{ "ml": { "v": "7", "eng": "2.2.0-beta.1", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.007982582, "rte": "az", "prob": 0.007982582 } ], "prob": 0.009439061, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.009439061395823956, "type": "xz" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.009321172721683979, "type": "shell" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.009439061395823956, "type": "shell" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.000010947386726911645, "type": "javascript" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.000010520219802856445, "type": "kotlin" } ], "version": "v18.18", "analyzed_at": "2026-06-28T14:33:09Z" }, "path": "tex-pictex-1.1b.tgz", "raw": { "files": [ { "id": 0, "mol": "O(Er)H(Po₂)", "sha": "ef22aa2a3a68dbc04d8863b0bc714ab41052deb841f47e0355925ff1db6d24b5", "path": "tex-pictex-1.1b.tgz", "risk": 4, "size": 44832, "type": "xz", "facts": { "metrics": { "file": { "size": 44832.0, "entropy": 8.0, "size_bytes": 44832.0 }, "binary": { "overall_entropy": 8.0, "peak_region_bytes": 44832.0, "peak_region_entropy": 7.85 }, "consistency": { "extension_content_mismatch": 1.0, "extension_content_mismatch.archive_as_archive": 1.0 } } }, "traits": [ { "id": "micro-behaviors/process/create/shell/spawn::bin-sh", "atk": "T1059.004", "mbc": "E1059.004", "conf": 0.6000000238418579, "crit": 3, "desc": "References /bin/sh (Bourne shell)" }, { "id": "objectives/evasion/masquerade/extension/shebang::bash-shebang-first-line", "atk": "T1036.008", "mbc": "F0008", "conf": 0.949999988079071, "crit": 3, "desc": "File starts with" }, { "id": "metadata/file/metrics::low-string-density-large-file", "conf": 0.8999999761581421, "crit": 1, "desc": "Low string density in source", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/process/create/shell/spawn::shell-execution-comp", "atk": "T1059", "mbc": "E1059", "conf": 0.8999999761581421, "crit": 3, "desc": "Shell command execution capability", "from": [ { "file": 1 }, { "file": 2 } ], "spans": [ [ 0, 34 ] ] }, { "id": "micro-behaviors/process/create/shell/spawn::shell-symbols", "conf": 0.8999999761581421, "crit": 3, "desc": "Shell execution symbols", "from": [ { "off": 742, "file": 1, "line": 42 }, { "off": 742, "file": 2, "line": 42 } ], "spans": [ [ 0, 34 ] ] }, { "id": "micro-behaviors/os/env/vars/access::env-cmd", "atk": "T1082", "conf": 0.6000000238418579, "crit": 3, "desc": "env command path" }, { "id": "micro-behaviors/process/create/shell/spawn::sh-dynamic-command-target", "conf": 0.6000000238418579, "crit": 3, "desc": "Shell command name from variable", "spans": [ [ 0, 34 ] ] }, { "id": "micro-behaviors/process/interpreter/perl::perl-keyword", "conf": 0.699999988079071, "crit": 3, "desc": "perl interpreter keyword (beyond shebang)" } ] }, { "ctx": [ { "b": "boXZHx(kOBxA", "n": [ { "c": 3, "d": "File starts with", "i": "objectives/evasion/masquerade/extension/shebang::bash-shebang-first-line", "o": 0, "z": 9, "cf": 0.949999988079071 } ], "ln": 1, "addr": 0 }, { "b": "bl", "ln": 2, "addr": 10 }, { "b": "boOmbwPQmql](D7wNPaXAX8wRf!Lm8gb7BtfekjngCx}ah99DFiX\u0026xiCwhvCmr\u0026+]bM", "n": [ { "c": 2, "d": "NetBSD RCS ident keyword", "i": "metadata/binary/provenance::netbsd-rcs-id", "o": 14, "z": 8, "cf": 0.8999999761581421 } ], "ln": 3, "addr": 12 }, { "b": "", "ln": 4, "addr": 66 }, { "b": "q:\u003cwHjT8d9a]", "ln": 5, "addr": 67 }, { "b": "B7/o1BrAs", "ln": 8, "addr": 101 }, { "b": "", "ln": 9, "addr": 109 }, { "b": "l03Yxa$[7WAXy)ozzbBxyA-", "n": [ { "c": 2, "d": "Uses awk for text processing", "i": "well-known/tool/development/cli::awk-processing", "o": 124, "z": 3, "cf": 1.0 } ], "ln": 10, "addr": 110 }, { "b": "lp1Kspc?PyjT8L4B8\u0026{yx(kOkvrl0$vqPN1", "ln": 11, "addr": 129 }, { "b": "lQsWma$)ztzzbHdBrQ", "ln": 12, "addr": 158 }, { "b": "oI4#LmNo{DjT8L4B8\u0026{PvRGZky?W^5w)]Z%a]", "ln": 29, "addr": 469 }, { "b": "oIN.{fjFTkfkLII", "ln": 30, "addr": 499 }, { "b": "oJa7#fjFTkfkLXN", "n": [ { "c": 2, "d": "List directory contents via /bin/ls", "i": "micro-behaviors/fs/directory/readdir::readdir-ls", "o": 516, "z": 7, "cf": 0.6600000262260437 } ], "ln": 31, "addr": 512 }, { "b": "o?N(CqAViSvRGZkzeiV@AV=@Ma]", "ln": 32, "addr": 525 }, { "b": "o\u0026:z3zfv3Nw*d", "ln": 33, "addr": 547 }, { "b": "p^[nQh9AcpB-RNRAbf8tvRGZkAaK6aa]", "n": [ { "c": 3, "d": "perl interpreter keyword (beyond shebang)", "i": "micro-behaviors/process/interpreter/perl::perl-keyword", "o": 578, "z": 4, "cf": 0.699999988079071 } ], "ln": 34, "addr": 558 }, { "b": "p!Kq=k$1Bspcx^OB-RNRB7e\u003c3fk$YtuTWFZx(k9", "ln": 35, "addr": 584 }, { "b": "p!Kq=nLR-JjT8L4B8\u0026{PvRGZkAbf8[x(mK3a]", "ln": 36, "addr": 616 }, { "b": "qCxp#fjFTkflg[N", "ln": 38, "addr": 665 }, { "b": "qCxLJqAViSvRGZkA=2u3AV$", "ln": 39, "addr": 678 }, { "b": "q:\u003c8qa$[7WAXy)ozzc6xwfI", "n": [ { "c": 2, "d": "Uses sed for text processing", "i": "well-known/tool/development/cli::sed-processing", "o": 711, "z": 3, "cf": 1.0 } ], "ln": 40, "addr": 697 }, { "b": "q:\u003cUOpf6I4flItRfjFTkfj/3Aa]", "n": [ { "c": 3, "d": "env command path", "i": "micro-behaviors/os/env/vars/access::env-cmd", "o": 724, "z": 12, "cf": 0.6000000238418579 } ], "ln": 41, "addr": 716 }, { "b": "q+f4}fjFTkflp!J", "n": [ { "c": 3, "d": "Shell command execution capability", "i": "micro-behaviors/process/create/shell/spawn::shell-execution-comp", "o": 742, "z": 7, "cf": 0.8999999761581421 } ], "ln": 42, "addr": 738 }, { "b": "q+{p\u003cjT8L4B8\u0026{yx(kOBz/P}z", "ln": 43, "addr": 751 }, { "b": "q=L$8flItRfjFTkflqmW", "ln": 44, "addr": 772 }, { "b": "2{QM\u003cwO(vewGV5cwO=g7azbUjz6gGyByM$BxK#0@B1N", "ln": 108, "addr": 2025 }, { "b": "2{P", "ln": 109, "addr": 2060 }, { "b": "2{:\u003c%mn)flar.\u003cVCPXQ(d]O#coIuNRD\u0026", "n": [ { "c": 2, "d": "SHELL environment variable", "i": "micro-behaviors/os/env/vars/system-info::shell-var", "o": 2080, "z": 5, "cf": 0.5 } ], "ln": 110, "addr": 2063 }, { "b": "2)\u0026jqd]O#coIuNbmnlMUmiA\u003e5p!Kq=o*@2El{T^ruQNE-Ee", "ln": 111, "addr": 2089 }, { "b": "2{:\u003c%mn)flar.\u003cVCPXQ(d]O#coIuNRD\u0026", "ln": 112, "addr": 2127 } ], "depth": 1, "facts": { "imp": [ [ "", "shift" ], [ "", "shift" ], [ "", "{PWD_CMD}" ], [ "", "/usr/pkg/bin/mktexlsr" ], [ "", "/usr/pkg/bin/mktexlsr" ], [ "", "{TEST}" ], [ "", "./+OCAML_FINDLIB_REGISTER" ], [ "", "./+OCAML_FINDLIB_REGISTER" ], [ "", "{TEST}" ], [ "", "./+INFO_FILES" ], [ "", "./+INFO_FILES" ], [ "", "{TEST}" ], [ "", "./+ICON_THEMES" ], [ "", "./+ICON_THEMES" ], [ "", "{TEST}" ], [ "", "./+SHELL" ], [ "", "./+SHELL" ], [ "", "{TEST}" ], [ "", "./+SHELL" ], [ "", "./+SHELL" ], [ "", "{TEST}" ], [ "", "./+FILES" ], [ "", "./+FILES" ], [ "", "{TEST}" ], [ "", "./+FONTS" ], [ "", "./+FONTS" ], [ "", "{TEST}" ], [ "", "./+ICON_THEMES" ], [ "", "./+ICON_THEMES" ], [ "", "{TEST}" ], [ "", "./+SHLIBS" ], [ "", "./+SHLIBS" ], [ "", "{TEST}" ], [ "", "./+DIRS" ], [ "", "./+DIRS" ], [ "", "{TEST}" ], [ "", "./+USERGROUP" ], [ "", "./+USERGROUP" ], [ "", "{TEST}" ], [ "", "./+USERGROUP" ], [ "", "./+USERGROUP" ], [ "", "{TEST}" ], [ "", "./+FILES" ], [ "", "./+FILES" ], [ "", "{TEST}" ], [ "", "./+DIRS" ], [ "", "./+DIRS" ], [ "", "exit" ], [ "", "exit" ] ], "tgt": [ "${PWD_CMD}", "${TEST}", "./+DIRS", "./+FILES", "./+FONTS", "./+ICON_THEMES", "./+INFO_FILES", "./+OCAML_FINDLIB_REGISTER", "./+SHELL", "./+SHLIBS", "./+USERGROUP", "/usr/pkg/bin/mktexlsr", ":", "exit", "shift" ], "metrics": { "ast": { "max_depth": 7.0, "bind_count": 55.0, "call_count": 33.0, "node_count": 782.0, "identifier_count": 82.0, "string_literal_count": 53.0 }, "file": { "size": 3268.0, "entropy": 5.79, "size_bytes": 3268.0 }, "text": { "tab_count": 74.0, "digit_ratio": 0.04, "space_count": 216.0, "total_lines": 160.0, "char_entropy": 5.79, "mixed_indent": 1.0, "unique_chars": 84.0, "string_density": 0.33, "avg_line_length": 19.43, "max_line_length": 71.0, "empty_line_ratio": 0.1, "last_line_length": 6.0, "whitespace_ratio": 0.14, "most_common_ratio": 0.05, "identifier_density": 1.27, "line_length_stddev": 16.79, "normalized_string_count": 4.19, "suspicious_string_ratio": 0.02, "most_common_char_is_null": 0.0, "suspicious_comment_ratio": 0.1, "max_inline_whitespace_run": 1.0, "most_common_char_codepoint": 47.0, "normalized_unique_identifiers": 11.47 }, "binds": { "count": 55.0 }, "calls": { "count": 33.0, "dynamic_target_count": 15.0 }, "binary": { "overall_entropy": 5.79, "peak_region_bytes": 3268.0, "peak_region_entropy": 5.79 }, "strings": { "total": 53.0, "avg_length": 10.7, "max_length": 40.0, "path_count": 39.0, "avg_entropy": 2.85, "empty_count": 2.0, "total_bytes": 567.0, "entropy_stddev": 0.67, "shell_command_strings": 1.0 }, "comments": { "chars": 696.0, "lines": 17.0, "total": 39.0, "to_code_ratio": 0.12, "empty_comments": 22.0, "high_entropy_comments": 4.0 }, "identifiers": { "count": 82.0, "total": 203.0, "avg_length": 6.88, "max_length": 25.0, "min_length": 1.0, "avg_entropy": 2.25, "reuse_ratio": 0.41, "unique_count": 84.0, "length_stddev": 5.18, "has_digit_ratio": 0.06, "single_char_count": 5.0, "single_char_ratio": 0.06, "high_entropy_count": 7.0, "high_entropy_ratio": 0.08, "all_lowercase_ratio": 0.04, "all_uppercase_ratio": 0.7, "numeric_suffix_count": 1.0, "underscore_prefix_count": 1.0 } } }, "id": 1, "mol": "O(Er)H(Po₂)", "path": "tex-pictex-1.1b.tgz!!+DEINSTALL", "risk": 4, "sha": "1c1b9b58a3fe1890ad542921fe0846a7a65eaa38a0aa37c40c5d3fd0c16254c2", "size": 3268, "traits": [ { "id": "micro-behaviors/process/create/shell/spawn::bin-sh", "atk": "T1059.004", "mbc": "E1059.004", "conf": 0.6000000238418579, "crit": 3, "desc": "References /bin/sh (Bourne shell)", "spans": [ [ 742, 7 ] ] }, { "id": "micro-behaviors/os/env/vars/access::env-cmd", "atk": "T1082", "conf": 0.6000000238418579, "crit": 3, "desc": "env command path", "spans": [ [ 724, 12 ] ] }, { "id": "objectives/evasion/masquerade/extension/shebang::bash-shebang-first-line", "atk": "T1036.008", "mbc": "F0008", "conf": 0.949999988079071, "crit": 3, "desc": "File starts with", "spans": [ [ 0, 9 ] ] }, { "id": "micro-behaviors/process/interpreter/perl::perl-keyword", "conf": 0.699999988079071, "crit": 3, "desc": "perl interpreter keyword (beyond shebang)", "spans": [ [ 578, 4 ] ] }, { "id": "micro-behaviors/process/create/shell/spawn::sh-dynamic-command-target", "conf": 0.6000000238418579, "crit": 3, "desc": "Shell command name from variable", "spans": [ [ 0, 34 ] ] }, { "id": "micro-behaviors/process/create/shell/spawn::shell-execution-comp", "atk": "T1059", "mbc": "E1059", "conf": 0.8999999761581421, "crit": 3, "desc": "Shell command execution capability", "spans": [ [ 0, 34 ], [ 742, 7 ] ] }, { "id": "micro-behaviors/process/create/shell/spawn::shell-symbols", "conf": 0.8999999761581421, "crit": 3, "desc": "Shell execution symbols", "spans": [ [ 0, 34 ], [ 742, 7 ] ] } ], "type": "shell" }, { "ctx": [ { "b": "boXZHx(kOBxA", "n": [ { "c": 3, "d": "File starts with", "i": "objectives/evasion/masquerade/extension/shebang::bash-shebang-first-line", "o": 0, "z": 9, "cf": 0.949999988079071 } ], "ln": 1, "addr": 0 }, { "b": "bl", "ln": 2, "addr": 10 }, { "b": "boOmbwPQmql](D7wNPaXAX8wRf!Lm8gb7BtfekjngCx}ah99DFiX\u0026xiCwhvCmr\u0026+]bM", "n": [ { "c": 2, "d": "NetBSD RCS ident keyword", "i": "metadata/binary/provenance::netbsd-rcs-id", "o": 14, "z": 8, "cf": 0.8999999761581421 } ], "ln": 3, "addr": 12 }, { "b": "", "ln": 4, "addr": 66 }, { "b": "q:\u003cwHjT8d9a]", "ln": 5, "addr": 67 }, { "b": "B7/o1BrAs", "ln": 8, "addr": 101 }, { "b": "", "ln": 9, "addr": 109 }, { "b": "l03Yxa$[7WAXy)ozzbBxyA-", "n": [ { "c": 2, "d": "Uses awk for text processing", "i": "well-known/tool/development/cli::awk-processing", "o": 124, "z": 3, "cf": 1.0 } ], "ln": 10, "addr": 110 }, { "b": "lp1Kspc?PyjT8L4B8\u0026{yx(kOkvrl0$vqPN1", "ln": 11, "addr": 129 }, { "b": "lQsWma$)ztzzbHdBrQ", "ln": 12, "addr": 158 }, { "b": "oI4#LmNo{DjT8L4B8\u0026{PvRGZky?W^5w)]Z%a]", "ln": 29, "addr": 469 }, { "b": "oIN.{fjFTkfkLII", "ln": 30, "addr": 499 }, { "b": "oJa7#fjFTkfkLXN", "n": [ { "c": 2, "d": "List directory contents via /bin/ls", "i": "micro-behaviors/fs/directory/readdir::readdir-ls", "o": 516, "z": 7, "cf": 0.6600000262260437 } ], "ln": 31, "addr": 512 }, { "b": "o?N(CqAViSvRGZkzeiV@AV=@Ma]", "ln": 32, "addr": 525 }, { "b": "o\u0026:z3zfv3Nw*d", "ln": 33, "addr": 547 }, { "b": "p^[nQh9AcpB-RNRAbf8tvRGZkAaK6aa]", "n": [ { "c": 3, "d": "perl interpreter keyword (beyond shebang)", "i": "micro-behaviors/process/interpreter/perl::perl-keyword", "o": 578, "z": 4, "cf": 0.699999988079071 } ], "ln": 34, "addr": 558 }, { "b": "p!Kq=k$1Bspcx^OB-RNRB7e\u003c3fk$YtuTWFZx(k9", "ln": 35, "addr": 584 }, { "b": "p!Kq=nLR-JjT8L4B8\u0026{PvRGZkAbf8[x(mK3a]", "ln": 36, "addr": 616 }, { "b": "qCxp#fjFTkflg[N", "ln": 38, "addr": 665 }, { "b": "qCxLJqAViSvRGZkA=2u3AV$", "ln": 39, "addr": 678 }, { "b": "q:\u003c8qa$[7WAXy)ozzc6xwfI", "n": [ { "c": 2, "d": "Uses sed for text processing", "i": "well-known/tool/development/cli::sed-processing", "o": 711, "z": 3, "cf": 1.0 } ], "ln": 40, "addr": 697 }, { "b": "q:\u003cUOpf6I4flItRfjFTkfj/3Aa]", "n": [ { "c": 3, "d": "env command path", "i": "micro-behaviors/os/env/vars/access::env-cmd", "o": 724, "z": 12, "cf": 0.6000000238418579 } ], "ln": 41, "addr": 716 }, { "b": "q+f4}fjFTkflp!J", "n": [ { "c": 3, "d": "Shell command execution capability", "i": "micro-behaviors/process/create/shell/spawn::shell-execution-comp", "o": 742, "z": 7, "cf": 0.8999999761581421 } ], "ln": 42, "addr": 738 }, { "b": "q+{p\u003cjT8L4B8\u0026{yx(kOBz/P}z", "ln": 43, "addr": 751 }, { "b": "q=L$8flItRfjFTkflqmW", "ln": 44, "addr": 772 }, { "b": "2{QM\u003cwOkZ#By/FnB7/c3y\u0026Z.kzxHPzByM$BxK#0@B1N", "ln": 142, "addr": 2924 }, { "b": "2{P", "ln": 143, "addr": 2959 }, { "b": "2{:\u003c%mn)flar.