{ "ml": { "v": "7", "eng": "2.9.1", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.000021229187, "rte": "az", "prob": 0.000021229187 }, { "cls": 0, "raw": 0.00020712614, "rte": "az/zip", "prob": 0.00020712614 } ], "prob": 0.000021229187, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.000021229187041171826, "type": "zip" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.000008712212547834497, "type": "zip" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.000011036793694074731, "type": "json" }, { "id": 16, "lvl": -1, "conf": 0, "prob": 0.000010748703971330542, "type": "jar" }, { "id": 21, "lvl": -1, "conf": 0, "prob": 0.00001051028539222898, "type": "java_class" }, { "id": 30, "lvl": -1, "conf": 0, "prob": 0.000012169281944807153, "type": "jar" }, { "id": 52, "lvl": -1, "conf": 0, "prob": 0.000010699033737182617, "type": "java_class" }, { "id": 64, "lvl": -1, "conf": 0, "prob": 0.000010619561180646997, "type": "java_class" } ], "version": "v18.18", "analyzed_at": "2026-09-11T13:17:44Z" }, "path": "fleet.terraform-262.834.43.zip", "raw": { "files": [ { "id": 0, "ctx": [ { "b": "p!H([6AwyA2MK\u00268aPIGx0000000000000ua2([ENzeBiee{.kJrA6b40rr9101npdw!wFf\u0026nw0Ju@gx028iLR3#4-3Su(\u0026]iI\u003e#dDbU7QSyomjy57idDDC#[X+QI%dF.8ZXV6\u003c2I6XMPurh5{ut6P{10ZuXyP4", "ln": 0 } ], "mol": "H₂(CmF)", "sha": "e9607dee3690cacb6e68bca17a94f8e2a7886c38dffb055a25e623c0da226e74", "path": "fleet.terraform-262.834.43.zip", "risk": 3, "size": 79385, "type": "zip", "facts": { "metrics": { "file": { "size": 79385, "entropy": 7.99 }, "binary": { "peak_region_bytes": 76800, "peak_region_entropy": 7.83 }, "archive": { "file_count": 10, "member_count": 10, "script_count": 0, "zip_bomb_ratio": 12.27, "compressed_size": 72213, "directory_count": 0, "executable_count": 0, "extra_field_size": 90, "noise_file_count": 0, "compression.ratio": 0.25, "hidden_file_count": 0, "uncompressed_size": 291637, "crc_collision_count": 0, "entry_comment_count": 0, "max_filename_length": 37, "rtlo_filename_count": 0, "format.regular_count": 10, "nested_archive_count": 5, "path_traversal_count": 0, "symlink_escape_count": 0, "security.setgid_count": 0, "security.setuid_count": 0, "security.sticky_count": 0, "double_extension_count": 0, "duplicate_member_count": 0, "security.symlink_count": 0, "unicode_filename_count": 0, "homoglyph_filename_count": 0, "security.encrypted_count": 0, "timing.mtime_unique_count": 1, "timing.mtime_unique_ratio": 0.1, "misplaced_executable_count": 0, "timing.mtime_dominant_count": 10, "timing.mtime_spread_seconds": 0, "timing.sentinel_mtime_count": 0, "security.world_writable_count": 0, "timing.mtime_dominant_fraction": 1, "compression.method_counts.deflate": 10 } } }, "ident": { "name": { "value": "fleet.terraform", "source": "file.basename", "verified": false }, "trust": "unsigned", "version": { "value": "262.834.43", "source": "file.basename", "verified": false } }, "traits": [ { "id": "micro-behaviors/fs/path/extension::java-executable-reference", "conf": 0.92, "crit": 3, "desc": "Java bytecode references an executable