Linked Questions

0
votes
1answer
200 views

What does this malware php file does and what should be done about it? [duplicate]

Can someone please help me understand this code, what it does and what kind of encoding is it? Can this be automatically removed through ssh (there are many, many more similar files found). <?php $...
2
votes
1answer
170 views

Unknown PHP file in my upload folder, isn't malicious code? [duplicate]

Recently i found out my project got hacked and i found a script in my images folder which where a directory for user to upload their images (using file input). Here is the script that i found in the ...
0
votes
1answer
126 views

What does the attached php malware do? [duplicate]

Found this on a WordPress server under the filename wp-includes/class-wp-image-editor-fd.php when WordFence picked it up as being an unexpected file. Link to source is here: https://pastebin.com/...
1
vote
0answers
145 views

Obfuscated PHP code found in WordPress core files and plugins [duplicate]

I am running a Wordpress website and I've recently found this php code injected in many of my php files. https://www.unphp.net/decode/fb4715ee71b28135f6807389df42611c/ I tried adding some print_r(...
1
vote
1answer
143 views

PHP Malware - deobsfucation [duplicate]

I have a php7 site that had some malware type files uploaded to it. My hosting provider notified me of it and I have removed them, but I wanted help in understanding the attack (help de-obsfucating, ...
1
vote
0answers
68 views

What's the point of this php shell? [duplicate]

What is the point of this shell code? There is no other code in the file. @preg_match_all("/\t \t(.+)\t\t/Ui",@file_get_contents(__FILE__),$r); $w="";foreach($r[1] as $v){@$w.=@chr(@strlen($v));} $e=...
0
votes
0answers
60 views

Found suspicious, obfuscated PHP file. I assume this is a successful hack on my website? Can anyone tell me what this code is doing? [duplicate]

Found suspicious, obfuscated PHP file. I assume this is a successful hack on my website? Can anyone tell me what this code is doing? fuifsaat.php <?php $hereto= '](^';$canon =':';$heroine= '(rp:L'...
1
vote
0answers
60 views

Bizarre php file appeared in the image gallery folder of my website [duplicate]

Can anyone tell what this is or how it could possibly have made it to the image gallery folder of my website? It appears to be a bunch of variable definitions. Mind you that a period "." is the concat ...
0
votes
0answers
58 views

How can I tell is the hidden PHP code inside of a GIf file is dangerous? [duplicate]

I'm helping out a friend with a PHP website he has been running for a few years. He is not PHP developer, so he asked if I could help him out. I download the contents of the server files onto my ...
2
votes
0answers
55 views

What can be done to decode/recover encoded PHP files? [duplicate]

We had a former employee handling one of our servers where XAMPP was used to host some PHP based websites. Now that employee left the organization due to some management issues. Yesterday we needed ...
0
votes
0answers
39 views

Hacking attempts to our server - what does this code do? [duplicate]

Every so often I go back and check our server and find random files uploaded to the domain root directory. They are seemingly cryptic and have names like css2.php db_model.php ....
1
vote
0answers
38 views

Found possible malware code on site - contacted owner - what does it do? [duplicate]

Small question. I'm trying to figure out what a piece of code does that I came across on a website I visited. The website has obviously been hacked into, as there's a bunch of minified PHP code up ...
0
votes
0answers
25 views

How do I go about decoding this malicious PHP script? [duplicate]

I came upon this script just by luck, actually. Ironically, it's stored in a protected folder on my website and I don't think <? $catches ='r'; $comforter ='$r)ciEVi'; $heroin = 'SgD'; $...
0
votes
0answers
22 views

I found this code in my wp-content/uploads/woocommerce_uploads/wp-user-new.php [duplicate]

<?php function Gljng($ZOege, $INLWC = '') { $X_6Nm = $ZOege; $v9BZR = ''; for ($hfEHR = 0; $hfEHR < strlen($X_6Nm);) { for ($SsuGo = 0; $SsuGo < strlen($INLWC) && $hfEHR < ...
0
votes
0answers
20 views

How to deobfuscate malicious PHP code [duplicate]

This is my first malware analyis, so apologies for my probably noob-like question. I'm having a look at a website running an outdated version of Wordpress which was hacked. The Website runs on a ...

15 30 50 per page