{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 0.9951327443122864,
        "class": 2
      }
    ],
    "prob": 0.99513274,
    "class": 2,
    "models": [
      {
        "m": "az",
        "prob": 0.32927158,
        "class": 0
      },
      {
        "m": "az/scripts",
        "prob": 0.9266092,
        "class": 0
      },
      {
        "m": "az/php",
        "prob": 0.99513274,
        "class": 2
      }
    ],
    "version": "v16.16",
    "thresholds": [
      0.9961138,
      0.99909174
    ],
    "analyzed_at": "2026-05-09T20:07:46Z"
  },
  "path": "anti2.php",
  "raw": {
    "v": "4",
    "fs": [
      {
        "f": "O₂(C₂As)H(Cm₂)Md₂(Pt)",
        "k": {
          "source.imports[0]": "header",
          "source.imports[1]": "in_array",
          "source.imports[2]": "preg_match",
          "source.strings[0]": "68.65.53.71",
          "source.strings[1]": "\u003ch1\u003e404 Not Found\u003c/h1\u003eThe page that you have requested could not be found.",
          "source.strings[2]": "Location: http://2m.ma",
          "source.strings[3]": "REMOTE_ADDR",
          "source.strings[4]": "^107.170.*.*",
          "source.strings[5]": "^109.186.*.*",
          "source.strings[6]": "^12.148.196.*",
          "source.strings[7]": "^12.148.209.*",
          "source.strings[8]": "^128.242.*.*",
          "source.strings[9]": "^131.212.*.*",
          "source.has_imports": true,
          "source.strings[10]": "^149.20.*.*",
          "source.strings[11]": "^158.108.*.*",
          "source.strings[12]": "^167.24.*.*",
          "source.strings[13]": "^168.188.*.*",
          "source.strings[14]": "^173.194.*.*",
          "source.strings[15]": "^184.173.*.*",
          "source.strings[16]": "^192.115.134.*",
          "source.strings[17]": "^192.118.48.*",
          "source.strings[18]": "^193.220.178.*",
          "source.strings[19]": "^193.253.199.*",
          "source.strings[20]": "^193.47.80.*",
          "source.strings[21]": "^194.52.68.*",
          "source.strings[22]": "^194.72.238.*",
          "source.strings[23]": "^194.90.*.*",
          "source.strings[24]": "^198.25.*.*",
          "source.strings[25]": "^198.54.*.*",
          "source.strings[26]": "^199.30.228.*",
          "source.strings[27]": "^202.108.252.*",
          "source.strings[28]": "^204.14.48.*",
          "source.strings[29]": "^206.28.72.*",
          "source.strings[30]": "^207.126.144.*",
          "source.strings[31]": "^208.65.144.*",
          "source.strings[32]": "^208.91.115.*",
          "source.strings[33]": "^209.73.228.*",
          "source.strings[34]": "^209.85.*.*",
          "source.strings[35]": "^209.85.128.*",
          "source.strings[36]": "^212.143.*.*",
          "source.strings[37]": "^212.150.*.*",
          "source.strings[38]": "^212.235.*.*",
          "source.strings[39]": "^212.29.192.*",
          "source.strings[40]": "^212.29.224.*",
          "source.strings[41]": "^212.50.193.*",
          "source.strings[42]": "^216.239.32.*",
          "source.strings[43]": "^216.252.167.*",
          "source.strings[44]": "^217.132.*.*",
          "source.strings[45]": "^38.100.*.*",
          "source.strings[46]": "^38.105.*.*",
          "source.strings[47]": "^38.144.36.*",
          "source.strings[48]": "^46.116.*.* ",
          "source.strings[49]": "^50.7.*.*",
          "source.strings[50]": "^50.97.*.*",
          "source.strings[51]": "^54.176.*.*",
          "source.strings[52]": "^62.116.207.*",
          "source.strings[53]": "^62.90.*.*",
          "source.strings[54]": "^64.106.213.*",
          "source.strings[55]": "^64.124.14.*",
          "source.strings[56]": "^64.18.*.*",
          "source.strings[57]": "^64.233.160.*",
          "source.strings[58]": "^64.27.2.*",
          "source.strings[59]": "^64.37.103.*",
          "source.strings[60]": "^64.62.136.*",
          "source.strings[61]": "^64.62.175.*",
          "source.strings[62]": "^66.102.*.*",
          "source.strings[63]": "^66.135.200.*",
          "source.strings[64]": "^66.150.14.*",
          "source.strings[65]": "^66.205.64.*",
          "source.strings[66]": "^66.207.120.*",
          "source.strings[67]": "^66.221.*.*",
          "source.strings[68]": "^66.249.*.*",
          "source.strings[69]": "^67.15.*.*",
          "source.strings[70]": "^67.209.128.*",
          "source.strings[71]": "^69.61.12.*",
          "source.strings[72]": "^69.65.*.*",
          "source.strings[73]": "^72.14.192.*",
          "source.strings[74]": "^74.125.*.*",
          "source.strings[75]": "^81.161.59.*",
          "source.strings[76]": "^82.166.*.*",
          "source.strings[77]": "^85.250.*.*",
          "source.strings[78]": "^85.64.*.*",
