{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 0.9999908208847046,
        "class": 2
      }
    ],
    "prob": 0.9999908,
    "class": 2,
    "models": [
      {
        "m": "az",
        "prob": 0.9974299,
        "class": 1
      },
      {
        "m": "az/scripts",
        "prob": 0.9999124,
        "class": 2
      },
      {
        "m": "az/php",
        "prob": 0.9999908,
        "class": 2
      }
    ],
    "version": "v16.16",
    "thresholds": [
      0.9961138,
      0.99909174
    ],
    "analyzed_at": "2026-05-10T03:09:07Z"
  },
  "path": "plugin.txt",
  "raw": {
    "v": "4",
    "fs": [
      {
        "f": "O(As₂)H(Po)Md₂Th",
        "k": {
          "source.imports[0]": "strrev",
          "source.strings[0]": "7RpdbxvH8d2A/8P6wvhIhJ+iZFsij07hyHFQp3Zip2grCcSRtxQPIu/Od0tTqqAf0wZojLZG4lhNk9pOUtstHKOwDThIWsAw8mD0JWgfEqAtkqbozH7cB3mkqKRB+1BDBu92ZmdmZ2ZnZ2bv4AHq+67f9Knn+sx21rPlXO3ggS41LepntROuw6jDCmzLo0uMbrJSl/V7tXbX9APKjPXWXLUyp+Vq5OCBjGcGwdD1LWIQrb3QthbnjxypVjrmYnkO/lfac/PV8sJCtbp49NgxDXhk+hRRu4x5S6WSVlynwOpiVjt1/vzZ5qkz585ruWKmeW755e8vv7yinz11Fp5Pn9TXcGrbdTds6piChLdJfaRod7J2AHJlM82zMH9FR5H0tVxuG6aYgEmtpje0RsFiJiIYJFxFbhsICTbZGLs8yZh5wuw+zeaema/OlUFdOwcPlEpKY6fdtsls11kiXaYVNVwb/JSsolaMkSnqRbZR0ou6XfS63vGhoc+8/KJ+2AP08TWMSwAs+xRBO3yFh2jfY1vZaInk8GFySGnsxJkz331heSUm5FqOuD5JB5FDcV2hgj3fdhjR6sxs9ShpwTD1jTIZ2hbrGpVy+WnSpfZ6l/HnRp1Z5KLZs9cdY1Xr25bVo6tao94GZ6N+o95x/T4x27gMgPN1FLVVjfQp67oWDOHicYLteANG0D1hUMmDiOZmjzrrwHpVq87BAEotUUbmBYNW32aNegmZNtCPLLA5N2vMoZ5fRmWDplFp0Sv6jNZz190B01ALodOQpNdomvIaUiDSb6aYLMn75eWXXllGY1u2z9253YWn7MDvWbTtWjQFJU36jt2jfDpIxrc17Ig4jThSbYfQXkBJHFe5nECRHKhP17N6Sc/71Ox5JutmwatzuRzM9CgPBgCMqKmx1VV90iIvyB0bDG3W7pJREAFQ2wRiuuUOHS7LEhIi6YtF9Ay+yGDRgqn4mFULQzuECE3b6bgYKDa9HioF1gI7XkFDVAiEqI/ErJW2O3CAfWIwV6isRXbWE+GUmJ7Xs4XhS5sF2NKSdC5lxnN24LmBLZzEZMxsd/swXiOKnSHni+iip9KgQdu3PUEDAgp5njrUNxm1yHMmM1PnnOabaInoRSQe2D+OKQ7xnwWzWwga9Z+DB+imzdDGLUDZqCmjDbzIZKHFTr5wevncCsB6LrC3BI0VHdeiwjczfYiQTfSwmCtyby9yr6qNI8Vfi5HlyV4MUfh21yXZvnuRNhVSUy5zwlzW95pifj7BGVzwOCHa1Q/e+ZlGYIPffe2NR9q4XtrwBpaA9SylHGRtX+5rsi0l28AIMA4+Po3TDv+DsL1OA9CP6fvmVlZv9y2dGA2i3/rnb/+q53UKcVkM7H5x81MYEOFNDH380/tfcEfJCE/BvVzHnKBRx4FGHSK0SfBML9ALA/uiEaYQ58HnNSJ9x9CiZIKobGLAOoVjGinB4WCzHm288+j9v5D0g1GvlwROPWBb8AOnyXYHSBfQQ5dIZc7bhK2BAx2zb/e2lshFcBHTMYGb23P9JfJUtXryZLlcA7dob6z7sHctGCzDyM5TVplsjwzPKchSF3zCH4NXqwJemQyZPrMzznO+LCGTZkr4OM+FBQmZPjMYAxzhwng+TaqzPLM6d8ztsRElBJq8gKeNLw87x3VobYcfxXkEmuCn+YD2aJuBZDyDKDDXK/AcAsQIpRjyTGIJsoyeVZO5RqFHO2wcVa6AD8QR93QDhd1yGXP7CcJJyCilMcrRQkZB6SpVM3xcZBpjARjVc9cfVX1sUWOsu1KFC0B3p14S26heEpu45VpbpLXO5xitHlAhkKs5G4YG80+cKJc1cjF8X1zE9+RrQ6aBUfbHMz7bMjQRN7QEyCMiFUTLAPfGSh1iiE87hnZca9y7/c6jeslsrOkQdiBHo3D2ZWUQMwPCnzA28QcegiHDkdGpCOGJxKjxzBnxIIuGkAlvkABRhydAyQSmqGsNidsUZ6qUYSeKfUUe/HzAC7rusAkEA54x8PNIBClQJvNx7Q2UXuTIcjpPJlyXySAq0ZCeSoMPt11vq0be+POdS7euPXzw6i+vvfXw8tu7H/2+XlKJMudQ4sqGX7RbaEQeXTnbDKaLWCjF094uJN3UEXkxgiHqDyhPthOKwLS7MVJchfmYNzlV8xKpms9P3tSjTSYMvBaRBUoM4tAh5yFOPT+ZuuVTMNNPQFWcJOsKcAdBMaoskB564IeXb325VG+hhluJagHjlFAaMo1pLWCQWwU9M+jSIMqReNWCMcg4WiaYK7lOD0yEhFuNBzcVk4kMYFUhj4gSJwClAtq1qAlq/h5FTTLdsCDKsqkGyW2LnLrJE40w51OW6CeH09Quc34xYeBghNhjxuSiBd0DH5uQVQYsiAskbXvn129d+uDdq1+RyaYgt3ZffY9raswPhD5G/WDCdolZnlf1nH5Rm8kiKakfZH1MJcXKUbvVxpVPrl8m4CWT14O+SbJaEcJNPz6eg71fFT6S1hXh/EABKrXujNd2OIopdMf1qAM1TZ7oQ523A6SAu5+9ee29n2thptwZ+jaDndnp5klCXAxCgUfbttnjeV4zLDfHhUl1Coj57Z4bcNqyl6GUlGpJpc3923L6LoboLFMUPOEDo7IAG9odBka1rJoLai1RxEx1WWI6VtR3SbcJr5JFwRGrU8PTD8B49PWU949qOZvp5cny9843X3rlzPnlc7wdkNiPU22UKlU8jJaUKr5ZEIIa1rVGvP7t23cucfdNdd0wNnFYuW6EFVCX21BfE+2ZkcG6cfToURW6ONfoDNHKWnFsQnp4Qv0JItrdJ3c+ffjg3ud8O087YDi38fPl3u3r/1r6ts6VO5fuP558bslFhixANYrWkRlD2KghYYknXzw/YskHj9++fffK9Sd7WjPl6MdWmdoKfXyJ9WS0gpZP4uWPyB5uZfEo+gSfsVJeO3w4fKwbc5BqIqdKiFCJECqAUJlLguci8ByAqxUER+SrEbiK5KtJ8HwEngfwwmISvBCBFzhYLLUzcOxNWGt/gzcLQ/r5kFQ+nJUPZc+HYubDBUdNjGeZO8CYoRyeSDYToq0KE9KSMzu68IF0T/+2HP3Dy8LBJrn6Se46EQvLhDNK+2GhX7AKpwp2IdDyPMj2hbbDnCJiOjefkrVNZ5rgGdH5mlsLuzNL0+JLPyW6YCeHCyiLaS4X7TTqLu/+hdIFWwGjeFyJh3pJwMfwsGvOuv4AMNXjRFy6SduAhz8TccDEvV5TYkYvEX5JCD4pgrn9Pp6hXLOwrWOqnXj6hEpvNe4+ufo3rp3xBCksXyQLGYPCu41kBjBfFRnAXJgB+DQY9BgYJHQaniLB2gaMNiXR6HjtQOxKZVpLPWtF9jOSPGK3bpqDIMKoh0zIZCpRJsMnNaL8biRbQabikOS7th1u2yQCxhU+f1VjNAC91LT0lc2eRcxmx6SYky2oVr6nBYFSdupSZzJZLAuTNwlRH5Y3VUEJ4Paub48A9rxc4+2V8NXbxFZLgEp6808f/50rSfQirBBw68urv08F7H7+4CcJgCA7H6caZhiJyQ9vXXstObK7e+OSiJbx0SgzkP0RYT2SzXTB/Xt42GPdgRUm78VsD7t4VGQ7JqrukGEQcc0CeGglXomKmfziifuBKFsRCy+8YnpdWVNXN9GtFLdEHACGMgPXB1eKzURDyFE+gVuMWYZmlfl9NusYWoc/hnl63J6YsHN5RPKKM2FqRQPxFBGRYYrXiiYvyORSDYK6iLuy6KcVAR1qz7iGwzHZ94I4gM2uIuzoG7+78u7t925ex2ZW6pS0MWxTiramwa/pm/xZapfXvaICle+4Ux2WSkrj10ju0KF+DD0ND49qknZWt8VZLSy779n91NnCA4U7JDX+TVWOOv/g/vW3/q/zaTrn4dBS93YpLVkpN2+sFrlVahOtEllAtfcO42xEwN+ixju/8CYY8tp+5aM/rnHzxCeLntAMkz94d22ibZP+oKX1m0PNrPIWkuCzL2eJS80LzlBoJWaK2F/bxdIF+992M/4XhmVx8o4F5A4E5I4IyDKUq4Dc4QDe+xcaNCbbMdUzO0kzXTDUxwvKUmTUVBMvJrjL3b857q+q8zXJ+NMpXvlknOLI9tkXvRl21L7oTdhkScWG2wcSOHEHD4PNVs90NvbaXJ3Qh8VXDhNcuLOv/TZ1Sf+FDdj5RhtwbO2i5v9ai9/PRg7XG23m8NiQW+3eY0xJn7z+/vu8Yz5yhYWp6iFVJiT6mOLiDO/cpqbWss8My5GfmvWhSLA902e8KinAWkxwuajuumCID13SvllrQUaw+wveF5HVS/IzNtGejr5Ze/E7P+AfnTTPvfCjZRhWVTQIJ/6t4kcTozUwL44Xwrom/rkKbg7BSr6VRiQQJdeqVgqrLukJY/32C0Y7pf/wh3/86gbPeCZdoIluY3m228cpxWD8gnX2qwDs4dy4xA0gBUxtIIxLOtKxSooqkhNe6OJHnbMInqpP9SFQutSzq5V/FDSLtKvaTA2U+FWz3EedgcMlDz+s9XLbPmUD3yF9ayGrm0cqc229iM/8vbVgzi/irXquqC/SY515EESn7QXrqM7vFyJ6ox0ToYl8Rg7wq2Vx66xgufCyWTSzsCkinrJqVj7jX5Sd4kPwaBjl8Pbw3uMHr2HX7Npnv3n97ld3H91/nHJRp3pfvN8in/9jxHHJSBh/40RpjLCiG90DUZ7FuIpVxoUd4+BNKk9c9sM/asNF7aRoLJQoVxv9niw0WuywIsoNwIcC5mcDTq+T1Z92dRHkETlQQT5PCvNJBxg9DVVVj9eM6IFhaS/5aOs+pY5M2NAE47jYgIdR7BikUhh2bUZVykfUqE8tcTEdihZ965EZdinah3/usS3aN3gmBLHbCg6MPo4VU3iSmLEBrVwjGeYys4efZ4y2DgQt8Y2LzzgHT87BT7TkDN4cAT78k2wbkleEFeFZUVjJeOobSZj4zDM8jRVMi/hRyOQSBUkVBXNVneCLCh54MvPOhw1EuS8oreH9D2YMyATx5A1QePTKD1/kV6K8xfVv",
          "source.strings[1]": "ZXZhbChnemluZmxhdGUoYmFzZTY0X2RlY29kZSgkX1MpKSk7",
          "source.strings[2]": "edoced",
          "source.strings[3]": "eval(gzinflate(base64_decode($_S)));",
          "source.strings[4]": "noitcnu",
          "source.has_imports": true
