{ "llm": { "conf": 0.99723846, "grade": "hostile", "model": "Qwen/Qwen3.8-27B", "before": { "lvl": 1, "prob": 0.9958783, "class": "hostile" }, "outcome": "hostile", "interpretation": "Hardcoded exfil database credentials" }, "ml": { "v": "7", "eng": "2.12.0-beta.0", "lvl": 0, "conf": 100, "mods": [ { "cls": 2, "raw": 0.9958783, "rte": "az", "prob": 0.9958783 }, { "cls": 0, "raw": 0.9688199, "rte": "az/whl", "prob": 0.9688199 } ], "prob": 0.9958783, "files": [ { "id": 0, "lvl": 0, "conf": 100, "prob": 0.995878279209137, "type": "whl" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.00003789861875702627, "type": "python" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.000033597152651054785, "type": "python" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.000043253105104668066, "type": "python" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.000015209118828352075, "type": "python" }, { "id": 5, "lvl": -1, "conf": 0, "prob": 0.00005202491956879385, "type": "python" }, { "id": 6, "lvl": -1, "conf": 0, "prob": 0.00001529852488602046, "type": "python" }, { "id": 7, "lvl": -1, "conf": 0, "prob": 0.00001633167266845703, "type": "python" }, { "id": 8, "lvl": -1, "conf": 0, "prob": 0.000023225942641147412, "type": "python" }, { "id": 9, "lvl": -1, "conf": 0, "prob": 0.00003281235694885254, "type": "python" }, { "id": 10, "lvl": -1, "conf": 0, "prob": 0.00003719329833984375, "type": "python" }, { "id": 11, "lvl": -1, "conf": 0, "prob": 0.00003161032873322256, "type": "python" }, { "id": 12, "lvl": -1, "conf": 0, "prob": 0.0009503166074864566, "type": "python" }, { "id": 13, "lvl": -1, "conf": 0, "prob": 0.00004723668098449707, "type": "python" }, { "id": 14, "lvl": -1, "conf": 0, "prob": 0.0000823835507617332, "type": "python" }, { "id": 15, "lvl": -1, "conf": 0, "prob": 0.00004661083221435547, "type": "python" }, { "id": 16, "lvl": -1, "conf": 0, "prob": 0.000028431415557861328, "type": "python" }, { "id": 17, "lvl": -1, "conf": 0, "prob": 0.000032842159271240234, "type": "python" }, { "id": 18, "lvl": -1, "conf": 0, "prob": 0.000020454326659091748, "type": "python" }, { "id": 19, "lvl": -1, "conf": 0, "prob": 0.0000209808349609375, "type": "python" }, { "id": 20, "lvl": -1, "conf": 0, "prob": 0.000011821587577287573, "type": "python" }, { "id": 21, "lvl": -1, "conf": 0, "prob": 0.00002092123031616211, "type": "python" }, { "id": 22, "lvl": -1, "conf": 0, "prob": 0.000015149514183576684, "type": "python" }, { "id": 23, "lvl": -1, "conf": 0, "prob": 0.000024547180146328174, "type": "python" }, { "id": 24, "lvl": -1, "conf": 0, "prob": 0.000029802322387695312, "type": "python" }, { "id": 25, "lvl": -1, "conf": 0, "prob": 0.0000169376526173437, "type": "python" }, { "id": 26, "lvl": -1, "conf": 0, "prob": 0.000044971704483032227, "type": "python" }, { "id": 27, "lvl": -1, "conf": 0, "prob": 0.00003618995469878428, "type": "python" }, { "id": 28, "lvl": -1, "conf": 0, "prob": 0.00002000729182327632, "type": "python" }, { "id": 29, "lvl": -1, "conf": 0, "prob": 0.000021060308426967822, "type": "python" }, { "id": 30, "lvl": -1, "conf": 0, "prob": 0.0000250240173045313, "type": "python" }, { "id": 31, "lvl": -1, "conf": 0, "prob": 0.00007320443546632305, "type": "python" }, { "id": 32, "lvl": -1, "conf": 0, "prob": 0.00001903375050460454, "type": "python" }, { "id": 33, "lvl": -1, "conf": 0, "prob": 0.000018546978026279248, "type": "python" }, { "id": 34, "lvl": -1, "conf": 0, "prob": 0.000018695989638217725, "type": "python" }, { "id": 36, "lvl": -1, "conf": 0, "prob": 0.000027398267775424756, "type": "python" }, { "id": 37, "lvl": -1, "conf": 0, "prob": 0.000015626350432285108, "type": "python" }, { "id": 38, "lvl": -1, "conf": 0, "prob": 0.000019848346710205078, "type": "python" }, { "id": 39, "lvl": -1, "conf": 0, "prob": 0.000023057064026943408, "type": "python" }, { "id": 40, "lvl": -1, "conf": 0, "prob": 0.000019470850020297803, "type": "python" }, { "id": 41, "lvl": -1, "conf": 0, "prob": 0.00006464123725891113, "type": "python" }, { "id": 43, "lvl": -1, "conf": 0, "prob": 0.000042816001950995997, "type": "python" }, { "id": 44, "lvl": -1, "conf": 0, "prob": 0.00002014636993408203, "type": "python" }, { "id": 45, "lvl": -1, "conf": 0, "prob": 0.0012395977973937988, "type": "python" }, { "id": 46, "lvl": -1, "conf": 0, "prob": 0.00001868605613708496, "type": "python" }, { "id": 47, "lvl": -1, "conf": 0, "prob": 0.000023126602172851562, "type": "python" }, { "id": 48, "lvl": -1, "conf": 0, "prob": 0.00004019339758087881, "type": "python" }, { "id": 49, "lvl": -1, "conf": 0, "prob": 0.00004868705946137197, "type": "python" }, { "id": 50, "lvl": -1, "conf": 0, "prob": 0.000026494264602661133, "type": "python" }, { "id": 51, "lvl": -1, "conf": 0, "prob": 0.000019729137420654297, "type": "python" }, { "id": 52, "lvl": -1, "conf": 0, "prob": 0.000024010738343349658, "type": "python" }, { "id": 53, "lvl": -1, "conf": 0, "prob": 0.000028431415557861328, "type": "python" }, { "id": 54, "lvl": -1, "conf": 0, "prob": 0.000017096599549404345, "type": "pkg_info" }, { "id": 55, "lvl": -1, "conf": 0, "prob": 0.000009646018042985816, "type": "text" }, { "id": 57, "lvl": -1, "conf": 0, "prob": 0.000013232231140136719, "type": "registry" } ], "version": "v18.18", "analyzed_at": "2026-09-20T16:25:20Z" }, "path": "milenium-1.1.1-py3-none-any.whl", "raw": { "files": [ { "id": 0, "ctx": [ { "b": "p!H([6Awak2MSaKg*Muj!oJ?K007QO000Yk003\u003eIy?mG#B.@^suUKy(ByexcAcWZFok-Gr5z=T^GU1Btsv!vK40m[aB{kDd3pgAbhEPf/{^(XA1^k:{zHc}w.eO.\u003e4pXGc!qVI+t./FA-o6zTC#6%7O\u0026A!=tXZ0be=", "ln": 0 } ], "mol": "K(Te)O₇(Dy₂Eu₄As₂C₅CaS₃Xe₂)H₇(Cm₃₀Cr₂Db₁₅F₄Os₅Po₁₀Ti)Md₅(InPa₃Pt)", "sha": "04f8e625498a5a9b26c11c5a074e0afbcd51f1013badff36b2f5c8ad942d2999", "path": "/data/samples/incoming/forager/python/pythonhosted.org/pypi.org/milenium/milenium-1.1.1-py3-none-any.whl", "risk": 118, "size": 41499, "type": "whl", "facts": { "metrics": { "whl": { "native_extension_count": 0 }, "file": { "size": 41499, "entropy": 7.81 }, "binary": { "peak_region_bytes": 36864, "peak_region_entropy": 7.83 }, "archive": { "file_count": 58, "member_count": 58, "script_count": 53, "zip_bomb_ratio": 4.87, "compressed_size": 33565, "directory_count": 0, "executable_count": 0, "extra_field_size": 0, "noise_file_count": 0, "compression.ratio": 0.4, "hidden_file_count": 0, "uncompressed_size": 84495, "crc_collision_count": 0, "entry_comment_count": 0, "max_filename_length": 41, "rtlo_filename_count": 0, "format.regular_count": 58, "nested_archive_count": 0, "path_traversal_count": 0, "symlink_escape_count": 0, "security.setgid_count": 0, "security.setuid_count": 0, "security.sticky_count": 0, "double_extension_count": 0, "duplicate_member_count": 0, "security.symlink_count": 0, "unicode_filename_count": 0, "homoglyph_filename_count": 0, "security.encrypted_count": 0, "timing.mtime_unique_count": 2, "timing.mtime_unique_ratio": 0.03, "misplaced_executable_count": 0, "timing.mtime_outlier_count": 5, "timing.mtime_dominant_count": 53, "timing.mtime_spread_seconds": 6, "timing.sentinel_mtime_count": 0, "security.world_writable_count": 0, "timing.mtime_dominant_fraction": 0.91, "compression.method_counts.deflate": 58 }, "consistency": { "cloned_summary": 0, "name_typosquat": 0, "self_dependency": 0, "metadata_identity_mismatch": 0 } } }, "ident": { "name": { "value": "milenium", "source": "whl.distribution", "verified": false }, "trust": "unsigned", "authors": [ { "name": "VexxDev200", "role": "author", "source": "whl.author" } ], "version": { "value": "1.1.1", "source": "whl.version", "verified": false } }, "traits": [ { "id": "micro-behaviors/os/env/secret-name::python-env-keyword-key", "conf": 0.88, "crit": 3, "desc": "Python getenv name contains KEY", "from": [ { "file": 48 } ] }, { "id": "micro-behaviors/communications/http/client/response-body::python-response-body-member-reference", "conf": 0.8, "crit": 3, "desc": "Python response body member access" }, { "id": "micro-behaviors/communications/http/services/entra-directory::user-collection-path-token", "conf": 0.92, "crit": 3, "desc": "Microsoft Graph user collection endpoint", "from": [ { "file": 18 } ] }, { "id": "micro-behaviors/data/decode/symbol-base64::b64decode-call", "conf": 0.9, "crit": 3, "desc": "Decodes Base64 data with Python", "from": [ { "file": 10 } ] }, { "id": "micro-behaviors/process/create/subprocess::asyncio-create-subprocess-exec", "atk": "T1059.006", "mbc": "E1059.006", "conf": 0.85, "crit": 3, "desc": "asyncio subprocess execution call", "from": [ { "file": 21 } ] }, { "id": "objectives/discovery/network/enumeration::certificate-subdomain-collection", "conf": 0.92, "crit": 4, "desc": "Collects subdomains from certificates", "from": [ { "off": 260, "file": 12, "line": 9 }, { "off": 597, "file": 13, "line": 23 } ], "uses": [ 67, 134, 180 ] }, { "id": "micro-behaviors/data/decode/custom::python-whitespace-only-line-selection", "atk": "T1140", "conf": 0.92, "crit": 3, "desc": "Python selects lines containing only whitespace", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/communications/http/ip-discovery::ipinfo-io", "conf": 0.85, "crit": 3, "desc": "ipinfo.io IP information API", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/communications/http/ip-discovery::ip-api-com", "conf": 0.85, "crit": 3, "desc": "ip-api.com geolocation service", "from": [ { "file": 24 } ] }, { "id": "micro-behaviors/communications/http/request/client::requests-get-url-literal", "conf": 0.8, "crit": 3, "desc": "Literal URL passed to requests.get/httpx.get", "from": [ { "file": 11 } ] }, { "id": "objectives/command-and-control/infrastructure/tracking::domain-field", "conf": 0.7, "crit": 3, "desc": "Domain tracking field", "from": [ { "file": 5 } ] }, { "id": "objectives/execution/autoinstall/pip::subprocess-install", "atk": "T1059.006", "mbc": "B0024", "conf": 0.9, "crit": 3, "desc": "Runtime pip install via subprocess", "from": [ { "file": 1 } ], "uses": [ 118 ] }, { "id": "micro-behaviors/communications/http/user-agent::application-user-agent", "conf": 0.86, "crit": 3, "desc": "Application-specific User-Agent header", "from": [ { "file": 23 } ] }, { "id": "micro-behaviors/process/create/subprocess::check-call-ast", "atk": "T1059.006", "mbc": "C0017", "conf": 0.85, "crit": 3, "desc": "subprocess.check_call call", "from": [ { "file": 1 } ] }, { "id": "well-known/tool/detection/threat-intel::virustotal", "conf": 0.7, "crit": 3, "desc": "VirusTotal service name reference", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/process/create/subprocess::import-subprocess", "atk": "T1059.006", "mbc": "E1059.006", "conf": 0.95, "crit": 3, "desc": "Imports Python's subprocess module", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/http/lib/requests::imports-requests", "conf": 0.95, "crit": 3, "desc": "Imports the requests HTTP client for Python", "from": [ { "file": 7 } ] }, { "id": "micro-behaviors/communications/http/header/custom::custom-token-header", "conf": 0.9, "crit": 3, "desc": "Sets custom X-prefixed token header", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/communications/email/send/smtp::python-smtplib-import", "conf": 0.9, "crit": 3, "desc": "Imports Python SMTP client library", "from": [ { "file": 16 } ] }, { "id": "objectives/command-and-control/dropper/python-script::python-resource-url-field", "atk": "T1105", "mbc": "B0024", "conf": 0.9, "crit": 3, "desc": "Reads resource URL field", "from": [ { "file": 31 } ] }, { "id": "objectives/credential-access/dump/system::routeros-api-user-print", "atk": "T1003", "conf": 0.92, "crit": 3, "desc": "RouterOS API user print", "from": [ { "file": 45 } ] }, { "id": "micro-behaviors/os/env/read::python-os-getenv-call", "conf": 0.92, "crit": 3, "desc": "Python reads an environment variable", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/data/control-flow/error-handling::python-permission-error-handler", "atk": "T1027", "mbc": "C0027", "conf": 0.9, "crit": 3, "desc": "Python PermissionError except handler", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/process/create/shell/spawn::subprocess-timeout-expired-text", "conf": 0.88, "crit": 3, "desc": "Subprocess TimeoutExpired reference", "from": [ { "file": 45 } ] }, { "id": "micro-behaviors/communications/http/user-agent::non-mozilla-user-agent-header", "conf": 0.9, "crit": 3, "desc": "Sets a non-Mozilla User-Agent header", "from": [ { "file": 20 } ] }, { "id": "micro-behaviors/communications/http/browser-automation::authentication-token-name-literal", "conf": 0.9, "crit": 3, "desc": "Authentication token name literal", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/communications/email/send/smtp::python-smtp-client-construction", "conf": 0.92, "crit": 3, "desc": "Constructs a Python SMTP client", "from": [ { "file": 16 } ] }, { "id": "objectives/exfiltration/http/hardcoded-key::requests-payload-argument", "atk": "T1041", "mbc": "C0002", "conf": 0.86, "crit": 3, "desc": "Requests payload argument", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/communications/socket/create::socket-module-import", "atk": "T1071", "mbc": "C0001", "conf": 0.6, "crit": 3, "desc": "Imports Python's socket module", "from": [ { "file": 24 } ] }, { "id": "metadata/package/ecosystem::pkginfo-requires-dist", "conf": 0.9, "crit": 3, "desc": "Declares Python runtime dependencies", "from": [ { "file": 54 } ] }, { "id": "micro-behaviors/communications/http/lib/requests::requests-get", "conf": 0.85, "crit": 3, "desc": "Calls requests.get in Python", "from": [ { "file": 7 } ] }, { "id": "micro-behaviors/data/parse/command::python-shlex-command-split", "conf": 0.9, "crit": 3, "desc": "Python parses shell-like command words", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/process/argument/subcommand::cli-verb-items", "conf": 0.82, "crit": 3, "desc": "CLI items selector token", "from": [ { "file": 18 } ] }, { "id": "metadata/package/ecosystem::pkginfo-requires-python", "conf": 0.9, "crit": 3, "desc": "Declares supported Python versions", "from": [ { "file": 54 } ] }, { "id": "metadata/package/scripts/entrypoint::wheel-console-entrypoint", "conf": 0.9, "crit": 3, "desc": "Package declares a console-script entry point", "from": [ { "file": 55 } ], "uses": [ 153, 173 ] }, { "id": "micro-behaviors/data/decode/base64::base64-decoding", "conf": 0.95, "crit": 3, "desc": "Base64 decoding behavior", "from": [ { "file": 10 } ], "uses": [ 3 ] }, { "id": "micro-behaviors/communications/http/authorization-header::bearer-prefix", "atk": "T1071.001", "mbc": "C0002", "conf": 0.72, "crit": 3, "desc": "HTTP Bearer authorization header prefix", "from": [ { "file": 9 } ] }, { "id": "objectives/discovery/host/geo::ip-address-field", "atk": "T1016", "conf": 0.5, "crit": 1, "desc": "IP address data field", "from": [ { "off": 323, "file": 5, "line": 13 }, { "file": 26 } ], "uses": [ 186 ] }, { "id": "objectives/exfiltration/messaging/telegram::python-hardcoded-bot-token", "atk": "T1567", "conf": 0.95, "crit": 4, "desc": "Hardcoded Telegram bot token literal", "from": [ { "file": 45 } ] }, { "id": "well-known/lib/stdlib/python-stdlib::asyncio-reference", "conf": 0.5, "crit": 3, "desc": "Python asyncio library reference", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/communications/http/device-code::token-object-field", "conf": 0.93, "crit": 3, "desc": "OAuth token object member", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/process/fd/stdio::py-stdout-custom-stream", "conf": 0.75, "crit": 3, "desc": "Python redirects stdout to custom stream", "from": [ { "file": 2 } ] }, { "id": "objectives/command-and-control/infrastructure/domain/brand-impersonation::google-service-label", "atk": "T1583.001", "mbc": "C0002", "conf": 0.86, "crit": 3, "desc": "Google brand in nested noncanonical host", "from": [ { "file": 14 } ] }, { "id": "objectives/command-and-control/dropper/python-script::python-resource-platform-field", "atk": "T1105", "mbc": "B0024", "conf": 0.9, "crit": 3, "desc": "Reads resource platform field", "from": [ { "file": 41 } ] }, { "id": "metadata/package/ecosystem::pkginfo-core-metadata", "conf": 1.0, "crit": 2, "desc": "Declares Python Core Metadata version", "from": [ { "file": 54 } ] }, { "id": "micro-behaviors/communications/dns/lookup/resolver::dnspython-lookup", "conf": 0.85, "crit": 3, "desc": "dnspython DNS query capability", "from": [ { "off": 463, "file": 13, "line": 18 }, { "off": 262, "file": 15, "line": 12 }, { "off": 241, "file": 16, "line": 8 } ], "uses": [ 75 ] }, { "id": "micro-behaviors/time/sleep/interval::python-sleep-call", "conf": 0.65, "crit": 2, "desc": "Pauses execution with a Python sleep call", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/data/serialize/schema-object::user-field-key", "conf": 0.9, "crit": 3, "desc": "JSON-like user identity field", "from": [ { "file": 43 } ] }, { "id": "micro-behaviors/process/create/subprocess::python-subprocess-io-fields--stdout", "atk": "T1059.006", "conf": 0.84, "crit": 3, "desc": "Process output/status field names (stdout)", "from": [ { "file": 2 } ] }, { "id": "objectives/exfiltration/stealer/credential/dev-file::python-smtp-send-exfil", "atk": "T1552.001,T1041", "mbc": "E1552", "conf": 0.8, "crit": 3, "desc": "Python smtplib sendmail call site", "from": [ { "file": 16 } ] }, { "id": "micro-behaviors/process/create/subprocess::process-execution", "atk": "T1059.006", "conf": 0.8, "crit": 3, "desc": "Python launches a child process", "from": [ { "off": 1143, "file": 1, "line": 40 }, { "off": 279, "file": 17, "line": 9 }, { "file": 45 } ], "uses": [ 13, 82, 87 ] }, { "id": "micro-behaviors/data/serialize/schema-object::platform-field-key", "conf": 0.86, "crit": 3, "desc": "JSON-like platform or OS field", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/data/serialize/object::json-dump", "conf": 0.86, "crit": 3, "desc": "Serializes to a stream with json.dump()", "from": [ { "file": 37 } ] }, { "id": "micro-behaviors/communications/http/services/entra-directory::domain-collection-path-token", "conf": 0.92, "crit": 3, "desc": "Microsoft Graph domain collection endpoint", "from": [ { "file": 50 } ] }, { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/serialize/schema-object::country-code-camel", "conf": 0.5, "crit": 3, "desc": "Contains a countryCode data field", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/communications/http/request/client::python-http-post-any", "conf": 0.8, "crit": 3, "desc": "Python HTTP POST method usage", "from": [ { "file": 14 } ], "uses": [ 177 ] }, { "id": "micro-behaviors/communications/http/header/custom::api-key-header-map-entry", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Configures a bare api-key request header", "from": [ { "file": 48 } ] }, { "id": "micro-behaviors/os/api-resolution/dynamic::python-getattr-call", "conf": 0.75, "crit": 3, "desc": "Python getattr dynamic attribute lookup", "from": [ { "file": 22 } ] }, { "id": "micro-behaviors/data/serialize/schema-object::country-name", "conf": 0.5, "crit": 3, "desc": "country_name data field", "from": [ { "file": 25 } ] }, { "id": "micro-behaviors/data/db/sql::sql-insert", "conf": 0.8, "crit": 3, "desc": "Contains an SQL INSERT statement", "from": [ { "file": 31 } ] }, { "id": "micro-behaviors/communications/http/services/github::github-api-host", "conf": 0.86, "crit": 3, "desc": "GitHub API host reference", "from": [ { "file": 18 } ] }, { "id": "micro-behaviors/data/control-flow/module-exec::module-level-side-effect-call", "conf": 0.82, "crit": 3, "desc": "Python module-level function call" }, { "id": "objectives/discovery/host/geo::geo-response-field", "atk": "T1016", "conf": 0.5, "crit": 3, "desc": "Geolocation response field markers", "from": [ { "file": 3 }, { "file": 5 }, { "off": 304, "file": 24, "line": 12 }, { "file": 25 }, { "off": 231, "file": 26, "line": 10 }, { "off": 688, "file": 27, "line": 21 }, { "off": 1078, "file": 41, "line": 28 }, { "off": 761, "file": 53, "line": 22 } ], "uses": [ 37, 59, 94, 122, 127 ] }, { "id": "micro-behaviors/communications/dns/label::python-dns-query-reference", "atk": "T1071.004", "conf": 0.9, "crit": 3, "desc": "Python DNS resolution API reference", "from": [ { "file": 13 } ] }, { "id": "metadata/lang/natural::script-cyrillic", "conf": 0.8, "crit": 3, "desc": "Contains multiple standalone Cyrillic words", "from": [ { "file": 1 } ] }, { "id": "objectives/anti-static/obfuscation/payload/encrypted::py-passphrase-literal-assign", "atk": "T1027.013", "mbc": "B0032", "conf": 0.85, "crit": 3, "desc": "Python secret or cipher key literal", "from": [ { "file": 14 } ] }, { "id": "objectives/discovery/network/enumeration::subdomain-result-field", "conf": 0.86, "crit": 3, "desc": "Certificate subdomain result field", "from": [ { "file": 12 } ] }, { "id": "metadata/import/package::python-hashlib-import", "conf": 0.9, "crit": 3, "desc": "Python imports the hashlib library", "from": [ { "file": 19 } ] }, { "id": "micro-behaviors/os/package-manager/install::python-runtime-pip-install", "mbc": "C0002", "conf": 0.94, "crit": 3, "desc": "Python invokes pip module install", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/interpreter/python::dunder-import-call", "atk": "T1059.006", "mbc": "E1059", "conf": 0.85, "crit": 3, "desc": "Python __import__ call" }, { "id": "micro-behaviors/communications/http/token-auth::access-token-field-source", "conf": 0.92, "crit": 3, "desc": "Access token field in source", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/communications/http/client/library::aiohttp-import", "conf": 0.9, "crit": 3, "desc": "Imports the aiohttp Python HTTP client", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/os/env/secret-name::credential-env-read", "conf": 0.9, "crit": 3, "desc": "Reads a credential-bearing environment variable", "from": [ { "file": 48 } ], "uses": [ 189 ] }, { "id": "micro-behaviors/data/control-flow/membership::not-in-membership-check", "conf": 0.3, "crit": 3, "desc": "Python not-in membership check", "from": [ { "file": 10 } ] }, { "id": "micro-behaviors/communications/dns/lookup/resolver::dns-resolver-resolve", "conf": 0.85, "crit": 3, "desc": "dns.resolver.resolve() lookup", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/data/db/sql::sql-keywords", "conf": 0.5, "crit": 3, "desc": "Contains several SQL statement types", "from": [ { "off": 6204, "file": 31, "line": 176 } ], "uses": [ 60, 136, 138 ] }, { "id": "micro-behaviors/communications/email/address::eastern-consumer-email-domain-suffix", "conf": 0.55, "crit": 3, "desc": "Eastern consumer email domain suffix", "from": [ { "file": 11 } ] }, { "id": "micro-behaviors/data/serialize/object::python-username-variable-object-field", "conf": 0.92, "crit": 3, "desc": "Python object maps username variable", "from": [ { "file": 43 } ] }, { "id": "micro-behaviors/data/format/json::json-result-field", "conf": 0.8, "crit": 3, "desc": "JSON result or response field key", "from": [ { "file": 43 } ] }, { "id": "micro-behaviors/communications/http/authorization-header::auth-like-constant-assignment", "atk": "T1071.001", "mbc": "C0002", "conf": 0.8, "crit": 3, "desc": "Auth-like constant assignment", "from": [ { "file": 9 } ] }, { "id": "metadata/package/ecosystem::pkginfo-version-field", "conf": 0.9, "crit": 2, "desc": "Declares Python package version", "from": [ { "file": 54 } ] }, { "id": "micro-behaviors/process/create/subprocess::run-ast", "atk": "T1059.006", "mbc": "C0017", "conf": 0.85, "crit": 3, "desc": "Calls subprocess.run to launch a process", "from": [ { "file": 17 } ] }, { "id": "micro-behaviors/os/env/secret-name::python-env-keyword-token", "conf": 0.88, "crit": 3, "desc": "Python getenv name contains TOKEN", "from": [ { "file": 9 } ] }, { "id": "metadata/lang/natural::lang-english--atom-6", "conf": 0.8, "crit": 1, "desc": "English function-word token \"with\"", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/fs/directory/traverse::traverse-walk", "conf": 0.66, "crit": 2, "desc": "Traverse filesystem hierarchy (os.walk)", "from": [ { "file": 8 } ] }, { "id": "objectives/execution/condition/platform::python-click-option-call", "conf": 0.7, "crit": 3, "desc": "Python Click option declaration", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/process/create/subprocess::check-call-content", "atk": "T1059.006", "mbc": "E1059.006", "conf": 0.75, "crit": 3, "desc": "Calls subprocess.check_call", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/file/open::write-append-create-mode", "conf": 0.85, "crit": 3, "desc": "Python file opened for write or append" }, { "id": "micro-behaviors/process/create/subprocess::subprocess-run-sys-executable", "atk": "T1059.006", "mbc": "C0017", "conf": 0.92, "crit": 3, "desc": "subprocess.run relaunches Python interpreter", "from": [ { "file": 45 } ] }, { "id": "micro-behaviors/communications/http/authorization-header::auth-header", "atk": "T1071.001", "mbc": "C0002", "conf": 0.5, "crit": 3, "desc": "Authorization header-name literal", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/communications/http/url/forge::public-code-forge-url", "conf": 0.9, "crit": 3, "desc": "References a public code-forge URL", "from": [ { "file": 49 } ] }, { "id": "objectives/command-and-control/infrastructure/tracking::username-field", "conf": 0.7, "crit": 3, "desc": "Username tracking field", "from": [ { "file": 43 } ] }, { "id": "objectives/supply-chain/recon-exfil/agent-skill::proxy-api-key-field", "atk": "T1195.002", "conf": 0.96, "crit": 3, "desc": "API-key field marker for proxy use", "from": [ { "file": 48 } ] }, { "id": "objectives/discovery/host/geo::city-field", "atk": "T1016", "conf": 0.5, "crit": 3, "desc": "City JSON field (geo profiling)", "from": [ { "file": 24 } ] }, { "id": "objectives/discovery/network/enumeration::certificate-search-query", "conf": 0.88, "crit": 3, "desc": "crt.sh JSON certificate query", "from": [ { "file": 12 } ] }, { "id": "micro-behaviors/communications/http/client/library::python-session-method-call", "conf": 0.85, "crit": 3, "desc": "Python session-like method call", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/communications/http/authorization-header::basic-auth", "atk": "T1071.001", "mbc": "C0002", "conf": 0.5, "crit": 3, "desc": "Basic authentication", "from": [ { "file": 53 } ] }, { "id": "micro-behaviors/communications/ipc/agent-hook::agent-hook-input-field", "conf": 0.9, "crit": 3, "desc": "Reads a hook command field", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/communications/http/post::post-method-detection", "atk": "T1071.001", "mbc": "C0002", "conf": 0.75, "crit": 3, "desc": "Uses an HTTP POST request method", "from": [ { "file": 14 } ], "uses": [ 177 ] }, { "id": "micro-behaviors/communications/http/request/tasking::http-task-command-field-read", "atk": "T1071.001", "mbc": "C0002", "conf": 0.94, "crit": 3, "desc": "Reads structured task command field", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/communications/http/post::session-post-call", "atk": "T1071.001", "mbc": "C0002", "conf": 0.8, "crit": 3, "desc": "Python session .post call", "from": [ { "file": 48 } ] }, { "id": "metadata/package/ecosystem::pkginfo-name-field", "conf": 0.9, "crit": 2, "desc": "Declares Python package name", "from": [ { "file": 54 } ] }, { "id": "micro-behaviors/fs/directory/traverse::traverse-walk-call", "conf": 0.84, "crit": 3, "desc": "Calls os.walk for filesystem enumeration", "from": [ { "file": 8 } ] }, { "id": "micro-behaviors/communications/http/request/client::requests-post-json-payload", "conf": 0.85, "crit": 3, "desc": "Sends JSON with Python requests.post()", "from": [ { "file": 14 } ] }, { "id": "objectives/anti-static/obfuscation/payload/bytecode::import-dunder", "conf": 1.0, "crit": 3, "desc": "__import__ function", "from": [ { "file": 15 } ] }, { "id": "micro-behaviors/os/env/secret-name::python-sensitive-env-read", "conf": 0.9, "crit": 3, "desc": "Python reads credential-named environment variable", "from": [ { "file": 9 }, { "file": 10 }, { "file": 48 } ], "uses": [ 0, 156 ] }, { "id": "micro-behaviors/os/env/secret-name::python-environ-credential-keyword-filter", "conf": 0.9, "crit": 3, "desc": "Python environment access uses credential-named keys", "from": [ { "file": 9 }, { "file": 48 } ], "uses": [ 0, 83 ] }, { "id": "micro-behaviors/os/env/read::python-environ-copy-assignment", "conf": 0.9, "crit": 3, "desc": "Copies entry into env or credential mapping", "from": [ { "file": 10 } ] }, { "id": "micro-behaviors/communications/http/client/library::aiohttp-session-request", "conf": 0.85, "crit": 3, "desc": "Sends HTTP through an aiohttp session", "from": [ { "off": 17, "file": 5, "line": 2 }, { "off": 17, "file": 9, "line": 2 }, { "off": 17, "file": 27, "line": 2 }, { "off": 17, "file": 41, "line": 2 }, { "off": 17, "file": 48, "line": 2 }, { "off": 17, "file": 50, "line": 2 } ], "uses": [ 72, 96 ] }, { "id": "micro-behaviors/communications/http/header/accept::accept-json-header", "atk": "T1071.001", "mbc": "C0002", "conf": 0.95, "crit": 3, "desc": "Requests a JSON HTTP response", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/process/info/current::python-sys-executable-text", "conf": 0.75, "crit": 3, "desc": "Python sys.executable reference text", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/serialize/json::json-loads-call", "conf": 0.9, "crit": 3, "desc": "Parses JSON data with Python", "from": [ { "file": 10 } ] }, { "id": "micro-behaviors/communications/http/url/scheme::cleartext-http-url-code-literal", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Code embeds cleartext HTTP URL literal", "from": [ { "file": 24 } ] }, { "id": "micro-behaviors/process/lifecycle/auto-exec::asyncio-run-call", "conf": 0.85, "crit": 3, "desc": "Python asyncio.run call", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/os/api-resolution/dynamic::py-importlib-import-module", "conf": 0.6, "crit": 3, "desc": "Dynamically imports a Python module", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/path/check::python-os-path-isdir-symbol", "conf": 0.86, "crit": 3, "desc": "Python os.path.isdir path test", "from": [ { "file": 8 } ] }, { "id": "micro-behaviors/data/db/sql::sql-password-column", "conf": 0.86, "crit": 3, "desc": "SQL password column definition", "from": [ { "file": 31 } ] }, { "id": "micro-behaviors/os/package-manager/install::subprocess-pip-install-list", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Subprocess argument list invokes pip install", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/http/client/response-body::requests-response-body-access", "conf": 0.9, "crit": 3, "desc": "Reads a requests response body", "from": [ { "file": 11 } ], "uses": [ 1, 16, 30 ] }, { "id": "micro-behaviors/fs/path/location::home-hidden-dotpath", "conf": 0.85, "crit": 3, "desc": "Hidden dot-entry under the home directory", "from": [ { "file": 10 } ] }, { "id": "micro-behaviors/communications/http/ip-discovery::ipapi-co", "conf": 0.85, "crit": 3, "desc": "References the ipapi.co IP geolocation service", "from": [ { "file": 25 } ] }, { "id": "objectives/discovery/host/geo::region-field", "atk": "T1016", "conf": 0.5, "crit": 3, "desc": "Region JSON field (geo profiling)", "from": [ { "file": 24 } ] }, { "id": "objectives/execution/autoinstall/pip::except-import-error-content", "atk": "T1059.006", "mbc": "B0024", "conf": 0.7, "crit": 3, "desc": "except ImportError in source", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/http/header/content-type::json-header", "conf": 0.9, "crit": 3, "desc": "References HTTP Content-Type application/json", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/communications/http/lib/aiohttp::aiohttp-session", "conf": 0.7, "crit": 3, "desc": "aiohttp.ClientSession usage", "from": [ { "file": 5 } ] }, { "id": "objectives/command-and-control/infrastructure/paste::pastebin", "conf": 0.7, "crit": 3, "desc": "Pastebin.com reference", "from": [ { "file": 14 } ] }, { "id": "objectives/discovery/host/geo::geo-api", "atk": "T1016", "conf": 0.7, "crit": 3, "desc": "Geolocation API endpoint", "from": [ { "off": 11463, "file": 3, "line": 325 }, { "file": 24 }, { "off": 89, "file": 25, "line": 6 }, { "off": 89, "file": 26, "line": 6 }, { "off": 151, "file": 27, "line": 9 } ], "uses": [ 7, 8, 121 ] }, { "id": "micro-behaviors/communications/http/request/body::http-post-with-body-argument", "conf": 0.82, "crit": 3, "desc": "HTTP POST supplies a body argument" }, { "id": "micro-behaviors/time/sleep/interval::python-sleep-1s-plus", "conf": 0.75, "crit": 1, "desc": "Python one-second-plus sleep", "from": [ { "off": 12168, "file": 3, "line": 342 } ], "uses": [ 46, 178 ] }, { "id": "micro-behaviors/process/create/launch::sys-executable-module-launch", "atk": "T1059.003", "mbc": "E1059.003", "conf": 0.9, "crit": 3, "desc": "Launches Python module with interpreter", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/http/request/client::py-post-generic", "conf": 0.8, "crit": 3, "desc": "Python post method call", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/communications/http/services/telegram::telegram-client-open-call", "conf": 0.92, "crit": 3, "desc": "Constructs a Telegram session client", "from": [ { "file": 43 } ] }, { "id": "micro-behaviors/data/db/schema/relational::account-handle-field", "conf": 0.8, "crit": 3, "desc": "Account handle field name", "from": [ { "file": 2 } ] }, { "id": "objectives/discovery/network/enumeration::subdomain-result-split", "conf": 0.86, "crit": 3, "desc": "Splits discovered subdomain results", "from": [ { "file": 12 } ] }, { "id": "metadata/package/ecosystem::pkginfo-markdown-description", "conf": 0.9, "crit": 3, "desc": "Declares Markdown package description", "from": [ { "file": 54 } ] }, { "id": "micro-behaviors/data/db/sql::sql-select", "conf": 0.6, "crit": 3, "desc": "SQL SELECT syntax reference", "from": [ { "file": 31 } ] }, { "id": "micro-behaviors/communications/http/request/result::http-post-client-call", "atk": "T1071.001", "mbc": "C0002", "conf": 0.85, "crit": 3, "desc": "HTTP POST client call", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/data/db/sql::sql-create-table", "conf": 0.5, "crit": 3, "desc": "SQL CREATE TABLE syntax reference", "from": [ { "file": 31 } ] }, { "id": "objectives/command-and-control/infrastructure/tracking::sessions-table-sql", "conf": 0.7, "crit": 3, "desc": "Sessions table SQL schema", "from": [ { "file": 31 } ] }, { "id": "objectives/supply-chain/impersonation/package/wheel-sdist::requires-telethon", "atk": "T1204.001", "mbc": "F0004", "conf": 0.86, "crit": 3, "desc": "Package requires Telethon", "from": [ { "file": 54 } ] }, { "id": "micro-behaviors/data/encode/base64::import-base64", "conf": 0.9, "crit": 3, "desc": "Imports Python's base64 module", "from": [ { "file": 10 } ] }, { "id": "objectives/command-and-control/infrastructure/domain/malicious::short-domain-url-pattern", "atk": "T1071.001", "mbc": "C0002", "conf": 0.8, "crit": 3, "desc": "Very short domain in URL", "from": [ { "file": 12 } ] }, { "id": "micro-behaviors/communications/dns/lookup/resolver::dnspython-resolver-import", "conf": 0.85, "crit": 3, "desc": "Imports the dnspython resolver module", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/communications/http/request/client::request-python", "conf": 0.9, "crit": 3, "desc": "Sends an HTTP request with a Python client library", "from": [ { "file": 5 } ], "uses": [ 30, 125, 151, 177 ] }, { "id": "objectives/supply-chain/recon-exfil/pipeline::gha-interesting-secret-keywords--rx-2", "atk": "T1195.002, T1552.001", "conf": 0.9, "crit": 3, "desc": "Cloudflare or database credential variable name", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/process/create/subprocess::python-subprocess-io-fields--returncode", "atk": "T1059.006", "conf": 0.84, "crit": 3, "desc": "Process output/status field names (returncode)", "from": [ { "file": 17 } ] }, { "id": "micro-behaviors/data/control-flow/analysis::while-loop", "conf": 0.3, "crit": 2, "desc": "While-loop control flow", "from": [ { "file": 3 } ] }, { "id": "metadata/encoded-payload/base64", "conf": 0.9, "crit": 3, "desc": "Encoded content decoded: base64" }, { "id": "objectives/exfiltration/stealer/credential/dev-file::python-requests-post-exfil", "atk": "T1552.001,T1041", "mbc": "E1552", "conf": 0.8, "crit": 3, "desc": "Python requests.post call site", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/communications/http/url/query::interpolated-identifier-query-value", "conf": 0.9, "crit": 3, "desc": "URL query interpolates an identifier value", "from": [ { "file": 18 } ] }, { "id": "micro-behaviors/communications/http/request/client::url-literal", "conf": 0.8, "crit": 3, "desc": "Uses a literal URL in an HTTP request", "from": [ { "file": 11 }, { "file": 38 }, { "file": 51 }, { "file": 52 }, { "file": 53 } ], "uses": [ 9 ] }, { "id": "micro-behaviors/process/create/exec::python-asyncio-subprocess-call", "atk": "T1059", "conf": 0.9, "crit": 3, "desc": "Python creates a subprocess through asyncio", "from": [ { "file": 21 } ] }, { "id": "metadata/package/scripts/entrypoint::entry-points-file", "conf": 0.95, "crit": 3, "desc": "Python package contains an entry_points.txt file", "from": [ { "file": 55 } ] }, { "id": "micro-behaviors/communications/http/services/haveibeenpwned::hibp-service-name", "conf": 0.9, "crit": 3, "desc": "Have I Been Pwned service reference", "from": [ { "file": 7 } ] }, { "id": "micro-behaviors/crypto/hash/digest::python-md5-digest", "conf": 0.9, "crit": 3, "desc": "Computes an MD5 digest in Python", "from": [ { "file": 19 } ] }, { "id": "micro-behaviors/os/env/secret-name::python-env-get-call", "conf": 0.8, "crit": 3, "desc": "Python reads an environment variable", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/data/control-flow/error-handling::silent-exception-pass", "atk": "T1027", "mbc": "C0027", "conf": 0.85, "crit": 3, "desc": "exception suppression via try/except pass", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/http/authorization-header::x-api-key-header-map-entry", "atk": "T1071.001", "mbc": "C0002", "conf": 0.88, "crit": 3, "desc": "Configures an X-API-Key request header", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/crypto/certificate/transparency::crt-sh-endpoint", "conf": 0.92, "crit": 3, "desc": "crt.sh certificate lookup endpoint", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/communications/http/services/github::github-rest-json-accept-header", "conf": 0.95, "crit": 3, "desc": "GitHub REST JSON API Accept header", "from": [ { "file": 18 } ] }, { "id": "metadata/lang/natural::lang-english--atom-2", "conf": 0.8, "crit": 1, "desc": "English function-word token \"and\"", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/communications/http/url/scheme::cleartext-http-request-target", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "HTTP client requests a cleartext URL", "from": [ { "file": 52 } ] }, { "id": "micro-behaviors/communications/email/address::google-consumer-email-domain-suffix", "conf": 0.55, "crit": 3, "desc": "Gmail consumer email domain suffix", "from": [ { "file": 11 } ] }, { "id": "micro-behaviors/data/source/syntax/keyword::function-command-parameter", "conf": 0.8, "crit": 3, "desc": "Python function accepts a command parameter", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/process/interpreter/python::dunder-import-string-call", "atk": "T1059.006", "mbc": "E1059", "conf": 0.9, "crit": 3, "desc": "Python imports named module dynamically", "from": [ { "file": 15 } ] }, { "id": "micro-behaviors/communications/http/ip-discovery::ipwho-is", "conf": 0.85, "crit": 3, "desc": "ipwho.is geolocation service", "from": [ { "file": 25 } ] }, { "id": "objectives/execution/autoinstall/pip::try-import-install", "atk": "T1059.006", "mbc": "B0024", "conf": 0.9, "crit": 3, "desc": "Try-except import with fallback pip", "from": [ { "file": 1 } ], "uses": [ 11, 184 ] }, { "id": "micro-behaviors/fs/directory/traverse::traverse-readdir-walk-find", "conf": 0.85, "crit": 2, "desc": "Traverses directories using common APIs", "from": [ { "file": 8 } ] }, { "id": "micro-behaviors/communications/http/response::source-http-200-status", "atk": "T1190", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Compares HTTP response status property to 200", "from": [ { "file": 7 } ] }, { "id": "micro-behaviors/communications/http/token-auth::bearer-header-from-variable", "conf": 0.94, "crit": 3, "desc": "Builds Bearer authorization header from variable", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/communications/http/authorization-header::authorization-header-map-entry", "atk": "T1071.001", "mbc": "C0002", "conf": 0.88, "crit": 3, "desc": "Defines an HTTP Authorization header mapping", "from": [ { "file": 9 } ] }, { "id": "objectives/discovery/host/geo::ip-geolocation-lookup", "atk": "T1016", "conf": 0.85, "crit": 3, "desc": "IP geolocation lookup via API", "from": [ { "file": 3 }, { "file": 24 }, { "file": 25 }, { "off": 529, "file": 26, "line": 19 }, { "file": 27 } ], "uses": [ 63, 127 ] }, { "id": "metadata/package/scripts/entrypoint::console-scripts-entry", "conf": 0.88, "crit": 3, "desc": "Declares Python console-script entry points", "from": [ { "file": 55 } ] }, { "id": "micro-behaviors/os/package-manager/install::apt-install-cmd", "conf": 0.75, "crit": 3, "desc": "Installs a package with apt", "from": [ { "file": 17 } ] }, { "id": "micro-behaviors/process/hook/interception::python-stdio-stream-hook", "mbc": "B0024", "conf": 0.88, "crit": 3, "desc": "Python replaces a standard I/O stream", "from": [ { "file": 2 } ] }, { "id": "metadata/package/dependencies/declaration::pypi-http-client-dependency", "conf": 0.9, "crit": 3, "desc": "PyPI metadata declares an HTTP client dependency" }, { "id": "micro-behaviors/communications/http/lib/requests::requests-post", "conf": 0.85, "crit": 3, "desc": "Calls requests.post() in Python", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/time/sleep/interval::python-sleep-1s-plus-arg", "conf": 0.75, "crit": 3, "desc": "Python sleep waits at least one second", "from": [ { "file": 3 } ] }, { "id": "metadata/file/data-blob::high-byte-script-text", "conf": 0.88, "crit": 3, "desc": "High-byte script text (\u003e=12%)", "from": [ { "file": 8 } ] }, { "id": "objectives/discovery/network/enumeration::certificate-transparency-domain-search", "conf": 0.94, "crit": 3, "desc": "Searches certificate records for a domain", "from": [ { "off": 1942, "file": 3, "line": 39 }, { "file": 12 }, { "file": 13 }, { "off": 1563, "file": 45, "line": 48 } ], "uses": [ 95, 159 ] }, { "id": "metadata/package/ecosystem::pkginfo-summary-field", "conf": 0.9, "crit": 2, "desc": "Declares Python package summary", "from": [ { "file": 54 } ] }, { "id": "objectives/exfiltration/oob/system-profile::python-user-path-profile-fields", "atk": "T1041", "mbc": "E1041", "conf": 0.88, "crit": 3, "desc": "Python user path profile fields", "from": [ { "file": 43 } ] }, { "id": "micro-behaviors/data/control-flow/membership::set-construction", "conf": 0.75, "crit": 3, "desc": "Python set() construction", "from": [ { "file": 12 } ] }, { "id": "micro-behaviors/data/control-flow/error-handling::python-import-error-handler", "atk": "T1027", "mbc": "C0027", "conf": 0.5, "crit": 3, "desc": "Handles a missing-module ImportError", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/path/check::python-os-path-isdir-text", "conf": 0.7, "crit": 3, "desc": "Python os.path.isdir path test text", "from": [ { "file": 8 } ] }, { "id": "micro-behaviors/communications/ip/parse::ip-address-camel", "conf": 0.4, "crit": 2, "desc": "ipAddress field (camelCase)", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/os/env/secret-name::posix-env-token-name", "conf": 0.7, "crit": 3, "desc": "Reads a TOKEN-named environment variable", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/communications/http/header/content-type::python-json-content-type", "conf": 0.94, "crit": 3, "desc": "Python JSON content type", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/os/env/ai-provider::python-api-key-env-read", "conf": 0.85, "crit": 3, "desc": "Python reads API key env vars", "from": [ { "file": 48 } ] }, { "id": "micro-behaviors/data/encode/base64::b64encode-call", "conf": 0.9, "crit": 3, "desc": "Encodes data with Python base64.b64encode()", "from": [ { "file": 11 } ] }, { "id": "micro-behaviors/fs/directory/traverse::recursive-directory-traversal", "conf": 0.86, "crit": 3, "desc": "Recursive directory traversal logic", "from": [ { "file": 8 } ], "uses": [ 85, 168 ] }, { "id": "micro-behaviors/process/create/subprocess::python-subprocess-io-fields--stderr", "atk": "T1059.006", "conf": 0.84, "crit": 3, "desc": "Process output/status field names (stderr)", "from": [ { "file": 17 } ] } ] }, { "ctx": [ { "b": "x(d*cA=-BBBZ/rgz!0v1A%=R#AbP=saAI*H3tBu@z/P}xx(d*cA==bivHrCHwmYu}uUaa@B-I52wmY.3c[dg:arR^Ha%FkTKKgqXG3.lVGvbm$G3Z:GZ0KHuVE3hfUPRr4^6g)5^74FO^74Dn^7W[U^sP-M^77pCZTmOUXffek^6.nK^6z3j^7yHFXx}[nZTfZxFye$}WjSTEa{]CnarUiaAc0c+aBsCrarR^HarR^JA+flkwPI%mb03?