{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 0.9999529123306274,
        "class": 2
      }
    ],
    "prob": 0.9999529,
    "class": 2,
    "models": [
      {
        "m": "az",
        "prob": 0.98604625,
        "class": 0
      },
      {
        "m": "az/scripts",
        "prob": 0.9999529,
        "class": 2
      },
      {
        "m": "az/php",
        "prob": 0.9998412,
        "class": 2
      }
    ],
    "version": "v16.16",
    "thresholds": [
      0.9961138,
      0.99909174
    ],
    "analyzed_at": "2026-05-09T10:25:15Z"
  },
  "path": "105.108.125.206W5fU1oIFIdnO5f-8ZQ9bVwAAAAA.0.file",
  "raw": {
    "v": "4",
    "fs": [
      {
        "f": "O₂(C₅Xe)H₄(Cm₄Po₃Db₂Os)Md₂Th",
        "k": {
          "source.imports[0]": "base64_decode",
          "source.imports[1]": "count",
          "source.imports[2]": "empty",
          "source.imports[3]": "ereg_replace",
          "source.imports[4]": "eval",
          "source.imports[5]": "flush",
          "source.imports[6]": "intval",
          "source.imports[7]": "isset",
          "source.imports[8]": "mail",
          "source.imports[9]": "set_time_limit",
          "source.strings[0]": " ....... ",
          "source.strings[1]": " .......  ",
          "source.strings[2]": "$message = ereg_replace(\"\\\"\", \"\"\", $message);",
          "source.strings[3]": "$to ....... ",
          "source.strings[4]": "$xx / $numemails .......  $txtspamed\u003cbr\u003e",
          "source.strings[5]": "%5C%22",
          "source.strings[6]": "Content-Type: text/html\r\n",
          "source.strings[7]": "From: ",
          "source.strings[8]": "From: $realname \u003c$from\u003e\r\n",
          "source.strings[9]": "MIME-Version: 1.0\r\n",
          "source.has_imports": true,
          "source.imports[10]": "sleep",
          "source.imports[11]": "split",
          "source.imports[12]": "stripslashes",
          "source.imports[13]": "urldecode",
          "source.imports[14]": "urlencode",
          "source.strings[10]": "Please complete all fields before sending your message.",
          "source.strings[11]": "The test Post was not Submitted.\u003cbr /\u003e",
          "source.strings[12]": "Your Message was Sent Test.\u003cbr /\u003e",
          "source.strings[13]": "ZGllKGluY2x1ZGVfb25jZSAkaW4pOw==",
          "source.strings[14]": "action",
          "source.strings[15]": "die(include_once $in);",
          "source.strings[16]": "emaillist",
          "source.strings[17]": "message",
          "source.strings[18]": "realname",
          "source.strings[19]": "spammed",
          "source.strings[20]": "subject"
        },
        "x": 328,
        "id": 0,
        "is": [
          "isset",
          "empty",
          "eval",
          "base64_decode",
          "isset",
          "empty",
          "eval",
          "urldecode",
          "isset",
          "urlencode",
          "ereg_replace",
          "urldecode",
          "stripslashes",
          "stripslashes",
          "split",
          "count",
          "empty",
          "set_time_limit",
          "intval",
          "set_time_limit",
          "empty",
          "ereg_replace",
          "ereg_replace",
          "ereg_replace",
          "flush",
          "empty",
          "mail",
          "empty",
          "mail",
          "mail",
          "flush",
          "empty",
          "sleep"
        ],
        "ms": {
          "file": {
            "size": 9080.0
          },
          "text": {
            "tab_count": 348.0,
            "digit_ratio": 0.04,
            "space_count": 1345.0,
            "total_lines": 294.0,
            "char_entropy": 5.28,
            "mixed_indent": true,
            "unique_chars": 95.0,
            "import_density": 11.22,
            "lines_over_200": 1.0,
            "string_density": 0.25,
            "avg_line_length": 28.89,
            "max_line_length": 248.0,
            "empty_line_ratio": 0.08,
            "last_line_length": 7.0,
            "most_common_char": "e",
            "whitespace_ratio": 0.25,
            "most_common_ratio": 0.06,
            "identifier_density": 0.55,
            "line_length_stddev": 32.12,
            "encoded_string_ratio": 0.03,
            "normalized_import_count": 1.92,
            "normalized_string_count": 4.32,
            "repeated_char_sequences": 43.0,
            "max_inline_whitespace_run": 2.0,
            "trailing_whitespace_lines": 24.0,
            "suspicious_identifier_ratio": 0.02,
            "normalized_unique_identifiers": 5.12
          },
          "imports": {
            "total": 33.0,
            "unique_modules": 15.0,
            "third_party_count": 33.0,
            "third_party_ratio": 1.0
          },
          "strings": {
            "total": 74.0,
            "avg_length": 11.84,
            "max_length": 55.0,
            "avg_entropy": 2.3,
            "total_bytes": 876.0,
            "entropy_stddev": 1.16,
            "base64_candidates": 2.0
