{ "ml": { "v": "7", "eng": "2.0.1-rc.1", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.00005236268, "rte": "az", "prob": 0.00005236268 }, { "cls": 0, "raw": 0.9022221, "rte": "az/source", "prob": 0.9022221 }, { "cls": 0, "raw": 0.9583954, "rte": "az/c", "prob": 0.9583954 } ], "prob": 0.00005236268, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.000052362680435180664, "type": "c" } ], "version": "v18.18", "analyzed_at": "2026-06-15T10:01:00Z" }, "path": "Uninstall.c", "raw": { "v": "7", "tv": "061e3", "files": [ { "id": 0, "ctx": [ { "a": 144, "b": "2$n-uvR/Q^l$G?IxhAR.C4\u003e=7xjSFui@", "l": 10 }, { "a": 170, "b": "", "l": 11 }, { "a": 171, "b": "2})}Ol$HgCBy=OpxK@rcByw/[AV!}rwN/\u003e8vpB4:ayPd#aARpdaAzysBzCPjavF)%cVZ)", "l": 12, "n": [ { "c": 3, "d": "Code explicitly mentions rootkit", "i": "objectives/evasion/kernel-hide/lkm/hiding::rootkit-mention-comment", "o": 172, "z": 54 } ] }, { "a": 227, "b": "2$NYTsS?G\u003eC@(", "l": 13 }, { "a": 238, "b": "329#]c@KR?pJf(.oj-xqCVMp:ogq#\u003coIX2woKyHWlR6^zmjYMPb2.obr98v-miTo9fF1ttmoJ$-oIw!VlQKpvqY{Dgogq#\u003cs5h)Qg*-c$ogq#masp(nC{%\u003e0jS)f\u003eqCQg$q=MgLmn)bl", "l": 14 }, { "a": 351, "b": "33#", "l": 15 }, { "a": 354, "b": "2)\u003cHvxgcrEwPRG:vqH6$s14\u0026}C}p7enKM0Op/o.KnMW9eb6d\u003cmxjV9cdlv", "l": 16, "n": [ { "c": 3, "d": "RegDeleteValueW registry value deletion", "i": "micro-behaviors/os/registry/manipulate::reg-delete-value-w-symbol", "o": 356, "z": 15 } ] }, { "a": 401, "b": "2)\u003cHvxgcrEwPRG:vqH6$s14\u0026}C}p7enKM0Op/o.KnMW9eb4LIagCQd6i@", "l": 17 }, { "a": 447, "b": "2)\u003cHvxgcrEwPRG:vqH6$s14\u0026}C}p7enKM0Op/o.KnMW9eb4LIahz=Qbi@", "l": 18 } ], "mol": "O(Er)H(Os)", "sha": "283317fce27ff693bfcb306442086145778813133d53d5e9b853c0c8b895e3b9", "fact": { "id": "c", "imp": [ [ "", "EnabledDebugPrivilege" ], [ "", "RegOpenKeyExW" ], [ "", "RegDeleteValueW" ], [ "", "RegDeleteValueW" ], [ "", "RegDeleteValueW" ], [ "", "DeleteWindowsService" ], [ "", "Is64BitOperatingSystem" ], [ "", "GetResource" ], [ "", "CreateTempFile" ], [ "", "ExecuteFile" ], [ "", "DetachR77Service" ], [ "", "DetachAllInjectedProcesses" ], [ "", "UninstallR77Config" ], [ "", "r77config.h" ], [ "", "r77def.h" ], [ "", "r77process.h" ], [ "", "r77win.h" ], [ "", "resource.h" ] ], "met": { "ast": { "op.eq": 1.0, "op.add": 1.0, "op.bor": 1.0, "op.band": 3.0, "max_depth": 12.0, "call_count": 13.0, "node_count": 269.0, "op_density.eq": 0.0, "op_density.add": 0.0, "op_density.bor": 0.0, "op_density.band": 0.01, "identifier_count": 29.0, "string_literal_count": 11.0, "string_concat_chain_max_length": 2.0 }, "file": { "size": 1282.0, "entropy": 5.52, "size_bytes": 1282.0 }, "text": { "tab_count": 59.0, "digit_ratio": 0.06, "space_count": 83.0, "total_lines": 52.0, "char_entropy": 5.52, "unique_chars": 79.0, "string_density": 0.21, "avg_line_length": 23.67, "max_line_length": 112.0, "empty_line_ratio": 0.15, "last_line_length": 1.0, "whitespace_ratio": 0.15, "most_common_ratio": 0.09, "identifier_density": 0.83, "line_length_stddev": 26.77, "normalized_string_count": 1.53, "suspicious_string_ratio": 0.09, "most_common_char_is_null": 0.0, "suspicious_comment_ratio": 0.17, "max_inline_whitespace_run": 1.0, "most_common_char_codepoint": 101.0, "suspicious_identifier_ratio": 0.17, "normalized_unique_identifiers": 5.09 }, "calls": { "count": 13.0 }, "binary": { "overall_entropy": 5.52 }, "source": { "function_count": 1.0 }, "imports": { "count": 5.0, "unique_modules": 5.0, "third_party_count": 5.0, "third_party_ratio": 