{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9999847412109375, "class": 2 } ], "prob": 0.99998474, "class": 2, "models": [ { "m": "az", "prob": 0.9987571, "class": 1 }, { "m": "az/scripts", "prob": 0.99998367, "class": 2 }, { "m": "az/php", "prob": 0.99998474, "class": 2 } ], "version": "v16.16", "thresholds": [ 0.9961138, 0.99909174 ], "analyzed_at": "2026-05-08T23:15:16Z" }, "path": "aces.php", "raw": { "v": "4", "fs": [ { "f": "O₂(C₆As₄)H₃(Po₂CmF₂)MdTh", "k": { "source.imports[0]": "base64_decode", "source.imports[1]": "chmod", "source.imports[2]": "eval", "source.imports[3]": "gzuncompress", "source.imports[4]": "mail", "source.strings[0]": "eNpdUs1u00AQfpWNlYMdrDhO89dEOZTKolEpQYkBoRpZU+86u8TZtdZr1X6A3jhy4Q248gxUvAavwjhpgWQPO/+ab74ZkdottstN7XVeZkpRKeRnmJIFyUSyJbUqNWGgM3XHXAKSklJSdXDfg0l4t+PZ7XgdrN4Hq1vrKgzfxu/Qii9eBW9C65PjTNvxt+8/f/14fJyD1lDb1iXXKvKHQ2a5VlQNRqj7mqUqqsYTdIVaUCYNajfrRYDiQ5OAXe+LQ0EiZFmhusgx0FMyqkZDNC8k1UpQ1JY504ByDSloYTmzVGkGCbf/QiFQtOMvvx++PjhTkdpFuBK5Kk4Hiarh8L9Z3OeS1nzuddaggfvnaYJk7fC5RG2hRjpSyAp2SqaBLUPWSA7SFESlqUs2upRGyA0SjTEgRqssw/o9opYoCmYQ0OVyeb0IbnHu0cTkcSloXBo06J7bIgiTJoHZFt9HMTKIy8gfDXZIgG+5obgJbOdFb9zr945Bf2TA92vG7sIQrcpNs81O76x3ir7YweEWiOHNVdwpZep9bt+ZXTGggbat1yoBI5ScEm5MPvU8/2zQjaqz/uC86/uj7njiCUmbZVXdnOe4FirYMaQlJzWicrENGJIylhVkg0CaI3NmTFKR/vuflvrkmB1jXjeI3WdRM8YAOG/m+wMpCvZB", "source.strings[1]": "qqifquaqdzvp", "source.strings[2]": "tdluhqtnmzr", "source.strings[3]": "vwkxlpc", "source.strings[4]": "yfbhn : ", "source.strings[5]": "ylxqjqbcn", "source.has_imports": true }, "x": 296, "id": 0, "is": [ "eval", "gzuncompress", "base64_decode", "eval", "gzuncompress", "base64_decode", "eval", "gzuncompress", "base64_decode", "eval", "gzuncompress", "base64_decode", "eval", "gzuncompress", "base64_decode", "eval", "gzuncompress", "base64_decode", "eval", "gzuncompress", "base64_decode", "base64_decode", "base64_decode", "base64_decode", "base64_decode", "mail", "chmod" ], "ms": { "file": { "size": 5569.0 }, "text": { "digit_ratio": 0.14, "space_count": 147.0, "total_lines": 19.0, "char_entropy": 6.11, "unique_chars": 84.0, "import_density": 142.11, "lines_over_200": 1.0, "lines_over_500": 1.0, "string_density": 1.37, "avg_line_length": 291.11, "lines_over_1000": 1.0, "max_line_length": 5060.0, "empty_line_ratio": 0.58, "last_line_length": 22.0, "long_token_count": 7.0, "most_common_char": "p", "whitespace_ratio": 0.03, "most_common_ratio": 0.03, "identifier_density": 2.26, "line_length_stddev": 1124.31, "encoded_string_ratio": 0.54, "normalized_import_count": 6.19, "normalized_string_count": 5.96, "repeated_char_sequences": 3.0, "max_inline_whitespace_run": 1.0, "trailing_whitespace_lines": 14.0, "normalized_unique_identifiers": 2.82 }, "imports": { "total": 27.0, "unique_modules": 5.0, "third_party_count": 27.0, "third_party_ratio": 1.0 }, "strings": { "total": 26.0, "avg_length": 367.92, "max_length": 676.0, "avg_entropy": 4.48, "total_bytes": 9566.0, "entropy_stddev": 1.6, "base64_candidates": 14.0, "high_entropy_count": 14.0 }, "comments": {}, "functions": {}, "identifiers": { "total": 43.0, "avg_length": 