Suspicious ^80% php-malware-analysis Download

decrypt

XOR decryption with hardcoded key

Base64 decoding behaviorEmits data with a PHP echo statement

SHA-256745a54ca1853e7ac08faccc14b66bfc186d4b2cd40fb2d5056411cea951eeda9

Evidence

References Mozilla/5.0 User-Agent prefix lines 1–25

1#!/usr/bin/env php
2<?php
3
4$pwd = md5('Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6');
5print("\$pwd = \"$pwd\"\n");
6#$action = iconv('UTF-8', "UTF-8", decrypt($argv[1], $pwd));
7$action = decrypt($argv[1], $pwd);
8echo $argv[1] . ' -> "' . $action . "\"\n";
9
10function decrypt($str, $pwd)
11{
12    $pwd = base64_encode($pwd);
13print("decrypt \$pwd = \"$pwd\"\n");
14    $str = base64_decode($str);
15    $enc_chr = '';
16    $enc_str = '';
17    $i = 0;
18    while ($i < strlen($str)) {
19        for ($j = 0; $j < strlen($pwd); $j++) {
20            $enc_chr = chr(ord($str[$i]) ^ ord($pwd[$j]));
21            $enc_str .= $enc_chr;
22            $i++;
23            if ($i >= strlen($str)) {
24                break;
25    …