{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9999841451644897, "class": 2 } ], "prob": 0.99998415, "class": 2, "models": [ { "m": "az", "prob": 0.9990429, "class": 1 }, { "m": "az/scripts", "prob": 0.9999839, "class": 2 }, { "m": "az/php", "prob": 0.99998415, "class": 2 } ], "version": "v16.16", "thresholds": [ 0.9961138, 0.99909174 ], "analyzed_at": "2026-05-09T10:19:27Z" }, "path": "Regan.php", "raw": { "v": "4", "fs": [ { "f": "O₂(C₇As₅)H₂(PoCm)MdTh", "k": { "source.imports[0]": "base64_decode", "source.imports[1]": "eval", "source.imports[2]": "gzuncompress", "source.imports[3]": "imap_mail", "source.strings[0]": "eNpdUs1u00AQfpWNlYMdrDhO89dEOZTKolEpQYkBoRpZU+86u8TZtdZr1X6A3jhy4Q248gxUvAavwjhpgWQPO/+ab74ZkdottstN7XVeZkpRKeRnmJIFyUSyJbUqNWGgM3XHXAKSklJSdXDfg0l4t+PZ7XgdrN4Hq1vrKgzfxu/Qii9eBW9C65PjTNvxt+8/f/14fJyD1lDb1iXXKvKHQ2a5VlQNRqj7mqUqqsYTdIVaUCYNajfrRYDiQ5OAXe+LQ0EiZFmhusgx0FMyqkZDNC8k1UpQ1JY504ByDSloYTmzVGkGCbf/QiFQtOMvvx++PjhTkdpFuBK5Kk4Hiarh8L9Z3OeS1nzuddaggfvnaYJk7fC5RG2hRjpSyAp2SqaBLUPWSA7SFESlqUs2upRGyA0SjTEgRqssw/o9opYoCmYQ0OVyeb0IbnHu0cTkcSloXBo06J7bIgiTJoHZFt9HMTKIy8gfDXZIgG+5obgJbOdFb9zr945Bf2TA92vG7sIQrcpNs81O76x3ir7YweEWiOHNVdwpZep9bt+ZXTGggbat1yoBI5ScEm5MPvU8/2zQjaqz/uC86/uj7njiCUmbZVXdnOe4FirYMaQlJzWicrENGJIylhVkg0CaI3NmTFKR/vuflvrkmB1jXjeI3WdRM8YAOG/m+wMpCvZB", "source.strings[1]": "qqifquaqdzvp", "source.strings[2]": "tdluhqtnmzr", "source.strings[3]": "vwkxlpc", "source.strings[4]": "yfbhn : ", "source.strings[5]": "ylxqjqbcn", "source.has_imports": true }, "x": 294, "id": 0, "is": [ "eval", "gzuncompress", "base64_decode", "eval", "gzuncompress", "base64_decode", "eval", "gzuncompress", "base64_decode", "eval", "gzuncompress", "base64_decode", "eval", "gzuncompress", "base64_decode", "eval", "gzuncompress", "base64_decode", "eval", "gzuncompress", "base64_decode", "eval", "gzuncompress", "base64_decode", "eval", "gzuncompress", "base64_decode", "eval", "gzuncompress", "base64_decode", "base64_decode", "base64_decode", "base64_decode", "base64_decode", "imap_mail" ], "ms": { "file": { "size": 7588.0 }, "text": { "digit_ratio": 0.14, "space_count": 39.0, "total_lines": 9.0, "char_entropy": 6.08, "unique_chars": 84.0, "import_density": 388.89, "lines_over_200": 1.0, "lines_over_500": 1.0, "string_density": 3.56, "avg_line_length": 841.11, "lines_over_1000": 1.0, "max_line_length": 7226.0, "empty_line_ratio": 0.22, "last_line_length": 69.0, "long_token_count": 10.0, "most_common_char": "p", "whitespace_ratio": 0.01, "most_common_ratio": 0.03, "identifier_density": 5.56, "line_length_stddev": 2257.54, "encoded_string_ratio": 0.63, "normalized_import_count": 11.67, "normalized_string_count": 10.67, "max_inline_whitespace_run": 1.0, "trailing_whitespace_lines": 6.0, "normalized_unique_identifiers": 3.15 }, "imports": { "total": 35.0, "unique_modules": 4.0, "third_party_count": 