Benign php-malware-analysis Download

create_pl2_2

Executes a file from current directoryrm -rf shell command

SHA-256120f3780d2cf1b3e279bb60c51b7bec28805d3b1042b2375e02a83a4785d632f

Evidence

rm -rf shell command lines 7–8

7rm -rf $DST1
8mkdir $DST1

base64 -d/-D decode command lines 13–15

DN=$(echo $BN | sed -e 's/W..*//' -e 's/\./_/g')
#echo $NAME $BN $DN
base64 -d $NAME | ./xor - bWtmaWxl | base64 -d > $DST1/$DN