{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9846314787864685, "class": 2 } ], "prob": 0.9846315, "class": 2, "models": [ { "m": "az", "prob": 0.21875255, "class": 0 }, { "m": "az/scripts", "prob": 0.80550754, "class": 0 }, { "m": "az/php", "prob": 0.9846315, "class": 2 } ], "version": "v16.16", "thresholds": [ 0.9961138, 0.99909174 ], "analyzed_at": "2026-05-09T10:08:33Z" }, "path": "b88262fef14efa326c56a48e29ce03d9", "raw": { "v": "4", "fs": [ { "f": "O₄(C₇CaILa)H₃(Cm₂Db₂F₂)Md", "k": { "source.imports[0]": "basename", "source.imports[1]": "class_exists", "source.imports[2]": "closedir", "source.imports[3]": "date", "source.imports[4]": "define", "source.imports[5]": "empty", "source.imports[6]": "fclose", "source.imports[7]": "file_exists", "source.imports[8]": "fopen", "source.imports[9]": "function_exists", "source.strings[0]": "$folder/$f", "source.strings[1]": "$parentPath/", "source.strings[2]": ".zip or .gz or .rar files found, ready for extraction", "source.strings[3]": "\u003c/option\u003e", "source.strings[4]": "\u003coption\u003e", "source.strings[5]": "\u003coption\u003e$zip\u003c/option\u003e", "source.strings[6]": "Error unzipping file.", "source.strings[7]": "Error: Cannot read .rar archive.", "source.strings[8]": "Error: Cannot read .zip archive.", "source.strings[9]": "Error: Directory not writeable by webserver.", "source.has_imports": true, "source.imports[10]": "fwrite", "source.imports[11]": "gzclose", "source.imports[12]": "gzopen", "source.imports[13]": "gzread", "source.imports[14]": "in_array", "source.imports[15]": "is_dir", "source.imports[16]": "is_file", "source.imports[17]": "is_writeable", "source.imports[18]": "isset", "source.imports[19]": "key", "source.imports[20]": "microtime", "source.imports[21]": "mkdir", "source.imports[22]": "opendir", "source.imports[23]": "pathinfo", "source.imports[24]": "readdir", "source.imports[25]": "reset", "source.imports[26]": "strip_tags", "source.imports[27]": "strlen", "source.imports[28]": "strtoupper", "source.imports[29]": "substr", "source.strings[10]": "Error: Your PHP has no zlib support enabled.", "source.strings[11]": "Error: Your PHP version does not support .rar archive functionality. \u003ca class=\"info\" href=\"http://php.net/manual/en/rar.installation.php\" target=\"_blank\"\u003eHow to install RarArchive\u003c/a\u003e", "source.strings[12]": "Error: Your PHP version does not support unzip functionality.", "source.strings[13]": "File unzipped successfully.", "source.strings[14]": "Files extracted successfully.", "source.strings[15]": "Files unzipped successfully", "source.strings[16]": "No .zip or .gz or rar files found. So only zipping functionality available.", "source.strings[17]": "RarArchive", "source.strings[18]": "Successfully created archive ", "source.strings[19]": "VERSION", "source.strings[20]": "Y-m-d--H-i", "source.strings[21]": "ZipArchive", "source.strings[22]": "basename", "source.strings[23]": "dirname", "source.strings[24]": "dounzip", "source.strings[25]": "extpath", "source.strings[26]": "gzopen", "source.strings[27]": "status", "source.strings[28]": "success", "source.strings[29]": "zipfile", "source.strings[30]": "zippath", "source.strings[31]": "zipper-", "source.functions[0]": "__construct", "source.functions[1]": "extract", "source.functions[2]": "extractGzipFile", "source.functions[3]": "extractRarArchive", "source.functions[4]": "extractZipArchive", "source.functions[5]": "folderToZip", "source.functions[6]": "prepareExtraction", "source.functions[7]": "zipDir" }, "x": 66, "id": 0, "is": [ "define", "microtime", "isset", "isset", "strip_tags", "isset", "strip_tags", "isset", "empty", "strip_tags", "date", "microtime", "opendir", "readdir", "pathinfo", "pathinfo", "pathinfo", "closedir", "empty", "empty", "is_dir", "mkdir", "in_array", "pathinfo", "class_exists", "is_writeable", "function_exists", "pathinfo", "gzopen", "fopen", "gzread", "fwrite", "strlen", "gzclose", "fclose", "file_exists", "class_exists", "is_writeable", "opendir", "readdir", "basename", "substr", "is_file", "is_dir", "closedir", "pathinfo", "strlen", "strtoupper", "key", "reset" ], "ms": { "file": { "size": 11153.0 }, "text": { "digit_ratio": 0.02, "space_count": 2377.0, "total_lines": 365.0, "char_entropy": 5.0, "unique_chars": 87.0, "import_density": 13.7, "lines_over_200": 1.0, "string_density": 0.45, "avg_line_length": 29.56, "max_line_length": 231.0, "empty_line_ratio": 0.01, "last_line_length": 7.0, "most_common_char": "e", "whitespace_ratio": 0.25, "most_common_ratio": 0.06, "identifier_density": 0.74, "line_length_stddev": 27.49, "normalized_import_count": 2.62, "normalized_string_count": 8.64, "repeated_char_sequences": 8.0, "suspicious_comment_ratio": 0.07, "max_inline_whitespace_run": 8.0, "normalized_function_count": 0.42, "imports_to_functions_ratio": 6.25, "strings_to_functions_ratio": 20.63, "suspicious_identifier_ratio": 0.02, "normalized_unique_identifiers": 10.57, "identifiers_to_functions_ratio": 11.25 }, "imports": { "total": 50.0, "unique_modules": 30.0, "third_party_count": 50.0, "third_party_ratio": 1.0 }, "strings": { "total": 165.0, "avg_length": 12.92, "max_length": 183.0, "avg_entropy": 2.07, "total_bytes": 2132.0, "entropy_stddev": 1.16 }, "comments": { "chars": 2349.0, "lines": 90.0, "total": 27.0, "todo_count": 1.0, "to_code_ratio": 0.33, "url_in_comments": 1.0, "high_entropy_comments": 2.0 }, "functions": { "total": 8.0, "length_stddev": 3.5, "avg_name_length": 12.63, "no_params_count": 8.0, "avg_length_lines": 19.63, "max_length_lines": 25.0, "min_length_lines": 14.0, "high_entropy_names": 1.0, "density_per_100_lines": 2.19, "code_in_functions_ratio": 0.43 }, "identifiers": { "total": 271.0, "avg_length": 7.79, "max_length": 18.0, "min_length": 1.0, "avg_entropy": 2.55, "reuse_ratio": 0.33, "unique_count": 90.0, "length_stddev": 3.56, "sequential_names": 2.0, "single_char_count": 2.0, "single_char_ratio": 0.02, "high_entropy_count": 2.0, "high_entropy_ratio": 0.02, "all_lowercase_ratio": 0.67, "all_uppercase_ratio": 0.08, "double_underscore_count": 1.0, "underscore_prefix_count": 3.0 } }, "ss": [ [ 427, "VERSION" ], [ 428, "VERSION" ], [ 