{ "ml": { "l": -1, "v": "6", "fs": [ { "l": -1, "id": 0, "prob": 0.8549450635910034 } ], "prob": 0.85494506, "models": [ { "m": "az", "raw": 0.15097754, "prob": 0.85494506, "class": 0 }, { "m": "az/source", "raw": 0.009239783, "prob": 0.058257442, "class": 0 }, { "m": "az/java", "raw": 0.9999998, "prob": 0.41071427, "class": 0 } ], "version": "v17.17", "analyzed_at": "2026-06-07T17:15:54Z" }, "path": "CompileServiceImpl.java", "raw": { "v": "6", "fs": [ { "f": "O(Er)H(F)", "x": 40, "ff": { "i": [ [ "", "LoggerFactory" ], [ "", "bypassAVConfigProperties" ], [ "", "bypassAVConfigProperties" ], [ "", "bypassAVConfigProperties" ], [ "", "Arrays" ], [ "", "shellcodeUploadDTO" ], [ "", "shellcodeUploadDTO" ], [ "", "shellcodeUploadDTO" ], [ "", "getRandomDirectorName" ], [ "", "Path" ], [ "", "TextFileProcessor" ], [ "", "workingDirectory" ], [ "", "Files" ], [ "", "ShellcodeProcessor" ], [ "", "shellcodeUploadDTO" ], [ "", "logger" ], [ "", "ShellcodeProcessor" ], [ "", "shellcodeUploadDTO" ], [ "", "shellcodeUploadDTO" ], [ "", "shellcodeUploadDTO" ], [ "", "shellcodeUploadDTO" ], [ "", "Files" ], [ "", "Path" ], [ "", "Files" ], [ "", "TextFileProcessor" ], [ "", "content" ], [ "", "shellcodeUploadDTO" ], [ "", "content" ], [ "", "shellcodeUploadDTO" ], [ "", "content" ], [ "", "content" ], [ "", "content" ], [ "", "ShellcodeProcessor" ], [ "", "String" ], [ "", "logger" ], [ "", "Files" ], [ "", "content" ], [ "", "CompilerCode" ], [ "", "String" ], [ "", "FileUtils" ], [ "", "FileUtils" ], [ "", "FileUtils" ], [ "", "shellcodeUploadDTO" ], [ "", "shellcodeUploadDTO" ], [ "", "shellcodeUploadDTO" ], [ "", "getRandomDirectorName" ], [ "", "Path" ], [ "", "TextFileProcessor" ], [ "", "workingDirectory" ], [ "", "Files" ], [ "", "ShellcodeProcessor" ], [ "", "shellcodeUploadDTO" ], [ "", "logger" ], [ "", "ShellcodeProcessor" ], [ "", "shellcodeUploadDTO" ], [ "", "shellcodeUploadDTO" ], [ "", "shellcodeUploadDTO" ], [ "", "shellcodeUploadDTO" ], [ "", "Files" ], [ "", "Path" ], [ "", "Files" ], [ "", "TextFileProcessor" ], [ "", "content" ], [ "", "shellcodeUploadDTO" ], [ "", "content" ], [ "", "shellcodeUploadDTO" ], [ "", "content" ], [ "", "content" ], [ "", "content" ], [ "", "ShellcodeProcessor" ], [ "", "String" ], [ "", "logger" ], [ "", "Files" ], [ "", "content" ], [ "", "CompilerCode" ], [ "", "String" ], [ "", "FileUtils" ], [ "", "FileUtils" ], [ "", "FileUtils" ], [ "", "shellcodeUploadDTO" ], [ "", "shellcodeUploadDTO" ], [ "", "shellcodeUploadDTO" ], [ "", "getRandomDirectorName" ], [ "", "Path" ], [ "", "TextFileProcessor" ], [ "", "workingDirectory" ], [ "", "Files" ], [ "", "ShellcodeProcessor" ], [ "", "shellcodeUploadDTO" ], [ "", "logger" ], [ "", "ShellcodeProcessor" ], [ "", "shellcodeUploadDTO" ], [ "", "shellcodeUploadDTO" ], [ "", "shellcodeUploadDTO" ], [ "", "shellcodeUploadDTO" ], [ "", "Path" ], [ "", "String" ], [ "", "Path" ], [ "", "String" ], [ "", "Files" ], [ "", "Path" ], [ "", "Files" ], [ "", "Files" ], [ "", "Path" ], [ "", "String" ], [ "", "Files" ], [ "", "Files" ], [ "", "Path" ], [ "", "String" ], [ "", "Files" ], [ "", "TextFileProcessor" ], [ "", "content" ], [ "", "shellcodeUploadDTO" ], [ "", "content" ], [ "", "shellcodeUploadDTO" ], [ "", "content" ], [ "", "content" ], [ "", "content" ], [ "", "ShellcodeProcessor" ], [ "", "String" ], [ "", "logger" ], [ "", "Files" ], [ "", "content" ], [ "", "CompilerCode" ], [ "", "String" ], [ "", "FileUtils" ], [ "", "FileUtils" ], [ "", "FileUtils" ], [ "", "com.yutian4060.avevasioncraftonline.config.BypassAVConfigProperties" ], [ "", "com.yutian4060.avevasioncraftonline.dto.CompilationResponseDTO" ], [ "", "com.yutian4060.avevasioncraftonline.dto.ShellcodeUploadDTO" ], [ "", "com.yutian4060.avevasioncraftonline.service.CompileService" ], [ "", "com.yutian4060.avevasioncraftonline.utils.CompilerCode" ], [ "", "com.yutian4060.avevasioncraftonline.utils.CompilerCode.getRandomDirectorName" ], [ "", "com.yutian4060.avevasioncraftonline.utils.FileUtils" ], [ "", "com.yutian4060.avevasioncraftonline.utils.ShellcodeProcessor" ], [ "", "com.yutian4060.avevasioncraftonline.utils.TextFileProcessor" ], [ "", "jakarta.annotation.PostConstruct" ], [ "", "java.io.File" ], [ "", "java.io.IOException" ], [ "", "java.nio.file.Files" ], [ "", "java.nio.file.Path" ], [ "", "java.nio.file.StandardCopyOption" ], [ "", "java.util.Arrays" ], [ "", "java.util.List" ], [ "", "org.slf4j.Logger" ], [ "", "org.slf4j.LoggerFactory" ], [ "", "org.springframework.beans.factory.annotation.Autowired" ], [ "", "org.springframework.stereotype.Service" ] ], "m": { "ast": { "op.add": 54.0, "max_depth": 21.0, "bind_count": 61.0, "call_count": 137.0, "node_count": 2653.0, "member_count": 4.0, "op_density.add": 0.02, "identifier_count": 116.0, "member_depth_max": 2.0, "string_literal_count": 53.0, "string_concat_chain_max_length": 12.0 }, "file": { "size": 13554.0, "entropy": 5.21, "size_bytes": 13554.0 }, "text": { "digit_ratio": 0.01, "space_count": 2593.0, "total_lines": 245.0, "char_entropy": 5.21, "unique_chars": 130.0, "string_density": 0.22, "avg_line_length": 54.32, "high_byte_ratio": 0.05, "max_line_length": 148.0, "non_ascii_ratio": 0.05, "empty_line_ratio": 0.15, "last_line_length": 1.0, "whitespace_ratio": 0.21, "most_common_ratio": 0.07, "identifier_density": 2.44, "line_length_stddev": 38.78, "normalized_string_count": 3.39, "repeated_char_sequences": 118.0, "most_common_char_is_null": 0.0, "suspicious_comment_ratio": 0.43, "max_inline_whitespace_run": 12.0, "most_common_char_codepoint": 101.0, "suspicious_identifier_ratio": 0.01, "normalized_unique_identifiers": 14.62 }, "binds": { "count": 61.0 }, "calls": { "count": 137.0 }, "binary": { "overall_entropy": 5.21 }, "source": { "class_count": 1.0, "function_count": 5.0 }, "imports": { "count": 21.0, "unique_modules": 21.0, "third_party_count": 21.0, "third_party_ratio": 1.0 }, "members": { "count": 4.0 }, "strings": { "total": 53.0, "avg_length": 8.42, "max_length": 21.0, "path_count": 3.0, "avg_entropy": 