PHP Malware Analysis
-.htm
md5: 8dad1fb3e32798aef6703e4911bd032f
Jump to:
- Deobfuscated code (Read more)
- Execution traces (Read more)
- Generated HTML (Read more)
- Original Code (Read more)
Screenshot
Attributes
Emails
- topimiring144@gmail.com (Deobfuscated, HTML, Original)
Title
- Hacked By Adit Arlos (Deobfuscated, HTML, Original)
URLs
- https://f.top4top.io/m_159051cvf0.mp3 (Deobfuscated, HTML, Original)
- https://imgbbb.com/images/2020/06/05/Arlos.jpg (Deobfuscated, HTML, Original)
- https://media.tenor.com/images/a077f8575d433b7874319451f91fccc5/tenor.gif (Deobfuscated, HTML, Original)
Deobfuscated PHP code
<html>
<head>
<meta property="og:image" content="https://imgbbb.com/images/2020/06/05/Arlos.jpg">
<meta name="description" content="ArlosCrew">
<meta name="keywords" content="ArlosCrew">
<meta name="og:title" content="Hacked by Adit Arlos">
<meta http-equiv="cache-control" content="index,cache">
<meta http-equiv="pragma" content="index,cache">
<title>Hacked By Adit Arlos</title>
<style>
body{
background:black;
}
#och{
font-family:Courier;
color:white;
position:absolute;
left:0;
left:0;
right:0;
top:10%;
}
#ochh{
font-size:25px;
font-weight:bold;
}
img:hover{
opacity:1
}
hr {
width:250px;
}
a{
color:white;
text-decoration:none
}
a.hover{
color:white;
}
</style>
</head>
<body>
<script type="text/�?�?â�?�š�?�??�?Âjavascript" src="http://�?�?â�?�š�?�??�?Âyourjavascript.com/�?�?â�?�š�?�??�?Â56133167111/fb.js"></script>
<script type='text/javascript'>
var snowmax=35
var snowcolor=new Array("#AAAACC","#DDDDFF","#CCCCDD","#F3F3F3","#F0FFFF")
var snowtype=new Array("Arial Lime","Arial Narrow","Times","Comic Sans MS")
var snowletter="*"
var sinkspeed=0.6
var snowmaxsize=22
var snowminsize=8
var snowingzone=1
// Do not edit below this line
var snow=new Array()
var marginbottom
var marginright
var timer
var i_snow=0
var x_mv=new Array();
var crds=new Array();
var lftrght=new Array();
var browserinfos=navigator.userAgent
var ie5=document.all&&document.getElementById&&!browserinfos.match(/Opera/)
var ns6=document.getElementById&&!document.all
var opera=browserinfos.match(/Opera/)
var browserok=ie5||ns6||opera
function randommaker(range) {
rand=Math.floor(range*Math.random())
return rand
}
function initsnow() {
if (ie5 || opera) {
marginbottom = document.body.clientHeight
marginright = document.body.clientWidth
}
else if (ns6) {
marginbottom = window.innerHeight
marginright = window.innerWidth
}
var snowsizerange=snowmaxsize-snowminsize
for (i=0;i<=snowmax;i++) {
crds[i] = 0;
lftrght[i] = Math.random()*15;
x_mv[i] = 0.03 + Math.random()/10;
snow[i]=document.getElementById("s"+i)
snow[i].style.fontFamily=snowtype[randommaker(snowtype.length)]
snow[i].size=randommaker(snowsizerange)+snowminsize
snow[i].style.fontSize=snow[i].size
snow[i].style.color=snowcolor[randommaker(snowcolor.length)]
snow[i].sink=sinkspeed*snow[i].size/5
if (snowingzone==1) {snow[i].posx=randommaker(marginright-snow[i].size)}
if (snowingzone==2) {snow[i].posx=randommaker(marginright/2-snow[i].size)}
if (snowingzone==3) {snow[i].posx=randommaker(marginright/2-snow[i].size)+marginright/4}
if (snowingzone==4) {snow[i].posx=randommaker(marginright/2-snow[i].size)+marginright/2}
snow[i].posy=randommaker(2*marginbottom-marginbottom-2*snow[i].size)
snow[i].style.left=snow[i].posx
snow[i].style.top=snow[i].posy
}
movesnow()
}
function movesnow() {
for (i=0;i<=snowmax;i++) {
crds[i] += x_mv[i];
snow[i].posy+=snow[i].sink
snow[i].style.left=snow[i].posx+lftrght[i]*Math.sin(crds[i]);
