{ "ml": { "v": "7", "eng": "2.0.1-rc.1", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.000028361877, "rte": "az", "prob": 0.000028361877 }, { "cls": 0, "raw": 0.81147337, "rte": "az/source", "prob": 0.81147337 }, { "cls": 0, "raw": 0.7328682, "rte": "az/c", "prob": 0.7328682 } ], "prob": 0.000028361877, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.000028361877411953174, "type": "c" } ], "version": "v18.18", "analyzed_at": "2026-06-15T10:00:43Z" }, "path": "utils.h", "raw": { "v": "7", "tv": "061e3", "files": [ { "id": 0, "ctx": [ { "a": 290, "b": "", "l": 17 }, { "a": 291, "b": "bwy:jf-", "l": 18 }, { "a": 297, "b": "bv\u003ev$x(mG8nk9@gwk3YDA::0lawuYZwk3YDA::0lk(", "l": 19, "n": [ { "c": 3, "d": "LoadLibraryA call in source", "i": "micro-behaviors/dylib/load/source::load-library-a-source", "o": 318, "z": 12 } ] }, { "a": 331, "b": "bv$XjwD", "l": 20 }, { "a": 337, "b": "B97\u0026jx\u003e5n}z/fSray/7[AW\u0026hMBAg-7wPzW1y+)*?jP", "l": 21 }, { "a": 692, "b": "", "l": 31 }, { "a": 693, "b": "B97\u0026jx\u003e5nRo\u00261eSoHQ6{x\u003eg^Gz^^fIx\u003c#9\u003eA^o6bp^XeXqxP^{o(BM+y?lvIzdLdsDJ", "l": 32 }, { "a": 747, "b": "arTiHpEFhRmiDnrz!a0bwGTbUm}D^pz!a0bwK{lEwnC*yd06GJuU:j[zE)Sugato", "l": 33, "n": [ { "c": 3, "d": "Get module handle", "i": "micro-behaviors/process/info/thread::get-module-handle", "o": 767, "z": 16 } ] }, { "a": 799, "b": "arUYoBAIRwasFTeo\u00261eSoHQuVdjv\u003e^lSl@ZdjE+#BwN0@v)KToA+frkc$(s[wozZ1efG1QA:JT3vpTg*vSC)$C{$f\u003c", "l": 34, "n": [ { "c": 2, "d": "Windows GetProcAddress in source", "i": "micro-behaviors/dylib/lookup::get-proc-address-source", "o": 829, "z": 14 } ] }, { "a": 872, "b": "arR^HarUGto(BM+y?lvIzdLdT", "l": 35 }, { "a": 893, "b": "Ee", "l": 36 } ], "mol": "Hâ‚‚(DsPo)", "sha": "2fa6fd4218d71206fe4540dd8fcdcc0df411087b749cd6a727db33b360c4adf0", "fact": { "id": "c", "imp": [ [ "", "DecodeXor.data" ], [ "", "DecodeXor" ], [ "", "DecodeXor.data" ], [ "", "DecodeXor" ], [ "", "GetModuleHandleA" ], [ "", "GetProcAddress" ], [ "", "HIDE_FUNCTION" ], [ "", "HIDE_FUNCTION" ], [ "", "HIDE_FUNCTION" ], [ "", "HIDE_FUNCTION" ], [ "", "HIDE_FUNCTION" ], [ "", "HIDE_FUNCTION" ], [ "", "HIDE_FUNCTION" ], [ "", "\u003cstdio.h\u003e" ], [ "", "\u003cwindows.h\u003e" ] ], "mbr": [ "DecodeXor().data" ], "met": { "ast": { "op.lt": 1.0, "op.xor": 1.0, "max_depth": 24.0, "op.concat": 2.0, "call_count": 14.0, "node_count": 777.0, "member_count": 1.0, "op_density.lt": 0.0, "op_density.xor": 0.0, "identifier_count": 52.0, "member_depth_max": 2.0, "op_density.concat": 0.0, "string_literal_count": 7.0 }, "file": { "size": 2798.0, "entropy": 4.92, "size_bytes": 2798.0 }, "text": { "digit_ratio": 0.07, "space_count": 753.0, "total_lines": 71.0, "char_entropy": 4.92, "unique_chars": 78.0, "string_density": 0.1, "avg_line_length": 38.41, "max_line_length": 80.0, "empty_line_ratio": 0.13, "last_line_length": 45.0, "whitespace_ratio": 0.29, "most_common_ratio": 0.05, "identifier_density": 2.45, "line_length_stddev": 28.39, "normalized_string_count": 0.83, "repeated_char_sequences": 25.0, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 39.0, "trailing_whitespace_lines": 1.0, "most_common_char_codepoint": 