\u003cA+flkwPI%ma$K6zarR^HarR^JvqfT[BAzECiV]RPx(vWbBz@AP3lQDlarR^Har\u003eulB0rT/b4LOjAcVLsz/c:I3lQDlarR^Har\u003e=rz/fc7B.$P0AS", "ln": 0, "col": 1, "line": 1 }, { "b": "b2z#-nO})GwM9eGA:@=bed9HxarR^HarV7tarR^Hw]zYjzeS@oaAhaeazCZowmY.3e[]Aszf49OiTM#LarR^HarU=DC@=oParR^HarR^HarR!vze:AlBzLV2e[]fwz/P@bzeS%cy?k2iz!7p7arR^HarR^HwQ4Y@Ac9i]ze:AlBvyj\u003cz/N(CarR^HarR^HarR^HBAhT/3lQDlarR^HarR^HarR^HaAIWmAb](bwPI]Bv}YB-yHpNWy?$I7B9R*VwQ4=@B-.53y?kdua$WTQefDcQx(CmEar\u003eJqB97\u0026by:7zMAbf8qar\u0026x?ADL#bBrU0t3lQDlarR^HarR^Haz2!cwPh-lmr\u0026rNAcb/jzAnaEarR^HarR^HarR^HarR!CvrlF%arR^HboUv9^sxPT^7mPl^6RhU^6z35^6.lkaKEZDZr\u003cNvGWvlQVMNS2aKE\u003cHY3V5QGv46NWA#RlXx}R\u003carR^HBAhT/3lQDlarR^HazbUjz6iXfy?mG#B.@:Fz!a0bwPF#dze:AlBrC7izF0P}3lQDlarR^Hay/tcw[+)gvq{g4D0+ViuUaa#c[bGCarR!rCW\u003er7BrB1%v}xR3x(v(I3lQDlarR^HaAg+gA%-lYuUaa@B-I52wmY.3c[bGguTE$/A=U@kzEl-[jS\u003e}6e?![ia]", "ln": 966, "col": 31, "line": 33 } ], "depth": 1, "facts": { "imp": [ [ "", "deps.items" ], [ "", "importlib.import_module" ], [ "", "subprocess.check_call" ], [ "", "config.apply_to_env" ], [ "", "_ensure_deps" ], [ "milenium.modules", "config" ], [ "", "importlib" ], [ "", "milenium.modules" ], [ "", "subprocess" ], [ "", "sys" ] ], "mbr": [ "config.apply_to_env", "deps.items", "importlib.import_module", "subprocess.check_call", "sys.executable" ], "tgt": [ "_ensure_deps", "config.apply_to_env", "deps.items", "importlib.import_module", "subprocess.check_call" ], "funcs": [ [ "_ensure_deps", 48 ], [ "_ensure_deps", 546 ] ], "metrics": { "ast": { "max_depth": 15, "call_count": 5, "node_count": 419, "member_count": 5, "max_array_len": 6, "member_depth_max": 2 }, "file": { "size": 1495, "entropy": 4.57 }, "text": { "lines": 53, "top_char": 34, "max_ws_run": 1, "digit_ratio": 0.02, "space_count": 424, "char_entropy": 4.57, "unique_chars": 72, "top_char_null": 0, "string_density": 0.94, "top_char_ratio": 0.07, "avg_line_length": 27.23, "max_line_length": 97, "non_ascii_ratio": 0.09, "empty_line_ratio": 0.09, "last_line_length": 21, "whitespace_ratio": 0.32, "identifier_density": 0.55, "line_length_stddev": 19.38, "normalized_string_count": 6.87, "repeated_char_sequences": 16, "normalized_unique_identifiers": 3.14 }, "binds": { "count": 3 }, "binary": { "peak_region_bytes": 1495, "peak_region_entropy": 4.58 }, "source": { "function_count": 1 }, "imports": { "count": 5, "dynamic": 1, "stdlib_count": 3, "stdlib_ratio": 0.6, "third_party_count": 2, "third_party_ratio": 0.4 }, "strings": { "bytes": 485, "count": 50, "avg_length": 9.7, "max_length": 91, "avg_entropy": 2.55, "entropy_stddev": 0.69 }, "comments": { "chars": 58, "count": 1, "lines": 1, "to_code_ratio": 0.02 }, "functions": { "count": 1, "density": 3.77, "code_ratio": 0.81, "length_stddev": 6.5, "avg_name_length": 12, "no_params_count": 2, "avg_length_lines": 21.5, "max_length_lines": 28, "min_length_lines": 15 }, "identifiers": { "count": 29, "unique": 18, "avg_length": 8.11, "max_length": 13, "min_length": 3, "avg_entropy": 2.53, "reuse_ratio": 0.62, "length_stddev": 3.28, "all_lowercase_ratio": 0.89, "double_underscore_count": 1, "underscore_prefix_count": 2 } } }, "id": 1, "mol": "O(Xe)H₃(Db₂OsPo₄)Md₂(In₂Pt)", "path": "/data/samples/incoming/forager/python/pythonhosted.org/pypi.org/milenium/milenium-1.1.1-py3-none-any.whl!!milenium/__init__.py", "pid": 0, "risk": 7, "sha": "082d1207c9d3c5787b575ccb6643bf7d9900dc123d00da50bb613e500a1bcd56", "size": 1495, "traits": [ { "id": "metadata/import/python/milenium/modules/config::config", "conf": 0.95, "crit": 2, "desc": "imports config from milenium.modules", "spans": [ [ 1384, 0 ] ] }, { "id": "metadata/import/python/importlib::importlib", "conf": 0.95, "crit": 3, "desc": "imports importlib", "spans": [ [ 36, 9 ] ] }, { "id": "metadata/import/python/milenium/modules::milenium/modules", "conf": 0.95, "crit": 2, "desc": "imports milenium.modules", "spans": [ [ 1360, 0 ] ] }, { "id": "metadata/import/python/subprocess::subprocess", "conf": 0.95, "crit": 3, "desc": "imports subprocess", "spans": [ [ 7, 10 ] ] }, { "id": "metadata/import/python/sys::sys", "conf": 0.95, "crit": 2, "desc": "imports sys", "spans": [ [ 25, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "spans": [ [ 998, 0 ] ] }, { "id": "micro-behaviors/data/control-flow/error-handling::python-import-error-handler", "atk": "T1027", "mbc": "C0027", "conf": 0.5, "crit": 3, "desc": "Handles a missing-module ImportError", "spans": [ [ 1090, 19 ] ] }, { "id": "micro-behaviors/data/control-flow/error-handling::silent-exception-pass", "atk": "T1027", "mbc": "C0027", "conf": 0.85, "crit": 3, "desc": "exception suppression via try/except pass", "spans": [ [ 1223, 50 ], [ 1421, 34 ] ] }, { "id": "micro-behaviors/os/package-manager/install::python-runtime-pip-install", "mbc": "C0002", "conf": 0.94, "crit": 3, "desc": "Python invokes pip module install", "spans": [ [ 1166, 37 ] ] }, { "id": "micro-behaviors/process/create/launch::sys-executable-module-launch", "atk": "T1059.003", "mbc": "E1059.003", "conf": 0.9, "crit": 3, "desc": "Launches Python module with interpreter", "spans": [ [ 1166, 20 ] ] }, { "id": "micro-behaviors/process/info/current::python-sys-executable-text", "conf": 0.75, "crit": 3, "desc": "Python sys.executable reference text", "spans": [ [ 1166, 14 ] ] }, { "id": "metadata/lang/natural::script-cyrillic", "conf": 0.8, "crit": 3, "desc": "Contains multiple standalone Cyrillic words", "spans": [ [ 75, 26 ], [ 102, 24 ], [ 127, 6 ], [ 134, 12 ], [ 147, 14 ], [ 1280, 22 ], [ 1303, 12 ], [ 1319, 18 ] ] }, { "id": "micro-behaviors/data/control-flow/module-exec::module-level-side-effect-call", "conf": 0.82, "crit": 3, "desc": "Python module-level function call", "spans": [ [ 1458, 14 ] ] }, { "id": "micro-behaviors/os/api-resolution/dynamic::py-importlib-import-module", "conf": 0.6, "crit": 3, "desc": "Dynamically imports a Python module", "spans": [ [ 1053, 23 ] ] }, { "id": "micro-behaviors/os/package-manager/install::subprocess-pip-install-list", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Subprocess argument list invokes pip install", "spans": [ [ 1143, 60 ] ] }, { "id": "micro-behaviors/process/create/subprocess::check-call-ast", "atk": "T1059.006", "mbc": "C0017", "conf": 0.85, "crit": 3, "desc": "subprocess.check_call call", "spans": [ [ 1143, 21 ] ] }, { "id": "micro-behaviors/process/create/subprocess::check-call-content", "atk": "T1059.006", "mbc": "E1059.006", "conf": 0.75, "crit": 3, "desc": "Calls subprocess.check_call", "spans": [ [ 1143, 22 ] ] }, { "id": "micro-behaviors/process/create/subprocess::import-subprocess", "atk": "T1059.006", "mbc": "E1059.006", "conf": 0.95, "crit": 3, "desc": "Imports Python's subprocess module", "spans": [ [ 7, 10 ] ] }, { "id": "objectives/execution/autoinstall/pip::subprocess-install", "atk": "T1059.006", "mbc": "B0024", "conf": 0.9, "crit": 3, "desc": "Runtime pip install via subprocess", "uses": [ 14 ], "spans": [ [ 1143, 60 ] ] }, { "id": "micro-behaviors/process/create/subprocess::process-execution", "atk": "T1059.006", "conf": 0.8, "crit": 3, "desc": "Python launches a child process", "uses": [ 15, 16 ], "spans": [ [ 1143, 22 ] ] }, { "id": "objectives/execution/autoinstall/pip::try-import-install", "atk": "T1059.006", "mbc": "B0024", "conf": 0.9, "crit": 3, "desc": "Try-except import with fallback pip", "uses": [ 6, 18 ], "spans": [ [ 1090, 19 ], [ 1143, 60 ] ] }, { "id": "micro-behaviors/process/create/exec::child-process-execution", "atk": "T1059", "conf": 0.94, "crit": 3, "desc": "Executes a child process", "uses": [ 19 ], "spans": [ [ 1143, 22 ] ] } ], "type": "python" }, { "ctx": [ { "b": "x(d*cA=-BBD2\u003csbze:AlBrCstz/b[@ze:AlBrCWtzdK5*ze:AlBrC1kD2vbazWHh}AbP=say/k4v}#A-A=k!qA+P2%e[n*qB8L(aazCXiz/P}xlVl\u003c-z!@$(w].*baAzgaxFaynvR/P#x(d*cA=-B6vpB4:3tar%z6iXfy?mG#B.@:Fz!a0bwPGFuz!AY]AV/7kAbP=saxh]-oMaMRwPxsAAb](fA+frk3tar%z6iXfy?mG#B.@:Fz!a0bwPF#dze:AlBrz$sarR^HzE):7uU0Q%ayO[}A+e((Bz(gJ3lQDlaAIjmwmov.B7F^2v}Wzov}xL0D2)tlwNPQ?xE\u003eoHx(XuqBz(nfy*Rl{vrb\u003c\u003eed9HxarU94B-RbdAaAA+B7F^2v}Wzox(E^7w]z3$wNPQ?xE\u003eoGA+]/bvqYB[wNPQ?xE\u003cGkarR!zvqfv{wPRp2wNPQ?xE\u003eoExK#j2z!0M\u0026B7F^2v}WzoxM4Y#xK$K(wNPQ?xE\u003cGkarR!GwO+{\u003cA:-/(ve", "ln": 0, "col": 1, "line": 1 }, { "b": "uU\u003cT[xjV9idlm!UarR!yz!AY]AV^H/raPSmz!AY]AWSbGx(4u#x)1nBy\u0026r@gefF!FwmW[FviNccarR^HB9R*VB97@hB-X-?az+$exjV8\u003carR^HA+funA=91oz!AY]ATAcXwmYu}uVPU0wHI5bzeAZ0wgO\u003cBvrc0(BsXLKz!a0bwH[%mvrt{eaAR4jxjVf(BA}?pjX/{kwHPUEarR^HBAhT/3lQDlarR^Haz$+ezEl{-e[]iqBsnNBarR^HarR^HzE):7uU0Q#B76l6c$vgjzddr)efG4yA+w%9efF!FwozZ1efFFiByuZyByxi5wPRp3D2NsTByxi5wPRp3D2Nsz3lQDlarR^HaAhvtxl4N8B0@kcwP8DOlolmoX6RwaZTfHrFZyTFZ0KFqdgdguarUluv}xR3avQJ+wPh:9z/cXaB0b3P3lQDlarR^HaAhvtxl4N8B0$SApgXuYl{-2cA=M8siV@=XEiH9E3jo4dy?Wx{e[YiyB-n-T3s)ZWaz\u003eL3zyu}{3lQDlar\u00260Nze0/$zFslgaMv{oaKL+!U*y5gI{P0S^7E-t^tuk-^tMwZawU{cpe\u0026v.U*x-7Fy7ZJV^t@7G3.lVFfDfY3lQDlaAg+gA%-lYkY6}zzz2BqzeAZ0wge(lkX1RAv@0Y9A+xJiwO#Prb6v%rA=br5wG\u0026MgwmYu}B-Rbmd0oPxA=br5wHPUEarR^Ha%Fj9vqfv{wPP4Bax8@+A+]V7yALbInn\u0026rQxK@wia{]CnarUGsxj\u003e^@auZ\u0026Ox(mTbuU\u003cT[xjV9idgdguarU+WauZ\u0026?x(dAlBzkP6c[bGCarR!CA=kPhwPI]vw*kSN^sP-H^sxR@iV@M^wPw]uB-RbmzEEx[EiH9EarR^HA+fqmjS[fCxl4M@vruBde](8Ld0oPxA=br5wJ+fSwPzV%zdLd6arR^HuVPU0wHF:BB7GwoefG7RwPzV%zdLmvb6v%rA=br5wG\u0026VFA+fqyar\u003e@HwPzV%zdK[u3lQDlay/tcB8L(ae]U\u0026BzGEpwB8L}Gwoz:dB0#6uB1wCFzE^r@BuIxgaz2CiB-I52vrk{)x*1{]y\u0026:esay]4}vrDydj-+Z=djCPDarR!CA=kPhwPI]vw*kQd^7W[V^7W(j^7QTHX6Ru4DVS$swIe7szdLaAat1ZTfGH*vw{[.AdgdguarUGsxj\u003e^@e[nZoB7D:G3jmb9zddc@e[n*pzddr)c[bG*v@b\u003c?yC64oxlw65zGEoJwO\u003e\u003c\u0026y:7qnwmYu}wO\u003e\u003c\u0026y*QW?wgh2avqfKbiTM#LarR\u003cLb1MS*wOq", "ln": 466, "col": 10, "line": 20 }, { "b": "zE+dA3p59qx\u003e7{hvrc16zdNQbc)A!Oy:7qnwmYu}B-Iq9v@k:8B-IpEiTM#LarR\u003cLb6v{xB7nS@e[]kD^6g)g^6g)e^74Dia%FirarR^Hy\u0026r%0wPw[Rayw\u00262x()Y#z!AY]AWSvzarR^HBta?2aARsmwIe7szdLaA3lQDlaAhvtxl4N8B0$SA^sGX%^6g]F^sKz4B-IpvDV:vBEiH9EarR^HA+fqmjS[fCxl4M@vruBde](8Ld0oMDj-$^Ydgdgu", "ln": 2292, "col": 12, "line": 83 }, { "b": "3p59qx\u003e7{hvrc16zdNQbc)A!PwPzV%zdK[u3s)ZWaARlAB-RbmzEEx[dlm!UarR^Ja%G#$y?mZ4z/dPU^74Do^s/(JaKE)IZ93xBeZQ-GY3O4nU*F9IZ0RCVGczG-3lQDlaz+$exjV9ajS[9CzFsi1y\u0026r%0wPxgF3lQDlaAPpWjS[\u0026XzdLtwx(dAfdgdguarUSzz!B94B8@:wbgg$?G3Z:HFye%faARghwOl3(z6jgFB7GxfvqPO7a$i\u003cwarR!EwPF$SayPtpzEWy0e](8Ld0f3pwOl3(zc{Z?vqHjgx(+[pxK$W?uV*B3AWV6KwPzV%zdLdB3lQDlayxg#C4A6CBy/o1xl4A$a$K\u003cVB7GxfvqPNbar\u003e]sy?mm1vqNhtaAz4mefDcVB7GxfvqPN1dgdguarUomAV/cGaA!(wzxJ$hB1RfGwO(Gpdlm!UarR^HarR!pz/fSmy?kkrA+PAkc$TVcvSc6[u3*vni:jmDz!@@\u0026aBwoWa$i\u003cwarR!CA=kPhwPI]vw*kQd^7W[V^7W(j=\u0026", "ln": 2708, "col": 16, "line": 97 }, { "b": "y\u0026r%0wPxzky\u0026sxac[bGg3p5Dpx(kLkz/6u1zE+dA3p59qx\u003e7{hvrc16zdNQbc)Awxvp%dUAa9\u003c4a$i\u003c:v@b\u003c?yC6KABzkVhc)yk{wO#c{zE\u003e1yay]4}vrDydjTbeWzE^s6a$i\u003efwO960zd+nhzdd6*uVoB}xE\u003eoqzF9W3wHPUEarR^Ha%Fjcx\u003e6.Kvp%dIwNPQ?xGvo.Zr\u003cdjFy7KFG3.iUI{P0S^7^@w^74FO^7gvDZTfXq^s/(X^sP-Va%Firao", "ln": 3170, "col": 5, "line": 109 }, { "b": "kY6}zzz2BqzeAZ0wge(lkX1RAv@0YnAcb/jzyuXXeO!{ya$K\u003cEwObv[y\u0026?*nz/fbn3p59qx\u003e7{hz/x/jz/c%EeIhcOy\u0026%qkefFFmw)]*#BuJxqzE\u003em7wmYu}v@Dl%", "ln": 3748, "col": 1, "line": 127 }, { "b": "^6.ll^t#Xb^tPi{Z0KglYu#O:X6Zl=a%FirarR^Hw].*baz\u003e?ewO#j8z7YWzwozZ1B0bglAbP=say/tcw[+(+3lQDlazCBgyH}=lvqYP#C42ifwJyevarR^HarR!GA^oXMarR^HarR^HarR^Hv@Dl%x\u003eG5twPRo{wQbXtwQb*HC42ifwHN%earR^HarR^HarR!pz/fSmy?kkrA+PAkc$TVcxl4M{zE7R.^7W[Y^sxPF^7N/l^7N/ui:jmIA+e*1t{aGfwQeXFdgdguarR^HarUluv}xR3aw=S\u0026ze16jx(v(TA=M8sayPslwJyevarR^HarR^HarR!pz/fSmy?kkrA+PAkc$TVcA+e=!oIX2GmmogvflgSmt{aG9EiH9EarR^HarR^HA+funA=8i\u003earR^Hv}Gu@jS[lMzF0P}e[5NjuU:j#B0@EAarR^Hy\u0026r*0wN(]Day/tcw[+)gy\u0026r*0", "ln": 3956, "col": 89, "line": 131 }, { "b": "arR^HBywS{wIdz4wm5?+y\u0026%Pjc)E3d^7W(l^sY/T^tPm#3lQDlarR^HarR^HazbLjaAwPszxJ$rCxk!LarR^HarR^HarR^HarR^HBywS{wIdz4wm6v}CpmJOAWU%jb6m(It}5#sf/-I\u003caAyWgv@Dj3vqYQ1t}vastoXe$A+w%9b3=-xA:6-8z!a0bwG\u003eze3lQDlarR^HarR^Hay/tcB8L(ae]U\u0026BzGEpGvpB4:dgdguarUluv}xR3avQJ+wPh:9z/cXaB0b3P3lQDlarR^Hay/tcB8L(ae]U\u0026BzGEpsb3OI{y?aVewN]8[P3-wvXb", "ln": 5602, "col": 9, "line": 175 }, { "b": "a%G#^nG=x\u0026^7N?U^6.nK^s/(O^7dLPa%FirarR^Hw].*baz\u003e?ewO#j8z7Y{Mx=}bbAbP=sazC.nwPzi?Bzk]f3lQDlazC.nwPzi?Bzk]fc[bGg3tB8{uTEXVzdN6Yau.\u003egb41X]vqfQ^uM}JrarR^Hzddc@c[b", "ln": 5938, "col": 6, "line": 186 } ], "depth": 1, "facts": { "imp": [ [ "", "Console" ], [ "", "TeeLogger" ], [ "", "neon_db.init" ], [ "", "neon_db.save" ], [ "", "progress" ], [ "", "progress" ], [ "", "click.group" ], [ "", "main.command" ], [ "", "click.argument" ], [ "", "_init_logger" ], [ "", "time.time" ], [ "", "progress" ], [ "", "aggregator.run" ], [ "", "_save" ], [ "", "console.print" ], [ "", "json.dumps" ], [ "", "progress" ], [ "", "time.time" ], [ "", "logger.close" ], [ "", "main.command" ], [ "", "click.argument" ], [ "", "_init_logger" ], [ "", "time.time" ], [ "", "progress" ], [ "", "aggregator.run" ], [ "", "_save" ], [ "", "console.print" ], [ "", "json.dumps" ], [ "", "progress" ], [ "", "time.time" ], [ "", "logger.close" ], [ "", "main.command" ], [ "", "click.argument" ], [ "", "_init_logger" ], [ "", "time.time" ], [ "", "progress" ], [ "", "aggregator.run" ], [ "", "_save" ], [ "", "console.print" ], [ "", "json.dumps" ], [ "", "progress" ], [ "", "time.time" ], [ "", "logger.close" ], [ "", "main.command" ], [ "", "click.argument" ], [ "", "_init_logger" ], [ "", "time.time" ], [ "", "progress" ], [ "", "aggregator.run" ], [ "", "_save" ], [ "", "console.print" ], [ "", "json.dumps" ], [ "", "progress" ], [ "", "time.time" ], [ "", "logger.close" ], [ "", "main.command" ], [ "", "click.argument" ], [ "", "_init_logger" ], [ "", "time.time" ], [ "", "progress" ], [ "", "asyncio.run" ], [ "", "telegram_analysis.check_user" ], [ "", "_save" ], [ "", "res.items" ], [ "", "console.print" ], [ "", "progress" ], [ "", "time.time" ], [ "", "logger.close" ], [ "", "main.command" ], [ "", "click.argument" ], [ "", "click.option" ], [ "", "_init_logger" ], [ "", "time.time" ], [ "", "progress" ], [ "", "asyncio.run" ], [ "", "image_search.search" ], [ "", "_save" ], [ "", "console.print" ], [ "", "json.dumps" ], [ "", "progress" ], [ "", "time.time" ], [ "", "logger.close" ], [ "", "main.command" ], [ "", "click.option" ], [ "", "click.option" ], [ "", "config.set_key" ], [ "", "console.print" ], [ "", "console.print" ], [ "", "config.all_keys" ], [ "", "config.locked_keys" ], [ "", "console.print" ], [ "", "config.config_path" ], [ "", "console.print" ], [ "", "console.print" ], [ "", "cfg.items" ], [ "", "console.print" ], [ "", "len" ], [ "", "console.print" ], [ "", "main.command" ], [ "", "click.option" ], [ "", "click.option" ], [ "", "_init_logger" ], [ "", "neon_db.init" ], [ "", "neon_db.stats" ], [ "", "console.print" ], [ "", "console.print" ], [ "", "console.print" ], [ "", "neon_db.query" ], [ "", "Table" ], [ "", "table.add_column" ], [ "", "table.add_column" ], [ "", "table.add_column" ], [ "", "table.add_column" ], [ "", "table.add_row" ], [ "", "str" ], [ "", "console.print" ], [ "", "console.print" ], [ "", "logger.close" ], [ "", "main.command" ], [ "", "interactive" ], [ "", "main" ], [ "", "Console" ], [ "", "Table" ], [ "", "TeeLogger" ], [ "", "abuseipdb_search" ], [ "", "aggregator" ], [ "", "asyncio" ], [ "", "censys_search" ], [ "", "click" ], [ "", "config" ], [ "", "holehe_search" ], [ "", "image_search" ], [ "", "interactive" ], [ "", "ipinfo_search" ], [ "", "json" ], [ "", "maigret_search" ], [ "", "milenium.modules" ], [ "", "milenium.modules.logger" ], [ "", "milenium.tui" ], [ "", "neon_db" ], [ "", "progress" ], [ "", "rich.console" ], [ "", "rich.table" ], [ "", "sherlock_search" ], [ "", "shodan_search" ], [ "", "sys" ], [ "", "telegram_analysis" ], [ "", "time" ], [ "", "urlscan_search" ], [ "", "virustotal_search" ] ], "mbr": [ "aggregator.run", "asyncio.run", "cfg.items", "click.argument", "click.group", "click.option", "config.all_keys", "config.config_path", "config.locked_keys", "config.set_key", "console.print", "image_search.search", "json.dumps", "logger.close", "main.command", "neon_db.init", "neon_db.query", "neon_db.save", "neon_db.stats", "r.command", "r.module", "r.target", "r.ts", "res.items", "s.findings", "s.leaks", "s.total", "sys.stdout", "table.add_column", "table.add_row", "telegram_analysis.check_user", "time.time" ], "tgt": [ "Console", "Table", "TeeLogger", "_init_logger", "_save", "aggregator.run", "asyncio.run", "cfg.items", "click.argument", "click.group", "click.option", "config.all_keys", "config.config_path", "config.locked_keys", "config.set_key", "console.print", "image_search.search", "interactive", "json.dumps", "len", "logger.close", "main", "main.command", "neon_db.init", "neon_db.query", "neon_db.save", "neon_db.stats", "progress", "res.items", "str", "table.add_column", "table.add_row", "telegram_analysis.check_user", "time.time" ], "funcs": [ [ "_init_logger", 457 ], [ "_save", 570 ], [ "main", 867 ], [ "user", 1006 ], [ "email_cmd", 1458 ], [ "ip_cmd", 1892 ], [ "url_cmd", 2320 ], [ "tg", 2737 ], [ "img", 3277 ], [ "config_cmd", 3840 ], [ "db_neon", 4959 ], [ "tui", 5922 ] ], "metrics": { "ast": { "op.add": 1, "op.lor": 1, "op.sub": 6, "op.land": 2, "max_depth": 19, "call_count": 122, "node_count": 2200, "member_count": 32, "op_density.add": 0, "op_density.lor": 0, "op_density.sub": 0, "op_density.land": 0, "max_concat_chain": 2, "member_depth_max": 2 }, "file": { "size": 6064, "entropy": 5.13 }, "text": { "lines": 192, "top_char": 101, "max_ws_run": 2, "digit_ratio": 0.01, "space_count": 1009, "char_entropy": 5.13, "unique_chars": 110, "top_char_null": 0, "string_density": 0.43, "top_char_ratio": 0.07, "avg_line_length": 30.59, "max_line_length": 115, "non_ascii_ratio": 0.09, "empty_line_ratio": 0.15, "last_line_length": 10, "whitespace_ratio": 0.2, "identifier_density": 2.22, "line_length_stddev": 23.25, "normalized_string_count": 5.92, "repeated_char_sequences": 20, "suspicious_identifier_ratio": 0.06, "normalized_unique_identifiers": 13.18 }, "binds": { "count": 29 }, "binary": { "peak_region_bytes": 6064, "peak_region_entropy": 5.27 }, "source": { "function_count": 12 }, "imports": { "count": 29, "stdlib_count": 4, "stdlib_ratio": 0.14, "third_party_count": 25, "third_party_ratio": 0.86 }, "strings": { "bytes": 1649, "count": 82, "avg_length": 20.11, "max_length": 109, "avg_entropy": 2.97, "empty_count": 1, "entropy_stddev": 1.11 }, "functions": { "count": 12, "density": 6.25, "avg_params": 1.33, "code_ratio": 0.66, "max_params": 5, "length_stddev": 6.41, "avg_name_length": 6, "no_params_count": 3, "avg_length_lines": 10.5, "max_length_lines": 24, "min_length_lines": 3, "avg_param_name_length": 5.94 }, "identifiers": { "count": 426, "unique": 100, "avg_length": 6.8, "max_length": 17, "min_length": 1, "avg_entropy": 2.29, "reuse_ratio": 0.23, "length_stddev": 3.79, "has_digit_ratio": 0.01, "sequential_names": 6, "single_char_count": 5, "single_char_ratio": 0.05, "high_entropy_count": 2, "high_entropy_ratio": 0.02, "all_lowercase_ratio": 0.94, "numeric_suffix_count": 1, "double_underscore_count": 1, "underscore_prefix_count": 3 } } }, "id": 2, "mol": "K(Te)O(Xe)H₃(Cm₂Db₃Po₄)Md(Pt)", "path": "/data/samples/incoming/forager/python/pythonhosted.org/pypi.org/milenium/milenium-1.1.1-py3-none-any.whl!!milenium/cli.py", "pid": 0, "risk": 11, "sha": "b21db6ac863844c01d4ae8c0fc1ee44c3706d6185f8c23ff8c577c44869b95e7", "size": 6064, "traits": [ { "id": "metadata/lang/natural::lang-english--atom-2", "conf": 0.8, "crit": 1, "desc": "English function-word token \"and\"", "spans": [ [ 4036, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "spans": [ [ 3034, 0 ] ] }, { "id": "micro-behaviors/communications/http/request/tasking::http-task-command-field-read", "atk": "T1071.001", "mbc": "C0002", "conf": 0.94, "crit": 3, "desc": "Reads structured task command field", "spans": [ [ 5716, 11 ] ] }, { "id": "micro-behaviors/communications/ipc/agent-hook::agent-hook-input-field", "conf": 0.9, "crit": 3, "desc": "Reads a hook command field", "spans": [ [ 5717, 9 ] ] }, { "id": "micro-behaviors/data/control-flow/error-handling::python-permission-error-handler", "atk": "T1027", "mbc": "C0027", "conf": 0.9, "crit": 3, "desc": "Python PermissionError except handler", "spans": [ [ 4178, 22 ] ] }, { "id": "micro-behaviors/data/db/schema/relational::account-handle-field", "conf": 0.8, "crit": 3, "desc": "Account handle field name", "spans": [ [ 994, 10 ] ] }, { "id": "micro-behaviors/data/source/syntax/keyword::function-command-parameter", "conf": 0.8, "crit": 3, "desc": "Python function accepts a command parameter", "spans": [ [ 568, 60 ] ] }, { "id": "micro-behaviors/process/create/subprocess::python-subprocess-io-fields--stdout", "atk": "T1059.006", "conf": 0.84, "crit": 3, "desc": "Process output/status field names (stdout)", "spans": [ [ 534, 6 ] ] }, { "id": "micro-behaviors/process/fd/stdio::py-stdout-custom-stream", "conf": 0.75, "crit": 3, "desc": "Python redirects stdout to custom stream", "spans": [ [ 534, 15 ] ] }, { "id": "objectives/execution/condition/platform::python-click-option-call", "conf": 0.7, "crit": 3, "desc": "Python Click option declaration", "spans": [ [ 3234, 13 ] ] }, { "id": "well-known/lib/stdlib/python-stdlib::asyncio-reference", "conf": 0.5, "crit": 3, "desc": "Python asyncio library reference", "spans": [ [ 42, 7 ] ] }, { "id": "well-known/tool/detection/threat-intel::virustotal", "conf": 0.7, "crit": 3, "desc": "VirusTotal service name reference", "spans": [ [ 271, 10 ] ] }, { "id": "metadata/lang/natural::script-cyrillic", "conf": 0.8, "crit": 3, "desc": "Contains multiple standalone Cyrillic words", "spans": [ [ 765, 16 ], [ 899, 10 ], [ 910, 12 ], [ 929, 18 ], [ 1128, 10 ], [ 1352, 12 ], [ 2356, 12 ], [ 2772, 8 ] ] }, { "id": "micro-behaviors/process/hook/interception::python-stdio-stream-hook", "mbc": "B0024", "conf": 0.88, "crit": 3, "desc": "Python replaces a standard I/O stream", "spans": [ [ 530, 19 ] ] }, { "id": "micro-behaviors/process/lifecycle/auto-exec::asyncio-run-call", "conf": 0.85, "crit": 3, "desc": "Python asyncio.run call", "spans": [ [ 2917, 11 ] ] } ], "type": "python" }, { "ctx": [ { "b": "x(d*cA=-BBD2\u003csbze:AlBrCTry?m?#x(d*cA=-BrzWHh}AbP=say/tcBy/Ysy?Wt=x(d*cA=-BCx(dz*w].*bay[]5wPRT6wGUY7AbP=say[]5wPRT6wEr3\u0026z/3Rqx\u003e7*ev@Dmaz!@#cx(d*cA=-A\u003ez/fSmy?i@=A=k!qA+P2%e]j%wz/{dAx(d*cA=-A$vr(^lBp8S2z/3Rqx\u003e7*eAa9S}y-)CeAbP=saw=G:wO.Y=A=k!qA+P2%e{7VHBrCpmAbP=saxh]%Bp8S2z/3Rqx\u003e7*evqGT\u003czxJUgAbP=savf*TxkO5*A=k!qA+P2%e]klBwGUY7AbP=sawuG)wEr3\u0026z/3Rqx\u003e7*eAb](lAc9jpze:AlBrBz2z/6Dn3tar%z6i\u003ekv}WG8z!%MkzGu}mze:AlBrA}?y\u0026%PjA%=J1z/3Rlx(4u#x)1nBzeS%cy?mVuy\u0026r%0wPw]c", "ln": 0, "col": 1, "line": 1 }, { "b": "\u0026*2\u0026M\u0026*bzWMwBK^H#K.R\u0026*2U=MwBK^H#KXZ\u0026*bzWMwBK=KSU+?arYWfH#K.R\u0026*2+/M5$0\u003cKM8K!\u0026*2R+M7u{2H#K.R\u0026*bzWMwBK=MMNBgMwBK^H#KXZ\u0026*bzWMwBK=K(zW.\u0026*bzWM60giaMwYy\u0026*bzWM676(H#K.R\u0026*bzWMwBK=MMUpNH#K.R\u0026*bzWMwBK=KQy9lH#KZ", "ln": 594, "col": 13, "line": 21 }, { "b": "M5$0\u003cOGM{TH#K.R\u0026*2Sk\u0026*2$(M5$0\u003cOGG3$arYWeN=oP]\u0026*37]M73Y$KM8K@\u0026*2$(M5$0\u003cKM8K!\u0026*2R+M5$0\u003cKM8K@\u0026*2$(M5$0\u003cKM8K!\u0026*2R+M5$0\u003cKM8K@\u0026*2$(M5$0\u003cOGG6mM73Y$KM8K!\u0026*2R+M7u{1N=oP]\u0026*35S\u0026*2$(M5$0\u003cKM8K!\u0026*2R+M5$0\u003cOGM{SN=oP]\u0026*35SarR^H\u0026*2$(M5$0\u003cOEcL+a{[VApFBLHpde26jS)@oarR^Hc)E3g^4nQK^4O*PaKDR8Uf-AWMc+{yefFd7arR^HarR^Hc)A!PwPw[Q^7N/o^7hy+efDchvqfv{wPP4Bax8@+A+]V7yA+hU3lQDlarR^HasFBBzddc{uT)}-auTjLvqfKwa$K\u0026Xnn\u0026rQxK@qpaxAh%B-QJ2Byw#fdj+/GarR^HarR^Pb5?jlzE)f+zdB+K^7N/u^7E-k^ssz8efDd-P3Um0WB6JKU*F6HZr}DZaKL+/G3/a}U*y8gUP+IE3lQDlarR^HasFBQxcorVB7GxfvqPNta$K\u0026XraP(SBzbPgiV}x(eZQ-GY3O4nU*F9IZ0RAQdj+/GarR^HarR^Pb57[bauTQKBz9\u0026ZefDckx\u003e6.Kvp%dIwNPQ?xD!(R3lQDlarR^HasFBPz!0G\u0026y*QW?wfs1YZ0KpoX\u0026}q?ar]ga^7W[Z^sGVL^sP-PaKE)IZ97!o^74Dl^sSR(ed9HxarT@sed9HxarS6R^4O*K^4X)*a$K\u003cv3lQDlarR^HasFBFA9)9(wfs0ap^c6Oar\u003c-$z!9o]as!N4wO#NmB08$Qr-yg(avfEVB7DKAed9HxarR^HarS6Rwn=rcjKyEZZr\u003cKtWA#PJa$K\u0026Xs4DaUq.f4Vpe-X^v@=VzB7=:Ded9HxarR^HarS6RB-Iq9v@k:0jxkoMj%zK2b6v{xB7nS@e[]kFdj+/GarR^HarR^Pb6NZsx(^T4wP/gU^6Rfl^7E-k^7IQ!efDcmwP?T9B7DE}nkz/Qa$k5IarR^HarR^Hc)A.Ny*Q)]w]w!OxM4%lj%zK2b2X", "ln": 1250, "col": 165, "line": 24 }, { "b": "arS6RA=kA9BAnM!^6Rfl^7E-k^7IQ!efDcSz^)TbB1RMVBrSd+3lQDlaycAE3lQDlasFCXQTk:ZMc=CQN:vACefFd7arR^HarR^Hc)AROzE)u3jKy\u003c\u0026U*F0FZr\u003cHtI#", "ln": 2109, "col": 7, "line": 43 }, { "b": "^tMza^7W(la$k5IarR^Ht}4rit)Z{qmn)bRpFJ2}aBsCrarR^JB97\u0026hBrS:*wmoN\u003eBzkP6e]CPKc[cXOarR^Hb5}:pA+P9ab03\u00262ed9HxarR\u003eGwPJ0gBAnS!atttNarR^Hb5yXeBrS:*tu@=!arR^Hb4C+oA+fcgb03\u0026wz/fbq3lQDlar\u003errA=L-eByf9hvrcDl", "ln": 3132, "col": 25, "line": 69 }, { "b": "zxJ+7D2E?E3jmbJwO969wO#3\u0026A:JG\u003evpS}\u0026c[dg:arR^Hy\u0026r%8uVY\u003e7BrAZ?raQq@c})AbpB)SfBA}XljTauNy?aVewN(#l3lQDlayX+%zE)\u0026hjS)ZnCYUMIA=k/4zddE2B-n-oarR^HarR^Hb3OI{y?aVjxLzN1t$)):mnuAOo\u003conWz!@@bCw7Yj", "ln": 4385, "col": 10, "line": 125 }, { "b": "uU\u003cB]wPGyBA+Pf1Bye\u0026#zE)(ijS)%mefFe53lQDlazC}ezf3*.ax@aUarR^Hw]zYjv{%Egay/n0B0bgmavw}0o*IJxq-UmdarR^HarR!vBy/rge[5ZrwO#3bc)AefBrSmUv{%EddgdguarR^HarUomAV!\u003eewgO\u003clwPIu7x(k56zdEYG3lQDlarR^", "ln": 4929, "col": 9, "line": 144 }, { "b": "b64m9a$i\u003cwarR^HarR^HarR!Gvrc0(Bs}0vAaJ]$d0c)B3lQDlaz+R3BrAZ?raQq@c)z]la$kcVz!T8qy?mj2uU\u003cB]wPGpcarR^HA+Pf1BrAZ?raQq@c)z]la$kcVz!T8qA+Pf1Bye\u0026#zE)(r3lQDlay/taB09Q*lVl^-zeKzytwN\u003e.BsXLPx\u003eIa3t}vafCM", "ln": 5532, "col": 34, "line": 161 }, { "b": "dgcz8arR!vw/$2vq=um-pfO]LB-IIlzGE7diTM#LarR^HarUlivq{p0wfs2TBzkP6e{7/AwHF#IeG^$Xq=um-pfO]LB-IIlzGGlbByxiib3+J#arR^HarR!yx(mH6e[5ZrwO#3ba%FDyarR^HarR^Hy?W=#B1Q)uAaJ]$c$TVcvSc6[aBdKmy\u0026sJ6\u0026*d1}DJ", "ln": 6197, "col": 85, "line": 176 }, { "b": "y?aVewN]9aL.4?UFGNYRpFJ32llLoLF-q]Btq6D7y?aVewN]6\u003cdgdguarUi7uV*y9auZ\u0026Sw[J-ewPPsAl{T^rlp1KsuSx#$a$K\u0026Xa$i\u003cwarR!yx(mH6e[5ZrwO#3bw*gD6xLzN1t#:=@i:jmYxLzN1t{9u:A+e*1ugsFJK%0B]lRx\u003cotq6SfwO2:+a%pPiay[}*B-IpvwO=B0ar\u003e3gwN]7wpGeDnmo0FAA+e=!a$i\u003cwarR!GA^oXMarR^HarR^H", "ln": 6961, "col": 22, "line": 199 }, { "b": "oL4TFB2)IUCw7YjwNcA3arT)ewN]7[B6y2dwNPv}cTzd8flgSmt{pZ8arR^HwQ4Y@Ac9i\u003eCW\u003er7BzkVhayPslwJyevarR^HarR!yx(mH6e[5ZrwO#3bw*gD1wN]7nqC]K#DVKpHc$K\u0026iiYnV$EoOvBwN]6\u003cdgcz8arR!yx(mH6e[5ZrwO#3ba%FDyarR^Hy?W=#B1Q)u", "ln": 7373, "col": 31, "line": 206 }, { "b": "tm8F}arR^HarS6Rq+fXLk#5QPar\u003c-PpEEGzuQmHWuRr*\u003ca$k5IarR^HarR^Hc)z2Epe+p]a$K\u0026XlQ::GsYnWbpFjbKa$k5IarR^HarR^Hc)zX\u003epGfRNa$K\u0026Xr.lg?q=DK(k$\u003eSKp!t1!moH/-ed9HxarR^HarS6Rk%!NImiTo9b0!K}q:\u003cnOl{+lNmoH/-ed9HxarR^HarS6RnL?#NmO+iVar\u003cxNnLR-JuSo/]mnt3Qed9HxarR^HarS6Rrz(H?lQsD\u003eefDcpqCm", "ln": 7602, "col": 12, "line": 212 }, { "b": "mn^FUp!t1!moH/-ed9HxarR^HarS6Rnj=cAa$K\u0026Xnj=cAuRr*\u003ca$k5IarR^Ht).X%arUomAV/mdzdLmvyH}=lx(k5ewQetT3lQDlarR^HaA83rjS[iLz!{?iw[J-ewPPto", "ln": 7963, "col": 25, "line": 222 }, { "b": "aAz47ue?91\u0026/]0p^45EO^3h[L^3@yHaMwSp\u0026/]0#fjF\u003cowft]7wl*xd3lQDlazbLjaz\u0026lnzxJdcCw7]eB0rdTb4LOja$K\u0026XA+flkwPI%ma$K\u0026XvqfT[BAzECefDcSx\u003e7*2t@\u0026rnarR^HarR!yx(mH6e[5ZrwO#3bw*gD6xLzN1u3*Bptq7hlx()](ax@G0wN$", "ln": 8437, "col": 24, "line": 240 }, { "b": "b3=*zAaAy0wHIOgzE^s0uVp47v}x.5c[cOLarR^Hy*?QcB-Z?iA+frmy\u0026*\u003ebe{hbzvru6eA+fc0wPzc#wPJ0gBsnN!3lQDlaz+Fiz/{eab57}lB-X*ke{hbzvru6eA+fc0wPzc(zG6-u", "ln": 10245, "col": 20, "line": 290 }, { "b": "3lQDlaz+Fiz/{eab4++iBy/Fpt}QnswmoN\u003ec#@)pwmY^*w]zQfwPxgFdgdguarUYoBAIRwaz+Fiz/{de3jprPw/$C]vqYQ(wNw[?x(4)9zyx1iwgoLDarR^Hv\u003c0]Sv@k:eB98CpA40d/y\u0026sJeAWSvzarR^Hx\u003ewF$au.\u003egb4$L7A3vsIarR^HarR^HAclknuVg7eAclmJbgg$*ZTfHrFZzcTX//wh^7W(t^6g)g^6K}xVlmJa^6.la^7W(qaKE)IU*y8gWA#LjXfrvearQ", "ln": 10360, "col": 43, "line": 292 }, { "b": "arR^HarR^Pb11^]q^04ar8ldQp9Ikib12{VB9R*HBz\u003e@azxZIX3lQDlarR^HasFBmnM5L!r8lEVoKy7ZnNCaVsT2ytb35z#B-QJ2Byw#dk#pb}yH}=ndj+/GarR^HarR^Pb0!K}q:\u003cnOl{+lNmoH/=ar\u003c9XB-Ra=p^^R)yH}=ndj+/GarR^HarR^Pb1UQ5pdw2^r8ldQp9Ikib581gzF0/tx(tboz!\u0026{4a$k5IarR^HarR^Hc)zU?oJaqApg3p-nNCaVsT2ytb6v{xB7nS@e[]kDyH}=ndj+/GarR^HarR^Pb2?6tk#pcWnKK:Nar\u003c=@y?mm1vqNbMp!q^3l)s6h3lQDlarR^HasFBkm{!LUnNC1Oq+e8-ar\u003c=@y?i", "ln": 11298, "col": 2, "line": 322 }, { "b": "^7E-t^6?rm^7QTHZTfZwX6ROgWii\u003eL^6.nK^6.lfay/tcw[+)+v@k:etq7nky\u002613lt{pZ8arR^HBzkP6e]$\u0026uwPf4LdgdguarUfjzGx-jwIdFewNPQcdgcy?wmYu}x(n37A:-E1x)a5odlm!UarR!sA=k!qze0/$zFslge]tJqB.\u003eSgazCXiz/P}xv@Dl%x\u003eE+WarR^Hx\u003ewF$z/ff3xd^[tuUj1)B97=fB-5PRiTM#LarR^HarU36x(XopuJ", "ln": 12104, "col": 65, "line": 341 }, { "b": "VE32aW9Vr9cUN7cA3(^PW9VCjK08/:^7W(l^sGVQ^6g)a^7mPla$i\u003caarR^HCwhejawuG)wHI8fvrTaGefF$Aw].E7xKtZ\u0026A:J)0v@Dl}jV1PgvriMcx)a5G3lQDlarR^HaA}Hky?j.*A=\u003e}O3lQDlarR^HarR^HaARTHiTM#LarR^HarR^HarR^HarUGmC4ApEBz(aDdgdguarR^HarR^HarR^HarUfhwfs2Tp\u0026ZF\u003eAc9ZvB89fharR^HarR^HarR^HarR^HarR^Hb3OI{y?aVewN]7-x(4u#x)1n%fjF\u003cowft]7wl*q", "ln": 12473, "col": 21, "line": 356 }, { "b": "x(\u003eKIar\u003e/Fx(\u003eKIar\u003e!Hdlm!UarR^HarR^HarR^HarR^HarR!oA+eV{3lQDlarR^HarR^HarR^HazCBgzF%Rtv@k:eB98CpA40d@3lQDlarR^HarR^HarR^HarR^Haz++nwIeaAwmoN\u003ec$EvbCpj)?3lQDlarR^HarR^HarR^HarR^Hay/tcBzkSnwEn+!arR^HarR^HarR^HarR!9mn)bRpFLarADL\u0026kx\u003equft{7TXatBiCarR^HarR^HarR^HarR^", "ln": 12894, "col": 47, "line": 368 }, { "b": "A=-BvvqfP^arR^HarR^HarR^HarR^HBta?2aARsmwIe7szdLaA3lQDlarR^HarR^HarR^HayPq6B09Q*B7/x3CRj5Ry?W#tv@k:93lQDlarR^HarR^HarR^HayYF9auZ\u0026Yz.s$gA+PA7nLZ--3lQDlarR^HarR^HarR^HaARTHiTM#LarR^HarR^HarR^HarR^HarU(xBz8!bz/fVdCYW+ovLhXjwnc6}v@#70ByYrjBspQvw*]+FarR^HarR^", "ln": 13512, "col": 39, "line": 386 }, { "b": "arR^HarR^HA::emjS[iRw?E.cBAR8eB.8%I3lQDlarR^HarR^HarR^HarR^HazbLjaz++fwGUY8aAy[me]$#Fx([f9zE)(qdlm!UarR^HarR^HarR^HarR^HarR^HarR!vw/$]7zE\u003eCwBAh8mc[dg:arR^HarR^HarR^HarR^HarR^HarR^HarR^HAclknuVG.0B.(dFy?W=#dgdguarR^Hao", "ln": 13778, "col": 13, "line": 393 } ], "depth": 1, "facts": { "imp": [ [ "", "Console" ], [ "", "datetime.now" ], [ "", "datetime.now.strftime" ], [ "", "datetime.now" ], [ "", "OUTPUT_LOG.append" ], [ "", "len" ], [ "", "OUTPUT_LOG.pop" ], [ "", "RESULT_LOG.append" ], [ "", "len" ], [ "", "RESULT_LOG.pop" ], [ "", "RESULT_LOG.clear" ], [ "", "datetime.now.strftime" ], [ "", "datetime.now" ], [ "", "SESSION.last.append" ], [ "", "len" ], [ "", "SESSION.last.pop" ], [ "", "Layout" ], [ "", "layout.split_column" ], [ "", "Layout" ], [ "", "Layout" ], [ "", "Layout" ], [ "", "Layout" ], [ "", "Layout" ], [ "", "Layout" ], [ "", "layout.body.split_row" ], [ "", "Layout" ], [ "", "Layout" ], [ "", "Layout" ], [ "", "Text" ], [ "", "Text.from_markup" ], [ "", "Panel" ], [ "", "Align.center" ], [ "", "items.append" ], [ "", "items.append" ], [ "", "len" ], [ "", "enumerate" ], [ "", "target.append" ], [ "", "Text" ], [ "", "Text" ], [ "", "t.append" ], [ "", "t.append" ], [ "", "t.append" ], [ "", "target.append" ], [ "", "Text.join" ], [ "", "Text" ], [ "", "Text.join" ], [ "", "Text" ], [ "", "Columns" ], [ "", "Panel" ], [ "", "datetime.now" ], [ "", "divmod" ], [ "", "int" ], [ "", "uptime.total_seconds" ], [ "", "lines.append" ], [ "", "lines.append" ], [ "", "lines.append" ], [ "", "time.time" ], [ "", "lines.append" ], [ "", "lines.append" ], [ "", "lines.append" ], [ "", "lines.append" ], [ "", "lines.append" ], [ "", "lines.extend" ], [ "", "lines.append" ], [ "", "Panel" ], [ "", "config.all_keys" ], [ "", "config.locked_keys" ], [ "", "lines.append" ], [ "", "cfg.get" ], [ "", "lines.append" ], [ "", "neon_db.stats" ], [ "", "lines.append" ], [ "", "lines.append" ], [ "", "lines.append" ], [ "", "lines.append" ], [ "", "str" ], [ "", "lines.append" ], [ "", "lines.append" ], [ "", "bool" ], [ "", "cfg.get" ], [ "", "lines.append" ], [ "", "lines.append" ], [ "", "lines.append" ], [ "", "lines.append" ], [ "", "Panel" ], [ "", "lines.extend" ], [ "", "lines.append" ], [ "", "Panel" ], [ "", "lines.extend" ], [ "", "lines.append" ], [ "", "Panel" ], [ "", "Panel" ], [ "", "Panel" ], [ "", "Align.center" ], [ "", "build_layout" ], [ "", "layout.header.update" ], [ "", "render_header" ], [ "", "layout.left.update" ], [ "", "render_commands" ], [ "", "layout.center.update" ], [ "", "render_session" ], [ "", "layout.right.update" ], [ "", "render_status" ], [ "", "layout.process.update" ], [ "", "render_process" ], [ "", "layout.result.update" ], [ "", "render_result" ], [ "", "layout.input.update" ], [ "", "render_input" ], [ "", "layout.footer.update" ], [ "", "render_footer" ], [ "", "cmd.strip.lower" ], [ "", "cmd.strip" ], [ "", "push_output" ], [ "", "OUTPUT_LOG.clear" ], [ "", "clear_result" ], [ "", "push_output" ], [ "", "console.clear" ], [ "", "console.print" ], [ "", "Panel" ], [ "", "config.config_path" ], [ "", "Prompt.ask" ], [ "", "val.strip" ], [ "", "val.strip" ], [ "", "config.set_many" ], [ "", "console.print" ], [ "", "len" ], [ "", "console.print" ], [ "", "time.sleep" ], [ "", "console.clear" ], [ "", "config.is_first_run" ], [ "", "_first_run_wizard" ], [ "", "config.apply_to_env" ], [ "", "console.clear" ], [ "", "set_progress_callback" ], [ "", "push_output" ], [ "", "push_output" ], [ "", "Live" ], [ "", "draw" ], [ "", "live.stop" ], [ "", "Prompt.ask" ], [ "", "live.start" ], [ "", "cmd.strip.lower" ], [ "", "cmd.strip" ], [ "", "cmd.strip" ], [ "", "live.update" ], [ "", "draw" ], [ "", "cmd.strip" ], [ "", "time.time" ], [ "", "push_output" ], [ "", "clear_result" ], [ "", "live.update" ], [ "", "draw" ], [ "", "_handle_builtin" ], [ "", "live.update" ], [ "", "draw" ], [ "", "time.time" ], [ "", "shlex.split" ], [ "", "io.StringIO" ], [ "", "contextlib.redirect_stdout" ], [ "", "main" ], [ "", "buf.getvalue" ], [ "", "raw.splitlines" ], [ "", "line.strip" ], [ "", "push_result" ], [ "", "log_result" ], [ "", "push_result" ], [ "", "time.time" ], [ "", "push_output" ], [ "", "live.update" ], [ "", "draw" ], [ "", "console.clear" ], [ "", "Align" ], [ "", "Columns" ], [ "", "Console" ], [ "", "Layout" ], [ "", "Live" ], [ "", "Panel" ], [ "", "Prompt" ], [ "", "Text" ], [ "", "config" ], [ "", "contextlib" ], [ "", "datetime" ], [ "", "io" ], [ "", "main" ], [ "", "milenium.cli" ], [ "", "milenium.modules" ], [ "", "milenium.modules.logger" ], [ "", "neon_db" ], [ "", "rich.align" ], [ "", "rich.columns" ], [ "", "rich.console" ], [ "", "rich.layout" ], [ "", "rich.live" ], [ "", "rich.panel" ], [ "", "rich.prompt" ], [ "", "rich.text" ], [ "", "set_progress_callback" ], [ "", "shlex" ], [ "", "sys" ], [ "", "time" ] ], "mbr": [ "Align.center", "OUTPUT_LOG.append", "OUTPUT_LOG.clear", "OUTPUT_LOG.pop", "Prompt.ask", "RESULT_LOG.append", "RESULT_LOG.clear", "RESULT_LOG.pop", "SESSION.current", "SESSION.current_start", "SESSION.last", "SESSION.last.append", "SESSION.last.pop", "SESSION.queries", "SESSION.results", "SESSION.start", "Text.from_markup", "Text.join", "buf.getvalue", "cfg.get", "cmd.strip", "cmd.strip.lower", "config.all_keys", "config.apply_to_env", "config.config_path", "config.is_first_run", "config.locked_keys", "config.set_many", "console.clear", "console.print", "contextlib.redirect_stdout", "datetime.now", "datetime.now.strftime", "io.StringIO", "items.append", "layout.body", "layout.body.split_row", "layout.center", "layout.center.update", "layout.footer", "layout.footer.update", "layout.header", "layout.header.update", "layout.input", "layout.input.update", "layout.left", "layout.left.update", "layout.process", "layout.process.update", "layout.result", "layout.result.update", "layout.right", "layout.right.update", "layout.split_column", "line.strip", "lines.append", "lines.extend", "live.start", "live.stop", "live.update", "neon_db.stats", "raw.splitlines", "s.findings", "s.leaks", "s.total", "shlex.split", "t.append", "target.append", "time.sleep", "time.time", "uptime.total_seconds", "val.strip" ], "tgt": [ "Align.center", "Columns", "Console", "Layout", "Live", "OUTPUT_LOG.append", "OUTPUT_LOG.clear", "OUTPUT_LOG.pop", "Panel", "Prompt.ask", "RESULT_LOG.append", "RESULT_LOG.clear", "RESULT_LOG.pop", "SESSION.last.append", "SESSION.last.pop", "Text", "Text.from_markup", "Text.join", "_first_run_wizard", "_handle_builtin", "bool", "buf.getvalue", "build_layout", "cfg.get", "clear_result", "cmd.strip", "cmd.strip.lower", "config.all_keys", "config.apply_to_env", "config.config_path", "config.is_first_run", "config.locked_keys", "config.set_many", "console.clear", "console.print", "contextlib.redirect_stdout", "datetime.now", "datetime.now.strftime", "divmod", "draw", "enumerate", "int", "io.StringIO", "items.append", "layout.body.split_row", "layout.center.update", "layout.footer.update", "layout.header.update", "layout.input.update", "layout.left.update", "layout.process.update", "layout.result.update", "layout.right.update", "layout.split_column", "len", "line.strip", "lines.append", "lines.extend", "live.start", "live.stop", "live.update", "log_result", "main", "neon_db.stats", "push_output", "push_result", "raw.splitlines", "render_commands", "render_footer", "render_header", "render_input", "render_process", "render_result", "render_session", "render_status", "set_progress_callback", "shlex.split", "str", "t.append", "target.append", "time.sleep", "time.time", "uptime.total_seconds", "val.strip" ], "funcs": [ [ "push_output", 3333 ], [ "push_result", 3523 ], [ "clear_result", 3632 ], [ "log_result", 3677 ], [ "build_layout", 3865 ], [ "render_header", 4396 ], [ "render_commands", 4898 ], [ "render_session", 5805 ], [ "render_status", 6792 ], [ "render_process", 8706 ], [ "render_result", 9038 ], [ "render_input", 9405 ], [ "render_footer", 9685 ], [ "draw", 10006 ], [ "_handle_builtin", 10426 ], [ "_first_run_wizard", 10753 ], [ "interactive", 12200 ] ], "metrics": { "ast": { "op.add": 3, "op.sub": 6, "max_depth": 20, "call_count": 176, "node_count": 4103, "op.floordiv": 1, "member_count": 72, "max_array_len": 11, "op_density.add": 0, "op_density.sub": 0, "max_concat_chain": 2, "member_depth_max": 3, "infinite_loop_count": 1, "op_density.floordiv": 0 }, "file": { "size": 14487, "entropy": 5.35 }, "text": { "lines": 411, "top_char": 101, "max_ws_run": 5, "digit_ratio": 0.01, "space_count": 3209, "char_entropy": 5.35, "unique_chars": 144, "top_char_null": 0, "string_density": 0.61, "top_char_ratio": 0.05, "avg_line_length": 34.25, "max_line_length": 179, "non_ascii_ratio": 0.16, "empty_line_ratio": 0.13, "last_line_length": 19, "whitespace_ratio": 0.25, "identifier_density": 1.37, "line_length_stddev": 28.98, "normalized_string_count": 12.33, "repeated_char_sequences": 63, "suspicious_identifier_ratio": 0.05, "normalized_unique_identifiers": 17.39 }, "binds": { "count": 54 }, "binary": { "peak_region_bytes": 11264, "peak_region_entropy": 5.26 }, "source": { "function_count": 17 }, "imports": { "count": 29, "stdlib_count": 5, "stdlib_ratio": 0.17, "third_party_count": 24, "third_party_ratio": 0.83 }, "strings": { "bytes": 5666, "count": 250, "very_long": 1, "avg_length": 22.66, "max_length": 1007, "avg_entropy": 2.95, "empty_count": 6, "domain_count": 1, "entropy_stddev": 0.98 }, "functions": { "count": 17, "density": 4.14, "avg_params": 0.24, "code_ratio": 0.72, "max_params": 1, "length_stddev": 