{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 0.7868712544441223,
        "class": 0
      }
    ],
    "prob": 0.78687125,
    "class": 0,
    "models": [
      {
        "m": "az",
        "prob": 0.78687125,
        "class": 0
      },
      {
        "m": "az/source",
        "prob": 0.14864865,
        "class": 0
      },
      {
        "m": "az/c",
        "prob": 0.11965812,
        "class": 0
      }
    ],
    "version": "v16.16",
    "thresholds": [
      0.9979839,
      1.0
    ],
    "analyzed_at": "2026-05-11T16:58:40Z"
  },
  "path": "packet.c",
  "raw": {
    "v": "4",
    "fs": [
      {
        "f": "O(C)Md",
        "k": {
          "source.imports[0]": "fprintf",
          "source.imports[1]": "htons",
          "source.imports[2]": "inet_ntoa",
          "source.imports[3]": "memcpy",
          "source.imports[4]": "ntohs",
          "source.imports[5]": "printf",
          "source.imports[6]": "random",
          "source.imports[7]": "strcpy",
          "source.imports[8]": "strlen",
          "source.imports[9]": "strncpy",
          "source.strings[0]": "\"dhost: \u0002x:\u0002x:\u0002x:\u0002x:\u0002x:\u0002x }\\n\",",
          "source.strings[1]": "../../lib/includes.h",
          "source.strings[2]": "../../lib/xalloc.h",
          "source.strings[3]": "../state.h",
          "source.strings[4]": "\u003cassert.h\u003e",
          "source.strings[5]": "\u003cstdio.h\u003e",
          "source.strings[6]": "\u003cstdlib.h\u003e",
          "source.strings[7]": "\u003cstring.h\u003e",
          "source.strings[8]": "Device %s -\u003e Ethernet %02x:%02x:%02x:%02x:%02x:%02x",
          "source.strings[9]": "Device %s -\u003e Ethernet %02x:%02x:%02x:%02x:%02x:%02x\\n",
          "source.has_imports": true,
          "source.imports[10]": "xmalloc",
          "source.strings[10]": "dhost: %02x:%02x:%02x:%02x:%02x:%02x }",
          "source.strings[11]": "dhost: %02x:%02x:%02x:%02x:%02x:%02x }\\n",
          "source.strings[12]": "eth { shost: %02x:%02x:%02x:%02x:%02x:%02x | ",
          "source.strings[13]": "eth { shost: %02x:%02x:%02x:%02x:%02x:%02x | \"\n\t\t\t\"dhost: %02x:%02x:%02x:%02x:%02x:%02x }\\n",
          "source.strings[14]": "fprintf(fp, \"eth { shost: \u0002x:\u0002x:\u0002x:\u0002x:\u0002x:\u0002x | \"",
          "source.strings[15]": "ip { saddr: %s | daddr: %s | checksum: %#04X }",
          "source.strings[16]": "ip { saddr: %s | daddr: %s | checksum: %#04X }\\n",
          "source.strings[17]": "packet.h",
          "source.strings[18]": "printf(\"Device %s -\u003e Ethernet \u0002x:\u0002x:\u0002x:\u0002x:\u0002x:\u0002x\\n\",",
          "source.functions[0]": "*make_ip_str(uint32_t ip)",
          "source.functions[1]": "fprintf_eth_header(FILE *fp, struct ether_header *ethh)",
          "source.functions[2]": "fprintf_ip_header(FILE *fp, struct ip *iph)",
          "source.functions[3]": "make_eth_header(struct ether_header *ethh, macaddr_t *src, macaddr_t *dst)",
          "source.functions[4]": "make_icmp_header(struct icmp *buf)",
          "source.functions[5]": "make_ip_header(struct ip *iph, uint8_t protocol, uint16_t len)",
          "source.functions[6]": "make_tcp_header(struct tcphdr *tcp_header, port_h_t dest_port, uint16_t th_flags)",
          "source.functions[7]": "make_udp_header(struct udphdr *udp_header, port_h_t dest_port,\n\t\t\t\tuint16_t len)",
          "source.functions[8]": "print_macaddr(struct ifreq* i)"
        },
        "x": 3,
        "id": 0,
        "is": [
          "printf",
          "strncpy",
          "inet_ntoa",
          "strncpy",
          "inet_ntoa",
          "fprintf",
          "ntohs",
          "fprintf",
          "memcpy",
          "memcpy",
          "htons",
          "htons",
          "random",
          "htons",
          "htons",
          "htons",
          "htons",
          "inet_ntoa",
          "xmalloc",
          "strlen",
          "strcpy"
        ],
        "ms": {
          "file": {
            "size": 4175.0
          },
          "text": {
            "tab_count": 114.0,
            "digit_ratio": 0.04,
            "space_count": 427.0,
            "total_lines": 138.0,
            "char_entropy": 5.3,
            "mixed_indent": true,
            "unique_chars": 83.0,
            "escape_density": 0.05,
            "import_density": 15.22,
            "string_density": 0.15,
            "avg_line_length": 29.25,
            "max_line_length": 86.0,
            "empty_line_ratio": 0.12,
            "last_line_length": 1.0,
            "most_common_char": "t",
            "whitespace_ratio": 0.16,
            "most_common_ratio": 0.06,
            "identifier_density": 1.04,
            "line_length_stddev": 22.94,
            "octal_escape_count": 2.0,
            "encoded_string_ratio": 0.33,
            "normalized_import_count": 1.79,
            "normalized_string_count": 1.79,
            "suspicious_comment_ratio": 0.06,
            "max_inline_whitespace_run": 1.0,
            "normalized_function_count": 0.77,
            "imports_to_functions_ratio": 2.33,
            "strings_to_functions_ratio": 2.33,
            "suspicious_identifier_ratio": 0.09,
            "normalized_unique_identifiers": 6.61,
            "identifiers_to_functions_ratio": 5.22
          },
          "imports": {
            "total": 21.0,
            "unique_modules": 11.0,
            "third_party_count": 21.0,
            "third_party_ratio": 1.0
