File name: | xleet.php |
Full analysis: | https://app.any.run/tasks/36535a83-b6c3-4cf7-be30-074f5eab5229 |
Verdict: | Malicious activity |
Analysis date: | April 01, 2023, 09:44:22 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | text/x-php |
File info: | PHP script, ASCII text, with very long lines, with no line terminators |
MD5: | 7740B928DEED28272391A3ECFA93DC8A |
SHA1: | 1692688AEA50D20CF65A16D6F0FC13B11A88BACD |
SHA256: | 56FE2502F2ED1C9C803300CDAA25377C4A151201C0BA07926382E84B76CABEDE |
SSDEEP: | 768:46Y+DdgStiKL8lO5ZH/12eGaJ44WXL9F8b6YAp5m7DKwh460NTjGteI8dhhrzYQD:zZ3tYo5R/gO44WXxwem7GO4hNkexhSy |
.php | | | PHP source (100) |
---|
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
2668 | "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL "C:\Users\admin\Desktop\xleet.php" | C:\Windows\System32\rundll32.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows host process (Rundll32) Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
1744 | "C:\Program Files\Notepad++\notepad++.exe" "C:\Users\admin\Desktop\xleet.php" | C:\Program Files\Notepad++\notepad++.exe | explorer.exe | ||||||||||||
User: admin Company: Don HO [email protected] Integrity Level: MEDIUM Description: Notepad++ : a free (GNU) source code editor Exit code: 0 Version: 7.91 Modules
| |||||||||||||||
3040 | "C:\Program Files\Opera\opera.exe" | C:\Program Files\Opera\opera.exe | explorer.exe | ||||||||||||
User: admin Company: Opera Software Integrity Level: MEDIUM Description: Opera Internet Browser Exit code: 0 Version: 1748 Modules
| |||||||||||||||
2720 | "C:\Program Files\Mozilla Firefox\firefox.exe" | C:\Program Files\Mozilla Firefox\firefox.exe | — | explorer.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Exit code: 0 Version: 83.0 Modules
| |||||||||||||||
1456 | "C:\Program Files\Mozilla Firefox\firefox.exe" | C:\Program Files\Mozilla Firefox\firefox.exe | firefox.exe | ||||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Version: 83.0 Modules
| |||||||||||||||
3568 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1456.0.1126093318\641312883" -parentBuildID 20201112153044 -prefsHandle 1104 -prefMapHandle 864 -prefsLen 1 -prefMapSize 238726 -appdir "C:\Program Files\Mozilla Firefox\browser" - 1456 "\\.\pipe\gecko-crash-server-pipe.1456" 1184 gpu | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Version: 83.0 Modules
| |||||||||||||||
528 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1456.6.411077941\2017842995" -childID 1 -isForBrowser -prefsHandle 2680 -prefMapHandle 2676 -prefsLen 181 -prefMapSize 238726 -parentBuildID 20201112153044 -appdir "C:\Program Files\Mozilla Firefox\browser" - 1456 "\\.\pipe\gecko-crash-server-pipe.1456" 2692 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Version: 83.0 Modules
| |||||||||||||||
2928 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1456.13.1725807240\510943974" -childID 2 -isForBrowser -prefsHandle 3156 -prefMapHandle 3152 -prefsLen 6644 -prefMapSize 238726 -parentBuildID 20201112153044 -appdir "C:\Program Files\Mozilla Firefox\browser" - 1456 "\\.\pipe\gecko-crash-server-pipe.1456" 3168 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Version: 83.0 Modules
| |||||||||||||||
3600 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1456.20.2142307687\650289073" -childID 3 -isForBrowser -prefsHandle 3592 -prefMapHandle 3588 -prefsLen 7399 -prefMapSize 238726 -parentBuildID 20201112153044 -appdir "C:\Program Files\Mozilla Firefox\browser" - 1456 "\\.\pipe\gecko-crash-server-pipe.1456" 3604 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 83.0 Modules
| |||||||||||||||
3704 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1456.21.1919311102\519891693" -childID 4 -isForBrowser -prefsHandle 3620 -prefMapHandle 3616 -prefsLen 7399 -prefMapSize 238726 -parentBuildID 20201112153044 -appdir "C:\Program Files\Mozilla Firefox\browser" - 1456 "\\.\pipe\gecko-crash-server-pipe.1456" 3624 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 83.0 Modules
|
(PID) Process: | (2668) rundll32.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\16D\52C64B7E |
