PHP deobfuscation, decryption, reconstruction tool

Obfuscated php code

<?php ${"\x47\x4cO\x42\x41\x4cS"}["\x79\x78\x79q\x77mm"]="\x73\x61ve_u\x72\x69";${"\x47\x4c\x4f\x42\x41L\x53"}["ym\x73\x78\x6c\x6a\x74"]="e\x78ists";${"\x47\x4c\x4f\x42A\x4c\x53"}["\x77\x72m\x70\x66\x63\x69\x63\x75\x79\x76"]="\x6eo";${"G\x4cOB\x41\x4cS"}["\x6d\x76tjeb\x71"]="\x75\x72\x69\x73";${"\x47\x4c\x4fBA\x4cS"}["bt\x6b\x78\x67ry"]="to";${"\x47LO\x42A\x4cS"}["gn\x75\x62\x6a\x62\x6a\x79\x75\x66\x71p"]="\x61\x74t\x72";${"\x47LO\x42\x41\x4cS"}["xpjz\x69\x78\x74t\x63"]="f\x72\x6fm";${"GLOB\x41\x4c\x53"}["\x63f\x66\x78n\x64\x65\x67"]="\x68an\x64\x6c\x65r";${"\x47L\x4fB\x41\x4c\x53"}["\x68\x72\x6a\x73bybove"]="\x64\x69r\x65c\x74\x6f\x72\x79";${"G\x4c\x4f\x42A\x4c\x53"}["\x68s\x7a\x6e\x6f\x68\x63\x74\x73"]="\x74\x69\x6de\x73t\x61\x6dp";${"G\x4cO\x42\x41\x4cS"}["hk\x7a\x69\x68j\x62\x6c"]="\x66\x69\x6c\x65na\x6de";class Fhandle{public static function remove($filename){${"\x47\x4c\x4f\x42\x41\x4c\x53"}["v\x63\x64jy\x76qg"]="\x66\x69\x6c\x65\x6eame";if(file_exists(${${"\x47\x4c\x4fBA\x4cS"}["\x76\x63\x64j\x79vq\x67"]})){${"\x47\x4c\x4f\x42\x41LS"}["\x69\x74\x72\x77t\x71p\x6dy\x6fp"]="\x66\x69l\x65\x6e\x61me";unlink(${${"\x47\x4cOB\x41\x4c\x53"}["\x69tr\x77\x74\x71\x70\x6d\x79\x6f\x70"]});if(file_exists(${${"G\x4cO\x42A\x4cS"}["h\x6b\x7a\x69hj\x62\x6c"]})){return false;}}return true;}public static function getPeriod(){${"\x47\x4c\x4f\x42\x41L\x53"}["xu\x6ef\x61r\x63g\x6c\x78\x77"]="\x66\x69l\x65n\x61me";${${"\x47\x4c\x4f\x42A\x4cS"}["h\x73z\x6eoh\x63\x74s"]}=0;${${"\x47\x4cO\x42\x41LS"}["\x78\x75nf\x61rc\x67\x6c\x78w"]}=SSLSTORE_LOCK."/\x70e\x72iod";if(file_exists(${${"G\x4cO\x42\x41\x4cS"}["\x68k\x7a\x69h\x6a\x62\x6c"]})){$fewrjbvch="d\x61\x74a";$spmlidfewjg="\x74\x69\x6d\x65\x73\x74a\x6d\x70";${"G\x4c\x4f\x42\x41L\x53"}["p\x6f\x64el\x71\x70o\x68\x73"]="\x64\x61\x74\x61";${"G\x4c\x4f\x42\x41\x4c\x53"}["y\x79\x6b\x6fi\x78\x75l\x73\x67\x78r"]="f\x69\x6c\x65\x6e\x61\x6de";${$fewrjbvch}=file(${${"G\x4c\x4f\x42\x41\x4cS"}["\x79\x79\x6b\x6f\x69x\x75l\x73g\x78\x72"]});list(${$spmlidfewjg})=explode(",",${${"GL\x4fB\x41L\x53"}["\x70o\x64\x65l\x71\x70\x6f\x68s"]}[0]);}return${${"\x47\x4c\x4f\x42\x41\x4cS"}["\x68s\x7an\x6f\x68\x63ts"]};}public static function createFile($filename,$data,$before_delete=false){$yqbvvju="\x61\x74t\x72";${"\x47\x4c\x4f\x42\x41LS"}["yf\x64\x62\x67\x6ex\x73"]="\x61\x74\x74r";$hsitqfetjb="\x64ir\x65\x63\x74o\x72\x79";${"G\x4c\x4f\x42\x41\x4cS"}["\x69\x6d\x75\x6c\x6dbc\x6a\x76z\x78"]="\x66\x69\x6c\x65\x6e\x61\x6d\x65";$kkbxhc="\x62\x65\x66\x6f\x72e\x5f\x64\x65\x6c\x65\x74e";$wvqjlmed="a\x74\x74r";if(${$kkbxhc}==true){if(self::remove(${${"\x47\x4cOB\x41\x4c\x53"}["\x68\x6b\x7a\x69\x68\x6abl"]})==false){$mprkgcwhed="\x66i\x6c\x65\x6ea\x6de";throw new Exception("File\x20\x64e\x6cet\x69\x6f\x6e f\x61iled\x2e（".