{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 0.968811571598053,
        "class": 2
      }
    ],
    "prob": 0.9688116,
    "class": 2,
    "models": [
      {
        "m": "az",
        "prob": 0.1579679,
        "class": 0
      },
      {
        "m": "az/scripts",
        "prob": 0.08264583,
        "class": 0
      },
      {
        "m": "az/php",
        "prob": 0.9688116,
        "class": 2
      }
    ],
    "version": "v16.16",
    "thresholds": [
      0.9961138,
      0.99909174
    ],
    "analyzed_at": "2026-05-09T12:21:47Z"
  },
  "path": "short",
  "raw": {
    "v": "4",
    "fs": [
      {
        "f": "O₄(DyAsC₃I)H₄(CmFOsDb₂)Md₂(Pt)",
        "k": {
          "source.imports[0]": "CheckWritable",
          "source.imports[1]": "GetDocRoot",
          "source.imports[2]": "GetFileList",
          "source.imports[3]": "GetPathDiff",
          "source.imports[4]": "GetSpaceString",
          "source.imports[5]": "GetWritableFiles",
          "source.imports[6]": "PatchPayload",
          "source.imports[7]": "array_merge",
          "source.imports[8]": "array_unique",
          "source.imports[9]": "basename",
          "source.strings[0]": "DIRECTORY_SEPARATOR",
          "source.strings[1]": "DOCUMENT_ROOT",
          "source.strings[2]": "HTTP_HOST",
          "source.strings[3]": "PHP_EOL",
          "source.strings[4]": "PHP_SELF",
          "source.strings[5]": "REQUEST_URI",
          "source.strings[6]": "SCRIPT_FILENAME",
          "source.strings[7]": "STATUS_CANTUPLOAD",
          "source.strings[8]": "STATUS_UNWRITABLE",
          "source.strings[9]": "URL#http://",
          "source.has_imports": true,
          "source.imports[10]": "closedir",
          "source.imports[11]": "count",
          "source.imports[12]": "define",
          "source.imports[13]": "defined",
          "source.imports[14]": "fclose",
          "source.imports[15]": "file_exists",
          "source.imports[16]": "file_get_contents",
          "source.imports[17]": "file_put_contents",
          "source.imports[18]": "fopen",
          "source.imports[19]": "function_exists",
          "source.imports[20]": "fwrite",
          "source.imports[21]": "in_array",
          "source.imports[22]": "is_dir",
          "source.imports[23]": "is_file",
          "source.imports[24]": "is_writable",
          "source.imports[25]": "opendir",
          "source.imports[26]": "rawurldecode",
          "source.imports[27]": "readdir",
          "source.imports[28]": "rtrim",
          "source.imports[29]": "shuffle",
          "source.imports[30]": "srand",
          "source.imports[31]": "stat",
          "source.imports[32]": "strlen",
          "source.imports[33]": "strpos",
          "source.imports[34]": "strrpos",
          "source.imports[35]": "substr",
          "source.imports[36]": "time",
          "source.imports[37]": "touch",
          "source.strings[10]": "file_put_contents",
          "source.strings[11]": "{$dir}/{$f}",
          "source.functions[0]": "CheckWritable",
          "source.functions[1]": "GetDocRoot",
          "source.functions[2]": "GetFileList",
          "source.functions[3]": "GetPathDiff",
          "source.functions[4]": "GetSpaceString",
          "source.functions[5]": "GetWritableFiles",
          "source.functions[6]": "PatchPayload",
          "source.functions[7]": "file_put_contents"
        },
        "x": 4,
        "id": 0,
        "is": [
          "defined",
          "define",
          "defined",
          "define",
          "srand",
          "time",
          "function_exists",
          "fopen",
          "fwrite",
          "fclose",
          "strpos",
          "substr",
          "strlen",
          "GetDocRoot",
          "strrpos",
          "substr",
          "GetDocRoot",
          "strlen",
          "in_array",
          "array_merge",
          "GetFileList",
          "CheckWritable",
          "array_unique",
          "is_writable",
          "strlen",
          "rtrim",
          "opendir",
          "readdir",
          "is_file",
          "strpos",
          "is_dir",
          "array_merge",
          "GetFileList",
          "closedir",
          "strrpos",
          "substr",
          "file_exists",
          "stat",
          "file_get_contents",
          "strpos",
          "GetSpaceString",
          "rawurldecode",
          "file_put_contents",
