{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9999779462814331, "class": 2 } ], "prob": 0.99997795, "class": 2, "models": [ { "m": "az", "prob": 0.99919266, "class": 2 }, { "m": "az/scripts", "prob": 0.99997413, "class": 2 }, { "m": "az/php", "prob": 0.99997795, "class": 2 } ], "version": "v16.16", "thresholds": [ 0.9961138, 0.99909174 ], "analyzed_at": "2026-05-09T22:43:18Z" }, "path": "f1.php", "raw": { "v": "4", "fs": [ { "f": "KO₂(As₃C₂)H(Po)Md₃(Pt)Th", "k": { "source.imports[0]": "base64_decode", "source.imports[1]": "eval", "source.imports[2]": "gzinflate", "source.strings[0]": "d2RyMTU5c3E0YXllejd4Y2duZl90djhubHVrNmpoYmlvMzJtcA==", "source.strings[1]": "hY7NCoJAFIVf5SQu5tIUzVpc9hxSeq0huwPzA4X47ikxEm7anu/82V7t+iRttE4aftkQgyq8iyyt67ggGjPFqqoyRG/lpsvL0yWJhBHlg9+oEdJ1ZqsBJw1DFWyvZmVgyYTq2iwxzzF5QXv3yvlOLS2EPXJxhQk8BP7vxHH5d/7+274wGpv5gyH9uzJNHw==", "source.strings[2]": "wdr159sq4ayez7xcgnf_tv8nluk6jhbio32mp", "source.strings[3]": "xes26:tr5bzf{8ydhog`uw9omvl7kicjp43nq", "source.has_imports": true }, "x": 285, "id": 0, "is": [ "base64_decode", "eval", "gzinflate", "base64_decode" ], "ms": { "file": { "size": 15970.0 }, "text": { "digit_ratio": 0.17, "space_count": 432.0, "total_lines": 8.0, "char_entropy": 6.07, "unique_chars": 85.0, "import_density": 50.0, "lines_over_200": 3.0, "lines_over_500": 1.0, "string_density": 0.75, "avg_line_length": 1995.25, "lines_over_1000": 1.0, "max_line_length": 14981.0, "last_line_length": 14981.0, "long_token_count": 1.0, "most_common_char": "k", "whitespace_ratio": 0.03, "most_common_ratio": 0.02, "identifier_density": 5.13, "line_length_stddev": 4908.74, "encoded_string_ratio": 0.67, "normalized_import_count": 1.41, "normalized_string_count": 2.12, "repeated_char_sequences": 1.0, "suspicious_string_ratio": 0.33, "max_inline_whitespace_run": 1.0, "normalized_unique_identifiers": 2.67 }, "imports": { "total": 4.0, "unique_modules": 3.0, "third_party_count": 4.0, "third_party_ratio": 1.0 }, "strings": { "total": 6.0, "avg_length": 93.67, "max_length": 192.0, "avg_entropy": 5.28, "total_bytes": 562.0, "entropy_stddev": 0.3, "base64_candidates": 4.0, "high_entropy_count": 4.0, "shell_command_strings": 2.0 }, "comments": {}, "functions": {}, "identifiers": { "total": 41.0, "avg_length": 10.25, "max_length": 13.0, "min_length": 4.0, "avg_entropy": 2.11, "reuse_ratio": 0.2, "unique_count": 8.0, "length_stddev": 2.68, "has_digit_ratio": 0.75, "all_lowercase_ratio": 0.25, "numeric_suffix_count": 3.0 } }, "ss": [ [ 34, "d2RyMTU5c3E0YXllejd4Y2duZl90djhubHVrNmpoYmlvMzJtcA==" ], [ 35, "d2RyMTU5c3E0YXllejd4Y2duZl90djhubHVrNmpoYmlvMzJtcA==" ], [ 120, "hY7NCoJAFIVf5SQu5tIUzVpc9hxSeq0huwPzA4X47ikxEm7anu/82V7t+iRttE4aftkQgyq8iyyt67ggGjPFqqoyRG/lpsvL0yWJhBHlg9+oEdJ1ZqsBJw1DFWyvZmVg" ], [ 121, "hY7NCoJAFIVf5SQu5tIUzVpc9hxSeq0huwPzA4X47ikxEm7anu/82V7t+iRttE4aftkQgyq8iyyt67ggGjPFqqoyRG/lpsvL0yWJhBHlg9+oEdJ1ZqsBJw1DFWyvZmVg" ], [ 522, "xes26:tr5bzf{8ydhog`uw9omvl7kicjp43nq" ], [ 523, "xes26:tr5bzf{8ydhog`uw9omvl7kicjp43nq" ], [ 6, "base64", "wdr159sq4ayez7xcgnf_tv8nluk6jhbio32mp" ] ], "sz": 15970, "ts": [ { "c": 0.949999988079071, "d": "PHP opening tag present", "e": [ "\u003c?php" ], "i": "metadata/lang/scripted::php-open-tag", "l": 1 }, { "a": "T1505.003", "c": 0.8999999761581421, "d": "PHP source imports base64_decode", "e": [ "[base64_decode, eval, gzinflate]" ], "i": "objectives/command-and-control/backdoor/webshell/stager::source-import-base64-decode", "l": 1 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Last line is over 1000 chars", "e": [ "text.last_line_length = 14981.