{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9999731779098511, "class": 2 } ], "prob": 0.9999732, "class": 2, "models": [ { "m": "az", "prob": 0.9989248, "class": 1 }, { "m": "az/scripts", "prob": 0.9999732, "class": 2 }, { "m": "az/php", "prob": 0.9999639, "class": 2 } ], "version": "v16.16", "thresholds": [ 0.9961138, 0.99909174 ], "analyzed_at": "2026-05-08T23:22:07Z" }, "path": "72398833bc9aa459cf60c5895ff3c956", "raw": { "v": "4", "fs": [ { "f": "O₅(As₆C₈AlDy₃I)H₃(Cm₂FOs)MdTh", "k": { "source.imports[0]": "array_reverse", "source.imports[1]": "empty", "source.imports[2]": "explode", "source.imports[3]": "implode", "source.imports[4]": "isset", "source.imports[5]": "l10", "source.imports[6]": "l10w", "source.imports[7]": "l11vw2", "source.imports[8]": "l19qv", "source.imports[9]": "l1ArXq", "source.strings[0]": " HTTP/1.0", "source.strings[1]": "$\nyumingid=12\nlineid=1565\nx3=\nx4=AZvgrGSzJx\nx5=well,hippopotamus,learning,pastries,Shiver,Miner,waterpurifier,nature,circumstance,catch,dissolve,gut,goto,magnitude,northwest,six,knowledge,safetyisland,application,banana,daily,dropball,Pron,evening,Jew,early,LonglifeMilk,pants,RemoteControl,about\nx6=\nx7=http://ctuan07.sj||fsif573uwt/weilai.php\ncache=00\nsps=1011110\nurlgz=[3:5]/[1:5]_#_[1:4][0:10]_[2:9]-!.*|[0:12][1:5]/^-!/[2:5]/[1:5]|[1:4]-^/!-[0:1][1:4].*|^-[2:7]_[1:4]-[0:4]-[1:3]-[2:5]_!_[0:5]|[0:7][1:5]-^-!/[1:3]/.*|[0:12]^/[1:3~9]-!/|[2:9]/[4:3]-^-[1:5]-!-[2:7].*|[0:4]-^-[0:5]-[3:2]-[0:4]-!-[2:3~7]-[2:6]/|[2:5]-^/[1:5][0:6]_[1:4]_[2:9]_!|[1:4]/^/[0:4]-[2:5]_!/|[5:2]/#/[0:8]_!-[0:4]_[1:3~5].*|[0:3]-^-!/[1:4]_[1:5].*|[1:5]-[2:5]_^_[0:9]-[2:7]-!.*|[2:9]/[0:5]/^-[2:12]_!/[1:5][0:5]/[0:3~6].*|^/[0:6]/[2:14]-[1:4]-!-[0:10]_[0:6].*||htms,dhtml,aspx,phpt,eijap,bheo,qvonm,server,ruby,cfmy\n", "source.strings[2]": "$l15mz5be/", "source.strings[3]": "$l1Iy5$l1ae1{$l1BoXN[3]}\u003c", "source.strings[4]": "$l1JaE8/", "source.strings[5]": "$l1Y/$l1EE", "source.strings[6]": "$l1ds3Pj7/robots.txt", "source.strings[7]": "$l1i7M/$l1avtFFX", "source.strings[8]": "$l1i7M/$l1avtFFX/$l1efZ", "source.strings[9]": "$l1i7M/$l1avtFFX/$l1o", "source.has_imports": true, "source.imports[10]": "l1B", "source.imports[11]": "l1DhIK", "source.imports[12]": "l1E", "source.imports[13]": "l1F", "source.imports[14]": "l1FrV", "source.imports[15]": "l1Gj4EqS", "source.imports[16]": "l1Gz5R", "source.imports[17]": "l1ICDfcF", "source.imports[18]": "l1JLj2", "source.imports[19]": "l1LuaV", "source.imports[20]": "l1PYg12a", "source.imports[21]": "l1Qrp", "source.imports[22]": "l1RNMk", "source.imports[23]": "l1Sw", "source.imports[24]": "l1YctUf", "source.imports[25]": "l1ZZn0", "source.imports[26]": "l1akod", "source.imports[27]": "l1c46yT", "source.imports[28]": "l1ci", "source.imports[29]": "l1hk4ndy", "source.imports[30]": "l1ibchG", "source.imports[31]": "l1l", "source.imports[32]": "l1nDw", "source.imports[33]": "l1t", "source.imports[34]": "l1vHPM99", "source.imports[35]": "l1yK", "source.imports[36]": "l1ztqII", "source.imports[37]": "preg_split", "source.strings[10]": "$l1i7M/$l1avtFFX/landingcss", "source.strings[11]": "$l1lcpGQW", "source.strings[12]": "$l1p$l1y29l,", "source.strings[13]": "$l1tGyiR/", "source.strings[14]": "$l1tGyiR?", "source.strings[15]": "$l1uzy/", "source.strings[16]": "$l1wn08p/", "source.strings[17]": "($l1vQYbq)", "source.strings[18]": "(.*)/si", "source.strings[19]": "(.*?)';/s", "source.strings[20]": ")?(\\?|\\/)/si", "source.strings[21]": ")?(\\d+)$/si", "source.strings[22]": "/$l1EE", "source.strings[23]": "/$l1RGn", "source.strings[24]": "/$l1wPX", "source.strings[25]": "/($l1IrjCFS)/si", "source.strings[26]": "/([^\\d]+)(\\d+)\\.xml$/si", "source.strings[27]": "/.*?\\r\\n\\r\\n(.*)/si", "source.strings[28]": "/\u003cIfModule\\s+mod_rewrite.c\u003e[^\u003c]+\u003c\\/IfModule\u003e/si", "source.strings[29]": "/@'\\\\\\$(.*?)';/s", "source.strings[30]": "/@\\'\\$.*?exit\\(\\);\\}if\\(.*?\\}\\}[a-z0-9]+\\(\\);/si", "source.strings[31]": "/[^A-Za-z0-9\\+\\/\\=$]/", "source.strings[32]": "/\\.(jpg|jpeg|gif|png|bmp|svg)$/si", "source.strings[33]": "/\\.xml$/si", "source.strings[34]": "/^$l1ZYL$/", "source.strings[35]": "/^($l1tGyiR)?(\\?|\\/)/si", "source.strings[36]": "/^[a-z](\\d+)$/si", "source.strings[37]": "/landingcss", "source.strings[38]": "/robots.txt", "source.strings[39]": "1\\d)/si", "source.strings[40]": "1|\\^\\(.\\*\\)", "source.strings[41]": "710(\\d+)$/si", "source.strings[42]": "=\\\\\\$1|\\^\\(.\\*\\)\\\\\\$|.\\*-.\\*|\\?\\\\\\$\\d\\d?\\\\\\$1\\d)/si", "source.strings[43]": "?