{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.999143123626709, "class": 2 } ], "prob": 0.9991431, "class": 2, "models": [ { "m": "az", "prob": 0.8624469, "class": 0 }, { "m": "az/scripts", "prob": 0.9946903, "class": 0 }, { "m": "az/php", "prob": 0.9991431, "class": 2 } ], "version": "v16.16", "thresholds": [ 0.9961138, 0.99909174 ], "analyzed_at": "2026-05-09T00:02:20Z" }, "path": "e62ef90036cd66865272ae4dbc7dfb21", "raw": { "v": "4", "fs": [ { "f": "O₉(As₄C₁₄CaEr₃Dy₂CoLa₃P₂S)H₆(Cm₅CrDb₇F₃Os₂Po₃)Md₂", "k": { "source.imports[0]": "addcslashes", "source.imports[1]": "array_key_exists", "source.imports[2]": "array_merge", "source.imports[3]": "array_pop", "source.imports[4]": "array_push", "source.imports[5]": "array_search", "source.imports[6]": "array_unique", "source.imports[7]": "array_unshift", "source.imports[8]": "base64_decode", "source.imports[9]": "base64_encode", "source.strings[0]": " ", "source.strings[1]": " ", "source.strings[2]": " Additional SMTP info: ", "source.strings[3]": " Could not write temp file", "source.strings[4]": " Detail: ", "source.strings[5]": " SMTP code: ", "source.strings[6]": " https://github.com/PHPMailer/PHPMailer/wiki/Troubleshooting", "source.strings[7]": " mailer is not supported.", "source.strings[8]": "#^[A-z]+://#", "source.strings[9]": "#^data:(image[^;,]*)(;base64)?,#", "source.has_imports": true, "source.imports[10]": "basename", "source.imports[11]": "call_user_func", "source.imports[12]": "call_user_func_array", "source.imports[13]": "checkdnsrr", "source.imports[14]": "chunk_split", "source.imports[15]": "count", "source.imports[16]": "date", "source.imports[17]": "date_default_timezone_get", "source.imports[18]": "date_default_timezone_set", "source.imports[19]": "defined", "source.imports[20]": "dirname", "source.imports[21]": "empty", "source.imports[22]": "ereg_replace", "source.imports[23]": "eregi", "source.imports[24]": "error_log", "source.imports[25]": "error_reporting", "source.imports[26]": "escapeshellarg", "source.imports[27]": "escapeshellcmd", "source.imports[28]": "explode", "source.imports[29]": "extension_loaded", "source.imports[30]": "file_exists", "source.imports[31]": "file_get_contents", "source.imports[32]": "file_put_contents", "source.imports[33]": "filter_var", "source.imports[34]": "floor", "source.imports[35]": "fputs", "source.imports[36]": "function_exists", "source.imports[37]": "get_magic_quotes_runtime", "source.imports[38]": "gethostname", "source.imports[39]": "gmdate", "source.imports[40]": "hexdec", "source.imports[41]": "html_entity_decode", "source.imports[42]": "htmlentities", "source.imports[43]": "idn_to_ascii", "source.imports[44]": "imap_rfc822_parse_adrlist", "source.imports[45]": "implode", "source.imports[46]": "in_array", "source.imports[47]": "ini_get", "source.imports[48]": "ini_set", "source.imports[49]": "is_callable", "source.imports[50]": "is_file", "source.imports[51]": "is_null", "source.imports[52]": "is_object", "source.imports[53]": "is_readable", "source.imports[54]": "isset", "source.imports[55]": "leafClear", "source.imports[56]": "leafMailCheck", "source.imports[57]": "leafTrim", "source.imports[58]": "ltrim", "source.imports[59]": "mail", "source.imports[60]": "mb_check_encoding", "source.imports[61]": "mb_convert_encoding", "source.imports[62]": "mb_strlen", "source.imports[63]": "mb_substr", "source.imports[64]": "md5", "source.imports[65]": "method_exists", "source.imports[66]": "openssl_error_string", "source.imports[67]": "openssl_pkcs7_sign", "source.imports[68]": "openssl_pkey_get_private", "source.imports[69]": "openssl_sign", "source.imports[70]": "ord", "source.imports[71]": "pack", "source.imports[72]": "pclose", "source.imports[73]": "php_uname", "source.imports[74]": "popen", "source.imports[75]": "preg_match", "source.imports[76]": "preg_match_all", "source.imports[77]": "preg_quote", "source.imports[78]": "preg_replace", "source.imports[79]": "property_exists", "source.imports[80]": "quoted_printable_encode", "source.imports[81]": "rand", "source.imports[82]": "randString", "source.imports[83]": "rawurldecode", "source.imports[84]": "rawurlencode", "source.imports[85]": "realpath", "source.imports[86]": "rtrim", "source.imports[87]": "serialize", "source.imports[88]": "session_start", "source.imports[89]": "set_magic_quotes_runtime", "source.imports[90]": "set_time_limit", "source.imports[91]": "sha1", "source.imports[92]": "sprintf", "source.imports[93]": "str_replace", "source.imports[94]": "strip_tags", "source.imports[95]": "stripslashes", "source.imports[96]": "stristr", "source.imports[97]": "strlen", "source.imports[98]": "strpos", "source.imports[99]": "strrpos", "source.strings[10]": "$0=\\r\\n", "source.strings[11]": "$comma = $t", "source.strings[12]": "$i = @ev", "source.strings[13]": "%0D%0A", "source.strings[14]": "%0D%0A.", "source.strings[15]": "%5C%22", "source.strings[16]": "%s -f%s", "source.strings[17]": "%s -oi -f%s -t", "source.strings[18]": "%s -oi -t", "source.strings[19]": "((?\u003e(?\u003e(?\u003e((?\u003e(?\u003e(?\u003e\\x0D\\x0A)?[\\t ])+|(?\u003e[\\t ]*\\x0D\\x0A)?[\\t ]+)?)(\\((?\u003e(?2)", "source.strings[20]": "(?2)\")(?\u003e(?1)\\.(?1)(?4))*(?1)@(?!(?1)[a-z0-9-]{64,})(?1)(?\u003e([a-z0-9](?\u003e[a-z0-9-]*[a-z0-9])?)", "source.strings[21]": "(?\u003e(?1)\\.(?!(?1)[a-z0-9-]{64,})(?1)(?5)){0,126}|\\[(?:(?\u003eIPv6:(?\u003e([a-f0-9]{1,4})(?\u003e:(?6)){7}", "source.strings[22]": "(?\u003e(?:[a-f0-9]{1,4}(?\u003e:[a-f0-9]{1,4}){0,4}):)?))?(?\u003e25[0-5]|2[0-4][0-9]|1[0-9]{2}", "source.strings[23]": "(?\u003e[\\x01-\\x08\\x0B\\x0C\\x0E-", "source.strings[24]": "(?\u003e[\\x01-\\x08\\x0B\\x0C\\x0E-\\'*-\\[\\]-\\x7F]|\\\\\\[\\x00-\\x7F]|(?3)))*(?2)\\)))+(?2))|(?2))?)", "source.strings[25]": "(?\u003e[a-f0-9]{1,4}(?\u003e:[a-f0-9]{1,4}){0,6})?))|(?\u003e(?\u003eIPv6:(?\u003e[a-f0-9]{1,4}(?\u003e:", "source.strings[26]": "(?\u003e[a-z0-9](?\u003e[a-z0-9-]*[a-z0-9])?)){0,126}|\\[(?:(?\u003eIPv6:(?\u003e(?\u003e[a-f0-9]{1,4})(?\u003e:", "source.strings[27]": "(?\u003e\\.(?\u003e[!#-", "source.strings[28]": "(?\u003e\\.(?\u003e[!#-\\'*+\\/-9=?^-~-]+|\"(?\u003e(?\u003e[\\x01-\\x08\\x0B\\x0C\\x0E-!#-\\[\\]-\\x7F]|\\\\\\[\\x00-\\xFF]))*\"))*", "source.strings[29]": "([!#-\\'*+\\/-9=?^-~-]+|\"(?\u003e(?2)(?\u003e[\\x01-\\x08\\x0B\\x0C\\x0E-!#-\\[\\]-\\x7F]|\\\\\\[\\x00-\\x7F]))*", "source.strings[30]": "*+\\/-9=?^-~-]+|\"(?\u003e(?2)(?\u003e[\\x01-\\x08\\x0B\\x0C\\x0E-!#-\\[\\]-\\x7F]|", "source.strings[31]": "*+\\/-9=?^-~-]+|\"(?\u003e(?\u003e[\\x01-\\x08\\x0B\\x0C\\x0E-!#-\\[\\]-\\x7F]|", "source.strings[32]": "*+\\/=?^_`{|}~ -]/", "source.strings[33]": "*+\\/=?^_`{|}~-]+@[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}", "source.strings[34]": "*-\\[\\]-\\x7F]|", "source.strings[35]": "--%s%s", "source.strings[36]": "--%s--%s", "source.strings[37]": ".$t.\"lef$flu", "source.strings[38]": ".SYNTAX-ERROR.", "source.strings[39]": "/([^@]*).*/", "source.strings[40]": "/(\\r\\n|\\r|\\n)/ms", "source.strings[41]": "/(src|background)=[", "source.strings[42]": "/(src|background)=[\"\\'](.