{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 0.9918832778930664,
        "class": 2
      }
    ],
    "prob": 0.9918833,
    "class": 2,
    "models": [
      {
        "m": "az",
        "prob": 0.30233762,
        "class": 0
      },
      {
        "m": "az/scripts",
        "prob": 0.8166724,
        "class": 0
      },
      {
        "m": "az/php",
        "prob": 0.9918833,
        "class": 2
      }
    ],
    "version": "v16.16",
    "thresholds": [
      0.9961138,
      0.99909174
    ],
    "analyzed_at": "2026-05-08T22:35:46Z"
  },
  "path": "6970155c34e6b1f233a15c88ba279826",
  "raw": {
    "v": "4",
    "fs": [
      {
        "f": "O₄(C₅CaILa)H₃(Cm₂Db₂F)Md",
        "k": {
          "source.imports[0]": "class_exists",
          "source.imports[1]": "closedir",
          "source.imports[2]": "empty",
          "source.imports[3]": "fclose",
          "source.imports[4]": "file_exists",
          "source.imports[5]": "fopen",
          "source.imports[6]": "function_exists",
          "source.imports[7]": "fwrite",
          "source.imports[8]": "gzclose",
          "source.imports[9]": "gzopen",
          "source.strings[0]": ".zip or .gz files found, ready for extraction",
          "source.strings[1]": "\u003c/option\u003e",
          "source.strings[2]": "\u003coption\u003e",
          "source.strings[3]": "\u003coption\u003e$zip\u003c/option\u003e",
          "source.strings[4]": "\u003cspan style=\"color:green; font-weight:bold;font-size:120%;\"\u003eFile unzipped successfully.\u003c/span\u003e",
          "source.strings[5]": "\u003cspan style=\"color:green; font-weight:bold;font-size:120%;\"\u003eFiles unzipped successfully\u003c/span\u003e",
          "source.strings[6]": "\u003cspan style=\"color:red; font-weight:bold;font-size:120%;\"\u003eError unzipping file.\u003c/span\u003e",
          "source.strings[7]": "\u003cspan style=\"color:red; font-weight:bold;font-size:120%;\"\u003eError: Cannot read .zip archive.\u003c/span\u003e",
          "source.strings[8]": "\u003cspan style=\"color:red; font-weight:bold;font-size:120%;\"\u003eError: Directory not writeable by webserver.\u003c/span\u003e",
          "source.strings[9]": "\u003cspan style=\"color:red; font-weight:bold;font-size:120%;\"\u003eError: No .zip or .gz files found.\u003c/span\u003e",
          "source.has_imports": true,
          "source.imports[10]": "gzread",
          "source.imports[11]": "in_array",
          "source.imports[12]": "is_writeable",
          "source.imports[13]": "microtime",
          "source.imports[14]": "opendir",
          "source.imports[15]": "pathinfo",
          "source.imports[16]": "readdir",
          "source.imports[17]": "strip_tags",
          "source.imports[18]": "strlen",
          "source.strings[10]": "\u003cspan style=\"color:red; font-weight:bold;font-size:120%;\"\u003eError: Your PHP has no zlib support enabled.\u003c/span\u003e",
          "source.strings[11]": "\u003cspan style=\"color:red; font-weight:bold;font-size:120%;\"\u003eError: Your PHP version does not support unzip functionality.\u003c/span\u003e",
          "source.strings[12]": "ZipArchive",
          "source.strings[13]": "gzopen",
          "source.strings[14]": "zipfile",
          "source.functions[0]": "__construct",
          "source.functions[1]": "extract",
          "source.functions[2]": "extractGzipFile",
          "source.functions[3]": "extractZipArchive"
        },
        "x": 65,
        "id": 0,
        "is": [
          "microtime",
          "microtime",
          "opendir",
          "readdir",
          "pathinfo",
          "pathinfo",
          "closedir",
          "empty",
          "strip_tags",
          "in_array",
          "pathinfo",
          "class_exists",
          "is_writeable",
          "function_exists",
          "pathinfo",
          "gzopen",
          "fopen",
          "gzread",
          "fwrite",
          "strlen",
          "gzclose",
          "fclose",
          "file_exists"
        ],
        "ms": {
          "file": {
            "size": 6656.0
          },
          "text": {
            "digit_ratio": 0.04,
            "space_count": 1290.0,
            "total_lines": 208.0,
            "char_entropy": 5.09,
            "unique_chars": 85.0,
            "import_density": 11.06,
            "string_density": 0.22,
            "avg_line_length": 30.01,
            "max_line_length": 151.0,
            "empty_line_ratio": 0.04,
            "last_line_length": 7.0,
