{ "ml": { "v": "7", "eng": "2.2.0-beta.2", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.011951566, "rte": "az", "prob": 0.011951566 } ], "prob": 0.011951566, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.011951565742492676, "type": "xz" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.009726841934025288, "type": "shell" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.00985120702534914, "type": "shell" } ], "version": "v18.18", "analyzed_at": "2026-06-29T00:49:32Z" }, "path": "tex-dozenal-7.2.75722.tgz", "raw": { "files": [ { "id": 0, "mol": "O(Er)H(Po₂)", "sha": "5d22471bccb3c96b58ec4571bbf7eae1dbe7bfcbdca6c2c1214092f26df8e9ad", "path": "/data/samples/good/foraged/netbsd/netbsd.org/_/tex-dozenal-7.2.75722/tex-dozenal-7.2.75722.tgz", "risk": 4, "size": 107816, "type": "xz", "facts": { "metrics": { "file": { "size": 107816.0, "entropy": 8.0, "size_bytes": 107816.0 }, "binary": { "overall_entropy": 8.0, "peak_region_bytes": 107520.0, "peak_region_entropy": 7.84 }, "consistency": { "extension_content_mismatch": 1.0, "extension_content_mismatch.archive_as_archive": 1.0 } } }, "traits": [ { "id": "micro-behaviors/os/env/vars/access::env-cmd", "atk": "T1082", "conf": 0.6000000238418579, "crit": 3, "desc": "env command path" }, { "id": "micro-behaviors/process/interpreter/perl::perl-keyword", "conf": 0.699999988079071, "crit": 3, "desc": "perl interpreter keyword (beyond shebang)" }, { "id": "objectives/evasion/masquerade/extension/shebang::bash-shebang-first-line", "atk": "T1036.008", "mbc": "F0008", "conf": 0.949999988079071, "crit": 3, "desc": "File starts with" }, { "id": "micro-behaviors/process/create/shell/spawn::sh-dynamic-command-target", "conf": 0.6000000238418579, "crit": 3, "desc": "Shell command name from variable", "spans": [ [ 0, 34 ] ] }, { "id": "micro-behaviors/process/create/shell/spawn::shell-symbols", "conf": 0.8999999761581421, "crit": 3, "desc": "Shell execution symbols", "from": [ { "file": 1 }, { "file": 2 } ], "spans": [ [ 0, 34 ] ] }, { "id": "micro-behaviors/process/create/shell/spawn::bin-sh", "atk": "T1059.004", "mbc": "E1059.004", "conf": 0.6000000238418579, "crit": 3, "desc": "References /bin/sh (Bourne shell)" } ] }, { "ctx": [ { "b": "boXZHx(kOBxBk%\u003eboOmbwPQmql](D7wNPaXAX8wRf!Lm8gb7BtfekjngCx}ah99DFiX\u0026xiCwhvCmr\u0026+]bNK(Smncfla%X\u0026^3q:w=pc?PyjT8daa{}mFk$svba%X]/3uG({w]]dJ3jo72ofBELB-RNRvRGZkvrVGh3pm3SmnucymlI?FB-RNRvRGZkvQTs?zEEx[a{{X6r6qAUvRGZkv{%E63pvuOqCYI2flItRfjFTkfjOWdA=riflR6{El{h.EvRGZkv}YZ$wfIvFnkAqZjT8L4B8\u0026{P", "n": [ { "c": 3, "d": "pkgsrc binary package maintainer script filename", "i": "metadata/package/files/bsd::pkgsrc-maintainer-script-basename", "o": 0, "z": 10, "cf": 0.92 }, { "c": 3, "d": "pkgsrc maintainer script NetBSD header", "i": "metadata/package/files/bsd::pkgsrc-maintainer-script-header", "o": 14, "z": 16, "cf": 0.92 }, { "c": 3, "d": "pkgsrc maintainer script lifecycle variables", "i": "metadata/package/files/bsd::pkgsrc-maintainer-script-vars", "o": 77, "z": 23, "cf": 0.92 }, { "c": 1, "d": "Awk decoder invocation", "i": "objectives/anti-static/obfuscation/encoding/shell::shell-awk-token", "o": 124, "z": 3, "cf": 0.9 } ], "ln": 0, "col": 1, "line": 1 }, { "b": "jT8L4B8\u0026{yx(kOox(mD93p^#.p^30QB-RNRvRGZkxl4N5a{{?tk#G\u0026\u0026a{{\u003efk$0\u003cWflItRfjFTkfka{9wfIvLl{h.EB-RNRvRGZkx\u003eey{oI4#LmNo{DjT8L4B8\u0026{PvRGZky?W^5w)]Z%a{}1sjT8K*x(kOuzxYAYq-#rTvRGZky\u0026Z^co?N(CqAViSvRGZkzeiV@AV=@Ma{}4BjTa-^at4gH3q:e?oF[%SflItRfk$YtfjFTkfk$Gyy:6i.ogJtPl}{lFjT8L4B8\u0026{PvRGZkAbf8[vpTj?zxYA:ogJtXpdw2xa$[7WAXzGyx(kOyyId0*zF0/h3q:!