*)[\"\\']/Ui", "source.strings[43]": "/\u003c(head|title|style|script)[^\u003e]*\u003e.*?\u003c\\/", "source.strings[44]": "/\u003c(head|title|style|script)[^\u003e]*\u003e.*?\u003c\\/\\\\1\u003e/si", "source.strings[45]": "/[ \\(\\)\u003c\u003e@,;:", "source.strings[46]": "/[ \\(\\)\u003c\u003e@,;:\\\\\"\\/\\[\\]\\?=]/", "source.strings[47]": "/[()\"]/", "source.strings[48]": "/[\\000-\\010\\013\\014\\016-\\037\\177-\\377]/", "source.strings[49]": "/[\\200-\\377]/", "source.strings[50]": "/[\\r\\n]+/", "source.strings[51]": "/[\\x80-\\xFF]/", "source.strings[52]": "/[^A-Za-z0-9!#$%\u0026", "source.strings[53]": "/[^A-Za-z0-9!#$%\u0026\\'*+\\/=?^_`{|}~ -]/", "source.strings[54]": "/[^\\040\\041\\043-\\133\\135-\\176]/", "source.strings[55]": "/[^\\r\\n]{", "source.strings[56]": "/[{$pattern}]/", "source.strings[57]": "/^((ssl|tls):\\/\\/)*([a-zA-Z0-9\\.-]*):?([0-9]*)$/", "source.strings[58]": "/^(.*)$/m", "source.strings[59]": "/^(?!(?\u003e\"?(?\u003e", "source.strings[60]": "/^(?!(?\u003e\"?(?\u003e\\\\\\[ -~]|[^\"])\"?){255,})(?!(?\u003e\"?(?\u003e\\\\\\[ -~]|[^\"])\"?){65,}@)(?\u003e", "source.strings[61]": "/^(?!(?\u003e(?1)\"?(?\u003e", "source.strings[62]": "/^(?!(?\u003e(?1)\"?(?\u003e\\\\\\[ -~]|[^\"])\"?(?1)){255,})(?!(?\u003e(?1)\"?(?\u003e\\\\\\[ -~]|[^\"])\"?(?1)){65,}@)", "source.strings[63]": "/^[a-zA-Z0-9.!#$%\u0026", "source.strings[64]": "/^[a-zA-Z0-9.!#$%\u0026\\'*+\\/=?^_`{|}~-]+@[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}", "source.strings[65]": "/usr/sbin/sendmail", "source.strings[66]": "/var/qmail/bin/qmail-inject", "source.strings[67]": "0123456789", "source.strings[68]": "5.2.14", "source.strings[69]": "; charset=", "source.strings[70]": "\u003c%s@%s\u003e", "source.strings[71]": "\u003cbr\u003e\\n", "source.strings[72]": "\u003cpre align=center\u003e\u003cform method=post\u003ePassword: \u003cinput type='password' name='pass'\u003e\u003cinput type='submit' value='\u003e\u003e'\u003e\u003c/form\u003e\u003c/pre\u003e", "source.strings[73]": "=\"cid:", "source.strings[74]": "=[\"\\']", "source.strings[75]": "?$encoding?\\\\1?=", "source.strings[76]": "@(?\u003e(?![a-z0-9-]{64,})(?\u003e[a-z0-9](?\u003e[a-z0-9-]*[a-z0-9])?)(?\u003e\\.(?![a-z0-9-]{64,})", "source.strings[77]": "@phpmailer.0", "source.strings[78]": "Cannot set or reset variable: ", "source.strings[79]": "ConfirmReadingTo", "source.strings[80]": "Content-Disposition: %s%s", "source.strings[81]": "Content-Disposition: %s; filename=\"%s\"%s", "source.strings[82]": "Content-Disposition: %s; filename=%s%s", "source.strings[83]": "Content-ID: \u003c%s\u003e%s", "source.strings[84]": "Content-Transfer-Encoding", "source.strings[85]": "Content-Transfer-Encoding: %s%s", "source.strings[86]": "Content-Type", "source.strings[87]": "Content-Type: ", "source.strings[88]": "Content-Type: %s%s", "source.strings[89]": "Content-Type: %s; charset=%s", "source.strings[90]": "Content-Type: %s; name=\"%s\"%s", "source.strings[91]": "Could not access file: ", "source.strings[92]": "Could not execute: ", "source.strings[93]": "Could not instantiate mail function.", "source.strings[94]": "D, j M Y H:i:s O", "source.strings[95]": "Disposition-Notification-To", "source.strings[96]": "Extension missing: ", "source.strings[97]": "File Error: Could not open file: ", "source.strings[98]": "INTL_IDNA_VARIANT_UTS46", "source.strings[99]": "Invalid address: ", "source.functions[0]": "DKIM_Add", "source.functions[1]": "DKIM_BodyC", "source.functions[2]": "DKIM_HeaderC", "source.functions[3]": "DKIM_QP", "source.functions[4]": "DKIM_Sign", "source.functions[5]": "__construct", "source.functions[6]": "__destruct", "source.functions[7]": "_mime_types", "source.functions[8]": "addAddress", "source.functions[9]": "addAnAddress", "source.imports[100]": "strtolower", "source.imports[101]": "substr", "source.imports[102]": "sys_get_temp_dir", "source.imports[103]": "tempnam", "source.imports[104]": "time", "source.imports[105]": "trim", "source.imports[106]": "uniqid", "source.imports[107]": "unlink", "source.imports[108]": "urldecode", "source.imports[109]": "urlencode", "source.imports[110]": "version_compare", "source.strings[100]": "Invalid recipient kind: ", "source.strings[101]": "Leaf PHPMailer 2.7 (leafmailer.pw)", "source.strings[102]": "MIME-Version", "source.strings[103]": "Message body empty", "source.strings[104]": "Message-ID", "source.strings[105]": "OPENSSL_ALGO_SHA1", "source.strings[106]": "PCRE_VERSION", "source.strings[107]": "PKCS7_TEXT", "source.strings[108]": "Reply-To", "source.strings[109]": "Root User", "source.strings[110]": "SERVER_NAME", "source.strings[111]": "SMTP Error: Could not authenticate.", "source.strings[112]": "SMTP Error: Could not connect to SMTP host.", "source.strings[113]": "SMTP Error: The following recipients failed: ", "source.strings[114]": "SMTP Error: data not accepted.", "source.strings[115]": "SMTP connect() failed.", "source.strings[116]": "SMTP server error: ", "source.strings[117]": "STARTTLS", "source.strings[118]": "Sender", "source.strings[119]": "Signing Error: ", "source.strings[120]": "Subject", "source.strings[121]": "The following From address failed: ", "source.strings[122]": "This is a multi-part message in MIME format.", "source.strings[123]": "To view this email message, open it in a program that understands HTML!", "source.strings[124]": "Unknown encoding: ", "source.strings[125]": "X-Mailer", "source.strings[126]": "X-Priority", "source.strings[127]": "Y-m-d H:i:s", "source.strings[128]": "You must provide at least one recipient email address.", "source.strings[129]": "[!#-\\'*+\\/-9=?^-~-]+|\"(?\u003e(?\u003e[\\x01-\\x08\\x0B\\x0C\\x0E-!#-\\[\\]-\\x7F]|\\\\\\[\\x00-\\xFF]))*\")", "source.strings[130]": "[\"\\']/Ui", "source.strings[131]": "[-email-]", "source.strings[132]": "[-emailuser-]", "source.strings[133]": "[-randomletters-]", "source.strings[134]": "[-randommd5-]", "source.strings[135]": "[-randomnumber-]", "source.strings[136]": "[-randomstring-]", "source.strings[137]": "[-time-]", "source.strings[138]": "[a-f0-9]{1,4}){5}:|(?!(?:.*[a-f0-9]:){6,})(?\u003e[a-f0-9]{1,4}(?\u003e:[a-f0-9]{1,4}){0,4})?", "source.strings[139]": "[a-f0-9]{1,4}){7}|(?!(?:.*[a-f0-9][:\\]]){8,})(?\u003e[a-f0-9]{1,4}(?\u003e:[a-f0-9]{1,4}){0,6})?", "source.strings[140]": "[a-zA-Z0-9])?(?:\\.[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*$/sD", "source.strings[141]": "\\\"$encoded\\", "source.strings[142]": "\\/\\[\\]\\?=]/", "source.strings[143]": "\\0..\\37\\177\\\\\\", "source.strings[144]": "\\000-\\011\\013\\014\\016-\\037\\075\\077\\137\\177-\\377", "source.strings[145]": "\\[ -~]|[^\"])\"?(?1)){255,})(?!(?\u003e(?1)\"?(?\u003e", "source.strings[146]": "\\[ -~]|[^\"])\"?(?1)){65,}@)", "source.strings[147]": "\\[ -~]|[^\"])\"?){255,})(?!(?\u003e\"?(?\u003e", "source.strings[148]": "\\[ -~]|[^\"])\"?){65,}@)(?