{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9536154270172119, "class": 2 } ], "prob": 0.9536154, "class": 2, "models": [ { "m": "az", "prob": 0.41244936, "class": 0 }, { "m": "az/scripts", "prob": 0.27956748, "class": 0 }, { "m": "az/php", "prob": 0.9536154, "class": 2 } ], "version": "v16.16", "thresholds": [ 0.9961138, 0.99909174 ], "analyzed_at": "2026-05-09T03:42:29Z" }, "path": "PrinceDuScam1.php", "raw": { "v": "4", "fs": [ { "f": "O₃(AlC₃I)H(Cm)Md", "k": { "source.imports[0]": "empty", "source.imports[1]": "gethostbyaddr", "source.imports[2]": "header", "source.imports[3]": "in_array", "source.imports[4]": "preg_match", "source.imports[5]": "strpos", "source.imports[6]": "substr_count", "source.strings[0]": "103.248.172.42", "source.strings[1]": "159.203.0.156", "source.strings[2]": "162.243.187.126", "source.strings[3]": "165.227.0.128", "source.strings[4]": "165.227.39.194", "source.strings[5]": "173.239.230.97", "source.strings[6]": "173.239.240.147", "source.strings[7]": "185.229.190.140", "source.strings[8]": "185.230.127.245", "source.strings[9]": "185.75.141.32 ", "source.has_imports": true, "source.strings[10]": "191.205.79.249", "source.strings[11]": "197.206.189.158", "source.strings[12]": "209.66.70.253", "source.strings[13]": "216.162.210.13", "source.strings[14]": "38.127.197.68", "source.strings[15]": "46.101.119.24", "source.strings[16]": "46.101.94.163", "source.strings[17]": "47.30.133.89", "source.strings[18]": "68.65.53.71", "source.strings[19]": "72.12.194.90", "source.strings[20]": "72.12.194.91", "source.strings[21]": "82.102.27.75", "source.strings[22]": "87.113.96.90", "source.strings[23]": "\u003ch1\u003e404 Not Found\u003c/h1\u003eThe page that you have requested could not be found.", "source.strings[24]": "Dr.Web", "source.strings[25]": "Google", "source.strings[26]": "HTTP_USER_AGENT", "source.strings[27]": "Location: http://2m.ma", "source.strings[28]": "MSNBot", "source.strings[29]": "REMOTE_ADDR", "source.strings[30]": "Rambler", "source.strings[31]": "Yandex", "source.strings[32]": "^107.170.*.*", "source.strings[33]": "^109.186.*.*", "source.strings[34]": "^12.148.196.*", "source.strings[35]": "^12.148.209.*", "source.strings[36]": "^128.242.*.*", "source.strings[37]": "^131.212.*.*", "source.strings[38]": "^148.163.128.*", "source.strings[39]": "^149.20.*.*", "source.strings[40]": "^158.108.*.*", "source.strings[41]": "^167.24.*.*", "source.strings[42]": "^168.188.*.*", "source.strings[43]": "^172.111.*.*", "source.strings[44]": "^173.194.*.*", "source.strings[45]": "^173.239.*.*", "source.strings[46]": "^173.244.36.*", "source.strings[47]": "^184.173.*.*", "source.strings[48]": "^185.230.127.*", "source.strings[49]": "^191.205.79.*", "source.strings[50]": "^192.115.134.*", "source.strings[51]": "^192.118.48.*", "source.strings[52]": "^193.220.178.*", "source.strings[53]": "^193.253.199.