(uQEKQjT8K*x(kOyCvR)8qCxp#fjFTkflg[N3q%O^nM4X}fjFTkflg]ux(Uy8q:\u003c8qa$[7WAXy)ozzc6xwfIvVmn#YJrY}SWB-RNRvRGZkwO#Vn3r6FUa$)ztzzc6Aa{}mAqDb!6flItRfjFTkflq5LBrR5\u003crxRJVB-RNRvRGZkB9eVlr7f.+jTa#VB95Pkr8lHYniFdIB-RNRvRGZkBz(qixD^^.qAViSB-RNRvRGZkBAeMjr8MZ+jTa#*B.8:7sv2?Pq-#rTB-RNRvRGZkCWUS9B0p}#lSE2LnM4YVbZSu?l%\u0026qQm15CIiV]X{p!Kq=o*@2El{T^ruQNE-jTtwwrz(jRqHJ%2p!KqBk#Qinb6myveO5^CwO${)a{[VJpEvAwlp1KsjT8L4B8\u0026{MyIa*#stqJ%k#Qina$[7WAXyJHf\u0026x}O3q:R?mOcYBa$[7WAXzxExcEV\u0026p!Kq=q^03^pFKwCk#Qina$[7WAXzxExd)?rv\u003chmRogJt/sYmW-pdvMoq:\u003c8CqAVi", "n": [ { "c": 3, "d": "Unix rm delete utility absolute path", "i": "micro-behaviors/fs/path/system::rm-utility-path", "o": 668, "z": 8, "cf": 0.5 }, { "c": 3, "d": "References /bin/sh shell executable", "i": "micro-behaviors/process/create/shell/spawn::bin-sh", "o": 742, "z": 7, "cf": 0.6 }, { "c": 2, "d": "Shell assignment captures command substitution", "i": "micro-behaviors/data/string/assembly::assignment-backtick-substitution", "o": 877, "z": 19, "cf": 0.9 }, { "c": 2, "d": "List directory contents via /bin/ls", "i": "micro-behaviors/fs/directory/readdir::readdir-ls", "o": 516, "z": 7, "cf": 0.66 }, { "c": 1, "d": "Conda PREFIX build variable", "i": "metadata/build/conda::conda-prefix-var", "o": 994, "z": 6, "cf": 0.95 }, { "c": 1, "d": "Command field or assignment key", "i": "micro-behaviors/data/serialize/envelope::command-assignment-key", "o": 650, "z": 4, "cf": 0.4 }, { "c": 1, "d": "Contains the grep command keyword", "i": "micro-behaviors/fs/search::grep-keyword", "o": 417, "z": 4, "cf": 0.7 } ], "ln": 385, "col": 5, "line": 24 }, { "b": "dLb-=e]UPsB8\u003e+kdLAz[yIdZev\u003chl!v{%B\u0026ar\u00267Tp!Kq=lR*DDnK\u003e/[sW=nqa%pPq3r{UUu0x:eu0ylGu3]\u003cQBx@9GA:q)HBZniuwNfW/pJ6JyphTu+f!0CouR\u003cx=uQEQ:mO9", "n": [ { "c": 1, "d": "Uppercase config environment variable", "i": "metadata/file/policy/config/env::uppercase-config-env", "o": 1195, "z": 10, "cf": 0.55 } ], "ln": 1163, "col": 39, "line": 64 }, { "b": "nLSh-k$\u003c%33jewdB8\u0026{MyIbqfx(kOvyJKcjy\u0026:RtflItRfk$Ytflp/nA+c[CwQ567eO5NpBp6ckarR^HarS:c3mWFi2%giQwPIo\u00263l{VspgXJlq:-U?wmYE)B97\u0026by+f-Lf!Lsagb7Bwfebpqf/g1chAy", "n": [ { "c": 1, "d": "URL path carries a long base64 segment", "i": "objectives/exfiltration/http/encoded::url-path-base64-segment", "o": 1511, "z": 26, "cf": 0.9 } ], "ln": 1479, "col": 8, "line": 81 }, { "b": "zep!ox(mD$x\u003c@X4arR)oarR}Rr7f.+EioWQeQex\u003cfdP*=k$$3WmOcuyoI4MTqBK8Eq=Dg-aBFLzarR^He?X.JlQsBuuQ^QZl}*fsuS6r.nMeOSqxO\u003eao\u00261!Uas8qflQsBuuQ^QZl}*fsuQNE-Ef{q/bmj-4axrr1wOkZ#By/Fnx(mK3azbt7wPGEh2{P=-bZSGVq=Fe/aS@vYatbq$nLR-JuQ^QXmn\u003esRD\u003cQe^e?X.Dpdw2^mOcoxqY[$bo\u00261!Uas8qgogJt-mn#Mvk#ZcSl}Hp83jd{:2{QM\u003cwO(vewGUA0C{3*hz/cXtxK#3(ay!?\u0026xK#lq3jd{:2{:\u003c%mn)flar.\u003cVCPXQ(d[J97pg3%\u003emnliHaBFLz2)\u0026jqd[J97pg3%\u003emnliHaw$T5pGx[bbZSuXm{!$Vr6-]rr6:\u003eVnM6%z2{P=-boP(}zeTPeaAIjcy\u00261enw].*batmqFv\u003eR[pwO=g7e^.[f3jd#8r7f.