{
  "ml": {
    "l": -1,
    "v": "6",
    "fs": [
      {
        "l": -1,
        "id": 0,
        "prob": 0.000021566947907558642
      }
    ],
    "prob": 0.000021566948,
    "models": [
      {
        "m": "az",
        "raw": 0.000021566948,
        "prob": 0.000021566948,
        "class": 0
      },
      {
        "m": "az/source",
        "raw": 0.000027656555,
        "prob": 0.000027656555,
        "class": 0
      },
      {
        "m": "az/rust",
        "raw": 0.000000029802322,
        "prob": 0.000000029802322,
        "class": 0
      }
    ],
    "version": "v17.17",
    "analyzed_at": "2026-06-08T13:50:43Z"
  },
  "path": "main.rs",
  "raw": {
    "v": "6",
    "fs": [
      {
        "f": "H₂(FPo₂)",
        "x": 2,
        "ff": {
          "i": [
            [
              "",
              "eprintln"
            ],
            [
              "",
              "include_bytes"
            ],
            [
              "",
              "include_bytes"
            ],
            [
              "",
              "println"
            ],
            [
              "",
              "Ok"
            ]
          ],
          "m": {
            "ast": {
              "max_depth": 39.0,
              "call_count": 31.0,
              "node_count": 711.0,
              "identifier_count": 34.0,
              "string_literal_count": 37.0
            },
            "file": {
              "size": 2070.0,
              "entropy": 4.79,
              "size_bytes": 2070.0
            },
            "text": {
              "digit_ratio": 0.02,
              "space_count": 523.0,
              "total_lines": 69.0,
              "char_entropy": 4.79,
              "unique_chars": 67.0,
              "string_density": 0.54,
              "avg_line_length": 29.0,
              "max_line_length": 78.0,
              "empty_line_ratio": 0.07,
              "last_line_length": 1.0,
              "whitespace_ratio": 0.29,
              "most_common_ratio": 0.06,
              "identifier_density": 1.39,
              "line_length_stddev": 18.42,
              "normalized_string_count": 4.45,
              "repeated_char_sequences": 24.0,
              "suspicious_string_ratio": 0.05,
              "most_common_char_is_null": 0.0,
              "max_inline_whitespace_run": 1.0,
              "most_common_char_codepoint": 101.0,
              "normalized_unique_identifiers": 5.57
            },
            "calls": {
              "count": 31.0
            },
            "binary": {
              "overall_entropy": 4.79
            },
            "source": {
              "function_count": 1.0
            },
            "strings": {
              "total": 37.0,
              "avg_length": 13.62,
              "max_length": 34.0,
              "path_count": 5.0,
              "avg_entropy": 3.11,
              "total_bytes": 504.0,
              "entropy_stddev": 0.5,
              "shell_command_strings": 2.0
            },
            "comments": {
              "chars": 59.0,
              "lines": 2.0,
              "total": 2.0,
              "todo_count": 1.0,
              "to_code_ratio": 0.03
            },
            "functions": {
              "count": 1.0,
              "avg_name_length": 4.0,
              "no_params_count": 1.0,
              "avg_length_lines": 62.0,
              "max_length_lines": 62.0,
              "min_length_lines": 62.0,
              "density_per_100_lines": 1.45,
              "code_in_functions_ratio": 0.9
            },
            "identifiers": {
              "count": 34.0,
              "total": 96.0,
              "avg_length": 5.97,
              "max_length": 17.0,
              "min_length": 1.0,
              "avg_entropy": 2.11,
              "reuse_ratio": 0.35,
              "unique_count": 34.0,
              "length_stddev": 3.88,
              "single_char_count": 1.0,
              "single_char_ratio": 0.03,
              "high_entropy_count": 2.0,
              "high_entropy_ratio": 0.06,
              "all_lowercase_ratio": 0.79,
              "all_uppercase_ratio": 0.06,
              "underscore_prefix_count": 1.0
            }
          },
          "s": [
            [
              23,
              "u8",
              "windows"
            ],
            [
              24,
              "u8",
              "windows"
            ],
            [
              50,
              "u8",
              "windows-service"
            ],
            [
              51,
              "u8",
              "windows-service"
            ],
            [
              177,
              "16",
              "134217728"
            ],
            [
              285,
              "u8",
              "This platform is not supported"
            ],
            [
              286,
              "u8",
              "This platform is not supported"
            ],
            [
              363,
              "u8",
              "windows-service"
            ],
            [
              364,
              "u8",
              "windows-service"
            ],
            [
              422,
              "u8",
              "C:\\\\Windows\\\\System32\\\\agent.exe"
            ],
            [
              423,
