{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9999692440032959, "class": 2 } ], "prob": 0.99996924, "class": 2, "models": [ { "m": "az", "prob": 0.9987153, "class": 1 }, { "m": "az/scripts", "prob": 0.999624, "class": 2 }, { "m": "az/php", "prob": 0.99996924, "class": 2 } ], "version": "v16.16", "thresholds": [ 0.9961138, 0.99909174 ], "analyzed_at": "2026-05-09T07:43:04Z" }, "path": "wp-system.php.malware", "raw": { "v": "4", "fs": [ { "f": "O₂(As₂C₂)MdTh", "k": { "source.imports[0]": "fdgfdhgcx", "source.strings[0]": "4eg03(pm)b6.fnwvsic5hz;y1u82xqo9/j_ka7dtrl*", "source.has_imports": true, "source.functions[0]": "fdgfdhgcx" }, "x": 144, "id": 0, "is": [ "fdgfdhgcx", "fdgfdhgcx", "fdgfdhgcx", "fdgfdhgcx", "fdgfdhgcx", "fdgfdhgcx", "fdgfdhgcx", "fdgfdhgcx", "fdgfdhgcx", "fdgfdhgcx", "fdgfdhgcx", "fdgfdhgcx", "fdgfdhgcx", "fdgfdhgcx", "fdgfdhgcx", "fdgfdhgcx", "fdgfdhgcx", "fdgfdhgcx", "fdgfdhgcx", "fdgfdhgcx", "fdgfdhgcx", "fdgfdhgcx", "fdgfdhgcx", "fdgfdhgcx", "fdgfdhgcx", "fdgfdhgcx", "fdgfdhgcx", "fdgfdhgcx", "fdgfdhgcx", "fdgfdhgcx", "fdgfdhgcx", "fdgfdhgcx" ], "ms": { "file": { "size": 27085.0 }, "text": { "digit_ratio": 0.18, "space_count": 65.0, "total_lines": 1.0, "char_entropy": 6.09, "unique_chars": 83.0, "import_density": 3200.0, "lines_over_200": 1.0, "lines_over_500": 1.0, "string_density": 8.0, "avg_line_length": 27085.0, "lines_over_1000": 1.0, "max_line_length": 27085.0, "last_line_length": 27085.0, "long_token_count": 2.0, "most_common_char": "7", "whitespace_ratio": 0.0, "most_common_ratio": 0.02, "identifier_density": 164.0, "encoded_string_ratio": 0.25, "normalized_import_count": 32.0, "normalized_string_count": 8.0, "max_inline_whitespace_run": 2.0, "normalized_function_count": 1.0, "imports_to_functions_ratio": 32.0, "strings_to_functions_ratio": 8.0, "suspicious_identifier_ratio": 0.68, "identifiers_to_functions_ratio": 31.0 }, "imports": { "total": 32.0, "unique_modules": 1.0, "third_party_count": 32.0, "third_party_ratio": 1.0 }, "strings": { "total": 8.0, "avg_length": 6253.5, "max_length": 24968.0, "avg_entropy": 2.86, "total_bytes": 50028.0, "entropy_stddev": 2.86, "base64_candidates": 2.0, "very_long_strings": 2.0, "high_entropy_count": 4.0 }, "comments": { "chars": 64.0, "lines": 1.0, "total": 1.0 }, "functions": { "total": 1.0, "one_liners": 1.0, "avg_name_length": 9.0, "no_params_count": 1.0, "avg_length_lines": 1.0, "max_length_lines": 1.0, "min_length_lines": 1.0, "density_per_100_lines": 100.0, "code_in_functions_ratio": 1.0 }, "identifiers": { "total": 164.0, "avg_length": 8.58, "max_length": 10.0, "min_length": 1.0, "avg_entropy": 2.75, "reuse_ratio": 0.19, "unique_count": 31.0, "length_stddev": 2.61, "has_digit_ratio": 0.87, "sequential_names": 3.0, "base64_like_names": 18.0, "single_char_count": 3.0, "single_char_ratio": 0.1, "all_lowercase_ratio": 0.13, "numeric_suffix_count": 27.0 } }, "ss": [ [ 94, "4eg03(pm)b6.fnwvsic5hz;y1u82xqo9/j_ka7dtrl*" ], [ 95, "4eg03(pm)b6.fnwvsic5hz;y1u82xqo9/j_ka7dtrl*" ], [ 27064, "}" ], [ 27065, "}" ], [ 27078, "//" ], [ 27079, "//" ] ], "sz": 27085, "ts": [ { "a": "T1027", "c": 0.8999999761581421, "d": "Exactly one line exceeds 1000 chars", "e": [ "text.lines_over_1000 = 1.