{
  "ml": {
    "v": "7",
    "eng": "2.9.1",
    "lvl": -1,
    "conf": 0,
    "mods": [
      {
        "cls": 0,
        "raw": 0.000017821789,
        "rte": "az",
        "prob": 0.000017821789
      }
    ],
    "prob": 0.000017821789,
    "files": [
      {
        "id": 0,
        "lvl": -1,
        "conf": 0,
        "prob": 0.000017821788787841797,
        "type": "gz"
      },
      {
        "id": 1,
        "lvl": -1,
        "conf": 0,
        "prob": 0.000013569991097028833,
        "type": "c"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-09-11T23:31:41Z"
  },
  "path": "shadow.3.gz",
  "raw": {
    "files": [
      {
        "id": 0,
        "mol": "H₂(CmOs)",
        "sha": "f116a3a4b7e3f36849ed681cdeed636081dbee159ecb8350263efdfecab6412f",
        "path": "shadow.3.gz",
        "risk": 2,
        "size": 1825,
        "type": "gz",
        "facts": {
          "metrics": {
            "file": {
              "size": 1825,
              "entropy": 7.9
            },
            "binary": {
              "peak_region_bytes": 1825,
              "peak_region_entropy": 7.8
            }
          }
        },
        "traits": [
          {
            "id": "micro-behaviors/os/user/lookup::fgetspent",
            "conf": 0.8,
            "crit": 3,
            "desc": "Read shadow entries from a file",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "micro-behaviors/os/user/lookup::getspnam",
            "atk": "T1003.008",
            "mbc": "E1003.008",
            "conf": 0.8,
            "crit": 3,
            "desc": "Resolve shadow password entry (getspnam)",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/url/scheme::cleartext-http-url-code-literal",
            "atk": "T1071.001",
            "mbc": "C0002",
            "conf": 0.9,
            "crit": 3,
            "desc": "Code embeds cleartext HTTP URL literal",
            "from": [
              {
                "file": 1
              }
            ]
          }
        ]
      },
      {
        "ctx": [
          {
            "b": "cTm\u0026rBp6T9a%n0JarTS$BzLIHaAIj8wn=V0e)GOyarR^)B-.qnAYLsnB.\u003e=2zF\u003c2dmSI{Pv}xZ7nmuTNxBlv%a%ox!zE)\u0026%Bz(gXavHcTlt{^TaxRMoax9xcy?mW3wO2$8",
            "ln": 0,
            "col": 1,
            "line": 1
          },
          {
            "b": "iV@GSvpTq2eP(eHy\u0026ZZQe?]pqgZU\u003cua%n14vqY.2vp%djaw=#)x(^}{e)GOce(Uv:b2.2#l@c(dar\u0026P=ar\u0026G]febalf/.iEa%n7JxKLB\u0026Cu=.xBzkMjat^sIe?]p\u0026cn4b0ar\u003cG[vSC)$C{2E.y\u00261ep3nbNcat2e%eIeLaeIeLaeIeLaeIeLaeIeLaeIeLaeIeLaeIeK",
            "ln": 208,
            "col": 14,
            "line": 7
          },
          {
            "b": "ETV-{ETV-{ETV-{ETV-{ETV-{ETV-{EHmYja%pMvBz%n]fjG6pB1R0mvRGm*e]L=yfeUBxhA9A0e)GOyxMOuniXJd5x(!xqe[Y6Ae]L=yfjw)hxLzT3fkbDAy+GBwz!rPmgb7yxeIF}kzf6tzfFCjqe[/uzyZI!1a%qt-ETV-{ETV-{ETV-{ETV-{ETV-{ETV-{ETV-{ETV-{ETV-{ETV-{ETV-{ETV-{ETV-{ETV-{ETV-{ETV.Me[[(ttY7@xxcn*qB09+*ay3s6Asasfy-\u003c\u0026yarR^He[x2Cl2!1{3nbNcat2e%eIeLaeIeLaeD",
            "ln": 549,
            "col": 45,
            "line": 14
          },
          {
            "b": "A^qRCwN({5vrlHlz/Pwhw[=6)aAzyyBzkS7A%:J#nfx9Poi-\u003e#oHh6wnKjKce(kvKtXlLLx(mA%B.25ajACgAwn=V%cn5%}tXl\u003eve(kvKtXlMGBAhIlBrCTzCvR*CxjVgaAaJ{ec[dk.w(n%*p/4H7w\u003ev5=A=\u003e(laAIHCwfrvmwPS0jzEExgv}Yp\u003etXl\u003evtXlLSzEEx[tXl(sw\u003esBktXl\u003eve(kvKtXlMJz!S-8B7GDmAaJ{ec[dk.w(n%*p/4H7w\u003eve:x\u003eet$zE^*cwO#Prdly^Dqvk3MpZQDtnPO#]BZ]IoB8VtlasZ#owPS0jwO#PrmOcoxtXl\u003evtXlLSw]I0!qE0*9dly^Dqvk3MpZQDtnPO#]BZ]IoB8Vtlas.CBwPS0jwO#Prv}Yp\u003etXl\u003evtXlLSv@LW+qE0*9dly^Dqvk3MpZQDtnOJ6:aAhEBB8UYdBsqiLA=\u003e(laAIHCwl-.A3s4gmdSu}zw(n$v",
