{ "ml": { "v": "7", "eng": "2.0.1-rc.1", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.00004324317, "rte": "az", "prob": 0.00004324317 }, { "cls": 0, "raw": 0.8460007, "rte": "az/source", "prob": 0.8460007 }, { "cls": 0, "raw": 0.8688362, "rte": "az/java", "prob": 0.8688362 } ], "prob": 0.00004324317, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.0000432431697845459, "type": "java" } ], "version": "v18.18", "analyzed_at": "2026-06-15T09:52:02Z" }, "path": "TomcatValveInjectorTpl.java", "raw": { "v": "7", "tv": "061e3", "files": [ { "id": 0, "ctx": [ { "a": 47, "b": "x(d*cA=-BsvrM6iy*?i]e]\u003eJny?m9#e\u003efL^y?bQ", "l": 5 }, { "a": 79, "b": "x(d*cA=-BsvrM6iy*?i]e]\u003eJny?m9#e\u003eG@7z!0i$x(v(*vrc0(BvyB:wPh:9z/dS", "l": 6 }, { "a": 131, "b": "x(d*cA=-BsvrM6iy*?i]e]\u003eJny?m9#e\u003e]]0xM4Ay", "l": 7, "n": [ { "c": 3, "d": "Java dynamic code loading pattern extended", "i": "objectives/anti-static/obfuscation/reflection/class::java-dynamic-code-loading-extended", "o": 138, "z": 24 } ] }, { "a": 164, "b": "x(d*cA=-BsvrM6iB-.tle\u003cTI#vr\u003eKXB96F", "l": 8 }, { "a": 192, "b": "x(d*cA=-BsvrM6iB-.tle\u003cTI#vr(]Q", "l": 9 }, { "a": 310, "b": "asXH4vru6watLSaga$vpfeb9", "l": 16 }, { "a": 330, "b": "asXH1B-.qnAYLsZwO%tEx(i", "l": 17 }, { "a": 349, "b": "asXH4wPIv4x(Ffdz/dPUrbVR-vrrR)vqH9#aM*2e\u003c+oL)NwZ", "l": 18, "n": [ { "c": 3, "d": "Chinese text detection (Mandarin/Yue)", "i": "micro-behaviors/data/text/language::lang-chinese", "o": 378, "z": 9 } ] }, { "a": 388, "b": "asXHkwPI%8wfu5bA=U@kzTUlb", "l": 19 }, { "a": 409, "b": "asXHGwnrqgarU?Ze\u0026UEquOTL$", "l": 20 }, { "a": 461, "b": "AckSax\u003e5n}y*?yaaxin@v{%EWvqH9#nP5oOv@#Tfrb=T@DJ", "l": 23 }, { "a": 499, "b": "", "l": 24 }, { "a": 500, "b": "arR^HAckSax\u003e5n:BAh8kxcp?#Bx9u$p*[D/wPzVpdiJ%", "l": 25, "n": [ { "c": 1, "d": "Validation vocabulary string", "i": "metadata/file/text/format::vocab-string", "o": 511, "z": 6 } ] }, { "a": 536, "b": "arR^HarR^HA+funA=90zfdFec", "l": 26 }, { "a": 557, "b": "arR^HEe", "l": 27 }, { "a": 768, "b": "arR^HAckSax\u003e5n+z/5#)Bxh*^C4Bl.ygQ)%z/O/@y:Z.PDJ", "l": 43 }, { "a": 806, "b": "arR^HarR^HBAhTHDJ", "l": 44 }, { "a": 820, "b": "arR^HarR^HarR^HoLFM\u0026jwPB3wN/*Cay/tcBy/YsB09Q*xjVfLz/fVdCYUt.i@", "l": 45, "n": [ { "c": 1, "d": "Validation vocabulary object", "i": "metadata/file/text/format::vocab-object", "o": 837, "z": 6 } ] }, { "a": 870, "b": "arR^HarR^HarR^Hw]zYjc@jq!wN/*8v@DmbwQ5qtiV}{JzGGDmBAn(NDJ", "l": 46, "n": [ { "c": 2, "d": "English language detection", "i": "micro-behaviors/data/text/language::lang-english", "o": 882, "z": 3 } ] }, { "a": 916, "b": "arR^HarR^HarR^HarR^HpHX6Iv@@\u0026pvqH9#auZ\u0026WwPQ%Yy\u003c6wrv@DmbwQ5qCi@", "l": 47 }, { "a": 966, "b": "arR^HarR^HarR^HarR^Hx\u003ewFoC42igwGTc0az#sry:*Gpz/fVhzGPIL", "l": 48 }, { "a": 1533, "b": "arR^HarR^HarR^HarR^Hx\u003ewFoBzbYavpR06wPQWQzdLaAe[n*qByw)3B0@k1z/fV9x(mH5lsBwtxl4{kzE=N:z!0v1B8M7ydiG@:ay/tcBy/Ysau.