{ "ml": { "v": "7", "eng": "2.2.0-beta.1", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.000016411146, "rte": "az", "prob": 0.000016411146 }, { "cls": 0, "raw": 0.00035196543, "rte": "az/tar", "prob": 0.00035196543 } ], "prob": 0.000025014082, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.00002501408198440913, "type": "tar.gz" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.00002501408198440913, "type": "shell" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.000016083320588222705, "type": "shell" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.000012507040992204566, "type": "text" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.000011901061043317895, "type": "text" }, { "id": 5, "lvl": -1, "conf": 0, "prob": 0.000010768572792585474, "type": "text" }, { "id": 6, "lvl": -1, "conf": 0, "prob": 0.000010768572792585474, "type": "text" }, { "id": 7, "lvl": -1, "conf": 0, "prob": 0.000011662642464216333, "type": "text" }, { "id": 8, "lvl": -1, "conf": 0, "prob": 0.000011573235497053247, "type": "src_info" } ], "version": "v18.18", "analyzed_at": "2026-06-25T03:23:18Z" }, "path": "aic8800d80-pcie-dkms-6.4.3.0-4.src.tar.gz", "raw": { "files": [ { "id": 0, "ctx": [ { "b": "abZy80000000zNIyJFmsVI=oK3zZxLK%Om#kKva4J{STli^cLPxZUImi3nJ198\u0026U9qKldg", "n": [ { "c": 2, "d": "Archive parser reported errors", "i": "metadata/file/metrics::archive-parse-error", "o": 0, "z": 24, "cf": 0.8999999761581421 } ], "ln": 0 } ], "mol": "O(Er)H(F)", "sha": "90293f929ba0b7c679178a7fe60b17f5e39873468d20aaafae59bd16874f0ffe", "path": "/data/samples/unknown/foraged/arch/archlinux.org/aur.archlinux.org/aic8800d80-pcie-dkms/aic8800d80-pcie-dkms-6.4.3.0-4.src.tar.gz", "risk": 2, "size": 69196, "type": "tar.gz", "facts": { "metrics": { "file": { "size": 69196.0, "entropy": 8.0, "size_bytes": 69196.0 }, "parse": { "error_count": 1.0 }, "binary": { "overall_entropy": 8.0, "peak_region_bytes": 69196.0, "peak_region_entropy": 7.84 } } }, "traits": [ { "id": "micro-behaviors/fs/directory/traverse::find-type-file", "atk": "T1083", "mbc": "E1083", "conf": 0.8199999928474426, "crit": 3, "desc": "find enumerates regular files", "from": [ { "file": 2 } ] }, { "id": "objectives/evasion/masquerade/extension/shebang::bash-shebang-first-line", "atk": "T1036.008", "mbc": "F0008", "conf": 0.949999988079071, "crit": 3, "desc": "File starts with" } ] }, { "ctx": [ { "b": "boXZHx(kOBxA", "n": [ { "c": 3, "d": "File starts with", "i": "objectives/evasion/masquerade/extension/shebang::bash-shebang-first-line", "o": 0, "z": 9, "cf": 0.949999988079071 } ], "ln": 1, "addr": 0 }, { "b": "", "ln": 2, "addr": 10 }, { "b": "v{%B\u0026ar\u00266=a%pPq", "ln": 3, "addr": 11 }, { "b": "arUSzwHN", "ln": 4, "addr": 24 }, { "b": "arR^HflItRfjFTkfkUSrAb](awGSNBayO$]i5\u0026PCl]V(cw[k}9au?C?wP/.AB.