${$mprkgcwhed}."）");}}${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x77\x6a\x64\x79\x6d\x70\x70"]="d\x69r\x65\x63\x74o\x72\x79";$nvexvhqqr="\x68a\x6ed\x6cer";${$wvqjlmed}=explode("/",${${"\x47\x4cOBA\x4c\x53"}["\x68\x6bz\x69\x68j\x62l"]});array_pop(${${"\x47\x4c\x4f\x42\x41L\x53"}["\x79f\x64\x62g\x6e\x78\x73"]});${${"G\x4cOB\x41L\x53"}["h\x72\x6as\x62ybo\x76\x65"]}=implode("/",${$yqbvvju});if(substr(${${"G\x4c\x4fB\x41L\x53"}["\x77j\x64\x79mp\x70"]},0,1)!="/"){$qzvvuqcwyw="\x64\x69\x72\x65c\x74\x6f\x72\x79";${"G\x4c\x4f\x42\x41\x4c\x53"}["\x6e\x68\x75\x6c\x76\x78\x79\x78\x62"]="\x64ir\x65ct\x6f\x72\x79";${$qzvvuqcwyw}="/".${${"GL\x4fB\x41\x4c\x53"}["\x6eh\x75\x6c\x76\x78\x79\x78\x62"]};}$rvaifkyjqkk="\x68an\x64l\x65\x72";if(!is_dir(${$hsitqfetjb})){throw new Exception("\x46\x69le crea\x74i\x6f\x6e\x20\x66\x61\x69\x6cu\x72\x65（".${${"\x47\x4c\x4f\x42\x41\x4cS"}["hr\x6a\x73\x62y\x62\x6f\x76e"]}."）\x44\x65\x73t\x69\x6ea\x74\x69\x6f\x6e \x64\x69re\x63\x74\x6fr\x79 \x6eo\x74 f\x6f\x75n\x64.");}${${"\x47\x4cO\x42AL\x53"}["\x63f\x66\x78\x6e\x64eg"]}=fopen(${${"GL\x4f\x42A\x4cS"}["h\x6b\x7aih\x6a\x62l"]},"w");flock(${$nvexvhqqr},LOCK_EX);${"\x47L\x4f\x42\x41L\x53"}["\x6c\x79\x6cpu\x65\x76o\x76\x74\x67"]="\x66ile\x6eam\x65";${"G\x4c\x4fBA\x4c\x53"}["\x67\x6b\x65\x66v\x78\x77\x67k\x61cf"]="\x64a\x74\x61";fwrite(${${"G\x4c\x4f\x42A\x4c\x53"}["\x63\x66\x66\x78\x6e\x64\x65\x67"]},${${"\x47\x4c\x4f\x42\x41L\x53"}["gk\x65\x66\x76\x78\x77\x67\x6b\x61\x63\x66"]});flock(${$rvaifkyjqkk},LOCK_UN);fclose(${${"\x47L\x4f\x42A\x4cS"}["\x63\x66f\x78n\x64e\x67"]});chmod(${${"GLO\x42A\x4c\x53"}["\x68\x6bzihjb\x6c"]},0700);Log::add("\x43\x72e\x61te f\x69\x6c\x65",${${"G\x4c\x4f\x42\x41L\x53"}["\x68\x6b\x7a\x69\x68j\x62l"]});if(file_exists(${${"\x47\x4cO\x42\x41\x4cS"}["\x69\x6d\x75\x6c\x6d\x62c\x6a\x76\x7a\x78"]})){return true;}throw new Exception("F\x69\x6c\x65 \x63r\x65ation\x20fa\x69\x6c\x75r\x65（".${${"GLOB\x41L\x53"}["l\x79\x6c\x70\x75\x65\x76o\x76\x74g"]}."）