\u003e", "source.strings[149]": "\\[\\x00-\\x7F]))*", "source.strings[150]": "\\[\\x00-\\x7F]|(?3)))*(?2)\\)))+(?2))|(?2))?)", "source.strings[151]": "\\[\\x00-\\xFF]))*\")", "source.strings[152]": "\\[\\x00-\\xFF]))*\"))*", "source.strings[153]": "\\n \\t ", "source.strings[154]": "\\r\\n=2E", "source.strings[155]": "\\tboundary=\\", "source.strings[156]": "](.*)[", "source.strings[157]": "^A-Za-z0-9!*+\\/ -", "source.strings[158]": "^[a-z\\'0-9]+([._-][a-z\\'0-9]+)*@([a-z0-9]+([._-][a-z0-9]+))+$", "source.strings[159]": "abcdefghijklmnopqrstuvwxyz", "source.strings[160]": "abcdefghijklmnopqrstuvwxyz0123456789", "source.strings[161]": "action", "source.strings[162]": "addAnAddress", "source.strings[163]": "address", "source.strings[164]": "alt_attach", "source.strings[165]": "alt_inline", "source.strings[166]": "alt_inline_attach", "source.strings[167]": "attach", "source.strings[168]": "attachment", "source.strings[169]": "authenticate", "source.strings[170]": "base64", "source.strings[171]": "binary", "source.strings[172]": "boundary=", "source.strings[173]": "checked", "source.strings[174]": "comment", "source.strings[175]": "connect_host", "source.strings[176]": "create_", "source.strings[177]": "data_not_accepted", "source.strings[178]": "detail", "source.strings[179]": "emailList", "source.strings[180]": "empty_message", "source.strings[181]": "encoding", "source.strings[182]": "error_log", "source.strings[183]": "et_contents(\"h", "source.strings[184]": "execute", "source.strings[185]": "extension_loaded", "source.strings[186]": "extension_missing", "source.strings[187]": "file://", "source.strings[188]": "file_access", "source.strings[189]": "file_open", "source.strings[190]": "from_failed", "source.strings[191]": "gethostname", "source.strings[192]": "idn_to_ascii", "source.strings[193]": "imap_rfc822_parse_adrlist", "source.strings[194]": "inline", "source.strings[195]": "inline_attach", "source.strings[196]": "instantiate", "source.strings[197]": "invalid_address", "source.strings[198]": "iso-8859-1", "source.strings[199]": "language", "source.strings[200]": "leafmailer.pw", "source.strings[201]": "localhost", "source.strings[202]": "localhost.localdomain", "source.strings[203]": "m/d/Y h:i:s a", "source.strings[204]": "magic_quotes_runtime", "source.strings[205]": "mailer_not_supported", "source.strings[206]": "mb_convert_encoding", "source.strings[207]": "mb_strlen", "source.strings[208]": "mbstring.func_overload", "source.strings[209]": "memory_limit", "source.strings[210]": "messageLetter", "source.strings[211]": "messageType", "source.strings[212]": "multipart/alternative", "source.strings[213]": "multipart/alternative;", "source.strings[214]": "multipart/mixed;", "source.strings[215]": "multipart/related;", "source.strings[216]": "noregex", "source.strings[217]": "openssl", "source.strings[218]": "p:$comma-2\"));", "source.strings[219]": "personal", "source.strings[220]": "phpmailer.lang-", "source.strings[221]": "phrase", "source.strings[222]": "provide_address", "source.strings[223]": "quoted-printable", "source.strings[224]": "quoted_printable_encode", "source.strings[225]": "recipients_failed", "source.strings[226]": "replyTo", "source.strings[227]": "root@localhost", "source.strings[228]": "safe_mode", "source.strings[229]": "senderEmail", "source.strings[230]": "senderName", "source.strings[231]": "sendmail", "source.strings[232]": "sendmail_from", "source.strings[233]": "sendmail_path", "source.strings[234]": "signed", "source.strings[235]": "signing", "source.strings[236]": "smtp_code", "source.strings[237]": "smtp_code_ex", "source.strings[238]": "smtp_connect_failed", "source.strings[239]": "smtp_error", "source.strings[240]": "ssl://", "source.strings[241]": "subject", "source.strings[242]": "text/calendar; method=REQUEST", "source.strings[243]": "text/html", "source.strings[244]": "text/plain", "source.strings[245]": "undisclosed-recipients:;", "source.strings[246]": "us-ascii", "source.strings[247]": "ush,$t", "source.strings[248]": "variable_set", "source.strings[249]": "version", "source.strings[250]": "website", "source.strings[251]": "|(?!(?:.*[a-f0-9]:){6,})(?8)?::(?\u003e((?6)(?\u003e:(?6)){0,4}):)?))?(25[0-5]|2[0-4][0-9]|1[0-9]{2}", "source.strings[252]": "|(?!(?:.*[a-f0-9][:\\]]){8,})((?6)(?\u003e:(?6)){0,6})?::(?7)?))|(?\u003e(?\u003eIPv6:(?\u003e(?6)(?\u003e:(?6)){5}:", "source.strings[253]": "|[1-9]?[0-9])(?\u003e\\.(?9)){3}))\\])(?1)$/isD", "source.strings[254]": "|[1-9]?[0-9])(?\u003e\\.(?\u003e25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])){3}))\\])$/isD", "source.strings[255]": "}[^=\\r\\n]{2}/", "source.functions[10]": "addAttachment", "source.functions[11]": "addBCC", "source.functions[12]": "addCC", "source.functions[13]": "addCustomHeader", "source.functions[14]": "addEmbeddedImage", "source.functions[15]": "addOrEnqueueAnAddress", "source.functions[16]": "addReplyTo", "source.functions[17]": "addStringAttachment", "source.functions[18]": "addStringEmbeddedImage", "source.functions[19]": "addrAppend", "source.functions[20]": "addrFormat", "source.functions[21]": "alternativeExists", "source.functions[22]": "attachAll", "source.functions[23]": "attachmentExists", "source.functions[24]": "base64EncodeWrapMB", "source.functions[25]": "clearAddresses", "source.functions[26]": "clearAllRecipients", "source.functions[27]": "clearAttachments", "source.functions[28]": "clearBCCs", "source.functions[29]": "clearCCs", "source.functions[30]": "clearCustomHeaders", "source.functions[31]": "clearQueuedAddresses", "source.functions[32]": "clearReplyTos", "source.functions[33]": "createBody", "source.functions[34]": "createHeader", "source.functions[35]": "doCallback", "source.functions[36]": "edebug", "source.functions[37]": "encodeFile", "source.functions[38]": "encodeHeader", "source.functions[39]": "encodeQ", "source.functions[40]": "encodeQP", "source.functions[41]": "encodeQPphp", "source.functions[42]": "encodeString", "source.functions[43]": "endBoundary", "source.functions[44]": "errorMessage", "source.functions[45]": "filenameToType", "source.functions[46]": "fixEOL", "source.functions[47]": "getAllRecipientAddresses", "source.functions[48]": "getAttachments", "source.functions[49]": "getBccAddresses", "source.functions[50]": "getBoundary", "source.functions[51]": "getCcAddresses", "source.functions[52]": "getCustomHeaders", "source.functions[53]": "getLastMessageID", "source.functions[54]": "getMailMIME", "source.functions[55]": "getReplyToAddresses", "source.functions[56]": "getSMTPInstance", "source.functions[57]": "getSentMIMEMessage", "source.functions[58]": "getToAddresses", "source.functions[59]": "getTranslations", "source.functions[60]": "has8bitChars", "source.functions[61]": "hasLineLongerThanMax", "source.functions[62]": "hasMultiBytes", "source.functions[63]": "headerLine", "source.functions[64]": "html2text", "source.functions[65]": "idnSupported", "source.functions[66]": "inlineImageExists", "source.functions[67]": "innerBody", "source.functions[68]": "isError", "source.functions[69]