{ "ml": { "v": "7", "eng": "2.0.1-rc.1", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.00008536378, "rte": "az", "prob": 0.00008536378 }, { "cls": 0, "raw": 0.000020474195, "rte": "az/scripts", "prob": 0.000020474195 }, { "cls": 0, "raw": 0.17220014, "rte": "az/php", "prob": 0.17220014 } ], "prob": 0.00008536378, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.00008536378300050274, "type": "php" } ], "version": "v18.18", "analyzed_at": "2026-06-15T09:45:55Z" }, "path": "command.php", "raw": { "v": "7", "tv": "061e3", "files": [ { "id": 0, "ctx": [ { "a": 813, "b": "bXy+4y?dP]B98CpzF77Pazt\u003esA9)6%x(4r!ADL\u0026kC{\u003c}Ix\u003eq9\u003eB16f", "l": 38 }, { "a": 857, "b": "", "l": 39 }, { "a": 858, "b": "bX7HgjS[lSA+]8%zFshvdlv", "l": 40, "n": [ { "c": 3, "d": "cURL session initialization", "i": "micro-behaviors/communications/http/curl::init", "o": 864, "z": 9 } ] }, { "a": 877, "b": "", "l": 41 }, { "a": 878, "b": "v%8*duVP!2z/x!DbX7HslSE2TpF+1$rz(Hwas88Iy:?B", "l": 42, "n": [ { "c": 3, "d": "cURL option configuration", "i": "micro-behaviors/communications/http/curl::setopt", "o": 878, "z": 11 } ] }, { "a": 914, "b": "v%8*duVP!2z/x!DbX7HslSE2TpF+1$p!$1?efG4PB.90-", "l": 43 }, { "a": 951, "b": "v%8*duVP!2z/x!DbX7HslSE2TpF+1$p!$1?mOc3xl@LSVbXy+4y?dP]B98CpzF7yW", "l": 44 }, { "a": 1005, "b": "v%8*duVP!2z/x!DbX7HslSE2TpF+1$qBKL+qCHg?k#7uFmn+VVBAhIndlv", "l": 46 }, { "a": 1052, "b": "", "l": 47 }, { "a": 1053, "b": "bYWEqB.(dxjS[lSA+]8]CX7wkbX7Hpi@", "l": 48, "n": [ { "c": 3, "d": "cURL request execution", "i": "micro-behaviors/communications/http/curl::exec", "o": 1063, "z": 9 } ] }, { "a": 1079, "b": "wN/y(as7#sB9hqvi@", "l": 49 }, { "a": 1093, "b": "", "l": 50 } ], "mol": "H(Cm)", "sha": "3c65f84c2f8b5c66bc7aa0a25929b0fe185fdb0b7cff539f9d077edea5f51baf", "fact": { "id": "php", "imp": [ [ "", "file_get_contents" ], [ "", "str_rot13" ], [ "", "unpack" ], [ "", "strrev" ], [ "", "strlen" ], [ "", "rand" ], [ "", "rand" ], [ "", "rand" ], [ "", "strlen" ], [ "", "substr" ], [ "", "substr" ], [ "", "substr" ], [ "", "substr" ], [ "", "http_build_query" ], [ "", "curl_init" ], [ "", "curl_setopt" ], [ "", "curl_setopt" ], [ "", "curl_setopt" ], [ "", "curl_setopt" ], [ "", "curl_exec" ] ], "met": { "ast": { "op.add": 6.0, "op.sub": 3.0, "max_depth": 11.0, "bind_count": 16.0, "call_count": 20.0, "node_count": 566.0, "op_density.add": 0.01, "op_density.sub": 0.01, "identifier_count": 32.0, "string_literal_count": 12.0, "array_literal_max_length": 4.0, "string_concat_chain_max_length": 4.0 }, "file": { "size": 1093.0, "entropy": 5.27, "size_bytes": 1093.0 }, "text": { "tab_count": 4.0, "digit_ratio": 0.07, "space_count": 120.0, "total_lines": 49.0, "char_entropy": 5.27, "unique_chars": 69.0, "string_density": 0.24, "avg_line_length": 21.31, "max_line_length": 52.0, "empty_line_ratio": 0.22, "last_line_length": 13.0, "whitespace_ratio": 0.16, "most_common_ratio": 0.06, "identifier_density": 3.14, "line_length_stddev": 16.25, "normalized_string_count": 1.71, "repeated_char_sequences": 1.0, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 10.0, "most_common_char_codepoint": 36.0, "suspicious_identifier_ratio": 0.08, "normalized_unique_identifiers": 8.73 }, "binds": { "count": 16.0 }, "calls": { "count": 20.0 }, "binary": { "overall_entropy": 5.27 }, "strings": { "total": 12.0, "avg_length": 9.42, "max_length": 15.0, "avg_entropy": 2.88, "total_bytes": 113.0, "entropy_stddev": 0.73 }, "comments": { "chars": 