{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9999556541442871, "class": 2 } ], "prob": 0.99995565, "class": 2, "models": [ { "m": "az", "prob": 0.9988335, "class": 1 }, { "m": "az/scripts", "prob": 0.9999418, "class": 2 }, { "m": "az/php", "prob": 0.99995565, "class": 2 } ], "version": "v16.16", "thresholds": [ 0.9961138, 0.99909174 ], "analyzed_at": "2026-05-10T00:12:11Z" }, "path": "1ee67481a39f8d3f9a61821f117a1a27", "raw": { "v": "4", "fs": [ { "f": "O₄(As₃C₃AlDy)H₃(Cm₂FOs)Th", "k": { "source.imports[0]": "array_reverse", "source.imports[1]": "empty", "source.imports[2]": "explode", "source.imports[3]": "implode", "source.imports[4]": "isset", "source.imports[5]": "l10", "source.imports[6]": "l10w", "source.imports[7]": "l11vw2", "source.imports[8]": "l19qv", "source.imports[9]": "l1ArXq", "source.strings[0]": " HTTP/1.0", "source.strings[1]": "$\r\nyumingid=27\r\nlineid=552\r\nx3=\r\nx4=ojcJnKxPqO\r\nx5=professor,relationship,hundred,devise,cube,individual,clearly,sex,major,define,actually,indicate,consult,convenient,definite,energy,establish,conversation,million,respond,probably,credit,convey,consequently,data,confuse,oh,destination,dear,themselves,copper,couple,demonstrate,according,concentrate,tonight,ok,finally,congratulate,thought,process,two,theory,daylight,others,series,activity,his,convince,involve,deny,manager,phone,policy,defeat,comprehension,i,correspond,defend,myself\r\nx6=\r\nx7=http://btuan07.sj|uwtizhy5\u003e3tsqnsj/cjia.php\r\ncache=00\r\nsps=1001110\r\nurlgz=#-^-[2:3~9].*|#/[2:2~6]/!/|[0:3~6]-#-$-[1:3~5]-[0:3~6]|#_[2:3~5]_[1:3~6]/!.*|^/[0:3~7]_#/[0:3~6]_[0:3~6]_[0:3~6]_!|^_[0:3~6]-[1:3~6]-[1:3~6]|^_[0:2~5]_!|[0:9]/#_^-[0:10]_[0:7]/[0:4]/[0:10]-[0:10]_[0:8]-[0:10]/!/[0:3~5].magp|[1:8]_#_[1:4]_[0:5]_!_[1:5]|[0:1]_^_!|[0:9]/^/!|[0:9]_^-[0:7]_[0:6]/[0:10]-!-[0:10]_[0:6]/[0:11]-[0:8]/[0:7].*|^_!-[0:1~3]|#/^-[0:8]-!-[0:7].*||xhtml,cgi,jsp,htm\r\n", "source.strings[2]": "$l15mz5be/", "source.strings[3]": "$l1Iy5$l1ae1{$l1BoXN[3]}\u003c", "source.strings[4]": "$l1JaE8/", "source.strings[5]": "$l1Y/$l1EE", "source.strings[6]": "$l1ds3Pj7/robots.txt", "source.strings[7]": "$l1i7M/$l1avtFFX", "source.strings[8]": "$l1i7M/$l1avtFFX/$l1efZ", "source.strings[9]": "$l1i7M/$l1avtFFX/$l1o", "source.has_imports": true, "source.imports[10]": "l1B", "source.imports[11]": "l1DhIK", "source.imports[12]": "l1E", "source.imports[13]": "l1F", "source.imports[14]": "l1FrV", "source.imports[15]": "l1Gj4EqS", "source.imports[16]": "l1Gz5R", "source.imports[17]": "l1ICDfcF", "source.imports[18]": "l1JLj2", "source.imports[19]": "l1LuaV", "source.imports[20]": "l1PYg12a", "source.imports[21]": "l1Qrp", "source.imports[22]": "l1RNMk", "source.imports[23]": "l1Sw", "source.imports[24]": "l1YctUf", "source.imports[25]": "l1ZZn0", "source.imports[26]": "l1akod", "source.imports[27]": "l1c46yT", "source.imports[28]": "l1ci", "source.imports[29]": "l1hk4ndy", "source.imports[30]": "l1ibchG", "source.imports[31]": "l1l", "source.imports[32]": "l1nDw", "source.imports[33]": "l1t", "source.imports[34]": "l1vHPM99", "source.imports[35]": "l1yK", "source.imports[36]": "l1ztqII", "source.imports[37]": "preg_split", "source.strings[10]": "$l1i7M/$l1avtFFX/landingcss", "source.strings[11]": "$l1lcpGQW", "source.strings[12]": "$l1p$l1y29l,", "source.strings[13]": "$l1tGyiR/", "source.strings[14]": "$l1tGyiR?", "source.strings[15]": "$l1uzy/", "source.strings[16]": "$l1wn08p/", "source.strings[17]": "($l1vQYbq)", "source.strings[18]": "(.*)/si", "source.strings[19]": "(.*?)';/s", "source.strings[20]": ")?(\\?|\\/)/si", "source.strings[21]": ")?(\\d+)$/si", "source.strings[22]": "/$l1EE", "source.strings[23]": "/$l1RGn", "source.strings[24]": "/$l1wPX", "source.strings[25]": "/($l1IrjCFS)/si", "source.strings[26]": "/([^\\d]+)(\\d+)\\.xml$/si", "source.strings[27]": "/.*?\\r\\n\\r\\n(.*)/si", "source.strings[28]": "/\u003cIfModule\\s+mod_rewrite.c\u003e[^\u003c]+\u003c\\/IfModule\u003e/si", "source.strings[29]": "/@'\\\\\\$(.*?)';/s", "source.strings[30]": "/@\\'\\$.*?exit\\(\\);\\}if\\(.*?\\}\\}[a-z0-9]+\\(\\);/si", "source.strings[31]": "/[^A-Za-z0-9\\+\\/\\=$]/", "source.strings[32]": "/\\.(jpg|jpeg|gif|png|bmp|svg)$/si", "source.strings[33]": "/\\.xml$/si", "source.strings[34]": "/^$l1ZYL$/", "source.strings[35]": "/^($l1tGyiR)?(\\?|\\/)/si", "source.strings[36]": "/^[a-z](\\d+)$/si", "source.strings[37]": "/landingcss", "source.strings[38]": "/robots.txt", "source.strings[39]": "1\\d)/si", "source.strings[40]": "1|\\^\\(.\\*\\)", "source.strings[41]": "710(\\d+)$/si", "source.strings[42]": "=\\\\\\$1|\\^\\(.