{ "ml": { "v": "7", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.000028570494, "rte": "az", "prob": 0.000028570494 }, { "cls": 0, "raw": 0.000014990568, "rte": "az/source", "prob": 0.000014990568 }, { "cls": 0, "raw": 0.000000029802322, "rte": "az/rust", "prob": 0.000000029802322 } ], "prob": 0.000028570494, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.00002857049366866704 } ], "version": "v18.18", "analyzed_at": "2026-06-12T15:59:31Z" }, "path": "hells_gate.rs", "raw": { "v": "7", "tv": "e31a3", "files": [ { "id": 0, "ctx": [ { "a": 0, "b": "fe1E\u003enm=QNcVZz2vru66\u0026^^mownc6}v@@\u0026mD2)F7y?$kiB.$P0AV==eq+!+:A+frgy\u0026%\u0026lz/cXfA=k!qzGGA9y-)!vBZ/zA", "l": 1, "n": [ { "c": 1, "d": "Validation vocabulary number", "i": "metadata/file/text/format::vocab-number", "o": 35, "z": 6 } ] }, { "a": 77, "b": "fe1E", "l": 2 }, { "a": 81, "b": "fe1E\u003ebo[s4z*9srBrC^CA+/Z", "l": 3 }, { "a": 1658, "b": "fe1E", "l": 43 }, { "a": 1662, "b": "fe1E\u003es7#+\u0026x(k53nLIGvmpeF=p!%$*uQNE-mmg3IqDWx*", "l": 44 }, { "a": 1699, "b": "fe1E\u003eeG!B!wmPZ(B8$b?pgn0JB6{akarR^PqDu7jaMwcsayPqhvr\u0026#lw/$FHs5hZZu)5uFl31e\u003czY\u0026}azdK\u0026hBAh8kxla", "l": 45, "n": [ { "c": 1, "d": "Validation vocabulary array", "i": "metadata/file/text/format::vocab-array", "o": 1736, "z": 5 } ] }, { "a": 1774, "b": "fe1E\u003eeG!B!wmPZ(B8$b?mS\u0026PUBzkVhB6{asqDu7jaMwcsayPqhvr\u0026#lw/$FHs5hZZu)5uFl31e\u003czY\u0026UmzEW^5z/cXbz!9M[A@", "l": 46 }, { "a": 1852, "b": "fe1E\u003eeG!B!wmPZ(B8$b?pgn0JpJx#WzEEv5u)3\u003c}rZweS\u0026!AQsvrcx%C{43qayFnDqBB[nz/Px5zEEu7z!rQ5wPR$", "l": 47 }, { "a": 2120, "b": "fe1E\u003el2E/ll@Cdvz/oAjayMylBAI4nvTf8pwPhD]v}/*[aARpdazbtdB95KlD30RsaA}KwxDQ.au$%K$u)6xdayFX/y\u00260F", "l": 54 }, { "a": 2196, "b": "fe1E\u003ex(n3hazC}saz(4mx([olx(mMal}*obaxJa%wmY\u003c]v@@\u0026nxLzJgvTf8axK$W?x(mMaBzb98aARpdaAITEvJYPdwO#L", "l": 55 }, { "a": 2272, "b": "fe1E\u003eCwhejaARpdaz2!pwN/*[wftnplM!uPavE}blo5u}z/xi8wmV)8wPq\u003c7zEWlgaw3e/x(\u003eFdz!i#jzF%RtzddJ@xE\u003c", "l": 56, "n": [ { "c": 1, "d": "Validation vocabulary expected", "i": "metadata/file/text/format::vocab-expected", "o": 2285, "z": 8 } ] }, { "a": 2347, "b": "fe1E\u003eu#/?1z!%PduVQHlv{%g\u0026uV716vR6N/aAz4nB-IwvayESUAWT\u003eiB7nS{y^\u0026w+z/N)1q/)d\u003enn\u0026AZwN)k$ayPd#aARpd", "l": 57 }, { "a": 2424, "b": "fe1E\u003ev{%g\u0026wPw]mxM53fwftF)y?$k6vpK6}Bz\u0026pau$jj=By^G]ByxiivrcHiuUr!?wJz\u003e)wPI^aC4C37x\u003c\u003ev\u003cvrcD#A=(Cgxjk)[u%Lw", "l": 58 }, { "a": 2918, "b": "AckRjv@DmaBrBH+q:S\u0026AoKyW^r9@cYl}oWBiV}THi6elst{8oMtqgpQmL2VoCRz0aatw4cgHi6", "l": 73 }, { "a": 2978, "b": "", "l": 74 }, { "a": 2979, "b": "fe1EcLZ}+TFfm{czE^WfB0bglAbo95wO#P#BzkVhaMwSo\u0026/[#MLZ}+TFz#/z\u0026/[#MLZ}+TFz#/z\u0026/[#MLZ}+TFz#/z\u0026/[#MLZ}+TFz#/z\u0026/[#MLZ}+TFz#/z\u0026/[#MLZ}+TFz#/z\u0026/[#MLZ}+TFz#/z\u0026/[#MLZ}+TFz#/z\u0026/[#MLZ}+TFz#/z\u0026/[#MLZ}+TFz#/z\u0026/[#MLZ}+TFz#/z\u0026/[#MLZ}+TFz#/z\u0026/[#MLZ}+TFb", "l": 75, "n": [ { "c": 2, "d": "Box drawing text banner", "i": "metadata/file/text/format::box-drawing-banner", "o": 3012, "z": 156 } ] }, { "a": 3169, "b": "", "l": 76 }, { "a": 3170, "b": "bu[U\u0026xdd\u003egA+w%9uVg0djS\u003e})x(mE1Cxj@St(", "l": 77 }, { "a": 3811, "b": "arR^HarR^Hfe1CCwNP9(p^)X[AbPDdBy/Fnw].