{
  "llm": {
    "conf": 0.38772285,
    "grade": "benign",
    "model": "Qwen/Qwen3.6-27B",
    "outcome": "benign",
    "interpretation": "Standard chocolatey package installation script"
  },
  "ml": {
    "v": "7",
    "eng": "2.3.0-beta.0",
    "lvl": -1,
    "conf": 0,
    "mods": [
      {
        "cls": 0,
        "raw": 0.12531835,
        "rte": "az",
        "prob": 0.12531835
      }
    ],
    "prob": 0.12531835,
    "skip": [
      {
        "rte": "az/zip",
        "why": "unavailable"
      },
      {
        "rte": "az/zip",
        "why": "unavailable"
      }
    ],
    "files": [
      {
        "id": 0,
        "lvl": -1,
        "conf": 0,
        "prob": 0.12531834840774536,
        "type": "nupkg"
      },
      {
        "id": 1,
        "lvl": -1,
        "conf": 0,
        "prob": 0.00012001395225524902,
        "type": "xml"
      },
      {
        "id": 2,
        "lvl": -1,
        "conf": 0,
        "prob": 0.002773970365524292,
        "type": "xml"
      },
      {
        "id": 3,
        "lvl": -1,
        "conf": 0,
        "prob": 0.0001284778118133545,
        "type": "powershell"
      },
      {
        "id": 4,
        "lvl": -1,
        "conf": 0,
        "prob": 0.0011684298515319824,
        "type": "powershell"
      },
      {
        "id": 5,
        "lvl": -1,
        "conf": 0,
        "prob": 0.000041097402572631836,
        "type": "xml"
      },
      {
        "id": 6,
        "lvl": -1,
        "conf": 0,
        "prob": 0.00012001395225524902,
        "type": "xml"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-07-07T02:04:50Z"
  },
  "path": "Executor.nupkg",
  "raw": {
    "files": [
      {
        "id": 0,
        "ctx": [
          {
            "b": "p!H([6Awak2MR*B!)8JIoIMl4008Y[000xb003wDwO=Ave]\u003eJtBcR)zy63a3m^*.kHMD\u003eb\u0026S",
            "n": [
              {
                "c": 3,
                "d": "Staged loader six file archive",
                "i": "objectives/command-and-control/backdoor/loader/archive::staged-loader-six-files",
                "o": 0,
                "z": 25,
                "cf": 0.949999988079071
              }
            ],
            "ln": 0
          }
        ],
        "mol": "O(C)H₂(CmPo)",
        "sha": "a9651b6ec123ba8c71d28da59ff00298978c97e5f5ed2724c018b9a7f6784fe6",
        "path": "Executor.nupkg",
        "risk": 3,
        "size": 3600,
        "type": "nupkg",
        "facts": {
          "metrics": {
            "file": {
              "size": 3600.0,
              "entropy": 7.69,
              "size_bytes": 3600.0
            },
            "binary": {
              "overall_entropy": 7.69,
              "peak_region_bytes": 3072.0,
              "peak_region_entropy": 7.78
            },
            "archive": {
              "file_count": 6.0,
              "member_count": 6.0,
              "script_count": 2.0,
              "zip_bomb_ratio": 2.27,
              "directory_count": 0.0,
              "executable_count": 0.0,
              "extra_field_size": 0.0,
              "noise_file_count": 0.0,
              "total_compressed": 2752.0,
              "compression.ratio": 0.54,
              "hidden_file_count": 1.0,
              "total_uncompressed": 5112.0,
              "crc_collision_count": 0.0,
              "entry_comment_count": 0.0,
              "max_filename_length": 81.0,
              "rtlo_filename_count": 0.0,
              "format.regular_count": 6.0,
              "nested_archive_count": 0.0,
              "path_traversal_count": 0.0,
              "symlink_escape_count": 0.0,
              "security.setgid_count": 0.0,
              "security.setuid_count": 0.0,
              "security.sticky_count": 0.0,
              "double_extension_count": 0.0,
              "duplicate_member_count": 0.0,
              "security.symlink_count": 0.0,
              "unicode_filename_count": 0.0,
              "homoglyph_filename_count": 0.0,
              "security.encrypted_count": 0.0,
              "timing.mtime_unique_count": 3.0,