*", "source.strings[54]": "^193.47.80.*", "source.strings[55]": "^194.52.68.*", "source.strings[56]": "^194.72.238.*", "source.strings[57]": "^194.90.*.*", "source.strings[58]": "^197.206.189.*", "source.strings[59]": "^198.25.*.*", "source.strings[60]": "^198.54.*.*", "source.strings[61]": "^199.30.228.*", "source.strings[62]": "^202.108.252.*", "source.strings[63]": "^204.14.48.*", "source.strings[64]": "^206.28.72.*", "source.strings[65]": "^207.126.144.*", "source.strings[66]": "^208.65.144.*", "source.strings[67]": "^208.91.115.*", "source.strings[68]": "^209.19.*.*", "source.strings[69]": "^209.66.*.*", "source.strings[70]": "^209.66.70.*", "source.strings[71]": "^209.73.228.*", "source.strings[72]": "^209.85.*.*", "source.strings[73]": "^209.85.128.*", "source.strings[74]": "^212.143.*.*", "source.strings[75]": "^212.150.*.*", "source.strings[76]": "^212.235.*.*", "source.strings[77]": "^212.29.192.*", "source.strings[78]": "^212.29.224.*", "source.strings[79]": "^212.50.193.*", "source.strings[80]": "^216.162.210.*", "source.strings[81]": "^216.239.32.*", "source.strings[82]": "^216.252.167.*", "source.strings[83]": "^217.132.*.*", "source.strings[84]": "^38.100.*.*", "source.strings[85]": "^38.105.*.*", "source.strings[86]": "^38.127.197.*", "source.strings[87]": "^38.144.36.*", "source.strings[88]": "^46.116.*.* ", "source.strings[89]": "^49.44.84.*", "source.strings[90]": "^50.7.*.*", "source.strings[91]": "^50.97.*.*", "source.strings[92]": "^54.176.*.*", "source.strings[93]": "^62.116.207.*", "source.strings[94]": "^62.90.*.*", "source.strings[95]": "^64.106.213.*", "source.strings[96]": "^64.124.14.*", "source.strings[97]": "^64.18.*.*", "source.strings[98]": "^64.233.160.*", "source.strings[99]": "^64.27.2.*", "source.strings[100]": "^64.37.103.*", "source.strings[101]": "^64.62.136.*", "source.strings[102]": "^64.62.175.*", "source.strings[103]": "^66.102.*.*", "source.strings[104]": "^66.135.200.*", "source.strings[105]": "^66.150.14.*", "source.strings[106]": "^66.205.64.*", "source.strings[107]": "^66.207.120.*", "source.strings[108]": "^66.221.*.*", "source.strings[109]": "^66.249.*.*", "source.strings[110]": "^67.15.*.*", "source.strings[111]": "^67.209.128.*", "source.strings[112]": "^69.61.12.*", "source.strings[113]": "^69.65.*.*", "source.strings[114]": "^72.14.192.*", "source.strings[115]": "^74.125.*.*", "source.strings[116]": "^81.161.59.*", "source.strings[117]": "^82.166.*.*", "source.strings[118]": "^85.250.*.*", "source.strings[119]": "^85.64.*.*", "source.strings[120]": "^89.138.*.*", "source.strings[121]": "^91.103.66.*", "source.strings[122]": "^93.172.*.