\u003cVCPXQ(d]O#coIuNRD\u0026", "n": [ { "c": 2, "d": "SHELL environment variable", "i": "micro-behaviors/os/env/vars/system-info::shell-var", "o": 2979, "z": 5, "cf": 0.5 } ], "ln": 144, "addr": 2962 }, { "b": "2)\u0026jqd]O#coIuM{l{@dyDR^v9uRJ%*k$11rl0)2KqHF", "ln": 145, "addr": 2988 }, { "b": "2{:\u003c%mn)flar.\u003cVCPXQ(d]O#coIuNRD\u0026", "ln": 146, "addr": 3023 } ], "depth": 1, "facts": { "imp": [ [ "", "shift" ], [ "", "shift" ], [ "", "{PWD_CMD}" ], [ "", "{SH}" ], [ "", "{TEST}" ], [ "", "./+USERGROUP" ], [ "", "./+USERGROUP" ], [ "", "./+USERGROUP" ], [ "", "./+USERGROUP" ], [ "", "exit" ], [ "", "exit" ], [ "", "{TEST}" ], [ "", "./+DIRS" ], [ "", "./+DIRS" ], [ "", "{TEST}" ], [ "", "./+DIRS" ], [ "", "./+DIRS" ], [ "", "{TEST}" ], [ "", "./+SHLIBS" ], [ "", "./+SHLIBS" ], [ "", "{TEST}" ], [ "", "./+FILES" ], [ "", "./+FILES" ], [ "", "{TEST}" ], [ "", "./+FILES" ], [ "", "./+FILES" ], [ "", "{TEST}" ], [ "", "./+PERMS" ], [ "", "./+PERMS" ], [ "", "{TEST}" ], [ "", "./+FONTS" ], [ "", "./+FONTS" ], [ "", "{TEST}" ], [ "", "./+ICON_THEMES" ], [ "", "./+ICON_THEMES" ], [ "", "{TEST}" ], [ "", "./+DIRS" ], [ "", "./+DIRS" ], [ "", "{TEST}" ], [ "", "./+DIRS" ], [ "", "./+DIRS" ], [ "", "{TEST}" ], [ "", "./+FILES" ], [ "", "./+FILES" ], [ "", "{TEST}" ], [ "", "./+FILES" ], [ "", "./+FILES" ], [ "", "{TEST}" ], [ "", "./+SHELL" ], [ "", "./+SHELL" ], [ "", "{TEST}" ], [ "", "./+SHELL" ], [ "", "./+SHELL" ], [ "", "{TEST}" ], [ "", "./+INFO_FILES" ], [ "", "./+INFO_FILES" ], [ "", "{TEST}" ], [ "", "./+OCAML_FINDLIB_REGISTER" ], [ "", "./+OCAML_FINDLIB_REGISTER" ], [ "", "/usr/pkg/bin/mktexlsr" ], [ "", "/usr/pkg/bin/mktexlsr" ], [ "", "exit" ], [ "", "exit" ] ], "tgt": [ "${PWD_CMD}", "${SH}", "${TEST}", "./+DIRS", "./+FILES", "./+FONTS", "./+ICON_THEMES", "./+INFO_FILES", "./+OCAML_FINDLIB_REGISTER", "./+PERMS", "./+SHELL", "./+SHLIBS", "./+USERGROUP", "/usr/pkg/bin/mktexlsr", ":", "exit", "shift" ], "metrics": { "ast": { "max_depth": 9.0, "bind_count": 55.0, "call_count": 43.0, "node_count": 882.0, "identifier_count": 84.0, "string_literal_count": 53.0 }, "file": { "size": 3621.0, "entropy": 5.73, "size_bytes": 3621.0 }, "text": { "tab_count": 96.0, "digit_ratio": 0.04, "space_count": 283.0, "total_lines": 177.0, "char_entropy": 5.73, "mixed_indent": 1.0, "unique_chars": 84.0, "string_density": 0.3, "avg_line_length": 19.46, "max_line_length": 73.0, "empty_line_ratio": 0.1, "last_line_length": 6.0, "whitespace_ratio": 0.15, "most_common_ratio": 0.04, "identifier_density": 1.36, "line_length_stddev": 16.64, "normalized_string_count": 3.98, "suspicious_string_ratio": 0.02, "most_common_char_is_null": 0.0, "suspicious_comment_ratio": 0.1, "max_inline_whitespace_run": 1.0, "most_common_char_codepoint": 47.0, "normalized_unique_identifiers": 11.65 }, "binds": { "count": 55.0 }, "calls": { "count": 43.0, "dynamic_target_count": 19.0 }, "binary": { "overall_entropy": 5.73, "peak_region_bytes": 