SUSP_WEBSHELL_JPEG_PHP_Code_Dec20_1

Rule Info

Score
70
Name
SUSP_WEBSHELL_JPEG_PHP_Code_Dec20_1
Description
Detects suspicious PHP code injected into JPEG images
Av Ratio
11.58
Author
Florian Roth
Tags
['WEBSHELL', 'T1100', 'FILE', 'SUSP']
Rule Hash
dc71d78ecdba15b0f02f757ab41a1612
Minimum Yara
1.7
Date
2020-12-29
Required Modules
[]

Antivirus Verdicts

Rating
Number of Samples
Malicious (>= 10 engines)
16
Suspicious (< 10 engines)
65
Clean (0 engines)
7

Rule Matches

Positives
Hash
Total
Timestamp
VT
4
495c11fa3a4c858e12268d574577f162d4678b0adfc1aed9c3233b0be891bdaa
56
2022-01-22 15:15:57
3
6db560132a7f879affa7610622fb2dbde4a4dc62ccb5833441f8486f34587ff8
57
2022-01-21 20:57:03
2
676d88e9cb4e01def990403b6a5270b1d61c08b4a5940bacc9fd8db990b0e345
56
2022-01-20 18:08:35
16
330f593c0640c574b745f8c3aef94e2664772ce85b80d8ade873ce55750f21fb
55
2022-01-19 23:20:41
1
60fdbacac1954df828c2d8a7776287bc18a9aa571ff9f129061d63f53ad1500c
56
2022-01-18 18:29:26
3
f9f503f3c061cdf39c299b4337f4c9e5ab418e3ea76e6d717ed36b69ec239c56
55
2022-01-17 14:20:00
4
7985810565c6c0420024e5377baafec6b7b70d5c6a2e5013a32188a4f09b7bad
57
2022-01-16 11:02:30
5
9c7e5422d3a3b19faca05a4f9b821d5a7ed0ab7ea8111196a308ee21a386cf94
57
2022-01-14 05:35:31
15
0bebb9a6c66622cbb68e1b6e8f43de9c6dc3be8976b2b4dbe55330301b6a24de
56
2022-01-12 11:37:54
4
e5bee4e46e13d2e41fe1d1b8de6861ffac3ba17af442325f9559ddbbe7ec8f0a
56
2022-01-12 06:12:52
3
f2353c62dab2725091c3080aa22f1f9b0d379682ceef3780995bcc802916e5df
57
2022-01-11 12:44:17
8
173409d15f05eb815f38a6ad25e665d738c85be149a7c4abc88f4a61547efcd7
57
2022-01-11 00:00:38
17
493612eb8503166b2350ae38bf5eb86f7c58fa7b89eb54b9710c3a20d4732b34
57
2022-01-10 04:42:25
3
89f1674bc8b7cfcc82cb8bf7e024403de3009653151ce8a16e6ff333d99af7b9
57
2022-01-09 17:34:02
7
24d34da3c816fd9eefaf1788d5996ca95a7c34a32b9e33189b6f22d723885e4c
56
2022-01-06 19:59:51
6
1970f3d0a08ee30d728378e179737b628dad921b341582d2594cdcc217405327
56
2022-01-06 03:27:16
8
bfe8f489cb3c99d485a63ee9ac3c9625fe3df23d32b949a69005127218f5d405
58
2022-01-05 21:36:26
18
f2dce65c36228da8032856b942e4108c6fc4ebe7b95a5d5eef98342026fdc3fd
57
2022-01-04 18:14:45
17
5ba21bd8b3083e0fac297417086f87688f185c400f52a54fa9c23942f99541b0
57
2022-01-03 21:30:21
17
11fdba1bd3d4fef672e07e3e9afc21c35066c08cce3704c1fccee40e7ae977f6
56
2022-01-03 18:19:58
21
0b4a529feebfaa5ac67729fd36622b7466c48f0504f93df3ce7326a3eb8cb45e
56
2022-01-03 18:10:21
25
3214b8a24eabed4135481b1966c49f59c032b8bc37eef8c162ff790a58e997ec
50
2022-01-03 16:56:20
28
32ba797247874e404f967455c017b65d90a766aeba17d5a97bd3849eb6e5e663
57
2022-01-03 16:22:41
5
d033122c48e825534f8073b403585ccdec12288761ec0af57d919dd01f8590b7
51
2022-01-03 16:13:36
11
965b7ad0d681c518043e577aa7c9a3eb84540710afe9dea6a32fb0277709d6ca
58
2022-01-03 14:51:00
6
25fede2a590de6dea3f1aca0890ecec7ba57f390a03e913b15cd46daf6fdf58d
