Japanese English

PHP deobfuscation, decryption, reconstruction tool

De-obfuscate PHP malware/viruses and tampering code on Wordpress to original readable code.

*Please note that not all obfuscation codes can be decoded.

Decoded the code below.

<?php namespace Mgt\Varnish\Model\Feed; use Magento\Framework\Config\ConfigOptionsListConstants; use Laminas\Http\Client as HttpClient; class Feed extends \Magento\Framework\Model\AbstractModel { const FEED_URL = "\150\164\164\x70\72\57\57\146\145\145\x64\x2e\155\147\164\x2d\x63\157\155\x6d\145\1...



Obfuscated php code

<?php
 namespace Mgt\Varnish\Model\Feed; use Magento\Framework\Config\ConfigOptionsListConstants; use Laminas\Http\Client as HttpClient; class Feed extends \Magento\Framework\Model\AbstractModel { const FEED_URL = "\150\164\164\x70\72\57\57\146\145\145\x64\x2e\155\147\164\x2d\x63\157\155\x6d\145\162\143\x65\x2e\x63\157\x6d\57"; const UPDATE_FREQUENCY = 21600; const SEVERITY_INFORMATION = 4; protected $backendConfig; protected $inboxFactory; protected $storeManager; protected $deploymentConfig; protected $productMetadata; protected $urlBuilder; public function __construct(\Magento\Framework\Model\Context $context, \Magento\Framework\Registry $registry, \Magento\Backend\App\ConfigInterface $backendConfig, \Magento\AdminNotification\Model\InboxFactory $inboxFactory, \Magento\Store\Model\StoreManagerInterface $storeManager, \Magento\Framework\App\DeploymentConfig $deploymentConfig, \Magento\Framework\App\ProductMetadataInterface $productMetadata, \Magento\Framework\UrlInterface $urlBuilder, \Magento\Framework\Model\ResourceModel\AbstractResource $resource = null, \Magento\Framework\Data\Collection\AbstractDb $resourceCollection = null, array $data = []) { goto A1e04; Cd889: $this->productMetadata = $productMetadata; goto baae0; E2d21: $this->storeManager = $storeManager; goto A0bce; A0bce: $this->deploymentConfig = $deploymentConfig; goto Cd889; F2b58: $this->inboxFactory = $inboxFactory; goto E2d21; bab73: $this->backendConfig = $backendConfig; goto F2b58; A1e04: parent::__construct($context, $registry, $resource, $resourceCollection, $data); goto bab73; baae0: $this->urlBuilder = $urlBuilder; goto Ea871; Ea871: } protected function _construct() { } public function checkUpdate() { goto b4504; b4504: $frequency = $this->getFrequency(); goto Ae62a; bb333: return $this; goto da946; F9393: if (!($feedXml && isset($feedXml->channel) && isset($feedXml->channel->item))) { goto cd518; } goto D9f62; D348f: $feedData = []; goto Fdd56; d46ea: $this->inboxFactory->create()->parse(array_reverse($feedData)); goto cc003; da946: D66f3: goto D348f; af808: cd518: goto e1c0f; Fdd56: $feedXml = $this->getFeedData(); goto Df649; D9f62: foreach ($feedXml->channel->item as $item) { goto fc54f; Cadb8: b9f0f: goto b3233; b3233: dedc7: goto ecf0b; C86aa: $feedData[] = ["\x73\x65\x76\x65\162\151\x74\x79" => self::SEVERITY_INFORMATION, "\x64\x61\164\145\137\x61\x64\x64\145\144" => date("\x59\x2d\x6d\x2d\x64\x20\110\72\151\x3a\x73", $itemPublicationDate), "\x74\x69\164\154\145" => (string) $item->title, "\x64\145\163\x63\162\x69\160\164\x69\x6f\x6e" => (string) $item->description, "\165\x72\154" => (string) $item->link]; goto Cadb8; fc54f: $itemPublicationDate = strtotime((string) $item->pubDate); goto D5868; D5868: if (!($installDate <= $itemPublicationDate)) { goto b9f0f; } goto C86aa; ecf0b: } goto adccb; bce36: return $this; goto D6195; Df649: $installDate = strtotime($this->deploymentConfig->get(ConfigOptionsListConstants::CONFIG_PATH_INSTALL_DATE)); goto F9393; dd9e8: if (!$feedData) { goto Ca9fe; } goto d46ea; e1c0f: $this->setLastUpdate(); goto bce36; cc003: Ca9fe: goto af808; adccb: C06db: goto dd9e8; dfda8: if (!($frequency + $lastUpdate > time())) { goto D66f3; } goto bb333; Ae62a: $lastUpdate = $this->getLastUpdate(); goto dfda8; D6195: } public function getFrequency() { return self::UPDATE_FREQUENCY; } public function getLastUpdate() { return $this->_cacheManager->load("\x6d\147\x74\x5f\x66\x65\145\144\x5f\x61\x64\x6d\151\156\137\x6e\157\x74\x69\146\151\x63\x61\164\151\x6f\x6e\x73\137\x6c\x61\163\x74\x63\150\145\x63\153"); } public function setLastUpdate() { $this->_cacheManager->save(time(), "\155\x67\x74\x5f\146\x65\145\x64\x5f\141\144\x6d\x69\x6e\x5f\156\157\164\x69\x66\151\143\141\164\x69\157\x6e\163\137\x6c\x61\163\164\x63\x68\x65\x63\x6b"); return $this; } public function getFeedData() { try { goto Ea339; E5e0b: $config = ["\x61\x64\141\160\x74\145\x72" => HttpClient\Adapter\Curl::class, "\143\165\x72\154\x6f\x70\x74\151\157\x6e\163" => [CURLOPT_FOLLOWLOCATION => true], "\x6d\x61\170\162\x65\x64\151\162\145\x63\x74\x73" => 0, "\164\x69\155\145\x6f\x75\164" => 30]; goto d2326; d2326: $httpClient = new HttpClient(self::FEED_URL, $config); goto E98d9; A21b6: $httpClient->setParameterPost($postParams); goto b3914; b3914: $response = $httpClient->send(); goto a75dc; a75dc: if (!(200 == $response->getStatusCode())) { goto D434d; } goto d0830; Ea339: $xml = ''; goto b6e6d; b6e6d: $postParams = ["\163\150\157\160\x5f\x75\162\x6c" => $this->storeManager->getStore()->getBaseUrl(), "\x76\145\162\163\x69\157\156" => $this->productMetadata->getVersion()]; goto E5e0b; E98d9: $httpClient->setMethod("\x50\x4f\x53\124"); goto A21b6; B2af4: D434d: goto d07ec; d0830: $xml = new \SimpleXMLElement($response->getBody()); goto B2af4; d07ec: } catch (\Exception $e) { return false; } return $xml; } }

