{ "llm": { "conf": 0.3205551, "grade": "benign", "model": "Qwen/Qwen3.6-27B", "outcome": "benign", "interpretation": "Standard root check script" }, "ml": { "v": "7", "eng": "2.3.0-beta.1", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.029364407, "rte": "az", "prob": 0.029364407 } ], "prob": 0.029364407, "skip": [ { "rte": "az/tar", "why": "unavailable" }, { "rte": "az/tar", "why": "unavailable" } ], "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.029364407062530518, "type": "tar.gz" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.00033527612686157227, "type": "shell" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.0003719627857208252, "type": "shell" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.00012001395225524902, "type": "src_info" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "registry" }, { "id": 5, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "registry" }, { "id": 6, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "registry" } ], "version": "v18.18", "analyzed_at": "2026-07-10T05:41:02Z" }, "path": "dxvk-gplasync-bin-3.0-1.src.tar.gz", "raw": { "fetched": [ { "size": 17873192, "cached": false, "status": 200, "headers": [ [ "date", "Fri, 10 Jul 2026 05:41:01 GMT" ], [ "content-type", "application/octet-stream" ], [ "content-length", "17873192" ], [ "connection", "keep-alive" ], [ "cf-ray", "a18d3cac4c4ad6f3-IAD" ], [ "cf-cache-status", "MISS" ], [ "accept-ranges", "bytes" ], [ "cache-control", "max-age=60, public, must-revalidate, stale-while-revalidate=60, stale-if-error=300, s-maxage=60" ], [ "content-disposition", "attachment" ], [ "etag", "\"fe57d8e80a95b78ff2e2205a23264374\"" ], [ "server", "cloudflare" ], [ "strict-transport-security", "max-age=31536000" ], [ "vary", "Accept" ], [ "content-security-policy", "base-uri 'self'; child-src https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.googletagmanager.com/ns.html https://*.zuora.com/apps/PublicHostedPageLite.do https://gitlab.com/admin/ https://gitlab.com/assets/ https://gitlab.com/-/speedscope/index.html https://gitlab.com/-/sandbox/ 'self' blob: data: https://embed.figma.com https://www.figma.com https://www.youtube.com; connect-src 'self' https://gitlab.com wss://gitlab.com https://sentry.gitlab.net https://new-sentry.gitlab.net https://customers.gitlab.com https://snowplow.trx.gitlab.net https://sourcegraph.com https://collector.prd-278964.gl-product-analytics.com https://analytics.gitlab.com snowplowprd.trx.gitlab.net; default-src 'self'; font-src 'self'; form-action 'self' https: http:; frame-ancestors 'self'; frame-src https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.googletagmanager.com/ns.html https://*.zuora.com/apps/PublicHostedPageLite.do https://gitlab.com/admin/ https://gitlab.com/assets/ https://gitlab.com/-/speedscope/index.html https://gitlab.com/-/sandbox/ https://embed.figma.com https://www.figma.com https://www.youtube.com; img-src 'self' data: blob: http: https:; manifest-src 'self'; media-src 'self' data: blob: http: https:; object-src 'none'; report-uri