{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 0.9951310157775879,
        "class": 2
      }
    ],
    "prob": 0.995131,
    "class": 2,
    "models": [
      {
        "m": "az",
        "prob": 0.620116,
        "class": 0
      },
      {
        "m": "az/scripts",
        "prob": 0.90413207,
        "class": 0
      },
      {
        "m": "az/php",
        "prob": 0.995131,
        "class": 2
      }
    ],
    "version": "v16.16",
    "thresholds": [
      0.9961138,
      0.99909174
    ],
    "analyzed_at": "2026-05-08T21:45:31Z"
  },
  "path": "signin.php",
  "raw": {
    "v": "4",
    "fs": [
      {
        "f": "O₂(C₄La)H₄(Cm₂Db₄OsPo)Md",
        "k": {
          "source.imports[0]": "header",
          "source.imports[1]": "isset",
          "source.imports[2]": "mail",
          "source.strings[0]": "\r\n\u003ch4 style='font-weight: bold;font-family: sans-serif;'\u003e\r\n✘±±±±±±±±±±±±±±±±±±[ AMAZON LOGIN ]±±±±±±±±±±±±±±±±±±±±✘\u003cbr\u003e\r\n✘ Password : ",
          "source.strings[1]": "\r\n\u003ch4 style='font-weight: bold;font-family: sans-serif;'\u003e\r\n✘±±±±±±±±±±±±±±±±±±[ AMAZON LOGIN ]±±±±±±±±±±±±±±±±±±±±✘\u003cbr\u003e\r\n✘ Password : $password\u003cbr\u003e\r\n✘±±±±±±±±±±±±±±±±[ END AMAZON LOGIN ]±±±±±±±±±±±±±±±±±±✘\u003cbr\u003e\u003c/h4\u003e\r\n\u003ch4 style='font-weight: bold;font-family: sans-serif;'\u003e\r\n✘±±±±±±±±±±±±±±±±[     MORE INFO     ]±±±±±±±±±±±±±±±±±±✘\u003cbr\u003e\r\n✘🕘 Time : $time\u003cbr\u003e\r\n✘🗺 Ip : $iip\u003cbr\u003e\r\n✘📍 Geo : $ip\u003cbr\u003e\r\n✘💻 Operating System : $user_os\u003cbr\u003e\r\n✘🌀 Browser : $user_browser\u003cbr\u003e\r\n✘±±±±±±±±±±±±±±±±[ END MORE INFO ]±±±±±±±±±±±±±±±±✘\u003cbr\u003e\u003c/h4\u003e",
          "source.strings[2]": " 🌀 ",
          "source.strings[3]": " 💻 ",
          "source.strings[4]": "$rzlt_email,$sc",
          "source.strings[5]": "\u003cbr\u003e\r\n✘±±±±±±±±±±±±±±±±[ END AMAZON LOGIN ]±±±±±±±±±±±±±±±±±±✘\u003cbr\u003e\u003c/h4\u003e\r\n\u003ch4 style='font-weight: bold;font-family: sans-serif;'\u003e\r\n✘±±±±±±±±±±±±±±±±[     MORE INFO     ]±±±±±±±±±±±±±±±±±±✘\u003cbr\u003e\r\n✘🕘 Time : ",
          "source.strings[6]": "\u003cbr\u003e\r\n✘±±±±±±±±±±±±±±±±[ END MORE INFO ]±±±±±±±±±±±±±±±±✘\u003cbr\u003e\u003c/h4\u003e",
          "source.strings[7]": "\u003cbr\u003e\r\n✘🌀 Browser : ",
          "source.strings[8]": "\u003cbr\u003e\r\n✘💻 Operating System : ",
          "source.strings[9]": "\u003cbr\u003e\r\n✘📍 Geo : ",
          "source.has_imports": true,
          "source.strings[10]": "\u003cbr\u003e\r\n✘🗺 Ip : ",
          "source.strings[11]": "Billing",
          "source.strings[12]": "Content-type:text/html;charset=UTF-8",
          "source.strings[13]": "Email.php",
          "source.strings[14]": "From:AMAZON RZLT \u003cno-reply@kira.com\u003e",
          "source.strings[15]": "Location: submit.php",
          "source.strings[16]": "MIME-Version: 1.0",
          "source.strings[17]": "NEW AMAZON LOGIN 🗺 ",
          "source.strings[18]": "NEW AMAZON LOGIN 🗺 $iip 🌀 $user_browser 💻 $user_os",
          "source.strings[19]": "allantibots/a1.php",
          "source.strings[20]": "allantibots/a10.php",
          "source.strings[21]": "allantibots/a11.php",
          "source.strings[22]": "allantibots/a12.php",
          "source.strings[23]": "allantibots/a2.php",
          "source.strings[24]": "allantibots/a3.php",
          "source.strings[25]": "allantibots/a4.php",
          "source.strings[26]": "allantibots/a5.php",
          "source.strings[27]": "allantibots/a6.php",
          "source.strings[28]": "allantibots/a7.php",
          "source.strings[29]": "allantibots/a8.php",
          "source.strings[30]": "allantibots/a9.php",
          "source.strings[31]": "billing",
          "source.strings[32]": "var.php"
        },
        "x": 38,
        "id": 0,
        "is": [
          "isset",
          "header",
          "mail"
        ],
        "ms": {
          "file": {
            "size": 4663.0