\u003egzGP=idiJ%", "l": 63 }, { "a": 1633, "b": "arR^HarR^HarR^HarR^HarR^HnmuNMo\u003c}#-v}YN)wo8m0o\u003c}#-jS(dzvrl9Rvq)UrxjVfOrW.P(BvGpVxjVfOrW-66A+eV\u0026efDcUvrc0(BrSd+ar\u003e]vx(+KNa$k5=b4Cq2y?dM$zxZI\u003e", "l": 64 }, { "a": 1746, "b": "arR^HarR^HarR^HarR^HarR^Hfe1EfJ?nuPzddxoxjVfkb5zgcvqGQ}B95PP", "l": 65, "n": [ { "c": 2, "d": "Hardcoded localhost network host", "i": "micro-behaviors/communications/ip/literal::localhost-source", "o": 1783, "z": 9 } ] }, { "a": 1795, "b": "arR^HarR^HarR^HarR^HarR^Hfe1EeXR]NaJPNKu\u003ea4p\u0026UEL=OByx5$vrb)Hz/Z1y\u003e!ARJP]wk!JPDgP[4sRvKe?z]GxO.=\u003cHQ6*y\u0026r/(y?N:dBrG+nGYW]v\u003c+yhiYO$%HG65U{\u003eBnTpPOI-^S]ZyL\u003cHHcdX}Rtvz/Z1K\u003c+Pt=YQF5AX8\u0026Wp\u003cHyihH{l0AX-Hz!\u003eBd5Dv@DmbwQ5s=YO$%QYY+cT\u003ecI2FG@9[bVfnM\u003e", "l": 66, "n": [ { "c": 2, "d": "Dense Han ideograph prose (localized source)", "i": "metadata/file/text/format::han-ideograph-prose", "o": 1818, "z": 15 } ] }, { "a": 1984, "b": "arR^HarR^HarR^HarR^HarR^Hw]zYjc@jq!wN/*8yH}=liV}{Cx(4s2wO$jJA4U{qC#Fo@c[cO/DJ", "l": 67 }, { "a": 2046, "b": "arR^HarR^HarR^HarR^HarR^HarR^HnmuNMo\u003c}#-v}YN)wo8m0auZ?}nmuNMo\u003c}#\u0026azkncmPH{ExLzo[A+fb.vq)\u0026iwPPtowQbZQar\u003erex(4s2wO@Xvi@", "l": 68 }, { "a": 2948, "b": "arR^HarR^HarR^HarR^HEe", "l": 80 }, { "a": 2966, "b": "arR^HarR^HarR^HarR^Hfe1EjFp^3tJuAsYzdv0@aA/:", "l": 81 }, { "a": 3002, "b": "arR^HarR^HarR^HarR^HwO=B0azCBgd0fcywNPa4xjVfLz/fVdCYVq?vrlG-z^^f/AWSvVaW3@=B.\u003e\u003epcmf\u0026-BzbYavpR06wPQpTzGGDmBvf\u003eMB8$2[vpS}\u0026c[c=YwPQpQvrlGrdk2ZXq/)4]zF7vDe[n*qByw)3B0@kevrb^)y?mA:wNY7!A6[CIB8$2[vpS}\u0026a$jTZD)0JAA+eV\u0026e[X:qlVl\u003c:wQ5q:y*?yaoMauIwPxgFe[X:qlU{gLB0@E\u0026Bz\u003e91A+PA7c[c=Uz/fV9x(m#ub2\u0026F$v{%EFzdm6!wmYpMwNY7!A6[CIB8$2[vpS}\u0026a$j@\u0026aBs", "l": 82, "n": [ { "c": 3, "d": "Java reflection class loading", "i": "objectives/anti-static/obfuscation/reflection/class::java-reflection", "o": 3044, "z": 11 } ] }, { "a": 3265, "b": "arR^HarR^HarR^HarR^HarR^Hv@DmbwQ5qtjS[xGBvGpVxjVfOrW-66A+eV\u0026e[X:qlVl\u003c:wQ5q:y*?yaoMauIwPxgFefDcSwPI^jA:@W4a$k5=b4CLeBy/Ysa$kO", "l": 83 }, { "a": 3365, "b": "arR^HarR^HarR^HarR^HarR^Hx\u003ewFov@DmbwQ5qtaW3@=B.