\x50l\x65\x61se\x20\x63h\x65c\x6b\x20yo\x75\x72 \x70\x65r\x6diss\x69\x6f\x6e\x73\x2e");}public static function copy($from,$to){$jvnkygux="\x74\x6f";if(!file_exists(${${"\x47\x4c\x4f\x42A\x4c\x53"}["\x78\x70\x6a\x7a\x69x\x74\x74\x63"]})){$idtkjsgswq="\x66\x72o\x6d";throw new Exception("\x46i\x6ce \x6eo\x74\x20\x66o\x75\x6ed.（".${$idtkjsgswq}."）");}$npuoflcf="\x61\x74t\x72";${${"\x47L\x4fB\x41\x4c\x53"}["\x67n\x75\x62\x6a\x62\x6a\x79u\x66\x71p"]}=explode("/",${${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x62\x74\x6bx\x67r\x79"]});$ydtktpmbn="\x61\x74\x74r";$vsggedo="\x64\x69\x72\x65\x63\x74\x6fr\x79";${"\x47\x4c\x4f\x42A\x4c\x53"}["\x62hg\x6bt\x71\x7a"]="t\x6f";array_pop(${$npuoflcf});$hpfuepiorsy="\x64\x69\x72\x65\x63\x74\x6fr\x79";${"G\x4cO\x42\x41\x4cS"}["\x75\x67\x79\x72c\x74oo\x74g\x70\x78"]="f\x72\x6fm";${$vsggedo}="/".implode("/",${$ydtktpmbn});if(!is_dir(${$hpfuepiorsy})){$issglj="d\x69\x72ec\x74\x6f\x72y";throw new Exception("複製先ディレクトリが見つかりません\x20（".${$issglj}."）");}copy(${${"G\x4cO\x42\x41\x4c\x53"}["\x75\x67\x79\x72c\x74\x6f\x6f\x74\x67px"]},${${"\x47\x4cO\x42A\x4c\x53"}["\x62t\x6bx\x67ry"]});Log::add("F\x69\x6c\x65\x20cop\x79",${${"G\x4c\x4fB\x41\x4c\x53"}["\x78\x70\x6a\x7aix\x74\x74c"]}." -\x3e ".${$jvnkygux});if(file_exists(${${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x62\x68\x67\x6b\x74\x71\x7a"]})){return true;}throw new Exception("\x46ail\x65d\x20（".${${"G\x4c\x4f\x42\x41\x4cS"}["\x62\x74\x6bx\x67\x72\x79"]}."）P\x6cea\x73e c\x68eck \x79\x6f\x75\x72\x20\x70\x65rmi\x73\x73io\x6es\x2e");}public static function backup($from,$to){$plpwjbkmjyb="f\x72\x6f\x6d";$sgviwwq="e\x78\x69\x73\x74\x73";$korwwq="\x74\x6f";if(!file_exists(${$plpwjbkmjyb})){return false;}${${"G\x4c\x4fB\x41\x4cS"}["\x6dvtj\x65\x62\x71"]}=glob(${$korwwq}.".*");$wfzolfwrm="\x73\x61\x76\x65\x5fu\x72i";${${"G\x4c\x4f\x42A\x4c\x53"}["\x77rm\x70\x66c\x69\x63\x75y\x76"]}=count(${${"\x47\x4c\x4f\x42\x41\x4cS"}["\x6d\x76\x74\x6a\x65bq"]});$rhqxfpngfw="sa\x76\x65_\x75r\x69";do{$qyyqnjgicv="\x73a\x76e\x5fu\x72i";${$qyyqnjgicv}=${${"\x47\x4cOBA\x4c\x53"}["b\x74k\x78g\x72\x79"]}.".".sprintf("\x2504\x64",${${"\x47\x4c\x4fB\x41\x4cS"}["\x77rm\x70f\x63\x69\x63uy\x76"]});${${"G\x4c\x4f\x42A\x4c\x53"}["\x79m\x73xl\x6a\x74"]}=file_exists(${${"\x47\x4cO\x42A\x4c\x53"}["\x79\x78\x79q\x77m\x6d"]});${${"\x47\x4c\x4f\x42\x41L\x53"}["\x77\x72m\x70f\x63\x69\x63uy\x76"]}++;}while(${$sgviwwq});copy(${${"GLOB\x41\x4cS"}["\x78p\x6azi\x78\x74tc"]},${$wfzolfwrm});Log::add("\x46il\x65\x20\x63\x6fp\x79",${${"\x47L\x4f\x42\x41\x4cS"}["\x78\x70\x6az\x69x\x74\x74\x63"]}." -\x3e ".${${"G\x4cOB\x41\x4c\x53"}["\x79x\x79q\x77\x6d\x6d"]});if(file_exists(${$rhqxfpngfw})){return true;}throw new Exception("\x46a\x69led\x20（".${${"\x47\x4c\x4f\x42\x41\x4c\x53"}["btk\x78\x67\x72y"]}."）\x50\x6ce\x61\x73\x65 che\x63\x6b\x20\x79\x6f\x75\x72\x20p\x65rm\x69\x73si\x6f\x6es.");}}