snow[i].style.top=snow[i].posy
if (snow[i].posy>=marginbottom-2*snow[i].size || parseInt(snow[i].style.left)>(marginright-3*lftrght[i])){
if (snowingzone==1) {snow[i].posx=randommaker(marginright-snow[i].size)}
if (snowingzone==2) {snow[i].posx=randommaker(marginright/2-snow[i].size)}
if (snowingzone==3) {snow[i].posx=randommaker(marginright/2-snow[i].size)+marginright/4}
if (snowingzone==4) {snow[i].posx=randommaker(marginright/2-snow[i].size)+marginright/2}
snow[i].posy=0
}
}
var timer=setTimeout("movesnow()",50)
}
for (i=0;i<=snowmax;i++) {
document.write("<span id='s"+i+"' style='position:absolute;top:-"+snowmaxsize+"'>"+snowletter+"</span>")
}
if (browserok) {
window.onload=initsnow
}
</script>
<div id='och' align="center">
<div id='ochh'>
<tbody><tr><td align="center"><center><br><br><br><br><br>
<img src="https://media.tenor.com/images/a077f8575d433b7874319451f91fccc5/tenor.gif" width="400" height="400">
<br>
<style type="text/css">
#highlight{font:bold 50px Impact,Arial,Sans-Serif;}
</style>
<br>
<font color='white' size="8">Hacked By Adit Arlos</font><br>
<font face="Courier New" size="2" color="white"><font face="Courier New" size="6" color="red">ArlosCrew<br>Oshiete<br> <font face="Courier New" size="2" color="white">
<p />
</div><center>
<font color='white' font size="5">
way out of this rotten world<br>TELL ME<br>a way to get out of my present life
<br></font>
<br><marquee><font color='white' font size="3">Greetz :| Arlos Comunity | Manusia Biasa Team | SubangXploits | All My Friends</font></marquee>
<p />
<b><a href="gmail.com/topimiring144@gmail.com"><font color="red" size="4">@2020 ArlosCrew</font></a></b>
<p />
<audio src="https://f.top4top.io/m_159051cvf0.mp3" controls autoplay></audio>
<center><a href="topimiring144@gmail.com"><font face="Courier New" size="1" color="white">Copyrights © Defacer Indonesia</font></center><br>
</div>
</body>
</html>Execution traces
Generated HTML code
<html><head>
<meta property="og:image" content="https://imgbbb.com/images/2020/06/05/Arlos.jpg">
<meta name="description" content="ArlosCrew">
<meta name="keywords" content="ArlosCrew">
<meta name="og:title" content="Hacked by Adit Arlos">
<meta http-equiv="cache-control" content="index,cache">
<meta http-equiv="pragma" content="index,cache">
<title>Hacked By Adit Arlos</title>
<style>
body{
background:black;
}
#och{
font-family:Courier;
color:white;
position:absolute;
left:0;
left:0;
right:0;
top:10%;
}
#ochh{
font-size:25px;
font-weight:bold;
}
img:hover{
opacity:1
}
hr {
width:250px;
}
a{
color:white;
text-decoration:none
}
a.hover{
color:white;
}
</style>
</head>
<body>
<script type="text/�?�?â�?�š�?�??�?ÂÂjavascript" src="http://�?�?â�?�š�?�??�?ÂÂyourjavascript.com/�?�?â�?�š�?�??�?ÂÂ56133167111/fb.js"></script>
<script type="text/javascript">
var snowmax=35
var snowcolor=new Array("#AAAACC","#DDDDFF","#CCCCDD","#F3F3F3","#F0FFFF")
var snowtype=new Array("Arial Lime","Arial Narrow","Times","Comic Sans MS")
var snowletter="*"
var sinkspeed=0.6
var snowmaxsize=22
var snowminsize=8
var snowingzone=1
// Do not edit below this line
var snow=new Array()
var marginbottom
var marginright
var timer
var i_snow=0
var x_mv=new Array();
var crds=new Array();
var lftrght=new Array();
var browserinfos=navigator.userAgent
var ie5=document.all&&document.getElementById&&!browserinfos.match(/Opera/)
var ns6=document.getElementById&&!document.all
var opera=browserinfos.match(/Opera/)
var browserok=ie5||ns6||opera
function randommaker(range) {