          },
          "text": {
            "tab_count": 65.0,
            "digit_ratio": 0.03,
            "space_count": 551.0,
            "total_lines": 128.0,
            "char_entropy": 5.48,
            "mixed_indent": true,
            "unique_chars": 105.0,
            "import_density": 2.34,
            "string_density": 0.45,
            "avg_line_length": 34.45,
            "high_byte_ratio": 0.08,
            "max_line_length": 193.0,
            "non_ascii_ratio": 0.08,
            "empty_line_ratio": 0.07,
            "last_line_length": 7.0,
            "most_common_char": "s",
            "whitespace_ratio": 0.19,
            "most_common_ratio": 0.04,
            "identifier_density": 0.23,
            "line_length_stddev": 32.12,
            "normalized_import_count": 0.27,
            "normalized_string_count": 5.13,
            "repeated_char_sequences": 24.0,
            "max_inline_whitespace_run": 5.0,
            "trailing_whitespace_lines": 2.0,
            "normalized_unique_identifiers": 2.57
          },
          "imports": {
            "total": 3.0,
            "unique_modules": 3.0,
            "third_party_count": 3.0,
            "third_party_ratio": 1.0
          },
          "strings": {
            "total": 58.0,
            "avg_length": 37.91,
            "max_length": 702.0,
            "avg_entropy": 3.35,
            "email_count": 2.0,
            "total_bytes": 2199.0,
            "entropy_stddev": 0.97
          },
          "comments": {},
          "functions": {},
          "identifiers": {
            "total": 30.0,
            "avg_length": 6.61,
            "max_length": 17.0,
            "min_length": 2.0,
            "avg_entropy": 2.16,
            "reuse_ratio": 0.6,
            "unique_count": 18.0,
            "length_stddev": 4.07,
            "all_lowercase_ratio": 0.83,
            "all_uppercase_ratio": 0.06,
            "underscore_prefix_count": 1.0
          }
        },
        "ss": [
          [
            15,
            "Email.php"
          ],
          [
            16,
            "Email.php"
          ],
          [
            35,
            "var.php"
          ],
          [
            36,
            "var.php"
          ],
          [
            88,
            "Location: submit.php"
          ],
          [
            89,
            "Location: submit.php"
          ],
          [
            133,
            "fl"
          ],
          [
            134,
            "fl"
          ],
          [
            151,
            "$rzlt_email,$sc"
          ],
          [
            163,
            ","
          ],
          [
            178,
            "\r\n\u003ch4 style='font-weight: bold;font-family: sans-serif;'\u003e\r\n✘±±±±±±±±±±±±±±±±±±[ AMAZON LOGIN ]±±±±±±±"
          ],
          [
            179,
            "\r\n\u003ch4 style='font-weight: bold;font-family: sans-serif;'\u003e\r\n✘±±±±±±±±±±±±±±±±±±[ AMAZON LOGIN ]±±±±±±±"
          ],
          [
            366,
            "\u003cbr\u003e\r\n✘±±±±±±±±±±±±±±±±[ END AMAZON LOGIN ]±±±±±±±±±±±±±±±±±±✘\u003cbr\u003e\u003c/h4\u003e\r\n\u003ch4 style='font-w"
          ],
          [
            655,
            "\u003cbr\u003e\r\n✘🗺 Ip : "
          ],
          [
            678,
            "\u003cbr\u003e\r\n✘📍 Geo : "
          ],
          [
            701,
            "\u003cbr\u003e\r\n✘💻 Operating System : "
          ],
          [
            742,
            "\u003cbr\u003e\r\n✘🌀 Browser : "
          ],
          [
            779,
            "\u003cbr\u003e\r\n✘±±±±±±±±±±±±±±±±[ END MORE INFO ]±±±±±±±±±±±±±±±±✘\u003cbr\u003e\u003c/h4\u003e"
          ],
          [
            896,
            "From:AMAZON RZLT \u003cno-reply@kira.com\u003e"
          ],
          [
            897,
            "From:AMAZON RZLT \u003cno-reply@kira.com\u003e"
          ],
          [
            948,
            "MIME-Version: 1.0"
          ],
          [
            949,
