{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 0.9999059438705444,
        "class": 2
      }
    ],
    "prob": 0.99990594,
    "class": 2,
    "models": [
      {
        "m": "az",
        "prob": 0.9861546,
        "class": 0
      },
      {
        "m": "az/scripts",
        "prob": 0.9997969,
        "class": 2
      },
      {
        "m": "az/php",
        "prob": 0.99990594,
        "class": 2
      }
    ],
    "version": "v16.16",
    "thresholds": [
      0.9961138,
      0.99909174
    ],
    "analyzed_at": "2026-05-09T18:52:54Z"
  },
  "path": "21b2c2f87ddeb34fac82612a5ebbd38b",
  "raw": {
    "v": "4",
    "fs": [
      {
        "f": "O₃(C₆AsLa)H₄(Po₂CmDb₄Os)MdTh",
        "k": {
          "source.imports[0]": "base64_decode",
          "source.imports[1]": "die",
          "source.imports[2]": "eval",
          "source.imports[3]": "gethostbyname",
          "source.imports[4]": "gzuncompress",
          "source.imports[5]": "isset",
          "source.imports[6]": "session_start",
          "source.imports[7]": "set_time_limit",
          "source.strings[0]": "\r\n\u003c/td\u003e\u003c/tr\u003e\u003c/table\u003e\r\n",
          "source.strings[1]": "\r\n\u003cnoembed\u003e\u003cxmp\u003e\u003cbody\u003e\u003c/xmp\u003e\u003c/noembed\u003e\u003cnoembed\u003e\u003cxmp\u003e\u003c/body\r\n\r\n\u003e\u003c/html\u003e\u003c/xmp\u003e\u003c/noembed\u003e\u003ctitle\u003e-farM-mOn3Y-\u003c/title\u003e\r\n\u003ccenter\u003e\r\n\u003ctable width=100 bgcolor=000000 border=6 \r\n\r\nbordercolor=999999\u003e\u003ctr\u003e\u003ctd\u003e\r\n\u003cfont size=1 face=verdana\u003e\u003ccenter\u003e\r\n\u003cb\u003e\u003c/font\u003e\u003c/a\u003e\u003cbr\u003e\u003c/b\u003e\r\n\u003c/center\u003e\r\n\u003cform method=post\u003e\r\n\u003cfont size=1 face=verdana \r\n\r\ncolor=99CCFF\u003e\u003cstrong\u003e\u003ccenter\u003e\u003cbr\u003ewelcome\u003c/center\u003e\u003c/stron\r\n\r\ng\u003e\u003cbr\u003e\r\n\u003cinput type=password name=pass size=30\u003e\r\n\u003c/form\u003e\r\n\u003cb\u003eHost:\u003c/b\u003e ",
          "source.strings[2]": "\u003cbr\u003e\r\n\u003cb\u003eIP:\u003c/b\u003e ",
          "source.strings[3]": "\u003cbr\u003e\r\n\u003cb\u003eYour ip:\u003c/b\u003e ",
          "source.strings[4]": "HTTP_HOST",
          "source.strings[5]": "REMOTE_ADDR",
          "source.strings[6]": "dot1992",
          "source.has_imports": true
        },
        "x": 176,
        "id": 0,
        "is": [
          "session_start",
          "set_time_limit",
          "isset",
          "die",
          "gethostbyname",
          "eval",
          "gzuncompress",
          "base64_decode"
        ],
        "ms": {
          "file": {
            "size": 132403.0
          },
          "text": {
            "digit_ratio": 0.18,
            "space_count": 32.0,
            "total_lines": 4428.0,
            "char_entropy": 6.03,
            "unique_chars": 88.0,
            "import_density": 0.18,
            "string_density": 0.01,
            "avg_line_length": 27.9,
            "max_line_length": 56.0,
            "empty_line_ratio": 0.5,
            "last_line_length": 14.0,
            "most_common_char": "/",
            "whitespace_ratio": 0.07,
            "most_common_ratio": 0.02,
            "identifier_density": 0.01,
            "line_length_stddev": 27.92,
            "normalized_import_count": 0.12,
            "normalized_string_count": 0.47,
            "repeated_char_sequences": 1.0,
            "max_inline_whitespace_run": 2.0,
            "trailing_whitespace_lines": 2.0,
            "normalized_unique_identifiers": 1.24
          },
          "imports": {
            "total": 8.0,
            "unique_modules": 8.0,
            "third_party_count": 8.0,
            "third_party_ratio": 1.0
          },
          "strings": {
            "total": 31.0,
            "avg_length": 8512.23,
            "max_length": 131370.0,
            "avg_entropy": 2.68,
            "total_bytes": 263879.0,
            "entropy_stddev": 1.3,
            "very_long_strings": 2.0,
            "high_entropy_count": 2.0
          },
          "comments": {},
          "functions": {},
          "identifiers": {
