{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9999886751174927, "class": 2 } ], "prob": 0.9999887, "class": 2, "models": [ { "m": "az", "prob": 0.9988643, "class": 1 }, { "m": "az/scripts", "prob": 0.99989426, "class": 2 }, { "m": "az/php", "prob": 0.9999887, "class": 2 } ], "version": "v16.16", "thresholds": [ 0.9961138, 0.99909174 ], "analyzed_at": "2026-05-09T18:34:45Z" }, "path": "type.php", "raw": { "v": "4", "fs": [ { "f": "KO₂(As₄C₃)H₂(CrOs)MdTh", "k": { "source.imports[0]": "pack", "source.imports[1]": "sha1", "source.imports[2]": "strlen", "source.imports[3]": "strpos", "source.imports[4]": "substr", "source.strings[0]": "XY9Pa4NAEMXvgXyH6SKsgvQPpYFi9FKElB5s1fYiRTbJBBeyruyOofn2HdseUm8z89785k2AfrSQgmgFXIMft55caPYPYdBWefmRl43c1PVruymqWn5GMdzGcB8ly4U+hNp7JDaW+dt7XtWNbPsTeyIIOt8x8x9tZvoB3a2iBPDo8QL2VBQvz3kTTLmYtVz8wWZKArxzhWagczg5+KpDGl0Pyjn1O4tBrlA9qq2cAuOusyDXB+sMqB1p26dCgEHq7D4Vg/UksrXuh5GAzgOmgvCLBPTKcM2hZyo/ZzTrJ3Ucuc0y1m8meCaTbw==", "source.has_imports": true, "source.functions[0]": "__construct", "source.functions[1]": "build", "source.functions[2]": "core", "source.functions[3]": "memory", "source.functions[4]": "module", "source.functions[5]": "stable", "source.functions[6]": "tx", "source.functions[7]": "x64" }, "x": 147, "id": 0, "is": [ "strpos", "strlen", "strlen", "substr", "pack", "sha1" ], "ms": { "file": { "size": 18272.0 }, "text": { "digit_ratio": 0.15, "space_count": 177.0, "total_lines": 1.0, "char_entropy": 6.13, "unique_chars": 89.0, "import_density": 600.0, "lines_over_200": 1.0, "lines_over_500": 1.0, "string_density": 35.0, "avg_line_length": 18272.0, "lines_over_1000": 1.0, "max_line_length": 18272.0, "last_line_length": 18272.0, "long_token_count": 2.0, "most_common_char": "t", "whitespace_ratio": 0.01, "most_common_ratio": 0.02, "identifier_density": 162.0, "encoded_string_ratio": 0.11, "normalized_import_count": 6.0, "normalized_string_count": 35.0, "max_inline_whitespace_run": 1.0, "normalized_function_count": 8.0, "imports_to_functions_ratio": 0.75, "strings_to_functions_ratio": 4.38, "suspicious_identifier_ratio": 0.03, "identifiers_to_functions_ratio": 4.13 }, "imports": { "total": 6.0, "unique_modules": 5.0, "third_party_count": 6.0, "third_party_ratio": 1.0 }, "strings": { "total": 35.0, "avg_length": 957.6, "max_length": 16392.0, "avg_entropy": 2.01, "total_bytes": 33516.0, "entropy_stddev": 1.55, "base64_candidates": 4.0, "very_long_strings": 2.0, "high_entropy_count": 4.0 }, "comments": {}, "functions": { "total": 8.0, "one_liners": 8.0, "avg_name_length": 5.38, "no_params_count": 8.0, "avg_length_lines": 1.0, "max_length_lines": 1.0, "min_length_lines": 1.0, "density_per_100_lines": 800.0, "code_in_functions_ratio": 8.0 }, "identifiers": { "total": 162.0, "avg_length": 4.33, "max_length": 11.0, "min_length": 1.0, "avg_entropy": 1.85, "reuse_ratio": 0.2, "unique_count": 33.0, "length_stddev": 2.01, "has_digit_ratio": 0.09, "sequential_names": 1.0, "single_char_count": 1.0, "single_char_ratio": 0.03, "all_lowercase_ratio": 0.88, "numeric_suffix_count": 3.0, "underscore_prefix_count": 1.0 } }, "ss": [ [ 616, "H*" ], [ 617, "H*" ], [ 1312, "\\r\\n" ], [ 1361, "late" ], [ 1362, "late" ], [ 1369, "zinf" ], [ 1370, "zinf" ], [ 1377, "g" ], [ 1378, "g" ], [ 1399, "ode" ], [ 1400, "ode" ], [ 1406, "e" ], [ 1407, "e" ], [ 1411, "_dec" ], [ 1412, "_dec" ], [ 1419, "bas" ], [ 1420, "bas" ], [ 1448, "tion" ], [ 1449, "tion" ], [ 1456, "unc" ], [ 1457, "unc" ], [ 1463, "ate_f" ], [ 1464, "ate_f" ], [ 1472, "cre" ], [ 1473, "cre" ], [ 1497, "lace" ], [ 1498, "lace" ], [ 1505, "r_rep" ], [ 1506, "r_rep" ], [ 1514, "st" ], [ 1515, "st" ], [ 17940, "XY9Pa4NAEMXvgXyH6SKsgvQPpYFi9FKElB5s1fYiRTbJBBeyruyOofn2HdseUm8z89785k2AfrSQgmgFXIMft55caPYPYdBWefmRl43c1PVruymqWn5GMdzGcB8ly4U+" ], [ 17941, "XY9Pa4NAEMXvgXyH6SKsgvQPpYFi9FKElB5s1fYiRTbJBBeyruyOofn2HdseUm8z89785k2AfrSQgmgFXIMft55caPYPYdBWefmRl43c1PVruymqWn5GMdzGcB8ly4U+" ] ], "sz": 18272, "ts": [ { "a": "T1505.003", "c": 1.0, "d": "Inequality check in WordPress user list", "e": [ "!=" ], "i": "objectives/command-and-control/backdoor/webshell/hide::wp-user-hiding-not-trait", "l": 1, "m": "B0030" }, { "c": 0.699999988079071, "d": "SHA1 hash computation", "e": [ "sha1" ], "i": "micro-behaviors/crypto/hash/digest::sha1-php", "l": 3, "m": "C0029" }, { "a": "T1027", "c": 0.8999999761581421, "d": "Exactly one line exceeds 1000 chars", "e": [ "text.lines_over_1000 = 1.