              "u8",
              "C:"
            ],
            [
              427,
              "u8",
              "Windows"
            ],
            [
              436,
              "u8",
              "System32"
            ],
            [
              446,
              "u8",
              "agent.exe"
            ],
            [
              495,
              "u8",
              "OUT_DIR"
            ],
            [
              496,
              "u8",
              "OUT_DIR"
            ],
            [
              507,
              "u8",
              "/stager.exe"
            ],
            [
              508,
              "u8",
              "/stager.exe"
            ],
            [
              556,
              "u8",
              "windows-service"
            ],
            [
              557,
              "u8",
              "windows-service"
            ],
            [
              616,
              "u8",
              "agent.exe"
            ],
            [
              617,
              "u8",
              "agent.exe"
            ],
            [
              666,
              "u8",
              "OUT_DIR"
            ],
            [
              667,
              "u8",
              "OUT_DIR"
            ],
            [
              678,
              "u8",
              "/stager.exe"
            ],
            [
              679,
              "u8",
              "/stager.exe"
            ],
            [
              746,
              "u8",
              "windows-service"
            ],
            [
              747,
              "u8",
              "windows-service"
            ],
            [
              808,
              "u8",
              "C:\\\\Windows\\\\System32\\\\agent.exe"
            ],
            [
              809,
              "u8",
              "C:"
            ],
            [
              813,
              "u8",
              "Windows"
            ],
            [
              822,
              "u8",
              "System32"
            ],
            [
              832,
              "u8",
              "agent.exe"
            ],
            [
              947,
              "u8",
              "windows-service"
            ],
            [
              948,
              "u8",
              "windows-service"
            ],
            [
              990,
              "u8",
              "{:#?}"
            ],
            [
              991,
              "u8",
              "{:#?}"
            ],
            [
              1045,
              "u8",
              "agent.exe"
            ],
            [
              1046,
              "u8",
              "agent.exe"
            ],
            [
              1181,
              "u8",
              "windows-service"
            ],
            [
              1182,
              "u8",
              "windows-service"
            ],
            [
              1237,
              "u8",
              "powershell"
            ],
            [
              1238,
              "u8",
              "powershell"
            ],
            [
              1314,
              "u8",
              "-Command"
            ],
            [
              1315,
              "u8",
              "-Command"
            ],
            [
              1343,
              "u8",
              "New-Service"
            ],
            [
              1344,
              "u8",
              "New-Service"
            ],
            [
              1375,
              "u8",
              "-Name"
            ],
            [
              1376,
              "u8",
              "-Name"
            ],
            [
              1401,
              "u8",
              "Agent"
            ],
            [
              1402,
              "u8",
              "Agent"
            ],
            [
              1429,
              "u8",
              "-BinaryPathName"
            ],
            [
              1430,
              "u8",
              "-BinaryPathName"
            ],
            [
              1465,
              "u8",
              "C:\\\\Windows\\\\System32\\\\agent.exe"
            ],
            [
              1466,
              "u8",
              "C:"
            ],
            [
              1471,
              "u8",
              "Windows"
            ],
            [
              1480,
              "u8",
              "System32"
            ],
            [
              1490,
              "u8",
              "agent.exe"
            ],
            [
              1520,
              "u8",
              "-DisplayName"
            ],
            [
              1521,
              "u8",
              "-DisplayName"
            ],
            [
              1553,
              "u8",
              "Agent"
            ],
            [
              1554,
              "u8",
              "Agent"
            ],
            [
              1581,
              "u8",
              "-StartupType"
            ],
            [
              1582,
              "u8",
              "-StartupType"
            ],
            [
              1614,
              "u8",
              "Automatic"
            ],
            [
              1615,
