PHP Malware Analysis

0x48.html

md5: a1536815bb4a76658b932d57bd39fe72

Jump to:

Screenshot


Attributes

Title

URLs


Deobfuscated PHP code

<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html" ; charset="UTF-8">
<link rel="icon" type="image/png" href="https://f.top4top.io/p_19270dkhh0.jpg">
<title>BURN OUT!!!</title>
<meta name="description" content="Burn Out By Dit"> <link href="https://fonts.googleapis.com/css?family=Merienda&amp;display=swap" rel="stylesheet">
<link href="https://fonts.googleapis.com/css2?family=Noto+Serif+SC:wght@300&display=swap" rel="stylesheet">
<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css">
<link href="https://stackpath.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css" rel="stylesheet" type="text/css">
<style type="text/css">
		body {  
			padding: 0;   margin: 0;  height: 100vh;  width: 100%;  background-size: cover;   background-position: center;  overflow: hidden;
			   }   
		
		.bg {     
			position: absolute;     left: 0;    right: 0;     top: 0;     bottom: 0;    background: rgba(96, 90, 82, 0.37);
		   }   
		
		.box {    position: absolute;     left: 50%;    top: 50%;     transform: translate(-50%, -50%);     text-align: center;     width: 80%;     color: #fff;  }   h1 {  font-size: 50px;    letter-spacing: 2px;    font-family: 'Noto Serif SC', serif;   }   p {     font-size: 20px;    letter-spacing: 2px;    font-family: 'Merienda', cursive;   }   a {     text-decoration: none;  }   a:hover {     text-decoration: none   }   
		.btnn {
    align-items: center;
    justify-content: center;
    position: relative;
    left: 42%;
    top: 58%;
    background: transparent;
    letter-spacing: 0px;
    color: cyan;
    width: 60px;
    height: 25px;
    padding: 0;
    font-size: 15px;
    font-family:' Merienda', cursive;
  }
</style>
<style>
	img[alt*="https://i.ibb.co/P5BrVD4/129784-adapted-1080x2160.jpg "]{display:none}</style>
<script language="javascript"> function onKeyDown() { // current pressed key var pressedKey = String.fromCharCode(event.keyCode).toLowerCase(); if (event.ctrlKey && (pressedKey == "c" || pressedKey == "v" || pressedKey == "u")) { // disable key press porcessing event.returnValue = false; } } // onKeyDown </script> </head> <body onload="randombg()" id="random" onkeydown="onKeyDown()">
<div class="bg"></div>
<div class="box">
<h1>サダム</font></h1>
<p> <h2>UnLocked by Zho ;)</h2> <marquee direction="left">Support My Old Team - Indonesian Bug Hunter 
- CytoXploit</marquee></h3></font></b><center></p><p>Pesan:<br>berharap setelah aku berhasil login di hati kamu ga akan ada tombol logout, dan sessionku ga bakal pernah expired.</br>
<p>
<b><marquee direction="left">I Dont Know What Hurt The Most.. Holding Or Letting Go</marquee></h3></font></b> </div></p>
<audio id="myAudio">
            <source src="https://g.top4top.io/m_1738upsbi1.mp3" type="audio/ogg">
            <source src="https://g.top4top.io/m_1738upsbi1.mp3" type="audio/mpeg">
        </audio>
        <button onclick="playAudio()" class="btnn" type="button">PLAY!!</button>
        &nbsp;&nbsp;
        <button onclick="pauseAudio()" class="btnn" type="button">STOP?</button>
        <script>
              var x = document.getElementById("myAudio"); 

              function playAudio() { 
                  x.play(); 
              } 

               function pauseAudio() { 
                  x.pause(); 
              } 
        </script>  <center> </center> <style> body { background: url("https://64.media.tumblr.com/02d1f76324f05100f1b5d7189a384da1/tumblr_ptn4hdw5C01roqdm2_540.gif") no-repeat fixed; background-size: 100% 100%; background-color: black; color: white; } } </style>
</body> </html>