\u003e\u003epgcN3taBFLVBAhIn", "n": [ { "c": 2, "d": "Combined stdout+stderr redirect to /dev/null", "i": "micro-behaviors/os/console/io::null-redirect-stdout-stderr", "o": 72, "z": 15, "cf": 0.800000011920929 } ], "ln": 5, "addr": 31 }, { "b": "arR^Hj39", "ln": 6, "addr": 96 }, { "b": "arUSwB95\u0026", "ln": 7, "addr": 103 } ], "depth": 1, "facts": { "imp": [ [ "", "/usr/bin/modprobe" ], [ "", "/usr/bin/modprobe" ], [ "", "true" ], [ "", "true" ], [ "", "/usr/bin/modprobe" ], [ "", "/usr/bin/modprobe" ], [ "", "true" ], [ "", "true" ] ], "tgt": [ "/usr/bin/modprobe", "true" ], "metrics": { "ast": { "max_depth": 7.0, "call_count": 4.0, "node_count": 55.0, "identifier_count": 8.0, "string_literal_count": 1.0 }, "file": { "size": 185.0, "entropy": 4.69, "size_bytes": 185.0 }, "text": { "digit_ratio": 0.16, "space_count": 33.0, "total_lines": 10.0, "char_entropy": 4.69, "unique_chars": 37.0, "string_density": 0.1, "avg_line_length": 17.5, "max_line_length": 64.0, "empty_line_ratio": 0.1, "last_line_length": 4.0, "whitespace_ratio": 0.23, "most_common_ratio": 0.06, "identifier_density": 1.6, "line_length_stddev": 22.7, "normalized_string_count": 0.32, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 1.0, "most_common_char_codepoint": 47.0, "normalized_unique_identifiers": 2.41 }, "calls": { "count": 4.0 }, "binary": { "overall_entropy": 4.69, "peak_region_bytes": 185.0, "peak_region_entropy": 4.69 }, "strings": { "total": 1.0, "avg_length": 2.0, "max_length": 2.0, "avg_entropy": 1.0, "total_bytes": 2.0 }, "comments": { "chars": 8.0, "lines": 1.0, "total": 1.0, "to_code_ratio": 0.11 }, "identifiers": { "count": 8.0, "total": 16.0, "avg_length": 6.88, "max_length": 17.0, "min_length": 1.0, "avg_entropy": 2.0, "reuse_ratio": 0.5, "unique_count": 8.0, "length_stddev": 5.73, "has_digit_ratio": 0.25, "single_char_count": 1.0, "single_char_ratio": 0.13, "all_lowercase_ratio": 0.38 } } }, "id": 1, "mol": "O(Er)", "path": "/data/samples/unknown/foraged/arch/archlinux.org/aur.archlinux.org/aic8800d80-pcie-dkms/aic8800d80-pcie-dkms-6.4.3.0-4.src.tar.gz!!aic8800d80-pcie-dkms/aic8800d80-sleep-hook", "risk": 1, "sha": "1d34e929c3570cfae9aea2b79d3e143ca89c41ad165457e10c143c2bb74489da", "size": 185, "traits": [ { "id": "objectives/evasion/masquerade/extension/shebang::bash-shebang-first-line", "atk": "T1036.008", "mbc": "F0008", "conf": 0.949999988079071, "crit": 3, "desc": "File starts with", "spans": [ [ 0, 9 ] ] } ], "type": "shell" }, { "ctx": [ { "b": "boPY?x(n33x(mH5iV}agByx8goM.Euy\u0026%MdByx8xixo2-xkI6\u003ey+xjoz9v", "n": [ { "c": 2, "d": "Arch PKGBUILD package recipe basename", "i": "metadata/file/string/identity::pkgbuild-basename", "o": 0, "z": 8, "cf": 1.0 } ], "ln": 1, "addr": 0 }, { "b": "boPD@z/3RsxLzJgwnc6}v@#TfC@^6+vqxB[yIa+wB7L", "ln": 2, "addr": 47 }, { "b": "boPx{x)a6das!NDx(X6mvrb{4v@Di}azbUjz6i}lwGVeczE^WaaBm:vasIbCBrCTDz/PA1azCZoxk8Dpj0mjhzGQgDhzcZud\u003ceCrCX7}svrb{4vq{g4x\u003ep/$C4\u003ewcAa9\u0026#xF6", "ln": 3, "addr": 82 }, { "b": "Abf8%wPIuAb1b6#qY]{}wozZ1B0b7kAV^UtlPv4VfHN(Oaw+A%wGU5*eK\u003cB%vqYP#v@Dj6vqY^$zxI}TllFQhB.bVkz//UnvpS!