{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 1.0,
        "class": 1
      }
    ],
    "prob": 1.0,
    "class": 1,
    "models": [
      {
        "m": "az",
        "prob": 0.9017224,
        "class": 0
      },
      {
        "m": "az/scripts",
        "prob": 0.9893617,
        "class": 0
      },
      {
        "m": "az/php",
        "prob": 1.0,
        "class": 1
      }
    ],
    "version": "v16.16",
    "thresholds": [
      0.9961373,
      0.9998425
    ],
    "analyzed_at": "2026-05-14T07:25:04Z"
  },
  "path": "456f89a0ac865ff4eef5805c0d12d31e39da8bf1b2b1ac48a8d54885fa77f043.php",
  "raw": {
    "v": "4",
    "fs": [
      {
        "f": "O(C)H(Cm)Md",
        "k": {
          "source.imports[0]": "header",
          "source.imports[1]": "session_start",
          "source.strings[0]": "\u003ciframe src=\"https://www.google.com/maps/embed?pb=!1m14!1m8!1m3!1d6039.819406421406!2d29.359455!3d40.807978!3m2!1i1024!2i768!4f13.1!3m3!1m2!1s0x0:0x28e488940d24037f!2sGebze Teknik Üniversitesi!5e0!3m2!1str!2str!4v1655498530225!5m2!1str!2str\" width=\"600\" height=\"550\" style=\"border:0;\" allowfullscreen=\"\" loading=\"lazy\" referrerpolicy=\"no-referrer-when-downgrade\"\u003e\u003c/iframe\u003e",
          "source.strings[1]": "Location:",
          "source.strings[2]": "PHP_SELF",
          "source.strings[3]": "components/backCanvas.php",
          "source.strings[4]": "components/copyright.php",
          "source.strings[5]": "components/footer.php",
          "source.strings[6]": "components/header.php",
          "source.strings[7]": "components/preloader.php",
          "source.strings[8]": "components/title.php",
          "source.strings[9]": "contact-form-1",
          "source.has_imports": true,
          "source.strings[10]": "contact-form-2",
          "source.strings[11]": "contact-form-3",
          "source.strings[12]": "contact-form-4",
          "source.strings[13]": "contact-form-5",
          "source.strings[14]": "contact-location",
          "source.strings[15]": "contact-main-1",
          "source.strings[16]": "contact-main-2",
          "source.strings[17]": "contact-text-1",
          "source.strings[18]": "contact-text-2",
          "source.strings[19]": "contact-text-3",
          "source.strings[20]": "contact-text-4",
          "source.strings[21]": "contact-text-5",
          "source.strings[22]": "contact-text-6",
          "source.strings[23]": "contact-text-7",
          "source.strings[24]": "lang/eng.php",
          "source.strings[25]": "lang/tr.php",
          "source.strings[26]": "sales-button"
        },
        "x": 31,
        "id": 0,
        "is": [
          "session_start",
          "header"
        ],
        "ms": {
          "file": {
            "size": 7687.0
          },
          "text": {
            "tab_count": 465.0,
            "digit_ratio": 0.07,
            "space_count": 353.0,
            "total_lines": 208.0,
            "char_entropy": 5.39,
            "mixed_indent": true,
            "unique_chars": 88.0,
            "import_density": 0.96,
            "lines_over_200": 2.0,
            "string_density": 0.32,
            "avg_line_length": 34.97,
            "max_line_length": 435.0,
            "empty_line_ratio": 0.1,
            "last_line_length": 7.0,
            "long_token_count": 3.0,
            "most_common_char": "s",
            "whitespace_ratio": 0.16,
            "most_common_ratio": 0.05,
            "identifier_density": 0.11,
            "line_length_stddev": 46.0,
            "normalized_import_count": 0.14,
            "normalized_string_count": 4.58,
            "max_inline_whitespace_run": 1.0,
            "trailing_whitespace_lines": 14.0,
            "normalized_unique_identifiers": 0.78
          },
          "imports": {
            "total": 2.0,
            "unique_modules": 2.0,
            "third_party_count": 2.0,
            "third_party_ratio": 1.0
          },
          "strings": {
            "total": 66.0,
            "avg_length": 12.85,
            "max_length": 25.0,
            "avg_entropy": 2.81,
            "total_bytes": 848.0,
            "entropy_stddev": 0.85
          },
          "comments": {
            "chars": 23.0,
            "lines": 1.0,
            "total": 1.0,
            "to_code_ratio": 0.0
          },
          "functions": {},
          "identifiers": {
            "total": 23.0,
            "avg_length": 7.0,
            "max_length": 13.0,
            "min_length": 4.0,
            "avg_entropy": 2.3,
            "reuse_ratio": 0.26,
            "unique_count": 6.0,
            "length_stddev": 3.06,
            "all_lowercase_ratio": 0.5,
            "all_uppercase_ratio": 0.5,
            "underscore_prefix_count": 3.0
          }
        },
        "ss": [
          [
            35,
            "la"
