{
  "ml": {
    "v": "7",
    "eng": "2.2.0-beta.2",
    "lvl": -1,
    "conf": 0,
    "mods": [
      {
        "cls": 0,
        "raw": 0.013070752,
        "rte": "az",
        "prob": 0.013070752
      }
    ],
    "prob": 0.013070752,
    "files": [
      {
        "id": 0,
        "lvl": -1,
        "conf": 0,
        "prob": 0.013070751912891865,
        "type": "xz"
      },
      {
        "id": 1,
        "lvl": -1,
        "conf": 0,
        "prob": 0.009726841934025288,
        "type": "shell"
      },
      {
        "id": 2,
        "lvl": -1,
        "conf": 0,
        "prob": 0.00985120702534914,
        "type": "shell"
      },
      {
        "id": 3,
        "lvl": -1,
        "conf": 0,
        "prob": 0.000009894371032714844,
        "type": "kotlin"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-06-29T00:49:45Z"
  },
  "path": "tex-multitoc-2.02.tgz",
  "raw": {
    "files": [
      {
        "id": 0,
        "mol": "O(Er)H(Po₂)",
        "sha": "8a1223211bddfa9d9dbae95d51c3bcfe803bea898c0a6cf795be772b4388b72a",
        "path": "/data/samples/good/foraged/netbsd/netbsd.org/_/tex-multitoc-2.02/tex-multitoc-2.02.tgz",
        "risk": 4,
        "size": 4516,
        "type": "xz",
        "facts": {
          "metrics": {
            "file": {
              "size": 4516.0,
              "entropy": 7.96,
              "size_bytes": 4516.0
            },
            "binary": {
              "overall_entropy": 7.96,
              "peak_region_bytes": 4516.0,
              "peak_region_entropy": 7.84
            },
            "consistency": {
              "extension_content_mismatch": 1.0,
              "extension_content_mismatch.archive_as_archive": 1.0
            }
          }
        },
        "traits": [
          {
            "id": "micro-behaviors/process/interpreter/perl::perl-keyword",
            "conf": 0.699999988079071,
            "crit": 3,
            "desc": "perl interpreter keyword (beyond shebang)"
          },
          {
            "id": "micro-behaviors/process/create/shell/spawn::bin-sh",
            "atk": "T1059.004",
            "mbc": "E1059.004",
            "conf": 0.6000000238418579,
            "crit": 3,
            "desc": "References /bin/sh (Bourne shell)"
          },
          {
            "id": "micro-behaviors/os/env/vars/access::env-cmd",
            "atk": "T1082",
            "conf": 0.6000000238418579,
            "crit": 3,
            "desc": "env command path"
          },
          {
            "id": "objectives/evasion/masquerade/extension/shebang::bash-shebang-first-line",
            "atk": "T1036.008",
            "mbc": "F0008",
            "conf": 0.949999988079071,
            "crit": 3,
            "desc": "File starts with"
          },
          {
            "id": "micro-behaviors/process/create/shell/spawn::sh-dynamic-command-target",
            "conf": 0.6000000238418579,
            "crit": 3,
            "desc": "Shell command name from variable",
            "spans": [
              [
                0,
                34
              ]
            ]
          },
          {
            "id": "micro-behaviors/process/create/shell/spawn::shell-symbols",
            "conf": 0.8999999761581421,
            "crit": 3,
            "desc": "Shell execution symbols",
            "from": [
              {
                "file": 1
              },
              {
                "file": 2
              }
            ],
            "spans": [
              [
                0,
                34
              ]
            ]
          }
        ]
      },
      {
        "ctx": [
          {
            "b": "boXZHx(kOBxA",
            "n": [
              {
                "c": 3,
                "d": "File starts with",
                "i": "objectives/evasion/masquerade/extension/shebang::bash-shebang-first-line",
                "o": 0,
                "z": 9,
                "cf": 0.949999988079071
              }
            ],
            "ln": 1,
            "addr": 0
          },
          {
            "b": "bl",
            "ln": 2,
            "addr": 10
          },
          {
            "b": "boOmbwPQmql](D7wNPaXAX8wRf!Lm8gb7BtfekjngCx}ah99DFiX\u0026xiCwhvCmr\u0026+]bM",
            "n": [
              {
                "c": 2,
                "d": "NetBSD RCS ident keyword",
                "i": "metadata/binary/provenance::netbsd-rcs-id",
                "o": 14,
                "z": 8,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 3,
            "addr": 12
          },
          {
            "b": "",
            "ln": 4,
            "addr": 66
          },
          {
            "b": "q:\u003cwHjT8d9a]",
            "ln": 5,
            "addr": 67
          },
          {
            "b": "B7/o1BrAs",
            "ln": 8,
