{ "ml": { "v": "7", "id": 381, "lvl": -1, "conf": 0, "prob": 0.000012328227057878394, "type": "php", "version": "v18.18", "analyzed_at": "2026-09-24T22:34:53Z" }, "path": "php-code-coverage@2.2.2", "raw": { "rev": "c1ea9", "files": [ { "id": 401, "mol": "K(Li₃)O₈(Al₂As₈C₂CoErEuSXe)H₈(Cm₁₆Db₃₀F₆Hf₂Os₅Po₈TiU₁₁)Md₆(BkPa₄PdPt)", "pid": 7, "rel": "fetched", "sha": "03ae713d51b4c14e975306b327f568974af4f4ce324d6b265b9593d5cfd14fe5", "via": "https://api.github.com/repos/sebastianbergmann/php-code-coverage/zipball/2d7c03c0e4e080901b8f33b2897b0577be18a13c", "path": "pkg:composer/phpunit/php-code-coverage@2.2.2", "risk": 48, "size": 388628, "type": "zip", "depth": 2, "facts": { "metrics": { "file": { "size": 388628, "entropy": 7.95 }, "binary": { "peak_region_bytes": 355328, "peak_region_entropy": 7.85 }, "archive": { "file_count": 120, "has_comment": 1, "comment_size": 40, "member_count": 143, "script_count": 91, "zip_bomb_ratio": 7.41, "compressed_size": 351212, "directory_count": 23, "executable_count": 0, "extra_field_size": 1287, "noise_file_count": 0, "compression.ratio": 0.3, "hidden_file_count": 3, "uncompressed_size": 1152776, "crc_collision_count": 0, "entry_comment_count": 0, "max_filename_length": 131, "rtlo_filename_count": 0, "format.regular_count": 120, "nested_archive_count": 0, "path_traversal_count": 0, "symlink_escape_count": 0, "security.setgid_count": 0, "security.setuid_count": 0, "security.sticky_count": 0, "double_extension_count": 0, "duplicate_member_count": 0, "format.directory_count": 23, "security.symlink_count": 0, "unicode_filename_count": 0, "homoglyph_filename_count": 0, "security.encrypted_count": 0, "timing.mtime_unique_count": 1, "timing.mtime_unique_ratio": 0.01, "misplaced_executable_count": 0, "timing.mtime_dominant_count": 143, "timing.mtime_spread_seconds": 0, "timing.sentinel_mtime_count": 0, "security.world_writable_count": 0, "timing.mtime_dominant_fraction": 1, "compression.method_counts.stored": 26, "compression.method_counts.deflate": 117 } } }, "traits": [ { "id": "micro-behaviors/process/interpreter/jscript::activex-object", "conf": 1.0, "crit": 3, "desc": "ActiveXObject constructor reference", "from": [ { "file": 45 } ] }, { "id": "micro-behaviors/ui/graphics/draw::canvas-2d-context", "conf": 0.78, "crit": 3, "desc": "Uses canvas 2D context", "from": [ { "file": 41 } ] }, { "id": "micro-behaviors/data/decode/custom::js-indexof-charat-lookup", "atk": "T1140", "conf": 0.9, "crit": 3, "desc": "Indexes characters in a custom alphabet", "from": [ { "file": 41 } ] }, { "id": "micro-behaviors/data/string/concat::js-loop-string-concat-any", "conf": 0.6, "crit": 3, "desc": "String concatenation inside JavaScript loop", "from": [ { "file": 40 } ], "uses": [ 101 ] }, { "id": "metadata/import/php/sebastianbergmann/environment/runtime::sebastianbergmann/environment/runtime", "conf": 0.95, "crit": 2, "desc": "imports SebastianBergmann\\Environment\\Runtime", "from": [ { "file": 12 } ] }, { "id": "micro-behaviors/fs/path/check::php-is-writable-call", "conf": 0.9, "crit": 3, "desc": "Checks path writability via PHP is_writable()", "from": [ { "file": 52 } ] }, { "id": "micro-behaviors/data/source/prototype::return-this-body", "conf": 0.7, "crit": 3, "desc": "Function body returns this", "from": [ { "file": 41 } ] }, { "id": "metadata/package/testing/harness/unit::phpunit-assertion-call", "conf": 0.9, "crit": 2, "desc": "PHPUnit assertion method call", "from": [ { "file": 65 } ] }, { "id": "micro-behaviors/data/string/replace::chained-replace-calls", "conf": 0.9, "crit": 3, "desc": "Chains multiple JavaScript string replacements", "from": [ { "file": 43 } ] }, { "id": "micro-behaviors/data/encoded::base64-token", "conf": 0.7, "crit": 2, "desc": "Calls a Base64 conversion helper", "from": [ { "file": 41 } ] }, { "id": "metadata/lang/natural::lang-english--atom-6", "conf": 0.8, "crit": 1, "desc": "English function-word token \"with\"", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/ui/window/click::capture-phase-listener-bound", "conf": 0.88, "crit": 3, "desc": "Capture-phase listener with bound handler", "from": [ { "file": 43 } ] }, { "id": "metadata/file/function::many-constant-return-functions", "conf": 0.9, "crit": 3, "desc": "File has many constant-return functions", "from": [ { "file": 44 } ] }, { "id": "objectives/supply-chain/hidden-payload/extensions/session::cookie-domain-filter", "conf": 0.82, "crit": 3, "desc": "Filters cookies by domain", "from": [ { "file": 41 } ] }, { "id": "micro-behaviors/data/control-flow/dispatch::js-async-named-event-handler", "conf": 0.85, "crit": 3, "desc": "Registers asynchronous named event handler", "from": [ { "file": 39 } ] }, { "id": "micro-behaviors/communications/http/post::url-encoded-content-type", "atk": "T1071.001", "mbc": "C0002", "conf": 0.7, "crit": 3, "desc": "Uses URL-encoded HTTP form content", "from": [ { "file": 43 } ] }, { "id": "micro-behaviors/ui/window/automation::dom-click-call", "conf": 0.82, "crit": 3, "desc": "Calls click() on a DOM element", "from": [ { "file": 43 } ] }, { "id": "metadata/build/bundler/asset::js-any-bundle-output", "conf": 0.95, "crit": 2, "desc": "Contains bundled or minified JavaScript", "from": [ { "file": 39 }, { "file": 40 }, { "off": 3266, "file": 41, "line": 12 }, { "file": 43 }, { "file": 44 } ], "uses": [ 46, 122, 143 ] }, { "id": "micro-behaviors/data/serialize/json::php-json-encode", "conf": 0.86, "crit": 3, "desc": "PHP JSON serialization", "from": [ { "file": 25 } ] }, { "id": "micro-behaviors/data/source/property/read::result-dot-member-read", "conf": 0.9, "crit": 3, "desc": "Reads result through dot or arrow access", "from": [ { "file": 40 } ] }, { "id": "micro-behaviors/data/control-flow/analysis::js-conditional-matcher-call", "conf": 0.88, "crit": 3, "desc": "Calls a matcher in a conditional expression", "from": [ { "file": 39 } ] }, { "id": "micro-behaviors/ui/terminal::ansi-erase-op", "conf": 0.86, "crit": 3, "desc": "ANSI erase-line/erase-screen sequence", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/data/source/syntax/array::js-array-sort-call", "conf": 0.72, "crit": 3, "desc": "Sorts a JavaScript array", "from": [ { "file": 39 } ] }, { "id": "micro-behaviors/time/query::js-triple-date-now", "conf": 0.4, "crit": 3, "desc": "3+ Date.now() calls", "from": [ { "file": 40 } ] }, { "id": "objectives/command-and-control/backdoor/webshell/ui::self-named-get-form--rx-4", "mbc": "B0030", "conf": 0.86, "crit": 3, "desc": "Matches '$_SERVER['", "from": [ { "file": 11 } ] }, { "id": "micro-behaviors/ui/window/dom/create::browser-create-input-element", "conf": 0.95, "crit": 3, "desc": "Creates an input DOM element", "from": [ { "file": 43 } ] }, { "id": "micro-behaviors/communications/http/client/xmlhttp::xhr-readystatechange-handler", "conf": 0.7, "crit": 3, "desc": "Assigns an XHR readystatechange handler", "from": [ { "file": 40 } ] }, { "id": "micro-behaviors/data/buffer/integer-codec::source-right-shift-16-bits", "conf": 0.9, "crit": 2, "desc": "Source right-shifts by 16 bits", "from": [ { "file": 40 } ] }, { "id": "well-known/lib/ui/bootstrap::twbs-license-url", "conf": 0.99, "crit": 3, "desc": "Bootstrap MIT license GitHub URL", "from": [ { "file": 39 } ] }, { "id": "micro-behaviors/communications/url/encoded::inline-svg-data-uri-context", "atk": "T1027", "mbc": "B0032", "conf": 0.95, "crit": 3, "desc": "Contains an inline SVG data URI", "from": [ { "file": 41 } ] }, { "id": "micro-behaviors/ui/window/dom/create::browser-create-element", "conf": 0.96, "crit": 3, "desc": "Creates DOM element", "from": [ { "file": 39 } ] }, { "id": "micro-behaviors/ui/window/style::element-absolute-position-assignment", "conf": 0.88, "crit": 3, "desc": "Sets an element style to absolute positioning", "from": [ { "file": 41 } ] }, { "id": "micro-behaviors/data/decode/custom::js-indexof-source-token", "atk": "T1140", "conf": 0.75, "crit": 3, "desc": "JavaScript indexOf lookup uses character input", "from": [ { "file": 41 } ] }, { "id": "micro-behaviors/communications/http/post::post", "atk": "T1071.001", "mbc": "C0002", "conf": 0.7, "crit": 3, "desc": "HTTP POST method string literal", "from": [ { "file": 43 } ] }, { "id": "micro-behaviors/data/encode/char-code::fromcharcode-call", "conf": 0.9, "crit": 3, "desc": "Builds characters with String.fromCharCode", "from": [ { "file": 40 } ] }, { "id": "micro-behaviors/communications/http/url/forge::public-code-forge-url", "conf": 0.9, "crit": 3, "desc": "References a public code-forge URL", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/communications/http/url/domain::js-insecure-remote-http-url", "conf": 0.9, "crit": 3, "desc": "Contains a hardcoded insecure HTTP URL", "from": [ { "file": 41 } ] }, { "id": "micro-behaviors/time/schedule/interval::repeated-settimeout", "conf": 0.9, "crit": 3, "desc": "Contains at least six setTimeout calls", "from": [ { "file": 39 } ] }, { "id": "well-known/lib/web/jquery::header-prefix", "conf": 0.95, "crit": 2, "desc": "Contains a jQuery version banner", "from": [ { "file": 43 } ] }, { "id": "micro-behaviors/data/source/syntax/array::temporary-array-element-read", "conf": 0.8, "crit": 2, "desc": "Reads an array element into a variable", "from": [ { "file": 39 } ] }, { "id": "micro-behaviors/ui/window/style::css-display-none", "conf": 0.9, "crit": 3, "desc": "CSS display none declaration", "from": [ { "file": 42 } ] }, { "id": "micro-behaviors/communications/http/url/domain::js-remote-host-url", "conf": 0.75, "crit": 3, "desc": "Contains a hardcoded remote HTTP(S) URL", "from": [ { "file": 41 } ] }, { "id": "micro-behaviors/fs/path/construct::php-script-path-suffix", "conf": 0.94, "crit": 3, "desc": "PHP script path suffix", "from": [ { "file": 11 } ] }, { "id": "micro-behaviors/data/control-flow/error-handling::empty-catch-block", "conf": 0.9, "crit": 3, "desc": "JavaScript silently discards caught errors" }, { "id": "micro-behaviors/data/serialize/object::unserialize", "atk": "T1059", "mbc": "E1059", "conf": 0.65, "crit": 3, "desc": "PHP object deserialization call", "from": [ { "file": 65 } ] }, { "id": "objectives/command-and-control/dropper/execution/jphp::jphp-file-put-contents", "conf": 0.9, "crit": 3, "desc": "JPHP file write call", "from": [ { "file": 50 } ] }, { "id": "metadata/build/minifier::js-medium-minified-line", "conf": 0.9, "crit": 2, "desc": "JavaScript contains a long minified line", "from": [ { "file": 39 } ] }, { "id": "micro-behaviors/communications/http/url/scheme::cleartext-http-url-code-literal", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Code embeds cleartext HTTP URL literal", "from": [ { "file": 41 } ] }, { "id": "metadata/lang/source::repeated-large-integer-arrays", "conf": 0.8, "crit": 3, "desc": "Repeated long numeric array literals", "from": [ { "file": 40 } ] }, { "id": "micro-behaviors/data/string/conversion::tostring-call", "conf": 0.94, "crit": 3, "desc": "Calls JavaScript toString conversion method", "from": [ { "file": 40 } ] }, { "id": "micro-behaviors/data/control-flow/loop::js-object-key-in-loop", "conf": 0.9, "crit": 3, "desc": "JavaScript iterates enumerable object keys", "from": [ { "file": 39 } ] }, { "id": "micro-behaviors/ui/window/dom/create::browser-create-method-reference", "conf": 0.85, "crit": 3, "desc": "References a DOM element creation method", "from": [ { "file": 39 } ] }, { "id": "micro-behaviors/process/create/load/remote-code::js-dom-createelement-literal", "atk": "T1105", "conf": 0.8, "crit": 3, "desc": "Creates a script element with createElement", "from": [ { "file": 43 } ] }, { "id": "micro-behaviors/data/control-flow/analysis::js-try-catch-error-method-call", "conf": 0.8, "crit": 3, "desc": "Calls nested caught-error object method" }, { "id": "micro-behaviors/data/string/replace::keyed-replacement-call", "conf": 0.96, "crit": 3, "desc": "Replaces text using a keyed replacement table", "from": [ { "file": 45 } ] }, { "id": "metadata/file/line::js-long-string-concat-chain", "conf": 0.94, "crit": 3, "desc": "Long JavaScript string concatenation chain", "from": [ { "file": 40 } ] }, { "id": "micro-behaviors/ui/window/dom-access::dom-text-content-read", "conf": 0.82, "crit": 3, "desc": "Reads DOM text content", "from": [ { "file": 40 } ] }, { "id": "well-known/lib/ui/bootstrap::glyphicons-halflings-svg-font", "conf": 0.99, "crit": 3, "desc": "Glyphicons Halflings SVG icon font", "from": [ { "off": 214, "file": 35, "line": 6 } ], "uses": [ 161, 186 ] }, { "id": "metadata/package/testing/presence/harness::test-directory-path", "conf": 1.0, "crit": 2, "desc": "File is in common test directory", "from": [ { "file": 65 } ] }, { "id": "micro-behaviors/ui/window/form-input::browser-value-event-member-read", "conf": 0.9, "crit": 3, "desc": "Reads event/target value or innerText", "from": [ { "file": 40 } ] }, { "id": "metadata/build/minifier::js-webpack-minified-module-call", "conf": 0.95, "crit": 2, "desc": "Minified webpack module-factory invocation", "from": [ { "file": 41 } ] }, { "id": "micro-behaviors/ui/window/dom/create::dom-anchor-element-creation", "conf": 0.85, "crit": 3, "desc": "Creates an anchor DOM element", "from": [ { "file": 42 } ] }, { "id": "micro-behaviors/data/encode/url::encode-uri-component-call", "conf": 0.7, "crit": 3, "desc": "URL-encodes data via encodeURIComponent", "from": [ { "file": 41 } ] }, { "id": "micro-behaviors/data/format/html::markdown-remote-image-source", "conf": 0.9, "crit": 3, "desc": "Markdown references a remote image", "from": [ { "file": 5 } ] }, { "id": "metadata/package/testing/harness/unit::phpunit-test-shape", "conf": 0.9, "crit": 2, "desc": "PHPUnit test method + assertion co-occurrence", "from": [ { "file": 65 } ], "uses": [ 7, 164 ] }, { "id": "micro-behaviors/fs/path/construct::realpath-call", "conf": 0.9, "crit": 3, "desc": "Resolves canonical filesystem path", "from": [ { "file": 19 } ] }, { "id": "metadata/document/html::generated-doc-footer", "conf": 0.9, "crit": 3, "desc": "Generated documentation footer", "from": [ { "file": 31 } ] }, { "id": "micro-behaviors/time/query::js-triple-new-date", "conf": 0.4, "crit": 3, "desc": "3+ new Date() calls", "from": [ { "file": 40 } ] }, { "id": "micro-behaviors/data/source/syntax/array::indexed-array-element-copy", "conf": 0.8, "crit": 2, "desc": "Copies one indexed array element to another", "from": [ { "file": 40 } ] }, { "id": "well-known/lib/ui/bootstrap::version-banner", "conf": 0.99, "crit": 3, "desc": "Bootstrap version header comment", "from": [ { "file": 39 } ] }, { "id": "objectives/anti-static/obfuscation/code-metrics/structure::last-line-over-1000", "atk": "T1027", "mbc": "B0032", "conf": 0.9, "crit": 3, "desc": "Last line is over 1000 chars", "from": [ { "file": 39 } ] }, { "id": "micro-behaviors/communications/http/client/xmlhttp::js-xmlhttp-progid", "conf": 0.9, "crit": 3, "desc": "References an XMLHTTP COM client", "from": [ { "file": 43 } ] }, { "id": "micro-behaviors/communications/http/url/fragment::location-hash-read", "conf": 0.85, "crit": 3, "desc": "Reads the URL fragment from location.hash", "from": [ { "file": 43 } ] }, { "id": "micro-behaviors/communications/http/client/xmlhttp::js-xmlhttp-open", "conf": 0.8, "crit": 