*bazk:RtqgpWfKlp", "l": 93 }, { "a": 3855, "b": "arR^HarR^Hy?mYhAaJGtasZ(tzGx[xBVqC", "l": 94 }, { "a": 3883, "b": "arR^HarR^HB97}Ni:)5sxGwg.B8r6G", "l": 95, "n": [ { "c": 3, "d": "Inline assembly macro", "i": "micro-behaviors/mem/inline-asm/arch::macro", "o": 3902, "z": 5 } ] }, { "a": 3908, "b": "arR^HarR^HarR^Hb5ImwaBw6svTP^IAD=twwft\u0026kAV/1oi:jp.hzwzXec", "l": 96 }, { "a": 3954, "b": "arR^HarR^HarR^HAaJG3jS[V=Bsqfvxdj%xwNWg", "l": 97 }, { "a": 12109, "b": "Ee", "l": 287 }, { "a": 12111, "b": "", "l": 288 }, { "a": 12112, "b": "bu[U\u0026xdd\u003ekB95\u003cp", "l": 289, "n": [ { "c": 2, "d": "#[cfg(test)] attribute", "i": "metadata/package/testing/harness/unit::rust-cfg-test", "o": 12112, "z": 12 } ] }, { "a": 12125, "b": "zeS@cBy/JnB0b/", "l": 290 }, { "a": 12137, "b": "arR^HB-RapB9hCkAYMlhi@", "l": 291 } ], "mol": "H(Mg)", "sha": "2e12e9d1017c8c04fc55a76ed2e0259e55eed8d218899593b238d171784397aa", "fact": { "id": "rust", "imp": [ [ "", "peb.add" ], [ "", "ldr.add" ], [ "", "ntdll_entry.add" ], [ "", "base.add" ], [ "", "base.add" ], [ "", "nt_headers.add" ], [ "", "base.add" ], [ "", "export_dir.add" ], [ "", "export_dir.add" ], [ "", "export_dir.add" ], [ "", "export_dir.add" ], [ "", "base.add" ], [ "", "base.add" ], [ "", "base.add" ], [ "", "base.add" ], [ "", "Some" ], [ "", "ntdll_base" ], [ "", "find_export_rva.ok_or_else" ], [ "", "find_export_rva" ], [ "", "name.to_string" ], [ "", "base.add" ], [ "", "Err" ], [ "", "name.to_string" ], [ "", "stub.add" ], [ "", "stub.add" ], [ "", "stub.add" ], [ "", "stub.add" ], [ "", "Ok" ], [ "", "Err" ], [ "", "name.to_string" ], [ "", "bytes.len" ], [ "", "stub_is_clean" ], [ "", "bytes.len" ], [ "", "Some" ], [ "", "assert" ], [ "", "assert" ], [ "", "assert" ], [ "", "assert" ], [ "", "assert" ], [ "", "assert_eq" ], [ "", "assert_eq" ], [ "", "assert_eq" ], [ "", "assert_eq" ], [ "", "resolve_syscall_number" ], [ "", "assert" ] ], "mbr": [ "base.add", "bytes.len", "export_dir.add", "find_export_rva().ok_or_else", "ldr.add", "name.to_string", "nt_headers.add", "ntdll_entry.add", "peb.add", "stub.add" ], "met": { "ast": { "op.eq": 3.0, "op.ge": 1.0, "op.lt": 1.0, "op.ne": 1.0, "op.add": 3.0, "op.lor": 1.0, "op.mul": 3.0, "op.land": 1.0, "max_depth": 20.0, "call_count": 42.0, "node_count": 2524.0, "member_count": 10.0, "op_density.eq": 0.0, "op_density.ge": 0.0, "op_density.lt": 0.0, "op_density.ne": 0.0, "op_density.add": 0.0, "op_density.lor": 0.0, "op_density.mul": 0.0, "op_density.land": 0.0, "identifier_count": 88.0, "member_depth_max": 2.0, "string_literal_count": 7.0, "array_literal_max_length": 11.0, "numeric_array_max_length": 11.0, "string_concat_chain_max_length": 3.0 }, "file": { "size": 14737.0, "entropy": 5.13, "size_bytes": 14737.0 }, "text": { "digit_ratio": 0.07, "space_count": 3337.0, "total_lines": 