{
  "llm": {
    "conf": 0.99984086,
    "grade": "hostile",
    "model": "Qwen/Qwen3.8-27B",
    "before": {
      "lvl": 1,
      "prob": 0.9997625,
      "class": "hostile"
    },
    "outcome": "hostile",
    "interpretation": "Contains remote shell backdoor code"
  },
  "ml": {
    "v": "7",
    "eng": "2.11.0-beta.0",
    "lvl": 0,
    "conf": 100,
    "mods": [
      {
        "cls": 2,
        "raw": 0.9997625,
        "rte": "az",
        "prob": 0.9997625
      }
    ],
    "prob": 0.9997625,
    "files": [
      {
        "id": 0,
        "lvl": 0,
        "conf": 100,
        "prob": 0.9997624754905701,
        "type": "rar"
      },
      {
        "id": 1,
        "lvl": -1,
        "conf": 0,
        "prob": 0.0005476176738739014,
        "type": "text"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-09-15T21:39:24Z"
  },
  "path": "PHANTASMA.rar",
  "raw": {
    "files": [
      {
        "id": 0,
        "ctx": [
          {
            "b": "qEKO?8v3n*KAgy44fcwd00000p.[c}FgQ:$7xsCqwDhYi@ou$+E82Rr9wXc8aohxwp!i(Er6:CSk}Wn7BpXG1+-9j3-HQkBBkY+3Nk+/(9/P-eD4VTzk:8MdaV]*rzGnBBNa?Vdv}vNu\u003e?Twb",
            "ln": 0
          }
        ],
        "mol": "O(C)Th",
        "sha": "90ba00b4f301b895e907f43d9be909d4cfab85ce45700580817f1773b1d8a4fb",
        "path": "PHANTASMA.rar",
        "risk": 109,
        "size": 6040,
        "type": "rar",
        "facts": {
          "metrics": {
            "file": {
              "size": 6040,
              "entropy": 7.96
            },
            "binary": {
              "peak_region_bytes": 6040,
              "peak_region_entropy": 7.79
            }
          }
        },
        "traits": [
          {
            "id": "third_party/SigBase/PHANTASMA/Php",
            "conf": 0.9,
            "crit": 5,
            "desc": "Semi-Auto-generated  - file PHANTASMA.php.txt"
          },
          {
            "id": "objectives/command-and-control/backdoor/native-source::diff-native-connect-call",
            "mbc": "B0030",
            "conf": 0.9,
            "crit": 3,
            "desc": "Text adds a native connect call",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "objectives/command-and-control/backdoor/native-source::diff-native-stdio-duplication",
            "mbc": "B0030",
            "conf": 0.9,
            "crit": 3,
            "desc": "Text adds native stdio duplication",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "metadata/lang/natural::lang-english--atom-1",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"the\"",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "metadata/lang/natural::lang-english--atom-2",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"and\"",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "metadata/lang/natural::lang-english--atom-7",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"this\"",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "objectives/command-and-control/backdoor/native-source::diff-native-shell-exec",