*", "source.strings[123]": "amazonaws", "source.strings[124]": "calyxinstitute", "source.strings[125]": "crawler", "source.strings[126]": "cyveillance", "source.strings[127]": "dreamhost", "source.strings[128]": "facebook", "source.strings[129]": "google", "source.strings[130]": "hostinger", "source.strings[131]": "ia_archiver", "source.strings[132]": "messagelabs", "source.strings[133]": "msnbot", "source.strings[134]": "netcraft", "source.strings[135]": "netpilot", "source.strings[136]": "p3pwgdsn", "source.strings[137]": "paypal", "source.strings[138]": "phishtank", "source.strings[139]": "scanurl", "source.strings[140]": "softlayer", "source.strings[141]": "sucuri.net", "source.strings[142]": "tor-exit", "source.strings[143]": "torservers", "source.strings[144]": "trendmicro" }, "x": 3, "id": 0, "is": [ "in_array", "header", "preg_match", "header", "gethostbyaddr", "substr_count", "header", "empty", "strpos", "header" ], "ms": { "file": { "size": 9015.0 }, "text": { "digit_ratio": 0.79, "space_count": 1550.0, "total_lines": 379.0, "char_entropy": 4.39, "unique_chars": 80.0, "import_density": 2.64, "lines_over_200": 1.0, "lines_over_500": 1.0, "string_density": 2.22, "avg_line_length": 21.79, "lines_over_1000": 1.0, "max_line_length": 1025.0, "last_line_length": 1025.0, "long_token_count": 2.0, "most_common_char": ".", "whitespace_ratio": 0.26, "most_common_ratio": 0.13, "identifier_density": 0.08, "line_length_stddev": 51.68, "normalized_import_count": 0.51, "normalized_string_count": 43.15, "max_inline_whitespace_run": 1.0, "suspicious_identifier_ratio": 0.25, "normalized_unique_identifiers": 1.87 }, "imports": { "total": 10.0, "unique_modules": 7.0, "third_party_count": 10.0, "third_party_ratio": 1.0 }, "strings": { "total": 840.0, "ip_count": 76.0, "avg_length": 12.05, "max_length": 74.0, "avg_entropy": 2.79, "total_bytes": 10120.0, "domain_count": 2.0, "entropy_stddev": 0.32 }, "comments": {}, "functions": {}, "identifiers": { "total": 32.0, "avg_length": 7.44, "max_length": 13.0, "min_length": 5.0, "avg_entropy": 2.49, "reuse_ratio": 0.5, "unique_count": 16.0, "length_stddev": 2.37, "hex_like_names": 4.0, "has_digit_ratio": 0.5, "all_lowercase_ratio": 0.44, "all_uppercase_ratio": 0.06, "underscore_prefix_count": 1.0 } }, "ss": [ [ 24, "REMOTE_ADDR" ], [ 25, "REMOTE_ADDR" ], [ 55, "^66.102.*.*" ], [ 56, "^66.102.*.*" ], [ 75, "^38.100.*.*" ], [ 76, "^38.100.*.*" ], [ 95, "^107.170.*.*" ], [ 96, "^107.170.*.*" ], [ 116, "^149.20.*.*" ], [ 117, "^149.20.*.*" ], [ 136, "^38.105.*.*" ], [ 137, "^38.105.*.*" ], [ 156, "^173.239.*.*" ], [ 157, "^173.239.*.*" ], [ 177, "^173.244.36.*" ], [ 178, "^173.244.36.*" ], [ 199, "^74.125.*.*" ], [ 200, "^74.125.*.*" ], [ 219, "^66.150.14.*" ], [ 220, "^66.150.14.*" ], [ 240, "^54.176.*.*" ], [ 241, "^54.176.*.*" ], [ 260, "^38.100.*.*" ], [ 261, "^38.100.*.*" ], [ 280, "^184.173.*.*" ], [ 281, "^184.173.*.*" ], [ 301, "^66.249.*.*" ], [ 302, "^66.249.*.*" ], [ 321, "^128.242.*.*" ], [ 322, "^128.242.*.*" ], [ 342, "^72.14.192.*" ], [ 343, "^72.14.192.*" ], [ 363, "^208.65.144.