{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.999925971031189, "class": 2 } ], "prob": 0.999926, "class": 2, "models": [ { "m": "az", "prob": 0.98415816, "class": 0 }, { "m": "az/scripts", "prob": 0.999185, "class": 0 }, { "m": "az/php", "prob": 0.999926, "class": 2 } ], "version": "v16.16", "thresholds": [ 0.9961138, 0.99909174 ], "analyzed_at": "2026-05-09T02:29:18Z" }, "path": "136.243.192.73Wnh6QrnRsC02jHMGWXHfQwAAAAY.0.file", "raw": { "v": "4", "fs": [ { "f": "O₄(C₃PXeAs)H₂(PoOs)MdTh", "k": { "source.imports[0]": "eval", "source.strings[0]": "$k54bdbec=\"\\142\\141se6\\64\\137\\144e\\143\\157de\";@eval($k54bdbec(", "source.strings[1]": "\\142\\141\\x73\\x65\\x36\\64\\137\\144\\x65\\143\\157\\x64\\x65", "source.has_imports": true }, "x": 357, "id": 0, "is": [ "eval" ], "ms": { "file": { "size": 441273.0 }, "text": { "digit_ratio": 0.13, "space_count": 24.0, "total_lines": 5386.0, "char_entropy": 5.7, "unique_chars": 82.0, "escape_density": 0.0, "import_density": 0.02, "string_density": 0.0, "avg_line_length": 79.93, "max_line_length": 87.0, "hex_escape_count": 6.0, "last_line_length": 2.0, "most_common_char": "V", "whitespace_ratio": 0.02, "most_common_ratio": 0.04, "identifier_density": 0.0, "line_length_stddev": 2.24, "octal_escape_count": 7.0, "normalized_import_count": 0.01, "normalized_string_count": 0.04, "suspicious_comment_ratio": 1.0, "max_inline_whitespace_run": 1.0, "normalized_unique_identifiers": 0.16 }, "imports": { "total": 1.0, "unique_modules": 1.0, "third_party_count": 1.0, "third_party_ratio": 1.0 }, "strings": { "total": 3.0, "avg_length": 293978.34, "max_length": 440942.0, "avg_entropy": 4.78, "total_bytes": 881935.0, "entropy_stddev": 1.3, "very_long_strings": 2.0, "high_entropy_count": 2.0, "unicode_heavy_strings": 1.0 }, "comments": { "chars": 227.0, "lines": 4.0, "total": 1.0, "to_code_ratio": 0.0, "url_in_comments": 1.0, "high_entropy_comments": 1.0 }, "functions": {}, "identifiers": { "total": 3.0, "avg_length": 6.0, "max_length": 8.0, "min_length": 4.0, "avg_entropy": 2.38, "reuse_ratio": 0.67, "unique_count": 2.0, "length_stddev": 2.0, "has_digit_ratio": 0.5, "all_lowercase_ratio": 0.5 } }, "ss": [ [ 250, "\\142\\141\\x73\\x65\\x36\\64\\137\\144\\x65\\143\\157\\x64\\x65" ], [ 240, "unicode-escape", "$k54bdbec=\"\\142\\141se6\\64\\137\\144e\\143\\157de\";@eval($k54bdbec(" ] ], "sz": 441273, "ts": [ { "a": "T1027", "c": 0.9599999785423279, "d": "FOPO obfuscated eval marker", "e": [ "\";@eval(" ], "i": "objectives/command-and-control/backdoor/webshell/decoder::php-fopo-eval-marker", "l": 4, "m": "B0030" }, { "a": "T1505.003", "c": 0.8600000143051147, "d": "Very long embedded string", "e": [ "strings.max_length = 440942.00" ], "i": "objectives/command-and-control/backdoor/webshell/stager::very-long-string", "l": 1 }, { "c": 0.800000011920929, "d": "PHP variable function invocation pattern", "e": [ "k54bdbec" ], "i": "objectives/anti-static/obfuscation/imports::dynamic-function-execution", "l": 3 }, { "a": "T1505.003", "d": "PHP open tag", "e": [ "\u003c?php" ], "i": "objectives/command-and-control/backdoor/webshell/request::php-tag", "l": 1, "m": "B0030" }, { "c": 0.699999988079071, "d": "PHP error suppression operator usage", "e": [ "@eval($k54bdbec(\r\n\"Ly9OT3JONlU4Y0h5cDFVOHpTVVhpOWV4QmxTdzhXOXZQY1VoekdKcU9hMndkVGlHWERza0h5NkYrQml\r\n..." ], "i": "micro-behaviors/os/stdio::error-suppress-prefix", "l": 3 }, { "a": "T1053", "c": 0.8600000143051147, "d": "at atrun scheduled job", "e": [ "at 12:45" ], "i": "objectives/persistence/system/surface/paths::at-atrun-job", "l": 4 }, { "a": "T1059.006", "c": 0.75, "d": "PHP eval() token present", "e": [ "eval" ], "i": "micro-behaviors/process/interpreter/eval::eval-symbol", "l": 4, "m": "E1059" }, { "a": "T1059.001", "c": 0.8999999761581421, "d": "Error-suppressed eval (@eval)", "e": [ "@eval(" ], "i": "objectives/execution/interpreter/eval/remote::eval-error-suppressed", "l": 4, "m": "E1059" }, { "c": 0.8999999761581421, "d": "File has 30 or more lines", "e": [ "text.total_lines = 5386.00" ], "i": "metadata/file/text/metrics::file-has-30-plus-lines", "l": 1 }, { "a": "T1027", "c": 0.800000011920929, "d": "High overall text entropy (encoded", "e": [ "text.char_entropy = 5.70" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::high-text-entropy", "l": 2, "m": "B0032" }, { "a": "T1027", "c": 0.4000000059604645, "d": "Very few string literals (string obfuscation indicator)", "e": [ "strings.total = 3.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/strings::few-strings", "l": 3, "m": "B0032" }, { "a": "T1027", "c": 0.699999988079071, "d": "Very low whitespace ratio (minified/compressed)", "e": [ "text.whitespace_ratio = 0.02" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::low-whitespace", "l": 2, "m": "B0032" }, { "c": 1.0, "d": "php code embedded in string", "e": [ "Detected php at offset 0x0" ], "i": "metadata/lang/embedded::php", "l": 2 }, { "c": 0.8999999761581421, "d": "Decoded unicode-escape content", "e": [ "$k54bdbec=\"\\142\\141se6\\64\\137\\144e\\143\\1 \u003cunicode-escape\u003e" ], "i": "metadata/encoded-payload/unicode-escape", "l": 2 }, { "c": 0.8999999761581421, "d": "Detects malware from NK APT incident DE", "e": [ "Obfuscation provided by FOPO", "\";@eval($", "$f1" ], "i": "third_party/SigBase/Webshell/FOPO/Obfuscation/APT/ON/Nov17", "l": 5 }, { "c": 0.8999999761581421, "d": "PHP webshell obfuscated by encoding of mixed hex and dec", "e": [ "\"\\142\\141\\x73\\x65\\x36\\64\\137\\144\\x65\\143\\157\\x64\\", "\u003c?", "\u003c?php" ], "i": "third_party/SigBase/WEBSHELL/PHP/OBFUSC/Encoded/Mixed/Dec/And/Hex", "l": 5 }, { "c": 0.8999999761581421, "d": "PHP webshell which eval()s obfuscated string", "e": [ "eval($", "\u003c?", "O0BldmFsK", "\u003c?php" ], "i": "third_party/SigBase/WEBSHELL/PHP/OBFUSC/Fopo", "l": 5 } ], "sha": "9b7e7f40bacfe2a0d4fa9c7bc6f4a698bda17039a923a74e2a82cbdb643f39ce", "path": "136.243.192.73Wnh6QrnRsC02jHMGWXHfQwAAAAY.0.file", "type": "php" } ], "tv": "a9555" } }