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::single-long-line-outlier", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Very long line", "e": [ "text.max_line_length = 18272.00" ], "i": "metadata/file/text/metrics::single-long-line", "l": 1 }, { "a": "T1505.003", "c": 0.8999999761581421, "d": "Single-file admin shell metrics", "e": [ "type.php" ], "i": "well-known/malware/webshell/zaco::single-file-webshell-metrics", "l": 3, "m": "B0030" }, { "c": 0.800000011920929, "d": "PHP variable function invocation pattern", "e": [ "code", "view" ], "i": "objectives/anti-static/obfuscation/imports::dynamic-function-execution", "l": 3 }, { "a": "T1505.003", "c": 0.8600000143051147, "d": "Very long embedded string", "e": [ "strings.max_length = 16392.00" ], "i": "objectives/command-and-control/backdoor/webshell/stager::very-long-string", "l": 1 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Last line is over 1000 chars", "e": [ "text.last_line_length = 18272.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::last-line-over-1000", "l": 1, "m": "B0032" }, { "a": "T1505.003", "c": 0.8399999737739563, "d": "Near-zero whitespace script", "e": [ "text.whitespace_ratio = 0.01" ], "i": "objectives/command-and-control/backdoor/webshell/stager::near-zero-whitespace", "l": 1 }, { "c": 0.949999988079071, "d": "File is a one-liner", "e": [ "text.total_lines = 1.00" ], "i": "metadata/file/text/metrics::file-one-liner", "l": 1 }, { "a": "T1027", "c": 0.8999999761581421, "d": "pack(H*) hex-encoded XOR key for decryption", "e": [ "pack('H*'" ], "i": "objectives/anti-static/obfuscation/encoding/xor::packed-hex-xor-key", "l": 4, "m": "B0032" }, { "a": "T1505.003", "d": "PHP open tag", "e": [ "\u003c?php" ], "i": "objectives/command-and-control/backdoor/webshell/request::php-tag", "l": 1, "m": "B0030" }, { "c": 0.800000011920929, "d": "Very short file (under 12 lines)", "e": [ "text.total_lines = 1.00" ], "i": "metadata/file/text/metrics::file-under-12-lines", "l": 1 }, { "c": 0.699999988079071, "d": "PHP error suppression operator usage", "e": [ "@$code($str)" ], "i": "micro-behaviors/os/stdio::error-suppress-prefix", "l": 3 }, { "a": "T1027", "c": 0.699999988079071, "d": "Very low whitespace ratio (minified/compressed)", "e": [ "text.whitespace_ratio = 0.01" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::low-whitespace", "l": 2, "m": "B0032" }, { "a": "T1027", "c": 0.8999999761581421, "d": "PHP source contains very long line", "e": [ "text.max_line_length = 18272.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/identifiers::php-single-long-line", "l": 4, "m": "B0032" }, { "a": "T1027", "c": 0.800000011920929, "d": "High overall text entropy (encoded", "e": [ "text.char_entropy = 6.13" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::high-text-entropy", "l": 2, "m": "B0032" }, { "a": "T1027", "c": 0.75, "d": "Many short functions (deobfuscation layers)", "e": [ "functions.one_liners = 8.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/identifiers::php-many-short-functions", "l": 4, "m": "B0032" }, { "c": 0.6000000238418579, "d": "Very long base64 strings present", "e": [ "XY9Pa4NAEMXvgXyH6SKsgvQPpYFi9FKElB5s1fYiRTbJBBeyruyOofn2HdseUm8z89785k2AfrSQgmgFXIMft55caPYPYdBWefmRl43c1PVruymqWn5GMdzGcB8ly4U+" ], "i": "objectives/anti-static/obfuscation/string/base64::long-base64-in-strings", "l": 3 }, { "a": "T1027", "c": 0.8500000238418579, "d": "High function density", "e": [ "functions.density_per_100_lines = 800.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/functions::high-function-density", "l": 2, "m": "B0032" }, { "a": "T1027", "c": 0.8999999761581421, "d": "Minified/compressed code (multiple indicators)", "e": [ "functions.density_per_100_lines = 800.00", "text.whitespace_ratio = 0.01" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::minified-code", "l": 2, "m": "B0032" }, { "c": 0.8999999761581421, "d": "PHP webshell using $a($code) for kind of eval with encoded blob to decode, e.g. b374k", "e": [ "\u003c?php", "\u003c?", "$code(\"", "$code('", "$view()", " ^ $", "$code($" ], "i": "third_party/SigBase/WEBSHELL/PHP/Dynamic/Big", "l": 5 } ], "sha": "c79c5586cb3d44e9b2910212650020c3ac82db227f47c5b4e5b53cbc4012430b", "path": "type.php", "type": "php" } ], "tv": "87c42" } }