{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9999823570251465, "class": 2 } ], "prob": 0.99998236, "class": 2, "models": [ { "m": "az", "prob": 0.9982551, "class": 1 }, { "m": "az/scripts", "prob": 0.9999809, "class": 2 }, { "m": "az/php", "prob": 0.99998236, "class": 2 } ], "version": "v16.16", "thresholds": [ 0.9961138, 0.99909174 ], "analyzed_at": "2026-05-09T15:05:48Z" }, "path": "182a773134549545f5aad1dc34c3fb90", "raw": { "v": "4", "fs": [ { "f": "O₃(AsC₅La)H₅(Po₂CmFOsDb₃)Md₂(Pt)Th", "k": { "source.imports[0]": "TC9A16C47DA8EEE87", "source.imports[1]": "base64_decode", "source.imports[2]": "count", "source.imports[3]": "die", "source.imports[4]": "eval", "source.imports[5]": "file_get_contents", "source.imports[6]": "function_exists", "source.imports[7]": "implode", "source.imports[8]": "isset", "source.imports[9]": "ord", "source.strings[0]": "\r\n \u003c/td\u003e\u003c/tr\u003e\u003c/table\u003e\r\n \u003c/td\u003e\u003c/tr\u003e\u003c/table\u003e\r\n ", "source.strings[1]": "\r\n \u003ctitle\u003eBy FAHMI\u003c/title\u003e\r\n \u003ccenter\u003e\r\n \u003ctable border=0 cellpadding=0 cellspacing=0 width=100% height=100%\u003e\r\n \u003ctr\u003e\u003ctd valign=middle align=center\u003e\r\n \u003ctable width=100 bgcolor=silver border=6 bordercolor=green\u003e\u003ctr\u003e\u003ctd\u003e\r\n \u003cfont size=1 face=verdana\u003e\u003ccenter\u003e\r\n \u003cb\u003e\u003c/font\u003e\u003c/a\u003e\u003cbr\u003e\u003c/b\u003e\r\n \u003c/center\u003e\r\n \u003cform method=post\u003e\r\n \u003cfont size=1 face=verdana color=green\u003e\u003cstrong\u003e\u003ccenter\u003e~ HELLO NIGGA ~\u003c/center\u003e\u003c/strong\u003e\u003cbr\u003e\r\n \u003cinput type=password name=pass size=30\u003e\r\n \u003c/form\u003e\r\n \u003cb\u003eYOUR IP ==\u003e \u0026nbsp;\u003c/b\u003e ", "source.strings[2]": "/(print|sprint|echo)/", "source.strings[3]": "LyhwcmludHxzcHJpbnR8ZWNobykv", "source.strings[4]": "REMOTE_ADDR", "source.strings[5]": "TC9A16C47DA8EEE87", "source.has_imports": true, "source.imports[10]": "preg_match", "source.imports[11]": "session_start", "source.imports[12]": "set_time_limit", "source.imports[13]": "strlen", "source.functions[0]": "TC9A16C47DA8EEE87" }, "x": 212, "id": 0, "is": [ "session_start", "set_time_limit", "isset", "die", "function_exists", "base64_decode", "ord", "ord", "strlen", "file_get_contents", "preg_match", "base64_decode", "count", "ord", "ord", "ord", "ord", "ord", "ord", "ord", "implode", "eval", "TC9A16C47DA8EEE87" ], "ms": { "file": { "size": 43627.0 }, "text": { "digit_ratio": 0.12, "space_count": 91.0, "total_lines": 43.0, "char_entropy": 5.92, "unique_chars": 90.0, "import_density": 53.49, "lines_over_200": 1.0, "lines_over_500": 1.0, "string_density": 0.63, "avg_line_length": 1012.58, "lines_over_1000": 1.0, "max_line_length": 42700.0, "empty_line_ratio": 0.14, "last_line_length": 2.0, "long_token_count": 4.0, "most_common_char": "A", "whitespace_ratio": 0.0, "most_common_ratio": 0.06, "identifier_density": 2.88, "line_length_stddev": 6432.54, "encoded_string_ratio": 0.15, "normalized_import_count": 3.51, "normalized_string_count": 4.12, "max_inline_whitespace_run": 2.0, "normalized_function_count": 