358.0, "char_entropy": 5.13, "unique_chars": 94.0, "escape_density": 0.01, "lines_over_200": 1.0, "string_density": 0.02, "avg_line_length": 40.16, "high_byte_ratio": 0.06, "max_line_length": 201.0, "non_ascii_ratio": 0.06, "empty_line_ratio": 0.11, "last_line_length": 1.0, "long_token_count": 5.0, "whitespace_ratio": 0.25, "most_common_ratio": 0.05, "identifier_density": 0.72, "line_length_stddev": 35.36, "octal_escape_count": 2.0, "normalized_string_count": 0.37, "repeated_char_sequences": 60.0, "most_common_char_is_null": 0.0, "suspicious_comment_ratio": 0.17, "max_inline_whitespace_run": 20.0, "most_common_char_codepoint": 101.0, "suspicious_identifier_ratio": 0.01, "normalized_unique_identifiers": 10.37 }, "calls": { "count": 42.0 }, "binary": { "overall_entropy": 5.13 }, "source": { "function_count": 15.0 }, "members": { "count": 10.0 }, "strings": { "total": 7.0, "avg_length": 11.57, "max_length": 30.0, "avg_entropy": 3.04, "empty_count": 1.0, "total_bytes": 81.0, "entropy_stddev": 0.75 }, "comments": { "chars": 8403.0, "lines": 182.0, "total": 184.0, "to_code_ratio": 1.03, "empty_comments": 2.0, "base64_in_comments": 9.0, "high_entropy_comments": 23.0 }, "functions": { "count": 15.0, "avg_params": 0.4, "max_params": 2.0, "length_stddev": 15.56, "avg_name_length": 20.73, "no_params_count": 10.0, "avg_length_lines": 11.67, "max_length_lines": 63.0, "min_length_lines": 3.0, "high_entropy_names": 8.0, "avg_param_name_length": 4.33, "density_per_100_lines": 4.19, "code_in_functions_ratio": 0.49 }, "identifiers": { "count": 88.0, "total": 256.0, "avg_length": 9.73, "max_length": 38.0, "min_length": 1.0, "avg_entropy": 2.57, "reuse_ratio": 0.34, "unique_count": 88.0, "length_stddev": 7.23, "has_digit_ratio": 0.02, "sequential_names": 1.0, "single_char_count": 1.0, "single_char_ratio": 0.01, "high_entropy_count": 10.0, "high_entropy_ratio": 0.11, "all_lowercase_ratio": 0.83, "all_uppercase_ratio": 0.02, "numeric_suffix_count": 1.0 } }, "str": [ [ 2779, "10", "4" ], [ 2785, "16", "76" ], [ 2791, "16", "139" ], [ 2797, "16", "209" ], [ 2803, "16", "184" ], [ 2953, "10", "3" ], [ 2959, "16", "15" ], [ 2965, "16", "5" ], [ 2971, "16", "195" ], [ 3188, "u8", "windows" ], [ 3189, "u8", "windows" ], [ 3920, "u8", "mov {peb}, qword ptr gs:[0x60]" ], [ 3921, "u8", "mov {peb}, qword ptr gs:[0x60]" ], [ 4119, "16", "24" ], [ 4267, "16", "32" ], [ 4700, "16", "32" ], [ 5294, "16", "60" ], [ 5993, "16", "136" ], [ 6044, "10", "0" ], [ 6886, "16", "24" ], [ 6958, "16", "28" ], [ 7030, "16", "32" ], [ 7102, "16", "36" ], [ 7174, "10", "0" ], [ 7381, "10", "4" ], [ 7837, "10", "2" ], [ 8031, "10", "4" ], [ 8964, "10", "4" ], [ 9155, "10", "0" ], [ 9166, "10", "1" ], [ 9177, "10", "2" ], [ 9188, "10", "3" ], [ 9364, "10", "4" ], [ 9394, "10", "5" ], [ 9424, "10", "6" ], [ 9454, "10", "7" ], [ 10534, "u8", "windows" ], [ 10535, "u8", "windows" ], [ 10628, "u8", "windows" ], [ 10629, "u8", "windows" ], [ 11522, "10", "4" ], [ 11535, "10", "4" ], [ 12007, "10", "8" ], [ 12073, "10", "4" ], [ 12083, "10", "5" ], [ 