57
2022-01-03 13:14:38
28
336492ee8b20f2bb5b93035ada1343c2e08ffcbbaffdf91baf95136d02cf25a7
57
2022-01-03 13:13:34
29
3ce0e0d2fdfcfde743a32c4e73ae5a3c5dc0197c543a1ea78a155099d43bbe9f
57
2022-01-03 13:13:30
23
119466205cd8d0b83fae3074619a0c38b77ede3830fd92ee25dc8edc7b013eb4
57
2022-01-03 13:10:14
11
65c6c03769c25ef83fb7545f3c60262f78807c2d76c79d722a4ceb1f4db8f633
57
2022-01-03 13:08:30
22
59ec34ad3bc754b522d22499d584c8ba54e700acf2bbb3c5f36f728f9e4ce9cc
58
2022-01-03 12:17:12
4
6ded2b750b9e18c071d87bb64cd7db3d4af17459a46b19a635ac81e3bcbf7507
58
2022-01-02 14:18:20
7
62dde0c31cf8fcf0c220331e3b731972f48ce18452e3878085eb01c2369eb9ea
58
2021-12-31 23:09:29
2
bb6ff3dbd25877a303e01d62e0ace515dbd2de7851c6737c2a76b43e3c2ab933
57
2021-12-31 17:14:56
4
a1fe42a7b2910487f58ff8e839f12804e8a91541b1c950c2bc45ac0a7f0ab249
57
2021-12-30 18:42:28
2
cbfecfac121e783e95746d21d0c38fc9f4b3a743b1346e2bbe1118c905c22b41
35
2021-12-29 17:43:15
7
7d440f330f667beb81f3c25553e1ad71c66f68af34b998d2e2d73ca281fc2c91
46
2021-12-29 16:57:11
0
3ad170ad61da31ef526c1fed3084a81ad6162d3bbecf0a32848309ffb627fdf4
57
2021-12-29 15:59:07
7
257c84f4c4e6ec584d4887fd3584d64bd9f6ad4281c010d3e51dc85d79589dc7
58
2021-12-27 21:52:21
7
a54bc7f6d7648ea2ec22d2e066f4afc276cdf04f438359d11b3482fd309842df
58
2021-12-26 19:41:00
7
3886e4316575545efb393195c69c112e2f12a25dd3a9d5ebb8b35ea47f1c2a08
56
2021-12-24 08:46:25
2
126818ba8f5ec5e64ce2a9cd0549360ae5f62ec70a880e127a695f6631d11319
50
2021-12-24 08:35:39
8
33bd49e7e564099c4e8c0d590d69a6c6caba6871112db576d2e32c42239d32f8
55
2021-12-23 15:04:32
0
9f883d1c950092d498492b01a55778af73868945ec2c394873c4cec6732bd0e8
57
2021-12-23 06:23:13
4
61b048f2fb390de612d648b024810322d700ca6596bea7fa9751db2c474d96f9
58
2021-12-21 21:15:37
4
99d2cd7e6fe01534cacb252b418182a30858bdf5c1968205eb87bd103ac7574a
57
2021-12-21 21:15:28
1
b6cb31abc9fe3e1444d5642bc9ed59fd2ac1002ee87d6f7b3f417c3544233c87
56
2021-12-21 21:15:25
2
4854a308d50975d533fbe2c8a5cb4903e7140a6ca2ae7ea381e32a325120f4dd
56
2021-12-21 11:07:07
0
e13a12fa787389029f867a79c51ea3ec56658f928970a069e380638e0651c004
57
2021-12-21 01:45:59
1
de017b289d9714f3a99843b6ee4abd3381c1dfdd2ae1e5ae37a649062bd4c958
56
2021-12-20 12:21:47
1
186b08eb8c532acbad3624d3cba6d5b802185f4e8237738a31fecd949a904be3
57
2021-12-20 12:15:53
7
67c6b8e56c31848ccc593f8770aeccfe002ecf9a4fb8859a73182ed1eae152b4
56
2021-12-17 16:57:37
1
435e39f73351d00d668787abba64601c8e01a522fcbc4c184d5dcc0a473e80dc
57
2021-12-17 02:37:24
0
cb4d8d8d5fd07e673dd8809ae9342eed003893400836144350100bec428b870c
57
2021-12-15 15:44:30
1
88b75ba7365667c777a2191d13dfce14ec35860088e82fe336d6aa4758147908
56
2021-12-15 15:41:04
1
3f929a1586174891844fcd34bc08461a9bfb47393799c40178dcfd414988c749
57
2021-12-15 15:32:56
3
7f94c57b7c8cef838e866a880a70e494ee19bd20162935de00d4edb73f3a4024
57
2021-12-15 02:38:32
3
