{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9997809529304504, "class": 2 } ], "prob": 0.99978095, "class": 2, "models": [ { "m": "az", "prob": 0.9928818, "class": 0 }, { "m": "az/scripts", "prob": 0.99800533, "class": 0 }, { "m": "az/php", "prob": 0.99978095, "class": 2 } ], "version": "v16.16", "thresholds": [ 0.9961138, 0.99909174 ], "analyzed_at": "2026-05-09T03:10:43Z" }, "path": "184.168.27.139", "raw": { "v": "4", "fs": [ { "f": "O(C₄)H₄(DbCmOsPo)Md", "k": { "source.imports[0]": "base64_decode", "source.imports[1]": "chr", "source.imports[2]": "define", "source.imports[3]": "defined", "source.imports[4]": "ini_set", "source.imports[5]": "isset", "source.imports[6]": "k3bf54", "source.imports[7]": "ord", "source.imports[8]": "phpversion", "source.imports[9]": "serialize", "source.strings[0]": "4gm\rF%X]n?", "source.strings[1]": "Ea^w+#z:rW= B)\u0026q~eCMfhvyotH_U8;[uQxIj1\t\n{Gi$d!0@}5.pV", "source.strings[2]": "Ea^w+#z:rW= B)\u0026q~eCMfhvyotH_U8;[uQxIj1\t\n{Gi$d!0@}5.pV\\'4gm\rF%X]n?\\\\ZK*RT7YbA\u003cD(/\u003eLlJP9-S6skc\"`O3N2,|", "source.strings[3]": "GLOBALS", "source.strings[4]": "LREADY_RUN_366afb8a8a2355ab21fbf11ba1a02fba", "source.strings[5]": "ZK*RT7YbA\u003cD(/\u003eLlJP9-S6skc\"`O3N2,|", "source.strings[6]": "a874441e", "source.strings[7]": "base64_decode", "source.strings[8]": "c6e2716", "source.strings[9]": "caf53b", "source.has_imports": true, "source.imports[10]": "set_time_limit", "source.imports[11]": "strlen", "source.imports[12]": "unserialize", "source.imports[13]": "v965e20b5", "source.strings[10]": "define", "source.strings[11]": "defined", "source.strings[12]": "e28ec8b", "source.strings[13]": "error_log", "source.strings[14]": "f9ba9dd1-9cfe-4252-bf10-0cc9ed502a4c", "source.strings[15]": "g7eff3", "source.strings[16]": "hdbca9", "source.strings[17]": "ini_set", "source.strings[18]": "jf5762289", "source.strings[19]": "k3bf54", "source.strings[20]": "k3c57ec", "source.strings[21]": "ldb36db10", "source.strings[22]": "log_errors", "source.strings[23]": "max_execution_time", "source.strings[24]": "oa103b", "source.strings[25]": "paee5ce9", "source.strings[26]": "phpversion", "source.strings[27]": "qda525", "source.strings[28]": "rcdd0f10d", "source.strings[29]": "serialize", "source.strings[30]": "set_time_limit", "source.strings[31]": "strlen", "source.strings[32]": "unserialize", "source.strings[33]": "v965e20b5", "source.strings[34]": "v9e2b618d", "source.strings[35]": "y45ad9", "source.functions[0]": "k3bf54", "source.functions[1]": "v965e20b5" }, "x": 71, "id": 0, "is": [ "ini_set", "ini_set", "ini_set", "set_time_limit", "defined", "define", "strlen", "strlen", "strlen", "chr", "ord", "ord", "v965e20b5", "v965e20b5", "unserialize", "k3bf54", "base64_decode", "isset", "phpversion", "serialize" ], "ms": { "file": { "size": 2440.0 }, "text": { "tab_count": 1.0, "digit_ratio": 0.35, "space_count": 454.0, "total_lines": 71.0, "char_entropy": 5.27, "unique_chars": 98.0, "import_density": 28.17, "string_density": 1.55, "avg_line_length": 33.37, "max_line_length": 122.0, "last_line_length": 1.0, "most_common_char": "'", "whitespace_ratio": 0.22, "most_common_ratio": 0.04, "identifier_density": 1.42, "line_length_stddev": 24.24, "encoded_string_ratio": 0.02, "normalized_import_count": 2.37, "normalized_string_count": 13.05, "repeated_char_sequences": 8.0, "suspicious_string_ratio": 0.02, "max_inline_whitespace_run": 1.0, "normalized_function_count": 0.24, "trailing_whitespace_lines": 1.0, "imports_to_functions_ratio": 