{
  "llm": {
    "conf": 0.8,
    "grade": "suspicious",
    "model": "Qwen/Qwen3.6-27B",
    "review": true,
    "outcome": "suspicious",
    "interpretation": "External executable download via script"
  },
  "ml": {
    "v": "7",
    "eng": "2.1.0",
    "lvl": 250,
    "conf": 80,
    "mods": [
      {
        "cls": 0,
        "raw": 0.21812682,
        "rte": "az",
        "prob": 0.21812682
      }
    ],
    "prob": 0.8,
    "files": [
      {
        "id": 0,
        "lvl": 250,
        "conf": 80,
        "prob": 0.800000011920929,
        "type": "nupkg"
      },
      {
        "id": 1,
        "lvl": -1,
        "conf": 0,
        "prob": 0.00004763404649565928,
        "type": "xml"
      },
      {
        "id": 2,
        "lvl": -1,
        "conf": 0,
        "prob": 0.00007574757182737812,
        "type": "powershell"
      },
      {
        "id": 3,
        "lvl": -1,
        "conf": 0,
        "prob": 0.000010440747246320825,
        "type": "xml"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-06-24T04:36:07Z"
  },
  "path": "angry-birds-star-wars.nupkg",
  "raw": {
    "files": [
      {
        "id": 0,
        "ctx": [
          {
            "b": "p!H([3ig5a008}ro?@cKWrIDF008\u0026@000xb8#%t^wO=Ave]\u003eJtB0dg]04sGO000000000000",
            "ln": 0
          }
        ],
        "mol": "O(C)H₂(CmPo₂)",
        "sha": "d46f13877e0a34fd1e9d9f8bb3fb0f17879c37f18e52928ad9c14eb2531f2060",
        "path": "angry-birds-star-wars.nupkg",
        "risk": 4,
        "size": 6321,
        "type": "nupkg",
        "facts": {
          "metrics": {
            "file": {
              "size": 6321.0,
              "entropy": 6.88,
              "size_bytes": 6321.0
            },
            "binary": {
              "overall_entropy": 6.88
            },
            "archive": {
              "file_count": 6.0,
              "member_count": 6.0,
              "script_count": 1.0,
              "zip_bomb_ratio": 2.19,
              "directory_count": 0.0,
              "executable_count": 0.0,
              "extra_field_size": 0.0,
              "noise_file_count": 0.0,
              "total_compressed": 5301.0,
              "compression.ratio": 0.71,
              "hidden_file_count": 1.0,
              "total_uncompressed": 7454.0,
              "crc_collision_count": 0.0,
              "entry_comment_count": 0.0,
              "max_filename_length": 81.0,
              "rtlo_filename_count": 0.0,
              "format.regular_count": 6.0,
              "nested_archive_count": 0.0,
              "path_traversal_count": 0.0,
              "symlink_escape_count": 0.0,
              "security.setgid_count": 0.0,
              "security.setuid_count": 0.0,
              "security.sticky_count": 0.0,
              "double_extension_count": 0.0,
              "duplicate_member_count": 0.0,
              "security.symlink_count": 0.0,
              "unicode_filename_count": 0.0,
              "homoglyph_filename_count": 0.0,
              "security.encrypted_count": 0.0,
              "timing.mtime_unique_count": 1.0,
              "timing.mtime_unique_ratio": 0.17,
              "misplaced_executable_count": 0.0,
              "timing.mtime_dominant_count": 6.0,
              "timing.mtime_spread_seconds": 0.0,
              "timing.sentinel_mtime_count": 0.0,
              "security.world_writable_count": 0.0,
              "timing.mtime_dominant_fraction": 1.0,
              "compression.method_counts.stored": 3.0,
              "compression.method_counts.deflate": 3.0
            }
          }
        },
        "ident": {
          "name": {
            "value": "Angry Birds Star Wars (Install)",
            "source": "nupkg.title",
            "verified": false
          },
          "urls": [
            {
              "url": "https://games.lol/angry-birds-star-wars/",
              "kind": "homepage",
              "source": "nupkg.project_url"
            }
          ],
          "trust": "unsigned",
          "authors": [
            {
              "name": "Rovio",
              "role": "author",
              "source": "nupkg.authors"
            },
            {
              "name": "bcurran3",
              "role": "owner",
              "source": "nupkg.owners"
            }
          ],
          "version": {
            "value": "0.38.6.0",
            "source": "nupkg.version",
            "verified": false
          },
          "identifier": {
