{ "ml": { "v": "7", "eng": "2.2.0-beta.2", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.12461403, "rte": "az", "prob": 0.12461403 } ], "prob": 0.12461403, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.12461403012275696, "type": "xz" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.0010807812213897705, "type": "shell" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.0010942518711090088, "type": "shell" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "text" } ], "version": "v18.18", "analyzed_at": "2026-07-05T15:56:42Z" }, "path": "hunspell-fr_FR-2.3.2.tgz", "raw": { "files": [ { "id": 0, "mol": "O(As)H(Po₂)", "sha": "381fcabfcd936c42f65d0430611ffe48573f16da1bb23ab2804da42283d69efa", "path": "/data/samples/good/foraged/netbsd/netbsd.org/_/hunspell-fr_FR-2.3.2/hunspell-fr_FR-2.3.2.tgz", "risk": 4, "size": 272556, "type": "xz", "facts": { "metrics": { "file": { "size": 272556.0, "entropy": 8.0, "size_bytes": 272556.0 }, "binary": { "overall_entropy": 8.0, "peak_region_bytes": 272384.0, "peak_region_entropy": 7.85 }, "consistency": { "extension_content_mismatch": 1.0, "extension_content_mismatch.archive_as_archive": 1.0 } } }, "traits": [ { "id": "micro-behaviors/os/env/vars/access::env-cmd", "atk": "T1082", "conf": 0.6000000238418579, "crit": 3, "desc": "env command path" }, { "id": "objectives/anti-static/obfuscation/code-metrics/structure::sh-guarded-env-expansion", "atk": "T1027", "mbc": "B0032", "conf": 0.8500000238418579, "crit": 3, "desc": "Guarded shell parameter expansion" }, { "id": "micro-behaviors/process/create/shell/spawn::bin-sh", "atk": "T1059.004", "mbc": "E1059.004", "conf": 0.6000000238418579, "crit": 3, "desc": "References /bin/sh (Bourne shell)" }, { "id": "micro-behaviors/process/interpreter/perl::perl-keyword", "conf": 0.699999988079071, "crit": 3, "desc": "perl interpreter keyword (beyond shebang)" }, { "id": "micro-behaviors/process/create/shell/spawn::sh-dynamic-command-target", "conf": 0.6000000238418579, "crit": 3, "desc": "Shell command name from variable", "spans": [ [ 0, 34 ] ] }, { "id": "micro-behaviors/process/create/shell/spawn::shell-symbols", "conf": 0.8999999761581421, "crit": 3, "desc": "Shell execution symbols", "from": [ { "file": 1 }, { "file": 2 } ], "spans": [ [ 0, 34 ] ] }, { "id": "objectives/credential-access/theft/keywords::token", "conf": 0.30000001192092896, "crit": 1, "desc": "Credential-access vocabulary word: token" } ] }, { "ctx": [ { "b": "boXZHx(kOBxA", "n": [ { "c": 3, "d": "Shell execution symbols", "i": "micro-behaviors/process/create/shell/spawn::shell-symbols", "o": 0, "z": 34, "cf": 0.8999999761581421 } ], "ln": 1, "addr": 0 }, { "b": "bl", "ln": 2, "addr": 10 }, { "b": "boOmbwPQmql](D7wNPaXAX8wRf!Lm8gb7BtfekjngCx}ah99DFiX\u0026xiCwhvCmr\u0026+]bM", "n": [ { "c": 2, "d": "NetBSD RCS ident keyword", "i": "metadata/binary/provenance::netbsd-rcs-id", "o": 14, "z": 8, "cf": 0.8999999761581421 } ], "ln": 3, "addr": 12 }, { "b": "", "ln": 4, "addr": 66 }, { "b": "q:\u003cwHjT8d9a]", "ln": 5, "addr": 