Japanese English

PHP deobfuscation, decryption, reconstruction tool

De-obfuscate PHP malware/viruses and tampering code on Wordpress to original readable code.

*Please note that not all obfuscation codes can be decoded.

Decoded the code below.

<?php namespace moApiIntegrator\Wrapper; use wpdb; class dbWrapper { private static $dbWrapper; public static function getdbWrapper() : dbWrapper { if (isset(self::$dbWrapper)) { goto eQ; } self::$dbWrapper = new dbWrapper(); eQ: return self::$dbWrapper; } public static function mo_add_query_in_a...



Obfuscated php code

<?php


namespace moApiIntegrator\Wrapper;

use wpdb;
class dbWrapper
{
    private static $dbWrapper;
    public static function getdbWrapper() : dbWrapper
    {
        if (isset(self::$dbWrapper)) {
            goto eQ;
        }
        self::$dbWrapper = new dbWrapper();
        eQ:
        return self::$dbWrapper;
    }
    public static function mo_add_query_in_audit($Xh, $f_, $UY)
    {
        global $wpdb;
        $RO = $wpdb->prefix . dbConstant::AZURE_AUDIT_LOG;
        $wpdb->insert($RO, array("\x55\x50\x4e\137\x49\x44" => $Xh, "\x54\x49\115\105" => time(), "\123\124\x41\x54\x55\x53" => $f_, "\115\105\x53\x53\101\x47\105" => $UY));
    }
    public static function mo_create_azure_audit_log_table()
    {
        global $wpdb;
        $up = $wpdb->get_charset_collate();
        $RO = $wpdb->prefix . dbConstant::AZURE_AUDIT_LOG;
        $SA = "\103\x52\105\101\124\x45\40\x54\101\x42\x4c\105\x20{$RO}\40\50\xd\xa\x20\x20\40\40\x20\40\x20\x20\40\x20\40\40\151\144\40\155\145\x64\x69\x75\155\151\156\x74\50\71\x29\x20\116\x4f\124\40\116\125\x4c\114\40\x41\x55\x54\117\x5f\x49\x4e\103\122\105\x4d\x45\116\124\x2c\xd\12\40\x20\x20\40\40\40\40\x20\40\x20\x20\x20\x55\x50\116\x5f\x49\104\x20\164\x65\170\x74\40\116\117\124\x20\x4e\x55\114\114\54\xd\xa\x20\40\40\x20\x20\x20\40\x20\40\x20\x20\x20\124\x49\x4d\105\x20\x74\145\170\x74\x20\x2c\15\12\40\40\40\40\40\40\x20\40\40\x20\x20\40\x53\x54\x41\124\125\x53\40\164\145\170\164\40\x2c\xd\12\40\40\40\x20\40\40\x20\x20\40\x20\x20\x20\120\122\x49\115\101\x52\131\40\x4b\x45\x59\40\151\144\x20\50\151\x64\51\54\xd\12\40\40\x20\x20\x20\40\40\40\x20\x20\40\40\115\x45\x53\x53\101\107\105\x20\164\x65\x78\164\xd\12\x20\40\x20\x20\40\40\x20\x20\x29\40{$up}\x20\73";
        require_once ABSPATH . "\x77\x70\x2d\x61\x64\x6d\151\x6e\57\151\x6e\143\x6c\x75\144\145\x73\57\165\160\147\x72\141\144\145\56\x70\150\160";
        dbDelta($SA);
    }
    public static function mo_drop_audit_table()
    {
        global $wpdb;
        $RO = $wpdb->prefix . dbConstant::AZURE_AUDIT_LOG;
        $wpdb->query("\x44\x52\x4f\120\40\124\101\x42\x4c\x45\40\111\106\x20\105\x58\111\123\124\x53\40{$RO}");
    }
    public static function mo_count_users_in_audit()
    {
        global $wpdb;
        $RO = $wpdb->prefix . dbConstant::AZURE_AUDIT_LOG;
        $tq = $wpdb->get_var("\123\105\x4c\x45\103\x54\40\103\117\125\x4e\x54\50\x55\120\x4e\137\111\x44\51\40\x46\x52\117\115\x20{$RO}\40");
        return $tq;
    }
    public static function mo_delete_top__in_audit($UP)
    {
        global $wpdb;
        $RO = $wpdb->prefix . dbConstant::AZURE_AUDIT_LOG;
        $f_ = $wpdb->query("\104\105\114\105\124\x45\40\x46\122\x4f\x4d\40{$RO}\40\x4c\x49\115\x49\x54\40{$UP}\x3b");
    }
    public static function mo_bring_data_from_db()
    {
        global $wpdb;
        $RO = $wpdb->prefix . dbConstant::AZURE_AUDIT_LOG;
        $x0 = $wpdb->get_results("\123\x45\114\105\x43\124\40\52\40\106\122\x4f\115\x20{$RO}\40\117\x52\x44\105\122\x20\x42\131\x20\151\144\x20\x44\x45\x53\103");
        return $x0;
    }
    public static function mo_delete_data_from_tb()
    {
        global $wpdb;
        $RO = $wpdb->prefix . dbConstant::AZURE_AUDIT_LOG;
        error_log("\145\x72\x79\147\146\x79\x72\145\147\x66");
        $wpdb->query("\x54\x52\x55\x4e\x43\101\124\105\x20\124\x41\102\114\x45\40{$RO}");
    }
}

