{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9998946189880371, "class": 2 } ], "prob": 0.9998946, "class": 2, "models": [ { "m": "az", "prob": 0.9847413, "class": 0 }, { "m": "az/scripts", "prob": 0.9997298, "class": 2 }, { "m": "az/php", "prob": 0.9998946, "class": 2 } ], "version": "v16.16", "thresholds": [ 0.9961138, 0.99909174 ], "analyzed_at": "2026-05-09T05:12:53Z" }, "path": "pass.php", "raw": { "v": "4", "fs": [ { "f": "O₄(As₂C₇CaLa)H₅(Cm₄Db₄FOsPo)Md₂", "k": { "source.imports[0]": "Info", "source.imports[1]": "base64_decode", "source.imports[2]": "curl_close", "source.imports[3]": "curl_errno", "source.imports[4]": "curl_exec", "source.imports[5]": "curl_init", "source.imports[6]": "curl_setopt", "source.imports[7]": "date", "source.imports[8]": "empty", "source.imports[9]": "fclose", "source.strings[0]": " - 200", "source.strings[1]": " alt=\"\" class=\"center\" height=\"50px\" width=\"50px\"\u003e\u003cbr\u003e", "source.strings[2]": " | Email: ", "source.strings[3]": " | IP: ", "source.strings[4]": " | Pass: ", "source.strings[5]": " | Pass: {$_POST['password_akhir']} | IP: {$_SERVER['REMOTE_ADDR']}", "source.strings[6]": " | Pass: {$_POST['password_awal']} | IP: {$_SERVER['REMOTE_ADDR']}", "source.strings[7]": "\" alt=\"\" class=\"center\" height=\"50px\" width=\"50px\"\u003e\u003cbr\u003e", "source.strings[8]": "\";\u003c/script\u003e", "source.strings[9]": ".++----------------------==-[ OFFICE LOGIN ]---------------------------++.", "source.has_imports": true, "source.imports[10]": "fopen", "source.imports[11]": "fwrite", "source.imports[12]": "isset", "source.imports[13]": "logger", "source.imports[14]": "mail", "source.imports[15]": "session_destroy", "source.imports[16]": "session_start", "source.imports[17]": "strlen", "source.imports[18]": "strrchr", "source.imports[19]": "substr", "source.imports[20]": "trim", "source.strings[10]": ".++----------------------==-[ OFFICE LOGIN ]---------------------------++.\\n", "source.strings[11]": ".++----------------------==-[ W3LL STORE ]---------------------------++.", "source.strings[12]": ".++----------------------==-[ W3LL STORE ]---------------------------++.\\n", "source.strings[13]": ";\u003c/script\u003e", "source.strings[14]": "\u003cimg src=\"assets/images/logo.svg\"\u003e\u003cbr\u003e", "source.strings[15]": "\u003cimg src=\"https://logo.clearbit.com/", "source.strings[16]": "\u003cscript\u003ewindow.location = \"another.php\";\u003c/script\u003e", "source.strings[17]": "\u003cscript\u003ewindow.location = \"login.php?cngmail=", "source.strings[18]": "Email\t\t: ", "source.strings[19]": "HTTP_HOST", "source.strings[20]": "Host\t\t\t: ", "source.strings[21]": "Host: | ", "source.strings[22]": "Host: | {$_SERVER['HTTP_HOST']} | Email: ", "source.strings[23]": "IP Address\t\t: ", "source.strings[24]": "Office Login", "source.strings[25]": "Office Login 2", "source.strings[26]": "Password\t\t: ", "source.strings[27]": "REMOTE_ADDR", "source.strings[28]": "REQUEST_URI", "source.strings[29]": "Upgrade-Insecure-Requests: 1", "source.strings[30]": "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.100 Safari/537.36", "source.strings[31]": "[PASSWORD] ", "source.strings[32]": "[PASSWORD] {$_SERVER['REQUEST_URI']} - 200", "source.strings[33]": "[VISIT] ", "source.strings[34]": "[VISIT] {$_SERVER['REQUEST_URI']} - 