0.15, "trailing_whitespace_lines": 1.0, "imports_to_functions_ratio": 23.0, "strings_to_functions_ratio": 27.0, "normalized_unique_identifiers": 5.9, "identifiers_to_functions_ratio": 32.0 }, "imports": { "total": 23.0, "unique_modules": 14.0, "third_party_count": 23.0, "third_party_ratio": 1.0 }, "strings": { "total": 27.0, "avg_length": 3025.81, "max_length": 40224.0, "avg_entropy": 2.53, "total_bytes": 81697.0, "entropy_stddev": 1.7, "base64_candidates": 4.0, "very_long_strings": 2.0, "high_entropy_count": 2.0 }, "comments": { "chars": 41.0, "lines": 2.0, "total": 2.0, "to_code_ratio": 0.05 }, "functions": { "total": 1.0, "one_liners": 1.0, "avg_name_length": 17.0, "no_params_count": 1.0, "avg_length_lines": 1.0, "max_length_lines": 1.0, "min_length_lines": 1.0, "density_per_100_lines": 2.33, "code_in_functions_ratio": 0.02 }, "identifiers": { "total": 124.0, "avg_length": 11.5, "max_length": 17.0, "min_length": 3.0, "avg_entropy": 2.81, "reuse_ratio": 0.26, "unique_count": 32.0, "length_stddev": 5.35, "has_digit_ratio": 0.41, "high_entropy_count": 1.0, "high_entropy_ratio": 0.03, "all_lowercase_ratio": 0.47, "all_uppercase_ratio": 0.13, "numeric_suffix_count": 10.0, "double_underscore_count": 1.0, "underscore_prefix_count": 4.0 } }, "ss": [ [ 93, "pass" ], [ 94, "pass" ], [ 135, "123 " ], [ 136, "123 " ], [ 208, "nst" ], [ 209, "nst" ], [ 217, "$pass" ], [ 280, "nst" ], [ 281, "nst" ], [ 301, "nst" ], [ 302, "nst" ], [ 332, "\r\n \u003ctitle\u003eBy FAHMI\u003c/title\u003e\r\n \u003ccenter\u003e\r\n \u003ctable border=0 cellpadding=0 cellspacing=0 width=100% height=100%\u003e\r\n \u003ctr\u003e\u003ctd valign" ], [ 333, "\r\n \u003ctitle\u003eBy FAHMI\u003c/title\u003e\r\n \u003ccenter\u003e\r\n \u003ctable border=0 cellpadding=0 cellspacing=0 width=100% height=100%\u003e\r\n \u003ctr\u003e\u003ctd valign" ], [ 842, "REMOTE_ADDR" ], [ 843, "REMOTE_ADDR" ], [ 857, "\r\n \u003c/td\u003e\u003c/tr\u003e\u003c/table\u003e\r\n \u003c/td\u003e\u003c/tr\u003e\u003c/table\u003e\r\n " ], [ 858, "\r\n \u003c/td\u003e\u003c/tr\u003e\u003c/table\u003e\r\n \u003c/td\u003e\u003c/tr\u003e\u003c/table\u003e\r\n " ], [ 939, "TC9A16C47DA8EEE87" ], [ 940, "TC9A16C47DA8EEE87" ], [ 1465, "LyhwcmludHxzcHJpbnR8ZWNobykv" ], [ 1466, "LyhwcmludHxzcHJpbnR8ZWNobykv" ], [ 2938, "?" ], [ 2939, "?" ], [ 2942, "\u003e" ], [ 2943, "\u003e" ], [ 918, "base64", "/(print|sprint|echo)/" ] ], "sz": 43627, "ts": [ { "c": 0.8500000238418579, "d": "Removes PHP script execution time limit", "e": [ "@set_time_limit(0)" ], "i": "objectives/command-and-control/backdoor/webshell/session::unlimited-runtime-call", "l": 4 }, { "a": "T1505.003", "c": 0.8399999737739563, "d": "Near-zero whitespace script", "e": [ "text.whitespace_ratio = 0.00" ], "i": "objectives/command-and-control/backdoor/webshell/stager::near-zero-whitespace", "l": 1 }, { "d": "password keyword", "e": [ "password" ], "i": "micro-behaviors/data/text/keywords/lexicon::password", "l": 1 }, { "a": "T1505.003", "c": 0.8600000143051147, "d": "Very long embedded string", "e": [ "strings.max_length = 40224.00" ], "i": "objectives/command-and-control/backdoor/webshell/stager::very-long-string", "l": 1 }, { "a": "T1059.006", "c": 0.75, "d": "PHP