{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9919290542602539, "class": 2 } ], "prob": 0.99192905, "class": 2, "models": [ { "m": "az", "prob": 0.9004079, "class": 0 }, { "m": "az/scripts", "prob": 0.99192905, "class": 0 }, { "m": "az/php", "prob": 0.9908991, "class": 2 } ], "version": "v16.16", "thresholds": [ 0.9961138, 0.99909174 ], "analyzed_at": "2026-05-10T00:17:59Z" }, "path": "xmlrpc_Rating.php", "raw": { "v": "4", "fs": [ { "f": "O₄(As₄C₄ILa)H₄(CmF₅OsDb)Md₂(Pt)", "k": { "source.imports[0]": "Chr", "source.imports[1]": "Ord", "source.imports[2]": "PclError", "source.imports[3]": "PclErrorCode", "source.imports[4]": "PclErrorReset", "source.imports[5]": "PclErrorString", "source.imports[6]": "PclZipUtilCopyBlock", "source.imports[7]": "PclZipUtilOptionText", "source.imports[8]": "PclZipUtilPathInclusion", "source.imports[9]": "PclZipUtilPathReduction", "source.strings[0]": " : Missing zlib extensions", "source.strings[1]": " Some trailing bytes exists after the archive.", "source.strings[2]": " [code ", "source.strings[3]": " already open", "source.strings[4]": " can not be used with option 'PCLZIP_OPT_TEMP_FILE_OFF", "source.strings[5]": " can not be used with option 'PCLZIP_OPT_TEMP_FILE_ON", "source.strings[6]": " can not be used with option 'PCLZIP_OPT_TEMP_FILE_THRESHOLD", "source.strings[7]": " does not exist", "source.strings[8]": " exists ", "source.strings[9]": " filename ", "source.has_imports": true, "source.imports[10]": "PclZipUtilRename", "source.imports[11]": "PclZipUtilTranslateWinPath", "source.imports[12]": "array_merge", "source.imports[13]": "array_shift", "source.imports[14]": "base64_decode", "source.imports[15]": "basename", "source.imports[16]": "bin2hex", "source.imports[17]": "chmod", "source.imports[18]": "clearstatcache", "source.imports[19]": "closedir", "source.imports[20]": "copy", "source.imports[21]": "crc32", "source.imports[22]": "define", "source.imports[23]": "defined", "source.imports[24]": "die", "source.imports[25]": "dirname", "source.imports[26]": "explode", "source.imports[27]": "fclose", "source.imports[28]": "file_exists", "source.imports[29]": "file_put_contents", "source.imports[30]": "filemtime", "source.imports[31]": "filesize", "source.imports[32]": "floor", "source.imports[33]": "fopen", "source.imports[34]": "fputs", "source.imports[35]": "fread", "source.imports[36]": "fseek", "source.imports[37]": "ftell", "source.imports[38]": "func_get_args", "source.imports[39]": "func_num_args", "source.imports[40]": "function_exists", "source.imports[41]": "fwrite", "source.imports[42]": "getDirContents", "source.imports[43]": "get_class", "source.imports[44]": "get_defined_constants", "source.imports[45]": "get_magic_quotes_runtime", "source.imports[46]": "getcwd", "source.imports[47]": "getdate", "source.imports[48]": "gettype", "source.imports[49]": "gzclose", "source.imports[50]": "gzdeflate", "source.imports[51]": "gzinflate", "source.imports[52]": "gzopen", "source.imports[53]": "gzputs", "source.imports[54]": "gzread", "source.imports[55]": "gzwrite", "source.imports[56]": "ini_get", "source.imports[57]": "is_array", "source.imports[58]": "is_dir", "source.imports[59]": "is_file", "source.imports[60]": "is_integer", "source.imports[61]": "is_link", "source.imports[62]": "is_object", "source.imports[63]": "is_readable", "source.imports[64]": "is_string", "source.imports[65]": "is_writeable", "source.imports[66]": "isset", "source.imports[67]": "key", "source.imports[68]": "mkdir", "source.imports[69]": "mktime", "source.imports[70]": "next", "source.imports[71]": "opendir", "source.imports[72]": "ord", "source.imports[73]": "pack", "source.imports[74]": "pathinfo", "source.imports[75]": "php_uname", "source.imports[76]": "preg_match", "source.imports[77]": "rand", "source.imports[78]": "readdir", "source.imports[79]": "realpath", "source.imports[80]": "rename", "source.imports[81]": "reset", "source.imports[82]": "rewind", "source.imports[83]": "scandir", "source.imports[84]": "set_magic_quotes_runtime", "source.imports[85]": "sizeof", "source.imports[86]": "stristr", "source.imports[87]": "strlen", "source.imports[88]": "strpos", "source.imports[89]": "strstr", "source.imports[90]": "strtolower", "source.imports[91]": "strtr", "source.imports[92]": "substr", "source.imports[93]": "time", "source.imports[94]": "touch", "source.imports[95]": "trim", "source.imports[96]": "uniqid", "source.imports[97]": "unlink", "source.imports[98]": "unpack", "source.strings[10]": " for p_filelist", "source.strings[11]": " for this file", "source.strings[12]": " for this method", "source.strings[13]": " has invalid filesize - should be minimum 18 bytes", "source.strings[14]": " in binary read mode", "source.strings[15]": " in binary write mode", "source.strings[16]": " is encrypted. Encrypted files are not supported.", "source.strings[17]": "$mUJzDQVi4358", "source.strings[18]": "'v*+K*RIaGZ", "source.strings[19]": "'~Ei#{GC~]f{ffIRy!