+EioWQeQex\u003cfdP%(mncw$E0=nc2}^\u003eYq+ftJoDWk4o\u00261!Uas8qgogJt-mn#Mvk#ZcSl}Hp83jd#8r7f.+EioWQeQex\u003cfdP%(mncw$E0=nc2}^\u003eYq+ftJoDVX[mmfZ1qBKqQrZ!bRDR^v9uRJ%*k$11rl0)2KqHF(V2{QM\u003cwO(vewGUG3zF0P}B-H]jx(v(iw[=6)B0bgeaARpdC{3TozyoJGwnbT/wPw]9A=k!qBzbkdwmYvYB.(db2{QN5z/ff3xcp/2y?kja2{P=-bZSGVq=Fe/aS@vYatbq$mOcoxqY{En3jd1\u003efdPH-oHR(5qBKqQrZ!bRDR^v9uRJ%*k$11rl0)2KqHF(Uj39=Rp!$1?eKS30pe+aToIu(x2{P=-boQ09wmoN\u003eayPekazbLfBAnNnvrt{!vrl13e^.[f3jd#8r7f.+EioWQeQex\u003cfdPH/pe\u003edmE0=nc2}^\u003eYmO==UqY)ujp!Kq=o*@2El{T^ruQNE-Ef{o93jd}1rD8FSBy=O6zH0vsv@DlcBzbl5wGUF\u003ev}YB{e^.[f3jd#8r7f.+EioWQeQex\u003cfdPQYpFLm@njulwqY{En3jd1\u003efdPQYpFLm@njulwqY]7pl{T^vas8qgogJt-mn#Mvk(", "n": [ { "c": 3, "d": "Executes a local relative file", "i": "micro-behaviors/process/create/local-exec::execute-dot-slash-literal", "o": 1747, "z": 25, "cf": 0.88 }, { "c": 2, "d": "Contains common English function words", "i": "metadata/file/profile/language::lang-english--atom-1", "o": 2255, "z": 3, "cf": 0.8 }, { "c": 2, "d": "SHELL environment variable", "i": "micro-behaviors/os/env/vars/system-info::shell-var", "o": 2081, "z": 5, "cf": 0.5 } ], "ln": 1683, "col": 32, "line": 92 }, { "b": "wGU/6vSC)$C{4ftvrb\u003c\u003eaAg+hxDQ?]BywS!B7D%h2{P=-bZSGVq=Fe/aS@vYatbq$q+fONlq]1OD\u003cQe^e?X.Nnk8PwqY[$bo\u00261!Uas8qgogJt-mn#Mvk#ZcSl}Hp83jd{:2{QM\u003cwO(vewGUM3AccvFwnc6}v@#Tfx\u003equdvqYP#B-8tywN({aB7Gxkfk2rzB-qyO3jd{:2{:\u003c%mn)flar.\u003cVCPXQ(d)#%bqY{En3jd1\u003efdPBZqD1YomnlMUmiA\u003e5p!Kq=o*@2El{T^ruQNE-Ef{oaDSiBjrdb(jat4*Xe?X.Pq:\u003cOOqCQp?aBFLz2)\u0026jqd]/IpqB:RXrzT/omnlMUmiA\u003e5p!Kq=o*@2El{T^ruQNE-Ef{o93jd}1lUH4vyANkcAV!!dC{3Wyx(!xgzF783x([zsvp\u003cQ)AV/NqcVS=vw[=c%B7/b}ay]4nx(n0lvqG:]zF7Ne2{P=-bZSGVq=Fe/aS@vYatbq$rz#s:m]Ab.p-$dk3jd1\u003efdQ43mf", "n": [ { "c": 3, "d": "Executes a local relative file", "i": "micro-behaviors/process/create/local-exec::execute-dot-slash-literal", "o": 2676, "z": 9, "cf": 0.88 }, { "c": 2, "d": "Contains common English function words", "i": "metadata/file/profile/language::lang-english--atom-2", "o": 2744, "z": 3, "cf": 0.8 }, { "c": 2, "d": "Contains common English function words", "i": "metadata/file/profile/language::lang-english--atom-5", "o": 2918, "z": 3, "cf": 0.8 }, { "c": 1, "d": "Microsoft Graph group collection endpoint", "i": "micro-behaviors/communications/http/services/entra-directory::group-collection-path-token", "o": 2760, "z": 7, "cf": 0.92 } ], "ln": 2612, "col": 30, "line": 134 }, { "b": "l](D5z/o-eAX8wRf!Lg6gb7yufebmpgbf[bgDExEiX-Gmyhvr}avQJ]as4p3wQ4{hatscf", "n": [ { "c": 2, "d": "Script returns a process status", "i": "micro-behaviors/process/exit/terminate::shell-return-status", "o": 3261, "z": 6, "cf": 0.8 } ], "ln": 3213, "col": 9, "line": 157 } ], "depth": 1, "facts": { "imp": [ [ "", "shift" ], [ "", "shift" ], [ "", "{PWD_CMD}" ], [ "", "/usr/pkg/bin/mktexlsr" ], [ "", "/usr/pkg/bin/mktexlsr" ], [ "", "{TEST}" ], [ "", "./+OCAML_FINDLIB_REGISTER" ], [ "", "./+OCAML_FINDLIB_REGISTER" ], [ "", "{TEST}" ], [ "", "./+INFO_FILES" ], [ "", "./+INFO_FILES" ], [ "", "{TEST}" ], [ "", "./+ICON_THEMES" ], [ "", "./+ICON_THEMES" ], [ "", "{TEST}" ], [ "", "./+SHELL" ], [ "", "./+SHELL" ], [ "", "{TEST}" ], [ "", "./+SHELL" ], [ "", "./+SHELL" ], [ "", "{TEST}" ], [ "", "./+FILES" ], [ "", "./+FILES" ], [ "", "{TEST}" ], [ "", "./+FONTS" ], [ "", "./+FONTS" ], [ "", "{TEST}" ], [ "", "./+ICON_THEMES" ], [ "", "./+ICON_THEMES" ], [ "", "{TEST}" ], [ "", "./+SHLIBS" ], [ "", "./+SHLIBS" ], [ "", "{TEST}" ], [ "", "./+DIRS" ], [ "", "./+DIRS" ], [ "", "{TEST}" ], [ "", "./+USERGROUP" ], [ "", "./+USERGROUP" ], [ "", "{TEST}" ], [ "", "./+USERGROUP" ], [ "", "./+USERGROUP" ], [ "", "{TEST}" ], [ "", "./+FILES" ], [ "", "./+FILES" ], [ "", "{TEST}" ], [ "", "./+DIRS" ], [ "", "./+DIRS" ], [ "", "exit" ], [ "", "exit" ] ], "tgt": [ "${PWD_CMD}", "${TEST}", "./+DIRS", "./+FILES", "./+FONTS", "./+ICON_THEMES", "./+INFO_FILES", "./+OCAML_FINDLIB_REGISTER", "./+SHELL", "./+SHLIBS", "./+USERGROUP", "/usr/pkg/bin/mktexlsr", ":", "exit", "shift" ], "metrics": { "ast": { "max_depth": 7.0, "bind_count": 55.0, "call_count": 33.0, "node_count": 782.0, "identifier_count": 82.0, "string_literal_count": 53.0 }, "file": { "size": 3269.0, "entropy": 5.79, "size_bytes": 3269.0 }, "text": { "tab_count": 74.0, "digit_ratio": 0.04, "space_count": 216.0, "total_lines": 160.0, "char_entropy": 5.79, "mixed_indent": 1.0, "unique_chars": 84.0, "string_density": 0.33, "avg_line_length": 19.43, "max_line_length": 71.0, "empty_line_ratio": 0.1, "last_line_length": 6.0, "whitespace_ratio": 0.14, "most_common_ratio": 0.05, "identifier_density": 1.27, "line_length_stddev": 16.79, "normalized_string_count": 4.19, "suspicious_string_ratio": 0.02, "most_common_char_is_null": 0.0, "suspicious_comment_ratio": 0.1, "max_inline_whitespace_run": 1.0, "most_common_char_codepoint": 47.0, "normalized_unique_identifiers": 11.47 }, "binds": { "count": 55.0 }, "calls": { "count": 33.0, "dynamic_target_count": 15.0 }, "binary": { "overall_entropy": 5.79, "peak_region_bytes": 3269.0, "peak_region_entropy": 5.79 }, "strings": { "total": 53.0, "avg_length": 10.72, "max_length": 40.0, "path_count": 39.0, "avg_entropy": 2.86, "empty_count": 2.0, "total_bytes": 568.0, "entropy_stddev": 0.67, "shell_command_strings": 1.0 }, "comments": { "chars": 696.0, "lines": 17.0, "total": 39.0, "to_code_ratio": 0.12, "empty_comments": 22.0, "high_entropy_comments": 4.0 }, "identifiers": { "count": 82.0, "total": 203.0, "avg_length": 6.88, "max_length": 25.0, "min_length": 1.0, "avg_entropy": 2.25, "reuse_ratio": 0.41, "unique_count": 84.0, "length_stddev": 5.18, "has_digit_ratio": 0.06, "single_char_count": 5.0, "single_char_ratio": 0.06, "high_entropy_count": 7.0, "high_entropy_ratio": 0.08, "all_lowercase_ratio": 0.04, "all_uppercase_ratio": 0.7, "numeric_suffix_count": 1.0, "underscore_prefix_count": 1.0 } } }, "id": 1, "mol": "H(Po)Md(Pa)", "path": "/data/samples/good/foraged/netbsd/netbsd.org/_/tex-dozenal-7.2.75722/tex-dozenal-7.2.75722.tgz!!+DEINSTALL", "pid": 0, "risk": 3, "sha": "6e56058795546ce2543d9d0a4f64befb04d47d0dcf9a32dcab85ff1a300838c8", "size": 3269, "traits": [ { "id": "metadata/package/files/bsd::pkgsrc-maintainer-script-vars", "conf": 0.92, "crit": 3, "desc": "pkgsrc maintainer script lifecycle variables", "spans": [ [ 77, 23 ] ] }, { "id": "micro-behaviors/fs/path/system::rm-utility-path", "conf": 0.5, "crit": 3, "desc": "Unix rm delete utility absolute path", "spans": [ [ 668, 8 ] ] }, { "id": "metadata/package/files/bsd::pkgsrc-maintainer-script-basename", "conf": 0.92, "crit": 3, "desc": "pkgsrc