\\*\\)\\\\\\$|.\\*-.\\*|\\?\\\\\\$\\d\\d?\\\\\\$1\\d)/si", "source.strings[43]": "?/|\u0026()[]{}+^$!:*", "source.strings[44]": "@require(", "source.strings[45]": "@require('$l1AUc5o');", "source.strings[46]": "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=$", "source.strings[47]": "Connection:Close", "source.strings[48]": "DOCUMENT_ROOT", "source.strings[49]": "GET $l1BmNY HTTP/1.0\\r\\nHost:", "source.strings[50]": "HTTP_HOST", "source.strings[51]": "HTTP_REFERER", "source.strings[52]": "HTTP_USER_AGENT", "source.strings[53]": "K/@mJB3pOxjmNx8y", "source.strings[54]": "PATH_INFO", "source.strings[55]": "QUERY_STRING", "source.strings[56]": "REMOTE_ADDR", "source.strings[57]": "REQUEST_URI", "source.strings[58]": "SCRIPT_FILENAME", "source.strings[59]": "SCRIPT_NAME", "source.strings[60]": "SERVER_NAME", "source.strings[61]": "SERVER_SOFTWARE", "source.strings[62]": "\\$.*?exit\\(\\);\\}if\\(.*?\\}\\}[a-z0-9]+\\(\\);/si", "source.strings[63]": "\\\\?/|\u0026()[]{}+^$!:*", "source.strings[64]": "\\r\\nConnection:Close\\r\\n\\r\\n", "source.strings[65]": "\\x3c\\x3fphp $l1lX", "source.strings[66]": "\\xEF\\xBB\\xBF", "source.strings[67]": "b66666", "source.strings[68]": "b666666", "source.strings[69]": "b6666666b", "source.strings[70]": "b6666b", "source.strings[71]": "b6666b6", "source.strings[72]": "b6666b666", "source.strings[73]": "b6666b6b", "source.strings[74]": "b6666bb6", "source.strings[75]": "b6666bb6b", "source.strings[76]": "b6666bbb", "source.strings[77]": "b6666bbbb", "source.strings[78]": "b666b6", "source.strings[79]": "b666b66", "source.strings[80]": "b666b6666", "source.strings[81]": "b666b6b6b", "source.strings[82]": "b666bb", "source.strings[83]": "b666bb66", "source.strings[84]": "b666bb6b", "source.strings[85]": "b666bbb66", "source.strings[86]": "b666bbbb6", "source.strings[87]": "b66b66", "source.strings[88]": "b66b666b6", "source.strings[89]": "b66b66bb", "source.strings[90]": "b66b6b", "source.strings[91]": "b66b6b6", "source.strings[92]": "b66b6b66", "source.strings[93]": "b66b6b6b", "source.strings[94]": "b66b6b6bb", "source.strings[95]": "b66b6bb", "source.strings[96]": "b66b6bb66", "source.strings[97]": "b66b6bbb", "source.strings[98]": "b66b6bbbb", "source.strings[99]": "b66bb6", "source.functions[0]": "l10", "source.functions[1]": "l10w", "source.functions[2]": "l11vw2", "source.functions[3]": "l19qv", "source.functions[4]": "l1ArXq", "source.functions[5]": "l1B", "source.functions[6]": "l1DhIK", "source.functions[7]": "l1E", "source.functions[8]": "l1F", "source.functions[9]": "l1FrV", "source.strings[100]": "b66bb66", "source.strings[101]": "b66bb666", "source.strings[102]": "b66bb6666", "source.strings[103]": "b66bb66b6", "source.strings[104]": "b66bb6b6", "source.strings[105]": "b66bb6bb", "source.strings[106]": "b66bb6bb6", "source.strings[107]": "b66bb6bbb", "source.strings[108]": "b66bbb", "source.strings[109]": "b66bbb6", "source.strings[110]": "b66bbbb6", "source.strings[111]": "b6b666", "source.strings[112]": "b6b6666", "source.strings[113]": "b6b66666", "source.strings[114]": "b6b6666b6", "source.strings[115]": "b6b6666bb", "source.strings[116]": "b6b666bb", "source.strings[117]": "b6b666bb6", "source.strings[118]": "b6b66b6", "source.strings[119]": "b6b66b66", "source.strings[120]": "b6b66b66b", "source.strings[121]": "b6b66b6b", "source.strings[122]": "b6b66b6bb", "source.strings[123]": "b6b66bbb", "source.strings[124]": "b6b66bbb6", "source.strings[125]": "b6b66bbbb", "source.strings[126]": "b6b6b6", "source.strings[127]": "b6b6b66", "source.strings[128]": "b6b6b6666", "source.strings[129]": "b6b6b66b", "source.strings[130]": "b6b6b6b6b", "source.strings[131]": "b6b6b6bb", "source.strings[132]": "b6b6bb", "source.strings[133]": "b6b6bb6", "source.strings[134]": "b6b6bb66", "source.strings[135]": "b6b6bbb6b", "source.strings[136]": "b6bb6666", "source.strings[137]": "b6bb666bb", "source.strings[138]": "b6bb66bb", "source.strings[139]": "b6bb6b", "source.strings[140]": "b6bb6b6", "source.strings[141]": "b6bb6b66", "source.strings[142]": "b6bb6b666", "source.strings[143]": "b6bb6bbb", "source.strings[144]": "b6bbb6", "source.strings[145]": "b6bbb6b66", "source.strings[146]": "b6bbb6bb", "source.strings[147]": "b6bbb6bbb", "source.strings[148]": "b6bbbb6", "source.strings[149]": "b6bbbb66", "source.strings[150]": "b6bbbb666", "source.strings[151]": "b6bbbb6b", "source.strings[152]": "b6bbbbb", "source.strings[153]": "b6bbbbb6", "source.strings[154]": "b6bbbbbb", "source.strings[155]": "b6bbbbbbb", "source.strings[156]": "b6bbbbbbb9bbb6bb66b9b66bbbb69bb6b66b669b66b6bb669bbb6bbb69bb666bb6b9bb66bb6bb9bb666bbb9b6bb6bbb9bb66b6bb9b6666bbb9b6b66b6bb9bb666666b9b66bb6bb9b666b6b6b9b666b66669bb666bbb69bbbbb6b69b6bb6b669b6bbbb6669b6b6b669b6666666b9b6bbbb6b9b6bbbbb9bb6bbbbb69b66bb6b69b66b6b6b9bb6bbb6bb9bb66bbb669b6666b6b9b666bb6b9b6bbb6bb9b6bbb6bb69bb66bb66b9bbbb6b69bb6bbbb69b6b666bb9bbbbb6b9bb66bbbb69bbbb66b9b66b666b69bb6b6bbb69bb6b6669bbb66bbbb9bbbb66bb69b6b66bbbb9b66bb6bbb9b6b6666bb9b6bb6b6669b6666b6b69bbb66b69bbb6b6b6b9b6b6b66669bb666bb9bbb6b6669bbb6bb669b66bb6669b6b66bbb9bbb66b669b6bbbbbb9b6bb6bb69b666bb669bb6b6bbb9bb6b66b6b9b66bb6bb69bb6666b669b6b66b6b9b66b669b6666bb6b9b6b666b9bb6b6b6bb9b6bb666bb9b6b666bb6", "source.strings[157]": "bb66666", "source.strings[158]": "bb666666b", "source.strings[159]": "bb666b", "source.strings[160]": "bb666bb", "source.strings[161]": "bb666bb6", "source.strings[162]": "bb666bb66", "source.strings[163]": "bb666bbb", "source.strings[164]": "bb666bbb6", "source.strings[165]": "bb666bbbb", "source.strings[166]": "bb66b6", "source.strings[167]": "bb66b66", "source.strings[168]": "bb66b666", "source.strings[169]": "bb66b66b6", "source.strings[170]": "bb66b6b", "source.strings[171]": "bb66b6b6", "source.strings[172]": "bb66b6bb", "source.strings[173]": "bb66b6bb6", "source.strings[174]": "bb66bb66", "source.strings[175]": "bb66bb6bb", "source.strings[176]": "bb66bbb", "source.strings[177]": "bb66bbb6", "source.strings[178]": "bb66bbb66", "source.strings[179]": "bb66bbbb6", "source.strings[180]": "bb6b66", "source.strings[181]": "bb6b666", "source.strings[182]": "bb6b66b6", "source.strings[183]": "bb6b66b66", "source.strings[184]": "bb6b66b6b", "source.strings[185]": "bb6b66bb", "source.strings[186]": "bb6b6b", "source.strings[187]": "bb6b6b6", "source.strings[188]": "bb6b6b66", "source.strings[189]": "bb6b6b6bb", "source.strings[190]": "bb6b6bb", "source.strings[191]": "bb6b6bb66", "source.strings[192]": "bb6b6bbb", "source.strings[193]": "bb6b6bbb6", "source.strings[194]": "bb6bb6", "source.strings[195]": "bb6bb66b", "source.strings[196]": "bb6bb6b", "source.strings[197]": "bb6bb6b6b", "source.strings[198]": "bb6bb6bbb", "source.strings[199]": "bb6bbb", "source.strings[200]": "bb6bbb6", "source.strings[201]": "bb6bbb66", "source.strings[202]": "bb6bbb66b", "source.strings[203]": "bb6bbb6b", "source.strings[204]": "bb6bbb6bb", "source.strings[205]": "bb6bbbb", "source.strings[206]": "bb6bbbb6", "source.strings[207]": "bb6bbbbb6", "source.strings[208]": "bbb666", "source.strings[209]": "bbb6666", "source.strings[210]": "bbb6666b", "source.strings[211]": "bbb666b", "source.strings[212]": "bbb666b6", "source.strings[213]": "bbb66b", "source.strings[214]": "bbb66b6", "source.strings[215]": "bbb66b66", "source.strings[216]": "bbb66bbbb", "source.strings[217]": "bbb6b666", "source.strings[218]": "bbb6b666b", "source.strings[219]": "bbb6b6b", "source.strings[220]": "bbb6b6b6b", "source.strings[221]": "bbb6bb", "source.strings[222]": "bbb6bb66", "source.strings[223]": "bbb6bb666", "source.strings[224]": "bbb6bb66b", "source.strings[225]": "bbb6bbb", "source.strings[226]": "bbb6bbb6", "source.strings[227]": "bbbb66", "source.strings[228]": "bbbb666", "source.strings[229]": "bbbb66b66", "source.strings[230]": "bbbb66bb", "source.strings[231]": "bbbb66bb6", "source.strings[232]": "bbbb6b", "source.strings[233]": "bbbb6b6", "source.strings[234]": "bbbb6b6bb", "source.strings[235]": "bbbbb6b", "source.strings[236]": "bbbbb6b6", "source.strings[237]": "bbbbbb6", "source.strings[238]": "bbbbbb6b6", "source.strings[239]": "bbbbbb6bb", "source.strings[240]": "bbbbbbbbb", "source.strings[241]": "extensions", "source.strings[242]": "http://", "source.strings[243]": "http://$l1l", "source.strings[244]": "list_test", "source.strings[245]": "ml$/si", "source.strings[246]": "oO0Oo0OO0", "source.strings[247]": "s)$/si", "source.strings[248]": "stnetnoc_teg_elif1letirwf1ltini_lruc1ledocedlru1llru_esrap1ltnuoc1ledocnelru1ltes_ini1lciremun_si1ltpotes_lruc1lroolf1lcexe_lruc1lseulav_yarra1lerapmoc_noisrev1lemaner1lesolcf1lecalper_gerp1ldnar_tm1ldro1legrem_yarra1lpop_yarra1lhcuot1ltrats_bo1ltimil_emit_tes1lnepof1lmirt1lelif_si1lecils_yarra1llla_hctam_gerp1ltfihs_yarra1lfoef1lsoprts1legnar1leuqinu_yarra1letad1lezilaires1ltcartxe1lhctam_gerp1lelbatirw_si1lrtrts1lliec1lftnirps1lenifed1ltes_enozemit_tluafed_etad1lyarra_ni1ltilps_gerp1lnelrts1lesolc_lruc1lridkm1ldnars_tm1lhcraes_yarra1ledolpmi1l5dm1lstsixe_noitcnuf1lrhc1lrtsbus1ltroba_resu_erongi1lpilf_yarra1lyarra_si1ldomhc1lsba1lofniphp1lstegf1lemitmelif1ledolpxe1lemitotrts1lredaeh1lezilairesnu1lsoprrts1ltressa1lemanybtsohteg1lelffuhs1lecalper_rts1lstsixe_elif", "source.strings[249]": "url_prefix", "source.strings[250]": "url_prefix_qm", "source.strings[251]": "url_rules", "source.strings[252]": "{$l1S}000", "source.strings[253]": "{$l1S}l", "source.strings[254]": "{$l1S}l000", "source.strings[255]": "|.