{ "ml": { "l": 0, "v": "6", "fs": [ { "l": 0, "id": 0, "prob": 0.9964538812637329 } ], "prob": 0.9964539, "models": [ { "m": "az", "raw": 0.9252977, "prob": 0.9252977, "class": 0 }, { "m": "az/source", "raw": 0.9964539, "prob": 0.9964539, "class": 2 }, { "m": "az/c", "raw": 0.99338746, "prob": 0.99338746, "class": 0 } ], "version": "v17.17", "analyzed_at": "2026-06-08T07:52:08Z" }, "path": "main.c.save", "raw": { "v": "6", "fs": [ { "f": "O(C₂)", "x": 39, "ff": { "i": [ [ "", "strlen" ], [ "", "strlen" ], [ "", "malloc" ], [ "", "printf" ], [ "", "printf" ], [ "", "printf" ], [ "", "printf" ], [ "", "printf" ], [ "", "printf" ], [ "", "printf" ], [ "", "gets" ], [ "", "printf" ], [ "", "fopen" ], [ "", "fprintf" ], [ "", "fprintf" ], [ "", "fprintf" ], [ "", "fprintf" ], [ "", "fprintf" ], [ "", "Encode_Decode" ], [ "", "Encode_Decode" ], [ "", "Encode_Decode" ], [ "", "Encode_Decode" ], [ "", "Encode_Decode" ], [ "", "Encode_Decode" ], [ "", "Encode_Decode" ], [ "", "Encode_Decode" ], [ "", "Encode_Decode" ], [ "", "Encode_Decode" ], [ "", "Encode_Decode" ], [ "", "Encode_Decode" ], [ "", "Encode_Decode" ], [ "", "Encode_Decode" ], [ "", "Encode_Decode" ], [ "", "Encode_Decode" ], [ "", "Reverse_Str" ], [ "", "Reverse_Str" ], [ "", "Reverse_Str" ], [ "", "Reverse_Str" ], [ "", "Reverse_Str" ], [ "", "Reverse_Str" ], [ "", "Reverse_Str" ], [ "", "Reverse_Str" ], [ "", "Reverse_Str" ], [ "", "Reverse_Str" ], [ "", "Reverse_Str" ], [ "", "Reverse_Str" ], [ "", "Reverse_Str" ], [ "", "Reverse_Str" ], [ "", "Reverse_Str" ], [ "", "Reverse_Str" ], [ "", "Reverse_Str" ], [ "", "Reverse_Str" ], [ "", "Reverse_Str" ], [ "", "Reverse_Str" ], [ "", "fprintf" ], [ "", "fprintf" ], [ "", "fprintf" ], [ "", "fprintf" ], [ "", "fprintf" ], [ "", "fprintf" ], [ "", "fprintf" ], [ "", "fprintf" ], [ "", "fprintf" ], [ "", "fprintf" ], [ "", "fprintf" ], [ "", "fprintf" ], [ "", "fprintf" ], [ "", "fprintf" ], [ "", "fprintf" ], [ "", "fprintf" ], [ "", "fprintf" ], [ "", "fprintf" ], [ "", "fprintf" ], [ "", "fprintf" ], [ "", "fprintf" ], [ "", "fprintf" ], [ "", "fprintf" ], [ "", "fprintf" ], [ "", "fprintf" ], [ "", "fprintf" ], [ "", "fprintf" ], [ "", "fclose" ], [ "", "\u003cstdio.h\u003e" ], [ "", "\u003cstdlib.h\u003e" ], [ "", "\u003cstring.h\u003e" ], [ "", "\u003ctchar.h\u003e" ], [ "", "\u003cwindows.h\u003e" ] ], "m": { "ast": { "op.eq": 1.0, "op.ge": 1.0, "op.lt": 2.0, "op.ne": 1.0, "op.add": 1.0, "op.mul": 2.0, "op.sub": 3.0, "op.xor": 1.0, "op.band": 2.0, "op.bnot": 1.0, "max_depth": 10.0, "bind_count": 42.0, "call_count": 98.0, "node_count": 2461.0, "op_density.eq": 0.0, "op_density.ge": 0.0, "op_density.lt": 0.0, "op_density.ne": 0.0, "op_density.add": 0.0, "op_density.mul": 0.0, "op_density.sub": 0.0, "op_density.xor": 0.0, "op_density.band": 0.0, "op_density.bnot": 0.0, "identifier_count": 96.0, "string_literal_count": 93.0, "string_concat_chain_max_length": 2.0 }, "file": { "size": 