PHP deobfuscation, decryption, reconstruction tool

De-obfuscate PHP malware/viruses and tampering code on Wordpress to original readable code.

*Please note that not all obfuscation codes can be decoded.

Decoded the code below.

<?php eval(base64_decode('CiBnb3RvIEVBZ2s0OyBMMGhPTjogVGRWS2E6IGdvdG8gWW4zWUg7IFdHOVMyOiBnb3RvIEtQaUlDOyBnb3RvIHdvdkd0OyBjRzFjbjogZWNobyAkdGl0bGU7IGdvdG8gbWp4Mmc7IG1qeDJnOiBnb3RvIFc3R2ZZOyBnb3RvIFdza2pKOyBUelFmMTogZ290byBUZFZLYTsgZ290byBMMGhPTjsgV3Nrako6IFc3R2ZZOiBnb3RvIEp6a3B2OyBaNXFnZToga1BOZmg...

Obfuscated php code

<?php eval(base64_decode('CiBnb3RvIEVBZ2s0OyBMMGhPTjogVGRWS2E6IGdvdG8gWW4zWUg7IFdHOVMyOiBnb3RvIEtQaUlDOyBnb3RvIHdvdkd0OyBjRzFjbjogZWNobyAkdGl0bGU7IGdvdG8gbWp4Mmc7IG1qeDJnOiBnb3RvIFc3R2ZZOyBnb3RvIFdza2pKOyBUelFmMTogZ290byBUZFZLYTsgZ290byBMMGhPTjsgV3Nrako6IFc3R2ZZOiBnb3RvIEp6a3B2OyBaNXFnZToga1BOZmg6IGdvdG8gUUwzMjE7IHdvdkd0OiBLUGlJQzogZ290byBjRzFjbjsgRUFnazQ6IGdvdG8ga1BOZmg7IGdvdG8gWjVxZ2U7IFluM1lIOiA/Pgo8IWRvY3R5cGVodG1sPjxodG1sIGxhbmc9ImZhIj48aGVhZD48bWV0YSBjaGFyc2V0PSJVVEYtOCI+PG1ldGEgY29udGVudD0id2lkdGg9ZGV2aWNlLXdpZHRoLGluaXRpYWwtc2NhbGU9MSJuYW1lPSJ2aWV3cG9ydCI+PHRpdGxlPjw/cGhwICBnb3RvIFdHOVMyOyBRTDMyMTogJHRpdGxlID0gIlwxMTFceDZlXHg2NFwxNDVcMTcwXDQwXHg1MFwxNDFcMTQ3XHg2NSI7IGdvdG8gVHpRZjE7IEp6a3B2OiA/Pgo8L3RpdGxlPjwvaGVhZD48Ym9keT48aDI+VGhpcyBpcyB0aGUgSW5kZXggUGdhZTwvaDI+PGEgaHJlZj0ic2Vjb25kLnBocCI+U2Vjb25kIFBhZ2U8L2E+PC9ib2R5PjwvaHRt')); ?>

Decoded(de-Obfuscated) php code

<?php

eval {
    $title = "Index Page";
    ?>
<!doctypehtml><html lang="fa"><head><meta charset="UTF-8"><meta content="width=device-width,initial-scale=1"name="viewport"><title><?php 
    echo $title;
    ?>
</title></head><body><h2>This is the Index Pgae</h2><a href="second.php">Second Page</a></body></htm<?php 
};

Malware detection & removal plugin for WordPress