SUSP_PHP_Base64Encoded_Nov20

Rule Info

Tags
['SUSP', 'T1132']
Name
SUSP_PHP_Base64Encoded_Nov20
Minimum Yara
1.7
Rule Hash
17efec792acdda9ed0c79979959fe56e
Av Ratio
11.48
Score
40
Author
Max Altgelt
Date
2020-11-17
Description
Detects a base64 encoded PHP header inside another PHP script
Required Modules
[]
Reference
Internal research

Antivirus Verdicts

Rating
Number of Samples
Malicious (>= 10 engines)
44
Suspicious (< 10 engines)
84
Clean (0 engines)
15

Rule Matches

Hash
Timestamp
Total
Positives
VT
3afb2267230bd179cbf27198e578b05f844ed714d4c39f57f3badab5c1873d86
2021-06-13 20:39:01
59
26
d72fbe25545c91e41bae268e19e02dd2720cc13d2d76a171ffdeba6d4551aa9d
2021-06-11 18:41:54
57
1
b4548c17dfde5fbb1e58f7ae875bfa08009e8887935902e7301027f6adc8d5ee
2021-06-11 16:24:11
57
1
7d3d61a9b21b7b905fe8f08f02806e8a701614ed18a62463e95e458fd82015b0
2021-06-11 14:45:21
58
1
157233b3269db48c0ed04ab85125c060231169f6c9b49b2126edbfdd8648d630
2021-06-10 01:45:40
58
2
735710e8d1e228b59a9a2e9788584b6a20d854dccb9abc84e604d4c9371a9001
2021-06-10 01:45:23
58
2
0cb9f6cb37aa4565eb8d7fcc380a43e8eccb1c657f849700950a308d4c4b15f5
2021-06-10 01:45:19
58
1
54d87624755474d5fe868b72d7802643fbd0a10372497d05391c6d69060d848f
2021-06-10 01:45:08
58
1
4ae4f1e48d69d584fd8686d3c05a5d07cff42e83bd77c50b38d5b1938ab26aa7
2021-06-10 01:45:02
58
1
a7378482d73d5304616b7c91912752e7b3d52695da7a668ac111592b63631c0d
2021-06-10 01:44:38
58
1
c3a96cfa539332b1e5378956744f814cb2aa781d2005868fb8305dffae301b61
2021-06-10 01:44:18
55
1
b1789abf2e75c928abd502cb57ee0bc607164f5477b4131a265edc7c775a4a12
2021-06-10 01:44:15
58
2
5bdb23c3d1198c2ecaca3c84fa200d0b7e8b65818abef45281bdc1ce947a4d6a
2021-06-10 01:43:56
58
1
189081ff28bbe21c3ffdf29b513cbf37df9a9baf40d250345f0db27d29c47856
2021-06-10 01:43:53
58
1
6e979ad7efb5758ba3e6cf7e5a7bc8aea8ba8b23907318e3ab0b503c6d34a930
2021-06-10 01:43:40
58
1
3bfd744a2fbd844ccc12547c49a46edba91d95768073e6aabd826c43b0d61ca7
2021-06-10 01:43:34
57
1
d5548a7799d094d983788507b422840284e2ac1aea30779681d86769afd6333c
2021-06-10 01:43:32
58
2
82cb3131d240dfee3aa317baf62c1f688f9d232bcae3f01fd5132682c188109c
2021-06-08 19:22:25
59
10
af4c3c0f36768095d757352b66cca4f06aa6a99e351340699da27002e61d56d3
2021-06-08 17:20:46
58
0
93a490f39a8092a421e733326226f40192c4186a90a5691da52d095049ca8309
2021-06-04 17:44:29
58
0
8ae861296297cd9e86166a9a5edcf8ce87e93fb3b26e9991e9f7e2bbafb14fa0
2021-06-04 17:44:29
59
10
6e3efcc688efc76ef9dddd91e0807fc1b4cd9b8d6dfafbd1b4bea5022f53a961
2021-06-02 22:41:34
58
1
ff9c9f9f3ecd5ee28e93a84071335db542dfce51cdc0701c66f1bb92f0483c1f
2021-05-27 01:31:00
58
9
b056eab4cc28eb43b3868bb833505cf0a377dbc28d7dd37e1a17d34b0cc361c9
2021-05-18 17:02:22
56
21