2.51, "total_bytes": 446.0, "entropy_stddev": 0.75 }, "comments": { "chars": 953.0, "lines": 28.0, "total": 28.0, "to_code_ratio": 0.13, "base64_in_comments": 3.0, "high_entropy_comments": 9.0 }, "functions": { "count": 6.0, "avg_params": 0.8, "max_params": 1.0, "length_stddev": 26.39, "avg_name_length": 16.4, "no_params_count": 1.0, "avg_length_lines": 37.0, "max_length_lines": 65.0, "min_length_lines": 4.0, "high_entropy_names": 1.0, "avg_param_name_length": 19.5, "density_per_100_lines": 2.04, "code_in_functions_ratio": 0.76 }, "identifiers": { "count": 116.0, "total": 599.0, "avg_length": 12.17, "max_length": 30.0, "min_length": 1.0, "avg_entropy": 2.88, "reuse_ratio": 0.19, "unique_count": 116.0, "length_stddev": 6.66, "has_digit_ratio": 0.02, "sequential_names": 1.0, "single_char_count": 1.0, "single_char_ratio": 0.01, "high_entropy_count": 25.0, "high_entropy_ratio": 0.22, "all_lowercase_ratio": 0.28, "all_uppercase_ratio": 0.11, "numeric_suffix_count": 1.0 } }, "s": [ [ 2015, "10", "8" ], [ 2160, "u8", "calc_payload" ], [ 2161, "u8", "calc_payload" ], [ 2176, "u8", "payload_len" ], [ 2177, "u8", "payload_len" ], [ 2191, "u8", "calcSt" ], [ 2192, "u8", "calcSt" ], [ 2201, "u8", "calcTH" ], [ 2202, "u8", "calcTH" ], [ 2211, "u8", "oldProtectCalc" ], [ 2212, "u8", "oldProtectCalc" ], [ 2229, "u8", "x2Ldrx" ], [ 2230, "u8", "x2Ldrx" ], [ 2239, "u8", "XOR" ], [ 2240, "u8", "XOR" ], [ 2277, "u8", "tId" ], [ 2278, "u8", "tId" ], [ 2284, "u8", "tHandle" ], [ 2285, "u8", "tHandle" ], [ 2295, "u8", "pHandle" ], [ 2296, "u8", "pHandle" ], [ 2306, "u8", "rPtr" ], [ 2307, "u8", "rPtr" ], [ 2314, "u8", "bytesWritten" ], [ 2315, "u8", "bytesWritten" ], [ 2364, "u8", "fetchShellcode" ], [ 2365, "u8", "fetchShellcode" ], [ 2382, "u8", "delayedLoading" ], [ 2383, "u8", "delayedLoading" ], [ 2400, "u8", "checkDomain" ], [ 2401, "u8", "checkDomain" ], [ 2415, "u8", "DecryptData" ], [ 2416, "u8", "DecryptData" ], [ 2430, "u8", "Ldr1" ], [ 2431, "u8", "Ldr1" ], [ 2438, "u8", "WriteMemory" ], [ 2439, "u8", "WriteMemory" ], [ 2453, "u8", "XorDecrypt" ], [ 2454, "u8", "XorDecrypt" ], [ 2524, "u8", "{{LOCAL_FILENAME}}" ], [ 2525, "u8", "{{LOCAL_FILENAME}}" ], [ 2592, "u8", "{{REMOTE_URL}}" ], [ 2593, "u8", "{{REMOTE_URL}}" ], [ 2662, "u8", "{{ICON}}" ], [ 2663, "u8", "{{ICON}}" ], [ 2725, "u8", "{{Key}}" ], [ 2726, "u8", "{{Key}}" ], [ 2787, "u8", "{{Len}}" ], [ 2788, "u8", "{{Len}}" ], [ 2855, "u8", "{{Shellcode}}" ], [ 2856, "u8", "{{Shellcode}}" ], [ 3590, "u8", ".c" ], [ 3591, "u8", ".c" ], [ 3895, "u8", "Random key: {}" ], [ 3896, "u8", "Random key: {}" ], [ 4382, "u8", ".c" ], [ 4383, "u8", ".c" ], [ 5519, "u8", "destinationPath： {}" ], [ 5520, "u8", "destinationPath： {}" ], [ 5859, "u8", ".exe" ], [ 5860, "u8", ".exe" ], [ 5905, "u8", ".bin" ], [ 5906, "u8", ".bin" ], [ 6076, "u8", "/download/" ], [ 6077, "u8", "/download/" ], [ 6112, "u8", ".zip" ], [ 6113, "u8", ".zip" ], [ 6933, "u8", ".nim" ], [ 6934, "u8", ".nim" ], [ 7240, "u8", "Random key: {}" ], [ 7241, "u8", "Random key: {}" ], [ 7727, "u8", ".nim" ], [ 7728, "u8", ".nim" ], [ 8866, "u8", "destinationPath： {}" ], [ 8867, "u8", "destinationPath： {}" ], [ 9208, "u8", ".exe" ], [ 9209, "u8", ".exe" ], [ 9254, "u8", ".bin" ], [ 9255, "u8", ".bin" ], [ 9425, "u8", "/download/" ], [ 9426, "u8", "/download/" ], [ 9461, "u8", ".zip" ], [ 9462, "u8", ".zip" ], [ 10281, "u8", ".go" ], [ 10282, "u8", ".go" ], [ 10587, "u8", "Random key: {}" ], [ 10588, "u8", "Random key: {}" ], [ 11135, "u8", ".go" ], [ 11136, "u8", ".go" ], [ 11218, "u8", "go.mod" ], [ 11219, "u8", "go.mod" ], [ 11306, "u8", "go.sum" ], [ 11307, "u8", "go.sum" ], [ 11636, "u8", "go.mod" ], [ 11637, "u8", "go.mod" ], [ 11830, "u8", "go.sum" ], [ 11831, "u8", "go.sum" ], [ 12835, "u8", "destinationPath： {}" ], [ 12836, "u8", "destinationPath： {}" ], [ 13176, "u8", ".exe" ], [ 13177, "u8", ".exe" ], [ 13222, "u8", ".bin" ], [ 13223, "u8", ".bin" ], [ 13413, "u8", "/download/" ], [ 13414, "u8", "/download/" ], [ 13449, "u8", ".zip" ], [ 13450, "u8", ".zip" ] ], "v": { "file.stem": "CompileServiceImpl", "file.basename": "CompileServiceImpl.java", "source.language": "java", "source.imports[0]": "Arrays", "source.imports[1]": "CompilerCode", "source.imports[2]": "FileUtils", "source.imports[3]": "Files", "source.imports[4]": "LoggerFactory", "source.imports[5]": "Path", "source.imports[6]": "ShellcodeProcessor", "source.imports[7]": "String", "source.imports[8]": "TextFileProcessor", "source.imports[9]": "bypassAVConfigProperties", "source.strings[0]": "/download/", "source.strings[1]": "DecryptData", "source.strings[2]": "Random key: {}", "source.strings[3]": "WriteMemory", "source.strings[4]": "XorDecrypt", "source.strings[5]": "bytesWritten", "source.strings[6]": "calcSt", "source.strings[7]": "calcTH", "source.strings[8]": "calc_payload", "source.strings[9]": "checkDomain", "source.has_imports": true, "source.imports[10]": "com.yutian4060.avevasioncraftonline.config.BypassAVConfigProperties", "source.imports[11]": "com.yutian4060.avevasioncraftonline.dto.CompilationResponseDTO", "source.imports[12]": "com.yutian4060.avevasioncraftonline.dto.ShellcodeUploadDTO", "source.imports[13]": "com.yutian4060.avevasioncraftonline.service.CompileService", "source.imports[14]": "com.yutian4060.avevasioncraftonline.utils.CompilerCode", "source.imports[15]": "com.yutian4060.avevasioncraftonline.utils.CompilerCode.getRandomDirectorName", "source.imports[16]": "com.yutian4060.avevasioncraftonline.utils.FileUtils", "source.imports[17]": "com.yutian4060.avevasioncraftonline.utils.ShellcodeProcessor", "source.imports[18]": "com.yutian4060.avevasioncraftonline.utils.TextFileProcessor", "source.imports[19]": "content", "source.imports[20]": "getRandomDirectorName", "source.imports[21]": "jakarta.annotation.PostConstruct", "source.imports[22]": "java.io.File", "source.imports[23]": "java.io.IOException", "source.imports[24]": "java.nio.file.Files", "source.imports[25]": "java.nio.file.Path", "source.imports[26]": "java.nio.file.StandardCopyOption", "source