{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 0.9830508232116699,
        "class": 0
      }
    ],
    "prob": 0.9830508,
    "class": 0,
    "models": [
      {
        "m": "az",
        "prob": 0.8985075,
        "class": 0
      },
      {
        "m": "az/scripts",
        "prob": 0.6702871,
        "class": 0
      },
      {
        "m": "az/shell",
        "prob": 0.9830508,
        "class": 0
      }
    ],
    "version": "v16.16",
    "thresholds": [
      0.9983558,
      0.99991804
    ],
    "analyzed_at": "2026-05-19T10:50:19Z"
  },
  "path": "1fc688871b7dd21b9d3b70c7a9f06c52a47fb37c8629940274f4815e5707a172.sh",
  "raw": {
    "v": "4",
    "fs": [
      {
        "f": "H₂(FPo₂)",
        "k": {
          "source.imports[0]": "./dvrip3.sh",
          "source.imports[1]": "cd",
          "source.imports[2]": "chmod",
          "source.imports[3]": "mkdir",
          "source.imports[4]": "mount",
          "source.imports[5]": "sh",
          "source.has_imports": true
        },
        "x": 2,
        "id": 0,
        "is": [
          "cd",
          "cd",
          "cd",
          "cd",
          "mkdir",
          "mkdir",
          "mount",
          "mount",
          "cd",
          "cd",
          "sh",
          "sh",
          "chmod",
          "chmod",
          "./dvrip3.sh",
          "./dvrip3.sh"
        ],
        "ms": {
          "file": {
            "size": 172.0
          },
          "text": {
            "digit_ratio": 0.1,
            "space_count": 17.0,
            "total_lines": 1.0,
            "char_entropy": 4.77,
            "unique_chars": 34.0,
            "import_density": 1600.0,
            "avg_line_length": 172.0,
            "max_line_length": 172.0,
            "last_line_length": 172.0,
            "most_common_char": "r",
            "whitespace_ratio": 0.1,
            "most_common_ratio": 0.06,
            "normalized_import_count": 16.0,
            "max_inline_whitespace_run": 1.0
          },
          "imports": {
            "total": 16.0,
            "relative_ratio": 0.13,
            "unique_modules": 6.0,
            "relative_imports": 2.0,
            "third_party_count": 16.0,
            "third_party_ratio": 1.0
          },
          "strings": {},
          "comments": {},
          "functions": {},
          "identifiers": {}
        },
        "sz": 172,
        "ts": [
          {
            "c": 0.20000000298023224,
            "d": "tmp keyword",
            "e": [
              "tmp"
            ],
            "i": "micro-behaviors/data/text/keywords/lexicon::tmp",
            "l": 1
          },
          {
            "a": "T1543",
            "c": 0.8199999928474426,
            "d": "Launch helper used with /root binary",
            "e": [
              "exec "
            ],
            "i": "objectives/persistence/system/init/script::root-binary-launcher",
            "l": 1
          },
          {
            "a": "T1059.004",
            "c": 0.6000000238418579,
            "d": "./ execution pattern",
            "e": [
              ";./dvrip3.sh"
            ],
            "i": "objectives/command-and-control/dropper/execution/pipe::execute-dot-slash",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "Very short file (under 12 lines)",
            "e": [
              "text.total_lines = 1.00"
            ],
            "i": "metadata/file/text/metrics::file-under-12-lines",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "Invokes mkdir",
            "e": [
              "mkdir"
            ],
            "i": "micro-behaviors/process/create/tool::mkdir-invocation",
            "l": 1
          },
          {
            "c": 0.949999988079071,
            "d": "File is a one-liner",
            "e": [
              "text.total_lines = 1.00"
            ],
            "i": "metadata/file/text/metrics::file-one-liner",
            "l": 1
          },
          {
            "a": "T1059.004",
            "c": 0.699999988079071,
            "d": "Executes a shell script file (.sh)",
            "e": [
              " sh dvrip3.sh"
            ],
            "i": "micro-behaviors/process/create/script/file::shell-script-execution",
            "l": 3
          },
          {
            "c": 1.0,
            "d": "Executes a file from current directory",
            "e": [
              ";./dvrip3.sh"
            ],
            "i": "micro-behaviors/process/create/local-exec::local-execution",
            "l": 3
          },
          {
            "a": "T1059.004",
            "c": 0.699999988079071,
            "d": "Executes a relative shell script path (.sh)",
            "e": [
              ";./dvrip3.sh"
            ],
            "i": "micro-behaviors/process/create/script/file::shell-script-relative-execution",
            "l": 3
          },
          {
            "a": "T1222",
            "c": 0.75,
            "d": "chmod +x (make executable)",
            "e": [
              "chmod +x d"
            ],
            "i": "micro-behaviors/fs/chmod/executable/mode::shell-plus-x",
            "l": 3,
            "m": "E1222"
          },
          {
            "c": 0.800000011920929,
            "d": "High density of shell commands",
            "e": [
              "text.import_density = 1600.00"
            ],
            "i": "metadata/binary/metrics/text-density::shell-high-import-density",
            "l": 2
          },
          {
            "a": "T1059.004",
            "c": 0.8999999761581421,
            "d": "Multi-interpreter shell execution fallback",
            "e": [
              " sh dvrip3.sh",
              ";./dvrip3.sh"
            ],
            "i": "micro-behaviors/process/create/script/file::multi-interpreter-exec",
            "l": 3
          }
        ],
        "sha": "1fc688871b7dd21b9d3b70c7a9f06c52a47fb37c8629940274f4815e5707a172",
        "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/2026-02/1fc688871b7dd21b9d3b70c7a9f06c52a47fb37c8629940274f4815e5707a172.sh",
        "type": "shell"
      }
    ],
    "tv": "012f9"
  }
}