        },
        "x": 225,
        "id": 0,
        "is": [
          "strrev",
          "strrev",
          "strrev",
          "strrev"
        ],
        "ms": {
          "file": {
            "size": 5240.0
          },
          "text": {
            "digit_ratio": 0.17,
            "space_count": 2.0,
            "total_lines": 1.0,
            "char_entropy": 6.06,
            "unique_chars": 78.0,
            "import_density": 400.0,
            "lines_over_200": 1.0,
            "lines_over_500": 1.0,
            "string_density": 18.0,
            "avg_line_length": 5240.0,
            "lines_over_1000": 1.0,
            "max_line_length": 5240.0,
            "last_line_length": 5240.0,
            "long_token_count": 1.0,
            "most_common_char": "2",
            "whitespace_ratio": 0.0,
            "most_common_ratio": 0.02,
            "identifier_density": 14.0,
            "encoded_string_ratio": 0.22,
            "normalized_import_count": 4.0,
            "normalized_string_count": 18.0,
            "max_inline_whitespace_run": 1.0
          },
          "imports": {
            "total": 4.0,
            "unique_modules": 1.0,
            "third_party_count": 4.0,
            "third_party_ratio": 1.0
          },
          "strings": {
            "total": 18.0,
            "avg_length": 569.22,
            "max_length": 5044.0,
            "avg_entropy": 2.69,
            "total_bytes": 10246.0,
            "entropy_stddev": 1.49,
            "base64_candidates": 4.0,
            "very_long_strings": 2.0,
            "high_entropy_count": 2.0
          },
          "comments": {},
          "functions": {},
          "identifiers": {
            "total": 14.0,
            "avg_length": 3.17,
            "max_length": 6.0,
            "min_length": 2.0,
            "avg_entropy": 1.47,
            "reuse_ratio": 0.43,
            "unique_count": 6.0,
            "length_stddev": 1.46,
            "all_lowercase_ratio": 0.5,
            "all_uppercase_ratio": 0.5,
            "underscore_prefix_count": 3.0
          }
        },
        "ss": [
          [
            10,
            "7RpdbxvH8d2A/8P6wvhIhJ+iZFsij07hyHFQp3Zip2grCcSRtxQPIu/Od0tTqqAf0wZojLZG4lhNk9pOUtstHKOwDThIWsAw8mD0JWgfEqAtkqbozH7cB3mkqKRB+1BD"
          ],
          [
            11,
            "7RpdbxvH8d2A/8P6wvhIhJ+iZFsij07hyHFQp3Zip2grCcSRtxQPIu/Od0tTqqAf0wZojLZG4lhNk9pOUtstHKOwDThIWsAw8mD0JWgfEqAtkqbozH7cB3mkqKRB+1BD"
          ],
          [
            5068,
            "esab"
          ],
          [
            5069,
            "esab"
          ],
          [
            5076,
            "64_"
          ],
          [
            5077,
            "64_"
          ],
          [
            5089,
            "edoced"
          ],
          [
            5090,
            "edoced"
          ],
          [
            5107,
            "ZXZhbChnemluZmxhdGUoYmFzZTY0X2RlY29kZSgkX1MpKSk7"
          ],
          [
            5108,
            "ZXZhbChnemluZmxhdGUoYmFzZTY0X2RlY29kZSgkX1MpKSk7"