https://new-sentry.gitlab.net/api/4/security/?sentry_key=f5573e26de8f4293b285e556c35dfd6e\u0026sentry_environment=gprd; script-src 'strict-dynamic' 'self' 'unsafe-inline' 'unsafe-eval' https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.recaptcha.net/ https://apis.google.com https://*.zuora.com/apps/PublicHostedPageLite.do 'nonce-H331odhftCMVnmCU4m/UTw=='; style-src 'self' 'unsafe-inline'; worker-src 'self' https://gitlab.com/assets/ blob: data:" ], [ "gitlab-lb", "haproxy-main-09-lb-gprd" ], [ "gitlab-sv", "web-gke-us-east1-d" ], [ "nel", "{\"max_age\": 0}" ], [ "permissions-policy", "interest-cohort=()" ], [ "ratelimit-limit", "500" ], [ "ratelimit-name", "throttle_unauthenticated_web" ], [ "ratelimit-observed", "1" ], [ "ratelimit-remaining", "499" ], [ "ratelimit-reset", "1782645120" ], [ "referrer-policy", "strict-origin-when-cross-origin" ], [ "x-content-type-options", "nosniff" ], [ "x-frame-options", "SAMEORIGIN" ], [ "x-gitlab-meta", "{\"correlation_id\":\"a12c40865cc2ce1b-VNO\",\"version\":\"1\"}" ], [ "x-gitlab-namespace", "Ph42oN" ], [ "x-gitlab-score-gitaly", "6" ], [ "x-permitted-cross-domain-policies", "none" ], [ "x-request-id", "a12c40865cc2ce1b-VNO" ], [ "x-runtime", "0.103348" ], [ "x-ua-compatible", "IE=edge" ], [ "x-xss-protection", "1; mode=block" ] ], "locator": "https://gitlab.com/Ph42oN/dxvk-gplasync/-/raw/main/releases/dxvk-gplasync-v3.0-1.tar.gz", "outcome": "ok", "final_url": "https://gitlab.com/Ph42oN/dxvk-gplasync/-/raw/main/releases/dxvk-gplasync-v3.0-1.tar.gz", "fetched_at": 1783662061, "pin_verified": true, "resolved_url": "https://gitlab.com/Ph42oN/dxvk-gplasync/-/raw/main/releases/dxvk-gplasync-v3.0-1.tar.gz", "source_offset": 494, "source_sha256": "61860ace44161ca28feb91611aa45a4c432aaf90c28b98c6b2a0eb12f494b4d3", "content_sha256": "f3d13925baa8124a3b0a6b7cd46ff57e9204426beb42f243dcc17267f7c2c0dc" }, { "size": 5776, "cached": false, "status": 200, "headers": [ [ "server", "nginx" ], [ "date", "Fri, 10 Jul 2026 05:41:01 GMT" ], [ "content-type", "text/plain; charset=UTF-8" ], [ "transfer-encoding", "chunked" ], [ "connection", "keep-alive" ], [ "content-disposition", "inline; filename=\"setup_dxvk.sh\"" ], [ "content-security-policy", "default-src 'none'" ], [ "etag", "W/\"48f1ce29f82fb988ddbea8cbf545ebc71e04778d\"" ], [ "expires", "Fri, 10 Jul 2026 04:24:55 GMT" ], [ "last-modified", "Fri, 10 Jul 2026 03:24:55 GMT" ], [ "x-cgit-cache", "STALE" ], [ "x-content-type-options", "nosniff" ], [ "strict-transport-security", "max-age=31536000; includeSubdomains; preload" ] ], "locator": "https://aur.archlinux.org/cgit/aur.git/plain/setup_dxvk.sh?h=dxvk-mingw\u0026id=15fc8ab6b1bb285df589359c50540b9c14c1f063", "outcome": "ok", "final_url": "https://aur.archlinux.org/cgit/aur.git/plain/setup_dxvk.sh?h=dxvk-mingw\u0026id=15fc8ab6b1bb285df589359c50540b9c14c1f063", "fetched_at": 1783662061, "pin_verified": true, "resolved_url": "https://aur.archlinux.org/cgit/aur.git/plain/setup_dxvk.sh?h=dxvk-mingw\u0026id=15fc8ab6b1bb285df589359c50540b9c14c1f063", "source_offset": 