Benign php-malware-analysis Download

keyguess2

Tiny script runs a command staged in local variablesShell execution symbols

SHA-256660faac079454c0e7ed94149bf43c73d248a9bca3c2c6c381f9f2a50323cfbb7

Evidence

Tiny script runs a command staged in local variables line 1

1#!/bin/bash

Hardcoded absolute home directory path lines 3–5

3SRC=base64_decoded
4DST=keyguesses
5KG=/home/bediger/src/vigenere-decoding/vigkeyguess

rm -rf shell command lines 7–8

7rm -rf $DST
8mkdir $DST

Shell execution symbols lines 10–14

10cat bigs | while read FNAME
11do
12	echo $(date) $FNAME
13	$KG -l 16 -N 127 -r $SRC/$FNAME > $DST/$FNAME
14done