9507.0, "entropy": 4.91, "size_bytes": 9507.0 }, "text": { "tab_count": 12.0, "digit_ratio": 0.05, "space_count": 2495.0, "total_lines": 227.0, "char_entropy": 4.91, "mixed_indent": 1.0, "unique_chars": 89.0, "escape_density": 0.02, "string_density": 0.41, "ascii_art_lines": 1.0, "avg_line_length": 39.88, "max_line_length": 159.0, "empty_line_ratio": 0.18, "last_line_length": 1.0, "long_token_count": 1.0, "whitespace_ratio": 0.31, "most_common_ratio": 0.04, "identifier_density": 1.76, "line_length_stddev": 30.69, "octal_escape_count": 2.0, "normalized_string_count": 6.17, "repeated_char_sequences": 62.0, "suspicious_string_ratio": 0.01, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 32.0, "trailing_whitespace_lines": 3.0, "most_common_char_codepoint": 101.0, "suspicious_identifier_ratio": 0.02, "normalized_unique_identifiers": 12.27 }, "binds": { "count": 42.0 }, "calls": { "count": 98.0 }, "binary": { "overall_entropy": 4.91 }, "source": { "function_count": 3.0 }, "imports": { "count": 5.0, "unique_modules": 5.0, "third_party_count": 5.0, "third_party_ratio": 1.0 }, "strings": { "total": 93.0, "avg_length": 26.42, "max_length": 83.0, "path_count": 7.0, "avg_entropy": 3.0, "total_bytes": 2457.0, "entropy_stddev": 0.95, "shell_command_strings": 1.0 }, "comments": { "chars": 115.0, "lines": 5.0, "total": 5.0, "to_code_ratio": 0.02 }, "functions": { "count": 3.0 }, "consistency": { "extension_content_mismatch": 1.0, "extension_content_mismatch.source_as_unknown": 1.0 }, "identifiers": { "count": 96.0, "total": 400.0, "avg_length": 8.75, "max_length": 19.0, "min_length": 1.0, "avg_entropy": 2.71, "reuse_ratio": 0.24, "unique_count": 96.0, "length_stddev": 3.76, "has_digit_ratio": 0.43, "sequential_names": 2.0, "single_char_count": 2.0, "single_char_ratio": 0.02, "high_entropy_count": 5.0, "high_entropy_ratio": 0.05, "all_lowercase_ratio": 0.42, "all_uppercase_ratio": 0.01, "numeric_suffix_count": 39.0 } }, "s": [ [ 9, "u8", "\u003cstdio.h\u003e" ], [ 29, "u8", "\u003cwindows.h\u003e" ], [ 51, "u8", "\u003cstring.h\u003e" ], [ 72, "u8", "\u003cstdlib.h\u003e" ], [ 93, "u8", "\u003ctchar.h\u003e" ], [ 206, "10", "0" ], [ 250, "10", "0" ], [ 540, "10", "0" ], [ 608, "10", "1" ], [ 630, "10", "1" ], [ 636, "10", "0" ], [ 663, "10", "1" ], [ 745, "10", "256" ], [ 762, "u8", "\\n _ " ], [ 765, "u8", " _ " ], [ 828, "u8", "\\n | | " ], [ 831, "u8", " | | " ], [ 894, "u8", "\\n _ __ __ _ _ __ ___ ___ | | ___ ___ ___ " ], [ 897, "u8", " _ __ __ _ _ __ ___ ___ | | ___ ___ ___ " ], [ 960, "u8", "\\n| '_ \\\\ / _` || '_ ` _ \\\\ / _ \\\\| | / _ \\\\/ __|/ __|" ], [ 963, "u8", "| '_ " ], [ 970, "u8", " / _` || '_ ` _ " ], [ 989, "u8", " / _ " ], [ 997, "u8", "| | / _ " ], [ 1007, "u8", "/ __|/ __|" ], [ 1030, "u8", "\\n| | | || (_| || | | | | || __/| || __/\\__ \\\\__ \\\\" ], [ 1033, "u8", "| | | || (_| || | | | | || __/| || __/" ], [ 1075, "u8", "_ " ], [ 1079, "u8", "__ " ], [ 1097, "u8", "\\n|_| |_| \\\\__,_||_| |_| |_| \\\\___||_| \\\\__||___/|__/" ], [ 1100, "u8", "|_| |_| " ], [ 1110, "u8", "__,_||_| |_| |_| " ], [ 1129, "u8", "___||_| " ], [ 1139, "u8", "__||___/|__/" ], [ 1169, "u8", "\\n\\n What password/key would you like to use?