{ "ml": { "v": "7", "eng": "2.2.0-beta.2", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.06350856, "rte": "az", "prob": 0.06350856 } ], "prob": 0.06350856, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.06350856274366379, "type": "xz" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.000013828277587890625, "type": "python" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.009726841934025288, "type": "shell" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.00985120702534914, "type": "shell" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.000015368064850918017, "type": "python" }, { "id": 5, "lvl": -1, "conf": 0, "prob": 0.000015000502571638208, "type": "python" }, { "id": 6, "lvl": -1, "conf": 0, "prob": 0.000010351340279157739, "type": "kotlin" }, { "id": 7, "lvl": -1, "conf": 0, "prob": 0.00001000364591163816, "type": "kotlin" } ], "version": "v18.18", "analyzed_at": "2026-06-29T00:50:26Z" }, "path": "tex-pst-node-1.45.tgz", "raw": { "files": [ { "id": 0, "mol": "O(Er)H(Po₂)", "sha": "cd287c0131bb2c637b5da88db5aec163934cf091a332d5b67bcf86b9fc69d469", "path": "/data/samples/good/foraged/netbsd/netbsd.org/_/tex-pst-node-1.45/tex-pst-node-1.45.tgz", "risk": 4, "size": 28492, "type": "xz", "facts": { "metrics": { "file": { "size": 28492.0, "entropy": 7.99, "size_bytes": 28492.0 }, "binary": { "overall_entropy": 7.99, "peak_region_bytes": 28492.0, "peak_region_entropy": 7.84 }, "consistency": { "extension_content_mismatch": 1.0, "extension_content_mismatch.archive_as_archive": 1.0 } } }, "traits": [ { "id": "well-known/tool/detection/security-scanner::dangerous-code-call-denylist", "conf": 0.9200000166893005, "crit": 1, "desc": "Defensive dangerous code-call denylist", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/interpreter/perl::perl-keyword", "conf": 0.699999988079071, "crit": 3, "desc": "perl interpreter keyword (beyond shebang)" }, { "id": "micro-behaviors/os/env/vars/access::env-cmd", "atk": "T1082", "conf": 0.6000000238418579, "crit": 3, "desc": "env command path" }, { "id": "micro-behaviors/process/create/shell/spawn::bin-sh", "atk": "T1059.004", "mbc": "E1059.004", "conf": 0.6000000238418579, "crit": 3, "desc": "References /bin/sh (Bourne shell)" }, { "id": "micro-behaviors/process/create/shell/spawn::shell-symbols", "conf": 0.8999999761581421, "crit": 3, "desc": "Shell execution symbols", "from": [ { "file": 2 }, { "file": 3 } ], "spans": [ [ 0, 34 ] ] }, { "id": "objectives/evasion/masquerade/extension/shebang::bash-shebang-first-line", "atk": "T1036.008", "mbc": "F0008", "conf": 0.949999988079071, "crit": 3, "desc": "File starts with" }, { "id": "micro-behaviors/process/create/shell/spawn::sh-dynamic-command-target", "conf": 0.6000000238418579, "crit": 3, "desc": "Shell command name from variable", "spans": [ [ 0, 34 ] ] } ] }, { "ctx": [ { "b": "azttbvR6O4as4pub)\u003e}AavnH!nLQyEB960Kz!9AiBy/X7b{-)Ab{k%3wmY*8Cwhejaw=0oA+P30B1N!Cb{lf2x(+ztB7GznBzbkdxK$Q.wPw]9x(4u6u#QgeePbGqwId}xzZNdAb{-)Ab{kMJp*3W/m[uP4f/.lIefDVciw-off/.lOayYQsrb3h/Bzb}xr:/\u003e*t48qVBsXLRC6Vz\u003eCxCJHwoxH", "ln": 44, "col": 45, "line": 1 }, { "b": "B.rsBA+v0ib{-)Ab{lf2x(+zoA=kPhvqNb%vqWh%wGV28wncabA+P09By!#9vqYQez/M$qz!9M]x\u003ep/$B-7-3AV/EqwGV8aA=2\u003e8b{:WLw/#hewGTVPraPeOp\u0026ZF?wN/*8p\u003c3k-x\u003e5nVx\u003e7Z(B7DEZx(!xpx\u003c#jbwN(]}A=k!qlSuuD3mc#vvrb\u0026", "ln": 263, "col": 44, "line": 9 }, { "b": "Bu\u003ctNBz0ggBzbk\u003cAc3a^v@uy4tYT\u003c)v}y6m3lQD@w[=V2b)\u003e}vvS=raw[=Gjw]zYjCX7Y1By/XFay]UfAaAM$CP.cIwPF#oxK@rgA=k\u0026daAI43y?W^13s4aMw)xC5kU+)mph:VODOncjwmXXHvqGG$DT7n%CWbieBz=2cwPIu\u0026y?l\u003cpB-7-3w[=b", "ln": 1522, "col": 13, "line": 54 }, { "b": "D2Nsqf!:.YAuGPJasedHzF%5%aAR)FwEoL5arSJ:v@DsiapoklarUfqy?W#lvqG\u003c\u003cwft\u0026fA0^ZgarSA[aAITBx(mMav%h]oc{5L2arR^+atL6Wz!%kjb{k=%x()f?z!9z^arR^Hgb6?(", "ln": 2992, "col": 9, "line": 99 }, { "b": "zxJ!sy-)!wvJYh)w^PU6arR^HtYs+akX1.JAV^aWv@Dsi3lQDlarR!Lg9yTXvJWsHf^5[M3lQDlarR!Kg9yTXvJWsGf^74Lv}V#}wO8n(arR^HaBbZ+vpS)\u003efl]q}wQ4Y#ay]4}3lP", "ln": 14005, "col": 41, "line": 490 }, { "b": "CS/qBvScGlBz\u003eAgkZK^:tX^[\u003ezy]ajB96VTx(do-C4bxmaARKbDo=*ZC5}.fvScG@Ac3a^xKU[8tY$g7x(CUeAc3a^wnb)\u003eEoZDbBa5DztX4zTtUOTxwM9nXA=+5+", "ln": 29806, "col": 16, "line": 977 }, { "b": "azkIevQT7?C)W!wx\u003ezl]CYWCevrbQZxl4{kAc\u003e?+z!9AAkTn*$z/QmLaA}xtxKM6}ayPdgvpS[.BzkVhvqE67z!9A4tp}JXu3*EcwmZe@arR^HarR^HarR^HarR^HarR!NtUYiFwK5H\u003cz/oVAbqJH?zFr]kaA}xtxKM6}arT(ve?QBEz!9z^tXd!-", "ln": 33826, "col": 67, "line": 1103 }, { "b": "v)a7oB8a3HzF9=%k{gb*3lQD@Ac3a^wnb)\u003ejUX]IAc8BfasedtwGV5pA+c^ABzb98ayPe2y?k)Px(+yJaA8oyf/Q\u003ctazCBgzF%RFaA}xtB7GCox(\u003eFtzY*.varT{6w[kQ)tYs+akXaOCv)a7ykWm(pB7FP\u003cw[kQ)tYs+akXaOCv)a7oB96VTx(dx=", "ln": 41050, "col": 11, "line": 1338 }, { "b": "vR3W6AaJJ[w[+*!azCBgD2E?Caz2!pA+frkx(v(ix(+z9y?Er*A:-V(3mc*1l3d3ic{YpglmEmGEir6iw[=c]B0bvswmV()C{40kzdK?Saz2RnwO#Q7vqG+9ayPsllm\u003eFgb{lCUAboVrlmtbGc{/wflWZ7/wObT]wPF#iz!9A4vTf8lvqPM#lM/@YA@", "ln": 48389, "col": 161, "line": 1486 }, { "b": "tXvR\u0026zF%5%y?W%jDPVg:wmV)7z/o.uzEEx[k7d=uzE[6may/tbzddr)k7aL/B0bQDwOc73azCZoCxdztx(mMaAc3bwx\u003e7}1az\u003eK%A=l1IaA}HgA+cwnxK#i}azC)tvixx2B95Ky", "ln": 49075, "col": 3, "line": 1492 }, { "b": "wmYT!zdLB=Es17Kz!9A%vqPNhk7a?BdjvIic]0nddju#lgCymahy{Zme?O:-c3KoFyJyRxx([2hBzbkdy?W=#aAITkA==2kxcpS8avdb-wNPa-zF78lz*bSgwfsh\u0026ayPd#ay/tbAclnlB0bNrwGUP0A=VsBAbPDdBrCWsvrrSdx\u003equdz/cXtxK@r9z!