{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 0.14829449355602264,
        "class": 0
      }
    ],
    "prob": 0.1482945,
    "class": 0,
    "models": [
      {
        "m": "az",
        "prob": 0.064773,
        "class": 0
      },
      {
        "m": "az/scripts",
        "prob": 0.1482945,
        "class": 0
      },
      {
        "m": "az/php",
        "prob": 0.023349866,
        "class": 0
      }
    ],
    "version": "v16.16",
    "thresholds": [
      0.9961138,
      0.99909174
    ],
    "analyzed_at": "2026-05-09T06:45:20Z"
  },
  "path": "4e275e4d15584fb13bb3701ffa137860",
  "raw": {
    "v": "4",
    "fs": [
      {
        "f": "O₂(As₂C)",
        "x": 39,
        "id": 0,
        "ms": {
          "file": {
            "size": 1763.0
          },
          "text": {
            "tab_count": 13.0,
            "space_count": 364.0,
            "total_lines": 15.0,
            "char_entropy": 3.26,
            "unique_chars": 61.0,
            "lines_over_200": 2.0,
            "avg_line_length": 115.67,
            "high_byte_ratio": 0.7,
            "max_line_length": 210.0,
            "non_ascii_ratio": 0.7,
            "last_line_length": 5.0,
            "most_common_char": "â",
            "whitespace_ratio": 0.23,
            "most_common_ratio": 0.23,
            "line_length_stddev": 79.71,
            "repeated_char_sequences": 2.0,
            "max_inline_whitespace_run": 13.0,
            "trailing_whitespace_lines": 8.0
          },
          "strings": {},
          "comments": {
            "chars": 1744.0,
            "lines": 12.0,
            "total": 1.0,
            "to_code_ratio": 4.0,
            "url_in_comments": 1.0
          },
          "functions": {},
          "identifiers": {}
        },
        "sz": 1763,
        "ts": [
          {
            "a": "T1505.003",
            "d": "PHP open tag",
            "e": [
              "\u003c?php"
            ],
            "i": "objectives/command-and-control/backdoor/webshell/request::php-tag",
            "l": 1,
            "m": "B0030"
          },
          {
            "a": "T1027",
            "c": 1.0,
            "d": "Comment-heavy source context",
            "e": [
              "comments.to_code_ratio = 4.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/strings::comment-heavy-source",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.949999988079071,
            "d": "High non-ASCII byte ratio (packed/obfuscated)",
            "e": [
              "text.non_ascii_ratio = 0.70"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/identifiers::php-high-non-ascii-ratio",
            "l": 4,
            "m": "B0032"
          },
          {
            "c": 1.0,
            "d": "php code embedded in string",
            "e": [
              "Detected php at offset 0x0"
            ],
            "i": "metadata/lang/embedded::php",
            "l": 2
          }
        ],
        "sha": "7c74e2bc898e509426a22fd4f3b31e4a016a23bef1f4756333533d343edfbb19",
        "path": "4e275e4d15584fb13bb3701ffa137860",
        "type": "php"
      }
    ],
    "tv": "a9555"
  }
}