{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.999962568283081, "class": 2 } ], "prob": 0.99996257, "class": 2, "models": [ { "m": "az", "prob": 0.999166, "class": 2 }, { "m": "az/scripts", "prob": 0.9999373, "class": 2 }, { "m": "az/php", "prob": 0.99996257, "class": 2 } ], "version": "v16.16", "thresholds": [ 0.9961138, 0.99909174 ], "analyzed_at": "2026-05-09T07:58:19Z" }, "path": "miniv48.php", "raw": { "v": "4", "fs": [ { "f": "KO₅(C₈CaErAsI₂)H₅(Cm₂Db₃F₅OsPo)MdTh", "k": { "source.imports[0]": "chmod", "source.imports[1]": "copy", "source.imports[2]": "error_reporting", "source.imports[3]": "explode", "source.imports[4]": "fclose", "source.imports[5]": "file_get_contents", "source.imports[6]": "fileperms", "source.imports[7]": "filesize", "source.imports[8]": "fopen", "source.imports[9]": "fwrite", "source.strings[0]": "\n\u003ctr\u003e\n\u003ctd class=td_home\u003e \u003cimg src='data:image/png;base64,R0lGODlhEwAQALMAAAAAAP///5ycAM7OY///nP//zv/OnPf39////wAAAAAAAAAAAAAAAAAAAAAA", "source.strings[1]": " /\u003e\n\u003cinput type=\"hidden\" name=\"path\" value=", "source.strings[2]": " /\u003e\u003cinput type=\"submit\" name=\"ngaran\" value=\"Create\"/\u003e\u003c/form\u003e\u003cbr\u003e ", "source.strings[3]": " \u003ctable width=\"100%\" class=\"table_home\" border=\"0\" cellpadding=\"3\" cellspacing=\"1\" align=\"center\"\u003e\n\u003ctr\u003e\n\u003cth class=th_home style=\"background:silver;color:black;\"\u003e\u003ccenter\u003eName\u003c/center\u003e\u003c/th\u003e\n\u003cth class=th_home style=\"background:silver;color:black;\" \u003e\u003ccenter\u003eSize\u003c/center\u003e\u003c/th\u003e\n\u003cth class=th_home style=\"background:silver;color:black;\" \u003e\u003ccenter\u003ePerm\u003c/center\u003e\u003c/th\u003e\n\u003cth class=th_home style=\"background:silver;color:black;\" \u003e\u003ccenter\u003eOptions\u003c/center\u003e\u003c/th\u003e\n\u003c/tr\u003e \u003ctr\u003e\n\u003ctd class=td_home\u003e..\u003c/td\u003e\u003ctd class=td_home align=center\u003eNONE\u003c/td\u003e \u003ctd class=td_home align=center\u003eLINK\u003c/td\u003e \u003ctd class=td_home align=center\u003e \u003ca href=\"?option\u0026path=", "source.strings[4]": " \u003ctextarea style=\"width: 100%;height: 400px;\" readonly\u003e ", "source.strings[5]": " ]\u003c/font\u003e\u003cbr /\u003e", "source.strings[6]": "\" /\u003e\n\u003cinput type=\"hidden\" name=\"path\" value=\"", "source.strings[7]": "\" /\u003e\u003cinput type=\"submit\" name=\"ngaran\" value=\"Create\"/\u003e\u003c/form\u003e\u003cbr\u003e ", "source.strings[8]": "\"\u003e\n\u003cinput type=\"hidden\" name=\"opt\" value=\"chmod\"\u003e\n\u003cinput type=\"submit\" value=\"Go\" /\u003e\n\u003c/form\u003e", "source.strings[9]": "\"\u003e\n\u003cinput type=\"hidden\" name=\"opt\" value=\"delete\"\u003e\n\u003cinput type=\"submit\" value=\"Go\" /\u003e\n\u003c/form\u003e", "source.has_imports": true, "source.imports[10]": "get_magic_quotes_gpc", "source.imports[11]": "getcwd", "source.imports[12]": "htmlspecialchars", "source.imports[13]": "is_dir", "source.imports[14]": "is_file", "source.imports[15]": "is_readable", "source.imports[16]": "is_writable", "source.imports[17]": "isset", "source.imports[18]": "mkdir", "source.imports[19]": "perms", "source.imports[20]": "php_uname", "source.imports[21]": "rename", "source.imports[22]": "rmdir", "source.imports[23]": "round", "source.imports[24]": "scandir", "source.imports[25]": "set_time_limit", "source.imports[26]": "sprintf", "source.imports[27]": "str_replace", "source.imports[28]": "stripslashes", "source.imports[29]": "substr", "source.imports[30]": "unlink", "source.strings[10]": "\"\u003e\n\u003cinput type=\"hidden\" name=\"opt\" value=\"edit\"\u003e\n\u003cinput type=\"submit\" value=\"Go\" /\u003e\n\u003c/form\u003e", "source.strings[11]": "\"\u003e\n\u003cinput type=\"hidden\" name=\"opt\" value=\"rename\"\u003e\n\u003cinput type=\"submit\" value=\"Go\" /\u003e\n\u003c/form\u003e", "source.strings[12]": "$azz/$new", "source.strings[13]": "$haaa/$heee", "source.strings[14]": "$hell/$yeah", "source.strings[15]": "$path/$dir", "source.strings[16]": "$path/$file", "source.strings[17]": "$paths[$i]", "source.strings[18]": "\u0026opt=baru\u0026name=new.php\"\u003e+ New File\u003c/a\u003e | \u003ca href=\"?option\u0026path=", "source.strings[19]": "\u0026opt=btw\u0026type=dir\"\u003e+ New Dir\u003c/a\u003e \u003c/td\u003e\u003c/tr\u003e\n", "source.strings[20]": "\u0026opt=chmod\u0026type=dir\u0026name=", "source.strings[21]": "\u0026opt=chmod\u0026type=file\u0026name=", "source.strings[22]": "\u0026opt=delete\u0026type=buat\" method=\"POST\"\u003e\nNew Name : \u003cinput name=\"name\" type=\"text\" size=\"20\" value=\"Folder\" /\u003e\n\u003cinput type=\"hidden\" name=\"path\" value=", "source.strings[23]": "\u0026opt=delete\u0026type=buat\" method=\"POST\"\u003e\nNew Name : \u003cinput name=\"name\" type=\"text\" size=\"20\" value=\"Folder\" /\u003e\n\u003cinput