#PZifD\u0026p@Ye+VYEqiajQAikdtqKA`uaku~x$!gz_PR{}E[`EWYy~uQTEUB]\\ucIvvx%GEYwzijBdjk^e!8kVQj8rJK`g*[g\"vcX$$8U{\u0026tTDBzQBzVuq%%Db'vD$'*pb\u003c", "source.strings[20]": "()' is not an existing function for option ", "source.strings[21]": ". Integer expected for attribute ", "source.strings[22]": ". String expected for attribute ", "source.strings[23]": "1425756856", "source.strings[24]": "3.3raarj;:(", "source.strings[25]": "3333333333", "source.strings[26]": "333333333333337eLwza", "source.strings[27]": "33333333337eLwza", "source.strings[28]": "33333333337z88(", "source.strings[29]": "33333333553;2uz", "source.strings[30]": "333333337cLuz", "source.strings[31]": "333333337eLer", "source.strings[32]": "333333337eLrggL", "source.strings[33]": "333333337z88(", "source.strings[34]": "33333333Cp", "source.strings[35]": "33333333Sp", "source.strings[36]": "33333333oo3;7cLuz", "source.strings[37]": "33333333up", "source.strings[38]": "33333333zu3;7cLuz", "source.strings[39]": "33333337ArRQfuJY+\u0026+*3=.37AaGIZ", "source.strings[40]": "3333337eLrggL", "source.strings[41]": "3333337eLwza", "source.strings[42]": "333333qavrx(", "source.strings[43]": "333333wvurf", "source.strings[44]": "333333zu3;7eLwza", "source.strings[45]": "33337ArRQfuJY+\u0026+*3.311(", "source.strings[46]": "33337eLratL", "source.strings[47]": "33337t3.37V", "source.strings[48]": "3333\u003c9gY}~Tdz]ZJ_]WQ]yKA[QEwy^qI]|f\\x{Ux@\\\\dWzjxZ]B]IPg\\Er~R|wqZf", "source.strings[49]": "3333zu3;333;7cLuz", "source.strings[50]": "3333zu3;7cLuf", "source.strings[51]": "3333zu3;7cLuz", "source.strings[52]": "3333zu3;uz", "source.strings[53]": "33era37izcLuw3.3#(", "source.strings[54]": "835c2j0917s.a4;ohbg*6wdftlpy(i_mznurevq)k/x", "source.strings[55]": "Abort ", "source.strings[56]": "Error : ", "source.strings[57]": "File \\", "source.strings[58]": "Filename ", "source.strings[59]": "Function ", "source.strings[60]": "Integer expected for option ", "source.strings[61]": "Invalid End of Central Dir Record size : ", "source.strings[62]": "Invalid archive size", "source.strings[63]": "Invalid archive structure", "source.strings[64]": "Invalid block size : ", "source.strings[65]": "Invalid empty filename for attribute ", "source.strings[66]": "Invalid empty full filename for attribute ", "source.strings[67]": "Invalid empty short filename for attribute ", "source.strings[68]": "Invalid file attribute ", "source.strings[69]": "Invalid file list parameter (invalid or empty list)", "source.strings[70]": "Invalid number / type of arguments", "source.strings[71]": "Invalid optional parameter ", "source.strings[72]": "Invalid order of index range for option ", "source.strings[73]": "Invalid type ", "source.strings[74]": "Invalid variable type ", "source.strings[75]": "Invalid variable type p_archive_to_add", "source.strings[76]": "Invalid variable type p_filelist", "source.strings[77]": "JbvxPVT^r+z'^R]ribpwf}Wju[+F}WvDpug8^Gt%y@r%fIPywa|D\u0026eU@tCRt#DBFf+%wdz_UR]!8}gpvRPJ!C~FwwqIE8{{wea\\Z%%e%bcX__A}\\\\x`@ekFbB\"!xECj_x!t[qwXru|\u003c\u0026Jii#`!IykIG", "source.strings[78]": "Lwza3.3raarj;:(", "source.strings[79]": "Missing archive file ", "source.strings[80]": "Missing mandatory parameter ", "source.strings[81]": "Missing parameter value for option ", "source.strings[82]": "Newer version of ", "source.strings[83]": "No file with filename ", "source.strings[84]": "NoName", "source.strings[85]": "Option ", "source.strings[86]": "PCLZIP_ATT", "source.strings[87]": "PCLZIP_ATT_FILE_COMMENT", "source.strings[88]": "PCLZIP_ATT_FILE_CONTENT", "source.strings[89]": "PCLZIP_ATT_FILE_MTIME", "source.strings[90]": "PCLZIP_ATT_FILE_NAME", "source.strings[91]": "PCLZIP_ATT_FILE_NEW_FULL_NAME", "source.strings[92]": "PCLZIP_ATT_FILE_NEW_SHORT_NAME", "source.strings[93]": "PCLZIP_CB_", "source.strings[94]": "PCLZIP_CB_POST_ADD", "source.strings[95]": "PCLZIP_CB_POST_EXTRACT", "source.strings[96]": "PCLZIP_CB_PRE_ADD", "source.strings[97]": "PCLZIP_CB_PRE_EXTRACT", "source.strings[98]": "PCLZIP_ERROR_EXTERNAL", "source.strings[99]": "PCLZIP_ERR_ALREADY_A_DIRECTORY", "source.functions[0]": "PclZip", "source.functions[1]": "PclZipUtilCopyBlock", "source.functions[2]": "PclZipUtilOptionText", "source.functions[3]": "PclZipUtilPathInclusion", "source.functions[4]": "PclZipUtilPathReduction", "source.functions[5]": "PclZipUtilRename", "source.functions[6]": "PclZipUtilTranslateWinPath", "source.functions[7]": "add", "source.functions[8]": "create", "source.functions[9]": "delete", "source.strings[100]": "PCLZIP_ERR_BAD_CHECKSUM", "source.strings[101]": "PCLZIP_ERR_BAD_EXTENSION", "source.strings[102]": "PCLZIP_ERR_BAD_EXTRACTED_FILE", "source.strings[103]": "PCLZIP_ERR_BAD_FORMAT", "source.strings[104]": "PCLZIP_ERR_DELETE_FILE_FAIL", "source.strings[105]": "PCLZIP_ERR_DIRECTORY_RESTRICTION", "source.strings[106]": "PCLZIP_ERR_DIR_CREATE_FAIL", "source.strings[107]": "PCLZIP_ERR_FILENAME_TOO_LONG", "source.strings[108]": "PCLZIP_ERR_INVALID_ARCHIVE_ZIP", "source.strings[109]": "PCLZIP_ERR_INVALID_ATTRIBUTE_VALUE", "source.strings[110]": "PCLZIP_ERR_INVALID_OPTION_VALUE", "source.strings[111]": "PCLZIP_ERR_INVALID_PARAMETER", "source.strings[112]": "PCLZIP_ERR_INVALID_ZIP", "source.strings[113]": "PCLZIP_ERR_MISSING_FILE", "source.strings[114]": "PCLZIP_ERR_MISSING_OPTION_VALUE", "source.strings[115]": "PCLZIP_ERR_NO_ERROR", "source.strings[116]": "PCLZIP_ERR_READ_OPEN_FAIL", "source.strings[117]": "PCLZIP_ERR_RENAME_FILE_FAIL", "source.strings[118]": "PCLZIP_ERR_UNSUPPORTED_COMPRESSION", "source.strings[119]": "PCLZIP_ERR_UNSUPPORTED_ENCRYPTION", "source.strings[120]": "PCLZIP_ERR_USER_ABORTED", "source.strings[121]": "PCLZIP_ERR_WRITE_OPEN_FAIL", "source.strings[122]": "PCLZIP_OPT", "source.strings[123]": "PCLZIP_OPT_ADD_COMMENT", "source.strings[124]": "PCLZIP_OPT_ADD_PATH", "source.strings[125]": "PCLZIP_OPT_BY_EREG", "source.strings[126]": "PCLZIP_OPT_BY_INDEX", "source.strings[127]": "PCLZIP_OPT_BY_NAME