{ "ml": { "v": "7", "eng": "2.2.0-beta.1", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.00007145604, "rte": "az", "prob": 0.00007145604 } ], "prob": 0.00007145604, "skip": [ { "rte": "az/tar", "why": "unavailable" }, { "rte": "az/tar", "why": "unavailable" } ], "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.00007145603740355, "type": "tar.gz" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.000043700139940483496, "type": "shell" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.000010768572792585474, "type": "srcinfo" } ], "version": "v18.18", "analyzed_at": "2026-06-24T14:05:47Z" }, "path": "parakeet.cpp-vulkan-bin-release-git-0.3.2-1.src.tar.gz", "raw": { "files": [ { "id": 0, "ctx": [ { "b": "abZy80000000zQ?)[.W$80kS9sg*1N1(mP-x{m04wFg+Or$c0#z66q0Ijl%]nO6#W4eN-@", "n": [ { "c": 2, "d": "Archive parser reported errors", "i": "metadata/file/metrics::archive-parse-error", "o": 0, "z": 24, "cf": 0.8999999761581421 } ], "ln": 0 } ], "mol": "H₂(Cm₂Db)Md(Bk)", "sha": "ce1ce3e9d7990d35188414e30f8eeb9cea09139d0f8eee23e2c1ce1b7ed177f8", "path": "parakeet.cpp-vulkan-bin-release-git-0.3.2-1.src.tar.gz", "risk": 3, "size": 1229, "type": "tar.gz", "facts": { "metrics": { "file": { "size": 1229.0, "entropy": 7.82, "size_bytes": 1229.0 }, "parse": { "error_count": 1.0 }, "binary": { "overall_entropy": 7.82, "peak_region_bytes": 1024.0, "peak_region_entropy": 7.8 } } }, "traits": [ { "id": "micro-behaviors/communications/http/download/curl::curl-silent", "atk": "T1105", "conf": 0.800000011920929, "crit": 3, "desc": "curl silent flags", "from": [ { "file": 1 } ] }, { "id": "objectives/impact/destroy/keywords::cleanup-verb--clean", "conf": 0.8799999952316284, "crit": 1, "desc": "Cleanup/action word: clean", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/http/download/curl::curl-output-file", "atk": "T1105", "conf": 0.699999988079071, "crit": 3, "desc": "curl download to file", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/http/download/cli::fetch-output-flag-script", "conf": 0.8500000238418579, "crit": 3, "desc": "curl/wget output file option in script", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/archive/extract/tar::tar-gzip-extract", "atk": "T1560.001", "conf": 0.8399999737739563, "crit": 3, "desc": "tar gzip extraction command usage", "from": [ { "file": 1 } ] }, { "id": "metadata/build/package::pkgbuild-checksum-skip", "conf": 0.699999988079071, "crit": 3, "desc": "PKGBUILD skips source checksum verification", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/http/download/curl::curl-cmd", "atk": "T1105", "conf": 0.699999988079071, "crit": 3, "desc": "curl command", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/archive/extract/tar::tar-extract", "atk": "T1560.001", "conf": 0.7799999713897705, "crit": 3, "desc": "tar extraction command usage", "from": [ { "file": 1 } ] } ] }, { "ctx": [ { "b": "boPY?x(n33x(mH5iV}yuz6hwTy?j.KBz(1svrrS9vqGG$wn=MjwO14", "n": [ { "c": 2, "d": "Arch PKGBUILD package recipe basename", "i": "metadata/file/string/identity::pkgbuild-basename", "o": 0, "z": 8, "cf": 1.0 } ], "ln": 1, "addr": 0 }, { "b": "boR5vwO=f)xK$W?aAIjcy?