{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9915806651115417, "class": 2 } ], "prob": 0.99158067, "class": 2, "models": [ { "m": "az", "prob": 0.5318722, "class": 0 }, { "m": "az/scripts", "prob": 0.7684686, "class": 0 }, { "m": "az/php", "prob": 0.99158067, "class": 2 } ], "version": "v16.16", "thresholds": [ 0.9961138, 0.99909174 ], "analyzed_at": "2026-05-09T19:20:34Z" }, "path": "anti7.php", "raw": { "v": "4", "fs": [ { "f": "O₃(AlC₂As)H₂(Cm₂Db)Md", "k": { "source.imports[0]": "getenv", "source.imports[1]": "header", "source.imports[2]": "preg_match", "source.imports[3]": "strtolower", "source.imports[4]": "substr_count", "source.strings[0]": "#!bgpalw.dlldof!/", "source.strings[1]": "007ac9", "source.strings[2]": "192.comagent", "source.strings[3]": "200pleasebot", "source.strings[4]": "360spider", "source.strings[5]": "4seohuntbot", "source.strings[6]": "68.65.53.71", "source.strings[7]": "HTTP_USER_AGENT", "source.strings[8]": "Location: http://2m.ma", "source.strings[9]": "REMOTE_ADDR", "source.has_imports": true, "source.strings[10]": "^1.234.41.*", "source.strings[11]": "^104.131.223.*", "source.strings[12]": "^107.170.*.*", "source.strings[13]": "^107.178.194.*", "source.strings[14]": "^107.178.195.*", "source.strings[15]": "^107.20.181.*", "source.strings[16]": "^108.162.215.*", "source.strings[17]": "^108.162.246.*", "source.strings[18]": "^109.186.*.*", "source.strings[19]": "^12.148.196.*", "source.strings[20]": "^12.148.209.*", "source.strings[21]": "^124.66.185.*", "source.strings[22]": "^128.242.*.*", "source.strings[23]": "^131.*.*.*", "source.strings[24]": "^131.212.*.*", "source.strings[25]": "^131.253.*.*", "source.strings[26]": "^133.11.204.*", "source.strings[27]": "^141.101.104.*", "source.strings[28]": "^149.20.*.*", "source.strings[29]": "^149.20.54.*", "source.strings[30]": "^157.*.*.*", "source.strings[31]": "^157.54.*.*", "source.strings[32]": "^158.108.*.*", "source.strings[33]": "^162.158.*.*", "source.strings[34]": "^162.158.7.*", "source.strings[35]": "^162.158.72.*", "source.strings[36]": "^162.158.95.*", "source.strings[37]": "^167.24.*.*", "source.strings[38]": "^168.188.*.*", "source.strings[39]": "^173.194.*.*", "source.strings[40]": "^173.245.55.*", "source.strings[41]": "^176.195.231.*", "source.strings[42]": "^178.43.117.*", "source.strings[43]": "^184.173.*.*", "source.strings[44]": "^185.2.138.*", "source.strings[45]": "^188.165.83.*", "source.strings[46]": "^188.244.39.*", "source.strings[47]": "^192.115.134.*", "source.strings[48]": "^192.118.48.*", "source.strings[49]": "^192.232.213.*", "source.strings[50]": "^193.220.178.*", "source.strings[51]": "^193.253.199.*", "source.strings[52]": "^193.47.80.*", "source.strings[53]": "^194.153.113.*", "source.strings[54]": "^194.52.68.*", "source.strings[55]": "^194.72.238.*", "source.strings[56]": "^194.90.*.*", "source.strings[57]": "^195.128.227.*", "source.strings[58]": "^198.25.*.*", "source.strings[59]": "^198.41.243.*", "source.strings[60]": "^198.54.*.*", "source.strings[61]": "^198.60.236.*", "source.strings[62]": "^202.*.*.*", "source.strings[63]": "^202.108.252.