Operation: | write | Name: | LanguageList |
Value: en-US | |||
(PID) Process: | (1744) notepad++.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\16D\52C64B7E |
Operation: | write | Name: | LanguageList |
Value: en-US | |||
(PID) Process: | (3040) opera.exe | Key: | HKEY_CURRENT_USER\Software\Opera Software |
Operation: | write | Name: | Last CommandLine v2 |
Value: C:\Program Files\Opera\opera.exe | |||
(PID) Process: | (3040) opera.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\16D\52C64B7E |
Operation: | write | Name: | LanguageList |
Value: en-US | |||
(PID) Process: | (2720) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher |
Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe|Launcher |
Value: 09611C1E1E000000 | |||
(PID) Process: | (1456) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher |
Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe|Browser |
Value: AD681C1E1E000000 | |||
(PID) Process: | (1456) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher |
Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe|Telemetry |
Value: 0 | |||
(PID) Process: | (1456) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\DllPrefetchExperiment |
Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe |
Value: 0 | |||
(PID) Process: | (1456) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Default Browser Agent |
Operation: | write | Name: | C:\Program Files\Mozilla Firefox|DisableTelemetry |
Value: 1 | |||
(PID) Process: | (1456) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Default Browser Agent |
Operation: | write | Name: | C:\Program Files\Mozilla Firefox|DisableDefaultBrowserAgent |
Value: 0 |
PID | Process | Filename | Type | |
---|---|---|---|---|
3040 | opera.exe | C:\Users\admin\AppData\Roaming\Opera\Opera\oprAC5A.tmp | xml | |
MD5:1B6CA304C016C6ADD89A50D5AC6BBF92 | SHA256:9B6155A2436372FD20DE14A9712FAA222586CD51CE392F3597526DE38381B49B | |||
3040 | opera.exe | C:\Users\admin\AppData\Roaming\Opera\Opera\opssl6.dat | binary | |
MD5:CD220919CF632DC1C3BF21523F68A6FC | SHA256:B332264C7A29A4E55B111EA3430001D16D4C6A27A14E7340767A3ADEB458C2EC | |||
3040 | opera.exe | C:\Users\admin\AppData\Roaming\Opera\Opera\operaprefs.ini | text | |
MD5:86CBE62EC3BE5C544BA4CC6C301CDAE0 | SHA256:6E58789E960EB15CAAC29180D310B3E054A70DF23FCBE8027B6C34634F569C83 | |||
3040 | opera.exe | C:\Users\admin\AppData\Roaming\Opera\Opera\tasks.xml | xml | |
MD5:1B6CA304C016C6ADD89A50D5AC6BBF92 | SHA256:9B6155A2436372FD20DE14A9712FAA222586CD51CE392F3597526DE38381B49B | |||
3040 | opera.exe | C:\Users\admin\AppData\Roaming\Opera\Opera\opcert6.dat | binary | |
MD5:1AA8644C9261DC10F7247F6A145C1DD2 | SHA256:58A8933F65361633C6AB194000D312DC9D566F717B1A16814A0DBEE24A60EBE3 | |||
3040 | opera.exe | C:\Users\admin\AppData\Roaming\Opera\Opera\oprAC0B.tmp | text | |
MD5:86CBE62EC3BE5C544BA4CC6C301CDAE0 | SHA256:6E58789E960EB15CAAC29180D310B3E054A70DF23FCBE8027B6C34634F569C83 | |||
3040 | opera.exe | C:\Users\admin\AppData\Roaming\Opera\Opera\opicacrt6.dat | binary | |
MD5:82F1A2B1176A5ECC457D32301E2AD833 | SHA256:A783052804DD4C232BE2ED3DC00C430CB67A20370890E235562ED2B27B5A602E | |||
3040 | opera.exe | C:\Users\admin\AppData\Roaming\Opera\Opera\typed_history.xml | xml | |
MD5:B52E352896E390ACC71B62455B26B41F | SHA256:97FEBA01840EDD13CE87885A9941CC5287057103C838C5661FBC47C11ECC7127 | |||
3040 | opera.exe | C:\Users\admin\AppData\Roaming\Opera\Opera\sessions\oprED4D.tmp | text | |
MD5:8C7F7E93CDD87D70EEFE9D93AE81A943 | SHA256:79875072354E93781C80772A833DE49D13D66822C07452DF25FF6C10A9426D7A | |||
3040 | opera.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\D8G0UAGDCAXKF9WT8G9I.temp | binary | |
MD5:FDBCDB294DED05EA01DCAA246B98C2C5 | SHA256:EAEC5A291DBC8E8760BAB0C1BB27CB801F671166CE85310FD173F54111357C4B |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3040 | opera.exe | GET | 302 | 142.250.181.227:80 | http://www.google.com.ua/search?client=opera&q=decode+php+online&sourceid=opera&ie=utf-8&oe=utf-8&channel=suggest | US | html | 346 b | whitelisted |