": "isHTML", "source.functions[70]": "isMail", "source.functions[71]": "isQmail", "source.functions[72]": "isSMTP", "source.functions[73]": "isSendmail", "source.functions[74]": "lang", "source.functions[75]": "leafClear", "source.functions[76]": "leafMailCheck", "source.functions[77]": "leafTrim", "source.functions[78]": "mailPassthru", "source.functions[79]": "mailSend", "source.functions[80]": "mb_pathinfo", "source.functions[81]": "msgHTML", "source.functions[82]": "normalizeBreaks", "source.functions[83]": "parseAddresses", "source.functions[84]": "postSend", "source.functions[85]": "preSend", "source.functions[86]": "punyencodeAddress", "source.functions[87]": "randString", "source.functions[88]": "rfcDate", "source.functions[89]": "secureHeader", "source.functions[90]": "send", "source.functions[91]": "sendmailSend", "source.functions[92]": "serverHostname", "source.functions[93]": "set", "source.functions[94]": "setError", "source.functions[95]": "setFrom", "source.functions[96]": "setLanguage", "source.functions[97]": "setMessageType", "source.functions[98]": "setWordWrap", "source.functions[99]": "sign", "source.functions[100]": "smtpClose", "source.functions[101]": "smtpConnect", "source.functions[102]": "smtpSend", "source.functions[103]": "textLine", "source.functions[104]": "utf8CharBoundary", "source.functions[105]": "validateAddress", "source.functions[106]": "wrapText" }, "x": 178, "id": 0, "is": [ "session_start", "error_reporting", "set_time_limit", "ini_set", "md5", "empty", "isset", "leafTrim", "leafTrim", "leafTrim", "leafTrim", "leafTrim", "leafTrim", "leafTrim", "urlencode", "ereg_replace", "urldecode", "stripslashes", "stripslashes", "stripslashes", "preg_replace", "str_replace", "date", "time", "str_replace", "str_replace", "str_replace", "randString", "str_replace", "randString", "str_replace", "randString", "str_replace", "md5", "randString", "stripslashes", "ltrim", "rtrim", "rand", "rand", "strlen", "eregi", "checkdnsrr", "array_pop", "explode", "ini_get", "ini_get", "mail", "mail", "in_array", "is_callable", "call_user_func", "error_log", "htmlentities", "preg_replace", "preg_replace", "gmdate", "str_replace", "trim", "ini_get", "stristr", "ini_get", "stristr", "trim", "trim", "preg_replace", "strrpos", "substr", "array_key_exists", "array_key_exists", "call_user_func_array", "in_array", "array_key_exists", "strtolower", "array_push", "strtolower", "array_key_exists", "strtolower", "strtolower", "function_exists", "imap_rfc822_parse_adrlist", "property_exists", "explode", "trim", "strpos", "explode", "trim", "str_replace", "trim", "str_replace", "trim", "trim", "preg_replace", "strrpos", "substr", "empty", "strpos", "strpos", "defined", "version_compare", "function_exists", "extension_loaded", "version_compare", "preg_match", "preg_match", "preg_match", "strlen", "strpos", "strpos", "strlen", "filter_var", "function_exists", "function_exists", "empty", "strrpos", "substr", "mb_check_encoding", "mb_convert_encoding", "defined", "idn_to_ascii", "idn_to_ascii", "substr", "array_merge", "call_user_func_array", "count", "count", "count", "trim", "empty", "empty", "empty", "count", "trim", "empty", "empty", "empty", "file_exists", "rtrim", "str_replace", "method_exists", "sprintf", "escapeshellcmd", "escapeshellarg", "sprintf", "escapeshellcmd", "escapeshellarg", "sprintf", "escapeshellcmd", "sprintf", "escapeshellcmd", "popen", "fputs", "fputs", "fputs", "pclose", "popen", "fputs", "fputs", "pclose", "implode", "empty", "sprintf", "ini_get", "ini_get", "ini_set", "count", "isset", "ini_set", "is_object", "implode", "count", "count", "count", "is_null", "explode", "preg_match", "trim", "defined", "is_null", "empty", "dirname", "is_readable", "implode", "empty", "sprintf", "strtolower", "strlen", "strlen", "substr", "substr", "explode", "explode", "strlen", "strlen", "substr", "substr", "substr", "substr", "sprintf", "strlen", "substr", "substr", "substr", "substr", "strlen", "sprintf", "strlen", "substr", "strpos", "substr", "hexdec", "count", "count", "trim", "count", "count", "count", "sprintf", "is_null", "trim", "trim", "trim", "md5", "uniqid", "time", "empty", "defined", "tempnam", "sys_get_temp_dir", "file_put_contents", "tempnam", "sys_get_temp_dir", "empty", "openssl_pkcs7_sign", "realpath", "realpath", "openssl_pkcs7_sign", "realpath", "realpath", "unlink", "file_get_contents", "unlink", "explode", "unlink", "unlink", "openssl_error_string", "sprintf", "implode", "is_file", "basename", "md5", "serialize", "in_array", "array_key_exists", "sprintf", "empty", "sprintf", "sprintf", "sprintf", "sprintf", "empty", "preg_match", "sprintf", "empty", "sprintf", "sprintf", "sprintf", "implode", "is_readable", "get_magic_quotes_runtime", "version_compare", "set_magic_quotes_runtime", "ini_set", "file_get_contents", "version_compare", "set_magic_quotes_runtime", "ini_set", "strtolower", "chunk_split", "base64_encode", "substr", "strlen", "strtolower", "preg_match", "addcslashes", "preg_match", "preg_match_all", "preg_match_all", "preg_match_all", "strlen", "strlen", "function_exists", "base64_encode", "trim", "chunk_split", "str_replace", "trim", "preg_replace", "trim", "str_replace", "function_exists", "strlen", "mb_strlen", "preg_match", "mb_strlen", "strlen", "strlen", "strlen", "floor", "mb_substr", "base64_encode", "strlen", "substr", "strlen", "function_exists", "quoted_printable_encode", "str_replace", "rawurlencode", "preg_replace", "str_replace", "strtolower", "preg_match_all", "array_search", "array_unshift", "array_unique", "str_replace", "sprintf", "ord", "str_replace", "basename", "is_file", "basename", "empty", "empty", "strtolower", "strtolower", "strtolower", "is_null", "empty", "empty", "empty", "empty", "date_default_timezone_set", "date_default_timezone_get", "date", "empty", "isset", "array_key_exists", "empty", "function_exists", "gethostname", "gethostname", "php_uname", "php_uname", "count", "array_key_exists", "str_replace", "str_replace", "explode", "preg_match_all", "array_key_exists", "preg_match", "substr", "strpos", "base64_decode", "rawurldecode", "md5", "str_replace", "substr", "preg_match", "basename", "dirname", "md5", "strlen", "substr", "strlen", "substr", "preg_replace", "preg_quote", "empty", "is_callable", "call_user_func", "html_entity_decode", "trim", "strip_tags", "preg_replace", "array_key_exists", "strtolower", "strtolower", "strpos", "substr", "preg_match", "array_key_exists", "array_key_exists", "array_key_exists", "array_key_exists", "property_exists", "trim", "str_replace", "preg_replace", "strlen", "ord", "sprintf", "defined", "file_get_contents", "openssl_pkey_get_private", "openssl_sign", "base64_encode", "preg_replace", "explode", "explode", "strtolower", "preg_replace", "trim", "implode", "str_replace", "str_replace", "substr", "strlen", "substr", "strlen", "time", "explode", "strpos", "strpos", "empty", "strpos", "str_replace", "str_replace", "str_replace", "strlen", "base64_encode", "pack", "sha1", "preg_match", "empty", "is_callable", "call_user_func_array", "date", "time", "explode", "count", "leafMailCheck", "leafClear", "leafClear", "leafClear", "leafClear", "leafClear", "count" ], "ms": { "file": { "size": 