{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9995256662368774, "class": 2 } ], "prob": 0.99952567, "class": 2, "models": [ { "m": "az", "prob": 0.96922517, "class": 0 }, { "m": "az/scripts", "prob": 0.99904233, "class": 0 }, { "m": "az/php", "prob": 0.99952567, "class": 2 } ], "version": "v16.16", "thresholds": [ 0.9961138, 0.99909174 ], "analyzed_at": "2026-05-08T21:10:21Z" }, "path": "step1.php", "raw": { "v": "4", "fs": [ { "f": "O₄(C₄CaIAl)H₅(Cm₂FOsPoDb)Md", "k": { "source.imports[0]": "date", "source.imports[1]": "fclose", "source.imports[2]": "fopen", "source.imports[3]": "fwrite", "source.imports[4]": "header", "source.imports[5]": "isset", "source.imports[6]": "mail", "source.imports[7]": "session_start", "source.imports[8]": "strpos", "source.strings[0]": " GMT\\r\\n", "source.strings[1]": "- PPL LOGIN [", "source.strings[2]": "- PPL LOGIN ]\u003e ===========", "source.strings[3]": "- PPL LOGIN ]\u003e ===========\\r\\n", "source.strings[4]": "---------------------- IP Info ----------------------", "source.strings[5]": "---------------------- IP Info ----------------------\\r\\n", "source.strings[6]": "../../", "source.strings[7]": "../mine.php", "source.strings[8]": "=========== \u003c[ -", "source.strings[9]": "=========== \u003c[ THANKS TO xMR.B3SS0x ]\u003e ===========", "source.has_imports": true, "source.strings[10]": "=========== \u003c[ THANKS TO xMR.B3SS0x ]\u003e ===========\\r\\n\\r\\n\\r\\n", "source.strings[11]": "BROWSER\t\t: ", "source.strings[12]": "BROWSER\t\t: {$_SESSION['browser']} on {$_SESSION['os']}\\r\\n", "source.strings[13]": "Content-Type: text/plain; charset=UTF-8", "source.strings[14]": "Content-Type: text/plain; charset=UTF-8\\r\\n", "source.strings[15]": "EMAIL\t\t: ", "source.strings[16]": "EMAIL\t\t: {$_POST['EML']}\\r\\n", "source.strings[17]": "From: xMR_B3SS0x \u003cnewlogin@xMR.B3SS0x.com\u003e", "source.strings[18]": "From: xMR_B3SS0x \u003cnewlogin@xMR.B3SS0x.com\u003e\\r\\n", "source.strings[19]": "HTTP/1.0 404 Not Found", "source.strings[20]": "HTTP_USER_AGENT", "source.strings[21]": "IP ADDRESS\t: ", "source.strings[22]": "IP ADDRESS\t: {$_SESSION['ip']}\\r\\n", "source.strings[23]": "LOCATION\t: ", "source.strings[24]": "LOCATION\t: {$_SESSION['ip_city']} , {$_SESSION['ip_countryName']} , {$_SESSION['currency']}\\r\\n", "source.strings[25]": "Location: ../../app/process", "source.strings[26]": "Location: ../../app/signin?invalid", "source.strings[27]": "Location: ../../app/unusual_activity", "source.strings[28]": "MIME-Version: 1.0", "source.strings[29]": "MIME-Version: 1.0\\r\\n", "source.strings[30]": "PASS\t\t: ", "source.strings[31]": "PASS\t\t: {$_POST['PWD']}\\r\\n", "source.strings[32]": "SCREEN\t\t: ", "source.strings[33]": "SCREEN\t\t: {$_SESSION['screen']}\\r\\n", "source.strings[34]": "TIME\t\t: ", "source.strings[35]": "TIMEZONE\t: ", "source.strings[36]": "TIMEZONE\t: {$_SESSION['ip_timezone']}\\r\\n", "source.strings[37]": "USER AGENT\t: ", "source.strings[38]": "USER AGENT\t: {$_SERVER['HTTP_USER_AGENT']}\\r\\n", "source.strings[39]": "] From [", "source.strings[40]": "acxMR.B3SS0xkey", "source.strings[41]": "browser", "source.strings[42]": "currency", "source.strings[43]": "d/m/Y h:i:sa", "source.strings[44]": "fuckingspam", "source.strings[45]": "googlebot", "source.strings[46]": "gotofindgoodjob", "source.strings[47]": "ip_city", "source.strings[48]": "ip_countryName", "source.strings[49]": "ip_timezone", "source.strings[50]": "screen", "source.strings[51]": "sonofbitch", "source.strings[52]": "spammer", "source.strings[53]": "stupid" }, "x": 135, "id": 0, "is": [ "session_start", "header", "isset", "isset", "strpos", "strpos", "strpos", "strpos", "strpos", "strpos", "strpos", "strpos", "strpos", "strpos", "strpos", "strpos", "strpos", "isset", "isset", "date", "fopen", "fwrite", "fclose", "mail", "header", "header", "header", "header" ], "ms": { "file": { "size": 2954.0 }, "text": { "tab_count": 54.0, "digit_ratio": 0.03, "space_count": 202.0, "total_lines": 67.0, "char_entropy": 5.83, "mixed_indent": true, "unique_chars": 96.0, "import_density": 41.79, "lines_over_200": 1.0, "string_density": 2.31, "ascii_art_lines": 1.0, "avg_line_length": 43.1, "high_byte_ratio": 0.16, "max_line_length": 465.0, "non_ascii_ratio": 0.16, "empty_line_ratio": 0.03, "last_line_length": 2.0, "most_common_char": "â", "whitespace_ratio": 0.11, "most_common_ratio": 0.05, "identifier_density": 1.51, "line_length_stddev": 60.55, "normalized_import_count": 3.42, "normalized_string_count": 18.94, "repeated_char_sequences": 6.0, "suspicious_comment_ratio": 1.0, "max_inline_whitespace_run": 7.0, "trailing_whitespace_lines": 2.0, "normalized_unique_identifiers": 4.12 }, "imports": { "total": 28.0, "unique_modules": 9.0, "third_party_count": 28.0, "third_party_ratio": 1.0 }, "strings": { "total": 155.0, "avg_length": 12.58, "max_length": 95.0, "path_count": 4.0, "avg_entropy": 2.47, "email_count": 2.0, "total_bytes": 1950.0, "entropy_stddev": 1.11 }, "comments": { "chars": 600.0, "lines": 8.0, "total": 1.0, "to_code_ratio": 0.14, "url_in_comments": 1.0, "base64_in_comments": 1.0 }, "functions": {}, "identifiers": { "total": 101.0, "avg_length": 6.96, "max_length": 21.0, "min_length": 3.0, "avg_entropy": 2.41, "reuse_ratio": 0.25, "unique_count": 25.0, "length_stddev": 3.69, "has_digit_ratio": 0.08, "high_entropy_count": 1.0, "high_entropy_ratio": 0.04, "all_lowercase_ratio": 0.8, "all_uppercase_ratio": 0.12, "numeric_suffix_count": 2.0, "underscore_prefix_count": 3.0 } }, "ss": [ [ 651, "acxMR.B3SS0xkey" ], [ 652, "acxMR.B3SS0xkey" ], [ 681, "acxMR.B3SS0xkey" ], [ 682, "acxMR.B3SS0xkey" ], [ 716, "HTTP/1.0 404 Not Found" ], [ 717, "HTTP/1.0 404 Not Found" ], [ 758, "../mine.php" ], [ 759, "../mine.php" ], [ 785, "PWD" ], [ 786, "PWD" ], [ 809, "EML" ], [ 810, "EML" ], [ 831, "PWD" ], [ 832, "PWD" ], [ 851, "true" ], [ 852, "true" ], [ 875, "fuck" ], [ 876, "fuck" ], [ 908, "1234" ], [ 909, "1234" ], [ 941, "4321" ], [ 942, "4321" ], [ 974, "qwer" ], [ 975, "qwer" ], [ 1007, "rewq" ], [ 1008, "rewq" ], [ 1040, "gotofindgoodjob" ], [ 