{ "ml": { "v": "7", "eng": "2.2.0-rc.1", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.048997324, "rte": "az", "prob": 0.048997324 } ], "prob": 0.048997324, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.04899732396006584, "type": "xz" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.00004676977914641611, "type": "jar" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.04899732396006584, "type": "java_class" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.00001566608807479497, "type": "java_class" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.000013907750144426245, "type": "java_class" }, { "id": 5, "lvl": -1, "conf": 0, "prob": 0.000016957521438598633, "type": "java" }, { "id": 6, "lvl": -1, "conf": 0, "prob": 0.000023146470994106494, "type": "java" }, { "id": 7, "lvl": -1, "conf": 0, "prob": 0.04899732396006584, "type": "shell" }, { "id": 8, "lvl": -1, "conf": 0, "prob": 0.04899732396006584, "type": "java_class" }, { "id": 9, "lvl": -1, "conf": 0, "prob": 0.04899732396006584, "type": "java_class" }, { "id": 10, "lvl": -1, "conf": 0, "prob": 0.04899732396006584, "type": "java_class" }, { "id": 11, "lvl": -1, "conf": 0, "prob": 0.04899732396006584, "type": "java_class" }, { "id": 12, "lvl": -1, "conf": 0, "prob": 0.04899732396006584, "type": "java_class" }, { "id": 13, "lvl": -1, "conf": 0, "prob": 0.04899732396006584, "type": "java_class" }, { "id": 14, "lvl": -1, "conf": 0, "prob": 0.04899732396006584, "type": "java_class" }, { "id": 15, "lvl": -1, "conf": 0, "prob": 0.04899732396006584, "type": "java_class" }, { "id": 16, "lvl": -1, "conf": 0, "prob": 0.04899732396006584, "type": "java_class" }, { "id": 17, "lvl": -1, "conf": 0, "prob": 0.04899732396006584, "type": "java_class" }, { "id": 18, "lvl": -1, "conf": 0, "prob": 0.04899732396006584, "type": "java_class" }, { "id": 19, "lvl": -1, "conf": 0, "prob": 0.04899732396006584, "type": "java" }, { "id": 20, "lvl": -1, "conf": 0, "prob": 0.000011553366675798316, "type": "java" }, { "id": 21, "lvl": -1, "conf": 0, "prob": 0.000011672575965349097, "type": "java" }, { "id": 22, "lvl": -1, "conf": 0, "prob": 0.04899732396006584, "type": "text" }, { "id": 23, "lvl": -1, "conf": 0, "prob": 0.04899732396006584, "type": "java_class" }, { "id": 24, "lvl": -1, "conf": 0, "prob": 0.000012099742889404297, "type": "java_class" }, { "id": 25, "lvl": -1, "conf": 0, "prob": 0.00001152356435341062, "type": "java_class" }, { "id": 26, "lvl": -1, "conf": 0, "prob": 0.04899732396006584, "type": "java_class" }, { "id": 27, "lvl": -1, "conf": 0, "prob": 0.04899732396006584, "type": "java_class" }, { "id": 28, "lvl": -1, "conf": 0, "prob": 0.000011394421562727075, "type": "java_class" }, { "id": 29, "lvl": -1, "conf": 0, "prob": 0.04899732396006584, "type": "java_class" } ], "version": "v18.18", "analyzed_at": "2026-06-27T23:12:01Z" }, "path": "applerecords-0.5nb1.tgz", "raw": { "files": [ { "id": 0, "mol": "O(C)H₂(CmPo₂)", "sha": "ca4d0473004f311a8d0a7912fe83c9a8c228ec905830c577ffa0210a39cdaf3e", "path": "applerecords-0.5nb1.tgz", "risk": 4, "size": 485848, "type": "xz", "facts": { "metrics": { "file": { "size": 485848.0, "entropy": 8.0, "size_bytes": 485848.0 }, "binary": { "overall_entropy": 8.0, "peak_region_bytes": 485848.0, "peak_region_entropy": 7.86 }, "consistency": { "extension_content_mismatch": 1.0, "extension_content_mismatch.archive_as_archive": 1.0 } } }, "traits": [ { "id": "net/url", "conf": 0.8500000238418579, "crit": 3, "desc": "URL reference", "from": [ { "file": 4 } ] }, { "id": "objectives/command-and-control/dropper/staged-loader::java-base64-stringbuilder-append-source", "atk": "T1105", "mbc": "B0042", "conf": 0.8799999952316284, "crit": 3, "desc": "Java Base64 StringBuilder append source", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/process/create/launch::java-jar-command-line", "atk": "T1059", "conf": 0.8500000238418579, "crit": 3, "desc": "Runs an executable JAR (java -jar)", "from": [ { "file": 7 } ] }, { "id": "micro-behaviors/process/create/shell/spawn::shell-exec", "atk": "T1059", "crit": 3, "desc": "Shell exec builtin (process replacement)", "from": [ { "file": 7 } ] }, { "id": "micro-behaviors/communications/dns/lookup/resolver::jvm-inetaddress-getbyname-source", "conf": 0.8199999928474426, "crit": 3, "desc": "JVM InetAddress getByName", "from": [ { "file": 6 } ] }, { "id": "micro-behaviors/process/create/shell/spawn::shell-symbols", "conf": 0.8999999761581421, "crit": 3, "desc": "Shell execution symbols", "from": [ { "file": 7 } ] }, { "id": "micro-behaviors/communications/dns/lookup/resolver::jvm-inetaddress-getbyname-bytecode", "conf": 0.8600000143051147, "crit": 3, "desc": "JVM bytecode InetAddress getByName", "from": [ { "file": 3 } ] } ] }, { "depth": 1, "facts": { "metrics": { "jar": { "class_count": 156, "entry_count": 355, "signature_count": 0, "embedded_jar_count": 0 }, "file": { "size": 541553, "entropy": 7.89 }, "binary": { "peak_region_bytes": 492544, "peak_region_entropy": 7.85 }, "archive": { "file_count": 355, "member_count": 409, "script_count": 0, "zip_bomb_ratio": 28.34, "compressed_size": 471923, "directory_count": 54, "executable_count": 0, "extra_field_size": 4, "noise_file_count": 0, "compression.ratio": 0.25, "hidden_file_count": 6, "uncompressed_size": 1888964, "crc_collision_count": 0, "entry_comment_count": 0, "max_filename_length": 78, "rtlo_filename_count": 0, "format.regular_count": 355, "nested_archive_count": 0, "path_traversal_count": 0, "symlink_escape_count": 0, "security.setgid_count": 0, "security.setuid_count": 0, "security.sticky_count": 0, "double_extension_count": 0, "duplicate_member_count": 0, "format.directory_count": 54, "security.symlink_count": 0, "unicode_filename_count": 0, "homoglyph_filename_count": 0, "security.encrypted_count": 0, "timing.mtime_unique_count": 6, "timing.mtime_unique_ratio": 0.01, "misplaced_executable_count": 0, "timing.mtime_outlier_count": 156, "timing.mtime_dominant_count": 253, "timing.mtime_spread_seconds": 2208, "timing.sentinel_mtime_count": 0, "security.world_writable_count": 0, "timing.mtime_dominant_fraction": 0.62, "compression.method_counts.stored": 53, "compression.method_counts.deflate": 356 } } }, "id": 1, "ident": { "trust": "unsigned", "producer": { "value": "1.4.1 (Blackdown Java-Linux