0029252a05a6d3d4e8ad49523ef82fa6f2a07de875d8a84406b2d0e9140073e4
55
2021-12-13 15:31:59
5
015c7f510ee3f177b73524b0b8f172f08865209bbd8e7438158e84f13cac6501
57
2021-12-12 09:01:14
7
935e35e9e75b242b67c02ac0d85a2d6d83f988cbc18107440113b459db1edfd0
53
2021-12-12 08:25:59
4
75082be27702fe4a721bb34042b73d967acd54480c92b8024c6d6474bb3a45f3
57
2021-12-12 00:08:54
1
6dfbef65d203dd49048c5bc67fe86f944d34cf8da4a3fdb20186f816c202eb14
55
2021-12-11 18:18:34
0
89f9b8b12697406ade2b7525fc8a47cf4c3b9a80c85381f67d07d75c9fb8ca03
55
2021-12-10 21:12:24
4
65605933bd7522cad1680dd0712dba0192a652fcf6acb6e4a29ecc4d2d23ea1e
51
2021-12-09 17:04:03
5
3db1c197300181543f760358c3ccd4c332b439c1ecd982055aee93cfd277fde9
51
2021-12-09 14:35:09
4
82d76068d2373b1c440b911bd8b56b6ea697490c9b2767405f76ac2b561d4c31
56
2021-12-08 00:58:29
4
424196ec4ac4851ba2cbda31f7f2c6226791ee5971fa53e80e4489896c2d56f6
57
2021-12-07 10:49:50
1
25fd5bbb9cda3c5b37ff9d065d879690bdf037ac448165dbf6e77981ee337ba3
56
2021-12-07 02:58:10
5
386fc46a6dca820186e8814e4cf56870314c08928164d1f4f2e7e04404839057
53
2021-12-06 10:32:08
3
59c62b9bb163e011d7e2b236566fa905d1982dc66616a01d78bf90937dd2fb07
50
2021-12-05 19:09:19
19
9a0a5809219d1410ff67f509e7b8f366ba8acab8b366e8aa21249ad6859d0ae1
55
2021-12-02 19:03:07
5
41316d2eb531f9bd3e33e87e7e4d189a7f22fba332addc2a65c9690e60397084
57
2021-12-01 19:02:33
3
4a6999a31079b9920053f1a6a3f579731f7c881ea3abccf29c5b0e602036b5ea
57
2021-12-01 09:06:41
1
118dc7d12bb9e02d33b948928a2a021998f2a64e7e73c01ae8be0b696e1e37af
55
2021-12-01 08:58:15
3
dde766cee3141e58a519a0ec0a15c87b18ba40580107ace56ed89daec6570d2b
56
2021-12-01 08:53:01
3
b6f6f42611bafd983a29b0f294a479e29caecae5f61d8bef6d71b837236028cc
56
2021-12-01 08:50:56
4
74392f20c7bd8c918e2245484cbbf6aa8715c8a4b6861ad3c498444fce9a788f
56
2021-11-30 18:43:48
0
d2257d34a1a57b9357ee3e9608201b4353328d339b8ceb76f4685c545bcce0bb
56
2021-11-30 17:36:58
5
c94e1ef08d047b04274684a9803110930c3569f15f92550ae1c0c63d66fff2f6
57
2021-11-30 16:48:11
1
2e678a0a653d4c776699a544a8d891b63ae1d6504f8b88a1c5a9ac45480c6f50
56
2021-11-30 00:39:37
0
3b583240b2df5af75b541030cf2627a95a66c486591c4018f809cdc1042c492c
55
2021-11-29 22:32:55
4
824bb038faea7e249779087743bc7048889d6e25e6b0c4f92a648dd6d6ac7c41
55
2021-11-29 12:16:58
3
640565ceca4290a6a90f2d468303264eb90570fb611fea2ea1638d4e49bc951c
55
2021-11-29 02:33:31
5
ed78dd2dd0758cc59cee2a78d93c7d756bf595240d6c7f2267f8b14c5bbdf1fb
56
2021-11-26 05:49:07
2
773408be2d5602406915adac4b1b67754a5f58c5d8045eea6fad6e02ee83efc2
55
2021-11-24 20:21:06
2
3d80fb66b43e675dc8263c0183c1aca6e1cc3741ded7a28350a218b7617a6f2c
57
2021-11-24 20:18:10
1
3dbfced429828e2673a61de6c26f22a4921df2b4b0867a9407d8e2eecb091966
55
2021-11-24 20:05:20
8
4f6a6c88e6b56eb5bd908a664f5e6ea40bb198a47502866db69209519b2a5756
56
2021-11-24 09:13:26

Rule Matches per Month (last 24 months)