%Ynx(mG8c]0nddju#lgCymahy{Zme?O+cay!?@y?W^1azC{ujwG*9wO${[wIDw3aw3U$vqH16ay/tbAclnlB0bNrwGUP0A=VsBAbPDdBrCpnaARpdaA8jrz/YSmwGUI$A+e:5x(v(ic$WHrz6ha[az=sqzF78gzxK4mvrrShz!%Ynx(mGkaz$R8x(mMax(\u003eEWph:VOzEEx[gcNrknOf8-zE\u003c@eAV/pxxK#ibz!pblxK#l@azC.nwPz\u003c6v@#B6zGu}mB0b4hAccvRaARpdaz#adwPF#5A+cwmwPP5pzY\u003c7izeTJcaAhmkzGG}xz/cXtxK@r5x(mGmaxi2=aAR*Caz#adwPF#5A+cwnxK#67yhW*7wN(])C{3Jry?W=#e*abbwGUL@w[tE]ay]55wO#41aA8cuBzbkdy\u0026r/(BzkVhaA7\u003cmk{fPNwfshYA+f5}Bzk]faARJABzbkdAbPMry?W=#efGdJBz8!sCw!Qlvrl13aA}:ABz8!mz//Yhxd:JqasHUEazCBgBzbkdAbPMry?W=#azC)tv@c78wN(](zE:(7w/%w\u003cavmhVA+cwczGGDgx(w2mBz\u0026puzE\u003c@ew/$/fB0a$hze:AhwO#QhefGjRBS+sdBrC0my?S", "ln": 50753, "col": 24, "line": 1500 }, { "b": "y-)O6v@=He3s4EWCvLMlzGGc3B.%x.BAm^]zE[34z/]@ttYs+akW!XCv@uxmazbLjaA.:pazCZoAa9^dx(mMazF%5%az2!pA+frkx(v)g3s4aMw)wehr6UFxz/*tO3s4yUBx\u0026^aBu\u003c.PCYWhhwO+!13mfLmaAI4kvru0)aA?glx\u003c\u003eE!wPFh-wmYvTzfXx*wO(xL", "ln": 52106, "col": 34, "line": 1507 }, { "b": "x(+z9ay/tbzddr)efDe)azC)tvix-4y\u0026%quaAhmuB7]91C{3Jrv@Dj3vqYP.arT{6w[kE+x(mG)bqACqw{tKPtTh\u003eqAccwgCW$w$bqBJ\u0026gjrztx\u003ctj=B7FQ3wmYu$f)+c2EoZw#Ei/jD3s4aMw)xB?B96Y:xcPcUbqJH?zFr{lb)))\u003ew{vN3wO+!1bqJIAwO+!1b)\u003e+qay5.]Bx\u0026WdkYgdTBx!", "ln": 52457, "col": 27, "line": 1525 }, { "b": "eIOw*z!%kjB9g}mgAXy{A=k=gaz2!cxDRwsvJWAGv@Dsiaz2!cxDQ\u0026dA3f1uy-)qlv}V#}B-nEuB.\u0026gewmM*7ADldz3lQDlarR^HarR^Hay]RlatUb{aAzypy-)n5B%5N-f^3", "ln": 54693, "col": 15, "line": 1586 }, { "b": "ar@V\u003eDM$vLx)?omarT]$woIy0v}w[:B96VTx(do3tYs+akXaOCvTPKftXmWSarT{2CYm8ewmo7(wPz42wmYu}tW}?)vqPM#tU[u#kYQ^YBrCEtwmYm?B-8qawO#3*B8CA6wGVt8Bzbk\u003cAc3a^v@ux%Ei/jyay5R)zGP/3p\u0026*.zl$G?IxfF0(tY+k", "ln": 58312, "col": 76, "line": 1689 }, { "b": "Ac3a^v@ux%jThZ8tYKy(vr=3=woIy0v}w[:B96VSzGGqfvTf7J3s4dMwObgjBzU#zEi/k9zfoVpx\u003ehdetXMtCf!j#bDT7JhBu\u003ctNByxPAtZf^\u003cw)vPyze:\u0026bkY*\u003cZc)HJMx^[EUb)))*CYm8ewmo7(wPz3{B8kMdwN4Gxze:[H3s4pTzF%MbB8UL$wPJnC3mb", "ln": 58834, "col": 2, "line": 1705 }, { "b": "pcZ3UazU\u003ekCwXKIasedCzF%-paz#adwEoL5arR^Hflz5Ivr9F{c@aX\u003ewGSiLiV]\u003c]jtF(WasFVYc[DF\u0026asFVYjtF]Xt{9V?w/@xbarR^HarSsUBAeGUg9yTWA+PA7", "ln": 60063, "col": 18, "line": 1748 }, { "b": "wObgWwPR*3CYVhCz!9BatTi1nzE[6mv}Yp\u003ed0]iiwPR*3CYVhCz!9AAx)?omarV2ovpTK\u0026zEWl.Ac3a^vrc14ayYQstX#-zwGUk?CYm8ewmo7(wPz42wmYu}tW}?)vqPM#tU[u#kYQ^YBrCEtwmYm?B-8qawO#3*B8CA6wGVt8Bzbk\u003cAc3a^vrc14Ef}8ttXN!/B.$wWB96VnwNY^{j$[9:BA}?pz/{eGlVM:DBy!#9zF%5%B0aZ:q=D25zV", "ln": 60805, "col": 3, "line": 1773 }, { "b": "AbPMrnP5SYA=U/4BzkVhB3KCNbqyz#DNf27wmYvTA=k(rkYgHJwQtTREoZVjz9S5ZB3g:6ay5}#y*?Mm3s4K*y\u003cwP\u0026By/GlwN/*@z/fRYx\u003e.pfb{iKv3s4aMw)xp[yY", "ln": 64281, "col": 6, "line": 1878 }, { "b": "wPP4\u003eBw)r\u003earR%MCRHs^f^7Y}eQf2[C}*)@g72=Vv@Dsiaw^u9xDQ#4ay]hfatL6Ix)7RfB-nDHaB2Q-C}*B^f!ES9aBbW[C}{HMay(PCwgY#Qfet1\u003cxBlKrf^7HPy?$juaB0", "ln": 67903, "col": 24, "line": 1955 }, { "b": "aARKvzGP!sgAXn7aAzypy-)XtBrz\u003eLwO(ydC)U\u0026uzE[6maAIToA4JUNx(mD7w[=pbBrCpnwmZ0dz/{eyx\u003eg=$v}/%[y?j-cw/#b5wncgcaztBh3lR0uy?d3\u0026zE^s6ay624wD", "ln": 68730, "col": 65, "line": 1969 }, { "b": "C{)LZx(mAfefD63By/Gfj.e^(uns3wC}\u0026RX3lR8Dv@DsiaB4xsD1d%[Bw)r\u003easedPc#HRJzEUarC{)LZx(mAfasIE.zy]Nuv\u003c%0Ov\u003c@JGC{)LZx(mAfeQp?P3lR8Dv@Dsi", "ln": 69650, "col": 12, "line": 1982 } ], "depth": 1, "facts": { "imp": [ [ "", "NodeDict" ], [ "", "NodeDict" ], [ "", "cvs" ], [ "", "InitPnode" ], [ "", "type" ], [ "", "Name" ], [ "", "cvs" ], [ "", "cvs" ], [ "", "cvs" ], [ "", "roll" ], [ "", "pop" ], [ "", "pop" ], [ "", "cvs" ], [ "", "type" ], [ "", "Name" ], [ "", "false" ], [ "", "false" ], [ "", "false" ], [ "", "ii" ], [ "", "ii" ], [ "", "pscircle" ], [ "", "ii" ], [ "", "reference" ], [ "", "ADDED" ], [ "", "ii" ], [ "", "ii" ], [ "", "pnode" ], [ "", "getcoor" ], [ "", "pnode" ], [ "", "tlName" ], [ "", "bcName" ], [ "", "crName" ], [ "", "tcName" ], [ "", "Michael" ], [ "", "sin" ], [ "", "cos" ], [ "", "at" ], [ "", "cos" ], [ "", "sin" ], [ "", "psxline" ], [ "", "plotpoints" ], [ "", "Ex" ], [ "", "AtoB" ], [ "", "AtoB" ], [ "", "AplusB" ], [ "", "AplusB" ], [ "", "midAB" ], [ "", "midAB" ], [ "", "P3.P7" ], [ "", "argument.shownode" ], [ "", "vectors.Where" ], [ "", "psLCNodeVar" ], [ "", "psLCNodeVar" ], [ "", "psLCNodeVar" ], [ "", "argument" ], [ "", "changing.The" ], [ "", "changing.The" ], [ "", "changing.The" ], [ "", "argument" ], [ "", "pspolygon.psrline" ], [ "", "pspolygon.psrline" ], [ "", "pspolygon" ], [ "", "pspolygon" ], [ "", "pspolygon" ], [ "", "pspolygon" ], [ "", "at" ], [ "", "increments" ], [ "", "polyline" ], [ "", "polyline" ], [ "", "polyline" ], [ "", "direction" ], [ "", "psStep" ], [ "", "pnode" ], [ "", "pnode" ], [ "", "pnode" ], [ "", "pnode" ], [ "", "pnode" ], [ "", "pnode" ], [ "", "pnode" ], [ "", "psline" ], [ "", "psline" ], [ "", "pnode" ], [ "", "pnode" ], [ "", "getcoor" ], [ "", "multiply" ], [ "", "then" ], [ "", "psline" ], [ "", "cos" ], [ "", "sin" ], [ "", "pnode" ], [ "", "psRelNodeVar" ], [ "", "ifnextchar" ], [ "", "pnode" ], [ "", "pnode" ], [ "", "pnode" ], [ "", "conditions" ], [ "", "dx1" ], [ "", "pnode" ] ], "mbr": [ "A.x", "A.y", "A1.x", "A1.y", "B.polyIntersection", "B.psRelNodeVar", "B.x", "B.y", "Jan.leavevmode", "P.This", "P.x", "P.y", "P0.P10", "P0.P99", "P3.P7", "PSTricks.This", "SpecialCoor.Unlike", "abscissas.psStepa", "active.begingroup", "argument.shownode", "beta.bug", "changing.The", "coil.tex", "collection.It", "curve.Eg", "de.x", "de.y", "detected.fnpnode", "dimc.pslinewidth", "dimen.sub", "empty.testAlg", "expressions.curvepnodes", "file.It", "followed.pnodes", "function.The", "graph.Eg", "increments.It", "index.The", "jobname.nodes", "length.It", "line.The", "lppl.txt", "lppl.txt.csname", "msharpe.edu", "mul.mul", "node.ifPst", "node.pro", "node.tex", "node.x", "node.y", "nodexn.normalvec", "nwu.edu", "nwu.edu.COPYRIGHT", "pnodes.psStepa", "polyline.calling", "psRelNode.psRelLineVar", "psRelNode.rhombus", "psline.Eg", "pspolygon.psrline", "pstricks.tex", "recursively.Better", "root0.PST", "sequence.Eg", "syntax.nodexn", "tool.getnodelist", "tug.org", "tug.org.This", "user.psGetNodeCenter", "vectors.Where" ], "tgt": [ "ADDED", "AplusB", "AtoB", "Ex", "InitPnode", "Michael", "Name", "NodeDict", "P3.P7", "argument", "argument.shownode", "at", "bcName", "changing.The", "conditions", "cos", "crName", "cvs", "direction", "dx1", "false", "getcoor", "ifnextchar", "ii", "increments", "midAB", "multiply", "plotpoints", "pnode", "polyline", "pop", "psLCNodeVar", "psRelNodeVar", "psStep", "pscircle", "psline", "pspolygon", "pspolygon.psrline", "psxline", "reference", "roll", "sin", "tcName", "then", "tlName", "type", "vectors.Where", "x", "y" ], "metrics": { "ast": { "op.add": 19, "op.bor": 15, "op.div": 194, "op.lor": 5, "op.mod": 509, "op.mul": 7, "op.sub": 229, "op.xor": 11, "op.land": 17, "max_depth": 143, "call_count": 178, "node_count": 27540, "member_count": 69, "max_array_len": 10, "op_density.add": 0, "op_density.bor": 0, "op_density.div": 0.01, "op_density.lor": 0, "op_density.mod": 0.02, "op_density.mul": 0, "op_density.sub": 0.01, "op_density.xor": 0, "op_density.land": 0, "max_concat_chain": 31, "member_depth_max": 3, "max_numeric_array": 2, "self_compare_count": 20, "xor_mod_loop_count": 6 }, "file": { "size": 71120, "entropy": 5.15 }, "text": { "lines": 2020, "top_char": 101, "tab_count": 23, "max_ws_run": 21, "digit_ratio": 0.04, "space_count": 7644, "char_entropy": 5.15, "mixed_indent": 1, "unique_chars": 94, "top_char_null": 0, "escape_density": 0.07, "lines_over_200": 10, "lines_over_500": 1, "string_density": 0, "top_char_ratio": 0.08, "ascii_art_lines": 1, "avg_line_length": 34.21, "max_line_length": 506, "empty_line_ratio": 0, "hex_escape_count": 15, "last_line_length": 19, "long_token_count": 1, "whitespace_ratio": 0.14, "identifier_density": 4.01, "line_length_stddev": 32.47, "unicode_escape_count": 38, "normalized_string_count": 0.09, "repeated_char_sequences": 48, "suspicious_comment_ratio": 0.04, "trailing_whitespace_lines": 95, "suspicious_identifier_ratio": 0.05, "normalized_unique_identifiers": 115.3 }, "binary": { "peak_region_bytes": 53248, "peak_region_entropy": 5.25 }, "strings": { "bytes": 52, "count": 4, "avg_length": 13, "max_length": 13, "avg_entropy": 3.55 }, "comments": { "chars": 3428, "count": 146, "lines": 146, "base64": 1, "high_entropy": 5, "to_code_ratio": 0.08 }, "identifiers": { "count": 8100, "unique": 1266, "avg_length": 5.96, "max_length": 17, "min_length": 1, "avg_entropy": 2.2, "reuse_ratio": 0.16, "length_stddev": 2.86, "has_digit_ratio": 0.04, "sequential_names": 55, "base64_like_names": 3, "single_char_count": 37, "single_char_ratio": 0.03, "high_entropy_count": 2, "high_entropy_ratio": 0, "all_lowercase_ratio": 0.71, "all_uppercase_ratio": 0.03, "repeated_char_names": 1, "numeric_suffix_count": 46, "underscore_prefix_count": 1 } } }, "id": 1, "mol": "O(As)H(Cr)Md(Pa)", "path": "/data/samples/good/foraged/netbsd/netbsd.org/_/tex-pst-node-1.45/tex-pst-node-1.45.tgz!!share/texmf-dist/tex/generic/pst-node/pst-node.tex", "pid": 0, "risk": 3, "sha": "816ff04f3a86904dcbfd84ef99626f9a3a827458ff4d8d1e433a895caad0fafd", "size": 71120, "traits": [ { "id": "metadata/file/string/file::tmp", "conf": 0.2, "crit": 1, "desc": "tmp keyword", "spans": [ [ 58882, 0 ], [ 58889, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"", "spans": [ [ 120, 0 ], [ 58360, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-2", "conf": 0.8, "crit": 1, "desc": "English function-word token \"and\"", "spans": [ [ 311, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-3", "conf": 0.8, "crit": 1, "desc": "English function-word token \"that\"", "spans": [ [ 41098, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-4", "conf": 0.8, "crit": 1, "desc": "English function-word token \"have\"", "spans": [ [ 33874, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "spans": [ [ 1570, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-6", "conf": 0.8, "crit": 1, "desc": "English function-word token \"with\"", "spans": [ [ 92, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-7", "conf": 0.8, "crit": 1, "desc": "English function-word token \"this\"", "spans": [ [ 110, 0 ] ] }, { "id": "metadata/package/files/dependency::native-vendor-dependency-path", "conf": 1.0, "crit": 3, "desc": "File under a vendored native dependency path" }, { "id": "micro-behaviors/fs/write/file/stage::source-temp-path-reference", "conf": 0.92, "crit": 1, "desc": "Source references temporary path", "spans": [ [ 60095, 0 ] ] }, { "id": "metadata/file/naming::sequential-identifiers", "conf": 0.8, "crit": 2, "desc": "Sequential source identifier names" }, { "id": "micro-behaviors/crypto/symmetric/xor/loop::xor-modulo-key-loop", "conf": 0.8, "crit": 3, "desc": "Loop XORs through modulo-indexed accumulator" }, { "id": "objectives/anti-static/obfuscation/code-metrics/identifiers::py-sequential-identifiers", "atk": "T1027", "mbc": "B0032", "conf": 0.8, "crit": 3, "desc": "Excessive sequential identifiers" } ], "type": "python" }, { "ctx": [ { "b": "boXZHx(kOBxA", "n": [ { "c": 3, "d": "File starts with", "i": "objectives/evasion/masquerade/extension/shebang::bash-shebang-first-line", "o": 0, "z": 9, "cf": 0.949999988079071 } ], "ln": 1, "addr": 0 }, { "b": "bl", "ln": 2, "addr": 10 }, { "b": "boOmbwPQmql](D7wNPaXAX8wRf!Lm8gb7BtfekjngCx}ah99DFiX\u0026xiCwhvCmr\u0026+]bM", "n": [ { "c": 2, "d": "NetBSD RCS ident keyword", "i": "metadata/binary/provenance::netbsd-rcs-id", "o": 14, "z": 8, "cf": 0.8999999761581421 } ], "ln": 3, "addr": 12 }, { "b": "", "ln": 4, "addr": 66 }, { "b": "q:\u003cwHjT8d9a]", "ln": 5, "addr": 67 }, { "b": "B7/o1BrAs", "ln": 8, "addr": 101 }, { "b": "", "ln": 9, "addr": 109 }, { "b": "l03Yxa$[7WAXy)ozzbBxyA-", "n": [ { "c": 2, "d": "Uses awk for text processing", "i": "well-known/tool/development/cli::awk-processing", "o": 124, "z": 3, "cf": 1.0 } ], "ln": 10, "addr": 110 }, { "b": "lp1Kspc?PyjT8L4B8\u0026{yx(kOkvrl0$vqPN1", "ln": 11, "addr": 129 }, { "b": "lQsWma$)ztzzbHdBrQ", "ln": 12, "addr": 158 }, { "b": "oI4#LmNo{DjT8L4B8\u0026{PvRGZky?W^5w)]Z%a]", "ln": 29, "addr": 469 }, { "b": "oIN.{fjFTkfkLII", "ln": 30, "addr": 499 }, { "b": "oJa7#fjFTkfkLXN", "n": [ { "c": 2, "d": "List directory contents via /bin/ls", "i": "micro-behaviors/fs/directory/readdir::readdir-ls", "o": 516, "z": 7, "cf": 0.6600000262260437 } ], "ln": 31, "addr": 512 }, { "b": "o?N(CqAViSvRGZkzeiV@AV=@Ma]", "ln": 32, "addr": 525 }, { "b": "o\u0026:z3zfv3Nw*d", "ln": 33, "addr": 547 }, { "b": "p^[nQh9AcpB-RNRAbf8tvRGZkAaK6aa]", "n": [ { "c": 3, "d": "perl interpreter keyword (beyond shebang)", "i": "micro-behaviors/process/interpreter/perl::perl-keyword", "o": 578, "z": 4, "cf": 0.699999988079071 } ], "ln": 34, "addr": 558 }, { "b": "p!Kq=k$1Bspcx^OB-RNRB7e\u003c3fk$YtuTWFZx(k9", "ln": 35, "addr": 584 }, { "b": "p!Kq=nLR-JjT8L4B8\u0026{PvRGZkAbf8[x(mK3a]", "ln": 36, "addr": 616 }, { "b": "qCxp#fjFTkflg[N", "ln": 38, "addr": 665 }, { "b": "qCxLJqAViSvRGZkA=2u3AV$", "ln": 39, "addr": 678 }, { "b": "q:\u003c8qa$[7WAXy)ozzc6xwfI", "n": [ { "c": 2, "d": "Uses sed for text processing", "i": "well-known/tool/development/cli::sed-processing", "o": 711, "z": 3, "cf": 1.0 } ], "ln": 40, "addr": 697 }, { "b": "q:\u003cUOpf6I4flItRfjFTkfj/3Aa]", "n": [ { "c": 3, "d": "env command path", "i": "micro-behaviors/os/env/vars/access::env-cmd", "o": 724, "z": 12, "cf": 0.6000000238418579 } ], "ln": 41, "addr": 716 }, { "b": "q+f4}fjFTkflp!J", "n": [ { "c": 3, "d": "Shell command execution capability", "i": "micro-behaviors/process/create/shell/spawn::shell-execution-comp", "o": 742, "z": 7, "cf": 0.8999999761581421 } ], "ln": 42, "addr": 738 }, { "b": "q+{p\u003cjT8L4B8\u0026{yx(kOBz/P}z", "ln": 43, "addr": 751 }, { "b": "q=L$8flItRfjFTkflqmW", "ln": 44, "addr": 772 }, { "b": "2{QM\u003cwO(vewGV5cwO=g7azbUjz6gGyByM$BxK#0@B1N", "ln": 108, "addr": 2027 }, { "b": "2{P", "ln": 109, "addr": 2062 }, { "b": "2{:\u003c%mn)flar.\u003cVCPXQ(d]O#coIuNRD\u0026", "n": [ { "c": 2, "d": "SHELL environment variable", "i": "micro-behaviors/os/env/vars/system-info::shell-var", "o": 2082, "z": 5, "cf": 0.5 } ], "ln": 110, "addr": 2065 }, { "b": "2)\u0026jqd]O#coIuNbmnlMUmiA\u003e5p!Kq=o*@2El{T^ruQNE-Ee", "ln": 111, "addr": 2091 }, { "b": "2{:\u003c%mn)flar.