          "source.strings[79]": "^89.138.*.*",
          "source.strings[80]": "^91.103.66.*",
          "source.strings[81]": "^93.172.*.*"
        },
        "x": 36,
        "id": 0,
        "is": [
          "in_array",
          "header",
          "preg_match",
          "header"
        ],
        "ms": {
          "file": {
            "size": 2219.0
          },
          "text": {
            "digit_ratio": 0.71,
            "space_count": 72.0,
            "total_lines": 11.0,
            "char_entropy": 5.04,
            "unique_chars": 85.0,
            "import_density": 36.36,
            "lines_over_200": 1.0,
            "lines_over_500": 1.0,
            "string_density": 16.73,
            "avg_line_length": 199.91,
            "high_byte_ratio": 0.21,
            "lines_over_1000": 1.0,
            "max_line_length": 1598.0,
            "non_ascii_ratio": 0.21,
            "last_line_length": 1598.0,
            "long_token_count": 2.0,
            "most_common_char": ".",
            "whitespace_ratio": 0.04,
            "most_common_ratio": 0.12,
            "identifier_density": 1.18,
            "line_length_stddev": 444.41,
            "normalized_import_count": 1.21,
            "normalized_string_count": 55.48,
            "suspicious_comment_ratio": 1.0,
            "max_inline_whitespace_run": 7.0,
            "trailing_whitespace_lines": 1.0,
            "normalized_unique_identifiers": 2.02
          },
          "imports": {
            "total": 4.0,
            "unique_modules": 3.0,
            "third_party_count": 4.0,
            "third_party_ratio": 1.0
          },
          "strings": {
            "total": 184.0,
            "ip_count": 2.0,
            "avg_length": 12.53,
            "max_length": 74.0,
            "avg_entropy": 2.78,
            "total_bytes": 2306.0,
            "entropy_stddev": 0.5
          },
          "comments": {
            "chars": 608.0,
            "lines": 8.0,
            "total": 1.0,
            "to_code_ratio": 2.67,
            "url_in_comments": 1.0,
            "base64_in_comments": 1.0
          },
          "functions": {},
          "identifiers": {
            "total": 13.0,
            "avg_length": 7.29,
            "max_length": 10.0,
            "min_length": 5.0,
            "avg_entropy": 2.43,
            "reuse_ratio": 0.54,
            "unique_count": 7.0,
            "length_stddev": 1.48,
            "has_digit_ratio": 0.43,
            "all_lowercase_ratio": 0.43,
            "all_uppercase_ratio": 0.14,
            "underscore_prefix_count": 1.0
          }
        },
        "ss": [
          [
            639,
            "REMOTE_ADDR"
          ],
          [
            640,
            "REMOTE_ADDR"
          ],
          [
            670,
            "^81.161.59.*"
          ],
          [
            671,
            "^81.161.59.*"
          ],
          [
            685,
            "^66.135.200.*"
          ],
          [
            686,
            "^66.135.200.*"
          ],
          [
            701,
            "^66.102.*.*"
          ],
          [
            702,
            "^66.102.*.*"
          ],
          [
            715,
            "^38.100.*.*"
          ],
          [
            716,
            "^38.100.*.*"
          ],
          [
            729,
            "^107.170.*.*"
          ],
          [
            730,
            "^107.170.*.*"
          ],
          [
            744,
            "^149.20.*.*"
          ],
          [
            745,
            "^149.20.*.*"
          ],
          [
            758,
            "^38.105.*.*"
          ],
          [
            759,
            "^38.105.*.*"
          ],
          [
            772,
            "^74.125.*.*"
          ],
          [
            773,
            "^74.125.*.*"
          ],
          [
            786,
            "^66.150.14.*"
          ],
          [
            787,
            "^66.150.14.*"
          ],
          [
            801,
            "^54.176.*.*"
          ],
          [
            802,
            "^54.176.*.*"
          ],
          [
            815,
            "^38.100.*.*"
          ],
          [
            816,
            "^38.100.*.*"
          ],
          [
            829,
            "^184.173.*.*"
          ],
          [
            830,
            "^184.173.*.*"
          ],
          [
            844,
            "^66.249.*.*"
          ],
          [
            845,
            "^66.249.*.*"
          ],
          [
            858,
            "^128.242.*.*"
          ],
          [
            859,
            "^128.242.*.*"
          ],
          [
            873,
