Nextron YARA rules China Chopper Webshells - PHP and ASPX
Verdictmalware
Severitymedium
WEBSITE ANALYSIS REPORT
http://www.casternara.com
public
Report summary
Submitted and final observations · captured HTTP activity
- Submitted URL
- http://www.casternara.com
- Submitted IP / ASN
220.73.161.90 AS4766 · Korea Telecom
- Final URL
- https://www.casternara.com/
- Final IP / ASN
- 220.73.161.90 AS4766 · Korea Telecom
Final page
- Page title
- 캐스터나라/진영종합상사: 삼송캐스터,지덕산업,오토씨에프티,로타캐스터,로타휠,바퀴,캐스터,운반구,손수레,리어카,볼캐스터,볼트랜스퍼,의자바퀴,병원용바퀴,우레탄바퀴,에어바퀴,발포바퀴,고무바퀴,프라스틱바퀴,도비캐스터,조절좌,종발이,프로파일부품,방진고무,스프링방
- Final DOM MIME
- text/html; charset=utf-8
- Final DOM size
- 4.6 KB (4661 bytes)
Detections
Activity
- HTTP requests
- 239
- Observed hosts
- 6
- Script records
- 54
Estimated HTTP data
- Sent
- ~135.3 KB
- Received
- ~6.67 MB
Page capture
Final browser state
www.casternara.com
Screenshot unavailableNo screenshot pixels areavailable for this report.
Detection signals
URLQuery findings, Threat Detection Systems, and IDS alerts
Threat Detection Systems
7Nextron YARA rules Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type
Verdictmalware
Severitymedium
Nextron YARA rules php webshell having some kind of input and some kind of payload. restricted to small files or big ones inclusing suspicious strings
Verdictmalware
Severitymedium
Nextron YARA rules Generic PHP webshell which uses any eval/exec function in the same line with user input
Verdictmalware
Severitymedium
Nextron YARA rules Webshell in GIF, PNG or JPG
Verdictmalware
Severitymedium
Public YARA rules Identifies a webshell or backdoor in image files.
Verdictmalware
Severitymedium
ClamAV Win.Trojan.Hide-1
VerdictMalicious
Severitymedium
Host infrastructure
Observed hosts are context, not independent maliciousness verdicts
| Host | Rank | Registered | First seen | Last seen | Sent | Received | IP | Fingerprints |
|---|---|---|---|---|---|---|---|---|
| ssl.daumcdn.net | 1779663 | 2010-07-08 | 2017-02-01 | 2026-03-07 | 908 B | 3.7 KB | 211.183.208.43 | Nginx Web servers, Reverse proxies Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache. |
| static.tosspayments.com | N/A | 2019-11-20 | 2022-08-15 | 2026-02-06 | 932 B | 2.2 KB |  52.84.50.116 | Amazon Web Services PaaS Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality. Amazon S3 CDN Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface. Amazon CloudFront CDN Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds. |
| casternara.com | 4442215 | 2004-07-02 | 2012-12-05 | 2026-03-10 | 438 B | 65.6 KB | 220.73.161.90 | Nginx Web servers, Reverse proxies Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache. |
| www.casternara.com 7 alerts | N/A | 2004-07-02 | 2012-12-05 | 2023-08-26 | 129.9 KB | 5.31 MB | 220.73.161.90 | Nginx Web servers, Reverse proxies Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache. jQuery UI:1.12.1 JavaScript libraries jQuery UI is a collection of GUI widgets, animated visual effects, and themes implemented with jQuery, Cascading Style Sheets, and HTML. jQuery CDN CDN jQuery CDN is a way to include jQuery in your website without actually downloading and keeping it your website's folder. jQuery:1.7.1 JavaScript libraries jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax. PHP Programming languages PHP is a general-purpose scripting language used for web development. |
| wsa.mig-log.com | N/A | 2019-08-21 | 2019-10-17 | 2026-02-17 | 1.7 KB | 58.2 KB |  188.114.97.1 | Cloudflare CDN Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services. HSTS Security HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS. |
| code.jquery.com | 4915 | 2005-12-10 | 2012-05-21 | 2026-03-08 | 1.2 KB | 1.24 MB | 151.101.194.137 | Varnish Caching Varnish is a reverse caching proxy. Nginx Web servers, Reverse proxies Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache. |