{
  "ml": {
    "v": "7",
    "eng": "2.2.0-beta.2",
    "lvl": -1,
    "conf": 0,
    "mods": [
      {
        "cls": 0,
        "raw": 0.017586768,
        "rte": "az",
        "prob": 0.017586768
      },
      {
        "cls": 0,
        "raw": 0.005854368,
        "rte": "az/tar",
        "prob": 0.005854368
      }
    ],
    "prob": 0.017586768,
    "files": [
      {
        "id": 0,
        "lvl": -1,
        "conf": 0,
        "prob": 0.01758676767349243,
        "type": "tar.gz"
      },
      {
        "id": 1,
        "lvl": -1,
        "conf": 0,
        "prob": 0.005618005990982056,
        "type": "shell"
      },
      {
        "id": 2,
        "lvl": -1,
        "conf": 0,
        "prob": 0.00003331899642944336,
        "type": "src_info"
      },
      {
        "id": 3,
        "lvl": -1,
        "conf": 0,
        "prob": 0.00003349781036376953,
        "type": "desktop_entry"
      },
      {
        "id": 4,
        "lvl": -1,
        "conf": 0,
        "prob": 0.00020629167556762695,
        "type": "registry"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-07-03T17:12:47Z"
  },
  "path": "lanshare-bin-1.1.0-1.src.tar.gz",
  "raw": {
    "fetched": [
      {
        "cached": false,
        "locator": "pkg:alpm/arch/glibc",
        "outcome": "unresolved",
        "fetched_at": 0,
        "source_offset": 267,
        "source_sha256": "13f4afba7e66fb99368a0b124c43868b008a5f8f848b081b855f8e475bb1d6e7"
      }
    ],
    "files": [
      {
        "id": 0,
        "ctx": [
          {
            "b": "abZy80000000zQ\u003c?ep$96.Vzs6OEkAo\u0026\u003c#@TE*S6IE/Mp8Uq:SzMZL]PE0hCb8Dv)b[wGc",
            "n": [
              {
                "c": 2,
                "d": "Archive parser reported errors",
                "i": "metadata/file/metrics::archive-parse-error",
                "o": 0,
                "z": 24,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 0
          }
        ],
        "mol": "H₂(Cm₃F)",
        "sha": "68c0b33755866990447adbd15a7a21ef294ef1a5548398ad9a798aec24cffd0f",
        "path": "/data/samples/unknown/foraged/arch/archlinux.org/aur.archlinux.org/lanshare-bin/lanshare-bin-1.1.0-1.src.tar.gz",
        "risk": 3,
        "size": 962,
        "type": "tar.gz",
        "facts": {
          "metrics": {
            "file": {
              "size": 962.0,
              "entropy": 7.76,
              "size_bytes": 962.0
            },
            "parse": {
              "error_count": 1.0
            },
            "binary": {
              "overall_entropy": 7.76,
              "peak_region_bytes": 962.0,
              "peak_region_entropy": 7.76
            }
          }
        },
        "traits": [
          {
            "id": "metadata/file/format::desktop-exec-present",
            "conf": 1.0,
            "crit": 1,
            "desc": "Desktop entry has Exec directive"
          },
          {
            "id": "micro-behaviors/communications/http/download/curl::curl-silent",
            "atk": "T1105",
            "conf": 0.800000011920929,
            "crit": 3,
            "desc": "curl silent flags",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/chmod/executable/mode::shell-plus-x",
            "atk": "T1222",
            "mbc": "E1222",
            "conf": 0.75,
            "crit": 3,
            "desc": "chmod +x (make executable)",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/download/cli::fetch-output-flag-script",
            "conf": 0.8500000238418579,
            "crit": 3,
            "desc": "curl/wget output file option in script",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/download/curl::curl-output-file",
            "atk": "T1105",
            "conf": 0.699999988079071,
            "crit": 3,
            "desc": "curl download to file",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "metadata/file/format::desktop-type-application",
            "conf": 1.0,
            "crit": 1,
            "desc": "Desktop entry Type=Application"
          },
          {
            "id": "metadata/file/format::desktop-terminal-hidden",
            "conf": 1.0,
            "crit": 1,
            "desc": "Desktop entry Terminal=false"
          },
          {
