{ "llm": { "conf": 0.39988497, "grade": "benign", "model": "Qwen/Qwen3.6-27B", "outcome": "benign", "interpretation": "Legitimate browser extension UI code" }, "ml": { "v": "7", "eng": "2.3.1-beta.0", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.1426928, "rte": "az", "prob": 0.1426928 } ], "prob": 0.1426928, "skip": [ { "rte": "az/zip", "why": "unavailable" }, { "rte": "az/zip", "why": "unavailable" } ], "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.14269280433654785, "type": "crx" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.00006663799285888672, "type": "png" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.00012001395225524902, "type": "svg" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.00006663799285888672, "type": "png" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.00006663799285888672, "type": "png" }, { "id": 5, "lvl": -1, "conf": 0, "prob": 0.00006663799285888672, "type": "png" }, { "id": 6, "lvl": -1, "conf": 0, "prob": 0.00006663799285888672, "type": "png" }, { "id": 7, "lvl": -1, "conf": 0, "prob": 0.00006663799285888672, "type": "png" }, { "id": 8, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "svg" }, { "id": 9, "lvl": -1, "conf": 0, "prob": 0.000049501657485961914, "type": "json" }, { "id": 10, "lvl": -1, "conf": 0, "prob": 0.02455398440361023, "type": "javascript" }, { "id": 11, "lvl": -1, "conf": 0, "prob": 0.0030144155025482178, "type": "text" }, { "id": 12, "lvl": -1, "conf": 0, "prob": 0.00006663799285888672, "type": "json" }, { "id": 13, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "registry" } ], "version": "v18.18", "analyzed_at": "2026-07-13T00:24:54Z" }, "path": "lghhlcfdlbbnclnlhpdboobafcadncfp.crx", "raw": { "files": [ { "id": 0, "ctx": [ { "b": "lVK}s0@@r39T8Jz608iyRueD60u%ib1{(=lnqu\u003cF0rAi800v/N4/!qn0sw)W0rAgY}[Dw{w0x9W)G7nlRKB=ZmS-L:ig@2OhqN+wyyYd[ccJQY(IAu!Uo0^k0@", "n": [ { "c": 2, "d": "Chrome Web Store extension archive", "i": "metadata/permission/manifest::chrome-webstore-extension", "o": 0, "z": 1, "cf": 0.949999988079071 } ], "ln": 0 } ], "mol": "H₂(FU)", "sha": "087c0826d17c08a76f900195091ccdd7dfd93765cd58c89ab0872cee2c7b1f8a", "path": "lghhlcfdlbbnclnlhpdboobafcadncfp.crx", "risk": 2, "size": 348028, "type": "crx", "facts": { "metrics": { "file": { "size": 348028.0, "entropy": 8.0, "size_bytes": 348028.0 }, "binary": { "overall_entropy": 8.0, "peak_region_bytes": 347136.0, "peak_region_entropy": 7.85 }, "archive": { "file_count": 15.0, "member_count": 18.0, "prefix_bytes": 1322.0, "script_count": 1.0, "zip_bomb_ratio": 6.11, "directory_count": 3.0, "executable_count": 0.0, "extra_field_size": 0.0, "noise_file_count": 0.0, "total_compressed": 344418.0, "compression.ratio": 0.86, "hidden_file_count": 0.0, "total_uncompressed": 402797.0, "crc_collision_count": 0.0, "entry_comment_count": 0.0, "max_filename_length": 32.0, "rtlo_filename_count": 0.0, "format.regular_count": 15.0, "nested_archive_count": 0.0, "path_traversal_count": 0.0, "symlink_escape_count": 0.0, "security.setgid_count": 0.0, "security.setuid_count": 0.0, "security.sticky_count": 0.0, "double_extension_count": 0.0, "duplicate_member_count": 0.0, "format.directory_count": 3.0, "security.symlink_count": 0.0, "unicode_filename_count": 0.0, "homoglyph_filename_count": 0.0, "security.encrypted_count": 0.0, "timing.mtime_unique_count": 10.0, "timing.mtime_unique_ratio": 0.56, "misplaced_executable_count": 0.0, "timing.mtime_dominant_count": 5.0, "timing.mtime_spread_seconds": 1384914.0, "timing.sentinel_mtime_count": 0.0, "security.world_writable_count": 0.0, "timing.mtime_dominant_fraction": 0.28, "compression.method_counts.deflate": 18.0 } } }, "ident": { "trust": "self_signed", "identifier": { "value": "lfoeajgcchlidpicbabpmckkejpckcfb", "source": "crx.extension_id", "verified": true }, "unique_ids": { "crx_id": "lfoeajgcchlidpicbabpmckkejpckcfb", "public_key_sha256": "b5e4096227b83f82101fc2aa49f2a251accde3d98471464dd17d1819b43786b0" } }, "traits": [ { "id": "micro-behaviors/fs/path/sensitive/credentials::secret-token-file-path", "atk": "T1552.001", "conf": 0.75, "crit": 3, "desc": "Secret or token file path reference", "from": [ { "file": 10 } ] }, { "id": "micro-behaviors/time/schedule/interval::setTimeout", "crit": 2, "desc": "setTimeout timer usage", "from": [ { "file": 10 } ] }, { "id": "micro-behaviors/time/schedule/interval::setInterval", "crit": 2, "desc": "setInterval timer usage", "from": [ { "file": 10 } ] }, { "id": "objectives/anti-static/obfuscation/code-metrics/structure::source-svg-element", "atk": "T1027", "mbc": "B0032", "conf": 1.0, "crit": 1, "desc": "Source contains SVG element", "from": [ { "file": 10 } ] }, { "id": "micro-behaviors/ui/window/manage/dom::browser-node-remove", "conf": 0.800000011920929, "crit": 3, "desc": "Removes child DOM node", "from": [ { "file": 10 } ] }, { "id": "objectives/anti-static/obfuscation/code-metrics/structure::source-svg-path-data", "atk": "T1027", "mbc": "B0032", "conf": 1.0, "crit": 1, "desc": "Source contains SVG path data", "from": [ { "file": 10 } ] }, { "id": "objectives/credential-access/wallet/keywords::wallet-token", "conf": 0.4000000059604645, "crit": 1, "desc": "Wallet keyword", "from": [ { "file": 10 } ] }, { "id": "micro-behaviors/ui/window/manage/dom::dom-element-lookup", "conf": 0.8999999761581421, "crit": 2, "desc": "getElementById/querySelector DOM lookup", "from": [ { "off": 652, "file": 10 } ] }, { "id": "objectives/anti-static/obfuscation/code-metrics/structure::source-svg-namespace", "atk": "T1027", "mbc": "B0032", "conf": 1.0, "crit": 1, "desc": "Source contains SVG namespace", "from": [ { "file": 10 } ] }, { "id": "micro-behaviors/ui/window/manage/dom::dom-element-lookup--getelementbyid", "conf": 0.8999999761581421, "crit": 2, "desc": "getElementById/querySelector (getElementById)", "from": [ { "file": 10 } ] }, { "id": "micro-behaviors/ui/window/manage/dom::browser-innerhtml-assignment", "conf": 0.800000011920929, "crit": 