path" }, { "id": "metadata/file/profile/language::lang-english--atom-5", "conf": 0.8, "crit": 2, "desc": "English function-word token \"for\"" }, { "id": "net/url", "conf": 0.85, "crit": 3, "desc": "URL reference" }, { "id": "metadata/file/profile/language::lang-english--atom-1", "conf": 0.8, "crit": 2, "desc": "English function-word token \"the\"" }, { "id": "micro-behaviors/communications/http/url/github::github-web-raw-url", "atk": "T1071.001", "mbc": "C0002", "conf": 0.86, "crit": 3, "desc": "GitHub web raw file URL", "from": [ { "file": 3 } ] } ] }, { "depth": 1, "facts": { "metrics": { "file": { "size": 1201, "entropy": 7.6 }, "binary": { "peak_region_bytes": 1024, "peak_region_entropy": 7.75 }, "archive": { "file_count": 1, "member_count": 1, "script_count": 0, "zip_bomb_ratio": 2.04, "compressed_size": 971, "directory_count": 0, "executable_count": 0, "extra_field_size": 9, "noise_file_count": 0, "compression.ratio": 0.49, "hidden_file_count": 0, "uncompressed_size": 1977, "crc_collision_count": 0, "entry_comment_count": 0, "max_filename_length": 49, "rtlo_filename_count": 0, "format.regular_count": 1, "nested_archive_count": 0, "path_traversal_count": 0, "symlink_escape_count": 0, "security.setgid_count": 0, "security.setuid_count": 0, "security.sticky_count": 0, "double_extension_count": 0, "duplicate_member_count": 0, "security.symlink_count": 0, "unicode_filename_count": 0, "homoglyph_filename_count": 0, "security.encrypted_count": 0, "timing.mtime_unique_count": 1, "timing.mtime_unique_ratio": 1, "misplaced_executable_count": 0, "timing.mtime_dominant_count": 1, "timing.mtime_spread_seconds": 0, "timing.sentinel_mtime_count": 0, "security.world_writable_count": 0, "timing.mtime_dominant_fraction": 1, "compression.method_counts.deflate": 1 } } }, "id": 1, "mol": "Md", "path": "fleet.terraform-262.834.43.zip!!common.zip", "pid": 0, "risk": 1, "sha": "9177a0743a0b085b684ba7bbc5bd522ecc47b1daf85baba55aed537f8edc5716", "size": 1201, "traits": [ { "id": "metadata/file/archive::archive-member-under-10kb", "conf": 0.9, "crit": 3, "desc": "Archive has a sub-10KB member" } ], "type": "zip" }, { "ctx": [ { "b": "tm8F}arV1rarR^HarR^Hb5Q?awG\u003ceTb1D=:C3#NC3lQDlarR^Har\u003e#uA=U@kzx.a:a#q2ch7*Nmyi0(fed9HxarR^HarR\u003eJA+({Xar\u003eGvBz#pZfe3%LBzb/ae=", "ln": 0, "col": 1, "line": 1 }, { "b": "xlvTaviNlfarR^HarR^Hb5y$6wO#N2b03?\u003cl2ZmxxK@qwe?!F23lQDlarR^Har\u003eSov}xL0wMr+!b03?\u003cxMOunB2\u003e%cxk8E3BZ=$kz/4duz/oo8wImXsvrM6jA::eBzddHcwPxB$nKC{wq:?(qarR^HEjLZFarR!N3lQDlarR^Har\u003eYizdK[Lar\u003cAMk{v\u0026!arR^HarR^Hb6EKrB7]Mgb03?\u003ch7*Qze?[L33lQDlarR^Har\u003e@Gy:7[.b4#7uAc15[fk20vxMW=pv@Diqygho]ePb0sx)a5t", "ln": 108, "col": 43, "line": 5 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 13788, "entropy": 4.66 }, "json": { "parsed_bytes": 13788, "parse_limit_bytes": 76800 }, "binary": { "peak_region_bytes": 13788, "peak_region_entropy": 4.72 } } }, "id": 3, "mol": "H(Cm)", "path": "fleet.terraform-262.834.43.zip!!dependencies.json", "pid": 0, "risk": 1, "sha": "50c2d54bb0b5ec5dfec25a55b23bd864f9bc6a9c1d79990fd002a7b9f0b0ae6e", "size": 13788, "traits": [ { "id": "micro-behaviors/communications/http/url/github::github-web-raw-url", "atk": "T1071.001", "mbc": "C0002", "conf": 0.86, "crit": 3, "desc": "GitHub web raw file URL", "spans": [ [ 172, 36 ] ] } ], "type": "json" }, { "depth": 1, "facts": { "metrics": { "jar": { "class_count": 11, "entry_count": 15, "index_count": 0, "service_count": 1, "signature_count": 0, "native_lib_count": 0, "embedded_jar_count": 0, "manifest.entry_count": 0, "manifest.digest_count": 0, "signature_block_count": 0, "versioned_class_count": 0, "manifest.section_count": 0, "manifest.attribute_count": 1, "manifest.class_path_count": 0, "manifest.boot_class_path_count": 0 }, "file": { "size": 33064, "entropy": 5.54 }, "binary": { "peak_region_bytes": 8192, "peak_region_entropy": 5.8 }, "archive": { "file_count": 15, "has_comment": 1, "comment_size": 5, "member_count": 15, "script_count": 0, "zip_bomb_ratio": 1, "compressed_size": 30187, "directory_count": 0, "executable_count": 0, "extra_field_size": 0, "noise_file_count": 0, "compression.ratio": 1, "hidden_file_count": 0, "uncompressed_size": 30187, "crc_collision_count": 0, "entry_comment_count": 0, "max_filename_length": 78, "rtlo_filename_count": 0, "format.regular_count": 15, "nested_archive_count": 0, "path_traversal_count": 0, "symlink_escape_count": 0, "security.setgid_count": 0, "security.setuid_count": 0, "security.sticky_count": 0, "double_extension_count": 0, "duplicate_member_count": 0, "security.symlink_count": 0, "unicode_filename_count": 0, "homoglyph_filename_count": 0, "security.encrypted_count": 0, "misplaced_executable_count": 0, "timing.mtime_dominant_count": 15, "timing.sentinel_mtime_count": 15, "security.world_writable_count": 0, "timing.mtime_dominant_fraction": 1, "compression.method_counts.stored": 15 } } }, "id": 16, "mol": "H(Cm)Md", "path": "fleet.terraform-262.834.43.zip!!fleet.plugins.terraform.frontend.jar", "pid": 0, "risk": 4, "sha": "f40ba9589e7d6f3e875ebbdee81c6aa1135d0cfb9e2d9c6b9472573aca7ef649", "size": 33064, "traits": [ { "id": "metadata/lang/natural::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"" }, { "id": "metadata/lang/natural::lang-english--atom-6", "conf": 0.8, "crit": 1, "desc": "English function-word token \"with\"" }, { "id": "micro-behaviors/communications/http/url/domain::http-url-binary", "atk": "T1071.001", "mbc": "C0002", "conf": 0.7, "crit": 3, "desc": "Embedded HTTP or WebSocket URL" }, { "id": "metadata/lang/natural::lang-english--atom-7", "conf": 0.8, "crit": 1, "desc": "English function-word token \"this\"" }, { "id": "net/url", "conf": 0.85, "crit": 3, "desc": "URL reference" }, { "id": "metadata/file/archive::archive-at-least-10-members", "conf": 0.9, "crit": 3, "desc": "Archive contains at least ten members" }, { "id": "metadata/file/naming::archive-member-under-10kb", "conf": 0.9, "crit": 3, "desc": "Archive has a sub-10KB member" } ], "type": "jar" }, { "ctx": [ { "b": "+kO#^0000/0c!IAj.wIwwPPOAy\u0026%x8zGvEMwPz*1w]zZbfj]lyzGGDcwg{[[A=LP2z/PX\u003ey\u0026%x8zx%4pvpQSsbRZM0bRYJ70rAgtoLXM*y?W=uyiBCEx(n37A=br4fhb!