{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9991268515586853, "class": 2 } ], "prob": 0.99912685, "class": 2, "models": [ { "m": "az", "prob": 0.9688271, "class": 0 }, { "m": "az/scripts", "prob": 0.9798055, "class": 0 }, { "m": "az/php", "prob": 0.99912685, "class": 2 } ], "version": "v16.16", "thresholds": [ 0.9961138, 0.99909174 ], "analyzed_at": "2026-05-09T06:31:11Z" }, "path": "decode_sess.php", "raw": { "v": "4", "fs": [ { "f": "O₄(C₅AlDyI)H₅(CmCrF₃OsDb)Md", "k": { "source.imports[0]": "abs", "source.imports[1]": "base64_decode", "source.imports[2]": "basename", "source.imports[3]": "bcmul", "source.imports[4]": "crc32", "source.imports[5]": "curl_close", "source.imports[6]": "curl_exec", "source.imports[7]": "curl_init", "source.imports[8]": "curl_setopt", "source.imports[9]": "dirname", "source.strings[0]": "/bot|crawl|spider|mediapartners|slurp|patrol/i", "source.strings[1]": "/sess_", "source.strings[2]": "19131421", "source.strings[3]": "ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789abcdefghijklmnopqrstuvwxyz-_-_/", "source.strings[4]": "HTTP_USER_AGENT", "source.strings[5]": "HTTP_X_FORWARDED_PROTO", "source.strings[6]": "HTTP_X_FORWARDED_SSL", "source.strings[7]": "REQUEST_URI", "source.strings[8]": "SCRIPT_NAME", "source.strings[9]": "SERVER_NAME", "source.has_imports": true, "source.imports[10]": "empty", "source.imports[11]": "fclose", "source.imports[12]": "file_exists", "source.imports[13]": "file_get_contents", "source.imports[14]": "filemtime", "source.imports[15]": "fopen", "source.imports[16]": "fread", "source.imports[17]": "function_exists", "source.imports[18]": "fwrite", "source.imports[19]": "get_between", "source.imports[20]": "get_temp_dir_mass", "source.imports[21]": "http_get", "source.imports[22]": "ini_get", "source.imports[23]": "is_readable", "source.imports[24]": "is_writeable", "source.imports[25]": "isset", "source.imports[26]": "local_host", "source.imports[27]": "md5", "source.imports[28]": "mt_rand", "source.imports[29]": "preg_match", "source.imports[30]": "realpath", "source.imports[31]": "session_save_path", "source.imports[32]": "str_ireplace", "source.imports[33]": "stristr", "source.imports[34]": "strlen", "source.imports[35]": "strpos", "source.imports[36]": "strtolower", "source.imports[37]": "substr", "source.imports[38]": "sys_get_temp_dir", "source.imports[39]": "tempnam", "source.imports[40]": "time", "source.imports[41]": "unlink", "source.strings[10]": "SERVER_PORT", "source.strings[11]": "TMPDIR", "source.strings[12]": "abcdefghijklmnopqrstuvwxyz", "source.strings[13]": "curl_init", "source.strings[14]": "file_get_contents", "source.strings[15]": "http://", "source.strings[16]": "https://", "source.strings[17]": "index.php", "source.strings[18]": "sys_get_temp_dir", "source.strings[19]": "update", "source.strings[20]": "upload_tmp_dir", "source.functions[0]": "_base_url", "source.functions[1]": "_get_between", "source.functions[2]": "_get_cache", "source.functions[3]": "_get_temp_dir_mass", "source.functions[4]": "_http_get", "source.functions[5]": "_local_host", "source.functions[6]": "_local_url", "source.functions[7]": "hashCode", "source.functions[8]": "isBot", "source.functions[9]": "rand_str" }, "x": 