=By/GlasHl5A+e*1avw\u003c-h8(Z!zE:(hx(dN2vr9!v", "ln": 9, "addr": 244 }, { "b": "vrb\u003c\u003ejT.X5i5Ub4g::Z", "ln": 10, "addr": 357 }, { "b": "B-IpYb4#7uAc15[fl.R:e[5E7B7Gi5e[n*pfcQ", "n": [ { "c": 2, "d": "HTTPS protocol prefix", "i": "micro-behaviors/communications/http/message::https-prefix", "o": 378, "z": 8, "cf": 0.8999999761581421 } ], "ln": 11, "addr": 373 }, { "b": "y?Wx\u003czGxwLc)}IYoF51LfFdi-eO[\u003cqwPxdE", "n": [ { "c": 2, "d": "GPL license reference", "i": "metadata/package/license::gpl-word", "o": 414, "z": 3, "cf": 0.699999988079071 } ], "ln": 12, "addr": 404 }, { "b": "wmYZ\u003ezE^/Kc)@Lvzf46N", "ln": 13, "addr": 433 }, { "b": "v@Dl%y?Wy3B3g{0vqfjhi503%i4#{{yI!budf", "ln": 14, "addr": 450 }, { "b": "", "ln": 18, "addr": 649 }, { "b": "B8Mhwv}v!K", "ln": 19, "addr": 650 }, { "b": "arR\u003edm]z=ApaX?ciw\u0026=Fh-iGFhd63\u003ezGQhhl#)0+wNwE)e?!]7x(D9]xMOunB2\u003e%cwn=Wfy\u0026r-)e]kVDx\u003c\u003e)iv@r}PfFUKrwo8ycwIm4NqBK2HeKJk)h8)fDh8WfDuRCfKB:dmYA+PYduSF)lfFmV=A3t", "n": [ { "c": 2, "d": "Linux platform string", "i": "micro-behaviors/os/sysinfo/platform/string::os-string-linux", "o": 662, "z": 118, "cf": 0.6000000238418579 } ], "ln": 20, "addr": 659 }, { "b": "arR\u003cZfFCjky?W^fCR7*af/7z2y\u0026%!Jv@Dj6vrsbvvru0)a]", "ln": 21, "addr": 782 }, { "b": "arR\u003cZfFCmlwQ5fjA=-)Lv}^Jiz!9o)x\u003c(6nAa9\u0026#xD^", "ln": 22, "addr": 820 }, { "b": "Ab]Jevrb{cdiJ%", "ln": 44, "addr": 1746 }, { "b": "31v%^ByxhjeKHT8bY!0ownc6dat4?Iar\u00267LA:@S]AXyA.qBK2HeKJk)h8)fDh8WfDuRCfKB:dmYA+PYduSF)lfFmV=A3t", "n": [ { "c": 2, "d": "Linux platform string", "i": "micro-behaviors/os/sysinfo/platform/string::os-string-linux", "o": 1784, "z": 47, "cf": 0.6000000238418579 } ], "ln": 45, "addr": 1758 }, { "b": "31v%^ByxhjeKHT8bY!0ownc6dat4?Iar\u00267LA:@S]AXya2zGQgSvqfjhi503[y?W^fCWC04C4\u003eJde{.kJa]", "n": [ { "c": 2, "d": "Linux platform string", "i": "micro-behaviors/os/sysinfo/platform/string::os-string-linux", "o": 1859, "z": 38, "cf": 0.6000000238418579 } ], "ln": 46, "addr": 1833 }, { "b": "2)\u003e6UjTqB+vrl0$vqPM#a%Z+Adf", "ln": 65, "addr": 2771 }, { "b": "2)\u003e9IB7DErbW$TnazCY", "ln": 66, "addr": 2793 }, { "b": "2)*[/e]Ma!e]bxMdLtNRwpb\u003cVzeS@qv%/:Uv@k+7dLtTWx\u003eI/ye]\u003eJrD#i!jB.\u003eSge]L=vwPAe)z!a0bwIe4HzfxGhB9}Ctx(4rjy\u0026r@nay/tcBzkSnwGT5@", "n": [ { "c": 1, "d": ".cmd extension", "i": "metadata/file/extension/identity::cmd-ext", "o": 2836, "z": 4, "cf": 1.0 } ], "ln": 67, "addr": 2809 }, { "b": "2)\u003ef:vpG", "ln": 68, "addr": 2906 }, { "b": "2)\u003er-B97\u0026by-\u003eq$z8Kjcar\u00267ya%n6PDTyr8BBt!