{ "ml": { "v": "7", "eng": "2.12.0-beta.2", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.06806624, "rte": "az", "prob": 0.06806624 }, { "cls": 0, "raw": 0.22083236, "rte": "az/scripts", "prob": 0.22083236 }, { "cls": 0, "raw": 0.123883784, "rte": "az/javascript", "prob": 0.123883784 } ], "prob": 0.06806624, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.06806623935699463, "type": "javascript" } ], "version": "v18.18", "analyzed_at": "2026-10-10T10:35:08Z" }, "path": "octave-glyphKeys-short-dark.tif", "raw": { "v": "8", "rev": "c1ea9", "files": [ { "id": 0, "ctx": [ { "b": "o?+Qq001Y3gCZ\u0026!us3$rgCZ\u0026!b{:(qqbHi\u003cg=d5?b{:(qp/70*us3$rlpa3sus3$rus3$rf!\u003eA.b{:(qqC{A)gCZ\u0026!b{:(qq=uS{gbpS+b{:(qr8=\u0026%o?!vZp/70*f!\u003eA.b{:(qq=uS{f!\u003eA.b{:(qq=uS{us3$rlpa3sus3$rus3$rfe20Ub{:(qr8=\u0026%fFCiXb{:(qr8=\u0026%fFCiXb{:(qr-So3og}}TqC{A)fFCiXb{:(qr8=\u0026%fe20Ub{:(qr8=\u0026%tWgLllpa3sus3$rus3$reIeNOb{:(qrAi60e?O^Rb{:(qrAi60eIeNOb{:(qsY[]cnL8INq=uS{eg-vLb{:(qrAi60eg-vLb{:(qs65G6t3tbflpa3sus3$rtWgLldK(}Fb{:(qr-So3d\u003erdIb{:(qr-So3d\u003erdIb{:(qt3tbfnjVqKq=uS{dK(}Fcmg8tr-So3dK(}Fcmg8tsY[]ct3tbflpa3sus3$rtu+tidjD.CcNQqwr-So3djD.CcNQqwr-So3djD.CcNQqwtWgLlnjVqKr8=\u0026%c[3Izc[3Izr-So3c[3Izc[3Izt3tbfsxFY9m[l8Hus3$rt3tbfcNQqwdjD.Cr-So3cNQqwdK(}Fr-So3cNQqwdjD.Cu0Q+olQKlvr8=\u0026%cmg8tdK(}Fr-So3cmg8tdK(}FtWgLlrAi60njVqKus3$rsxFY9b{:(qd\u003erdIr-So3b{:(qd\u003erdIr-So3b{:(qdK(}Fus3$rlQKlvq=uS{b{:(q", "ln": 0, "col": 1, "line": 1 } ], "mol": "O(As)Md", "sha": "a26ab9df044a811ba90e5b8b8445b5b33cb2a25f557749635011741768cce05f", "path": "octave-glyphKeys-short-dark.tif", "risk": 4, "size": 33984, "supp": [ { "by": [ { "id": "basename" } ], "id": "micro-behaviors/crypto/symmetric/xor/loop::xor-modulo-key-loop", "crit": "notable", "kind": "unless" }, { "by": [ { "id": "metadata/build/minifier::js-medium-minified-line", "spans": [ [ 0, 29259 ] ] }, { "id": "metadata/build/bundler/asset::js-any-bundle-output", "spans": [ [ 0, 29259 ] ] }, { "id": "metadata/build/minifier::terser-minifier-helpers", "spans": [ [ 0, 29259 ] ] }, { "id": "metadata/build/recognized-contexts::benign-build-tooling-context", "spans": [ [ 0, 29259 ] ] } ], "id": "objectives/anti-static/obfuscation/string/reconstruct::max-line-length-20000", "crit": "notable", "kind": "unless" } ], "type": "javascript", "facts": { "imp": [ [ "", "Copyright" ], [ "", "�" ], [ "", "�" ], [ "", "M5�5�5�676r6�6�7$7" ], [ "", "_a_�" ], [ "", "���p����" ] ], "mbr": [ "_.�", "desc.IEC", "sRGB.IEC", "www.iec", "www.iec.ch", "�.I", "�.L", "�.L.�", "�.L.�.�", "�.L.�.�.�", "���.