          "touch",
          "GetDocRoot",
          "GetWritableFiles",
          "count",
          "shuffle",
          "strpos",
          "basename",
          "GetPathDiff",
          "strpos",
          "PatchPayload"
        ],
        "ms": {
          "file": {
            "size": 4422.0
          },
          "text": {
            "digit_ratio": 0.01,
            "space_count": 1152.0,
            "total_lines": 156.0,
            "char_entropy": 4.78,
            "unique_chars": 77.0,
            "import_density": 33.97,
            "string_density": 0.39,
            "ascii_art_lines": 2.0,
            "avg_line_length": 27.35,
            "max_line_length": 96.0,
            "last_line_length": 5.0,
            "most_common_char": "e",
            "whitespace_ratio": 0.3,
            "most_common_ratio": 0.05,
            "identifier_density": 1.29,
            "line_length_stddev": 21.57,
            "normalized_import_count": 4.24,
            "normalized_string_count": 4.88,
            "repeated_char_sequences": 29.0,
            "suspicious_string_ratio": 0.03,
            "max_inline_whitespace_run": 1.0,
            "normalized_function_count": 0.64,
            "imports_to_functions_ratio": 6.63,
            "strings_to_functions_ratio": 7.63,
            "suspicious_identifier_ratio": 0.04,
            "normalized_unique_identifiers": 10.29,
            "identifiers_to_functions_ratio": 9.38
          },
          "imports": {
            "total": 53.0,
            "unique_modules": 38.0,
            "third_party_count": 53.0,
            "third_party_ratio": 1.0
          },
          "strings": {
            "total": 61.0,
            "avg_length": 7.87,
            "max_length": 19.0,
            "avg_entropy": 1.94,
            "total_bytes": 480.0,
            "entropy_stddev": 1.41,
            "embedded_code_candidates": 2.0
          },
          "comments": {
            "chars": 145.0,
            "lines": 2.0,
            "total": 2.0,
            "to_code_ratio": 0.01
          },
          "functions": {
            "total": 8.0,
            "length_stddev": 6.96,
            "avg_name_length": 13.0,
            "no_params_count": 8.0,
            "avg_length_lines": 14.63,
            "max_length_lines": 28.0,
            "min_length_lines": 8.0,
            "high_entropy_names": 1.0,
            "density_per_100_lines": 5.13,
            "code_in_functions_ratio": 0.75
          },
          "identifiers": {
            "total": 201.0,
            "avg_length": 8.16,
            "max_length": 19.0,
            "min_length": 1.0,
            "avg_entropy": 2.5,
            "reuse_ratio": 0.37,
            "unique_count": 75.0,
            "length_stddev": 4.16,
            "sequential_names": 3.0,
            "single_char_count": 3.0,
            "single_char_ratio": 0.04,
            "high_entropy_count": 1.0,
            "high_entropy_ratio": 0.01,
            "all_lowercase_ratio": 0.87,
            "all_uppercase_ratio": 0.04,
            "underscore_prefix_count": 1.0
          }
        },
        "ss": [
          [
            19,
            "PHP_EOL"
          ],
          [
            20,
            "PHP_EOL"
          ],
          [
            44,
            "PHP_EOL"
          ],
          [
            45,
            "PHP_EOL"
          ],
          [
            55,
            "\\n"
          ],
          [
            77,
            "DIRECTORY_SEPARATOR"
          ],
          [
            78,
            "DIRECTORY_SEPARATOR"
          ],
          [
            114,
            "DIRECTORY_SEPARATOR"
          ],
          [
            115,
            "DIRECTORY_SEPARATOR"
          ],
          [
            137,
            "/"
          ],
          [
            138,
            "/"
          ],
          [
            239,
            "file_put_contents"
          ],
          [
            240,
            "file_put_contents"
          ],
          [
            349,
            "w"
          ],
          [
            350,
            "w"
          ],
          [
            875,
            "SCRIPT_FILENAME"
          ],
          [
            876,
            "SCRIPT_FILENAME"
          ],
          [
            1824,
            "\\\\/"
          ],
          [
            1827,
            "/"
          ],
          [
            1973,
            "."
