Japanese English

PHP deobfuscation, decryption, reconstruction tool

De-obfuscate PHP malware/viruses and tampering code on Wordpress to original readable code.

*Please note that not all obfuscation codes can be decoded.

Decoded the code below.

<?php /* M4DI~UciH4 */ eval(base64_decode('JE1hZGlHYW56YWJwbW44aDA9ZmlsZShwcmVnX3JlcGxhY2UoIkBcKC4qXCguKiRAIiwiIixfX0ZJTEVfXykpOw0KICAgICAgICAgICAgICAgICAgICBpZihwcmVnX3JlcGxhY2UoIkBcKC4qXCguKiRAIiwiIixfX0ZJTEVfXyk9PV9fRklMRV9fIG9yDQogICAgICAgICAgICAgICAgICAgIHByZWdfcmVwbGFjZSgiQFwoLipcKC4qJEAiLC...



Obfuscated php code

<?php /* M4DI~UciH4 */ eval(base64_decode('JE1hZGlHYW56YWJwbW44aDA9ZmlsZShwcmVnX3JlcGxhY2UoIkBcKC4qXCguKiRAIiwiIixfX0ZJTEVfXykpOw0KICAgICAgICAgICAgICAgICAgICBpZihwcmVnX3JlcGxhY2UoIkBcKC4qXCguKiRAIiwiIixfX0ZJTEVfXyk9PV9fRklMRV9fIG9yDQogICAgICAgICAgICAgICAgICAgIHByZWdfcmVwbGFjZSgiQFwoLipcKC4qJEAiLCIiLF9fTElORV9fKSAhPSAzKWRpZSgiZXZhbCBldmFsIGV2YWwgZXZhbCBldmFsIGV2YWwgZXZhbCBldmFsIGV2YWwgZXZhbCAkbWFkaWdhbnogRVJST1IgV2t3a3drd3drd2sgamFuZ2FuIFJlY29kZSBBbmppbmcgLCBGdWNrIFlvdS4uRVJST1IgV2t3a3drd3drd2sgamFuZ2FuIFJlY29kZSBBbmppbmcgLCBGdWNrIFlvdS4uRVJST1IgV2t3a3drd3drd2sgamFuZ2FuIFJlY29kZSBBbmppbmcgLCBGdWNrIFlvdS4uRVJST1IgV2t3a3drd3drd2sgamFuZ2FuIFJlY29kZSBBbmppbmcgLCBGdWNrIFlvdS4uRVJST1IgV2t3a3drd3drd2sgamFuZ2FuIFJlY29kZSBBbmppbmcgLCBGdWNrIFlvdS4uRVJST1IgV2t3a3drd3drd2sgamFuZ2FuIFJlY29kZSBBbmppbmcgLCBGdWNrIFlvdS4uZXZhbCBldmFsIGV2YWwgZXZhbCAkY29rIEJhaGFoYWhhYSBoYWhhYWhhZ2FnIGhhaGFoYWhhaGFnYWFhIGV2YWwgZXZhbCBldmFsIGV2YWwgZXZhbCBldmFsIGV2YWwgZXZhbCBldmFsIGV2YWwgJG1hZGlnYW56IEVSUk9SIFdrd2t3a3d3a3drIGphbmdhbiBSZWNvZGUgQW5qaW5nICwgRnVjayBZb3UuLkVSUk9SIFdrd2t3a3d3a3drIGphbmdhbiBSZWNvZGUgQW5qaW5nICwgRnVjayBZb3UuLkVSUk9SIFdrd2t3a3d3a3drIGphbmdhbiBSZWNvZGUgQW5qaW5nICwgRnVjayBZb3UuLkVSUk9SIFdrd2t3a3d3a3drIGphbmdhbiBSZWNvZGUgQW5qaW5nICwgRnVjayBZb3UuLkVSUk9SIFdrd2t3a3d3a3drIGphbmdhbiBSZWNvZGUgQW5qaW5nICwgRnVjayBZb3UuLkVSUk9SIFdrd2t3a3d3a3drIGphbmdhbiBSZWNvZGUgQW5qaW5nICwgRnVjayBZb3UuLmV2YWwgZXZhbCBldmFsIGV2YWwgJGNvayBCYWhhaGFoYWEgaGFoYWFoYWdhZyBoYWhhaGFoYWhhZ2FhYSBldmFsIGV2YWwgZXZhbCBldmFsIGV2YWwgZXZhbCBldmFsIGV2YWwgZXZhbCBldmFsICRtYWRpZ2FueiBFUlJPUiBXa3drd2t3d2t3ayBqYW5nYW4gUmVjb2RlIEFuamluZyAsIEZ1Y2sgWW91Li5FUlJPUiBXa3drd2t3d2t3ayBqYW5nYW4gUmVjb2RlIEFuamluZyAsIEZ1Y2sgWW91Li5FUlJPUiBXa3drd2t3d2t3ayBqYW5nYW4gUmVjb2RlIEFuamluZyAsIEZ1Y2sgWW91Li5FUlJPUiBXa3drd2t3d2t3ayBqYW5nYW4gUmVjb2RlIEFuamluZyAsIEZ1Y2sgWW91Li5FUlJPUiBXa3drd2t3d2t3ayBqYW5nYW4gUmVjb2RlIEFuamluZyAsIEZ1Y2sgWW91Li5FUlJPUiBXa3drd2t3d2t3ayBqYW5nYW4gUmVjb2RlIEFuamluZyAsIEZ1Y2sgWW91Li5ldmFsIGV2YWwgZXZhbCBldmFsICRjb2sgQmFoYWhhaGFhIGhhaGFhaGFnYWcgaGFoYWhhaGFoYWdhYWEgZXZhbCBldmFsIGV2YWwgZXZhbCBldmFsIGV2YWwgZXZhbCBldmFsIGV2YWwgZXZhbCAkbWFkaWdhbnogRVJST1IgV2t3a3drd3drd2sgamFuZ2FuIFJlY29kZSBBbmppbmcgLCBGdWNrIFlvdS4uRVJST1IgV2t3a3drd3drd2sgamFuZ2FuIFJlY29kZSBBbmppbmcgLCBGdWNrIFlvdS4uRVJST1IgV2t3a3drd3drd2sgamFuZ2FuIFJlY29kZSBBbmppbmcgLCBGdWNrIFlvdS4uRVJST1IgV2t3a3drd3drd2sgamFuZ2FuIFJlY29kZSBBbmppbmcgLCBGdWNrIFlvdS4uRVJST1IgV2t3a3drd3drd2sgamFuZ2FuIFJlY29kZSBBbmppbmcgLCBGdWNrIFlvdS4uRVJST1IgV2t3a3drd3drd2sgamFuZ2FuIFJlY29kZSBBbmppbmcgLCBGdWNrIFlvdS4uZXZhbCBldmFsIGV2YWwgZXZhbCAkY29rIEJhaGFoYWhhYSBoYWhhYWhhZ2FnIGhhaGFoYWhhaGFnYWFhIik7'));eval(base64_decode('aWYoIWZ1bmN0aW9uX2V4aXN0cygiTWFkaUdhbnpkYXc4NGNlMSIpKXtmdW5jdGlvbiBNYWRpR2FuemRhdzg0Y2UxKCRhLCRiKXskYz1hcnJheSgzMTkyLDI5NiwzMiwyNjYpO2lmKCRiPT03MzQpeyRkPXN1YnN0cigkYSwkY1swXSskY1sxXSwkY1syXSk7fWVsc2VpZigkYj09MjUyKXskZD1zdWJzdHIoJGEsJGNbMF0sJGNbMV0pO31lbHNlaWYoJGI9PTc0NSl7JGQ9dHJpbShzdWJzdHIoJGEsJGNbMF0rJGNbMV0rJGNbMl0pKTt9cmV0dXJuJGQ7fX0='));eval(base64_decode(MadiGanzdaw84ce1($MadiGanzabpmn8h0[0],252)));eval(MadiGanze860y2rl(MadiGanzdaw84ce1($MadiGanzabpmn8h0[0],745),MadiGanzdaw84ce1($MadiGanzabpmn8h0[0],734),$MadiGanzabpmn8h0));__halt_compiler();VSz2mLtaWYoIWZ1bmN0aW9uX2V4aXN0cygiTWFkaUdhbnplODYweTJybCIpKXtmdW5jdGlvbiBNYWRpR2FuemU4NjB5MnJsKCRhLCRiLCRjKXskZD1pbXBsb2RlKCRjKTskZD1wcmVnX3JlcGxhY2UoIi9fX2hhbHRfY29tcGlsZXIuKi8iLCIiLCRkKTtpZigkYj09aGFzaCgidGlnZXIxMjgsMyIsIiRkIikpe3JldHVybihnemluZmxhdGUoYmFzZTY0X2RlY29kZSgkYSkpKTt9ZWxzZXtkaWUoKTt9fX0=4c0feb4346f2babd517c97c00cec6e2fs7ezsS/IKOBKTc7IV1DySM3JyVcIzy/KSVFUsuYCAA==

