Japanese English

PHP deobfuscation, decryption, reconstruction tool

De-obfuscate PHP malware/viruses and tampering code on Wordpress to original readable code.

*Please note that not all obfuscation codes can be decoded.

Decoded the code below.

<?php //ICB0 72:0 81:12f1 ?><?php //00cb7 // ************************************************************************* // * * // * WHMCS - The Complete Client Management, Billing & Support Solution * // * Copyright (c) WHMCS Ltd. All Rights Reserved, * // * Version:8.9.0 (8.9.0-release....



Obfuscated php code

<?php //ICB0 72:0 81:12f1                                                     ?><?php //00cb7
// *************************************************************************
// *                                                                       *
// * WHMCS - The Complete Client Management, Billing & Support Solution    *
// * Copyright (c) WHMCS Ltd. All Rights Reserved,                         *
// * Version:8.9.0 (8.9.0-release.1)                                      *
// * BuildId:caf50d8.355                                                  *
// * Build Date:05 Mar 2024                                               *
// *                                                                       *
// *************************************************************************
// *                                                                       *
// * Email: info@whmcs.com                                                 *
// * Website: http://www.whmcs.com                                         *
// *                                                                       *
// *************************************************************************
// *                                                                       *
// * This software is furnished under a license and may be used and copied *
// * only  in  accordance  with  the  terms  of such  license and with the *
// * inclusion of the above copyright notice.  This software  or any other *
// * copies thereof may not be provided or otherwise made available to any *
// * other person.  No title to and  ownership of the  software is  hereby *
// * transferred.                                                          *
// *                                                                       *
// * You may not reverse  engineer, decompile, defeat  license  encryption *
// * mechanisms, or  disassemble this software product or software product *
// * license.  WHMCompleteSolution may terminate this license if you don't *
// * comply with any of the terms and conditions set forth in our end user *
// * license agreement (EULA).  In such event,  licensee  agrees to return *
// * licensor  or destroy  all copies of software  upon termination of the *
// * license.                                                              *
// *                                                                       *
// * Please see the EULA file for the full End User License Agreement.     *
// *                                                                       *
// *************************************************************************