17.25, "avg_name_length": 12.35, "no_params_count": 13, "avg_length_lines": 17.29, "max_length_lines": 66, "min_length_lines": 2, "avg_param_name_length": 3.75 }, "identifiers": { "count": 565, "unique": 151, "avg_length": 6.8, "max_length": 21, "min_length": 1, "avg_entropy": 2.29, "reuse_ratio": 0.27, "length_stddev": 3.95, "has_digit_ratio": 0.01, "sequential_names": 7, "single_char_count": 6, "single_char_ratio": 0.04, "high_entropy_count": 2, "high_entropy_ratio": 0.01, "all_lowercase_ratio": 0.88, "all_uppercase_ratio": 0.03, "numeric_suffix_count": 1, "underscore_prefix_count": 2 } } }, "id": 3, "mol": "K(Te)O₂(DyS)H₄(CmCrDb₃Ti)Md(Pt)", "path": "/data/samples/incoming/forager/python/pythonhosted.org/pypi.org/milenium/milenium-1.1.1-py3-none-any.whl!!milenium/tui.py", "pid": 0, "risk": 9, "sha": "9477530b6aa5fb6f3f7c6a06854786149aae09f34295212e7555fc8de47fb5ec", "size": 14487, "traits": [ { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "spans": [ [ 4977, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-6", "conf": 0.8, "crit": 1, "desc": "English function-word token \"with\"", "spans": [ [ 12521, 0 ] ] }, { "id": "micro-behaviors/communications/http/ip-discovery::ipinfo-io", "conf": 0.85, "crit": 3, "desc": "ipinfo.io IP information API", "spans": [ [ 11463, 9 ] ] }, { "id": "micro-behaviors/crypto/certificate/transparency::crt-sh-endpoint", "conf": 0.92, "crit": 3, "desc": "crt.sh certificate lookup endpoint", "spans": [ [ 1942, 6 ] ] }, { "id": "micro-behaviors/data/control-flow/analysis::while-loop", "conf": 0.3, "crit": 2, "desc": "While-loop control flow", "spans": [ [ 12570, 0 ] ] }, { "id": "micro-behaviors/data/decode/custom::python-whitespace-only-line-selection", "atk": "T1140", "conf": 0.92, "crit": 3, "desc": "Python selects lines containing only whitespace", "spans": [ [ 12958, 15 ] ] }, { "id": "micro-behaviors/data/source/syntax/keyword::function-command-parameter", "conf": 0.8, "crit": 3, "desc": "Python function accepts a command parameter", "spans": [ [ 10424, 26 ] ] }, { "id": "micro-behaviors/time/sleep/interval::python-sleep-1s-plus-arg", "conf": 0.75, "crit": 3, "desc": "Python sleep waits at least one second", "spans": [ [ 12168, 9 ] ] }, { "id": "micro-behaviors/time/sleep/interval::python-sleep-call", "conf": 0.65, "crit": 2, "desc": "Pauses execution with a Python sleep call", "spans": [ [ 12164, 0 ] ] }, { "id": "objectives/supply-chain/recon-exfil/pipeline::gha-interesting-secret-keywords--rx-2", "atk": "T1195.002, T1552.001", "conf": 0.9, "crit": 3, "desc": "Cloudflare or database credential variable name", "spans": [ [ 7025, 12 ] ] }, { "id": "well-known/tool/detection/threat-intel::virustotal", "conf": 0.7, "crit": 3, "desc": "VirusTotal service name reference", "spans": [ [ 1567, 10 ] ] }, { "id": "metadata/lang/natural::script-cyrillic", "conf": 0.8, "crit": 3, "desc": "Contains multiple standalone Cyrillic words", "spans": [ [ 1452, 10 ], [ 1463, 10 ], [ 1494, 6 ], [ 1602, 10 ], [ 1617, 16 ], [ 1635, 12 ], [ 1691, 14 ], [ 1784, 14 ] ] }, { "id": "micro-behaviors/data/parse/command::python-shlex-command-split", "conf": 0.9, "crit": 3, "desc": "Python parses shell-like command words", "spans": [ [ 13576, 11 ] ] }, { "id": "micro-behaviors/time/sleep/interval::python-sleep-1s-plus", "conf": 0.75, "crit": 1, "desc": "Python one-second-plus sleep", "uses": [ 7, 8 ], "spans": [ [ 12164, 0 ], [ 12168, 0 ] ] }, { "id": "objectives/discovery/host/geo::geo-api", "atk": "T1016", "conf": 0.7, "crit": 3, "desc": "Geolocation API endpoint", "uses": [ 2 ], "spans": [ [ 11463, 9 ] ] } ], "type": "python" }, { "id": 4, "mol": "K(Te)H(Db)", "sha": "1ff363823447806dcd5d82b8c7195335aa935427f76a14b6ace0d53df4007e9c", "path": "/data/samples/incoming/forager/python/pythonhosted.org/pypi.org/milenium/milenium-1.1.1-py3-none-any.whl!!milenium/modules/__init__.py", "risk": 2, "size": 464, "type": "python", "depth": 1 }, { "id": 5, "mol": "O(C)H(Cm₅)", "sha": "68828e6d7a16f9088f7a18274b78794abcca403f54dee0396464fad0e4db7742", "path": "/data/samples/incoming/forager/python/pythonhosted.org/pypi.org/milenium/milenium-1.1.1-py3-none-any.whl!!milenium/modules/abuseipdb_search.py", "risk": 3, "size": 1129, "type": "python", "depth": 1 }, { "id": 6, "mol": "K(Te)H(Po)", "sha": "bf4b5308f2522c0f235444ec43e9a72771b03145c778438e552968ac47aab473", "path": "/data/samples/incoming/forager/python/pythonhosted.org/pypi.org/milenium/milenium-1.1.1-py3-none-any.whl!!milenium/modules/aggregator.py", "risk": 3, "size": 1353, "type": "python", "depth": 1 }, { "id": 7, "mol": "H(Cm₄)", "sha": "cb8ae8e5a18bfbb4d32624df296f1ee56488b45b7bc42309f59c7162c24417d1", "path": "/data/samples/incoming/forager/python/pythonhosted.org/pypi.org/milenium/milenium-1.1.1-py3-none-any.whl!!milenium/modules/breach.py", "risk": 1, "size": 366, "type": "python", "depth": 1 }, { "id": 8, "mol": "H(F₂)Md₂(Pt)", "sha": "e394af1a80f60eb85fde511d6b953b08ddeff2768de4ef0752af8b348408d2fe", "path": "/data/samples/incoming/forager/python/pythonhosted.org/pypi.org/milenium/milenium-1.1.1-py3-none-any.whl!!milenium/modules/breach_local.py", "risk": 4, "size": 1021, "type": "python", "depth": 1 }, { "id": 9, "mol": "H₃(Cm₅DbOs₂)Md(Pt)", "sha": "7d883679109253ed9ac8396ad9e9904d437e45278dcff6f5bfab18e6f7972969", "path": "/data/samples/incoming/forager/python/pythonhosted.org/pypi.org/milenium/milenium-1.1.1-py3-none-any.whl!!milenium/modules/censys_search.py", "risk": 4, "size": 1259, "type": "python", "depth": 1 }, { "ctx": [ { "b": "x(d*cA=-BxA%=R#AbP=sazL$ozvg8{AbP=sayX=2wI#vLw].*baAg+hxL.x(azCXiz/P}xp*[DV3joc@pdv/BuQNE-auZ\u0026zvrufnxM4:0c[cn(ar\u0026BPx(4u#x)1np3pvP:mOc9SmOcoxauZ\u0026mpFKwJm{!UQqxNRnb4CLew[+)gyiarha{[U:wmYu}uT+]Id04A(B98BKat2=1B98B-3lQDlaAz4nB-IvxvQTs?hz^3}hz!@Qv@C)?d03*\u0026wmYm?wmWer3jma+aMwVF\u0026*2R+M5$0\u003cKM8K!\u0026*2R+M5$0\u003cKM8K!\u0026*2R+M5$0\u003cKM8K!\u0026*2R+M5$0\u003cKM8K!\u0026*2R+M5$0\u003cKM8K!\u0026*2R+M5$0\u003cKM8K!\u0026*2R+M5$0\u003cKM8K!\u0026*2R+M5$0\u003cKM8K!\u0026*2R+M5$0\u003cKM8K!\u0026*2R+M5$0\u003cKM8K!\u0026*2R+M5$0\u003cKM8K!\u0026*2R+M5$0\u003cKM8K!\u0026*2R+M5(s$awtM#ogqk\u003e\u0026^^mo^t=L9^6$jBX6R?nU*FlMWA#RlXy3uW^6z5P^74FP^tGc]VlmJ9^7W(laKERv^4eKGaKDU9P3SXFQTk.T^6p#R^sP=83l{XuXx}.iYWj7kZ0KglZ0R-X^7^@w^7vX:^6}xo^6z35^sP-M^7vVj^7y$N^4nQ$^6$jBVEalIWA#nbW9V31^74Dn^6.nY^sJH/ZTmOUXx}$qFy7*NG3Z{MF?vxPaMwVF\u0026*2R+M5$0\u003cKM8K!\u0026*2R+M5$0\u003cKM8K!\u0026*2R+M5$0\u003cKM8K!\u0026*2R+M5$0\u003cKM8K!\u0026*2R+M5$0\u003cKM8K!\u0026*2R+M5$0\u003cKM3", "ln": 0, "col": 1, "line": 1 }, { "b": "KM8K!\u0026*2R+M5$0\u003cKM8K!\u0026*2R+M5$0\u003cKM8K!\u0026*2R+M5$0\u003cKM8K!\u0026*2R+M5(sWoIX2GmmnmYaBsCrarR^Jl{T^rlp1KsuSx#$b03\u0026NvM34\u003e3lQDlarR^Har\u003eq=iEkjawo?uXpiZkoz*1/fheD.SheuuhiD!{*heD=qAckUXwm!+Qh9$.*hc0^Yz*bkZB1{JZr^dktqzR-.CYl?wxFraYn[.ZGf\u003e\u003cu-iC?}\u003cy\u003c6tRf)v7ZiDFwanP!fYfFMmrrXWoHphBxSqH8zDCxuLThe3IRo)6]Zr^4}^h85inph-/YheD.SheuufiEkf\u003cCYWyIqFYfin]e0tr=w", "ln": 660, "col": 110, "line": 17 }, { "b": "zcnScxKU*oy*]\u003c]x\u003c\u003e72yHHp4zCTCcy?3NFAar-+jT7jQarR^Qed9HxarR\u003ecm{!OUr9@Q2ogqP1iV}^shz=*apEFXHpi]F/pEF5qpe(g0qb}pFv[6i}r+(F8s..OavmC62s8Ah0t1gIAwnt\u003e0v]M5\u003erXVQrrbte}rz+[xa$k5IarR^Hb2?6tk#pcWnKK:-ar\u0026N2fGq3Hixnom3lQDlar\u003c=PuQmHWuR0EYnfQ8qa#\u003caBhdXQ2ia+fWhA28PvkfL@wJ8qKf\u003eApLgg+09g:jETEf{q*l}6Nhrzlv\u003cauZ\u0026]3lQDlao", "ln": 925, "col": 181, "line": 21 }, { "b": "r6-\u0026pq:\u003e4[qCnn}ar\u00260X3lQDlar\u003c-PpEEGzuQmHWuRr*\u003cb03?\u003ca$K6zarR^JlQ::GsYnWbpFjbKb03?\u003ca$K6zarR^Jr.lg?q=DK(k$\u003eSKp!t1!moH/}ar\u00260X3lQDlar\u003c9rrz#sTp^^SSogq#ciV]Q\u003ced9HxarR\u003e1p!szKpHv6%ogqP1iV]Q\u003ced9HxarR\u003edqCp1Rk#7=Mp!t1!moH/}ar\u00260X3lQDlar\u003c=PuQmHWuR9TfiV]Q\u003ced9HxarR\u003ecm{!LUnNC1Oq+c", "ln": 1169, "col": 8, "line": 30 }, { "b": "3lQDlar\u003c-MqCY!WuQmHWuRr*\u003cb03?\u003ca$K6zarR^Jnj=cAuRr*\u003cb03?\u003ca$K6zarR^Jl}6Tjq+ftBuQWWPnLyr?ar\u00260X3lQDlar\u003cixni{fBmmpGQmoH/}ar\u00260X3lQDlar\u003cGFk$:NommfZPogq#ciV]Q\u003cedc!j3jprPw/$V5B9hImuT[1(w[+)adlm!UarR^]pFKwJm{!UQqz8*4wnc6jAa9=#zGG}.rc09", "ln": 1437, "col": 28, "line": 40 }, { "b": "^3lgRpEv=zl)f\u003c=^7N/g^tc8R^7N/o^t[RSarR^HarR!qvrt{2jS]8!iV@O*w]zYjyB*PKazCZowmoN*e[]Aszf49OazCBgyANIkBrCpnawtM#ogql%3lQDlarR^Havw}1mOc9SmOcoxe{ztIBy!*3wQ5qByiarhe[x9wAc0Brvrt{eazC.7wO#PMgaTLVzGx@vwNw\u003e!v}/TumQZaOwHPeMwO#0@wnb{]jTb2\u003cw?t$^dgdguarR^HarUYoBAIRway[]5vg1b1arU=DC@=oParR^HarR!qvrt{2jS[GXz/dgzz^^f$c{{^9mOc9SmOcoxe]\u003eJiwm6B\u0026CYUuBzEWP}x(mMDb6w0teJs}6dgdguarUluv}xR3avQJ+wPh:9z/dPyarR^HarR^HwmoN*auZ\u0026]Ef}8tarUomAV/cGaA!(wzxItomNp3Fr8Uz-By/rgc[dg:arR^HarR^Hx\u003ewG6az#atazCZooIX2GmmofzarR^HarR^HarR^HwmoN*e]$PCwmYvYB.(dFyB*PKdgdguarUYoBAIRway[]5vg0tGwmYu}xjVfkyH}=xay]4}vrDydjT870iTM#LarR)KoIX2GmmnoBXx}[nWA#teF/@BP^sxPN^7W[T^74FP^6.nMaKE*GU*x:1^6z5I^6.lk3lQDlazCBgyH}=lx(k4!pEv=zl)b]QwfsMwlRx\u003cotwE!}t@\u0026rnarR^HarR!EwPS6nzxIRGlRx\u003cotwE!}t).X%arUfaxcotWwO#NiA+eP/z/ff3xdbhoarR^HA+funA=91fw[J-ewPPtowQb*HwmYvYB.(dGaA8oyz/WKxzGY-mz/dguwPPtowQb*HwmYvYB.(dG3jmbJwO96awPRo{wQbXtwQb*HC42ifwHPUEarR^Hx\u003ewG6wQbzjzxIRGlRx\u003coiTM#LarR^HarUYkx(^\u0026dp?sV:x(!ufz/e0:A=k$Dw*hOqwQeXDx(+zkz!0M]wftq#wftw\u003czF\u003cxmayX[8v}U", "ln": 1743, "col": 47, "line": 53 }, { "b": "wQetBdgdguarUomAV/cGaA!(wzxJC3xd^[uwO(Gpdlm!UarR^HarR!vw/#mT3lQDlarR^HarR^HaA8rNwO#W9A=k\u00261yH55CaAITBd0v3D3jprPw/$/euUj1)B97=fB-5PRiTM#LarUYoBAIRwaz#atavw}1mOc9SmOcoxe[GowB98EKdgcy?wmYu}y\u0026r*0wN]d-wQetBdlm!UarR!EwPS6nzxJ+fB95*7pEv=zl[Sm^D2\u003ew.df", "ln": 3280, "col": 16, "line": 110 } ], "depth": 1, "facts": { "imp": [ [ "", "Path.home" ], [ "", "base64.b64decode.decode" ], [ "", "base64.b64decode" ], [ "", "_b64" ], [ "", "_b64" ], [ "", "CONFIG_DIR.mkdir" ], [ "", "CONFIG_FILE.exists" ], [ "", "dict" ], [ "", "data.items" ], [ "", "CONFIG_FILE.write_text" ], [ "", "json.dumps" ], [ "", "json.loads" ], [ "", "CONFIG_FILE.read_text" ], [ "", "DEFAULTS.items" ], [ "", "data.setdefault" ], [ "", "ensure_config" ], [ "", "cfg.get" ], [ "", "os.environ.get" ], [ "", "PermissionError" ], [ "", "ensure_config" ], [ "", "CONFIG_FILE.write_text" ], [ "", "json.dumps" ], [ "", "ensure_config" ], [ "", "pairs.items" ], [ "", "blocked.append" ], [ "", "CONFIG_FILE.write_text" ], [ "", "json.dumps" ], [ "", "ensure_config" ], [ "", "dict" ], [ "", "LOCKED.items" ], [ "", "str" ], [ "", "all_keys" ], [ "", "cfg.items" ], [ "", "str" ], [ "", "CONFIG_FILE.exists" ], [ "", "list" ], [ "", "LOCKED.keys" ], [ "", "Path" ], [ "", "base64" ], [ "", "json" ], [ "", "os" ], [ "", "pathlib" ] ], "mbr": [ "CONFIG_DIR.mkdir", "CONFIG_FILE.exists", "CONFIG_FILE.read_text", "CONFIG_FILE.write_text", "DEFAULTS.items", "LOCKED.items", "LOCKED.keys", "Path.home", "base64.b64decode", "base64.b64decode.decode", "blocked.append", "cfg.get", "cfg.items", "data.items", "data.setdefault", "json.dumps", "json.loads", "os.environ", "os.environ.get", "pairs.items" ], "tgt": [ "CONFIG_DIR.mkdir", "CONFIG_FILE.exists", "CONFIG_FILE.read_text", "CONFIG_FILE.write_text", "DEFAULTS.items", "LOCKED.items", "LOCKED.keys", "Path.home", "PermissionError", "_b64", "all_keys", "base64.b64decode", "base64.b64decode.decode", "blocked.append", "cfg.get", "cfg.items", "data.items", "data.setdefault", "dict", "ensure_config", "json.dumps", "json.loads", "list", "os.environ.get", "pairs.items", "str" ], "funcs": [ [ "_b64", 144 ], [ "ensure_config", 1563 ], [ "get", 2183 ], [ "set_key", 2426 ], [ "set_many", 2686 ], [ "all_keys", 2994 ], [ "config_path", 3196 ], [ "apply_to_env", 3245 ], [ "is_first_run", 3366 ], [ "locked_keys", 3424 ] ], "metrics": { "ast": { "op.div": 2, "op.lor": 1, "op.land": 1, "max_depth": 13, "call_count": 37, "node_count": 980, "member_count": 20, "op_density.div": 0, "op_density.lor": 0, "op_density.land": 0, "member_depth_max": 3 }, "file": { "size": 3473, "entropy": 5.68 }, "text": { "lines": 121, "top_char": 101, "max_ws_run": 1, "digit_ratio": 0.05, "space_count": 579, "char_entropy": 5.68, "unique_chars": 117, "top_char_null": 0, "lines_over_200": 1, "string_density": 0.4, "top_char_ratio": 0.04, "avg_line_length": 27.71, "max_line_length": 214, "non_ascii_ratio": 0.17, "empty_line_ratio": 0.21, "last_line_length": 30, "long_token_count": 3, "whitespace_ratio": 0.2, "identifier_density": 1.44, "line_length_stddev": 32.69, "encoded_string_ratio": 0.08, "normalized_string_count": 4.36, "repeated_char_sequences": 7, "suspicious_identifier_ratio": 0.06, "normalized_unique_identifiers": 7.8 }, "binds": { "count": 15 }, "binary": { "peak_region_bytes": 2048, "peak_region_entropy": 5.6 }, "source": { "function_count": 10 }, "imports": { "count": 5, "stdlib_count": 4, "stdlib_ratio": 0.8, "third_party_count": 1, "third_party_ratio": 0.2 }, "strings": { "hex": 2, "bytes": 634, "count": 48, "avg_length": 13.21, "max_length": 204, "avg_entropy": 3.14, "empty_count": 17, "entropy_stddev": 0.7, "base64_candidates": 2, "high_entropy_count": 2 }, "comments": { "chars": 643, "count": 7, "lines": 7, "to_code_ratio": 0.06 }, "functions": { "count": 10, "density": 8.26, "avg_params": 0.6, "code_ratio": 0.49, "max_params": 2, "length_stddev": 4.3, "avg_name_length": 8.9, "no_params_count": 6, "avg_length_lines": 5.9, "max_length_lines": 16, "min_length_lines": 2, "single_char_params": 1, "avg_param_name_length": 4 }, "identifiers": { "count": 174, "unique": 54, "avg_length": 6.61, "max_length": 15, "min_length": 1, "avg_entropy": 2.34, "reuse_ratio": 0.31, "length_stddev": 3.22, "has_digit_ratio": 0.06, "sequential_names": 3, "single_char_count": 3, "single_char_ratio": 0.06, "all_lowercase_ratio": 0.81, "all_uppercase_ratio": 0.07, "numeric_suffix_count": 2, "underscore_prefix_count": 1 } } }, "id": 10, "mol": "K(Te)O(S)H₃(Db₄FOs₂)Md₂(Pt)", "path": "/data/samples/incoming/forager/python/pythonhosted.org/pypi.org/milenium/milenium-1.1.1-py3-none-any.whl!!milenium/modules/config.py", "pid": 0, "risk": 9, "sha": "da0f3ae95f875579e395bc3eccabd36d4f74f79985bfc83e6eb547d10d8687b5", "size": 3473, "traits": [ { "id": "metadata/lang/natural::lang-english--atom-2", "conf": 0.8, "crit": 1, "desc": "English function-word token \"and\"", "spans": [ [ 2289, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "spans": [ [ 1791, 0 ] ] }, { "id": "micro-behaviors/data/control-flow/membership::not-in-membership-check", "conf": 0.3, "crit": 3, "desc": "Python not-in membership check", "spans": [ [ 2111, 19 ] ] }, { "id": "micro-behaviors/fs/path/location::home-hidden-dotpath", "conf": 0.85, "crit": 3, "desc": "Hidden dot-entry under the home directory", "spans": [ [ 75, 16 ] ] }, { "id": "micro-behaviors/os/env/read::python-environ-copy-assignment", "conf": 0.9, "crit": 3, "desc": "Copies entry into env or credential mapping", "spans": [ [ 3344, 16 ] ] }, { "id": "micro-behaviors/os/env/secret-name::python-env-get-call", "conf": 0.8, "crit": 3, "desc": "Python reads an environment variable", "spans": [ [ 2395, 14 ] ] }, { "id": "objectives/supply-chain/recon-exfil/pipeline::gha-interesting-secret-keywords--rx-2", "atk": "T1195.002, T1552.001", "conf": 0.9, "crit": 3, "desc": "Cloudflare or database credential variable name", "spans": [ [ 724, 12 ] ] }, { "id": "well-known/tool/detection/threat-intel::virustotal", "conf": 0.7, "crit": 3, "desc": "VirusTotal service name reference", "spans": [ [ 1241, 10 ] ] }, { "id": "metadata/lang/natural::script-cyrillic", "conf": 0.8, "crit": 3, "desc": "Contains multiple standalone Cyrillic words", "spans": [ [ 380, 6 ], [ 387, 16 ], [ 404, 10 ], [ 418, 6 ], [ 433, 10 ], [ 444, 8 ], [ 455, 16 ], [ 472, 26 ] ] }, { "id": "micro-behaviors/data/decode/symbol-base64::b64decode-call", "conf": 0.9, "crit": 3, "desc": "Decodes Base64 data with Python", "spans": [ [ 180, 16 ] ] }, { "id": "micro-behaviors/data/encode/base64::import-base64", "conf": 0.9, "crit": 3, "desc": "Imports Python's base64 module", "spans": [ [ 29, 6 ] ] }, { "id": "micro-behaviors/data/serialize/json::json-loads-call", "conf": 0.9, "crit": 3, "desc": "Parses JSON data with Python", "spans": [ [ 1977, 10 ] ] }, { "id": "micro-behaviors/os/env/read::python-os-getenv-call", "conf": 0.92, "crit": 3, "desc": "Python reads an environment variable", "spans": [ [ 2395, 14 ] ] }, { "id": "micro-behaviors/data/decode/base64::base64-decoding", "conf": 0.95, "crit": 3, "desc": "Base64 decoding behavior", "uses": [ 9 ], "spans": [ [ 180, 16 ] ] }, { "id": "metadata/encoded-payload/base64", "conf": 0.9, "crit": 3, "desc": "Encoded content decoded: base64", "spans": [ [ 745, 49 ], [ 989, 49 ] ] } ], "type": "python" }, { "id": 11, "mol": "H₂(Cm₇Db)Md₂(Pt)", "sha": "fad408b2886def31fba25a97b514d38dd91424789b3e7c70f66331441699c100", "path": "/data/samples/incoming/forager/python/pythonhosted.org/pypi.org/milenium/milenium-1.1.1-py3-none-any.whl!!milenium/modules/dehashed.py", "risk": 5, "size": 1169, "type": "python", "depth": 1 }, { "ctx": [ { "b": "x(d*cA=-BAwPq\u003c7B98Eg3s)ZWay/7@v@0G6z/5]%zyEQNarR^HBAhT/3lQDlarR^HaAwO/aAz4kB.bSoB1R9pBsp-BxMOunB2\u003e%cv@=VzB7^i\u003eAxLQ6h7\u003ck^z/5]%zHA\u003cIB-.OBBuKwWz/c:IaARsmwP8ZkjUX/y3lQDlarR^HazCBgAXqAPvruTkuT[1+wGTc0atLS8iTM#LarR^HarR^HarU-FvSJUPaAIaoc[bGCarR^HarR^HarR!sz/M$izGG]AazCZoAXq9Fz/c%LiTM#LarR^HarR^HarR^HarUomAV/mdzdK\u00267zxJIdBAhTVxjVfkb5Q?awNxQ?y\u0026%qkefDbXdk2WXy?W#tb3Y1fdlm!UarR^HarR^HarR^HarR^HarR!FBZ/zAvpS)%zEEx[e]#bPx(CEHdgdguarR^HarR^HarUYoBAIRwaBtqNBZ!)1zddc@B0rT/B8M8vwN)igBZ/zvEf}8tarR^HarUYoBAIRwaBtqzA=M8sb03\u0026Ub1LWjp-$a9e]#byBAIUiv@C)?EiK7DarR^HwQ4Y@Ac9i\u003eCW\u003er7BzkVhayPslwJyevarR^HarR!EwPS6nzxKoIwPz*fAW0K!B98BJwHS3", "ln": 0, "col": 1, "line": 1 } ], "depth": 1, "facts": { "imp": [ [ "", "requests.get" ], [ "", "set" ], [ "", "r.json" ], [ "", "entry.get.split" ], [ "", "entry.get" ], [ "", "subs.add" ], [ "", "name.strip" ], [ "", "sorted" ], [ "", "str" ], [ "", "requests" ] ], "mbr": [ "entry.get", "entry.get.split", "name.strip", "r.json", "r.status_code", "requests.get", "subs.add" ], "tgt": [ "entry.get", "entry.get.split", "name.strip", "r.json", "requests.get", "set", "sorted", "str", "subs.add" ], "funcs": [ [ "check", 17 ] ], "metrics": { "ast": { "max_depth": 16, "call_count": 9, "node_count": 194, "member_count": 7, "member_depth_max": 3 }, "file": { "size": 491, "entropy": 4.37 }, "text": { "lines": 14, "top_char": 116, "max_ws_run": 1, "digit_ratio": 0.03, "space_count": 139, "char_entropy": 4.37, "unique_chars": 49, "top_char_null": 0, "string_density": 0.57, "top_char_ratio": 0.06, "avg_line_length": 34.14, "max_line_length": 83, "empty_line_ratio": 0.07, "last_line_length": 32, "whitespace_ratio": 0.31, "identifier_density": 2.21, "line_length_stddev": 21.77, "normalized_string_count": 2.14, "repeated_char_sequences": 5, "suspicious_identifier_ratio": 0.11, "normalized_unique_identifiers": 4.99 }, "binds": { "count": 2 }, "binary": { "peak_region_bytes": 491, "peak_region_entropy": 4.37 }, "source": { "function_count": 1 }, "imports": { "count": 1, "third_party_count": 1, "third_party_ratio": 1 }, "strings": { "bytes": 93, "count": 8, "url_count": 1, "avg_length": 11.63, "max_length": 42, "avg_entropy": 2.47, "empty_count": 1, "entropy_stddev": 1.49 }, "functions": { "count": 1, "density": 7.14, "avg_params": 1, "code_ratio": 0.86, "max_params": 1, "avg_name_length": 5, "avg_length_lines": 12, "max_length_lines": 12, "min_length_lines": 12, "avg_param_name_length": 6 }, "identifiers": { "count": 31, "unique": 19, "avg_length": 4.89, "max_length": 11, "min_length": 1, "avg_entropy": 1.92, "reuse_ratio": 0.61, "length_stddev": 2.49, "sequential_names": 2, "single_char_count": 2, "single_char_ratio": 0.11, "all_lowercase_ratio": 0.95 } } }, "id": 12, "mol": "O(C)H₃(Cm₃CrDb)Md(In₂)", "path": "/data/samples/incoming/forager/python/pythonhosted.org/pypi.org/milenium/milenium-1.1.1-py3-none-any.whl!!milenium/modules/dns_history.py", "pid": 0, "risk": 6, "sha": "0f43628652787fb3cd6ca09554aecd71d624d73d15c02c51f4cc022a56c8fe6c", "size": 491, "traits": [ { "id": "metadata/import/python/requests::requests", "conf": 0.95, "crit": 3, "desc": "imports requests", "spans": [ [ 7, 8 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "spans": [ [ 199, 0 ] ] }, { "id": "micro-behaviors/communications/http/response::source-http-200-status", "atk": "T1190", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Compares HTTP response status property to 200", "spans": [ [ 140, 20 ] ] }, { "id": "micro-behaviors/crypto/certificate/transparency::certificate-search-query", "conf": 0.88, "crit": 3, "desc": "crt.sh JSON certificate query", "spans": [ [ 80, 34 ] ] }, { "id": "micro-behaviors/crypto/certificate/transparency::crt-sh-endpoint", "conf": 0.92, "crit": 3, "desc": "crt.sh certificate lookup endpoint", "spans": [ [ 80, 6 ] ] }, { "id": "micro-behaviors/crypto/certificate/transparency::subdomain-result-field", "conf": 0.86, "crit": 3, "desc": "Certificate subdomain result field", "spans": [ [ 260, 12 ] ] }, { "id": "micro-behaviors/crypto/certificate/transparency::subdomain-result-split", "conf": 0.86, "crit": 3, "desc": "Splits discovered subdomain results", "spans": [ [ 261, 