1041, "gotofindgoodjob" ], [ 1084, "stupid" ], [ 1085, "stupid" ], [ 1119, "spammer" ], [ 1120, "spammer" ], [ 1155, "fuckingspam" ], [ 1156, "fuckingspam" ], [ 1195, "spam" ], [ 1196, "spam" ], [ 1228, "sonofbitch" ], [ 1229, "sonofbitch" ], [ 1267, " " ], [ 1268, " " ], [ 1299, "googlebot" ], [ 1300, "googlebot" ], [ 1337, "false" ], [ 1338, "false" ], [ 1367, "true" ], [ 1368, "true" ], [ 1396, "EML" ], [ 1397, "EML" ], [ 1418, "PWD" ], [ 1419, "PWD" ], [ 1441, "true" ], [ 1442, "true" ], [ 1458, "true" ], [ 1459, "true" ], [ 1479, "screen" ], [ 1480, "screen" ], [ 1496, "screen" ], [ 1497, "screen" ], [ 1518, "EML" ], [ 1519, "EML" ], [ 1532, "EML" ], [ 1533, "EML" ], [ 1546, "=========== \u003c[ -" ], [ 1547, "=========== \u003c[ -" ], [ 1575, "- PPL LOGIN ]\u003e ===========\\r\\n" ], [ 1576, "- PPL LOGIN ]\u003e ===========" ], [ 1616, "EMAIL\t\t: {$_POST['EML']}\\r\\n" ], [ 1617, "EMAIL\t\t: " ], [ 1634, "EML" ], [ 1635, "EML" ], [ 1655, "PASS\t\t: {$_POST['PWD']}\\r\\n" ], [ 1656, "PASS\t\t: " ], [ 1672, "PWD" ], [ 1673, "PWD" ], [ 1693, "---------------------- IP Info ----------------------\\r\\n" ], [ 1694, "---------------------- IP Info ----------------------" ], [ 1761, "IP ADDRESS\t: {$_SESSION['ip']}\\r\\n" ], [ 1762, "IP ADDRESS\t: " ], [ 1786, "ip" ], [ 1787, "ip" ], [ 1806, "LOCATION\t: {$_SESSION['ip_city']} , {$_SESSION['ip_countryName']} , {$_SESSION['currency']}\\r\\n" ], [ 1807, "LOCATION\t: " ], [ 1829, "ip_city" ], [ 1830, "ip_city" ], [ 1840, " , " ], [ 1854, "ip_countryName" ], [ 1855, "ip_countryName" ], [ 1872, " , " ], [ 1886, "currency" ], [ 1887, "currency" ], [ 1912, "BROWSER\t\t: {$_SESSION['browser']} on {$_SESSION['os']}\\r\\n" ], [ 1913, "BROWSER\t\t: " ], [ 1935, "browser" ], [ 1936, "browser" ], [ 1946, " on " ], [ 1961, "os" ], [ 1962, "os" ], [ 1981, "SCREEN\t\t: {$_SESSION['screen']}\\r\\n" ], [ 1982, "SCREEN\t\t: " ], [ 2003, "screen" ], [ 2004, "screen" ], [ 2027, "USER AGENT\t: {$_SERVER['HTTP_USER_AGENT']}\\r\\n" ], [ 2028, "USER AGENT\t: " ], [ 2051, "HTTP_USER_AGENT" ], [ 2052, "HTTP_USER_AGENT" ], [ 2084, "TIMEZONE\t: {$_SESSION['ip_timezone']}\\r\\n" ], [ 2085, "TIMEZONE\t: " ], [ 2107, "ip_timezone" ], [ 2108, "ip_timezone" ], [ 2136, "TIME\t\t: " ], [ 2137, "TIME\t\t: " ], [ 2152, "d/m/Y h:i:sa" ], [ 2153, "d/m/Y h:i:sa" ], [ 2168, " GMT\\r\\n" ], [ 2169, " GMT" ], [ 2187, "=========== \u003c[ THANKS TO xMR.B3SS0x ]\u003e ===========\\r\\n\\r\\n\\r\\n" ], [ 2188, "=========== \u003c[ THANKS TO xMR.B3SS0x ]\u003e ===========" ], [ 2271, "yes" ], [ 2272, "yes" ], [ 2293, "../../" ], [ 2294, "../../" ], [ 2312, ".txt" ], [ 2313, ".txt" ], [ 2319, "a+" ], [ 2320, "a+" ], [ 2375, "-" ], [ 2376, "-" ], [ 2389, "- PPL LOGIN [" ], [ 2390, "- PPL LOGIN [" ], [ 2412, "EML" ], [ 2413, "EML" ], [ 2419, "] From [" ], [ 2420, "] From [" ], [ 2440, "ip_countryName" ], [ 2441, "ip_countryName" ], [ 2458, "]" ], [ 2459, "]" ], [ 2473, "From: xMR_B3SS0x \u003cnewlogin@xMR.B3SS0x.com\u003e\\r\\n" ], [ 2474, "From: xMR_B3SS0x \u003cnewlogin@xMR.B3SS0x.com\u003e" ], [ 