{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.998762845993042, "class": 2 } ], "prob": 0.99876285, "class": 2, "models": [ { "m": "az", "prob": 0.9253049, "class": 0 }, { "m": "az/scripts", "prob": 0.9394416, "class": 0 }, { "m": "az/php", "prob": 0.99876285, "class": 2 } ], "version": "v16.16", "thresholds": [ 0.9961138, 0.99909174 ], "analyzed_at": "2026-05-09T03:11:14Z" }, "path": "opgl24g5jf.php", "raw": { "v": "4", "fs": [ { "f": "O₁₀(C₅AlDy₂AsCaCoErILaS)H₄(Cm₂F₄OsPo)Md", "k": { "source.imports[0]": "array_unique", "source.imports[1]": "chmod", "source.imports[2]": "chop", "source.imports[3]": "curl_close", "source.imports[4]": "curl_exec", "source.imports[5]": "curl_init", "source.imports[6]": "curl_setopt", "source.imports[7]": "empty", "source.imports[8]": "explode", "source.imports[9]": "fclose", "source.strings[0]": "#\u003c/div\u003e\u003cp\u003e(.*)\u003c/p\u003e\u003c/div\u003e#iU", "source.strings[1]": "#Accoona#i", "source.strings[2]": "#Ask\\s*Jeeves#i", "source.strings[3]": "#BingBot#i", "source.strings[4]": "#CFNetwork#i", "source.strings[5]": "#CazoodleBot#i", "source.strings[6]": "#ConveraCrawler#i", "source.strings[7]": "#DISCo#i", "source.strings[8]": "#Download\\s*Master#i", "source.strings[9]": "#FAST\\s*MetaWeb\\s*Crawler#i", "source.has_imports": true, "source.imports[10]": "file", "source.imports[11]": "file_exists", "source.imports[12]": "fopen", "source.imports[13]": "fwrite", "source.imports[14]": "gethostbyaddr", "source.imports[15]": "header", "source.imports[16]": "implode", "source.imports[17]": "mb_strtolower", "source.imports[18]": "preg_match_all", "source.imports[19]": "preg_replace", "source.imports[20]": "rand", "source.imports[21]": "scandir", "source.imports[22]": "shuffle", "source.imports[23]": "sizeof", "source.imports[24]": "str_replace", "source.imports[25]": "strip_tags", "source.imports[26]": "strlen", "source.imports[27]": "strpos", "source.imports[28]": "ucfirst", "source.imports[29]": "unlink", "source.strings[10]": "#Flexum\\s*spider#i", "source.strings[11]": "#Gigabot#i", "source.strings[12]": "#HP\\s*Web\\s*PrintSmart#i", "source.strings[13]": "#HTMLParser#i", "source.strings[14]": "#HTTrack#i", "source.strings[15]": "#IDBot#i", "source.strings[16]": "#IRLbot#i", "source.strings[17]": "#Indy\\s*Library#", "source.strings[18]": "#Java#i", "source.strings[19]": "#LWP::Simple#i", "source.strings[20]": "#ListChecker#i", "source.strings[21]": "#Lupa\\.ru#i", "source.strings[22]": "#MJ12bot#i", "source.strings[23]": "#MSIECrawler#i", "source.strings[24]": "#Missigua#i", "source.strings[25]": "#NetCache#i", "source.strings[26]": "#Nutch#i", "source.strings[27]": "#Offline\\s*Explorer#i", "source.strings[28]": "#OmniExplorer_Bot#i", "source.strings[29]": "#PEAR#i", "source.strings[30]": "#Python#i", "source.strings[31]": "#RPT-HTTPClient#i", "source.strings[32]": "#SMILE#i", "source.strings[33]": "#Speedy#i", "source.strings[34]": "#Teleport\\s*Pro#i", "source.strings[35]": "#TurtleScanner#i", "source.strings[36]": "#Twiceler#i", "source.strings[37]": "#User-Agent#i", "source.strings[38]": "#WebAlta#i", "source.strings[39]": "#WebCopier#i", "source.strings[40]": "#WebData#i", "source.strings[41]": "#WebZIP#i", "source.strings[42]": "#Webalta#i", "source.strings[43]": "#Webster\\s*Pro#i", "source.strings[44]": "#Wget#i", "source.strings[45]": "#Wysigot#i", "source.strings[46]": "#Yahoo!