{
  "ml": {
    "v": "7",
    "eng": "2.0.1-rc.1",
    "lvl": -1,
    "conf": 0,
    "mods": [
      {
        "cls": 0,
        "raw": 0.00001035134,
        "rte": "az",
        "prob": 0.00001035134
      },
      {
        "cls": 0,
        "raw": 0.000009149313,
        "rte": "az/scripts",
        "prob": 0.000009149313
      },
      {
        "cls": 0,
        "raw": 0.23788437,
        "rte": "az/php",
        "prob": 0.23788437
      }
    ],
    "prob": 0.00001035134,
    "files": [
      {
        "id": 0,
        "lvl": -1,
        "conf": 0,
        "prob": 0.000010351340279157739,
        "type": "php"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-06-15T10:13:06Z"
  },
  "path": "tst.php",
  "raw": {
    "v": "7",
    "tv": "061e3",
    "files": [
      {
        "id": 0,
        "ctx": [
          {
            "a": 285,
            "b": "arR^HbYdalB75Y)auZ?\u003eq!P-Uy-(q\u003caxJG4yIvW0ata\u0026\u003cbY)Evi$h",
            "l": 9
          },
          {
            "a": 328,
            "b": "arR^HbXQ:$wmY!5auZ?\u003emSJA:iWbX0as7Mtz/4MB",
            "l": 10
          },
          {
            "a": 361,
            "b": "arR^Hzddc{c)S[Mef]pVvRPE:BsXXOwPI{3xjSRpbXQ:$wmY!5dlv$",
            "l": 11,
            "n": [
              {
                "c": 3,
                "d": "Sends email via mail()",
                "i": "micro-behaviors/communications/email/send/mail-func::mail-call",
                "o": 365,
                "z": 4
              }
            ]
          },
          {
            "a": 405,
            "b": "arR^HwN/y(ar\u003c=@B95Kozddc{aAIaiBrS^Q",
            "l": 12
          },
          {
            "a": 434,
            "b": "krY",
            "l": 13
          }
        ],
        "sha": "893b569f59462f55011e26dd89c44a581eeff2619da7ce7bcf270a3001d58e68",
        "fact": {
          "id": "php",
          "imp": [
            [
              "",
              "ini_set"
            ],
            [
              "",
              "error_reporting"
            ],
            [
              "",
              "rand"
            ],
            [
              "",
              "mail"
            ]
          ],
          "met": {
            "ast": {
              "max_depth": 8.0,
              "op.concat": 3.0,
              "bind_count": 7.0,
              "call_count": 4.0,
              "node_count": 155.0,
              "identifier_count": 12.0,
              "op_density.concat": 0.02,
              "string_literal_count": 8.0
            },
            "file": {
              "size": 436.0,
              "entropy": 5.08,
              "size_bytes": 436.0
            },
            "text": {
              "tab_count": 1.0,
              "digit_ratio": 0.13,
              "space_count": 70.0,
              "total_lines": 13.0,
              "char_entropy": 5.08,
              "mixed_indent": 1.0,
              "unique_chars": 61.0,
              "string_density": 0.62,
              "avg_line_length": 31.69,
              "max_line_length": 70.0,
              "last_line_length": 2.0,
              "whitespace_ratio": 0.22,
              "most_common_ratio": 0.06,
              "identifier_density": 2.38,
              "line_length_stddev": 18.04,
              "normalized_string_count": 2.22,
              "repeated_char_sequences": 1.0,
              "most_common_char_is_null": 0.0,
              "max_inline_whitespace_run": 1.0,
              "trailing_whitespace_lines": 2.0,
              "most_common_char_codepoint": 101.0,
              "normalized_unique_identifiers": 5.13
            },
            "binds": {
              "count": 7.0
            },
            "calls": {
              "count": 4.0
            },
            "binary": {
              "overall_entropy": 5.08
            },
            "strings": {
              "total": 8.0,
              "avg_length": 17.0,
              "max_length": 36.0,
              "avg_entropy": 3.37,
              "total_bytes": 136.0,
              "entropy_stddev": 0.62
            },
            "identifiers": {
              "count": 12.0,
              "total": 31.0,
              "avg_length": 6.21,
              "max_length": 15.0,
              "min_length": 2.0,
              "avg_entropy": 2.25,
              "reuse_ratio": 0.61,
              "unique_count": 19.0,
              "length_stddev": 2.91,
              "all_lowercase_ratio": 0.53,
              "all_uppercase_ratio": 0.05
            }
          },
          "str": [
            [
              32,
              "u8",
              "display_errors"
            ],
            [
              33,
              "u8",
              "display_errors"
            ],
            [
              50,
              "10",
              "1"
            ],
            [
              95,
              "u8",
              "Link Shell: http://facebook.com"
            ],
            [
              96,
              "u8",
              "Link Shell: http://facebook.com"
            ],
            [
              145,
              "u8",
              "service@"
            ],
            [
              146,
              "u8",
              "service@"
            ],
            [
              173,
              "10",
              "100000000"
            ],
            [
              183,
              "10",
              "100000000000000000"
            ],
            [
              215,
              "u8",
              "x1x2x3x@outlook.fr,tnxahmed@inbox.eu"
            ],
            [
              216,
              "u8",
              "x1x2x3x@outlook.fr,tnxahmed@inbox.eu"
            ],
            [
              271,
              "u8",
              "Mailer V2"
            ],
            [
              272,
              "u8",
              "Mailer V2"
            ],
            [
              300,
              "u8",
              "Shell Is Working ."
            ],
            [
              301,
              "u8",
              "Shell Is Working ."
            ],
            [
              343,
              "u8",
              "From:"
            ],
            [
              344,
              "u8",
              "From:"
            ],
            [
              414,
              "u8",
              "Test email sent"
            ],
            [
              415,
              "u8",
              "Test email sent"
            ]
          ],
          "tgt": [
            "error_reporting",
            "ini_set",
            "mail",
            "rand"
          ],
          "val": {
            "file.stem": "tst",
            "file.basename": "tst.php",
            "source.language": "php",
            "source.imports[0]": "error_reporting",
            "source.imports[1]": "ini_set",
            "source.imports[2]": "mail",
            "source.imports[3]": "rand",
            "source.strings[0]": "100000000",
            "source.strings[1]": "100000000000000000",
            "source.strings[2]": "Link Shell: http://facebook.com",
            "source.strings[3]": "Mailer V2",
            "source.strings[4]": "Shell Is Working .",
            "source.strings[5]": "Test email sent",
            "source.strings[6]": "display_errors",
            "source.strings[7]": "service@",
            "source.strings[8]": "x1x2x3x@outlook.fr,tnxahmed@inbox.eu",
            "source.has_imports": true
          }
        },
        "find": [
          {
            "id": "micro-behaviors/communications/email/send/mail-func::mail-call",
            "conf": 0.6000000238418579,
            "crit": 3,
            "desc": "Sends email via mail()"
          }
        ],
        "path": "/data/samples/bad/datasets/various/awesome-malware/PHP/tst.php",
        "risk": 1,
        "size": 436,
        "type": "php"
      }
    ]
  }
}