{ "ml": { "v": "7", "eng": "2.2.1", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.5815813, "rte": "az", "prob": 0.5815813 }, { "cls": 0, "raw": 0.002667129, "rte": "az/zip", "prob": 0.002667129 } ], "prob": 0.5815813, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.5815812945365906, "type": "zip" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.004258930683135986, "type": "text" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.009284406900405884, "type": "markdown" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.09769049286842346, "type": "composer.json" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.011222779750823975, "type": "php" }, { "id": 5, "lvl": -1, "conf": 0, "prob": 0.4198119342327118, "type": "php" }, { "id": 6, "lvl": -1, "conf": 0, "prob": 0.007767736911773682, "type": "php" }, { "id": 7, "lvl": -1, "conf": 0, "prob": 0.00020629167556762695, "type": "registry" } ], "version": "v18.18", "analyzed_at": "2026-07-08T10:58:22Z" }, "path": "satwareag-php-firebird-stubs-v12.1.0-rc.4.zip", "raw": { "files": [ { "id": 0, "ctx": [ { "b": "p!H([3ig5a005i$\u003euE#!0000000000001qB2(]3PBA.elwKe*rAa\u003chxw[=o%vRG\u003c[ePV2RvSKaPg=5Y0v(D5vr0rm5Ms0v3pY", "n": [ { "c": 2, "d": "Zip archive path", "i": "metadata/package/files/included::zip-archive-path", "o": 0, "z": 45, "cf": 0.949999988079071 } ], "ln": 0 } ], "mol": "O(As)H(Db)", "sha": "7a78fbebe808b2a3c9ed16fc9ae81fc9e6e53a592dfe7ab14814092abfa82f90", "path": "/data/samples/unknown/foraged/php/packagist.org/_/satwareag/php-firebird-stubs/satwareag-php-firebird-stubs-v12.1.0-rc.4.zip", "risk": 2, "size": 17755, "type": "zip", "facts": { "metrics": { "file": { "size": 17755.0, "entropy": 7.95, "size_bytes": 17755.0 }, "binary": { "overall_entropy": 7.95, "peak_region_bytes": 16384.0, "peak_region_entropy": 7.84 }, "archive": { "file_count": 6.0, "has_comment": 1.0, "comment_size": 40.0, "member_count": 7.0, "script_count": 3.0, "zip_bomb_ratio": 5.51, "directory_count": 1.0, "executable_count": 1.0, "extra_field_size": 63.0, "noise_file_count": 0.0, "total_compressed": 16345.0, "compression.ratio": 0.24, "hidden_file_count": 0.0, "total_uncompressed": 67307.0, "crc_collision_count": 0.0, "entry_comment_count": 0.0, "max_filename_length": 57.0, "rtlo_filename_count": 0.0, "format.regular_count": 6.0, "nested_archive_count": 0.0, "path_traversal_count": 0.0, "symlink_escape_count": 0.0, "security.setgid_count": 0.0, "security.setuid_count": 0.0, "security.sticky_count": 0.0, "double_extension_count": 0.0, "duplicate_member_count": 0.0, "format.directory_count": 1.0, "security.symlink_count": 0.0, "unicode_filename_count": 0.0, "homoglyph_filename_count": 0.0, "security.encrypted_count": 0.0, "timing.mtime_unique_count": 1.0, "timing.mtime_unique_ratio": 0.14, "misplaced_executable_count": 0.0, "timing.mtime_dominant_count": 7.0, "timing.mtime_spread_seconds": 0.0, "timing.sentinel_mtime_count": 0.0, "security.world_writable_count": 0.0, "timing.mtime_dominant_fraction": 1.0, "compression.method_counts.stored": 1.0, "compression.method_counts.deflate": 6.0 } } }, "traits": [ { "id": "objectives/anti-static/obfuscation/code-metrics/identifiers::php-many-short-functions", "atk": "T1027", "mbc": "B0032", "conf": 0.75, "crit": 3, "desc": "Many one-line PHP functions", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/data/db/sql::sql-insert", "crit": 3, "desc": "INSERT INTO SQL keyword", "from": [ { "file": 6 } ] }, { "id": "objectives/impact/destroy/keywords::delete-verb--erase", "conf": 0.8999999761581421, "crit": 1, "desc": "Destructive-action word: erase", "from": [ { "file": 6 } ] }, { "id": "objectives/credential-access/theft/keywords::password", "crit": 1, "desc": "Credential-access vocabulary word: password", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/data/db/sqlite::sqlite-insert-statement", "conf": 0.75, "crit": 3, "desc": "SQLite INSERT statement", "from": [ { "file": 6 } ] }, { "id": "objectives/impact/destroy/keywords::delete-verb--delete", "conf": 0.8999999761581421, "crit": 1, "desc": "Destructive-action word: delete", "from": [ { "file": 5 } ] } ] }, { "ctx": [ { "b": "eIeLaeIeLaeIeLaeIeLaeIeLaeIeLaeIeLaeEAQyarR^HarR^HarR^HarR^Hra]?