#mzvrl98wnc9[vR/Qsq:Sq]gC*TYlOZwNg+qM)gbgWzarR)KC42zlB-8tywN(]paA?glaz#atayPtjx\u003eIr{wfrJFv}lZax([3bB-X:ND)00Bx(\u003c", "ln": 2, "addr": 44 }, { "b": "", "ln": 3, "addr": 151 }, { "b": "Abf8%wPIuAcQ}J=BrCHteO5Box\u003e7Y%k#QV7B-Rnmxco@InKMcoaw=G!vqxB=BrCBswmYN#aA?Ecazkt7y-\u003ecBA+eZ5x(4(lr=@j]vqWh%x(mv1C}p7Ovru74BrB7/BrCQny?m3@wHO#", "ln": 7, "addr": 218 }, { "b": "vrb\u003c\u003ejT.X5i5Ub4g::Z", "ln": 8, "addr": 330 }, { "b": "B-IpYcUNQzAc15[fk20vxMW=pv@Diqzfox9wPxCyvrb^(wO2%ov@Mxm", "n": [ { "c": 2, "d": "HTTPS protocol prefix", "i": "micro-behaviors/communications/http/message::https-prefix", "o": 351, "z": 8, "cf": 0.8999999761581421 } ], "ln": 9, "addr": 346 }, { "b": "y?Wx\u003czGxwLc)}.Xr3%9", "ln": 10, "addr": 391 }, { "b": "wmYZ\u003ezE^/Kc)%gXy?)D%eOOZ9eO]ulwmY^edf", "ln": 11, "addr": 407 }, { "b": "zddi\u003ewmYZ\u003ezE^/Kc)@UwBsegUv%8*dcN/", "n": [ { "c": 3, "d": "Send functions or download tools", "i": "objectives/command-and-control/botnet/iot::send-or-download", "o": 457, "z": 4, "cf": 0.30000001192092896 } ], "ln": 12, "addr": 437 }, { "b": "Ab](ux\u003eg^@jT.W%vrb^(wO2%ov@Mxmdf", "ln": 13, "addr": 464 }, { "b": "v@Dl%y?Wy3B3g{0Aa9=}yH}70e[n\u003ctcM\u003c^Qvrb^(wO2%ov@Mxsxk8DnaszbpA:--{wPPLmAbWyrx(kpvcVAHmvqxB=Bs}6xA4M9wy?m3@wI4LeBseH", "ln": 14, "addr": 490 }, { "b": "B8Mhwv}v!Ka%.IOyIdJ[zdObRi+JeGd\u003cPE:A+{dRxk8Didf", "ln": 15, "addr": 582 }, { "b": "B7!#qh8YI#zf4\u0026*cSrVfp:WW", "n": [ { "c": 3, "d": "PKGBUILD skips source checksum verification", "i": "metadata/build/package::pkgbuild-checksum-skip", "o": 620, "z": 17, "cf": 0.699999988079071 } ], "ln": 16, "addr": 620 }, { "b": "", "ln": 17, "addr": 640 }, { "b": "Abf9fwPxgFaBs", "ln": 18, "addr": 641 }, { "b": "arUf8ar\u00267TB8\u003e=3x(XRPbZTGCxkRc{wQL:", "ln": 19, "addr": 652 }, { "b": "arR)KqE%VQvrl05Byw/8z/fxpj0n0DzEENhayPq2xLzT3axqrkazC)twmY^}C4Chbw].*baARphB0a$ewNPE0C4CYnx(v(w", "n": [ { "c": 1, "d": "Cleanup/action word: clean", "i": "objectives/impact/destroy/keywords::cleanup-verb--clean", "o": 742, "z": 5, "cf": 0.8799999952316284 } ], "ln": 20, "addr": 680 }, { "b": "arUrhBrCa9B7ol8vR3VleP+AlB094^vpAX^wP*i\u003catMblwmY{qzGP=iaBCqMwN(]hB1Z\u003cyfe1W", "n": [ { "c": 2, "d": "Output/error suppression", "i": "micro-behaviors/os/console/io::output-suppression", "o": 791, "z": 10, "cf": 1.0 } ], "ln": 21, "addr": 757 }, { "b": "Ee", "ln": 22, "addr": 817 }, { "b": "", "ln": 23, "addr": 819 }, { "b": "arR)KpJgz\u0026z/cW=iV})CzEENhayPtjwPP5bwPRA}wN(]]D2v5cx\u003e7N/y\u003cw8+xk8DgB8Mhwv}u=%B0bysy\u003cvdnz/M$zwPz\u003caz/cXtA:-D[x(mMo", "ln": 29, "addr": 993 }, { "b": "arUGsv{%f@uV{13jT8d#Abf9fwPAhy", "ln": 30, "addr": 1082 }, { "b": "arUGsv{%f@uTW$+xLzT3jTa\u0026NA:--{wPPIEbZS)wwPAhJvRGZiy?W^fCRa8Yy?)D%eQffge{7Jxe[YFO", "n": [ { "c": 1, "d": "Regex component marker", "i": "objectives/command-and-control/dropper/delivery/fetch-exec::arch-args-misc--rx-25", "o": 