{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 0.9998589754104614,
        "class": 2
      }
    ],
    "prob": 0.999859,
    "class": 2,
    "models": [
      {
        "m": "az",
        "prob": 0.9634541,
        "class": 0
      },
      {
        "m": "az/scripts",
        "prob": 0.9894778,
        "class": 0
      },
      {
        "m": "az/php",
        "prob": 0.999859,
        "class": 2
      }
    ],
    "version": "v16.16",
    "thresholds": [
      0.9961138,
      0.99909174
    ],
    "analyzed_at": "2026-05-10T01:09:23Z"
  },
  "path": "522fee056aec9055f3d5251eb7a63601",
  "raw": {
    "v": "4",
    "fs": [
      {
        "f": "H₂(CmOs)Th",
        "k": {
          "source.imports[0]": "Base64_DecodE",
          "source.imports[1]": "EvaL",
          "source.imports[2]": "array_push",
          "source.imports[3]": "basename",
          "source.imports[4]": "closedir",
          "source.imports[5]": "count",
          "source.imports[6]": "elencafiles",
          "source.imports[7]": "file_exists",
          "source.imports[8]": "is_file",
          "source.imports[9]": "opendir",
          "source.strings[0]": "HTTP_LENGTH",
          "source.strings[1]": "PHP_SELF",
          "source.strings[2]": "img/gallery/",
          "source.has_imports": true,
          "source.imports[10]": "readdir",
          "source.imports[11]": "sort",
          "source.imports[12]": "substr",
          "source.functions[0]": "elencafiles"
        },
        "x": 110,
        "id": 0,
        "is": [
          "EvaL",
          "Base64_DecodE",
          "file_exists",
          "opendir",
          "readdir",
          "is_file",
          "array_push",
          "closedir",
          "sort",
          "basename",
          "substr",
          "elencafiles",
          "count"
        ],
        "ms": {
          "file": {
            "size": 1421.0
          },
          "text": {
            "digit_ratio": 0.01,
            "space_count": 262.0,
            "total_lines": 56.0,
            "char_entropy": 5.04,
            "unique_chars": 77.0,
            "import_density": 23.21,
            "string_density": 0.14,
            "avg_line_length": 24.39,
            "max_line_length": 99.0,
            "empty_line_ratio": 0.09,
            "last_line_length": 7.0,
            "most_common_char": "e",
            "whitespace_ratio": 0.22,
            "most_common_ratio": 0.05,
            "identifier_density": 0.91,
            "line_length_stddev": 22.84,
            "normalized_import_count": 1.74,
            "normalized_string_count": 1.07,
            "repeated_char_sequences": 6.0,
            "max_inline_whitespace_run": 1.0,
            "normalized_function_count": 0.13,
            "trailing_whitespace_lines": 5.0,
            "imports_to_functions_ratio": 13.0,
            "strings_to_functions_ratio": 8.0,
            "suspicious_identifier_ratio": 0.04,
            "normalized_unique_identifiers": 3.96,
            "identifiers_to_functions_ratio": 23.0
          },
          "imports": {
            "total": 13.0,
            "unique_modules": 13.0,
            "third_party_count": 13.0,
            "third_party_ratio": 1.0
          },
          "strings": {
            "total": 8.0,
            "avg_length": 8.0,
            "max_length": 12.0,
            "avg_entropy": 2.17,
            "total_bytes": 64.0,
            "entropy_stddev": 1.26
          },
          "comments": {
            "chars": 31.0,
            "lines": 3.0,
            "total": 3.0,
            "to_code_ratio": 0.06
          },
          "functions": {
            "total": 1.0,
            "avg_name_length": 11.0,
            "no_params_count": 1.0,
            "avg_length_lines": 14.0,
            "max_length_lines": 14.0,
            "min_length_lines": 14.0,
            "density_per_100_lines": 1.79,
            "code_in_functions_ratio": 0.25
          },
          "identifiers": {
            "total": 51.0,
            "avg_length": 6.91,
            "max_length": 13.0,
            "min_length": 1.0,
            "avg_entropy": 2.42,
            "reuse_ratio": 0.45,
            "unique_count": 23.0,
            "length_stddev": 2.8,
            "has_digit_ratio": 0.04,