=p!jz9oLF0FzGxwuaA?spB7]MgatUS7f:Zo^AcVFrxj#xfc$sXGf/.lOat1Y\u003efFLNgra]?=p!jz9m@\u0026J\u003cA4Sn0y?$kmx\u003eIa3B0bHmB7GxnwN)z2eIeLaeIeLaeIeLaeIeLaeIeLaeIeLaeIeLaeIeLaeIeLaeIeLaeIeLaeIeLaeIeLaeIeLaeIeLaeIeLaeIeLa3joWxwncabA+P09BzkVhayPd#aA.:pazCZoB8Mhwv}u=\u003ezE:(0x(mv1C{3ZqA=2\u003eGaA}KwxDRklaA}KwxM53n3t\u003cY(x\u003ez6?vruj4zy=]AB0bBkA=2JjBy!#9Ab](ux\u003eg^=aARp9BrCWswGUP6y\u002613lx(mMav@Dl}x([6czGud[A+cwgwPP%u3lQDCe*a56wncabA+P09BzkVhB0bykaAIEzA:@V6v@C)?az(mxBrCQnByw)3aARpdayO.$C4z!az/x#xx\u003eIa33lQDlarUMuBzkk@efG4Fx(+zkx(!wsz!pb4z/f91BzkVhB0a[ewft#cwGUP6y\u002613lx(mMawnc9{y*?3{wPxyg3lQDDe*a56wncabA+P09BzkVhB0bgmayY55vrcSow]zZbaz(mxBrCQnAb\u003e", "ln": 39, "col": 40, "line": 1 }, { "b": "BAh88B-.tozy#n6arSD)axi2=az$R8wGSf[nkHGMzfo]waz#atayX[8B-Rb8aARJAwO#3%A=U!mz/M$tA=k/kBy=OlA=kGhv@#=0arR^Hay]57x)a5#azbUjz6i}lx(+zrz!s9nvrb{4Cwhejz/{dAAb]VhAV/NDx([DdzxJ[fA=2JiB7]Mge*9S4ATA{iarR!JA+PSqwO@SfwPzT4B8#5lzy=]Hy?m3@wGUG3zGGq%BrCjpz/{1:Aa\u003chyzE)]x3jm)#g+G[EA=kGhv@#=mwmY^}C4Chbw].*baARphB0bKxw]@l9A+cwgvr\u0026#kz/^ahwGUF\u003ey\u00260V[ar\u003cSMp:dCkzF%L5arR^Haz\u003eLjar\u003cSMp:d2\u003cAbYw%AV/7laARpdx(UtlvqPNbaA}KwxM53naAhvnz/M$AA+PSqwO@SfwPzT4B8#5lzvdHearR!sA=k!qxl4{kA6OwQA4V3tBs[WUs-nB9zddYjx(mD}v{%E\u003caARp9BrC\u003cEB-FQCz!s9nvrb{4Ck", "ln": 740, "col": 9, "line": 16 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 3204, "entropy": 5.06 }, "binary": { "peak_region_bytes": 1156, "peak_region_entropy": 4.94 } } }, "id": 1, "mol": "K(Te)", "path": "/data/samples/unknown/foraged/php/packagist.org/_/satwareag/php-firebird-stubs/satwareag-php-firebird-stubs-v12.1.0-rc.4.zip!!satwareAG-php-firebird-stubs-043e3c7/LICENSE", "pid": 0, "risk": 1, "sha": "0967ad6cf4b7fe81d38709d7aaef3fecb3bd685be7eebb37b864aa34c991baa7", "size": 3204, "traits": [ { "id": "metadata/lang/natural::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"", "spans": [ [ 87, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-2", "conf": 0.8, "crit": 1, "desc": "English function-word token \"and\"", "spans": [ [ 264, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-3", "conf": 0.8, "crit": 1, "desc": "English function-word token \"that\"", "spans": [ [ 352, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "spans": [ [ 886, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-6", "conf": 0.8, "crit": 1, "desc": "English function-word token \"with\"", "spans": [ [ 300, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-7", "conf": 0.8, "crit": 1, "desc": "English function-word token \"this\"", "spans": [ [ 473, 0 ] ] }, { "id": "well-known/tool/development/vcs/github-web::github-repo-fetched-path", "conf": 0.98, "crit": 3, "desc": "Fetched github.com repository artifact" } ], "type": "text" }, { "ctx": [ { "b": "boP/Np-@kwA+eY]A+3pYCYWImB7]Mgax9x8vSI", "n": [ { "c": 1, "d": "Document or config file extension", "i": "metadata/file/extension/identity::doc-or-config-extension", "o": 0, "z": 9, "cf": 1.0 } ], "ln": 1, "addr": 0 }, { "b": "", "ln": 2, "addr": 31 }, { "b": "toNiEnkHBfwPz\u003caz/e\u0026exMOunB2\u003e%cx(dGnB7/o0y?dPtx(tUlvpT1Zfk$PzeHrhwb@m}Ge?[}qi5@-XmLn+9xdmamxMOunB2\u003e%cAa\u003chyzE)]ydf", "ln": 3, "addr": 32 }, { "b": "", "ln": 5, "addr": 201 }, { "b": "nKL#\u0026vrDWgv@Dj6y?mZ5z/cXazE:(hByxo9v\u003c2h$vqHjgx(+zrBAI5lazbLjaARpdax@!