{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9998272061347961, "class": 2 } ], "prob": 0.9998272, "class": 2, "models": [ { "m": "az", "prob": 0.99459547, "class": 0 }, { "m": "az/scripts", "prob": 0.9997004, "class": 2 }, { "m": "az/php", "prob": 0.9998272, "class": 2 } ], "version": "v16.16", "thresholds": [ 0.9961138, 0.99909174 ], "analyzed_at": "2026-05-08T23:26:12Z" }, "path": "new.txt", "raw": { "v": "4", "fs": [ { "f": "O(C₄)H₄(PoCmOsDb)Md₂Th", "k": { "source.imports[0]": "add_action", "source.imports[1]": "define", "source.imports[2]": "defined", "source.imports[3]": "error_reporting", "source.imports[4]": "eval", "source.imports[5]": "fs_login_page", "source.imports[6]": "header", "source.imports[7]": "in_array", "source.imports[8]": "rand", "source.imports[9]": "session_start", "source.strings[0]": "\t\t\u003cinput name=", "source.strings[1]": "\t\t\u003cinput type=", "source.strings[2]": "\t\t\u003cinput type=hidden name=", "source.strings[3]": "\t\u003cp\u003e\\n\t\t\u003cinput name=", "source.strings[4]": "\t\u003cp\u003e\\n\t\t\u003cinput name=\\", "source.strings[5]": "\t\u003cp\u003e\\n\t\t\u003cinput type=\\\"hidden\\\" name=\\", "source.strings[6]": "\t\u003cp\u003e\\n\t\t\u003cinput type=hidden name=", "source.strings[7]": " /\u003e\\n\t\u003c/p\u003e", "source.strings[8]": " name=", "source.strings[9]": " type=", "source.has_imports": true, "source.imports[10]": "sprintf", "source.imports[11]": "time", "source.strings[10]": " type=hidden value=", "source.strings[11]": " value=", "source.strings[12]": "-\u003e|OK|-\u003c", "source.strings[13]": "2IESEE_YXM1awzz1K6+dwxr\u003e'\u0026\u0026\u0026:////?-", "source.strings[14]": "HTTP_REFERER", "source.strings[15]": "Location: %s", "source.strings[16]": "LoginWall", "source.strings[17]": "Weak Liver", "source.strings[18]": "\\\" /\u003e\\n\t\u003c/p\u003e", "source.strings[19]": "\\\" type=\\\"hidden\\\" value=\\", "source.strings[20]": "\\\" value=\\", "source.strings[21]": "fs_login_session", "source.strings[22]": "fs_session_check", "source.strings[23]": "hidden", "source.strings[24]": "http://127.0.0.1", "source.strings[25]": "ll_lasttime", "source.strings[26]": "ll_times", "source.strings[27]": "login_form", "source.strings[28]": "pagenow", "source.strings[29]": "plugins_loaded", "source.strings[30]": "wp-login.php", "source.functions[0]": "fs_login_page", "source.functions[1]": "fs_login_session", "source.functions[2]": "fs_session_check" }, "x": 218, "id": 0, "is": [ "error_reporting", "defined", "define", "in_array", "session_start", "rand", "rand", "rand", "session_start", "fs_login_page", "time", "header", "sprintf", "eval", "add_action", "add_action" ], "ms": { "file": { "size": 2300.0 }, "text": { "tab_count": 97.0, "digit_ratio": 0.04, "space_count": 168.0, "total_lines": 75.0, "char_entropy": 5.56, "mixed_indent": true, "unique_chars": 81.0, "import_density": 