          ],
          [
            5171,
            "taerc"
          ],
          [
            5172,
            "taerc"
          ],
          [
            5180,
            "e_f"
          ],
          [
            5181,
            "e_f"
          ],
          [
            5193,
            "noitcnu"
          ],
          [
            5194,
            "noitcnu"
          ],
          [
            5215,
            "$_S"
          ],
          [
            5216,
            "$_S"
          ],
          [
            0,
            "base64",
            "eval(gzinflate(base64_decode($_S)));"
          ]
        ],
        "sz": 5240,
        "ts": [
          {
            "c": 0.949999988079071,
            "d": "PHP opening tag present",
            "e": [
              "\u003c?php"
            ],
            "i": "metadata/lang/scripted::php-open-tag",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "Very short file (under 12 lines)",
            "e": [
              "text.total_lines = 1.00"
            ],
            "i": "metadata/file/text/metrics::file-under-12-lines",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "Very long line",
            "e": [
              "text.max_line_length = 5240.00"
            ],
            "i": "metadata/file/text/metrics::single-long-line",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "PHP variable function invocation pattern",
            "e": [
              "trd",
              "_A",
              "ctel"
            ],
            "i": "objectives/anti-static/obfuscation/imports::dynamic-function-execution",
            "l": 3
          },
          {
            "a": "T1059.006",
            "c": 0.9800000190734863,
            "d": "eval gzinflate base64 chain",
            "e": [
              "eval(gzinflate(base64_decode($_S)));"
            ],
            "i": "micro-behaviors/process/interpreter/eval::eval-gzinflate-base64",
            "l": 4,
            "m": "E1059"
          },
          {
            "c": 0.949999988079071,
            "d": "File is a one-liner",
            "e": [
              "text.total_lines = 1.00"
            ],
            "i": "metadata/file/text/metrics::file-one-liner",
            "l": 1
          },
          {
            "a": "T1505.003",
            "c": 0.8600000143051147,
            "d": "Very long embedded string",
            "e": [
              "strings.max_length = 5044.00"
            ],
            "i": "objectives/command-and-control/backdoor/webshell/stager::very-long-string",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "Last line is over 1000 chars",
            "e": [
              "text.last_line_length = 5240.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::last-line-over-1000",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "Exactly one line exceeds 1000 chars",
            "e": [
              "text.lines_over_1000 = 1.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::single-long-line-outlier",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1505.003",
