{
  "ml": {
    "v": "7",
    "eng": "2.0.1-rc.1",
    "lvl": -1,
    "conf": 0,
    "mods": [
      {
        "cls": 0,
        "raw": 0.000009049972,
        "rte": "az",
        "prob": 0.000009049972
      },
      {
        "cls": 0,
        "raw": 0.0000087320805,
        "rte": "az/scripts",
        "prob": 0.0000087320805
      },
      {
        "cls": 0,
        "raw": 0.016689966,
        "rte": "az/shell",
        "prob": 0.016689966
      }
    ],
    "prob": 0.000009049972,
    "files": [
      {
        "id": 0,
        "lvl": -1,
        "conf": 0,
        "prob": 0.00000904997159523191,
        "type": "shell"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-06-15T06:58:33Z"
  },
  "path": "create_pl2",
  "raw": {
    "v": "7",
    "tv": "061e3",
    "files": [
      {
        "id": 0,
        "ctx": [
          {
            "a": 0,
            "b": "boXZHx(kOkvrl8",
            "l": 1,
            "n": [
              {
                "c": 2,
                "d": "shell code embedded in string",
                "i": "metadata/lang/embedded::shell",
                "o": 0,
                "z": 109
              }
            ]
          },
          {
            "a": 12,
            "b": "",
            "l": 2
          },
          {
            "a": 13,
            "b": "l}HotAbmo",
            "l": 3
          },
          {
            "a": 21,
            "b": "A+#{JA+lBtl}Hn",
            "l": 4,
            "n": [
              {
                "c": 2,
                "d": "Shell deletion operation",
                "i": "micro-behaviors/fs/directory/traverse::delete-shell",
                "o": 21,
                "z": 6
              }
            ]
          },
          {
            "a": 33,
            "b": "zeiV@AV=R}nM2",
            "l": 5
          },
          {
            "a": 44,
            "b": "",
            "l": 6
          }
        ],
        "sha": "d7fb79da3ced0f5a7e71bf65646ce135be24115eb9a70f7e362a9f5921586258",
        "fact": {
          "id": "shell",
          "imp": [
            [
              "",
              "rm"
            ],
            [
              "",
              "rm"
            ],
            [
              "",
              "mkdir"
            ],
            [
              "",
              "mkdir"
            ],
            [
              "",
              "cd"
            ],
            [
              "",
              "cd"
            ],
            [
              "",
              "uudecode"
            ],
            [
              "",
              "uudecode"
            ],
            [
              "",
              "cd"
            ],
            [
              "",
              "cd"
            ]
          ],
          "met": {
            "ast": {
              "max_depth": 6.0,
              "bind_count": 1.0,
              "call_count": 5.0,
              "node_count": 48.0,
              "identifier_count": 12.0
            },
            "file": {
              "size": 115.0,
              "entropy": 4.8,
              "size_bytes": 115.0
            },
            "text": {
              "tab_count": 3.0,
              "digit_ratio": 0.01,
              "space_count": 10.0,
              "total_lines": 12.0,
              "char_entropy": 4.8,
              "unique_chars": 37.0,
              "avg_line_length": 8.58,
              "max_line_length": 23.0,
              "empty_line_ratio": 0.17,
              "last_line_length": 4.0,
              "whitespace_ratio": 0.22,
              "most_common_ratio": 0.08,
              "identifier_density": 1.83,
              "line_length_stddev": 7.05,
              "most_common_char_is_null": 0.0,
              "max_inline_whitespace_run": 1.0,
              "most_common_char_codepoint": 100.0,
              "suspicious_identifier_ratio": 0.08,
              "normalized_unique_identifiers": 3.35
            },
            "binds": {
              "count": 1.0
            },
            "calls": {
              "count": 5.0
            },
            "binary": {
              "overall_entropy": 4.8
            },
            "comments": {
              "chars": 10.0,
              "lines": 1.0,
              "total": 1.0,
              "to_code_ratio": 0.09
            },
            "identifiers": {
              "count": 12.0,
              "total": 22.0,
              "avg_length": 3.92,
              "max_length": 11.0,
              "min_length": 1.0,
              "avg_entropy": 1.43,
              "reuse_ratio": 0.55,
              "unique_count": 12.0,
              "length_stddev": 2.75,
              "has_digit_ratio": 0.08,
              "sequential_names": 1.0,
              "single_char_count": 1.0,
              "single_char_ratio": 0.08,
              "all_lowercase_ratio": 0.33,
              "all_uppercase_ratio": 0.25,
              "numeric_suffix_count": 1.0
            }
          },
          "tgt": [
            "cd",
            "mkdir",
            "rm",
            "uudecode"
          ],
          "val": {
            "file.stem": "create_pl2",
            "file.basename": "create_pl2",
            "source.shebang": "/bin/bash",
            "source.language": "bash",
            "source.imports[0]": "cd",
            "source.imports[1]": "mkdir",
            "source.imports[2]": "rm",
            "source.imports[3]": "uudecode",
            "source.has_imports": true
          }
        },
        "find": [
          {
            "id": "metadata/lang/shebang::bash",
            "conf": 1.0,
            "crit": 2,
            "desc": "Bash shell shebang line"
          },
          {
            "id": "micro-behaviors/fs/directory/traverse::rm-rf-cmd",
            "conf": 0.6000000238418579,
            "crit": 2,
            "desc": "rm -rf command"
          },
          {
            "id": "micro-behaviors/fs/directory/traverse::delete-shell",
            "conf": 0.8500000238418579,
            "crit": 2,
            "desc": "Shell deletion operation"
          },
          {
            "id": "metadata/lang/embedded::shell",
            "conf": 1.0,
            "crit": 2,
            "desc": "shell code embedded in string"
          }
        ],
        "path": "create_pl2",
        "risk": 1,
        "size": 115,
        "type": "shell"
      }
    ]
  }
}