\\*-.\\*|\\?", "source.functions[10]": "l1Gj4EqS", "source.functions[11]": "l1Gz5R", "source.functions[12]": "l1ICDfcF", "source.functions[13]": "l1JLj2", "source.functions[14]": "l1LuaV", "source.functions[15]": "l1PYg12a", "source.functions[16]": "l1Qrp", "source.functions[17]": "l1RNMk", "source.functions[18]": "l1Sw", "source.functions[19]": "l1YctUf", "source.functions[20]": "l1ZZn0", "source.functions[21]": "l1akod", "source.functions[22]": "l1c46yT", "source.functions[23]": "l1ci", "source.functions[24]": "l1hk4ndy", "source.functions[25]": "l1ibchG", "source.functions[26]": "l1l", "source.functions[27]": "l1nDw", "source.functions[28]": "l1t", "source.functions[29]": "l1vHPM99", "source.functions[30]": "l1yK", "source.functions[31]": "l1ztqII" }, "x": 187, "id": 0, "is": [ "explode", "preg_split", "implode", "array_reverse", "explode", "l1Gj4EqS", "l1ibchG", "l1yK", "l1yK", "l1yK", "isset", "isset", "isset", "l1nDw", "l1nDw", "isset", "l1nDw", "isset", "empty", "isset", "isset", "isset", "isset", "isset", "empty", "l1vHPM99", "l1ICDfcF", "l1vHPM99", "isset", "empty", "empty", "l1ztqII", "l1ICDfcF", "isset", "isset", "l1nDw", "l1Sw", "l1vHPM99", "l1ztqII", "l1ICDfcF", "isset", "isset", "l1t", "isset", "empty", "l1t", "isset", "empty", "empty", "empty", "l1YctUf", "l1l", "l1t", "l1YctUf", "isset", "empty", "isset", "l1ArXq", "l1E", "empty", "isset", "empty", "empty", "isset", "empty", "isset", "empty", "l1LuaV", "l1LuaV", "empty", "isset", "empty", "l1ci", "l1E", "l1E", "l1ztqII", "l1ICDfcF", "l1ztqII", "l1ICDfcF", "l1vHPM99", "l1ztqII", "l1ICDfcF", "l1E", "l1E", "l1ztqII", "l1ICDfcF", "l1ztqII", "l1ICDfcF", "l1ICDfcF", "isset", "isset", "isset", "l1Gz5R", "l1F", "isset", "isset", "isset", "empty", "isset", "isset", "isset", "l10w", "l1vHPM99", "l1FrV", "l10", "l1ArXq", "l1ArXq", "empty", "empty", "empty", "l11vw2", "l1c46yT", "empty", "l1PYg12a", "l1DhIK", "l1RNMk", "l1ZZn0", "l1l", "l1B", "l19qv", "empty", "l1LuaV", "empty", "l1B", "l1JLj2", "empty", "l1hk4ndy", "empty", "l1LuaV", "l1JLj2", "l1akod", "l1B", "l1B", "empty", "l1JLj2", "empty", "l1Qrp" ], "ms": { "file": { "size": 48763.0 }, "text": { "digit_ratio": 0.2, "space_count": 113.0, "total_lines": 12.0, "char_entropy": 5.83, "unique_chars": 97.0, "escape_density": 0.04, "import_density": 1141.67, "lines_over_200": 3.0, "lines_over_500": 1.0, "string_density": 149.25, "avg_line_length": 4061.58, "lines_over_1000": 1.0, "max_line_length": 47747.0, "hex_escape_count": 20.0, "last_line_length": 47747.0, "long_token_count": 70.0, "most_common_char": "b", "whitespace_ratio": 0.0, "most_common_ratio": 0.07, "identifier_density": 212.58, "line_length_stddev": 13172.61, "encoded_string_ratio": 0.19, "normalized_import_count": 39.55, "normalized_string_count": 517.02, "suspicious_string_ratio": 0.0, "max_inline_whitespace_run": 1.0, "normalized_function_count": 9.24, "imports_to_functions_ratio": 4.28, "strings_to_functions_ratio": 55.97, "suspicious_identifier_ratio": 0.17, "normalized_unique_identifiers": 110.46, "identifiers_to_functions_ratio": 12.38 }, "imports": { "total": 137.0, "unique_modules": 38.0, "third_party_count": 137.0, "third_party_ratio": 1.0 }, "strings": { "total": 1791.0, "url_count": 3.0, "avg_length": 22.32, "max_length": 10752.0, "path_count": 57.0, "avg_entropy": 1.07, "email_count": 2.0, "hex_strings": 340.0, "total_bytes": 39977.0, "entropy_stddev": 0.89, "very_long_strings": 4.0, "high_entropy_count": 6.0, "shell_command_strings": 3.0, "unicode_heavy_strings": 1.0, "embedded_code_candidates": 2.0 }, "comments": {}, "functions": { "total": 32.0, "one_liners": 32.0, "avg_name_length": 5.5, "no_params_count": 32.0, "avg_length_lines": 1.0, "max_length_lines": 1.0, "min_length_lines": 1.0, "numeric_suffix_names": 3.0, "density_per_100_lines": 266.67, "code_in_functions_ratio": 2.67 }, "identifiers": { "total": 2551.0, "avg_length": 6.06, "max_length": 22.0, "min_length": 3.0, "avg_entropy": 2.36, "reuse_ratio": 0.16, "unique_count": 396.0, "length_stddev": 2.31, "hex_like_names": 5.0, "has_digit_ratio": 0.95, "base64_like_names": 64.0, "high_entropy_count": 2.0, "high_entropy_ratio": 0.01, "all_lowercase_ratio": 0.02, "all_uppercase_ratio": 0.03, "numeric_suffix_count": 