*", "source.strings[64]": "^202.160.*.*", "source.strings[65]": "^204.*.*.*", "source.strings[66]": "^204.14.48.*", "source.strings[67]": "^206.207.*.*", "source.strings[68]": "^206.253.226.*", "source.strings[69]": "^206.28.72.*", "source.strings[70]": "^207.*.*.*", "source.strings[71]": "^207.126.144.*", "source.strings[72]": "^207.46.*.*", "source.strings[73]": "^207.68.*.*", "source.strings[74]": "^208.65.144.*", "source.strings[75]": "^209.191.*.*", "source.strings[76]": "^209.73.228.*", "source.strings[77]": "^209.85.*.*", "source.strings[78]": "^209.85.128.*", "source.strings[79]": "^212.143.*.*", "source.strings[80]": "^212.150.*.*", "source.strings[81]": "^212.235.*.*", "source.strings[82]": "^212.29.192.*", "source.strings[83]": "^212.29.224.*", "source.strings[84]": "^212.50.193.*", "source.strings[85]": "^212.8.79.*", "source.strings[86]": "^213.*.*.*", "source.strings[87]": "^216.239.*.*", "source.strings[88]": "^216.239.32.*", "source.strings[89]": "^216.252.167.*", "source.strings[90]": "^217.132.*.*", "source.strings[91]": "^217.74.103.*", "source.strings[92]": "^219.*.*.*", "source.strings[93]": "^37.140.188.*", "source.strings[94]": "^38.100.*.*", "source.strings[95]": "^38.105.*.*", "source.strings[96]": "^38.144.36.*", "source.strings[97]": "^38.74.138.*", "source.strings[98]": "^46.116.*.* ", "source.strings[99]": "^46.244.*.*", "source.strings[100]": "^46.4.120.*", "source.strings[101]": "^50.7.*.*", "source.strings[102]": "^50.97.*.*", "source.strings[103]": "^54.176.*.*", "source.strings[104]": "^62.116.207.*", "source.strings[105]": "^62.141.65.*", "source.strings[106]": "^62.90.*.*", "source.strings[107]": "^62.99.77.*", "source.strings[108]": "^63.*.*.*", "source.strings[109]": "^64.*.*.*", "source.strings[110]": "^64.106.213.*", "source.strings[111]": "^64.124.14.*", "source.strings[112]": "^64.18.*.*", "source.strings[113]": "^64.233.160.*", "source.strings[114]": "^64.233.191.*", "source.strings[115]": "^64.233.191.255*", "source.strings[116]": "^64.27.2.*", "source.strings[117]": "^64.37.103.*", "source.strings[118]": "^64.4.*.*", "source.strings[119]": "^64.62.136.*", "source.strings[120]": "^64.62.175.*", "source.strings[121]": "^65.*.*.*", "source.strings[122]": "^65.52.*.*", "source.strings[123]": "^66.102.*.*", "source.strings[124]": "^66.150.14.*", "source.strings[125]": "^66.196.*.*", "source.strings[126]": "^66.205.64.*", "source.strings[127]": "^66.207.120.*", "source.strings[128]": "^66.211.160.86*", "source.strings[129]": "^66.221.*.*", "source.strings[130]": "^66.228.*.*", "source.strings[131]": "^66.249.*.*", "source.strings[132]": "^67.15.*.*", "source.strings[133]": "^67.195.*.*", "source.strings[134]": "^67.209.128.*", "source.strings[135]": "^68.*.*.*", "source.strings[136]": "^68.142.*.*", "source.strings[137]": "^69.164.145.*", "source.strings[138]": "^69.61.12.*", "source.strings[139]": "^69.65.*.*", "source.strings[140]": "^72.14.*.*", "source.strings[141]": "^72.14.192.*", "source.strings[142]": "^72.30.*.*", "source.strings[143]": "^72.52.96.*", "source.strings[144]": "^74.125.*.*", "source.strings[145]": "^74.6.*.