{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9995942711830139, "class": 2 } ], "prob": 0.9995943, "class": 2, "models": [ { "m": "az", "prob": 0.98339856, "class": 0 }, { "m": "az/scripts", "prob": 0.9995943, "class": 2 }, { "m": "az/php", "prob": 0.9993375, "class": 2 } ], "version": "v16.16", "thresholds": [ 0.9961138, 0.99909174 ], "analyzed_at": "2026-05-09T04:21:47Z" }, "path": "ad4ba47c806ee421a0e3d32cc341e352", "raw": { "v": "4", "fs": [ { "f": "KO₄(C₈ErDyLa)H₄(Cm₃Db₄OsPo₂)Md", "k": { "source.imports[0]": "die", "source.imports[1]": "explode", "source.imports[2]": "ini_get", "source.imports[3]": "isset", "source.imports[4]": "mail", "source.imports[5]": "php_uname", "source.imports[6]": "session_start", "source.imports[7]": "set_time_limit", "source.imports[8]": "stripslashes", "source.strings[0]": "\r\n\u003cnoembed\u003e\u003cxmp\u003e\u003cbody\u003e\u003c/xmp\u003e\u003c/noembed\u003e\u003cnoembed\u003e\u003cxmp\u003e\u003c/body\u003e\u003c/html\u003e\u003c/xmp\u003e\u003c/noembed\u003e\u003ctitle\u003eOLD Mailer - Nyender ID\u003c/title\u003e\u003ccenter\u003e\u003cbody background=black\u003ctable width=1 bgcolor=white\u003e\u003ctr\u003e\u003ctd\u003e\u003cfont size=1 face=verdana\u003e\u003ccenter\u003e\u003cb\u003e\u003c/font\u003e\u003c/a\u003e\u003cbr\u003e\u003c/b\u003e\u003c/center\u003e\u003cform method=post\u003e\u003cfont size=1 face=verdana color=808080\u003e\u003cstrong\u003e\u003ccenter\u003ePlease log in to access\u003c/center\u003e\u003c/strong\u003e\u003cbr\u003e\u003cinput type=password name=pass size=10\u003e\u003c/form\u003e\r\n\u003c/td\u003e\u003c/tr\u003e\u003c/table\u003e\r\n", "source.strings[1]": "\u003c/b\u003e \u003cfont color=gren\u003eSuccess send!\u003c/font\u003e\u003cbr\u003e\u003chr\u003e", "source.strings[2]": "\u003c/b\u003e \u003cfont color=red\u003eServer error [ can't sending email ]\u003c/font\u003e\u003cbr\u003e\u003chr\u003e", "source.strings[3]": "\u003cfont color=gren\u003e* NyenderID: [ Line ] : ", "source.strings[4]": "\u003cfont color=gren\u003e* NyenderID: [ Line ] : $count \u003cb\u003e", "source.strings[5]": "\u003cfont color=red\u003e* NyenderID: [ Line ] : ", "source.strings[6]": "\u003cfont color=red\u003e* NyenderID: [ Line ] : $count \u003cb\u003e", "source.strings[7]": "Content-Type: text/html; charset=UTF-8\r\nContent-Transfer-Encoding: 7bit\r\nX-Mailer: EDMAIL R6.00.02\r\nContent-Length: 41061", "source.strings[8]": "Content-Type: text/html; charset=UTF-8\r\nContent-Transfer-Encoding: 7bit\r\nX-Mailer: EDMAIL R6.00.02\r\nContent-Length: 41061\\n", "source.strings[9]": "From: ", "source.has_imports": true, "source.strings[10]": "MIME-Version: 1.0", "source.strings[11]": "MIME-Version: 1.0\\n", "source.strings[12]": "SERVER_ADDR", "source.strings[13]": "SERVER_ADMIN", "source.strings[14]": "SERVER_SOFTWARE", "source.strings[15]": "assunto", "source.strings[16]": "deyola", "source.strings[17]": "emails", "source.strings[18]": "safe_mode" }, "x": 68, "id": 