{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9993844032287598, "class": 2 } ], "prob": 0.9993844, "class": 2, "models": [ { "m": "az", "prob": 0.97101676, "class": 0 }, { "m": "az/scripts", "prob": 0.9562699, "class": 0 }, { "m": "az/php", "prob": 0.9993844, "class": 2 } ], "version": "v16.16", "thresholds": [ 0.9961138, 0.99909174 ], "analyzed_at": "2026-05-08T22:45:00Z" }, "path": "dcf2voiirdr.php", "raw": { "v": "4", "fs": [ { "f": "O₇(C₅AlDy₂CaCoErI)H₄(Cm₂F₂OsPo)Md", "k": { "source.imports[0]": "chmod", "source.imports[1]": "chop", "source.imports[2]": "curl_close", "source.imports[3]": "curl_exec", "source.imports[4]": "curl_init", "source.imports[5]": "curl_setopt", "source.imports[6]": "dirname", "source.imports[7]": "empty", "source.imports[8]": "fclose", "source.imports[9]": "file", "source.strings[0]": "#Accoona#i", "source.strings[1]": "#Ask\\s*Jeeves#i", "source.strings[2]": "#BingBot#i", "source.strings[3]": "#CFNetwork#i", "source.strings[4]": "#CazoodleBot#i", "source.strings[5]": "#ConveraCrawler#i", "source.strings[6]": "#DISCo#i", "source.strings[7]": "#Download\\s*Master#i", "source.strings[8]": "#FAST\\s*MetaWeb\\s*Crawler#i", "source.strings[9]": "#Flexum\\s*spider#i", "source.has_imports": true, "source.imports[10]": "file_exists", "source.imports[11]": "file_get_contents", "source.imports[12]": "filesize", "source.imports[13]": "fopen", "source.imports[14]": "fwrite", "source.imports[15]": "gethostbyaddr", "source.imports[16]": "header", "source.imports[17]": "implode", "source.imports[18]": "is_mobile", "source.imports[19]": "mb_strtolower", "source.imports[20]": "preg_replace", "source.imports[21]": "rand", "source.imports[22]": "str_replace", "source.imports[23]": "strlen", "source.imports[24]": "strpos", "source.imports[25]": "ucfirst", "source.strings[10]": "#Gigabot#i", "source.strings[11]": "#HP\\s*Web\\s*PrintSmart#i", "source.strings[12]": "#HTMLParser#i", "source.strings[13]": "#HTTrack#i", "source.strings[14]": "#IDBot#i", "source.strings[15]": "#IRLbot#i", "source.strings[16]": "#Indy\\s*Library#", "source.strings[17]": "#Java#i", "source.strings[18]": "#LWP::Simple#i", "source.strings[19]": "#ListChecker#i", "source.strings[20]": "#Lupa\\.ru#i", "source.strings[21]": "#MJ12bot#i", "source.strings[22]": "#MSIECrawler#i", "source.strings[23]": "#Missigua#i", "source.strings[24]": "#NetCache#i", "source.strings[25]": "#Nutch#i", "source.strings[26]": "#Offline\\s*Explorer#i", "source.strings[27]": "#OmniExplorer_Bot#i", "source.strings[28]": "#PEAR#i", "source.strings[29]": "#Python#i", "source.strings[30]": "#RPT-HTTPClient#i", "source.strings[31]": "#SMILE#i", "source.strings[32]": "#Speedy#i", "source.strings[33]": "#Teleport\\s*Pro#i", "source.strings[34]": "#TurtleScanner#i", "source.strings[35]": "#Twiceler#i", "source.strings[36]": "#User-Agent#i", "source.strings[37]": "#WebAlta#i", "source.strings[38]": "#WebCopier#i", "source.strings[39]": "#WebData#i", "source.strings[40]": "#WebZIP#i", "source.strings[41]": "#Webalta#i", "source.strings[42]": "#Webster\\s*Pro#i", "source.strings[43]": "#Wget#i", "source.strings[44]": "#Wysigot#i", "source.strings[45]": "#Yahoo!