{ "ml": { "v": "7", "eng": "2.2.0-rc.1", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.02684462, "rte": "az", "prob": 0.02684462 } ], "prob": 0.02684462, "skip": [ { "rte": "az/tar", "why": "unavailable" }, { "rte": "az/tar", "why": "unavailable" } ], "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.02684462070465088, "type": "tar.gz" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.004753857851028442, "type": "shell" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.0025262534618377686, "type": "shell" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.00012001395225524902, "type": "src_info" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "registry" }, { "id": 5, "lvl": -1, "conf": 0, "prob": 0.00020629167556762695, "type": "registry" } ], "version": "v18.18", "analyzed_at": "2026-07-01T03:51:28Z" }, "path": "wallet-recovery-wizard-bin-5.11.0-1.src.tar.gz", "raw": { "fetched": [ { "cached": false, "locator": "pkg:alpm/arch/electron22", "outcome": "unresolved", "fetched_at": 0, "source_offset": 284, "source_sha256": "189790167da4f4f96a1578f3707759d1ee05a3a6aa653d941d471ea8372c2ea5" }, { "cached": false, "locator": "pkg:alpm/arch/python", "outcome": "unresolved", "fetched_at": 0, "source_offset": 306, "source_sha256": "189790167da4f4f96a1578f3707759d1ee05a3a6aa653d941d471ea8372c2ea5" }, { "size": 1301841, "cached": false, "status": 200, "headers": [ [ "access-control-allow-origin", "https://render.githubusercontent.com" ], [ "content-disposition", "attachment; filename=wallet-recovery-wizard-HEAD.tar.gz" ], [ "content-security-policy", "default-src 'none'; style-src 'unsafe-inline'; sandbox" ], [ "content-type", "application/x-gzip" ], [ "cross-origin-resource-policy", "cross-origin" ], [ "etag", "\"6b703643ed2cad17ab75bc66f4a0f1f7c51c9628a328fbb4c8b616b2742971d6\"" ], [ "strict-transport-security", "max-age=31536000" ], [ "vary", "Authorization,Accept-Encoding" ], [ "x-content-type-options", "nosniff" ], [ "x-frame-options", "deny" ], [ "x-xss-protection", "1; mode=block" ], [ "date", "Wed, 01 Jul 2026 03:51:28 GMT" ], [ "transfer-encoding", "chunked" ], [ "x-github-request-id", "EC96:1C96:B5E9EE:1352075:6A448EC0" ] ], "locator": "pkg:github/bitgo/wallet-recovery-wizard", "outcome": "pin_mismatch", "final_url": "https://codeload.github.com/bitgo/wallet-recovery-wizard/tar.gz/HEAD", "fetched_at": 1782877888, "pin_verified": false, "resolved_url": "https://codeload.github.com/bitgo/wallet-recovery-wizard/tar.gz/HEAD", "source_offset": 423, "source_sha256": "189790167da4f4f96a1578f3707759d1ee05a3a6aa653d941d471ea8372c2ea5", "content_sha256": "88ccde67196f93765f3d48dfd7aeab510e1ef4fec28db23ba29ed040855e310b" } ], "files": [ { "id": 0, "ctx": [ { "b": "abZy80000000zQb?eZ#*Md$HK7a0uIaLS7V\u0026^:aT/A\u0026BELD+!VyOmbYW6zMKb#(EJ1Am.w", "n": [ { "c": 2, "d": "Archive parser reported errors", "i": "metadata/file/metrics::archive-parse-error", "o": 0, "z": 24, "cf": 