{ "ml": { "v": "7", "eng": "2.0.1-rc.1", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.000011026859, "rte": "az", "prob": 0.000011026859 }, { "cls": 0, "raw": 0.0000023841858, "rte": "az/media", "prob": 0.0000023841858 }, { "cls": 0, "raw": 0.000000029802322, "rte": "az/png", "prob": 0.000000029802322 } ], "prob": 0.000011026859, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.000011026859283447266, "type": "png" } ], "version": "v18.18", "analyzed_at": "2026-06-15T06:58:55Z" }, "path": "chinese_webshell.png", "raw": { "v": "7", "tv": "061e3", "files": [ { "id": 0, "sha": "303dd7c18130823e48e858d3cd441a59f02f0458ad1a4cb685e8945872c2c3b2", "fact": { "id": "png", "met": { "png": { "a_entropy": 0.0, "chunk_count": 15.0, "trailing_bytes": 0.0, "idat_chunk_count": 13.0, "text_chunk_bytes": 0.0, "chunks_after_iend": 0.0, "compression_ratio": 0.03, "unknown_chunk_count": 0.0 }, "file": { "size": 101369.0, "entropy": 7.96, "size_bytes": 101369.0 }, "image": { "width": 1354.0, "height": 596.0, "channels": 4.0, "b_entropy": 2.19, "g_entropy": 2.19, "r_entropy": 2.18, "edge_density": 0.1, "pixel_entropy": 2.38, "histogram_flatness": 0.3 }, "binary": { "overall_entropy": 7.96 } }, "str": [ [ 11, "u8", "IHDR" ], [ 37, "u8", "IDATx" ], [ 606, "u8", "5277" ], [ 1086, "u8", "TPj6O" ], [ 2040, "u8", "DDDDDDDd" ], [ 3026, "u8", "TTT 99" ], [ 3073, "u8", "\u003cy2\u003e" ], [ 4863, "u8", "nHJJBjjj" ], [ 4964, "u8", "z5JJJ" ], [ 5475, "u8", "gIUTT" ], [ 7282, "u8", "RSS5" ], [ 8024, "u8", "/Giii" ], [ 8145, "u8", "yTTT ++" ], [ 8241, "u8", "IDAT" ], [ 8777, "u8", "Jccc" ], [ 9357, "u8", "ODDDDD" ], [ 9408, "u8", "DDDDDDDDDT" ], [ 9433, "u8", "XADDDDDDDD" ], [ 9561, "u8", "DDDDDDDDdYX" ], [ 9914, "u8", "MDDDD" ], [ 11801, "u8", "Q8cPJa" ], [ 12064, "u8", "233q" ], [ 12482, "u8", "aPJDDDD" ], [ 12522, "u8", "NbEBE" ], [ 12773, "u8", "4JJJ" ], [ 12922, "u8", "zPju" ], [ 13395, "u8", "%%%(--EQQ" ], [ 15541, "u8", "`PJDDDDDDDD" ], [ 15843, "u8", "uDDPj" ], [ 17023, "u8", "W8okv" ], [ 17531, "u8", "/'P\"eyr" ], [ 17539, "u8", "zB}[" ], [ 17630, "u8", "DNcPJDDDz" ], [ 17656, "u8", "zbPJa" ], [ 17748, "u8", "POg6X" ], [ 17756, "u8", "ecPJDDD" ], [ 17986, "u8", "9EBW" ], [ 18695, "u8", "q111" ], [ 18716, "u8", "Dvv6v" ], [ 18925, "u8", "Ett4f" ], [ 19234, "u8", "HOOGll" ], [ 19689, "u8", "vPZZRb" ], [ 19841, "u8", "HOOW" ], [ 20314, "u8", "1ZFOFu" ], [ 20988, "u8", "xEiu" ], [ 21217, "u8", "5TTT" ], [ 21598, "u8", "WVdYD" ], [ 22218, "u8", "/Fqj" ], [ 22638, "u8", "R_KNN" ], [ 22723, "u8", "IIIRYZZ" ], [ 22995, "u8", "W_EXX" ], [ 