            "addr": 101
          },
          {
            "b": "",
            "ln": 9,
            "addr": 109
          },
          {
            "b": "l03Yxa$[7WAXy)ozzbBxyA-",
            "n": [
              {
                "c": 2,
                "d": "Uses awk for text processing",
                "i": "well-known/tool/development/cli::awk-processing",
                "o": 124,
                "z": 3,
                "cf": 1.0
              }
            ],
            "ln": 10,
            "addr": 110
          },
          {
            "b": "lp1Kspc?PyjT8L4B8\u0026{yx(kOkvrl0$vqPN1",
            "ln": 11,
            "addr": 129
          },
          {
            "b": "lQsWma$)ztzzbHdBrQ",
            "ln": 12,
            "addr": 158
          },
          {
            "b": "oI4#LmNo{DjT8L4B8\u0026{PvRGZky?W^5w)]Z%a]",
            "ln": 29,
            "addr": 469
          },
          {
            "b": "oIN.{fjFTkfkLII",
            "ln": 30,
            "addr": 499
          },
          {
            "b": "oJa7#fjFTkfkLXN",
            "n": [
              {
                "c": 2,
                "d": "List directory contents via /bin/ls",
                "i": "micro-behaviors/fs/directory/readdir::readdir-ls",
                "o": 516,
                "z": 7,
                "cf": 0.6600000262260437
              }
            ],
            "ln": 31,
            "addr": 512
          },
          {
            "b": "o?N(CqAViSvRGZkzeiV@AV=@Ma]",
            "ln": 32,
            "addr": 525
          },
          {
            "b": "o\u0026:z3zfv3Nw*d",
            "ln": 33,
            "addr": 547
          },
          {
            "b": "p^[nQh9AcpB-RNRAbf8tvRGZkAaK6aa]",
            "n": [
              {
                "c": 3,
                "d": "perl interpreter keyword (beyond shebang)",
                "i": "micro-behaviors/process/interpreter/perl::perl-keyword",
                "o": 578,
                "z": 4,
                "cf": 0.699999988079071
              }
            ],
            "ln": 34,
            "addr": 558
          },
          {
            "b": "p!Kq=k$1Bspcx^OB-RNRB7e\u003c3fk$YtuTWFZx(k9",
            "ln": 35,
            "addr": 584
          },
          {
            "b": "p!Kq=nLR-JjT8L4B8\u0026{PvRGZkAbf8[x(mK3a]",
            "ln": 36,
            "addr": 616
          },
          {
            "b": "qCxp#fjFTkflg[N",
            "ln": 38,
            "addr": 665
          },
          {
            "b": "qCxLJqAViSvRGZkA=2u3AV$",
            "ln": 39,
            "addr": 678
          },
          {
            "b": "q:\u003c8qa$[7WAXy)ozzc6xwfI",
            "n": [
              {
                "c": 2,
                "d": "Uses sed for text processing",
                "i": "well-known/tool/development/cli::sed-processing",
                "o": 711,
                "z": 3,
                "cf": 1.0
              }
            ],
            "ln": 40,
            "addr": 697
          },
          {
            "b": "q:\u003cUOpf6I4flItRfjFTkfj/3Aa]",
            "n": [
              {
                "c": 3,
                "d": "env command path",
                "i": "micro-behaviors/os/env/vars/access::env-cmd",
                "o": 724,
                "z": 12,
                "cf": 0.6000000238418579
              }
            ],
            "ln": 41,
            "addr": 716
          },
          {
            "b": "q+f4}fjFTkflp!J",
            "n": [
              {
                "c": 3,
                "d": "Shell command execution capability",
                "i": "micro-behaviors/process/create/shell/spawn::shell-execution-comp",
                "o": 742,
                "z": 7,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 42,
            "addr": 738
          },
          {
            "b": "q+{p\u003cjT8L4B8\u0026{yx(kOBz/P}z",
            "ln": 43,
            "addr": 751
          },
          {
            "b": "q=L$8flItRfjFTkflqmW",
            "ln": 44,
            "addr": 772
          },
          {
            "b": "2{QM\u003cwO(vewGV5cwO=g7azbUjz6gGyByM$BxK#0@B1N",
            "ln": 108,
            "addr": 2027
          },
          {
            "b": "2{P",
            "ln": 109,
            "addr": 2062
          },
          {
            "b": "2{:\u003c%mn)flar.\u003cVCPXQ(d]O#coIuNRD\u0026",
            "n": [
              {
                "c": 2,
                "d": "SHELL environment variable",
                "i": "micro-behaviors/os/env/vars/system-info::shell-var",
                "o": 2082,
                "z": 5,
                "cf": 0.5
              }
            ],
            "ln": 110,
            "addr": 2065
          },
          {
            "b": "2)\u0026jqd]O#coIuNbmnlMUmiA\u003e5p!Kq=o*@2El{T^ruQNE-Ee",