            "sequential_names": 1.0,
            "single_char_count": 1.0,
            "single_char_ratio": 0.04,
            "high_entropy_count": 1.0,
            "high_entropy_ratio": 0.04,
            "all_lowercase_ratio": 0.87,
            "all_uppercase_ratio": 0.04,
            "underscore_prefix_count": 1.0
          }
        },
        "ss": [
          [
            41,
            "HTTP_LENGTH"
          ],
          [
            42,
            "HTTP_LENGTH"
          ],
          [
            536,
            "PHP_SELF"
          ],
          [
            537,
            "PHP_SELF"
          ],
          [
            586,
            "img/gallery/"
          ],
          [
            587,
            "img/gallery/"
          ],
          [
            607,
            "/"
          ],
          [
            608,
            "/"
          ]
        ],
        "sz": 1421,
        "ts": [
          {
            "c": 0.8600000143051147,
            "d": "Regex component marker",
            "e": [
              "basename($_SERVER["
            ],
            "i": "objectives/command-and-control/backdoor/webshell/ui::self-named-get-form--rx-1",
            "l": 1,
            "m": "B0030"
          },
          {
            "c": 0.8600000143051147,
            "d": "Regex component marker",
            "e": [
              "$_SERVER["
            ],
            "i": "objectives/command-and-control/backdoor/webshell/ui::self-named-get-form--rx-4",
            "l": 1,
            "m": "B0030"
          },
          {
            "c": 0.8999999761581421,
            "d": "File has 30 or more lines",
            "e": [
              "text.total_lines = 56.00"
            ],
            "i": "metadata/file/text/metrics::file-has-30-plus-lines",
            "l": 1
          },
          {
            "c": 0.75,
            "d": "Generic $_SERVER superglobal access",
            "e": [
              "$_SERVER"
            ],
            "i": "micro-behaviors/communications/http/request/params::server-dup",
            "l": 3
          },
          {
            "c": 0.949999988079071,
            "d": "PHP opening tag present",
            "e": [
              "\u003c?php"
            ],
            "i": "metadata/lang/scripted::php-open-tag",
            "l": 1
          },
          {
            "c": 1.0,
            "d": ".js extension",
            "e": [
              "\"jquery.simplyscroll.js\""
            ],
            "i": "objectives/command-and-control/dropper/builder::js-ext",
            "l": 1
          },
          {
            "c": 0.8600000143051147,
            "d": "Regex component marker",
            "e": [
              "PHP_SELF"
            ],
            "i": "objectives/command-and-control/backdoor/webshell/ui::self-named-get-form--rx-2",
            "l": 1,
            "m": "B0030"
          },
          {
            "c": 0.699999988079071,
            "d": "PHP error suppression operator usage",
            "e": [
              "@EvaL ( Base64_DecodE ( $_SERVER [ 'HTTP_LENGTH' ] ) )"
            ],
            "i": "micro-behaviors/os/stdio::error-suppress-prefix",
            "l": 3
          },
          {
            "a": "T1083",
            "c": 1.0,
            "d": "Iterate directory contents via functions in PHP",
            "e": [
              "opendir("
            ],
            "i": "micro-behaviors/fs/directory/traverse::php-dir-traverse-fn",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "php code embedded in string",
            "e": [
              "Detected php at offset 0x0"
            ],
            "i": "metadata/lang/embedded::php",
            "l": 2
          },
          {
            "c": 0.8999999761581421,
            "d": "PHP webshell which directly eval()s obfuscated string",
            "e": [
              "EvaL ( Base64_DecodE (",
              "\u003c?",
              "\u003c?php"
            ],
            "i": "third_party/SigBase/WEBSHELL/PHP/Gzinflated",
            "l": 5
          }
        ],
        "sha": "81ac45eff4f8bd5f0b8e9d50420ac5fcb33c59ab3db17fb41b315886c74a9045",
        "path": "522fee056aec9055f3d5251eb7a63601",
        "type": "php"
      }
    ],
    "tv": "87c42"
  }
}