{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9998236298561096, "class": 2 } ], "prob": 0.99982363, "class": 2, "models": [ { "m": "az", "prob": 0.96634835, "class": 0 }, { "m": "az/scripts", "prob": 0.9991086, "class": 0 }, { "m": "az/php", "prob": 0.99982363, "class": 2 } ], "version": "v16.16", "thresholds": [ 0.9961138, 0.99909174 ], "analyzed_at": "2026-05-10T00:42:41Z" }, "path": "config2.php", "raw": { "v": "4", "fs": [ { "f": "KO₅(C₅XeAlAs₃La)H₄(Cm₅Db₂PoOs)Md₃(Pt)", "k": { "source.imports[0]": "array_flip", "source.imports[1]": "array_key_exists", "source.imports[2]": "array_merge", "source.imports[3]": "chr", "source.imports[4]": "curl_close", "source.imports[5]": "curl_exec", "source.imports[6]": "curl_init", "source.imports[7]": "curl_setopt", "source.imports[8]": "define", "source.imports[9]": "defined", "source.strings[0]": "$key: $value", "source.strings[1]": "-3nr:r,!t~:o#7(c4+n+jaww3-p\u003ca\u0026ec|!s9nf2*\u0014\u0026o~ bf(wmlc,eg\"toid,y,%g\t!*n~$\u0026x1?g?,*m) vtq^\u0004I\u001d\u000fI\u000e\u0015c\u001dS\u0011\u0015MU\u000e\u0016]B\u001c@\u00051\ned=*=_\u0013\nk`\u003c\u0026lu9)c(wjGS\u001d\u001d\u001aN\b\u0011`KB\u001bR\u000f]C\u0010\u0018JBP\u000f\f\f\u0010\u0015\u001a\u0010\u0018=^f/7?{0o6$#c\u0012\u0007E\u0005N\t[j\tUBD\u0011\u000e\rF\u0013\u0011\b\u0013-\u0005x3t\u001c\u0013\u000bX\u0018F\bSo\u000f\f[K\u0014K\u0003A\u0002{\u0016 -i}}\u001d\f\u0013\u0005\u0004=XOb\n_xt6{*$`#5-\"L\u0018\tOwHTp\u0016\u001aBJ/0|}d:|; $x\u0011\u0017\nD\u0016\u0010\u0002E\u0026\u0019\u000fLF\u000bZ\u0012S\u0005\u001a\u0004GOTLq\u0003e`\u003c\u0026l`\u0026\u003cp\u000e2/lc0gk$r3\u0026mr*z2st/?{k6\u003e2\u003e$\u003e%!{q,g\"5\u003e1g0\u0026-s\u003c'.\u0026a t){'/.nqx+ %s8!\"5s!'v11#\u0026v=f;z./$mr%d0s%27?nh188)127+q\u00261pd)+7w56$f*43kn$\u0026\u0026l-\u0026;ot$\u003c\u00049(|.\u003e+cy(\u0003\u001d\u0001\u001d@\u0005\u0007\u000b9I\u0005\u000fHI\u0001\\\u0004D\b\u0004\u0002EDN?\u000bweMJ!A\u001aty7q-+lu*!lM\u001b\u0006\u0014F-B\b-\u0011\n^W|y}\u0026,!?`s6/hb6'll\u0007mx7'c7{{j{\\yk;otom!1;\u0012r)s\u003e;bf#xs\u003c\fm$!i6,}$m`wS5/l/=qukq/Pz81(bxza3z\u001979+,9|ta3y\u001bmzg-{}\u0026lbqQ5z?'iqpu\u0026xPa)h:acc6gz\f0q?\u003c71x/f9\u000bk\"il5?z~ko\u001ct%s;v0}i7\\v%?$}fg$9\u0013,$dt|z66(l,(68tpq:$`l9,5\u001f54\u003c\u003c?pwms/ h\u0010$7'\u0026hxH`, pydaa(w\b\u003c'3\u001ccc `6})\"+S4d$`2qv\u0017yw|\bm\u003c? 68n3ye\u003e(\tw5r61/Hyhd.*f{\u0006%;5\u0002 x!4#8(\t.x+cy+s\u0012k.r-\u003c\u003ewr%)yb;}\u001d9xbi -5h\u003e.!9!\u003e!y:v~vsn?/ \" y*)\u001b-f'r;,sz5J %('3\u001ctxz6#f/*0{gi!3)h~VG/\r]8l){!'!\u003ed\u003c9/_;\"9\"gppa5$%6\u0026nC~W\u001e\u0002\nY^\u0019Xk@\u0013\b\u001e\u0013SX\u000b\u0015\u000f\u0012j\u0002h\u0019_e9'u#Y\u001c{xa4vgc\"x$ /x\"e\u0018LWC\n{K\\|u!wqBSqQDIEd%!%loq\u000fJC\u00114c-$}:(n|%\u0001\u003c!42n+'c\u0026ael7l7(%et:/s4tqj*:q)~eP*=`l3afo !