Japanese English

PHP deobfuscation, decryption, reconstruction tool

De-obfuscate PHP malware/viruses and tampering code on Wordpress to original readable code.

*Please note that not all obfuscation codes can be decoded.

Decoded the code below.

<?php /*** PHP Encode v1.0 by zeura.com ***/ $XnNhAWEnhoiqwciqpoHH=file(__FILE__);eval(base64_decode("aWYoIWZ1bmN0aW9uX2V4aXN0cygiWWl1bklVWTc2YkJodWhOWUlPOCIpKXtmdW5jdGlvbiBZaXVuSVVZNzZiQmh1aE5ZSU84KCRnLCRiPTApeyRhPWltcGxvZGUoIlxuIiwkZyk7JGQ9YXJyYXkoNjU1LDIzNiw0MCk7aWYoJGI9PTApICRmPXN1YnN0cigkYSw...



Obfuscated php code

<?php /*** PHP Encode v1.0 by zeura.com ***/ $XnNhAWEnhoiqwciqpoHH=file(__FILE__);eval(base64_decode("aWYoIWZ1bmN0aW9uX2V4aXN0cygiWWl1bklVWTc2YkJodWhOWUlPOCIpKXtmdW5jdGlvbiBZaXVuSVVZNzZiQmh1aE5ZSU84KCRnLCRiPTApeyRhPWltcGxvZGUoIlxuIiwkZyk7JGQ9YXJyYXkoNjU1LDIzNiw0MCk7aWYoJGI9PTApICRmPXN1YnN0cigkYSwkZFswXSwkZFsxXSk7ZWxzZWlmKCRiPT0xKSAkZj1zdWJzdHIoJGEsJGRbMF0rJGRbMV0sJGRbMl0pO2Vsc2UgJGY9dHJpbShzdWJzdHIoJGEsJGRbMF0rJGRbMV0rJGRbMl0pKTtyZXR1cm4oJGYpO319"));eval(base64_decode(YiunIUY76bBhuhNYIO8($XnNhAWEnhoiqwciqpoHH)));eval(ZsldkfhGYU87iyihdfsow(YiunIUY76bBhuhNYIO8($XnNhAWEnhoiqwciqpoHH,2),YiunIUY76bBhuhNYIO8($XnNhAWEnhoiqwciqpoHH,1)));__halt_compiler();aWYoIWZ1bmN0aW9uX2V4aXN0cygiWnNsZGtmaEdZVTg3aXlpaGRmc293Iikpe2Z1bmN0aW9uIFpzbGRrZmhHWVU4N2l5aWhkZnNvdygkYSwkaCl7aWYoJGg9PXNoYTEoJGEpKXtyZXR1cm4oZ3ppbmZsYXRlKGJhc2U2NF9kZWNvZGUoJGEpKSk7fWVsc2V7ZWNobygiRXJyb3I6IEZpbGUgTW9kaWZpZWQiKTt9fX0=bbcb6a8f56adf9414d051ad4806781edec173bf2XU+9asMwEN4NfocrFGSZuiJpS5yYrqUP0M7BcZRgcOwgy+kQMthuIUMfounPkLlbsZ9GQ0e9Qk9xoJBvkHS67+eOMc8DVX2reqdqPLe2dZ5LAbdAdLPTzbtuPnTzqZsvEmArTiW2ev2ra6xsi7mubYF7YgAus60oCfMc7rM5t601/iGWxSSJI8hlKPGaFWkk4yzFx5w7JvQCjD/tyEeNQTwD52wxGSMl4emBSimsYRpzh5hKla+/+x9VvqlqS2gAm3+t4LIQKXRqmSXZExfHMPL4cOf5hMIljiRWYeIc1nNh6A9o0Fmg08YsugrFeFoslo5ZaDQ6HRkzEYyBbkvdVrqtdfus25devzcY3vh/

