{ "ml": { "v": "7", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.000040968258, "rte": "az", "prob": 0.000040968258 }, { "cls": 0, "raw": 0.000110924244, "rte": "az/source", "prob": 0.000110924244 }, { "cls": 0, "raw": 0.000000029802322, "rte": "az/java", "prob": 0.000000029802322 } ], "prob": 0.000040968258, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.00004096825796295889 } ], "version": "v18.18", "analyzed_at": "2026-06-10T17:42:44Z" }, "path": "BCELoaderGenerator.java", "raw": { "v": "7", "tv": "055ed", "files": [ { "id": 0, "ctx": [ { "a": 0, "l": 1, "t": "package jmg.core.format;" }, { "a": 25, "l": 2, "t": "" }, { "a": 26, "l": 3, "n": [ { "c": 3, "d": "Javassist library reference", "i": "micro-behaviors/data/string/library::javassist", "o": 33, "z": 9 } ], "t": "import javassist.ClassClassPath;" }, { "a": 59, "l": 4, "t": "import javassist.ClassPool;" }, { "a": 87, "l": 5, "t": "import javassist.CtClass;" }, { "a": 1759, "l": 41, "t": " private static String encodeToBase64(byte[] input) throws Exception {" }, { "a": 1833, "l": 42, "t": " String value = null;" }, { "a": 1862, "l": 43, "n": [ { "c": 2, "d": "base64 encoding keyword", "i": "micro-behaviors/data/text/encoded::base64-token", "o": 1876, "z": 6 } ], "t": " Class base64;" }, { "a": 1884, "l": 44, "t": " try {" }, { "a": 1898, "l": 45, "n": [ { "c": 3, "d": "Java reflection class loading", "i": "objectives/anti-static/obfuscation/reflection/class::java-reflection", "o": 1919, "z": 13 } ], "t": " base64 = Class.forName(\"java.util.Base64\");" }, { "a": 1954, "l": 46, "t": " Object Encoder = base64.getMethod(\"getEncoder\", (Class[]) null).invoke(base64, (Object[]) null);" }, { "a": 2063, "l": 47, "t": " value = (String) Encoder.getClass().getMethod(\"encodeToString\", byte[].class).invoke(Encoder, input);" }, { "a": 2212, "l": 49, "t": " try {" }, { "a": 2230, "l": 50, "t": " base64 = Class.forName(\"sun.misc.BASE64Encoder\");" }, { "a": 2296, "l": 51, "n": [ { "c": 3, "d": "Java reflection class loading", "i": "objectives/anti-static/obfuscation/reflection/class::java-reflection", "o": 2336, "z": 11 } ], "t": " Object Encoder = base64.newInstance();" }, { "a": 2351, "l": 52, "t": " value = (String) Encoder.getClass().getMethod(\"encode\", byte[].class).invoke(Encoder, input);" }, { "a": 2461, "l": 53, "t": " } catch (Exception var5) {" } ], "mol": "O(As)H(Db)", "sha": "d05a2a0c80bb2b17c33ef4786242531d88eb15f5aea453f1fb858a6352cb98d0", "fact": { "id": "java", "imp": [ [ "", "ClassPool" ], [ "", "pool" ], [ "", "pool" ], [ "", "ctClass" ], [ "", "config" ], [ "", "ctClass" ], [ "", "ctClass" ], [ "", "ctClass" ], [ "", "getClassName" ], [ "", "String" ], [ "", "config" ], [ "", "ctClass" ], [ "", "encodeToBase64" ], [ "", "encodeToBase64" ], [ "", "config" ], [ "", "splitChunks" ], [ "", "result" ], [ "", "result" ], [ "", "getBase64String" ], [ "", "String" ], [ "", "ctClass" ], [ "", "JavassistUtil" ], [ "", "ctClass" ], [ "", "ctClass" ], [ "", "Class" ], [ "", "base64" ], [ "", "base64" ], [ "", "Encoder" ], [ "", "Encoder" ], [ "", "Encoder" ], [ "", "Class" ], [ "", "base64" ], [ "", "Encoder" ], [ "", "Encoder" ], [ "", "Encoder" ], [ "", "Math" ], [ "", "source" ], [ "", "source" ], [ "", "System" ], [ "", "System" ], [ "", "javassist.ClassClassPath" ], [ "", "javassist.ClassPool" ], [ "", "javassist.CtClass" ], [ "", "javassist.CtMethod" ], [ "", "jmg.core.config.AbstractConfig" ], [ "", "jmg.core.util.JavassistUtil" ] ], "mbr": [ "parts.length", "payload.length", "ret.length" ], "met": { "ast": { "op.gt": 