binary package maintainer script filename", "spans": [ [ 0, 10 ] ] }, { "id": "metadata/package/files/bsd::pkgsrc-maintainer-script-header", "conf": 0.92, "crit": 3, "desc": "pkgsrc maintainer script NetBSD header", "spans": [ [ 14, 16 ] ] }, { "id": "micro-behaviors/process/create/local-exec::execute-dot-slash-literal", "conf": 0.88, "crit": 3, "desc": "Executes a local relative file", "spans": [ [ 1747, 25 ], [ 1867, 13 ], [ 1981, 14 ], [ 2092, 8 ], [ 2314, 8 ], [ 2436, 8 ], [ 2676, 9 ], [ 2799, 7 ] ] }, { "id": "micro-behaviors/process/create/shell/spawn::bin-sh", "atk": "T1059.004", "mbc": "E1059.004", "conf": 0.6, "crit": 3, "desc": "References /bin/sh shell executable", "spans": [ [ 742, 7 ] ] } ], "type": "shell" }, { "ctx": [ { "b": "boXZHx(kOBxBk%\u003eboOmbwPQmql](D7wNPaXAX8wRf!Lm8gb7BtfekjngCx}ah99DFiX\u0026xiCwhvCmr\u0026+]bNK(Smncfla%X\u0026^3q:w=pc?PyjT8daa{}mFk$svba%X]/3uG({w]]dJ3jo72ofBELB-RNRvRGZkvrVGh3pm3SmnucymlI?FB-RNRvRGZkvQTs?zEEx[a{{X6r6qAUvRGZkv{%E63pvuOqCYI2flItRfjFTkfjOWdA=riflR6{El{h.EvRGZkv}YZ$wfIvFnkAqZjT8L4B8\u0026{P", "n": [ { "c": 3, "d": "pkgsrc binary package maintainer script filename", "i": "metadata/package/files/bsd::pkgsrc-maintainer-script-basename", "o": 0, "z": 8, "cf": 0.92 }, { "c": 3, "d": "pkgsrc maintainer script NetBSD header", "i": "metadata/package/files/bsd::pkgsrc-maintainer-script-header", "o": 14, "z": 16, "cf": 0.92 }, { "c": 3, "d": "pkgsrc maintainer script lifecycle variables", "i": "metadata/package/files/bsd::pkgsrc-maintainer-script-vars", "o": 77, "z": 23, "cf": 0.92 }, { "c": 1, "d": "Awk decoder invocation", "i": "objectives/anti-static/obfuscation/encoding/shell::shell-awk-token", "o": 124, "z": 3, "cf": 0.9 } ], "ln": 0, "col": 1, "line": 1 }, { "b": "jT8L4B8\u0026{yx(kOox(mD93p^#.p^30QB-RNRvRGZkxl4N5a{{?tk#G\u0026\u0026a{{\u003efk$0\u003cWflItRfjFTkfka{9wfIvLl{h.EB-RNRvRGZkx\u003eey{oI4#LmNo{DjT8L4B8\u0026{PvRGZky?W^5w)]Z%a{}1sjT8K*x(kOuzxYAYq-#rTvRGZky\u0026Z^co?N(CqAViSvRGZkzeiV@AV=@Ma{}4BjTa-^at4gH3q:e?oF[%SflItRfk$YtfjFTkfk$Gyy:6i.ogJtPl}{lFjT8L4B8\u0026{PvRGZkAbf8[vpTj?zxYA:ogJtXpdw2xa$[7WAXzGyx(kOyyId0*zF0/h3q:!(uQEKQjT8K*x(kOyCvR)8qCxp#fjFTkflg[N3q%O^nM4X}fjFTkflg]ux(Uy8q:\u003c8qa$[7WAXy)ozzc6xwfIvVmn#YJrY}SWB-RNRvRGZkwO#Vn3r6FUa$)ztzzc6Aa{}mAqDb!6flItRfjFTkflq5LBrR5\u003crxRJVB-RNRvRGZkB9eVlr7f.+jTa#VB95Pkr8lHYniFdIB-RNRvRGZkBz(qixD^^.qAViSB-RNRvRGZkBAeMjr8MZ+jTa#*B.8:7sv2?Pq-#rTB-RNRvRGZkCWUS9B0p}#lSE2LnM4YVbZSu?l%\u0026qQm15CIiV]X{p!Kq=o*@2El{T^ruQNE-jTtwwrz(jRqHJ%2p!KqBk#Qinb6myveO5^CwO${)a{[VJpEvAwlp1KsjT8L4B8\u0026{MyIa*#stqJ%k#Qina$[7WAXyJHf\u0026x}O3q:R?mOcYBa$[7WAXzxExcEV\u0026p!Kq=q^03^pFKwCk#Qina$[7WAXzxExd)?rv\u003chmRogJt/sYmW-pdvMoq:\u003c8CqAVi", "n": [ { "c": 3, "d": "Unix rm delete utility absolute path", "i": "micro-behaviors/fs/path/system::rm-utility-path", "o": 668, "z": 8, "cf": 0.5 }, { "c": 3, "d": "References /bin/sh shell executable", "i": "micro-behaviors/process/create/shell/spawn::bin-sh", "o": 742, "z": 7, "cf": 0.6 }, { "c": 2, "d": "Shell assignment captures command substitution", "i": "micro-behaviors/data/string/assembly::assignment-backtick-substitution", "o": 877, "z": 19, "cf": 0.9 }, { "c": 2, "d": "List directory contents via /bin/ls", "i": "micro-behaviors/fs/directory/readdir::readdir-ls", "o": 516, "z": 7, "cf": 0.66 }, { "c": 1, "d": "Conda PREFIX build variable", "i": "metadata/build/conda::conda-prefix-var", "o": 994, "z": 6, "cf": 0.95 }, { "c": 1, "d": "Command field or assignment key", "i": "micro-behaviors/data/serialize/envelope::command-assignment-key", "o": 650, "z": 4, "cf": 0.4 }, { "c": 1, "d": "Contains the grep command keyword", "i": "micro-behaviors/fs/search::grep-keyword", "o": 417, "z": 4, "cf": 0.7 } ], "ln": 385, "col": 5, "line": 24 }, { "b": "dLb-=e]UPsB8\u003e+kdLAz[yIdZev\u003chl!v{%B\u0026ar\u00267Tp!Kq=lR*DDnK\u003e/[sW=nqa%pPq3r{UUu0x:eu0ylGu3]\u003cQBx@9GA:q)HBZniuwNfW/pJ6JyphTu+f!0CouR\u003cx=uQEQ:mO9", "n": [ { "c": 1, "d": "Uppercase config environment variable", "i": "metadata/file/policy/config/env::uppercase-config-env", "o": 1195, "z": 10, "cf": 0.55 } ], "ln": 1163, "col": 39, "line": 64 }, { "b": "A3czk3s^H=wGSmBq=D4Mmsup)zvfirmj?8aq=D4RoEQqPbmj-4axrq#vpK6}BzbkdxK#10wPw]mv@=p5BzLJgB1N!abmj-5DS9E-as8qjmncg0as8qgogI-yo*%EMrzDvRlRv:)bmj-4aw#=\u003cB.L(caARp9BrCEjv}x.5vrcSoB-RbmB0a[ewftJ9z/{2uaz2!iB95KyAV!}fB7DFavqfK2Bzbj)2{QNbzGx]dy\u00260K4x(v(iz!pblxK@r9vpK7YxjSX52{P=-bZSGVq=Fe/aS@vYatbq$rz#s:m]Ab.p-$dk3jd2=atbq$rz#s:m]Ab.p-@4(l)9+4p!Kq=o*@2El{T^ruQNE-Ef{n!arUxgatbq$rz#s:m]Ab.p-@a@mmfZ1k$19-bZSuXm{!$Vr6-]rr6:\u003eVnM6%#aARpdzvcWR2%5z12{pv4y\u0026:d{2)*]HCXImxf:Xi[arUogj0n}U2{:\u003c%mn)flar.\u003cVCPXQ(d)#%bqY{En3jd1\u003efdPBZqD1Y7l{@dyDR^v9uRJ%*k$11rl0)2KqHF(UbZSGVq=Fe/aS@vYatbq$l}HoPaBFLz2)\u0026jqd)#%bqY[[9qCy7jbZSuXm{!$Vr6-]rr6:\u003eVnM6%zarR^HarR^Hj39=Rp!$1?eLeYor6:hKdgcwa3jd}1qE%rWx(4r5Bz7", "n": [ { "c": 3, "d": "Executes a local relative file", "i": "micro-behaviors/process/create/local-exec::execute-dot-slash-literal", "o": 1650, "z": 12, "cf": 0.88 }, { "c": 2, "d": "Contains common English function words", "i": "metadata/file/profile/language::lang-english--atom-1", "o": 1453, "z": 3, "cf": 0.8 }, { "c": 2, "d": "Contains common English function words", "i": "metadata/file/profile/language::lang-english--atom-2", "o": 1547, "z": 3, "cf": 0.8 }, { "c": 2, "d": "Contains common English function words", "i": "metadata/file/profile/language::lang-english--atom-3", "o": 1526, "z": 4, "cf": 0.8 }, { "c": 2, "d": "Script returns a process status", "i": "micro-behaviors/process/exit/terminate::shell-return-status", "o": 1760, "z": 6, "cf": 0.8 } ], "ln": 1405, "col": 54, "line": 75 }, { "b": "wGU/6vSC)$C{4ftvrb\u003c\u003eaAg+hxDQ?]BywS!B7D%h2{P=-bZSGVq=Fe/aS@vYatbq$q+fONlq]1OD\u003cQe^e?X.Nnk8PwqY[v]l)9+4p!Kq=o*@2El{T^ruQNE-Ef{o93jd}1lVl{?ay/tcw[+[2A::67z/djHB-qqrA=-Box(4v4azC.nzY\u003c1nvpJ\u003e33jd{:arR^HarR^HbZSGVq=Fe/aS@vYatbq$mOcoxqY{En3jd1\u003efdPH-oHR(5k$19-bZSuXm{!$Vr6-]rr6:\u003eVnM6%zarR^HarR^HbZSGVq=Fe/aS@vYatbq$mOcoxqY{En3jd1\u003efdPH-oHR(5p^[nRqY)ujp!Kq=o*@2El{T^ruQNE-Ef{o93jd}1q!p4[B8UY2x\u003c\u003e*2AaK6bx(!ufz/fRsz/cV", "n": [ { "c": 3, "d": "Executes a local relative file", "i": "micro-behaviors/process/create/local-exec::execute-dot-slash-literal", "o": 2019, "z": 9, "cf": 0.88 } ], "ln": 1955, "col": 30, "line": 102 }, { "b": "x(4v4fjX^qwN/?2A+P9aaARp9BrCEjwN({9xK#3k3jd{:2{:\u003c%mn)flar.