{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9171918034553528, "class": 0 } ], "prob": 0.9171918, "class": 0, "version": "v16.16", "thresholds": [ 0.9815004, 0.99404883 ], "analyzed_at": "2026-04-30T05:24:57Z" }, "path": "embedder.h", "raw": { "v": "4", "fs": [ { "f": "O₂(CoEr)", "x": 1, "id": 0, "is": [ "FlutterEngineFlushPendingTasksNow", "FlutterEngineGetProcAddresses" ], "ms": { "text": { "digit_ratio": 0.01, "space_count": 29691.0, "total_lines": 3814.0, "char_entropy": 4.76, "unique_chars": 94.0, "import_density": 0.05, "string_density": 0.0, "ascii_art_lines": 39.0, "avg_line_length": 43.16, "high_byte_ratio": 0.0, "max_line_length": 112.0, "non_ascii_ratio": 0.0, "empty_line_ratio": 0.07, "last_line_length": 54.0, "long_token_count": 1.0, "most_common_char": "e", "whitespace_ratio": 0.2, "most_common_ratio": 0.09, "identifier_density": 0.14, "line_length_stddev": 27.03, "normalized_import_count": 0.03, "normalized_string_count": 0.08, "repeated_char_sequences": 369.0, "suspicious_comment_ratio": 0.07, "max_inline_whitespace_run": 38.0, "suspicious_identifier_ratio": 0.05, "normalized_unique_identifiers": 22.69 }, "imports": { "total": 2.0, "unique_modules": 2.0, "third_party_count": 2.0, "third_party_ratio": 1.0 }, "strings": { "total": 5.0, "avg_length": 6.6, "max_length": 11.0, "avg_entropy": 1.9, "total_bytes": 33.0, "entropy_stddev": 1.56 }, "comments": { "chars": 112262.0, "lines": 2267.0, "total": 2280.0, "to_code_ratio": 1.47, "empty_comments": 13.0, "url_in_comments": 10.0, "base64_in_comments": 152.0, "high_entropy_comments": 14.0 }, "functions": {}, "identifiers": { "total": 529.0, "avg_length": 24.79, "max_length": 52.0, "min_length": 1.0, "avg_entropy": 3.51, "reuse_ratio": 0.51, "unique_count": 270.0, "length_stddev": 13.02, "has_digit_ratio": 0.05, "sequential_names": 2.0, "base64_like_names": 12.0, "single_char_count": 2.0, "single_char_ratio": 0.01, "high_entropy_count": 182.0, "high_entropy_ratio": 0.67, "all_lowercase_ratio": 0.2, "all_uppercase_ratio": 0.03, "numeric_suffix_count": 10.0, "underscore_prefix_count": 2.0 } }, "ss": [ [ 279, "\u003cstdbool.h\u003e" ], [ 300, "\u003cstddef.h\u003e" ], [ 320, "\u003cstdint.h\u003e" ], [ 2522, "C" ], [ 2523, "C" ], [ 5791, "xor", "(PfQUETYNe" ], [ 19987, "xor", "UPfRKTALRcNW" ], [ 20569, "xor", "?arXA@XoxeNHFAE" ], [ 23258, "xor", "\tAfFZX~EReNGINEaotdATAsOURCE" ], [ 25551, "xor", "\tAfFZX~EReNGINEaotdATAsOURCE" ], [ 25633, "xor", "Q*fLUTTEReNGINEaotdATAsOURCE" ], [ 25698, "xor", "\tE5L_[XoReNGINEaotdATAsOURCE" ], [ 25906, "xor", "\tAfFZX~EReNGINEaotdATAsOURCE" ], [ 25982, "xor", "Q*fLUTTEReNGINEaotdATAsOURCE" ], [ 26034, "xor", "\tHfFZX~EReNGINEaotdATAsOURCE" ], [ 26097, "xor", "Q*fLUTTEReNGINEaotdATAsOURCE" ], [ 31181, "xor", "\tH#fUT[J]eNGINEaotdATAsOUR" ], [ 31339, "xor", "\tOLLU[[JReNGINEaotdATAsOU" ], [ 31414, "xor", "\tR'fUT[J]eNGINEaotdATAsOUR" ], [ 31494, "xor", "\tELLU[[JReNGINEaotdATAsOU" ], [ 