1160, "z": 3, "cf": 0.949999988079071 } ], "ln": 31, "addr": 1107 }, { "b": "arUGsv{%f@uU0$}A+)(.bZTVOy\u003c^%SwO+{^B7GzCwn=Wfy\u0026r-)flOQ/uV{13Ej(\u003c)uTW$+xLzT3EiF", "ln": 32, "addr": 1172 }, { "b": "arUfpA+(\u003cIw\u003eTr\u003ebZS)ey\u0026%=mEiG^=zY*kHDVKjqwnc7jfc\u003e)Kvrb\u003c\u003ex)a6oa]", "n": [ { "c": 3, "d": "curl/wget output file option in script", "i": "micro-behaviors/communications/http/download/cli::fetch-output-flag-script", "o": 1237, "z": 24, "cf": 0.8500000238418579 } ], "ln": 33, "addr": 1235 }, { "b": "arU=mAV=@UDs!ozbZTPMv}op]Ej(\u003c)uTW$+xLzT3EiG^=lM^M#DVKjqwnc7ja]", "n": [ { "c": 3, "d": "tar gzip extraction command usage", "i": "micro-behaviors/data/archive/extract/tar::tar-gzip-extract", "o": 1287, "z": 32, "cf": 0.8399999737739563 } ], "ln": 34, "addr": 1285 }, { "b": "Ee", "ln": 35, "addr": 1335 }, { "b": "", "ln": 36, "addr": 1337 } ], "depth": 1, "facts": { "imp": [ [ "", "cd" ], [ "", "cd" ], [ "", "git" ], [ "", "git" ], [ "", "sed" ], [ "", "sed" ], [ "", "cd" ], [ "", "cd" ], [ "", "git" ], [ "", "git" ], [ "", "git" ], [ "", "git" ], [ "", "curl" ], [ "", "curl" ], [ "", "tar" ], [ "", "tar" ], [ "", "install" ], [ "", "install" ], [ "", "install" ], [ "", "install" ], [ "", "install" ], [ "", "install" ] ], "tgt": [ "cd", "curl", "git", "install", "sed", "tar" ], "metrics": { "ast": { "max_depth": 8.0, "bind_count": 17.0, "call_count": 11.0, "node_count": 368.0, "identifier_count": 41.0, "string_literal_count": 32.0, "array_literal_max_length": 4.0 }, "file": { "size": 1708.0, "entropy": 5.27, "size_bytes": 1708.0 }, "text": { "digit_ratio": 0.03, "space_count": 153.0, "total_lines": 44.0, "char_entropy": 5.27, "unique_chars": 76.0, "string_density": 0.73, "avg_line_length": 37.84, "max_line_length": 111.0, "empty_line_ratio": 0.14, "last_line_length": 35.0, "whitespace_ratio": 0.11, "most_common_ratio": 0.07, "identifier_density": 1.98, "line_length_stddev": 32.42, "normalized_string_count": 4.82, "suspicious_string_ratio": 0.03, "most_common_char_is_null": 0.0, "suspicious_comment_ratio": 0.33, "max_inline_whitespace_run": 2.0, "most_common_char_codepoint": 101.0, "normalized_unique_identifiers": 7.51 }, "binds": { "count": 17.0 }, "calls": { "count": 11.0 }, "binary": { "overall_entropy": 5.27, "peak_region_bytes": 1708.0, "peak_region_entropy": 5.19 }, "source": { "function_count": 3.0 }, "strings": { "total": 32.0, "url_count": 1.0, "avg_length": 23.5, "max_length": 101.0, "path_count": 1.0, "avg_entropy": 3.43, "total_bytes": 752.0, "entropy_stddev": 0.89, "shell_command_strings": 1.0 }, "comments": { "chars": 412.0, "lines": 6.0, "total": 6.0, "to_code_ratio": 0.16, "base64_in_comments": 1.0, "high_entropy_comments": 1.0 }, "functions": { "count": 3.0, "avg_params": 5.33, "max_params": 9.0, "length_stddev": 3.09, "avg_name_length": 6.67, "avg_length_lines": 7.67, "max_length_lines": 12.0, "min_length_lines": 5.0, "many_params_count": 1.0, "avg_param_name_length": 