*" ], [ 364, "^208.65.144.*" ], [ 385, "^74.125.*.*" ], [ 386, "^74.125.*.*" ], [ 405, "^209.85.128.*" ], [ 406, "^209.85.128.*" ], [ 427, "^216.239.32.*" ], [ 428, "^216.239.32.*" ], [ 449, "^74.125.*.*" ], [ 450, "^74.125.*.*" ], [ 469, "^207.126.144.*" ], [ 470, "^207.126.144.*" ], [ 492, "^173.194.*.*" ], [ 493, "^173.194.*.*" ], [ 513, "^64.233.160.*" ], [ 514, "^64.233.160.*" ], [ 535, "^72.14.192.*" ], [ 536, "^72.14.192.*" ], [ 556, "^66.102.*.*" ], [ 557, "^66.102.*.*" ], [ 576, "^64.18.*.*" ], [ 577, "^64.18.*.*" ], [ 595, "^194.52.68.*" ], [ 596, "^194.52.68.*" ], [ 616, "^194.72.238.*" ], [ 617, "^194.72.238.*" ], [ 638, "^62.116.207.*" ], [ 639, "^62.116.207.*" ], [ 660, "^212.50.193.*" ], [ 661, "^212.50.193.*" ], [ 682, "^69.65.*.*" ], [ 683, "^69.65.*.*" ], [ 701, "^50.7.*.*" ], [ 702, "^50.7.*.*" ], [ 719, "^131.212.*.*" ], [ 720, "^131.212.*.*" ], [ 740, "^46.116.*.* " ], [ 741, "^46.116.*.* " ], [ 761, "^62.90.*.*" ], [ 762, "^62.90.*.*" ], [ 780, "^89.138.*.*" ], [ 781, "^89.138.*.*" ], [ 800, "^82.166.*.*" ], [ 801, "^82.166.*.*" ], [ 820, "^85.64.*.*" ], [ 821, "^85.64.*.*" ], [ 839, "^85.250.*.*" ], [ 840, "^85.250.*.*" ], [ 859, "^89.138.*.*" ], [ 860, "^89.138.*.*" ], [ 879, "^93.172.*.*" ], [ 880, "^93.172.*.*" ], [ 899, "^109.186.*.*" ], [ 900, "^109.186.*.*" ], [ 920, "^194.90.*.*" ], [ 921, "^194.90.*.*" ], [ 940, "^212.29.192.*" ], [ 941, "^212.29.192.*" ], [ 962, "^212.29.224.*" ], [ 963, "^212.29.224.*" ], [ 984, "^212.143.*.*" ], [ 985, "^212.143.*.*" ], [ 1005, "^212.150.*.*" ], [ 1006, "^212.150.*.*" ], [ 1026, "^212.235.*.*" ], [ 1027, "^212.235.*.*" ], [ 1047, "^217.132.*.*" ], [ 1048, "^217.132.*.*" ], [ 1068, "^50.97.*.*" ], [ 1069, "^50.97.*.*" ], [ 1087, "^217.132.*.*" ], [ 1088, "^217.132.*.*" ], [ 1108, "^209.85.*.*" ], [ 1109, "^209.85.*.*" ], [ 1128, "^66.205.64.*" ], [ 1129, "^66.205.64.*" ], [ 1149, "^204.14.48.*" ], [ 1150, "^204.14.48.*" ], [ 1170, "^64.27.2.*" ], [ 1171, "^64.27.2.*" ], [ 1189, "^67.15.*.*" ], [ 1190, "^67.15.*.*" ], [ 1208, "^202.108.252.*" ], [ 1209, "^202.108.252.*" ], [ 1231, "^193.47.80.*" ], [ 1232, "^193.47.80.*" ], [ 1252, "^64.62.136.*" ], [ 1253, "^64.62.136.*" ], [ 1273, "^66.221.*.*" ], [ 1274, "^66.221.*.*" ], [ 1293, "^64.62.175.*" ], [ 1294, "^64.62.175.*" ], [ 1314, "^198.54.*.*" ], [ 1315, "^198.54.*.*" ], [ 1334, "^209.66.*.*" ], [ 1335, "^209.66.*.*" ], [ 1354, "^209.19.*.*" ], [ 1355, "^209.19.*.*" ], [ 1374, "^192.115.134.*" ], [ 1375, "^192.115.134.*" ], [ 1397, "^216.252.167.*" ], [ 1398, "^216.252.167.*" ], [ 1420, "^193.253.199.*" ], [ 1421, "^193.253.199.*" ], [ 1443, "^69.61.12.*" ], [ 1444, "^69.61.12.*" ], [ 1463, "^64.37.103.*" ], [ 1464, "^64.37.103.*" ], [ 1484, "^38.144.36.*" ], [ 1485, "^38.144.36.*" ], [ 1505, "^64.124.14.*" ], [ 1506, "^64.124.14.*" ], [ 1526, "^206.28.72.*" ], [ 1527, "^206.28.72.*" ], [ 1547, "^209.73.228.