\\n" ], [ 1174, "u8", " What password/key would you like to use?" ], [ 1259, "u8", "\\n \r\n scanf" ], [ 1259, "u8", "\\n \r" ], [ 1262, "u8", " \r" ], [ 1303, "u8", "%c %c" ], [ 1304, "u8", "%c %c" ], [ 1422, "u8", "main.recon" ], [ 1423, "u8", "main.recon" ], [ 1492, "u8", "main.removal" ], [ 1493, "u8", "main.removal" ], [ 1565, "u8", "main.join" ], [ 1566, "u8", "main.join" ], [ 1632, "u8", "main.part" ], [ 1633, "u8", "main.part" ], [ 1717, "u8", "NICK" ], [ 1718, "u8", "NICK" ], [ 1763, "u8", "USER" ], [ 1764, "u8", "USER" ], [ 1809, "u8", "PRIVMSG" ], [ 1810, "u8", "PRIVMSG" ], [ 1858, "u8", "NOTICE" ], [ 1859, "u8", "NOTICE" ], [ 1906, "u8", "PASS" ], [ 1907, "u8", "PASS" ], [ 1952, "u8", "JOIN" ], [ 1953, "u8", "JOIN" ], [ 1998, "u8", "PART" ], [ 1999, "u8", "PART" ], [ 2044, "u8", "QUIT" ], [ 2045, "u8", "QUIT" ], [ 2090, "u8", "PING" ], [ 2091, "u8", "PING" ], [ 2136, "u8", "PONG" ], [ 2137, "u8", "PONG" ], [ 2182, "u8", "443" ], [ 2183, "u8", "443" ], [ 2227, "u8", "332" ], [ 2228, "u8", "332" ], [ 2294, "u8", "shell32.dll" ], [ 2295, "u8", "shell32.dll" ], [ 2344, "u8", "ShellExecuteA" ], [ 2345, "u8", "ShellExecuteA" ], [ 2422, "u8", "Advapi32.dll" ], [ 2423, "u8", "Advapi32.dll" ], [ 2473, "u8", "RegCreateKeyExA" ], [ 2474, "u8", "RegCreateKeyExA" ], [ 2527, "u8", "RegSetValueExA" ], [ 2528, "u8", "RegSetValueExA" ], [ 2580, "u8", "RegCloseKey" ], [ 2581, "u8", "RegCloseKey" ], [ 2653, "u8", "WS2_32.dll" ], [ 2654, "u8", "WS2_32.dll" ], [ 2701, "u8", "WSACleanup" ], [ 2702, "u8", "WSACleanup" ], [ 2749, "u8", "WSAStartup" ], [ 2750, "u8", "WSAStartup" ], [ 2797, "u8", "closesocket" ], [ 2798, "u8", "closesocket" ], [ 2846, "u8", "connect" ], [ 2847, "u8", "connect" ], [ 2891, "u8", "gethostbyname" ], [ 2892, "u8", "gethostbyname" ], [ 2942, "u8", "htons" ], [ 2943, "u8", "htons" ], [ 2985, "u8", "recv" ], [ 2986, "u8", "recv" ], [ 3027, "u8", "send" ], [ 3028, "u8", "send" ], [ 3069, "u8", "socket" ], [ 3070, "u8", "socket" ], [ 3113, "u8", "inet_addr" ], [ 3114, "u8", "inet_addr" ], [ 3160, "u8", "select" ], [ 3161, "u8", "select" ], [ 3227, "u8", "urlmon.dll" ], [ 3228, "u8", "urlmon.dll" ], [ 3275, "u8", "URLDownloadToFileA" ], [ 3276, "u8", "URLDownloadToFileA" ], [ 3865, "u8", "encrypted_strings.txt" ], [ 3866, "u8", "encrypted_strings.txt" ], [ 3890, "u8", "w" ], [ 3891, "u8", "w" ], [ 3947, "u8", "********NOTE********\\n" ], [ 3948, "u8", "********NOTE********" ], [ 3995, "u8", "*MAKE SURE YOU COPY + PASTE \\nTHIS TO THE TOP OF\\nTHE \\\"cryptn.c\\\" FILE!!! -Carve\\n" ], [ 3996, "u8", "*MAKE SURE YOU COPY + PASTE " ], [ 4026, "u8", "THIS TO THE TOP OF" ], [ 4046, "u8", "THE " ], [ 4052, "u8", "cryptn.c" ], [ 