60287, "xor", "Q*fLUTTEReNGINEaotdATAsOURCE" ], [ 61352, "xor", "\tAfFZX~EReNGINEaotdATAsOURCE" ], [ 61412, "xor", "Q*fLUTTEReNGINEaotdATAsOURCE" ], [ 74006, "xor", "\tOLCZ[TEReNGINEaotdATAs" ], [ 74163, "xor", "\tOLCZ[TEReNGINEaotdATAs" ], [ 92548, "xor", "Q*fLUTTEReNGINEaotdATAsOURCE" ], [ 92614, "xor", "Q*fLUTTEReNGINEaotdATAsOURCE" ], [ 100466, "xor", "\tH#fUT[J]eNGINEaotdATAsOUR" ], [ 100701, "xor", "\tH#fUT[J]eNGINEaotdATAsOUR" ], [ 103203, "xor", "\tY6\tY~TEReNGINEaotdATAsOURCE" ], [ 104108, "xor", "\tA!L_[XoReNGINEaotdATAsOURCE" ], [ 104183, "xor", "Q*fLUTTEReNGINEaotdATAsOURCE" ], [ 105188, "xor", "\tSLLU[[JReNGINEaotdATAsOU" ], [ 105260, "xor", "?iLLU[[JReNGINEaotdATAsOU" ], [ 105745, "xor", "\tSLLU[[JReNGINEaotdATAsO" ], [ 105816, "xor", "?iLLU[[JReNGINEaotdATAsO" ], [ 106623, "xor", "\tH#fUT[J]eNGINEaotdATAsOU" ], [ 110275, "xor", "Q*fLZ[[EReNGINEaotdATAs" ], [ 110451, "xor", "S*fLZ[[oReAHFNEaotdATAsOURCE" ], [ 111392, "xor", "Q*fLZ[[EReNGINEaotdATAs" ], [ 111568, "xor", "S*fLZ[[oReAHFNEaotdATAsOURCE" ], [ 116462, "xor", "RC'ZAAD\\CuV" ], [ 119529, "xor", "Q*fLZ[[EReNGINEaotdATAs" ], [ 119703, "xor", "S*fLZ[[oReAHFNEaotdATAsOURCE" ], [ 124609, "xor", "]B#fZ[[EReNGINEaotdATAsOURCE" ], [ 124846, "xor", "]I(fZ[[EReNGINEaotdATAsOURCE" ], [ 125104, "xor", "Q*fLUTTEReNGINEaotdATAsOURCE" ], [ 125178, "xor", "Q*fLUTTEReNGINEaotdATAsOURCE" ], [ 125247, "xor", "Q*fLUTTEReNGINEaotdATAsOURCE" ], [ 125299, "xor", "\tAjfUTTEReNGINEaotdATAsOURCE" ], [ 125374, "xor", "W*fLUTTEReNGINEaotdATAsOURCE" ], [ 126148, "xor", "T*fLUTTEReNGINEaotdATAsOURCE" ], [ 126875, "xor", "]B#fZ[[EReNGINEaotdATAsOURCE" ], [ 127112, "xor", "]I(fZ[[EReNGINEaotdATAsOURCE" ], [ 127384, "xor", "Q*fLUTTEReNGINEaotdATAsOURCE" ], [ 127465, "xor", "Q*fLUTTEReNGINEaotdATAsOURCE" ], [ 127541, "xor", "Q*fLUTTEReNGINEaotdATAsOURCE" ], [ 127600, "xor", "\tAjfUTTEReNGINEaotdATAsOURCE" ], [ 127682, "xor", "W*fLUTTEReNGINEaotdATAsOURCE" ], [ 128439, "xor", "T*fLUTTEReNGINEaotdATAsOURCE" ], [ 128799, "xor", "Q*iCZTTEReNGINEaot'" ], [ 129365, "xor", "S*iCZ~[J]eNGINEaotdATA" ], [ 129659, "xor", "S*iCZ~[J]eNGINEaotdATA" ], [ 129727, "xor", "S*iCZ~[J]eNGINEaotdATA" ], [ 129863, "xor", "S*iCZ~[J]eNGINEaotdATA" ], [ 130283, "xor", "\tE\"fZ[[EReNGINEaotdATAsOURCET" ], [ 130644, "xor", "T*fLUTTEReNGINEaotdATAsOURCE" ], [ 130697, "xor", "Q*fLUTTEReNGINEaotdATAsOURCE" ], [ 130885, "xor", "S*iCZ~[J]eNGINEaotdATA" ], [ 131089, "xor", "\tR3\t[~[J]OAHFNEaotdATAsOUR7" ], [ 131229, "xor", "S*iCZ~[J]eNGINEaotdATA" ], [ 131657, "xor", "\tE\"fZ[[EReNGINEaotdATAsOURCET" ], [ 132030, "xor", "T*fLUTTEReNGINEaotdATAsOURCE" ], [ 132086, "xor", "Q*fLUTTEReNGINEaotdATAsOURCE" ], [ 133503, "xor", "]N)fZ[[EReNGINEaotdATAsOURCE" ], [ 133648, "xor", "\tH#fZ[[EReNGINEaotdATAsOURCE" ], [ 133722, "xor", "]I2fZ[[EReNGINEaotdATAsOURCE" ], [ 133867, "xor", ")H#fZ[[EReNGINEaotdATAsOURCE" ], [ 133949, "xor", "S*iCZTTEReNGINEaotdATAsOURCE" ], [ 