{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 0.9979660511016846,
        "class": 2
      }
    ],
    "prob": 0.99796605,
    "class": 2,
    "models": [
      {
        "m": "az",
        "prob": 0.7946233,
        "class": 0
      },
      {
        "m": "az/scripts",
        "prob": 0.9855048,
        "class": 0
      },
      {
        "m": "az/php",
        "prob": 0.99796605,
        "class": 2
      }
    ],
    "version": "v16.16",
    "thresholds": [
      0.9961138,
      0.99909174
    ],
    "analyzed_at": "2026-05-09T10:32:35Z"
  },
  "path": "smtp.php",
  "raw": {
    "v": "4",
    "fs": [
      {
        "f": "O₃(C₃DyLa)H₅(CmF₂OsPoDb₂)Md",
        "k": {
          "source.imports[0]": "count",
          "source.imports[1]": "crypt",
          "source.imports[2]": "explode",
          "source.imports[3]": "fclose",
          "source.imports[4]": "file_get_contents",
          "source.imports[5]": "fopen",
          "source.imports[6]": "fsockopen",
          "source.imports[7]": "fwrite",
          "source.imports[8]": "get_current_user",
          "source.imports[9]": "glob",
          "source.strings[0]": "$6$roottn$",
          "source.strings[1]": "/etc/*",
          "source.strings[2]": "/home/",
          "source.strings[3]": "/shadow",
          "source.strings[4]": "/shadow.roottn.bak",
          "source.strings[5]": "16249:::::",
          "source.strings[6]": "SERVER_NAME",
          "source.strings[7]": "anon812",
          "source.strings[8]": "max_execution_time",
          "source.strings[9]": "memory_limit",
          "source.has_imports": true,
          "source.imports[10]": "ini_set",
          "source.imports[11]": "is_resource",
          "source.imports[12]": "link",
          "source.imports[13]": "set_time_limit",
          "source.imports[14]": "str_replace",
          "source.imports[15]": "unlink"
        },
        "x": 39,
        "id": 0,
        "is": [
          "set_time_limit",
          "ini_set",
          "ini_set",
          "get_current_user",
          "crypt",
          "str_replace",
          "glob",
          "explode",
          "count",
          "file_get_contents",
          "explode",
          "link",
          "unlink",
          "explode",
          "fopen",
          "fwrite",
          "fclose",
          "fsockopen",
          "is_resource",
          "fclose"
        ],
        "ms": {
          "file": {
            "size": 1298.0
          },
          "text": {
            "tab_count": 1.0,
            "digit_ratio": 0.05,
            "space_count": 91.0,
            "total_lines": 65.0,
            "char_entropy": 5.28,
            "mixed_indent": true,
            "unique_chars": 75.0,
            "import_density": 30.77,
            "string_density": 1.11,
            "avg_line_length": 18.97,
            "max_line_length": 109.0,
            "empty_line_ratio": 0.23,
            "last_line_length": 2.0,
            "long_token_count": 1.0,
            "most_common_char": "e",
            "whitespace_ratio": 0.12,
            "most_common_ratio": 0.07,
            "identifier_density": 1.2,
            "line_length_stddev": 22.43,
            "normalized_import_count": 2.48,
            "normalized_string_count": 8.93,
            "max_inline_whitespace_run": 2.0,
            "trailing_whitespace_lines": 10.0,
            "suspicious_identifier_ratio": 0.09,
            "normalized_unique_identifiers": 5.81
          },
          "imports": {
            "total": 20.0,
            "unique_modules": 16.0,
            "third_party_count": 20.0,
            "third_party_ratio": 1.0
          },
          "strings": {
            "total": 72.0,
            "ip_count": 2.0,
            "avg_length": 6.0,
            "max_length": 18.0,
            "path_count": 34.0,
            "avg_entropy": 1.9,
            "total_bytes": 432.0,
            "entropy_stddev": 0.96
          },
          "comments": {
            "chars": 128.0,
            "lines": 13.0,
            "total": 13.0,
            "to_code_ratio": 0.25
          },
          "functions": {},
          "identifiers": {
            "total": 78.0,
            "avg_length": 6.6,
            "max_length": 17.0,
            "min_length": 1.0,
            "avg_entropy": 2.16,
            "reuse_ratio": 0.45,
            "unique_count": 35.0,
            "length_stddev": 4.02,
            "sequential_names": 3.0,
            "single_char_count": 3.0,
            "single_char_ratio": 0.09,
            "all_lowercase_ratio": 0.94,
            "all_uppercase_ratio": 0.06,
            "underscore_prefix_count": 1.0
          }
        },
        "ss": [
          [
            57,
            "max_execution_time"
          ],
          [
            58,
            "max_execution_time"
          ],
          [
            90,
            "memory_limit"
          ],
          [
            91,
            "memory_limit"
          ],
          [
            189,
            "25"
          ],
          [
            190,
            "25"
          ],
          [
            262,
            "anon812"
          ],
          [
            263,
            "anon812"
          ],
          [
            304,
            "$6$roottn$"
          ],
          [
            305,
            "$6$roottn$"
          ],
          [
            347,
            "SERVER_NAME"
          ],
          [
            348,
            "SERVER_NAME"
          ],
          [
            389,
            "www."