Team)", "source": "jar.manifest.created_by", "verified": false } }, "mol": "H₂(CmPo)", "path": "applerecords-0.5nb1.tgz!!lib/applerecords/applerecords.jar", "pid": 0, "risk": 3, "sha": "1bfbb9ba9f49f67f839d2550b2bad1dfb20ac123f5f4600d0487488922fe0f8c", "size": 541553, "traits": [ { "id": "micro-behaviors/communications/dns/lookup/resolver::jvm-inetaddress-getbyname-bytecode", "conf": 0.86, "crit": 3, "desc": "JVM bytecode InetAddress getByName" }, { "id": "net/url", "conf": 0.85, "crit": 3, "desc": "URL reference" }, { "id": "micro-behaviors/communications/dns/lookup/resolver::jvm-inetaddress-getbyname-source", "conf": 0.82, "crit": 3, "desc": "JVM InetAddress getByName" }, { "id": "metadata/file/profile/identity::static-html-shell", "conf": 0.95, "crit": 1, "desc": "Static HTML document shell" }, { "id": "micro-behaviors/process/exit/terminate::jvm-system-exit-bytecode", "conf": 0.93, "crit": 3, "desc": "JVM invokes System.exit" }, { "id": "metadata/file/profile/identity::documentation-page-term", "conf": 0.82, "crit": 1, "desc": "Documentation page terminology" } ], "type": "jar" }, { "ctx": [ { "b": "+kO#^0000K0D!UFS%O\u0026R0iuFbDJpeM0iMUe1otRg0i=!g1]$[n0daZK2lq7q00@Uj3ig", "n": [ { "c": 3, "d": "Patterns associated with legitimate injectors to reduce FPs", "i": "objectives/evasion/process/injection/toolkit::legitimate-injector-patterns", "o": 0, "z": 22, "cf": 1.0 } ], "ln": 0 } ], "depth": 2, "facts": { "imp": [ [ "", "javax/jmdns/JmDNS" ], [ "", "java/awt/GridLayout" ], [ "", "java/io/IOException" ], [ "", "java/awt/BorderLayout" ], [ "", "javax/swing/DefaultListModel" ], [ "", "java/lang/StringBuffer" ], [ "", "javax/swing/JFrame" ], [ "", "java/awt/Container" ], [ "", "java/io/PrintStream" ], [ "", "javax/swing/event/ListSelectionEvent" ], [ "", "javax/swing/JPanel" ], [ "", "java/lang/String" ], [ "", "javax/jmdns/ServiceListener" ], [ "", "javax/jmdns/ServiceTypeListener" ], [ "", "javax/swing/JScrollPane" ], [ "", "javax/swing/JLabel" ], [ "", "com/strangeberry/jmdns/tools/Browser$ServiceTableModel" ], [ "", "java/awt/Color" ], [ "", "javax/swing/event/ListSelectionListener" ], [ "", "javax/swing/border/EmptyBorder" ], [ "", "javax/jmdns/ServiceInfo" ], [ "", "java/util/Enumeration" ], [ "", "javax/swing/JList" ], [ "", "javax/swing/JTextArea" ], [ "", "java/lang/System" ], [ "javax/jmdns/JmDNS", "javax/jmdns/JmDNS.addServiceListener" ], [ "javax/jmdns/JmDNS", "addServiceListener" ], [ "javax/swing/JTextArea", "javax/swing/JTextArea.setText" ], [ "javax/swing/JTextArea", "setText" ], [ "javax/jmdns/JmDNS", "javax/jmdns/JmDNS.getServiceInfo" ], [ "javax/jmdns/JmDNS", "getServiceInfo" ], [ "java/lang/StringBuffer", "java/lang/StringBuffer.\u003cinit\u003e" ], [ "java/lang/StringBuffer", "\u003cinit\u003e" ], [ "javax/jmdns/JmDNS", "javax/jmdns/JmDNS.removeServiceListener" ], [ "javax/jmdns/JmDNS", "removeServiceListener" ], [ "javax/jmdns/JmDNS", "javax/jmdns/JmDNS.addServiceTypeListener" ], [ "javax/jmdns/JmDNS", "addServiceTypeListener" ], [ "java/util/Enumeration", "java/util/Enumeration.hasMoreElements" ], [ "java/util/Enumeration", "hasMoreElements" ], [ "com/strangeberry/jmdns/tools/Browser", "com/strangeberry/jmdns/tools/Browser.getContentPane" ], [ "com/strangeberry/jmdns/tools/Browser", "getContentPane" ], [ "java/lang/String", "java/lang/String.equals" ], [ "java/lang/String", "equals" ], [ "javax/swing/JFrame", "javax/swing/JFrame.\u003cinit\u003e" ], [ "javax/swing/JFrame", "\u003cinit\u003e" ], [ "javax/swing/JPanel", "javax/swing/JPanel.\u003cinit\u003e" ], [ "javax/swing/JPanel", "\u003cinit\u003e" ], [ "java/io/PrintStream", "java/io/PrintStream.println" ], [ "java/io/PrintStream", "println" ], [ "javax/swing/DefaultListModel", "javax/swing/DefaultListModel.elementAt" ], [ "javax/swing/DefaultListModel", "elementAt" ], [ "javax/swing/DefaultListModel", "javax/swing/DefaultListModel.getSize" ], [ "javax/swing/DefaultListModel", "getSize" ], [ "javax/swing/JList", "javax/swing/JList.setBackground" ], [ "javax/swing/JList", "setBackground" ], [ "javax/swing/JList", "javax/swing/JList.setBorder" ], [ "javax/swing/JList", "setBorder" ], [ "javax/jmdns/ServiceInfo", "javax/jmdns/ServiceInfo.getPropertyNames" ], [ "javax/jmdns/ServiceInfo", "getPropertyNames" ], [ "javax/swing/JTextArea", "javax/swing/JTextArea.setText" ], [ "javax/swing/JTextArea", "setText" ], [ "javax/swing/event/ListSelectionEvent", "javax/swing/event/ListSelectionEvent.getSource" ], [ "javax/swing/event/ListSelectionEvent", "getSource" ], [ "com/strangeberry/jmdns/tools/Browser", "com/strangeberry/jmdns/tools/Browser.insertSorted" ], [ "com/strangeberry/jmdns/tools/Browser", "insertSorted" ], [ "com/strangeberry/jmdns/tools/Browser", "com/strangeberry/jmdns/tools/Browser.\u003cinit\u003e" ], [ "com/strangeberry/jmdns/tools/Browser", "\u003cinit\u003e" ], [ "java/awt/Container", "java/awt/Container.setLayout" ], [ "java/awt/Container", "setLayout" ], [ "java/lang/StringBuffer", "java/lang/StringBuffer.append" ], [ "java/lang/StringBuffer", "append" ], [ "javax/swing/DefaultListModel", "javax/swing/DefaultListModel.\u003cinit\u003e" ], [ "javax/swing/DefaultListModel", "\u003cinit\u003e" ], [ "javax/swing/JPanel", "javax/swing/JPanel.add" ], [ "javax/swing/JPanel", "add" ], [ "java/lang/StringBuffer", "java/lang/StringBuffer.append" ], [ "java/lang/StringBuffer", "append" ], [ "java/lang/String", "java/lang/String.endsWith" ], [ "java/lang/String", "endsWith" ], [ "javax/jmdns/JmDNS", "javax/jmdns/JmDNS.requestServiceInfo" ], [ "javax/jmdns/JmDNS", "requestServiceInfo" ], [ "java/lang/String", "java/lang/String.substring" ], [ "java/lang/String", "substring" ], [ "javax/swing/JTextArea", "javax/swing/JTextArea.setBorder" ], [ "javax/swing/JTextArea", "setBorder" ], [ "javax/swing/DefaultListModel", "javax/swing/DefaultListModel.insertElementAt" ], [ "javax/swing/DefaultListModel", "insertElementAt" ], [ "javax/swing/JList", "javax/swing/JList.setSelectionMode" ], [ "javax/swing/JList", "setSelectionMode" ], [ "javax/swing/JPanel", "javax/swing/JPanel.add" ], [ "javax/swing/JPanel", "add" ], [ "javax/jmdns/ServiceInfo", "javax/jmdns/ServiceInfo.getAddress" ], [ "javax/jmdns/ServiceInfo", "getAddress" ], [ "java/util/Enumeration", "java/util/Enumeration.nextElement" ], [ "java/util/Enumeration", "nextElement" ], [ "java/lang/StringBuffer", "java/lang/StringBuffer.toString" ], [ "java/lang/StringBuffer", "toString" ], [ "javax/swing/JList", "javax/swing/JList.