{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 0.9906377792358398,
        "class": 2
      }
    ],
    "prob": 0.9906378,
    "class": 2,
    "models": [
      {
        "m": "az",
        "prob": 0.8478576,
        "class": 0
      },
      {
        "m": "az/scripts",
        "prob": 0.9906378,
        "class": 2
      },
      {
        "m": "az/perl",
        "prob": 0.8165486,
        "class": 2
      }
    ],
    "version": "v16.16",
    "thresholds": [
      0.9961138,
      0.99909174
    ],
    "analyzed_at": "2026-05-09T03:40:34Z"
  },
  "path": "bp.pl",
  "raw": {
    "v": "4",
    "fs": [
      {
        "f": "O₂(CEr)H₃(Cm₂FPo)Md₂(Pt)",
        "k": {
          "source.shebang": "/usr/bin/perl",
          "source.strings[0]": "                    $o",
          "source.strings[1]": "                  $o",
          "source.strings[2]": "             $o",
          "source.strings[3]": "            $o",
          "source.strings[4]": "           $o",
          "source.strings[5]": "      Error: ",
          "source.strings[6]": "$l      OK! I'm accept connection.$l",
          "source.strings[7]": "$l$e$!$l",
          "source.strings[8]": "$l\\r\\n",
          "source.strings[9]": "----   Hello from S.A.P. Bind Port   ----",
          "source.strings[10]": "/bin/sh -i",
          "source.strings[11]": "\u003c\u0026CONN",
          "source.strings[12]": "\u003e\u0026CONN",
          "source.strings[13]": "Error: ",
          "source.strings[14]": "IGNORE",
          "source.strings[15]": "\\r\\n$h\\r\\n\\r\\n",
          "source.strings[16]": "\\r\\n-----------------------------------------\\r\\n",
          "source.strings[17]": "\\r\\n\u003e Accept connection...",
          "source.strings[18]": "\\r\\n\u003e Bind socket...",
          "source.strings[19]": "\\r\\n\u003e Create socket...",
          "source.strings[20]": "\\r\\n\u003e Get protocol by name...",
          "source.strings[21]": "\\r\\n\u003e Listen socket...",
          "source.strings[22]": "\\r\\n\u003e Packed address info...",
          "source.strings[23]": "\\r\\n\u003e Set socket options...",
          "source.strings[24]": "\\r\\n\u003e Start...",
          "source.strings[25]": "unset HISTFILE; unset SAVEHIST;"
        },
        "x": 75,
        "id": 0,
        "ms": {
          "file": {
            "size": 1326.0
          },
          "text": {
            "tab_count": 8.0,
            "digit_ratio": 0.01,
            "space_count": 205.0,
            "total_lines": 41.0,
            "char_entropy": 5.13,
            "unique_chars": 72.0,
            "string_density": 1.76,
            "ascii_art_lines": 1.0,
            "avg_line_length": 31.34,
            "max_line_length": 72.0,
            "last_line_length": 1.0,
            "most_common_char": "\"",
            "whitespace_ratio": 0.19,
            "most_common_ratio": 0.05,
            "line_length_stddev": 15.14,
            "normalized_string_count": 11.24,
            "repeated_char_sequences": 7.0,
            "suspicious_string_ratio": 0.06,
            "max_inline_whitespace_run": 20.0
          },
          "strings": {
            "total": 72.0,
            "avg_length": 14.85,
            "max_length": 49.0,
            "path_count": 2.0,
            "avg_entropy": 2.3,
            "sql_strings": 2.0,
            "total_bytes": 1069.0,
            "entropy_stddev": 1.06,
            "shell_command_strings": 2.0
          },
          "comments": {
            "chars": 14.0,
            "lines": 1.0,
            "total": 1.0,
            "to_code_ratio": 0.03
          },
          "functions": {},
          "identifiers": {}
        },
        "ss": [
          [
            21,
            "CHLD"
          ],
          [
            22,
            "CHLD"
          ],
          [
            29,
            "IGNORE"
          ],
          [
            30,
            "IGNORE"
          ],
          [
            74,
            " [OK]"
          ],
          [
            76,
            "[OK]"
          ],
          [
            86,
            "      Error: "
          ],
          [
            93,
            "Error: "
          ],
          [
            106,
            "\\r\\n-----------------------------------------\\r\\n"
          ],
          [
            107,
            "\\r\\n-----------------------------------------\\r\\n"
          ],
          [
            162,
            "----   Hello from S.A.P. Bind Port   ----"
          ],
          [
            163,
            "----   Hello from S.A.P. Bind Port   ----"
          ],
          [
            223,
            "\\r\\n\u003e Start..."
