I found this backdoor on a client's website.

https://github.com/baogiaphucthinh/Malicious-php/blob/main/1259da6sc.php (original file)

I have gotten rid of it and realise it's an obfuscated script but how can I deobfuscate it in order to get to the root of this matter and understand the motive behind this attack better?


  • it looks like the main part is gzip compressed so try decompress to remove the obfuscation (at least the first layer) Jun 21, 2021 at 17:38
  • thank you, i think he use TinyObfuscate, i saw the character is same same but i cant decode it
    – Joey Doe
    Jun 22, 2021 at 6:22
  • So what's underneath gzip layer? Either it's done (post an answer) or if not update the question with more info. Jun 22, 2021 at 16:00
  • @JoeyDoe why do you think it is TinyObfuscate? I wrote TinyObfuscate and I can help you decode it. yesterday


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.