<p>Software security is a cornerstone of modern digital infrastructure, with static code analysis playing a pivotal role in identifying vulnerabilities and detecting malicious code. Among the many threats to software security, WebShell, a command execution environment written in scripting languages, stand out as one of the most commonly used attack tools by cyber attackers. Once a WebShell is deployed on a compromised web server, attackers can gain unauthorized control, execute malicious actions, and escalate their operations, posing severe risks to software systems. Detecting WebShells effectively remains a critical challenge in the field of software security. Traditional feature matching-based methods fail to identify new and obfuscated WebShell variants, while machine learning approaches are often hindered by complex feature engineering and limited adaptability to unknown threats. This paper introduces a novel WebShell detection method that transforms WebShell code files into grayscale images, reframing the detection task as an image classification problem. Leveraging a deep residual network enhanced with a hybrid attention mechanism and spatial pyramid pooling, the proposed method achieves high detection accuracy. Experimental results show its efficacy in identifying PHP, JSP and ASP WebShells, with a maximum accuracy of 98.53% and a recall of 98.73%.</p>