{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 0.19900932908058167,
        "class": 0
      }
    ],
    "prob": 0.19900933,
    "class": 0,
    "models": [
      {
        "m": "az",
        "prob": 0.03430774,
        "class": 0
      },
      {
        "m": "az/scripts",
        "prob": 0.19900933,
        "class": 0
      },
      {
        "m": "az/php",
        "prob": 0.03550296,
        "class": 0
      }
    ],
    "version": "v17.17",
    "thresholds": [
      0.999503,
      0.9998882
    ],
    "analyzed_at": "2026-05-25T19:00:33Z"
  },
  "path": "67d66cb8f0b95836d6a886b5aae6db7d",
  "raw": {
    "v": "5",
    "fs": [
      {
        "f": "H(F)",
        "x": 2,
        "ff": {
          "i": [
            [
              "",
              "file_exists"
            ],
            [
              "",
              "file_exists"
            ],
            [
              "",
              "unlink"
            ],
            [
              "",
              "die"
            ],
            [
              "",
              "unlink"
            ],
            [
              "",
              "die"
            ],
            [
              "",
              "json_encode"
            ],
            [
              "",
              "unlink"
            ],
            [
              "",
              "die"
            ]
          ],
          "m": {
            "ast": {
              "max_depth": 11.0,
              "bind_count": 5.0,
              "call_count": 11.0,
              "node_count": 328.0,
              "target_count": 6.0,
              "member_depth_max": 2.0,
              "string_literal_count": 15.0,
              "array_literal_max_length": 3.0
            },
            "file": {
              "size": 767.0,
              "entropy": 5.45,
              "size_bytes": 767.0
            },
            "text": {
              "tab_count": 12.0,
              "digit_ratio": 0.02,
              "space_count": 57.0,
              "total_lines": 30.0,
              "char_entropy": 5.45,
              "mixed_indent": 1.0,
              "unique_chars": 68.0,
              "string_density": 0.5,
              "avg_line_length": 23.63,
              "max_line_length": 112.0,
              "empty_line_ratio": 0.17,
              "last_line_length": 1.0,
              "whitespace_ratio": 0.17,
              "most_common_ratio": 0.06,
              "identifier_density": 1.63,
              "line_length_stddev": 27.43,
              "normalized_string_count": 2.74,
              "suspicious_string_ratio": 0.2,
              "most_common_char_is_null": 0.0,
              "max_inline_whitespace_run": 2.0,
              "most_common_char_codepoint": 101.0,
              "normalized_unique_identifiers": 4.89
            },
            "strings": {
              "total": 15.0,
              "avg_length": 14.0,
              "max_length": 41.0,
              "path_count": 4.0,
              "avg_entropy": 3.04,
              "sql_strings": 1.0,
              "total_bytes": 210.0,
              "entropy_stddev": 0.46,
              "shell_command_strings": 2.0
            },
            "identifiers": {
              "total": 49.0,
              "avg_length": 7.33,
              "max_length": 13.0,
              "min_length": 3.0,
              "avg_entropy": 2.49,
              "reuse_ratio": 0.49,
              "unique_count": 24.0,
              "length_stddev": 3.14,
              "all_lowercase_ratio": 0.58,
              "all_uppercase_ratio": 0.21
            }
          },
          "s": [
            [
              25,
              "u8",
              "../../config.php"
            ],
            [
              26,
              "u8",
              "../../config.php"
            ],
            [
              63,
              "u8",
              "../../config.php"
            ],
            [
              64,
              "u8",
              "../../config.php"
            ],
            [
              108,
              "u8",
              "../../../config.php"
            ],
            [
              109,
              "u8",
              "../../../config.php"
            ],
            [
              149,
              "u8",
              "../../../config.php"
            ],
            [
              150,
              "u8",
              "../../../config.php"
            ],
            [
              191,
              "u8",
              "emails.php"
            ],
            [
              192,
              "u8",
              "emails.php"
            ],
            [
              336,
              "u8",
              "emails.php"
            ],
            [
              337,
              "u8",
              "emails.php"
            ],
            [
              373,
              "u8",
              "SELECT firstname, lastname, email FROM  "
            ],
            [
              374,
              "u8",
              "SELECT firstname, lastname, email FROM  "
            ],
            [
              431,
              "u8",
              "customer`  LIMIT 1000000;"
            ],
            [
              432,
              "u8",
              "customer`  LIMIT 1000000;"
            ],
            [
              606,
              "u8",
              "firstname"
            ],
            [
              607,