          },
          "comments": {},
          "functions": {},
          "identifiers": {
            "total": 161.0,
            "avg_length": 5.69,
            "max_length": 14.0,
            "min_length": 1.0,
            "avg_entropy": 2.07,
            "reuse_ratio": 0.26,
            "unique_count": 42.0,
            "length_stddev": 3.19,
            "has_digit_ratio": 0.02,
            "sequential_names": 1.0,
            "single_char_count": 1.0,
            "single_char_ratio": 0.02,
            "all_lowercase_ratio": 0.93,
            "all_uppercase_ratio": 0.05,
            "underscore_prefix_count": 2.0
          }
        },
        "ss": [
          [
            19,
            "in"
          ],
          [
            20,
            "in"
          ],
          [
            90,
            "ZGllKGluY2x1ZGVfb25jZSAkaW4pOw=="
          ],
          [
            91,
            "ZGllKGluY2x1ZGVfb25jZSAkaW4pOw=="
          ],
          [
            145,
            "ev"
          ],
          [
            146,
            "ev"
          ],
          [
            250,
            "action"
          ],
          [
            251,
            "action"
          ],
          [
            286,
            "action"
          ],
          [
            287,
            "action"
          ],
          [
            320,
            "message"
          ],
          [
            321,
            "message"
          ],
          [
            357,
            "emaillist"
          ],
          [
            358,
            "emaillist"
          ],
          [
            391,
            "from"
          ],
          [
            392,
            "from"
          ],
          [
            423,
            "subject"
          ],
          [
            424,
            "subject"
          ],
          [
            459,
            "realname"
          ],
          [
            460,
            "realname"
          ],
          [
            492,
            "wait"
          ],
          [
            493,
            "wait"
          ],
          [
            520,
            "tem"
          ],
          [
            521,
            "tem"
          ],
          [
            547,
            "smv"
          ],
          [
            548,
            "smv"
          ],
          [
            621,
            "%5C%22"
          ],
          [
            622,
            "%5C%22"
          ],
          [
            631,
            "%22"
          ],
          [
            632,
            "%22"
          ],
          [
            6683,
            "Please complete all fields before sending your message."
          ],
          [
            6684,
            "Please complete all fields before sending your message."
          ],
          [
            6799,
            "\r\n"
          ],
          [
            6800,
            "\r\n"
          ],
          [
            6887,
            "wait"
          ],
          [
            6888,
            "wait"
          ],
          [
            6906,
            "wait"
          ],
          [
            6907,
            "wait"
          ],
          [
            6960,
            "wait"
          ],
          [
            6961,
            "wait"
          ],
          [
            7336,
            " "
          ],
          [
            7337,
            " "
          ],
          [
            7393,
            "#EM#"
          ],
          [
            7394,
            "#EM#"
          ],
          [
            7459,
            "#EM#"
          ],
          [
            7460,
            "#EM#"
          ],
          [
            7538,
            "From: $realname \u003c$from\u003e\r\n"
          ],
          [
            7539,
            "From: "
          ],
          [
            7554,
            " \u003c"
          ],
          [
            7561,
            "\u003e\r\n"
          ],
          [
            7596,
            "MIME-Version: 1.0\r\n"
          ],
          [
            7597,
            "MIME-Version: 1.0\r\n"
          ],
          [
            7648,
            "Content-Type: text/html\r\n"
          ],
          [
            7649,
            "Content-Type: text/html\r\n"
          ],
          [
            7813,
            "The test Post was not Submitted.\u003cbr /\u003e"
          ],
          [
            7814,
            "The test Post was not Submitted.\u003cbr /\u003e"
          ],
          [
            7938,
            "Your Message was Sent Test.\u003cbr /\u003e"
          ],
          [
            7939,
            "Your Message was Sent Test.\u003cbr /\u003e"
          ],
          [
            8094,
            "smv"
          ],
          [
            8095,
            "smv"
          ],
          [
            8193,
            "The test Post was not Submitted.\u003cbr /\u003e"
          ],
          [
            8194,
            "The test Post was not Submitted.\u003cbr /\u003e"