          ],
          [
            1974,
            "."
          ],
          [
            1988,
            ".."
          ],
          [
            1989,
            ".."
          ],
          [
            2024,
            "{$dir}/{$f}"
          ],
          [
            2031,
            "/"
          ],
          [
            2123,
            ".php"
          ],
          [
            2124,
            ".php"
          ],
          [
            2516,
            "SCRIPT_FILENAME"
          ],
          [
            2517,
            "SCRIPT_FILENAME"
          ],
          [
            2545,
            "REQUEST_URI"
          ],
          [
            2546,
            "REQUEST_URI"
          ],
          [
            2620,
            "DOCUMENT_ROOT"
          ],
          [
            2621,
            "DOCUMENT_ROOT"
          ],
          [
            2689,
            "/"
          ],
          [
            2690,
            "/"
          ],
          [
            2738,
            "SCRIPT_FILENAME"
          ],
          [
            2739,
            "SCRIPT_FILENAME"
          ],
          [
            2883,
            " "
          ],
          [
            2884,
            " "
          ],
          [
            3112,
            "eval"
          ],
          [
            3113,
            "eval"
          ],
          [
            3157,
            "\u003c?php"
          ],
          [
            3158,
            "\u003c?php"
          ],
          [
            3214,
            "; ?\u003e"
          ],
          [
            3215,
            "; ?\u003e"
          ],
          [
            3380,
            "mtime"
          ],
          [
            3381,
            "mtime"
          ],
          [
            3675,
            "HTTP_HOST"
          ],
          [
            3676,
            "HTTP_HOST"
          ],
          [
            3812,
            "STATUS_UNWRITABLE"
          ],
          [
            3813,
            "STATUS_UNWRITABLE"
          ],
          [
            4036,
            "PHP_SELF"
          ],
          [
            4037,
            "PHP_SELF"
          ],
          [
            4201,
            "/"
          ],
          [
            4202,
            "/"
          ],
          [
            4225,
            "/"
          ],
          [
            4226,
            "/"
          ],
          [
            4310,
            "URL#http://"
          ],
          [
            4311,
            "URL#http://"
          ],
          [
            4395,
            "STATUS_CANTUPLOAD"
          ],
          [
            4396,
            "STATUS_CANTUPLOAD"
          ]
        ],
        "sz": 4422,
        "ts": [
          {
            "c": 0.949999988079071,
            "d": "PHP open tag (\u003c?php)",
            "e": [
              "\u003c?php"
            ],
            "i": "metadata/lang/scripted::php-open-tag",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.9200000166893005,
            "d": "bytes() literal (Python byte array)",
            "e": [
              "bytes"
            ],
            "i": "objectives/anti-static/obfuscation/payload/config::api-named-byte-array-const--rx-6",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.8600000143051147,
            "d": "Regex component marker",
            "e": [
              "basename($_SERVER["
            ],
            "i": "objectives/command-and-control/backdoor/webshell/ui::self-named-get-form--rx-1",
            "l": 1,
            "m": "B0030"
          },
          {
            "a": "T1505.003",
            "c": 0.8999999761581421,
            "d": "PHP source imports file_put_contents",
            "e": [
              "[CheckWritable, GetDocRoot, GetFileList, GetPathDiff, GetSpaceString, GetWritableFiles, PatchPayload, array_merge, array_unique,"
            ],
            "i": "objectives/command-and-control/backdoor/webshell/stager::source-import-file-put-contents",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "Writes data to an open file",
            "e": [
              "fwrite"
            ],
            "i": "micro-behaviors/fs/write/file/direct::fwrite",
            "l": 3,
            "m": "C0052"
          },
          {
            "c": 0.699999988079071,
            "d": "\"directory\" path-target noun",
            "e": [
              "directory"
            ],
            "i": "micro-behaviors/data/text/llm/action::llm-path-noun-directory",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "PHP error suppression operator usage",
            "e": [
              "@stat($path)",
              "@touch($path, $mod_time['mtime'])",
