Malicious Archive / .VIR — malware analysis report

Heuristics 2

• PHP webshell / backdoor source critical WEBSHELL_PHP
  The file contains PHP server-side code with the signature of a webshell/backdoor (request input fed to a command/code-exec sink with a decoder/second sink (RCE backdoor)). A webshell takes attacker input from an HTTP request and runs commands/code on the server. Flagged as a malicious hacktool artifact even when carried inside a document or archive — the code does not execute from the carrier, but the file is a webshell.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://www.microsoft.com0 In document body

  • http://ocsp.digicert.com0AIn document body
  • http://ocsp.digicert.com0In document body
  • http://ocsp.digicert.com0XIn document body
  • http://ocsp.digicert.com0CIn document body
  • http://ocsp.thawte.com0In document body
  • http://ts-ocsp.ws.symantec.com07In document body
  • http://sv.symcd.com0&In document body
  • http://s2.symcb.com0In document body
  • http://ocsp.entrust.net03In document body
  • http://ocsp.entrust.net02In document body
  • http://www.microsoft.com/pkiops/crl/MicWinProPCA2011_2011-10-19.crl0aIn document body
  • http://www.microsoft.com/pkiops/certs/MicWinProPCA2011_2011-10-19.crt0In document body
  • http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0ZIn document body
  • http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0In document body
  • http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl0ZIn document body
  • http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0In document body
  • http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0��In document body
  • http://www.microsoft.com/PKI/docs/CPS/default.htm0@In document body
  • http://www.microsoft.com/windows0In document body
  • https://sjremetrics.java.com/b/ss//6In document body
  • https://java.comIn document body
  • https://javadl-esd-secure.oracle.com/update/1.8.0/8c876547113c4e4aab3c868e9e0ec572/1.8.0_381-b09.xmlIn document body
  • https://java.com/verify9/?src=installIn document body
  • https://www.java.com/applet/javaLatestVersion.xmlIn document body
  • http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtdIn document body
  • http://www.w3.org/1999/xhtmlIn document body
  • https://java.com/data/In document body
  • https://java.com/otnlicense/In document body
  • http://www.tutorialspoint.com/javascript/array_map.htmIn document body
  • https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Array/filterifIn document body
  • https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Array/indexOfifIn document body
  • https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Array/Reduce//In document body
  • http://es5.github.io/#x15.4.4.21ifIn document body
  • https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/String/startsWithifIn document body
  • https://developer.mozilla.org/en/docs/Web/JavaScript/Reference/Global_Objects/String/endsWithifIn document body
  • https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/String/TrimifIn document body
  • http://stackoverflow.com/a/15123777In document body
  • http://stackoverflow.com/questions/1026069/capitalize-the-first-letter-of-string-in-javascriptapi.capitalizeFirstLetterIn document body
  • http://stackoverflow.com/questions/1068834/object-comparison-in-javascriptvarIn document body
  • http://www.computerhope.com/forum/index.php?topic=76293.0In document body
  • http://stackoverflow.com/a/1465386/4224163In document body
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In document body
  • http://ns.adobe.com/xap/1.0/In document body
  • http://ns.adobe.com/xap/1.0/mm/In document body
  • http://ns.adobe.com/xap/1.0/sType/ResourceRef#In document body
  • http://schemas.microsoft.com/wix/2006/localizationIn document body
  • https://www.oracle.com/javase/jmcIn document body
  • https://www.oracle.com/javase/jmc]���������������������������In document body
  • https://www.oracle.com/javase/jmc]���In document body

  +57 more URL(s)

Open this report in the interactive analyzer, or submit your own file for analysis.