3621.0, "peak_region_entropy": 5.71 }, "strings": { "total": 53.0, "avg_length": 10.7, "max_length": 40.0, "path_count": 39.0, "avg_entropy": 2.85, "empty_count": 2.0, "total_bytes": 567.0, "entropy_stddev": 0.67, "shell_command_strings": 1.0 }, "comments": { "chars": 762.0, "lines": 18.0, "total": 42.0, "to_code_ratio": 0.11, "empty_comments": 24.0, "high_entropy_comments": 4.0 }, "identifiers": { "count": 84.0, "total": 241.0, "avg_length": 6.68, "max_length": 25.0, "min_length": 1.0, "avg_entropy": 2.24, "reuse_ratio": 0.36, "unique_count": 87.0, "length_stddev": 4.98, "has_digit_ratio": 0.06, "single_char_count": 5.0, "single_char_ratio": 0.06, "high_entropy_count": 7.0, "high_entropy_ratio": 0.08, "all_lowercase_ratio": 0.03, "all_uppercase_ratio": 0.68, "numeric_suffix_count": 1.0, "underscore_prefix_count": 1.0 } } }, "id": 2, "mol": "O(Er)H(Po₂)", "path": "tex-pictex-1.1b.tgz!!+INSTALL", "risk": 4, "sha": "ae1146b1beaf9ab3bcfe72b8293818934a1a5e43181d7744e1dd2ba9d7dfb279", "size": 3621, "traits": [ { "id": "micro-behaviors/process/create/shell/spawn::bin-sh", "atk": "T1059.004", "mbc": "E1059.004", "conf": 0.6000000238418579, "crit": 3, "desc": "References /bin/sh (Bourne shell)", "spans": [ [ 742, 7 ] ] }, { "id": "micro-behaviors/os/env/vars/access::env-cmd", "atk": "T1082", "conf": 0.6000000238418579, "crit": 3, "desc": "env command path", "spans": [ [ 724, 12 ] ] }, { "id": "objectives/evasion/masquerade/extension/shebang::bash-shebang-first-line", "atk": "T1036.008", "mbc": "F0008", "conf": 0.949999988079071, "crit": 3, "desc": "File starts with", "spans": [ [ 0, 9 ] ] }, { "id": "micro-behaviors/process/interpreter/perl::perl-keyword", "conf": 0.699999988079071, "crit": 3, "desc": "perl interpreter keyword (beyond shebang)", "spans": [ [ 578, 4 ] ] }, { "id": "micro-behaviors/process/create/shell/spawn::sh-dynamic-command-target", "conf": 0.6000000238418579, "crit": 3, "desc": "Shell command name from variable", "spans": [ [ 0, 34 ] ] }, { "id": "micro-behaviors/process/create/shell/spawn::shell-execution-comp", "atk": "T1059", "mbc": "E1059", "conf": 0.8999999761581421, "crit": 3, "desc": "Shell command execution capability", "spans": [ [ 0, 34 ], [ 742, 7 ] ] }, { "id": "micro-behaviors/process/create/shell/spawn::shell-symbols", "conf": 0.8999999761581421, "crit": 3, "desc": "Shell execution symbols", "spans": [ [ 0, 34 ], [ 742, 7 ] ] } ], "type": "shell" }, { "ctx": [ { "b": "b{kJ*zEENhaARTnwGUJ7vrVB6xcp]aawuiywMQ6$B7]J8aARpdaw==traPeOzdc{{z/WJrb)\u003e}vmpZQJA+3p!e*a56x(mN4y?aUpA+e%5xk.P%kX1\u003c/B.L#de[FNodgdvzpgmTCB.@l?wPz\u003c9z*b]qDlsRNvpJ$[z9RPLe{g(Jv\u003eIt6BTWUz3s4W#AaJ%gBBct*zEENhaxiw)wGTYQv@=Hee*8omwO+{^B7F(8f/QpFvqWhxixn/Qaz(4cx\u003ez6\u003cwb", "ln": 0, "col": 1, "line": 1 }, { "b": "A=l1wvrb{4x(k5nxK@r9BZ/f3v\u003c2r2zddc@e*8otz/)gtvr\u0026#rB7DFoxK#36vqYP#v@DsiaARpdz6ine3mc*sx(4PpaAhvtC4\u003eF#wfueoBS+ZoByw)3aARpdayPzmxM4{jxLzAdx(mK3A=2lbx(v(w3mc393mc/{q:A]xiV}WHA+e/^z/x/jz/f01aAzysBrCTIzdmB1u3*y0w]]epBZ/DkwO3ppA+Pf1BrCTEvSVT4wQK[i3mc/:z/M$iCWUDdy?kd8b)\u003e}varR^HtY+0$wM@nx3mc/qarR^HarV2oB7GD7z/*59BAg@7tuUqtb{jrMarR^HarR^HDT7S6BAqwpx\u003egE\u003cA+e/^sZuw.Es3x\u003c3mc/qarQ", "ln": 232, "col": 12, "line": 8 }, { "b": "zxJz1aA.:pwftP7ayPekay/tcBy/YsazCZooKQ[ispct%z/M%%x*U\u003chss$Zsra]YZazC)FaBd)Fay!?