{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.971041738986969, "class": 2 } ], "prob": 0.97104174, "class": 2, "models": [ { "m": "az", "prob": 0.3622564, "class": 0 }, { "m": "az/scripts", "prob": 0.38439044, "class": 0 }, { "m": "az/php", "prob": 0.97104174, "class": 2 } ], "version": "v16.16", "thresholds": [ 0.9961138, 0.99909174 ], "analyzed_at": "2026-05-08T21:13:38Z" }, "path": "identity.php", "raw": { "v": "4", "fs": [ { "f": "KO₃(C₅CaCo)H₂(Cm₂Db₃)Md", "k": { "source.imports[0]": "header", "source.imports[1]": "isset", "source.imports[2]": "ob_start", "source.imports[3]": "rand", "source.imports[4]": "session_start", "source.strings[0]": "*)f~f6su~y62zqIfdyuseeM1zyqycb1K)(*9w(*)f~f6su~y64*7;;48dwxr\u003e\u0026:////////?84;;(4)(", "source.strings[1]": "*cz6uzwee+4esuyxrCz4(", "source.strings[2]": "*cz6uzwee+4p", "source.strings[3]": "*efwx(*9efwx(", "source.strings[4]": "*efwx6ebozs+4uyzyd,5\"'wr\"/-pyxb;as", "source.strings[5]": "*f6uzwee+4r", "source.strings[6]": "*tyro(6666*r", "source.strings[7]": "*w6ebozs+4pyxb;as", "source.strings[8]": "*yz6uzwee+4fdyyp4(", "source.strings[9]": "*zwtsz6uzwee+4uyxb4(", "source.has_imports": true, "source.strings[10]": "../extra/languages/", "source.strings[11]": "../extra/languages/{$_SESSION['language']}.php", "source.strings[12]": "../news/news-", "source.strings[13]": "../prevents/anti1.php", "source.strings[14]": "../prevents/anti2.php", "source.strings[15]": "../prevents/anti3.php", "source.strings[16]": "../prevents/anti4.php", "source.strings[17]": "../prevents/anti5.php", "source.strings[18]": "../prevents/anti6.php", "source.strings[19]": "../prevents/anti7.php", "source.strings[20]": "../prevents/anti8.php", "source.strings[21]": "6uzwee+44(", "source.strings[22]": "6uzwee+4wub", "source.strings[23]": "6uzwee+4xyb", "source.strings[24]": "6uzwee+4zyqycbZ", "source.strings[25]": "Location: index", "source.strings[26]": "Location: signin", "source.strings[27]": "`6uzwee+4dya6dczse6bsnb;usxbsd4(*)f~f6su~y64*7;;48dwxr\u003e\u0026:////////?84;;(4)(", "source.strings[28]": "activity", "source.strings[29]": "b8ry9astwuuycxb4(", "source.strings[30]": "b8ry9astwuuycxb4-k?-pcxub", "source.strings[31]": "bo1K)(*9w(", "source.strings[32]": "bo1K)(*9w(*9z", "source.strings[33]": "bt_back", "source.strings[34]": "bt_proceed", "source.strings[35]": "choose", "source.strings[36]": "contact", "source.strings[37]": "drop_zone", "source.strings[38]": "dsbcdx6u-k", "source.strings[39]": "efzwo,xyxs4(", "source.strings[40]": "efzwo,xyxs46bofs+4p", "source.strings[41]": "fb,46uzwee+4z", "source.strings[42]": "fb46edu+4z", "source.strings[43]": "footer", "source.strings[44]": "head_slf", "source.strings[45]": "head_up", "source.strings[46]": "language", "source.strings[47]": "logout", "source.strings[48]": "privacy", "source.strings[49]": "qxM1pyybsd1KM1fd", "source.strings[50]": "r+4eszsubIyxs4(", "source.strings[51]": "r+4fdyusee4(", "source.strings[52]": "r+4wdswIcfI", "source.strings[53]": "r+4wdswIcfIeszp", "source.strings[54]": "r1?++1ueu1?m", "source.strings[55]": "r1?