4062, "u8", " FILE!!! -Carve" ], [ 4104, "u8", "********NOTE********\\n\\n\\n" ], [ 4105, "u8", "********NOTE********" ], [ 4185, "u8", "/* ENCRYPTION KEY */\\n" ], [ 4186, "u8", "/* ENCRYPTION KEY */" ], [ 4233, "u8", "char decode_pass[] = \\\"%s\\\";\\n\\n" ], [ 4234, "u8", "char decode_pass[] = " ], [ 4257, "u8", "%s" ], [ 4261, "u8", ";" ], [ 6188, "u8", "/* COMMANDS */\\n" ], [ 6189, "u8", "/* COMMANDS */" ], [ 6230, "u8", "char cmd__RECONNECT[] = \\\"%s\\\"; /* main.recon */\\n" ], [ 6231, "u8", "char cmd__RECONNECT[] = " ], [ 6263, "u8", "%s" ], [ 6267, "u8", "; /* main.recon */" ], [ 6337, "u8", "char cmd__REMOVAL[] = \\\"%s\\\"; /* main.removal */\\n" ], [ 6338, "u8", "char cmd__REMOVAL[] = " ], [ 6370, "u8", "%s" ], [ 6374, "u8", "; /* main.removal */" ], [ 6442, "u8", "char cmd__JOIN[] = \\\"%s\\\"; /* main.join */\\n" ], [ 6443, "u8", "char cmd__JOIN[] = " ], [ 6475, "u8", "%s" ], [ 6479, "u8", "; /* main.join */" ], [ 6544, "u8", "char cmd__PART[] = \\\"%s\\\"; /* main.part */\\n" ], [ 6545, "u8", "char cmd__PART[] = " ], [ 6577, "u8", "%s" ], [ 6581, "u8", "; /* main.part */" ], [ 6648, "u8", "/* IRC */\\n" ], [ 6649, "u8", "/* IRC */" ], [ 6685, "u8", "char my_nick[] = \\\"%s\\\";\\n" ], [ 6686, "u8", "char my_nick[] = " ], [ 6718, "u8", "%s" ], [ 6722, "u8", ";" ], [ 6766, "u8", "char my_user[] = \\\"%s\\\";\\n" ], [ 6767, "u8", "char my_user[] = " ], [ 6799, "u8", "%s" ], [ 6803, "u8", ";" ], [ 6845, "u8", "char my_privmsg[] = \\\"%s\\\";\\n" ], [ 6846, "u8", "char my_privmsg[] = " ], [ 6878, "u8", "%s" ], [ 6882, "u8", ";" ], [ 6924, "u8", "char my_notice[] = \\\"%s\\\";\\n" ], [ 6925, "u8", "char my_notice[] = " ], [ 6957, "u8", "%s" ], [ 6961, "u8", ";" ], [ 7003, "u8", "char my_pass[] = \\\"%s\\\";\\n" ], [ 7004, "u8", "char my_pass[] = " ], [ 7036, "u8", "%s" ], [ 7040, "u8", ";" ], [ 7082, "u8", "char my_join[] = \\\"%s\\\";\\n" ], [ 7083, "u8", "char my_join[] = " ], [ 7115, "u8", "%s" ], [ 7119, "u8", ";" ], [ 7161, "u8", "char my_part[] = \\\"%s\\\";\\n" ], [ 7162, "u8", "char my_part[] = " ], [ 7194, "u8", "%s" ], [ 7198, "u8", ";" ], [ 7240, "u8", "char my_quit[] = \\\"%s\\\";\\n" ], [ 7241, "u8", "char my_quit[] = " ], [ 7273, "u8", "%s" ], [ 7277, "u8", ";" ], [ 7319, "u8", "char my_P1N6[] = \\\"%s\\\";\\n" ], [ 7320, "u8", "char my_P1N6[] = " ], [ 7352, "u8", "%s" ], [ 7356, "u8", ";" ], [ 7398, "u8", "char my_P0N6[] = \\\"%s\\\";\\n" ], [ 7399, "u8", "char my_P0N6[] = " ], [ 7431, "u8", "%s" ], [ 7435, "u8", ";" ], [ 7477, "u8", "char my_4_4_3[] = \\\"%s\\\";\\n" ], [ 7478, "u8", "char my_4_4_3[] = " ], [ 7510, "u8", "%s" ], [ 7514, "u8", ";" ], [ 7560, "u8", "char my_3_3_2[] = \\\"%s\\\";\\n\\n" ], [ 7561, "u8", "char my_3_3_2[] = " ], [ 7593, "u8", "%s" ], [ 7597, "u8", ";" ], [ 7647, "u8", "/* Shell32.dll */\\n" ], [ 7648, "u8", "/* Shell32.dll */" ], [ 7692, "u8", "char shell32_[] = \\\"%s\\\";\\n" ], [ 7693, "u8", "char shell32_[] = " ], [ 