{ "ml": { "v": "7", "eng": "2.0.1-rc.1", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.000070651375, "rte": "az", "prob": 0.000070651375 }, { "cls": 0, "raw": 0.89644855, "rte": "az/source", "prob": 0.89644855 }, { "cls": 0, "raw": 0.9317667, "rte": "az/c", "prob": 0.9317667 } ], "prob": 0.000070651375, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.00007065137469908223, "type": "c" } ], "version": "v18.18", "analyzed_at": "2026-06-15T09:51:59Z" }, "path": "Stub.asm", "raw": { "v": "7", "tv": "061e3", "files": [ { "id": 0, "ctx": [ { "a": 53, "b": "x(mA%B.25acVj2Ux(mAd", "l": 5 }, { "a": 70, "b": "", "l": 6 }, { "a": 71, "b": "B7F\u003c6x(v(icOxHLCYUqQv@C)?aAz44wmn}-wGUMewN/\u003e8vpB4:", "l": 7, "n": [ { "c": 3, "d": "Quoted hidden-dotfile path literal", "i": "objectives/evasion/file-hiding/dotfile-create::native-hidden-dotfile-token", "o": 79, "z": 7 } ] }, { "a": 112, "b": "", "l": 8 }, { "a": 113, "b": "B97\u0026hBuf", "l": 9 }, { "a": 162, "b": "", "l": 13 }, { "a": 163, "b": "j0mEzvp%c]g9yTKwO=f)z!9z", "l": 14 }, { "a": 183, "b": "j0mQrwO@S3wN/+aAcb/ixdLfxB-RTEvR3WaA+PSqwO@SjzY\u003cdnwGVecA^n^pwOkZ{zFs03azbLjaARpdaAhmux([6czxJUhwmYZ\u003ezE^r@BrCTrwO=f)z!9A4Bz\u0026piz/P(fv@#KjaAz4mz!%PdayO-2z!%MrwGUz(wo8m5B7GzB", "l": 15, "n": [ { "c": 2, "d": "English language detection", "i": "micro-behaviors/data/text/language::lang-english", "o": 221, "z": 3 } ] }, { "a": 320, "b": "j0mHox(+zvz/PSmefFzkv{%I3wGT][BZ=$mCX51azE:\u003e*Byw/[ga)c.wGUD2Bz8!gvrMi8BzbkdB75]%azCX3xjSh{vrl05vpS[?wPI]B", "l": 16 }, { "a": 405, "b": "", "l": 17 }, { "a": 665, "b": "32BfY2)\u003efKCQ%$wq/)4]zF9k", "l": 31 }, { "a": 685, "b": "32BJ\u003cB98CD2}6I1A=bD8gCQN[y?$E", "l": 32 }, { "a": 709, "b": "32ap2z!\u0026[\u003cm}D^pz!a0bwK{lEwnC*UefFIjCM", "l": 33, "n": [ { "c": 3, "d": "Get module handle", "i": "micro-behaviors/process/info/thread::get-module-handle", "o": 717, "z": 16 } ] }, { "a": 739, "b": "32KQ72)\u003c*ewPzW1y+)?qvqYQ(wNc\u0026fwNP/", "l": 34 }, { "a": 767, "b": "", "l": 35 }, { "a": 801, "b": "32BfY2)\u003efKCQ%$wq/)4]zF9k", "l": 37 }, { "a": 821, "b": "32BJ\u003cB98Ch2}5+/A==Cjy/2d\u003cBy!%7cJ", "l": 38 }, { "a": 847, "b": "32ap2z!\u0026[\u003cm}D^sA=kCNwmPZ(B8@(Ptt5KFzE)SugdU?\u003ewnC*.efFIjCM", "l": 39, "n": [ { "c": 2, "d": "Windows GetProcAddress in source", "i": "micro-behaviors/dylib/lookup::get-proc-address-source", "o": 855, "z": 14 } ] }, { "a": 893, "b": "32KQ72)\u003c*px(XrrvqF+Xz//M2BwN71t}vafvr.", "l": 40 }, { "a": 924, "b": "", "l": 41 }, { "a": 1636, "b": "2%fm#CX7xcBy=O9wN/+aAcbV4aAITkxjShvaAIjcy\u00260Q1wmU", "l": 73 }, { "a": 1675, "b": "32BfY2)\u003efKCQ%$wra{q-vpShyA:-/@By/F#", "l": 74 }, { "a": 1704, "b": "32ap2z!