            "total": 24.0,
            "avg_length": 8.47,
            "max_length": 15.0,
            "min_length": 3.0,
            "avg_entropy": 2.49,
            "reuse_ratio": 0.63,
            "unique_count": 15.0,
            "length_stddev": 4.27,
            "has_digit_ratio": 0.07,
            "all_lowercase_ratio": 0.73,
            "all_uppercase_ratio": 0.2,
            "underscore_prefix_count": 3.0
          }
        },
        "ss": [
          [
            132,
            "dot1992"
          ],
          [
            133,
            "dot1992"
          ],
          [
            165,
            "v1.3"
          ],
          [
            166,
            "v1.3"
          ],
          [
            203,
            "pass"
          ],
          [
            204,
            "pass"
          ],
          [
            246,
            "nst"
          ],
          [
            247,
            "nst"
          ],
          [
            253,
            "$pass"
          ],
          [
            319,
            "nst"
          ],
          [
            320,
            "nst"
          ],
          [
            340,
            "nst"
          ],
          [
            341,
            "nst"
          ],
          [
            369,
            "\r\n\u003cnoembed\u003e\u003cxmp\u003e\u003cbody\u003e\u003c/xmp\u003e\u003c/noembed\u003e\u003cnoembed\u003e\u003cxmp\u003e\u003c/body\r\n\r\n\u003e\u003c/html\u003e\u003c/xmp\u003e\u003c/noembed\u003e\u003ctitle\u003e-farM-mOn3Y-\u003c/title\u003e\r\n\u003ccenter\u003e\r\n\u003cta"
          ],
          [
            370,
            "\r\n\u003cnoembed\u003e\u003cxmp\u003e\u003cbody\u003e\u003c/xmp\u003e\u003c/noembed\u003e\u003cnoembed\u003e\u003cxmp\u003e\u003c/body\r\n\r\n\u003e\u003c/html\u003e\u003c/xmp\u003e\u003c/noembed\u003e\u003ctitle\u003e-farM-mOn3Y-\u003c/title\u003e\r\n\u003ccenter\u003e\r\n\u003cta"
          ],
          [
            832,
            "HTTP_HOST"
          ],
          [
            833,
            "HTTP_HOST"
          ],
          [
            845,
            "\u003cbr\u003e\r\n\u003cb\u003eIP:\u003c/b\u003e "
          ],
          [
            846,
            "\u003cbr\u003e\r\n\u003cb\u003eIP:\u003c/b\u003e "
          ],
          [
            888,
            "HTTP_HOST"
          ],
          [
            889,
            "HTTP_HOST"
          ],
          [
            902,
            "\u003cbr\u003e\r\n\u003cb\u003eYour ip:\u003c/b\u003e "
          ],
          [
            903,
            "\u003cbr\u003e\r\n\u003cb\u003eYour ip:\u003c/b\u003e "
          ],
          [
            936,
            "REMOTE_ADDR"
          ],
          [
            937,
            "REMOTE_ADDR"
          ],
          [
            951,
            "\r\n\u003c/td\u003e\u003c/tr\u003e\u003c/table\u003e\r\n"
          ],
          [
            952,
            "\r\n\u003c/td\u003e\u003c/tr\u003e\u003c/table\u003e\r\n"
          ],
          [
            990,
            "?\u003e"
          ],
          [
            991,
            "?\u003e"
          ]
        ],
        "sz": 132403,
        "ts": [
          {
            "a": "T1505.003",
            "c": 1.0,
            "d": "Inequality check in WordPress user list",
            "e": [
              "!="
            ],
            "i": "objectives/command-and-control/backdoor/webshell/hide::wp-user-hiding-not-trait",
            "l": 1,
            "m": "B0030"
          },
          {
            "c": 0.6000000238418579,
            "d": "Generates HTML tags",
            "e": [
              "\u003cbody"
            ],
            "i": "micro-behaviors/data/format/html::html-generator-tags",
            "l": 3
          },
          {
            "a": "T1027",
            "c": 0.9200000166893005,
            "d": "Regex component marker",
            "e": [
              "HOST"
            ],
            "i": "objectives/anti-static/obfuscation/payload/config::url-component-concat--rx-12",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1505.003",
            "c": 0.8500000238418579,
            "d": "PHP request superglobal access",
            "e": [
              "$_POST"
