Japanese English

PHP deobfuscation, decryption, reconstruction tool

De-obfuscate PHP malware/viruses and tampering code on Wordpress to original readable code.

*Please note that not all obfuscation codes can be decoded.

Decoded the code below.

<?php eval(str_rot13(gzinflate(str_rot13(base64_decode('LUnHEuy4Dfwa165iyqF8RUGjnGhkKeec9fWW3m1XNSROgFGTQINYPdx/Yv0Rr/dDLn+PULFgyH/nclfm5e98dar8/v/gL1Ia4LwQg7OupoUtlH57zEDt6IlAK7tAQxX+F3GTsAMqIXjr2mTzqCrSrwwSRXIPf2KvSGJzX2Lm7VewQ19Ra0oo/o6ISqTfWApbLhuTdQAbYRK3WvdX+WpNRu2QcvA8VwaiYY8KeMfewwFl5CXbu...



Obfuscated php code

<?php
eval(str_rot13(gzinflate(str_rot13(base64_decode('LUnHEuy4Dfwa165iyqF8RUGjnGhkKeec9fWW3m1XNSROgFGTQINYPdx/Yv0Rr/dDLn+PULFgyH/nclfm5e98dar8/v/gL1Ia4LwQg7OupoUtlH57zEDt6IlAK7tAQxX+F3GTsAMqIXjr2mTzqCrSrwwSRXIPf2KvSGJzX2Lm7VewQ19Ra0oo/o6ISqTfWApbLhuTdQAbYRK3WvdX+WpNRu2QcvA8VwaiYY8KeMfewwFl5CXbutbgSIPYI+UkO2WdW1Z8xkKCAaT9x1lAIpCZXwfqS04YN2HVGeY3g6/w2vy7rSIF13smlVs251qgcxCqK5hsZ+7zlnK0KCbnR35912h1t+PlV9gLhCvd9+Tf8mb5CuFJBIEeTFX2LKc+GIarATeChcH8rqHQSCxRv72Lx1mYZX4YhwfAZtM6ctJ/lRnciQ0I4pnTnlzGbSX/fAAVLedkeqbiC+Z9hLPWKSIZVirWvLPmGGeqvTP4/mY0ecoK/OGiSkEhymW+rSiSwLUd+thchM3cv96fmNTLNJPLLYobXLy12NPg+5Cwb1/5Usvz0L6NUKVRiNey3sLvkTDbuINI0AsJ9hlA2cpuqpCj9ApqCjm6lRR4WzjZ2/LllpEG4fbt6SsqfgJR9w/9wcbr3IO+vV5qAmUXzV1dOZoFl3SbXfED2s11I5wT3+v5aOZVRVqHinQTwS4sVpZLeezifXR0tCexdlgCeSBAtiwPn8REWWzvMdhoZxZik7MHCqbneXgTaOVwrsS8MC320KdqJPujBPixD8qLjUnR7wJ4rYtxiJXkdpmpaxLz/sIn/vIiXa930RLtaA7EsJsVrTPwGcVrIJmWC4gVJ4rdD1mNXSi2b8Wl/n7B/KS9I5/0RS2J/8b8IF1I4xmSF95Ka7/qcN/c7aBpS4pwUSrUCMYZbcXdggEigktJ/ZcMk7eU01Jem3Xi3iQ9Ummoimv8MQel/NWY5UfbAPriAVDXBqTsI40mxbjunNvcml9fCPqVpDWBhBRcMZxcMDhyJDfYrkZa9Tbj1ojxLsNNAivfeNghh9XCe51/ZA5F4/vv9VllUHDYRO0z/sjdQGPgFftVd8qVUw2lAlRO7fN9c3DnDon+3N1tfiob+Lopm9LmEDzC2KXx5YB/iyI1sA7MyxwIv2t5513LnXmoovNOtsDj3LolX4R1XDmSO7aFQl6zMxdVw4tewDqWaLBClVrPHpNNT2BpSiEnkQ5rOqx5cQa+cpPvEfhigAahBEhelCoVn6vcEFft3I/HQZnuYKlqKcEaKLNX5Cuz1to4F7tOY9gvxmLKdbR0DDftIPPcJsj5YftATUt6ZffRh6oL0ROpcEwW37qG5bNwW18cHIq0Gl9A9jCMjaoNIdHAYtLaWNpGKjxvoUM5FzwVxcdd3dNgc3G4J260eafZaC4Cip9Ig8bFv4GuwkBR6qcRYW/7Dq7INy6q7dcQyKa0RbpEmgVbWN0JeW1x7qn93