67 }, { "b": "B7/o1BrAs", "ln": 8, "addr": 101 }, { "b": "", "ln": 9, "addr": 109 }, { "b": "l03Yxa$[7WAXy)ozzbBxyA-", "n": [ { "c": 2, "d": "Uses awk for text processing", "i": "well-known/tool/development/cli::awk-processing", "o": 124, "z": 3, "cf": 1.0 } ], "ln": 10, "addr": 110 }, { "b": "lp1Kspc?PyjT8L4B8\u0026{yx(kOkvrl0$vqPN1", "ln": 11, "addr": 129 }, { "b": "lQsWma$)ztzzbHdBrQ", "ln": 12, "addr": 158 }, { "b": "oI4#LmNo{DjT8L4B8\u0026{PvRGZky?W^5w)]Z%a]", "ln": 29, "addr": 469 }, { "b": "oIN.{fjFTkfkLII", "ln": 30, "addr": 499 }, { "b": "oJa7#fjFTkfkLXN", "n": [ { "c": 2, "d": "List directory contents via /bin/ls", "i": "micro-behaviors/fs/directory/readdir::readdir-ls", "o": 516, "z": 7, "cf": 0.6600000262260437 } ], "ln": 31, "addr": 512 }, { "b": "o?N(CqAViSvRGZkzeiV@AV=@Ma]", "ln": 32, "addr": 525 }, { "b": "o\u0026:z3zfv3Nw*d", "ln": 33, "addr": 547 }, { "b": "p^[nQh9AcpB-RNRAbf8tvRGZkAaK6aa]", "n": [ { "c": 3, "d": "perl interpreter keyword (beyond shebang)", "i": "micro-behaviors/process/interpreter/perl::perl-keyword", "o": 578, "z": 4, "cf": 0.699999988079071 } ], "ln": 34, "addr": 558 }, { "b": "p!Kq=k$1Bspcx^OB-RNRB7e\u003c3fk$YtuTWFZx(k9", "ln": 35, "addr": 584 }, { "b": "p!Kq=nLR-JjT8L4B8\u0026{PvRGZkAbf8[x(mK3a]", "ln": 36, "addr": 616 }, { "b": "qCxp#fjFTkflg[N", "ln": 38, "addr": 665 }, { "b": "qCxLJqAViSvRGZkA=2u3AV$", "ln": 39, "addr": 678 }, { "b": "q:\u003c8qa$[7WAXy)ozzc6xwfI", "n": [ { "c": 2, "d": "Uses sed for text processing", "i": "well-known/tool/development/cli::sed-processing", "o": 711, "z": 3, "cf": 1.0 } ], "ln": 40, "addr": 697 }, { "b": "q:\u003cUOpf6I4flItRfjFTkfj/3Aa]", "n": [ { "c": 3, "d": "env command path", "i": "micro-behaviors/os/env/vars/access::env-cmd", "o": 724, "z": 12, "cf": 0.6000000238418579 } ], "ln": 41, "addr": 716 }, { "b": "q+f4}fjFTkflp!J", "n": [ { "c": 3, "d": "Shell command execution capability", "i": "micro-behaviors/process/create/shell/spawn::shell-execution-comp", "o": 742, "z": 7, "cf": 0.8999999761581421 } ], "ln": 42, "addr": 738 }, { "b": "q+{p\u003cjT8L4B8\u0026{yx(kOBz/P}z", "ln": 43, "addr": 751 }, { "b": "q=L$8flItRfjFTkflqmW", "ln": 44, "addr": 772 }, { "b": "lR*DDuR9:.pF%R*mOcoxq-#rOtyE/5asY0toHH0Me]L=AxcnVPB%5zRyIdZev\u003c0lOe]UPsB8\u003e+m", "ln": 64, "addr": 1128 }, { "b": "", "ln": 65, "addr": 1189 }, { "b": "v{%B\u0026ar\u00267Tp!Kq=lR*DDnK\u003e/[sW=nqa%pPq", "n": [ { "c": 3, "d": "Guarded shell parameter expansion", "i": "objectives/anti-static/obfuscation/code-metrics/structure::sh-guarded-env-expansion", "o": 1196, "z": 14, "cf": 0.8500000238418579 } ], "ln": 66, "addr": 1190 }, { "b": "tuMkStsAaett]PGD%oM(u0yiEu0yrKu0x:eu3]\u003cLz^uNxzE4SAdf", "ln": 67, "addr": 1219 }, { "b": "313I4m{!RVpdv/Bj:yQW", "ln": 68, "addr": 1261 }, { "b": "2{QM\u003cwO(vewGV5cwO=g7azbUjz6gGyByM$BxK#0@B1N", "ln": 96, "addr": 1821 }, { "b": "2{P", "ln": 97, "addr": 1856 }, { "b": "2{:\u003c%mn)flar.