0.8999999761581421 } ], "ln": 0 } ], "mol": "H₂(F₂Po₂)", "sha": "9db4e688eeed70d4f3f200c5939a83bd837e2667496e62e6849d186c2ecbee9f", "path": "wallet-recovery-wizard-bin-5.11.0-1.src.tar.gz", "risk": 5, "size": 2829, "type": "tar.gz", "facts": { "metrics": { "file": { "size": 2829.0, "entropy": 7.92, "size_bytes": 2829.0 }, "parse": { "error_count": 1.0 }, "binary": { "overall_entropy": 7.92, "peak_region_bytes": 2829.0, "peak_region_entropy": 7.82 } } }, "traits": [ { "id": "micro-behaviors/fs/path/location::home-hidden-dotdir-ref", "conf": 0.6000000238418579, "crit": 3, "desc": "References hidden directory under home", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/directory/traverse::find-type-file", "atk": "T1083", "mbc": "E1083", "conf": 0.8199999928474426, "crit": 3, "desc": "find enumerates regular files", "from": [ { "file": 2 } ] }, { "id": "metadata/file/extension/identity::shell-a", "conf": 1.0, "crit": 2, "desc": "POSIX shell script extension", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/create/shell/spawn::shell-symbols", "conf": 0.8999999761581421, "crit": 3, "desc": "Shell execution symbols", "from": [ { "file": 1 } ], "spans": [ [ 1027, 15 ] ] }, { "id": "micro-behaviors/fs/enumerate/extension::search-image-extensions", "conf": 0.800000011920929, "crit": 3, "desc": "Search for image file extensions", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/process/interpreter/python::python-keyword", "conf": 0.699999988079071, "crit": 3, "desc": "python interpreter keyword (beyond shebang)", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/process/create/shell/spawn::shell-exec", "atk": "T1059", "crit": 3, "desc": "Shell exec builtin (process replacement)", "from": [ { "file": 1 } ] } ] }, { "ctx": [ { "b": "boXZHx(kOkvrl8?B7GCoeObn@k#pxCnM4X}flItRfkLuiff\u0026@+AbG93wK4BDuS6)0pc?PyjT8d#uQmH+l}Hp8ff\u003cM2zF\u0026)1wK4BD3l{VWvrl05wO#W9A=k\u0026jwO#PjC42A9vpB4:A%=G6AbP=savO%)lSu@Vpg3N\u003euQNs-jUNjOCYmOwBrB1Cmmg3LpFLm^pF%LGuRag6p^EDwk$svij-\u003eZ!wEr0[AbP=savO%)lSu@Vpg3yXq:A-zmpe$ZlSE2Qr9rNfk#HDHpdFkCBAhIn3t1E3z/P}xpesnDuQWZ\u003cj-CBWwozy7x(v\u003e@wQ5fjA=-Bal}pPKpFKwJm{!!.o*}h?bZSSYm{!RVpdv/BuR0%!mli1Cnkz@Gfd{:MzF0P}EiG2fCYmOwBrBmBuRB3TqBah-uR\u003c3/niFdxDTx6np^^(MEj]zJvMC=YoHJkYnKurvqDWv6k#Zy6a{[V4atCF\u003el${ZYy*?Piq*ACawO\u0026L=Acb/hx)Kifx(v(ic%ehUasnjjvr(V$zE+g6boQ0cwGSveB-.KHaARJAvqG:#Coy:vwmY!0avQ9Tv@#:fzxHuJgb7jcaARJAwmY\u003c]v@@\u0026nxK@q}wPI@oAbn%8w]zZb3l{V)xLzJgxK#10B0bWvBz8^#vr(V$zE:(lx(mE1CoyBcv@Dx@BzkVhB1wCCA:-E1x(v($y-)!evqGT}xdLflzE:\u003eWp/OSDv}f7^wPzj3x(v\u003e@wQ5fjA=-A)oHRrFqCQ4{pG*K?mpe\u003e+k#ZrHqCyH?nLSkFa%.I7oHRrFqCQ4{pG*K?mpe\u003e+k#ZrHqCyH?nLSkCeN-^zz*-/p3l{VGe*9L[B8b(oA3dO!C4\u003e#nzF-%5Brz#1mjxuDz/6D4Bzkh#y?X0p3l{V(wPP4Znk-kTmpeCKq+H7=p-%\u003c#az\u003eLev}W0bxK@qswmY*$Bz(avw[=6)azbLjay/tgA+e:5aAR4kyHQZ)azCt7zxJOjz/{2kzF6q/CYmOwBrA}wqCQ1QuQNsYoh[X-jT9d1AbYY6zdL%+wmY*$Bz(ax3jn12mRN8\u0026w]zYjmqMKBBAhqqcVZzLA::35azCXiy?mD{zGGrex(v(iz/cXdx\u003ey%*A+fcgavFUt3s^H=wGSfxDSSWauQE*\u003equ", "ln": 0, "col": 1, "line": 1 }, { "b": "z6g9JuQ^ZPm]J+:nLzN3a{]CnarR^HarU(wx(4u6A+eV\u0026at4QRy?W=#aBFLVtu-j4zxHbGy?W=#a%pe%j0n6L3lQDlarR^HarR^Hax@4)a%.IKx(mHga%o3$aynnR", "ln": 1960, "col": 32, "line": 55 }, { "b": "vScGlvqYP#mr\u0026xNB-.tozxI+!A=2JiB7]MgA%:cml${ZJvR/P#B75@%vScGlx\u003ewGdB-88hzF782B0bHwz/^aCx([3bB-X-{oHRrFqCQ4{qDlF0k#Rb=pEERUuSfl=l{:WKuQmNWjT.