            "ln": 111,
            "addr": 2091
          },
          {
            "b": "2{:\u003c%mn)flar.\u003cVCPXQ(d]O#coIuNRD\u0026",
            "ln": 112,
            "addr": 2129
          }
        ],
        "depth": 1,
        "facts": {
          "imp": [
            [
              "",
              "shift"
            ],
            [
              "",
              "shift"
            ],
            [
              "",
              "{PWD_CMD}"
            ],
            [
              "",
              "/usr/pkg/bin/mktexlsr"
            ],
            [
              "",
              "/usr/pkg/bin/mktexlsr"
            ],
            [
              "",
              "{TEST}"
            ],
            [
              "",
              "./+OCAML_FINDLIB_REGISTER"
            ],
            [
              "",
              "./+OCAML_FINDLIB_REGISTER"
            ],
            [
              "",
              "{TEST}"
            ],
            [
              "",
              "./+INFO_FILES"
            ],
            [
              "",
              "./+INFO_FILES"
            ],
            [
              "",
              "{TEST}"
            ],
            [
              "",
              "./+ICON_THEMES"
            ],
            [
              "",
              "./+ICON_THEMES"
            ],
            [
              "",
              "{TEST}"
            ],
            [
              "",
              "./+SHELL"
            ],
            [
              "",
              "./+SHELL"
            ],
            [
              "",
              "{TEST}"
            ],
            [
              "",
              "./+SHELL"
            ],
            [
              "",
              "./+SHELL"
            ],
            [
              "",
              "{TEST}"
            ],
            [
              "",
              "./+FILES"
            ],
            [
              "",
              "./+FILES"
            ],
            [
              "",
              "{TEST}"
            ],
            [
              "",
              "./+FONTS"
            ],
            [
              "",
              "./+FONTS"
            ],
            [
              "",
              "{TEST}"
            ],
            [
              "",
              "./+ICON_THEMES"
            ],
            [
              "",
              "./+ICON_THEMES"
            ],
            [
              "",
              "{TEST}"
            ],
            [
              "",
              "./+SHLIBS"
            ],
            [
              "",
              "./+SHLIBS"
            ],
            [
              "",
              "{TEST}"
            ],
            [
              "",
              "./+DIRS"
            ],
            [
              "",
              "./+DIRS"
            ],
            [
              "",
              "{TEST}"
            ],
            [
              "",
              "./+USERGROUP"
            ],
            [
              "",
              "./+USERGROUP"
            ],
            [
              "",
              "{TEST}"
            ],
            [
              "",
              "./+USERGROUP"
            ],
            [
              "",
              "./+USERGROUP"
            ],
            [
              "",
              "{TEST}"
            ],
            [
              "",
              "./+FILES"
            ],
            [
              "",
              "./+FILES"
            ],
            [
              "",
              "{TEST}"
            ],
            [
              "",
              "./+DIRS"
            ],
            [
              "",
              "./+DIRS"
            ],
            [
              "",
              "exit"
            ],
            [
              "",
              "exit"
            ]
          ],
          "tgt": [
            "${PWD_CMD}",
            "${TEST}",
            "./+DIRS",
            "./+FILES",
            "./+FONTS",
            "./+ICON_THEMES",
            "./+INFO_FILES",
            "./+OCAML_FINDLIB_REGISTER",
            "./+SHELL",
            "./+SHLIBS",
            "./+USERGROUP",
            "/usr/pkg/bin/mktexlsr",
            ":",
            "exit",
            "shift"
          ],
          "metrics": {
            "ast": {
              "max_depth": 7.0,
              "bind_count": 55.0,
              "call_count": 33.0,
              "node_count": 782.0,
              "identifier_count": 82.0,
              "string_literal_count": 53.0
            },
            "file": {
              "size": 3270.0,
              "entropy": 5.79,
              "size_bytes": 3270.0
            },
            "text": {
              "tab_count": 74.0,
              "digit_ratio": 0.04,
              "space_count": 216.0,