23 ] ] }, { "id": "micro-behaviors/data/control-flow/membership::set-construction", "conf": 0.75, "crit": 3, "desc": "Python set() construction", "spans": [ [ 174, 12 ] ] }, { "id": "micro-behaviors/communications/http/lib/requests::imports-requests", "conf": 0.95, "crit": 3, "desc": "Imports the requests HTTP client for Python", "spans": [ [ 0, 15 ] ] }, { "id": "micro-behaviors/communications/http/lib/requests::requests-get", "conf": 0.85, "crit": 3, "desc": "Calls requests.get in Python", "spans": [ [ 57, 12 ] ] }, { "id": "objectives/command-and-control/infrastructure/domain/malicious::short-domain-url-pattern", "atk": "T1071.001", "mbc": "C0002", "conf": 0.8, "crit": 3, "desc": "Very short domain in URL", "spans": [ [ 72, 15 ] ] }, { "id": "metadata/import/package::python-network-client-imports", "conf": 0.95, "crit": 3, "desc": "Imports a Python network client library", "uses": [ 0 ], "spans": [ [ 7, 8 ] ] }, { "id": "micro-behaviors/crypto/certificate/transparency::certificate-transparency-domain-search", "conf": 0.94, "crit": 3, "desc": "Searches certificate records for a domain", "uses": [ 3, 4 ], "spans": [ [ 80, 6 ] ] }, { "id": "micro-behaviors/crypto/certificate/transparency::certificate-subdomain-collection", "conf": 0.92, "crit": 3, "desc": "Collects subdomains from certificates", "uses": [ 5, 6, 12 ], "spans": [ [ 80, 34 ], [ 260, 12 ], [ 261, 23 ] ] }, { "id": "micro-behaviors/communications/http/request/client::request-python", "conf": 0.9, "crit": 3, "desc": "Sends an HTTP request with a Python client library", "uses": [ 9 ], "spans": [ [ 57, 12 ] ] } ], "type": "python" }, { "ctx": [ { "b": "x(d*cA=-BFxM4Qa3tBu@z/P}xwnVDvA+frgy\u003c6xg3tBu@z/P}xA+flkwPI%m3jprPw/$O%wN/H7xM4%ldlm!UarR!BB-X-?aBwIzarR^HBAhT/3lQDlarR^HaA[}\u003eaA}Hqx(+[JxM4Qac$)KuBsvLtarR^HarR!BB-Z?iA+e($B98ChAW1^ijS[@3A+e($B98ChATA{iarR^HarUPBBxY@0A+eW3x(v(kt{8oMB98BJCp)xCwNPW{z/e])vru6f3lQDlarR^HaA8yAtoWT6Aa%u3BzkVhb3=rOaAITBd0EpP", "ln": 0, "col": 1, "line": 1 }, { "b": "arR^HarR!BB-Z?izEEx[uVP!0C4CYnb3=rOaA]CQvqPN.B7GxnwPz\u00260arR^HwQ4Y@Ac9i\u003eCW\u003er7BzkVhayPslwJyevarR^HarR!BB-Z?iCw7]eB6\u0026H0A=k$xt{8oMB98BJwHN@[arR^Hw]zYjA==OCwGUY8ax{3Qa$K\u0026Xo\u0026@O\u003car\u003cMVa$K\u0026Xr9i9zt@\u0026rnarR^HarR!GA^oXMarR^HarR^HarR^Hz/{eaA==OCwNcAwax@]eAWU@SazbLjaAwPszxJFcB1RGAB8L(rwPxzzwPI^aC4A7nz/Z1KaAzNHAaHF73lQDlarR^Haz2!cwPh-lmr\u0026rNAcb/jzAnaEarR^HarR^HarR!BB-Z\u0026dBA}?pt{8oMtu}NyarR^HBAhT/3lQDlarR^HaAwO/aAz4kB.bSoB1R9pBsp-BxMOunB2\u003e%cv@=VzB7^i\u003eAxLQ6h7\u003ck?z/Z2Gcu13GAclm=yiarha$K\u003cUx(dB1B-Y=3fEWtKarR^HarR!BB-Z?iv@=V#B9g@5z/5]%zGv1cauZ\u0026-x(!wADU3z9zEEx[uV]\u003c]B.8+5azbLjay#WfzxJ%Lyiarhc[fM[3lQDlaz2!cwPh-lmr\u0026rNAcb/jzAnaEarR^HarR!BB-Z?iv@=V#B9g@5z/5]%zGv1cauZ\u0026Kt).X%arUYoBAIRwaA8yA", "ln": 257, "col": 2, "line": 12 } ], "depth": 1, "facts": { "imp": [ [ "", "whois.whois" ], [ "", "str" ], [ "", "str" ], [ "", "str" ], [ "", "str" ], [ "", "dns.resolver.resolve" ], [ "", "requests.get" ], [ "", "list" ], [ "", "r.json" ], [ "", "dns.resolver" ], [ "", "requests" ], [ "", "whois" ] ], "mbr": [ "dns.resolver", "dns.resolver.resolve", "e.name_value", "out.creation", "out.crt_subdomains", "out.expiration", "out.name_servers", "out.registrar", "out.whois_error", "r.json", "requests.get", "w.creation_date", "w.expiration_date", "w.name_servers", "w.registrar", "whois.whois" ], "tgt": [ "dns.resolver.resolve", "list", "r.json", "requests.get", "str", "whois.whois" ], "funcs": [ [ "check", 50 ] ], "metrics": { "ast": { "max_depth": 14, "call_count": 9, "node_count": 318, "member_count": 16, "max_array_len": 4, "member_depth_max": 3 }, "file": { "size": 789, "entropy": 4.52 }, "text": { "lines": 27, "top_char": 116, "max_ws_run": 1, "digit_ratio": 0.01, "space_count": 190, "char_entropy": 4.52, "unique_chars": 54, "top_char_null": 0, "string_density": 0.48, "top_char_ratio": 0.07, "avg_line_length": 28.26, "max_line_length": 81, "empty_line_ratio": 0.11, "last_line_length": 14, "whitespace_ratio": 0.27, "identifier_density": 2.15, "line_length_stddev": 22.07, "normalized_string_count": 2.5, "repeated_char_sequences": 2, "suspicious_identifier_ratio": 0.14, "normalized_unique_identifiers": 4.63 }, "binds": { "count": 10 }, "binary": { "peak_region_bytes": 789, "peak_region_entropy": 4.52 }, "source": { "function_count": 1 }, "imports": { "count": 3, "third_party_count": 3, "third_party_ratio": 1 }, "strings": { "bytes": 136, "count": 13, "url_count": 1, "avg_length": 10.46, "max_length": 40, "avg_entropy": 2.45, "entropy_stddev": 1.23 }, "functions": { "count": 1, "density": 3.7, "avg_params": 1, "code_ratio": 0.85, "max_params": 1, "avg_name_length": 5, "avg_length_lines": 23, "max_length_lines": 23, "min_length_lines": 23, "avg_param_name_length": 4 }, "identifiers": { "count": 58, "unique": 22, "avg_length": 5.91, "max_length": 15, "min_length": 1, "avg_entropy": 2.01, "reuse_ratio": 0.38, "length_stddev": 3.81, "sequential_names": 3, "single_char_count": 3, "single_char_ratio": 0.14, "all_lowercase_ratio": 0.95 } } }, "id": 13, "mol": "O(C₂)H₂(Cm₄Cr)Md(In₃)", "path": "/data/samples/incoming/forager/python/pythonhosted.org/pypi.org/milenium/milenium-1.1.1-py3-none-any.whl!!milenium/modules/domain.py", "pid": 0, "risk": 7, "sha": "7beb1cfafb68dab5087ae9683558a3aad5fbd0c0a3411c3ed58ce8c69aab95bb", "size": 789, "traits": [ { "id": "metadata/import/python/dns/resolver::dns/resolver", "conf": 0.95, "crit": 3, "desc": "imports dns.resolver", "spans": [ [ 20, 12 ] ] }, { "id": "metadata/import/python/requests::requests", "conf": 0.95, "crit": 3, "desc": "imports requests", "spans": [ [ 40, 8 ] ] }, { "id": "metadata/import/python/whois::whois", "conf": 0.95, "crit": 2, "desc": "imports whois", "spans": [ [ 7, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "spans": [ [ 369, 0 ] ] }, { "id": "micro-behaviors/communications/dns/label::python-dns-query-reference", "atk": "T1071.004", "conf": 0.9, "crit": 3, "desc": "Python DNS resolution API reference", "spans": [ [ 20, 12 ] ] }, { "id": "micro-behaviors/communications/dns/lookup/resolver::dns-resolver-resolve", "conf": 0.85, "crit": 3, "desc": "dns.resolver.resolve() lookup", "spans": [ [ 463, 20 ] ] }, { "id": "micro-behaviors/communications/dns/lookup/resolver::dnspython-resolver-import", "conf": 0.85, "crit": 3, "desc": "Imports the dnspython resolver module", "spans": [ [ 13, 19 ] ] }, { "id": "micro-behaviors/crypto/certificate/transparency::certificate-search-query", "conf": 0.88, "crit": 3, "desc": "crt.sh JSON certificate query", "spans": [ [ 597, 32 ] ] }, { "id": "micro-behaviors/crypto/certificate/transparency::crt-sh-endpoint", "conf": 0.92, "crit": 3, "desc": "crt.sh certificate lookup endpoint", "spans": [ [ 597, 6 ] ] }, { "id": "micro-behaviors/crypto/certificate/transparency::subdomain-result-field", "conf": 0.86, "crit": 3, "desc": "Certificate subdomain result field", "spans": [ [ 684, 12 ] ] }, { "id": "objectives/command-and-control/channel/deaddrop/public-service::source-whois-server-host", "atk": "T1071", "mbc": "B0030", "conf": 0.9, "crit": 3, "desc": "Source names a WHOIS server host", "spans": [ [ 101, 11 ] ] }, { "id": "micro-behaviors/communications/http/lib/requests::imports-requests", "conf": 0.95, "crit": 3, "desc": "Imports the requests HTTP client for Python", "spans": [ [ 33, 15 ] ] }, { "id": "micro-behaviors/communications/http/lib/requests::requests-get", "conf": 0.85, "crit": 3, "desc": "Calls requests.get in Python", "spans": [ [ 574, 12 ] ] }, { "id": "objectives/command-and-control/infrastructure/domain/malicious::short-domain-url-pattern", "atk": "T1071.001", "mbc": "C0002", "conf": 0.8, "crit": 3, "desc": "Very short domain in URL", "spans": [ [ 589, 15 ] ] }, { "id": "metadata/import/package::python-network-client-imports", "conf": 0.95, "crit": 3, "desc": "Imports a Python network client library", "uses": [ 1 ], "spans": [ [ 40, 8 ] ] }, { "id": "micro-behaviors/communications/dns/lookup/resolver::dnspython-lookup", "conf": 0.85, "crit": 3, "desc": "dnspython DNS query capability", "uses": [ 5 ], "spans": [ [ 463, 20 ] ] }, { "id": "micro-behaviors/crypto/certificate/transparency::certificate-transparency-domain-search", "conf": 0.94, "crit": 3, "desc": "Searches certificate records for a domain", "uses": [ 7, 8 ], "spans": [ [ 597, 6 ] ] }, { "id": "micro-behaviors/communications/http/request/client::request-python", "conf": 0.9, "crit": 3, "desc": "Sends an HTTP request with a Python client library", "uses": [ 12 ], "spans": [ [ 574, 12 ] ] } ], "type": "python" }, { "id": 14, "mol": "O₃(AsC₂Eu₂)H(Cm₈)Md(Pt)", "sha": "5259d125e0f28d1d5afac5a765d73d506398105a01048a4dcbc95cf7f6fff33d", "path": "/data/samples/incoming/forager/python/pythonhosted.org/pypi.org/milenium/milenium-1.1.1-py3-none-any.whl!!milenium/modules/dorker.py", "risk": 6, "size": 1344, "type": "python", "depth": 1 }, { "id": 15, "mol": "O(As)H₂(Cm₆Po)", "sha": "5edefe611a99b68b4ce29c104ec06625f4efa486cc1cb9888a3a4d67f303b3f0", "path": "/data/samples/incoming/forager/python/pythonhosted.org/pypi.org/milenium/milenium-1.1.1-py3-none-any.whl!!milenium/modules/email.py", "risk": 4, "size": 865, "type": "python", "depth": 1 }, { "id": 16, "mol": "O(Eu)H(Cm₃)Md(Pt)", "sha": "b4a8f9d401e19302cc3ff060859f139480665812132875bb83872677bdff392b", "path": "/data/samples/incoming/forager/python/pythonhosted.org/pypi.org/milenium/milenium-1.1.1-py3-none-any.whl!!milenium/modules/email_validator.py", "risk": 4, "size": 826, "type": "python", "depth": 1 }, { "id": 17, "mol": "H₃(DbOsPo)Md(Pt)", "sha": "86f04745b07c5dc68babc8ec91260573d6de927e81d5b13fdb24fa57855aefe9", "path": "/data/samples/incoming/forager/python/pythonhosted.org/pypi.org/milenium/milenium-1.1.1-py3-none-any.whl!!milenium/modules/exif_extractor.py", "risk": 4, "size": 858, "type": "python", "depth": 1 }, { "id": 18, "mol": "H₂(Cm₆Po)", "sha": "46fa9197ad171c1efe5b85474fe2622af72cf86f984a02067318c3afae46b362", "path": "/data/samples/incoming/forager/python/pythonhosted.org/pypi.org/milenium/milenium-1.1.1-py3-none-any.whl!!milenium/modules/github_search.py", "risk": 2, "size": 1040, "type": "python", "depth": 1 }, { "id": 19, "mol": "H₂(Cm₃Cr)Md(In)", "sha": "ceaab8d7d21bdd5911a6d9aedb228ea20eb78596935231e77daf9e6dcd9bc2b8", "path": "/data/samples/incoming/forager/python/pythonhosted.org/pypi.org/milenium/milenium-1.1.1-py3-none-any.whl!!milenium/modules/gravatar.py", "risk": 3, "size": 421, "type": "python", "depth": 1 }, { "ctx": [ { "b": "x(d*cA=-BAwPq\u003c7B98Eg3p)-Pp*V\u003c:sS/\u003cIa%FcLboUvs^sGX%^6g)5^tPi{Y3O7pJ)SR8^sAANBAzFyiXJd1vrMi@vR6a*AcDhhwg?wgz7!gKnIr.FC)T)?wO95{xK$W?uUa7.x(2hezddc{dlm!UarR!vw/$#fBrBaClqR2ZmoIUUarR^HarR^HA+funA=91Db4U!nz/N3.ar\u003eYwav]6\u003cp-%K+C{3QnzF0P}B-I57b7f!varR!uwNPaXA=Su^aBtqCx\u003c#3kvq]{jyH}=niV{%+lqR2ZmoIe:b2@X}AXfN\u0026wO#PliV]R-x(4u#x)1npEf}8tarU=DC@=oParR^HarR!EauZ\u0026/wPq\u003c7B98EQxjVfk3lQDlarR^HarR^Haz8*hBAzFyiXJd1vrMi@vR6a*AcDhhwg?wgz7/spx!KS=fjF%kvpJ$Zwmn$Tz/]@tfmdnEvqfLaa$K6zarR^HarR^HarR!uwNPaXA=TxSwNPaXA=S=OBzkP6z/{d+f/opXarR^HarR^Q3lQDlarR^HazCBgAXqAPvruTkuT[1+wGTc0atLS8iTM#LarR^HarR^HarUYoBAIRwaBtqwA+eV?xK#leiV}TotoV*JzdK[%azbLjayVEczxJ%Lyiarhc[eCI3lQDlarR^Haz2w6w/#aDB97\u0026jB-Q]1z!9A4jV%]AfF\u003e/$arR^HarR^HarR^HA+funA=91Db4tO7vpJ$ZB0rT/tu#T:arR^HarR^HwO=B0iTM#LarR^H", "ln": 0, "col": 1, "line": 1 }, { "b": "arUYoBAIRwaBtqzA=M8sb03\u0026Ub1LWjp-$a9e]#byBAIUiv@C)?EiK7DarR^HwQ4Y@Ac9i\u003eCW\u003er7BzkVhayPslwJyevarR^HarR!EwPS6nzxKoIwPz*fAW0K!B98BJwHS3", "ln": 608, "col": 11, "line": 19 } ], "depth": 1, "facts": { "imp": [ [ "", "requests.get" ], [ "", "r.json" ], [ "", "str" ], [ "", "requests" ] ], "mbr": [ "b.Name", "r.json", "r.status_code", "requests.get" ], "tgt": [ "r.json", "requests.get", "str" ], "funcs": [ [ "check_email", 95 ] ], "metrics": { "ast": { "max_depth": 14, "call_count": 3, "node_count": 225, "member_count": 4, "member_depth_max": 2 }, "file": { "size": 711, "entropy": 4.79 }, "text": { "lines": 21, "top_char": 101, "max_ws_run": 2, "digit_ratio": 0.02, "space_count": 179, "char_entropy": 4.79, "unique_chars": 70, "top_char_null": 0, "string_density": 0.62, "top_char_ratio": 0.08, "avg_line_length": 32.9, "max_line_length": 76, "non_ascii_ratio": 0.03, "empty_line_ratio": 0.1, "last_line_length": 32, "whitespace_ratio": 0.28, "identifier_density": 1.33, "line_length_stddev": 22.46, "normalized_string_count": 2.84, "repeated_char_sequences": 5, "suspicious_comment_ratio": 2, "suspicious_identifier_ratio": 0.21, "normalized_unique_identifiers": 3.19 }, "binds": { "count": 3 }, "binary": { "peak_region_bytes": 711, "peak_region_entropy": 4.79 }, "source": { "function_count": 1 }, "imports": { "count": 1, "third_party_count": 1, "third_party_ratio": 1 }, "strings": { "bytes": 164, "count": 13, "url_count": 1, "avg_length": 12.62, "max_length": 57, "avg_entropy": 2.72, "empty_count": 1, "entropy_stddev": 1 }, "comments": { "chars": 60, "count": 1, "lines": 1, "base64": 1, "high_entropy": 1, "to_code_ratio": 0.05, "url_in_comments": 1 }, "functions": { "count": 1, "density": 4.76, "avg_params": 1, "code_ratio": 0.81, "max_params": 1, "avg_name_length": 11, "avg_length_lines": 17, "max_length_lines": 17, "min_length_lines": 17, "avg_param_name_length": 5 }, "identifiers": { "count": 28, "unique": 14, "avg_length": 5.64, "max_length": 11, "min_length": 1, "avg_entropy": 1.96, "reuse_ratio": 0.5, "length_stddev": 3.44, "sequential_names": 3, "single_char_count": 3, "single_char_ratio": 0.21, "all_lowercase_ratio": 0.86, "all_uppercase_ratio": 0.07 } } }, "id": 20, "mol": "H(Cm₅)Md₂(In₂Pt)", "path": "/data/samples/incoming/forager/python/pythonhosted.org/pypi.org/milenium/milenium-1.1.1-py3-none-any.whl!!milenium/modules/hibp.py", "pid": 0, "risk": 4, "sha": "1e9fa9fcb51958ab3f6604a92515d54adf2352066a30524223dfdf4e9000f5a7", "size": 711, "traits": [ { "id": "metadata/import/python/requests::requests", "conf": 0.95, "crit": 3, "desc": "imports requests", "spans": [ [ 7, 8 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "spans": [ [ 493, 0 ] ] }, { "id": "micro-behaviors/communications/http/response::source-http-200-status", "atk": "T1190", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Compares HTTP response status property to 200", "spans": [ [ 428, 20 ] ] }, { "id": "micro-behaviors/communications/http/services/haveibeenpwned::hibp-service-name", "conf": 0.9, "crit": 3, "desc": "Have I Been Pwned service reference", "spans": [ [ 67, 14 ] ] }, { "id": "metadata/lang/natural::script-cyrillic", "conf": 0.8, "crit": 3, "desc": "Contains multiple standalone Cyrillic words", "spans": [ [ 34, 12 ], [ 47, 8 ] ] }, { "id": "micro-behaviors/communications/http/lib/requests::imports-requests", "conf": 0.95, "crit": 3, "desc": "Imports the requests HTTP client for Python", "spans": [ [ 0, 15 ] ] }, { "id": "micro-behaviors/communications/http/lib/requests::requests-get", "conf": 0.85, "crit": 3, "desc": "Calls requests.get in Python", "spans": [ [ 279, 12 ] ] }, { "id": "micro-behaviors/communications/http/user-agent::non-mozilla-user-agent-header", "conf": 0.9, "crit": 3, "desc": "Sets a non-Mozilla User-Agent header", "spans": [ [ 232, 24 ] ] }, { "id": "metadata/import/package::python-network-client-imports", "conf": 0.95, "crit": 3, "desc": "Imports a Python network client library", "uses": [ 0 ], "spans": [ [ 7, 8 ] ] }, { "id": "micro-behaviors/communications/http/request/client::request-python", "conf": 0.9, "crit": 3, "desc": "Sends an HTTP request with a Python client library", "uses": [ 6 ], "spans": [ [ 279, 12 ] ] } ], "type": "python" }, { "id": 21, "mol": "H(Po₂)Md(Pt)", "sha": "e136583988d54723d77e66c4d2fd95331b38a53774780922234f52f4c4b563ef", "path": "/data/samples/incoming/forager/python/pythonhosted.org/pypi.org/milenium/milenium-1.1.1-py3-none-any.whl!!milenium/modules/holehe_search.py", "risk": 3, "size": 625, "type": "python", "depth": 1 }, { "id": 22, "mol": "H(Os)Md(Pt)", "sha": "604c5be6f1c219f6fbc5fb79379f46260eb8e91458f3384c310fd53672e6e5a8", "path": "/data/samples/incoming/forager/python/pythonhosted.org/pypi.org/milenium/milenium-1.1.1-py3-none-any.whl!!milenium/modules/image_search.py", "risk": 3, "size": 972, "type": "python", "depth": 1 }, { "id": 23, "mol": "H(Cm₄)Md(Pt)", "sha": "9e8b4198e343c81821193755776f737f2623d270aff5ed62192ad53ddba49360", "path": "/data/samples/incoming/forager/python/pythonhosted.org/pypi.org/milenium/milenium-1.1.1-py3-none-any.whl!!milenium/modules/instagram_osint.py", "risk": 2, "size": 1008, "type": "python", "depth": 1 }, { "id": 24, "mol": "O(Dy)H(Cm₄)", "sha": "f8c5bbb33881d85b61685d0e5611e02465c4eddc13e7eb6b1292ec12b24e64e5", "path": "/data/samples/incoming/forager/python/pythonhosted.org/pypi.org/milenium/milenium-1.1.1-py3-none-any.whl!!milenium/modules/ip.py", "risk": 3, "size": 701, "type": "python", "depth": 1 }, { "id": 25, "mol": "O(Dy)H(Cm₃)", "sha": "7831f4ddf64999c66e2e383324281828d98fb060ca947a0e45436355ad7e76aa", "path": "/data/samples/incoming/forager/python/pythonhosted.org/pypi.org/milenium/milenium-1.1.1-py3-none-any.whl!!milenium/modules/ip_geo_advanced.py", "risk": 3, "size": 551, "type": "python", "depth": 1 }, { "id": 26, "mol": "O(Dy)H₂(Cm₆Db)", "sha": "4eca199fdbea06d10c5b547f68fde124a5ef4ffdd3195ce69ae71bdfc606cfac", "path": "/data/samples/incoming/forager/python/pythonhosted.org/pypi.org/milenium/milenium-1.1.1-py3-none-any.whl!!milenium/modules/ip_reputation.py", "risk": 3, "size": 922, "type": "python", "depth": 1 }, { "ctx": [ { "b": "x(d*cA=-BxA%=R#AbP=sayO#5xMOun3jpx=z/3Rlx(4u#x)1nBzeS%cy?mVgx(d*cA=-Blz/ff3x9}jbnLR-JuSo/]mns%*ay/tcw[+)gxjVfkb1UQ5pdw2^r8ldQp9Ikia%FDy3jpi.D2vamwmYu}v}YB-yBA[oiV@G=AW-a.j%jxIv@%:sarR^Ha%FjBAa%i4z.t:xiV#!Q^6.lmefEkSpaNKmY3OgrYWjBuU*y8gXy3u\u0026a%FirarR^Hx\u003ewG9z/^9[p!szKpHv6%ogqPp3lQDlarR^HaAz4nB-IvxDM)3wA=k$xiV]Rrp!szKpHv6%ogqO#zF%RtB7GCqEf}8tarU/Ey-\u003e\u003e-w*g]gBz#pZfe43Ux(mK3e[]kSDUECEfktMDzA\u0026kYyH}xDDR449pdw2^r8ldQpjjq[arR^HBAhT/3lQDlarR^HayPtpzET/kx([2hvqfT[BAzEOlU{EFzGF/*B8#5lzyu}RvriMjwPI{bz/dPyarR^HarR^HarR^HvrlZiv\u003c2#fBz8!rwPI{bz/dguwPPtyA+)oHBzkP6z/{d+f/py5vriMiwPI/K3lQDlarR^HarR^HarR^HazCBgA+frhe]#byBAITEaW3@6fFCJ{arR^HarR^HarR^HarR^HarR^HA+funA=91Db4U!nz/N3.az8/*r8=WpDVAXsA4ViNvruTkEiK7DarR^HarR^HarR^HarR^HwmoN*auZ\u0026QCvticaAz4mA4U)Dz/c%L3lQDlarR^HarR^HarR^HaAz4nB-IvxDKp(rarR^HarR^HarR^HarR^HarR\u003erx([RAiV}%wByu!mwPPsAv}*4ga$k5IarR^HarR^HarR^HarR^HarR^Hb64mcx(v(kiV}%wByu!mwPPsAA+e($z/c:Fed9HxarR^HarR^HarR^HarR^HarR\u003erz/]@tA^n\u0026\u0026ay[]5vj(h7Bsntyz/]@tA^n\u0026Ted9HxarR^HarR^HarR^HarR^HarR\u003eDA+uNSay[]5vj(h7BsntKA+uNBed9HxarR^HarR^Hao", "ln": 0, "col": 1, "line": 1 }, { "b": "arR\u003eAz^%$Lay[]5vj(h7BsntHz^%$ued9HxarR^HarR^HarR^HarV7tarR^HwQ4Y@Ac9i\u003eCW\u003er7BzkVhayPslwJyevarR^HarR!EwPS6nzxKoIwPz*fAW0K!B98BJwHS3", "ln": 886, "col": 19, "line": 25 } ], "depth": 1, "facts": { "imp": [ [ "", "config.get" ], [ "", "aiohttp.ClientSession" ], [ "", "session.get" ], [ "", "resp.json" ], [ "", "data.get" ], [ "", "data.get" ], [ "", "data.get" ], [ "", "data.get" ], [ "", "data.get" ], [ "", "data.get" ], [ "", "str" ], [ "", "aiohttp" ], [ "milenium.modules", "config" ], [ "", "milenium.modules" ], [ "", "os" ] ], "mbr": [ "aiohttp.ClientSession", "config.get", "data.get", "resp.json", "resp.status", "session.get" ], "tgt": [ "aiohttp.ClientSession", "config.get", "data.get", "resp.json", "session.get", "str" ], "funcs": [ [ "check", 110 ] ], "metrics": { "ast": { "max_depth": 17, "call_count": 11, "node_count": 339, "member_count": 6, "member_depth_max": 2 }, "file": { "size": 989, "entropy": 4.45 }, "text": { "lines": 28, "top_char": 116, "max_ws_run": 1, "digit_ratio": 0.01, "space_count": 314, "char_entropy": 4.45, "unique_chars": 68, "top_char_null": 0, "string_density": 0.75, "top_char_ratio": 0.05, "avg_line_length": 34.36, "max_line_length": 61, "non_ascii_ratio": 0.02, "empty_line_ratio": 0.11, "last_line_length": 32, "whitespace_ratio": 0.34, "identifier_density": 1.68, "line_length_stddev": 18.87, "normalized_string_count": 3.97, "repeated_char_sequences": 12, "suspicious_identifier_ratio": 0.05, "normalized_unique_identifiers": 4.37 }, "binds": { "count": 3 }, "binary": { "peak_region_bytes": 989, "peak_region_entropy": 4.45 }, "source": { "function_count": 1 }, "imports": { "count": 4, "stdlib_count": 1, "stdlib_ratio": 0.25, "third_party_count": 3, "third_party_ratio": 0.75 }, "strings": { "bytes": 220, "count": 21, "url_count": 1, "avg_length": 10.48, "max_length": 48, "avg_entropy": 2.5, "empty_count": 1, "entropy_stddev": 0.96 }, "functions": { "count": 1, "density": 3.57, "avg_params": 1, "code_ratio": 0.75, "max_params": 1, "avg_name_length": 5, "avg_length_lines": 21, "max_length_lines": 21, "min_length_lines": 21, "avg_param_name_length": 2 }, "identifiers": { "count": 47, "unique": 21, "avg_length": 5.57, "max_length": 13, "min_length": 1, "avg_entropy": 2.02, "reuse_ratio": 0.45, "length_stddev": 3.08, "sequential_names": 1, "single_char_count": 1, "single_char_ratio": 0.05, "all_lowercase_ratio": 0.86, "all_uppercase_ratio": 0.05 } } }, "id": 