{ "ml": { "l": -1, "v": "6", "fs": [ { "l": -1, "id": 0, "prob": 0.8083134293556213 } ], "prob": 0.8083134, "models": [ { "m": "az", "raw": 0.8083134, "prob": 0.8083134, "class": 0 }, { "m": "az/source", "raw": 0.9953089, "prob": 0.9953089, "class": 0 }, { "m": "az/c", "raw": 0.999399, "prob": 0.999399, "class": 0 } ], "version": "v17.17", "analyzed_at": "2026-06-08T02:26:59Z" }, "path": "usb.cpp", "raw": { "v": "6", "fs": [ { "f": "O(Er)H(F)", "x": 38, "ff": { "i": [ [ "", "strcat" ], [ "", "strcat" ], [ "", "CreateDirectory" ], [ "", "GetLastError" ], [ "", "SetFileAttributes" ], [ "", "strcat" ], [ "", "CreateDirectory" ], [ "", "GetLastError" ], [ "", "SetFileAttributes" ], [ "", "strcat" ], [ "", "strcat" ], [ "", "CreateFile" ], [ "", "WriteFile" ], [ "", "strlen" ], [ "", "CloseHandle" ], [ "", "CloseHandle" ], [ "", "strlen" ], [ "", "strcat" ], [ "", "CopyFile" ], [ "", "SetFileAttributes" ], [ "", "strcat" ], [ "", "strcat" ], [ "", "strcat" ], [ "", "strcat" ], [ "", "strcat" ], [ "", "strcat" ], [ "", "strcat" ], [ "", "SetFileAttributes" ], [ "", "CreateFile" ], [ "", "WriteFile" ], [ "", "strlen" ], [ "", "CloseHandle" ], [ "", "CloseHandle" ], [ "", "StrCpyN" ], [ "", "Sleep" ], [ "", "ExitThread" ], [ "", "GetLogicalDriveStrings" ], [ "", "GetDriveType" ], [ "", "USBinfectDrive" ], [ "", "strcat" ], [ "", "strcat" ], [ "", "IRC_Send" ], [ "", "\u003cshellapi.h\u003e" ], [ "", "\u003cshlwapi.h\u003e" ], [ "", "externs.h" ], [ "", "includes.h" ] ], "m": { "ast": { "op.eq": 2.0, "op.gt": 1.0, "op.lt": 8.0, "op.ne": 8.0, "op.add": 1.0, "op.bor": 9.0, "op.mul": 5.0, "op.sub": 1.0, "op.band": 2.0, "op.land": 5.0, "op.lnot": 4.0, "max_depth": 19.0, "bind_count": 11.0, "call_count": 42.0, "node_count": 1114.0, "op_density.eq": 0.0, "op_density.gt": 0.0, "op_density.lt": 0.01, "op_density.ne": 0.01, "op_density.add": 0.0, "op_density.bor": 0.01, "op_density.mul": 0.0, "op_density.sub": 0.0, "op_density.band": 0.0, "op_density.land": 0.0, "op_density.lnot": 0.0, "identifier_count": 55.0, "infinite_loop_count": 1.0, "string_literal_count": 3.0, "string_concat_chain_max_length": 2.0 }, "file": { "size": 3408.0, "entropy": 5.55, "size_bytes": 3408.0 }, "text": { "tab_count": 206.0, "digit_ratio": 0.03, "space_count": 320.0, "total_lines": 140.0, "char_entropy": 5.55, "mixed_indent": 1.0, "unique_chars": 85.0, "string_density": 0.02, "avg_line_length": 22.34, "max_line_length": 139.0, "empty_line_ratio": 0.16, "last_line_length": 1.0, "whitespace_ratio": 0.24, "most_common_ratio": 0.05, "identifier_density": 1.54, "line_length_stddev": 25.06, "normalized_string_count": 0.25, "repeated_char_sequences": 2.0, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 3.0, "trailing_whitespace_lines": 1.0, "most_common_char_codepoint": 101.0, "suspicious_identifier_ratio": 0.07, "normalized_unique_identifiers": 7.71 }, "binds": { "count": 11.0 }, "calls": { "count": 42.0 }, "binary": { "overall_entropy": 5.55 }, "source": { "function_count": 2.0 }, "imports": { "count": 4.0, "unique_modules": 4.0, "third_party_count": 4.0, "third_party_ratio": 1.0 }, "strings": { "total": 3.0, "avg_length": 6.67, "max_length": 10.0, "avg_entropy": 2.09, "total_bytes": 20.0, "entropy_stddev": 1.49 }, "comments": { "chars": 165.0, "lines": 7.0, "total": 7.0, "todo_count": 1.0, "to_code_ratio": 0.05 }, "functions": { "count": 2.0 }, "identifiers": { "count": 55.0, "total": 216.0, "avg_length": 11.29, "max_length": 23.0, "min_length": 1.0, "avg_entropy": 2.72, "reuse_ratio": 0.25, "unique_count": 55.0, "length_stddev": 6.46, "has_digit_ratio": 0.05, "sequential_names": 4.0, "single_char_count": 4.0, "single_char_ratio": 0.07, "high_entropy_count": 7.0, "high_entropy_ratio": 0.13, "all_lowercase_ratio": 0.25, "all_uppercase_ratio": 0.36, "numeric_suffix_count": 3.0 } }, "s": [ [ 9, "u8", "includes.h" ], [ 10, "u8", "includes.h" ], [ 32, "u8", "externs.h" ], [ 33, "u8", "externs.h" ], [ 54, "u8", "\u003cshlwapi.h\u003e" ], [ 76, "u8", "\u003cshellapi.h\u003e" ], [ 159, "10", "512" ], [ 172, "10", "512" ], [ 246, "10", "0" ], [ 289, "10", "0" ], [ 303, "10", "0" ], [ 346, "10", "0" ], [ 521, "10", "1" ], [ 785, "10", "1" ], [ 1035, "10", "0" ], [ 1106, "10", "0" ], [ 1128, "10", "1" ], [ 1141, "10", "1" ], [ 1260, "10", "1" ], [ 1349, "10", "0" ], [ 1383, "10", "0" ], [ 1637, "10", "0" ], [ 1680, "10", "0" ], [ 1708, "10", "0" ], [ 1942, "10", "0" ], [ 1985, "10", "0" ], [ 2142, "10", "0" ], [ 2239, "10", "0" ], [ 2261, "10", "1" ], [ 2274, "10", "1" ], [ 2365, "10", "1" ], [ 2401, "10", "1" ], [ 2480, "10", "512" ], [ 2491, "10", "512" ], [ 2514, "10", "3" ], [ 2587, "10", "0" ], [ 2630, "10", "0" ], [ 2645, "10", "0" ], [ 2650, "10", "0" ], [ 2721, "10", "12000" ], [ 2748, "10", "0" ], [ 2766, "10", "0" ], [ 2805, "10", "512" ], [ 2811, "10", "1" ], [ 2919, "10", "0" ], [ 2925, "10", "65" ], [ 2939, "10", "0" ], [ 2945, "10", "66" ], [ 2959, "10", "0" ], [ 2965, "10", "97" ], [ 2979, "10", "0" ], [ 2985, "10", "98" ], [ 3094, "10", "0" ], [ 3123, "10", "0" ], [ 3168, "10", "0" ] ], "v": { "file.stem": "usb", "file.basename": "usb.cpp", "source.language": "c", "source.imports[0]": "\u003cshellapi.h\u003e", "source.imports[1]": "\u003cshlwapi.h\u003e", "source.imports[2]": "CloseHandle", "source.imports[3]": "CopyFile", "source.imports[4]": "CreateDirectory", "source.imports[5]": "CreateFile", "source.imports[6]": "ExitThread", "source.imports[7]": "GetDriveType", "source.imports[8]": "GetLastError", "source.imports[9]": "GetLogicalDriveStrings", "source.strings[0]": "\u003cshellapi.h\u003e", "source.strings[1]": "\u003cshlwapi.h\u003e", "source.strings[2]": "externs.h", "source.strings[3]": "includes.h", "source.has_imports": true, "source.imports[10]": "IRC_Send", "source.imports[11]": "SetFileAttributes", "source.imports[12]": "Sleep", "source.imports[13]": "StrCpyN", "source.imports[14]": "USBinfectDrive", "source.imports[15]": "WriteFile", "source.imports[16]": "externs.h", "source.imports[17]": "includes.h", "source.imports[18]": "strcat", "source.imports[19]": "strlen", "source.functions[0]": "RemoteUSBThread(void *sock)", "source.functions[1]": "USBinfectDrive(char *drv)" }, "ct": [ "CloseHandle", "CopyFile", "CreateDirectory", "CreateFile", "ExitThread", "GetDriveType", "GetLastError", "GetLogicalDriveStrings", "IRC_Send", "SetFileAttributes", "Sleep", "StrCpyN", "USBinfectDrive", "WriteFile", "strcat", "strlen" ], "id": "c" }, "id": 0, "sz": 3408, "ts": [ { "c": 0.6600000262260437, "d": "Create directories (Windows API)", "e": [ "CreateDirectory" ], "i": "micro-behaviors/fs/directory/mkdir::create-directory", "l": 2, "el": [ "1b6" ] }, { "a": "T1083", "c": 0.8799999952316284, "d": "GetDriveType API in source", "e": [ "GetDriveType" ], "i": "micro-behaviors/fs/traversal/drives::get-drive-type-source", "l": 2, "el": [ "bbe" ] }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2 }, { "c": 0.8799999952316284, "d": "SetFileAttributes API in source", "e": [ "SetFileAttributes" ], "i": "micro-behaviors/fs/file/attributes::set-file-attributes-source", "l": 2, "el": [ "20e" ] }, { "a": "T1091", "c": 0.8500000238418579, "d": "DRIVE_REMOVABLE constant in source", "e": [ "DRIVE_REMOVABLE" ], "i": "micro-behaviors/fs/traversal/drives::drive-type-removable-source", "l": 3 }, { "c": 0.8799999952316284, "d": "WriteFile API in source code", "e": [ "WriteFile" ], "i": "micro-behaviors/fs/file/write/direct::write-file-source", "l": 2, "el": [ "47f" ] }, { "c": 0.8199999928474426, "d": "Delay execution with Sleep in source", "e": [ "Sleep" ], "i": "micro-behaviors/time/timing/delay::sleep-source", "l": 2, "el": [ "a9b" ] }, { "c": 1.0, "d": "Infinite loop structure (e.g. for(;;) or while(1))", "e": [ "for (;;)" ], "i": "micro-behaviors/data/control-flow/loop::infinite-loop-header", "l": 2 }, { "c": 0.8999999761581421, "d": "CreateFile API string reference", "e": [ "CreateFile" ], "i": "micro-behaviors/fs/file/open::createfile-api", "l": 2 }, { "a": "T1564.001", "c": 0.8799999952316284, "d": "FILE_ATTRIBUTE_HIDDEN flag in source", "e": [ "FILE_ATTRIBUTE_HIDDEN" ], "i": "objectives/evasion/file-hiding/attributes::file-attribute-hidden-source", "l": 1 }, { "a": "T1564.001", "c": 0.8999999761581421, "d": "Hide file via FILE_ATTRIBUTE_HIDDEN", "e": [ "SetFileAttributes", "FILE_ATTRIBUTE_HIDDEN" ], "i": "objectives/evasion/file-hiding/attributes::hide-file-attributes", "l": 4, "el": [ "20e", "" ] } ], "sha": "d67c7a3457458317f7bbfd3cea59951a2a58a0b9d37bbd6f953b1b3824171448", "path": "/data/samples/bad/projects/botnets/VirusPack/asper + usb/usb.cpp", "type": "c" } ], "tv": "8e9ac" } }