Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

<?php eval("\x65\x76\x61\x6C\x28\x67\x7A\x69\x6E\x66\x6C\x61\x74\x65\x28\x62\x61\x73\x65\..

Decoded Output download

?><?php
include('config.php');


$time = time();
$unvarcryter = md5(md5($APIKEY.$time.'5r64z6ht546rt54hzz9r4yj9ze849htrz849z4g8'));
$url = 'http://app.privateheberg.fr/BZPAY/apicheck.php?APIKEY='.$APIKEY.'&checktime='.$time.'';
  
// Provider only likes Firefox
$agent = "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.124 Safari/537.36";
ini_set("user_agent", $agent);
$ch = curl_init(); 
curl_setopt($ch, CURLOPT_URL,$url);
curl_setopt($ch, CURLOPT_REFERER, $SITEURL);
curl_setopt($ch, CURLOPT_USERAGENT, $agent);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$output = curl_exec($ch);
curl_close($ch);
$apicheck = $output;
if($apicheck != $unvarcryter) {
     echo '<div style="margin-top:170px;"><center>Please Check your API KEY</center></div>';
	    	exit();
}
if (isset($_GET['action'])) {
   ############################################################################
    if ($_GET['action'] == "postedform") {
	############################################################################
	if (isset($_GET['email'])) {
	    if (!filter_var($_GET['email'], FILTER_VALIDATE_EMAIL)) {
		echo '<div style="margin-top:170px;"><center>' . $lang['0'] . '</center></div>
	    <div id="thisstyle" style="width:200px;margin:auto;height:50px;line-height:50px;font-size:16px;" align="center" onclick="getotourl(\'action=default\')">' . $lang['1'] . '</div>';
		exit();
	    }
	############################################################################
	    if (isset($_GET['prix'])) {
		if (!is_numeric($_GET['prix'])) {
		    echo '<div style="margin-left:50px;margin-top:180px;line-height:50px;">' . $lang['2'] . '</div>
	    <div id="thisstyle" style="width:200px;margin-left:300px;height:50px;line-height:50px;font-size:16px;" align="center" onclick="getotourl(\'action=default\')">' . $lang['1'] . '</div>';
		    exit();
		}
		$paieid = time() + rand(0, 500);
		$email = $_GET['email']; // rcupration de l'adresse envoye avec le formulaire (ton champ de texte doit s'appeler "email")
		$prix = $_GET['prix'];
		$query = "SELECT COUNT(*) FROM Accounts WHERE email='" . $email . "'";
		$query = sqlsrv_query($conn, $query);
		$num = sqlsrv_fetch_array($query);
		if ($num['0'] != "0") {
		    $file = fopen("log/" . $paieid . ".txt", "w"); // ouvre le fichier en criture
		    fwrite($file, '!mail!' . $email . '!mail!'); // ecrit l'e-mail dans le fichier
		    fwrite($file, '!price!' . $prix . '!price!'); // ecrit l'e-mail dans le fichier
		    fclose($file); // ferme le fichier


		    echo '<form action="' . $PAYPALIPN . '" method="post">
    <table border="0">
	<tr>
	    <td>
		<input name="currency_code" type="hidden" value="' . $DEVISE . '" />
		<input name="shipping" type="hidden" value="0.00" />
		<input name="tax" type="hidden" value="0.00" />
		<input name="return" type="hidden" value="' . $SITEURL . 'index.php?pay=1" />
		<input name="cancel_return" type="hidden" value="' . $SITEURL . 'index.php?pay=0" />
		<input name="notify_url" type="hidden" value="' . $SITEURL . 'ipn.php" />
		<input name="cmd" type="hidden" value="_xclick" />
		<input name="business" type="hidden" value="' . $PAYPALADDR . '" />
		<input name="item_name" type="hidden" value=" Commande: ' . $paieid . '"/>
		<input type="hidden" value="' . $_GET['prix'] . '" name="amount"/>
		<input name="no_note" type="hidden" value="2" />
		<input name="lc" type="hidden" value="FR" />
		<input name="bn" type="hidden" value="PP-BuyNowBF" />
	    </td>  
	</tr>  
	<tr>
	    <td><input id="thisstyle" style="width:200px;margin-left:300px;margin-top:180px;height:50px;line-height:50px;" type="submit" style="width:150px;" width="120px" class="btn btn-primary" value="' . $lang['3'] . '" /></td>
	</tr>
    </table>
</form>';
		} else {
		    echo '<div style="margin-left:50px;margin-top:180px;line-height:50px;">' . $lang['4'] . '</div>
	    <div id="thisstyle" style="width:200px;margin-left:300px;height:50px;line-height:50px;font-size:16px;" align="center" onclick="getotourl(\'action=default\')">' . $lang['1'] . '</div>';
		}
		echo '<script type="text/javascript">clearInterval(interval);</script>';
	    }
	}
    } 
    ############################################################################
    elseif ($_GET['action'] == "default") {
	echo '
<script tyle="text/javascript">
function gcvalues() {

