{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 0.17375501990318298,
        "class": 0
      }
    ],
    "prob": 0.17375502,
    "class": 0,
    "models": [
      {
        "m": "az",
        "prob": 0.17375502,
        "class": 0
      },
      {
        "m": "az/scripts",
        "prob": 0.02791474,
        "class": 0
      },
      {
        "m": "az/shell",
        "prob": 0.005129011,
        "class": 0
      }
    ],
    "version": "v16.16",
    "thresholds": [
      0.9961138,
      0.99909174
    ],
    "analyzed_at": "2026-05-10T02:44:38Z"
  },
  "path": "fetch_test_image.sh",
  "raw": {
    "v": "4",
    "fs": [
      {
        "f": "H(Cm)Md(Pt)",
        "k": {
          "source.shebang": "/usr/bin/env bash",
          "source.imports[0]": "cd",
          "source.imports[1]": "curl",
          "source.imports[2]": "dirname",
          "source.imports[3]": "echo",
          "source.imports[4]": "mkdir",
          "source.imports[5]": "mv",
          "source.imports[6]": "pwd",
          "source.imports[7]": "set",
          "source.strings[0]": " cloud image...",
          "source.strings[1]": "$(cd \"$(dirname \"$0\")/..\" \u0026\u0026 pwd)",
          "source.strings[2]": "$(dirname \"$0\")/..",
          "source.strings[3]": "$IMG_DIR",
          "source.strings[4]": "$IMG_DIR/ubuntu-${VERSION}.img",
          "source.strings[5]": "$IMG_PATH",
          "source.strings[6]": "$IMG_PATH.tmp",
          "source.strings[7]": "$IMG_URL",
          "source.strings[8]": "$ROOT/tests/qemu/images",
          "source.strings[9]": "${1:-${UBUNTU_VERSION:-26.04}}",
          "source.has_imports": true,
          "source.strings[10]": "-server-cloudimg-amd64.img",
          "source.strings[11]": "/release/ubuntu-",
          "source.strings[12]": "/tests/qemu/images",
          "source.strings[13]": "/ubuntu-",
          "source.strings[14]": "[fetch] Downloading Ubuntu ",
          "source.strings[15]": "[fetch] Downloading Ubuntu ${VERSION} cloud image...",
          "source.strings[16]": "https://cloud-images.ubuntu.com/releases/",
          "source.strings[17]": "https://cloud-images.ubuntu.com/releases/${VERSION}/release/ubuntu-${VERSION}-server-cloudimg-amd64.img"
        },
        "x": 3,
        "id": 0,
        "is": [
          "set",
          "set",
          "cd",
          "cd",
          "dirname",
          "dirname",
          "pwd",
          "pwd",
          "mkdir",
          "mkdir",
          "echo",
          "echo",
          "curl",
          "curl",
          "mv",
          "mv",
          "echo",
          "echo"
        ],
        "ms": {
          "file": {
            "size": 762.0
          },
          "text": {
            "digit_ratio": 0.03,
            "space_count": 77.0,
            "total_lines": 22.0,
            "char_entropy": 5.51,
            "unique_chars": 70.0,
            "import_density": 81.82,
            "string_density": 1.18,
            "avg_line_length": 33.64,
            "max_line_length": 113.0,
            "empty_line_ratio": 0.18,
            "last_line_length": 16.0,
            "long_token_count": 1.0,
            "most_common_char": "e",
            "whitespace_ratio": 0.13,
            "most_common_ratio": 0.05,
            "line_length_stddev": 27.22,
            "normalized_import_count": 3.84,
            "normalized_string_count": 5.54,
            "suspicious_string_ratio": 0.08,
            "suspicious_comment_ratio": 0.4,
            "max_inline_whitespace_run": 3.0
          },
          "imports": {
            "total": 18.0,
            "unique_modules": 8.0,
            "third_party_count": 18.0,
            "third_party_ratio": 1.0
          },
          "strings": {
            "total": 26.0,
            "url_count": 2.0,
            "avg_length": 20.23,
            "max_length": 103.0,
            "path_count": 4.0,
            "avg_entropy": 3.27,
            "total_bytes": 526.0,
            "entropy_stddev": 1.03,
            "shell_command_strings": 2.0
          },
          "comments": {
            "chars": 232.0,
            "lines": 5.0,
            "total": 5.0,
            "to_code_ratio": 0.29,
            "high_entropy_comments": 2.0
          },
          "functions": {},
          "identifiers": {}
        },
        "ss": [
          [
            269,
            "${1:-${UBUNTU_VERSION:-26.04}}"
          ],
          [
            308,
            "$(cd \"$(dirname \"$0\")/..\" \u0026\u0026 pwd)"
          ],
          [
            314,
            "$(dirname \"$0\")/.."
          ],
          [
            325,
            "$0"
          ],
          [
            330,
            "/.."
