WEBSITE ANALYSIS REPORT

http://www.casternara.com/upload/gboy/banner/1400231023.jpg

15 Mar 2026 · 23:49:40.000 UTCpublic

Report tags
Submit tags

Request review

Report summary

Submitted and final observations · captured HTTP activity

Submitted URL: http://www.casternara.com/upload/gboy/banner/1400231023.jpg
Submitted IP / ASN: 220.73.161.90 AS4766 · Korea Telecom

Final URL: https://www.casternara.com/upload/gboy/banner/1400231023.jpg
Final IP / ASN: 220.73.161.90 AS4766 · Korea Telecom

Final page

Page title: 1400231023.jpg (GIF Image)
Final DOM MIME: text/html; charset=utf-8
Final DOM size: 521 B (521 bytes)

Detections

URLQuery: 0
IDS: 0
TDS: 7

Activity

HTTP requests: 2
Observed hosts: 1
Script records: 0

Estimated HTTP data

Sent: ~996 B
Received: ~3.5 KB

Page capture

Final browser state

www.casternara.com

Recorded title

1400231023.jpg (GIF Image)

521 B final DOM

Detection signals

URLQuery findings, Threat Detection Systems, and IDS alerts

Threat Detection Systems

Nextron YARA rules China Chopper Webshells - PHP and ASPX

Verdictmalware

Severitymedium

Nextron YARA rules Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type

Verdictmalware

Severitymedium

Nextron YARA rules php webshell having some kind of input and some kind of payload. restricted to small files or big ones inclusing suspicious strings

Verdictmalware

Severitymedium

Nextron YARA rules Generic PHP webshell which uses any eval/exec function in the same line with user input

Verdictmalware

Severitymedium

Nextron YARA rules Webshell in GIF, PNG or JPG

Verdictmalware

Severitymedium

Public YARA rules Identifies a webshell or backdoor in image files.

Verdictmalware

Severitymedium

ClamAV Win.Trojan.Hide-1

VerdictMalicious

Severitymedium

Host infrastructure

Observed hosts are context, not independent maliciousness verdicts

Host	Rank	Registered	First seen	Last seen	Sent	Received	IP	Fingerprints
www.casternara.com 7 alerts	N/A	2004-07-02	2012-12-05	2026-03-13	996 B	3.5 KB	220.73.161.90

http://www.casternara.com/upload/gboy/banner/1400231023.jpg

Report summary

Final page

Detections

Activity

Estimated HTTP data

Page capture

Detection signals

Threat Detection Systems

Nextron YARA rules China Chopper Webshells - PHP and ASPX

Nextron YARA rules Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type

Nextron YARA rules php webshell having some kind of input and some kind of payload. restricted to small files or big ones inclusing suspicious strings

Nextron YARA rules Generic PHP webshell which uses any eval/exec function in the same line with user input

Nextron YARA rules Webshell in GIF, PNG or JPG

Public YARA rules Identifies a webshell or backdoor in image files.

ClamAV Win.Trojan.Hide-1

Host infrastructure

Display preferences

Go to…

Notifications

Full request body

Full screenshot

>http://www.casternara.com/upload/gboy/banner/1400231023.jpg

[Report summary]

Final page

Detections

Activity

Estimated HTTP data

[Page capture]

[Detection signals]

Threat Detection Systems

Nextron YARA rules ·China Chopper Webshells - PHP and ASPX

Nextron YARA rules ·Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type

Nextron YARA rules ·php webshell having some kind of input and some kind of payload. restricted to small files or big ones inclusing suspicious strings

Nextron YARA rules ·Generic PHP webshell which uses any eval/exec function in the same line with user input

Nextron YARA rules ·Webshell in GIF, PNG or JPG

Public YARA rules ·Identifies a webshell or backdoor in image files.

ClamAV ·Win.Trojan.Hide-1

[Host infrastructure]

http://www.casternara.com/upload/gboy/banner/1400231023.jpg

Report summary

Page capture

Detection signals

Nextron YARA rules China Chopper Webshells - PHP and ASPX

Nextron YARA rules Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type

Nextron YARA rules php webshell having some kind of input and some kind of payload. restricted to small files or big ones inclusing suspicious strings

Nextron YARA rules Generic PHP webshell which uses any eval/exec function in the same line with user input

Nextron YARA rules Webshell in GIF, PNG or JPG

Public YARA rules Identifies a webshell or backdoor in image files.

ClamAV Win.Trojan.Hide-1

Host infrastructure