Execution traces


Generated HTML code

<html><head>
<meta http-equiv="Content-Type" content="text/html" ;="" charset="UTF-8">
<link rel="icon" type="image/png" href="https://f.top4top.io/p_19270dkhh0.jpg">
<title>BURN OUT!!!</title>
<meta name="description" content="Burn Out By Dit"> <link href="https://fonts.googleapis.com/css?family=Merienda&amp;display=swap" rel="stylesheet">
<link href="https://fonts.googleapis.com/css2?family=Noto+Serif+SC:wght@300&amp;display=swap" rel="stylesheet">
<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css">
<link href="https://stackpath.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css" rel="stylesheet" type="text/css">
<style type="text/css">
		body {  
			padding: 0;   margin: 0;  height: 100vh;  width: 100%;  background-size: cover;   background-position: center;  overflow: hidden;
			   }   
		
		.bg {     
			position: absolute;     left: 0;    right: 0;     top: 0;     bottom: 0;    background: rgba(96, 90, 82, 0.37);
		   }   
		
		.box {    position: absolute;     left: 50%;    top: 50%;     transform: translate(-50%, -50%);     text-align: center;     width: 80%;     color: #fff;  }   h1 {  font-size: 50px;    letter-spacing: 2px;    font-family: 'Noto Serif SC', serif;   }   p {     font-size: 20px;    letter-spacing: 2px;    font-family: 'Merienda', cursive;   }   a {     text-decoration: none;  }   a:hover {     text-decoration: none   }   
		.btnn {
    align-items: center;
    justify-content: center;
    position: relative;
    left: 42%;
    top: 58%;
    background: transparent;
    letter-spacing: 0px;
    color: cyan;
    width: 60px;
    height: 25px;
    padding: 0;
    font-size: 15px;
    font-family:' Merienda', cursive;
  }
</style>
<style>
	img[alt*="https://i.ibb.co/P5BrVD4/129784-adapted-1080x2160.jpg "]{display:none}</style>
<script language="javascript"> function onKeyDown() { // current pressed key var pressedKey = String.fromCharCode(event.keyCode).toLowerCase(); if (event.ctrlKey && (pressedKey == "c" || pressedKey == "v" || pressedKey == "u")) { // disable key press porcessing event.returnValue = false; } } // onKeyDown </script> </head> <body onload="randombg()" id="random" onkeydown="onKeyDown()">
<div class="bg"></div>
<div class="box">
<h1>サダム</h1>
<p> </p><h2>UnLocked by Zho ;)</h2> <marquee direction="left">Support My Old Team - Indonesian Bug Hunter 
- CytoXploit</marquee><center><p></p><p>Pesan:<br>berharap setelah aku berhasil login di hati kamu ga akan ada tombol logout, dan sessionku ga bakal pernah expired.<br>
</p><p>
<b><marquee direction="left">I Dont Know What Hurt The Most.. Holding Or Letting Go</marquee></b> </p></center></div><p></p>
<audio id="myAudio">
            <source src="https://g.top4top.io/m_1738upsbi1.mp3" type="audio/ogg">
            <source src="https://g.top4top.io/m_1738upsbi1.mp3" type="audio/mpeg">
        </audio>
        <button onclick="playAudio()" class="btnn" type="button">PLAY!!</button>
        &nbsp;&nbsp;
        <button onclick="pauseAudio()" class="btnn" type="button">STOP?</button>
        <script>
              var x = document.getElementById("myAudio"); 

              function playAudio() { 
                  x.play(); 
              } 

               function pauseAudio() { 
                  x.pause(); 
              } 
        </script>  <center> </center> <style> body { background: url("https://64.media.tumblr.com/02d1f76324f05100f1b5d7189a384da1/tumblr_ptn4hdw5C01roqdm2_540.gif") no-repeat fixed; background-size: 100% 100%; background-color: black; color: white; } } </style>
 </body></html>