          ],
          [
            390,
            "www."
          ],
          [
            419,
            "/home/"
          ],
          [
            420,
            "/home/"
          ],
          [
            434,
            "/etc/*"
          ],
          [
            435,
            "/etc/*"
          ],
          [
            497,
            "/"
          ],
          [
            498,
            "/"
          ],
          [
            580,
            "/home/"
          ],
          [
            581,
            "/home/"
          ],
          [
            595,
            "/etc/"
          ],
          [
            596,
            "/etc/"
          ],
          [
            609,
            "/shadow"
          ],
          [
            610,
            "/shadow"
          ],
          [
            640,
            "\\r\\n"
          ],
          [
            679,
            "/home/"
          ],
          [
            680,
            "/home/"
          ],
          [
            694,
            "/etc/"
          ],
          [
            695,
            "/etc/"
          ],
          [
            708,
            "/shadow"
          ],
          [
            709,
            "/shadow"
          ],
          [
            718,
            "/home/"
          ],
          [
            719,
            "/home/"
          ],
          [
            733,
            "/etc/"
          ],
          [
            734,
            "/etc/"
          ],
          [
            747,
            "/shadow.roottn.bak"
          ],
          [
            748,
            "/shadow.roottn.bak"
          ],
          [
            794,
            "/home/"
          ],
          [
            795,
            "/home/"
          ],
          [
            809,
            "/etc/"
          ],
          [
            810,
            "/etc/"
          ],
          [
            823,
            "/shadow"
          ],
          [
            824,
            "/shadow"
          ],
          [
            914,
            "/home/"
          ],
          [
            915,
            "/home/"
          ],
          [
            929,
            "/etc/"
          ],
          [
            930,
            "/etc/"
          ],
          [
            943,
            "/shadow"
          ],
          [
            944,
            "/shadow"
          ],
          [
            953,
            "ab"
          ],
          [
            954,
            "ab"
          ],
          [
            981,
            "16249:::::"
          ],
          [
            982,
            "16249:::::"
          ],
          [
            995,
            "\\r\\n"
          ],
          [
            1020,
            "tazx"
          ],
          [
            1021,
            "tazx"
          ],
          [
            1033,
            "|25|"
          ],
          [
            1034,
            "|25|"
          ],
          [
            1043,
            "@"
          ],
          [
            1044,
            "@"
          ],
          [
            1053,
            "|"
          ],
          [
            1054,
            "|"
          ],
          [
            1067,
            "tazx"
          ],
          [
            1068,
            "tazx"
          ],
          [
            1267,
            "\u003cbr/\u003e"
          ],
          [
            1268,
            "\u003cbr/\u003e"
          ]
        ],
        "sz": 1298,
        "ts": [
          {
            "a": "T1505.003",
            "c": 0.9399999976158142,
            "d": "Regex component marker",
            "e": [
              "file_get_contents"
            ],
            "i": "objectives/command-and-control/backdoor/webshell/request::raw-json-post-cmd-field--rx-7",
            "l": 1,
            "m": "B0030"
          },
          {
            "a": "T1083",
            "c": 1.0,
            "d": "Iterate directory contents via functions in PHP",
            "e": [
              "glob("
            ],
            "i": "micro-behaviors/fs/directory/traverse::php-dir-traverse-fn",
            "l": 2
          },
          {
            "c": 0.75,
            "d": "Generic $_SERVER superglobal access",