              "timing.mtime_unique_ratio": 0.5,
              "misplaced_executable_count": 0.0,
              "timing.mtime_outlier_count": 2.0,
              "timing.mtime_dominant_count": 4.0,
              "timing.mtime_spread_seconds": 632.0,
              "timing.sentinel_mtime_count": 0.0,
              "security.world_writable_count": 0.0,
              "timing.mtime_dominant_fraction": 0.67,
              "compression.method_counts.deflate": 6.0
            }
          }
        },
        "ident": {
          "name": {
            "value": "Executor",
            "source": "nupkg.title",
            "verified": false
          },
          "urls": [
            {
              "url": "http://executor.dk/",
              "kind": "homepage",
              "source": "nupkg.project_url"
            }
          ],
          "trust": "unsigned",
          "authors": [
            {
              "name": "Martin Bresson",
              "role": "author",
              "source": "nupkg.authors"
            },
            {
              "name": "tunisiano",
              "role": "owner",
              "source": "nupkg.owners"
            }
          ],
          "version": {
            "value": "2.3.8",
            "source": "nupkg.version",
            "verified": false
          },
          "identifier": {
            "value": "Executor",
            "source": "nupkg.id",
            "verified": false
          }
        },
        "traits": [
          {
            "id": "micro-behaviors/fs/path/extension::exe-dup",
            "crit": 2,
            "desc": ".exe extension reference",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/lib/invoke-webrequest::uri-literal",
            "atk": "T1071.001",
            "mbc": "C0002",
            "conf": 0.75,
            "crit": 3,
            "desc": "HTTP/HTTPS URL literal",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "micro-behaviors/process/terminate/kill::stop-process",
            "conf": 0.8799999952316284,
            "crit": 3,
            "desc": "PowerShell stops process",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "objectives/command-and-control/backdoor/loader/archive::staged-loader-six-files",
            "conf": 0.949999988079071,
            "crit": 3,
            "desc": "Staged loader six file archive",
            "spans": [
              [
                0,
                25
              ]
            ]
          }
        ]
      },
      {
        "depth": 1,
        "facts": {
          "metrics": {
            "file": {
              "size": 502.0,
              "entropy": 5.21,
              "size_bytes": 502.0
            },
            "binary": {
              "overall_entropy": 5.21,
              "peak_region_bytes": 502.0,
              "peak_region_entropy": 5.21
            }
          }
        },
        "id": 1,
        "path": "Executor.nupkg!!_rels/.rels",
        "sha": "808b2aa59fc2abcd799d71601086f337d71036701893f4e306de5d03faaced9c",
        "size": 502,
        "type": "xml"
      },
      {
        "ctx": [
          {
            "b": "[4ls%kx}3YaA?spB7]MgjT8QkfD}SJzEWP}x(mMDb6w0teJs}sj]",
            "n": [
              {
                "c": 2,
                "d": "NuGet nuspec manifest file",
                "i": "metadata/build/manifest::nuspec-file",
                "o": 0,
                "z": 15,
                "cf": 0.9800000190734863
              }
            ],
            "ln": 1,
            "addr": 0
          },
          {
            "b": "jAa.syHH\u003c!aB4:tzGv@+xMOuniXJdcv}YB\u003cvrj5rx\u003e8g4B8LVje[n*pfk$ufyHH\u003c\u0026zF7QTfFLpnfGp.6B-RIkv\u003eJ1EwfKh",
            "ln": 2,
            "addr": 43
          },
          {
            "b": "arS^-wPRu\u003evrt{w",
            "ln": 3,
            "addr": 120
          }
        ],
        "depth": 1,
        "facts": {
          "metrics": {
            "file": {
              "size": 1972.0,
              "entropy": 5.07,