$azthbwH[%Bvr\u003cyDBywS{wPF#jw/#howO2{9z!pb6ADLYix(v)ge^-)ib)\u003e}vs3Y.VnLR=pavHb\u003czF%RtB-RapBzbkdBzkM4wGSyIdiJ5uaARpdazbtdB95KmxKL{\u0026v/", "ln": 737, "col": 39, "line": 25 }, { "b": "zdmB1azbLjayPdgx(n37A=br4az#adwEo.aarR^HarR^HarR^HarR^HarR^HarR^Haxiw)wGUL{xjVcbv@Dm5wN/*@zF78lzY\u003cdnwGUI{w)]*#BrCEtwmV)8D2m2eyZIEharR^HarR^HarR^HarR^HarR^HarR^HaA}Koy-)weaARJAx(\u003e.zay!#2By/FBarTE4xK#ibBAg@7az27@wPF#rx(4PdvR2()arR^HarR^HarR^HarR^HarR^HarR^Hao", "ln": 1281, "col": 53, "line": 37 }, { "b": "arR^HarR^HarR^HarR^HaBvv9vScHrEslJ(3mc393mc/.z/c}Aazbs#wnC*1CwhejaARpdaAITEw[AfcxKM09w]zH4z*cm:azC{BB0b76x(X3nay]51x\u003e7N[wIaro3mc/@z/PSczF78nvrc6\u003cvR/Q%3mc3:v{%E?z!9A!kS{?Rb))){wP}W0zdNP\u0026", "ln": 2024, "col": 8, "line": 59 }, { "b": "ar@W9A=k(r3mc3:xKLZ?B9g@lA+e*6wPf!qB9g@lA+e*6wPe+marR^MavHb\u003cBzbxfay!?@v%8P@BzkVhazbLjaz1$\u003exDRhhwmV)8zY\u0026+oB1P6$3s4aQC4\u003eF#tXELZw]\u002697BAg@7B7GqkvTf7KarR^Hasec.e?RrQy\u0026%qiv{%l$C42ApaARpqz/]Yaz/{dABzbkdBAg@73mc3:x\u003eIs4A+frhvpJ\u003e\u0026b)\u003e}9b{l8%v%8*kx)a67C{3TrvrS\u0026iz/fc6AccvFy?mj2aAIWmBAg@73mc3:x\u003ezO", "ln": 4492, "col": 58, "line": 120 } ], "depth": 1, "facts": { "imp": [ [ "", "M.Reingold" ], [ "", "Dershowitz" ], [ "", "catcode" ] ], "mbr": [ "M.Reingold", "cs.uiuc", "cs.uiuc.edu", "domain.You", "tree.newdimen" ], "tgt": [ "Dershowitz", "M.Reingold", "catcode" ], "metrics": { "ast": { "op.mod": 24, "op.bnot": 1, "max_depth": 15, "call_count": 3, "node_count": 1783, "member_count": 5, "op_density.mod": 0.01, "sequence_count": 1, "op_density.bnot": 0, "member_depth_max": 3 }, "file": { "size": 11382, "entropy": 4.7 }, "text": { "lines": 353, "top_char": 101, "max_ws_run": 38, "digit_ratio": 0.03, "space_count": 2016, "char_entropy": 4.7, "unique_chars": 85, "top_char_null": 0, "string_density": 0.01, "top_char_ratio": 0.08, "avg_line_length": 31.24, "max_line_length": 79, "last_line_length": 14, "whitespace_ratio": 0.21, "identifier_density": 0.66, "line_length_stddev": 26.02, "normalized_string_count": 0.11, "repeated_char_sequences": 31, "suspicious_string_ratio": 0.5, "trailing_whitespace_lines": 2, "suspicious_identifier_ratio": 0.06, "normalized_unique_identifiers": 16.78 }, "binds": { "count": 6 }, "binary": { "peak_region_bytes": 9334, "peak_region_entropy": 4.77 }, "strings": { "sql": 1, "bytes": 9065, "count": 2, "very_long": 1, "avg_length": 4532.5, "max_length": 9025, "avg_entropy": 4.13, "unicode_heavy": 1, "entropy_stddev": 0.6 }, "consistency": { "extension_content_mismatch": 1, "extension_content_mismatch.script_as_unknown": 1 }, "identifiers": { "count": 234, "unique": 142, "avg_length": 5.25, "max_length": 11, "min_length": 1, "avg_entropy": 1.97, "reuse_ratio": 0.61, "length_stddev": 2.62, "sequential_names": 9, "single_char_count": 10, "single_char_ratio": 0.07, "all_lowercase_ratio": 0.76, "all_uppercase_ratio": 0.06 } } }, "id": 3, "mol": "O(Xe)Md", "path": "tex-pictex-1.1b.tgz!!share/texmf-dist/tex/generic/pictex/tree.sty", "pid": 93, "risk": 3, "sha": "2eb0302eedb98cc004e00e4ed72cc954ca1498c010431743ada1f7734348e6ee", "size": 11382, "traits": [ { "id": "metadata/file/extension/identity::script-content-extension-mismatch", "conf": 0.9, "crit": 3, "desc": "Script content mismatches extension" }, { "id": "metadata/lang/natural::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"", "spans": [ [ 37, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-2", "conf": 0.8, "crit": 1, "desc": "English function-word token \"and\"", "spans": [ [ 280, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-3", "conf": 0.8, "crit": 1, "desc": "English function-word token \"that\"", "spans": [ [ 785, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-4", "conf": 0.8, "crit": 1, "desc": "English function-word token \"have\"", "spans": [ [ 802, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "spans": [ [ 427, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-6", "conf": 0.8, "crit": 1, "desc": "English function-word token \"with\"", "spans": [ [ 2072, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-7", "conf": 0.8, "crit": 1, "desc": "English function-word token \"this\"", "spans": [ [ 4540, 0 ] ] }, { "id": "objectives/anti-static/obfuscation/code-metrics/strings::few-strings", "atk": "T1027", "mbc": "B0032", "conf": 0.4, "crit": 3, "desc": "Very few string literals" }, { "id": "objectives/execution/lure/countdown::lure-please-wait", "atk": "T1204.001", "mbc": "F0007", "conf": 0.7, "crit": 3, "desc": "Please-wait connecting status text", "spans": [ [ 1345, 13 ] ] }, { "id": "metadata/file/naming::sequential-identifiers", "conf": 0.8, "crit": 2, "desc": "Sequential source identifier names" } ], "type": "javascript" }, { "ctx": [ { "b": "b{lf2x(+zhB0bpcBy/Yox\u003e86\u003cyi81HwQ2:Gr+lq)x(v(if!Lg6auq8ff!UHB", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 2, "z": 4, "cf": 0.800000011920929 } ], "ln": 1, "addr": 0 }, { "b": "", "ln": 2, "addr": 49 }, { "b": "b{lf2x(+zex(4u6zddi\u003eB0bNrwGTVPraPeOy?W=#efGaEv@#TfefFCpA:@]%efFwswft/lvqE5@z/fSrA=\u003e(lx(v)gao", "ln": 3, "addr": 50 } ], "depth": 1, "facts": { "metrics": { "ast": { "max_depth": 4.0, "call_count": 0.0, "node_count": 17.0, "identifier_count": 4.0 }, "file": { "size": 10519.0, "entropy": 4.66, "size_bytes": 10519.0 }, "text": { "digit_ratio": 0.03, "space_count": 1830.0, "total_lines": 482.0, "char_entropy": 4.66, "unique_chars": 72.0, "escape_density": 0.08, "avg_line_length": 20.82, "max_line_length": 73.0, "empty_line_ratio": 0.1, "last_line_length": 27.0, "whitespace_ratio": 0.22, "most_common_ratio": 0.09, "identifier_density": 0.01, "line_length_stddev": 14.87, "unicode_escape_count": 8.0, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 2.0, "trailing_whitespace_lines": 153.0, "most_common_char_codepoint": 92.0, "normalized_unique_identifiers": 0.45 }, "binary": { "overall_entropy": 4.66, "peak_region_bytes": 7447.0, "peak_region_entropy": 4.89 }, "consistency": { "extension_content_mismatch": 1.0, "extension_content_mismatch.source_as_unknown": 1.0 }, "identifiers": { "count": 4.0, "total": 4.0, "avg_length": 6.5, "max_length": 12.0, "min_length": 3.0, "avg_entropy": 2.49, "reuse_ratio": 1.0, "unique_count": 4.0, "length_stddev": 3.5, "high_entropy_count": 1.0, "high_entropy_ratio": 0.25, "all_lowercase_ratio": 0.5 } } }, "id": 4, "path": "tex-pictex-1.1b.tgz!!share/texmf-dist/tex/generic/pictex/latexpicobjs.tex", "risk": 1, "sha": "9f0552e4a33ec23118a58562f65c82311435cb4fc75506ba2191ff8e9c936f57", "size": 10519, "traits": [ { "id": "metadata/file/profile/language::lang-english", "conf": 0.800000011920929, "crit": 2, "desc": "English language detection", "spans": [ [ 2, 4 ] ] } ], "type": "kotlin" } ], "rev": "868bd", "v": "8" } }