\\s*Slurp#i", "source.strings[47]": "#Yandex#i", "source.strings[48]": "#Yanga#i", "source.strings[49]": "#Yeti#i", "source.strings[50]": "#altavista#i", "source.strings[51]": "#architextspider#i", "source.strings[52]": "#ask#i", "source.strings[53]": "#asterias#i", "source.strings[54]": "#av\\s*fetch#i", "source.strings[55]": "#charlotte#i", "source.strings[56]": "#google#i", "source.strings[57]": "#gulliver#i", "source.strings[58]": "#ia_archiver#i", "source.strings[59]": "#ichiro#i", "source.strings[60]": "#infoseek sidewinder#i", "source.strings[61]": "#jeeves#i", "source.strings[62]": "#kmSearchBot#i", "source.strings[63]": "#km\\.ru\\s*bot#i", "source.strings[64]": "#libwww-perl#i", "source.strings[65]": "#lwp-trivial#i", "source.strings[66]": "#lycos.spider#i", "source.strings[67]": "#msnbot#i", "source.strings[68]": "#msnbot-media#i", "source.strings[69]": "#ngb#i", "source.strings[70]": "#polybot#i", "source.strings[71]": "#psbot#i", "source.strings[72]": "#robozill#i", "source.strings[73]": "#rulinki\\.ru#i", "source.strings[74]": "#scooter#i", "source.strings[75]": "#spider#i", "source.strings[76]": "#spiderthread revision#i", "source.strings[77]": "#sqworm#i", "source.strings[78]": "#ultraseek#i", "source.strings[79]": "#voyager#i", "source.strings[80]": "#webcrawler#i", "source.strings[81]": "#www\\.cys\\.ru#i", "source.strings[82]": "#yahoo!\\s*slurp#i", "source.strings[83]": "#yahoo#i", "source.strings[84]": "\u0026first=", "source.strings[85]": "\u0026mykeys=", "source.strings[86]": "\u0026pass=qwerty8", "source.strings[87]": "-NO-WAY-", "source.strings[88]": ".bing.", "source.strings[89]": ".google.", "source.strings[90]": ".yahoo.", "source.strings[91]": "HTTP_HOST", "source.strings[92]": "HTTP_REFERER", "source.strings[93]": "HTTP_USER_AGENT", "source.strings[94]": "Location: http://imagger.pw/sf/77?d=", "source.strings[95]": "Location: http://imagger.pw/sf/77?d=$d\u0026mykeys=$mykeys", "source.strings[96]": "REMOTE_ADDR", "source.strings[97]": "google", "source.strings[98]": "http://picgures.pw/story2.php?q=", "source.strings[99]": "http://picgures.pw/story2.php?q=$query_pars_2\u0026pass=qwerty8", "source.strings[100]": "https://www4.bing.com/search?q=", "source.strings[101]": "https://www4.bing.com/search?q=$query_pars_2\u0026first=$page", "source.strings[102]": "nptoris", "source.strings[103]": "werbxverf", "source.strings[104]": "{keyword}", "source.strings[105]": "{manytext_bing}" }, "x": 151, "id": 0, "is": [ "file_exists", "chmod", "file_exists", "unlink", "empty", "strpos", "preg_replace", "strpos", "gethostbyaddr", "file_exists", "file", "implode", "scandir", "rand", "sizeof", "file", "str_replace", "chop", "ucfirst", "str_replace", "chop", "mb_strtolower", "curl_init", "curl_setopt", "curl_setopt", "curl_exec", "curl_close", "strlen", "curl_init", "curl_setopt", "curl_setopt", "curl_setopt", "curl_setopt", "curl_exec", "curl_close", "preg_match_all", "str_replace", "strip_tags", "str_replace", "str_replace", "str_replace", "str_replace", "str_replace", "str_replace", "str_replace", "explode", "shuffle", "array_unique", "implode", "implode", "str_replace", "str_replace", "fopen", "fwrite", "fclose", "str_replace", "str_replace", "strpos", "strpos", "strpos", "header" ], "ms": { "file": { "size": 5411.0 }, "text": { "tab_count": 70.0, "digit_ratio": 0.02, "space_count": 881.0, "total_lines": 153.0, "char_entropy": 5.32, "mixed_indent": true, "unique_chars": 89.0, "import_density": 39.87, "string_density": 1.9, "avg_line_length": 33.38, "max_line_length": 163.0, "empty_line_ratio": 0.22, "last_line_length": 2.0, "most_common_char": "e", "whitespace_ratio": 0.23, "most_common_ratio": 0.05, "identifier_density": 1.33, "line_length_stddev": 38.67, "normalized_import_count": 4.93, "normalized_string_count": 23.45, "repeated_char_sequences": 17.0, "suspicious_comment_ratio": 0.67, "max_inline_whitespace_run": 2.0, "trailing_whitespace_lines": 30.0, "suspicious_identifier_ratio": 0.1, "normalized_unique_identifiers": 8.41 }, "imports": { "total": 61.0, "unique_modules": 30.0, "third_party_count": 61.0, "third_party_ratio": 1.0 }, "strings": { "total": 290.0, "url_count": 4.0, "avg_length": 10.32, "max_length": 58.0, "avg_entropy": 2.41, "total_bytes": 2992.0, "entropy_stddev": 1.29 }, "comments": { "chars": 376.0, "lines": 8.0, "total": 3.0, "to_code_ratio": 0.06, "url_in_comments": 1.0, "high_entropy_comments": 2.0 }, "functions": {}, "identifiers": { "total": 203.0, "avg_length": 7.67, "max_length": 22.0, "min_length": 1.0, "avg_entropy": 2.36, "reuse_ratio": 0.3, "unique_count": 61.0, "length_stddev": 5.08, "has_digit_ratio": 0.07, "sequential_names": 6.0, "single_char_count": 3.0, "single_char_ratio": 0.05, "high_entropy_count": 3.0, "high_entropy_ratio": 0.05, "all_lowercase_ratio": 0.84, "all_uppercase_ratio": 0.1, "numeric_suffix_count": 4.0, "underscore_prefix_count": 2.0 } }, "ss": [ [ 15, ".ht" ], [ 16, ".ht" ], [ 28, "acc" ], [ 29, "acc" ], [ 41, "ess" ], [ 42, "ess" ], [ 169, "wtuds" ], [ 170, "wtuds" ], [ 198, "nptoris" ], [ 199, "nptoris" ], [ 243, "#Ask\\s*Jeeves#i" ], [ 244, "#Ask\\s*Jeeves#i" ], [ 262, "#HP\\s*Web\\s*PrintSmart#i" ], [ 263, "#HP\\s*Web\\s*PrintSmart#i" ], [ 290, "#HTTrack#i" ], [ 291, "#HTTrack#i" ], [ 304, "#IDBot#i" ], [ 305, "#IDBot#i" ], [ 316, "#Indy\\s*Library#" ], [ 317, "#Indy\\s*Library#" ], [ 368, "#ListChecker#i" ], [ 369, "#ListChecker#i" ], [ 386, "#MSIECrawler#i" ], [ 387, "#MSIECrawler#i" ], [ 404, "#NetCache#i" ], [ 405, "#NetCache#i" ], [ 419, "#Nutch#i" ], [ 420, "#Nutch#i" ], [ 431, "#RPT-HTTPClient#i" ], [ 432, "#RPT-HTTPClient#i" ], [ 484, "#rulinki\\.ru#i" ], [ 485, "#rulinki\\.ru#i" ], [ 502, "#Twiceler#i" ], [ 503, "#Twiceler#i" ], [ 517, "#WebAlta#i" ], [ 518, "#WebAlta#i" ], [ 531, "#Webster\\s*Pro#i" ], [ 532, "#Webster\\s*Pro#i" ], [ 550, "#www\\.cys\\.ru#i" ], [ 551, "#www\\.cys\\.ru#i" ], [ 601, "#Wysigot#i" ], [ 602, "#Wysigot#i" ], [ 615, "#Yahoo!