{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9957337975502014, "class": 2 } ], "prob": 0.9957338, "class": 2, "models": [ { "m": "az", "prob": 0.79392254, "class": 0 }, { "m": "az/scripts", "prob": 0.92512757, "class": 0 }, { "m": "az/php", "prob": 0.9957338, "class": 2 } ], "version": "v16.16", "thresholds": [ 0.9961138, 0.99909174 ], "analyzed_at": "2026-05-09T04:40:18Z" }, "path": "next.inc.php", "raw": { "v": "4", "fs": [ { "f": "O₄(C₃CaAlLa₂)H₂(CmDb₃)Md", "k": { "source.imports[0]": "date", "source.imports[1]": "header", "source.imports[2]": "isset", "source.imports[3]": "session_start", "source.imports[4]": "strlen", "source.imports[5]": "substr", "source.strings[0]": "HTTP_USER_AGENT", "source.strings[1]": "Location: payment.php", "source.strings[2]": "Location: payment.php?secure_code_m", "source.strings[3]": "Location: payment.php?secure_code_v", "source.strings[4]": "Location: tnk_p.php", "source.strings[5]": "Location: tnk_v.php", "source.strings[6]": "MASTERCARD", "source.strings[7]": "Mastercard", "source.strings[8]": "Y/m/d h:i:s:A", "source.strings[9]": "addresse", "source.has_imports": true, "source.strings[10]": "btn_last", "source.strings[11]": "btnm_last", "source.strings[12]": "btnplll", "source.strings[13]": "cdholder", "source.strings[14]": "country", "source.strings[15]": "countryip", "source.strings[16]": "datetimeopen", "source.strings[17]": "dsecure", "source.strings[18]": "emailpl", "source.strings[19]": "exp_dt", "source.strings[20]": "mastercard", "source.strings[21]": "namebank", "source.strings[22]": "passpl", "source.strings[23]": "passwd", "source.strings[24]": "passwd2", "source.strings[25]": "password", "source.strings[26]": "phonebank", "source.strings[27]": "schemecard", "source.strings[28]": "submit", "source.strings[29]": "typecard", "source.strings[30]": "urlbank", "source.strings[31]": "useragent" }, "x": 66, "id": 0, "is": [ "session_start", "isset", "date", "header", "isset", "strlen", "substr", "header", "header", "header", "isset", "header", "isset", "header", "isset", "header" ], "ms": { "file": { "size": 2315.0 }, "text": { "tab_count": 116.0, "digit_ratio": 0.01, "space_count": 122.0, "total_lines": 65.0, "char_entropy": 5.28, "unique_chars": 71.0, "import_density": 24.62, "string_density": 2.95, "avg_line_length": 34.63, "max_line_length": 139.0, "empty_line_ratio": 0.02, "last_line_length": 2.0, "most_common_char": "S", "whitespace_ratio": 0.13, "most_common_ratio": 0.07, "identifier_density": 1.65, "line_length_stddev": 21.98, "normalized_import_count": 1.98, "normalized_string_count": 23.81, "max_inline_whitespace_run": 2.0, "trailing_whitespace_lines": 1.0, "normalized_unique_identifiers": 2.16 }, "imports": { "total": 16.0, "unique_modules": 6.0, "third_party_count": 16.0, "third_party_ratio": 1.0 }, "strings": { "total": 192.0, "avg_length": 7.24, "max_length": 35.0, "avg_entropy": 2.13, "total_bytes": 1390.0, "entropy_stddev": 1.11 }, "comments": {}, "functions": {}, "identifiers": { "total": 107.0, "avg_length": 6.08, "max_length": 13.0, "min_length": 2.0, "avg_entropy": 2.12, "reuse_ratio": 0.12, "unique_count": 13.0, "length_stddev": 2.89, "all_lowercase_ratio": 