if (IsNumeric(document.getElementById("prix").value)) {

var fully = (document.getElementById("prix").value*' . $PRICEFORON . ');
document.getElementById("gcresult").innerHTML = Math.round(fully);
} else {
document.getElementById("gcresult").innerHTML = "' . $lang['9'] . '";

}
} </script>
<form method="POST" id="cmdform" action="">
    <table border="0" align="right" width="100%">
	<tr>
	    <td colspan="3">
		<p id="red" align="center"><font size="8">' . $EMULATORNAME . '</font></td>
	</tr>
	<tr>
	    <td colspan="3" height="32">
		<p align="center">' . $lang['5'] . '</td>
	</tr>
	<tr style="height:70px;">
	    <td style="width:290px" >
		<p align="right">' . $lang['6'] . ':&nbsp;&nbsp;&nbsp;&nbsp;</td>
	    <td colspan="2"><input type="text" name="email" size="20"></td>
	</tr>
	<tr style="height:70px;">
	    <td>
		<p align="right">' . $lang['7'] . ':&nbsp;&nbsp;&nbsp;&nbsp;</td>
	    <td colspan="2" ><input id="prix" type="text" name="prix" size="20"></td>
	</tr>
	<tr style="height:70px;">
	    <td><p align="right">GC:&nbsp;&nbsp;&nbsp;&nbsp;</td>
	    <td width="1px" id="gcresult"></td>
	    <td><img width="32px" src="img/gc.png"></img></td>
	</tr>
	<tr>
	    <td colspan="3">
		<div  id="thisstyle" onclick="getotourl(\'action=postedform&\' + $(\'#cmdform\').serialize());" style="width:170px;margin:auto;" >' . $lang['8'] . '</div>

	    </td>
	</tr>
    </table>

</form>
<div style="opacity:0.5;color:#888;font-size:13px;text-align:right;top:470px;left:530px;position:absolute">By Marc Moreau (Skype: mamarcmoreau)</div><script tyle="text/javascript">  

var interval = setInterval(gcvalues, 15);</script>
';
    }
}
?>

Did this file decode correctly?