\u003cVCPXQ(d]O#coIuNRD\u0026", "n": [ { "c": 2, "d": "SHELL environment variable", "i": "micro-behaviors/os/env/vars/system-info::shell-var", "o": 1876, "z": 5, "cf": 0.5 } ], "ln": 98, "addr": 1859 }, { "b": "2)\u0026jqd]O#coIuNbmnlMUmiA\u003e5p!Kq=o*@2El{T^ruQNE-Ee", "ln": 99, "addr": 1885 }, { "b": "2{:\u003c%mn)flar.\u003cVCPXQ(d]O#coIuNRD\u0026", "ln": 100, "addr": 1923 } ], "depth": 1, "facts": { "imp": [ [ "", "shift" ], [ "", "shift" ], [ "", "{PWD_CMD}" ], [ "", "{TEST}" ], [ "", "./+OCAML_FINDLIB_REGISTER" ], [ "", "./+OCAML_FINDLIB_REGISTER" ], [ "", "{TEST}" ], [ "", "./+INFO_FILES" ], [ "", "./+INFO_FILES" ], [ "", "{TEST}" ], [ "", "./+ICON_THEMES" ], [ "", "./+ICON_THEMES" ], [ "", "{TEST}" ], [ "", "./+SHELL" ], [ "", "./+SHELL" ], [ "", "{TEST}" ], [ "", "./+SHELL" ], [ "", "./+SHELL" ], [ "", "{TEST}" ], [ "", "./+FILES" ], [ "", "./+FILES" ], [ "", "{TEST}" ], [ "", "./+FONTS" ], [ "", "./+FONTS" ], [ "", "{TEST}" ], [ "", "./+ICON_THEMES" ], [ "", "./+ICON_THEMES" ], [ "", "{TEST}" ], [ "", "./+SHLIBS" ], [ "", "./+SHLIBS" ], [ "", "{TEST}" ], [ "", "./+DIRS" ], [ "", "./+DIRS" ], [ "", "{TEST}" ], [ "", "./+USERGROUP" ], [ "", "./+USERGROUP" ], [ "", "{TEST}" ], [ "", "./+USERGROUP" ], [ "", "./+USERGROUP" ], [ "", "{TEST}" ], [ "", "./+FILES" ], [ "", "./+FILES" ], [ "", "{TEST}" ], [ "", "./+DIRS" ], [ "", "./+DIRS" ], [ "", "exit" ], [ "", "exit" ] ], "tgt": [ "${PWD_CMD}", "${TEST}", "./+DIRS", "./+FILES", "./+FONTS", "./+ICON_THEMES", "./+INFO_FILES", "./+OCAML_FINDLIB_REGISTER", "./+SHELL", "./+SHLIBS", "./+USERGROUP", ":", "exit", "shift" ], "metrics": { "ast": { "max_depth": 7.0, "bind_count": 55.0, "call_count": 32.0, "node_count": 758.0, "identifier_count": 80.0, "string_literal_count": 53.0 }, "file": { "size": 3064.0, "entropy": 5.77, "size_bytes": 3064.0 }, "text": { "tab_count": 72.0, "digit_ratio": 0.03, "space_count": 194.0, "total_lines": 148.0, "char_entropy": 5.77, "mixed_indent": 1.0, "unique_chars": 83.0, "string_density": 0.36, "avg_line_length": 19.7, "max_line_length": 67.0, "empty_line_ratio": 0.1, "last_line_length": 6.0, "whitespace_ratio": 0.14, "most_common_ratio": 0.05, "identifier_density": 1.34, "line_length_stddev": 16.36, "normalized_string_count": 4.36, "suspicious_string_ratio": 0.02, "most_common_char_is_null": 0.0, "suspicious_comment_ratio": 0.09, "max_inline_whitespace_run": 1.0, "most_common_char_codepoint": 47.0, "normalized_unique_identifiers": 11.37 }, "binds": { "count": 55.0 }, "calls": { "count": 32.0, "dynamic_target_count": 15.0 }, "binary": { "overall_entropy": 5.77, "peak_region_bytes": 3064.0, "peak_region_entropy": 5.75 }, "strings": { "total": 53.0, "avg_length": 10.77, "max_length": 40.0, "path_count": 39.0, "avg_entropy": 2.86, "empty_count": 2.0, "total_bytes": 571.0, "entropy_stddev": 0.67, "shell_command_strings": 1.0 }, "comments": { "chars": 602.0, "lines": 15.0, "total": 35.0, "to_code_ratio": 0.11, "empty_comments": 20.0, "high_entropy_comments": 3.0 }, "identifiers": { "count": 80.0, "total": 199.0, "avg_length": 6.49, "max_length": 25.0, "min_length": 1.0, "avg_entropy": 2.22, "reuse_ratio": 0.41, "unique_count": 82.0, "length_stddev": 4.57, "has_digit_ratio": 0.06, "single_char_count": 5.0, "single_char_ratio": 0.06, "high_entropy_count": 5.0, "high_entropy_ratio": 0.06, "all_lowercase_ratio": 0.04, "all_uppercase_ratio": 0.72, "numeric_suffix_count": 1.0, "underscore_prefix_count": 1.0 } } }, "id": 1, "mol": "O(As)H(Po₂)", "path": "/data/samples/good/foraged/netbsd/netbsd.org/_/hunspell-fr_FR-2.3.2/hunspell-fr_FR-2.3.2.tgz!!