\u003e\u003epcmf\u003cBz/fVdCYUMJwPQpQvrlGrdk2mABwumYwHF#Wv@DmbvqfR2c)zPivqYQ:A+4KQzGGDmBrSd.", "l": 84 }, { "a": 3891, "b": "arR^HarR^HlU{gLB4*HXwmY^7v@bN{B4*HXwmY^7jS[lMzGGDmBs}iqBvf\u003eMB8@-Ue[X:qlU{gLB4*HXwmY^fdlv", "l": 98 }, { "a": 3962, "b": "arR^HarR^HBAhTHDJ", "l": 99 }, { "a": 3976, "b": "arR^HarR^HarR^HC42igwGTbUv@bN{B4*HXwmY^ly\u0026r-)lU{gLB0$WjBvf\u003eMB8$8+zdLaAdk2HHCs=W[Byx5%wHF#?", "l": 100, "n": [ { "c": 1, "d": "Java loadClass", "i": "objectives/anti-static/obfuscation/reflection/class::java-loadclass", "o": 4008, "z": 9 }, { "c": 1, "d": "Java newInstance", "i": "objectives/anti-static/obfuscation/reflection/class::java-newinstance", "o": 4034, "z": 11 } ] }, { "a": 4049, "b": "arR^HarR^HEir3dByO#bc}ew\u003cwPh:9z/cXediJ%", "l": 101 }, { "a": 4081, "b": "arR^HarR^HarR^HBAhTHDJ", "l": 102 }, { "a": 4099, "b": "arR^HarR^HarR^HarR^HvTi6btu@vYy*?Tolv0V:auZ\u0026WDtds^wN/T}Ab]JhB0$Ngv@C)?lsB}Dhz=*{wPQmEB7El^q/)4]zF7vDdjEs", "l": 103 }, { "a": 4183, "b": "arR^HarR^HarR^HarR^Ho\u003ewAWz!6#3wObT]wKyoxB8@D!avx%NB8$2[vpS}\u0026e[nZaB8@%DwPQsKv@bN]wN[IDBzbP6c)Ahkw[=c]lU{gLB0rdTvTi6btu@\u003c\u003ey*?yaefFUABs}6tvrlGvazC.ne[nZaB8@=(", "l": 104, "n": [ { "c": 1, "d": "Java defineClass reflective load", "i": "micro-behaviors/data/source/dynamic/reflect::java-defineclass", "o": 4206, "z": 11 } ] }, { "a": 4308, "b": "arR^HarR^HarR^HarR^HwmYv!zE(gKvrlGxB7GCVv}f7\u003eB7]91wHIUvB.90-", "l": 105 }, { "a": 4357, "b": "arR^HarR^HarR^HarR^HlU{gLB0a$evs0kxjS(duy*?yadiJejw[=c]lU{gLB1RfAC5Iecc$v74B8$2[vpS}\u0026efFCsvs0k^D30QGattt?v@bO1Do#[0wId!gzFa68dlv", "l": 106 }, { "a": 4788, "b": "arR^HarR^HlU{gLB38VJay]4[z!9B1lU{gLB2%", "l": 116 }, { "a": 4819, "b": "arR^HarR^HBAhTHDJ", "l": 117 }, { "a": 4833, "b": "arR^HarR^HarR^HwmYm?wmY^Gy*?yaauZ\u0026my*?yae[P3xpgn0Jc)A.Pzz2^uB7l*?k#Qigg^\u003e[+z!9B1a$kO", "l": 118, "n": [ { "c": 1, "d": "Java Class.forName", "i": "objectives/anti-static/obfuscation/reflection/class::java-class-forname", "o": 4860, "z": 13 } ] }, { "a": 4901, "b": "arR^HarR^HarR^HA+funA=90FvTi6btu@W2wmYm?wmY^Gy*?yae[X:qo\u003ewAWz!7muwmYm?wmX8Iw[CQ{a$K\u003cnBAh8kxd^XgvrlGse[]iDz!\u0026]jwmYm?wmY^Gy*?yae]ClAnP5P\u003evqYN^c[cX\u0026vQTs?hz!uOAW:6", "l": 119 }, { "a": 5029, "b": "arR^HarR^HEir3dByO#bc}ew\u003cwPh:9z/cXixkRTdwN)kjDJ", "l": 120 }, { "a": 5067, "b": "arR^HarR^HarR^HwmYm?wmY^Gy*?yaauZ\u0026my*?yae[P3xpgn0Jc)AzmC401CBzkLzlsB}Dhz=Qbi@", "l": 121, "n": [ { "c": 2, "d": "base64 encoding keyword", "i": "micro-behaviors/data/text/encoded::base64-token", "o": 5119, "z": 6 } ] }, { "a": 5129, "b": "arR^HarR^HarR^HpHX6Iv@@\u00267wN/T?wPw[Ray]4[z!9B1lU{gLB1R9pBwls*xM4Afb4\u003eFel$G\u003eDwmY^9dk2sLC5Iecc#Kfzy:?B", "l": 122 }, { "a": 5209, "b": "arR^HarR^HarR^HA+funA=90FvTi6btu@W2wmYm?wmY^lxjVfLy*?yac[c=YwPQTTBzbP6c)Ahkv@C)?a$K\u003cnBAh8kxd^XgvrlGse[]iDz!