          ],
          [
            224,
            "\\r\\n\u003e Start..."
          ],
          [
            247,
            "\\r\\n\u003e Get protocol by name..."
          ],
          [
            248,
            "\\r\\n\u003e Get protocol by name..."
          ],
          [
            300,
            "tcp"
          ],
          [
            301,
            "tcp"
          ],
          [
            320,
            "$l$e$!$l"
          ],
          [
            321,
            "$l$e$!$l"
          ],
          [
            338,
            "           $o"
          ],
          [
            350,
            "$o"
          ],
          [
            361,
            "\\r\\n\u003e Packed address info..."
          ],
          [
            362,
            "\\r\\n\u003e Packed address info..."
          ],
          [
            442,
            "$l$e$!$l"
          ],
          [
            443,
            "$l$e$!$l"
          ],
          [
            460,
            "            $o"
          ],
          [
            473,
            "$o"
          ],
          [
            484,
            "\\r\\n\u003e Create socket..."
          ],
          [
            485,
            "\\r\\n\u003e Create socket..."
          ],
          [
            565,
            "$l$e$!$l"
          ],
          [
            566,
            "$l$e$!$l"
          ],
          [
            583,
            "                  $o"
          ],
          [
            602,
            "$o"
          ],
          [
            613,
            "\\r\\n\u003e Set socket options..."
          ],
          [
            614,
            "\\r\\n\u003e Set socket options..."
          ],
          [
            705,
            "$l$e$!$l"
          ],
          [
            706,
            "$l$e$!$l"
          ],
          [
            723,
            "             $o"
          ],
          [
            737,
            "$o"
          ],
          [
            748,
            "\\r\\n\u003e Bind socket..."
          ],
          [
            749,
            "\\r\\n\u003e Bind socket..."
          ],
          [
            804,
            "$l$e$!$l"
          ],
          [
            805,
            "$l$e$!$l"
          ],
          [
            822,
            "                    $o"
          ],
          [
            843,
            "$o"
          ],
          [
            854,
            "\\r\\n\u003e Listen socket..."
          ],
          [
            855,
            "\\r\\n\u003e Listen socket..."
          ],
          [
            911,
            "$l$e$!$l"
          ],
          [
            912,
            "$l$e$!$l"
          ],
          [
            929,
            "                  $o"
          ],
          [
            948,
            "$o"
          ],
          [
            959,
            "\\r\\n\u003e Accept connection..."
          ],
          [
            960,
            "\\r\\n\u003e Accept connection..."
