{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 0.2200779914855957,
        "class": 0
      }
    ],
    "prob": 0.22007799,
    "skip": [
      {
        "m": "az/c",
        "why": "uncalibrated"
      }
    ],
    "class": 0,
    "models": [
      {
        "m": "az",
        "prob": 0.22007799,
        "class": 0
      },
      {
        "m": "az/source",
        "prob": 0.03591208,
        "class": 0
      }
    ],
    "version": "v16.16",
    "thresholds": [
      0.9961138,
      0.99909174
    ],
    "analyzed_at": "2026-05-09T23:20:31Z"
  },
  "path": "whoami.cpp",
  "raw": {
    "v": "4",
    "fs": [
      {
        "f": "O(Er)H(Db₂)",
        "k": {
          "source.imports[0]": "ComputerNameGet",
          "source.imports[1]": "NtCurrentProcess",
          "source.imports[2]": "PrivilegeCheck",
          "source.imports[3]": "UserNameGet",
          "source.imports[4]": "pState.pProcs.lpGetLastError",
          "source.imports[5]": "pState.pProcs.lpGetTokenInformation",
          "source.imports[6]": "pState.pProcs.lpGlobalAlloc",
          "source.imports[7]": "pState.pProcs.lpGlobalFree",
          "source.imports[8]": "pState.pProcs.lpLookupPrivilegeNameW",
          "source.imports[9]": "pState.pProcs.lpOpenProcessToken",
          "source.strings[0]": "\u0026df(]UserNamepMo40knlif}",
          "source.strings[1]": "'ot(]UserNamepMo20knlif}",
          "source.strings[2]": ",*.GwUserNamepMoiAAnlif}",
          "source.strings[3]": ",of(]UserNamepMo \\kfm9",
          "source.strings[4]": ",ot(]UserNamepMo20knlif}",
          "source.strings[5]": ":of(]UserNam,6Mg\u003ey$#\u003c\u003c28P3",
          "source.strings[6]": "@]*\"WuSERnAMJ",
          "source.strings[7]": "Error: Failed to get the computer name.",
          "source.strings[8]": "Error: Failed to get the username.",
          "source.strings[9]": "Error: Failed to get token information.",
          "source.has_imports": true,
          "source.imports[10]": "wstring",
          "source.strings[10]": "Error: Failed to lookup privilege name.",
          "source.strings[11]": "Error: Failed to open process token.",
          "source.strings[12]": "I(ud;nyERnAME",
          "source.strings[13]": "IF[\"WuSERnAM",
          "source.strings[14]": "IF[\"WuSERnAME",
          "source.strings[15]": "IF[\"WuSERnAMJ",
          "source.strings[16]": "IF]\"WuSERnAME",
          "source.strings[17]": "IF]\"WuSERnAMo",
          "source.strings[18]": "IF]\"}uSERnAME",
          "source.strings[19]": "IF]\"}uSERnAMEI[",
          "source.strings[20]": "IF]\"}uSERnAMEPmOI:KNL",
          "source.strings[21]": "IF]\"}uSERnAMERXIU\u003eL",
          "source.strings[22]": "IF]\"}uSERnAMESIY",
          "source.strings[23]": "L\"Error: Failed to get the computer name.",
          "source.strings[24]": "L\"Error: Failed to get the username.",
          "source.strings[25]": "L\"Error: Failed to get token information.",
          "source.strings[26]": "L\"Error: Failed to lookup privilege name.",
          "source.strings[27]": "L\"Error: Failed to open process token.",
          "source.strings[28]": "core/task.hpp",
          "source.strings[29]": "gdf(]UserNam8ZMoi",
          "source.strings[30]": "gdf(]UserNam8Zgoi",
          "source.strings[31]": "gdf(]UserNamepMo40knlif}",
          "source.strings[32]": "gdf(]UserNamepMoi",
          "source.strings[33]": "if (wUserAnm",
          "source.strings[34]": "if (wUserNamepMoiS-nd",
          "source.strings[35]": "if\u0026(]UserNamepMo9i?/8,kcR-",
          "source.strings[36]": "if\u0026(]UserNamepMo;_?;\u003e'f",
          "source.strings[37]": "if}(]UserNam75",
          "source.strings[38]": "if}YwUserName",
          "source.strings[39]": "if}YwUserName#",
          "source.strings[40]": "if}YwUserNamepMoi",
          "source.strings[41]": "if}YwUserNamepMoiS-nd9",
          "source.strings[42]": "if}YwUserNamepMoiv",
          "source.strings[43]": "ivf(wUserName",
          "source.strings[44]": "ivf(wUserName#",
          "source.strings[45]": "Ԕ\u0014R\u0002 CS",
          "source.functions[0]": "Task"
        },
        "id": 0,
        "is": [
          "ComputerNameGet",
          "UserNameGet",
          "pState.pProcs.lpOpenProcessToken",
          "NtCurrentProcess",
          "pState.pProcs.lpGetTokenInformation",
          "pState.pProcs.lpGetLastError",