\\s*Slurp#i", "source.strings[46]": "#Yandex#i", "source.strings[47]": "#Yanga#i", "source.strings[48]": "#Yeti#i", "source.strings[49]": "#altavista#i", "source.strings[50]": "#architextspider#i", "source.strings[51]": "#ask#i", "source.strings[52]": "#asterias#i", "source.strings[53]": "#av\\s*fetch#i", "source.strings[54]": "#charlotte#i", "source.strings[55]": "#google#i", "source.strings[56]": "#gulliver#i", "source.strings[57]": "#ia_archiver#i", "source.strings[58]": "#ichiro#i", "source.strings[59]": "#infoseek sidewinder#i", "source.strings[60]": "#jeeves#i", "source.strings[61]": "#kmSearchBot#i", "source.strings[62]": "#km\\.ru\\s*bot#i", "source.strings[63]": "#libwww-perl#i", "source.strings[64]": "#lwp-trivial#i", "source.strings[65]": "#lycos.spider#i", "source.strings[66]": "#msnbot#i", "source.strings[67]": "#msnbot-media#i", "source.strings[68]": "#ngb#i", "source.strings[69]": "#polybot#i", "source.strings[70]": "#psbot#i", "source.strings[71]": "#robozill#i", "source.strings[72]": "#rulinki\\.ru#i", "source.strings[73]": "#scooter#i", "source.strings[74]": "#spider#i", "source.strings[75]": "#spiderthread revision#i", "source.strings[76]": "#sqworm#i", "source.strings[77]": "#ultraseek#i", "source.strings[78]": "#voyager#i", "source.strings[79]": "#webcrawler#i", "source.strings[80]": "#www\\.cys\\.ru#i", "source.strings[81]": "#yahoo!\\s*slurp#i", "source.strings[82]": "#yahoo#i", "source.strings[83]": "$num_temple", "source.strings[84]": "\u0026engkey=", "source.strings[85]": "-NO-WAY-", "source.strings[86]": ".31.253.227/cakes/page.php", "source.strings[87]": ".45.79.15/input/?mark=", "source.strings[88]": ".45.79.15/input/?mark=$today-$s\u0026tpl=$tpl\u0026engkey=$keyword", "source.strings[89]": ".9.23.3/story.php?pass=", "source.strings[90]": ".9.23.3/story.php?pass=$apass\u0026q=$_GET[id]", "source.strings[91]": "20191119", "source.strings[92]": "\u003cbr\u003e\u003cbr\u003e", "source.strings[93]": "\u003cbr\u003e\u003cbr\u003e\\n\\n\\n\\n", "source.strings[94]": "HTTP_REFERER", "source.strings[95]": "HTTP_USER_AGENT", "source.strings[96]": "Location: http://", "source.strings[97]": "PHP_SELF", "source.strings[98]": "REMOTE_ADDR", "source.strings[99]": "RewriteEngine On \r\nRewriteRule ^([A-Za-z0-9-]+).html$ dcf2voiirdr.php?world=5\u0026looping=176\u0026hl=$1 [L]", "source.strings[100]": "SERVER_NAME", "source.strings[101]": "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX", "source.strings[102]": "checkmob.php", "source.strings[103]": "google", "source.strings[104]": "google.", "source.strings[105]": "http://", "source.strings[106]": "http://$zzzzz.31.253.227/cakes/page.php", "source.strings[107]": "looping", "source.strings[108]": "num=100", "source.strings[109]": "oodoskoskd", "source.strings[110]": "tpl$num_temple.html", "source.strings[111]": "yahoo.", "source.strings[112]": "{keyword}", "source.strings[113]": "{manytext_bing}" }, "x": 39, "id": 0, "is": [ "file_exists", "chmod", "filesize", "fopen", "fwrite", "fclose", "empty", "strpos", "preg_replace", "strpos", "gethostbyaddr", "file_exists", "file", "implode", "rand", "file", "str_replace", "chop", "ucfirst", "str_replace", "chop", "mb_strtolower", "curl_init", "curl_setopt", "curl_setopt", "curl_setopt", "curl_exec", "curl_close", "strlen", "file_get_contents", "curl_init", "curl_setopt", "curl_setopt", "curl_setopt", "curl_exec", "curl_close", "implode", "str_replace", "str_replace", "strlen", "fopen", "fwrite", "fclose", "str_replace", "str_replace", "dirname", "is_mobile", "strpos", "file_exists", "file", "implode", "strpos", "strpos", "strpos", "header", "file_exists", "file", "implode" ], "ms": { "file": { "size": 5567.0 }, "text": { "tab_count": 73.0, "digit_ratio": 0.03, "space_count": 858.0, "total_lines": 177.0, "char_entropy": 5.46, "mixed_indent": true, "unique_chars": 92.0, "import_density": 32.77, "string_density": 1.69, "avg_line_length": 29.46, "max_line_length": 163.0, "empty_line_ratio": 0.21, "last_line_length": 2.0, "most_common_char": "e", "whitespace_ratio": 0.23, "most_common_ratio": 0.04, "identifier_density": 1.16, "line_length_stddev": 37.24, "encoded_string_ratio": 0.01, "normalized_import_count": 4.36, "normalized_string_count": 22.55, "repeated_char_sequences": 18.0, "suspicious_comment_ratio": 0.8, "max_inline_whitespace_run": 2.0, "trailing_whitespace_lines": 23.0, "suspicious_identifier_ratio": 0.14, "normalized_unique_identifiers": 7.9 }, "imports": { "total": 58.0, "unique_modules": 26.0, "third_party_count": 58.0, "third_party_ratio": 1.0 }, "strings": { "total": 300.0, "url_count": 6.0, "avg_length": 11.39, "max_length": 99.0, "avg_entropy": 2.58, "hex_strings": 2.0, "total_bytes": 3418.0, "entropy_stddev": 1.08, "high_entropy_count": 2.0 }, "comments": { "chars": 292.0, "lines": 10.0, "total": 5.0, "to_code_ratio": 0.06, "high_entropy_comments": 4.0 }, "functions": {}, "identifiers": { "total": 206.0, "avg_length": 7.08, "max_length": 22.0, "min_length": 1.0, "avg_entropy": 2.17, "reuse_ratio": 0.29, "unique_count": 59.0, "length_stddev": 4.87, "has_digit_ratio": 0.12, "sequential_names": 7.0, "single_char_count": 3.0, "single_char_ratio": 0.05, "high_entropy_count": 1.0, "high_entropy_ratio": 0.02, "all_lowercase_ratio": 0.8, "all_uppercase_ratio": 0.08, "repeated_char_names": 1.0, "numeric_suffix_count": 7.0, "underscore_prefix_count": 2.0 } }, "ss": [ [ 15, ".ht" ], [ 16, ".ht" ], [ 28, "acc" ], [ 29, "acc" ], [ 41, "ess" ], [ 42, "ess" ], [ 80, "oodoskoskd" ], [ 81, "oodoskoskd" ], [ 187, "w" ], [ 188, "w" ], [ 210, "RewriteEngine On \r\nRewriteRule ^([A-Za-z0-9-]+).html$ dcf2voiirdr.php?world=5\u0026looping=176\u0026hl=$1 [L]" ], [ 211, "RewriteEngine On \r\nRewriteRule ^([A-Za-z0-9-]+).html$ dcf2voiirdr.php?world=5\u0026looping=176\u0026hl=$1 [L]" ], [ 374, "id" ], [ 375, "id" ], [ 544, "#Ask\\s*Jeeves#i" ], [ 545, "#Ask\\s*Jeeves#i" ], [ 563, "#HP\\s*Web\\s*PrintSmart#i" ], [ 564, "#HP\\s*Web\\s*PrintSmart#i" ], [ 591, "#HTTrack#i" ], [ 592, "#HTTrack#i" ], [ 605, "#IDBot#i" ], [ 606, "#IDBot#i" ], [ 617, "#Indy\\s*Library#" ], [ 618, "#Indy\\s*Library#" ], [ 