          ],
          [
            8318,
            "Your Message was Sent Test.\u003cbr /\u003e"
          ],
          [
            8319,
            "Your Message was Sent Test.\u003cbr /\u003e"
          ],
          [
            8482,
            "$to ....... "
          ],
          [
            8486,
            " ....... "
          ],
          [
            8615,
            "spammed"
          ],
          [
            8616,
            "spammed"
          ],
          [
            8689,
            "error"
          ],
          [
            8690,
            "error"
          ],
          [
            8803,
            "$xx / $numemails .......  $txtspamed\u003cbr\u003e"
          ],
          [
            8807,
            " / "
          ],
          [
            8820,
            " .......  "
          ],
          [
            8840,
            "\u003cbr\u003e"
          ],
          [
            61,
            "base64",
            "die(include_once $in);"
          ],
          [
            593,
            "url",
            "$message = ereg_replace(\"\\\"\", \"\"\", $message);"
          ]
        ],
        "sz": 9080,
        "ts": [
          {
            "c": 0.6000000238418579,
            "d": "Generates HTML tags",
            "e": [
              "\u003chtml"
            ],
            "i": "micro-behaviors/data/format/html::html-generator-tags",
            "l": 3
          },
          {
            "a": "T1071.001",
            "c": 0.6000000238418579,
            "d": "enctype attribute",
            "e": [
              "enctype="
            ],
            "i": "micro-behaviors/communications/http/post::enctype-attr",
            "l": 3,
            "m": "C0002"
          },
          {
            "c": 1.0,
            "d": "PHP mail() function call",
            "e": [
              "mail"
            ],
            "i": "micro-behaviors/process/create/exec::php-mail",
            "l": 3
          },
          {
            "c": 0.699999988079071,
            "d": "PHP error suppression operator usage",
            "e": [
              "@eval(base64_decode('ZGllKGluY2x1ZGVfb25jZSAkaW4pOw=='))",
              "@mail($to, $subject, $message, $header)",
              "@mail($tem,$subject,$message,$header)"
            ],
            "i": "micro-behaviors/os/stdio::error-suppress-prefix",
            "l": 3
          },
          {
            "c": 0.800000011920929,
            "d": "Sends email with error suppression (@mail)",
            "e": [
              "@mail($tem,$subject,$message,$header)",
              "@mail($to, $subject, $message, $header)"
            ],
            "i": "micro-behaviors/communications/email/send/mail-func::mail-suppressed",
            "l": 4,
            "m": "B0032"
          },
          {
            "a": "T1059",
            "c": 0.8500000238418579,
            "d": "HTTP GET parameter access ($_GET)",
            "e": [
              "$_GET"
            ],
            "i": "micro-behaviors/communications/http/request/params::get-dup",
            "l": 3
          },
          {
            "a": "T1059.001",
            "c": 0.8999999761581421,
            "d": "Error-suppressed eval (@eval)",
            "e": [
              "@eval("
            ],
            "i": "objectives/execution/interpreter/eval/remote::eval-error-suppressed",
            "l": 4,
            "m": "E1059"
          },
          {
            "a": "T1505.003",
            "d": "PHP open tag",
            "e": [
              "\u003c?php"
            ],
            "i": "objectives/command-and-control/backdoor/webshell/request::php-tag",
            "l": 1,
            "m": "B0030"
          },
          {
            "c": 0.8999999761581421,
            "d": "File has 30 or more lines",
            "e": [
              "text.total_lines = 294.00"
            ],
            "i": "metadata/file/text/metrics::file-has-30-plus-lines",
            "l": 1
          },
          {
            "c": 0.8600000143051147,
            "d": "Regex component marker",
            "e": [
              "method="
            ],
            "i": "objectives/command-and-control/backdoor/webshell/ui::self-named-get-form--rx-3",
            "l": 1,
            "m": "B0030"
          },
          {
            "a": "T1059.006",
            "c": 0.75,
            "d": "PHP eval() token present",
            "e": [
              "eval"
            ],
            "i": "micro-behaviors/process/interpreter/eval::eval-symbol",
            "l": 4,
            "m": "E1059"
          },
          {
            "a": "T1505.003",
            "c": 0.8500000238418579,
            "d": "PHP request superglobal access",
            "e": [
              "$_POST"
            ],
            "i": "objectives/command-and-control/backdoor/webshell/upload::php-request-variadic-function-call",
            "l": 3,
            "m": "B0030"
          },
          {