2534, "MIME-Version: 1.0\\r\\n" ], [ 2535, "MIME-Version: 1.0" ], [ 2570, "Content-Type: text/plain; charset=UTF-8\\r\\n" ], [ 2571, "Content-Type: text/plain; charset=UTF-8" ], [ 2637, "yes" ], [ 2638, "yes" ], [ 2717, "yes" ], [ 2718, "yes" ], [ 2739, "Location: ../../app/unusual_activity" ], [ 2740, "Location: ../../app/unusual_activity" ], [ 2801, "Location: ../../app/process" ], [ 2802, "Location: ../../app/process" ], [ 2856, "Location: ../../app/signin?invalid" ], [ 2857, "Location: ../../app/signin?invalid" ], [ 2920, "HTTP/1.0 404 Not Found" ], [ 2921, "HTTP/1.0 404 Not Found" ] ], "sz": 2954, "ts": [ { "c": 0.699999988079071, "d": "Access to HTTP User-Agent header", "e": [ "$_SERVER['HTTP_USER_AGENT']" ], "i": "micro-behaviors/communications/http/request/params::http-user-agent-superglobal", "l": 3 }, { "a": "T1505.003", "c": 0.4000000059604645, "d": "PHP $_POST parameter access", "e": [ "$_POST[" ], "i": "objectives/command-and-control/backdoor/webshell/request::php-post", "l": 1, "m": "B0030" }, { "c": 0.699999988079071, "d": "PHP error suppression operator usage", "e": [ "@mail($yours,$subject,$msg,$headers)" ], "i": "micro-behaviors/os/stdio::error-suppress-prefix", "l": 3 }, { "c": 0.8999999761581421, "d": "Detects append mode file opening for infection", "e": [ "fopen(\"../../\".$filename.\".txt\",\"a+\")" ], "i": "objectives/impact/infect/script::php-append-file-mode", "l": 4 }, { "a": "T1505.003", "c": 1.0, "d": "Inequality check in WordPress user list", "e": [ "!=" ], "i": "objectives/command-and-control/backdoor/webshell/hide::wp-user-hiding-not-trait", "l": 1, "m": "B0030" }, { "c": 0.75, "d": "Generic $_SERVER superglobal access", "e": [ "$_SERVER" ], "i": "micro-behaviors/communications/http/request/params::server-dup", "l": 3 }, { "c": 1.0, "d": "PHP mail() function call", "e": [ "mail" ], "i": "micro-behaviors/process/create/exec::php-mail", "l": 3 }, { "a": "T1071.001", "d": "HTTP/1.x version string", "e": [ "HTTP/1." ], "i": "micro-behaviors/communications/http/request/client::http-version", "l": 2, "m": "C0002" }, { "a": "T1546", "c": 1.0, "d": "Writes data to a file via functions", "e": [ "fopen(" ], "i": "micro-behaviors/fs/file/write/direct::php-file-write-func", "l": 2 }, { "a": "T1505.003", "d": "PHP open tag", "e": [ "\u003c?php" ], "i": "objectives/command-and-control/backdoor/webshell/request::php-tag", "l": 1, "m": "B0030" }, { "c": 0.800000011920929, "d": "Sends email with error suppression (@mail)", "e": [ "@mail($yours,$subject,$msg,$headers)" ], "i": "micro-behaviors/communications/email/send/mail-func::mail-suppressed", "l": 4, "m": "B0032" }, { "c": 0.8999999761581421, "d": "File has 30 or more lines", "e": [ "text.total_lines = 67.00" ], "i": "metadata/file/text/metrics::file-has-30-plus-lines", "l": 1 }, { "a": "T1059", "c": 0.8500000238418579, "d": "HTTP POST parameter access ($_POST)", "e": [ "$_POST" ], "i": "micro-behaviors/communications/http/request/params::post-dup", "l": 3 }, { "c": 0.8399999737739563, "d": "Regex component