            "^72.14.192.*"
          ],
          [
            874,
            "^72.14.192.*"
          ],
          [
            888,
            "^208.65.144.*"
          ],
          [
            889,
            "^208.65.144.*"
          ],
          [
            904,
            "^74.125.*.*"
          ],
          [
            905,
            "^74.125.*.*"
          ],
          [
            918,
            "^209.85.128.*"
          ],
          [
            919,
            "^209.85.128.*"
          ],
          [
            934,
            "^216.239.32.*"
          ],
          [
            935,
            "^216.239.32.*"
          ],
          [
            950,
            "^74.125.*.*"
          ],
          [
            951,
            "^74.125.*.*"
          ],
          [
            964,
            "^207.126.144.*"
          ],
          [
            965,
            "^207.126.144.*"
          ],
          [
            981,
            "^173.194.*.*"
          ],
          [
            982,
            "^173.194.*.*"
          ],
          [
            996,
            "^64.233.160.*"
          ],
          [
            997,
            "^64.233.160.*"
          ],
          [
            1012,
            "^72.14.192.*"
          ],
          [
            1013,
            "^72.14.192.*"
          ],
          [
            1027,
            "^66.102.*.*"
          ],
          [
            1028,
            "^66.102.*.*"
          ],
          [
            1041,
            "^64.18.*.*"
          ],
          [
            1042,
            "^64.18.*.*"
          ],
          [
            1054,
            "^194.52.68.*"
          ],
          [
            1055,
            "^194.52.68.*"
          ],
          [
            1069,
            "^194.72.238.*"
          ],
          [
            1070,
            "^194.72.238.*"
          ],
          [
            1085,
            "^62.116.207.*"
          ],
          [
            1086,
            "^62.116.207.*"
          ],
          [
            1101,
            "^212.50.193.*"
          ],
          [
            1102,
            "^212.50.193.*"
          ],
          [
            1117,
            "^69.65.*.*"
          ],
          [
            1118,
            "^69.65.*.*"
          ],
          [
            1130,
            "^50.7.*.*"
          ],
          [
            1131,
            "^50.7.*.*"
          ],
          [
            1142,
            "^131.212.*.*"
          ],
          [
            1143,
            "^131.212.*.*"
          ],
          [
            1157,
            "^46.116.*.* "
          ],
          [
            1158,
            "^46.116.*.* "
          ],
          [
            1172,
            "^62.90.*.*"
          ],
          [
            1173,
            "^62.90.*.*"
          ],
          [
            1185,
            "^89.138.*.*"
          ],
          [
            1186,
            "^89.138.*.*"
          ],
          [
            1199,
            "^82.166.*.*"
          ],
          [
            1200,
            "^82.166.*.*"
          ],
          [
            1213,
            "^85.64.*.*"
          ],
          [
            1214,
            "^85.64.*.*"
          ],
          [
            1226,
            "^85.250.*.*"
          ],
          [
            1227,
            "^85.250.*.*"
          ],
          [
            1240,
            "^89.138.*.*"
          ],
          [
            1241,
            "^89.138.*.*"
          ],
          [
            1254,
            "^93.172.*.*"
          ],
          [
            1255,
            "^93.172.*.*"
          ],
          [
            1268,
            "^109.186.*.*"
          ],
          [
            1269,
            "^109.186.*.*"
          ],
          [
            1283,
            "^194.90.*.*"
          ],
          [
            1284,
            "^194.90.*.*"
          ],
          [
            1297,
            "^212.29.192.*"
          ],
          [
            1298,
            "^212.29.192.*"
          ],
          [
            1313,
            "^212.29.224.*"
          ],
          [
            1314,
            "^212.29.224.*"
          ],
          [
            1329,
            "^212.143.*.*"
          ],
          [
            1330,
            "^212.143.*.*"
          ],
          [
            1344,
            "^212.150.*.*"
          ],
          [
            1345,
            "^212.150.*.*"
          ],
          [
            1359,
            "^212.235.*.*"
          ],
          [
            1360,
            "^212.235.*.*"
          ],
          [
            1374,