656, "source_sha256": "61860ace44161ca28feb91611aa45a4c432aaf90c28b98c6b2a0eb12f494b4d3", "content_sha256": "b562e8dc9539ef3cd1554c6679eef10aacf21103403d7390a141a41ae146b7a6" } ], "files": [ { "id": 0, "mol": "H₂(CmPo₂)", "sha": "b04cd340645be385f92ccd24f8612ce51bdea4414e2bef2efab8db7e1352bb93", "path": "dxvk-gplasync-bin-3.0-1.src.tar.gz", "risk": 3, "size": 2675, "type": "tar.gz", "facts": { "metrics": { "file": { "size": 2675.0, "entropy": 7.9, "size_bytes": 2675.0 }, "parse": { "error_count": 1.0 }, "binary": { "overall_entropy": 7.9, "peak_region_bytes": 2675.0, "peak_region_entropy": 7.8 } } }, "traits": [ { "id": "micro-behaviors/communications/http/url/github::raw-githubusercontent-script-file", "atk": "T1071.001", "mbc": "C0002", "conf": 0.699999988079071, "crit": 3, "desc": "raw.githubusercontent.com script file URL", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/process/create/shell/spawn::shell-symbols", "conf": 0.8999999761581421, "crit": 3, "desc": "Shell execution symbols", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/create/shell/spawn::sh-dynamic-command-target", "conf": 0.6000000238418579, "crit": 3, "desc": "Shell command name from variable", "from": [ { "file": 1 } ] }, { "id": "metadata/file/extension/identity::shell-a", "conf": 1.0, "crit": 2, "desc": "POSIX shell script extension", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/user/query::id-cmd-shell", "atk": "T1033", "mbc": "E1033", "conf": 0.699999988079071, "crit": 3, "desc": "bare `id` command invocation in shell script", "from": [ { "file": 1 } ] } ] }, { "ctx": [ { "b": "boXZ.B8\u0026{yx(kOnzGWdivrl8", "n": [ { "c": 3, "d": "Shell command execution capability", "i": "micro-behaviors/process/create/shell/spawn::shell-execution-comp", "o": 0, "z": 33, "cf": 0.8999999761581421 } ], "ln": 1, "addr": 0 }, { "b": "", "ln": 2, "addr": 20 }, { "b": "vQTs?wnc6Ea%XNEx(X91zdK?lbQ^XAvpTg*zFHvDw/@oyfD}}\u0026diX", "n": [ { "c": 2, "d": "Read symbolic link target path", "i": "micro-behaviors/fs/link/symlink::readlink", "o": 43, "z": 8, "cf": 0.800000011920929 } ], "ln": 3, "addr": 21 }, { "b": "wnD76jT:\u0026=xk5#ey?$k8gH@D$wnD68whv:Re[w^may)osf!^9QA+c\u003ely?$k8gH@i{e[w^mdf", "n": [ { "c": 2, "d": ".dll extension reference", "i": "micro-behaviors/fs/path/extension::dll-dup", "o": 74, "z": 4, "cf": 0.5 } ], "ln": 4, "addr": 64 }, { "b": "wo-okuU\u003cB=gCSrRvrufCa%ZSaB7F(@AXzU[g9M", "ln": 5, "addr": 122 }, { "b": "wo-okuU\u003cB=hz!=WvrufCa%ZSaB7F(@AXzU}g:h", "n": [ { "c": 1, "d": "Regex component marker", "i": "objectives/command-and-control/dropper/delivery/fetch-exec::arch-args-misc--rx-25", "o": 179, "z": 3, "cf": 0.949999988079071 } ], "ln": 6, "addr": 153 }, { "b": "", "ln": 7, "addr": 184 }, { "b": "Ab](sz/e])CY)\u003ewvrufCc[/Z:AXzGEvrb{jB97#4z7/yqze-{9x\u003c$^)x([Sxz/oDke[uQ+dLCyFy?mVvDU^z9enP3fhz/?nCwg@afjYrJyCg3GgDmoACwg@9z*cmNCSmP*hz^1fx(mE1Cxkr-df", "ln": 8, "addr": 185 }, { "b": "", "ln": 9, "addr": 303 }, { "b": "w{503BzkVhaAg)Ig*+fwuV6!7aBs", "ln": 10, "addr": 304 }, { "b": "arR^Hx\u003ewFhaz2!eAa7)Pc#@)cy\u0026A*8xDO)rB08ULf^m.