151665.0 }, "text": { "digit_ratio": 0.02, "space_count": 47479.0, "total_lines": 4087.0, "char_entropy": 4.6, "unique_chars": 97.0, "escape_density": 0.05, "import_density": 10.99, "lines_over_200": 5.0, "string_density": 0.46, "avg_line_length": 35.11, "max_line_length": 228.0, "empty_line_ratio": 0.07, "hex_escape_count": 38.0, "last_line_length": 2.0, "most_common_char": "e", "whitespace_ratio": 0.37, "most_common_ratio": 0.05, "identifier_density": 0.95, "line_length_stddev": 27.81, "octal_escape_count": 32.0, "encoded_string_ratio": 0.0, "normalized_import_count": 7.02, "normalized_string_count": 29.13, "repeated_char_sequences": 1517.0, "suspicious_string_ratio": 0.0, "suspicious_comment_ratio": 0.07, "max_inline_whitespace_run": 19.0, "normalized_function_count": 1.67, "trailing_whitespace_lines": 12.0, "imports_to_functions_ratio": 4.2, "strings_to_functions_ratio": 17.4, "suspicious_identifier_ratio": 0.02, "normalized_unique_identifiers": 44.6, "identifiers_to_functions_ratio": 5.0 }, "imports": { "total": 449.0, "unique_modules": 111.0, "third_party_count": 449.0, "third_party_ratio": 1.0 }, "strings": { "total": 1862.0, "url_count": 8.0, "avg_length": 16.25, "max_length": 815.0, "path_count": 59.0, "avg_entropy": 2.36, "email_count": 4.0, "hex_strings": 2.0, "total_bytes": 30264.0, "entropy_stddev": 1.19, "base64_candidates": 2.0, "high_entropy_count": 4.0, "shell_command_strings": 4.0, "unicode_heavy_strings": 8.0, "embedded_code_candidates": 2.0 }, "comments": { "chars": 47281.0, "lines": 1395.0, "total": 375.0, "todo_count": 5.0, "to_code_ratio": 0.52, "url_in_comments": 13.0, "code_in_comments": 7.0, "base64_in_comments": 6.0, "high_entropy_comments": 21.0 }, "functions": { "total": 107.0, "length_stddev": 30.37, "over_100_lines": 4.0, "avg_name_length": 11.54, "no_params_count": 107.0, "avg_length_lines": 22.93, "max_length_lines": 201.0, "min_length_lines": 3.0, "high_entropy_names": 7.0, "density_per_100_lines": 2.62, "code_in_functions_ratio": 0.6 }, "identifiers": { "total": 3869.0, "avg_length": 9.41, "max_length": 25.0, "min_length": 1.0, "avg_entropy": 2.71, "reuse_ratio": 0.14, "unique_count": 535.0, "length_stddev": 4.56, "hex_like_names": 1.0, "has_digit_ratio": 0.03, "sequential_names": 4.0, "base64_like_names": 3.0, "single_char_count": 4.0, "single_char_ratio": 0.01, "high_entropy_count": 31.0, "high_entropy_ratio": 0.06, "all_lowercase_ratio": 0.55, "all_uppercase_ratio": 0.04, "numeric_suffix_count": 5.0, "keyboard_pattern_names": 1.0, "double_underscore_count": 1.0, "underscore_prefix_count": 9.0 } }, "ss": [ [ 176, "memory_limit" ], [ 177, "memory_limit" ], [ 207, "version" ], [ 208, "version" ], [ 218, "2.7" ], [ 219, "2.7" ], [ 232, "website" ], [ 233, "website" ], [ 243, "leafmailer.pw" ], [ 244, "leafmailer.pw" ], [ 421, "pass" ], [ 422, "pass" ], [ 444, "pass" ], [ 445, "pass" ], [ 548, "\u003cpre align=center\u003e\u003cform method=post\u003ePassword: \u003cinput type='password' name='pass'\u003e\u003cinput type='submit' value='\u003e\u003e'\u003e\u003c/form\u003e\u003c/pre\u003e" ], [ 549, "\u003cpre align=center\u003e\u003cform method=post\u003ePassword: \u003cinput type='password' name='pass'\u003e\u003cinput type='submit' value='\u003e\u003e'\u003e\u003c/form\u003e\u003c/pre\u003e" ], [ 724, "action" ], [ 725, "action" ], [ 735, "send" ], [ 736, "send" ], [ 778, "senderEmail" ], [ 779, "senderEmail" ], [ 828, "senderName" ], [ 829, "senderName" ], [ 874, "replyTo" ], [ 875, "replyTo" ], [ 917, "subject" ], [ 918, "subject" ], [ 962, "emailList" ], [ 963, "emailList" ], [ 1011, "messageType" ], [ 1012, "messageType" ], [ 1064, "messageLetter" ], [ 1065, "messageLetter" ], [ 1171, "%5C%22" ], [ 1172, "%5C%22" ], [ 1181, "%22" ], [ 1182, "%22" ], [ 1425, "checked" ], [ 1426, "checked" ], [ 1458, "checked" ], [ 1459, "checked" ], [ 1540, "/([^@]*).*/" ], [ 1541, "/([^@]*).*/" ], [ 1555, "$1" ], [ 1556, "$1" ], [ 1595, "[-time-]" ], [ 1596, "[-time-]" ], [ 1612, "m/d/Y h:i:s a" ], [ 1613, "m/d/Y h:i:s a" ], [ 1671, "[-email-]" ], [ 1672, "[-email-]" ], [ 1725, "[-emailuser-]" ], [ 1726, "[-emailuser-]" ], [ 1787, "[-randomletters-]" ], [ 1788, "[-randomletters-]" ], [ 1819, "abcdefghijklmnopqrstuvwxyz" ], [ 1820, "abcdefghijklmnopqrstuvwxyz" ], [ 1883, "[-randomstring-]" ], [ 1884, "[-randomstring-]" ], [ 1914, "abcdefghijklmnopqrstuvwxyz0123456789" ], [ 1915, "abcdefghijklmnopqrstuvwxyz0123456789" ], [ 1988, "[-randomnumber-]" ], [ 1989, "[-randomnumber-]" ], [ 2019, "0123456789" ], [ 2020, "0123456789" ], [ 2067, "[-randommd5-]" ], [ 2068, "[-randommd5-]" ], [ 2099, "abcdefghijklmnopqrstuvwxyz0123456789" ], [ 2100, "abcdefghijklmnopqrstuvwxyz0123456789" ], [ 2525, "^[a-z\\'0-9]+([._-][a-z\\'0-9]+)*@([a-z0-9]+([._-][a-z0-9]+))+$" ], [ 2526, "^[a-z\\'0-9]+([._-][a-z\\'0-9]+)*@([a-z0-9]+([._-][a-z0-9]+))+$" ], [ 2659, "@" ], [ 2660, "@" ], [ 2672, "MX" ], [ 2673, "MX" ], [ 2880, "5.2.14" ], [ 2881, "5.2.14" ], [ 3203, "iso-8859-1" ], [ 3204, "iso-8859-1" ], [ 3330, "text/plain" ], [ 3331, "text/plain" ], [ 3515, "8bit" ], [ 3516, "8bit" ], [ 3752, "root@localhost" ], [ 3753, "root@localhost" ], [ 3872, "Root User" ], [ 3873, "Root User" ], [ 6268, "mail" ], [ 6269, "mail" ], [ 6382, "/usr/sbin/sendmail" ], [ 6383, "/usr/sbin/sendmail" ], [ 8177, "localhost" ], [ 8178, "localhost" ], [ 11222, "echo" ], [ 11223, "echo" ], [ 12503, "\\n" ], [ 18245, "\\r\\n" ], [ 18788, "smtp" ], [ 18789, "smtp" ], [ 19505, "mbstring.func_overload" ], [ 19506, "mbstring.func_overload" ], [ 19719, "safe_mode" ], [ 19720, "safe_mode" ], [ 20434, "error_log" ], [ 20435, "error_log" ], [ 20447, "html" ], [ 20448, "html" ], [ 20455, "echo" ], [ 20456, "echo" ], [ 20665, "error_log" ], [ 20666, "error_log" ], [ 20796, "html" ], [ 20797, "html" ], [ 20955, "/[\\r\\n]+/" ], [ 20956, "/[\\r\\n]+/" ], [ 21033, "UTF-8" ], [ 21034, "UTF-8" ], [ 21079, "\u003cbr\u003e\\n" ], [ 21080, "\u003cbr\u003e" ], [ 21131, "echo" ], [ 21132, "echo" ], [ 21239, "/(\\r\\n|\\r|\\n)/ms" ], [ 21240, "/(\\r\\n|\\r|\\n)/ms" ], [ 21259, "\\n" ], [ 21301, "Y-m-d H:i:s" ], [ 21302, "Y-m-d H:i:s" ], [ 21318, "\\t" ], [ 21359, "\\n" ], [ 21386, "\\n \\t " ], [ 21389, " " ], [ 21410, " " ], [ 21484, "\\n" ], [ 21740, "file" ], [ 21741, "file" ], [ 21761, "_g" ], [ 21762, "_g" ], [ 21825, "text/html" ], [ 21826, "text/html" ], [ 21900, "text/plain" ], [ 21901, "text/plain" ], [ 21946, ".$t.\"lef$flu" ], [ 21947, ".$t.