            ],
            "i": "objectives/command-and-control/backdoor/webshell/upload::php-request-variadic-function-call",
            "l": 3,
            "m": "B0030"
          },
          {
            "d": "password keyword",
            "e": [
              "password"
            ],
            "i": "micro-behaviors/data/text/keywords/lexicon::password",
            "l": 1
          },
          {
            "c": 0.8600000143051147,
            "d": "Regex component marker",
            "e": [
              "method="
            ],
            "i": "objectives/command-and-control/backdoor/webshell/ui::self-named-get-form--rx-3",
            "l": 1,
            "m": "B0030"
          },
          {
            "a": "T1505.003",
            "c": 0.8600000143051147,
            "d": "Very long embedded string",
            "e": [
              "strings.max_length = 131370.00"
            ],
            "i": "objectives/command-and-control/backdoor/webshell/stager::very-long-string",
            "l": 1
          },
          {
            "c": 0.8399999737739563,
            "d": "password/token/api_key field keyword",
            "e": [
              "password"
            ],
            "i": "micro-behaviors/data/text/keywords/credential::credential-field",
            "l": 1
          },
          {
            "c": 0.8500000238418579,
            "d": "Removes PHP script execution time limit",
            "e": [
              "@set_time_limit(0)"
            ],
            "i": "objectives/command-and-control/backdoor/webshell/session::unlimited-runtime-call",
            "l": 4
          },
          {
            "c": 0.8399999737739563,
            "d": "Regex component marker",
            "e": [
              "\r\n\u003cnoembed\u003e\u003cxmp\u003e\u003cbody\u003e\u003c/xmp\u003e\u003c/noembed\u003e\u003cnoembed\u003e\u003cxmp\u003e\u003c/body\r\n\r\n\u003e\u003c/html\u003e\u003c/xmp\u003e\u003c/noembed\u003e\u003ctitle\u003e-farM-mOn3Y-\u003c/title\u003e\r\n\u003ccenter\u003e\r\n\u003cta"
            ],
            "i": "micro-behaviors/data/text/llm/action::llm-send-action--rx-6",
            "l": 1
          },
          {
            "a": "T1059",
            "c": 0.8500000238418579,
            "d": "HTTP POST parameter access ($_POST)",
            "e": [
              "$_POST"
            ],
            "i": "micro-behaviors/communications/http/request/params::post-dup",
            "l": 3
          },
          {
            "a": "T1059.006",
            "c": 0.75,
            "d": "PHP eval() token present",
            "e": [
              "eval"
            ],
            "i": "micro-behaviors/process/interpreter/eval::eval-symbol",
            "l": 4,
            "m": "E1059"
          },
          {
            "c": 0.75,
            "d": "Generic $_SERVER superglobal access",
            "e": [
              "$_SERVER"
            ],
            "i": "micro-behaviors/communications/http/request/params::server-dup",
            "l": 3
          },
          {
            "c": 0.8999999761581421,
            "d": "File has 30 or more lines",
            "e": [
              "text.total_lines = 4428.00"
            ],
            "i": "metadata/file/text/metrics::file-has-30-plus-lines",
            "l": 1
          },
          {
            "a": "T1505.003",
            "d": "PHP open tag",
            "e": [
              "\u003c?php"
            ],
            "i": "objectives/command-and-control/backdoor/webshell/request::php-tag",
            "l": 1,
            "m": "B0030"
          },
          {
            "c": 0.8399999737739563,
            "d": "Regex component marker",
            "e": [
              "\r\n\u003cnoembed\u003e\u003cxmp\u003e\u003cbody\u003e\u003c/xmp\u003e\u003c/noembed\u003e\u003cnoembed\u003e\u003cxmp\u003e\u003c/body\r\n\r\n\u003e\u003c/html\u003e\u003c/xmp\u003e\u003c/noembed\u003e\u003ctitle\u003e-farM-mOn3Y-\u003c/title\u003e\r\n\u003ccenter\u003e\r\n\u003cta"
            ],
            "i": "micro-behaviors/data/text/llm/action::llm-send-action-cond-4--inline-11750",
            "l": 1
          },
          {
            "a": "T1505.003",
            "c": 0.8999999761581421,