            "most_common_char": "e",
            "whitespace_ratio": 0.26,
            "most_common_ratio": 0.06,
            "identifier_density": 0.6,
            "line_length_stddev": 30.01,
            "normalized_import_count": 1.59,
            "normalized_string_count": 3.12,
            "repeated_char_sequences": 2.0,
            "suspicious_comment_ratio": 0.15,
            "max_inline_whitespace_run": 2.0,
            "normalized_function_count": 0.28,
            "imports_to_functions_ratio": 5.75,
            "strings_to_functions_ratio": 11.25,
            "normalized_unique_identifiers": 6.36,
            "identifiers_to_functions_ratio": 12.25
          },
          "imports": {
            "total": 23.0,
            "unique_modules": 19.0,
            "third_party_count": 23.0,
            "third_party_ratio": 1.0
          },
          "strings": {
            "total": 45.0,
            "avg_length": 40.76,
            "max_length": 126.0,
            "avg_entropy": 2.73,
            "total_bytes": 1834.0,
            "entropy_stddev": 1.87
          },
          "comments": {
            "chars": 963.0,
            "lines": 33.0,
            "total": 13.0,
            "to_code_ratio": 0.19,
            "base64_in_comments": 1.0,
            "high_entropy_comments": 1.0
          },
          "functions": {
            "total": 4.0,
            "length_stddev": 6.5,
            "avg_name_length": 12.5,
            "no_params_count": 4.0,
            "avg_length_lines": 21.25,
            "max_length_lines": 29.0,
            "min_length_lines": 11.0,
            "high_entropy_names": 1.0,
            "density_per_100_lines": 1.92,
            "code_in_functions_ratio": 0.41
          },
          "identifiers": {
            "total": 124.0,
            "avg_length": 7.86,
            "max_length": 18.0,
            "min_length": 2.0,
            "avg_entropy": 2.59,
            "reuse_ratio": 0.4,
            "unique_count": 49.0,
            "length_stddev": 3.74,
            "high_entropy_count": 1.0,
            "high_entropy_ratio": 0.02,
            "all_lowercase_ratio": 0.84,
            "all_uppercase_ratio": 0.06,
            "underscore_prefix_count": 2.0
          }
        },
        "ss": [
          [
            524,
            "."
          ],
          [
            525,
            "."
          ],
          [
            822,
            "zip"
          ],
          [
            823,
            "zip"
          ],
          [
            882,
            "gz"
          ],
          [
            883,
            "gz"
          ],
          [
            1042,
            ".zip or .gz files found, ready for extraction"
          ],
          [
            1043,
            ".zip or .gz files found, ready for extraction"
          ],
          [
            1139,
            "\u003cspan style=\"color:red; font-weight:bold;font-size:120%;\"\u003eError: No .zip or .gz files found.\u003c/span\u003e"
          ],
          [
            1140,
            "\u003cspan style=\"color:red; font-weight:bold;font-size:120%;\"\u003eError: No .zip or .gz files found.\u003c/span\u003e"
          ],
          [
            1404,
            "zipfile"
          ],
          [
            1405,
            "zipfile"
          ],
          [
            1744,
            "zip"
          ],
          [
            1745,
            "zip"
          ],
          [
            1848,
            "gz"
          ],
          [
            1849,
            "gz"
          ],
          [
            2197,
            "ZipArchive"
          ],
          [
            2198,
            "ZipArchive"
          ],
          [
            2237,
            "\u003cspan style=\"color:red; font-weight:bold;font-size:120%;\"\u003eError: Your PHP version does not support unzip functionality.\u003c/span\u003e"
          ],
          [
            2238,
            "\u003cspan style=\"color:red; font-weight:bold;font-size:120%;\"\u003eError: Your PHP version does not support unzip functionality.\u003c/span\u003e"
          ],
          [
            2578,
            "/"
          ],
          [
            2579,
            "/"
          ],
          [
            2675,
            "\u003cspan style=\"color:green; font-weight:bold;font-size:120%;\"\u003eFiles unzipped successfully\u003c/span\u003e"
          ],
          [
            2676,
            "\u003cspan style=\"color:green; font-weight:bold;font-size:120%;\"\u003eFiles unzipped successfully\u003c/span\u003e"