Decoded(de-Obfuscated) php code

<?php

/*** PHP Encode v1.0 by zeura.com ***/
$XnNhAWEnhoiqwciqpoHH = array(0 => "<?php /*** PHP Encode v1.0 by zeura.com ***/ \$XnNhAWEnhoiqwciqpoHH=file(__FILE__);eval(base64_decode(\"aWYoIWZ1bmN0aW9uX2V4aXN0cygiWWl1bklVWTc2YkJodWhOWUlPOCIpKXtmdW5jdGlvbiBZaXVuSVVZNzZiQmh1aE5ZSU84KCRnLCRiPTApeyRhPWltcGxvZGUoIlxuIiwkZyk7JGQ9YXJyYXkoNjU1LDIzNiw0MCk7aWYoJGI9PTApICRmPXN1YnN0cigkYSwkZFswXSwkZFsxXSk7ZWxzZWlmKCRiPT0xKSAkZj1zdWJzdHIoJGEsJGRbMF0rJGRbMV0sJGRbMl0pO2Vsc2UgJGY9dHJpbShzdWJzdHIoJGEsJGRbMF0rJGRbMV0rJGRbMl0pKTtyZXR1cm4oJGYpO319\"));eval(base64_decode(YiunIUY76bBhuhNYIO8(\$XnNhAWEnhoiqwciqpoHH)));eval(ZsldkfhGYU87iyihdfsow(YiunIUY76bBhuhNYIO8(\$XnNhAWEnhoiqwciqpoHH,2),YiunIUY76bBhuhNYIO8(\$XnNhAWEnhoiqwciqpoHH,1)));__halt_compiler();aWYoIWZ1bmN0aW9uX2V4aXN0cygiWnNsZGtmaEdZVTg3aXlpaGRmc293Iikpe2Z1bmN0aW9uIFpzbGRrZmhHWVU4N2l5aWhkZnNvdygkYSwkaCl7aWYoJGg9PXNoYTEoJGEpKXtyZXR1cm4oZ3ppbmZsYXRlKGJhc2U2NF9kZWNvZGUoJGEpKSk7fWVsc2V7ZWNobygiRXJyb3I6IEZpbGUgTW9kaWZpZWQiKTt9fX0=bbcb6a8f56adf9414d051ad4806781edec173bf2XU+9asMwEN4NfocrFGSZuiJpS5yYrqUP0M7BcZRgcOwgy+kQMthuIUMfounPkLlbsZ9GQ0e9Qk9xoJBvkHS67+eOMc8DVX2reqdqPLe2dZ5LAbdAdLPTzbtuPnTzqZsvEmArTiW2ev2ra6xsi7mubYF7YgAus60oCfMc7rM5t601/iGWxSSJI8hlKPGaFWkk4yzFx5w7JvQCjD/tyEeNQTwD52wxGSMl4emBSimsYRpzh5hKla+/+x9VvqlqS2gAm3+t4LIQKXRqmSXZExfHMPL4cOf5hMIljiRWYeIc1nNh6A9o0Fmg08YsugrFeFoslo5ZaDQ6HRkzEYyBbkvdVrqtdfus25devzcY3vh/");
eval {
    if (!function_exists("YiunIUY76bBhuhNYIO8")) {
        function YiunIUY76bBhuhNYIO8($g, $b = 0)
        {
            $a = implode("\n", $g);
            $d = array(655, 236, 40);
            if ($b == 0) {
                $f = substr($a, $d[0], $d[1]);
            } elseif ($b == 1) {
                $f = substr($a, 891, $d[2]);
            } else {
                $f = trim(substr($a, 931));
            }
            return $f;
        }
    }
};
eval(base64_decode(YiunIUY76bBhuhNYIO8($XnNhAWEnhoiqwciqpoHH)));
eval(ZsldkfhGYU87iyihdfsow(YiunIUY76bBhuhNYIO8($XnNhAWEnhoiqwciqpoHH, 2), YiunIUY76bBhuhNYIO8($XnNhAWEnhoiqwciqpoHH, 1)));
__halt_compiler();aWYoIWZ1bmN0aW9uX2V4aXN0cygiWnNsZGtmaEdZVTg3aXlpaGRmc293Iikpe2Z1bmN0aW9uIFpzbGRrZmhHWVU4N2l5aWhkZnNvdygkYSwkaCl7aWYoJGg9PXNoYTEoJGEpKXtyZXR1cm4oZ3ppbmZsYXRlKGJhc2U2NF9kZWNvZGUoJGEpKSk7fWVsc2V7ZWNobygiRXJyb3I6IEZpbGUgTW9kaWZpZWQiKTt9fX0=bbcb6a8f56adf9414d051ad4806781edec173bf2XU+9asMwEN4NfocrFGSZuiJpS5yYrqUP0M7BcZRgcOwgy+kQMthuIUMfounPkLlbsZ9GQ0e9Qk9xoJBvkHS67+eOMc8DVX2reqdqPLe2dZ5LAbdAdLPTzbtuPnTzqZsvEmArTiW2ev2ra6xsi7mubYF7YgAus60oCfMc7rM5t601/iGWxSSJI8hlKPGaFWkk4yzFx5w7JvQCjD/tyEeNQTwD52wxGSMl4emBSimsYRpzh5hKla+/+x9VvqlqS2gAm3+t4LIQKXRqmSXZExfHMPL4cOf5hMIljiRWYeIc1nNh6A9o0Fmg08YsugrFeFoslo5ZaDQ6HRkzEYyBbkvdVrqtdfus25devzcY3vh/

Malware detection & removal plugin for WordPress

（C）2020 Wordpress Doctor All rights reserved.