*" ], [ 1548, "^209.73.228.*" ], [ 1569, "^158.108.*.*" ], [ 1570, "^158.108.*.*" ], [ 1590, "^168.188.*.*" ], [ 1591, "^168.188.*.*" ], [ 1611, "^66.207.120.*" ], [ 1612, "^66.207.120.*" ], [ 1633, "^167.24.*.*" ], [ 1634, "^167.24.*.*" ], [ 1653, "^192.118.48.*" ], [ 1654, "^192.118.48.*" ], [ 1675, "^67.209.128.*" ], [ 1676, "^67.209.128.*" ], [ 1697, "^12.148.209.*" ], [ 1698, "^12.148.209.*" ], [ 1719, "^12.148.196.*" ], [ 1720, "^12.148.196.*" ], [ 1741, "^193.220.178.*" ], [ 1742, "^193.220.178.*" ], [ 1764, "68.65.53.71" ], [ 1765, "68.65.53.71" ], [ 1784, "^198.25.*.*" ], [ 1785, "^198.25.*.*" ], [ 1804, "^64.106.213.*" ], [ 1805, "^64.106.213.*" ], [ 1826, "173.239.240.147" ], [ 1827, "173.239.240.147" ], [ 1850, "^216.162.210.*" ], [ 1851, "^216.162.210.*" ], [ 1873, "^209.66.70.*" ], [ 1874, "^209.66.70.*" ], [ 1894, "^148.163.128.*" ], [ 1895, "^148.163.128.*" ], [ 1917, "^49.44.84.*" ], [ 1918, "^49.44.84.*" ], [ 1937, "^38.127.197.*" ], [ 1938, "^38.127.197.*" ], [ 1959, "^191.205.79.*" ], [ 1960, "^191.205.79.*" ], [ 1981, "^185.230.127.*" ], [ 1982, "^185.230.127.*" ], [ 2004, "^197.206.189.*" ], [ 2005, "^197.206.189.*" ], [ 2027, "^66.102.*.*" ], [ 2028, "^66.102.*.*" ], [ 2047, "^38.100.*.*" ], [ 2048, "^38.100.*.*" ], [ 2067, "^107.170.*.*" ], [ 2068, "^107.170.*.*" ], [ 2088, "^149.20.*.*" ], [ 2089, "^149.20.*.*" ], [ 2108, "^38.105.*.*" ], [ 2109, "^38.105.*.*" ], [ 2128, "^74.125.*.*" ], [ 2129, "^74.125.*.*" ], [ 2148, "^66.150.14.*" ], [ 2149, "^66.150.14.*" ], [ 2169, "^54.176.*.*" ], [ 2170, "^54.176.*.*" ], [ 2189, "^38.100.*.*" ], [ 2190, "^38.100.*.*" ], [ 2209, "^184.173.*.*" ], [ 2210, "^184.173.*.*" ], [ 2230, "^66.249.*.*" ], [ 2231, "^66.249.*.*" ], [ 2250, "^128.242.*.*" ], [ 2251, "^128.242.*.*" ], [ 2271, "^72.14.192.*" ], [ 2272, "^72.14.192.*" ], [ 2292, "^208.65.144.*" ], [ 2293, "^208.65.144.*" ], [ 2314, "^74.125.*.*" ], [ 2315, "^74.125.*.*" ], [ 2334, "^209.85.128.*" ], [ 2335, "^209.85.128.*" ], [ 2356, "^216.239.32.*" ], [ 2357, "^216.239.32.*" ], [ 2378, "^74.125.*.*" ], [ 2379, "^74.125.*.*" ], [ 2398, "^207.126.144.*" ], [ 2399, "^207.126.144.*" ], [ 2421, "^173.194.*.*" ], [ 2422, "^173.194.*.*" ], [ 2442, "^64.233.160.*" ], [ 2443, "^64.233.160.*" ], [ 2464, "^72.14.192.*" ], [ 2465, "^72.14.192.*" ], [ 2485, "^66.102.*.*" ], [ 2486, "^66.102.*.*" ], [ 2505, "^64.18.*.*" ], [ 2506, "^64.18.*.*" ], [ 2524, "^194.52.68.*" ], [ 2525, "^194.52.68.*" ], [ 2545, "^194.72.238.*" ], [ 2546, "^194.72.238.*" ], [ 2567, "^62.116.207.*" ], [ 2568, "^62.116.207.*" ], [ 2589, "^212.50.193.*" ], [ 2590, "^212.50.193.*" ], [ 2611, "^69.65.*.*" ], [ 2612, "^69.65.*.*" ], [ 2630, "^50.7.*.*" ], [ 2631, "^50.7.*.*" ], [ 2648, "^131.212.*.*" ], [ 2649, "^131.212.*.*" ], [ 2669, "^46.116.*.* " ], [ 2670, "^46.116.*.* " ], [ 2690, "^62.90.*.*" ], [ 2691, "^62.90.*.