              "total_lines": 160.0,
              "char_entropy": 5.79,
              "mixed_indent": 1.0,
              "unique_chars": 84.0,
              "string_density": 0.33,
              "avg_line_length": 19.44,
              "max_line_length": 71.0,
              "empty_line_ratio": 0.1,
              "last_line_length": 6.0,
              "whitespace_ratio": 0.14,
              "most_common_ratio": 0.05,
              "identifier_density": 1.27,
              "line_length_stddev": 16.79,
              "normalized_string_count": 4.19,
              "suspicious_string_ratio": 0.02,
              "most_common_char_is_null": 0.0,
              "suspicious_comment_ratio": 0.1,
              "max_inline_whitespace_run": 1.0,
              "most_common_char_codepoint": 47.0,
              "normalized_unique_identifiers": 11.47
            },
            "binds": {
              "count": 55.0
            },
            "calls": {
              "count": 33.0,
              "dynamic_target_count": 15.0
            },
            "binary": {
              "overall_entropy": 5.79,
              "peak_region_bytes": 3270.0,
              "peak_region_entropy": 5.79
            },
            "strings": {
              "total": 53.0,
              "avg_length": 10.74,
              "max_length": 40.0,
              "path_count": 39.0,
              "avg_entropy": 2.86,
              "empty_count": 2.0,
              "total_bytes": 569.0,
              "entropy_stddev": 0.67,
              "shell_command_strings": 1.0
            },
            "comments": {
              "chars": 696.0,
              "lines": 17.0,
              "total": 39.0,
              "to_code_ratio": 0.12,
              "empty_comments": 22.0,
              "high_entropy_comments": 4.0
            },
            "identifiers": {
              "count": 82.0,
              "total": 203.0,
              "avg_length": 6.88,
              "max_length": 25.0,
              "min_length": 1.0,
              "avg_entropy": 2.25,
              "reuse_ratio": 0.41,
              "unique_count": 84.0,
              "length_stddev": 5.18,
              "has_digit_ratio": 0.06,
              "single_char_count": 5.0,
              "single_char_ratio": 0.06,
              "high_entropy_count": 7.0,
              "high_entropy_ratio": 0.08,
              "all_lowercase_ratio": 0.04,
              "all_uppercase_ratio": 0.7,
              "numeric_suffix_count": 1.0,
              "underscore_prefix_count": 1.0
            }
          }
        },
        "id": 1,
        "mol": "O(Er)H(Po₂)",
        "path": "/data/samples/good/foraged/netbsd/netbsd.org/_/tex-multitoc-2.02/tex-multitoc-2.02.tgz!!+DEINSTALL",
        "risk": 4,
        "sha": "e21d5ac97b2caea88e9a2badd4db62f1c5098305108879cf7de324089c1fc203",
        "size": 3270,
        "traits": [
          {
            "id": "micro-behaviors/os/env/vars/access::env-cmd",
            "atk": "T1082",
            "conf": 0.6000000238418579,
            "crit": 3,
            "desc": "env command path",
            "spans": [
              [
                724,
                12
              ]
            ]
          },
          {
            "id": "micro-behaviors/process/create/shell/spawn::bin-sh",
            "atk": "T1059.004",
            "mbc": "E1059.004",
            "conf": 0.6000000238418579,
            "crit": 3,
            "desc": "References /bin/sh (Bourne shell)",
            "spans": [
              [
                742,
                7
              ]
            ]
          },
          {
            "id": "objectives/evasion/masquerade/extension/shebang::bash-shebang-first-line",
            "atk": "T1036.008",
            "mbc": "F0008",
            "conf": 0.949999988079071,
            "crit": 3,
            "desc": "File starts with",
            "spans": [
              [
                0,
                9
              ]
            ]
          },
          {
            "id": "micro-behaviors/process/interpreter/perl::perl-keyword",
            "conf": 0.699999988079071,
            "crit": 3,
            "desc": "perl interpreter keyword (beyond shebang)",
            "spans": [
              [
                578,
                4
              ]
            ]
          },
          {
            "id": "micro-behaviors/process/create/shell/spawn::sh-dynamic-command-target",
            "conf": 0.6000000238418579,
            "crit": 3,
            "desc": "Shell command name from variable",
            "spans": [
              [
                0,
                34
              ]
            ]
          },
          {
            "id": "micro-behaviors/process/create/shell/spawn::shell-symbols",
            "conf": 0.8999999761581421,
            "crit": 3,
            "desc": "Shell execution symbols",