              "u8",
              "firstname"
            ],
            [
              626,
              "u8",
              "firstname"
            ],
            [
              627,
              "u8",
              "firstname"
            ],
            [
              640,
              "u8",
              "lastname"
            ],
            [
              641,
              "u8",
              "lastname"
            ],
            [
              659,
              "u8",
              "lastname"
            ],
            [
              660,
              "u8",
              "lastname"
            ],
            [
              672,
              "u8",
              "email"
            ],
            [
              673,
              "u8",
              "email"
            ],
            [
              688,
              "u8",
              "email"
            ],
            [
              689,
              "u8",
              "email"
            ],
            [
              741,
              "u8",
              "emails.php"
            ],
            [
              742,
              "u8",
              "emails.php"
            ]
          ],
          "v": {
            "source.language": "php",
            "source.imports[0]": "die",
            "source.imports[1]": "file_exists",
            "source.imports[2]": "json_encode",
            "source.imports[3]": "unlink",
            "source.strings[0]": "../../../config.php",
            "source.strings[1]": "../../config.php",
            "source.strings[2]": "SELECT firstname, lastname, email FROM  ",
            "source.strings[3]": "customer`  LIMIT 1000000;",
            "source.strings[4]": "emails.php",
            "source.strings[5]": "firstname",
            "source.strings[6]": "lastname",
            "source.has_imports": true
          },
          "ca": [
            [
              "file_exists",
              "../../../config.php"
            ],
            [
              "file_exists",
              "../../config.php"
            ],
            [
              "unlink",
              "emails.php"
            ]
          ],
          "ct": [
            "$conn",
            "$result",
            "die",
            "file_exists",
            "json_encode",
            "unlink"
          ],
          "id": "php",
          "mc": [
            "$conn.connect_error",
            "$result.num_rows"
          ]
        },
        "id": 0,
        "sz": 767,
        "ts": [
          {
            "c": 1.0,
            "d": "PHP unlink function symbol",
            "e": [
              "unlink"
            ],
            "i": "micro-behaviors/fs/delete/file::php-unlink",
            "l": 3
          },
          {
            "a": "T1027",
            "c": 0.9200000166893005,
            "d": "HOST URL component identifier",
            "e": [
              "HOST"
            ],
            "i": "objectives/anti-static/obfuscation/payload/config::url-component-concat--rx-12",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.6000000238418579,
            "d": "JSON encoding for data output",
            "e": [
              "json_encode"
            ],
            "i": "micro-behaviors/data/serialize/object::json-encode",
            "l": 2
          },
          {
            "a": "T1071.001",
            "c": 0.8999999761581421,
            "d": "Command/result field word",
            "e": [
              "result"
            ],
            "i": "objectives/command-and-control/beacon/network/json::result-command-word",
            "l": 1,
            "m": "B0030"
          },
          {
            "d": "password keyword",
            "e": [
              "password"
            ],
            "i": "micro-behaviors/data/text/keywords/lexicon::password",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "File has 30 or more lines",
            "e": [
              "text.total_lines = 30.00"
            ],
            "i": "metadata/file/text/metrics::file-has-30-plus-lines",
            "l": 1
          },
          {
            "c": 0.949999988079071,
            "d": "PHP opening tag present",
            "e": [
              "\u003c?php"
            ],
            "i": "metadata/lang/scripted::php-open-tag",
            "l": 1
          },
          {
            "c": 0.6000000238418579,
            "d": "SELECT SQL keyword in query",
            "e": [
              "SELECT firstname, lastname, email FROM"
            ],
            "i": "micro-behaviors/data/db/conn/sql::sql-select",
            "l": 3
          },
          {
            "a": "T1110.001",
            "c": 0.8500000238418579,
            "d": "Service account mysql",
            "e": [
              "mysql"
            ],
            "i": "objectives/lateral-movement/brute-force/password::service-account-mysql",
            "l": 1,
            "m": "E1110"
          },
          {
            "c": 1.0,
            "d": "php code embedded in string",
            "e": [
              "Detected php at offset 0x0"
            ],
            "i": "metadata/lang/embedded::php",
            "l": 2
          }
        ],
        "sha": "a6f6aa94792938eae88414ebc8303d7af1df13764878df3be5fbd948dd6f8bb9",
        "path": "67d66cb8f0b95836d6a886b5aae6db7d",
        "type": "php"
      }
    ],
    "tv": "cf883"
  }
}