\u003evQ@)", "ln": 0 }, { "b": "wDq=Vc}[b?z7/TnByGo0x(m#BA+Gfkz/65@vLp8ZvqYZ?q!6-+wJItw0rrJNBzbxfbX7H@zF9I^01/ki9=2Xoy?W=uyiBCEx(n37A=br4fg*56A+PAjx\u003e8h?022wk6\u003ep]*v@1?TBwu%{y/1LXvqPN$wPv!KcN.V6vrM6jy*?i]fhD4(wN/*zoLO0V", "ln": 373 }, { "b": "wO#3izF%Shw[+:-BzkVhB1ZpbBzku3v{%E[z/ecRz/dSB04v)$3ihEOd//SEra]?=B7GxnwPw]cB0bQyvrM6[y**^?wGUY8aBd)FAV/ylxk8p4e*9#bwNPT\u003eaAIa9aARTjwmV([z/fVqz!%FqvTf7!vrl9@lVm0:iTtZq0rsJYBAzFyiXJdgCxUVMvrl9@v@Dybe[n*pflzkywmWu5z/fVqz!%F2051uMhd*VowPPOqA=k\u0026qwO#3izF%Shw[+:-BzkVhB1ZpbBzku3v{%E[z/el.zFIW=By/GgvqDeGf-.n4c}[w:C404uvqYZhq/)4]zF848ygho]fkL6mxd)h9A+PA7j1jhs00\u0026MX3ih*YgY", "ln": 980 } ], "depth": 2, "facts": { "imp": [ [ "", "kotlin/Unit" ], [ "", "fleet/plugins/smartMode/frontend/api/BackendNotificationKt" ], [ "", "com/jetbrains/rhizomedb/ChangeScope" ], [ "", "fleet/plugins/terraform/frontend/TerraformPlugin$load$2" ], [ "", "kotlin/collections/CollectionsKt" ], [ "", "fleet/plugins/terraform/frontend/TerraformPlugin$load$2$1$1" ], [ "", "fleet/frontend/notifications/NotificationIcon" ], [ "", "fleet/plugins/terraform/frontend/TerraformPlugin$load$2$1" ], [ "", "kotlin/jvm/internal/Intrinsics" ], [ "", "kotlin/jvm/functions/Function1" ], [ "", "fleet/frontend/notifications/NotificationIcon$Companion" ], [ "", "fleet/frontend/notifications/NotificationLinkExternal" ], [ "", "kotlin/jvm/internal/Lambda" ], [ "", "fleet/frontend/notifications/NotificationsKt" ], [ "fleet/plugins/terraform/frontend/TerraformPlugin$load$2$1$1$1", "fleet/plugins/terraform/frontend/TerraformPlugin$load$2$1$1$1.\u003cinit\u003e" ], [ "fleet/plugins/terraform/frontend/TerraformPlugin$load$2$1$1$1", "\u003cinit\u003e" ], [ "kotlin/jvm/internal/Intrinsics", "kotlin/jvm/internal/Intrinsics.checkNotNullParameter" ], [ "kotlin/jvm/internal/Intrinsics", "checkNotNullParameter" ], [ "kotlin/jvm/internal/Lambda", "kotlin/jvm/internal/Lambda.\u003cinit\u003e" ], [ "kotlin/jvm/internal/Lambda", "\u003cinit\u003e" ], [ "fleet/plugins/smartMode/frontend/api/BackendNotificationKt", "fleet/plugins/smartMode/frontend/api/BackendNotificationKt.getBackendNotificationCategory" ], [ "fleet/plugins/smartMode/frontend/api/BackendNotificationKt", "getBackendNotificationCategory" ], [ "kotlin/Unit", "kotlin/Unit.INSTANCE" ], [ "kotlin/Unit", "INSTANCE" ], [ "fleet/plugins/terraform/frontend/TerraformPlugin$load$2$1$1$1", "fleet/plugins/terraform/frontend/TerraformPlugin$load$2$1$1$1.invoke" ], [ "fleet/plugins/terraform/frontend/TerraformPlugin$load$2$1$1$1", "invoke" ], [ "fleet/plugins/terraform/frontend/TerraformPlugin$load$2$1$1$1", "fleet/plugins/terraform/frontend/TerraformPlugin$load$2$1$1$1.INSTANCE" ], [ "fleet/plugins/terraform/frontend/TerraformPlugin$load$2$1$1$1", "INSTANCE" ], [ "fleet/frontend/notifications/NotificationLinkExternal", "fleet/frontend/notifications/NotificationLinkExternal.