-^x\u003ewF(toCanDQQ}am13m4eOe]AfD:UbasnATtu-i]bZR%Nmmg3LpFLm{rzD)!q^So}l}8IFar-(\u003ca#7n:u0PJmBzbl63lQDlayw5kpddAAsyju(m)emAeIg\u003cUePUurwmxF4a$i\u003ehx:LhSwfr6wDTx6np^^(MEiG2fCX7wcwO+{/BAhqqkXj+yv@#:fzGYPiB7]MgkP?l@DUd85xldoxu40[ta%.Ixq:BeDlqHY\u003ck#HiSkWw^Zar\u00267TuS6)0pc?PyEiG^TbTrK", "ln": 2264, "col": 10, "line": 65 } ], "depth": 1, "facts": { "imp": [ [ "", "set" ], [ "", "echo" ], [ "", "read" ], [ "", "read" ], [ "", "cd" ], [ "", "exec" ] ], "tgt": [ "cd", "echo", "exec", "read", "set" ], "metrics": { "ast": { "op.eq": 1, "op.ne": 1, "max_depth": 14, "call_count": 6, "node_count": 462, "op_density.eq": 0, "op_density.ne": 0, "max_array_length": 4 }, "file": { "size": 2587, "entropy": 5.47 }, "text": { "lines": 73, "top_char": 101, "digit_ratio": 0.01, "space_count": 373, "char_entropy": 5.47, "unique_chars": 84, "top_char_null": 0, "string_density": 0.44, "top_char_ratio": 0.05, "avg_line_length": 34.45, "max_line_length": 99, "empty_line_ratio": 0.11, "last_line_length": 84, "whitespace_ratio": 0.17, "identifier_density": 1.04, "line_length_stddev": 27.24, "max_whitespace_run": 1, "normalized_string_count": 3.75, "repeated_char_sequences": 4, "suspicious_comment_ratio": 0.35, "normalized_unique_identifiers": 6.3 }, "binds": { "count": 17 }, "binary": { "peak_region_bytes": 2587, "peak_region_entropy": 5.51 }, "strings": { "bytes": 602, "count": 32, "avg_length": 18.81, "max_length": 55, "path_count": 1, "avg_entropy": 3.39, "entropy_stddev": 1.09 }, "comments": { "chars": 972, "count": 17, "lines": 17, "high_entropy": 6, "to_code_ratio": 0.3 }, "identifiers": { "count": 76, "unique": 39, "avg_length": 9.64, "max_length": 34, "min_length": 1, "avg_entropy": 2.48, "reuse_ratio": 0.51, "length_stddev": 8.1, "single_char_count": 1, "single_char_ratio": 0.03, "high_entropy_count": 6, "high_entropy_ratio": 0.15, "all_lowercase_ratio": 0.28, "all_uppercase_ratio": 0.54, "underscore_prefix_count": 5 } } }, "id": 1, "mol": "K(Am)H₂(F₂Os)", "path": "wallet-recovery-wizard-bin-5.11.0-1.src.tar.gz!!wallet-recovery-wizard-bin/wallet-recovery-wizard.sh", "pid": 0, "risk": 5, "sha": "a774c2f54fbbeeaac3cefc0f7250796d30c86d27f0fd40b7eaf9c0fdb021623d", "size": 2587, "traits": [ { "id": "micro-behaviors/fs/directory/chdir::shell-change-directory", "conf": 0.95, "crit": 3, "desc": "Shell changes working directory", "spans": [ [ 2487, 2 ] ] }, { "id": "micro-behaviors/fs/path/location::shell-home-dotpath", "conf": 0.85, "crit": 3, "desc": "Shell path to a dot-entry under $HOME", "spans": [ [ 291, 8 ] ] }, { "id": "micro-behaviors/os/linker/env::ld-library-path", "conf": 0.6, "crit": 3, "desc": "References the LD_LIBRARY_PATH search path", "spans": [ [ 314, 15 ] ] }, { "id": "micro-behaviors/os/linker/env::ld-library-path-export", "conf": 0.85, "crit": 3, "desc": "LD_LIBRARY_PATH shell export", "spans": [ [ 307, 23 ] ] }, { "id": "micro-behaviors/os/linker/env::ld-library-path-set", "atk": "T1574.006", "conf": 0.85, "crit": 3, "desc": "Sets LD_LIBRARY_PATH", "uses": [ 2, 3 ], "spans": [ [ 307, 23 ], [ 314, 15 ] ] }, { "id": "micro-behaviors/process/create/shell/spawn::shell-exec", "atk": "T1059", "conf": 0.5, "crit": 3, "desc": "Uses shell exec to replace process", "spans": [ [ 2503, 4 ] ] }, { "id": "well-known/app/system/archlinuxcn::packaging-recipe-path", "conf": 0.99, "crit": 3, "desc": "archlinuxcn or alarmcn package tree path" }, { "id": "well-known/app/system/archlinuxcn::repository-member-path", "conf": 0.99, "crit": 3, "desc": "Arch Linux CN repo tree member path" }, { "id": "metadata/build/archive::github-versioned-source-archive-member", "conf": 0.95, "crit": 2, "desc": "GitHub versioned source archive member" }, { "id": "metadata/file/extension/identity::shell-a", "conf": 1.0, "crit": 2, "desc": "POSIX shell script extension" }, { "id": "metadata/lang/natural/vocabulary/content-word::data-access-verb-token", "conf": 0.88, "crit": 1, "desc": "Data-access verb token", "spans": [ [ 1992, 0 ] ] }, { "id": "metadata/lang/natural/vocabulary/content-word::environment-data-term-token", "conf": 0.9, "crit": 1, "desc": "Environment or instruction terminology", "spans": [ [ 88, 0 ] ] }, { "id": "metadata/lang/natural/vocabulary/content-word::sensitive-target-term-token", "conf": 0.88, "crit": 1, "desc": "Secret, security, or environment terminology", "uses": [ 11 ], "spans": [ [ 88, 0 ] ] }, { "id": "metadata/lang/natural/vocabulary/function-word::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"", "spans": [ [ 471, 0 ] ] }, { "id": "metadata/lang/natural/vocabulary/function-word::lang-english--atom-2", "conf": 0.8, "crit": 1, "desc": "English function-word token \"and\"", "spans": [ [ 555, 0 ] ] }, { "id": "metadata/lang/natural/vocabulary/function-word::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "spans": [ [ 745, 0 ] ] }, { "id": "metadata/lang/natural/vocabulary/function-word::lang-english--atom-6", "conf": 0.8, "crit": 1, "desc": "English function-word token \"with\"", "spans": [ [ 502, 0 ] ] }, { "id": "metadata/lang/natural/vocabulary/function-word::lang-english--atom-7", "conf": 0.8, "crit": 1, "desc": "English function-word token \"this\"", "spans": [ [ 491, 0 ] ] }, { "id": "micro-behaviors/data/llm/repository-directive::control-action-prose-fragment", "conf": 0.88, "crit": 1, "desc": "Control-action verb followed by prose", "spans": [ [ 2296, 0 ] ] } ], "type": "shell" }, { "ctx": [ { "b": "boPY?x(n33x(mH5iV@-[A4%vjgbgEph6t2cCYkw$i5iixfF%$YBrAp@gAZjDBrC7iz9v", "n": [ { "c": 3, "d": "Recognized OS-specific execution marker", "i": "objectives/execution/condition/platform::os-specific-execution-recognized-marker", "o": 0, "z": 8, "cf": 0.800000011920929 } ], "ln": 1, "addr": 0 }, { "b": "Abf97vqPNsCvtr7wPPIAwN/U4wPA5FCwhwiA+3+hx(i", "ln": 2, "addr": 55 }, { "b": "uVo^[zEEx[jY=6dy?mYvqE%uRC4CYte(#+kvrb(", "ln": 3, "addr": 90 }, { "b": "Abf8%wPIuAb1lrVv@#:fzy]saB7F(8xM4:0azbLjayP85avo^:m@GI\u003cwN/U4wPA5sBz(8lB0fFiLKD2x[sL@Fe*%LpwNY^@y\u0026*!ywPz\u003caz/dgcB7DFnD2[7sz7P%CwmV({y?m9#A=k?Aa]", "ln": 7, "addr": 165 }, { "b": "vrb\u003c\u003ejT.X5i5Ub4g::Z", "ln": 8, "addr": 279 }, { "b": "B-IpYb4#7uAc15[fk20vxMW=pv@DiqltpKiz.Dryy\u00260W8ePLAjz*2YjC}BkODsp\u00268a]", "n": [ { "c": 2, "d": "HTTPS protocol prefix", "i": "micro-behaviors/communications/http/message::https-prefix", "o": 300, "z": 8, "cf": 0.8999999761581421 } ], "ln": 9, "addr": 295 }, { "b": "y?Wx\u003czGxwLc)}r1vpJ$ZeIX}jcN/", "ln": 10, "addr": 349 }, { "b": "v@Dl%y?Wy3B3g]}bZTGCxkRc{wHe{qx(ntydf", "ln": 11, "addr": 372 }, { "b": "wmYZ\u003ezE^/Kc\u0026", "ln": 13, "addr": 441 }, { "b": "arR^Hb4UO4v@#:fzx%NowO+{/BAhqqC4CYnx(v)qa]", "ln": 14, "addr": 451 }, { "b": "arR^HcVBuMxM4=o", "n": [ { "c": 3, "d": "python interpreter keyword (beyond shebang)", "i": "micro-behaviors/process/interpreter/python::python-keyword", "o": 489, "z": 8, "cf": 0.699999988079071 } ], "ln": 15, "addr": 485 }, { "b": "df", "ln": 16, "addr": 498 }, { "b": "z/x/jz/fRVc\u0026", "ln": 17, "addr": 500 }, { "b": "df", "ln": 19, "addr": 527 }, { "b": "B8Mhwv}v!K", "ln": 20, "addr": 529 }, { "b": "arR^Ha%.IOyIdJ[zdL1BvRG.deHkWZyId*4A^YMJwNWXYbZTVOy\u003c^%SwO+{^B7GzCwn=Wfy\u0026r-)flOQ/Abf9fwPAhLbZS)qyIdJ[zdObEoLFx!CR7g/Abf9fwPAhKwmYi]", "n": [ { "c": 2, "d": "Linux platform string", "i": "micro-behaviors/os/sysinfo/platform/string::os-string-linux", "o": 543, "z": 98, "cf": 0.6000000238418579 } ], "ln": 21, "addr": 538 }, { "b": "arR^Ha%.IOyIdJ[zdL1BvRG.de]$XI", "ln": 22, "addr": 643 }, { "b": "df", "ln": 23, "addr": 668 }, { "b": "arR^HarR^HarR^HcT!})g?epMh8F]OvR6aVvpI96wObBaw\u0026zF5fGh0Iwht]Hi5Uq5h!B:QwhC#Hh!uAfiB::PwmvkFf/y^ywg5/", "ln": 25, "addr": 749 }, { "b": "uUr}(uTW[)uU0\u003e\u003ec[co=", "ln": 26, "addr": 829 }, { "b": "arR^Hw[=c[ar\u00267TB8\u003e=3x(XRCat4XXAaHe7at4FtzdK?lA+frgB-H#6B1RAuyA:(MwQ4=@ay]hbzEEx[aBwIVd\u003cfiZxK$Q.at4ENf-", "n": [ { "c": 3, "d": "Recursive directory traversal logic", "i": "micro-behaviors/fs/directory/traverse::recursive-directory-traversal", "o": 850, "z": 24, "cf": 0.8600000143051147 } ], "ln": 27, "addr": 846 }, { "b": "Ee", "ln": 28, "addr": 928 }, { "b": "uT)+Xv@2B.y?m9#A=k\u00265C4CYnx(v(qdiJ%", "ln": 29, "addr": 930 }, { "b": "arR^HwN/y(ar\u003c\u0026$A+Pchx(mMamqMKBBAhqqaA?spB7]Mge?O+2", "ln": 30, "addr": 958 }, { "b": "arR^Hy\u0026r/(y-)84vqfQ^wQ4=HbQ^nszE:\u003elbQ^2jwPRo/AbYe{x(UTDat4CsCW$x8Bz8^Kat4XXAaHe7at4eHwN/\u003e8vpB4:at4LMx(n38aswERasg#izylMOaAIEwBrAeMAV/-LxK$Q.at2q\u003cD(#{wBrAeCcM\u003c=VeOl:\u0026df", "n": [ { "c": 3, "d": "Shell command execution capability", "i": "micro-behaviors/process/create/shell/spawn::shell-execution-comp", "o": 1027, "z": 15, "cf": 0.8999999761581421 } ], "ln": 31, "addr": 999 }, { "b": "arR^Htu-j4DlsySDTyR#x(mo?CX8pEayem}cmf\u003cDv}Y^6eOc4GtRE@\u0026tqnh}gI])9By^GQlVm9-wft=dBrCgfzE:\u003eUy?m9#A=k?rvRGZ*A^ooxfF+H?fL@0Rcmf\u003cQwPS6nzu", "ln": 32, "addr": 1133 }, { "b": "arR^Hy\u0026r/(y-)7@y?m9-C4CXSbQ^.QA+PA7B08ULDTyR#x(mo?CX8pEaBCqAA+fhjePjDdcQ?\u0026.v@#:fzzbl/tqdS?t}moBD)09lvpQGjf!0", "ln": 33, "addr": 1239 }, { "b": "arR^HuT)+Xv@2B.y?m9#A=k\u00265C4CYnx(v\u003e", "ln": 47, "addr": 1951 }, { "b": "arR^Hy\u0026r/(y-)7[AbYe{x(VuZc%{Q#ByeD}A9)c\u0026AWZ", "ln": 48, "addr": 1979 }, { "b": "arR^Hy\u0026gvEB7MKsflItRfjFTkfk#hUxM4=jar\u00267TuTW[)uU0\u003e\u003eEj]RLB8Mhwv}xZmvq{frvrk\u003c$e{h5JvpK7:wg}?swmYa+z!a0bwPGIlx\u003eIc$Bs*%Aw[CQ{fjG6ry?bhpz!9A^xl!D6vRG.3fk#hUxM4=Aa]", "n": [ { "c": 3, "d": "Electron app.asar file targeting", "i": "objectives/supply-chain/trojanized/app/asar::asar-targeting", "o": 2056, "z": 18, "cf": 0.800000011920929 } ], "ln": 49, "addr": 2014 }, { "b": "Ee", "ln": 50, "addr": 2140 }, { "b": "Aa9l(vp%d1diJ%", "ln": 51, "addr": 2142 }, { "b": "32BJ\u0026vqE5[vq{f)wnc6EbQ^2jwPRo/AbYe{x(UT", "ln": 54, "addr": 2298 }, { "b": "31E]%eNY+CbZS)bAbYe{x(XRPA+frgB-H#6B1XZ\u0026ar\u00267TAbf8%x(XRPB-RNRy?WuibZTGCxkRc{wHe{qx(ntLa]", "ln": 55, "addr": 2330 }, { "b": "arR^Hw[=c[ar\u00267TB8\u003e=3x(XRCat4XXAaHe7ay3rqePb0lwGSfDe]UYva%nEQat4FtzdK?ldLt^=xcFE6diHiYvruf9a$vUEvrb{jx\u003e870B1Y0!aBCqQxLzo]aAz44wfrEAayw?Aay]x", "n": [ { "c": 3, "d": "Search for image file extensions", "i": "micro-behaviors/fs/enumerate/extension::search-image-extensions", "o": 2439, "z": 5, "cf": 0.800000011920929 } ], "ln": 56, "addr": 2400 }, { "b": "arR^HarR^HuUaF7wO#N6z/dYZbZS)jbo[V\u003cEiF", "ln": 57, "addr": 2512 }, { "b": "arR^HarR^HuUK1*zEmu\u003eBz9/YbZS)jbpW+Fvrb{jx\u003e870B1.}=", "ln": 58, "addr": 2543 } ], "depth": 1, "facts": { "imp": [ [ "", "find" ], [ "", "find" ], [ "", "head" ], [ "", "head" ], [ "", "echo" ], [ "", "echo" ], [ "", "find" ], [ "", "find" ], [ "", "get_app_dir" ], [ "", "get_app_dir" ], [ "", "sort" ], [ "", "sort" ], [ "", "head" ], [ "", "head" ], [ "", "cut" ], [ "", "cut" ], [ "", "echo" ], [ "", "echo" ], [ "", "return" ], [ "", "return" ], [ "", "strings" ], [ "", "strings" ], [ "", "grep" ], [ "", "grep" ], [ "", "head" ], [ "", "head" ], [ "", "echo" ], [ "", "echo" ], [ "", "return" ], [ "", "return" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "sed" ], [ "", "sed" ], [ "", "bsdtar" ], [ "", "bsdtar" ], [ "", "check_electron_version" ], [ "", "check_electron_version" ], [ "", "get_app_dir" ], [ "", "get_app_dir" ], [ "", "ln" ], [ "", "ln" ], [ "", "install" ], [ "", "install" ], [ "", "install" ], [ "", "install" ], [ "", "get_app_dir" ], [ "", "get_app_dir" ], [ "", "cp" ], [ "", "cp" ], [ "", "find" ], [ "", "find" ], [ "", "read" ], [ "", "read" ], [ "", "dirname" ], [ "", "dirname" ], [ "", "install" ], [ "", "install" ], [ "", "install" ], [ "", "install" ] ], "tgt": [ "_check_electron_version", "_get_app_dir", "bsdtar", "cp", "cut", "dirname", "echo", "find", "grep", "head", "install", "ln", "read", "return", "sed", "sort", "strings" ], "metrics": { "ast": { "op.ne": 1.0, "op.mod": 12.0, "max_depth": 12.0, "bind_count": 22.0, "call_count": 31.0, "node_count": 744.0, "op_density.ne": 0.0, "op_density.mod": 0.02, "identifier_count": 76.0, "string_literal_count": 50.0, "array_literal_max_length": 2.0 }, "file": { "size": 2864.0, "entropy": 5.32, "size_bytes": 2864.0 }, "text": { "tab_count": 2.0, "digit_ratio": 0.09, "space_count": 345.0, "total_lines": 63.0, "char_entropy": 5.32, "mixed_indent": 1.0, "unique_chars": 90.0, "escape_density": 0.28, "string_density": 0.79, "avg_line_length": 44.46, "high_byte_ratio": 0.0, "invisible_chars": 1.0, "max_line_length": 133.0, "non_ascii_ratio": 0.0, "last_line_length": 1.0, "whitespace_ratio": 0.14, "most_common_ratio": 0.07, "identifier_density": 2.92, "line_length_stddev": 37.64, "octal_escape_count": 8.0, "encoded_string_ratio": 0.04, "normalized_string_count": 6.3, "repeated_char_sequences": 1.0, "suspicious_string_ratio": 0.04, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 1.0, "most_common_char_codepoint": 101.0, "suspicious_identifier_ratio": 0.01, "normalized_unique_identifiers": 12.71 }, "binds": { "count": 22.0 }, "calls": { "count": 31.0 }, "binary": { "overall_entropy": 5.32, "peak_region_bytes": 2048.0, "peak_region_entropy": 5.45 }, "source": { "function_count": 4.0 }, "strings": { "total": 50.0, "url_count": 1.0, "avg_length": 32.8, "max_length": 161.0, "path_count": 3.0, "avg_entropy": 3.61, "hex_strings": 2.0, "total_bytes": 1640.0, "entropy_stddev": 0.86, "shell_command_strings": 2.0 }, "comments": { "chars": 53.0, "lines": 1.0, "total": 1.0, "to_code_ratio": 0.02 }, "functions": { "count": 4.0, "avg_params": 4.5, "max_params": 6.0, "length_stddev": 3.91, "avg_name_length": 12.25, "avg_length_lines": 9.5, "max_length_lines": 13.0, "min_length_lines": 3.0, "high_entropy_names": 1.0, "avg_param_name_length": 67.17, "density_per_100_lines": 6.35, "code_in_functions_ratio": 0.6 }, "identifiers": { "count": 76.0, "total": 184.0, "avg_length": 5.96, "max_length": 26.0, "min_length": 1.0, "avg_entropy": 2.01, "reuse_ratio": 0.41, "unique_count": 76.0, "length_stddev": 4.72, "has_digit_ratio": 0.07, "sequential_names": 1.0, "single_char_count": 6.0, "single_char_ratio": 0.08, "high_entropy_count": 3.0, "high_entropy_ratio": 0.04, "all_lowercase_ratio": 0.57, "numeric_suffix_count": 2.0, "underscore_prefix_count": 11.0 } } }, "id": 2, "mol": "H₂(F₂Po₂)", "path": "wallet-recovery-wizard-bin-5.11.0-1.src.tar.gz!!wallet-recovery-wizard-bin/PKGBUILD", "risk": 