          },
          "strings": {
            "total": 21.0,
            "avg_length": 28.95,
            "max_length": 91.0,
            "path_count": 6.0,
            "avg_entropy": 3.31,
            "total_bytes": 608.0,
            "entropy_stddev": 0.39,
            "url_encoded_strings": 7.0
          },
          "comments": {
            "chars": 745.0,
            "lines": 24.0,
            "total": 18.0,
            "to_code_ratio": 0.21,
            "url_in_comments": 1.0,
            "high_entropy_comments": 1.0
          },
          "functions": {
            "total": 9.0,
            "length_stddev": 4.81,
            "avg_name_length": 53.78,
            "no_params_count": 9.0,
            "avg_length_lines": 11.67,
            "max_length_lines": 21.0,
            "min_length_lines": 6.0,
            "high_entropy_names": 9.0,
            "density_per_100_lines": 6.52,
            "code_in_functions_ratio": 0.76
          },
          "identifiers": {
            "total": 144.0,
            "avg_length": 7.57,
            "max_length": 18.0,
            "min_length": 1.0,
            "avg_entropy": 2.31,
            "reuse_ratio": 0.33,
            "unique_count": 47.0,
            "length_stddev": 4.78,
            "sequential_names": 4.0,
            "single_char_count": 4.0,
            "single_char_ratio": 0.09,
            "all_lowercase_ratio": 0.87,
            "all_uppercase_ratio": 0.13
          }
        },
        "ss": [
          [
            302,
            "\u003cstdlib.h\u003e"
          ],
          [
            322,
            "\u003cstdio.h\u003e"
          ],
          [
            341,
            "\u003cstring.h\u003e"
          ],
          [
            361,
            "\u003cassert.h\u003e"
          ],
          [
            382,
            "../../lib/includes.h"
          ],
          [
            383,
            "../../lib/includes.h"
          ],
          [
            414,
            "../../lib/xalloc.h"
          ],
          [
            415,
            "../../lib/xalloc.h"
          ],
          [
            444,
            "packet.h"
          ],
          [
            445,
            "packet.h"
          ],
          [
            465,
            "../state.h"
          ],
          [
            466,
            "../state.h"
          ],
          [
            540,
            "Device %s -\u003e Ethernet %02x:%02x:%02x:%02x:%02x:%02x\\n"
          ],
          [
            541,
            "Device %s -\u003e Ethernet %02x:%02x:%02x:%02x:%02x:%02x"
          ],
          [
            1536,
            "ip { saddr: %s | daddr: %s | checksum: %#04X }\\n"
          ],
          [
            1537,
            "ip { saddr: %s | daddr: %s | checksum: %#04X }"
          ],
          [
            1711,
            "eth { shost: %02x:%02x:%02x:%02x:%02x:%02x | \"\n\t\t\t\"dhost: %02x:%02x:%02x:%02x:%02x:%02x }\\n"
          ],
          [
            1711,
            "eth { shost: %02x:%02x:%02x:%02x:%02x:%02x | "
          ],
          [
            1712,
            "eth { shost: %02x:%02x:%02x:%02x:%02x:%02x | "
          ],
          [
            1762,
            "dhost: %02x:%02x:%02x:%02x:%02x:%02x }\\n"
          ],
          [
            1763,
            "dhost: %02x:%02x:%02x:%02x:%02x:%02x }"
          ],
          [
            532,
            "url",
            "printf(\"Device %s -\u003e Ethernet \u0002x:\u0002x:\u0002x:\u0002x:\u0002x:\u0002x\\n\","
          ],
          [
            1698,
            "url",
            "fprintf(fp, \"eth { shost: \u0002x:\u0002x:\u0002x:\u0002x:\u0002x:\u0002x | \""
          ],
          [
            1759,
            "url",
            "\"dhost: \u0002x:\u0002x:\u0002x:\u0002x:\u0002x:\u0002x }\\n\","
          ]
        ],
        "sz": 4175,
        "ts": [
          {
            "c": 0.30000001192092896,
            "d": "ICMP service/protocol reference",
            "e": [
              "icmp"
            ],
            "i": "micro-behaviors/communications/ip/services::services-icmp",
            "l": 2
          },
          {
            "a": "T1055",
            "c": 0.8999999761581421,
            "d": "Memory copy in source code",
            "e": [
              "memcpy"
            ],
            "i": "objectives/evasion/process/injection/shellcode::memcpy-raw",
            "l": 1,
            "m": "B0033"
          },
          {
            "c": 0.800000011920929,
            "d": "Hardcoded network port in source",
            "e": [
              "htons(54321)"
            ],
            "i": "objectives/command-and-control/reverse-shell/socket::hardcoded-htons-port-source",
            "l": 3
          },
          {
            "c": 0.6000000238418579,
            "d": "ICMP_ECHO constant",
            "e": [
              "ICMP_ECHO"
            ],
            "i": "objectives/command-and-control/trigger/activation::icmp-echo-const",
            "l": 3
          },
          {
            "c": 0.8999999761581421,
            "d": "Encoded payload detected: url",
            "e": [
              "\u003cbinary data\u003e \u003curl\u003e"
            ],
            "i": "metadata/encoded-payload/url",
            "l": 3
          }
        ],
        "sha": "1194e690dce470fa26e41d1285cc384066427890b61d8c0d6de1e3a28ce199f6",
        "path": "packet.c",
        "type": "c"
      }
    ],
    "tv": "46790"
  }
}