Original PHP code

<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html" ; charset="UTF-8">
<link rel="icon" type="image/png" href="https://f.top4top.io/p_19270dkhh0.jpg">
<title>BURN OUT!!!</title>
<meta name="description" content="Burn Out By Dit"> <link href="https://fonts.googleapis.com/css?family=Merienda&amp;display=swap" rel="stylesheet">
<link href="https://fonts.googleapis.com/css2?family=Noto+Serif+SC:wght@300&display=swap" rel="stylesheet">
<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css">
<link href="https://stackpath.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css" rel="stylesheet" type="text/css">
<style type="text/css">
		body {  
			padding: 0;   margin: 0;  height: 100vh;  width: 100%;  background-size: cover;   background-position: center;  overflow: hidden;
			   }   
		
		.bg {     
			position: absolute;     left: 0;    right: 0;     top: 0;     bottom: 0;    background: rgba(96, 90, 82, 0.37);
		   }   
		
		.box {    position: absolute;     left: 50%;    top: 50%;     transform: translate(-50%, -50%);     text-align: center;     width: 80%;     color: #fff;  }   h1 {  font-size: 50px;    letter-spacing: 2px;    font-family: 'Noto Serif SC', serif;   }   p {     font-size: 20px;    letter-spacing: 2px;    font-family: 'Merienda', cursive;   }   a {     text-decoration: none;  }   a:hover {     text-decoration: none   }   
		.btnn {
    align-items: center;
    justify-content: center;
    position: relative;
    left: 42%;
    top: 58%;
    background: transparent;
    letter-spacing: 0px;
    color: cyan;
    width: 60px;
    height: 25px;
    padding: 0;
    font-size: 15px;
    font-family:' Merienda', cursive;
  }
</style>
<style>
	img[alt*="https://i.ibb.co/P5BrVD4/129784-adapted-1080x2160.jpg "]{display:none}</style>
<script language="javascript"> function onKeyDown() { // current pressed key var pressedKey = String.fromCharCode(event.keyCode).toLowerCase(); if (event.ctrlKey && (pressedKey == "c" || pressedKey == "v" || pressedKey == "u")) { // disable key press porcessing event.returnValue = false; } } // onKeyDown </script> </head> <body onload="randombg()" id="random" onkeydown="onKeyDown()">
<div class="bg"></div>
<div class="box">
<h1>サダム</font></h1>
<p> <h2>UnLocked by Zho ;)</h2> <marquee direction="left">Support My Old Team - Indonesian Bug Hunter 
- CytoXploit</marquee></h3></font></b><center></p><p>Pesan:<br>berharap setelah aku berhasil login di hati kamu ga akan ada tombol logout, dan sessionku ga bakal pernah expired.</br>
<p>
<b><marquee direction="left">I Dont Know What Hurt The Most.. Holding Or Letting Go</marquee></h3></font></b> </div></p>
<audio id="myAudio">
            <source src="https://g.top4top.io/m_1738upsbi1.mp3" type="audio/ogg">
            <source src="https://g.top4top.io/m_1738upsbi1.mp3" type="audio/mpeg">
        </audio>
        <button onclick="playAudio()" class="btnn" type="button">PLAY!!</button>
        &nbsp;&nbsp;
        <button onclick="pauseAudio()" class="btnn" type="button">STOP?</button>
        <script>
              var x = document.getElementById("myAudio"); 

              function playAudio() { 
                  x.play(); 
              } 

               function pauseAudio() { 
                  x.pause(); 
              } 
        </script>  <center> </center> <style> body { background: url("https://64.media.tumblr.com/02d1f76324f05100f1b5d7189a384da1/tumblr_ptn4hdw5C01roqdm2_540.gif") no-repeat fixed; background-size: 100% 100%; background-color: black; color: white; } } </style>
</body> </html>