{ "llm": { "conf": 0.05740434, "grade": "benign", "model": "Qwen/Qwen3.8-27B", "before": { "lvl": -1, "prob": 0.08567812, "class": "benign" }, "outcome": "benign", "interpretation": "Legitimate LaTeX package" }, "ml": { "v": "7", "eng": "2.12.0-beta.2", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.08567812, "rte": "az", "prob": 0.08567812 }, { "cls": 0, "raw": 0.012810926, "rte": "az/zip", "prob": 0.012810926 } ], "prob": 0.08567812, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.08567812293767929, "type": "zip" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.00002368291279708501, "type": "zip" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.000029752651244052686, "type": "shell" }, { "id": 7, "lvl": -1, "conf": 0, "prob": 0.000021805366486660205, "type": "pdf" }, { "id": 8, "lvl": -1, "conf": 0, "prob": 0.00001671910285949707, "type": "pdf" }, { "id": 9, "lvl": -1, "conf": 0, "prob": 0.000023404756575473584, "type": "pdf" }, { "id": 10, "lvl": -1, "conf": 0, "prob": 0.00001726547816360835, "type": "pdf" }, { "id": 11, "lvl": -1, "conf": 0, "prob": 0.000018358230590820312, "type": "pdf" }, { "id": 12, "lvl": -1, "conf": 0, "prob": 0.000023315349608310498, "type": "pdf" }, { "id": 13, "lvl": -1, "conf": 0, "prob": 0.000023643175154575147, "type": "pdf" }, { "id": 14, "lvl": -1, "conf": 0, "prob": 0.00002250075340270996, "type": "pdf" }, { "id": 48, "lvl": -1, "conf": 0, "prob": 0.000012656052604143042, "type": "postscript" }, { "id": 50, "lvl": -1, "conf": 0, "prob": 0.000012656052604143042, "type": "postscript" }, { "id": 242, "lvl": -1, "conf": 0, "prob": 0.00001181165407615481, "type": "png" }, { "id": 243, "lvl": -1, "conf": 0, "prob": 0.00001181165407615481, "type": "png" }, { "id": 257, "lvl": -1, "conf": 0, "prob": 0.000012656052604143042, "type": "postscript" }, { "id": 258, "lvl": -1, "conf": 0, "prob": 0.000012656052604143042, "type": "postscript" }, { "id": 275, "lvl": -1, "conf": 0, "prob": 0.000012656052604143042, "type": "postscript" }, { "id": 277, "lvl": -1, "conf": 0, "prob": 0.00001430511474609375, "type": "shell" }, { "id": 278, "lvl": -1, "conf": 0, "prob": 0.000019162893295288086, "type": "shell" }, { "id": 403, "lvl": -1, "conf": 0, "prob": 0.000011920928955078125, "type": "pdf" }, { "id": 408, "lvl": -1, "conf": 0, "prob": 0.000011920928955078125, "type": "pdf" }, { "id": 409, "lvl": -1, "conf": 0, "prob": 0.000011920928955078125, "type": "pdf" }, { "id": 468, "lvl": -1, "conf": 0, "prob": 0.000011920928955078125, "type": "pdf" }, { "id": 470, "lvl": -1, "conf": 0, "prob": 0.000012596447959367651, "type": "postscript" }, { "id": 471, "lvl": -1, "conf": 0, "prob": 0.000012656052604143042, "type": "postscript" }, { "id": 472, "lvl": -1, "conf": 0, "prob": 0.000011920928955078125, "type": "pdf" }, { "id": 473, "lvl": -1, "conf": 0, "prob": 0.000012656052604143042, "type": "postscript" }, { "id": 474, "lvl": -1, "conf": 0, "prob": 0.000012656052604143042, "type": "postscript" }, { "id": 475, "lvl": -1, "conf": 0, "prob": 0.000011920928955078125, "type": "pdf" }, { "id": 476, "lvl": -1, "conf": 0, "prob": 0.000012656052604143042, "type": "postscript" }, { "id": 478, "lvl": -1, "conf": 0, "prob": 0.00001681844332779292, "type": "postscript" }, { "id": 479, "lvl": -1, "conf": 0, "prob": 0.000013073285117570776, "type": "postscript" }, { "id": 519, "lvl": -1, "conf": 0, "prob": 0.000012775261893693823, "type": "text" }, { "id": 648, "lvl": -1, "conf": 0, "prob": 0.000012954075828019995, "type": "registry" } ], "version": "v18.18", "analyzed_at": "2026-10-04T14:32:12Z" }, "path": "caption-2023.9.8-1.src.rock", "raw": { "files": [ { "id": 0, "mol": "O₃(As₂ErXe)H₄(Cm₄F₆Po₄U)Md₄(Pa₃Pd₂Pt)", "sha": "4fa1d0b92f95589bb8909b64207c69b0ca3a1926fd78a7ee9059558f866993f2", "path": "caption-2023.9.8-1.src.rock", "risk": 16, "size": 3923608, "type": "zip", "facts": { "metrics": { "file": { "size": 3923608, "entropy": 8 }, "binary": { "peak_region_bytes": 3922944, "peak_region_entropy": 7.86 }, "archive": { "file_count": 2, "member_count": 2, "script_count": 0, "zip_bomb_ratio": 2.02, "compressed_size": 3923254, "directory_count": 0, "executable_count": 0, "extra_field_size": 72, "noise_file_count": 0, "compression.ratio": 0.97, "hidden_file_count": 0, "uncompressed_size": 4050206, "crc_collision_count": 0, "entry_comment_count": 0, "max_filename_length": 27, "rtlo_filename_count": 0, "format.regular_count": 2, "nested_archive_count": 1, "path_traversal_count": 0, "symlink_escape_count": 0, "security.setgid_count": 0, "security.setuid_count": 0, "security.sticky_count": 0, "double_extension_count": 0, "duplicate_member_count": 0, "security.symlink_count": 0, "unicode_filename_count": 0, "homoglyph_filename_count": 0, "security.encrypted_count": 0, "timing.mtime_unique_count": 1, "timing.mtime_unique_ratio": 0.5, "misplaced_executable_count": 0, "timing.mtime_dominant_count": 2, "timing.mtime_spread_seconds": 0, "timing.sentinel_mtime_count": 0, "security.world_writable_count": 0, "timing.mtime_dominant_fraction": 1, "compression.method_counts.deflate": 2 }, "consistency": { "extension_content_mismatch": 1, "extension_content_mismatch.archive_as_unknown": 1 } } }, "traits": [ { "id": "micro-behaviors/fs/shell-ops::recursive-copy-variable-destination-portable", "conf": 0.9, "crit": 3, "desc": "Recursive copy to variable destination" }, { "id": "objectives/anti-static/obfuscation/code-metrics/structure::sh-dense-eval-chains-unless-cond-1--rx-3", "atk": "T1027", "mbc": "B0032", "conf": 0.92, "crit": 3, "desc": "Command-line usage text marker" }, { "id": "metadata/document/pdf/properties::pdf-info-author-cyrillic", "conf": 0.9, "crit": 3, "desc": "PDF info.author contains Cyrillic" }, { "id": "micro-behaviors/process/create/shell/target::sh-reconstructed-command-target-shape", "conf": 0.9, "crit": 3, "desc": "Dynamic shell call target shape" }, { "id": "objectives/anti-static/obfuscation/code-metrics/identifiers::identifier-obfuscation-cond-0--inline-23810", "atk": "T1027", "mbc": "B0032", "conf": 0.9, "crit": 3, "desc": "Average identifier length \u003e= 22 chars" }, { "id": "metadata/import/shell/relative/1/test-lib/sh::relative/1/test-lib/sh", "conf": 0.95, "crit": 2, "desc": "imports ./test-lib.sh" }, { "id": "micro-behaviors/ui/help::script-usage-screen", "conf": 0.9, "crit": 3, "desc": "Script prints a CLI usage screen" }, { "id": "metadata/package/testing/presence/path::archive-test-directory-member-path", "conf": 0.98, "crit": 3, "desc": "Archive ships a root-level test tree" }, { "id": "micro-behaviors/communications/http/url/path::remote-transfer-url-path", "conf": 0.95, "crit": 3, "desc": "URL path names upload, backup or exfil" }, { "id": "micro-behaviors/process/create/script/file::shell-script-execution-alt", "atk": "T1059.004", "conf": 0.7, "crit": 3, "desc": "Executes shell script via alt interpreters" }, { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/http/url/navigation::pdf-external-http-navigation", "conf": 0.94, "crit": 3, "desc": "PDF link annotation opens HTTP(S) URL", "uses": [ 18, 23, 51 ] }, { "id": "micro-behaviors/fs/write/file/redirect::shell-printf-file-write", "conf": 0.86, "crit": 3, "desc": "Shell printf redirects output to a file" }, { "id": "micro-behaviors/fs/delete/file/command::rm-force-variable-target", "atk": "T1070.004", "mbc": "C0047", "conf": 0.9, "crit": 3, "desc": "Force-deletes a shell variable target" }, { "id": "micro-behaviors/communications/http/url/forge::public-code-forge-url", "conf": 0.9, "crit": 3, "desc": "References a public code-forge URL" }, { "id": "metadata/lang/natural::lang-german--atom-3", "conf": 0.8, "crit": 2, "desc": "German function-word token \"aber\"" }, { "id": "metadata/file/format/markup::postscript-adobe-header", "conf": 0.97, "crit": 3, "desc": "Adobe PostScript document header" }, { "id": "objectives/evasion/masquerade/file/lure::pdf-search-home-posix--rx-5", "atk": "T1036", "conf": 0.9, "crit": 3, "desc": "Documents directory reference" }, { "id": "metadata/document/pdf/action::pdf-link-annotation", "conf": 0.9, "crit": 3, "desc": "PDF link annotation present" }, { "id": "metadata/lang/natural::lang-english--atom-7", "conf": 0.8, "crit": 1, "desc": "English function-word token \"this\"" }, { "id": "metadata/file/archive::archive-at-least-10-members", "conf": 0.9, "crit": 