          ],
          [
            2821,
            "\u003cspan style=\"color:red; font-weight:bold;font-size:120%;\"\u003eError: Directory not writeable by webserver.\u003c/span\u003e"
          ],
          [
            2822,
            "\u003cspan style=\"color:red; font-weight:bold;font-size:120%;\"\u003eError: Directory not writeable by webserver.\u003c/span\u003e"
          ],
          [
            2985,
            "\u003cspan style=\"color:red; font-weight:bold;font-size:120%;\"\u003eError: Cannot read .zip archive.\u003c/span\u003e"
          ],
          [
            2986,
            "\u003cspan style=\"color:red; font-weight:bold;font-size:120%;\"\u003eError: Cannot read .zip archive.\u003c/span\u003e"
          ],
          [
            3321,
            "gzopen"
          ],
          [
            3322,
            "gzopen"
          ],
          [
            3357,
            "\u003cspan style=\"color:red; font-weight:bold;font-size:120%;\"\u003eError: Your PHP has no zlib support enabled.\u003c/span\u003e"
          ],
          [
            3358,
            "\u003cspan style=\"color:red; font-weight:bold;font-size:120%;\"\u003eError: Your PHP has no zlib support enabled.\u003c/span\u003e"
          ],
          [
            3581,
            "rb"
          ],
          [
            3582,
            "rb"
          ],
          [
            3618,
            "w"
          ],
          [
            3619,
            "w"
          ],
          [
            3843,
            "/"
          ],
          [
            3844,
            "/"
          ],
          [
            3886,
            "\u003cspan style=\"color:green; font-weight:bold;font-size:120%;\"\u003eFile unzipped successfully.\u003c/span\u003e"
          ],
          [
            3887,
            "\u003cspan style=\"color:green; font-weight:bold;font-size:120%;\"\u003eFile unzipped successfully.\u003c/span\u003e"
          ],
          [
            4026,
            "\u003cspan style=\"color:red; font-weight:bold;font-size:120%;\"\u003eError unzipping file.\u003c/span\u003e"
          ],
          [
            4027,
            "\u003cspan style=\"color:red; font-weight:bold;font-size:120%;\"\u003eError unzipping file.\u003c/span\u003e"
          ],
          [
            6342,
            "\u003coption\u003e$zip\u003c/option\u003e"
          ],
          [
            6343,
            "\u003coption\u003e"
          ],
          [
            6355,
            "\u003c/option\u003e"
          ]
        ],
        "sz": 6656,
        "ts": [
          {
            "c": 0.7599999904632568,
            "d": "Regex component marker",
            "e": [
              "directory"
            ],
            "i": "micro-behaviors/data/text/llm/action::llm-path-navigation-action--rx-21",
            "l": 1
          },
          {
            "c": 0.8600000143051147,
            "d": "Regex component marker",
            "e": [
              "method="
            ],
            "i": "objectives/command-and-control/backdoor/webshell/ui::self-named-get-form--rx-3",
            "l": 1,
            "m": "B0030"
          },
          {
            "a": "T1071.001",
            "c": 0.699999988079071,
            "d": "HTTP POST method",
            "e": [
              "\"POST\""
            ],
            "i": "micro-behaviors/communications/http/post::post",
            "l": 1,
            "m": "C0002"
          },
          {
            "c": 0.8999999761581421,
            "d": "File has 30 or more lines",
            "e": [
              "text.total_lines = 208.00"
            ],
            "i": "metadata/file/text/metrics::file-has-30-plus-lines",
            "l": 1
          },
          {
            "a": "T1546",
            "c": 1.0,
            "d": "Writes data to a file via functions",
            "e": [
              "fopen("
            ],
            "i": "micro-behaviors/fs/file/write/direct::php-file-write-func",
            "l": 2
          },
          {
            "c": 0.800000011920929,
            "d": "Generates HTML content (DOCTYPE)",
            "e": [
              "\u003c!DOCTYPE html\u003e"
            ],
            "i": "micro-behaviors/data/format/html::html-generator-doctype",
            "l": 2
          },
          {
            "a": "T1083",
            "c": 1.0,
            "d": "Iterate directory contents via functions in PHP",
            "e": [
              "opendir("