669, "#ListChecker#i" ], [ 670, "#ListChecker#i" ], [ 687, "#MSIECrawler#i" ], [ 688, "#MSIECrawler#i" ], [ 705, "#NetCache#i" ], [ 706, "#NetCache#i" ], [ 720, "#Nutch#i" ], [ 721, "#Nutch#i" ], [ 732, "#RPT-HTTPClient#i" ], [ 733, "#RPT-HTTPClient#i" ], [ 785, "#rulinki\\.ru#i" ], [ 786, "#rulinki\\.ru#i" ], [ 803, "#Twiceler#i" ], [ 804, "#Twiceler#i" ], [ 818, "#WebAlta#i" ], [ 819, "#WebAlta#i" ], [ 832, "#Webster\\s*Pro#i" ], [ 833, "#Webster\\s*Pro#i" ], [ 851, "#www\\.cys\\.ru#i" ], [ 852, "#www\\.cys\\.ru#i" ], [ 902, "#Wysigot#i" ], [ 903, "#Wysigot#i" ], [ 916, "#Yahoo!\\s*Slurp#i" ], [ 917, "#Yahoo!\\s*Slurp#i" ], [ 937, "#Yeti#i" ], [ 938, "#Yeti#i" ], [ 948, "#Accoona#i" ], [ 949, "#Accoona#i" ], [ 962, "#CazoodleBot#i" ], [ 963, "#CazoodleBot#i" ], [ 1012, "#CFNetwork#i" ], [ 1013, "#CFNetwork#i" ], [ 1028, "#ConveraCrawler#i" ], [ 1029, "#ConveraCrawler#i" ], [ 1048, "#DISCo#i" ], [ 1049, "#DISCo#i" ], [ 1060, "#Download\\s*Master#i" ], [ 1061, "#Download\\s*Master#i" ], [ 1084, "#FAST\\s*MetaWeb\\s*Crawler#i" ], [ 1085, "#FAST\\s*MetaWeb\\s*Crawler#i" ], [ 1147, "#Flexum\\s*spider#i" ], [ 1148, "#Flexum\\s*spider#i" ], [ 1169, "#Gigabot#i" ], [ 1170, "#Gigabot#i" ], [ 1183, "#HTMLParser#i" ], [ 1184, "#HTMLParser#i" ], [ 1200, "#ia_archiver#i" ], [ 1201, "#ia_archiver#i" ], [ 1218, "#ichiro#i" ], [ 1219, "#ichiro#i" ], [ 1263, "#IRLbot#i" ], [ 1264, "#IRLbot#i" ], [ 1276, "#Java#i" ], [ 1277, "#Java#i" ], [ 1287, "#km\\.ru\\s*bot#i" ], [ 1288, "#km\\.ru\\s*bot#i" ], [ 1306, "#kmSearchBot#i" ], [ 1307, "#kmSearchBot#i" ], [ 1324, "#libwww-perl#i" ], [ 1325, "#libwww-perl#i" ], [ 1374, "#Lupa\\.ru#i" ], [ 1375, "#Lupa\\.ru#i" ], [ 1389, "#LWP::Simple#i" ], [ 1390, "#LWP::Simple#i" ], [ 1407, "#lwp-trivial#i" ], [ 1408, "#lwp-trivial#i" ], [ 1425, "#Missigua#i" ], [ 1426, "#Missigua#i" ], [ 1440, "#MJ12bot#i" ], [ 1441, "#MJ12bot#i" ], [ 1486, "#msnbot#i" ], [ 1487, "#msnbot#i" ], [ 1499, "#msnbot-media#i" ], [ 1500, "#msnbot-media#i" ], [ 1518, "#Offline\\s*Explorer#i" ], [ 1519, "#Offline\\s*Explorer#i" ], [ 1543, "#OmniExplorer_Bot#i" ], [ 1544, "#OmniExplorer_Bot#i" ], [ 1598, "#PEAR#i" ], [ 1599, "#PEAR#i" ], [ 1609, "#psbot#i" ], [ 1610, "#psbot#i" ], [ 1621, "#Python#i" ], [ 1622, "#Python#i" ], [ 1634, "#rulinki\\.ru#i" ], [ 1635, "#rulinki\\.ru#i" ], [ 1652, "#SMILE#i" ], [ 1653, "#SMILE#i" ], [ 1696, "#Speedy#i" ], [ 1697, "#Speedy#i" ], [ 1709, "#Teleport\\s*Pro#i" ], [ 1710, "#Teleport\\s*Pro#i" ], [ 1730, "#TurtleScanner#i" ], [ 1731, "#TurtleScanner#i" ], [ 1750, "#User-Agent#i" ], [ 1751, "#User-Agent#i" ], [ 1767, "#voyager#i" ], [ 1768, "#voyager#i" ], [ 1813, "#Webalta#i" ], [ 1814, "#Webalta#i" ], [ 1827, "#WebCopier#i" ], [ 1828, "#WebCopier#i" ], [ 1843, "#WebData#i" ], [ 1844, "#WebData#i" ], [ 1857, "#WebZIP#i" ], [ 1858, "#WebZIP#i" ], [ 1870, "#Wget#i" ], [ 1871, "#Wget#i" ], [ 1913, "#Yandex#i" ], [ 1914, "#Yandex#i" ], [ 1926, "#Yanga#i" ], [ 1927, "#Yanga#i" ], [ 1938, "#Yeti#i" ], [ 1939, "#Yeti#i" ], [ 1948, "#msnbot#i" ], [ 1949, "#msnbot#i" ], [ 1993, "#spider#i" ], [ 1994, "#spider#i" ], [ 