{
  "ml": {
    "l": -1,
    "v": "6",
    "fs": [
      {
        "l": -1,
        "id": 0,
        "prob": 0.000021765628844150342
      }
    ],
    "prob": 0.000021765629,
    "models": [
      {
        "m": "az",
        "raw": 0.000021765629,
        "prob": 0.000021765629,
        "class": 0
      },
      {
        "m": "az/source",
        "raw": 0.00007548928,
        "prob": 0.00007548928,
        "class": 0
      },
      {
        "m": "az/c",
        "raw": 0.00003167987,
        "prob": 0.00003167987,
        "class": 0
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-06-09T16:22:22Z"
  },
  "path": "main.c",
  "raw": {
    "v": "6",
    "fs": [
      {
        "f": "H(Ds)",
        "x": 2,
        "ff": {
          "i": [
            [
              "",
              "VirtualProtect"
            ],
            [
              "",
              "LoadLibraryA"
            ],
            [
              "",
              "GetProcAddress"
            ],
            [
              "",
              "GetProcAddress"
            ],
            [
              "",
              "VirtualAlloc"
            ],
            [
              "",
              "VirtualAlloc"
            ],
            [
              "",
              "memcpy"
            ],
            [
              "",
              "memcpy"
            ],
            [
              "",
              "MapImageToMemory"
            ],
            [
              "",
              "printf"
            ],
            [
              "",
              "FixImageIAT"
            ],
            [
              "",
              "printf"
            ],
            [
              "",
              "Sleep"
            ],
            [
              "",
              "DeactivateActCtx"
            ],
            [
              "",
              "ReleaseActCtx"
            ],
            [
              "",
              "../../build/main.h"
            ],
            [
              "",
              "../../build/pe_image.h"
            ],
            [
              "",
              "\u003cstdio.h\u003e"
            ],
            [
              "",
              "\u003cwindows.h\u003e"
            ]
          ],
          "m": {
            "ast": {
              "op.eq": 2.0,
              "op.lt": 1.0,
              "op.ne": 2.0,
              "op.add": 15.0,
              "op.bor": 2.0,
              "op.mul": 1.0,
              "op.band": 4.0,
              "op.lnot": 1.0,
              "max_depth": 21.0,
              "op.concat": 22.0,
              "bind_count": 11.0,
              "call_count": 32.0,
              "node_count": 1128.0,
              "member_count": 24.0,
              "op_density.eq": 0.0,
              "op_density.lt": 0.0,
              "op_density.ne": 0.0,
              "op_density.add": 0.01,
              "op_density.bor": 0.0,
              "op_density.mul": 0.0,
              "op_density.band": 0.0,
              "op_density.lnot": 0.0,
              "identifier_count": 85.0,
              "member_depth_max": 3.0,
              "op_density.concat": 0.02,
              "string_literal_count": 5.0,
              "string_concat_chain_max_length": 3.0
            },
            "file": {
              "size": 5135.0,
              "entropy": 5.06,
              "size_bytes": 5135.0
            },
            "text": {
              "digit_ratio": 0.01,
              "space_count": 1158.0,
              "total_lines": 157.0,
              "char_entropy": 5.06,
              "unique_chars": 81.0,
              "string_density": 0.03,
              "ascii_art_lines": 2.0,
              "avg_line_length": 31.71,
              "max_line_length": 186.0,
              "empty_line_ratio": 0.25,
              "last_line_length": 1.0,
              "long_token_count": 1.0,
              "whitespace_ratio": 0.26,
              "most_common_ratio": 0.05,
              "identifier_density": 1.65,
              "line_length_stddev": 41.14,
              "normalized_string_count": 0.4,
              "repeated_char_sequences": 22.0,
              "most_common_char_is_null": 0.0,
              "max_inline_whitespace_run": 73.0,
              "trailing_whitespace_lines": 8.0,
              "most_common_char_codepoint": 101.0,
              "suspicious_identifier_ratio": 0.02,
              "normalized_unique_identifiers": 11.65
            },
            "binds": {
              "count": 11.0
            },
            "calls": {
              "count": 32.0
            },
            "binary": {
              "overall_entropy": 5.06
            },
            "source": {
              "function_count": 3.0
            },
            "imports": {
              "count": 4.0,
              "relative_ratio": 0.5,
              "unique_modules": 4.0,
              "relative_imports": 2.0,
              "third_party_count": 4.0,
              "third_party_ratio": 1.0
            },
            "members": {
              "count": 24.0