#A4LWoA+eY]A+5D7xMOunB2\u003e%cxk8E3BZ=$kz/4dGvruZ4A+dKbfk$PzeOnZqwNYv]wgnTjCYWImB7]Mge=", "n": [ { "c": 2, "d": "Contains frequent English function words", "i": "metadata/file/profile/language::lang-english", "o": 221, "z": 3, "cf": 0.800000011920929 } ], "ln": 6, "addr": 202 }, { "b": "", "ln": 7, "addr": 324 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 3767.0, "entropy": 5.14, "size_bytes": 3767.0 }, "text": { "digit_ratio": 0.01, "space_count": 395.0, "total_lines": 100.0, "char_entropy": 5.14, "unique_chars": 84.0, "ascii_art_lines": 2.0, "avg_line_length": 36.67, "high_byte_ratio": 0.0, "max_line_length": 137.0, "non_ascii_ratio": 0.0, "empty_line_ratio": 0.3, "last_line_length": 55.0, "whitespace_ratio": 0.13, "most_common_ratio": 0.07, "line_length_stddev": 38.23, "repeated_char_sequences": 6.0, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 13.0, "most_common_char_codepoint": 101.0 }, "binary": { "overall_entropy": 5.14, "peak_region_bytes": 3767.0, "peak_region_entropy": 5.12 } } }, "id": 2, "path": "/data/samples/unknown/foraged/php/packagist.org/_/satwareag/php-firebird-stubs/satwareag-php-firebird-stubs-v12.1.0-rc.4.zip!!satwareAG-php-firebird-stubs-043e3c7/README.md", "pid": 0, "risk": 1, "sha": "abe960f288d0481188b52a912582e283cd432278f32eeb0175b4334b74e06a11", "size": 3767, "traits": [ { "id": "metadata/file/extension/identity::doc-or-config-extension", "conf": 1.0, "crit": 1, "desc": "Document or config file extension", "spans": [ [ 0, 9 ] ] }, { "id": "metadata/file/profile/language::lang-english", "conf": 0.800000011920929, "crit": 2, "desc": "Contains frequent English function words", "spans": [ [ 221, 3 ] ] }, { "id": "metadata/file/extension/identity::markdown-file-basename", "conf": 1.0, "crit": 1, "desc": "Markdown document file extension", "spans": [ [ 0, 9 ] ] } ], "type": "markdown" }, { "ctx": [ { "b": "DJ", "ln": 1, "addr": 0 }, { "b": "arR^Hb5Q?awG\u003ceTb6dgmCvtJ6vp}ljxMbLnx(W=]x(W-oB98LlB0rd", "n": [ { "c": 2, "d": "Composer package declares a name", "i": "metadata/package/manifest/ecosystem::composer-has-name", "o": 6, "z": 28, "cf": 0.949999988079071 } ], "ln": 2, "addr": 2 }, { "b": "arR^Hb4Lnav@=p5BzkVhb03?\u003cnKL#\u0026vqYP#B97\u0026jx\u003e5n]zEEvbB7]XrB98LlB0b7kAV/EqwGU@9A4LWoA+eY]A+3q7CYWImB7]Mga$J", "ln": 3, "addr": 46 }, { "b": "arR^Hb6n9HwG\u003ceTb5y$5A::0la$J", "n": [ { "c": 2, "d": "Composer package type library", "i": "metadata/package/manifest/ecosystem::composer-type-library", "o": 133, "z": 7, "cf": 0.949999988079071 } ], "ln": 4, "addr": 129 }, { "b": "arR^Hb5p+nCw?IjB0rT/tl", "ln": 5, "addr": 152 }, { "b": "arR^HarR^Hb4+LfwNYv]wfJM", "ln": 6, "addr": 170 }, { "b": "arR^Ht}t", "ln": 14, "addr": 321 }, { "b": "arR^Hb4$[iwPh6\u003cwG\u003ceTb4#7uAc15[fk20vxMW=pv@DiqB76fmvrb{Bm\u003eX*{A4LWoA+eY]A+3vB", "ln": 15, "addr": 328 }, { "b": "arR^Hb5y$6wO#N2b03?\u003cp!jzmgCgvoa$J", "n": [ { "c": 2, "d": "Composer package declares a license", "i": "metadata/package/manifest/ecosystem::composer-license-declared", "o": 393, "z": 8, "cf": 0.949999988079071 } ], "ln": 16, "addr": 389 }, { "b": "arR^Hb4kRoxM4{jb03\u0026J", "ln": 17, "addr": 416 }, { "b": "arR^HarR^HDJ", "ln": 18, "addr": 433 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 1051.0, "entropy": 4.31, "size_bytes": 1051.0 }, "binary": { "overall_entropy": 4.31, "peak_region_bytes": 1024.0, "peak_region_entropy": 4.31 } } }, "id": 3, "path": "/data/samples/unknown/foraged/php/packagist.org/_/satwareag/php-firebird-stubs/satwareag-php-firebird-stubs-v12.1.0-rc.4.zip!!satwareAG-php-firebird-stubs-043e3c7/composer.json", "risk": 1, "sha": "571ca3d012829d31a1e4fdfcee9e5986899a418f76530f634399bea83ed9c7b5", "size": 1051, "traits": [ { "id": "metadata/package/manifest/ecosystem::composer-license-declared", "conf": 0.949999988079071, "crit": 2, "desc": "Composer package declares a license", "spans": [ [ 393, 8 ] ] }, { "id": "metadata/package/manifest/ecosystem::composer-has-name", "conf": 0.949999988079071, "crit": 2, "desc": "Composer package declares a name", "spans": [ [ 6, 28 ] ] }, { "id": "metadata/package/manifest/ecosystem::composer-type-library", "conf": 0.949999988079071, "crit": 2, "desc": "Composer package type library", "spans": [ [ 133, 7 ] ] } ], "type": "composer.json" }, { "ctx": [ { "b": "ju)^#z#", "n": [ { "c": 2, "d": "Script overall entropy stays low", "i": "metadata/file/metrics::low-overall-entropy-source", "o": 0, "z": 29, "cf": 0.8999999761581421 } ], "ln": 1, "addr": 0 }, { "b": "", "ln": 2, "addr": 6 }, { "b": "fdFB", "ln": 3, "addr": 7 }, { "b": "asXHgnkHA#x(W=]x(W-bmr\u0026]=zGxJgzxIq.vrlGjq/)d\u003eA@", "ln": 4, "addr": 11 }, { "b": "asW", "ln": 5, "addr": 49 }, { "b": "asXHkxLzJgw[=6)aAhvtC4\u003eF#B0bKCBZ=F7wN/K+A::67z/fRsw]zYjv@bN{B7GznAb](ux\u003eg^=ayYQsBzbkdAa\u003chxw[=o%vRG\u003c[", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 55, "z": 4, "cf": 0.800000011920929 } ], "ln": 6, "addr": 52 }, { "b": "asXH3az2!twO#N6z/dfIra]\u0026:wGUA4wGVbpwN(])C{4fIvrui[ayPd@y\u003cy8oB0bNyz!