{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 0.9677777290344238,
        "class": 0
      }
    ],
    "prob": 0.9677777,
    "class": 0,
    "models": [
      {
        "m": "az",
        "prob": 0.8344549,
        "class": 0
      },
      {
        "m": "az/scripts",
        "prob": 0.9677777,
        "class": 0
      },
      {
        "m": "az/javascript",
        "prob": 0.10545129,
        "class": 0
      }
    ],
    "version": "v16.16",
    "thresholds": [
      0.9979839,
      1.0
    ],
    "analyzed_at": "2026-05-11T02:49:29Z"
  },
  "path": "Backdoor.Python.d00r.a",
  "raw": {
    "v": "4",
    "fs": [
      {
        "f": "H₂(CmPo₂)",
        "k": {
          "source.shebang": "/usr/bin/env python",
          "source.imports[0]": "\"-r\"",
          "source.imports[1]": "HOST",
          "source.imports[2]": "MAX_LEN",
          "source.imports[3]": "PORT",
          "source.imports[4]": "PW",
          "source.imports[5]": "SHELL",
          "source.imports[6]": "TIME_OUT",
          "source.imports[7]": "action",
          "source.imports[8]": "argv",
          "source.imports[9]": "cmd",
          "source.strings[0]": "/bin/zsh -c",
          "source.strings[1]": "\\nPass?\\n",
          "source.strings[2]": "error; help: head -n 16 d00r.py",
          "source.strings[3]": "host unreachable",
          "source.strings[4]": "j00 are on air!",
          "source.strings[5]": "j00 are on air!\\n",
          "source.strings[6]": "localhost",
          "source.strings[7]": "timeout",
          "source.has_imports": true,
          "source.imports[10]": "conn.recv",
          "source.imports[11]": "conn.send",
          "source.imports[12]": "conn.shutdown",
          "source.imports[13]": "def",
          "source.imports[14]": "exit",
          "source.imports[15]": "int",
          "source.imports[16]": "len",
          "source.imports[17]": "nsh_out",
          "source.imports[18]": "os.fork",
          "source.imports[19]": "os.popen",
          "source.imports[20]": "os.popen.readlines",
          "source.imports[21]": "out",
          "source.imports[22]": "pcmd",
          "source.imports[23]": "port",
          "source.imports[24]": "pw_in",
          "source.imports[25]": "range",
          "source.imports[26]": "run",
          "source.imports[27]": "sh_out",
          "source.imports[28]": "shell",
          "source.imports[29]": "sock",
          "source.imports[30]": "sock.accept",
          "source.imports[31]": "sock.bind",
          "source.imports[32]": "sock.connect",
          "source.imports[33]": "sock.listen",
          "source.imports[34]": "sock.send",
          "source.imports[35]": "sock.settimeout",
          "source.imports[36]": "sock.shutdown",
          "source.imports[37]": "socket.socket",
          "source.imports[38]": "sys.exit",
          "source.imports[39]": "time.sleep"
        },
        "x": 5,
        "id": 0,
        "is": [
          "port",
          "MAX_LEN",
          "SHELL",
          "TIME_OUT",
          "PW",
          "PORT",
          "HOST",
          "def",
          "sh_out",
          "os.popen.readlines",
          "os.popen",
          "nsh_out",
          "range",
          "len",
          "action",
          "conn.send",
          "pw_in",
          "conn.recv",
          "len",
          "conn.send",
          "conn.send",
          "pcmd",
          "conn.recv",
          "cmd",
          "range",
          "len",
          "len",
          "out",
          "shell",
          "conn.send",
          "argv",
          "len",
          "sys.exit",
          "PW",
          "PORT",
          "\"-r\"",
          "PW",
          "PORT",
          "HOST",
          "exit",
          "PORT",
          "int",
          "os.fork",
          "sys.exit",
          "sock",
          "socket.socket",
          "sock.settimeout",
          "sock.bind",
          "sock.listen",
          "run",
          "sock.connect",
          "time.sleep",
          "run",
          "action",
          "sock.accept",
          "time.sleep",
          "run",
          "action",
          "conn.shutdown",
          "sock.send",
          "time.sleep",
          "sock.shutdown"
        ],
        "ms": {
          "file": {
            "size": 2456.0
          },
          "text": {
            "tab_count": 238.0,
            "digit_ratio": 0.04,
            "space_count": 218.0,
            "total_lines": 121.0,
            "char_entropy": 5.2,
            "mixed_indent": true,
            "unique_chars": 78.0,
            "import_density": 51.24,
            "string_density": 0.38,
