{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 0.9889166355133057,
        "class": 2
      }
    ],
    "prob": 0.98891664,
    "class": 2,
    "models": [
      {
        "m": "az",
        "prob": 0.3499764,
        "class": 0
      },
      {
        "m": "az/scripts",
        "prob": 0.7469192,
        "class": 0
      },
      {
        "m": "az/php",
        "prob": 0.98891664,
        "class": 2
      }
    ],
    "version": "v16.16",
    "thresholds": [
      0.9961138,
      0.99909174
    ],
    "analyzed_at": "2026-05-09T04:33:00Z"
  },
  "path": "ex.php",
  "raw": {
    "v": "4",
    "fs": [
      {
        "f": "O₃(C₃IS)H₄(PoCmF₂Db)Md",
        "k": {
          "source.imports[0]": "array_diff",
          "source.imports[1]": "basename",
          "source.imports[2]": "copy",
          "source.imports[3]": "date",
          "source.imports[4]": "dirname",
          "source.imports[5]": "eval",
          "source.imports[6]": "fclose",
          "source.imports[7]": "file_get_contents",
          "source.imports[8]": "file_put_contents",
          "source.imports[9]": "findFilesFromDirectory",
          "source.strings[0]": "\u003cbr\u003e\\n",
          "source.strings[1]": "H:i:s ",
          "source.strings[2]": "https://pastebin.com/raw/hpqEekGT",
          "source.strings[3]": "https://pastebin.com/raw/kHL0XPea",
          "source.strings[4]": "result.txt",
          "source.strings[5]": "wp-config.php",
          "source.strings[6]": "wp-system.php",
          "source.has_imports": true,
          "source.imports[10]": "fopen",
          "source.imports[11]": "fwrite",
          "source.imports[12]": "is_dir",
          "source.imports[13]": "is_file",
          "source.imports[14]": "is_null",
          "source.imports[15]": "posix_getpwuid",
          "source.imports[16]": "posix_getuid",
          "source.imports[17]": "scandir",
          "source.functions[0]": "findFilesFromDirectory"
        },
        "x": 34,
        "id": 0,
        "is": [
          "posix_getpwuid",
          "posix_getuid",
          "file_get_contents",
          "file_put_contents",
          "findFilesFromDirectory",
          "fopen",
          "copy",
          "copy",
          "dirname",
          "fwrite",
          "fclose",
          "date",
          "file_get_contents",
          "eval",
          "is_dir",
          "array_diff",
          "scandir",
          "findFilesFromDirectory",
          "is_null",
          "is_file",
          "basename"
        ],
        "ms": {
          "file": {
            "size": 1188.0
          },
          "text": {
            "tab_count": 24.0,
            "digit_ratio": 0.0,
            "space_count": 63.0,
            "total_lines": 38.0,
            "char_entropy": 5.42,
            "unique_chars": 79.0,
            "import_density": 55.26,
            "string_density": 0.87,
            "avg_line_length": 29.32,
            "high_byte_ratio": 0.06,
            "max_line_length": 98.0,
            "non_ascii_ratio": 0.06,
            "empty_line_ratio": 0.05,
            "last_line_length": 2.0,
            "most_common_char": "e",
            "whitespace_ratio": 0.14,
            "most_common_ratio": 0.06,
            "identifier_density": 1.84,
            "line_length_stddev": 23.54,
            "normalized_import_count": 3.41,
            "normalized_string_count": 5.35,
            "suspicious_string_ratio": 0.12,
            "max_inline_whitespace_run": 2.0,
            "normalized_function_count": 0.16,
            "imports_to_functions_ratio": 21.0,
            "strings_to_functions_ratio": 33.0,
            "suspicious_identifier_ratio": 0.03,
            "normalized_unique_identifiers": 5.91,