", "source.strings[128]": "PCLZIP_OPT_BY_PREG", "source.strings[129]": "PCLZIP_OPT_COMMENT", "source.strings[130]": "PCLZIP_OPT_EXTRACT_AS_STRING", "source.strings[131]": "PCLZIP_OPT_EXTRACT_DIR_RESTRICTION", "source.strings[132]": "PCLZIP_OPT_EXTRACT_IN_OUTPUT", "source.strings[133]": "PCLZIP_OPT_NO_COMPRESSION", "source.strings[134]": "PCLZIP_OPT_PATH", "source.strings[135]": "PCLZIP_OPT_PREPEND_COMMENT", "source.strings[136]": "PCLZIP_OPT_REMOVE_ALL_PATH", "source.strings[137]": "PCLZIP_OPT_REMOVE_PATH", "source.strings[138]": "PCLZIP_OPT_REPLACE_NEWER", "source.strings[139]": "PCLZIP_OPT_SET_CHMOD", "source.strings[140]": "PCLZIP_OPT_STOP_ON_ERROR", "source.strings[141]": "PCLZIP_OPT_TEMP_FILE_OFF", "source.strings[142]": "PCLZIP_OPT_TEMP_FILE_ON", "source.strings[143]": "PCLZIP_OPT_TEMP_FILE_THRESHOLD", "source.strings[144]": "PCLZIP_READ_BLOCK_SIZE", "source.strings[145]": "PCLZIP_SEPARATOR", "source.strings[146]": "PCLZIP_TEMPORARY_DIR", "source.strings[147]": "PCLZIP_TEMPORARY_FILE_RATIO", "source.strings[148]": "The central dir is not at the end of the archive.", "source.strings[149]": "Too many values in index range for option ", "source.strings[150]": "Unable to create directory ", "source.strings[151]": "Unable to create directory '$p_dir", "source.strings[152]": "Unable to find End of Central Dir Record signature", "source.strings[153]": "Unable to go to the end of the archive ", "source.strings[154]": "Unable to go to the end of the archive \\", "source.strings[155]": "Unable to open archive ", "source.strings[156]": "Unable to open archive \\", "source.strings[157]": "Unable to open archive file ", "source.strings[158]": "Unable to open archive file \\", "source.strings[159]": "Unable to open file ", "source.strings[160]": "Unable to open file '$p_filename' in binary read mode", "source.strings[161]": "Unable to open temporary file ", "source.strings[162]": "Unable to open temporary file \\", "source.strings[163]": "Unable to read archive ", "source.strings[164]": "Unable to seek back to the middle of the archive ", "source.strings[165]": "Unable to seek back to the middle of the archive \\", "source.strings[166]": "Unknown", "source.strings[167]": "Unknown parameter ", "source.strings[168]": "Unsupported encryption for ", "source.strings[169]": "Value must be integer, string or array for option ", "source.strings[170]": "Vcrc/Vcompressed_size", "source.strings[171]": "VvvvvVVv", "source.strings[172]": "VvvvvvVVVvv", "source.strings[173]": "VvvvvvvVVVvvvvvVV", "source.strings[174]": "Wrong parameter value for option ", "source.strings[175]": "Zip file ", "source.strings[176]": "Zip file \\", "source.strings[177]": "\\' already open", "source.strings[178]": "\\' has invalid filesize - should be minimum 18 bytes", "source.strings[179]": "\\' in ", "source.strings[180]": "\\' in binary read mode", "source.strings[181]": "\\' in binary write mode", "source.strings[182]": "\\' is encrypted. Encrypted files are not supported.", "source.strings[183]": "a1id1/a1id2/a1cm/a1flag/Vmtime/a1xfl/a1os", "source.strings[184]": "aaGUYrcrUX+$fTbFgv", "source.strings[185]": "aborted", "source.strings[186]": "already used by an existing directory", "source.strings[187]": "already_a_directory", "source.strings[188]": "and is write protected", "source.strings[189]": "and option PCLZIP_OPT_REPLACE_NEWER is not selected", "source.strings[190]": "comment", "source.strings[191]": "comment_len", "source.strings[192]": "comment_size", "source.strings[193]": "compressed by an unsupported compression ", "source.strings[194]": "compressed_size", "source.strings[195]": "compression", "source.strings[196]": "content", "source.strings[197]": "dirname", "source.strings[198]": "disk_entries", "source.strings[199]": "disk_start", "source.strings[200]": "entries", "source.strings[201]": "external", "source.strings[202]": "extra_len", "source.strings[203]": "file test okay", "source.strings[204]": "filename", "source.strings[205]": "filename_len", "source.strings[206]": "filename_too_long", "source.strings[207]": "filtered", "source.strings[208]": "folder", "source.strings[209]": "fv32.31=135537er", "source.strings[210]": "fv::3oo3;7eLer", "source.strings[211]": "get_magic_quotes_runtime", "source.strings[212]": "gzip temporary file ", "source.strings[213]": "gzip temporary file \\", "source.strings[214]": "gzopen", "source.strings[215]": "internal", "source.strings[216]": "invalid_header", "source.strings[217]": "mandatory", "source.strings[218]": "memory_limit", "source.strings[219]": "method (", "source.strings[220]": "minutes", "source.strings[221]": "new_full_name", "source.strings[222]": "new_short_name", "source.strings[223]": "newer_exist", "source.strings[224]": "not_exist", "source.strings[225]": "offset", "source.strings[226]": "optional", "source.strings[227]": "outside PCLZIP_OPT_EXTRACT_DIR_RESTRICTION", "source.strings[228]": "path_creation_fail", "source.strings[229]": "pclzip", "source.strings[230]": "pclzip-", "source.strings[231]": "qK EDF wKF#*rE @F", "source.strings[232]": "read_error", "source.strings[233]": "seconds", "source.strings[234]": "set_magic_quotes_runtime", "source.strings[235]": "skipped", "source.strings[236]": "status", "source.strings[237]": "stored_filename", "source.strings[238]": "test_url", "source.strings[239]": "unsupported_compression", "source.strings[240]": "unsupported_encryption", "source.strings[241]": "v341=7cLuz", "source.strings[242]": "va1a1Va1a1", "source.strings[243]": "va::32..3ur", "source.strings[244]": "vdisk/vdisk_start/vdisk_entries/ventries/Vsize/Voffset/vcomment_size", "source.strings[245]": "version", "source.strings[246]": "version_extracted", "source.strings[247]": "virtual_file", "source.strings[248]": "vversion/vflag/vcompression/vmtime/vmdate/Vcrc/Vcompressed_size/Vsize/vfilename_len/vextra_len", "source.strings[249]": "vversion/vversion_extracted/vflag/vcompression/vmtime/vmdate/Vcrc/Vcompressed_size/Vsize/vfilename_len/vextra_len/vcomment_len/vdisk/vinternal/Vexternal/Voffset", "source.strings[250]": "windows", "source.strings[251]": "write_error", "source.strings[252]": "write_protected", "source.strings[253]": "ynibgkd65jf.zip", "source.strings[254]": "zaITj\\JrJI", "source.strings[255]": "{_qd!