{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9996302127838135, "class": 2 } ], "prob": 0.9996302, "class": 2, "models": [ { "m": "az", "prob": 0.9923373, "class": 0 }, { "m": "az/scripts", "prob": 0.998073, "class": 0 }, { "m": "az/php", "prob": 0.9996302, "class": 2 } ], "version": "v16.16", "thresholds": [ 0.9961138, 0.99909174 ], "analyzed_at": "2026-05-09T02:59:22Z" }, "path": "iC.3.php", "raw": { "v": "4", "fs": [ { "f": "O₅(C₇As₂AlDyI)H₅(CmCrDb₂F₃Os)Md", "k": { "source.imports[0]": "abs", "source.imports[1]": "base64_decode", "source.imports[2]": "base_url", "source.imports[3]": "basename", "source.imports[4]": "bcmul", "source.imports[5]": "count", "source.imports[6]": "crc32", "source.imports[7]": "curl_close", "source.imports[8]": "curl_exec", "source.imports[9]": "curl_init", "source.strings[0]": " \u003cchangefreq\u003edaily\u003c/changefreq\u003e", "source.strings[1]": " \u003clastmod\u003e", "source.strings[2]": " \u003cpriority\u003e0.9\u003c/priority\u003e", "source.strings[3]": " \u003cloc\u003e", "source.strings[4]": " \u003c/url\u003e", "source.strings[5]": " \u003curl\u003e", "source.strings[6]": " \u003curl\u003e\\r\\n \u003cloc\u003e", "source.strings[7]": " encoding=", "source.strings[8]": "\");\u003c/script\u003e\u003c/body\u003e\u003c/html\u003e", "source.strings[9]": ");\u003c/script\u003e\u003c/body\u003e\u003c/html\u003e", "source.has_imports": true, "source.imports[10]": "curl_setopt", "source.imports[11]": "date", "source.imports[12]": "die", "source.imports[13]": "dirname", "source.imports[14]": "empty", "source.imports[15]": "explode", "source.imports[16]": "fclose", "source.imports[17]": "file_exists", "source.imports[18]": "file_get_contents", "source.imports[19]": "filemtime", "source.imports[20]": "fopen", "source.imports[21]": "fread", "source.imports[22]": "function_exists", "source.imports[23]": "fwrite", "source.imports[24]": "get_cache", "source.imports[25]": "get_static_arr", "source.imports[26]": "get_temp_dir_mass", "source.imports[27]": "hashCode", "source.imports[28]": "header", "source.imports[29]": "http_get", "source.imports[30]": "ini_get", "source.imports[31]": "isBot", "source.imports[32]": "is_writeable", "source.imports[33]": "isset", "source.imports[34]": "local_host", "source.imports[35]": "local_url", "source.imports[36]": "md5", "source.imports[37]": "mt_rand", "source.imports[38]": "preg_match", "source.imports[39]": "rand_str", "source.imports[40]": "realpath", "source.imports[41]": "session_save_path", "source.imports[42]": "str_ireplace", "source.imports[43]": "stristr", "source.imports[44]": "strlen", "source.imports[45]": "strpos", "source.imports[46]": "strtolower", "source.imports[47]": "substr", "source.imports[48]": "substr_replace", "source.imports[49]": "sys_get_temp_dir", "source.imports[50]": "tempnam", "source.imports[51]": "time", "source.imports[52]": "unlink", "source.imports[53]": "urlencode", "source.strings[10]": "---------", "source.strings[11]": "/bot|crawl|spider|mediapartners|slurp|patrol/i", "source.strings[12]": "/sess_", "source.strings[13]": "\u003c!DOCTYPE html\u003e\u003chtml\u003e\u003cbody\u003e\u003cscript\u003edocument.location=(", "source.strings[14]": "\u003c!DOCTYPE