          "pState.pProcs.lpGlobalAlloc",
          "pState.pProcs.lpGetTokenInformation",
          "pState.pProcs.lpLookupPrivilegeNameW",
          "PrivilegeCheck",
          "wstring",
          "pState.pProcs.lpGlobalFree"
        ],
        "ms": {
          "file": {
            "size": 2642.0
          },
          "text": {
            "digit_ratio": 0.0,
            "space_count": 808.0,
            "total_lines": 90.0,
            "char_entropy": 4.62,
            "unique_chars": 74.0,
            "import_density": 13.33,
            "string_density": 0.27,
            "avg_line_length": 28.37,
            "max_line_length": 106.0,
            "empty_line_ratio": 0.19,
            "last_line_length": 1.0,
            "most_common_char": "e",
            "whitespace_ratio": 0.34,
            "most_common_ratio": 0.06,
            "identifier_density": 0.87,
            "line_length_stddev": 28.4,
            "normalized_import_count": 1.26,
            "normalized_string_count": 2.53,
            "repeated_char_sequences": 25.0,
            "max_inline_whitespace_run": 1.0,
            "normalized_function_count": 0.11,
            "trailing_whitespace_lines": 1.0,
            "imports_to_functions_ratio": 12.0,
            "strings_to_functions_ratio": 24.0,
            "suspicious_identifier_ratio": 0.03,
            "normalized_unique_identifiers": 4.47,
            "identifiers_to_functions_ratio": 29.0
          },
          "imports": {
            "total": 12.0,
            "unique_modules": 11.0,
            "third_party_count": 12.0,
            "third_party_ratio": 1.0
          },
          "strings": {
            "total": 24.0,
            "avg_length": 21.33,
            "max_length": 41.0,
            "avg_entropy": 2.63,
            "total_bytes": 512.0,
            "entropy_stddev": 1.62
          },
          "comments": {
            "chars": 164.0,
            "lines": 4.0,
            "total": 4.0,
            "to_code_ratio": 0.05
          },
          "functions": {
            "total": 1.0,
            "avg_name_length": 4.0,
            "no_params_count": 1.0,
            "avg_length_lines": 88.0,
            "max_length_lines": 88.0,
            "min_length_lines": 88.0,
            "density_per_100_lines": 1.11,
            "code_in_functions_ratio": 0.98
          },
          "identifiers": {
            "total": 78.0,
            "avg_length": 8.97,
            "max_length": 25.0,
            "min_length": 1.0,
            "avg_entropy": 2.68,
            "reuse_ratio": 0.37,
            "unique_count": 29.0,
            "length_stddev": 5.05,
            "sequential_names": 1.0,
            "single_char_count": 1.0,
            "single_char_ratio": 0.03,
            "high_entropy_count": 1.0,
            "high_entropy_ratio": 0.03,
            "all_lowercase_ratio": 0.17,
            "all_uppercase_ratio": 0.14
          }
        },
        "ss": [
          [
            9,
            "core/task.hpp"
          ],
          [
            10,
            "core/task.hpp"
          ],
          [
            208,
            "L"
          ],
          [
            242,
            "L\"Error: Failed to get the computer name."
          ],
          [
            244,
            "Error: Failed to get the computer name."
          ],
          [
            398,
            "L"
          ],
          [
            432,
            "L\"Error: Failed to get the username."
          ],
          [
            434,
            "Error: Failed to get the username."
          ],
          [
            521,
            "L\"\\\\"
          ],
          [
            857,
            "L\"Error: Failed to open process token."
          ],
          [
            859,
            "Error: Failed to open process token."
          ],
          [
            1256,
            "L\"Error: Failed to get token information."
          ],
          [
            1258,
            "Error: Failed to get token information."
          ],
          [
            1595,
            "L\"Error: Failed to get token information."
          ],
          [
            1597,
            "Error: Failed to get token information."
          ],
          [
            2135,
            "L\"Error: Failed to lookup privilege name."
          ],
          [
            2137,
            "Error: Failed to lookup privilege name."