\u003cVCPXQ(d]O#coIuNRD\u0026", "ln": 112, "addr": 2129 } ], "depth": 1, "facts": { "imp": [ [ "", "shift" ], [ "", "shift" ], [ "", "{PWD_CMD}" ], [ "", "/usr/pkg/bin/mktexlsr" ], [ "", "/usr/pkg/bin/mktexlsr" ], [ "", "{TEST}" ], [ "", "./+OCAML_FINDLIB_REGISTER" ], [ "", "./+OCAML_FINDLIB_REGISTER" ], [ "", "{TEST}" ], [ "", "./+INFO_FILES" ], [ "", "./+INFO_FILES" ], [ "", "{TEST}" ], [ "", "./+ICON_THEMES" ], [ "", "./+ICON_THEMES" ], [ "", "{TEST}" ], [ "", "./+SHELL" ], [ "", "./+SHELL" ], [ "", "{TEST}" ], [ "", "./+SHELL" ], [ "", "./+SHELL" ], [ "", "{TEST}" ], [ "", "./+FILES" ], [ "", "./+FILES" ], [ "", "{TEST}" ], [ "", "./+FONTS" ], [ "", "./+FONTS" ], [ "", "{TEST}" ], [ "", "./+ICON_THEMES" ], [ "", "./+ICON_THEMES" ], [ "", "{TEST}" ], [ "", "./+SHLIBS" ], [ "", "./+SHLIBS" ], [ "", "{TEST}" ], [ "", "./+DIRS" ], [ "", "./+DIRS" ], [ "", "{TEST}" ], [ "", "./+USERGROUP" ], [ "", "./+USERGROUP" ], [ "", "{TEST}" ], [ "", "./+USERGROUP" ], [ "", "./+USERGROUP" ], [ "", "{TEST}" ], [ "", "./+FILES" ], [ "", "./+FILES" ], [ "", "{TEST}" ], [ "", "./+DIRS" ], [ "", "./+DIRS" ], [ "", "exit" ], [ "", "exit" ] ], "tgt": [ "${PWD_CMD}", "${TEST}", "./+DIRS", "./+FILES", "./+FONTS", "./+ICON_THEMES", "./+INFO_FILES", "./+OCAML_FINDLIB_REGISTER", "./+SHELL", "./+SHLIBS", "./+USERGROUP", "/usr/pkg/bin/mktexlsr", ":", "exit", "shift" ], "metrics": { "ast": { "max_depth": 7.0, "bind_count": 55.0, "call_count": 33.0, "node_count": 782.0, "identifier_count": 82.0, "string_literal_count": 53.0 }, "file": { "size": 3270.0, "entropy": 5.79, "size_bytes": 3270.0 }, "text": { "tab_count": 74.0, "digit_ratio": 0.04, "space_count": 216.0, "total_lines": 160.0, "char_entropy": 5.79, "mixed_indent": 1.0, "unique_chars": 84.0, "string_density": 0.33, "avg_line_length": 19.44, "max_line_length": 71.0, "empty_line_ratio": 0.1, "last_line_length": 6.0, "whitespace_ratio": 0.14, "most_common_ratio": 0.05, "identifier_density": 1.27, "line_length_stddev": 16.79, "normalized_string_count": 4.19, "suspicious_string_ratio": 0.02, "most_common_char_is_null": 0.0, "suspicious_comment_ratio": 0.1, "max_inline_whitespace_run": 1.0, "most_common_char_codepoint": 47.0, "normalized_unique_identifiers": 11.47 }, "binds": { "count": 55.0 }, "calls": { "count": 33.0, "dynamic_target_count": 15.0 }, "binary": { "overall_entropy": 5.79, "peak_region_bytes": 3270.0, "peak_region_entropy": 5.79 }, "strings": { "total": 53.0, "avg_length": 10.74, "max_length": 40.0, "path_count": 39.0, "avg_entropy": 2.85, "empty_count": 2.0, "total_bytes": 569.0, "entropy_stddev": 0.67, "shell_command_strings": 1.0 }, "comments": { "chars": 696.0, "lines": 17.0, "total": 39.0, "to_code_ratio": 0.12, "empty_comments": 22.0, "high_entropy_comments": 4.0 }, "identifiers": { "count": 82.0, "total": 203.0, "avg_length": 6.88, "max_length": 25.0, "min_length": 1.0, "avg_entropy": 2.25, "reuse_ratio": 0.41, "unique_count": 84.0, "length_stddev": 5.18, "has_digit_ratio": 0.06, "single_char_count": 5.0, "single_char_ratio": 0.06, "high_entropy_count": 7.0, "high_entropy_ratio": 0.08, "all_lowercase_ratio": 0.04, "all_uppercase_ratio": 0.7, "numeric_suffix_count": 1.0, "underscore_prefix_count": 1.0 } } }, "id": 2, "mol": "O(Er)H(Po₂)", "path": "/data/samples/good/foraged/netbsd/netbsd.org/_/tex-pst-node-1.45/tex-pst-node-1.45.tgz!!+DEINSTALL", "risk": 4, "sha": "a1ade09e3296a29e8135205b21677dd238a034342fa06fde08d0a1513477fc7f", "size": 3270, "traits": [ { "id": "micro-behaviors/os/env/vars/access::env-cmd", "atk": "T1082", "conf": 0.6000000238418579, "crit": 3, "desc": "env command path", "spans": [ [ 724, 12 ] ] }, { "id": "micro-behaviors/process/create/shell/spawn::bin-sh", "atk": "T1059.004", "mbc": "E1059.004", "conf": 0.6000000238418579, "crit": 3, "desc": "References /bin/sh (Bourne shell)", "spans": [ [ 742, 7 ] ] }, { "id": "objectives/evasion/masquerade/extension/shebang::bash-shebang-first-line", "atk": "T1036.008", "mbc": "F0008", "conf": 0.949999988079071, "crit": 3, "desc": "File starts with", "spans": [ [ 0, 9 ] ] }, { "id": "micro-behaviors/process/interpreter/perl::perl-keyword", "conf": 0.699999988079071, "crit": 3, "desc": "perl interpreter keyword (beyond shebang)", "spans": [ [ 578, 4 ] ] }, { "id": "micro-behaviors/process/create/shell/spawn::sh-dynamic-command-target", "conf": 0.6000000238418579, "crit": 3, "desc": "Shell command name from variable", "spans": [ [ 0, 34 ] ] }, { "id": "micro-behaviors/process/create/shell/spawn::shell-symbols", "conf": 0.8999999761581421, "crit": 3, "desc": "Shell execution symbols", "spans": [ [ 0, 34 ], [ 742, 7 ] ] } ], "type": "shell" }, { "ctx": [ { "b": "boXZHx(kOBxA", "n": [ { "c": 3, "d": "File starts with", "i": "objectives/evasion/masquerade/extension/shebang::bash-shebang-first-line", "o": 0, "z": 9, "cf": 0.949999988079071 } ], "ln": 1, "addr": 0 }, { "b": "bl", "ln": 2, "addr": 10 }, { "b": "boOmbwPQmql](D7wNPaXAX8wRf!Lm8gb7BtfekjngCx}ah99DFiX\u0026xiCwhvCmr\u0026+]bM", "n": [ { "c": 2, "d": "NetBSD RCS ident keyword", "i": "metadata/binary/provenance::netbsd-rcs-id", "o": 14, "z": 8, "cf": 0.8999999761581421 } ], "ln": 3, "addr": 12 }, { "b": "", "ln": 4, "addr": 66 }, { "b": "q:\u003cwHjT8d9a]", "ln": 5, "addr": 67 }, { "b": "B7/o1BrAs", "ln": 8, "addr": 101 }, { "b": "", "ln": 9, "addr": 109 }, { "b": "l03Yxa$[7WAXy)ozzbBxyA-", "n": [ { "c": 2, "d": "Uses awk for text processing", "i": "well-known/tool/development/cli::awk-processing", "o": 124, "z": 3, "cf": 1.0 } ], "ln": 10, "addr": 110 }, { "b": "lp1Kspc?PyjT8L4B8\u0026{yx(kOkvrl0$vqPN1", "ln": 11, "addr": 129 }, { "b": "lQsWma$)ztzzbHdBrQ", "ln": 12, "addr": 158 }, { "b": "oI4#LmNo{DjT8L4B8\u0026{PvRGZky?W^5w)]Z%a]", "ln": 29, "addr": 469 }, { "b": "oIN.