~7smos5ubb\"nyv)", "source.strings[2]": "77.87.193.14", "source.strings[3]": "8d513cbb-4054-45b6-a276-b668f435ab9a", "source.strings[4]": "\u003c/body\u003e", "source.strings[5]": "\u003c/head\u003e", "source.strings[6]": "\u003c/tds\u003e", "source.strings[7]": "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=", "source.strings[8]": "Content-type: application/x-www-form-urlencoded", "source.strings[9]": "HTTP_ACCEPT", "source.has_imports": true, "source.imports[10]": "empty", "source.imports[11]": "eval", "source.imports[12]": "explode", "source.imports[13]": "file_get_contents", "source.imports[14]": "filter_var", "source.imports[15]": "function_exists", "source.imports[16]": "header", "source.imports[17]": "http_build_query", "source.imports[18]": "is_acceptable_tds_request", "source.imports[19]": "isset", "source.imports[20]": "ob_start", "source.imports[21]": "ord", "source.imports[22]": "preg_replace", "source.imports[23]": "serialize", "source.imports[24]": "setcookie", "source.imports[25]": "str_replace", "source.imports[26]": "str_split", "source.imports[27]": "stream_context_create", "source.imports[28]": "strlen", "source.imports[29]": "strpos", "source.imports[30]": "strtolower", "source.imports[31]": "time", "source.imports[32]": "trim", "source.imports[33]": "unserialize", "source.strings[10]": "HTTP_ACCEPT_CHARSET", "source.strings[11]": "HTTP_ACCEPT_ENCODING", "source.strings[12]": "HTTP_ACCEPT_LANGUAGE", "source.strings[13]": "HTTP_CF_CONNECTING_IP", "source.strings[14]": "HTTP_CONNECTION", "source.strings[15]": "HTTP_HOST", "source.strings[16]": "HTTP_REFERER", "source.strings[17]": "HTTP_USER_AGENT", "source.strings[18]": "LTNucjpyLCF0fjpvIzcoYzQrbitqYXd3My1wPGEmZWN8IXM5bmYyKhQmb34gYmYod21sYyxlZyJ0b2lkLHksJWcJISpufiQmeDE/f2c/LCptKSB2dHFeBEkdD0kOFWMdUxEAFU1VDhZdQhxABTEKZWQ9Kj1fEwprYDwmbHU5KWMod2pHUx0dGk4IEWBLQhtSD11DEBhKQlAPDAwQFRoQGD1eZi83P3swbzYkI2N/fxIHRQVOCVsAaglVQkQRDg1GExEIEy0FeDN0HBMLWBhGCFNvDwxbSxRLA0ECexZ/IC1pfX0dDBMFBD1YT2IKX3h0NnsqJGAjNS0iTAAYCU93SFRwFhpCSi8wfH1kOnw7ICR4ERcKRBYQAkUmGQ9MRgtaElMFGgRHT1RMcQNlYDwmbGAmPHAOMi9sYzBnayRyMyZtcip6MnN0Lz97f2s2PjI+JD4lIXtxLGciNT4xZzAmLXM8Jy4mYSB0KXsnLy5ucXgrICVzOCEiNXMhJ3YxMSMmdj1mO3ouLyRtciVkMHMlMjc/bmgxODgpMTI3K3EmMXBkKSs3dzU2JGYqNDNrbiQmJmwtJjtvdH8kPAQ5KHwuPitjeSgDHQEdQAUHCzlJBQ9ISQFcBEQIBAJFRE4/C3dlTUohQRp0eTdxLStsdSohbE0bBhRGLUIILREKXld8eX0mLCE/YHM2L2hiNidsbAdteDcnYzd7e2p7XHlrO290b20hMTsScilzPjtiZiN4czwMbSQhaTYsfSRtYHdTNS9sLz1xdWtxL1B6ODEoYnh6YTN6GTd/OSssOXx0YTN5G216Zy17fSZsYnFRNXo/J2lxcHUmeFBhKWg6YWNjNmd6DDBxPzw3MXgvZjkLayJpbDU/en5rbxx0JXM7djB9f2k3XHYlPyR9ZmckORMsJGR0fHo2NihsLCg2OHRwcTokYGw5LDUfNTQ8PD9wd21zLyBoECQ3JyZoeEhgLCBweWRhYSh3CDwnMxxjYyBgNn0pIitTNGQkYDJxdhd5d3wIbTw/IDY4bjN5ZT4oCXc1cjYxL0h5aGQuKmZ7BiU7NQIgeH8hNCM4KAkueCtjeStzEmsuci08PndyJSl5Yjt9HTl4YmkgLTVoPi4hOSE+IXk6dn52c24/LyAiIHkqKRstZidyfzssc3o1SiAlKCczHHR4ejYjZi8qMHtnaSEzKWh+VkcvDV04bCl7ISchPmQ8OS9fOyI5ImdwcGE1JCU2Jm5DflceAgpZXhlYa0ATCB4TU1gLFQ8SagJ/aBlfZTkndSNZHHt4YTR2Z2MieCQgL3giZRhMV0MKe0tcfHUhd3FCU3FRRElFZCUhJWxvcQ9KQxE0Yy0kf306KG58JQE8ITQybisnYyZhZWw3bDcoJWV0Oi9zNHRxaio6cSl+ZVAqPWBsM2FmbyAhfjdzbW9zNXViYiJueXYp", "source.strings[19]": "REMOTE_ADDR", "source.strings[20]": "REQUEST_URI", "source.strings[21]": "TdsClient::postrender_handler", "source.strings[22]": "content", "source.strings[23]": "cookies", "source.strings[24]": "curl_version", "source.strings[25]": "file_get_contents ", "source.strings[26]": "function is_acceptable_tds_request(){", "source.strings[27]": "function is_acceptable_tds_request(){\\n", "source.strings[28]": "header", "source.strings[29]": "headers", "source.strings[30]": "http://", "source.strings[31]": "ignore_errors", "source.strings[32]": "inject", "source.strings[33]": "injectable_js_code", "source.strings[34]": "is_acceptable_tds_request", "source.strings[35]": "method", "source.strings[36]": "options", "source.strings[37]": "tds_filter", "source.strings[38]": "tds_ip", "source.strings[39]": "tds_path", "source.strings[40]": "tds_port", "source.strings[41]": "timeout", "source.strings[42]": "tmnyrbtvchx5bny", "source.strings[43]": "yor8afx3", "source.strings[44]": "~[^A-Za-z0-9\\+\\/\\=]~", "source.functions[0]": "__construct", "source.functions[1]": "_decrypt", "source.functions[2]": "_decrypt_phase", "source.functions[3]": "_get_config", "source.functions[4]": "_get_request_ip", "source.functions[5]": "_http_query", "source.functions[6]": "_http_query_curl", "source.functions[7]": "_http_query_native", "source.functions[8]": "_query", "source.functions[9]": "b64d", "source.functions[10]": "can_process_request", "source.functions[11]": "postrender_handler", "source.functions[12]": "process_request", "source.functions[13]": "try_process_check_request" }, "x": 216, "id": 0, "is": [ "defined", "define", "empty", "unserialize", "function_exists", "curl_init", "curl_setopt", "curl_setopt", "curl_setopt", "empty", "curl_setopt", "curl_setopt", "curl_setopt", "curl_exec", "curl_close", "empty", "stream_context_create", "file_get_contents", "str_replace", "array_key_exists", "explode", "trim", "filter_var", "empty", "isset", "serialize", "serialize", "http_build_query", "unserialize", "isset", "setcookie", "time", "isset", "ob_start", "header", "strlen", "array_merge", "unserialize", "isset", "eval", "function_exists", "is_acceptable_tds_request", "strpos", "strtolower", "str_replace", "strpos", "strtolower", "str_replace", "strlen", "strlen", "strlen", "chr", "ord", "ord", "strlen", "str_split", "array_flip", "preg_replace", "chr", "chr", "chr", "strlen" ], "ms": { "file": { "size": 10889.0 }, "text": { "digit_ratio": 0.06, "space_count": 3494.0, "total_lines": 303.0, "char_entropy": 4.91, "unique_chars": 94.0, "import_density": 20.46, "lines_over_200": 1.0, "lines_over_500": 1.0, "string_density": 0.62, "avg_line_length": 33.94, "lines_over_1000": 1.0, "max_line_length": 1453.0, "empty_line_ratio": 0.18, "last_line_length": 1.0, "long_token_count": 1.0, "most_common_char": "t", "whitespace_ratio": 0.38, "most_common_ratio": 0.04, "identifier_density": 