++1usn1?m", "source.strings[56]": "r46ebozs+4r", "source.strings[57]": "rIlyxs4(*r", "source.strings[58]": "rM1bofs1KM1bay1K)(*9efwx(", "source.strings[59]": "rM1tbIfdyussr1K)(4(", "source.strings[60]": "rM1tbIfdyussr1K)(4(*r", "source.strings[61]": "rights", "source.strings[62]": "rotate", "source.strings[63]": "rrsx-tyn;e", "source.strings[64]": "safydb46uyxbsxb+4a", "source.strings[65]": "security", "source.strings[66]": "send_receive", "source.strings[67]": "szre6uzswdp", "source.strings[68]": "t9ebozse9fdyusee8uee4(", "source.strings[69]": "usIadwffsd4(", "source.strings[70]": "usIadwffsd4(*r", "source.strings[71]": "wallet", "source.strings[72]": "x46ebozs+4r", "source.strings[73]": "xUyxbsxbe46", "source.strings[74]": "xfcb6ebozs+4r", "source.strings[75]": "xrya8zyuwb", "source.strings[76]": "zsK1:pcxub", "source.strings[77]": "zsMK46wuusfb+4" }, "x": 3, "id": 0, "is": [ "ob_start", "session_start", "isset", "header", "isset", "header", "rand", "rand", "rand", "rand", "rand", "rand", "rand", "rand", "rand", "rand", "rand", "rand", "rand", "rand", "rand", "rand", "rand", "rand", "rand", "rand", "rand", "rand", "rand", "rand", "rand", "rand", "rand", "rand", "rand", "rand", "rand", "rand" ], "ms": { "file": { "size": 21271.0 }, "text": { "tab_count": 669.0, "digit_ratio": 0.08, "space_count": 714.0, "total_lines": 254.0, "char_entropy": 5.53, "mixed_indent": true, "unique_chars": 100.0, "import_density": 14.96, "lines_over_200": 9.0, "lines_over_500": 7.0, "string_density": 1.94, "avg_line_length": 82.75, "high_byte_ratio": 0.02, "lines_over_1000": 3.0, "max_line_length": 1889.0, "non_ascii_ratio": 0.02, "empty_line_ratio": 0.0, "last_line_length": 7.0, "long_token_count": 28.0, "most_common_char": "e", "whitespace_ratio": 0.08, "most_common_ratio": 0.05, "identifier_density": 0.54, "line_length_stddev": 186.54, "normalized_import_count": 2.38, "normalized_string_count": 30.93, "repeated_char_sequences": 1.0, "suspicious_comment_ratio": 1.0, "max_inline_whitespace_run": 7.0, "trailing_whitespace_lines": 4.0, "normalized_unique_identifiers": 1.25 }, "imports": { "total": 38.0, "unique_modules": 5.0, "third_party_count": 38.0, "third_party_ratio": 1.0 }, "strings": { "total": 493.0, "avg_length": 4.85, "max_length": 46.0, "path_count": 20.0, "avg_entropy": 1.59, "total_bytes": 2389.0, "entropy_stddev": 0.7 }, "comments": { "chars": 600.0, "lines": 8.0, "total": 1.0, "to_code_ratio": 0.03, "url_in_comments": 1.0, "base64_in_comments": 1.0 }, "functions": {}, "identifiers": { "total": 136.0, "avg_length": 7.5, "max_length": 13.0, "min_length": 4.0, "avg_entropy": 2.52, "reuse_ratio": 0.07, "unique_count": 10.0, "length_stddev": 2.58, "all_lowercase_ratio": 0.9, "all_uppercase_ratio": 0.1, "underscore_prefix_count": 1.0 } }, "ss": [ [ 620, "../prevents/anti1.php" ], [ 621, "../prevents/anti1.php" ], [ 653, "../prevents/anti2.php" ], [ 654, "../prevents/anti2.php" ], [ 686, "../prevents/anti3.php" ], [ 687, "../prevents/anti3.php" ], [ 719, "../prevents/anti4.php" ], [ 720, "../prevents/anti4.php" ], [ 752, "../prevents/anti5.php" ], [ 753, "../prevents/anti5.php" ], [ 785, "../prevents/anti6.php" ], [ 786, "../prevents/anti6.php" ], [ 818, "../prevents/anti7.php" ], [ 819, "../prevents/anti7.php" ], [ 