{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9815208315849304, "class": 2 } ], "prob": 0.98152083, "class": 2, "models": [ { "m": "az", "prob": 0.7901902, "class": 0 }, { "m": "az/scripts", "prob": 0.9055391, "class": 0 }, { "m": "az/php", "prob": 0.98152083, "class": 2 } ], "version": "v16.16", "thresholds": [ 0.9961138, 0.99909174 ], "analyzed_at": "2026-05-09T19:17:01Z" }, "path": "blocker_4.php", "raw": { "v": "4", "fs": [ { "f": "O₂(AsC)H₂(PoDb)Md₂(Pt)", "k": { "source.imports[0]": "WLIRJ", "source.imports[1]": "base64_decode", "source.imports[2]": "chr", "source.imports[3]": "eval", "source.imports[4]": "gzinflate", "source.imports[5]": "ord", "source.imports[6]": "strlen", "source.strings[0]": "nVX/btpIEH4AnmJBkTBVuvWu1/ZaveSUtlxzEg0RISdFpytaYAErxotspwmtePabAWwvUdEd9R+wszPfzDc/dpcQ+BqNs4XJi1QtNbkgc12gNF6r6TRzzkZ33cFf3cHf7UH3S3/YHV19+jRo/9N53zgbJ2byqKejZ5NNcwCqLFNrp6XG5ptunbfmxswTXORmViRqrTNYq6X6blL1nMN6sv6m4yRR6QStVos4XxQqfYT1NNNqiSRgnepiFScGlxOVrF/iNC/i4qlATGGyt/olBh1prdR6pZIWEJsZgE8WziuCKidnuOqQHw3MOp4RJ38a50U2mpintHCqIpyXhpfELa0XWk115rSuh8Pbd4y6RLiC3JiC/AHYKYYl+28aa6f124Jd9vo9ct3t9frkQ39IHvr35OPVzZAMulcfr8mXB3J79bnbbDY/CERv4RvoxQYKq9JUT/+8rWv6NQgoczl9Q99grl89CaJbicwNKQstWUSUu4fWfiWGgjJeimTn23cpE3u9D/owOBpLotqrZEBzCFepuQS5ZhpydMwivpe5K2ngw574GRvUR1SCHtzsNxgE8CLq8WMAyJ0HlkdkxyJRMxTgALYC9winV8UFeybrhMCTz2kgLRkccK/cCMAbcgQeJWNOsZ6RV1pEmHLpEFRh7d1jFO1LWQRbZyCS0nlU115GlHk1NQmRg7pRULZA2BL3j0KBGwu5NUCglsFB0lZcZMgju4u7Dc6FtcGEd4Bg/isPntU1Bl3zuF2UKDyq3Q+FPXLuLtm9WmBDhbQaHtKqu+DLHhcgBjPIfV7l6lERUunWaGypF1jROLOnA9WhX8El9YVVORwHGGBP2APsY6tCKyL3cUgja0IYZbyO4QFr17OOIIx3TQmPgKhPLHchhMSxrOsFh4BXh4j5cpt1xRLGmUl5WFE8R25lAAV8nZW0SgxqnJk6AvZfbjcPNlgU2FlDABbuMcH2JoA6hKyqpHWwMUnMi2EV4IaMZ06cjnYX4pFX6by6OjvlvV1e3O2fX9zt8uLGZ8QBYUN0kusSXD8l5ZWMr0i8qryT3UvirDI9Hy1VAbbtd21C0Qh+YX1+7AXt2C5OoVp/v/bU1PhNY/+3aWB54SlcmdwqLhIZ3YM0AvzNEApM2rtnvd0hJiP/C7DM07EpTgA8qIUxTXKXPGWrU2F3Wj/q7ATU5206pxEcx+n8NMQkU8/JSbxu15P7Qe8EwExNIA3zqF8KnaUqWcRIsHlxQWYKJhom9r/na3sK3sM8NH6//Bc=", "source.has_imports": true, "source.functions[0]": "WLIRJ" }, "x": 31, "id": 0, "is": [ "gzinflate", "base64_decode", "strlen", "chr", "ord", "eval", "WLIRJ" ], "ms": { "file": { "size": 1468.0 }, "text": { "digit_ratio": 0.16, "space_count": 16.0, "total_lines": 1.0, "char_entropy": 6.13, "unique_chars": 82.0, "import_density": 700.0, "lines_over_200": 1.0, "lines_over_500": 1.0, "string_density": 2.0, "avg_line_length": 1468.0, "lines_over_1000": 1.0, "max_line_length": 1468.0, "last_line_length": 1468.0, "long_token_count": 1.0, "most_common_char": "c", "whitespace_ratio": 0.01, "most_common_ratio": 0.02, "identifier_density": 20.0, "encoded_string_ratio": 1.0, "normalized_import_count": 7.0, "normalized_string_count": 2.0, "max_inline_whitespace_run": 1.0, "normalized_function_count": 1.0, "imports_to_functions_ratio": 7.0, "strings_to_functions_ratio": 2.0, "suspicious_identifier_ratio": 0.11, "identifiers_to_functions_ratio": 9.0 }, "imports": { "total": 7.0, "unique_modules": 7.0, "third_party_count": 7.0, "third_party_ratio": 1.0 }, "strings": { "total": 2.0, "avg_length": 1268.0, "max_length": 1268.0, "avg_entropy": 5.96, "total_bytes": 2536.0, "base64_candidates": 2.0, "very_long_strings": 2.0, "high_entropy_count": 2.0 }, "comments": { "chars": 31.0, "lines": 1.0, "total": 1.0 }, "functions": { "total": 1.0, "one_liners": 1.0, "avg_name_length": 5.0, "no_params_count": 1.0, "avg_length_lines": 1.0, "max_length_lines": 1.0, "min_length_lines": 1.0, "density_per_100_lines": 100.0, "code_in_functions_ratio": 1.0 }, "identifiers": { "total": 20.0, "avg_length": 