}j$*CTB$W-Qy?$KZaARpdzu", "n": [ { "c": 2, "d": "Resolve symbolic links to canonical", "i": "micro-behaviors/fs/link/symlink::symlink-resolve", "o": 344, "z": 8, "cf": 0.6600000262260437 }, { "c": 2, "d": "Output/error suppression", "i": "micro-behaviors/os/console/io::output-suppression", "o": 363, "z": 10, "cf": 1.0 } ], "ln": 11, "addr": 327 }, { "b": "arR^HarR^HwN/y(ar\u003cS\u003cBz8^AbRZU?zF%RtwQ4{gBAnS", "ln": 12, "addr": 381 }, { "b": "arR^HarR^HwQ4{hatLR", "ln": 13, "addr": 417 }, { "b": "Ee", "ln": 70, "addr": 1622 }, { "b": "", "ln": 71, "addr": 1624 }, { "b": "x\u003ewF(ar\u00266Vx\u003eetrBTXHSaW3}(fD}SBj0nSUwO}", "n": [ { "c": 3, "d": "bare `id` command invocation in shell script", "i": "micro-behaviors/process/user/query::id-cmd-shell", "o": 1633, "z": 2, "cf": 0.699999988079071 } ], "ln": 72, "addr": 1625 }, { "b": "arR^HarR^HwN/y(ar\u003c%bBS+NkwN({7B-5szxLzJgB7ol8Ac9jhB0bHwz/^cD", "ln": 73, "addr": 1656 }, { "b": "arR^HarR^HwQ4{hatA", "ln": 74, "addr": 1705 }, { "b": "dK+", "ln": 85, "addr": 1820 }, { "b": "arUl9xM21qrC(?*v@D0$x)Ku3ayO=4x(v(Ias7x9BzkVha]", "ln": 86, "addr": 1823 }, { "b": "arUl9xM21qrDzOYwJy}VfD:OlzGx]dy\u00261GtwPI%iA+eJ0tp?BFD2mwizFJJ4", "n": [ { "c": 1, "d": "Regex component marker", "i": "objectives/anti-static/obfuscation/code-metrics/structure::sh-dense-eval-chains-unless-cond-1--rx-3", "o": 1869, "z": 7, "cf": 0.9200000166893005 } ], "ln": 87, "addr": 1861 }, { "b": "arUlux(\u003eEL", "ln": 88, "addr": 1910 }, { "b": "wPIo\u0026", "ln": 89, "addr": 1919 } ], "depth": 1, "facts": { "imp": [ [ "", "dirname" ], [ "", "dirname" ], [ "", "readlink" ], [ "", "readlink" ], [ "", "realpath" ], [ "", "realpath" ], [ "", "echo" ], [ "", "echo" ], [ "", "exit" ], [ "", "exit" ], [ "", "file" ], [ "", "file" ], [ "", "echo" ], [ "", "echo" ], [ "", "return" ], [ "", "return" ], [ "", "echo" ], [ "", "echo" ], [ "", "exit" ], [ "", "exit" ], [ "", "pe64_or_not" ], [ "", "pe64_or_not" ], [ "", "realpath" ], [ "", "realpath" ], [ "", "echo" ], [ "", "echo" ], [ "", "return" ], [ "", "return" ], [ "", "realpath" ], [ "", "realpath" ], [ "", "mv" ], [ "", "mv" ], [ "", "echo" ], [ "", "echo" ], [ "", "rm" ], [ "", "rm" ], [ "", "file_cmd" ], [ "", "realpath" ], [ "", "realpath" ], [ "", "echo" ], [ "", "echo" ], [ "", "return" ], [ "", "return" ], [ "", "realpath" ], [ "", "realpath" ], [ "", "echo" ], [ "", "echo" ], [ "", "return" ], [ "", "return" ], [ "", "mv" ], [ "", "mv" ], [ "", "echo" ], [ "", "echo" ], [ "", "id" ], [ "", "id" ], [ "", "echo" ], [ "", "echo" ], [ "", "exit" ], [ "", "exit" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "exit" ], [ "", "exit" ], [ "", "shift" ], [ "", "shift" ], [ "", "shift" ], [ "", "shift" ], [ "", "printf" ], [ "", "printf" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "break" ], [ "", "break" ], [ "", "exit" ], [ "", "exit" ], [ "", "echo" ], [ "", "echo" ], [ "", "exit" ], [ "", "exit" ], [ "", "echo" ], [ "", "echo" ], [ "", "exit" ], [ "", "exit" ], [ "", "InstallFile" ], [ "", "InstallFile" ], [ "", "RestoreFile" ], [ "", "RestoreFile" ], [ "", "action" ] ], "tgt": [ "$action", "$file_cmd", "InstallFile", "RestoreFile", "break", "dirname", "echo", "exit", "file", "id", "mv", "pe64_or_not", "printf", "readlink", "realpath", "return", "rm", "shift" ], "metrics": { "ast": { "op.gt": 1.0, "op.ne": 1.0, "max_depth": 12.0, "bind_count": 21.0, "call_count": 47.0, "node_count": 954.0, "op_density.gt": 0.0, "op_density.ne": 0.0, "identifier_count": 59.0, "string_literal_count": 57.0, "array_literal_max_length": 5.0 }, "file": { "size": 2842.0, "entropy": 4.89, "size_bytes": 2842.0 }, "text": { "digit_ratio": 0.05, "space_count": 569.0, "total_lines": 145.0, "char_entropy": 4.89, "unique_chars": 74.0, "string_density": 0.39, "avg_line_length": 18.6, "max_line_length": 117.0, "empty_line_ratio": 0.18, "last_line_length": 4.0, "long_token_count": 1.0, "whitespace_ratio": 0.25, "most_common_ratio": 0.06, "identifier_density": 1.46, "line_length_stddev": 18.82, "normalized_string_count": 4.73, "repeated_char_sequences": 7.0, "suspicious_string_ratio": 0.05, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 2.0, "trailing_whitespace_lines": 1.0, "most_common_char_codepoint": 101.0, "normalized_unique_identifiers": 8.5 }, "binds": { "count": 21.0 }, "calls": { "count": 47.0, "dynamic_target_count": 2.0 }, "binary": { "overall_entropy": 4.89, "peak_region_bytes": 2842.0, "peak_region_entropy": 4.87 }, "source": { "function_count": 5.0 }, "strings": { "total": 57.0, "avg_length": 15.79, "max_length": 62.0, "avg_entropy": 3.14, "total_bytes": 900.0, "entropy_stddev": 1.0, "shell_command_strings": 3.0 }, "comments": { "chars": 81.0, "lines": 4.0, "total": 4.0, "to_code_ratio": 0.03 }, "functions": { "count": 5.0, "avg_params": 3.6, "max_params": 7.0, "length_stddev": 7.12, "avg_name_length": 9.4, "avg_length_lines": 14.6, "max_length_lines": 26.0, "min_length_lines": 7.0, "avg_param_name_length": 68.56, "density_per_100_lines": 3.45, "code_in_functions_ratio": 0.5 }, "identifiers": { "count": 59.0, "total": 212.0, "avg_length": 6.89, "max_length": 47.0, "min_length": 1.0, "avg_entropy": 2.05, "reuse_ratio": 0.29, "unique_count": 61.0, "length_stddev": 6.98, "has_digit_ratio": 0.21, "single_char_count": 7.0, "single_char_ratio": 0.11, "high_entropy_count": 5.0, "high_entropy_ratio": 0.08, "all_lowercase_ratio": 0.48, "numeric_suffix_count": 2.0 } } }, "id": 1, "mol": "H(Po₂)", "path": "dxvk-gplasync-bin-3.0-1.src.tar.gz!!dxvk-gplasync-bin/setup_dxvk_proton.sh", "pid": 0, "risk": 2, "sha": "62fae8dd3f15cb4a7e09ccdce83d5554e593558ed88c40600afe6c2b854e1312", "size": 2842, "traits": [ { "id": "metadata/file/extension/identity::shell-a", "conf": 1.0, "crit": 2, "desc": "POSIX shell script extension", "spans": [ [ 0, 20 ] ] }, { "id": "micro-behaviors/process/user/query::id-cmd-shell", "atk": "T1033", "mbc": "E1033", "conf": 0.699999988079071, "crit": 3, "desc": "bare `id` command invocation in shell script", "spans": [ [ 1633, 2 ] ] }, { "id": "micro-behaviors/process/create/shell/spawn::sh-dynamic-command-target", "conf": 0.6000000238418579, "crit": 3, "desc": "Shell command name from variable", "spans": [ [ 0, 33 ] ] }, { "id": "micro-behaviors/process/create/shell/spawn::shell-symbols", "conf": 0.8999999761581421, "crit": 3, "desc": "Shell execution symbols", "spans": [ [ 0, 33 ] ] } ], "type": "shell" }, { "ctx": [ { "b": "boPY?x(n33x(mH5iV}%ABzkf2auTgCxK$K)x\u003c\u003e)4vrrSgB-.Crz!