39, "id": 0, "is": [ "function_exists", "is_writeable", "sys_get_temp_dir", "is_readable", "sys_get_temp_dir", "realpath", "sys_get_temp_dir", "empty", "is_writeable", "realpath", "is_readable", "realpath", "empty", "is_writeable", "realpath", "is_readable", "realpath", "empty", "is_writeable", "realpath", "is_readable", "realpath", "tempnam", "file_exists", "unlink", "is_writeable", "realpath", "dirname", "is_readable", "realpath", "dirname", "realpath", "dirname", "is_writeable", "realpath", "ini_get", "is_readable", "realpath", "ini_get", "realpath", "ini_get", "is_writeable", "realpath", "session_save_path", "is_readable", "realpath", "session_save_path", "realpath", "session_save_path", "is_writeable", "realpath", "dirname", "is_readable", "realpath", "dirname", "realpath", "dirname", "isset", "preg_match", "empty", "md5", "substr", "substr", "abs", "crc32", "abs", "crc32", "substr", "bcmul", "mt_rand", "strlen", "mt_rand", "mt_rand", "strlen", "mt_rand", "function_exists", "file_get_contents", "function_exists", "curl_init", "curl_setopt", "curl_setopt", "curl_setopt", "curl_exec", "curl_close", "function_exists", "fopen", "fread", "strlen", "fclose", "isset", "empty", "empty", "get_temp_dir_mass", "md5", "file_get_contents", "file_exists", "isset", "stristr", "stristr", "time", "filemtime", "http_get", "fopen", "fwrite", "fclose", "local_host", "local_host", "str_ireplace", "str_ireplace", "basename", "str_ireplace", "dirname", "stristr", "strtolower", "substr", "strlen", "strpos", "strlen", "strpos", "base64_decode", "get_between" ], "ms": { "file": { "size": 5315.0 }, "text": { "digit_ratio": 0.03, "space_count": 1067.0, "total_lines": 155.0, "char_entropy": 5.13, "unique_chars": 91.0, "import_density": 78.06, "string_density": 0.81, "avg_line_length": 33.29, "max_line_length": 196.0, "last_line_length": 17.0, "most_common_char": "t", "whitespace_ratio": 0.23, "most_common_ratio": 0.05, "identifier_density": 1.95, "line_length_stddev": 33.8, "encoded_string_ratio": 0.02, "normalized_import_count": 9.72, "normalized_string_count": 10.12, "repeated_char_sequences": 10.0, "max_inline_whitespace_run": 1.0, "normalized_function_count": 0.8, "imports_to_functions_ratio": 12.1, "strings_to_functions_ratio": 12.6, "suspicious_identifier_ratio": 0.01, "normalized_unique_identifiers": 12.09, "identifiers_to_functions_ratio": 8.8 }, "imports": { "total": 121.0, "unique_modules": 42.0, "third_party_count": 121.0, "third_party_ratio": 1.0 }, "strings": { "total": 126.0, "url_count": 4.0, "avg_length": 9.0, "max_length": 67.0, "path_count": 4.0, "avg_entropy": 2.14, "hex_strings": 2.0, "total_bytes": 1134.0, "entropy_stddev": 1.31, "high_entropy_count": 2.0 }, "comments": {}, "functions": { "total": 10.0, "length_stddev": 9.08, "avg_name_length": 10.0, "no_params_count": 10.0, "avg_length_lines": 15.2, "max_length_lines": 