8.25, "max_length": 13.0, "min_length": 4.0, "avg_entropy": 2.69, "reuse_ratio": 0.28, "unique_count": 12.0, "length_stddev": 3.39, "has_digit_ratio": 0.08, "all_lowercase_ratio": 0.75, "all_uppercase_ratio": 0.17, "double_underscore_count": 1.0, "underscore_prefix_count": 2.0 } }, "ss": [ [ 38, "eNpdUs1u00AQfpWNlYMdrDhO89dEOZTKolEpQYkBoRpZU+86u8TZtdZr1X6A3jhy4Q248gxUvAavwjhpgWQPO/+ab74ZkdottstN7XVeZkpRKeRnmJIFyUSyJbUqNWGg" ], [ 39, "eNpdUs1u00AQfpWNlYMdrDhO89dEOZTKolEpQYkBoRpZU+86u8TZtdZr1X6A3jhy4Q248gxUvAavwjhpgWQPO/+ab74ZkdottstN7XVeZkpRKeRnmJIFyUSyJbUqNWGg" ], [ 760, "eNpdUs1u00AQfpWNlYMdrDhO89dEOZTKolEpQYkBoRpZU+86u8TZtdZr1X6A3jhy4Q248gxUvAavwjhpgWQPO/+ab74ZkdottstN7XVeZkpRKeRnmJIFyUSyJbUqNWGg" ], [ 761, "eNpdUs1u00AQfpWNlYMdrDhO89dEOZTKolEpQYkBoRpZU+86u8TZtdZr1X6A3jhy4Q248gxUvAavwjhpgWQPO/+ab74ZkdottstN7XVeZkpRKeRnmJIFyUSyJbUqNWGg" ], [ 1482, "eNpdUs1u00AQfpWNlYMdrDhO89dEOZTKolEpQYkBoRpZU+86u8TZtdZr1X6A3jhy4Q248gxUvAavwjhpgWQPO/+ab74ZkdottstN7XVeZkpRKeRnmJIFyUSyJbUqNWGg" ], [ 1483, "eNpdUs1u00AQfpWNlYMdrDhO89dEOZTKolEpQYkBoRpZU+86u8TZtdZr1X6A3jhy4Q248gxUvAavwjhpgWQPO/+ab74ZkdottstN7XVeZkpRKeRnmJIFyUSyJbUqNWGg" ], [ 2204, "eNpdUs1u00AQfpWNlYMdrDhO89dEOZTKolEpQYkBoRpZU+86u8TZtdZr1X6A3jhy4Q248gxUvAavwjhpgWQPO/+ab74ZkdottstN7XVeZkpRKeRnmJIFyUSyJbUqNWGg" ], [ 2205, "eNpdUs1u00AQfpWNlYMdrDhO89dEOZTKolEpQYkBoRpZU+86u8TZtdZr1X6A3jhy4Q248gxUvAavwjhpgWQPO/+ab74ZkdottstN7XVeZkpRKeRnmJIFyUSyJbUqNWGg" ], [ 2926, "eNpdUs1u00AQfpWNlYMdrDhO89dEOZTKolEpQYkBoRpZU+86u8TZtdZr1X6A3jhy4Q248gxUvAavwjhpgWQPO/+ab74ZkdottstN7XVeZkpRKeRnmJIFyUSyJbUqNWGg" ], [ 2927, "eNpdUs1u00AQfpWNlYMdrDhO89dEOZTKolEpQYkBoRpZU+86u8TZtdZr1X6A3jhy4Q248gxUvAavwjhpgWQPO/+ab74ZkdottstN7XVeZkpRKeRnmJIFyUSyJbUqNWGg" ], [ 3648, "eNpdUs1u00AQfpWNlYMdrDhO89dEOZTKolEpQYkBoRpZU+86u8TZtdZr1X6A3jhy4Q248gxUvAavwjhpgWQPO/+ab74ZkdottstN7XVeZkpRKeRnmJIFyUSyJbUqNWGg" ], [ 3649, "eNpdUs1u00AQfpWNlYMdrDhO89dEOZTKolEpQYkBoRpZU+86u8TZtdZr1X6A3jhy4Q248gxUvAavwjhpgWQPO/+ab74ZkdottstN7XVeZkpRKeRnmJIFyUSyJbUqNWGg" ], [ 4370, "eNpdUs1u00AQfpWNlYMdrDhO89dEOZTKolEpQYkBoRpZU+86u8TZtdZr1X6A3jhy4Q248gxUvAavwjhpgWQPO/+ab74ZkdottstN7XVeZkpRKeRnmJIFyUSyJbUqNWGg" ], [ 4371, "eNpdUs1u00AQfpWNlYMdrDhO89dEOZTKolEpQYkBoRpZU+86u8TZtdZr1X6A3jhy4Q248gxUvAavwjhpgWQPO/+ab74ZkdottstN7XVeZkpRKeRnmJIFyUSyJbUqNWGg" ], [ 5097, "ylxqjqbcn" ], [ 5098, "ylxqjqbcn" ], [ 5144, "nrsf" ], [ 5145, "nrsf" ], [ 5194, "tdluhqtnmzr" ], [ 5195, "tdluhqtnmzr" ], [ 5250, "qqifquaqdzvp" ], [ 5251, "qqifquaqdzvp" ], [ 5362, "vwkxlpc" ], [ 5363, "vwkxlpc" ], [ 5385, "yfbhn : " ], [ 5386, "yfbhn : " ] ], "sz": 5569, "ts": [ { "a": "T1027", "c": 0.8999999761581421, "d": "Dense base64_decode calls", "e": [ "base64_decode" ], "i": "objectives/anti-static/obfuscation/string/encoding::dense-base64-decode", "l": 4, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Very long line", "e": [ "text.max_line_length = 5060.00" ], "i": "metadata/file/text/metrics::single-long-line", "l": 1 }, { "a": "T1505.003", "c": 0.8799999952316284, "d": "Regex component marker", "e": [ "eval" ], "i": "objectives/command-and-control/backdoor/webshell/exec::dangerous-php-function-cluster--rx-16", "l": 1, "m": "B0030" }, { "a": "T1505.003", "c": 0.8500000238418579, "d": "PHP request superglobal access", "e": [ "$_POST" ], "i": "objectives/command-and-control/backdoor/webshell/upload::php-request-variadic-function-call", "l": 3, "m": "B0030" }, { "a": "T1027", "c": 0.8999999761581421, "d": "Exactly one line exceeds 1000 chars", "e": [ "text.lines_over_1000 = 1.