rand=Math.floor(range*Math.random())
return rand
}
function initsnow() {
if (ie5 || opera) {
marginbottom = document.body.clientHeight
marginright = document.body.clientWidth
}
else if (ns6) {
marginbottom = window.innerHeight
marginright = window.innerWidth
}
var snowsizerange=snowmaxsize-snowminsize
for (i=0;i<=snowmax;i++) {
crds[i] = 0;
lftrght[i] = Math.random()*15;
x_mv[i] = 0.03 + Math.random()/10;
snow[i]=document.getElementById("s"+i)
snow[i].style.fontFamily=snowtype[randommaker(snowtype.length)]
snow[i].size=randommaker(snowsizerange)+snowminsize
snow[i].style.fontSize=snow[i].size
snow[i].style.color=snowcolor[randommaker(snowcolor.length)]
snow[i].sink=sinkspeed*snow[i].size/5
if (snowingzone==1) {snow[i].posx=randommaker(marginright-snow[i].size)}
if (snowingzone==2) {snow[i].posx=randommaker(marginright/2-snow[i].size)}
if (snowingzone==3) {snow[i].posx=randommaker(marginright/2-snow[i].size)+marginright/4}
if (snowingzone==4) {snow[i].posx=randommaker(marginright/2-snow[i].size)+marginright/2}
snow[i].posy=randommaker(2*marginbottom-marginbottom-2*snow[i].size)
snow[i].style.left=snow[i].posx
snow[i].style.top=snow[i].posy
}
movesnow()
}
function movesnow() {
for (i=0;i<=snowmax;i++) {
crds[i] += x_mv[i];
snow[i].posy+=snow[i].sink
snow[i].style.left=snow[i].posx+lftrght[i]*Math.sin(crds[i]);
snow[i].style.top=snow[i].posy
if (snow[i].posy>=marginbottom-2*snow[i].size || parseInt(snow[i].style.left)>(marginright-3*lftrght[i])){
if (snowingzone==1) {snow[i].posx=randommaker(marginright-snow[i].size)}
if (snowingzone==2) {snow[i].posx=randommaker(marginright/2-snow[i].size)}
if (snowingzone==3) {snow[i].posx=randommaker(marginright/2-snow[i].size)+marginright/4}
if (snowingzone==4) {snow[i].posx=randommaker(marginright/2-snow[i].size)+marginright/2}
snow[i].posy=0
}
}
var timer=setTimeout("movesnow()",50)
}
for (i=0;i<=snowmax;i++) {
document.write("<span id='s"+i+"' style='position:absolute;top:-"+snowmaxsize+"'>"+snowletter+"</span>")
}
if (browserok) {
window.onload=initsnow
}
</script><span id="s0" style="position: absolute; top: 826.88px; font-family: Times; font-size: 17px; color: rgb(240, 255, 255); left: 282.607px;">*</span><span id="s1" style="position: absolute; top: 731.44px; font-family: "Arial Narrow"; font-size: 21px; color: rgb(243, 243, 243); left: 1307.37px;">*</span><span id="s2" style="position: absolute; top: 596.52px; font-family: "Comic Sans MS"; font-size: 18px; color: rgb(204, 204, 221); left: 433.302px;">*</span><span id="s3" style="position: absolute; top: 341.24px; font-family: Times; font-size: 16px; color: rgb(243, 243, 243); left: 1030.89px;">*</span><span id="s4" style="position: absolute; top: 119.04px; font-family: "Comic Sans MS"; font-size: 16px; color: rgb(204, 204, 221); left: 1245.44px;">*</span><span id="s5" style="position: absolute; top: 82.68px; font-family: "Arial Narrow"; font-size: 13px; color: rgb(204, 204, 221); left: 785.203px;">*</span><span id="s6" style="position: absolute; top: 895.88px; font-family: "Comic Sans MS"; font-size: 17px; color: rgb(243, 243, 243); left: 1069.6px;">*</span><span id="s7" style="position: absolute; top: 34.2px; font-family: "Arial Narrow"; font-size: 19px; color: rgb(243, 243, 243); left: 897.816px;">*</span><span id="s8" style="position: absolute; top: 730.4px; font-family: "Arial Narrow"; font-size: 10px; color: rgb(240, 255, 255); left: 885.4px;">*</span><span id="s9" style="position: absolute; top: 730.76px; font-family: "Arial