PHP deobfuscation, decryption, reconstruction tool

De-obfuscate PHP malware/viruses and tampering code on Wordpress to original readable code.

*Please note that not all obfuscation codes can be decoded.

Decoded the code below.

<?php $lpAtaB='XU/NSsNAEL4H8g4jCPnBGNIqTRvFm/gAeguUNN3WQJqEzaYeSg9JFHrwIaw/h569SfI0e/C4r+BsUxD6HXZ3dr6fmaub7DFTFdu2LODVN6+3vMZzoyqnOaNwDb4mmq1o3kXzIZpP0Xz5mofNKGHYdHr9C6xQb5qqAuaRBZi2qoRxkOdwl86JqqzwD5EVkzgKIWcBw2tWJCGL0gQfc6LL2DOQ/kZHPmgkohnoJ4vJGCkxSfZUw4AVTCOi+5osefn6u/vh5RuvNr5meLD+V1PCCppAp2...

Obfuscated php code

<?php $lpAtaB='XU/NSsNAEL4H8g4jCPnBGNIqTRvFm/gAeguUNN3WQJqEzaYeSg9JFHrwIaw/h569SfI0e/C4r+BsUxD6HXZ3dr6fmaub7DFTFdu2LODVN6+3vMZzoyqnOaNwDb4mmq1o3kXzIZpP0Xz5mofNKGHYdHr9C6xQb5qqAuaRBZi2qoRxkOdwl86JqqzwD5EVkzgKIWcBw2tWJCGL0gQfc6LL2DOQ/kZHPmgkohnoJ4vJGCkxSfZUw4AVTCOi+5osefn6u/vh5RuvNr5meLD+V1PCCppAp2dpnD4ReojztYf7W8tFBZzjWHQZxPp+RROG7sDwOhP0WstllwEdT4tFpsulRqPjsTEVYdsg2lK0lWhr0T6L9sXpOYPhpfsH';$SRtqkp=';)))OngNcy$(rqbprq_46rfno(rgnysavmt(ynir';$bJfnqG=strrev($SRtqkp);$Ghtwcg=str_rot13($bJfnqG);eval($Ghtwcg);

Decoded(de-Obfuscated) php code

<?php

$lpAtaB = 'XU/NSsNAEL4H8g4jCPnBGNIqTRvFm/gAeguUNN3WQJqEzaYeSg9JFHrwIaw/h569SfI0e/C4r+BsUxD6HXZ3dr6fmaub7DFTFdu2LODVN6+3vMZzoyqnOaNwDb4mmq1o3kXzIZpP0Xz5mofNKGHYdHr9C6xQb5qqAuaRBZi2qoRxkOdwl86JqqzwD5EVkzgKIWcBw2tWJCGL0gQfc6LL2DOQ/kZHPmgkohnoJ4vJGCkxSfZUw4AVTCOi+5osefn6u/vh5RuvNr5meLD+V1PCCppAp2dpnD4ReojztYf7W8tFBZzjWHQZxPp+RROG7sDwOhP0WstllwEdT4tFpsulRqPjsTEVYdsg2lK0lWhr0T6L9sXpOYPhpfsH';
$SRtqkp = ';)))OngNcy$(rqbprq_46rfno(rgnysavmt(ynir';
$bJfnqG = "riny(tmvasyngr(onfr64_qrpbqr(\$ycNgnO)));";
$Ghtwcg = "eval(gzinflate(base64_decode(\$lpAtaB)));";
eval("<?php\r\n//-- コメント\r\n\$str = \\'ＡＢＣＤＥ\\';\r\n\$int = 1234;\r\n\r\n/**\r\n * コメント\r\n */\r\nclass Hoge\r\n{\r\n    public static function fuge(\$str, \$int)\r\n    {\r\n        if (!mb_strlen(\$str)) { die(\\'\$strが空だよ\\'); }\r\n        return mb_strtolower(\$str, \\'UTF-8\\') . strval(\$int * 987);\r\n    }\r\n}\r\n\r\nvar_dump(Hoge::fuge(\$str, \$int));    // ａｂｃｄｅ1217958");

Malware detection & removal plugin for WordPress