{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9759540557861328, "class": 2 } ], "prob": 0.97595406, "class": 2, "models": [ { "m": "az", "prob": 0.4952941, "class": 0 }, { "m": "az/scripts", "prob": 0.93649, "class": 0 }, { "m": "az/php", "prob": 0.97595406, "class": 2 } ], "version": "v16.16", "thresholds": [ 0.9961138, 0.99909174 ], "analyzed_at": "2026-05-08T21:41:40Z" }, "path": "quest.php", "raw": { "v": "4", "fs": [ { "f": "O(C₂)H₃(Cm₂PoDb)Md", "k": { "source.imports[0]": "getenv", "source.imports[1]": "mail", "source.strings[0]": "----Coded by smalljama----------------", "source.strings[1]": "----Coded by smalljama----------------\\n", "source.strings[2]": "--Coded by smalljama----", "source.strings[3]": "--Coded by smalljama----\\n", "source.strings[4]": "ANZ Bank", "source.strings[5]": "Answer1: ", "source.strings[6]": "Answer2: ", "source.strings[7]": "Answer3: ", "source.strings[8]": "Answer4: ", "source.strings[9]": "Answer5: ", "source.has_imports": true, "source.strings[10]": "Answer6: ", "source.strings[11]": "ERROR! Please go back and try again.", "source.strings[12]": "From: JoELobABa", "source.strings[13]": "MIME-Version: 1.0", "source.strings[14]": "MIME-Version: 1.0\\n", "source.strings[15]": "Question1: ", "source.strings[16]": "Question2: ", "source.strings[17]": "Question3: ", "source.strings[18]": "Question4: ", "source.strings[19]": "Question5: ", "source.strings[20]": "Question6: ", "source.strings[21]": "REMOTE_ADDR", "source.strings[22]": "SYNC Code: ", "source.strings[23]": "answer1", "source.strings[24]": "answer2", "source.strings[25]": "answer3", "source.strings[26]": "answer4", "source.strings[27]": "answer5", "source.strings[28]": "answer6", "source.strings[29]": "eMailAdd", "source.strings[30]": "jbloginbox07@gmail.com,jblogindesign07@hotmail.com,joel.osazie@mail.ru", "source.strings[31]": "question1", "source.strings[32]": "question2", "source.strings[33]": "question3", "source.strings[34]": "question4", "source.strings[35]": "question5", "source.strings[36]": "question6" }, "x": 31, "id": 0, "is": [ "getenv", "mail", "mail" ], "ms": { "file": { "size": 1383.0 }, "text": { "tab_count": 9.0, "digit_ratio": 0.04, "space_count": 103.0, "total_lines": 46.0, "char_entropy": 5.44, "mixed_indent": true, "unique_chars": 81.0, "import_density": 6.52, "string_density": 1.89, "avg_line_length": 28.11, "max_line_length": 86.0, "empty_line_ratio": 0.17, "last_line_length": 2.0, "most_common_char": "e", "whitespace_ratio": 0.15, "most_common_ratio": 0.07, "identifier_density": 0.98, "line_length_stddev": 22.78, "normalized_import_count": 0.44, "normalized_string_count": 12.83, "repeated_char_sequences": 1.0, "max_inline_whitespace_run": 1.0, "trailing_whitespace_lines": 1.0, "normalized_unique_identifiers": 1.45 }, "imports": { "total": 3.0, "unique_modules": 2.0, "third_party_count": 3.0, "third_party_ratio": 1.0 }, "strings": { "total": 87.0, "avg_length": 11.06, "max_length": 70.0, "avg_entropy": 2.79, "total_bytes": 962.0, "entropy_stddev": 0.91 }, "comments": {}, "functions": {}, "identifiers": { "total": 45.0, "avg_length": 5.88, "max_length": 9.0, "min_length": 2.0, "avg_entropy": 2.23, "reuse_ratio": 0.18, "unique_count": 8.0, "length_stddev": 2.03, "all_lowercase_ratio": 0.88, "all_uppercase_ratio": 0.13, "underscore_prefix_count": 1.0 } }, "ss": [ [ 19, "REMOTE_ADDR" ], [ 20, "REMOTE_ADDR" ], [ 48, "--Coded by smalljama----\\n" ], [ 49, "--Coded by smalljama----" ], [ 91, "Question1: " ], [ 92, "Question1: " ], [ 112, "question1" ], [ 113, "question1" ], [ 125, "\\n" ], [ 144, "Answer1: " ], [ 145, "Answer1: " ], [ 163, "answer1" ], [ 164, "answer1" ], [ 174, "\\n" ], [ 