.imports[27]": "java.util.Arrays", "source.imports[28]": "java.util.List", "source.imports[29]": "logger", "source.imports[30]": "org.slf4j.Logger", "source.imports[31]": "org.slf4j.LoggerFactory", "source.imports[32]": "org.springframework.beans.factory.annotation.Autowired", "source.imports[33]": "org.springframework.stereotype.Service", "source.imports[34]": "shellcodeUploadDTO", "source.imports[35]": "workingDirectory", "source.strings[10]": "delayedLoading", "source.strings[11]": "destinationPath： {}", "source.strings[12]": "fetchShellcode", "source.strings[13]": "go.mod", "source.strings[14]": "go.sum", "source.strings[15]": "oldProtectCalc", "source.strings[16]": "pHandle", "source.strings[17]": "payload_len", "source.strings[18]": "tHandle", "source.strings[19]": "x2Ldrx", "source.strings[20]": "{{ICON}}", "source.strings[21]": "{{Key}}", "source.strings[22]": "{{LOCAL_FILENAME}}", "source.strings[23]": "{{Len}}", "source.strings[24]": "{{REMOTE_URL}}", "source.strings[25]": "{{Shellcode}}", "source.functions[0]": "compileCodeC", "source.functions[1]": "compileCodeGo", "source.functions[2]": "compileCodeNim", "source.functions[3]": "initializeConstants", "source.functions[4]": "setApplicationProperties" }, "ct": [ "CompilationResponseDTO", "RuntimeException", "String", "asList", "compileC", "compileGo", "compileNim", "copy", "createDirectories", "deleteDirectory", "exists", "generateRandomString", "getAdditionalParameter", "getBytes", "getCompilerWorkDirectory", "getKey", "getLogger", "getRandomDirectorName", "getShellcode", "getStorageDirectory", "getStorageType", "getTemplateLanguage", "getTemplateName", "getTemplatesDirectory", "getTransformation", "info", "of", "readAllBytes", "replace", "replaceFunctionNames", "resolve", "saveFileZIP", "transformation", "valueOf", "write", "writeREADME" ], "id": "java", "mc": [ "CompileServiceImpl.bypassAVConfigProperties", "File.separator", "StandardCopyOption.REPLACE_EXISTING", "shellcodeByte.length" ] }, "id": 0, "sz": 13554, "ts": [ { "a": "T1027.009,T1059", "c": 0.9200000166893005, "d": "Java temporary payload prefix", "e": [ "payload_" ], "i": "objectives/command-and-control/dropper/staging/encrypted::java-temp-shell-payload-name", "l": 1, "m": "B0032,E1059" }, { "c": 0.8999999761581421, "d": "Java Files.write usage", "e": [ "Files.write" ], "i": "micro-behaviors/fs/write/file/direct::java-files-write-source", "l": 3 }, { "a": "T1027", "c": 0.9599999785423279, "d": "Embedded shellcode resource staging", "e": [ "shellcode" ], "i": "objectives/evasion/fileless/memory::shellcode-resource-staging", "l": 4 }, { "c": 0.9700000286102295, "d": "Validation vocabulary string", "e": [ "String" ], "i": "metadata/file/text/format::vocab-string", "l": 1 }, { "c": 0.75, "d": "Java write call reference", "e": [ "write" ], "i": "micro-behaviors/fs/file/copy::write-ref", "l": 1 } ], "sha": "b5fa57f0bd61aa33f8739c663fe4b6b3463e2552a770237e2794fd7d84b56c4e", "path": "CompileServiceImpl.java", "type": "java" } ], "tv": "318d5" } }