{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 0.8383554220199585,
        "class": 0
      }
    ],
    "prob": 0.8383554,
    "class": 0,
    "models": [
      {
        "m": "az",
        "prob": 0.8383554,
        "class": 0
      },
      {
        "m": "az/scripts",
        "prob": 0.19900933,
        "class": 0
      },
      {
        "m": "az/shell",
        "prob": 0.32484075,
        "class": 0
      }
    ],
    "version": "v17.17",
    "thresholds": [
      0.999503,
      0.9998882
    ],
    "analyzed_at": "2026-05-25T19:02:08Z"
  },
  "path": "massage",
  "raw": {
    "v": "5",
    "fs": [
      {
        "f": "H(Po₂)",
        "x": 2,
        "ff": {
          "i": [
            [
              "",
              "cat"
            ],
            [
              "",
              "cat"
            ],
            [
              "",
              "fgrep"
            ],
            [
              "",
              "fgrep"
            ],
            [
              "",
              "fgrep"
            ],
            [
              "",
              "fgrep"
            ],
            [
              "",
              "fgrep"
            ],
            [
              "",
              "fgrep"
            ],
            [
              "",
              "fgrep"
            ],
            [
              "",
              "fgrep"
            ],
            [
              "",
              "fgrep"
            ],
            [
              "",
              "fgrep"
            ],
            [
              "",
              "fgrep"
            ],
            [
              "",
              "fgrep"
            ],
            [
              "",
              "fgrep"
            ],
            [
              "",
              "fgrep"
            ],
            [
              "",
              "fgrep"
            ],
            [
              "",
              "fgrep"
            ],
            [
              "",
              "sort"
            ],
            [
              "",
              "sort"
            ],
            [
              "",
              "uniq"
            ],
            [
              "",
              "uniq"
            ],
            [
              "",
              "sort"
            ],
            [
              "",
              "sort"
            ],
            [
              "",
              "./timeparsefilter"
            ],
            [
              "",
              "./timeparsefilter"
            ],
            [
              "",
              "sort"
            ],
            [
              "",
              "sort"
            ],
            [
              "",
              "uniq"
            ],
            [
              "",
              "uniq"
            ],
            [
              "",
              "php"
            ],
            [
              "",
              "php"
            ],
            [
              "",
              "awk"
            ],
            [
              "",
              "awk"
            ],
            [
              "",
              "sort"
            ],
            [
              "",
              "sort"
            ],
            [
              "",
              "uniq"
            ],
            [
              "",
              "uniq"
            ],
            [
              "",
              "sort"
            ],
            [
              "",
              "sort"
            ],
            [
              "",
              "head"
            ],
            [
              "",
              "head"
            ],
            [
              "",
              "awk"
            ],
            [
              "",
              "awk"
            ]
          ],
          "m": {
            "ast": {
              "max_depth": 8.0,
              "call_count": 22.0,
              "node_count": 146.0,
              "target_count": 8.0,
              "string_literal_count": 11.0
            },
            "file": {
              "size": 834.0,
              "entropy": 5.01,
              "size_bytes": 834.0
            },
            "text": {
              "digit_ratio": 0.09,
              "space_count": 104.0,
              "total_lines": 21.0,
              "char_entropy": 5.01,
              "unique_chars": 64.0,
              "string_density": 0.52,
              "avg_line_length": 38.71,
              "max_line_length": 108.0,
              "empty_line_ratio": 0.14,
              "last_line_length": 108.0,
              "whitespace_ratio": 0.15,
              "most_common_ratio": 0.08,
              "identifier_density": 3.38,
              "line_length_stddev": 31.28,
              "normalized_string_count": 2.4,
              "most_common_char_is_null": 0.0,
              "max_inline_whitespace_run": 2.0,
              "most_common_char_codepoint": 115.0,
              "normalized_unique_identifiers": 5.46
            },
            "strings": {
              "total": 11.0,
              "avg_length": 9.18,
              "max_length": 18.0,
              "avg_entropy": 2.86,
              "total_bytes": 101.0,
              "domain_count": 1.0,
              "entropy_stddev": 0.54
            },
            "comments": {
              "chars": 130.0,
              "lines": 5.0,
              "total": 5.0,
              "to_code_ratio": 0.31
            },
            "identifiers": {
              "total": 71.0,
              "avg_length": 13.25,
              "max_length": 29.0,
              "min_length": 2.0,
              "avg_entropy": 2.66,
              "reuse_ratio": 0.34,
              "unique_count": 24.0,
              "length_stddev": 9.83,
              "has_digit_ratio": 0.38,
              "high_entropy_count": 5.0,
              "high_entropy_ratio": 0.21,
              "all_lowercase_ratio": 0.29,
              "numeric_suffix_count": 3.0
            }
          },
          "s": [
            [
              282,
              "u8",
              "Cookie for"
            ],
            [
              306,
              "u8",
              "eval"
            ],
            [
              324,
              "u8",
              "print "
            ],
            [
              344,
              "u8",
              "fopen("
            ],
            [
              364,
              "u8",
              "die("
            ],
            [
              382,
              "u8",