            "c": 0.8399999737739563,
            "d": "Near-zero whitespace script",
            "e": [
              "text.whitespace_ratio = 0.00"
            ],
            "i": "objectives/command-and-control/backdoor/webshell/stager::near-zero-whitespace",
            "l": 1
          },
          {
            "c": 0.6000000238418579,
            "d": "Very long base64 strings present",
            "e": [
              "7RpdbxvH8d2A/8P6wvhIhJ+iZFsij07hyHFQp3Zip2grCcSRtxQPIu/Od0tTqqAf0wZojLZG4lhNk9pOUtstHKOwDThIWsAw8mD0JWgfEqAtkqbozH7cB3mkqKRB+1BD"
            ],
            "i": "objectives/anti-static/obfuscation/string/base64::long-base64-in-strings",
            "l": 3
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "PHP source contains very long line",
            "e": [
              "text.max_line_length = 5240.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/identifiers::php-single-long-line",
            "l": 4,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.800000011920929,
            "d": "High overall text entropy (encoded",
            "e": [
              "text.char_entropy = 6.06"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::high-text-entropy",
            "l": 2,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.699999988079071,
            "d": "Very low whitespace ratio (minified/compressed)",
            "e": [
              "text.whitespace_ratio = 0.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::low-whitespace",
            "l": 2,
            "m": "B0032"
          },
          {
            "c": 1.0,
            "d": "php code embedded in string",
            "e": [
              "Detected php at offset 0x0"
            ],
            "i": "metadata/lang/embedded::php",
            "l": 2
          },
          {
            "a": "T1036.005",
            "c": 1.0,
            "d": "File extension claims Text but content is Php",
            "e": [
              "expected=Text, actual=Php"
            ],
            "i": "metadata/file-extension-mismatch",
            "l": 4
          },
          {
            "c": 0.8999999761581421,
            "d": "Encoded payload detected: base64",
            "e": [
              "eval(gzinflate(base64_decode($_S))); \u003cbase64\u003e"
            ],
            "i": "metadata/encoded-payload/base64",
            "l": 3
          },
          {
            "c": 0.8999999761581421,
            "d": "PHP webshell using $a($code) for kind of eval with encoded blob to decode, e.g. b374k",
            "e": [
              "$trd('",
              "$ctel($",
              "strrev(\"",
              "\u003c?",
              "\u003c?php",
              "$_A('"
            ],
            "i": "third_party/SigBase/WEBSHELL/PHP/Dynamic/Big",
            "l": 5
          }
        ],
        "sha": "602a3f0b2b30c1c78d2b79facbfe982e4341e271b8510c7fcc8aff2d9b8f709b",
        "path": "plugin.txt",
        "type": "php"
      }
    ],
    "tv": "d376d"
  }
}