            "value": "angry-birds-star-wars",
            "source": "nupkg.id",
            "verified": false
          }
        },
        "traits": [
          {
            "id": "micro-behaviors/os/env/vars/user-info::userprofile-var",
            "crit": 3,
            "desc": "USERPROFILE environment variable",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/lib/invoke-webrequest::uri-literal",
            "atk": "T1071.001",
            "mbc": "C0002",
            "conf": 0.75,
            "crit": 3,
            "desc": "HTTP/HTTPS URL literal",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "micro-behaviors/process/create/exec::start-process-dup",
            "conf": 0.8999999761581421,
            "crit": 3,
            "desc": "Uses Start-Process cmdlet",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/path/extension::exe-dup",
            "crit": 2,
            "desc": ".exe extension reference",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "micro-behaviors/process/create/start-process::start-process-dup",
            "conf": 0.800000011920929,
            "crit": 3,
            "desc": "Start-Process call",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "objectives/command-and-control/backdoor/loader/archive::staged-loader-six-files",
            "conf": 0.949999988079071,
            "crit": 3,
            "desc": "Staged loader six file archive",
            "spans": [
              [
                0,
                25
              ]
            ]
          }
        ]
      },
      {
        "ctx": [
          {
            "b": "ju[7cy-)[jA=U@kzAPf#e?!Flj}d",
            "ln": 1,
            "addr": 0
          },
          {
            "b": "jAa.syHH\u003c!aB4:tzGv@+xMOuniXJdcv}YB\u003cvrj5rx\u003e8g4B8LVje[n*pfk$ufyHH\u003c\u0026zF7QTfFLmmfGgU5B-RIkv\u003eJ1EwfKhD",
            "ln": 2,
            "addr": 23
          },
          {
            "b": "arS^-wPRu\u003evrt{w4f",
            "ln": 3,
            "addr": 100
          },
          {
            "b": "arR^HjAL1AB3sR.C4\u003e\u003eqvqYZ#C{3NgA+6klB97\u0026haA}mmB0bsrvRGy^vqPM#xjkT*B0bvsBAqejwO#PLflySnB3p3",
            "ln": 39,
            "addr": 2325
          },
          {
            "b": "arR^HjAa.syHH\u003c!q/u/0v}wUXy^8JOBz#pZfe3%LBzb/ae[n*pfjFBlA=LPagCqaez!0Z4vru7ap*)\u003cHvp%d)flzkCwIm[eB97#lfjw:hA^olCx(W:9ePV2xAXhGzA=Tt@Aa9l(vp%dIz/{8gwMr+!j}d",
            "ln": 40,
            "addr": 2397
          },
          {
            "b": "arR^Hjy\u00262xwO#3\u0026zEWx(B3p3",
            "ln": 41,
            "addr": 2520
          },
          {
            "b": "arR^HarS^SwPhi#wmYT*C{3*ijTarSBz\u003e\u0026hBzCDka%nK54f",
            "ln": 42,
            "addr": 2540
          },
          {
            "b": "arR^HarS^SwPhi#wmYT*C{3*ijTaxHz!0Z4vru7aeP2iyv\u003ezw9y\u0026A%aB1R3GBy/uhx(v(kaA?spB7]MgjT8NjfFka8atk[/",
            "ln": 43,
            "addr": 2578
          }
        ],
        "depth": 1,
        "facts": {
          "metrics": {
            "file": {
              "size": 2738.0,
              "entropy": 5.09,
              "size_bytes": 2738.0
            },
            "binary": {
              "overall_entropy": 5.09
            }
          }
        },
        "id": 1,
        "path": "angry-birds-star-wars.nupkg!!angry-birds-star-wars.nuspec",
        "risk": 1,
        "sha": "d88eabed9550d3b74866c57aa6852b6c0f0d6f6b2bdd27ecebbb671ba40d5268",
        "size": 2738,
        "traits": [
          {
            "id": "metadata/build/manifest::nuspec-file",
            "conf": 0.9800000190734863,
            "crit": 2,
            "desc": "NuGet nuspec manifest file",
            "spans": [
              [
                0,
                28
              ]
            ]
          },
          {
            "id": "metadata/package/files/nuget::nuspec-dependencies",
            "conf": 0.8999999761581421,
            "crit": 2,
            "desc": "NuGet package declares dependencies",
            "spans": [
              [
                2524,
                148
              ]
            ]
          }
        ],
        "type": "xml"
      },
      {
        "ctx": [
          {
            "b": "[4lsWmriA!AZshSx(v(=A+e\u0026]A+fb#wGTbUcStb9A3(7",
            "ln": 1,
            "addr": 0
          },
          {
            "b": "bY)%yy\u0026-0UAV=FEarR^HjS\u003e{]c@U83x(\u003e}6vruf9ePtcswO#PjbU-LQzGY@dvruj4zz1UelVl*UvqYQdl$G$AzFsibz/d0F4f",
            "ln": 2,