0.69, "all_uppercase_ratio": 0.23, "underscore_prefix_count": 3.0 } }, "ss": [ [ 43, "submit" ], [ 44, "submit" ], [ 68, "user" ], [ 69, "user" ], [ 85, "email" ], [ 86, "email" ], [ 107, "password" ], [ 108, "password" ], [ 128, "password" ], [ 129, "password" ], [ 153, "ip" ], [ 154, "ip" ], [ 168, "ip" ], [ 169, "ip" ], [ 187, "countryip" ], [ 188, "countryip" ], [ 209, "countryip" ], [ 210, "countryip" ], [ 235, "datetimeopen" ], [ 236, "datetimeopen" ], [ 258, "Y/m/d h:i:s:A" ], [ 259, "Y/m/d h:i:s:A" ], [ 288, "useragent" ], [ 289, "useragent" ], [ 312, "HTTP_USER_AGENT" ], [ 313, "HTTP_USER_AGENT" ], [ 341, "Location: payment.php" ], [ 342, "Location: payment.php" ], [ 388, "start" ], [ 389, "start" ], [ 413, "fname" ], [ 414, "fname" ], [ 431, "fname" ], [ 432, "fname" ], [ 453, "lname" ], [ 454, "lname" ], [ 471, "lname" ], [ 472, "lname" ], [ 493, "cn" ], [ 494, "cn" ], [ 508, "cn" ], [ 509, "cn" ], [ 527, "exp_dt" ], [ 528, "exp_dt" ], [ 546, "exp_dt" ], [ 547, "exp_dt" ], [ 569, "cvv" ], [ 570, "cvv" ], [ 585, "cvv" ], [ 586, "cvv" ], [ 605, "addresse" ], [ 606, "addresse" ], [ 626, "addresse" ], [ 627, "addresse" ], [ 651, "city" ], [ 652, "city" ], [ 668, "city" ], [ 669, "city" ], [ 689, "country" ], [ 690, "country" ], [ 709, "country" ], [ 710, "country" ], [ 733, "zip" ], [ 734, "zip" ], [ 749, "zip" ], [ 750, "zip" ], [ 769, "namebank" ], [ 770, "namebank" ], [ 790, "namebank" ], [ 791, "namebank" ], [ 815, "schemecard" ], [ 816, "schemecard" ], [ 838, "schemecard" ], [ 839, "schemecard" ], [ 865, "typecard" ], [ 866, "typecard" ], [ 886, "typecard" ], [ 887, "typecard" ], [ 911, "urlbank" ], [ 912, "urlbank" ], [ 931, "urlbank" ], [ 932, "urlbank" ], [ 955, "phonebank" ], [ 956, "phonebank" ], [ 977, "phonebank" ], [ 978, "phonebank" ], [ 1009, "cn" ], [ 1010, "cn" ], [ 1111, "cardx" ], [ 1112, "cardx" ], [ 1146, "schemecard" ], [ 1147, "schemecard" ], [ 1163, "Visa" ], [ 1164, "Visa" ], [ 1183, "schemecard" ], [ 1184, "schemecard" ], [ 1200, "VISA" ], [ 1201, "VISA" ], [ 1220, "schemecard" ], [ 1221, "schemecard" ], [ 1237, "visa" ], [ 1238, "visa" ], [ 1258, "Location: payment.php?secure_code_v" ], [ 1259, "Location: payment.php?secure_code_v" ], [ 1319, "schemecard" ], [ 1320, "schemecard" ], [ 1336, "Mastercard" ], [ 1337, "Mastercard" ], [ 1362, "schemecard" ], [ 1363, "schemecard" ], [ 1379, "mastercard" ], [ 1380, "mastercard" ], [ 1405, "schemecard" ], [ 1406, "schemecard" ], [ 1422, "MASTERCARD" ], [ 1423, "MASTERCARD" ], [ 1448, "Location: payment.php?secure_code_m" ], [ 1449, "Location: payment.php?secure_code_m" ], [ 1507, "Location: tnk_v.php" ], [ 1508, "Location: tnk_v.php" ], [ 1555, "btn_last" ], [ 1556, "btn_last" ], [ 1582, "dd" ], [ 1583, "dd" ], [ 1597, "dd" ], [ 1598, "dd" ], [ 1616, "mm" ], [ 1617, "mm" ], [ 1631, "mm" ], [ 1632, "mm" ], [ 1650, "yy" ], [ 1651, "yy" ], [ 1665, "yy" ], [ 1666, "yy" ], [ 1684, "z1" ], [ 1685, "z1" ], [ 1699, "z1" ], [ 1700, "z1" ], [ 1718, "z2" ], [ 1719, "z2" ], [ 1733, "z2" ], [ 1734, "z2" ], [ 1752, "z3" ], [ 1753, "z3" ], [ 1767, "z3" ], [ 1768, "z3" ], [ 1786, "dsecure" ], [ 1787, "dsecure" ], [ 1806, "dsecure" ], [ 1807, "dsecure" ], [ 