I found this backdoor on a client's website.

https://github.com/baogiaphucthinh/Malicious-php/blob/main/1259da6sc.php (original file)

I have gotten rid of it and realise it's an obfuscated script but how can I deobfuscate it in order to get to the root of this matter and understand the motive behind this attack better?


  • it looks like the main part is gzip compressed so try decompress to remove the obfuscation (at least the first layer) Jun 21, 2021 at 17:38
  • thank you, i think he use TinyObfuscate, i saw the character is same same but i cant decode it
    – Joey Doe
    Jun 22, 2021 at 6:22
  • So what's underneath gzip layer? Either it's done (post an answer) or if not update the question with more info. Jun 22, 2021 at 16:00


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.