            "ascii_art_lines": 3.0,
            "avg_line_length": 18.3,
            "max_line_length": 57.0,
            "empty_line_ratio": 0.16,
            "last_line_length": 24.0,
            "most_common_char": "e",
            "whitespace_ratio": 0.28,
            "most_common_ratio": 0.05,
            "identifier_density": 1.49,
            "line_length_stddev": 13.5,
            "normalized_import_count": 5.64,
            "normalized_string_count": 4.18,
            "repeated_char_sequences": 5.0,
            "max_inline_whitespace_run": 7.0,
            "trailing_whitespace_lines": 16.0,
            "suspicious_identifier_ratio": 0.09,
            "normalized_unique_identifiers": 9.68
          },
          "imports": {
            "total": 62.0,
            "unique_modules": 40.0,
            "third_party_count": 62.0,
            "third_party_ratio": 1.0
          },
          "strings": {
            "total": 46.0,
            "avg_length": 6.7,
            "max_length": 31.0,
            "path_count": 2.0,
            "avg_entropy": 1.98,
            "total_bytes": 308.0,
            "entropy_stddev": 0.99
          },
          "comments": {},
          "functions": {},
          "identifiers": {
            "total": 180.0,
            "avg_length": 4.39,
            "max_length": 10.0,
            "min_length": 1.0,
            "avg_entropy": 1.83,
            "reuse_ratio": 0.37,
            "unique_count": 67.0,
            "length_stddev": 2.0,
            "has_digit_ratio": 0.01,
            "sequential_names": 6.0,
            "single_char_count": 6.0,
            "single_char_ratio": 0.09,
            "all_lowercase_ratio": 0.85,
            "all_uppercase_ratio": 0.09
          }
        },
        "ss": [
          [
            498,
            "/bin/zsh -c"
          ],
          [
            499,
            "/bin/zsh -c"
          ],
          [
            693,
            " "
          ],
          [
            694,
            " "
          ],
          [
            843,
            "\\nPass?\\n"
          ],
          [
            846,
            "Pass?"
          ],
          [
            904,
            "timeout"
          ],
          [
            905,
            "timeout"
          ],
          [
            957,
            "j00 are on air!\\n"
          ],
          [
            958,
            "j00 are on air!"
          ],
          [
            1032,
            "\u003e\u003e\u003e "
          ],
          [
            1033,
            "\u003e\u003e\u003e "
          ],
          [
            1105,
            "timeout"
          ],
          [
            1106,
            "timeout"
          ],
          [
            1162,
            "pcmd:"
          ],
          [
            1163,
            "pcmd:"
          ],
          [
            1276,
            "dc"
          ],
          [
            1277,
            "dc"
          ],
          [
            1318,
            "sd"
          ],
          [
            1319,
            "sd"
          ],
          [
            1507,
            "error; help: head -n 16 d00r.py"
          ],
          [
            1508,
            "error; help: head -n 16 d00r.py"
          ],
          [
            1570,
            "-b"
          ],
          [
            1571,
            "-b"
          ],
          [
            1620,
            "-r"
          ],
          [
            1621,
            "-r"
          ],
          [
            1725,
            "PW:"
          ],
          [
            1726,
            "PW:"
          ],
          [
            1734,
            "PORT:"
          ],
          [
            1735,
            "PORT:"
          ],
          [
            1747,
            "HOST:"
          ],
          [
            1748,
            "HOST:"
          ],
          [
            1777,
            "d00r"
          ],
          [
            1778,
            "d00r"
          ],
          [
            1963,
            "-b"
          ],
          [
            1964,
            "-b"
          ],
          [
            1982,
            "localhost"
          ],
          [
            1983,
            "localhost"
          ],
          [
            2059,
            "-r"
          ],
          [
            2060,
            "-r"
          ],
          [
            2124,
            "host unreachable"
          ],
          [
            2125,
            "host unreachable"
          ],
          [
            2253,
            "timeout"
          ],
          [
            2254,