3040 | opera.exe | GET | 200 | 142.250.185.142:80 | http://clients1.google.com/complete/search?q=decod&client=opera-suggest-omnibox&hl=de | US | text | 145 b | whitelisted |
3040 | opera.exe | GET | 200 | 142.250.185.142:80 | http://clients1.google.com/complete/search?q=decode+p&client=opera-suggest-omnibox&hl=de | US | text | 149 b | whitelisted |
3040 | opera.exe | GET | 200 | 142.250.185.142:80 | http://clients1.google.com/complete/search?q=decode+php+online&client=opera-suggest-omnibox&hl=de | US | text | 176 b | whitelisted |
3040 | opera.exe | GET | 200 | 142.250.185.142:80 | http://clients1.google.com/complete/search?q=decode+php&client=opera-suggest-omnibox&hl=de | US | text | 163 b | whitelisted |
3040 | opera.exe | GET | 302 | 142.250.181.227:80 | http://www.google.com.ua/search?q=decode+php+online&sourceid=opera&ie=utf-8&oe=utf-8&channel=suggest | US | html | 330 b | whitelisted |
3040 | opera.exe | GET | 200 | 142.250.185.142:80 | http://clients1.google.com/complete/search?q=decode+php+onlie&client=opera-suggest-omnibox&hl=de | US | text | 88 b | whitelisted |
3040 | opera.exe | GET | 200 | 142.250.185.142:80 | http://clients1.google.com/complete/search?q=decode+php+on&client=opera-suggest-omnibox&hl=de | US | text | 164 b | whitelisted |
3040 | opera.exe | GET | 200 | 142.250.185.142:80 | http://clients1.google.com/complete/search?q=decode+php+onli&client=opera-suggest-omnibox&hl=de | US | text | 178 b | whitelisted |
3040 | opera.exe | GET | 200 | 142.250.185.195:80 | http://crl.pki.goog/gtsr1/gtsr1.crl | US | der | 760 b | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3040 | opera.exe | 142.250.185.142:80 | clients1.google.com | GOOGLE | US | whitelisted |
3040 | opera.exe | 142.250.181.227:443 | www.google.com.ua | GOOGLE | US | whitelisted |
— | — | 185.26.182.94:443 | certs.opera.com | Opera Software AS | — | whitelisted |
3040 | opera.exe | 185.26.182.93:80 | certs.opera.com | Opera Software AS | — | whitelisted |
3040 | opera.exe | 185.26.182.94:443 | certs.opera.com | Opera Software AS | — | whitelisted |
3040 | opera.exe | 142.250.181.227:80 | www.google.com.ua | GOOGLE | US | whitelisted |
— | — | 142.250.181.227:80 | www.google.com.ua | GOOGLE | US | whitelisted |
3040 | opera.exe | 142.250.185.196:443 | www.google.com | GOOGLE | US | whitelisted |
— | — | 142.250.181.227:443 | www.google.com.ua | GOOGLE | US | whitelisted |
3040 | opera.exe | 142.250.185.195:80 | crl.pki.goog | GOOGLE | US | whitelisted |
Domain | IP | Reputation |
---|---|---|
certs.opera.com |
| whitelisted |
clients1.google.com |
| whitelisted |
www.google.com.ua |
| whitelisted |
sitecheck2.opera.com |
| whitelisted |
crl.pki.goog |
| whitelisted |
ocsp.pki.goog |
| whitelisted |
consent.google.com.ua |
| whitelisted |
www.google.com |
| whitelisted |
www.gstatic.com |
| whitelisted |
onecompiler.com |
| malicious |
PID | Process | Class | Message |
---|---|---|---|
3040 | opera.exe | Potentially Bad Traffic | ET INFO TLS Handshake Failure |
3040 | opera.exe | Potentially Bad Traffic | ET INFO TLS Handshake Failure |
3040 | opera.exe | Potentially Bad Traffic | ET INFO TLS Handshake Failure |
3040 | opera.exe | Potentially Bad Traffic | ET INFO TLS Handshake Failure |
3040 | opera.exe | Potentially Bad Traffic | ET INFO TLS Handshake Failure |
3040 | opera.exe | Potentially Bad Traffic | ET INFO TLS Handshake Failure |
3040 | opera.exe | Potentially Bad Traffic | ET INFO TLS Handshake Failure |
Process | Message |
---|---|
notepad++.exe | VerifyLibrary: C:\Program Files\Notepad++\SciLexer.dll
|
notepad++.exe | VerifyLibrary: certificate revocation checking is disabled
|
notepad++.exe | VerifyLibrary: C:\Program Files\Notepad++\SciLexer.dll
|
notepad++.exe | VerifyLibrary: certificate revocation checking is disabled
|
notepad++.exe | ED255D9151912E40DF048A56288E969A8D0DAFA3
|
notepad++.exe | ED255D9151912E40DF048A56288E969A8D0DAFA3
|
notepad++.exe | VerifyLibrary: C:\Program Files\Notepad++\updater\gup.exe
|
notepad++.exe | VerifyLibrary: certificate revocation checking is disabled
|
notepad++.exe | ED255D9151912E40DF048A56288E969A8D0DAFA3
|
notepad++.exe | VerifyLibrary: C:\Program Files\Notepad++\updater\gup.exe
|