              "size_bytes": 1972.0
            },
            "binary": {
              "overall_entropy": 5.07,
              "peak_region_bytes": 1972.0,
              "peak_region_entropy": 5.04
            }
          }
        },
        "id": 2,
        "path": "Executor.nupkg!!Executor.nuspec",
        "risk": 1,
        "sha": "68835cbbbb3a187e3f3cd152e33645887afc0ff29dd5e1e01f14e6fc0532e7bd",
        "size": 1972,
        "traits": [
          {
            "id": "metadata/build/manifest::nuspec-file",
            "conf": 0.9800000190734863,
            "crit": 2,
            "desc": "NuGet nuspec manifest file",
            "spans": [
              [
                0,
                15
              ]
            ]
          }
        ],
        "type": "xml"
      },
      {
        "ctx": [
          {
            "b": "[4lsWmriA!AZshSx(v(=A+e\u0026]A+fb#wGTbUcStb9A3\u003e",
            "n": [
              {
                "c": 2,
                "d": "Script overall entropy stays low",
                "i": "metadata/file/metrics::low-overall-entropy-source",
                "o": 0,
                "z": 29,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 1,
            "addr": 0
          },
          {
            "b": "x\u003ewFobU\u0026F#y-\u003ervAuDVxwPPIyA=kD0B8@DFmr\u0026xNB-.Lxa%nEGviwG.y?mHay\u003cwx^zGGPgB.90JaBs",
            "ln": 2,
            "addr": 35
          },
          {
            "b": "arT:ax()]rpJZ+#B-X-Imr\u0026xNB-.LxawLZiaAzQxzFs03e*p",
            "ln": 3,
            "addr": 98
          },
          {
            "b": "Eir9qB7DFv",
            "ln": 4,
            "addr": 137
          },
          {
            "b": "arT:ax()]rpJZ+#B-X-Iq/(}%Aa%i5avQJ^v%8)iAV/swz!0v1B1P6$a]",
            "ln": 5,
            "addr": 146
          },
          {
            "b": "arTQ8z/vp8A=kD0B8@DQAb](bwPI{gvqPM#b1l-/v%8)iAV$",
            "n": [
              {
                "c": 3,
                "d": "PowerShell stops process",
                "i": "micro-behaviors/process/terminate/kill::stop-process",
                "o": 194,
                "z": 12,
                "cf": 0.8799999952316284
              }
            ],
            "ln": 6,
            "addr": 192
          },
          {
            "b": "Ee",
            "ln": 7,
            "addr": 231
          },
          {
            "b": "",
            "ln": 8,
            "addr": 233
          }
        ],
        "depth": 1,
        "facts": {
          "tgt": [
            "Stop-Process",
            "Write-Output",
            "get-process"
          ],
          "metrics": {
            "ast": {
              "max_depth": 22.0,
              "call_count": 4.0,
              "node_count": 121.0,
              "identifier_count": 6.0,
              "string_literal_count": 5.0,
              "array_literal_max_length": 1.0
            },
            "file": {
              "size": 233.0,
              "entropy": 4.74,
              "size_bytes": 233.0
            },
            "text": {
              "space_count": 25.0,
              "total_lines": 7.0,
              "char_entropy": 4.74,
              "unique_chars": 42.0,
              "string_density": 0.71,
              "avg_line_length": 32.29,
              "high_byte_ratio": 0.01,
              "max_line_length": 62.0,
              "non_ascii_ratio": 0.01,
              "last_line_length": 1.0,
              "whitespace_ratio": 0.14,
              "most_common_ratio": 0.09,
              "identifier_density": 1.0,
              "line_length_stddev": 19.57,
              "normalized_string_count": 1.89,
              "suspicious_string_ratio": 0.2,
              "most_common_char_is_null": 0.0,
              "max_inline_whitespace_run": 1.0,
              "most_common_char_codepoint": 101.0,
              "normalized_unique_identifiers": 2.14
            },
            "calls": {
              "count": 4.0
            },
            "binary": {
              "overall_entropy": 4.74,
              "peak_region_bytes": 233.0,
