{ "ml": { "v": "7", "eng": "2.12.0-beta.3", "lvl": 0, "conf": 100, "mods": [ { "cls": 2, "raw": 0.98997355, "rte": "az", "prob": 0.98997355 }, { "cls": 2, "raw": 0.9991503, "rte": "az/crx", "prob": 0.9991503 } ], "prob": 0.9991503, "files": [ { "id": 0, "lvl": 0, "conf": 100, "prob": 0.999150276184082, "type": "crx" }, { "id": 5, "lvl": -1, "conf": 0, "prob": 0.00435878848657012, "type": "javascript" }, { "id": 6, "lvl": -1, "conf": 0, "prob": 0.0025972824078053236, "type": "javascript" }, { "id": 7, "lvl": -1, "conf": 0, "prob": 0.00002552072146499995, "type": "chrome-manifest" }, { "id": 8, "lvl": -1, "conf": 0, "prob": 0.00001763304135238286, "type": "javascript" }, { "id": 9, "lvl": -1, "conf": 0, "prob": 0.000012248754501342773, "type": "json" } ], "version": "v18.18", "analyzed_at": "2026-10-06T21:35:44Z" }, "path": "oadlamjbejlcfifalhbnmhggeinoegjc.crx", "raw": { "files": [ { "id": 0, "mol": "O₄(CoErIS)H₄(Cm₇Br₈Db₂Po₂)Md₂(Pa₂Pm₅)", "sha": "216a1efa04108474e169ba1698fa340acd042af7a9873c9a6f2ddb6f099ff4bf", "path": "/usr/local/var/cyclotron/tmp.noindex/cyclotron-84c78eba/samples/216a1efa0410/oadlamjbejlcfifalhbnmhggeinoegjc.crx", "risk": 522, "size": 69935, "type": "crx", "facts": { "metrics": { "file": { "size": 69935, "entropy": 7.98 }, "binary": { "peak_region_bytes": 68608, "peak_region_entropy": 7.83 }, "archive": { "file_count": 9, "member_count": 12, "script_count": 3, "leading_bytes": 1322, "zip_bomb_ratio": 3.98, "compressed_size": 67187, "directory_count": 3, "executable_count": 0, "extra_field_size": 0, "noise_file_count": 0, "compression.ratio": 0.86, "hidden_file_count": 0, "uncompressed_size": 77788, "crc_collision_count": 0, "entry_comment_count": 0, "max_filename_length": 32, "rtlo_filename_count": 0, "format.regular_count": 9, "nested_archive_count": 0, "path_traversal_count": 0, "symlink_escape_count": 0, "security.setgid_count": 0, "security.setuid_count": 0, "security.sticky_count": 0, "double_extension_count": 0, "duplicate_member_count": 0, "format.directory_count": 3, "security.symlink_count": 0, "unicode_filename_count": 0, "homoglyph_filename_count": 0, "security.encrypted_count": 0, "timing.mtime_unique_count": 1, "timing.mtime_unique_ratio": 0.08, "misplaced_executable_count": 0, "timing.mtime_dominant_count": 12, "timing.mtime_dominant_ratio": 1, "timing.mtime_spread_seconds": 0, "timing.sentinel_mtime_count": 0, "security.world_writable_count": 0, "compression.method_counts.deflate": 12 } } }, "ident": { "trust": "unverified", "identifier": { "value": "oadlamjbejlcfifalhbnmhggeinoegjc", "source": "crx.extension_id", "verified": false }, "unique_ids": { "crx_id": "oadlamjbejlcfifalhbnmhggeinoegjc", "public_key_sha256": "e03b0c9149b25850b71dc76648de4692182c5efb63ebde5646171881dbe9e819" }, "description": { "value": "This extension updates your default search.", "source": "crx.description", "verified": false } }, "traits": [ { "id": "objectives/collection/monitor/tracking::search-override-config-cookie-tracker", "atk": "T1176,T1041,T1539", "conf": 0.98, "crit": 5, "desc": "Search override reads configuration cookie and installs tracking redirect", "from": [ { "off": 75, "file": 5, "line": 4 }, { "file": 6 }, { "file": 7 }, { "off": 381, "file": 8, "line": 18 } ], "uses": [ 8, 15, 22, 26, 41, 43, 61 ] }, { "id": "objectives/evasion/security-bypass/policy/browser::extension-install-close-webstore-tab", "atk": "T1562.001,T1176", "conf": 0.98, "crit": 5, "desc": "Extension closes Chrome Web Store tab on install", "from": [ { "off": 1102, "file": 5, "line": 39 }, { "file": 6 }, { "off": 381, "file": 8, "line": 18 } ], "uses": [ 5, 22, 32 ] }, { "id": "objectives/impact/ui/manipulation/traffic::runtime-search-dnr-hijack", "atk": "T1176,T1185", "conf": 0.98, "crit": 5, "desc": "Extension redirects main-frame search traffic externally", "from": [ { "off": 6168, "file": 5, "line": 176 }, { "off": 1137, "file": 6, "line": 40 } ], "uses": [ 4, 44, 61 ] }, { "id": "objectives/supply-chain/hidden-payload/extensions/affiliate::remote-configured-search-dnr-hijacker", "atk": "T1176,T1071.001,T1105", "conf": 0.98, "crit": 5, "desc": "Remotely configured search DNR hijacker", "from": [ { "off": 6168, "file": 