851, "../prevents/anti8.php" ], [ 852, "../prevents/anti8.php" ], [ 925, "language" ], [ 926, "language" ], [ 951, "Location: index" ], [ 952, "Location: index" ], [ 988, "../extra/languages/{$_SESSION['language']}.php" ], [ 989, "../extra/languages/" ], [ 1019, "language" ], [ 1020, "language" ], [ 1031, ".php" ], [ 1059, "EML" ], [ 1060, "EML" ], [ 1080, "Location: signin" ], [ 1081, "Location: signin" ], [ 1528, "title" ], [ 1529, "title" ], [ 2128, "../news/news-" ], [ 2129, "../news/news-" ], [ 2154, ".txt" ], [ 2155, ".txt" ], [ 2350, "\u003c!--" ], [ 2351, "\u003c!--" ], [ 2374, "--\u003e" ], [ 2375, "--\u003e" ], [ 2419, "\u003c!--" ], [ 2420, "\u003c!--" ], [ 2443, "--\u003e" ], [ 2444, "--\u003e" ], [ 2463, "\u003c!--" ], [ 2464, "\u003c!--" ], [ 2487, "--\u003e" ], [ 2488, "--\u003e" ], [ 2602, "logout" ], [ 2603, "logout" ], [ 2628, "\u003c!--" ], [ 2629, "\u003c!--" ], [ 2652, "--\u003e" ], [ 2653, "--\u003e" ], [ 2685, "\u003c!--" ], [ 2686, "\u003c!--" ], [ 2709, "--\u003e" ], [ 2710, "--\u003e" ], [ 2758, "\u003c!--" ], [ 2759, "\u003c!--" ], [ 2782, "--\u003e" ], [ 2783, "--\u003e" ], [ 2857, "\u003c!--" ], [ 2858, "\u003c!--" ], [ 2881, "--\u003e" ], [ 2882, "--\u003e" ], [ 2899, "\u003c!--" ], [ 2900, "\u003c!--" ], [ 2923, "--\u003e" ], [ 2924, "--\u003e" ], [ 3001, "\u003c!--" ], [ 3002, "\u003c!--" ], [ 3025, "--\u003e" ], [ 3026, "--\u003e" ], [ 3056, "\u003c!--" ], [ 3057, "\u003c!--" ], [ 3080, "--\u003e" ], [ 3081, "--\u003e" ], [ 3128, "\u003c!--" ], [ 3129, "\u003c!--" ], [ 3152, "--\u003e" ], [ 3153, "--\u003e" ], [ 3186, "EML" ], [ 3187, "EML" ], [ 3261, "\u003c!--" ], [ 3262, "\u003c!--" ], [ 3285, "--\u003e" ], [ 3286, "--\u003e" ], [ 3330, "\u003c!--" ], [ 3331, "\u003c!--" ], [ 3354, "--\u003e" ], [ 3355, "--\u003e" ], [ 3372, "\u003c!--" ], [ 3373, "\u003c!--" ], [ 3396, "--\u003e" ], [ 3397, "--\u003e" ], [ 3414, "\u003c!--" ], [ 3415, "\u003c!--" ], [ 3438, "--\u003e" ], [ 3439, "--\u003e" ], [ 3479, "\u003c!--" ], [ 3480, "\u003c!--" ], [ 3503, "--\u003e" ], [ 3504, "--\u003e" ], [ 3522, "\u003c!--" ], [ 3523, "\u003c!--" ], [ 3546, "--\u003e" ], [ 3547, "--\u003e" ], [ 3579, "\u003c!--" ], [ 3580, "\u003c!--" ], [ 3603, "--\u003e" ], [ 3604, "--\u003e" ], [ 3681, "menu" ], [ 3682, "menu" ], [ 3689, "home" ], [ 3690, "home" ], [ 3719, "\u003c!--" ], [ 3720, "\u003c!--" ], [ 3743, "--\u003e" ], [ 3744, "--\u003e" ], [ 3843, "menu" ], [ 3844, "menu" ], [ 3851, "activity" ], [ 3852, "activity" ], [ 3905, "\u003c!--" ], [ 3906, "\u003c!--" ], [ 3929, "--\u003e" ], [ 3930, "--\u003e" ], [ 4009, "menu" ], [ 4010, "menu" ], [ 4017, "send_receive" ], [ 4018, "send_receive" ], [ 4069, "\u003c!--" ], [ 4070, "\u003c!--" ], [ 4093, "--\u003e" ], [ 4094, "--\u003e" ], [ 4167, "menu" ], [ 4168, "menu" ], [ 4175, "wallet" ], [ 4176, "wallet" ], [ 4239, "\u003c!--" ], [ 4240, "\u003c!--" ], [ 4263, "--\u003e" ], [ 4264, "--\u003e" ], [ 4286, "\u003c!--" ], [ 4287, "\u003c!--" ], [ 4310, "--\u003e" ], [ 4311, "--\u003e" ], [ 4381, "menu" ], [ 4382, "menu" ], [ 4389, "help" ], [ 4390, "help" ], [ 4434, "\u003c!--" ], [ 4435, "\u003c!--" ], [ 4458, "--\u003e" ], [ 4459, "--\u003e" ], [ 4479, "\u003c!