*Faz/^aiz/4V", "n": [ { "c": 3, "d": "Recognized OS-specific execution marker", "i": "objectives/execution/condition/platform::os-specific-execution-recognized-marker", "o": 0, "z": 8, "cf": 0.800000011920929 } ], "ln": 1, "addr": 0 }, { "b": "boPu(zGG]kvS=^hAYLsezE^^4B-OW0B.+]pwP?=$x)1Ftjz[\u003eKvRG$4iwS{kzddc{e[n*pj]", "ln": 2, "addr": 52 }, { "b": "boPu(zGG]kvS=^hAYLsQx\u003c\u003e[3woRE5w/%h\u003ch!WbvxKV0ExkI6\u003ey+xjoz9v", "ln": 3, "addr": 110 }, { "b": "Abf8%wPIuAb0^tLB.\u003e\u00264zy]saB7F(8v@Dj6vrui)x(4H9C{3{iD1z1sw]zYjl${WMv@%H{auq8ffFtdnasICFBz8!fAbn%7D2vamAa9\u0026#xELb", "ln": 11, "addr": 299 }, { "b": "vrb\u003c\u003ejT.X5i5Ub4g::Z", "ln": 12, "addr": 387 }, { "b": "B-IpYb4#7uAc15[fk20vy**^9v@Diqp?RWvz+.@huVo^[zEEx[a]", "n": [ { "c": 2, "d": "HTTPS protocol prefix", "i": "micro-behaviors/communications/http/message::https-prefix", "o": 408, "z": 8, "cf": 0.8999999761581421 } ], "ln": 13, "addr": 403 }, { "b": "y?Wx\u003czGxwLc)%sSx\u003c@V5v@2$2CwH\u00263xjU{\u003ezGElP", "ln": 14, "addr": 445 }, { "b": "wmYZ\u003ezE^/Kc)%gXy?)D%eOOZ9eO]ulwmY^easy#tvLY+\u003eC6dRpvqWVhv}mfcz^^f/AWI$SvQTs\u003ecN/", "ln": 15, "addr": 478 }, { "b": "v@Dl%y?Wy3B3g{0wo-okcM\u003c^EicG6+asyXWC55DO", "ln": 18, "addr": 610 }, { "b": "z/x/jz/fRVc)rUNA+PFw", "ln": 19, "addr": 643 }, { "b": "B8Mhwv}v!Ka%.qKy+Ev[A::eBzddc@flgSuwNPT\u003eB1X!CAbf97vqPNcbWURkv%hB7e{7Jxe[YFO", "n": [ { "c": 1, "d": "Tar.gz archive filename reference", "i": "micro-behaviors/data/archive/extension::tar-gz", "o": 669, "z": 50, "cf": 0.4000000059604645 } ], "ln": 20, "addr": 660 }, { "b": "arR^HarR^Ha%ZJmyIdJ[zdLqgzGWTxz/feh", "ln": 21, "addr": 721 }, { "b": "arR^HarR^HcV-\u003cvB-pX#CY)\u003efAb](sz/dgGxEr", "ln": 22, "addr": 750 }, { "b": "arR^HarR^HcV-\u003cvB-pX#CY)\u003cPB7^P}xMOunB2\u003e%cvrDPyvrb\u003c\u003ey?W^fCRi]Pxd)+cx((1pB-G9Ex((1Ey*?3}flpYDB-pX#CY)\u003cPB7^^Kj.e!XyB%yqzFaeux\u003efvYhd*tTvpzc7f\u003eaPEi5LkUh8)PLh92e7fF$WvvMv{Mg?emLfG7ZmdiG\u0026TxMOunB2\u003e%cA::eAxk8E3BZ/GmwPzp0zGGDcBs}6wz7/Brx([Asyh4Mswo-okfeNo3fL0aKw\u0026jfXvpRqRh8WuDh83$2fK[MGh9281g?p37hdo#Nh7%2ZBAILfwo-oke]$X", "n": [ { "c": 3, "d": "raw.githubusercontent.com URL with executable file extension", "i": "objectives/command-and-control/channel/deaddrop/github::raw-githubusercontent-url", "o": 933, "z": 95, "cf": 0.800000011920929 } ], "ln": 23, "addr": 781 }, { "b": "B7!