{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9399284720420837, "class": 2 } ], "prob": 0.9399285, "class": 2, "models": [ { "m": "az", "prob": 0.6722479, "class": 0 }, { "m": "az/scripts", "prob": 0.38508108, "class": 0 }, { "m": "az/php", "prob": 0.9399285, "class": 2 } ], "version": "v16.16", "thresholds": [ 0.9961138, 0.99909174 ], "analyzed_at": "2026-05-09T11:49:47Z" }, "path": "checkmob.php", "raw": { "v": "4", "fs": [ { "f": "O₂(C₄As)H(Cm)Md", "k": { "source.imports[0]": "getenv", "source.imports[1]": "in_array", "source.imports[2]": "isset", "source.imports[3]": "preg_match", "source.imports[4]": "strpos", "source.imports[5]": "strtolower", "source.imports[6]": "substr", "source.strings[0]": "/(mini 9.5|vx1000|lge |m800|e860|u940|ux840|compal|", "source.strings[1]": "HTTP_ACCEPT", "source.strings[2]": "HTTP_PROFILE", "source.strings[3]": "HTTP_USER_AGENT", "source.strings[4]": "HTTP_X_WAP_PROFILE", "source.strings[5]": "_mms|myx|a700|gu1100|bc831|e300|ems100|me701|me702m-three|sd588|", "source.strings[6]": "application/vnd.wap.xhtml+xml", "source.strings[7]": "d736|p-9521|telco|sl74|ktouch|m4u\\/|me702|8325rc|kddi|phone|lg |", "source.strings[8]": "fennec|blackberry|htc_|opera m|windowsphone)/", "source.strings[9]": "htil-g1|fly v71|s302|-x113|novarra|k610i|-three|8325rc|8352rc|", "source.has_imports": true, "source.strings[10]": "i250|sprint|w398samr810|m5252|c7100|mt126|x225|s5330|s820|", "source.strings[11]": "lg370|sam-r|mg50|s55|g83|t66|vx400|mk99|d615|d763|el370|sl900|", "source.strings[12]": "m881|s920|n210|s700|c-810|_h797|mob-x|sk16d|848b|mowser|s580|", "source.strings[13]": "mp500|samu3|samu4|vx10|xda_|samu5|samu6|samu7|samu9|a615|b832|", "source.strings[14]": "p404i|s210|c5100|teleca|s940|c500|s590|foma|samsu|vx8|vx9|a1000|", "source.strings[15]": "pocket|kindle|mobile|psp|treo|android|iphone|ipod|webos|wp7|wp8|", "source.strings[16]": "r800|471x|v120|rim8|c500foma:|160x|x160|480x|x640|t503|w839|", "source.strings[17]": "s800|8325rc|ac831|mw200|brew |d88|htc\\/|htc_touch|355x|m50|km100|", "source.strings[18]": "sanyo|vx54|c888|nx250|n120|mtk |c5588|s710|t880|c5005|i;458x|", "source.strings[19]": "sonyericsson|samsung|240x|x320vx10|nokia|sony cmd|motorola|", "source.strings[20]": "text/vnd.wap.wml", "source.strings[21]": "up.browser|up.link|mmp|symbian|smartphone|midp|wap|vodafone|o2|", "source.strings[22]": "wireless| mobi|ahong|lg380|lgku|lgu900|lg210|lg47|lg920|lg840|", "source.functions[0]": "is_mobile" }, "x": 33, "id": 0, "is": [ "strtolower", "getenv", "strtolower", "getenv", "strpos", "strpos", "isset", "isset", "preg_match", "in_array", "substr" ], "ms": { "file": { "size": 6013.0 }, "text": { "digit_ratio": 0.21, "space_count": 991.0, "total_lines": 94.0, "char_entropy": 4.97, "unique_chars": 84.0, "import_density": 11.7, "string_density": 8.96, "avg_line_length": 61.99, "high_byte_ratio": 0.09, "max_line_length": 154.0, "non_ascii_ratio": 0.09, "empty_line_ratio": 0.13, "last_line_length": 2.0, "most_common_char": "\"", "whitespace_ratio": 0.2, "most_common_ratio": 0.13, "identifier_density": 0.21, "line_length_stddev": 