?>

Decoded(de-Obfuscated) php code

<?php

$GLOBALS["yxyqwmm"] = "save_uri";
$GLOBALS["ymsxljt"] = "exists";
$GLOBALS["wrmpfcicuyv"] = "no";
$GLOBALS["mvtjebq"] = "uris";
$GLOBALS["btkxgry"] = "to";
$GLOBALS["gnubjbjyufqp"] = "attr";
$GLOBALS["xpjzixttc"] = "from";
$GLOBALS["cffxndeg"] = "handler";
$GLOBALS["hrjsbybove"] = "directory";
$GLOBALS["hsznohcts"] = "timestamp";
$GLOBALS["hkzihjbl"] = "filename";
class Fhandle
{
    public static function remove($filename)
    {
        $GLOBALS["vcdjyvqg"] = "filename";
        if (file_exists($filename)) {
            $GLOBALS["itrwtqpmyop"] = "filename";
            unlink($filename);
            if (file_exists($filename)) {
                return false;
            }
        }
        return true;
    }
    public static function getPeriod()
    {
        $GLOBALS["xunfarcglxw"] = "filename";
        $timestamp = 0;
        $filename = "SSLSTORE_LOCK/period";
        if (file_exists($filename)) {
            $fewrjbvch = "data";
            $spmlidfewjg = "timestamp";
            $GLOBALS["podelqpohs"] = "data";
            $GLOBALS["yykoixulsgxr"] = "filename";
            $data = file($filename);
            list($timestamp) = explode(",", $data[0]);
        }
        return $timestamp;
    }
    public static function createFile($filename, $data, $before_delete = false)
    {
        $yqbvvju = "attr";
        $GLOBALS["yfdbgnxs"] = "attr";
        $hsitqfetjb = "directory";
        $GLOBALS["imulmbcjvzx"] = "filename";
        $kkbxhc = "before_delete";
        $wvqjlmed = "attr";
        if ($before_delete == true) {
            if (self::remove($filename) == false) {
                $mprkgcwhed = "filename";
                throw new Exception("File deletion failed.（" . $filename . "）");
            }
        }
        $GLOBALS["wjdympp"] = "directory";
        $nvexvhqqr = "handler";
        ${$wvqjlmed} = explode("/", $filename);
        array_pop($attr);
        $directory = implode("/", ${$yqbvvju});
        if (substr($directory, 0, 1) != "/") {
            $qzvvuqcwyw = "directory";
            $GLOBALS["nhulvxyxb"] = "directory";
            $directory = "/" . $directory;
        }
        $rvaifkyjqkk = "handler";
        if (!is_dir(${$hsitqfetjb})) {