21.33, "string_density": 1.55, "avg_line_length": 29.67, "max_line_length": 126.0, "empty_line_ratio": 0.12, "last_line_length": 1.0, "long_token_count": 1.0, "most_common_char": "l", "whitespace_ratio": 0.15, "most_common_ratio": 0.05, "identifier_density": 0.99, "line_length_stddev": 31.1, "normalized_import_count": 1.85, "normalized_string_count": 13.39, "suspicious_comment_ratio": 1.0, "max_inline_whitespace_run": 6.0, "normalized_function_count": 0.35, "trailing_whitespace_lines": 20.0, "imports_to_functions_ratio": 5.33, "strings_to_functions_ratio": 38.67, "normalized_unique_identifiers": 4.17, "identifiers_to_functions_ratio": 8.67 }, "imports": { "total": 16.0, "unique_modules": 12.0, "third_party_count": 16.0, "third_party_ratio": 1.0 }, "strings": { "total": 116.0, "url_count": 2.0, "avg_length": 8.62, "max_length": 37.0, "avg_entropy": 2.53, "total_bytes": 1000.0, "entropy_stddev": 0.7 }, "comments": { "chars": 377.0, "lines": 14.0, "total": 2.0, "to_code_ratio": 0.23, "url_in_comments": 2.0, "high_entropy_comments": 2.0 }, "functions": { "total": 3.0, "length_stddev": 11.9, "avg_name_length": 15.0, "no_params_count": 3.0, "avg_length_lines": 14.67, "max_length_lines": 31.0, "min_length_lines": 3.0, "density_per_100_lines": 4.0, "code_in_functions_ratio": 0.59 }, "identifiers": { "total": 74.0, "avg_length": 8.23, "max_length": 16.0, "min_length": 4.0, "avg_entropy": 2.51, "reuse_ratio": 0.35, "unique_count": 26.0, "length_stddev": 3.69, "all_lowercase_ratio": 0.77, "all_uppercase_ratio": 0.23, "underscore_prefix_count": 4.0 } }, "ss": [ [ 430, "LoginWall" ], [ 431, "LoginWall" ], [ 454, "LoginWall" ], [ 455, "LoginWall" ], [ 524, "pagenow" ], [ 525, "pagenow" ], [ 542, "wp-login.php" ], [ 543, "wp-login.php" ], [ 623, "login" ], [ 624, "login" ], [ 660, "wall" ], [ 661, "wall" ], [ 725, "\t\u003cp\u003e\\n\t\t\u003cinput type=\\\"hidden\\\" name=\\" ], [ 726, "\t\u003cp\u003e" ], [ 732, "\t\t\u003cinput type=" ], [ 748, "hidden" ], [ 756, " name=" ], [ 776, "wall" ], [ 777, "wall" ], [ 784, "\\\" value=\\" ], [ 787, " value=" ], [ 808, "login" ], [ 809, "login" ], [ 817, "\\\" /\u003e\\n\t\u003c/p\u003e" ], [ 820, " /\u003e" ], [ 825, "\t\u003c/p\u003e" ], [ 852, "\t\u003cp\u003e\\n\t\t\u003cinput name=\\" ], [ 853, "\t\u003cp\u003e" ], [ 859, "\t\t\u003cinput name=" ], [ 887, "wall" ], [ 888, "wall" ], [ 895, "\\\" type=\\\"hidden\\\" value=\\" ], [ 898, " type=" ], [ 906, "hidden" ], [ 914, " value=" ], [ 935, "login" ], [ 936, "login" ], [ 944, "\\\" /\u003e\\n\t\u003c/p\u003e" ], [ 947, " /\u003e" ], [ 952, "\t\u003c/p\u003e" ], [ 979, "\t\u003cp\u003e\\n\t\t\u003cinput type=hidden name=" ], [ 980, "\t\u003cp\u003e" ], [ 986, "\t\t\u003cinput type=hidden name=" ], [ 1024, "wall" ], [ 1025, "wall" ], [ 1032, " value=" ], [ 1033, " value=" ], [ 1052, "login" ], [ 1053, "login" ], [ 1061, " /\u003e\\n\t\u003c/p\u003e" ], [ 1062, " /\u003e" ], [ 