html\u003e\u003chtml\u003e\u003cbody\u003e\u003cscript\u003edocument.location=(\"", "source.strings[15]": "\u003c/lastmod\u003e", "source.strings[16]": "\u003c/lastmod\u003e\\r\\n \u003cchangefreq\u003edaily\u003c/changefreq\u003e\\r\\n \u003cpriority\u003e0.9\u003c/priority\u003e\\r\\n \u003c/url\u003e\\r\\n", "source.strings[17]": "\u003c/loc\u003e", "source.strings[18]": "\u003c/loc\u003e\\r\\n \u003clastmod\u003e", "source.strings[19]": "\u003c/urlset\u003e", "source.strings[20]": "\u003c?xml version=", "source.strings[21]": "\u003c?xml version=\\\"1.0\\\" encoding=\\\"UTF-8\\\"?\u003e\\r\\n\u003curlset xmlns=\\\"http://www.google.com/schemas/sitemap/0.84\\\"\u003e\\r\\n", "source.strings[22]": "\u003ca href=", "source.strings[23]": "\u003ca href=\\", "source.strings[24]": "\u003curlset xmlns=", "source.strings[25]": "ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789abcdefghijklmnopqrstuvwxyz-_-_/", "source.strings[26]": "Content-type:text/xml", "source.strings[27]": "HTTP_ACCEPT_LANGUAGE", "source.strings[28]": "HTTP_REFERER", "source.strings[29]": "HTTP_USER_AGENT", "source.strings[30]": "HTTP_X_FORWARDED_PROTO", "source.strings[31]": "HTTP_X_FORWARDED_SSL", "source.strings[32]": "REQUEST_URI", "source.strings[33]": "SCRIPT_NAME", "source.strings[34]": "SERVER_NAME", "source.strings[35]": "SERVER_PORT", "source.strings[36]": "TMPDIR", "source.strings[37]": "Y-m-d-H-i", "source.strings[38]": "[ahref]", "source.strings[39]": "[area1]", "source.strings[40]": "[area2]", "source.strings[41]": "[areax]", "source.strings[42]": "[bracketl", "source.strings[43]": "[bracketr", "source.strings[44]": "[contact", "source.strings[45]": "[contact1]", "source.strings[46]": "[contact2]", "source.strings[47]": "[content]", "source.strings[48]": "[keyword", "source.strings[49]": "[keyword1]", "source.strings[50]": "[keyword2]", "source.strings[51]": "[keywordx]", "source.strings[52]": "[link]", "source.strings[53]": "[mkey1]", "source.strings[54]": "[mkey2]", "source.strings[55]": "[mkeyx]", "source.strings[56]": "[search]", "source.strings[57]": "[site1]", "source.strings[58]": "[site2]", "source.strings[59]": "[symbolx]", "source.strings[60]": "[time]", "source.strings[61]": "abcdefghijklmnopqrstuvwxyz", "source.strings[62]": "bracket", "source.strings[63]": "curl_init", "source.strings[64]": "file_get_contents", "source.strings[65]": "google-site-verification: google468d7b4c28db3fdc.html", "source.strings[66]": "google468d7b4c28db3fdc.html", "source.strings[67]": "http://", "source.strings[68]": "http://verm.xyz/data.php?g=git\u0026d=", "source.strings[69]": "http://www.google.com/schemas/sitemap/0.84", "source.strings[70]": "https://", "source.strings[71]": "index.php", "source.strings[72]": "keyword", "source.strings[73]": "keyword1", "source.strings[74]": "sitemap.xml", "source.strings[75]": "sys_get_temp_dir", "source.strings[76]": "upload_tmp_dir", "source.functions[0]": "_base_url", "source.functions[1]": "_get_cache", "source.functions[2]": "_get_static_arr", "source.functions[3]": "_get_temp_dir_mass", "source.functions[4]": "_http_get", "source.functions[5]": "_local_host", "source.functions[6]": "_local_url", "source.functions[7]": "hashCode", "source.functions[8]": "isBot", "source.functions[9]": "rand_str" }, "x": 190, "id": 0, "is": [ "get_temp_dir_mass", "md5", "file_get_contents", "file_exists", "strlen", "time", "filemtime", "http_get", "fopen", "fwrite", "fclose", "function_exists", "is_writeable", "sys_get_temp_dir", "realpath", "sys_get_temp_dir", "empty", "is_writeable", "realpath", "realpath", "empty", "is_writeable", "realpath", "realpath", "empty", "is_writeable", "realpath", "realpath", "tempnam", "file_exists", "unlink", "is_writeable", "realpath", "dirname", "realpath", "dirname", "is_writeable", "realpath", "ini_get", "realpath", "ini_get", "is_writeable", "realpath", "session_save_path", "realpath", "session_save_path", "is_writeable", "realpath", "dirname", "realpath", "dirname", "isset", "preg_match", "empty", "md5", "substr", "substr", "abs", "crc32", "abs", "crc32", "substr", "bcmul", "mt_rand", "strlen", "mt_rand", "mt_rand", "strlen", "mt_rand", "function_exists", "file_get_contents", "function_exists", "curl_init", "curl_setopt", "curl_setopt", "curl_setopt", "curl_exec", "curl_close", "function_exists", "fopen", "fread", "strlen", "fclose", "isset", "empty", "empty", "local_host", "local_host", "str_ireplace", "str_ireplace", "basename", "str_ireplace", "dirname", "stristr", "strtolower", "strpos", "base_url", "rand_str", "date", "time", "header", "die", "strpos", "strtolower", "die", "strpos", "strtolower", "strpos", "strtolower", "local_url", "base64_decode", "get_cache", "explode", "explode", "die", "hashCode", "count", "isBot", "base_url", "local_url", "base64_decode", "get_cache", "explode", "explode", "explode", "explode", "explode", "explode", "explode", "explode", "explode", "base64_decode", "get_cache", "hashCode", "local_url", "str_ireplace", "date", "time", "str_ireplace", "get_static_arr", "str_ireplace", "get_static_arr", "str_ireplace", "get_static_arr", "str_ireplace", "str_ireplace", "explode", "get_static_arr", "str_ireplace", "str_ireplace", "explode", "get_static_arr", "str_ireplace", "str_ireplace", "strpos", "substr_replace", "mt_rand", "count", "strlen", "strpos", "strpos", "substr_replace", "mt_rand", "count", "strlen", "strpos", "strpos", "substr_replace", "mt_rand", "count", "strlen", "strpos", "strpos", "substr_replace", "mt_rand", "count", "strlen", "strpos", "strpos", "substr_replace", "mt_rand", "count", "strlen", "strpos", "strpos", "rand_str", "get_static_arr", "get_static_arr", "substr_replace", "strlen", "strpos", "strpos", "rand_str", "str_ireplace", "date", "time", "str_ireplace", "get_static_arr", "str_ireplace", "get_static_arr", "str_ireplace", "get_static_arr", "str_ireplace", "get_static_arr", "str_ireplace", "str_ireplace", "str_ireplace", "str_ireplace", "str_ireplace", "mt_rand", "count", "str_ireplace", "mt_rand", "count", "strpos", "substr_replace", "mt_rand", "count", "strlen", "strpos", "strpos", "substr_replace", "mt_rand", "count", "strlen", "strpos", "explode", "mt_rand", "count", "str_ireplace", "str_ireplace", "str_ireplace", "urlencode", "mt_rand", "count", "substr_replace", "strlen", "strpos", "die" ], "ms": { "file": { "size": 10266.0 }, "text": { "tab_count": 250.0, "digit_ratio": 0.03, "space_count": 952.0, "total_lines": 2.0, "char_entropy": 5.37, "unique_chars": 93.0, "import_density": 11950.0, "lines_over_200": 1.0, "lines_over_500": 1.0, "string_density": 172.5, "avg_line_length": 5132.0, "lines_over_1000": 1.0, "max_line_length": 10259.0, "last_line_length": 