            "id": "micro-behaviors/communications/url/external/github::github-release-download",
            "atk": "T1105",
            "conf": 0.8500000238418579,
            "crit": 3,
            "desc": "GitHub releases download URL",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/download/curl::curl-cmd",
            "atk": "T1105",
            "conf": 0.699999988079071,
            "crit": 3,
            "desc": "curl command",
            "from": [
              {
                "file": 1
              }
            ]
          }
        ]
      },
      {
        "ctx": [
          {
            "b": "boPY?x(n33x(mH5iV@6DzGx@meOocrvivWBwO#Nix!r}txjj5FB7Gxke]CPFwPhEhe[X)uxMW=pv@DiF",
            "n": [
              {
                "c": 3,
                "d": "Recognized OS-specific execution marker",
                "i": "objectives/execution/condition/platform::os-specific-execution-recognized-marker",
                "o": 0,
                "z": 8,
                "cf": 0.800000011920929
              }
            ],
            "ln": 1,
            "addr": 0
          },
          {
            "b": "",
            "ln": 2,
            "addr": 65
          },
          {
            "b": "Abf97vqPNsy*?j5xKL{)eN\u0026Bi",
            "ln": 3,
            "addr": 66
          },
          {
            "b": "Abf8%wPIuAb13x?B8@{fy*?A$z/PXqoHhz@mRMWIax8@ZA+PA7aMv{oazbUjB97#7azkI0B8@EFwNV=ZnH$#{BZY8eB-qenvpR34z*c8nz^^f0wnc79efFwivq{s5C4z!rxK#3(a]",
            "ln": 6,
            "addr": 109
          },
          {
            "b": "vrb\u003c\u003ejT.X5i5Ub4g::y[vpsg^xF}W{df",
            "ln": 7,
            "addr": 219
          },
          {
            "b": "B-IpYb4#7uAc15[fk20vxMW=pv@DiqxjU$4B.JBtB.tboy*?j5xKL{)a]",
            "n": [
              {
                "c": 2,
                "d": "HTTPS protocol prefix",
                "i": "micro-behaviors/communications/http/message::https-prefix",
                "o": 250,
                "z": 8,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 8,
            "addr": 245
          },
          {
            "b": "y?Wx\u003czGxwLc)}IYoFX4B",
            "ln": 9,
            "addr": 291
          },
          {
            "b": "wmYZ\u003ezE^/Kc)@Uzx\u003c$N1df",
            "ln": 10,
            "addr": 308
          },
          {
            "b": "arR^HwPIo\u0026",
            "ln": 17,
            "addr": 467
          },
          {
            "b": "arR^Hzf6tjb1cu[zFTl1wnb{]az+F7B7/05wI4.jzGQgQbWT#2v}W0dbYEKiC4CXDe?Os",
            "ln": 18,
            "addr": 476
          },
          {
            "b": "arR^Hv%8*dat4UkoDU{9az+F7B7/05wGUj",
            "n": [
              {
                "c": 3,
                "d": "curl/wget output file option in script",
                "i": "micro-behaviors/communications/http/download/cli::fetch-output-flag-script",
                "o": 536,
                "z": 13,
                "cf": 0.8500000238418579
              }
            ],
            "ln": 19,
            "addr": 532
          },
          {
            "b": "arR^HarR^Hb4#7uAc15[fk20vxMW=pv@DiqxjU$4B.JBtB.tboy*?j5xKL{)flgSuwNPT\u003eB1.6xCw.knvpR3mbYEKiC4CXEy*?j5xKL{)eO]csB:bF-uTW$+xD^",
            "n": [
              {
                "c": 3,
                "d": "GitHub releases download URL",
                "i": "micro-behaviors/communications/url/external/github::github-release-download",
                "o": 577,
                "z": 50,
                "cf": 0.8500000238418579
              }
            ],
            "ln": 20,
            "addr": 560
          },
          {
            "b": "arR^Hv}YZ$wfryEaz+F7B7/05wD",
            "n": [
              {
                "c": 3,
                "d": "chmod +x (make executable)",
                "i": "micro-behaviors/fs/chmod/executable/mode::shell-plus-x",
                "o": 663,
                "z": 10,
                "cf": 0.75
              }
            ],
            "ln": 21,
            "addr": 659
          },
          {
            "b": "Ee",
            "ln": 22,
            "addr": 681
          },
          {
            "b": "",
            "ln": 23,
            "addr": 683
          },
          {
            "b": "Aa9l(vp%d1diJ%",