              "WRITE:1|IWRITE:28"
            ],
            [
              413,
              "u8",
              "sheldonbarrett.com"
            ],
            [
              445,
              "u8",
              "UNAME:"
            ],
            [
              579,
              "u8",
              "{print $4}"
            ],
            [
              729,
              "u8",
              "{print $4}"
            ],
            [
              809,
              "u8",
              "{print $2}"
            ]
          ],
          "v": {
            "source.shebang": "/bin/bash",
            "source.language": "bash",
            "source.imports[0]": "./timeparsefilter",
            "source.imports[1]": "awk",
            "source.imports[2]": "cat",
            "source.imports[3]": "fgrep",
            "source.imports[4]": "head",
            "source.imports[5]": "php",
            "source.imports[6]": "sort",
            "source.imports[7]": "uniq",
            "source.strings[0]": "Cookie for",
            "source.strings[1]": "UNAME:",
            "source.strings[2]": "WRITE:1|IWRITE:28",
            "source.strings[3]": "fopen(",
            "source.strings[4]": "print ",
            "source.strings[5]": "sheldonbarrett.com",
            "source.strings[6]": "{print $2}",
            "source.strings[7]": "{print $4}",
            "source.has_imports": true
          },
          "ca": [
            [
              "awk",
              "{print $2}"
            ],
            [
              "awk",
              "{print $4}"
            ],
            [
              "fgrep",
              "Cookie for"
            ],
            [
              "fgrep",
              "UNAME:"
            ],
            [
              "fgrep",
              "WRITE:1|IWRITE:28"
            ],
            [
              "fgrep",
              "die("
            ],
            [
              "fgrep",
              "eval"
            ],
            [
              "fgrep",
              "fopen("
            ],
            [
              "fgrep",
              "print "
            ],
            [
              "fgrep",
              "sheldonbarrett.com"
            ]
          ],
          "ct": [
            "./timeparsefilter",
            "awk",
            "cat",
            "fgrep",
            "head",
            "php",
            "sort",
            "uniq"
          ],
          "id": "shell"
        },
        "id": 0,
        "sz": 834,
        "ts": [
          {
            "a": "T1036.008",
            "c": 0.949999988079071,
            "d": "File starts with",
            "e": [
              "#!/bin/bash"
            ],
            "i": "objectives/evasion/masquerade/extension/shebang::bash-shebang-first-line",
            "l": 1,
            "m": "F0008"
          },
          {
            "c": 0.75,
            "d": "Tiny multi-line text script",
            "e": [
              "text.total_lines = 21.00"
            ],
            "i": "metadata/file/text/profile::tiny-text-script",
            "l": 2
          },
          {
            "c": 0.800000011920929,
            "d": "Limits command output to 20 lines",
            "e": [
              "head -20"
            ],
            "i": "micro-behaviors/process/create/shell/pipeline::head-20-limit",
            "l": 3
          },
          {
            "c": 1.0,
            "d": "Bash shell shebang line",
            "e": [
              "#!/bin/bash"
            ],
            "i": "metadata/lang/shebang::bash",
            "l": 2
          },
          {
            "d": "password keyword",
            "e": [
              "password"
            ],
            "i": "micro-behaviors/data/text/keywords/lexicon::password",
            "l": 1
          },
          {
            "a": "T1059.004",
            "c": 0.6000000238418579,
            "d": "./ execution pattern",
            "e": [
              "| ./timeparsefilter"
            ],
            "i": "objectives/command-and-control/dropper/execution/pipe::execute-dot-slash",
            "l": 1
          },
          {
            "a": "T1053.003",
            "c": 0.6000000238418579,
            "d": "grep -v (inverse match/filter)",
            "e": [
              "grep -v"
            ],
            "i": "objectives/persistence/system/cron/schedule::grep-v",
            "l": 1
          },
          {
            "a": "T1552.001",
            "c": 0.699999988079071,
            "d": "Settings password keyword",
            "e": [
              "password"
            ],
            "i": "objectives/supply-chain/credential-theft/registry::settings-password-keyword",
            "l": 1
          },
          {
            "c": 0.8399999737739563,
            "d": "password/token/api_key field keyword",
            "e": [
              "password"
            ],
            "i": "micro-behaviors/data/text/keywords/credential::credential-field",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "Regex component marker",
            "e": [
              "sort | uniq -c | sort -k1.1nr | head -20 |"
            ],
            "i": "micro-behaviors/process/create/shell/pipeline::excessive-pipes--rx-3",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "Rootkit hook fopen mention",
            "e": [
              "fopen"
            ],
            "i": "well-known/malware/botnet/systemten::hook-fopen",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "Regex component marker",
            "e": [
              "awk '{print $4}' wso.passwords.txt | sort | uniq -c | sort -k1.1nr |"
            ],
            "i": "micro-behaviors/process/create/shell/pipeline::excessive-pipes--rx-2",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Executes a file from current directory",
            "e": [
              "| ./timeparsefilter"
            ],
            "i": "micro-behaviors/process/create/local-exec::local-execution",
            "l": 3
          },
          {
            "c": 1.0,
            "d": "shell code embedded in string",
            "e": [
              "Detected shell at offset 0x0"
            ],
            "i": "metadata/lang/embedded::shell",
            "l": 2
          }
        ],
        "sha": "b82c6a693629a035a0548f06ee30d7d9887087c7a4da50dc4e1d3a16dd8d9aa3",
        "path": "massage",
        "type": "shell"
      }
    ],
    "tv": "cf883"
  }
}