if(extension_loaded('ionCube Loader')){die('The file '.__FILE__." is corrupted.\n");}echo("\nScript error: the ".(($cli=(php_sapi_name()=='cli')) ?'ionCube':'<a href="https://www.ioncube.com">ionCube</a>')." Loader for PHP needs to be installed.\n\nThe ionCube Loader is the industry standard PHP extension for running protected PHP code,\nand can usually be added easily to a PHP installation.\n\nFor Loaders please visit".($cli?":\n\nhttps://get-loader.ioncube.com\n\nFor":' <a href="https://get-loader.ioncube.com">get-loader.ioncube.com</a> and for')." an instructional video please see".($cli?":\n\nhttp://ioncu.be/LV\n\n":' <a href="http://ioncu.be/LV">http://ioncu.be/LV</a> ')."\n\n");exit(199);
?>
HR+cPs7KMuQXTQ2fp1dEfSP4JYX0zuPgeZMUhkOt1o2piUX6XahtLFTEOm+iPiAYDp8Talz0QxBe
84Ltae0NcXxrS8cWVoXk3pY7rzEul+c+O/deSQQG3r9BbhZmYfzGBmW7JVd72z7bN5a1VoOTsm8z
I0OjMuLTc9GEY16/SwZbSecrOCJtbqSmKHwMGiWr9O2tiF82bZ2RA7B7dENI/MiOof3zAYte6zh0
t6xVHPz0ofBbPr4BSuucYSS3YJlUnsKlfMZdIun59cDSHObqneWG4ab9B71mJT9KE+jkvlJNpYw2
CpDWL6wEnnvcO2b+WEHMrHtrNNp/yHvWDFLsDypZaKYHFfcNfuQwSXQs4W/+qyUaDa47vcbhPwgN
gUEz8Klysj4DQ6s7BDvTI/8BlCJPAU2l36WiLADPERZdiH3ld7o4HysBT0Uh6sPz8ZB7PhPVXf5/
u0lbacljgQxvCfqJj64ru31hbHGrDw7eKLp9jRLexbIZikoCmVQhVdqVYGycnpvLOAJI+WCSQ3S6
IFf5mSh5LQEzuUGD5LgJ48jG2nQju8uEd08muWdIVL/7comnzrbQTN4r2kqi/tKFeY5v1VxWGQSQ
XP9JRvILLhRL11kvTPT/uBCkItzwRHcYQjuA8+BETLI/ubqHypL6q8zhjQ8/zU4JRXlQx9OZegC+
pqR611cHcJVQxJlsCN41uT8+xyAEOsuSId6q9LDkRRW+bflDiSVZ8shTx67W2VGzczO2pOwvCgvF
7q4V71mqvTrLs2R8AOp983ahn0MMR62y1jg3kvL0orEc4S0QWQ2OitK4+/f09+3scH9AOPjC56/x
UhX/IFdFQDKk4O5Ze/ZgkoCECbdW00xZ2ZuaOc4V7AsUlnph72Mq3FMu/CEd+vwjV5cQe6FrCF5w
gqdjK5eadYsF+HXi3VUv/8gabVHIDqyQo84PvPhNjy2GJ6TXUHURoH76Af1exICqc6MJz8Hca+FL
MMwINK0NFgPZ2Psk3aljfl+b2X9rOADsP1kuqSDPIbiBdi71aQhs7bJfGRy1ezWeZpCazSsH4YO2
eBPZC9u8TcQRRQ7fyc3ly4/D/Owox1RgJfcr9OLKei/PFVQ3qWMslEQBQaQ/x8CPcHrYCX946uWv
NnwtTVTHeNTs7ZgNNvdamQxQQjqIozDmEJteGetCdrSoE5nTZ0LfrFsUruXAWiyA88SctryW1jWo
mLe6RNlGeAkVX7KY6aXyXIwzVpeM7/NUYjuIFl2nOqHDY8BcJqCrh85Ucz6zxYnFa9bN2nAbMDQC
1vKTJMaYxd+YkF8YudNjN6oFr9CJU3jj/IV9TzquleKXafnG8KBaqe46QtP0Eh+QrGjp462ruyLX
4fRaR44NK7zeslTsQ3g1QAxg0Ijifzafi4e1k7tE5AuUKU+gnM83ZwVhTPsuTKl30xl08h1lJsB9
AWBChUPFX7K4BfWCvvyCZvEKf8o+g/AO7xZ5LNTfyym5GpULrlz0R0ZGNLvN39S9WfygCxDgmmzL
Ns/Z6FzpvOQbJllC9gaaxMBnWP+qkwJXdC7I1wR1gu79Nk4==
HR+cPr6syldhWCV+WWvdslo8NI0jAylfSU8LABp8zymiVaUI9OwsSQcmn96zc5p9gBfIt4vKzgGx
s75xHwHLOuh60rZhniQWwSWkM6j2UirgqfYCqzb/HLsWB7+SEHbiC18SVdcz/x08IiM7FIvLjwWp
ZVN92eBXYBmCYCiYxbZrk/BTKMo4H3UgfNirr0FtGHe7vaJvoxcNVF0TMW/wHFMHfekmGrrpheof
++956Ecgc3Knd2uku16CSwaf1hS69u5XNEbaFMI5Q+5sOe0VByEC2tFNXkqMvxdWXmOV4mG/ugS/
AVRhSxkj/zdhQRnOpAECJlWQBV+hMQfTsozDvhLlZQhN5gvq8SXDW3XXZfdZgl4pCBokdT1SanYt
gb41D0JWj4cliGHRhxHeyaeZNz5RznnxNAA3C4/z49obtOC/4A+TzJfTJVO2NVqPlQKk7Ra828fg
79wG/eGG3PfGGZ9BR/62uhdKixbrHStxgi0Y0tIzHKujguRrHPdNzvN4e8viNbZxo5RQPFKlVk0a
xywM0b2gY7JlP+JTIUgdnQK+20NCNPrAWAupo+xNXOMckuXnSvWLjKuuZ2e/Xs5QKIDPoYCfgQ+z
tVz3Yb7Ov8UiMYfir98hXOWEa5z0cN/WeQFS9oTyt5TnjXYku25xijLvV6OwTYWG8L+u3DKOSvPL
vlN8ziBBLfDUtNaYlMkJbjrMZ2kTzK4Om92YO4CrGEszMwc5Mzu40ez6fMYcIk9zPsm3xjsHXO/2
gM5yd3gqy8arWTqk2+94dDeN3Cra59cFVftUsZUoMKc7WXWhn/rqW1DTFvnq4mZSGWuPE1KqB+DC
zvVc5NaolTRQ61Gh0ZLBZ0xj19gbG6ZBDulw3BCPZOnZB16N/EcTybJt/nw7yn3qoft+NbVxvIxo
8eLbKULEVLq8ZZ7t+wHzxCyFNCOKrl6b1Y7aaSA5TAcdSNecU6xPP1LAzF6eftDkbW4wD9sbo2tP
nGTqIuT9Os8GixiMZFYH9p2LprMz338dhCwUobe1JpLsFb23G6pT740oWonn4S98Xz/x5VP9EfV5
4uG2dwqrq0LAbm2A8GChnUlXRt/524KwWxO4z1Vuh6y1e/YOtRTevGVJ5sbxB06oO2yOx5zGtAb8
Wd8RnC7dRLrNBSPmtO8o1JSpvgJRkgekjCckgl9GkpvwKmxYI9K2HcVuGg8gpS0fD3EQGQIN34E1
JWWVIUyki+OefT8oESbnzFpIl53YT8t4455VDADOQnxIe9ZQjA/TBbDKM5IfNC0Z6uMzMJHJH6dg
LtMRgh+bS+Nf/nnOUD4e+o391YdgO70vPeTIb2BEk2DoAHC=