%FqvqYP#nKM0*e=", "ln": 7, "addr": 133 }, { "b": "asW", "ln": 8, "addr": 199 }, { "b": "asXH0v@DsiA+Pf1BrAs)gbQg}vruZ4A+cvVm/", "ln": 12, "addr": 305 }, { "b": "asXH0y?Wx\u003czGxwiarTGKp+sEQfFKX-BAzFyiXJdgCxUVUxMbOwwPPOwx\u003e7Z(B7E0XuOBh!BA?)", "ln": 13, "addr": 335 }, { "b": "asXH0y?W^5arR^HarUutBz#pZfe3%LBzb/ae[n*pflpMzCvtJ6k$rOExMbLnx(W=]x(W.", "n": [ { "c": 1, "d": "Encoded URL documentation context", "i": "micro-behaviors/communications/url/encoded::encoded-url-doc-context", "o": 398, "z": 19, "cf": 0.8999999761581421 } ], "ln": 14, "addr": 395 }, { "b": "asW", "ln": 15, "addr": 451 }, { "b": "asXH0B7]J4wGS]:fFk3", "ln": 16, "addr": 454 }, { "b": "arR^HasXH0Aa9=}z6i[wA+PA7as7GaBywS!B7DEpl$7gCvQTs?aAg+hxDRklaztXmBujwHBz9o", "ln": 86, "addr": 2201 }, { "b": "arR^HasXH0Aa9=}z6i[wA+PA7as88JwPzV%zdK?jl$7gCvQTs?aA.:pAV/mdzdLs", "ln": 87, "addr": 2261 }, { "b": "arR^HasXH0Aa9=}z6i[wA+PA7as7]mB8#LzA+3pnl$7gCvQTs?aAg+gB9zLywg^", "n": [ { "c": 1, "d": "password/token/api_key field keyword (password)", "i": "objectives/credential-access/theft/keywords::credential-field--password", "o": 2335, "z": 8, "cf": 0.8399999737739563 } ], "ln": 88, "addr": 2313 }, { "b": "arR^HasXH0Aa9=}z6i[wA+PA7as7DgvrcB2BrzXGlUG[GvpKy\u003cAV/BmBrz#xwObv[y\u0026?YXrA8BEdj$", "ln": 89, "addr": 2364 }, { "b": "arR^HasXH0Aa9=}z6iLgBrzXGas7Asw[CQ{B08OFlT:FrwGUD8w[CQ{ay/tjzGEG", "ln": 90, "addr": 2427 }, { "b": "arR^HasY2", "ln": 234, "addr": 6300 }, { "b": "arR^HAckSax\u003e5n$B-7Yhx(v(iuTEqYzGx]uBZ]Iw", "ln": 235, "addr": 6308 }, { "b": "arR^HarR^HB98CpzF77qxM4%lauZ?{y\u0026r/(y?N:dBseQ", "n": [ { "c": 2, "d": "Hardcoded localhost network host", "i": "micro-behaviors/communications/ip/literal::localhost-source", "o": 6365, "z": 9, "cf": 0.75 } ], "ln": 236, "addr": 6341 }, { "b": "arR^HarR^HB98CpzF77qB-RbmzEEx[auZ?{q^03!lo#$I", "ln": 237, "addr": 6377 }, { "b": "arR^HarR^HB98CpzF77qAa9*eCw?IjauZ?{zddHcwPzM$C{-", "ln": 238, "addr": 6414 } ], "depth": 1, "facts": { "imp": [ [ "", "extension_loaded" ] ], "mbr": [ "$this.sqlState" ], "tgt": [ "extension_loaded" ], "metrics": { "ast": { "op.sub": 1.0, "max_depth": 9.0, "call_count": 1.0, "node_count": 993.0, "member_count": 1.0, "op_density.sub": 0.0, "identifier_count": 65.0, "member_depth_max": 2.0, "string_literal_count": 29.0 }, "file": { "size": 7448.0, "entropy": 4.73, "size_bytes": 7448.0 }, "text": { "digit_ratio": 0.02, "space_count": 1535.0, "total_lines": 270.0, "char_entropy": 4.73, "unique_chars": 79.0, "string_density": 0.11, "avg_line_length": 26.59, "max_line_length": 108.0, "empty_line_ratio": 0.14, "last_line_length": 1.0, "whitespace_ratio": 0.24, "most_common_ratio": 0.07, "identifier_density": 0.47, "line_length_stddev": 24.79, "normalized_string_count": 1.76, "most_common_char_is_null": 0.0, "suspicious_comment_ratio": 0.18, "max_inline_whitespace_run": 6.0, "most_common_char_codepoint": 116.0, "normalized_unique_identifiers": 10.77 }, "calls": { "count": 1.0 }, "binary": { "overall_entropy": 4.73, "peak_region_bytes": 7448.0, "peak_region_entropy": 4.88 }, "source": { "class_count": 11.0, "function_count": 28.0 }, "members": { "count": 1.0 }, "strings": { "total": 29.0, "avg_length": 5.45, "max_length": 9.0, "avg_entropy": 2.46, "empty_count": 3.0, "total_bytes": 158.0, "entropy_stddev": 0.52 }, "comments": { "chars": 4233.0, "lines": 144.0, "total": 39.0, "to_code_ratio": 1.14, "url_in_comments": 1.0, "base64_in_comments": 4.0, "high_entropy_comments": 3.0 }, "functions": { "count": 39.0, "avg_params": 0.71, "max_params": 8.0, "one_liners": 36.0, "length_stddev": 