In this article we want to show you some examples of malware code. Sometimes it is easy to decide, whether a part of code is malicious, sometimes it's not.
Malware with eval and base64_decode
This form of malware is one of the widest-spread types out there. It is easy to find code like this when looking at your php files.
Okay, that looks weired. If you run a base64_decrypt on the string, you get an eval(base64_decode()) again. So let's have a look at what's hidden inside this malware code.
$muie = file_get_contents('/tmp/.found/magerror.txt', FILE_USE_INCLUDE_PATH);
echo $muie ."\n";
$my_sloboz = '/tmp/.found/magerror.txt';
$handle = fopen($my_sloboz, 'w') or die('error: '.$my_sloboz); //make new file
This specific malware doesn't do any harm itself, but you get the point: There could be any code hidden in the base64 string.
So you might say: »Great! So I can delete all those eval(base64_decode()) crap!«
We wish it would be that easy, but sorry. There are lots of people out there that try to protect their code by »encrypting« it this way. Some of it just outputs a copyright notice, other creates a function that's needed by the software. You'll have to decode the string to know if it is really malware.
BEWARE! Never execute such code without checking it first!
Marius Burkard has been working as a software developer for 20 years and has several years of experience as a server administrator. As one of the lead developers of the ISPConfig control panel and technical contact for several hundred web hosting customers, he has extensive experience with malware, hacked websites and the analysis of vulnerabilities.