200", "source.strings[35]": "cngmail", "source.strings[36]": "config/config.php", "source.strings[37]": "core/blocker.php", "source.strings[38]": "core/functions.php", "source.strings[39]": "gzip, deflate", "source.strings[40]": "https://logo.clearbit.com/", "source.strings[41]": "https://logo.clearbit.com/$domain", "source.strings[42]": "location.hash = 'wa=wsignin1.0\u0026rpsnv=13\u0026ct=1539585327\u0026rver=7.0.6737.0\u0026wp=MBI_SSL\u0026wreply=https://outlook.live.com/owa/?nlp=1\u0026RpsCsrfState=715d44a2-2f11-4282-f625-a066679e96e2\u0026id=292841\u0026CBCXT=out\u0026lw=1\u0026fl=dob,flname,wld\u0026cobrandid=90015';", "source.strings[43]": "password_akhir", "source.strings[44]": "password_awal", "source.strings[45]": "result/info-login.txt", "source.functions[0]": "Info" }, "x": 144, "id": 0, "is": [ "session_start", "base64_decode", "substr", "strrchr", "logger", "empty", "isset", "isset", "session_destroy", "isset", "logger", "mail", "base64_decode", "Info", "base64_decode", "fclose", "fwrite", "fopen", "isset", "logger", "mail", "base64_decode", "Info", "base64_decode", "fclose", "fwrite", "fopen", "curl_init", "curl_setopt", "curl_setopt", "curl_setopt", "curl_setopt", "curl_setopt", "curl_exec", "strlen", "trim", "curl_errno", "curl_close", "base64_decode", "date" ], "ms": { "file": { "size": 8206.0 }, "text": { "tab_count": 217.0, "digit_ratio": 0.17, "space_count": 1488.0, "total_lines": 202.0, "char_entropy": 5.4, "mixed_indent": true, "unique_chars": 94.0, "import_density": 19.8, "lines_over_200": 2.0, "lines_over_500": 1.0, "string_density": 0.67, "avg_line_length": 39.62, "high_byte_ratio": 0.0, "max_line_length": 509.0, "non_ascii_ratio": 0.0, "empty_line_ratio": 0.13, "last_line_length": 7.0, "long_token_count": 1.0, "most_common_char": "1", "whitespace_ratio": 0.23, "most_common_ratio": 0.04, "identifier_density": 0.57, "line_length_stddev": 51.81, "normalized_import_count": 2.81, "normalized_string_count": 9.5, "repeated_char_sequences": 53.0, "suspicious_string_ratio": 0.03, "suspicious_comment_ratio": 0.2, "max_inline_whitespace_run": 4.0, "normalized_function_count": 0.07, "trailing_whitespace_lines": 10.0, "imports_to_functions_ratio": 40.0, "strings_to_functions_ratio": 135.0, "normalized_unique_identifiers": 5.22, "identifiers_to_functions_ratio": 40.0 }, "imports": { "total": 40.0, "unique_modules": 21.0, "third_party_count": 40.0, "third_party_ratio": 1.0 }, "strings": { "total": 135.0, "url_count": 2.0, "avg_length": 18.01, "max_length": 127.0, "avg_entropy": 2.83, "total_bytes": 2431.0, "entropy_stddev": 1.09, "high_entropy_count": 2.0, "embedded_code_candidates": 4.0 }, "comments": { "chars": 339.0, "lines": 13.0, "total": 10.0, "to_code_ratio": 0.07, "high_entropy_comments": 2.0 }, "functions": { "total": 1.0, "avg_name_length": 4.0, "no_params_count": 1.0, "avg_length_lines": 11.0, "max_length_lines": 11.0, "min_length_lines": 11.0, "density_per_100_lines": 0.5, "code_in_functions_ratio": 0.05 }, "identifiers": { "total": 116.0, "avg_length": 7.95, "max_length": 22.0, "min_length": 2.0, "avg_entropy": 2.46, "reuse_ratio": 0.34, "unique_count": 40.0, "length_stddev": 4.82, "has_digit_ratio": 0.03, "high_entropy_count": 1.0, "high_entropy_ratio": 0.03, "all_lowercase_ratio": 0.73, "all_uppercase_ratio": 0.22, "underscore_prefix_count": 4.0 } }, "ss": [ [ 31, "core/functions.php" ], [ 32, "core/functions.php" ], [ 61, "core/blocker.php" ], [ 