{fjFTkfkLII", "ln": 30, "addr": 499 }, { "b": "oJa7#fjFTkfkLXN", "n": [ { "c": 2, "d": "List directory contents via /bin/ls", "i": "micro-behaviors/fs/directory/readdir::readdir-ls", "o": 516, "z": 7, "cf": 0.6600000262260437 } ], "ln": 31, "addr": 512 }, { "b": "o?N(CqAViSvRGZkzeiV@AV=@Ma]", "ln": 32, "addr": 525 }, { "b": "o\u0026:z3zfv3Nw*d", "ln": 33, "addr": 547 }, { "b": "p^[nQh9AcpB-RNRAbf8tvRGZkAaK6aa]", "n": [ { "c": 3, "d": "perl interpreter keyword (beyond shebang)", "i": "micro-behaviors/process/interpreter/perl::perl-keyword", "o": 578, "z": 4, "cf": 0.699999988079071 } ], "ln": 34, "addr": 558 }, { "b": "p!Kq=k$1Bspcx^OB-RNRB7e\u003c3fk$YtuTWFZx(k9", "ln": 35, "addr": 584 }, { "b": "p!Kq=nLR-JjT8L4B8\u0026{PvRGZkAbf8[x(mK3a]", "ln": 36, "addr": 616 }, { "b": "qCxp#fjFTkflg[N", "ln": 38, "addr": 665 }, { "b": "qCxLJqAViSvRGZkA=2u3AV$", "ln": 39, "addr": 678 }, { "b": "q:\u003c8qa$[7WAXy)ozzc6xwfI", "n": [ { "c": 2, "d": "Uses sed for text processing", "i": "well-known/tool/development/cli::sed-processing", "o": 711, "z": 3, "cf": 1.0 } ], "ln": 40, "addr": 697 }, { "b": "q:\u003cUOpf6I4flItRfjFTkfj/3Aa]", "n": [ { "c": 3, "d": "env command path", "i": "micro-behaviors/os/env/vars/access::env-cmd", "o": 724, "z": 12, "cf": 0.6000000238418579 } ], "ln": 41, "addr": 716 }, { "b": "q+f4}fjFTkflp!J", "n": [ { "c": 3, "d": "Shell command execution capability", "i": "micro-behaviors/process/create/shell/spawn::shell-execution-comp", "o": 742, "z": 7, "cf": 0.8999999761581421 } ], "ln": 42, "addr": 738 }, { "b": "q+{p\u003cjT8L4B8\u0026{yx(kOBz/P}z", "ln": 43, "addr": 751 }, { "b": "q=L$8flItRfjFTkflqmW", "ln": 44, "addr": 772 }, { "b": "2{QM\u003cwOkZ#By/FnB7/c3y\u0026Z.kzxHPzByM$BxK#0@B1N", "ln": 142, "addr": 2926 }, { "b": "2{P", "ln": 143, "addr": 2961 }, { "b": "2{:\u003c%mn)flar.\u003cVCPXQ(d]O#coIuNRD\u0026", "n": [ { "c": 2, "d": "SHELL environment variable", "i": "micro-behaviors/os/env/vars/system-info::shell-var", "o": 2981, "z": 5, "cf": 0.5 } ], "ln": 144, "addr": 2964 }, { "b": "2)\u0026jqd]O#coIuM{l{@dyDR^v9uRJ%*k$11rl0)2KqHF", "ln": 145, "addr": 2990 }, { "b": "2{:\u003c%mn)flar.\u003cVCPXQ(d]O#coIuNRD\u0026", "ln": 146, "addr": 3025 } ], "depth": 1, "facts": { "imp": [ [ "", "shift" ], [ "", "shift" ], [ "", "{PWD_CMD}" ], [ "", "{SH}" ], [ "", "{TEST}" ], [ "", "./+USERGROUP" ], [ "", "./+USERGROUP" ], [ "", "./+USERGROUP" ], [ "", "./+USERGROUP" ], [ "", "exit" ], [ "", "exit" ], [ "", "{TEST}" ], [ "", "./+DIRS" ], [ "", "./+DIRS" ], [ "", "{TEST}" ], [ "", "./+DIRS" ], [ "", "./+DIRS" ], [ "", "{TEST}" ], [ "", "./+SHLIBS" ], [ "", "./+SHLIBS" ], [ "", "{TEST}" ], [ "", "./+FILES" ], [ "", "./+FILES" ], [ "", "{TEST}" ], [ "", "./+FILES" ], [ "", "./+FILES" ], [ "", "{TEST}" ], [ "", "./+PERMS" ], [ "", "./+PERMS" ], [ "", "{TEST}" ], [ "", "./+FONTS" ], [ "", "./+FONTS" ], [ "", "{TEST}" ], [ "", "./+ICON_THEMES" ], [ "", "./+ICON_THEMES" ], [ "", "{TEST}" ], [ "", "./+DIRS" ], [ "", "./+DIRS" ], [ "", "{TEST}" ], [ "", "./+DIRS" ], [ "", "./+DIRS" ], [ "", "{TEST}" ], [ "", "./+FILES" ], [ "", "./+FILES" ], [ "", "{TEST}" ], [ "", "./+FILES" ], [ "", "./+FILES" ], [ "", "{TEST}" ], [ "", "./+SHELL" ], [ "", "./+SHELL" ], [ "", "{TEST}" ], [ "", "./+SHELL" ], [ "", "./+SHELL" ], [ "", "{TEST}" ], [ "", "./+INFO_FILES" ], [ "", "./+INFO_FILES" ], [ "", "{TEST}" ], [ "", "./+OCAML_FINDLIB_REGISTER" ], [ "", "./+OCAML_FINDLIB_REGISTER" ], [ "", "/usr/pkg/bin/mktexlsr" ], [ "", "/usr/pkg/bin/mktexlsr" ], [ "", "exit" ], [ "", "exit" ] ], "tgt": [ "${PWD_CMD}", "${SH}", "${TEST}", "./+DIRS", "./+FILES", "./+FONTS", "./+ICON_THEMES", "./+INFO_FILES", "./+OCAML_FINDLIB_REGISTER", "./+PERMS", "./+SHELL", "./+SHLIBS", "./+USERGROUP", "/usr/pkg/bin/mktexlsr", ":", "exit", "shift" ], "metrics": { "ast": { "max_depth": 9.0, "bind_count": 55.0, "call_count": 43.0, "node_count": 882.0, "identifier_count": 84.0, "string_literal_count": 53.0 }, "file": { "size": 3623.0, "entropy": 5.73, "size_bytes": 3623.0 }, "text": { "tab_count": 96.0, "digit_ratio": 0.04, "space_count": 283.0, "total_lines": 177.0, "char_entropy": 5.73, "mixed_indent": 1.0, "unique_chars": 84.0, "string_density": 0.3, "avg_line_length": 19.47, "max_line_length": 73.0, "empty_line_ratio": 0.1, "last_line_length": 6.0, "whitespace_ratio": 0.15, "most_common_ratio": 0.04, "identifier_density": 1.36, "line_length_stddev": 16.64, "normalized_string_count": 3.98, "suspicious_string_ratio": 