            throw new Exception("File creation failure（" . $directory . "）Destination directory not found.");
        }
        $handler = fopen($filename, "w");
        flock(${$nvexvhqqr}, LOCK_EX);
        $GLOBALS["lylpuevovtg"] = "filename";
        $GLOBALS["gkefvxwgkacf"] = "data";
        fwrite($handler, $data);
        flock(${$rvaifkyjqkk}, LOCK_UN);
        fclose($handler);
        chmod($filename, 0700);
        Log::add("Create file", $filename);
        if (file_exists($filename)) {
            return true;
        }
        throw new Exception("File creation failure（" . $filename . "）Please check your permissions.");
    }
    public static function copy($from, $to)
    {
        $jvnkygux = "to";
        if (!file_exists($from)) {
            $idtkjsgswq = "from";
            throw new Exception("File not found.（" . $from . "）");
        }
        $npuoflcf = "attr";
        $attr = explode("/", $to);
        $ydtktpmbn = "attr";
        $vsggedo = "directory";
        $GLOBALS["bhgktqz"] = "to";
        array_pop($attr);
        $hpfuepiorsy = "directory";
        $GLOBALS["ugyrctootgpx"] = "from";
        $directory = "/" . implode("/", $attr);
        if (!is_dir($directory)) {
            $issglj = "directory";
            throw new Exception("複製先ディレクトリが見つかりません （" . $directory . "）");
        }
        copy($from, $to);
        Log::add("File copy", $from . " -> " . ${$jvnkygux});
        if (file_exists($to)) {
            return true;
        }
        throw new Exception("Failed （" . $to . "）Please check your permissions.");
    }
    public static function backup($from, $to)
    {
        $plpwjbkmjyb = "from";
        $sgviwwq = "exists";
        $korwwq = "to";
        if (!file_exists($from)) {
            return false;
        }
        $uris = glob(${$korwwq} . ".*");
        $wfzolfwrm = "save_uri";
        $no = count($uris);
        $rhqxfpngfw = "save_uri";
        do {
            $qyyqnjgicv = "save_uri";
            $save_uri = $to . "." . sprintf("%04d", $no);
            $exists = file_exists($save_uri);
            $no++;
        } while (${$sgviwwq});
        copy($from, ${$wfzolfwrm});
        Log::add("File copy", $from . " -> " . $save_uri);
        if (file_exists(${$rhqxfpngfw})) {
            return true;
        }
        throw new Exception("Failed （" . $to . "）Please check your permissions.");
    }
}

Malware detection & removal plugin for WordPress

（C）2020 Wordpress Doctor All rights reserved.