62, "core/blocker.php" ], [ 90, "config/config.php" ], [ 91, "config/config.php" ], [ 144, "email" ], [ 145, "email" ], [ 187, "@" ], [ 188, "@" ], [ 204, "[VISIT] {$_SERVER['REQUEST_URI']} - 200" ], [ 205, "[VISIT] " ], [ 223, "REQUEST_URI" ], [ 224, "REQUEST_URI" ], [ 238, " - 200" ], [ 431, "email" ], [ 432, "email" ], [ 463, "email" ], [ 464, "email" ], [ 494, "email" ], [ 495, "email" ], [ 511, "email" ], [ 512, "email" ], [ 547, "\u003cscript\u003ewindow.location = \"another.php\";\u003c/script\u003e" ], [ 548, "\u003cscript\u003ewindow.location = \"another.php\";\u003c/script\u003e" ], [ 640, "cngmail" ], [ 641, "cngmail" ], [ 687, "\u003cscript\u003ewindow.location = \"login.php?cngmail=" ], [ 688, "\u003cscript\u003ewindow.location = \"login.php?cngmail=" ], [ 745, "email" ], [ 746, "email" ], [ 754, "\";\u003c/script\u003e" ], [ 755, ";\u003c/script\u003e" ], [ 887, ".++----------------------==-[ OFFICE LOGIN ]---------------------------++.\\n" ], [ 888, ".++----------------------==-[ OFFICE LOGIN ]---------------------------++." ], [ 980, "Email\t\t: " ], [ 981, "Email\t\t: " ], [ 998, "\\n" ], [ 1017, "Password\t\t: " ], [ 1018, "Password\t\t: " ], [ 1038, "\\n" ], [ 1057, "Host\t\t\t: " ], [ 1058, "Host\t\t\t: " ], [ 1078, "HTTP_HOST" ], [ 1079, "HTTP_HOST" ], [ 1091, "\\n" ], [ 1110, "IP Address\t\t: " ], [ 1111, "IP Address\t\t: " ], [ 1136, "REMOTE_ADDR" ], [ 1137, "REMOTE_ADDR" ], [ 1151, "\\n" ], [ 1170, ".++----------------------==-[ W3LL STORE ]---------------------------++.\\n" ], [ 1171, ".++----------------------==-[ W3LL STORE ]---------------------------++." ], [ 1285, "password_awal" ], [ 1286, "password_awal" ], [ 1317, "[PASSWORD] {$_SERVER['REQUEST_URI']} - 200" ], [ 1318, "[PASSWORD] " ], [ 1339, "REQUEST_URI" ], [ 1340, "REQUEST_URI" ], [ 1354, " - 200" ], [ 1378, "Office Login" ], [ 1379, "Office Login" ], [ 1394, "Host: | {$_SERVER['HTTP_HOST']} | Email: " ], [ 1395, "Host: | " ], [ 1413, "HTTP_HOST" ], [ 1414, "HTTP_HOST" ], [ 1426, " | Email: " ], [ 1462, "email" ], [ 1463, "email" ], [ 1472, " | Pass: {$_POST['password_awal']} | IP: {$_SERVER['REMOTE_ADDR']}" ], [ 1473, " | Pass: " ], [ 1490, "password_awal" ], [ 1491, "password_awal" ], [ 1507, " | IP: " ], [ 1524, "REMOTE_ADDR" ], [ 1525, "REMOTE_ADDR" ], [ 1609, "email" ], [ 1610, "email" ], [ 1626, "password_awal" ], [ 1627, "password_awal" ], [ 1670, "result/info-login.txt" ], [ 1671, "result/info-login.txt" ], [ 1695, "a" ], [ 1696, "a" ], [ 1800, "password_akhir" ], [ 1801, "password_akhir" ], [ 1833, "[PASSWORD] {$_SERVER['REQUEST_URI']} - 200" ], [ 1834, "[PASSWORD] " ], [ 1855, "REQUEST_URI" ], [ 1856, "REQUEST_URI" ], [ 1870, " - 200" ], [ 1894, "Office Login 2" ], [ 1895, "Office Login 2" ], [ 1912, "Host: | {$_SERVER['HTTP_HOST']} | Email: " ], [ 1913, "Host: | " ], [ 1931, "HTTP_HOST" ], [ 1932, "HTTP_HOST" ], [ 1944, " | Email: " ], [ 1980, "email" ], [ 1981, "email" ], [ 1990, " | Pass: {$_POST['password_akhir']} | IP: {$_SERVER['REMOTE_ADDR']}" ], [ 1991, " | Pass: " ], [ 2008, "password_akhir" ], [ 2009, "password_akhir" ], [ 2026, " | IP: " ], [ 2043, "REMOTE_ADDR" ], [ 2044, "REMOTE_ADDR" ], [ 2128, "email" ], [ 2129, "email" ], [ 2145, "password_akhir" ], [ 2146, "password_akhir" ], [ 2190, "result/info-login.txt" ], [ 2191, "result/info-login.txt" ], [ 2215, "a" ], [ 2216, "a" ], [ 3383, "https://logo.clearbit.com/$domain" ], [ 