            ],
            "i": "micro-behaviors/fs/directory/traverse::php-dir-traverse-fn",
            "l": 2
          },
          {
            "a": "T1505.003",
            "d": "PHP open tag",
            "e": [
              "\u003c?php"
            ],
            "i": "objectives/command-and-control/backdoor/webshell/request::php-tag",
            "l": 1,
            "m": "B0030"
          },
          {
            "c": 0.800000011920929,
            "d": "Writes data to an open file",
            "e": [
              "fwrite"
            ],
            "i": "micro-behaviors/fs/write/file/direct::fwrite",
            "l": 3,
            "m": "C0052"
          },
          {
            "c": 0.6000000238418579,
            "d": "Generates HTML tags",
            "e": [
              "\u003chead\u003e"
            ],
            "i": "micro-behaviors/data/format/html::html-generator-tags",
            "l": 3
          },
          {
            "c": 0.75,
            "d": "Archive open or extract instruction",
            "e": [
              "open($archive"
            ],
            "i": "objectives/lateral-movement/social-engineering/lures::open-or-extract-zip-archive",
            "l": 1
          },
          {
            "a": "T1105",
            "c": 0.699999988079071,
            "d": "Python zipfile module",
            "e": [
              "zipfile"
            ],
            "i": "objectives/command-and-control/dropper/staging/archive::zipfile-module",
            "l": 1,
            "m": "E1105"
          },
          {
            "a": "T1505.003",
            "c": 0.4000000059604645,
            "d": "PHP $_POST parameter access",
            "e": [
              "$_POST["
            ],
            "i": "objectives/command-and-control/backdoor/webshell/request::php-post",
            "l": 1,
            "m": "B0030"
          },
          {
            "c": 0.8199999928474426,
            "d": "Detects overwrite-mode file open",
            "e": [
              "fopen($filename, \"w\""
            ],
            "i": "objectives/impact/infect/script::php-overwrite-file-mode",
            "l": 1
          },
          {
            "a": "T1059",
            "c": 0.8500000238418579,
            "d": "HTTP POST parameter access ($_POST)",
            "e": [
              "$_POST"
            ],
            "i": "micro-behaviors/communications/http/request/params::post-dup",
            "l": 3
          },
          {
            "c": 0.699999988079071,
            "d": "GPL license reference",
            "e": [
              "GPL"
            ],
            "i": "metadata/package/license::gpl-word",
            "l": 2
          },
          {
            "a": "T1505.003",
            "c": 1.0,
            "d": "Inequality check in WordPress user list",
            "e": [
              "!="
            ],
            "i": "objectives/command-and-control/backdoor/webshell/hide::wp-user-hiding-not-trait",
            "l": 1,
            "m": "B0030"
          },
          {
            "a": "T1505.003",
            "c": 0.8500000238418579,
            "d": "PHP request superglobal access",
            "e": [
              "$_POST"
            ],
            "i": "objectives/command-and-control/backdoor/webshell/upload::php-request-variadic-function-call",
            "l": 3,
            "m": "B0030"
          },
          {
            "c": 0.699999988079071,
            "d": "AJAX request handler pattern",
            "e": [
              "$_POST['zipfile']"
            ],
            "i": "objectives/command-and-control/backdoor/webshell/ui::ajax-handler",
            "l": 4,
            "m": "B0030"
          },
          {
            "a": "T1566.002",
            "c": 0.8500000238418579,
            "d": "PHP script writing POST data to local file",
            "e": [
              "$_POST",
              "fopen("
            ],
            "i": "objectives/credential-access/phishing/tactics::php-credential-exfiltration",
            "l": 4,
            "m": "B0030"
          },
          {
            "c": 1.0,
            "d": "php code embedded in string",
            "e": [
              "Detected php at offset 0x0"
            ],
            "i": "metadata/lang/embedded::php",
            "l": 2
          }
        ],
        "sha": "2892f80a7f29e134cd05d2a6d629acec5151eb683c9d19d17a5ae14580985ef9",
        "path": "6970155c34e6b1f233a15c88ba279826",
        "type": "php"
      }
    ],
    "tv": "bef72"
  }
}