{
  "ml": {
    "l": -1,
    "v": "6",
    "fs": [
      {
        "l": -1,
        "id": 0,
        "prob": 0.00001767277717590332
      }
    ],
    "prob": 0.000017672777,
    "models": [
      {
        "m": "az",
        "raw": 0.000017672777,
        "prob": 0.000017672777,
        "class": 0
      },
      {
        "m": "az/source",
        "raw": 0.00003707409,
        "prob": 0.00003707409,
        "class": 0
      },
      {
        "m": "az/c",
        "raw": 0.00013124943,
        "prob": 0.00013124943,
        "class": 0
      }
    ],
    "version": "v17.17",
    "analyzed_at": "2026-06-08T05:04:46Z"
  },
  "path": "init_conn_provider.cpp",
  "raw": {
    "v": "6",
    "fs": [
      {
        "f": "H(Ds)",
        "x": 2,
        "ff": {
          "i": [
            [
              "",
              "LoadLibraryW"
            ],
            [
              "",
              "MemoryGetModuleHandle"
            ],
            [
              "",
              "MemoryGetProcAddressP"
            ],
            [
              "",
              "MemoryGetProcAddressP"
            ],
            [
              "",
              "MemoryGetProcAddressP"
            ],
            [
              "",
              "fnWinHttpOpen"
            ],
            [
              "",
              "ws.c_str"
            ],
            [
              "",
              "fnWinHttpSetTimeouts"
            ],
            [
              "",
              "ws.assign"
            ],
            [
              "",
              "fnWinHttpConnect"
            ],
            [
              "",
              "ws.c_str"
            ],
            [
              "",
              "\u003cWindows.h\u003e"
            ],
            [
              "",
              "\u003capidef.h\u003e"
            ],
            [
              "",
              "\u003cconfig.h\u003e"
            ],
            [
              "",
              "\u003chashtable.h\u003e"
            ],
            [
              "",
              "\u003ciostream\u003e"
            ],
            [
              "",
              "\u003cmem_ldr.h\u003e"
            ],
            [
              "",
              "\u003cwinhttp.h\u003e"
            ]
          ],
          "m": {
            "ast": {
              "op.add": 2.0,
              "max_depth": 10.0,
              "op.concat": 3.0,
              "bind_count": 2.0,
              "call_count": 11.0,
              "node_count": 295.0,
              "member_count": 7.0,
              "op_density.add": 0.01,
              "identifier_count": 35.0,
              "member_depth_max": 2.0,
              "op_density.concat": 0.01,
              "string_literal_count": 1.0,
              "string_concat_chain_max_length": 2.0
            },
            "file": {
              "size": 1244.0,
              "entropy": 5.32,
              "size_bytes": 1244.0
            },
            "text": {
              "tab_count": 27.0,
              "digit_ratio": 0.0,
              "space_count": 57.0,
              "total_lines": 37.0,
              "char_entropy": 5.32,
              "unique_chars": 67.0,
              "string_density": 0.03,
              "avg_line_length": 32.65,
              "max_line_length": 125.0,
              "empty_line_ratio": 0.16,
              "last_line_length": 1.0,
              "whitespace_ratio": 0.1,
              "most_common_ratio": 0.08,
              "identifier_density": 2.03,
              "line_length_stddev": 31.16,
              "normalized_string_count": 0.16,
              "most_common_char_is_null": 0.0,
              "max_inline_whitespace_run": 1.0,
              "trailing_whitespace_lines": 1.0,
              "most_common_char_codepoint": 116.0,
              "normalized_unique_identifiers": 6.72
            },
            "binds": {
              "count": 2.0
            },
            "calls": {
              "count": 11.0
            },
            "binary": {
              "overall_entropy": 5.32
            },
            "source": {
              "function_count": 1.0
            },
            "imports": {
              "count": 7.0,
              "unique_modules": 7.0,
              "third_party_count": 7.0,
              "third_party_ratio": 1.0
            },
            "members": {
              "count": 7.0
            },
            "strings": {
              "total": 1.0,
              "avg_length": 14.0,
              "max_length": 14.0,
              "avg_entropy": 3.38,
              "total_bytes": 14.0
            },
            "comments": {
              "chars": 27.0,
              "lines": 2.0,
              "total": 2.0,
              "to_code_ratio": 0.06
            },
            "functions": {
              "count": 1.0
            },
            "identifiers": {
              "count": 35.0,
              "total": 75.0,
              "avg_length": 12.74,
              "max_length": 33.0,
              "min_length": 2.0,
              "avg_entropy": 2.92,
