{
  "ml": {
    "v": "7",
    "eng": "2.2.0-beta.2",
    "lvl": -1,
    "conf": 0,
    "mods": [
      {
        "cls": 0,
        "raw": 0.00037144622,
        "rte": "az",
        "prob": 0.00037144622
      },
      {
        "cls": 0,
        "raw": 0.00071653724,
        "rte": "az/tar",
        "prob": 0.00071653724
      }
    ],
    "prob": 0.00037144622,
    "files": [
      {
        "id": 0,
        "lvl": -1,
        "conf": 0,
        "prob": 0.00037144622183404863,
        "type": "apk_alpine"
      },
      {
        "id": 1,
        "lvl": -1,
        "conf": 0,
        "prob": 0.00011607011401792988,
        "type": "shell"
      },
      {
        "id": 2,
        "lvl": -1,
        "conf": 0,
        "prob": 0.000010838110938493628,
        "type": "text"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-06-26T10:53:49Z"
  },
  "path": "ifupdown-ng-wireguard-0.13.0-r0.apk",
  "raw": {
    "files": [
      {
        "id": 0,
        "ctx": [
          {
            "b": "abZy8000000T3{24[J!\u003enkh=HeH]u63?!Yp^*DIa!jX1m:JNrco?u{f=2H?Deg@xa3GU*X",
            "n": [
              {
                "c": 2,
                "d": "Archive parser reported errors",
                "i": "metadata/file/metrics::archive-parse-error",
                "o": 0,
                "z": 24,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 0
          }
        ],
        "mol": "O(Er)H₂(OsPo)",
        "sha": "908db1861edae0f4df1a4e3d44c7e79e37cf78713d8253f6e28ef5bd87563fc3",
        "path": "/data/samples/unknown/foraged/alpine/alpinelinux.org/_/ifupdown-ng-wireguard/ifupdown-ng-wireguard-0.13.0-r0.apk",
        "risk": 3,
        "size": 1819,
        "type": "apk_alpine",
        "facts": {
          "metrics": {
            "file": {
              "size": 1819.0,
              "entropy": 7.86,
              "size_bytes": 1819.0
            },
            "parse": {
              "error_count": 1.0
            },
            "binary": {
              "overall_entropy": 7.86,
              "peak_region_bytes": 1819.0,
              "peak_region_entropy": 7.74
            }
          }
        },
        "traits": [
          {
            "id": "objectives/evasion/masquerade/extension/shebang::bash-shebang-first-line",
            "atk": "T1036.008",
            "mbc": "F0008",
            "conf": 0.949999988079071,
            "crit": 3,
            "desc": "File starts with",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "micro-behaviors/process/create/shell/spawn::shell-execution-comp",
            "atk": "T1059",
            "mbc": "E1059",
            "conf": 0.8999999761581421,
            "crit": 3,
            "desc": "Shell command execution capability",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "micro-behaviors/process/create/shell/spawn::sh-dynamic-command-target",
            "conf": 0.6000000238418579,
            "crit": 3,
            "desc": "Shell command name from variable",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "micro-behaviors/process/create/shell/spawn::shell-symbols",
            "conf": 0.8999999761581421,
            "crit": 3,
            "desc": "Shell execution symbols",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "metadata/package/files/system-package::alpine-pkginfo-origin-field",
            "conf": 0.8999999761581421,
            "crit": 1,
            "desc": "Alpine/Wolfi package origin field",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "micro-behaviors/os/network/interface::ip-link",
            "conf": 0.8999999761581421,
            "crit": 3,
            "desc": "ip link command",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "metadata/package/files/system-package::alpine-pkginfo-version-field",
            "conf": 0.8999999761581421,
            "crit": 1,
            "desc": "Alpine/Wolfi package version field",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "metadata/package/files/system-package::alpine-pkginfo-package-field",
            "conf": 0.8999999761581421,
            "crit": 1,
            "desc": "Alpine/Wolfi package name field",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "metadata/package/files/system-package::alpine-pkginfo-basename",
            "conf": 0.8999999761581421,
            "crit": 1,
            "desc": "Alpine/Wolfi package info file"
          }
        ]
      },
      {
        "ctx": [
          {
            "b": "boXZHx(kOBxA",
            "n": [
              {
                "c": 3,
                "d": "File starts with",