          ],
          [
            1022,
            "$l$e$!$l"
          ],
          [
            1023,
            "$l$e$!$l"
          ],
          [
            1040,
            "$l      OK! I'm accept connection.$l"
          ],
          [
            1041,
            "$l      OK! I'm accept connection.$l"
          ],
          [
            1142,
            "\u003c\u0026CONN"
          ],
          [
            1143,
            "\u003c\u0026CONN"
          ],
          [
            1167,
            "\u003e\u0026CONN"
          ],
          [
            1168,
            "\u003e\u0026CONN"
          ],
          [
            1192,
            "\u003e\u0026CONN"
          ],
          [
            1193,
            "\u003e\u0026CONN"
          ],
          [
            1211,
            "unset HISTFILE; unset SAVEHIST;"
          ],
          [
            1212,
            "unset HISTFILE; unset SAVEHIST;"
          ],
          [
            1254,
            "\\r\\n$h\\r\\n\\r\\n"
          ],
          [
            1255,
            "\\r\\n$h\\r\\n\\r\\n"
          ],
          [
            1280,
            "/bin/sh -i"
          ],
          [
            1281,
            "/bin/sh -i"
          ],
          [
            1302,
            "$l\\r\\n"
          ],
          [
            1303,
            "$l\\r\\n"
          ]
        ],
        "sz": 1326,
        "ts": [
          {
            "c": 0.8500000238418579,
            "d": "Perl module import statement",
            "e": [
              "use IO::Socket;"
            ],
            "i": "metadata/lang/scripted::use-module",
            "l": 2
          },
          {
            "c": 0.9599999785423279,
            "d": "STDOUT redirected to socket",
            "e": [
              "open(STDOUT, \"\u003e\u0026C"
            ],
            "i": "objectives/command-and-control/reverse-shell/socket::stdout-socket-redir",
            "l": 1
          },
          {
            "a": "T1070.003",
            "c": 0.949999988079071,
            "d": "History wipe shell prelude",
            "e": [
              "unset HISTFILE; unset SAVEHIST;"
            ],
            "i": "objectives/command-and-control/reverse-shell/socket::history-wipe-prelude",
            "l": 4
          },
          {
            "c": 0.75,
            "d": "Perl file descriptor redirect",
            "e": [
              "\u003e\u0026CONN"
            ],
            "i": "objectives/command-and-control/reverse-shell/socket::perl-redir",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "File has 30 or more lines",
            "e": [
              "text.total_lines = 41.00"
            ],
            "i": "metadata/file/text/metrics::file-has-30-plus-lines",
            "l": 1
          },
          {
            "c": 0.949999988079071,
            "d": "Open target file for overwrite",
            "e": [
              "open(STDOUT, \"\u003e\u0026CONN\")"
            ],
            "i": "micro-behaviors/fs/write/file/direct::overwrite-target-open",
            "l": 3
          },
          {
            "d": "SOCK_STREAM socket type",
            "e": [
              "SOCK_STREAM"
            ],
            "i": "micro-behaviors/communications/socket/tcp::sock-stream",
            "l": 3
          },
          {
            "c": 1.0,
            "d": "Perl shebang line",
            "e": [
              "#!/usr/bin/perl"
            ],
            "i": "metadata/lang/shebang::perl",
            "l": 3
          },
          {
            "a": "T1036.005",
            "c": 0.800000011920929,
            "d": "Ignore SIGCHLD handler",
            "e": [
              "$SIG{'CHLD'}='IGNORE'"
            ],
            "i": "objectives/evasion/masquerade/identity/process-title::ignore-chld",
            "l": 4,
            "m": "F0004"
          },
          {
            "c": 0.8999999761581421,
            "d": "Interactive shell references (/bin/sh -i)",
            "e": [
              "/bin/sh -i"
            ],
            "i": "micro-behaviors/process/create/shell/invoke::bin-sh-interactive",
            "l": 3
          },
          {
            "c": 0.9599999785423279,
            "d": "STDERR redirected to socket",
            "e": [
              "open(STDERR, \"\u003e\u0026C"
            ],
            "i": "objectives/command-and-control/reverse-shell/socket::stderr-socket-redir",
            "l": 1
          },
          {
            "a": "T1071.001",
            "d": "listen() socket call",
            "e": [
              "listen"
            ],
            "i": "micro-behaviors/communications/http/server/listener::listen-keyword",
            "l": 3,
            "m": "C0002"
          },
          {
            "a": "T1059.004",
            "c": 0.6000000238418579,
            "d": "References /bin/sh (Bourne shell)",
            "e": [
              "/bin/sh -i"
            ],
            "i": "micro-behaviors/process/create/shell/invoke::bin-sh",
            "l": 3,
            "m": "E1059.004"
          }
        ],
        "sha": "e21b27f2efb0df9756f5a5d36c1ca8e728cdd7dc4de05f0a2af4b72b573e9a0f",
        "path": "/data/samples/bad/datasets/php-malware-analysis/plugins/login_wall/ring_decoded/bp.pl",
        "type": "perl"
      }
    ],
    "tv": "a9555"
  }
}