            "ln": 24,
            "addr": 684
          },
          {
            "b": "arR^Hx(n0lvqG:5eKTCmh8MH2bY!0ownc6qy*?j5xKL{)a%n6PAbf8%x(U\u003eHB8\u0026{yx(kOuvqZd1vrb{6",
            "ln": 25,
            "addr": 696
          },
          {
            "b": "arR^Hx(n0lvqG:5eKTClg=cs0bY!0ownc6qe?O!fe?.3HzGxG1A+c*FAbf9fwPxB$nKC{wq:?(Ma%.byxjLZ%flItRflp/nA+c[ux\u003e7Z(B7GzCbYEKizEEx[fha@8mnu=Ia%nT8fjXTqfk+]Gy-[aMaARTDwD",
            "n": [
              {
                "c": 2,
                "d": "Output/error suppression",
                "i": "micro-behaviors/os/console/io::output-suppression",
                "o": 868,
                "z": 10,
                "cf": 1.0
              }
            ],
            "ln": 26,
            "addr": 761
          },
          {
            "b": "Ee",
            "ln": 27,
            "addr": 887
          },
          {
            "b": "",
            "ln": 28,
            "addr": 889
          }
        ],
        "depth": 1,
        "facts": {
          "imp": [
            [
              "",
              "error"
            ],
            [
              "",
              "error"
            ],
            [
              "",
              "msg"
            ],
            [
              "",
              "msg"
            ],
            [
              "",
              "curl"
            ],
            [
              "",
              "curl"
            ],
            [
              "",
              "chmod"
            ],
            [
              "",
              "chmod"
            ],
            [
              "",
              "install"
            ],
            [
              "",
              "install"
            ],
            [
              "",
              "install"
            ],
            [
              "",
              "install"
            ],
            [
              "",
              "true"
            ],
            [
              "",
              "true"
            ]
          ],
          "tgt": [
            "chmod",
            "curl",
            "error",
            "install",
            "msg",
            "true"
          ],
          "metrics": {
            "ast": {
              "max_depth": 8.0,
              "bind_count": 10.0,
              "call_count": 7.0,
              "node_count": 201.0,
              "identifier_count": 29.0,
              "string_literal_count": 16.0,
              "array_literal_max_length": 2.0
            },
            "file": {
              "size": 889.0,
              "entropy": 5.21,
              "size_bytes": 889.0
            },
            "text": {
              "digit_ratio": 0.05,
              "space_count": 107.0,
              "total_lines": 27.0,
              "char_entropy": 5.21,
              "unique_chars": 75.0,
              "string_density": 0.59,
              "avg_line_length": 31.93,
              "high_byte_ratio": 0.0,
              "max_line_length": 125.0,
              "non_ascii_ratio": 0.0,
              "empty_line_ratio": 0.11,
              "last_line_length": 1.0,
              "whitespace_ratio": 0.15,
              "most_common_ratio": 0.06,
              "identifier_density": 1.78,
              "line_length_stddev": 33.47,
              "normalized_string_count": 3.08,
              "most_common_char_is_null": 0.0,
              "max_inline_whitespace_run": 1.0,
              "most_common_char_codepoint": 97.0,
              "normalized_unique_identifiers": 6.1
            },
            "binds": {
              "count": 10.0
            },
            "calls": {
              "count": 7.0
            },
            "binary": {
              "overall_entropy": 5.21,
              "peak_region_bytes": 889.0,
              "peak_region_entropy": 5.21
            },
            "source": {
              "function_count": 2.0
            },
            "strings": {
              "total": 16.0,
              "url_count": 2.0,
              "avg_length": 28.06,
              "max_length": 99.0,
              "path_count": 1.0,
              "avg_entropy": 3.36,
              "total_bytes": 449.0,
              "entropy_stddev": 0.98
            },
            "comments": {
              "chars": 63.0,