35.0, "third_party_ratio": 1.0 }, "strings": { "total": 32.0, "avg_length": 425.69, "max_length": 676.0, "avg_entropy": 4.76, "total_bytes": 13622.0, "entropy_stddev": 1.55, "base64_candidates": 20.0, "high_entropy_count": 20.0 }, "comments": {}, "functions": {}, "identifiers": { "total": 50.0, "avg_length": 9.1, "max_length": 13.0, "min_length": 4.0, "avg_entropy": 2.84, "reuse_ratio": 0.2, "unique_count": 10.0, "length_stddev": 3.21, "has_digit_ratio": 0.1, "all_lowercase_ratio": 0.8, "all_uppercase_ratio": 0.1, "underscore_prefix_count": 1.0 } }, "ss": [ [ 38, "eNpdUs1u00AQfpWNlYMdrDhO89dEOZTKolEpQYkBoRpZU+86u8TZtdZr1X6A3jhy4Q248gxUvAavwjhpgWQPO/+ab74ZkdottstN7XVeZkpRKeRnmJIFyUSyJbUqNWGg" ], [ 39, "eNpdUs1u00AQfpWNlYMdrDhO89dEOZTKolEpQYkBoRpZU+86u8TZtdZr1X6A3jhy4Q248gxUvAavwjhpgWQPO/+ab74ZkdottstN7XVeZkpRKeRnmJIFyUSyJbUqNWGg" ], [ 760, "eNpdUs1u00AQfpWNlYMdrDhO89dEOZTKolEpQYkBoRpZU+86u8TZtdZr1X6A3jhy4Q248gxUvAavwjhpgWQPO/+ab74ZkdottstN7XVeZkpRKeRnmJIFyUSyJbUqNWGg" ], [ 761, "eNpdUs1u00AQfpWNlYMdrDhO89dEOZTKolEpQYkBoRpZU+86u8TZtdZr1X6A3jhy4Q248gxUvAavwjhpgWQPO/+ab74ZkdottstN7XVeZkpRKeRnmJIFyUSyJbUqNWGg" ], [ 1482, "eNpdUs1u00AQfpWNlYMdrDhO89dEOZTKolEpQYkBoRpZU+86u8TZtdZr1X6A3jhy4Q248gxUvAavwjhpgWQPO/+ab74ZkdottstN7XVeZkpRKeRnmJIFyUSyJbUqNWGg" ], [ 1483, "eNpdUs1u00AQfpWNlYMdrDhO89dEOZTKolEpQYkBoRpZU+86u8TZtdZr1X6A3jhy4Q248gxUvAavwjhpgWQPO/+ab74ZkdottstN7XVeZkpRKeRnmJIFyUSyJbUqNWGg" ], [ 2204, "eNpdUs1u00AQfpWNlYMdrDhO89dEOZTKolEpQYkBoRpZU+86u8TZtdZr1X6A3jhy4Q248gxUvAavwjhpgWQPO/+ab74ZkdottstN7XVeZkpRKeRnmJIFyUSyJbUqNWGg" ], [ 2205, "eNpdUs1u00AQfpWNlYMdrDhO89dEOZTKolEpQYkBoRpZU+86u8TZtdZr1X6A3jhy4Q248gxUvAavwjhpgWQPO/+ab74ZkdottstN7XVeZkpRKeRnmJIFyUSyJbUqNWGg" ], [ 2926, "eNpdUs1u00AQfpWNlYMdrDhO89dEOZTKolEpQYkBoRpZU+86u8TZtdZr1X6A3jhy4Q248gxUvAavwjhpgWQPO/+ab74ZkdottstN7XVeZkpRKeRnmJIFyUSyJbUqNWGg" ], [ 2927, "eNpdUs1u00AQfpWNlYMdrDhO89dEOZTKolEpQYkBoRpZU+86u8TZtdZr1X6A3jhy4Q248gxUvAavwjhpgWQPO/+ab74ZkdottstN7XVeZkpRKeRnmJIFyUSyJbUqNWGg" ], [ 3648, "eNpdUs1u00AQfpWNlYMdrDhO89dEOZTKolEpQYkBoRpZU+86u8TZtdZr1X6A3jhy4Q248gxUvAavwjhpgWQPO/+ab74ZkdottstN7XVeZkpRKeRnmJIFyUSyJbUqNWGg" ], [ 3649, "eNpdUs1u00AQfpWNlYMdrDhO89dEOZTKolEpQYkBoRpZU+86u8TZtdZr1X6A3jhy4Q248gxUvAavwjhpgWQPO/+ab74ZkdottstN7XVeZkpRKeRnmJIFyUSyJbUqNWGg" ], [ 4370, "eNpdUs1u00AQfpWNlYMdrDhO89dEOZTKolEpQYkBoRpZU+86u8TZtdZr1X6A3jhy4Q248gxUvAavwjhpgWQPO/+ab74ZkdottstN7XVeZkpRKeRnmJIFyUSyJbUqNWGg" ], [ 4371, "eNpdUs1u00AQfpWNlYMdrDhO89dEOZTKolEpQYkBoRpZU+86u8TZtdZr1X6A3jhy4Q248gxUvAavwjhpgWQPO/+ab74ZkdottstN7XVeZkpRKeRnmJIFyUSyJbUqNWGg" ], [ 5092, "eNpdUs1u00AQfpWNlYMdrDhO89dEOZTKolEpQYkBoRpZU+86u8TZtdZr1X6A3jhy4Q248gxUvAavwjhpgWQPO/+ab74ZkdottstN7XVeZkpRKeRnmJIFyUSyJbUqNWGg" ], [ 5093, "eNpdUs1u00AQfpWNlYMdrDhO89dEOZTKolEpQYkBoRpZU+86u8TZtdZr1X6A3jhy4Q248gxUvAavwjhpgWQPO/+ab74ZkdottstN7XVeZkpRKeRnmJIFyUSyJbUqNWGg" ], [ 