44.0, "suspicious_identifier_ratio": 0.19, "normalized_unique_identifiers": 8.46 }, "calls": { "count": 14.0 }, "binary": { "overall_entropy": 4.92 }, "source": { "function_count": 2.0 }, "imports": { "count": 2.0, "unique_modules": 2.0, "third_party_count": 2.0, "third_party_ratio": 1.0 }, "members": { "count": 1.0 }, "strings": { "total": 7.0, "avg_length": 11.43, "max_length": 12.0, "avg_entropy": 2.96, "total_bytes": 80.0, "entropy_stddev": 0.05 }, "functions": { "count": 2.0 }, "identifiers": { "count": 52.0, "total": 174.0, "avg_length": 8.12, "max_length": 25.0, "min_length": 1.0, "avg_entropy": 2.25, "reuse_ratio": 0.3, "unique_count": 52.0, "length_stddev": 5.7, "has_digit_ratio": 0.12, "sequential_names": 10.0, "single_char_count": 5.0, "single_char_ratio": 0.1, "all_lowercase_ratio": 0.23, "all_uppercase_ratio": 0.25, "numeric_suffix_count": 6.0 } }, "str": [ [ 22, "u8", "\u003cstdio.h\u003e" ], [ 41, "u8", "\u003cwindows.h\u003e" ], [ 237, "10", "0" ], [ 295, "10", "1" ], [ 386, "16", "42" ], [ 392, "16", "36" ], [ 398, "16", "51" ], [ 404, "16", "47" ], [ 410, "16", "36" ], [ 416, "16", "45" ], [ 422, "16", "114" ], [ 428, "16", "115" ], [ 434, "16", "111" ], [ 440, "16", "37" ], [ 446, "16", "45" ], [ 467, "16", "45" ], [ 473, "16", "0" ], [ 568, "16", "13" ], [ 574, "16", "46" ], [ 580, "16", "32" ], [ 586, "16", "37" ], [ 592, "16", "13" ], [ 598, "16", "40" ], [ 604, "16", "35" ], [ 610, "16", "51" ], [ 616, "16", "32" ], [ 622, "16", "51" ], [ 628, "16", "56" ], [ 649, "16", "0" ], [ 1526, "u8", "kernel32.dll" ], [ 1527, "u8", "kernel32.dll" ], [ 1703, "u8", "kernel32.dll" ], [ 1704, "u8", "kernel32.dll" ], [ 1880, "u8", "kernel32.dll" ], [ 1881, "u8", "kernel32.dll" ], [ 2019, "u8", "wininet.dll" ], [ 2020, "u8", "wininet.dll" ], [ 2240, "u8", "wininet.dll" ], [ 2241, "u8", "wininet.dll" ], [ 2351, "u8", "wininet.dll" ], [ 2352, "u8", "wininet.dll" ], [ 2540, "u8", "wininet.dll" ], [ 2541, "u8", "wininet.dll" ] ], "tgt": [ "DecodeXor", "DecodeXor().data", "GetModuleHandleA", "GetProcAddress", "HIDE_FUNCTION" ], "val": { "file.stem": "utils", "file.basename": "utils.h", "source.language": "c", "source.imports[0]": "\u003cstdio.h\u003e", "source.imports[1]": "\u003cwindows.h\u003e", "source.imports[2]": "DecodeXor", "source.imports[3]": "DecodeXor.data", "source.imports[4]": "GetModuleHandleA", "source.imports[5]": "GetProcAddress", "source.imports[6]": "HIDE_FUNCTION", "source.strings[0]": "\u003cstdio.h\u003e", "source.strings[1]": "\u003cwindows.h\u003e", "source.strings[2]": "kernel32.dll", "source.strings[3]": "wininet.dll", "source.has_imports": true, "source.functions[0]": "DecodeXor(char* in, size_t len, char key)", "source.functions[1]": "HideLoadLibrary(LPCSTR lpModuleName)" } }, "find": [ { "id": "micro-behaviors/dylib/load/source::load-library-a-source", "atk": "T1574.002", "conf": 0.949999988079071, "crit": 3, "desc": "LoadLibraryA call in source" }, { "id": "micro-behaviors/process/info/thread::get-module-handle", "conf": 0.8999999761581421, "crit": 3, "desc": "Get module handle" } ], "path": "/data/samples/bad/projects/ADR/loader/utils.h", "risk": 2, "size": 2798, "type": "c" } ] } }