$EupKEyg$ZEQY'Ca\u0026 v_+y@\u0026pdVB\u003cu*fzY\\Z_zYPiDY*\u003cK!]$}#\u003cv", "source.functions[10]": "deleteByIndex", "source.functions[11]": "duplicate", "source.functions[12]": "errorCode", "source.functions[13]": "errorInfo", "source.functions[14]": "errorName", "source.functions[15]": "extract", "source.functions[16]": "extractByIndex", "source.functions[17]": "getDirContents", "source.functions[18]": "listContent", "source.functions[19]": "merge", "source.functions[20]": "privAdd", "source.functions[21]": "privAddFile", "source.functions[22]": "privAddFileList", "source.functions[23]": "privAddFileUsingTempFile", "source.functions[24]": "privAddList", "source.functions[25]": "privCalculateStoredFilename", "source.functions[26]": "privCheckFileHeaders", "source.functions[27]": "privCheckFormat", "source.functions[28]": "privCloseFd", "source.functions[29]": "privConvertHeader2FileInfo", "source.functions[30]": "privCreate", "source.functions[31]": "privDeleteByRule", "source.functions[32]": "privDirCheck", "source.functions[33]": "privDisableMagicQuotes", "source.functions[34]": "privDuplicate", "source.functions[35]": "privErrorLog", "source.functions[36]": "privErrorReset", "source.functions[37]": "privExtractByRule", "source.functions[38]": "privExtractFile", "source.functions[39]": "privExtractFileAsString", "source.functions[40]": "privExtractFileInOutput", "source.functions[41]": "privExtractFileUsingTempFile", "source.functions[42]": "privFileDescrExpand", "source.functions[43]": "privFileDescrParseAtt", "source.functions[44]": "privList", "source.functions[45]": "privMerge", "source.functions[46]": "privOpenFd", "source.functions[47]": "privOptionDefaultThreshold", "source.functions[48]": "privParseOptions", "source.functions[49]": "privReadCentralFileHeader", "source.functions[50]": "privReadEndCentralDir", "source.functions[51]": "privReadFileHeader", "source.functions[52]": "privSwapBackMagicQuotes", "source.functions[53]": "privWriteCentralFileHeader", "source.functions[54]": "privWriteCentralHeader", "source.functions[55]": "privWriteFileHeader", "source.functions[56]": "properties" }, "x": 83, "id": 0, "is": [ "isset", "isset", "scandir", "realpath", "is_dir", "getDirContents", "base64_decode", "file_put_contents", "defined", "define", "defined", "define", "defined", "define", "defined", "define", "defined", "define", "define", "define", "define", "define", "define", "define", "define", "define", "define", "define", "define", "define", "define", "define", "define", "define", "define", "define", "define", "define", "define", "define", "define", "define", "define", "define", "define", "function_exists", "die", "basename", "func_num_args", "func_get_args", "array_shift", "is_integer", "is_array", "isset", "is_array", "is_string", "explode", "sizeof", "func_num_args", "func_get_args", "array_shift", "is_integer", "is_array", "isset", "is_array", "is_string", "explode", "gettype", "sizeof", "func_num_args", "func_get_args", "is_integer", "isset", "isset", "isset", "isset", "strlen", "substr", "func_num_args", "func_get_args", "array_shift", "is_integer", "isset", "isset", "isset", "isset", "strlen", "substr", "isset", "sizeof", "func_num_args", "func_get_args", "is_file", "fopen", "is_object", "get_class", "is_string", "is_file", "is_object", "get_class", "is_string", "PclErrorCode", "isset", "PclErrorString", "clearstatcache", "is_file", "is_readable", "isset", "PclZipUtilOptionText", "PclZipUtilTranslateWinPath", "PclZipUtilOptionText", "isset", "PclZipUtilOptionText", "is_integer", "PclZipUtilOptionText", "isset", "PclZipUtilOptionText", "isset", "PclZipUtilOptionText", "isset", "PclZipUtilOptionText", "PclZipUtilOptionText", "is_string", "PclZipUtilTranslateWinPath", "PclZipUtilOptionText", "is_string", "is_array", "PclZipUtilOptionText", "PclZipUtilOptionText", "is_string", "PclZipUtilOptionText", "PclZipUtilOptionText", "is_string", "PclZipUtilOptionText", "PclZipUtilOptionText", "is_string", "strtr", "explode", "is_integer", "is_array", "PclZipUtilOptionText", "sizeof", "explode", "sizeof", "PclZipUtilOptionText", "PclZipUtilOptionText", "PclZipUtilOptionText", "PclZipUtilOptionText", "function_exists", "PclZipUtilOptionText", "reset", "key", "next", "isset", "PclZipUtilOptionText", "isset", "isset", "isset", "ini_get", "trim", "strtolower", "substr", "floor", "isset", "is_string", "gettype", "PclZipUtilOptionText", "PclZipUtilPathReduction", "PclZipUtilOptionText", "is_string", "gettype", "PclZipUtilOptionText", "PclZipUtilPathReduction", "PclZipUtilOptionText", "is_string", "gettype", "PclZipUtilOptionText", "PclZipUtilPathReduction", "PclZipUtilOptionText", "is_string", "gettype", "PclZipUtilOptionText", "is_integer", "gettype", "PclZipUtilOptionText", "reset", "key", "next", "isset", "PclZipUtilOptionText", "sizeof", "PclZipUtilTranslateWinPath", "PclZipUtilPathReduction", "file_exists", "is_file", "is_dir", "is_link", "isset", "sizeof", "opendir", "readdir", "isset", "closedir", "array_merge", "is_file", "filesize", "rewind", "uniqid", "fopen", "fread", "fwrite", "fclose", "unlink", "ftell", "fread", "fwrite", "sizeof", "fclose", "unlink", "isset", "isset", "isset", "ftell", "fclose", "unlink", "PclZipUtilRename", "fopen", "fclose", "ftell", "sizeof", "isset", "ftell", "sizeof", "sizeof", "PclZipUtilTranslateWinPath", "file_exists", "isset", "clearstatcache", "strlen", "filesize", "filemtime", "filesize", "strlen", "time", "filemtime", "strlen", "PclZipUtilPathReduction", "strlen", "fopen", "fread", "fclose", "crc32", "gzdeflate", "strlen", "fclose", "fwrite", "crc32", "gzdeflate", "strlen", "fclose", "fwrite", "substr", "fopen", "uniqid", "gzopen", "fclose", "filesize", "fread", "gzputs", "fclose", "gzclose", "filesize", "fopen", "fread", "unpack", "bin2hex", "fseek", "filesize", "fread", "unpack", "ord", "filesize", "fclose", "fopen", "fseek", "fread", "fwrite", "fclose", "unlink", "PclZipUtilTranslateWinPath", "pathinfo", "basename", "substr", "substr", "substr", "substr", "substr", "substr", "substr", "substr", "PclZipUtilPathInclusion", "substr", "strlen", "PclZipUtilTranslateWinPath", "substr", "PclZipUtilPathReduction", "ftell", "getdate", "pack", "strlen", "fputs", "strlen", "fputs", "strlen", "fputs", "getdate", "pack", "strlen", "fputs", "strlen", "fputs", "strlen", "fputs", "fputs", "pack", "strlen", "fputs", "strlen", "fputs", "strlen", "fopen", "rewind", "fseek", "PclZipUtilPathReduction", "PclZipUtilPathReduction", "substr", "substr", "substr", "substr", "substr", "strlen", "substr", "strlen", "rewind", "fseek", "ftell", "sizeof", "substr", "strlen", "strlen", "substr", "strlen", "preg_match", "sizeof", "rewind", "fseek", "basename", "PclZipUtilPathInclusion", "strlen", "substr", "substr", "PclZipUtilPathInclusion", "file_exists", "is_dir", "is_writeable", "filemtime", "substr", "strstr", "dirname", "fopen", "fread", "fwrite", "fclose", "touch", "fread", "gzinflate", "fopen", "fwrite", "fclose", "touch", "chmod", "uniqid", "fopen", "fclose", "pack", "Chr", "Chr", "time", "Chr", "Chr", "fwrite", "fread", "fwrite", "pack", "fwrite", "fclose", "fopen", "gzopen", "fclose", "gzread", "fwrite", "fclose", "gzclose", "unlink", "fread", "fread", "gzinflate", "fread", "fread", "gzinflate", "fread", "unpack", "fread", "strlen", "strlen", "unpack", "fread", "fread", "mktime", "time", "fread", "unpack", "fread", "strlen", "strlen", "unpack", "fread", "fread", "fread", "mktime", "time", "substr", "filesize", "fseek", "ftell", "fseek", "ftell", "fread", "unpack", "ftell", "fseek", "ftell", "ftell", "fread", "Ord", "fread", "strlen", "strlen", "unpack", "fread", "rewind", "rewind", "fseek", "sizeof", "substr", "strlen", "strlen", "substr", "preg_match", "sizeof", "uniqid", "sizeof", "rewind", "fseek", "unlink", "unlink", "unlink", "PclZipUtilCopyBlock", "unlink", "ftell", "sizeof", "unlink", "ftell", "sizeof", "unlink", "unlink", "PclZipUtilRename", "substr", "substr", "is_dir", "dirname", "mkdir", "is_file", "is_file", "rewind", "rewind", "uniqid", "fopen", "fread", "fwrite", "fread", "fwrite", "ftell", "fread", "fwrite", "fread", "fwrite", "ftell", "fclose", "fclose", "unlink", "PclZipUtilRename", "is_file", "fopen", "filesize", "fread", "fwrite", "fclose", "PclError", "PclErrorReset", "function_exists", "function_exists", "get_magic_quotes_runtime", "set_magic_quotes_runtime", "function_exists", "function_exists", "set_magic_quotes_runtime", "explode", "sizeof", "sizeof", "sizeof", "substr", "PclZipUtilTranslateWinPath", "getcwd", "substr", "PclZipUtilTranslateWinPath", "getcwd", "explode", "sizeof", "explode", "sizeof", "fwrite", "gzread", "fwrite", "gzwrite", "gzread", "gzwrite", "rename", "copy", "unlink", "get_defined_constants", "reset", "key", "next", "stristr", "php_uname", "strpos", "strpos", "strtr", "die", "explode", "getDirContents", "touch", "time", "rand", "touch", "time", "rand", "touch", "time", "rand", "unlink", "die" ], "ms": { "file": { "size": 133949.0 }, "text": { "tab_count": 269.0, "digit_ratio": 0.06, "space_count": 23131.0, "total_lines": 3948.0, "char_entropy": 5.53, "mixed_indent": true, "unique_chars": 93.0, "import_density": 14.26, "lines_over_200": 2.0, "lines_over_500": 1.0, "string_density": 0.5, "avg_line_length": 31.94, "lines_over_1000": 1.0, "max_line_length": 19807.0, "empty_line_ratio": 0.24, "last_line_length": 1.0, "long_token_count": 9.0, "most_common_char": "e", "whitespace_ratio": 0.23, "most_common_ratio": 0.04, "identifier_density": 1.21, "line_length_stddev": 316.23, "encoded_string_ratio": 0.0, "normalized_import_count": 8.96, "normalized_string_count": 31.48, "repeated_char_sequences": 440.0, "suspicious_string_ratio": 0.0, "suspicious_comment_ratio": 2.0, "max_inline_whitespace_run": 3.0, "normalized_function_count": 0.91, "trailing_whitespace_lines": 122.0, "imports_to_functions_ratio": 9.88, "strings_to_functions_ratio": 34.7, "suspicious_identifier_ratio": 0.02, "normalized_unique_identifiers": 31.64, "identifiers_to_functions_ratio": 6.63 }, "imports": { "total": 563.0, "unique_modules": 99.0, "third_party_count": 563.0, "third_party_ratio": 1.0 }, "strings": { "total": 1978.0, "avg_length": 31.55, "max_length": 19780.0, "path_count": 26.0, "avg_entropy": 2.5, "hex_strings": 2.0, "total_bytes": 62401.0, "entropy_stddev": 1.09, "base64_candidates": 2.0, "very_long_strings": 2.0, "high_entropy_count": 4.0, "embedded_code_candidates": 4.0 }, "comments": { "chars": 640.0, "lines": 5.0, "total": 5.0, "to_code_ratio": 0.0, "base64_in_comments": 5.0, "high_entropy_comments": 5.0 }, "functions": { "total": 57.0, "length_stddev": 66.31, "over_100_lines": 11.0, "avg_name_length": 15.67, "no_params_count": 57.0, "avg_length_lines": 65.18, "max_length_lines": 288.0, "min_length_lines": 7.0, "high_entropy_names": 24.0, "density_per_100_lines": 1.44, "code_in_functions_ratio": 0.94 }, "identifiers": { "total": 4767.0, "avg_length": 12.61, "max_length": 34.0, "min_length": 1.0, "avg_entropy": 2.94, "reuse_ratio": 0.08, "unique_count": 378.0, "length_stddev": 7.36, "has_digit_ratio": 0.03, "sequential_names": 4.0, "base64_like_names": 5.0, "single_char_count": 4.0, "single_char_ratio": 0.01, "high_entropy_count": 73.0, "high_entropy_ratio": 0.19, "all_lowercase_ratio": 0.66, "all_uppercase_ratio": 0.16, "numeric_suffix_count": 7.0, "double_underscore_count": 1.0, "underscore_prefix_count": 2.0 } }, "ss": [ [ 28, "835c2j0917s.a4;ohbg*6wdftlpy(i_mznurevq)k/x" ], [ 29, "835c2j0917s.a4;ohbg*6wdftlpy(i_mznurevq)k/x" ], [ 341, "$mUJzDQVi4358" ], [ 525, "$mUJzDQVi4358" ], [ 1249, "n" ], [ 1250, "n" ], [ 1259, "o" ], [ 1260, "o" ], [ 1266, "i" ], [ 1267, "i" ], [ 1270, "t" ], [ 1271, "t" ], [ 1280, "c" ], [ 1281, "c" ], [ 1290, "n" ], [ 1291, "n" ], [ 1300, "u" ], [ 1301, "u" ], [ 1313, "f" ], [ 1314, "f" ], [ 1320, "_" ], [ 1321, "_" ], [ 1324, "e" ], [ 1325, "e" ], [ 1328, "t" ], [ 1329, "t" ], [ 1332, "a" ], [ 1333, "a" ], [ 1336, "e" ], [ 1337, "e" ], [ 1349, "r" ], [ 1350, "r" ], [ 1359, "c" ], [ 1360, "c" ], [ 1476, "test_url" ], [ 1477, "test_url" ], [ 1506, "file test okay" ], [ 1507, "file test okay" ], [ 1814, "." ], [ 1815, "." ], [ 1831, ".." ], [ 1832, ".." ], [ 21784, "ynibgkd65jf.zip" ], [ 21785, "ynibgkd65jf.zip" ], [ 21829, "PCLZIP_READ_BLOCK_SIZE" ], [ 21830, "PCLZIP_READ_BLOCK_SIZE" ], [ 21869, "PCLZIP_READ_BLOCK_SIZE" ], [ 21870, "PCLZIP_READ_BLOCK_SIZE" ], [ 21922, "PCLZIP_SEPARATOR" ], [ 21923, "PCLZIP_SEPARATOR" ], [ 21956, "PCLZIP_SEPARATOR" ], [ 21957, "PCLZIP_SEPARATOR" ], [ 21976, "," ], [ 21977, "," ], [ 22002, "PCLZIP_ERROR_EXTERNAL" ], [ 22003, "PCLZIP_ERROR_EXTERNAL" ], [ 22041, "PCLZIP_ERROR_EXTERNAL" ], [ 22042, "PCLZIP_ERROR_EXTERNAL" ], [ 22090, "PCLZIP_TEMPORARY_DIR" ], [ 22091, "PCLZIP_TEMPORARY_DIR" ], [ 22128, "PCLZIP_TEMPORARY_DIR" ], [ 22129, "PCLZIP_TEMPORARY_DIR" ], [ 22177, "PCLZIP_TEMPORARY_FILE_RATIO" ], [ 22178, "PCLZIP_TEMPORARY_FILE_RATIO" ], [ 22222, "PCLZIP_TEMPORARY_FILE_RATIO" ], [ 22223, "PCLZIP_TEMPORARY_FILE_RATIO" ], [ 22289, "2.8.2" ], [ 22290, "2.8.2" ], [ 22309, "PCLZIP_ERR_USER_ABORTED" ], [ 22310, "PCLZIP_ERR_USER_ABORTED" ], [ 22350, "PCLZIP_ERR_NO_ERROR" ], [ 22351, "PCLZIP_ERR_NO_ERROR" ], [ 22387, "PCLZIP_ERR_WRITE_OPEN_FAIL" ], [ 22388, "PCLZIP_ERR_WRITE_OPEN_FAIL" ], [ 22432, "PCLZIP_ERR_READ_OPEN_FAIL" ], [ 22433, "PCLZIP_ERR_READ_OPEN_FAIL" ], [ 22476, "PCLZIP_ERR_INVALID_PARAMETER" ], [ 22477, "PCLZIP_ERR_INVALID_PARAMETER" ], [ 22523, "PCLZIP_ERR_MISSING_FILE" ], [ 22524, "PCLZIP_ERR_MISSING_FILE" ], [ 22565, "PCLZIP_ERR_FILENAME_TOO_LONG" ], [ 22566, "PCLZIP_ERR_FILENAME_TOO_LONG" ], [ 22612, "PCLZIP_ERR_INVALID_ZIP" ], [ 22613, "PCLZIP_ERR_INVALID_ZIP" ], [ 22653, "PCLZIP_ERR_BAD_EXTRACTED_FILE" ], [ 22654, "PCLZIP_ERR_BAD_EXTRACTED_FILE" ], [ 22701, "PCLZIP_ERR_DIR_CREATE_FAIL" ], [ 22702, "PCLZIP_ERR_DIR_CREATE_FAIL" ], [ 22746, "PCLZIP_ERR_BAD_EXTENSION" ], [ 22747, "PCLZIP_ERR_BAD_EXTENSION" ], [ 22789, "PCLZIP_ERR_BAD_FORMAT" ], [ 22790, "PCLZIP_ERR_BAD_FORMAT" ], [ 22830, "PCLZIP_ERR_DELETE_FILE_FAIL" ], [ 22831, "PCLZIP_ERR_DELETE_FILE_FAIL" ], [ 22877, "PCLZIP_ERR_RENAME_FILE_FAIL" ], [ 22878, "PCLZIP_ERR_RENAME_FILE_FAIL" ], [ 22924, "PCLZIP_ERR_BAD_CHECKSUM" ], [ 22925, "PCLZIP_ERR_BAD_CHECKSUM" ], [ 22967, "PCLZIP_ERR_INVALID_ARCHIVE_ZIP" ], [ 22968, "PCLZIP_ERR_INVALID_ARCHIVE_ZIP" ], [ 23017, "PCLZIP_ERR_MISSING_OPTION_VALUE" ], [ 23018, "PCLZIP_ERR_MISSING_OPTION_VALUE" ], [ 23068, "PCLZIP_ERR_INVALID_OPTION_VALUE" ], [ 23069, "PCLZIP_ERR_INVALID_OPTION_VALUE" ], [ 23119, "PCLZIP_ERR_ALREADY_A_DIRECTORY" ], [ 23120, "PCLZIP_ERR_ALREADY_A_DIRECTORY" ], [ 23169, "PCLZIP_ERR_UNSUPPORTED_COMPRESSION" ], [ 23170, "PCLZIP_ERR_UNSUPPORTED_COMPRESSION" ], [ 23223, "PCLZIP_ERR_UNSUPPORTED_ENCRYPTION" ], [ 23224, "PCLZIP_ERR_UNSUPPORTED_ENCRYPTION" ], [ 23276, "PCLZIP_ERR_INVALID_ATTRIBUTE_VALUE" ], [ 23277, "PCLZIP_ERR_INVALID_ATTRIBUTE_VALUE" ], [ 23330, "PCLZIP_ERR_DIRECTORY_RESTRICTION" ], [ 23331, "PCLZIP_ERR_DIRECTORY_RESTRICTION" ], [ 23384, "PCLZIP_OPT_PATH" ], [ 23385, "PCLZIP_OPT_PATH" ], [ 23421, "PCLZIP_OPT_ADD_PATH" ], [ 23422, "PCLZIP_OPT_ADD_PATH" ], [ 23462, "PCLZIP_OPT_REMOVE_PATH" ], [ 23463, "PCLZIP_OPT_REMOVE_PATH" ], [ 23506, "PCLZIP_OPT_REMOVE_ALL_PATH" ], [ 23507, "PCLZIP_OPT_REMOVE_ALL_PATH" ], [ 23554, "PCLZIP_OPT_SET_CHMOD" ], [ 23555, "PCLZIP_OPT_SET_CHMOD" ], [ 23596, "PCLZIP_OPT_EXTRACT_AS_STRING" ], [ 23597, "PCLZIP_OPT_EXTRACT_AS_STRING" ], [ 23646, "PCLZIP_OPT_NO_COMPRESSION" ], [ 23647, "PCLZIP_OPT_NO_COMPRESSION" ], [ 23693, "PCLZIP_OPT_BY_NAME" ], [ 23694, "PCLZIP_OPT_BY_NAME" ], [ 23733, "PCLZIP_OPT_BY_INDEX" ], [ 