#qh8YI#zf4\u0026*cUteBf/7*Bhdy05i59fBvkzvDvk.NNv}mzOw[A[VwJqI1g=c%CvR619gg\u0026o#gH$09f/H\u003cCh!C0UggJ1Gv\u003c.", "ln": 24, "addr": 1029 }, { "b": "arR^HarR^HarR^HcOWCng+Z?0hdHkMi5k87vkx\u0026NvQ\u0026\u003e7fKV:%vk8h4i5Ck6w\u0026hz7wIDh4gC{%Dwh2/Hh!j*RhEXBJhE[*9fED", "ln": 25, "addr": 1108 }, { "b": "arUfkat4bAat2f:A+fr6A=#1SzeS@@eoCPywPI%4zeZQIar\u00267IyIdf(AXzMRAXzGEvrb{jwo-oka]", "ln": 33, "addr": 1433 }, { "b": "", "ln": 34, "addr": 1495 }, { "b": "arUxoB97\u0026by-\u003eq$z6g+{h6s7*B8\u003e=3x(U\u003eFwPS6luU1z8yC6Wwa%n6PAbf8%x(U\u003eHB8\u0026{PxKL{)fjYrJyCf:uBAILfwo-oke]$XI", "n": [ { "c": 2, "d": "coreutils install stages a file", "i": "micro-behaviors/fs/write/copy::coreutils-install-file", "o": 1497, "z": 11, "cf": 0.699999988079071 } ], "ln": 35, "addr": 1496 }, { "b": "arUxoB97\u0026by-\u003eq$z6g+{h6s7*B8\u003e=3x(U\u003eFwPS6luU1z8yHq43z//]ne]$XIar\u00267IyIdf(AXzMRAXzGEvrb{jwo-okflpYDB-pX#CY)\u003efAb](sz/dgGxD^", "ln": 36, "addr": 1577 }, { "b": "arUxoB97\u0026by-\u003eruz8Tsfar\u00267IyIdf(AXzMRAXy)ozxY", "ln": 37, "addr": 1672 } ], "depth": 1, "facts": { "imp": [ [ "", "cd" ], [ "", "cd" ], [ "", "exit" ], [ "", "exit" ], [ "", "install" ], [ "", "install" ], [ "", "cp" ], [ "", "cp" ], [ "", "install" ], [ "", "install" ], [ "", "install" ], [ "", "install" ], [ "", "install" ], [ "", "install" ], [ "", "ln" ], [ "", "ln" ], [ "", "ln" ], [ "", "ln" ], [ "", "install" ], [ "", "install" ], [ "", "install" ], [ "", "install" ] ], "tgt": [ "cd", "cp", "exit", "install", "ln" ], "metrics": { "ast": { "max_depth": 7.0, "bind_count": 16.0, "call_count": 11.0, "node_count": 316.0, "identifier_count": 37.0, "string_literal_count": 37.0, "array_literal_max_length": 4.0 }, "file": { "size": 2007.0, "entropy": 5.37, "size_bytes": 2007.0 }, "text": { "digit_ratio": 0.17, "space_count": 149.0, "total_lines": 43.0, "char_entropy": 5.37, "unique_chars": 68.0, "lines_over_200": 1.0, "string_density": 0.86, "avg_line_length": 45.67, "max_line_length": 247.0, "empty_line_ratio": 0.12, "last_line_length": 1.0, "long_token_count": 2.0, "whitespace_ratio": 0.1, "most_common_ratio": 0.05, "identifier_density": 1.86, "line_length_stddev": 42.32, "encoded_string_ratio": 0.11, "normalized_string_count": 5.64, "repeated_char_sequences": 3.0, "most_common_char_is_null": 0.0, "suspicious_comment_ratio": 0.2, "max_inline_whitespace_run": 1.0, "most_common_char_codepoint": 101.0, "normalized_unique_identifiers": 6.82 }, "binds": { "count": 16.0 }, "calls": { "count": 11.0 }, "binary": { "overall_entropy": 5.37, "peak_region_bytes": 2007.0, "peak_region_entropy": 5.38 }, "source": { "function_count": 1.0 }, "strings": { "total": 37.0, "url_count": 1.0, "avg_length": 29.0, "max_length": 130.0, "path_count": 2.0, "avg_entropy": 3.49, "hex_strings": 4.0, "total_bytes": 1073.0, "entropy_stddev": 0.89, "high_entropy_count": 1.0 }, "comments": { "chars": 308.0, "lines": 5.0, "total": 5.0, "to_code_ratio": 0.13, "url_in_comments": 1.0, "high_entropy_comments": 1.0 }, "functions": { "count": 1.0, "avg_params": 10.0, "max_params": 10.0, "avg_name_length": 7.0, "avg_length_lines": 15.0, "max_length_lines": 15.0, "min_length_lines": 15.0, "many_params_count": 1.0, "avg_param_name_length": 8.1, "density_per_100_lines": 2.33, "code_in_functions_ratio": 0.35 }, "identifiers": { "count": 37.0, "total": 80.0, "avg_length": 7.7, "max_length": 