type=\"hidden\" name=\"path\" value=\"", "source.strings[24]": "\u0026opt=delete\u0026type=dir\u0026name=", "source.strings[25]": "\u0026opt=delete\u0026type=file\u0026name=", "source.strings[26]": "\u0026opt=edit\u0026type=file\u0026name=", "source.strings[27]": "\u0026opt=rename\u0026type=dir\u0026name=", "source.strings[28]": "\u0026opt=rename\u0026type=file\u0026name=", "source.strings[29]": "\u0026path=", "source.strings[30]": "/4YchffzGQhH4YRYPB2DOlHPiKwqd1Pq8yrVVg3QYeH5RYK5rJfaFUUA3vB4fBIBADs='\u003e \u003ca href=", "source.strings[31]": "/4YchffzGQhH4YRYPB2DOlHPiKwqd1Pq8yrVVg3QYeH5RYK5rJfaFUUA3vB4fBIBADs='\u003e \u003ca href=\\\"?path=$path/$dir\\\"\u003e$dir\u003c/a\u003e\u003c/td\u003e\n\u003ctd class=td_home \u003e\u003ccenter\u003eDIR\u003c/center\u003e\u003c/td\u003e\n\u003ctd class=td_home \u003e\u003ccenter\u003e", "source.strings[32]": "\u003c!doctype html\u003e\n\u003chtml\u003e\n\u003chead\u003e\n\u003ctitle\u003e$$ Beby $$\u003c/title\u003e\n\u003c/head\u003e", "source.strings[33]": "\u003c/a\u003e\u003c/td\u003e\n\u003ctd class=td_home \u003e\u003ccenter\u003eDIR\u003c/center\u003e\u003c/td\u003e\n\u003ctd class=td_home \u003e\u003ccenter\u003e", "source.strings[34]": "\u003c/a\u003e\u003c/td\u003e\n\u003ctd class=td_home\u003e\u003ccenter\u003e", "source.strings[35]": "\u003c/center\u003e", "source.strings[36]": "\u003c/center\u003e\u003c/font\u003e\u003cbr\u003e", "source.strings[37]": "\u003c/center\u003e\u003c/td\u003e\n\u003ctd class=td_home \u003e\u003ccenter\u003e\n\u003ca href=", "source.strings[38]": "\u003c/center\u003e\u003c/td\u003e\n\u003ctd class=td_home \u003e\u003ccenter\u003e\n\u003ca href=\\\"?option\u0026path=$path\u0026opt=rename\u0026type=dir\u0026name=$dir\\\"\u003eRename\u003c/a\u003e \u003ca href=\\\"?option\u0026path=$path\u0026opt=delete\u0026type=dir\u0026name=$dir\\\"\u003eDelete\u003c/a\u003e \u003ca href=\\\"?option\u0026path=$path\u0026opt=chmod\u0026type=dir\u0026name=$dir\\\"\u003eChmod\u003c/a\u003e\n\n\u003c/center\u003e\u003c/td\u003e\n\u003c/tr\u003e", "source.strings[39]": "\u003c/center\u003e\u003c/td\u003e\n\u003ctd class=td_home\u003e\u003ccenter\u003e", "source.strings[40]": "\u003c/center\u003e\u003c/td\u003e\n\u003ctd class=td_home\u003e\u003ccenter\u003e\n\u003ca href=", "source.strings[41]": "\u003c/center\u003e\u003c/td\u003e\n\u003ctd class=td_home\u003e\u003ccenter\u003e\n\u003ca href=\\\"?option\u0026path=$path\u0026opt=edit\u0026type=file\u0026name=$file\\\"\u003eEdit\u003c/a\u003e \u003ca href=\\\"?option\u0026path=$path\u0026opt=rename\u0026type=file\u0026name=$file\u0026path=$path\\\"\u003eRename\u003c/a\u003e \u003ca href=\\\"?option\u0026path=$path\u0026opt=delete\u0026type=file\u0026name=$file\\\"\u003eDelete\u003c/a\u003e \u003ca href=\\\"?option\u0026path=$path\u0026opt=chmod\u0026type=file\u0026name=$file\\\"\u003eChmod\u003c/a\u003e\n\u003c/center\u003e\u003c/td\u003e\n\u003c/tr\u003e", "source.strings[42]": "\u003c/center\u003e\u003c/tr\u003e\u003c/td\u003e\u003c/table\u003e\u003cbr /\u003e", "source.strings[43]": "\u003c/center\u003e\u003ccenter\u003e\u003cform enctype=\"multipart/form-data\" method=\"POST\"\u003e\u003cfont color=\"black\"\u003e\u003cinput style=\"background:silver;font-family: Comic Sans MS \" type=\"file\" name=\"file\" /\u003e\n\u003cinput type=\"submit\" value=\"Uploadd\" /\u003e\n\u003c/form\u003e\u003c/center\u003e\n\u003c/td\u003e\u003c/tr\u003e", "source.strings[44]": "\u003c/font\u003e", "source.strings[45]": "\u003c/font\u003e\u003c/center\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e\u003ccenter\u003e", "source.strings[46]": "\u003c/head\u003e\n\u003cbody\u003e\u003cb\u003e\n\u003cH1\u003e\u003ccenter\u003e \u0026lt;/\u0026gt; \u003cfont color=\"red\"\u003eUSTADCAGE_48\u003c/font\u003e \u003cfont color=\"dodgerblue\"\u003eFILE MANAGER\u003c/font\u003e\u003c/center\u003e\u003c/h1\u003e\n\u003ctable width=\"700\" border=\"0\" cellpadding=\"3\" cellspacing=\"1\" align=\"center\"\u003e\n\n\u003ctr\u003e\u003ctd\u003e\n\n\u003cfont color=\"green\"\u003e\u003ccenter\u003e", "source.strings[47]": "\u003c/table\u003e\n\u003c/div\u003e", "source.strings[48]": "\u003c/table\u003e\u003cbr /\u003e\u003ccenter\u003e", "source.strings[49]": "\u003c/textarea\u003e", "source.strings[50]": "\u003c/textarea\u003e\u003cbr /\u003e\n\u003cinput type=\"hidden\" name=\"path\" value=", "source.strings[51]": "\u003c/textarea\u003e\u003cbr /\u003e\n\u003cinput type=\"hidden\" name=\"path\" value=\"", "source.strings[52]": "\u003ca href=\"?path=", "source.strings[53]": "\u003cbr /\u003e\u003cbr /\u003e", "source.strings[54]": "\u003cbr\u003e\u003ccenter\u003e{ X48 - RES7OCK CREW - INDOXPLOIT CODERS - SUMEDANG CYBER TEAM }\u003cbr\u003e[SKILL 1%] [BACOT 98%] [COLI 1%]\u003cbr\u003e\u0026lt;/\u0026gt; ZONE_BLACK_HOLE\u003c/b\u003e\u003c/body\u003e\n\u003c/html\u003e", "source.strings[55]": "\u003cfont color=\"green\"\u003e", "source.strings[56]": "\u003cfont color=\"green\"\u003eChange Name Done \u003c/font\u003e\u003cbr /\u003e", "source.strings[57]": "\u003cfont color=\"green\"\u003eChange Permission Done \u003c/font\u003e\u003cbr /\u003e", "source.strings[58]": "\u003cfont color=\"green\"\u003eCreate File Done [ ", "source.strings[59]": "\u003cfont color=\"green\"\u003eCreate Folder Done \u003c/font\u003e\u003cbr /\u003e", "source.strings[60]": "\u003cfont color=\"green\"\u003eDelete File Done\u003c/font\u003e\u003cbr /\u003e", "source.strings[61]": "\u003cfont color=\"green\"\u003eEdit File Done \u003c/font\u003e\u003cbr /\u003e", "source.strings[62]": "\u003cfont color=\"green\"\u003eFile Upload\u003c/font\u003e\u003cbr /\u003e", "source.strings[63]": "\u003cfont color=\"red\"\u003e", "source.strings[64]": "\u003cfont color=\"red\"\u003eChange Name Error \u003c/font\u003e\u003cbr /\u003e", "source.strings[65]": "\u003cfont color=\"red\"\u003eChange Permission Error \u003c/font\u003e\u003cbr /\u003e", "source.strings[66]": "\u003cfont color=\"red\"\u003eCreate File Error\u003c/font\u003e\u003cbr /\u003e", "source.strings[67]": "\u003cfont color=\"red\"\u003eCreate Folder Error\u003c/font\u003e\u003cbr /\u003e", "source.strings[68]": "\u003cfont color=\"red\"\u003eEdit File Error \u003c/font\u003e\u003cbr /\u003e", "source.strings[69]": "\u003cfont color=\"red\"\u003eUpload Failed !!\u003c/font\u003e\u003cbr /\u003e", "source.strings[70]": "\u003cfont color=\"red#\"\u003eDelete File Error \u003c/font\u003e\u003cbr /\u003e", "source.strings[71]": "\u003cfont color=#fff\u003e\u003ccenter\u003e$ root@x48 : \u003ca href=\"?path=/\"\u003e/\u003c/a\u003e", "source.strings[72]": "\u003cform action=\"?option\u0026path=", "source.strings[73]": "\u003cform method=\"POST\"\u003e\n\u003ctextarea cols=80 rows=20 name=\"src\"\u003e", "source.strings[74]": "\u003cform method=\"POST\"\u003e\nNew Name : \u003cinput name=\"newname\" type=\"text\" size=\"20\" value=", "source.strings[75]": "\u003cform method=\"POST\"\u003e\nNew Name : \u003cinput name=\"newname\" type=\"text\" size=\"20\" value=\"", "source.strings[76]": "\u003cform method=\"POST\"\u003e\nPermission : \u003cinput name=\"perm\" type=\"text\" size=\"4\" value=", "source.strings[77]": "\u003cform method=\"POST\"\u003e\nPermission : \u003cinput name=\"perm\" type=\"text\" size=\"4\" value=\"", "source.strings[78]": "\u003cform method=\"POST\"\u003e Name : \u003cinput name=\"ngaran1\" type=\"text\" size=\"20\" value=", "source.strings[79]": "\u003cform method=\"POST\"\u003e Name : \u003cinput name=\"ngaran1\" type=\"text\" size=\"20\" value=\"", "source.strings[80]": "\u003ctr\u003e\n\u003ctd class=td_home \u003e \u003cimg src='data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAAAXNSR0IArs4c6QAAAAZiS0dEAP8A/wD/oL2nkwAAAAlwSFlzAAALEwAACxMBAJqcGAAAAAd0SU1FB9oJBhcTJv2B2d4AAAJMSURBVDjLbZO9ThxZEIW/qlvdtM38BNgJQmQgJGd+A/MQBLwGjiwH3nwdkSLtO2xERG5LqxXRSIR2YDfD4GkGM0P3rb4b9PAz0l7pSlWlW0fnnLolAIPB4PXh4eFunucAIILwdESeZyAifnp6+u9oNLo3gM3NzTdHR+//zvJMzSyJKKodiIg8AXaxeIz1bDZ7MxqNftgSURDWy7LUnZ0dYmxAFAVElI6AECygIsQQsizLBOABADOjKApqh7u7GoCUWiwYbetoUHrrPcwCqoF2KUeXLzEzBv0+uQmSHMEZ9F6SZcr6i4IsBOa/b7HQMaHtIAwgLdHalDA1ev0eQbSjrErQwJpqF4eAx/hoqD132mMkJri5uSOlFhEhpUQIiojwamODNsljfUWCqpLnOaaCSKJtnaBCsZYjAllmXI4vaeoaVX0cbSdhmUR3zAKvNjY6Vioo0tWzgEonKbW+KkGWt3Unt0CeGfJs9g+UU0rEGHH/Hw/MjH6/T+POdFoRNKChM22xmOPespjPGQ6HpNQ27t6sACDSNanyoljDLEdVaFOLe8ZkUjK5ukq3t79lPC7/ODk5Ga+Y6O5MqymNw3V1y3hyzfX0hqvJLybXFd++f2d3d0dms+qvg4ODz8fHx0/Lsbe3964sS7+4uEjunpqmSe6e3D3N5/N0WZbtly9f09nZ2Z/b29v2fLEevvK9qv7c2toKi8UiiQiqHbm6riW6a13fn+zv73+oqorhcLgKUFXVP+fn52+Lonj8ILJ0P8ZICCF9/PTpClhpBvgPeloL9U55NIAAAAAASUVORK5CYII='\u003e \u003ca href=", "source.strings[81]": "\u003ctr\u003e\n\u003ctd class=td_home \u003e \u003cimg src='data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAAAXNSR0IArs4c6QAAAAZiS0dEAP8A/wD/oL2nkwAAAAlwSFlzAAALEwAACxMBAJqcGAAAAAd0SU1FB9oJBhcTJv2B2d4AAAJMSURBVDjLbZO9ThxZEIW/qlvdtM38BNgJQmQgJGd+A/MQBLwGjiwH3nwdkSLtO2xERG5LqxXRSIR2YDfD4GkGM0P3rb4b9PAz0l7pSlWlW0fnnLolAIPB4PXh4eFunucAIILwdESeZyAifnp6+u9oNLo3gM3NzTdHR+//zvJMzSyJKKodiIg8AXaxeIz1bDZ7MxqNftgSURDWy7LUnZ0dYmxAFAVElI6AECygIsQQsizLBOABADOjKApqh7u7GoCUWiwYbetoUHrrPcwCqoF2KUeXLzEzBv0+uQmSHMEZ9F6SZcr6i4IsBOa/b7HQMaHtIAwgLdHalDA1ev0eQbSjrErQwJpqF4eAx/hoqD132mMkJri5uSOlFhEhpUQIiojwamODNsljfUWCqpLnOaaCSKJtnaBCsZYjAllmXI4vaeoaVX0cbSdhmUR3zAKvNjY6Vioo0tWzgEonKbW+KkGWt3Unt0CeGfJs9g+UU0rEGHH/Hw/MjH6/T+POdFoRNKChM22xmOPespjPGQ6HpNQ27t6sACDSNanyoljDLEdVaFOLe8ZkUjK5ukq3t79lPC7/ODk5Ga+Y6O5MqymNw3V1y3hyzfX0hqvJLybXFd++f2d3d0dms+qvg4ODz8fHx0/Lsbe3964sS7+4uEjunpqmSe6e3D3N5/N0WZbtly9f09nZ2Z/b29v2fLEevvK9qv7c2toKi8UiiQiqHbm6riW6a13fn+zv73+oqorhcLgKUFXVP+fn52+Lonj8ILJ0P8ZICCF9/PTpClhpBvgPeloL9U55NIAAAAAASUVORK5CYII='\u003e \u003ca href=\\\"?filesrc=$path/$file\u0026path=$path\\\"\u003e$file\u003c/a\u003e\u003c/td\u003e\n\u003ctd class=td_home\u003e\u003ccenter\u003e", "source.strings[82]": "\u003ctr\u003e\u003ctd\u003e\u003ccenter\u003eCurrent File : ", "source.strings[83]": "\u003e\n\u003cinput type=\"hidden\" name=\"opt\" value=\"chmod\"\u003e\n\u003cinput type=\"submit\" value=\"Go\" /\u003e\n\u003c/form\u003e", "source.strings[84]": "\u003e\n\u003cinput type=\"hidden\" name=\"opt\" value=\"delete\"\u003e\n\u003cinput type=\"submit\" value=\"Go\" /\u003e\n\u003c/form\u003e", "source.strings[85]": "\u003e\n\u003cinput type=\"hidden\" name=\"opt\" value=\"edit\"\u003e\n\u003cinput type=\"submit\" value=\"Go\" /\u003e\n\u003c/form\u003e", "source.strings[86]": "\u003e\n\u003cinput