{ "ml": { "v": "7", "eng": "2.3.1-beta.0", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.00013560057, "rte": "az", "prob": 0.00013560057 }, { "cls": 0, "raw": 0.00016567111, "rte": "az/tar", "prob": 0.00016567111 } ], "prob": 0.00013560057, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.00013560056686401367, "type": "tar.gz" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.000014702479347761255, "type": "c" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.00001393755246681394, "type": "c" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.00007756551349302754, "type": "c" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.000015517076462856494, "type": "c" }, { "id": 5, "lvl": -1, "conf": 0, "prob": 0.000013947486877441406, "type": "c" }, { "id": 6, "lvl": -1, "conf": 0, "prob": 0.000012546777725219727, "type": "c" }, { "id": 7, "lvl": -1, "conf": 0, "prob": 0.000011225541129533667, "type": "c" }, { "id": 8, "lvl": -1, "conf": 0, "prob": 0.000013222296729509253, "type": "c" }, { "id": 9, "lvl": -1, "conf": 0, "prob": 0.000013579924598161597, "type": "makefile" }, { "id": 10, "lvl": -1, "conf": 0, "prob": 0.000013043482795183081, "type": "makefile" }, { "id": 11, "lvl": -1, "conf": 0, "prob": 0.000015228986740112305, "type": "text" }, { "id": 12, "lvl": -1, "conf": 0, "prob": 0.000016262134522548877, "type": "xml" } ], "version": "v18.18", "analyzed_at": "2026-07-20T07:11:23Z" }, "path": "v1.5.tar.gz", "raw": { "files": [ { "id": 0, "ctx": [ { "b": "abZy80000000zS4D4jP1L}.0yJzCbfpHV}[7hyf\u003e/}8odx?5?t[[pQ+ASbwcnSVtm0VRi\u0026^OvKND:ZJ!ao", "n": [ { "c": 1, "d": "Gzip-compressed tar archive", "i": "metadata/package/files/system-package::tar-gz-archive-format", "o": 0, "z": 1, "cf": 0.8999999761581421 } ], "ln": 0 } ], "mol": "H₂(F₂Po₂)", "sha": "c474d22feae5d9c05b3ec167b839c8fded512587da0f020ca682d60db174f24a", "path": "/data/samples/unknown/foraged/macos/brew.sh/_/xbee-comm/v1.5.tar.gz", "risk": 3, "size": 23123, "type": "tar.gz", "facts": { "metrics": { "file": { "size": 23123.0, "entropy": 7.99, "size_bytes": 23123.0 }, "parse": { "error_count": 1.0 }, "binary": { "overall_entropy": 7.99, "peak_region_bytes": 23123.0, "peak_region_entropy": 7.83 } } }, "traits": [ { "id": "micro-behaviors/fs/file/stat::stat-core", "conf": 0.800000011920929, "crit": 3, "desc": "Read file status and metadata (core)", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/info/selfpath::check-argv-0", "conf": 0.800000011920929, "crit": 3, "desc": "Accesses argv[0] (Self path)", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/fs/file/write/direct::write", "conf": 0.6600000262260437, "crit": 2, "desc": "POSIX file-write capability", "from": [ { "file": 2 }, { "off": 1857, "file": 3, "line": 92 } ] }, { "id": "micro-behaviors/communications/socket/multiplex::poll-multiplex", "crit": 3, "desc": "poll() I/O multiplexing", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/process/tty/pty::tcgetattr", "atk": "T1059", "conf": 0.75, "crit": 3, "desc": "Get terminal attributes", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/fs/file/binary::file-read-operation", "atk": "T1005", "conf": 0.75, "crit": 1, "desc": "File-reading capability", "from": [ { "off": 1932, "file": 1, "line": 91 }, { "off": 2092, "file": 2, "line": 100 }, { "file": 3 } ] }, { "id": "micro-behaviors/fs/file/write/direct::write--write", "conf": 0.6600000262260437, "crit": 2, "desc": "References POSIX write API", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/fs/file/read::read", "conf": 0.699999988079071, "crit": 2, "desc": "Read file descriptor (read/pread)", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/file/binary::file-manipulation", "atk": "T1005", "conf": 0.75, "crit": 3, "desc": "File content manipulation (read/write/seek)", "from": [ { "file": 1 }, { "file": 2 }, { "file": 3 } ] } ] }, { "ctx": [ { "b": "", "ln": 62, "addr": 1368 }, { "b": "32a01asH\u0026jauZ\u0026=AaJ]nw[=6)zEEx[efE.}qBBqQoJ-![auQ=2diJ%", "n": [ { "c": 2, "d": "Open files", "i": "micro-behaviors/fs/file/open::open-base", "o": 1380, "z": 4, "cf": 0.6600000262260437 } ], "ln": 63, "addr": 1369 }, { "b": "2)\u003elKCvtJfx(mMib4+m$y?mc1Bz\u0026puAaJ]fc37mYazbt7wO${[wHPX", "ln": 64, "addr": 1413 }, { "b": "2)\u003eS-BAIRwat2rf", "ln": 65, "addr": 1457 }, { "b": "34h", "ln": 66, "addr": 1470 }, { "b": "", "ln": 67, "addr": 1473 }, { "b": "32a01w]\u002665Bsp:iefDoXByGx8diH.}fEXb\u003e", "n": [ { "c": 3, "d": "Read file status and metadata (core)", "i": "micro-behaviors/fs/file/stat::stat-core", "o": 1478, "z": 5, "cf": 0.800000011920929 } ], "ln": 68, "addr": 1474 }, { "b": "2)\u003elKCvtJfx(mMib4+m$y?mc1Bz\u0026pyByxnlc37mYazbt7wO${[wHPX", "ln": 69, "addr": 1503 }, { "b": "2)\u003e9Tz/YFrw[itL", "ln": 70, "addr": 1547 }, { "b": "2)\u003eS-BAIRwat2rf", "ln": 71, "addr": 1560 }, { "b": "31N@%DJ", "ln": 90, "addr": 1918 }, { "b": "2)\u003eS-BrAZ?A+eV\u0026c$W0vayYF9as!NMw[AOpw[=6)B7]@iat1ZOw[AFN", "n": [ { "c": 2, "d": "Read file descriptor (read/pread)", "i": "micro-behaviors/fs/file/read::read", "o": 1932, "z": 4, "cf": 0.699999988079071 } ], "ln": 91, "addr": 1924 }, { "b": "", "ln": 92, "addr": 1969 } ], "depth": 1, "facts": { "imp": [ [ "", "gtk_tree_store_append" ], [ "", "gtk_tree_store_set" ], [ "", "gtk_tree_store_append" ], [ "", "gtk_tree_store_set" ], [ "", "open" ], [ "", "g_warning" ], [ "", "fstat" ], [ "", "g_warning" ], [ "", "close" ], [ "", "g_warning" ], [ "", "close" ], [ "", "malloc" ], [ "", "g_warning" ], [ "", "close" ], [ "", "read" ], [ "", "g_warning" ], [ "", "free" ], [ "", "close" ], [ "", "g_warning" ], [ "", "strchr" ], [ "", "g_warning" ], [ "", "strchr" ], [ "", "g_warning" ], [ "", "strchr" ], [ "", "g_warning" ], [ "", "store_add_category" ], [ "", "strchr" ], [ "", "g_warning" ], [ "", "strchr" ], [ "", "g_warning" ], [ "", "strchr" ], [ "", "g_warning" ], [ "", "strchr" ], [ "", "g_warning" ], [ "", "strchr" ], [ "", "g_warning" ], [ "", "store_add_command" ], [ "", "free" ], [ "", "close" ], [ "", "gtk_tree_path_get_depth" ], [ "", "gtk_tree_model_get_iter" ], [ "", "gtk_tree_model_get" ], [ "", "GTK_TEXT_VIEW" ], [ "", "gtk_text_view_get_buffer" ], [ "", "gtk_text_buffer_set_text" ], [ "", "gtk_text_buffer_set_text" ], [ "", "g_free" ], [ "", "gtk_tree_store_new" ], [ "", "read_conf_file" ], [ "", "gtk_cell_renderer_text_new" ], [ "", "gtk_tree_view_column_new_with_attributes" ], [ "", "gtk_tree_view_column_set_resizable" ], [ "", "gtk_tree_view_append_column" ], [ "", "gtk_cell_renderer_text_new" ], [ "", "gtk_tree_view_column_new_with_attributes" ], [ "", "gtk_tree_view_column_set_resizable" ], [ "", "gtk_tree_view_append_column" ], [ "", "gtk_cell_renderer_text_new" ], [ "", "gtk_tree_view_column_new_with_attributes" ], [ "", "gtk_tree_view_column_set_resizable" ], [ "", "gtk_tree_view_append_column" ], [ "", "create_and_fill_store" ], [ "", "gtk_tree_view_set_model" ], [ "", "GTK_TREE_MODEL" ], [ "", "g_object_unref" ], [ "", "G_OBJECT" ], [ "", "set_main_view_columns" ], [ "", "gtk_tree_view_get_selection" ], [ "", "gtk_tree_selection_set_mode" ], [ "", "gtk_tree_selection_set_select_function" ], [ "", "gtk_builder_new" ], [ "", "gtk_builder_add_from_file" ], [ "", "g_warning" ], [ "", "g_free" ], [ "", "GTK_WIDGET" ], [ "", "gtk_builder_get_object" ], [ "", "GTK_WIDGET" ], [ "", "gtk_builder_get_object" ], [ "", "GTK_WIDGET" ], [ "", "gtk_builder_get_object" ], [ "", "gtk_builder_connect_signals" ], [ "", "setup_tree_view" ], [ "", "GTK_TREE_VIEW" ], [ "", "g_object_unref" ], [ "", "G_OBJECT" ], [ "", "gtk_init" ], [ "", "g_slice_new" ], [ "", "xbc_gui_init" ], [ "", "gtk_widget_show" ], [ "", "gtk_main" ], [ "", "\u003cerrno.h\u003e" ], [ "", "\u003cfcntl.h\u003e" ], [ "", "\u003cgtk/gtk.h\u003e" ], [ "", "\u003cstdlib.h\u003e" ], [ "", "\u003cstring.h\u003e" ], [ "", "\u003csys/stat.h\u003e" ], [ "", "\u003csys/types.h\u003e" ], [ "", "\u003cunistd.h\u003e" ] ], "mbr": [ "error.message", "gctx.text", "gctx.tree", "gctx.window", "gui_ctx.window", "stbuf.st_size" ], "tgt": [ "GTK_TEXT_VIEW", "GTK_TREE_MODEL", "GTK_TREE_VIEW", "GTK_WIDGET", "G_OBJECT", "close", "create_and_fill_store", "free", "fstat", "g_free", "g_object_unref", "g_slice_new", "g_warning", "gtk_builder_add_from_file", "gtk_builder_connect_signals", "gtk_builder_get_object", "gtk_builder_new", "gtk_cell_renderer_text_new", "gtk_init", "gtk_main", "gtk_text_buffer_set_text", "gtk_text_view_get_buffer", "gtk_tree_model_get", "gtk_tree_model_get_iter", "gtk_tree_path_get_depth", "gtk_tree_selection_set_mode", "gtk_tree_selection_set_select_function", "gtk_tree_store_append", "gtk_tree_store_new", "gtk_tree_store_set", "gtk_tree_view_append_column", "gtk_tree_view_column_new_with_attributes", "gtk_tree_view_column_set_resizable", "gtk_tree_view_get_selection", "gtk_tree_view_set_model", "gtk_widget_show", "malloc", "open", "read", "read_conf_file", "set_main_view_columns", "setup_tree_view", "store_add_category", "store_add_command", "strchr", "xbc_gui_init" ], "metrics": { "ast": { "op.eq": 6.0, "op.gt": 1.0, "op.le": 1.0, "op.lt": 3.0, "op.ne": 8.0, "op.add": 15.0, "op.lor": 9.0, "op.mul": 26.0, "op.sub": 1.0, "op.band": 11.0, "op.land": 1.0, "op.lnot": 13.0, "max_depth": 19.0, "op.concat": 3.0, "bind_count": 48.0, "call_count": 90.0, "node_count": 2602.0, "member_count": 6.0, "op_density.eq": 0.0, "op_density.gt": 0.0, "op_density.le": 0.0, "op_density.lt": 0.0, "op_density.ne": 0.0, "op_density.add": 0.01, "op_density.lor": 0.0, "op_density.mul": 0.01, "op_density.sub": 0.0, "op_density.band": 0.0, "op_density.land": 0.0, "op_density.lnot": 0.0, "identifier_count": 121.0, "member_depth_max": 2.0, "op_density.concat": 0.0, "string_literal_count": 27.0, "string_concat_chain_max_length": 2.0 }, "file": { "size": 8536.0, "entropy": 5.39, "size_bytes": 8536.0 }, "text": { "tab_count": 645.0, "digit_ratio": 0.01, "space_count": 634.0, "total_lines": 367.0, "char_entropy": 5.39, "unique_chars": 85.0, "escape_density": 0.13, "string_density": 0.07, "avg_line_length": 22.26, "max_line_length": 88.0, "empty_line_ratio": 0.15, "last_line_length": 1.0, "whitespace_ratio": 0.19, "most_common_ratio": 0.07, "identifier_density": 1.26, "line_length_stddev": 19.42, "octal_escape_count": 11.0, "normalized_string_count": 1.41, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 3.0, "most_common_char_codepoint": 101.0, "normalized_unique_identifiers": 14.2 }, "binds": { "count": 48.0 }, "calls": { "count": 90.0 }, "binary": { "overall_entropy": 5.39, "peak_region_bytes": 8192.0, "peak_region_entropy": 5.38 }, "source": { "class_count": 3.0, "function_count": 9.0 }, "imports": { "count": 8.0, "unique_modules": 8.0, "third_party_count": 8.0, "third_party_ratio": 1.0 }, "members": { "count": 6.0 }, "strings": { "total": 27.0, "avg_length": 17.26, "max_length": 40.0, "avg_entropy": 3.02, "empty_count": 1.0, "total_bytes": 466.0, "entropy_stddev": 0.9 }, "comments": { "chars": 702.0, "lines": 30.0, "total": 30.0, "to_code_ratio": 0.09 }, "functions": { "count": 12.0 }, "identifiers": { "count": 121.0, "total": 462.0, "avg_length": 11.77, "max_length": 40.0, "min_length": 2.0, "avg_entropy": 2.74, "reuse_ratio": 0.26, "unique_count": 121.0, "length_stddev": 7.92, "high_entropy_count": 13.0, "high_entropy_ratio": 0.11, "all_lowercase_ratio": 0.75, "all_uppercase_ratio": 0.14 } } }, "id": 1, "mol": "H(F)", "path": "/data/samples/unknown/foraged/macos/brew.sh/_/xbee-comm/v1.5.tar.gz!!xbee-comm-1.5/src/ui/xbc-gui.c", "pid": 0, "risk": 1, "sha": "a20beb0ac4d0a57bfa6a590e6d5d4a91fcfc913a3e4449654394e361302e5c0d", "size": 8536, "traits": [ { "id": "micro-behaviors/fs/file/read::read", "conf": 0.699999988079071, "crit": 2, "desc": "Read file descriptor (read/pread)", "spans": [ [ 1932, 4 ] ] }, { "id": "micro-behaviors/fs/file/stat::stat-core", "conf": 0.800000011920929, "crit": 3, "desc": "Read file status and metadata (core)", "spans": [ [ 1478, 5 ] ] }, { "id": "micro-behaviors/fs/file/binary::file-read-operation", "atk": "T1005", "conf": 0.75, "crit": 1, "desc": "File-reading capability", "spans": [ [ 1932, 4 ] ] } ], "type": "c" }, { "ctx": [ { "b": "", "ln": 32, "addr": 967 }, { "b": "329#]c)f{.vRfc[jS[VZwO@]bwP?=$wH[%1uS6o[qxQufpHu\u003c)lSv2/djDx4attk!DJ", "n": [ { "c": 2, "d": "Open files", "i": "micro-behaviors/fs/file/open::open-base", "o": 982, "z": 4, "cf": 0.6600000262260437 } ], "ln": 33, "addr": 968 }, { "b": "2)\u003eS-BAIRwawL{goGJ", "ln": 34, "addr": 1022 }, { "b": "33gf4DsZD9aAz4ni@", "ln": 53, "addr": 1326 }, { "b": "", "ln": 54, "addr": 1340 }, { "b": "33Q5%y?j.qv@DHcBrA:\u0026fEXb\u003e", "ln": 55, "addr": 1341 }, { "b": "2)\u003eS-BrAZ?CxdztwHIe3efFzAw?k6mz/]@tdlv", "n": [ { "c": 3, "d": "File content manipulation (read/write/seek)", "i": "micro-behaviors/fs/file/binary::file-manipulation", "o": 1370, "z": 5, "cf": 0.75 } ], "ln": 56, "addr": 1362 }, { "b": "", "ln": 57, "addr": 1393 }, { "b": "2)\u003erTasInwBrAXeattk!DJ", "ln": 58, "addr": 1394 }, { "b": "2)*]UwPS6nzxHI=i@", "ln": 59, "addr": 1412 }, { "b": "31N@%DJ", "ln": 99, "addr": 2078 }, { "b": "2)\u003eS-BrAZ?A+eV\u0026d0PlzCR8a7vRfd4ayYF9eK0YNByupxayYF9eK1x0x(){9z/WDLvS=omk67B:wGSMEvS=omk6I3YBy/AfB16f", "n": [ { "c": 2, "d": "Read file descriptor (read/pread)", "i": "micro-behaviors/fs/file/read::read", "o": 2092, "z": 4, "cf": 0.699999988079071 } ], "ln": 100, "addr": 2084 }, { "b": "2)\u003erTasInwBrAW*fEXb\u003e", "ln": 101, "addr": 2164 } ], "depth": 1, "facts": { "imp": [ [ "", "open" ], [ "", "malloc" ], [ "", "close" ], [ "", "write" ], [ "", "xb_buffer_as_api" ], [ "", "xb_buffer_as_at" ], [ "", "xb_write_fully" ], [ "", "buffer_free" ], [ "", "buffer_new" ], [ "", "read" ], [ "", "free" ], [ "", "memcpy" ], [ "", "be16toh" ], [ "", "xb_buffer_new" ], [ "", "xb_buffer_put_uint8" ], [ "", "xb_buffer_set_frame_id" ], [ "", "xb_buffer_put_uint8" ], [ "", "xb_buffer_put_at_cmd" ], [ "", "xb_buffer_free" ], [ "", "xb_create_at_cmd" ], [ "", "xb_send" ], [ "", "xb_buffer_free" ], [ "", "xb_buffer_get_frame_id" ], [ "", "xb_buffer_free" ], [ "", "\u003cfcntl.h\u003e" ], [ "", "\u003cstdlib.h\u003e" ], [ "", "\u003cstring.h\u003e" ], [ "", "\u003csys/stat.h\u003e" ], [ "", "\u003csys/types.h\u003e" ], [ "", "\u003cunistd.h\u003e" ], [ "", "xb_buffer.h" ], [ "", "xb_ctx.h" ] ], "mbr": [ "buf.data", "buf.size", "buf.writepos", "packet.data", "packet.writepos", "xctx.api_mode", "xctx.frame_id", "xctx.xbfd" ], "tgt": [ "be16toh", "buffer_free", "buffer_new", "close", "free", "malloc", "memcpy", "open", "read", "write", "xb_buffer_as_api", "xb_buffer_as_at", "xb_buffer_free", "xb_buffer_get_frame_id", "xb_buffer_new", "xb_buffer_put_at_cmd", "xb_buffer_put_uint8", "xb_buffer_set_frame_id", "xb_create_at_cmd", "xb_send", "xb_write_fully" ], "metrics": { "ast": { "op.eq": 7.0, "op.ge": 1.0, "op.gt": 1.0, "op.le": 1.0, "op.lt": 6.0, "op.ne": 1.0, "op.add": 5.0, "op.bor": 1.0, "op.lor": 2.0, "op.mul": 1.0, "op.sub": 2.0, "op.band": 2.0, "op.lnot": 4.0, "max_depth": 14.0, "bind_count": 18.0, "call_count": 24.0, "node_count": 1024.0, "member_count": 8.0, "op_density.eq": 0.01, "op_density.ge": 0.0, "op_density.gt": 0.0, "op_density.le": 0.0, "op_density.lt": 0.01, "op_density.ne": 0.0, "op_density.add": 0.0, "op_density.bor": 0.0, "op_density.lor": 0.0, "op_density.mul": 0.0, "op_density.sub": 0.0, "op_density.band": 0.0, "op_density.lnot": 0.0, "identifier_count": 52.0, "member_depth_max": 2.0, "string_literal_count": 2.0, "string_concat_chain_max_length": 2.0 }, "file": { "size": 3613.0, "entropy": 5.25, "size_bytes": 3613.0 }, "text": { "tab_count": 173.0, "digit_ratio": 0.02, "space_count": 385.0, "total_lines": 179.0, "char_entropy": 5.25, "mixed_indent": 1.0, "unique_chars": 85.0, "string_density": 0.01, "avg_line_length": 19.18, "max_line_length": 79.0, "empty_line_ratio": 0.18, "last_line_length": 1.0, "whitespace_ratio": 0.2, "most_common_ratio": 0.06, "identifier_density": 1.07, "line_length_stddev": 21.1, "normalized_string_count": 0.15, "most_common_char_is_null": 0.0, "suspicious_comment_ratio": 0.25, "max_inline_whitespace_run": 2.0, "most_common_char_codepoint": 101.0, "normalized_unique_identifiers": 