{
  "ml": {
    "v": "7",
    "eng": "2.4.0-beta.1",
    "lvl": -1,
    "conf": 0,
    "mods": [
      {
        "cls": 0,
        "raw": 0.122858845,
        "rte": "az",
        "prob": 0.122858845
      },
      {
        "cls": 0,
        "raw": 0.004687816,
        "rte": "az/tar",
        "prob": 0.004687816
      }
    ],
    "prob": 0.122858845,
    "files": [
      {
        "id": 0,
        "lvl": -1,
        "conf": 0,
        "prob": 0.12285884469747543,
        "type": "tar.gz"
      },
      {
        "id": 1,
        "lvl": -1,
        "conf": 0,
        "prob": 0.07437607645988464,
        "type": "shell"
      },
      {
        "id": 2,
        "lvl": -1,
        "conf": 0,
        "prob": 0.000007549921519967029,
        "type": "src_info"
      },
      {
        "id": 3,
        "lvl": -1,
        "conf": 0,
        "prob": 0.000007321437351492932,
        "type": "registry"
      },
      {
        "id": 4,
        "lvl": -1,
        "conf": 0,
        "prob": 0.000007321437351492932,
        "type": "registry"
      },
      {
        "id": 5,
        "lvl": -1,
        "conf": 0,
        "prob": 0.000008841355338518042,
        "type": "registry"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-07-23T16:41:54Z"
  },
  "path": "amazon-corretto-11-11.0.32.9.1-3.src.tar.gz",
  "raw": {
    "files": [
      {
        "id": 0,
        "ctx": [
          {
            "b": "abZy80000000zQ\u0026yFSXQ6Y*\u003eA6@co[qw4Ut9/]u\u0026Ss2u^VAL]g*rTCGJ#Y4K\u003cvq*d@p^)+]cc}4Cl%]]j}+/9/o%h3CKA0FZQ\u0026]^/Y6-^p\u0026F}2tBQxPv2Q7{0N5m8nW\u003e{0g.?*ig7z}(!Ik+F9:{YV6J@ZWPIjx9%jK{V}J?-!ky(N\u003e9FZtA]1H0b=Ji[Jn]ot5U7YP-xq\u003c2?*+L\u003eKoPcAv(jAi\u003c{Uod$\u002632\u003c}QPLSnSMsXvI)oNcJXRT:lTH@n[vP+vL\u0026acw\u003c2Zy{7ASPb@4BW(9r",
            "n": [
              {
                "c": 2,
                "d": "Linux kernel architecture source path",
                "i": "metadata/lang/source::linux-kernel-arch-source-path",
                "o": 0,
                "z": 129,
                "cf": 0.9800000190734863
              }
            ],
            "ln": 0
          }
        ],
        "mol": "H₃(CmF₂Os)Md(Bk)",
        "sha": "a4b17db83bc080100f88d59f53f20ff2ae56efebbf21d3096d963fb71ccb32a7",
        "path": "/data/samples/unknown/foraged/arch/archlinux.org/aur.archlinux.org/amazon-corretto-11/amazon-corretto-11-11.0.32.9.1-3.src.tar.gz",
        "risk": 5,
        "size": 1186,
        "type": "tar.gz",
        "facts": {
          "metrics": {
            "file": {
              "size": 1186.0,
              "entropy": 7.81,
              "size_bytes": 1186.0
            },
            "parse": {
              "error_count": 1.0
            },
            "binary": {
              "overall_entropy": 7.81,
              "peak_region_bytes": 1024.0,
              "peak_region_entropy": 7.78
            }
          }
        },
        "traits": [
          {
            "id": "micro-behaviors/os/sysinfo/platform/arch::architecture-selection-wordlist",
            "conf": 0.9399999976158142,
            "crit": 3,
            "desc": "Selects among multiple CPU architecture payloads",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "metadata/build/package::pkgbuild-architecture-checksum-arrays",
            "conf": 0.949999988079071,
            "crit": 3,
            "desc": "PKGBUILD defines architecture checksum arrays",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/download/url::archive-url-reference-b",
            "conf": 0.8799999952316284,
            "crit": 3,
            "desc": "References an HTTP(S) archive URL",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/shell-ops::cp-command",
            "conf": 0.8999999761581421,
            "crit": 3,
            "desc": "Invokes cp file-copy command",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/directory/mkdir::mkdir-command",
            "conf": 0.800000011920929,
            "crit": 3,
            "desc": "Shell invokes mkdir command",
            "from": [
              {
                "file": 1
              }
            ]
          }
        ]
      },
      {
        "ctx": [
          {
