{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 0.9804288148880005,
        "class": 2
      }
    ],
    "prob": 0.9804288,
    "class": 2,
    "models": [
      {
        "m": "az",
        "prob": 0.38148805,
        "class": 0
      },
      {
        "m": "az/scripts",
        "prob": 0.76434064,
        "class": 0
      },
      {
        "m": "az/php",
        "prob": 0.9804288,
        "class": 2
      }
    ],
    "version": "v16.16",
    "thresholds": [
      0.9961138,
      0.99909174
    ],
    "analyzed_at": "2026-05-09T12:29:03Z"
  },
  "path": "x3.php",
  "raw": {
    "v": "4",
    "fs": [
      {
        "f": "O(C)H(F)Md(Pt)",
        "k": {
          "source.imports[0]": "base64_decode",
          "source.imports[1]": "fopen",
          "source.imports[2]": "fread",
          "source.imports[3]": "str_replace",
          "source.imports[4]": "strtr",
          "source.strings[0]": "2ww.php",
          "source.strings[1]": "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/",
          "source.strings[2]": "EnteryouwkhRHYKNWOUTAaBbCcDdFfGgIiJjLlMmPpQqSsVvXxZz0123456789+/=",
          "source.strings[3]": "O0O000O00",
          "source.strings[4]": "O0O00OO00",
          "source.strings[5]": "OOO00000O",
          "source.strings[6]": "OOO0000O0",
          "source.strings[7]": "OOO000O00",
          "source.strings[8]": "__FILE__",
          "source.strings[9]": "base64_d",
          "source.has_imports": true,
          "source.strings[10]": "fg6sbehpra4co_tnd"
        },
        "x": 2,
        "id": 0,
        "is": [
          "fopen",
          "fread",
          "fread",
          "str_replace",
          "base64_decode",
          "strtr",
          "fread"
        ],
        "ms": {
          "file": {
            "size": 812.0
          },
          "text": {
            "digit_ratio": 0.2,
            "space_count": 62.0,
            "total_lines": 17.0,
            "char_entropy": 5.51,
            "unique_chars": 82.0,
            "import_density": 41.18,
            "lines_over_200": 1.0,
            "string_density": 2.53,
            "avg_line_length": 46.76,
            "max_line_length": 245.0,
            "last_line_length": 18.0,
            "most_common_char": "0",
            "whitespace_ratio": 0.1,
            "most_common_ratio": 0.09,
            "identifier_density": 1.35,
            "line_length_stddev": 51.61,
            "encoded_string_ratio": 0.05,
            "normalized_import_count": 1.7,
            "normalized_string_count": 10.43,
            "max_inline_whitespace_run": 1.0,
            "normalized_unique_identifiers": 2.45
          },
          "imports": {
            "total": 7.0,
            "unique_modules": 5.0,
            "third_party_count": 7.0,
            "third_party_ratio": 1.0
          },
          "strings": {
            "total": 43.0,
            "avg_length": 12.53,
            "max_length": 65.0,
            "avg_entropy": 2.08,
            "total_bytes": 539.0,
            "entropy_stddev": 1.55,
            "base64_candidates": 2.0,
            "high_entropy_count": 4.0
          },
          "comments": {},
          "functions": {},
          "identifiers": {
            "total": 23.0,
            "avg_length": 7.9,
            "max_length": 13.0,
            "min_length": 5.0,
            "avg_entropy": 2.04,
            "reuse_ratio": 0.43,
            "unique_count": 10.0,
            "length_stddev": 2.62,
            "has_digit_ratio": 0.4,
            "all_lowercase_ratio": 0.5,
            "all_uppercase_ratio": 0.1,
            "numeric_suffix_count": 3.0
          }
        },
        "ss": [
          [
            19,
            "fg6sbehpra4co_tnd"
          ],
          [
            20,
            "fg6sbehpra4co_tnd"
          ],
          [
            49,
            "OOO0000O0"
          ],
          [
            50,
            "OOO0000O0"
          ],
          [
            64,
            "base64_d"
          ],
          [
            65,
            "base64_d"
          ],
          [
            85,
            "OOO0000O0"
          ],
          [
            86,
            "OOO0000O0"
          ],
          [
            101,
            "ecode"
          ],
          [
            102,
            "ecode"
          ],
          [
            119,
            "OOO000O00"
          ],
          [
            120,
            "OOO000O00"
          ],
          [
            134,
            "fopen"
          ],
          [
            135,
            "fopen"
          ],
          [
            152,
            "O0O000O00"
          ],
          [
            153,
            "O0O000O00"
          ],
          [
            167,
            "fget"
          ],
          [
            168,
            "fget"
          ],
          [
            184,
            "O0O000O00"
          ],
          [
            185,
            "O0O000O00"
          ],
          [
            199,
            "fgets"
          ],
          [
            200,
            "fgets"
          ],
          [
            217,
            "O0O00OO00"
          ],
          [
            218,
            "O0O00OO00"
          ],
          [
            232,
            "fread"
          ],
          [
            233,
            "fread"
          ],
          [
            250,
            "OOO00000O"
          ],
          [
            251,
            "OOO00000O"
          ],
          [
            265,
            "strtr"
          ],
          [
            266,
            "strtr"
          ],
          [
            287,
            "2ww.php"
          ],
          [
            288,
            "2ww.php"
          ],
          [
            314,
            "2ww.php"
          ],
          [
            315,
            "2ww.php"
          ],
          [
            325,
            "r"
          ],
          [
            326,
            "r"
          ],
          [
            572,
            "__FILE__"
          ],
          [
            573,
            "__FILE__"
          ],
          [
            584,
            "\\"
          ],
          [
            653,
            "EnteryouwkhRHYKNWOUTAaBbCcDdFfGgIiJjLlMmPpQqSsVvXxZz0123456789+/="
          ],
          [
            654,
            "EnteryouwkhRHYKNWOUTAaBbCcDdFfGgIiJjLlMmPpQqSsVvXxZz0123456789+/="
          ],
          [
            722,
            "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"
          ],
          [
            723,
            "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"
          ]
        ],
        "sz": 812,
        "ts": [
          {
            "c": 0.949999988079071,
            "d": "PHP open tag (\u003c?php)",
            "e": [
              "\u003c?php"
            ],
            "i": "metadata/lang/scripted::php-open-tag",
            "l": 1
          },
          {
            "a": "T1027.010",
            "d": "Hardcoded standard base64 alphabet",
            "e": [
              "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"
            ],
            "i": "micro-behaviors/data/encode/base64::alphabet-standard",
            "l": 2,
            "m": "B0032.001"
          },
          {
            "a": "T1059",
            "c": 0.800000011920929,
            "d": "Self-reference via __FILE__",
            "e": [
              "__FILE__"
            ],
            "i": "micro-behaviors/fs/read/self::self-file-reference",
            "l": 3
          },
          {
            "a": "T1505.003",
            "c": 0.8999999761581421,
            "d": "PHP source imports base64_decode",
            "e": [
              "[base64_decode, fopen, fread, str_replace, strtr]"
            ],
            "i": "objectives/command-and-control/backdoor/webshell/stager::source-import-base64-decode",
            "l": 1
          },
          {
            "a": "T1546",
            "c": 1.0,
            "d": "Writes data to a file via functions",
            "e": [
              "fopen("
            ],
            "i": "micro-behaviors/fs/file/write/direct::php-file-write-func",
            "l": 2
          }
        ],
        "sha": "228eb3a92aec13035c5c9878b58a56b25da4a4eba80466b21fb178be05108504",
        "path": "x3.php",
        "type": "php"
      }
    ],
    "tv": "0a4d2"
  }
}