\\s*Slurp#i" ], [ 616, "#Yahoo!\\s*Slurp#i" ], [ 636, "#Yeti#i" ], [ 637, "#Yeti#i" ], [ 647, "#Accoona#i" ], [ 648, "#Accoona#i" ], [ 661, "#CazoodleBot#i" ], [ 662, "#CazoodleBot#i" ], [ 711, "#CFNetwork#i" ], [ 712, "#CFNetwork#i" ], [ 727, "#ConveraCrawler#i" ], [ 728, "#ConveraCrawler#i" ], [ 747, "#DISCo#i" ], [ 748, "#DISCo#i" ], [ 759, "#Download\\s*Master#i" ], [ 760, "#Download\\s*Master#i" ], [ 783, "#FAST\\s*MetaWeb\\s*Crawler#i" ], [ 784, "#FAST\\s*MetaWeb\\s*Crawler#i" ], [ 846, "#Flexum\\s*spider#i" ], [ 847, "#Flexum\\s*spider#i" ], [ 868, "#Gigabot#i" ], [ 869, "#Gigabot#i" ], [ 882, "#HTMLParser#i" ], [ 883, "#HTMLParser#i" ], [ 899, "#ia_archiver#i" ], [ 900, "#ia_archiver#i" ], [ 917, "#ichiro#i" ], [ 918, "#ichiro#i" ], [ 962, "#IRLbot#i" ], [ 963, "#IRLbot#i" ], [ 975, "#Java#i" ], [ 976, "#Java#i" ], [ 986, "#km\\.ru\\s*bot#i" ], [ 987, "#km\\.ru\\s*bot#i" ], [ 1005, "#kmSearchBot#i" ], [ 1006, "#kmSearchBot#i" ], [ 1023, "#libwww-perl#i" ], [ 1024, "#libwww-perl#i" ], [ 1073, "#Lupa\\.ru#i" ], [ 1074, "#Lupa\\.ru#i" ], [ 1088, "#LWP::Simple#i" ], [ 1089, "#LWP::Simple#i" ], [ 1106, "#lwp-trivial#i" ], [ 1107, "#lwp-trivial#i" ], [ 1124, "#Missigua#i" ], [ 1125, "#Missigua#i" ], [ 1139, "#MJ12bot#i" ], [ 1140, "#MJ12bot#i" ], [ 1185, "#msnbot#i" ], [ 1186, "#msnbot#i" ], [ 1198, "#msnbot-media#i" ], [ 1199, "#msnbot-media#i" ], [ 1217, "#Offline\\s*Explorer#i" ], [ 1218, "#Offline\\s*Explorer#i" ], [ 1242, "#OmniExplorer_Bot#i" ], [ 1243, "#OmniExplorer_Bot#i" ], [ 1297, "#PEAR#i" ], [ 1298, "#PEAR#i" ], [ 1308, "#psbot#i" ], [ 1309, "#psbot#i" ], [ 1320, "#Python#i" ], [ 1321, "#Python#i" ], [ 1333, "#rulinki\\.ru#i" ], [ 1334, "#rulinki\\.ru#i" ], [ 1351, "#SMILE#i" ], [ 1352, "#SMILE#i" ], [ 1395, "#Speedy#i" ], [ 1396, "#Speedy#i" ], [ 1408, "#Teleport\\s*Pro#i" ], [ 1409, "#Teleport\\s*Pro#i" ], [ 1429, "#TurtleScanner#i" ], [ 1430, "#TurtleScanner#i" ], [ 1449, "#User-Agent#i" ], [ 1450, "#User-Agent#i" ], [ 1466, "#voyager#i" ], [ 1467, "#voyager#i" ], [ 1512, "#Webalta#i" ], [ 1513, "#Webalta#i" ], [ 1526, "#WebCopier#i" ], [ 1527, "#WebCopier#i" ], [ 1542, "#WebData#i" ], [ 1543, "#WebData#i" ], [ 1556, "#WebZIP#i" ], [ 1557, "#WebZIP#i" ], [ 1569, "#Wget#i" ], [ 1570, "#Wget#i" ], [ 1612, "#Yandex#i" ], [ 1613, "#Yandex#i" ], [ 1625, "#Yanga#i" ], [ 1626, "#Yanga#i" ], [ 1637, "#Yeti#i" ], [ 1638, "#Yeti#i" ], [ 1647, "#msnbot#i" ], [ 1648, "#msnbot#i" ], [ 1692, "#spider#i" ], [ 1693, "#spider#i" ], [ 1705, "#yahoo#i" ], [ 1706, "#yahoo#i" ], [ 1717, "#jeeves#i" ], [ 1718, "#jeeves#i" ], [ 1730, "#google#i" ], [ 1731, "#google#i" ], [ 1743, "#altavista#i" ], [ 1744, "#altavista#i" ], [ 1791, "#scooter#i" ], [ 1792, "#scooter#i" ], [ 1805, "#av\\s*fetch#i" ], [ 1806, "#av\\s*fetch#i" ], [ 1822, "#asterias#i" ], [ 1823, "#asterias#i" ], [ 1837, "#spiderthread revision#i" ], [ 1838, "#spiderthread revision#i" ], [ 1865, "#sqworm#i" ], [ 1866, "#sqworm#i" ], [ 