12093, "10", "6" ], [ 12103, "10", "7" ], [ 12419, "16", "76" ], [ 12425, "16", "139" ], [ 12431, "16", "209" ], [ 12437, "16", "184" ], [ 12443, "16", "5" ], [ 12449, "16", "0" ], [ 12455, "16", "0" ], [ 12461, "16", "0" ], [ 12467, "16", "15" ], [ 12473, "16", "5" ], [ 12479, "16", "195" ], [ 12647, "16", "233" ], [ 12653, "16", "0" ], [ 12659, "16", "16" ], [ 12665, "16", "0" ], [ 12671, "16", "0" ], [ 12677, "16", "0" ], [ 12683, "16", "0" ], [ 12689, "16", "0" ], [ 12695, "16", "15" ], [ 12701, "16", "5" ], [ 12707, "16", "195" ], [ 12882, "16", "204" ], [ 12888, "16", "139" ], [ 12894, "16", "209" ], [ 12900, "16", "184" ], [ 12906, "16", "5" ], [ 12912, "16", "0" ], [ 12918, "16", "0" ], [ 12924, "16", "0" ], [ 12930, "16", "15" ], [ 12936, "16", "5" ], [ 12942, "16", "195" ], [ 13074, "16", "76" ], [ 13080, "16", "139" ], [ 13086, "16", "209" ], [ 13484, "16", "76" ], [ 13490, "16", "139" ], [ 13496, "16", "209" ], [ 13502, "16", "184" ], [ 13508, "16", "24" ], [ 13514, "16", "0" ], [ 13520, "16", "0" ], [ 13526, "16", "0" ], [ 13532, "16", "15" ], [ 13538, "16", "5" ], [ 13544, "16", "195" ], [ 13595, "16", "24" ], [ 13727, "16", "76" ], [ 13733, "16", "139" ], [ 13739, "16", "209" ], [ 13745, "16", "184" ], [ 13751, "16", "5" ], [ 13757, "16", "1" ], [ 13763, "16", "0" ], [ 13769, "16", "0" ], [ 13775, "16", "15" ], [ 13781, "16", "5" ], [ 13787, "16", "195" ], [ 13838, "16", "261" ], [ 13932, "16", "233" ], [ 13938, "16", "0" ], [ 13944, "16", "16" ], [ 13950, "16", "0" ], [ 13956, "16", "0" ], [ 13962, "16", "0" ], [ 13968, "16", "0" ], [ 13974, "16", "0" ], [ 13980, "16", "15" ], [ 13986, "16", "5" ], [ 13992, "16", "195" ], [ 14170, "16", "76" ], [ 14176, "16", "139" ], [ 14182, "16", "209" ], [ 14188, "16", "184" ], [ 14194, "16", "5" ], [ 14200, "16", "0" ], [ 14497, "u8", "windows" ], [ 14498, "u8", "windows" ], [ 14604, "u8", "NtAllocateVirtualMemory" ], [ 14605, "u8", "NtAllocateVirtualMemory" ] ], "tgt": [ "Err", "Ok", "Some", "base.add", "bytes.len", "export_dir.add", "find_export_rva", "find_export_rva().ok_or_else", "ldr.add", "name.to_string", "nt_headers.add", "ntdll_base", "ntdll_entry.add", "peb.add", "resolve_syscall_number", "stub.add", "stub_is_clean" ], "val": { "file.stem": "hells_gate", "file.basename": "hells_gate.rs", "source.language": "rust", "source.imports[0]": "Err", "source.imports[1]": "Ok", "source.imports[2]": "Some", "source.imports[3]": "assert", "source.imports[4]": "assert_eq", "source.imports[5]": "base.add", "source.imports[6]": "bytes.len", "source.imports[7]": "export_dir.add", "source.imports[8]": "find_export_rva", "source.imports[9]": "find_export_rva.ok_or_else", "source.strings[0]": "NtAllocateVirtualMemory", "source.strings[1]": "mov {peb}, qword ptr