            "mbc": "B0030",
            "conf": 0.95,
            "crit": 3,
            "desc": "Text adds native shell execution",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "metadata/lang/natural::lang-english--atom-5",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"for\"",
            "from": [
              {
                "file": 1
              }
            ]
          }
        ]
      },
      {
        "ctx": [
          {
            "b": "oJa+NlRg3yjT8N7j{\u003czpAa\u003cg$3lQDpB-7S8wGTbUAbP/iCWCPhvqPN7asPwVarU(wx(4u6c#rQsBsnzGzF0/ras8bsy\u0026%qrauZ\u0026UvpJ%[c)S}MvqPN8diJ%A3o{YYarS^CqA+BgarR^?r75]jl}HA4q=D)[mlI\u0026bz/fUGw)]K\u003cy\u003cw5:C4CY8vqYHnazbLfBs?MFDsYbWf/r]{j0D\u003cJkrQbmx(mK3au@4JauR\u003eKas8bsy\u0026%qikr.g.l}HAyjtfV4j{\u0026zPjtfVij{\u003czpAa\u003cg$arV7tkrYz%3lQDNr8L)",
            "ln": 490,
            "col": 38,
            "line": 18
          },
          {
            "b": "q:\u003cO+mn^F\u003epEXq+k#Hb]bVvcfrZ/[[rZ/[+nL-89j0l:Kjtf8]rZ5S0r75[SarS^1r8L)!jtfV1lqf*i3oQTMj{\u003czpAa\u003cg$3lQE9w/@GEv@k:0aW3}(a$jTY3lQDlaz24@zY*k^l}HA4q=D)[mlK)1w]zNeeOnBdx(55QaA?spwmov:j0ncNzGEEKx)KtKatC-)CSPdOk3GHxavy6:zddr)awD=+wGT([zAGNunMF20i%(rVj{?SVl}HA4q=D)[mlI\u0026bz/fUGw)]K\u003cy\u003cw5:C4CY8vqYHn",
            "ln": 1464,
            "col": 79,
            "line": 49
          },
          {
            "b": "a%}bFj0Di#bYv*EAclmKdlv(3j{\u003cz9r7f[*k#Hcqj{\u003czsqA+BIkx7pP3jm)#Ef}87arUxgasFHRvp\u003c7/z!9A4aW3}(a$jTY3lQDlaz24@zY*k^l}HA4q=D)[mlK)1w]zNeeOnBdx(55QaA?spwmov:j0ncNzGEEKx)KtKatC-)CSPdOk3GHxax8YXwO(u@wGTY=wmV(YB-6q{l}HAyb0cbskrYApl}HA4q=D)[mlI\u0026bz/fUGw)]K\u003cy\u003cw5:C4CY8vqYHnazbLfBs?MFDsYbWgb9V(j0ncNzGEEOwOC^\u003cBugKNz!@@Cay/taz/N(YbsTEPh.V{Eb0F}lw[r8Vz!9A4l${WMv@#TfC{2^{B98blxfm?nnMF1Zju)^#A0={{arR!vw/@GEwnc6bjS)1dAaJ]$x(UQEv}Yy!AW-BWDKp(rarR^HwN/y(ar\u0026{Ek%!mlayYnfwmY^Af^6$qy\u00261fivpK1?xfv%(v}xE)Aa9o/x(mMDfG{Wx3lQDlarR!rv}Y^6b0n?5j%A5}arR^HarUl9",
            "ln": 2175,
            "col": 73,
            "line": 84
          },
          {
            "b": "x\u003ewFokXUpDw[=6)c)Szsy?k4AaBsCrarR^HarR^Has7Mky?kszjS[uJy?mKezE)\u0026pbXy+bwHPXFarR^HarR^HarR}wx(4uoauZ\u0026Vx(4v1wPzTec)Szsy?k4S3lQDlapfekwN/y(ar\u0026{Wz/fUtv@Dg4AY[5QwO2:ybXy+bwICqVas7Mky?kvAeG^e:azt!bw\u003c4zrlScGLr9@x^o*}n(qb{4.sZL9bqB%RNcuA:fjTsSNy?k^Qw[=6)jtgbbjySs{b0c[O2{puzfcB?oxM21qjz5IHBrC7iy\u0026stSxl4M{zAYsTx(4unat1YYw[=6)g9wd\u003ebXy+bwGT8*w]zNek0ip{j%A5}arR^HarR^HarUojB-RjAasPwVarR^HarR^HEf}8tarR^HEf{r7arR^Haz24@zY*k^fh$t6b0cbOarR^Haz24@zZ4qyl)cUYy?WK1j-\u003eQYj%A5}arR^HarUl9xM21qjyQGpw]zNeaAImywJ.^\u003ew)]gXjZ\u0026wBvqFb3x(!wspI%#]avZo=wmY!5jtgecauTaNk0ip{j%A5}arR^HarUxgasFHCx(UsVav6\u003c:wO#3)",
            "ln": 2748,
            "col": 9,
            "line": 105
          },
          {