              "@is_writable($file)",
              "@$_SERVER['HTTP_HOST']",
              "@fopen($filename, 'w')",
              "@file_get_contents($path)",
              "@opendir($dir)",
              "@file_put_contents($path, $data)"
            ],
            "i": "micro-behaviors/os/stdio::error-suppress-prefix",
            "l": 3
          },
          {
            "c": 0.8999999761581421,
            "d": "File has 30 or more lines",
            "e": [
              "text.total_lines = 156.00"
            ],
            "i": "metadata/file/text/metrics::file-has-30-plus-lines",
            "l": 1
          },
          {
            "c": 0.6000000238418579,
            "d": "payload keyword",
            "e": [
              "payload"
            ],
            "i": "micro-behaviors/data/text/keywords/lexicon::payload",
            "l": 1
          },
          {
            "c": 0.8399999737739563,
            "d": "\"upload\" string-literal token",
            "e": [
              "STATUS_CANTUPLOAD"
            ],
            "i": "micro-behaviors/data/text/llm/action::llm-send-action--rx-11",
            "l": 1
          },
          {
            "c": 0.8600000143051147,
            "d": "Regex component marker",
            "e": [
              "$_SERVER["
            ],
            "i": "objectives/command-and-control/backdoor/webshell/ui::self-named-get-form--rx-4",
            "l": 1,
            "m": "B0030"
          },
          {
            "a": "T1505.003",
            "c": 0.9399999976158142,
            "d": "file_get_contents (raw POST body reader)",
            "e": [
              "file_get_contents"
            ],
            "i": "objectives/command-and-control/backdoor/webshell/request::raw-json-post-cmd-field--rx-7",
            "l": 1,
            "m": "B0030"
          },
          {
            "c": 0.75,
            "d": "Generic $_SERVER superglobal access",
            "e": [
              "$_SERVER"
            ],
            "i": "micro-behaviors/communications/http/request/params::server-dup",
            "l": 3
          },
          {
            "c": 0.8199999928474426,
            "d": "fopen() with w/x/c overwrite mode",
            "e": [
              "fopen($filename, 'w'"
            ],
            "i": "objectives/impact/infect/script::php-overwrite-file-mode",
            "l": 1
          },
          {
            "a": "T1083",
            "c": 1.0,
            "d": "Iterate directory contents via functions in PHP",
            "e": [
              "opendir("
            ],
            "i": "micro-behaviors/fs/directory/traverse::php-dir-traverse-fn",
            "l": 2
          },
          {
            "a": "T1105",
            "c": 0.800000011920929,
            "d": "Creates or overwrites a local file",
            "e": [
              "file_put_contents"
            ],
            "i": "micro-behaviors/fs/write/file/direct::file-put-contents",
            "l": 3,
            "m": "C0052"
          },
          {
            "a": "T1027",
            "c": 0.9200000166893005,
            "d": "HOST URL component identifier",
            "e": [
              "HOST"
            ],
            "i": "objectives/anti-static/obfuscation/payload/config::url-component-concat--rx-12",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.8600000143051147,
            "d": "Regex component marker",
            "e": [
              "PHP_SELF"
            ],
            "i": "objectives/command-and-control/backdoor/webshell/ui::self-named-get-form--rx-2",
            "l": 1,
            "m": "B0030"
          },
          {
            "a": "T1546",
            "c": 1.0,
            "d": "Writes data to a file via functions",
            "e": [
              "file_put_contents("
            ],
            "i": "micro-behaviors/fs/file/write/direct::php-file-write-func",
            "l": 2
          },
          {
            "a": "T1082",
            "c": 0.6000000238418579,
            "d": "Accesses DOCUMENT_ROOT variable",
            "e": [
              "$_SERVER['DOCUMENT_ROOT']"
            ],
            "i": "objectives/discovery/system/fingerprint/info::document-root-access",
            "l": 3,
            "m": "E1082"
          },
          {
            "c": 1.0,
            "d": "php code embedded in string",
            "e": [
              "Detected php at offset 0x0"
            ],
            "i": "metadata/lang/embedded::php",
            "l": 2
          }
        ],
        "sha": "acaf5ea862dc04b8038118079ae440effca69e5803ecaa8b86e85dc8b708a6cf",
        "path": "short",
        "type": "php"
      }
    ],
    "tv": "0a4d2"
  }
}