PHP Malware Analysis

index.html

md5: f81b0e793838743940849267ff1ab08e

Jump to:

Screenshot


Attributes

Title

URLs


Deobfuscated PHP code

<html>
<head>
<title>Hacked by Jon !!!!</title>
<iframe width="1" height="1" src="https://www.youtube.com/embed/EqXqSnMjg6U?rel=0&amp;autoplay=1&amp;loop=3" frameborder="0" allowfullscreen></iframe>
</head>
<body background="https://wallpapers.com/images/featured/75yqzvkpketv5cob.jpg" >
<center><br><h1><span style="color:Lime;font-family:Iceland;text-shadow:black 0px 0px 10px">[+] Hacked by Jon !!!! [+]</span></h1>
<br> 
<script language="JavaScript">
var text="Those little boys Run, jump and charge Look friends, they collide with bombs and bullets Only with stones Those little boys Running without fear Hunt without a doubt This is not all in a fantasy land These are all real events that were there, In the homeland of the Prophets, in Palestine There is no compulsion for them to move There is also no reward for their wounds It's all just because they want His pleasure And just want His heaven And the land of Palestine is free, from the hands of the Jews, Laknatullah Don't ask when they will stop Don't wait when they will complain Because they will always come back To free the holy land and free their brothers and sisters And there will always be heard Throwing stones and shouting Allahu Akbar..!! Who said they lost? who said they cry.? Even the opponent is scared and trembled for shelter because of their courage Who said they were wrong.? who said they were crybaby Even the Malikats and the heavens praise him, praise all his bravery Because they always believe in Allah's promises They believe that Allah will always be with them Accompany their days, sigh His breath, in the recesses of His heart Allahu Albar, Allahhu Akbar. The roar of takbir will always be heard in Beloved Palestine.";
var delay=15;
var currentChar=1;
var destination="[none]";
function type()
{
//if (document.all)
{
var dest=document.getElementById(destination);
if (dest)// && dest.innerHTML)
{
dest.innerHTML=text.substr(0, currentChar)+"<blink>_</blink>";
currentChar++;
if (currentChar>text.length)
{
currentChar=1;
setTimeout("type()", 5000);
}
else
{
setTimeout("type()", delay);
}
}
}
}
function startTyping(textParam, delayParam, destinationParam)
{
text=textParam;
delay=delayParam;
currentChar=1;
destination=destinationParam;
type();
}
</script> 

<b><div 0px="" 12px="" Times New Roman="" color:="" ff0000="" font:="" id="textDestination" margin:="" style="background-color: glow;"></div></b> <script language="JavaScript">
javascript:startTyping(text, 50, "textDestination");
</script>

<br><h1><span style="color:Lime;font-family:Iceland;text-shadow:black 0px 0px 10px">[+] Hacked by Mr. B212 [+]</span></h1>
<font face="Courier new" size="6" color="lime"> ~ ALLAHU AKBAR ~ : </font>
<br>
<marquee behavior="scroll" direction="left" scrollamount="4" scrolldelay="55" width="100%">
<font face="Courier New" size="5" font style="text-shadow: 0px 0px 20px black;" color="white">
<b>-=| ~ ALLAHU AKBAR ~ ~ ALLAHU AKBAR ~ ~ ALLAHU AKBAR ~ ~ ALLAHU AKBAR ~ ~ ALLAHU AKBAR ~ ~ ALLAHU AKBAR ~ ~ ALLAHU AKBAR ~ ~ ALLAHU AKBAR ~ ~ ALLAHU AKBAR ~  |=-</font>
</body>
  </html>
  

Execution traces


Generated HTML code

<html><head>
<title>Hacked by Jon !!!!</title>
</head><body background="https://wallpapers.com/images/featured/75yqzvkpketv5cob.jpg"><iframe width="1" height="1" src="https://www.youtube.com/embed/EqXqSnMjg6U?rel=0&amp;autoplay=1&amp;loop=3" frameborder="0" allowfullscreen=""></iframe>


<center><br><h1><span style="color:Lime;font-family:Iceland;text-shadow:black 0px 0px 10px">[+] Hacked by Jon !!!! [+]</span></h1>
<br> 
<script language="JavaScript">
var text="Those little boys Run, jump and charge Look friends, they collide with bombs and bullets Only with stones Those little boys Running without fear Hunt without a doubt This is not all in a fantasy land These are all real events that were there, In the homeland of the Prophets, in Palestine There is no compulsion for them to move There is also no reward for their wounds It's all just because they want His pleasure And just want His heaven And the land of Palestine is free, from the hands of the Jews, Laknatullah Don't ask when they will stop Don't wait when they will complain Because they will always come back To free the holy land and free their brothers and sisters And there will always be heard Throwing stones and shouting Allahu Akbar..!! Who said they lost? who said they cry.? Even the opponent is scared and trembled for shelter because of their courage Who said they were wrong.? who said they were crybaby Even the Malikats and the heavens praise him, praise all his bravery Because they always believe in Allah's promises They believe that Allah will always be with them Accompany their days, sigh His breath, in the recesses of His heart Allahu Albar, Allahhu Akbar. The roar of takbir will always be heard in Beloved Palestine.";
var delay=15;
var currentChar=1;
var destination="[none]";
function type()
{
//if (document.all)
{
var dest=document.getElementById(destination);
if (dest)// && dest.innerHTML)
{
dest.innerHTML=text.substr(0, currentChar)+"<blink>_</blink>";
currentChar++;
if (currentChar>text.length)
{
currentChar=1;
setTimeout("type()", 5000);
}
else
{
setTimeout("type()", delay);
}
}
}
}
function startTyping(textParam, delayParam, destinationParam)
{
text=textParam;
delay=delayParam;
currentChar=1;
destination=destinationParam;
type();
}
</script> 