0, "is": [ "session_start", "set_time_limit", "isset", "isset", "die", "isset", "die", "explode", "stripslashes", "mail", "php_uname", "ini_get" ], "ms": { "file": { "size": 17355.0 }, "text": { "tab_count": 3.0, "digit_ratio": 0.09, "space_count": 1820.0, "total_lines": 205.0, "char_entropy": 5.26, "mixed_indent": true, "unique_chars": 90.0, "import_density": 5.85, "lines_over_200": 17.0, "lines_over_500": 10.0, "string_density": 0.27, "avg_line_length": 82.67, "lines_over_1000": 2.0, "max_line_length": 1545.0, "empty_line_ratio": 0.11, "last_line_length": 7.0, "most_common_char": "t", "whitespace_ratio": 0.13, "most_common_ratio": 0.06, "identifier_density": 0.38, "line_length_stddev": 195.46, "normalized_import_count": 0.84, "normalized_string_count": 3.84, "repeated_char_sequences": 25.0, "max_inline_whitespace_run": 2.0, "trailing_whitespace_lines": 6.0, "suspicious_identifier_ratio": 0.09, "normalized_unique_identifiers": 4.17 }, "imports": { "total": 12.0, "unique_modules": 9.0, "third_party_count": 12.0, "third_party_ratio": 1.0 }, "strings": { "total": 55.0, "avg_length": 32.85, "max_length": 438.0, "avg_entropy": 2.64, "total_bytes": 1807.0, "entropy_stddev": 1.21, "high_entropy_count": 2.0 }, "comments": {}, "functions": {}, "identifiers": { "total": 77.0, "avg_length": 6.0, "max_length": 15.0, "min_length": 1.0, "avg_entropy": 2.01, "reuse_ratio": 0.42, "unique_count": 32.0, "length_stddev": 3.66, "sequential_names": 3.0, "single_char_count": 3.0, "single_char_ratio": 0.09, "all_lowercase_ratio": 0.81, "all_uppercase_ratio": 0.19, "underscore_prefix_count": 3.0 } }, "ss": [ [ 155, "deyola" ], [ 156, "deyola" ], [ 179, "pass" ], [ 180, "pass" ], [ 222, "nst" ], [ 223, "nst" ], [ 229, "$pass" ], [ 291, "nst" ], [ 292, "nst" ], [ 312, "nst" ], [ 313, "nst" ], [ 337, "\r\n\u003cnoembed\u003e\u003cxmp\u003e\u003cbody\u003e\u003c/xmp\u003e\u003c/noembed\u003e\u003cnoembed\u003e\u003cxmp\u003e\u003c/body\u003e\u003c/html\u003e\u003c/xmp\u003e\u003c/noembed\u003e\u003ctitle\u003eOLD Mailer - Nyender ID\u003c/title\u003e\u003ccenter\u003e" ], [ 338, "\r\n\u003cnoembed\u003e\u003cxmp\u003e\u003cbody\u003e\u003c/xmp\u003e\u003c/noembed\u003e\u003cnoembed\u003e\u003cxmp\u003e\u003c/body\u003e\u003c/html\u003e\u003c/xmp\u003e\u003c/noembed\u003e\u003ctitle\u003eOLD Mailer - Nyender ID\u003c/title\u003e\u003ccenter\u003e" ], [ 801, "veio" ], [ 802, "veio" ], [ 849, "html" ], [ 850, "html" ], [ 877, "assunto" ], [ 878, "assunto" ], [ 905, "nome" ], [ 906, "nome" ], [ 928, "de" ], [ 929, "de" ], [ 949, "emails" ], [ 950, "emails" ], [ 978, "\\n" ], [ 1076, "ok" ], [ 1077, "ok" ], [ 1095, "MIME-Version: 1.0\\n" ], [ 1096, "MIME-Version: 1.0" ], [ 1131, "Content-Type: text/html; charset=UTF-8\r\nContent-Transfer-Encoding: 7bit\r\nX-Mailer: EDMAIL R6.00.02\r\nContent-Length: 41061\\n" ], [ 1132, "Content-Type: text/html; charset=UTF-8\r\nContent-Transfer-Encoding: 7bit\r\nX-Mailer: EDMAIL R6.00.02\r\nContent-Length: 41061" ], [ 1271, "From: " ], [ 1272, "From: " ], [ 1291, "\\r\\n" ], [ 1357, "\u003cfont color=gren\u003e* NyenderID: [ Line ] : $count \u003cb\u003e" ], [ 1358, "\u003cfont color=gren\u003e* NyenderID: [ Line ] : " ], [ 1405, " \u003cb\u003e" ], [ 1422, "\u003c/b\u003e \u003cfont color=gren\u003eSuccess send!