{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9995191097259521, "class": 2 } ], "prob": 0.9995191, "class": 2, "models": [ { "m": "az", "prob": 0.9375775, "class": 0 }, { "m": "az/scripts", "prob": 0.9893082, "class": 0 }, { "m": "az/php", "prob": 0.9995191, "class": 2 } ], "version": "v16.16", "thresholds": [ 0.9961138, 0.99909174 ], "analyzed_at": "2026-05-10T00:52:05Z" }, "path": "tryit.php", "raw": { "v": "4", "fs": [ { "f": "O₄(C₅AlDyI)H₅(CmCrF₃OsDb)Md₂(Pt)", "k": { "source.imports[0]": "abs", "source.imports[1]": "base64_decode", "source.imports[2]": "basename", "source.imports[3]": "bcmul", "source.imports[4]": "count", "source.imports[5]": "crc32", "source.imports[6]": "curl_close", "source.imports[7]": "curl_exec", "source.imports[8]": "curl_init", "source.imports[9]": "curl_setopt", "source.strings[0]": "./sess_", "source.strings[1]": "/bot|crawl|spider|mediapartners|slurp|patrol/i", "source.strings[2]": "\u003ca href=", "source.strings[3]": "\u003ca href=\\", "source.strings[4]": "ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789abcdefghijklmnopqrstuvwxyz-_-_/", "source.strings[5]": "HTTP_USER_AGENT", "source.strings[6]": "HTTP_X_FORWARDED_PROTO", "source.strings[7]": "HTTP_X_FORWARDED_SSL", "source.strings[8]": "REQUEST_URI", "source.strings[9]": "SCRIPT_NAME", "source.has_imports": true, "source.imports[10]": "date", "source.imports[11]": "dirname", "source.imports[12]": "empty", "source.imports[13]": "explode", "source.imports[14]": "fclose", "source.imports[15]": "file_exists", "source.imports[16]": "file_get_contents", "source.imports[17]": "fopen", "source.imports[18]": "fread", "source.imports[19]": "function_exists", "source.imports[20]": "fwrite", "source.imports[21]": "get_between", "source.imports[22]": "get_cache", "source.imports[23]": "get_static_arr", "source.imports[24]": "http_get", "source.imports[25]": "ini_get", "source.imports[26]": "is_readable", "source.imports[27]": "is_writeable", "source.imports[28]": "isset", "source.imports[29]": "local_host", "source.imports[30]": "md5", "source.imports[31]": "mt_rand", "source.imports[32]": "preg_match", "source.imports[33]": "rand_str", "source.imports[34]": "realpath", "source.imports[35]": "session_save_path", "source.imports[36]": "str_ireplace", "source.imports[37]": "stristr", "source.imports[38]": "strlen", "source.imports[39]": "strpos", "source.imports[40]": "strtolower", "source.imports[41]": "substr", "source.imports[42]": "substr_replace", "source.imports[43]": "sys_get_temp_dir", "source.imports[44]": "tempnam", "source.imports[45]": "time", "source.imports[46]": "unlink", "source.strings[10]": "SERVER_NAME", "source.strings[11]": "SERVER_PORT", "source.strings[12]": "TMPDIR", "source.strings[13]": "Y-m-d-H-i", "source.strings[14]": "[ahref]", "source.strings[15]": "[time]", "source.strings[16]": "_get_cache(", "source.strings[17]": "_get_cache($link) -\u003e $file\\n", "source.strings[18]": "abcdefghijklmnopqrstuvwxyz", "source.strings[19]": "curl_init", "source.strings[20]": "file_get_contents", "source.strings[21]": "http://", "source.strings[22]": "http://god.sm79.xyz/api.php?g=gitt", "source.strings[23]": "https://", "source.strings[24]": "index.php", "source.strings[25]": "keyword", "source.strings[26]": "sys_get_temp_dir", "source.strings[27]": "upload_tmp_dir", "source.functions[0]": "_base_url", "source.functions[1]": "_get_between", "source.functions[2]": "_get_cache", "source.functions[3]": "_get_temp_dir_mass", "source.functions[4]": "_http_get", "source.functions[5]": "_local_host", "source.functions[6]": "_local_url", "source.functions[7]": "content_process", "source.functions[8]": "hashCode", "source.functions[9]": "isBot", "source.functions[10]": "rand_str" }, "x": 153, "id": 0, "is": [ "function_exists", "is_writeable", "sys_get_temp_dir", "is_readable", "sys_get_temp_dir", "realpath", "sys_get_temp_dir", "empty", "is_writeable", "realpath", "is_readable", "realpath", "empty", "is_writeable", "realpath", "is_readable", "realpath", "empty", "is_writeable", "realpath", "is_readable", "realpath", "tempnam", "file_exists", "unlink", "is_writeable", "realpath", "dirname", "is_readable", "realpath", "dirname", "realpath", "dirname", "is_writeable", "realpath", "ini_get", "is_readable", "realpath", "ini_get", "realpath", "ini_get", "is_writeable", "realpath", "session_save_path", "is_readable", "realpath", "session_save_path", "realpath", "session_save_path", "is_writeable", "realpath", "dirname", "is_readable", "realpath", "dirname", "realpath", "dirname", "isset", "preg_match", "empty", "md5", "substr", "substr", "abs", "crc32", "abs", "crc32", "substr", "bcmul", "mt_rand", "strlen", "mt_rand", "mt_rand", "strlen", "mt_rand", "function_exists", "file_get_contents", "function_exists", "curl_init", "curl_setopt", "curl_setopt", "curl_setopt", "curl_exec", "curl_close", "function_exists", "fopen", "fread", "strlen", "fclose", "isset", "empty", "empty", "md5", "file_get_contents", "file_exists", "http_get", "fopen", "fwrite", "fclose", "local_host", "local_host", "str_ireplace", "str_ireplace", "basename", "str_ireplace", "dirname", "stristr", "strtolower", "substr", "strlen", "strpos", "strlen", "strpos", "str_ireplace", "date", "time", "strpos", "substr_replace", "mt_rand", "count", "strlen", "strpos", "strpos", "str_ireplace", "mt_rand", "count", "str_ireplace", "get_static_arr", "strpos", "strpos", "explode", "mt_rand", "count", "explode", "get_static_arr", "count", "str_ireplace", "str_ireplace", "strpos", "mt_rand", "rand_str", "rand_str", "mt_rand", "date", "time", "rand_str", "rand_str", "mt_rand", "isset", "mt_rand", "count", "isset", "mt_rand", "count", "substr_replace", "strlen", "strpos", "base64_decode", "get_between", "get_cache" ], "ms": { "file": { "size": 7635.0 }, "text": { "tab_count": 1.0, "digit_ratio": 