PHP Malware Analysis

alfa.php

md5: 8cd8ea0b7ea4fedaa08be38467e6af11

Jump to:

Screenshot


Attributes

Title


Deobfuscated PHP code

<!DOCTYPE html>
<html>
    <head>
        <meta charset="UTF-8" />
        <meta http-equiv="refresh" content="0;url='/apps/member/login'" />

        <title>Redirecting to /apps/member/login</title>
    </head>
    <body>
        Redirecting to <a href="/apps/member/login">/apps/member/login</a>.
    </body>
</html>

Execution traces

data/traces/8cd8ea0b7ea4fedaa08be38467e6af11_trace-1676257024.1005.xt
Version: 3.1.0beta2
File format: 4
TRACE START [2023-02-13 00:57:29.998346]
1	0	1	0.000131	393512
1	3	0	0.000171	393416	{main}	1		/var/www/html/uploads/alfa.php	0	0
1	3	1	0.000187	393416
			0.000211	314224
TRACE END   [2023-02-13 00:57:29.998452]


Generated HTML code

<html><head>
<title>404 Not Found</title>
</head><body>
<h1>Not Found</h1>
<p>The requested URL was not found on this server.</p>
<hr>
<address>Apache/2.4.52 (Ubuntu) Server at localhost Port 80</address>

</body></html>

Original PHP code

<!DOCTYPE html>
<html>
    <head>
        <meta charset="UTF-8" />
        <meta http-equiv="refresh" content="0;url='/apps/member/login'" />

        <title>Redirecting to /apps/member/login</title>
    </head>
    <body>
        Redirecting to <a href="/apps/member/login">/apps/member/login</a>.
    </body>
</html>