              "u8",
              "Automatic"
            ],
            [
              1644,
              "u8",
              "-Description"
            ],
            [
              1645,
              "u8",
              "-Description"
            ],
            [
              1677,
              "u8",
              "Hermes Agent Service"
            ],
            [
              1678,
              "u8",
              "Hermes Agent Service"
            ],
            [
              1745,
              "u8",
              "Failed to create service"
            ],
            [
              1746,
              "u8",
              "Failed to create service"
            ],
            [
              1804,
              "u8",
              "powershell"
            ],
            [
              1805,
              "u8",
              "powershell"
            ],
            [
              1881,
              "u8",
              "-Command"
            ],
            [
              1882,
              "u8",
              "-Command"
            ],
            [
              1910,
              "u8",
              "Start-Service"
            ],
            [
              1911,
              "u8",
              "Start-Service"
            ],
            [
              1944,
              "u8",
              "-Name"
            ],
            [
              1945,
              "u8",
              "-Name"
            ],
            [
              1970,
              "u8",
              "Agent"
            ],
            [
              1971,
              "u8",
              "Agent"
            ],
            [
              2023,
              "u8",
              "Failed to start service"
            ],
            [
              2024,
              "u8",
              "Failed to start service"
            ]
          ],
          "v": {
            "file.stem": "main",
            "file.basename": "main.rs",
            "source.shebang": "[windows_subsystem = \"windows\"]",
            "source.language": "rust",
            "source.imports[0]": "Ok",
            "source.imports[1]": "eprintln",
            "source.imports[2]": "include_bytes",
            "source.imports[3]": "println",
            "source.strings[0]": "-BinaryPathName",
            "source.strings[1]": "-Command",
            "source.strings[2]": "-Description",
            "source.strings[3]": "-DisplayName",
            "source.strings[4]": "-StartupType",
            "source.strings[5]": "/stager.exe",
            "source.strings[6]": "134217728",
            "source.strings[7]": "Automatic",
            "source.strings[8]": "C:\\\\Windows\\\\System32\\\\agent.exe",
            "source.strings[9]": "Failed to create service",
            "source.has_imports": true,
            "source.strings[10]": "Failed to start service",
            "source.strings[11]": "Hermes Agent Service",
            "source.strings[12]": "New-Service",
            "source.strings[13]": "OUT_DIR",
            "source.strings[14]": "Start-Service",
            "source.strings[15]": "System32",
            "source.strings[16]": "This platform is not supported",
            "source.strings[17]": "Windows",
            "source.strings[18]": "agent.exe",
            "source.strings[19]": "powershell",
            "source.strings[20]": "windows",
            "source.strings[21]": "windows-service",
            "source.functions[0]": "main"
          },
          "ct": [
            "Ok"
          ],
          "id": "rust"
        },
        "id": 0,
        "sz": 2070,
        "ts": [
          {
            "a": "T1059",
            "c": 0.9200000166893005,
            "d": "Builds process via Command::new",
            "e": [
              "Command::new("
            ],
            "i": "micro-behaviors/process/create/direct::rust-async-process",
            "l": 3,
            "m": "E1059"
          },
          {
            "a": "T1059",
            "c": 0.8999999761581421,
            "d": "Spawns a new process",
            "e": [
              ".spawn("
            ],
            "i": "micro-behaviors/process/create/direct::rust-spawn",
            "l": 3,
            "m": "E1059"
          },
          {
            "c": 0.4000000059604645,
            "d": "cmd/command/result vocabulary word",
            "e": [
              "Result"
            ],
            "i": "micro-behaviors/data/text/keywords/lexicon::command-result-word",
            "l": 1
          },
          {
            "a": "T1041",
            "c": 0.8500000238418579,
            "d": "Rust fs write call",
            "e": [
              "fs::write("
            ],
            "i": "micro-behaviors/fs/file/write/direct::fs-write",
            "l": 3
          },
          {
            "c": 0.699999988079071,
            "d": "powershell keyword",
            "e": [
              "powershell"
            ],
            "i": "micro-behaviors/process/create/shell/lang::powershell-keyword",
            "l": 3
          }
        ],
        "sha": "9f00ec2b647eb1a68244b0a4781319b69c25ca83e3962eefcf0e09b4b851ea99",
        "path": "/data/samples/bad/projects/hermes/dropper/src/main.rs",
        "type": "rust"
      }
    ],
    "tv": "8e9ac"
  }
}