            "b": "ar?{JB98CBv@@\u0026mz!0M\u003ewmPZ/x(k5mx(kEAw].*bj6VUEata0zarR^HarR^HarR^Ha%n1HBAhIlBrCmnB97#hBrA5DwJKdma%nGBarR^HarR^HarR^Har?{Jv}Yp\u003eaz(gjtoEh]jS)#Ns7MhTz/65dBz\u0026o\u0026vrt{2lUG)ZB09?*zF\u003c2}BrA[Uv@0h=xK#0@tWheKtY9^\u003ctY7-de^-ZzarR^HarR^HarR^JarR^HarR^HarR^HarR^HtP#:XB9h4ptWgITwQ5fjA=-B6mn=\u0026yCYWIqz95\u003eKCX7wcvQTs\u003eat4qjtWeETtY9^\u003ctY7-de^-ZzarR^HarR^HarR^JarR^HarR^HarR^HarR^HtP#TQAV!7{A+cv\u003ewO=6?vR/P#q!P-Uy+w%$zD[w\u003czxZhQ3lQDlarR^HarR^HarR\u003cJarR^HarR^HarR^HarR!ib1V\u0026%B.8X2tWeE}zGxxhav]75r7oCMmlqSmzGxxhax7Nbmf",
            "ln": 5097,
            "col": 13,
            "line": 175
          },
          {
            "b": "ar?{JarUYoBAIRwatC@.zxZhQ3lQDlarR^HarR^HarR\u003cJaBNHja%nGBarR^HarR^HarR^Har?{Jx\u003ewFov@Dm5wN/*gB8LM7efDuZBAhIlBrCTyv@2H-wo5!xdjfaIzy=]Kx)Kuew*?.mzyE1SaW3@4diJ$xzxZhQ3lQDlarR^HarR^HarR\u003cJarR!CA+PAkw**[dtp\u003cb6rC(kOy?j-hzY?z=zF\u003c2}Bx\u00266*tP$QUtY7-de^-ZzarR^HarR^HarR^JarR^HA+funA=90Oj6VUEata0zarR^HarR^HarR^Ha%n1RtY7-de^-ZzarR^HarR^HarR^JarUSzx(n38c%N%2dQse}Aa9%dx(mMaq!P-Uy*pj.tP$QUtY7-de^-ZzarR^HarR^HarR^JarUnsjS[uPA+^6Cdly^La%nGBarR^HarR^HarR^Har?{Jx\u003ewFow/%hUfEXb\u003etY7-de^-ZzarR^HarR^HarR^JarR^HAb]VgBy(}ab3MT8axrq/vR/P#Bz\u0026o\u003ez/PR#tY9^\u003cdly^La%nGBarR^HarR^HarR^Har?{JarUYoBAIRwatC@.zxZhQ3lQDlarR^HarR^HarR\u003cJaBLwzy\u0026:egx\u003ewFoa.AeCDT7Cjata0zarR^HarR^HarR^Ha%n0JaA}\u003cuBy=\u003ewz!0Mlaz(gjefG1FDs.2bc#B3rdjEt-zxZhQ3lQDlarR^HarR^HarR\u003cJarR!qB-o8:B8LM7efDR}j6VUEata0zarR^HarR^HarR^Ha%n0Jay]RlgamiZv@0Rrf!2g?zxZhQ3lQDlarR^HarR^HarR\u003cJarR!qB-o8:B8LM7efDX%j6VUEata0zarR^HarR^HarR^Ha%n0Jaz2!ev@9L#a$)ztzzc6AtP$ZwtQ1l5wO=f/a$K\u003cirzl7nj6VUEata0zarR^HarR^HarR^Ha%n0Jay/kaB7D+vz!0Mij6VUEata0zarR^HarR^HarR^Ha%n0JaAz4nB-IvxfGSJSa%nGBarR^HarR^HarR^Har?{JEoZUlata0zarR^HarR^H",
            "ln": 7351,
            "col": 13,
            "line": 219
          },
          {
            "b": "arR^HarR^Hb7iZlb0cbsarR^HbXz0rjS[uPAaJ]na$[4PA4+:ieN@ZpzE)s1vQS+Ze[l7Rar(1Ndlv\u003eVarR^Lz!*EUazb?rx()]mbXz0Das82wwO=fii%(rqarR!vw/@GBwO(ydC{\u003c}RyBHXPDKp(rarR^HwN/y(ar\u0026{onMD%jr9q)-jZogyz/fUGw)]K\u003cy\u003cw5:C4CY8vqYHnazbLfBs?MFDsYbWf/r]{j6S%[tpJ]3lVl\u003cWwN/*8lsBwtax8@+y?$j}vriL\u0026BZ[])B8$@oy\u003cvc\u003cz/xA4wiqIknMF20i%)8MarV7PwO=B0aBsCrarR^Haz24@zY*k^l}HA4q=D)[mlK)1w]zNeeOnBdx(55QaA?spwmov:j0ncNzGEEKx)KtKatC-)CSPdOk3GQAavf(/mriA!AV^[YB0am*B-IIlwfs@!x(4u6lVl{?x(mMaq!P-Uy=\u003cvsnMF20i%)8MarV7tarV7t3lQE9",
            "ln": 8259,
            "col": 6,
            "line": 241
          },
          {
            "b": "e)Jorata0zarR^HarR^HarR^Har?{TtY7-de^-ZzarR^HarR^HarR^Ha%nuTra]?=vS=raCvtLnw]z*fwftubaw=G?y-\u003eb$xKK+XwL%%1q/(C*Ds.hAauTQKB.\u003crSB7F\u0026lAbmZyzxZhQ3lQDlarR^HarR^HarR^JasZSla%nGBarR^HarR^HarR^HarR\u003cJdJ?i6A=+#aAV/ylB7F^2v}V#[zE:(3CYmFqx(\u003eFdwP?T3z/xM8zGE1gD0Ckhata0zarR^HarR^HarR^Har?{TaxJF@v}/H:xDQb]A:%AvzGxPcauTdIx(E-Jx(^\u0026}e]UR\u003cayPd#aw=G?y-(U#vr8",
            "ln": 8786,
            "col": 59,
            "line": 256