1827, "Location: tnk_v.php" ], [ 1828, "Location: tnk_v.php" ], [ 1872, "btnm_last" ], [ 1873, "btnm_last" ], [ 1901, "dd" ], [ 1902, "dd" ], [ 1916, "dd" ], [ 1917, "dd" ], [ 1935, "mm" ], [ 1936, "mm" ], [ 1950, "mm" ], [ 1951, "mm" ], [ 1969, "yy" ], [ 1970, "yy" ], [ 1984, "yy" ], [ 1985, "yy" ], [ 2003, "cdholder" ], [ 2004, "cdholder" ], [ 2024, "cdholder" ], [ 2025, "cdholder" ], [ 2049, "passwd" ], [ 2050, "passwd" ], [ 2068, "passwd" ], [ 2069, "passwd" ], [ 2091, "passwd2" ], [ 2092, "passwd2" ], [ 2111, "passwd2" ], [ 2112, "passwd2" ], [ 2132, "Location: tnk_v.php" ], [ 2133, "Location: tnk_v.php" ], [ 2176, "btnplll" ], [ 2177, "btnplll" ], [ 2202, "emailpl" ], [ 2203, "emailpl" ], [ 2222, "emailpl" ], [ 2223, "emailpl" ], [ 2246, "passpl" ], [ 2247, "passpl" ], [ 2265, "passpl" ], [ 2266, "passpl" ], [ 2285, "Location: tnk_p.php" ], [ 2286, "Location: tnk_p.php" ] ], "sz": 2315, "ts": [ { "c": 0.8999999761581421, "d": "File has 30 or more lines", "e": [ "text.total_lines = 65.00" ], "i": "metadata/file/text/metrics::file-has-30-plus-lines", "l": 1 }, { "c": 0.8399999737739563, "d": "Regex component marker", "e": [ "password" ], "i": "micro-behaviors/data/text/llm/action::llm-send-action-cond-4--inline-11750", "l": 1 }, { "a": "T1005", "c": 0.75, "d": "Regex component marker", "e": [ "typecard\"] = $_POST['typecard" ], "i": "objectives/credential-access/financial/credit-card::mastercard-bin--rx-5", "l": 1, "m": "B0030" }, { "c": 0.8199999928474426, "d": "Generic weak-login username marker", "e": [ "\"user\"]" ], "i": "objectives/lateral-movement/brute-force/ssh::weak-login-pair-set--rx-5", "l": 1 }, { "a": "T1505.003", "d": "PHP open tag", "e": [ "\u003c?php" ], "i": "objectives/command-and-control/backdoor/webshell/request::php-tag", "l": 1, "m": "B0030" }, { "a": "T1505.003", "c": 0.8500000238418579, "d": "PHP request superglobal access", "e": [ "$_POST" ], "i": "objectives/command-and-control/backdoor/webshell/upload::php-request-variadic-function-call", "l": 3, "m": "B0030" }, { "a": "T1005", "c": 0.75, "d": "Regex component marker", "e": [ "master" ], "i": "objectives/credential-access/financial/credit-card::mastercard-bin--rx-2", "l": 1, "m": "B0030" }, { "a": "T1005", "c": 0.4000000059604645, "d": "Mastercard brand reference", "e": [ "mastercard" ], "i": "objectives/credential-access/financial/credit-card::mastercard-brand", "l": 1, "m": "B0030" }, { "c": 0.8600000143051147, "d": "Regex component marker", "e": [ "$_SERVER[" ], "i": "objectives/command-and-control/backdoor/webshell/ui::self-named-get-form--rx-4", "l": 1, "m": "B0030" }, { "c": 0.8399999737739563, "d": "password/token/api_key field keyword", "e": [ "password" ], "i": "micro-behaviors/data/text/keywords/credential::credential-field", "l": 1 }, { "a": "T1005", "c": 0.800000011920929, "d": "Regex component marker", "e": [ "$_POST['cvv" ], "i": "objectives/credential-access/financial/credit-card::credit-card-form-capture--rx-35", "l": 1, "m": "B0030" }, { "c": 0.75, "d": "Session variable access ($_SESSION)", "e": [ "$_SESSION" ], "i": "micro-behaviors/communications/http/request/params::session", "l": 3 }, { "a": "T1059", "c": 