3, "desc": "Assigns DOM innerHTML", "from": [ { "file": 10 } ] }, { "id": "micro-behaviors/ui/window/manage/dom::dom-element-value-read", "conf": 0.8999999761581421, "crit": 2, "desc": "Reads .value property of a DOM element", "from": [ { "file": 10 } ] }, { "id": "micro-behaviors/ui/window/manage/dom::dom-element-lookup--queryselector", "conf": 0.8999999761581421, "crit": 2, "desc": "getElementById/querySelector DOM (querySelector)", "from": [ { "file": 10 } ] }, { "id": "metadata/signed/platform::web-extension-manifest", "conf": 1.0, "crit": 1, "desc": "Web-extension manifest.json at archive root" }, { "id": "metadata/permission/manifest::chrome-webstore-verified-contents", "conf": 0.949999988079071, "crit": 1, "desc": "Chrome Web Store metadata file present" } ] }, { "ctx": [ { "b": "Ibl@q4gj0X0000dnK#lE000c3000c32Ngne0g0XlrSAa10DRdelik=YepNT1010Qns-TMy3LJHu3LJKvNW+h{1w(A@l{T^%OB25tKq)}xc?@fI?t", "n": [ { "c": 1, "d": "Filename ends with .png", "i": "metadata/package/files/included::png-extension-basename", "o": 0, "z": 10, "cf": 0.8999999761581421 } ], "ln": 0 } ], "depth": 1, "facts": { "metrics": { "png": { "a_entropy": 1.25, "chunk_count": 5.0, "trailing_bytes": 0.0, "idat_chunk_count": 1.0, "text_chunk_bytes": 0.0, "chunks_after_iend": 0.0, "compression_ratio": 0.07, "unknown_chunk_count": 0.0 }, "file": { "size": 282894.0, "entropy": 7.97, "size_bytes": 282894.0 }, "image": { "width": 1023.0, "height": 1023.0, "channels": 4.0, "b_entropy": 2.1, "g_entropy": 2.1, "r_entropy": 2.15, "edge_density": 0.01, "pixel_entropy": 2.44, "histogram_flatness": 0.31 }, "binary": { "overall_entropy": 7.97, "peak_region_bytes": 278528.0, "peak_region_entropy": 7.84 } } }, "id": 1, "path": "lghhlcfdlbbnclnlhpdboobafcadncfp.crx!!images/cortyx.png", "pid": 0, "sha": "ddf4288a731ecece55966c4719979c80a46d04fa43f361c9491f3d430f6ec554", "size": 282894, "traits": [ { "id": "metadata/image/metrics::low-edge-density", "conf": 0.6499999761581421, "crit": 1, "desc": "Low image edge density metric", "spans": [ [ 0, 25 ] ] }, { "id": "metadata/package/files/included::png-extension-basename", "conf": 0.8999999761581421, "crit": 1, "desc": "Filename ends with .png", "spans": [ [ 0, 10 ] ] } ], "type": "png" }, { "id": 2, "sha": "28719d2921c6121f79a9553272e571148b1ade1ca7d868efdf4acb5b72e54a5e", "path": "lghhlcfdlbbnclnlhpdboobafcadncfp.crx!!images/logo.svg", "size": 5064, "type": "svg", "depth": 1 }, { "id": 3, "sha": "96245d179c1045664ee84d644fd327146bf9f38fc3d93eb98e8665e8b08b7200", "path": "lghhlcfdlbbnclnlhpdboobafcadncfp.crx!!images/logo_128.png", "size": 9327, "type": "png", "depth": 1 }, { "id": 4, "sha": "4268fc835e27524d7199fd92cfd6b61b67d03a35242a3580b7a67c1d2ff7935c", "path": "lghhlcfdlbbnclnlhpdboobafcadncfp.crx!!images/logo_16.png", "size": 1329, "type": "png", "depth": 1 }, { "id": 5, "sha": "325f697b033dc20deb27386f74fbe093ada9251625bbc65aa256591973abd3ff", "path": "lghhlcfdlbbnclnlhpdboobafcadncfp.crx!!images/logo_24.png", "size": 2609, "type": "png", "depth": 1 }, { "id": 6, "sha": "cd5e4e5e6efef153f54b82139a42de469a43e9d0935b767a1e809f840d27b01a", "path": "lghhlcfdlbbnclnlhpdboobafcadncfp.crx!!images/logo_32.png", "size": 3575, "type": "png", "depth": 1 }, { "id": 7, "sha": "4fef1876d353106298f3267dc491ec0b628a62a83f7b07be139754770f2acf5f", "path": "lghhlcfdlbbnclnlhpdboobafcadncfp.crx!!images/logo_48.png", "size": 5475, "type": "png", "depth": 1 }, { "id": 8, "sha": "624a8c2f569b0a0ef3eac87bb778e16f860501557a8fa9147e72aebcfdb2fbc1", "path": "lghhlcfdlbbnclnlhpdboobafcadncfp.crx!!index.html", "size": 21830, "type": "svg", "depth": 1 }, { "ctx": [ { "b": "DJ", "n": [ { "c": 2, "d": "JSON data format", "i": "metadata/file/format::valid", "o": 0, "z": 13, "cf": 0.6000000238418579 } ], "ln": 1, "addr": 0 }, { "b": "b6v\u003cnvru6/B-IpxiV]RWBAzFyiXJc@y?WD#BAoh\u0026xk.Z3y?kkez/4dGwPz%dv}vroAaAy0wIL]GA^e=V", "ln": 2, "addr": 3 }, { "b": "", "ln": 3, "addr": 69 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 771.0, "entropy": 5.02, "size_bytes": 771.0 }, "json": { "parsed_bytes": 771.0, "parse_limit_bytes": 76800.0 }, "binary": { "overall_entropy": 5.02, "peak_region_bytes": 771.0, "peak_region_entropy": 5.02 } } }, "id": 9, "path": "lghhlcfdlbbnclnlhpdboobafcadncfp.crx!!manifest.json", "pid": 0, "risk": 1, "sha": "08743a58a9aa271031dbe94fc90f70357bee5ce67c1ff3ddba2c16d2fb46968a", "size": 771, "traits": [ { "id": "metadata/file/format::valid", "conf": 0.6000000238418579, "crit": 2, "desc": "JSON data format", "spans": [ [ 0, 13 ] ] }, { "id": "metadata/file/extension/identity::web-asset-extension", "conf": 1.0, "crit": 1, "desc": "Web asset file extension (css/html/js/json)", "spans": [ [ 0, 13 ] ] } ], "type": "json" }, { "ctx": [ { "b": "y?mYhB97\u0026jwJ+xSvqZi@y!nI-B-YU*a$NejBzk]frafk%b6dm5zxZSMv{%mKA=kPhwPI]NfF3{Vq!6lNzFs03iW3jeB7/GoqE%](", "n": [ { "c": 3, "d": "Development toolchain indicators", "i": "metadata/build/toolchain::development-toolchain-indicators", "o": 0, "z": 4, "cf": 1.0 } ], "ln": 0 }, { "b": "\u0026^^[pc)AXyB9hqvB1I3Bx\u003eezpene:sBz(hBraflLwKprCC@/FOv%8T1zGEHzwPQvSwO(0@Bv7mAwgeTnx(!xmA^olUvpB4:eN\u0026TeC{jW*Bz(nfy/s?LzGv\u003cHz!0{bwO#PxxjVfNy?mD{zGFi\u003cnN%j[Bz(oXFtJ", "n": [ { "c": 2, "d": "HISTORY documentation reference", "i": "metadata/package/documentation::references-changelog-history", "o": 1167, "z": 7, "cf": 1.0 }, { "c": 2, "d": "getElementById/querySelector (getElementById)", "i": "micro-behaviors/ui/window/manage/dom::dom-element-lookup--getelementbyid", "o": 652, "z": 14, "cf": 0.8999999761581421 }, { "c": 2, "d": "getElementById/querySelector DOM (querySelector)", "i": "micro-behaviors/ui/window/manage/dom::dom-element-lookup--queryselector", "o": 703, "z": 13, "cf": 0.8999999761581421 }, { "c": 1, "d": "Credential field keyword", "i": "micro-behaviors/data/parse/vocabulary::credential-field", "o": 504, "z": 6, "cf": 0.8399999737739563 }, { "c": 1, "d": "Hidden-directory path string literal", "i": "micro-behaviors/fs/path/location::hidden-dir-literal", "o": 570, "z": 11, "cf": 0.8399999737739563 }, { "c": 1, "d": "notification or alert vocabulary word", "i": "micro-behaviors/ui/window/notify/keywords::notification-alert-word", "o": 456, "z": 13, "cf": 0.8999999761581421 }, { "c": 1, "d": "\"search\" verb inside a string literal", "i": "objectives/evasion/security-bypass/llm/keywords::search-word", "o": 770, "z": 6, "cf": 0.4000000059604645 } ], "ln": 376 }, { "b": "\u0026^^[ExM4Y$a$k6KAa}%RC@/FOv%8T1zGEHzwPQvSwO(0@Bv7mAwgeTgAa{[twQbEGElh4-zEW^5z/cXgwO#71vru6UvqYQ]zb+B?wO%[AByuNDDT*#iB95KojXYvbxF9[kz/oUAf!