3, "desc": "Archive contains at least ten members", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/fs/directory/chdir::shell-change-directory", "conf": 0.95, "crit": 3, "desc": "Shell changes working directory" }, { "id": "micro-behaviors/fs/path/temp::tmp-path-content", "conf": 1.0, "crit": 2, "desc": "Contains a /tmp/ or /var/tmp/ path" }, { "id": "metadata/document/pdf/action::pdf-action-uri", "conf": 0.9, "crit": 3, "desc": "PDF URI action present" }, { "id": "metadata/package/files/included::screenshot-directory-asset-path", "conf": 0.9, "crit": 3, "desc": "Asset path under screenshots directory" }, { "id": "metadata/file/archive::archive-at-least-500-members", "conf": 0.98, "crit": 3, "desc": "Archive contains at least 500 members", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/fs/path/temp::unix-temp", "conf": 0.7, "crit": 2, "desc": "Unix /tmp/ path reference" }, { "id": "micro-behaviors/process/create/script/file::shell-script-relative-execution", "atk": "T1059.004", "conf": 0.7, "crit": 3, "desc": "Executes a relative shell script path (.sh)" }, { "id": "metadata/lang/natural::lang-german--atom-2", "conf": 0.8, "crit": 2, "desc": "German function-word token \"oder\"" }, { "id": "micro-behaviors/fs/directory/mkdir::mkdir-command", "conf": 0.8, "crit": 3, "desc": "Shell invokes mkdir command" }, { "id": "micro-behaviors/fs/shell-ops::cp-command-text", "conf": 0.9, "crit": 3, "desc": "Source contains cp file-copy command" }, { "id": "micro-behaviors/process/create/local-exec::execute-dot-slash-literal", "conf": 0.88, "crit": 3, "desc": "Executes a local relative file" }, { "id": "micro-behaviors/fs/delete/directory::shell-recursive-delete", "conf": 0.9, "crit": 3, "desc": "Shell recursively removes a path" }, { "id": "metadata/file/string/file::tmp", "conf": 0.2, "crit": 1, "desc": "tmp keyword" }, { "id": "metadata/lang/natural::lang-german", "conf": 0.8, "crit": 3, "desc": "Contains probable German text", "from": [ { "file": 2 }, { "off": 2433, "file": 519, "line": 44 } ], "uses": [ 15, 28, 35, 36, 38, 48 ] }, { "id": "metadata/lang/natural::lang-german--atom-4", "conf": 0.8, "crit": 2, "desc": "German function-word token \"auch\"" }, { "id": "metadata/lang/natural::lang-german--atom-5", "conf": 0.8, "crit": 2, "desc": "German function-word token \"sich\"" }, { "id": "objectives/execution/lure/document::pdf-many-link-annotations", "atk": "T1566.001", "conf": 0.85, "crit": 3, "desc": "PDF carries twenty or more link annotations" }, { "id": "metadata/lang/natural::lang-german--atom-1", "conf": 0.8, "crit": 2, "desc": "German function-word token \"nicht\"" }, { "id": "objectives/execution/lure/document::pdf-dense-link-annotations", "atk": "T1566.001", "conf": 0.88, "crit": 3, "desc": "PDF averages four-plus links per page" }, { "id": "metadata/lang/natural::lang-english--atom-4", "conf": 0.8, "crit": 1, "desc": "English function-word token \"have\"" }, { "id": "metadata/file/archive::archive-at-least-120-members", "conf": 0.98, "crit": 3, "desc": "Archive contains at least 120 members", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/process/create/local-exec::local-execution", "conf": 1.0, "crit": 3, "desc": "Local ./ file invocation" }, { "id": "metadata/lang/natural::lang-english--atom-6", "conf": 0.8, "crit": 1, "desc": "English function-word token \"with\"", "from": [ { "file": 1 } ] }, { "id": "metadata/lang/natural::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/path/temp::tmp-gz-path", "conf": 0.6, "crit": 3, "desc": "Temporary directory path ending in .gz" }, { "id": "micro-behaviors/process/create/shell/spawn::shell-execution-current-dir", "conf": 0.7, "crit": 3, "desc": "Execution from current directory (./file)" }, { "id": "metadata/lang/natural::lang-english--atom-2", "conf": 0.8, "crit": 1, "desc": "English function-word token \"and\"", "from": [ { "file": 1 } ] }, { "id": "metadata/lang/natural::lang-german--atom-7", "conf": 0.8, "crit": 2, "desc": "German function-word token \"werden\"" }, { "id": "metadata/document/pdf/properties::pdf-info-author-cjk", "conf": 0.9, "crit": 3, "desc": "PDF info.author contains CJK" }, { "id": "metadata/file/format/markup::archive-member-postscript-extension", "conf": 0.95, "crit": 3, "desc": "Archive member has PostScript/EPS extension" }, { "id": "metadata/document/pdf/action::pdf-http-uri-action", "conf": 0.92, "crit": 3, "desc": "PDF action targets HTTP(S) URL" }, { "id": "micro-behaviors/communications/http/url/scheme::cleartext-http-url", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Cleartext http:// URL" }, { "id": "metadata/lang/natural::lang-english--atom-3", "conf": 0.8, "crit": 1, "desc": "English function-word token \"that\"", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/path/location::home-hidden-dotdir-ref", "conf": 0.6, "crit": 3, "desc": "Home-relative hidden directory path literal" }, { "id": "micro-behaviors/fs/path/temp::tmp-tar-path", "conf": 0.6, "crit": 3, "desc": "Temporary directory path ending in .tar" }, { "id": "metadata/package/files/archive-member::archive-nested-zip-member", "conf": 0.9, "crit": 3, "desc": "Archive member is a nested ZIP" } ] }, { "depth": 1, "facts": { "metrics": { "file": { "size": 4048796, "entropy": 7.99 }, "binary": { "peak_region_bytes": 3951616, "peak_region_entropy": 7.86 }, "archive": { "file_count": 658, "has_comment": 1, "comment_size": 40, "member_count": 713, "script_count": 3, "zip_bomb_ratio": 35.19, "compressed_size": 3909614, "directory_count": 55, "executable_count": 3, "extra_field_size": 6417, "noise_file_count": 0, "compression.ratio": 0.35, "hidden_file_count": 2, "uncompressed_size": 11297846, "crc_collision_count": 11, "entry_comment_count": 0, "max_filename_length": 82, "rtlo_filename_count": 0, "format.regular_count": 657, "format.symlink_count": 1, "nested_archive_count": 0, "path_traversal_count": 0, "symlink_escape_count": 0, "security.setgid_count": 0, "security.setuid_count": 0, "security.sticky_count": 0, "double_extension_count": 0, "duplicate_member_count": 0, "format.directory_count": 55, "security.symlink_count": 1, "unicode_filename_count": 0, "homoglyph_filename_count": 0, "security.encrypted_count": 0, "timing.mtime_unique_count": 1, "timing.mtime_unique_ratio": 0, "misplaced_executable_count": 0, "timing.mtime_dominant_count": 713, "timing.mtime_spread_seconds": 0, "timing.sentinel_mtime_count": 0, "security.world_writable_count": 1, "timing.mtime_dominant_fraction": 1, "compression.method_counts.stored": 56, "compression.method_counts.deflate": 657 } } }, "id": 2, "ident": { "name": { "value": "caption-CTAN", "source": "file.basename", "verified": false }, "trust": "unsigned", "version": { "value": "2023-09-08", "source": "file.basename", "verified": false } }, "mol": "O₃(As₂ErXe)H₄(Cm₄F₆Po₄U)Md₄(Pa₂Pd₂Pt)", "path": "caption-2023.9.8-1.src.rock!!caption-CTAN_2023-09-08.zip", "pid": 0, "risk": 16, "sha": "8fe33508eaae5ca1d585ebec15a36e0ab1f6d7bc4631a9b9b0c9e68f4689f2eb", "size": 4048796, "traits": [ { "id": "metadata/lang/natural::lang-english--atom-6", "conf": 0.8, "crit": 1, "desc": "English function-word token \"with\"" }, { "id": "micro-behaviors/fs/write/file/redirect::shell-printf-file-write", "conf": 0.86, "crit": 3, "desc": "Shell printf redirects output to a file" }, { "id": "metadata/document/pdf/properties::pdf-info-author-cyrillic", "conf": 0.9, "crit": 3, "desc": "PDF info.author contains Cyrillic" }, { "id": "micro-behaviors/communications/http/url/forge::public-code-forge-url", "conf": 0.9, "crit": 3, "desc": "References a public code-forge URL" }, { "id": "micro-behaviors/fs/path/temp::tmp-path-content", "conf": 1.0, "crit": 2, "desc": "Contains a /tmp/ or /var/tmp/ path" }, { "id": "micro-behaviors/process/create/local-exec::execute-dot-slash-literal", "conf": 0.88, "crit": 3, "desc": "Executes a local relative file" }, { "id": "metadata/lang/natural::lang-german--atom-7", "conf": 0.8, "crit": 2, "desc": "German function-word token \"werden\"" }, { "id": "objectives/anti-static/obfuscation/code-metrics/identifiers::identifier-obfuscation-cond-0--inline-23810", "atk": "T1027", "mbc": "B0032", "conf": 0.9, "crit": 3, "desc": "Average identifier length \u003e= 22 chars" }, { "id": "objectives/evasion/masquerade/file/lure::pdf-search-home-posix--rx-5", "atk": "T1036", "conf": 0.9, "crit": 