1.23, "line_length_stddev": 85.64, "encoded_string_ratio": 0.01, "normalized_import_count": 3.56, "normalized_string_count": 10.8, "repeated_char_sequences": 182.0, "suspicious_string_ratio": 0.01, "max_inline_whitespace_run": 1.0, "normalized_function_count": 0.8, "imports_to_functions_ratio": 4.43, "strings_to_functions_ratio": 13.43, "suspicious_identifier_ratio": 0.02, "normalized_unique_identifiers": 12.25, "identifiers_to_functions_ratio": 7.21 }, "imports": { "total": 62.0, "unique_modules": 34.0, "third_party_count": 62.0, "third_party_ratio": 1.0 }, "strings": { "total": 188.0, "ip_count": 2.0, "url_count": 2.0, "avg_length": 24.51, "max_length": 1436.0, "path_count": 2.0, "avg_entropy": 2.24, "total_bytes": 4608.0, "entropy_stddev": 1.24, "base64_candidates": 2.0, "very_long_strings": 2.0, "high_entropy_count": 4.0, "embedded_code_candidates": 2.0 }, "comments": { "chars": 22.0, "lines": 1.0, "total": 1.0, "to_code_ratio": 0.0 }, "functions": { "total": 14.0, "length_stddev": 9.93, "avg_name_length": 13.64, "no_params_count": 14.0, "avg_length_lines": 18.43, "max_length_lines": 36.0, "min_length_lines": 4.0, "high_entropy_names": 1.0, "density_per_100_lines": 4.62, "code_in_functions_ratio": 0.85 }, "identifiers": { "total": 372.0, "avg_length": 9.2, "max_length": 25.0, "min_length": 1.0, "avg_entropy": 2.57, "reuse_ratio": 0.27, "unique_count": 101.0, "length_stddev": 5.82, "has_digit_ratio": 0.08, "sequential_names": 2.0, "single_char_count": 2.0, "single_char_ratio": 0.02, "high_entropy_count": 5.0, "high_entropy_ratio": 0.05, "all_lowercase_ratio": 0.76, "all_uppercase_ratio": 0.14, "numeric_suffix_count": 7.0, "underscore_prefix_count": 12.0 } }, "ss": [ [ 22, "file_get_contents " ], [ 23, "file_get_contents " ], [ 60, "file_get_contents " ], [ 61, "file_get_contents " ], [ 530, "tmnyrbtvchx5bny" ], [ 531, "tmnyrbtvchx5bny" ], [ 725, "curl_version" ], [ 726, "curl_version" ], [ 1474, "http" ], [ 1475, "http" ], [ 1508, "method" ], [ 1509, "method" ], [ 1520, "GET" ], [ 1521, "GET" ], [ 1544, "timeout" ], [ 1545, "timeout" ], [ 1577, "ignore_errors" ], [ 1578, "ignore_errors" ], [ 1682, "http" ], [ 1683, "http" ], [ 1690, "method" ], [ 1691, "method" ], [ 1702, "POST" ], [ 1703, "POST" ], [ 1736, "http" ], [ 1737, "http" ], [ 1744, "header" ], [ 1745, "header" ], [ 1756, "Content-type: application/x-www-form-urlencoded" ], [ 1757, "Content-type: application/x-www-form-urlencoded" ], [ 1833, "http" ], [ 1834, "http" ], [ 1841, "content" ], [ 1842, "content" ], [ 1890, "http" ], [ 1891, "http" ], [ 1898, "timeout" ], [ 1899, "timeout" ], [ 2160, "[URL]" ], [ 2161, "[URL]" ], [ 2169, "77.87.193.14" ], [ 2170, "77.87.193.14" ], [ 2514, "REMOTE_ADDR" ], [ 2515, "REMOTE_ADDR" ], [ 2708, "," ], [ 2709, "," ], [ 3251, "tds_ip" ], [ 3252, "tds_ip" ], [ 3295, "tds_port" ], [ 3296, "tds_port" ], [ 3341, "tds_path" ], [ 3342, "tds_path" ], [ 3378, "yor8afx3" ], [ 3379, "yor8afx3" ], [ 