PHP Malware Analysis

Back to list

Tags

URLs
http://fonts.googleapis.com/css?family=Iceland
http://i.imgur.com/5xLle3r.gif
http://i.imgur.com/5xLle3r.gif
https://c.top4top.io/p_1728bwyqx1.jpg
https://facebook.com/Mr.QLQ.HaCK
https://www.youtube.com/watch?v=Qu4pp8o5Clo=0&showinfo=0&autohide=1&wmode=transparent&hd=1
Title
Hacked By Mr.QLQ

Deobfuscated code

<html><head>
<meta http-equiv="Content-Type" content="text/html; charset=windows-1252">
<title>Hacked By Mr.QLQ</title>
<meta name="keywords" content="LION OF SANAA">
<meta name="description" content="YEMEN.HACKER">
<link rel="shortcut icon" href="" type="image/x-icon">
<link href="http://fonts.googleapis.com/css?family=Iceland" rel="stylesheet" type="text/css">
</head><body background="http://i.imgur.com/5xLle3r.gif" bgcolor="#000000">
<style type="text/css">
<!--body,td,th {color: #CCCCCC;}
body {background="http://i.imgur.com/5xLle3r.gif"}
.style1 {font-family: Iceland;font-size: 10pt;}
.style2 {color: #00F000;font-weight: bold;}
.style3 {color: #FFFFFF}
.style7 {color: #FFFFFF; font-weight: bold; }
.style8 {font-family: Iceland;
font-size: 16pt;color: #FFFFFF;}
.style11 {font-size: 14pt}--></style></head>
<body bgcolor="#000000"> 
<center>
<pre><font color="red">

Attacker From Yemen

&#1578;&#1605; &#1575;&#1604;&#1575;&#1582;&#1578;&#1585;&#1575;&#1602; &#1605;&#1606; &#1602;&#1576;&#1604; &#1605;&#1587;&#1578;&#1585; &#1602;&#1604;&#1602; &#1571;&#1587;&#1583; &#1589;&#1606;&#1593;&#1575;&#1569;
                                                      
</font>"  &#1575;&#1604;&#1573;&#1582;&#1608;&#1575;&#1606; &#1608; &#1575;&#1604;&#1588;&#1610;&#1593;&#1607; &#1587;&#1576;&#1576; &#1583;&#1605;&#1575;&#1585; &#1575;&#1604;&#1608;&#1591;&#1606; &#1575;&#1604;&#1593;&#1585;&#1576;&#1610; " </pre>
<font face="Iceland" size="6" color="#FFFFFF"> 
<p align="center"><font color="red" face="Iceland" size="7">Hacked By Mr.QLQ</font></p><p align="center">
</font></p><center><font face="Iceland" size="5" color="#FFFFFF"><img style="-webkit-user-select: none" src="https://c.top4top.io/p_1728bwyqx1.jpg" width="490" height="359"><br>
<br><font color="red"><a href=""></a>  https://facebook.com/Mr.QLQ.HaCK  </font>
<iframe width="0" height="0" src="https://www.youtube.com/watch?v=Qu4pp8o5Clo=0&showinfo=0&autohide=1&wmode=transparent&hd=1" frameborder="0" allowfullscreen=""></iframe>


</font>
</font>
</font>
</center>
</center>
<script data-cfasync="false" src="/cdn-cgi/scripts/f2bf09f8/cloudflare-static/email-decode.min.js"></script></body>
</ht


Original code

<html><head>
<meta http-equiv="Content-Type" content="text/html; charset=windows-1252">
<title>Hacked By Mr.QLQ</title>
<meta name="keywords" content="LION OF SANAA">
<meta name="description" content="YEMEN.HACKER">
<link rel="shortcut icon" href="" type="image/x-icon">
<link href="http://fonts.googleapis.com/css?family=Iceland" rel="stylesheet" type="text/css">
</head><body background="http://i.imgur.com/5xLle3r.gif" bgcolor="#000000">
<style type="text/css">
<!--body,td,th {color: #CCCCCC;}
body {background="http://i.imgur.com/5xLle3r.gif"}
.style1 {font-family: Iceland;font-size: 10pt;}
.style2 {color: #00F000;font-weight: bold;}
.style3 {color: #FFFFFF}
.style7 {color: #FFFFFF; font-weight: bold; }
.style8 {font-family: Iceland;
font-size: 16pt;color: #FFFFFF;}
.style11 {font-size: 14pt}--></style></head>
<body bgcolor="#000000"> 
<center>
<pre><font color="red">

Attacker From Yemen

&#1578;&#1605; &#1575;&#1604;&#1575;&#1582;&#1578;&#1585;&#1575;&#1602; &#1605;&#1606; &#1602;&#1576;&#1604; &#1605;&#1587;&#1578;&#1585; &#1602;&#1604;&#1602; &#1571;&#1587;&#1583; &#1589;&#1606;&#1593;&#1575;&#1569;
                                                      
</font>"  &#1575;&#1604;&#1573;&#1582;&#1608;&#1575;&#1606; &#1608; &#1575;&#1604;&#1588;&#1610;&#1593;&#1607; &#1587;&#1576;&#1576; &#1583;&#1605;&#1575;&#1585; &#1575;&#1604;&#1608;&#1591;&#1606; &#1575;&#1604;&#1593;&#1585;&#1576;&#1610; " </pre>
<font face="Iceland" size="6" color="#FFFFFF"> 
<p align="center"><font color="red" face="Iceland" size="7">Hacked By Mr.QLQ</font></p><p align="center">
</font></p><center><font face="Iceland" size="5" color="#FFFFFF"><img style="-webkit-user-select: none" src="https://c.top4top.io/p_1728bwyqx1.jpg" width="490" height="359"><br>
<br><font color="red"><a href=""></a>  https://facebook.com/Mr.QLQ.HaCK  </font>
<iframe width="0" height="0" src="https://www.youtube.com/watch?v=Qu4pp8o5Clo=0&showinfo=0&autohide=1&wmode=transparent&hd=1" frameborder="0" allowfullscreen=""></iframe>


</font>
</font>
</font>
</center>
</center>
<script data-cfasync="false" src="/cdn-cgi/scripts/f2bf09f8/cloudflare-static/email-decode.min.js"></script></body>
</ht