3384, "https://logo.clearbit.com/" ], [ 3518, "GET" ], [ 3519, "GET" ], [ 3568, "gzip, deflate" ], [ 3569, "gzip, deflate" ], [ 3632, "Upgrade-Insecure-Requests: 1" ], [ 3633, "Upgrade-Insecure-Requests: 1" ], [ 3683, "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.100 Safari/537.36" ], [ 3684, "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.100 Safari/537.36" ], [ 4120, "\u003cimg src=\"assets/images/logo.svg\"\u003e\u003cbr\u003e" ], [ 4121, "\u003cimg src=\"assets/images/logo.svg\"\u003e\u003cbr\u003e" ], [ 4201, "\u003cimg src=\"https://logo.clearbit.com/" ], [ 4202, "\u003cimg src=\"https://logo.clearbit.com/" ], [ 4248, "\" alt=\"\" class=\"center\" height=\"50px\" width=\"50px\"\u003e\u003cbr\u003e" ], [ 4249, " alt=\"\" class=\"center\" height=\"50px\" width=\"50px\"\u003e\u003cbr\u003e" ], [ 4446, "email" ], [ 4447, "email" ], [ 6322, "Y" ], [ 6323, "Y" ], [ 6405, "url", "location.hash = 'wa=wsignin1.0\u0026rpsnv=13\u0026ct=1539585327\u0026rver=7.0.6737.0\u0026wp=MBI_SSL\u0026wreply=https://outlook.live.com/owa/?nlp=1\u0026RpsC" ] ], "sz": 8206, "ts": [ { "c": 0.8399999737739563, "d": "Regex component marker", "e": [ "password_awal", "Password\t\t: ", "[PASSWORD] {$_SERVER['REQUEST_URI']} - 200", "password_akhir", "[PASSWORD] ", " | Pass: {$_POST['password_akhir']} | IP: {$_SERVER['REMOTE_ADDR']}", " | Pass: {$_POST['password_awal']} | IP: {$_SERVER['REMOTE_ADDR']}" ], "i": "micro-behaviors/data/text/llm/action::llm-send-action--rx-6", "l": 1 }, { "a": "T1059", "c": 0.8500000238418579, "d": "HTTP GET parameter access ($_GET)", "e": [ "$_GET" ], "i": "micro-behaviors/communications/http/request/params::get-dup", "l": 3 }, { "c": 0.800000011920929, "d": "Writes data to an open file", "e": [ "fwrite" ], "i": "micro-behaviors/fs/write/file/direct::fwrite", "l": 3, "m": "C0052" }, { "a": "T1505.003", "c": 0.8999999761581421, "d": "PHP source imports base64_decode", "e": [ "[Info, base64_decode, curl_close, curl_errno, curl_exec, curl_init, curl_setopt, date, empty, fclose, fopen, fwrite, isset, logg" ], "i": "objectives/command-and-control/backdoor/webshell/stager::source-import-base64-decode", "l": 1 }, { "c": 0.8600000143051147, "d": "Regex component marker", "e": [ "method=" ], "i": "objectives/command-and-control/backdoor/webshell/ui::self-named-get-form--rx-3", "l": 1, "m": "B0030" }, { "c": 0.8999999761581421, "d": "Very long line", "e": [ "text.max_line_length = 509.00" ], "i": "metadata/file/text/metrics::single-long-line", "l": 1 }, { "a": "T1027", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "HOST" ], "i": "objectives/anti-static/obfuscation/payload/config::url-component-concat--rx-12", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "Generates HTML content (DOCTYPE)", "e": [ "\u003c!DOCTYPE html\u003e" ], "i": "micro-behaviors/data/format/html::html-generator-doctype", "l": 2 }, { "a": "T1071.001", "c": 0.699999988079071, "d": "HTTP POST method", "e": [ "\"POST\"" ], "i": "micro-behaviors/communications/http/post::post", "l": 1, "m": "C0002" }, { "a": "T1584", "c": 1.0, "d": "PHP dynamic curl_exec call from lookup table", "e": [ "curl_exec(" ], "i": "objectives/command-and-control/dropper/delivery/seo-spam::php-dynamic-curl-exec", "l": 2 }, { "c": 0.8399999737739563, "d": "Regex component marker", "e": [ "store" ], "i": "micro-behaviors/data/text/llm/action::llm-send-action-cond-6--inline-11769", "l": 1 }, { "a": "T1048", "c": 0.8500000238418579, "d": "Mail call includes HTTP_HOST", "e": [ "mail", "\"Host: | {$_SERVER['HTTP_HOST']} | Email: \".base64_decode($_SESSION['email']).