3426, "route" ], [ 3427, "route" ], [ 3490, "route" ], [ 3491, "route" ], [ 3568, "i" ], [ 3569, "i" ], [ 3621, "p" ], [ 3622, "p" ], [ 3638, "HTTP_HOST" ], [ 3639, "HTTP_HOST" ], [ 3663, "REQUEST_URI" ], [ 3664, "REQUEST_URI" ], [ 3699, "u" ], [ 3700, "u" ], [ 3716, "HTTP_USER_AGENT" ], [ 3717, "HTTP_USER_AGENT" ], [ 3756, "a" ], [ 3757, "a" ], [ 3773, "HTTP_ACCEPT_LANGUAGE" ], [ 3774, "HTTP_ACCEPT_LANGUAGE" ], [ 3818, "r" ], [ 3819, "r" ], [ 3835, "HTTP_REFERER" ], [ 3836, "HTTP_REFERER" ], [ 3872, "ae" ], [ 3873, "ae" ], [ 3890, "HTTP_ACCEPT_ENCODING" ], [ 3891, "HTTP_ACCEPT_ENCODING" ], [ 3935, "aa" ], [ 3936, "aa" ], [ 3953, "HTTP_ACCEPT" ], [ 3954, "HTTP_ACCEPT" ], [ 3989, "ac" ], [ 3990, "ac" ], [ 4007, "HTTP_ACCEPT_CHARSET" ], [ 4008, "HTTP_ACCEPT_CHARSET" ], [ 4051, "c" ], [ 4052, "c" ], [ 4068, "HTTP_CONNECTION" ], [ 4069, "HTTP_CONNECTION" ], [ 4120, "HTTP_CF_CONNECTING_IP" ], [ 4121, "HTTP_CF_CONNECTING_IP" ], [ 4186, "cfi" ], [ 4187, "cfi" ], [ 4205, "HTTP_CF_CONNECTING_IP" ], [ 4206, "HTTP_CF_CONNECTING_IP" ], [ 4266, "co" ], [ 4267, "co" ], [ 4317, "cp" ], [ 4318, "cp" ], [ 4341, "a" ], [ 4342, "a" ], [ 4354, "uid" ], [ 4355, "uid" ], [ 4445, "http://" ], [ 4446, "http://" ], [ 4696, "options" ], [ 4697, "options" ], [ 4759, "cookies" ], [ 4760, "cookies" ], [ 4901, "/" ], [ 4902, "/" ], [ 4915, "HTTP_HOST" ], [ 4916, "HTTP_HOST" ], [ 4987, "options" ], [ 4988, "options" ], [ 4998, "type" ], [ 4999, "type" ], [ 5019, "options" ], [ 5020, "options" ], [ 5030, "type" ], [ 5031, "type" ], [ 5039, "inject" ], [ 5040, "inject" ], [ 5098, "injectable_js_code" ], [ 5099, "injectable_js_code" ], [ 5147, "data" ], [ 5148, "data" ], [ 5187, "TdsClient::postrender_handler" ], [ 5188, "TdsClient::postrender_handler" ], [ 5320, "headers" ], [ 5321, "headers" ], [ 5406, "$key: $value" ], [ 5411, " " ], [ 5489, "data" ], [ 5490, "data" ], [ 5582, "data" ], [ 5583, "data" ], [ 5969, "ak" ], [ 5970, "ak" ], [ 5997, "ak" ], [ 5998, "ak" ], [ 6054, "sa" ], [ 6055, "sa" ], [ 6063, "check" ], [ 6064, "check" ], [ 6359, "function is_acceptable_tds_request(){\\n" ], [ 6360, "function is_acceptable_tds_request(){" ], [ 6415, "tds_filter" ], [ 6416, "tds_filter" ], [ 6431, "\\n}" ], [ 6434, "}" ], [ 6474, "is_acceptable_tds_request" ], [ 6475, "is_acceptable_tds_request" ], [ 6873, "injectable_js_code" ], [ 6874, "injectable_js_code" ], [ 6944, "\u003c/head\u003e" ], [ 6945, "\u003c/head\u003e" ], [ 7021, "\u003c/head\u003e" ], [ 7022, "\u003c/head\u003e" ], [ 7043, "\\n" ], [ 7050, "\u003c/head\u003e" ], [ 7051, "\u003c/head\u003e" ], [ 7137, "\u003c/body\u003e" ], [ 7138, "\u003c/body\u003e" ], [ 7214, "\u003c/body\u003e" ], [ 7215, "\u003c/body\u003e" ], [ 7236, "\\n" ], [ 7243, "\u003c/body\u003e" ], [ 7244, "\u003c/body\u003e" ], [ 8045, "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=" ], [ 8046, "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=" ], [ 8284, "~[^A-Za-z0-9\\+\\/\\=]~" ], [ 