36.0, "min_length": 1.0, "avg_entropy": 2.32, "reuse_ratio": 0.46, "unique_count": 37.0, "length_stddev": 7.21, "has_digit_ratio": 0.11, "single_char_count": 1.0, "single_char_ratio": 0.03, "high_entropy_count": 4.0, "high_entropy_ratio": 0.11, "all_lowercase_ratio": 0.62, "numeric_suffix_count": 2.0, "underscore_prefix_count": 2.0 } } }, "id": 2, "mol": "H(Cm)", "path": "dxvk-gplasync-bin-3.0-1.src.tar.gz!!dxvk-gplasync-bin/PKGBUILD", "pid": 0, "risk": 1, "sha": "ad6e37c647320e5de0f347e316b564eeb2609ca9af926a56a9082ca415e666d6", "size": 2007, "traits": [ { "id": "micro-behaviors/communications/http/url/github::raw-githubusercontent-script-file", "atk": "T1071.001", "mbc": "C0002", "conf": 0.699999988079071, "crit": 3, "desc": "raw.githubusercontent.com script file URL", "spans": [ [ 933, 95 ] ] } ], "type": "shell" }, { "depth": 1, "facts": { "metrics": { "file": { "size": 1132.0, "entropy": 5.27, "size_bytes": 1132.0 }, "binary": { "overall_entropy": 5.27, "peak_region_bytes": 1132.0, "peak_region_entropy": 5.27 } } }, "id": 3, "path": "dxvk-gplasync-bin-3.0-1.src.tar.gz!!dxvk-gplasync-bin/.SRCINFO", "pid": 0, "refs": [ { "to": "pkg:alpm/arch/vulkan-icd-loader", "off": 248, "kind": "dependency" }, { "to": "pkg:alpm/arch/lib32-vulkan-icd-loader", "off": 277, "kind": "dependency" }, { "to": "pkg:alpm/arch/bash", "off": 312, "kind": "dependency" }, { "to": "https://gitlab.com/Ph42oN/dxvk-gplasync/-/raw/main/releases/dxvk-gplasync-v3.0-1.tar.gz", "off": 494, "kind": "dependency" }, { "to": "https://aur.archlinux.org/cgit/aur.git/plain/setup_dxvk.sh?h=dxvk-mingw\u0026id=15fc8ab6b1bb285df589359c50540b9c14c1f063", "off": 656, "kind": "dependency" } ], "sha": "61860ace44161ca28feb91611aa45a4c432aaf90c28b98c6b2a0eb12f494b4d3", "size": 1132, "type": "src_info" }, { "depth": 2, "facts": { "metrics": { "file": { "size": 824.0, "entropy": 4.69, "size_bytes": 824.0 }, "binary": { "overall_entropy": 4.69, "peak_region_bytes": 824.0, "peak_region_entropy": 4.69 }, "registry": { "age_days": 19.0, "maintainers": 3.0, "published_at": 1781985939.0, "is_deprecated": 0.0 } } }, "id": 4, "path": "vulkan-icd-loader@1.4.350.1-1.registry.json", "pid": 2, "rel": "registry", "role": "sidecar", "sha": "85244aab726794e63b002020dc6a485107ddba7d7fa42a5effe9e0ae77385b45", "size": 824, "type": "registry" }, { "depth": 2, "facts": { "metrics": { "file": { "size": 839.0, "entropy": 4.73, "size_bytes": 839.0 }, "binary": { "overall_entropy": 4.73, "peak_region_bytes": 839.0, "peak_region_entropy": 4.73 }, "registry": { "age_days": 19.0, "maintainers": 3.0, "published_at": 1781985920.0, "is_deprecated": 0.0 } } }, "id": 5, "path": "lib32-vulkan-icd-loader@1.4.350.1-1.registry.json", "pid": 3, "rel": "registry", "role": "sidecar", "sha": "b8acca61f76be68325e760657cbf311f63b6470a86cecaf3ebef9eccf7d8f301", "size": 839, "type": "registry" }, { "id": 6, "sha": "afbb7c7a6b5c859c108f46062838295af19b32357dc204701a28c2a7bc05637a", "path": "bash@5.3.15-1.registry.json", "size": 815, "type": "registry", "depth": 2 } ], "omitted_files": 1, "v": "8" } }