3, "desc": "Opens an XMLHttpRequest connection", "from": [ { "file": 45 } ] }, { "id": "objectives/anti-analysis/emulator-detect/date-evasion::js-date-setter-call", "conf": 0.85, "crit": 3, "desc": "Calls a Date year setter", "from": [ { "file": 40 } ] }, { "id": "micro-behaviors/fs/path/location::hardcoded-home-dir-path", "conf": 0.8, "crit": 3, "desc": "Hardcoded absolute home directory path", "from": [ { "file": 22 } ] }, { "id": "well-known/lib/web/jquery::obfuscated-ajax-settings-marker", "conf": 0.98, "crit": 3, "desc": "jQuery ajaxSettings marker", "from": [ { "file": 43 } ] }, { "id": "micro-behaviors/data/format/html::display-none-style", "conf": 0.88, "crit": 3, "desc": "Hides element with display none", "from": [ { "file": 41 } ] }, { "id": "well-known/lib/testing/phpunit::legacy-testcase-class-reference", "conf": 0.98, "crit": 3, "desc": "Legacy PHPUnit TestCase class reference", "from": [ { "file": 12 } ] }, { "id": "metadata/import/php/php/codecoverage/autoload/php::php/codecoverage/autoload/php", "conf": 0.95, "crit": 2, "desc": "imports PHP/CodeCoverage/Autoload.php", "from": [ { "file": 11 } ] }, { "id": "objectives/anti-analysis/vm-detect/script::vm-indicator-bus-strings", "atk": "T1497.001", "conf": 0.9, "crit": 1, "desc": "VM bus string cluster", "from": [ { "file": 40 } ] }, { "id": "micro-behaviors/process/io/stream::js-stream-write-call", "conf": 0.88, "crit": 3, "desc": "Calls a write method on a stream", "from": [ { "file": 43 } ] }, { "id": "metadata/lang/natural::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/ui/window/style::browser-style-position-assignment", "conf": 0.9, "crit": 3, "desc": "Assigns CSS position through DOM style", "from": [ { "file": 41 } ] }, { "id": "micro-behaviors/data/control-flow/error-handling::empty-named-catch-text", "conf": 0.92, "crit": 3, "desc": "Text has empty named-parameter catch", "from": [ { "file": 41 } ] }, { "id": "metadata/file/comment::source-comment-bytes-over-300", "conf": 0.92, "crit": 2, "desc": "Source has over 300 comment bytes", "from": [ { "file": 40 } ] }, { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "from": [ { "file": 2 } ] }, { "id": "objectives/anti-static/obfuscation/code-metrics/identifiers::identifier-obfuscation-cond-0--inline-23810", "atk": "T1027", "mbc": "B0032", "conf": 0.9, "crit": 3, "desc": "Average identifier length \u003e= 22 chars", "from": [ { "file": 69 } ] }, { "id": "micro-behaviors/process/create/load/script::dynamic-script-element-load", "conf": 0.9, "crit": 3, "desc": "Dynamically loads script element", "from": [ { "file": 43 } ] }, { "id": "objectives/collection/keylog/capture::browser-key-event-object-queued", "atk": "T1056.001", "mbc": "E1056", "conf": 0.97, "crit": 3, "desc": "Queues browser keyboard-event key data", "from": [ { "file": 44 } ] }, { "id": "micro-behaviors/communications/http/request/client::xmlhttprequest-new", "atk": "T1071.001", "mbc": "C0002", "conf": 0.94, "crit": 3, "desc": "Invokes the XMLHttpRequest constructor", "from": [ { "file": 40 } ] }, { "id": "metadata/file/comment::source-comment-bytes-over-20000", "conf": 0.9, "crit": 3, "desc": "Source has over 20000 comment bytes", "from": [ { "file": 40 } ] }, { "id": "metadata/file/comment::source-at-most-two-comments", "conf": 0.88, "crit": 2, "desc": "Source has at most two comments", "from": [ { "file": 39 } ] }, { "id": "micro-behaviors/data/decode/url::js-unescape-call", "atk": "T1140", "conf": 0.9, "crit": 3, "desc": "Calls JavaScript unescape", "from": [ { "file": 41 } ] }, { "id": "micro-behaviors/communications/http/request/client::xmlhttprequest-word", "conf": 0.4, "crit": 3, "desc": "References the XMLHttpRequest HTTP client", "from": [ { "file": 40 } ] }, { "id": "micro-behaviors/ui/window/visibility::browser-blur-call", "conf": 0.9, "crit": 3, "desc": "Calls blur() on DOM object", "from": [ { "file": 43 } ] }, { "id": "objectives/execution/interpreter/php-assert::server-superglobal-read", "atk": "T1505.003,T1059.006", "mbc": "B0030", "conf": 0.85, "crit": 3, "desc": "Reads the server superglobal", "from": [ { "file": 11 } ] }, { "id": "micro-behaviors/data/decode/custom::js-charcode-byte-mask", "atk": "T1140", "conf": 0.94, "crit": 3, "desc": "Masks character code to one byte", "from": [ { "file": 41 } ] }, { "id": "micro-behaviors/communications/http/client/xmlhttp::activex-http-progid", "conf": 0.9, "crit": 3, "desc": "Creates legacy ActiveX HTTP object", "from": [ { "file": 43 } ] }, { "id": "micro-behaviors/ui/window/style::zero-height-element-style", "conf": 0.92, "crit": 3, "desc": "CSS sets element height to zero", "from": [ { "file": 43 } ] }, { "id": "micro-behaviors/ui/window/dom/tree::source-append-child-call", "conf": 0.9, "crit": 3, "desc": "Appends a node to a DOM parent", "from": [ { "file": 20 } ] }, { "id": "micro-behaviors/data/string/concat::js-loop-string-concat", "conf": 0.6, "crit": 2, "desc": "String concatenation in loop body using array", "from": [ { "file": 40 } ] }, { "id": "micro-behaviors/communications/http/header/content-type::application-json", "conf": 