{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 0.11156842112541199,
        "class": 0
      }
    ],
    "prob": 0.11156842,
    "skip": [
      {
        "m": "az/c",
        "why": "uncalibrated"
      }
    ],
    "class": 0,
    "models": [
      {
        "m": "az",
        "prob": 0.11156842,
        "class": 0
      },
      {
        "m": "az/source",
        "prob": 0.007026229,
        "class": 0
      }
    ],
    "version": "v16.16",
    "thresholds": [
      0.9961138,
      0.99909174
    ],
    "analyzed_at": "2026-05-09T11:43:27Z"
  },
  "path": "comdefsp.h",
  "raw": {
    "v": "4",
    "fs": [
      {
        "f": "O(Er)H(Os)",
        "k": {
          "source.imports[0]": "COM_SMARTPTR_TYPEDEF",
          "source.imports[1]": "uuidof",
          "source.has_imports": true
        },
        "x": 1,
        "id": 0,
        "is": [
          "COM_SMARTPTR_TYPEDEF",
          "uuidof",
          "COM_SMARTPTR_TYPEDEF",
          "uuidof",
          "COM_SMARTPTR_TYPEDEF",
          "uuidof",
          "COM_SMARTPTR_TYPEDEF",
          "uuidof",
          "COM_SMARTPTR_TYPEDEF",
          "uuidof",
          "COM_SMARTPTR_TYPEDEF",
          "uuidof",
          "COM_SMARTPTR_TYPEDEF",
          "uuidof",
          "COM_SMARTPTR_TYPEDEF",
          "uuidof",
          "COM_SMARTPTR_TYPEDEF",
          "uuidof",
          "COM_SMARTPTR_TYPEDEF",
          "uuidof",
          "COM_SMARTPTR_TYPEDEF",
          "uuidof",
          "COM_SMARTPTR_TYPEDEF",
          "uuidof",
          "COM_SMARTPTR_TYPEDEF",
          "uuidof",
          "COM_SMARTPTR_TYPEDEF",
          "uuidof",
          "COM_SMARTPTR_TYPEDEF",
          "uuidof",
          "COM_SMARTPTR_TYPEDEF",
          "uuidof",
          "COM_SMARTPTR_TYPEDEF",
          "uuidof",
          "COM_SMARTPTR_TYPEDEF",
          "uuidof",
          "COM_SMARTPTR_TYPEDEF",
          "uuidof",
          "COM_SMARTPTR_TYPEDEF",
          "uuidof",
          "COM_SMARTPTR_TYPEDEF",
          "uuidof",
          "COM_SMARTPTR_TYPEDEF",
          "uuidof",
          "COM_SMARTPTR_TYPEDEF",
          "uuidof",
          "COM_SMARTPTR_TYPEDEF",
          "uuidof",
          "COM_SMARTPTR_TYPEDEF",
          "uuidof",
          "COM_SMARTPTR_TYPEDEF",
          "uuidof",
          "COM_SMARTPTR_TYPEDEF",
          "uuidof",
          "COM_SMARTPTR_TYPEDEF",
          "uuidof",
          "COM_SMARTPTR_TYPEDEF",
          "uuidof",
          "COM_SMARTPTR_TYPEDEF",
          "uuidof",
          "COM_SMARTPTR_TYPEDEF",
          "uuidof",
          "COM_SMARTPTR_TYPEDEF",
          "uuidof"
        ],
        "ms": {
          "file": {
            "size": 79449.0
          },
          "text": {
            "digit_ratio": 0.0,
            "space_count": 2219.0,
            "total_lines": 1323.0,
            "char_entropy": 5.18,
            "unique_chars": 74.0,
            "import_density": 4.84,
            "avg_line_length": 58.05,
            "max_line_length": 96.0,
            "empty_line_ratio": 0.01,
            "last_line_length": 27.0,
            "most_common_char": "_",
            "whitespace_ratio": 0.06,
            "most_common_ratio": 0.09,
            "identifier_density": 1.63,
            "line_length_stddev": 11.56,
            "normalized_import_count": 1.76,
            "suspicious_comment_ratio": 0.33,
            "max_inline_whitespace_run": 2.0,
            "suspicious_identifier_ratio": 0.03,
            "normalized_unique_identifiers": 83.61
          },
          "imports": {
            "total": 64.0,
            "unique_modules": 2.0,
            "third_party_count": 64.0,
            "third_party_ratio": 1.0
          },
          "strings": {},
          "comments": {
            "chars": 22707.0,
            "lines": 440.0,
            "total": 435.0,
            "to_code_ratio": 0.5,
            "high_entropy_comments": 142.0
          },
          "functions": {},
          "identifiers": {
            "total": 2157.0,
            "avg_length": 26.16,
            "max_length": 52.0,
            "min_length": 5.0,
            "avg_entropy": 3.71,
            "reuse_ratio": 0.4,
            "unique_count": 867.0,
            "length_stddev": 11.88,
            "has_digit_ratio": 0.06,
            "base64_like_names": 27.0,
            "high_entropy_count": 636.0,
            "high_entropy_ratio": 0.73,
            "all_lowercase_ratio": 0.0,
            "all_uppercase_ratio": 0.01,
            "numeric_suffix_count": 27.0,
            "double_underscore_count": 430.0,
            "underscore_prefix_count": 436.0
          }
        },
        "sz": 79449,
        "ts": [
          {
            "a": "T1036.005",
            "c": 0.8999999761581421,
            "d": "Microsoft company string in source",
            "e": [
              "Microsoft Corporation"
            ],
            "i": "objectives/evasion/masquerade/dll/task-scheduler::microsoft-company-string",
            "l": 1
          },
          {
            "a": "T1547.009",
            "c": 0.8799999952316284,
            "d": "IPersistFile COM interface in C source",
            "e": [
              "IPersistFile"
            ],
            "i": "micro-behaviors/os/com/object::ipersistfile-interface",
            "l": 3
          },
          {
            "a": "T1547.009",
            "c": 0.8799999952316284,
            "d": "IShellLink COM interface in C source",
            "e": [
              "IShellLink"
            ],
            "i": "micro-behaviors/os/com/object::ishelllink-interface",
            "l": 3
          }
        ],
        "sha": "cbef3955cde258f6042d1036c18b2d7378ea5dd10cee0f7511f37934c573a4d6",
        "path": "comdefsp.h",
        "type": "c"
      }
    ],
    "tv": "a9555"
  }
}