33.5, "density_per_100_lines": 6.82, "code_in_functions_ratio": 0.52 }, "identifiers": { "count": 41.0, "total": 87.0, "avg_length": 6.61, "max_length": 35.0, "min_length": 2.0, "avg_entropy": 2.28, "reuse_ratio": 0.47, "unique_count": 41.0, "length_stddev": 5.02, "has_digit_ratio": 0.12, "high_entropy_count": 1.0, "high_entropy_ratio": 0.02, "all_lowercase_ratio": 0.68, "numeric_suffix_count": 3.0, "underscore_prefix_count": 4.0 } } }, "id": 1, "mol": "H₂(Cm₂Db)Md(Bk)", "path": "parakeet.cpp-vulkan-bin-release-git-0.3.2-1.src.tar.gz!!parakeet.cpp-vulkan-bin-release-git/PKGBUILD", "risk": 3, "sha": "9e8dbdc2d8217e2a7bf1f28a43b428af6be6f0b3183db0db307b2c8886f9d09a", "size": 1708, "traits": [ { "id": "micro-behaviors/data/archive/extract/tar::tar-gzip-extract", "atk": "T1560.001", "conf": 0.8399999737739563, "crit": 3, "desc": "tar gzip extraction command usage", "spans": [ [ 1287, 32 ] ] }, { "id": "micro-behaviors/communications/http/download/curl::curl-output-file", "atk": "T1105", "conf": 0.699999988079071, "crit": 3, "desc": "curl download to file", "spans": [ [ 1237, 23 ] ] }, { "id": "micro-behaviors/data/archive/extract/tar::tar-extract", "atk": "T1560.001", "conf": 0.7799999713897705, "crit": 3, "desc": "tar extraction command usage", "spans": [ [ 1287, 32 ] ] }, { "id": "micro-behaviors/communications/http/download/curl::curl-silent", "atk": "T1105", "conf": 0.800000011920929, "crit": 3, "desc": "curl silent flags", "spans": [ [ 1237, 8 ] ] }, { "id": "metadata/build/package::pkgbuild-checksum-skip", "conf": 0.699999988079071, "crit": 3, "desc": "PKGBUILD skips source checksum verification", "spans": [ [ 620, 17 ] ] }, { "id": "micro-behaviors/communications/http/download/cli::fetch-output-flag-script", "conf": 0.8500000238418579, "crit": 3, "desc": "curl/wget output file option in script", "spans": [ [ 1237, 24 ] ] }, { "id": "objectives/impact/destroy/keywords::cleanup-verb--clean", "conf": 0.8799999952316284, "crit": 1, "desc": "Cleanup/action word: clean", "spans": [ [ 742, 5 ] ] }, { "id": "micro-behaviors/communications/http/download/curl::curl-cmd", "atk": "T1105", "conf": 0.699999988079071, "crit": 3, "desc": "curl command", "spans": [ [ 1236, 6 ] ] } ], "type": "shell" }, { "depth": 1, "facts": { "metrics": { "file": { "size": 640.0, "entropy": 4.86, "size_bytes": 640.0 }, "binary": { "overall_entropy": 4.86, "peak_region_bytes": 640.0, "peak_region_entropy": 4.86 } } }, "id": 2, "path": "parakeet.cpp-vulkan-bin-release-git-0.3.2-1.src.tar.gz!!parakeet.cpp-vulkan-bin-release-git/.SRCINFO", "refs": [ { "to": "pkg:alpm/arch/vulkan-icd-loader", "off": 313, "kind": "dependency" }, { "to": "pkg:alpm/arch/git", "off": 42, "kind": "dependency" }, { "to": "pkg:alpm/arch/curl", "off": 297, "kind": "dependency" }, { "to": "pkg:github/mudler/parakeet.cpp", "off": 490, "kind": "dependency" } ], "sha": "19c68209432562897af8ca95331d951705514bda4019af6f439c46c6bea0ae13", "size": 640, "type": "srcinfo" } ], "rev": "33de0", "v": "8" } }