PHP Malware Analysis

1.php

md5: 8ffeb14447aa705ffc813234eba26eee

Jump to:

Screenshot


Attributes


Deobfuscated PHP code

01558
08620
08219
08045
07568
06989
06882
03889
03668
03377
03333
02112
01936
01902
01733
01675
00496
01556
01456
01410
01375
01336
01234
01230
01212
01196
01103
00948
00713
00695
00675
00564

Execution traces

data/traces/8ffeb14447aa705ffc813234eba26eee_trace-1676256358.343.xt
Version: 3.1.0beta2
File format: 4
TRACE START [2023-02-13 00:46:24.240801]
1	0	1	0.000178	393464
1	3	0	0.000219	393240	{main}	1		/var/www/html/uploads/1.php	0	0
1	3	1	0.000235	393240
			0.000261	314200
TRACE END   [2023-02-13 00:46:24.240917]


Generated HTML code

<html><head></head><body>01558
08620
08219
08045
07568
06989
06882
03889
03668
03377
03333
02112
01936
01902
01733
01675
00496
01556
01456
01410
01375
01336
01234
01230
01212
01196
01103
00948
00713
00695
00675
00564
</body></html>

Original PHP code

01558
08620
08219
08045
07568
06989
06882
03889
03668
03377
03333
02112
01936
01902
01733
01675
00496
01556
01456
01410
01375
01336
01234
01230
01212
01196
01103
00948
00713
00695
00675
00564