{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 0.9411555528640747,
        "class": 0
      }
    ],
    "prob": 0.94115555,
    "class": 0,
    "version": "v16.16",
    "thresholds": [
      0.9815004,
      0.99404883
    ],
    "analyzed_at": "2026-04-30T06:46:26Z"
  },
  "path": "EVP_md5.3",
  "raw": {
    "v": "4",
    "fs": [
      {
        "f": "O₂(As₂S)Md(Pa)",
        "x": 1,
        "id": 0,
        "ms": {
          "text": {
            "digit_ratio": 0.04,
            "space_count": 473.0,
            "total_lines": 116.0,
            "char_entropy": 5.31,
            "unique_chars": 85.0,
            "string_density": 0.68,
            "ascii_art_lines": 2.0,
            "avg_line_length": 27.87,
            "max_line_length": 94.0,
            "last_line_length": 46.0,
            "most_common_char": "e",
            "whitespace_ratio": 0.18,
            "most_common_ratio": 0.06,
            "identifier_density": 0.59,
            "line_length_stddev": 25.42,
            "normalized_string_count": 7.33,
            "repeated_char_sequences": 4.0,
            "suspicious_string_ratio": 0.03,
            "max_inline_whitespace_run": 12.0,
            "suspicious_identifier_ratio": 0.13,
            "normalized_unique_identifiers": 8.17
          },
          "strings": {
            "total": 79.0,
            "avg_length": 33.19,
            "max_length": 311.0,
            "avg_entropy": 2.67,
            "total_bytes": 2622.0,
            "entropy_stddev": 1.54,
            "high_entropy_count": 1.0,
            "shell_command_strings": 1.0,
            "embedded_code_candidates": 1.0
          },
          "comments": {},
          "functions": {},
          "identifiers": {
            "total": 69.0,
            "avg_length": 4.45,
            "max_length": 13.0,
            "min_length": 1.0,
            "avg_entropy": 1.69,
            "reuse_ratio": 0.81,
            "unique_count": 56.0,
            "length_stddev": 2.8,
            "sequential_names": 6.0,
            "single_char_count": 6.0,
            "single_char_ratio": 0.11,
            "all_lowercase_ratio": 0.59,
            "all_uppercase_ratio": 0.09,
            "repeated_char_names": 1.0
          }
        },
        "ss": [
          [
            218,
            " Vertical space (when we can't use .PP)"
          ],
          [
            294,
            " Begin verbatim text"
          ],
          [
            347,
            " End verbatim text"
          ],
          [
            387,
            " and \\*(C' are quotes in nroff, nothing in troff, for use with C\u003c\u003e.\n.ie n \\{\\\n.    ds C"
          ],
          [
            388,
            " and "
          ],
          [
            395,
            "(C' are quotes in nroff, nothing in troff, for use with C\u003c\u003e.\n.ie n "
          ],
          [
            466,
            ".    ds C"
          ],
          [
            489,
            " \"\"\n"
          ],
          [
            490,
            " "
          ],
          [
            517,
            "\n.    ds C'\n'br"
          ],
          [
            534,
            "\n."
          ],
          [
            538,
            "\n."
          ],
          [
            542,
            " Escape single quotes in literal strings from groff's Unicode transform.\n.ie "
          ],
          [
            621,
            "(.g .ds Aq "
          ],
          [
            634,
            "aq\n.el       .ds Aq '\n."
          ],
          [
            659,
            "\n."
          ],
          [
            663,
            " If the F register is \u003e0, we'll generate index entries on stderr for\n."
          ],
          [
            735,
            " titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index\n."
          ],
          [
            810,
            " entries marked with X\u003c\u003e in POD.  Of course, you'll have to process the\n."
          ],
          [
            885,
            " output yourself in some meaningful fashion.\n."
          ],
          [
            933,
            "\n."
          ],
          [
            937,
            " Avoid warning from groff about undefined register 'F'.\n.de IX\n..\n.nr rF 0\n.if "
          ],
          [
            1018,
            "(.g .if rF .nr rF 1\n.if ("
          ],
          [
            1045,
            "(rF:("
          ],
          [
            1052,
            "(.g==0)) "
          ],
          [
            1065,
            ".    if "
          ],
          [
            1075,
            "F "
          ],
          [
            1081,
            ".        de IX\n.        tm Index:"
          ],
          [
            1116,
            "$1"
          ],
          [
            1122,
            "n%"
          ],
          [
            1129,
            "$2\"\n..\n.        if !"
          ],
          [
            1151,
            "F==2 "
          ],
          [
            1160,
            ".            nr % 0\n.            nr F 2\n.        "
          ],
          [
            1211,
            "\n.    "
          ],
          [
            1219,
            "\n."
          ],
          [
            1223,
            "\n.rr rF\n."
          ],
          [
            1234,
            " ========================================================================\n."
          ],
          [
            1311,
            "\n.IX Title \"EVP_MD5 3ossl\"\n.TH EVP_MD5 3ossl 2025-09-30 3.5.4 OpenSSL\n."
          ],
          [
            1384,
            " For nroff, turn off justification.  Always turn off hyphenation; it makes\n."