+DEINSTALL", "risk": 4, "sha": "96f981a9fd5da0a4c8c7b18e8e2dcbb032b4d583a36ec5038a452e578731d6cd", "size": 3064, "traits": [ { "id": "objectives/anti-static/obfuscation/code-metrics/structure::sh-guarded-env-expansion", "atk": "T1027", "mbc": "B0032", "conf": 0.8500000238418579, "crit": 3, "desc": "Guarded shell parameter expansion", "spans": [ [ 1196, 14 ] ] }, { "id": "micro-behaviors/os/env/vars/access::env-cmd", "atk": "T1082", "conf": 0.6000000238418579, "crit": 3, "desc": "env command path", "spans": [ [ 724, 12 ] ] }, { "id": "micro-behaviors/process/create/shell/spawn::bin-sh", "atk": "T1059.004", "mbc": "E1059.004", "conf": 0.6000000238418579, "crit": 3, "desc": "References /bin/sh (Bourne shell)", "spans": [ [ 742, 7 ] ] }, { "id": "micro-behaviors/process/interpreter/perl::perl-keyword", "conf": 0.699999988079071, "crit": 3, "desc": "perl interpreter keyword (beyond shebang)", "spans": [ [ 578, 4 ] ] }, { "id": "micro-behaviors/process/create/shell/spawn::sh-dynamic-command-target", "conf": 0.6000000238418579, "crit": 3, "desc": "Shell command name from variable", "spans": [ [ 0, 34 ] ] }, { "id": "micro-behaviors/process/create/shell/spawn::shell-symbols", "conf": 0.8999999761581421, "crit": 3, "desc": "Shell execution symbols", "spans": [ [ 0, 34 ], [ 742, 7 ] ] } ], "type": "shell" }, { "ctx": [ { "b": "boXZHx(kOBxA", "n": [ { "c": 3, "d": "Shell execution symbols", "i": "micro-behaviors/process/create/shell/spawn::shell-symbols", "o": 0, "z": 34, "cf": 0.8999999761581421 } ], "ln": 1, "addr": 0 }, { "b": "bl", "ln": 2, "addr": 10 }, { "b": "boOmbwPQmql](D7wNPaXAX8wRf!Lm8gb7BtfekjngCx}ah99DFiX\u0026xiCwhvCmr\u0026+]bM", "n": [ { "c": 2, "d": "NetBSD RCS ident keyword", "i": "metadata/binary/provenance::netbsd-rcs-id", "o": 14, "z": 8, "cf": 0.8999999761581421 } ], "ln": 3, "addr": 12 }, { "b": "", "ln": 4, "addr": 66 }, { "b": "q:\u003cwHjT8d9a]", "ln": 5, "addr": 67 }, { "b": "B7/o1BrAs", "ln": 8, "addr": 101 }, { "b": "", "ln": 9, "addr": 109 }, { "b": "l03Yxa$[7WAXy)ozzbBxyA-", "n": [ { "c": 2, "d": "Uses awk for text processing", "i": "well-known/tool/development/cli::awk-processing", "o": 124, "z": 3, "cf": 1.0 } ], "ln": 10, "addr": 110 }, { "b": "lp1Kspc?PyjT8L4B8\u0026{yx(kOkvrl0$vqPN1", "ln": 11, "addr": 129 }, { "b": "lQsWma$)ztzzbHdBrQ", "ln": 12, "addr": 158 }, { "b": "oI4#LmNo{DjT8L4B8\u0026{PvRGZky?W^5w)]Z%a]", "ln": 29, "addr": 469 }, { "b": "oIN.