54.0, "double_underscore_count": 1.0, "underscore_prefix_count": 5.0 } }, "ss": [ [ 7, "$\r\nyumingid=27\r\nlineid=552\r\nx3=\r\nx4=ojcJnKxPqO\r\nx5=professor,relationship,hundred,devise,cube,individual,clearly,sex,major,defin" ], [ 8, "$\r\nyumingid=27\r\nlineid=552\r\nx3=\r\nx4=ojcJnKxPqO\r\nx5=professor,relationship,hundred,devise,cube,individual,clearly,sex,major,defin" ], [ 1035, "1l" ], [ 1036, "1l" ], [ 1040, "stnetnoc_teg_elif1letirwf1ltini_lruc1ledocedlru1llru_esrap1ltnuoc1ledocnelru1ltes_ini1lciremun_si1ltpotes_lruc1lroolf1lcexe_lruc" ], [ 1041, "stnetnoc_teg_elif1letirwf1ltini_lruc1ledocedlru1llru_esrap1ltnuoc1ledocnelru1ltes_ini1lciremun_si1ltpotes_lruc1lroolf1lcexe_lruc" ], [ 1881, "//" ], [ 1882, "//" ], [ 2020, "9" ], [ 2021, "9" ], [ 2024, "b6bbbbbbb9bbb6bb66b9b66bbbb69bb6b66b669b66b6bb669bbb6bbb69bb666bb6b9bb66bb6bb9bb666bbb9b6bb6bbb9bb66b6bb9b6666bbb9b6b66b6bb9bb66" ], [ 2025, "b6bbbbbbb9bbb6bb66b9b66bbbb69bb6b66b669b66b6bb669bbb6bbb69bb666bb6b9bb66bb6bb9bb666bbb9b6bb6bbb9bb66b6bb9b6666bbb9b6b66b6bb9bb66" ], [ 2833, "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=$" ], [ 2834, "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=$" ], [ 2995, "b666b6666" ], [ 2996, "b666b6666" ], [ 3008, "/[^A-Za-z0-9\\+\\/\\=$]/" ], [ 3009, "/[^A-Za-z0-9\\+\\/\\=$]/" ], [ 3060, "b666bb6b" ], [ 3061, "b666bb6b" ], [ 3090, "bbb6b666" ], [ 3091, "bbb6b666" ], [ 3142, "b666bb6b" ], [ 3143, "b666bb6b" ], [ 3172, "bbb6b666" ], [ 3173, "bbb6b666" ], [ 3220, "b666bb6b" ], [ 3221, "b666bb6b" ], [ 3250, "bbb6b666" ], [ 3251, "bbb6b666" ], [ 3299, "b666bb6b" ], [ 3300, "b666bb6b" ], [ 3329, "bbb6b666" ], [ 3330, "bbb6b666" ], [ 3484, "bb666bb" ], [ 3485, "bb666bb" ], [ 3544, "bb666bb" ], [ 3545, "bb666bb" ], [ 3601, "bb666bb" ], [ 3602, "bb666bb" ], [ 3712, "b6b66bbbb" ], [ 3713, "b6b66bbbb" ], [ 3800, "bbbb66bb6" ], [ 3801, "bbbb66bb6" ], [ 3813, "//u" ], [ 3814, "//u" ], [ 3894, "bb666bb" ], [ 3895, "bb666bb" ], [ 3914, "bbbbb6b6" ], [ 3915, "bbbbb6b6" ], [ 4038, "b6bbbbbbb" ], [ 4039, "b6bbbbbbb" ], [ 4084, "b6b66b6b" ], [ 4085, "b6b66b6b" ], [ 14953, "bb6bbbb6" ], [ 14954, "bb6bbbb6" ], [ 14986, "b6b666bb" ], [ 14987, "b6b666bb" ], [ 15003, "K/@mJB3pOxjmNx8y" ], [ 15004, "K/@mJB3pOxjmNx8y" ], [ 15043, "oO0Oo0OO0" ], [ 15044, "oO0Oo0OO0" ], [ 15067, "b6bbbb6b" ], [ 15068, "b6bbbb6b" ], [ 15095, "bbb6bb66" ], [ 15096, "bbb6bb66" ], [ 15120, "b6666666b" ], [ 15121, "b6666666b" ], [ 15147, "bb666666b" ], [ 15148, "bb666666b" ], [ 15181, "bbb" ], [ 15182, "bbb" ], [ 15188, "\u003c" ], [ 15189, "\u003c" ], [ 15204, "bb66bb6bb" ], [ 15205, "bb66bb6bb" ], [ 15226, "b66b" ], [ 15227, "b66b" ], [ 15243, "bbbb6" ], [ 15244, "bbbb6" ], [ 15269, "bb6b666" ], [ 15270, "bb6b666" ], [ 15289, "bbbb6" ], [ 15290, "bbbb6" ], [ 15374, "." ], [ 15375, "." ], [ 15521, "DOCUMENT_ROOT" ], [ 15522, "DOCUMENT_ROOT" ], [ 15593, "b6bbbbb" ], [ 15594, "b6bbbbb" ], [ 15611, "w" ], [ 15612, "w" ], [ 15646, "bbb6bb66b" ], [ 15647, "bbb6bb66b" ], [ 15686, "b666b6b6b" ], [ 15687, "b666b6b6b" ], [ 15752, "bbbb66bb6" ], [ 15753, "bbbb66bb6" ], [ 15774, "b66b6bbb" ], [ 15775, "b66b6bbb" ], [ 15918, "b6b6b6666" ], [ 15919, "b6b6b6666" ], [ 15940, "b66" ], [ 15941, "b66" ], [ 15958, "b6b6b6666" ], [ 15959, "b6b6b6666" ], [ 15980, "b66b6" ], [ 15981, "b66b6" ], [ 16010, "b66bbbb6" ], [ 16011, "b66bbbb6" ], [ 16033, "b6bb6bbb" ], [ 16034, "b6bb6bbb" ], [ 16086, "b6bb6bbb" ], [ 16087, "b6bb6bbb" ], [ 16135, "bbb66" ], [ 16136, "bbb66" ], [ 16154, "b6bb6bbb" ], [ 16155, "b6bb6bbb" ], [ 16211, "b6bb6bbb" ], [ 16212, "b6bb6bbb" ], [ 16268, "b6bb6bbb" ], [ 16269, "b6bb6bbb" ], [ 16329, "b6666bbb" ], [ 16330, "b6666bbb" ], [ 16361, "b66bb6bbb" ], [ 16362, "b66bb6bbb" ], [ 16447, "b6b6b6666" ], [ 16448, "b6b6b6666" ], [ 16469, "bbbb" ], [ 16470, "bbbb" ], [ 16498, "bbbb" ], [ 16499, "bbbb" ], [ 16523, "b6b6b6666" ], [ 16524, "b6b6b6666" ], [ 16545, "bb6bb6bbb" ], [ 16546, "bb6bb6bbb" ], [ 16579, "bb6bb6bbb" ], [ 16580, "bb6bb6bbb" ], [ 16626, "b66b6bb66" ], [ 16627, "b66b6bb66" ], [ 16674, "host" ], [ 16675, "host" ], [ 16694, "port" ], [ 16695, "port" ], [ 16709, "port" ], [ 16710, "port" ], [ 16773, "path" ], [ 16774, "path" ], [ 16788, "path" ], [ 16789, "path" ], [ 16820, "query" ], [ 16821, "query" ], [ 16830, "?" ], [ 16831, "?" ], [ 16840, "query" ], [ 16841, "query" ], [ 16872, "/" ], [ 16873, "/" ], [ 16893, "bbb6bb66b" ], [ 16894, "bbb6bb66b" ], [ 16915, "GET $l1BmNY HTTP/1.0\\r\\nHost:" ], [ 16916, "GET " ], [ 16927, " HTTP/1.0" ], [ 16940, "Host:" ], [ 16953, "host" ], [ 16954, "host" ], [ 16961, "\\r\\nConnection:Close\\r\\n\\r\\n" ], [ 16966, "Connection:Close" ], [ 17020, "b6666b6b" ], [ 17021, "b6666b6b" ], [ 17061, "b666bb66" ], [ 17062, "b666bb66" ], [ 17098, "b666b6b6b" ], [ 17099, "b666b6b6b" ], [ 17138, "b6b666bb" ], [ 17139, "b6b666bb" ], [ 17159, "bbb6bbb" ], [ 17160, "bbb6bbb" ], [ 17188, "b666b6666" ], [ 17189, "b666b6666" ], [ 17201, "/.