2006, "#yahoo#i" ], [ 2007, "#yahoo#i" ], [ 2018, "#jeeves#i" ], [ 2019, "#jeeves#i" ], [ 2031, "#google#i" ], [ 2032, "#google#i" ], [ 2044, "#altavista#i" ], [ 2045, "#altavista#i" ], [ 2092, "#scooter#i" ], [ 2093, "#scooter#i" ], [ 2106, "#av\\s*fetch#i" ], [ 2107, "#av\\s*fetch#i" ], [ 2123, "#asterias#i" ], [ 2124, "#asterias#i" ], [ 2138, "#spiderthread revision#i" ], [ 2139, "#spiderthread revision#i" ], [ 2166, "#sqworm#i" ], [ 2167, "#sqworm#i" ], [ 2211, "#ask#i" ], [ 2212, "#ask#i" ], [ 2221, "#lycos.spider#i" ], [ 2222, "#lycos.spider#i" ], [ 2240, "#infoseek sidewinder#i" ], [ 2241, "#infoseek sidewinder#i" ], [ 2266, "#ultraseek#i" ], [ 2267, "#ultraseek#i" ], [ 2282, "#polybot#i" ], [ 2283, "#polybot#i" ], [ 2328, "#webcrawler#i" ], [ 2329, "#webcrawler#i" ], [ 2345, "#robozill#i" ], [ 2346, "#robozill#i" ], [ 2360, "#gulliver#i" ], [ 2361, "#gulliver#i" ], [ 2375, "#architextspider#i" ], [ 2376, "#architextspider#i" ], [ 2397, "#yahoo!\\s*slurp#i" ], [ 2398, "#yahoo!\\s*slurp#i" ], [ 2450, "#charlotte#i" ], [ 2451, "#charlotte#i" ], [ 2466, "#ngb#i" ], [ 2467, "#ngb#i" ], [ 2476, "#BingBot#i" ], [ 2477, "#BingBot#i" ], [ 2518, "HTTP_USER_AGENT" ], [ 2519, "HTTP_USER_AGENT" ], [ 2599, "-NO-WAY-" ], [ 2600, "-NO-WAY-" ], [ 2620, "HTTP_USER_AGENT" ], [ 2621, "HTTP_USER_AGENT" ], [ 2642, "-NO-WAY-" ], [ 2643, "-NO-WAY-" ], [ 2729, "REMOTE_ADDR" ], [ 2730, "REMOTE_ADDR" ], [ 2746, "google" ], [ 2747, "google" ], [ 2883, "id" ], [ 2884, "id" ], [ 2889, ".php" ], [ 2890, ".php" ], [ 3204, "tpl$num_temple.html" ], [ 3205, "tpl" ], [ 3219, ".html" ], [ 3240, "$num_temple" ], [ 3279, "-" ], [ 3280, "-" ], [ 3284, " " ], [ 3285, " " ], [ 3295, "id" ], [ 3296, "id" ], [ 3422, " " ], [ 3423, " " ], [ 3427, "+" ], [ 3428, "+" ], [ 3571, "http://" ], [ 3572, "http://" ], [ 3587, "looping" ], [ 3588, "looping" ], [ 3598, ".9.23.3/story.php?pass=$apass\u0026q=$_GET[id]" ], [ 3599, ".9.23.3/story.php?pass=" ], [ 3628, "\u0026q=" ], [ 3836, "http://" ], [ 3837, "http://" ], [ 3852, "looping" ], [ 3853, "looping" ], [ 3863, ".9.23.3/story.php?pass=$apass\u0026q=$_GET[id]" ], [ 3864, ".9.23.3/story.php?pass=" ], [ 3893, "\u0026q=" ], [ 3932, "world" ], [ 3933, "world" ], [ 4002, "http://$zzzzz.31.253.227/cakes/page.php" ], [ 4003, "http://" ], [ 4016, ".31.253.227/cakes/page.php" ], [ 4209, "\u003cbr\u003e\u003cbr\u003e\\n\\n\\n\\n" ], [ 4210, "\u003cbr\u003e\u003cbr\u003e" ], [ 4264, "\\n" ], [ 4300, "{keyword}" ], [ 4301, "{keyword}" ], [ 4354, "{manytext_bing}" ], [ 4355, "{manytext_bing}" ], [ 4449, "w" ], [ 4450, "w" ], [ 4553, "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX" ], [ 4554, "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX" ], [ 4640, "-" ], [ 4641, "-" ], [ 4645, " " ], [ 4646, " " ], [ 4656, "id" ], [ 4657, "id" ], [ 4688, " " ], [ 4689, " " ], [ 4693, "+" ], [ 4694, "+" ] ], "sz": 5567, "ts": [ { "c": 0.8199999928474426, "d": "Regex component marker", "e": [ "Speed" ], "i": "objectives/discovery/system/ics-environment/register::ics-register-flow-rate--rx-77", "l": 1 }, { "a": "T1059", "c": 0.8500000238418579, "d": "HTTP