I need little help - Githubissues

ghost commented 4 years ago

Hi i need help aboud merged and obfuscated codes, I have both file for decode, one of if variable definations called name is eg: code like this ` public $x673 = null; public $x681 = null; public $x68c = null; public $x6be = null;

function __construct()
{
    $this->x673 = new \StdClass();
    $this->x681 = new \StdClass();
    $this->x68c = new \StdClass();
    $this->x6be = new \StdClass();
    $this->x673->x6cf = "\x78\66\143\144";
    $this->x6be->x176c = "\1PbqpeGUtu6gwPq2ujNkcnqEkDHqHqk2eR7";
    $this->x673->x8bf = "\x78\70b\141";
    $this->x681->xbfc = "\x78b\146\70";
    $this->x6be->x13d4 = "\x78\61\63d\61";....`

and another obfuscated file also taking function or variable names from this file with class extends.
how can decode thoose files correctly ? if i decode first files ( definations only ) its corrcectly decode, but another one give me following errors Couldn't find variable name Couldn't find variable name Could not find function name to see if arguments get replaced, line 13. Couldn't find variable name Could not find function name to see if arguments get replaced, line 13. Couldn't find variable name Could not find function name to see if arguments get replaced, line 13. Could not find function name to see if arguments get replaced, line 13. Could not find function name to see if arguments get replaced, line 13. Could not find function name to see if arguments get replaced, line 13. Could not find function name to see if arguments get replaced, line 13. Could not find function name to see if arguments get replaced, line 13.

bediger4000 commented 4 years ago

Hello. Thanks for the comment. I need more information to answer this. Can I get a copy of the file(s) you are attempting to de-obfuscate?

ghost commented 4 years ago

hi you can check files here. https://drive.google.com/file/d/15C922fkgG8k-5vPYcK50s8RF5CdZ60D5/view

ghost commented 4 years ago

any news ?

bediger4000 / reverse-php-malware

I need little help #4