1067, "\t\u003c/p\u003e" ], [ 1094, "\t\u003cp\u003e\\n\t\t\u003cinput name=" ], [ 1095, "\t\u003cp\u003e" ], [ 1101, "\t\t\u003cinput name=" ], [ 1127, "wall" ], [ 1128, "wall" ], [ 1135, " type=hidden value=" ], [ 1136, " type=hidden value=" ], [ 1167, "login" ], [ 1168, "login" ], [ 1176, " /\u003e\\n\t\u003c/p\u003e" ], [ 1177, " /\u003e" ], [ 1182, "\t\u003c/p\u003e" ], [ 1271, "log" ], [ 1272, "log" ], [ 1393, "ll_times" ], [ 1394, "ll_times" ], [ 1438, "ll_lasttime" ], [ 1439, "ll_lasttime" ], [ 1480, "ll_times" ], [ 1481, "ll_times" ], [ 1511, "ll_times" ], [ 1512, "ll_times" ], [ 1610, "ll_times" ], [ 1611, "ll_times" ], [ 1649, "ll_lasttime" ], [ 1650, "ll_lasttime" ], [ 1767, "Location: %s" ], [ 1768, "Location: %s" ], [ 1782, "http://127.0.0.1" ], [ 1783, "http://127.0.0.1" ], [ 1864, "ll_lasttime" ], [ 1865, "ll_lasttime" ], [ 1908, "ll_times" ], [ 1909, "ll_times" ], [ 1961, "wall" ], [ 1962, "wall" ], [ 1981, "login" ], [ 1982, "login" ], [ 2010, "wall" ], [ 2011, "wall" ], [ 2035, "HTTP_REFERER" ], [ 2036, "HTTP_REFERER" ], [ 2066, "pwd" ], [ 2067, "pwd" ], [ 2073, "Weak Liver" ], [ 2074, "Weak Liver" ], [ 2106, "login" ], [ 2107, "login" ], [ 2116, "cmd" ], [ 2117, "cmd" ], [ 2133, "123" ], [ 2134, "123" ], [ 2150, "-\u003e|OK|-\u003c" ], [ 2151, "-\u003e|OK|-\u003c" ], [ 2182, "123" ], [ 2183, "123" ], [ 2211, "plugins_loaded" ], [ 2212, "plugins_loaded" ], [ 2229, "fs_session_check" ], [ 2230, "fs_session_check" ], [ 2264, "login_form" ], [ 2265, "login_form" ], [ 2277, "fs_login_session" ], [ 2278, "fs_login_session" ], [ 650, "xor", "2IESEE_YXM1awzz1K6+dwxr\u003e'\u0026\u0026\u0026:////?-" ] ], "sz": 2300, "ts": [ { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2 }, { "c": 0.949999988079071, "d": "Disables error reporting (error_reporting(0))", "e": [ "error_reporting(0)" ], "i": "micro-behaviors/os/stdio::error-reporting-off", "l": 3 }, { "a": "T1505.003", "c": 1.0, "d": "Inequality check in WordPress user list", "e": [ "!=" ], "i": "objectives/command-and-control/backdoor/webshell/hide::wp-user-hiding-not-trait", "l": 1, "m": "B0030" }, { "c": 0.75, "d": "Generic $_SERVER superglobal access", "e": [ "$_SERVER" ], "i": "micro-behaviors/communications/http/request/params::server-dup", "l": 3 }, { "c": 0.8999999761581421, "d": "File has 30 or more lines", "e": [ "text.total_lines = 75.00" ], "i": "metadata/file/text/metrics::file-has-30-plus-lines", "l": 1 }, { "c": 0.75, "d": "Session variable access ($_SESSION)", "e": [ "$_SESSION" ], "i": "micro-behaviors/communications/http/request/params::session", "l": 3 }, { "a": "T1505.003", "c": 0.8500000238418579, "d": "PHP request superglobal access", "e": [ "$_POST" ], "i": "objectives/command-and-control/backdoor/webshell/upload::php-request-variadic-function-call", "l": 3, "m": "B0030" }, { "a": "T1059.006", "c": 0.9800000190734863, "d": "eval() call with direct user input", "e": [ "$_POST['123']", "eval" ], "i": "micro-behaviors/process/interpreter/eval::eval-user-input", "l": 4, "m": "E1059" }, { "a": "T1059.006", "c": 0.75, "d": "PHP eval() token present", "e": [ "eval" ], "i": "micro-behaviors/process/interpreter/eval::eval-symbol", "l": 4, "m": "E1059" }, { "c": 0.8600000143051147, "d": "Regex component marker", "e": [ "$_SERVER[" ], "i": "objectives/command-and-control/backdoor/webshell/ui::self-named-get-form--rx-4", "l": 1, "m": "B0030" }, { "a": "T1505.003", "c": 0.4000000059604645, "d": "PHP $_POST parameter access", "e": [ "$_POST[" ], "i": "objectives/command-and-control/backdoor/webshell/request::php-post", "l": 1, "m": "B0030" }, { "a": "T1505.003", "c": 0.4000000059604645, "d": "PHP $_GET parameter access", "e": [ "$_GET[" ], "i": "objectives/command-and-control/backdoor/webshell/request::php-get", "l": 1, "m": "B0030" }, { "a": "T1505.003", "d": "PHP open tag", "e": [ "\u003c?php" ], "i": "objectives/command-and-control/backdoor/webshell/request::php-tag", "l": 1, "m": "B0030" }, { "a": "T1059", "c": 0.8500000238418579, "d": "HTTP GET parameter access ($_GET)", "e": [ "$_GET" ], "i": "micro-behaviors/communications/http/request/params::get-dup", "l": 3 }, { "c": 0.8999999761581421, "d": "HTTP protocol prefix", "e": [ "http://" ], "i": "micro-behaviors/communications/http/protocol::http-prefix", "l": 2 }, { "a": "T1059", "c": 0.8500000238418579, "d": "HTTP POST parameter access ($_POST)", "e": [ "$_POST" ], "i": "micro-behaviors/communications/http/request/params::post-dup", "l": 3 }, { "c": 0.8399999737739563, "d": "Regex component marker", "e": [ "fs_session_check", "fs_login_session" ], "i": "micro-behaviors/data/text/llm/action::llm-send-action--rx-8", "l": 1 }, { "c": 0.800000011920929, "d": "Hardcoded loopback IPv4 address", "e": [ "127.0.0.1" ], "i": "micro-behaviors/communications/ip/literal::loopback-ipv4-source", "l": 2 }, { "c": 0.699999988079071, "d": "AJAX request handler pattern", "e": [ "$_POST[$_SESSION['wall']]", "$_GET[\"login\"]", "$_POST['123']", "$_POST[\"log\"]", "$_POST[\"pwd\"]" ], "i": "objectives/command-and-control/backdoor/webshell/ui::ajax-handler", "l": 4, "m": "B0030" }, { "c": 1.0, "d": "php code embedded in string", "e": [ "Detected php at offset 0x0" ], "i": "metadata/lang/embedded::php", "l": 2 }, { "a": "T1036.005", "c": 1.0, "d": "File extension claims Text but content is Php", "e": [ "expected=Text, actual=Php" ], "i": "metadata/file-extension-mismatch", "l": 4 }, { "c": 0.8999999761581421, "d": "Generic PHP webshell which uses any eval/exec function in the same line with user input", "e": [ "eval($_POST" ], "i": "third_party/SigBase/WEBSHELL/PHP/Generic/Eval", "l": 5 } ], "sha": "3e3f13bfee253442f604950bb0e789ecabeba9c8b07007f61f2b2815a400aae8", "path": "/data/samples/bad/datasets/php-malware-analysis/plugins/login_wall/strays/new.txt", "type": "php" } ], "tv": "bef72" } }