Decoded(de-Obfuscated) php code

<?php

eval {
    $MadiGanzabpmn8h0 = array(0 => "<?php /* M4DI~UciH4 */ eval(base64_decode('JE1hZGlHYW56YWJwbW44aDA9ZmlsZShwcmVnX3JlcGxhY2UoIkBcKC4qXCguKiRAIiwiIixfX0ZJTEVfXykpOw0KICAgICAgICAgICAgICAgICAgICBpZihwcmVnX3JlcGxhY2UoIkBcKC4qXCguKiRAIiwiIixfX0ZJTEVfXyk9PV9fRklMRV9fIG9yDQogICAgICAgICAgICAgICAgICAgIHByZWdfcmVwbGFjZSgiQFwoLipcKC4qJEAiLCIiLF9fTElORV9fKSAhPSAzKWRpZSgiZXZhbCBldmFsIGV2YWwgZXZhbCBldmFsIGV2YWwgZXZhbCBldmFsIGV2YWwgZXZhbCAkbWFkaWdhbnogRVJST1IgV2t3a3drd3drd2sgamFuZ2FuIFJlY29kZSBBbmppbmcgLCBGdWNrIFlvdS4uRVJST1IgV2t3a3drd3drd2sgamFuZ2FuIFJlY29kZSBBbmppbmcgLCBGdWNrIFlvdS4uRVJST1IgV2t3a3drd3drd2sgamFuZ2FuIFJlY29kZSBBbmppbmcgLCBGdWNrIFlvdS4uRVJST1IgV2t3a3drd3drd2sgamFuZ2FuIFJlY29kZSBBbmppbmcgLCBGdWNrIFlvdS4uRVJST1IgV2t3a3drd3drd2sgamFuZ2FuIFJlY29kZSBBbmppbmcgLCBGdWNrIFlvdS4uRVJST1IgV2t3a3drd3drd2sgamFuZ2FuIFJlY29kZSBBbmppbmcgLCBGdWNrIFlvdS4uZXZhbCBldmFsIGV2YWwgZXZhbCAkY29rIEJhaGFoYWhhYSBoYWhhYWhhZ2FnIGhhaGFoYWhhaGFnYWFhIGV2YWwgZXZhbCBldmFsIGV2YWwgZXZhbCBldmFsIGV2YWwgZXZhbCBldmFsIGV2YWwgJG1hZGlnYW56IEVSUk9SIFdrd2t3a3d3a3drIGphbmdhbiBSZWNvZGUgQW5qaW5nICwgRnVjayBZb3UuLkVSUk9SIFdrd2t3a3d3a3drIGphbmdhbiBSZWNvZGUgQW5qaW5nICwgRnVjayBZb3UuLkVSUk9SIFdrd2t3a3d3a3drIGphbmdhbiBSZWNvZGUgQW5qaW5nICwgRnVjayBZb3UuLkVSUk9SIFdrd2t3a3d3a3drIGphbmdhbiBSZWNvZGUgQW5qaW5nICwgRnVjayBZb3UuLkVSUk9SIFdrd2t3a3d3a3drIGphbmdhbiBSZWNvZGUgQW5qaW5nICwgRnVjayBZb3UuLkVSUk9SIFdrd2t3a3d3a3drIGphbmdhbiBSZWNvZGUgQW5qaW5nICwgRnVjayBZb3UuLmV2YWwgZXZhbCBldmFsIGV2YWwgJGNvayBCYWhhaGFoYWEgaGFoYWFoYWdhZyBoYWhhaGFoYWhhZ2FhYSBldmFsIGV2YWwgZXZhbCBldmFsIGV2YWwgZXZhbCBldmFsIGV2YWwgZXZhbCBldmFsICRtYWRpZ2FueiBFUlJPUiBXa3drd2t3d2t3ayBqYW5nYW4gUmVjb2RlIEFuamluZyAsIEZ1Y2sgWW91Li5FUlJPUiBXa3drd2t3d2t3ayBqYW5nYW4gUmVjb2RlIEFuamluZyAsIEZ1Y2sgWW91Li5FUlJPUiBXa3drd2t3d2t3ayBqYW5nYW4gUmVjb2RlIEFuamluZyAsIEZ1Y2sgWW91Li5FUlJPUiBXa3drd2t3d2t3ayBqYW5nYW4gUmVjb2RlIEFuamluZyAsIEZ1Y2sgWW91Li5FUlJPUiBXa3drd2t3d2t3ayBqYW5nYW4gUmVjb2RlIEFuamluZyAsIEZ1Y2sgWW91Li5FUlJPUiBXa3drd2t3d2t3ayBqYW5nYW4gUmVjb2RlIEFuamluZyAsIEZ1Y2sgWW91Li5ldmFsIGV2YWwgZXZhbCBldmFsICRjb2sgQmFoYWhhaGFhIGhhaGFhaGFnYWcgaGFoYWhhaGFoYWdhYWEgZXZhbCBldmFsIGV2YWwgZXZhbCBldmFsIGV2YWwgZXZhbCBldmFsIGV2YWwgZXZhbCAkbWFkaWdhbnogRVJST1IgV2t3a3drd3drd2sgamFuZ2FuIFJlY29kZSBBbmppbmcgLCBGdWNrIFlvdS4uRVJST1IgV2t3a3drd3drd2sgamFuZ2FuIFJlY29kZSBBbmppbmcgLCBGdWNrIFlvdS4uRVJST1IgV2t3a3drd3drd2sgamFuZ2FuIFJlY29kZSBBbmppbmcgLCBGdWNrIFlvdS4uRVJST1IgV2t3a3drd3drd2sgamFuZ2FuIFJlY29kZSBBbmppbmcgLCBGdWNrIFlvdS4uRVJST1IgV2t3a3drd3drd2sgamFuZ2FuIFJlY29kZSBBbmppbmcgLCBGdWNrIFlvdS4uRVJST1IgV2t3a3drd3drd2sgamFuZ2FuIFJlY29kZSBBbmppbmcgLCBGdWNrIFlvdS4uZXZhbCBldmFsIGV2YWwgZXZhbCAkY29rIEJhaGFoYWhhYSBoYWhhYWhhZ2FnIGhhaGFoYWhhaGFnYWFhIik7'));eval(base64_decode('aWYoIWZ1bmN0aW9uX2V4aXN0cygiTWFkaUdhbnpkYXc4NGNlMSIpKXtmdW5jdGlvbiBNYWRpR2FuemRhdzg0Y2UxKCRhLCRiKXskYz1hcnJheSgzMTkyLDI5NiwzMiwyNjYpO2lmKCRiPT03MzQpeyRkPXN1YnN0cigkYSwkY1swXSskY1sxXSwkY1syXSk7fWVsc2VpZigkYj09MjUyKXskZD1zdWJzdHIoJGEsJGNbMF0sJGNbMV0pO31lbHNlaWYoJGI9PTc0NSl7JGQ9dHJpbShzdWJzdHIoJGEsJGNbMF0rJGNbMV0rJGNbMl0pKTt9cmV0dXJuJGQ7fX0='));eval(base64_decode(MadiGanzdaw84ce1(\$MadiGanzabpmn8h0[0],252)));eval(MadiGanze860y2rl(MadiGanzdaw84ce1(\$MadiGanzabpmn8h0[0],745),MadiGanzdaw84ce1(\$MadiGanzabpmn8h0[0],734),\$MadiGanzabpmn8h0));__halt_compiler();VSz2mLtaWYoIWZ1bmN0aW9uX2V4aXN0cygiTWFkaUdhbnplODYweTJybCIpKXtmdW5jdGlvbiBNYWRpR2FuemU4NjB5MnJsKCRhLCRiLCRjKXskZD1pbXBsb2RlKCRjKTskZD1wcmVnX3JlcGxhY2UoIi9fX2hhbHRfY29tcGlsZXIuKi8iLCIiLCRkKTtpZigkYj09aGFzaCgidGlnZXIxMjgsMyIsIiRkIikpe3JldHVybihnemluZmxhdGUoYmFzZTY0X2RlY29kZSgkYSkpKTt9ZWxzZXtkaWUoKTt9fX0=4c0feb4346f2babd517c97c00cec6e2fs7ezsS/IKOBKTc7IV1DySM3JyVcIzy/KSVFUsuYCAA==");
    if (true) {
        die("eval eval eval eval eval eval eval eval eval eval {$madiganz} ERROR Wkwkwkwwkwk jangan Recode Anjing , Fuck You..ERROR Wkwkwkwwkwk jangan Recode Anjing , Fuck You..ERROR Wkwkwkwwkwk jangan Recode Anjing , Fuck You..ERROR Wkwkwkwwkwk jangan Recode Anjing , Fuck You..ERROR Wkwkwkwwkwk jangan Recode Anjing , Fuck You..ERROR Wkwkwkwwkwk jangan Recode Anjing , Fuck You..eval eval eval eval {$cok} Bahahahaa hahaahagag hahahahahagaaa eval eval eval eval eval eval eval eval eval eval {$madiganz} ERROR Wkwkwkwwkwk jangan Recode Anjing , Fuck You..ERROR Wkwkwkwwkwk jangan Recode Anjing , Fuck You..ERROR Wkwkwkwwkwk jangan Recode Anjing , Fuck You..ERROR Wkwkwkwwkwk jangan Recode Anjing , Fuck You..ERROR Wkwkwkwwkwk jangan Recode Anjing , Fuck You..ERROR Wkwkwkwwkwk jangan Recode Anjing , Fuck You..eval eval eval eval {$cok} Bahahahaa hahaahagag hahahahahagaaa eval eval eval eval eval eval eval eval eval eval {$madiganz} ERROR Wkwkwkwwkwk jangan Recode Anjing , Fuck You..ERROR Wkwkwkwwkwk jangan Recode Anjing , Fuck You..ERROR Wkwkwkwwkwk jangan Recode Anjing , Fuck You..ERROR Wkwkwkwwkwk jangan Recode Anjing , Fuck You..ERROR Wkwkwkwwkwk jangan Recode Anjing , Fuck You..ERROR Wkwkwkwwkwk jangan Recode Anjing , Fuck You..eval eval eval eval {$cok} Bahahahaa hahaahagag hahahahahagaaa eval eval eval eval eval eval eval eval eval eval {$madiganz} ERROR Wkwkwkwwkwk jangan Recode Anjing , Fuck You..ERROR Wkwkwkwwkwk jangan Recode Anjing , Fuck You..ERROR Wkwkwkwwkwk jangan Recode Anjing , Fuck You..ERROR Wkwkwkwwkwk jangan Recode Anjing , Fuck You..ERROR Wkwkwkwwkwk jangan Recode Anjing , Fuck You..ERROR Wkwkwkwwkwk jangan Recode Anjing , Fuck You..eval eval eval eval {$cok} Bahahahaa hahaahagag hahahahahagaaa");
    }
};
eval {
    if (!function_exists("MadiGanzdaw84ce1")) {
        function MadiGanzdaw84ce1($a, $b)
        {
            $c = array(3192, 296, 32, 266);
            if ($b == 734) {
                $d = substr($a, 3488, $c[2]);
            } elseif ($b == 252) {
                $d = substr($a, $c[0], $c[1]);
            } elseif ($b == 745) {
                $d = trim(substr($a, 3520));
            }
            return $d;
        }
    }
};
eval(base64_decode(MadiGanzdaw84ce1($MadiGanzabpmn8h0[0], 252)));
eval(MadiGanze860y2rl(MadiGanzdaw84ce1($MadiGanzabpmn8h0[0], 745), MadiGanzdaw84ce1($MadiGanzabpmn8h0[0], 734), $MadiGanzabpmn8h0));
__halt_compiler();VSz2mLtaWYoIWZ1bmN0aW9uX2V4aXN0cygiTWFkaUdhbnplODYweTJybCIpKXtmdW5jdGlvbiBNYWRpR2FuemU4NjB5MnJsKCRhLCRiLCRjKXskZD1pbXBsb2RlKCRjKTskZD1wcmVnX3JlcGxhY2UoIi9fX2hhbHRfY29tcGlsZXIuKi8iLCIiLCRkKTtpZigkYj09aGFzaCgidGlnZXIxMjgsMyIsIiRkIikpe3JldHVybihnemluZmxhdGUoYmFzZTY0X2RlY29kZSgkYSkpKTt9ZWxzZXtkaWUoKTt9fX0=4c0feb4346f2babd517c97c00cec6e2fs7ezsS/IKOBKTc7IV1DySM3JyVcIzy/KSVFUsuYCAA==

Malware detection & removal plugin for WordPress

（C）2020 Wordpress Doctor All rights reserved.