Japanese English

PHP deobfuscation, decryption, reconstruction tool

De-obfuscate PHP malware/viruses and tampering code on Wordpress to original readable code.

*Please note that not all obfuscation codes can be decoded.

Decoded the code below.

<?php goto B8090bfefa; Ddacf4c119: $instance_id = $instance[0]["\x69\x6e\x73\164\141\x6e\x63\145\x5f\151\144"]; goto Fad3c8296d; D95ec4f7a9: c2357597ba: goto Ef53bd03a4; Fad3c8296d: goto e259577df6; goto E68343de9e; fb3aa3935c: tNUcvSZDvT(["\x73\164\141\164\165\163" => "\145\x72\x72\x6f\162", ...



Obfuscated php code

<?php
goto B8090bfefa; Ddacf4c119: $instance_id = $instance[0]["\x69\x6e\x73\164\141\x6e\x63\145\x5f\151\144"]; goto Fad3c8296d; D95ec4f7a9: c2357597ba: goto Ef53bd03a4; Fad3c8296d: goto e259577df6; goto E68343de9e; fb3aa3935c: tNUcvSZDvT(["\x73\164\141\164\165\163" => "\145\x72\x72\x6f\162", "\155\x65\x73\163\141\147\x65" => sprintf("\131\x6f\165\x20\143\141\156\40\x6f\156\x6c\171\x20\141\x64\x64\x20\165\x70\x20\x74\157\x20\x25\x73\x20\x57\x68\141\x74\163\x61\160\x70\40\x61\x63\x63\157\x75\x6e\x74\163", $number_accounts)]); goto D95ec4f7a9; B8090bfefa: require_once "\x66\x75\x6e\143\x74\151\157\x6e\163\x2f\x68\x65\x6c\160\145\162\56\160\150\x70"; goto b901884462; E08dbf7f9b: if (!(count($accounts) >= $number_accounts)) { goto c2357597ba; } goto fb3aa3935c; Eb9b34187d: if (empty($instance)) { goto a3007a15a0; } goto Ddacf4c119; fae140ef57: $number_accounts = isset($permissions->number_accounts) ? $permissions->number_accounts : 0; goto fa2994752e; fa2994752e: $accounts = $db->table("\x73\160\x5f\x61\x63\143\157\x75\156\164\137\x6d\x61\156\x61\x67\145\162")->select("\x2a")->where("\163\157\143\151\x61\x6c\137\x6e\145\164\x77\157\162\153", "\167\150\141\164\x73\141\160\x70")->where("\154\x6f\147\x69\x6e\137\x74\x79\x70\x65", 2)->where("\x74\x65\x61\x6d\137\x69\144", $team_id)->get(); goto E08dbf7f9b; Aa037263e8: e259577df6: goto De7a309a46; Ef53bd03a4: $tb_whatsapp_sessions = $db->table("\x73\160\137\167\150\141\x74\x73\141\160\x70\x5f\163\145\x73\163\151\x6f\156\x73"); goto F82326bf99; E68343de9e: a3007a15a0: goto ee422c457c; b901884462: $db = tNUcvSZDvW(); goto D2b920ed47; F82326bf99: $instance = $db->table("\163\x70\x5f\167\x68\141\164\x73\141\160\x70\x5f\163\x65\163\x73\151\x6f\156\x73")->select("\52")->where("\x73\164\141\x74\x75\x73", 0)->where("\x74\145\141\x6d\x5f\151\144", $team_id)->get(); goto Eb9b34187d; ee422c457c: $instance_id = tNUcvSZDvR(); goto c96e315142; D2b920ed47: $team = tNUcvSZDvO($db); goto c5e094de6f; c5e094de6f: $team_id = $team["\151\144"]; goto E8de7a998e; E8de7a998e: $permissions = json_decode($team["\x70\x65\162\155\151\x73\x73\x69\157\156\x73"]); goto fae140ef57; c96e315142: $result = $tb_whatsapp_sessions->insert([["\x69\x64\163" => ids(), "\151\156\163\x74\x61\x6e\x63\145\x5f\x69\144" => $instance_id, "\x74\145\141\x6d\x5f\151\144" => $team["\x69\x64"], "\x64\x61\164\x61" => NULL, "\163\x74\x61\164\x75\163" => 0]])->execute(); goto Aa037263e8; De7a309a46: tNUcvSZDvT(["\x73\x74\x61\x74\165\163" => "\x73\165\143\143\145\x73\163", "\155\x65\163\163\x61\147\x65" => "\111\156\163\164\141\x6e\x63\145\x20\111\104\40\147\145\156\145\162\x61\164\145\144\x20\x73\x75\x63\x63\145\x73\163\146\165\154\x6c\x79", "\x69\x6e\x73\164\141\x6e\x63\x65\137\x69\x64" => $instance_id]);

Decoded(de-Obfuscated) php code

<?php

require_once "functions/helper.php";
$db = tNUcvSZDvW();
$team = tNUcvSZDvO($db);
$team_id = $team["id"];
$permissions = json_decode($team["permissions"]);
$number_accounts = isset($permissions->number_accounts) ? $permissions->number_accounts : 0;
$accounts = $db->table("sp_account_manager")->select("*")->where("social_network", "whatsapp")->where("login_type", 2)->where("team_id", $team_id)->get();
if (!(count($accounts) >= $number_accounts)) {
    goto c2357597ba;
}
tNUcvSZDvT(["status" => "error", "message" => sprintf("You can only add up to %s Whatsapp accounts", $number_accounts)]);
c2357597ba:
$tb_whatsapp_sessions = $db->table("sp_whatsapp_sessions");
$instance = $db->table("sp_whatsapp_sessions")->select("*")->where("status", 0)->where("team_id", $team_id)->get();
if (empty($instance)) {
    $instance_id = tNUcvSZDvR();
    $result = $tb_whatsapp_sessions->insert([["ids" => ids(), "instance_id" => $instance_id, "team_id" => $team["id"], "data" => NULL, "status" => 0]])->execute();
    goto Aa037263e8;
}
$instance_id = $instance[0]["instance_id"];
Aa037263e8:
tNUcvSZDvT(["status" => "success", "message" => "Instance ID generated successfully", "instance_id" => $instance_id]);


Malware detection & removal plugin for WordPress

(C)2020 Wordpress Doctor All rights reserved.