            "MIME-Version: 1.0"
          ],
          [
            970,
            "\\r\\n"
          ],
          [
            991,
            "Content-type:text/html;charset=UTF-8"
          ],
          [
            992,
            "Content-type:text/html;charset=UTF-8"
          ],
          [
            1032,
            "\\r\\n"
          ],
          [
            1052,
            "NEW AMAZON LOGIN 🗺 $iip 🌀 $user_browser 💻 $user_os"
          ],
          [
            1053,
            "NEW AMAZON LOGIN 🗺 "
          ],
          [
            1079,
            " 🌀 "
          ],
          [
            1098,
            " 💻 "
          ],
          [
            1185,
            "billing"
          ],
          [
            1186,
            "billing"
          ],
          [
            1208,
            "allantibots/a1.php"
          ],
          [
            1209,
            "allantibots/a1.php"
          ],
          [
            1239,
            "allantibots/a2.php"
          ],
          [
            1240,
            "allantibots/a2.php"
          ],
          [
            1270,
            "allantibots/a3.php"
          ],
          [
            1271,
            "allantibots/a3.php"
          ],
          [
            1301,
            "allantibots/a4.php"
          ],
          [
            1302,
            "allantibots/a4.php"
          ],
          [
            1332,
            "allantibots/a5.php"
          ],
          [
            1333,
            "allantibots/a5.php"
          ],
          [
            1363,
            "allantibots/a6.php"
          ],
          [
            1364,
            "allantibots/a6.php"
          ],
          [
            1394,
            "allantibots/a7.php"
          ],
          [
            1395,
            "allantibots/a7.php"
          ],
          [
            1425,
            "allantibots/a8.php"
          ],
          [
            1426,
            "allantibots/a8.php"
          ],
          [
            1456,
            "allantibots/a9.php"
          ],
          [
            1457,
            "allantibots/a9.php"
          ],
          [
            1487,
            "allantibots/a10.php"
          ],
          [
            1488,
            "allantibots/a10.php"
          ],
          [
            1519,
            "allantibots/a11.php"
          ],
          [
            1520,
            "allantibots/a11.php"
          ],
          [
            1551,
            "allantibots/a12.php"
          ],
          [
            1552,
            "allantibots/a12.php"
          ],
          [
            2491,
            "Billing"
          ],
          [
            2492,
            "Billing"
          ]
        ],
        "sz": 4663,
        "ts": [
          {
            "c": 0.6000000238418579,
            "d": "Generates HTML tags",
            "e": [
              "\u003chtml"
            ],
            "i": "micro-behaviors/data/format/html::html-generator-tags",
            "l": 3
          },
          {
            "c": 0.800000011920929,
            "d": "Generates HTML content (DOCTYPE)",
            "e": [
              "\u003c!DOCTYPE html\u003e"
            ],
            "i": "micro-behaviors/data/format/html::html-generator-doctype",
            "l": 2
          },
          {
            "c": 0.8399999737739563,
            "d": "Regex component marker",
            "e": [
              "\r\n\u003ch4 style='font-weight: bold;font-family: sans-serif;'\u003e\r\n✘±±±±±±±±±±±±±±±±±±[ AMAZON LOGIN ]±±±±±±±",
              "\r\n\u003ch4 style='font-weight: bold;font-family: sans-serif;'\u003e\r\n✘±±±±±±±±±±±±±±±±±±[ AMAZON LOGIN ]±±±±±±±"
            ],
            "i": "micro-behaviors/data/text/llm/action::llm-send-action-cond-4--inline-11750",
            "l": 1
          },
          {
            "c": 0.8399999737739563,
            "d": "password/token/api_key field keyword",
            "e": [
