{
  "ml": {
    "l": -1,
    "v": "6",
    "fs": [
      {
        "l": -1,
        "id": 0,
        "prob": 0.00003280242162873037
      }
    ],
    "prob": 0.00003280242,
    "models": [
      {
        "m": "az",
        "raw": 0.00003280242,
        "prob": 0.00003280242,
        "class": 0
      },
      {
        "m": "az/source",
        "raw": 0.00090307,
        "prob": 0.00090307,
        "class": 0
      },
      {
        "m": "az/c",
        "raw": 0.00091949105,
        "prob": 0.00091949105,
        "class": 0
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-06-09T03:01:03Z"
  },
  "path": "bdcore.c",
  "raw": {
    "v": "6",
    "fs": [
      {
        "f": "O(Er)H(Os)",
        "x": 3,
        "ff": {
          "i": [
            [
              "",
              "strcmp"
            ],
            [
              "",
              "setuid"
            ],
            [
              "",
              "setgid"
            ],
            [
              "",
              "raw_init"
            ],
            [
              "",
              "shell_init"
            ],
            [
              "",
              "error"
            ],
            [
              "",
              "error"
            ],
            [
              "",
              "printf"
            ],
            [
              "",
              "plugin/raw.h"
            ],
            [
              "",
              "plugin/shell.h"
            ],
            [
              "",
              "settings.h"
            ]
          ],
          "m": {
            "ast": {
              "op.eq": 6.0,
              "max_depth": 12.0,
              "call_count": 8.0,
              "node_count": 184.0,
              "op_density.eq": 0.03,
              "identifier_count": 13.0,
              "string_literal_count": 4.0
            },
            "file": {
              "size": 1199.0,
              "entropy": 4.97,
              "size_bytes": 1199.0
            },
            "text": {
              "digit_ratio": 0.02,
              "space_count": 229.0,
              "total_lines": 51.0,
              "char_entropy": 4.97,
              "unique_chars": 68.0,
              "string_density": 0.08,
              "avg_line_length": 22.51,
              "max_line_length": 73.0,
              "empty_line_ratio": 0.16,
              "last_line_length": 1.0,
              "whitespace_ratio": 0.23,
              "most_common_ratio": 0.07,
              "identifier_density": 0.39,
              "line_length_stddev": 23.75,
              "normalized_string_count": 0.56,
              "suspicious_string_ratio": 0.25,
              "most_common_char_is_null": 0.0,
              "suspicious_comment_ratio": 1.0,
              "max_inline_whitespace_run": 2.0,
              "most_common_char_codepoint": 101.0,
              "suspicious_identifier_ratio": 0.08,
              "normalized_unique_identifiers": 2.29
            },
            "calls": {
              "count": 8.0
            },
            "binary": {
              "overall_entropy": 4.97
            },
            "source": {
              "function_count": 2.0
            },
            "imports": {
              "count": 3.0,
              "unique_modules": 3.0,
              "third_party_count": 3.0,
              "third_party_ratio": 1.0
            },
            "strings": {
              "total": 4.0,
              "avg_length": 18.5,
              "max_length": 38.0,
              "path_count": 1.0,
              "avg_entropy": 3.47,
              "total_bytes": 74.0,
              "entropy_stddev": 0.41,
              "shell_command_strings": 1.0
            },
            "comments": {
              "chars": 751.0,
              "lines": 17.0,
              "total": 1.0,
              "to_code_ratio": 0.5,
              "url_in_comments": 1.0,
              "high_entropy_comments": 1.0
            },
            "functions": {
              "count": 2.0
            },
            "identifiers": {
              "count": 13.0,
              "total": 20.0,
              "avg_length": 5.46,
              "max_length": 10.0,
              "min_length": 3.0,
              "avg_entropy": 2.22,
              "reuse_ratio": 0.65,
              "unique_count": 13.0,
              "length_stddev": 1.82,
              "has_digit_ratio": 0.08,
              "sequential_names": 1.0,
              "all_lowercase_ratio": 0.77,
              "all_uppercase_ratio": 0.15,
              "numeric_suffix_count": 1.0
            }
          },
          "s": [
            [
              766,
              "u8",
              "settings.h"
            ],
            [
              767,
              "u8",
              "settings.h"
            ],
            [
              791,
              "10",
              "1"
