{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9999734163284302, "class": 2 } ], "prob": 0.9999734, "class": 2, "models": [ { "m": "az", "prob": 0.99735934, "class": 1 }, { "m": "az/scripts", "prob": 0.9996481, "class": 2 }, { "m": "az/php", "prob": 0.9999734, "class": 2 } ], "version": "v16.16", "thresholds": [ 0.9961138, 0.99909174 ], "analyzed_at": "2026-05-09T03:15:21Z" }, "path": "wskefaed.php", "raw": { "v": "4", "fs": [ { "f": "O₂(As₂C₃)H₃(PoCmOs)MdTh", "k": { "source.imports[0]": "eval", "source.imports[1]": "lmryvs", "source.imports[2]": "niclkhr", "source.imports[3]": "xvwxc", "source.strings[0]": "2n7e*_ax#09y5tkmirs1ulbov6", "source.strings[1]": "c34fpdHg8-", "source.strings[2]": "c34fpdHg8-\\'2n7e*_ax#09y5tkmirs1ulbov6", "source.has_imports": true, "source.functions[0]": "lmryvs", "source.functions[1]": "niclkhr", "source.functions[2]": "xvwxc" }, "x": 211, "id": 0, "is": [ "eval", "xvwxc", "lmryvs", "niclkhr" ], "ms": { "file": { "size": 1727.0 }, "text": { "digit_ratio": 0.16, "space_count": 64.0, "total_lines": 2.0, "char_entropy": 4.76, "unique_chars": 73.0, "import_density": 200.0, "lines_over_200": 1.0, "lines_over_500": 1.0, "string_density": 1.5, "avg_line_length": 863.0, "lines_over_1000": 1.0, "max_line_length": 1721.0, "last_line_length": 1721.0, "long_token_count": 3.0, "most_common_char": "r", "whitespace_ratio": 0.04, "most_common_ratio": 0.12, "identifier_density": 73.5, "line_length_stddev": 858.0, "normalized_import_count": 2.83, "normalized_string_count": 2.12, "max_inline_whitespace_run": 1.0, "normalized_function_count": 2.12, "imports_to_functions_ratio": 1.33, "strings_to_functions_ratio": 1.0, "normalized_unique_identifiers": 13.0, "identifiers_to_functions_ratio": 4.33 }, "imports": { "total": 4.0, "unique_modules": 4.0, "third_party_count": 4.0, "third_party_ratio": 1.0 }, "strings": { "total": 3.0, "avg_length": 24.67, "max_length": 38.0, "avg_entropy": 4.42, "total_bytes": 74.0, "entropy_stddev": 0.81, "high_entropy_count": 1.0 }, "comments": {}, "functions": { "total": 3.0, "one_liners": 3.0, "avg_name_length": 6.0, "no_params_count": 3.0, "avg_length_lines": 1.0, "max_length_lines": 1.0, "min_length_lines": 1.0, "density_per_100_lines": 150.0, "code_in_functions_ratio": 1.5 }, "identifiers": { "total": 147.0, "avg_length": 5.69, "max_length": 7.0, "min_length": 4.0, "avg_entropy": 2.36, "reuse_ratio": 0.09, "unique_count": 13.0, "length_stddev": 0.82, "all_lowercase_ratio": 0.85, "all_uppercase_ratio": 0.15, "underscore_prefix_count": 2.0 } }, "ss": [ [ 16, "c34fpdHg8-\\'2n7e*_ax#09y5tkmirs1ulbov6" ], [ 17, "c34fpdHg8-" ], [ 29, "2n7e*_ax#09y5tkmirs1ulbov6" ] ], "sz": 1727, "ts": [ { "c": 0.800000011920929, "d": "HTTP Cookie access ($_COOKIE)", "e": [ "$_COOKIE" ], "i": "micro-behaviors/communications/http/request/params::cookie", "l": 3 }, { "c": 0.800000011920929, "d": "Very short file (under 12 lines)", "e": [ "text.total_lines = 2.00" ], "i": "metadata/file/text/metrics::file-under-12-lines", "l": 1 }, { "a": "T1059.006", "c": 0.75, "d": "PHP eval() token present", "e": [ "eval" ], "i": "micro-behaviors/process/interpreter/eval::eval-symbol", "l": 4, "m": "E1059" }, { "a": "T1027.010", "c": 0.8700000047683716, "d": "Function dispatch via integer-indexed variable array", "e": [ "$mncpp[7](" ], "i": "objectives/anti-static/obfuscation/encoding/hex::integer-indexed-func-dispatch", "l": 4, "m": "B0032" }, { "a": "T1505.003", "d": "PHP open tag", "e": [ "\u003c?php" ], "i": "objectives/command-and-control/backdoor/webshell/request::php-tag", "l": 1, "m": "B0030" }, { "c": 0.8999999761581421, "d": "Very long line", "e": [ "text.max_line_length = 1721.00" ], "i": "metadata/file/text/metrics::single-long-line", "l": 1 }, { "c": 0.699999988079071, "d": "PHP error suppression operator usage", "e": [ "@$mncpp[9]($mncpp[1], $jmgrvy)" ], "i": "micro-behaviors/os/stdio::error-suppress-prefix", "l": 3 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Last line is over 1000 chars", "e": [ "text.last_line_length = 1721.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::last-line-over-1000", "l": 1, "m": "B0032" }, { "a": "T1505.003", "c": 0.8500000238418579, "d": "PHP request superglobal access", "e": [ "$_POST" ], "i": "objectives/command-and-control/backdoor/webshell/upload::php-request-variadic-function-call", "l": 3, "m": "B0030" }, { "a": "T1505.003", "c": 0.8999999761581421, "d": "Merged COOKIE and POST inputs", "e": [ "$_COOKIE, $_POST" ], "i": "objectives/command-and-control/backdoor/webshell/archive::cookie-post-merge", "l": 4, "m": "B0030" }, { "a": "T1059", "c": 0.8500000238418579, "d": "HTTP POST parameter access ($_POST)", "e": [ "$_POST" ], "i": "micro-behaviors/communications/http/request/params::post-dup", "l": 3 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Exactly one line exceeds 1000 chars", "e": [ "text.lines_over_1000 = 1.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::single-long-line-outlier", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8500000238418579, "d": "High function density", "e": [ "functions.density_per_100_lines = 150.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/functions::high-function-density", "l": 2, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Detects webshell using cookie POST", "e": [ "Array", "]($_COOKIE, $_POST) as $", "function" ], "i": "third_party/SigBase/WEBSHELL/Cookie/Post/Obfuscation", "l": 5 } ], "sha": "eb33165671ea92be4cd4d79cf148eb9a7cf080a99beca6862201e3f9bccfb9bd", "path": "wskefaed.php", "type": "php" } ], "tv": "a9555" } }