\" | Pass: {$_POST['pas..." ], "i": "micro-behaviors/communications/email/send/mail-func::mail-with-http-host", "l": 4 }, { "c": 0.8999999761581421, "d": "File has 30 or more lines", "e": [ "text.total_lines = 202.00" ], "i": "metadata/file/text/metrics::file-has-30-plus-lines", "l": 1 }, { "c": 0.699999988079071, "d": "Mozilla/5.0 User-Agent prefix", "e": [ "Mozilla/5.0 (" ], "i": "micro-behaviors/communications/http/user-agent::browser-mozilla-5-0", "l": 3 }, { "c": 0.8399999737739563, "d": "Regex component marker", "e": [ " | Pass: {$_POST['password_awal']} | IP: {$_SERVER['REMOTE_ADDR']}", "[PASSWORD] {$_SERVER['REQUEST_URI']} - 200", "Password\t\t: ", "password_awal", "[PASSWORD] ", "password_akhir", " | Pass: {$_POST['password_akhir']} | IP: {$_SERVER['REMOTE_ADDR']}" ], "i": "micro-behaviors/data/text/llm/action::llm-send-action-cond-4--inline-11750", "l": 1 }, { "c": 0.6000000238418579, "d": "Generates HTML tags", "e": [ "\u003chtml" ], "i": "micro-behaviors/data/format/html::html-generator-tags", "l": 3 }, { "a": "T1059", "c": 0.8500000238418579, "d": "HTTP POST parameter access ($_POST)", "e": [ "$_POST" ], "i": "micro-behaviors/communications/http/request/params::post-dup", "l": 3 }, { "a": "T1546", "c": 1.0, "d": "Writes data to a file via functions", "e": [ "fwrite(" ], "i": "micro-behaviors/fs/file/write/direct::php-file-write-func", "l": 2 }, { "c": 1.0, "d": "PHP mail() function call", "e": [ "mail" ], "i": "micro-behaviors/process/create/exec::php-mail", "l": 3 }, { "d": "password keyword", "e": [ "password" ], "i": "micro-behaviors/data/text/keywords/lexicon::password", "l": 1 }, { "c": 0.6000000238418579, "d": "JSON encoding for data output", "e": [ "json_encode" ], "i": "micro-behaviors/data/serialize/object::json-encode", "l": 2 }, { "c": 0.8399999737739563, "d": "password/token/api_key field keyword", "e": [ "password" ], "i": "micro-behaviors/data/text/keywords/credential::credential-field", "l": 1 }, { "c": 0.699999988079071, "d": "PHP error suppression operator usage", "e": [ "@fclose(@fwrite(@fopen(\"result/info-login.txt\", \"a\"),$message))", "@fwrite(@fopen(\"result/info-login.txt\", \"a\"),$message)", "@fopen(\"result/info-login.txt\", \"a\")" ], "i": "micro-behaviors/os/stdio::error-suppress-prefix", "l": 3 }, { "a": "T1048", "c": 0.8500000238418579, "d": "Mail call includes REMOTE_ADDR", "e": [ "mail", "\"Host: | {$_SERVER['HTTP_HOST']} | Email: \".base64_decode($_SESSION['email']).\" | Pass: {$_POST['pas..." ], "i": "micro-behaviors/communications/email/send/mail-func::mail-with-remote-addr", "l": 4 }, { "c": 0.75, "d": "Session variable access ($_SESSION)", "e": [ "$_SESSION" ], "i": "micro-behaviors/communications/http/request/params::session", "l": 3 }, { "a": "T1071.001", "d": "User-Agent header", "e": [ "User-Agent:" ], "i": "micro-behaviors/communications/http/request/client::user-agent-header", "l": 2, "m": "C0002" }, { "c": 0.75, "d": "Generic $_SERVER superglobal access", "e": [ "$_SERVER" ], "i": "micro-behaviors/communications/http/request/params::server-dup", "l": 3 }, { "c": 0.8999999761581421, "d": "HTTPS protocol prefix", "e": [ "https://" ], "i": "micro-behaviors/communications/http/protocol::https-prefix", "l": 