Decoded(de-Obfuscated) php code

<?php

//ICB0 72:0 81:12f1
//00cb7
// *************************************************************************
// *                                                                       *
// * WHMCS - The Complete Client Management, Billing & Support Solution    *
// * Copyright (c) WHMCS Ltd. All Rights Reserved,                         *
// * Version:8.9.0 (8.9.0-release.1)                                      *
// * BuildId:caf50d8.355                                                  *
// * Build Date:05 Mar 2024                                               *
// *                                                                       *
// *************************************************************************
// *                                                                       *
// * Email: info@whmcs.com                                                 *
// * Website: http://www.whmcs.com                                         *
// *                                                                       *
// *************************************************************************
// *                                                                       *
// * This software is furnished under a license and may be used and copied *
// * only  in  accordance  with  the  terms  of such  license and with the *
// * inclusion of the above copyright notice.  This software  or any other *
// * copies thereof may not be provided or otherwise made available to any *
// * other person.  No title to and  ownership of the  software is  hereby *
// * transferred.                                                          *
// *                                                                       *
// * You may not reverse  engineer, decompile, defeat  license  encryption *
// * mechanisms, or  disassemble this software product or software product *
// * license.  WHMCompleteSolution may terminate this license if you don't *
// * comply with any of the terms and conditions set forth in our end user *
// * license agreement (EULA).  In such event,  licensee  agrees to return *
// * licensor  or destroy  all copies of software  upon termination of the *
// * license.                                                              *
// *                                                                       *
// * Please see the EULA file for the full End User License Agreement.     *
// *                                                                       *
// *************************************************************************
if (extension_loaded('ionCube Loader')) {
    die("The file /var/www/html/input.php is corrupted.\n");
}
echo "\nScript error: the " . (($cli = php_sapi_name() == 'cli') ? 'ionCube' : '<a href="https://www.ioncube.com">ionCube</a>') . " Loader for PHP needs to be installed.\n\nThe ionCube Loader is the industry standard PHP extension for running protected PHP code,\nand can usually be added easily to a PHP installation.\n\nFor Loaders please visit" . ($cli ? ":\n\nhttps://get-loader.ioncube.com\n\nFor" : ' <a href="https://get-loader.ioncube.com">get-loader.ioncube.com</a> and for') . " an instructional video please see" . ($cli ? ":\n\nhttp://ioncu.be/LV\n\n" : ' <a href="http://ioncu.be/LV">http://ioncu.be/LV</a> ') . "\n\n";
exit(199);


Malware detection & removal plugin for WordPress

(C)2020 Wordpress Doctor All rights reserved.