Original Code

<?php
eval("\x65\x76\x61\x6C\x28\x67\x7A\x69\x6E\x66\x6C\x61\x74\x65\x28\x62\x61\x73\x65\x36\x34\x5F\x64\x65\x63\x6F\x64\x65\x28'TVfHDoXKDf2XbJKIBb0pyoJ+gUvv6G3o9dL714fkRUqELGtsj1jY5/hMcST93/7yx0Xgf1wk8Xr4Ne6PC6FeT74x5vX0a8JrxJ+5f9eQ2J93/lOH/DeG/hlD3zr0zePie/5vHfHv3P+dEeqvl1/AfBV+uxIKFRhfqp/kbJlwosjHc7AkBkKCXsA8XitzkHBbZS10rno9D/fhNFEQx+7PaV6EA3w+mE2fJQ99acMcXM2lDRBqMaGUBjKmAMVMh98BPhZI9BYIeqNLgbRUfq4YpL4P2AxkCnbsZ14AnCzzO/S/lESmQzIa7THZXcFeK0WCW1Yis0jM9A9eVE1sa637ipP0MXLI6alkPouKVD96PRkK59H7efDTNSwLS9XhUamkciy1eSihl/pJnR6ABy4U0Z06TG76R9vohlrXFj1qbE/YnzI9xLE80rFkojGrgp5wIEjCNKUTIeXeB9mnKHWAIFAQtS5oA1g0OkPjQjBJki8LC2gmvcEHe71aNxy2c+S7bcbIQnhPEays5LJLyV4WXYDJTJ3Ecu56Npp/hQrgZrhcSo8zV36MxUFlwHobtNHRQXXCpdFkdJaLLe7Hz4zMXlxrJcsZOhafpSx/R78fE3GMZlTN12fTx/H29EcGls/YCq/YLYj79xiVgOVprr1rqEEpwK237Mf1LSODn8AMGgW0DeCeSl9yCJRPpKNoxrgz9Acsuo2ntAD2jF8Ym959onO+OB1CET7GK4M1X6Rj6aXQfsWTKTVpaMAZdYFDZxLfLJoOvXh5HCM7zDtb/O4yjp1njbkj/oF51FME2fxq2vXwsynElQ/nW9b0eyBHWdNW6hlXYsAfByysHFj7Xnn2ZeFYo0Q6WruAcxzUka0Eyxj1WHvT+lWTa1ooT38hqKjdCS1ZSwxWcqdPZlP/ZFCRq3ojqHHH+kEml43Qnh2CJyANYuvGsJDE2/MolVLV8Vtqqc8GWXOEuN7QFGXj86jgoGHil6YiDBvs90mjARqLuus+NARFFdK1X5YhuLlhJfL1ou2+mt5wY3RKF3sUvhu8so+j0oOcZleCi8fSLE85GXppK4yeBrT2BWpf13n1juRnw9LJttYU27+Uku/aQVBoK9s9eSUy9FMDYulpZaNsfxUJSM/lANUB1CDwuE120zrq38WcO3B+YuycPakuF2ZzcdWpNhJgF1GhCPMqBMoHUVisTlpanrczZ/IoT/PcUpG069G6/feZE9KMp07KFiqqfwzwM+zZoiWsRDr+QEOLdjkdOxqJ4uXsAn6MbnSYrd8tgvEDjG0/PknT1lmjiiuOu7xwC9XUkHIUTupU5UPzBTWZknHGLVcNYXlHF1y4tYxIslXTteHyGWY73Mt8Tc5tKio5sFNd4Bab212wcZ90bIUAKUtW20PVn8FLmrNsSXq3EH8SaARlMrTB2xl5bJHCOwBgZdsFqtilyomIr3xq0zW1jjQVrGSdknXQm1EkN+loKeXLkUbJeYV3ncV2sCYxcRsdA0OKmj+5n+MpfzK3Y2GYjga7ka/BKj5SOzXEaMcBUh2Xxzy8cV65KKCt90hKSnxnxTrm60m3bxGA3Pi7VWiN9EsuhyofWyXyNpgmYuBERuieCwJZfYumrvDGSfdbMsj5OBnvyWY0UnsyFzCgB6ziKw19bQMWwjD1/i5lOCBj95Uf5Jsl2spdgDyJZPcYpzDpzxodMvLXzQ9PGlYzvZxGDsnOrY1O1re1xeipWTxQgIKT77HnbGoQkKEG+4fpJVUNOLqbpgs3nmnC+sEhZYDTOsVDUSzOz0CZKn6cqrrrcuOIrslusxxwwcwjqVmjst33tBUZ+VT1