{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.07645270228385925, "class": 0 } ], "prob": 0.0764527, "class": 0, "models": [ { "m": "az", "prob": 0.0764527, "class": 0 }, { "m": "az/scripts", "prob": 0.014546395, "class": 0 }, { "m": "az/php", "prob": 0.00065807684, "class": 0 } ], "version": "v16.16", "thresholds": [ 0.9961138, 0.99909174 ], "analyzed_at": "2026-05-09T02:39:23Z" }, "path": "http.php", "raw": { "v": "4", "fs": [ { "f": "O₃(As₂C₂La)H₂(Cm₃Db₃)Md", "k": { "source.imports[0]": "array_shift", "source.imports[1]": "base64_encode", "source.imports[2]": "curl_exec", "source.imports[3]": "curl_getinfo", "source.imports[4]": "curl_init", "source.imports[5]": "curl_setopt", "source.imports[6]": "defined", "source.imports[7]": "fclose", "source.imports[8]": "fopen", "source.imports[9]": "function_exists", "source.strings[0]": "$cookieName=", "source.strings[1]": "/(\\w+\\/\\d\\.\\d) (\\d{3})/", "source.strings[2]": "Authorization: Basic ", "source.strings[3]": "CURLOPT_ACCEPT_ENCODING", "source.strings[4]": "CURLOPT_ENCODING", "source.strings[5]": "Content-Length: ", "source.strings[6]": "Cookie: ", "source.strings[7]": "Cookie: $cookies\\r\\n", "source.strings[8]": "Host: ", "source.strings[9]": "Host: $urlParsed[host]\\r\\n", "source.has_imports": true, "source.imports[10]": "http_build_query", "source.imports[11]": "is_array", "source.imports[12]": "is_resource", "source.imports[13]": "join", "source.imports[14]": "parse_url", "source.imports[15]": "preg_match_all", "source.imports[16]": "rtrim", "source.imports[17]": "stream_context_create", "source.imports[18]": "stream_get_contents", "source.imports[19]": "stream_get_meta_data", "source.imports[20]": "trim", "source.imports[21]": "urlencode", "source.strings[10]": "Need to provide a valid HTTP transport before calling ", "source.strings[11]": "No valid HTTP transport found.", "source.strings[12]": "User-Agent: Wordfence Streams UA", "source.strings[13]": "User-Agent: Wordfence Streams UA\\r\\n", "source.strings[14]": "WFWAF_RUN_COMPLETE", "source.strings[15]": "WFWAF_VERSION", "source.strings[16]": "cacert.pem", "source.strings[17]": "content", "source.strings[18]": "curl_init", "source.strings[19]": "file_get_contents", "source.strings[20]": "follow_location", "source.strings[21]": "header", "source.strings[22]": "ignore_errors", "source.strings[23]": "max_redirects", "source.strings[24]": "method", "source.strings[25]": "password", "source.strings[26]": "scheme", "source.strings[27]": "timeout", "source.strings[28]": "user-agent", "source.strings[29]": "wrapper_data", "source.functions[0]": "buildCookieString", "source.functions[1]": "get", "source.functions[2]": "getAuth", "source.functions[3]": "getBody", "source.functions[4]": "getConnectTimeout", "source.functions[5]": "getCookies", "source.functions[6]": "getFirstTransport", "source.functions[7]": "getHeaders", "source.functions[8]": "getInstance", "source.functions[9]": "getMethod", "source.functions[10]": "getQueryString", "source.functions[11]": "getStatusCode", "source.functions[12]": "getTimeout", "source.functions[13]": "getTransport", "source.functions[14]": "getUrl", "