5, "line": 176 }, { "off": 1137, "file": 6, "line": 40 }, { "file": 7 }, { "off": 381, "file": 8, "line": 18 } ], "uses": [ 4, 15, 22, 44, 61 ] }, { "id": "micro-behaviors/communications/http/dynamic::dnr-main-frame-search-redirect", "conf": 0.93, "crit": 4, "desc": "DNR main-frame search redirect", "from": [ { "off": 6710, "file": 5, "line": 184 }, { "off": 1701, "file": 6, "line": 52 } ], "uses": [ 47, 48, 77 ] }, { "id": "objectives/evasion/security-bypass/policy/browser::close-webstore-tab", "atk": "T1562", "conf": 0.98, "crit": 4, "desc": "Closes Chrome Web Store tab", "from": [ { "off": 1141, "file": 5, "line": 40 } ], "uses": [ 35, 36, 53 ] }, { "id": "metadata/package/files/archive-member::archive-js-member", "conf": 0.9, "crit": 3, "desc": "Archive member is a JavaScript file" }, { "id": "metadata/package/files/runtime::javascript-lib-tree-artifact", "conf": 0.95, "crit": 3, "desc": "JavaScript file under lib", "from": [ { "file": 5 } ] }, { "id": "metadata/permission/cookie::permission-cookies", "conf": 0.9, "crit": 3, "desc": "Extension requests cookies permission" }, { "id": "metadata/permission/cookie::permission-cookies-text", "conf": 0.9, "crit": 3, "desc": "Chrome manifest contains cookies permission", "from": [ { "file": 7 } ] }, { "id": "metadata/permission/extension-api::all-site-resources", "conf": 0.9, "crit": 3, "desc": "Extension exposes resources to all sites" }, { "id": "metadata/permission/manifest::chrome-default-search-provider", "conf": 0.95, "crit": 3, "desc": "Chrome default search provider override" }, { "id": "metadata/permission/manifest::chrome-search-provider-override", "conf": 0.95, "crit": 3, "desc": "Chrome search provider override" }, { "id": "metadata/permission/manifest::chrome-search-terms-template", "conf": 0.95, "crit": 3, "desc": "Chrome search terms template URL" }, { "id": "metadata/permission/manifest::chrome-webstore-verified-contents", "conf": 0.95, "crit": 3, "desc": "Chrome Web Store signed contents manifest" }, { "id": "metadata/permission/manifest::extension-default-search-provider", "conf": 0.92, "crit": 3, "desc": "Extension sets a default search provider", "from": [ { "off": 950, "file": 7, "line": 33 } ], "uses": [ 11, 12, 13 ] }, { "id": "metadata/permission/network::permission-declarative-net-request", "conf": 0.92, "crit": 3, "desc": "Declares declarativeNetRequest permission" }, { "id": "metadata/permission/network::search-provider-rewrite-authority", "conf": 0.9, "crit": 3, "desc": "Search provider has request rewrite authority", "from": [ { "off": 1188, "file": 7, "line": 38 } ], "uses": [ 15, 16 ] }, { "id": "metadata/permission/storage::permission-storage", "conf": 0.9, "crit": 3, "desc": "Extension requests storage permission" }, { "id": "micro-behaviors/browser-extension/host-access/freshysearch-api.net::granted", "conf": 0.95, "crit": 3, "desc": "Manifest grants access to freshysearch-api.net" }, { "id": "micro-behaviors/browser-extension/lifecycle::chrome-namespace-core", "conf": 0.95, "crit": 3, "desc": "Uses core Chrome extension APIs", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/browser-extension/lifecycle::chrome-runtime-api", "conf": 0.9, "crit": 3, "desc": "Uses the Chrome runtime API", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/browser-extension/lifecycle::chrome-runtime-on-installed", "conf": 0.9, "crit": 3, "desc": "Handles browser extension install or update", "from": [ { "file": 8 } ] }, { "id": "micro-behaviors/browser-extension/lifecycle::chrome-runtime-on-startup", "conf": 0.9, "crit": 3, "desc": "Registers a browser-startup listener", "from": [ { "file": 8 } ] }, { "id": "micro-behaviors/browser-extension/lifecycle::chrome-webnavigation-api", "conf": 0.9, "crit": 3, "desc": "References the WebExtension webNavigation API", "from": [ { "file": 6 } ] }, { "id": "micro-behaviors/browser-extension/lifecycle::chrome-webnavigation-before-navigate", "conf": 0.9, "crit": 3, "desc": "Observes navigation before it starts", "from": [ { "file": 6 } ] }, { "id": "micro-behaviors/browser-extension/lifecycle::runtime-set-uninstall-url", "conf": 0.9, "crit": 3, "desc": "Sets a browser extension uninstall