1910, "#ask#i" ], [ 1911, "#ask#i" ], [ 1920, "#lycos.spider#i" ], [ 1921, "#lycos.spider#i" ], [ 1939, "#infoseek sidewinder#i" ], [ 1940, "#infoseek sidewinder#i" ], [ 1965, "#ultraseek#i" ], [ 1966, "#ultraseek#i" ], [ 1981, "#polybot#i" ], [ 1982, "#polybot#i" ], [ 2027, "#webcrawler#i" ], [ 2028, "#webcrawler#i" ], [ 2044, "#robozill#i" ], [ 2045, "#robozill#i" ], [ 2059, "#gulliver#i" ], [ 2060, "#gulliver#i" ], [ 2074, "#architextspider#i" ], [ 2075, "#architextspider#i" ], [ 2096, "#yahoo!\\s*slurp#i" ], [ 2097, "#yahoo!\\s*slurp#i" ], [ 2149, "#charlotte#i" ], [ 2150, "#charlotte#i" ], [ 2165, "#ngb#i" ], [ 2166, "#ngb#i" ], [ 2175, "#BingBot#i" ], [ 2176, "#BingBot#i" ], [ 2217, "HTTP_USER_AGENT" ], [ 2218, "HTTP_USER_AGENT" ], [ 2298, "-NO-WAY-" ], [ 2299, "-NO-WAY-" ], [ 2319, "HTTP_USER_AGENT" ], [ 2320, "HTTP_USER_AGENT" ], [ 2341, "-NO-WAY-" ], [ 2342, "-NO-WAY-" ], [ 2428, "REMOTE_ADDR" ], [ 2429, "REMOTE_ADDR" ], [ 2445, "google" ], [ 2446, "google" ], [ 2531, "/" ], [ 2532, "/" ], [ 2541, "werbxverf" ], [ 2542, "werbxverf" ], [ 2789, "/" ], [ 2790, "/" ], [ 2852, "-" ], [ 2853, "-" ], [ 2857, " " ], [ 2858, " " ], [ 2868, "werbxverf" ], [ 2869, "werbxverf" ], [ 3002, " " ], [ 3003, " " ], [ 3007, "+" ], [ 3008, "+" ], [ 3154, "http://picgures.pw/story2.php?q=$query_pars_2\u0026pass=qwerty8" ], [ 3155, "http://picgures.pw/story2.php?q=" ], [ 3200, "\u0026pass=qwerty8" ], [ 3444, "https://www4.bing.com/search?q=$query_pars_2\u0026first=$page" ], [ 3445, "https://www4.bing.com/search?q=" ], [ 3489, "\u0026first=" ], [ 3846, "#\u003c/div\u003e\u003cp\u003e(.*)\u003c/p\u003e\u003c/div\u003e#iU" ], [ 3847, "#\u003c/div\u003e\u003cp\u003e(.*)\u003c/p\u003e\u003c/div\u003e#iU" ], [ 3960, "..." ], [ 3961, "..." ], [ 4033, " " ], [ 4034, " " ], [ 4039, " " ], [ 4040, " " ], [ 4075, " " ], [ 4076, " " ], [ 4081, " " ], [ 4082, " " ], [ 4117, " " ], [ 4118, " " ], [ 4123, " " ], [ 4124, " " ], [ 4159, " " ], [ 4160, " " ], [ 4165, " " ], [ 4166, " " ], [ 4201, " " ], [ 4202, " " ], [ 4207, " " ], [ 4208, " " ], [ 4243, " " ], [ 4244, " " ], [ 4249, " " ], [ 4250, " " ], [ 4285, " " ], [ 4286, " " ], [ 4291, " " ], [ 4292, " " ], [ 4325, "." ], [ 4326, "." ], [ 4408, ". " ], [ 4409, ". " ], [ 4452, "\\n" ], [ 4744, "{keyword}" ], [ 4745, "{keyword}" ], [ 4798, "{manytext_bing}" ] ], "sz": 5411, "ts": [ { "c": 1.0, "d": "PHP unlink function symbol", "e": [ "unlink" ], "i": "micro-behaviors/fs/delete/file::php-unlink", "l": 3 }, { "a": "T1217", "c": 0.4000000059604645, "d": "Yandex browser name", "e": [ "Yandex" ], "i": "objectives/discovery/host/browser::yandex-name", "l": 3 }, { "c": 0.800000011920929, "d": "Writes data to an open file", "e": [ "fwrite" ], "i": "micro-behaviors/fs/write/file/direct::fwrite", "l": 3, "m": "C0052" }, { "a": "T1505.003", "c": 0.4000000059604645, "d": "PHP $_GET parameter access", "e": [ "$_GET[" ], "i": "objectives/command-and-control/backdoor/webshell/request::php-get", "l": 1, "m": "B0030" }, { "a": "T1059", "c": 0.8500000238418579, "d": "HTTP GET parameter access ($_GET)", "e": [ "$_GET" ], "i": "micro-behaviors/communications/http/request/params::get-dup", "l": 3 }, { "a": "T1071", "c": 0.800000011920929, "d": "URL with .pw TLD (commonly abused)", "e": [ "http://picgures.pw/" ], "i": "objectives/command-and-control/infrastructure/domain/abused-tlds::tld-pw", "l": 3 }, { "c": 0.75, "d": "Generic $_SERVER superglobal access", "e": [ "$_SERVER" ], "i": "micro-behaviors/communications/http/request/params::server-dup", "l": 3 }, { "a": "T1005", "c": 0.75, "d": "Regex component marker", "e": [ "master" ], "i": "objectives/credential-access/financial/credit-card::mastercard-bin--rx-2", "l": 1, "m": "B0030" }, { "a": "T1584", "c": 1.0, "d": "PHP dynamic curl_exec call from lookup table", "e": [ "curl_exec(" ], "i": "objectives/command-and-control/dropper/delivery/seo-spam::php-dynamic-curl-exec", "l": 2 }, { "c": 0.8999999761581421, "d": "File has 30 or more lines", "e": [ "text.total_lines = 153.00" ], "i": "metadata/file/text/metrics::file-has-30-plus-lines", "l": 1 }, { "c": 0.8999999761581421, "d": "HTTPS protocol prefix", "e": [ "https://" ], "i": "micro-behaviors/communications/http/protocol::https-prefix", "l": 2 }, { "a": "T1083", "c": 1.0, "d": "Iterate directory contents via functions in PHP", "e": [ "scandir(" ], "i": "micro-behaviors/fs/directory/traverse::php-dir-traverse-fn", "l": 2 }, { "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "BingBot" ], "i": "objectives/anti-analysis/browser-detect::bot-ua-list--rx-1", "l": 1 }, { "c": 0.8199999928474426, "d": "Detects overwrite-mode file open", "e": [ "fopen($myname, \"w\"" ], "i": "objectives/impact/infect/script::php-overwrite-file-mode", "l": 1 }, { "c": 0.75, "d": "Googlebot token reference", "e": [ "Googlebot" ], "i": "objectives/supply-chain/hidden-payload/trojan::googlebot-token", "l": 1 }, { "a": "T1505.003", "d": "PHP open tag", "e": [ "\u003c?php" ], "i": "objectives/command-and-control/backdoor/webshell/request::php-tag", "l": 1, "m": "B0030" }, { "a": "T1505.003", "c": 1.0, "d": "Inequality check in WordPress user list", "e": [ "!=" ], "i": "objectives/command-and-control/backdoor/webshell/hide::wp-user-hiding-not-trait", "l": 1, "m": "B0030" }, { "c": 1.0, "d": "PHP scandir function symbol", "e": [ "scandir" ], "i": "micro-behaviors/fs/enumerate/directory::php-scandir", "l": 3 }, { "a": "T1110.001", "c": 0.8999999761581421, "d": "Weak password qwerty", "e": [ "qwerty" ], "i": "objectives/lateral-movement/brute-force/password::weak-pass-qwerty", "l": 1, "m": "E1110" }, { "c": 0.699999988079071, "d": "Mozilla/5.0 User-Agent prefix", "e": [ "Mozilla/5.0 (" ], "i": "micro-behaviors/communications/http/user-agent::browser-mozilla-5-0", "l": 3 }, { "c": 0.800000011920929, "d": "Sequential source identifier names", "e": [ "identifiers.sequential_names = 6.00" ], "i": "metadata/file/text/profile::sequential-identifiers", "l": 2 }, { "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "ia_archiver" ], "i": "objectives/anti-analysis/browser-detect::bot-ua-list--rx-4", "l": 1 }, { "c": 0.8199999928474426, "d": "Regex component