23073, "u8", "HJJBOO" ], [ 23168, "u8", "aPjnP" ], [ 23668, "u8", "577c" ], [ 23763, "u8", "1118x" ], [ 23908, "u8", "2TWW" ], [ 25556, "u8", "cFPzt" ], [ 25712, "u8", "ttuuI" ], [ 26189, "u8", "UUUR" ], [ 27793, "u8", "R466b" ], [ 28146, "u8", "6mByy9" ], [ 28428, "u8", "Ntvv" ], [ 28621, "u8", "aZee" ], [ 28758, "u8", "Bttt" ], [ 28806, "u8", "Fxx8v" ], [ 29174, "u8", "ROAiFF" ], [ 29319, "u8", "YYYX" ], [ 29352, "u8", "fCdd" ], [ 29681, "u8", "Qeee" ], [ 31207, "u8", "BF5A" ], [ 32212, "u8", "dTVVb" ], [ 32778, "u8", "DDD8" ], [ 32798, "u8", "444 99Y" ], [ 32923, "u8", "JJJBee%" ], [ 33320, "u8", "YYY8q" ], [ 34294, "u8", "T466b" ], [ 34548, "u8", "qaPJDD" ], [ 34592, "u8", "Ass3jjj" ], [ 35101, "u8", "hiiAFF" ], [ 35261, "u8", "466b" ], [ 35323, "u8", "z477c" ], [ 36135, "u8", "aFPZSQ" ], [ 36574, "u8", "kFcPJ" ], [ 36887, "u8", "B 11" ], [ 37526, "u8", "PZWtt4" ], [ 37629, "u8", "uuuhll" ], [ 37759, "u8", "hjjBTT" ], [ 38401, "u8", "R5Aikk" ], [ 38452, "u8", "Ihhh" ], [ 38473, "u8", "QQQHLLtX" ], [ 38557, "u8", "jdeea" ], [ 39142, "u8", "zjG{{;rrr D" ], [ 40306, "u8", "EPJDDDDDDDD" ], [ 42543, "u8", "477c" ], [ 42778, "u8", "ueggK" ], [ 42920, "u8", "Gidt" ], [ 43134, "u8", "J322p" ], [ 43252, "u8", "IIIAUU" ], [ 43336, "u8", "Iiii" ], [ 43439, "u8", "wDGGK" ], [ 43839, "u8", "se999" ], [ 44069, "u8", "Ftvv" ], [ 44545, "u8", "x466" ], [ 44566, "u8", "ojjBMM" ], [ 44909, "u8", "BQWA" ], [ 45373, "u8", "aaa\\yee%***xlG" ], [ 45540, "u8", "KRSSQRR" ], [ 46141, "u8", "222p" ], [ 46690, "u8", "JsrrP__" ], [ 46721, "u8", "jKoo/f" ], [ 46753, "u8", "J5VYY" ], [ 47244, "u8", "Xtuuq" ], [ 47263, "u8", "sddd //" ], [ 47980, "u8", "BCCa6" ], [ 48289, "u8", "hnnFhh" ], [ 48766, "u8", "uxPNmm-" ], [ 49414, "u8", "RCRW" ], [ 50003, "u8", "bccQRR" ], [ 50104, "u8", "JJJPRR" ], [ 50851, "u8", "QQQ0" ], [ 51426, "u8", "hiiAmm-" ], [ 52186, "u8", "9233" ], [ 52202, "u8", "Whhh" ], [ 52286, "u8", "9222" ], [ 53113, "u8", "MMMX" ], [ 54594, "u8", "RFPJ" ], [ 57645, "u8", "EPZVV" ], [ 58832, "u8", "hkkCCC" ], [ 58886, "u8", "HJJBcc#:;;q" ], [ 60367, "u8", "zzz4YF" ], [ 60795, "u8", "HMiii" ], [ 61067, "u8", "AAA8p" ], [ 61373, "u8", "Eqq1rssy" ], [ 62011, "u8", "U0JA" ], [ 62072, "u8", "Atww" ], [ 62454, "u8", "r466" ], [ 63633, "u8", "jExx" ], [ 63698, "u8", "aDiHH" ], [ 64113, "u8", "p80c" ], [ 65597, "u8", "RRRT" ], [ 65934, "u8", "7qqqhmmEgg" ], [ 66424, "u8", "iiip8" ], [ 66533, "u8", "chiiAZZ" ], [ 68036, "u8", "%%%())All" ], [ 68202, "u8", "XTTTh" ], [ 68607, "u8", "D6_4" ], [ 68617, "u8", "r477" ], [ 68928, "u8", "_Krr2\u003e" ], [ 