            "identifiers_to_functions_ratio": 31.0
          },
          "imports": {
            "total": 21.0,
            "unique_modules": 18.0,
            "third_party_count": 21.0,
            "third_party_ratio": 1.0
          },
          "strings": {
            "total": 33.0,
            "url_count": 4.0,
            "avg_length": 8.73,
            "max_length": 33.0,
            "avg_entropy": 1.9,
            "total_bytes": 288.0,
            "entropy_stddev": 1.49,
            "embedded_code_candidates": 4.0
          },
          "comments": {
            "chars": 150.0,
            "lines": 7.0,
            "total": 7.0,
            "to_code_ratio": 0.23,
            "empty_comments": 2.0
          },
          "functions": {
            "total": 1.0,
            "avg_name_length": 22.0,
            "no_params_count": 1.0,
            "avg_length_lines": 12.0,
            "max_length_lines": 12.0,
            "min_length_lines": 12.0,
            "high_entropy_names": 1.0,
            "density_per_100_lines": 2.63,
            "code_in_functions_ratio": 0.32
          },
          "identifiers": {
            "total": 70.0,
            "avg_length": 7.23,
            "max_length": 22.0,
            "min_length": 1.0,
            "avg_entropy": 2.42,
            "reuse_ratio": 0.44,
            "unique_count": 31.0,
            "length_stddev": 4.65,
            "sequential_names": 1.0,
            "single_char_count": 1.0,
            "single_char_ratio": 0.03,
            "high_entropy_count": 2.0,
            "high_entropy_ratio": 0.06,
            "all_lowercase_ratio": 0.9
          }
        },
        "ss": [
          [
            61,
            "dir"
          ],
          [
            62,
            "dir"
          ],
          [
            82,
            "\u003cbr\u003e\\n"
          ],
          [
            83,
            "\u003cbr\u003e"
          ],
          [
            101,
            "wp-config.php"
          ],
          [
            102,
            "wp-config.php"
          ],
          [
            124,
            "wp-system.php"
          ],
          [
            125,
            "wp-system.php"
          ],
          [
            185,
            "https://pastebin.com/raw/hpqEekGT"
          ],
          [
            186,
            "https://pastebin.com/raw/hpqEekGT"
          ],
          [
            276,
            "wp-system.php"
          ],
          [
            277,
            "wp-system.php"
          ],
          [
            411,
            "result.txt"
          ],
          [
            412,
            "result.txt"
          ],
          [
            424,
            "w"
          ],
          [
            425,
            "w"
          ],
          [
            535,
            ".txt"
          ],
          [
            536,
            ".txt"
          ],
          [
            571,
            "/"
          ],
          [
            572,
            "/"
          ],
          [
            607,
            "\\n"
          ],
          [
            674,
            "H:i:s "
          ],
          [
            675,
            "H:i:s "
          ],
          [
            684,
            "done"
          ],
          [
            685,
            "done"
          ],
          [
            719,
            "https://pastebin.com/raw/kHL0XPea"
          ],
          [
            720,
            "https://pastebin.com/raw/kHL0XPea"
          ],
          [
            901,
            "."
          ],
          [
            902,
            "."
          ],
          [
            906,
            ".."
          ],
          [
            907,
            ".."
