{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 0.8383554220199585,
        "class": 0
      }
    ],
    "prob": 0.8383554,
    "class": 0,
    "models": [
      {
        "m": "az",
        "prob": 0.8383554,
        "class": 0
      }
    ],
    "version": "v17.17",
    "thresholds": [
      0.999503,
      0.9998882
    ],
    "analyzed_at": "2026-05-27T22:16:12Z"
  },
  "path": "wavefront-proxy-13.9-r15.apk",
  "raw": {
    "v": "5",
    "fs": [
      {
        "f": "O(C₂)",
        "x": 34,
        "ff": {
          "m": {
            "file": {
              "size": 41713414.0,
              "entropy": 7.99,
              "size_bytes": 41713414.0
            },
            "parse": {
              "error_count": 1.0
            }
          },
          "v": {
            "file.stem": "wavefront-proxy-13.9-r15",
            "file.basename": "wavefront-proxy-13.9-r15.apk",
            "archive.format.kind": "tar.gz",
            "archive.member_count": 2,
            "archive.members[0].path": ".melange.yaml",
            "archive.members[0].type": "unknown",
            "archive.members[1].path": ".PKGINFO",
            "archive.members[1].type": "unknown",
            "archive.members[0].gname": "root",
            "archive.members[0].uname": "root",
            "archive.members[1].gname": "root",
            "archive.members[1].uname": "root",
            "archive.timing.mtime_max": 1779914602,
            "archive.timing.mtime_min": 1779914602,
            "archive.builder.gnames[0]": "root",
            "archive.builder.unames[0]": "root",
            "archive.members[0].sha256": "adc451c718e4eeb3b6a288daadb1d2e47915442cd6815205af637398fba53617",
            "archive.members[1].sha256": "929f8d7f8c67a71437499d381a2901e1c0754566f1eab6d4ff86955b28cdab4e",
            "archive.format.regular_count": 2,
            "archive.format.entry_types[0]": "regular",
            "archive.members[0].entry_type": "regular",
            "archive.members[0].mode_octal": 420,
            "archive.members[0].mtime_unix": 1779914602,
            "archive.members[0].size_bytes": 38029,
            "archive.members[1].entry_type": "regular",
            "archive.members[1].mode_octal": 420,
            "archive.members[1].mtime_unix": 1779914602,
            "archive.members[1].size_bytes": 384,
            "archive.timing.mtime_unique_count": 1
          },
          "er": [
            [
              "malformed",
              "tar-parse"
            ]
          ],
          "id": "tar.gz"
        },
        "id": 0,
        "sz": 41713414,
        "ts": [
          {
            "a": "T1027",
            "c": 0.949999988079071,
            "d": "Gzip magic in data file",
            "e": [
              "1f 8b"
            ],
            "i": "objectives/anti-static/obfuscation/payload/data-file::gzip-magic-data-blob",
            "l": 1,
            "m": "F0001"
          },
          {
            "a": "T1620",
            "c": 0.9800000190734863,
            "d": "Bundled JNA Win32 dispatch paths",
            "e": [
              "jna/win32-x86/jnidispatch.dll"
            ],
            "i": "objectives/evasion/fileless/memory::archive-jna-win32-dispatch",
            "l": 1
          },
          {
            "a": "T1102.002",
            "c": 0.8399999737739563,
            "d": "Android OkHttp client reference",
            "e": [
              "okhttp3"
            ],
            "i": "objectives/command-and-control/channel/deaddrop/cloud-storage::android-okhttp-client-reference",
            "l": 3,
            "m": "B0030"
          },
          {
            "a": "T1555.003",
            "c": 0.8500000238418579,
            "d": "Java OkHttp POST client",
            "e": [
              "okhttp3/RequestBody"
            ],
            "i": "objectives/credential-access/discord/token::java-okhttp-post-client",
            "l": 1
          },
          {
            "a": "T1620",
            "c": 0.9599999785423279,
            "d": "Bundled JNA core class archive paths",
            "e": [
              "com/sun/jna/Native.class"
            ],
            "i": "objectives/evasion/fileless/memory::archive-jna-core-classes",
            "l": 1
          },
          {
            "a": "T1027.002",
            "c": 0.8199999928474426,
            "d": "APK bundles OkHttp network client data",
            "e": [
              "okhttp3/internal/publicsuffix/publicsuffixes.gz"
            ],
            "i": "objectives/command-and-control/dropper/staging/encrypted::apk-okhttp-publicsuffix-data",
            "l": 4,
            "m": "B0024"
          },
          {
            "c": 0.8799999952316284,
            "d": "Java invoke reference",
            "e": [
              "invoke"
            ],
            "i": "objectives/command-and-control/backdoor/loader/classloader::invoke-string",
            "l": 1
          },
          {
            "c": 0.9800000190734863,
            "d": "Spring Boot executable JAR",
            "e": [
              "BOOT-INF/lib/"
            ],
            "i": "well-known/lib/spring-boot::executable-jar",
            "l": 2
          }
        ],
        "sha": "59e64f2c139f348b36017c747eb6fc72aaf74b1a26ecaf103d7fefb4b7c03dc6",
        "path": "/data/samples/unknown/foraged/linux/wolfi.dev/_/wavefront-proxy/wavefront-proxy-13.9-r15.apk",
        "type": "tar.gz"
      }
    ],
    "tv": "eaad2"
  }
}