            "spans": [
              [
                0,
                34
              ],
              [
                742,
                7
              ]
            ]
          }
        ],
        "type": "shell"
      },
      {
        "ctx": [
          {
            "b": "boXZHx(kOBxA",
            "n": [
              {
                "c": 3,
                "d": "File starts with",
                "i": "objectives/evasion/masquerade/extension/shebang::bash-shebang-first-line",
                "o": 0,
                "z": 9,
                "cf": 0.949999988079071
              }
            ],
            "ln": 1,
            "addr": 0
          },
          {
            "b": "bl",
            "ln": 2,
            "addr": 10
          },
          {
            "b": "boOmbwPQmql](D7wNPaXAX8wRf!Lm8gb7BtfekjngCx}ah99DFiX\u0026xiCwhvCmr\u0026+]bM",
            "n": [
              {
                "c": 2,
                "d": "NetBSD RCS ident keyword",
                "i": "metadata/binary/provenance::netbsd-rcs-id",
                "o": 14,
                "z": 8,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 3,
            "addr": 12
          },
          {
            "b": "",
            "ln": 4,
            "addr": 66
          },
          {
            "b": "q:\u003cwHjT8d9a]",
            "ln": 5,
            "addr": 67
          },
          {
            "b": "B7/o1BrAs",
            "ln": 8,
            "addr": 101
          },
          {
            "b": "",
            "ln": 9,
            "addr": 109
          },
          {
            "b": "l03Yxa$[7WAXy)ozzbBxyA-",
            "n": [
              {
                "c": 2,
                "d": "Uses awk for text processing",
                "i": "well-known/tool/development/cli::awk-processing",
                "o": 124,
                "z": 3,
                "cf": 1.0
              }
            ],
            "ln": 10,
            "addr": 110
          },
          {
            "b": "lp1Kspc?PyjT8L4B8\u0026{yx(kOkvrl0$vqPN1",
            "ln": 11,
            "addr": 129
          },
          {
            "b": "lQsWma$)ztzzbHdBrQ",
            "ln": 12,
            "addr": 158
          },
          {
            "b": "oI4#LmNo{DjT8L4B8\u0026{PvRGZky?W^5w)]Z%a]",
            "ln": 29,
            "addr": 469
          },
          {
            "b": "oIN.{fjFTkfkLII",
            "ln": 30,
            "addr": 499
          },
          {
            "b": "oJa7#fjFTkfkLXN",
            "n": [
              {
                "c": 2,
                "d": "List directory contents via /bin/ls",
                "i": "micro-behaviors/fs/directory/readdir::readdir-ls",
                "o": 516,
                "z": 7,
                "cf": 0.6600000262260437
              }
            ],
            "ln": 31,
            "addr": 512
          },
          {
            "b": "o?N(CqAViSvRGZkzeiV@AV=@Ma]",
            "ln": 32,
            "addr": 525
          },
          {
            "b": "o\u0026:z3zfv3Nw*d",
            "ln": 33,
            "addr": 547
          },
          {
            "b": "p^[nQh9AcpB-RNRAbf8tvRGZkAaK6aa]",
            "n": [
              {
                "c": 3,
                "d": "perl interpreter keyword (beyond shebang)",
                "i": "micro-behaviors/process/interpreter/perl::perl-keyword",
                "o": 578,
                "z": 4,
                "cf": 0.699999988079071
              }
            ],
            "ln": 34,
            "addr": 558
          },
          {
            "b": "p!Kq=k$1Bspcx^OB-RNRB7e\u003c3fk$YtuTWFZx(k9",
            "ln": 35,
            "addr": 584
          },
          {
            "b": "p!Kq=nLR-JjT8L4B8\u0026{PvRGZkAbf8[x(mK3a]",
            "ln": 36,
            "addr": 616
          },
          {
            "b": "qCxp#fjFTkflg[N",
            "ln": 38,
            "addr": 665
          },
          {
            "b": "qCxLJqAViSvRGZkA=2u3AV$",
            "ln": 39,
            "addr": 678
          },
          {
            "b": "q:\u003c8qa$[7WAXy)ozzc6xwfI",
            "n": [
              {
                "c": 2,
                "d": "Uses sed for text processing",
                "i": "well-known/tool/development/cli::sed-processing",
                "o": 711,
                "z": 3,
                "cf": 1.0
              }
            ],
            "ln": 40,
            "addr": 697
          },
          {
            "b": "q:\u003cUOpf6I4flItRfjFTkfj/3Aa]",
            "n": [
              {
                "c": 3,
                "d": "env command path",
                "i": "micro-behaviors/os/env/vars/access::env-cmd",
                "o": 724,
                "z": 12,
                "cf": 0.6000000238418579
              }
            ],