type=\"hidden\" name=\"opt\" value=\"rename\"\u003e\n\u003cinput type=\"submit\" value=\"Go\" /\u003e\n\u003c/form\u003e", "source.strings[87]": "\u003eChmod\u003c/a\u003e\n\n\u003c/center\u003e\u003c/td\u003e\n\u003c/tr\u003e", "source.strings[88]": "\u003eChmod\u003c/a\u003e\n\u003c/center\u003e\u003c/td\u003e\n\u003c/tr\u003e", "source.strings[89]": "\u003eDelete\u003c/a\u003e \u003ca href=", "source.strings[90]": "\u003eEdit\u003c/a\u003e \u003ca href=", "source.strings[91]": "\u003eRename\u003c/a\u003e \u003ca href=", "source.strings[92]": "?filesrc=", "source.strings[93]": "?option\u0026path=", "source.strings[94]": "?path=", "source.strings[95]": "AAAAACH5BAEAAAgALAAAAAATABAAAARREMlJq7046yp6BxsiHEVBEAKYCUPrDp7HlXRdEoMqCebp", "source.strings[96]": "delete", "source.strings[97]": "filesrc", "source.strings[98]": "newname", "source.strings[99]": "ngaran", "source.functions[0]": "perms", "source.strings[100]": "ngaran1", "source.strings[101]": "option", "source.strings[102]": "rename", "source.strings[103]": "tmp_name" }, "x": 371, "id": 0, "is": [ "set_time_limit", "error_reporting", "get_magic_quotes_gpc", "stripslashes", "php_uname", "isset", "getcwd", "str_replace", "explode", "isset", "copy", "isset", "htmlspecialchars", "file_get_contents", "isset", "isset", "chmod", "substr", "sprintf", "fileperms", "getcwd", "isset", "rename", "isset", "fopen", "fwrite", "fclose", "isset", "htmlspecialchars", "file_get_contents", "isset", "fopen", "fwrite", "fclose", "htmlspecialchars", "file_get_contents", "isset", "rmdir", "htmlspecialchars", "mkdir", "unlink", "scandir", "getcwd", "is_dir", "is_writable", "is_readable", "perms", "is_writable", "is_readable", "is_file", "filesize", "round", "round", "is_writable", "is_readable", "perms", "is_writable", "is_readable", "fileperms" ], "ms": { "file": { "size": 12035.0 }, "text": { "tab_count": 13.0, "digit_ratio": 0.05, "space_count": 808.0, "total_lines": 380.0, "char_entropy": 5.66, "mixed_indent": true, "unique_chars": 93.0, "import_density": 15.53, "lines_over_200": 5.0, "lines_over_500": 1.0, "string_density": 1.17, "avg_line_length": 30.67, "lines_over_1000": 1.0, "max_line_length": 1069.0, "empty_line_ratio": 0.1, "last_line_length": 2.0, "long_token_count": 3.0, "most_common_char": "e", "whitespace_ratio": 0.1, "most_common_ratio": 0.07, "identifier_density": 0.85, "line_length_stddev": 65.46, "encoded_string_ratio": 0.0, "normalized_import_count": 3.03, "normalized_string_count": 22.73, "repeated_char_sequences": 1.0, "suspicious_comment_ratio": 0.08, "max_inline_whitespace_run": 4.0, "normalized_function_count": 0.05, "trailing_whitespace_lines": 7.0, "imports_to_functions_ratio": 59.0, "strings_to_functions_ratio": 443.0, "suspicious_identifier_ratio": 0.03, "normalized_unique_identifiers": 6.88, "identifiers_to_functions_ratio": 59.0 }, "imports": { "total": 59.0, "unique_modules": 31.0, "third_party_count": 59.0, "third_party_ratio": 1.0 }, "strings": { "total": 443.0, "avg_length": 29.56, "max_length": 1101.0, "path_count": 2.0, "avg_entropy": 2.26, "total_bytes": 13094.0, "entropy_stddev": 1.62, "base64_candidates": 2.0, "very_long_strings": 2.0, "high_entropy_count": 6.0 }, "comments": { "chars": 375.0, "lines": 23.0, "total": 26.0, "to_code_ratio": 0.06, "empty_comments": 3.0, "base64_in_comments": 1.0, "high_entropy_comments": 1.0 }, "functions": { "total": 1.0, "avg_name_length": 5.0, "no_params_count": 1.0, "avg_length_lines": 52.0, "max_length_lines": 52.0, "min_length_lines": 52.0, "density_per_100_lines": 0.26, "code_in_functions_ratio": 0.14 }, "identifiers": { "total": 323.0, "avg_length": 6.08, "max_length": 20.0, "min_length": 1.0, "avg_entropy": 2.1, "reuse_ratio": 0.18, "unique_count": 59.0, "length_stddev": 3.97, "sequential_names": 2.0, "single_char_count": 2.0, "single_char_ratio": 0.03, "high_entropy_count": 1.0, "high_entropy_ratio": 0.02, "all_lowercase_ratio": 0.95, "all_uppercase_ratio": 0.05, "underscore_prefix_count": 3.0 } }, "ss": [ [ 229, "\u003c!doctype html\u003e\n\u003chtml\u003e\n\u003chead\u003e\n\u003ctitle\u003e$$ Beby $$\u003c/title\u003e\n\u003c/head\u003e" ], [ 230, "\u003c!doctype html\u003e\n\u003chtml\u003e\n\u003chead\u003e\n\u003ctitle\u003e$$ Beby $$\u003c/title\u003e\n\u003c/head\u003e" ], [ 1089, "\u003c/head\u003e\n\u003cbody\u003e\u003cb\u003e\n\u003cH1\u003e\u003ccenter\u003e \u0026lt;/\u0026gt; \u003cfont color=\"red\"\u003eUSTADCAGE_48\u003c/font\u003e \u003cfont color=\"dodgerblue\"\u003eFILE MANAGER\u003c/font\u003e\u003c/cen" ], [ 1090, "\u003c/head\u003e\n\u003cbody\u003e\u003cb\u003e\n\u003cH1\u003e\u003ccenter\u003e \u0026lt;/\u0026gt; \u003cfont color=\"red\"\u003eUSTADCAGE_48\u003c/font\u003e \u003cfont color=\"dodgerblue\"\u003eFILE MANAGER\u003c/font\u003e\u003c/cen" ], [ 1359, "\u003c/center\u003e\u003c/font\u003e\u003cbr\u003e" ], [ 1360, "\u003c/center\u003e\u003c/font\u003e\u003cbr\u003e" ], [ 1398, "path" ], [ 1399, "path" ], [ 1423, "path" ], [ 1424, "path" ], [ 1483, "\\\\" ], [ 1488, "/" ], [ 1489, "/" ], [ 1517, "/" ], [ 1518, "/" ], [ 1604, "\u003cfont color=#fff\u003e\u003ccenter\u003e$ root@x48 : \u003ca href=\"?path=/\"\u003e/\u003c/a\u003e" ], [ 1605, "\u003cfont color=#fff\u003e\u003ccenter\u003e$ root@x48 : \u003ca href=\"?path=/\"\u003e/\u003c/a\u003e" ], [ 1711, "\u003ca href=\"?path=" ], [ 1712, "\u003ca href=\"?path=" ], [ 1759, "$paths[$i]" ], [ 1792, "/" ], [ 1793, "/" ], [ 1804, "\"\u003e" ], [ 1805, "\u003e" ], [ 1814, "\u003c/a\u003e/" ], [ 1815, "\u003c/a\u003e/" ], [ 1830, "\u003c/font\u003e\u003c/center\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e\u003ccenter\u003e" ], [ 1831, "\u003c/font\u003e\u003c/center\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e\u003ccenter\u003e" ], [ 1893, "file" ], [ 1894, "file" ], [ 1920, "file" ], [ 1921, "file" ], [ 1928, "tmp_name" ], [ 1929, "tmp_name" ], [ 1946, "/" ], [ 1947, "/" ], [ 1958, "file" ], [ 1959, "file" ], [ 1966, "name" ], [ 1967, "name" ], [ 1982, "\u003cfont color=\"green\"\u003eFile Upload\u003c/font\u003e\u003cbr /\u003e" ], [ 1983, "\u003cfont color=\"green\"\u003eFile Upload\u003c/font\u003e\u003cbr /\u003e" ], [ 2042, "\u003cfont color=\"red\"\u003eUpload Failed !!\u003c/font\u003e\u003cbr /\u003e" ], [ 2043, "\u003cfont color=\"red\"\u003eUpload Failed !!\u003c/font\u003e\u003cbr /\u003e" ], [ 2102, "\u003c/center\u003e\u003ccenter\u003e\u003cform enctype=\"multipart/form-data\" method=\"POST\"\u003e\u003cfont color=\"black\"\u003e\u003cinput style=\"background:silver;font-fami" ], [ 2103, "\u003c/center\u003e\u003ccenter\u003e\u003cform enctype=\"multipart/form-data\" method=\"POST\"\u003e\u003cfont color=\"black\"\u003e\u003cinput style=\"background:silver;font-fami" ], [ 2363, "filesrc" ], [ 2364, "filesrc" ], [ 2382, "\u003ctr\u003e\u003ctd\u003e\u003ccenter\u003eCurrent File : " ], [ 2383, "\u003ctr\u003e\u003ctd\u003e\u003ccenter\u003eCurrent File : " ], [ 2428, "filesrc" ], [ 2429, "filesrc" ], [ 2445, "\u003c/center\u003e\u003c/tr\u003e\u003c/td\u003e\u003c/table\u003e\u003cbr /\u003e" ], [ 2446, "\u003c/center\u003e\u003c/tr\u003e\u003c/td\u003e\u003c/table\u003e\u003cbr /\u003e" ], [ 2487, " \u003ctextarea style=\"width: 100%;height: 400px;\" readonly\u003e " ], [ 2488, " \u003ctextarea style=\"width: 100%;height: 400px;\" readonly\u003e " ], [ 2587, "filesrc" ], [ 2588, "filesrc" ], [ 2600, "\u003c/textarea\u003e" ], [ 2601, "\u003c/textarea\u003e" ], [ 2646, "option" ], [ 2647, "option" ], [ 2666, "opt" ], [ 2667, "opt" ], [ 2676, "delete" ], [ 2677, "delete" ], [ 2692, "\u003c/table\u003e\u003cbr /\u003e\u003ccenter\u003e" ], [ 2693, "\u003c/table\u003e\u003cbr /\u003e\u003ccenter\u003e" ], [ 2724, "path" ], [ 2725, "path" ], [ 2732, "\u003cbr /\u003e\u003cbr /\u003e" ], [ 2733, "\u003cbr /\u003e\u003cbr /\u003e" ], [ 2765, "opt" ], [ 2766, "opt" ], [ 2775, "chmod" ], [ 2776, "chmod" ], [ 2801, "perm" ], [ 2802, "perm" ], [ 2828, "path" ], [ 2829, "path" ], [ 2843, "perm" ], [ 2844, "perm" ], [ 2859, "\u003cfont color=\"green\"\u003eChange Permission Done \u003c/font\u003e\u003cbr /\u003e" ], [ 2860, "\u003cfont color=\"green\"\u003eChange Permission Done \u003c/font\u003e\u003cbr /\u003e" ], [ 2931, "\u003cfont color=\"red\"\u003eChange Permission Error \u003c/font\u003e\u003cbr /\u003e" ], [ 2932, "\u003cfont color=\"red\"\u003eChange Permission Error \u003c/font\u003e\u003cbr /\u003e" ], [ 3009, "path" ], [ 3010, "path" ], [ 3032, "name" ], [ 3033, "name" ], [ 3049, "$hell/$yeah" ], [ 3055, "/" ], [ 3070, "\u003cform method=\"POST\"\u003e\nPermission : \u003cinput name=\"perm\" type=\"text\" size=\"4\" value=\"" ], [ 3071, "\u003cform method=\"POST\"\u003e\nPermission : \u003cinput name=\"perm\" type=\"text\" size=\"4\" value=" ], [ 3169, "%o" ], [ 3170, "%o" ], [ 3198, "\" /\u003e\n\u003cinput type=\"hidden\" name=\"path\" value=\"" ], [ 3199, " /\u003e\n\u003cinput type=\"hidden\" name=\"path\" value=" ], [ 3253, "path" ], [ 3254, "path" ], [ 3261, "\"\u003e\n\u003cinput type=\"hidden\" name=\"opt\" value=\"chmod\"\u003e\n\u003cinput type=\"submit\" value=\"Go\" /\u003e\n\u003c/form\u003e" ], [ 3262, "\u003e\n\u003cinput type=\"hidden\" name=\"opt\" value=\"chmod\"\u003e\n\u003cinput type=\"submit\" value=\"Go\" /\u003e\n\u003c/form\u003e" ], [ 3375, "opt" ], [ 3376, "opt" ], [ 3385, "btw" ], [ 3386, "btw" ], [ 3418, "\u003cform action=\"?option\u0026path=" ], [ 3419, "\u003cform action=\"?option\u0026path=" ], [ 3453, "\u0026opt=delete\u0026type=buat\" method=\"POST\"\u003e\nNew Name : \u003cinput name=\"name\" type=\"text\" size=\"20\" value=\"Folder\" /\u003e\n\u003cinput type=\"hidden\"" ], [ 3454, "\u0026opt=delete\u0026type=buat\" method=\"POST\"\u003e\nNew Name : \u003cinput name=\"name\" type=\"text\" size=\"20\" value=\"Folder\" /\u003e\n\u003cinput type=\"hidden\"" ], [ 3609, "\"\u003e\n\u003cinput type=\"hidden\" name=\"opt\" value=\"delete\"\u003e\n\u003cinput type=\"submit\" value=\"Go\" /\u003e\n\u003c/form\u003e" ], [ 3610, "\u003e\n\u003cinput type=\"hidden\" name=\"opt\" value=\"delete\"\u003e\n\u003cinput type=\"submit\" value=\"Go\" /\u003e\n\u003c/form\u003e" ], [ 3735, "opt" ], [ 3736, "opt" ], [ 3745, "rename" ], [ 3746, "rename" ], [ 3772, "newname" ], [ 3773, "newname" ], [ 