{fjFTkfkLII", "ln": 30, "addr": 499 }, { "b": "oJa7#fjFTkfkLXN", "n": [ { "c": 2, "d": "List directory contents via /bin/ls", "i": "micro-behaviors/fs/directory/readdir::readdir-ls", "o": 516, "z": 7, "cf": 0.6600000262260437 } ], "ln": 31, "addr": 512 }, { "b": "o?N(CqAViSvRGZkzeiV@AV=@Ma]", "ln": 32, "addr": 525 }, { "b": "o\u0026:z3zfv3Nw*d", "ln": 33, "addr": 547 }, { "b": "p^[nQh9AcpB-RNRAbf8tvRGZkAaK6aa]", "n": [ { "c": 3, "d": "perl interpreter keyword (beyond shebang)", "i": "micro-behaviors/process/interpreter/perl::perl-keyword", "o": 578, "z": 4, "cf": 0.699999988079071 } ], "ln": 34, "addr": 558 }, { "b": "p!Kq=k$1Bspcx^OB-RNRB7e\u003c3fk$YtuTWFZx(k9", "ln": 35, "addr": 584 }, { "b": "p!Kq=nLR-JjT8L4B8\u0026{PvRGZkAbf8[x(mK3a]", "ln": 36, "addr": 616 }, { "b": "qCxp#fjFTkflg[N", "ln": 38, "addr": 665 }, { "b": "qCxLJqAViSvRGZkA=2u3AV$", "ln": 39, "addr": 678 }, { "b": "q:\u003c8qa$[7WAXy)ozzc6xwfI", "n": [ { "c": 2, "d": "Uses sed for text processing", "i": "well-known/tool/development/cli::sed-processing", "o": 711, "z": 3, "cf": 1.0 } ], "ln": 40, "addr": 697 }, { "b": "q:\u003cUOpf6I4flItRfjFTkfj/3Aa]", "n": [ { "c": 3, "d": "env command path", "i": "micro-behaviors/os/env/vars/access::env-cmd", "o": 724, "z": 12, "cf": 0.6000000238418579 } ], "ln": 41, "addr": 716 }, { "b": "q+f4}fjFTkflp!J", "n": [ { "c": 3, "d": "Shell command execution capability", "i": "micro-behaviors/process/create/shell/spawn::shell-execution-comp", "o": 742, "z": 7, "cf": 0.8999999761581421 } ], "ln": 42, "addr": 738 }, { "b": "q+{p\u003cjT8L4B8\u0026{yx(kOBz/P}z", "ln": 43, "addr": 751 }, { "b": "q=L$8flItRfjFTkflqmW", "ln": 44, "addr": 772 }, { "b": "lR*DDuR9:.pF%R*mOcoxq-#rOtyE/5asY0toHH0Me]L=AxcnVPB%5zRyIdZev\u003c0lOe]UPsB8\u003e+m", "ln": 64, "addr": 1128 }, { "b": "", "ln": 65, "addr": 1189 }, { "b": "v{%B\u0026ar\u00267Tp!Kq=lR*DDnK\u003e/[sW=nqa%pPq", "n": [ { "c": 3, "d": "Guarded shell parameter expansion", "i": "objectives/anti-static/obfuscation/code-metrics/structure::sh-guarded-env-expansion", "o": 1196, "z": 14, "cf": 0.8500000238418579 } ], "ln": 66, "addr": 1190 }, { "b": "tuMkStsAaett]PGD%oM(u0yiEu0yrKu0x:eu3]\u003cLz^uNxzE4SAdf", "ln": 67, "addr": 1219 }, { "b": "313I4m{!RVpdv/Bj:yQW", "ln": 68, "addr": 1261 }, { "b": "boOmbwPQmql](D3x(XnCB%5H(g:1LcfGpZtf!UjqatLVjh846DhY#^Bx(nktmr\u0026+]bM", "ln": 75, "addr": 1355 }, { "b": "bl", "ln": 76, "addr": 1409 }, { "b": "boPG/zE)\u0026%By=O6as/\u0026KqD1YVv@=p5BrCWsvrrSjwObH]wO#0?ay/tjzGG}xwnc6}v@#Tfx\u003equdBzb98ayPq4", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 1437, "z": 4, "cf": 0.800000011920929 } ], "ln": 77, "addr": 1411 }, { "b": "boR2rADL#owN(]}z/M$xxK@r9A=k]dAV!$pzEW^5z/fobxcqb8aARpdaAg+0yHH\u003c!e=", "ln": 78, "addr": 1480 }, { "b": "bl", "ln": 79, "addr": 1534 }, { "b": "v{%B\u0026ar\u00267Tq=D4MmsuZjf^m-Ozu", "ln": 80, "addr": 1536 }, { "b": "rzDvRlRw$TrzDvRlRw%Xl}HoPdf", "ln": 81, "addr": 1558 }, { "b": "2{:\u003c+k#-mPj%hEhd)#%bqY[g+asxPNmKF", "n": [ { "c": 2, "d": "shell script heredoc", "i": "micro-behaviors/process/create/eval::shell-heredoc", "o": 1598, "z": 8, "cf": 0.800000011920929 } ], "ln": 82, "addr": 1580 }, { "b": "boXZHx(kOBxA", "ln": 83, "addr": 1607 }, { "b": "bl", "ln": 84, "addr": 1617 }, { "b": "boOH8nM5FfeG/7Bw[u0]zEWlfv@DHcBy!