*?\\r\\n\\r\\n(.*)/si" ], [ 17202, "/.*?" ], [ 17214, "(.*)/si" ], [ 17223, "$1" ], [ 17224, "$1" ], [ 17246, "b666b6666" ], [ 17247, "b666b6666" ], [ 17268, "b6666b6" ], [ 17269, "b6666b6" ], [ 17279, "$1" ], [ 17280, "$1" ], [ 17333, "b6bbbbbbb" ], [ 17334, "b6bbbbbbb" ], [ 17373, "bb6bbbbb6" ], [ 17374, "bb6bbbbb6" ], [ 17395, "bb6bbbbb6" ], [ 17396, "bb6bbbbb6" ], [ 17416, "\\xEF\\xBB\\xBF" ], [ 17497, "bb6bbbbb6" ], [ 17498, "bb6bbbbb6" ], [ 17536, "bb6bbbbb6" ], [ 17537, "bb6bbbbb6" ], [ 17618, "b6b66bbbb" ], [ 17619, "b6b66bbbb" ], [ 17658, "bb66b6bb" ], [ 17659, "bb66b6bb" ], [ 17779, "b66bb666" ], [ 17780, "b66bb666" ], [ 18018, "bb666bbb" ], [ 18019, "bb666bbb" ], [ 18095, "bbb66b6" ], [ 18096, "bbb66b6" ], [ 18199, "bb666b" ], [ 18200, "bb666b" ], [ 18218, "b6bbb6" ], [ 18219, "b6bbb6" ], [ 18237, "b66b6bbbb" ], [ 18238, "b66b6bbbb" ], [ 18259, "bb6" ], [ 18260, "bb6" ], [ 18275, "bbb6" ], [ 18276, "bbb6" ], [ 18292, "b666" ], [ 18293, "b666" ], [ 18309, "b6b6" ], [ 18310, "b6b6" ], [ 18317, "oo" ], [ 18318, "oo" ], [ 18356, "bb6b66b6" ], [ 18357, "bb6b66b6" ], [ 18377, "b66bb" ], [ 18378, "b66bb" ], [ 18402, "b6b666bb" ], [ 18403, "b6b666bb" ], [ 18414, "/($l1IrjCFS)/si" ], [ 18415, "/(" ], [ 18426, ")/si" ], [ 18487, "b6b666bb" ], [ 18488, "b6b666bb" ], [ 18508, "bb" ], [ 18509, "bb" ], [ 18523, "b6" ], [ 18524, "b6" ], [ 18538, "b6b66b66" ], [ 18539, "b6b66b66" ], [ 18559, "b6b6666b6" ], [ 18560, "b6b6666b6" ], [ 18581, "b6bb6b" ], [ 18582, "b6bb6b" ], [ 18600, "b6bbb" ], [ 18601, "b6bbb" ], [ 18850, "b666b6666" ], [ 18851, "b666b6666" ], [ 18872, "bb6bbbb" ], [ 18873, "bb6bbbb" ], [ 18892, "b6b" ] ], "sz": 48763, "ts": [ { "a": "T1505.003", "c": 0.949999988079071, "d": "Retrieves web server document root path", "e": [ "$_SERVER[\"DOCUMENT_ROOT\"]" ], "i": "objectives/command-and-control/backdoor/webshell/stager::php-document-root-access", "l": 4 }, { "c": 0.800000011920929, "d": "Very short file (under 12 lines)", "e": [ "text.total_lines = 12.00" ], "i": "metadata/file/text/metrics::file-under-12-lines", "l": 1 }, { "a": "T1027", "c": 0.9200000166893005, "d": "HOST URL component identifier", "e": [ "HOST" ], "i": "objectives/anti-static/obfuscation/payload/config::url-component-concat--rx-12", "l": 1, "m": "B0032" }, { "a": "T1027.003", "c": 0.8999999761581421, "d": "Node.js require call in non-code file", "e": [ "require(" ], "i": "objectives/anti-static/obfuscation/payload/container::js-require-in-noncode", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "HTTP protocol prefix", "e": [ "http://" ], "i": "micro-behaviors/communications/http/protocol::http-prefix", "l": 2 }, { "a": "T1027", "c": 0.75, "d": "Many no-param functions", "e": [ "functions.no_params_count = 32.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/functions::many-no-param-functions", "l": 2, "m": "B0032" }, { "a": "T1027", "c": 0.9399999976158142, "d": "Architecture keyed encoded blob value", "e": [ "\"b6bbbbbbb9bbb6bb66b9b66bbbb69bb6b66b669b66b6bb669bbb6bbb69bb666bb6b9bb66bb6bb9bb666bbb9b6bb6bbb9bb66b6bb9b6666bbb9b6b66b6bb9bb6" ], "i": "objectives/anti-static/obfuscation/payload/config::arch-keyed-hex-blob-dict--encoded-value", "l": 1, "m": "B0032" }, { "a": "T1584", "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "\u003c/urlset\u003e" ], "i": "objectives/command-and-control/dropper/delivery/seo-spam::php-seo-cloaking--rx-1", "l": 1 }, { "a": "T1505.003", "c": 0.8600000143051147, "d": "Very long embedded string", "e": [ "strings.max_length = 10752.00" ], "i": "objectives/command-and-control/backdoor/webshell/stager::very-long-string", "l": 1 }, { "a": "T1505.003", "c": 0.8500000238418579, "d": "PHP request superglobal access", "e": [ "$_POST" ], "i": "objectives/command-and-control/backdoor/webshell/upload::php-request-variadic-function-call", "l": 3, "m": "B0030" }, { "a": "T1027", "c": 0.8999999761581421, "d": "Exactly one line exceeds 1000 chars", "e": [ "text.lines_over_1000 = 1.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::single-long-line-outlier", "l": 1, "m": "B0032" }, { "a": "T1059", "c": 0.8500000238418579, "d": "HTTP GET parameter access ($_GET)", "e": [ "$_GET" ], "i": "micro-behaviors/communications/http/request/params::get-dup", "l": 3 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Last line is over 1000 chars", "e": [ "text.last_line_length = 47747.