0.03, "space_count": 1883.0, "total_lines": 211.0, "char_entropy": 4.92, "mixed_indent": true, "unique_chars": 92.0, "import_density": 75.83, "string_density": 0.99, "avg_line_length": 35.18, "max_line_length": 196.0, "last_line_length": 17.0, "most_common_char": "t", "whitespace_ratio": 0.27, "most_common_ratio": 0.05, "identifier_density": 2.06, "line_length_stddev": 33.04, "normalized_import_count": 11.01, "normalized_string_count": 14.39, "repeated_char_sequences": 38.0, "max_inline_whitespace_run": 1.0, "normalized_function_count": 0.76, "imports_to_functions_ratio": 14.55, "strings_to_functions_ratio": 19.0, "suspicious_identifier_ratio": 0.04, "normalized_unique_identifiers": 13.08, "identifiers_to_functions_ratio": 9.18 }, "imports": { "total": 160.0, "unique_modules": 47.0, "third_party_count": 160.0, "third_party_ratio": 1.0 }, "strings": { "total": 209.0, "url_count": 6.0, "avg_length": 6.88, "max_length": 67.0, "path_count": 4.0, "avg_entropy": 1.63, "total_bytes": 1437.0, "entropy_stddev": 1.44, "high_entropy_count": 2.0 }, "comments": {}, "functions": { "total": 11.0, "length_stddev": 14.58, "avg_name_length": 10.45, "no_params_count": 11.0, "avg_length_lines": 18.91, "max_length_lines": 56.0, "min_length_lines": 4.0, "density_per_100_lines": 5.21, "code_in_functions_ratio": 0.99 }, "identifiers": { "total": 435.0, "avg_length": 7.47, "max_length": 22.0, "min_length": 1.0, "avg_entropy": 2.34, "reuse_ratio": 0.23, "unique_count": 101.0, "length_stddev": 4.36, "has_digit_ratio": 0.07, "sequential_names": 4.0, "single_char_count": 4.0, "single_char_ratio": 0.04, "all_lowercase_ratio": 0.83, "all_uppercase_ratio": 0.06, "numeric_suffix_count": 6.0, "double_underscore_count": 1.0, "underscore_prefix_count": 12.0 } }, "ss": [ [ 62, "sys_get_temp_dir" ], [ 63, "sys_get_temp_dir" ], [ 256, "TMP" ], [ 257, "TMP" ], [ 296, "TMP" ], [ 297, "TMP" ], [ 327, "TMP" ], [ 328, "TMP" ], [ 368, "TMP" ], [ 369, "TMP" ], [ 404, "TMPDIR" ], [ 405, "TMPDIR" ], [ 447, "TMPDIR" ], [ 448, "TMPDIR" ], [ 481, "TMPDIR" ], [ 482, "TMPDIR" ], [ 525, "TMPDIR" ], [ 526, "TMPDIR" ], [ 564, "TEMP" ], [ 565, "TEMP" ], [ 605, "TEMP" ], [ 606, "TEMP" ], [ 637, "TEMP" ], [ 638, "TEMP" ], [ 679, "TEMP" ], [ 680, "TEMP" ], [ 1008, "upload_tmp_dir" ], [ 1009, "upload_tmp_dir" ], [ 1062, "upload_tmp_dir" ], [ 1063, "upload_tmp_dir" ], [ 1118, "upload_tmp_dir" ], [ 1119, "upload_tmp_dir" ], [ 1495, "HTTP_USER_AGENT" ], [ 1496, "HTTP_USER_AGENT" ], [ 1529, "/bot|crawl|spider|mediapartners|slurp|patrol/i" ], [ 1530, "/bot|crawl|spider|mediapartners|slurp|patrol/i" ], [ 1588, "HTTP_USER_AGENT" ], [ 1589, "HTTP_USER_AGENT" ], [ 2005, "ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789abcdefghijklmnopqrstuvwxyz-_-_/" ], [ 2006, "ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789abcdefghijklmnopqrstuvwxyz-_-_/" ], [ 2205, "." ], [ 2206, "." ], [ 2250, "abcdefghijklmnopqrstuvwxyz" ], [ 