33.0, "min_length_lines": 4.0, "density_per_100_lines": 6.45, "code_in_functions_ratio": 0.98 }, "identifiers": { "total": 303.0, "avg_length": 7.56, "max_length": 22.0, "min_length": 1.0, "avg_entropy": 2.4, "reuse_ratio": 0.29, "unique_count": 88.0, "length_stddev": 4.28, "has_digit_ratio": 0.08, "sequential_names": 1.0, "single_char_count": 1.0, "single_char_ratio": 0.01, "all_lowercase_ratio": 0.81, "all_uppercase_ratio": 0.08, "numeric_suffix_count": 6.0, "double_underscore_count": 1.0, "underscore_prefix_count": 12.0 } }, "ss": [ [ 62, "sys_get_temp_dir" ], [ 63, "sys_get_temp_dir" ], [ 256, "TMP" ], [ 257, "TMP" ], [ 296, "TMP" ], [ 297, "TMP" ], [ 327, "TMP" ], [ 328, "TMP" ], [ 368, "TMP" ], [ 369, "TMP" ], [ 404, "TMPDIR" ], [ 405, "TMPDIR" ], [ 447, "TMPDIR" ], [ 448, "TMPDIR" ], [ 481, "TMPDIR" ], [ 482, "TMPDIR" ], [ 525, "TMPDIR" ], [ 526, "TMPDIR" ], [ 564, "TEMP" ], [ 565, "TEMP" ], [ 605, "TEMP" ], [ 606, "TEMP" ], [ 637, "TEMP" ], [ 638, "TEMP" ], [ 679, "TEMP" ], [ 680, "TEMP" ], [ 1008, "upload_tmp_dir" ], [ 1009, "upload_tmp_dir" ], [ 1062, "upload_tmp_dir" ], [ 1063, "upload_tmp_dir" ], [ 1118, "upload_tmp_dir" ], [ 1119, "upload_tmp_dir" ], [ 1495, "HTTP_USER_AGENT" ], [ 1496, "HTTP_USER_AGENT" ], [ 1529, "/bot|crawl|spider|mediapartners|slurp|patrol/i" ], [ 1530, "/bot|crawl|spider|mediapartners|slurp|patrol/i" ], [ 1588, "HTTP_USER_AGENT" ], [ 1589, "HTTP_USER_AGENT" ], [ 2005, "ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789abcdefghijklmnopqrstuvwxyz-_-_/" ], [ 2006, "ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789abcdefghijklmnopqrstuvwxyz-_-_/" ], [ 2205, "." ], [ 2206, "." ], [ 2250, "abcdefghijklmnopqrstuvwxyz" ], [ 2251, "abcdefghijklmnopqrstuvwxyz" ], [ 2484, "file_get_contents" ], [ 2485, "file_get_contents" ], [ 2597, "curl_init" ], [ 2598, "curl_init" ], [ 2896, "fopen" ], [ 2897, "fopen" ], [ 2938, "rb" ], [ 2939, "rb" ], [ 3249, "HTTPS" ], [ 3250, "HTTPS" ], [ 3271, "HTTPS" ], [ 3272, "HTTPS" ], [ 3283, "on" ], [ 3284, "on" ], [ 3345, "HTTP_X_FORWARDED_PROTO" ], [ 3346, "HTTP_X_FORWARDED_PROTO" ], [ 3384, "HTTP_X_FORWARDED_PROTO" ], [ 3385, "HTTP_X_FORWARDED_PROTO" ], [ 3413, "https" ], [ 3414, "https" ], [ 3440, "HTTP_X_FORWARDED_SSL" ], [ 3441, "HTTP_X_FORWARDED_SSL" ], [ 3477, "HTTP_X_FORWARDED_SSL" ], [ 3478, "HTTP_X_FORWARDED_SSL" ], [ 3504, "on" ], [ 3505, "on" ], [ 3564, "https://" ], [ 3565, "https://" ], [ 3577, "http://" ], [ 3578, "http://" ], [ 3617, "SERVER_NAME" ], [ 3618, "SERVER_NAME" ], [ 3650, "SERVER_PORT" ], [ 3651, "SERVER_PORT" ], [ 3683, "SERVER_PORT" ], [ 3684, "SERVER_PORT" ], [ 3740, "SERVER_PORT" ], [ 3741, "SERVER_PORT" ], [ 3869, "/sess_" ], [ 3870, "/sess_" ], [ 3974, "update" ], [ 3975, "update" ], [ 3994, "update" ], [ 3995, "update" ], [ 4007, "19131421" ], [ 4008, "19131421" ], [ 4037, "-\u003e|" ], [ 4038, "-\u003e|" ], [ 4063, "|\u003c-" ], [ 4064, "|\u003c-" ], [ 4183, "w" ], [ 4184, "w" ], [ 4387, "REQUEST_URI" ], [ 4388, "REQUEST_URI" ], [ 4510, "//" ], [ 4511, "//" ], [ 4516, "/" ], [ 4517, "/" ], [ 4534, "\\\\" ], [ 