            "b": "boPY?x(n33x(mH5iV}7lxK$)2q*0zeyIs[NwNPj/wPR^hkXB}xx(2ziz/4VBAbf97vqPNsvqPC0z/ddpz/P(fBAzBMf!\u003c2OyId*4AY(cie?![lga\u003eNtf:.(nxl4N1jUWp.yIdf?B7muXph.Z]z/Z1Kaz(mqBzkYgvrua1A=0uIAb](cBZ]Jcz/ddEwNPa{ay]hcBAh88B-.tozxJ\u003efawV@/zC0q\u0026cKKp5v}X1NcWmQeuP6.*asyPaA:@=vg::ZVB-IpYcUNQzAc15[fjx6Ce[5Q9Dt^WNv@Diqv@DydwPS3jfdd9yx\u003e7Z(B7EG.cR40bgaaHTwmYZ\u003ezE^/Kc)@+rC3#$yB-8qnzdLqez/6ufzylLOygho]eOe*yx(XcfzdNQbeN@ZozeTqtdgg1",
            "n": [
              {
                "c": 3,
                "d": "Selects among multiple CPU architecture payloads",
                "i": "micro-behaviors/os/sysinfo/platform/arch::architecture-selection-wordlist",
                "o": 185,
                "z": 6,
                "cf": 0.9399999976158142
              },
              {
                "c": 3,
                "d": "Recognized OS-specific execution marker",
                "i": "objectives/execution/condition/platform::os-specific-execution-recognized-marker",
                "o": 0,
                "z": 8,
                "cf": 0.800000011920929
              },
              {
                "c": 2,
                "d": "Contains an HTTPS URL prefix",
                "i": "micro-behaviors/communications/http/message::https-prefix",
                "o": 209,
                "z": 8,
                "cf": 0.8999999761581421
              },
              {
                "c": 1,
                "d": "AArch64 (ARM64) architecture string",
                "i": "micro-behaviors/os/sysinfo/platform/arch::arch-aarch64",
                "o": 194,
                "z": 7,
                "cf": 1.0
              }
            ],
            "ln": 0,
            "col": 1,
            "line": 1
          },
          {
            "b": "fjO{vA+fumz.C{nBy/JnfjO{vA+fumz.iW#eP\u003eXVwn=Wfy\u0026r-)B1IixB963FBzU?3B8Mhwv}x1(i5Ub4g^9lhxMOunB2\u003e%cv@DydwPS3je[5%BfjY0BzFTl1wofzAwPI^jA:@W4fc\u003e)-yId*4A^YPHzdd:ezy]vpA=L-kBz\u0026-RDVi+kC4CYxeO]csB:bG.hz^4dvr9#kDlNX!e]$-tEjkIAz/{8gwNw\u003eOA:@=vg^9lhxMOunB2\u003e%cv@DydwPS3je[5%BfjY0BzFTl1wofzAwPI^jA:@W4fc\u003e)-yId*4A^YPHzdd:ezy]vpA=L-kBz\u0026-RDVi+kC4CYxeO]csB:bGDvrb\u003c\u003ehz^4dvr9#kDlNX!e]$-tEjkIDvqGT*Aa:c9wQetWc){]vlO*RRhBG\u00261h8v6yg=W].loc\u003eXgbziJgbpZzgc[kXg!6kSmkDquar@0{zdd:ezxI\u003e?A=#ebwPF$/oHx{Jl2y4Rz/cW+z/P(fBAzBzA+f5#vrl0eauTdLA=L-kBz\u0026:MwNPBvvqPC0z/dgqz/4VB3ufA-yHH\u003c!c[co=3lQEdyH?d1at4KPa%.byxjLZ%flItRfkLuifktVEa{]Cnv{%B\u0026ar\u00266#k#H6va%pPq3lQDlar(4\u0026hEwv0a$i\u003cwarR^Hay/vkeNY+CvqPC0z/ddpz/P(fBAzBMbYEKiC4CXCy?W^fCRad#g:j4^bYEKiwnc6qB-RNRy?WuiyiBCEygho]eIO$ivqPC0z/ddpz/P(fBAzBB3lQDlarR^*i%)8MarR\u003epvrb\u003c\u003ehz=Qb3lQDlarR!pA3c-var\u003elhvr#\u003cfeN@ZtA+fumz.ikNyId*4AXh9wzGQgQvpsg^xF}W\u003ear\u00267IyIdf(AXzMRAXzlyvLqFtz7/TjC3#%Sf!D*Jvr#\u003cfeN@ZtA+fumzZ2JharR^HauIT(arUlpvpGT)3jp\u0026/vkoX#B9htvuWaK*uP6-7c)@HVg+{)yh83:}fGh0DiwruJwIVtTfK[VJfL1YFg=5-1h.^3Chz)iDh!1KKh!s*3hArYPiC6%1ggq{]g=cM!arR^HarR^HarR^HarR^HarR^Oq+GXUcN/yzxKJUNhGK1TB6\u0026u:A:@=vg^9lmgb?9Hf/g:Ev}xgVg5",
            "n": [
              {
                "c": 3,
                "d": "PKGBUILD defines architecture checksum arrays",
                "i": "metadata/build/package::pkgbuild-architecture-checksum-arrays",
                "o": 1187,
                "z": 20,
                "cf": 0.949999988079071
              },
              {
                "c": 3,
                "d": "References an HTTP(S) archive URL",
                "i": "micro-behaviors/communications/http/download/url::archive-url-reference-b",
                "o": 514,
                "z": 93,
                "cf": 0.8799999952316284
              },
              {
                "c": 3,
                "d": "Shell invokes mkdir command",
                "i": "micro-behaviors/fs/directory/mkdir::mkdir-command",
                "o": 887,
                "z": 32,
                "cf": 0.800000011920929
              },
              {
                "c": 3,
                "d": "Invokes cp file-copy command",
                "i": "micro-behaviors/fs/shell-ops::cp-command",
                "o": 958,
                "z": 88,
                "cf": 0.8999999761581421