543393f0cbfc52a1755d1683cf0906648e19d7bdd6d38f0d47ea63957010f0bb
2021-05-11 09:39:28
58
0
43b408ec170db4617f5bc08702170159e57cd45da8bc4a4dcb2f605cd5df93ae
2021-05-01 14:37:04
57
20
56d14f0c33e991bba9e0e6366c65f727d50c0216a384a22a442060a9703d03bd
2021-04-30 17:49:00
58
3
1cec255411943c7ad094ad05dfff51c7d71d84ff439b56a9f24c3eac0fe81705
2021-04-30 14:48:44
58
1
ce03a9bbba97c18499d50c7dc58b1b5973832d50d9bc30a12c34c2599ce9a01b
2021-04-29 18:51:05
58
0
9206694f696b70e766e46f0037bb456d212c6ea694ae2a92cfc8a04b34dfc0d2
2021-04-29 18:51:04
58
8
e00303959a1ed64e9217e4b7e932a3abe2337a39a547261f4f02e4d36d0e4a97
2021-04-27 21:58:23
57
1
ef5e1caad75cf8f76ec9edd3e1f0f80cedce0f32e0572a92773a2b8e77a5b461
2021-04-27 20:24:42
58
4
7ca43d012bbb64aefb3d08cbf162fe7bd4edf501f92862f61f0038adbaa499f6
2021-04-27 12:50:22
58
7
e679207356427787f8de5618ecaa425cac9d7c61ec70a3f3b12852677687e74b
2021-04-27 09:26:22
58
1
237024a4a0db6d9e672a22febd55eb3628691e677a3efaf149a1e8f714caa9ce
2021-04-27 09:06:01
56
0
3b53d26dfe15eb33ee876a6c02d041691779ec3b2b5e60f0aeff3c19dacc5942
2021-04-27 09:06:00
58
2
785e65b3bf5a638009ccfb456bdaea2536bdc7bded7b3164c8fd3d4dba531c10
2021-04-25 11:12:49
58
2
7f32dd981be170663b01629e6076f32ccaad7f12ad1a52f563b4e2c165754825
2021-04-23 15:18:06
59
14
3f504779b00a64e966ab2dd55ddbe8fd83403f7b52fcacc7b5f73c85e40385a3
2021-02-17 21:51:33
60
18
8d1b8bb130d3014ffd27bce93b4b7154d44da126e0c5a49e9b848a45272b4461
2021-02-11 15:45:11
59
1
f77c399af92f4ffc7f602f317d27ae253129500c6dfbddeb7df78c211d1ab193
2021-01-28 20:00:42
58
1
f7118c71665745540a6816c94158045aaab35da6f62179243bd62a1f4517baa2
2021-01-27 17:15:58
59
1
5a59503bc809b59516b33a95d33e41dd09ef6835dce37048c0d5a91943bfdd78
2021-01-27 16:37:19
60
26
e7a577d5babb0554bf1b19dd3f18c68eae3fd1aa74f498cce9ff1e568213a3f7
2021-01-26 22:49:33
57
1
9a3dbad00102f4735d3ef49ae80a5cf31f81dcecc1aa44f67a331e90ef1c992e
2021-01-26 22:48:05
58
2
35bcbf0f273261249ff257c13b6d26a090d1280748b11236916d1a4566abe594
2021-01-26 22:47:21
58
2
62d469126c11eed50171df07e1c683818bd8a316379d35fb86d362cdb0ba8643
2021-01-26 22:46:56
57
1
7e293a18fcb7082e05abe4414bd443ca4994bf8be3dbc0e62f42b61017ea2e9d
2021-01-26 22:46:47
57
2
162bcc6909c9d2b695394bd7165e5a774730c391ff4d9639df33638b82f31342
2021-01-24 19:08:16
59
1
5f70fbff01bcd1caa575ecfae8a8f9630ac04019d54f834756a70bc220aee846
2021-01-24 19:08:09
59
1
d9e592fa41123f25448a7eb71a4d8fa6dddfb637a8a3435839d3d83f1b506f0c
2021-01-24 19:08:08
50
0
629f5df88b5d34052575cb81617e3e592b33bbbff2719b041597169d95b501cc
2021-01-24 19:08:01
58
1
e816ace701d5450786b227ff798af40c8e8332be15b3440357709fbc73ce93b6
2021-01-24 19:08:00
59
1
40f239cad47308e58b86980cbff4243725d308c0f01f7682d13a425290557272
2021-01-24 19:08:00
57
1