/|\u0026()[]{}+^$!:*", "source.strings[44]": "@require(", "source.strings[45]": "@require('$l1AUc5o');", "source.strings[46]": "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=$", "source.strings[47]": "Connection:Close", "source.strings[48]": "DOCUMENT_ROOT", "source.strings[49]": "GET $l1BmNY HTTP/1.0\\r\\nHost:", "source.strings[50]": "HTTP_HOST", "source.strings[51]": "HTTP_REFERER", "source.strings[52]": "HTTP_USER_AGENT", "source.strings[53]": "K/@mJB3pOxjmNx8y", "source.strings[54]": "PATH_INFO", "source.strings[55]": "QUERY_STRING", "source.strings[56]": "REMOTE_ADDR", "source.strings[57]": "REQUEST_URI", "source.strings[58]": "SCRIPT_FILENAME", "source.strings[59]": "SCRIPT_NAME", "source.strings[60]": "SERVER_NAME", "source.strings[61]": "SERVER_SOFTWARE", "source.strings[62]": "\\$.*?exit\\(\\);\\}if\\(.*?\\}\\}[a-z0-9]+\\(\\);/si", "source.strings[63]": "\\\\?/|\u0026()[]{}+^$!:*", "source.strings[64]": "\\r\\nConnection:Close\\r\\n\\r\\n", "source.strings[65]": "\\x3c\\x3fphp $l1lX", "source.strings[66]": "\\xEF\\xBB\\xBF", "source.strings[67]": "b66666", "source.strings[68]": "b666666", "source.strings[69]": "b6666666b", "source.strings[70]": "b6666b", "source.strings[71]": "b6666b6", "source.strings[72]": "b6666b666", "source.strings[73]": "b6666b6b", "source.strings[74]": "b6666bb6", "source.strings[75]": "b6666bb6b", "source.strings[76]": "b6666bbb", "source.strings[77]": "b6666bbbb", "source.strings[78]": "b666b6", "source.strings[79]": "b666b66", "source.strings[80]": "b666b6666", "source.strings[81]": "b666b6b6b", "source.strings[82]": "b666bb", "source.strings[83]": "b666bb66", "source.strings[84]": "b666bb6b", "source.strings[85]": "b666bbb66", "source.strings[86]": "b666bbbb6", "source.strings[87]": "b66b66", "source.strings[88]": "b66b666b6", "source.strings[89]": "b66b66bb", "source.strings[90]": "b66b6b", "source.strings[91]": "b66b6b6", "source.strings[92]": "b66b6b66", "source.strings[93]": "b66b6b6b", "source.strings[94]": "b66b6b6bb", "source.strings[95]": "b66b6bb", "source.strings[96]": "b66b6bb66", "source.strings[97]": "b66b6bbb", "source.strings[98]": "b66b6bbbb", "source.strings[99]": "b66bb6", "source.functions[0]": "l10", "source.functions[1]": "l10w", "source.functions[2]": "l11vw2", "source.functions[3]": "l19qv", "source.functions[4]": "l1ArXq", "source.functions[5]": "l1B", "source.functions[6]": "l1DhIK", "source.functions[7]": "l1E", "source.functions[8]": "l1F", "source.functions[9]": "l1FrV", "source.strings[100]": "b66bb66", "source.strings[101]": "b66bb666", "source.strings[102]": "b66bb6666", "source.strings[103]": "b66bb66b6", "source.strings[104]": "b66bb6b6", "source.strings[105]": "b66bb6bb", "source.strings[106]": "b66bb6bb6", "source.strings[107]": "b66bb6bbb", "source.strings[108]": "b66bbb", "source.strings[109]": "b66bbb6", "source.strings[110]": "b66bbbb6", "source.strings[111]": "b6b666", "source.strings[112]": "b6b6666", "source.strings[113]": "b6b66666", "source.strings[114]": "b6b6666b6", "source.strings[115]": "b6b6666bb", "source.strings[116]": "b6b666bb", "source.strings[117]": "b6b666bb6", "source.strings[118]": "b6b66b6", "source.strings[119]": "b6b66b66", "source.strings[120]": "b6b66b66b", "source.strings[121]": "b6b66b6b", "source.strings[122]": "b6b66b6bb", "source.strings[123]": "b6b66bbb", "source.strings[124]": "b6b66bbb6", "source.strings[125]": "b6b66bbbb", "source.strings[126]": "b6b6b6", "source.strings[127]": "b6b6b66", "source.strings[128]": "b6b6b6666", "source.strings[129]": "b6b6b66b", "source.strings[130]": "b6b6b6b6b", "source.strings[131]": "b6b6b6bb", "source.strings[132]": "b6b6bb", "source.strings[133]": "b6b6bb6", "source.strings[134]": "b6b6bb66", "source.strings[135]": "b6b6bbb6b", "source.strings[136]": "b6bb6666", "source.strings[137]": "b6bb666bb", "source.strings[138]": "b6bb66bb", "source.strings[139]": "b6bb6b", "source.strings[140]": "b6bb6b6", "source.strings[141]": "b6bb6b66", "source.strings[142]": "b6bb6b666", "source.strings[143]": "b6bb6bbb", "source.strings[144]": "b6bbb6", "source.strings[145]": "b6bbb6b66", "source.strings[146]": "b6bbb6bb", "source.strings[147]": "b6bbb6bbb", "source.strings[148]": "b6bbbb6", "source.strings[149]": "b6bbbb66", "source.strings[150]": "b6bbbb666", "source.strings[151]": "b6bbbb6b", "source.strings[152]": "b6bbbbb", "source.strings[153]": "b6bbbbb6", "source.strings[154]": "b6bbbbbb", "source.strings[155]": "b6bbbbbbb", "source.strings[156]": "b6bbbbbbb9bbb6bb66b9b66bbbb69bb6b66b669b66b6bb669bbb6bbb69bb666bb6b9bb66bb6bb9bb666bbb9b6bb6bbb9bb66b6bb9b6666bbb9b6b66b6bb9bb666666b9b66bb6bb9b666b6b6b9b666b66669bb666bbb69bbbbb6b69b6bb