{
  "ml": {
    "v": "7",
    "eng": "2.0.1-rc.1",
    "lvl": -1,
    "conf": 0,
    "mods": [
      {
        "cls": 0,
        "raw": 0.000031669933,
        "rte": "az",
        "prob": 0.000031669933
      },
      {
        "cls": 0,
        "raw": 0.000024795532,
        "rte": "az/scripts",
        "prob": 0.000024795532
      },
      {
        "cls": 0,
        "raw": 0.004073888,
        "rte": "az/shell",
        "prob": 0.004073888
      }
    ],
    "prob": 0.000031669933,
    "files": [
      {
        "id": 0,
        "lvl": -1,
        "conf": 0,
        "prob": 0.00003166993337799795,
        "type": "shell"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-06-15T05:56:55Z"
  },
  "path": "decipher_data",
  "raw": {
    "v": "7",
    "tv": "061e3",
    "files": [
      {
        "id": 0,
        "ctx": [
          {
            "a": 0,
            "b": "boXZHx(kOkvrl8",
            "l": 1,
            "n": [
              {
                "c": 2,
                "d": "Bash shell shebang line",
                "i": "metadata/lang/shebang::bash",
                "o": 0,
                "z": 11
              }
            ]
          },
          {
            "a": 12,
            "b": "",
            "l": 2
          },
          {
            "a": 13,
            "b": "l}73Nj.5qtvrcE3CYS",
            "l": 3
          },
          {
            "a": 28,
            "b": "A+#{JA+lBtl}73N",
            "l": 4,
            "n": [
              {
                "c": 2,
                "d": "Shell deletion operation",
                "i": "micro-behaviors/fs/directory/traverse::delete-shell",
                "o": 28,
                "z": 6
              }
            ]
          },
          {
            "a": 41,
            "b": "zeiV@AV=R}mn)d",
            "l": 5
          },
          {
            "a": 53,
            "b": "",
            "l": 6
          },
          {
            "a": 209,
            "b": "2)\u00261dp9qXxp9q5ff!1K",
            "l": 15
          },
          {
            "a": 225,
            "b": "31N%(wD",
            "l": 16
          },
          {
            "a": 231,
            "b": "31vs:wI#v/eO2$Hl{T^rlqgfwpc?PyaBCp+xM4:0fjFH6x\u003eI0$flqezfl?zQeO5B5z!9N1xd[HFAV=}RvPNU*vomX\u0026aBCqvvrl0rg:1wXau*[[l@N4",
            "l": 17,
            "n": [
              {
                "c": 3,
                "d": "base64 -d/-D decode command",
                "i": "micro-behaviors/data/decode/base64::base64-d-cmd",
                "o": 232,
                "z": 9
              },
              {
                "c": 3,
                "d": "Hardcoded absolute home directory path",
                "i": "micro-behaviors/fs/path/location::hardcoded-home-dir-path",
                "o": 258,
                "z": 14
              }
            ]
          },
          {
            "a": 323,
            "b": "wn=u%auQ=?zFs9kwPE",
            "l": 18
          },
          {
            "a": 338,
            "b": "",
            "l": 19
          }
        ],
        "mol": "H(F)",
        "sha": "64c06c9ecec72f45d76f9c0c56efc08f0fce875dc7fc6202fe7b3edb708cfdbd",
        "fact": {
          "id": "shell",
          "imp": [
            [
              "",
              "rm"
            ],
            [
              "",
              "rm"
            ],
            [
              "",
              "mkdir"
            ],
            [
              "",
              "mkdir"
            ],
            [
              "",
              "read"
            ],
            [
              "",
              "read"
            ],
            [
              "",
              "basename"
            ],
            [
              "",
              "basename"
            ],
            [
              "",
              "sed"
            ],
            [
              "",
              "sed"
            ],
            [
              "",
              "base64"
            ],
            [
              "",
              "base64"
            ],
            [
              "",
              "/home/bediger/src/xor-decoding/xor"
            ],
            [
              "",
              "/home/bediger/src/xor-decoding/xor"
            ],
            [
              "",
              "base64"
            ],
            [
              "",
              "base64"
            ]
          ],
          "met": {
            "ast": {
              "op.add": 1.0,
              "max_depth": 10.0,