marker", "e": [ "LOCATION\t: {$_SESSION['ip_city']} , {$_SESSION['ip_countryName']} , {$_SESSION['currency']}\\r\\n", "SCREEN\t\t: {$_SESSION['screen']}\\r\\n", "TIMEZONE\t: {$_SESSION['ip_timezone']}\\r\\n", "IP ADDRESS\t: {$_SESSION['ip']}\\r\\n", "BROWSER\t\t: {$_SESSION['browser']} on {$_SESSION['os']}\\r\\n" ], "i": "micro-behaviors/data/text/llm/action::llm-send-action--rx-8", "l": 1 }, { "d": "Content-Type header string", "e": [ "Content-Type:" ], "i": "micro-behaviors/communications/http/request/client::content-type-header", "l": 1 }, { "c": 0.800000011920929, "d": "Writes data to an open file", "e": [ "fwrite" ], "i": "micro-behaviors/fs/write/file/direct::fwrite", "l": 3, "m": "C0052" }, { "c": 0.8999999761581421, "d": "HTTP/1.0 protocol version", "e": [ "HTTP/1.0 404 Not Found" ], "i": "micro-behaviors/communications/http/protocol::http-1-0-header", "l": 2 }, { "a": "T1505.003", "c": 0.8500000238418579, "d": "PHP request superglobal access", "e": [ "$_POST" ], "i": "objectives/command-and-control/backdoor/webshell/upload::php-request-variadic-function-call", "l": 3, "m": "B0030" }, { "c": 0.75, "d": "HTTP protocol version strings", "e": [ "HTTP/1.0" ], "i": "micro-behaviors/communications/http/request/client::http-versions", "l": 1 }, { "c": 0.8600000143051147, "d": "Regex component marker", "e": [ "$_SERVER[" ], "i": "objectives/command-and-control/backdoor/webshell/ui::self-named-get-form--rx-4", "l": 1, "m": "B0030" }, { "c": 0.75, "d": "Session variable access ($_SESSION)", "e": [ "$_SESSION" ], "i": "micro-behaviors/communications/http/request/params::session", "l": 3 }, { "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "googlebot" ], "i": "objectives/anti-analysis/browser-detect::bot-ua-list--rx-1", "l": 1 }, { "a": "T1027", "c": 0.800000011920929, "d": "High overall text entropy (encoded", "e": [ "text.char_entropy = 5.83" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::high-text-entropy", "l": 2, "m": "B0032" }, { "c": 0.8500000238418579, "d": "Checks User-Agent for crawler detection", "e": [ "$_SERVER['HTTP_USER_AGENT']" ], "i": "objectives/anti-analysis/browser-detect::check-ua-server-var", "l": 3 }, { "c": 0.699999988079071, "d": "AJAX request handler pattern", "e": [ "$_POST['EML']", "$_POST['acxMR.B3SS0xkey']", "$_POST['screen']", "$_POST['PWD']" ], "i": "objectives/command-and-control/backdoor/webshell/ui::ajax-handler", "l": 4, "m": "B0030" }, { "c": 0.8500000238418579, "d": "Logic to identify search engine crawlers", "e": [ "$_SERVER['HTTP_USER_AGENT']", "googlebot" ], "i": "objectives/anti-analysis/browser-detect::crawler-identification", "l": 3 }, { "a": "T1566.002", "c": 0.8500000238418579, "d": "PHP script writing POST data to local file", "e": [ "fopen(", "$_POST" ], "i": "objectives/credential-access/phishing/tactics::php-credential-exfiltration", "l": 4, "m": "B0030" } ], "sha": "25346b43ede2b43aa089c7564c9c838fe30a0d9a2cfc5fbca1a7ee26befe6176", "path": "/data/samples/bad/datasets/awesome-malware/PHP/step1.php", "type": "php" } ], "tv": "bef72" } }