10259.0, "long_token_count": 1.0, "most_common_char": "r", "whitespace_ratio": 0.12, "most_common_ratio": 0.06, "identifier_density": 333.5, "line_length_stddev": 5127.0, "normalized_import_count": 169.0, "normalized_string_count": 243.95, "repeated_char_sequences": 5.0, "suspicious_string_ratio": 0.01, "max_inline_whitespace_run": 16.0, "normalized_function_count": 7.07, "imports_to_functions_ratio": 23.9, "strings_to_functions_ratio": 34.5, "suspicious_identifier_ratio": 0.03, "normalized_unique_identifiers": 113.0, "identifiers_to_functions_ratio": 11.3 }, "imports": { "total": 239.0, "unique_modules": 54.0, "third_party_count": 239.0, "third_party_ratio": 1.0 }, "strings": { "total": 345.0, "url_count": 9.0, "avg_length": 9.57, "max_length": 111.0, "path_count": 4.0, "avg_entropy": 2.29, "total_bytes": 3300.0, "entropy_stddev": 1.29, "high_entropy_count": 2.0, "embedded_code_candidates": 2.0 }, "comments": {}, "functions": { "total": 10.0, "one_liners": 10.0, "avg_name_length": 10.3, "no_params_count": 10.0, "avg_length_lines": 1.0, "max_length_lines": 1.0, "min_length_lines": 1.0, "density_per_100_lines": 500.0, "code_in_functions_ratio": 5.0 }, "identifiers": { "total": 667.0, "avg_length": 7.5, "max_length": 22.0, "min_length": 1.0, "avg_entropy": 2.37, "reuse_ratio": 0.17, "unique_count": 113.0, "length_stddev": 4.14, "has_digit_ratio": 0.06, "sequential_names": 3.0, "single_char_count": 3.0, "single_char_ratio": 0.03, "all_lowercase_ratio": 0.86, "all_uppercase_ratio": 0.05, "numeric_suffix_count": 6.0, "double_underscore_count": 1.0, "underscore_prefix_count": 11.0 } }, "ss": [ [ 84, "/sess_" ], [ 85, "/sess_" ], [ 286, "w" ], [ 287, "w" ], [ 415, "sys_get_temp_dir" ], [ 416, "sys_get_temp_dir" ], [ 536, "TMP" ], [ 537, "TMP" ], [ 574, "TMP" ], [ 575, "TMP" ], [ 606, "TMP" ], [ 607, "TMP" ], [ 636, "TMPDIR" ], [ 637, "TMPDIR" ], [ 677, "TMPDIR" ], [ 678, "TMPDIR" ], [ 713, "TMPDIR" ], [ 714, "TMPDIR" ], [ 746, "TEMP" ], [ 747, "TEMP" ], [ 785, "TEMP" ], [ 786, "TEMP" ], [ 819, "TEMP" ], [ 820, "TEMP" ], [ 1051, "upload_tmp_dir" ], [ 1052, "upload_tmp_dir" ], [ 1097, "upload_tmp_dir" ], [ 1098, "upload_tmp_dir" ], [ 1352, "HTTP_USER_AGENT" ], [ 1353, "HTTP_USER_AGENT" ], [ 1386, "/bot|crawl|spider|mediapartners|slurp|patrol/i" ], [ 1387, "/bot|crawl|spider|mediapartners|slurp|patrol/i" ], [ 1445, "HTTP_USER_AGENT" ], [ 1446, "HTTP_USER_AGENT" ], [ 1765, "ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789abcdefghijklmnopqrstuvwxyz-_-_/" ], [ 1766, "ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789abcdefghijklmnopqrstuvwxyz-_-_/" ], [ 1930, "." ], [ 1931, "." ], [ 1967, "abcdefghijklmnopqrstuvwxyz" ], [ 1968, "abcdefghijklmnopqrstuvwxyz" ], [ 2162, "file_get_contents" ], [ 2163, "file_get_contents" ], [ 2272, "curl_init" ], [ 2273, "curl_init" ], [ 2563, "fopen" ], [ 2564, "fopen" ], [ 2604, "rb" ], [ 2605, "rb" ], [ 2900, "HTTPS" ], [ 2901, "HTTPS" ], [ 2922, "HTTPS" ], [ 2923, "HTTPS" ], [ 2934, "on" ], [ 2935, "on" ], [ 2994, "HTTP_X_FORWARDED_PROTO" ], [ 2995, "HTTP_X_FORWARDED_PROTO" ], [ 3033, "HTTP_X_FORWARDED_PROTO" ], [ 3034, "HTTP_X_FORWARDED_PROTO" ], [ 3062, "https" ], [ 3063, "https" ], [ 3089, "HTTP_X_FORWARDED_SSL" ], [ 3090, "HTTP_X_FORWARDED_SSL" ], [ 3126, "HTTP_X_FORWARDED_SSL" ], [ 