1.56, "avg_name_length": 8.11, "no_params_count": 25.0, "avg_length_lines": 1.34, "max_length_lines": 10.0, "min_length_lines": 1.0, "many_params_count": 1.0, "avg_param_name_length": 8.19, "density_per_100_lines": 14.07, "code_in_functions_ratio": 0.19 }, "identifiers": { "count": 65.0, "total": 126.0, "avg_length": 7.87, "max_length": 20.0, "min_length": 3.0, "avg_entropy": 2.55, "reuse_ratio": 0.69, "unique_count": 87.0, "length_stddev": 3.55, "high_entropy_count": 2.0, "high_entropy_ratio": 0.02, "all_lowercase_ratio": 0.44, "underscore_prefix_count": 1.0 } } }, "id": 4, "path": "/data/samples/unknown/foraged/php/packagist.org/_/satwareag/php-firebird-stubs/satwareag-php-firebird-stubs-v12.1.0-rc.4.zip!!satwareAG-php-firebird-stubs-043e3c7/firebird-classes.php", "risk": 1, "sha": "6c8e4af3f9512853068da1adad8df43e753c90b67a0b52672ed9231976749df1", "size": 7448, "traits": [ { "id": "metadata/file/profile/language::lang-english", "conf": 0.800000011920929, "crit": 2, "desc": "English language detection", "spans": [ [ 55, 4 ] ] }, { "id": "metadata/file/metrics::low-overall-entropy-source", "conf": 0.8999999761581421, "crit": 2, "desc": "Script overall entropy stays low", "spans": [ [ 0, 29 ] ] }, { "id": "metadata/file/metrics::many-no-param-functions", "conf": 0.75, "crit": 2, "desc": "Many no-param functions", "spans": [ [ 0, 33 ] ] }, { "id": "objectives/credential-access/theft/keywords::password", "crit": 1, "desc": "Credential-access vocabulary word: password", "spans": [ [ 2335, 8 ] ] } ], "type": "php" }, { "ctx": [ { "b": "ju)^#z#", "n": [ { "c": 3, "d": "Many one-line PHP functions", "i": "objectives/anti-static/obfuscation/code-metrics/identifiers::php-many-short-functions", "o": 0, "z": 28, "cf": 0.75 } ], "ln": 1, "addr": 0 }, { "b": "", "ln": 2, "addr": 6 }, { "b": "fdFB", "ln": 3, "addr": 7 }, { "b": "asXHgnkHA#x(W=]x(W-bmr\u0026]=zGxJgzxI(1BZ/y", "ln": 4, "addr": 11 }, { "b": "asW", "ln": 5, "addr": 43 }, { "b": "asXHkxLzJgw[=6)aAhvtC4\u003eF#B0bKCBZ=F7wN/K+A::67z/fRsw]zYjB97\u0026jx\u003e5n]zEEvbB7]XrBz(8lB08(cnkJlbvqWRsp\u0026*5Yz7b", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 49, "z": 4, "cf": 0.800000011920929 } ], "ln": 6, "addr": 46 }, { "b": "asXHxzE:\u003eYl}8etc@sO@q/(}#z7D/gq:UFlwGTMZBy/o1Aa\u0026*2B7D^yw]zYjv@C)?ay/tbAbo9cx(v(ivqYP#BA}?pay/7@v@2^@xd:", "ln": 7, "addr": 129 }, { "b": "asW", "ln": 8, "addr": 212 }, { "b": "asXH0v@DsiA+Pf1BrAs)gbQTsfFUKeB76fmvrb{4k$p", "ln": 15, "addr": 446 }, { "b": "asXH0y?Wx\u003czGxwiarTGKp+sEQfFKX-BAzFyiXJdgCxUVUxMbOwwPPOwx\u003e7Z(B7E0XuOBh!BA?)", "ln": 16, "addr": 481 }, { "b": "asXH0y?W^5arR^HarUutBz#pZfe3%LBzb/ae[n*pflpMzCvtJ6k$rOExMbLnx(W=]x(W.", "n": [ { "c": 1, "d": "Encoded URL documentation context", "i": "micro-behaviors/communications/url/encoded::encoded-url-doc-context", "o": 544, "z": 19, "cf": 0.8999999761581421 } ], "ln": 17, "addr": 541 }, { "b": "asW", "ln": 18, "addr": 597 }, { "b": "asXH0B7]J4wGS]:fFk3", "ln": 19, "addr": 600 }, { "b": "asXH0Aa9=}z6i[wA+PA7arR^HarR}uvrt{!vrl05l$7gCvQTs?aAg+hxDRklay/tczE)s1x(v(iB98CpzF5", "ln": 304, "addr": 9302 }, { "b": "asXH0Aa9=}z6i[wA+PA7D#s7yy-\u003e0CB7GxfvqPM#rDz.(zEEx[azbLjayPzmxK#76x\u003e7N[x(v\u003e", "ln": 305, "addr": 9369 }, { "b": "asXH0Aa9=}z6i[wA+PA7D#s7yy-\u003e0xvrlHlz/Pwhp*[A^Cw?IjazbLjayPzmxK#76x\u003e7N[x(v\u003e", "n": [ { "c": 1, "d": "password/token/api_key field keyword (password)", "i": "objectives/credential-access/theft/keywords::credential-field--password", "o": 9452, "z": 8, "cf": 0.8399999737739563 } ], "ln": 306, "addr": 9429 }, { "b": "asXH0Aa9=}z6i[wA+PA7D#s7yy-\u003e0kxKL}5wPP4qlUG[GvpKy\u003cAV/BmBrCglAV/EqwGUG3zF\u003c2}BzkVh", "ln": 307, "addr": 9489 }, { "b": "asXH0Aa9=}z6iLgBrzXGarR^HarR}sB.kk%A=SuCpiyz.wPw]iw/$R)BywS!B7DF7vpJ$ZayYF9w[u17", "ln": 308, "addr": 9554 }, { "b": "asXH1BAy@3xDRznaARpdaAIamC4\u003eC$az\u003eL8vp%d(e=", "ln": 990, "addr": 31376 }, { "b": "asW", "ln": 991, "addr": 31410 }, { "b": "asXH0Aa9=}z6i[wA+PA7as7SsB95JEarR^$z/Z1yzEEx[asH!Nxd+qJy\u0026r/(y?N:dBrSd", "n": [ { "c": 2, "d": "Hardcoded localhost network host", "i": "micro-behaviors/communications/ip/literal::localhost-source", "o": 31457, "z": 9, "cf": 0.75 } ], "ln": 992, "addr": 31413 }, { "b": "asXH0Aa9=}z6i[wA+PA7as88JwPzV%zdK?