Japanese English

PHP deobfuscation, decryption, reconstruction tool

De-obfuscate PHP malware/viruses and tampering code on Wordpress to original readable code.

*Please note that not all obfuscation codes can be decoded.

Decoded the code below.

<?php goto K3zvM; loMDZ: ibcfs: goto yzSZN; XuV9I: goto Lj196; goto Yk9Zn; LRvrZ: WV5_s: goto QsOLx; A7T9l: fECXi: goto xqs9J; Bt2df: ?> "></div></div><div class="form-group"><label class="col-sm-2 control-label">Target</label><div class="col-sm-10"><i...



Obfuscated php code

<?php
 goto K3zvM; loMDZ: ibcfs: goto yzSZN; XuV9I: goto Lj196; goto Yk9Zn; LRvrZ: WV5_s: goto QsOLx; A7T9l: fECXi: goto xqs9J; Bt2df: ?>
"></div></div><div class="form-group"><label class="col-sm-2 control-label">Target</label><div class="col-sm-10"><input class="form-control"id="target"name="target"value="<?php  goto CV0Rl; wQGRV: H8kXQ: goto XLjY0; jqisq: goto llC1e; goto vsdba; K3hIQ: ch4oU: goto ccKl_; Y3NES: ?>
"></div></div><div class="form-group"><label class="col-sm-2 control-label">Icon</label><div class="col-sm-10"><input class="form-control"id="icon"name="icon"value="<?php  goto tntXK; XLjY0: goto vXmOb; goto swMwc; GteiF: goto ibcfs; goto k1SzK; qz8Jb: vXmOb: goto ceaFx; AjjoU: goto cViIv; goto wsfHb; Ia1lc: ApDjs: goto fTVDe; bdAUu: goto YGe0C; goto WjcQb; sjzf6: goto F_QJM; goto kGM1N; PFNnC: goto fECXi; goto s6X0S; Ouv2v: goto TzliZ; goto TjUwv; Ga0rn: QF9zw: goto D2blT; eePzP: gWPWA: goto R8mBs; nkXho: F_QJM: goto k0nl8; WjcQb: sfwRG: goto mTm6m; WJyzY: vVnQu: goto vr5_p; xzuJ_: goto Cs99C; goto BNbs8; R8mBs: Itwp7: goto VWhiS; hBzG6: ZtC0Z: goto vgU5u; k1SzK: goto oobO6; goto nkXho; Yk9Zn: goto UCeJO; goto EfexE; xt_ot: Nvcnf: goto AFtOW; s6X0S: goto dpwF_; goto k0CJv; sIsxF: goto dfHtQ; goto xMnrt; dKzBa: Tprmf: goto sIsxF; OjSwy: goto PvYmD; goto SqtXr; TynEX: echo html_escape($row->id); goto jqisq; owx7_: FcU8O: goto mGkvE; TjUwv: csio2: goto H19VX; JFDZd: echo form_open(current_url(), "\143\154\x61\163\x73\x3d\42\146\157\162\x6d\55\150\157\x72\151\x7a\157\x6e\x74\141\154\x22") . PHP_EOL; goto AjjoU; QsOLx: goto xKRpA; goto s6I7J; e8Tyk: echo site_url("\141\x64\x6d\151\x6e\57\x6d\157\144\x6d\x65\156\165\57\x6d\145\x6e\165\x31"); goto njGKb; urIKV: goto IxMq2; goto BVV3A; Z0Ujz: goto QF9zw; goto t9gg_; xDXsP: hrpES: goto JFDZd; vsdba: YxMEa: goto wQGRV; vrkmT: defined("\102\x41\123\105\x50\101\124\x48") or die("\x4e\x6f\x20\144\151\x72\145\143\x74\x20\x73\143\162\x69\160\164\40\141\143\x63\x65\163\x73\x20\x61\x6c\154\157\167\x65\144"); goto gLdJL; uIAr8: n_sjE: goto L5rnh; D2blT: goto FcU8O; goto HKcIc; lma3T: vBjML: goto PHsmy; N967E: goto ApDjs; goto w7FhG; E7lpC: goto gWPWA; goto B2aQs; xtmGV: llC1e: goto ck4e2; ceaFx: echo $row->menu_target; goto N967E; Azp3W: goto ZhVuC; goto Ouv2v; H19VX: goto QZrCR; goto XRIEk; dCQ50: goto L9X1n; goto wiBBY; mkXCG: goto L6Eel; goto K3hIQ; IHh1D: ?>
<div class="form-group"><label class="col-sm-2 control-label">ID</label><div class="col-sm-10"><input class="form-control"id="id"name="id"value="<?php  goto c8AgY; njGKb: goto Lfb2N; goto Ia1lc; k0nl8: ?>