*" ] ], "sz": 9015, "ts": [ { "a": "T1027", "c": 0.8999999761581421, "d": "Exactly one line exceeds 1000 chars", "e": [ "text.lines_over_1000 = 1.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::single-long-line-outlier", "l": 1, "m": "B0032" }, { "a": "T1505.003", "d": "PHP open tag", "e": [ "\u003c?php" ], "i": "objectives/command-and-control/backdoor/webshell/request::php-tag", "l": 1, "m": "B0030" }, { "a": "T1217", "c": 0.4000000059604645, "d": "Yandex browser name", "e": [ "Yandex" ], "i": "objectives/discovery/host/browser::yandex-name", "l": 3 }, { "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "ia_archiver" ], "i": "objectives/anti-analysis/browser-detect::bot-ua-list--rx-4", "l": 1 }, { "a": "T1562.001", "c": 0.8999999761581421, "d": "SafeBoot cleanup targets major EDR vendor", "e": [ "trendmicro" ], "i": "objectives/impact/degrade/edr/teardown::safeboot-edr-vendor--rx-4", "l": 1 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Last line is over 1000 chars", "e": [ "text.last_line_length = 1025.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::last-line-over-1000", "l": 1, "m": "B0032" }, { "a": "T1505.003", "c": 1.0, "d": "Inequality check in WordPress user list", "e": [ "!=" ], "i": "objectives/command-and-control/backdoor/webshell/hide::wp-user-hiding-not-trait", "l": 1, "m": "B0030" }, { "c": 0.8600000143051147, "d": "Regex component marker", "e": [ "$_SERVER[" ], "i": "objectives/command-and-control/backdoor/webshell/ui::self-named-get-form--rx-4", "l": 1, "m": "B0030" }, { "c": 0.8999999761581421, "d": "Very long line", "e": [ "text.max_line_length = 1025.00" ], "i": "metadata/file/text/metrics::single-long-line", "l": 1 }, { "c": 0.8999999761581421, "d": "File has 30 or more lines", "e": [ "text.total_lines = 379.00" ], "i": "metadata/file/text/metrics::file-has-30-plus-lines", "l": 1 }, { "c": 0.75, "d": "Generic $_SERVER superglobal access", "e": [ "$_SERVER" ], "i": "micro-behaviors/communications/http/request/params::server-dup", "l": 3 }, { "c": 0.8500000238418579, "d": "Checks User-Agent for crawler detection", "e": [ "$_SERVER['HTTP_USER_AGENT']" ], "i": "objectives/anti-analysis/browser-detect::check-ua-server-var", "l": 3 }, { "c": 0.8500000238418579, "d": "Logic to identify search engine crawlers", "e": [ "$_SERVER['HTTP_USER_AGENT']", "ia_archiver" ], "i": "objectives/anti-analysis/browser-detect::crawler-identification", "l": 3 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Single appended long line in source", "e": [ "text.lines_over_1000 = 1.00", "text.total_lines = 379.00", "text.last_line_length = 1025.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::appended-long-line", "l": 2, "m": "B0032" } ], "sha": "0eab9320e030f2737c1e4cd474a9602edf3dda34e23215da62c107c4caebbb68", "path": "/data/samples/bad/datasets/awesome-malware/PHP/PrinceDuScam1.php", "type": "php" } ], "tv": "a9555" } }