{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 0.99954754114151,
        "class": 2
      }
    ],
    "prob": 0.99954754,
    "class": 2,
    "models": [
      {
        "m": "az",
        "prob": 0.9891739,
        "class": 0
      },
      {
        "m": "az/scripts",
        "prob": 0.9995121,
        "class": 1
      },
      {
        "m": "az/php",
        "prob": 0.99954754,
        "class": 2
      }
    ],
    "version": "v16.16",
    "thresholds": [
      0.9961138,
      0.99909174
    ],
    "analyzed_at": "2026-05-08T22:59:43Z"
  },
  "path": "haugpwtb.php",
  "raw": {
    "v": "4",
    "fs": [
      {
        "f": "O₄(As₃C₅CaDy)H₅(DbCmCrFOs)Md",
        "k": {
          "source.imports[0]": "array_keys",
          "source.imports[1]": "array_map",
          "source.imports[2]": "array_rand",
          "source.imports[3]": "array_values",
          "source.imports[4]": "count",
          "source.imports[5]": "cqmkm",
          "source.imports[6]": "file_put_contents",
          "source.imports[7]": "glob",
          "source.imports[8]": "implode",
          "source.imports[9]": "is_array",
          "source.strings[0]": "DOCUMENT_ROOT",
          "source.strings[1]": "HTTP_HOST",
          "source.strings[2]": "fesuixmuacsfyqgg",
          "source.strings[3]": "http://",
          "source.strings[4]": "ylkvtux",
          "source.has_imports": true,
          "source.imports[10]": "is_writable",
          "source.imports[11]": "kglitfesn",
          "source.imports[12]": "md5",
          "source.imports[13]": "phpversion",
          "source.imports[14]": "rawurldecode",
          "source.imports[15]": "serialize",
          "source.imports[16]": "str_rot13",
          "source.imports[17]": "str_split",
          "source.imports[18]": "strlen",
          "source.imports[19]": "substr",
          "source.imports[20]": "substr_count",
          "source.imports[21]": "time",
          "source.imports[22]": "unserialize",
          "source.functions[0]": "cqmkm",
          "source.functions[1]": "kglitfesn",
          "source.functions[2]": "ylkvtux"
        },
        "x": 147,
        "id": 0,
        "is": [
          "strlen",
          "substr_count",
          "cqmkm",
          "str_split",
          "rawurldecode",
          "str_rot13",
          "strlen",
          "strlen",
          "implode",
          "array_map",
          "array_values",
          "array_keys",
          "unserialize",
          "is_array",
          "array_keys",
          "serialize",
          "phpversion",
          "glob",
          "count",
          "is_writable",
          "kglitfesn",
          "kglitfesn",
          "array_rand",
          "substr",
          "md5",
          "time",
          "file_put_contents",
          "substr",
          "strlen"
        ],
        "ms": {
          "file": {
            "size": 1418.0
          },
          "text": {
            "digit_ratio": 0.01,
            "space_count": 106.0,
            "total_lines": 1.0,
            "char_entropy": 5.34,
            "unique_chars": 75.0,
            "import_density": 2900.0,
            "lines_over_200": 1.0,
            "lines_over_500": 1.0,
            "string_density": 20.0,
            "avg_line_length": 1418.0,
            "lines_over_1000": 1.0,
            "max_line_length": 1418.0,
            "last_line_length": 1418.0,
            "most_common_char": "v",
            "whitespace_ratio": 0.07,
            "most_common_ratio": 0.05,
            "identifier_density": 101.0,
            "normalized_import_count": 29.0,
            "normalized_string_count": 20.0,
            "max_inline_whitespace_run": 1.0,
            "normalized_function_count": 3.0,
            "imports_to_functions_ratio": 9.67,
            "strings_to_functions_ratio": 6.67,
            "identifiers_to_functions_ratio": 13.0
          },
          "imports": {
            "total": 29.0,
            "unique_modules": 23.0,
            "third_party_count": 29.0,
            "third_party_ratio": 1.0
          },
          "strings": {
            "total": 20.0,
            "url_count": 2.0,
            "avg_length": 6.3,
            "max_length": 16.0,
            "path_count": 2.0,