source.functions[15]": "post", "source.functions[16]": "send", "source.functions[17]": "setAuth", "source.functions[18]": "setBody", "source.functions[19]": "setConnectTimeout", "source.functions[20]": "setCookies", "source.functions[21]": "setHeaders", "source.functions[22]": "setInstance", "source.functions[23]": "setMethod", "source.functions[24]": "setQueryString", "source.functions[25]": "setStatusCode", "source.functions[26]": "setTimeout", "source.functions[27]": "setTransport", "source.functions[28]": "setUrl" }, "x": 30, "id": 0, "is": [ "defined", "defined", "function_exists", "function_exists", "urlencode", "rtrim", "is_array", "http_build_query", "curl_init", "curl_setopt", "curl_setopt", "curl_setopt", "is_array", "curl_setopt", "is_array", "curl_setopt", "curl_setopt", "curl_setopt", "curl_setopt", "defined", "curl_setopt", "defined", "curl_setopt", "curl_setopt", "curl_setopt", "curl_exec", "curl_getinfo", "is_array", "http_build_query", "parse_url", "base64_encode", "is_array", "is_array", "trim", "stream_context_create", "fopen", "is_resource", "stream_get_meta_data", "array_shift", "preg_match_all", "join", "stream_get_contents", "fclose" ], "ms": { "file": { "size": 10720.0 }, "text": { "tab_count": 688.0, "digit_ratio": 0.0, "space_count": 843.0, "total_lines": 472.0, "char_entropy": 5.31, "mixed_indent": true, "unique_chars": 87.0, "import_density": 9.11, "string_density": 0.22, "avg_line_length": 21.71, "max_line_length": 130.0, "empty_line_ratio": 0.13, "last_line_length": 1.0, "most_common_char": "e", "whitespace_ratio": 0.19, "most_common_ratio": 0.07, "identifier_density": 1.01, "line_length_stddev": 22.09, "normalized_import_count": 1.98, "normalized_string_count": 4.69, "repeated_char_sequences": 1.0, "suspicious_comment_ratio": 0.4, "max_inline_whitespace_run": 10.0, "normalized_function_count": 1.66, "trailing_whitespace_lines": 4.0, "imports_to_functions_ratio": 1.19, "strings_to_functions_ratio": 2.83, "normalized_unique_identifiers": 13.06, "identifiers_to_functions_ratio": 3.22 }, "imports": { "total": 43.0, "unique_modules": 22.0, "third_party_count": 43.0, "third_party_ratio": 1.0 }, "strings": { "total": 102.0, "avg_length": 9.7, "max_length": 54.0, "path_count": 2.0, "avg_entropy": 2.11, "total_bytes": 989.0, "entropy_stddev": 1.36 }, "comments": { "chars": 1865.0, "lines": 125.0, "total": 42.0, "todo_count": 2.0, "to_code_ratio": 0.36, "base64_in_comments": 8.0, "high_entropy_comments": 9.0 }, "functions": { "total": 36.0, "one_liners": 1.0, "length_stddev": 16.13, "avg_name_length": 9.53, "no_params_count": 36.0, "avg_length_lines": 7.81, "max_length_lines": 84.0, "min_length_lines": 1.0, "high_entropy_names": 1.0, "density_per_100_lines": 7.63, "code_in_functions_ratio": 0.6 }, "identifiers": { "total": 479.0, "avg_length": 10.7, "max_length": 27.0, "min_length": 2.0, "avg_entropy": 2.86, "reuse_ratio": 0.24, "unique_count": 116.0, "length_stddev": 5.21, "has_digit_ratio": 0.01, "high_entropy_count": 16.0, "high_entropy_ratio": 0.14, "all_lowercase_ratio": 0.45, "all_uppercase_ratio": 0.13, "double_underscore_count": 1.0, "underscore_prefix_count": 4.0 } }, "ss": [ [ 18, "WFWAF_VERSION" ], [ 19, "WFWAF_VERSION" ], [ 47, "WFWAF_RUN_COMPLETE" ], [ 48, "WFWAF_RUN_COMPLETE" ], [ 647, "GET" ], [ 648, "GET" ], [ 1288, "POST" ], [ 1289, "POST" ], [ 1714, "Need to provide a valid HTTP transport before calling " ], [ 1715, "Need to provide a valid HTTP transport before calling " ], [ 4720, "curl_init" ], [ 4721, "curl_init" ], [ 4805, "file_get_contents" ], [ 4806, "file_get_contents" ], [ 4916, "No valid HTTP transport found." ], [ 4917, "No valid HTTP transport found." ], [ 5156, "$cookieName=" ], [ 5168, "=" ], [ 5193, "; " ], [ 5194, "; " ], [ 6052, "\u0026" ], [ 6053, "\u0026" ], [ 6100, "?" ], [ 6101, "?" ], [ 6117, "\u0026" ], [ 6118, "\u0026" ], [ 6123, "?" ], [ 6124, "?" ], [ 6241, "post" ], [ 6242, "post" ], [ 6472, "user" ], [ 6473, "user" ], [ 6494, "password" ], [ 6495, "password" ], [ 6862, " " ], [ 6863, " " ], [ 7181, "CURLOPT_ACCEPT_ENCODING" ], [ 7182, "CURLOPT_ACCEPT_ENCODING" ], [ 7362, "CURLOPT_ENCODING" ], [ 7363, "CURLOPT_ENCODING" ], [ 7519, "cacert.pem" ], [ 7520, "cacert.pem" ], [ 8457, "\u0026" ], [ 8458, "\u0026" ], [ 8505, "?" ], [ 8506, "?" ], [ 8522, "\u0026" ], [ 8523, "\u0026" ], [ 8528, "?" ], [ 8529, "?" ], [ 8614, "Host: $urlParsed[host]\\r\\n" ], [ 8615, "Host: " ], [ 8696, "Authorization: Basic " ], [ 8697, "Authorization: Basic " ], [ 8742, "user" ], [ 8743, "user" ], [ 8764, "password" ], [ 8765, "password" ], [ 8779, "\\r\\n" ], [ 8933, "Cookie: $cookies\\r\\n" ], [ 8934, "Cookie: " ], [ 9151, "user-agent" ], [ 9152, "user-agent" ], [ 9222, " " ], [ 9223, " " ], [ 9238, "\\r\\n" ], [ 9293, "User-Agent: Wordfence Streams UA\\r\\n" ], [ 9294, "User-Agent: Wordfence Streams UA" ], [ 9365, "method" ], [ 9366, "method" ], [ 9412, "ignore_errors" ], [ 9413, "ignore_errors" ], [ 9442, "timeout" ], [ 9443, "timeout" ], [ 9476, "follow_location" ], [ 9477, "follow_location" ], [ 9503, "max_redirects" ], [ 9504, "max_redirects" ], [ 9601, "content" ], [ 9602, "content" ], [ 9650, "Content-Length: " ], [ 9651, "Content-Length: " ], [ 9703, "content" ], [ 9704, "content" ], [ 9717, "\\r\\n" ], [ 9744, "header" ], [ 9745, "header" ], [ 9824, "scheme" ], [ 9825, "scheme" ], [ 9942, "r" ], [ 9943, "r" ], [ 10136, "wrapper_data" ], [ 10137, "wrapper_data" ], [ 10176, "/(\\w+\\/\\d\\.\\d) (\\d{3})/" ], [ 10177, "/(\\w+\\/\\d\\.\\d) (\\d{3})/" ], [ 10443, "\\r\\n" ], [ 10461, "wrapper_data" ], [ 10462, "wrapper_data" ] ], "sz": 10720, "ts": [ { "d": "password keyword", "e": [ "password" ], "i": "micro-behaviors/data/text/keywords/lexicon::password", "l": 1 }, { "c": 0.75, "d": "File read via file_get_contents", "e": [ "file_get_contents" ], "i": "micro-behaviors/fs/read/file::file-get-contents", "l": 2, "m": "C0051" }, { "a": "T1584", "c": 1.0, "d": "PHP dynamic curl_exec call from lookup table", "e": [ "curl_exec(" ], "i": "objectives/command-and-control/dropper/delivery/seo-spam::php-dynamic-curl-exec", "l": 2 }, { "c": 0.8999999761581421, "d": "File has 30 or more lines", "e": [ "text.total_lines = 472.00" ], "i": "metadata/file/text/metrics::file-has-30-plus-lines", "l": 1 }, { "a": "T1027", "c": 1.0, "d": "Comment-heavy source context", "e": [ "comments.to_code_ratio = 0.36" ], "i": "objectives/anti-static/obfuscation/code-metrics/strings::comment-heavy-source", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.75, "d": "Many no-param functions", "e": [ "functions.no_params_count = 36.