URL" }, { "id": "micro-behaviors/browser-extension/management::browser-management-api", "conf": 0.9, "crit": 3, "desc": "Accesses the browser extension management API", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/browser-extension/permission/cookies::declared", "conf": 0.95, "crit": 3, "desc": "Declares \"cookies\" permission" }, { "id": "micro-behaviors/browser-extension/permission/declarative-net-request::declared", "conf": 0.95, "crit": 3, "desc": "Declares \"declarativeNetRequest\" permission" }, { "id": "micro-behaviors/browser-extension/permission/tabs::declared", "conf": 0.95, "crit": 3, "desc": "Declares \"tabs\" permission" }, { "id": "micro-behaviors/browser-extension/permission/web-navigation::declared", "conf": 0.95, "crit": 3, "desc": "Declares \"webNavigation\" permission" }, { "id": "micro-behaviors/browser-extension/tabs::chrome-tabs-api", "conf": 0.9, "crit": 3, "desc": "References the WebExtension tabs API", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/browser-extension/tabs::chrome-tabs-create", "conf": 0.9, "crit": 3, "desc": "Opens a new browser tab", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/browser-extension/tabs::chrome-tabs-create-with-url-option", "conf": 0.95, "crit": 3, "desc": "Creates browser tab with URL option" }, { "id": "micro-behaviors/browser-extension/tabs::chrome-tabs-query", "conf": 0.9, "crit": 3, "desc": "Queries open browser tabs", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/browser-extension/tabs::chrome-tabs-remove", "conf": 0.9, "crit": 3, "desc": "Closes a browser tab", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/browser-extension/tabs::chrome-tabs-update", "conf": 0.9, "crit": 3, "desc": "Updates a browser tab", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/browser-extension/tabs::chrome-tabs-update-with-url", "conf": 0.9, "crit": 3, "desc": "Updates a browser tab URL", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/browser-extension/tabs::static-https-tab-opener", "conf": 0.9, "crit": 3, "desc": "Opens fixed HTTPS URL in browser tab", "from": [ { "file": 6 } ] }, { "id": "micro-behaviors/browser-extension/tabs::tab-create-url-field", "conf": 0.9, "crit": 3, "desc": "Opens a browser tab at a destination", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/communications/http/cookies::chrome-cookies-get-all", "conf": 0.9, "crit": 3, "desc": "Enumerates extension-accessible cookies", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/communications/http/cookies::chrome-cookies-get-all-text", "conf": 0.9, "crit": 3, "desc": "Enumerates cookies via extension API text", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/communications/http/cookies::extension-config-cookie-name", "atk": "T1041", "conf": 0.9, "crit": 3, "desc": "Extension configuration cookie name", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/communications/http/dynamic::dnr-external-redirect-target", "conf": 0.92, "crit": 3, "desc": "DNR redirect uses an external HTTP target", "from": [ { "file": 5 }, { "file": 6 } ], "uses": [ 45 ] }, { "id": "micro-behaviors/communications/http/dynamic::dnr-external-regex-substitution-target", "conf": 0.92, "crit": 3, "desc": "DNR redirect uses an external regex target", "from": [ { "file": 5 }, { "file": 6 } ], "uses": [ 46, 59 ] }, { "id": "micro-behaviors/communications/http/dynamic::dnr-external-regex-substitution-url", "conf": 0.92, "crit": 3, "desc": "External URL in regex substitution field", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/communications/http/dynamic::dnr-main-frame-resource", "conf": 0.85, "crit": 3, "desc": "DNR main-frame resource", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/communications/http/dynamic::dnr-redirect-action", "conf": 0.9, "crit": 3, "desc": "DNR redirect action", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/communications/http/header/content-type::application-json", "conf": 0.65, "crit": 3, "desc": "References the application/json media type", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/communications/http/header/content-type::json-header", "conf": 0.9, "crit": 3, "desc": "References HTTP Content-Type