3803, "path" ], [ 3804, "path" ], [ 3817, "/" ], [ 3818, "/" ], [ 3828, "newname" ], [ 3829, "newname" ], [ 3847, "\u003cfont color=\"green\"\u003eChange Name Done \u003c/font\u003e\u003cbr /\u003e" ], [ 3848, "\u003cfont color=\"green\"\u003eChange Name Done \u003c/font\u003e\u003cbr /\u003e" ], [ 3913, "\u003cfont color=\"red\"\u003eChange Name Error \u003c/font\u003e\u003cbr /\u003e" ], [ 3914, "\u003cfont color=\"red\"\u003eChange Name Error \u003c/font\u003e\u003cbr /\u003e" ], [ 3975, "name" ], [ 3976, "name" ], [ 3992, "newname" ], [ 3993, "newname" ], [ 4020, "path" ], [ 4021, "path" ], [ 4043, "name" ], [ 4044, "name" ], [ 4060, "$hell/$yeah" ], [ 4066, "/" ], [ 4089, "newname" ], [ 4090, "newname" ], [ 4107, "\u003cform method=\"POST\"\u003e\nNew Name : \u003cinput name=\"newname\" type=\"text\" size=\"20\" value=\"" ], [ 4108, "\u003cform method=\"POST\"\u003e\nNew Name : \u003cinput name=\"newname\" type=\"text\" size=\"20\" value=" ], [ 4198, "\" /\u003e\n\u003cinput type=\"hidden\" name=\"path\" value=\"" ], [ 4199, " /\u003e\n\u003cinput type=\"hidden\" name=\"path\" value=" ], [ 4252, "\"\u003e\n\u003cinput type=\"hidden\" name=\"opt\" value=\"rename\"\u003e\n\u003cinput type=\"submit\" value=\"Go\" /\u003e\n\u003c/form\u003e" ], [ 4253, "\u003e\n\u003cinput type=\"hidden\" name=\"opt\" value=\"rename\"\u003e\n\u003cinput type=\"submit\" value=\"Go\" /\u003e\n\u003c/form\u003e" ], [ 4376, "opt" ], [ 4377, "opt" ], [ 4386, "baru" ], [ 4387, "baru" ], [ 4411, "path" ], [ 4412, "path" ], [ 4434, "name" ], [ 4435, "name" ], [ 4451, "$hell/$yeah" ], [ 4457, "/" ], [ 4480, "newname" ], [ 4481, "newname" ], [ 4506, "path" ], [ 4507, "path" ], [ 4523, "$azz/$new" ], [ 4528, "/" ], [ 4554, "src" ], [ 4555, "src" ], [ 4583, "path" ], [ 4584, "path" ], [ 4591, "w" ], [ 4592, "w" ], [ 4618, "src" ], [ 4619, "src" ], [ 4633, "\u003cfont color=\"green\"\u003eCreate File Done [ " ], [ 4634, "\u003cfont color=\"green\"\u003eCreate File Done [ " ], [ 4680, " ]\u003c/font\u003e\u003cbr /\u003e" ], [ 4681, " ]\u003c/font\u003e\u003cbr /\u003e" ], [ 4711, "\u003cfont color=\"red\"\u003eCreate File Error\u003c/font\u003e\u003cbr /\u003e" ], [ 4712, "\u003cfont color=\"red\"\u003eCreate File Error\u003c/font\u003e\u003cbr /\u003e" ], [ 4786, "\u003cform method=\"POST\"\u003e Name : \u003cinput name=\"ngaran1\" type=\"text\" size=\"20\" value=\"" ], [ 4787, "\u003cform method=\"POST\"\u003e Name : \u003cinput name=\"ngaran1\" type=\"text\" size=\"20\" value=" ], [ 4873, "\" /\u003e\u003cinput type=\"submit\" name=\"ngaran\" value=\"Create\"/\u003e\u003c/form\u003e\u003cbr\u003e " ], [ 4874, " /\u003e\u003cinput type=\"submit\" name=\"ngaran\" value=\"Create\"/\u003e\u003c/form\u003e\u003cbr\u003e " ], [ 4958, "ngaran1" ], [ 4959, "ngaran1" ], [ 4987, "ngaran" ], [ 4988, "ngaran" ], [ 5005, "\u003cform method=\"POST\"\u003e\n\u003ctextarea cols=80 rows=20 name=\"src\"\u003e" ], [ 5006, "\u003cform method=\"POST\"\u003e\n\u003ctextarea cols=80 rows=20 name=\"src\"\u003e" ], [ 5109, "\u003c/textarea\u003e\u003cbr /\u003e\n\u003cinput type=\"hidden\" name=\"path\" value=\"" ], [ 5110, "\u003c/textarea\u003e\u003cbr /\u003e\n\u003cinput type=\"hidden\" name=\"path\" value=" ], [ 5176, "/" ], [ 5177, "/" ], [ 5184, "\"\u003e\n\u003cinput type=\"hidden\" name=\"opt\" value=\"edit\"\u003e\n\u003cinput type=\"submit\" value=\"Go\" /\u003e\n\u003c/form\u003e" ], [ 5185, "\u003e\n\u003cinput type=\"hidden\" name=\"opt\" value=\"edit\"\u003e\n\u003cinput type=\"submit\" value=\"Go\" /\u003e\n\u003c/form\u003e" ], [ 5312, "opt" ], [ 5313, "opt" ], [ 5322, "edit" ], [ 5323, "edit" ], [ 5347, "src" ], [ 5348, "src" ], [ 5376, "path" ], [ 5377, "path" ], [ 5384, "w" ], [ 5385, "w" ], [ 5411, "src" ], [ 5412, "src" ], [ 5426, "\u003cfont color=\"green\"\u003eEdit File Done \u003c/font\u003e\u003cbr /\u003e" ], [ 5427, "\u003cfont color=\"green\"\u003eEdit File Done \u003c/font\u003e\u003cbr /\u003e" ], [ 5490, "\u003cfont color=\"red\"\u003eEdit File Error \u003c/font\u003e\u003cbr /\u003e" ], [ 5491, "\u003cfont color=\"red\"\u003eEdit File Error \u003c/font\u003e\u003cbr /\u003e" ], [ 5572, "path" ], [ 5573, "path" ], [ 5595, "name" ], [ 5596, "name" ], [ 5612, "$hell/$yeah" ], [ 5618, "/" ], [ 5632, "\u003cform method=\"POST\"\u003e\n\u003ctextarea cols=80 rows=20 name=\"src\"\u003e" ], [ 5633, "\u003cform method=\"POST\"\u003e\n\u003ctextarea cols=80 rows=20 name=\"src\"\u003e" ], [ 5736, "\u003c/textarea\u003e\u003cbr /\u003e\n\u003cinput type=\"hidden\" name=\"path\" value=\"" ], [ 5737, "\u003c/textarea\u003e\u003cbr /\u003e\n\u003cinput type=\"hidden\" name=\"path\" value=" ], [ 5803, "\"\u003e\n\u003cinput type=\"hidden\" name=\"opt\" value=\"edit\"\u003e\n\u003cinput type=\"submit\" value=\"Go\" /\u003e\n\u003c/form\u003e" ], [ 5804, "\u003e\n\u003cinput type=\"hidden\" name=\"opt\" value=\"edit\"\u003e\n\u003cinput type=\"submit\" value=\"Go\" /\u003e\n\u003c/form\u003e" ], [ 5905, "\u003c/center\u003e" ], [ 5906, "\u003c/center\u003e" ], [ 5930, "\u003c/table\u003e\u003cbr /\u003e\u003ccenter\u003e" ], [ 5931, "\u003c/table\u003e\u003cbr /\u003e\u003ccenter\u003e" ], [ 5993, "option" ], [ 5994, "option" ], [ 6013, "opt" ], [ 6014, "opt" ], [ 6023, "delete" ], [ 6024, "delete" ], [ 6050, "path" ], [ 6051, "path" ], [ 6073, "name" ], [ 6074, "name" ], [ 6090, "$hell/$yeah" ], [ 6096, "/" ], [ 6128, "type" ], [ 6129, "type" ], [ 6139, "dir" ], [ 6140, "dir" ], [ 6171, "\u003cfont color=\"green\"\u003eDelete File Done\u003c/font\u003e\u003cbr /\u003e" ], [ 6172, "\u003cfont color=\"green\"\u003eDelete File Done\u003c/font\u003e\u003cbr /\u003e" ], [ 6236, "\u003cfont color=\"red#\"\u003eDelete File Error \u003c/font\u003e\u003cbr /\u003e" ], [ 6237, "\u003cfont color=\"red#\"\u003eDelete File Error \u003c/font\u003e\u003cbr /\u003e" ], [ 6317, "type" ], [ 6318, "type" ], [ 6328, "buat" ], [ 6329, "buat" ], [ 6352, "path" ], [ 6353, "path" ], [ 6376, "name" ], [ 6377, "name" ], [ 6393, "$haaa/$heee" ], [ 6399, "/" ], [ 6421, "/" ], [ 6422, "/" ] ], "sz": 12035, "ts": [ { "c": 0.800000011920929, "d": "Writes data to an open file", "e": [ "fwrite" ], "i": "micro-behaviors/fs/write/file/direct::fwrite", "l": 3, "m": "C0052" }, { "a": "T1105", "c": 0.8500000238418579, "d": "File upload access ($_FILES)", "e": [ "$_FILES" ], "i": "micro-behaviors/communications/http/request/params::files", "l": 3 }, { "c": 0.800000011920929, "d": "Detects PHP rename file recreation call", "e": [ "rename" ], "i": "objectives/impact/infect/script::php-rename-call", "l": 1 }, { "c": 0.8999999761581421, "d": "Very long line", "e": [ "text.max_line_length = 1069.00" ], "i": "metadata/file/text/metrics::single-long-line", "l": 1 }, { "c": 0.800000011920929, "d": "URL parameter fetched and executed", "e": [ "fopen($_POST['path'],'w')", "htmlspecialchars(file_get_contents($_GET['filesrc']))", "file_get_contents($_GET['filesrc'])" ], "i": "objectives/command-and-control/backdoor/webshell/fetch::url-param-fetch", "l": 4, "m": "B0030" }, { "a": "T1505.003", "c": 0.9200000166893005, "d": "HTML tag in script body", "e": [ "\u003chtml\u003e" ], "i": "objectives/command-and-control/remote-command/shell::html-tag-present", "l": 1, "m": "B0030" }, { "a": "T1505.003", "c": 0.4000000059604645, "d": "PHP $_GET parameter access", "e": [ "$_GET[" ], "i": "objectives/command-and-control/backdoor/webshell/request::php-get", "l": 1, "m": "B0030" }, { "a": "T1059", "c": 0.8500000238418579, "d": "HTTP GET parameter access ($_GET)", "e": [ "$_GET" ], "i": "micro-behaviors/communications/http/request/params::get-dup", "l": 3 }, { "c": 1.0, "d": "backdoor keyword", "e": [ "Backdoor" ], "i": "micro-behaviors/data/text/malware/terms::backdoor-word", "l": 2 }, { "a": "T1505.003", "c": 0.9399999976158142, "d": "Regex component marker", "e": [ "file_get_contents" ], "i": "objectives/command-and-control/backdoor/webshell/request::raw-json-post-cmd-field--rx-7", "l": 1, "m": "B0030" }, { "a": "T1505.003", "c": 0.949999988079071, "d": "IndoXploit webshell family", "e": [ "INDOXPLOIT" ], "i": "well-known/malware/webshell/family::indoxploit", "l": 4, "m": "B0030" }, { "a": "T1071.001", "c": 0.699999988079071, "d": "HTTP POST method", "e": [ "\"POST\"" ], "i": "micro-behaviors/communications/http/post::post", "l": 1, "m": "C0002" }, { "c": 1.0, "d": "PHP unlink function symbol", "e": [ "unlink" ], "i": "micro-behaviors/fs/delete/file::php-unlink", "l": 3 }, { "c": 0.949999988079071, "d": "Disables error reporting (error_reporting(0))", "e": [ "error_reporting(0)" ], "i": "micro-behaviors/os/stdio::error-reporting-off", "l": 3 }, { "c": 0.8500000238418579, "d": "Removes PHP script execution time limit", "e": [ "set_time_limit(0)" ], "i": "objectives/command-and-control/backdoor/webshell/session::unlimited-runtime-call", "l": 4 }, { "c": 0.800000011920929, "d": "Detects PHP copy file recreation call", "e": [ "copy" ], "i": "objectives/impact/infect/script::php-copy-call", "l": 1 }, { "a": "T1083", "c": 1.0, "d": "Iterate directory contents via functions in PHP", "e": [ "scandir(" ], "i": "micro-behaviors/fs/directory/traverse::php-dir-traverse-fn", "l": 2 }, { "c": 0.8199999928474426, "d": "Detects overwrite-mode file open", "e": [ "fopen($_POST['path'],'w'" ], "i": "objectives/impact/infect/script::php-overwrite-file-mode", "l": 1 }, { "a": "T1059", "c": 0.8500000238418579, "d": "HTTP POST parameter access ($_POST)", "e": [ "$_POST" ], "i": "micro-behaviors/communications/http/request/params::post-dup", "l": 3 }, { "a": "T1505.003", "d": "PHP open tag", "e": [ "\u003c?php" ], "i": "objectives/command-and-control/backdoor/webshell/request::php-tag", "l": 1, "m": "B0030" }, { "a": "T1027", "c": 0.8999999761581421, "d": "Exactly one line exceeds 1000 chars", "e": [ "text.lines_over_1000 = 1.