#9wnc6}v@#TfC{3%jzEEf?zdNQbaAI4kx(Fd", "ln": 85, "addr": 1619 }, { "b": "bl", "ln": 86, "addr": 1675 }, { "b": "boQ0cvp%djatbq$l}HoPavey-D@rycpGx]ip^[nRqY]pYwPRu\u003evrt{*x(WF", "n": [ { "c": 1, "d": "Regex component marker", "i": "objectives/anti-static/obfuscation/code-metrics/structure::sh-dense-eval-chains-unless-cond-1--rx-3", "o": 1679, "z": 7, "cf": 0.9200000166893005 } ], "ln": 87, "addr": 1677 }, { "b": "boO9KarR^Hatbq$l}HoPavwW*lRx0%l{#z\u0026njt)seMb2ipGx]ilR6Tkod-$eqCy7jtwW}[vpS!*vpT7)t(", "ln": 88, "addr": 1725 }, { "b": "bl", "ln": 89, "addr": 1791 }, { "b": "bl", "ln": 109, "addr": 2955 }, { "b": "bmbOql}HoqatmqFv\u003eRCjzY\u0026(", "ln": 110, "addr": 2957 }, { "b": "bmbOql}Hoqatm[DAXzlExd)\u003enz.DiHA3f1oatt-dfD:$Cz.l9MwPw]9z/mjuA=l8t", "n": [ { "c": 1, "d": "tmp keyword", "i": "metadata/file/string/file::tmp", "o": 2999, "z": 3, "cf": 0.20000000298023224 } ], "ln": 111, "addr": 2977 }, { "b": "bmbOql}HoqaAIj8A+c[oz/mjDy\u0026%x8zGu}jz2", "ln": 112, "addr": 3030 }, { "b": "bl", "ln": 113, "addr": 3060 }, { "b": "2)\u003eMZA=2\u003eXa%.kyvpTq2uU0\u003e\u003efdP\u003c/qCx.Yq+o+WqZ8", "ln": 185, "addr": 4607 }, { "b": "2)\u003eM\u003ewO3a2B96L?bY^Tcwn=W0wnc6qd]objmoAbWr7P?Pa]", "ln": 186, "addr": 4642 }, { "b": "2)\u003eY(yH}xDa%.kyvpTq2uU0\u003e\u003efc\u003e)vogI-yo*%EO", "n": [ { "c": 1, "d": "Credential-access vocabulary word: token", "i": "objectives/credential-access/theft/keywords::token", "o": 4682, "z": 5, "cf": 0.30000001192092896 } ], "ln": 187, "addr": 4680 }, { "b": "2)\u003erTas8qkmn)flar.\u003cVwfr6wB7!#)z*bM0x(UyVaARpdzu", "ln": 188, "addr": 4713 }, { "b": "2)*[-DREd3nM6%VbY^Tcwn=W0wnc5", "ln": 189, "addr": 4751 }, { "b": "2)\u003eiT", "ln": 192, "addr": 4838 }, { "b": "2)\u003erTas8qkmn)flat4gFa%.nGyH}xcasnATtM", "ln": 193, "addr": 4843 }, { "b": "2)?Z%as8q7qBKAgar\u003ebqDR^v9uRJ%*k$11rl0)2KqHG/mas85EyH}xaj$*CTB$W-Qy?#fQBzbl6", "n": [ { "c": 2, "d": "Redirect to /dev/null", "i": "micro-behaviors/os/console/io::redirect-dev-null", "o": 4917, "z": 10, "cf": 0.5 } ], "ln": 194, "addr": 4873 }, { "b": "2)*]0", "ln": 195, "addr": 4934 }, { "b": "2)\u003efVB7C", "ln": 196, "addr": 4939 }, { "b": "2)*[A340!8vrl05bXgm]y**%$iWw6eogJtRpFKwJm\u003c8I-", "ln": 245, "addr": 6066 }, { "b": "2)*[A2{puuw?2?\u003eD[4g5wPGp", "ln": 246, "addr": 6103 }, { "b": "2)*[A2)?(7qCxLJqHGVtA3cApx(UsKj$*CTB$W-Qy?$kwD(%XYr8MZ+Eld", "n": [ { "c": 2, "d": "Stderr redirected to /dev/null", "i": "micro-behaviors/os/console/io::stderr-to-dev-null", "o": 6146, "z": 11, "cf": 0.6000000238418579 } ], "ln": 247, "addr": 6123 }, { "b": "2)*[A2)\u0026WP", "ln": 248, "addr": 6170 }, { "b": "2)*[A2{pv4B75MuaBK", "ln": 249, "addr": 6179 }, { "b": "2{QM\u003cwOkZ#By/FnB7/c3y\u0026Z.kzxHPzByM$BxK#0@B1N", "ln": 518, "addr": 12335 }, { "b": "2{P", "ln": 519, "addr": 12370 }, { "b": "2{:\u003c%mn)flar.