0.02, "most_common_char_is_null": 0.0, "suspicious_comment_ratio": 0.1, "max_inline_whitespace_run": 1.0, "most_common_char_codepoint": 47.0, "normalized_unique_identifiers": 11.65 }, "binds": { "count": 55.0 }, "calls": { "count": 43.0, "dynamic_target_count": 19.0 }, "binary": { "overall_entropy": 5.73, "peak_region_bytes": 3623.0, "peak_region_entropy": 5.71 }, "strings": { "total": 53.0, "avg_length": 10.74, "max_length": 40.0, "path_count": 39.0, "avg_entropy": 2.85, "empty_count": 2.0, "total_bytes": 569.0, "entropy_stddev": 0.67, "shell_command_strings": 1.0 }, "comments": { "chars": 762.0, "lines": 18.0, "total": 42.0, "to_code_ratio": 0.11, "empty_comments": 24.0, "high_entropy_comments": 4.0 }, "identifiers": { "count": 84.0, "total": 241.0, "avg_length": 6.68, "max_length": 25.0, "min_length": 1.0, "avg_entropy": 2.24, "reuse_ratio": 0.36, "unique_count": 87.0, "length_stddev": 4.98, "has_digit_ratio": 0.06, "single_char_count": 5.0, "single_char_ratio": 0.06, "high_entropy_count": 7.0, "high_entropy_ratio": 0.08, "all_lowercase_ratio": 0.03, "all_uppercase_ratio": 0.68, "numeric_suffix_count": 1.0, "underscore_prefix_count": 1.0 } } }, "id": 3, "mol": "O(Er)H(Po₂)", "path": "/data/samples/good/foraged/netbsd/netbsd.org/_/tex-pst-node-1.45/tex-pst-node-1.45.tgz!!+INSTALL", "risk": 4, "sha": "658315c6c5e8ea72d100a3bdc079274fbd015782d9c1c421796586f8ff6bab4e", "size": 3623, "traits": [ { "id": "micro-behaviors/os/env/vars/access::env-cmd", "atk": "T1082", "conf": 0.6000000238418579, "crit": 3, "desc": "env command path", "spans": [ [ 724, 12 ] ] }, { "id": "micro-behaviors/process/create/shell/spawn::bin-sh", "atk": "T1059.004", "mbc": "E1059.004", "conf": 0.6000000238418579, "crit": 3, "desc": "References /bin/sh (Bourne shell)", "spans": [ [ 742, 7 ] ] }, { "id": "objectives/evasion/masquerade/extension/shebang::bash-shebang-first-line", "atk": "T1036.008", "mbc": "F0008", "conf": 0.949999988079071, "crit": 3, "desc": "File starts with", "spans": [ [ 0, 9 ] ] }, { "id": "micro-behaviors/process/interpreter/perl::perl-keyword", "conf": 0.699999988079071, "crit": 3, "desc": "perl interpreter keyword (beyond shebang)", "spans": [ [ 578, 4 ] ] }, { "id": "micro-behaviors/process/create/shell/spawn::sh-dynamic-command-target", "conf": 0.6000000238418579, "crit": 3, "desc": "Shell command name from variable", "spans": [ [ 0, 34 ] ] }, { "id": "micro-behaviors/process/create/shell/spawn::shell-symbols", "conf": 0.8999999761581421, "crit": 3, "desc": "Shell execution symbols", "spans": [ [ 0, 34 ], [ 742, 7 ] ] } ], "type": "shell" }, { "ctx": [ { "b": "b{r", "n": [ { "c": 2, "d": "Script overall entropy stays low", "i": "metadata/file/metrics::low-overall-entropy-source", "o": 0, "z": 29, "cf": 0.8999999761581421 } ], "ln": 1, "addr": 0 }, { "b": "b{jE8wi7\u0026LB960Kz!9Ath.G5\u0026zY*\u003e)i3o$ggbpBnf!CgoatC/og=mrHhD?kpwPzl\u003eA=-AH", "ln": 2, "addr": 3 }, { "b": "b{l35B97t\u003cA+PGmaAhvty\u0026r%ewGUP6AV/sxBs?xGwmWxnwQ2*", "ln": 3, "addr": 60 }, { "b": "b{kM}wNPW(wfrP!iwSrAfekjmax9i3A:@V6w[=6)aA}mnaAhyzePbGqwIdIiv/", "n": [ { "c": 1, "d": "Source/test target word", "i": "objectives/impact/destroy/keywords::target-source-test", "o": 121, "z": 11, "cf": 0.8799999952316284 } ], "ln": 4, "addr": 100 }, { "b": "b{ll1A=U@kzxHR=iwU7{auqkhfF+vpga\u0026", "ln": 5, "addr": 150 }, { "b": "b{kV}AV/HCwGVhhBz8^{z!\u003c5%yIteqay]UfAc0S", "ln": 6, "addr": 177 } ], "depth": 1, "facts": { "mbr": [ "dvips.tx", "node.doc", "node.tex", "node.tex.Created", "node97.pro" ], "metrics": { "ast": { "op.div": 97.0, "op.mod": 3.0, "op.sub": 15.0, "op.land": 1.0, "max_depth": 17.0, "call_count": 0.0, "node_count": 2189.0, "member_count": 5.0, "op_density.div": 0.04, "op_density.mod": 0.0, "op_density.sub": 0.01, "op_density.land": 0.0, "identifier_count": 176.0, "member_depth_max": 3.0, "self_compare_count": 1.0, "array_literal_max_length": 3.0 }, "file": { "size": 6488.0, "entropy": 4.83, "size_bytes": 6488.0 }, "text": { "digit_ratio": 0.09, "space_count": 1413.0, "total_lines": 107.0, "char_entropy": 4.83, "unique_chars": 71.0, "avg_line_length": 59.64, "max_line_length": 73.0, "last_line_length": 3.0, "whitespace_ratio": 0.23, "most_common_ratio": 0.07, "identifier_density": 11.07, "line_length_stddev": 19.9, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 2.0, "most_common_char_codepoint": 101.0, "suspicious_identifier_ratio": 0.14, "normalized_unique_identifiers": 26.11 }, "binary": { "overall_entropy": 4.83, "peak_region_bytes": 6488.0, "peak_region_entropy": 4.8 }, "members": { "count": 5.0 }, "consistency": { "extension_content_mismatch": 1.0, "extension_content_mismatch.script_as_unknown": 1.0 }, "identifiers": { "count": 176.0, "total": 1184.0, "avg_length": 4.68, "max_length": 14.0, "min_length": 1.0, "avg_entropy": 1.83, "reuse_ratio": 0.15, "unique_count": 176.0, "length_stddev": 2.7, "has_digit_ratio": 0.1, "sequential_names": 24.0, "single_char_count": 16.0, "single_char_ratio": 