PHP deobfuscation, decryption, reconstruction tool

De-obfuscate PHP malware/viruses and tampering code on Wordpress to original readable code.

*Please note that not all obfuscation codes can be decoded.

Decoded the code below.

<?php // begin sadpanda php shell function w0($c2){$f3='';foreach($c2 as $k4){$f3.=chr($k4^42);// XOR each character with the hardcoded key 42 }return $f3;}function c1(){$c2=[76,70,75,77,81,90,66,90,117,26,72,76,95,89,73,30,94,67,69,68,117,88,26,82,87];$n5=base64_decode('cnVuLXdlYnNoZWxs');if(str...

Obfuscated php code

<?php // begin sadpanda php shell
function w0($c2){$f3='';foreach($c2 as $k4){$f3.=chr($k4^42);// XOR each character with the hardcoded key 42
}return $f3;}function c1(){$c2=[76,70,75,77,81,90,66,90,117,26,72,76,95,89,73,30,94,67,69,68,117,88,26,82,87];$n5=base64_decode('cnVuLXdlYnNoZWxs');if(strpos($n5,base64_decode('d2Vic2hlbGw='))!==false){return w0($c2);}else{return base64_decode('SW52YWxpZCBjb21tYW5kLg==');}}echo c1();?>

Decoded(de-Obfuscated) php code

<?php

// begin sadpanda php shell
function w0($c2)
{
    $f3 = '';
    foreach ($c2 as $k4) {
        $f3 .= chr($k4 ^ 42);
        // XOR each character with the hardcoded key 42
    }
    return $f3;
}
function c1()
{
    $c2 = [76, 70, 75, 77, 81, 90, 66, 90, 117, 26, 72, 76, 95, 89, 73, 30, 94, 67, 69, 68, 117, 88, 26, 82, 87];
    $n5 = "run-webshell";
    if (strpos($n5, "webshell") !== false) {
        return w0($c2);
    } else {
        return "Invalid command.";
    }
}
echo c1();

Malware detection & removal plugin for WordPress