{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9145503640174866, "class": 0 } ], "prob": 0.91455036, "class": 0, "version": "v16.16", "thresholds": [ 0.9815004, 0.99404883 ], "analyzed_at": "2026-04-30T03:49:52Z" }, "path": "vector.h", "raw": { "v": "4", "fs": [ { "f": "O(Erâ‚‚)", "id": 0, "ms": { "text": { "tab_count": 34.0, "digit_ratio": 0.0, "space_count": 2297.0, "total_lines": 475.0, "char_entropy": 4.95, "mixed_indent": true, "unique_chars": 84.0, "string_density": 0.01, "ascii_art_lines": 2.0, "avg_line_length": 27.02, "max_line_length": 80.0, "empty_line_ratio": 0.18, "last_line_length": 21.0, "most_common_char": "e", "whitespace_ratio": 0.21, "most_common_ratio": 0.08, "identifier_density": 0.26, "line_length_stddev": 26.64, "normalized_string_count": 0.18, "repeated_char_sequences": 9.0, "suspicious_comment_ratio": 0.01, "max_inline_whitespace_run": 14.0, "suspicious_identifier_ratio": 0.08, "normalized_unique_identifiers": 8.1 }, "strings": { "total": 4.0, "avg_length": 10.25, "max_length": 11.0, "avg_entropy": 3.11, "total_bytes": 41.0, "entropy_stddev": 0.13 }, "comments": { "chars": 10063.0, "lines": 280.0, "total": 78.0, "to_code_ratio": 1.44, "high_entropy_comments": 1.0 }, "functions": {}, "identifiers": { "total": 124.0, "avg_length": 10.38, "max_length": 22.0, "min_length": 1.0, "avg_entropy": 2.67, "reuse_ratio": 0.58, "unique_count": 72.0, "length_stddev": 5.06, "has_digit_ratio": 0.01, "sequential_names": 6.0, "single_char_count": 6.0, "single_char_ratio": 0.08, "high_entropy_count": 8.0, "high_entropy_ratio": 0.11, "all_lowercase_ratio": 0.63, "all_uppercase_ratio": 0.26, "numeric_suffix_count": 1.0, "underscore_prefix_count": 1.0 } }, "ss": [ [ 1690, "\u003cstdbool.h\u003e" ], [ 1711, "\u003cstddef.h\u003e" ], [ 1731, "\u003cstdint.h\u003e" ], [ 1752, "\u003cstatus.h\u003e" ], [ 137, "xor", "SR9(;'ij*eifi" ], [ 184, "xor", "HU$ ! gHifCts" ], [ 336, "xor", "XEp\"6'sHifCts" ], [ 424, "xor", "BI#Esyibi '-" ], [ 474, "xor", "FA9\"6!gHifCts" ], [ 1780, "xor", "DD57s5\u00260i-i98Po2Os8\":Kd6%$)eOD" ], [ 1898, "xor", "ERp960=-;?gt" ], [ 2257, "xor", "CDzo#';krFCw0Fo" ], [ 2523, "xor", "Is956hCHj)'00Foi" ], [ 3452, "xor", "CCp =s 6gF@71A=l" ], [ 3562, "xor", "ONkEYZfmfl" ], [ 3620, "xor", "OM#o02'b/%=t0No2H6_Jg" ], [ 3673, "xor", "KPkEYZfmfl" ], [ 3727, "xor", "XN5+s10b:%316Fgo" ], [ 3755, "xor", "PEkEYZfmfl" ], [ 3822, "xor", "OCkEY|chClct" ], [ 3949, "xor", "XN5+s10b:%316Fgo" ], [ 4070, "xor", "XI3;s%eb:%31" ], [ 4106, "xor", "X\tkEY|chClct" ], [ 4203, "xor", "FR5.7*gHifi" ], [ 4240, "xor", "OX .=7gHifi" ], [ 4321, "xor", "XI3;s%eb:%31" ], [ 4515, "xor", "XI3;s%eb:%31" ], [ 4559, "xor", "LFp;;6i (/\"t6Fo2H6u5-C0.?og" ], [ 4662, "xor", "EPp 55i-/bCts" ], [ 4753, "xor", "XI3;s%eb:%31" ], [ 4828, "xor", "BEp960=-;bi" ], [ 4852, "xor", "YTZoys!