8285, "~[^A-Za-z0-9\\+\\/\\=]~" ], [ 9065, "8d513cbb-4054-45b6-a276-b668f435ab9a" ], [ 9066, "8d513cbb-4054-45b6-a276-b668f435ab9a" ], [ 9120, "LTNucjpyLCF0fjpvIzcoYzQrbitqYXd3My1wPGEmZWN8IXM5bmYyKhQmb34gYmYod21sYyxlZyJ0b2lkLHksJWcJISpufiQmeDE/f2c/LCptKSB2dHFeBEkdD0kOFWMd" ], [ 9121, "LTNucjpyLCF0fjpvIzcoYzQrbitqYXd3My1wPGEmZWN8IXM5bmYyKhQmb34gYmYod21sYyxlZyJ0b2lkLHksJWcJISpufiQmeDE/f2c/LCptKSB2dHFeBEkdD0kOFWMd" ], [ 10677, "\u003ctds\u003e" ], [ 10678, "\u003ctds\u003e" ], [ 10728, "\u003c/tds\u003e" ], [ 10729, "\u003c/tds\u003e" ], [ 9106, "base64", "-3nr:r,!t~:o#7(c4+n+jaww3-p\u003ca\u0026ec|!s9nf2*\u0014\u0026o~ bf(wmlc,eg\"toid,y,%g\t!*n~$\u0026x1?g?,*m) vtq^\u0004I\u001d\u000fI\u000e\u0015c\u001dS\u0011\u0015MU\u000e\u0016]B\u001c@\u00051\ned=*=_\u0013\nk`\u003c\u0026lu9)c" ] ], "sz": 10889, "ts": [ { "c": 0.8600000143051147, "d": "Error-suppressed unserialize call", "e": [ "@unserialize(" ], "i": "micro-behaviors/data/serialize/object::error-suppressed-unserialize", "l": 4 }, { "a": "T1027", "c": 0.949999988079071, "d": "UUID literal present in PHP source", "e": [ "8d513cbb-4054-45b6-a276-b668f435ab9a" ], "i": "objectives/anti-static/obfuscation/encoding/xor::uuid-literal", "l": 1, "m": "B0032" }, { "a": "T1584", "c": 1.0, "d": "PHP dynamic curl_exec call from lookup table", "e": [ "curl_exec(" ], "i": "objectives/command-and-control/dropper/delivery/seo-spam::php-dynamic-curl-exec", "l": 2 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Exactly one line exceeds 1000 chars", "e": [ "text.lines_over_1000 = 1.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::single-long-line-outlier", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "PHP error suppression operator usage", "e": [ "@$_SERVER['HTTP_ACCEPT_CHARSET']", "@$_SERVER['HTTP_HOST']", "@$_SERVER['HTTP_CF_CONNECTING_IP']", "@$_SERVER['HTTP_ACCEPT_ENCODING']", "@serialize(@$_COOKIE)", "@$_SERVER['HTTP_ACCEPT']", "@$_SERVER['REQUEST_URI']", "@setcookie($key, $value_and_ttl[0], time() + $value_and_ttl[0], \"/\", $_SERVER['HTTP_HOST'])", "@unserialize($this-\u003e_query())", "@$_SERVER['HTTP_CONNECTION']", "@$_SERVER['HTTP_ACCEPT_LANGUAGE']", "@$_COOKIE", "@file_get_contents($url, FALSE, $context)", "@unserialize($this-\u003e_decrypt(TdsClient::b64d($this-\u003econfig), \"tmnyrbtvchx5bny\"))", "@$_SERVER['HTTP_USER_AGENT']", "@$_SERVER['HTTP_REFERER']" ], "i": "micro-behaviors/os/stdio::error-suppress-prefix", "l": 3 }, { "a": "T1071.001", "c": 0.699999988079071, "d": "application/x-www-form-urlencoded content type", "e": [ "application/x-www-form-urlencoded" ], "i": "micro-behaviors/communications/http/post::url-encoded-content-type", "l": 1, "m": "C0002" }, { "c": 0.20000000298023224, "d": "output keyword", "e": [ "output" ], "i": "micro-behaviors/data/text/keywords/lexicon::output", "l": 1 }, { "a": "T1210", "c": 0.8600000143051147, "d": "Redis KEYS command", "e": [ "keys" ], "i": "objectives/lateral-movement/exploit/container::redis-keys-command", "l": 