6b669b6bbbb6669b6b6b669b6666666b9b6bbbb6b9b6bbbbb9bb6bbbbb69b66bb6b69b66b6b6b9bb6bbb6bb9bb66bbb669b6666b6b9b666bb6b9b6bbb6bb9b6bbb6bb69bb66bb66b9bbbb6b69bb6bbbb69b6b666bb9bbbbb6b9bb66bbbb69bbbb66b9b66b666b69bb6b6bbb69bb6b6669bbb66bbbb9bbbb66bb69b6b66bbbb9b66bb6bbb9b6b6666bb9b6bb6b6669b6666b6b69bbb66b69bbb6b6b6b9b6b6b66669bb666bb9bbb6b6669bbb6bb669b66bb6669b6b66bbb9bbb66b669b6bbbbbb9b6bb6bb69b666bb669bb6b6bbb9bb6b66b6b9b66bb6bb69bb6666b669b6b66b6b9b66b669b6666bb6b9b6b666b9bb6b6b6bb9b6bb666bb9b6b666bb6", "source.strings[157]": "bb66666", "source.strings[158]": "bb666666b", "source.strings[159]": "bb666b", "source.strings[160]": "bb666bb", "source.strings[161]": "bb666bb6", "source.strings[162]": "bb666bb66", "source.strings[163]": "bb666bbb", "source.strings[164]": "bb666bbb6", "source.strings[165]": "bb666bbbb", "source.strings[166]": "bb66b6", "source.strings[167]": "bb66b66", "source.strings[168]": "bb66b666", "source.strings[169]": "bb66b66b6", "source.strings[170]": "bb66b6b", "source.strings[171]": "bb66b6b6", "source.strings[172]": "bb66b6bb", "source.strings[173]": "bb66b6bb6", "source.strings[174]": "bb66bb66", "source.strings[175]": "bb66bb6bb", "source.strings[176]": "bb66bbb", "source.strings[177]": "bb66bbb6", "source.strings[178]": "bb66bbb66", "source.strings[179]": "bb66bbbb6", "source.strings[180]": "bb6b66", "source.strings[181]": "bb6b666", "source.strings[182]": "bb6b66b6", "source.strings[183]": "bb6b66b66", "source.strings[184]": "bb6b66b6b", "source.strings[185]": "bb6b66bb", "source.strings[186]": "bb6b6b", "source.strings[187]": "bb6b6b6", "source.strings[188]": "bb6b6b66", "source.strings[189]": "bb6b6b6bb", "source.strings[190]": "bb6b6bb", "source.strings[191]": "bb6b6bb66", "source.strings[192]": "bb6b6bbb", "source.strings[193]": "bb6b6bbb6", "source.strings[194]": "bb6bb6", "source.strings[195]": "bb6bb66b", "source.strings[196]": "bb6bb6b", "source.strings[197]": "bb6bb6b6b", "source.strings[198]": "bb6bb6bbb", "source.strings[199]": "bb6bbb", "source.strings[200]": "bb6bbb6", "source.strings[201]": "bb6bbb66", "source.strings[202]": "bb6bbb66b", "source.strings[203]": "bb6bbb6b", "source.strings[204]": "bb6bbb6bb", "source.strings[205]": "bb6bbbb", "source.strings[206]": "bb6bbbb6", "source.strings[207]": "bb6bbbbb6", "source.strings[208]": "bbb666", "source.strings[209]": "bbb6666", "source.strings[210]": "bbb6666b", "source.strings[211]": "bbb666b", "source.strings[212]": "bbb666b6", "source.strings[213]": "bbb66b", "source.strings[214]": "bbb66b6", "source.strings[215]": "bbb66b66", "source.strings[216]": "bbb66bbbb", "source.strings[217]": "bbb6b666", "source.strings[218]": "bbb6b666b", "source.strings[219]": "bbb6b6b", "source.strings[220]": "bbb6b6b6b", "source.strings[221]": "bbb6bb", "source.strings[222]": "bbb6bb66", "source.strings[223]": "bbb6bb666", "source.strings[224]": "bbb6bb66b", "source.strings[225]": "bbb6bbb", "source.strings[226]": "bbb6bbb6", "source.strings[227]": "bbbb66", "source.strings[228]": "bbbb666", "source.strings[229]": "bbbb66b66", "source.strings[230]": "bbbb66bb", "source.strings[231]": "bbbb66bb6", "source.strings[232]": "bbbb6b", "source.strings[233]": "bbbb6b6", "source.strings[234]": "bbbb6b6bb", "source.strings[235]": "bbbbb6b", "source.strings[236]": "bbbbb6b6", "source.strings[237]": "bbbbbb6", "source.strings[238]": "bbbbbb6b6", "source.strings[239]": "bbbbbb6bb", "source.strings[240]": "bbbbbbbbb", "source.strings[241]": "extensions", "source.strings[242]": "http://", "source.strings[243]": "http://$l1l", "source.strings[244]": "list_test", "source.strings[245]": "ml$/si", "source.strings[246]": "oO0Oo0OO0", "source.strings[247]": "s)$/si", "source.strings[248]": "stnetnoc_teg_elif1letirwf1ltini_lruc1ledocedlru1llru_esrap1ltnuoc1ledocnelru1ltes_ini1lciremun_si1ltpotes_lruc1lroolf1lcexe_lruc1lseulav_yarra1lerapmoc_noisrev1lemaner1lesolcf1lecalper_gerp1ldnar_tm1ldro1legrem_yarra1lpop_yarra1lhcuot1ltrats_bo1ltimil_emit_tes1lnepof1lmirt1lelif_si1lecils_yarra1llla_hctam_gerp1ltfihs_yarra1lfoef1lsoprts1legnar1leuqinu_yarra1letad1lezilaires1ltcartxe1lhctam_gerp1lelbatirw_si1lrtrts1lliec1lftnirps1lenifed1ltes_enozemit_tluafed_etad1lyarra_ni1ltilps_gerp1lnelrts1lesolc_lruc1lridkm1ldnars_tm1lhcraes_yarra1ledolpmi1l5dm1lstsixe_noitcnuf1lrhc1lrtsbus1ltroba_resu_erongi1lpilf_yarra1lyarra_si1ldomhc1lsba1lofniphp1lstegf1lemitmelif1ledolpxe1lemitotrts1lredaeh1lezilairesnu1lsoprrts1ltressa1lemanybtsohteg1lelffuhs1lecalper_rts1lstsixe_elif", "source.strings[249]": "url_prefix", "source.strings[250]": "url_prefix_qm", "source.strings[251]": "url_rules", "source.strings[252]": "{$l1S}000", "source.strings[253]": "{$l1S}l", "source.strings[254]": "{$l1S}l000", "source.strings[255]": "|.