# Investigating IPTV Malware in the Wild
## 3 Implementation
### Evaluation  
To evaluate the IITMAF and showcase the main features of the IITMAF's automated software solution, we trialled the software on an illicit IPTV website, zmovies.co, applying the automated methodology of the framework outlined in Section 3.1. Before submitting the URL of zmovies.co to the dataset and running the IITMAF software solution, we made some modifications to the solution configuration file. The configuration file enables the user to set limits to the collection and analysis to shorten the duration of a dataset's analysis or to increase the volume of information reported. We set the scraper depth to 3, the maximum number of URLs scraped to 300, and the dynamic analysis submission limit to 25, as shown in Figure 5.  
Figure 4: Sample generated analysis report. Figure 5: Configuration file of the IITMAF software solution. Once the configuration was complete, the dispatcher API and requester client of the IITMAF software solution were executed, initiating the iterative URL collection as shown in Figure 6.  
The iterative URL collection function extracted 87 unique URLs from the given website URL with any duplicate URLs removed from the list, while 20 URLs were extracted from the webpage of the given URL and queued for analysis. For the analysis, any URLs pointing to files were downloaded, with some of the files downloaded shown in Figure 7. Once the static and dynamic analysis was complete, a report was generated, with a sample of the report presented in Figure 7.  
The iterative URL collection function extracted 87 unique URLs from the given website URL with any duplicate URLs removed from the list, while 20 URLs were extracted from the webpage of the given URL and queued for analysis. For the analysis, any URLs pointing to files were downloaded, with some of the files downloaded shown in Figure 7. Once the static and  
Although the submitted URL and its scraped files and URLs returned no YARA rule matches, the iterative URL collection and dynamic analysis functions supplied a high number of results, with Figure 7 showing some of the URLs scraped from the given website and the Hybrid Analysis reports generated. To determine if zmovies.co was associated with malware or malicious activity, we submitted some of the internal and external URLs collected from the website to VirusTotal and checked the generated Hybrid Analysis reports for malicious indicators. While we found a few malicious indicators from the URLs collected, the Hybrid Analysis report of a file scraped from zmovies.co indicated malicious activity. Figure 8 shows the Hybrid Analysis report for a JavaScript file downloaded from zmovies.co that marks the file as \"suspicious\" and classifies it as a Trojan HTML Agent. To obtain further information about whether the collected JS file was malicious, we checked the SHA-256 hash of the file in VirusTotal ((_1b47 cdc50d20d7239392e8391 cf1340 aa2 cf53b76e84 ee5671471e26f4_, accessed on 25 August 2023_)_3_[[https://www.virustotal.com/gui/domain/bmovies.vip/relations](https://www.virustotal.com/gui/domain/bmovies.vip/relations)]([https://www.virustotal.com/gui/domain/bmovies.vip/relations](https://www.virustotal.com/gui/domain/bmovies.vip/relations)) (_499 df4b49 ad07 ff06a56 bc1 bf8483f8f78904b0407926d91 bc349786 bf920_, accessed 25 August 2023_)_4_[[https://www.virustotal.com/gui/url/499](https://www.virustotal.com/gui/url/499) df4b49 ada07 ff706a56 bc1 bf84838f878940d47926d91 bc349786 bf5920/detection]([https://www.virustotal.com/gui/url/499](https://www.virustotal.com/gui/url/499) df4b49 ada07 ff706a56 bc1 bf84838f878940d47926d91 bc349786 bf5920/detection) (accessed 25 August 2023_)_. While only one antivirus tool detected the file as malicious, the relations (_3_ and 4_) show that the collected file is often created by known malware files when they are executed. In conclusion, the IITMAF software solution was able to detect a potentially malicious file collected from an illicit IPTV website and classify it.