"></div></div><div class="form-group"><label class="col-sm-2 control-label">Action</label><div class="col-sm-10"><input class="form-control"id="action"name="action"value="<?php  goto bdAUu; iMtF2: uUz9o: goto WJyzY; TPK6E: xKRpA: goto e8Tyk; ShxCd: dfHtQ: goto sUwis; BPN_m: goto iNfOj; goto fH9fa; PHsmy: goto b7jG2; goto vcSgU; JED2L: PvYmD: goto zh092; WYIiL: Cs99C: goto C8gHI; fHXUP: echo form_close(); goto urIKV; fJRNo: nOJ61: goto xt_ot; ck4e2: goto kxP40; goto AyyNi; t9gg_: T2zzb: goto TynEX; lO2oS: KOKMO: goto H1_nR; xqs9J: goto TEm52; goto taQd0; VA7RM: goto ZtC0Z; goto Yk7ak; Smop7: echo $row->menu_icon; goto e3c4o; y29uL: goto SL1FA; goto zW1De; seUqg: LfWT_: goto IHh1D; HKcIc: goto mIJ1S; goto xDXsP; uEWjA: goto nmCAD; goto lO2oS; zW1De: ZVaEN: goto Smop7; C8gHI: OfsFr: goto TIxlE; qIOjX: Z_hmp: goto GteiF; JHGYz: goto Tprmf; goto fJRNo; AFtOW: goto QOlPs; goto dKzBa; Zn3xe: goto vVnQu; goto VA7RM; VRPlJ: GARau: goto g9TjI; kGM1N: YpxWl: goto vrkmT; dcc8Y: QOlPs: goto YWNjP; kyvct: goto H8kXQ; goto uN_QW; tPFBt: goto YpxWl; goto Tx_Ln; Kw86Y: goto Itwp7; goto w2PCr; o19vj: goto FOjVr; goto lma3T; K3zvM: goto csio2; goto qz8Jb; VWhiS: goto TyzKK; goto UwURd; taQd0: L6Eel: goto o29Rs; l0NgF: cViIv: goto Zn3xe; iID0e: x3li7: goto mUQIU; qei5K: goto Nvcnf; goto E7lpC; D2pew: RwpV5: goto AorLL; HG0sU: L9X1n: goto wCZfR; fH9fa: nmCAD: goto Bt2df; vcSgU: goto dOHl9; goto xtmGV; ICSVq: b7jG2: goto uEWjA; Z9I9B: mG00G: goto y29uL; wCZfR: ?>
"></div></div><div class="form-group"style="margin-bottom:0"><div class="col-sm-10 col-sm-offset-2"><button class="btn btn-primary"type="submit"><i class="fa fa-check"></i> Simpan</button> <a class="btn btn-default"data-dismiss="modal"href="<?php  goto mkXCG; ccKl_: ZhVuC: goto sjzf6; gLdJL: goto KOKMO; goto dcc8Y; GB823: dOHl9: goto TePGx; xMnrt: goto wH2Ao; goto HG0sU; sUwis: goto GARau; goto JED2L; EfexE: LcXoJ: goto ShxCd; B2aQs: TEm52: goto fHXUP; mGkvE: goto hrpES; goto D2pew; DAtwu: A5tab: goto dCQ50; s6I7J: oobO6: goto ICSVq; UwURd: QRgPn: goto gr8gJ; wiBBY: tUn27: goto Z9I9B; CpBQ8: epUAQ: goto uxUPq; Kija4: SL1FA: goto Y3NES; e10WC: goto ZVaEN; goto iID0e; c8AgY: goto Z_hmp; goto VRPlJ; x8xMR: goto RwpV5; goto Gs5tP; w2PCr: goto YxMEa; goto WYIiL; BNbs8: TyzKK: goto WMME2; wsfHb: UCeJO: goto loMDZ; p9V9S: goto QRgPn; goto CpBQ8; TIxlE: goto sfwRG; goto Jlv4_; BVV3A: wH2Ao: goto LRvrZ; Gs5tP: iNfOj: goto PFNnC; yiQFN: dpwF_: goto DAtwu; o29Rs: goto WV5_s; goto xzuJ_; mTm6m: ?>
<div class="modal-header"><button class="close"type="button"aria-label="Close"data-dismiss="modal"><span aria-hidden="true">×</span></button><h4 class="modal-title">Edit Menu</h4></div><?php  goto Z0Ujz; k7Wye: goto n_sjE; goto Ga0rn; vgU5u: iRAsn: goto e10WC; TePGx: QZrCR: goto tPFBt; Jlv4_: xtskZ: goto kyvct; e3c4o: goto vBjML; goto seUqg; fTVDe: goto A5tab; goto p9V9S; CV0Rl: goto xtskZ; goto l0NgF; AyyNi: goto nOJ61; goto uIAr8; w7FhG: FOjVr: goto Azp3W; k0CJv: YGe0C: goto qei5K; Bgvpt: goto ch4oU; goto Kija4; XRIEk: goto LcXoJ; goto TPK6E; yzSZN: goto T2zzb; goto hBzG6; zh092: ?>
"readonly></div></div><div class="form-group"><label class="col-sm-2 control-label">Nama</label><div class="col-sm-10"><input class="form-control"id="nama"name="nama"value="<?php  goto JHGYz; SqtXr: mIJ1S: goto owx7_; L5rnh: ?>
"><i class="fa fa-remove"></i> Batal</a></div></div><?php  goto BPN_m; ld3Cc: goto uUz9o; goto qIOjX; mUQIU: goto iRAsn; goto Bgvpt; Tx_Ln: TzliZ: goto A7T9l; tntXK: goto x3li7; goto iMtF2; uN_QW: goto epUAQ; goto yiQFN; AorLL: goto mG00G; goto ld3Cc; YWNjP: echo $row->menu_action; goto x8xMR; TU7xd: goto tUn27; goto GB823; swMwc: IxMq2: goto Kw86Y; vr5_p: goto LfWT_; goto eePzP; H1_nR: goto OfsFr; goto TU7xd; Yk7ak: Lfb2N: goto XuV9I; g9TjI: echo $row->menu_nama; goto o19vj; gr8gJ: kxP40: goto OjSwy; uxUPq: Lj196: goto k7Wye; WMME2: ?>

