{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9993301630020142, "class": 2 } ], "prob": 0.99933016, "class": 2, "models": [ { "m": "az", "prob": 0.9803995, "class": 0 }, { "m": "az/scripts", "prob": 0.99179745, "class": 0 }, { "m": "az/php", "prob": 0.99933016, "class": 2 } ], "version": "v16.16", "thresholds": [ 0.9961138, 0.99909174 ], "analyzed_at": "2026-05-09T22:17:14Z" }, "path": "6683d2dc325816c0ba8df871751476da", "raw": { "v": "4", "fs": [ { "f": "O₄(AsC₃EuI)H₄(Cm₃Db₂OsPo)Md₂(Pt)", "k": { "source.imports[0]": "copy", "source.imports[1]": "explode", "source.imports[2]": "mail", "source.imports[3]": "stripslashes", "source.strings[0]": "\u003c/b\u003e \u003cfont color=DarkCyan\u003eSenD Ok....!\u003c/font\u003e\u003cbr\u003e\u003chr\u003e", "source.strings[1]": "\u003c/b\u003e \u003cfont color=red\u003eError in Sending ??\u003c/font\u003e\u003cbr\u003e\u003chr\u003e", "source.strings[2]": "\u003cfont color=DarkCyan\u003eNumber: ", "source.strings[3]": "\u003cfont color=DarkCyan\u003eNumber: $count \u003cb\u003e", "source.strings[4]": "\u003cfont color=red\u003eNumber: ", "source.strings[5]": "\u003cfont color=red\u003eNumber: $count \u003cb\u003e", "source.strings[6]": "Content-Type: text/html; charset=UTF-8", "source.strings[7]": "Content-Type: text/html; charset=UTF-8\\n", "source.strings[8]": "From: ", "source.strings[9]": "MIME-Version: 1.0", "source.has_imports": true, "source.strings[10]": "MIME-Version: 1.0\\n", "source.strings[11]": "emails", "source.strings[12]": "ssubject", "source.strings[13]": "tmp_name" }, "x": 69, "id": 0, "is": [ "copy", "explode", "stripslashes", "mail" ], "ms": { "file": { "size": 33290.0 }, "text": { "digit_ratio": 0.12, "space_count": 459.0, "total_lines": 115.0, "char_entropy": 6.06, "unique_chars": 91.0, "import_density": 3.48, "lines_over_200": 8.0, "lines_over_500": 6.0, "string_density": 0.4, "avg_line_length": 287.5, "lines_over_1000": 5.0, "max_line_length": 12626.0, "empty_line_ratio": 0.02, "last_line_length": 2.0, "long_token_count": 6.0, "most_common_char": "A", "whitespace_ratio": 0.02, "most_common_ratio": 0.06, "identifier_density": 0.43, "line_length_stddev": 1553.78, "normalized_import_count": 0.37, "normalized_string_count": 4.29, "repeated_char_sequences": 3.0, "suspicious_comment_ratio": 1.33, "max_inline_whitespace_run": 2.0, "trailing_whitespace_lines": 3.0, "suspicious_identifier_ratio": 0.06, "normalized_unique_identifiers": 2.63 }, "imports": { "total": 4.0, "unique_modules": 4.0, "third_party_count": 4.0, "third_party_ratio": 1.0 }, "strings": { "total": 46.0, "avg_length": 12.87, "max_length": 55.0, "avg_entropy": 2.37, "total_bytes": 592.0, "entropy_stddev": 1.31 }, "comments": { "chars": 12785.0, "lines": 3.0, "total": 3.0, "to_code_ratio": 0.03, "base64_in_comments": 2.0, "high_entropy_comments": 2.0 }, "functions": {}, "identifiers": { "total": 50.0, "avg_length": 5.33, "max_length": 12.0, "min_length": 1.0, "avg_entropy": 2.08, "reuse_ratio": 0.36, "unique_count": 18.0, "length_stddev": 2.56, "sequential_names": 1.0, "single_char_count": 1.0, "single_char_ratio": 0.06, "all_lowercase_ratio": 0.89, "all_uppercase_ratio": 