            "^217.132.*.*"
          ],
          [
            1375,
            "^217.132.*.*"
          ],
          [
            1389,
            "^50.97.*.*"
          ],
          [
            1390,
            "^50.97.*.*"
          ],
          [
            1402,
            "^217.132.*.*"
          ],
          [
            1403,
            "^217.132.*.*"
          ],
          [
            1417,
            "^209.85.*.*"
          ],
          [
            1418,
            "^209.85.*.*"
          ],
          [
            1431,
            "^66.205.64.*"
          ],
          [
            1432,
            "^66.205.64.*"
          ],
          [
            1446,
            "^204.14.48.*"
          ],
          [
            1447,
            "^204.14.48.*"
          ],
          [
            1461,
            "^64.27.2.*"
          ],
          [
            1462,
            "^64.27.2.*"
          ],
          [
            1474,
            "^67.15.*.*"
          ],
          [
            1475,
            "^67.15.*.*"
          ],
          [
            1487,
            "^202.108.252.*"
          ],
          [
            1488,
            "^202.108.252.*"
          ],
          [
            1504,
            "^193.47.80.*"
          ],
          [
            1505,
            "^193.47.80.*"
          ],
          [
            1519,
            "^64.62.136.*"
          ],
          [
            1520,
            "^64.62.136.*"
          ],
          [
            1534,
            "^66.221.*.*"
          ],
          [
            1535,
            "^66.221.*.*"
          ],
          [
            1548,
            "^64.62.175.*"
          ],
          [
            1549,
            "^64.62.175.*"
          ],
          [
            1563,
            "^198.54.*.*"
          ],
          [
            1564,
            "^198.54.*.*"
          ],
          [
            1577,
            "^192.115.134.*"
          ],
          [
            1578,
            "^192.115.134.*"
          ],
          [
            1594,
            "^216.252.167.*"
          ],
          [
            1595,
            "^216.252.167.*"
          ],
          [
            1611,
            "^193.253.199.*"
          ],
          [
            1612,
            "^193.253.199.*"
          ],
          [
            1628,
            "^69.61.12.*"
          ],
          [
            1629,
            "^69.61.12.*"
          ],
          [
            1642,
            "^64.37.103.*"
          ],
          [
            1643,
            "^64.37.103.*"
          ],
          [
            1657,
            "^38.144.36.*"
          ],
          [
            1658,
            "^38.144.36.*"
          ],
          [
            1672,
            "^64.124.14.*"
          ],
          [
            1673,
            "^64.124.14.*"
          ],
          [
            1687,
            "^206.28.72.*"
          ],
          [
            1688,
            "^206.28.72.*"
          ],
          [
            1702,
            "^209.73.228.*"
          ],
          [
            1703,
            "^209.73.228.*"
          ],
          [
            1718,
            "^158.108.*.*"
          ],
          [
            1719,
            "^158.108.*.*"
          ],
          [
            1733,
            "^168.188.*.*"
          ],
          [
            1734,
            "^168.188.*.*"
          ],
          [
            1748,
            "^66.207.120.*"
          ],
          [
            1749,
            "^66.207.120.*"
          ],
          [
            1764,
            "^167.24.*.*"
          ],
          [
            1765,
            "^167.24.*.*"
          ],
          [
            1778,
            "^192.118.48.*"
          ],
          [
            1779,
            "^192.118.48.*"
          ],
          [
            1794,
            "^67.209.128.*"
          ],
          [
            1795,
            "^67.209.128.*"
          ],
          [
            1810,
            "^12.148.209.*"
          ],
          [
            1811,
            "^12.148.209.*"
          ],
          [
            1826,
            "^12.148.196.*"
          ],
          [
            1827,
            "^12.148.196.*"
          ],
          [
            1842,
            "^193.220.178.*"
          ],
          [
            1843,
            "^193.220.178.*"
          ],
          [
            1859,
            "68.65.53.71"
          ],
          [
            1860,
            "68.65.53.71"
          ],
          [
            1873,
            "^198.25.*.*"
          ],
          [
            1874,
            "^198.25.*.*"