23734, "PCLZIP_OPT_BY_INDEX" ], [ 23774, "PCLZIP_OPT_BY_EREG" ], [ 23775, "PCLZIP_OPT_BY_EREG" ], [ 23814, "PCLZIP_OPT_BY_PREG" ], [ 23815, "PCLZIP_OPT_BY_PREG" ], [ 23854, "PCLZIP_OPT_COMMENT" ], [ 23855, "PCLZIP_OPT_COMMENT" ], [ 23894, "PCLZIP_OPT_ADD_COMMENT" ], [ 23895, "PCLZIP_OPT_ADD_COMMENT" ], [ 23938, "PCLZIP_OPT_PREPEND_COMMENT" ], [ 23939, "PCLZIP_OPT_PREPEND_COMMENT" ], [ 23986, "PCLZIP_OPT_EXTRACT_IN_OUTPUT" ], [ 23987, "PCLZIP_OPT_EXTRACT_IN_OUTPUT" ], [ 24036, "PCLZIP_OPT_REPLACE_NEWER" ], [ 24037, "PCLZIP_OPT_REPLACE_NEWER" ], [ 24082, "PCLZIP_OPT_STOP_ON_ERROR" ], [ 24083, "PCLZIP_OPT_STOP_ON_ERROR" ], [ 24128, "PCLZIP_OPT_EXTRACT_DIR_RESTRICTION" ], [ 24129, "PCLZIP_OPT_EXTRACT_DIR_RESTRICTION" ], [ 24184, "PCLZIP_OPT_TEMP_FILE_THRESHOLD" ], [ 24185, "PCLZIP_OPT_TEMP_FILE_THRESHOLD" ], [ 24236, "PCLZIP_OPT_TEMP_FILE_ON" ], [ 24237, "PCLZIP_OPT_TEMP_FILE_ON" ], [ 24281, "PCLZIP_OPT_TEMP_FILE_OFF" ], [ 24282, "PCLZIP_OPT_TEMP_FILE_OFF" ], [ 24329, "PCLZIP_ATT_FILE_NAME" ], [ 24330, "PCLZIP_ATT_FILE_NAME" ], [ 24371, "PCLZIP_ATT_FILE_NEW_SHORT_NAME" ], [ 24372, "PCLZIP_ATT_FILE_NEW_SHORT_NAME" ], [ 24423, "PCLZIP_ATT_FILE_NEW_FULL_NAME" ], [ 24424, "PCLZIP_ATT_FILE_NEW_FULL_NAME" ], [ 24474, "PCLZIP_ATT_FILE_MTIME" ], [ 24475, "PCLZIP_ATT_FILE_MTIME" ], [ 24517, "PCLZIP_ATT_FILE_CONTENT" ], [ 24518, "PCLZIP_ATT_FILE_CONTENT" ], [ 24562, "PCLZIP_ATT_FILE_COMMENT" ], [ 24563, "PCLZIP_ATT_FILE_COMMENT" ], [ 24609, "PCLZIP_CB_PRE_EXTRACT" ], [ 24610, "PCLZIP_CB_PRE_EXTRACT" ], [ 24652, "PCLZIP_CB_POST_EXTRACT" ], [ 24653, "PCLZIP_CB_POST_EXTRACT" ], [ 24696, "PCLZIP_CB_PRE_ADD" ], [ 24697, "PCLZIP_CB_PRE_ADD" ], [ 24735, "PCLZIP_CB_POST_ADD" ], [ 24736, "PCLZIP_CB_POST_ADD" ], [ 24975, "gzopen" ], [ 24976, "gzopen" ], [ 25000, "Abort " ], [ 25001, "Abort " ], [ 25028, " : Missing zlib extensions" ], [ 25029, " : Missing zlib extensions" ], [ 25697, "optional" ], [ 25698, "optional" ], [ 25789, "optional" ], [ 25790, "optional" ], [ 25874, "optional" ], [ 25875, "optional" ], [ 25957, "optional" ], [ 25958, "optional" ], [ 26041, "optional" ], [ 26042, "optional" ], [ 26132, "optional" ], [ 26133, "optional" ], [ 26216, "optional" ], [ 26217, "optional" ], [ 26312, "optional" ], [ 26313, "optional" ], [ 26401, "optional" ], [ 26402, "optional" ], [ 26491, "optional" ], [ 26492, "optional" ], [ 26954, "Invalid number / type of arguments" ], [ 26955, "Invalid number / type of arguments" ], [ 27590, "Invalid variable type p_filelist" ], [ 27591, "Invalid variable type p_filelist" ], [ 27934, "mandatory" ], [ 27935, "mandatory" ], [ 27993, "optional" ], [ 27994, "optional" ], [ 28050, "optional" ], [ 28051, "optional" ], [ 28099, "optional" ], [ 28100, "optional" ], [ 28150, "optional" ], [ 28151, "optional" ], [ 28201, "optional" ], [ 28202, "optional" ], [ 29371, "optional" ], [ 29372, "optional" ], [ 29463, "optional" ], [ 29464, "optional" ], [ 29548, "optional" ], [ 29549, "optional" ], [ 29631, "optional" ], [ 29632, "optional" ], [ 29715, "optional" ], [ 29716, "optional" ], [ 29806, "optional" ], [ 29807, "optional" ], [ 29890, "optional" ], [ 29891, "optional" ], [ 29978, "optional" ], [ 29979, "optional" ], [ 30070, "optional" ], [ 30071, "optional" ], [ 30166, "optional" ], [ 30167, "optional" ], [ 30255, "optional" ], [ 30256, "optional" ], [ 30345, "optional" ], [ 30346, "optional" ], [ 30768, "Invalid number / type of arguments" ], [ 30769, "Invalid number / type of arguments" ], [ 31404, "Invalid variable type " ], [ 31405, "Invalid variable type " ], [ 31451, " for p_filelist" ], [ 31452, " for p_filelist" ], [ 31715, "mandatory" ], [ 31716, "mandatory" ], [ 31774, "optional" ], [ 31775, "optional" ], [ 31831, "optional" ], [ 31832, "optional" ], [ 31880, "optional" ], [ 31881, "optional" ] ], "sz": 133949, "ts": [ { "c": 0.800000011920929, "d": "PHP copy() symbol", "e": [ "copy" ], "i": "objectives/impact/infect/script::php-copy-call", "l": 1 }, { "a": "T1505.003", "c": 0.4000000059604645, "d": "PHP $_REQUEST[...] superglobal access", "e": [ "$_REQUEST[" ], "i": "objectives/command-and-control/backdoor/webshell/request::php-request", "l": 1, "m": "B0030" }, { "c": 0.8399999737739563, "d": "\"to the\" doc cue", "e": [ "to the" ], "i": "micro-behaviors/data/text/llm/action::llm-send-action-cond-6--inline-11768", "l": 1 }, { "a": "T1505.003", "c": 0.8999999761581421, "d": "PHP source imports file_put_contents", "e": [ "[Chr, Ord, PclError, PclErrorCode, PclErrorReset, PclErrorString, PclZipUtilCopyBlock, PclZipUtilOptionText, PclZipUtilPathInclu" ], "i": "objectives/command-and-control/backdoor/webshell/stager::source-import-file-put-contents", "l": 1 }, { "c": 0.8399999737739563, "d": "\"store\" doc cue (storage instruction)", "e": [ "store" ], "i": "micro-behaviors/data/text/llm/action::llm-send-action-cond-6--inline-11769", "l": 1 }, { "a": "T1546", "c": 1.0, "d": "Writes data to a file via functions", "e": [ "file_put_contents(" ], "i": "micro-behaviors/fs/file/write/direct::php-file-write-func", "l": 2 }, { "a": "T1505.003", "c": 0.8999999761581421, "d": "PHP source imports base64_decode", "e": [ "[Chr, Ord, PclError, PclErrorCode, PclErrorReset, PclErrorString, PclZipUtilCopyBlock, PclZipUtilOptionText, PclZipUtilPathInclu" ], "i": "objectives/command-and-control/backdoor/webshell/stager::source-import-base64-decode", "l": 1 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Exactly one line exceeds 1000 chars", "e": [ "text.lines_over_1000 = 1.