\u003c/font\u003e\u003cbr\u003e\u003chr\u003e" ], [ 1423, "\u003c/b\u003e \u003cfont color=gren\u003eSuccess send!\u003c/font\u003e\u003cbr\u003e\u003chr\u003e" ], [ 1488, "\u003cfont color=red\u003e* NyenderID: [ Line ] : $count \u003cb\u003e" ], [ 1489, "\u003cfont color=red\u003e* NyenderID: [ Line ] : " ], [ 1535, " \u003cb\u003e" ], [ 1552, "\u003c/b\u003e \u003cfont color=red\u003eServer error [ can't sending email ]\u003c/font\u003e\u003cbr\u003e\u003chr\u003e" ], [ 1553, "\u003c/b\u003e \u003cfont color=red\u003eServer error [ can't sending email ]\u003c/font\u003e\u003cbr\u003e\u003chr\u003e" ], [ 1671, "ok" ], [ 1672, "ok" ], [ 3232, "SERVER_ADDR" ], [ 3233, "SERVER_ADDR" ], [ 3287, "SERVER_SOFTWARE" ], [ 3288, "SERVER_SOFTWARE" ], [ 3347, "SERVER_ADMIN" ], [ 3348, "SERVER_ADMIN" ], [ 3417, "safe_mode" ], [ 3418, "safe_mode" ] ], "sz": 17355, "ts": [ { "c": 0.8399999737739563, "d": "Regex component marker", "e": [ "to your" ], "i": "micro-behaviors/data/text/llm/action::llm-send-action-cond-6--inline-11766", "l": 1 }, { "c": 0.8600000143051147, "d": "Regex component marker", "e": [ "method=" ], "i": "objectives/command-and-control/backdoor/webshell/ui::self-named-get-form--rx-3", "l": 1, "m": "B0030" }, { "d": "password keyword", "e": [ "password" ], "i": "micro-behaviors/data/text/keywords/lexicon::password", "l": 1 }, { "d": "Content-Type header string", "e": [ "Content-Type:" ], "i": "micro-behaviors/communications/http/request/client::content-type-header", "l": 1 }, { "c": 0.6000000238418579, "d": "Generates HTML tags", "e": [ "\u003cbody" ], "i": "micro-behaviors/data/format/html::html-generator-tags", "l": 3 }, { "c": 1.0, "d": "PHP mail() function call", "e": [ "mail" ], "i": "micro-behaviors/process/create/exec::php-mail", "l": 3 }, { "a": "T1059", "c": 0.8500000238418579, "d": "HTTP POST parameter access ($_POST)", "e": [ "$_POST" ], "i": "micro-behaviors/communications/http/request/params::post-dup", "l": 3 }, { "c": 0.699999988079071, "d": "PHP error suppression operator usage", "e": [ "@ini_get('safe_mode')", "@PHP_OS", "@session_start()", "@php_uname()", "@set_time_limit(0)" ], "i": "micro-behaviors/os/stdio::error-suppress-prefix", "l": 3 }, { "c": 0.75, "d": "Generic $_SERVER superglobal access", "e": [ "$_SERVER" ], "i": "micro-behaviors/communications/http/request/params::server-dup", "l": 3 }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2 }, { "a": "T1505.003", "d": "PHP open tag", "e": [ "\u003c?php" ], "i": "objectives/command-and-control/backdoor/webshell/request::php-tag", "l": 1, "m": "B0030" }, { "a": "T1082", "c": 0.699999988079071, "d": "Accesses PHP_OS constant (OS detection)", "e": [ "PHP_OS" ], "i": "objectives/discovery/system/fingerprint/info::php-os-constant", "l": 3, "m": "E1082" }, { "a": "T1505.003", "c": 0.8600000143051147, "d": "Regex component marker", "e": [ "ini_get('safe_mode" ], "i": "objectives/command-and-control/backdoor/webshell/config::php-security-setting-probe--rx-1", "l": 1, "m": "B0030" }, { "c": 0.8600000143051147, "d": "Regex component marker", "e": [ "$_SERVER[" ], "i": "objectives/command-and-control/backdoor/webshell/ui::self-named-get-form--rx-4", "l": 1, "m": "B0030" }, { "c": 0.8999999761581421, "d": "Very long line", "e": [ "text.max_line_length = 1545.00" ], "i": "metadata/file/text/metrics::single-long-line", "l": 1 }, { "c": 0.8399999737739563, "d": "Regex component marker", "e": [ "\r\n\u003cnoembed\u003e\u003cxmp\u003e\u003cbody\u003e\u003c/xmp\u003e\u003c/noembed\u003e\u003cnoembed\u003e\u003cxmp\u003e\u003c/body\u003e\u003c/html\u003e\u003c/xmp\u003e\u003c/noembed\u003e\u003ctitle\u003eOLD Mailer - Nyender ID\u003c/title\u003e\u003ccenter\u003e" ], "i": "micro-behaviors/data/text/llm/action::llm-send-action--rx-6", "l": 1 }, { "a": "T1505.003", "c": 1.0, "d": "Inequality check in WordPress user list", "e": [ "!=" ], "i": "objectives/command-and-control/backdoor/webshell/hide::wp-user-hiding-not-trait", "l": 1, "m": "B0030" }, { "a": "T1505.003", "c": 0.8500000238418579, "d": "PHP request superglobal access", "e": [ "$_POST" ], "i": "objectives/command-and-control/backdoor/webshell/upload::php-request-variadic-function-call", "l": 3, "m": "B0030" }, { "a": "T1562.001", "c": 0.699999988079071, "d": "Reads safe_mode setting", "e": [ "ini_get('safe_mode" ], "i": "objectives/evasion/security-bypass/runtime::ini-get-safe-mode", "l": 4, "m": "B0032" }, { "c": 0.8500000238418579, "d": "Removes PHP script execution time limit", "e": [ "@set_time_limit(0)" ], "i": "objectives/command-and-control/backdoor/webshell/session::unlimited-runtime-call", "l": 4 }, { "c": 0.8399999737739563, "d": "Regex component marker", "e": [ "\r\n\u003cnoembed\u003e\u003cxmp\u003e\u003cbody\u003e\u003c/xmp\u003e\u003c/noembed\u003e\u003cnoembed\u003e\u003cxmp\u003e\u003c/body\u003e\u003c/html\u003e\u003c/xmp\u003e\u003c/noembed\u003e\u003ctitle\u003eOLD Mailer - Nyender ID\u003c/title\u003e\u003ccenter\u003e" ], "i": "micro-behaviors/data/text/llm/action::llm-send-action-cond-4--inline-11750", "l": 1 }, { "c": 0.7599999904632568, "d": "Regex component marker", "e": [ "please" ], "i": "micro-behaviors/data/text/llm/action::llm-path-navigation-action--rx-27", "l": 1 }, { "c": 0.8399999737739563, "d": "Regex component marker", "e": [ "store" ], "i": "micro-behaviors/data/text/llm/action::llm-send-action-cond-6--inline-11769", "l": 1 }, { "a": "T1071", "c": 0.6000000238418579, "d": "URL with .php endpoint", "e": [ "https://setanwar.net/redirect.php" ], "i": "objectives/command-and-control/infrastructure/domain/tld::php-endpoint-url", "l": 1 }, { "c": 0.8999999761581421, "d": "File has 30 or more lines", "e": [ "text.total_lines = 