{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 0.8090397715568542,
        "class": 0
      }
    ],
    "prob": 0.8090398,
    "class": 0,
    "models": [
      {
        "m": "az",
        "prob": 0.52940357,
        "class": 0
      },
      {
        "m": "az/scripts",
        "prob": 0.4842748,
        "class": 0
      },
      {
        "m": "az/shell",
        "prob": 0.8090398,
        "class": 0
      }
    ],
    "version": "v16.16",
    "thresholds": [
      0.9961138,
      0.99909174
    ],
    "analyzed_at": "2026-05-09T16:01:30Z"
  },
  "path": "decode_body",
  "raw": {
    "v": "4",
    "fs": [
      {
        "f": "O₂(S₂Er)H(Db₂)Md₂(Pt)",
        "k": {
          "source.shebang": "/bin/bash",
          "source.imports[0]": "awk",
          "source.imports[1]": "base64",
          "source.imports[2]": "echo",
          "source.imports[3]": "fgrep",
          "source.imports[4]": "read",
          "source.strings[0]": "{print $4}",
          "source.has_imports": true
        },
        "x": 35,
        "id": 0,
        "is": [
          "fgrep",
          "fgrep",
          "awk",
          "awk",
          "read",
          "read",
          "echo",
          "echo",
          "base64",
          "base64",
          "base64",
          "base64",
          "echo",
          "echo"
        ],
        "ms": {
          "file": {
            "size": 138.0
          },
          "text": {
            "tab_count": 2.0,
            "digit_ratio": 0.05,
            "space_count": 17.0,
            "total_lines": 8.0,
            "char_entropy": 4.96,
            "unique_chars": 42.0,
            "import_density": 175.0,
            "string_density": 0.13,
            "avg_line_length": 16.25,
            "max_line_length": 49.0,
            "empty_line_ratio": 0.13,
            "last_line_length": 4.0,
            "most_common_char": "e",
            "whitespace_ratio": 0.2,
            "most_common_ratio": 0.07,
            "line_length_stddev": 17.53,
            "normalized_import_count": 4.95,
            "normalized_string_count": 0.35,
            "max_inline_whitespace_run": 1.0
          },
          "imports": {
            "total": 14.0,
            "unique_modules": 5.0,
            "third_party_count": 14.0,
            "third_party_ratio": 1.0
          },
          "strings": {
            "total": 1.0,
            "avg_length": 10.0,
            "max_length": 10.0,
            "avg_entropy": 3.32,
            "total_bytes": 10.0
          },
          "comments": {
            "chars": 10.0,
            "lines": 1.0,
            "total": 1.0,
            "to_code_ratio": 0.14
          },
          "functions": {},
          "identifiers": {}
        },
        "ss": [
          [
            48,
            "{print $4}"
          ]
        ],
        "sz": 138,
        "ts": [
          {
            "a": "T1027",
            "c": 0.4000000059604645,
            "d": "Base64 encoding used for obfuscation",
            "e": [
              "| base64"
            ],
            "i": "objectives/credential-access/capture/input::pipe-to-base64-encode",
            "l": 1
          },
          {
            "c": 0.6000000238418579,
            "d": "base64 -d/-D decode command",
            "e": [
              "base64 -d"
            ],
            "i": "micro-behaviors/data/decode/base64::base64-d-cmd",
            "l": 3
          },
          {
            "a": "T1036.008",
            "c": 0.949999988079071,
            "d": "File starts with bash/sh shebang",
            "e": [
              "#!/bin/bash"
            ],
            "i": "objectives/evasion/masquerade/extension/shebang::bash-shebang-first-line",
            "l": 1,
            "m": "F0008"
          },
          {
            "c": 0.699999988079071,
            "d": "base64 encoding keyword",
            "e": [
              "base64"
            ],
            "i": "micro-behaviors/data/text/encoded::base64-token",
            "l": 3
          },
          {
            "c": 0.949999988079071,
            "d": "Source references base64 (import or shell command)",
            "e": [
              "[awk, base64, echo, fgrep, read]"
            ],
            "i": "metadata/lang/source::imports-base64",
            "l": 2
          },
          {
            "c": 0.800000011920929,
            "d": "Double base64 encoding pattern",
            "e": [
              "| base64 -d | base64"
            ],
            "i": "objectives/supply-chain/recon-exfil/pipeline::double-base64-encode",
            "l": 4
          },
          {
            "d": "base64 tool reference",
            "e": [
              "base64"
            ],
            "i": "micro-behaviors/data/decode/base64::base64-tool",
            "l": 2
          },
          {
            "c": 0.800000011920929,
            "d": "Very short file (under 12 lines)",
            "e": [
              "text.total_lines = 8.00"
            ],
            "i": "metadata/file/text/metrics::file-under-12-lines",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Bash shell shebang line",
            "e": [
              "#!/bin/bash"
            ],
            "i": "metadata/lang/shebang::bash",
            "l": 3
          },
          {
            "a": "T1552.001, T1041",
            "c": 0.9200000166893005,
            "d": "Regex component marker",
            "e": [
              "base64"
            ],
            "i": "objectives/supply-chain/recon-exfil/ai-cli::github-content-base64-upload--rx-35",
            "l": 1,
            "m": "E1552"
          },
          {
            "c": 0.800000011920929,
            "d": "High density of shell commands",
            "e": [
              "text.import_density = 175.00"
            ],
            "i": "metadata/binary/metrics/text-density::shell-high-import-density",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "shell code embedded in string",
            "e": [
              "Detected shell at offset 0x0"
            ],
            "i": "metadata/lang/embedded::shell",
            "l": 2
          }
        ],
        "sha": "4d721f8279af7101d685bc812306aed1577916f65b6e0c5ac7cf5aa5f6481d58",
        "path": "decode_body",
        "type": "shell"
      }
    ],
    "tv": "0a4d2"
  }
}