{
  "ml": {
    "l": -1,
    "v": "6",
    "fs": [
      {
        "l": -1,
        "id": 0,
        "prob": 0.05712823569774628
      }
    ],
    "prob": 0.057128236,
    "models": [
      {
        "m": "az",
        "raw": 0.000007688999,
        "prob": 0.057128236,
        "class": 0
      },
      {
        "m": "az/source",
        "raw": 0.018180272,
        "prob": 0.08830437,
        "class": 0
      },
      {
        "m": "az/c",
        "raw": 0.083069645,
        "prob": 0.27456647,
        "class": 0
      }
    ],
    "version": "v17.17",
    "analyzed_at": "2026-06-07T15:25:39Z"
  },
  "path": "clr.h",
  "raw": {
    "v": "6",
    "fs": [
      {
        "f": "H(Ds)",
        "x": 2,
        "ff": {
          "m": {
            "ast": {
              "max_depth": 11.0,
              "call_count": 0.0,
              "node_count": 5508.0,
              "identifier_count": 444.0
            },
            "file": {
              "size": 31487.0,
              "entropy": 4.78,
              "size_bytes": 31487.0
            },
            "text": {
              "digit_ratio": 0.01,
              "space_count": 9000.0,
              "total_lines": 916.0,
              "char_entropy": 4.78,
              "unique_chars": 79.0,
              "avg_line_length": 33.37,
              "max_line_length": 87.0,
              "empty_line_ratio": 0.18,
              "last_line_length": 6.0,
              "whitespace_ratio": 0.31,
              "most_common_ratio": 0.04,
              "identifier_density": 1.54,
              "line_length_stddev": 17.76,
              "repeated_char_sequences": 232.0,
              "most_common_char_is_null": 0.0,
              "suspicious_comment_ratio": 0.01,
              "max_inline_whitespace_run": 20.0,
              "trailing_whitespace_lines": 214.0,
              "most_common_char_codepoint": 101.0,
              "suspicious_identifier_ratio": 0.04,
              "normalized_unique_identifiers": 45.13
            },
            "binary": {
              "overall_entropy": 4.78
            },
            "source": {
              "class_count": 25.0
            },
            "comments": {
              "chars": 2375.0,
              "lines": 115.0,
              "total": 87.0,
              "to_code_ratio": 0.14,
              "high_entropy_comments": 1.0
            },
            "functions": {
              "count": 25.0
            },
            "identifiers": {
              "count": 444.0,
              "total": 1409.0,
              "avg_length": 13.74,
              "max_length": 33.0,
              "min_length": 1.0,
              "avg_entropy": 3.18,
              "reuse_ratio": 0.32,
              "unique_count": 444.0,
              "length_stddev": 6.17,
              "has_digit_ratio": 0.15,
              "sequential_names": 1.0,
              "base64_like_names": 13.0,
              "single_char_count": 1.0,
              "single_char_ratio": 0.0,
              "high_entropy_count": 126.0,
              "high_entropy_ratio": 0.28,
              "all_lowercase_ratio": 0.02,
              "all_uppercase_ratio": 0.05,
              "numeric_suffix_count": 63.0,
              "keyboard_pattern_names": 2.0,
              "underscore_prefix_count": 20.0
            }
          },
          "s": [
            [
              10046,
              "10",
              "0"
            ],
            [
              10093,
              "10",
              "1"
            ],
            [
              10140,
              "10",
              "2"
            ],
            [
              10187,
              "10",
              "4"
            ],
            [
              10234,
              "10",
              "8"
            ],
            [
              10281,
              "10",
              "16"
            ],
            [
              10329,
              "10",
              "32"
            ],
            [
              10377,
              "10",
              "64"
            ],
            [
              10425,
              "10",
              "256"
            ],
            [
              10474,
              "10",
              "512"
            ],
            [
              10523,
              "10",
              "1024"
            ],
            [
              10573,
              "10",
              "2048"
            ],
            [
              10623,
              "10",
              "4096"
            ],
            [
              10673,
              "10",
              "8192"
            ],
            [
              10723,
              "10",
              "16384"
            ],
            [
              10774,
              "10",
              "32768"
            ],
            [
              10825,
              "10",
              "65536"
            ],
            [
              10876,
              "10",
              "131072"
            ],
            [
              10928,
              "10",
              "262144"
            ],
            [
              10980,
              "10",
              "16777216"
            ],
            [
              20335,
              "xor",
              "rVLWnRVPP7/bin56"
            ],
            [
              22355,
              "xor",
              "zwZDeMWNRQXvP35bid"
            ]
          ],
          "v": {
            "file.stem": "clr",
            "file.basename": "clr.h",
            "source.language": "c",
            "source.strings[0]": "131072",
            "source.strings[1]": "16777216",
            "source.strings[2]": "262144",
            "source.strings[3]": "rVLWnRVPP7/bin56",
            "source.strings[4]": "zwZDeMWNRQXvP35bid"
          },
          "id": "c"
        },
        "id": 0,
        "sz": 31487,
        "ts": [
          {
            "c": 0.8799999952316284,
            "d": "Codebase deletion target",
            "e": [
              "code"
            ],
            "i": "micro-behaviors/data/text/keywords/lexicon::target-codebase",
            "l": 1
          },
          {
            "a": "T1574.002",
            "c": 0.949999988079071,
            "d": "Windows GetProcAddress in source",
            "e": [
              "GetProcAddress"
            ],
            "i": "micro-behaviors/dylib/lookup::get-proc-address-source",
            "l": 2
          },
          {
            "a": "T1574.002",
            "c": 0.9200000166893005,
            "d": "Dynamic library load in source",
            "e": [
              "LoadLibrary"
            ],
            "i": "micro-behaviors/dylib/load/source::load-library-source",
            "l": 3
          },
          {
            "c": 0.8799999952316284,
            "d": "Source or test deletion target",
            "e": [
              "source code"
            ],
            "i": "micro-behaviors/data/text/keywords/lexicon::target-source-test",
            "l": 1
          }
        ],
        "sha": "af45d08acf5108af6988889a2ccbe6f9b8ba9fb84e6f141ed2a52a214775bc4a",
        "path": "clr.h",
        "type": "c"
      }
    ],
    "tv": "318d5"
  }
}