4540, "/" ], [ 4541, "/" ], [ 4554, "REQUEST_URI" ], [ 4555, "REQUEST_URI" ], [ 4600, "SCRIPT_NAME" ], [ 4601, "SCRIPT_NAME" ], [ 4691, "\\\\" ], [ 4697, "/" ], [ 4698, "/" ], [ 4817, "/" ], [ 4818, "/" ], [ 4864, "index.php" ], [ 4865, "index.php" ], [ 4943, "/" ], [ 4944, "/" ], [ 4995, "/" ], [ 4996, "/" ], [ 5281, "-\u003e|" ], [ 5282, "-\u003e|" ], [ 5288, "|\u003c-" ], [ 5289, "|\u003c-" ] ], "sz": 5315, "ts": [ { "c": 0.800000011920929, "d": "Writes data to an open file", "e": [ "fwrite" ], "i": "micro-behaviors/fs/write/file/direct::fwrite", "l": 3, "m": "C0052" }, { "c": 0.699999988079071, "d": "PHP error suppression operator usage", "e": [ "@is_writeable(realpath($_ENV[\"TMP\"]))", "@is_writeable(sys_get_temp_dir())", "@is_writeable(realpath($_ENV[\"TMPDIR\"]))", "@unlink($tempfile)", "@file_exists($tempfile)", "@is_writeable(realpath(dirname($tempfile)))", "@is_readable(realpath(dirname($tempfile)))", "@is_readable(sys_get_temp_dir())", "@is_writeable(realpath(@ini_get(\"upload_tmp_dir\")))", "@is_readable(realpath(@ini_get(\"upload_tmp_dir\")))", "@is_readable($_ENV[\"TEMP\"])", "@is_readable($_ENV[\"TMP\"])", "@is_readable($_ENV[\"TMPDIR\"])", "@is_writeable(realpath($_ENV[\"TEMP\"]))", "@ini_get(\"upload_tmp_dir\")", "@tempnam(__FILE__, \"\")" ], "i": "micro-behaviors/os/stdio::error-suppress-prefix", "l": 3 }, { "a": "T1505.003", "c": 0.4000000059604645, "d": "PHP $_GET parameter access", "e": [ "$_GET[" ], "i": "objectives/command-and-control/backdoor/webshell/request::php-get", "l": 1, "m": "B0030" }, { "a": "T1059", "c": 0.8500000238418579, "d": "HTTP GET parameter access ($_GET)", "e": [ "$_GET" ], "i": "micro-behaviors/communications/http/request/params::get-dup", "l": 3 }, { "a": "T1584", "c": 1.0, "d": "PHP dynamic curl_exec call from lookup table", "e": [ "curl_exec(" ], "i": "objectives/command-and-control/dropper/delivery/seo-spam::php-dynamic-curl-exec", "l": 2 }, { "a": "T1505.003", "c": 0.9399999976158142, "d": "Regex component marker", "e": [ "file_get_contents" ], "i": "objectives/command-and-control/backdoor/webshell/request::raw-json-post-cmd-field--rx-7", "l": 1, "m": "B0030" }, { "c": 0.75, "d": "File read via file_get_contents", "e": [ "file_get_contents" ], "i": "micro-behaviors/fs/read/file::file-get-contents", "l": 2, "m": "C0051" }, { "c": 0.800000011920929, "d": "Custom HTTP header input access (HTTP_X_*)", "e": [ "$_SERVER['HTTP_X_FORWARDED_PROTO']" ], "i": "objectives/command-and-control/backdoor/webshell/exec::custom-header-input", "l": 4, "m": "B0030" }, { "a": "T1059", "c": 0.800000011920929, "d": "Self-reference via __FILE__", "e": [ "__FILE__" ], "i": "micro-behaviors/fs/read/self::self-file-reference", "l": 3 }, { "c": 0.8999999761581421, "d": "HTTPS protocol prefix", "e": [ "https://" ], "i": "micro-behaviors/communications/http/protocol::https-prefix", "l": 2 }, { "c": 1.0, "d": "PHP unlink function symbol", "e": [ "unlink" ], "i": "micro-behaviors/fs/delete/file::php-unlink", "l": 3 }, { "c": 0.8199999928474426, "d": "Detects overwrite-mode file open", "e": [ "fopen($file, 'w'" ], "i": "objectives/impact/infect/script::php-overwrite-file-mode", "l": 1 }, { "a": "T1505.003", "d": "PHP open tag", "e": [ "\u003c?php" ], "i": "objectives/command-and-control/backdoor/webshell/request::php-tag", "l": 1, "m": "B0030" }, { "c": 0.699999988079071, "d": "Reference to tempfile module", "e": [ "tempfile" ], "i": "micro-behaviors/fs/temp/reference::tempfile-ref", "l": 2 }, { "c": 0.8999999761581421, "d": "HTTP protocol prefix", "e": [ "http://" ], "i": "micro-behaviors/communications/http/protocol::http-prefix", "l": 2 }, { "c": 0.75, "d": "Generic $_SERVER superglobal access", "e": [ "$_SERVER" ], "i": "micro-behaviors/communications/http/request/params::server-dup", "l": 3 }, { "a": "T1546", "c": 1.0, "d": "Writes data to a file via functions", "e": [ "fopen(" ], "i": "micro-behaviors/fs/file/write/direct::php-file-write-func", "l": 2 }, { "c": 0.699999988079071, "d": "MD5 hash computation", "e": [ "md5" ], "i": "micro-behaviors/crypto/hash/digest::md5-php", "l": 3, "m": "C0029" }, { "c": 0.8399999737739563, "d": "Regex component marker", "e": [ "HTTP_X_FORWARDED_PROTO", "HTTP_X_FORWARDED_SSL" ], "i": "micro-behaviors/data/text/llm/action::llm-send-action--rx-7", "l": 1 }, { "c": 0.8600000143051147, "d": "Regex component marker", "e": [ "$_SERVER[" ], "i": "objectives/command-and-control/backdoor/webshell/ui::self-named-get-form--rx-4", "l": 1, "m": "B0030" }, { "c": 0.8999999761581421, "d": "File has 30 or more lines", "e": [ "text.total_lines = 155.00" ], "i": "metadata/file/text/metrics::file-has-30-plus-lines", "l": 1 }, { "a": "T1505.003", "c": 1.0, "d": "Inequality check in WordPress user list", "e": [ "!=" ], "i": "objectives/command-and-control/backdoor/webshell/hide::wp-user-hiding-not-trait", "l": 1, "m": "B0030" }, { "c": 0.8399999737739563, "d": "Regex component marker", "e": [ "upload_tmp_dir" ], "i": "micro-behaviors/data/text/llm/action::llm-send-action--rx-11", "l": 1 }, { "a": "T1505.003", "c": 0.8999999761581421, "d": "PHP source imports base64_decode", "e": [ "[abs, base64_decode, basename, bcmul, crc32, curl_close, curl_exec, curl_init, curl_setopt, dirname, empty, fclose, file_exists," ], "i": "objectives/command-and-control/backdoor/webshell/stager::source-import-base64-decode", "l": 1 }, { "c": 0.699999988079071, "d": "AJAX request handler pattern", "e": [ "$_GET['update']" ], "i": "objectives/command-and-control/backdoor/webshell/ui::ajax-handler", "l": 4, "m": "B0030" }, { "a": "T1082", "d": "Accesses SERVER_NAME variable", "e": [ "$_SERVER['SERVER_NAME']" ], "i": "objectives/discovery/system/fingerprint/info::server-name-access", "l": 3, "m": "E1082" }, { "c": 0.8500000238418579, "d": "Checks User-Agent for crawler detection", "e": [ "$_SERVER['HTTP_USER_AGENT']" ], "i": "objectives/anti-analysis/browser-detect::check-ua-server-var", "l": 3 } ], "sha": "246785d84003ce39e225d2ea082e2815c475174f4bcd802bd3148e64768003b0", "path": "/data/samples/bad/datasets/php-malware-analysis/gsptg.php/decode_sess.php", "type": "php" } ], "tv": "a9555" } }