            "avg_entropy": 1.76,
            "total_bytes": 126.0,
            "entropy_stddev": 1.2
          },
          "comments": {},
          "functions": {
            "total": 3.0,
            "one_liners": 3.0,
            "avg_name_length": 7.0,
            "no_params_count": 3.0,
            "avg_length_lines": 1.0,
            "max_length_lines": 1.0,
            "min_length_lines": 1.0,
            "avg_nesting_depth": 0.67,
            "max_nesting_depth": 1.0,
            "density_per_100_lines": 300.0,
            "code_in_functions_ratio": 3.0
          },
          "identifiers": {
            "total": 101.0,
            "avg_length": 8.36,
            "max_length": 17.0,
            "min_length": 3.0,
            "avg_entropy": 2.7,
            "reuse_ratio": 0.39,
            "unique_count": 39.0,
            "length_stddev": 2.9,
            "has_digit_ratio": 0.05,
            "high_entropy_count": 1.0,
            "high_entropy_ratio": 0.03,
            "all_lowercase_ratio": 0.87,
            "all_uppercase_ratio": 0.08,
            "numeric_suffix_count": 2.0,
            "underscore_prefix_count": 2.0
          }
        },
        "ss": [
          [
            19,
            "fesuixmuacsfyqgg"
          ],
          [
            20,
            "fesuixmuacsfyqgg"
          ],
          [
            139,
            "%"
          ],
          [
            140,
            "%"
          ],
          [
            506,
            "ylkvtux"
          ],
          [
            507,
            "ylkvtux"
          ],
          [
            761,
            "php"
          ],
          [
            762,
            "php"
          ],
          [
            888,
            "/*"
          ],
          [
            889,
            "/*"
          ],
          [
            1117,
            "DOCUMENT_ROOT"
          ],
          [
            1118,
            "DOCUMENT_ROOT"
          ],
          [
            1239,
            "/"
          ],
          [
            1240,
            "/"
          ],
          [
            1273,
            ".php"
          ],
          [
            1274,
            ".php"
          ],
          [
            1329,
            "http://"
          ],
          [
            1330,
            "http://"
          ],
          [
            1350,
            "HTTP_HOST"
          ],
          [
            1351,
            "HTTP_HOST"
          ]
        ],
        "sz": 1418,
        "ts": [
          {
            "c": 0.75,
            "d": "Generic $_SERVER superglobal access",
            "e": [
              "$_SERVER"
            ],
            "i": "micro-behaviors/communications/http/request/params::server-dup",
            "l": 3
          },
          {
            "a": "T1105",
            "c": 0.800000011920929,
            "d": "Creates or overwrites a local file",
            "e": [
              "file_put_contents"
            ],
            "i": "micro-behaviors/fs/write/file/direct::file-put-contents",
            "l": 3,
            "m": "C0052"
          },
          {
            "a": "T1505.003",
            "c": 0.8999999761581421,
            "d": "PHP source imports file_put_contents",
            "e": [
              "[array_keys, array_map, array_rand, array_values, count, cqmkm, file_put_contents, glob, implode, is_array, is_writable, kglitfe"
            ],
            "i": "objectives/command-and-control/backdoor/webshell/stager::source-import-file-put-contents",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.8799999952316284,
            "d": "UUID XOR decryption with modulo array index",
            "e": [
              "$hesfqjlbn[$cjvdr % strlen"
            ],
            "i": "objectives/anti-static/obfuscation/encoding/xor::uuid-xor-array-index",
            "l": 4,
            "m": "B0032"
          },
          {
            "a": "T1505.003",
            "c": 0.9300000071525574,
            "d": "Writable directory glob dropper",
            "e": [
              "GLOB_ONLYDIR);if (count($ttwlstekv) \u003e 0) {foreach ($ttwlstekv as $yjkids){if (@is_writable"
            ],
            "i": "objectives/command-and-control/backdoor/webshell/archive::writable-glob-dropper",
