I found this backdoor on a client's website.

https://github.com/baogiaphucthinh/Malicious-php/blob/main/1259da6sc.php (original file)

I have gotten rid of it and realise it's an obfuscated script but how can I deobfuscate it in order to get to the root of this matter and understand the motive behind this attack better?


  • it looks like the main part is gzip compressed so try decompress to remove the obfuscation (at least the first layer) Commented Jun 21, 2021 at 17:38
  • thank you, i think he use TinyObfuscate, i saw the character is same same but i cant decode it
    – Joey Doe
    Commented Jun 22, 2021 at 6:22
  • So what's underneath gzip layer? Either it's done (post an answer) or if not update the question with more info. Commented Jun 22, 2021 at 16:00
  • @JoeyDoe why do you think it is TinyObfuscate? I wrote TinyObfuscate and I can help you decode it. Commented Aug 14, 2022 at 9:20


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.