            },
            "strings": {
              "total": 5.0,
              "avg_length": 21.0,
              "max_length": 43.0,
              "path_count": 2.0,
              "avg_entropy": 3.33,
              "total_bytes": 105.0,
              "entropy_stddev": 0.74
            },
            "comments": {
              "chars": 721.0,
              "lines": 12.0,
              "total": 2.0,
              "to_code_ratio": 0.08
            },
            "functions": {
              "count": 3.0
            },
            "identifiers": {
              "count": 85.0,
              "total": 259.0,
              "avg_length": 11.14,
              "max_length": 36.0,
              "min_length": 1.0,
              "avg_entropy": 2.84,
              "reuse_ratio": 0.33,
              "unique_count": 85.0,
              "length_stddev": 6.37,
              "has_digit_ratio": 0.02,
              "sequential_names": 2.0,
              "single_char_count": 1.0,
              "single_char_ratio": 0.01,
              "high_entropy_count": 14.0,
              "high_entropy_ratio": 0.16,
              "all_lowercase_ratio": 0.34,
              "all_uppercase_ratio": 0.31,
              "numeric_suffix_count": 2.0
            }
          },
          "s": [
            [
              707,
              "u8",
              "\u003cwindows.h\u003e"
            ],
            [
              728,
              "u8",
              "\u003cstdio.h\u003e"
            ],
            [
              748,
              "u8",
              "../../build/main.h"
            ],
            [
              749,
              "u8",
              "../../build/main.h"
            ],
            [
              778,
              "u8",
              "../../build/pe_image.h"
            ],
            [
              779,
              "u8",
              "../../build/pe_image.h"
            ],
            [
              2380,
              "16",
              "65535"
            ],
            [
              3981,
              "10",
              "0"
            ],
            [
              4336,
              "10",
              "0"
            ],
            [
              4439,
              "10",
              "1"
            ],
            [
              4631,
              "u8",
              "%s\\n"
            ],
            [
              4632,
              "u8",
              "%s"
            ],
            [
              4639,
              "u8",
              "[!] Unable to call PE, likely thats invalid"
            ],
            [
              4640,
              "u8",
              "[!] Unable to call PE, likely thats invalid"
            ],
            [
              4945,
              "u8",
              "[+] calling 0x%p\\n"
            ],
            [
              4946,
              "u8",
              "[+] calling 0x%p"
            ],
            [
              4985,
              "10",
              "5"
            ],
            [
              5070,
              "10",
              "0"
            ],
            [
              5130,
              "10",
              "0"
            ],
            [
              1170,
              "xor",
              "!!7 66enem"
            ],
            [
              1299,
              "xor",
              "!!7 66leze"
            ],
            [
              4087,
              "xor",
              "!!7 66enem"
            ]
          ],
          "v": {
            "file.stem": "main",
            "file.basename": "main.c",
            "source.language": "c",
            "source.imports[0]": "../../build/main.h",
            "source.imports[1]": "../../build/pe_image.h",
            "source.imports[2]": "\u003cstdio.h\u003e",
            "source.imports[3]": "\u003cwindows.h\u003e",
            "source.imports[4]": "DeactivateActCtx",
            "source.imports[5]": "FixImageIAT",
            "source.imports[6]": "GetProcAddress",
            "source.imports[7]": "LoadLibraryA",
            "source.imports[8]": "MapImageToMemory",
            "source.imports[9]": "ReleaseActCtx",
            "source.strings[0]": "!!7 66enem",
            "source.strings[1]": "!!7 66leze",
            "source.strings[2]": "../../build/main.h",
            "source.strings[3]": "../../build/pe_image.h",
            "source.strings[4]": "\u003cstdio.h\u003e",
            "source.strings[5]": "\u003cwindows.h\u003e",
            "source.strings[6]": "[!] Unable to call PE, likely thats invalid",
            "source.strings[7]": "[+] calling 0x%p",
            "source.strings[8]": "[+] calling 0x%p\\n",
            "source.has_imports": true,
            "source.imports[10]": "Sleep",
            "source.imports[11]": "VirtualAlloc",
            "source.imports[12]": "VirtualProtect",
            "source.imports[13]": "memcpy",
            "source.imports[14]": "printf",
            "source.functions[0]": "FixImageIAT( PIMAGE_DOS_HEADER dos_header, PIMAGE_NT_HEADERS nt_header)",