438, "0.1.0" ], [ 439, "0.1.0" ], [ 487, "status" ], [ 488, "status" ], [ 551, "dounzip" ], [ 552, "dounzip" ], [ 643, "zipfile" ], [ 644, "zipfile" ], [ 675, "zipfile" ], [ 676, "zipfile" ], [ 723, "extpath" ], [ 724, "extpath" ], [ 755, "extpath" ], [ 756, "extpath" ], [ 848, "dozip" ], [ 849, "dozip" ], [ 888, "zippath" ], [ 889, "zippath" ], [ 920, "zippath" ], [ 921, "zippath" ], [ 934, "." ], [ 935, "." ], [ 1010, "zipper-" ], [ 1011, "zipper-" ], [ 1027, "Y-m-d--H-i" ], [ 1028, "Y-m-d--H-i" ], [ 1043, ".zip" ], [ 1044, ".zip" ], [ 1214, "." ], [ 1215, "." ], [ 1475, "zip" ], [ 1476, "zip" ], [ 1534, "gz" ], [ 1535, "gz" ], [ 1592, "rar" ], [ 1593, "rar" ], [ 1740, "status" ], [ 1741, "status" ], [ 1758, "info" ], [ 1759, "info" ], [ 1768, ".zip or .gz or .rar files found, ready for extraction" ], [ 1769, ".zip or .gz or .rar files found, ready for extraction" ], [ 1864, "status" ], [ 1865, "status" ], [ 1882, "info" ], [ 1883, "info" ], [ 1892, "No .zip or .gz or rar files found. So only zipping functionality available." ], [ 1893, "No .zip or .gz or rar files found. So only zipping functionality available." ], [ 2303, "/" ], [ 2304, "/" ], [ 2861, "zip" ], [ 2862, "zip" ], [ 2951, "gz" ], [ 2952, "gz" ], [ 3038, "rar" ], [ 3039, "rar" ], [ 3383, "ZipArchive" ], [ 3384, "ZipArchive" ], [ 3415, "status" ], [ 3416, "status" ], [ 3433, "error" ], [ 3434, "error" ], [ 3444, "Error: Your PHP version does not support unzip functionality." ], [ 3445, "Error: Your PHP version does not support unzip functionality." ], [ 3715, "/" ], [ 3716, "/" ], [ 3802, "status" ], [ 3803, "status" ], [ 3820, "success" ], [ 3821, "success" ], [ 3833, "Files unzipped successfully" ], [ 3834, "Files unzipped successfully" ], [ 3903, "status" ], [ 3904, "status" ], [ 3921, "error" ], [ 3922, "error" ], [ 3932, "Error: Directory not writeable by webserver." ], [ 3933, "Error: Directory not writeable by webserver." ], [ 4021, "status" ], [ 4022, "status" ], [ 4039, "error" ], [ 4040, "error" ], [ 4050, "Error: Cannot read .zip archive." ], [ 4051, "Error: Cannot read .zip archive." ], [ 4312, "gzopen" ], [ 4313, "gzopen" ], [ 4340, "status" ], [ 4341, "status" ], [ 4358, "error" ], [ 4359, "error" ], [ 4369, "Error: Your PHP has no zlib support enabled." ], [ 4370, "Error: Your PHP has no zlib support enabled." ], [ 4525, "rb" ], [ 4526, "rb" ], [ 4561, "w" ], [ 4562, "w" ], [ 4780, "/" ], [ 4781, "/" ], [ 4815, "status" ], [ 4816, "status" ], [ 4833, "success" ], [ 4834, "success" ], [ 4846, "File unzipped successfully." ], [ 4847, "File unzipped successfully." ], [ 4910, "status" ], [ 4911, "status" ], [ 4928, "error" ], [ 4929, "error" ], [ 4939, "Error unzipping file." ], [ 4940, "Error unzipping file." ], [ 5231, "RarArchive" ], [ 5232, "RarArchive" ], [ 5263, "status" ], [ 5264, "status" ], [ 5281, "error" ], [ 5282, "error" ], [ 5292, "Error: Your PHP version does not support .rar archive functionality. \u003ca class=\"info\" href=\"http://php.net/manual/en/rar.installa" ], [ 5293, "Error: Your PHP version does not support .rar archive functionality. \u003ca