2.0, "op.lt": 2.0, "op.add": 4.0, "op.div": 1.0, "op.sub": 2.0, "max_depth": 19.0, "bind_count": 24.0, "call_count": 46.0, "node_count": 1016.0, "member_count": 3.0, "op_density.gt": 0.0, "op_density.lt": 0.0, "op_density.add": 0.0, "op_density.div": 0.0, "op_density.sub": 0.0, "identifier_count": 71.0, "member_depth_max": 2.0, "string_literal_count": 14.0, "string_concat_chain_max_length": 3.0 }, "file": { "size": 3332.0, "entropy": 4.64, "size_bytes": 3332.0 }, "text": { "digit_ratio": 0.02, "space_count": 888.0, "total_lines": 77.0, "char_entropy": 4.64, "unique_chars": 71.0, "string_density": 0.18, "avg_line_length": 42.29, "max_line_length": 113.0, "empty_line_ratio": 0.05, "last_line_length": 1.0, "whitespace_ratio": 0.29, "most_common_ratio": 0.06, "identifier_density": 2.31, "line_length_stddev": 29.14, "normalized_string_count": 1.6, "repeated_char_sequences": 42.0, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 1.0, "most_common_char_codepoint": 116.0, "suspicious_identifier_ratio": 0.13, "normalized_unique_identifiers": 11.33 }, "binds": { "count": 24.0 }, "calls": { "count": 46.0 }, "binary": { "overall_entropy": 4.64 }, "source": { "class_count": 1.0, "function_count": 3.0 }, "imports": { "count": 6.0, "unique_modules": 6.0, "third_party_count": 6.0, "third_party_ratio": 1.0 }, "members": { "count": 3.0 }, "strings": { "total": 14.0, "avg_length": 10.86, "max_length": 22.0, "avg_entropy": 2.9, "empty_count": 1.0, "total_bytes": 152.0, "entropy_stddev": 1.05 }, "functions": { "count": 4.0, "avg_params": 1.33, "max_params": 2.0, "length_stddev": 5.44, "avg_name_length": 16.0, "avg_length_lines": 21.33, "max_length_lines": 29.0, "min_length_lines": 17.0, "high_entropy_names": 1.0, "avg_param_name_length": 6.75, "density_per_100_lines": 3.9, "code_in_functions_ratio": 0.83 }, "identifiers": { "count": 71.0, "total": 178.0, "avg_length": 8.94, "max_length": 25.0, "min_length": 1.0, "avg_entropy": 2.59, "reuse_ratio": 0.4, "unique_count": 71.0, "length_stddev": 5.15, "has_digit_ratio": 0.1, "sequential_names": 5.0, "base64_like_names": 4.0, "single_char_count": 3.0, "single_char_ratio": 0.04, "high_entropy_count": 9.0, "high_entropy_ratio": 0.13, "all_lowercase_ratio": 0.37, "all_uppercase_ratio": 0.01, "numeric_suffix_count": 5.0 } }, "str": [ [ 762, "u8", "getClassName" ], [ 763, "u8", "getClassName" ], [ 826, "u8", "{return \\\"%s\\\";}" ], [ 827, "u8", "{return " ], [ 837, "u8", "%s" ], [ 841, "u8", ";}" ], [ 944, "u8", "getBase64String" ], [ 945, "u8", "getBase64String" ], [ 1056, "u8", "[\\\\s*\\t\\n\\r]" ], [ 1057, "u8", "[" ], [ 1060, "u8", "s*" ], [ 1068, "u8", "]" ], [ 1137, "10", "40000" ], [ 1226, "10", "0" ], [ 1278, "10", "0" ], [ 1295, "u8", "+" ], [ 1296, "u8", "+" ], [ 1331, "u8", "new String(\\" ], [ 1332, "u8", "new String(" ], [ 1360, "u8", "\\\")" ], [ 1363, "u8", ")" ], [ 1432, "u8", "{return %s;}" ], [ 1433, "u8", "{return %s;}" ], [ 1933, "u8", "java.util.Base64" ], [ 1934, "u8", "java.util.Base64" ], [ 2000, "u8", "getEncoder" ], [ 2001, "u8", "getEncoder" ], [ 2121, "u8", "encodeToString" ], [ 2122, "u8", "encodeToString" ], [ 2269, "u8", "sun.misc.BASE64Encoder" ], [ 2270, "u8", "sun.misc.BASE64Encoder" ], [ 2413, "u8", "encode" ], [ 2414, "u8", "encode" ], [ 2784, "10", "0" ], [ 2808, "10", "0" ], [ 3002, "10", "0" ], [ 3192, "10", "0" ] ], "tgt": [ "ClassClassPath", "String", "StringBuilder", "append", "arraycopy", "ceil", "defrost", "detach", "encodeToBase64", "forName", "format", "getBytesInLoader", "getClass", "getClassFile", "getClassNameInLoader", "getCtClass", "getDeclaredMethod", "getDefault", "getLoaderClassName", "getMethod", "getName", "insertClassPath", "invoke", "length", "newInstance", "printStackTrace", "removeSourceFileAttribute", "replaceAll", "setBody", "setName", "setVersionToJava5", "splitChunks", "toBytecode", "toCharArray" ], "val": { "file.stem": "BCELoaderGenerator", "file.basename": "BCELoaderGenerator.java", "source.language": "java", "source.imports[0]": "Class", "source.imports[1]": "ClassPool", "source.imports[2]": "Encoder", "source.imports[3]": "JavassistUtil", "source.imports[4]": "Math", "source.imports[5]": "String", "source.imports[6]": "System", "source.imports[7]": "base64", "source.imports[8]": "config", "source.imports[9]": "ctClass", "source.strings[0]": "[\\\\s*\\t\\n\\r]", "source.strings[1]": "encode", "source.strings[2]": "encodeToString", "source.strings[3]": "getBase64String", "source.strings[4]": "getClassName", "source.strings[5]": "getEncoder", "source.strings[6]": "java.util.Base64", "source.strings[7]": "new String(", "source.strings[8]": "new String(\\", "source.strings[9]": "sun.misc.BASE64Encoder", "source.has_imports": true, "source.imports[10]": "encodeToBase64", "source.imports[11]": "getBase64String", "source.imports[12]": "getClassName", "source.imports[13]": "javassist.ClassClassPath", "source.imports[14]": "javassist.ClassPool", "source.imports[15]": "javassist.CtClass", "source.imports[16]": "javassist.CtMethod", "source.imports[17]": "jmg.core.config.AbstractConfig", "source.imports[18]": "jmg.core.util.JavassistUtil", "source.imports[19]": "pool", "source.imports[20]": "result", "source.imports[21]": "source", "source.imports[22]": "splitChunks", "source.strings[10]": "{return ", "source.strings[11]": "{return %s;}", "source.strings[12]": "{return \\\"%s\\\";}", "source.functions[0]": "encodeToBase64", "source.functions[1]": "generatorBCELoaderClass", "source.functions[2]": "splitChunks" } }, "find": [ { "id": "micro-behaviors/data/text/encoded::base64-token", "conf": 0.699999988079071, "crit": 2, "desc": "base64 encoding keyword" }, { "id": "objectives/anti-static/obfuscation/reflection/class::java-getmethod", "conf": 1.0, "crit": 1, "desc": "Java getMethod" }, { "id": "metadata/file/text/format::vocab-string", "conf": 0.9700000286102295, "crit": 1, "desc": "Validation vocabulary string" }, { "id": "micro-behaviors/data/text/keywords/lexicon::command-result-word", "conf": 0.4000000059604645, "crit": 1, "desc": "cmd/command/result vocabulary word" }, { "id": "micro-behaviors/data/text/keywords/lexicon::payload", "conf": 0.6000000238418579, "crit": 1, "desc": "payload keyword" }, { "id": "objectives/anti-static/obfuscation/reflection/class::java-invoke", "conf": 1.0, "crit": 1, "desc": "Java invoke method" }, { "id": "objectives/anti-static/obfuscation/reflection/class::java-class-forname", "conf": 1.0, "crit": 1, "desc": "Java Class.forName" }, { "id": "micro-behaviors/data/string/library::javassist", "conf": 0.800000011920929, "crit": 3, "desc": "Javassist library reference" }, { "id": "objectives/anti-static/obfuscation/reflection/class::java-newinstance", "conf": 1.0, "crit": 1, "desc": "Java newInstance" }, { "id": "metadata/file/text/format::vocab-object", "conf": 0.9700000286102295, "crit": 1, "desc": "Validation vocabulary object" }, { "id": "objectives/anti-static/obfuscation/reflection/class::java-reflection", "conf": 0.8500000238418579, "crit": 3, "desc": "Java reflection class loading" } ], "path": "BCELoaderGenerator.java", "risk": 2, "size": 3332, "type": "java" } ] } }