              "bind_count": 5.0,
              "call_count": 9.0,
              "node_count": 131.0,
              "op_density.add": 0.01,
              "identifier_count": 22.0,
              "string_literal_count": 1.0
            },
            "file": {
              "size": 338.0,
              "entropy": 5.32,
              "size_bytes": 338.0
            },
            "text": {
              "tab_count": 11.0,
              "digit_ratio": 0.03,
              "space_count": 31.0,
              "total_lines": 18.0,
              "char_entropy": 5.32,
              "unique_chars": 59.0,
              "string_density": 0.06,
              "avg_line_length": 17.78,
              "max_line_length": 91.0,
              "empty_line_ratio": 0.11,
              "last_line_length": 14.0,
              "whitespace_ratio": 0.18,
              "most_common_ratio": 0.05,
              "identifier_density": 2.61,
              "line_length_stddev": 21.43,
              "normalized_string_count": 0.24,
              "most_common_char_is_null": 0.0,
              "max_inline_whitespace_run": 1.0,
              "most_common_char_codepoint": 101.0,
              "suspicious_identifier_ratio": 0.04,
              "normalized_unique_identifiers": 5.52
            },
            "binds": {
              "count": 5.0
            },
            "calls": {
              "count": 9.0
            },
            "binary": {
              "overall_entropy": 5.32
            },
            "strings": {
              "total": 1.0,
              "avg_length": 9.0,
              "max_length": 9.0,
              "avg_entropy": 2.42,
              "total_bytes": 9.0
            },
            "comments": {
              "chars": 10.0,
              "lines": 1.0,
              "total": 1.0,
              "to_code_ratio": 0.06
            },
            "identifiers": {
              "count": 22.0,
              "total": 47.0,
              "avg_length": 6.0,
              "max_length": 34.0,
              "min_length": 1.0,
              "avg_entropy": 1.89,
              "reuse_ratio": 0.49,
              "unique_count": 23.0,
              "length_stddev": 6.61,
              "has_digit_ratio": 0.04,
              "sequential_names": 1.0,
              "single_char_count": 3.0,
              "single_char_ratio": 0.13,
              "high_entropy_count": 1.0,
              "high_entropy_ratio": 0.04,
              "all_lowercase_ratio": 0.3,
              "all_uppercase_ratio": 0.26,
              "numeric_suffix_count": 1.0
            }
          },
          "str": [
            [
              126,
              "u8",
              "s/W..*$//"
            ],
            [
              160,
              "10",
              "0"
            ],
            [
              221,
              "10",
              "1"
            ]
          ],
          "tgt": [
            "/home/bediger/src/xor-decoding/xor",
            "FNAME.$N",
            "base64",
            "basename",
            "mkdir",
            "read",
            "rm",
            "sed"
          ],
          "val": {
            "file.stem": "decipher_data",
            "file.basename": "decipher_data",
            "source.shebang": "/bin/bash",
            "source.language": "bash",
            "source.imports[0]": "/home/bediger/src/xor-decoding/xor",
            "source.imports[1]": "base64",
            "source.imports[2]": "basename",
            "source.imports[3]": "mkdir",
            "source.imports[4]": "read",
            "source.imports[5]": "rm",
            "source.imports[6]": "sed",
            "source.strings[0]": "s/W..*$//",
            "source.has_imports": true
          }
        },
        "find": [
          {
            "id": "micro-behaviors/data/decode/base64::base64-d-cmd",
            "conf": 0.6000000238418579,
            "crit": 3,
            "desc": "base64 -d/-D decode command"
          },
          {
            "id": "micro-behaviors/fs/directory/traverse::rm-rf-cmd",
            "conf": 0.6000000238418579,
            "crit": 2,
            "desc": "rm -rf command"
          },
          {
            "id": "micro-behaviors/fs/path/location::hardcoded-home-dir-path",
            "conf": 0.800000011920929,
            "crit": 3,
            "desc": "Hardcoded absolute home directory path"
          }
        ],
        "path": "/data/samples/bad/datasets/php/NxAcGg/decipher_data",
        "risk": 2,
        "size": 338,
        "type": "shell"
      }
    ]
  }
}