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::single-long-line-outlier", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.9200000166893005, "d": "bytes() literal (Python byte array)", "e": [ "bytes" ], "i": "objectives/anti-static/obfuscation/payload/config::api-named-byte-array-const--rx-6", "l": 1, "m": "B0032" }, { "a": "T1105", "c": 0.800000011920929, "d": "Creates or overwrites a local file", "e": [ "file_put_contents" ], "i": "micro-behaviors/fs/write/file/direct::file-put-contents", "l": 3, "m": "C0052" }, { "c": 0.699999988079071, "d": "PHP error suppression operator usage", "e": [ "@fopen($v_zip_temp_name, 'wb')", "@fwrite($v_zip_temp_fd, $v_buffer, $v_read_size)", "@fread($v_zip_temp_fd, $v_read_size)", "@rewind($this-\u003ezip_fd)", "@unlink($v_zip_temp_name)", "@opendir($v_descr['filename'])", "@ftell($this-\u003ezip_fd)", "@closedir($v_folder_handler)", "@fopen($this-\u003ezipname, 'rb')", "@readdir($v_folder_handler)", "@is_file($this-\u003ezipname)", "@is_dir($v_descr['filename'])", "@is_file($v_descr['filename'])", "@fwrite($this-\u003ezip_fd, $v_buffer, $v_read_size)", "@is_link($v_descr['filename'])" ], "i": "micro-behaviors/os/stdio::error-suppress-prefix", "l": 3 }, { "a": "T1083", "c": 1.0, "d": "Iterate directory contents via functions in PHP", "e": [ "scandir(" ], "i": "micro-behaviors/fs/directory/traverse::php-dir-traverse-fn", "l": 2 }, { "c": 0.75, "d": "Archive open or extract instruction", "e": [ "open archive" ], "i": "objectives/lateral-movement/social-engineering/lures::open-or-extract-zip-archive", "l": 1 }, { "c": 0.8999999761581421, "d": "File has 30 or more lines", "e": [ "text.total_lines = 3948.00" ], "i": "metadata/file/text/metrics::file-has-30-plus-lines", "l": 1 }, { "a": "T1505.003", "c": 0.8500000238418579, "d": "PHP request superglobal access", "e": [ "$_REQUEST" ], "i": "objectives/command-and-control/backdoor/webshell/upload::php-request-variadic-function-call", "l": 3, "m": "B0030" }, { "c": 0.800000011920929, "d": "Writes a string to an open file", "e": [ "fputs" ], "i": "micro-behaviors/fs/write/file/direct::fputs", "l": 3, "m": "C0052" }, { "c": 0.8999999761581421, "d": "Very long line", "e": [ "text.max_line_length = 19807.00" ], "i": "metadata/file/text/metrics::single-long-line", "l": 1 }, { "a": "T1222", "c": 0.699999988079071, "d": "Changes file permissions via chmod()", "e": [ "chmod" ], "i": "micro-behaviors/fs/chmod/modify::chmod-call", "l": 3 }, { "c": 0.800000011920929, "d": "PHP variable function invocation pattern", "e": [ "t", "g", "RaABufYJ8589", "ElkwNOhQ9982" ], "i": "objectives/anti-static/obfuscation/imports::dynamic-function-execution", "l": 3 }, { "c": 0.800000011920929, "d": "PHP rename() symbol", "e": [ "rename" ], "i": "objectives/impact/infect/script::php-rename-call", "l": 1 }, { "c": 0.800000011920929, "d": "Writes data to an open file", "e": [ "fwrite" ], "i": "micro-behaviors/fs/write/file/direct::fwrite", "l": 3, "m": "C0052" }, { "a": "T1059", "c": 0.800000011920929, "d": "Self-reference via __FILE__", "e": [ "__FILE__" ], "i": "micro-behaviors/fs/read/self::self-file-reference", "l": 3 }, { "c": 1.0, "d": "PHP scandir function symbol", "e": [ "scandir" ], "i": "micro-behaviors/fs/enumerate/directory::php-scandir", "l": 3 }, { "a": "T1584", "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "strstr" ], "i": "objectives/command-and-control/dropper/delivery/seo-spam::php-seo-cloaking--rx-3", "l": 1 }, { "a": "T1059", "c": 0.8500000238418579, "d": "HTTP REQUEST parameter access ($_REQUEST)", "e": [ "$_REQUEST" ], "i": "micro-behaviors/communications/http/request/params::request-dup", "l": 3 }, { "c": 0.699999988079071, "d": "\"directory\" path-target noun", "e": [ "directory" ], "i": "micro-behaviors/data/text/llm/action::llm-path-noun-directory", "l": 1 }, { "a": "T1505.003", "c": 0.9900000095367432, "d": "Decodes a large embedded payload (base64)", "e": [ "base64_decode(\"UEsDBAoAAAAAAEkLgk4AAAAAAAAAAAAAAAAMAAAAeW5pYmdrZDY1amYvUEsDBBQAAAAIAMcFKEy5ei+fpAAAAPoAAAAWAAAAeW5pYmdrZDY1amYva" ], "i": "objectives/command-and-control/backdoor/webshell/decoder::eval-base64-large-payload", "l": 4, "m": "B0030" }, { "a": "T1505.003", "c": 0.8600000143051147, "d": "Very long embedded string", "e": [ "strings.max_length = 19780.00" ], "i": "objectives/command-and-control/backdoor/webshell/stager::very-long-string", "l": 1 }, { "c": 1.0, "d": "PHP unlink function symbol", "e": [ "unlink" ], "i": "micro-behaviors/fs/delete/file::php-unlink", "l": 3 }, { "a": "T1027", "c": 0.75, "d": "Many no-param functions", "e": [ "functions.no_params_count = 57.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/functions::many-no-param-functions", "l": 2, "m": "B0032" }, { "c": 0.949999988079071, "d": "PHP opening tag present", "e": [ "\u003c?php" ], "i": "metadata/lang/scripted::php-open-tag", "l": 1 }, { "a": "T1027", "c": 0.8999999761581421, "d": "PHP source contains very long line", "e": [ "text.max_line_length = 19807.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/identifiers::php-single-long-line", "l": 4, "m": "B0032" }, { "c": 0.9200000166893005, "d": "PHP unlink near file recreate", "e": [ "copy", "rename" ], "i": "objectives/impact/infect/script::php-unlink-recreate-pattern", "l": 1 } ], "sha": "c840c01bb7a5fff28c0c39ce0493638a0372c40edb54336e86a52c920f369e82", "path": "/data/samples/bad/datasets/awesome-malware/PHP/xmlrpc_Rating.php", "type": "php" } ], "tv": "87c42" } }