0.8500000238418579, "d": "HTTP POST parameter access ($_POST)", "e": [ "$_POST" ], "i": "micro-behaviors/communications/http/request/params::post-dup", "l": 3 }, { "c": 0.8399999737739563, "d": "Regex component marker", "e": [ "password" ], "i": "micro-behaviors/data/text/llm/action::llm-send-action--rx-6", "l": 1 }, { "a": "T1110.001", "c": 0.8999999761581421, "d": "Weak password master", "e": [ "master" ], "i": "objectives/lateral-movement/brute-force/password::weak-pass-master", "l": 1, "m": "E1110" }, { "a": "T1005", "c": 0.75, "d": "Regex component marker", "e": [ "Mastercard" ], "i": "objectives/credential-access/financial/credit-card::mastercard-bin--rx-4", "l": 1, "m": "B0030" }, { "a": "T1505.003", "c": 0.4000000059604645, "d": "PHP $_POST parameter access", "e": [ "$_POST[" ], "i": "objectives/command-and-control/backdoor/webshell/request::php-post", "l": 1, "m": "B0030" }, { "d": "password keyword", "e": [ "password" ], "i": "micro-behaviors/data/text/keywords/lexicon::password", "l": 1 }, { "a": "T1005", "c": 0.800000011920929, "d": "Regex component marker", "e": [ "cvv\"] = $_POST['cvv'];\n\t\t$_SESSION[\"addresse\"] = $_POST['addresse'];\n\t\t$_SESSION[\"city\"] = $_POST['city'];\n\t\t$_SESSION[\"country\"" ], "i": "objectives/credential-access/financial/credit-card::credit-card-form-capture--rx-15", "l": 1, "m": "B0030" }, { "c": 0.75, "d": "Generic $_SERVER superglobal access", "e": [ "$_SERVER" ], "i": "micro-behaviors/communications/http/request/params::server-dup", "l": 3 }, { "c": 0.8500000238418579, "d": "Checks User-Agent for crawler detection", "e": [ "$_SERVER['HTTP_USER_AGENT']" ], "i": "objectives/anti-analysis/browser-detect::check-ua-server-var", "l": 3 }, { "a": "T1027", "c": 0.699999988079071, "d": "Low identifier reuse ratio", "e": [ "identifiers.reuse_ratio = 0.12" ], "i": "objectives/anti-static/obfuscation/code-metrics/identifiers::low-identifier-reuse", "l": 2, "m": "B0032" }, { "a": "T1005", "c": 0.699999988079071, "d": "CVV/CVC field reference", "e": [ "cvv" ], "i": "objectives/credential-access/financial/credit-card::cvv-field", "l": 1, "m": "B0030" }, { "c": 0.699999988079071, "d": "AJAX request handler pattern", "e": [ "$_POST['country']", "$_POST['email']", "$_POST['password']", "$_POST['lname']", "$_POST['cvv']", "$_POST['addresse']", "$_POST['zip']", "$_POST['submit']", "$_POST['fname']", "$_POST['cn']", "$_POST['start']", "$_POST['city']", "$_POST['countryip']", "$_POST['exp_dt']", "$_POST['ip']", "$_POST['namebank']" ], "i": "objectives/command-and-control/backdoor/webshell/ui::ajax-handler", "l": 4, "m": "B0030" }, { "a": "T1005", "c": 0.8999999761581421, "d": "Credit card form fields collection", "e": [ "$_POST['cvv", "cvv", "mastercard", "cvv\"] = $_POST['cvv'];\n\t\t$_SESSION[\"addresse\"] = $_POST['addresse'];\n\t\t$_SESSION[\"city\"] = $_POST['city'];\n\t\t$_SESSION[\"country\"" ], "i": "objectives/credential-access/financial/credit-card::credit-card-form-fields", "l": 4, "m": "B0030" } ], "sha": "462070f85f58adbb0cc47f7392a65e98ddfa77a965d158f89ed44a3bccb7e137", "path": "/data/samples/bad/datasets/awesome-malware/PHP/next.inc.php", "type": "php" } ], "tv": "a9555" } }