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::single-long-line-outlier", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "PHP variable function invocation pattern", "e": [ "UcpEVe6860" ], "i": "objectives/anti-static/obfuscation/imports::dynamic-function-execution", "l": 3 }, { "a": "T1505.003", "d": "PHP open tag", "e": [ "\u003c?php" ], "i": "objectives/command-and-control/backdoor/webshell/request::php-tag", "l": 1, "m": "B0030" }, { "a": "T1027", "c": 0.8999999761581421, "d": "Last line is over 1000 chars", "e": [ "text.last_line_length = 27085.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::last-line-over-1000", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "File is a one-liner", "e": [ "text.total_lines = 1.00" ], "i": "metadata/file/text/metrics::file-one-liner", "l": 1 }, { "c": 0.800000011920929, "d": "Very short file (under 12 lines)", "e": [ "text.total_lines = 1.00" ], "i": "metadata/file/text/metrics::file-under-12-lines", "l": 1 }, { "a": "T1505.003", "c": 0.8399999737739563, "d": "Near-zero whitespace script", "e": [ "text.whitespace_ratio = 0.00" ], "i": "objectives/command-and-control/backdoor/webshell/stager::near-zero-whitespace", "l": 1 }, { "c": 0.8999999761581421, "d": "Very long line", "e": [ "text.max_line_length = 27085.00" ], "i": "metadata/file/text/metrics::single-long-line", "l": 1 }, { "a": "T1505.003", "c": 0.8600000143051147, "d": "Very long embedded string", "e": [ "strings.max_length = 24968.00" ], "i": "objectives/command-and-control/backdoor/webshell/stager::very-long-string", "l": 1 }, { "a": "T1027", "c": 0.8500000238418579, "d": "High function density", "e": [ "functions.density_per_100_lines = 100.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/functions::high-function-density", "l": 2, "m": "B0032" }, { "a": "T1027", "c": 0.800000011920929, "d": "High overall text entropy (encoded", "e": [ "text.char_entropy = 6.09" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::high-text-entropy", "l": 2, "m": "B0032" }, { "a": "T1027", "c": 0.8999999761581421, "d": "PHP source contains very long line", "e": [ "text.max_line_length = 27085.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/identifiers::php-single-long-line", "l": 4, "m": "B0032" }, { "a": "T1027", "c": 0.699999988079071, "d": "Very low whitespace ratio (minified/compressed)", "e": [ "text.whitespace_ratio = 0.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::low-whitespace", "l": 2, "m": "B0032" }, { "a": "T1027", "c": 0.8999999761581421, "d": "Minified/compressed code (multiple indicators)", "e": [ "text.whitespace_ratio = 0.00", "functions.density_per_100_lines = 100.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::minified-code", "l": 2, "m": "B0032" }, { "c": 0.8999999761581421, "d": "PHP webshell using $a($code) for kind of eval with encoded blob to decode, e.g. b374k", "e": [ "\u003c?", "$UcpEVe6860($", "\u003c?php" ], "i": "third_party/SigBase/WEBSHELL/PHP/Dynamic/Big", "l": 5 } ], "sha": "3316d1ac808bb01b297e262197ee4018286bce0860da47995d93cdd15fcaf1ef", "path": "e0e08c7fdca752dbeac50a91c1e7784c.php", "type": "php" } ], "tv": "a9555" } }