\u003cinit\u003e" ], [ "javax/swing/JList", "\u003cinit\u003e" ], [ "javax/swing/JTextArea", "javax/swing/JTextArea.\u003cinit\u003e" ], [ "javax/swing/JTextArea", "\u003cinit\u003e" ], [ "com/strangeberry/jmdns/tools/Browser", "com/strangeberry/jmdns/tools/Browser.typeList" ], [ "com/strangeberry/jmdns/tools/Browser", "typeList" ], [ "com/strangeberry/jmdns/tools/Browser", "com/strangeberry/jmdns/tools/Browser.services" ], [ "com/strangeberry/jmdns/tools/Browser", "services" ], [ "javax/swing/JTextArea", "javax/swing/JTextArea.setEditable" ], [ "javax/swing/JTextArea", "setEditable" ], [ "javax/swing/JList", "javax/swing/JList.addListSelectionListener" ], [ "javax/swing/JList", "addListSelectionListener" ], [ "javax/swing/DefaultListModel", "javax/swing/DefaultListModel.setSize" ], [ "javax/swing/DefaultListModel", "setSize" ], [ "com/strangeberry/jmdns/tools/Browser", "com/strangeberry/jmdns/tools/Browser.show" ], [ "com/strangeberry/jmdns/tools/Browser", "show" ], [ "javax/swing/JTextArea", "javax/swing/JTextArea.setText" ], [ "javax/swing/JTextArea", "setText" ], [ "java/lang/System", "java/lang/System.out" ], [ "java/lang/System", "out" ], [ "javax/swing/JTextArea", "javax/swing/JTextArea.setText" ], [ "javax/swing/JTextArea", "setText" ], [ "javax/swing/JPanel", "javax/swing/JPanel.setLayout" ], [ "javax/swing/JPanel", "setLayout" ], [ "java/awt/GridLayout", "java/awt/GridLayout.\u003cinit\u003e" ], [ "java/awt/GridLayout", "\u003cinit\u003e" ], [ "com/strangeberry/jmdns/tools/Browser", "com/strangeberry/jmdns/tools/Browser.jmdns" ], [ "com/strangeberry/jmdns/tools/Browser", "jmdns" ], [ "javax/swing/JPanel", "javax/swing/JPanel.add" ], [ "javax/swing/JPanel", "add" ], [ "javax/swing/JScrollPane", "javax/swing/JScrollPane.\u003cinit\u003e" ], [ "javax/swing/JScrollPane", "\u003cinit\u003e" ], [ "javax/swing/JTextArea", "javax/swing/JTextArea.setBackground" ], [ "javax/swing/JTextArea", "setBackground" ], [ "com/strangeberry/jmdns/tools/Browser", "com/strangeberry/jmdns/tools/Browser.setDefaultCloseOperation" ], [ "com/strangeberry/jmdns/tools/Browser", "setDefaultCloseOperation" ], [ "javax/swing/JList", "javax/swing/JList.getSelectedValue" ], [ "javax/swing/JList", "getSelectedValue" ], [ "javax/swing/JList", "javax/swing/JList.setBackground" ], [ "javax/swing/JList", "setBackground" ], [ "javax/jmdns/JmDNS", "javax/jmdns/JmDNS.registerServiceType" ], [ "javax/jmdns/JmDNS", "registerServiceType" ], [ "javax/swing/DefaultListModel", "javax/swing/DefaultListModel.addElement" ], [ "javax/swing/DefaultListModel", "addElement" ], [ "com/strangeberry/jmdns/tools/Browser", "com/strangeberry/jmdns/tools/Browser.info" ], [ "com/strangeberry/jmdns/tools/Browser", "info" ], [ "javax/jmdns/ServiceInfo", "javax/jmdns/ServiceInfo.getServer" ], [ "javax/jmdns/ServiceInfo", "getServer" ], [ "com/strangeberry/jmdns/tools/Browser", "com/strangeberry/jmdns/tools/Browser.type" ], [ "com/strangeberry/jmdns/tools/Browser", "type" ], [ "java/awt/Color", "java/awt/Color.\u003cinit\u003e" ], [ "java/awt/Color", "\u003cinit\u003e" ], [ "javax/swing/event/ListSelectionEvent", "javax/swing/event/ListSelectionEvent.getValueIsAdjusting" ], [ "javax/swing/event/ListSelectionEvent", "getValueIsAdjusting" ], [ "javax/jmdns/JmDNS", "javax/jmdns/JmDNS.\u003cinit\u003e" ], [ "javax/jmdns/JmDNS", "\u003cinit\u003e" ], [ "javax/swing/JTextArea", "javax/swing/JTextArea.setText" ], [ "javax/swing/JTextArea", "setText" ], [ "java/lang/String", "java/lang/String.length" ], [ "java/lang/String", "length" ], [ "javax/swing/JPanel", "javax/swing/JPanel.add" ], [ "javax/swing/JPanel", "add" ], [ "javax/swing/JPanel", "javax/swing/JPanel.add" ], [ "javax/swing/JPanel", "add" ], [ "javax/jmdns/ServiceInfo", "javax/jmdns/ServiceInfo.getPropertyString" ], [ "javax/jmdns/ServiceInfo", "getPropertyString" ], [ "javax/swing/JList", "javax/swing/JList.setBorder" ], [ "javax/swing/JList", "setBorder" ], [ "javax/swing/JTextArea", "javax/swing/JTextArea.setLineWrap" ], [ "javax/swing/JTextArea", "setLineWrap" ], [ "javax/swing/DefaultListModel", "javax/swing/DefaultListModel.removeElement" ], [ "javax/swing/DefaultListModel", "removeElement" ], [ "java/awt/BorderLayout", "java/awt/BorderLayout.\u003cinit\u003e" ], [ "java/awt/BorderLayout", "\u003cinit\u003e" ], [ "javax/swing/JLabel", "javax/swing/JLabel.\u003cinit\u003e" ], [ "javax/swing/JLabel", "\u003cinit\u003e" ], [ "javax/swing/JPanel", "javax/swing/JPanel.add" ], [ "javax/swing/JPanel", "add" ], [ "javax/jmdns/ServiceInfo", "javax/jmdns/ServiceInfo.getPort" ], [ "javax/jmdns/ServiceInfo", "getPort" ], [ "javax/swing/JPanel", "javax/swing/JPanel.setLayout" ], [ "javax/swing/JPanel", "setLayout" ], [ "com/strangeberry/jmdns/tools/Browser", "com/strangeberry/jmdns/tools/Browser.types" ], [ "com/strangeberry/jmdns/tools/Browser", "types" ], [ "com/strangeberry/jmdns/tools/Browser", "com/strangeberry/jmdns/tools/Browser.setLocation" ], [ "com/strangeberry/jmdns/tools/Browser", "setLocation" ], [ "java/awt/Container", "java/awt/Container.add" ], [ "java/awt/Container", "add" ], [ "javax/swing/JPanel", "javax/swing/JPanel.setLayout" ], [ "javax/swing/JPanel", "setLayout" ], [ "com/strangeberry/jmdns/tools/Browser", "com/strangeberry/jmdns/tools/Browser.setSize" ], [ "com/strangeberry/jmdns/tools/Browser", "setSize" ], [ "com/strangeberry/jmdns/tools/Browser", "com/strangeberry/jmdns/tools/Browser.serviceList" ], [ "com/strangeberry/jmdns/tools/Browser", "serviceList" ], [ "java/lang/StringBuffer", "java/lang/StringBuffer.append" ], [ "java/lang/StringBuffer", "append" ], [ "java/lang/String", "java/lang/String.compareToIgnoreCase" ], [ "java/lang/String", "compareToIgnoreCase" ], [ "java/lang/StringBuffer", "java/lang/StringBuffer.append" ], [ "java/lang/StringBuffer", "append" ], [ "javax/swing/border/EmptyBorder", "javax/swing/border/EmptyBorder.