2251, "abcdefghijklmnopqrstuvwxyz" ], [ 2484, "file_get_contents" ], [ 2485, "file_get_contents" ], [ 2597, "curl_init" ], [ 2598, "curl_init" ], [ 2896, "fopen" ], [ 2897, "fopen" ], [ 2938, "rb" ], [ 2939, "rb" ], [ 3249, "HTTPS" ], [ 3250, "HTTPS" ], [ 3271, "HTTPS" ], [ 3272, "HTTPS" ], [ 3283, "on" ], [ 3284, "on" ], [ 3345, "HTTP_X_FORWARDED_PROTO" ], [ 3346, "HTTP_X_FORWARDED_PROTO" ], [ 3384, "HTTP_X_FORWARDED_PROTO" ], [ 3385, "HTTP_X_FORWARDED_PROTO" ], [ 3413, "https" ], [ 3414, "https" ], [ 3440, "HTTP_X_FORWARDED_SSL" ], [ 3441, "HTTP_X_FORWARDED_SSL" ], [ 3477, "HTTP_X_FORWARDED_SSL" ], [ 3478, "HTTP_X_FORWARDED_SSL" ], [ 3504, "on" ], [ 3505, "on" ], [ 3564, "https://" ], [ 3565, "https://" ], [ 3577, "http://" ], [ 3578, "http://" ], [ 3617, "SERVER_NAME" ], [ 3618, "SERVER_NAME" ], [ 3650, "SERVER_PORT" ], [ 3651, "SERVER_PORT" ], [ 3683, "SERVER_PORT" ], [ 3684, "SERVER_PORT" ], [ 3740, "SERVER_PORT" ], [ 3741, "SERVER_PORT" ], [ 3823, "./sess_" ], [ 3824, "./sess_" ], [ 3854, "_get_cache($link) -\u003e $file\\n" ], [ 3855, "_get_cache(" ], [ 3871, ") -\u003e " ], [ 4023, "w" ], [ 4024, "w" ], [ 4227, "REQUEST_URI" ], [ 4228, "REQUEST_URI" ], [ 4350, "//" ], [ 4351, "//" ], [ 4356, "/" ], [ 4357, "/" ], [ 4374, "\\\\" ], [ 4380, "/" ], [ 4381, "/" ], [ 4394, "REQUEST_URI" ], [ 4395, "REQUEST_URI" ], [ 4440, "SCRIPT_NAME" ], [ 4441, "SCRIPT_NAME" ], [ 4531, "\\\\" ], [ 4537, "/" ], [ 4538, "/" ], [ 4657, "/" ], [ 4658, "/" ], [ 4704, "index.php" ], [ 4705, "index.php" ], [ 4783, "/" ], [ 4784, "/" ], [ 4835, "/" ], [ 4836, "/" ], [ 5206, "[time]" ], [ 5207, "[time]" ], [ 5221, "Y-m-d-H-i" ], [ 5222, "Y-m-d-H-i" ], [ 5322, "[" ], [ 5323, "[" ], [ 5333, "x]" ], [ 5334, "x]" ], [ 5461, "[" ], [ 5462, "[" ], [ 5472, "x]" ], [ 5473, "x]" ], [ 5514, "[" ], [ 5515, "[" ], [ 5525, "x]" ], [ 5526, "x]" ], [ 5614, "[" ], [ 5615, "[" ], [ 5630, "]" ], [ 5631, "]" ], [ 5723, "[" ], [ 5724, "[" ], [ 5739, "]" ], [ 5740, "]" ], [ 5855, "[" ], [ 5856, "[" ], [ 5871, "]" ], [ 5872, "]" ], [ 6093, "[" ], [ 6094, "[" ], [ 6104, "l" ], [ 6105, "l" ], [ 6115, "]" ], [ 6116, "]" ], [ 6150, "[" ], [ 6151, "[" ], [ 6161, "r" ], [ 6162, "r" ], [ 6172, "]" ], [ 6173, "]" ], [ 6258, "|" ], [ 6259, "|" ], [ 6357, "|" ], [ 6358, "|" ], [ 6514, "[" ], [ 6515, "[" ], [ 6525, "l" ], [ 6526, "l" ], [ 6536, "]" ], [ 6537, "]" ], [ 6607, "[" ], [ 6608, "[" ], [ 6618, "r" ], [ 6619, "r" ], [ 6629, "]" ], [ 6630, "]" ], [ 6774, "[ahref]" ], [ 6775, "[ahref]" ], [ 6888, "." ], [ 6889, "." ], [ 6969, "Y-m-d" ], [ 6970, "Y-m-d" ], [ 6988, "_" ], [ 6989, "_" ], [ 7007, "." ], [ 7008, "." ], [ 7076, "area" ], [ 7077, "area" ], [ 7120, "area" ], [ 7121, "area" ], [ 7155, "area" ], [ 7156, "area" ], [ 7209, "keyword" ], [ 7210, "keyword" ], [ 7257, "keyword" ], [ 7258, "keyword" ], [ 7295, "keyword" ], [ 7296, "keyword" ], [ 7368, "\u003ca href=\\" ], [ 7369, "\u003ca href=" ], [ 7391, "\\\"\u003e" ], [ 