            "ln": 1257,
            "col": 24,
            "line": 31
          },
          {
            "b": "w*/8\u0026tXl\u003eve(Lp-b2q3bqZ8M3p/4H7w\u003ev5SvpTq2tXl\u003evzddr@Ack#9By/IoBzbkdv@DmbwO#QhaA7\u003cmBzbkdB7!#)z*9syvrlHlz/Pwhw[=6)eda4wByM$BxKLB\u0026Cu=EEaxi2=aAITBBZ]JoA+cwczxK4mwEqWOnH4}!v@co#wN5?B3ta0*wGUYdiTNGXA0!jiw/$$ltZGY.e=",
            "ln": 1712,
            "col": 15,
            "line": 58
          },
          {
            "b": "A+e=7dLzbKarR^Haz+$lxcp]aBo@m{A9)/$A=9@YfdF8Pvr(]pCvtJfx(mMaw]zYjwQ5fdA::67z/cWEfa5*AarR^Hy\u0026si7azC.n2)\u003eV(uUKy^v@%^PfdF8Pvr(]pvR6d\u0026A+cw4v}fC1zGE1nzEE3%x)a5gdLzbKarR^Haz+$lxcp]aBo@m{A9)e",
            "ln": 2159,
            "col": 52,
            "line": 76
          },
          {
            "b": "tZV%2A9)/$A=918eG!OjD2\u003e9qwOb\u003e3wGU@2B8#LzA+3qbB0bNyaz2!px(W=cBzb98aA.:pAV/7qaA}mmzE)u3z!pbhwO#3)zF78hvrlHlz/PwhwQ5fdA::67z/b[mqBH{BB8REsqD1X{3nc47az@rbDT3[.xEtw=g:=JRvS+{?cO3(bcTpc*e)J/i",
            "ln": 3219,
            "col": 2,
            "line": 152
          },
          {
            "b": "z/PwhwQ5fdA+fqmBzb98ayO+\u0026z/]@tazC)tv@Dmax\u003eg^}wN(]$zEE3%x)a5gvqYP#wnc9[vR/Q^3nbjB3ncys3nbjPat:ATx\u003enA8ay6m#3s4l(eIG1etQT67tXCGnfF+7Yv*T?[Ef}Pry-(#ftNA98A3c.!3na[Day3s7BS-B(gyt:tEf$4muUaD",
            "ln": 3427,
            "col": 29,
            "line": 164
          },
          {
            "b": "A=M8saA7+1B-IKCwoz{bzF78hA=kD0B8#5kxiV=oax0c2BzkS7B0bWux\u003e7*0xKM6}3s4gmx(n2$w(n$AB0bNrwGV28BAIRwaA?gfB.8XowPS6nzxHRQw]zYjB9g#5wPI]nvqYP#tRdVMw]zYjw)]y\u0026B-I4#cn2STq+e2PpG7j\u003ct1cAxmnuAua{]@0pZQfnwPIA9A=l8xx(mH6az\u003eLjaA8dlC{3NcaA.:pwftubaARpdaAIWAwPz{mwPw]4B0a[3v}x.5aARJABzbkdB7!#)z*9syvrlHlz/Pwhw[=6)azC)tA+frlA+P39wN]3)e^:jfnfx9MoI2",
            "ln": 4915,
            "col": 65,
            "line": 230
          }
        ],
        "depth": 1,
        "facts": {
          "imp": [
            [
              "",
              "getspent"
            ],
            [
              "",
              "getspnam"
            ]
          ],
          "mbr": [
            "changed.RE",
            "changed.RE.sp",
            "changed.RE.sp.RS",
            "changed.RE.sp.RS.ie",
            "disabled.RE",
            "disabled.RE.sp",
            "disabled.RE.sp.RS",
            "encrypted.SH",
            "expiration.RE",
            "expiration.RE.sp",
            "expiration.RE.sp.RS",
            "expiration.RE.sp.RS.ie",
            "fR.PP",
            "fR.SH",
            "fi.if",
            "ie.g",
            "ie.g.ds",
            "ie.g.ds.el",
            "ie.g.ds.el.ds",
            "password.RE",
            "password.RE.sp",
            "password.RE.sp.RS",
            "password.RE.sp.RS.ie",
            "reserved.RE",
            "reserved.RE.SH",
            "sp.RS"
          ],
          "tgt": [
            "getspent",
            "getspnam"
          ],
          "metrics": {
            "ast": {
              "op.gt": 1,
              "op.mul": 7,
              "op.sub": 21,
              "op.band": 1,
              "op.bnot": 64,
              "max_depth": 79,
              "op.concat": 67,
              "call_count": 2,
              "node_count": 2144,
              "member_count": 26,
              "op_density.gt": 0,
              "op_density.mul": 0,
              "op_density.sub": 0.01,
              "op_density.band": 0,
              "op_density.bnot": 0.03,
              "member_depth_max": 5,
              "op_density.concat": 0.03
            },