            "timeout"
          ],
          [
            2351,
            "-b"
          ],
          [
            2352,
            "-b"
          ]
        ],
        "sz": 2456,
        "ts": [
          {
            "c": 0.699999988079071,
            "d": "netcat command keyword",
            "e": [
              "netcat"
            ],
            "i": "micro-behaviors/communications/socket/netcat::netcat-keyword",
            "l": 1
          },
          {
            "c": 0.30000001192092896,
            "d": "for loop (content)",
            "e": [
              "\tfor i in "
            ],
            "i": "micro-behaviors/data/control-flow/analysis::for-loop-content",
            "l": 2
          },
          {
            "a": "T1071.001",
            "c": 0.6000000238418579,
            "d": "WebSocket sends data to peer",
            "e": [
              ".send("
            ],
            "i": "micro-behaviors/communications/websocket/server::websocket-send",
            "l": 3,
            "m": "C0002"
          },
          {
            "a": "T1027",
            "c": 0.9200000166893005,
            "d": "HOST URL component identifier",
            "e": [
              "HOST"
            ],
            "i": "objectives/anti-static/obfuscation/payload/config::url-component-concat--rx-12",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1105",
            "c": 0.8500000238418579,
            "d": "ClickFix copy-paste action word",
            "e": [
              "run"
            ],
            "i": "objectives/command-and-control/dropper/execution/browser::clickfix-lure-action-word",
            "l": 1,
            "m": "B0024"
          },
          {
            "c": 0.9200000166893005,
            "d": "Regex component marker",
            "e": [
              "alpha"
            ],
            "i": "objectives/anti-static/obfuscation/syntax::js-eval-word-parts--rx-3",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "\"please\" instruction cue",
            "e": [
              "please"
            ],
            "i": "micro-behaviors/data/text/llm/action::llm-instruction-cue-please",
            "l": 1
          },
          {
            "a": "T1195.002",
            "c": 0.8999999761581421,
            "d": "Regex component marker",
            "e": [
              "local"
            ],
            "i": "objectives/supply-chain/hidden-payload/extensions/browser::extension-storage-proxy-ops--rx-15",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "Low string density base64 context",
            "e": [
              "text.string_density = 0.38"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/string-blob::js-base64-candidate-low-string-density",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1552.001,T1082,T1041",
            "c": 0.9399999976158142,
            "d": "Regex component marker",
            "e": [
              "error"
            ],
            "i": "objectives/supply-chain/recon-exfil/npm::console-output-silenced--rx-3",
            "l": 1
          },
          {
            "c": 0.75,
            "d": "Hardcoded localhost network host",
            "e": [
              "localhost"
            ],
            "i": "micro-behaviors/communications/ip/literal::localhost-source",
            "l": 2
          },
          {
            "a": "T1071.002",
            "c": 0.800000011920929,
            "d": "Generic JavaScript connect method call",
            "e": [
              "sock.connect( (HOST, PORT) )"
            ],
            "i": "micro-behaviors/communications/ftp/client::connect-call",
            "l": 1,
            "m": "C0004"
          },
          {
            "c": 0.8999999761581421,
            "d": "nc command invocation",
            "e": [
              "nc -l"
            ],
            "i": "micro-behaviors/communications/socket/netcat::nc",
            "l": 3
          },
          {
            "c": 0.8999999761581421,
            "d": "File has 30 or more lines",
            "e": [
              "text.total_lines = 121.00"
            ],
            "i": "metadata/file/text/metrics::file-has-30-plus-lines",
            "l": 1
          },
          {
            "d": "password keyword",
            "e": [
              "password"
            ],
            "i": "micro-behaviors/data/text/keywords/lexicon::password",
            "l": 1
          },
          {
            "a": "T1105",
            "c": 0.8500000238418579,
            "d": "macOS shell interpreter",
            "e": [
              "zsh"
            ],