\"lef$flu" ], [ 21975, "sh" ], [ 21976, "sh" ], [ 21980, "$t\"; " ], [ 21981, "$t\"; " ], [ 22006, "$i = @ev" ], [ 22007, "$i = @ev" ], [ 22051, "create_" ], [ 22052, "create_" ], [ 22075, "func" ], [ 22076, "func" ], [ 22096, "tion" ], [ 22097, "tion" ], [ 22147, "$fl" ], [ 22148, "$fl" ], [ 22153, "ush,$t" ], [ 22154, "ush,$t" ], [ 22162, "$comma = $t" ], [ 22163, "$comma = $t" ], [ 22200, "al(@" ], [ 22201, "al(@" ], [ 22231, "et_contents(\"h" ], [ 22232, "et_contents(\"h" ], [ 22266, "tt" ], [ 22267, "tt" ], [ 22289, "p:$comma-2\"));" ], [ 22290, "p:$comma-2\"));" ], [ 22360, "8.p" ], [ 22361, "8.p" ], [ 22366, "w" ], [ 22367, "w" ], [ 22370, "/" ], [ 22371, "/" ], [ 22558, "smtp" ], [ 22559, "smtp" ], [ 22727, "mail" ], [ 22728, "mail" ], [ 22901, "sendmail_path" ], [ 22902, "sendmail_path" ], [ 22963, "sendmail" ], [ 22964, "sendmail" ], [ 23009, "/usr/sbin/sendmail" ], [ 23010, "/usr/sbin/sendmail" ], [ 23136, "sendmail" ], [ 23137, "sendmail" ], [ 23307, "sendmail_path" ], [ 23308, "sendmail_path" ], [ 23369, "qmail" ], [ 23370, "qmail" ], [ 23412, "/var/qmail/bin/qmail-inject" ], [ 23413, "/var/qmail/bin/qmail-inject" ], [ 23548, "qmail" ], [ 23549, "qmail" ], [ 23900, "to" ], [ 23901, "to" ], [ 24356, "cc" ], [ 24357, "cc" ], [ 24814, "bcc" ], [ 24815, "bcc" ], [ 25189, "Reply-To" ], [ 25190, "Reply-To" ], [ 26110, "/[\\r\\n]+/" ], [ 26111, "/[\\r\\n]+/" ], [ 26199, "@" ], [ 26200, "@" ], [ 26297, "invalid_address" ], [ 26298, "invalid_address" ], [ 26814, "Reply-To" ], [ 26815, "Reply-To" ], [ 27395, "addAnAddress" ], [ 27396, "addAnAddress" ], [ 28053, "to" ], [ 28054, "to" ], [ 28059, "cc" ], [ 28060, "cc" ], [ 28065, "bcc" ], [ 28066, "bcc" ], [ 28072, "Reply-To" ], [ 28073, "Reply-To" ], [ 28130, "Invalid recipient kind: " ], [ 28131, "Invalid recipient kind: " ], [ 28503, "invalid_address" ], [ 28504, "invalid_address" ], [ 28800, "Reply-To" ], [ 28801, "Reply-To" ], [ 30104, "imap_rfc822_parse_adrlist" ], [ 30105, "imap_rfc822_parse_adrlist" ], [ 30338, ".SYNTAX-ERROR." ], [ 30339, ".SYNTAX-ERROR." ], [ 30426, "@" ], [ 30427, "@" ], [ 30527, "name" ], [ 30528, "name" ], [ 30564, "personal" ], [ 30565, "personal" ], [ 30633, "address" ], [ 30634, "address" ], [ 30666, "@" ], [ 30667, "@" ], [ 30858, "," ], [ 30859, "," ], [ 31049, "\u003c" ], [ 31050, "\u003c" ], [ 31270, "name" ], [ 31271, "name" ], [ 31313, "address" ], [ 31314, "address" ], [ 31463, "\u003c" ], [ 31464, "\u003c" ], [ 31526, "\u003e" ], [ 31527, "\u003e" ], [ 31680, "name" ], [ 31681, "name" ], [ 31713, "\"" ] ], "sz": 151665, "ts": [ { "c": 0.75, "d": "Hardcoded localhost network host", "e": [ "localhost" ], "i": "micro-behaviors/communications/ip/literal::localhost-source", "l": 2 }, { "c": 0.20000000298023224, "d": "output keyword", "e": [ "output" ], "i": "micro-behaviors/data/text/keywords/lexicon::output", "l": 1 }, { "a": "T1505.003", "c": 0.8600000143051147, "d": "Regex component marker", "e": [ "ini_get('safe_mode" ], "i": "objectives/command-and-control/backdoor/webshell/config::php-security-setting-probe--rx-1", "l": 1, "m": "B0030" }, { "a": "T1005", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "docx" ], "i": "objectives/collection/stealer/tactics::office-secret-extension-list--rx-3", "l": 1, "m": "B0028" }, { "c": 0.8799999952316284, "d": "MIME multipart message marker", "e": [ "multipart/mixed" ], "i": "micro-behaviors/communications/email/mime::mime-multipart-boundary", "l": 3 }, { "c": 0.20000000298023224, "d": "command keyword", "e": [ "command" ], "i": "micro-behaviors/data/text/keywords/lexicon::command-dup", "l": 1 }, { "a": "T1505.003", "c": 1.0, "d": "Inequality check in WordPress user list", "e": [ "!=" ], "i": "objectives/command-and-control/backdoor/webshell/hide::wp-user-hiding-not-trait", "l": 1, "m": "B0030" }, { "a": "T1027", "c": 0.75, "d": "Many no-param functions", "e": [ "functions.no_params_count = 107.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/functions::many-no-param-functions", "l": 2, "m": "B0032" }, { "a": "T1505.003", "c": 0.8199999928474426, "d": "Content-Disposition download response", "e": [ "Content-Disposition: %s; filename" ], "i": "objectives/command-and-control/backdoor/webshell/stager::content-disposition-download", "l": 1 }, { "a": "T1071", "c": 0.800000011920929, "d": "Random number generation function call", "e": [ "rand()" ], "i": "micro-behaviors/communications/ip/spoof::bitwise-ip-rand-source", "l": 2, "m": "C0001" }, { "c": 0.699999988079071, "d": "HTTP REQUEST method", "e": [ "REQUEST" ], "i": "micro-behaviors/communications/http/request/client::request", "l": 2 }, { "c": 0.7599999904632568, "d": "Regex component marker", "e": [ "please" ], "i": "micro-behaviors/data/text/llm/action::llm-path-navigation-action--rx-27", "l": 1 }, { "c": 0.7599999904632568, "d": "Regex component marker", "e": [ "directory" ], "i": "micro-behaviors/data/text/llm/action::llm-path-navigation-action--rx-21", "l": 1 }, { "a": "T1105", "c": 0.8500000238418579, "d": "File upload access ($_FILES)", "e": [ "$_FILES" ], "i": "micro-behaviors/communications/http/request/params::files", "l": 3 }, { "c": 0.75, "d": "Session variable access ($_SESSION)", "e": [ "$_SESSION" ], "i": "micro-behaviors/communications/http/request/params::session", "l": 3 }, { "c": 1.0, "d": "PHP unlink function symbol", "e": [ "unlink" ], "i": "micro-behaviors/fs/delete/file::php-unlink", "l": 3 }, { "c": 0.6000000238418579, "d": "Generates HTML tags", "e": [ "\u003chead\u003e" ], "i": "micro-behaviors/data/format/html::html-generator-tags", "l": 3 }, { "a": "T1071.001", "c": 0.6000000238418579, "d": "enctype attribute", "e": [ "enctype=" ], "i": "micro-behaviors/communications/http/post::enctype-attr", "l": 3, "m": "C0002" }, { "a": "T1071", "c": 0.800000011920929, "d": "URL with .pw TLD (commonly abused)", "e": [ "https://leafmailer.pw/" ], "i": "objectives/command-and-control/infrastructure/domain/abused-tlds::tld-pw", "l": 3 }, { "a": "T1027", "c": 0.699999988079071, "d": "base64_encode function call for encoding payloads", "e": [ "base64_encode" ], "i": "objectives/anti-static/obfuscation/encoding/xor::base64-encode-call", "l": 4, "m": "B0032" }, { "c": 0.699999988079071, "d": "Username tracking field", "e": [ "Username =" ], "i": "objectives/command-and-control/infrastructure/tracking::username-field", "l": 1 }, { "c": 0.699999988079071, "d": "Domain tracking field", "e": [ "domain =" ], "i": "objectives/command-and-control/infrastructure/tracking::domain-field", "l": 1 }, { "c": 0.8399999737739563, "d": "password/token/api_key field keyword", "e": [ "password" ], "i": "micro-behaviors/data/text/keywords/credential::credential-field", "l": 1 }, { "a": "T1547.015", "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "defaults" ], "i": "objectives/persistence/login/items::defaults-write-loginhook--rx-6", "l": 1 }, { "a": "T1071.001", "c": 0.800000011920929, "d": "XML-RPC text xml content type", "e": [ "text/xml" ], "i": "micro-behaviors/communications/http/xmlrpc::xml-content-type", "l": 3, "m": "C0002" }, { "a": "T1027", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "bytes" ], "i": "objectives/anti-static/obfuscation/payload/config::api-named-byte-array-const--rx-6", "l": 1, "m": "B0032" }, { "c": 0.8199999928474426, "d": "Hostname profile field", "e": [ "hostname" ], "i": "objectives/discovery/system/profile::host-profile-hostname-field", "l": 