gs:[0x60]", "source.strings[2]": "windows", "source.has_imports": true, "source.imports[10]": "ldr.add", "source.imports[11]": "name.to_string", "source.imports[12]": "nt_headers.add", "source.imports[13]": "ntdll_base", "source.imports[14]": "ntdll_entry.add", "source.imports[15]": "peb.add", "source.imports[16]": "resolve_syscall_number", "source.imports[17]": "stub.add", "source.imports[18]": "stub_is_clean", "source.functions[0]": "clean_stub_recognized", "source.functions[1]": "extract_ssn", "source.functions[2]": "extract_ssn_hooked_returns_none", "source.functions[3]": "extract_ssn_known_value", "source.functions[4]": "extract_ssn_multi_byte", "source.functions[5]": "extract_ssn_too_short_returns_none", "source.functions[6]": "find_export_rva", "source.functions[7]": "int3_hook_not_clean", "source.functions[8]": "jmp_hook_not_clean", "source.functions[9]": "ntdll_base", "source.functions[10]": "resolve_returns_not_supported_on_linux", "source.functions[11]": "resolve_syscall_number", "source.functions[12]": "resolve_windows", "source.functions[13]": "stub_is_clean", "source.functions[14]": "too_short_not_clean" } }, "find": [ { "id": "objectives/anti-static/obfuscation/payload/config::arch-keyed-hex-blob-dict--encoded-value", "atk": "T1027", "mbc": "B0032", "conf": 0.9399999976158142, "crit": 1, "desc": "Architecture keyed hex byte-array value" }, { "id": "micro-behaviors/data/text/llm/override::llm-instruction-context", "conf": 0.7200000286102295, "crit": 1, "desc": "LLM instruction context" }, { "id": "metadata/file/text/format::box-drawing-banner", "conf": 0.8999999761581421, "crit": 2, "desc": "Box drawing text banner" }, { "id": "micro-behaviors/data/text/keywords/lexicon::cleanup-verb", "conf": 0.8799999952316284, "crit": 1, "desc": "Destructive cleanup verb" }, { "id": "metadata/file/text/format::vocab-array", "conf": 0.9700000286102295, "crit": 1, "desc": "Validation vocabulary array" }, { "id": "micro-behaviors/data/text/keywords/lexicon::command-result-word", "conf": 0.4000000059604645, "crit": 1, "desc": "cmd/command/result vocabulary word" }, { "id": "micro-behaviors/data/text/keywords/lexicon::edr-keyword", "conf": 0.699999988079071, "crit": 1, "desc": "EDR / endpoint detection keyword" }, { "id": "micro-behaviors/data/text/keywords/lexicon::target-source-test", "conf": 0.8799999952316284, "crit": 1, "desc": "Source or test deletion target" }, { "id": "metadata/package/testing/harness/unit::rust-cfg-test", "conf": 0.8999999761581421, "crit": 2, "desc": "#[cfg(test)] attribute" }, { "id": "micro-behaviors/mem/inline-asm/arch::macro", "conf": 1.0, "crit": 3, "desc": "Inline assembly macro" }, { "id": "micro-behaviors/data/text/keywords/lexicon::encrypted-trailer-vocab", "conf": 0.20000000298023224, "crit": 1, "desc": "encrypted-file trailer vocabulary" }, { "id": "metadata/file/text/format::vocab-expected", "conf": 0.9700000286102295, "crit": 1, "desc": "Validation vocabulary expected" }, { "id": "metadata/file/text/format::vocab-number", "conf": 0.9700000286102295, "crit": 1, "desc": "Validation vocabulary number" }, { "id": "metadata/file/text/format::i18n-validation-vocab", "conf": 0.9700000286102295, "crit": 1, "desc": "Form-validation vocabulary in dense non-ASCII file" } ], "path": "hells_gate.rs", "risk": 2, "size": 14737, "type": "rust" } ] } }