7726, "u8", "%s" ], [ 7730, "u8", ";" ], [ 7769, "u8", "char ShellExecute_[] = \\\"%s\\\";\\n\\n" ], [ 7770, "u8", "char ShellExecute_[] = " ], [ 7803, "u8", "%s" ], [ 7807, "u8", ";" ], [ 7855, "u8", "/* Advapi32.dll */\\n" ], [ 7856, "u8", "/* Advapi32.dll */" ], [ 7901, "u8", "char advapi32_[] = \\\"%s\\\";\\n" ], [ 7902, "u8", "char advapi32_[] = " ], [ 7935, "u8", "%s" ], [ 7939, "u8", ";" ], [ 7979, "u8", "char RegCreateKeyEx_[] = \\\"%s\\\";\\n" ], [ 7980, "u8", "char RegCreateKeyEx_[] = " ], [ 8013, "u8", "%s" ], [ 8017, "u8", ";" ], [ 8063, "u8", "char RegSetValueEx_[] = \\\"%s\\\";\\n" ], [ 8064, "u8", "char RegSetValueEx_[] = " ], [ 8097, "u8", "%s" ], [ 8101, "u8", ";" ], [ 8146, "u8", "char RegCloseKey_[] = \\\"%s\\\";\\n\\n" ], [ 8147, "u8", "char RegCloseKey_[] = " ], [ 8180, "u8", "%s" ], [ 8184, "u8", ";" ], [ 8233, "u8", "/* WS2_32.DLL */\\n" ], [ 8234, "u8", "/* WS2_32.DLL */" ], [ 8277, "u8", "char WS2_32_[] = \\\"%s\\\";\\n" ], [ 8278, "u8", "char WS2_32_[] = " ], [ 8310, "u8", "%s" ], [ 8314, "u8", ";" ], [ 8357, "u8", "char WSACleanup_[] = \\\"%s\\\";\\n" ], [ 8358, "u8", "char WSACleanup_[] = " ], [ 8390, "u8", "%s" ], [ 8394, "u8", ";" ], [ 8441, "u8", "char WSAStartup_[] = \\\"%s\\\";\\n" ], [ 8442, "u8", "char WSAStartup_[] = " ], [ 8474, "u8", "%s" ], [ 8478, "u8", ";" ], [ 8525, "u8", "char closesocket_[] = \\\"%s\\\";\\n" ], [ 8526, "u8", "char closesocket_[] = " ], [ 8558, "u8", "%s" ], [ 8562, "u8", ";" ], [ 8610, "u8", "char connect_[] = \\\"%s\\\";\\n" ], [ 8611, "u8", "char connect_[] = " ], [ 8643, "u8", "%s" ], [ 8647, "u8", ";" ], [ 8691, "u8", "char gethostbyname_[] = \\\"%s\\\";\\n" ], [ 8692, "u8", "char gethostbyname_[] = " ], [ 8724, "u8", "%s" ], [ 8728, "u8", ";" ], [ 8778, "u8", "char htons_[] = \\\"%s\\\";\\n" ] ], "v": { "file.stem": "main.c", "file.basename": "main.c.save", "source.language": "c", "source.imports[0]": "\u003cstdio.h\u003e", "source.imports[1]": "\u003cstdlib.h\u003e", "source.imports[2]": "\u003cstring.h\u003e", "source.imports[3]": "\u003ctchar.h\u003e", "source.imports[4]": "\u003cwindows.h\u003e", "source.imports[5]": "Encode_Decode", "source.imports[6]": "Reverse_Str", "source.imports[7]": "fclose", "source.imports[8]": "fopen", "source.imports[9]": "fprintf", "source.strings[0]": " \r", "source.strings[1]": " _ ", "source.strings[2]": " | | ", "source.strings[3]": " What password/key would you like to use?", "source.strings[4]": " / _ ", "source.strings[5]": " / _` || '_ ` _ ", "source.strings[6]": " FILE!!! -Carve", "source.strings[7]": " _ __ __ _ _ __ ___ ___ | | ___ ___ ___ ", "source.strings[8]": "********NOTE********", "source.strings[9]": "********NOTE********\\n", "source.has_imports": true, "source.imports[10]": "gets", "source.imports[11]": "malloc", "source.imports[12]": "printf", "source.imports[13]": "strlen", "source.strings[10]": "********NOTE********\\n\\n\\n", "source.strings[11]": "*MAKE SURE YOU COPY + PASTE ", "source.strings[12]": "*MAKE SURE YOU COPY + PASTE \\nTHIS TO THE TOP OF\\nTHE \\\"cryptn.c\\\" FILE!!! -Carve\\n", "source.strings[13]": "/ __|/ __|", "source.strings[14]": "/* Advapi32.dll */", "source.strings[15]": "/* Advapi32.dll */\\n", "source.strings[16]": "/* COMMANDS */", "source.strings[17]": "/* COMMANDS */\\n", "source.strings[18]": "/* ENCRYPTION KEY */", "source.strings[19]": "/* ENCRYPTION KEY */\\n", "source.strings[20]": "/* IRC */", "source.strings[21]": "/* IRC */\\n", "source.strings[22]": "/* Shell32.dll */", "source.strings[23]": "/* Shell32.dll */\\n", "source.strings[24]": "/* WS2_32.DLL */", "source.strings[25]": "/* WS2_32.DLL */\\n", "source.strings[26]": "/*UrlMon.DLL */", "source.strings[27]": "/*UrlMon.DLL */\\n", "source.strings[28]": "; /* main.join */", "source.strings[29]": "; /* main.part */", "source.strings[30]": "; /* main.recon */", "source.strings[31]": "; /* main.removal */", "source.strings[32]": "\u003cstdio.h\u003e", "source.strings[33]": "\u003cstdlib.h\u003e", "source.strings[34]": "\u003cstring.h\u003e", "source.strings[35]": "\u003ctchar.h\u003e", "source.strings[36]": "\u003cwindows.h\u003e", "source.strings[37]": "Advapi32.dll", "source.strings[38]": "NOTICE", "source.strings[39]": "PRIVMSG", "source.strings[40]": "RegCloseKey", "source.strings[41]": "RegCreateKeyExA", "source.strings[42]": "RegSetValueExA", "source.strings[43]": "ShellExecuteA", "source.strings[44]": "THIS TO THE TOP OF", "source.strings[45]": "URLDownloadToFileA", "source.strings[46]": "WS2_32.dll", "source.strings[47]": "WSACleanup", "source.strings[48]": "WSAStartup", "source.strings[49]": "\\n \r", "source.strings[50]": "\\n \r\n scanf", "source.strings[51]": "\\n _ ", "source.strings[52]": "\\n | | ", "source.strings[53]": "\\n _ __ __ _ _ __ ___ ___ | | ___ ___ ___ ", "source.strings[54]": "\\n\\n What password/key would you like to use?\\n", "source.strings[55]": "\\n| '_ \\\\ / _` || '_ ` _ \\\\ / _ \\\\| | / _ \\\\/ __|/ __|", "source.strings[56]": "\\n| | | || (_| || | | | | || __/| || __/\\__ \\\\__ \\\\", "source.strings[57]": "\\n|_| |_| \\\\__,_||_| |_| |_| \\\\___||_| \\\\__||___/|__/", "source.strings[58]": "__,_||_| |_| |_| ", "source.strings[59]": "___||_| ", "source.strings[60]": "__||___/|__/", "source.strings[61]": "char RegCloseKey_[] = ", "source.strings[62]": "char RegCloseKey_[] = \\\"%s\\\";\\n\\n", "source.strings[63]": "char RegCreateKeyEx_[] = ", "source.strings[64]": "char RegCreateKeyEx_[] = \\\"%s\\\";\\n", "source.strings[65]": "char RegSetValueEx_[] = ", "source.strings[66]": "char RegSetValueEx_[] = \\\"%s\\\";\\n", "source.strings[67]": "char ShellExecute_[] = ", "source.strings[68]": "char ShellExecute_[] = \\\"%s\\\";\\n\\n", "source.strings[69]": "char URLDownloadToFile_[] = ", "source.strings[70]": "char URLDownloadToFile_[] = \\\"%s\\\";\\n", "source.strings[71]": "char WS2_32_[] = ", "source.strings[72]": "char