GET parameter access ($_GET)", "e": [ "$_GET" ], "i": "micro-behaviors/communications/http/request/params::get-dup", "l": 3 }, { "c": 0.699999988079071, "d": "PHP error suppression operator usage", "e": [ "@$isbot" ], "i": "micro-behaviors/os/stdio::error-suppress-prefix", "l": 3 }, { "c": 0.8199999928474426, "d": "Detects overwrite-mode file open", "e": [ "fopen($ff, \"w\"" ], "i": "objectives/impact/infect/script::php-overwrite-file-mode", "l": 1 }, { "a": "T1505.003", "c": 1.0, "d": "Inequality check in WordPress user list", "e": [ "!=" ], "i": "objectives/command-and-control/backdoor/webshell/hide::wp-user-hiding-not-trait", "l": 1, "m": "B0030" }, { "c": 0.800000011920929, "d": "HTTP request via file_get_contents", "e": [ "file_get_contents", "\"http://\".$_GET[\"looping\"].\".9.23.3/story.php?pass=$apass\u0026q=$_GET[id]\"" ], "i": "micro-behaviors/communications/http/client/file-read::file-get-contents-url", "l": 3 }, { "c": 0.75, "d": "Generic $_SERVER superglobal access", "e": [ "$_SERVER" ], "i": "micro-behaviors/communications/http/request/params::server-dup", "l": 3 }, { "c": 0.8999999761581421, "d": "HTTP protocol prefix", "e": [ "http://" ], "i": "micro-behaviors/communications/http/protocol::http-prefix", "l": 2 }, { "a": "T1071", "c": 0.6000000238418579, "d": "URL with .php endpoint", "e": [ "http://\".$_GET[\"looping\"].\".9.23.3/story.php" ], "i": "objectives/command-and-control/infrastructure/domain/tld::php-endpoint-url", "l": 1 }, { "a": "T1584", "c": 1.0, "d": "PHP dynamic curl_exec call from lookup table", "e": [ "curl_exec(" ], "i": "objectives/command-and-control/dropper/delivery/seo-spam::php-dynamic-curl-exec", "l": 2 }, { "a": "T1546", "c": 1.0, "d": "Writes data to a file via functions", "e": [ "fopen(" ], "i": "micro-behaviors/fs/file/write/direct::php-file-write-func", "l": 2 }, { "a": "T1222", "c": 0.699999988079071, "d": "Changes file permissions via chmod()", "e": [ "chmod" ], "i": "micro-behaviors/fs/chmod/modify::chmod-call", "l": 3 }, { "a": "T1505.003", "c": 0.9399999976158142, "d": "Regex component marker", "e": [ "file_get_contents" ], "i": "objectives/command-and-control/backdoor/webshell/request::raw-json-post-cmd-field--rx-7", "l": 1, "m": "B0030" }, { "a": "T1505.003", "d": "PHP open tag", "e": [ "\u003c?php" ], "i": "objectives/command-and-control/backdoor/webshell/request::php-tag", "l": 1, "m": "B0030" }, { "c": 0.8999999761581421, "d": "File has 30 or more lines", "e": [ "text.total_lines = 177.00" ], "i": "metadata/file/text/metrics::file-has-30-plus-lines", "l": 1 }, { "c": 0.8600000143051147, "d": "Regex component marker", "e": [ "basename($_SERVER[" ], "i": "objectives/command-and-control/backdoor/webshell/ui::self-named-get-form--rx-1", "l": 1, "m": "B0030" }, { "a": "T1505.003", "c": 0.4000000059604645, "d": "PHP $_GET parameter access", "e": [ "$_GET[" ], "i": "objectives/command-and-control/backdoor/webshell/request::php-get", "l": 1, "m": "B0030" }, { "c": 0.800000011920929, "d": "URL parameter fetched and executed", "e": [ "file_get_contents(\"http://\".$_GET[\"looping\"].