/DTZ(va]", "ln": 69, "addr": 2913 }, { "b": "31N%(wGT8TjsB/QzE:\u003elbZS)eA=#\u003cPat4CsCW$x8Bz8^Kat4XXAaHe7at4LMx(n2Ddf", "n": [ { "c": 3, "d": "Recursive directory traversal logic", "i": "micro-behaviors/fs/directory/traverse::recursive-directory-traversal", "o": 2961, "z": 34, "cf": 0.8600000143051147 } ], "ln": 70, "addr": 2951 }, { "b": "", "ln": 71, "addr": 3005 }, { "b": "32ao#Byx04at4bvh-iDna%.Ixwoh\u003cvfjwN8uT!b1B7cr", "ln": 72, "addr": 3006 } ], "depth": 1, "facts": { "imp": [ [ "", "bsdtar" ], [ "", "bsdtar" ], [ "", "bsdtar" ], [ "", "bsdtar" ], [ "", "bsdtar" ], [ "", "bsdtar" ], [ "", "sed" ], [ "", "sed" ], [ "", "patch" ], [ "", "patch" ], [ "", "patch" ], [ "", "patch" ], [ "", "patch" ], [ "", "patch" ], [ "", "patch" ], [ "", "patch" ], [ "", "patch" ], [ "", "patch" ], [ "", "install" ], [ "", "install" ], [ "", "read" ], [ "", "basename" ], [ "", "basename" ], [ "", "continue" ], [ "", "continue" ], [ "", "install" ], [ "", "install" ], [ "", "find" ], [ "", "find" ], [ "", "install" ], [ "", "install" ], [ "", "read" ], [ "", "continue" ], [ "", "continue" ], [ "", "install" ], [ "", "install" ], [ "", "find" ], [ "", "find" ], [ "", "sed" ], [ "", "sed" ], [ "", "chmod" ], [ "", "chmod" ], [ "", "install" ], [ "", "install" ], [ "", "install" ], [ "", "install" ], [ "", "install" ], [ "", "install" ], [ "", "install" ], [ "", "install" ], [ "", "install" ], [ "", "install" ], [ "", "install" ], [ "", "install" ], [ "", "install" ], [ "", "install" ], [ "", "install" ], [ "", "install" ] ], "tgt": [ "basename", "bsdtar", "chmod", "continue", "find", "install", "patch", "read", "sed" ], "metrics": { "ast": { "max_depth": 11.0, "bind_count": 18.0, "call_count": 30.0, "node_count": 800.0, "identifier_count": 57.0, "string_literal_count": 80.0, "array_literal_max_length": 10.0 }, "file": { "size": 4154.0, "entropy": 5.54, "size_bytes": 4154.0 }, "text": { "tab_count": 67.0, "digit_ratio": 0.23, "space_count": 229.0, "total_lines": 101.0, "char_entropy": 5.54, "mixed_indent": 1.0, "unique_chars": 84.0, "string_density": 0.79, "avg_line_length": 40.13, "max_line_length": 122.0, "empty_line_ratio": 0.12, "last_line_length": 1.0, "long_token_count": 1.0, "whitespace_ratio": 0.1, "most_common_ratio": 0.05, "identifier_density": 2.03, "line_length_stddev": 31.52, "encoded_string_ratio": 0.13, "normalized_string_count": 7.96, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 1.0, "most_common_char_codepoint": 105.0, "suspicious_identifier_ratio": 0.02, "normalized_unique_identifiers": 8.56 }, "binds": { "count": 18.0 }, "calls": { "count": 30.0 }, "binary": { "overall_entropy": 5.54, "peak_region_bytes": 4096.0, "peak_region_entropy": 5.42 }, "source": { "function_count": 2.0 }, "strings": { "total": 80.0, "url_count": 1.0, "avg_length": 31.78, "max_length": 118.0, "avg_entropy": 3.62, "empty_count": 2.0, "hex_strings": 10.0, "total_bytes": 2542.0, "entropy_stddev": 