+pho\u003c@cSe]\u003exrwn=tAFtJ", "n": [ { "c": 3, "d": "JS build-config-injector compat noise markers", "i": "objectives/supply-chain/trojanized/app/config-injection::js-build-config-compatibility-marker", "o": 1518, "z": 23, "cf": 1.0 }, { "c": 2, "d": "Math.random invocation", "i": "micro-behaviors/os/random/prng/stdlib::math-random-call", "o": 1567, "z": 11, "cf": 1.0 } ], "ln": 1438 }, { "b": "\u0026^^[AAWST@dOTt[xFaslzE^W5c[cPJi=mbsfH6wTo\u003c@cSe[O{rz/NlXh7zseBz9pEvqYQ]z73?Zt@(!ao\u003c@cSe[O{rz/Nm2vrufnA:-\u0026@z/3)KdR{.NwO#d5xENjrDTQC}A+frki+o\u003c-v@Dy0i=lG.B4yleFtJ", "n": [ { "c": 2, "d": "Math.random used for indexing", "i": "micro-behaviors/os/random/prng/stdlib::math-random-index", "o": 2915, "z": 24, "cf": 1.0 }, { "c": 1, "d": "JavaScript length property", "i": "metadata/lang/scripted::length-prop", "o": 2943, "z": 6, "cf": 1.0 }, { "c": 1, "d": "password/token/api_key field keyword", "i": "objectives/credential-access/theft/keywords::credential-field", "o": 2782, "z": 10, "cf": 0.8399999737739563 } ], "ln": 2702 }, { "b": "\u0026^^[wwO$mKzdL+GeokDCyFnq.wO:zGemSQmz/OiYvrlGJz.bvglVl^VAZKUKB8%xJeotrfzBv]PwJzkSwP]m+vru6fe{829z!0i(wM9X\u003ex(mMib4UTzm)XyJDWfghAYLyZB.$Ygx\u003e5trzeTrlxGvs)eO5OPFtJ", "n": [ { "c": 2, "d": "JavaScript Date object construction", "i": "micro-behaviors/time/query::js-new-date", "o": 3121, "z": 8, "cf": 0.30000001192092896 } ], "ln": 3041 }, { "b": "\u0026^^)IEp^Rtv@#B6zxJO6BwlW:B.\u003eRXv@DlkwHR$ECwheexEEBvDT*G9wG\u003e/azE[9jz/^f:A+funA=9l!B9qgsCX}nmB3gZXBAzE.fe4J[Cp[7}e]L=yfetjnfFvG\u003cxcFExx\u003ehs0jT8Tra%pMgx\u003eIa3jT8VvFtJ", "n": [ { "c": 3, "d": "Recognized embedded large-string marker", "i": "objectives/command-and-control/dropper/execution/script-dropper::large-string-recognized-marker", "o": 3588, "z": 4, "cf": 1.0 }, { "c": 1, "d": "DOM or CSS size property (height)", "i": "micro-behaviors/ui/window/manage/dom::size-prop--height", "o": 3639, "z": 6, "cf": 1.0 }, { "c": 1, "d": "DOM or CSS size property (width)", "i": "micro-behaviors/ui/window/manage/dom::size-prop--width", "o": 3628, "z": 5, "cf": 1.0 }, { "c": 1, "d": "Source contains SVG namespace", "i": "objectives/anti-static/obfuscation/code-metrics/structure::source-svg-namespace", "o": 3600, "z": 26, "cf": 1.0 }, { "c": 1, "d": "Source contains SVG path data", "i": "objectives/anti-static/obfuscation/code-metrics/structure::source-svg-path-data", "o": 3795, "z": 7, "cf": 1.0 } ], "ln": 3508 }, { "b": "\u0026^^[tjT8T9aAITBz!\u0026]oy?W=#v{%stb64QAzE:}lB98CvyH]8lx(mG%z!T8Lb64QAzE:}lv@bN{B3gZ\u003evqG:\u003eBs?ipz/c:.jAa.JxDQ?Gb26^Lau9sTvke(Vats](attx4eIP^Nvkn@Xats](ats](at^=\u003eFtJ", "n": [ { "c": 1, "d": "Cryptocurrency library indicators", "i": "objectives/supply-chain/trojanized/library/framework::crypto-library-indicators", "o": 5826, "z": 6, "cf": 1.0 } ], "ln": 5746 }, { "b": "\u0026^^[3vqPNdBz\u003c\u0026\u003eCv+!Zvrl0ddlz97wIdOey\u0026\u003clec[5T\u0026k4Mu*z!\u0026{4pgn0Je{829z*b=klT+4Ec[c=.zEWH9wmY*gBszP+wIe7yyH}xHwmPZ(B8@%Qz+L7[wPydDB7D:Ge[]iky\u0026%o1B0#bVdjGWVw*!\u003e.FtJ", "n": [ { "c": 2, "d": "JavaScript substring search call", "i": "micro-behaviors/data/string/search::js-includes-indexof-call", "o": 7493, "z": 9, "cf": 0.8199999928474426 }, { "c": 1, "d": "3+ Date.now()/new Date() calls", "i": "micro-behaviors/time/query::js-triple-date", "o": 7604, "z": 9, "cf": 0.4000000059604645 } ], "ln": 7413 }, { "b": "\u0026^^[DeN\u0026\u003cABz(4vdlzlQc)rdJA+funA=9%Gz/fSraAP+VwPQjFBzk]fmRMWXwPz\u0026Vz/]@tc[cY+j.ll=B.bPsq!o=Rv@#Tfc)yoQx(4)5AXg:ewm]D$dlzlQc#HvUzz2%vzeTPec[cY?j$[Bjv@DmaBrCFXFtJ", "n": [ { "c": 3, "d": "Removes child DOM node", "i": "micro-behaviors/ui/window/manage/dom::browser-node-remove", "o": 8388, "z": 47, "cf": 0.800000011920929 }, { "c": 1, "d": "flex lexer-generator tool name", "i": "metadata/build/toolchain::flex-word", "o": 8587, "z": 4, "cf": 1.0 }, { "c": 1, "d": "Appends child DOM node", "i": "micro-behaviors/ui/window/manage/dom::browser-append-child", "o": 8676, "z": 13, "cf": 0.800000011920929 }, { "c": 1, "d": "JavaScript calls document.createElement", "i": "objectives/command-and-control/dropper/execution/browser::dom-createelement-symbol", "o": 8449, "z": 22, "cf": 0.800000011920929 }, { "c": 1, "d": "DOM script content sink", "i": "objectives/command-and-control/dropper/execution/browser::dom-script-content-sink", "o": 8632, "z": 13, "cf": 0.8500000238418579 }, { "c": 1, "d": "style.position assignment marker", "i": "objectives/credential-access/phishing/tactics::full-window-iframe-shell--rx-2", "o": 8649, "z": 14, "cf": 0.8999999761581421 } ], "ln": 8308 }, { "b": "\u0026^^[Fj.eFvB.$YcBs}6zwNPW(mqMKLwO#Prb4Lzha$kP}e[nZaB8$8+zdL\u003cOw[=76wPxwwvqYT)a$N**x(m*1A.6e7oG==*zxH5AauTgGB%7phvrlGMb4+U5CPZZxwO(Guv}xL1wPw]dB-RUsw{C$qwPSdQFtJ", "n": [ { "c": 3, "d": "Assigns DOM innerHTML", "i": "micro-behaviors/ui/window/manage/dom::browser-innerhtml-assignment", "o": 9123, "z": 11, "cf": 0.800000011920929 }, { "c": 1, "d": ".token string", "i": "objectives/supply-chain/trojanized/library/framework::dot-token", "o": 9135, "z": 128, "cf": 1.0 }, { "c": 1, "d": "Needle panel descriptor word", "i": "well-known/malware/stealer/needle::panel-word", "o": 9003, "z": 5, "cf": 0.4000000059604645 } ], "ln": 8923 }, { "b": "\u0026^^)*wncifv@bN{B3gZVy?m\u0026lxjk:hg9ypMwO(Guv}xL1wPw$UtY7VbarR^HarS^XzG6-uaAR)FwJ.kPB.