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::single-long-line-outlier", "l": 1, "m": "B0032" }, { "a": "T1059.006", "c": 0.75, "d": "PHP eval() token present", "e": [ "eval" ], "i": "micro-behaviors/process/interpreter/eval::eval-symbol", "l": 4, "m": "E1059" }, { "a": "T1505.003", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "eval(gzuncompress(" ], "i": "objectives/command-and-control/backdoor/webshell/decoder::eval-decoder-chain--rx-2", "l": 1, "m": "B0030" }, { "a": "T1059", "c": 0.800000011920929, "d": "Self-reference via __FILE__", "e": [ "__FILE__" ], "i": "micro-behaviors/fs/read/self::self-file-reference", "l": 3 }, { "a": "T1505.003", "c": 0.4000000059604645, "d": "PHP $_POST parameter access", "e": [ "$_POST[" ], "i": "objectives/command-and-control/backdoor/webshell/request::php-post", "l": 1, "m": "B0030" }, { "a": "T1505.003", "d": "PHP open tag", "e": [ "\u003c?php" ], "i": "objectives/command-and-control/backdoor/webshell/request::php-tag", "l": 1, "m": "B0030" }, { "a": "T1505.003", "c": 0.8999999761581421, "d": "PHP source imports base64_decode", "e": [ "[base64_decode, chmod, eval, gzuncompress, mail]" ], "i": "objectives/command-and-control/backdoor/webshell/stager::source-import-base64-decode", "l": 1 }, { "a": "T1222", "c": 0.699999988079071, "d": "Changes file permissions via chmod()", "e": [ "chmod" ], "i": "micro-behaviors/fs/chmod/modify::chmod-call", "l": 3 }, { "a": "T1505.003", "c": 0.9900000095367432, "d": "Decodes a large embedded payload (base64)", "e": [ "base64_decode('eNpdUs1u00AQfpWNlYMdrDhO89dEOZTKolEpQYkBoRpZU+86u8TZtdZr1X6A3jhy4Q248gxUvAavwjhpgWQPO/+ab74ZkdottstN7XVeZkpRKeRnm" ], "i": "objectives/command-and-control/backdoor/webshell/decoder::eval-base64-large-payload", "l": 4, "m": "B0030" }, { "a": "T1027", "c": 0.8799999952316284, "d": "Dense gzip decompression", "e": [ "gzuncompress(" ], "i": "objectives/anti-static/obfuscation/string/encoding::dense-gzip-decode", "l": 4, "m": "B0032" }, { "c": 1.0, "d": "PHP mail() function call", "e": [ "mail" ], "i": "micro-behaviors/process/create/exec::php-mail", "l": 3 }, { "a": "T1505.003", "c": 0.8600000143051147, "d": "Very long embedded string", "e": [ "strings.max_length = 676.00" ], "i": "objectives/command-and-control/backdoor/webshell/stager::very-long-string", "l": 1 }, { "a": "T1059", "c": 0.8500000238418579, "d": "HTTP POST parameter access ($_POST)", "e": [ "$_POST" ], "i": "micro-behaviors/communications/http/request/params::post-dup", "l": 3 }, { "a": "T1027", "c": 0.800000011920929, "d": "High entropy source string literals", "e": [ "strings.avg_entropy = 4.48" ], "i": "objectives/anti-static/obfuscation/code-metrics/source::high-entropy-strings", "l": 