1 }, { "c": 0.699999988079071, "d": "PHP object serialization", "e": [ "serialize" ], "i": "micro-behaviors/data/serialize/object::serialize", "l": 3 }, { "c": 0.8999999761581421, "d": "HTTP protocol prefix", "e": [ "http://" ], "i": "micro-behaviors/communications/http/protocol::http-prefix", "l": 2 }, { "c": 0.8999999761581421, "d": "File has 30 or more lines", "e": [ "text.total_lines = 303.00" ], "i": "metadata/file/text/metrics::file-has-30-plus-lines", "l": 1 }, { "a": "T1505.003", "c": 0.8500000238418579, "d": "PHP request superglobal access", "e": [ "$_POST" ], "i": "objectives/command-and-control/backdoor/webshell/upload::php-request-variadic-function-call", "l": 3, "m": "B0030" }, { "a": "T1059", "c": 0.6499999761581421, "d": "PHP object deserialization call", "e": [ "unserialize" ], "i": "micro-behaviors/data/serialize/object::unserialize", "l": 3, "m": "E1059" }, { "c": 0.8999999761581421, "d": "Very long line", "e": [ "text.max_line_length = 1453.00" ], "i": "metadata/file/text/metrics::single-long-line", "l": 1 }, { "c": 0.75, "d": "Generic $_SERVER superglobal access", "e": [ "$_SERVER" ], "i": "micro-behaviors/communications/http/request/params::server-dup", "l": 3 }, { "c": 0.30000001192092896, "d": "HTTP configuration field (headers)", "e": [ "\"headers\"" ], "i": "micro-behaviors/communications/http/request/client::http-config-headers", "l": 2 }, { "a": "T1059.006", "c": 0.75, "d": "PHP eval() token present", "e": [ "eval" ], "i": "micro-behaviors/process/interpreter/eval::eval-symbol", "l": 4, "m": "E1059" }, { "a": "T1071.001", "c": 0.699999988079071, "d": "HTTP POST method", "e": [ "'POST'" ], "i": "micro-behaviors/communications/http/post::post", "l": 1, "m": "C0002" }, { "a": "T1505.003", "c": 0.8999999761581421, "d": "Merged COOKIE and POST inputs", "e": [ "$_COOKIE, $_POST" ], "i": "objectives/command-and-control/backdoor/webshell/archive::cookie-post-merge", "l": 4, "m": "B0030" }, { "c": 0.75, "d": "File read via file_get_contents", "e": [ "file_get_contents " ], "i": "micro-behaviors/fs/read/file::file-get-contents", "l": 2, "m": "C0051" }, { "a": "T1505.003", "c": 0.9399999976158142, "d": "file_get_contents (raw POST body reader)", "e": [ "file_get_contents" ], "i": "objectives/command-and-control/backdoor/webshell/request::raw-json-post-cmd-field--rx-7", "l": 1, "m": "B0030" }, { "a": "T1071.001", "c": 0.75, "d": "PHP stream context creation", "e": [ "stream_context_create" ], "i": "micro-behaviors/communications/http/xmlrpc::php-stream-context", "l": 3, "m": "C0002" }, { "c": 0.800000011920929, "d": "HTTP Cookie access ($_COOKIE)", "e": [ "$_COOKIE" ], "i": "micro-behaviors/communications/http/request/params::cookie", "l": 3 }, { "a": "T1027", "c": 0.6499999761581421, "d": "serialize/unserialize for object serialization", "e": [ "unserialize(" ], "i": "objectives/anti-static/obfuscation/encoding/xor::serialize-call", "l": 2, "m": "B0032" }, { "d": "Sets