Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

A friend of mine recently discovered and sent me a small collection of trojan php scripts that were uploaded to his machine. Here's an example:


Why do attackers bother doing all of this? Any developer can trivially reverse these steps to see the source code.

The only reason I can imagine is an attempt to prevent antivirus detection against an existing codebase (base64() the script, you have a 'new' virus, at least for a few minutes).

This vector is largely successfully mitigated by things like heuristic virus detection, which looks precisely for suspicious snippets of source like this.

share|improve this question
In very simple terms, it defeats grep. – Jeff Ferland Aug 1 '12 at 19:50
Funnily enough, if I see base64_decode or eval anywhere it immediately sets off alarm bells as it's something that is rarely seen in 'normal' code. – Chris S Aug 1 '12 at 22:49
up vote 20 down vote accepted

This isn't aimed at defeating human analysis, it's aimed at defeating intrusion detection / prevention systems, and other automated scans, as the code comes into the network.

PHP is a Turing-complete language, which means that a single piece of code can be represented in a near-infinite number of ways. Automated systems have limited resources, and are designed with this fact in mind - they'll attempt to unravel basic eval obfuscation and other simple tricks, but there's little point attempting to analyse and identify every possible obfuscation technique. It's a losing battle, and their developers' time is much better spent implementing other features.

Once the code gets onto an internal system, it can be scanned by anti-malware software. These systems have access to the code as it runs, so it can be much more easily identified. There's no point analysing all the complex packing code when they can just identify the unpacked in-memory string using a simple detection signature.

share|improve this answer
Ah, so I was on the right track! Thanks, Polynomial. – msanford Aug 1 '12 at 19:48

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.