35.6, "normalized_import_count": 1.13, "normalized_string_count": 86.85, "repeated_char_sequences": 46.0, "max_inline_whitespace_run": 1.0, "normalized_function_count": 0.1, "trailing_whitespace_lines": 5.0, "imports_to_functions_ratio": 11.0, "strings_to_functions_ratio": 842.0, "normalized_unique_identifiers": 1.68, "identifiers_to_functions_ratio": 11.0 }, "imports": { "total": 11.0, "unique_modules": 7.0, "third_party_count": 11.0, "third_party_ratio": 1.0 }, "strings": { "total": 842.0, "avg_length": 6.46, "max_length": 65.0, "path_count": 2.0, "avg_entropy": 2.02, "total_bytes": 5436.0, "entropy_stddev": 0.51 }, "comments": { "chars": 597.0, "lines": 5.0, "total": 5.0, "to_code_ratio": 0.06 }, "functions": { "total": 1.0, "avg_name_length": 9.0, "no_params_count": 1.0, "avg_length_lines": 85.0, "max_length_lines": 85.0, "min_length_lines": 85.0, "density_per_100_lines": 1.06, "code_in_functions_ratio": 0.9 }, "identifiers": { "total": 20.0, "avg_length": 7.55, "max_length": 10.0, "min_length": 5.0, "avg_entropy": 2.53, "reuse_ratio": 0.55, "unique_count": 11.0, "length_stddev": 1.83, "all_lowercase_ratio": 0.91, "all_uppercase_ratio": 0.09, "underscore_prefix_count": 1.0 } }, "ss": [ [ 65, "HTTP_USER_AGENT" ], [ 66, "HTTP_USER_AGENT" ], [ 115, "HTTP_ACCEPT" ], [ 116, "HTTP_ACCEPT" ], [ 158, "text/vnd.wap.wml" ], [ 159, "text/vnd.wap.wml" ], [ 213, "application/vnd.wap.xhtml+xml" ], [ 214, "application/vnd.wap.xhtml+xml" ], [ 427, "HTTP_X_WAP_PROFILE" ], [ 428, "HTTP_X_WAP_PROFILE" ], [ 475, "HTTP_PROFILE" ], [ 476, "HTTP_PROFILE" ], [ 677, "/(mini 9.5|vx1000|lge |m800|e860|u940|ux840|compal|" ], [ 678, "/(mini 9.5|vx1000|lge |m800|e860|u940|ux840|compal|" ], [ 737, "wireless| mobi|ahong|lg380|lgku|lgu900|lg210|lg47|lg920|lg840|" ], [ 738, "wireless| mobi|ahong|lg380|lgku|lgu900|lg210|lg47|lg920|lg840|" ], [ 808, "lg370|sam-r|mg50|s55|g83|t66|vx400|mk99|d615|d763|el370|sl900|" ], [ 809, "lg370|sam-r|mg50|s55|g83|t66|vx400|mk99|d615|d763|el370|sl900|" ], [ 879, "mp500|samu3|samu4|vx10|xda_|samu5|samu6|samu7|samu9|a615|b832|" ], [ 880, "mp500|samu3|samu4|vx10|xda_|samu5|samu6|samu7|samu9|a615|b832|" ], [ 950, "m881|s920|n210|s700|c-810|_h797|mob-x|sk16d|848b|mowser|s580|" ], [ 951, "m881|s920|n210|s700|c-810|_h797|mob-x|sk16d|848b|mowser|s580|" ], [ 1020, "r800|471x|v120|rim8|c500foma:|160x|x160|480x|x640|t503|w839|" ], [ 1021, "r800|471x|v120|rim8|c500foma:|160x|x160|480x|x640|t503|w839|" ], [ 1089, "i250|sprint|w398samr810|m5252|c7100|mt126|x225|s5330|s820|" ], [ 1090, "i250|sprint|w398samr810|m5252|c7100|mt126|x225|s5330|s820|" ], [ 1156, "htil-g1|fly v71|s302|-x113|novarra|k610i|-three|8325rc|8352rc|" ], [ 1157, "htil-g1|fly v71|s302|-x113|novarra|k610i|-three|8325rc|8352rc|" ], [ 1227, "sanyo|vx54|c888|nx250|n120|mtk |c5588|s710|t880|c5005|i;458x|" ], [ 1228, "sanyo|vx54|c888|nx250|n120|mtk |c5588|s710|t880|c5005|i;458x|" ], [ 1297, "p404i|s210|c5100|teleca|s940|c500|s590|foma|samsu|vx8|vx9|a1000|" ], [ 1298, "p404i|s210|c5100|teleca|s940|c500|s590|foma|samsu|vx8|vx9|a1000|" ], [ 1370, "_mms|myx|a700|gu1100|bc831|e300|ems100|me701|me702m-three|sd588|" ], [ 