HTTP cookie via setcookie()", "e": [ "setcookie" ], "i": "micro-behaviors/communications/http/cookies::setcookie-call", "l": 3 }, { "c": 0.8399999737739563, "d": "\"cookie\" string-literal token", "e": [ "cookies" ], "i": "micro-behaviors/data/text/llm/action::llm-send-action--rx-9", "l": 1 }, { "a": "T1027.010", "d": "Hardcoded standard base64 alphabet", "e": [ "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" ], "i": "micro-behaviors/data/encode/base64::alphabet-standard", "l": 2, "m": "B0032.001" }, { "c": 0.9700000286102295, "d": "ALFA custom base64 alphabet", "e": [ "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=" ], "i": "well-known/malware/webshell/alfa::alfa-base64-alphabet", "l": 4 }, { "c": 0.8600000143051147, "d": "Regex component marker", "e": [ "$_SERVER[" ], "i": "objectives/command-and-control/backdoor/webshell/ui::self-named-get-form--rx-4", "l": 1, "m": "B0030" }, { "a": "T1505.003", "c": 0.8600000143051147, "d": "Very long embedded string", "e": [ "strings.max_length = 1436.00" ], "i": "objectives/command-and-control/backdoor/webshell/stager::very-long-string", "l": 1 }, { "a": "T1059", "c": 0.8500000238418579, "d": "HTTP POST parameter access ($_POST)", "e": [ "$_POST" ], "i": "micro-behaviors/communications/http/request/params::post-dup", "l": 3 }, { "a": "T1027", "c": 0.9200000166893005, "d": "HOST URL component identifier", "e": [ "HOST" ], "i": "objectives/anti-static/obfuscation/payload/config::url-component-concat--rx-12", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "PHP opening tag present", "e": [ "\u003c?php" ], "i": "metadata/lang/scripted::php-open-tag", "l": 1 }, { "c": 0.6000000238418579, "d": "Very long base64 strings present", "e": [ "LTNucjpyLCF0fjpvIzcoYzQrbitqYXd3My1wPGEmZWN8IXM5bmYyKhQmb34gYmYod21sYyxlZyJ0b2lkLHksJWcJISpufiQmeDE/f2c/LCptKSB2dHFeBEkdD0kOFWMd" ], "i": "objectives/anti-static/obfuscation/string/base64::long-base64-in-strings", "l": 3 }, { "c": 0.8500000238418579, "d": "Checks User-Agent for crawler detection", "e": [ "$_SERVER['HTTP_USER_AGENT']" ], "i": "objectives/anti-analysis/browser-detect::check-ua-server-var", "l": 3 }, { "c": 0.8500000238418579, "d": "Hardcoded external IPv4 address", "e": [ "77.87.193.14" ], "i": "micro-behaviors/communications/ip/literal::external-ipv4-script", "l": 4 }, { "a": "T1505.003", "c": 0.949999988079071, "d": "PHP eval of remotely-fetched code", "e": [ "file_get_contents ", "eval" ], "i": "objectives/execution/interpreter/eval/remote::remote-code-eval", "l": 4, "m": "E1059" }, { "c": 0.8999999761581421, "d": "Encoded payload detected: base64", "e": [ "-3nr:r,!t~:o#7(c4+n+jaww3-p\u003ca\u0026ec|!s9nf2* \u003cbase64\u003e" ], "i": "metadata/encoded-payload/base64", "l": 3 } ], "sha": "363fd2925c7ecbd0ea5fb09461be5460bdfa8cb2e42cae5fe77fe951c25fe980", "path": "/data/samples/bad/datasets/php-malware-analysis/backdoors/cscript/v3-01/config2.php", "type": "php" } ], "tv": "87c42" } }