            "ln": 41,
            "addr": 716
          },
          {
            "b": "q+f4}fjFTkflp!J",
            "n": [
              {
                "c": 3,
                "d": "Shell command execution capability",
                "i": "micro-behaviors/process/create/shell/spawn::shell-execution-comp",
                "o": 742,
                "z": 7,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 42,
            "addr": 738
          },
          {
            "b": "q+{p\u003cjT8L4B8\u0026{yx(kOBz/P}z",
            "ln": 43,
            "addr": 751
          },
          {
            "b": "q=L$8flItRfjFTkflqmW",
            "ln": 44,
            "addr": 772
          },
          {
            "b": "2{QM\u003cwOkZ#By/FnB7/c3y\u0026Z.kzxHPzByM$BxK#0@B1N",
            "ln": 142,
            "addr": 2926
          },
          {
            "b": "2{P",
            "ln": 143,
            "addr": 2961
          },
          {
            "b": "2{:\u003c%mn)flar.\u003cVCPXQ(d]O#coIuNRD\u0026",
            "n": [
              {
                "c": 2,
                "d": "SHELL environment variable",
                "i": "micro-behaviors/os/env/vars/system-info::shell-var",
                "o": 2981,
                "z": 5,
                "cf": 0.5
              }
            ],
            "ln": 144,
            "addr": 2964
          },
          {
            "b": "2)\u0026jqd]O#coIuM{l{@dyDR^v9uRJ%*k$11rl0)2KqHF",
            "ln": 145,
            "addr": 2990
          },
          {
            "b": "2{:\u003c%mn)flar.\u003cVCPXQ(d]O#coIuNRD\u0026",
            "ln": 146,
            "addr": 3025
          }
        ],
        "depth": 1,
        "facts": {
          "imp": [
            [
              "",
              "shift"
            ],
            [
              "",
              "shift"
            ],
            [
              "",
              "{PWD_CMD}"
            ],
            [
              "",
              "{SH}"
            ],
            [
              "",
              "{TEST}"
            ],
            [
              "",
              "./+USERGROUP"
            ],
            [
              "",
              "./+USERGROUP"
            ],
            [
              "",
              "./+USERGROUP"
            ],
            [
              "",
              "./+USERGROUP"
            ],
            [
              "",
              "exit"
            ],
            [
              "",
              "exit"
            ],
            [
              "",
              "{TEST}"
            ],
            [
              "",
              "./+DIRS"
            ],
            [
              "",
              "./+DIRS"
            ],
            [
              "",
              "{TEST}"
            ],
            [
              "",
              "./+DIRS"
            ],
            [
              "",
              "./+DIRS"
            ],
            [
              "",
              "{TEST}"
            ],
            [
              "",
              "./+SHLIBS"
            ],
            [
              "",
              "./+SHLIBS"
            ],
            [
              "",
              "{TEST}"
            ],
            [
              "",
              "./+FILES"
            ],
            [
              "",
              "./+FILES"
            ],
            [
              "",
              "{TEST}"
            ],
            [
              "",
              "./+FILES"
            ],
            [
              "",
              "./+FILES"
            ],
            [
              "",
              "{TEST}"
            ],
            [
              "",
              "./+PERMS"
            ],
            [
              "",
              "./+PERMS"
            ],
            [
              "",
              "{TEST}"
            ],
            [
              "",
              "./+FONTS"
            ],
            [
              "",
              "./+FONTS"
            ],
            [
              "",
              "{TEST}"
            ],
            [
              "",
              "./+ICON_THEMES"
            ],
            [
              "",
              "./+ICON_THEMES"
            ],
            [
              "",
              "{TEST}"
            ],
            [
              "",
              "./+DIRS"
            ],
            [
              "",
              "./+DIRS"
            ],
            [
              "",
              "{TEST}"
            ],
            [
              "",
              "./+DIRS"
            ],
            [
              "",
              "./+DIRS"
            ],
            [
              "",
              "{TEST}"
            ],
            [
              "",
              "./+FILES"
            ],
            [
              "",
