# Investigating IPTV Malware in the Wild
## 3 Implementation
### Malware Collection and Analysis  
For the malware analysis functions, file and webpage URLs are collected from a given webpage URL using a website scraper, which is then added to a list and queued for analysis, with the given webpage's URL and domain appended to the front of this list as shown in Figure 3. If a URL pointing to a non-webpage file is submitted, the webpage scraper collects URLs and files from the URL path with the filename removed instead, which will include the original URL submitted.  
Figure 2: DFD design of the IITMAF software solution.  
127.0.0.1 - [10/Aug/2022 15:16:54] \"GET /api/u1/analysis/dynamic HTTP/1.1\" 200 - URLs scraped: 1461  
ULs extracted from website: 753  
127.0.0.1 - [10/Aug/2022 15:17:00] \"GET /api/u1/u0 bsite/urls HTTP/1.1\" 200 - URLs extracted from webpage: 744  
[[https://tifaroindelcup.word/178/8.php](https://tifaroindelcup.word/178/8.php)]([https://tifaroindelcup.word/178/8.php](https://tifaroindelcup.word/178/8.php))  
8.php  
[[https://successfoothal.club/221/pt.php](https://successfoothal.club/221/pt.php)]([https://successfoothal.club/221/pt.php](https://successfoothal.club/221/pt.php))  
[[http://techusman.shop/2018/.php](http://techusman.shop/2018/.php)]([http://techusman.shop/2018/.php](http://techusman.shop/2018/.php))  
8.php  
[[https://rfcganom.club/86/1.php](https://rfcganom.club/86/1.php)]([https://rfcganom.club/86/1.php](https://rfcganom.club/86/1.php))  
1.php  
[[https://funhdtv.xyz/jpp/54/1k1/1b.php](https://funhdtv.xyz/jpp/54/1k1/1b.php)]([https://funhdtv.xyz/jpp/54/1k1/1b.php](https://funhdtv.xyz/jpp/54/1k1/1b.php))  
[[https://rojadirecta.watch/frogame.xyz/mail211/2](https://rojadirecta.watch/frogame.xyz/mail211/2) bd.php]([https://rojadirecta.watch/frogame.xyz/mail211/2](https://rojadirecta.watch/frogame.xyz/mail211/2) bd.php)  
2 hd.php  
[[https://sportshighlights.club/41/8.php](https://sportshighlights.club/41/8.php)]([https://sportshighlights.club/41/8.php](https://sportshighlights.club/41/8.php))  
8.php  
[[https://dstreamer.xyz/8/3.php](https://dstreamer.xyz/8/3.php)]([https://dstreamer.xyz/8/3.php](https://dstreamer.xyz/8/3.php))  
3.php  
[[https://pshighlightlight.club/220/6.php](https://pshighlightlight.club/220/6.php)]([https://pshighlightlight.club/220/6.php](https://pshighlightlight.club/220/6.php))  
6.php  
[[https://rojadirecta.watch/gamclassic.info/t211/3h.php](https://rojadirecta.watch/gamclassic.info/t211/3h.php)]([https://rojadirecta.watch/gamclassic.info/t211/3h.php](https://rojadirecta.watch/gamclassic.info/t211/3h.php))  
3h.php  
Once the URLs have been collected, they are queued for either file-based or fileless static analysis. If a URL contains a webpage file type or no file type, it is submitted to static fileless analysis. Otherwise, URLs are submitted to file-based static analysis with the files downloaded first.  
The URLs and downloaded files are then compared with either file-based malware or fileless malware YARA rules, identifying any binary or textual patterns that indicate a file or webpage has malicious capabilities. Any YARA rule matches for a URL or file are then recorded and stored as a JSON object to be used in the generated report. When the static analysis process is complete, the collected URLs are submitted to either file-based or fileless dynamic analysis, similar to the static analysis process. However, JavaScript (JS) files are submitted to both file-based and fileless dynamic analysis, as JS files can contain malware, and hence, analysing JS files in different environments could provide more accurate results.  
The dynamic analysis entails submitting the collected URLs and files to an isolated sandbox environment for automated analysis using the Hybrid Analysis API ([[https://www.hybrid-analysis.com/](https://www.hybrid-analysis.com/)]([https://www.hybrid-analysis.com/](https://www.hybrid-analysis.com/)) (accessed 25 August 2023)) with a generated analysis report returned once the analysis is complete.