*", "source.strings[146]": "^78.148.13.*", "source.strings[147]": "^8.12.*.*", "source.strings[148]": "^82.166.*.*", "source.strings[149]": "^83.31.118.*", "source.strings[150]": "^83.31.69.*", "source.strings[151]": "^85.250.*.*", "source.strings[152]": "^85.64.*.*", "source.strings[153]": "^85.9.7.*", "source.strings[154]": "^87.106.251.*", "source.strings[155]": "^89.138.*.*", "source.strings[156]": "^91.231.*.*", "source.strings[157]": "^91.231.212.*", "source.strings[158]": "^92.103.69.*", "source.strings[159]": "^93.172.*.*", "source.strings[160]": "^93.54.82.*", "source.strings[161]": "^94.26.*.*", "source.strings[162]": "^95.108.194.*", "source.strings[163]": "^95.85.*.*", "source.strings[164]": "^98.136.*.*", "source.strings[165]": "a6-indexer", "source.strings[166]": "aboundexbot", "source.strings[167]": "aboutusbot", "source.strings[168]": "abrave spider", "source.strings[169]": "accelobot", "source.strings[170]": "acoonbot", "source.strings[171]": "acunetix", "source.strings[172]": "addthis.com", "source.strings[173]": "admantx", "source.strings[174]": "adsbot-google", "source.strings[175]": "ahrefsbot", "source.strings[176]": "alexabot", "source.strings[177]": "amagit.com", "source.strings[178]": "amazonaws", "source.strings[179]": "amznkassocbot", "source.strings[180]": "analytics", "source.strings[181]": "antbot", "source.strings[182]": "apache-httpclient", "source.strings[183]": "apercite", "source.strings[184]": "aportworm", "source.strings[185]": "arabot", "source.strings[186]": "calyxinstitute", "source.strings[187]": "crawler", "source.strings[188]": "cyveillance", "source.strings[189]": "dreamhost", "source.strings[190]": "google", "source.strings[191]": "hotmail", "source.strings[192]": "hotmail!", "source.strings[193]": "jabber", "source.strings[194]": "jetbrains", "source.strings[195]": "lssrocketcrawler", "source.strings[196]": "netpilot", "source.strings[197]": "netsparker", "source.strings[198]": "outlook", "source.strings[199]": "outlook!", "source.strings[200]": "phishtank", "source.strings[201]": "softlayer", "source.strings[202]": "tor-exit", "source.strings[203]": "urlredirectresolver", "source.strings[204]": "windows 95", "source.strings[205]": "windows 98" }, "x": 37, "id": 0, "is": [ "preg_match", "header", "getenv", "strtolower", "substr_count", "strtolower", "header" ], "ms": { "file": { "size": 4941.0 }, "text": { "tab_count": 62.0, "digit_ratio": 0.62, "space_count": 394.0, "total_lines": 87.0, "char_entropy": 5.1, "mixed_indent": true, "unique_chars": 93.0, "import_density": 8.05, "lines_over_200": 1.0, "lines_over_500": 1.0, "string_density": 5.75, "avg_line_length": 54.82, "high_byte_ratio": 0.09, "lines_over_1000": 1.0, "max_line_length": 2915.0, "non_ascii_ratio": 0.09, "empty_line_ratio": 0.02, "last_line_length": 2.0, "most_common_char": ".", "whitespace_ratio": 0.13, "most_common_ratio": 0.12, "identifier_density": 0.29, "line_length_stddev": 309.41, "normalized_import_count": 0.75, "normalized_string_count": 53.61, "repeated_char_sequences": 2.0, "suspicious_comment_ratio": 1.0, "max_inline_whitespace_run": 