Base64 of the encrypted php malware (after the initial decryption phase but before the XOR decryption): http://pastebin.com/YfcKSLQq http://pastebin.com/YfcKSLQ

Base64 of the encrypted php malware (after the initial decryption phase but before the XOR decryption): http://pastebin.com/YfcKSLQq http://pastebin.com/YfcKSLQq I tidied up the code I used to analyse it and uploaded it here:- xor.pl: http://pastebin.com/NBhmSu1k http://pastebin.com/NBhmSu1k (Focus was on a quick hack not code quality or documentation!)