PHP Malware Analysis

Back to list

Tags

URLs
https://c.top4top.io/p_1746kc5an0.png
https://e.top4top.io/p_15540apes0.png
https://cdnjs.cloudflare.com/ajax/libs/meyer-reset/2.0/reset.min.css
https://cdn.rawgit.com/bungfrangki/efeksalju/2a7805c7/efek-salju.js
https://cdnjs.cloudflare.com/ajax/libs/prefixfree/1.0.7/prefixfree.min.js
https://fonts.googleapis.com/css?family=Share+Tech+Mono
https://h.top4top.io/m_1698ayesx0.mp3
https://c.top4top.io/p_22254utcw3.jpg
https://g.top4top.io/m_1831mw9x60.mp3

Deobfuscated code


<!DOCTYPE html>
	<html>
<head>
	    <title>HACKED BY ./N4V3R5 Ft 4LF1_404
  </title>
    <meta name="author" content="iBOY"/>
    <meta name="description" content="SQUOT BADUT"/>
    <meta name="keywords" content="SQUOT BADUT"/>
    <meta http-equiv="cache-control" content="index,cache">
    <meta http-equiv="pragma" content="index,cache">
    <meta name="theme-color" content="black">
    <meta property="og:title" content="I'M? iBOY CYBER"/>
    <meta property="og:description" content="SQUOT BADUT"/>
    <meta property="og:image" content="https://c.top4top.io/p_1746kc5an0.png"/>
    <link rel="shortcut icon" href="https://e.top4top.io/p_15540apes0.png"/>
    <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/meyer-reset/2.0/reset.min.css">
    <script src="https://cdn.rawgit.com/bungfrangki/efeksalju/2a7805c7/efek-salju.js" type="text/javascript"> </script> 
    <script src="https://cdnjs.cloudflare.com/ajax/libs/prefixfree/1.0.7/prefixfree.min.js"></script>
   <link href="https://fonts.googleapis.com/css?family=Share+Tech+Mono" rel="stylesheet" type='text/css'> 
    <div style="height: auto; min-height: 100%;">
    <div style="text-align: center; width: 800px; margin-left: -400px; position: absolute; top: 16%; left: 50%;">
    <body bgcolor=black>
</head>
<body>
<iframe width="0" height="0" scrolling="no" frameborder="no" allow="autoplay" src="https://h.top4top.io/m_1698ayesx0.mp3"></iframe>
<img  width="820" src="https://c.top4top.io/p_22254utcw3.jpg">
<br><br>
<font face="Share Tech Mono" size="8" color="white">HACKED BY ./N4V3R5 Ft 4LF1_404</font>
</center><br>
<font face="Share Tech Mono" size="6" color="red">[WIBU TERSAKITI TEAM]</font>
	<br><br><br>
<font face="Share Tech Mono" size="5" color="white">"LEBIH BAIK MENCOBA,DAN TIDAK TAKUT DI BULLY DAN DIAM SAJA"</font><br>
<br><br><br>



</center><br><br>
<font face="Share Tech Mono" size="5" color="red"><br>&copy; ANONYMOUS<font size="5" color="white">INDONESIA</font><br>
<br>
<a href=""><font color="white"></a></font>
</body>
</html>

<center>
   <audio autoplay="autoplay" controls="controls" src="https://g.top4top.io/m_1831mw9x60.mp3" type="audio/mpeg"></audio>
   <br>


Original code


<!DOCTYPE html>
	<html>
<head>
	    <title>HACKED BY ./N4V3R5 Ft 4LF1_404
  </title>
    <meta name="author" content="iBOY"/>
    <meta name="description" content="SQUOT BADUT"/>
    <meta name="keywords" content="SQUOT BADUT"/>
    <meta http-equiv="cache-control" content="index,cache">
    <meta http-equiv="pragma" content="index,cache">
    <meta name="theme-color" content="black">
    <meta property="og:title" content="I'M? iBOY CYBER"/>
    <meta property="og:description" content="SQUOT BADUT"/>
    <meta property="og:image" content="https://c.top4top.io/p_1746kc5an0.png"/>
    <link rel="shortcut icon" href="https://e.top4top.io/p_15540apes0.png"/>
    <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/meyer-reset/2.0/reset.min.css">
    <script src="https://cdn.rawgit.com/bungfrangki/efeksalju/2a7805c7/efek-salju.js" type="text/javascript"> </script> 
    <script src="https://cdnjs.cloudflare.com/ajax/libs/prefixfree/1.0.7/prefixfree.min.js"></script>
   <link href="https://fonts.googleapis.com/css?family=Share+Tech+Mono" rel="stylesheet" type='text/css'> 
    <div style="height: auto; min-height: 100%;">
    <div style="text-align: center; width: 800px; margin-left: -400px; position: absolute; top: 16%; left: 50%;">
    <body bgcolor=black>
</head>
<body>
<iframe width="0" height="0" scrolling="no" frameborder="no" allow="autoplay" src="https://h.top4top.io/m_1698ayesx0.mp3"></iframe>
<img  width="820" src="https://c.top4top.io/p_22254utcw3.jpg">
<br><br>
<font face="Share Tech Mono" size="8" color="white">HACKED BY ./N4V3R5 Ft 4LF1_404</font>
</center><br>
<font face="Share Tech Mono" size="6" color="red">[WIBU TERSAKITI TEAM]</font>
	<br><br><br>
<font face="Share Tech Mono" size="5" color="white">"LEBIH BAIK MENCOBA,DAN TIDAK TAKUT DI BULLY DAN DIAM SAJA"</font><br>
<br><br><br>



</center><br><br>
<font face="Share Tech Mono" size="5" color="red"><br>&copy; ANONYMOUS<font size="5" color="white">INDONESIA</font><br>
<br>
<a href=""><font color="white"></a></font>
</body>
</html>

<center>
   <audio autoplay="autoplay" controls="controls" src="https://g.top4top.io/m_1831mw9x60.mp3" type="audio/mpeg"></audio>
   <br>