PHP & JavaScript Malware Analysis (Webshell-Focused)

This repository contains sample code and deobfuscated (sanitized) code used for educational and defensive research on PHP and JavaScript malware—especially PHP webshells.

What’s inside

• Samples: representative snippets showing suspicious malicious behavior patterns
• Deobfuscated code: human-readable transformations to understand how the malware logic works (for analysis and learning)

Purpose

• Help learners understand how webshell-like code operates (defensively)
• Provide data to build detection ideas (rules/indicators and ML features)

Notes (important)

• This repo is for analysis and training only.
• Do not use this material to compromise systems—treat it as defensive research content.
• Avoid executing any code from this repository in real environments.

How to use

• Review the samples and compare them with the deobfuscated versions
• Extract indicators (tokens/strings/patterns) to label malicious vs benign behavior
• Use the code only in a safe, offline learning workflow (e.g., static analysis, feature extraction)