            ],
            [
              802,
              "u8",
              "plugin/raw.h"
            ],
            [
              803,
              "u8",
              "plugin/raw.h"
            ],
            [
              838,
              "10",
              "1"
            ],
            [
              849,
              "u8",
              "plugin/shell.h"
            ],
            [
              850,
              "u8",
              "plugin/shell.h"
            ],
            [
              920,
              "10",
              "3"
            ],
            [
              944,
              "10",
              "1"
            ],
            [
              955,
              "10",
              "0"
            ],
            [
              973,
              "10",
              "0"
            ],
            [
              988,
              "10",
              "0"
            ],
            [
              1007,
              "10",
              "1"
            ],
            [
              1055,
              "10",
              "1"
            ],
            [
              1079,
              "10",
              "2"
            ],
            [
              1154,
              "u8",
              "/bin/sh: cannote execute binary file\\n"
            ],
            [
              1155,
              "u8",
              "/bin/sh: cannote execute binary file"
            ]
          ],
          "v": {
            "file.stem": "bdcore",
            "file.basename": "bdcore.c",
            "source.language": "c",
            "source.imports[0]": "error",
            "source.imports[1]": "plugin/raw.h",
            "source.imports[2]": "plugin/shell.h",
            "source.imports[3]": "printf",
            "source.imports[4]": "raw_init",
            "source.imports[5]": "setgid",
            "source.imports[6]": "settings.h",
            "source.imports[7]": "setuid",
            "source.imports[8]": "shell_init",
            "source.imports[9]": "strcmp",
            "source.strings[0]": "/bin/sh: cannote execute binary file",
            "source.strings[1]": "/bin/sh: cannote execute binary file\\n",
            "source.strings[2]": "plugin/raw.h",
            "source.strings[3]": "plugin/shell.h",
            "source.strings[4]": "settings.h",
            "source.has_imports": true,
            "source.functions[0]": "error()",
            "source.functions[1]": "main(int argc, char *argv[])"
          },
          "ct": [
            "error",
            "printf",
            "raw_init",
            "setgid",
            "setuid",
            "shell_init",
            "strcmp"
          ],
          "id": "c"
        },
        "id": 0,
        "sz": 1199,
        "ts": [
          {
            "c": 0.800000011920929,
            "d": "Drop privileges (setuid after getuid)",
            "e": [
              "setgid",
              "setuid"
            ],
            "i": "micro-behaviors/process/identity/setuid::drop-privs",
            "l": 2,
            "el": [
              "3d5",
              "3c6"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "Container user and group identity drop",
            "e": [
              "setuid("
            ],
            "i": "micro-behaviors/os/container/oci::container-user-drop",
            "l": 3
          },
          {
            "c": 0.800000011920929,
            "d": "C source references shell path",
            "e": [
              "/bin/sh"
            ],
            "i": "objectives/command-and-control/reverse-shell/dup::c-source-shell-path",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Code explicitly mentions malware/backdoor",
            "e": [
              "/*\n    Trivial userspace backdoor\n    Copyright (C) 2012  Emanuele Paiano\n        nixw0rm@gmail.com\n..."
            ],
            "i": "objectives/evasion/kernel-hide/lkm/hiding::malware-mention-comment-backdoor",
            "l": 3,
            "el": [
              "@0"
            ]
          },
          {
            "c": 0.6000000238418579,
            "d": "Set group ID (capability)",
            "e": [
              "setgid"
            ],
            "i": "micro-behaviors/process/identity/setuid::setgid",
            "l": 3,
            "el": [
              "3d5"
            ]
          },
          {
            "c": 0.6000000238418579,
            "d": "Set user ID (capability)",
            "e": [
              "setuid"
            ],
            "i": "micro-behaviors/process/identity/setuid::setuid-dup",
            "l": 3,
            "el": [
              "3c6"
            ]
          }
        ],
        "sha": "7af7584427e6bc0ac70c731279f56cabf5dad3a569be2ada92de154cb89fd66a",
        "path": "bdcore.c",
        "type": "c"
      }
    ],
    "tv": "35641"
  }
}