            "e": [
              "$_SERVER"
            ],
            "i": "micro-behaviors/communications/http/request/params::server-dup",
            "l": 3
          },
          {
            "c": 0.8999999761581421,
            "d": "File has 30 or more lines",
            "e": [
              "text.total_lines = 65.00"
            ],
            "i": "metadata/file/text/metrics::file-has-30-plus-lines",
            "l": 1
          },
          {
            "c": 0.8600000143051147,
            "d": "Regex component marker",
            "e": [
              "$_SERVER["
            ],
            "i": "objectives/command-and-control/backdoor/webshell/ui::self-named-get-form--rx-4",
            "l": 1,
            "m": "B0030"
          },
          {
            "d": "password keyword",
            "e": [
              "password"
            ],
            "i": "micro-behaviors/data/text/keywords/lexicon::password",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "Writes data to an open file",
            "e": [
              "fwrite"
            ],
            "i": "micro-behaviors/fs/write/file/direct::fwrite",
            "l": 3,
            "m": "C0052"
          },
          {
            "c": 0.8500000238418579,
            "d": "Removes PHP script execution time limit",
            "e": [
              "set_time_limit(0)"
            ],
            "i": "objectives/command-and-control/backdoor/webshell/session::unlimited-runtime-call",
            "l": 4
          },
          {
            "c": 0.699999988079071,
            "d": "PHP error suppression operator usage",
            "e": [
              "@fsockopen($site, $port, $errno, $errstr, 2)",
              "@$passwd = file_get_contents('/home/'.$user.'/etc/'.$site.'/shadow')",
              "@str_replace(\"www.\",\"\",$t)",
              "@link('/home/'.$user.'/etc/'.$site.'/shadow','/home/'.$user.'/etc/'.$site.'/shadow.roottn.bak')",
              "@unlink('/home/'.$user.'/etc/'.$site.'/shadow')"
            ],
            "i": "micro-behaviors/os/stdio::error-suppress-prefix",
            "l": 3
          },
          {
            "a": "T1505.003",
            "d": "PHP open tag",
            "e": [
              "\u003c?php"
            ],
            "i": "objectives/command-and-control/backdoor/webshell/request::php-tag",
            "l": 1,
            "m": "B0030"
          },
          {
            "c": 1.0,
            "d": "PHP unlink function symbol",
            "e": [
              "unlink"
            ],
            "i": "micro-behaviors/fs/delete/file::php-unlink",
            "l": 3
          },
          {
            "a": "T1546",
            "c": 1.0,
            "d": "Writes data to a file via functions",
            "e": [
              "fopen("
            ],
            "i": "micro-behaviors/fs/file/write/direct::php-file-write-func",
            "l": 2
          },
          {
            "c": 0.8399999737739563,
            "d": "password/token/api_key field keyword",
            "e": [
              "password"
            ],
            "i": "micro-behaviors/data/text/keywords/credential::credential-field",
            "l": 1
          },
          {
            "a": "T1082",
            "d": "Accesses SERVER_NAME variable",
            "e": [
              "$_SERVER['SERVER_NAME']"
            ],
            "i": "objectives/discovery/system/fingerprint/info::server-name-access",
            "l": 3,
            "m": "E1082"
          },
          {
            "c": 0.75,
            "d": "Inline password token in lure",
            "e": [
              "password='anon812'"
            ],
            "i": "objectives/lateral-movement/social-engineering/lures::inline-password-token",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "Remove execution time limit",
            "e": [
              "set_time_limit"
            ],
            "i": "micro-behaviors/process/control/signal::set-time-limit",
            "l": 3
          }
        ],
        "sha": "cd8545fffe5da0e9ddbbf596249d28a632fc835e9b43e159375783960b20e4ea",
        "path": "/data/samples/bad/datasets/awesome-malware/PHP/smtp.php",
        "type": "php"
      }
    ],
    "tv": "a9555"
  }
}