0.11, "underscore_prefix_count": 2.0 } }, "ss": [ [ 32412, "file" ], [ 32413, "file" ], [ 32420, "tmp_name" ], [ 32421, "tmp_name" ], [ 32441, "file" ], [ 32442, "file" ], [ 32449, "name" ], [ 32450, "name" ], [ 32477, "veio" ], [ 32478, "veio" ], [ 32525, "bodys" ], [ 32526, "bodys" ], [ 32554, "ssubject" ], [ 32555, "ssubject" ], [ 32583, "nome" ], [ 32584, "nome" ], [ 32608, "de" ], [ 32609, "de" ], [ 32635, "\u003c" ], [ 32636, "\u003c" ], [ 32645, "\u003e" ], [ 32646, "\u003e" ], [ 32664, "emails" ], [ 32665, "emails" ], [ 32693, "\\n" ], [ 32791, "ok" ], [ 32792, "ok" ], [ 32810, "MIME-Version: 1.0\\n" ], [ 32811, "MIME-Version: 1.0" ], [ 32846, "Content-Type: text/html; charset=UTF-8\\n" ], [ 32847, "Content-Type: text/html; charset=UTF-8" ], [ 32903, "From: " ], [ 32904, "From: " ], [ 32927, "\\r\\n" ], [ 32993, "\u003cfont color=DarkCyan\u003eNumber: $count \u003cb\u003e" ], [ 32994, "\u003cfont color=DarkCyan\u003eNumber: " ], [ 33029, " \u003cb\u003e" ], [ 33046, "\u003c/b\u003e \u003cfont color=DarkCyan\u003eSenD Ok....!\u003c/font\u003e\u003cbr\u003e\u003chr\u003e" ], [ 33047, "\u003c/b\u003e \u003cfont color=DarkCyan\u003eSenD Ok....!\u003c/font\u003e\u003cbr\u003e\u003chr\u003e" ], [ 33115, "\u003cfont color=red\u003eNumber: $count \u003cb\u003e" ], [ 33116, "\u003cfont color=red\u003eNumber: " ], [ 33146, " \u003cb\u003e" ], [ 33163, "\u003c/b\u003e \u003cfont color=red\u003eError in Sending ??\u003c/font\u003e\u003cbr\u003e\u003chr\u003e" ], [ 33164, "\u003c/b\u003e \u003cfont color=red\u003eError in Sending ??\u003c/font\u003e\u003cbr\u003e\u003chr\u003e" ], [ 33265, "ok" ], [ 33266, "ok" ] ], "sz": 33290, "ts": [ { "c": 0.8600000143051147, "d": "Regex component marker", "e": [ "method=" ], "i": "objectives/command-and-control/backdoor/webshell/ui::self-named-get-form--rx-3", "l": 1, "m": "B0030" }, { "c": 1.0, "d": "PHP mail() function call", "e": [ "mail" ], "i": "micro-behaviors/process/create/exec::php-mail", "l": 3 }, { "c": 0.949999988079071, "d": "PHP opening tag present", "e": [ "\u003c?php" ], "i": "metadata/lang/scripted::php-open-tag", "l": 1 }, { "c": 0.8999999761581421, "d": "Very long line", "e": [ "text.max_line_length = 12626.00" ], "i": "metadata/file/text/metrics::single-long-line", "l": 1 }, { "c": 0.800000011920929, "d": "PHP copy() symbol", "e": [ "copy" ], "i": "objectives/impact/infect/script::php-copy-call", "l": 1 }, { "c": 0.6000000238418579, "d": "Generates HTML tags", "e": [ "\u003chtml" ], "i": "micro-behaviors/data/format/html::html-generator-tags", "l": 3 }, { "a": "T1059", "c": 0.8500000238418579, "d": "HTTP POST parameter access ($_POST)", "e": [ "$_POST" ], "i": "micro-behaviors/communications/http/request/params::post-dup", "l": 3 }, { "c": 0.8999999761581421, "d": "File has 30 or more lines", "e": [ "text.total_lines = 115.00" ], "i": "metadata/file/text/metrics::file-has-30-plus-lines", "l": 1 }, { "a": "T1505.003", "c": 0.9200000166893005, "d": "HTML tag in script body", "e": [ "\u003chtml\u003e" ], "i": "objectives/command-and-control/remote-command/shell::html-tag-present", "l": 1, "m": "B0030" }, { "d": "Content-Type header string", "e": [ "Content-Type:" ], "i": "micro-behaviors/communications/http/request/client::content-type-header", "l": 1 }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2 }, { "a": "T1105", "c": 0.8500000238418579, "d": "File upload access ($_FILES)", "e": [ "$_FILES" ], "i": "micro-behaviors/communications/http/request/params::files", "l": 3 }, { "c": 0.699999988079071, "d": "PHP error suppression operator usage", "e": [ "@copy($_FILES['file']['tmp_name'], $_FILES['file']['name'])" ], "i": "micro-behaviors/os/stdio::error-suppress-prefix", "l": 3 }, { "a": "T1071.001", "c": 0.6000000238418579, "d": "enctype attribute", "e": [ "enctype=" ], "i": "micro-behaviors/communications/http/post::enctype-attr", "l": 3, "m": "C0002" }, { "a": "T1505.003", "c": 0.8500000238418579, "d": "PHP request superglobal access", "e": [ "$_POST" ], "i": "objectives/command-and-control/backdoor/webshell/upload::php-request-variadic-function-call", "l": 3, "m": "B0030" }, { "c": 0.699999988079071, "d": "base64 encoding keyword", "e": [ "base64" ], "i": "micro-behaviors/data/text/encoded::base64-token", "l": 3 }, { "a": "T1505.003", "c": 0.4000000059604645, "d": "PHP $_POST[...] superglobal access", "e": [ "$_POST[" ], "i": "objectives/command-and-control/backdoor/webshell/request::php-post", "l": 1, "m": "B0030" }, { "a": "T1071.001", "c": 0.6000000238418579, "d": "multipart/form-data content type", "e": [ "multipart/form-data" ], "i": "micro-behaviors/communications/http/post::multipart-form", "l": 1, "m": "C0002" }, { "a": "T1027", "c": 0.699999988079071, "d": "Very low whitespace ratio (minified/compressed)", "e": [ "text.whitespace_ratio = 0.02" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::low-whitespace", "l": 2, "m": "B0032" }, { "c": 0.6000000238418579, "d": "Base64-encoded HTTP protocol fragment", "e": [ "aHR0cDovL" ], "i": "objectives/exfiltration/oob/endpoint::http-b64", "l": 1 }, { "a": "T1027", "c": 0.8500000238418579, "d": "Multiple long lines (\u003e1000 chars)", "e": [ "text.lines_over_1000 = 5.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::very-long-lines", "l": 2, "m": "B0032" }, { "c": 0.699999988079071, "d": "AJAX request handler pattern", "e": [ "$_POST['veio']", "$_POST['bodys']", "$_POST['ssubject']", "$_POST['nome']", "$_POST['de']", "$_POST['emails']" ], "i": "objectives/command-and-control/backdoor/webshell/ui::ajax-handler", "l": 4, "m": "B0030" }, { "a": "T1027", "c": 0.800000011920929, "d": "High overall text entropy (encoded", "e": [ "text.char_entropy = 6.06" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::high-text-entropy", "l": 2, "m": "B0032" }, { "a": "T1027", "c": 0.8999999761581421, "d": "PHP source contains very long line", "e": [ "text.max_line_length = 12626.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/identifiers::php-single-long-line", "l": 4, "m": "B0032" }, { "c": 1.0, "d": "php code embedded in string", "e": [ "Detected php at offset 0x0" ], "i": "metadata/lang/embedded::php", "l": 2 } ], "sha": "04a9b364920330b35bbe72b50770e115f5eb55640410babac0d4b9e6d22e3b90", "path": "/data/samples/bad/datasets/kaker-scripts/php/6683d2dc325816c0ba8df871751476da", "type": "php" } ], "tv": "87c42" } }