{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9997071623802185, "class": 2 } ], "prob": 0.99970716, "class": 2, "models": [ { "m": "az", "prob": 0.9774599, "class": 0 }, { "m": "az/scripts", "prob": 0.99970716, "class": 2 }, { "m": "az/php", "prob": 0.9996848, "class": 2 } ], "version": "v16.16", "thresholds": [ 0.9961138, 0.99909174 ], "analyzed_at": "2026-05-09T22:42:01Z" }, "path": "hd1.php", "raw": { "v": "4", "fs": [ { "f": "KO₃(As₂C₆Ca)H₆(Db₅Po₂CmCrF₂Os)Md₂(Pt)", "k": { "source.imports[0]": "array_flip", "source.imports[1]": "array_merge", "source.imports[2]": "chr", "source.imports[3]": "decode_base64", "source.imports[4]": "define", "source.imports[5]": "defined", "source.imports[6]": "error_reporting", "source.imports[7]": "eval", "source.imports[8]": "file_get_contents", "source.imports[9]": "file_put_contents", "source.strings[0]": "/\\(.*\\$/", "source.strings[1]": "7fb3a379-7087-4028-b2ca-7a0985866dc9", "source.strings[2]": "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=", "source.strings[3]": "DIRECTORY_SEPARATOR", "source.strings[4]": "PHP_EOL", "source.strings[5]": "\\n\\n//", "source.strings[6]": "`ab%+7fol .3~mso`jrw=1.exez((/2:", "source.strings[7]": "error_log", "source.strings[8]": "file_put_contents ", "source.strings[9]": "log_errors", "source.has_imports": true, "source.imports[10]": "get_attributes", "source.imports[11]": "get_filename", "source.imports[12]": "ini_set", "source.imports[13]": "isset", "source.imports[14]": "main", "source.imports[15]": "md5", "source.imports[16]": "my_decode", "source.imports[17]": "my_encode", "source.imports[18]": "ord", "source.imports[19]": "phpversion", "source.imports[20]": "preg_replace", "source.imports[21]": "rawurldecode", "source.imports[22]": "rawurlencode", "source.imports[23]": "serialize", "source.imports[24]": "set_attribute", "source.imports[25]": "set_attributes", "source.imports[26]": "set_time_limit", "source.imports[27]": "str_replace", "source.imports[28]": "str_split", "source.imports[29]": "strcmp", "source.imports[30]": "strlen", "source.imports[31]": "strpos", "source.imports[32]": "substr", "source.imports[33]": "trim", "source.imports[34]": "unserialize", "source.imports[35]": "unset_attribute", "source.imports[36]": "xorstring", "source.strings[10]": "max_execution_time", "source.strings[11]": "plugin", "source.strings[12]": "~[^A-Za-z0-9\\+\\/\\=]~", "source.functions[0]": "decode_base64", "source.functions[1]": "get_attributes", "source.functions[2]": "get_filename", "source.functions[3]": "main", "source.functions[4]": "my_decode", "source.functions[5]": "my_encode", "source.functions[6]": "set_attribute", "source.functions[7]": "set_attributes", "source.functions[8]": "unset_attribute", "source.functions[9]": "xorstring" }, "x": 216, "id": 0, "is": [ "ini_set", "ini_set", "ini_set", "error_reporting", "set_time_limit", "defined", "define", "defined", "define", "defined", "define", "strlen", "str_split", "array_flip", "preg_replace", "chr", "chr", "chr", "strlen", "trim", "preg_replace", "strlen", "strlen", "strlen", "chr", "ord", "ord", "xorstring", "xorstring", "xorstring", "xorstring", "file_get_contents", "get_filename", "strpos", "md5", "get_filename", "substr", "unserialize", "my_encode", "rawurldecode", "md5", "get_filename", "rawurlencode", "my_decode", "serialize", "md5", "get_filename", "file_get_contents", "get_filename", "strpos", "md5", "get_filename", "substr", "str_replace", "md5", "get_filename", "file_put_contents", "get_filename", "get_attributes", "decode_base64", "set_attributes", "get_attributes", "set_attributes", "get_attributes", "strcmp", "eval", "eval", "array_merge", "unserialize", "my_encode", "decode_base64", "isset", "phpversion", "serialize", "eval", "set_attribute", "unset_attribute", "main" ], "ms": { "file": { "size": 