LHgcV+FFNi8l/p5+AC+c4TnzorsThgFBkMz3TT6mmkDuaMjvO8/+h34inkE4FEeC6Vf3AWQjBjsOyaUEVz27r5Z2xdnC9LoO105sKhQ3ZOVmfLdZAmvZRcOOZaYnkhj8AB2IOblkUEchA3VBM7/IMvMpkt7lVBIARzZiPbTD5XuB3Y2umOHme3g/Ts9vtKYy00O8YJFxhZpWTkKqzte4sIGtCcLJ5Yb+I5DehoGHLxtoki3bswfmgwfRtqlIMv6+yHYHkBeS1lsfUTcWfegPa1Q9/nmtpCzizkRFQsUSRaWYxdhbWnbcKv6lqK9TMiz10N11DXiM15NeUyP3yW/rquFjY12UHVsIPM6xQc6IEiQqYa/VjdGPngSjJUTRNBTnQbNtnl1JirYznSBARhEkD1iOsBnAKwac5fLQSAChgmAq173gTCfEPXbalChi+FNagUx941Azn8y/Dit0RZ9DP3mAlJj9u08hQMFxvwoANTsm4V+abwD7g94LoYrhz7v0O24d8OHwFAzmuSmkk629/qJZc66blQaFzpHC2MTTAZo8V7bp7CNEuFv2P0qq75Vfgi80aY/bf9wOJSgNgC9/M5Hxk/V0cxE+u+I3y93TVbebYXHuFKQn2VO+v4Vl5sbiyOyV9mF5MjoXFmm9kTA2yk+lgRQ57rKlQMPDHDoubf5TTRJo9a6YsZiPwCrbbO36PyqSSZOPza1Rh52wO2Cq9CZ6fDCPtSIQE8ktoqoK+RzZAKYVFUO7NtaDzkWHAsftxnUktdYxG7cwRuo5Fr3szHrlZo9j43Okf8Jb3xRKqtyOGIs160ieG32Qyc+gSllRZhQ04/xaZ0c6nYkVLM8kD+vk0WJlaZiR5wn8u9ScFiQJ6alSHngw0TzXkhOiGvKl+1A14LU4J507/TcMjCzztHlIeKL6+o1mzyIdPxpU728bCXMjIK+9ffY3C/A22cFCohva1EYnR1HmMDncZorFlwo7KCjc0AnyCjXB7Yh8Jyp3FjsDUjdDipoPrMGQeCTQ98yTMzEQ3Y+zXB2BNTx2lnvHpXoehuNX6uCJmlOweRcMuXQk7GVeV3EFAfRnghXnaEbbLlrEJvgKTxNMJkFpdtI5IeSgNtbDh2hG9f6IZuZDa0EQ+38D13P7R8+9ZIBW2btpbSKeYXDl0A8vqDuaVJuEhmCmX4Pd5Kg0yrFPZoRYRYhuX0HmlcU50uTP/ty4qL6Zfh2rzfN9dvdRUcjVqECnTw206r7fptXZxIprh5o59i1BWYq4h5WeyxNwWH4VniaOw0eCODfvMEMFM/5SQtbCSLBqfVNFNYVQiCcOhJR4mZdTHYj+OUaACWaicVIT9XnEciiTyTp0CAIrhRInmvN+eUZne2PW6FDOYIgoNXLUbJOJl0TpP5nRG7zzi0RALdsoCwGlQbwSYVeqxPWw9iF+okskzO7n4+1rZaWV0XQ2Mn+ZMNJfen43if3MfUt2obX1v2eo96XnGOFUSlXI8r3xmnP9eZvT+/stX6HX9m4FZeLqriJ6Muzwq4y4F5fjRX/J2j7/KtNa/YZE/Zf/35///kf')))));
?>

Decoded(de-Obfuscated) php code

<?php

eval {
    //-- コメント
    $str = 'ABCDE';
    $int = 1234;
    /**
     * コメント
     */
    class Hoge
    {
        public static function fuge($str, $int)
        {
            if (!mb_strlen($str)) {
                die('$strが空だよ');
            }
            return mb_strtolower($str, 'UTF-8') . strval($int * 987);
        }
    }
    var_dump(Hoge::fuge($str, $int));
    // abcde1217958
};


Malware detection & removal plugin for WordPress

(C)2020 Wordpress Doctor All rights reserved.