1 }, { "a": "T1082", "c": 0.6000000238418579, "d": "Gets server hostname", "e": [ "gethostname" ], "i": "objectives/discovery/system/fingerprint/info::gethostname-call", "l": 3, "m": "E1082" }, { "c": 0.8600000143051147, "d": "Regex component marker", "e": [ "method=" ], "i": "objectives/command-and-control/backdoor/webshell/ui::self-named-get-form--rx-3", "l": 1, "m": "B0030" }, { "a": "T1505.003", "c": 0.8500000238418579, "d": "PHP request superglobal access", "e": [ "$_REQUEST" ], "i": "objectives/command-and-control/backdoor/webshell/upload::php-request-variadic-function-call", "l": 3, "m": "B0030" }, { "c": 0.800000011920929, "d": "Sends email with error suppression (@mail)", "e": [ "@mail($to, $subject, $body, $header, $params)", "@mail($to, $subject, $body, $header)" ], "i": "micro-behaviors/communications/email/send/mail-func::mail-suppressed", "l": 4, "m": "B0032" }, { "a": "T1059", "c": 0.8500000238418579, "d": "HTTP POST parameter access ($_POST)", "e": [ "$_POST" ], "i": "micro-behaviors/communications/http/request/params::post-dup", "l": 3 }, { "c": 0.8500000238418579, "d": "MIME octet-stream content type", "e": [ "application/octet-stream" ], "i": "micro-behaviors/communications/email/mime::mime-octet-stream", "l": 1 }, { "c": 0.8999999761581421, "d": "File has 30 or more lines", "e": [ "text.total_lines = 4087.00" ], "i": "metadata/file/text/metrics::file-has-30-plus-lines", "l": 1 }, { "a": "T1070.004", "c": 0.800000011920929, "d": "Redis ping protocol marker", "e": [ "redis" ], "i": "objectives/evasion/self-delete/file/delay::protocol-ping-redis", "l": 1 }, { "c": 0.8500000238418579, "d": "BCC library", "e": [ "bcc " ], "i": "micro-behaviors/os/bpf/trace-frameworks::bcc-lib", "l": 3 }, { "a": "T1565.001", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "download" ], "i": "objectives/evasion/hosts-file/block-security::escan-security-domain--rx-1", "l": 1, "m": "F0004" }, { "c": 0.8399999737739563, "d": "CSV attachment filename response", "e": [ "Content-Disposition: %s; filename" ], "i": "micro-behaviors/data/format/csv/http-telemetry::csv-attachment-filename", "l": 1 }, { "a": "T1027", "c": 0.6499999761581421, "d": "serialize/unserialize for object serialization", "e": [ "serialize(" ], "i": "objectives/anti-static/obfuscation/encoding/xor::serialize-call", "l": 2, "m": "B0032" }, { "c": 0.8600000143051147, "d": "Regex component marker", "e": [ "$_SERVER[" ], "i": "objectives/command-and-control/backdoor/webshell/ui::self-named-get-form--rx-4", "l": 1, "m": "B0030" }, { "a": "T1059", "c": 0.800000011920929, "d": "Self-reference via __FILE__", "e": [ "__FILE__" ], "i": "micro-behaviors/fs/read/self::self-file-reference", "l": 3 }, { "a": "T1505.003", "c": 0.8999999761581421, "d": "PHP source imports base64_decode", "e": [ "[addcslashes, array_key_exists, array_merge, array_pop, array_push, array_search, array_unique, array_unshift, base64_decode, ba" ], "i": "objectives/command-and-control/backdoor/webshell/stager::source-import-base64-decode", "l": 1 }, { "a": "T1505.003", "c": 0.949999988079071, "d": "Dynamic callback over object properties", "e": [ "$sendMethod($this-\u003eMIMEHeader, $this-\u003eMIMEBody)" ], "i": "objectives/supply-chain/hidden-payload/trojan::remote-prop-callback-exec", "l": 1 }, { "a": "T1082", "d": "References PHP_VERSION constant", "e": [ "PHP_VERSION" ], "i": "objectives/discovery/system/fingerprint/info::php-version-constant", "l": 2, "m": "E1082" }, { "c": 0.699999988079071, "d": "PHP object serialization", "e": [ "serialize" ], "i": "micro-behaviors/data/serialize/object::serialize", "l": 3 }, { "a": "T1505.003", "c": 0.8600000143051147, "d": "Very long embedded string", "e": [ "strings.max_length = 815.00" ], "i": "objectives/command-and-control/backdoor/webshell/stager::very-long-string", "l": 1 }, { "d": "Content-Type header string", "e": [ "Content-Type:" ], "i": "micro-behaviors/communications/http/request/client::content-type-header", "l": 1 }, { "a": "T1546", "c": 1.0, "d": "Writes data to a file via functions", "e": [ "fputs(" ], "i": "micro-behaviors/fs/file/write/direct::php-file-write-func", "l": 2 }, { "a": "T1505.003", "c": 0.8999999761581421, "d": "PHP source imports file_put_contents", "e": [ "[addcslashes, array_key_exists, array_merge, array_pop, array_push, array_search, array_unique, array_unshift, base64_decode, ba" ], "i": "objectives/command-and-control/backdoor/webshell/stager::source-import-file-put-contents", "l": 1 }, { "a": "T1543", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "usr/sbin" ], "i": "objectives/persistence/system/daemon/hidden-path::rc-local-hidden-system-bin--rx-4", "l": 1 }, { "a": "T1071.001", "c": 0.699999988079071, "d": "HTTP POST method", "e": [ "\"POST\"" ], "i": "micro-behaviors/communications/http/post::post", "l": 1, "m": "C0002" }, { "c": 0.699999988079071, "d": "MD5 hash computation", "e": [ "md5" ], "i": "micro-behaviors/crypto/hash/digest::md5-php", "l": 3, "m": "C0029" }, { "a": "T1027", "c": 0.8999999761581421, "d": "pack(H*) hex-encoded XOR key for decryption", "e": [ "pack('H*'" ], "i": "objectives/anti-static/obfuscation/encoding/xor::packed-hex-xor-key", "l": 4, "m": "B0032" }, { "a": "T1005", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "xlsx" ], "i": "objectives/collection/stealer/tactics::office-secret-extension-list--rx-7", "l": 1, "m": "B0028" }, { "a": "T1505.003", "d": "PHP open tag", "e": [ "\u003c?php" ], "i": "objectives/command-and-control/backdoor/webshell/request::php-tag", "l": 1, "m": "B0030" }, { "a": "T1105", "c": 0.800000011920929, "d": "Creates or overwrites a local file", "e": [ "file_put_contents" ], "i": "micro-behaviors/fs/write/file/direct::file-put-contents", "l": 3, "m": "C0052" }, { "c": 0.699999988079071, "d": "PHP error suppression operator usage", "e": [ "@mail($to, $subject, $body, $header, $params)", "@$mail = popen($sendmail, 'w')", "@unlink($file)", "@unlink($signed)", "@is_file($path)", "@date_default_timezone_get()", "@mail($to, $subject, $body, $header)", "@openssl_pkcs7_sign(\r\n $file,\r\n $signed,\r\n ...", "@mb_check_encoding($domain, $this-\u003eCharSet)" ], "i": "micro-behaviors/os/stdio::error-suppress-prefix", "l": 3 }, { "a": "T1059", "c": 0.8500000238418579, "d": "HTTP REQUEST parameter access ($_REQUEST)", "e": [ "$_REQUEST" ], "i": "micro-behaviors/communications/http/request/params::request-dup", "l": 3 }, { "a": "T1071", "c": 0.6000000238418579, "d": "URL with .php endpoint", "e": [ "http://www.php" ], "i": "objectives/command-and-control/infrastructure/domain/tld::php-endpoint-url", "l": 1 }, { "c": 0.800000011920929, "d": "PHP variable function invocation pattern", "e": [ "headerHTML", "exceptions" ], "i": "objectives/anti-static/obfuscation/imports::dynamic-function-execution", "l": 3 }, { "c": 0.949999988079071, "d": "Disables error reporting (error_reporting(0))", "e": [ "error_reporting(0)" ], "i": "micro-behaviors/os/stdio::error-reporting-off", "l": 3 }, { "c": 0.8399999737739563, "d": "Regex