7.0, "trailing_whitespace_lines": 3.0, "normalized_unique_identifiers": 1.86 }, "imports": { "total": 7.0, "unique_modules": 5.0, "third_party_count": 7.0, "third_party_ratio": 1.0 }, "strings": { "total": 500.0, "ip_count": 2.0, "avg_length": 11.04, "max_length": 22.0, "avg_entropy": 2.72, "total_bytes": 5518.0, "domain_count": 4.0, "entropy_stddev": 0.49 }, "comments": { "chars": 608.0, "lines": 8.0, "total": 1.0, "to_code_ratio": 0.1, "url_in_comments": 1.0, "base64_in_comments": 1.0 }, "functions": {}, "identifiers": { "total": 25.0, "avg_length": 6.5, "max_length": 13.0, "min_length": 2.0, "avg_entropy": 2.18, "reuse_ratio": 0.48, "unique_count": 12.0, "length_stddev": 3.8, "has_digit_ratio": 0.08, "all_lowercase_ratio": 0.83, "all_uppercase_ratio": 0.08, "numeric_suffix_count": 1.0, "underscore_prefix_count": 1.0 } }, "ss": [ [ 636, "REMOTE_ADDR" ], [ 637, "REMOTE_ADDR" ], [ 668, "^94.26.*.*" ], [ 669, "^94.26.*.*" ], [ 682, "^95.85.*.*" ], [ 683, "^95.85.*.*" ], [ 696, "^72.52.96.*" ], [ 697, "^72.52.96.*" ], [ 711, "^212.8.79.*" ], [ 712, "^212.8.79.*" ], [ 726, "^62.99.77.*" ], [ 727, "^62.99.77.*" ], [ 741, "^83.31.118.*" ], [ 742, "^83.31.118.*" ], [ 757, "^91.231.*.*" ], [ 758, "^91.231.*.*" ], [ 772, "^206.207.*.*" ], [ 773, "^206.207.*.*" ], [ 788, "^91.231.212.*" ], [ 789, "^91.231.212.*" ], [ 805, "^62.99.77.*" ], [ 806, "^62.99.77.*" ], [ 820, "^198.41.243.*" ], [ 821, "^198.41.243.*" ], [ 837, "^162.158.*.*" ], [ 838, "^162.158.*.*" ], [ 853, "^162.158.7.*" ], [ 854, "^162.158.7.*" ], [ 869, "^162.158.72.*" ], [ 870, "^162.158.72.*" ], [ 886, "^173.245.55.*" ], [ 887, "^173.245.55.*" ], [ 903, "^108.162.246.*" ], [ 904, "^108.162.246.*" ], [ 921, "^162.158.95.*" ], [ 922, "^162.158.95.*" ], [ 938, "^108.162.215.*" ], [ 939, "^108.162.215.*" ], [ 956, "^95.108.194.*" ], [ 957, "^95.108.194.*" ], [ 973, "^141.101.104.*" ], [ 974, "^141.101.104.*" ], [ 991, "^93.54.82.*" ], [ 992, "^93.54.82.*" ], [ 1006, "^69.164.145.*" ], [ 1007, "^69.164.145.*" ], [ 1023, "^194.153.113.*" ], [ 1024, "^194.153.113.*" ], [ 1041, "^178.43.117.*" ], [ 1042, "^178.43.117.*" ], [ 1058, "^62.141.65.*" ], [ 1059, "^62.141.65.*" ], [ 1074, "^83.31.69.*" ], [ 1075, "^83.31.69.*" ], [ 1089, "^107.178.195.*" ], [ 1090, "^107.178.195.*" ], [ 1107, "^149.20.54.*" ], [ 1108, "^149.20.54.*" ], [ 1123, "^85.9.7.*" ], [ 1124, "^85.9.7.*" ], [ 1136, "^87.106.251.*" ], [ 1137, "^87.106.251.*" ], [ 1153, "^107.178.194.*" ], [ 1154, "^107.178.194.*" ], [ 1171, "^124.66.185.*" ], [ 1172, "^124.66.185.*" ], [ 1188, "^133.11.204.*" ], [ 1189, "^133.11.204.*" ], [ 1205, "^185.2.138.*" ], [ 1206, "^185.2.138.*" ], [ 1221, "^188.165.83.*" ], [ 1222, "^188.165.83.*" ], [ 1238, "^78.148.13.*" ], [ 1239, "^78.148.13.*" ], [ 1254, "^192.232.213.*" ], [ 1255, "^192.232.213.*" ], [ 1272, "^1.234.41.*" ], [ 1273, "^1.234.41.*" ], [ 1287, "^124.66.185.*" ], [ 1288, "^124.66.185.*" ], [ 1304, "^87.106.251.*" ], [ 1305, "^87.106.251.*" ], [ 1321, "^176.195.231.*" ], [ 1322, "^176.195.231.*" ], [ 1339, "^206.253.226.*" ], [ 1340, "^206.253.226.*" ], [ 1357, "^107.20.181.*" ], [ 1358, "^107.20.181.*" ], [ 1374, "^188.244.39.