marker", "e": [ "Speed" ], "i": "objectives/discovery/system/ics-environment/register::ics-register-flow-rate--rx-77", "l": 1 }, { "a": "T1071", "c": 0.6000000238418579, "d": "URL with .php endpoint", "e": [ "http://picgures.pw/story2.php" ], "i": "objectives/command-and-control/infrastructure/domain/tld::php-endpoint-url", "l": 1 }, { "c": 0.8999999761581421, "d": "HTTP protocol prefix", "e": [ "http://" ], "i": "micro-behaviors/communications/http/protocol::http-prefix", "l": 2 }, { "c": 0.8600000143051147, "d": "Regex component marker", "e": [ "$_SERVER[" ], "i": "objectives/command-and-control/backdoor/webshell/ui::self-named-get-form--rx-4", "l": 1, "m": "B0030" }, { "c": 0.699999988079071, "d": "PHP error suppression operator usage", "e": [ "@$isbot" ], "i": "micro-behaviors/os/stdio::error-suppress-prefix", "l": 3 }, { "a": "T1565.001", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "download" ], "i": "objectives/evasion/hosts-file/block-security::escan-security-domain--rx-1", "l": 1, "m": "F0004" }, { "a": "T1546", "c": 1.0, "d": "Writes data to a file via functions", "e": [ "fopen(" ], "i": "micro-behaviors/fs/file/write/direct::php-file-write-func", "l": 2 }, { "a": "T1005", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "exts" ], "i": "objectives/collection/stealer/tactics::office-secret-extension-list--rx-4", "l": 1, "m": "B0028" }, { "a": "T1027", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "HOST" ], "i": "objectives/anti-static/obfuscation/payload/config::url-component-concat--rx-12", "l": 1, "m": "B0032" }, { "a": "T1222", "c": 0.699999988079071, "d": "Changes file permissions via chmod()", "e": [ "chmod" ], "i": "micro-behaviors/fs/chmod/modify::chmod-call", "l": 3 }, { "c": 0.699999988079071, "d": "AJAX request handler pattern", "e": [ "$_GET[\"werbxverf\"]" ], "i": "objectives/command-and-control/backdoor/webshell/ui::ajax-handler", "l": 4, "m": "B0030" }, { "a": "T1082", "d": "Accesses SERVER_NAME variable", "e": [ "$_SERVER['SERVER_NAME']" ], "i": "objectives/discovery/system/fingerprint/info::server-name-access", "l": 3, "m": "E1082" }, { "c": 0.699999988079071, "d": "perl interpreter keyword (beyond shebang)", "e": [ "perl" ], "i": "micro-behaviors/process/interpreter/perl::perl-keyword", "l": 3 }, { "c": 0.8500000238418579, "d": "Checks User-Agent for crawler detection", "e": [ "$_SERVER['HTTP_USER_AGENT']" ], "i": "objectives/anti-analysis/browser-detect::check-ua-server-var", "l": 3 }, { "c": 0.8500000238418579, "d": "Logic to identify search engine crawlers", "e": [ "$_SERVER['HTTP_USER_AGENT']", "BingBot", "ia_archiver" ], "i": "objectives/anti-analysis/browser-detect::crawler-identification", "l": 3 }, { "a": "T1071", "c": 0.949999988079071, "d": "PHP endpoint on suspicious domain", "e": [ "http://picgures.pw/", "http://picgures.pw/story2.php" ], "i": "objectives/command-and-control/infrastructure/domain/tld::php-c2-endpoint", "l": 5 } ], "sha": "b42b7049adcc16d99222e2e6cfc925d63635e77d90893c3cb05fcddf69e9f5da", "path": "opgl24g5jf.php", "type": "php" } ], "tv": "a9555" } }