69068, "u8", "wmGmU" ], [ 70238, "u8", "Mrr26o" ], [ 70537, "u8", "hjjBNNN" ], [ 70937, "u8", "Vtvvj" ], [ 71101, "u8", "tEiBB" ], [ 71276, "u8", "L455" ], [ 71923, "u8", "Divv6" ], [ 72531, "u8", "vdffB" ], [ 72788, "u8", "bccQTT" ], [ 72797, "u8", ".tuu" ], [ 72825, "u8", "QCkEiBB" ], [ 73074, "u8", "HMMEvv6N" ], [ 74074, "u8", "a2999" ], [ 74401, "u8", "/SW0" ], [ 75256, "u8", "KIROY" ], [ 75628, "u8", "uuuhmm" ], [ 75771, "u8", "bLfcfu" ], [ 76070, "u8", "X455a" ], [ 76096, "u8", "8z2v" ], [ 76116, "u8", "l455" ], [ 76683, "u8", "iHMM5" ], [ 77581, "u8", "iiiHHH" ], [ 79766, "u8", "444P" ], [ 79848, "u8", "rdeea" ], [ 80064, "u8", "qqqHIIAJJ" ], [ 80401, "u8", "3OGG" ], [ 80733, "u8", "8222p" ], [ 82063, "u8", "AVVVH" ], [ 82128, "u8", "iiihiiQ" ], [ 82257, "u8", "UUUHNN" ], [ 82750, "u8", "GVQPP" ], [ 84355, "u8", ")*Di aiDPZ%J" ], [ 84592, "u8", "p80j" ], [ 84627, "u8", "5HMM" ], [ 85751, "u8", "555HLL" ], [ 87887, "u8", "HNNFrr2" ], [ 88417, "u8", "poKJJ" ], [ 88701, "u8", "6TUU" ], [ 89428, "u8", "Zdj m" ], [ 90110, "u8", "WWIKR" ], [ 90124, "u8", "Tfinn" ], [ 91131, "u8", "oGyy9ZZZ" ], [ 91312, "u8", "/zzz0u" ], [ 91497, "u8", "Lttt //" ], [ 92219, "u8", "c8DiCC" ], [ 92722, "u8", "jkkQWW" ], [ 94041, "u8", "Uhnn" ], [ 94079, "u8", "mIMMu" ], [ 94264, "u8", "woRo" ], [ 94628, "u8", "9JQJQJ" ], [ 94790, "u8", "OJQJQJ" ], [ 95516, "u8", "4TTT" ], [ 95894, "u8", "dDEEa" ], [ 96208, "u8", "hiiQN" ], [ 96263, "u8", "hmmETT" ], [ 96814, "u8", "8455" ], [ 98349, "u8", "555x" ], [ 98582, "u8", "mS m" ], [ 98673, "u8", "nGbb" ], [ 99116, "u8", "lAqq" ], [ 100394, "u8", "\"PQZ_]%-I" ], [ 100920, "u8", "nGjj" ], [ 100977, "u8", "WJQJ" ], [ 101082, "u8", "bAuu5l6" ], [ 101361, "u8", "IEND" ] ], "val": { "file.stem": "chinese_webshell", "file.basename": "chinese_webshell.png", "png.chunks[0]": "IHDR", "png.chunks[1]": "IDAT", "png.chunks[2]": "IDAT", "png.chunks[3]": "IDAT", "png.chunks[4]": "IDAT", "png.chunks[5]": "IDAT", "png.chunks[6]": "IDAT", "png.chunks[7]": "IDAT", "png.chunks[8]": "IDAT", "png.chunks[9]": "IDAT", "png.chunks[10]": "IDAT", "png.chunks[11]": "IDAT", "png.chunks[12]": "IDAT", "png.chunks[13]": "IDAT", "png.chunks[14]": "IEND", "png.dimensions.width": 1354, "png.dimensions.height": 596, "png.dimensions.bit_depth": 8, "png.dimensions.interlace": "none", "png.dimensions.color_type": "truecolor_alpha" } }, "find": [ { "id": "metadata/package/files::png-extension-basename", "conf": 0.8999999761581421, "crit": 1, "desc": "Filename ends with .png" } ], "path": "chinese_webshell.png", "size": 101369, "type": "png" } ] } }