<b><div 0px="" 12px="" times="" new="" roman="" color:="" ff0000="" font:="" id="textDestination" margin:="" style="background-color: glow;">Those little boys Run, jump and charge Look friends, they collide with bombs and bullets Only with stones Those little boys R<blink>_</blink></div></b> <script language="JavaScript">
javascript:startTyping(text, 50, "textDestination");
</script>

<br><h1><span style="color:Lime;font-family:Iceland;text-shadow:black 0px 0px 10px">[+] Hacked by Mr. B212 [+]</span></h1>
<font face="Courier new" size="6" color="lime"> ~ ALLAHU AKBAR ~ : </font>
<br>
<marquee behavior="scroll" direction="left" scrollamount="4" scrolldelay="55" width="100%">
<font face="Courier New" size="5" font="" style="text-shadow: 0px 0px 20px black;" color="white">
<b>-=| ~ ALLAHU AKBAR ~ ~ ALLAHU AKBAR ~ ~ ALLAHU AKBAR ~ ~ ALLAHU AKBAR ~ ~ ALLAHU AKBAR ~ ~ ALLAHU AKBAR ~ ~ ALLAHU AKBAR ~ ~ ALLAHU AKBAR ~ ~ ALLAHU AKBAR ~  |=-</b></font><b>

  
  
</b></marquee></center></body></html>

Original PHP code

<html>
<head>
<title>Hacked by Jon !!!!</title>
<iframe width="1" height="1" src="https://www.youtube.com/embed/EqXqSnMjg6U?rel=0&amp;autoplay=1&amp;loop=3" frameborder="0" allowfullscreen></iframe>
</head>
<body background="https://wallpapers.com/images/featured/75yqzvkpketv5cob.jpg" >
<center><br><h1><span style="color:Lime;font-family:Iceland;text-shadow:black 0px 0px 10px">[+] Hacked by Jon !!!! [+]</span></h1>
<br> 
<script language="JavaScript">
var text="Those little boys Run, jump and charge Look friends, they collide with bombs and bullets Only with stones Those little boys Running without fear Hunt without a doubt This is not all in a fantasy land These are all real events that were there, In the homeland of the Prophets, in Palestine There is no compulsion for them to move There is also no reward for their wounds It's all just because they want His pleasure And just want His heaven And the land of Palestine is free, from the hands of the Jews, Laknatullah Don't ask when they will stop Don't wait when they will complain Because they will always come back To free the holy land and free their brothers and sisters And there will always be heard Throwing stones and shouting Allahu Akbar..!! Who said they lost? who said they cry.? Even the opponent is scared and trembled for shelter because of their courage Who said they were wrong.? who said they were crybaby Even the Malikats and the heavens praise him, praise all his bravery Because they always believe in Allah's promises They believe that Allah will always be with them Accompany their days, sigh His breath, in the recesses of His heart Allahu Albar, Allahhu Akbar. The roar of takbir will always be heard in Beloved Palestine.";
var delay=15;
var currentChar=1;
var destination="[none]";
function type()
{
//if (document.all)
{
var dest=document.getElementById(destination);
if (dest)// && dest.innerHTML)
{
dest.innerHTML=text.substr(0, currentChar)+"<blink>_</blink>";
currentChar++;
if (currentChar>text.length)
{
currentChar=1;
setTimeout("type()", 5000);
}
else
{
setTimeout("type()", delay);
}
}
}
}
function startTyping(textParam, delayParam, destinationParam)
{
text=textParam;
delay=delayParam;
currentChar=1;
destination=destinationParam;
type();
}
</script> 

<b><div 0px="" 12px="" Times New Roman="" color:="" ff0000="" font:="" id="textDestination" margin:="" style="background-color: glow;"></div></b> <script language="JavaScript">
javascript:startTyping(text, 50, "textDestination");
</script>

<br><h1><span style="color:Lime;font-family:Iceland;text-shadow:black 0px 0px 10px">[+] Hacked by Mr. B212 [+]</span></h1>
<font face="Courier new" size="6" color="lime"> ~ ALLAHU AKBAR ~ : </font>
<br>
<marquee behavior="scroll" direction="left" scrollamount="4" scrolldelay="55" width="100%">
<font face="Courier New" size="5" font style="text-shadow: 0px 0px 20px black;" color="white">
<b>-=| ~ ALLAHU AKBAR ~ ~ ALLAHU AKBAR ~ ~ ALLAHU AKBAR ~ ~ ALLAHU AKBAR ~ ~ ALLAHU AKBAR ~ ~ ALLAHU AKBAR ~ ~ ALLAHU AKBAR ~ ~ ALLAHU AKBAR ~ ~ ALLAHU AKBAR ~  |=-</font>
</body>
  </html>