\u003cVCPXQ(d]O#coIuNRD\u0026", "n": [ { "c": 2, "d": "SHELL environment variable", "i": "micro-behaviors/os/env/vars/system-info::shell-var", "o": 12390, "z": 5, "cf": 0.5 } ], "ln": 520, "addr": 12373 }, { "b": "2)\u0026jqd]O#coIuM{l{@dyDR^v9uRJ%*k$11rl0)2KqHF", "ln": 521, "addr": 12399 }, { "b": "2{:\u003c%mn)flar.\u003cVCPXQ(d]O#coIuNRD\u0026", "ln": 522, "addr": 12434 } ], "depth": 1, "facts": { "imp": [ [ "", "shift" ], [ "", "shift" ], [ "", "{PWD_CMD}" ], [ "", "{CAT}" ], [ "", "{SED}" ], [ "", "{CHMOD}" ], [ "", "{SH}" ], [ "", "{TEST}" ], [ "", "./+USERGROUP" ], [ "", "./+USERGROUP" ], [ "", "./+USERGROUP" ], [ "", "./+USERGROUP" ], [ "", "exit" ], [ "", "exit" ], [ "", "{TEST}" ], [ "", "./+DIRS" ], [ "", "./+DIRS" ], [ "", "{TEST}" ], [ "", "./+DIRS" ], [ "", "./+DIRS" ], [ "", "{TEST}" ], [ "", "./+SHLIBS" ], [ "", "./+SHLIBS" ], [ "", "{TEST}" ], [ "", "./+FILES" ], [ "", "./+FILES" ], [ "", "{TEST}" ], [ "", "./+FILES" ], [ "", "./+FILES" ], [ "", "{TEST}" ], [ "", "./+PERMS" ], [ "", "./+PERMS" ], [ "", "{TEST}" ], [ "", "./+FONTS" ], [ "", "./+FONTS" ], [ "", "{TEST}" ], [ "", "./+ICON_THEMES" ], [ "", "./+ICON_THEMES" ], [ "", "{TEST}" ], [ "", "./+DIRS" ], [ "", "./+DIRS" ], [ "", "{TEST}" ], [ "", "./+DIRS" ], [ "", "./+DIRS" ], [ "", "{TEST}" ], [ "", "./+FILES" ], [ "", "./+FILES" ], [ "", "{TEST}" ], [ "", "./+FILES" ], [ "", "./+FILES" ], [ "", "{TEST}" ], [ "", "./+SHELL" ], [ "", "./+SHELL" ], [ "", "{TEST}" ], [ "", "./+SHELL" ], [ "", "./+SHELL" ], [ "", "{TEST}" ], [ "", "./+INFO_FILES" ], [ "", "./+INFO_FILES" ], [ "", "{TEST}" ], [ "", "./+OCAML_FINDLIB_REGISTER" ], [ "", "./+OCAML_FINDLIB_REGISTER" ], [ "", "exit" ], [ "", "exit" ] ], "tgt": [ "${CAT}", "${CHMOD}", "${PWD_CMD}", "${SED}", "${SH}", "${TEST}", "./+DIRS", "./+FILES", "./+FONTS", "./+ICON_THEMES", "./+INFO_FILES", "./+OCAML_FINDLIB_REGISTER", "./+PERMS", "./+SHELL", "./+SHLIBS", "./+USERGROUP", ":", "exit", "shift" ], "metrics": { "ast": { "max_depth": 9.0, "bind_count": 55.0, "call_count": 45.0, "node_count": 927.0, "identifier_count": 84.0, "string_literal_count": 55.0 }, "file": { "size": 12848.0, "entropy": 5.65, "size_bytes": 12848.0 }, "text": { "tab_count": 737.0, "digit_ratio": 0.02, "space_count": 1034.0, "total_lines": 542.0, "char_entropy": 5.65, "mixed_indent": 1.0, "unique_chars": 93.0, "string_density": 0.1, "ascii_art_lines": 6.0, "avg_line_length": 22.7, "max_line_length": 88.0, "empty_line_ratio": 0.06, "last_line_length": 23.0, "whitespace_ratio": 0.18, "most_common_ratio": 0.05, "identifier_density": 0.46, "line_length_stddev": 20.27, "normalized_string_count": 2.36, "repeated_char_sequences": 6.0, "suspicious_string_ratio": 0.02, "most_common_char_is_null": 0.0, "suspicious_comment_ratio": 0.07, "max_inline_whitespace_run": 8.0, "most_common_char_codepoint": 101.0, "normalized_unique_identifiers": 9.91 }, "binds": { "count": 55.0 }, "calls": { "count": 45.0, "dynamic_target_count": 22.0 }, "binary": { "overall_entropy": 5.65, "peak_region_bytes": 8752.0, "peak_region_entropy": 5.69 }, "strings": { "total": 55.0, "avg_length": 10.8, "max_length": 40.0, "path_count": 