74.0, "lines": 2.0, "total": 2.0, "to_code_ratio": 0.04 }, "identifiers": { "count": 32.0, "total": 154.0, "avg_length": 6.67, "max_length": 22.0, "min_length": 2.0, "avg_entropy": 2.32, "reuse_ratio": 0.32, "unique_count": 49.0, "length_stddev": 4.55, "has_digit_ratio": 0.31, "sequential_names": 4.0, "high_entropy_count": 3.0, "high_entropy_ratio": 0.06, "all_lowercase_ratio": 0.41, "all_uppercase_ratio": 0.08, "numeric_suffix_count": 15.0 } }, "str": [ [ 39, "10", "1" ], [ 57, "10", "2" ], [ 107, "u8", "H*" ], [ 108, "u8", "H*" ], [ 148, "10", "1" ], [ 190, "10", "1" ], [ 224, "10", "1" ], [ 258, "10", "1" ], [ 325, "u8", "Encoded string $olen characters\\n" ], [ 326, "u8", "Encoded string " ], [ 346, "u8", " characters" ], [ 368, "u8", "Substring 1: $m0\\n" ], [ 369, "u8", "Substring 1: " ], [ 396, "u8", "Substring 2: $m1\\n" ], [ 397, "u8", "Substring 2: " ], [ 424, "u8", "Substring 3: $m2\\n" ], [ 425, "u8", "Substring 3: " ], [ 452, "u8", "Substring 4: $m3\\n" ], [ 453, "u8", "Substring 4: " ], [ 510, "u8", "Sum: $sum\\n" ], [ 511, "u8", "Sum: " ], [ 539, "u8", "jweyc" ], [ 540, "u8", "jweyc" ], [ 569, "10", "0" ], [ 588, "u8", "aeskoly" ], [ 589, "u8", "aeskoly" ], [ 637, "u8", "owhggiku" ], [ 638, "u8", "owhggiku" ], [ 686, "u8", "callbrhy" ], [ 687, "u8", "callbrhy" ] ], "tgt": [ "curl_exec", "curl_init", "curl_setopt", "file_get_contents", "http_build_query", "rand", "str_rot13", "strlen", "strrev", "substr", "unpack" ], "val": { "file.stem": "command", "file.basename": "command.php", "source.language": "php", "source.imports[0]": "curl_exec", "source.imports[1]": "curl_init", "source.imports[2]": "curl_setopt", "source.imports[3]": "file_get_contents", "source.imports[4]": "http_build_query", "source.imports[5]": "rand", "source.imports[6]": "str_rot13", "source.imports[7]": "strlen", "source.imports[8]": "strrev", "source.imports[9]": "substr", "source.strings[0]": " characters", "source.strings[1]": "Encoded string ", "source.strings[2]": "Encoded string $olen characters\\n", "source.strings[3]": "Substring 1: ", "source.strings[4]": "Substring 1: $m0\\n", "source.strings[5]": "Substring 2: ", "source.strings[6]": "Substring 2: $m1\\n", "source.strings[7]": "Substring 3: ", "source.strings[8]": "Substring 3: $m2\\n", "source.strings[9]": "Substring 4: ", "source.has_imports": true, "source.imports[10]": "unpack", "source.strings[10]": "Substring 4: $m3\\n", "source.strings[11]": "Sum: $sum\\n", "source.strings[12]": "aeskoly", "source.strings[13]": "callbrhy", "source.strings[14]": "owhggiku" } }, "find": [ { "id": "micro-behaviors/communications/http/curl::init-symbol", "atk": "T1071.001", "mbc": "C0002", "conf": 0.75, "crit": 3, "desc": "cURL session init symbol" }, { "id": "micro-behaviors/communications/http/curl::setopt", "conf": 0.699999988079071, "crit": 3, "desc": "cURL option configuration" }, { "id": "micro-behaviors/communications/http/curl::exec", "atk": "T1071.001", "mbc": "C0002", "conf": 0.800000011920929, "crit": 3, "desc": "cURL request execution" }, { "id": "micro-behaviors/communications/http/curl::init", "atk": "T1071.001", "mbc": "C0002", "conf": 0.800000011920929, "crit": 3, "desc": "cURL session initialization" }, { "id": "micro-behaviors/communications/http/curl::exec-symbol", "atk": "T1071.001", "mbc": "C0002", "conf": 0.800000011920929, "crit": 3, "desc": "cURL request execution symbol" } ], "path": "command.php", "risk": 1, "size": 1093, "type": "php" } ] } }