PHP Malware Analysis
AcuTestEXIF1433.jpg
md5: 73c2e9cc35dc347063c546af847dbcca
Jump to:
- Deobfuscated code (Read more)
- Execution traces (Read more)
- Generated HTML (Read more)
- Original Code (Read more)
Screenshot
Attributes
Title
- AcuTestEXIF1433.jpg (128×128) (HTML)
URLs
- http://localhost/AcuTestEXIF1433.jpg (HTML)
- http://ns.adobe.com/xap/1.0/ (Original)
- http://ns.microsoft.com/photo/1.0/ (Original)
- http://purl.org/dc/elements/1.1/ (Original)
- http://www.w3.org/1999/02/22-rdf-syntax-ns# (Original)
Deobfuscated PHP code
Failed to deobfuscate codeExecution traces
Generated HTML code
<html style="height: 100%;"><head><meta name="viewport" content="width=device-width, minimum-scale=0.1"><title>AcuTestEXIF1433.jpg (128×128)</title></head><body style="margin: 0px; background: #0e0e0e; height: 100%"><img style="display: block;-webkit-user-select: none;margin: auto;background-color: hsl(0, 0%, 90%);transition: background-color 300ms;" src="http://localhost/AcuTestEXIF1433.jpg"></body></html>Original PHP code
��� Adobe d ���Exif MM * 4 � �; �� ��i b�� 8 ��� 8 ^�� 8 X�� 8 &�� 8 � � � � P �
*
T
8 � � 1 < s v g o n l o a d = a l e r t ( 7 3 4 6 7 6 3 ) > < s v g o n l o a d = a l e r t ( 7 3 4 6 7 6 3 ) > <svg onload=alert(7346763)> <svg onload=alert(7346763)> onload=alert'exif')> <svg onload=alert'exif')>; < s v g o n l o a d = a l e r t ( 7 3 4 6 7 6 3 ) > n l o a d = a l e r t ( 1 ) > < s v g o n l o a d = a l e r t ( 7 3 4 6 7 6 3 ) > n l o a d = a l e r t ( 1 ) > < s v g o n l o a d = a l e r t ( 7 3 4 6 7 6 3 ) > alert(1)> <svg onload=alert(7346763)> <svg onload=alert(7346763)> alert(1)> <svg onload=alert(7346763)> ou acunetix wvs � t � ���http://ns.adobe.com/xap/1.0/ <?xpacket begin='' id='W5M0MpCehiHzreSzNTczkc9d'?>
<x:xmpmeta xmlns:x="adobe:ns:meta/"><rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"><rdf:Description rdf:about="uuid:faf5bdd5-ba3d-11da-ad31-d33d75182f1b" xmlns:dc="http://purl.org/dc/elements/1.1/"><dc:rights><rdf:Alt xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"><rdf:li xml:lang="x-default"><svg onload=alert(7346763)></rdf:li></rdf:Alt>
</dc:rights><dc:title><rdf:Alt xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"><rdf:li xml:lang="x-default"><svg onload=alert(7346763)></rdf:li></rdf:Alt>
</dc:title><dc:description><rdf:Alt xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"><rdf:li xml:lang="x-default"><svg onload=alert(7346763)></rdf:li></rdf:Alt>
</dc:description><dc:creator><rdf:Seq xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"><rdf:li><svg onload=alert(7346763)></rdf:li></rdf:Seq>
</dc:creator><dc:subject><rdf:Bag xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"><rdf:li><svg onload=alert(7346763)></rdf:li></rdf:Bag>
</dc:subject></rdf:Description><rdf:Description rdf:about="uuid:faf5bdd5-ba3d-11da-ad31-d33d75182f1b" xmlns:MicrosoftPhoto="http://ns.microsoft.com/photo/1.0/"><MicrosoftPhoto:CameraSerialNumber><svg onload=alert(7346763)></MicrosoftPhoto:CameraSerialNumber><MicrosoftPhoto:FlashManufacturer><svg onload=alert(7346763)></MicrosoftPhoto:FlashManufacturer><MicrosoftPhoto:FlashModel><svg onload=alert(7346763)></MicrosoftPhoto:FlashModel><MicrosoftPhoto:LensManufacturer><svg onload=alert(7346763)></MicrosoftPhoto:LensManufacturer><MicrosoftPhoto:LensModel><svg onload=alert(7346763)></MicrosoftPhoto:LensModel><MicrosoftPhoto:LastKeywordXMP><rdf:Bag xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"><rdf:li><svg onload=alert(7346763)></rdf:li></rdf:Bag>
</MicrosoftPhoto:LastKeywordXMP></rdf:Description><rdf:Description rdf:about="uuid:faf5bdd5-ba3d-11da-ad31-d33d75182f1b" xmlns:dc="http://purl.org/dc/elements/1.1/"/></rdf:RDF></x:xmpmeta>
<?xpacket end='w'?>�� C ) )A&&AB///BG?>>?GGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGG�� C ))4&4?((?G?5?GGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGG�� � �" �� �� �� �� �� ? � ��