40.0, "avg_entropy": 2.88, "empty_count": 2.0, "total_bytes": 594.0, "entropy_stddev": 0.67, "shell_command_strings": 1.0 }, "comments": { "chars": 2565.0, "lines": 54.0, "total": 87.0, "to_code_ratio": 0.11, "empty_comments": 33.0, "high_entropy_comments": 6.0 }, "identifiers": { "count": 84.0, "total": 251.0, "avg_length": 6.21, "max_length": 25.0, "min_length": 1.0, "avg_entropy": 2.19, "reuse_ratio": 0.36, "unique_count": 90.0, "length_stddev": 4.28, "has_digit_ratio": 0.06, "single_char_count": 5.0, "single_char_ratio": 0.06, "high_entropy_count": 5.0, "high_entropy_ratio": 0.06, "all_lowercase_ratio": 0.03, "all_uppercase_ratio": 0.66, "numeric_suffix_count": 1.0, "underscore_prefix_count": 1.0 } } }, "id": 2, "mol": "O(As)H(Po₂)", "path": "/data/samples/good/foraged/netbsd/netbsd.org/_/hunspell-fr_FR-2.3.2/hunspell-fr_FR-2.3.2.tgz!!+INSTALL", "risk": 4, "sha": "3cfbce4fb68f725fbdf208a62ce5477949311a0ffbdd8e6cf0547a3889c2e73d", "size": 12848, "traits": [ { "id": "objectives/anti-static/obfuscation/code-metrics/structure::sh-guarded-env-expansion", "atk": "T1027", "mbc": "B0032", "conf": 0.8500000238418579, "crit": 3, "desc": "Guarded shell parameter expansion", "spans": [ [ 1196, 14 ] ] }, { "id": "micro-behaviors/os/env/vars/access::env-cmd", "atk": "T1082", "conf": 0.6000000238418579, "crit": 3, "desc": "env command path", "spans": [ [ 724, 12 ] ] }, { "id": "objectives/credential-access/theft/keywords::token", "conf": 0.30000001192092896, "crit": 1, "desc": "Credential-access vocabulary word: token", "spans": [ [ 4682, 5 ] ] }, { "id": "micro-behaviors/process/create/shell/spawn::bin-sh", "atk": "T1059.004", "mbc": "E1059.004", "conf": 0.6000000238418579, "crit": 3, "desc": "References /bin/sh (Bourne shell)", "spans": [ [ 742, 7 ] ] }, { "id": "micro-behaviors/process/interpreter/perl::perl-keyword", "conf": 0.699999988079071, "crit": 3, "desc": "perl interpreter keyword (beyond shebang)", "spans": [ [ 578, 4 ] ] }, { "id": "micro-behaviors/process/create/shell/spawn::sh-dynamic-command-target", "conf": 0.6000000238418579, "crit": 3, "desc": "Shell command name from variable", "spans": [ [ 0, 34 ] ] }, { "id": "micro-behaviors/process/create/shell/spawn::shell-symbols", "conf": 0.8999999761581421, "crit": 3, "desc": "Shell execution symbols", "spans": [ [ 0, 34 ], [ 742, 7 ] ] } ], "type": "shell" }, { "depth": 1, "facts": { "metrics": { "file": { "size": 13005.0, "entropy": 4.7, "size_bytes": 13005.0 }, "binary": { "overall_entropy": 4.7, "peak_region_bytes": 8909.0, "peak_region_entropy": 4.8 } } }, "id": 3, "path": "/data/samples/good/foraged/netbsd/netbsd.org/_/hunspell-fr_FR-2.3.2/hunspell-fr_FR-2.3.2.tgz!!share/doc/hunspell-fr_FR/README_fr_FR.txt", "sha": "a301a40dec855e384c3ba0f2eb85703a4ad1d43d506412d850a046a4acdf06a5", "size": 13005, "traits": [ { "id": "metadata/file/extension/identity::doc-or-config-extension", "conf": 1.0, "crit": 1, "desc": "Document or config file extension", "spans": [ [ 0, 16 ] ] } ], "type": "text" } ], "rev": "299a3", "v": "8" } }