{
  "ml": {
    "l": -1,
    "v": "6",
    "fs": [
      {
        "l": -1,
        "id": 0,
        "prob": 0.7891718149185181
      }
    ],
    "prob": 0.7891718,
    "models": [
      {
        "m": "az",
        "raw": 0.7891718,
        "prob": 0.7891718,
        "class": 0
      },
      {
        "m": "az/source",
        "raw": 0.98867244,
        "prob": 0.98867244,
        "class": 0
      },
      {
        "m": "az/c",
        "raw": 0.99742347,
        "prob": 0.99742347,
        "class": 0
      }
    ],
    "version": "v17.17",
    "analyzed_at": "2026-06-08T02:59:41Z"
  },
  "path": "rootkit.mod.c",
  "raw": {
    "v": "6",
    "fs": [
      {
        "f": "O(Er)H(Os)",
        "x": 37,
        "ff": {
          "i": [
            [
              "",
              "MODULE_INFO"
            ],
            [
              "",
              "section"
            ],
            [
              "",
              "section"
            ],
            [
              "",
              "section"
            ],
            [
              "",
              "MODULE_INFO"
            ],
            [
              "",
              "\u003clinux/compiler.h\u003e"
            ],
            [
              "",
              "\u003clinux/module.h\u003e"
            ],
            [
              "",
              "\u003clinux/vermagic.h\u003e"
            ]
          ],
          "m": {
            "ast": {
              "max_depth": 7.0,
              "call_count": 5.0,
              "node_count": 207.0,
              "identifier_count": 20.0,
              "string_literal_count": 9.0,
              "array_literal_max_length": 4.0
            },
            "file": {
              "size": 731.0,
              "entropy": 5.49,
              "size_bytes": 731.0
            },
            "text": {
              "tab_count": 4.0,
              "digit_ratio": 0.07,
              "space_count": 44.0,
              "total_lines": 32.0,
              "char_entropy": 5.49,
              "mixed_indent": 1.0,
              "unique_chars": 70.0,
              "string_density": 0.28,
              "avg_line_length": 21.84,
              "max_line_length": 57.0,
              "empty_line_ratio": 0.19,
              "last_line_length": 51.0,
              "whitespace_ratio": 0.11,
              "most_common_ratio": 0.06,
              "identifier_density": 0.75,
              "line_length_stddev": 16.95,
              "normalized_string_count": 1.59,
              "most_common_char_is_null": 0.0,
              "max_inline_whitespace_run": 1.0,
              "most_common_char_codepoint": 95.0,
              "normalized_unique_identifiers": 4.0
            },
            "calls": {
              "count": 5.0
            },
            "binary": {
              "overall_entropy": 5.49
            },
            "source": {
              "class_count": 2.0
            },
            "imports": {
              "count": 3.0,
              "unique_modules": 3.0,
              "third_party_count": 3.0,
              "third_party_ratio": 1.0
            },
            "strings": {
              "total": 9.0,
              "avg_length": 13.22,
              "max_length": 25.0,
              "avg_entropy": 3.06,
              "total_bytes": 119.0,
              "entropy_stddev": 0.47
            },
            "functions": {
              "count": 2.0
            },
            "identifiers": {
              "count": 20.0,
              "total": 24.0,
              "avg_length": 10.5,
              "max_length": 20.0,
              "min_length": 4.0,
              "avg_entropy": 2.89,
              "reuse_ratio": 0.83,
              "unique_count": 20.0,
              "length_stddev": 4.76,
              "high_entropy_count": 4.0,
              "high_entropy_ratio": 0.2,
              "all_lowercase_ratio": 0.75,
              "all_uppercase_ratio": 0.25,
              "underscore_prefix_count": 4.0
            }
          },
          "s": [
            [
              9,
              "u8",
              "\u003clinux/module.h\u003e"
            ],
            [
              35,
              "u8",
              "\u003clinux/vermagic.h\u003e"
            ],
            [
              63,
              "u8",
              "\u003clinux/compiler.h\u003e"
            ],
            [
              175,
              "u8",
              ".gnu.linkonce.this_module"
            ],
            [
              176,
              "u8",
              ".gnu.linkonce.this_module"
            ],
            [
              429,
              "u8",
              "__versions"
            ],
            [
              430,
              "u8",
              "__versions"
            ],
            [
              452,
              "16",
              "1758687954"
            ],