            "a": "T1059",
            "c": 0.8500000238418579,
            "d": "HTTP POST parameter access ($_POST)",
            "e": [
              "$_POST"
            ],
            "i": "micro-behaviors/communications/http/request/params::post-dup",
            "l": 3
          },
          {
            "a": "T1505.003",
            "c": 0.8999999761581421,
            "d": "PHP source imports base64_decode",
            "e": [
              "[base64_decode, count, empty, ereg_replace, eval, flush, intval, isset, mail, set_time_limit, sleep, split, stripslashes, urldec"
            ],
            "i": "objectives/command-and-control/backdoor/webshell/stager::source-import-base64-decode",
            "l": 1
          },
          {
            "c": 0.7599999904632568,
            "d": "Regex component marker",
            "e": [
              "please"
            ],
            "i": "micro-behaviors/data/text/llm/action::llm-path-navigation-action--rx-27",
            "l": 1
          },
          {
            "d": "Content-Type header string",
            "e": [
              "Content-Type:"
            ],
            "i": "micro-behaviors/communications/http/request/client::content-type-header",
            "l": 1
          },
          {
            "a": "T1505.003",
            "c": 0.949999988079071,
            "d": "Regex component marker",
            "e": [
              "eval(base64_decode("
            ],
            "i": "objectives/command-and-control/backdoor/webshell/decoder::eval-decoder-chain--rx-1",
            "l": 1,
            "m": "B0030"
          },
          {
            "a": "T1505.003",
            "c": 0.4000000059604645,
            "d": "PHP $_GET parameter access",
            "e": [
              "$_GET["
            ],
            "i": "objectives/command-and-control/backdoor/webshell/request::php-get",
            "l": 1,
            "m": "B0030"
          },
          {
            "a": "T1505.003",
            "c": 0.4000000059604645,
            "d": "PHP $_POST parameter access",
            "e": [
              "$_POST["
            ],
            "i": "objectives/command-and-control/backdoor/webshell/request::php-post",
            "l": 1,
            "m": "B0030"
          },
          {
            "c": 0.699999988079071,
            "d": "AJAX request handler pattern",
            "e": [
              "$_POST['realname']",
              "$_POST['wait']",
              "$_GET['in']",
              "$_POST['smv']",
              "$_POST['subject']",
              "$_POST['tem']",
              "$_POST['from']",
              "$_POST['ev']",
              "$_POST['action']",
              "$_POST['message']",
              "$_POST['emaillist']"
            ],
            "i": "objectives/command-and-control/backdoor/webshell/ui::ajax-handler",
            "l": 4,
            "m": "B0030"
          },
          {
            "a": "T1071.001",
            "c": 0.6000000238418579,
            "d": "multipart/form-data content type",
            "e": [
              "multipart/form-data"
            ],
            "i": "micro-behaviors/communications/http/post::multipart-form",
            "l": 1,
            "m": "C0002"
          },
          {
            "c": 0.699999988079071,
            "d": "Remove execution time limit",
            "e": [
              "set_time_limit"
            ],
            "i": "micro-behaviors/process/control/signal::set-time-limit",
            "l": 3
          },
          {
            "a": "T1505.003",
            "c": 0.9700000286102295,
            "d": "PHP decoder eval webshell",
            "e": [
              "$_POST",
              "$_GET",
              "eval(base64_decode("
            ],
            "i": "objectives/command-and-control/backdoor/webshell/decoder::php-decoder-eval-webshell",
            "l": 5,
            "m": "B0030"
          },
          {
            "c": 1.0,
            "d": "php code embedded in string",
            "e": [
              "Detected php at offset 0x0"
            ],
            "i": "metadata/lang/embedded::php",
            "l": 2
          },
          {
            "c": 0.8999999761581421,
            "d": "Encoded payload detected: url",
            "e": [
              "$message = ereg_replace(\"\\\"\", \"\"\", $mess \u003curl\u003e"
            ],
            "i": "metadata/encoded-payload/url",
            "l": 3
          },
          {
            "c": 0.8999999761581421,
            "d": "PHP webshell which directly eval()s obfuscated string",
            "e": [
              "eval(base64_decode(",
              "\u003c?php",
              "\u003c?"
            ],
            "i": "third_party/SigBase/WEBSHELL/PHP/Gzinflated",
            "l": 5
          }
        ],
        "sha": "f969eda28a7eb687c472cfea67245603a7cb61be3b9a4ef2c545fac1f6171160",
        "path": "105.108.125.206W5fU1oIFIdnO5f-8ZQ9bVwAAAAA.0.file",
        "type": "php"
      }
    ],
    "tv": "a9555"
  }
}