0.87, "high_entropy_count": 1.0 }, "comments": { "chars": 280.0, "lines": 4.0, "total": 4.0, "to_code_ratio": 0.04 }, "functions": { "count": 2.0, "avg_params": 13.0, "max_params": 17.0, "length_stddev": 17.5, "avg_name_length": 7.0, "avg_length_lines": 28.5, "max_length_lines": 46.0, "min_length_lines": 11.0, "many_params_count": 2.0, "avg_param_name_length": 44.65, "density_per_100_lines": 1.98, "code_in_functions_ratio": 0.56 }, "identifiers": { "count": 57.0, "total": 205.0, "avg_length": 5.4, "max_length": 20.0, "min_length": 1.0, "avg_entropy": 2.09, "reuse_ratio": 0.28, "unique_count": 57.0, "length_stddev": 2.99, "has_digit_ratio": 0.14, "sequential_names": 1.0, "single_char_count": 2.0, "single_char_ratio": 0.04, "all_lowercase_ratio": 0.54, "all_uppercase_ratio": 0.02, "numeric_suffix_count": 5.0, "underscore_prefix_count": 4.0 } } }, "id": 2, "mol": "H(F)", "path": "/data/samples/unknown/foraged/arch/archlinux.org/aur.archlinux.org/aic8800d80-pcie-dkms/aic8800d80-pcie-dkms-6.4.3.0-4.src.tar.gz!!aic8800d80-pcie-dkms/PKGBUILD", "risk": 1, "sha": "382e1fd457fb3ffdbae6b14fa6581d6d30c627bcd61cf3ad4a1530121dd900a1", "size": 4154, "traits": [ { "id": "micro-behaviors/fs/directory/traverse::find-type-file", "atk": "T1083", "mbc": "E1083", "conf": 0.8199999928474426, "crit": 3, "desc": "find enumerates regular files", "spans": [ [ 2961, 34 ] ] } ], "type": "shell" }, { "ctx": [ { "b": "d*VH*k$KBBmNPNkc})Abr8M1HmjYM9pc?\u0026mh98\u003cKzGxxfBrBdKefE\u003eSjTz^wCQ%$9k%lIFicXXCa$K\u003cJAa**!B75P\u0026AX5tEAa**!wmo1VAW:6", "ln": 108, "addr": 5281 }, { "b": "apetXuTEXVBttZXxjU%(A::63uUKF5g*+ciBA.UzyHpHXwo68owPScmA+^%Kwo6jzctvBjeK1k:wmPZfi@", "ln": 109, "addr": 5369 }, { "b": "apetXfdF8+wN/U0wft@iB-H#6aw2xLvpS[?wPI]nvqYP#efG1LB-H#6az\u003eK%ayO!\u003eA+frkazC.nzY\u0026O1asY2", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 5467, "z": 3, "cf": 0.800000011920929 } ], "ln": 110, "addr": 5435 }, { "b": "apetXuTEXVBttZXwmw[-wPScmA+/2@zGxxfBsqrDw?k6CyHO\u003eVwmoN*as!N6r7HvZoHRYcaz$+jCw?Iql1BIDdlv", "ln": 111, "addr": 5503 }, { "b": "kTlCzh-JGxhY%Rfi4#)xav5f", "ln": 112, "addr": 5574 }, { "b": "kTlCzgbgKAehn[5d(5?miv()uav5f", "ln": 2162, "addr": 85594 }, { "b": "ao", "ln": 2163, "addr": 85618 }, { "b": "apimaw[+Q[B-RIkzE^9(z!9A4jS[Y:z!0c\u003eyH?d1c)A\u003eHw[+Q[B-RIkzE:}xawL{goES4", "n": [ { "c": 3, "d": "Create temp staging directory via shell", "i": "micro-behaviors/fs/directory/mkdir::temp-mkdir-command", "o": 85647, "z": 5, "cf": 0.75 } ], "ln": 2164, "addr": 85620 }, { "b": "aph:]asICFw[+Q[B-RIkzE^9(z!9A4jV%].rzl7naBs", "ln": 2165, "addr": 85676 }, { "b": "eEq-5A+PAkyByxbzEE0\u003cwGV8kay/C6vru66fk$@Iv\u003eS4uw[+Q[B-RIkzE:(2x(W={Bz(hBa$kO", "ln": 2166, "addr": 85711 }, { "b": "arR^HarR^HarR^HarR^HaBK", "ln": 2977, "addr": 119587 }, { "b": "arR^HarR^HarR^HayYw5vqv}", "ln": 2978, "addr": 119606 }, { "b": "arR^HarR^HarR^Hay!