\u0026B7GxfvqPM", "ln": 993, "addr": 31469 }, { "b": "asXH0Aa9=}z6i[wA+PA7as7]mB8#LzA+3p?vrlHlz/Pv", "ln": 994, "addr": 31505 }, { "b": "", "ln": 1114, "addr": 35332 }, { "b": "fdFB", "ln": 1115, "addr": 35333 }, { "b": "asXH4wO+}1wGUz7B-RbmazbUjz6i}lwGTDRA+eY]A+3qlwN/\u003e6x([RywmoN*vQTs?e=", "n": [ { "c": 1, "d": "Destructive-action word: delete", "i": "objectives/impact/destroy/keywords::delete-verb--delete", "o": 35340, "z": 6, "cf": 0.8999999761581421 } ], "ln": 1116, "addr": 35337 }, { "b": "asW", "ln": 1117, "addr": 35391 }, { "b": "asXH0Aa9=}z6hqZA+eY]A+5ANwPz%dv}u=dB7Gxnx\u003e7Y%ax8\u0026(C4\u003eC$azth3wnC/", "ln": 1118, "addr": 35394 } ], "depth": 1, "facts": { "imp": [ [ "", "extension_loaded" ] ], "tgt": [ "extension_loaded" ], "metrics": { "ast": { "op.sub": 1.0, "max_depth": 7.0, "call_count": 1.0, "node_count": 3554.0, "op_density.sub": 0.0, "identifier_count": 249.0, "string_literal_count": 77.0 }, "file": { "size": 42168.0, "entropy": 4.99, "size_bytes": 42168.0 }, "text": { "digit_ratio": 0.02, "space_count": 5803.0, "total_lines": 1333.0, "char_entropy": 4.99, "unique_chars": 86.0, "string_density": 0.06, "ascii_art_lines": 66.0, "avg_line_length": 30.63, "max_line_length": 147.0, "empty_line_ratio": 0.12, "last_line_length": 28.0, "whitespace_ratio": 0.17, "most_common_ratio": 0.12, "identifier_density": 0.44, "line_length_stddev": 28.52, "normalized_string_count": 2.11, "repeated_char_sequences": 91.0, "most_common_char_is_null": 0.0, "suspicious_comment_ratio": 0.16, "max_inline_whitespace_run": 37.0, "most_common_char_codepoint": 61.0, "normalized_unique_identifiers": 30.44 }, "calls": { "count": 1.0 }, "binary": { "overall_entropy": 4.99, "peak_region_bytes": 33792.0, "peak_region_entropy": 5.01 }, "source": { "function_count": 89.0 }, "strings": { "total": 77.0, "avg_length": 5.99, "max_length": 6.0, "avg_entropy": 2.58, "total_bytes": 461.0, "entropy_stddev": 0.03 }, "comments": { "chars": 30356.0, "lines": 948.0, "total": 276.0, "to_code_ratio": 2.46, "url_in_comments": 1.0, "code_in_comments": 4.0, "base64_in_comments": 6.0, "high_entropy_comments": 37.0 }, "functions": { "count": 89.0, "avg_params": 2.08, "max_params": 8.0, "one_liners": 82.0, "length_stddev": 1.8, "avg_name_length": 18.4, "no_params_count": 7.0, "avg_length_lines": 1.51, "max_length_lines": 10.0, "min_length_lines": 1.0, "many_params_count": 1.0, "high_entropy_names": 41.0, "avg_param_name_length": 8.54, "density_per_100_lines": 6.68, "code_in_functions_ratio": 0.1 }, "identifiers": { "count": 249.0, "total": 583.0, "avg_length": 14.49, "max_length": 31.0, "min_length": 2.0, "avg_entropy": 3.15, "reuse_ratio": 0.54, "unique_count": 316.0, "length_stddev": 6.73, "has_digit_ratio": 0.01, "high_entropy_count": 97.0, "high_entropy_ratio": 0.31, "all_lowercase_ratio": 0.49, "all_uppercase_ratio": 0.26, "numeric_suffix_count": 2.0 } } }, "id": 5, "mol": "O(As)", "path": "/data/samples/unknown/foraged/php/packagist.org/_/satwareag/php-firebird-stubs/satwareag-php-firebird-stubs-v12.1.0-rc.4.zip!!satwareAG-php-firebird-stubs-043e3c7/firebird-stubs.php", "risk": 1, "sha": "692cb40ce859e596e9ad701e0ee1a830725b2d2f89d12ec66cd2bbaff03ae541", "size": 42168, "traits": [ { "id": "objectives/impact/destroy/keywords::delete-verb--delete", "conf": 0.8999999761581421, "crit": 1, "desc": "Destructive-action word: delete", "spans": [ [ 35340, 6 ] ] }, { "id": "objectives/anti-static/obfuscation/code-metrics/identifiers::php-many-short-functions", "atk": "T1027", "mbc": "B0032", "conf": 0.75, "crit": 3, "desc": "Many one-line PHP functions", "spans": [ [ 0, 28 ] ] }, { "id": "objectives/credential-access/theft/keywords::password", "crit": 1, "desc": "Credential-access vocabulary word: password", "spans": [ [ 9452, 8 ] ] } ], "type": "php" }, { "ctx": [ { "b": "ju)^#z#", "n": [ { "c": 1, "d": "High comment-to-code ratio", "i": "metadata/file/metrics::high-comment-to-code-ratio", "o": 0, "z": 29, "cf": 1.0 } ], "ln": 1, "addr": 0 }, { "b": "", "ln": 2, "addr": 6 }, { "b": "fdFB", "ln": 3, "addr": 7 }, { "b": "asXHgnkHA#x(W=]x(W-bp^!84l#)0+wPw[(BAI5lasIhtz^N9=x(W-k", "ln": 4, "addr": 11 }, { "b": "asW", "ln": 5, "addr": 56 }, { "b": "asXHjBAI4nwmYm!vrb^#x(v)gazbLjaARpdaAg\u003efuUi+YA+3q7CYWImB7]MgaMv{oayMylwPh6#vru66p^!84wo8ycwPv", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 80, "z": 3, "cf": 0.800000011920929 } ], "ln": 6, "addr": 59 }, { "b": "asXHRB7]J8aARpdar\u003eAbx(W-Ba%ooLp9sH@wObU3e*abbx(+z9C5I89B0a$hy\u00260*bx(v(iCwhejaw+Q9cVZztB-7-awN\u003e", "ln": 7, "addr": 134 }, { "b": "asXHMwn+*!x(W=]x(W-bwo8ycwPw[wb4+LfwNYv]wi7[Sl@M\u0026fe=", "ln": 8, "addr": 209 }, { "b": "asW", "ln": 12, "addr": 356 }, { "b": "asXH5CWUDdy?kT", "ln": 13, "addr": 359 }, { "b": "asXGRas7]pzY?g=zE[2mp^!8ccUu?4A+4jAz/Z1-y\u0026r/(y?N:dBus2xzEEx[jUH$!AXzlyvLqtcA+eY]A+3?lvrt{hzfYV3e[OT6cOb", "n": [ { "c": 2, "d": "Hardcoded localhost network host", "i": "micro-behaviors/communications/ip/literal::localhost-source", "o": 403, "z": 9, "cf": 0.75 } ], "ln": 14, "addr": 371 }, { "b": "asXGRarR^HarR^HarR^HarR^HcSseDl{:f!efDrSvrlK4A+/licN?a", "ln": 15, "addr": 454 }, { "b": "asW", "ln": 16, "addr": 498 }, { "b": "asXH0v@DsiA+Pf1BrAs)gbQTsfFUKeB76fmvrb{4k$p", "ln": 20, "addr": 604 }, { "b": "asXH0y?Wx\u003czGxwiarTGKp+sEQfFKX-BAzFyiXJdgCxUVUxMbOwwPPOwx\u003e7Z(B7E0XuOBh!BA?)", "ln": 21, "addr": 639 }, { "b": "asXH0y?W^5arR^HarUutBz#pZfe3%LBzb/ae[n*pflpMzCvtJ6k$rOExMbLnx(W=]x(W.", "n": [ { "c": 1, "d": "Encoded URL documentation context", "i": "micro-behaviors/communications/url/encoded::encoded-url-doc-context", "o": 702, "z": 19, "cf": 0.8999999761581421 } ], "ln": 22, "addr": 699 }, { "b": "asW", "ln": 23, "addr": 755 }, { "b": "asXH0B7]J4wGS@+fFk3", "ln": 24, "addr": 758 }, { "b": "w[=c\u003ey-)k7vrlGjp^!8^mNxWAl%\u0026r1zGx]dzGG}", "ln": 39, "addr": 1063 }, { "b": "DJ", "ln": 40, "addr": 1095 }, { "b": "arR^Hfe1EcLZ}+TFfmi$zF\u003c2}BzkVhatj\u003cFx\u003c\u003e*?v@@\u00264BAzLqvS=^7B0fFbFz#/z\u0026/[#MLZ}+TFz#/z\u0026/[#MLZ}+TFz#/z\u0026/[#MLZ}+TFz#/z\u0026/[#MLZ}+TFz#/z\u0026/[#MLZ}+TFz#/z\u0026/[#MLZ}+TFz#/z\u0026/[#MLZ}+TFz#/z\u0026/[#MLZ}+TFz#/z", "n": [ { "c": 2, "d": "Box drawing text banner", "i": "metadata/file/format::box-drawing-banner", "o": 1143, "z": 102, "cf": 0.8999999761581421 } ], "ln": 41, "addr": 1097 }, { "b": "", "ln": 42, "addr": 1246 }, { "b": "arR^HfdFB]kYZTSv}u=xe?![iax8chay]g{y?m9#asF@!z/M%Rdj#.)f8", "ln": 43, "addr": 1247 }, { "b": "arR^HAckSax\u003e5n}z/fSravXW?qBB\u003eTr8=+5q:\u003cO+nKC{No\u00261eGmP\u003c7#q:\u003cObarR^\u0026atCM9fGP", "ln": 120, "addr": 4714 }, { "b": "", "ln": 121, "addr": 4773 }, { "b": "arR^HfdFB]kYZTSv}u=xe\u0026balavG^SwPRGaB-RbmasIqxBu$1\u003cA+P09By=Osx([2hB-RbmzEEx[dj#.)f8", "n": [ { "c": 1, "d": "Destructive-action word: delete", "i": "objectives/impact/destroy/keywords::delete-verb--delete", "o": 4795, "z": 6, "cf": 0.8999999761581421 } ], "ln": 122, "addr": 4774 }, { "b": "arR^HAckSax\u003e5n}z/fSravXW?qBB\u003eTr8=+5q:\u003cO+nKC{Nl}6^rr7gd]q:\u003cObarR^\u0026atCM9f/]", "ln": 123, "addr": 4840 }, { "b": "", "ln": 124, "addr": 4899 }, { "b": "asXGRarR^HarR^HarR^HarR^HarR^Hp^!8uiZ#CcqBB\u003e\u003eswAj3ml%sGlR*AJnMnUTl[7g", "ln": 158, "addr": 6261 }, { "b": "asXGRas7]pz.jdZwOkZ{rb#z+B75N2x(v(qdlv", "ln": 159, "addr": 6317 }, { "b": "asXGRas7]pz.jd:CX7wkb1UKdmn^8cnLSkXaAO.Ov@Dfjaxy^4ryG?ec]0d{dlv", "n": [ { "c": 3, "d": "SQLite INSERT statement", "i": "micro-behaviors/data/db/sqlite::sqlite-insert-statement", "o": 6365, "z": 11, "cf": 0.75 }, { "c": 1, "d": "PHP shell execution function", "i": "objectives/command-and-control/reverse-shell/dup::php-shell-exec-func-a", "o": 6359, "z": 5, "cf": 0.8500000238418579 } ], "ln": 160, "addr": 6348 }, { "b": "asXGRas7]pz.jd.z/6u9BsnO1", "ln": 161, "addr": 6399 }, { "b": "asW", "ln": 162, "addr": 6420 }, { "b": "asXGRat1ZFvRG\u003c[uU%v@vp9LNByupBaz++kByfb#vR/Q%atj\u003cNx(!x6w[+*)woe)MFrRf3gDd8", "ln": 218, "addr": 9155 }, { "b": "asXGRat1ZFvRG\u003c[uUap*vq]^+y?X05A:-=bfcB?Ev{%s/uUK4ZzGGP8x\u003eqrc\u0026^^mobqRnn", "ln": 219, "addr": 9215 }, { "b": "asXGRat1ZFvRG\u003c[uT^?