1.0 }, "strings": { "total": 11.0, "avg_length": 8.55, "max_length": 12.0, "avg_entropy": 2.62, "total_bytes": 94.0, "entropy_stddev": 0.66, "embedded_code_candidates": 1.0 }, "comments": { "chars": 332.0, "lines": 6.0, "total": 6.0, "to_code_ratio": 0.13, "high_entropy_comments": 1.0 }, "functions": { "count": 1.0 }, "identifiers": { "count": 29.0, "total": 43.0, "avg_length": 13.0, "max_length": 26.0, "min_length": 3.0, "avg_entropy": 3.04, "reuse_ratio": 0.67, "unique_count": 29.0, "length_stddev": 5.68, "has_digit_ratio": 0.31, "base64_like_names": 5.0, "high_entropy_count": 8.0, "high_entropy_ratio": 0.28, "all_lowercase_ratio": 0.07, "all_uppercase_ratio": 0.34, "numeric_suffix_count": 2.0 } }, "str": [ [ 30, "u8", "resource.h" ], [ 31, "u8", "resource.h" ], [ 52, "u8", "r77def.h" ], [ 53, "u8", "r77def.h" ], [ 72, "u8", "r77win.h" ], [ 73, "u8", "r77win.h" ], [ 92, "u8", "r77config.h" ], [ 93, "u8", "r77config.h" ], [ 115, "u8", "r77process.h" ], [ 116, "u8", "r77process.h" ], [ 277, "u8", "L\"SOFTWARE" ], [ 279, "u8", "SOFTWARE" ], [ 290, "10", "0" ], [ 377, "u8", "HIDE_PREFIX L\"stager" ], [ 389, "u8", "L\"stager" ], [ 391, "u8", "stager" ], [ 424, "u8", "HIDE_PREFIX L\"dll32" ], [ 436, "u8", "L\"dll32" ], [ 438, "u8", "dll32" ], [ 470, "u8", "HIDE_PREFIX L\"dll64" ], [ 482, "u8", "L\"dll64" ], [ 484, "u8", "dll64" ], [ 827, "u8", "EXE" ], [ 828, "u8", "EXE" ], [ 907, "10", "1" ], [ 963, "u8", "L\"exe" ], [ 965, "u8", "exe" ], [ 1278, "10", "0" ] ], "tgt": [ "CreateTempFile", "DeleteWindowsService", "DetachAllInjectedProcesses", "DetachR77Service", "EnabledDebugPrivilege", "ExecuteFile", "GetResource", "Is64BitOperatingSystem", "RegDeleteValueW", "RegOpenKeyExW", "UninstallR77Config" ], "val": { "file.stem": "Uninstall", "file.basename": "Uninstall.c", "source.language": "c", "source.imports[0]": "CreateTempFile", "source.imports[1]": "DeleteWindowsService", "source.imports[2]": "DetachAllInjectedProcesses", "source.imports[3]": "DetachR77Service", "source.imports[4]": "EnabledDebugPrivilege", "source.imports[5]": "ExecuteFile", "source.imports[6]": "GetResource", "source.imports[7]": "Is64BitOperatingSystem", "source.imports[8]": "RegDeleteValueW", "source.imports[9]": "RegOpenKeyExW", "source.strings[0]": "HIDE_PREFIX L\"dll32", "source.strings[1]": "HIDE_PREFIX L\"dll64", "source.strings[2]": "HIDE_PREFIX L\"stager", "source.strings[3]": "L\"SOFTWARE", "source.strings[4]": "L\"dll32", "source.strings[5]": "L\"dll64", "source.strings[6]": "L\"stager", "source.strings[7]": "SOFTWARE", "source.strings[8]": "r77config.h", "source.strings[9]": "r77def.h", "source.has_imports": true, "source.imports[10]": "UninstallR77Config", "source.imports[11]": "r77config.h", "source.imports[12]": "r77def.h", "source.imports[13]": "r77process.h", "source.imports[14]": "r77win.h", "source.imports[15]": "resource.h", "source.strings[10]": "r77process.h", "source.strings[11]": "r77win.h", "source.strings[12]": "resource.h", "source.strings[13]": "stager", "source.functions[0]": "main()" } }, "find": [ { "id": "objectives/evasion/kernel-hide/lkm/hiding::rootkit-mention-comment", "conf": 1.0, "crit": 3, "desc": "Code explicitly mentions rootkit" }, { "id": "micro-behaviors/os/registry/manipulate::reg-delete-value-w-symbol", "atk": "T1112", "conf": 0.8799999952316284, "crit": 3, "desc": "RegDeleteValueW registry value deletion" } ], "path": "/data/samples/bad/projects/r77-rootkit/Uninstall/Uninstall.c", "risk": 2, "size": 1282, "type": "c" } ] } }