            "l": 4,
            "m": "B0030"
          },
          {
            "a": "T1505.003",
            "c": 0.949999988079071,
            "d": "POST auth loop keyed by length",
            "e": [
              "foreach ($_POST as $cjvdr =\u003e $vqbpo){if (strlen($cjvdr) == 16"
            ],
            "i": "objectives/command-and-control/backdoor/webshell/archive::sixteen-char-post-auth-loop",
            "l": 4,
            "m": "B0030"
          },
          {
            "c": 0.8999999761581421,
            "d": "Very long line",
            "e": [
              "text.max_line_length = 1418.00"
            ],
            "i": "metadata/file/text/metrics::single-long-line",
            "l": 1
          },
          {
            "a": "T1505.003",
            "c": 0.9599999785423279,
            "d": "md5 time short PHP drop name",
            "e": [
              "substr(md5(time()), 0, 8)"
            ],
            "i": "objectives/command-and-control/backdoor/webshell/archive::md5-time-php-drop-name",
            "l": 4,
            "m": "B0030"
          },
          {
            "a": "T1546",
            "c": 1.0,
            "d": "Writes data to a file via functions",
            "e": [
              "file_put_contents("
            ],
            "i": "micro-behaviors/fs/file/write/direct::php-file-write-func",
            "l": 2
          },
          {
            "c": 0.8600000143051147,
            "d": "Error-suppressed unserialize call",
            "e": [
              "@unserialize("
            ],
            "i": "micro-behaviors/data/serialize/object::error-suppressed-unserialize",
            "l": 4
          },
          {
            "a": "T1083",
            "c": 1.0,
            "d": "Iterate directory contents via functions in PHP",
            "e": [
              "glob("
            ],
            "i": "micro-behaviors/fs/directory/traverse::php-dir-traverse-fn",
            "l": 2
          },
          {
            "a": "T1505.003",
            "d": "PHP open tag",
            "e": [
              "\u003c?php"
            ],
            "i": "objectives/command-and-control/backdoor/webshell/request::php-tag",
            "l": 1,
            "m": "B0030"
          },
          {
            "a": "T1027",
            "c": 0.6499999761581421,
            "d": "serialize/unserialize for object serialization",
            "e": [
              "unserialize("
            ],
            "i": "objectives/anti-static/obfuscation/encoding/xor::serialize-call",
            "l": 2,
            "m": "B0032"
          },
          {
            "c": 0.949999988079071,
            "d": "File is a one-liner",
            "e": [
              "text.total_lines = 1.00"
            ],
            "i": "metadata/file/text/metrics::file-one-liner",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "Very short file (under 12 lines)",
            "e": [
              "text.total_lines = 1.00"
            ],
            "i": "metadata/file/text/metrics::file-under-12-lines",
            "l": 1
          },
          {
            "a": "T1505.003",
            "c": 0.949999988079071,
            "d": "Retrieves web server document root path",
            "e": [
              "$_SERVER[\"DOCUMENT_ROOT\"]"
            ],
            "i": "objectives/command-and-control/backdoor/webshell/stager::php-document-root-access",
            "l": 4
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "Exactly one line exceeds 1000 chars",
            "e": [
              "text.lines_over_1000 = 1.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::single-long-line-outlier",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.699999988079071,
            "d": "MD5 hash computation",
            "e": [
              "md5"
            ],
            "i": "micro-behaviors/crypto/hash/digest::md5-php",
            "l": 3,
            "m": "C0029"
          },
          {
            "c": 0.8600000143051147,
            "d": "Regex component marker",
            "e": [
              "$_SERVER["
            ],
            "i": "objectives/command-and-control/backdoor/webshell/ui::self-named-get-form--rx-4",