6.95 }, "binds": { "count": 18.0 }, "calls": { "count": 24.0 }, "binary": { "overall_entropy": 5.25, "peak_region_bytes": 3613.0, "peak_region_entropy": 5.22 }, "source": { "class_count": 4.0, "function_count": 6.0 }, "imports": { "count": 8.0, "unique_modules": 8.0, "third_party_count": 8.0, "third_party_ratio": 1.0 }, "members": { "count": 8.0 }, "strings": { "total": 2.0, "avg_length": 9.5, "max_length": 11.0, "avg_entropy": 2.92, "total_bytes": 19.0, "entropy_stddev": 0.17 }, "comments": { "chars": 833.0, "lines": 19.0, "total": 4.0, "xxx_count": 1.0, "to_code_ratio": 0.12, "url_in_comments": 1.0, "high_entropy_comments": 1.0 }, "functions": { "count": 10.0 }, "identifiers": { "count": 52.0, "total": 191.0, "avg_length": 8.9, "max_length": 22.0, "min_length": 2.0, "avg_entropy": 2.59, "reuse_ratio": 0.27, "unique_count": 52.0, "length_stddev": 5.46, "has_digit_ratio": 0.04, "high_entropy_count": 5.0, "high_entropy_ratio": 0.1, "all_lowercase_ratio": 0.83, "all_uppercase_ratio": 0.13, "numeric_suffix_count": 1.0 } } }, "id": 2, "mol": "H(F)", "path": "/data/samples/unknown/foraged/macos/brew.sh/_/xbee-comm/v1.5.tar.gz!!xbee-comm-1.5/src/lib/xb_ctx.c", "pid": 0, "risk": 1, "sha": "e4b13ceafc670adcb71f530e9a635266046f868b7126a08e0988fa9ef29d024d", "size": 3613, "traits": [ { "id": "micro-behaviors/fs/file/write/direct::write--write", "conf": 0.6600000262260437, "crit": 2, "desc": "References POSIX write API", "spans": [ [ 1370, 5 ] ] }, { "id": "micro-behaviors/fs/file/read::read", "conf": 0.699999988079071, "crit": 2, "desc": "Read file descriptor (read/pread)", "spans": [ [ 2092, 4 ] ] }, { "id": "micro-behaviors/fs/file/binary::file-read-operation", "atk": "T1005", "conf": 0.75, "crit": 1, "desc": "File-reading capability", "spans": [ [ 2092, 4 ] ] }, { "id": "micro-behaviors/fs/file/write/direct::write", "conf": 0.6600000262260437, "crit": 2, "desc": "POSIX file-write capability", "spans": [ [ 1370, 5 ] ] }, { "id": "micro-behaviors/fs/file/binary::file-manipulation", "atk": "T1005", "conf": 0.75, "crit": 3, "desc": "File content manipulation (read/write/seek)", "spans": [ [ 1370, 5 ], [ 2092, 4 ] ] } ], "type": "c" }, { "ctx": [ { "b": "asW", "ln": 4, "addr": 83 }, { "b": "asXHkxLzJgAb](fA:-/cx(+zeA+e/8B8LVjCvtJ6iV@Y^BS+g5zxJ$hwncabA+P09By=OeBrC1fwg}\u003ewaz(4cx\u003ezR", "n": [ { "c": 2, "d": "Contains frequent English function words", "i": "metadata/file/profile/language::lang-english", "o": 89, "z": 4, "cf": 0.800000011920929 } ], "ln": 5, "addr": 86 }, { "b": "asXHFBrCZzwmY^7BzbkdBy/GfB0bykaARpdav/gbav*0XwPzi}aw^h\u0026y?Wx4oLF0FzGxwivriMgBZ/f3B7/b}ayYP", "ln": 6, "addr": 158 }, { "b": "31ETSAV!?lw)l#}i@", "ln": 49, "addr": 1214 }, { "b": "", "ln": 50, "addr": 1228 }, { "b": "31N@%DJ", "ln": 51, "addr": 1229 }, { "b": "2)\u003erTasInwvpQ=#wgO\u003cjB.ifEf!1keats]+clK^EB.h:VjS(aFcN/", "n": [ { "c": 3, "d": "File content manipulation (read/write/seek)", "i": "micro-behaviors/fs/file/binary::file-manipulation", "o": 1241, "z": 4, "cf": 0.75 } ], "ln": 52, "addr": 1235 }, { "b": "2)*]EA+eV{i@", "ln": 53, "addr": 1278 }, { "b": "2)\u003e-}y?mf%c]0zffFCgfi@", "ln": 54, "addr": 1288 }, { "b": "34i}uxLzo]asF@[i@", "n": [ { "c": 2, "d": "Infinite loop structure (e.g. (;;) / while(1))", "i": "micro-behaviors/data/control-flow/loop::infinite-loop-header", "o": 1309, "z": 9, "cf": 1.0 } ], "ln": 55, "addr": 1306 }, { "b": "336P=wgh52efFzAw?k5Vdlv", "ln": 56, "addr": 1320 }, { "b": "", "ln": 77, "addr": 1653 }, { "b": "2)\u003eM?B08$@aAz4ni@", "ln": 78, "addr": 1654 }, { "b": "", "ln": 79, "addr": 1668 }, { "b": "2)\u003eS-BrAZ?AbPMec$W1hefDU#atCM7dlv", "n": [ { "c": 3, "d": "I/O multiplexing on sockets", "i": "micro-behaviors/communications/socket/multiplex::multiplex", "o": 1677, "z": 4, "cf": 0.6600000262260437 } ], "ln": 80, "addr": 1669 }, { "b": "34i}uxLzo]asInwBrA:\u0026fD.X?aAhmuauQ=Rz/]@tdlv", "ln": 81, "addr": 1696 }, { "b": "", "ln": 82, "addr": 1731 }, { "b": "336Q0B-IvxAbP!V", "ln": 83, "addr": 1732 }, { "b": "33Q5%y?j.qv@DHcBrA:\u0026fEXb\u003e", "ln": 91, "addr": 1828 }, { "b": "2)\u003eS-BrAZ?CxdztwHIe3efFzAw?k6mz/]@tdlv", "n": [ { "c": 2, "d": "References POSIX write API", "i": "micro-behaviors/fs/file/write/direct::write--write", "o": 1857, "z": 5, "cf": 0.6600000262260437 } ], "ln": 92, "addr": 1849 }, { "b": "", "ln": 93, "addr": 1880 }, { "b": "34h", "ln": 154, "addr": 2901 }, { "b": "", "ln": 155, "addr": 2904 }, { "b": "2})+JA+eV\u0026az2Cjx(W=cw[=p5CvtJ6azCX3xjSi1zGG!tzdNN5A^n=Sf8", "ln": 156, "addr": 2905 }, { "b": "329#]c$WKxvrr]fCv\u003ewpasqeKvS=oiauQ=2diJ%", "n": [ { "c": 3, "d": "Read file status and metadata (core)", "i": "micro-behaviors/fs/file/stat::stat-core", "o": 2956, "z": 5, "cf": 0.800000011920929 } ], "ln": 157, "addr": 2951 }, { "b": "2)\u003e/:A=9oHw)]y\u0026wN({9zY\u003cayvrrS7x(X6mvrb{4w[=6)a$kO", "ln": 158, "addr": 2983 }, { "b": "2)\u003eS-BAIRwat2rf", "ln": 159, "addr": 3023 }, { "b": "34h", "ln": 160, "addr": 3036 }, { "b": "", "ln": 200, "addr": 3822 }, { "b": "2)\u003eoRvpS}\u0026tqft9jS(d}x(n2LuVW.AtZd}ScP-C7dJ?U=nfxxn", "n": [ { "c": 2, "d": "Decoded unicode-escape content", "i": "metadata/encoded-payload/unicode-escape", "o": 3823, "z": 30, "cf": 0.8999999761581421 } ], "ln": 201, "addr": 3823 }, { "b": "2)\u003eoRvpS}\u0026tqozajS(d}x(n2LuVW-ay\u0026r*0i@", "ln": 202, "addr": 3864 }, { "b": "2)\u003erTasInwvpQ^hvRfd4aAz4jy\u003cvMOf!1kcjS(B3E0^4^A+fiaC{1m[asyAsfG7pcaBs", "n": [ { "c": 2, "d": "Decoded unicode-escape content", "i": "metadata/encoded-payload/unicode-escape", "o": 4508, "z": 57, "cf": 0.8999999761581421 } ], "ln": 229, "addr": 4508 }, { "b": "329#]d0PidA+eV\u0026d0PikwgO\u003cjB.ifEB7]@iz!pzbB.i6KauR!ffD+:\u003casZ\u0026yw/@lWasyAsfG7pcaBs", "n": [ { "c": 2, "d": "Decoded unicode-escape content", "i": "metadata/encoded-payload/unicode-escape", "o": 4812, "z": 57, "cf": 0.8999999761581421 } ], "ln": 242, "addr": 4812 }, { "b": "33gieBZ]IoBy/Gfx(w5nB7GxavqF1", "ln": 295, "addr": 6176 }, { "b": "33x%1Bu0SHazbU5zdN6*wif", "ln": 296, "addr": 6200 }, { "b": "", "ln": 297, "addr": 6219 }, { "b": "329#]d0e%iwPRv5BAe^Ov@#@Ek6QKGwgO\u0026IB7GxavqEwwaBs", "n": [ { "c": 3, "d": "Get terminal attributes", "i": "micro-behaviors/process/tty/pty::tcgetattr", "o": 6225, "z": 9, "cf": 0.75 } ], "ln": 298, "addr": 6220 }, { "b": "2)\u003ef-AWTvUnMo4^k$K:IqBJbVb4+m$y?mc1Bz\u0026pmwPP5pwPzT4zEEu7vruQix\u003c#jbwPG4Ai@", "ln": 299, "addr": 6259 }, { "b": "34h", "ln": 300, "addr": 6317 }, { "b": "", "ln": 301, "addr": 6320 }, { "b": "34h", "ln": 355, "addr": 7564 }, { "b": "", "ln": 356, "addr": 7567 }, { "b": "31!9@c$%!!att(1x=]IXf!+pyazAtRdiJ%", "n": [ { "c": 1, "d": "Native disk fill write call", "i": "objectives/impact/dos/resource::native-disk-fill-write-call", "o": 7569, "z": 97, "cf": 0.8600000143051147 } ], "ln": 357, "addr": 7568 }, { "b": "2)\u003erTasH}Db{k5/jV%]wdiJ%", "ln": 358, "addr": 7596 }, { "b": "2)*]SA+PAkw*!\u0026Qa$kO", "ln": 359, "addr": 7616 }, { "b": "2)*]DAa@V@z!9A4jS[fPz!QRrAcbJexdk[", "ln": 416, "addr": 8832 }, { "b": "", "ln": 417, "addr": 8860 }, { "b": "2)*]Lw/@HgAa@V@z!9A4j%hQfaBs", "ln": 418, "addr": 8861 }, { "b": "2)*[AB-Q#7wHH#cxlEGkt}v9!sv(F0mNoQtrz(mmi@", "n": [ { "c": 3, "d": "Accesses argv[0] (Self path)", "i": "micro-behaviors/process/info/selfpath::check-argv-0", "o": 8894, "z": 7, "cf": 0.800000011920929 } ], "ln": 419, "addr": 8884 }, { "b": "2)*]^", "ln": 420, "addr": 8918 }, { "b": "", "ln": 421, "addr": 8923 }, { "b": "2)*]EA+eV{i@", "ln": 422, "addr": 8924 }, { "b": "", "ln": 438, "addr": 9113 }, { "b": "329#]c)f{ICv\u003ewdjS[VZwO@]dCv\u003eM9wH[%1uS6o/pe1!tdiH.}fEXb\u003e", "n": [ { "c": 2, "d": "Open files", "i": "micro-behaviors/fs/file/open::open-base", "o": 9128, "z": 4, "cf": 0.6600000262260437 } ], "ln": 439, "addr": 9114 }, { "b": "2)\u003ef-AWTvUnMo4^k$K:IqBJbVb4+m$y?mc1Bz\u0026puAaJ]fw[=p5CvtJ6azbt7wJy}WB0rdTw{m\u003c3y?k4S", "ln": 440, "addr": 9159 } ], "depth": 1, "facts": { "imp": [ [ "", "read" ], [ "", "usleep" ], [ "", "read" ], [ "", "read" ], [ "", "read" ], [ "", "poll" ], [ "", "write" ], [ "", "xb_write" ], [ "", "warnx" ], [ "", "xb_read" ], [ "", "warnx" ], [ "", "warnx" ], [ "", "fstat" ], [ "", "warn" ], [ "", "warnx" ], [ "", "malloc" ], [ "", "warn" ], [ "", "memset" ], [ "", "read" ], [ "", "printf" ], [ "", "printf" ], [ "", "printf" ], [ "", "fflush" ], [ "", "xb_write" ], [ "", "warn" ], [ "", "xb_write" ], [ "", "warn" ], [ "", "xmodem_crc" ], [ "", "htobe16" ], [ "", "xb_write" ], [ "", "warn" ], [ "", "printf" ], [ "", "fflush" ], [ "", "read" ], [ "", "warnx" ], [ "", "xb_write" ], [ "", "warn" ], [ "", "xb_read" ], [ "", "warnx" ], [ "", "bzero" ], [ "", "tcsetattr" ], [ "", "printf" ], [ "", "printf" ], [ "", "printf" ], [ "", "printf" ], [ "", "printf" ], [ "", "err" ], [ "", "fprintf" ], [ "", "exit" ], [ "", "tcgetattr" ], [ "", "err" ], [ "", "serial_setup" ], [ "", "printf" ], [ "", "sleep" ], [ "", "write" ], [ "", "sleep" ], [ "", "wait_for_ok" ], [ "", "printf" ], [ "", "xb_send_at_cmd" ], [ "", "err" ], [ "", "xb_wait_for_reply" ], [ "", "err" ], [ "", "buffer_free" ], [ "", "ioctl" ], [ "", "ioctl" ], [ "", "sleep" ], [ "", "ioctl" ], [ "", "ioctl" ], [ "", "cfsetspeed" ], [ "", "tcsetattr" ], [ "", "err" ], [ "", "printf" ], [ "", "fflush" ], [ "", "xb_write" ], [ "", "xb_read" ], [ "", "printf" ], [ "", "strncmp" ], [ "", "errx" ], [ "", "tcsetattr" ], [ "", "err" ], [ "", "printf" ], [ "", "xb_firmware_update" ], [ "", "errx" ], [ "", "printf" ], [ "", "xb_write" ], [ "", "cfsetspeed" ], [ "", "tcsetattr" ], [ "", "err" ], [ "", "getopt" ], [ "", "atoi" ], [ "", "usage" ], [ "", "usage" ], [ "", "usage" ], [ "", "open" ], [ "", "err" ], [ "", "xb_open" ], [ "", "err" ], [ "", "program_local" ], [ "", "close" ], [ "", "\u003cendian.h\u003e" ], [ "", "\u003cerr.h\u003e" ], [ "", "\u003cerrno.h\u003e" ], [ "", "\u003cfcntl.h\u003e" ], [ "", "\u003cmachine/endian.h\u003e" ], [ "", "\u003cpoll.h\u003e" ], [ "", "\u003cstdarg.h\u003e" ], [ "", "\u003cstdint.h\u003e" ], [ "", "\u003cstdio.h\u003e" ], [ "", "\u003cstdlib.h\u003e" ], [ "", "\u003cstring.h\u003e" ], [ "", "\u003csys/ioctl.h\u003e" ], [ "", "\u003csys/stat.h\u003e" ], [ "", "\u003csys/types.h\u003e" ], [ "", "\u003ctermios.h\u003e" ], [ "", "\u003cunistd.h\u003e" ], [ "", "xb_ctx.h" ] ], "mbr": [ "serial.c_cc", "serial.c_cflag", "serial.c_iflag", "serial.c_lflag", "stbuf.st_size", "xctx.api_mode", "xctx.xbfd" ], "tgt": [ "atoi", "buffer_free", "bzero", "cfsetspeed", "close", "err", "errx", "exit", "fflush", "fprintf", "fstat", "getopt", "htobe16", "ioctl", "malloc", "memset", "open", "poll", "printf", "program_local", "read", "serial_setup", "sleep", "strncmp", "tcgetattr", "tcsetattr", "usage", "usleep", "wait_for_ok", "warn", "warnx", "write", "xb_firmware_update", "xb_open", "xb_read", "xb_send_at_cmd", "xb_wait_for_reply", "xb_write", "xmodem_crc" ], "metrics": { "ast": { "op.eq": 