10.0, "strings_to_functions_ratio": 55.0, "suspicious_identifier_ratio": 0.04, "normalized_unique_identifiers": 4.39, "identifiers_to_functions_ratio": 13.5 }, "imports": { "total": 20.0, "unique_modules": 14.0, "third_party_count": 20.0, "third_party_ratio": 1.0 }, "strings": { "total": 110.0, "avg_length": 10.44, "max_length": 100.0, "avg_entropy": 2.34, "email_count": 2.0, "hex_strings": 2.0, "total_bytes": 1148.0, "entropy_stddev": 1.14, "high_entropy_count": 3.0, "shell_command_strings": 2.0, "very_high_entropy_count": 1.0 }, "comments": {}, "functions": { "total": 2.0, "length_stddev": 2.5, "avg_name_length": 7.5, "no_params_count": 2.0, "avg_length_lines": 8.5, "max_length_lines": 11.0, "min_length_lines": 6.0, "numeric_suffix_names": 1.0, "density_per_100_lines": 2.82, "code_in_functions_ratio": 0.24 }, "identifiers": { "total": 101.0, "avg_length": 7.15, "max_length": 14.0, "min_length": 3.0, "avg_entropy": 2.46, "reuse_ratio": 0.27, "unique_count": 27.0, "length_stddev": 2.65, "hex_like_names": 1.0, "has_digit_ratio": 0.48, "all_lowercase_ratio": 0.41, "all_uppercase_ratio": 0.11, "numeric_suffix_count": 11.0, "underscore_prefix_count": 2.0 } }, "ss": [ [ 28, "kaf94" ], [ 29, "kaf94" ], [ 84, "GLOBALS" ], [ 85, "GLOBALS" ], [ 95, "e28ec8b" ], [ 96, "e28ec8b" ], [ 108, "Ea^w+#z:rW= B)\u0026q~eCMfhvyotH_U8;[uQxIj1\t\n{Gi$d!0@}5.pV\\'4gm\rF%X]n?\\\\ZK*RT7YbA\u003cD(/\u003eLlJP9-S6skc\"`O3N2,|" ], [ 109, "Ea^w+#z:rW= B)\u0026q~eCMfhvyotH_U8;[uQxIj1\t\n{Gi$d!0@}5.pV" ], [ 164, "4gm\rF%X]n?" ], [ 176, "ZK*RT7YbA\u003cD(/\u003eLlJP9-S6skc\"`O3N2,|" ], [ 219, "jf5762289" ], [ 220, "jf5762289" ], [ 234, "chr" ], [ 235, "chr" ], [ 248, "hdbca9" ], [ 249, "hdbca9" ], [ 260, "ord" ], [ 261, "ord" ], [ 274, "ldb36db10" ], [ 275, "ldb36db10" ], [ 289, "define" ], [ 290, "define" ], [ 306, "v9e2b618d" ], [ 307, "v9e2b618d" ], [ 321, "strlen" ], [ 322, "strlen" ], [ 338, "qda525" ], [ 339, "qda525" ], [ 350, "defined" ], [ 351, "defined" ], [ 368, "oa103b" ], [ 369, "oa103b" ], [ 380, "ini_set" ], [ 381, "ini_set" ], [ 398, "a874441e" ], [ 399, "a874441e" ], [ 412, "serialize" ], [ 413, "serialize" ], [ 432, "paee5ce9" ], [ 433, "paee5ce9" ], [ 446, "phpversion" ], [ 447, "phpversion" ], [ 467, "bbcc0" ], [ 468, "bbcc0" ], [ 478, "unserialize" ], [ 479, "unserialize" ], [ 500, "y45ad9" ], [ 501, "y45ad9" ], [ 512, "base64_decode" ], [ 513, "base64_decode" ], [ 536, "caf53b" ], [ 537, "caf53b" ], [ 548, "set_time_limit" ], [ 549, "set_time_limit" ], [ 573, "c6e2716" ], [ 574, "c6e2716" ], [ 586, "k3bf54" ], [ 587, "k3bf54" ], [ 603, "rcdd0f10d" ], [ 604, "rcdd0f10d" ], [ 618, "v965e20b5" ], [ 619, "v965e20b5" ], [ 638, "m716" ], [ 639, "m716" ], [ 663, "k3c57ec" ], [ 664, "k3c57ec" ], [ 695, "error_log" ], [ 696, "error_log" ], [ 724, "log_errors" ], [ 725, "log_errors" ], [ 751, "max_execution_time" ], [ 752, "max_execution_time" ], [ 817, "e28ec8b" ], [ 818, "e28ec8b" ], [ 834, "LREADY_RUN_366afb8a8a2355ab21fbf11ba1a02fba" ], [ 835, "LREADY_RUN_366afb8a8a2355ab21fbf11ba1a02fba" ], [ 965, "e28ec8b" ], [ 966, "e28ec8b" ], [ 982, "LREADY_RUN_366afb8a8a2355ab21fbf11ba1a02fba" ], [ 983, "LREADY_RUN_366afb8a8a2355ab21fbf11ba1a02fba" ], [ 1085, "g7eff3" ], [ 1086, "g7eff3" ], [ 1097, "f9ba9dd1-9cfe-4252-bf10-0cc9ed502a4c" ], [ 1098, "f9ba9dd1-9cfe-4252-bf10-0cc9ed502a4c" ], [ 1753, "k3c57ec" ], [ 1754, "k3c57ec" ], [ 1897, "m716" ], [ 1898, "m716" ], [ 2105, "ak" ], [ 2106, "ak" ], [ 2115, "f9ba9dd1-9cfe-4252-bf10-0cc9ed502a4c" ], [ 2116, "f9ba9dd1-9cfe-4252-bf10-0cc9ed502a4c" ], [ 