1371, "_mms|myx|a700|gu1100|bc831|e300|ems100|me701|me702m-three|sd588|" ], [ 1443, "s800|8325rc|ac831|mw200|brew |d88|htc\\/|htc_touch|355x|m50|km100|" ], [ 1444, "s800|8325rc|ac831|mw200|brew |d88|htc\\/|htc_touch|355x|m50|km100|" ], [ 1517, "d736|p-9521|telco|sl74|ktouch|m4u\\/|me702|8325rc|kddi|phone|lg |" ], [ 1518, "d736|p-9521|telco|sl74|ktouch|m4u\\/|me702|8325rc|kddi|phone|lg |" ], [ 1590, "sonyericsson|samsung|240x|x320vx10|nokia|sony cmd|motorola|" ], [ 1591, "sonyericsson|samsung|240x|x320vx10|nokia|sony cmd|motorola|" ], [ 1658, "up.browser|up.link|mmp|symbian|smartphone|midp|wap|vodafone|o2|" ], [ 1659, "up.browser|up.link|mmp|symbian|smartphone|midp|wap|vodafone|o2|" ], [ 1730, "pocket|kindle|mobile|psp|treo|android|iphone|ipod|webos|wp7|wp8|" ], [ 1731, "pocket|kindle|mobile|psp|treo|android|iphone|ipod|webos|wp7|wp8|" ], [ 1803, "fennec|blackberry|htc_|opera m|windowsphone)/" ], [ 1804, "fennec|blackberry|htc_|opera m|windowsphone)/" ], [ 2070, "1207" ], [ 2071, "1207" ], [ 2078, "3gso" ], [ 2079, "3gso" ], [ 2086, "4thp" ], [ 2087, "4thp" ], [ 2094, "501i" ], [ 2095, "501i" ], [ 2102, "502i" ], [ 2103, "502i" ], [ 2110, "503i" ], [ 2111, "503i" ], [ 2118, "504i" ], [ 2119, "504i" ], [ 2126, "505i" ], [ 2127, "505i" ], [ 2134, "506i" ], [ 2135, "506i" ], [ 2153, "6310" ], [ 2154, "6310" ], [ 2161, "6590" ], [ 2162, "6590" ], [ 2169, "770s" ], [ 2170, "770s" ], [ 2177, "802s" ], [ 2178, "802s" ], [ 2185, "a wa" ], [ 2186, "a wa" ], [ 2193, "abac" ], [ 2194, "abac" ], [ 2201, "acer" ], [ 2202, "acer" ], [ 2209, "acoo" ], [ 2210, "acoo" ], [ 2217, "acs-" ], [ 2218, "acs-" ], [ 2236, "aiko" ], [ 2237, "aiko" ], [ 2244, "airn" ], [ 2245, "airn" ], [ 2252, "alav" ], [ 2253, "alav" ], [ 2260, "alca" ], [ 2261, "alca" ], [ 2268, "alco" ], [ 2269, "alco" ], [ 2276, "amoi" ], [ 2277, "amoi" ], [ 2284, "anex" ], [ 2285, "anex" ], [ 2292, "anny" ], [ 2293, "anny" ], [ 2300, "anyw" ], [ 2301, "anyw" ], [ 2319, "aptu" ], [ 2320, "aptu" ], [ 2327, "arch" ], [ 2328, "arch" ], [ 2335, "argo" ], [ 2336, "argo" ], [ 2343, "aste" ], [ 2344, "aste" ], [ 2351, "asus" ], [ 2352, "asus" ], [ 2359, "attw" ], [ 2360, "attw" ], [ 2367, "au-m" ], [ 2368, "au-m" ], [ 2375, "audi" ], [ 2376, "audi" ], [ 2383, "aur " ], [ 2384, "aur " ], [ 2402, "aus " ], [ 2403, "aus " ], [ 2410, "avan" ], [ 2411, "avan" ], [ 2418, "beck" ], [ 2419, "beck" ], [ 2426, "bell" ], [ 2427, "bell" ], [ 2434, "benq" ], [ 2435, "benq" ], [ 2442, "bilb" ], [ 2443, "bilb" ], [ 2450, "bird" ], [ 2451, "bird" ], [ 2458, "blac" ], [ 2459, "blac" ], [ 2466, "blaz" ], [ 2467, "blaz" ], [ 2485, "brew" ], [ 2486, "brew" ], [ 2493, "brvw" ], [ 2494, "brvw" ], [ 2501, "bumb" ], [ 2502, "bumb" ], [ 2509, "bw-n" ], [ 2510, "bw-n" ], [ 2517, "bw-u" ], [ 2518, "bw-u" ], [ 2525, "c55/" ], [ 2526, "c55/" ], [ 2533, "capi" ], [ 2534, "capi" ], [ 2541, "ccwa" ], [ 2542, "ccwa" ], [ 2549, "cdm-" ], [ 2550, "cdm-" ], [ 2568, "cell" ], [ 2569, "cell" ], [ 2576, "chtm" ], [ 2577, "chtm" ], [ 2584, "cldc" ], [ 2585, "cldc" ], [ 2592, "cmd-" ], [ 2593, "cmd-" ], [ 2600, "cond" ], [ 2601, "cond" ], [ 2608, "craw" ], [ 2609, "craw" ], [ 2616, "dait" ], [ 