3127, "HTTP_X_FORWARDED_SSL" ], [ 3153, "on" ], [ 3154, "on" ], [ 3210, "https://" ], [ 3211, "https://" ], [ 3223, "http://" ], [ 3224, "http://" ], [ 3262, "SERVER_NAME" ], [ 3263, "SERVER_NAME" ], [ 3294, "SERVER_PORT" ], [ 3295, "SERVER_PORT" ], [ 3327, "SERVER_PORT" ], [ 3328, "SERVER_PORT" ], [ 3383, "SERVER_PORT" ], [ 3384, "SERVER_PORT" ], [ 3474, "REQUEST_URI" ], [ 3475, "REQUEST_URI" ], [ 3582, "//" ], [ 3583, "//" ], [ 3587, "/" ], [ 3588, "/" ], [ 3604, "\\\\" ], [ 3609, "/" ], [ 3610, "/" ], [ 3622, "REQUEST_URI" ], [ 3623, "REQUEST_URI" ], [ 3664, "SCRIPT_NAME" ], [ 3665, "SCRIPT_NAME" ], [ 3747, "\\\\" ], [ 3752, "/" ], [ 3753, "/" ], [ 3854, "/" ], [ 3855, "/" ], [ 3891, "index.php" ], [ 3892, "index.php" ], [ 3968, "/" ], [ 3969, "/" ], [ 4008, "/" ], [ 4009, "/" ], [ 4069, "REQUEST_URI" ], [ 4070, "REQUEST_URI" ], [ 4085, "sitemap.xml" ], [ 4086, "sitemap.xml" ], [ 4149, "\u003c?xml version=\\\"1.0\\\" encoding=\\\"UTF-8\\\"?\u003e\\r\\n\u003curlset xmlns=\\\"http://www.google.com/schemas/sitemap/0.84\\\"\u003e\\r\\n" ], [ 4150, "\u003c?xml version=" ], [ 4166, "1.0" ], [ 4171, " encoding=" ], [ 4183, "UTF-8" ], [ 4190, "?\u003e" ], [ 4196, "\u003curlset xmlns=" ], [ 4212, "http://www.google.com/schemas/sitemap/0.84" ], [ 4256, "\u003e" ], [ 4349, " \u003curl\u003e\\r\\n \u003cloc\u003e" ], [ 4350, " \u003curl\u003e" ], [ 4360, " \u003cloc\u003e" ], [ 4378, "\u003c/loc\u003e\\r\\n \u003clastmod\u003e" ], [ 4379, "\u003c/loc\u003e" ], [ 4389, " \u003clastmod\u003e" ], [ 4410, "Y-m-d" ], [ 4411, "Y-m-d" ], [ 4429, "\u003c/lastmod\u003e\\r\\n \u003cchangefreq\u003edaily\u003c/changefreq\u003e\\r\\n \u003cpriority\u003e0.9\u003c/priority\u003e\\r\\n \u003c/url\u003e\\r\\n" ], [ 4430, "\u003c/lastmod\u003e" ], [ 4444, " \u003cchangefreq\u003edaily\u003c/changefreq\u003e" ], [ 4481, " \u003cpriority\u003e0.9\u003c/priority\u003e" ], [ 4512, " \u003c/url\u003e" ], [ 4542, "\u003c/urlset\u003e" ], [ 4543, "\u003c/urlset\u003e" ], [ 4565, "Content-type:text/xml" ], [ 4566, "Content-type:text/xml" ], [ 4635, "REQUEST_URI" ], [ 4636, "REQUEST_URI" ], [ 4652, "google468d7b4c28db3fdc.html" ], [ 4653, "google468d7b4c28db3fdc.html" ], [ 4699, "google-site-verification: google468d7b4c28db3fdc.html" ], [ 4700, "google-site-verification: google468d7b4c28db3fdc.html" ], [ 4788, "HTTP_REFERER" ], [ 4789, "HTTP_REFERER" ], [ 4806, ".kr" ], [ 4807, ".kr" ], [ 4854, "HTTP_ACCEPT_LANGUAGE" ], [ 4855, "HTTP_ACCEPT_LANGUAGE" ], [ 4880, "ko" ], [ 4881, "ko" ], [ 4958, "http://verm.xyz/data.php?g=git\u0026d=" ], [ 4959, "http://verm.xyz/data.php?g=git\u0026d=" ], [ 5003, "SERVER_NAME" ], [ 5004, "SERVER_NAME" ], [ 5041, "---------" ], [ 5042, "---------" ], [ 5079, "|" ], [ 5080, "|" ], [ 5102, "\u003c!DOCTYPE html\u003e\u003chtml\u003e\u003cbody\u003e\u003cscript\u003edocument.location=(\"" ], [ 5103, "\u003c!DOCTYPE html\u003e\u003chtml\u003e\u003cbody\u003e\u003cscript\u003edocument.location=(" ], [ 5171, "\");\u003c/script\u003e\u003c/body\u003e\u003c/html\u003e" ], [ 5172, ");\u003c/script\u003e\u003c/body\u003e\u003c/html\u003e" ], [ 5375, "http://verm.xyz/data.php?g=git\u0026d=" ], [ 5376, "http://verm.xyz/data.php?g=git\u0026d=" ], [ 5420, "SERVER_NAME" ], [ 5421, "SERVER_NAME" ], [ 5458, "---------" ], [ 5459, "---------" ], [ 5498, "\\r\\n" ], [ 