\u00263wGS\u0026\u003eatkw\u003clR6^BuSoD*p*VZYr9@J(q2", "n": [ { "c": 1, "d": "Regex component marker", "i": "micro-behaviors/fs/directory/mkdir::temp-mkdir-command--rx-3", "o": 119655, "z": 4, "cf": 0.75 } ], "ln": 2979, "addr": 119626 }, { "b": "arR^HarR^HarR^HarR^HazCBgc#@)var-(\u003cf!1k(", "ln": 2980, "addr": 119668 }, { "b": "eG=eUarR^HarR^HarR^HarR^HaAhvnzGGUxb5*$hvqNb#A=M8sar-(\u003cf\u003cFPudlv", "ln": 2981, "addr": 119701 }, { "b": "apetX2)\u003erTasIbsCxmLeau.\u003egpe%$YdiJ%", "ln": 6740, "addr": 304496 }, { "b": "apetX2)*[\u003edJ\u0026XJx)86(wQ5r7B97\u0026jB1RMVuU1g}Ac0JWj0l1a", "ln": 6741, "addr": 304524 }, { "b": "eEqZ\u00262)*]SA+PAkyByxasrH1fpF:7{B8bk(v@Dsiazb4@y:053a$kO", "n": [ { "c": 2, "d": "Benign application or testing context", "i": "well-known/tool/detection/security-scanner::multi-app-stealer-benign-context", "o": 304583, "z": 4, "cf": 0.8999999761581421 } ], "ln": 6742, "addr": 304565 }, { "b": "d*VH*2)*]7nKDMGl{:x(oIXeEqC{p*efDcosrH1fpF:7{B8bk(v@Dsiazb4@y:053a$kO", "ln": 6743, "addr": 304609 }, { "b": "apetX2)*[\u003edJ\u0026wxBz\u0026pyBz(b9Ab](bj0l1a", "ln": 6744, "addr": 304665 }, { "b": "apetXfdF8-A+PXGk4O$XuVQr$BAo6RCWC04z/x+Fd)1\u003e6f8", "ln": 6777, "addr": 305679 }, { "b": "eEqZ\u0026Ab]VgBzAoGr9gnhqCQaIaA.NzA:-\u003cbw]zZbwN(]}A:-/@ax7M!b}}8Rb}}8Rb}}8Rb}}8Rb}}8Rb}}8RaZw[eec", "n": [ { "c": 1, "d": "Defensive dangerous query-keyword denylist", "i": "well-known/tool/detection/security-scanner::dangerous-query-keyword-denylist", "o": 305717, "z": 4, "cf": 0.9200000166893005 } ], "ln": 6778, "addr": 305717 }, { "b": "d*VH*k$KBBmNPNkc})Abr8M1HmjYM9r9gnhqCQaIaA.NzA:-\u003cbw]zZbwN(]}A:-/@ax7M!b}}8Rb}}8Rb}}8Rb}}8Rb}}8Rb}}8RaZw[eec", "ln": 6779, "addr": 305791 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 323358.0, "entropy": 5.66, "size_bytes": 323358.0 }, "binary": { "overall_entropy": 5.66, "peak_region_bytes": 189214.0, "peak_region_entropy": 5.8 } } }, "id": 3, "path": "/data/samples/unknown/foraged/arch/archlinux.org/aur.archlinux.org/aic8800d80-pcie-dkms/aic8800d80-pcie-dkms-6.4.3.0-4.src.tar.gz!!aic8800d80-pcie-dkms/0003-normalize-driver-logging.patch", "risk": 1, "sha": "60744f321ef8f069e10efeb579a20a6114aeefa5796c0da2d9e0e0c91965ff8e", "size": 323358, "traits": [ { "id": "metadata/file/profile/language::lang-english", "conf": 0.800000011920929, "crit": 2, "desc": "English language detection", "spans": [ [ 5467, 3 ] ] }, { "id": "objectives/impact/infect/binary/dos::dos-asm-file-helper-labels", "atk": "T1204", "conf": 0.8600000143051147, "crit": 1, "desc": "DOS file helper labels", "spans": [ [ 114950, 10 ] ] }, { "id": "well-known/tool/detection/security-scanner::dangerous-query-keyword-denylist", "conf": 0.9200000166893005, "crit": 1, "desc": "Defensive dangerous query-keyword denylist", "spans": [ [ 304583, 4 ], [ 305717, 4 ] ] } ], "type": "text" }, { "depth": 1, "facts": { "metrics": { "file": { "size": 7797.0, "entropy": 5.57, "size_bytes": 7797.0 }, "binary": { "overall_entropy": 5.57, "peak_region_bytes": 7797.0, "peak_region_entropy": 5.62 } } }, "id": 4, "path": "/data/samples/unknown/foraged/arch/archlinux.org/aur.archlinux.org/aic8800d80-pcie-dkms/aic8800d80-pcie-dkms-6.4.3.0-4.src.tar.gz!!aic8800d80-pcie-dkms/0005-linux-7.1-compat.patch", "sha": "b78fb00a2afab38213fd705d6500c3a9dd6456fd394c548829d831f28392f88f", "size": 7797, "type": "text" }, { "ctx": [ { "b": "wnbT/at2fTx(\u003eFafjwN8uT!b1B7c!hx\u003e7HVBAIUle[=wpfjwN8uT!b1B7c!hx\u003e7HVBAIUle[+PazE^s6atNK*gbHZ@e?QZCf\u003c#!Cg:1IbfG7:A3n0?YayM{ix\u003e7HVBAIUlfjwN8uT!b1B7c+n3m^RSayW0jx\u003e7HVBAIUlfjwN8uT!b1B7c+n3p3\u003c0eI/spiuP?dh.l%ikTkV03lPV#bwy+2wO95LpFKwJm{/7^k#ZrHqCyH#lrc=Wrsgr5wmYv!zE\u003c}TpFKwJm{!OR", "ln": 0, "col": 1, "line": 1 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 465, "entropy": 5.08 }, "binary": { "peak_region_bytes": 465, "peak_region_entropy": 5.08 } } }, "id": 5, "mol": "Md", "path": "/data/samples/unknown/foraged/arch/archlinux.org/aur.archlinux.org/aic8800d80-pcie-dkms/aic8800d80-pcie-dkms-6.4.3.0-4.src.tar.gz!!aic8800d80-pcie-dkms/0004-aic-btusb-bluez.patch", "pid": 0, "risk": 1, "sha": "cf5532c0254f9f0f6ce80b6f0eda15f3103cebfdb6af500c9d38cd04cda0295b", "size": 465, "traits": [ { "id": "metadata/file/format/markup::unified-diff-header", "conf": 0.98, "crit": 1, "desc": "Git unified diff header", "spans": [ [ 0, 0 ] ] }, { "id": "metadata/file/format/markup::unified-diff-index", "conf": 0.98, "crit": 1, "desc": "Git unified diff index line", "spans": [ [ 59, 0 ] ] }, { "id": "metadata/file/format/markup::unified-diff", "conf": 0.98, "crit": 3, "desc": "Git unified diff text format", "spans": [ [ 0, 58 ], [ 59, 29 ] ] } ], "type": "text" }, { "id": 6, "sha": "98699379ab9b302c0e5059d6a16e1598ad3ace7cfb15570c988c994c12a0333f", "path": "/data/samples/unknown/foraged/arch/archlinux.org/aur.archlinux.org/aic8800d80-pcie-dkms/aic8800d80-pcie-dkms-6.4.3.0-4.src.tar.gz!!aic8800d80-pcie-dkms/0002-export-pci-modalias.patch", "size": 543, "type": "text", "depth": 1 }, { "id": 7, "sha": "6e8562dcb93f114bdbf759506967f9504ffc5fc9043b94b616449ba43d1d34ef", "path": "/data/samples/unknown/foraged/arch/archlinux.org/aur.archlinux.org/aic8800d80-pcie-dkms/aic8800d80-pcie-dkms-6.4.3.0-4.src.tar.gz!!aic8800d80-pcie-dkms/0001-linux-6.13-plus-compat.patch", "size": 14052, "type": "text", "depth": 1 }, { "id": 8, "sha": "0d8b89948d2c8c8d04eb75f93f4d75d39c426309224fa06487f7dfb1d74378c5", "path": "/data/samples/unknown/foraged/arch/archlinux.org/aur.archlinux.org/aic8800d80-pcie-dkms/aic8800d80-pcie-dkms-6.4.3.0-4.src.tar.gz!!aic8800d80-pcie-dkms/.SRCINFO", "size": 1624, "type": "src_info", "depth": 1 } ], "omitted_files": 3, "rev": "d6380", "v": "8" } }