205.00" ], "i": "metadata/file/text/metrics::file-has-30-plus-lines", "l": 1 }, { "a": "T1110.001", "c": 0.20000000298023224, "d": "admin keyword", "e": [ "Admin" ], "i": "micro-behaviors/data/text/keywords/username::admin-keyword", "l": 2, "m": "B0028" }, { "a": "T1505.003", "c": 0.4000000059604645, "d": "PHP $_POST parameter access", "e": [ "$_POST[" ], "i": "objectives/command-and-control/backdoor/webshell/request::php-post", "l": 1, "m": "B0030" }, { "c": 0.8399999737739563, "d": "password/token/api_key field keyword", "e": [ "password" ], "i": "micro-behaviors/data/text/keywords/credential::credential-field", "l": 1 }, { "a": "T1505.003", "c": 0.8999999761581421, "d": "Single-file admin shell metrics", "e": [ "ad4ba47c806ee421a0e3d32cc341e352##plain@0x0" ], "i": "well-known/malware/webshell/zaco::single-file-webshell-metrics", "l": 3, "m": "B0030" }, { "a": "T1505.003", "c": 0.9200000166893005, "d": "HTML tag in script body", "e": [ "\u003chtml\u003e" ], "i": "objectives/command-and-control/remote-command/shell::html-tag-present", "l": 1, "m": "B0030" }, { "c": 0.75, "d": "Session variable access ($_SESSION)", "e": [ "$_SESSION" ], "i": "micro-behaviors/communications/http/request/params::session", "l": 3 }, { "a": "T1071.001", "c": 0.6000000238418579, "d": "enctype attribute", "e": [ "enctype=" ], "i": "micro-behaviors/communications/http/post::enctype-attr", "l": 3, "m": "C0002" }, { "a": "T1027", "c": 0.8500000238418579, "d": "Multiple long lines (\u003e1000 chars)", "e": [ "text.lines_over_1000 = 2.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::very-long-lines", "l": 2, "m": "B0032" }, { "c": 0.699999988079071, "d": "Remove execution time limit", "e": [ "set_time_limit" ], "i": "micro-behaviors/process/control/signal::set-time-limit", "l": 3 }, { "c": 0.75, "d": "Inline password token in lure", "e": [ "password = \"deyola\"" ], "i": "objectives/lateral-movement/social-engineering/lures::inline-password-token", "l": 1 }, { "a": "T1071.001", "c": 0.6000000238418579, "d": "multipart/form-data content type", "e": [ "multipart/form-data" ], "i": "micro-behaviors/communications/http/post::multipart-form", "l": 1, "m": "C0002" }, { "a": "T1082", "c": 0.699999988079071, "d": "Accesses SERVER_SOFTWARE variable", "e": [ "$_SERVER['SERVER_SOFTWARE']" ], "i": "objectives/discovery/system/fingerprint/info::server-software-access", "l": 3, "m": "E1082" }, { "c": 0.699999988079071, "d": "AJAX request handler pattern", "e": [ "$_POST['assunto']", "$_POST['nome']", "$_POST['de']", "$_POST['emails']", "$_POST['html']", "$_POST['pass']", "$_POST['veio']" ], "i": "objectives/command-and-control/backdoor/webshell/ui::ajax-handler", "l": 4, "m": "B0030" }, { "c": 1.0, "d": "php code embedded in string", "e": [ "Detected php at offset 0x0" ], "i": "metadata/lang/embedded::php", "l": 2 } ], "sha": "454b40f0606f82b5a07b9019e72b7d83ef97eff02cb9667eb7e329d57f3366d9", "path": "ad4ba47c806ee421a0e3d32cc341e352", "type": "php" } ], "tv": "a9555" } }