\u003cinit\u003e" ], [ "fleet/frontend/notifications/NotificationLinkExternal", "\u003cinit\u003e" ], [ "fleet/frontend/notifications/NotificationIcon$Companion", "fleet/frontend/notifications/NotificationIcon$Companion.getWarning" ], [ "fleet/frontend/notifications/NotificationIcon$Companion", "getWarning" ], [ "fleet/frontend/notifications/NotificationsKt", "fleet/frontend/notifications/NotificationsKt.showNotification$default" ], [ "fleet/frontend/notifications/NotificationsKt", "showNotification$default" ], [ "fleet/frontend/notifications/NotificationIcon", "fleet/frontend/notifications/NotificationIcon.Companion" ], [ "fleet/frontend/notifications/NotificationIcon", "Companion" ], [ "kotlin/collections/CollectionsKt", "kotlin/collections/CollectionsKt.listOf" ], [ "kotlin/collections/CollectionsKt", "listOf" ] ], "metrics": { "file": { "size": 3182, "entropy": 5.44 }, "class": { "major_version": 69, "interface_count": 1, "method_ref_count": 12, "constant_pool_size": 120, "external_class_count": 14 }, "binary": { "peak_region_bytes": 3072, "peak_region_entropy": 5.29 }, "imports": { "count": 26 }, "functions": { "count": 4 } } }, "id": 21, "mol": "H(Cm)", "path": "fleet.terraform-262.834.43.zip!!fleet.plugins.terraform.frontend.jar!!fleet/plugins/terraform/frontend/TerraformPlugin$load$2$1$1$1.class", "pid": 16, "risk": 2, "sha": "a2039dbec91383d3f2539effb9265f7dfe4309eac731b004bf0f81469e210c08", "size": 3182, "traits": [ { "id": "net/url", "conf": 0.85, "crit": 3, "desc": "URL reference" }, { "id": "metadata/lang/natural::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"", "spans": [ [ 1028, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-7", "conf": 0.8, "crit": 1, "desc": "English function-word token \"this\"", "spans": [ [ 421, 0 ] ] }, { "id": "micro-behaviors/communications/http/url/domain::http-url-binary", "atk": "T1071.001", "mbc": "C0002", "conf": 0.7, "crit": 3, "desc": "Embedded HTTP or WebSocket URL", "spans": [ [ 1115, 26 ] ] } ], "type": "java_class" }, { "depth": 1, "facts": { "metrics": { "jar": { "class_count": 47, "entry_count": 51, "index_count": 0, "service_count": 1, "signature_count": 0, "native_lib_count": 0, "embedded_jar_count": 0, "manifest.entry_count": 0, "manifest.digest_count": 0, "signature_block_count": 0, "versioned_class_count": 0, "manifest.section_count": 0, "manifest.attribute_count": 1, "manifest.class_path_count": 0, "manifest.boot_class_path_count": 0 }, "file": { "size": 192554, "entropy": 5.72 }, "binary": { "peak_region_bytes": 9216, "peak_region_entropy": 6.17 }, "archive": { "file_count": 51, "has_comment": 1, "comment_size": 5, "member_count": 51, "script_count": 0, "zip_bomb_ratio": 1, "compressed_size": 181123, "directory_count": 0, "executable_count": 0, "extra_field_size": 0, "noise_file_count": 0, "compression.ratio": 1, "hidden_file_count": 0, "uncompressed_size": 181123, "crc_collision_count": 0, "entry_comment_count": 0, "max_filename_length": 111, "rtlo_filename_count": 0, "format.regular_count": 51, "nested_archive_count": 0, "path_traversal_count": 0, "symlink_escape_count": 0, "security.setgid_count": 0, "security.setuid_count": 0, "security.sticky_count": 0, "double_extension_count": 0, "duplicate_member_count": 0, "security.symlink_count": 0, "unicode_filename_count": 0, "homoglyph_filename_count": 0, "security.encrypted_count": 0, "misplaced_executable_count": 0, "timing.mtime_dominant_count": 