              "password"
            ],
            "i": "micro-behaviors/data/text/keywords/credential::credential-field",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "HTTP Cookie access ($_COOKIE)",
            "e": [
              "$_COOKIE"
            ],
            "i": "micro-behaviors/communications/http/request/params::cookie",
            "l": 3
          },
          {
            "c": 0.699999988079071,
            "d": "PHP error suppression operator usage",
            "e": [
              "@$fullBillingAdress = $_COOKIE['billing']"
            ],
            "i": "micro-behaviors/os/stdio::error-suppress-prefix",
            "l": 3
          },
          {
            "c": 1.0,
            "d": "PHP mail() function call",
            "e": [
              "mail"
            ],
            "i": "micro-behaviors/process/create/exec::php-mail",
            "l": 3
          },
          {
            "c": 0.8600000143051147,
            "d": "Regex component marker",
            "e": [
              "method="
            ],
            "i": "objectives/command-and-control/backdoor/webshell/ui::self-named-get-form--rx-3",
            "l": 1,
            "m": "B0030"
          },
          {
            "a": "T1505.003",
            "d": "PHP open tag",
            "e": [
              "\u003c?php"
            ],
            "i": "objectives/command-and-control/backdoor/webshell/request::php-tag",
            "l": 1,
            "m": "B0030"
          },
          {
            "c": 0.8999999761581421,
            "d": "File has 30 or more lines",
            "e": [
              "text.total_lines = 128.00"
            ],
            "i": "metadata/file/text/metrics::file-has-30-plus-lines",
            "l": 1
          },
          {
            "d": "password keyword",
            "e": [
              "password"
            ],
            "i": "micro-behaviors/data/text/keywords/lexicon::password",
            "l": 1
          },
          {
            "c": 0.8399999737739563,
            "d": "Regex component marker",
            "e": [
              "\r\n\u003ch4 style='font-weight: bold;font-family: sans-serif;'\u003e\r\n✘±±±±±±±±±±±±±±±±±±[ AMAZON LOGIN ]±±±±±±±",
              "\r\n\u003ch4 style='font-weight: bold;font-family: sans-serif;'\u003e\r\n✘±±±±±±±±±±±±±±±±±±[ AMAZON LOGIN ]±±±±±±±"
            ],
            "i": "micro-behaviors/data/text/llm/action::llm-send-action--rx-6",
            "l": 1
          },
          {
            "a": "T1505.003",
            "c": 0.8600000143051147,
            "d": "Very long embedded string",
            "e": [
              "strings.max_length = 702.00"
            ],
            "i": "objectives/command-and-control/backdoor/webshell/stager::very-long-string",
            "l": 1
          },
          {
            "a": "T1071.001",
            "c": 0.699999988079071,
            "d": "HTTP POST method",
            "e": [
              "\"POST\""
            ],
            "i": "micro-behaviors/communications/http/post::post",
            "l": 1,
            "m": "C0002"
          },
          {
            "a": "T1505.003",
            "c": 0.8500000238418579,
            "d": "HTML password form in PHP",
            "e": [
              "\u003cinput class=\"password\" type=\"password\""
            ],
            "i": "objectives/command-and-control/backdoor/webshell/auth::password-form",
            "l": 4,
            "m": "B0030"
          },
          {
            "c": 0.75,
            "d": "Inline password token in lure",
            "e": [
              "password\" type=\"password\""
            ],
            "i": "objectives/lateral-movement/social-engineering/lures::inline-password-token",
            "l": 1
          }
        ],
        "sha": "00431ece56e9997d2f9e057bc956db09c19a95bb31b6d8817c453cf1196c7e65",
        "path": "/data/samples/bad/datasets/awesome-malware/PHP/signin.php",
        "type": "php"
      }
    ],
    "tv": "bef72"
  }
}