component marker", "e": [ "\u003cpre align=center\u003e\u003cform method=post\u003ePassword: \u003cinput type='password' name='pass'\u003e\u003cinput type='submit' value='\u003e\u003e'\u003e\u003c/form\u003e\u003c/pre\u003e" ], "i": "micro-behaviors/data/text/llm/action::llm-send-action-cond-4--inline-11750", "l": 1 }, { "c": 0.699999988079071, "d": "base64 encoding keyword", "e": [ "base64" ], "i": "micro-behaviors/data/text/encoded::base64-token", "l": 3 }, { "a": "T1572", "d": "Regex component marker", "e": [ "video/quicktime" ], "i": "objectives/command-and-control/channel/tunnel/proxy::gost-scheme--rx-4", "l": 1 }, { "d": "certificate string reference", "e": [ "certificate" ], "i": "micro-behaviors/crypto/certificate/usage::certificate-ref", "l": 2 }, { "a": "T1071.001", "c": 0.8999999761581421, "d": "Base64 result chunking", "e": [ "chunk_split(base64" ], "i": "objectives/command-and-control/beacon/network/json::result-base64-chunking", "l": 3, "m": "B0030" }, { "c": 0.699999988079071, "d": "SHA1 hash computation", "e": [ "sha1" ], "i": "micro-behaviors/crypto/hash/digest::sha1-php", "l": 3, "m": "C0029" }, { "a": "T1110.001", "c": 0.8500000238418579, "d": "Service account redis", "e": [ "redis" ], "i": "objectives/lateral-movement/brute-force/password::service-account-redis", "l": 1, "m": "E1110" }, { "a": "T1505.003", "c": 0.9399999976158142, "d": "Regex component marker", "e": [ "file_get_contents" ], "i": "objectives/command-and-control/backdoor/webshell/request::raw-json-post-cmd-field--rx-7", "l": 1, "m": "B0030" }, { "a": "T1027", "c": 1.0, "d": "Comment-heavy source context", "e": [ "comments.to_code_ratio = 0.52" ], "i": "objectives/anti-static/obfuscation/code-metrics/strings::comment-heavy-source", "l": 1, "m": "B0032" }, { "c": 0.8399999737739563, "d": "Regex component marker", "e": [ "to the" ], "i": "micro-behaviors/data/text/llm/action::llm-send-action-cond-6--inline-11768", "l": 1 }, { "a": "T1210", "c": 0.8600000143051147, "d": "Redis KEYS command", "e": [ "keys" ], "i": "objectives/lateral-movement/exploit/container::redis-keys-command", "l": 1 }, { "a": "T1505.003", "c": 0.8799999952316284, "d": "Regex component marker", "e": [ "escapeshellcmd" ], "i": "objectives/command-and-control/backdoor/webshell/exec::dangerous-php-function-cluster-cond-0--inline-16595", "l": 1, "m": "B0030" }, { "c": 0.8500000238418579, "d": "Removes PHP script execution time limit", "e": [ "set_time_limit(0)" ], "i": "objectives/command-and-control/backdoor/webshell/session::unlimited-runtime-call", "l": 4 }, { "c": 1.0, "d": "PHP mail() function call", "e": [ "mail" ], "i": "micro-behaviors/process/create/exec::php-mail", "l": 3 }, { "d": "password keyword", "e": [ "password" ], "i": "micro-behaviors/data/text/keywords/lexicon::password", "l": 1 }, { "c": 0.8399999737739563, "d": "Regex component marker", "e": [ "\u003cpre align=center\u003e\u003cform method=post\u003ePassword: \u003cinput type='password' name='pass'\u003e\u003cinput type='submit' value='\u003e\u003e'\u003e\u003c/form\u003e\u003c/pre\u003e" ], "i": "micro-behaviors/data/text/llm/action::llm-send-action--rx-6", "l": 1 }, { "c": 0.7599999904632568, "d": "Regex component marker", "e": [ "following" ], "i": "micro-behaviors/data/text/llm/action::llm-path-navigation-action--rx-22", "l": 1 }, { "a": "T1505.003", "c": 0.4000000059604645, "d": "PHP $_POST parameter access", "e": [ "$_POST[" ], "i": "objectives/command-and-control/backdoor/webshell/request::php-post", "l": 1, "m": "B0030" }, { "c": 0.800000011920929, "d": "Writes a string to an open file", "e": [ "fputs" ], "i": "micro-behaviors/fs/write/file/direct::fputs", "l": 3, "m": "C0052" }, { "a": "T1505.003", "c": 0.4000000059604645, "d": "PHP $_REQUEST parameter access", "e": [ "$_REQUEST[" ], "i": "objectives/command-and-control/backdoor/webshell/request::php-request", "l": 1, "m": "B0030" }, { "a": "T1562.001", "c": 0.699999988079071, "d": "Reads safe_mode setting", "e": [ "ini_get('safe_mode" ], "i": "objectives/evasion/security-bypass/runtime::ini-get-safe-mode", "l": 4, "m": "B0032" }, { "c": 0.75, "d": "Generic $_SERVER superglobal access", "e": [ "$_SERVER" ], "i": "micro-behaviors/communications/http/request/params::server-dup", "l": 3 }, { "a": "T1059.004", "c": 0.8999999761581421, "d": "Process open via popen()", "e": [ "popen" ], "i": "micro-behaviors/process/create/shell/lang::popen", "l": 3, "m": "E1059" }, { "c": 0.75, "d": "Inline password token in lure", "e": [ "password' name='pass'" ], "i": "objectives/lateral-movement/social-engineering/lures::inline-password-token", "l": 1 }, { "a": "T1082", "d": "Accesses SERVER_NAME variable", "e": [ "$_SERVER['SERVER_NAME']" ], "i": "objectives/discovery/system/fingerprint/info::server-name-access", "l": 3, "m": "E1082" }, { "c": 0.699999988079071, "d": "AJAX request handler pattern", "e": [ "$_POST['subject']", "$_POST['replyTo']", "$_POST['messageType']", "$_POST['action']", "$_POST['emailList']", "$_POST['messageLetter']", "$_POST['senderName']", "$_POST['senderEmail']" ], "i": "objectives/command-and-control/backdoor/webshell/ui::ajax-handler", "l": 4, "m": "B0030" }, { "a": "T1071.001", "c": 0.6000000238418579, "d": "multipart/form-data content type", "e": [ "multipart/form-data" ], "i": "micro-behaviors/communications/http/post::multipart-form", "l": 1, "m": "C0002" }, { "a": "T1505.003", "c": 0.8500000238418579, "d": "HTML password form in PHP", "e": [ "\u003cinput type='password'" ], "i": "objectives/command-and-control/backdoor/webshell/auth::password-form", "l": 4, "m": "B0030" }, { "a": "T1059.004", "c": 0.8999999761581421, "d": "Variable input reaches alt exec functions", "e": [ "popen($" ], "i": "micro-behaviors/process/create/shell/lang::exec-user-input-func-alt", "l": 3, "m": "E1059" }, { "c": 0.699999988079071, "d": "Remove execution time limit", "e": [ "set_time_limit" ], "i": "micro-behaviors/process/control/signal::set-time-limit", "l": 3 }, { "a": "T1566.002", "c": 0.8500000238418579, "d": "PHP script writing POST data to local file", "e": [ "fputs(", "$_POST" ], "i": "objectives/credential-access/phishing/tactics::php-credential-exfiltration", "l": 4, "m": "B0030" }, { "c": 1.0, "d": "php code embedded in string", "e": [ "Detected php at offset 0x0" ], "i": "metadata/lang/embedded::php", "l": 2 }, { "c": 0.8999999761581421, "d": "Encoded payload detected: url", "e": [ "array(' ', ' .', ' ', '%'), \u003curl\u003e", "$messageLetter = ereg_replace(\"\\\"\", \"\"\", \u003curl\u003e" ], "i": "metadata/encoded-payload/url", "l": 3 }, { "c": 0.8999999761581421, "d": "Decoded unicode-escape content", "e": [ "'((?\u003e(?\u003e(?\u003e((?\u003e(?\u003e(?\u003e )?[\\t ])+|(?\u003e[\\t \u003cunicode-escape\u003e", "\u003cbinary data\u003e \u003cunicode-escape\u003e" ], "i": "metadata/encoded-payload/unicode-escape", "l": 2 } ], "sha": "ccddd020fa9ba3fb78a52fdbc3887c2e6a56d0355a643f4e5ee2bb17e5e0ad37", "path": "e62ef90036cd66865272ae4dbc7dfb21", "type": "php" } ], "tv": "bef72" } }