              "./+FILES"
            ],
            [
              "",
              "{TEST}"
            ],
            [
              "",
              "./+FILES"
            ],
            [
              "",
              "./+FILES"
            ],
            [
              "",
              "{TEST}"
            ],
            [
              "",
              "./+SHELL"
            ],
            [
              "",
              "./+SHELL"
            ],
            [
              "",
              "{TEST}"
            ],
            [
              "",
              "./+SHELL"
            ],
            [
              "",
              "./+SHELL"
            ],
            [
              "",
              "{TEST}"
            ],
            [
              "",
              "./+INFO_FILES"
            ],
            [
              "",
              "./+INFO_FILES"
            ],
            [
              "",
              "{TEST}"
            ],
            [
              "",
              "./+OCAML_FINDLIB_REGISTER"
            ],
            [
              "",
              "./+OCAML_FINDLIB_REGISTER"
            ],
            [
              "",
              "/usr/pkg/bin/mktexlsr"
            ],
            [
              "",
              "/usr/pkg/bin/mktexlsr"
            ],
            [
              "",
              "exit"
            ],
            [
              "",
              "exit"
            ]
          ],
          "tgt": [
            "${PWD_CMD}",
            "${SH}",
            "${TEST}",
            "./+DIRS",
            "./+FILES",
            "./+FONTS",
            "./+ICON_THEMES",
            "./+INFO_FILES",
            "./+OCAML_FINDLIB_REGISTER",
            "./+PERMS",
            "./+SHELL",
            "./+SHLIBS",
            "./+USERGROUP",
            "/usr/pkg/bin/mktexlsr",
            ":",
            "exit",
            "shift"
          ],
          "metrics": {
            "ast": {
              "max_depth": 9.0,
              "bind_count": 55.0,
              "call_count": 43.0,
              "node_count": 882.0,
              "identifier_count": 84.0,
              "string_literal_count": 53.0
            },
            "file": {
              "size": 3623.0,
              "entropy": 5.73,
              "size_bytes": 3623.0
            },
            "text": {
              "tab_count": 96.0,
              "digit_ratio": 0.04,
              "space_count": 283.0,
              "total_lines": 177.0,
              "char_entropy": 5.73,
              "mixed_indent": 1.0,
              "unique_chars": 84.0,
              "string_density": 0.3,
              "avg_line_length": 19.47,
              "max_line_length": 73.0,
              "empty_line_ratio": 0.1,
              "last_line_length": 6.0,
              "whitespace_ratio": 0.15,
              "most_common_ratio": 0.04,
              "identifier_density": 1.36,
              "line_length_stddev": 16.64,
              "normalized_string_count": 3.98,
              "suspicious_string_ratio": 0.02,
              "most_common_char_is_null": 0.0,
              "suspicious_comment_ratio": 0.1,
              "max_inline_whitespace_run": 1.0,
              "most_common_char_codepoint": 47.0,
              "normalized_unique_identifiers": 11.65
            },
            "binds": {
              "count": 55.0
            },
            "calls": {
              "count": 43.0,
              "dynamic_target_count": 19.0
            },
            "binary": {
              "overall_entropy": 5.73,
              "peak_region_bytes": 3623.0,
              "peak_region_entropy": 5.71
            },
            "strings": {
              "total": 53.0,
              "avg_length": 10.74,
              "max_length": 40.0,
              "path_count": 39.0,
              "avg_entropy": 2.86,
              "empty_count": 2.0,
              "total_bytes": 569.0,
              "entropy_stddev": 0.67,
              "shell_command_strings": 1.0
            },
            "comments": {
              "chars": 762.0,
              "lines": 18.0,
              "total": 42.0,
              "to_code_ratio": 0.11,
              "empty_comments": 24.0,
              "high_entropy_comments": 4.0
            },
            "identifiers": {
              "count": 84.0,
              "total": 241.0,
              "avg_length": 6.68,
              "max_length": 25.0,
              "min_length": 1.0,
              "avg_entropy": 2.24,
              "reuse_ratio": 0.36,
              "unique_count": 87.0,
              "length_stddev": 4.98,
              "has_digit_ratio": 0.06,
              "single_char_count": 5.0,
              "single_char_ratio": 0.06,
              "high_entropy_count": 7.0,
              "high_entropy_ratio": 0.08,