\u0026[\u003clVM:DBy!A+A+eV\u0026efEX/oIu#WfF1t/ByxiiefFIjCQ%%\u003eefEX/oIt", "l": 75, "n": [ { "c": 3, "d": "CreateThread usage in source", "i": "micro-behaviors/process/thread/create::create-thread-source", "o": 1712, "z": 12 } ] }, { "a": 1755, "b": "kTmv", "l": 76 }, { "a": 1759, "b": "32ap2z!\u0026[\u003cq/32RA4Aa^fFCf", "l": 77 } ], "mol": "O(Er)H(Po₂)", "sha": "623dfd6c961839172b2baf65b3fe5a432cfe9b9420e089f66c968e212b7fff1e", "fact": { "id": "c", "mbr": [ "kernel32.dll" ], "met": { "ast": { "op.sub": 1.0, "max_depth": 7.0, "op.concat": 1.0, "call_count": 0.0, "node_count": 562.0, "member_count": 1.0, "op_density.sub": 0.0, "identifier_count": 138.0, "member_depth_max": 2.0, "op_density.concat": 0.0 }, "file": { "size": 2086.0, "entropy": 5.09, "size_bytes": 2086.0 }, "text": { "tab_count": 124.0, "digit_ratio": 0.03, "space_count": 145.0, "total_lines": 100.0, "char_entropy": 5.09, "unique_chars": 71.0, "avg_line_length": 19.87, "max_line_length": 136.0, "empty_line_ratio": 0.21, "last_line_length": 7.0, "whitespace_ratio": 0.18, "most_common_ratio": 0.09, "identifier_density": 2.49, "line_length_stddev": 20.68, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 2.0, "most_common_char_codepoint": 101.0, "suspicious_identifier_ratio": 0.06, "normalized_unique_identifiers": 20.77 }, "binary": { "overall_entropy": 5.09 }, "members": { "count": 1.0 }, "identifiers": { "count": 138.0, "total": 249.0, "avg_length": 6.33, "max_length": 22.0, "min_length": 1.0, "avg_entropy": 2.19, "reuse_ratio": 0.55, "unique_count": 138.0, "length_stddev": 3.95, "has_digit_ratio": 0.07, "sequential_names": 2.0, "base64_like_names": 6.0, "single_char_count": 2.0, "single_char_ratio": 0.01, "high_entropy_count": 3.0, "high_entropy_ratio": 0.02, "all_lowercase_ratio": 0.67, "all_uppercase_ratio": 0.07, "numeric_suffix_count": 4.0 } }, "str": [ [ 155, "10", "0" ], [ 171, "10", "2" ], [ 461, "10", "100" ], [ 1238, "10", "2" ], [ 1328, "10", "5" ], [ 1341, "10", "7" ], [ 1354, "10", "1" ], [ 1412, "10", "1" ], [ 1663, "10", "2" ], [ 1732, "10", "0" ], [ 1747, "10", "0" ], [ 1774, "10", "1000" ], [ 1816, "10", "0" ] ], "val": { "file.stem": "Stub", "file.basename": "Stub.asm", "source.language": "c" } }, "find": [ { "id": "objectives/evasion/file-hiding/dotfile-create::native-hidden-dotfile-token", "atk": "T1564.001", "mbc": "F0005", "conf": 0.8999999761581421, "crit": 3, "desc": "Quoted hidden-dotfile path literal" }, { "id": "micro-behaviors/process/thread/create::create-thread-source", "conf": 0.8999999761581421, "crit": 3, "desc": "CreateThread usage in source" }, { "id": "micro-behaviors/process/info/thread::get-module-handle", "conf": 0.8999999761581421, "crit": 3, "desc": "Get module handle" } ], "path": "Stub.asm", "risk": 3, "size": 2086, "type": "c" } ] } }