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/functions::many-no-param-functions", "l": 2, "m": "B0032" }, { "d": "Cookie header", "e": [ "Cookie:" ], "i": "micro-behaviors/communications/http/cookies::cookie-header", "l": 3 }, { "a": "T1505.003", "d": "PHP open tag", "e": [ "\u003c?php" ], "i": "objectives/command-and-control/backdoor/webshell/request::php-tag", "l": 1, "m": "B0030" }, { "c": 0.8199999928474426, "d": "Generic weak-login username marker", "e": [ "'user']" ], "i": "objectives/lateral-movement/brute-force/ssh::weak-login-pair-set--rx-5", "l": 1 }, { "a": "T1505.003", "c": 1.0, "d": "Inequality check in WordPress user list", "e": [ "!=" ], "i": "objectives/command-and-control/backdoor/webshell/hide::wp-user-hiding-not-trait", "l": 1, "m": "B0030" }, { "a": "T1071.001", "c": 0.75, "d": "PHP stream context creation", "e": [ "stream_context_create" ], "i": "micro-behaviors/communications/http/xmlrpc::php-stream-context", "l": 3, "m": "C0002" }, { "a": "T1071.001", "d": "User-Agent header", "e": [ "User-Agent:" ], "i": "micro-behaviors/communications/http/request/client::user-agent-header", "l": 2, "m": "C0002" }, { "c": 0.8399999737739563, "d": "Regex component marker", "e": [ "password" ], "i": "micro-behaviors/data/text/llm/action::llm-send-action--rx-6", "l": 1 }, { "c": 0.8399999737739563, "d": "password/token/api_key field keyword", "e": [ "password" ], "i": "micro-behaviors/data/text/keywords/credential::credential-field", "l": 1 }, { "c": 0.8399999737739563, "d": "Regex component marker", "e": [ "password" ], "i": "micro-behaviors/data/text/llm/action::llm-send-action-cond-4--inline-11750", "l": 1 }, { "a": "T1071.001", "c": 0.699999988079071, "d": "HTTP POST method", "e": [ "'POST'" ], "i": "micro-behaviors/communications/http/post::post", "l": 1, "m": "C0002" }, { "d": "certificate string reference", "e": [ "certificate" ], "i": "micro-behaviors/crypto/certificate/usage::certificate-ref", "l": 2 }, { "a": "T1505.003", "c": 0.9399999976158142, "d": "Regex component marker", "e": [ "file_get_contents" ], "i": "objectives/command-and-control/backdoor/webshell/request::raw-json-post-cmd-field--rx-7", "l": 1, "m": "B0030" }, { "a": "T1027", "c": 0.699999988079071, "d": "base64_encode function call for encoding payloads", "e": [ "base64_encode" ], "i": "objectives/anti-static/obfuscation/encoding/xor::base64-encode-call", "l": 4, "m": "B0032" }, { "a": "T1546", "c": 1.0, "d": "Writes data to a file via functions", "e": [ "fopen(" ], "i": "micro-behaviors/fs/file/write/direct::php-file-write-func", "l": 2 }, { "c": 0.8399999737739563, "d": "Regex component marker", "e": [ "$cookieName=", "Cookie: $cookies\\r\\n", "Cookie: " ], "i": "micro-behaviors/data/text/llm/action::llm-send-action--rx-9", "l": 1 } ], "sha": "2864cb7f8be4ff68be72f537b449c55619bb7644cdc7d38535846e60e49414d0", "path": "http.php", "type": "php" } ], "tv": "a9555" } }