          ],
          [
            974,
            "/"
          ],
          [
            975,
            "/"
          ]
        ],
        "sz": 1188,
        "ts": [
          {
            "a": "T1546",
            "c": 1.0,
            "d": "Writes data to a file via functions",
            "e": [
              "file_put_contents("
            ],
            "i": "micro-behaviors/fs/file/write/direct::php-file-write-func",
            "l": 2
          },
          {
            "a": "T1083",
            "c": 1.0,
            "d": "Iterate directory contents via functions in PHP",
            "e": [
              "scandir("
            ],
            "i": "micro-behaviors/fs/directory/traverse::php-dir-traverse-fn",
            "l": 2
          },
          {
            "a": "T1059.006",
            "c": 0.75,
            "d": "PHP eval() token present",
            "e": [
              "eval"
            ],
            "i": "micro-behaviors/process/interpreter/eval::eval-symbol",
            "l": 4,
            "m": "E1059"
          },
          {
            "a": "T1505.003",
            "d": "PHP open tag",
            "e": [
              "\u003c?php"
            ],
            "i": "objectives/command-and-control/backdoor/webshell/request::php-tag",
            "l": 1,
            "m": "B0030"
          },
          {
            "a": "T1505.003",
            "c": 0.9399999976158142,
            "d": "Regex component marker",
            "e": [
              "file_get_contents"
            ],
            "i": "objectives/command-and-control/backdoor/webshell/request::raw-json-post-cmd-field--rx-7",
            "l": 1,
            "m": "B0030"
          },
          {
            "c": 0.800000011920929,
            "d": "Detects PHP copy file recreation call",
            "e": [
              "copy"
            ],
            "i": "objectives/impact/infect/script::php-copy-call",
            "l": 1
          },
          {
            "c": 0.7599999904632568,
            "d": "Regex component marker",
            "e": [
              "directory"
            ],
            "i": "micro-behaviors/data/text/llm/action::llm-path-navigation-action--rx-21",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "PHP scandir function symbol",
            "e": [
              "scandir"
            ],
            "i": "micro-behaviors/fs/enumerate/directory::php-scandir",
            "l": 3
          },
          {
            "c": 0.8999999761581421,
            "d": "HTTPS protocol prefix",
            "e": [
              "https://"
            ],
            "i": "micro-behaviors/communications/http/protocol::https-prefix",
            "l": 2
          },
          {
            "c": 0.8199999928474426,
            "d": "Detects overwrite-mode file open",
            "e": [
              "fopen('result.txt','w'"
            ],
            "i": "objectives/impact/infect/script::php-overwrite-file-mode",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "HTTP request via file_get_contents",
            "e": [
              "'https://pastebin.com/raw/hpqEekGT'",
              "'https://pastebin.com/raw/kHL0XPea'",
              "file_get_contents"
            ],
            "i": "micro-behaviors/communications/http/client/file-read::file-get-contents-url",
            "l": 3
          },
          {
            "c": 0.8199999928474426,
            "d": "wp-config.php path reference",
            "e": [
              "wp-config.php"
            ],
            "i": "objectives/supply-chain/hidden-payload/trojan::wp-config-path",
            "l": 1
          },
          {
            "a": "T1505.003",
            "c": 0.8999999761581421,
            "d": "PHP source imports file_put_contents",
            "e": [
              "[array_diff, basename, copy, date, dirname, eval, fclose, file_get_contents, file_put_contents, findFilesFromDirectory, fopen, f"
            ],
            "i": "objectives/command-and-control/backdoor/webshell/stager::source-import-file-put-contents",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "File has 30 or more lines",
            "e": [
              "text.total_lines = 38.00"
            ],
            "i": "metadata/file/text/metrics::file-has-30-plus-lines",
            "l": 1
          },
          {
            "a": "T1105",
            "c": 0.800000011920929,
            "d": "Creates or overwrites a local file",
            "e": [
              "file_put_contents"
            ],
            "i": "micro-behaviors/fs/write/file/direct::file-put-contents",
            "l": 3,
            "m": "C0052"
          },
          {
            "c": 0.800000011920929,
            "d": "Writes data to an open file",
            "e": [
              "fwrite"
            ],
            "i": "micro-behaviors/fs/write/file/direct::fwrite",
            "l": 3,
            "m": "C0052"
          },
          {
            "c": 0.699999988079071,
            "d": "Pastebin.com reference",
            "e": [
              "pastebin.com"
            ],
            "i": "objectives/command-and-control/infrastructure/paste::pastebin",
            "l": 3
          }
        ],
        "sha": "afdbadfdf90c6fb08b0ff28f8f64e86bea7592876c928d9361d5b9eb9220a72f",
        "path": "ex.php",
        "type": "php"
      }
    ],
    "tv": "a9555"
  }
}