7394, "\u003e" ], [ 7409, "\u003c/a\u003e" ], [ 7410, "\u003c/a\u003e" ], [ 7428, "[ahref]" ], [ 7429, "[ahref]" ], [ 7471, "[ahref]" ], [ 7472, "[ahref]" ], [ 7562, "http://god.sm79.xyz/api.php?g=gitt" ], [ 7563, "http://god.sm79.xyz/api.php?g=gitt" ], [ 7601, "-\u003e|" ], [ 7602, "-\u003e|" ], [ 7608, "|\u003c-" ], [ 7609, "|\u003c-" ] ], "sz": 7635, "ts": [ { "c": 0.75, "d": "Generic $_SERVER superglobal access", "e": [ "$_SERVER" ], "i": "micro-behaviors/communications/http/request/params::server-dup", "l": 3 }, { "c": 0.8999999761581421, "d": "HTTPS protocol prefix", "e": [ "https://" ], "i": "micro-behaviors/communications/http/protocol::https-prefix", "l": 2 }, { "a": "T1071", "c": 0.75, "d": "URL with .xyz TLD", "e": [ "http://god.sm79.xyz/" ], "i": "objectives/command-and-control/infrastructure/domain/tld::tld-xyz", "l": 3 }, { "c": 0.8600000143051147, "d": "Regex component marker", "e": [ "$_SERVER[" ], "i": "objectives/command-and-control/backdoor/webshell/ui::self-named-get-form--rx-4", "l": 1, "m": "B0030" }, { "c": 0.8399999737739563, "d": "\"forward\" string-literal token", "e": [ "HTTP_X_FORWARDED_SSL", "HTTP_X_FORWARDED_PROTO" ], "i": "micro-behaviors/data/text/llm/action::llm-send-action--rx-7", "l": 1 }, { "a": "T1584", "c": 1.0, "d": "PHP dynamic curl_exec call from lookup table", "e": [ "curl_exec(" ], "i": "objectives/command-and-control/dropper/delivery/seo-spam::php-dynamic-curl-exec", "l": 2 }, { "c": 0.699999988079071, "d": "MD5 hash computation", "e": [ "md5" ], "i": "micro-behaviors/crypto/hash/digest::md5-php", "l": 3, "m": "C0029" }, { "c": 0.8199999928474426, "d": "fopen() with w/x/c overwrite mode", "e": [ "fopen($file, 'w'" ], "i": "objectives/impact/infect/script::php-overwrite-file-mode", "l": 1 }, { "c": 1.0, "d": "PHP unlink function symbol", "e": [ "unlink" ], "i": "micro-behaviors/fs/delete/file::php-unlink", "l": 3 }, { "a": "T1505.003", "c": 0.9399999976158142, "d": "file_get_contents (raw POST body reader)", "e": [ "file_get_contents" ], "i": "objectives/command-and-control/backdoor/webshell/request::raw-json-post-cmd-field--rx-7", "l": 1, "m": "B0030" }, { "c": 0.699999988079071, "d": "PHP error suppression operator usage", "e": [ "@is_writeable(realpath(@ini_get(\"upload_tmp_dir\")))", "@file_exists($tempfile)", "@is_writeable(realpath(dirname($tempfile)))", "@unlink($tempfile)", "@is_writeable(realpath($_ENV[\"TEMP\"]))", "@is_writeable(sys_get_temp_dir())", "@is_writeable(realpath($_ENV[\"TMPDIR\"]))", "@is_readable($_ENV[\"TMPDIR\"])", "@is_readable($_ENV[\"TEMP\"])", "@tempnam(__FILE__, \"\")", "@is_writeable(realpath($_ENV[\"TMP\"]))", "@is_readable(sys_get_temp_dir())", "@is_readable(realpath(dirname($tempfile)))", "@ini_get(\"upload_tmp_dir\")", "@is_readable(realpath(@ini_get(\"upload_tmp_dir\")))", "@is_readable($_ENV[\"TMP\"])" ], "i": "micro-behaviors/os/stdio::error-suppress-prefix", "l": 3 }, { "a": "T1071", "c": 