          ],
          [
            36,
            "la"
          ],
          [
            55,
            "la"
          ],
          [
            56,
            "la"
          ],
          [
            69,
            "la"
          ],
          [
            70,
            "la"
          ],
          [
            85,
            "Location:"
          ],
          [
            86,
            "Location:"
          ],
          [
            106,
            "PHP_SELF"
          ],
          [
            107,
            "PHP_SELF"
          ],
          [
            153,
            "la"
          ],
          [
            154,
            "la"
          ],
          [
            169,
            "tr"
          ],
          [
            170,
            "tr"
          ],
          [
            186,
            "lang/tr.php"
          ],
          [
            187,
            "lang/tr.php"
          ],
          [
            220,
            "eng"
          ],
          [
            221,
            "eng"
          ],
          [
            238,
            "lang/eng.php"
          ],
          [
            239,
            "lang/eng.php"
          ],
          [
            289,
            "lang/eng.php"
          ],
          [
            290,
            "lang/eng.php"
          ],
          [
            1193,
            "components/title.php"
          ],
          [
            1194,
            "components/title.php"
          ],
          [
            2174,
            "components/preloader.php"
          ],
          [
            2175,
            "components/preloader.php"
          ],
          [
            2288,
            "components/backCanvas.php"
          ],
          [
            2289,
            "components/backCanvas.php"
          ],
          [
            2396,
            "components/header.php"
          ],
          [
            2397,
            "components/header.php"
          ],
          [
            2762,
            "contact-main-1"
          ],
          [
            2763,
            "contact-main-1"
          ],
          [
            2836,
            "contact-main-2"
          ],
          [
            2837,
            "contact-main-2"
          ],
          [
            3264,
            "contact-text-1"
          ],
          [
            3265,
            "contact-text-1"
          ],
          [
            3517,
            "contact-form-1"
          ],
          [
            3518,
            "contact-form-1"
          ],
          [
            3613,
            "contact-form-2"
          ],
          [
            3614,
            "contact-form-2"
          ],
          [
            3734,
            "contact-form-3"
          ],
          [
            3735,
            "contact-form-3"
          ],
          [
            3831,
            "contact-form-4"
          ],
          [
            3832,
            "contact-form-4"
          ],
          [
            3986,
            "contact-form-5"
          ],
          [
            3987,
            "contact-form-5"
          ],
          [
            4161,
            "sales-button"
          ],
          [
            4162,
            "sales-button"
          ],
          [
            4377,
            "contact-text-2"
          ],
          [
            4378,
            "contact-text-2"
          ],
          [
            4423,
            "contact-text-3"
          ],
          [
            4424,
            "contact-text-3"
          ],
          [
            4548,
            "contact-text-4"
          ],
          [
            4549,
            "contact-text-4"
          ],
          [
            4594,
            "contact-text-5"
          ],
          [
            4595,
            "contact-text-5"
          ],
          [
            4727,
            "contact-text-6"
          ],
          [
            4728,
            "contact-text-6"
          ],
          [
            4773,
            "contact-text-7"
          ],
          [
            4774,
            "contact-text-7"
          ],
          [
            5114,
            "contact-location"
          ],
          [
            5115,
            "contact-location"
          ],
          [
            6506,
            "components/footer.php"
          ],
          [
            6507,
            "components/footer.php"
          ],
          [
            6601,
            "components/copyright.php"
          ],
          [
            6602,
            "components/copyright.php"
          ],
          [
            5994,
            "url",
            "\u003ciframe src=\"https://www.google.com/maps/embed?pb=!1m14!1m8!1m3!1d6039.819406421406!2d29.359455!3d40.807978!3m2!1i1024!2i768!4f1"
          ]
        ],
        "sz": 7687,
        "ts": [
