{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 0.99994957447052,
        "class": 2
      }
    ],
    "prob": 0.9999496,
    "class": 2,
    "models": [
      {
        "m": "az",
        "prob": 0.99728656,
        "class": 1
      },
      {
        "m": "az/scripts",
        "prob": 0.99991155,
        "class": 2
      },
      {
        "m": "az/php",
        "prob": 0.9999496,
        "class": 2
      }
    ],
    "version": "v16.16",
    "thresholds": [
      0.9961138,
      0.99909174
    ],
    "analyzed_at": "2026-05-09T03:26:09Z"
  },
  "path": "b715246b9a776d94eff17cf854e93308",
  "raw": {
    "v": "4",
    "fs": [
      {
        "f": "KO₂(As₄C₂)H₂(OsDb₂)MdTh₂",
        "k": {
          "source.strings[0]": "(\"\\$s_pass=\\\"$y\\\";?\u003e\".gz",
          "source.strings[1]": "befebbbd41323dd1c01b926075850fad",
          "source.strings[2]": "de($x)));"
        },
        "x": 219,
        "id": 0,
        "ms": {
          "file": {
            "size": 57464.0
          },
          "text": {
            "digit_ratio": 0.17,
            "space_count": 12.0,
            "total_lines": 6.0,
            "char_entropy": 6.02,
            "unique_chars": 83.0,
            "lines_over_200": 1.0,
            "lines_over_500": 1.0,
            "string_density": 6.0,
            "avg_line_length": 9575.67,
            "lines_over_1000": 1.0,
            "max_line_length": 57312.0,
            "last_line_length": 57312.0,
            "long_token_count": 2.0,
            "most_common_char": "d",
            "whitespace_ratio": 0.0,
            "most_common_ratio": 0.02,
            "identifier_density": 1.0,
            "line_length_stddev": 21348.38,
            "encoded_string_ratio": 0.11,
            "normalized_string_count": 14.7,
            "suspicious_comment_ratio": 0.5,
            "max_inline_whitespace_run": 1.0,
            "normalized_unique_identifiers": 1.16
          },
          "strings": {
            "total": 36.0,
            "avg_length": 3180.5,
            "max_length": 57140.0,
            "avg_entropy": 2.09,
            "hex_strings": 2.0,
            "total_bytes": 114498.0,
            "entropy_stddev": 1.26,
            "base64_candidates": 2.0,
            "very_long_strings": 2.0,
            "high_entropy_count": 2.0
          },
          "comments": {
            "chars": 90.0,
            "lines": 3.0,
            "total": 2.0,
            "xxx_count": 1.0,
            "to_code_ratio": 1.0,
            "base64_in_comments": 1.0
          },
          "functions": {},
          "identifiers": {
            "total": 6.0,
            "avg_length": 5.67,
            "max_length": 6.0,
            "min_length": 5.0,
            "avg_entropy": 2.23,
            "reuse_ratio": 0.5,
            "unique_count": 3.0,
            "length_stddev": 0.47,
            "has_digit_ratio": 0.33,
            "all_lowercase_ratio": 0.67
          }
        },
        "ss": [
          [
            46,
            "befebbbd41323dd1c01b926075850fad"
          ],
          [
            47,
            "befebbbd41323dd1c01b926075850fad"
          ],
          [
            160,
            "cr"
          ],
          [
            161,
            "cr"
          ],
          [
            165,
            "eat"
          ],
          [
            166,
            "eat"
          ],
          [
            171,
            "e_fun"
          ],
          [
            172,
            "e_fun"
          ],
          [
            179,
            "cti"
          ],
          [
            180,
            "cti"
          ],
          [
            185,
            "on"
          ],
          [
            186,
            "on"
          ],
          [
            206,
            "$x,$y"
          ],
          [
            207,
            "$x,$y"
          ],
          [
            214,
            "ev"
          ],
          [
            215,
            "ev"
          ],
          [
            219,
            "al"
          ],
          [
            220,
            "al"
          ],
          [
            224,
            "(\"\\$s_pass=\\\"$y\\\";?\u003e\".gz"
          ],
          [
            225,
            "(\"\\$s_pass=\\\"$y\\\";?\u003e\".gz"
          ],
          [
            251,
            "inf"
          ],
          [
            252,
            "inf"
          ],
          [
            257,
            "late"
          ],
          [
            258,
            "late"
          ],
          [
            264,
            "( bas"
          ],
          [
            265,
            "( bas"
          ],
          [
            272,
            "e64"
          ],
          [
            273,
            "e64"
          ],
          [
            278,
            "_de"
          ],
          [
            279,
            "_de"
          ],
          [
            284,
            "co"
          ],
          [
            285,
            "co"
          ],
          [
            289,
            "de($x)));"
          ],
          [
            290,
            "de($x)));"
          ]
        ],
        "sz": 57464,
        "ts": [
          {
            "d": "password keyword",
            "e": [
              "password"
            ],
            "i": "micro-behaviors/data/text/keywords/lexicon::password",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.9399999976158142,
            "d": "Architecture keyed encoded blob value",
            "e": [
              "\"befebbbd41323dd1c01b926075850fad\""
            ],
            "i": "objectives/anti-static/obfuscation/payload/config::arch-keyed-hex-blob-dict--encoded-value",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "Exactly one line exceeds 1000 chars",
            "e": [
              "text.lines_over_1000 = 1.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::single-long-line-outlier",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.699999988079071,
            "d": "PHP error suppression operator usage",
            "e": [
              "@$b374k(\"7P1nm+M20igMf779K7RaH/f0qqdJUXnG3V4FKkukcrB9+mImxShGSbb/+wswiZTUPT1je8/e7/WMd2cohEKhUACqCkD...",
              "@$s_func('$x,$y','ev'.'al'.'(\"\\$s_pass=\\\"$y\\\";?\u003e\".gz'.'inf'.'late'.'( bas'.'e64'.'_de'.'co'.'de($x))..."