\\*-.\\*|\\?", "source.functions[10]": "l1Gj4EqS", "source.functions[11]": "l1Gz5R", "source.functions[12]": "l1ICDfcF", "source.functions[13]": "l1JLj2", "source.functions[14]": "l1LuaV", "source.functions[15]": "l1PYg12a", "source.functions[16]": "l1Qrp", "source.functions[17]": "l1RNMk", "source.functions[18]": "l1Sw", "source.functions[19]": "l1YctUf", "source.functions[20]": "l1ZZn0", "source.functions[21]": "l1akod", "source.functions[22]": "l1c46yT", "source.functions[23]": "l1ci", "source.functions[24]": "l1hk4ndy", "source.functions[25]": "l1ibchG", "source.functions[26]": "l1l", "source.functions[27]": "l1nDw", "source.functions[28]": "l1t", "source.functions[29]": "l1vHPM99", "source.functions[30]": "l1yK", "source.functions[31]": "l1ztqII" }, "x": 188, "id": 0, "is": [ "explode", "preg_split", "implode", "array_reverse", "explode", "l1Gj4EqS", "l1ibchG", "l1yK", "l1yK", "l1yK", "isset", "isset", "isset", "l1nDw", "l1nDw", "isset", "l1nDw", "isset", "empty", "isset", "isset", "isset", "isset", "isset", "empty", "l1vHPM99", "l1ICDfcF", "l1vHPM99", "isset", "empty", "empty", "l1ztqII", "l1ICDfcF", "isset", "isset", "l1nDw", "l1Sw", "l1vHPM99", "l1ztqII", "l1ICDfcF", "isset", "isset", "l1t", "isset", "empty", "l1t", "isset", "empty", "empty", "empty", "l1YctUf", "l1l", "l1t", "l1YctUf", "isset", "empty", "isset", "l1ArXq", "l1E", "empty", "isset", "empty", "empty", "isset", "empty", "isset", "empty", "l1LuaV", "l1LuaV", "empty", "isset", "empty", "l1ci", "l1E", "l1E", "l1ztqII", "l1ICDfcF", "l1ztqII", "l1ICDfcF", "l1vHPM99", "l1ztqII", "l1ICDfcF", "l1E", "l1E", "l1ztqII", "l1ICDfcF", "l1ztqII", "l1ICDfcF", "l1ICDfcF", "isset", "isset", "isset", "l1Gz5R", "l1F", "isset", "isset", "isset", "empty", "isset", "isset", "isset", "l10w", "l1vHPM99", "l1FrV", "l10", "l1ArXq", "l1ArXq", "empty", "empty", "empty", "l11vw2", "l1c46yT", "empty", "l1PYg12a", "l1DhIK", "l1RNMk", "l1ZZn0", "l1l", "l1B", "l19qv", "empty", "l1LuaV", "empty", "l1B", "l1JLj2", "empty", "l1hk4ndy", "empty", "l1LuaV", "l1JLj2", "l1akod", "l1B", "l1B", "empty", "l1JLj2", "empty", "l1Qrp" ], "ms": { "file": { "size": 48650.0 }, "text": { "digit_ratio": 0.2, "space_count": 113.0, "total_lines": 12.0, "char_entropy": 5.83, "unique_chars": 96.0, "escape_density": 0.04, "import_density": 1141.67, "lines_over_200": 3.0, "lines_over_500": 2.0, "string_density": 149.25, "avg_line_length": 4053.25, "lines_over_1000": 1.0, "max_line_length": 47747.0, "hex_escape_count": 20.0, "last_line_length": 47747.0, "long_token_count": 70.0, "most_common_char": "b", "whitespace_ratio": 0.0, "most_common_ratio": 0.07, "identifier_density": 212.58, "line_length_stddev": 13175.02, "encoded_string_ratio": 0.19, "normalized_import_count": 39.55, "normalized_string_count": 517.02, "suspicious_string_ratio": 0.0, "max_inline_whitespace_run": 1.0, "normalized_function_count": 9.24, "imports_to_functions_ratio": 4.28, "strings_to_functions_ratio": 55.97, "suspicious_identifier_ratio": 0.17, "normalized_unique_identifiers": 110.46, "identifiers_to_functions_ratio": 12.38 }, "imports": { "total": 137.0, "unique_modules": 38.0, "third_party_count": 137.0, "third_party_ratio": 1.0 }, "strings": { "total": 1791.0, "url_count": 3.0, "avg_length": 22.2, "max_length": 10752.0, "path_count": 57.0, "avg_entropy": 1.07, "email_count": 2.0, "hex_strings": 340.0, "total_bytes": 39755.0, "entropy_stddev": 0.89, "very_long_strings": 2.0, "high_entropy_count": 6.0, "shell_command_strings": 3.0, "unicode_heavy_strings": 1.0, "embedded_code_candidates": 2.0 }, "comments": {}, "functions": { "total": 32.0, "one_liners": 32.0, "avg_name_length": 5.5, "no_params_count": 32.0, "avg_length_lines": 1.0, "max_length_lines": 1.0, "min_length_lines": 1.0, "numeric_suffix_names": 3.0, "density_per_100_lines": 266.67, "code_in_functions_ratio": 2.67 }, "identifiers": { "total": 2551.0, "avg_length": 6.06, "max_length": 22.0, "min_length": 3.0, "avg_entropy": 2.36, "reuse_ratio": 0.16, "unique_count": 396.0, "length_stddev": 2.31, "hex_like_names": 5.0, "has_digit_ratio": 0.95, "base64_like_names": 64.0, "high_entropy_count": 2.0, "high_entropy_ratio": 0.01, "all_lowercase_ratio": 0.02, "all_uppercase_ratio": 0.03, "numeric_suffix_count": 54.0, "double_underscore_count": 1.0, "underscore_prefix_count": 5.0 } }, "ss": [ [ 7, "$\nyumingid=12\nlineid=1565\nx3=\nx4=AZvgrGSzJx\nx5=well,hippopotamus,learning,pastries,Shiver,Miner,waterpurifier,nature,circumstanc" ], [ 