            "source.functions[1]": "MapImageToMemory(LPVOID base_addr)",
            "source.functions[2]": "main()"
          },
          "ct": [
            "DeactivateActCtx",
            "FixImageIAT",
            "GetProcAddress",
            "LoadLibraryA",
            "MapImageToMemory",
            "ReleaseActCtx",
            "Sleep",
            "VirtualAlloc",
            "VirtualProtect",
            "memcpy",
            "printf"
          ],
          "id": "c",
          "mc": [
            "fixup.u1",
            "fixup.u1.Function",
            "image_base.e_lfanew",
            "import_table.FirstThunk",
            "import_table.Name",
            "import_table.OriginalFirstThunk",
            "nt_header.FileHeader",
            "nt_header.FileHeader.NumberOfSections",
            "nt_header.OptionalHeader",
            "nt_header.OptionalHeader.AddressOfEntryPoint",
            "nt_header.OptionalHeader.DataDirectory",
            "nt_header.OptionalHeader.ImageBase",
            "nt_header.OptionalHeader.SizeOfHeaders",
            "nt_header.OptionalHeader.SizeOfImage",
            "nt_header.Signature",
            "raw_image_base.e_lfanew",
            "raw_image_base.e_magic",
            "section_header.PointerToRawData",
            "section_header.SizeOfRawData",
            "section_header.VirtualAddress",
            "thunk.u1",
            "thunk.u1.AddressOfData",
            "thunk.u1.Function",
            "thunk.u1.Ordinal"
          ]
        },
        "id": 0,
        "sz": 5135,
        "ts": [
          {
            "c": 1.0,
            "d": "LoadLibrary symbol",
            "e": [
              "LoadLibraryA"
            ],
            "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym",
            "l": 1,
            "el": [
              "69d"
            ]
          },
          {
            "a": "T1574.002",
            "c": 0.949999988079071,
            "d": "LoadLibraryA call in source",
            "e": [
              "LoadLibraryA"
            ],
            "i": "micro-behaviors/dylib/load/source::load-library-a-source",
            "l": 3
          },
          {
            "c": 0.800000011920929,
            "d": "PE header DOS signature reference",
            "e": [
              "IMAGE_DOS_SIGNATURE"
            ],
            "i": "micro-behaviors/fs/file/section::asm-pe-header-manipulation-dos",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "PE header SizeOfImage reference",
            "e": [
              "SizeOfImage"
            ],
            "i": "micro-behaviors/fs/file/section::asm-pe-header-manipulation-sizeofimage",
            "l": 1
          },
          {
            "a": "T1055",
            "c": 0.9200000166893005,
            "d": "RWX memory API call in source",
            "e": [
              "VirtualAlloc(NULL, nt_header-\u003eOptionalHeader.SizeOfImage, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE"
            ],
            "i": "objectives/evasion/process/injection/shellcode::rwx-memory-api-source",
            "l": 1,
            "m": "B0033"
          },
          {
            "a": "T1587.001",
            "c": 0.8999999761581421,
            "d": "Allocate virtual memory",
            "e": [
              "VirtualAlloc"
            ],
            "i": "micro-behaviors/mem/protect/modify::virtual-alloc",
            "l": 2,
            "el": [
              "d92"
            ]
          },
          {
            "a": "T1055",
            "c": 0.6000000238418579,
            "d": "MEM_COMMIT | MEM_RESERVE allocation",
            "e": [
              "MEM_COMMIT | MEM_RESERVE"
            ],
            "i": "objectives/evasion/process/injection/memory::mem-commit-reserve",
            "l": 1,
            "m": "E1055"
          },
          {
            "c": 0.9200000166893005,
            "d": "PE import directory access",
            "e": [
              "IMAGE_DIRECTORY_ENTRY_IMPORT"
            ],
            "i": "micro-behaviors/process/hook/interception::pe-import-directory-source",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "PE VirtualAddress reference",
            "e": [
              "VirtualAddress"
            ],
            "i": "micro-behaviors/fs/file/section::asm-pe-header-manipulation-layout-virtualaddr",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "PE PointerToRawData reference",
            "e": [
              "PointerToRawData"
            ],
            "i": "micro-behaviors/fs/file/section::asm-pe-header-manipulation-layout-pointerraw",
            "l": 1
          },
          {
            "a": "T1222.001",
            "c": 0.949999988079071,
            "d": "Modify memory page protection",
            "e": [
              "VirtualProtect"
            ],
            "i": "micro-behaviors/mem/protect/modify::virtual-protect",
            "l": 2,
            "m": "C0021",
            "el": [
              "62d"
            ]
          },
          {