4, "sha": "3673490b12c5085b184ac307db84f09336086a4fe008ca1deb13c880016fff66", "size": 2864, "traits": [ { "id": "micro-behaviors/fs/enumerate/extension::search-image-extensions", "conf": 0.800000011920929, "crit": 3, "desc": "Search for image file extensions", "spans": [ [ 2439, 5 ] ] }, { "id": "micro-behaviors/fs/directory/traverse::find-type-file", "atk": "T1083", "mbc": "E1083", "conf": 0.8199999928474426, "crit": 3, "desc": "find enumerates regular files", "spans": [ [ 850, 24 ] ] }, { "id": "micro-behaviors/process/interpreter/python::python-keyword", "conf": 0.699999988079071, "crit": 3, "desc": "python interpreter keyword (beyond shebang)", "spans": [ [ 489, 8 ] ] }, { "id": "micro-behaviors/process/create/shell/spawn::shell-symbols", "conf": 0.8999999761581421, "crit": 3, "desc": "Shell execution symbols", "spans": [ [ 1027, 15 ] ] } ], "type": "shell" }, { "depth": 1, "facts": { "metrics": { "file": { "size": 804.0, "entropy": 5.28, "size_bytes": 804.0 }, "binary": { "overall_entropy": 5.28, "peak_region_bytes": 804.0, "peak_region_entropy": 5.28 } } }, "id": 3, "path": "wallet-recovery-wizard-bin-5.11.0-1.src.tar.gz!!wallet-recovery-wizard-bin/.SRCINFO", "refs": [ { "to": "pkg:alpm/arch/electron22", "off": 284, "kind": "dependency" }, { "to": "pkg:alpm/arch/python", "off": 306, "kind": "dependency" }, { "to": "pkg:github/bitgo/wallet-recovery-wizard", "off": 423, "kind": "dependency" } ], "sha": "189790167da4f4f96a1578f3707759d1ee05a3a6aa653d941d471ea8372c2ea5", "size": 804, "type": "src_info" }, { "depth": 2, "facts": { "metrics": { "file": { "size": 768.0, "entropy": 4.63, "size_bytes": 768.0 }, "binary": { "overall_entropy": 4.63, "peak_region_bytes": 768.0, "peak_region_entropy": 4.63 }, "registry": { "age_days": 10.0, "maintainers": 1.0, "published_at": 1781949506.0, "is_deprecated": 0.0 } } }, "id": 4, "path": "python@3.14.6-1.registry.json", "sha": "0bd0a2cc687625bf59282b30057139fee37f18130bdee835f85f2ea0136f26e7", "size": 768, "type": "registry" }, { "ctx": [ { "b": "DM)3hz/ZhBBy/qkiWeiJBzb/aa$K{QvqPN1iWe3EBz2IBCvtr7wPPIAwN/U4wPA5FCwhwiA+3vBb6EKrB7]Mgb03[(efY4QvR/+1", "n": [ { "c": 3, "d": "Registry release under 7 days old", "i": "metadata/registry::freshly-published", "o": 0, "z": 24, "cf": 1.0 } ], "ln": 0 } ], "depth": 2, "facts": { "metrics": { "file": { "size": 865.0, "entropy": 4.75, "size_bytes": 865.0 }, "binary": { "overall_entropy": 4.75, "peak_region_bytes": 865.0, "peak_region_entropy": 4.75 }, "registry": { "age_days": 0.0, "published_at": 1782815181.0, "rating_count": 64.0, "is_deprecated": 0.0 } } }, "id": 5, "mol": "Md", "path": "bitgo_wallet-recovery-wizard.registry.json", "risk": 1, "sha": "4dd0cc3cc8428404c5c779c885a0b086b0cf058f7a584d14228e16155256cd6a", "size": 865, "traits": [ { "id": "metadata/registry::freshly-published", "conf": 1.0, "crit": 3, "desc": "Registry release under 7 days old", "spans": [ [ 0, 24 ] ] } ], "type": "registry" } ], "v": "8" } }