6108.0 }, "text": { "tab_count": 41.0, "digit_ratio": 0.05, "space_count": 1835.0, "total_lines": 224.0, "char_entropy": 4.7, "mixed_indent": true, "unique_chars": 95.0, "import_density": 34.82, "string_density": 0.34, "avg_line_length": 25.27, "max_line_length": 96.0, "empty_line_ratio": 0.17, "last_line_length": 1.0, "most_common_char": "e", "whitespace_ratio": 0.38, "most_common_ratio": 0.05, "identifier_density": 1.09, "line_length_stddev": 23.09, "normalized_import_count": 5.21, "normalized_string_count": 5.08, "repeated_char_sequences": 64.0, "max_inline_whitespace_run": 2.0, "normalized_function_count": 0.67, "imports_to_functions_ratio": 7.8, "strings_to_functions_ratio": 7.6, "suspicious_identifier_ratio": 0.1, "normalized_unique_identifiers": 9.09, "identifiers_to_functions_ratio": 7.1 }, "imports": { "total": 78.0, "unique_modules": 37.0, "third_party_count": 78.0, "third_party_ratio": 1.0 }, "strings": { "total": 76.0, "avg_length": 7.97, "max_length": 65.0, "path_count": 4.0, "avg_entropy": 1.61, "total_bytes": 606.0, "entropy_stddev": 1.48, "high_entropy_count": 2.0 }, "comments": { "chars": 578.0, "lines": 16.0, "total": 16.0, "to_code_ratio": 0.08 }, "functions": { "total": 10.0, "length_stddev": 10.16, "avg_name_length": 11.2, "no_params_count": 10.0, "avg_length_lines": 14.2, "max_length_lines": 38.0, "min_length_lines": 4.0, "density_per_100_lines": 4.46, "code_in_functions_ratio": 0.63 }, "identifiers": { "total": 244.0, "avg_length": 7.92, "max_length": 17.0, "min_length": 2.0, "avg_entropy": 2.44, "reuse_ratio": 0.29, "unique_count": 71.0, "length_stddev": 4.08, "has_digit_ratio": 0.15, "sequential_names": 7.0, "all_lowercase_ratio": 0.8, "all_uppercase_ratio": 0.04, "numeric_suffix_count": 10.0, "double_underscore_count": 1.0, "underscore_prefix_count": 3.0 } }, "ss": [ [ 18, "error_log" ], [ 19, "error_log" ], [ 48, "log_errors" ], [ 49, "log_errors" ], [ 76, "max_execution_time" ], [ 77, "max_execution_time" ], [ 162, "PHP_EOL" ], [ 163, "PHP_EOL" ], [ 189, "PHP_EOL" ], [ 190, "PHP_EOL" ], [ 200, "\\n" ], [ 225, "DIRECTORY_SEPARATOR" ], [ 226, "DIRECTORY_SEPARATOR" ], [ 264, "DIRECTORY_SEPARATOR" ], [ 265, "DIRECTORY_SEPARATOR" ], [ 287, "/" ], [ 288, "/" ], [ 312, "file_put_contents " ], [ 313, "file_put_contents " ], [ 376, "file_put_contents " ], [ 377, "file_put_contents " ], [ 508, "7fb3a379-7087-4028-b2ca-7a0985866dc9" ], [ 509, "7fb3a379-7087-4028-b2ca-7a0985866dc9" ], [ 775, "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=" ], [ 776, "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=" ], [ 1137, "~[^A-Za-z0-9\\+\\/\\=]~" ], [ 1138, "~[^A-Za-z0-9\\+\\/\\=]~" ], [ 1959, "/\\(.*\\$/" ], [ 1960, "/\\(.*" ], [ 1967, "/" ], [ 3747, "\\n\\n//" ], [ 3752, "//" ], [ 5024, "ak" ], [ 5025, "ak" ], [ 5051, "ak" ], [ 5052, "ak" ], [ 5150, "a" ], [ 5151, "a" ], [ 5158, "i" ], [ 5159, "i" ], [ 5262, "pv" ], [ 5263, "pv" ], [ 5306, "sv" ], [ 5307, "sv" ], [ 5314, "2.0-1" ], [ 5315, "2.0-1" ], [ 5383, "ak" ], [ 5384, "ak" ], [ 5398, "ak" ], [ 5399, "ak" ], [ 5536, "a" ], [ 5537, "a" ], [ 5544, "e" ], [ 5545, "e" ], [ 5610, "d" ], [ 5611, "d" ], [ 5691, "a" ], [ 5692, "a" ], [ 5699, "plugin" ], [ 5700, "plugin" ], [ 5751, "sa" ], [ 5752, "sa" ], [ 5760, "add" ], [ 5761, "add" ], [ 5828, "p" ], [ 5829, "p" ], [ 5841, "d" ], [ 5842, "d" ], [ 5898, "sa" ], [ 5899, "sa" ], [ 