0.09, "all_lowercase_ratio": 0.5, "all_uppercase_ratio": 0.05, "numeric_suffix_count": 9.0 } } }, "id": 4, "path": "/data/samples/good/foraged/netbsd/netbsd.org/_/tex-pst-node-1.45/tex-pst-node-1.45.tgz!!share/texmf-dist/dvips/pst-node/pst-node97.pro", "risk": 1, "sha": "f131898b91c911154e2a2705f24f5fe76758c0dd4c5256a8f1e6f7476a0b842d", "size": 6488, "traits": [ { "id": "metadata/file/metrics::file-has-30-plus-lines", "conf": 0.8999999761581421, "crit": 1, "desc": "File has 30 or more lines", "spans": [ [ 0, 25 ] ] }, { "id": "metadata/file/metrics::low-overall-entropy-source", "conf": 0.8999999761581421, "crit": 2, "desc": "Script overall entropy stays low", "spans": [ [ 0, 29 ] ] }, { "id": "metadata/file/profile/identity::sequential-identifiers", "conf": 0.800000011920929, "crit": 2, "desc": "Sequential source identifier names", "spans": [ [ 0, 36 ] ] } ], "type": "python" }, { "ctx": [ { "b": "b{jE8wi7\u0026LB960Kz!9AiAb]\u003etiwAJpgb7EueIGanf!:.8i65\u0026IiX\u0026S$azttbvR6O4as3", "n": [ { "c": 2, "d": "Script overall entropy stays low", "i": "metadata/file/metrics::low-overall-entropy-source", "o": 0, "z": 29, "cf": 0.8999999761581421 } ], "ln": 1, "addr": 0 }, { "b": "b{-", "ln": 2, "addr": 55 }, { "b": "b{:Wgz/Z20v@=p5BrCKyz!%u8B.8Xcz/M$tB960Kz!9AiBy/XH", "ln": 3, "addr": 58 }, { "b": "b{-", "ln": 5, "addr": 129 }, { "b": "b{:WkxLzJgAb](fA:-/cv{%l$vR3W5wN]H@BAh88B-.h9ayPd#fk\u003e\u003eNzeS%0w[+*!aA.NjwPw]nxK@rdwPzTe", "ln": 6, "addr": 132 }, { "b": "b{:WLw/#hewGTVPraPeOp\u0026ZF?wN/*8p\u003c3k-x\u003e5nVx\u003e7Z(B7DEZx(!xpx\u003c#jbwN(]}A=k!qlSuuDayPq2xLzT3A@", "n": [ { "c": 1, "d": "Project/workspace target word", "i": "objectives/impact/destroy/keywords::target-project", "o": 217, "z": 7, "cf": 0.8600000143051147 } ], "ln": 7, "addr": 201 }, { "b": "b{:WFzxJF7A+e:5z/QaCzdc{{z/WNFvru79fjFvhwIm\u003esAbmdGCYUL", "ln": 8, "addr": 271 }, { "b": "b(", "ln": 9, "addr": 315 } ], "depth": 1, "facts": { "mbr": [ "lppl.txt", "lppl.txt.EMPTY", "node.pro", "node.tex", "node.tex.Version" ], "metrics": { "ast": { "op.div": 308.0, "op.mod": 68.0, "op.sub": 16.0, "max_depth": 117.0, "call_count": 0.0, "node_count": 5461.0, "member_count": 5.0, "op_density.div": 0.06, "op_density.mod": 0.01, "op_density.sub": 0.0, "identifier_count": 314.0, "member_depth_max": 3.0, "self_compare_count": 7.0, "array_literal_max_length": 3.0 }, "file": { "size": 16951.0, "entropy": 4.66, "size_bytes": 16951.0 }, "text": { "tab_count": 24.0, "digit_ratio": 0.06, "space_count": 4670.0, "total_lines": 610.0, "char_entropy": 4.66, "unique_chars": 78.0, "avg_line_length": 26.79, "max_line_length": 78.0, "last_line_length": 18.0, "whitespace_ratio": 0.31, "most_common_ratio": 0.06, "identifier_density": 4.39, "line_length_stddev": 19.73, "repeated_char_sequences": 6.0, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 21.0, "trailing_whitespace_lines": 372.0, "most_common_char_codepoint": 101.0, "suspicious_identifier_ratio": 0.1, "normalized_unique_identifiers": 33.94 }, "binary": { "overall_entropy": 4.66, "peak_region_bytes": 14336.0, "peak_region_entropy": 4.83 }, "members": { "count": 5.0 }, "consistency": { "extension_content_mismatch": 1.0, "extension_content_mismatch.script_as_unknown": 1.0 }, "identifiers": { "count": 314.0, "total": 2676.0, "avg_length": 5.05, "max_length": 14.0, "min_length": 1.0, "avg_entropy": 1.94, "reuse_ratio": 0.12, "unique_count": 314.0, "length_stddev": 2.9, "has_digit_ratio": 0.08, "sequential_names": 30.0, "single_char_count": 20.0, "single_char_ratio": 0.06, "all_lowercase_ratio": 0.49, "all_uppercase_ratio": 0.05, "numeric_suffix_count": 26.0 } } }, "id": 5, "path": "/data/samples/good/foraged/netbsd/netbsd.org/_/tex-pst-node-1.45/tex-pst-node-1.45.tgz!!share/texmf-dist/dvips/pst-node/pst-node.pro", "risk": 1, "sha": "1a58bbbcc056e0b2d9798ad91cbf815b02a465938b45e224056750c82d9e3deb", "size": 16951, "traits": [ { "id": "metadata/file/metrics::file-has-30-plus-lines", "conf": 0.8999999761581421, "crit": 1, "desc": "File has 30 or more lines", "spans": [ [ 0, 25 ] ] }, { "id": "metadata/file/metrics::low-overall-entropy-source", "conf": 0.8999999761581421, "crit": 2, "desc": "Script overall entropy stays low", "spans": [ [ 0, 29 ] ] }, { "id": "metadata/file/profile/identity::sequential-identifiers", "conf": 0.800000011920929, "crit": 2, "desc": "Sequential source identifier names", "spans": [ [ 0, 36 ] ] } ], "type": "python" }, { "id": 6, "sha": "c76df8f2735bab808dd060dd8bde26998005dd75c867f7bbee626727dd360cbd", "path": "/data/samples/good/foraged/netbsd/netbsd.org/_/tex-pst-node-1.45/tex-pst-node-1.45.tgz!!+DESC", "size": 490, "type": "kotlin", "depth": 1 }, { "id": 7, "sha": "33d4d4301eab0d9c3bbf454479dd12eaeeff10fd90be8253c1a853bebb1a7390", "path": "/data/samples/good/foraged/netbsd/netbsd.org/_/tex-pst-node-1.45/tex-pst-node-1.45.tgz!!share/texmf-dist/tex/latex/pst-node/pst-node.sty", "size": 1483, "type": "kotlin", "depth": 1 } ], "omitted_files": 2, "rev": "46112", "v": "8" } }