              "all_lowercase_ratio": 0.03,
              "all_uppercase_ratio": 0.68,
              "numeric_suffix_count": 1.0,
              "underscore_prefix_count": 1.0
            }
          }
        },
        "id": 2,
        "mol": "O(Er)H(Po₂)",
        "path": "/data/samples/good/foraged/netbsd/netbsd.org/_/tex-multitoc-2.02/tex-multitoc-2.02.tgz!!+INSTALL",
        "risk": 4,
        "sha": "0443ec5b54bc985f279cbba9b5413b2e8664b9d98fa50871ef2c54875c40fc40",
        "size": 3623,
        "traits": [
          {
            "id": "micro-behaviors/os/env/vars/access::env-cmd",
            "atk": "T1082",
            "conf": 0.6000000238418579,
            "crit": 3,
            "desc": "env command path",
            "spans": [
              [
                724,
                12
              ]
            ]
          },
          {
            "id": "micro-behaviors/process/create/shell/spawn::bin-sh",
            "atk": "T1059.004",
            "mbc": "E1059.004",
            "conf": 0.6000000238418579,
            "crit": 3,
            "desc": "References /bin/sh (Bourne shell)",
            "spans": [
              [
                742,
                7
              ]
            ]
          },
          {
            "id": "objectives/evasion/masquerade/extension/shebang::bash-shebang-first-line",
            "atk": "T1036.008",
            "mbc": "F0008",
            "conf": 0.949999988079071,
            "crit": 3,
            "desc": "File starts with",
            "spans": [
              [
                0,
                9
              ]
            ]
          },
          {
            "id": "micro-behaviors/process/interpreter/perl::perl-keyword",
            "conf": 0.699999988079071,
            "crit": 3,
            "desc": "perl interpreter keyword (beyond shebang)",
            "spans": [
              [
                578,
                4
              ]
            ]
          },
          {
            "id": "micro-behaviors/process/create/shell/spawn::sh-dynamic-command-target",
            "conf": 0.6000000238418579,
            "crit": 3,
            "desc": "Shell command name from variable",
            "spans": [
              [
                0,
                34
              ]
            ]
          },
          {
            "id": "micro-behaviors/process/create/shell/spawn::shell-symbols",
            "conf": 0.8999999761581421,
            "crit": 3,
            "desc": "Shell execution symbols",
            "spans": [
              [
                0,
                34
              ],
              [
                742,
                7
              ]
            ]
          }
        ],
        "type": "shell"
      },
      {
        "depth": 1,
        "facts": {
          "metrics": {
            "ast": {
              "max_depth": 5.0,
              "call_count": 0.0,
              "node_count": 14.0,
              "identifier_count": 8.0
            },
            "file": {
              "size": 235.0,
              "entropy": 4.46,
              "size_bytes": 235.0
            },
            "text": {
              "space_count": 29.0,
              "total_lines": 7.0,
              "char_entropy": 4.46,
              "unique_chars": 31.0,
              "avg_line_length": 32.57,
              "max_line_length": 61.0,
              "empty_line_ratio": 0.14,
              "last_line_length": 29.0,
              "whitespace_ratio": 0.15,
              "most_common_ratio": 0.09,
              "identifier_density": 1.14,
              "line_length_stddev": 25.64,
              "most_common_char_is_null": 0.0,
              "max_inline_whitespace_run": 1.0,
              "most_common_char_codepoint": 101.0,
              "normalized_unique_identifiers": 2.85
            },
            "binary": {
              "overall_entropy": 4.46,
              "peak_region_bytes": 235.0,
              "peak_region_entropy": 4.46
            },
            "comments": {
              "chars": 21.0,
              "lines": 1.0,
              "total": 1.0,
              "to_code_ratio": 0.17
            },
            "identifiers": {
              "count": 8.0,
              "total": 8.0,
              "avg_length": 5.63,
              "max_length": 13.0,
              "min_length": 2.0,
              "avg_entropy": 2.01,
              "reuse_ratio": 1.0,
              "unique_count": 8.0,
              "length_stddev": 3.39,
              "all_lowercase_ratio": 0.88
            }
          }
        },
        "id": 3,
        "path": "/data/samples/good/foraged/netbsd/netbsd.org/_/tex-multitoc-2.02/tex-multitoc-2.02.tgz!!+DESC",
        "sha": "7e5ecc3667e8d07250785834be83a6fcfb67567d777aeb9f95d10b719e2f43bd",
        "size": 235,
        "type": "kotlin"
      }
    ],
    "rev": "46112",
    "v": "8"
  }
}