              },
              {
                "c": 1,
                "d": "Regex component marker",
                "i": "objectives/evasion/masquerade/file/lure::pdf-search-home-posix--rx-6",
                "o": 478,
                "z": 9,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 446,
            "col": 30,
            "line": 13
          }
        ],
        "depth": 1,
        "facts": {
          "imp": [
            [
              "",
              "mkdir"
            ],
            [
              "",
              "mkdir"
            ],
            [
              "",
              "cp"
            ],
            [
              "",
              "cp"
            ],
            [
              "",
              "cp"
            ],
            [
              "",
              "cp"
            ]
          ],
          "tgt": [
            "cp",
            "mkdir"
          ],
          "metrics": {
            "ast": {
              "max_depth": 8.0,
              "bind_count": 16.0,
              "call_count": 3.0,
              "node_count": 219.0,
              "identifier_count": 28.0,
              "string_literal_count": 25.0,
              "array_literal_max_length": 3.0
            },
            "file": {
              "size": 1416.0,
              "entropy": 5.45,
              "size_bytes": 1416.0
            },
            "text": {
              "digit_ratio": 0.17,
              "space_count": 110.0,
              "total_lines": 33.0,
              "char_entropy": 5.45,
              "unique_chars": 74.0,
              "string_density": 0.76,
              "avg_line_length": 41.91,
              "max_line_length": 132.0,
              "empty_line_ratio": 0.06,
              "last_line_length": 27.0,
              "long_token_count": 2.0,
              "whitespace_ratio": 0.1,
              "most_common_ratio": 0.06,
              "identifier_density": 1.33,
              "line_length_stddev": 39.48,
              "encoded_string_ratio": 0.12,
              "normalized_string_count": 4.35,
              "repeated_char_sequences": 2.0,
              "most_common_char_is_null": 0.0,
              "max_inline_whitespace_run": 1.0,
              "most_common_char_codepoint": 97.0,
              "normalized_unique_identifiers": 5.55
            },
            "binds": {
              "count": 16.0
            },
            "calls": {
              "count": 3.0
            },
            "binary": {
              "overall_entropy": 5.45,
              "peak_region_bytes": 1416.0,
              "peak_region_entropy": 5.38
            },
            "source": {
              "function_count": 1.0
            },
            "strings": {
              "total": 25.0,
              "url_count": 3.0,
              "avg_length": 30.92,
              "max_length": 97.0,
              "avg_entropy": 3.42,
              "hex_strings": 3.0,
              "total_bytes": 773.0,
              "entropy_stddev": 0.88
            },
            "comments": {
              "chars": 198.0,
              "lines": 3.0,
              "total": 3.0,
              "to_code_ratio": 0.1,
              "url_in_comments": 1.0
            },
            "functions": {
              "count": 1.0,
              "avg_params": 2.0,
              "max_params": 2.0,
              "avg_name_length": 7.0,
              "avg_length_lines": 11.0,
              "max_length_lines": 11.0,
              "min_length_lines": 11.0,
              "avg_param_name_length": 133.5,
              "density_per_100_lines": 3.03,
              "code_in_functions_ratio": 0.33
            },
            "identifiers": {
              "count": 28.0,
              "total": 44.0,
              "avg_length": 7.39,
              "max_length": 18.0,
              "min_length": 1.0,
              "avg_entropy": 2.31,
              "reuse_ratio": 0.64,
              "unique_count": 28.0,
              "length_stddev": 4.83,
              "has_digit_ratio": 0.21,
              "single_char_count": 2.0,
              "single_char_ratio": 0.07,
              "all_lowercase_ratio": 0.57,
              "all_uppercase_ratio": 0.04,
