PHP Malware Analysis

na.html

md5: b2e329a397ece93e37fa15f2b2e4119f

Jump to:

Screenshot


Attributes

Title

URLs


Deobfuscated PHP code


<html>	<head>		<title>Hacked By KrisnaGanz</title>	</head>		<script type="text/javascript">		var snowmax=50	var snowcolor=new Array("white")	var snowtype=new Array("Arial Black","Arial Narrow","Times","Comic Sans MS")	var snowletter="*"	var sinkspeed=0	var snowmaxsize=22	var snowminsize=8	var snowingzone=1		var snow=new Array()	var marginbottom	var marginright	var timer	var i_snow=0	var x_mv=new Array();	var crds=new Array();	var lftrght=new Array();	var browserinfos=navigator.userAgent 	var ie5=document.all&&document.getElementById&&!browserinfos.match(/Opera/)	var ns6=document.getElementById&&!document.all	var opera=browserinfos.match(/Opera/) 	var browserok=ie5||ns6||opera		function randommaker(range) {			rand=Math.floor(range*Math.random())	return rand	}		function initsnow() {		if (ie5 || opera) {			marginbottom = document.body.clientHeight			marginright = document.body.clientWidth		}		else if (ns6) {			marginbottom = window.innerHeight			marginright = window.innerWidth		}		var snowsizerange=snowmaxsize-snowminsize		for (i=0;i<=snowmax;i++) {			crds[i] = 0; 			lftrght[i] = Math.random()*15; 			x_mv[i] = 0.03 + Math.random()/10;			snow[i]=document.getElementById("s"+i)			snow[i].style.fontFamily=snowtype[randommaker(snowtype.length)]			snow[i].size=randommaker(snowsizerange)+snowminsize			snow[i].style.fontSize=snow[i].size			snow[i].style.color=snowcolor[randommaker(snowcolor.length)]			snow[i].sink=sinkspeed*snow[i].size/5			if (snowingzone==1) {snow[i].posx=randommaker(marginright-snow[i].size)}			if (snowingzone==2) {snow[i].posx=randommaker(marginright/2-snow[i].size)}			if (snowingzone==3) {snow[i].posx=randommaker(marginright/2-snow[i].size)+marginright/4}			if (snowingzone==4) {snow[i].posx=randommaker(marginright/2-snow[i].size)+marginright/2}			snow[i].posy=randommaker(2*marginbottom-marginbottom-2*snow[i].size)			snow[i].style.left=snow[i].posx			snow[i].style.top=snow[i].posy		}		movesnow()	}		function movesnow() {		for (i=0;i<=snowmax;i++) {			crds[i] += x_mv[i];			snow[i].posy+=snow[i].sink			snow[i].style.left=snow[i].posx+lftrght[i]*Math.sin(crds[i]);			snow[i].style.top=snow[i].posy				if (snow[i].posy>=marginbottom-2*snow[i].size || parseInt(snow[i].style.left)>(marginright-3*lftrght[i])){				if (snowingzone==1) {snow[i].posx=randommaker(marginright-snow[i].size)}				if (snowingzone==2) {snow[i].posx=randommaker(marginright/2-snow[i].size)}				if (snowingzone==3) {snow[i].posx=randommaker(marginright/2-snow[i].size)+marginright/4}				if (snowingzone==4) {snow[i].posx=randommaker(marginright/2-snow[i].size)+marginright/2}				snow[i].posy=0			}		}		var timer=setTimeout("movesnow()",50)	}		for (i=0;i<=snowmax;i++) {		document.write("<span id='s"+i+"' style='position:absolute;top:-"+snowmaxsize+"'>"+snowletter+"</span>")	}	if (browserok) {		window.onload=initsnow	}	</script>		<style type="text/css">		body {			background-color: black;		}		.a {			color: white;			font-size: 40px;			text-shadow: 2px 13px 1px grey;		}		.b {			color: white;			font-size: 20px;			text-shadow: 2px 10px 1px grey;		}		.blink {			animation: blink-animation 0.1s steps(1, start) infinite;			-webkit-animation: blink-animation 0.1s steps(3, start) infinite;		}		@keyframes blink-animation {			to {				visibility: hidden;			}		}		@-webkit-keyframes blink-animation {			to {				visibility: hidden;			}		}	</style>	<body>		<table width="100%" height="90%">			<td align="center">				<div class="blink"><i><code>					<div class="a" >						<font>Hacked By KrisnaGanz<br>			</div>				</div>				<div class="b">					<code>						<font>< Jateng BlackHat ></font>					</code>				</div>			</td>		</table><iframe width="0" height="0" src="https://j.top4top.io/m_2131h89ql1.mp3" frameborder="0" allowfullscreen></iframe> </body> </html>
>tml>