3, "desc": "Documents directory reference" }, { "id": "micro-behaviors/ui/help::script-usage-screen", "conf": 0.9, "crit": 3, "desc": "Script prints a CLI usage screen" }, { "id": "objectives/execution/lure/document::pdf-dense-link-annotations", "atk": "T1566.001", "conf": 0.88, "crit": 3, "desc": "PDF averages four-plus links per page" }, { "id": "micro-behaviors/fs/path/location::home-hidden-dotdir-ref", "conf": 0.6, "crit": 3, "desc": "Home-relative hidden directory path literal" }, { "id": "micro-behaviors/process/create/local-exec::local-execution", "conf": 1.0, "crit": 3, "desc": "Local ./ file invocation" }, { "id": "metadata/lang/natural::lang-german--atom-3", "conf": 0.8, "crit": 2, "desc": "German function-word token \"aber\"" }, { "id": "metadata/lang/natural::lang-english--atom-7", "conf": 0.8, "crit": 1, "desc": "English function-word token \"this\"" }, { "id": "metadata/file/format/markup::postscript-adobe-header", "conf": 0.97, "crit": 3, "desc": "Adobe PostScript document header" }, { "id": "micro-behaviors/fs/shell-ops::recursive-copy-variable-destination-portable", "conf": 0.9, "crit": 3, "desc": "Recursive copy to variable destination" }, { "id": "objectives/anti-static/obfuscation/code-metrics/structure::sh-dense-eval-chains-unless-cond-1--rx-3", "atk": "T1027", "mbc": "B0032", "conf": 0.92, "crit": 3, "desc": "Command-line usage text marker" }, { "id": "micro-behaviors/fs/shell-ops::cp-command-text", "conf": 0.9, "crit": 3, "desc": "Source contains cp file-copy command" }, { "id": "metadata/document/pdf/properties::pdf-info-author-cjk", "conf": 0.9, "crit": 3, "desc": "PDF info.author contains CJK" }, { "id": "metadata/lang/natural::lang-german--atom-1", "conf": 0.8, "crit": 2, "desc": "German function-word token \"nicht\"" }, { "id": "metadata/document/pdf/action::pdf-http-uri-action", "conf": 0.92, "crit": 3, "desc": "PDF action targets HTTP(S) URL" }, { "id": "metadata/lang/natural::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"" }, { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"" }, { "id": "micro-behaviors/communications/http/url/path::remote-transfer-url-path", "conf": 0.95, "crit": 3, "desc": "URL path names upload, backup or exfil" }, { "id": "micro-behaviors/fs/directory/chdir::shell-change-directory", "conf": 0.95, "crit": 3, "desc": "Shell changes working directory" }, { "id": "metadata/document/pdf/action::pdf-link-annotation", "conf": 0.9, "crit": 3, "desc": "PDF link annotation present" }, { "id": "micro-behaviors/process/create/shell/spawn::shell-execution-current-dir", "conf": 0.7, "crit": 3, "desc": "Execution from current directory (./file)" }, { "id": "micro-behaviors/process/create/script/file::shell-script-execution-alt", "atk": "T1059.004", "conf": 0.7, "crit": 3, "desc": "Executes shell script via alt interpreters" }, { "id": "metadata/document/pdf/action::pdf-action-uri", "conf": 0.9, "crit": 3, "desc": "PDF URI action present" }, { "id": "metadata/file/string/file::tmp", "conf": 0.2, "crit": 1, "desc": "tmp keyword" }, { "id": "metadata/package/files/included::screenshot-directory-asset-path", "conf": 0.9, "crit": 3, "desc": "Asset path under screenshots directory" }, { "id": "micro-behaviors/fs/path/temp::tmp-tar-path", "conf": 0.6, "crit": 3, "desc": "Temporary directory path ending in .tar" }, { "id": "metadata/lang/natural::lang-english--atom-2", "conf": 0.8, "crit": 1, "desc": "English function-word token \"and\"" }, { "id": "metadata/lang/natural::lang-german--atom-4", "conf": 0.8, "crit": 2, "desc": "German function-word token \"auch\"" }, { "id": "micro-behaviors/fs/directory/mkdir::mkdir-command", "conf": 0.8, "crit": 3, "desc": "Shell invokes mkdir command" }, { "id": "metadata/lang/natural::lang-english--atom-3", "conf": 0.8, "crit": 1, "desc": "English function-word token \"that\"" }, { "id": "micro-behaviors/communications/http/url/scheme::cleartext-http-url", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Cleartext http:// URL" }, { "id": "objectives/execution/lure/document::pdf-many-link-annotations", "atk": "T1566.001", "conf": 0.85, "crit": 3, "desc": "PDF carries twenty or more link annotations" }, { "id": "micro-behaviors/fs/delete/file/command::rm-force-variable-target", "atk": "T1070.004", "mbc": "C0047", "conf": 0.9, "crit": 3, "desc": "Force-deletes a shell variable target" }, { "id": "micro-behaviors/process/create/shell/target::sh-reconstructed-command-target-shape", "conf": 0.9, "crit": 3, "desc": "Dynamic shell call target shape" }, { "id": "metadata/lang/natural::lang-english--atom-4", "conf": 0.8, "crit": 1, "desc": "English function-word token \"have\"" }, { "id": "micro-behaviors/communications/http/url/navigation::pdf-external-http-navigation", "conf": 0.94, "crit": 3, "desc": "PDF link annotation opens HTTP(S) URL", "from": [ { "file": 7 }, { "file": 8 }, { "file": 9 }, { "file": 10 }, { "file": 11 }, { "file": 12 }, { "file": 13 }, { "file": 14 } ], "uses": [ 21, 26, 29 ] }, { "id": "micro-behaviors/fs/delete/directory::shell-recursive-delete", "conf": 0.9, "crit": 3, "desc": "Shell recursively removes a path" }, { "id": "metadata/lang/natural::lang-german", "conf": 0.8, "crit": 3, "desc": "Contains probable German text", "from": [ { "off": 2433, "file": 519, "line": 44 } ], "uses": [ 6, 13, 20, 34, 45, 48 ] }, { "id": "metadata/lang/natural::lang-german--atom-2", "conf": 0.8, "crit": 2, "desc": "German function-word token \"oder\"" }, { "id": "metadata/import/shell/relative/1/test-lib/sh::relative/1/test-lib/sh", "conf": 0.95, "crit": 2, "desc": "imports ./test-lib.sh" }, { "id": "micro-behaviors/fs/path/temp::unix-temp", "conf": 0.7, "crit": 2, "desc": "Unix /tmp/ path reference" }, { "id": "metadata/lang/natural::lang-german--atom-5", "conf": 0.8, "crit": 2, "desc": "German function-word token \"sich\"" }, { "id": "micro-behaviors/fs/path/temp::tmp-gz-path", "conf": 0.6, "crit": 3, "desc": "Temporary directory path ending in .gz" }, { "id": "micro-behaviors/process/create/script/file::shell-script-relative-execution", "atk": "T1059.004", "conf": 0.7, "crit": 3, "desc": "Executes a relative shell script path (.sh)" }, { "id": "metadata/file/archive::archive-at-least-10-members", "conf": 0.9, "crit": 3, "desc": "Archive contains at least ten members" }, { "id": "metadata/file/archive::archive-at-least-120-members", "conf": 0.98, "crit": 3, "desc": "Archive contains at least 120 members" }, { "id": "metadata/file/archive::archive-at-least-500-members", "conf": 0.98, "crit": 3, "desc": "Archive contains at least 500 members" }, { "id": "metadata/file/format/markup::archive-member-postscript-extension", "conf": 0.95, "crit": 3, "desc": "Archive member has PostScript/EPS extension" }, { "id": "metadata/package/testing/presence/path::archive-test-directory-member-path", "conf": 0.98, "crit": 3, "desc": "Archive ships a root-level test tree" } ], "type": "zip" }, { "ctx": [ { "b": "boXZHx(kOBxBk%\u003eboO-}f!\u003emmfFa$siV{d#BrC:rA=U@kzvdQhgb7BqeIO}hf!+ThoMaL^w[=6)aA}Koy-)g#ay/tex\u003ep/$vriLne\u003e/5ha%p=wCowqKwO2y[aAg+0yHH\u003c!ao", "ln": 0, "col": 1, "line": 1 }, { "b": "a%pr8wmYo]Bz\u0026oCv@JRmv@Dj3vqYP.boO-}f/7ynf!C7siV]Q#ruL*XzGGClay/7[zF9J\u003eaARJAa$W{WxMOuniXJdgCxUVHByx5tz/PFzB-qenvpQL?boO-}f/7ynga+goiV{.0vq{s1wft#jaz$+max8roay]hbwN/?2A^n^GBAhIlBAIRn3l{VGfFLBpfGyZth--6VwP?^ewN)tmv@#c%B-qenvpQG\u003cz/6u5zGGD2aA8yAaAImmv}u=)B-IIlzGGYuePbGGeQ8bNyIvU", "ln": 187, "col": 25, "line": 6 }, { "b": "wN/yZzFsAddJ\u0026XwA+)sfo?WcrA+e/GB.LV5wPwa+B7GCoeObo1x(!x6wnc6EbQ^RQwgm\u003ecwO(x[wnc6Ea$[4PA4+ZfAcb/jzxYz{e?.rTB963QxDQ/3wNPD-3ux#aeOo2Ca%.nwze-\u0026)x(Uy8zeiV@AV=LKBy/rduU0\u003e\u003ea{}?0at41AB8Mhwv}vqye[]iAaAIEzA:@VldLtmNCP.6CB-H#6fdFO:y\u0026Z.uz/{8gwIkI=wPhYkB8Mhwv}vr9vqG:?vpK6}a%.nwze-\u0026)x(Uy8v@JLxvixV6CRpK0B98WIBy/XIdLt^:zY*kHBy/rduU0\u003e\u003ea{}?0at41Awn+%hdLtWJw/@oyBy/rduU0\u003e\u003ea{}?0at41AqBJ(to*{f(ni{0vmncGEax8omo*IVWar\u00267MwO(x[wnc6d3s^P?a%.nwze-\u0026)x(Uy83l{WmxK#0@v}YB-yANe4B75J]wJ-%Vgb7Hw3tB8{v@#c%x\u003ezSkv{%s#x(v(wx(m#mtNzO@arR^HarR\u003cTe[nZsj-+K:A:@Vly*?A%CRrMnAcb/jzxZid3lQDlarR^Har\u0026o/wPhYNB8Mhwv}vp", "ln": 712, "col": 88, "line": 15 }, { "b": "wQ2\u003ervq{s5z/c:wdLtWJw^SS[wO}?