$P0AV#Soy*?yajTa@Sz/Pzvze0(gCp+KcayX$nto+\u003c*f*NM-t}X8\u0026ayYnfwmY^7vSco$wPxxZFtJ", "n": [ { "c": 1, "d": "String literal contains number word", "i": "metadata/file/format::vocab-number", "o": 10553, "z": 6, "cf": 0.9700000286102295 } ], "ln": 10473 }, { "b": "\u0026^^[uz/d:zzxH5AarR^?flpYvwN/*CtY7VbarS^1wnciJtY9!:arR^HtZe5maUtn*rbVL-zxIX.zdK?*wNPQ?xDO(UtZe5otY7VbarS^Sx)7Rey*?yajTa-LeI!OmtY7VbarR^HjzXCnwO-G0y*?yajTb1cFtJ", "n": [ { "c": 1, "d": "\"search\" verb inside a string literal", "i": "objectives/evasion/security-bypass/llm/keywords::search-word", "o": 11613, "z": 6, "cf": 0.4000000059604645 } ], "ln": 11533 }, { "b": "\u0026^^[ywN]H$z6iX8eIOwSy\u0026r*0b0Fz6By=N)vqYZ?jtgIVvR6vttY7VbarR^HjAC7IwN/*8v@bN{B3gZTvru6jw[=76wPw]qeOocwy-)h1eN6COk}$UXmo}M8fD:?yA+5:4ayYnfwmY^kvR6a5xk.P%feUDyFtJ", "n": [ { "c": 1, "d": "String literal contains date word", "i": "metadata/file/format::vocab-date", "o": 12160, "z": 4, "cf": 0.9700000286102295 } ], "ln": 12080 }, { "b": "\u0026^^[CB.bPsq!o=Rv@#Tfc)yoOvru6jw[=76wPw$ze{pVtB.9ZSByxo5e[O*lBy/Gle[wyjwL#@OxjSSnwPQ)=zdNTdBsnK=dlP\u003ewwn+$2zdNQbe[5p3mrSlWBwcy\u0026By/u3AWSbGz/{bjwn=Wfa$N^^aUUw8FtJ", "n": [ { "c": 2, "d": "setTimeout timer usage", "i": "micro-behaviors/time/schedule/interval::setTimeout", "o": 13587, "z": 10, "cf": 0.5 }, { "c": 2, "d": "Reads .value property of a DOM element", "i": "micro-behaviors/ui/window/manage/dom::dom-element-value-read", "o": 13428, "z": 6, "cf": 0.8999999761581421 }, { "c": 1, "d": "Click analytics event token", "i": "micro-behaviors/communications/http/services/analytics::click-event-token", "o": 13705, "z": 5, "cf": 0.8600000143051147 } ], "ln": 13348 }, { "b": "\u0026^^[FwIdOey\u0026\u003cleB1R0iBy!uUzF9JzwIe7kA+w%9e{pVtB.9axc[fM[dj/M[ADL\u0026kC#Fo\u003cwN/?2AWSa:Bz\u003e@azy]{vvrb\u003c\u003ea$kcMwmObLwO#P-x(!xczE)\u0026pb57}lB-X/Uc$LL9DVKpqBy^7px(4)5A=S\u003e)FtJ", "n": [ { "c": 3, "d": "Secret or token file path reference", "i": "micro-behaviors/fs/path/sensitive/credentials::secret-token-file-path", "o": 14452, "z": 6, "cf": 0.75 } ], "ln": 14372 }, { "b": "\u0026^^[7wPJ0gBAn\u0026VDT*#iB95Koj-+ZNBy^7mB-IIlzGF=/B9hqvB30@HwO(0@BAo6PwPJ0gBAo@)x\u003ee\u0026gzF\u003c3ank@qSjT87iv@DmaBrCV*tyg6{iWelQzE[9jz/^fOBzk\u0026kwJz2az/fciAbP?xeoUDrB.9R[FtJ", "n": [ { "c": 1, "d": "innerHTML/location.href rewrite", "i": "objectives/supply-chain/hidden-payload/extensions/session::extension-page-block", "o": 15939, "z": 12, "cf": 0.8999999761581421 }, { "c": 1, "d": "id field in object literal", "i": "objectives/supply-chain/recon-exfil/oast/secret::node-payload-id-field", "o": 15962, "z": 3, "cf": 0.30000001192092896 } ], "ln": 15859 }, { "b": "\u0026^^[Azyx6Gx\u003eeVvtY7VbarR^HjzlMnbZT8PBzk\u0026kwQMV]xF.[TzxH5AarR^LDU1*tB-RUyz9@bFB8%MNjy\u0026eHj%UF^e{pVtB.b$-fjX^uk43AVjACEIzxJC9vrlGMa%.IDe[n*oz/OiYvrlHraAz4mB.(fVFtJ", "n": [ { "c": 1, "d": "ES6 template literal syntax", "i": "metadata/lang/javascript-features::template-literal", "o": 17234, "z": 8, "cf": 0.8999999761581421 } ], "ln": 17154 }, { "b": "\u0026^^[uC0oeGarR^HcP+*RzGx[xBuKhKwO(0@BAo6Fx(!xmA^pR)vR/Qxz!abCAa9=#zGFr-wO(0@BusN%x(n06A=:SVw]zZ3c$K@Ke[O*rB96=.x(4reem*CNB.bPsq!o=Rv@#Tfc)yoQx(4)5AXg:yBAzDXFtJ", "n": [ { "c": 1, "d": "Inserts DOM node before reference node", "i": "micro-behaviors/ui/window/manage/dom::browser-insert-before", "o": 18849, "z": 14, "cf": 0.800000011920929 } ], "ln": 18769 }, { "b": "\u0026^^[Ix(4PqvqY^@vru68iWelKB98tvC}A-LwO\u0026M6x(!xmA^olUvpB4:ePL=Na$N^/x(m*1A.6e7oG==*zxH5AarR^?wncifv@bN{B3gZ?z!\u0026{4eOP9mzZ4wIzxH5AarR^HauTZ*xcqCoy\u0026jqSb4#7uA5]ViFtJ", "n": [ { "c": 1, "d": ".token string", "i": "objectives/supply-chain/trojanized/library/framework::dot-token", "o": 20251, "z": 128, "cf": 1.0 } ], "ln": 20171 }, { "b": "\u0026^^[px)8WBzxH5AarR^HarR^?wncifv@bN{B3gZ?z!\u0026{4eN-g2A+frkb0Eo0wIe7yyH}xHwmPZ(B8@%Py?Wx\u003cc[)hedsA*3e*L^Pe{82EwO%!Awo8m5B1RJIx\u003e7Z5eI[]8jtgkVC0oeGarR^HarR^Hjtgm8FtJ", "n": [ { "c": 2, "d": "Substring call", "i": "micro-behaviors/data/encode/xor::js-substring", "o": 20845, "z": 6, "cf": 1.0 } ], "ln": 20765 }, { "b": "\u0026^^[qzdNQbB1RALx\u003e7ZNxMvW9xM4Y$cmgcLy?mD{zGG}LAb]V5wMit-wPIK6y?bewvqH6$j-+ZNBy^7CwPS3dzFa2yAb]V5wMit-wPIK6y?a$CwO+{{wO#Qhe[5Zkoj-w}cmACwwO(0@BAo6yAa}%RC}Kp1FtJ", "n": [ { "c": 1, "d": "Settings secret keyword", "i": "objectives/supply-chain/credential-theft/registry::settings-secret-keyword-cluster", "o": 22137, "z": 86, "cf": 0.75 } ], "ln": 22057 }, { "b": "\u0026^^)McuBoqA=+2:zGPx7l2HaED2)Xvc[fNRB-7Yhx(v(ixKL^?y?lN:xj(3(luNx(z/d{Ux\u003e7{bwHR$oz/fSraAP+Te[o3AA+fcgraf/WwPPLnvrt}0wPPLCwPS3dzF84Mcmi[Ox\u003eetuaW4#fByxo5e]$Q-FtJ", "n": [ { "c": 1, "d": "Array element swap pattern", "i": "objectives/anti-static/obfuscation/string/encoding::js-array-swap", "o": 23046, "z": 90, "cf": 0.550000011920929 } ], "ln": 22966 }, { "b": "\u0026^^[7wPJ0gBAoO*f!vx/vru6kB7/Gmy?b?Hx(dp2wK{JRBz(hBjS#KhB-p(1By!Dzc[dk/z/fSraAP+/wPQHYBy/GovqEtuc[dqyDVKpqBy^7Cv{%mKA=kPhwPI]yjU!Yvo\u003c@cSe]\u003exrwn=rkdjWbbeot{)FtJ", "n": [ { "c": 2, "d": "setInterval timer usage", "i": "micro-behaviors/time/schedule/interval::setInterval", "o": 23507, "z": 11, "cf": 0.5 } ], "ln": 23427 }, { "b": "\u0026^^)SB97\u0026jwId.uB97t\u003cvqY%]wiz7\u0026j7AhDB95Kxj.4]pv%8P@By^*Tze-][Bw=*]yBA:yj9bHLBy^7mB-IIlzGF=/B9hqvB3jz5v@DmaBrCS/DVTgwwO%!Awo8m5B2)\u003e-A+PPgq!6-^wJBYYB7ocewH}]ZFtJ", "n": [ { "c": 1, "d": "Plain JavaScript identifier assignment", "i": "metadata/lang/scripted::plain-js-identifier-assignment", "o": 23807, "z": 17, "cf": 1.0 } ], "ln": 23727 } ], "depth": 1, "facts": { "imp": [ [ "", "state" ], [ "", "elements" ], [ "", "document.querySelectorAll" ], [ "", "document.querySelectorAll" ], [ "", "document.getElementById" ], [ "", "document.querySelector" ], [ "", "document.querySelector" ], [ "", "document.querySelector" ], [ "", "document.querySelector" ], [ "", "document.getElementById" ], [ "", "document.querySelector" ], [ "", "document.querySelector" ], [ "", "document.getElementById" ], [ "", "document.getElementById" ], [ "", "document.getElementById" ], [ "", "document.getElementById" ], [ "", "document.getElementById" ], [ "", "document.querySelectorAll" ], [ "", "document.getElementById" ], [ "", "document.getElementById" ], [ "", "Math.floor" ], [ "", "Math.random" ], [ "", "Math.floor" ], [ "", "Math.random" ], [ "", "Math.random" ], [ "", "Math.random" ], [ "", "Math.random" ], [ "", "Math.random" ], [ "", "Math.random" ], [ "", "Math.random" ], [ "", "Math.random" ], [ "", "Math.floor" ], [ "", "Math.random" ], [ "", "generateRandomTokenData" ], [ "", "Math.max" ], [ "", "Math.min" ], [ "", "Math.floor" ], [ "", "Math.random" ], [ "", "Math.floor" ], [ "", "Math.random" ], [ "", "Math.floor" ], [ "", "Math.random" ], [ "", "e.filter" ], [ "", "e.filter" ], [ "", "e.filter" ], [ "", "state.filters.tokenName.trim" ], [ "", "state.filters.tokenName.toLowerCase" ], [ "", "e.filter" ], [ "", "e.tokenName.toLowerCase.includes" ], [ "", "e.tokenName.toLowerCase" ], [ "", "e.tokenAddress.toLowerCase.includes" ], [ "", "e.tokenAddress.toLowerCase" ], [ "", "t.getFullYear" ], [ "", "t.getMonth" ], [ "", "t.getDate" ], [ "", "e.filter" ], [ "", "e.scanDate.replace" ], [ "", "n.getTime" ], [ "", "n.getTime" ], [ "", "state.filteredHistory" ], [ "", "renderHistory" ], [ "", "updateFilterBadge" ], [ "", "state.filters.tokenName.trim" ], [ "", "document.querySelector" ], [ "", "getActiveFiltersCount" ], [ "", "e.querySelector" ], [ "", "n.remove" ], [ "", "document.createElement" ], [ "", "n.className" ], [ "", "n.textContent" ], [ "", "e.style.position" ], [ "", "e.appendChild" ], [ "", "state.filters" ], [ "", "state.filteredHistory" ], [ "", "renderHistory" ], [ "", "updateFilterBadge" ], [ "", "renderFilterPanel" ], [ "", "document.querySelector" ], [ "", "e.remove" ], [ "", "document.createElement" ], [ "", "t.className" ], [ "", "t.innerHTML" ], [ "", "document.querySelector" ], [ "", "document.querySelector" ], [ "", "t.contains" ], [ "", "n.contains" ], [ "", "state.filters.isOpen" ], [ "", "t.remove" ], [ "", "document.removeEventListener" ], [ "", "e.filter" ], [ "", "t.querySelector.textContent" ], [ "", "t.querySelector" ], [ "", "n.style.position" ], [ "", "n.appendChild" ], [ "", "t.querySelector.value" ], [ "", "t.querySelector" ], [ "", "t.querySelector.value" ], [ "", "t.querySelector" ], [ "", "t.querySelector.value" ], [ "", "t.querySelector" ], [ "", "setTimeout" ], [ "", "document.addEventListener" ], [ "", "t.querySelector.addEventListener" ], [ "", "t.querySelector" ], [ "", "state.filters.isOpen" ], [ "", "t.remove" ], [ "", "document.removeEventListener" ], [ "", "t.querySelector.addEventListener" ], [ "", "t.querySelector" ], [ "", "resetFilters" ], [ "", "document.removeEventListener" ], [ "", "t.querySelector.addEventListener" ], [ "", "t.querySelector" ], [ "", "applyFilters" ], [ "", "state.filters.isOpen" ], [ "", "t.remove" ], [ "", "document.removeEventListener" ], [ "", "t.querySelector.addEventListener" ], [ "", "t.querySelector" ], [ "", "state.filters.riskLevel" ], [ "", "t.querySelector.addEventListener" ], [ "", "t.querySelector" ], [ "", "state.filters.volumeRange" ], [ "", "t.querySelector.addEventListener" ], [ "", "t.querySelector" ], [ "", "state.filters.dateRange" ], [ "", "t.querySelector.addEventListener" ], [ "", "t.querySelector" ], [ "", "state.filters.tokenName" ], [ "", "t.querySelector.addEventListener" ], [ "", "t.querySelector" ], [ "", "state.filters.scoreRange.min" ], [ "", "parseInt" ], [ "", "t.querySelector.addEventListener" ], [ "", "t.querySelector" ], [ "", "state.filters.scoreRange.max" ], [ "", "parseInt" ], [ "", "elements.tokenInput.value" ], [ "", "elements.clearButton.classList.remove" ], [ "", "elements.searchIcon.classList.add" ], [ "", "elements.clearButton.classList.add" ], [ "", "elements.searchIcon.classList.remove" ], [ "", "elements.progressBarContainer.classList.remove" ], [ "", "elements.progressBar.style.width" ], [ "", "elements.progressBarContainer.classList.add" ], [ "", "elements.scanButton.classList.add" ], [ "", "elements.buttonContent.classList.add" ], [ "", "elements.scanningContent.classList.remove" ], [ "", "elements.scanningContent.classList.add" ], [ "", "elements.buttonContent.classList.remove" ], [ "", "state.manualInput.trim" ], [ "", "elements.scanButton.classList.remove" ], [ "", "elements.scanButton.classList.add" ], [ "", "elements.resultsGrid.classList.remove" ], [ "", "renderResults" ], [ "", "elements.resultsGrid.classList.add" ], [ "", "renderHistory" ], [ "", "updateHistoryStats" ], [ "", "updateSettingsUI" ], [ "", "elements.resultsGrid.innerHTML" ], [ "", "e.riskLevel.replace" ], [ "", "formatVolume" ], [ "", "t.forEach" ], [ "", "document.createElement" ], [ "", "s.className" ], [ "", "s.innerHTML" ], [ "", "getModuleIcon" ], [ "", "getModuleIcon" ], [ "", "elements.resultsGrid.appendChild" ], [ "", "setTimeout" ], [ "", "s.classList.remove" ], [ "", "s.classList.add" ], [ "", "state.justScanned" ], [ "", "state.shouldAnimateResults" ], [ "", "document.querySelector" ], [ "", "document.createElement" ], [ "", "e.className" ], [ "", "e.innerHTML" ], [ "", "t.insertBefore" ], [ "", "e.querySelector.addEventListener" ], [ "", "e.querySelector" ], [ "", "state.filters.isOpen" ], [ "", "renderFilterPanel" ], [ "", "getActiveFiltersCount" ], [ "", "document.querySelector" ], [ "", "getActiveFiltersCount" ], [ "", "t.textContent" ], [ "", "t.textContent" ], [ "", "elements.historyTableBody.innerHTML" ], [ "", "getActiveFiltersCount" ], [ "", "getActiveFiltersCount" ], [ "", "elements.historyTableBody.innerHTML" ], [ "", "e.forEach" ], [ "", "document.createElement" ], [ "", "s.className" ], [ "", "s.innerHTML" ], [ "", "e.tokenAddress.slice" ], [ "", "e.tokenAddress.slice" ], [ "", "getVolumeColor" ], [ "", "formatVolume" ], [ "", "elements.historyTableBody.appendChild" ], [ "", "setTimeout" ], [ "", "s.classList.remove" ], [ "", "s.classList.add" ], [ "", "state.shouldAnimateHistory" ], [ "", "getActiveFiltersCount" ], [ "", "elements.totalScans.textContent" ], [ "", "elements.highRiskCount.textContent" ], [ "", "e.filter" ], [ "", "elements.lowRiskCount.textContent" ], [ "", "e.filter" ], [ "", "elements.toggleButtons.forEach" ], [ "", "e.classList.toggle" ], [ "", "elements.priceThreshold.value" ], [ "", "elements.apiKey.value" ], [ "", "state.activeTab" ], [ "", "state.shouldAnimateResults" ], [ "", "state.shouldAnimateHistory" ], [ "", "elements.tabButtons.forEach" ], [ "", "e.classList.toggle" ], [ "", "elements.tabPanes.forEach" ], [ "", "e.classList.toggle" ], [ "", "updateUI" ], [ "", "state.manualInput" ], [ "", "updateUI" ], [ "", "state.manualInput" ], [ "", "state.showResults" ], [ "", "updateUI" ], [ "", "state.manualInput.trim" ], [ "", "startManualAnalysis" ], [ "", "state.settings.t" ], [ "", "updateUI" ], [ "", "state.settings.priceThreshold" ], [ "", "state.settings.apiKey" ], [ "", "state.isScanning" ], [ "", "state.scanProgress" ], [ "", "state.showResults" ], [ "", "state.justScanned" ], [ "", "state.shouldAnimateResults" ], [ "", "state.shouldAnimateHistory" ], [ "", "updateUI" ], [ "", "setInterval" ], [ "", "Math.random" ], [ "", "state.scanProgress" ], [ "", "clearInterval" ], [ "", "updateUI" ], [ "", "setTimeout" ], [ "", "clearInterval" ], [ "", "state.scanProgress" ], [ "", "state.isScanning" ], [ "", "state.showResults" ], [ "", "state.justScanned" ], [ "", "calculateCompactRisk" ], [ "", "state.currentResults" ], [ "", "state.scanHistory" ], [ "", "state.scanHistory.slice" ], [ "", "applyFilters" ], [ "", "updateUI" ], [ "", "state.manualInput.trim" ], [ "", "startScanning" ], [ "", "state.manualInput.trim" ], [ "", "state.filteredHistory" ], [ "", "elements.tabButtons.forEach" ], [ "", "e.addEventListener" ], [ "", "elements.tokenInput.addEventListener" ], [ "", "elements.clearButton.addEventListener" ], [ "", "elements.scanButton.addEventListener" ], [ "", "elements.toggleButtons.forEach" ], [ "", "e.addEventListener" ], [ "", "elements.priceThreshold.addEventListener" ], [ "", "elements.apiKey.addEventListener" ], [ "", "document.querySelector" ], [ "", "e.addEventListener" ], [ "", "state.filters.isOpen" ], [ "", "renderFilterPanel" ], [ "", "updateUI" ], [ "", "document.addEventListener" ] ], "mbr": [ "Math.floor", "Math.max", "Math.min", "Math.random", "document.addEventListener", "document.createElement", "document.getElementById", "document.querySelector", "document.querySelectorAll", "document.removeEventListener", "e.addEventListener", "e.appendChild", "e.bgColorClass", "e.buyRatio", "e.classList", "e.classList.toggle", "e.className", "e.colorClass", "e.currentTarget", "e.currentTarget.dataset", "e.currentTarget.dataset.setting", "e.currentTarget.dataset.tab", "e.customClass", "e.dataset", "e.dataset.setting", "e.dataset.tab", "e.filter", "e.filter().length", "e.forEach", "e.id", "e.innerHTML", "e.isHoneypot", "e.length", "e.lpLocked", "e.mintAuthority", "e.ownerControl", "e.querySelector", "e.querySelector().addEventListener", "e.remove", "e.riskLevel", "e.riskLevel.replace", "e.riskScore", "e.scanDate", "e.scanDate.replace", "e.score", "e.sellRatio", "e.style", "e.style.position", "e.target", "e.target.value", "e.title", "e.tokenAddress", "e.tokenAddress.slice", "e.tokenAddress.toLowerCase", "e.tokenAddress.toLowerCase().includes", "e.tokenName", "e.tokenName.toLowerCase", "e.tokenName.toLowerCase().includes", "e.topWalletShare", "e.value", "e.volume", "elements.apiKey", "elements.apiKey.addEventListener", "elements.apiKey.value", "elements.buttonContent", "elements.buttonContent.classList", "elements.buttonContent.classList.add", "elements.buttonContent.classList.remove", "elements.clearButton", "elements.clearButton.addEventListener", "elements.clearButton.classList", "elements.clearButton.classList.add", "elements.clearButton.classList.remove", "elements.highRiskCount", "elements.highRiskCount.textContent", "elements.historyTableBody", "elements.historyTableBody.appendChild", "elements.historyTableBody.innerHTML", "elements.historyTableBody.parentElement", "elements.lowRiskCount", "elements.lowRiskCount.textContent", "elements.priceThreshold", "elements.priceThreshold.addEventListener", "elements.priceThreshold.value", "elements.progressBar", "elements.progressBar.style", "elements.progressBar.style.width", "elements.progressBarContainer", "elements.progressBarContainer.classList", "elements.progressBarContainer.classList.add", "elements.progressBarContainer.classList.remove", "elements.resultsGrid", "elements.resultsGrid.appendChild", "elements.resultsGrid.classList", "elements.resultsGrid.classList.add", "elements.resultsGrid.classList.remove", "elements.resultsGrid.innerHTML", "elements.scanButton", "elements.scanButton.addEventListener", "elements.scanButton.classList", "elements.scanButton.classList.add", "elements.scanButton.classList.remove", "elements.scanningContent", "elements.scanningContent.classList", "elements.scanningContent.classList.add", "elements.scanningContent.classList.remove", "elements.searchIcon", "elements.searchIcon.classList", "elements.searchIcon.classList.add", "elements.searchIcon.classList.remove", "elements.tabButtons", "elements.tabButtons.forEach", "elements.tabPanes", "elements.tabPanes.forEach", "elements.toggleButtons", "elements.toggleButtons.forEach", "elements.tokenInput", "elements.tokenInput.addEventListener", "elements.tokenInput.value", "elements.totalScans", "elements.totalScans.textContent", "l.length", "n.appendChild", "n.bgColorClass", "n.className", "n.colorClass", "n.contains", "n.getTime", "n.remove", "n.riskLevel", "n.scanDate", "n.score", "n.style", "n.style.position", "n.textContent", "n.tokenName", "n.volume", "s.classList", "s.classList.add", "s.classList.remove", "s.className", "s.innerHTML", "state.activeTab", "state.currentResults", "state.filteredHistory", "state.filteredHistory.length", "state.filters