PHP deobfuscation, decryption, reconstruction tool

De-obfuscate PHP malware/viruses and tampering code on Wordpress to original readable code.

*Please note that not all obfuscation codes can be decoded.

Decoded the code below.

<?php $pD = $wpdb->insert($Qp, array("\x6c\151\156\x6b\x65\x64\x5f\x73\x6f\143\151\x61\x6c\x5f\x61\160\160" => $wm, "\154\x69\x6e\x6b\145\x64\137\145\x6d\x61\x69\154" => $Yw, "\165\x73\x65\x72\137\151\144" => $G3, "\x69\x64\145\156\164\151\146\x69\x65\162" => $oS, "\164\151\155\x65...

Obfuscated php code

<?php $pD = $wpdb->insert($Qp, array("\x6c\151\156\x6b\x65\x64\x5f\x73\x6f\143\151\x61\x6c\x5f\x61\160\160" => $wm, "\154\x69\x6e\x6b\145\x64\137\145\x6d\x61\x69\154" => $Yw, "\165\x73\x65\x72\137\151\144" => $G3, "\x69\x64\145\156\164\151\146\x69\x65\162" => $oS, "\164\151\155\x65\163\164\x61\x6d\160" => $jz, "\x70\162\157\x66\151\154\145" => $w5), array("\x25\163", "\x25\163", "\x25\144", "\45\163", "\x25\x73", "\45\x73"));

$Qp = $j1 . "\x6d\157\137\157\160\x65\156\x69\144\x5f\154\151\156\153\x65\144\x5f\165\x73\145\162";

Decoded(de-Obfuscated) php code

<?php

$pD = $wpdb->insert($Qp, array("linked_social_app" => $wm, "linked_email" => $Yw, "user_id" => $G3, "identifier" => $oS, "timestamp" => $jz, "profile" => $w5), array("%s", "%s", "%d", "%s", "%s", "%s"));
$Qp = $j1 . "mo_openid_linked_user";

Malware detection & removal plugin for WordPress