Decoded(de-Obfuscated) php code

<?php

namespace moApiIntegrator\Wrapper;

use wpdb;
class dbWrapper
{
    private static $dbWrapper;
    public static function getdbWrapper() : dbWrapper
    {
        if (isset(self::$dbWrapper)) {
            goto eQ;
        }
        self::$dbWrapper = new dbWrapper();
        eQ:
        return self::$dbWrapper;
    }
    public static function mo_add_query_in_audit($Xh, $f_, $UY)
    {
        global $wpdb;
        $RO = $wpdb->prefix . dbConstant::AZURE_AUDIT_LOG;
        $wpdb->insert($RO, array("UPN_ID" => $Xh, "TIME" => time(), "STATUS" => $f_, "MESSAGE" => $UY));
    }
    public static function mo_create_azure_audit_log_table()
    {
        global $wpdb;
        $up = $wpdb->get_charset_collate();
        $RO = $wpdb->prefix . dbConstant::AZURE_AUDIT_LOG;
        $SA = "CREATE TABLE {$RO} (\r\n            id mediumint(9) NOT NULL AUTO_INCREMENT,\r\n            UPN_ID text NOT NULL,\r\n            TIME text ,\r\n            STATUS text ,\r\n            PRIMARY KEY id (id),\r\n            MESSAGE text\r\n        ) {$up} ;";
        require_once "ABSPATHwp-admin/includes/upgrade.php";
        dbDelta($SA);
    }
    public static function mo_drop_audit_table()
    {
        global $wpdb;
        $RO = $wpdb->prefix . dbConstant::AZURE_AUDIT_LOG;
        $wpdb->query("DROP TABLE IF EXISTS {$RO}");
    }
    public static function mo_count_users_in_audit()
    {
        global $wpdb;
        $RO = $wpdb->prefix . dbConstant::AZURE_AUDIT_LOG;
        $tq = $wpdb->get_var("SELECT COUNT(UPN_ID) FROM {$RO} ");
        return $tq;
    }
    public static function mo_delete_top__in_audit($UP)
    {
        global $wpdb;
        $RO = $wpdb->prefix . dbConstant::AZURE_AUDIT_LOG;
        $f_ = $wpdb->query("DELETE FROM {$RO} LIMIT {$UP};");
    }
    public static function mo_bring_data_from_db()
    {
        global $wpdb;
        $RO = $wpdb->prefix . dbConstant::AZURE_AUDIT_LOG;
        $x0 = $wpdb->get_results("SELECT * FROM {$RO} ORDER BY id DESC");
        return $x0;
    }
    public static function mo_delete_data_from_tb()
    {
        global $wpdb;
        $RO = $wpdb->prefix . dbConstant::AZURE_AUDIT_LOG;
        error_log("erygfyregf");
        $wpdb->query("TRUNCATE TABLE {$RO}");
    }
}


Malware detection & removal plugin for WordPress

(C)2020 Wordpress Doctor All rights reserved.