                "i": "objectives/evasion/masquerade/extension/shebang::bash-shebang-first-line",
                "o": 0,
                "z": 9,
                "cf": 0.949999988079071
              }
            ],
            "ln": 1,
            "addr": 0
          },
          {
            "b": "toCInar\u00267imn=DFq:?(Mt{7EvaAIaoat4*",
            "ln": 2,
            "addr": 10
          },
          {
            "b": "toCIzar\u002675mQGj*qBK8Qk#H9TlR*DDnK)b:k#Zx0ayc9pclL(HuSP/%mmQuzqBB\u003eVpFKwJm{/7Ur7Gd@fj/lnfl.bJwOlc]A+3*GnK=0kmj@7*zE$6",
            "ln": 3,
            "addr": 38
          },
          {
            "b": "v{%B\u0026ar\u00267cni{fya%pPq",
            "ln": 5,
            "addr": 131
          },
          {
            "b": "v@=c?By=)",
            "ln": 6,
            "addr": 148
          },
          {
            "b": "2{:\u003c(pEv^6azC^qy?W^5ayO!\u003eas6JFk%[6-BA}?paA}KuwOlc]A+2",
            "n": [
              {
                "c": 3,
                "d": "ip link command",
                "i": "micro-behaviors/os/network/interface::ip-link",
                "o": 165,
                "z": 11,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 7,
            "addr": 156
          },
          {
            "b": "2%gi",
            "ln": 8,
            "addr": 199
          },
          {
            "b": "Ab]IwB-n=",
            "ln": 9,
            "addr": 203
          },
          {
            "b": "2{:\u003c(pEv^6aA}DvB7GD6z/fefbUpD\u003elQ-aynK^5*nM4#Ery6IJuQEQ:mOc9Sp^F5K",
            "ln": 10,
            "addr": 211
          },
          {
            "b": "2%gi",
            "ln": 11,
            "addr": 264
          },
          {
            "b": "wmY?7A=ljL",
            "n": [
              {
                "c": 1,
                "d": "Destructive-action word: destroy",
                "i": "objectives/impact/destroy/keywords::destroy-verb",
                "o": 268,
                "z": 7,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 12,
            "addr": 268
          },
          {
            "b": "2{:\u003c(pEv^6azC^qy?W^5ay]51wPRGawmY{bbUpD\u003elQZ",
            "n": [
              {
                "c": 1,
                "d": "Destructive-action word: delete",
                "i": "objectives/impact/destroy/keywords::delete-verb--delete",
                "o": 294,
                "z": 6,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 13,
            "addr": 277
          },
          {
            "b": "2%gi",
            "ln": 14,
            "addr": 312
          },
          {
            "b": "wPIo\u0026",
            "ln": 15,
            "addr": 316
          }
        ],
        "depth": 1,
        "facts": {
          "imp": [
            [
              "",
              "set"
            ],
            [
              "",
              "set"
            ],
            [
              "",
              "{MOCK}"
            ],
            [
              "",
              "{MOCK}"
            ],
            [
              "",
              "{MOCK}"
            ]
          ],
          "tgt": [
            "${MOCK}",
            "set"
          ],
          "metrics": {
            "ast": {
              "max_depth": 6.0,
              "bind_count": 1.0,
              "call_count": 4.0,
              "node_count": 106.0,
              "identifier_count": 18.0,
              "string_literal_count": 4.0
            },
            "file": {
              "size": 321.0,
              "entropy": 5.5,
              "size_bytes": 321.0
            },
            "text": {
              "tab_count": 6.0,
              "space_count": 28.0,
              "total_lines": 15.0,
              "char_entropy": 5.5,
              "unique_chars": 62.0,
              "string_density": 0.27,
              "avg_line_length": 20.4,
              "max_line_length": 91.0,
              "empty_line_ratio": 0.07,
              "last_line_length": 4.0,
              "whitespace_ratio": 0.15,
              "most_common_ratio": 0.05,
              "identifier_density": 2.07,
              "line_length_stddev": 24.4,
              "normalized_string_count": 1.03,
              "most_common_char_is_null": 0.0,
              "max_inline_whitespace_run": 1.0,
              "most_common_char_codepoint": 101.0,
              "normalized_unique_identifiers": 4.86
            },
            "binds": {
              "count": 1.0
            },
            "calls": {
              "count": 4.0,
              "dynamic_target_count": 3.0
            },