eval() token present", "e": [ "eval" ], "i": "micro-behaviors/process/interpreter/eval::eval-symbol", "l": 4, "m": "E1059" }, { "c": 0.75, "d": "Generic $_SERVER superglobal access", "e": [ "$_SERVER" ], "i": "micro-behaviors/communications/http/request/params::server-dup", "l": 3 }, { "c": 0.8600000143051147, "d": "Regex component marker", "e": [ "$_SERVER[" ], "i": "objectives/command-and-control/backdoor/webshell/ui::self-named-get-form--rx-4", "l": 1, "m": "B0030" }, { "a": "T1505.003", "c": 0.4000000059604645, "d": "PHP $_POST[...] superglobal access", "e": [ "$_POST[" ], "i": "objectives/command-and-control/backdoor/webshell/request::php-post", "l": 1, "m": "B0030" }, { "c": 0.8999999761581421, "d": "File has 30 or more lines", "e": [ "text.total_lines = 43.00" ], "i": "metadata/file/text/metrics::file-has-30-plus-lines", "l": 1 }, { "c": 0.75, "d": "Session variable access ($_SESSION)", "e": [ "$_SESSION" ], "i": "micro-behaviors/communications/http/request/params::session", "l": 3 }, { "a": "T1505.003", "c": 0.9399999976158142, "d": "file_get_contents (raw POST body reader)", "e": [ "file_get_contents" ], "i": "objectives/command-and-control/backdoor/webshell/request::raw-json-post-cmd-field--rx-7", "l": 1, "m": "B0030" }, { "a": "T1027", "c": 0.8999999761581421, "d": "Exactly one line exceeds 1000 chars", "e": [ "text.lines_over_1000 = 1.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::single-long-line-outlier", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "PHP error suppression operator usage", "e": [ "@$pass = $_POST['pass']", "@session_start()", "@set_time_limit(0)" ], "i": "micro-behaviors/os/stdio::error-suppress-prefix", "l": 3 }, { "a": "T1027.010", "d": "Custom base64 decode lookup table", "e": [ "$T77605D5F26DD5248+$" ], "i": "micro-behaviors/data/encode/base64::decode-table", "l": 2, "m": "B0032.001" }, { "a": "T1505.003", "c": 0.8999999761581421, "d": "PHP source imports base64_decode", "e": [ "[TC9A16C47DA8EEE87, base64_decode, count, die, eval, file_get_contents, function_exists, implode, isset, ord, preg_match, sessio" ], "i": "objectives/command-and-control/backdoor/webshell/stager::source-import-base64-decode", "l": 1 }, { "c": 0.949999988079071, "d": "PHP open tag (\u003c?php)", "e": [ "\u003c?php" ], "i": "metadata/lang/scripted::php-open-tag", "l": 1 }, { "c": 0.8399999737739563, "d": "\"password\" string-literal token", "e": [ "\r\n \u003ctitle\u003eBy FAHMI\u003c/title\u003e\r\n \u003ccenter\u003e\r\n \u003ctable border=0 cellpadding=0 cellspacing=0 width=100% height=100%\u003e\r\n \u003ctr\u003e\u003ctd valign" ], "i": "micro-behaviors/data/text/llm/action::llm-send-action--rx-6", "l": 1 }, { "a": "T1505.003", "c": 0.8500000238418579, "d": "PHP request superglobal access", "e": [ "$_POST" ], "i": "objectives/command-and-control/backdoor/webshell/upload::php-request-variadic-function-call", "l": 3, "m": "B0030" }, { "c": 0.8399999737739563, "d": "password/token/api_key field keyword", "e": [ "password" ], "i": "micro-behaviors/data/text/keywords/credential::credential-field", "l": 1 }, { "c": 0.8399999737739563, "d": "\"password\" doc-context token", "e": [ "\r\n \u003ctitle\u003eBy FAHMI\u003c/title\u003e\r\n \u003ccenter\u003e\r\n \u003ctable border=0 cellpadding=0 cellspacing=0 width=100% height=100%\u003e\r\n \u003ctr\u003e\u003ctd valign" ], "i": "micro-behaviors/data/text/llm/action::llm-send-action-cond-4--inline-11750", "l": 1 }, { "c": 0.8999999761581421, "d": "Very long line", "e": [ "text.max_line_length = 42700.00" ], "i": "metadata/file/text/metrics::single-long-line", "l": 1 }, { "c": 0.8600000143051147, "d": "Regex component marker", "e": [ "method=" ], "i": "objectives/command-and-control/backdoor/webshell/ui::self-named-get-form--rx-3", "l": 1, "m": "B0030" }, { "a": "T1059", "c": 0.800000011920929, "d": "Self-reference via __FILE__", "e": [ "__FILE__" ], "i": "micro-behaviors/fs/read/self::self-file-reference", "l": 3 }, { "a": "T1059", "c": 0.8500000238418579, "d": "HTTP POST parameter access ($_POST)", "e": [ "$_POST" ], "i": "micro-behaviors/communications/http/request/params::post-dup", "l": 3 }, { "a": "T1027", "c": 0.800000011920929, "d": "High overall text entropy (encoded", "e": [ "text.char_entropy = 5.92" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::high-text-entropy", "l": 2, "m": "B0032" }, { "a": "T1027", "c": 0.699999988079071, "d": "Very low whitespace ratio (minified/compressed)", "e": [ "text.whitespace_ratio = 0.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::low-whitespace", "l": 2, "m": "B0032" }, { "c": 0.699999988079071, "d": "Remove execution time limit", "e": [ "set_time_limit" ], "i": "micro-behaviors/process/control/signal::set-time-limit", "l": 3 }, { "c": 0.75, "d": "Inline password token in lure", "e": [ "password = \"123" ], "i": "objectives/lateral-movement/social-engineering/lures::inline-password-token", "l": 1 }, { "c": 0.699999988079071, "d": "AJAX request handler pattern", "e": [ "$_POST['pass']" ], "i": "objectives/command-and-control/backdoor/webshell/ui::ajax-handler", "l": 4, "m": "B0030" }, { "a": "T1027", "c": 0.8999999761581421, "d": "PHP source contains very long line", "e": [ "text.max_line_length = 42700.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/identifiers::php-single-long-line", "l": 4, "m": "B0032" }, { "c": 1.0, "d": "php code embedded in string", "e": [ "Detected php at offset 0x0" ], "i": "metadata/lang/embedded::php", "l": 2 }, { "c": 0.8999999761581421, "d": "php webshell containing base64 encoded payload", "e": [ "cG9wZW", "\u003c?", "\u003c?php", "V4ZW", "base64_decode", "wb3Blb", "ZXZhb", "N5c3Rlb", "ZXhlY", "zeXN0ZW", "V4ZWN1" ], "i": "third_party/SigBase/WEBSHELL/PHP/Base64/Encoded/Payloads", "l": 5 }, { "c": 0.8999999761581421, "d": "PHP webshell using $a($code) for kind of eval with encoded blob to decode, e.g. b374k", "e": [ "eval(", "\u003c?php", "ase6", "$password = ", "++;$", "\u003c?" ], "i": "third_party/SigBase/WEBSHELL/PHP/Dynamic/Big", "l": 5 }, { "c": 0.8999999761581421, "d": "PHP webshell using some kind of eval with encoded blob to decode, which is checked with YARAs math.entropy module", "e": [ "\u003c?php", "\u003c?", "eval(T" ], "i": "third_party/SigBase/WEBSHELL/PHP/Encoded/Big", "l": 5 } ], "sha": "526141b656f723db9b885480eb167e18a905a0e804defd5925a1066b31f22345", "path": "182a773134549545f5aad1dc34c3fb90", "type": "php" } ], "tv": "0a4d2" } }