            "d": "PHP source imports base64_decode",
            "e": [
              "[base64_decode, die, eval, gethostbyname, gzuncompress, isset, session_start, set_time_limit]"
            ],
            "i": "objectives/command-and-control/backdoor/webshell/stager::source-import-base64-decode",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "PHP error suppression operator usage",
            "e": [
              "@set_time_limit(0)",
              "@session_start()",
              "@$pass=$_POST['pass']"
            ],
            "i": "micro-behaviors/os/stdio::error-suppress-prefix",
            "l": 3
          },
          {
            "a": "T1505.003",
            "c": 0.4000000059604645,
            "d": "PHP $_POST parameter access",
            "e": [
              "$_POST["
            ],
            "i": "objectives/command-and-control/backdoor/webshell/request::php-post",
            "l": 1,
            "m": "B0030"
          },
          {
            "c": 0.75,
            "d": "Session variable access ($_SESSION)",
            "e": [
              "$_SESSION"
            ],
            "i": "micro-behaviors/communications/http/request/params::session",
            "l": 3
          },
          {
            "c": 0.8600000143051147,
            "d": "Regex component marker",
            "e": [
              "$_SERVER["
            ],
            "i": "objectives/command-and-control/backdoor/webshell/ui::self-named-get-form--rx-4",
            "l": 1,
            "m": "B0030"
          },
          {
            "a": "T1027",
            "c": 0.699999988079071,
            "d": "Very low whitespace ratio (minified/compressed)",
            "e": [
              "text.whitespace_ratio = 0.07"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::low-whitespace",
            "l": 2,
            "m": "B0032"
          },
          {
            "c": 0.699999988079071,
            "d": "Remove execution time limit",
            "e": [
              "set_time_limit"
            ],
            "i": "micro-behaviors/process/control/signal::set-time-limit",
            "l": 3
          },
          {
            "c": 0.75,
            "d": "Inline password token in lure",
            "e": [
              "password = \"dot1992\""
            ],
            "i": "objectives/lateral-movement/social-engineering/lures::inline-password-token",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "AJAX request handler pattern",
            "e": [
              "$_POST['pass']"
            ],
            "i": "objectives/command-and-control/backdoor/webshell/ui::ajax-handler",
            "l": 4,
            "m": "B0030"
          },
          {
            "a": "T1027",
            "c": 0.800000011920929,
            "d": "High overall text entropy (encoded",
            "e": [
              "text.char_entropy = 6.03"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::high-text-entropy",
            "l": 2,
            "m": "B0032"
          },
          {
            "c": 1.0,
            "d": "php code embedded in string",
            "e": [
              "Detected php at offset 0x0"
            ],
            "i": "metadata/lang/embedded::php",
            "l": 2
          },
          {
            "c": 0.8999999761581421,
            "d": "PHP webshell which directly eval()s obfuscated string",
            "e": [
              "\u003c?",
              "\u003c?php",
              "eval(\"?\u003e\".gzuncompress(base64_decode"
            ],
            "i": "third_party/SigBase/WEBSHELL/PHP/Gzinflated",
            "l": 5
          },
          {
            "c": 0.8999999761581421,
            "d": "typical webshell strings, suspicious",
            "e": [
              "eval(\"?\u003e\"",
              "\u003c?php",
              "_POST[",
              "_SERVER[\"HTTP_",
              "\u003c?"
            ],
            "i": "third_party/SigBase/WEBSHELL/PHP/Strings/SUSP",
            "l": 5
          }
        ],
        "sha": "f7b3a2629f744dca599eff7ce02ef8e8660e67ca176318fd891b9d81b1eac2a1",
        "path": "21b2c2f87ddeb34fac82612a5ebbd38b",
        "type": "php"
      }
    ],
    "tv": "87c42"
  }
}