5.22, "max_length": 13.0, "min_length": 1.0, "avg_entropy": 2.0, "reuse_ratio": 0.45, "unique_count": 9.0, "length_stddev": 3.49, "has_digit_ratio": 0.11, "sequential_names": 1.0, "single_char_count": 1.0, "single_char_ratio": 0.11, "all_lowercase_ratio": 0.67, "all_uppercase_ratio": 0.11 } }, "ss": [ [ 193, "nVX/btpIEH4AnmJBkTBVuvWu1/ZaveSUtlxzEg0RISdFpytaYAErxotspwmtePabAWwvUdEd9R+wszPfzDc/dpcQ+BqNs4XJi1QtNbkgc12gNF6r6TRzzkZ33cFf3cHf" ], [ 194, "nVX/btpIEH4AnmJBkTBVuvWu1/ZaveSUtlxzEg0RISdFpytaYAErxotspwmtePabAWwvUdEd9R+wszPfzDc/dpcQ+BqNs4XJi1QtNbkgc12gNF6r6TRzzkZ33cFf3cHf" ] ], "sz": 1468, "ts": [ { "c": 0.8399999737739563, "d": "\"store\" doc cue (storage instruction)", "e": [ "store" ], "i": "micro-behaviors/data/text/llm/action::llm-send-action-cond-6--inline-11769", "l": 1 }, { "a": "T1505.003", "c": 0.8999999761581421, "d": "PHP source imports base64_decode", "e": [ "[WLIRJ, base64_decode, chr, eval, gzinflate, ord, strlen]" ], "i": "objectives/command-and-control/backdoor/webshell/stager::source-import-base64-decode", "l": 1 }, { "c": 0.800000011920929, "d": "Very short file (under 12 lines)", "e": [ "text.total_lines = 1.00" ], "i": "metadata/file/text/metrics::file-under-12-lines", "l": 1 }, { "c": 0.8999999761581421, "d": "Very long line", "e": [ "text.max_line_length = 1468.00" ], "i": "metadata/file/text/metrics::single-long-line", "l": 1 }, { "a": "T1505.003", "c": 0.8600000143051147, "d": "Very long embedded string", "e": [ "strings.max_length = 1268.00" ], "i": "objectives/command-and-control/backdoor/webshell/stager::very-long-string", "l": 1 }, { "c": 0.949999988079071, "d": "PHP open tag (\u003c?php)", "e": [ "\u003c?php" ], "i": "metadata/lang/scripted::php-open-tag", "l": 1 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Exactly one line exceeds 1000 chars", "e": [ "text.lines_over_1000 = 1.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::single-long-line-outlier", "l": 1, "m": "B0032" }, { "a": "T1505.003", "c": 0.8399999737739563, "d": "Near-zero whitespace script", "e": [ "text.whitespace_ratio = 0.01" ], "i": "objectives/command-and-control/backdoor/webshell/stager::near-zero-whitespace", "l": 1 }, { "c": 0.949999988079071, "d": "File is a one-liner", "e": [ "text.total_lines = 1.00" ], "i": "metadata/file/text/metrics::file-one-liner", "l": 1 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Last line is over 1000 chars", "e": [ "text.last_line_length = 1468.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::last-line-over-1000", "l": 1, "m": "B0032" }, { "a": "T1059.006", "c": 0.75, "d": "PHP eval() token present", "e": [ "eval" ], "i": "micro-behaviors/process/interpreter/eval::eval-symbol", "l": 4, "m": "E1059" }, { "a": "T1027", "c": 0.8500000238418579, "d": "High function density", "e": [ "functions.density_per_100_lines = 100.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/functions::high-function-density", "l": 2, "m": "B0032" }, { "a": "T1027", "c": 0.800000011920929, "d": "High overall text entropy (encoded", "e": [ "text.char_entropy = 6.13" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::high-text-entropy", "l": 2, "m": "B0032" }, { "c": 0.6000000238418579, "d": "Very long base64 strings present", "e": [ "nVX/btpIEH4AnmJBkTBVuvWu1/ZaveSUtlxzEg0RISdFpytaYAErxotspwmtePabAWwvUdEd9R+wszPfzDc/dpcQ+BqNs4XJi1QtNbkgc12gNF6r6TRzzkZ33cFf3cHf" ], "i": "objectives/anti-static/obfuscation/string/base64::long-base64-in-strings", "l": 3 } ], "sha": "d07200dcd2926890262b78986792b6c1e80246732ad1d53d77bd7c66a5aeba23", "path": "blocker_4.php", "type": "php" } ], "tv": "87c42" } }