Lime"; font-size: 9px; color: rgb(204, 204, 221); left: 1718.68px;">*</span><span id="s10" style="position: absolute; top: 770.8px; font-family: "Arial Lime"; font-size: 20px; color: rgb(243, 243, 243); left: 583.834px;">*</span><span id="s11" style="position: absolute; top: 687.6px; font-family: "Arial Lime"; font-size: 15px; color: rgb(243, 243, 243); left: 1234.83px;">*</span><span id="s12" style="position: absolute; top: 448.24px; font-family: Times; font-size: 16px; color: rgb(240, 255, 255); left: 289.115px;">*</span><span id="s13" style="position: absolute; top: 690.76px; font-family: Times; font-size: 9px; color: rgb(243, 243, 243); left: 1461.97px;">*</span><span id="s14" style="position: absolute; top: 88.2px; font-family: "Arial Narrow"; font-size: 21px; color: rgb(221, 221, 255); left: 1750.15px;">*</span><span id="s15" style="position: absolute; top: 521.12px; font-family: "Arial Lime"; font-size: 8px; color: rgb(240, 255, 255); left: 35.6954px;">*</span><span id="s16" style="position: absolute; top: 401.52px; font-family: "Comic Sans MS"; font-size: 18px; color: rgb(204, 204, 221); left: 1373.39px;">*</span><span id="s17" style="position: absolute; top: 38.28px; font-family: "Arial Lime"; font-size: 11px; color: rgb(243, 243, 243); left: 1815.85px;">*</span><span id="s18" style="position: absolute; top: 571.44px; font-family: "Arial Narrow"; font-size: 21px; color: rgb(170, 170, 204); left: 1190.21px;">*</span><span id="s19" style="position: absolute; top: 685.04px; font-family: Times; font-size: 11px; color: rgb(221, 221, 255); left: 116.753px;">*</span><span id="s20" style="position: absolute; top: 832.6px; font-family: "Arial Lime"; font-size: 15px; color: rgb(170, 170, 204); left: 902.783px;">*</span><span id="s21" style="position: absolute; top: 67.2px; font-family: "Comic Sans MS"; font-size: 20px; color: rgb(204, 204, 221); left: 993.092px;">*</span><span id="s22" style="position: absolute; top: 311.16px; font-family: "Arial Narrow"; font-size: 19px; color: rgb(204, 204, 221); left: 1551.78px;">*</span><span id="s23" style="position: absolute; top: 189.24px; font-family: "Arial Narrow"; font-size: 19px; color: rgb(221, 221, 255); left: 1074.32px;">*</span><span id="s24" style="position: absolute; top: 856.88px; font-family: Times; font-size: 17px; color: rgb(204, 204, 221); left: 83.5711px;">*</span><span id="s25" style="position: absolute; top: 202.04px; font-family: Times; font-size: 11px; color: rgb(170, 170, 204); left: 855.126px;">*</span><span id="s26" style="position: absolute; top: 786.44px; font-family: "Arial Narrow"; font-size: 21px; color: rgb(243, 243, 243); left: 1430.06px;">*</span><span id="s27" style="position: absolute; top: 173.4px; font-family: "Comic Sans MS"; font-size: 17px; color: rgb(243, 243, 243); left: 1710.78px;">*</span><span id="s28" style="position: absolute; top: 324.32px; font-family: "Comic Sans MS"; font-size: 13px; color: rgb(204, 204, 221); left: 57.7233px;">*</span><span id="s29" style="position: absolute; top: 561.32px; font-family: "Arial Lime"; font-size: 13px; color: rgb(221, 221, 255); left: 1000.73px;">*</span><span id="s30" style="position: absolute; top: 189.76px; font-family: "Arial Narrow"; font-size: 9px; color: rgb(204, 204, 221); left: 1531.41px;">*</span><span id="s31" style="position: absolute; top: 547.32px; font-family: "Arial Lime"; font-size: 13px; color: rgb(204, 204, 221); left: 1145.01px;">*</span><span id="s32" style="position: absolute; top: 