\u003cinit\u003e" ], [ "javax/swing/border/EmptyBorder", "\u003cinit\u003e" ], [ "javax/swing/event/ListSelectionEvent", "javax/swing/event/ListSelectionEvent.getSource" ], [ "javax/swing/event/ListSelectionEvent", "getSource" ] ], "metrics": { "file": { "size": 6680.0, "entropy": 5.96, "size_bytes": 6680.0 }, "class": { "method_count": 9.0, "major_version": 46.0, "interface_count": 3.0, "method_ref_count": 88.0, "constant_pool_size": 373.0, "external_class_count": 25.0 }, "binary": { "overall_entropy": 5.96, "peak_region_bytes": 4096.0, "peak_region_entropy": 5.7 }, "imports": { "count": 113.0 }, "functions": { "count": 9.0 } } }, "id": 2, "path": "lib/applerecords/applerecords.jar!!lib/applerecords/applerecords.jar!com/strangeberry/jmdns/tools/Browser.class", "risk": 1, "sha": "b8120058a925bdca811b74096e5b26933f9f2da14092286512c692996588ba25", "size": 6680, "traits": [ { "id": "micro-behaviors/os/env/access::jvm-system-class-ref", "conf": 0.8600000143051147, "crit": 2, "desc": "JVM System class reference" }, { "id": "metadata/binary/metrics/structural::many-imports", "conf": 0.800000011920929, "crit": 2, "desc": "High number of imported symbols (\u003e80)", "spans": [ [ 0, 22 ] ] }, { "id": "metadata/binary/metrics/threshold::many-imports-100", "conf": 1.0, "crit": 1, "desc": "Binary has 100+ imports", "spans": [ [ 0, 22 ] ] } ], "type": "java_class" }, { "ctx": [ { "b": "+kO#^0000K0ji7ki@?!S07^H$n=RG\u003e089w!3ii:1p6Z?}2MNWd08S.]2MN^g08@}#3ij39rTeRa3igFmso[[f2lm{m01P6l3igFmtNgsn2ln6q022u63igFmuKcTt2lnft02CSa3ig\u003exvH8%z3ig", "ln": 0 }, { "b": "j4%x$C404uvqYZhpHX6Iv@%^YoLO0Vvj#C9zF7Q#vRPE:BuoH66L.61vj#IfBt3j6wPQjGwo8m5A@=mExjVfKC$}^+wDq=Xc}[w:C404uvqYZhq/)4]zF83WoLO0Vvj#IfBt3j6wPQjGwo8m5B2%y53$\u003cc[oMaAHy!eF=Bo8vUc[d\u00268vrM6jzE)]ynP59Yl1BIDwPI]O0rr#=oLO0Vvj#IfBt3j6wPQjGwo8m5B2$*K0rr(-oLO0Vvr:CuzdEK9fg{7Hpe:k6rSJglA+e($B94", "ln": 1688 }, { "b": "00vdZBo8vRoLO0Vvj#tkfhMX6zGF*0A+eV@i@]r{ygho]fkktTp\u0026Zn/Bw)p4wNPAR00^E-x(n3ezuf.uwQ4{h0rrlJnHWWuaPKL6i@/lX000620rtp-kl7Y:kMy=:aPIJy0rr911Uc$Y0KhR80096=0000a00ic203hay03zmF073VM00ic=0009n00@Sj0006Wd.X1EjPOp%O=y8I0XapcWG3z$02)x\u003cdG+t8@#nDF1H[Bn5^w%NWG3Om1u^XbQYqII2}u3jWG", "ln": 2467 } ], "depth": 2, "facts": { "imp": [ [ "", "java/net/InetAddress" ], [ "", "java/lang/String" ], [ "", "javax/jmdns/ServiceInfo" ], [ "", "java/util/Properties" ], [ "", "java/lang/System" ], [ "", "com/strangeberry/jmdns/tools/Browser" ], [ "", "java/lang/Object" ], [ "", "java/util/Hashtable" ], [ "", "javax/jmdns/JmDNS" ], [ "", "java/lang/RuntimeException" ], [ "", "com/strangeberry/jmdns/tools/Responder" ], [ "", "java/io/PrintStream" ], [ "", "java/io/IOException" ], [ "", "java/lang/Integer" ], [ "", "java/lang/StringBuffer" ], [ "", "com/strangeberry/jmdns/tools/Main$SampleListener" ], [ "java/lang/StringBuffer", "java/lang/StringBuffer.append" ], [ "java/lang/StringBuffer", "append" ], [ "com/strangeberry/jmdns/tools/Main$SampleListener", "com/strangeberry/jmdns/tools/Main$SampleListener.\u003cinit\u003e" ], [ "com/strangeberry/jmdns/tools/Main$SampleListener", "\u003cinit\u003e" ], [ "java/net/InetAddress", "java/net/InetAddress.getByName" ], [ "java/net/InetAddress", "getByName" ], [ "java/lang/System", "java/lang/System.exit" ], [ "java/lang/System", "exit" ], [ "java/lang/String", "java/lang/String.indexOf" ], [ "java/lang/String", "indexOf" ], [ "javax/jmdns/JmDNS", "javax/jmdns/JmDNS.registerServiceType" ], [ "javax/jmdns/JmDNS", "registerServiceType" ], [ "javax/jmdns/ServiceInfo", "javax/jmdns/ServiceInfo.\u003cinit\u003e" ], [ "javax/jmdns/ServiceInfo", "\u003cinit\u003e" ], [ "javax/jmdns/JmDNS", "javax/jmdns/JmDNS.registerService" ], [ "javax/jmdns/JmDNS", "registerService" ], [ "java/lang/String", "java/lang/String.substring" ], [ "java/lang/String", "substring" ], [ "com/strangeberry/jmdns/tools/Browser", "com/strangeberry/jmdns/tools/Browser.\u003cinit\u003e" ], [ "com/strangeberry/jmdns/tools/Browser", "\u003cinit\u003e" ], [ "java/lang/String", "java/lang/String.substring" ], [ "java/lang/String", "substring" ], [ "javax/jmdns/JmDNS", "javax/jmdns/JmDNS.addServiceListener" ], [ "javax/jmdns/JmDNS", "addServiceListener" ], [ "java/lang/System", "java/lang/System.arraycopy" ], [ "java/lang/System", "arraycopy" ], [ "java/util/Properties", "java/util/Properties.put" ], [ "java/util/Properties", "put" ], [ "java/lang/Integer", "java/lang/Integer.parseInt" ], [ "java/lang/Integer", "parseInt" ], [ "java/io/PrintStream", "java/io/PrintStream.println" ], [ "java/io/PrintStream", "println" ], [ "java/lang/RuntimeException", "java/lang/RuntimeException.\u003cinit\u003e" ], [ "java/lang/RuntimeException", "\u003cinit\u003e" ], [ "com/strangeberry/jmdns/tools/Responder", "com/strangeberry/jmdns/tools/Responder.\u003cinit\u003e" ], [ "com/strangeberry/jmdns/tools/Responder", "\u003cinit\u003e" ], [ "java/util/Hashtable", "java/util/Hashtable.put" ], [ "java/util/Hashtable", "put" ], [ "java/io/PrintStream", "java/io/PrintStream.println" ], [ "java/io/PrintStream", "println" ], [ "java/lang/Object", "java/lang/Object.\u003cinit\u003e" ], [ "java/lang/Object", "\u003cinit\u003e" ], [ "java/lang/String", "java/lang/String.equals" ], [ "java/lang/String", "equals" ], [ "java/lang/System", "java/lang/System.out" ], [ "java/lang/System", "out" ], [ "java/net/InetAddress", "java/net/InetAddress.getLocalHost" ], [ "java/net/InetAddress", "getLocalHost" ], [ "javax/jmdns/JmDNS", "javax/jmdns/JmDNS.\u003cinit\u003e" ], [ "javax/jmdns/JmDNS", "\u003cinit\u003e" ], [ "javax/jmdns/JmDNS", "javax/jmdns/JmDNS.addServiceTypeListener" ], [ "javax/jmdns/JmDNS", "addServiceTypeListener" ], [ "java/lang/StringBuffer", "java/lang/StringBuffer.\u003cinit\u003e" ], [ "java/lang/StringBuffer", "\u003cinit\u003e" ], [ "java/lang/StringBuffer", "java/lang/StringBuffer.toString" ], [ "java/lang/StringBuffer", "toString" ], [ "java/lang/System", "java/lang/System.getProperties" ], [ "java/lang/System", "getProperties" ], [ "java/util/Hashtable", "java/util/Hashtable.