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::last-line-over-1000", "l": 1, "m": "B0032" }, { "a": "T1505.003", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "eval(gzinflate(" ], "i": "objectives/command-and-control/backdoor/webshell/decoder::eval-decoder-chain--rx-2", "l": 1, "m": "B0030" }, { "c": 0.8999999761581421, "d": "Very long line", "e": [ "text.max_line_length = 14981.00" ], "i": "metadata/file/text/metrics::single-long-line", "l": 1 }, { "a": "T1027", "c": 0.8500000238418579, "d": "High entropy strings (base64/gzinflate encoded)", "e": [ "strings.avg_entropy = 5.28" ], "i": "objectives/anti-static/obfuscation/code-metrics/identifiers::php-encoded-strings", "l": 4, "m": "B0032" }, { "a": "T1027", "c": 0.8999999761581421, "d": "Exactly one line exceeds 1000 chars", "e": [ "text.lines_over_1000 = 1.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::single-long-line-outlier", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "Very short file (under 12 lines)", "e": [ "text.total_lines = 8.00" ], "i": "metadata/file/text/metrics::file-under-12-lines", "l": 1 }, { "c": 0.800000011920929, "d": "PHP variable function invocation pattern", "e": [ "O0O0O0O0O0O0" ], "i": "objectives/anti-static/obfuscation/imports::dynamic-function-execution", "l": 3 }, { "a": "T1505.003", "c": 0.8999999761581421, "d": "PHP file 12-22KB (single-file webshell size band)", "e": [ "f1.php" ], "i": "well-known/malware/webshell/zaco::single-file-webshell-metrics", "l": 1, "m": "B0030" }, { "a": "T1059.006", "c": 0.75, "d": "PHP eval() token present", "e": [ "eval" ], "i": "micro-behaviors/process/interpreter/eval::eval-symbol", "l": 4, "m": "E1059" }, { "a": "T1027", "c": 0.800000011920929, "d": "High entropy strings (encoded/encrypted data)", "e": [ "strings.avg_entropy = 5.28" ], "i": "objectives/anti-static/obfuscation/code-metrics/strings::high-entropy-strings-dup", "l": 3, "m": "B0032" }, { "a": "T1027", "c": 0.800000011920929, "d": "High overall text entropy (encoded", "e": [ "text.char_entropy = 6.07" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::high-text-entropy", "l": 2, "m": "B0032" }, { "a": "T1027", "c": 0.699999988079071, "d": "Very low whitespace ratio (minified/compressed)", "e": [ "text.whitespace_ratio = 0.03" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::low-whitespace", "l": 2, "m": "B0032" }, { "a": "T1027", "c": 0.8999999761581421, "d": "PHP source contains very long line", "e": [ "text.max_line_length = 14981.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/identifiers::php-single-long-line", "l": 4, "m": "B0032" }, { "a": "T1027", "c": 0.949999988079071, "d": "PHP webshell pattern detected", "e": [ "strings.avg_entropy = 5.28", "text.max_line_length = 14981.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/identifiers::php-webshell-pattern", "l": 4, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Encoded payload detected: base64", "e": [ "wdr159sq4ayez7xcgnf_tv8nluk6jhbio32mp \u003cbase64\u003e" ], "i": "metadata/encoded-payload/base64", "l": 3 }, { "c": 0.8999999761581421, "d": "Chinese Hacktool Set - file templatr.php", "e": [ "eval(gzinflate(base64_decode('" ], "i": "third_party/SigBase/Templatr", "l": 5 }, { "c": 0.8999999761581421, "d": "PHP webshell which directly eval()s obfuscated string", "e": [ "\u003c?php", "\u003c?", "eval(gzinflate(base64_decode(" ], "i": "third_party/SigBase/WEBSHELL/PHP/Gzinflated", "l": 5 }, { "c": 0.8999999761581421, "d": "PHP webshell using $a($code) for kind of eval with encoded blob to decode, e.g. b374k", "e": [ "$OO000OO000OO(base64_decode", "$O0O0O0O0O0O0(\"", "\u003c?", "\u003c?php", "eval(", "ase6" ], "i": "third_party/SigBase/WEBSHELL/PHP/Dynamic/Big", "l": 5 }, { "c": 0.8999999761581421, "d": "PHP webshell using some kind of eval with encoded blob to decode, which is checked with YARAs math.entropy module", "e": [ "\u003c?", "eval($", "\u003c?php", "eval(g" ], "i": "third_party/SigBase/WEBSHELL/PHP/Encoded/Big", "l": 5 } ], "sha": "dd64b7b64bcc6e7b77f846bf1fab4db11652f30dd9ab0428e513d52df0739886", "path": "f1.php", "type": "php" } ], "tv": "87c42" } }