            ],
            "i": "micro-behaviors/os/stdio::error-suppress-prefix",
            "l": 3
          },
          {
            "a": "T1505.003",
            "c": 0.8600000143051147,
            "d": "Very long embedded string",
            "e": [
              "strings.max_length = 57140.00"
            ],
            "i": "objectives/command-and-control/backdoor/webshell/stager::very-long-string",
            "l": 1
          },
          {
            "a": "T1505.003",
            "d": "PHP open tag",
            "e": [
              "\u003c?php"
            ],
            "i": "objectives/command-and-control/backdoor/webshell/request::php-tag",
            "l": 1,
            "m": "B0030"
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "Last line is over 1000 chars",
            "e": [
              "text.last_line_length = 57312.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::last-line-over-1000",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.8399999737739563,
            "d": "password/token/api_key field keyword",
            "e": [
              "password"
            ],
            "i": "micro-behaviors/data/text/keywords/credential::credential-field",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 1.0,
            "d": "Comment-heavy source context",
            "e": [
              "comments.to_code_ratio = 1.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/strings::comment-heavy-source",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.8999999761581421,
            "d": "Very long line",
            "e": [
              "text.max_line_length = 57312.00"
            ],
            "i": "metadata/file/text/metrics::single-long-line",
            "l": 1
          },
          {
            "a": "T1505.003",
            "c": 0.949999988079071,
            "d": "b374k webshell family",
            "e": [
              "b374k"
            ],
            "i": "well-known/malware/webshell/family::b374k",
            "l": 4,
            "m": "B0030"
          },
          {
            "a": "T1505.003",
            "c": 0.8399999737739563,
            "d": "Near-zero whitespace script",
            "e": [
              "text.whitespace_ratio = 0.00"
            ],
            "i": "objectives/command-and-control/backdoor/webshell/stager::near-zero-whitespace",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "Very short file (under 12 lines)",
            "e": [
              "text.total_lines = 6.00"
            ],
            "i": "metadata/file/text/metrics::file-under-12-lines",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "PHP variable function invocation pattern",
            "e": [
              "s_func",
              "b374k"
            ],
            "i": "objectives/anti-static/obfuscation/imports::dynamic-function-execution",
            "l": 3
          },
          {
            "a": "T1027",
            "c": 0.699999988079071,
            "d": "Very low whitespace ratio (minified/compressed)",
            "e": [
              "text.whitespace_ratio = 0.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::low-whitespace",
            "l": 2,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.800000011920929,
            "d": "High overall text entropy (encoded",
            "e": [
              "text.char_entropy = 6.02"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::high-text-entropy",
            "l": 2,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "PHP source contains very long line",
            "e": [
              "text.max_line_length = 57312.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/identifiers::php-single-long-line",
            "l": 4,
            "m": "B0032"
          },
          {
            "c": 1.0,
            "d": "php code embedded in string",
            "e": [
              "Detected php at offset 0x0"
            ],
            "i": "metadata/lang/embedded::php",
            "l": 2
          },
          {
            "c": 0.8999999761581421,
            "d": "Webshell b374k",
            "e": [
              "func=\"cr\".\"eat\".\"e_fun\".\"cti\".\"on\";$b374k="
            ],
            "i": "third_party/JPCERT/b374k/webshell_b374k",
            "l": 4
          },
          {
            "c": 0.8999999761581421,
            "d": "PHP webshell using $a($code) for kind of eval with encoded blob to decode, e.g. b374k",
            "e": [
              "r\".\"e",
              "z'.'i",
              "e'.'c",
              "o'.'d",
              "v'.'a",
              "t\".\"e",
              "s'.'e",
              "\u003c?",
              "\u003c?php",
              "$s_func('",
              "n\".\"c",
              "$b374k(\"",
              "4'.'_",
              "f'.'l",
              "i\".\"o"
            ],
            "i": "third_party/SigBase/WEBSHELL/PHP/Dynamic/Big",
            "l": 5
          },
          {
            "c": 0.8999999761581421,
            "d": "Known PHP Webshells which contain unique strings, lousy rule for low hanging fruits. Most are catched by other rules in here but maybe these catch different versions.",
            "e": [
              "\u003c?",
              "\u003c?php",
              "$b374k(\""
            ],
            "i": "third_party/SigBase/WEBSHELL/PHP/By/String/Known/Webshell",
            "l": 5
          }
        ],
        "sha": "e5cd8d1e63d05d6e73e10a18f861afca1c9d5d97896f87c8aae1a3f7568fc593",
        "path": "/data/samples/bad/datasets/kaker-scripts/php/b715246b9a776d94eff17cf854e93308",
        "type": "php"
      }
    ],
    "tv": "a9555"
  }
}