          ],
          [
            1462,
            " way too many mistakes in technical documents.\n.if n .ad l\n.nh\n.SH NAME\nEVP_md5,\nEVP_md5_sha1\n"
          ],
          [
            1560,
            " MD5 For EVP\n.SH SYNOPSIS\n.IX Header \"SYNOPSIS\"\n.Vb 1\n"
          ],
          [
            1616,
            " #include \u003copenssl/evp.h\u003e\n"
          ],
          [
            1644,
            "\n"
          ],
          [
            1647,
            " const EVP_MD *EVP_md5(void);\n"
          ],
          [
            1679,
            " const EVP_MD *EVP_md5_sha1(void);\n.Ve\n.SH DESCRIPTION\n.IX Header \"DESCRIPTION\"\nMD5 is a cryptographic hash function standardize"
          ],
          [
            1992,
            "BEVP_md5()"
          ],
          [
            2004,
            "R 4\n.IX Item \"EVP_md5()\"\nThe MD5 algorithm which produces a 128"
          ],
          [
            2069,
            "bit output from a given input.\n.IP "
          ],
          [
            2106,
            "BEVP_md5_sha1()"
          ],
          [
            2123,
            "R 4\n.IX Item \"EVP_md5_sha1()\"\nA hash algorithm of SSL v3 that combines MD5 with SHA"
          ],
          [
            2208,
            "1 as described in RFC\n6101.\n.Sp\nWARNING: this algorithm is not intended for non-SSL usage.\n.SH NOTES\n.IX Header \"NOTES\"\nDevelope"
          ],
          [
            2468,
            "BEVP_MD_fetch"
          ],
          [
            2483,
            "R"
          ],
          [
            2486,
            "(3) with "
          ],
          [
            2497,
            "BEVP_MD"
          ],
          [
            2506,
            "MD5"
          ],
          [
            2511,
            "R"
          ],
          [
            2514,
            "(7) or "
          ],
          [
            2523,
            "BEVP_MD"
          ],
          [
            2532,
            "MD5"
          ],
          [
            2537,
            "SHA1"
          ],
          [
            2543,
            "R"
          ],
          [
            2546,
            "(7) instead.\nSee \"Performance\" in "
          ],
          [
            2582,
            "Bcrypto"
          ],
          [
            2591,
            "R"
          ],
          [
            2594,
            "(7) for further information.\n.SH \"RETURN VALUES\"\n.IX Header \"RETURN VALUES\"\nThese functions return a "
          ],
          [
            2697,
            "BEVP_MD"
          ],
          [
            2706,
            "R structure that contains the\nimplementation of the message digest. See "
          ],
          [
            2780,
            "BEVP_MD_meth_new"
          ],
          [
            2798,
            "R"
          ],
          [
            2801,
            "(3) for\ndetails of the "
          ],
          [
            2826,
            "BEVP_MD"
          ],
          [
            2835,
            "R structure.\n.SH \"CONFORMING TO\"\n.IX Header \"CONFORMING TO\"\nIETF RFC 1321.\n.SH \"SEE ALSO\"\n.IX Header \"SEE ALSO\"\n"
          ],
          [
            2951,
            "Bevp"
          ],
          [
            2957,
            "R"
          ],
          [
            2960,
            "(7),\n"
          ],
          [
            2969,
            "BEVP_DigestInit"
          ],
          [
            2986,
            "R"
          ],
          [
            2989,
            "(3)\n.SH COPYRIGHT\n.IX Header \"COPYRIGHT\"\nCopyright 2017"
          ]
        ],
        "sz": 3349,
        "ts": [
          {
            "c": 0.8999999761581421,
            "d": "ES6 const/let declarations",
            "e": [
              "const E",
              "const E"
            ],
            "i": "metadata/lang/javascript-features::const-let",
            "l": 2
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "Low string density base64 context",
            "e": [
              "text.string_density = 0.68"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics::js-base64-candidate-low-string-density",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 1.0,
            "d": "Path-like string pattern",
            "e": [
              "x:\\\\$1\\t\\\\n%\\t\"\\\\$2\""
            ],
            "i": "micro-behaviors/data/text/malware::path-like-pattern",
            "l": 2
          },
          {
            "c": 0.8999999761581421,
            "d": "Unix manual page or bundled manpage example",
            "e": [
              "EVP_md5.3"
            ],
            "i": "metadata/package/documentation::unix-manpage",
            "l": 2
          },
          {
            "c": 0.20000000298023224,
            "d": "crypto keyword (substr, catches imports)",
            "e": [
              "crypto"
            ],
            "i": "micro-behaviors/data/text/keywords::crypto-substr",
            "l": 1
          },
          {
            "c": 0.20000000298023224,
            "d": "output keyword",
            "e": [
              "output"
            ],
            "i": "micro-behaviors/data/text/keywords::output",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "File has 30 or more lines",
            "e": [
              "text.total_lines = 116.00"
            ],
            "i": "metadata/package/metrics::file-has-30-plus-lines",
            "l": 1
          },
          {
            "c": 0.30000001192092896,
            "d": "stderr string reference",
            "e": [
              " If the F register is \u003e0, we'll generate index entries on stderr for\n."
            ],
            "i": "micro-behaviors/process/fd/stdio::stderr-string",
            "l": 2
          },
          {
            "a": "T1027",
            "c": 0.6000000238418579,
            "d": "No comments in code",
            "e": [
              "comments.total = 0.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/structure::no-comments",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.800000011920929,
            "d": "Sequential identifiers (a, b, c,",
            "e": [
              "identifiers.sequential_names = 6.00"
            ],
            "i": "objectives/anti-static/obfuscation/code-metrics/identifiers::sequential-identifiers",
            "l": 2,
            "m": "B0032"
          },
          {
            "c": 0.699999988079071,
            "d": "Small file under 5KB",
            "e": [
              "EVP_md5.3"
            ],
            "i": "objectives/supply-chain/metadata-anomaly/markers/npm::small-file-5k",
            "l": 1
          }
        ],
        "sha": "4aedea77f932d7136b7f6f928cbfdfc6a370e9c39f73e0ac595ef42a27449a8f",
        "path": "/data/samples/good/freebsd/usr/src/secure/lib/libcrypto/man/man3/EVP_md5.3",
        "type": "javascript"
      }
    ],
    "tv": "f6eaa"
  }
}