            "addr": 36
          },
          {
            "b": "bZ1czarR^HarR^HarR^HjS(a=BAzFyiXJc%f)CZ1zFRo!gi2c*wg?wdz/]P5A=k\u0026qe]ClxfkkrBByx04wPxClz/4aEz*2\u0026ke[5TgA^qbdA+6ljByxilvrcAwvpTBix\u003c\u003e%ll2HsQD0-)LA+6k#q/(C*uSQVRB1I3kzdN^8z!}4qCX5li",
            "ln": 3,
            "addr": 114
          },
          {
            "b": "bX7I0v@3ddz6f@zarR^HjS(ajh:PFZlQ\u003cK4gEiYPhzu%wh:Gw(mMAp\u003ei7bR\u003ch8[2)hA0\u0026\u003ci5\u0026]RmNPJ%ml0gWlpi:[iwJJEg=46Fiw\u003chL4f",
            "ln": 4,
            "addr": 255
          },
          {
            "b": "bW\u003ew4mr\u0026w^arR^HarR^HjS(arB-.K)z/!S-C{:4",
            "ln": 5,
            "addr": 341
          },
          {
            "b": "arU-zw]@l9A+e0OzdK?jjS(aDz^)AJvqPN64f",
            "ln": 14,
            "addr": 592
          },
          {
            "b": "arUfcwN/H%B.@lzarR^HjS(1WxK$W?B9hse",
            "ln": 15,
            "addr": 622
          },
          {
            "b": "arUfcwN/H%B.$96AaHdmjS(a[xKJUNhyxQR",
            "ln": 16,
            "addr": 651
          },
          {
            "b": "Egl",
            "ln": 17,
            "addr": 680
          },
          {
            "b": "4f",
            "ln": 18,
            "addr": 683
          },
          {
            "b": "q/(C*Bs*sfz!0v1B08-pxLQ4YwGSmbxLQ7Ky?j4",
            "ln": 19,
            "addr": 685
          },
          {
            "b": "nP5P\u003evqG:ilUHyFz!@\u003c7wQd9Xv@2H=wGTlSvpK7YxjTwHxlaH",
            "ln": 20,
            "addr": 717
          },
          {
            "b": "q/(C*Bs?MIwO2*6g7s",
            "ln": 21,
            "addr": 757
          },
          {
            "b": "qE%Y-C4Al%By/qia%Z-qB#?{dA71bRvo=Jvv@=Hez!s8@nP5SYA=bDgavQJ]y\u0026su9A:hE:x\u003e7{3oKS6Yv}YaEB7Gwmp?:/+wN]4BvrliJvrbQyvqPN%oIXtmy\u0026j2jat4ekax8#\u003cwO#QaC%=H/BzkSnwEO",
            "ln": 22,
            "addr": 772
          },
          {
            "b": "qE%Y-C4Al%By/qia%Z-qB#\u0026S4mn=@WpEW]Hmo\u0026k(B8b(oA9L[wzdN=ZpFrxSzFHBseOeukq!Z5VzGGYulVl\u003c:x(n684f",
            "ln": 23,
            "addr": 895
          },
          {
            "b": "qE%Y-C4Al%By/qia%Z-qB#?{dA71bRvo=Jvv@=Hez!s8@nP5SYA=bDgavQJ]y\u0026su9A:hE:x\u003e7{3oKS6Yv}YaEB7Gwmp?:/+wN]4BvrliJvrbQszFa0navo^.woe\u003e(Byxhjs7cb\u003ce]kAva%nEGviwG.y?mHay\u003cwx^zGGPgB.80",
            "ln": 24,
            "addr": 969
          },
          {
            "b": "q/(C*Bs/\u003c[wN/HwzE=W/z/u*yzeS($zF%Shw[+*%a}j",
            "ln": 25,
            "addr": 1105
          }
        ],
        "depth": 1,
        "facts": {
          "tgt": [
            "Install-ChocolateyPackage",
            "Remove-Item",
            "Split-Path",
            "Start-CheckAndStop",
            "Start-Process",
            "Start-sleep"
          ],
          "metrics": {
            "ast": {
              "max_depth": 43.0,
              "call_count": 9.0,
              "node_count": 495.0,
              "identifier_count": 28.0,
              "string_literal_count": 16.0,
              "array_literal_max_length": 3.0
            },
            "file": {
              "size": 1173.0,
              "entropy": 5.4,
              "size_bytes": 1173.0
            },
            "text": {
              "digit_ratio": 0.07,
              "space_count": 140.0,
              "total_lines": 26.0,
              "char_entropy": 5.4,
              "unique_chars": 78.0,
              "escape_density": 0.17,
              "string_density": 0.62,
              "avg_line_length": 43.12,
              "high_byte_ratio": 0.0,
              "max_line_length": 139.0,
              "non_ascii_ratio": 0.0,
              "empty_line_ratio": 0.08,
              "last_line_length": 31.0,
              "long_token_count": 1.0,
              "whitespace_ratio": 0.16,
              "most_common_ratio": 0.06,
              "identifier_density": 1.5,
              "line_length_stddev": 37.78,
              "encoded_string_ratio": 0.06,
              "unicode_escape_count": 2.0,
              "normalized_string_count": 3.14,
              "repeated_char_sequences": 2.0,
              "suspicious_string_ratio": 0.06,
              "most_common_char_is_null": 0.0,
              "max_inline_whitespace_run": 12.0,
              "trailing_whitespace_lines": 2.0,
              "most_common_char_codepoint": 101.0,
              "normalized_unique_identifiers": 5.96
            },
            "calls": {
              "count": 9.0