\u003cinit\u003e" ], [ "java/util/Hashtable", "\u003cinit\u003e" ] ], "metrics": { "file": { "size": 3439, "entropy": 5.86 }, "class": { "major_version": 46, "interface_count": 0, "method_ref_count": 30, "constant_pool_size": 180, "external_class_count": 16 }, "binary": { "peak_region_bytes": 2048, "peak_region_entropy": 5.76 }, "imports": { "count": 46 }, "functions": { "count": 2 } } }, "id": 3, "mol": "H₂(CmPo)", "path": "lib/applerecords/applerecords.jar!!lib/applerecords/applerecords.jar!com/strangeberry/jmdns/tools/Main.class", "risk": 2, "sha": "aba4d8f614b46106ffcb5f93dc133c83418d944b4c42d507dc98e94df69aacf7", "size": 3439, "traits": [ { "id": "micro-behaviors/communications/dns/lookup/resolver::jvm-inetaddress-getbyname-bytecode", "conf": 0.86, "crit": 3, "desc": "JVM bytecode InetAddress getByName", "spans": [ [ 1752, 30 ] ] }, { "id": "micro-behaviors/process/exit/terminate::jvm-system-exit-bytecode", "conf": 0.93, "crit": 3, "desc": "JVM invokes System.exit", "spans": [ [ 2531, 21 ] ] } ], "type": "java_class" }, { "ctx": [ { "b": "+kO#^00riM0fdx^ec4{w04O4n2((EQlj0Sx07c(V0000904O4q2((EQmf@@A07Eg[m*PeC07Wv}nEkwE07)H%o9$U)08i!2d/-rK089w*2MNWd089w\u00263ii:1qviy$08\u003cj8q#/]609fyar@=td09G", "ln": 0 }, { "b": "c}L\u003cYygho]fkL6mxd)h9A+PA7luM)LwPx\u003ck00)W+q/)4]zF5$I6EUz7ygho]fkL6mxd)h9A+PA7i@]r:wQ4{h0rrlJnHWWv02YJWC42Ynz/4dxy+GppzGYPiBy/FCyhvwWaoi[(ec2UI2MK(9eDvy600031f90Q800031fAr*c00031g5%9g00031gYPxk00031hukPm00031hVLMj00031h#\u003eMh000930rtaWiSGfXi@/lXd/YRJ0rr91a1B-10v!qY00jRLWe", "ln": 1428 } ], "depth": 2, "facts": { "imp": [ [ "", "java/lang/StringBuffer" ], [ "", "java/lang/Object" ], [ "", "java/lang/System" ], [ "", "java/io/PrintStream" ], [ "", "java/lang/NumberFormatException" ], [ "", "java/lang/String" ], [ "", "java/lang/Integer" ], [ "", "javazoom/jl/converter/jlc" ], [ "", "javazoom/jl/decoder/Crc16" ], [ "javazoom/jl/converter/jlc$jlcArgs", "javazoom/jl/converter/jlc$jlcArgs.output_mode" ], [ "javazoom/jl/converter/jlc$jlcArgs", "output_mode" ], [ "java/lang/StringBuffer", "java/lang/StringBuffer.append" ], [ "java/lang/StringBuffer", "append" ], [ "java/lang/StringBuffer", "java/lang/StringBuffer.append" ], [ "java/lang/StringBuffer", "append" ], [ "javazoom/jl/converter/jlc$jlcArgs", "javazoom/jl/converter/jlc$jlcArgs.use_own_scalefactor" ], [ "javazoom/jl/converter/jlc$jlcArgs", "use_own_scalefactor" ], [ "javazoom/jl/converter/jlc$jlcArgs", "javazoom/jl/converter/jlc$jlcArgs.verbose_mode" ], [ "javazoom/jl/converter/jlc$jlcArgs", "verbose_mode" ], [ "java/lang/String", "java/lang/String.charAt" ], [ "java/lang/String", "charAt" ], [ "java/lang/String", "java/lang/String.startsWith" ], [ "java/lang/String", "startsWith" ], [ "java/lang/Integer", "java/lang/Integer.parseInt" ], [ "java/lang/Integer", "parseInt" ], [ "java/lang/String", "java/lang/String.length" ], [ "java/lang/String", "length" ], [ "java/lang/String", "java/lang/String.equals" ], [ "java/lang/String", "equals" ], [ "java/lang/StringBuffer", "java/lang/StringBuffer.toString" ], [ "java/lang/StringBuffer", "toString" ], [ "java/io/PrintStream", "java/io/PrintStream.println" ], [ "java/io/PrintStream", "println" ], [ "java/lang/StringBuffer", "java/lang/StringBuffer.\u003cinit\u003e" ], [ "java/lang/StringBuffer", "\u003cinit\u003e" ], [ "javazoom/jl/converter/jlc$jlcArgs", "javazoom/jl/converter/jlc$jlcArgs.which_c" ], [ "javazoom/jl/converter/jlc$jlcArgs", "which_c" ], [ "javazoom/jl/converter/jlc$jlcArgs", "javazoom/jl/converter/jlc$jlcArgs.verbose_level" ], [ "javazoom/jl/converter/jlc$jlcArgs", "verbose_level" ], [ "javazoom/jl/converter/jlc$jlcArgs", "javazoom/jl/converter/jlc$jlcArgs.Usage" ], [ "javazoom/jl/converter/jlc$jlcArgs", "Usage" ], [ "java/lang/System", "java/lang/System.out" ], [ "java/lang/System", "out" ], [ "java/lang/System", "java/lang/System.exit" ], [ "java/lang/System", "exit" ], [ "java/lang/String", "java/lang/String.substring" ], [ "java/lang/String", "substring" ], [ "java/lang/System", "java/lang/System.err" ], [ "java/lang/System", "err" ], [ "javazoom/jl/converter/jlc$jlcArgs", "javazoom/jl/converter/jlc$jlcArgs.output_filename" ], [ "javazoom/jl/converter/jlc$jlcArgs", "output_filename" ], [ "java/lang/Object", "java/lang/Object.\u003cinit\u003e" ], [ "java/lang/Object", "\u003cinit\u003e" ], [ "javazoom/jl/converter/jlc$jlcArgs", "javazoom/jl/converter/jlc$jlcArgs.scalefactor" ], [ "javazoom/jl/converter/jlc$jlcArgs", "scalefactor" ], [ "javazoom/jl/converter/jlc$jlcArgs", "javazoom/jl/converter/jlc$jlcArgs.filename" ], [ "javazoom/jl/converter/jlc$jlcArgs", "filename" ] ], "metrics": { "file": { "size": 2070, "entropy": 5.76 }, "class": { "major_version": 45, "interface_count": 0, "method_ref_count": 24, "constant_pool_size": 142, "external_class_count": 9 }, "binary": { "peak_region_bytes": 2048, "peak_region_entropy": 5.56 }, "imports": { "count": 33 }, "functions": { "count": 3 } } }, "id": 4, "mol": "H(Po)", "path": "lib/applerecords/applerecords.jar!!lib/applerecords/applerecords.jar!javazoom/jl/converter/jlc$jlcArgs.class", "risk": 2, "sha": "969f9811ff13a406f1f711878336f9cc747df0efa84301839f259725a9468235", "size": 2070, "traits": [ { "id": "net/url", "conf": 0.85, "crit": 3, "desc": "URL reference" }, { "id": "micro-behaviors/process/exit/terminate::jvm-system-exit-bytecode", "conf": 0.93, "crit": 3, "desc": "JVM invokes System.exit", "spans": [ [ 1492, 21 ] ] } ], "type": "java_class" }, { "ctx": [ { "b": "fe1B]s%UE?b}He+nHk]gb$xl", "ln": 1, "addr": 0 }, { "b": "fe0", "ln": 2, "addr": 21 }, { "b": "fe1CExLzJgy?Wv0vrcSox(+zeA+e/8B8LVjCvtJ6j0n/!BS+g5zxJ$hwncabA+P09By=OeBrC1fwg}\u003ew", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 28, "z": 4, "cf": 0.800000011920929 } ], "ln": 3, "addr": 25 }, { "b": "fe1C+z!9M]C{3*yaA.NjwPw]nxK@rdwPzTeaA7\u003cmBzbkdm]05boL5o^wPw[-wO#71vqE5.BZ/f3v/", "ln": 4, "addr": 91 }, { "b": "fe1Cwx\u003e7Z(B7DF5B0bBAvR/+1xK$Y%vTf8rxK@qQA+e/8q/un\u0026CvtJ6avZo(zE^f$x(v(Jaz2nexK#h", "ln": 5, "addr": 154 }, { "b": "2)*[", "ln": 177, "addr": 5363 }, { "b": "2)\u003cKLA+PA7luM)LwPw]5B.h:Vaz$+max9x5x(mMIB.kk%AWSv#", "ln": 178, "addr": 5368 }, { "b": "2)\u003e6-w?EIhAaJ]$c#JEgwHPX", "n": [ { "c": 3, "d": "Java Base64 StringBuilder append source", "i": "objectives/command-and-control/dropper/staged-loader::java-base64-stringbuilder-append-source", "o": 5412, "z": 6, "cf": 0.8799999952316284 } ], "ln": 179, "addr": 5410 }, { "b": "2)\u003e6-w?EIhAaJ]$c)@nqcN?a", "ln": 180, "addr": 5431 }, { "b": "2)\u003e6-w?EIhAaJ]$c#0Nhz.tWlBw(:\u003eC4CXxdjEs", "ln": 181, "addr": 5452 } ], "depth": 2, "facts": { "imp": [ [ "", "getContentPane" ], [ "", "content" ], [ "", "typeList" ], [ "", "typeList" ], [ "", "typeList" ], [ "", "typeList" ], [ "", "typePanel" ], [ "", "typePanel" ], [ "", "typePanel" ], [ "", "content" ], [ "", "serviceList" ], [ "", "serviceList" ], [ "", "serviceList" ], [ "", "serviceList" ], [ "", "servicePanel" ], [ "", "servicePanel" ], [ "", "servicePanel" ], [ "", "content" ], [ "", "info" ], [ "", "info" ], [ "", "info" ], [ "", "info" ], [ "", "infoPanel" ], [ "", "infoPanel" ], [ "", "infoPanel" ], [ "", "content" ], [ "", "setDefaultCloseOperation" ], [ "", "setLocation" ], [ "", "setSize" ], [ "", "jmdns" ], [ "", "jmdns" ], [ "", "show" ], [ "", "name" ], [ "", "name" ], [ "", "name" ], [ "", "type" ], [ "", "insertSorted" ], [ "", "name" ], [ "", "name" ], [ "", "name" ], [ "", "type" ], [ "", "services" ], [ "", "insertSorted" ], [ "", "model" ], [ "", "value" ], [ "", "model" ], [ "", "model" ], [ "", "model" ], [ "", "name" ], [ "", "serviceList" ], [ "", "buf" ], [ "", "buf" ], [ "", "buf" ], [ "", "info" ], [ "", "buf" ], [ "", "buf" ], [ "", "info" ], [ "", "buf" ], [ "", "buf" ], [ "", "info" ], [ "", "buf" ], [ "", "buf" ], [ "", "info" ], [ "", "buf" ], [ "", "info" ], [ "", "names" ], [ "", "names" ], [ "", "buf" ], [ "", "buf" ], [ "", "buf" ], [ "", "info" ], [ "", "buf" ], [ "", "buf" ], [ "", "typeList" ], [ "", "jmdns" ], [ "", "services" ], [ "", "info" ], [ "", "jmdns" ], [ "", "serviceList" ], [ "", "info" ], [ "", "name" ], [ "", "jmdns" ], [ "", "info" ], [ "", "name" ], [ "", "jmdns" ], [ "", "services" ], [ "", "services" ], [ "", "java.awt" ], [ "", "java.awt.event" ], [ "", "java.io" ], [ "", "java.net" ], [ "", "java.util" ], [ "", "javax.jmdns" ], [ "", "javax.swing" ], [ "", "javax.swing.border" ], [ "", "javax.swing.event" ], [ "", "javax.swing.table" ] ], "mbr": [ "JFrame.EXIT_ON_CLOSE", "JScrollPane.HORIZONTAL_SCROLLBAR_AS_NEEDED", "JScrollPane.VERTICAL_SCROLLBAR_AS_NEEDED", "ListSelectionModel.SINGLE_SELECTION", "System.out", "list.length" ], "tgt": [ "BorderLayout", "Browser", "Color", "DefaultListModel", "EmptyBorder", "GridLayout", "JLabel", "JList", "JPanel", "JScrollPane", "JTextArea", "JmDNS", "StringBuffer", "add", "addElement", "addListSelectionListener", "addServiceListener", "addServiceTypeListener", "append", "compareToIgnoreCase", "elementAt", "endsWith", "equals", "getAddress", "getContentPane", "getPort", "getPropertyNames", "getPropertyString", "getSelectedValue", "getServer", "getServiceInfo", "getSize", "getSource", "getValueIsAdjusting", "hasMoreElements", "insertElementAt", "insertSorted", "length", "nextElement", "println", "registerServiceType", "removeElement", "removeServiceListener", "requestServiceInfo", "setBackground", "setBorder", "setDefaultCloseOperation", "setEditable", "setLayout", "setLineWrap", "setLocation", "setSelectionMode", "setSize", "setText", "show", "size", "substring", "toString" ], "metrics": { "ast": { "op.eq": 5.0, "op.lt": 3.0, "op.add": 13.0, "op.sub": 2.0, "op.lnot": 3.0, "max_depth": 21.0, "bind_count": 25.0, "call_count": 118.0, "node_count": 2141.0, "member_count": 6.0, "op_density.eq": 0.0, "op_density.lt": 0.0, "op_density.add": 0.01, "op_density.sub": 0.0, "op_density.lnot": 0.0, "identifier_count": 107.0, "member_depth_max": 2.0, "string_literal_count": 40.0, "array_literal_max_length": 11.0, "string_concat_chain_max_length": 3.0 }, "file": { "size": 7689.0, "entropy": 5.21, "size_bytes": 7689.0 }, "text": { "tab_count": 200.0, "digit_ratio": 0.01, "space_count": 1051.0, "total_lines": 277.0, "char_entropy": 5.21, "mixed_indent": 1.0, "unique_chars": 86.0, "string_density": 0.14, "avg_line_length": 25.76, "max_line_length": 144.0, "empty_line_ratio": 0.1, "last_line_length": 1.0, "whitespace_ratio": 0.23, "most_common_ratio": 0.08, "identifier_density": 1.3, "line_length_stddev": 23.44, "normalized_string_count": 2.4, "repeated_char_sequences": 1.0, "most_common_char_is_null": 0.0, "suspicious_comment_ratio": 0.13, "max_inline_whitespace_run": 2.0, "trailing_whitespace_lines": 8.0, "most_common_char_codepoint": 101.0, "suspicious_identifier_ratio": 0.03, "normalized_unique_identifiers": 13.19 }, "binds": { "count": 25.0 }, "calls": { "count": 118.0 }, "binary": { "overall_entropy": 5.21, "peak_region_bytes": 7168.0, "peak_region_entropy": 5.2 }, "source": { "class_count": 2.0, "function_count": 13.0 }, "imports": { "count": 10.0, "unique_modules": 10.0, "third_party_count": 10.0, "third_party_ratio": 1.0 }, "members": { "count": 6.0 }, "strings": { "total": 40.0, "avg_length": 8.95, "max_length": 23.0, "avg_entropy": 2.27, "empty_count": 2.0, "total_bytes": 358.0, "entropy_stddev": 1.19 }, "comments": { "chars": 1121.0, "lines": 43.0, "total": 24.0, "to_code_ratio": 0.18, "empty_comments": 3.0, "high_entropy_comments": 3.0 }, "functions": { "count": 15.0, "avg_params": 1.54, "max_params": 4.0, "length_stddev": 19.42, "avg_name_length": 10.92, "no_params_count": 3.0, "avg_length_lines": 15.08, "max_length_lines": 75.0, "min_length_lines": 4.0, "single_char_params": 1.0, "avg_param_name_length": 4.2, "density_per_100_lines": 4.69, "code_in_functions_ratio": 0.71 }, "identifiers": { "count": 107.0, "total": 359.0, "avg_length": 9.55, "max_length": 30.0, "min_length": 1.0, "avg_entropy": 2.58, "reuse_ratio": 0.3, "unique_count": 107.0, "length_stddev": 6.01, "sequential_names": 3.0, "single_char_count": 3.0, "single_char_ratio": 0.03, "high_entropy_count": 9.0, "high_entropy_ratio": 0.08, "all_lowercase_ratio": 0.43, "all_uppercase_ratio": 0.04 } } }, "id": 5, "mol": "O(C)", "path": "lib/applerecords/applerecords.jar!!lib/applerecords/applerecords.jar!com/strangeberry/jmdns/tools/Browser.java", "risk": 1, "sha": "99abe697bc4fe7adee5a507198294cee745e8c34be3ced2f518847f888078ff0", "size": 7689, "traits": [ { "id": "objectives/command-and-control/dropper/staged-loader::java-base64-stringbuilder-append-source", "atk": "T1105", "mbc": "B0042", "conf": 0.8799999952316284, "crit": 3, "desc": "Java Base64 StringBuilder append source", "spans": [ [ 5412, 6 ] ] } ], "type": "java" }, { "ctx": [ { "b": "fe1B]s%UE?b}He+nHk]gb$xl\u003c3nj4w3nj4Pra]#!az++3A::0lazC)tw].D]aAIEkBA.elwJI2Wz/)gjvqWidwN]H@BAh88B-.gqx(\u003eFazE+zsAT-vefcCaIwnbU3azC{uB-7-3AV/EqwGV8aA=2\u003euz!pblxK@qRpe@AgwPI{7AV^\u003e-zE)\u0026%y-(L%vR/:*4gj:wawuGVwO#N2ayPslAckSax(^%0wftubaARpdavZx.wGT]\u0026w]@l9A+cv.z/]@dvruj4zu", "ln": 0, "col": 1, "line": 1 }, { "b": "fe1BS3nj4Pra]#!az++3A::0lazC)twncabA+P09By!#9x(k5nxK@r1z/xngBzb98azC{uCwg(fayX[8B-RbaB.