$ay/vkeNY+CbY)QmA9)c\u0026AXy{hAcb/jzz33tAXq0Ja%n6PwncabuU0\u003e\u003efjOBfBzkVhuNd4gvru66eIh0Pv\u003exF)gDvQevru6fe{7Jxe[YFO3lQE3wfr6wwncabuU0\u003e\u003ea{[V4arUfovqZjby\u0026r-)at4yLePq*:BS+vtBz%n]fl.R:e[o0izz2\u003cFxd[x", "ln": 1836, "col": 55, "line": 46 }, { "b": "zF%Vnv}v!Say2l#arR^HeIg^Mv}xL0wJ:TCwN##oeOo3mwP?T9B7]Mgj-27Ry-(%\u0026boO9Kat2fSx(4uzflz5IfjOBfBzkVhfjOBfBzkVhe{7Jxe[YFqw[.OV", "ln": 2217, "col": 15, "line": 56 } ], "depth": 2, "facts": { "imp": [ [ "", "set" ], [ "", "pwd" ], [ "", "./test.sh" ], [ "", "rm" ], [ "", "mkdir" ], [ "", "cp" ], [ "", "cp" ], [ "", "cp" ], [ "", "cp" ], [ "", "cd" ], [ "", "ctanify" ], [ "", "cp" ], [ "", "date" ], [ "", "cd" ] ], "tgt": [ "./test.sh", "cd", "cp", "ctanify", "date", "mkdir", "pwd", "rm", "set" ], "metrics": { "ast": { "max_depth": 7, "call_count": 14, "node_count": 233 }, "file": { "size": 2313, "entropy": 5.25 }, "text": { "lines": 60, "top_char": 116, "tab_count": 12, "max_ws_run": 4, "digit_ratio": 0.08, "space_count": 199, "char_entropy": 5.25, "mixed_indent": 1, "unique_chars": 73, "top_char_null": 0, "string_density": 0.43, "top_char_ratio": 0.06, "avg_line_length": 37.55, "max_line_length": 117, "empty_line_ratio": 0.1, "last_line_length": 2, "whitespace_ratio": 0.12, "identifier_density": 1.05, "line_length_stddev": 26.26, "normalized_string_count": 3.36, "suspicious_string_ratio": 0.04, "suspicious_comment_ratio": 0.29, "normalized_unique_identifiers": 4.91 }, "binds": { "count": 2 }, "binary": { "peak_region_bytes": 2313, "peak_region_entropy": 5.2 }, "strings": { "bytes": 788, "count": 26, "shell": 1, "avg_length": 30.31, "max_length": 54, "path_count": 1, "avg_entropy": 3.81, "entropy_stddev": 0.54 }, "comments": { "chars": 1069, "count": 24, "empty": 2, "lines": 22, "base64": 1, "high_entropy": 6, "to_code_ratio": 0.58, "url_in_comments": 2 }, "identifiers": { "count": 63, "unique": 29, "avg_length": 7.17, "max_length": 15, "min_length": 2, "avg_entropy": 2.4, "reuse_ratio": 0.46, "length_stddev": 3.98, "has_digit_ratio": 0.03, "high_entropy_count": 2, "high_entropy_ratio": 0.07, "all_lowercase_ratio": 0.38, "all_uppercase_ratio": 0.1 } } }, "id": 4, "mol": "H₃(Cm₂F₅Po₃)", "path": "caption-2023.9.8-1.src.rock!!caption-CTAN_2023-09-08.zip!!caption-CTAN_2023-09-08/2ctan.sh", "pid": 2, "risk": 6, "sha": "90ff57d20f9f514b5d46e3e53022488d2337f613259d1f2409add93f7b54647c", "size": 2313, "traits": [ { "id": "metadata/file/string/file::tmp", "conf": 0.2, "crit": 1, "desc": "tmp keyword", "spans": [ [ 778, 0 ] ] }, { "id": "micro-behaviors/communications/http/url/path::remote-transfer-url-path", "conf": 0.95, "crit": 3, "desc": "URL path names upload, backup or exfil", "spans": [ [ 251, 27 ] ] }, { "id": "micro-behaviors/fs/delete/file/command::rm-force-variable-target", "atk": "T1070.004", "mbc": "C0047", "conf": 0.9, "crit": 3, "desc": "Force-deletes a shell variable target", "spans": [ [ 808, 18 ] ] }, { "id": "micro-behaviors/fs/path/temp::tmp-gz-path", "conf": 0.6, "crit": 3, "desc": "Temporary directory path ending in .gz", "spans": [ [ 2281, 27 ] ] }, { "id": "micro-behaviors/fs/path/temp::tmp-path-content", "conf": 1.0, "crit": 2, "desc": "Contains a /tmp/ or /var/tmp/ path", "spans": [ [ 776, 0 ] ] }, { "id": "micro-behaviors/fs/path/temp::tmp-tar-path", "conf": 0.6, "crit": 3, "desc": "Temporary directory path ending in .tar", "spans": [ [ 2281, 24 ] ] }, { "id": "micro-behaviors/fs/path/temp::unix-temp", "conf": 0.7, "crit": 2, "desc": "Unix /tmp/ path reference", "spans": [ [ 777, 0 ] ] }, { "id": "micro-behaviors/fs/shell-ops::cp-command-text", "conf": 0.9, "crit": 3, "desc": "Source contains cp file-copy command", "spans": [ [ 845, 86 ], [ 931, 38 ], [ 969, 28 ], [ 997, 43 ] ] }, { "id": "micro-behaviors/communications/http/url/scheme::cleartext-http-url", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Cleartext http:// URL", "spans": [ [ 251, 26 ] ] }, { "id": "micro-behaviors/fs/delete/directory::shell-recursive-delete", "conf": 0.9, "crit": 3, "desc": "Shell recursively removes a path", "spans": [ [ 809, 2 ], [ 812, 3 ] ] }, { "id": "micro-behaviors/fs/directory/chdir::shell-change-directory", "conf": 0.95, "crit": 3, "desc": "Shell changes working directory", "spans": [ [ 1041, 2 ] ] }, { "id": "micro-behaviors/fs/directory/mkdir::mkdir-command", "conf": 0.8, "crit": 3, "desc": "Shell invokes mkdir command", "spans": [ [ 828, 17 ] ] }, { "id": "micro-behaviors/process/create/local-exec::execute-dot-slash-literal", "conf": 0.88, "crit": 3, "desc": "Executes a local relative file", "spans": [ [ 792, 9 ] ] }, { "id": "micro-behaviors/process/create/local-exec::local-execution", "conf": 1.0, "crit": 3, "desc": "Local ./ file invocation", "spans": [ [ 792, 9 ] ] }, { "id": "micro-behaviors/process/create/script/file::shell-script-relative-execution", "atk": "T1059.004", "conf": 0.7, "crit": 3, "desc": "Executes a relative shell script path (.sh)", "spans": [ [ 792, 9 ] ] }, { "id": "micro-behaviors/process/create/shell/spawn::shell-execution-current-dir", "conf": 0.7, "crit": 3, "desc": "Execution from current directory (./file)", "spans": [ [ 791, 10 ] ] } ], "type": "shell" }, { "ctx": [ { "b": "g9wm[qxN\u003eNats{oat#50fD:mohz(Qhaw%s/3o*SXwO#3%vRMlcgAXv]z^)C*juJ%7rc-B]atl2#zF%R7fh)15BA}?patlA5zFGOjlt{)PwPz0eats](t}X-4nIrCnf^5d)fKk2sqE%uWax{SZh.D{Ai3papiw9fEgAXFliw9cCf^5wkh.D^yi9=\u003eAk{eoLatlUofgP}WzY*Y3au8h3fD:mok0xrqj{\u003e\u003eswn+{(3n\u003cT.fD+pyy6)6=3nkw7AaHdBl2D", "ln": 3498 }, { "b": "aw@L1p*[0Fo(BMNfi978pJZ+}x(mH63o*SXwO#3%vRMl8i5R)kaA7.73oQATfhMXcwozx[AV==8x?IApsrIM[w(JtzeIO\u003emfFkardgdZ]B-.qnAWUfGh-s[%h-B$}fFC^$fFCh9tRE\u0026=wN3]yfL\u003c#FfFD-=g+-e*fFDBgfFCh0tRE\u0026=zcO+GfL$5GfFE6yfFCf", "ln": 148328 } ], "depth": 2, "facts": { "metrics": { "pdf": { "eof_count": 1, "font_count": 10, "page_count": 15, "action_count": 5, "header_count": 1, "object_count": 186, "stream_count": 34, "trailer_count": 1, "startxref_count": 1, "annotation_count": 26, "uri_action_count": 5, "flate_filter_count": 34, "risky_feature_score": 5, "annotations_per_page": 1.73, "uri_actions_per_page": 0.33, "visible_object_count": 186, "signature_object_count": 0, "trailing_bytes_after_eof": 1, "unreferenced_object_count": 2, "stream_bad_delimiter_count": 0, "leading_bytes_before_header": 0, "stream_invalid_length_count": 0, "stream_missing_length_count": 0, "stream_length_mismatch_count": 0, "stream_missing_endstream_count": 0 }, "file": { "size": 153251, "entropy": 7.8 }, "binary": { "peak_region_bytes": 120832, "peak_region_entropy": 7.83 } } }, "id": 7, "ident": { "title": { "value": "52", "source": "pdf.info.title", "verified": false }, "trust": "unsigned", "authors": [ { "name": "Axel Sommerfeldt, ` `%%%`#`\u002612_`__~~~\\376＀C\u0000漀n\u0000琀e\u0000渀t\u0000", "role": "author", "source": "pdf.info.author" } ], "producer": { "value": "MiKTeX pdfTeX-1.40.25", "source": "pdf.info.producer", "verified": false } }, "mol": "O(Xe)H(Cm)Md(Pd₂)", "path": "caption-2023.9.8-1.src.rock!!caption-CTAN_2023-09-08.zip!!caption-CTAN_2023-09-08/doc/bicaption.pdf", "pid": 2, "risk": 3, "sha": "6cadcf601467a43bd147b487db666339274c34368a6f3010962338642479896a", "size": 153251, "traits": [ { "id": "metadata/document/pdf/action::pdf-action-uri", "conf": 0.9, "crit": 3, "desc": "PDF URI action present" }, { "id": "metadata/document/pdf/action::pdf-http-uri-action", "conf": 0.92, "crit": 3, "desc": "PDF action targets HTTP(S) URL" }, { "id": "metadata/document/pdf/action::pdf-link-annotation", "conf": 0.9, "crit": 3, "desc": "PDF link annotation present", "spans": [ [ 3562, 14 ] ] }, { "id": "metadata/document/pdf/properties::pdf-info-author-cjk", "conf": 0.9, "crit": 3, "desc": "PDF info.author contains CJK" }, { "id": "objectives/execution/lure/document::pdf-many-link-annotations", "atk": "T1566.001", "conf": 0.85, "crit": 3, "desc": "PDF carries twenty or more link annotations" }, { "id": "micro-behaviors/communications/http/url/navigation::pdf-external-http-navigation", "conf": 0.94, "crit": 3, "desc": "PDF link annotation opens HTTP(S) URL", "uses": [ 0, 1, 2 ], "spans": [ [ 3562, 14 ] ] } ], "type": "pdf" }, { "id": 8, "mol": "H(Cm)Md(Pd)", "sha": "8ac5de87741cc94b32aa497d3f5ee0aa7666afb08c0da9961647f119289a0f20", "path": "caption-2023.9.8-1.src.rock!!caption-CTAN_2023-09-08.zip!!caption-CTAN_2023-09-08/doc/caption-light.pdf", "risk": 2, "size": 67305, "type": "pdf", "depth": 2 }, { "id": 