8, "$\nyumingid=12\nlineid=1565\nx3=\nx4=AZvgrGSzJx\nx5=well,hippopotamus,learning,pastries,Shiver,Miner,waterpurifier,nature,circumstanc" ], [ 924, "1l" ], [ 925, "1l" ], [ 929, "stnetnoc_teg_elif1letirwf1ltini_lruc1ledocedlru1llru_esrap1ltnuoc1ledocnelru1ltes_ini1lciremun_si1ltpotes_lruc1lroolf1lcexe_lruc" ], [ 930, "stnetnoc_teg_elif1letirwf1ltini_lruc1ledocedlru1llru_esrap1ltnuoc1ledocnelru1ltes_ini1lciremun_si1ltpotes_lruc1lroolf1lcexe_lruc" ], [ 1770, "//" ], [ 1771, "//" ], [ 1909, "9" ], [ 1910, "9" ], [ 1913, "b6bbbbbbb9bbb6bb66b9b66bbbb69bb6b66b669b66b6bb669bbb6bbb69bb666bb6b9bb66bb6bb9bb666bbb9b6bb6bbb9bb66b6bb9b6666bbb9b6b66b6bb9bb66" ], [ 1914, "b6bbbbbbb9bbb6bb66b9b66bbbb69bb6b66b669b66b6bb669bbb6bbb69bb666bb6b9bb66bb6bb9bb666bbb9b6bb6bbb9bb66b6bb9b6666bbb9b6b66b6bb9bb66" ], [ 2722, "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=$" ], [ 2723, "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=$" ], [ 2884, "b666b6666" ], [ 2885, "b666b6666" ], [ 2897, "/[^A-Za-z0-9\\+\\/\\=$]/" ], [ 2898, "/[^A-Za-z0-9\\+\\/\\=$]/" ], [ 2949, "b666bb6b" ], [ 2950, "b666bb6b" ], [ 2979, "bbb6b666" ], [ 2980, "bbb6b666" ], [ 3031, "b666bb6b" ], [ 3032, "b666bb6b" ], [ 3061, "bbb6b666" ], [ 3062, "bbb6b666" ], [ 3109, "b666bb6b" ], [ 3110, "b666bb6b" ], [ 3139, "bbb6b666" ], [ 3140, "bbb6b666" ], [ 3188, "b666bb6b" ], [ 3189, "b666bb6b" ], [ 3218, "bbb6b666" ], [ 3219, "bbb6b666" ], [ 3373, "bb666bb" ], [ 3374, "bb666bb" ], [ 3433, "bb666bb" ], [ 3434, "bb666bb" ], [ 3490, "bb666bb" ], [ 3491, "bb666bb" ], [ 3601, "b6b66bbbb" ], [ 3602, "b6b66bbbb" ], [ 3689, "bbbb66bb6" ], [ 3690, "bbbb66bb6" ], [ 3702, "//u" ], [ 3703, "//u" ], [ 3783, "bb666bb" ], [ 3784, "bb666bb" ], [ 3803, "bbbbb6b6" ], [ 3804, "bbbbb6b6" ], [ 3927, "b6bbbbbbb" ], [ 3928, "b6bbbbbbb" ], [ 3973, "b6b66b6b" ], [ 3974, "b6b66b6b" ], [ 14842, "bb6bbbb6" ], [ 14843, "bb6bbbb6" ], [ 14875, "b6b666bb" ], [ 14876, "b6b666bb" ], [ 14892, "K/@mJB3pOxjmNx8y" ], [ 14893, "K/@mJB3pOxjmNx8y" ], [ 14932, "oO0Oo0OO0" ], [ 14933, "oO0Oo0OO0" ], [ 14956, "b6bbbb6b" ], [ 14957, "b6bbbb6b" ], [ 14984, "bbb6bb66" ], [ 14985, "bbb6bb66" ], [ 15009, "b6666666b" ], [ 15010, "b6666666b" ], [ 15036, "bb666666b" ], [ 15037, "bb666666b" ], [ 15070, "bbb" ], [ 15071, "bbb" ], [ 15077, "\u003c" ], [ 15078, "\u003c" ], [ 15093, "bb66bb6bb" ], [ 15094, "bb66bb6bb" ], [ 15115, "b66b" ], [ 15116, "b66b" ], [ 15132, "bbbb6" ], [ 15133, "bbbb6" ], [ 15158, "bb6b666" ], [ 15159, "bb6b666" ], [ 15178, "bbbb6" ], [ 15179, "bbbb6" ], [ 15263, "." ], [ 15264, "." ], [ 15410, "DOCUMENT_ROOT" ], [ 15411, "DOCUMENT_ROOT" ], [ 15482, "b6bbbbb" ], [ 15483, "b6bbbbb" ], [ 15500, "w" ], [ 15501, "w" ], [ 15535, "bbb6bb66b" ], [ 15536, "bbb6bb66b" ], [ 15575, "b666b6b6b" ], [ 15576, "b666b6b6b" ], [ 15641, "bbbb66bb6" ], [ 15642, "bbbb66bb6" ], [ 15663, "b66b6bbb" ], [ 15664, "b66b6bbb" ], [ 15807, "b6b6b6666" ], [ 15808, "b6b6b6666" ], [ 15829, "b66" ], [ 15830, "b66" ], [ 15847, "b6b6b6666" ], [ 15848, "b6b6b6666" ], [ 15869, "b66b6" ], [ 15870, "b66b6" ], [ 15899, "b66bbbb6" ], [ 15900, "b66bbbb6" ], [ 15922, "b6bb6bbb" ], [ 15923, "b6bb6bbb" ], [ 15975, "b6bb6bbb" ], [ 15976, "b6bb6bbb" ], [ 16024, "bbb66" ], [ 16025, "bbb66" ], [ 16043, "b6bb6bbb" ], [ 16044, "b6bb6bbb" ], [ 16100, "b6bb6bbb" ], [ 16101, "b6bb6bbb" ], [ 16157, "b6bb6bbb" ], [ 16158, "b6bb6bbb" ], [ 16218, "b6666bbb" ], [ 16219, "b6666bbb" ], [ 16250, "b66bb6bbb" ], [ 16251, "b66bb6bbb" ], [ 16336, "b6b6b6666" ], [ 16337, "b6b6b6666" ], [ 16358, "bbbb" ], [ 16359, "bbbb" ], [ 16387, "bbbb" ], [ 16388, "bbbb" ], [ 16412, "b6b6b6666" ], [ 16413, "b6b6b6666" ], [ 16434, "bb6bb6bbb" ], [ 16435, "bb6bb6bbb" ], [ 16468, "bb6bb6bbb" ], [ 16469, "bb6bb6bbb" ], [ 16515, "b66b6bb66" ], [ 16516, "b66b6bb66" ], [ 16563, "host" ], [ 16564, "host" ], [ 16583, "port" ], [ 16584, "port" ], [ 16598, "port" ], [ 16599, "port" ], [ 16662, "path" ], [ 16663, "path" ], [ 16677, "path" ], [ 16678, "path" ], [ 16709, "query" ], [ 16710, "query" ], [ 16719, "?" ], [ 16720, "?" ], [ 16729, "query" ], [ 16730, "query" ], [ 16761, "/" ], [ 16762, "/" ], [ 16782, "bbb6bb66b" ], [ 16783, "bbb6bb66b" ], [ 16804, "GET $l1BmNY HTTP/1.0\\r\\nHost:" ], [ 16805, "GET " ], [ 16816, " HTTP/1.0" ], [ 16829, "Host:" ], [ 16842, "host" ], [ 16843, "host" ], [ 16850, "\\r\\nConnection:Close\\r\\n\\r\\n" ], [ 16855, "Connection:Close" ], [ 16909, "b6666b6b" ], [ 16910, "b6666b6b" ], [ 16950, "b666bb66" ], [ 16951, "b666bb66" ], [ 16987, "b666b6b6b" ], [ 16988, "b666b6b6b" ], [ 17027, "b6b666bb" ], [ 17028, "b6b666bb" ], [ 17048, "bbb6bbb" ], [ 17049, "bbb6bbb" ], [ 17077, "b666b6666" ], [ 17078, "b666b6666" ], [ 17090, "/.