          {
            "c": 1.0,
            "d": ".js extension",
            "e": [
              "\"assets/js/jquery-1.11.3.min.js\""
            ],
            "i": "objectives/command-and-control/dropper/builder::js-ext",
            "l": 1
          },
          {
            "c": 0.8600000143051147,
            "d": "Regex component marker",
            "e": [
              "$_SERVER["
            ],
            "i": "objectives/command-and-control/backdoor/webshell/ui::self-named-get-form--rx-4",
            "l": 1,
            "m": "B0030"
          },
          {
            "c": 0.8399999737739563,
            "d": "password/token/api_key field keyword",
            "e": [
              "token"
            ],
            "i": "micro-behaviors/data/text/keywords/credential::credential-field",
            "l": 1
          },
          {
            "c": 0.8600000143051147,
            "d": "Regex component marker",
            "e": [
              "method="
            ],
            "i": "objectives/command-and-control/backdoor/webshell/ui::self-named-get-form--rx-3",
            "l": 1,
            "m": "B0030"
          },
          {
            "a": "T1505.003",
            "c": 0.4000000059604645,
            "d": "PHP $_GET[...] superglobal access",
            "e": [
              "$_GET["
            ],
            "i": "objectives/command-and-control/backdoor/webshell/request::php-get",
            "l": 1,
            "m": "B0030"
          },
          {
            "c": 0.75,
            "d": "Session variable access ($_SESSION)",
            "e": [
              "$_SESSION"
            ],
            "i": "micro-behaviors/communications/http/request/params::session",
            "l": 3
          },
          {
            "a": "T1027.003",
            "c": 0.8999999761581421,
            "d": "Node.js require call in non-code file",
            "e": [
              "require("
            ],
            "i": "objectives/anti-static/obfuscation/payload/container::js-require-in-noncode",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.949999988079071,
            "d": "PHP opening tag present",
            "e": [
              "\u003c?php"
            ],
            "i": "metadata/lang/scripted::php-open-tag",
            "l": 1
          },
          {
            "a": "T1059",
            "c": 0.8500000238418579,
            "d": "HTTP GET parameter access ($_GET)",
            "e": [
              "$_GET"
            ],
            "i": "micro-behaviors/communications/http/request/params::get-dup",
            "l": 3
          },
          {
            "c": 0.8999999761581421,
            "d": "File has 30 or more lines",
            "e": [
              "text.total_lines = 208.00"
            ],
            "i": "metadata/file/text/metrics::file-has-30-plus-lines",
            "l": 1
          },
          {
            "a": "T1071.001",
            "c": 0.699999988079071,
            "d": "HTTP POST method",
            "e": [
              "\"POST\""
            ],
            "i": "micro-behaviors/communications/http/post::post",
            "l": 1,
            "m": "C0002"
          },
          {
            "c": 0.6000000238418579,
            "d": "Generates HTML tags",
            "e": [
              "\u003chtml"
            ],
            "i": "micro-behaviors/data/format/html::html-generator-tags",
            "l": 3
          },
          {
            "c": 0.8600000143051147,
            "d": "Regex component marker",
            "e": [
              "PHP_SELF"
            ],
            "i": "objectives/command-and-control/backdoor/webshell/ui::self-named-get-form--rx-2",
            "l": 1,
            "m": "B0030"
          },
          {
            "c": 0.75,
            "d": "Generic $_SERVER superglobal access",
            "e": [
              "$_SERVER"
            ],
            "i": "micro-behaviors/communications/http/request/params::server-dup",
            "l": 3
          },
          {
            "c": 0.699999988079071,
            "d": "AJAX request handler pattern",
            "e": [
              "$_GET['la']"
            ],
            "i": "objectives/command-and-control/backdoor/webshell/ui::ajax-handler",
            "l": 4,
            "m": "B0030"
          },
          {
            "c": 0.8999999761581421,
            "d": "Encoded payload detected: url",
            "e": [
              "\u003ciframe src=\"https://www.google.com/maps \u003curl\u003e"
            ],
            "i": "metadata/encoded-payload/url",
            "l": 3
          }
        ],
        "sha": "456f89a0ac865ff4eef5805c0d12d31e39da8bf1b2b1ac48a8d54885fa77f043",
        "path": "456f89a0ac865ff4eef5805c0d12d31e39da8bf1b2b1ac48a8d54885fa77f043.php",
        "type": "php"
      }
    ],
    "tv": "1f252"
  }
}