PHP Malware Analysis

readme.html, ziii.html

md5: 433576693592998aedc01198648e3d98

Jump to: 

Screenshot
Attributes
Emails

Title

URLs
  • https://fonts.googleapis.com/css2?family=Syne+Mono&amp (HTML)
  • https://fonts.googleapis.com/css2?family=Syne+Mono&display=swap (Deobfuscated, Original)
  • https://g.top4top.io/p_2253ntztg9.png (Deobfuscated, HTML, Original)
  • https://s314.podbean.com/pb/60d2a5c5b71eba60a67668d19f2aa5d5/62217280/data1/fs136/12848571/uploads/Ada_aku_disini_cover9aup5.mp3?pbss=fd9b6c39-b080-5609-9f22-a6b02ad81457 (Deobfuscated, HTML, Original)

Deobfuscated PHP code
<html>
  <head>
  	<title>Dientod Oleh Skyzi Xploit</title>
      <meta charset="UTF-8">
      <meta name="og:image" content="https://g.top4top.io/p_2253ntztg9.png">
       <meta content="Skyzi Xploit Ft Liaa" name="description"/>
       <link href="https://g.top4top.io/p_2253ntztg9.png" rel="icon">
       <link href="https://fonts.googleapis.com/css2?family=Syne+Mono&display=swap" rel="stylesheet">
<style>
   body {
		background-color:white;
		color: #000;
		font-family: 'Syne Mono', monospace;
		text-align: center;
		text-decoration: none;
		text-shadow: 0px 1px 0px #000;
		}
  </style>
  <br><br><br><br><br><br><br><br><br><br><br
   <b><font size="7">Dientod Oleh Skyzi Xploit</font>
   <br><br
      <b><font size="6">Wh00pz!!!We Are Happy People :v</font>
      <br><br>
        <b><font size="5">Contact : K4nCutH4x0r@gmail.com</font><br><b><br>
         <b><font size="5">.:Thanks:.<br>Cyber Meguri Fujiura - Padang Blackhat</font><br>
             <center><audio autoplay="autoplay" controls="controls" src="https://s314.podbean.com/pb/60d2a5c5b71eba60a67668d19f2aa5d5/62217280/data1/fs136/12848571/uploads/Ada_aku_disini_cover9aup5.mp3?pbss=fd9b6c39-b080-5609-9f22-a6b02ad81457" type="audio/mpeg"/></center>

Execution traces
Generated HTML code
<html><head>
  	<title>Dientod Oleh Skyzi Xploit</title>
      <meta charset="UTF-8">
      <meta name="og:image" content="https://g.top4top.io/p_2253ntztg9.png">
       <meta content="Skyzi Xploit Ft Liaa" name="description">
       <link href="https://g.top4top.io/p_2253ntztg9.png" rel="icon">
       <link href="https://fonts.googleapis.com/css2?family=Syne+Mono&amp;display=swap" rel="stylesheet">
<style>
   body {
		background-color:white;
		color: #000;
		font-family: 'Syne Mono', monospace;
		text-align: center;
		text-decoration: none;
		text-shadow: 0px 1px 0px #000;
		}
  </style>
  </head><body><br><br><br><br><br><br><br><br><br><br><br <b=""><font size="7">Dientod Oleh Skyzi Xploit</font>
   <br><br <b=""><font size="6">Wh00pz!!!We Are Happy People :v</font>
      <br><br>
        <b><font size="5">Contact : K4nCutH4x0r@gmail.com</font><br><b><br>
         <b><font size="5">.:Thanks:.<br>Cyber Meguri Fujiura - Padang Blackhat</font><br>
             <center><audio autoplay="autoplay" controls="controls" src="https://s314.podbean.com/pb/60d2a5c5b71eba60a67668d19f2aa5d5/62217280/data1/fs136/12848571/uploads/Ada_aku_disini_cover9aup5.mp3?pbss=fd9b6c39-b080-5609-9f22-a6b02ad81457" type="audio/mpeg"></audio></center>
</b></b></b></body></html>
Original PHP code
<html>
  <head>
  	<title>Dientod Oleh Skyzi Xploit</title>
      <meta charset="UTF-8">
      <meta name="og:image" content="https://g.top4top.io/p_2253ntztg9.png">
       <meta content="Skyzi Xploit Ft Liaa" name="description"/>
       <link href="https://g.top4top.io/p_2253ntztg9.png" rel="icon">
       <link href="https://fonts.googleapis.com/css2?family=Syne+Mono&display=swap" rel="stylesheet">
<style>
   body {
		background-color:white;
		color: #000;
		font-family: 'Syne Mono', monospace;
		text-align: center;
		text-decoration: none;
		text-shadow: 0px 1px 0px #000;
		}
  </style>
  <br><br><br><br><br><br><br><br><br><br><br
   <b><font size="7">Dientod Oleh Skyzi Xploit</font>
   <br><br
      <b><font size="6">Wh00pz!!!We Are Happy People :v</font>
      <br><br>
        <b><font size="5">Contact : K4nCutH4x0r@gmail.com</font><br><b><br>
         <b><font size="5">.:Thanks:.<br>Cyber Meguri Fujiura - Padang Blackhat</font><br>
             <center><audio autoplay="autoplay" controls="controls" src="https://s314.podbean.com/pb/60d2a5c5b71eba60a67668d19f2aa5d5/62217280/data1/fs136/12848571/uploads/Ada_aku_disini_cover9aup5.mp3?pbss=fd9b6c39-b080-5609-9f22-a6b02ad81457" type="audio/mpeg"/></center>