*?\\r\\n\\r\\n(.*)/si" ], [ 17091, "/.*?" ], [ 17103, "(.*)/si" ], [ 17112, "$1" ], [ 17113, "$1" ], [ 17135, "b666b6666" ], [ 17136, "b666b6666" ], [ 17157, "b6666b6" ], [ 17158, "b6666b6" ], [ 17168, "$1" ], [ 17169, "$1" ], [ 17222, "b6bbbbbbb" ], [ 17223, "b6bbbbbbb" ], [ 17262, "bb6bbbbb6" ], [ 17263, "bb6bbbbb6" ], [ 17284, "bb6bbbbb6" ], [ 17285, "bb6bbbbb6" ], [ 17305, "\\xEF\\xBB\\xBF" ], [ 17386, "bb6bbbbb6" ], [ 17387, "bb6bbbbb6" ], [ 17425, "bb6bbbbb6" ], [ 17426, "bb6bbbbb6" ], [ 17507, "b6b66bbbb" ], [ 17508, "b6b66bbbb" ], [ 17547, "bb66b6bb" ], [ 17548, "bb66b6bb" ], [ 17668, "b66bb666" ], [ 17669, "b66bb666" ], [ 17907, "bb666bbb" ], [ 17908, "bb666bbb" ], [ 17984, "bbb66b6" ], [ 17985, "bbb66b6" ], [ 18088, "bb666b" ], [ 18089, "bb666b" ], [ 18107, "b6bbb6" ], [ 18108, "b6bbb6" ], [ 18126, "b66b6bbbb" ], [ 18127, "b66b6bbbb" ], [ 18148, "bb6" ], [ 18149, "bb6" ], [ 18164, "bbb6" ], [ 18165, "bbb6" ], [ 18181, "b666" ], [ 18182, "b666" ], [ 18198, "b6b6" ], [ 18199, "b6b6" ], [ 18206, "oo" ], [ 18207, "oo" ], [ 18245, "bb6b66b6" ], [ 18246, "bb6b66b6" ], [ 18266, "b66bb" ], [ 18267, "b66bb" ], [ 18291, "b6b666bb" ], [ 18292, "b6b666bb" ], [ 18303, "/($l1IrjCFS)/si" ], [ 18304, "/(" ], [ 18315, ")/si" ], [ 18376, "b6b666bb" ], [ 18377, "b6b666bb" ], [ 18397, "bb" ], [ 18398, "bb" ], [ 18412, "b6" ], [ 18413, "b6" ], [ 18427, "b6b66b66" ], [ 18428, "b6b66b66" ], [ 18448, "b6b6666b6" ], [ 18449, "b6b6666b6" ], [ 18470, "b6bb6b" ], [ 18471, "b6bb6b" ], [ 18489, "b6bbb" ], [ 18490, "b6bbb" ], [ 18739, "b666b6666" ], [ 18740, "b666b6666" ], [ 18761, "bb6bbbb" ], [ 18762, "bb6bbbb" ], [ 18781, "b6b" ] ], "sz": 48650, "ts": [ { "c": 0.800000011920929, "d": "Very short file (under 12 lines)", "e": [ "text.total_lines = 12.00" ], "i": "metadata/file/text/metrics::file-under-12-lines", "l": 1 }, { "d": "catch handler keyword", "e": [ "catch" ], "i": "metadata/package/error-handling::catch-keyword", "l": 2 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Last line is over 1000 chars", "e": [ "text.last_line_length = 47747.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::last-line-over-1000", "l": 1, "m": "B0032" }, { "a": "T1505.003", "c": 0.949999988079071, "d": "Retrieves web server document root path", "e": [ "$_SERVER[\"DOCUMENT_ROOT\"]" ], "i": "objectives/command-and-control/backdoor/webshell/stager::php-document-root-access", "l": 4 }, { "c": 0.8999999761581421, "d": "Very long line", "e": [ "text.max_line_length = 47747.00" ], "i": "metadata/file/text/metrics::single-long-line", "l": 1 }, { "c": 0.75, "d": "HTTP protocol version strings", "e": [ "HTTP/1.0" ], "i": "micro-behaviors/communications/http/request/client::http-versions", "l": 1 }, { "a": "T1505.003", "c": 1.0, "d": "Inequality check in WordPress user list", "e": [ "!=" ], "i": "objectives/command-and-control/backdoor/webshell/hide::wp-user-hiding-not-trait", "l": 1, "m": "B0030" }, { "c": 0.75, "d": "Generic $_SERVER superglobal access", "e": [ "$_SERVER" ], "i": "micro-behaviors/communications/http/request/params::server-dup", "l": 3 }, { "c": 0.75, "d": "Session variable access ($_SESSION)", "e": [ "$_SESSION" ], "i": "micro-behaviors/communications/http/request/params::session", "l": 3 }, { "a": "T1505.003", "c": 0.8500000238418579, "d": "PHP request superglobal access", "e": [ "$_POST" ], "i": "objectives/command-and-control/backdoor/webshell/upload::php-request-variadic-function-call", "l": 3, "m": "B0030" }, { "c": 0.6000000238418579, "d": "Miner string (title case)", "e": [ "Miner" ], "i": "objectives/impact/cryptojacking/miner/context::miner-title", "l": 3 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Exactly one line exceeds 1000 chars", "e": [ "text.lines_over_1000 = 1.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::single-long-line-outlier", "l": 1, "m": "B0032" }, { "a": "T1027.003", "c": 0.8999999761581421, "d": "Node.js require call in non-code file", "e": [ "require(" ], "i": "objectives/anti-static/obfuscation/payload/container::js-require-in-noncode", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "HOST" ], "i": "objectives/anti-static/obfuscation/payload/config::url-component-concat--rx-12", "l": 1, "m": "B0032" }, { "a": "T1082", "d": "References PHP_VERSION constant", "e": [ "PHP_VERSION" ], "i": "objectives/discovery/system/fingerprint/info::php-version-constant", "l": 2, "m": "E1082" }, { "a": "T1584", "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "\u003c/urlset\u003e" ], "i": "objectives/command-and-control/dropper/delivery/seo-spam::php-seo-cloaking--rx-1", "l": 