", "state.filters.dateRange", "state.filters.isOpen", "state.filters.riskLevel", "state.filters.scoreRange", "state.filters.scoreRange.max", "state.filters.scoreRange.min", "state.filters.tokenName", "state.filters.tokenName.toLowerCase", "state.filters.tokenName.trim", "state.filters.volumeRange", "state.isScanning", "state.justScanned", "state.manualInput", "state.manualInput.trim", "state.scanHistory", "state.scanHistory.length", "state.scanHistory.slice", "state.scanProgress", "state.settings", "state.settings.apiKey", "state.settings.priceThreshold", "state.shouldAnimateHistory", "state.shouldAnimateResults", "state.showResults", "t.buyRatio", "t.className", "t.contains", "t.firstChild", "t.forEach", "t.getDate", "t.getFullYear", "t.getMonth", "t.innerHTML", "t.insertBefore", "t.isHoneypot", "t.lpLocked", "t.mintAuthority", "t.ownerControl", "t.querySelector", "t.querySelector().addEventListener", "t.querySelector().textContent", "t.querySelector().value", "t.remove", "t.sellRatio", "t.textContent", "t.topWalletShare", "t.volume" ], "tgt": [ "Date", "Math.floor", "Math.max", "Math.min", "Math.random", "applyFilters", "calculateCompactRisk", "clearInterval", "document.addEventListener", "document.createElement", "document.getElementById", "document.querySelector", "document.querySelectorAll", "document.removeEventListener", "e.addEventListener", "e.appendChild", "e.classList.toggle", "e.filter", "e.forEach", "e.querySelector", "e.querySelector().addEventListener", "e.remove", "e.riskLevel.replace", "e.scanDate.replace", "e.tokenAddress.slice", "e.tokenAddress.toLowerCase", "e.tokenAddress.toLowerCase().includes", "e.tokenName.toLowerCase", "e.tokenName.toLowerCase().includes", "elements.apiKey.addEventListener", "elements.buttonContent.classList.add", "elements.buttonContent.classList.remove", "elements.clearButton.addEventListener", "elements.clearButton.classList.add", "elements.clearButton.classList.remove", "elements.historyTableBody.appendChild", "elements.priceThreshold.addEventListener", "elements.progressBarContainer.classList.add", "elements.progressBarContainer.classList.remove", "elements.resultsGrid.appendChild", "elements.resultsGrid.classList.add", "elements.resultsGrid.classList.remove", "elements.scanButton.addEventListener", "elements.scanButton.classList.add", "elements.scanButton.classList.remove", "elements.scanningContent.classList.add", "elements.scanningContent.classList.remove", "elements.searchIcon.classList.add", "elements.searchIcon.classList.remove", "elements.tabButtons.forEach", "elements.tabPanes.forEach", "elements.toggleButtons.forEach", "elements.tokenInput.addEventListener", "formatVolume", "generateRandomTokenData", "getActiveFiltersCount", "getModuleIcon", "getVolumeColor", "n.appendChild", "n.contains", "n.getTime", "n.remove", "o", "parseInt", "renderFilterPanel", "renderHistory", "renderResults", "resetFilters", "s.classList.add", "s.classList.remove", "setInterval", "setTimeout", "startManualAnalysis", "startScanning", "state.filters.tokenName.toLowerCase", "state.filters.tokenName.trim", "state.manualInput.trim", "state.scanHistory.slice", "t.contains", "t.forEach", "t.getDate", "t.getFullYear", "t.getMonth", "t.insertBefore", "t.querySelector", "t.querySelector().addEventListener", "t.remove", "updateFilterBadge", "updateHistoryStats", "updateSettingsUI", "updateUI" ], "metrics": { "ast": { "op.eq": 20.0, "op.ge": 14.0, "op.gt": 20.0, "op.le": 5.0, "op.lt": 14.0, "op.ne": 14.0, "op.add": 18.0, "op.div": 2.0, "op.lor": 12.0, "op.mul": 12.0, "op.sub": 6.0, "op.land": 56.0, "op.lnot": 51.0, "max_depth": 23.0, "bind_count": 133.0, "call_count": 223.0, "node_count": 7634.0, "member_count": 194.0, "op_density.eq": 0.0, "op_density.ge": 0.0, "op_density.gt": 0.0, "op_density.le": 0.0, "op_density.lt": 0.0, "op_density.ne": 0.0, "op_density.add": 0.0, "op_density.div": 0.0, "op_density.lor": 0.0, "op_density.mul": 0.0, "op_density.sub": 0.0, "sequence_count": 54.0, "op_density.land": 0.01, "op_density.lnot": 0.01, "identifier_count": 157.0, "member_depth_max": 4.0, "string_literal_count": 253.0, "array_literal_max_length": 20.0, "string_concat_chain_max_length": 3.0 }, "file": { "size": 25041.0, "entropy": 5.3, "size_bytes": 25041.0 }, "text": { "digit_ratio": 0.07, "space_count": 1651.0, "total_lines": 1.0, "char_entropy": 5.3, "unique_chars": 88.0, "escape_density": 0.05, "lines_over_200": 1.0, "lines_over_500": 1.0, "string_density": 253.0, "avg_line_length": 25041.0, "lines_over_1000": 1.0, "max_line_length": 25041.0, "hex_escape_count": 12.0, "last_line_length": 25041.0, "long_token_count": 33.0, "whitespace_ratio": 0.07, "most_common_ratio": 0.09, "identifier_density": 1390.0, "encoded_string_ratio": 0.0, "normalized_string_count": 253.0, "repeated_char_sequences": 20.0, "suspicious_string_ratio": 0.01, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 15.0, "most_common_char_codepoint": 101.0, "suspicious_identifier_ratio": 0.05 }, "binds": { "count": 133.0 }, "calls": { "count": 223.0 }, "binary": { "overall_entropy": 5.3, "peak_region_bytes": 19456.0, "peak_region_entropy": 5.37 }, "source": { "function_count": 27.0 }, "members": { "count": 194.0 }, "strings": { "total": 253.0, "avg_length": 47.57, "max_length": 3612.0, "avg_entropy": 2.81, "empty_count": 8.0, "sql_strings": 1.0, "total_bytes": 12036.0, "entropy_stddev": 0.95, "base64_candidates": 1.0, "very_long_strings": 3.0, "high_entropy_count": 1.0, "shell_command_strings": 1.0, "unicode_heavy_strings": 1.0 }, "functions": { "count": 27.0, "anonymous": 31.0, "avg_params": 0.26, "max_params": 2.0, "one_liners": 58.0, "avg_name_length": 15.3, "no_params_count": 45.0, "avg_length_lines": 1.0, "max_length_lines": 1.0, "min_length_lines": 1.0, "nested_functions": 12.0, "avg_nesting_depth": 0.62, "max_nesting_depth": 2.0, "single_char_names": 2.0, "high_entropy_names": 11.0, "single_char_params": 15.0, "avg_param_name_length": 1.0, "density_per_100_lines": 