9, "mol": "O(Xe)H(Cm)Md(Pd₂)", "sha": "34d0ebd044f5f4f753a7134fc064f2193dd4f948a56438cb02a3c788e0dd915a", "path": "caption-2023.9.8-1.src.rock!!caption-CTAN_2023-09-08.zip!!caption-CTAN_2023-09-08/doc/caption.pdf", "risk": 3, "size": 428715, "type": "pdf", "depth": 2 }, { "id": 10, "mol": "H(Cm)Md(Pd₂)", "sha": "b8aae76078326931a1536596d5071c9bc9806324f7f3c36e2870dd312602de2a", "path": "caption-2023.9.8-1.src.rock!!caption-CTAN_2023-09-08.zip!!caption-CTAN_2023-09-08/doc/caption2.pdf", "risk": 2, "size": 78170, "type": "pdf", "depth": 2 }, { "id": 11, "mol": "H(Cm)Md(Pd₂)", "sha": "84b29d42db0a008fd626c897fc382315e36fa66d1d003cd1382f401714a5697e", "path": "caption-2023.9.8-1.src.rock!!caption-CTAN_2023-09-08.zip!!caption-CTAN_2023-09-08/doc/ltcaption.pdf", "risk": 2, "size": 99130, "type": "pdf", "depth": 2 }, { "id": 12, "mol": "O(Xe)H(Cm)Md(Pd)", "sha": "8e1e40a9d06380701406e796f60b695f3725e54488cdbef1f1bb4daa37a15df8", "path": "caption-2023.9.8-1.src.rock!!caption-CTAN_2023-09-08.zip!!caption-CTAN_2023-09-08/doc/outdated/caption-deu.pdf", "risk": 3, "size": 409862, "type": "pdf", "depth": 2 }, { "id": 13, "mol": "O(Xe)Md(Pd₂)", "sha": "b659b24b46e5f10332b2fcba97d8c49f39f8aa79a3cd946dd4249ccee0a76851", "path": "caption-2023.9.8-1.src.rock!!caption-CTAN_2023-09-08.zip!!caption-CTAN_2023-09-08/doc/outdated/caption-rus.pdf", "risk": 2, "size": 718117, "type": "pdf", "depth": 2 }, { "id": 14, "mol": "O(Xe)H(Cm)Md(Pd)", "sha": "08edbd37147e079a7fb8876b18f7f4585bbe81d0e7eeab2d65a3b94c295b5da7", "path": "caption-2023.9.8-1.src.rock!!caption-CTAN_2023-09-08.zip!!caption-CTAN_2023-09-08/doc/subcaption.pdf", "risk": 3, "size": 230920, "type": "pdf", "depth": 2 }, { "id": 48, "mol": "Md", "sha": "79e1ef5c270ca6bf8ab51b96148a6e9431469cdae7139bc0161df1cbea0c86ed", "path": "caption-2023.9.8-1.src.rock!!caption-CTAN_2023-09-08.zip!!caption-CTAN_2023-09-08/issues/gitlab/cat.eps", "risk": 1, "size": 15737, "type": "postscript", "depth": 2 }, { "id": 50, "mol": "Md", "sha": "72f8aeb2984681fa7fb9506b20a7c9608f11636e3a0afa4cda9947f854bf5595", "path": "caption-2023.9.8-1.src.rock!!caption-CTAN_2023-09-08.zip!!caption-CTAN_2023-09-08/issues/gitlab/elephant.eps", "risk": 1, "size": 21191, "type": "postscript", "depth": 2 }, { "id": 242, "mol": "Md(Pa)", "sha": "5c2be5e2e203503fb0e5208263616a20bb13937309c43c2e19a51274ef901831", "path": "caption-2023.9.8-1.src.rock!!caption-CTAN_2023-09-08.zip!!caption-CTAN_2023-09-08/screenshots/bicaption.png", "risk": 1, "size": 13659, "type": "png", "depth": 2 }, { "id": 243, "mol": "Md(Pa)", "sha": "626a5cbe6d53971663cb09a238013fe7a55c80494a7730db165533b79951faa2", "path": "caption-2023.9.8-1.src.rock!!caption-CTAN_2023-09-08.zip!!caption-CTAN_2023-09-08/screenshots/subcaption.png", "risk": 1, "size": 47533, "type": "png", "depth": 2 }, { "id": 257, "mol": "Md", "sha": "79e1ef5c270ca6bf8ab51b96148a6e9431469cdae7139bc0161df1cbea0c86ed", "path": "caption-2023.9.8-1.src.rock!!caption-CTAN_2023-09-08.zip!!caption-CTAN_2023-09-08/source/cat.eps", "risk": 1, "size": 15737, "type": "postscript", "depth": 2 }, { "id": 258, "mol": "Md", "sha": "72f8aeb2984681fa7fb9506b20a7c9608f11636e3a0afa4cda9947f854bf5595", "path": "caption-2023.9.8-1.src.rock!!caption-CTAN_2023-09-08.zip!!caption-CTAN_2023-09-08/source/elephant.eps", "risk": 1, "size": 21191, "type": "postscript", "depth": 2 }, { "id": 275, "mol": "Md", "sha": "79e1ef5c270ca6bf8ab51b96148a6e9431469cdae7139bc0161df1cbea0c86ed", "path": "caption-2023.9.8-1.src.rock!!caption-CTAN_2023-09-08.zip!!caption-CTAN_2023-09-08/source/outdated/cat.eps", "risk": 1, "size": 15737, "type": "postscript", "depth": 2 }, { "ctx": [ { "b": "boXZHx(kOkvrl8?3l{V/z!a0bwJy@QwPI@By?WuhB7+[9avgc(xM4]Lavgl-y-(U{zeA\u003c8w[t^?Brz#uCX7XzB8L]jwPzx]y?dSMw?v\u003cLw]e$7boP#:oGBpsarUutBz#pZfe3%LBzLw{e[n*pfjx9py\u0026:JizdN:1wO+[0fjOBfBzkVh3l{VYvru6warR^ZfFUvmfF$Bog71vkaAIjcy\u00260P{wN/G#wnc9[vR/Qsq:Sq{h8LZ=arR!qx(^Y(y?mVgBzbkdCvtJfx(mMab1c0Ly*?u}ayPd#ayPtjx\u003eIraB7Gr0A::63y\u003cvdBzY\u0026Fiz!S-8zddH3x(mMaA+funA=91yvqH6$B1OTz3sWB+wN]H}jTqB{CvScf3sN:!j-\u003eZ!wGS9rarR^HarR^HarR^HarR)KwmYvYB.(dXaxh=\u0026xjVfcb4kq7a{}\u003c{B75J]wN]d!wm/T^By/XWc[cnYarR^Kay]4}vrDydiV{!dze:i9wGUy", "ln": 0, "col": 1, "line": 1 }, { "b": "B75J]wN)}T3lQEcz!0i(azkH$v@DmbwO#PMa%Evpaz+$avqE60y*Rm9vrcDMbQ^+GzdN^gvqP%j3jm)#y\u0026r/(y-)n5B75J]wNw\u003e^xfx\u003cny\u0026:d{arUGsv{%f@x(n37A:-E1x)a5{vrc0zw)]H%wEoL5y\u0026r/(y-)UsBz#wAuTW$/j.wbsB7CW=arUGsv{%f@vrb#/arUomAV!!hxcp]aar\u00266@a{]Cnwn.!$arR!vw/$qZas7xoxcou2ar\u0026y4a%qnXas7xoxcou2ar\u0026x?xK#10a%pe%3lQDlaARpdzvdHearR^HAb]VgBy(TtrDzOYwJy}^fly=DBs}SFax}Srr7P\u003eXq^z1de*awby\u00261Gey?m3)D{*L7mmg3IqDXxpnLzMUe?O+YzxYAgarR^HaAhvnzGGFkb3Y1f3lQDlarR!CA+PAkw/@ouat4aPat2fQx(^Y(y?k+0nLzL}arR^Hay]z4B8AvEay/tbAa%c1avX{@miB0%AV^+wqBJ@LpF}", "ln": 1096, "col": 14, "line": 31 }, { "b": "wO#PjC4CYnx(v(iz!pa=vn{/utY7.)arR^HarUSzx(n38ar\u003e6da{]CnarR^HwQ4{hatBiCarR!ry?WG7tu-i}vrc06jV%]ieO34FE0^4Zvrc06jV%]ieIgHEB75J]wG\u0026m5t).X%arU=twO}?$arR^Hay]hcvpB4:uTW$/j-\u003eZ!wEoL5arUlix\u003ewFkwn8", "ln": 2016, "col": 66, "line": 53 }, { "b": "e^-ZzboP%0wGUG3zdmi%vruj4zxJ\u003efar\u003erivrlHcvqPN1ayPd#ar\u003eYizdK[lzfo]wayX[8B-7]kB.99Dz//V7A^8kswGV8dwGSgswPI%6vrl07az2w2zdNQbB0bWvy?$kiz/^ahwGUG3B-8qjwftr43lQDoay]g#w[u0]zGE1ywPI%me*9.$aARpd", "ln": 5001, "col": 121, "line": 174 }, { "b": "v}^PszFsi1By/JnuVGZ%z/P@ve[/uzyZIpcx\u003ewF(toCInas7(FBz#wAuUj1*wGUn:3lQEkxK#5*arR^Hv}lYabW$h6wN]H}a%qnXaz2!iBp6ckarUSzx(n38asxooCX}mtC4CYnx(v(La#7Y7a%pDmv@C)(zF89RrA8Bti3HNJtY8VCwPI%mB.L@eB0bvezdL\u003ena%?qna%p#sB98E^tP$F8tP$q5vqfL2A+fqPtP$F8tP$q3x(^Y(y?mcutP$F8tP$qjx(dAAtP$FntP#vpzy6u^fly=DBAqOsBy/IStY7]ib0*3YraQb)B0q.JbXH}2By/JnB0q.JbXH}2w)]y\u0026B-I5ma%n6Pxky{=x(^Y(y?mc3ar\u00266VBzkP6B97\u0026cA9)c\u0026w[AefbXH}2B97\u0026hBrR?KbXH}2wO#35diY(UbXH}2v@DmbwO#Plau*[(bYv*EAclnfw[=6)a{]Cnw[.OVarR)KqE%@)A=90NazCBgzF{UfvqfL2A+fqmz!0p1A+e=jatC0SBzblaCwhbf3lQDtc)iesuUi.Xy\u0026%=fB09Reats]!dggFg3taA#v@#B6zxJC9wNPD-DKp(rboP(}zeTPeazC.nwPzH4azbt7wPFh3ar@17z//LKaxi2*B0bHmzeTPeB0a[cy-)\u003erB97\u00266wN(]izE[2vazbt7wPF#5B0bWry?$ZharUrhBrC7fwNPE0eOnKrat4dEB8Mhwv}vrfBA?tmv\u003eIn6x9%4]3taA#v@#B6zxJCcz2", "ln": 5467, "col": 42, "line": 179 }, { "b": "3taA#v@#B6zxJ[pB97=0z/6Dcy?l%=x(4v43vra5ar@10wO#71vru66A+fidA=.Thaz+$avqE6dwO(w[arUSzx(n38at4:VBy/rdasxo[wPI%mB.L@eaz$R8wJ:oxc39rnaARgoBAoPIa%*=8a%pGax(4{jwPH1ta%*=8a%pAgB75J]wN)@ea%*=8a%p#wzdL\u003ena%?qnb0GmHc38g4By/JnB9hhswJ\u003cvpcM\u003cPUwnc6dar\u00267MwPI%ma%n6Pw)]y\u0026B-I5ma%n6Pwnc9[vR/Q^a%n6Pd0ffuwPI%4ze-\u0026)x\u003ey%1a%.kKvrcDlar\u00267xzE:}ua%n6Pv@DmbwO#Pl3lQE7y*QW\u003czGGDcBsPG#bY)QmA3tR@arR)KrD8FSBy=Ocy\u0026r+", "ln": 7302, "col": 1, "line": 274 }, { "b": "zdN^gvqP%j3lQE3z/6Dcy?j.kbR*LJarUGsv{%f@A+frmy\u0026?/=kmeIQy\u0026r/(y-)qbwizg^BzkP6B97\u0026cA48b3arUGsv{%f@By/rd3lQE9w/@GIaAz4mB.(dxjV%]wasO-DarU=twO}?$arR!CA+PAkw/@o+z/6Dcy?W^1ash7Zc37hFvrlH3wg?b8a%n6Pf^m.:bR*LJarR^HAb]VgBy(TEB%7)rzeZQBjALdQByO:2wGUG0vrlHcvqPNsa%?pOaz$R8wJ.j-B0q-Gx(dAAa%?pOatk]-zylLJbRZF=a%X]/ar\u00266VBzkP6B97\u0026cA9)c\u0026w[AefbY!6oA=-GFa%Z-qwfJDD3lQE5y\u0026:d{arR^HAb]VgBy(TttY82vdJ?8%ze:i9x(mMac37Z=B0b76x(4u\u003ee)Jorar\u00266=a%n6Pg9N5FarR!CA+PAkw/@WGaARgiA3cI\u003cBy/Jnv{%B\u0026ay/j@B8#kczdL\u003cOc37mMzEEx[jT8g[a%p#wzdL\u003cOc37m]jz52oy\u0026%=faz\u003eXhB75Y)jT8g[a%p#MAaIfRmn^2Vqx^kpk0gGuwPI%6vrl0ztY7]ia%X(!ar\u00266^a%n6Pd0ffuwPI%4ze-\u0026)x\u003ey%1a%.kKvrcDlar\u00267xzE:}ua%n6Pd0PPBuUap*vq]^2a%.2pB8$=5wG\u0026ME3jm)#arS6Xd\u003etjux(4{jwPGpH3jm)#arUxgas7Jyx()Z2zEl%}A=k$9arR^HBzbl63i", "ln": 7841, "col": 19, "line": 294 }, { "b": "ar@1IxK#0@v}YB-yANe4B75J]wJ-%Vgb7HvarR)Kwnc9[vR/P#CvtJfx(mMaBzb98auTv4azC[mcV*FNB7F\u003e?arUomAV/6sx(k5uf!L7mEf}8twn.!$arR!yz!0i(aAz4mB.(dxy\u0026r}[3lQDlazCBgbX.drwPzi?Bzk]f3lQDlaARpdzvdHearR^H", "ln": 8616, "col": 2, "line": 326 }, { "b": "3lQDlarR!EwPJ0gBuH)l3lQDlaz2wgwEoU8arR^HB8kA0A3c?!f:Y3CarR^Hy\u0026r@HbQ:{Ovru79uUaa/x(mGcy*?A%CWCJmw[C+4at4nny\u0026?mEzy]BuA=k$va%X(!dgdguarR^HA+frmy\u0026?/=kmeIQarUog3jm)#arUxgasFSXA+frmy\u0026*^yjS(B3djCPDarR!GxK#5*arR^HarUSzx(n38aswERcM\u003cPUy\u0026r@g3lQDlarR!zwPI{3x8", "ln": 8808, "col": 38, "line": 334 }, { "b": "aAz4nB-IvxbYWEqB.