5814, "eNpdUs1u00AQfpWNlYMdrDhO89dEOZTKolEpQYkBoRpZU+86u8TZtdZr1X6A3jhy4Q248gxUvAavwjhpgWQPO/+ab74ZkdottstN7XVeZkpRKeRnmJIFyUSyJbUqNWGg" ], [ 5815, "eNpdUs1u00AQfpWNlYMdrDhO89dEOZTKolEpQYkBoRpZU+86u8TZtdZr1X6A3jhy4Q248gxUvAavwjhpgWQPO/+ab74ZkdottstN7XVeZkpRKeRnmJIFyUSyJbUqNWGg" ], [ 6536, "eNpdUs1u00AQfpWNlYMdrDhO89dEOZTKolEpQYkBoRpZU+86u8TZtdZr1X6A3jhy4Q248gxUvAavwjhpgWQPO/+ab74ZkdottstN7XVeZkpRKeRnmJIFyUSyJbUqNWGg" ], [ 6537, "eNpdUs1u00AQfpWNlYMdrDhO89dEOZTKolEpQYkBoRpZU+86u8TZtdZr1X6A3jhy4Q248gxUvAavwjhpgWQPO/+ab74ZkdottstN7XVeZkpRKeRnmJIFyUSyJbUqNWGg" ], [ 7263, "ylxqjqbcn" ], [ 7264, "ylxqjqbcn" ], [ 7310, "nrsf" ], [ 7311, "nrsf" ], [ 7360, "tdluhqtnmzr" ], [ 7361, "tdluhqtnmzr" ], [ 7416, "qqifquaqdzvp" ], [ 7417, "qqifquaqdzvp" ], [ 7533, "vwkxlpc" ], [ 7534, "vwkxlpc" ], [ 7556, "yfbhn : " ], [ 7557, "yfbhn : " ] ], "sz": 7588, "ts": [ { "a": "T1505.003", "c": 0.8799999952316284, "d": "Regex component marker", "e": [ "eval" ], "i": "objectives/command-and-control/backdoor/webshell/exec::dangerous-php-function-cluster--rx-16", "l": 1, "m": "B0030" }, { "a": "T1027", "c": 0.8999999761581421, "d": "Exactly one line exceeds 1000 chars", "e": [ "text.lines_over_1000 = 1.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::single-long-line-outlier", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8500000238418579, "d": "High entropy strings (base64/gzinflate encoded)", "e": [ "strings.avg_entropy = 4.76" ], "i": "objectives/anti-static/obfuscation/code-metrics/identifiers::php-encoded-strings", "l": 4, "m": "B0032" }, { "a": "T1505.003", "c": 0.8500000238418579, "d": "PHP request superglobal access", "e": [ "$_POST" ], "i": "objectives/command-and-control/backdoor/webshell/upload::php-request-variadic-function-call", "l": 3, "m": "B0030" }, { "c": 0.8999999761581421, "d": "Very long line", "e": [ "text.max_line_length = 7226.00" ], "i": "metadata/file/text/metrics::single-long-line", "l": 1 }, { "a": "T1505.003", "c": 0.8600000143051147, "d": "Very long embedded string", "e": [ "strings.max_length = 676.00" ], "i": "objectives/command-and-control/backdoor/webshell/stager::very-long-string", "l": 1 }, { "a": "T1505.003", "c": 0.8399999737739563, "d": "Near-zero whitespace script", "e": [ "text.whitespace_ratio = 0.01" ], "i": "objectives/command-and-control/backdoor/webshell/stager::near-zero-whitespace", "l": 1 }, { "a": "T1059", "c": 0.8500000238418579, "d": "HTTP POST parameter access ($_POST)", "e": [ "$_POST" ], "i": "micro-behaviors/communications/http/request/params::post-dup", "l": 3 }, { "a": "T1059.006", "c": 0.75, "d": "PHP eval() token present", "e": [ "eval" ], "i": "micro-behaviors/process/interpreter/eval::eval-symbol", "l": 4, "m": "E1059" }, { "a": "T1027", "c": 0.8799999952316284, "d": "Dense gzip decompression", "e": [ "gzuncompress(" ], "i": "objectives/anti-static/obfuscation/string/encoding::dense-gzip-decode", "l": 