PHP Malware Analysis

up.php

md5: e08ddd912e77b33a1d065ce70aa4afdc

Jump to: 

Screenshot
Attributes
Files

Input

Deobfuscated PHP code

<?php 
$target_dir = "/avatars/";
$target_file = $target_dir . basename($_FILES["fileToUpload"]["name"]);
if (move_uploaded_file($_FILES["fileToUpload"]["tmp_name"], $target_file)) {
    echo "The file " . htmlspecialchars(basename($_FILES["fileToUpload"]["name"])) . " has been uploaded.";
} else {
    echo "Sorry, there was an error uploading your file.";
}
Execution traces
data/traces/e08ddd912e77b33a1d065ce70aa4afdc_trace-1676250452.1516.xt
Version: 3.1.0beta2
File format: 4
TRACE START [2023-02-12 23:07:58.049444]
1	0	1	0.000153	393464
1	3	0	0.000215	396080	{main}	1		/var/www/html/uploads/up.php	0	0
1		A						/var/www/html/uploads/up.php	3	$target_dir = '/avatars/'
2	4	0	0.000262	396080	basename	0		/var/www/html/uploads/up.php	4	1	NULL
2	4	1	0.000276	396144
2	4	R			''
1		A						/var/www/html/uploads/up.php	4	$target_file = '/avatars/'
2	5	0	0.000306	396080	move_uploaded_file	0		/var/www/html/uploads/up.php	6	2	NULL	'/avatars/'
2	5	1	0.000321	396152
2	5	R			FALSE
1	3	1	0.000335	396080
			0.000360	314320
TRACE END   [2023-02-12 23:07:58.049681]


Generated HTML code
<html><head></head><body>Sorry, there was an error uploading your file.</body></html>
Original PHP code

<?php
$target_dir = "/avatars/";
$target_file = $target_dir . basename($_FILES["fileToUpload"]["name"]);

  if (move_uploaded_file($_FILES["fileToUpload"]["tmp_name"], $target_file)) {
    echo "The file ". htmlspecialchars( basename( $_FILES["fileToUpload"]["name"])). " has been uploaded.";
  } else {
    echo "Sorry, there was an error uploading your file.";
  }
?>