5800.0, "code_in_functions_ratio": 58.0 }, "identifiers": { "count": 157.0, "total": 1390.0, "avg_length": 10.2, "max_length": 26.0, "min_length": 1.0, "avg_entropy": 2.73, "reuse_ratio": 0.11, "unique_count": 157.0, "length_stddev": 5.17, "sequential_names": 8.0, "single_char_count": 8.0, "single_char_ratio": 0.05, "high_entropy_count": 15.0, "high_entropy_ratio": 0.1, "all_lowercase_ratio": 0.3 } } }, "id": 10, "mol": "H₂(FU)", "path": "lghhlcfdlbbnclnlhpdboobafcadncfp.crx!!script.min.js", "pid": 0, "risk": 2, "sha": "2ac4ac5c1a68c162c267d11c9a0d658c810032953e63ccbbbcb8913cc88a2e60", "size": 25041, "traits": [ { "id": "micro-behaviors/fs/path/sensitive/credentials::secret-token-file-path", "atk": "T1552.001", "conf": 0.75, "crit": 3, "desc": "Secret or token file path reference", "spans": [ [ 14452, 6 ] ] }, { "id": "micro-behaviors/time/schedule/interval::setTimeout", "crit": 2, "desc": "setTimeout timer usage", "spans": [ [ 13587, 10 ] ] }, { "id": "micro-behaviors/ui/window/manage/dom::dom-element-lookup--getelementbyid", "conf": 0.8999999761581421, "crit": 2, "desc": "getElementById/querySelector (getElementById)", "spans": [ [ 0, 14 ], [ 652, 14 ] ] }, { "id": "micro-behaviors/time/schedule/interval::setInterval", "crit": 2, "desc": "setInterval timer usage", "spans": [ [ 23507, 11 ] ] }, { "id": "micro-behaviors/ui/window/manage/dom::dom-element-lookup--queryselector", "conf": 0.8999999761581421, "crit": 2, "desc": "getElementById/querySelector DOM (querySelector)", "spans": [ [ 0, 13 ], [ 703, 13 ] ] }, { "id": "micro-behaviors/ui/window/manage/dom::dom-element-value-read", "conf": 0.8999999761581421, "crit": 2, "desc": "Reads .value property of a DOM element", "spans": [ [ 0, 6 ], [ 13428, 6 ] ] }, { "id": "micro-behaviors/ui/window/manage/dom::browser-innerhtml-assignment", "conf": 0.800000011920929, "crit": 3, "desc": "Assigns DOM innerHTML", "spans": [ [ 0, 11 ], [ 9123, 11 ] ] }, { "id": "objectives/credential-access/wallet/keywords::wallet-token", "conf": 0.4000000059604645, "crit": 1, "desc": "Wallet keyword", "spans": [ [ 0, 6 ], [ 5826, 6 ] ] }, { "id": "objectives/anti-static/obfuscation/code-metrics/structure::source-svg-path-data", "atk": "T1027", "mbc": "B0032", "conf": 1.0, "crit": 1, "desc": "Source contains SVG path data", "spans": [ [ 0, 7 ], [ 3795, 7 ] ] }, { "id": "objectives/anti-static/obfuscation/code-metrics/structure::source-svg-namespace", "atk": "T1027", "mbc": "B0032", "conf": 1.0, "crit": 1, "desc": "Source contains SVG namespace", "spans": [ [ 0, 128 ], [ 3600, 26 ] ] }, { "id": "objectives/anti-static/obfuscation/code-metrics/structure::source-svg-element", "atk": "T1027", "mbc": "B0032", "conf": 1.0, "crit": 1, "desc": "Source contains SVG element", "spans": [ [ 0, 4 ], [ 3588, 4 ] ] }, { "id": "micro-behaviors/ui/window/manage/dom::browser-node-remove", "conf": 0.800000011920929, "crit": 3, "desc": "Removes child DOM node", "spans": [ [ 0, 47 ], [ 8388, 47 ] ] }, { "id": "micro-behaviors/ui/window/manage/dom::dom-element-lookup", "conf": 0.8999999761581421, "crit": 2, "desc": "getElementById/querySelector DOM lookup", "spans": [ [ 0, 13 ], [ 652, 14 ], [ 703, 13 ] ] } ], "type": "javascript" }, { "ctx": [ { "b": "\u0026^^[JiX-ZmC4CYay\u0026sIUxLz0/wO%ONx\u003ehs0iX-rxc4dy/vpy*cvqYU6vqGT\u003czy]NAwO(GHv}xL1wPx\u003eyx(!lfvr\u003c[Kz/fbFw]846eO5NowN/*@z/dQCz!%MkzAzJyx\u003eIa3iX-rxb%cr+woqGCf!+pcEj/T3FtJ", "n": [ { "c": 1, "d": "CSS display none rule", "i": "micro-behaviors/data/format/css::display-none", "o": 2457, "z": 12, "cf": 0.8199999928474426 } ], "ln": 2377 }, { "b": "\u0026^^[Oe]\u003eJtvrujbwQwxmB7]-gz/dQRwO+^%x)a6okX\u003c}Rw].r%wPF#mwPJ0gBvfFSwi\u003efNwNPRafEq6:Aa9l\u003cBA]]3j9kHKzGxAdA=0\u003cUv{%g+c[WIqdiJ.MvqZd5vru6-c]0z{CQX4#fEq6:Aa9l\u003cBA]}bFtJ", "n": [ { "c": 2, "d": "CSS opacity zero rule", "i": "micro-behaviors/data/format/css::opacity-zero", "o": 14941, "z": 9, "cf": 0.7799999713897705 } ], "ln": 14861 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 18601.0, "entropy": 4.96, "size_bytes": 18601.0 }, "binary": { "overall_entropy": 4.96, "peak_region_bytes": 17408.0, "peak_region_entropy": 5.18 } } }, "id": 11, "path": "lghhlcfdlbbnclnlhpdboobafcadncfp.crx!!styles.min.css", "pid": 0, "risk": 1, "sha": "7e78f0f674342aa90d0e70482d79860b62184a828720a796050c421eb4d15931", "size": 18601, "traits": [ { "id": "micro-behaviors/data/format/css::opacity-zero", "conf": 0.7799999713897705, "crit": 2, "desc": "CSS opacity zero rule", "spans": [ [ 14941, 9 ] ] }, { "id": "micro-behaviors/data/format/css::display-none", "conf": 0.8199999928474426, "crit": 1, "desc": "CSS display none rule", "spans": [ [ 2457, 12 ] ] } ], "type": "text" }, { "ctx": [ { "b": "tydM8wPIv4x(Ffdz/c:Wb6m\u003cpwOtH[xDRn9AV!$dy?j!wb6dEhzE)u=v@DmbwO#Pli^S5\u0026vr(WcvpQMyb4V3(ygn}QfJ}KnfJZ8z", "n": [ { "c": 2, "d": "JSON data format", "i": "metadata/file/format::valid", "o": 0, "z": 22, "cf": 0.6000000238418579 } ], "ln": 0 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 2833.0, "entropy": 5.93, "size_bytes": 2833.0 }, "json": { "parsed_bytes": 2833.0, "parse_limit_bytes": 76800.0 }, "binary": { "overall_entropy": 5.93, "peak_region_bytes": 2833.0, "peak_region_entropy": 6.0 } } }, "id": 12, "path": "lghhlcfdlbbnclnlhpdboobafcadncfp.crx!!_metadata/verified_contents.json", "pid": 0, "risk": 1, "sha": "64c10e026d23bc432871ddc9963d3f599afd80c18c283960881c0b1c8f08a046", "size": 2833, "traits": [ { "id": "metadata/file/format::valid", "conf": 0.6000000238418579, "crit": 2, "desc": "JSON data format", "spans": [ [ 0, 22 ] ] }, { "id": "metadata/file/extension/identity::web-asset-extension", "conf": 1.0, "crit": 1, "desc": "Web asset file extension (css/html/js/json)", "spans": [ [ 0, 22 ] ] } ], "type": "json" }, { "id": 13, "sha": "689eddede5f026153df80ea2c9a2ecb768d9daa05a9f2d9ea29fbef970462dd2", "path": "lghhlcfdlbbnclnlhpdboobafcadncfp.registry.json", "size": 898, "type": "registry", "depth": 1 } ], "omitted_files": 8, "v": "8" } }