(dbarR^Hw[.O{arR!vw/@ltxl4N5at365ar\u003cY{A=(mxBz\u0026pmwPPasa%Z#yxj+\u003c]wG?E7arR!GxK#5*arR^HarUclwNPuYarR^Hw[.O{ay]zd", "ln": 9070, "col": 6, "line": 346 }, { "b": "vR/Q^djCPharR^HarR^HAb]VgBy(TtdJ?8%ze:i9x(mMac37Z=B0bKtx(F35wg?b8a%n6Pf^m.:bR*LJarR^HarR^HAb]VgBy(TEB%7)rzeZQBjALdQByO:2wGUG0vrlHcvqPNsa%?pOaz$R8wJ.j-B0q-Gx(dAAa%?pOk0i[4x(F35wg{befly=DByO:2wJ\u003cvpcM\u003cPUf^m.:bR*L^a$$S6a{]CnarR^HarUfjzGGDcBsPG#bY)QmA3tSiarR^Hazbr{3lQDlarR^KavG{:wN/?2A^n^FwPI/yazbt7wGUYday]hcvpB4:wc%C4arR^HA+funA=90N3lQDlazbr{arUikzE\u003cdZarR)Kl${WMv@#TfC{4csB8S-Ow[=6)azC)twO${=y?mb:arUYoBAIRwatBjK3jpx/zEW^5z/cXtx(dB5Byx393vra5ar@19A+PAkaARsmwPI%4zeY*?arUi6By=NDBS.\u003eUc37W+p9H/6boP]@v@Dl}B08$QzEEB3B7F\u003c1zE^/hB7]J4wGQ", "ln": 12141, "col": 17, "line": 484 }, { "b": "fE4\u0026\u0026f^OC4EiH9?ar@1Ey?d9$aA?glx\u003c\u003e[3B0bykayX=2xDQ\u00267az#ataAIWAAbP=sar\u0026J]bo!mzwPzt?boQ/vv{%f@B97\u0026hBye]GbQ+5+f!:*$DOD-{e}1])dgdpxy\u0026o", "ln": 12671, "col": 22, "line": 510 } ], "depth": 2, "facts": { "imp": [ [ "", "pwd" ], [ "", "shopt" ], [ "", "timestamp" ], [ "", "printf" ], [ "", "printf" ], [ "", "printf" ], [ "", "printf" ], [ "", "printf" ], [ "", "printf" ], [ "", "printf" ], [ "", "printf" ], [ "", "printf" ], [ "", "printf" ], [ "", "printf" ], [ "", "exit" ], [ "", "$disable_arg" ], [ "", "disable" ], [ "", "disable" ], [ "", "disable" ], [ "", "$interactive_arg" ], [ "", "boolean" ], [ "", "boolean" ], [ "", "boolean" ], [ "", "$output_arg" ], [ "", "printf" ], [ "", "exit" ], [ "", "clean" ], [ "", "compile_dir" ], [ "", "compile_file" ], [ "", "printf" ], [ "", "exit" ], [ "", "$all" ], [ "", "is_disabled" ], [ "", "compile_dir" ], [ "", "timestamp" ], [ "", "printf" ], [ "", "timestamp_diff" ], [ "", "cd" ], [ "", "exit" ], [ "", "printf" ], [ "", "timestamp_diff" ], [ "", "git" ], [ "", "cd" ], [ "", "exit" ], [ "", "is_disabled" ], [ "", "compile_dir" ], [ "", "pre_compile_files" ], [ "", "timestamp" ], [ "", "is_disabled" ], [ "", "compile_dir_file" ], [ "", "timestamp" ], [ "", "post_compile_files" ], [ "", "dirname" ], [ "", "basename" ], [ "", "pre_compile_files" ], [ "", "timestamp" ], [ "", "compile_dir_file" ], [ "", "timestamp" ], [ "", "post_compile_files" ], [ "", "cd" ], [ "", "exit" ], [ "", "copy_package_files" ], [ "", "cp" ], [ "", "printf" ], [ "", "timestamp_diff" ], [ "", "timestamp" ], [ "", "compile" ], [ "", "timestamp" ], [ "", "printf" ], [ "", "printf" ], [ "", "timestamp_diff" ], [ "", "printf" ], [ "", "printf" ], [ "", "timestamp_diff" ], [ "", "xml_escape" ], [ "", "$exit_on_error" ], [ "", "exit" ], [ "", "return" ], [ "", "$interactive" ], [ "", "$latex_engine$latex_suffix" ], [ "", "$latex_engine$latex_suffix" ], [ "", "printf" ], [ "", "tail" ], [ "", "return" ], [ "", "grep" ], [ "", "break" ], [ "", "printf" ], [ "", "printf" ], [ "", "printf" ], [ "", "exit" ], [ "", "printf" ], [ "", "exit" ], [ "", "$dev" ], [ "", "$all" ], [ "", "$pdflatex" ], [ "", "$all" ], [ "", "$xelatex" ], [ "", "$all" ], [ "", "$lualatex" ], [ "", "$all" ], [ "", "$htlatex" ], [ "", "printf" ], [ "", "exit" ], [ "", "printf" ], [ "", "exit" ], [ "", "printf" ], [ "", "printf" ], [ "", "return" ], [ "", "return" ], [ "", "date" ], [ "", "strip" ], [ "", "strip" ], [ "", "strip" ], [ "", "strip" ], [ "", "printf" ], [ "", "printf" ], [ "", "printf" ] ], "tgt": [ "$all", "$dev", "$disable_arg", "$exit_on_error", "$htlatex", "$interactive", "$interactive_arg", "$latex_engine$latex_suffix", "$lualatex", "$output_arg", "$pdflatex", "$xelatex", "basename", "boolean", "break", "cd", "clean", "compile", "compile_dir", "compile_dir_file", "compile_file", "copy_package_files", "cp", "date", "dirname", "disable", "exit", "git", "grep", "is_disabled", "post_compile_files", "pre_compile_files", "printf", "pwd", "return", "shopt", "strip", "tail", "timestamp", "timestamp_diff", "xml_escape" ], "funcs": [ [ "main", 1026 ], [ "clean", 5916 ], [ "compile_dir", 6056 ], [ "compile_file", 6765 ], [ "pre_compile_files", 7082 ], [ "copy_package_files", 7218 ], [ "post_compile_files", 7303 ], [ "compile_dir_file", 7714 ], [ "compile", 8493 ], [ "boolean", 9175 ], [ "disable", 9492 ], [ "is_disabled", 10948 ], [ "timestamp", 12471 ], [ "timestamp_diff", 12576 ], [ "strip", 13136 ], [ "xml_escape", 13335 ] ], "metrics": { "ast": { "op.eq": 49, "op.gt": 4, "op.lt": 1, "op.ne": 2, "op.add": 4, "op.lor": 8, "op.mod": 3, "op.sub": 5, "max_depth": 14, "call_count": 117, "node_count": 3449, "max_array_len": 3, "op_density.eq": 0.01, "op_density.gt": 0, "op_density.lt": 0, "op_density.ne": 0, "op_density.add": 0, "op_density.lor": 0, "op_density.mod": 0, "op_density.sub": 0 }, "file": { "size": 13806, "entropy": 4.72 }, "text": { "lines": 573, "top_char": 101, "max_ws_run": 17, "digit_ratio": 0.02, "space_count": 3073, "char_entropy": 4.72, "unique_chars": 84, "top_char_null": 0, "lines_over_200": 2, "string_density": 0.37, "top_char_ratio": 0.07, "avg_line_length": 23.09, "max_line_length": 279, "empty_line_ratio": 0.13, "last_line_length": 1, "whitespace_ratio": 0.26, "identifier_density": 1.17, "line_length_stddev": 27.11, "normalized_string_count": 8.81, "repeated_char_sequences": 13, "suspicious_string_ratio": 0.04, "suspicious_comment_ratio": 0.01, "suspicious_identifier_ratio": 0.02, "normalized_unique_identifiers": 13.1 }, "binds": { "count": 121 }, "calls": { "dynamic_target_count": 15, "obfuscated_target_count": 2 }, "binary": { "peak_region_bytes": 11758, "peak_region_entropy": 4.82 }, "source": { "function_count": 16 }, "strings": { "bytes": 2619, "count": 211, "shell": 8, "avg_length": 12.41, "max_length": 140, "path_count": 1, "avg_entropy": 2.38, "empty_count": 8, "entropy_stddev": 1.16 }, "comments": { "chars": 3107, "count": 70, "lines": 70, "xxx_count": 1, "high_entropy": 1, "to_code_ratio": 0.14, "url_in_comments": 3 }, "functions": { "count": 16, "density": 2.79, "avg_params": 7.44, "code_ratio": 0.93, "max_params": 25, "length_stddev": 37.94, "over_100_lines": 1, "avg_name_length": 10.69, "avg_length_lines": 33.25, "max_length_lines": 162, "min_length_lines": 4, "many_params_count": 8, "high_entropy_names": 1, "avg_param_name_length": 97.15 }, "identifiers": { "count": 670, "unique": 120, "avg_length": 7.44, "max_length": 26, "min_length": 1, "avg_entropy": 2.3, "reuse_ratio": 0.18, "length_stddev": 4.79, "has_digit_ratio": 0.03, "sequential_names": 2, "single_char_count": 7, "single_char_ratio": 0.06, "high_entropy_count": 3, "high_entropy_ratio": 0.03, "all_lowercase_ratio": 0.73, "numeric_suffix_count": 1 } } }, "id": 277, "mol": "O(As)H₄(CmF₂PoU)", "path": "caption-2023.9.8-1.src.rock!!caption-CTAN_2023-09-08.zip!!caption-CTAN_2023-09-08/test-lib.sh", "pid": 2, "risk": 6, "sha": "57b9208466191abf6b41e5ed1db8bc4d30049e40ab7669f06602a6f64f8fcc8c", "size": 13806, "traits": [ { "id": "metadata/lang/natural::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"", "spans": [ [ 204, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-2", "conf": 0.8, "crit": 1, "desc": "English function-word token \"and\"", "spans": [ [ 225, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-3", "conf": 0.8, "crit": 1, "desc": "English function-word token \"that\"", "spans": [ [ 8664, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "spans": [ [ 1254, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-7", "conf": 0.8, "crit": 1, "desc": "English function-word token \"this\"", "spans": [ [ 5968, 0 ] ] }, { "id": "micro-behaviors/communications/http/url/forge::public-code-forge-url", "conf": 0.9, "crit": 3, "desc": "References a public code-forge URL", "spans": [ [ 98, 19 ] ] }, { "id": "micro-behaviors/fs/write/file/redirect::shell-printf-file-write", "conf": 0.86, "crit": 3, "desc": "Shell printf redirects output to a file", "spans": [ [ 5553, 151 ], [ 7366, 115 ], [ 8001, 68 ], [ 8180, 114 ], [ 12205, 91 ] ] }, { "id": "micro-behaviors/ui/help::script-usage-screen", "conf": 0.9, "crit": 3, "desc": "Script prints a CLI usage screen", "spans": [ [ 1344, 26 ] ] }, { "id": "objectives/anti-static/obfuscation/code-metrics/structure::sh-dense-eval-chains-unless-cond-1--rx-3", "atk": "T1027", "mbc": "B0032", "conf": 0.92, "crit": 3, "desc": "Command-line usage text marker", "spans": [ [ 1344, 7 ] ] }, { "id": "micro-behaviors/fs/directory/chdir::shell-change-directory", "conf": 0.95, "crit": 3, "desc": "Shell changes working directory", "spans": [ [ 5531, 2 ] ] }, { "id": "micro-behaviors/process/create/shell/target::sh-reconstructed-command-target-shape", "conf": 0.9, "crit": 3, "desc": "Dynamic shell call target shape" } ], "type": "shell" }, { "ctx": [ { "b": "boXZHx(kOkvrl8?3l{WnwPI@CB7+[9avy6:Aa%c1B08(GwNPQ}C{%\u003eAwmM/[z!0{bwO#P#BzkVhefG4CB95JKazC[rB.8Xaz!0{bwO#Qh3jn12l3mo.z/N(Yl3M%Sax9h}zdN:1wO+[0asHVywO-#uz/6u5A+n)0wop7GeP0aLz7b/paxqrkiV]K/azt\u003esAc15[fk20vy**^9v@Diqvr=v1B8L]jwPzx]y?dSvv{%s#x(v\u003e@boPx.By^GQarSA[gbyHoi4V*w3jp\u0026)B-H#6atbr?wPI@By?WuhB7+)/boQ6aA+^mnA=l8rwftG5AV!7\u003cyGa\u003eEar?