WS2_32_[] = \\\"%s\\\";\\n", "source.strings[73]": "char WSACleanup_[] = ", "source.strings[74]": "char WSACleanup_[] = \\\"%s\\\";\\n", "source.strings[75]": "char WSAStartup_[] = ", "source.strings[76]": "char WSAStartup_[] = \\\"%s\\\";\\n", "source.strings[77]": "char advapi32_[] = ", "source.strings[78]": "char advapi32_[] = \\\"%s\\\";\\n", "source.strings[79]": "char closesocket_[] = ", "source.strings[80]": "char closesocket_[] = \\\"%s\\\";\\n", "source.strings[81]": "char cmd__JOIN[] = ", "source.strings[82]": "char cmd__JOIN[] = \\\"%s\\\"; /* main.join */\\n", "source.strings[83]": "char cmd__PART[] = ", "source.strings[84]": "char cmd__PART[] = \\\"%s\\\"; /* main.part */\\n", "source.strings[85]": "char cmd__RECONNECT[] = ", "source.strings[86]": "char cmd__RECONNECT[] = \\\"%s\\\"; /* main.recon */\\n", "source.strings[87]": "char cmd__REMOVAL[] = ", "source.strings[88]": "char cmd__REMOVAL[] = \\\"%s\\\"; /* main.removal */\\n", "source.strings[89]": "char connect_[] = ", "source.strings[90]": "char connect_[] = \\\"%s\\\";\\n", "source.strings[91]": "char decode_pass[] = ", "source.strings[92]": "char decode_pass[] = \\\"%s\\\";\\n\\n", "source.strings[93]": "char gethostbyname_[] = ", "source.strings[94]": "char gethostbyname_[] = \\\"%s\\\";\\n", "source.strings[95]": "char htons_[] = ", "source.strings[96]": "char htons_[] = \\\"%s\\\";\\n", "source.strings[97]": "char inet_addr_[] = ", "source.strings[98]": "char inet_addr_[] = \\\"%s\\\";\\n\\n", "source.strings[99]": "char my_3_3_2[] = ", "source.functions[0]": "* Reverse_Str(char* str)", "source.functions[1]": "*Encode_Decode(unsigned char *string, unsigned char *key)", "source.functions[2]": "main()", "source.strings[100]": "char my_3_3_2[] = \\\"%s\\\";\\n\\n", "source.strings[101]": "char my_4_4_3[] = ", "source.strings[102]": "char my_4_4_3[] = \\\"%s\\\";\\n", "source.strings[103]": "char my_P0N6[] = ", "source.strings[104]": "char my_P0N6[] = \\\"%s\\\";\\n", "source.strings[105]": "char my_P1N6[] = ", "source.strings[106]": "char my_P1N6[] = \\\"%s\\\";\\n", "source.strings[107]": "char my_join[] = ", "source.strings[108]": "char my_join[] = \\\"%s\\\";\\n", "source.strings[109]": "char my_nick[] = ", "source.strings[110]": "char my_nick[] = \\\"%s\\\";\\n", "source.strings[111]": "char my_notice[] = ", "source.strings[112]": "char my_notice[] = \\\"%s\\\";\\n", "source.strings[113]": "char my_part[] = ", "source.strings[114]": "char my_part[] = \\\"%s\\\";\\n", "source.strings[115]": "char my_pass[] = ", "source.strings[116]": "char my_pass[] = \\\"%s\\\";\\n", "source.strings[117]": "char my_privmsg[] = ", "source.strings[118]": "char my_privmsg[] = \\\"%s\\\";\\n", "source.strings[119]": "char my_quit[] = ", "source.strings[120]": "char my_quit[] = \\\"%s\\\";\\n", "source.strings[121]": "char my_user[] = ", "source.strings[122]": "char my_user[] = \\\"%s\\\";\\n", "source.strings[123]": "char