Hostile ^92% bsd Download

php83-avideo-14.3 14.3

Trojanized getID3 dependency with packed PE injector

Packed PE combines process-memory writing with remote thread executionPHP assert backdoor reads request headers

SHA-25652115febd25ec45a2de985f70a3b03706b8c1e4bb96b965d99ead3127fee532b

MaleculeK₃(Am₂Li₂₄Te₃)O₁₀(PAs₈C₅Co₄Dy₂EuLa₂PrS₄Xe₂)H₁₁(F₃₆Cm₁₀₉Cr₁₄Db₆₃Hf₄Mg₂Os₃₈Po₄₉TiU₁₂)Md₁₀(ArBi₄Bk₃InLi₇Pa₂₃Pt₂Si₂)

Evidence

Call to GetDriveTypeA by raw bytes cygwin1.dll · 0xe0e46–0xe1026

⋯3 more rows
0xe0e760000fe0047657443757272656e745468....GetCurrentTh
0xe0e8672656164496400000000040147657444readId......GetD
0xe0e9669736b46726565537061636541000801iskFreeSpaceA...
0xe0ea647657444726976655479706541000a01GetDriveTypeA...
0xe0eb6476574456e7669726f6e6d656e745374GetEnvironmentSt
0xe0ec672696e6773000d01476574456e766972rings...GetEnvir
0xe0ed66f6e6d656e745661726961626c654100onmentVariableA.
0xe0ee60000100147657445786974436f646550....GetExitCodeP
⋯7 more rows
0xe0f66616d654100001f014765744c61737445ameA....GetLastE
0xe0f7672726f72000023014765744c6f676963rror..#.GetLogic
0xe0f86616c4472697665537472696e67734100alDriveStringsA.
0xe0f96000025014765744c6f676963616c4472..%.GetLogicalDr
0xe0fa669766573000029014765744d6f64756cives..).GetModul
0xe0fb66546696c654e616d6541000000002b01eFileNameA....+.
⋯7 more rows

Packed PE combines process-memory writing with remote thread execution cygwin1.dll · 0xe1856–0xe19e6

⋯7 more rows
0xe18c60000e602577269746546696c6500f002....WriteFile...
0xe18d6577269746550726f636573734d656d6fWriteProcessMemo
0xe18e6727900000000f6025772697465546170ry......WriteTap
0xe18f6656d61726b0000e0120000e0120000e0emark...........
⋯15 more rows

Calls PHP file_put_contents() functions.php · lines 1687–1696

1687:32… ($url);
1688    _error_log('copy_remotefile_if_local_is_smaller url_get_contents = ' . humanFileSize(strlen($content)));
1689    return file_put_contents($destination, $content);
1690}
1691
⋯5 lines

PHP handler reads User-Agent header functions.php · lines 1964–1971

32… null, $httpHeaders = null)
1965{
  if (empty($userAgent) && empty($_SERVER["HTTP_USER_AGENT"])) {
      return false;
  }
  global $global;
  require_once $global['systemRootPath'] . 'objects/Mobile_Detect.php';
…

crontab command option functions.php · lines 6477–6483

31… ;
  if (empty($validCrontabLines)) {
      $crontab = shell_exec('crontab -l');
      if (empty($crontab)) {
          return array();
      }
      $crontabLines = preg_split("/\r\n|\n|\r/", $cro …

Showing the top 5 files — 8 more files (129 regions) not shown.

No evidence locations were recorded for this file. Raw result