{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 0.9375,
        "class": 0
      }
    ],
    "prob": 0.9375,
    "class": 0,
    "models": [
      {
        "m": "az",
        "prob": 0.8383554,
        "class": 0
      },
      {
        "m": "az/source",
        "prob": 0.9375,
        "class": 0
      },
      {
        "m": "az/c",
        "prob": 0.9102564,
        "class": 0
      }
    ],
    "version": "v17.17",
    "thresholds": [
      0.999503,
      0.9998882
    ],
    "analyzed_at": "2026-05-25T18:58:26Z"
  },
  "path": "instruction_helper.h",
  "raw": {
    "v": "5",
    "fs": [
      {
        "f": "O(Er)",
        "x": 39,
        "ff": {
          "m": {
            "ast": {
              "max_depth": 6.0,
              "call_count": 0.0,
              "node_count": 23.0,
              "target_count": 0.0
            },
            "file": {
              "size": 494.0,
              "entropy": 4.76,
              "size_bytes": 494.0
            },
            "text": {
              "digit_ratio": 0.02,
              "space_count": 69.0,
              "total_lines": 14.0,
              "char_entropy": 4.76,
              "unique_chars": 59.0,
              "avg_line_length": 34.36,
              "max_line_length": 74.0,
              "empty_line_ratio": 0.07,
              "last_line_length": 49.0,
              "whitespace_ratio": 0.17,
              "most_common_ratio": 0.09,
              "identifier_density": 0.14,
              "line_length_stddev": 29.57,
              "most_common_char_is_null": 0.0,
              "suspicious_comment_ratio": 1.0,
              "max_inline_whitespace_run": 1.0,
              "most_common_char_codepoint": 116.0,
              "normalized_unique_identifiers": 0.53
            },
            "imports": {
              "count": 1.0,
              "unique_modules": 1.0,
              "third_party_count": 1.0,
              "third_party_ratio": 1.0
            },
            "comments": {
              "chars": 400.0,
              "lines": 10.0,
              "total": 1.0,
              "to_code_ratio": 2.5,
              "high_entropy_comments": 1.0
            },
            "identifiers": {
              "total": 2.0,
              "avg_length": 12.0,
              "max_length": 22.0,
              "min_length": 2.0,
              "avg_entropy": 2.26,
              "reuse_ratio": 1.0,
              "unique_count": 2.0,
              "length_stddev": 10.0,
              "high_entropy_count": 1.0,
              "high_entropy_ratio": 0.5,
              "all_lowercase_ratio": 1.0
            }
          },
          "s": [
            [
              22,
              "u8",
              "\u003clinux/module.h\u003e"
            ]
          ],
          "v": {
            "source.language": "c",
            "source.strings[0]": "\u003clinux/module.h\u003e"
          },
          "id": "c"
        },
        "id": 0,
        "sz": 494,
        "ts": [
          {
            "a": "T1106",
            "c": 0.9900000095367432,
            "d": "Linux kernel module header include (linux/module.h)",
            "e": [
              "linux/module.h"
            ],
            "i": "micro-behaviors/os/syscall/invoke::kernel-module-include-detect",
            "l": 1
          },
          {
            "c": 0.9900000095367432,
            "d": "Linux kernel module header detection",
            "e": [
              "\u003clinux/module.h\u003e"
            ],
            "i": "objectives/evasion/kernel-hide/lkm/headers::kernel-module-header-detect",
            "l": 2
          },
          {
            "a": "T1082",
            "c": 0.30000001192092896,
            "d": "x86_64 architecture string",
            "e": [
              "x86_64"
            ],
            "i": "micro-behaviors/os/sysinfo/platform/string::arch-x86-64",
            "l": 2,
            "m": "E1082"
          },
          {
            "a": "T1014",
            "c": 0.949999988079071,
            "d": "Rootkit header file pattern",
            "e": [
              "\u003clinux/module.h\u003e"
            ],
            "i": "objectives/evasion/kernel-hide/lkm/rootkit::rootkit-header",
            "l": 4
          }
        ],
        "sha": "7de01369442392c32de9fd3111a90d647d96b5c2f7fd4998d7702a6cfbbb961c",
        "path": "/data/samples/bad/projects/ksymless/src/kernel/instruction_helper.h",
        "type": "c"
      }
    ],
    "tv": "cf883"
  }
}