11.0, "op.ge": 1.0, "op.gt": 5.0, "op.le": 5.0, "op.lt": 10.0, "op.ne": 4.0, "op.add": 13.0, "op.bor": 5.0, "op.div": 3.0, "op.lor": 3.0, "op.mod": 4.0, "op.mul": 7.0, "op.shl": 3.0, "op.sub": 8.0, "op.xor": 2.0, "op.band": 13.0, "op.land": 2.0, "op.lnot": 3.0, "max_depth": 16.0, "op.concat": 13.0, "bind_count": 39.0, "call_count": 99.0, "node_count": 2955.0, "member_count": 7.0, "op_density.eq": 0.0, "op_density.ge": 0.0, "op_density.gt": 0.0, "op_density.le": 0.0, "op_density.lt": 0.0, "op_density.ne": 0.0, "op_density.add": 0.0, "op_density.bor": 0.0, "op_density.div": 0.0, "op_density.lor": 0.0, "op_density.mod": 0.0, "op_density.mul": 0.0, "op_density.shl": 0.0, "op_density.sub": 0.0, "op_density.xor": 0.0, "op_density.band": 0.0, "op_density.land": 0.0, "op_density.lnot": 0.0, "identifier_count": 114.0, "member_depth_max": 2.0, "op_density.concat": 0.0, "infinite_loop_count": 1.0, "string_literal_count": 49.0, "string_concat_chain_max_length": 2.0 }, "file": { "size": 9422.0, "entropy": 5.4, "size_bytes": 9422.0 }, "text": { "tab_count": 442.0, "digit_ratio": 0.05, "space_count": 1134.0, "total_lines": 454.0, "char_entropy": 5.4, "mixed_indent": 1.0, "unique_chars": 89.0, "escape_density": 0.06, "string_density": 0.11, "avg_line_length": 19.75, "max_line_length": 81.0, "empty_line_ratio": 0.19, "hex_escape_count": 5.0, "last_line_length": 1.0, "whitespace_ratio": 0.22, "most_common_ratio": 0.06, "identifier_density": 1.06, "line_length_stddev": 18.55, "octal_escape_count": 1.0, "normalized_string_count": 2.3, "repeated_char_sequences": 4.0, "most_common_char_is_null": 0.0, "suspicious_comment_ratio": 0.05, "max_inline_whitespace_run": 3.0, "most_common_char_codepoint": 101.0, "suspicious_identifier_ratio": 0.02, "normalized_unique_identifiers": 12.92 }, "binds": { "count": 39.0 }, "calls": { "count": 99.0 }, "binary": { "overall_entropy": 5.4, "peak_region_bytes": 9422.0, "peak_region_entropy": 5.44 }, "source": { "class_count": 6.0, "function_count": 9.0 }, "imports": { "count": 17.0, "unique_modules": 17.0, "third_party_count": 17.0, "third_party_ratio": 1.0 }, "members": { "count": 7.0 }, "strings": { "total": 49.0, "ip_count": 1.0, "avg_length": 22.12, "max_length": 53.0, "path_count": 1.0, "avg_entropy": 3.1, "total_bytes": 1084.0, "entropy_stddev": 1.35 }, "comments": { "chars": 1740.0, "lines": 56.0, "total": 37.0, "to_code_ratio": 0.14, "url_in_comments": 2.0, "high_entropy_comments": 2.0 }, "functions": { "count": 15.0 }, "identifiers": { "count": 114.0, "total": 482.0, "avg_length": 6.22, "max_length": 18.0, "min_length": 1.0, "avg_entropy": 2.25, "reuse_ratio": 0.24, "unique_count": 114.0, "length_stddev": 2.88, "has_digit_ratio": 0.04, "sequential_names": 2.0, "single_char_count": 2.0, "single_char_ratio": 0.02, "high_entropy_count": 2.0, "high_entropy_ratio": 0.02, "all_lowercase_ratio": 0.75, "all_uppercase_ratio": 0.2, "numeric_suffix_count": 5.0, "double_underscore_count": 1.0, "underscore_prefix_count": 2.0 } } }, "id": 3, "mol": "H₂(F₂Po₂)", "path": "/data/samples/unknown/foraged/macos/brew.sh/_/xbee-comm/v1.5.tar.gz!!xbee-comm-1.5/src/bin/xbfwup.c", "pid": 0, "risk": 3, "sha": "49ba5a9ddefdee600a3f0d1d68a601a10b4b2b452e9320c815e46d468a54c9d0", "size": 9422, "traits": [ { "id": "micro-behaviors/fs/file/write/direct::write--write", "conf": 0.6600000262260437, "crit": 2, "desc": "References POSIX write API", "spans": [ [ 1857, 5 ] ] }, { "id": "micro-behaviors/communications/socket/multiplex::poll-multiplex", "crit": 3, "desc": "poll() I/O multiplexing", "spans": [ [ 1677, 4 ] ] }, { "id": "micro-behaviors/fs/file/read::read", "conf": 0.699999988079071, "crit": 2, "desc": "Read file descriptor (read/pread)", "spans": [ [ 1241, 4 ] ] }, { "id": "micro-behaviors/process/info/selfpath::check-argv-0", "conf": 0.800000011920929, "crit": 3, "desc": "Accesses argv[0] (Self path)", "spans": [ [ 8894, 7 ] ] }, { "id": "micro-behaviors/fs/file/stat::stat-core", "conf": 0.800000011920929, "crit": 3, "desc": "Read file status and metadata (core)", "spans": [ [ 2956, 5 ] ] }, { "id": "micro-behaviors/process/tty/pty::tcgetattr", "atk": "T1059", "conf": 0.75, "crit": 3, "desc": "Get terminal attributes", "spans": [ [ 6225, 9 ] ] }, { "id": "micro-behaviors/fs/file/binary::file-read-operation", "atk": "T1005", "conf": 0.75, "crit": 1, "desc": "File-reading capability", "spans": [ [ 1241, 4 ] ] }, { "id": "micro-behaviors/fs/file/write/direct::write", "conf": 0.6600000262260437, "crit": 2, "desc": "POSIX file-write capability", "spans": [ [ 1857, 5 ] ] }, { "id": "micro-behaviors/fs/file/binary::file-manipulation", "atk": "T1005", "conf": 0.75, "crit": 3, "desc": "File content manipulation (read/write/seek)", "spans": [ [ 1241, 4 ], [ 1857, 5 ] ] } ], "type": "c" }, { "id": 4, "sha": "1d160adb05601edb384deea480c34b45022dd956fa227705f54263966e27118f", "path": "/data/samples/unknown/foraged/macos/brew.sh/_/xbee-comm/v1.5.tar.gz!!xbee-comm-1.5/src/lib/xb_ctx.h", "size": 1429, "type": "c", "depth": 1 }, { "id": 5, "sha": "9dce4882935c7e507b3cd319df420b30afe015dd2df686ae95e5ac48dddcc5e1", "path": "/data/samples/unknown/foraged/macos/brew.sh/_/xbee-comm/v1.5.tar.gz!!xbee-comm-1.5/src/lib/xb_buffer.h", "size": 1744, "type": "c", "depth": 1 }, { "ctx": [ { "b": "asW", "ln": 3, "addr": 38 }, { "b": "asXHkxLzJgAb](fA:-/cx(+zeA+e/8B8LVjCvtJ6iV@Y^BS+g5zxJ$hwncabA+P09By=OeBrC1fwg}\u003ewaz(4cx\u003ezR", "n": [ { "c": 2, "d": "Contains frequent English function words", "i": "metadata/file/profile/language::lang-english", "o": 44, "z": 4, "cf": 0.800000011920929 } ], "ln": 4, "addr": 41 }, { "b": "asXHFBrCZzwmY^7BzbkdBy/GfB0bykaARpdav/gbav*0XwPzi}aw^h\u0026y?Wx4oLF0FzGxwivriMgBZ/f3B7/b}ayYP", "ln": 5, "addr": 113 } ], "depth": 1, "facts": { "imp": [ [ "", "malloc" ], [ "", "free" ], [ "", "free" ], [ "", "malloc" ], [ "", "xb_buffer_new_value" ], [ "", "xb_buffer_new_value" ], [ "", "xb_buffer_new_value" ], [ "", "xb_buffer_new_value" ], [ "", "xb_buffer_new_value" ], [ "", "buffer_new" ], [ "", "buffer_put_uint8" ], [ "", "buffer_put_uint8" ], [ "", "buffer_put_uint16" ], [ "", "buffer_put_uint32" ], [ "", "buffer_put_uint64" ], [ "", "buffer_sprintf" ], [ "", "htobe16" ], [ "", "memcpy" ], [ "", "buffer_new" ], [ "", "buffer_sprintf" ], [ "", "buffer_sprintf" ], [ "", "buffer_sprintf" ], [ "", "buffer_sprintf" ], [ "", "buffer_sprintf" ], [ "", "\u003cstdlib.h\u003e" ], [ "", "\u003cstring.h\u003e" ], [ "", "xb_buffer.h" ] ], "mbr": [ "buf.data", "buf.frame_id", "buf.head", "buf.tail", "buf.tail.next", "buf.writepos", "val.len", "val.next", "val.type", "val.value", "val.value.at_cmd", "val.value.u16", "val.value.u32", "val.value.u64", "val.value.u8", "valptr.next", "valptr.type", "valptr.value", "valptr.value.at_cmd", "valptr.value.u16", "valptr.value.u32", "valptr.value.u64", "valptr.value.u8", "xbuf.frame_id", "xbuf.head" ], "tgt": [ "buffer_new", "buffer_put_uint16", "buffer_put_uint32", "buffer_put_uint64", "buffer_put_uint8", "buffer_sprintf", "free", "htobe16", "malloc", "memcpy", "xb_buffer_new_value" ], "metrics": { "ast": { "op.lt": 1.0, "op.add": 2.0, "op.sub": 2.0, "op.band": 1.0, "op.lnot": 10.0, "max_depth": 14.0, "op.concat": 18.0, "bind_count": 40.0, "call_count": 24.0, "node_count": 1795.0, "member_count": 25.0, "op_density.lt": 0.0, "op_density.add": 0.0, "op_density.sub": 0.0, "op_density.band": 0.0, "op_density.lnot": 0.01, "identifier_count": 58.0, "member_depth_max": 3.0, "op_density.concat": 0.01, "string_literal_count": 7.0, "string_concat_chain_max_length": 2.0 }, "file": { "size": 6268.0, "entropy": 5.35, "size_bytes": 6268.0 }, "text": { "tab_count": 275.0, "digit_ratio": 0.05, "space_count": 487.0, "total_lines": 313.0, "char_entropy": 5.35, "mixed_indent": 1.0, "unique_chars": 83.0, "string_density": 0.02, "avg_line_length": 19.03, "max_line_length": 76.0, "empty_line_ratio": 0.19, "last_line_length": 1.0, "whitespace_ratio": 0.17, "most_common_ratio": 0.06, "identifier_density": 1.14, "line_length_stddev": 19.96, "normalized_string_count": 0.4, "most_common_char_is_null": 0.0, "suspicious_comment_ratio": 0.29, "max_inline_whitespace_run": 2.0, "most_common_char_codepoint": 117.0, "suspicious_identifier_ratio": 0.03, "normalized_unique_identifiers": 7.0 }, "binds": { "count": 40.0 }, "calls": { "count": 24.0 }, "binary": { "overall_entropy": 5.35, "peak_region_bytes": 6268.0, "peak_region_entropy": 5.37 }, "source": { "class_count": 4.0, "function_count": 16.0 }, "imports": { "count": 3.0, "unique_modules": 3.0, "third_party_count": 3.0, "third_party_ratio": 1.0 }, "members": { "count": 25.0 }, "strings": { "total": 7.0, "avg_length": 4.71, "max_length": 11.0, "avg_entropy": 1.67, "total_bytes": 33.0, "entropy_stddev": 0.66 }, "comments": { "chars": 1037.0, "lines": 24.0, "total": 7.0, "xxx_count": 2.0, "to_code_ratio": 0.08, "url_in_comments": 1.0, "high_entropy_comments": 2.0 }, "functions": { "count": 20.0 }, "identifiers": { "count": 58.0, "total": 357.0, "avg_length": 11.83, "max_length": 25.0, "min_length": 1.0, "avg_entropy": 2.76, "reuse_ratio": 0.16, "unique_count": 58.0, "length_stddev": 7.11, "has_digit_ratio": 0.36, "sequential_names": 2.0, "single_char_count": 1.0, "single_char_ratio": 0.02, "high_entropy_count": 9.0, "high_entropy_ratio": 0.16, "all_lowercase_ratio": 0.59, "all_uppercase_ratio": 0.05, "numeric_suffix_count": 21.0 } } }, "id": 6, "path": "/data/samples/unknown/foraged/macos/brew.sh/_/xbee-comm/v1.5.tar.gz!!xbee-comm-1.5/src/lib/xb_buffer.c", "pid": 0, "risk": 1, "sha": "0f89667b9f751966c27327b6dd96d96c34f88549d16c20b71f29413d879331d6", "size": 6268, "traits": [ { "id": "metadata/file/profile/language::lang-english", "conf": 0.800000011920929, "crit": 2, "desc": "Contains frequent English function words", "spans": [ [ 44, 4 ] ] } ], "type": "c" }, { "id": 7, "sha": "ef0caeaa0ed8a7b733035cfff27a4627d46d9ee92adcfdc022ecef4beae9f616", "path": "/data/samples/unknown/foraged/macos/brew.sh/_/xbee-comm/v1.5.tar.gz!!xbee-comm-1.5/src/lib/buffer.h", "size": 1702, "type": "c", "depth": 1 }, { "id": 8, "sha": "c51162c112fc852c4052edd99a7b4217820d5e61ed2bb9aaf31d410a8b6fae71", "path": "/data/samples/unknown/foraged/macos/brew.sh/_/xbee-comm/v1.5.tar.gz!!xbee-comm-1.5/src/lib/buffer.c", "size": 3552, "type": "c", "depth": 1 }, { "id": 9, "sha": "240d3d876b2eaa1e558557b7d3879fa0a45d617288f42509c422728f994adc24", "path": "/data/samples/unknown/foraged/macos/brew.sh/_/xbee-comm/v1.5.tar.gz!!xbee-comm-1.5/src/bin/Makefile.am", "size": 121, "type": "makefile", "depth": 1 }, { "id": 10, "sha": "abec420e44e3136be1c88bedfefaa0f0c4ee8eeda78061c424281649ebfc1099", "path": "/data/samples/unknown/foraged/macos/brew.sh/_/xbee-comm/v1.5.tar.gz!!xbee-comm-1.5/Makefile.am", "size": 45, "type": "makefile", "depth": 1 }, { "ctx": [ { "b": "arR^HarR^HarR^HarR^HarR^HarTY@A=U@kzxH.