Why do attackers bother (trivially) obfuscating their source code?

Question

A friend of mine recently discovered and sent me a small collection of trojan php scripts that were uploaded to his machine. Here's an example:

eval(gzinflate(str_rot13(base64_decode('huge-string'))));
die;

Why do attackers bother doing all of this? Any developer can trivially reverse these steps to see the source code.

The only reason I can imagine is an attempt to prevent antivirus detection against an existing codebase (base64() the script, you have a 'new' virus, at least for a few minutes).

This vector is largely successfully mitigated by things like heuristic virus detection, which looks precisely for suspicious snippets of source like this.

Answer 1

This isn't aimed at defeating human analysis, it's aimed at defeating intrusion detection / prevention systems, and other automated scans, as the code comes into the network.

PHP is a Turing-complete language, which means that a single piece of code can be represented in a near-infinite number of ways. Automated systems have limited resources, and are designed with this fact in mind - they'll attempt to unravel basic eval obfuscation and other simple tricks, but there's little point attempting to analyse and identify every possible obfuscation technique. It's a losing battle, and their developers' time is much better spent implementing other features.

Once the code gets onto an internal system, it can be scanned by anti-malware software. These systems have access to the code as it runs, so it can be much more easily identified. There's no point analysing all the complex packing code when they can just identify the unpacked in-memory string using a simple detection signature.