            "l": 1,
            "m": "B0030"
          },
          {
            "a": "T1027",
            "c": 0.9200000166893005,
            "d": "Regex component marker",
            "e": [
              "HOST"
            ],
            "i": "objectives/anti-static/obfuscation/payload/config::url-component-concat--rx-12",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "Last line is over 1000 chars",
            "e": [
              "text.last_line_length = 1418.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::last-line-over-1000",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.8999999761581421,
            "d": "HTTP protocol prefix",
            "e": [
              "http://"
            ],
            "i": "micro-behaviors/communications/http/protocol::http-prefix",
            "l": 2
          },
          {
            "c": 0.699999988079071,
            "d": "PHP error suppression operator usage",
            "e": [
              "@file_put_contents($attadyyvb, $vpzdvkcaen)",
              "@phpversion()",
              "@serialize(Array('php' =\u003e @phpversion(), ))",
              "@unserialize($vpzdvkcaen)",
              "@is_array($vpzdvkcaen)",
              "@is_writable($yjkids)"
            ],
            "i": "micro-behaviors/os/stdio::error-suppress-prefix",
            "l": 3
          },
          {
            "a": "T1059",
            "c": 0.8500000238418579,
            "d": "HTTP POST parameter access ($_POST)",
            "e": [
              "$_POST"
            ],
            "i": "micro-behaviors/communications/http/request/params::post-dup",
            "l": 3
          },
          {
            "c": 0.699999988079071,
            "d": "PHP object serialization",
            "e": [
              "serialize"
            ],
            "i": "micro-behaviors/data/serialize/object::serialize",
            "l": 3
          },
          {
            "a": "T1505.003",
            "c": 0.8500000238418579,
            "d": "PHP request superglobal access",
            "e": [
              "$_POST"
            ],
            "i": "objectives/command-and-control/backdoor/webshell/upload::php-request-variadic-function-call",
            "l": 3,
            "m": "B0030"
          },
          {
            "a": "T1059",
            "c": 0.6499999761581421,
            "d": "PHP object deserialization call",
            "e": [
              "unserialize"
            ],
            "i": "micro-behaviors/data/serialize/object::unserialize",
            "l": 3,
            "m": "E1059"
          },
          {
            "a": "T1505.003",
            "c": 0.949999988079071,
            "d": "Triple-array_map XOR decryption",
            "e": [
              "array_map(\"ylkvtux\", array_values($vpzdvkcaen), array_keys"
            ],
            "i": "objectives/command-and-control/backdoor/webshell/archive::array-map-xor-triplet",
            "l": 4,
            "m": "B0030"
          },
          {
            "a": "T1082",
            "c": 0.6000000238418579,
            "d": "Accesses DOCUMENT_ROOT variable",
            "e": [
              "$_SERVER[\"DOCUMENT_ROOT\"]"
            ],
            "i": "objectives/discovery/system/fingerprint/info::document-root-access",
            "l": 3,
            "m": "E1082"
          },
          {
            "a": "T1027",
            "c": 0.8500000238418579,
            "d": "High function density",
            "e": [
              "functions.density_per_100_lines = 300.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/functions::high-function-density",
            "l": 2,
            "m": "B0032"
          },
          {
            "a": "T1566.002",
            "c": 0.8500000238418579,
            "d": "PHP script writing POST data to local file",
            "e": [
              "$_POST",
              "file_put_contents("
            ],
            "i": "objectives/credential-access/phishing/tactics::php-credential-exfiltration",
            "l": 4,
            "m": "B0030"
          }
        ],
        "sha": "625255f2a197ebc91ea14bb16a5e1bd491eae0783a2511401966365c5e1d527e",
        "path": "haugpwtb.php",
        "type": "php"
      }
    ],
    "tv": "bef72"
  }
}