\u0026vQBj$B-7X$By=NFaz2O4B7DEEazbCjB7=YQFrRf3gDde", "n": [ { "c": 1, "d": "Destructive-action word: erase", "i": "objectives/impact/destroy/keywords::delete-verb--erase", "o": 9301, "z": 5, "cf": 0.8999999761581421 } ], "ln": 220, "addr": 9272 }, { "b": "asXGRat1ZFvRG\u003c[uT^?\u0026vQAX\u003eAbP=sasItIazbt7wHO+YFrRf3gDdh", "ln": 221, "addr": 9324 }, { "b": "asXGRat1ZFvRG\u003c[uU0.SB.q*Iay]RiA9)c!vS=r\u003cx(mK3atj\u003cVA:-D?aMv{oar@W3hV", "ln": 222, "addr": 9368 } ], "depth": 1, "facts": { "imp": [ [ "", "extension_loaded" ] ], "tgt": [ "extension_loaded" ], "metrics": { "ast": { "max_depth": 7.0, "call_count": 1.0, "node_count": 341.0, "identifier_count": 31.0, "string_literal_count": 1.0 }, "file": { "size": 9669.0, "entropy": 5.38, "size_bytes": 9669.0 }, "text": { "digit_ratio": 0.06, "space_count": 1590.0, "total_lines": 229.0, "char_entropy": 5.38, "unique_chars": 94.0, "string_density": 0.0, "avg_line_length": 41.22, "high_byte_ratio": 0.1, "max_line_length": 174.0, "non_ascii_ratio": 0.1, "empty_line_ratio": 0.17, "last_line_length": 3.0, "long_token_count": 7.0, "whitespace_ratio": 0.19, "most_common_ratio": 0.05, "identifier_density": 0.14, "line_length_stddev": 34.82, "normalized_string_count": 0.07, "repeated_char_sequences": 10.0, "most_common_char_is_null": 0.0, "suspicious_comment_ratio": 0.24, "max_inline_whitespace_run": 22.0, "most_common_char_codepoint": 101.0, "normalized_unique_identifiers": 3.95 }, "calls": { "count": 1.0 }, "binary": { "overall_entropy": 5.38, "peak_region_bytes": 9216.0, "peak_region_entropy": 5.28 }, "source": { "class_count": 1.0, "function_count": 1.0 }, "strings": { "total": 1.0, "avg_length": 9.0, "max_length": 9.0, "avg_entropy": 2.95, "total_bytes": 9.0 }, "comments": { "chars": 7645.0, "lines": 152.0, "total": 38.0, "to_code_ratio": 1.97, "url_in_comments": 1.0, "code_in_comments": 1.0, "base64_in_comments": 1.0, "high_entropy_comments": 8.0 }, "functions": { "count": 2.0, "one_liners": 1.0, "avg_name_length": 11.0, "no_params_count": 1.0, "avg_length_lines": 1.0, "max_length_lines": 1.0, "min_length_lines": 1.0, "density_per_100_lines": 0.44, "code_in_functions_ratio": 0.0 }, "identifiers": { "count": 31.0, "total": 31.0, "avg_length": 24.0, "max_length": 38.0, "min_length": 11.0, "avg_entropy": 3.5, "reuse_ratio": 1.0, "unique_count": 31.0, "length_stddev": 5.54, "high_entropy_count": 17.0, "high_entropy_ratio": 0.55, "all_lowercase_ratio": 0.06, "all_uppercase_ratio": 0.9, "underscore_prefix_count": 1.0 } } }, "id": 6, "mol": "H(Db)", "path": "/data/samples/unknown/foraged/php/packagist.org/_/satwareag/php-firebird-stubs/satwareag-php-firebird-stubs-v12.1.0-rc.4.zip!!satwareAG-php-firebird-stubs-043e3c7/pdo-fbird-stubs.php", "risk": 1, "sha": "557c49887dc32c89e5091913d41e388cd87f118dd6347ffc8df6f09166a68998", "size": 9669, "traits": [ { "id": "micro-behaviors/data/db/sqlite::sqlite-insert-statement", "conf": 0.75, "crit": 3, "desc": "SQLite INSERT statement", "spans": [ [ 6365, 11 ] ] }, { "id": "micro-behaviors/data/db/sql::sql-insert", "crit": 3, "desc": "INSERT INTO SQL keyword", "spans": [ [ 6365, 11 ] ] }, { "id": "objectives/impact/destroy/keywords::delete-verb--erase", "conf": 0.8999999761581421, "crit": 1, "desc": "Destructive-action word: erase", "spans": [ [ 9301, 5 ] ] }, { "id": "objectives/impact/destroy/keywords::delete-verb--delete", "conf": 0.8999999761581421, "crit": 1, "desc": "Destructive-action word: delete", "spans": [ [ 4795, 6 ] ] } ], "type": "php" }, { "id": 7, "mol": "Md", "sha": "20064fe2c98f8bd40f0a280de635545b800c1045265c9fbc8b8f2665b58c3bbf", "path": "satwareag_php-firebird-stubs@v12.1.0-rc.4.registry.json", "risk": 1, "size": 852, "type": "registry", "depth": 1 } ], "omitted_files": 1, "rev": "d1009", "v": "8" } }