58414fdba76bfa20873529e7cf3e40253e04a81dfb0168cc494c326e4d38e292
2021-01-24 19:07:53
59
1
600085a0855e42678c790f2f221d09b2bb82202ddc309e947d0369ce76391f81
2021-01-24 19:07:53
58
1
1c9d639431089b64f64801a29410910c9e2ac2762479f36fa421121aca575e64
2021-01-24 19:07:53
59
2
082516bf90cc7f38bf79d634b8d75d2de5af9add2abaa0cb34223853f7e457df
2021-01-24 19:07:52
58
0
de4243cece8d05c7c7161c03f726175f34011ac1b6480907f62ba380c591d331
2021-01-24 19:07:52
59
1
c1fa83356a952b206eb0f73a5b3429ed95f8fa2dd727c34128dd2a3cd6743037
2021-01-24 19:07:52
58
1
3d074586bf3da998892ee94b188cf3bba6ee39b4784c53e37fd909d598b503b8
2021-01-24 19:07:44
58
0
12cc7e752f25bbf9ec1e31ca9628cd0130b64b1db262e682b3a42aaced1c3458
2021-01-24 19:07:44
59
1
2bd3d491dbd41667c0515d6905d4b4064eb2978ca4a397f07aaf9682e673fb1f
2021-01-24 19:07:44
58
0
54207ac81f5b9faecbe0ef8d466f5b44d43e044fed644496283557772c82fb06
2021-01-24 19:07:43
57
4
7f38d98c46d3726b59ce86593dce8001da3b563a237741cab69b31ef5d6dba14
2021-01-24 19:07:43
58
1
23ba7b393da05ee91d041fbccadecce5d691460241130f54d6c7f131bc208fe6
2021-01-24 19:07:36
59
1
6e6107a29d584876a3552be87d1e412d74da42701d14742f23d140996b7fb6e3
2021-01-24 19:07:36
59
1
8b4b5af67413a03431479f3e61e3395e47d9ad596cfd2b7e229aba83d2d91557
2021-01-24 19:07:35
58
1
f07d70f588b115fb99b26be350de21267aa279cdd54cb544bd79c2896c7b418f
2021-01-24 19:07:35
59
1
96dd577a8a895879e360868449301e4c6b642f1105c33b5f08c9ea09b7bc067e
2021-01-24 19:07:35
58
3
7751b54c18fdd20e3ed7c198e046310a68bd20544d41bb9de4020fa0025a77ff
2021-01-24 19:07:34
59
1
7f15ce95e8da927db835a2087c9a4957f702ea277aaa45d077f7ea455d5acd0a
2021-01-24 19:07:28
59
2
75fb70affa3931fc50bdb0f32bb95def0b8fcad121d148ad2e9346e6267e45ee
2021-01-24 19:07:27
59
1
70e6b81a1f3ec7081e66a6f825a87d131d8bf83a926d209a80afb0a544249c56
2021-01-24 19:07:27
56
1
2fa47db5416562ae2cf67b86cbdbdf8b751926bc2df53f188943b04b9a11b244
2021-01-24 19:07:27
58
1
4485bff94c4d2f9755490ed8e5c4e51db1d2d6594cb2e59d2f26be36a0f00f55
2021-01-24 19:07:27
59
1
ecf14c73b6301b5874701c0148902c6efab3cc8d521f27d35b76f9bc24471993
2021-01-24 19:07:26
58
1
b1b70644680fd3a726cba343aea94fd19db666a1ce9d9e1bd9f2c11d5b823649
2021-01-24 19:07:18
58
1
2a621cfa58845347e9d1bbabf560b86847dc188ed6be4a6882d7f84584bb0bc9
2021-01-24 16:58:17
59
12
139e5987f94f67be7c735b8c978f0abcf801aafb64db369eef5c4f60b5e03e61
2021-01-23 13:35:42
59
1
18a8ca1a11907a7bdb8b974e13673949865590d8def9843db7ab54a41831e110
2021-01-20 08:48:35
59
0
6e939a67cb692458878d15ae696107db4c7e2c431be736943135e059b5067f15
2021-01-14 11:28:07
60
10
74a021d9914e7e6125e79c9ef15ee824c538d2b1a536510794e412926f6f3718
2021-01-14 11:12:03
60
20
8ed9c1eb4ba49a09d64543c24e1373105eb6bef036958c8d20c03539aed6ebde
2021-01-14 11:11:42