          ],
          [
            2335,
            "L\"o"
          ],
          [
            2337,
            "o"
          ],
          [
            2410,
            "L\"x"
          ],
          [
            2412,
            "x"
          ],
          [
            2461,
            "L\" "
          ],
          [
            2463,
            " "
          ],
          [
            2493,
            "L\"\\n"
          ],
          [
            90,
            "xor",
            "if}YwUserName#"
          ],
          [
            91,
            "xor",
            "IF[\"WuSERnAM"
          ],
          [
            175,
            "xor",
            ":of(]UserNam,6Mg\u003ey$#\u003c\u003c28P3"
          ],
          [
            219,
            "xor",
            "if\u0026(]UserNamepMo;_?;\u003e'f"
          ],
          [
            282,
            "xor",
            "gdf(]UserNam8Zgoi"
          ],
          [
            292,
            "xor",
            "IF]\"}uSERnAMESIY"
          ],
          [
            409,
            "xor",
            "if\u0026(]UserNamepMo;_?;\u003e'f"
          ],
          [
            467,
            "xor",
            "gdf(]UserNam8ZMoi"
          ],
          [
            477,
            "xor",
            "IF]\"WuSERnAMo"
          ],
          [
            486,
            "xor",
            "if}(]UserNam75"
          ],
          [
            542,
            "xor",
            "if (wUserAnm"
          ],
          [
            660,
            "xor",
            "if}YwUserName"
          ],
          [
            661,
            "xor",
            "IF[\"WuSERnAMJ"
          ],
          [
            834,
            "xor",
            "if\u0026(]UserNamepMo;_?;\u003e'f"
          ],
          [
            894,
            "xor",
            "gdf(]UserNam8Zgoi"
          ],
          [
            948,
            "xor",
            "I(ud;nyERnAME"
          ],
          [
            977,
            "xor",
            "ivf(wUserName"
          ],
          [
            1135,
            "xor",
            "if}YwUserNamepMoiS-nd9"
          ],
          [
            1136,
            "xor",
            "IF[\"WuSERnAME"
          ],
          [
            1140,
            "base64",
            "Ԕ\u0014R\u0002 CS"
          ],
          [
            1228,
            "xor",
            "if}YwUserNamepMoi"
          ],
          [
            1229,
            "xor",
            "IF[\"WuSERnAME"
          ],
          [
            1296,
            "xor",
            "gdf(]UserNamepMo40knlif}"
          ],
          [
            1320,
            "xor",
            "IF]\"}uSERnAMEPmOI:KNL"
          ],
          [
            1409,
            "xor",
            "@]*\"WuSERnAMJ"
          ],
          [
            1572,
            "xor",
            "if\u0026(]UserNamepMo;_?;\u003e'f"
          ],
          [
            1635,
            "xor",
            "gdf(]UserNam8Zgoi"
          ],
          [
            1761,
            "xor",
            "ivf(wUserName#"
          ],
          [
            1893,
            "xor",
            "if}YwUserNamepMoiv"
          ],
          [
            1894,
            "xor",
            "IF[\"WuSERnAME"
          ],
          [
            1998,
            "xor",
            ",of(]UserNamepMo \\kfm9"
          ],
          [
            2094,
            "xor",
            "'ot(]UserNamepMo20knlif}"
          ],
          [
            2108,
            "xor",
            "IF[\"WuSERnAME"
          ],
          [
            2175,
            "xor",
            "gdf(]UserNamepMoi"
          ],
          [
            2212,
            "xor",
            "if (wUserNamepMoiS-nd"
          ],
          [
            2293,
            "xor",
            ",ot(]UserNamepMo20knlif}"
          ],
          [
            2307,
            "xor",
            "IF[\"WuSERnAME"
          ],
          [
            2337,
            "xor",
            "\u0026df(]UserNamepMo40knlif}"
          ],
          [
            2351,
            "xor",
            "IF]\"WuSERnAME"
          ],
          [
            2367,
            "xor",
            ",*.GwUserNamepMoiAAnlif}"
          ],
          [
            2382,
            "xor",
            "IF[\"WuSERnAME"
          ],
          [
            2426,
            "xor",
            "IF]\"}uSERnAME"
          ],
          [
            2506,
            "xor",
            "IF]\"}uSERnAMEI["
          ],
          [
            2542,
            "xor",
            "if\u0026(]UserNamepMo9i?/8,kcR-"
          ],
          [
            2607,
            "xor",
            "IF]\"}uSERnAMERXIU\u003eL"
          ]
        ],
        "sz": 2642,
        "ts": [
          {
            "c": 0.8399999737739563,
            "d": "password/token/api_key field keyword",
            "e": [
              "token"
            ],
            "i": "micro-behaviors/data/text/keywords/credential::credential-field",
            "l": 1
          },
          {
            "c": 0.30000001192092896,
            "d": "token keyword",
            "e": [
              "token"
            ],
            "i": "micro-behaviors/data/text/keywords/lexicon::token",
            "l": 1
          },
          {
            "c": 0.44999998807907104,
            "d": "TOKEN credential label",
            "e": [
              "TOKEN"
            ],
            "i": "micro-behaviors/data/text/keywords/credential::token-upper",
            "l": 1
          },
          {
            "c": 0.9200000166893005,
            "d": "Regex component marker",
            "e": [
              "access"
            ],
            "i": "objectives/evasion/kernel-hide/userspace::preload-rootkit-hook-set--rx-5",
            "l": 1
          },
          {
            "c": 0.8199999928474426,
            "d": "LLM access token target",
            "e": [
              "access token"
            ],
            "i": "micro-behaviors/data/text/llm/target::llm-secret-target-token",
            "l": 1
          }
        ],
        "sha": "1d3fb698f52a94be40524091f9edb582f50934ffafda5ea9190aa144e5ddb7bb",
        "path": "/data/samples/bad/projects/cross-platform/backdoor/hermit/payload/win/implant/src/core/task/whoami.cpp",
        "type": "c"
      }
    ],
    "tv": "87c42"
  }
}