          },
          {
            "b": "arR^HarR^HarR^Ha%nvuzxZhQ3lQDlarR^HarR^HarR^JasXGZv\u003c@JQfFCp9lVl{?A+Pf1BrC4raw3lPqfuCFayPd#ay/k4Aa*\u003cDl2puWqFx=SBAnN5wPIB6C4ChptY7-de^-ZzarR^HarR^HarR^Ha%nvuzxZhQ3lQDlarR^HarR^HarR^JasXH3pF+g=p5",
            "ln": 9069,
            "col": 3,
            "line": 262
          },
          {
            "b": "lM^G]arR^HarR^HarSv.wmYvYv}xf[fdF8oaAIjmB.\u003eOoC4z!nvru6#By!#9Bzbxfaz#ssvR6N5eN@QhAa*vzfi\u0026xsata0zarR^HarR^HarR^Har\u00264vwObT]wGTApr8M\u003eao*IovlM!6/zxZhQ3lQDlarR^HarR^HarR^Jbv\u003ev$x(mG8mnu/WsZKV+",
            "ln": 10439,
            "col": 28,
            "line": 293
          },
          {
            "b": "vr9FuayPq6C3wk{jS]7]uR\u003c3/nmaXZnjuiCefEX/oIuNSj6VUEata0zarR^HarR^HarR^Har?{JarR^HwQ4=@C4A7ep^F5KuQvWZmncxaayPq6B$s+EzGY-mz/d0=tY7-de^-ZzarR^HarR^HarR^Ha%n0JarR!svrt{]c%N@@zEE0\u003cwGV8kaAIHgCwXKAxK#0@tWheKa$kPUzxZhQ3lQDlarR^HarR^HarR^JEoZUlata0zarR^HarR^",
            "ln": 21370,
            "col": 24,
            "line": 500
          },
          {
            "b": "b7iZlb0cbsarR^HbXz0rjS[uPAaJ]na$[4PA4=DPy*QT(yC69vefDcXa$kOXarR^HbYvDvjS[uXA+PSbc)SzzefDiNwPzW1y:?BMarR^H3lQDlazCBgc)resAccvNbYvDEdiJ%AarR^HarUl9xM21qjvz+wax8lxoHR9Hb4++hBs?9kze0*iiV@PSA+5P@vlkPzz/fUGB7]@iiV{dmAcKDHb0GiXt{8*PzGQgDoMaAHy-(wZA=bD8avQJ]y\u0026s3faxI#)ax9z)v}x.5w{4{navy6^x\u003ep*qfgnxjj%A5}arR^HEe",
            "ln": 22992,
            "col": 15,
            "line": 533
          },
          {
            "b": "kXt4FvpQ=iw]Gpzg+Z{Fdlv\u003eVarR!vw/@Hkze:Pxc)S?AvpQ/oayYw5vqv}iarR^HbYvDvjS[uXA+PSbc)Szzf!sB)A+eV\u0026dlv\u003eVarR^larR^Hx\u003ewFowO(ydC{\u003c}RyBHXPDKp(rarR^HwN/y(ar\u0026{onMD%jr9q)-jZogyz/fUGw)]K\u003cy\u003cw5:C4CY8vqYHnazbLfBs?MFDsYbWf/r]{j6S%[tp\u003cb6l2E/lA=M8sav]{ZawVG\u0026A=L-4axJk\u003cy?j.?AboD3wnb{]avZ6YwJRRlnMF20i%)8MarR^HvSD3*yDz\u003eCarR!P3lQEt3jm)#x\u003ewFoa.tIfBA]nWz!*^JaBsCrarR!rv}Y^6b0nm+rV\u003esusXImEtQ0=#zGEExvqPZ{C@^6\u003ewPzr\u0026zECQHw]zNeePUSLwJy}*he)!4tP#vodQse^x(4u6s7cd)q/#OWwPI{8B.(sCrD8+)vpS}Wjtf8]rZ4Y?3lQEt3vJl*w]8QhxEB#Li%(rFfcA-bzES",
            "ln": 23924,
            "col": 13,
            "line": 568
          }
        ],
        "depth": 1,
        "facts": {
          "metrics": {
            "file": {
              "size": 25944,
              "entropy": 4.41
            },
            "binary": {
              "peak_region_bytes": 5120,
              "peak_region_entropy": 5.47
            }
          }
        },
        "id": 1,
        "mol": "O(C)Th",
        "path": "PHANTASMA.rar!!PHANTASMA.txt",
        "pid": 0,
        "risk": 109,
        "sha": "d722416bcf1f2aea420bece7082887fcab1dcca1aae970baeccb326179f7c4ba",
        "size": 25944,
        "traits": [
          {
            "id": "metadata/lang/natural::lang-english--atom-1",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"the\"",
            "spans": [
              [
                8834,
                0