2 }, { "c": 0.8600000143051147, "d": "Regex component marker", "e": [ "$_SERVER[" ], "i": "objectives/command-and-control/backdoor/webshell/ui::self-named-get-form--rx-4", "l": 1, "m": "B0030" }, { "a": "T1027", "c": 0.8999999761581421, "d": "Dense base64_decode calls", "e": [ "base64_decode" ], "i": "objectives/anti-static/obfuscation/string/encoding::dense-base64-decode", "l": 4, "m": "B0032" }, { "a": "T1505.003", "d": "PHP open tag", "e": [ "\u003c?php" ], "i": "objectives/command-and-control/backdoor/webshell/request::php-tag", "l": 1, "m": "B0030" }, { "c": 0.699999988079071, "d": "Domain tracking field", "e": [ "domain =" ], "i": "objectives/command-and-control/infrastructure/tracking::domain-field", "l": 1 }, { "a": "T1505.003", "c": 0.4000000059604645, "d": "PHP $_POST parameter access", "e": [ "$_POST[" ], "i": "objectives/command-and-control/backdoor/webshell/request::php-post", "l": 1, "m": "B0030" }, { "a": "T1505.003", "c": 0.8500000238418579, "d": "PHP request superglobal access", "e": [ "$_POST" ], "i": "objectives/command-and-control/backdoor/webshell/upload::php-request-variadic-function-call", "l": 3, "m": "B0030" }, { "a": "T1566.002", "c": 0.8999999761581421, "d": "PHP writes Pass label for credentials", "e": [ " | Pass: ", " | Pass: {$_POST['password_akhir']} | IP: {$_SERVER['REMOTE_ADDR']}", " | Pass: {$_POST['password_awal']} | IP: {$_SERVER['REMOTE_ADDR']}" ], "i": "objectives/credential-access/phishing/tactics::php-credential-label-pass", "l": 1, "m": "B0030" }, { "a": "T1505.003", "c": 0.4000000059604645, "d": "PHP $_GET parameter access", "e": [ "$_GET[" ], "i": "objectives/command-and-control/backdoor/webshell/request::php-get", "l": 1, "m": "B0030" }, { "c": 1.0, "d": ".js extension", "e": [ "\"assets/js/jquery.min.js\"" ], "i": "objectives/command-and-control/dropper/builder::js-ext", "l": 1 }, { "a": "T1505.003", "c": 0.8500000238418579, "d": "HTML password form in PHP", "e": [ "\u003cinput type=\"password\"" ], "i": "objectives/command-and-control/backdoor/webshell/auth::password-form", "l": 4, "m": "B0030" }, { "a": "T1082", "c": 0.6000000238418579, "d": "Windows platform detection marker", "e": [ "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.100 Safari/537.36" ], "i": "objectives/discovery/system/fingerprint/os::os-check-windows", "l": 2, "m": "B0012" }, { "c": 0.75, "d": "Inline password token in lure", "e": [ "password\" class=\"form-control\"" ], "i": "objectives/lateral-movement/social-engineering/lures::inline-password-token", "l": 1 }, { "c": 0.699999988079071, "d": "AJAX request handler pattern", "e": [ "$_GET['cngmail']", "$_POST['password_awal']", "$_POST['password_akhir']", "$_GET['email']" ], "i": "objectives/command-and-control/backdoor/webshell/ui::ajax-handler", "l": 4, "m": "B0030" }, { "a": "T1566.002", "c": 0.8500000238418579, "d": "PHP script writing POST data to local file", "e": [ "fwrite(", "$_POST" ], "i": "objectives/credential-access/phishing/tactics::php-credential-exfiltration", "l": 4, "m": "B0030" }, { "c": 0.8999999761581421, "d": "Encoded payload detected: url", "e": [ "location.hash = 'wa=wsignin1.0\u0026rpsnv=13\u0026 \u003curl\u003e" ], "i": "metadata/encoded-payload/url", "l": 3 } ], "sha": "e1090aed6b17a42ce2f5b43845e72ec247cf943812be5464c1c121901125c3ff", "path": "pass.php", "type": "php" } ], "tv": "a9555" } }