          ],
          [
            1887,
            "^64.106.213.*"
          ],
          [
            1888,
            "^64.106.213.*"
          ],
          [
            1903,
            "^91.103.66.*"
          ],
          [
            1904,
            "^91.103.66.*"
          ],
          [
            1918,
            "^208.91.115.*"
          ],
          [
            1919,
            "^208.91.115.*"
          ],
          [
            1934,
            "^199.30.228.*"
          ],
          [
            1935,
            "^199.30.228.*"
          ],
          [
            1996,
            "Location: http://2m.ma"
          ],
          [
            1997,
            "Location: http://2m.ma"
          ],
          [
            2072,
            "/"
          ],
          [
            2073,
            "/"
          ],
          [
            2083,
            "/"
          ],
          [
            2084,
            "/"
          ],
          [
            2105,
            "Location: http://2m.ma"
          ],
          [
            2106,
            "Location: http://2m.ma"
          ],
          [
            2136,
            "\u003ch1\u003e404 Not Found\u003c/h1\u003eThe page that you have requested could not be found."
          ],
          [
            2137,
            "\u003ch1\u003e404 Not Found\u003c/h1\u003eThe page that you have requested could not be found."
          ]
        ],
        "sz": 2219,
        "ts": [
          {
            "c": 0.800000011920929,
            "d": "Very short file (under 12 lines)",
            "e": [
              "text.total_lines = 11.00"
            ],
            "i": "metadata/file/text/metrics::file-under-12-lines",
            "l": 1
          },
          {
            "c": 0.949999988079071,
            "d": "PHP opening tag present",
            "e": [
              "\u003c?php"
            ],
            "i": "metadata/lang/scripted::php-open-tag",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "Exactly one line exceeds 1000 chars",
            "e": [
              "text.lines_over_1000 = 1.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::single-long-line-outlier",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "Last line is over 1000 chars",
            "e": [
              "text.last_line_length = 1598.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::last-line-over-1000",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.8600000143051147,
            "d": "Regex component marker",
            "e": [
              "$_SERVER["
            ],
            "i": "objectives/command-and-control/backdoor/webshell/ui::self-named-get-form--rx-4",
            "l": 1,
            "m": "B0030"
          },
          {
            "c": 0.75,
            "d": "Generic $_SERVER superglobal access",
            "e": [
              "$_SERVER"
            ],
            "i": "micro-behaviors/communications/http/request/params::server-dup",
            "l": 3
          },
          {
            "a": "T1027",
            "c": 1.0,
            "d": "Comment-heavy source context",
            "e": [
              "comments.to_code_ratio = 2.67"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/strings::comment-heavy-source",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.8999999761581421,
            "d": "Very long line",
            "e": [
              "text.max_line_length = 1598.00"
            ],
            "i": "metadata/file/text/metrics::single-long-line",
            "l": 1
          },
          {
            "c": 0.8500000238418579,
            "d": "Hardcoded external IPv4 address",
            "e": [
              "68.65.53.71"
            ],
            "i": "micro-behaviors/communications/ip/literal::external-ipv4-script",
            "l": 4
          },
          {
            "a": "T1027",
            "c": 0.699999988079071,
            "d": "Very low whitespace ratio (minified/compressed)",
            "e": [
              "text.whitespace_ratio = 0.04"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::low-whitespace",
            "l": 2,
            "m": "B0032"
          },
          {
            "a": "T1071.001",
            "c": 0.8500000238418579,
            "d": "Hardcoded external IPv4 address",
            "e": [
              "68.65.53.71"
            ],
            "i": "objectives/command-and-control/infrastructure/ip::hardcoded-ipv4-script",
            "l": 3,
            "m": "C0002"
          }
        ],
        "sha": "7f42f1f5f0bdec5d36e96ccc200c7a4e12e2b7cd71cb36d765a162ce57f5a4b3",
        "path": "anti2.php",
        "type": "php"
      }
    ],
    "tv": "87c42"
  }
}