              ]
            ]
          },
          {
            "id": "metadata/lang/natural::lang-english--atom-2",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"and\"",
            "spans": [
              [
                8957,
                0
              ]
            ]
          },
          {
            "id": "metadata/lang/natural::lang-english--atom-5",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"for\"",
            "spans": [
              [
                5383,
                0
              ]
            ]
          },
          {
            "id": "metadata/lang/natural::lang-english--atom-7",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"this\"",
            "spans": [
              [
                10487,
                0
              ]
            ]
          },
          {
            "id": "micro-behaviors/fs/directory/mkdir::temp-mkdir-command--rx-5",
            "conf": 0.75,
            "crit": 1,
            "desc": "Temporary directory path reference",
            "spans": [
              [
                8291,
                0
              ]
            ]
          },
          {
            "id": "objectives/command-and-control/backdoor/native-source::diff-native-connect-call",
            "mbc": "B0030",
            "conf": 0.9,
            "crit": 3,
            "desc": "Text adds a native connect call",
            "spans": [
              [
                7415,
                8
              ]
            ]
          },
          {
            "id": "objectives/command-and-control/backdoor/native-source::diff-native-shell-exec",
            "mbc": "B0030",
            "conf": 0.95,
            "crit": 3,
            "desc": "Text adds native shell execution",
            "spans": [
              [
                8045,
                6
              ],
              [
                21434,
                7
              ]
            ]
          },
          {
            "id": "objectives/command-and-control/backdoor/native-source::diff-native-stdio-duplication",
            "mbc": "B0030",
            "conf": 0.9,
            "crit": 3,
            "desc": "Text adds native stdio duplication",
            "spans": [
              [
                7922,
                5
              ]
            ]
          },
          {
            "id": "third_party/SigBase/PHANTASMA/Php",
            "conf": 0.9,
            "crit": 5,
            "desc": "Semi-Auto-generated  - file PHANTASMA.php.txt",
            "spans": [
              [
                2315,
                28
              ],
              [
                2876,
                76
              ],
              [
                5225,
                5
              ],
              [
                7622,
                18
              ]
            ]
          }
        ],
        "type": "text"
      }
    ],
    "rev": "e86a6",
    "v": "8"
  }
}