Execution traces


Generated HTML code

<html><head>		<title>Hacked By KrisnaGanz</title>	<script type="text/javascript">		var snowmax=50	var snowcolor=new Array("white")	var snowtype=new Array("Arial Black","Arial Narrow","Times","Comic Sans MS")	var snowletter="*"	var sinkspeed=0	var snowmaxsize=22	var snowminsize=8	var snowingzone=1		var snow=new Array()	var marginbottom	var marginright	var timer	var i_snow=0	var x_mv=new Array();	var crds=new Array();	var lftrght=new Array();	var browserinfos=navigator.userAgent 	var ie5=document.all&&document.getElementById&&!browserinfos.match(/Opera/)	var ns6=document.getElementById&&!document.all	var opera=browserinfos.match(/Opera/) 	var browserok=ie5||ns6||opera		function randommaker(range) {			rand=Math.floor(range*Math.random())	return rand	}		function initsnow() {		if (ie5 || opera) {			marginbottom = document.body.clientHeight			marginright = document.body.clientWidth		}		else if (ns6) {			marginbottom = window.innerHeight			marginright = window.innerWidth		}		var snowsizerange=snowmaxsize-snowminsize		for (i=0;i<=snowmax;i++) {			crds[i] = 0; 			lftrght[i] = Math.random()*15; 			x_mv[i] = 0.03 + Math.random()/10;			snow[i]=document.getElementById("s"+i)			snow[i].style.fontFamily=snowtype[randommaker(snowtype.length)]			snow[i].size=randommaker(snowsizerange)+snowminsize			snow[i].style.fontSize=snow[i].size			snow[i].style.color=snowcolor[randommaker(snowcolor.length)]			snow[i].sink=sinkspeed*snow[i].size/5			if (snowingzone==1) {snow[i].posx=randommaker(marginright-snow[i].size)}			if (snowingzone==2) {snow[i].posx=randommaker(marginright/2-snow[i].size)}			if (snowingzone==3) {snow[i].posx=randommaker(marginright/2-snow[i].size)+marginright/4}			if (snowingzone==4) {snow[i].posx=randommaker(marginright/2-snow[i].size)+marginright/2}			snow[i].posy=randommaker(2*marginbottom-marginbottom-2*snow[i].size)			snow[i].style.left=snow[i].posx			snow[i].style.top=snow[i].posy		}		movesnow()	}		function movesnow() {		for (i=0;i<=snowmax;i++) {			crds[i] += x_mv[i];			snow[i].posy+=snow[i].sink			snow[i].style.left=snow[i].posx+lftrght[i]*Math.sin(crds[i]);			snow[i].style.top=snow[i].posy				if (snow[i].posy>=marginbottom-2*snow[i].size || parseInt(snow[i].style.left)>(marginright-3*lftrght[i])){				if (snowingzone==1) {snow[i].posx=randommaker(marginright-snow[i].size)}				if (snowingzone==2) {snow[i].posx=randommaker(marginright/2-snow[i].size)}				if (snowingzone==3) {snow[i].posx=randommaker(marginright/2-snow[i].size)+marginright/4}				if (snowingzone==4) {snow[i].posx=randommaker(marginright/2-snow[i].size)+marginright/2}				snow[i].posy=0			}		}		var timer=setTimeout("movesnow()",50)	}		for (i=0;i<=snowmax;i++) {		document.write("<span id='s"+i+"' style='position:absolute;top:-"+snowmaxsize+"'>"+snowletter+"</span>")	}	if (browserok) {		window.onload=initsnow	}	</script><style type="text/css">		body {			background-color: black;		}		.a {			color: white;			font-size: 40px;			text-shadow: 2px 13px 1px grey;		}		.b {			color: white;			font-size: 20px;			text-shadow: 2px 10px 1px grey;		}		.blink {			animation: blink-animation 0.1s steps(1, start) infinite;			-webkit-animation: blink-animation 0.1s steps(3, start) infinite;		}		@keyframes blink-animation {			to {				visibility: hidden;			}		}		@-webkit-keyframes blink-animation {			to {				visibility: hidden;			}		}	</style></head>					<body>		<table width="100%" height="90%">			<tbody><tr><td align="center">				<div class="blink"><i><code>					<div class="a">						<font>Hacked By KrisnaGanz<br>			</font></div><font>				</font></code></i></div><i><code><font>				<div class="b">					<code>						<font>&lt; Jateng BlackHat &gt;</font>					</code>				</div>			</font></code></i></td>		</tr></tbody></table><iframe width="0" height="0" src="https://j.top4top.io/m_2131h89ql1.mp3" frameborder="0" allowfullscreen=""></iframe>  
&gt;tml&gt;</body></html>