���" ], "tgt": [ "Copyright", "M5�5�5�676r6�6�7$7", "W", "_a_�", "q", "�", "���p����" ], "metrics": { "ast": { "op.gt": 3, "op.lt": 4, "op.add": 8, "op.bor": 3, "op.div": 5, "op.mod": 16, "op.mul": 6, "op.sub": 17, "op.xor": 10, "op.band": 4, "op.bnot": 3, "op.lnot": 3, "max_depth": 16, "call_count": 8, "node_count": 1259, "member_count": 11, "op_density.gt": 0, "op_density.lt": 0, "op_density.add": 0.01, "op_density.bor": 0, "op_density.div": 0, "op_density.mod": 0.01, "op_density.mul": 0, "op_density.sub": 0.01, "op_density.xor": 0.01, "op_density.band": 0, "op_density.bnot": 0, "op_density.lnot": 0, "member_depth_max": 5, "xor_mod_loop_count": 9 }, "file": { "size": 33984, "entropy": 3.14 }, "text": { "lines": 18, "top_char": 191, "tab_count": 17, "max_ws_run": 2, "digit_ratio": 0.21, "space_count": 54, "char_entropy": 3.14, "unique_chars": 182, "top_char_null": 0, "escape_density": 0, "lines_over_200": 8, "lines_over_500": 6, "string_density": 0.67, "top_char_ratio": 0.27, "avg_line_length": 1887.06, "lines_over_1000": 3, "max_line_length": 29259, "non_ascii_ratio": 0.81, "null_byte_count": 680, "last_line_length": 542, "long_token_count": 14, "whitespace_ratio": 0, "identifier_density": 22.67, "line_length_stddev": 6649.92, "octal_escape_count": 1, "non_printable_ratio": 0.04, "normalized_string_count": 2.83, "repeated_char_sequences": 176, "suspicious_identifier_ratio": 0.27, "normalized_unique_identifiers": 38.37 }, "binds": { "count": 1 }, "binary": { "peak_region_bytes": 2048, "peak_region_entropy": 5.17 }, "strings": { "bytes": 1335, "count": 12, "avg_length": 111.25, "max_length": 663, "avg_entropy": 2.21, "entropy_stddev": 1.6 }, "comments": { "chars": 29549, "count": 2, "lines": 2, "xxx_count": 1, "to_code_ratio": 0.13, "url_in_comments": 1 }, "consistency": { "extension_content_mismatch": 1, "extension_content_mismatch.script_as_unknown": 1 }, "identifiers": { "count": 408, "unique": 160, "avg_length": 8.76, "max_length": 101, "min_length": 1, "avg_entropy": 1.61, "reuse_ratio": 0.39, "length_stddev": 12.49, "has_digit_ratio": 0.14, "sequential_names": 39, "single_char_count": 42, "single_char_ratio": 0.26, "high_entropy_count": 1, "high_entropy_ratio": 0.01, "all_lowercase_ratio": 0.24, "all_uppercase_ratio": 0.16, "repeated_char_names": 4, "numeric_suffix_count": 6, "underscore_prefix_count": 2 } } }, "traits": [ { "id": "metadata/file/comment::source-at-most-two-comments", "conf": 0.88, "crit": 2, "desc": "Source has at most two comments" }, { "id": "metadata/file/comment::source-comment-bytes-over-20000", "conf": 0.9, "crit": 3, "desc": "Source has over 20000 comment bytes" }, { "id": "metadata/file/comment::source-comment-bytes-over-300", "conf": 0.92, "crit": 2, "desc": "Source has over 300 comment bytes" }, { "id": "metadata/build/minifier::js-medium-minified-line", "conf": 0.9, "crit": 2, "desc": "JavaScript contains a long minified line", "spans": [ [ 0, 29259 ] ] }, { "id": "metadata/file/data-blob::high-byte-script-text", "conf": 0.88, "crit": 3, "desc": "High-byte script text (\u003e=12%)" }, { "id": "objectives/anti-static/obfuscation/code-metrics/line-shape::js-near-zero-whitespace", "atk": "T1027", "mbc": "B0032", "conf": 0.9, "crit": 3, "desc": "JavaScript near-zero whitespace" }, { "id": "metadata/build/bundler/asset::js-any-bundle-output", "conf": 0.95, "crit": 2, "desc": "Contains bundled or minified JavaScript", "uses": [ 3 ], "spans": [ [ 0, 29259 ] ] } ] } ] } }