60
18
d94a52d937ad7c7917d04416795b9dd4908e32fde71f1bf3850c23c62d1e9e3d
2021-01-14 10:17:46
59
22
c86493796c5b31280f11e02f751a8774889baee45611b18fb5f0f3882e77c56e
2021-01-14 10:16:48
60
28
f69309f72d23adcf9df5a8bfc5831b0f93b5214bc7d92fc13d33a4f0ec87d25c
2021-01-12 14:53:23
60
14
170001c3dfc1810f23ec5253a79ea3d82381d6bd33fa9dfa747d0243e44a16be
2021-01-12 14:00:38
60
0
5afee99d7361c6d7f20590a9602612275c1820b176b8fa5cba42dd32918dc49d
2021-01-12 11:27:34
60
16
e10cde929c4eb13d7a03d2a1d4a3057cc38688cc9323d5e14b6e6f6373089472
2021-01-12 11:14:00
59
18
cf33d8a3ea0f28534c5ecf6fafb615eb7fbfc46c56817cfb2d6fa0a18f6eddad
2021-01-12 10:56:20
57
19
5360425f3c3dda0242e7af2df00cde047ce89cdb06353ba0647a353520b6ba48
2021-01-12 01:10:28
60
4
d923621fae99e562fb27276d1ebd00174b1c815b3dcb1f64b4b8b7e440ddb34f
2021-01-11 23:42:18
60
9
656412b468cf4cab16e2811fc0d0c7b9ad95cb08b1fa0ea82a1763d401083099
2021-01-11 10:45:10
60
19
b6d444a6e1a3125ee951496e508ee0206e18a21ecc1e7a15d42c8aa97ee6eb73
2021-01-09 13:52:34
59
20
0681d7935c0d7884083187231b85b1b9abfdf55828cbc46770d87ebfbdabb002
2021-01-09 12:36:30
59
1
a3fcbf09e0f70edf5b77aa55ba70f4154b38745af6c665b33847e4782ad9ce77
2021-01-09 12:36:22
58
1
703d653a33d32d076ad2c8fb6213b090448c7fa33e61d3c56062b725b6396721
2021-01-09 12:36:21
60
1
2f670ee65a1fa000464cbd33300868461b4fda761cce4b56aeb505e1a0730779
2021-01-09 11:22:32
58
2
0c3e5e40a64486446be2f4f71aba1f3021d8d7d3b0e04adc243566641bad0305
2021-01-08 16:11:49
60
2
235d8c2116751fdae698f9c3b8eb83610bea14f23f882c2e3ab7eb7c0d77e2db
2020-12-31 16:00:50
58
20
573180b71090b53a5583f4a25bfbf81cf4010adc9c56626059093b5f18dae281
2020-12-30 18:17:33
58
1
29ad97d861e9bd04abba2530edcfbbd210e730988ade2d956bf1262bcea2bc33
2020-12-30 17:57:05
60
2
cd003857d9441b097fa4c523ba5e07cee34274303963497221762d357ede9425
2020-12-30 17:52:06
60
1
36d9732fdbb8235ee0e781ecef70f0f318e52862ed7340df43ce83bfbd327929
2020-12-30 15:06:25
60
8
00775145f494d735f7a219651f543bf77ea19ea0459080822d174a8c4233e0a5
2020-12-30 14:09:54
60
1
8463e8416765dd0c42467d98324138e4c8b6fed906d43d027da11bbd76711315
2020-12-30 13:37:56
59
21
43f160adab1f4c5fbd1bbbd9dba466170637b99bf45e7701c6c7eff7c568807e
2020-12-30 13:10:23
59
21
d02f583e5b22b32de1551cbd396c9bf1b06bc966c592beed5b1e5190a9a39d7a
2020-12-30 13:09:33
60
21
e665c7eb56d3b7eb87baf74e125e59c287624eca76efb5b43ed8170091b6f5fd
2020-12-30 13:09:11
60
15
327eeea595c3d5a0df3241016b354f6525aa9ce76af8c9bf1d517985222a662b
2020-12-30 13:09:09
59
13
d27bcffd8066473c6e7a17207ed080312e4bcb1d64b07560413419ab66947d1a
2020-12-30 13:09:08
60
15
d0cf96ed9eab4d1f0eb1ebae0ba41dc90822785d69a722ce44acda6b0b51fd85
2020-12-30 13:09:06
59
14
7f2e803e4524d8412e403a79f5630a0cc7bf1955554d4e70212a32c1a6063052
