{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 0.13800160586833954,
        "class": 0
      }
    ],
    "prob": 0.1380016,
    "class": 0,
    "models": [
      {
        "m": "az",
        "prob": 0.10631393,
        "class": 0
      },
      {
        "m": "az/scripts",
        "prob": 0.1380016,
        "class": 0
      },
      {
        "m": "az/php",
        "prob": 0.042114705,
        "class": 0
      }
    ],
    "version": "v16.16",
    "thresholds": [
      0.9961138,
      0.99909174
    ],
    "analyzed_at": "2026-05-09T22:42:37Z"
  },
  "path": "deserialized_plugins.php",
  "raw": {
    "v": "4",
    "fs": [
      {
        "f": "O(C)Md",
        "x": 1,
        "id": 0,
        "ms": {
          "file": {
            "size": 23973.0
          },
          "text": {
            "digit_ratio": 0.33,
            "space_count": 88.0,
            "total_lines": 292.0,
            "char_entropy": 4.22,
            "unique_chars": 87.0,
            "lines_over_200": 2.0,
            "lines_over_500": 1.0,
            "avg_line_length": 81.1,
            "max_line_length": 636.0,
            "last_line_length": 47.0,
            "long_token_count": 15.0,
            "most_common_char": "%",
            "whitespace_ratio": 0.02,
            "most_common_ratio": 0.23,
            "line_length_stddev": 36.58,
            "max_inline_whitespace_run": 1.0
          },
          "strings": {},
          "comments": {},
          "functions": {},
          "identifiers": {}
        },
        "sz": 23973,
        "ts": [
          {
            "c": 0.8999999761581421,
            "d": "Very long line",
            "e": [
              "text.max_line_length = 636.00"
            ],
            "i": "metadata/file/text/metrics::single-long-line",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "File has 30 or more lines",
            "e": [
              "text.total_lines = 292.00"
            ],
            "i": "metadata/file/text/metrics::file-has-30-plus-lines",
            "l": 1
          },
          {
            "a": "T1505.003",
            "c": 0.8399999737739563,
            "d": "Near-zero whitespace script",
            "e": [
              "text.whitespace_ratio = 0.02"
            ],
            "i": "objectives/command-and-control/backdoor/webshell/stager::near-zero-whitespace",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.699999988079071,
            "d": "Low identifier reuse ratio",
            "e": [
              "identifiers.reuse_ratio = 0.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/identifiers::low-identifier-reuse",
            "l": 2,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.699999988079071,
            "d": "Very low whitespace ratio (minified/compressed)",
            "e": [
              "text.whitespace_ratio = 0.02"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::low-whitespace",
            "l": 2,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.4000000059604645,
            "d": "Very few string literals (string obfuscation indicator)",
            "e": [
              "strings.total = 0.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/strings::few-strings",
            "l": 3,
            "m": "B0032"
          }
        ],
        "sha": "7f80b6f5c45ad475ef5d417584b3212addc2bbca03755539516f5565297500d1",
        "path": "/data/samples/bad/datasets/php-malware-analysis/backdoors/cscript/v3-01/deserialized_plugins.php",
        "type": "php"
      }
    ],
    "tv": "87c42"
  }
}