            "binary": {
              "overall_entropy": 5.5,
              "peak_region_bytes": 321.0,
              "peak_region_entropy": 5.5
            },
            "strings": {
              "total": 4.0,
              "avg_length": 16.25,
              "max_length": 26.0,
              "path_count": 1.0,
              "avg_entropy": 3.39,
              "total_bytes": 65.0,
              "entropy_stddev": 0.74
            },
            "comments": {
              "chars": 8.0,
              "lines": 1.0,
              "total": 1.0,
              "to_code_ratio": 0.07
            },
            "identifiers": {
              "count": 18.0,
              "total": 31.0,
              "avg_length": 5.79,
              "max_length": 24.0,
              "min_length": 2.0,
              "avg_entropy": 2.08,
              "reuse_ratio": 0.61,
              "unique_count": 19.0,
              "length_stddev": 4.73,
              "high_entropy_count": 1.0,
              "high_entropy_ratio": 0.05,
              "all_lowercase_ratio": 0.63,
              "all_uppercase_ratio": 0.26
            }
          }
        },
        "id": 1,
        "mol": "O(Er)H₂(OsPo)",
        "path": "/data/samples/unknown/foraged/alpine/alpinelinux.org/_/ifupdown-ng-wireguard/ifupdown-ng-wireguard-0.13.0-r0.apk!!usr/libexec/ifupdown-ng/wireguard",
        "risk": 3,
        "sha": "5b0f6169bb3d7f6e3ae64339ea8fa8b74c04c7e98ab06689a479f04f1406825b",
        "size": 321,
        "traits": [
          {
            "id": "micro-behaviors/os/network/interface::ip-link",
            "conf": 0.8999999761581421,
            "crit": 3,
            "desc": "ip link command",
            "spans": [
              [
                165,
                11
              ]
            ]
          },
          {
            "id": "micro-behaviors/process/create/shell/spawn::sh-dynamic-command-target",
            "conf": 0.6000000238418579,
            "crit": 3,
            "desc": "Shell command name from variable",
            "spans": [
              [
                0,
                33
              ]
            ]
          },
          {
            "id": "objectives/evasion/masquerade/extension/shebang::bash-shebang-first-line",
            "atk": "T1036.008",
            "mbc": "F0008",
            "conf": 0.949999988079071,
            "crit": 3,
            "desc": "File starts with",
            "spans": [
              [
                0,
                9
              ]
            ]
          },
          {
            "id": "micro-behaviors/process/create/shell/spawn::shell-execution-comp",
            "atk": "T1059",
            "mbc": "E1059",
            "conf": 0.8999999761581421,
            "crit": 3,
            "desc": "Shell command execution capability",
            "spans": [
              [
                0,
                33
              ]
            ]
          },
          {
            "id": "micro-behaviors/process/create/shell/spawn::shell-symbols",
            "conf": 0.8999999761581421,
            "crit": 3,
            "desc": "Shell execution symbols",
            "spans": [
              [
                0,
                33
              ]
            ]
          }
        ],
        "type": "shell"
      },
      {
        "ctx": [
          {
            "b": "boPG/zE)\u0026%By!#9vTf88vS=y3wfrVXf/HZsuVGTiePJJ",
            "n": [
              {
                "c": 1,
                "d": "Alpine/Wolfi package info file",
                "i": "metadata/package/files/system-package::alpine-pkginfo-basename",
                "o": 0,
                "z": 1,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 1,
            "addr": 0
          },
          {
            "b": "boRbIx(mMaw)]E^A=k(raA?spB7]MgatCG8h.D\u0026",
            "ln": 2,
            "addr": 36
          },
          {
            "b": "Abf97vqPM#jS[DJB-p(fCwY0IxdXswA+e)avrb(",
            "n": [
              {
                "c": 2,
                "d": "Alpine/Wolfi package info metadata",
                "i": "metadata/package/files/system-package::alpine-apk-pkginfo",
                "o": 68,
                "z": 31,
                "cf": 0.9700000286102295
              }
            ],
            "ln": 3,
            "addr": 68
          },
          {
            "b": "Abf9fwPw[RattA5gCgvkAXE",
            "n": [
              {
                "c": 1,
                "d": "Alpine/Wolfi package version field",
                "i": "metadata/package/files/system-package::alpine-pkginfo-version-field",