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::last-line-over-1000", "l": 1, "m": "B0032" }, { "a": "T1505.003", "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "ecalper_gerp" ], "i": "objectives/command-and-control/backdoor/webshell/decoder::reversed-dangerous-php--rx-7", "l": 1, "m": "B0030" }, { "a": "T1505.003", "c": 0.8399999737739563, "d": "Near-zero whitespace script", "e": [ "text.whitespace_ratio = 0.00" ], "i": "objectives/command-and-control/backdoor/webshell/stager::near-zero-whitespace", "l": 1 }, { "c": 0.75, "d": "HTTP protocol version strings", "e": [ "HTTP/1.0" ], "i": "micro-behaviors/communications/http/request/client::http-versions", "l": 1 }, { "c": 0.8999999761581421, "d": "HTTP/1.0 protocol version", "e": [ "GET $l1BmNY HTTP/1.0\\r\\nHost:", " HTTP/1.0" ], "i": "micro-behaviors/communications/http/protocol::http-1-0-header", "l": 2 }, { "a": "T1071.001", "d": "HTTP/1.x version string", "e": [ "HTTP/1." ], "i": "micro-behaviors/communications/http/request/client::http-version", "l": 2, "m": "C0002" }, { "a": "T1059", "c": 0.8500000238418579, "d": "HTTP POST parameter access ($_POST)", "e": [ "$_POST" ], "i": "micro-behaviors/communications/http/request/params::post-dup", "l": 3 }, { "c": 0.8600000143051147, "d": "Regex component marker", "e": [ "$_SERVER[" ], "i": "objectives/command-and-control/backdoor/webshell/ui::self-named-get-form--rx-4", "l": 1, "m": "B0030" }, { "a": "T1027.010", "d": "Hardcoded standard base64 alphabet", "e": [ "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" ], "i": "micro-behaviors/data/encode/base64::alphabet-standard", "l": 2, "m": "B0032.001" }, { "a": "T1059", "c": 0.800000011920929, "d": "Self-reference via __FILE__", "e": [ "__FILE__" ], "i": "micro-behaviors/fs/read/self::self-file-reference", "l": 3 }, { "a": "T1005", "c": 0.75, "d": "Regex component marker", "e": [ "credit" ], "i": "objectives/credential-access/financial/credit-card::mastercard-bin--rx-1", "l": 1, "m": "B0030" }, { "a": "T1082", "d": "References PHP_VERSION constant", "e": [ "PHP_VERSION" ], "i": "objectives/discovery/system/fingerprint/info::php-version-constant", "l": 2, "m": "E1082" }, { "c": 0.75, "d": "Session variable access ($_SESSION)", "e": [ "$_SESSION" ], "i": "micro-behaviors/communications/http/request/params::session", "l": 3 }, { "c": 0.75, "d": "Generic $_SERVER superglobal access", "e": [ "$_SERVER" ], "i": "micro-behaviors/communications/http/request/params::server-dup", "l": 3 }, { "d": "finally handler keyword", "e": [ "finally" ], "i": "metadata/package/error-handling::finally-keyword", "l": 2 }, { "a": "T1505.003", "c": 0.4000000059604645, "d": "PHP $_GET[...] superglobal access", "e": [ "$_GET[" ], "i": "objectives/command-and-control/backdoor/webshell/request::php-get", "l": 1, "m": "B0030" }, { "a": "T1071", "c": 0.6000000238418579, "d": "URL with .php endpoint", "e": [ "http://btuan07.sj|uwtizhy5\u003e3tsqnsj/cjia.php" ], "i": "objectives/command-and-control/infrastructure/domain/tld::php-endpoint-url", "l": 1 }, { "c": 0.949999988079071, "d": "PHP opening tag present", "e": [ "\u003c?php" ], "i": "metadata/lang/scripted::php-open-tag", "l": 1 }, { "a": "T1505.003", "c": 0.4000000059604645, "d": "PHP $_POST[...] superglobal access", "e": [ "$_POST[" ], "i": "objectives/command-and-control/backdoor/webshell/request::php-post", "l": 1, "m": "B0030" }, { "c": 0.800000011920929, "d": "PHP variable function invocation pattern", "e": [ "l1K1x5ID" ], "i": "objectives/anti-static/obfuscation/imports::dynamic-function-execution", "l": 3 }, { "c": 0.699999988079071, "d": "PHP error suppression operator usage", "e": [ "@$GLOBALS[\"bbb66b66\"]($l1T,0444)", "@$GLOBALS[\"bb6bbbb6\"]($b6bbbb66b)", "@$GLOBALS[\"b6bbbbbbb\"]($l1T)", "@$GLOBALS[\"b6b6b66\"]($l11J5qm,$GLOBALS[\"b66bb6bb6\"]($GLOBALS[\"b6b66bbb6\"].$GLOBALS[\"bb66bbb6\"]))", "@$GLOBALS[\"b6b6666bb\"]($l15mz5be)", "@$GLOBALS[\"b6bbbb6b\"](7200)", "@$GLOBALS[\"bb6b666\"]($GLOBALS[\"bbbb6\"])", "@$GLOBALS[\"b6b66b6b\"](l1yK(\"XSnxLyH5d2L5NSnhXlH1XlH1MlH1HisyNiD1NhIgaUE4TF0qUEgVX/4XTCv7HisyNif5HlIh...", "@$GLOBALS[\"bbb66b66\"]($l15mz5be,0755)", "@$GLOBALS[\"bb66bb6bb\"]($GLOBALS[\"b66b\"],$GLOBALS[\"bbbb6\"])", "@$GLOBALS[\"bbb66b66\"]($l1F)", "@$GLOBALS[\"b6bbbbb\"]($l1W0Z,'w')", "@$GLOBALS[\"bbb6bb66\"](1)", "@$GLOBALS[\"b6666666b\"]()", "@$GLOBALS[\"bbb66b66\"]($l1T,0777)", "@'$\r\nyumingid=27\r\nlineid=552\r\nx3=\r\nx4=ojcJnKxPqO\r\nx5=professor,relationship,hundred,devise,cube,indi..." ], "i": "micro-behaviors/os/stdio::error-suppress-prefix", "l": 3 }, { "c": 0.8999999761581421, "d": "Very long line", "e": [ "text.max_line_length = 47747.00" ], "i": "metadata/file/text/metrics::single-long-line", "l": 1 }, { "a": "T1082", "c": 0.6000000238418579, "d": "Accesses DOCUMENT_ROOT variable", "e": [ "$_SERVER[\"DOCUMENT_ROOT\"]" ], "i": "objectives/discovery/system/fingerprint/info::document-root-access", "l": 3, "m": "E1082" }, { "a": "T1046", "c": 0.6000000238418579, "d": "HTTP port number (80)", "e": [ "port\"])?