{
  "ml": {
    "l": -1,
    "v": "6",
    "fs": [
      {
        "l": -1,
        "id": 0,
        "prob": 0.000023911396056064405
      }
    ],
    "prob": 0.000023911396,
    "models": [
      {
        "m": "az",
        "raw": 0.000023911396,
        "prob": 0.000023911396,
        "class": 0
      },
      {
        "m": "az/source",
        "raw": 0.00024068356,
        "prob": 0.00024068356,
        "class": 0
      },
      {
        "m": "az/c",
        "raw": 0.0001116097,
        "prob": 0.0001116097,
        "class": 0
      }
    ],
    "version": "v17.17",
    "analyzed_at": "2026-06-08T14:22:42Z"
  },
  "path": "init.c",
  "raw": {
    "v": "6",
    "fs": [
      {
        "f": "O(Er)H(Os)",
        "x": 2,
        "ff": {
          "i": [
            [
              "",
              "MODULE_LICENSE"
            ],
            [
              "",
              "MODULE_AUTHOR"
            ],
            [
              "",
              "MODULE_VERSION"
            ],
            [
              "",
              "MODULE_DESCRIPTION"
            ],
            [
              "",
              "printk"
            ],
            [
              "",
              "core_start"
            ],
            [
              "",
              "core_stop"
            ],
            [
              "",
              "printk"
            ],
            [
              "",
              "module_init"
            ],
            [
              "",
              "module_exit"
            ],
            [
              "",
              "\u003clinux/init.h\u003e"
            ],
            [
              "",
              "\u003clinux/kernel.h\u003e"
            ],
            [
              "",
              "\u003clinux/module.h\u003e"
            ],
            [
              "",
              "core.h"
            ]
          ],
          "m": {
            "ast": {
              "max_depth": 8.0,
              "call_count": 10.0,
              "node_count": 154.0,
              "identifier_count": 14.0,
              "string_literal_count": 7.0
            },
            "file": {
              "size": 557.0,
              "entropy": 5.28,
              "size_bytes": 557.0
            },
            "text": {
              "digit_ratio": 0.01,
              "space_count": 49.0,
              "total_lines": 29.0,
              "char_entropy": 5.28,
              "unique_chars": 59.0,
              "string_density": 0.24,
              "avg_line_length": 18.21,
              "max_line_length": 79.0,
              "empty_line_ratio": 0.28,
              "last_line_length": 22.0,
              "whitespace_ratio": 0.14,
              "most_common_ratio": 0.07,
              "identifier_density": 0.62,
              "line_length_stddev": 20.58,
              "normalized_string_count": 1.3,
              "most_common_char_is_null": 0.0,
              "max_inline_whitespace_run": 1.0,
              "trailing_whitespace_lines": 2.0,
              "most_common_char_codepoint": 105.0,
              "normalized_unique_identifiers": 2.88
            },
            "calls": {
              "count": 10.0
            },
            "binary": {
              "overall_entropy": 5.28
            },
            "source": {
              "function_count": 2.0
            },
            "imports": {
              "count": 4.0,
              "unique_modules": 4.0,
              "third_party_count": 4.0,
              "third_party_ratio": 1.0
            },
            "strings": {
              "total": 7.0,
              "avg_length": 21.71,
              "max_length": 56.0,
              "avg_entropy": 3.04,
              "total_bytes": 152.0,
              "entropy_stddev": 1.16
            },
            "functions": {
              "count": 2.0
            },
            "identifiers": {
              "count": 14.0,
              "total": 18.0,
              "avg_length": 10.29,
              "max_length": 18.0,
              "min_length": 6.0,
              "avg_entropy": 3.0,
              "reuse_ratio": 0.78,
              "unique_count": 14.0,
              "length_stddev": 3.41,
              "high_entropy_count": 2.0,
              "high_entropy_ratio": 0.14,
              "all_lowercase_ratio": 0.64,
              "all_uppercase_ratio": 0.36,
              "underscore_prefix_count": 2.0
            }
          },
          "s": [
            [
              9,
              "u8",
              "core.h"
            ],
            [
              10,
              "u8",
              "core.h"
            ],
            [
              28,
              "u8",
              "\u003clinux/module.h\u003e"
            ],
            [
              54,
              "u8",
              "\u003clinux/kernel.h\u003e"
            ],
            [
              81,
              "u8",
              "\u003clinux/init.h\u003e"
            ],
            [
              112,
              "u8",
              "GPL"
            ],
            [
              113,
              "u8",
              "GPL"
            ],
            [
              134,
              "u8",
              "spiderpig"
            ],
            [
              135,
              "u8",
              "spiderpig"
            ],
            [
              163,
              "u8",
              "1.0.0"
            ],
            [
              164,
              "u8",
              "1.0.0"
            ],
            [
              192,
              "u8",
              "an LKM for stealth send of files over ICMP communication"
            ],
            [
              193,
              "u8",
              "an LKM for stealth send of files over ICMP communication"
            ],
            [
              300,
              "u8",
              "KERN_DEBUG \"kfile-over-icmp: LKM loaded\\n"
            ],
            [
              311,
              "u8",
              "kfile-over-icmp: LKM loaded\\n"
            ],
            [
              312,
              "u8",
              "kfile-over-icmp: LKM loaded"
            ],
            [
              376,
              "10",
              "0"
            ],
            [
              448,
              "u8",