#?)i5-" ], [ 5006, "xor", "EPp 55i-/bCts" ], [ 5145, "xor", "XI3;s%eb:%31" ], [ 5200, "xor", "ENp;;6i (/\"t6Fo2H6u5-C0.?og" ], [ 5294, "xor", "CPp 5s=*,l-5-AaL" ], [ 5483, "xor", "ENp;;6i (/\"t6Fo2H6u5-C0.?og" ], [ 5577, "xor", "CPp 5s=*,l-5-AaL" ], [ 5726, "xor", "XI3;s%eb:%31" ], [ 5914, "xor", "\\E#o2=Cbcl,,-R.fM68 8YlhcKgo" ], [ 6099, "xor", "EN$ s2i 08,76D*fV667'Rja" ], [ 6222, "xor", "NEp960=-;bCts" ], [ 6390, "xor", "EN$ s2i 08,76D*fV667'Rja" ], [ 6441, "xor", "NEZoys?'*8\u0026\u0026w" ], [ 6682, "xor", "XI3;s%eb:%31" ], [ 6832, "xor", "BEp960=-;egt" ], [ 7163, "xor", "CDzo72=#el:=#E" ], [ 7182, "xor", "R\tkEY|chClct" ], [ 7441, "xor", "B*pessibility" ], [ 7566, "xor", "XI3;s%eb:%31" ], [ 7609, "xor", "X\tkEY|chClct" ], [ 7723, "xor", "FR5.7*gHifi" ], [ 7886, "xor", "X\tkEY|chClct" ], [ 7970, "xor", "YTp-6Yihi-i71A=fV667'" ], [ 8028, "xor", "CC$o%zrHCo 2yb" ], [ 8246, "xor", "XE #20,lClct" ], [ 8343, "xor", "XI3;s%eb:%31" ], [ 8375, "xor", "NA$.zhCHj)'00Foi" ], [ 8506, "xor", "ERp960=-;?gt" ], [ 8556, "xor", "BEp960=-;bCts" ], [ 8628, "xor", "jR5;\u0026!'bilit" ], [ 8712, "xor", "XI3;s%eb:%31" ], [ 8729, "xor", "R\tkEY|chClct" ], [ 8824, "xor", "BE\"o860b/9'7-I (" ], [ 8842, "xor", "ERp960=-;?gt" ], [ 8892, "xor", "BEp960=-;bCts" ], [ 8964, "xor", "jR5;\u0026!'bilit" ], [ 9062, "xor", "XI3;s%eb:%31" ], [ 9079, "xor", "R\tkEY|chClct" ], [ 9132, "xor", "FO3.'6-lClct" ], [ 9352, "xor", "I\tkEY|chClct" ], [ 9597, "xor", "N*pessibility" ], [ 9626, "xor", "ON$\u0026'*gHifi" ], [ 9785, "xor", "G*pessibility" ], [ 9819, "xor", "XE$:!=ibilit" ], [ 9960, "xor", "uTp\u00267+eHility" ], [ 9999, "xor", "C\tkEY|chClct" ], [ 10194, "xor", "XE$:!=ibilit" ], [ 10254, "xor", "X*pessibility" ], [ 10528, "xor", "jR5;\u0026!'bilit" ], [ 10617, "xor", "XI3;s%eb:%31" ], [ 10690, "xor", "BEp960=-;bCts" ], [ 10738, "xor", "OMp 55i-/bCts" ], [ 10828, "xor", "BEp960=-;bCts" ], [ 10877, "xor", "GSp 55i-/bCts" ], [ 11085, "xor", "EPp 5s:6(/\"t6FaL" ], [ 11185, "xor", "YE\"96s(1i-i98PaL" ], [ 11235, "xor", "CZ5aYscmCo-1?I!#" ], [ 11770, "xor", "H\tkEY|chClct" ], [ 12019, "xor", "FI3.'6gHifi" ], [ 12030, "xor", "jR5;\u0026!'bilit" ], [ 12165, "xor", "X\tkEY|chClct" ], [ 12188, "xor", "KBp960=-;bi" ], [ 12235, "xor", "FA2o2=-b* ,5+So2H6_cb" ], [ 12346, "xor", "CC$o%zrHCo 2yb" ], [ 12834, "xor", "DO%(;s=-Clcty" ], [ 12897, "xor", "CN7aYscmCo-1?I!#" ], [ 13123, "xor", "DO%(;s=-Clcty" ], [ 13186, "xor", "CN7aYscmCo-1?I!#" ] ], "sz": 13311, "ts": [ { "a": "T1055", "c": 0.8999999761581421, "d": "Memory copy in source code", "e": [ "memcpy" ], "i": "objectives/evasion/process/injection/shellcode::memcpy-raw", "l": 1, "m": "B0033" }, { "c": 0.699999988079071, "d": "macOS who tool reference", "e": [ "who" ], "i": "objectives/evasion/kernel-hide/rootkit::macos-who-ref", "l": 1 } ], "sha": "b4dd4e1624741cdd9967c2959ae84eca8a61586dcc0fd972ee4ce90fac8687c4", "path": "/data/samples/good/freebsd/usr/src/contrib/bc/include/vector.h", "type": "c" } ], "tv": "f6eaa" } }