class=\"info\" href=\"http://php.net/manual/en/rar.installa" ], [ 5662, "/" ], [ 5663, "/" ], [ 5839, "status" ], [ 5840, "status" ], [ 5857, "success" ], [ 5858, "success" ], [ 5870, "Files extracted successfully." ], [ 5871, "Files extracted successfully." ], [ 5942, "status" ], [ 5943, "status" ], [ 5960, "error" ], [ 5961, "error" ], [ 5971, "Error: Directory not writeable by webserver." ], [ 5972, "Error: Directory not writeable by webserver." ], [ 6060, "status" ], [ 6061, "status" ], [ 6078, "error" ], [ 6079, "error" ], [ 6089, "Error: Cannot read .rar archive." ], [ 6090, "Error: Cannot read .rar archive." ], [ 6872, "." ], [ 6873, "." ], [ 6885, ".." ], [ 6886, ".." ], [ 6941, "$folder/$f" ], [ 6949, "/" ], [ 7828, "dirname" ], [ 7829, "dirname" ], [ 7865, "basename" ], [ 7866, "basename" ], [ 8128, "$parentPath/" ], [ 8140, "/" ], [ 8182, "status" ], [ 8183, "status" ], [ 8200, "success" ], [ 8201, "success" ], [ 8213, "Successfully created archive " ], [ 8214, "Successfully created archive " ], [ 9801, "status" ], [ 9802, "status" ], [ 9855, "status" ], [ 9856, "status" ], [ 10240, "\u003coption\u003e$zip\u003c/option\u003e" ], [ 10241, "\u003coption\u003e" ], [ 10253, "\u003c/option\u003e" ] ], "sz": 11153, "ts": [ { "a": "T1071.001", "c": 0.699999988079071, "d": "HTTP POST method", "e": [ "\"POST\"" ], "i": "micro-behaviors/communications/http/post::post", "l": 1, "m": "C0002" }, { "c": 0.6000000238418579, "d": "Generates HTML tags", "e": [ "\u003chtml" ], "i": "micro-behaviors/data/format/html::html-generator-tags", "l": 3 }, { "a": "T1505.003", "c": 1.0, "d": "Inequality check in WordPress user list", "e": [ "!=" ], "i": "objectives/command-and-control/backdoor/webshell/hide::wp-user-hiding-not-trait", "l": 1, "m": "B0030" }, { "c": 0.8199999928474426, "d": "Detects overwrite-mode file open", "e": [ "fopen($filename, \"w\"" ], "i": "objectives/impact/infect/script::php-overwrite-file-mode", "l": 1 }, { "a": "T1083", "c": 1.0, "d": "Iterate directory contents via functions in PHP", "e": [ "opendir(" ], "i": "micro-behaviors/fs/directory/traverse::php-dir-traverse-fn", "l": 2 }, { "c": 0.800000011920929, "d": "Generates HTML content (DOCTYPE)", "e": [ "\u003c!DOCTYPE html\u003e" ], "i": "micro-behaviors/data/format/html::html-generator-doctype", "l": 2 }, { "a": "T1105", "c": 0.699999988079071, "d": "Python zipfile module", "e": [ "zipfile" ], "i": "objectives/command-and-control/dropper/staging/archive::zipfile-module", "l": 1, "m": "E1105" }, { "c": 0.75, "d": "RAR extract instruction", "e": [ "extract a Rar" ], "i": "objectives/lateral-movement/social-engineering/lures::extract-rar-archive", "l": 1 }, { "c": 0.20000000298023224, "d": "output keyword", "e": [ "output" ], "i": "micro-behaviors/data/text/keywords/lexicon::output", "l": 1 }, { "a": "T1505.003", "c": 0.4000000059604645, "d": "PHP $_POST parameter access", "e": [ "$_POST[" ], "i": "objectives/command-and-control/backdoor/webshell/request::php-post", "l": 1, "m": "B0030" }, { "c": 0.8999999761581421, "d": "File has 30 or more lines", "e": [ "text.total_lines = 365.00" ], "i": "metadata/file/text/metrics::file-has-30-plus-lines", "l": 1 }, { "c": 0.800000011920929, "d": "Writes data to an open file", "e": [ "fwrite" ], "i": "micro-behaviors/fs/write/file/direct::fwrite", "l": 3, "m": "C0052" }, { "a": "T1059", "c": 0.800000011920929, "d": "Self-reference via __FILE__", "e": [ "__FILE__" ], "i": "micro-behaviors/fs/read/self::self-file-reference", "l": 3 }, { "c": 0.699999988079071, "d": "GPL license reference", "e": [ "GPL" ], "i": "metadata/package/license::gpl-word", "l": 2 }, { "c": 0.8600000143051147, "d": "Regex component marker", "e": [ "method=" ], "i": "objectives/command-and-control/backdoor/webshell/ui::self-named-get-form--rx-3", "l": 1, "m": "B0030" }, { "a": "T1505.003", "d": "PHP open tag", "e": [ "\u003c?php" ], "i": "objectives/command-and-control/backdoor/webshell/request::php-tag", "l": 1, "m": "B0030" }, { "a": "T1505.003", "c": 0.8500000238418579, "d": "PHP request superglobal access", "e": [ "$_POST" ], "i": "objectives/command-and-control/backdoor/webshell/upload::php-request-variadic-function-call", "l": 3, "m": "B0030" }, { "c": 0.7599999904632568, "d": "Regex component marker", "e": [ "directory" ], "i": "micro-behaviors/data/text/llm/action::llm-path-navigation-action--rx-21", "l": 1 }, { "c": 0.75, "d": "Archive open or extract instruction", "e": [ "open($archive" ], "i": "objectives/lateral-movement/social-engineering/lures::open-or-extract-zip-archive", "l": 1 }, { "a": "T1505.003", "c": 0.9200000166893005, "d": "HTML tag in script body", "e": [ "\u003chtml\u003e" ], "i": "objectives/command-and-control/remote-command/shell::html-tag-present", "l": 1, "m": "B0030" }, { "a": "T1059", "c": 0.8500000238418579, "d": "HTTP POST parameter access ($_POST)", "e": [ "$_POST" ], "i": "micro-behaviors/communications/http/request/params::post-dup", "l": 3 }, { "a": "T1546", "c": 1.0, "d": "Writes data to a file via functions", "e": [ "fopen(" ], "i": "micro-behaviors/fs/file/write/direct::php-file-write-func", "l": 2 }, { "a": "T1071", "c": 0.6000000238418579, "d": "URL with .php endpoint", "e": [ "http://php.net/manual/en/rar.installation.php" ], "i": "objectives/command-and-control/infrastructure/domain/tld::php-endpoint-url", "l": 1 }, { "c": 0.699999988079071, "d": "AJAX request handler pattern", "e": [ "$_POST['zipfile']", "$_POST['extpath']", "$_POST['zippath']", "$_POST['dozip']", "$_POST['dounzip']" ], "i": "objectives/command-and-control/backdoor/webshell/ui::ajax-handler", "l": 4, "m": "B0030" }, { "a": "T1566.002", "c": 0.8500000238418579, "d": "PHP script writing POST data to local file", "e": [ "$_POST", "fopen(" ], "i": "objectives/credential-access/phishing/tactics::php-credential-exfiltration", "l": 4, "m": "B0030" }, { "c": 1.0, "d": "php code embedded in string", "e": [ "Detected php at offset 0x0" ], "i": "metadata/lang/embedded::php", "l": 2 } ], "sha": "bb99530015f15584d410beec48361372a2a0ddd725522738578ddc09fe65190a", "path": "/data/samples/bad/datasets/kaker-scripts/php/b88262fef14efa326c56a48e29ce03d9", "type": "php" } ], "tv": "a9555" } }