0.65, "crit": 3, "desc": "References the application/json media type", "from": [ { "file": 40 } ] }, { "id": "micro-behaviors/data/encode/char-code::multiple-fromcharcode-calls", "conf": 0.92, "crit": 3, "desc": "Calls String.fromCharCode multiple times", "from": [ { "file": 41 } ] }, { "id": "micro-behaviors/data/encode/base64::btoa-symbol", "conf": 0.78, "crit": 3, "desc": "Calls the browser btoa() Base64 encoder", "from": [ { "file": 41 } ] }, { "id": "micro-behaviors/data/string/conversion::js-fromcharcode-alias", "conf": 0.9, "crit": 3, "desc": "Aliases String.fromCharCode conversion function", "from": [ { "file": 41 } ] }, { "id": "micro-behaviors/data/buffer/integer-codec::source-right-shift-24-bits", "conf": 0.9, "crit": 2, "desc": "Source right-shifts by 24 bits", "from": [ { "file": 40 } ] }, { "id": "micro-behaviors/data/decode/hex::js-hex-number-parse", "conf": 0.9, "crit": 3, "desc": "JavaScript hex-to-integer conversion", "from": [ { "file": 40 } ] }, { "id": "micro-behaviors/process/interpreter/eval/compile::js-function-constructor", "conf": 0.9, "crit": 3, "desc": "Constructs a JavaScript function dynamically" }, { "id": "micro-behaviors/fs/path/temp::unix-temp", "conf": 0.7, "crit": 2, "desc": "Unix /tmp/ path reference", "from": [ { "file": 10 } ] }, { "id": "objectives/anti-static/obfuscation/string/reconstruct::vendor-minified-js-name", "conf": 0.9, "crit": 3, "desc": "Common vendor minified JS name", "from": [ { "file": 43 } ] }, { "id": "micro-behaviors/hardware/input/event::on-mouse-event-handler", "conf": 0.92, "crit": 3, "desc": "Registers mouse event handler with on()", "from": [ { "file": 44 } ] }, { "id": "micro-behaviors/fs/path/temp::tmp-path-content", "conf": 1.0, "crit": 2, "desc": "Contains a /tmp/ or /var/tmp/ path", "from": [ { "file": 10 } ] }, { "id": "micro-behaviors/communications/http/client/file-read::php-file-get-variable-source", "conf": 0.88, "crit": 3, "desc": "PHP reads content from a variable source", "from": [ { "file": 16 } ] }, { "id": "metadata/package/testing/harness/unit::phpunit-testcase-extends", "conf": 0.97, "crit": 2, "desc": "Extends PHPUnit TestCase class", "from": [ { "file": 65 } ] }, { "id": "micro-behaviors/data/source/syntax/array::js-array-short-delimiter-join-call", "conf": 0.72, "crit": 3, "desc": "Joins array with a short delimiter", "from": [ { "file": 39 } ] }, { "id": "micro-behaviors/os/clipboard/write::browser-select-before-copy", "atk": "T1115", "conf": 0.78, "crit": 3, "desc": "Calls select() on a browser element", "from": [ { "file": 40 } ] }, { "id": "micro-behaviors/ui/window/dom/tree::browser-insert-before", "conf": 0.8, "crit": 3, "desc": "Inserts DOM node before reference node", "from": [ { "file": 40 } ] }, { "id": "micro-behaviors/ui/graphics/draw::canvas-image-data-url", "conf": 0.78, "crit": 3, "desc": "Exports canvas content as image data URL", "from": [ { "file": 41 } ] }, { "id": "micro-behaviors/data/string/concat::join-empty-separator-call", "conf": 0.82, "crit": 3, "desc": "Joins values without a separator", "from": [ { "file": 40 } ] }, { "id": "micro-behaviors/communications/http/request/superglobal::http-request-server-variable", "conf": 0.8, "crit": 3, "desc": "Reads PHP HTTP request server variable" }, { "id": "micro-behaviors/ui/window/dom/tree::browser-node-remove", "conf": 0.8, "crit": 3, "desc": "Removes a child node from the DOM", "from": [ { "file": 39 } ] }, { "id": "metadata/build/minifier::js-umd-wrapper-amd-minified", "conf": 0.9, "crit": 2, "desc": "Contains a minified UMD AMD branch", "from": [ { "file": 40 } ] }, { "id": "micro-behaviors/process/interpreter/eval/compile::js-new-function-constructor", "conf": 0.7, "crit": 3, "desc": "Calls JavaScript's new Function constructor" }, { "id": "micro-behaviors/os/sysinfo/platform/timezone::js-gettimezoneoffset", "atk": "T1614", "conf": 0.9, "crit": 3, "desc": "Reads host UTC offset via getTimezoneOffset", "from": [ { "file": 40 } ] }, { "id": "objectives/anti-static/obfuscation/eval/browser::html-createelement-object", "atk": "T1027,T1059.007", "conf": 0.9, "crit": 3, "desc": "Creates a scripted DOM object", "from": [ { "file": 39 } ] }, { "id": "micro-behaviors/fs/file/copy::copy-call", "conf": 0.9, "crit": 3, "desc": "Copies file via copy()", "from": [ { "file": 23 } ] }, { "id": "metadata/package/testing/presence/harness::python-php-test-basename-suffix", "conf": 0.95, "crit": 2, "desc": "Python/PHP test filename suffix", "from": [ { "file": 61 } ] }, { "id": "micro-behaviors/data/control-flow/loop::js-length-loop-compound-add", "conf": 0.85, "crit": 3, "desc": "Length-bounded loop uses compound addition", "from": [ { "file": 40 } ] }, { "id": "micro-behaviors/ui/window/dom/tree::browser-append-child", "conf": 0.8, "crit": 3, "desc": "Appends child DOM node", "from": [ { "file": 41 } ] }, { "id": "micro-behaviors/data/decode/base64::standard-base64-alphabet", "conf": 0.9, "crit": 3, "desc": "JavaScript embeds an upper-first Base64 alphabet", "from": [ { "file": 41 } ] }, { "id": "micro-behaviors/fs/write/file/full::php-file-put-contents", "atk": "T1546", "conf": 1.0, "crit": 3, "desc": "Calls PHP file_put_contents()", "from": [ { "file": 50 } ] }, { "id": "objectives/anti-analysis/environment-detect/runtime::runtime-vm-detection-evidence", "mbc": "B0001", "conf": 0.9, "crit": 3, "desc": "Contains virtual-machine detection evidence", "from": [ { "file": 40 } ], "uses": [ 80 ] }, { "id": "micro-behaviors/data/string/replace::php-preg-replace-call", "conf": 0.9, "crit": 3, "desc": "PHP replaces strings with a regular expression", "from": [ { "file": 109 } ] }, { "id": "well-known/lib/ui/bootstrap::getbootstrap-url", "conf": 0.99, "crit": 3, "desc": "getbootstrap.com library homepage URL", "from": [ { "file": 39 } ] }, { "id": "micro-behaviors/data/serialize/schema-object::json-object-variable-field", "conf": 0.84, "crit": 3, "desc": "JSON object includes a variable-valued field", "from": [ { "file": 40 } ] }, { "id": "micro-behaviors/communications/http/request/client::http-client", "conf": 0.7, "crit": 3, "desc": "Uses common HTTP client APIs", "from": [ { "off": 10196, "file": 40, "line": 1 } ], "uses": [ 90 ] }, { "id": "micro-behaviors/ui/window/dom/create::browser-insert-mutate-method-reference", "conf": 0.85, "crit": 3, "desc": "References a DOM insertion or mutation method", "from": [ { "file": 40 } ] }, { "id": "micro-behaviors/data/control-flow/module-exec::js-synchronous-iife-close", "conf": 0.86, "crit": 3, "desc": "Calls a parenthesized function expression", "from": [ { "file": 40 } ] }, { "id": "micro-behaviors/data/string/search::compiled-js-pattern-set", "conf": 0.9, "crit": 3, "desc": "Compiles a set of JavaScript regex patterns", "from": [ { "file": 40 } ] }, { "id": "metadata/lang/natural::lang-english--atom-3", "conf": 0.8, "crit": 1, "desc": "English function-word token \"that\"", "from": [ { "file": 3 } ] }, { "id": "metadata/package/files/runtime::typescript-source-tree-artifact", "conf": 0.95, "crit": 3, "desc": "Source file under src", "from": [ { "file": 39 } ] }, { "id": "micro-behaviors/process/hook/console/assignment::js-console-forwarding-call", "conf": 0.95, "crit": 3, "desc": "Invokes preserved console method with arguments", "from": [ { "file": 44 } ] }, { "id": "metadata/build/minifier::js-umd-wrapper-minified", "conf": 0.9, "crit": 2, "desc": "Contains a minified UMD CommonJS branch", "from": [ { "file": 41 } ] }, { "id": "micro-behaviors/data/serialize/json::json-stringify-identifier", "conf": 0.85, "crit": 3, "desc": "Serializes an identifier as JSON", "from": [ { "file": 40 } ] }, { "id": "micro-behaviors/os/stdio::error-suppress-prefix", "conf": 0.7, "crit": 3, "desc": "Suppresses errors with the PHP @ operator" }, { "id": "micro-behaviors/ui/window/dom/create::browser-iframe-element", "conf": 0.78, "crit": 1, "desc": "References an iframe HTML element", "from": [ { "file": 42 } ] }, { "id": "micro-behaviors/ui/window/insert-html::dom-outer-html-insertion-sink", "conf": 0.9, "crit": 3, "desc": "Replaces or inserts HTML around a node", "from": [ { "file": 43 } ] }, { "id": "micro-behaviors/data/string/split::js-split-call", "conf": 0.8, "crit": 3, "desc": "Calls JavaScript split()", "from": [ { "file": 39 } ] }, { "id": "micro-behaviors/hardware/input/mouse/position::dom-pointer-client-coordinate-read", "conf": 0.9, "crit": 3, "desc": "Reads a DOM pointer client coordinate", "from": [ { "file": 40 } ] }, { "id": "micro-behaviors/communications/url/encoded::encoded-http-url", "atk": "T1027", "mbc": "B0032", "conf": 0.85, "crit": 3, "desc": "Encoded URL decoded to http(s)", "from": [ { "file": 40 } ] }, { "id": "micro-behaviors/communications/http/post::enctype-attr", "atk": "T1071.001", "mbc": "C0002", "conf": 0.6, "crit": 3, "desc": "HTML form encoding attribute", "from": [ { "file": 43 } ] }, { "id": "micro-behaviors/data/source/arithmetic::js-bitwise-arithmetic-chain", "conf": 0.8, "crit": 3, "desc": "JavaScript bitwise arithmetic and shift chain", "from": [ { "file": 40 } ] }, { "id": "metadata/encoded-payload/url", "conf": 0.9, "crit": 3, "desc": "Percent-encoded content decoded" }, { "id": "objectives/evasion/masquerade/source-review::data-handling-function-name", "atk": "T1036", "mbc": "F0001", "conf": 0.85, "crit": 3, "desc": "Function named for handling data safely", "from": [ { "file": 51 } ] }, { "id": "objectives/exfiltration/stealer/file::svg-path-append-recognized", "atk": "T1020", "conf": 0.99, "crit": 3, "desc": "Recognized SVG path append pattern", "from": [ { "file": 44 } ] }, { "id": "micro-behaviors/data/serialize/object::js-serialise", "conf": 0.85, "crit": 3, "desc": "References a serialization-related symbol", "from": [ { "file": 41 } ] }, { "id": "objectives/anti-static/obfuscation/eval/loader::nested-decoder-function-build", "atk": "T1027", "mbc": "B0032", "conf": 0.86, "crit": 3, "desc": "Nested decoder builds function", "from": [ { "file": 40 } ] }, { "id": "micro-behaviors/communications/url/encoded::inline-image-data-uri-context", "atk": "T1027", "mbc": "B0032", "conf": 0.95, "crit": 3, "desc": "Contains