\u003cVCPXQ(d]nVjo\u0026AfZD\u003cQe^e?X.Kmn=\u0026Uas8qgogJt-mn#Mvk#ZcSl}Hp83jd{:2{QM)AaAy0wGUA0C{3ZqzGG}xwmoN*vQTs?B1N!abmj-5DSiBjrdb(jat4*Xe?X.ApFK\u003e/aBFLz2)\u0026jqd[irfr8T[+DR^v9uRJ%*k$11rl0)2KqHF(V2{P=-boQ09wmoN\u003eayPekazCt7zxK4mwO(03v{@\u003eXwPGEh2{P=-bZSGVq=Fe/aS@vYatbq$nKDoGuSoM+o*}#6E0=nc2}^\u003eYnKDoGuSoM+o*}#6rzV7Hr7d]PDR^v9uRJ%*k$11rl0)2KqHF(V2{QMWxK$W?azbLjayPekaz\u003e?lB7]J8ayY5bB0a[6By/FnCv-dxwGUP0zFsf9wN(]$zGx]dy\u00260*6xd:I$bmj-5DSiBjrdb(jat4*Xe?X.ynM5FfE0=nc2}^\u003eYl}HoPavwW*lRx0%", "n": [ { "c": 3, "d": "Executes a local relative file", "i": "micro-behaviors/process/create/local-exec::execute-dot-slash-literal", "o": 2347, "z": 8, "cf": 0.88 }, { "c": 2, "d": "Contains common English function words", "i": "metadata/file/profile/language::lang-english--atom-5", "o": 2596, "z": 3, "cf": 0.8 } ], "ln": 2283, "col": 36, "line": 114 }, { "b": "aw#=-x(!xcAV/BpwO=g7azCZofj/lnflp/ry\u00261eB3jd{:2{:\u003c%mn)flar.\u003cVCPXQ(d]O#coIuNRD\u003cQe^e?X.NnjuiCavey-as8qgogJt-mn#Mvk#ZcSl}Hp83jd#8r7f.+EioWQeQex\u003cfdP%(mncw$E0=nc2}^\u003eYq+ftJoDVX[mmfZ1k$19-bZSuXm{!$Vr6-]rr6:\u003eVnM6%z2{P=-boP(}xk8BewPw]czF0/fw[=6)B1N!abmj-5DSiBj", "n": [ { "c": 3, "d": "Executes a local relative file", "i": "micro-behaviors/process/create/local-exec::execute-dot-slash-literal", "o": 2991, "z": 8, "cf": 0.88 }, { "c": 2, "d": "SHELL environment variable", "i": "micro-behaviors/os/env/vars/system-info::shell-var", "o": 2980, "z": 5, "cf": 0.5 } ], "ln": 2927, "col": 3, "line": 142 }, { "b": "nLSh-k$\u003c%33jewdB8\u0026{MyIbqfx(kOvyJKcjy\u0026:RtflItRfk$Ytflp/nA+c[CwQ567eO5NpBp6ckarR^HarS:c3mWFi2%giQwPIo\u00263l{VspgXJlq:-U?w]zQfwPxtBatCG6atLS8hzl:wfetm8gby%GfGG", "n": [ { "c": 1, "d": "URL path carries a long base64 segment", "i": "objectives/exfiltration/http/encoded::url-path-base64-segment", "o": 3509, "z": 26, "cf": 0.9 } ], "ln": 3477, "col": 6, "line": 168 } ], "depth": 1, "facts": { "imp": [ [ "", "shift" ], [ "", "shift" ], [ "", "{PWD_CMD}" ], [ "", "{SH}" ], [ "", "{TEST}" ], [ "", "./+USERGROUP" ], [ "", "./+USERGROUP" ], [ "", "./+USERGROUP" ], [ "", "./+USERGROUP" ], [ "", "exit" ], [ "", "exit" ], [ "", "{TEST}" ], [ "", "./+DIRS" ], [ "", "./+DIRS" ], [ "", "{TEST}" ], [ "", "./+DIRS" ], [ "", "./+DIRS" ], [ "", "{TEST}" ], [ "", "./+SHLIBS" ], [ "", "./+SHLIBS" ], [ "", "{TEST}" ], [ "", "./+FILES" ], [ "", "./+FILES" ], [ "", "{TEST}" ], [ "", "./+FILES" ], [ "", "./+FILES" ], [ "", "{TEST}" ], [ "", "./+PERMS" ], [ "", "./+PERMS" ], [ "", "{TEST}" ], [ "", "./+FONTS" ], [ "", "./+FONTS" ], [ "", "{TEST}" ], [ "", "./+ICON_THEMES" ], [ "", "./+ICON_THEMES" ], [ "", "{TEST}" ], [ "", "./+DIRS" ], [ "", "./+DIRS" ], [ "", "{TEST}" ], [ "", "./+DIRS" ], [ "", "./+DIRS" ], [ "", "{TEST}" ], [ "", "./+FILES" ], [ "", "./+FILES" ], [ "", "{TEST}" ], [ "", "./+FILES" ], [ "", "./+FILES" ], [ "", "{TEST}" ], [ "", "./+SHELL" ], [ "", "./+SHELL" ], [ "", "{TEST}" ], [ "", "./+SHELL" ], [ "", "./+SHELL" ], [ "", "{TEST}" ], [ "", "./+INFO_FILES" ], [ "", "./+INFO_FILES" ], [ "", "{TEST}" ], [ "", "./+OCAML_FINDLIB_REGISTER" ], [ "", "./+OCAML_FINDLIB_REGISTER" ], [ "", "/usr/pkg/bin/mktexlsr" ], [ "", "/usr/pkg/bin/mktexlsr" ], [ "", "exit" ], [ "", "exit" ] ], "tgt": [ "${PWD_CMD}", "${SH}", "${TEST}", "./+DIRS", "./+FILES", "./+FONTS", "./+ICON_THEMES", "./+INFO_FILES", "./+OCAML_FINDLIB_REGISTER", "./+PERMS", "./+SHELL", "./+SHLIBS", "./+USERGROUP", "/usr/pkg/bin/mktexlsr", ":", "exit", "shift" ], "metrics": { "ast": { "max_depth": 