              "lines": 1.0,
              "total": 1.0,
              "to_code_ratio": 0.04
            },
            "functions": {
              "count": 2.0,
              "avg_params": 3.0,
              "max_params": 4.0,
              "length_stddev": 3.5,
              "avg_name_length": 6.0,
              "avg_length_lines": 7.5,
              "max_length_lines": 11.0,
              "min_length_lines": 4.0,
              "avg_param_name_length": 45.67,
              "density_per_100_lines": 7.41,
              "code_in_functions_ratio": 0.56
            },
            "identifiers": {
              "count": 29.0,
              "total": 48.0,
              "avg_length": 5.62,
              "max_length": 12.0,
              "min_length": 2.0,
              "avg_entropy": 2.19,
              "reuse_ratio": 0.6,
              "unique_count": 29.0,
              "length_stddev": 2.06,
              "has_digit_ratio": 0.1,
              "all_lowercase_ratio": 0.69,
              "all_uppercase_ratio": 0.03,
              "numeric_suffix_count": 2.0,
              "underscore_prefix_count": 1.0
            }
          }
        },
        "id": 1,
        "mol": "H₂(Cm₃F)",
        "path": "/data/samples/unknown/foraged/arch/archlinux.org/aur.archlinux.org/lanshare-bin/lanshare-bin-1.1.0-1.src.tar.gz!!lanshare-bin/PKGBUILD",
        "risk": 3,
        "sha": "d1113a45cb9e06ffbc0af27872afe86996c7ff4436e0095fc5a83200003a33c9",
        "size": 889,
        "traits": [
          {
            "id": "micro-behaviors/communications/http/download/cli::fetch-output-flag-script",
            "conf": 0.8500000238418579,
            "crit": 3,
            "desc": "curl/wget output file option in script",
            "spans": [
              [
                536,
                13
              ]
            ]
          },
          {
            "id": "micro-behaviors/communications/http/download/curl::curl-silent",
            "atk": "T1105",
            "conf": 0.800000011920929,
            "crit": 3,
            "desc": "curl silent flags",
            "spans": [
              [
                536,
                9
              ]
            ]
          },
          {
            "id": "micro-behaviors/communications/http/download/curl::curl-output-file",
            "atk": "T1105",
            "conf": 0.699999988079071,
            "crit": 3,
            "desc": "curl download to file",
            "spans": [
              [
                536,
                12
              ]
            ]
          },
          {
            "id": "micro-behaviors/communications/url/external/github::github-release-download",
            "atk": "T1105",
            "conf": 0.8500000238418579,
            "crit": 3,
            "desc": "GitHub releases download URL",
            "spans": [
              [
                577,
                50
              ]
            ]
          },
          {
            "id": "micro-behaviors/communications/http/download/curl::curl-cmd",
            "atk": "T1105",
            "conf": 0.699999988079071,
            "crit": 3,
            "desc": "curl command",
            "spans": [
              [
                535,
                10
              ]
            ]
          },
          {
            "id": "micro-behaviors/fs/chmod/executable/mode::shell-plus-x",
            "atk": "T1222",
            "mbc": "E1222",
            "conf": 0.75,
            "crit": 3,
            "desc": "chmod +x (make executable)",
            "spans": [
              [
                663,
                10
              ]
            ]
          }
        ],
        "type": "shell"
      },
      {
        "depth": 1,
        "facts": {
          "metrics": {
            "file": {
              "size": 297.0,
              "entropy": 4.98,
              "size_bytes": 297.0
            },
            "binary": {
              "overall_entropy": 4.98,
              "peak_region_bytes": 297.0,
              "peak_region_entropy": 4.98
            }
          }
        },
        "id": 2,
        "path": "/data/samples/unknown/foraged/arch/archlinux.org/aur.archlinux.org/lanshare-bin/lanshare-bin-1.1.0-1.src.tar.gz!!lanshare-bin/.SRCINFO",
        "refs": [