5907, "rem" ], [ 5908, "rem" ], [ 5977, "p" ], [ 5978, "p" ], [ 6043, "ak" ], [ 6044, "ak" ], [ 2139, "xor", "`ab%+7fol .3~mso`jrw=1.exez((/2:" ] ], "sz": 6108, "ts": [ { "c": 0.8399999737739563, "d": "password/token/api_key field keyword", "e": [ "password" ], "i": "micro-behaviors/data/text/keywords/credential::credential-field", "l": 1 }, { "a": "T1105", "c": 0.800000011920929, "d": "Creates or overwrites a local file", "e": [ "file_put_contents" ], "i": "micro-behaviors/fs/write/file/direct::file-put-contents", "l": 3, "m": "C0052" }, { "a": "T1027", "c": 0.9200000166893005, "d": "Dense eval/create_function variable calls", "e": [ " eval($" ], "i": "objectives/anti-static/obfuscation/string/encoding::dense-eval-calls", "l": 4, "m": "B0032" }, { "c": 0.699999988079071, "d": "\"directory\" path-target noun", "e": [ "directory" ], "i": "micro-behaviors/data/text/llm/action::llm-path-noun-directory", "l": 1 }, { "c": 0.949999988079071, "d": "PHP opening tag present", "e": [ "\u003c?php" ], "i": "metadata/lang/scripted::php-open-tag", "l": 1 }, { "a": "T1059", "c": 0.8500000238418579, "d": "HTTP POST parameter access ($_POST)", "e": [ "$_POST" ], "i": "micro-behaviors/communications/http/request/params::post-dup", "l": 3 }, { "a": "T1027", "c": 0.949999988079071, "d": "UUID literal present in PHP source", "e": [ "7fb3a379-7087-4028-b2ca-7a0985866dc9" ], "i": "objectives/anti-static/obfuscation/encoding/xor::uuid-literal", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "HTTP Cookie access ($_COOKIE)", "e": [ "$_COOKIE" ], "i": "micro-behaviors/communications/http/request/params::cookie", "l": 3 }, { "a": "T1059", "c": 0.800000011920929, "d": "Self-reference via __FILE__", "e": [ "__FILE__" ], "i": "micro-behaviors/fs/read/self::self-file-reference", "l": 3 }, { "c": 0.8999999761581421, "d": "File has 30 or more lines", "e": [ "text.total_lines = 224.00" ], "i": "metadata/file/text/metrics::file-has-30-plus-lines", "l": 1 }, { "c": 0.8500000238418579, "d": "Removes PHP script execution time limit", "e": [ "@set_time_limit(0)" ], "i": "objectives/command-and-control/backdoor/webshell/session::unlimited-runtime-call", "l": 4 }, { "a": "T1027", "c": 0.6499999761581421, "d": "serialize/unserialize for object serialization", "e": [ "unserialize(" ], "i": "objectives/anti-static/obfuscation/encoding/xor::serialize-call", "l": 2, "m": "B0032" }, { "a": "T1059", "c": 0.6499999761581421, "d": "PHP object deserialization call", "e": [ "unserialize" ], "i": "micro-behaviors/data/serialize/object::unserialize", "l": 3, "m": "E1059" }, { "c": 0.800000011920929, "d": "Sequential source identifier names", "e": [ "identifiers.sequential_names = 7.00" ], "i": "metadata/file/text/profile::sequential-identifiers", "l": 2 }, { "a": "T1059.006", "c": 0.75, "d": "PHP eval() token present", "e": [ "eval" ], "i": "micro-behaviors/process/interpreter/eval::eval-symbol", "l": 4, "m": "E1059" }, { "c": 0.699999988079071, "d": "PHP object serialization", "e": [ "serialize" ], "i": "micro-behaviors/data/serialize/object::serialize", "l": 3 }, { "a": "T1505.003", "c": 0.8799999952316284, "d": "Regex component marker", "e": [ "eval" ], "i": "objectives/command-and-control/backdoor/webshell/exec::dangerous-php-function-cluster--rx-16", "l": 1, "m": "B0030" }, { "c": 0.949999988079071, "d": "Disables error reporting (error_reporting(0))", "e": [ "error_reporting(0)" ], "i": "micro-behaviors/os/stdio::error-reporting-off", "l": 3 }, { "c": 0.699999988079071, "d": "PHP error suppression operator usage", "e": [ "@error_reporting(0)", "@file_get_contents(get_filename())", "@unserialize(\r\n\t\t\t\tmy_encode(\r\n\t\t\t\t\trawurldecode($tmp_str),\r\n\t\t\t\t\tmd5(get_filename())\r\n\t\t\t\t)\r\n\t\t\t)", "@ini_set('log_errors', 0)", "@serialize($zivtfol)", "@set_time_limit(0)", "@unserialize(my_encode(decode_base64($value), $name))", "@ini_set('max_execution_time', 0)", "@file_put_contents(get_filename(), $xiulds)", "@phpversion()", "@ini_set('error_log', NULL)", "@serialize($siteinfo)" ], "i": "micro-behaviors/os/stdio::error-suppress-prefix", "l": 3 }, { "c": 0.699999988079071, "d": "MD5 hash computation", "e": [ "md5" ], "i": "micro-behaviors/crypto/hash/digest::md5-php", "l": 3, "m": "C0029" }, { "a": "T1505.003", "c": 0.9399999976158142, "d": "file_get_contents (raw POST body reader)", "e": [ "file_get_contents" ], "i": "objectives/command-and-control/backdoor/webshell/request::raw-json-post-cmd-field--rx-7", "l": 1, "m": "B0030" }, { "d": "password keyword", "e": [ "password" ], "i": "micro-behaviors/data/text/keywords/lexicon::password", "l": 1 }, { "c": 0.8600000143051147, "d": "Error-suppressed unserialize call", "e": [ "@unserialize(" ], "i": "micro-behaviors/data/serialize/object::error-suppressed-unserialize", "l": 4 }, { "a": "T1505.003", "c": 0.8500000238418579, "d": "PHP request superglobal access", "e": [ "$_POST" ], "i": "objectives/command-and-control/backdoor/webshell/upload::php-request-variadic-function-call", "l": 3, "m": "B0030" }, { "c": 0.699999988079071, "d": "base64 encoding keyword", "e": [ "base64" ], "i": "micro-behaviors/data/text/encoded::base64-token", "l": 3 }, { "a": "T1546", "c": 1.0, "d": "Writes data to a file via functions", "e": [ "file_put_contents(" ], "i": "micro-behaviors/fs/file/write/direct::php-file-write-func", "l": 2 }, { "a": "T1505.003", "c": 0.8999999761581421, "d": "PHP source imports file_put_contents", "e": [ "[array_flip, array_merge, chr, decode_base64, define, defined, error_reporting, eval, file_get_contents, file_put_contents, get_" ], "i": "objectives/command-and-control/backdoor/webshell/stager::source-import-file-put-contents", "l": 1 }, { "a": "T1027.010", "d": "Hardcoded standard base64 alphabet", "e": [ "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" ], "i": "micro-behaviors/data/encode/base64::alphabet-standard", "l": 2, "m": "B0032.001" }, { "a": "T1505.003", "c": 0.8999999761581421, "d": "Merged COOKIE and POST inputs", "e": [ "$_COOKIE, $_POST" ], "i": "objectives/command-and-control/backdoor/webshell/archive::cookie-post-merge", "l": 4, "m": "B0030" }, { "a": "T1027", "c": 0.9399999976158142, "d": "Architecture keyed encoded blob value", "e": [ "\"a1a1fd5781c87fc2bab6b91cca71963d\"" ], "i": "objectives/anti-static/obfuscation/payload/config::arch-keyed-hex-blob-dict--encoded-value", "l": 1, "m": "B0032" }, { "c": 0.9700000286102295, "d": "ALFA custom base64 alphabet", "e": [ "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=" ], "i": "well-known/malware/webshell/alfa::alfa-base64-alphabet", "l": 4 }, { "c": 0.699999988079071, "d": "Remove execution time limit", "e": [ "set_time_limit" ], "i": "micro-behaviors/process/control/signal::set-time-limit", "l": 3 }, { "a": "T1566.002", "c": 0.8500000238418579, "d": "PHP script writing POST data to local file", "e": [ "$_POST", "file_put_contents(" ], "i": "objectives/credential-access/phishing/tactics::php-credential-exfiltration", "l": 4, "m": "B0030" } ], "sha": "052e85f798108e6fa9013af542adf76ba16def1eac67509c54745741b54de3aa", "path": "/data/samples/bad/datasets/php-malware-analysis/backdoors/cscript/ico/hd1.php", "type": "php" } ], "tv": "87c42" } }