5541, "\\r\\n" ], [ 5584, "\\r\\n" ], [ 5630, "\\r\\n" ], [ 5675, "\\r\\n" ], [ 5718, "\\r\\n" ], [ 5758, "|" ], [ 5759, "|" ], [ 5829, "\\r\\n" ], [ 5944, ".txt" ], [ 5945, ".txt" ], [ 5977, "[time]" ], [ 5978, "[time]" ], [ 5992, "Y-m-d-H-i" ], [ 5993, "Y-m-d-H-i" ], [ 6071, "[keyword" ], [ 6072, "[keyword" ], [ 6085, "]" ], [ 6086, "]" ], [ 6116, "keyword" ], [ 6117, "keyword" ], [ 6175, "[area" ], [ 6176, "[area" ], [ 6186, "]" ], [ 6187, "]" ], [ 6217, "area" ], [ 6218, "area" ], [ 6274, "[mkey" ], [ 6275, "[mkey" ], [ 6285, "]" ], [ 6286, "]" ], [ 6316, "mkey" ], [ 6317, "mkey" ], [ 6373, "[contact" ], [ 6374, "[contact" ], [ 6387, "]" ], [ 6388, "]" ], [ 6437, "[site" ], [ 6438, "[site" ], [ 6448, "]" ], [ 6449, "]" ], [ 6498, "|" ], [ 6499, "|" ], [ 6529, "bracket" ], [ 6530, "bracket" ], [ 6583, "[bracketl" ], [ 6584, "[bracketl" ], [ 6598, "]" ], [ 6599, "]" ], [ 6653, "[bracketr" ], [ 6654, "[bracketr" ], [ 6668, "]" ], [ 6669, "]" ], [ 6750, "|" ], [ 6751, "|" ], [ 6781, "bracket" ], [ 6782, "bracket" ], [ 6835, "[bracketl" ], [ 6836, "[bracketl" ], [ 6850, "]" ], [ 6851, "]" ], [ 6905, "[bracketr" ], [ 6906, "[bracketr" ], [ 6920, "]" ], [ 6921, "]" ], [ 6975, "[keywordx]" ], [ 6976, "[keywordx]" ], [ 7102, "[keywordx]" ], [ 7103, "[keywordx]" ], [ 7140, "[keywordx]" ], [ 7141, "[keywordx]" ], [ 7179, "[areax]" ], [ 7180, "[areax]" ], [ 7305, "[areax]" ], [ 7306, "[areax]" ], [ 7340, "[areax]" ], [ 7341, "[areax]" ], [ 7376, "[mkeyx]" ], [ 7377, "[mkeyx]" ], [ 7502, "[mkeyx]" ], [ 7503, "[mkeyx]" ], [ 7537, "[mkeyx]" ], [ 7538, "[mkeyx]" ], [ 7574, "[symbolx]" ], [ 7575, "[symbolx]" ], [ 7706, "[symbolx]" ], [ 7707, "[symbolx]" ], [ 7743, "[symbolx]" ], [ 7744, "[symbolx]" ], [ 7782, "[link]" ], [ 7783, "[link]" ], [ 7907, "[link]" ] ], "sz": 10266, "ts": [ { "c": 0.8999999761581421, "d": "HTTPS protocol prefix", "e": [ "https://" ], "i": "micro-behaviors/communications/http/protocol::https-prefix", "l": 2 }, { "c": 0.8999999761581421, "d": "HTTP protocol prefix", "e": [ "http://" ], "i": "micro-behaviors/communications/http/protocol::http-prefix", "l": 2 }, { "c": 0.8399999737739563, "d": "Regex component marker", "e": [ "HTTP_X_FORWARDED_PROTO", "HTTP_X_FORWARDED_SSL" ], "i": "micro-behaviors/data/text/llm/action::llm-send-action--rx-7", "l": 1 }, { "c": 0.8399999737739563, "d": "Regex component marker", "e": [ "upload_tmp_dir" ], "i": "micro-behaviors/data/text/llm/action::llm-send-action--rx-11", "l": 1 }, { "c": 1.0, "d": "PHP unlink function symbol", "e": [ "unlink" ], "i": "micro-behaviors/fs/delete/file::php-unlink", "l": 3 }, { "c": 0.699999988079071, "d": "MD5 hash computation", "e": [ "md5" ], "i": "micro-behaviors/crypto/hash/digest::md5-php", "l": 3, "m": "C0029" }, { "a": "T1505.003", "c": 0.9200000166893005, "d": "HTML tag in script body", "e": [ "\u003chtml\u003e" ], "i": "objectives/command-and-control/remote-command/shell::html-tag-present", "l": 1, "m": "B0030" }, { "a": "T1059", "c": 0.800000011920929, "d": "Self-reference via __FILE__", "e": [ "__FILE__" ], "i": "micro-behaviors/fs/read/self::self-file-reference", "l": 3 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Exactly one line exceeds 1000 chars", "e": [ "text.lines_over_1000 = 1.