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::single-long-line-outlier", "l": 1, "m": "B0032" }, { "a": "T1505.003", "c": 0.4000000059604645, "d": "PHP $_POST parameter access", "e": [ "$_POST[" ], "i": "objectives/command-and-control/backdoor/webshell/request::php-post", "l": 1, "m": "B0030" }, { "a": "T1505.003", "c": 0.8500000238418579, "d": "PHP request superglobal access", "e": [ "$_POST" ], "i": "objectives/command-and-control/backdoor/webshell/upload::php-request-variadic-function-call", "l": 3, "m": "B0030" }, { "a": "T1222", "c": 0.699999988079071, "d": "Changes file permissions via chmod()", "e": [ "chmod" ], "i": "micro-behaviors/fs/chmod/modify::chmod-call", "l": 3 }, { "c": 0.7599999904632568, "d": "Regex component marker", "e": [ "directory" ], "i": "micro-behaviors/data/text/llm/action::llm-path-navigation-action--rx-21", "l": 1 }, { "a": "T1546", "c": 1.0, "d": "Writes data to a file via functions", "e": [ "fopen(" ], "i": "micro-behaviors/fs/file/write/direct::php-file-write-func", "l": 2 }, { "a": "T1505.003", "c": 0.8999999761581421, "d": "Single-file admin shell metrics", "e": [ "miniv48.php" ], "i": "well-known/malware/webshell/zaco::single-file-webshell-metrics", "l": 3, "m": "B0030" }, { "a": "T1505.003", "c": 0.8600000143051147, "d": "Very long embedded string", "e": [ "strings.max_length = 1101.00" ], "i": "objectives/command-and-control/backdoor/webshell/stager::very-long-string", "l": 1 }, { "a": "T1485", "c": 0.8500000238418579, "d": "Targets source code directory", "e": [ "\"src\"" ], "i": "objectives/impact/wipe/disk/mass-delete::target-src", "l": 1 }, { "c": 1.0, "d": "PHP scandir function symbol", "e": [ "scandir" ], "i": "micro-behaviors/fs/enumerate/directory::php-scandir", "l": 3 }, { "c": 0.8999999761581421, "d": "File has 30 or more lines", "e": [ "text.total_lines = 380.00" ], "i": "metadata/file/text/metrics::file-has-30-plus-lines", "l": 1 }, { "c": 0.8600000143051147, "d": "Regex component marker", "e": [ "method=" ], "i": "objectives/command-and-control/backdoor/webshell/ui::self-named-get-form--rx-3", "l": 1, "m": "B0030" }, { "a": "T1505.003", "c": 1.0, "d": "Inequality check in WordPress user list", "e": [ "!=" ], "i": "objectives/command-and-control/backdoor/webshell/hide::wp-user-hiding-not-trait", "l": 1, "m": "B0030" }, { "c": 0.6000000238418579, "d": "Generates HTML tags", "e": [ "\u003chtml" ], "i": "micro-behaviors/data/format/html::html-generator-tags", "l": 3 }, { "c": 0.8399999737739563, "d": "Regex component marker", "e": [ "\u003c/center\u003e\u003ccenter\u003e\u003cform enctype=\"multipart/form-data\" method=\"POST\"\u003e\u003cfont color=\"black\"\u003e\u003cinput style=\"background:silver;font-fami", "\u003cfont color=\"red\"\u003eUpload Failed !!\u003c/font\u003e\u003cbr /\u003e", "\u003cfont color=\"green\"\u003eFile Upload\u003c/font\u003e\u003cbr /\u003e" ], "i": "micro-behaviors/data/text/llm/action::llm-send-action--rx-11", "l": 1 }, { "c": 0.699999988079071, "d": "base64 encoding keyword", "e": [ "base64" ], "i": "micro-behaviors/data/text/encoded::base64-token", "l": 3 }, { "c": 1.0, "d": "PHP rmdir function symbol", "e": [ "rmdir" ], "i": "micro-behaviors/fs/delete/directory::php-rmdir", "l": 3 }, { "a": "T1071.001", "c": 0.6000000238418579, "d": "enctype attribute", "e": [ "enctype=" ], "i": "micro-behaviors/communications/http/post::enctype-attr", "l": 3, "m": "C0002" }, { "c": 0.699999988079071, "d": "AJAX request handler pattern", "e": [ "$_POST['path']", "$_GET['filesrc']", "$_GET['path']", "$_GET['option']", "$_POST[$key]", "$_POST['perm']", "$_GET['opt']", "$_GET['name']" ], "i": "objectives/command-and-control/backdoor/webshell/ui::ajax-handler", "l": 4, "m": "B0030" }, { "c": 0.6000000238418579, "d": "Very long base64 strings present", "e": [ "iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAAAXNSR0IArs4c6QAAAAZiS0dEAP8A/wD/oL2nkwAAAAlwSFlzAAALEwAACxMBAJqcGAAAAAd0SU1FB9oJ" ], "i": "objectives/anti-static/obfuscation/string/base64::long-base64-in-strings", "l": 3 }, { "c": 0.699999988079071, "d": "Remove execution time limit", "e": [ "set_time_limit" ], "i": "micro-behaviors/process/control/signal::set-time-limit", "l": 3 }, { "a": "T1027", "c": 0.699999988079071, "d": "Very low whitespace ratio (minified/compressed)", "e": [ "text.whitespace_ratio = 0.10" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::low-whitespace", "l": 2, "m": "B0032" }, { "a": "T1071.001", "c": 0.6000000238418579, "d": "multipart/form-data content type", "e": [ "multipart/form-data" ], "i": "micro-behaviors/communications/http/post::multipart-form", "l": 1, "m": "C0002" }, { "a": "T1070.004", "c": 1.0, "d": "Recursive directory cleanup in PHP", "e": [ "scandir", "unlink", "rmdir" ], "i": "objectives/evasion/self-delete/scripts::php-recursive-delete", "l": 4 }, { "a": "T1566.002", "c": 0.8500000238418579, "d": "PHP script writing POST data to local file", "e": [ "$_POST" ], "i": "objectives/credential-access/phishing/tactics::php-credential-exfiltration", "l": 4, "m": "B0030" }, { "c": 0.8999999761581421, "d": "Looks like a webshell cloaked as GIF", "e": [ "input type" ], "i": "third_party/SigBase/Gifcloaked/Webshell/A", "l": 5 }, { "c": 0.8999999761581421, "d": "Webshell in GIF, PNG or JPG", "e": [ "\u003c?php", "fopen(", "\u003c?", "fwrite(", "GIF8" ], "i": "third_party/SigBase/WEBSHELL/In/Image", "l": 5 } ], "sha": "df5d6cfbe6873eaf4c24c41de42b43ab2d93d484ed49e903395f2fc1581ba12c", "path": "/data/samples/bad/datasets/awesome-malware/PHP/miniv48.php", "type": "php" } ], "tv": "a9555" } }