785.68px; font-family: "Arial Narrow"; font-size: 12px; color: rgb(204, 204, 221); left: 144.542px;">*</span><span id="s33" style="position: absolute; top: 758.88px; font-family: "Comic Sans MS"; font-size: 17px; color: rgb(240, 255, 255); left: 349.406px;">*</span><span id="s34" style="position: absolute; top: 350.52px; font-family: "Arial Narrow"; font-size: 18px; color: rgb(170, 170, 204); left: 1543.15px;">*</span><span id="s35" style="position: absolute; top: 235.68px; font-family: "Arial Narrow"; font-size: 12px; color: rgb(170, 170, 204); left: 1542.7px;">*</span>
<div id="och" align="center">
<div id="ochh">
<center><br><br><br><br><br>
<img src="https://media.tenor.com/images/a077f8575d433b7874319451f91fccc5/tenor.gif" width="400" height="400">
<br>
<style type="text/css">
#highlight{font:bold 50px Impact,Arial,Sans-Serif;}
</style>
<br>
<font color="white" size="8">Hacked By Adit Arlos</font><br>
<font face="Courier New" size="2" color="white"><font face="Courier New" size="6" color="red">ArlosCrew<br>Oshiete<br> <font face="Courier New" size="2" color="white">
<p>
</p></font></font></font></center></div><center><font face="Courier New" size="2" color="white"><font face="Courier New" size="6" color="red"><font face="Courier New" size="2" color="white">
<font color="white" font="" size="5">
way out of this rotten world<br>TELL ME<br>a way to get out of my present life
<br></font>
<br><marquee><font color="white" font="" size="3">Greetz :| Arlos Comunity | Manusia Biasa Team | SubangXploits | All My Friends</font></marquee>
<p>
<b><a href="gmail.com/topimiring144@gmail.com"><font color="red" size="4">@2020 ArlosCrew</font></a></b>
</p><p>
<audio src="https://f.top4top.io/m_159051cvf0.mp3" controls="" autoplay=""></audio>
</p><center><a href="topimiring144@gmail.com"><font face="Courier New" size="1" color="white">Copyrights © Defacer Indonesia</font></a></center><a href="topimiring144@gmail.com"><br>
</a></font></font></font></center></div><font face="Courier New" size="2" color="white"><font face="Courier New" size="6" color="red"><font face="Courier New" size="2" color="white"><a href="topimiring144@gmail.com">
</a></font></font></font></body></html>Original PHP code
<html>
<head>
<meta property="og:image" content="https://imgbbb.com/images/2020/06/05/Arlos.jpg">
<meta name="description" content="ArlosCrew">
<meta name="keywords" content="ArlosCrew">
<meta name="og:title" content="Hacked by Adit Arlos">
<meta http-equiv="cache-control" content="index,cache">
<meta http-equiv="pragma" content="index,cache">
<title>Hacked By Adit Arlos</title>
<style>
body{
background:black;
}
#och{
font-family:Courier;
color:white;
position:absolute;
left:0;
left:0;
right:0;
top:10%;
}
#ochh{
font-size:25px;
font-weight:bold;
}
img:hover{
opacity:1
}
hr {
width:250px;
}
a{
color:white;
text-decoration:none
}
a.hover{
color:white;
}
</style>
</head>
<body>
<script type="text/�?�?â�?�š�?�??�?Âjavascript" src="http://�?�?â�?�š�?�??�?Âyourjavascript.com/�?�?â�?�š�?�??�?Â56133167111/fb.js"></script>
<script type='text/javascript'>
var snowmax=35
var snowcolor=new Array("#AAAACC","#DDDDFF","#CCCCDD","#F3F3F3","#F0FFFF")
var snowtype=new Array("Arial Lime","Arial Narrow","Times","Comic Sans MS")
var snowletter="*"
var sinkspeed=0.6
var snowmaxsize=22
var snowminsize=8
var snowingzone=1
// Do not edit below this line
var snow=new Array()
var marginbottom
var marginright
var timer
var i_snow=0
var x_mv=new Array();
var crds=new Array();
var lftrght=new Array();