            "i": "objectives/command-and-control/dropper/execution/browser::macos-shell-interpreter",
            "l": 1,
            "m": "B0024"
          },
          {
            "c": 0.8399999737739563,
            "d": "password/token/api_key field keyword",
            "e": [
              "password"
            ],
            "i": "micro-behaviors/data/text/keywords/credential::credential-field",
            "l": 1
          },
          {
            "c": 0.9800000190734863,
            "d": "shutdown command keyword",
            "e": [
              "shutdown"
            ],
            "i": "objectives/impact/system/power::shutdown-keyword",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "Localhost or IP literal string",
            "e": [
              "localhost"
            ],
            "i": "micro-behaviors/communications/http/url/path::local-ip-or-localhost-literal",
            "l": 1
          },
          {
            "c": 0.4000000059604645,
            "d": "socket module usage",
            "e": [
              "socket.socket("
            ],
            "i": "micro-behaviors/communications/http/request/client::socket-dot",
            "l": 3
          },
          {
            "c": 0.800000011920929,
            "d": "Sequential source identifier names",
            "e": [
              "identifiers.sequential_names = 6.00"
            ],
            "i": "metadata/file/text/profile::sequential-identifiers",
            "l": 2
          },
          {
            "c": 0.20000000298023224,
            "d": "command keyword",
            "e": [
              "command"
            ],
            "i": "micro-behaviors/data/text/keywords/lexicon::command-dup",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "Generic env-based shebang line",
            "e": [
              "#!/usr/bin/env python"
            ],
            "i": "metadata/lang/shebang::env-interpreter",
            "l": 2
          },
          {
            "a": "T1059.007",
            "c": 0.8999999761581421,
            "d": "Regex component marker",
            "e": [
              "send"
            ],
            "i": "objectives/command-and-control/remote-command/protocol::websocket-host-env-send--rx-12",
            "l": 1
          },
          {
            "d": "SOCK_STREAM socket type",
            "e": [
              "SOCK_STREAM"
            ],
            "i": "micro-behaviors/communications/socket/tcp::sock-stream",
            "l": 3
          },
          {
            "c": 0.699999988079071,
            "d": "python interpreter keyword (beyond shebang)",
            "e": [
              "python"
            ],
            "i": "micro-behaviors/process/interpreter/python::python-keyword",
            "l": 3
          },
          {
            "a": "T1071.001",
            "d": "listen() socket call",
            "e": [
              "listen"
            ],
            "i": "micro-behaviors/communications/http/server/listener::listen-keyword",
            "l": 3,
            "m": "C0002"
          },
          {
            "c": 0.800000011920929,
            "d": "shell execution with -c flag",
            "e": [
              "zsh -c"
            ],
            "i": "micro-behaviors/process/create/shell/invoke::sh-c-exec",
            "l": 3
          },
          {
            "a": "T1027",
            "c": 0.6000000238418579,
            "d": "No comments in code",
            "e": [
              "comments.total = 0.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::no-comments",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.699999988079071,
            "d": "Small file under 5KB",
            "e": [
              "Backdoor.Python.d00r.a"
            ],
            "i": "objectives/supply-chain/metadata-anomaly/package/npm::small-file-5k",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "zsh shell reference",
            "e": [
              "zsh"
            ],
            "i": "micro-behaviors/process/create/shell/invoke::zsh-exec",
            "l": 3
          },
          {
            "c": 0.6000000238418579,
            "d": "+= string concatenation from array access",
            "e": [
              "nsh_out+=sh_out[i]"
            ],
            "i": "micro-behaviors/data/encode/skip-step::js-loop-string-plus-equals",
            "l": 3
          }
        ],
        "sha": "b5281b942705e696b0503474b97cdc74a17632e4b5cd882a0a0002ef04aba7bd",
        "path": "/data/samples/bad/datasets/vxunderground-src/Python/Backdoor.Python.d00r.a",
        "type": "javascript"
      }
    ],
    "tv": "6a383"
  }
}