            },
            "binary": {
              "overall_entropy": 5.4
            },
            "strings": {
              "total": 16.0,
              "url_count": 1.0,
              "avg_length": 35.0,
              "max_length": 119.0,
              "avg_entropy": 3.49,
              "empty_count": 1.0,
              "hex_strings": 1.0,
              "total_bytes": 560.0,
              "entropy_stddev": 1.09,
              "shell_command_strings": 1.0
            },
            "identifiers": {
              "count": 28.0,
              "total": 39.0,
              "avg_length": 11.61,
              "max_length": 25.0,
              "min_length": 3.0,
              "avg_entropy": 3.06,
              "reuse_ratio": 0.72,
              "unique_count": 28.0,
              "length_stddev": 4.62,
              "high_entropy_count": 4.0,
              "high_entropy_ratio": 0.14,
              "all_lowercase_ratio": 0.07
            }
          }
        },
        "id": 2,
        "mol": "H₂(CmPo₂)",
        "path": "angry-birds-star-wars.nupkg!!tools/ChocolateyInstall.ps1",
        "risk": 3,
        "sha": "ee8ea167bf5dc6539339204cf180a32c6cfc9901a425a76204514a11b6af5c6a",
        "size": 1173,
        "traits": [
          {
            "id": "micro-behaviors/process/create/exec::start-process-dup",
            "conf": 0.8999999761581421,
            "crit": 3,
            "desc": "Uses Start-Process cmdlet",
            "spans": [
              [
                685,
                13
              ]
            ]
          },
          {
            "id": "micro-behaviors/os/env/vars/user-info::userprofile-var",
            "crit": 3,
            "desc": "USERPROFILE environment variable",
            "spans": [
              [
                913,
                11
              ]
            ]
          },
          {
            "id": "micro-behaviors/process/create/start-process::start-process-dup",
            "conf": 0.800000011920929,
            "crit": 3,
            "desc": "Start-Process call",
            "spans": [
              [
                685,
                13
              ]
            ]
          },
          {
            "id": "micro-behaviors/communications/http/lib/invoke-webrequest::uri-literal",
            "atk": "T1071.001",
            "mbc": "C0002",
            "conf": 0.75,
            "crit": 3,
            "desc": "HTTP/HTTPS URL literal",
            "spans": [
              [
                132,
                33
              ]
            ]
          },
          {
            "id": "micro-behaviors/fs/path/extension::exe-dup",
            "crit": 2,
            "desc": ".exe extension reference",
            "spans": [
              [
                248,
                4
              ]
            ]
          }
        ],
        "type": "powershell"
      },
      {
        "ctx": [
          {
            "b": "[4ls%kx}3YaA?spB7]MgjT8QkfD}SJzEWP}x(mMDb6w0teJs}sk0h!\u0026AaK8kCX}nmB3gZXBAzE.fe4xRxK#3?B1RxIwO#:fy?vQazddI",
            "n": [
              {
                "c": 1,
                "d": "File uses a document or configuration extension",
                "i": "metadata/file/extension/identity::doc-or-config-extension",
                "o": 0,
                "z": 19,
                "cf": 1.0
              }
            ],
            "ln": 0,
            "col": 1,
            "line": 1
          }
        ],
        "depth": 1,
        "facts": {
          "metrics": {
            "file": {
              "size": 507.0,
              "entropy": 4.81,
              "size_bytes": 507.0
            },
            "binary": {
              "overall_entropy": 4.81,
              "peak_region_bytes": 507.0,
              "peak_region_entropy": 4.81
            }
          }
        },
        "id": 3,
        "path": "angry-birds-star-wars.nupkg!![Content_Types].xml",
        "pid": 0,
        "sha": "9e90397a9b985cf9fa988271393dedc4b383681018ac9813c34eec5f47499e1d",
        "size": 507,
        "traits": [
          {
            "id": "metadata/file/extension/identity::doc-or-config-extension",
            "conf": 1.0,
            "crit": 1,
            "desc": "File uses a document or configuration extension",
            "spans": [
              [
                0,
                19
              ]
            ]
          }
        ],
        "type": "xml"
      }
    ],
    "rev": "33de0",
    "v": "8"
  }
}