2617, "dait" ], [ 2624, "dall" ], [ 2625, "dall" ], [ 2632, "dang" ], [ 2633, "dang" ], [ 2651, "dbte" ], [ 2652, "dbte" ], [ 2659, "dc-s" ], [ 2660, "dc-s" ], [ 2667, "devi" ], [ 2668, "devi" ], [ 2675, "dica" ], [ 2676, "dica" ], [ 2683, "dmob" ], [ 2684, "dmob" ], [ 2691, "doco" ], [ 2692, "doco" ], [ 2699, "dopo" ], [ 2700, "dopo" ], [ 2707, "ds-d" ], [ 2708, "ds-d" ], [ 2715, "ds12" ], [ 2716, "ds12" ], [ 2734, "el49" ], [ 2735, "el49" ], [ 2742, "elai" ], [ 2743, "elai" ], [ 2750, "eml2" ], [ 2751, "eml2" ], [ 2758, "emul" ], [ 2759, "emul" ], [ 2766, "eric" ], [ 2767, "eric" ], [ 2774, "erk0" ], [ 2775, "erk0" ], [ 2782, "esl8" ], [ 2783, "esl8" ], [ 2790, "ez40" ], [ 2791, "ez40" ], [ 2798, "ez60" ], [ 2799, "ez60" ], [ 2817, "ez70" ], [ 2818, "ez70" ], [ 2825, "ezos" ], [ 2826, "ezos" ], [ 2833, "ezwa" ], [ 2834, "ezwa" ], [ 2841, "ezze" ], [ 2842, "ezze" ], [ 2849, "fake" ], [ 2850, "fake" ], [ 2857, "fetc" ], [ 2858, "fetc" ], [ 2865, "fly-" ], [ 2866, "fly-" ], [ 2873, "fly_" ], [ 2874, "fly_" ], [ 2881, "g-mo" ], [ 2882, "g-mo" ], [ 2900, "g1 u" ], [ 2901, "g1 u" ], [ 2908, "g560" ], [ 2909, "g560" ], [ 2916, "gene" ], [ 2917, "gene" ], [ 2924, "gf-5" ], [ 2925, "gf-5" ], [ 2932, "go.w" ], [ 2933, "go.w" ], [ 2940, "good" ], [ 2941, "good" ], [ 2948, "grad" ], [ 2949, "grad" ], [ 2956, "grun" ], [ 2957, "grun" ], [ 2964, "haie" ], [ 2965, "haie" ], [ 2983, "hcit" ], [ 2984, "hcit" ], [ 2991, "hd-m" ], [ 2992, "hd-m" ], [ 2999, "hd-p" ], [ 3000, "hd-p" ], [ 3007, "hd-t" ], [ 3008, "hd-t" ], [ 3015, "hei-" ], [ 3016, "hei-" ], [ 3023, "hiba" ], [ 3024, "hiba" ] ], "sz": 6013, "ts": [ { "c": 0.75, "d": "Generic $_SERVER superglobal access", "e": [ "$_SERVER" ], "i": "micro-behaviors/communications/http/request/params::server-dup", "l": 3 }, { "c": 0.8999999761581421, "d": "File has 30 or more lines", "e": [ "text.total_lines = 94.00" ], "i": "metadata/file/text/metrics::file-has-30-plus-lines", "l": 1 }, { "c": 0.8600000143051147, "d": "Regex component marker", "e": [ "$_SERVER[" ], "i": "objectives/command-and-control/backdoor/webshell/ui::self-named-get-form--rx-4", "l": 1, "m": "B0030" }, { "a": "T1027", "c": 0.9399999976158142, "d": "Regex component marker", "e": [ "android" ], "i": "objectives/anti-static/obfuscation/payload/config::arch-keyed-hex-blob-dict--rx-15", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "Custom HTTP header input access (HTTP_X_*)", "e": [ "$_SERVER['HTTP_X_WAP_PROFILE']" ], "i": "objectives/command-and-control/backdoor/webshell/exec::custom-header-input", "l": 4, "m": "B0030" }, { "a": "T1505.003", "d": "PHP open tag", "e": [ "\u003c?php" ], "i": "objectives/command-and-control/backdoor/webshell/request::php-tag", "l": 1, "m": "B0030" }, { "a": "T1505.003", "c": 1.0, "d": "Inequality check in WordPress user list", "e": [ "!=" ], "i": "objectives/command-and-control/backdoor/webshell/hide::wp-user-hiding-not-trait", "l": 1, "m": "B0030" } ], "sha": "e1e46ad55cb5f57f33c34063ccaed8b11ccef56631b55c4e62ca3257fe57099d", "path": "/data/samples/bad/datasets/awesome-malware/PHP/checkmob.php", "type": "php" } ], "tv": "a9555" } }