9.0, "bind_count": 55.0, "call_count": 43.0, "node_count": 882.0, "identifier_count": 84.0, "string_literal_count": 53.0 }, "file": { "size": 3622.0, "entropy": 5.73, "size_bytes": 3622.0 }, "text": { "tab_count": 96.0, "digit_ratio": 0.04, "space_count": 283.0, "total_lines": 177.0, "char_entropy": 5.73, "mixed_indent": 1.0, "unique_chars": 84.0, "string_density": 0.3, "avg_line_length": 19.46, "max_line_length": 73.0, "empty_line_ratio": 0.1, "last_line_length": 6.0, "whitespace_ratio": 0.15, "most_common_ratio": 0.04, "identifier_density": 1.36, "line_length_stddev": 16.64, "normalized_string_count": 3.98, "suspicious_string_ratio": 0.02, "most_common_char_is_null": 0.0, "suspicious_comment_ratio": 0.1, "max_inline_whitespace_run": 1.0, "most_common_char_codepoint": 47.0, "normalized_unique_identifiers": 11.65 }, "binds": { "count": 55.0 }, "calls": { "count": 43.0, "dynamic_target_count": 19.0 }, "binary": { "overall_entropy": 5.73, "peak_region_bytes": 3622.0, "peak_region_entropy": 5.71 }, "strings": { "total": 53.0, "avg_length": 10.72, "max_length": 40.0, "path_count": 39.0, "avg_entropy": 2.86, "empty_count": 2.0, "total_bytes": 568.0, "entropy_stddev": 0.67, "shell_command_strings": 1.0 }, "comments": { "chars": 762.0, "lines": 18.0, "total": 42.0, "to_code_ratio": 0.11, "empty_comments": 24.0, "high_entropy_comments": 4.0 }, "identifiers": { "count": 84.0, "total": 241.0, "avg_length": 6.68, "max_length": 25.0, "min_length": 1.0, "avg_entropy": 2.24, "reuse_ratio": 0.36, "unique_count": 87.0, "length_stddev": 4.98, "has_digit_ratio": 0.06, "single_char_count": 5.0, "single_char_ratio": 0.06, "high_entropy_count": 7.0, "high_entropy_ratio": 0.08, "all_lowercase_ratio": 0.03, "all_uppercase_ratio": 0.68, "numeric_suffix_count": 1.0, "underscore_prefix_count": 1.0 } } }, "id": 2, "mol": "H(Po)Md(Pa)", "path": "/data/samples/good/foraged/netbsd/netbsd.org/_/tex-dozenal-7.2.75722/tex-dozenal-7.2.75722.tgz!!+INSTALL", "pid": 0, "risk": 3, "sha": "198b3e0b0214a6dfe852257b8943316eee79397e872315ebb8415dc7fcdfa8cb", "size": 3622, "traits": [ { "id": "metadata/package/files/bsd::pkgsrc-maintainer-script-vars", "conf": 0.92, "crit": 3, "desc": "pkgsrc maintainer script lifecycle variables", "spans": [ [ 77, 23 ] ] }, { "id": "micro-behaviors/fs/path/system::rm-utility-path", "conf": 0.5, "crit": 3, "desc": "Unix rm delete utility absolute path", "spans": [ [ 668, 8 ] ] }, { "id": "metadata/package/files/bsd::pkgsrc-maintainer-script-basename", "conf": 0.92, "crit": 3, "desc": "pkgsrc binary package maintainer script filename", "spans": [ [ 0, 8 ] ] }, { "id": "metadata/package/files/bsd::pkgsrc-maintainer-script-header", "conf": 0.92, "crit": 3, "desc": "pkgsrc maintainer script NetBSD header", "spans": [ [ 14, 16 ] ] }, { "id": "micro-behaviors/process/create/local-exec::execute-dot-slash-literal", "conf": 0.88, "crit": 3, "desc": "Executes a local relative file", "spans": [ [ 1650, 12 ], [ 1804, 7 ], [ 2019, 9 ], [ 2142, 8 ], [ 2347, 8 ], [ 2441, 8 ], [ 2544, 14 ], [ 2991, 8 ] ] }, { "id": "micro-behaviors/process/create/shell/spawn::bin-sh", "atk": "T1059.004", "mbc": "E1059.004", "conf": 0.6, "crit": 3, "desc": "References /bin/sh shell executable", "spans": [ [ 742, 7 ] ] } ], "type": "shell" } ], "rev": "46112", "v": "8" } }