\u0026Pr3nj4PvS==ns4MvZpGpvpk#7M9s3Y.Zk#7xZj0n-YBzbPnBrCdrwO@SjxK@r2ze:r9wN({cvrcx%zGHdDz!oB=fe1Cxmn=Gzk#7xBlp\u003c\u003cxr9ptZAV^?yr8b\u003eXqY[L9qxOmFp^E#UnKDGKk#F?4rz(T?q:\u0026qYax8\u0026.aARpdav/gb4gj:wawuu/B7Gwmm}DNHA:-=bp\u003c3k-x\u003e5nVx\u003e7Z(B7DFaz/M$qz/PziwmY\u003c\u003ex(4\u0026y4gj:wapOVhfcBzoBS+:sz/](bazthbwGV28v}xv$wN(](ay/teC{43qaARpdav/gbawuu/B7Gwmm}DNHA:-=bp\u003c3k-x\u003e4OVfe1Cwx\u003e7Z(B7DF5y\u0026si7aA}KwxDRzgx(+zkx\u003c#9\u003eA^o.?x\u003ewG9z/^JMCxdztwGV8kaARpdavZx.wGT]\u0026w]@l9A+bW!fe1Cqz/]@dvruj4zy=]4zEUpIat(e4raP]=y?j.=y***+efE(lx()]egx", "ln": 290, "col": 1, "line": 7 }, { "b": "v\u003c%FG3jd*$arTQdB97#ge[X:qp\u0026ZF[wPz)bwPGmGe]U@Pc)AzywnVDvwmYj)xcF(Ha#7n\u003ci$hJ6arR^HwmYj)xcotWBAhIni$hJ6EglI\u0026x\u003ewFoc$ddev\u003c0@Tf!1j(clKG:x^bfvADLYaB0$EqxlEGkt}4iBDKQq*arR^Hx(n38auZ\u0026szE)]QwmPZ(B8@%DwPQm:pgn0Jc$ddeC3uXbdlv$C2{pukax9MbBy/qwvrcx%D1g=iC{)9wxlC*GgaTLRA+xLDattt?vrc0\u003cat2-0gato]3jha\u00263jgAUasH@wBy(TUjS[S+y?$KyDKQq*arR^Hx(n38auZ\u0026szE)]QwmPZ(B8@%DwPQQ:v{%gAz/Z1G", "ln": 1879, "col": 46, "line": 59 } ], "depth": 2, "facts": { "imp": [ [ "", "jmdns" ], [ "", "\"-d\"" ], [ "", "System" ], [ "", "System" ], [ "", "System" ], [ "", "\"-i\"" ], [ "", "InetAddress" ], [ "", "System" ], [ "", "InetAddress" ], [ "", "\"-browse\"" ], [ "", "jmdns" ], [ "", "\"-bt\"" ], [ "", "jmdns" ], [ "", "\"-bs\"" ], [ "", "jmdns" ], [ "", "\"-rs\"" ], [ "", "props" ], [ "", "jmdns" ], [ "", "Integer" ], [ "", "\"-f\"" ], [ "", "System" ], [ "", "java.io" ], [ "", "java.net" ], [ "", "java.util" ], [ "", "javax.jmdns" ] ], "mbr": [ "System.out", "argv.length" ], "tgt": [ "Browser", "Hashtable", "JmDNS", "Responder", "RuntimeException", "SampleListener", "ServiceInfo", "addServiceListener", "addServiceTypeListener", "arraycopy", "equals", "exit", "getByName", "getLocalHost", "getProperties", "getServiceInfo", "indexOf", "parseInt", "println", "put", "registerService", "registerServiceType", "substring" ], "funcs": [ [ "addService", 1115 ], [ "removeService", 1265 ], [ "resolveService", 1385 ], [ "addServiceType", 1526 ], [ "main", 1644 ] ], "metrics": { "ast": { "op.eq": 6, "op.ge": 1, "op.gt": 3, "op.lt": 3, "op.add": 12, "op.lor": 1, "op.mul": 1, "op.sub": 1, "op.land": 7, "op.lnot": 1, "max_depth": 19, "call_count": 46, "node_count": 1189, "member_count": 2, "op_density.eq": 0.01, "op_density.ge": 0, "op_density.gt": 0, "op_density.lt": 0, "op_density.add": 0.01, "op_density.lor": 0, "op_density.mul": 0, "op_density.sub": 0, "op_density.land": 0.01, "op_density.lnot": 0, "max_concat_chain": 3, "member_depth_max": 2 }, "file": { "size": 4129, "entropy": 5.13 }, "text": { "lines": 113, "top_char": 101, "tab_count": 83, "max_ws_run": 39, "digit_ratio": 0.02, "space_count": 786, "char_entropy": 5.13, "mixed_indent": 1, "unique_chars": 85, "top_char_null": 0, "string_density": 0.22, "top_char_ratio": 0.06, "avg_line_length": 34.54, "max_line_length": 105, "empty_line_ratio": 0.06, "last_line_length": 1, "whitespace_ratio": 0.27, "identifier_density": 1.68, "line_length_stddev": 29.54, "normalized_string_count": 2.35, "repeated_char_sequences": 6, "suspicious_comment_ratio": 0.19, "trailing_whitespace_lines": 3, "suspicious_identifier_ratio": 0.04, "normalized_unique_identifiers": 6.89 }, "binds": { "count": 15 }, "binary": { "peak_region_bytes": 3072, "peak_region_entropy": 5.15 }, "source": { "class_count": 2, "function_count": 5 }, "imports": { "count": 4, "third_party_count": 4, "third_party_ratio": 1 }, "strings": { "bytes": 571, "count": 25, "avg_length": 22.84, "max_length": 77, "avg_entropy": 2.01, "entropy_stddev": 1.17 }, "comments": { "chars": 825, "count": 16, "empty": 3, "lines": 21, "high_entropy": 3, "to_code_ratio": 0.23 }, "functions": { "count": 7, "density": 4.42, "avg_params": 2.6, "code_ratio": 0.68, "max_params": 4, "length_stddev": 22.8, "avg_name_length": 11, "avg_length_lines": 15.4, "max_length_lines": 61, "min_length_lines": 4, "avg_param_name_length": 4.31 }, "identifiers": { "count": 190, "unique": 47, "avg_length": 7.66, "max_length": 22, "min_length": 1, "avg_entropy": 2.35, "reuse_ratio": 0.25, "length_stddev": 4.99, "sequential_names": 2, "single_char_count": 2, "single_char_ratio": 0.04, "high_entropy_count": 1, "high_entropy_ratio": 0.02, "all_lowercase_ratio": 0.6 } } }, "id": 6, "mol": "H(Cm)", "path": "lib/applerecords/applerecords.jar!!lib/applerecords/applerecords.jar!com/strangeberry/jmdns/tools/Main.java", "risk": 1, "sha": "e34eb3ba837f329459393dce744094c1fb0e10f8dc321f66587053793968a6e1", "size": 4129, "traits": [ { "id": "micro-behaviors/communications/dns/lookup/resolver::jvm-inetaddress-getbyname-source", "conf": 0.82, "crit": 3, "desc": "JVM InetAddress getByName", "spans": [ [ 2018, 21 ] ] } ], "type": "java" }, { "ctx": [ { "b": "boXf.vRGZkB7+)/B.\u003e=ex(\u003eEHwfr-+g+}3I3jpu?wN=\u0026$vrM64eOXZmatm\u003eUAXzxExd[7nvLqeeAbo9awN/U0wofzjAbYS8A+e:0A+6kzyghb\u0026", "ln": 0, "col": 1, "line": 1 } ], "depth": 1, "facts": { "imp": [ [ "", "ulimit" ], [ "", "ulimit" ], [ "", "exec" ], [ "", "exec" ] ], "tgt": [ "exec", "ulimit" ], "metrics": { "ast": { "max_depth": 3, "call_count": 2, "node_count": 13 }, "file": { "size": 88, "entropy": 4.65 }, "text": { "lines": 5, "top_char": 114, "max_ws_run": 1, "digit_ratio": 0.09, "space_count": 6, "char_entropy": 4.65, "unique_chars": 32, "top_char_null": 0, "top_char_ratio": 0.08, "avg_line_length": 16.6, "max_line_length": 57, "empty_line_ratio": 0.4, "last_line_length": 57, "whitespace_ratio": 0.13, "identifier_density": 1.6, "line_length_stddev": 21.11, "normalized_unique_identifiers": 2.58 }, "binary": { "peak_region_bytes": 88, "peak_region_entropy": 4.65 }, "comments": { "chars": 9, "count": 1, "lines": 1, "to_code_ratio": 0.25 }, "identifiers": { "count": 8, "unique": 6, "avg_length": 10.33, "max_length": 42, "min_length": 2, "avg_entropy": 2.01, "reuse_ratio": 0.75, "length_stddev": 14.21, "high_entropy_count": 1, "high_entropy_ratio": 0.17, "all_lowercase_ratio": 0.5 } } }, "id": 7, "mol": "H(Po₃)", "path": "applerecords-0.5nb1.tgz!!bin/applerecords", "pid": 0, "risk": 1, "sha": "9239e8fe1775a7e934f253710d6c7073973e52fc0af293838dc62fdeb6337810", "size": 88, "traits": [ { "id": "micro-behaviors/process/create/launch::java-jar-command-line", "atk": "T1059", "conf": 0.85, "crit": 3, "desc": "Runs an executable JAR (java -jar)", "spans": [ [ 35, 9 ] ] }, { "id": "micro-behaviors/process/create/shell/spawn::shell-exec", "atk": "T1059", "conf": 0.5, "crit": 