*" ], [ 1375, "^188.244.39.*" ], [ 1391, "^124.66.185.*" ], [ 1392, "^124.66.185.*" ], [ 1408, "^38.74.138.*" ], [ 1409, "^38.74.138.*" ], [ 1424, "^124.66.185.*" ], [ 1425, "^124.66.185.*" ], [ 1441, "^38.74.138.*" ], [ 1442, "^38.74.138.*" ], [ 1457, "^206.253.226.*" ], [ 1458, "^206.253.226.*" ], [ 1475, "^1.234.41.*" ], [ 1476, "^1.234.41.*" ], [ 1490, "^124.66.185.*" ], [ 1491, "^124.66.185.*" ], [ 1507, "^87.106.251.*" ], [ 1508, "^87.106.251.*" ], [ 1524, "^85.9.7.*" ], [ 1525, "^85.9.7.*" ], [ 1537, "^37.140.188.*" ], [ 1538, "^37.140.188.*" ], [ 1554, "^195.128.227.*" ], [ 1555, "^195.128.227.*" ], [ 1572, "^38.74.138.*" ], [ 1573, "^38.74.138.*" ], [ 1588, "^107.20.181.*" ], [ 1589, "^107.20.181.*" ], [ 1605, "^104.131.223.*" ], [ 1606, "^104.131.223.*" ], [ 1623, "^46.4.120.*" ], [ 1624, "^46.4.120.*" ], [ 1638, "^107.178.194.*" ], [ 1639, "^107.178.194.*" ], [ 1656, "^198.60.236.*" ], [ 1657, "^198.60.236.*" ], [ 1673, "^217.74.103.*" ], [ 1674, "^217.74.103.*" ], [ 1690, "^92.103.69.*" ], [ 1691, "^92.103.69.*" ], [ 1706, "^217.74.103.*" ], [ 1707, "^217.74.103.*" ], [ 1723, "^66.211.160.86*" ], [ 1724, "^66.211.160.86*" ], [ 1742, "^46.244.*.*" ], [ 1743, "^46.244.*.*" ], [ 1757, "^131.*.*.*" ], [ 1758, "^131.*.*.*" ], [ 1771, "^157.*.*.*" ], [ 1772, "^157.*.*.*" ], [ 1785, "^202.*.*.*" ], [ 1786, "^202.*.*.*" ], [ 1799, "^204.*.*.*" ], [ 1800, "^204.*.*.*" ], [ 1813, "^207.*.*.*" ], [ 1814, "^207.*.*.*" ], [ 1827, "^213.*.*.*" ], [ 1828, "^213.*.*.*" ], [ 1841, "^219.*.*.*" ], [ 1842, "^219.*.*.*" ], [ 1855, "^63.*.*.*" ], [ 1856, "^63.*.*.*" ], [ 1868, "^64.*.*.*" ], [ 1869, "^64.*.*.*" ], [ 1881, "^65.*.*.*" ], [ 1882, "^65.*.*.*" ], [ 1894, "^68.*.*.*" ], [ 1895, "^68.*.*.*" ], [ 1907, "^64.*.*.*" ], [ 1908, "^64.*.*.*" ], [ 1920, "^64.233.160.*" ], [ 1921, "^64.233.160.*" ], [ 1937, "^64.233.191.*" ], [ 1938, "^64.233.191.*" ], [ 1954, "^64.233.191.255*" ], [ 1955, "^64.233.191.255*" ], [ 1975, "^66.102.*.*" ], [ 1976, "^66.102.*.*" ], [ 1990, "^66.249.*.*" ], [ 1991, "^66.249.*.*" ], [ 2005, "^72.14.*.*" ], [ 2006, "^72.14.*.*" ], [ 2019, "^74.125.*.*" ], [ 2020, "^74.125.*.*" ], [ 2034, "^209.85.*.*" ], [ 2035, "^209.85.*.*" ], [ 2049, "^216.239.*.*" ], [ 2050, "^216.239.*.*" ], [ 2065, "^64.4.*.*" ], [ 2066, "^64.4.*.*" ], [ 2078, "^65.52.*.*" ], [ 2079, "^65.52.*.*" ], [ 2092, "^131.253.*.*" ], [ 2093, "^131.253.*.*" ], [ 2108, "^157.54.*.*" ], [ 2109, "^157.54.*.*" ], [ 2123, "^207.46.*.*" ], [ 2124, "^207.46.*.*" ], [ 2138, "^207.68.*.*" ], [ 2139, "^207.68.*.*" ], [ 2153, "^8.12.*.*" ], [ 2154, "^8.12.*.*" ], [ 2166, "^66.196.*.*" ], [ 2167, "^66.196.*.*" ], [ 2181, "^66.228.*.*" ], [ 2182, "^66.228.*.*" ], [ 2196, "^67.195.*.*" ], [ 2197, "^67.195.*.*" ], [ 2211, "^68.142.*.*" ], [ 2212, "^68.142.*.*" ], [ 2226, "^72.30.*.*" ], [ 2227, "^72.30.*.*" ], [ 2240, "^74.6.*.*" ], [ 2241, "^74.6.*.*" ], [ 2253, "^98.136.*.*" ], [ 2254, "^98.136.*.*" ], [ 2268, "^202.160.*.*" ], [ 2269, "^202.160.*.*" ], [ 2284, "^209.191.*.*" ], [ 2285, "^209.191.*.*" ], [ 2300, "^66.102.*.*" ], [ 2301, "^66.102.*.*" ], [ 2315, "^38.100.*.*" ], [ 2316, "^38.100.