          {
            "to": "pkg:alpm/arch/glibc",
            "off": 267,
            "kind": "dependency"
          }
        ],
        "sha": "13f4afba7e66fb99368a0b124c43868b008a5f8f848b081b855f8e475bb1d6e7",
        "size": 297,
        "type": "src_info"
      },
      {
        "ctx": [
          {
            "b": "tsr4zyJKGlavQf\u0026A^p{",
            "n": [
              {
                "c": 1,
                "d": "Desktop entry has Exec directive",
                "i": "metadata/file/format::desktop-exec-present",
                "o": 0,
                "z": 1,
                "cf": 1.0
              }
            ],
            "ln": 1,
            "addr": 0
          },
          {
            "b": "pgn0JjXPp4q!PPWwD",
            "ln": 2,
            "addr": 16
          },
          {
            "b": "lVl*UwO#PMlVN9^B1Hj8vrua1A+#{)z!0i(awMG\u0026Cw?IqavZ6YwGT]+vrc71x8",
            "ln": 3,
            "addr": 30
          }
        ],
        "depth": 1,
        "facts": {
          "metrics": {
            "file": {
              "size": 192.0,
              "entropy": 4.74,
              "size_bytes": 192.0
            },
            "binary": {
              "overall_entropy": 4.74,
              "peak_region_bytes": 192.0,
              "peak_region_entropy": 4.74
            }
          }
        },
        "id": 3,
        "path": "/data/samples/unknown/foraged/arch/archlinux.org/aur.archlinux.org/lanshare-bin/lanshare-bin-1.1.0-1.src.tar.gz!!lanshare-bin/lanshare.desktop",
        "risk": 1,
        "sha": "0208ad9df17216e858ccd92a08fa0646ec760a4f2925b6e6a1f669398525355d",
        "size": 192,
        "traits": [
          {
            "id": "metadata/file/format::desktop-type-application",
            "conf": 1.0,
            "crit": 1,
            "desc": "Desktop entry Type=Application"
          },
          {
            "id": "metadata/file/format::desktop-terminal-hidden",
            "conf": 1.0,
            "crit": 1,
            "desc": "Desktop entry Terminal=false"
          },
          {
            "id": "metadata/file/format::desktop-exec-present",
            "conf": 1.0,
            "crit": 1,
            "desc": "Desktop entry has Exec directive"
          },
          {
            "id": "objectives/persistence/login/xdg::desktop-launcher",
            "atk": "T1547.013",
            "mbc": "F0012",
            "conf": 1.0,
            "crit": 1,
            "desc": "Desktop Entry headless launcher"
          }
        ],
        "type": "desktop_entry"
      },
      {
        "ctx": [
          {
            "b": "DM)3hz/ZhBBy/qkiWe0Mv}W5qb5Q?awG\u003ceVxkzo\u003ev\u003ciDFC4CYnx(v(kiWcsig=3U5gDc*%w[kHdfG7:AwhX1geIOC2b5?Wly?W%7",
            "n": [
              {
                "c": 3,
                "d": "Registry release under 7 days old",
                "i": "metadata/registry::freshly-published",
                "o": 0,
                "z": 24,
                "cf": 1.0
              }
            ],
            "ln": 0
          }
        ],
        "depth": 2,
        "facts": {
          "metrics": {
            "file": {
              "size": 784.0,
              "entropy": 4.7,
              "size_bytes": 784.0
            },
            "binary": {
              "overall_entropy": 4.7,
              "peak_region_bytes": 784.0,
              "peak_region_entropy": 4.7
            },
            "registry": {
              "age_days": 6.0,
              "maintainers": 2.0,
              "published_at": 1782564346.0,
              "is_deprecated": 0.0
            }
          }
        },
        "id": 4,
        "mol": "Md",
        "path": "glibc@2.43_r37_gfdf10644d6ee-1.registry.json",
        "risk": 1,
        "sha": "6cfe42a5ff55b6b602a3bb842418c1a3829640dceecadbda820ccba8f9a1d113",
        "size": 784,
        "traits": [
          {
            "id": "metadata/registry::freshly-published",
            "conf": 1.0,
            "crit": 3,
            "desc": "Registry release under 7 days old",
            "spans": [
              [
                0,
                24
              ]
            ]
          }
        ],
        "type": "registry"
      }
    ],
    "rev": "66111",
    "v": "8"
  }
}