Decoded(de-Obfuscated) php code

<?php

TePGx:
defined("BASEPATH") or die("No direct script access allowed");
C8gHI:
?>
<div class="modal-header"><button class="close"type="button"aria-label="Close"data-dismiss="modal"><span aria-hidden="true">×</span></button><h4 class="modal-title">Edit Menu</h4></div><?php 
owx7_:
echo form_open(current_url(), "class=\"form-horizontal\"") . PHP_EOL;
WJyzY:
?>
<div class="form-group"><label class="col-sm-2 control-label">ID</label><div class="col-sm-10"><input class="form-control"id="id"name="id"value="<?php 
loMDZ:
echo html_escape($row->id);
gr8gJ:
?>
"readonly></div></div><div class="form-group"><label class="col-sm-2 control-label">Nama</label><div class="col-sm-10"><input class="form-control"id="nama"name="nama"value="<?php 
ShxCd:
echo $row->menu_nama;
ccKl_:
?>
"></div></div><div class="form-group"><label class="col-sm-2 control-label">Action</label><div class="col-sm-10"><input class="form-control"id="action"name="action"value="<?php 
xt_ot:
echo $row->menu_action;
Z9I9B:
?>
"></div></div><div class="form-group"><label class="col-sm-2 control-label">Icon</label><div class="col-sm-10"><input class="form-control"id="icon"name="icon"value="<?php 
vgU5u:
echo $row->menu_icon;
ICSVq:
?>
"></div></div><div class="form-group"><label class="col-sm-2 control-label">Target</label><div class="col-sm-10"><input class="form-control"id="target"name="target"value="<?php 
wQGRV:
echo $row->menu_target;
DAtwu:
?>
"></div></div><div class="form-group"style="margin-bottom:0"><div class="col-sm-10 col-sm-offset-2"><button class="btn btn-primary"type="submit"><i class="fa fa-check"></i> Simpan</button> <a class="btn btn-default"data-dismiss="modal"href="<?php 
LRvrZ:
echo site_url("admin/modmenu/menu1");
uxUPq:
?>
"><i class="fa fa-remove"></i> Batal</a></div></div><?php 
A7T9l:
echo form_close();
R8mBs:


Malware detection & removal plugin for WordPress

(C)2020 Wordpress Doctor All rights reserved.