*.*" ], [ 2330, "^107.170.*.*" ], [ 2331, "^107.170.*.*" ], [ 2346, "^149.20.*.*" ], [ 2347, "^149.20.*.*" ], [ 2361, "^38.105.*.*" ], [ 2362, "^38.105.*.*" ], [ 2376, "^74.125.*.*" ], [ 2377, "^74.125.*.*" ], [ 2392, "^66.150.14.*" ], [ 2393, "^66.150.14.*" ], [ 2408, "^54.176.*.*" ], [ 2409, "^54.176.*.*" ], [ 2423, "^38.100.*.*" ], [ 2424, "^38.100.*.*" ], [ 2438, "^184.173.*.*" ], [ 2439, "^184.173.*.*" ], [ 2454, "^66.249.*.*" ], [ 2455, "^66.249.*.*" ], [ 2469, "^128.242.*.*" ], [ 2470, "^128.242.*.*" ], [ 2485, "^72.14.192.*" ], [ 2486, "^72.14.192.*" ], [ 2501, "^208.65.144.*" ], [ 2502, "^208.65.144.*" ], [ 2518, "^74.125.*.*" ], [ 2519, "^74.125.*.*" ], [ 2533, "^209.85.128.*" ], [ 2534, "^209.85.128.*" ], [ 2550, "^216.239.32.*" ], [ 2551, "^216.239.32.*" ], [ 2567, "^74.125.*.*" ], [ 2568, "^74.125.*.*" ], [ 2582, "^207.126.144.*" ], [ 2583, "^207.126.144.*" ], [ 2600, "^173.194.*.*" ], [ 2601, "^173.194.*.*" ], [ 2616, "^64.233.160.*" ], [ 2617, "^64.233.160.*" ], [ 2633, "^72.14.192.*" ], [ 2634, "^72.14.192.*" ], [ 2649, "^66.102.*.*" ], [ 2650, "^66.102.*.*" ], [ 2664, "^64.18.*.*" ], [ 2665, "^64.18.*.*" ] ], "sz": 4941, "ts": [ { "c": 0.8600000143051147, "d": "Regex component marker", "e": [ "$_SERVER[" ], "i": "objectives/command-and-control/backdoor/webshell/ui::self-named-get-form--rx-4", "l": 1, "m": "B0030" }, { "c": 0.8999999761581421, "d": "Very long line", "e": [ "text.max_line_length = 2915.00" ], "i": "metadata/file/text/metrics::single-long-line", "l": 1 }, { "c": 0.949999988079071, "d": "PHP opening tag present", "e": [ "\u003c?php" ], "i": "metadata/lang/scripted::php-open-tag", "l": 2 }, { "c": 0.75, "d": "Generic $_SERVER superglobal access", "e": [ "$_SERVER" ], "i": "micro-behaviors/communications/http/request/params::server-dup", "l": 3 }, { "c": 0.8999999761581421, "d": "File has 30 or more lines", "e": [ "text.total_lines = 87.00" ], "i": "metadata/file/text/metrics::file-has-30-plus-lines", "l": 1 }, { "c": 0.699999988079071, "d": "\"please\" instruction cue", "e": [ "please" ], "i": "micro-behaviors/data/text/llm/action::llm-instruction-cue-please", "l": 1 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Exactly one line exceeds 1000 chars", "e": [ "text.lines_over_1000 = 1.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::single-long-line-outlier", "l": 1, "m": "B0032" }, { "c": 0.8500000238418579, "d": "Hardcoded external IPv4 address", "e": [ "68.65.53.71" ], "i": "micro-behaviors/communications/ip/literal::external-ipv4-script", "l": 4 }, { "c": 0.8500000238418579, "d": "Checks User-Agent for crawler detection", "e": [ "$_SERVER['HTTP_USER_AGENT']" ], "i": "objectives/anti-analysis/browser-detect::check-ua-server-var", "l": 3 }, { "a": "T1071.001", "c": 0.8500000238418579, "d": "Hardcoded external IPv4 address", "e": [ "68.65.53.71" ], "i": "objectives/command-and-control/infrastructure/ip::hardcoded-ipv4-script", "l": 3, "m": "C0002" } ], "sha": "7f197bea7551b97da74443bbde23b2112840e495587d359d50d8d462b6f7d0c0", "path": "/data/samples/bad/datasets/awesome-malware/PHP/anti7.php", "type": "php" } ], "tv": "0d82f" } }