$l1hI[\"port\"]:80" ], "i": "objectives/discovery/network/scan/port::port-number-http", "l": 1, "m": "E1046" }, { "c": 0.6000000238418579, "d": "Very long base64 strings present", "e": [ "b6bbbbbbb9bbb6bb66b9b66bbbb69bb6b66b669b66b6bb669bbb6bbb69bb666bb6b9bb66bb6bb9bb666bbb9b6bb6bbb9bb66b6bb9b6666bbb9b6b66b6bb9bb66" ], "i": "objectives/anti-static/obfuscation/string/base64::long-base64-in-strings", "l": 3 }, { "a": "T1027", "c": 0.800000011920929, "d": "High overall text entropy (encoded", "e": [ "text.char_entropy = 5.83" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::high-text-entropy", "l": 2, "m": "B0032" }, { "a": "T1071.001", "c": 0.6499999761581421, "d": "bind to HTTP port 80", "e": [ "port\"])?$l1hI[\"port\"]:80" ], "i": "micro-behaviors/communications/http/server/listener::bind-port-80", "l": 3, "m": "C0002" }, { "a": "T1082", "d": "Accesses SERVER_NAME variable", "e": [ "$_SERVER[\"SERVER_NAME\"]" ], "i": "objectives/discovery/system/fingerprint/info::server-name-access", "l": 3, "m": "E1082" }, { "c": 0.8500000238418579, "d": "Checks User-Agent for crawler detection", "e": [ "$_SERVER[\"HTTP_USER_AGENT\"]" ], "i": "objectives/anti-analysis/browser-detect::check-ua-server-var", "l": 3 }, { "a": "T1027", "c": 0.699999988079071, "d": "Many one-line source function definitions", "e": [ "functions.one_liners = 32.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/functions::many-one-liner-functions", "l": 3, "m": "B0032" }, { "a": "T1027", "c": 0.699999988079071, "d": "Very low whitespace ratio (minified/compressed)", "e": [ "text.whitespace_ratio = 0.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::low-whitespace", "l": 2, "m": "B0032" }, { "c": 0.699999988079071, "d": "AJAX request handler pattern", "e": [ "$_GET[$l1zmSDcX]", "$_GET[$l1h]", "$_GET[\"html\"]", "$_GET[$l1RRPwB]", "$_GET[$l1M]", "$_GET[\"list_test\"]", "$_GET[$l1K9]", "$_POST[$l1Fy7]", "$_GET[$l1AB5Cc]", "$_GET[$l1sKs]", "$_GET[$l1j2]", "$_GET[$l1p2raRI]" ], "i": "objectives/command-and-control/backdoor/webshell/ui::ajax-handler", "l": 4, "m": "B0030" }, { "a": "T1027", "c": 0.8999999761581421, "d": "PHP source contains very long line", "e": [ "text.max_line_length = 47747.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/identifiers::php-single-long-line", "l": 4, "m": "B0032" }, { "a": "T1027", "c": 0.8500000238418579, "d": "High function density", "e": [ "functions.density_per_100_lines = 266.67" ], "i": "objectives/anti-static/obfuscation/code-metrics/functions::high-function-density", "l": 2, "m": "B0032" }, { "a": "T1027", "c": 0.75, "d": "Many short functions (deobfuscation layers)", "e": [ "functions.one_liners = 32.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/identifiers::php-many-short-functions", "l": 4, "m": "B0032" }, { "a": "T1082", "c": 0.699999988079071, "d": "Accesses SERVER_SOFTWARE variable", "e": [ "$_SERVER[\"SERVER_SOFTWARE\"]" ], "i": "objectives/discovery/system/fingerprint/info::server-software-access", "l": 3, "m": "E1082" }, { "a": "T1027", "c": 0.8999999761581421, "d": "Minified/compressed code (multiple indicators)", "e": [ "text.whitespace_ratio = 0.00", "functions.density_per_100_lines = 266.67", "functions.one_liners = 32.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::minified-code", "l": 2, "m": "B0032" }, { "c": 1.0, "d": "php code embedded in string", "e": [ "Detected php at offset 0x0" ], "i": "metadata/lang/embedded::php", "l": 2 }, { "c": 0.8999999761581421, "d": "Decoded unicode-escape content", "e": [ "';$bbbbb6bbb=explode(\"1l\",\"stnetnoc_teg_ \u003cunicode-escape\u003e" ], "i": "metadata/encoded-payload/unicode-escape", "l": 2 }, { "c": 0.8999999761581421, "d": "Webshell which sends eval/assert via GET", "e": [ "$_POST[$l1Fy7])){$GLOBALS[\"b6666bb6b\"]($_POST[" ], "i": "third_party/SigBase/WEBSHELL/PHP/Function/Via/Get", "l": 5 } ], "sha": "f9f41da58d418e8055a470287620d7a5cec79235ac9f198c70c650bcf41ed508", "path": "1ee67481a39f8d3f9a61821f117a1a27", "type": "php" } ], "tv": "87c42" } }