{
  "ml": {
    "l": -1,
    "v": "6",
    "fs": [
      {
        "l": -1,
        "id": 0,
        "prob": 0.9134063720703125
      }
    ],
    "prob": 0.9134064,
    "models": [
      {
        "m": "az",
        "raw": 0.39558476,
        "prob": 0.9134064,
        "class": 0
      },
      {
        "m": "az/source",
        "raw": 0.061439473,
        "prob": 0.91582,
        "class": 0
      },
      {
        "m": "az/c",
        "raw": 0.53114873,
        "prob": 0.7894737,
        "class": 0
      }
    ],
    "version": "v17.17",
    "analyzed_at": "2026-06-07T20:02:23Z"
  },
  "path": "config.h",
  "raw": {
    "v": "6",
    "fs": [
      {
        "f": "O(Er)H(Os)",
        "x": 39,
        "ff": {
          "m": {
            "ast": {
              "max_depth": 3.0,
              "call_count": 0.0,
              "node_count": 53.0,
              "identifier_count": 10.0
            },
            "file": {
              "size": 735.0,
              "entropy": 5.12,
              "size_bytes": 735.0
            },
            "text": {
              "digit_ratio": 0.06,
              "space_count": 91.0,
              "total_lines": 30.0,
              "char_entropy": 5.12,
              "unique_chars": 60.0,
              "avg_line_length": 23.5,
              "max_line_length": 71.0,
              "empty_line_ratio": 0.3,
              "last_line_length": 6.0,
              "whitespace_ratio": 0.16,
              "most_common_ratio": 0.07,
              "identifier_density": 0.37,
              "line_length_stddev": 21.74,
              "repeated_char_sequences": 1.0,
              "most_common_char_is_null": 0.0,
              "max_inline_whitespace_run": 1.0,
              "most_common_char_codepoint": 101.0,
              "normalized_unique_identifiers": 2.04
            },
            "binary": {
              "overall_entropy": 5.12
            },
            "comments": {
              "chars": 387.0,
              "lines": 11.0,
              "total": 11.0,
              "to_code_ratio": 0.58
            },
            "identifiers": {
              "count": 10.0,
              "total": 11.0,
              "avg_length": 8.1,
              "max_length": 16.0,
              "min_length": 3.0,
              "avg_entropy": 2.6,
              "reuse_ratio": 0.91,
              "unique_count": 10.0,
              "length_stddev": 3.73,
              "all_uppercase_ratio": 1.0
            }
          },
          "v": {
            "file.stem": "config",
            "file.basename": "config.h",
            "source.language": "c"
          },
          "id": "c"
        },
        "id": 0,
        "sz": 735,
        "ts": [
          {
            "c": 0.8600000143051147,
            "d": "Kill hook hide markers",
            "e": [
              "hide"
            ],
            "i": "objectives/evasion/kernel-hide/hook::kill-hook-hide-context",
            "l": 1
          },
          {
            "c": 0.20000000298023224,
            "d": "output keyword",
            "e": [
              "output"
            ],
            "i": "micro-behaviors/data/text/keywords/lexicon::output",
            "l": 1
          },
          {
            "c": 0.20000000298023224,
            "d": "encrypted-file trailer vocabulary",
            "e": [
              "magic"
            ],
            "i": "micro-behaviors/data/text/keywords/lexicon::encrypted-trailer-vocab",
            "l": 1
          },
          {
            "c": 0.7799999713897705,
            "d": "Regex component marker",
            "e": [
              "hide for file"
            ],
            "i": "objectives/evasion/kernel-hide/ebpf::bpf-rootkit-controller-actions--rx-6",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "Destructive delete verb",
            "e": [
              "remove"
            ],
            "i": "micro-behaviors/data/text/keywords/lexicon::delete-verb",
            "l": 1
          },
          {
            "c": 0.9700000286102295,
            "d": "Validation vocabulary string",
            "e": [
              "STRING"
            ],
            "i": "metadata/file/text/format::vocab-string",
            "l": 1
          },
          {
            "c": 0.8399999737739563,
            "d": "password/token/api_key field keyword",
            "e": [
              "password"
            ],
            "i": "micro-behaviors/data/text/keywords/credential::credential-field",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Code explicitly mentions malware/backdoor",
            "e": [
              "/* magic source port to trigger accept() backdoor */",
              "/* password for accept() backdoor shell */"
            ],
            "i": "objectives/evasion/kernel-hide/lkm/hiding::malware-mention-comment-backdoor",
            "l": 3,
            "el": [
              "@64",
              "@548"
            ]
          },
          {
            "d": "hide keyword",
            "e": [
              "hide"
            ],
            "i": "micro-behaviors/data/text/keywords/lexicon::hide",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Code explicitly mentions rootkit",
            "e": [
              "/* location of rootkit on disk */"
            ],
            "i": "objectives/evasion/kernel-hide/lkm/hiding::rootkit-mention-comment",
            "l": 3,
            "el": [
              "@621"
            ]
          },
          {
            "d": "password keyword",
            "e": [
              "password"
            ],
            "i": "micro-behaviors/data/text/keywords/lexicon::password",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "netstat command",
            "e": [
              "netstat"
            ],
            "i": "micro-behaviors/os/network/status::netstat",
            "l": 3
          },
          {
            "c": 0.949999988079071,
            "d": "Code explicitly mentions privilege escalation",
            "e": [
              "Privilege Escalation"
            ],
            "i": "objectives/evasion/kernel-hide/lkm/hiding::privilege-escalation-mention-comment",
            "l": 4
          }
        ],
        "sha": "ef662c71d0639fb207b9b37cf1ebd784b5f6712b6f2caaabdcd02930d77c4dec",
        "path": "config.h",
        "type": "c"
      }
    ],
    "tv": "318d5"
  }
}