27, "mol": "O(Dy)H(Cm₆)Md₂(In₂Pt)", "path": "/data/samples/incoming/forager/python/pythonhosted.org/pypi.org/milenium/milenium-1.1.1-py3-none-any.whl!!milenium/modules/ipinfo_search.py", "pid": 0, "risk": 4, "sha": "03f1ba13e2d79a3917e9d8d2e504039ca204b1ba4a88ebbae7e5cc380cddbf5f", "size": 989, "traits": [ { "id": "metadata/import/python/aiohttp::aiohttp", "conf": 0.95, "crit": 3, "desc": "imports aiohttp", "spans": [ [ 17, 7 ] ] }, { "id": "metadata/import/python/milenium/modules/config::config", "conf": 0.95, "crit": 2, "desc": "imports config from milenium.modules", "spans": [ [ 55, 0 ] ] }, { "id": "metadata/import/python/milenium/modules::milenium/modules", "conf": 0.95, "crit": 2, "desc": "imports milenium.modules", "spans": [ [ 31, 0 ] ] }, { "id": "metadata/import/python/os::os", "conf": 0.95, "crit": 3, "desc": "imports os", "spans": [ [ 7, 2 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-6", "conf": 0.8, "crit": 1, "desc": "English function-word token \"with\"", "spans": [ [ 355, 0 ] ] }, { "id": "micro-behaviors/communications/http/authorization-header::auth-like-constant-assignment", "atk": "T1071.001", "mbc": "C0002", "conf": 0.8, "crit": 3, "desc": "Auth-like constant assignment", "spans": [ [ 62, 14 ] ] }, { "id": "micro-behaviors/communications/http/client/library::aiohttp-import", "conf": 0.9, "crit": 3, "desc": "Imports the aiohttp Python HTTP client", "spans": [ [ 17, 7 ], [ 360, 21 ] ] }, { "id": "micro-behaviors/communications/http/client/library::python-session-method-call", "conf": 0.85, "crit": 3, "desc": "Python session-like method call", "spans": [ [ 419, 11 ] ] }, { "id": "micro-behaviors/communications/http/ip-discovery::ipinfo-io", "conf": 0.85, "crit": 3, "desc": "ipinfo.io IP information API", "spans": [ [ 151, 9 ] ] }, { "id": "micro-behaviors/communications/http/lib/aiohttp::aiohttp-session", "conf": 0.7, "crit": 3, "desc": "aiohttp.ClientSession usage", "spans": [ [ 17, 7 ] ] }, { "id": "micro-behaviors/communications/http/url/query::interpolated-identifier-query-value", "conf": 0.9, "crit": 3, "desc": "URL query interpolates an identifier value", "spans": [ [ 309, 21 ] ] }, { "id": "objectives/discovery/host/geo::city-field", "atk": "T1016", "conf": 0.5, "crit": 3, "desc": "City JSON field (geo profiling)", "spans": [ [ 642, 7 ] ] }, { "id": "objectives/discovery/host/geo::region-field", "atk": "T1016", "conf": 0.5, "crit": 3, "desc": "Region JSON field (geo profiling)", "spans": [ [ 688, 9 ] ] }, { "id": "metadata/lang/natural::script-cyrillic", "conf": 0.8, "crit": 3, "desc": "Contains multiple standalone Cyrillic words", "spans": [ [ 162, 6 ], [ 175, 16 ] ] }, { "id": "micro-behaviors/communications/http/client/library::aiohttp-session-request", "conf": 0.85, "crit": 3, "desc": "Sends HTTP through an aiohttp session", "uses": [ 6, 7 ], "spans": [ [ 17, 7 ], [ 360, 21 ], [ 419, 11 ] ] }, { "id": "objectives/discovery/host/geo::geo-api", "atk": "T1016", "conf": 0.7, "crit": 3, "desc": "Geolocation API endpoint", "uses": [ 8 ], "spans": [ [ 151, 9 ] ] }, { "id": "objectives/discovery/host/geo::geo-response-field", "atk": "T1016", "conf": 0.5, "crit": 3, "desc": "Geolocation response field markers", "uses": [ 11, 12, 15 ], "spans": [ [ 151, 9 ], [ 642, 7 ], [ 688, 9 ] ] }, { "id": "micro-behaviors/communications/http/request/client::request-python", "conf": 0.9, "crit": 3, "desc": "Sends an HTTP request with a Python client library", "uses": [ 9 ], "spans": [ [ 17, 7 ] ] }, { "id": "objectives/discovery/host/geo::ip-geolocation-lookup", "atk": "T1016", "conf": 0.85, "crit": 3, "desc": "IP geolocation lookup via API", "uses": [ 15, 16 ], "spans": [ [ 151, 9 ], [ 642, 7 ], [ 688, 9 ] ] } ], "type": "python" }, { "id": 28, "mol": "H(Cm₆)", "sha": "9abd2da1408f00c0dc41211483c9459f63fbd3ebceafd740eddbc85c739b58b2", "path": "/data/samples/incoming/forager/python/pythonhosted.org/pypi.org/milenium/milenium-1.1.1-py3-none-any.whl!!milenium/modules/leakcheck.py", "risk": 1, "size": 558, "type": "python", "depth": 1 }, { "id": 29, "mol": "H₂(DbPo₂)", "sha": "58f7b018512ca56881d9a28007aaa1967bbc9530c41ae42798f9f6729478c1f6", "path": "/data/samples/incoming/forager/python/pythonhosted.org/pypi.org/milenium/milenium-1.1.1-py3-none-any.whl!!milenium/modules/logger.py", "risk": 3, "size": 1480, "type": "python", "depth": 1 }, { "id": 30, "mol": "H₂(DbPo₂)Md(Pt)", "sha": "3feaa8883b14f48f6e26516fbec9ad18734abf269b82fac8d1b8a0b55482f942", "path": "/data/samples/incoming/forager/python/pythonhosted.org/pypi.org/milenium/milenium-1.1.1-py3-none-any.whl!!milenium/modules/maigret_search.py", "risk": 4, "size": 651, "type": "python", "depth": 1 }, { "id": 31, "mol": "O₂(C₂S)H(Db₂)", "sha": "baf96ca6bada5c7ba9749103adb1e814e750b7cbb2fbbf833b72fcccf15e8d76", "path": "/data/samples/incoming/forager/python/pythonhosted.org/pypi.org/milenium/milenium-1.1.1-py3-none-any.whl!!milenium/modules/neon_db.py", "risk": 5, "size": 6927, "type": "python", "depth": 1 }, { "id": 32, "mol": "H(Db)Md(Pt)", "sha": "8de77897a50d8580ebc5e76ff00bd58d937566ba736b810e6078844bc2a6d7b0", "path": "/data/samples/incoming/forager/python/pythonhosted.org/pypi.org/milenium/milenium-1.1.1-py3-none-any.whl!!milenium/modules/password_pattern.py", "risk": 2, "size": 1137, "type": "python", "depth": 1 }, { "id": 33, "mol": "H(Db)Md₂(Pt)", "sha": "180f9f9498579d088fb25f355d68c19dfd4d594c4d8b19f3bd06e89c1fc66f08", "path": "/data/samples/incoming/forager/python/pythonhosted.org/pypi.org/milenium/milenium-1.1.1-py3-none-any.whl!!milenium/modules/permutator.py", "risk": 3, "size": 1229, "type": "python", "depth": 1 }, { "id": 34, "mol": "H(Cm₄)", "sha": "a69ad6f900c13e9f267ab6c89eedcda6732aa707e9038b1da05280cfba3ad263", "path": "/data/samples/incoming/forager/python/pythonhosted.org/pypi.org/milenium/milenium-1.1.1-py3-none-any.whl!!milenium/modules/pgp_lookup.py", "risk": 1, "size": 314, "type": "python", "depth": 1 }, { "id": 36, "mol": "H(Cm₃)Md₂(InPt)", "sha": "d6f0e6bfec309d7e6448681706dc1960fc838873b1b8b9120ec6ed8ebf904d7e", "path": "/data/samples/incoming/forager/python/pythonhosted.org/pypi.org/milenium/milenium-1.1.1-py3-none-any.whl!!milenium/modules/pwned_passwords.py", "risk": 3, "size": 753, "type": "python", "depth": 1 }, { "id": 37, "mol": "H₂(DbF)", "sha": "a6ed75ec0e9f1d35c4a68751ba84c9d83a849725e192728418012a52de25b70a", "path": "/data/samples/incoming/forager/python/pythonhosted.org/pypi.org/milenium/milenium-1.1.1-py3-none-any.whl!!milenium/modules/report.py", "risk": 2, "size": 605, "type": "python", "depth": 1 }, { "ctx": [ { "b": "x(d*cA=-BAwPq\u003c7B98Egw].*bayYyGazCXiz/P}xls\u003cOFBzkufy/tm{A0=}.wO95{xK$W?c#\u003cxvA^o8{3lQDlar\u00260N^4wW?^sxR}^74FPaA?EgCvUPje[]inzY[4\u0026LPXtT^6.nL^7^@t^6g]H^7N/uefJrA^6.lfave*}eZR8QYu#U^HTrmTa%FirarR^HBAhT/3lQDlarR^HaAwO/aAz4kB.bSoB1R9pBsmFsarR^HarR^HarR^JxMOunB2\u003e%cC4\u003eJiwnVDvx(mK3flgSEwPz\u003c6Cw7]eB1XZ*3lQDlarR^HarR^HaAg+fvqQ6GDM)CNiV@A+wPA6Aed9HxarR^HarR^HarUuevpS}\u0026B3j\u003c]rDz.(eKs2XzGE6-ar\u003cJ#Dtdhivj%F\u003cfD$]@3lQDlarR^HarR^HaARsmwP8ZkjU!Yx3lQDlarR^HasNTuarR^HarR!Fz/{1wjS)75vrDWaw{4]*z/{1EAXqDBCYUFVb4#7ny+xWnA=U/ja$i\u003cwarR^HarR!GvpB4:auZ\u0026*z/{1Kw[=c[c)A+wvR/Q1efGo-vSco$wPw$Qar\u0026J:EjkHCarR^HarR!vw/$#fBrCWlvR/Qp3lQDlarR^HarR^HaAz4nB-IvxDM)0szddc@B0rT/tu#T:arR^HarR^Hwn=r[x(m#mjS)%m3lQDlarR^HazbLjaAzyAazCZoBywS{wIdOezE^9.y?$HzBAeMOtqnfAiTM#LarR^HarR^HarUfjy\u0026ZZZaAzyAe[O*nwm5+Yy:ZGHwfJDfarR^HarR^HarR^Hx\u003ewF$z!%FQ3lQDlarR^HarR^H", "ln": 0, "col": 1, "line": 1 }, { "b": "dgdguarR^HarUYoBAIRwaBtqyz/5]%zGv0.ay]zcvqfR2trjF)fKo8larR^HwQ4Y@Ac9i\u003eCW\u003er7BzkVhayPslwJyevarR^HarR!EwPS6nzxKoIwPz*fAW0K!B98BJwHS3", "ln": 688, "col": 52, "line": 21 } ], "depth": 1, "facts": { "imp": [ [ "", "requests.get" ], [ "", "BeautifulSoup" ], [ "", "soup.find" ], [ "", "table.find_all" ], [ "", "row.find_all" ], [ "", "domains.append" ], [ "", "str" ], [ "bs4", "BeautifulSoup" ], [ "", "bs4" ], [ "", "requests" ] ], "mbr": [ "domains.append", "r.text", "requests.get", "row.find_all", "soup.find", "table.find_all" ], "tgt": [ "BeautifulSoup", "domains.append", "requests.get", "row.find_all", "soup.find", "str", "table.find_all" ], "funcs": [ [ "check", 47 ] ], "metrics": { "ast": { "max_depth": 16, "call_count": 8, "node_count": 272, "member_count": 6, "member_depth_max": 2 }, "file": { "size": 791, "entropy": 4.69 }, "text": { "lines": 24, "top_char": 101, "max_ws_run": 1, "digit_ratio": 0.03, "space_count": 224, "char_entropy": 4.69, "unique_chars": 74, "top_char_null": 0, "string_density": 0.58, "top_char_ratio": 0.05, "avg_line_length": 32, "max_line_length": 82, "non_ascii_ratio": 0.06, "empty_line_ratio": 0.04, "last_line_length": 32, "whitespace_ratio": 0.31, "identifier_density": 1.58, "line_length_stddev": 17.93, "normalized_string_count": 2.86, "repeated_char_sequences": 8, "suspicious_identifier_ratio": 0.09, "normalized_unique_identifiers": 5.02 }, "binds": { "count": 5 }, "binary": { "peak_region_bytes": 791, "peak_region_entropy": 4.69 }, "source": { "function_count": 1 }, "imports": { "count": 3, "third_party_count": 3, "third_party_ratio": 1 }, "strings": { "bytes": 178, "count": 14, "url_count": 1, "avg_length": 12.71, "max_length": 76, "avg_entropy": 2.26, "entropy_stddev": 1.35 }, "functions": { "count": 1, "density": 4.17, "avg_params": 1, "code_ratio": 0.88, "max_params": 1, "avg_name_length": 5, "avg_length_lines": 21, "max_length_lines": 21, "min_length_lines": 21, "avg_param_name_length": 5 }, "identifiers": { "count": 38, "unique": 23, "avg_length": 5.26, "max_length": 13, "min_length": 1, "avg_entropy": 2.04, "reuse_ratio": 0.61, "length_stddev": 2.66, "has_digit_ratio": 0.04, "sequential_names": 2, "single_char_count": 2, "single_char_ratio": 0.09, "all_lowercase_ratio": 0.87, "numeric_suffix_count": 1 } } }, "id": 38, "mol": "H(Cm₄)Md₂(In₂Pt)", "path": "/data/samples/incoming/forager/python/pythonhosted.org/pypi.org/milenium/milenium-1.1.1-py3-none-any.whl!!milenium/modules/reverse_whois.py", "pid": 0, "risk": 4, "sha": "2f33ac6643588bb8102f79d2e209c3ff797660815ff5be61b9a630f3e025027d", "size": 791, "traits": [ { "id": "metadata/import/python/bs4/beautifulsoup::beautifulsoup", "conf": 0.95, "crit": 2, "desc": "imports BeautifulSoup from bs4", "spans": [ [ 32, 0 ] ] }, { "id": "metadata/import/python/bs4::bs4", "conf": 0.95, "crit": 2, "desc": "imports bs4", "spans": [ [ 21, 0 ] ] }, { "id": "metadata/import/python/requests::requests", "conf": 0.95, "crit": 3, "desc": "imports requests", "spans": [ [ 7, 8 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "spans": [ [ 541, 0 ] ] }, { "id": "micro-behaviors/communications/http/client/response-body::python-response-body-member-reference", "conf": 0.8, "crit": 3, "desc": "Python response body member access", "spans": [ [ 380, 1 ], [ 382, 4 ] ] }, { "id": "micro-behaviors/communications/http/request/client::requests-get-url-literal", "conf": 0.8, "crit": 3, "desc": "Literal URL passed to requests.get/httpx.get", "spans": [ [ 169, 35 ] ] }, { "id": "micro-behaviors/communications/http/user-agent::application-user-agent", "conf": 0.86, "crit": 3, "desc": "Application-specific User-Agent header", "spans": [ [ 287, 27 ] ] }, { "id": "metadata/lang/natural::script-cyrillic", "conf": 0.8, "crit": 3, "desc": "Contains multiple standalone Cyrillic words", "spans": [ [ 72, 12 ], [ 102, 18 ], [ 122, 6 ], [ 133, 10 ] ] }, { "id": "micro-behaviors/communications/http/lib/requests::imports-requests", "conf": 0.95, "crit": 3, "desc": "Imports the requests HTTP client for Python", "spans": [ [ 0, 15 ] ] }, { "id": "micro-behaviors/communications/http/lib/requests::requests-get", "conf": 0.85, "crit": 3, "desc": "Calls requests.get in Python", "spans": [ [ 169, 12 ] ] }, { "id": "metadata/import/package::python-network-client-imports", "conf": 0.95, "crit": 3, "desc": "Imports a Python network client library", "uses": [ 2 ], "spans": [ [ 7, 8 ] ] }, { "id": "micro-behaviors/communications/http/client/response-body::requests-response-body-access", "conf": 0.9, "crit": 3, "desc": "Reads a requests response body", "uses": [ 4, 8, 9 ], "spans": [ [ 0, 15 ], [ 169, 12 ], [ 380, 1 ], [ 382, 4 ] ] }, { "id": "micro-behaviors/communications/http/request/client::url-literal", "conf": 0.8, "crit": 3, "desc": "Uses a literal URL in an HTTP request", "uses": [ 5 ], "spans": [ [ 169, 35 ] ] }, { "id": "micro-behaviors/communications/http/request/client::request-python", "conf": 0.9, "crit": 3, "desc": "Sends an HTTP request with a Python client library", "uses": [ 9, 12 ], "spans": [ [ 169, 35 ] ] } ], "type": "python" }, { "id": 39, "mol": "H₂(DbPo₂)Md(Pt)", "sha": "f1841501e0c03cd48e320642112fbfb80ecd02fefee7af271000e7e2118735c6", "path": "/data/samples/incoming/forager/python/pythonhosted.org/pypi.org/milenium/milenium-1.1.1-py3-none-any.whl!!milenium/modules/sherlock_search.py", "risk": 4, "size": 555, "type": "python", "depth": 1 }, { "id": 40, "mol": "H(Cm₃)Md(Pt)", "sha": "982c2bcf029c4e04bd259245e50c727c8488c2e02d0995715b7e96c7cc1b90dd", "path": "/data/samples/incoming/forager/python/pythonhosted.org/pypi.org/milenium/milenium-1.1.1-py3-none-any.whl!!milenium/modules/shodan_lite.py", "risk": 2, "size": 676, "type": "python", "depth": 1 }, { "ctx": [ { "b": "x(d*cA=-BxA%=R#AbP=sayO#5xMOun3jpx=z/3Rlx(4u#x)1nBzeS%cy?mVgx(d*cA=-Blz/ff3x9}NdpEEGzuRr*\u003cauZ\u0026Sz/ff3xd^?dBsntinkzStpg3p-nNCaVsT2yta%FDy3jpi.D2vamwmYu}v}YB-yHp^{c#0SYaAITBdiHiaay]g@Buf:KarR^Ja%G%0z!9o]ave*}iV#!:^7W[T^sP=7efJrA^6g)g^7N/l^sxS5efEqXmjYOdV^ubbZaHPNa{]CnarUxgaz#atax7*bl{TNPogq#A3lQDlarR^HaAz4nB-IvxDM)3wA=k$xiV]RBnkzStpg3p-nNCaVsS?Q2BrCToBrVbuarR^HB-IpvjS[tXxMOunB2\u003e%cvq]{kB7/G5vqWYiz.DfBz!9o]fkboBBt4#PAd6@^wQcB=q+fXLk#7=WmoL3=ze0)4w{DKYA=\u003e}q3lQDlaARTHiTM#LarR^HarU9lD2vamCwhejayO#5xMOune\u003c\u003cC?wO#P*wPI{bz/c%LayPslB7GAlx(v(I3lQDlarR^HarR^HayPtpzET/kx([2hB7GAlx(v(wxjVfkB-IpHaARsmwP8ZkjUX/yayPslA+frhiTM#LarR^HarR^HarR^HarUxgaAz4mA4ViNvruTkau.\u003egg+Z:E3lQDlarR^HarR^HarR^HarR^HaAz4nB-IvxDM)6uB-7.liV{[2y\u0026:fo3lQDlarR^HarR^HarR^HazCA", "ln": 0, "col": 1, "line": 1 }, { "b": "A+frhe]#byBAIUMb7f!varR^HarR^HarR^HarR!qvrt{2jS[fSvqf*aA+frhe]2DCzyu}varR^HarR^HarR^HarR^HA+funA=91D3lQDlarR^HarR^HarR^HarR^Har\u003e-AxcGwVwmoN*e[X:qc)AOIxcF=Q3lQDlarR^HarR^HarR^HarR^Har\u003e-Bb03\u0026Svrt{gxjVfkb5.JDdj+/GarR^HarR^HarR^HarR^HarR^JAbP=sB0rT/wmoN*e[X:qc)ARGA==vDefFe5dj+/GarR^HarR^HarR^HarR^HarR^JxM4%lzEEx[B0rT/wmoN*e[X:qc)AtyB98qdzdN=jefFe5dj+/GarR^HarR^HarR^Hao", "ln": 657, "col": 46, "line": 19 }, { "b": "c)A?Sy\u0026jqrefGp/dk2yED2\u003ew.dj+/GarR^HarR^HarR^HarR^HarR^Jv@DHcBAhTJiV}%wByu!mwPPsAv@DHcBAhUlzEEx[a$k5IarR^HarR^HarR^HarR^HarR^Hb4CteC{ko(wmoN*e[X:qc)AenBA]5Ved9HxarR^HarR^HarR^HarV7tarR^HwQ4Y@Ac9i\u003eCW\u003er7BzkVhayPslwJyevarR^HarR!EwPS6nzxKoIwPz*fAW0K!B98BJwHS3", "ln": 978, "col": 43, "line": 26 } ], "depth": 1, "facts": { "imp": [ [ "", "config.get" ], [ "", "aiohttp.ClientSession" ], [ "", "session.get" ], [ "", "resp.json" ], [ "", "data.get" ], [ "", "data.get" ], [ "", "data.get" ], [ "", "data.get" ], [ "", "list" ], [ "", "data.get.keys" ], [ "", "data.get" ], [ "", "data.get" ], [ "", "data.get" ], [ "", "str" ], [ "", "aiohttp" ], [ "milenium.modules", "config" ], [ "", "milenium.modules" ], [ "", "os" ] ], "mbr": [ "aiohttp.ClientSession", "config.get", "data.get", "data.get.keys", "resp.json", "resp.status", "session.get" ], "tgt": [ "aiohttp.ClientSession", "config.get", "data.get", "data.get.keys", "list", "resp.json", "session.get", "str" ], "funcs": [ [ "check_ip", 110 ] ], "metrics": { "ast": { "max_depth": 19, "call_count": 14, "node_count": 406, "member_count": 7, "member_depth_max": 3 }, "file": { "size": 1181, "entropy": 4.51 }, "text": { "lines": 31, "top_char": 116, "max_ws_run": 1, "digit_ratio": 0.01, "space_count": 381, "char_entropy": 4.51, "unique_chars": 75, "top_char_null": 0, "string_density": 0.77, "top_char_ratio": 0.05, "avg_line_length": 37.13, "max_line_length": 80, "non_ascii_ratio": 0.03, "empty_line_ratio": 0.1, "last_line_length": 32, "whitespace_ratio": 0.35, "identifier_density": 1.71, "line_length_stddev": 20.59, "normalized_string_count": 4.31, "repeated_char_sequences": 15, "suspicious_identifier_ratio": 0.04, "normalized_unique_identifiers": 4.64 }, "binds": { "count": 3 }, "binary": { "peak_region_bytes": 1024, "peak_region_entropy": 4.56 }, "source": { "function_count": 1 }, "imports": { "count": 4, "stdlib_count": 1, "stdlib_ratio": 0.25, "third_party_count": 3, "third_party_ratio": 0.75 }, "strings": { "bytes": 272, "count": 24, "url_count": 1, "avg_length": 11.33, "max_length": 67, "avg_entropy": 2.5, "empty_count": 1, "entropy_stddev": 1.06 }, "functions": { "count": 1, "density": 3.23, "avg_params": 1, "code_ratio": 0.77, "max_params": 1, "avg_name_length": 8, "avg_length_lines": 24, "max_length_lines": 24, "min_length_lines": 24, "avg_param_name_length": 2 }, "identifiers": { "count": 53, "unique": 23, "avg_length": 5.48, "max_length": 13, "min_length": 1, "avg_entropy": 2.07, "reuse_ratio": 0.43, "length_stddev": 2.86, "sequential_names": 1, "single_char_count": 1, "single_char_ratio": 0.04, "all_lowercase_ratio": 0.87, "all_uppercase_ratio": 0.04 } } }, "id": 41, "mol": "O(C)H₂(Cm₄Db)Md₂(In₂Pt)", "path": "/data/samples/incoming/forager/python/pythonhosted.org/pypi.org/milenium/milenium-1.1.1-py3-none-any.whl!!milenium/modules/shodan_search.py", "pid": 0, "risk": 5, "sha": "290eb9c2ab849dbee86dc0ee1a8a1f9c139a22fa24dbc25aec069a0a70d4f49b", "size": 1181, "traits": [ { "id": "metadata/import/python/aiohttp::aiohttp", "conf": 0.95, "crit": 3, "desc": "imports aiohttp", "spans": [ [ 17, 7 ] ] }, { "id": "metadata/import/python/milenium/modules/config::config", "conf": 0.95, "crit": 2, "desc": "imports config from milenium.modules", "spans": [ [ 55, 0 ] ] }, { "id": "metadata/import/python/milenium/modules::milenium/modules", "conf": 0.95, "crit": 2, "desc": "imports milenium.modules", "spans": [ [ 31, 0 ] ] }, { "id": "metadata/import/python/os::os", "conf": 0.95, "crit": 3, "desc": "imports os", "spans": [ [ 7, 2 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-6", "conf": 0.8, "crit": 1, "desc": "English function-word token \"with\"", "spans": [ [ 388, 0 ] ] }, { "id": "micro-behaviors/communications/http/client/library::aiohttp-import", "conf": 0.9, "crit": 3, "desc": "Imports the aiohttp Python HTTP client", "spans": [ [ 17, 7 ], [ 393, 21 ] ] }, { "id": "micro-behaviors/communications/http/client/library::python-session-method-call", "conf": 0.85, "crit": 3, "desc": "Python session-like method call", "spans": [ [ 452, 11 ] ] }, { "id": "micro-behaviors/communications/http/lib/aiohttp::aiohttp-session", "conf": 0.7, "crit": 3, "desc": "aiohttp.ClientSession usage", "spans": [ [ 17, 7 ] ] }, { "id": "micro-behaviors/communications/http/url/query::interpolated-identifier-query-value", "conf": 0.9, "crit": 3, "desc": "URL query interpolates an identifier value", "spans": [ [ 334, 17 ] ] }, { "id": "micro-behaviors/data/serialize/schema-object::country-name", "conf": 0.5, "crit": 3, "desc": "country_name data field", "spans": [ [ 1042, 12 ] ] }, { "id": "micro-behaviors/data/serialize/schema-object::platform-field-key", "conf": 0.86, "crit": 3, "desc": "JSON-like platform or OS field", "spans": [ [ 802, 5 ] ] }, { "id": "objectives/command-and-control/dropper/python-script::python-resource-platform-field", "atk": "T1105", "mbc": "B0024", "conf": 0.9, "crit": 3, "desc": "Reads resource platform field", "spans": [ [ 812, 10 ] ] }, { "id": "objectives/discovery/host/geo::city-field", "atk": "T1016", "conf": 0.5, "crit": 3, "desc": "City JSON field (geo profiling)", "spans": [ [ 1078, 7 ] ] }, { "id": "metadata/lang/natural::script-cyrillic", "conf": 0.8, "crit": 3, "desc": "Contains multiple standalone Cyrillic words", "spans": [ [ 166, 10 ], [ 178, 14 ], [ 199, 6 ] ] }, { "id": "micro-behaviors/communications/http/client/library::aiohttp-session-request", "conf": 0.85, "crit": 3, "desc": "Sends HTTP through an aiohttp session", "uses": [ 5, 6 ], "spans": [ [ 17, 7 ], [ 393, 21 ], [ 452, 11 ] ] }, { "id": "micro-behaviors/communications/http/request/client::request-python", "conf": 0.9, "crit": 3, "desc": "Sends an HTTP request with a Python client library", "uses": [ 7 ], "spans": [ [ 17, 7 ] ] } ], "type": "python" }, { "id": 43, "mol": "O₂(CEu)H₂(CmDb₄)Md(Pt)", "sha": "fe034bfc49467ea621016ffc3b61b8be42215e0f4f1c6b971c6f0a1383ea86c9", "path": "/data/samples/incoming/forager/python/pythonhosted.org/pypi.org/milenium/milenium-1.1.1-py3-none-any.whl!!milenium/modules/telegram_analysis.py", "risk": 6, "size": 1225, "type": "python", "depth": 1 }, { "id": 44, "mol": "H(Cm₃)Md(Pt)", "sha": "9630fd89bad59389663914f75b1e8c7542c03ff5d28ea8f9fb57308e8bf09e82", "path": "/data/samples/incoming/forager/python/pythonhosted.org/pypi.org/milenium/milenium-1.1.1-py3-none-any.whl!!milenium/modules/telegram_osint.py", "risk": 2, "size": 772, "type": "python", "depth": 1 }, { "ctx": [ { "b": "x(d*cA=-BxA%=R#AbP=sayPtpzEWy03tBu@z/P}xB9g@hA=kD0B8}X5ze:AlBrCTIA%=J1z/3R9x(vT8vqNc3ze:AlBrA[*BsXL5x(!l4ByO#}AX5tPD2Nto3tar%z6in3z!B90z7YBmy\u0026\u003cleB0bglAbP=savy6:zddr)3tar%z6iXfy?mG#B.