193, "Question2: " ], [ 194, "Question2: " ], [ 214, "question2" ], [ 215, "question2" ], [ 227, "\\n" ], [ 246, "Answer2: " ], [ 247, "Answer2: " ], [ 265, "answer2" ], [ 266, "answer2" ], [ 276, "\\n" ], [ 295, "Question3: " ], [ 296, "Question3: " ], [ 316, "question3" ], [ 317, "question3" ], [ 329, "\\n" ], [ 348, "Answer3: " ], [ 349, "Answer3: " ], [ 367, "answer3" ], [ 368, "answer3" ], [ 378, "\\n" ], [ 397, "Question4: " ], [ 398, "Question4: " ], [ 418, "question4" ], [ 419, "question4" ], [ 431, "\\n" ], [ 450, "Answer4: " ], [ 451, "Answer4: " ], [ 469, "answer4" ], [ 470, "answer4" ], [ 480, "\\n" ], [ 499, "Question5: " ], [ 500, "Question5: " ], [ 520, "question5" ], [ 521, "question5" ], [ 533, "\\n" ], [ 552, "Answer5: " ], [ 553, "Answer5: " ], [ 571, "answer5" ], [ 572, "answer5" ], [ 582, "\\n" ], [ 601, "Question6: " ], [ 602, "Question6: " ], [ 622, "question6" ], [ 623, "question6" ], [ 635, "\\n" ], [ 654, "Answer6: " ], [ 655, "Answer6: " ], [ 673, "answer6" ], [ 674, "answer6" ], [ 684, "\\n" ], [ 703, "SYNC Code: " ], [ 704, "SYNC Code: " ], [ 724, "email" ], [ 725, "email" ], [ 733, "\\n" ], [ 752, "IP: " ], [ 753, "IP: " ], [ 763, "\\n" ], [ 782, "----Coded by smalljama----------------\\n" ], [ 783, "----Coded by smalljama----------------" ], [ 846, "jbloginbox07@gmail.com,jblogindesign07@hotmail.com,joel.osazie@mail.ru" ], [ 847, "jbloginbox07@gmail.com,jblogindesign07@hotmail.com,joel.osazie@mail.ru" ], [ 932, "ANZ Bank" ], [ 933, "ANZ Bank" ], [ 956, "From: JoELobABa" ], [ 957, "From: JoELobABa" ], [ 995, "eMailAdd" ], [ 996, "eMailAdd" ], [ 1007, "\\n" ], [ 1026, "MIME-Version: 1.0\\n" ], [ 1027, "MIME-Version: 1.0" ], [ 1329, "ERROR! Please go back and try again." ], [ 1330, "ERROR! Please go back and try again." ] ], "sz": 1383, "ts": [ { "a": "T1505.003", "c": 0.4000000059604645, "d": "PHP $_POST parameter access", "e": [ "$_POST[" ], "i": "objectives/command-and-control/backdoor/webshell/request::php-post", "l": 1, "m": "B0030" }, { "d": "Hardcoded Gmail address", "e": [ "jbloginbox07@gmail.com" ], "i": "micro-behaviors/communications/email/send/mail-func::hardcoded-gmail", "l": 3 }, { "c": 1.0, "d": "PHP mail() function call", "e": [ "mail" ], "i": "micro-behaviors/process/create/exec::php-mail", "l": 3 }, { "c": 0.8999999761581421, "d": "File has 30 or more lines", "e": [ "text.total_lines = 46.00" ], "i": "metadata/file/text/metrics::file-has-30-plus-lines", "l": 1 }, { "a": "T1059", "c": 0.8500000238418579, "d": "HTTP POST parameter access ($_POST)", "e": [ "$_POST" ], "i": "micro-behaviors/communications/http/request/params::post-dup", "l": 3 }, { "a": "T1505.003", "c": 0.8500000238418579, "d": "PHP request superglobal access", "e": [ "$_POST" ], "i": "objectives/command-and-control/backdoor/webshell/upload::php-request-variadic-function-call", "l": 3, "m": "B0030" }, { "c": 0.7599999904632568, "d": "Regex component marker", "e": [ "please" ], "i": "micro-behaviors/data/text/llm/action::llm-path-navigation-action--rx-27", "l": 1 }, { "c": 0.699999988079071, "d": "AJAX request handler pattern", "e": [ "$_POST['answer2']", "$_POST['question6']", "$_POST['answer3']", "$_POST['question1']", "$_POST['question3']", "$_POST['answer5']", "$_POST['answer6']", "$_POST['question4']", "$_POST['eMailAdd']", "$_POST['question2']", "$_POST['email']", "$_POST['answer1']", "$_POST['answer4']", "$_POST['question5']" ], "i": "objectives/command-and-control/backdoor/webshell/ui::ajax-handler", "l": 4, "m": "B0030" } ], "sha": "08ecf926a0ce2bded8a89ce606aa950c192cbe0a3289e032f6a4fb16f35617b0", "path": "/data/samples/bad/datasets/awesome-malware/PHP/quest.php", "type": "php" } ], "tv": "bef72" } }