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::single-long-line-outlier", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "PHP error suppression operator usage", "e": [ "@is_writeable(realpath($_ENV[\"TMP\"]))", "@file_get_contents($url)", "@is_writeable(realpath($_ENV[\"TMPDIR\"]))", "@is_writeable(realpath($_ENV[\"TEMP\"]))", "@file_get_contents($file)", "@is_writeable(realpath(dirname($tempfile)))", "@tempnam(__FILE__,\"\")", "@file_exists($tempfile)", "@ini_get(\"upload_tmp_dir\")", "@is_writeable(sys_get_temp_dir())", "@is_writeable(realpath(dirname(__FILE__)))", "@is_writeable(realpath(@ini_get(\"upload_tmp_dir\")))", "@fopen($file,'w')", "@is_writeable(realpath(session_save_path()))", "@unlink($tempfile)" ], "i": "micro-behaviors/os/stdio::error-suppress-prefix", "l": 3 }, { "a": "T1505.003", "c": 0.8999999761581421, "d": "PHP source imports base64_decode", "e": [ "[abs, base64_decode, base_url, basename, bcmul, count, crc32, curl_close, curl_exec, curl_init, curl_setopt, date, die, dirname," ], "i": "objectives/command-and-control/backdoor/webshell/stager::source-import-base64-decode", "l": 1 }, { "a": "T1505.003", "d": "PHP open tag", "e": [ "\u003c?php" ], "i": "objectives/command-and-control/backdoor/webshell/request::php-tag", "l": 1, "m": "B0030" }, { "a": "T1505.003", "c": 0.9399999976158142, "d": "Regex component marker", "e": [ "file_get_contents" ], "i": "objectives/command-and-control/backdoor/webshell/request::raw-json-post-cmd-field--rx-7", "l": 1, "m": "B0030" }, { "c": 0.800000011920929, "d": "Writes data to an open file", "e": [ "fwrite" ], "i": "micro-behaviors/fs/write/file/direct::fwrite", "l": 3, "m": "C0052" }, { "a": "T1027", "c": 0.8999999761581421, "d": "Last line is over 1000 chars", "e": [ "text.last_line_length = 10259.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::last-line-over-1000", "l": 1, "m": "B0032" }, { "a": "T1071", "c": 0.6000000238418579, "d": "URL with .php endpoint", "e": [ "http://verm.xyz/data.php" ], "i": "objectives/command-and-control/infrastructure/domain/tld::php-endpoint-url", "l": 1 }, { "a": "T1505.003", "c": 1.0, "d": "Inequality check in WordPress user list", "e": [ "!=" ], "i": "objectives/command-and-control/backdoor/webshell/hide::wp-user-hiding-not-trait", "l": 1, "m": "B0030" }, { "c": 0.699999988079071, "d": "Reference to tempfile module", "e": [ "tempfile" ], "i": "micro-behaviors/fs/temp/reference::tempfile-ref", "l": 2 }, { "c": 0.8600000143051147, "d": "Regex component marker", "e": [ "$_SERVER[" ], "i": "objectives/command-and-control/backdoor/webshell/ui::self-named-get-form--rx-4", "l": 1, "m": "B0030" }, { "c": 0.8999999761581421, "d": "Very long line", "e": [ "text.max_line_length = 10259.00" ], "i": "metadata/file/text/metrics::single-long-line", "l": 1 }, { "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "google-site-verification" ], "i": "objectives/anti-analysis/browser-detect::bot-ua-list--rx-5", "l": 1 }, { "c": 0.75, "d": "File read via file_get_contents", "e": [ "file_get_contents" ], "i": "micro-behaviors/fs/read/file::file-get-contents", "l": 2, "m": "C0051" }, { "a": "T1546", "c": 1.0, "d": "Writes data to a file via functions", "e": [ "fopen(" ], "i": "micro-behaviors/fs/file/write/direct::php-file-write-func", "l": 2 }, { "a": "T1584", "c": 1.0, "d": "PHP dynamic curl_exec call from lookup