3, "desc": "Uses shell exec to replace process", "spans": [ [ 30, 4 ] ] }, { "id": "micro-behaviors/process/create/shell/spawn::shell-execution-comp", "atk": "T1059", "mbc": "E1059", "conf": 0.9, "crit": 3, "desc": "Shell command execution capability", "uses": [ 1 ], "spans": [ [ 30, 4 ] ] }, { "id": "micro-behaviors/process/create/exec::child-process-execution", "atk": "T1059", "conf": 0.94, "crit": 3, "desc": "Executes a child process", "uses": [ 2 ], "spans": [ [ 30, 4 ] ] } ], "type": "shell" }, { "id": 8, "sha": "afb35d9871eea084c1dce46fa4b80f704e0001f23a722dc862825e0a0e2bb000", "path": "lib/applerecords/applerecords.jar!!lib/applerecords/applerecords.jar!org/cdavies/applerecords/AppleRecordsPanel.class", "risk": 1, "size": 4545, "type": "java_class", "depth": 2 }, { "id": 9, "sha": "3286a7a1ab000f57cdd5412a4c7b2e1458d04be419c9963f8785b12a1b806965", "path": "lib/applerecords/applerecords.jar!!lib/applerecords/applerecords.jar!com/strangeberry/jmdns/tools/Browser$ServiceTableModel.class", "size": 1038, "type": "java_class", "depth": 2 }, { "id": 10, "sha": "0f1c60d140dd4db3acd63cfcf525838f2ee378de53aaeadbe5d8a7aff39d12a4", "path": "lib/applerecords/applerecords.jar!!lib/applerecords/applerecords.jar!com/strangeberry/jmdns/tools/Main$SampleListener.class", "risk": 1, "size": 1422, "type": "java_class", "depth": 2 }, { "id": 11, "sha": "480ec0ccac3185126b33af61442d340190a9bc239d97df607fcaafc92e9e2655", "path": "lib/applerecords/applerecords.jar!!lib/applerecords/applerecords.jar!com/twmacinta/util/MD5State.class", "size": 587, "type": "java_class", "depth": 2 }, { "id": 12, "sha": "4f5ba9acd02c939f3038e20491b8d3f4a347f68bcb5dabdfbc9bd3087f4b0b7e", "path": "lib/applerecords/applerecords.jar!!lib/applerecords/applerecords.jar!itunes/FieldPair.class", "risk": 1, "size": 4758, "type": "java_class", "depth": 2 }, { "id": 13, "sha": "853b278b3e95a3f977af8680401effd350bf91769a59b34bfdd205dc4f5fc178", "path": "lib/applerecords/applerecords.jar!!lib/applerecords/applerecords.jar!javazoom/jl/converter/Converter$ProgressListener.class", "size": 551, "type": "java_class", "depth": 2 }, { "id": 14, "sha": "83974446a16586ab48ec739bb79c1955f27a74cf0ef081a3eca9a698fca661d6", "path": "lib/applerecords/applerecords.jar!!lib/applerecords/applerecords.jar!javazoom/jl/converter/Converter$PrintWriterProgressListener.class", "risk": 1, "size": 2425, "type": "java_class", "depth": 2 }, { "id": 15, "sha": "806c5b7cd53716f0f208b3d2d989c9c70f84c215831e4c2aab3ba12745607f94", "path": "lib/applerecords/applerecords.jar!!lib/applerecords/applerecords.jar!javazoom/jl/converter/Converter.class", "risk": 1, "size": 3246, "type": "java_class", "depth": 2 }, { "id": 16, "sha": "07edf509d3cf0a66237f4506a3771799cbf867a3238d24366971f1704d4a1acd", "path": "lib/applerecords/applerecords.jar!!lib/applerecords/applerecords.jar!javazoom/jl/converter/RiffFile$RiffChunkHeader.class", "size": 435, "type": "java_class", "depth": 2 }, { "id": 17, "sha": "e57d3172a94545c109e295b41e9e1ce8279c44f6a32e626785832c87d29212db", "path": "lib/applerecords/applerecords.jar!!lib/applerecords/applerecords.jar!javazoom/jl/converter/WaveFile$WaveFileSample.class", "size": 404, "type": "java_class", "depth": 2 }, { "id": 18, "sha": "51399a016a67ffb6d6ba1615306e782bd84c8a91bfa31dda354ab013d1fd8108", "path": "lib/applerecords/applerecords.jar!!lib/applerecords/applerecords.jar!javazoom/jl/converter/jlc.class", "risk": 1, "size": 1589, "type": "java_class", "depth": 2 }, { "id": 19, "sha": "72088db796443c3c277870788577761de1cb71d90826f2c8cd2510011ee65802", "path": "lib/applerecords/applerecords.jar!!lib/applerecords/applerecords.jar!com/strangeberry/jmdns/tools/Responder.java", "risk": 1, "size": 2325, "type": "java", "depth": 2 }, { "id": 20, "sha": "8931d287641ef59c82efae6ecfa73cab180adbac86f4ae43ab602dc518f2db86", "path": "lib/applerecords/applerecords.jar!!lib/applerecords/applerecords.jar!com/twmacinta/util/MD5State.java", "risk": 1, "size": 2340, "type": "java", "depth": 2 }, { "id": 21, "sha": "cd702440d321dc19e70154c7286e74cfe256a319e2d28f37be00f84674609d9e", "path": "lib/applerecords/applerecords.jar!!lib/applerecords/applerecords.jar!com/twmacinta/util/MD5.java", "risk": 1, "size": 22822, "type": "java", "depth": 2 }, { "id": 22, "sha": "d0c399cdfacf178a2a4633dda519ce191125f24ad15ec780c391a52a5f4707d2", "path": "lib/applerecords/applerecords.jar!!lib/applerecords/applerecords.jar!docs/stylesheet.css", "size": 1299, "type": "text", "depth": 2 }, { "id": 23, "sha": "c44752a4285d02b72ae059926955f71c72f4b696ccfda2c13c2ba72b0f0b934a", "path": "lib/applerecords/applerecords.jar!!lib/applerecords/applerecords.jar!com/strangeberry/jmdns/tools/Responder.class", "size": 1480, "type": "java_class", "depth": 2 }, { "id": 24, "sha": "b9bbe61079fcf7b8ff78ea92bf034e0a6d10881b6f102eb31c6b8595a4d8ac1a", "path": "lib/applerecords/applerecords.jar!!lib/applerecords/applerecords.jar!com/twmacinta/util/MD5.class", "size": 8151, "type": "java_class", "depth": 2 }, { "id": 25, "sha": "8baa8cc965730ab46d9d93a3b7d0a9479354117c8b9aa70b4e10f4c021c4ccec", "path": "lib/applerecords/applerecords.jar!!lib/applerecords/applerecords.jar!javazoom/jl/converter/RiffFile.class", "size": 3890, "type": "java_class", "depth": 2 }, { "id": 26, "sha": "56b42b0d65b854fe18b1a7f733c2162b71e4414ffbbb42aad214a11341185677", "path": "lib/applerecords/applerecords.jar!!lib/applerecords/applerecords.jar!javazoom/jl/converter/WaveFile$WaveFormat_ChunkData.class", "size": 743, "type": "java_class", "depth": 2 }, { "id": 27, "sha": "fe325df154b1e1c5a6dbaa790eaf599456ad778b762dc784ac43f8e676070ba6", "path": "lib/applerecords/applerecords.jar!!lib/applerecords/applerecords.jar!javazoom/jl/converter/WaveFile$WaveFormat_Chunk.class", "size": 1225, "type": "java_class", "depth": 2 }, { "id": 28, "sha": "2081725a3c084d5c688a4a1c5c1bf6423c3e748a82023de6a81797167e6943ba", "path": "lib/applerecords/applerecords.jar!!lib/applerecords/applerecords.jar!javazoom/jl/converter/WaveFile.class", "size": 2475, "type": "java_class", "depth": 2 }, { "id": 29, "sha": "297eba60f64448c71ec7b2f0cb819c02ff4608fffe489a4e8cd8ef89544a4b95", "path": "lib/applerecords/applerecords.jar!!lib/applerecords/applerecords.jar!javazoom/jl/converter/WaveFileObuffer.class", "size": 999, "type": "java_class", "depth": 2 } ], "omitted_files": 22, "v": "8" } }