                "o": 100,
                "z": 18,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 4,
            "addr": 100
          },
          {
            "b": "Abf8%wPIu7jS[DJB-p(fCwY0Ixcp]aBy/99vruj4zxJLfAV/NuA+e)avrb(",
            "ln": 5,
            "addr": 119
          },
          {
            "b": "B-IpvjS[AWBz#pZfe3%LBzb/ae[n*pfkk3vAaA)hzy]:sfkk3vAaA)hzy]:s",
            "ln": 6,
            "addr": 167
          },
          {
            "b": "B7]@iauZ\u00266gbe",
            "ln": 9,
            "addr": 297
          },
          {
            "b": "vrb\u003c\u003eauZ\u0026(i5Ub4gY",
            "ln": 10,
            "addr": 308
          },
          {
            "b": "z/PM8x(k4RazCCgAaA)hzy]:s",
            "n": [
              {
                "c": 1,
                "d": "Alpine/Wolfi package origin field",
                "i": "metadata/package/files/system-package::alpine-pkginfo-origin-field",
                "o": 322,
                "z": 20,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 11,
            "addr": 322
          },
          {
            "b": "v@Dj3x(\u003eEXatNBZhFcMhhdX:6w[9Sav(u82w?(j#hzN6CvL/#2wI#F9fG9xLir",
            "ln": 12,
            "addr": 343
          },
          {
            "b": "zddc@Byw)3wPw[Ravg3ZvpTm!avy6+x(4PdjyJnAvpTm!kXaCDwObH]wO#0?wg?!vxfD",
            "ln": 13,
            "addr": 393
          }
        ],
        "depth": 1,
        "facts": {
          "metrics": {
            "file": {
              "size": 670.0,
              "entropy": 5.13,
              "size_bytes": 670.0
            },
            "binary": {
              "overall_entropy": 5.13,
              "peak_region_bytes": 670.0,
              "peak_region_entropy": 5.13
            }
          }
        },
        "id": 2,
        "path": "/data/samples/unknown/foraged/alpine/alpinelinux.org/_/ifupdown-ng-wireguard/ifupdown-ng-wireguard-0.13.0-r0.apk!!.PKGINFO",
        "risk": 1,
        "sha": "c0b11040c9ad1241e05c760f628f55c2dbc745fcafefb59ee4580cf57cd8a650",
        "size": 670,
        "traits": [
          {
            "id": "metadata/package/files/system-package::arch-pkgver-field",
            "conf": 0.9399999976158142,
            "crit": 1,
            "desc": "Arch pkgver metadata field",
            "spans": [
              [
                100,
                18
              ]
            ]
          },
          {
            "id": "metadata/package/files/system-package::alpine-pkginfo-origin-field",
            "conf": 0.8999999761581421,
            "crit": 1,
            "desc": "Alpine/Wolfi package origin field",
            "spans": [
              [
                322,
                20
              ]
            ]
          },
          {
            "id": "metadata/package/files/system-package::alpine-pkginfo-version-field",
            "conf": 0.8999999761581421,
            "crit": 1,
            "desc": "Alpine/Wolfi package version field",
            "spans": [
              [
                100,
                18
              ]
            ]
          },
          {
            "id": "metadata/package/files/system-package::alpine-pkginfo-package-field",
            "conf": 0.8999999761581421,
            "crit": 1,
            "desc": "Alpine/Wolfi package name field",
            "spans": [
              [
                68,
                31
              ]
            ]
          },
          {
            "id": "metadata/package/files/system-package::alpine-pkginfo-basename",
            "conf": 0.8999999761581421,
            "crit": 1,
            "desc": "Alpine/Wolfi package info file"
          },
          {
            "id": "metadata/package/files/system-package::arch-pkgname-field",
            "conf": 0.9399999976158142,
            "crit": 1,
            "desc": "Arch pkgname metadata field",
            "spans": [
              [
                68,
                31
              ]
            ]
          },
          {
            "id": "metadata/package/files/system-package::alpine-apk-pkginfo",
            "conf": 0.9700000286102295,
            "crit": 2,
            "desc": "Alpine/Wolfi package info metadata",
            "spans": [
              [
                68,
                31
              ],
              [
                100,
                18
              ],
              [
                322,
                20
              ]
            ]
          }
        ],
        "type": "text"
      }
    ],
    "rev": "af11a",
    "v": "8"
  }
}