1 }, { "a": "T1027", "c": 0.9399999976158142, "d": "Architecture keyed encoded blob value", "e": [ "\"b6bbbbbbb9bbb6bb66b9b66bbbb69bb6b66b669b66b6bb669bbb6bbb69bb666bb6b9bb66bb6bb9bb666bbb9b6bb6bbb9bb66b6bb9b6666bbb9b6b66b6bb9bb6" ], "i": "objectives/anti-static/obfuscation/payload/config::arch-keyed-hex-blob-dict--encoded-value", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "PHP error suppression operator usage", "e": [ "@$GLOBALS[\"bbb66b66\"]($l15mz5be,0755)", "@$GLOBALS[\"bb6b666\"]($GLOBALS[\"bbbb6\"])", "@$GLOBALS[\"bb6bbbb6\"]($b6bbbb66b)", "@$GLOBALS[\"bbb66b66\"]($l1T,0444)", "@$GLOBALS[\"bb66bb6bb\"]($GLOBALS[\"b66b\"],$GLOBALS[\"bbbb6\"])", "@$GLOBALS[\"b6b6666bb\"]($l15mz5be)", "@'$\nyumingid=12\nlineid=1565\nx3=\nx4=AZvgrGSzJx\nx5=well,hippopotamus,learning,pastries,Shiver,Miner,wa...", "@$GLOBALS[\"b6666666b\"]()", "@$GLOBALS[\"bbb6bb66\"](1)", "@$GLOBALS[\"b6bbbbb\"]($l1W0Z,'w')", "@$GLOBALS[\"b6b66b6b\"](l1yK(\"XSnxLyH5d2L5NSnhXlH1XlH1MlH1HisyNiD1NhIgaUE4TF0qUEgVX/4XTCv7HisyNif5HlIh...", "@$GLOBALS[\"bbb66b66\"]($l1T,0777)", "@$GLOBALS[\"b6b6b66\"]($l11J5qm,$GLOBALS[\"b66bb6bb6\"]($GLOBALS[\"b6b66bbb6\"].$GLOBALS[\"bb66bbb6\"]))", "@$GLOBALS[\"b6bbbbbbb\"]($l1T)", "@$GLOBALS[\"b6bbbb6b\"](7200)", "@$GLOBALS[\"bbb66b66\"]($l1F)" ], "i": "micro-behaviors/os/stdio::error-suppress-prefix", "l": 3 }, { "c": 0.8600000143051147, "d": "Regex component marker", "e": [ "$_SERVER[" ], "i": "objectives/command-and-control/backdoor/webshell/ui::self-named-get-form--rx-4", "l": 1, "m": "B0030" }, { "a": "T1071.001", "d": "HTTP/1.x version string", "e": [ "HTTP/1." ], "i": "micro-behaviors/communications/http/request/client::http-version", "l": 2, "m": "C0002" }, { "a": "T1071", "c": 0.6000000238418579, "d": "URL with .php endpoint", "e": [ "http://ctuan07.sj||fsif573uwt/weilai.php" ], "i": "objectives/command-and-control/infrastructure/domain/tld::php-endpoint-url", "l": 1 }, { "a": "T1505.003", "c": 0.8399999737739563, "d": "Near-zero whitespace script", "e": [ "text.whitespace_ratio = 0.00" ], "i": "objectives/command-and-control/backdoor/webshell/stager::near-zero-whitespace", "l": 1 }, { "a": "T1059", "c": 0.800000011920929, "d": "Self-reference via __FILE__", "e": [ "__FILE__" ], "i": "micro-behaviors/fs/read/self::self-file-reference", "l": 3 }, { "a": "T1505.003", "c": 0.4000000059604645, "d": "PHP $_POST parameter access", "e": [ "$_POST[" ], "i": "objectives/command-and-control/backdoor/webshell/request::php-post", "l": 1, "m": "B0030" }, { "a": "T1505.003", "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "ecalper_gerp" ], "i": "objectives/command-and-control/backdoor/webshell/decoder::reversed-dangerous-php--rx-7", "l": 1, "m": "B0030" }, { "a": "T1505.003", "c": 0.4000000059604645, "d": "PHP $_GET parameter access", "e": [ "$_GET[" ], "i": "objectives/command-and-control/backdoor/webshell/request::php-get", "l": 1, "m": "B0030" }, { "a": "T1505.003", "d": "PHP open tag", "e": [ "\u003c?php" ], "i": "objectives/command-and-control/backdoor/webshell/request::php-tag", "l": 1, "m": "B0030" }, { "a": "T1059", "c": 0.8500000238418579, "d": "HTTP GET parameter access ($_GET)", "e": [ "$_GET" ], "i": "micro-behaviors/communications/http/request/params::get-dup", "l": 3 }, { "c": 0.800000011920929, "d": "PHP variable function invocation pattern", "e": [ "l1K1x5ID" ], "i": "objectives/anti-static/obfuscation/imports::dynamic-function-execution", "l": 3 }, { "c": 0.8999999761581421, "d": "HTTP protocol prefix", "e": [ "http://" ], "i": "micro-behaviors/communications/http/protocol::http-prefix", "l": 2 }, { "a": "T1027", "c": 0.75, "d": "Many no-param functions", "e": [ "functions.no_params_count = 32.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/functions::many-no-param-functions", "l": 2, "m": "B0032" }, { "a": "T1505.003", "c": 0.8600000143051147, "d": "Very long embedded string", "e": [ "strings.max_length = 10752.00" ], "i": "objectives/command-and-control/backdoor/webshell/stager::very-long-string", "l": 1 }, { "c": 0.8999999761581421, "d": "HTTP/1.0 protocol version", "e": [ " HTTP/1.0", "GET $l1BmNY HTTP/1.0\\r\\nHost:" ], "i": "micro-behaviors/communications/http/protocol::http-1-0-header", "l": 2 }, { "c": 0.8199999928474426, "d": "Regex component marker", "e": [ "Water" ], "i": "objectives/discovery/system/ics-environment/register::ics-register-flow-rate--rx-79", "l": 1 }, { "a": "T1059", "c": 0.8500000238418579, "d": "HTTP POST parameter access ($_POST)", "e": [ "$_POST" ], "i": "micro-behaviors/communications/http/request/params::post-dup", "l": 3 }, { "a": "T1027.010", "d": "Hardcoded standard base64 alphabet", "e": [ "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" ], "i": "micro-behaviors/data/encode/base64::alphabet-standard", "l": 2, "m": "B0032.001" }, { "a": "T1027", "c": 0.699999988079071, "d": "Very low whitespace ratio (minified/compressed)", "e": [ "text.whitespace_ratio = 0.