            "file": {
              "size": 5310,
              "entropy": 5.19
            },
            "text": {
              "lines": 245,
              "top_char": 45,
              "tab_count": 17,
              "max_ws_run": 7,
              "digit_ratio": 0.04,
              "space_count": 582,
              "char_entropy": 5.19,
              "unique_chars": 86,
              "top_char_null": 0,
              "string_density": 0.07,
              "top_char_ratio": 0.08,
              "ascii_art_lines": 6,
              "avg_line_length": 20.67,
              "max_line_length": 116,
              "non_ascii_ratio": 0,
              "empty_line_ratio": 0,
              "last_line_length": 18,
              "whitespace_ratio": 0.16,
              "identifier_density": 2.47,
              "line_length_stddev": 23.63,
              "normalized_string_count": 1.09,
              "repeated_char_sequences": 8,
              "trailing_whitespace_lines": 1,
              "suspicious_identifier_ratio": 0.04,
              "normalized_unique_identifiers": 28.1
            },
            "binary": {
              "peak_region_bytes": 4286,
              "peak_region_entropy": 5.22
            },
            "source": {
              "class_count": 1
            },
            "strings": {
              "bytes": 515,
              "count": 17,
              "avg_length": 30.29,
              "max_length": 69,
              "avg_entropy": 2.31,
              "entropy_stddev": 1.49
            },
            "functions": {
              "count": 1
            },
            "identifiers": {
              "count": 604,
              "unique": 223,
              "avg_length": 5.76,
              "max_length": 14,
              "min_length": 1,
              "avg_entropy": 2.11,
              "reuse_ratio": 0.37,
              "length_stddev": 2.85,
              "sequential_names": 8,
              "single_char_count": 8,
              "single_char_ratio": 0.04,
              "high_entropy_count": 1,
              "high_entropy_ratio": 0,
              "all_lowercase_ratio": 0.74,
              "all_uppercase_ratio": 0.07
            }
          }
        },
        "id": 1,
        "mol": "H₂(CmOs)",
        "path": "shadow.3.gz!!shadow.3",
        "pid": 0,
        "risk": 2,
        "sha": "06edae51df74814e989d11c439a5e042f1cfeb09308c9a98ce1728e8f1f9d21a",
        "size": 5310,
        "traits": [
          {
            "id": "micro-behaviors/os/user/lookup::fgetspent",
            "conf": 0.8,
            "crit": 3,
            "desc": "Read shadow entries from a file",
            "spans": [
              [
                1502,
                11
              ]
            ]
          },
          {
            "id": "micro-behaviors/os/user/lookup::getspnam",
            "atk": "T1003.008",
            "mbc": "E1003.008",
            "conf": 0.8,
            "crit": 3,
            "desc": "Resolve shadow password entry (getspnam)",
            "spans": [
              [
                1392,
                8
              ]
            ]
          },
          {
            "id": "micro-behaviors/communications/http/url/scheme::cleartext-http-url-code-literal",
            "atk": "T1071.001",
            "mbc": "C0002",
            "conf": 0.9,
            "crit": 3,
            "desc": "Code embeds cleartext HTTP URL literal",
            "spans": [
              [
                613,
                61
              ]
            ]
          }
        ],
        "type": "c"
      }
    ],
    "rev": "b3dc8",
    "v": "8"
  }
}