2020-12-30 13:05:05
60
21
709d336eb6d19632f89f9156a70aa0fa09563a20b6f4b04916caf1ae45e45bfa
2020-12-29 12:24:36
60
1
dd7af89790be3eccb8900ff0bf32737253f5f4f43d9deff2dc04b6d611b188c6
2020-12-26 10:41:54
59
0
8d9620e257a482dd94763c4bf6c8fdd49e826d4b6dfd1216a6439987cc86d49e
2020-12-21 18:03:08
59
2
63a025d655078d7e1b58d378f80bde2af7ab7cbcf9810cfc3c6f721ba89a2c10
2020-12-21 18:03:08
60
1
b533495be07fa56cbdc69243b516fd71c711635b52bcea5cd03f2600e5982617
2020-12-17 13:18:54
60
1
2367847a15cb414b51f39a2e8f1ebab4eb7e78baff94833250405e74ea6f39c3
2020-12-16 16:19:35
60
14
c2f2beb2e855ec24a26b07a8ee9016d03ebc05cfdcdd86b6da5b4416924431e3
2020-12-14 20:51:42
58
0
bfc4594f3deec09b4e2525341799779d1397ec89dabc2b655ef5ae33f1943484
2020-12-14 20:51:32
55
18
9a4e350ce3add6e26b1b513d657b6b70a16a1e7433fe310089e8adddd3d6e3cf
2020-12-14 20:50:12
60
21
a288ba04c89e168506b1daefc9cde2c290d7aca14400c86d62d1871f96ed4d77
2020-12-14 14:42:41
57
2
3a693c5ade4d66d1557339cbd4c6cfe648597eadf93eac6cc68c55274822ab11
2020-12-11 21:57:58
54
9
9a421efb4fc13d9ed9313257998ab6695098b40a471011c433440fe5edbbcbbc
2020-12-10 19:53:11
60
20
3635a0e0540592c03d3ebae5b8aaee8a878beb4013fbd074cb0b34ed27673bb4
2020-12-10 19:38:17
59
21
5c7dad584b8d1bb2afef675aca6a8cad322107f49a998e8c9c7ecf4b43db365a
2020-12-10 19:38:17
60
20
149ddde6a0240ad35ef61c3ed06477efd0a65595f0d7f8802b4499144303f0db
2020-12-10 19:38:16
60
22
5b406e3ae2e78e67c5b5b6e37406578467d09e307cd3d0f51338084d007bd8c2
2020-12-10 19:38:16
59
21
e87d2c60154be813459ee7f5f40cbaf0eb587b9037633d33f4cc3ced80383aab
2020-12-10 19:35:42
60
20
9d5569371619251c9f333006edd181c4600ef44eced3fd311a4cb3b4b23c3e09
2020-12-10 19:29:05
58
22
331acc11b846bdb2ba8d1e121c44ad1ebc17f06b09be5a359ef761ff2ba9c009
2020-12-10 19:06:45
54
17
833ea7760cd991d7d005ede2e34b1b3d88cfe96eb4f2d31203a8a5b8d2f14b34
2020-12-10 18:56:07
57
21
f0d5a00de146bfe8c6a89ac49e88888e01035bb2f6265d79c9b434e9210904c3
2020-12-10 18:56:03
58
19
6f3e109b58d8b1df72e795a4f93132fdc64c4820c2c361d344379f0295811bfe
2020-12-03 19:04:45
60
10
c4e2aa4785a95e9bb6ed3b6cefb1a8dd47924f69e4e264ec4825deebee464f62
2020-12-02 18:50:04
60
1
19a751292888089eef5a965faac176e12ab38211bd75c888beaeefe84a55dcc4
2020-11-30 11:17:57
59
2
4f69d70998227f889d27958ca74a65299a783130c05ed754bb3920439a7517e9
2020-11-29 18:30:40
60
1
13a94ae36d830c319dbf5ff59abac6469a8e37b844840b0b4741b8bb00fe5e7a
2020-11-29 18:21:40
60
0
6bff6a9e616b65c3b722da88df283692fa522791585417d796610bc2491f04d6
2020-11-27 18:25:51
60
2
ea426581750aec7402be80faf267dd93fdd0673c15a98b8c291edbf530c249fb
2020-11-26 18:13:18
60
19
51e7a285e5403886120c1044f4bb73012dbe39d891e2976ad77a38222e9543dd
2020-11-18 16:05:30
61
0

Rule Matches per Month (last 24 months)