              "peak_region_entropy": 4.74
            },
            "strings": {
              "total": 5.0,
              "avg_length": 13.8,
              "max_length": 28.0,
              "avg_entropy": 3.15,
              "total_bytes": 69.0,
              "entropy_stddev": 0.7,
              "embedded_code_candidates": 1.0
            },
            "identifiers": {
              "count": 6.0,
              "total": 7.0,
              "avg_length": 13.0,
              "max_length": 22.0,
              "min_length": 5.0,
              "avg_entropy": 2.96,
              "reuse_ratio": 0.86,
              "unique_count": 6.0,
              "length_stddev": 5.16
            }
          }
        },
        "id": 3,
        "mol": "H(Po)",
        "path": "Executor.nupkg!!tools/chocolateyBeforeModify.ps1",
        "risk": 1,
        "sha": "fb60d030ac4b51f7695a6200349258fa048da0655f59967bb831f304dba9a64a",
        "size": 233,
        "traits": [
          {
            "id": "micro-behaviors/process/terminate/kill::stop-process",
            "conf": 0.8799999952316284,
            "crit": 3,
            "desc": "PowerShell stops process",
            "spans": [
              [
                194,
                12
              ]
            ]
          }
        ],
        "type": "powershell"
      },
      {
        "ctx": [
          {
            "b": "arR^Hp*)\u003cHvp%dDvqPM#arR^HjS(1YzGX6dxM4y0y*?A%C#d{VyHH\u003c!pgn0J",
            "ln": 4,
            "addr": 57
          },
          {
            "b": "arR^HmRMWIrc-B]arR^HarR^HjS(a-CX5l",
            "ln": 5,
            "addr": 107
          },
          {
            "b": "arR^HrDq)#arR^HarR^HarR^HjS(a=BAzFyiXJc$CX7xcBz(gLwnr\u0026qA+fAdz/{biz*c8nz^^f$fgya%v%8)iA-lK\u003eB-o5\u0026f!N3ZwHv",
            "n": [
              {
                "c": 3,
                "d": "HTTP/HTTPS URL literal",
                "i": "micro-behaviors/communications/http/lib/invoke-webrequest::uri-literal",
                "o": 159,
                "z": 19,
                "cf": 0.75
              },
              {
                "c": 3,
                "d": "References Windows executable or script",
                "i": "objectives/execution/interpreter/script/shell::windows-executable-ref",
                "o": 213,
                "z": 4,
                "cf": 0.6000000238418579
              }
            ],
            "ln": 6,
            "addr": 136
          },
          {
            "b": "arR^HlUH4vyJBSnarR^HarR^HjS(aaf\u003e1H3wh=m$ia+9df/rJ0gH@mKiwSVQvL//Jgc4p8wh#w1h!3xhhEOK0hdy8QvMckTf/p}3fFCBzvkRKx",
            "ln": 7,
            "addr": 220
          },
          {
            "b": "arR^HlUH4vyJBSnrc-B]arR^HjS(a[xKJUNhyw",
            "n": [
              {
                "c": 2,
                "d": "sha256 hash algorithm",
                "i": "micro-behaviors/crypto/hash/digest::sha256-keyword",
                "o": 333,
                "z": 6,
                "cf": 0.6000000238418579
              }
            ],
            "ln": 8,
            "addr": 310
          },
          {
            "b": "arR^Hq!Z5VzGFf+xlbgrarR^HjS(a9rZ/[?q+oUKpe\u0026t?q=MT\u003cqBKI.o\u0026BLGpGQ4:atlF=qBKI-k#HV8fh\u003eX0cJ",
            "ln": 9,
            "addr": 342
          },
          {
            "b": "Ee",
            "ln": 10,
            "addr": 413
          }
        ],
        "depth": 1,
        "facts": {
          "tgt": [
            "Install-ChocolateyPackage"
          ],
          "metrics": {
            "ast": {
              "max_depth": 30.0,
              "call_count": 1.0,
              "node_count": 171.0,
              "identifier_count": 11.0,
              "string_literal_count": 6.0,
              "array_literal_max_length": 1.0
            },
            "file": {
              "size": 456.0,
              "entropy": 5.24,
              "size_bytes": 456.0
            },
            "text": {
              "digit_ratio": 0.15,
              "space_count": 82.0,