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::low-whitespace", "l": 2, "m": "B0032" }, { "a": "T1027", "c": 0.75, "d": "Many short functions (deobfuscation layers)", "e": [ "functions.one_liners = 32.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/identifiers::php-many-short-functions", "l": 4, "m": "B0032" }, { "c": 0.8500000238418579, "d": "Checks User-Agent for crawler detection", "e": [ "$_SERVER[\"HTTP_USER_AGENT\"]" ], "i": "objectives/anti-analysis/browser-detect::check-ua-server-var", "l": 3 }, { "a": "T1046", "c": 0.6000000238418579, "d": "HTTP port number (80)", "e": [ "port\"])?$l1hI[\"port\"]:80" ], "i": "objectives/discovery/network/scan/port::port-number-http", "l": 1, "m": "E1046" }, { "c": 0.6000000238418579, "d": "Very long base64 strings present", "e": [ "b6bbbbbbb9bbb6bb66b9b66bbbb69bb6b66b669b66b6bb669bbb6bbb69bb666bb6b9bb66bb6bb9bb666bbb9b6bb6bbb9bb66b6bb9b6666bbb9b6b66b6bb9bb66" ], "i": "objectives/anti-static/obfuscation/string/base64::long-base64-in-strings", "l": 3 }, { "a": "T1071.001", "c": 0.6499999761581421, "d": "bind to HTTP port 80", "e": [ "port\"])?$l1hI[\"port\"]:80" ], "i": "micro-behaviors/communications/http/server/listener::bind-port-80", "l": 3, "m": "C0002" }, { "a": "T1082", "c": 0.6000000238418579, "d": "Accesses DOCUMENT_ROOT variable", "e": [ "$_SERVER[\"DOCUMENT_ROOT\"]" ], "i": "objectives/discovery/system/fingerprint/info::document-root-access", "l": 3, "m": "E1082" }, { "c": 0.699999988079071, "d": "AJAX request handler pattern", "e": [ "$_GET[$l1RRPwB]", "$_GET[$l1j2]", "$_GET[$l1M]", "$_GET[$l1sKs]", "$_GET[$l1zmSDcX]", "$_POST[$l1Fy7]", "$_GET[$l1K9]", "$_GET[$l1h]", "$_GET[$l1p2raRI]", "$_GET[\"html\"]", "$_GET[\"list_test\"]", "$_GET[$l1AB5Cc]" ], "i": "objectives/command-and-control/backdoor/webshell/ui::ajax-handler", "l": 4, "m": "B0030" }, { "a": "T1027", "c": 0.8500000238418579, "d": "High function density", "e": [ "functions.density_per_100_lines = 266.67" ], "i": "objectives/anti-static/obfuscation/code-metrics/functions::high-function-density", "l": 2, "m": "B0032" }, { "a": "T1082", "d": "Accesses SERVER_NAME variable", "e": [ "$_SERVER[\"SERVER_NAME\"]" ], "i": "objectives/discovery/system/fingerprint/info::server-name-access", "l": 3, "m": "E1082" }, { "a": "T1082", "c": 0.699999988079071, "d": "Accesses SERVER_SOFTWARE variable", "e": [ "$_SERVER[\"SERVER_SOFTWARE\"]" ], "i": "objectives/discovery/system/fingerprint/info::server-software-access", "l": 3, "m": "E1082" }, { "a": "T1027", "c": 0.8999999761581421, "d": "PHP source contains very long line", "e": [ "text.max_line_length = 47747.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/identifiers::php-single-long-line", "l": 4, "m": "B0032" }, { "a": "T1027", "c": 0.699999988079071, "d": "Many one-line source function definitions", "e": [ "functions.one_liners = 32.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/functions::many-one-liner-functions", "l": 3, "m": "B0032" }, { "a": "T1027", "c": 0.800000011920929, "d": "High overall text entropy (encoded", "e": [ "text.char_entropy = 5.83" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::high-text-entropy", "l": 2, "m": "B0032" }, { "a": "T1027", "c": 0.8999999761581421, "d": "Minified/compressed code (multiple indicators)", "e": [ "text.whitespace_ratio = 0.00", "functions.density_per_100_lines = 266.67", "functions.one_liners = 32.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::minified-code", "l": 2, "m": "B0032" }, { "c": 1.0, "d": "php code embedded in string", "e": [ "Detected php at offset 0x0" ], "i": "metadata/lang/embedded::php", "l": 2 }, { "c": 0.8999999761581421, "d": "Decoded unicode-escape content", "e": [ "';$bbbbb6bbb=explode(\"1l\",\"stnetnoc_teg_ \u003cunicode-escape\u003e" ], "i": "metadata/encoded-payload/unicode-escape", "l": 2 }, { "c": 0.8999999761581421, "d": "Webshell which sends eval/assert via GET", "e": [ "$_POST[$l1Fy7])){$GLOBALS[\"b6666bb6b\"]($_POST[" ], "i": "third_party/SigBase/WEBSHELL/PHP/Function/Via/Get", "l": 5 } ], "sha": "483ac632585dfb551a439a81f176ba494f7e3e48dfb0f08220874c9517dc3757", "path": "/data/samples/bad/datasets/kaker-scripts/php/72398833bc9aa459cf60c5895ff3c956", "type": "php" } ], "tv": "bef72" } }