              "reuse_ratio": 0.47,
              "unique_count": 35.0,
              "length_stddev": 7.84,
              "high_entropy_count": 9.0,
              "high_entropy_ratio": 0.26,
              "all_lowercase_ratio": 0.37,
              "all_uppercase_ratio": 0.2
            }
          },
          "s": [
            [
              9,
              "u8",
              "\u003cWindows.h\u003e"
            ],
            [
              30,
              "u8",
              "\u003cwinhttp.h\u003e"
            ],
            [
              51,
              "u8",
              "\u003cconfig.h\u003e"
            ],
            [
              71,
              "u8",
              "\u003ciostream\u003e"
            ],
            [
              91,
              "u8",
              "\u003chashtable.h\u003e"
            ],
            [
              114,
              "u8",
              "\u003cmem_ldr.h\u003e"
            ],
            [
              135,
              "u8",
              "\u003capidef.h\u003e"
            ],
            [
              242,
              "u8",
              "L\"winhttp.dll"
            ],
            [
              244,
              "u8",
              "winhttp.dll"
            ],
            [
              931,
              "10",
              "0"
            ],
            [
              1212,
              "10",
              "0"
            ]
          ],
          "v": {
            "file.stem": "init_conn_provider",
            "file.basename": "init_conn_provider.cpp",
            "source.language": "c",
            "source.imports[0]": "\u003cWindows.h\u003e",
            "source.imports[1]": "\u003capidef.h\u003e",
            "source.imports[2]": "\u003cconfig.h\u003e",
            "source.imports[3]": "\u003chashtable.h\u003e",
            "source.imports[4]": "\u003ciostream\u003e",
            "source.imports[5]": "\u003cmem_ldr.h\u003e",
            "source.imports[6]": "\u003cwinhttp.h\u003e",
            "source.imports[7]": "LoadLibraryW",
            "source.imports[8]": "MemoryGetModuleHandle",
            "source.imports[9]": "MemoryGetProcAddressP",
            "source.strings[0]": "\u003cWindows.h\u003e",
            "source.strings[1]": "\u003capidef.h\u003e",
            "source.strings[2]": "\u003cconfig.h\u003e",
            "source.strings[3]": "\u003chashtable.h\u003e",
            "source.strings[4]": "\u003ciostream\u003e",
            "source.strings[5]": "\u003cmem_ldr.h\u003e",
            "source.strings[6]": "\u003cwinhttp.h\u003e",
            "source.strings[7]": "L\"winhttp.dll",
            "source.strings[8]": "winhttp.dll",
            "source.has_imports": true,
            "source.imports[10]": "fnWinHttpConnect",
            "source.imports[11]": "fnWinHttpOpen",
            "source.imports[12]": "fnWinHttpSetTimeouts",
            "source.imports[13]": "ws.assign",
            "source.imports[14]": "ws.c_str",
            "source.functions[0]": "initialize_connection_provider()"
          },
          "ct": [
            "LoadLibraryW",
            "MemoryGetModuleHandle",
            "MemoryGetProcAddressP",
            "fnWinHttpConnect",
            "fnWinHttpOpen",
            "fnWinHttpSetTimeouts",
            "ws.assign",
            "ws.c_str"
          ],
          "id": "c",
          "mc": [
            "pg_conf.host",
            "pg_conf.port",
            "pg_conf.timeout",
            "pg_conf.useragent",
            "std.useragent",
            "ws.assign",
            "ws.c_str"
          ]
        },
        "id": 0,
        "sz": 1244,
        "ts": [
          {
            "c": 1.0,
            "d": "LoadLibrary symbol",
            "e": [
              "LoadLibraryW"
            ],
            "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym",
            "l": 1,
            "el": [
              "e5"
            ]
          },
          {
            "c": 0.75,
            "d": "Delphi assign file pattern",
            "e": [
              "assign("
            ],
            "i": "metadata/lang/source::assignfile-pattern",
            "l": 2
          },
          {
            "a": "T1620",
            "c": 0.8500000238418579,
            "d": "MemoryGetProcAddress function",
            "e": [
              "MemoryGetProcAddress"
            ],
            "i": "objectives/evasion/process/injection/memory::memory-get-proc-address",
            "l": 1,
            "m": "E1620"
          },
          {
            "a": "T1129",
            "c": 0.8799999952316284,
            "d": "Dynamic library loading via LoadLibraryW",
            "e": [
              "LoadLibraryW"
            ],
            "i": "micro-behaviors/dylib/load/runtime::load-library-w",
            "l": 3,
            "el": [
              "e5"
            ]
          }
        ],
        "sha": "726a8eae8e67f71ff718bafb6ab4b48e4dc60d72a7b0c0e594af59421d8a598c",
        "path": "init_conn_provider.cpp",
        "type": "c"
      }
    ],
    "tv": "8e9ac"
  }
}