            [
              464,
              "u8",
              "module_layout"
            ],
            [
              465,
              "u8",
              "module_layout"
            ],
            [
              486,
              "16",
              "1357831864"
            ],
            [
              498,
              "u8",
              "printk"
            ],
            [
              499,
              "u8",
              "printk"
            ],
            [
              513,
              "16",
              "3758612033"
            ],
            [
              525,
              "u8",
              "kallsyms_lookup_name"
            ],
            [
              526,
              "u8",
              "kallsyms_lookup_name"
            ],
            [
              554,
              "16",
              "3023638426"
            ],
            [
              566,
              "u8",
              "mcount"
            ],
            [
              567,
              "u8",
              "mcount"
            ],
            [
              649,
              "u8",
              ".modinfo"
            ],
            [
              650,
              "u8",
              ".modinfo"
            ],
            [
              665,
              "u8",
              "depends="
            ],
            [
              666,
              "u8",
              "depends="
            ],
            [
              703,
              "u8",
              "5535DD31C0FEE8BB378949C"
            ],
            [
              704,
              "u8",
              "5535DD31C0FEE8BB378949C"
            ]
          ],
          "v": {
            "file.stem": "rootkit.mod",
            "file.basename": "rootkit.mod.c",
            "source.language": "c",
            "source.imports[0]": "\u003clinux/compiler.h\u003e",
            "source.imports[1]": "\u003clinux/module.h\u003e",
            "source.imports[2]": "\u003clinux/vermagic.h\u003e",
            "source.imports[3]": "MODULE_INFO",
            "source.imports[4]": "section",
            "source.strings[0]": ".gnu.linkonce.this_module",
            "source.strings[1]": ".modinfo",
            "source.strings[2]": "1357831864",
            "source.strings[3]": "1758687954",
            "source.strings[4]": "3023638426",
            "source.strings[5]": "3758612033",
            "source.strings[6]": "5535DD31C0FEE8BB378949C",
            "source.strings[7]": "\u003clinux/compiler.h\u003e",
            "source.strings[8]": "\u003clinux/module.h\u003e",
            "source.strings[9]": "\u003clinux/vermagic.h\u003e",
            "source.has_imports": true,
            "source.strings[10]": "__versions",
            "source.strings[11]": "depends=",
            "source.strings[12]": "kallsyms_lookup_name",
            "source.strings[13]": "mcount",
            "source.strings[14]": "module_layout",
            "source.strings[15]": "printk"
          },
          "ct": [
            "MODULE_INFO",
            "section"
          ],
          "id": "c"
        },
        "id": 0,
        "sz": 731,
        "ts": [
          {
            "d": "__this_module reference",
            "e": [
              "__this_module"
            ],
            "i": "objectives/evasion/kernel-hide/module::this-module",
            "l": 1
          },
          {
            "a": "T1106",
            "c": 0.9900000095367432,
            "d": "Linux kernel module header include (linux/module.h)",
            "e": [
              "linux/module.h"
            ],
            "i": "micro-behaviors/os/syscall/invoke::kernel-module-include-detect",
            "l": 1
          },
          {
            "a": "T1014",
            "c": 0.8999999761581421,
            "d": "kallsyms_lookup_name string reference",
            "e": [
              "kallsyms_lookup_name"
            ],
            "i": "objectives/evasion/kernel-hide/lkm/headers::kallsyms-lookup-name-str",
            "l": 4
          },
          {
            "c": 0.9900000095367432,
            "d": "Linux kernel module header detection",
            "e": [
              "\u003clinux/module.h\u003e"
            ],
            "i": "objectives/evasion/kernel-hide/lkm/headers::kernel-module-header-detect",
            "l": 2,
            "el": [
              "9"
            ]
          },
          {
            "c": 0.8500000238418579,
            "d": "kallsyms_lookup_name kernel symbol resolver",
            "e": [
              "kallsyms_lookup_name"
            ],
            "i": "micro-behaviors/os/kernel/routines::kallsyms-lookup-name",
            "l": 3
          }
        ],
        "sha": "6f4b3946d1b8a9bcc02bb4ff6070ee2b12da2b8683ceac899ed573ae46a2a05c",
        "path": "rootkit.mod.c",
        "type": "c"
      }
    ],
    "tv": "8e9ac"
  }
}