2166, "ak" ], [ 2167, "ak" ], [ 2196, "a" ], [ 2197, "a" ], [ 2204, "i" ], [ 2205, "i" ], [ 2246, "e28ec8b" ], [ 2247, "e28ec8b" ], [ 2263, "v" ], [ 2264, "v" ], [ 2285, "1.0-1" ], [ 2286, "1.0-1" ], [ 2360, "a" ], [ 2361, "a" ], [ 2368, "e" ], [ 2369, "e" ], [ 2402, "d" ], [ 2403, "d" ] ], "sz": 2440, "ts": [ { "a": "T1505.003", "c": 0.8999999761581421, "d": "PHP source imports base64_decode", "e": [ "[base64_decode, chr, define, defined, ini_set, isset, k3bf54, ord, phpversion, serialize, set_time_limit, strlen, unserialize, v" ], "i": "objectives/command-and-control/backdoor/webshell/stager::source-import-base64-decode", "l": 1 }, { "c": 0.8600000143051147, "d": "Error-suppressed unserialize call", "e": [ "@unserialize(" ], "i": "micro-behaviors/data/serialize/object::error-suppressed-unserialize", "l": 4 }, { "a": "T1027", "c": 0.6499999761581421, "d": "serialize/unserialize for object serialization", "e": [ "unserialize(" ], "i": "objectives/anti-static/obfuscation/encoding/xor::serialize-call", "l": 2, "m": "B0032" }, { "a": "T1059", "c": 0.8500000238418579, "d": "HTTP POST parameter access ($_POST)", "e": [ "$_POST" ], "i": "micro-behaviors/communications/http/request/params::post-dup", "l": 3 }, { "a": "T1059", "c": 0.6499999761581421, "d": "PHP object deserialization call", "e": [ "unserialize" ], "i": "micro-behaviors/data/serialize/object::unserialize", "l": 3, "m": "E1059" }, { "a": "T1505.003", "d": "PHP open tag", "e": [ "\u003c?php" ], "i": "objectives/command-and-control/backdoor/webshell/request::php-tag", "l": 1, "m": "B0030" }, { "a": "T1027", "c": 0.949999988079071, "d": "UUID literal present in PHP source", "e": [ "f9ba9dd1-9cfe-4252-bf10-0cc9ed502a4c" ], "i": "objectives/anti-static/obfuscation/encoding/xor::uuid-literal", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "PHP object serialization", "e": [ "serialize" ], "i": "micro-behaviors/data/serialize/object::serialize", "l": 3 }, { "c": 0.8500000238418579, "d": "Removes PHP script execution time limit", "e": [ "@set_time_limit(0)" ], "i": "objectives/command-and-control/backdoor/webshell/session::unlimited-runtime-call", "l": 4 }, { "a": "T1505.003", "c": 0.8500000238418579, "d": "PHP request superglobal access", "e": [ "$_POST" ], "i": "objectives/command-and-control/backdoor/webshell/upload::php-request-variadic-function-call", "l": 3, "m": "B0030" }, { "c": 0.699999988079071, "d": "PHP error suppression operator usage", "e": [ "@set_time_limit(0)", "@unserialize(k3bf54(base64_decode($g95f175), $r56137))", "@ini_set('max_execution_time', 0)", "@serialize($n4968e)", "@ini_set('log_errors', 0)", "@phpversion()", "@ini_set('error_log', NULL)" ], "i": "micro-behaviors/os/stdio::error-suppress-prefix", "l": 3 }, { "c": 0.800000011920929, "d": "HTTP Cookie access ($_COOKIE)", "e": [ "$_COOKIE" ], "i": "micro-behaviors/communications/http/request/params::cookie", "l": 3 }, { "c": 0.8999999761581421, "d": "File has 30 or more lines", "e": [ "text.total_lines = 71.00" ], "i": "metadata/file/text/metrics::file-has-30-plus-lines", "l": 1 }, { "c": 0.699999988079071, "d": "Remove execution time limit", "e": [ "set_time_limit" ], "i": "micro-behaviors/process/control/signal::set-time-limit", "l": 3 }, { "c": 1.0, "d": "php code embedded in string", "e": [ "Detected php at offset 0x0" ], "i": "metadata/lang/embedded::php", "l": 2 } ], "sha": "7d8a1a7d625a63c6d1fc3c3eca5026f5e36e33c18f9bda78f3b1e90d35341be0", "path": "184.168.27.139", "type": "php" } ], "tv": "a9555" } }