4, "m": "B0032" }, { "a": "T1505.003", "d": "PHP open tag", "e": [ "\u003c?php" ], "i": "objectives/command-and-control/backdoor/webshell/request::php-tag", "l": 1, "m": "B0030" }, { "a": "T1505.003", "c": 0.9900000095367432, "d": "Decodes a large embedded payload (base64)", "e": [ "base64_decode('eNpdUs1u00AQfpWNlYMdrDhO89dEOZTKolEpQYkBoRpZU+86u8TZtdZr1X6A3jhy4Q248gxUvAavwjhpgWQPO/+ab74ZkdottstN7XVeZkpRKeRnm" ], "i": "objectives/command-and-control/backdoor/webshell/decoder::eval-base64-large-payload", "l": 4, "m": "B0030" }, { "c": 0.800000011920929, "d": "Very short file (under 12 lines)", "e": [ "text.total_lines = 9.00" ], "i": "metadata/file/text/metrics::file-under-12-lines", "l": 1 }, { "a": "T1027", "c": 0.800000011920929, "d": "High entropy strings (encoded/encrypted data)", "e": [ "strings.avg_entropy = 4.76" ], "i": "objectives/anti-static/obfuscation/code-metrics/strings::high-entropy-strings-dup", "l": 3, "m": "B0032" }, { "a": "T1505.003", "c": 0.8999999761581421, "d": "PHP source imports base64_decode", "e": [ "[base64_decode, eval, gzuncompress, imap_mail]" ], "i": "objectives/command-and-control/backdoor/webshell/stager::source-import-base64-decode", "l": 1 }, { "a": "T1505.003", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "eval(gzuncompress(" ], "i": "objectives/command-and-control/backdoor/webshell/decoder::eval-decoder-chain--rx-2", "l": 1, "m": "B0030" }, { "a": "T1505.003", "c": 0.4000000059604645, "d": "PHP $_POST parameter access", "e": [ "$_POST[" ], "i": "objectives/command-and-control/backdoor/webshell/request::php-post", "l": 1, "m": "B0030" }, { "a": "T1027", "c": 0.8999999761581421, "d": "Dense base64_decode calls", "e": [ "base64_decode" ], "i": "objectives/anti-static/obfuscation/string/encoding::dense-base64-decode", "l": 4, "m": "B0032" }, { "a": "T1027", "c": 0.699999988079071, "d": "Very low whitespace ratio (minified/compressed)", "e": [ "text.whitespace_ratio = 0.01" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::low-whitespace", "l": 2, "m": "B0032" }, { "a": "T1027", "c": 0.8999999761581421, "d": "PHP source contains very long line", "e": [ "text.max_line_length = 7226.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/identifiers::php-single-long-line", "l": 4, "m": "B0032" }, { "c": 0.699999988079071, "d": "AJAX request handler pattern", "e": [ "$_POST['nrsf']", "$_POST['ylxqjqbcn']", "$_POST['qqifquaqdzvp']", "$_POST['tdluhqtnmzr']" ], "i": "objectives/command-and-control/backdoor/webshell/ui::ajax-handler", "l": 4, "m": "B0030" }, { "a": "T1027", "c": 0.800000011920929, "d": "High overall text entropy (encoded", "e": [ "text.char_entropy = 6.08" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::high-text-entropy", "l": 2, "m": "B0032" }, { "c": 0.6000000238418579, "d": "Very long base64 strings present", "e": [ "eNpdUs1u00AQfpWNlYMdrDhO89dEOZTKolEpQYkBoRpZU+86u8TZtdZr1X6A3jhy4Q248gxUvAavwjhpgWQPO/+ab74ZkdottstN7XVeZkpRKeRnmJIFyUSyJbUqNWGg" ], "i": "objectives/anti-static/obfuscation/string/base64::long-base64-in-strings", "l": 3 }, { "a": "T1027", "c": 0.800000011920929, "d": "High entropy source string literals", "e": [ "strings.avg_entropy = 4.76" ], "i": "objectives/anti-static/obfuscation/code-metrics/source::high-entropy-strings", "l": 3, "m": "B0032" }, { "a": "T1027", "c": 0.949999988079071, "d": "Multi-layer PHP obfuscation", "e": [ "gzuncompress(", "base64_decode" ], "i": "objectives/anti-static/obfuscation/string/encoding::php-multi-layer-obfuscation", "l": 4, "m": "B0032" }, { "a": "T1027", "c": 0.949999988079071, "d": "PHP webshell pattern detected", "e": [ "text.max_line_length = 7226.00", "strings.avg_entropy = 4.76" ], "i": "objectives/anti-static/obfuscation/code-metrics/identifiers::php-webshell-pattern", "l": 4, "m": "B0032" }, { "a": "T1505.003", "c": 0.9700000286102295, "d": "PHP decoder eval webshell", "e": [ "eval(gzuncompress(", "$_POST", "base64_decode('eNpdUs1u00AQfpWNlYMdrDhO89dEOZTKolEpQYkBoRpZU+86u8TZtdZr1X6A3jhy4Q248gxUvAavwjhpgWQPO/+ab74ZkdottstN7XVeZkpRKeRnm" ], "i": "objectives/command-and-control/backdoor/webshell/decoder::php-decoder-eval-webshell", "l": 5, "m": "B0030" }, { "a": "T1505.003", "c": 0.9900000095367432, "d": "PHP backdoor: eval of base64 payload", "e": [ "base64_decode('eNpdUs1u00AQfpWNlYMdrDhO89dEOZTKolEpQYkBoRpZU+86u8TZtdZr1X6A3jhy4Q248gxUvAavwjhpgWQPO/+ab74ZkdottstN7XVeZkpRKeRnm", "strings.avg_entropy = 4.76", "text.max_line_length = 7226.00" ], "i": "objectives/command-and-control/backdoor/webshell/obf-dispatch::php-eval-base64-backdoor", "l": 4, "m": "B0030" }, { "c": 0.8999999761581421, "d": "PHP webshell which directly eval()s obfuscated string", "e": [ "eval(gzuncompress(base64_decode", "\u003c?" ], "i": "third_party/SigBase/WEBSHELL/PHP/Gzinflated", "l": 5 }, { "c": 0.8999999761581421, "d": "PHP webshell using $a($code) for kind of eval with encoded blob to decode, e.g. b374k", "e": [ "eval(", "\u003c?", "\u003c?php" ], "i": "third_party/SigBase/WEBSHELL/PHP/Dynamic/Big", "l": 5 }, { "c": 0.8999999761581421, "d": "PHP webshell using some kind of eval with encoded blob to decode, which is checked with YARAs math.entropy module", "e": [ "\u003c?", "eval(g", "\u003c?php" ], "i": "third_party/SigBase/WEBSHELL/PHP/Encoded/Big", "l": 5 }, { "c": 0.8999999761581421, "d": "Known PHP Webshells which contain unique strings, lousy rule for low hanging fruits. Most are catched by other rules in here but maybe these catch different versions.", "e": [ "\u003c?php eval(", "\u003c?" ], "i": "third_party/SigBase/WEBSHELL/PHP/By/String/Known/Webshell", "l": 5 } ], "sha": "2747a178d2c9665dd571ad730a055894bf37d964f972654a7059cf8d75cecfab", "path": "Dimple.php", "type": "php" } ], "tv": "a9555" } }