\u0026]jwmYm?wmY^jayX=2wI#wzBAe/(", "l": 123 }, { "a": 5808, "b": "", "l": 138 }, { "a": 5809, "b": "", "l": 139 }, { "a": 5810, "b": "arR^HAckSax\u003e5n{z/oD6vqWi4B4Hm:wN/*[wggk.ygQ)%ay/tcBy/YsefE(kA+PA7aA?gfC4B3SvrlG+vqPN8aARpqz*cmBmr\u0026rNAcb/jzxKo", "l": 140, "n": [ { "c": 1, "d": "Validation vocabulary boolean", "i": "metadata/file/text/format::vocab-boolean", "o": 5821, "z": 7 } ] }, { "a": 5898, "b": "arR^HarR^HpHX6Iv@@\u0026ivRN2GazC.pz!\u0026]UwPRQ7wgg@azGGDmBsXKUxjVfYx(ET1x(mGadlv", "l": 141 }, { "a": 5957, "b": "arR^HarR^HpHX6Iv@${XaA?gfC4C.qjS(dGvRPE:Bx-31azC.pz!\u0026]UwPRQ7wghw9yaHFKxjVf=vqH9#B0r4{", "l": 142 } ], "mol": "O(As)H(Db)", "sha": "f7463a268c4a80ca7830aed4d2390618441c051dcedd8ce1802398fe4e7bc340", "fact": { "id": "java", "imp": [ [ "", "getContext" ], [ "", "getValve" ], [ "", "injectValve" ], [ "", "invokeMethod" ], [ "", "thread" ], [ "", "thread" ], [ "", "getFV" ], [ "", "getFV" ], [ "", "getFV" ], [ "", "childrenMap" ], [ "", "getFV" ], [ "", "childrenMap" ], [ "", "children" ], [ "", "children" ], [ "", "context" ], [ "", "context" ], [ "", "context" ], [ "", "contexts" ], [ "", "context" ], [ "", "context" ], [ "", "context" ], [ "", "contexts" ], [ "", "thread" ], [ "", "thread" ], [ "", "thread" ], [ "", "thread" ], [ "", "thread" ], [ "", "thread" ], [ "", "thread" ], [ "", "thread" ], [ "", "thread" ], [ "", "getFV" ], [ "", "getFV" ], [ "", "thread" ], [ "", "context" ], [ "", "context" ], [ "", "context" ], [ "", "contexts" ], [ "", "context" ], [ "", "context" ], [ "", "context" ], [ "", "contexts" ], [ "", "context" ], [ "", "context" ], [ "", "classLoader" ], [ "", "classLoader" ], [ "", "getClassName" ], [ "", "gzipDecompress" ], [ "", "decodeBase64" ], [ "", "getBase64String" ], [ "", "defineClass" ], [ "", "defineClass" ], [ "", "clazz" ], [ "", "e2" ], [ "", "Class" ], [ "", "decoderClass" ], [ "", "decoderClass" ], [ "", "decoderClass" ], [ "", "Class" ], [ "", "decoderClass" ], [ "", "decoderClass" ], [ "", "decoder" ], [ "", "decoder" ], [ "", "decoder" ], [ "", "ungzip" ], [ "", "out" ], [ "", "out" ], [ "", "invokeMethod" ], [ "", "invokeMethod" ], [ "", "Arrays" ], [ "", "valve" ], [ "", "valve" ], [ "", "valve" ], [ "", "isInjected" ], [ "", "valve" ], [ "", "valve" ], [ "", "Thread" ], [ "", "Thread" ], [ "", "Thread" ], [ "", "context" ], [ "", "context" ], [ "", "context" ], [ "", "invokeMethod" ], [ "", "invokeMethod" ], [ "", "var0" ], [ "", "var3" ], [ "", "var3" ], [ "", "var2" ], [ "", "var2" ], [ "", "invokeMethod" ], [ "", "obj" ], [ "", "tempClass" ], [ "", "tempClass" ], [ "", "tempClass" ], [ "", "method" ], [ "", "method" ], [ "", "method" ], [ "", "java.io" ], [ "", "java.lang.reflect.Field" ], [ "", "java.lang.reflect.InvocationTargetException" ], [ "", "java.lang.reflect.Method" ], [ "", "java.util.ArrayList" ], [ "", "java.util.Arrays" ], [ "", "java.util.HashMap" ], [ "", "java.util.List" ], [ "", "java.util.zip.GZIPInputStream" ] ], "mbr": [ "clazzByte.length", "getParameterTypes().length", "methods.length" ], "met": { "ast": { "op.eq": 7.0, "op.ge": 1.0, "op.lt": 1.0, "op.ne": 7.0, "op.lor": 1.0, "op.land": 8.0, "max_depth": 22.0, "bind_count": 42.0, "call_count": 115.0, "node_count": 2373.0, "member_count": 3.0, "op_density.eq": 0.0, "op_density.ge": 0.0, "op_density.lt": 0.0, "op_density.ne": 0.0, "op_density.lor": 0.0, "op_density.land": 0.0, "identifier_count": 102.0, "member_depth_max": 2.0, "string_literal_count": 29.0, "array_literal_max_length": 1.0 }, "file": { "size": 9843.0, "entropy": 4.73, "size_bytes": 9843.0 }, "text": { "digit_ratio": 0.01, "space_count": 2870.0, "total_lines": 239.0, "char_entropy": 4.73, "unique_chars": 137.0, "lines_over_200": 2.0, "string_density": 0.12, "avg_line_length": 40.19, "high_byte_ratio": 0.03, "max_line_length": 262.0, "non_ascii_ratio": 0.03, "empty_line_ratio": 0.1, "last_line_length": 1.0, "whitespace_ratio": 0.32, "most_common_ratio": 0.07, "identifier_density": 1.49, "line_length_stddev": 39.61, "encoded_string_ratio": 0.03, "normalized_string_count": 1.88, "repeated_char_sequences": 104.0, "most_common_char_is_null": 0.0, "suspicious_comment_ratio": 0.45, "max_inline_whitespace_run": 4.0, "most_common_char_codepoint": 101.0, "suspicious_identifier_ratio": 0.12, "normalized_unique_identifiers": 12.91 }, "binds": { "count": 42.0 }, "calls": { "count": 115.0 }, "binary": { "overall_entropy": 4.73 }, "source": { "class_count": 1.0, "function_count": 12.0 }, "imports": { "count": 9.0, "unique_modules": 9.0, "third_party_count": 9.0, "third_party_ratio": 1.0 }, "members": { "count": 3.0 }, "strings": { "total": 29.0, "avg_length": 13.03, "max_length": 31.0, "path_count": 1.0, "avg_entropy": 3.01, "empty_count": 2.0, "total_bytes": 378.0, "entropy_stddev": 0.64, "base64_candidates": 1.0 }, "comments": { "chars": 829.0, "lines": 18.0, "total": 11.0, "to_code_ratio": 0.08, "high_entropy_comments": 5.0 }, "functions": { "count": 13.0, "avg_params": 1.15, "max_params": 4.0, "length_stddev": 12.2, "avg_name_length": 12.0, "no_params_count": 5.0, "avg_length_lines": 14.92, "max_length_lines": 41.0, "min_length_lines": 3.0, "high_entropy_names": 2.0, "avg_param_name_length": 7.47, "density_per_100_lines": 5.44, "code_in_functions_ratio": 0.81 }, "identifiers": { "count": 102.0, "total": 357.0, "avg_length": 8.21, "max_length": 25.0, "min_length": 