--" ], [ 4480, "\u003c!--" ], [ 4503, "--\u003e" ], [ 4504, "--\u003e" ], [ 4675, "\u003c!--" ], [ 4676, "\u003c!--" ], [ 4699, "--\u003e" ], [ 4700, "--\u003e" ], [ 4726, "\u003c!--" ], [ 4727, "\u003c!--" ], [ 4750, "--\u003e" ], [ 4751, "--\u003e" ], [ 4886, "\u003c!--" ], [ 4887, "\u003c!--" ], [ 4910, "--\u003e" ], [ 4911, "--\u003e" ], [ 4966, "\u003c!--" ], [ 4967, "\u003c!--" ], [ 4990, "--\u003e" ], [ 4991, "--\u003e" ], [ 5072, "logout" ], [ 5073, "logout" ], [ 5113, "\u003c!--" ], [ 5114, "\u003c!--" ], [ 5137, "--\u003e" ], [ 5138, "--\u003e" ], [ 5197, "\u003c!--" ], [ 5198, "\u003c!--" ], [ 5221, "--\u003e" ], [ 5222, "--\u003e" ], [ 5276, "\u003c!--" ], [ 5277, "\u003c!--" ], [ 5300, "--\u003e" ], [ 5301, "--\u003e" ], [ 5374, "\u003c!--" ], [ 5375, "\u003c!--" ], [ 5398, "--\u003e" ], [ 5399, "--\u003e" ], [ 5446, "\u003c!--" ], [ 5447, "\u003c!--" ], [ 5470, "--\u003e" ], [ 5471, "--\u003e" ], [ 5525, "rotate" ], [ 5526, "rotate" ], [ 5586, "\u003c!--" ], [ 5587, "\u003c!--" ], [ 5610, "--\u003e" ], [ 5611, "--\u003e" ], [ 5670, "\u003c!--" ], [ 5671, "\u003c!--" ], [ 5694, "--\u003e" ], [ 5695, "--\u003e" ], [ 5768, "\u003c!--" ], [ 5769, "\u003c!--" ], [ 5792, "--\u003e" ], [ 5793, "--\u003e" ], [ 5813, "\u003c!--" ], [ 5814, "\u003c!--" ], [ 5837, "--\u003e" ], [ 5838, "--\u003e" ], [ 5916, "\u003c!--" ], [ 5917, "\u003c!--" ], [ 5940, "--\u003e" ], [ 5941, "--\u003e" ], [ 5994, "menu" ], [ 5995, "menu" ], [ 6002, "open" ], [ 6003, "open" ], [ 6057, "\u003c!--" ], [ 6058, "\u003c!--" ], [ 6081, "--\u003e" ], [ 6082, "--\u003e" ], [ 6099, "\u003c!--" ], [ 6100, "\u003c!--" ], [ 6123, "--\u003e" ], [ 6124, "--\u003e" ], [ 6160, "menu" ], [ 6161, "menu" ], [ 6168, "close" ], [ 6169, "close" ], [ 6198, "\u003c!--" ], [ 6199, "\u003c!--" ], [ 6222, "--\u003e" ], [ 6223, "--\u003e" ], [ 6253, "\u003c!--" ], [ 6254, "\u003c!--" ], [ 6277, "--\u003e" ], [ 6278, "--\u003e" ], [ 6314, "\u003c!--" ], [ 6315, "\u003c!--" ], [ 6338, "--\u003e" ], [ 6339, "--\u003e" ], [ 6358, "\u003c!--" ], [ 6359, "\u003c!--" ], [ 6382, "--\u003e" ], [ 6383, "--\u003e" ], [ 6531, "\u003c!--" ], [ 6532, "\u003c!--" ], [ 6555, "--\u003e" ], [ 6556, "--\u003e" ], [ 6614, "\u003c!--" ] ], "sz": 21271, "ts": [ { "a": "T1505.003", "c": 0.8999999761581421, "d": "Single-file admin shell metrics", "e": [ "identity.php" ], "i": "well-known/malware/webshell/zaco::single-file-webshell-metrics", "l": 3, "m": "B0030" }, { "c": 0.75, "d": "Session variable access ($_SESSION)", "e": [ "$_SESSION" ], "i": "micro-behaviors/communications/http/request/params::session", "l": 3 }, { "c": 1.0, "d": ".js extension", "e": [ "\"lib/js/jquery-3.3.1.min.js\"" ], "i": "objectives/command-and-control/dropper/builder::js-ext", "l": 1 }, { "c": 0.8600000143051147, "d": "Regex component marker", "e": [ "method=" ], "i": "objectives/command-and-control/backdoor/webshell/ui::self-named-get-form--rx-3", "l": 1, "m": "B0030" }, { "a": "T1071.001", "c": 0.699999988079071, "d": "HTTP POST method", "e": [ "\"POST\"" ], "i": "micro-behaviors/communications/http/post::post", "l": 1, "m": "C0002" }, { "c": 0.8999999761581421, "d": "File has 30 or more lines", "e": [ "text.total_lines = 254.00" ], "i": "metadata/file/text/metrics::file-has-30-plus-lines", "l": 1 }, { "a": "T1005", "c": 0.75, "d": "Regex component marker", "e": [ "credit" ], "i": "objectives/credential-access/financial/credit-card::mastercard-bin--rx-1", "l": 1, "m": "B0030" }, { "c": 0.8999999761581421, "d": "Very long line", "e": [ "text.max_line_length = 1889.00" ], "i": "metadata/file/text/metrics::single-long-line", "l": 1 }, { "c": 0.4000000059604645, "d": "Wallet keyword", "e": [ "wallet" ], "i": "micro-behaviors/data/text/crypto::wallet-token", "l": 1 }, { "c": 0.800000011920929, "d": "Generates HTML content (DOCTYPE)", "e": [ "\u003c!DOCTYPE html\u003e" ], "i": "micro-behaviors/data/format/html::html-generator-doctype", "l": 2 }, { "a": "T1505.003", "d": "PHP open tag", "e": [ "\u003c?php" ], "i": "objectives/command-and-control/backdoor/webshell/request::php-tag", "l": 1, "m": "B0030" }, { "a": "T1027", "c": 0.6499999761581421, "d": "serialize/unserialize for object serialization", "e": [ "serialize(" ], "i": "objectives/anti-static/obfuscation/encoding/xor::serialize-call", "l": 2, "m": "B0032" }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2 }, { "d": "overflow keyword", "e": [ "overflow" ], "i": "micro-behaviors/data/text/keywords/lexicon::overflow", "l": 1 }, { "c": 0.6000000238418579, "d": "Generates HTML tags", "e": [ "\u003chtml" ], "i": "micro-behaviors/data/format/html::html-generator-tags", "l": 3 }, { "c": 0.8399999737739563, "d": "Regex component marker", "e": [ "../extra/languages/{$_SESSION['language']}.php" ], "i": "micro-behaviors/data/text/llm/action::llm-send-action--rx-8", "l": 1 }, { "a": "T1505.003", "c": 0.9200000166893005, "d": "HTML tag in script body", "e": [ "\u003chtml\u003e" ], "i": "objectives/command-and-control/remote-command/shell::html-tag-present", "l": 1, "m": "B0030" }, { "d": "hide keyword", "e": [ "hide" ], "i": "micro-behaviors/data/text/keywords/lexicon::hide", "l": 1 }, { "a": "T1505.003", "c": 1.0, "d": "Inequality check in WordPress user list", "e": [ "!=" ], "i": "objectives/command-and-control/backdoor/webshell/hide::wp-user-hiding-not-trait", "l": 1, "m": "B0030" }, { "a": "T1027", "c": 0.699999988079071, "d": "Very low whitespace ratio (minified/compressed)", "e": [ "text.whitespace_ratio = 0.08" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::low-whitespace", "l": 2, "m": "B0032" }, { "a": "T1005", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "wallet" ], "i": "objectives/collection/stealer/tactics::office-secret-extension-list--rx-2", "l": 1, "m": "B0028" }, { "a": "T1027", "c": 0.699999988079071, "d": "Low identifier reuse ratio", "e": [ "identifiers.reuse_ratio = 0.07" ], "i": "objectives/anti-static/obfuscation/code-metrics/identifiers::low-identifier-reuse", "l": 2, "m": "B0032" }, { "a": "T1027", "c": 0.8500000238418579, "d": "Multiple long lines (\u003e1000 chars)", "e": [ "text.lines_over_1000 = 3.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::very-long-lines", "l": 2, "m": "B0032" } ], "sha": "e46bfaad8dbcbeb5d345de34eae11bfd186b969a868abb199d35c955a51afebc", "path": "identity.php", "type": "php" } ], "tv": "bef72" } }