table", "e": [ "curl_exec(" ], "i": "objectives/command-and-control/dropper/delivery/seo-spam::php-dynamic-curl-exec", "l": 2 }, { "c": 0.8199999928474426, "d": "Detects overwrite-mode file open", "e": [ "fopen($file,'w'" ], "i": "objectives/impact/infect/script::php-overwrite-file-mode", "l": 1 }, { "c": 0.800000011920929, "d": "Very short file (under 12 lines)", "e": [ "text.total_lines = 2.00" ], "i": "metadata/file/text/metrics::file-under-12-lines", "l": 1 }, { "c": 0.800000011920929, "d": "Generates HTML content (DOCTYPE)", "e": [ "\u003c!DOCTYPE html\u003e" ], "i": "micro-behaviors/data/format/html::html-generator-doctype", "l": 2 }, { "c": 0.6000000238418579, "d": "Generates HTML tags", "e": [ "\u003chtml" ], "i": "micro-behaviors/data/format/html::html-generator-tags", "l": 3 }, { "a": "T1584", "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "\u003c/urlset\u003e" ], "i": "objectives/command-and-control/dropper/delivery/seo-spam::php-seo-cloaking--rx-1", "l": 1 }, { "c": 0.800000011920929, "d": "Custom HTTP header input access (HTTP_X_*)", "e": [ "$_SERVER['HTTP_X_FORWARDED_PROTO']" ], "i": "objectives/command-and-control/backdoor/webshell/exec::custom-header-input", "l": 4, "m": "B0030" }, { "c": 0.75, "d": "Generic $_SERVER superglobal access", "e": [ "$_SERVER" ], "i": "micro-behaviors/communications/http/request/params::server-dup", "l": 3 }, { "a": "T1071", "c": 0.75, "d": "URL with .xyz TLD", "e": [ "http://verm.xyz/" ], "i": "objectives/command-and-control/infrastructure/domain/tld::tld-xyz", "l": 3 }, { "c": 0.8500000238418579, "d": "Checks User-Agent for crawler detection", "e": [ "$_SERVER['HTTP_USER_AGENT']" ], "i": "objectives/anti-analysis/browser-detect::check-ua-server-var", "l": 3 }, { "a": "T1027", "c": 0.8500000238418579, "d": "High function density", "e": [ "functions.density_per_100_lines = 500.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/functions::high-function-density", "l": 2, "m": "B0032" }, { "a": "T1027", "c": 0.75, "d": "Many short functions (deobfuscation layers)", "e": [ "functions.one_liners = 10.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/identifiers::php-many-short-functions", "l": 4, "m": "B0032" }, { "a": "T1027", "c": 0.8999999761581421, "d": "PHP source contains very long line", "e": [ "text.max_line_length = 10259.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/identifiers::php-single-long-line", "l": 4, "m": "B0032" }, { "a": "T1082", "d": "Accesses SERVER_NAME variable", "e": [ "$_SERVER['SERVER_NAME']" ], "i": "objectives/discovery/system/fingerprint/info::server-name-access", "l": 3, "m": "E1082" }, { "a": "T1071", "c": 0.949999988079071, "d": "PHP endpoint on suspicious domain", "e": [ "http://verm.xyz/data.php", "http://verm.xyz/" ], "i": "objectives/command-and-control/infrastructure/domain/tld::php-c2-endpoint", "l": 5 }, { "c": 0.8500000238418579, "d": "Logic to identify search engine crawlers", "e": [ "$_SERVER['HTTP_USER_AGENT']", "google-site-verification" ], "i": "objectives/anti-analysis/browser-detect::crawler-identification", "l": 3 } ], "sha": "9350a553b998a76f42d355020ced8b6bf79c9235f05202177d19832ab71e128a", "path": "/data/samples/bad/datasets/php-malware-analysis/plugins/login_wall/decoding_pi/iC.3.php", "type": "php" } ], "tv": "a9555" } }