Towards a PHP webshell taxonomy using deobfuscation-assisted similarity analysis
Towards a sandbox for the deobfuscation and dissection of PHP malware