              "KERN_DEBUG \"kfile-over-icmp: LKM unloaded successfully\\n"
            ],
            [
              459,
              "u8",
              "kfile-over-icmp: LKM unloaded successfully\\n"
            ],
            [
              460,
              "u8",
              "kfile-over-icmp: LKM unloaded successfully"
            ]
          ],
          "v": {
            "file.stem": "init",
            "file.basename": "init.c",
            "source.language": "c",
            "source.imports[0]": "\u003clinux/init.h\u003e",
            "source.imports[1]": "\u003clinux/kernel.h\u003e",
            "source.imports[2]": "\u003clinux/module.h\u003e",
            "source.imports[3]": "MODULE_AUTHOR",
            "source.imports[4]": "MODULE_DESCRIPTION",
            "source.imports[5]": "MODULE_LICENSE",
            "source.imports[6]": "MODULE_VERSION",
            "source.imports[7]": "core.h",
            "source.imports[8]": "core_start",
            "source.imports[9]": "core_stop",
            "source.strings[0]": "\u003clinux/init.h\u003e",
            "source.strings[1]": "\u003clinux/kernel.h\u003e",
            "source.strings[2]": "\u003clinux/module.h\u003e",
            "source.strings[3]": "KERN_DEBUG \"kfile-over-icmp: LKM loaded\\n",
            "source.strings[4]": "KERN_DEBUG \"kfile-over-icmp: LKM unloaded successfully\\n",
            "source.strings[5]": "an LKM for stealth send of files over ICMP communication",
            "source.strings[6]": "core.h",
            "source.strings[7]": "kfile-over-icmp: LKM loaded",
            "source.strings[8]": "kfile-over-icmp: LKM loaded\\n",
            "source.strings[9]": "kfile-over-icmp: LKM unloaded successfully",
            "source.has_imports": true,
            "source.imports[10]": "module_exit",
            "source.imports[11]": "module_init",
            "source.imports[12]": "printk",
            "source.strings[10]": "kfile-over-icmp: LKM unloaded successfully\\n",
            "source.strings[11]": "spiderpig",
            "source.functions[0]": "mod_exit(void)",
            "source.functions[1]": "mod_init(void)"
          },
          "ct": [
            "MODULE_AUTHOR",
            "MODULE_DESCRIPTION",
            "MODULE_LICENSE",
            "MODULE_VERSION",
            "core_start",
            "core_stop",
            "module_exit",
            "module_init",
            "printk"
          ],
          "id": "c"
        },
        "id": 0,
        "sz": 557,
        "ts": [
          {
            "c": 0.8999999761581421,
            "d": "Registers Linux kernel module init",
            "e": [
              "module_init"
            ],
            "i": "micro-behaviors/os/kernel/module::linux-module-init-macro",
            "l": 3,
            "el": [
              "1ff"
            ]
          },
          {
            "a": "T1106",
            "c": 0.9900000095367432,
            "d": "Linux kernel module header include (linux/module.h)",
            "e": [
              "linux/module.h"
            ],
            "i": "micro-behaviors/os/syscall/invoke::kernel-module-include-detect",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "Registers Linux kernel module exit",
            "e": [
              "module_exit"
            ],
            "i": "micro-behaviors/os/kernel/module::linux-module-exit-macro",
            "l": 3,
            "el": [
              "216"
            ]
          },
          {
            "c": 0.800000011920929,
            "d": "Registers Linux kernel module exit",
            "e": [
              "module_exit"
            ],
            "i": "micro-behaviors/os/kernel/module::linux-module-exit-symbol",
            "l": 3,
            "el": [
              "216"
            ]
          },
          {
            "c": 0.30000001192092896,
            "d": "ICMP service/protocol reference",
            "e": [
              "ICMP"
            ],
            "i": "micro-behaviors/communications/ip/services::services-icmp",
            "l": 2
          },
          {
            "c": 0.800000011920929,
            "d": "Registers Linux kernel module init",
            "e": [
              "module_init"
            ],
            "i": "micro-behaviors/os/kernel/module::linux-module-init-symbol",
            "l": 3,
            "el": [
              "1ff"
            ]
          },
          {
            "c": 0.699999988079071,
            "d": "MODULE_AUTHOR declaration (attacker attribution)",
            "e": [
              "MODULE_AUTHOR"
            ],
            "i": "objectives/evasion/kernel-hide/lkm/headers::module-author-macro",
            "l": 2,
            "el": [
              "78"
            ]
          },
          {
            "c": 0.699999988079071,
            "d": "MODULE_DESCRIPTION declaration",
            "e": [
              "MODULE_DESCRIPTION"
            ],
            "i": "objectives/evasion/kernel-hide/lkm/headers::module-description-macro",
            "l": 2,
            "el": [
              "ad"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "Declares Linux kernel module license",
            "e": [
              "MODULE_LICENSE"
            ],
            "i": "micro-behaviors/os/kernel/module::linux-module-license-macro",
            "l": 2,
            "el": [
              "61"
            ]
          },
          {
            "c": 0.9900000095367432,
            "d": "Linux kernel module header detection",
            "e": [
              "\u003clinux/module.h\u003e"
            ],
            "i": "objectives/evasion/kernel-hide/lkm/headers::kernel-module-header-detect",
            "l": 2,
            "el": [
              "1c"
            ]
          },
          {
            "c": 0.699999988079071,
            "d": "printk kernel logging function",
            "e": [
              "printk"
            ],
            "i": "objectives/evasion/kernel-hide/module::printk-sym",
            "l": 3,
            "el": [
              "125"
            ]
          }
        ],
        "sha": "431e9c604fba3b8e745266dab7f6b2984e16b28fdf93b0f755271605411ea786",
        "path": "/data/samples/bad/projects/kfile-over-icmp/src/init.c",
        "type": "c"
      }
    ],
    "tv": "8e9ac"
  }
}