3, "m": "B0032" }, { "a": "T1027", "c": 0.699999988079071, "d": "Very low whitespace ratio (minified/compressed)", "e": [ "text.whitespace_ratio = 0.03" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::low-whitespace", "l": 2, "m": "B0032" }, { "c": 0.6000000238418579, "d": "Very long base64 strings present", "e": [ "eNpdUs1u00AQfpWNlYMdrDhO89dEOZTKolEpQYkBoRpZU+86u8TZtdZr1X6A3jhy4Q248gxUvAavwjhpgWQPO/+ab74ZkdottstN7XVeZkpRKeRnmJIFyUSyJbUqNWGg" ], "i": "objectives/anti-static/obfuscation/string/base64::long-base64-in-strings", "l": 3 }, { "c": 0.699999988079071, "d": "AJAX request handler pattern", "e": [ "$_POST['qqifquaqdzvp']", "$_POST['tdluhqtnmzr']", "$_POST['nrsf']", "$_POST['ylxqjqbcn']" ], "i": "objectives/command-and-control/backdoor/webshell/ui::ajax-handler", "l": 4, "m": "B0030" }, { "a": "T1027", "c": 0.8999999761581421, "d": "PHP source contains very long line", "e": [ "text.max_line_length = 5060.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/identifiers::php-single-long-line", "l": 4, "m": "B0032" }, { "a": "T1027", "c": 0.800000011920929, "d": "High overall text entropy (encoded", "e": [ "text.char_entropy = 6.11" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::high-text-entropy", "l": 2, "m": "B0032" }, { "a": "T1027", "c": 0.949999988079071, "d": "Multi-layer PHP obfuscation", "e": [ "gzuncompress(", "base64_decode" ], "i": "objectives/anti-static/obfuscation/string/encoding::php-multi-layer-obfuscation", "l": 4, "m": "B0032" }, { "a": "T1505.003", "c": 0.9700000286102295, "d": "PHP decoder eval webshell", "e": [ "base64_decode('eNpdUs1u00AQfpWNlYMdrDhO89dEOZTKolEpQYkBoRpZU+86u8TZtdZr1X6A3jhy4Q248gxUvAavwjhpgWQPO/+ab74ZkdottstN7XVeZkpRKeRnm", "$_POST", "eval(gzuncompress(" ], "i": "objectives/command-and-control/backdoor/webshell/decoder::php-decoder-eval-webshell", "l": 5, "m": "B0030" }, { "c": 0.8999999761581421, "d": "PHP webshell which directly eval()s obfuscated string", "e": [ "eval(gzuncompress(base64_decode", "\u003c?", "\u003c?php" ], "i": "third_party/SigBase/WEBSHELL/PHP/Gzinflated", "l": 5 }, { "c": 0.8999999761581421, "d": "PHP webshell using $a($code) for kind of eval with encoded blob to decode, e.g. b374k", "e": [ "eval(", "\u003c?", "\u003c?php" ], "i": "third_party/SigBase/WEBSHELL/PHP/Dynamic/Big", "l": 5 }, { "c": 0.8999999761581421, "d": "PHP webshell using some kind of eval with encoded blob to decode, which is checked with YARAs math.entropy module", "e": [ "eval(g", "\u003c?php", "\u003c?" ], "i": "third_party/SigBase/WEBSHELL/PHP/Encoded/Big", "l": 5 }, { "c": 0.8999999761581421, "d": "Known PHP Webshells which contain unique strings, lousy rule for low hanging fruits. Most are catched by other rules in here but maybe these catch different versions.", "e": [ "\u003c?php eval(", "\u003c?", "\u003c?php" ], "i": "third_party/SigBase/WEBSHELL/PHP/By/String/Known/Webshell", "l": 5 } ], "sha": "c44a4d3bfa552a86aa6f07a21ecb8f4a0ec778ddcf33a6fb3932eafefea1dac8", "path": "/data/samples/bad/datasets/awesome-malware/PHP/aces.php", "type": "php" } ], "tv": "bef72" } }