            "a": "T1014",
            "c": 0.9399999976158142,
            "d": "Regex component marker",
            "e": [
              "IMAGE_DOS_SIGNATURE"
            ],
            "i": "objectives/evasion/kernel-hide/rootkit::executable-read-patch-markers--rx-8",
            "l": 1
          },
          {
            "c": 0.9200000166893005,
            "d": "PE FirstThunk access",
            "e": [
              "FirstThunk"
            ],
            "i": "micro-behaviors/process/hook/interception::first-thunk-source",
            "l": 1
          },
          {
            "a": "T1055",
            "c": 0.8999999761581421,
            "d": "PAGE_EXECUTE_READWRITE flag",
            "e": [
              "PAGE_EXECUTE_READWRITE"
            ],
            "i": "micro-behaviors/mem/alloc/executable::page-execute-readwrite",
            "l": 1
          },
          {
            "a": "T1574.002",
            "c": 0.949999988079071,
            "d": "Windows GetProcAddress in source",
            "e": [
              "GetProcAddress"
            ],
            "i": "micro-behaviors/dylib/lookup::get-proc-address-source",
            "l": 2
          },
          {
            "c": 0.8199999928474426,
            "d": "Delay execution with Sleep in source",
            "e": [
              "Sleep"
            ],
            "i": "micro-behaviors/time/timing/delay::sleep-source",
            "l": 2,
            "el": [
              "1373"
            ]
          },
          {
            "c": 0.800000011920929,
            "d": "PE SizeOfRawData reference",
            "e": [
              "SizeOfRawData"
            ],
            "i": "micro-behaviors/fs/file/section::asm-pe-header-manipulation-layout-sizeofraw",
            "l": 1
          },
          {
            "c": 0.9700000286102295,
            "d": "Validation vocabulary invalid",
            "e": [
              "invalid"
            ],
            "i": "metadata/file/text/format::vocab-invalid",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "PE NumberOfSections reference",
            "e": [
              "NumberOfSections"
            ],
            "i": "micro-behaviors/fs/file/section::asm-pe-header-manipulation-layout-sections",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "VirtualProtect symbol",
            "e": [
              "VirtualProtect"
            ],
            "i": "objectives/anti-static/obfuscation/reflection/class::virtualprotect-sym",
            "l": 1,
            "el": [
              "62d"
            ]
          },
          {
            "c": 0.800000011920929,
            "d": "PE header NT signature reference",
            "e": [
              "IMAGE_NT_SIGNATURE"
            ],
            "i": "micro-behaviors/fs/file/section::asm-pe-header-manipulation-nt",
            "l": 1
          },
          {
            "c": 0.8799999952316284,
            "d": "Codebase deletion target",
            "e": [
              "code"
            ],
            "i": "micro-behaviors/data/text/keywords/lexicon::target-codebase",
            "l": 1
          },
          {
            "a": "T1055",
            "c": 0.699999988079071,
            "d": "PAGE_EXECUTE_READ allocation",
            "e": [
              "PAGE_EXECUTE_READ"
            ],
            "i": "objectives/evasion/process/injection/memory::page-execute-read",
            "l": 1,
            "m": "E1055"
          },
          {
            "c": 0.800000011920929,
            "d": "PE entry point header field",
            "e": [
              "AddressOfEntryPoint"
            ],
            "i": "micro-behaviors/fs/file/section::asm-pe-header-manipulation-entrypoint",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "Source references PE section layout fields",
            "e": [
              "SizeOfRawData",
              "VirtualAddress",
              "PointerToRawData",
              "NumberOfSections"
            ],
            "i": "micro-behaviors/fs/file/section::asm-pe-header-manipulation-layout",
            "l": 2
          },
          {
            "a": "T1055",
            "c": 1.0,
            "d": "Executable read with commit",
            "e": [
              "PAGE_EXECUTE_READ",
              "MEM_COMMIT | MEM_RESERVE"
            ],
            "i": "objectives/evasion/process/injection/memory::exec-read-commit",
            "l": 2,
            "m": "E1055"
          },
          {
            "c": 0.800000011920929,
            "d": "Source references multiple PE header fields",
            "e": [
              "IMAGE_DOS_SIGNATURE",
              "AddressOfEntryPoint",
              "SizeOfImage",
              "IMAGE_NT_SIGNATURE"
            ],
            "i": "micro-behaviors/fs/file/section::asm-pe-header-manipulation",
            "l": 2
          }
        ],
        "sha": "c805cdeb65d0b69535ab28932cb2e301d4f1f53ded1680f5ca71ec9ef57e631e",
        "path": "main.c",
        "type": "c"
      }
    ],
    "tv": "433e5"
  }
}