1.0, "avg_entropy": 2.5, "reuse_ratio": 0.29, "unique_count": 102.0, "length_stddev": 4.71, "has_digit_ratio": 0.1, "sequential_names": 9.0, "base64_like_names": 3.0, "single_char_count": 3.0, "single_char_ratio": 0.03, "high_entropy_count": 6.0, "high_entropy_ratio": 0.06, "all_lowercase_ratio": 0.38, "numeric_suffix_count": 8.0 } }, "str": [ [ 551, "u8", "/*" ], [ 552, "u8", "/*" ], [ 1393, "u8", "getThreads" ], [ 1394, "u8", "getThreads" ], [ 1579, "u8", "ContainerBackgroundProcessor" ], [ 1580, "u8", "ContainerBackgroundProcessor" ], [ 1711, "u8", "target" ], [ 1712, "u8", "target" ], [ 1722, "u8", "this$0" ], [ 1723, "u8", "this$0" ], [ 1733, "u8", "children" ], [ 1734, "u8", "children" ], [ 2127, "u8", "children" ], [ 2128, "u8", "children" ], [ 2585, "u8", "StandardContext" ], [ 2586, "u8", "StandardContext" ], [ 2819, "u8", "TomcatEmbeddedContext" ], [ 2820, "u8", "TomcatEmbeddedContext" ], [ 3132, "u8", "ParallelWebappClassLoader" ], [ 3133, "u8", "ParallelWebappClassLoader" ], [ 3226, "u8", "TomcatEmbeddedWebappClassLoader" ], [ 3227, "u8", "TomcatEmbeddedWebappClassLoader" ], [ 3339, "u8", "resources" ], [ 3340, "u8", "resources" ], [ 3353, "u8", "context" ], [ 3354, "u8", "context" ], [ 3446, "u8", "StandardContext" ], [ 3447, "u8", "StandardContext" ], [ 3594, "u8", "TomcatEmbeddedContext" ], [ 3595, "u8", "TomcatEmbeddedContext" ], [ 4256, "u8", "defineClass" ], [ 4257, "u8", "defineClass" ], [ 4438, "10", "0" ], [ 4874, "u8", "sun.misc.BASE64Decoder" ], [ 4875, "u8", "sun.misc.BASE64Decoder" ], [ 4952, "u8", "decodeBuffer" ], [ 4953, "u8", "decodeBuffer" ], [ 5108, "u8", "java.util.Base64" ], [ 5109, "u8", "java.util.Base64" ], [ 5181, "u8", "getDecoder" ], [ 5182, "u8", "getDecoder" ], [ 5266, "u8", "decode" ], [ 5267, "u8", "decode" ], [ 5651, "10", "256" ], [ 5716, "10", "0" ], [ 5751, "10", "0" ], [ 5941, "u8", "getPipeline" ], [ 5942, "u8", "getPipeline" ], [ 6012, "u8", "getValves" ], [ 6013, "u8", "getValves" ], [ 6596, "u8", "org.apache.catalina.Valve" ], [ 6597, "u8", "org.apache.catalina.Valve" ], [ 6737, "u8", "org.apache.catalina.Valve" ], [ 6738, "u8", "org.apache.catalina.Valve" ], [ 6828, "u8", "getPipeline" ], [ 6829, "u8", "getPipeline" ], [ 7100, "u8", "addValve" ], [ 7101, "u8", "addValve" ], [ 8067, "10", "0" ], [ 8082, "10", "0" ], [ 8726, "10", "0" ], [ 8868, "10", "0" ] ], "tgt": [ "ByteArrayInputStream", "ByteArrayOutputStream", "GZIPInputStream", "NoSuchFieldException", "NoSuchMethodException", "RuntimeException", "TomcatValveInjectorTpl", "add", "asList", "contains", "currentThread", "decodeBase64", "equals", "forName", "get", "getBase64String", "getClass", "getClassLoader", "getClassName", "getContext", "getContextClassLoader", "getDeclaredField", "getDeclaredMethod", "getDeclaredMethods", "getFV", "getMessage", "getMethod", "getName", "getParameterTypes", "getSuperclass", "getValve", "gzipDecompress", "injectValve", "invoke", "invokeMethod", "isInjected", "keySet", "loadClass", "newInstance", "printStackTrace", "read", "setAccessible", "toByteArray", "toString", "write" ], "val": { "file.stem": "TomcatValveInjectorTpl", "file.basename": "TomcatValveInjectorTpl.java", "source.language": "java", "source.imports[0]": "Arrays", "source.imports[1]": "Class", "source.imports[2]": "Thread", "source.imports[3]": "children", "source.imports[4]": "childrenMap", "source.imports[5]": "classLoader", "source.imports[6]": "clazz", "source.imports[7]": "context", "source.imports[8]": "contexts", "source.imports[9]": "decodeBase64", "source.strings[0]": "ContainerBackgroundProcessor", "source.strings[1]": "ParallelWebappClassLoader", "source.strings[2]": "StandardContext", "source.strings[3]": "TomcatEmbeddedContext", "source.strings[4]": "TomcatEmbeddedWebappClassLoader", "source.strings[5]": "addValve", "source.strings[6]": "children", "source.strings[7]": "context", "source.strings[8]": "decode", "source.strings[9]": "decodeBuffer", "source.has_imports": true, "source.imports[10]": "decoder", "source.imports[11]": "decoderClass", "source.imports[12]": "defineClass", "source.imports[13]": "e2", "source.imports[14]": "getBase64String", "source.imports[15]": "getClassName", "source.imports[16]": "getContext", "source.imports[17]": "getFV", "source.imports[18]": "getValve", "source.imports[19]": "gzipDecompress", "source.imports[20]": "injectValve", "source.imports[21]": "invokeMethod", "source.imports[22]": "isInjected", "source.imports[23]": "java.io", "source.imports[24]": "java.lang.reflect.Field", "source.imports[25]": "java.lang.reflect.InvocationTargetException", "source.imports[26]": "java.lang.reflect.Method", "source.imports[27]": "java.util.ArrayList", "source.imports[28]": "java.util.Arrays", "source.imports[29]": "java.util.HashMap", "source.imports[30]": "java.util.List", "source.imports[31]": "java.util.zip.GZIPInputStream", "source.imports[32]": "method", "source.imports[33]": "obj", "source.imports[34]": "out", "source.imports[35]": "tempClass", "source.imports[36]": "thread", "source.imports[37]": "ungzip", "source.imports[38]": "valve", "source.imports[39]": "var0", "source.imports[40]": "var2", "source.imports[41]": "var3", "source.strings[10]": "defineClass", "source.strings[11]": "getDecoder", "source.strings[12]": "getPipeline", "source.strings[13]": "getThreads", "source.strings[14]": "getValves", "source.strings[15]": "java.util.Base64", "source.strings[16]": "org.apache.catalina.Valve", "source.strings[17]": "resources", "source.strings[18]": "sun.misc.BASE64Decoder", "source.strings[19]": "target", "source.strings[20]": "this$0", "source.functions[0]": "TomcatValveInjectorTpl", "source.functions[1]": "decodeBase64", "source.functions[2]": "getBase64String", "source.functions[3]": "getClassName", "source.functions[4]": "getContext", "source.functions[5]": "getFV", "source.functions[6]": "getUrlPattern", "source.functions[7]": "getValve", "source.functions[8]": "gzipDecompress", "source.functions[9]": "injectValve", "source.functions[10]": "invokeMethod", "source.functions[11]": "isInjected" } }, "find": [ { "id": "objectives/anti-static/obfuscation/reflection/class::java-classloader", "conf": 1.0, "crit": 1, "desc": "Java ClassLoader" }, { "id": "objectives/anti-static/obfuscation/reflection/class::java-reflective-method", "atk": "T1140", "mbc": "E1202", "conf": 0.8500000238418579, "crit": 1, "desc": "Java reflective method invocation" }, { "id": "objectives/anti-static/obfuscation/reflection/class::java-newinstance", "conf": 1.0, "crit": 1, "desc": "Java newInstance" }, { "id": "micro-behaviors/data/source/dynamic/reflect::java-defineclass", "conf": 0.8799999952316284, "crit": 1, "desc": "Java defineClass reflective load" }, { "id": "metadata/file/text/format::vocab-string", "conf": 0.9700000286102295, "crit": 1, "desc": "Validation vocabulary string" }, { "id": "metadata/file/text/format::vocab-boolean", "conf": 0.9700000286102295, "crit": 1, "desc": "Validation vocabulary boolean" }, { "id": "micro-behaviors/data/text/language::lang-chinese", "conf": 0.800000011920929, "crit": 3, "desc": "Chinese text detection (Mandarin/Yue)" }, { "id": "metadata/file/text/format::vocab-object", "conf": 0.9700000286102295, "crit": 1, "desc": "Validation vocabulary object" }, { "id": "objectives/anti-static/obfuscation/reflection/class::java-class-forname", "conf": 1.0, "crit": 1, "desc": "Java Class.forName" }, { "id": "objectives/anti-static/obfuscation/reflection/class::java-loadclass", "conf": 1.0, "crit": 1, "desc": "Java loadClass" }, { "id": "objectives/anti-static/obfuscation/reflection/class::java-dynamic-code-loading-extended", "atk": "T1140", "mbc": "E1202", "conf": 0.9200000166893005, "crit": 3, "desc": "Java dynamic code loading pattern extended" }, { "id": "objectives/anti-static/obfuscation/reflection/class::java-reflection", "conf": 0.8500000238418579, "crit": 3, "desc": "Java reflection class loading" } ], "path": "TomcatValveInjectorTpl.java", "risk": 2, "size": 9843, "type": "java" } ] } }