Benign php-malware-analysis Download

encrypt.php

Simple XOR encryption script

Base64 decoding behaviorPHP chr/ord XOR byte transform loop

SHA-25616dc3a4e2456b50ae419730338c73053c23b430865c0a687c819340e281cba8d

Evidence

MD5 hash computation lines 1–40

⋯8 lines
9print 'Encrypted: "'.$encrypted."\"\n";
10
11$decrypted = decrypt($encrypted, md5($pwd));
12print "Decrypted '".$decrypted."'\n";
13
14
15function encrypt($string, $pwd)
16{
17	$key = base64_encode(md5($pwd));  // Key string always 44 bytes
18	// strlen(md5($anything)) == 36
19
⋯4 lines
24
25	for ($i = 0; $i < $len; ++$i) {
26		$enc_str .= chr(ord($str[$i]) ^ ord($key[$i % 44]));
27	}
28
⋯4 lines
33{
34    $pwd = base64_encode($pwd);
35    $str = base64_decode($str);
36    $enc_chr = '';
37    $enc_str = '';
38    $i = 0;
39    while ($i < strlen($str)) {
40        for ($j = 0; $j < strlen($pwd) …