51, "timing.sentinel_mtime_count": 51, "security.world_writable_count": 0, "timing.mtime_dominant_fraction": 1, "compression.method_counts.stored": 51 } } }, "id": 30, "mol": "O₃(CaIPr)H₄(CmDbFPo)Md", "path": "fleet.terraform-262.834.43.zip!!fleet.plugins.terraform.workspace.jar", "pid": 0, "risk": 9, "sha": "409082230e2a4d799812b2d864069dbdf6987db6ffbf2d39448f2fd15fa52975", "size": 192554, "traits": [ { "id": "objectives/impact/ransom/recovery-inhibition::jvm-wbadmin-string", "atk": "T1486", "conf": 0.98, "crit": 3, "desc": "JVM string names wbadmin catalog deletion" }, { "id": "metadata/lang/natural::lang-english--atom-2", "conf": 0.8, "crit": 1, "desc": "English function-word token \"and\"" }, { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"" }, { "id": "metadata/lang/natural::lang-english--atom-7", "conf": 0.8, "crit": 1, "desc": "English function-word token \"this\"" }, { "id": "objectives/credential-access/gaming/minecraft::minecraft-session-getter-id", "atk": "T1528", "mbc": "B0006", "conf": 0.96, "crit": 3, "desc": "Minecraft account ID getter helper" }, { "id": "micro-behaviors/process/info/current::getpath-ref", "conf": 0.8, "crit": 3, "desc": "Java getPath call reference" }, { "id": "micro-behaviors/data/string/conversion::tostring-token", "conf": 1.0, "crit": 3, "desc": "References the toString conversion method" }, { "id": "metadata/lang/natural::lang-english--atom-6", "conf": 0.8, "crit": 1, "desc": "English function-word token \"with\"" }, { "id": "micro-behaviors/fs/path/extension::java-executable-reference", "conf": 0.92, "crit": 3, "desc": "Java bytecode references an executable path" }, { "id": "objectives/privilege-escalation/elevation-control/setuid/runtime::jvm-bytecode-set-executable", "atk": "T1548.001", "conf": 0.9, "crit": 3, "desc": "JVM bytecode references setExecutable" }, { "id": "net/url", "conf": 0.85, "crit": 3, "desc": "URL reference" }, { "id": "micro-behaviors/communications/http/url/domain::http-url-binary", "atk": "T1071.001", "mbc": "C0002", "conf": 0.7, "crit": 3, "desc": "Embedded HTTP or WebSocket URL" }, { "id": "metadata/lang/natural::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"" }, { "id": "metadata/file/archive::archive-at-least-10-members", "conf": 0.9, "crit": 3, "desc": "Archive contains at least ten members" }, { "id": "metadata/file/naming::archive-member-under-10kb", "conf": 0.9, "crit": 3, "desc": "Archive has a sub-10KB member" } ], "type": "jar" }, { "id": 52, "mol": "H(F)", "sha": "bf81c919bd66ecec9d4b71f78cd2a310789202357ffa9be98f575113b320918d", "path": "fleet.terraform-262.834.43.zip!!fleet.plugins.terraform.workspace.jar!!fleet/plugins/terraform/workspace/DownloaderKt.class", "risk": 1, "size": 17022, "type": "java_class", "depth": 2 }, { "id": 64, "sha": "0e6b729cf87e68ac033288dda2f48e1a87354cb45fc2d44be7412cb4f1efcbab", "path": "fleet.terraform-262.834.43.zip!!fleet.plugins.terraform.workspace.jar!!fleet/plugins/terraform/workspace/TerraformLs$terraformLsArtifact$1.class", "risk": 1, "size": 2952, "type": "java_class", "depth": 2 } ], "omitted_files": 2, "v": "8" } }