\".9.23.3/story.php?pass=$apass\u0026q=$_GET[id]\")" ], "i": "objectives/command-and-control/backdoor/webshell/fetch::url-param-fetch", "l": 4, "m": "B0030" }, { "c": 0.800000011920929, "d": "Writes data to an open file", "e": [ "fwrite" ], "i": "micro-behaviors/fs/write/file/direct::fwrite", "l": 3, "m": "C0052" }, { "c": 0.8600000143051147, "d": "Regex component marker", "e": [ "PHP_SELF" ], "i": "objectives/command-and-control/backdoor/webshell/ui::self-named-get-form--rx-2", "l": 1, "m": "B0030" }, { "c": 0.8600000143051147, "d": "Regex component marker", "e": [ "$_SERVER[" ], "i": "objectives/command-and-control/backdoor/webshell/ui::self-named-get-form--rx-4", "l": 1, "m": "B0030" }, { "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "ia_archiver" ], "i": "objectives/anti-analysis/browser-detect::bot-ua-list--rx-4", "l": 1 }, { "a": "T1217", "c": 0.4000000059604645, "d": "Yandex browser name", "e": [ "Yandex" ], "i": "objectives/discovery/host/browser::yandex-name", "l": 3 }, { "a": "T1565.001", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "download" ], "i": "objectives/evasion/hosts-file/block-security::escan-security-domain--rx-1", "l": 1, "m": "F0004" }, { "c": 0.800000011920929, "d": "Sequential source identifier names", "e": [ "identifiers.sequential_names = 7.00" ], "i": "metadata/file/text/profile::sequential-identifiers", "l": 2 }, { "a": "T1005", "c": 0.75, "d": "Regex component marker", "e": [ "master" ], "i": "objectives/credential-access/financial/credit-card::mastercard-bin--rx-2", "l": 1, "m": "B0030" }, { "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "BingBot" ], "i": "objectives/anti-analysis/browser-detect::bot-ua-list--rx-1", "l": 1 }, { "a": "T1005", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "exts" ], "i": "objectives/collection/stealer/tactics::office-secret-extension-list--rx-4", "l": 1, "m": "B0028" }, { "c": 0.8500000238418579, "d": "Checks User-Agent for crawler detection", "e": [ "$_SERVER['HTTP_USER_AGENT']" ], "i": "objectives/anti-analysis/browser-detect::check-ua-server-var", "l": 3 }, { "a": "T1082", "d": "Accesses SERVER_NAME variable", "e": [ "$_SERVER['SERVER_NAME']" ], "i": "objectives/discovery/system/fingerprint/info::server-name-access", "l": 3, "m": "E1082" }, { "c": 0.699999988079071, "d": "AJAX request handler pattern", "e": [ "$_GET[\"id\"]", "$_GET[\"looping\"]", "$_GET[\"world\"]", "$_GET[id]" ], "i": "objectives/command-and-control/backdoor/webshell/ui::ajax-handler", "l": 4, "m": "B0030" }, { "c": 0.699999988079071, "d": "perl interpreter keyword (beyond shebang)", "e": [ "perl" ], "i": "micro-behaviors/process/interpreter/perl::perl-keyword", "l": 3 }, { "c": 0.8500000238418579, "d": "Logic to identify search engine crawlers", "e": [ "$_SERVER['HTTP_USER_AGENT']", "ia_archiver", "BingBot" ], "i": "objectives/anti-analysis/browser-detect::crawler-identification", "l": 3 } ], "sha": "5b87ae34e3ce81d58b375c0ddb4c7d902fd5b00ce593baf30f15f930c49d1a55", "path": "/data/samples/bad/datasets/awesome-malware/PHP/dcf2voiirdr.php", "type": "php" } ], "tv": "bef72" } }