Decoded(de-Obfuscated) php code

<?php

namespace Mgt\Varnish\Model\Feed;

use Magento\Framework\Config\ConfigOptionsListConstants;
use Laminas\Http\Client as HttpClient;
class Feed extends \Magento\Framework\Model\AbstractModel
{
    const FEED_URL = "http://feed.mgt-commerce.com/";
    const UPDATE_FREQUENCY = 21600;
    const SEVERITY_INFORMATION = 4;
    protected $backendConfig;
    protected $inboxFactory;
    protected $storeManager;
    protected $deploymentConfig;
    protected $productMetadata;
    protected $urlBuilder;
    public function __construct(\Magento\Framework\Model\Context $context, \Magento\Framework\Registry $registry, \Magento\Backend\App\ConfigInterface $backendConfig, \Magento\AdminNotification\Model\InboxFactory $inboxFactory, \Magento\Store\Model\StoreManagerInterface $storeManager, \Magento\Framework\App\DeploymentConfig $deploymentConfig, \Magento\Framework\App\ProductMetadataInterface $productMetadata, \Magento\Framework\UrlInterface $urlBuilder, \Magento\Framework\Model\ResourceModel\AbstractResource $resource = null, \Magento\Framework\Data\Collection\AbstractDb $resourceCollection = null, array $data = array())
    {
        parent::__construct($context, $registry, $resource, $resourceCollection, $data);
        $this->backendConfig = $backendConfig;
        $this->inboxFactory = $inboxFactory;
        $this->storeManager = $storeManager;
        $this->deploymentConfig = $deploymentConfig;
        $this->productMetadata = $productMetadata;
        $this->urlBuilder = $urlBuilder;
    }
    protected function _construct()
    {
    }
    public function checkUpdate()
    {
        $frequency = $this->getFrequency();
        $lastUpdate = $this->getLastUpdate();
        if (!($frequency + $lastUpdate > time())) {
            $feedData = [];
            $feedXml = $this->getFeedData();
            $installDate = strtotime($this->deploymentConfig->get(ConfigOptionsListConstants::CONFIG_PATH_INSTALL_DATE));
            if (!($feedXml && isset($feedXml->channel) && isset($feedXml->channel->item))) {
                goto cd518;
            }
            foreach ($feedXml->channel->item as $item) {
                $itemPublicationDate = strtotime((string) $item->pubDate);
                if (!($installDate <= $itemPublicationDate)) {
                    goto b9f0f;
                }
                $feedData[] = ["severity" => self::SEVERITY_INFORMATION, "date_added" => date("Y-m-d H:i:s", $itemPublicationDate), "title" => (string) $item->title, "description" => (string) $item->description, "url" => (string) $item->link];
                b9f0f:
            }
            if (!$feedData) {
                goto Ca9fe;
            }
            $this->inboxFactory->create()->parse(array_reverse($feedData));
            Ca9fe:
            cd518:
            $this->setLastUpdate();
            return $this;
        }
        return $this;
    }
    public function getFrequency()
    {
        return self::UPDATE_FREQUENCY;
    }
    public function getLastUpdate()
    {
        return $this->_cacheManager->load("mgt_feed_admin_notifications_lastcheck");
    }
    public function setLastUpdate()
    {
        $this->_cacheManager->save(time(), "mgt_feed_admin_notifications_lastcheck");
        return $this;
    }
    public function getFeedData()
    {
        try {
            $xml = '';
            $postParams = ["shop_url" => $this->storeManager->getStore()->getBaseUrl(), "version" => $this->productMetadata->getVersion()];
            $config = ["adapter" => HttpClient\Adapter\Curl::class, "curloptions" => [CURLOPT_FOLLOWLOCATION => true], "maxredirects" => 0, "timeout" => 30];
            $httpClient = new HttpClient(self::FEED_URL, $config);
            $httpClient->setMethod("POST");
            $httpClient->setParameterPost($postParams);
            $response = $httpClient->send();
            if (!(200 == $response->getStatusCode())) {
                goto D434d;
            }
            $xml = new \SimpleXMLElement($response->getBody());
            D434d:
        } catch (\Exception $e) {
            return false;
        }
        return $xml;
    }
}


Malware detection & removal plugin for WordPress

(C)2020 Wordpress Doctor All rights reserved.