              "total_lines": 11.0,
              "char_entropy": 5.24,
              "unique_chars": 68.0,
              "string_density": 0.55,
              "avg_line_length": 39.45,
              "high_byte_ratio": 0.01,
              "max_line_length": 88.0,
              "non_ascii_ratio": 0.01,
              "empty_line_ratio": 0.09,
              "last_line_length": 38.0,
              "whitespace_ratio": 0.23,
              "most_common_ratio": 0.07,
              "identifier_density": 1.0,
              "line_length_stddev": 28.49,
              "encoded_string_ratio": 0.17,
              "normalized_string_count": 1.81,
              "repeated_char_sequences": 1.0,
              "most_common_char_is_null": 0.0,
              "max_inline_whitespace_run": 13.0,
              "most_common_char_codepoint": 101.0,
              "normalized_unique_identifiers": 3.18
            },
            "calls": {
              "count": 1.0
            },
            "binary": {
              "overall_entropy": 5.24,
              "peak_region_bytes": 456.0,
              "peak_region_entropy": 5.24
            },
            "strings": {
              "total": 6.0,
              "url_count": 1.0,
              "avg_length": 30.0,
              "max_length": 64.0,
              "path_count": 1.0,
              "avg_entropy": 2.93,
              "hex_strings": 1.0,
              "total_bytes": 180.0,
              "entropy_stddev": 1.2
            },
            "identifiers": {
              "count": 11.0,
              "total": 11.0,
              "avg_length": 13.55,
              "max_length": 26.0,
              "min_length": 3.0,
              "avg_entropy": 3.13,
              "reuse_ratio": 1.0,
              "unique_count": 11.0,
              "length_stddev": 7.11,
              "high_entropy_count": 2.0,
              "high_entropy_ratio": 0.18
            }
          }
        },
        "id": 4,
        "mol": "H(Cm)",
        "path": "Executor.nupkg!!tools/ChocolateyInstall.ps1",
        "risk": 1,
        "sha": "9ada619bd2baec79a2cf1ac46c2988744009c2681bb756f045f18d9a2723821a",
        "size": 456,
        "traits": [
          {
            "id": "micro-behaviors/communications/http/lib/invoke-webrequest::uri-literal",
            "atk": "T1071.001",
            "mbc": "C0002",
            "conf": 0.75,
            "crit": 3,
            "desc": "HTTP/HTTPS URL literal",
            "spans": [
              [
                159,
                19
              ]
            ]
          },
          {
            "id": "micro-behaviors/fs/path/extension::exe-dup",
            "crit": 2,
            "desc": ".exe extension reference",
            "spans": [
              [
                213,
                4
              ]
            ]
          }
        ],
        "type": "powershell"
      },
      {
        "depth": 1,
        "facts": {
          "metrics": {
            "file": {
              "size": 465,
              "entropy": 4.87
            },
            "binary": {
              "peak_region_bytes": 465,
              "peak_region_entropy": 4.87
            }
          }
        },
        "id": 5,
        "path": "Executor.nupkg!![Content_Types].xml",
        "pid": 0,
        "risk": 1,
        "sha": "07afe6f2cc5b9ef31efb02bf99c5601166fe1e5ba9a0c5459d19e6842a54e84c",
        "size": 465,
        "traits": [
          {
            "id": "metadata/file/extension/identity::doc-or-config-extension",
            "conf": 1.0,
            "crit": 2,
            "desc": "Text, document, or config extension"
          }
        ],
        "type": "xml"
      },
      {
        "id": 6,
        "sha": "b55c6a21b5ec1005972bf0c7d1b3571b1e6e3523237c11ca3e4ea71ba578d94b",
        "path": "Executor.nupkg!!package/services/metadata/core-properties/990db6f2e2704907ae952343bb1f3d8a.psmdcp",
        "size": 1484,
        "type": "xml",
        "depth": 1
      }
    ],
    "omitted_files": 1,
    "rev": "20834",
    "v": "8"
  }
}