how can i decode this malware PHP script? [closed]

Answer 1

Ignore the first long variable ($eva1fYlbakBcVSir). You can go through and echo the other vars, which are written using escape sequences, and then you can decipher the rest of the code.

Answer 2

1. Properly indent the code (I used http://beta.phpformatter.com/)

   http://pastebin.com/A106eFjY

2. Look for function calls (func() or $func()).

   Line 14: `$eva1tYldokBcVSjr(..., $eva1tYldakBcVSir(...));

3. Comment out the function call, and echo $eva1tYldokBcVSjr (and $eva1tYldakBcVSir) to see what it's doing.

   echo $eva1tYldokBcVSjr; => 'preg_replace'
echo $eva1tYldakBcVSir;=> 'strrev'

4. echo out the parameters passed to $eva1tYldokBcVSjr() (preg_replace()).

   $eva1tYidokBcVSjr[0.016 * (7812.5 * 0.016)] => "@(.+)@ie"

$eva1tYidokBcVSjr[62.5 * 0.016] => "eval("\1");"

strrev($eva1tYidokBcVSjr[0.061 * 0.031]) => "@eval(base64_decode($eva1tYidakBcVSjr[1]));"

So line 14 decodes to (in a PHP regex anything can be a delimiter):

preg_replace("/(.+)/ie", 'eval("\1");', eval(base64_decode($eva1tYidakBcVSjr[1])));

The string that's being base64_decoded decodes to code with a bunch of evals in it.

http://pastebin.com/zRr9dMHN

Replace all those evals with echos, to see what's going on. There are even more eval(base64_decode(s.

http://pastebin.com/H9WcBFyJ

Changing those evals to echos gets you this:

http://pastebin.com/VaYCgUyK

I see a setcookie in there...

EDIT: Here's a post where someone continued decoding this:

http://www.thehosthelpers.com/technical-help/help-de-obfsucating-code/msg17585#msg17585

Answer 3

I immediately found pages like this on Google:

http://blog.sucuri.net/2011/10/evil-backdoors-part-ii.html

And it is also already asked here:

PHP Script in my Wordpress Files. Please Decode or Help Me Remove it

Answer 4

Code doesn't work at a one-to-one relationship. You can write any number of different codes to the same end. Because of this, de-obfuscating code is very difficult. You can try using some de-obfuscation extensions like this one, but I wouldn't get my hopes up on getting legible code back. Also, if the hacker is smart, he'll have used a number of redirects and other measures to make sure you can't track him even if you de-obfuscated the code.