@:Fz!a0bwPF#dze:AlBrC7izF0P}3jo9}r9@Q2ogqO#jS[lMzF0P}e[X:qc)zRXuQvK/uSo/]mnt3Tar\u0026^7i5-PKi5ASMiZD55xMc)Kr.kbSi5\u003eOOlrXhqwm4]KnnAi2m]%52peTFSa$i\u003c+oIwk-mmpG.q:\u003cO.auZ\u0026Sz/ff3xd^?dBsntjm{!LQoIX.Ul%\u0026})mn^5defDc4AbP\u0026zyhNQda$jSSboUx?^6.nK^6.lfaKEQAU*yejKi@NbGvbYgaKE)JGvbm$G3.jOjS@aS^sGVL3jplXBrAZ?lt{@]Bz\u003e@azAQrZr9@Q2ogqP8azCBglqHM/r8ldQp9sa:B7DE?z/fa[wn\u0026UOavG{+Aa9\u0026#xK#ijdgcy?wmYu}uTW+!z*b=6d0oPxA:JJ\u003eiV@cOBsws:j%jrMz!}DwarR^HvqG:#Cv+qcjS[lMzF0P}", "ln": 0, "col": 1, "line": 1 }, { "b": "wPS6nzxI]0B.7[5arR!EwPS6nzxK1xAWV6KwPzc(wgnTnzxJede]#bPx(CEHazbLjaB22yzxJw7y\u0026sJewg?}xy?W#ta$K]!t)Z]CwmYu}uVHpbuT)[^c$ddeB2\u003eBWx(!wBat2=1B98B-3lQDlar\u00260N^3Ja-^7^$X^sGVQ^6g)8^sJGTx(4u#x)1nnlRH5]^6$jBVE3tjX6RCdFy7KFIo@GNWB6NGB97@hB-YkWa%EvparR!GA^oXMarR^HarR^HAb](bauZ\u0026*BZ/rgz!0v1B1RGQzyt\u0026marR^HarR^HarR!hB9R*VwQ4=@B-.53y?kdua$WTQefDcNx(4u#x)1nBv@b\u003c6t{7Tuvrc14ed9HxarR^HarR^HarUf5AcckywNxv#Bz#wAjYDDAwH[%CwQ5qWrc0a)efG4GzdNTdBuIurfBw{BarR^HarS9uarR^HarR^Hz/{dAjS[Y:z^$zvByYrjBs}SRA+PFvdiJLHaAhvtv\u003eI?AwmY!4e]#bPx(CEH3lQDlarR^HaAz4nB-Ivxz/{eaiY5JAfKk/tAV=LO^7^$X^sGX%^7Q}M3lQDlaz2!cwPh-lB9g@hA=kD0B8@%kx(dB1B-Z5%Aa%u7wi75uarR^HarR!EwPS6nzxHd.KfG?PG3Z:GXZn1oU*F9JF/(^cfWUB}3lQDlaz2!cwPh-lmr\u0026rNAcb/jzxJweaz0OvarR^HarR^HA+funA=91ibga6KH%SVUVcZ8eUSr[NwQL:f3jo4eA4V0sB8$=5wHG]:zeAZ0wgeTyByxiia$j@FvrlZiv\u003c2q[w/$P2wm6z1vrcDrzdN^fvp%djaAR)FwPGE#wPI{3xjSIM3lQDlazCBgzF%RtuTW+!z*b=6c#AKpB75Y)e[Pcxzc}BbwPxzqwgoLDao", "ln": 554, "col": 10, "line": 19 }, { "b": "a{]CnarR^HarR\u003cYx(CgSnL?O[\u0026^^moq!Q8WvqWhravxZTB9R*Hd\u003cd\u003e(as!N2vS=:6tY7.)arR^HarR^Ha$[7WwPw[Q^7N/o^7hy-\u0026^^moo\u003c}:GA+ftnd\u003cd=7wPzQ9v@2s!a{]CnarR^HarR\u003cYwO\u003e\u003c\u0026y-\u003e\u0026Kzddc{j%n\u003cnLPSIny?mo\u003eas!Nnr9Tq+3lQDlarR^Har\u0026EHz/3QV^6Rfl^7E-k^7IQ=\u0026^^mos4DaUqY)Okl@3V6d\u003cetxBs}SFtY7.)arR^HarR^Ha$[7Vy-\u003e\u0026uqCom%\u0026^^moB-Iqtv{%mcx(vl]a{]CnarR^HarR\u003cYBy#ZUB-RbmzEEx[j%n\u003cnLPS}py?mZ4z/e/$a{]CnarR^HarR\u003cYAcDhhwfs1YZTfjjFy83SYu#N3aMv{oaw^o1wN(]WvrlHl", "ln": 1369, "col": 27, "line": 44 }, { "b": "diH.}gcb:+arR^HarR!nCvticaz\u003eXhB75Y)e[5TsCv+!ybg9\u003cEFZzfUZr\u003cHtJl]5XZr\u003cgjU*y8gXx}SAatm\u003eUwPw[Q^7N/o^7hy+dgdguarR^HarUYoBAIRw3lQDlayPF5x(\u003eFmwPI{3xjSY7zGy2kAWUJz\u0026/yz*B-RbmaBw6oA==wbf\u003cPhKdgdguarUPBBrAZ?vrVc]BrC1kD2vbaz.ucIuVY$4wNP9$uVHpbuT)[^efFdvB-Rbma$K\u0026", "ln": 2564, "col": 17, "line": 80 }, { "b": "wPI{3xjSY7zGy2kAWScUXy2(OZTfZwYu#O:X6R\u003eoVE2\u00265Z0KpoWk]A-B-IpvxMOunB2\u003e%cwQ4T2Abo8rv@DiddgdguarR^HarUYoBAIRw3lQDlayPF5x(\u003eFmwPI{3xjSY7zGy2kAWUJz\u0026/yz*B-Iq9v@k:0DVizlBApUvu40[C3lQDlaA8yAauZ\u0026QCvticayPtpzEWy0e{81", "ln": 4013, "col": 16, "line": 120 }, { "b": "x(\u003eFmwPI{3xjSY7zGy2kAWScUXy2(OZTfZwYu#O:X6R\u003eoVE2\u00265Z0KpoWk]A-AcDhhwft\u00261B8#LzA+3)WgA[mParR^HarR^HA+funA=8jbarR!BB-X-?ayPF5x(\u003eFaB9RUkx(tRCz^NQ1A+eV\u0026c%}1qzEl)\u0026x!gxhb5?:zwN(#oaAg+fBApUvu0O(^arR^HvrVc]Bry", "ln": 4954, "col": 12, "line": 146 }, { "b": "U*yejGvbL5WA#PhdgdguarU9pvqf*awn\u003cexByxiiuVo}1y?W^1c$mapdgcy?wmYu}zddc@c[dg:arR^HvrlZiv}/\u003clA=(mFA=(nbvScupdjCPh3tB8{uTEXVzdN6Yau.\u003egb41X]vqfQ^uM}JrarR^Hzddc@c[b", "ln": 5580, "col": 22, "line": 164 } ], "depth": 1, "facts": { "imp": [ [ "", "config.get" ], [ "", "config.get" ], [ "", "Bot" ], [ "", "Dispatcher" ], [ "", "config.get" ], [ "", "str" ], [ "", "x.strip" ], [ "", "allowed.split" ], [ "", "subprocess.run" ], [ "", "proc.stdout.strip" ], [ "", "proc.stderr.strip" ], [ "", "dp.message" ], [ "", "Command" ], [ "", "_allowed" ], [ "", "message.answer" ], [ "", "dp.message" ], [ "", "Command" ], [ "", "cmd_start" ], [ "", "dp.message" ], [ "", "Command" ], [ "", "_allowed" ], [ "", "message.text.split" ], [ "", "len" ], [ "", "message.answer" ], [ "", "message.answer" ], [ "", "asyncio.to_thread" ], [ "", "message.answer" ], [ "", "dp.message" ], [ "", "Command" ], [ "", "_allowed" ], [ "", "message.text.split" ], [ "", "len" ], [ "", "message.answer" ], [ "", "message.answer" ], [ "", "asyncio.to_thread" ], [ "", "message.answer" ], [ "", "dp.message" ], [ "", "Command" ], [ "", "_allowed" ], [ "", "message.text.split" ], [ "", "len" ], [ "", "message.answer" ], [ "", "message.answer" ], [ "", "asyncio.to_thread" ], [ "", "message.answer" ], [ "", "dp.message" ], [ "", "Command" ], [ "", "_allowed" ], [ "", "message.text.split" ], [ "", "len" ], [ "", "message.answer" ], [ "", "message.answer" ], [ "", "asyncio.to_thread" ], [ "", "message.answer" ], [ "", "dp.message" ], [ "", "Command" ], [ "", "_allowed" ], [ "", "message.text.split" ], [ "", "len" ], [ "", "message.answer" ], [ "", "message.answer" ], [ "", "asyncio.to_thread" ], [ "", "message.answer" ], [ "", "dp.message" ], [ "", "Command" ], [ "", "_allowed" ], [ "", "message.text.split" ], [ "", "len" ], [ "", "message.answer" ], [ "", "message.answer" ], [ "", "asyncio.to_thread" ], [ "", "message.answer" ], [ "", "dp.message" ], [ "", "Command" ], [ "", "_allowed" ], [ "", "message.text.split" ], [ "", "len" ], [ "", "message.answer" ], [ "", "asyncio.to_thread" ], [ "", "message.answer" ], [ "", "dp.message" ], [ "", "Command" ], [ "", "_allowed" ], [ "", "asyncio.to_thread" ], [ "", "message.answer" ], [ "", "print" ], [ "", "print" ], [ "", "dp.start_polling" ], [ "", "asyncio.run" ], [ "", "run_bot" ], [ "", "main" ], [ "", "Bot" ], [ "", "Command" ], [ "", "Dispatcher" ], [ "", "aiogram" ], [ "", "aiogram.filters" ], [ "", "asyncio" ], [ "", "config" ], [ "", "milenium.modules" ], [ "", "os" ], [ "", "subprocess" ], [ "", "sys" ], [ "", "types" ] ], "mbr": [ "allowed.split", "asyncio.run", "asyncio.to_thread", "config.get", "dp.message", "dp.start_polling", "message.answer", "message.from_user", "message.from_user.id", "message.text", "message.text.split", "proc.stderr", "proc.stderr.strip", "proc.stdout", "proc.stdout.strip", "subprocess.TimeoutExpired", "subprocess.run", "sys.executable", "types.Message", "x.strip" ], "tgt": [ "Bot", "Command", "Dispatcher", "_allowed", "allowed.split", "asyncio.run", "asyncio.to_thread", "cmd_start", "config.get", "dp.message", "dp.start_polling", "len", "main", "message.answer", "message.text.split", "print", "proc.stderr.strip", "proc.stdout.strip", "run_bot", "str", "subprocess.run", "x.strip" ], "funcs": [ [ "_allowed", 440 ], [ "_run_cli", 634 ], [ "cmd_start", 1182 ], [ "cmd_help", 1832 ], [ "cmd_ip", 1934 ], [ "cmd_user", 2403 ], [ "cmd_email", 2874 ], [ "cmd_dom", 3363 ], [ "cmd_url", 3831 ], [ "cmd_tg", 4314 ], [ "cmd_pwned", 4774 ], [ "cmd_db", 5199 ], [ "run_bot", 5437 ], [ "main", 5628 ] ], "metrics": { "ast": { "op.add": 1, "op.lor": 2, "max_depth": 12, "call_count": 91, "node_count": 2016, "member_count": 20, "max_array_len": 3, "op_density.add": 0, "op_density.lor": 0, "max_concat_chain": 2, "member_depth_max": 3 }, "file": { "size": 5706, "entropy": 5.24 }, "text": { "lines": 173, "top_char": 101, "max_ws_run": 2, "digit_ratio": 0.02, "space_count": 932, "char_entropy": 5.24, "unique_chars": 118, "top_char_null": 0, "string_density": 0.43, "top_char_ratio": 0.06, "avg_line_length": 31.99, "max_line_length": 109, "non_ascii_ratio": 0.09, "empty_line_ratio": 0.18, "last_line_length": 10, "whitespace_ratio": 0.19, "identifier_density": 1.98, "line_length_stddev": 23.93, "normalized_string_count": 5.7, "repeated_char_sequences": 2, "suspicious_string_ratio": 0.11, "suspicious_identifier_ratio": 0.03, "normalized_unique_identifiers": 9.15 }, "binds": { "count": 22 }, "binary": { "peak_region_bytes": 5706, "peak_region_entropy": 5.38 }, "source": { "function_count": 14 }, "imports": { "count": 12, "stdlib_count": 5, "stdlib_ratio": 0.42, "third_party_count": 7, "third_party_ratio": 0.58 }, "strings": { "bytes": 1346, "count": 75, "shell": 8, "avg_length": 17.95, "max_length": 67, "path_count": 9, "avg_entropy": 3.02, "email_count": 1, "empty_count": 1, "entropy_stddev": 1.08 }, "comments": { "chars": 47, "count": 1, "lines": 1, "to_code_ratio": 0.01 }, "functions": { "count": 14, "density": 8.09, "avg_params": 0.86, "code_ratio": 0.68, "max_params": 1, "length_stddev": 3.83, "avg_name_length": 7.29, "no_params_count": 2, "avg_length_lines": 8.43, "max_length_lines": 16, "min_length_lines": 2, "avg_param_name_length": 6.75 }, "identifiers": { "count": 343, "unique": 68, "avg_length": 6.4, "max_length": 14, "min_length": 1, "avg_entropy": 2.31, "reuse_ratio": 0.2, "length_stddev": 2.95, "sequential_names": 2, "single_char_count": 2, "single_char_ratio": 0.03, "high_entropy_count": 1, "high_entropy_ratio": 0.01, "all_lowercase_ratio": 0.88, "all_uppercase_ratio": 0.03, "double_underscore_count": 1, "underscore_prefix_count": 3 } } }, "id": 45, "mol": "O₂(EuCa)H₃(CmCrPo₅)Md(Pt)", "path": "/data/samples/incoming/forager/python/pythonhosted.org/pypi.org/milenium/milenium-1.1.1-py3-none-any.whl!!milenium/modules/tg_bot.py", "pid": 0, "risk": 45, "sha": "6b4b6f7b272d46ba1e03292bee59313884ccabb16dea7e9ad076531f3847247b", "size": 5706, "traits": [ { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "spans": [ [ 603, 0 ] ] }, { "id": "micro-behaviors/communications/http/authorization-header::auth-like-constant-assignment", "atk": "T1071.001", "mbc": "C0002", "conf": 0.8, "crit": 3, "desc": "Auth-like constant assignment", "spans": [ [ 170, 11 ] ] }, { "id": "micro-behaviors/crypto/certificate/transparency::crt-sh-endpoint", "conf": 0.92, "crit": 3, "desc": "crt.sh certificate lookup endpoint", "spans": [ [ 1563, 6 ] ] }, { "id": "micro-behaviors/process/create/launch::sys-executable-module-launch", "atk": "T1059.003", "mbc": "E1059.003", "conf": 0.9, "crit": 3, "desc": "Launches Python module with interpreter", "spans": [ [ 794, 20 ] ] }, { "id": "micro-behaviors/process/create/shell/spawn::subprocess-timeout-expired-text", "conf": 0.88, "crit": 3, "desc": "Subprocess TimeoutExpired reference", "spans": [ [ 1029, 14 ] ] }, { "id": "micro-behaviors/process/create/subprocess::python-subprocess-io-fields--stderr", "atk": "T1059.006", "conf": 0.84, "crit": 3, "desc": "Process output/status field names (stderr)", "spans": [ [ 948, 6 ] ] }, { "id": "micro-behaviors/process/create/subprocess::python-subprocess-io-fields--stdout", "atk": "T1059.006", "conf": 0.84, "crit": 3, "desc": "Process output/status field names (stdout)", "spans": [ [ 730, 6 ] ] }, { "id": "micro-behaviors/process/create/subprocess::subprocess-run-sys-executable", "atk": "T1059.006", "mbc": "C0017", "conf": 0.92, "crit": 3, "desc": "subprocess.run relaunches Python interpreter", "spans": [ [ 765, 44 ] ] }, { "id": "micro-behaviors/process/info/current::python-sys-executable-text", "conf": 0.75, "crit": 3, "desc": "Python sys.executable reference text", "spans": [ [ 794, 14 ] ] }, { "id": "objectives/credential-access/dump/system::routeros-api-user-print", "atk": "T1003", "conf": 0.92, "crit": 3, "desc": "RouterOS API user print", "spans": [ [ 1433, 7 ], [ 2628, 7 ] ] }, { "id": "objectives/exfiltration/messaging/telegram::python-hardcoded-bot-token", "atk": "T1567", "conf": 0.95, "crit": 4, "desc": "Hardcoded Telegram bot token literal", "spans": [ [ 209, 48 ] ] }, { "id": "well-known/lib/stdlib/python-stdlib::asyncio-reference", "conf": 0.5, "crit": 3, "desc": "Python asyncio library reference", "spans": [ [ 17, 7 ] ] }, { "id": "metadata/lang/natural::script-cyrillic", "conf": 0.8, "crit": 3, "desc": "Contains multiple standalone Cyrillic words", "spans": [ [ 322, 10 ], [ 333, 14 ], [ 349, 10 ], [ 362, 6 ], [ 674, 18 ], [ 709, 20 ], [ 1065, 14 ], [ 1131, 12 ] ] }, { "id": "micro-behaviors/process/create/subprocess::import-subprocess", "atk": "T1059.006", "mbc": "E1059.006", "conf": 0.95, "crit": 3, "desc": "Imports Python's subprocess module", "spans": [ [ 32, 10 ] ] }, { "id": "micro-behaviors/process/create/subprocess::run-ast", "atk": "T1059.006", "mbc": "C0017", "conf": 0.85, "crit": 3, "desc": "Calls subprocess.run to launch a process", "spans": [ [ 765, 14 ] ] }, { "id": "micro-behaviors/process/lifecycle/auto-exec::asyncio-run-call", "conf": 0.85, "crit": 3, "desc": "Python asyncio.run call", "spans": [ [ 5644, 11 ] ] }, { "id": "micro-behaviors/process/create/subprocess::process-execution", "atk": "T1059.006", "conf": 0.8, "crit": 3, "desc": "Python launches a child process", "uses": [ 14 ], "spans": [ [ 750, 30 ], [ 765, 14 ] ] } ], "type": "python" }, { "id": 46, "mol": "H(Cm₃)", "sha": "5d771e47cd70cbb1296b4fef92bc9639075785f324d6c601ff52ce9862448457", "path": "/data/samples/incoming/forager/python/pythonhosted.org/pypi.org/milenium/milenium-1.1.1-py3-none-any.whl!!milenium/modules/tg_parser.py", "risk": 1, "size": 781, "type": "python", "depth": 1 }, { "id": 47, "mol": "H(Cm₄)Md₂(Pt)", "sha": "2f90a27f62361d00ad309d89004f686e69b7629865eb6d464c976a241e58a414", "path": "/data/samples/incoming/forager/python/pythonhosted.org/pypi.org/milenium/milenium-1.1.1-py3-none-any.whl!!milenium/modules/twitter_osint.py", "risk": 3, "size": 560, "type": "python", "depth": 1 }, { "id": 48, "mol": "O(S)H₃(Cm₇DbOs₃)Md(Pt)", "sha": "5353e87574fd5e26fff9790d688daea6b346ecfa0af7cccadcbd8b3b05d050a8", "path": "/data/samples/incoming/forager/python/pythonhosted.org/pypi.org/milenium/milenium-1.1.1-py3-none-any.whl!!milenium/modules/urlscan_search.py", "risk": 5, "size": 1003, "type": "python", "depth": 1 }, { "id": 49, "mol": "O(C)H(Cm₆)Md(Pt)", "sha": "ee45bf510e9a05ae04a2760d69fee8645dcc5ffd8f2e94d39b01d8275b5ab593", "path": "/data/samples/incoming/forager/python/pythonhosted.org/pypi.org/milenium/milenium-1.1.1-py3-none-any.whl!!milenium/modules/username.py", "risk": 3, "size": 1592, "type": "python", "depth": 1 }, { "id": 50, "mol": "K(Te)H(Cm₅)Md(Pt)", "sha": "8e4e110109e6ddab679cb25f5d36b3b531c1acd3c4cb80c85d50e6abb6656bfb", "path": "/data/samples/incoming/forager/python/pythonhosted.org/pypi.org/milenium/milenium-1.1.1-py3-none-any.whl!!milenium/modules/virustotal_search.py", "risk": 3, "size": 1971, "type": "python", "depth": 1 }, { "ctx": [ { "b": "x(d*cA=-BAwPq\u003c7B98Eg3s)ZWay/7@v@0GnB7Gx0x\u003ee+qBz\u003e@azAPf/dlm!UarR^Ja%H5Xave*}iV#!.^sY/O^6.llaKL+!WB6JKVE3beFZz9TI{P0S^sP-V^7mPi^7I4O^2(X.^6\u003edAZ0KglV^uAe^6z3a^sxPS^uh?daKE\u003cIH%SVUVcZ8fGdXt(a{]CnarUxgaz#ataARKqwO%KoarR^HarR^HA+funA=91Db4U!nz/N3.ar\u003eYwaxzbTBz\u003e@azx:GoarR^HBAhT/3lQDlarR^HaAwO/aAz4kB.bSoB1R9pBsmFsarR^HarR^HarR^JxMOunB2\u003e%cvq]{kC55Zuz/4dAwPRQ7wg@7DwPz\u0026AxjVfeed9HxarR^HarR^HarUSiA:-*aj:NIUarR^HarR^HarR^HarR^JB-RbmuUK4(b03\u0026?B7Gx0x\u003ee+4arR^HarR^HarR^HarR^Hb4+L2y?dPhiV]RUz!%ldCv+/ouT[1%zGEBtz/]@tA^oiCx([RKAa\u003cfiz^Nu\u0026CR0rmvru68ed9HxarR^HarR^HarR^HarR\u003epv}f7\u003eB6\u003c3cyH}xciV@J.yH}xm3lQDlarR^HarR^HarR^Har\u003e$MiV]R7e?]vDa$K6zarR^HarR^HarR!Ped9HxarR^HarR^HarU=uzdNTdBuIuoed9HxarR^HarS9uarR^HarR^HwmoN*auZ\u0026/e]2DCzyu}varR^HarR^Hx\u003ewFiA+frhz/fSca%pPqay[]5vla-rarR^HarR^HarR!EwPS6nzxJE#Byww$A+frhz/fScb3!zbt).X%arR^HarUYoBAIRwaBtqzA=M8sb03\u0026Svrt{gxjVfkb4U!nz/N3MaBwI=e[X:qc)AkyA=k#9zf6tldszKCarR!rCW\u003er7BrB1%v}xR3x(v(ivriM5iTM#LarR^HarUYoBAIRwaBtqzA=M8sb03\u0026/BAe^vdsz", "ln": 0, "col": 1, "line": 1 } ], "depth": 1, "facts": { "imp": [ [ "", "requests.get" ], [ "", "r.json" ], [ "", "data.get.get" ], [ "", "data.get" ], [ "", "str" ], [ "", "requests" ] ], "mbr": [ "data.get", "data.get.get", "data.response", "r.json", "requests.get" ], "tgt": [ "data.get", "data.get.get", "r.json", "requests.get", "str" ], "funcs": [ [ "check", 17 ] ], "metrics": { "ast": { "max_depth": 13, "call_count": 5, "node_count": 220, "member_count": 5, "member_depth_max": 3 }, "file": { "size": 762, "entropy": 4.51 }, "text": { "lines": 23, "top_char": 101, "max_ws_run": 1, "digit_ratio": 0.02, "space_count": 233, "char_entropy": 4.51, "unique_chars": 70, "top_char_null": 0, "string_density": 0.74, "top_char_ratio": 0.06, "avg_line_length": 32.17, "max_line_length": 102, "non_ascii_ratio": 0.1, "empty_line_ratio": 0.04, "last_line_length": 32, "whitespace_ratio": 0.33, "identifier_density": 1.04, "line_length_stddev": 22.31, "normalized_string_count": 3.54, "repeated_char_sequences": 9, "suspicious_identifier_ratio": 0.15, "normalized_unique_identifiers": 2.87 }, "binds": { "count": 2 }, "binary": { "peak_region_bytes": 762, "peak_region_entropy": 4.51 }, "source": { "function_count": 1 }, "imports": { "count": 1, "third_party_count": 1, "third_party_ratio": 1 }, "strings": { "bytes": 263, "count": 17, "url_count": 1, "avg_length": 15.47, "max_length": 96, "avg_entropy": 2.41, "empty_count": 1, "entropy_stddev": 1.1 }, "functions": { "count": 1, "density": 4.35, "avg_params": 2, "code_ratio": 0.91, "max_params": 2, "avg_name_length": 5, "avg_length_lines": 21, "max_length_lines": 21, "min_length_lines": 21, "avg_param_name_length": 6 }, "identifiers": { "count": 24, "unique": 13, "avg_length": 4.85, "max_length": 9, "min_length": 1, "avg_entropy": 1.86, "reuse_ratio": 0.54, "length_stddev": 2.41, "sequential_names": 2, "single_char_count": 2, "single_char_ratio": 0.15, "all_lowercase_ratio": 0.92 } } }, "id": 51, "mol": "H(Cm₆)Md₂(In₂Pt)", "path": "/data/samples/incoming/forager/python/pythonhosted.org/pypi.org/milenium/milenium-1.1.1-py3-none-any.whl!!milenium/modules/vk_osint.py", "pid": 0, "risk": 4, "sha": "254041dc9a73e1d534187673ebb4f9cc40b5ec2451934efaa3922bee931a9938", "size": 762, "traits": [ { "id": "metadata/import/python/requests::requests", "conf": 0.95, "crit": 3, "desc": "imports requests", "spans": [ [ 7, 8 ] ] }, { "id": "micro-behaviors/communications/http/browser-automation::authentication-token-name-literal", "conf": 0.9, "crit": 3, "desc": "Authentication token name literal", "spans": [ [ 443, 12 ] ] }, { "id": "micro-behaviors/communications/http/request/client::requests-get-url-literal", "conf": 0.8, "crit": 3, "desc": "Literal URL passed to requests.get/httpx.get", "spans": [ [ 229, 35 ] ] }, { "id": "micro-behaviors/communications/http/token-auth::access-token-field-source", "conf": 0.92, "crit": 3, "desc": "Access token field in source", "spans": [ [ 442, 15 ] ] }, { "id": "micro-behaviors/communications/http/url/endpoint::user-collection-path-token", "conf": 0.92, "crit": 3, "desc": "user collection URL path segment", "spans": [ [ 281, 6 ] ] }, { "id": "metadata/lang/natural::script-cyrillic", "conf": 0.8, "crit": 3, "desc": "Contains multiple standalone Cyrillic words", "spans": [ [ 62, 10 ], [ 73, 18 ], [ 92, 10 ], [ 104, 6 ], [ 111, 8 ], [ 120, 12 ], [ 133, 12 ] ] }, { "id": "micro-behaviors/communications/http/device-code::token-object-field", "conf": 0.93, "crit": 3, "desc": "OAuth token object member", "spans": [ [ 442, 15 ] ] }, { "id": "micro-behaviors/communications/http/lib/requests::imports-requests", "conf": 0.95, "crit": 3, "desc": "Imports the requests HTTP client for Python", "spans": [ [ 0, 15 ] ] }, { "id": "micro-behaviors/communications/http/lib/requests::requests-get", "conf": 0.85, "crit": 3, "desc": "Calls requests.get in Python", "spans": [ [ 229, 12 ] ] }, { "id": "metadata/import/package::python-network-client-imports", "conf": 0.95, "crit": 3, "desc": "Imports a Python network client library", "uses": [ 0 ], "spans": [ [ 7, 8 ] ] }, { "id": "micro-behaviors/communications/http/request/client::url-literal", "conf": 0.8, "crit": 3, "desc": "Uses a literal URL in an HTTP request", "uses": [ 2 ], "spans": [ [ 229, 35 ] ] }, { "id": "micro-behaviors/communications/http/request/client::request-python", "conf": 0.9, "crit": 3, "desc": "Sends an HTTP request with a Python client library", "uses": [ 8, 10 ], "spans": [ [ 229, 35 ] ] } ], "type": "python" }, { "id": 52, "mol": "H(Cm₄)", "sha": "4cf53d5f48def1eb4ecec5862b5bfd6141beaa6422a534cb205f6b6fb643d431", "path": "/data/samples/incoming/forager/python/pythonhosted.org/pypi.org/milenium/milenium-1.1.1-py3-none-any.whl!!milenium/modules/wayback.py", "risk": 1, "size": 587, "type": "python", "depth": 1 }, { "id": 53, "mol": "H(Cm₄)Md(Pt)", "sha": "db9b9d363ac1f483ecb848df81c09a71a238ba84673c4c457dbf98287792a0a7", "path": "/data/samples/incoming/forager/python/pythonhosted.org/pypi.org/milenium/milenium-1.1.1-py3-none-any.whl!!milenium/modules/wifi_geolocation.py", "risk": 3, "size": 951, "type": "python", "depth": 1 }, { "id": 54, "mol": "O(S)Md(Pa₂)", "sha": "fae8ff5c1ceeac0af98c1aed39d53ddc53ed736a5c843b86f267ddb78de49a43", "path": "/data/samples/incoming/forager/python/pythonhosted.org/pypi.org/milenium/milenium-1.1.1-py3-none-any.whl!!milenium-1.1.1.dist-info/METADATA", "risk": 3, "size": 563, "type": "pkg_info", "depth": 1 }, { "id": 55, "mol": "Md(Pa)", "sha": "400c9ee718ad6b13e8dbe80485f020abb9f00505119a57b5e3e4701befb016a3", "path": "/data/samples/incoming/forager/python/pythonhosted.org/pypi.org/milenium/milenium-1.1.1-py3-none-any.whl!!milenium-1.1.1.dist-info/entry_points.txt", "risk": 1, "size": 47, "type": "text", "depth": 1 }, { "id": 57, "mol": "Md(Re)", "sha": "36ab9f14db3798f33aa8a4e32296b7ddeea95c82576ad974a80acec782c10d98", "path": "milenium@1.1.1.registry.json", "risk": 1, "size": 778, "type": "registry", "depth": 1 } ], "omitted_files": 42, "rev": "e86a6", "v": "8" } }