Japanese English

PHP deobfuscation, decryption, reconstruction tool

De-obfuscate PHP malware/viruses and tampering code on Wordpress to original readable code.

*Please note that not all obfuscation codes can be decoded.

Decoded the code below.

<?php echo "//--\x20コメント\n\$\x73\x74\x72\x20\x3d\x20'ABCDE';\n\$int \x3d 1\x32\x334\x3b\n\n/**\n *\x20コメント\n */\n\x63\x6ca\x73\x73 Hog\x65\n{\n\x20\x20\x20\x20pu\x62l\x69c\x20\x73t\x61\x74\x69\x63\x20\x66unct\x69o\x6e \x66\x75g\x65(\$str,\x20\$\x69\x6et)\n \x20 {\n \x20 \x20 \x20\x20 i\x66 (!mb_\...



Obfuscated php code

<?php echo "//--\x20コメント\n\$\x73\x74\x72\x20\x3d\x20'ABCDE';\n\$int \x3d 1\x32\x334\x3b\n\n/**\n *\x20コメント\n */\n\x63\x6ca\x73\x73 Hog\x65\n{\n\x20\x20\x20\x20pu\x62l\x69c\x20\x73t\x61\x74\x69\x63\x20\x66unct\x69o\x6e \x66\x75g\x65(\$str,\x20\$\x69\x6et)\n  \x20 {\n \x20 \x20 \x20\x20 i\x66 (!mb_\x73\x74r\x6c\x65n(\$s\x74r))\x20{ \x64\x69\x65(\x27\$st\x72が空だよ')\x3b }\n \x20\x20   \x20 \x72\x65t\x75r\x6e\x20mb\x5fs\x74r\x74\x6f\x6c\x6f\x77e\x72(\$st\x72, \x27\x55T\x46-\x38')\x20. \x73t\x72\x76\x61\x6c(\$\x69\x6e\x74\x20* 98\x37);\n \x20\x20 }\n}\n\n\x76\x61r_d\x75m\x70(Hog\x65::f\x75\x67e(\$s\x74r,\x20\$\x69\x6et))\x3b \x20 \x20//\x20abcde121\x37\x39\x358\n\n\n\n?\x3e\n";

Decoded(de-Obfuscated) php code

<?php

echo "//-- コメント\n\$str = 'ABCDE';\n\$int = 1234;\n\n/**\n * コメント\n */\nclass Hoge\n{\n    public static function fuge(\$str, \$int)\n    {\n        if (!mb_strlen(\$str)) { die('\$strが空だよ'); }\n        return mb_strtolower(\$str, 'UTF-8') . strval(\$int * 987);\n    }\n}\n\nvar_dump(Hoge::fuge(\$str, \$int));    // abcde1217958\n\n\n\n?>\n";


Malware detection & removal plugin for WordPress

(C)2020 Wordpress Doctor All rights reserved.