$Fwm!!LsrIf}A=k$VaAg\u003e6y*?A%CPXzDx(4u6vp-!Oy\u0026a97vqYH:uT^}\u0026wg??kvKTtXv{%m)z/^auAaJ]frc-B]atC0Jz/fUtw[=6)azbLjaAz44wnb{]a%npFB8#FnB1.fuBzb/afkkGGB.a]te{7VHdgf^3ax@4)aS@vEas6GNo*{Y/ze0^cwQ2\u003eIwQ567B1.lBB97\u0026by+GyszGG}MBA}?pf!V%QvpA}7vrb^=wQd\u003cdasnATeO2$Hnkz@Gfd}9QyJKcjfly=IzdW\u0026xx(n0lvqG:kB8Mhwv}vr4A:-A\u003efjw)fvREGqwQ567fj]cuBAo9SD2NsHfjw)fvREG7A:-A*D1z4tu0N!VxK#5*32KD*x(UsFA3cz%pFBnhe]trrBy/XIBy/Ylw]/RtzGx]dy?$+pz/fVrflzFUwIC\u0026DA:-A\u003e3l]\u003c[zxHJLatbo1e?O!fe?.o:B-H#6fjw)fvREG7A:-A\u003efly=IzdUCkz/fVrflzFUwIC\u0026DA:-A\u003efjw)fvR6*@B08-0pFBnhe]trrBy/XIBy/Ylw]/RtzGx]dy?$+pz/fVrflzFUwIC\u0026DA:-A\u003efa51}A3c-QAV=R#pFBnhe]trrBy/XIBy/Ylw]/RtzGx]dy?$+Cz/{8gwImFjvpA}7vrb^=x!KNtCX}4Cw]zNeB1.SXAaH:Svrb^=x!J[nvpA![wPF$tnkz@Gfd}9QyJKcjfly=IzdW\u0026xx(n0lvqG:kw]zNeB1.SXAaH:Svrb^=x!G/1ze0^cwQ2tfzE^i0A+e\u003c6wPII(w[.OVboQ6aA+^mnA=l8rwftG5AV!7\u003cyGa\u003eEar?$Fwm!!LsrIf}A=k$VaAg\u003e6y*?A%CPXzDx(4u6zEE\u003cc", "ln": 0, "col": 1, "line": 1 }, { "b": "vrb^=x!K7bA=U@swNV=cnkz@Gfd}9QyJKcjfly=IzdW\u0026xx(n0lvqG:kw]zNeB1.SXAaH:Svrb^=x!G/1v@JLxC5!YJnkz@Gfd}9QyJKcjfly=IzdW\u0026xx(n0lvqG:kB8Mhwv}vr4A:-A\u003efjw)fvREGqwQ567fj]cuBAo9SD2NsHfjw)fvREGcvrcB6Cv+kabUgZ9mk3ogx\u003e}*4CRseICX}5lfkkrBByx04fj]cuBAo9SD2NsHfjw)fvREF532Kx(By/Xtw]qc*aAz49A+fr93t9#V3s)\u003c(vpB4:aARgoBt49ivR6vew].E2v}YW\u0026eIF/0wQ2suarR^HarR^Kaxhc8pAR5$A+fb#xL.ljB98W*at2u5vL5ZAxK@qQA+fb#xDRb1zFa92xjSi1B0bQywmYv!zE)u3c}d3ipF@t+dgfQ1B75J]wGV8aB966AvpA!:fj]lozEWu@wI2R?By/XtarR^HarR^HboP@Yl@a{Nw].E2v}U", "ln": 1292, "col": 55, "line": 25 }, { "b": "Aa9l(vp%c]wn=42az#ataAIa9z6i}saA}:AyANb9A=L-3BzMjBvqZvcz/PziCwhejawuiywMQZ0auRzkgbgvmh7ZHpj%j/+wI4}ly?m3@wI2UAwnc9[vR/P#eIgHAB%72%33o:1Bt4DGzFa61vR/QezE[3dx(mG?BywT3e{7VHay2lWx(!urwPGIC", "ln": 5372, "col": 14, "line": 100 } ], "depth": 2, "facts": { "imp": [ [ "", "source" ], [ "", "mkdir" ], [ "", "cp" ], [ "", "miktex" ], [ "", "mkdir" ], [ "", "cp" ], [ "", "miktex" ], [ "", "disable" ], [ "", "disable" ], [ "", "disable" ], [ "", "disable" ], [ "", "disable" ], [ "", "disable" ], [ "", "disable" ], [ "", "disable" ], [ "", "disable" ], [ "", "disable" ], [ "", "disable" ], [ "", "disable" ], [ "", "disable" ], [ "", "disable" ], [ "", "disable" ], [ "", "disable" ], [ "", "disable" ], [ "", "disable" ], [ "", "disable" ], [ "", "disable" ], [ "", "disable" ], [ "", "disable" ], [ "", "disable" ], [ "", "disable" ], [ "", "disable" ], [ "", "disable" ], [ "", "disable" ], [ "", "disable" ], [ "", "disable" ], [ "", "disable" ], [ "", "disable" ], [ "", "disable" ], [ "", "main" ], [ "", "./test-lib.sh" ] ], "tgt": [ "cp", "disable", "main", "miktex", "mkdir", "source" ], "metrics": { "ast": { "op.land": 2, "op.lnot": 2, "max_depth": 8, "call_count": 55, "node_count": 383, "op_density.land": 0.01, "op_density.lnot": 0.01 }, "file": { "size": 5587, "entropy": 4.97 }, "text": { "lines": 107, "top_char": 101, "tab_count": 29, "max_ws_run": 26, "digit_ratio": 0.04, "space_count": 615, "char_entropy": 4.97, "unique_chars": 80, "top_char_null": 0, "string_density": 0.01, "top_char_ratio": 0.1, "avg_line_length": 51.21, "max_line_length": 156, "empty_line_ratio": 0.13, "last_line_length": 9, "whitespace_ratio": 0.13, "identifier_density": 1.95, "line_length_stddev": 40.64, "normalized_string_count": 0.1, "repeated_char_sequences": 1, "suspicious_comment_ratio": 0.23, "normalized_unique_identifiers": 11.87 }, "binary": { "peak_region_bytes": 5587, "peak_region_entropy": 5 }, "imports": { "count": 1, "relative": 1, "relative_ratio": 1, "third_party_count": 1, "third_party_ratio": 1 }, "strings": { "bytes": 2, "count": 1, "avg_length": 2, "max_length": 2, "avg_entropy": 1 }, "comments": { "chars": 2174, "count": 52, "lines": 52, "base64": 3, "todo_count": 10, "high_entropy": 9, "to_code_ratio": 0.95, "url_in_comments": 1 }, "identifiers": { "count": 209, "unique": 80, "avg_length": 25.6, "max_length": 75, "min_length": 2, "avg_entropy": 3.46, "reuse_ratio": 0.38, "length_stddev": 13.29, "has_digit_ratio": 0.61, "high_entropy_count": 59, "high_entropy_ratio": 0.74, "all_lowercase_ratio": 0.11, "all_uppercase_ratio": 0.01 } } }, "id": 278, "mol": "O₂(AsEr)H₃(CmF₂Po)", "path": "caption-2023.9.8-1.src.rock!!caption-CTAN_2023-09-08.zip!!caption-CTAN_2023-09-08/test.sh", "pid": 2, "risk": 6, "sha": "a7023f9321e94d78906f8bf163b0cdb2477b73e7ed7bf230f86a0b0ff202f2fd", "size": 5587, "traits": [ { "id": "metadata/import/shell/relative/1/test-lib/sh::relative/1/test-lib/sh", "conf": 0.95, "crit": 2, "desc": "imports ./test-lib.sh", "spans": [ [ 221, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"", "spans": [ [ 1587, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "spans": [ [ 250, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-6", "conf": 0.8, "crit": 1, "desc": "English function-word token \"with\"", "spans": [ [ 5420, 0 ] ] }, { "id": "micro-behaviors/communications/http/url/forge::public-code-forge-url", "conf": 0.9, "crit": 3, "desc": "References a public code-forge URL", "spans": [ [ 149, 19 ] ] }, { "id": "micro-behaviors/fs/shell-ops::recursive-copy-variable-destination-portable", "conf": 0.9, "crit": 3, "desc": "Recursive copy to variable destination", "spans": [ [ 723, 93 ], [ 1356, 93 ] ] }, { "id": "micro-behaviors/fs/directory/mkdir::mkdir-command", "conf": 0.8, "crit": 3, "desc": "Shell invokes mkdir command", "spans": [ [ 548, 56 ] ] }, { "id": "micro-behaviors/fs/path/location::home-hidden-dotdir-ref", "conf": 0.6, "crit": 3, "desc": "Home-relative hidden directory path literal", "spans": [ [ 397, 14 ] ] }, { "id": "micro-behaviors/process/create/script/file::shell-script-execution-alt", "atk": "T1059.004", "conf": 0.7, "crit": 3, "desc": "Executes shell script via alt interpreters", "spans": [ [ 212, 22 ] ] }, { "id": "objectives/anti-static/obfuscation/code-metrics/identifiers::identifier-obfuscation-cond-0--inline-23810", "atk": "T1027", "mbc": "B0032", "conf": 0.9, "crit": 3, "desc": "Average identifier length \u003e= 22 chars" }, { "id": "objectives/evasion/masquerade/file/lure::pdf-search-home-posix--rx-5", "atk": "T1036", "conf": 0.9, "crit": 3, "desc": "Documents directory reference", "spans": [ [ 75, 9 ] ] } ], "type": "shell" }, { "id": 403, "sha": "fb472b50c32605531ddfb9450cda04bd152d762e8903bec0ed3a4a97758f2cb7", "path": "caption-2023.9.8-1.src.rock!!caption-CTAN_2023-09-08.zip!!caption-CTAN_2023-09-08/test/floatrow/pslearn.pdf", "risk": 1, "size": 7545, "type": "pdf", "depth": 2 }, { "id": 408, "sha": "912df9db709d79d4306c4f28562eef8b55119728e904a675724a636399a07b6d", "path": "caption-2023.9.8-1.src.rock!!caption-CTAN_2023-09-08.zip!!caption-CTAN_2023-09-08/test/keyfloat/images/image.pdf", "risk": 1, "size": 5456, "type": "pdf", "depth": 2 }, { "id": 409, "sha": "78dc9b5658635f5e9ce6f1766110e33a1369d73aa9917d1f3e2137b1dc796076", "path": "caption-2023.9.8-1.src.rock!!caption-CTAN_2023-09-08.zip!!caption-CTAN_2023-09-08/test/keyfloat/images/image2.pdf", "risk": 1, "size": 4700, "type": "pdf", "depth": 2 }, { "id": 468, "sha": "8feb2f8cbba53142a72e4c15f898c1ea34bcbd420feae1bcf7b2a18d1ece9c16", "path": "caption-2023.9.8-1.src.rock!!caption-CTAN_2023-09-08.zip!!caption-CTAN_2023-09-08/test/tlc2/Escher.pdf", "risk": 1, "size": 2152, "type": "pdf", "depth": 2 }, { "id": 470, "mol": "Md", "sha": "593a59cb38a3667b4e3d1f027042ce045ff47ea09bd6c22fcded78cbe0f04551", "path": "caption-2023.9.8-1.src.rock!!caption-CTAN_2023-09-08.zip!!caption-CTAN_2023-09-08/test/tlc2/Escher2.eps", "risk": 1, "size": 9378, "type": "postscript", "depth": 2 }, { "id": 471, "mol": "Md", "sha": "79e1ef5c270ca6bf8ab51b96148a6e9431469cdae7139bc0161df1cbea0c86ed", "path": "caption-2023.9.8-1.src.rock!!caption-CTAN_2023-09-08.zip!!caption-CTAN_2023-09-08/test/tlc2/cat.eps", "risk": 1, "size": 15737, "type": "postscript", "depth": 2 }, { "id": 472, "sha": "eaefdd73207821fc162d1812ae0bba313ca4eee04c57ff929147f2e9fa5f2884", "path": "caption-2023.9.8-1.src.rock!!caption-CTAN_2023-09-08.zip!!caption-CTAN_2023-09-08/test/tlc2/cat.pdf", "risk": 