PHP Malware Analysis

Back to list

Filename: wso.php

Tags

URLs

Deobfuscated code

<html><head><meta http-equiv="refresh" content="0;url=http://searchguide.level3.com/search/?q=http://repository.codehaus.org/org/apache/struts/struts2-plugins/wp-content/uploads/wso.php&t=0"/></head><body><script>window.location="http://searchguide.level3.com/search/?q="+escape(window.location)+"&r="+escape(document.referrer)+"&t=0";</script></body></html>


Original code

<html><head><meta http-equiv="refresh" content="0;url=http://searchguide.level3.com/search/?q=http://repository.codehaus.org/org/apache/struts/struts2-plugins/wp-content/uploads/wso.php&t=0"/></head><body><script>window.location="http://searchguide.level3.com/search/?q="+escape(window.location)+"&r="+escape(document.referrer)+"&t=0";</script></body></html>