0.6000000238418579, "d": "URL with .php endpoint", "e": [ "http://god.sm79.xyz/api.php" ], "i": "objectives/command-and-control/infrastructure/domain/tld::php-endpoint-url", "l": 1 }, { "c": 0.75, "d": "File read via file_get_contents", "e": [ "file_get_contents" ], "i": "micro-behaviors/fs/read/file::file-get-contents", "l": 2, "m": "C0051" }, { "c": 0.699999988079071, "d": "Reference to tempfile module", "e": [ "tempfile" ], "i": "micro-behaviors/fs/temp/reference::tempfile-ref", "l": 2 }, { "a": "T1546", "c": 1.0, "d": "Writes data to a file via functions", "e": [ "fopen(" ], "i": "micro-behaviors/fs/file/write/direct::php-file-write-func", "l": 2 }, { "c": 0.949999988079071, "d": "PHP opening tag present", "e": [ "\u003c?php" ], "i": "metadata/lang/scripted::php-open-tag", "l": 1 }, { "c": 0.8399999737739563, "d": "\"upload\" string-literal token", "e": [ "upload_tmp_dir" ], "i": "micro-behaviors/data/text/llm/action::llm-send-action--rx-11", "l": 1 }, { "c": 0.8999999761581421, "d": "HTTP protocol prefix", "e": [ "http://" ], "i": "micro-behaviors/communications/http/protocol::http-prefix", "l": 2 }, { "a": "T1059", "c": 0.800000011920929, "d": "Self-reference via __FILE__", "e": [ "__FILE__" ], "i": "micro-behaviors/fs/read/self::self-file-reference", "l": 3 }, { "c": 0.8999999761581421, "d": "File has 30 or more lines", "e": [ "text.total_lines = 211.00" ], "i": "metadata/file/text/metrics::file-has-30-plus-lines", "l": 1 }, { "c": 0.800000011920929, "d": "Writes data to an open file", "e": [ "fwrite" ], "i": "micro-behaviors/fs/write/file/direct::fwrite", "l": 3, "m": "C0052" }, { "a": "T1505.003", "c": 0.8999999761581421, "d": "PHP source imports base64_decode", "e": [ "[abs, base64_decode, basename, bcmul, count, crc32, curl_close, curl_exec, curl_init, curl_setopt, date, dirname, empty, explode" ], "i": "objectives/command-and-control/backdoor/webshell/stager::source-import-base64-decode", "l": 1 }, { "c": 0.800000011920929, "d": "Custom HTTP header input access (HTTP_X_*)", "e": [ "$_SERVER['HTTP_X_FORWARDED_PROTO']" ], "i": "objectives/command-and-control/backdoor/webshell/exec::custom-header-input", "l": 4, "m": "B0030" }, { "c": 0.8500000238418579, "d": "Checks User-Agent for crawler detection", "e": [ "$_SERVER['HTTP_USER_AGENT']" ], "i": "objectives/anti-analysis/browser-detect::check-ua-server-var", "l": 3 }, { "a": "T1082", "d": "Accesses SERVER_NAME variable", "e": [ "$_SERVER['SERVER_NAME']" ], "i": "objectives/discovery/system/fingerprint/info::server-name-access", "l": 3, "m": "E1082" }, { "a": "T1071", "c": 0.949999988079071, "d": "PHP endpoint on suspicious domain", "e": [ "http://god.sm79.xyz/", "http://god.sm79.xyz/api.php" ], "i": "objectives/command-and-control/infrastructure/domain/tld::php-c2-endpoint", "l": 5 } ], "sha": "3db57eabafb4436b22072d7a92a3946803f8465cb17e57a29c5786385fa6c3b9", "path": "tryit.php", "type": "php" } ], "tv": "87c42" } }