fRkJo++HIHzERKZPeH4HxYa94OVTVXBJg7vr+1FTNJEp2S1yBGtpgfjFGmQZMD2HeRIWlaSvcC34kBQQsaGG8MqYAxu87JGfothAsys3cihfEGkH7XjK4KegS5TW5BqT4sbFTu0MwOem2jVQ+GtlBIvx8LIOpFSlPM0wNXFZ5VWK5N36DWkuYze7a+2v7toys0SUqDX6GBJcVt3l5Rug5QgtVDlrmkkxKAZl4GzTgjRJ5WSnP6eSQoiaWp8GXiBkrkfrKwS6fN1orW4xZGI+dNGakrzIcUSrfzuLSC8ryGGKvTPNfwzDrkRsPraGU0cxtVicMBB2aMKCevxtlJTNG7bazjOgbuyfmSMBpiKMqauy2m69eQE4IyL1+wkJquCq68WjU9b1Vcx9uMBDatC+puYjpHJRGWazzDESsjkv7lEswPkhoMkjI0rynjBj+g6XYq8wFUNFOPAZqxs9FL+wutsPcjNYy65b9DVEmVBih0WYsYKudk24aJ0B51SB5/ltln8dyYXRyjBPiTi7T1J5eW6r8atfuHsSpRINkbY2tJoEKf3O4u/kQSgGu7Z/4L590zZIN19bBSFcCM++TYjd39KqfHPb0ZPHkBsVe1qXpSuigBFkPb1TIvNg4X0sMGqIpnMxJqaVK3YvJ1akTjutda7eyePcupaa9SGMneDsrlrInzMzLQ7FHjkjd1NgR6mp0VkjWhpWsFwMSWZHTMAcuhz+yi7VKBe2UKRqkWzPT36bexzwxRQfYpcn6talFS1/cN4gherscT8VcQPVNTM7FqihC9G28cCSZLX0A+X8IqhTImv8IAF+L1kn5hvgMd39RUTVutK6KOFoWA5xq4tp6Z+7wor4KguT3l4FQa9T+VOBMdgUhlS7AeezCqvRD+xDuRx5XtVinztogTCmjYf+tYWAbNSBlFVqF6M0IvK6JiLHnKT90hqNfISFNixW/gxBTvUK316d1ofRWKZ956HnLebNUkpMwgGIZ16xvgHm088kARMHFx67++ynzQ9EZh2W5kxoq8KxXDCUqNI7qM/uHLmclN82gHez5s4q0NZBus3qKiQR/RKrKvOQOlcMITYHgTky4a7j29bBhvEgR3X5VTgIlAeDD+iuv8mdHAMCJTA3CP9ah6GS+FT2Cl1t5KqhL0Xwm17u4f5DG9CJQgrsTzUi2mwAflHQJsiCyXv5zNb8LoDZcDqD7VEVoiY/sRk8egak3wH81+DQfl6I5IQ7D6xfhoZeQFOHYHdlLMvYwa2Se+1KAqQAlod4Is/3kFXoEuxGNJ/+cS1nv9KpZEgXd//Gb6OiF6J/OfhsSpIl40iEg4PB1frdclDXeLGMrB2EkmJOJ1/n80mbO1ShCmRvvtCQJR4kqGY4Wi9BAymUlp+TPnW1E2CcPQbVqOE+oZV6Sg2Mas+zD06pEZggWa8bI+Bprwx8+HQVK0IWn3f3oyfGWQlN1Wm2bqqn5XgyvIK5/DQnEgrh9ItkIF67RzJhjjC7mSojUWJfrRVAZ1o8brG+in81oU+JkFZymVq0U34kgon0wZmeZk9nyzPR2kvaRDIHLlHjHr1Erh0s9dhQArOZXKQCmHqFcwLmZ2uPMeB+J1he6iA80oSVHyRfw4ZnbvuGH8/a4z2vA3+V8ZnRiphbclArt04e4N0GzNwdHVsUYU9ED/x9kXwp5vznP//6voro/xnK/uXv//gX'\x29\x29\x29\x3B");
?>

Function Calls

gzinflate 5
dxgvrl05801 1
base64_decode 5

Variables

$a base64_decode
$b gzinflate
$str 3VjrctpIFv6Nq/wObYWJxKwtwIAv3FLYwRkqvlAYj2t2skW1pQb1RLdptTB4..

Stats

MD5 e43dc546fc924b3894b4dd28ad38fd9f
Eval Count 9
Decode Time 189 ms