recv_[] = ", "source.strings[124]": "char recv_[] = \\\"%s\\\";\\n", "source.strings[125]": "char select_[] = ", "source.strings[126]": "char select_[] = \\\"%s\\\";\\n", "source.strings[127]": "char send_[] = ", "source.strings[128]": "char send_[] = \\\"%s\\\";\\n", "source.strings[129]": "char shell32_[] = ", "source.strings[130]": "char shell32_[] = \\\"%s\\\";\\n", "source.strings[131]": "char socket_[] = ", "source.strings[132]": "char socket_[] = \\\"%s\\\";\\n", "source.strings[133]": "char urlmon_[] = ", "source.strings[134]": "char urlmon_[] = \\\"%s\\\";\\n", "source.strings[135]": "closesocket", "source.strings[136]": "connect", "source.strings[137]": "cryptn.c", "source.strings[138]": "encrypted_strings.txt", "source.strings[139]": "gethostbyname", "source.strings[140]": "inet_addr", "source.strings[141]": "main.join", "source.strings[142]": "main.part", "source.strings[143]": "main.recon", "source.strings[144]": "main.removal", "source.strings[145]": "select", "source.strings[146]": "shell32.dll", "source.strings[147]": "socket", "source.strings[148]": "urlmon.dll", "source.strings[149]": "| | / _ ", "source.strings[150]": "| | | || (_| || | | | | || __/| || __/", "source.strings[151]": "|_| |_| " }, "ct": [ "Encode_Decode", "Reverse_Str", "fclose", "fopen", "fprintf", "gets", "malloc", "printf", "strlen" ], "id": "c" }, "id": 0, "sz": 9507, "ts": [ { "c": 0.9700000286102295, "d": "Validation vocabulary string", "e": [ "string" ], "i": "metadata/file/text/format::vocab-string", "l": 1 }, { "c": 0.8999999761581421, "d": "IRC PRIVMSG command string", "e": [ "PRIVMSG" ], "i": "objectives/command-and-control/channel/irc/bot::privmsg", "l": 3, "el": [ "711" ] }, { "d": "password keyword", "e": [ "password" ], "i": "micro-behaviors/data/text/keywords/lexicon::password", "l": 1 }, { "c": 0.6200000047683716, "d": "fopen API string", "e": [ "fopen" ], "i": "micro-behaviors/fs/file/open::fopen-text", "l": 2 }, { "c": 0.6600000262260437, "d": "Open files", "e": [ "fopen" ], "i": "micro-behaviors/fs/file/open::fopen", "l": 2, "el": [ "f13" ] }, { "a": "T1027", "c": 1.0, "d": "XOR pattern for return address", "e": [ "for (j = 0; j \u003c strlen(key); j++)\r\n\t\t\tstring[i] ^= key" ], "i": "objectives/anti-static/obfuscation/control-flow/stack::return-address-xor-pattern", "l": 1, "m": "F0001" }, { "c": 0.8399999737739563, "d": "password/token/api_key field keyword", "e": [ "password" ], "i": "micro-behaviors/data/text/keywords/credential::credential-field", "l": 1 }, { "a": "T1105", "c": 0.9300000071525574, "d": "URLDownloadToFile call", "e": [ "URLDownloadToFileA", "char URLDownloadToFile_[] = ", "char URLDownloadToFile_[] = \\\"%s\\\";\\n" ], "i": "objectives/command-and-control/backdoor/tasking/poll::url-download-call", "l": 4, "el": [ "ccb", "24a6", "24a5" ] } ], "sha": "469bfbcb48591c90dfd61094e52a7eff8a721dde7c6f3b73784f4ca443987e4f", "path": "main.c.save", "type": "c" } ], "tv": "8e9ac" } }