an inline image data URI", "from": [ { "file": 41 } ] }, { "id": "well-known/lib/web/jquery::obfuscated-sizzle-marker", "conf": 0.98, "crit": 2, "desc": "jQuery Sizzle engine marker", "from": [ { "file": 43 } ] }, { "id": "micro-behaviors/data/string/concat::array-join-empty-separator-text", "conf": 0.78, "crit": 3, "desc": "Array expression joined without separator", "from": [ { "file": 41 } ] }, { "id": "well-known/lib/ui/bootstrap::glyphicons-halflings-font-face", "conf": 0.99, "crit": 3, "desc": "Glyphicons Halflings font-face metrics", "from": [ { "file": 35 } ] }, { "id": "metadata/lang/natural::lang-english--atom-2", "conf": 0.8, "crit": 1, "desc": "English function-word token \"and\"", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/ui/window/style::zero-width-element-style", "conf": 0.92, "crit": 3, "desc": "CSS sets element width to zero", "from": [ { "file": 43 } ] }, { "id": "metadata/package/testing/harness/unit::phpunit-method-test-prefix", "conf": 0.8, "crit": 2, "desc": "PHPUnit test_ method prefix", "from": [ { "file": 65 } ] }, { "id": "micro-behaviors/data/string/conversion::tostring-token", "conf": 1.0, "crit": 3, "desc": "References the toString conversion method", "from": [ { "file": 40 } ] }, { "id": "micro-behaviors/os/sysinfo/platform/runtime::phpversion-call", "conf": 0.8, "crit": 3, "desc": "Reads the PHP runtime version", "from": [ { "file": 16 } ] }, { "id": "micro-behaviors/data/source/property/read::repeated-constructor-property-read", "conf": 0.9, "crit": 3, "desc": "Reads constructor properties repeatedly", "from": [ { "file": 39 } ] }, { "id": "metadata/build/minifier::js-min-or-map-basename", "conf": 0.9, "crit": 3, "desc": "JavaScript minified or map basename", "from": [ { "file": 39 } ] }, { "id": "micro-behaviors/data/encode/base64::btoa-utf8-safe-encode", "conf": 0.88, "crit": 3, "desc": "UTF-8-safe Base64 encoding via btoa()", "from": [ { "file": 41 } ] }, { "id": "micro-behaviors/ui/window/dom-access::browser-queryselectorall-call", "conf": 0.86, "crit": 3, "desc": "Queries multiple DOM elements", "from": [ { "file": 40 } ] }, { "id": "micro-behaviors/data/buffer/integer-codec::source-right-shift-8-bits", "conf": 0.9, "crit": 2, "desc": "Source right-shifts by 8 bits", "from": [ { "file": 40 } ] }, { "id": "micro-behaviors/data/encode/charcode::charcode-at", "conf": 0.7, "crit": 3, "desc": "charCodeAt() method call", "from": [ { "file": 40 } ] }, { "id": "micro-behaviors/os/env/read::php-server-superglobal", "conf": 0.85, "crit": 3, "desc": "Reads PHP $_SERVER execution environment data", "from": [ { "file": 11 } ] }, { "id": "micro-behaviors/data/format/html::iframe-visibility-hidden", "conf": 0.88, "crit": 3, "desc": "Hides iframe with visibility property", "from": [ { "file": 41 } ] }, { "id": "micro-behaviors/ui/window/dom-access::domparser-constructor", "conf": 0.76, "crit": 3, "desc": "Constructs a DOMParser", "from": [ { "file": 41 } ] }, { "id": "metadata/lang/natural::lang-english--atom-7", "conf": 0.8, "crit": 1, "desc": "English function-word token \"this\"", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/communications/http/url/navigation::browser-location-host-read", "conf": 0.82, "crit": 3, "desc": "Reads current host from browser location", "from": [ { "file": 45 } ] }, { "id": "metadata/import/php/bankaccount/php::bankaccount/php", "conf": 0.95, "crit": 2, "desc": "imports BankAccount.php", "from": [ { "file": 73 } ] }, { "id": "micro-behaviors/data/source/dynamic/reflect::computed-this-method-call", "conf": 0.9, "crit": 3, "desc": "Calls a computed this method", "from": [ { "file": 43 } ] }, { "id": "well-known/lib/web/jquery::license-url", "conf": 0.95, "crit": 3, "desc": "jQuery license URL marker", "from": [ { "file": 43 } ] }, { "id": "micro-behaviors/data/string/replace::php-str-replace-call", "conf": 0.9, "crit": 3, "desc": "PHP replaces matched string content", "from": [ { "file": 25 } ] }, { "id": "micro-behaviors/process/create/script/wsh::activexobject-marker", "conf": 0.8, "crit": 3, "desc": "ActiveXObject marker", "from": [ { "file": 43 } ] }, { "id": "micro-behaviors/communications/http/url/rpc::solana-rpc-method-2", "conf": 0.8, "crit": 3, "desc": "Solana JSON-RPC method (balance/tx/blockhash)", "from": [ { "file": 67 } ] }, { "id": "objectives/anti-static/obfuscation/code-metrics/structure::single-long-line-outlier", "atk": "T1027", "mbc": "B0032", "conf": 0.9, "crit": 3, "desc": "Exactly one line exceeds 1000 chars", "from": [ { "file": 41 } ] }, { "id": "objectives/anti-static/obfuscation/string/array::js-string-split", "conf": 0.6, "crit": 3, "desc": "Split to empty-delimiter char array", "from": [ { "file": 43 } ] }, { "id": "well-known/lib/ui/bootstrap::glyphicons-halflings-font-id", "conf": 0.99, "crit": 3, "desc": "Glyphicons Halflings SVG font id", "from": [ { "file": 35 } ] }, { "id": "well-known/lib/ui/bootstrap::bootstrap-js-library", "conf": 0.99, "crit": 3, "desc": "twbs Bootstrap JavaScript library", "from": [ { "off": 32, "file": 39, "line": 2 } ], "uses": [ 28, 69, 