          ],
          [
            352,
            "$ROOT/tests/qemu/images"
          ],
          [
            358,
            "/tests/qemu/images"
          ],
          [
            387,
            "$IMG_DIR"
          ],
          [
            407,
            "https://cloud-images.ubuntu.com/releases/${VERSION}/release/ubuntu-${VERSION}-server-cloudimg-amd64.img"
          ],
          [
            408,
            "https://cloud-images.ubuntu.com/releases/"
          ],
          [
            459,
            "/release/ubuntu-"
          ],
          [
            485,
            "-server-cloudimg-amd64.img"
          ],
          [
            522,
            "$IMG_DIR/ubuntu-${VERSION}.img"
          ],
          [
            531,
            "/ubuntu-"
          ],
          [
            549,
            ".img"
          ],
          [
            566,
            "$IMG_PATH"
          ],
          [
            595,
            "[fetch] Downloading Ubuntu ${VERSION} cloud image..."
          ],
          [
            596,
            "[fetch] Downloading Ubuntu "
          ],
          [
            633,
            " cloud image..."
          ],
          [
            680,
            "$IMG_PATH.tmp"
          ],
          [
            690,
            ".tmp"
          ],
          [
            696,
            "$IMG_URL"
          ],
          [
            714,
            "$IMG_PATH.tmp"
          ],
          [
            724,
            ".tmp"
          ],
          [
            730,
            "$IMG_PATH"
          ],
          [
            750,
            "$IMG_PATH"
          ]
        ],
        "sz": 762,
        "ts": [
          {
            "c": 1.0,
            "d": "Bash shell shebang line",
            "e": [
              "#!/usr/bin/env bash"
            ],
            "i": "metadata/lang/shebang::bash",
            "l": 3
          },
          {
            "a": "T1105",
            "c": 0.699999988079071,
            "d": "curl command keyword",
            "e": [
              "curl"
            ],
            "i": "micro-behaviors/communications/http/download/curl::curl-keyword",
            "l": 1
          },
          {
            "c": 0.75,
            "d": "Tiny multi-line text script",
            "e": [
              "text.total_lines = 22.00"
            ],
            "i": "metadata/file/text/profile::tiny-text-script",
            "l": 2
          },
          {
            "c": 0.30000001192092896,
            "d": "curl command",
            "e": [
              "curl -f"
            ],
            "i": "micro-behaviors/communications/http/download/curl::curl-cmd-dup",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "Generic env-based shebang line",
            "e": [
              "#!/usr/bin/env bash"
            ],
            "i": "metadata/lang/shebang::env-interpreter",
            "l": 2
          },
          {
            "a": "T1105",
            "c": 0.699999988079071,
            "d": "curl command",
            "e": [
              " curl "
            ],
            "i": "micro-behaviors/communications/http/download/curl::curl-cmd",
            "l": 3
          },
          {
            "a": "T1105",
            "c": 0.699999988079071,
            "d": "curl download to file",
            "e": [
              "curl -fL --retry 3 -o"
            ],
            "i": "micro-behaviors/communications/http/download/curl::curl-output-file",
            "l": 3
          },
          {
            "c": 0.8999999761581421,
            "d": "HTTPS protocol prefix",
            "e": [
              "https://"
            ],
            "i": "micro-behaviors/communications/http/protocol::https-prefix",
            "l": 2
          },
          {
            "c": 0.800000011920929,
            "d": "Invokes mkdir",
            "e": [
              "mkdir"
            ],
            "i": "micro-behaviors/process/create/tool::mkdir-invocation",
            "l": 1
          },
          {
            "a": "T1105",
            "c": 0.800000011920929,
            "d": "curl silent flags",
            "e": [
              "curl -fL"
            ],
            "i": "micro-behaviors/communications/http/download/curl::curl-silent",
            "l": 3
          },
          {
            "a": "T1110.001",
            "c": 0.8500000238418579,
            "d": "Service account ubuntu",
            "e": [
              "ubuntu"
            ],
            "i": "objectives/lateral-movement/brute-force/password::service-account-ubuntu",
            "l": 1,
            "m": "E1110"
          },
          {
            "a": "T1027",
            "c": 0.9399999976158142,
            "d": "Regex component marker",
            "e": [
              "amd64"
            ],
            "i": "objectives/anti-static/obfuscation/payload/config::arch-keyed-hex-blob-dict--rx-18",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1195.002",
            "c": 0.9800000190734863,
            "d": "Regex component marker",
            "e": [
              " curl "
            ],
            "i": "objectives/supply-chain/trojanized/build-pipeline::gha-curl-extraheader-post--rx-5",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "High density of shell commands",
            "e": [
              "text.import_density = 81.82"
            ],
            "i": "metadata/binary/metrics/text-density::shell-high-import-density",
            "l": 2
          }
        ],
        "sha": "3f627b6f99cde3a0babe1e5ebc0fa28d63a9fda1f866f628cea55322cd169d39",
        "path": "fetch_test_image.sh",
        "type": "shell"
      }
    ],
    "tv": "d376d"
  }
}