134140, "xor", "T*fLUTTEReNGINEaotdATAsOURCE" ], [ 134198, "xor", "Q*fLUTTEReNGINEaotdATAsOURCE" ], [ 134274, "xor", "Q*fLUTTEReNGINEaotdATAsOURCE" ], [ 134354, "xor", "Q*fLUTTEReNGINEaotdATAsOURCE" ], [ 134812, "xor", "S*iCZTTEReNGINEao" ], [ 134952, "xor", "R*iCZTTEReNGINEao" ], [ 135482, "xor", "R*iCZTTEReNGINEao" ], [ 135817, "xor", "\tH#fZ[[EReNGINEaotdATAsOURCE" ], [ 135891, "xor", "\tH#fZ[[EReNGINEaotdATAsOURCE" ], [ 136087, "xor", "]I5fZ[[EReNGINEaotdATAsOURCE" ], [ 136816, "xor", "S*iCZTTEReNGINEaotdATAsOURCE" ], [ 138327, "xor", "S*iCZTTEReNGINEaot" ], [ 138849, "xor", "T*iCZTTEReNGINEaot-" ], [ 139458, "xor", "\tE4fZ[[EReNGINEaotdATAsOURCE" ], [ 141535, "xor", "\tH#fZ[[EReNGINEaotdATAsOURCE" ], [ 141586, "xor", "\tH#fZ[[EReNGINEaotdATAsOURCE" ], [ 141661, "xor", "]T)fZ[[EReNGINEaotdATAsOURCE" ], [ 141720, "xor", "]I(fZ[[EReNGINEaotdATAsOURCE" ], [ 143561, "xor", "\tShfZ[[EReNGINEaotdATAsOURCEo" ], [ 144524, "xor", "\tO(LUTTEReNGINEaotdATAs;" ], [ 145096, "xor", "S*iCZTTEReNGINEaotdATAsOURCE" ], [ 145169, "xor", "]T)fZ[[EReNGINEaotdATAsOURCE" ], [ 145249, "xor", "]I(fZ[[EReNGINEaotdATAsOURCE" ], [ 145400, "xor", ";O4fZ[[EReNGINEaotdATAsOURCE" ], [ 145749, "xor", "T*fLUTTEReNGINEaotdATAsOURCE" ], [ 145802, "xor", "Q*fLUTTEReNGINEaotdATAsOURCE" ], [ 145859, "xor", "Q*fLUTTEReNGINEaotdATAsOURCE" ], [ 145933, "xor", "Q*fLUTTEReNGINEaotdATAsOURCE" ], [ 149871, "xor", "S*iCZTTEReNGINEaot" ], [ 150184, "xor", "T*fLUTTEReNGINEaotdATAsOURCE" ], [ 150237, "xor", "Q*fLUTTEReNGINEaotdATAsOURCE" ], [ 151004, "xor", "T*fLUTTEReNGINEaotdATAsOURCE" ], [ 151063, "xor", "Q*fLUTTEReNGINEaotdATAsOURCE" ], [ 151141, "xor", "Q*fLUTTEReNGINEaotdATAsOURCE" ], [ 151438, "xor", "S*iCZ~[J]eNGINEaotdATA" ], [ 151970, "xor", "Q*iCZTTEReNGINEaot$" ], [ 152776, "xor", "S*iCZ~[J]eNGINEaotdATA" ], [ 153071, "xor", "S*iCZ~[J]eNGINEaotdATA" ], [ 153510, "xor", "\tH#fZ[[EReNGINEaotdATAsOURCE" ], [ 153981, "xor", "S*iCZTTEReNGINEaot" ], [ 154328, "xor", "S*iCZ~[J]eNGINEaotdATA" ], [ 154953, "xor", "S*iCZTTEReNGINEaot" ], [ 156411, "xor", "]O(fZ[[EReNGINEaotdATAsOURCE" ], [ 157971, "xor", "T*fLUTTEReNGINEaotdATAsOURCE" ], [ 158193, "xor", "S*iCZTTEReNGINEaot" ], [ 168034, "xor", "]B#fZ[[EReNGINEaotdATAsOURCEA" ] ], "sz": 168433, "ts": [ { "c": 0.20000000298023224, "d": "command keyword", "e": [ "command" ], "i": "micro-behaviors/data/text/keywords::command-dup", "l": 1 }, { "c": 0.699999988079071, "d": "macOS who tool reference", "e": [ "who" ], "i": "objectives/evasion/kernel-hide/rootkit::macos-who-ref", "l": 1 }, { "a": "T1056.001", "c": 0.699999988079071, "d": "key down phrase (lowercase)", "e": [ "key down" ], "i": "objectives/collection/keylog/capture::key-down-lower", "l": 3, "m": "B0015" } ], "sha": "166626fb689d4e77e720c925f18e814a3cd55280999a443d9d1cc244384e37af", "path": "/data/samples/good/repos/flutter/engine/src/flutter/shell/platform/embedder/embedder.h", "type": "c" } ], "tv": "f6eaa" } }