1, "size": 2971, "type": "pdf", "depth": 2 }, { "id": 473, "mol": "Md", "sha": "79e1ef5c270ca6bf8ab51b96148a6e9431469cdae7139bc0161df1cbea0c86ed", "path": "caption-2023.9.8-1.src.rock!!caption-CTAN_2023-09-08.zip!!caption-CTAN_2023-09-08/test/tlc2/cat.ps", "risk": 1, "size": 15737, "type": "postscript", "depth": 2 }, { "id": 474, "mol": "Md", "sha": "72f8aeb2984681fa7fb9506b20a7c9608f11636e3a0afa4cda9947f854bf5595", "path": "caption-2023.9.8-1.src.rock!!caption-CTAN_2023-09-08.zip!!caption-CTAN_2023-09-08/test/tlc2/elephant.eps", "risk": 1, "size": 21191, "type": "postscript", "depth": 2 }, { "id": 475, "sha": "cc659ee990853c10f34a7812cc725514c6e8341c6981ea4b4b1e891c1c19fb28", "path": "caption-2023.9.8-1.src.rock!!caption-CTAN_2023-09-08.zip!!caption-CTAN_2023-09-08/test/tlc2/elephant.pdf", "risk": 1, "size": 8800, "type": "pdf", "depth": 2 }, { "id": 476, "mol": "Md", "sha": "72f8aeb2984681fa7fb9506b20a7c9608f11636e3a0afa4cda9947f854bf5595", "path": "caption-2023.9.8-1.src.rock!!caption-CTAN_2023-09-08.zip!!caption-CTAN_2023-09-08/test/tlc2/elephant.ps", "risk": 1, "size": 21191, "type": "postscript", "depth": 2 }, { "id": 478, "mol": "Md", "sha": "7530dc507c17d3efe69e775271a32443785c6aa0db18aaadd02b43fbb22c69c3", "path": "caption-2023.9.8-1.src.rock!!caption-CTAN_2023-09-08.zip!!caption-CTAN_2023-09-08/test/tlc2/rosette.ps", "risk": 1, "size": 1482943, "type": "postscript", "depth": 2 }, { "id": 479, "mol": "Md", "sha": "d23fb8d966dad68bd738547a03f0bb444344b8849b2216cabe665811d21c1d58", "path": "caption-2023.9.8-1.src.rock!!caption-CTAN_2023-09-08.zip!!caption-CTAN_2023-09-08/test/tlc2/w.eps", "risk": 1, "size": 559, "type": "postscript", "depth": 2 }, { "ctx": [ { "b": "v}Yp*xjSY9z/4dEB.bSox(v)gfekpvg=Eizx\u003ezl]CYWCevrcAvBA.CpeOP8OBzbkqyH}K7wO-!53n0x9kY.6Sw]8x]ByGfkA+fr6BrCdezF5/WA+fbtaA}KuwftP7zE)\u003c4vqGx}tYU3%v{%s#x(v(#z*iyEzE:(hBZ!@%xlwlaflySiy?j.$B-Rf", "ln": 90, "col": 64, "line": 4 }, { "b": "fe4AUCRj5VvpK7:CW\u003ez}zF9Jkv@DiqADL\u0026lBzkVhB1Ym7g=EfHfkboFeP+[.xKM6}eN@vfBy/FABzk\u0026kwI4RleO]cxBzkS9B1IPHwO%8Bz/)TBvrMilB9g@4vq{s5z/ddJz/PS4z/{8rwg.qfzF0Z03jnvcxMOuniXJddwQ2?GBywV{wQ4Y#vqYZ?", "ln": 280, "col": 8, "line": 8 }, { "b": "tW}hYBzkVhkYy:PAa9=#B8kteB.$V2w[=c%wPz(zay]57az$+kwGTuUwmV)9wPI%8BrC13efF\u003euaz2QpB7]b$aA.JzwOD3[zxJczxL.m2ayPzlay]57awuG\u003cBy=OdvqYQ!y\u0026?oparS*haxh][BARkoB7]Mgay[]7z/cXizxK4wB-7$F3jnvcpJgz\u0026z/d9GB.@mix\u003enzMzHb(dxjSh@wPw]6vq{s5z/cXex(kOjB-R\u003eKB7n((y\u0026\u003cla", "ln": 749, "col": 60, "line": 13 }, { "b": "z/4dEB.bSox(v)gfekjxhA0uAxM58DBz\u0026:LB-qquwPI]AAa9x\u003cePbYFvR6Niw]zYwB9g@7x\u003eINewPGCqzy]Wyw\u0026ZnwavG{PB7GwmBz\u003eV9z!s8yq*04#z/P}xB8L(hBy=OezGu}wBZ!\u0026?Acb/jzy[W[yH}PgwOD3{wNY7\u003cBrC^sA+5:03lQD^wOD3kayX]6B7GwMazt\u003esA5]T9By/XHB97\u00262yH}:2xKL^\u003ewIdFhz7/)KwPI%cz/fRHf/7Nsf!$z3wm/T^By/XGvqYQcB9g@4vq{s5z/ddEwO(vewI4\u003efxjSVjB.$P0AXg)zz/47xz!ot0au.[hq!6GHy\u0026\u003clear\u003e]Cv@c6}BrSmUwmY^7wnbP$Aa9*ewO#3\u0026zxHclwPh:8a$W0VxL.k", "ln": 1192, "col": 29, "line": 24 }, { "b": "yJ15#ePUAxx(FeCvqYQcB9g@4vq{s5z/ddJA=k\u0026deN@ZwzGGPgx9]+7c$E46ax)\u0026ty\u0026%SdaAIEqy\u0026\u003ckhvrD6[ay[[#zxHcnvqH0{xD!NuwOD3kaA}ymzxHckvq{s5z/fRVBywS{wOtT-wnb{]a%prixjUZ!vR6B1x(!wB3jnvcxMOuniXJdgCxUVLz!@\u003c7wQ2?rwImIby?dWaBy/Glv}Y)%w]]RkzF%MazGP\u0026fePbcewO%8xzE+tw", "ln": 1621, "col": 53, "line": 29 }, { "b": "aA?Wvay5z+Acb/jzvc.5avpi-atCS6fGyZuf^4$?pJgz\u0026z/d9GwmsvrwnbP$w]8Ndvp%d6v{%s#x(v(izFrP]BrCZzBy/tjB8L@bwPzVhz^)o}az2Omv}YB/zGEALvqH16az\u003e?max{1ht{aigvruPltoNDYaA.Njaxiw)zF\u003cJqA+P2%aA.NzwPw]7wPw]6vq{s5z/b[8auZ\u0026lB.r-TxMOuniXJddwQ2?GBywV{wQ4Y#vqYZ?e[n*pf8", "ln": 2369, "col": 74, "line": 42 }, { "b": "ztXD@wO@S3x\u003enAdBZ=}jvq{s5z/ddEwOc0aDuyuwx(mH0awuiMwO-GgAb]VgxjU%iaA}ykv}YB{az2QpvpA!*aBnfEax\u0026t\u003cBz#wuyJG[aaA?Wvay5#gvQ\u0026?=BzkVhvScGlzF%2#azkb6az$[6xMLwfx\u003c#fpasHrfA+/97z/]@diV@9YAarr}j-\u003eZ!wGV59BB4IoaT):9eG^x5xf4d\u0026ga+joeIGf(3n0x9Ab]Jevrb{?vq{s5z/e=l", "ln": 2818, "col": 45, "line": 48 }, { "b": "Ab]J1xK#6(azkn8vru0)BrC^sA+5:0asICxB0bTqA=2@vy?Wx)az$[6xMLwsA+PYhvqE60wOufmed9Hxz!9B1ayO.\u003cAV!QOz/fVhzGPJ3mR)0KBrCBy?YM#Ov}W0ex\u003enA0A@oPZAV/KpA+F($By/tvaA}ymzxJE#B0bKDvRfs!eL]\u003e\u003ewPP5cwO+^=wO@S8B962w3n0xlBAzE.fe4J[Cp)-MB-7]re[wJDw]zZjzf4vKxM59pxMvV)", "ln": 9863, "col": 60, "line": 230 }, { "b": "qE$2[wQ3lyvrDj9x\u003eg^aar\u0026/#avZ6TB-I5mayPd#ayPqjCw?Iqa{]I?z//LkBzb98azC)tB-88dv}x.5vrcSoc$d17aA.NjwPINavpB4:diJ.JaA.:paz2!py?Wx[BrC78zGGDgx(mMav@Dj3vqYQ%azC.mx\u003eg=$Bzbkdw]8x]BrCdjC4\u003e#nzF-%5", "ln": 11929, "col": 3, "line": 289 }, { "b": "w)]g.azVauDsZ$pr+lq}wODidvrDf8zE[37y\u0026r:7fgowYy*?u}mR)0KBzkS9mq^o.A=k\u0026jwO#O%3n0w^vRB?uxk80]wODleC5Imvb5?Ewx([6czAPf^B-7.jwmYQ2l1jqqy?dWaxlbTTraflEy\u00260W2DGn:Q", "ln": 15876, "col": 48, "line": 405 }, { "b": "vqPNsEoYJos7V2LBAIRnDV?g$fL(dAs-nB9v{%l$v}Yp*xjSicxK@r7vqPM#z!pblxK@q#x\u003eINewPF#5zE:(ivpB4:B0bWvBz8!sxK@r8Acb/jzGud\u0026vR6g^zHlwCz//MstW?nSx(notvpBv}vrc^ykZN{1kZN]}kZM:QBZX*ey^rt}Ef}8tD$E89B-I5hvqPNsD(%:UtY14]vs8)2zdObrclJ", "ln": 16722, "col": 22, "line": 420 }, { "b": "wO${[wJ-H%xd!MstXd!-DVsgDBy/\u003ecD2E*Fv{%l$v}Yp*xjSicxK@q#x\u003eINewGU(0zdK\u0026izY\u0026B}mRMG.cOt-ktYT:\u003cy\u00261fdx(ErGpdw1^nOf8\u003cz/)gBB7DFoxK@q\u003eAa9l(vp%d#vQS.SyY", "ln": 17072, "col": 9, "line": 429 }, { "b": "B-8qjA=SviA+cw6z/fVhzGP(uB0bNrA=l8kxM53naARpday]z2B.$YcBs)[cra]#!ay!?$ayX[8v}Yp*xjUP@CwhejaARpdaA8jvx(v)g3s44Kxk8mgADMhwwQN/)wOkZ{DVSX9B.\u003eGbEs30JEf}8tD$E89B-I5qx([35zASv\u0026clMMnwQ5rsBBdIh", "ln": 17937, "col": 11, "line": 457 } ], "depth": 2, "facts": { "metrics": { "file": { "size": 27310, "entropy": 5.1 }, "binary": { "peak_region_bytes": 13312, "peak_region_entropy": 5.4 } } }, "id": 519, "mol": "Md(Pt)", "path": "caption-2023.9.8-1.src.rock!!caption-CTAN_2023-09-08.zip!!caption-CTAN_2023-09-08/unsorted/00todo.txt", "pid": 2, "risk": 1, "sha": "980ca4df284c6b6ace1e1465f5d3734b1667fa7e47848206e776b5a78212ba5c", "size": 27310, "traits": [ { "id": "metadata/lang/natural::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"", "spans": [ [ 138, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-2", "conf": 0.8, "crit": 1, "desc": "English function-word token \"and\"", "spans": [ [ 1404, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-3", "conf": 0.8, "crit": 1, "desc": "English function-word token \"that\"", "spans": [ [ 11977, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-4", "conf": 0.8, "crit": 1, "desc": "English function-word token \"have\"", "spans": [ [ 328, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "spans": [ [ 1240, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-6", "conf": 0.8, "crit": 1, "desc": "English function-word token \"with\"", "spans": [ [ 16796, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-7", "conf": 0.8, "crit": 1, "desc": "English function-word token \"this\"", "spans": [ [ 17985, 0 ] ] }, { "id": "metadata/lang/natural::lang-german--atom-1", "conf": 0.8, "crit": 2, "desc": "German function-word token \"nicht\"", "spans": [ [ 2433, 0 ] ] }, { "id": "metadata/lang/natural::lang-german--atom-2", "conf": 0.8, "crit": 2, "desc": "German function-word token \"oder\"", "spans": [ [ 9927, 0 ] ] }, { "id": "metadata/lang/natural::lang-german--atom-3", "conf": 0.8, "crit": 2, "desc": "German function-word token \"aber\"", "spans": [ [ 2882, 0 ] ] }, { "id": "metadata/lang/natural::lang-german--atom-4", "conf": 0.8, "crit": 2, "desc": "German function-word token \"auch\"", "spans": [ [ 1685, 0 ] ] }, { "id": "metadata/lang/natural::lang-german--atom-5", "conf": 0.8, "crit": 2, "desc": "German function-word token \"sich\"", "spans": [ [ 813, 0 ] ] }, { "id": "metadata/lang/natural::lang-german--atom-7", "conf": 0.8, "crit": 2, "desc": "German function-word token \"werden\"", "spans": [ [ 1326, 0 ] ] }, { "id": "metadata/lang/natural::lang-german", "conf": 0.8, "crit": 3, "desc": "Contains probable German text", "uses": [ 7, 8, 9, 10, 11, 12 ], "spans": [ [ 813, 4 ], [ 1326, 6 ], [ 1685, 4 ], [ 2433, 5 ], [ 2882, 4 ], [ 9927, 4 ] ] } ], "type": "text" }, { "id": 648, "sha": "4211097171bda1a4129e18d69b02c684b237c03f3a47ed7c91bacbe154893782", "path": "caption@2023.9.8-1.registry.json", "size": 821, "type": "registry", "depth": 1 } ], "omitted_files": 28, "rev": "c1ea9", "v": "8" } }