Original PHP code


<html>	<head>		<title>Hacked By KrisnaGanz</title>	</head>		<script type="text/javascript">		var snowmax=50	var snowcolor=new Array("white")	var snowtype=new Array("Arial Black","Arial Narrow","Times","Comic Sans MS")	var snowletter="*"	var sinkspeed=0	var snowmaxsize=22	var snowminsize=8	var snowingzone=1		var snow=new Array()	var marginbottom	var marginright	var timer	var i_snow=0	var x_mv=new Array();	var crds=new Array();	var lftrght=new Array();	var browserinfos=navigator.userAgent 	var ie5=document.all&&document.getElementById&&!browserinfos.match(/Opera/)	var ns6=document.getElementById&&!document.all	var opera=browserinfos.match(/Opera/) 	var browserok=ie5||ns6||opera		function randommaker(range) {			rand=Math.floor(range*Math.random())	return rand	}		function initsnow() {		if (ie5 || opera) {			marginbottom = document.body.clientHeight			marginright = document.body.clientWidth		}		else if (ns6) {			marginbottom = window.innerHeight			marginright = window.innerWidth		}		var snowsizerange=snowmaxsize-snowminsize		for (i=0;i<=snowmax;i++) {			crds[i] = 0; 			lftrght[i] = Math.random()*15; 			x_mv[i] = 0.03 + Math.random()/10;			snow[i]=document.getElementById("s"+i)			snow[i].style.fontFamily=snowtype[randommaker(snowtype.length)]			snow[i].size=randommaker(snowsizerange)+snowminsize			snow[i].style.fontSize=snow[i].size			snow[i].style.color=snowcolor[randommaker(snowcolor.length)]			snow[i].sink=sinkspeed*snow[i].size/5			if (snowingzone==1) {snow[i].posx=randommaker(marginright-snow[i].size)}			if (snowingzone==2) {snow[i].posx=randommaker(marginright/2-snow[i].size)}			if (snowingzone==3) {snow[i].posx=randommaker(marginright/2-snow[i].size)+marginright/4}			if (snowingzone==4) {snow[i].posx=randommaker(marginright/2-snow[i].size)+marginright/2}			snow[i].posy=randommaker(2*marginbottom-marginbottom-2*snow[i].size)			snow[i].style.left=snow[i].posx			snow[i].style.top=snow[i].posy		}		movesnow()	}		function movesnow() {		for (i=0;i<=snowmax;i++) {			crds[i] += x_mv[i];			snow[i].posy+=snow[i].sink			snow[i].style.left=snow[i].posx+lftrght[i]*Math.sin(crds[i]);			snow[i].style.top=snow[i].posy				if (snow[i].posy>=marginbottom-2*snow[i].size || parseInt(snow[i].style.left)>(marginright-3*lftrght[i])){				if (snowingzone==1) {snow[i].posx=randommaker(marginright-snow[i].size)}				if (snowingzone==2) {snow[i].posx=randommaker(marginright/2-snow[i].size)}				if (snowingzone==3) {snow[i].posx=randommaker(marginright/2-snow[i].size)+marginright/4}				if (snowingzone==4) {snow[i].posx=randommaker(marginright/2-snow[i].size)+marginright/2}				snow[i].posy=0			}		}		var timer=setTimeout("movesnow()",50)	}		for (i=0;i<=snowmax;i++) {		document.write("<span id='s"+i+"' style='position:absolute;top:-"+snowmaxsize+"'>"+snowletter+"</span>")	}	if (browserok) {		window.onload=initsnow	}	</script>		<style type="text/css">		body {			background-color: black;		}		.a {			color: white;			font-size: 40px;			text-shadow: 2px 13px 1px grey;		}		.b {			color: white;			font-size: 20px;			text-shadow: 2px 10px 1px grey;		}		.blink {			animation: blink-animation 0.1s steps(1, start) infinite;			-webkit-animation: blink-animation 0.1s steps(3, start) infinite;		}		@keyframes blink-animation {			to {				visibility: hidden;			}		}		@-webkit-keyframes blink-animation {			to {				visibility: hidden;			}		}	</style>	<body>		<table width="100%" height="90%">			<td align="center">				<div class="blink"><i><code>					<div class="a" >						<font>Hacked By KrisnaGanz<br>			</div>				</div>				<div class="b">					<code>						<font>< Jateng BlackHat ></font>					</code>				</div>			</td>		</table><iframe width="0" height="0" src="https://j.top4top.io/m_2131h89ql1.mp3" frameborder="0" allowfullscreen></iframe> </body> </html>
>tml>