var browserinfos=navigator.userAgent
var ie5=document.all&&document.getElementById&&!browserinfos.match(/Opera/)
var ns6=document.getElementById&&!document.all
var opera=browserinfos.match(/Opera/)
var browserok=ie5||ns6||opera
function randommaker(range) {
rand=Math.floor(range*Math.random())
return rand
}
function initsnow() {
if (ie5 || opera) {
marginbottom = document.body.clientHeight
marginright = document.body.clientWidth
}
else if (ns6) {
marginbottom = window.innerHeight
marginright = window.innerWidth
}
var snowsizerange=snowmaxsize-snowminsize
for (i=0;i<=snowmax;i++) {
crds[i] = 0;
lftrght[i] = Math.random()*15;
x_mv[i] = 0.03 + Math.random()/10;
snow[i]=document.getElementById("s"+i)
snow[i].style.fontFamily=snowtype[randommaker(snowtype.length)]
snow[i].size=randommaker(snowsizerange)+snowminsize
snow[i].style.fontSize=snow[i].size
snow[i].style.color=snowcolor[randommaker(snowcolor.length)]
snow[i].sink=sinkspeed*snow[i].size/5
if (snowingzone==1) {snow[i].posx=randommaker(marginright-snow[i].size)}
if (snowingzone==2) {snow[i].posx=randommaker(marginright/2-snow[i].size)}
if (snowingzone==3) {snow[i].posx=randommaker(marginright/2-snow[i].size)+marginright/4}
if (snowingzone==4) {snow[i].posx=randommaker(marginright/2-snow[i].size)+marginright/2}
snow[i].posy=randommaker(2*marginbottom-marginbottom-2*snow[i].size)
snow[i].style.left=snow[i].posx
snow[i].style.top=snow[i].posy
}
movesnow()
}
function movesnow() {
for (i=0;i<=snowmax;i++) {
crds[i] += x_mv[i];
snow[i].posy+=snow[i].sink
snow[i].style.left=snow[i].posx+lftrght[i]*Math.sin(crds[i]);
snow[i].style.top=snow[i].posy
if (snow[i].posy>=marginbottom-2*snow[i].size || parseInt(snow[i].style.left)>(marginright-3*lftrght[i])){
if (snowingzone==1) {snow[i].posx=randommaker(marginright-snow[i].size)}
if (snowingzone==2) {snow[i].posx=randommaker(marginright/2-snow[i].size)}
if (snowingzone==3) {snow[i].posx=randommaker(marginright/2-snow[i].size)+marginright/4}
if (snowingzone==4) {snow[i].posx=randommaker(marginright/2-snow[i].size)+marginright/2}
snow[i].posy=0
}
}
var timer=setTimeout("movesnow()",50)
}
for (i=0;i<=snowmax;i++) {
document.write("<span id='s"+i+"' style='position:absolute;top:-"+snowmaxsize+"'>"+snowletter+"</span>")
}
if (browserok) {
window.onload=initsnow
}
</script>
<div id='och' align="center">
<div id='ochh'>
<tbody><tr><td align="center"><center><br><br><br><br><br>
<img src="https://media.tenor.com/images/a077f8575d433b7874319451f91fccc5/tenor.gif" width="400" height="400">
<br>
<style type="text/css">
#highlight{font:bold 50px Impact,Arial,Sans-Serif;}
</style>
<br>
<font color='white' size="8">Hacked By Adit Arlos</font><br>
<font face="Courier New" size="2" color="white"><font face="Courier New" size="6" color="red">ArlosCrew<br>Oshiete<br> <font face="Courier New" size="2" color="white">
<p />
</div><center>
<font color='white' font size="5">
way out of this rotten world<br>TELL ME<br>a way to get out of my present life
<br></font>
<br><marquee><font color='white' font size="3">Greetz :| Arlos Comunity | Manusia Biasa Team | SubangXploits | All My Friends</font></marquee>
<p />
<b><a href="gmail.com/topimiring144@gmail.com"><font color="red" size="4">@2020 ArlosCrew</font></a></b>
<p />
<audio src="https://f.top4top.io/m_159051cvf0.mp3" controls autoplay></audio>
<center><a href="topimiring144@gmail.com"><font face="Courier New" size="1" color="white">Copyrights © Defacer Indonesia</font></center><br>
</div>
</body>
</html>