134 ] }, { "id": "micro-behaviors/data/source/prototype::return-this-prototype", "conf": 0.7, "crit": 3, "desc": "Prototype methods returning this", "from": [ { "file": 39 } ] }, { "id": "micro-behaviors/data/source/property/computed::js-computed-call-cluster", "conf": 0.86, "crit": 3, "desc": "Dense computed-property call cluster (3+)", "from": [ { "file": 39 } ] }, { "id": "metadata/package/testing/presence/harness::test-directory", "conf": 1.0, "crit": 2, "desc": "File identified as a test by path or name", "from": [ { "file": 61 } ], "uses": [ 58, 127 ] }, { "id": "micro-behaviors/data/buffer/record::slice-decimal-offset-pair", "conf": 0.8, "crit": 3, "desc": "Slice split at decimal offsets", "from": [ { "file": 43 } ] }, { "id": "objectives/anti-static/obfuscation/reflection/identity::identity-function-proxy", "conf": 0.8, "crit": 3, "desc": "Contains several identity wrapper functions", "from": [ { "file": 44 } ] }, { "id": "micro-behaviors/process/attach/debugger::php-xdebug-extension-check", "conf": 0.94, "crit": 3, "desc": "PHP Xdebug extension check", "from": [ { "file": 16 } ] }, { "id": "well-known/lib/web/jquery::version-string", "conf": 0.95, "crit": 3, "desc": "jQuery version string", "from": [ { "file": 43 } ] }, { "id": "micro-behaviors/communications/http/auth::signature-field-to-field-assignment", "mbc": "C0002", "conf": 0.96, "crit": 3, "desc": "Copies signature between structured fields", "from": [ { "file": 48 } ] }, { "id": "micro-behaviors/data/serialize/object::php-serialized-object-record", "conf": 0.96, "crit": 3, "desc": "PHP serialized object record", "from": [ { "file": 65 } ] }, { "id": "micro-behaviors/communications/http/url/path::image-file-url", "conf": 0.85, "crit": 3, "desc": "HTTP URL targets an image file", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/data/decode/base64::base64-alphabet", "conf": 0.9, "crit": 3, "desc": "JavaScript embeds a Base64 alphabet", "from": [ { "off": 1101, "file": 41, "line": 12 } ], "uses": [ 130 ] }, { "id": "micro-behaviors/communications/http/client/response-body::response-text", "conf": 0.7, "crit": 3, "desc": "Reads an XMLHttpRequest response body", "from": [ { "file": 40 } ] }, { "id": "micro-behaviors/fs/path/extension::quoted-font-path", "conf": 0.9, "crit": 3, "desc": "References a quoted font file path", "from": [ { "file": 23 } ] }, { "id": "micro-behaviors/data/decode/url::js-unescape-call-text", "atk": "T1140", "conf": 0.9, "crit": 3, "desc": "Calls JavaScript unescape in source text", "from": [ { "file": 41 } ] }, { "id": "objectives/anti-static/obfuscation/string/reverse::js-reverse-assignment-tail", "atk": "T1027", "mbc": "B0032", "conf": 0.97, "crit": 3, "desc": "Variable assigned reverse call result", "from": [ { "file": 43 } ] }, { "id": "micro-behaviors/data/control-flow/analysis::js-zero-divided-by-zero-assignment", "conf": 0.8, "crit": 3, "desc": "JavaScript assigns a zero-divided-by-zero result", "from": [ { "file": 40 } ] }, { "id": "micro-behaviors/ui/window/insert-html::browser-innerhtml-assignment", "conf": 0.8, "crit": 3, "desc": "Writes HTML into the DOM with innerHTML" }, { "id": "micro-behaviors/data/format/csv/export::csv-content-type", "conf": 0.9, "crit": 3, "desc": "Declares text/csv content type", "from": [ { "file": 40 } ] }, { "id": "objectives/anti-static/obfuscation/string/recovery::js-indirect-replace-call", "conf": 0.75, "crit": 3, "desc": "Indirect string replacement call", "from": [ { "file": 40 } ] }, { "id": "metadata/file/string/file::tmp", "conf": 0.2, "crit": 1, "desc": "tmp keyword", "from": [ { "file": 10 } ] }, { "id": "micro-behaviors/ui/window/click::programmatic-element-click", "conf": 0.9, "crit": 3, "desc": "Programmatically clicks a DOM element", "from": [ { "file": 43 } ] }, { "id": "metadata/file/archive::archive-at-least-10-members", "conf": 0.9, "crit": 3, "desc": "Archive contains at least ten members" }, { "id": "metadata/file/archive::archive-at-least-120-members", "conf": 0.98, "crit": 3, "desc": "Archive contains at least 120 members" }, { "id": "metadata/package/files/archive-member::archive-css-member", "conf": 0.9, "crit": 3, "desc": "Archive member is a stylesheet" }, { "id": "metadata/package/files/archive-member::archive-font-member", "conf": 0.9, "crit": 3, "desc": "Archive member is a font file" }, { "id": "metadata/package/files/archive-member::archive-js-member", "conf": 0.9, "crit": 3, "desc": "Archive member is a JavaScript file" }, { "id": "metadata/package/files/archive-member::archive-svg-member", "conf": 0.9, "crit": 3, "desc": "Archive member is an SVG document" }, { "id": "metadata/package/testing/presence/path::archive-test-directory-member-path", "conf": 0.98, "crit": 3, "desc": "Archive ships a root-level test tree" }, { "id": "metadata/package/testing/scripted::go-fuzz-corpus-entry-basename", "conf": 0.96, "crit": 3, "desc": "Go fuzz corpus entry basename (sha1[-index])" }, { "id": "metadata/file/naming::hex-hash-zip-basename", "conf": 0.92, "crit": 3, "desc": "Zip basename is a hexadecimal hash" } ] } ] } }