              "numeric_suffix_count": 5.0
            }
          }
        },
        "id": 1,
        "mol": "H₃(CmF₂Os)Md(Bk)",
        "path": "/data/samples/unknown/foraged/arch/archlinux.org/aur.archlinux.org/amazon-corretto-11/amazon-corretto-11-11.0.32.9.1-3.src.tar.gz!!amazon-corretto-11/PKGBUILD",
        "pid": 0,
        "risk": 5,
        "sha": "45a1694903c36c00a3fce3234d59c0273e66a1cc33b447dd2c1680c1cd3beddf",
        "size": 1416,
        "traits": [
          {
            "id": "metadata/build/package::pkgbuild-architecture-checksum-arrays",
            "conf": 0.949999988079071,
            "crit": 3,
            "desc": "PKGBUILD defines architecture checksum arrays",
            "spans": [
              [
                1187,
                20
              ]
            ]
          },
          {
            "id": "micro-behaviors/os/sysinfo/platform/arch::architecture-selection-wordlist",
            "conf": 0.9399999976158142,
            "crit": 3,
            "desc": "Selects among multiple CPU architecture payloads",
            "spans": [
              [
                185,
                6
              ]
            ]
          },
          {
            "id": "micro-behaviors/communications/http/download/url::archive-url-reference-b",
            "conf": 0.8799999952316284,
            "crit": 3,
            "desc": "References an HTTP(S) archive URL",
            "spans": [
              [
                514,
                93
              ],
              [
                634,
                97
              ]
            ]
          },
          {
            "id": "micro-behaviors/fs/directory/mkdir::mkdir-command",
            "conf": 0.800000011920929,
            "crit": 3,
            "desc": "Shell invokes mkdir command",
            "spans": [
              [
                887,
                32
              ]
            ]
          },
          {
            "id": "micro-behaviors/fs/shell-ops::cp-command",
            "conf": 0.8999999761581421,
            "crit": 3,
            "desc": "Invokes cp file-copy command",
            "spans": [
              [
                958,
                88
              ]
            ]
          }
        ],
        "type": "shell"
      },
      {
        "depth": 1,
        "facts": {
          "metrics": {
            "file": {
              "size": 1180.0,
              "entropy": 5.28,
              "size_bytes": 1180.0
            },
            "binary": {
              "overall_entropy": 5.28,
              "peak_region_bytes": 1180.0,
              "peak_region_entropy": 5.25
            }
          }
        },
        "id": 2,
        "path": "/data/samples/unknown/foraged/arch/archlinux.org/aur.archlinux.org/amazon-corretto-11/amazon-corretto-11-11.0.32.9.1-3.src.tar.gz!!amazon-corretto-11/.SRCINFO",
        "pid": 0,
        "refs": [
          {
            "to": "pkg:alpm/arch/java-runtime-common",
            "off": 237,
            "kind": "dependency"
          },
          {
            "to": "pkg:alpm/arch/java-environment-common",
            "off": 268,
            "kind": "dependency"
          }
        ],
        "sha": "4dd44f284824e5f7181616f68b4f0010394e687bbc418a0d5ec7eff21b87f37b",
        "size": 1180,
        "type": "src_info"
      },
      {
        "id": 3,
        "sha": "0a2c9ea5099ce9e96c67bee5258c6a4295fcaa9234227e8bb123548f655b086e",
        "path": "java-runtime-common@3-6.registry.json",
        "size": 844,
        "type": "registry",
        "depth": 2
      },
      {
        "id": 4,
        "sha": "c91c258b298739becf2ee59a2d7065962a7b86c04e5f0b09cd8229aa024decf1",
        "path": "java-environment-common@3-6.registry.json",
        "size": 844,
        "type": "registry",
        "depth": 2
      },
      {
        "id": 5,
        "mol": "Md",
        "sha": "9e13abaa9676185bbf3e3400f56414ef727cdb08695e90836dd84018d7f8cb22",
        "path": "amazon-corretto-11@11.0.32.9.1-1.registry.json",
        "risk": 1,
        "size": 872,
        "type": "registry",
        "depth": 1
      }
    ],
    "omitted_files": 3,
    "rev": "2065e",
    "v": "8"
  }
}