^atL@1n{b2.atLS8hWP)mlVl{?A+Pf1Brz#0diHx1fGgazA+e/8q/un\u0026CvtJ6avZo(zE^f$x(v(uaw3DXe*9n\u0026BAzE.fe3{Uw?F1xxd(BQavQD+A^qOvwGUYdaAg[jze19lwN({9zY\u0026LdAcSNmzE:(2x(!xpx\u003c#jbwGVecA:\u0026E0x(a#5z/xA4A%:4dw/#hex(+zkx\u003e7Z(B7DF8z!0{bwO#PvayYFnay/7[zF9W3xcp]gazC)tzF%RtvqG:#Cv+qq3jm)#arR^HarR^HarR^HarR^HarR^HarR^HarTH3wNPB+y?i}XarTS%wGTGrruK!yzE)\u0026%y-(L%vR/:*awuGVwO#N2azC)tvixf5wO0znv@Dsiy?mj2az++4wO#N2azbLj3uHb$BA.elwGUA0wft/jxK#ibyIvV%B0bykaA}:AyJz9n3lQD\u003cxK@r5x\u003e7Z(B7Gznw]zYjzeTGqaAIEkBA.elwGUA0wft/jxK#ibAb]w%Bzkk[y-)}uA+/.s", "ln": 48, "col": 2, "line": 2 }, { "b": "zE)\u0026%y-(L%vR/:*awuGVwO#N2B0a[iwGUI{B7]o8wN({9zY\u0026[9yH[SfB-I4oBzb98aBd)F3tr\u003c\u003ewGV8dwGUP9wO2y\u003cz6i}say]hcBAh88B-.gqv@Ds2wPF#jw/$YawO009z!s9nvrb{4c$d17ay/7[A+w@aw]zX%Bzbl5azCBgD2E*FCwhbidj=P-xKM09D2E*FAS", "ln": 1028, "col": 15, "line": 23 }, { "b": "BZ]8cvixJfz!B90z7D/NxK#p0wPwb\u003cA::67B0bywazbLjayMy8wO0znD2E*Fzfo]waAg+gB0bysaARJABzbkdA+e-{Aa@)3BAnNDxK@rcvqPM.w].D]wn=saaARp9BrC\u003cEBS+Zov}xv$wN)zoax-S9az(mxBrCBeyH[SfB-I4oBzb98aARpdC}p7W", "ln": 1679, "col": 45, "line": 34 }, { "b": "z*9sCxK$)#aAzgexMOqF3jm)#l$HKMy\u0026so7A=SvBxKM09B-RapBzbkdm]05bm]h(4Ab](swN/*8D2E?CaAzgexMOqrCwhejaAR*CaAIToAc15Ec]0d[vrlH3A=-Blz/x#xx\u003eIa3aA8cuBzbkdB8LVjCvtJ6efFwswfroQdiJLvw[u09D2E*FBzbxfawuGVwO#N23tj6@x(mMaD2E*Fy?ml/y-)XdA=2JiB7]MgaARJAv@DsiefFFqB98CpvS=^7ayPd#fk\u003e\u003eNzeS%0w{CIkBs)[carTc(AV/EqwGUI{C4CGdAaK6hcM(\u0026nwftr6BzbPkB0\u00268HA=l5hv@#B6zy=]LxK@qRp!S0w", "ln": 1913, "col": 3, "line": 38 }, { "b": "z/fRG3jm)#q/uI:ay]5bx\u003e7Z}ayPq4ay]58x\u003eIr{wft#jay]53C{4lJwPz\u0026mvpJ!UB8@ECzY\u0026+iB97\u0026by-)UpaAzQx3t\u003cY(x\u003ez6\u003cwfu5bA=U@kzGu}sw/#hewGV5jw]@l9A+cwczGxJ5wGV8dwO\u0026$vvqH40z/]YaaARpdaz\u003eL8B.k5(BAIRnATDq+zxF", "ln": 2443, "col": 26, "line": 48 }, { "b": "vqG:5zF%Shv}xZ7z!pblxK@q{vSM9#v}u^3w/$J1C{4rtA=LPaBA]}\u003cvqYP#xk8K2ayP853uxY/x(E=$zGG}xvix5#AcSNAw/#hex(+y\u003cx\u003e7Z(B7DF5y\u0026si7aA}KwxDRzgwGT/\u0026z!B90z7Ve5arT*9BS+KfC{3Qgvrc0(ayPekaAhvnv}u^3AV/mr", "ln": 10201, "col": 13, "line": 202 }, { "b": "woz{7B1wCxB-.qnA+P\u0026dBzkVhazULlB1wCLAV/pxxK#ibx(mK3A=2lbx(v(iA+flkx(W=}aARJAx(n0lvqG-!vqYP#wQ4=@B-.gqzeS%0w[+*!aA?spB7]MgB0bykayMy5z*2YjwN({cz/PRox(k5nxKM09rDz.(aw^8%wozy7azbUjz3\u003cX]zeS%0w[+*!", "ln": 15988, "col": 6, "line": 311 }, { "b": "v@@\u0026czxKdpx\u003e7*0x(\u003eFhvriM2wO2:4zeS%0w[+*!aA8oyx(n0lvqG:\u003ewg!#El1szoB8@ECzY\u0026D}zE){lz/PRozddYjvR3V)wO#i[wfu8fwO@SjxK@r6z!9M]x\u003e7N[x(v(ix([Acy?s/bvru73x\u003c\u003e*]C{3Kkwc#:QC4CYnwO=Smvp\u003ca.v@#=mBzbkdz/t", "ln": 17241, "col": 15, "line": 332 }, { "b": "B-.qnA=Svww/#hewGU?#By/GbvqF1Fz/Mf(arR^HwHO-\u0026wN/K\u003czFs03aARJAxl4A#BrCQrxj#ydaA.NjwPw]nA:-G\u0026zddE2az+FgazbLjaA.:paA7\u003cmB8L]b3lQDlaARTjwmV)3vqPN%efG4PvpS}^vrcd8efF\u003eKaAIamC4\u003eC$az\u003eLcyJzMWz/Mf(ao", "ln": 19566, "col": 6, "line": 377 }, { "b": "zddJ$A+O@#aA.NjwPw]mwN/*@z/cWLfFiXtarSV%avfHEwPh:1zEWl2ph+j%qE%\u0026\u003cx(W=}azbLjav]{:x(mMalVl{TwPGEh3lQD]z/)ghA+cwhz/^axwPq\u003cbA+e=7Bz\u0026pgv}f7?BrCWsx(+y\u003cx\u003e7Z(B7DFdzxJ\u003erwmY^7Bz\u0026pxwN/p=C4z!mATD\u0026fzxJvg", "ln": 22374, "col": 1, "line": 433 }, { "b": "awuG^x()^9x(v(iz!pa=x\u003c\u003eE+y?X0pe^.}daw2rJper03rZ/+.axqfgmn)bcqBKC.nM4#BavoiNk#pxKnKC^goHQ6$l02g8qxOm}qBK2xaxhbVnLQyfqB%?VpdCT)nLz/2k#7M9lR*JYqB%wHr3j.coHIrEefE.^ave+9awU%cmn+m8k#HV+axI9fawCT1", "ln": 31364, "col": 6, "line": 600 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 35147, "entropy": 4.57 }, "binary": { "peak_region_bytes": 18763, "peak_region_entropy": 4.86 } } }, "id": 11, "mol": "K(Te)", "path": "/data/samples/unknown/foraged/macos/brew.sh/_/xbee-comm/v1.5.tar.gz!!xbee-comm-1.5/COPYING", "pid": 0, "risk": 1, "sha": "8ceb4b9ee5adedde47b31e975c1d90c73ad27b6b165a1dcd80c7c545eb65b903", "size": 35147, "traits": [ { "id": "well-known/tool/development/vcs/github-web::github-repo-fetched-path", "conf": 0.98, "crit": 3, "desc": "Fetched github.com repository artifact" }, { "id": "metadata/lang/natural::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"", "spans": [ [ 326, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-2", "conf": 0.8, "crit": 1, "desc": "English function-word token \"and\"", "spans": [ [ 195, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-3", "conf": 0.8, "crit": 1, "desc": "English function-word token \"that\"", "spans": [ [ 1076, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-4", "conf": 0.8, "crit": 1, "desc": "English function-word token \"have\"", "spans": [ [ 1085, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "spans": [ [ 385, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-6", "conf": 0.8, "crit": 1, "desc": "English function-word token \"with\"", "spans": [ [ 1985, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-7", "conf": 0.8, "crit": 1, "desc": "English function-word token \"this\"", "spans": [ [ 230, 0 ] ] } ], "type": "text" }, { "id": 12, "sha": "7dd4f4e8159347d0b9bf433b41a987db8cfaea31174e3096d94b3bb38d91a3bf", "path": "/data/samples/unknown/foraged/macos/brew.sh/_/xbee-comm/v1.5.tar.gz!!xbee-comm-1.5/src/ui/xbee-comm.glade", "size": 14348, "type": "xml", "depth": 1 } ], "omitted_files": 7, "rev": "8eeac", "v": "8" } }