application/json", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/communications/http/message::http-url-literal", "conf": 0.75, "crit": 3, "desc": "HTTP URL string literal", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/communications/http/url/build::http-url-template-literal", "conf": 0.94, "crit": 3, "desc": "Builds an HTTP URL with interpolation", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/communications/http/url/domain::chrome-webstore-listing-url", "conf": 0.75, "crit": 3, "desc": "Chrome Web Store listing URL", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/communications/http/url/query::query-parameter-mutation", "conf": 0.82, "crit": 3, "desc": "Mutates a URL query parameter collection", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/data/db/web-storage::chrome-storage-area-get", "conf": 0.9, "crit": 3, "desc": "Reads from any extension storage area", "from": [ { "file": 6 } ] }, { "id": "micro-behaviors/data/db/web-storage::chrome-storage-local-get", "conf": 0.9, "crit": 3, "desc": "Reads data from extension local storage", "from": [ { "file": 6 } ] }, { "id": "micro-behaviors/data/db/web-storage::chrome-storage-local-set", "conf": 0.9, "crit": 3, "desc": "Writes data to extension local storage", "from": [ { "file": 6 } ] }, { "id": "micro-behaviors/data/serialize/schema-object::files-object-field", "conf": 0.8, "crit": 3, "desc": "JSON files object field", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/process/hook/webextension::chrome-declarative-net-request", "conf": 0.9, "crit": 3, "desc": "WebExtension declarativeNetRequest API", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/process/hook/webextension::chrome-dnr-update-dynamic-rules", "conf": 0.92, "crit": 3, "desc": "Chrome updates dynamic DNR rules", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/process/hook/webextension::declarative-net-request-update", "conf": 0.92, "crit": 3, "desc": "Updates declarativeNetRequest rules", "from": [ { "file": 5 }, { "file": 6 } ], "uses": [ 60 ] }, { "id": "micro-behaviors/process/interpreter/scripting::worker-importscripts-call", "atk": "T1059.007", "mbc": "C0017", "conf": 0.92, "crit": 3, "desc": "Worker imports additional scripts", "from": [ { "file": 8 } ] }, { "id": "objectives/impact/ui/manipulation/traffic::search-provider-search-token", "conf": 0.86, "crit": 3, "desc": "Search provider URL contains a search token" }, { "id": "objectives/impact/ui/manipulation/traffic::search-url-query-template", "conf": 0.9, "crit": 3, "desc": "Search URL query template" }, { "id": "objectives/supply-chain/hidden-payload/extensions/affiliate::search-api-service-host", "conf": 0.86, "crit": 3, "desc": "Search middleware service host" }, { "id": "objectives/supply-chain/hidden-payload/extensions/affiliate::search-provider-host-permission", "conf": 0.84, "crit": 3, "desc": "Search provider host permission" }, { "id": "metadata/file/format/browser-extension::web-extension-root-manifest", "conf": 0.95, "crit": 2, "desc": "Archive contains root WebExtension manifest" }, { "id": "metadata/lang/javascript-features::async-await", "conf": 0.9, "crit": 2, "desc": "ES2017 async/await syntax", "from": [ { "file": 5 } ] }, { "id": "metadata/lang/javascript-features::template-literal", "conf": 0.9, "crit": 2, "desc": "ES6 template literal syntax", "from": [ { "file": 5 } ] }, { "id": "metadata/permission/manifest::extension-conventional-version", "conf": 0.95, "crit": 2, "desc": "Extension version uses dotted numeric format" }, { "id": "metadata/permission/manifest::extension-description-field", "conf": 0.95, "crit": 2, "desc": "Extension declares description field" }, { "id": "metadata/permission/manifest::extension-name-field", "conf": 0.95, "crit": 2, "desc": "Extension declares name field" }, { "id": "metadata/lang/natural::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"", "from": [ { "file": 6 } ] }, { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "from": [ { "file": 5 } ] }, { "id": "metadata/lang/natural::lang-english--atom-6", "conf": 0.8, "crit": 1, "desc": "English function-word token \"with\"", "from": [ { "file": 5 } ] }, { "id": "metadata/lang/natural::lang-english--atom-7", "conf": 0.8, "crit": 1, "desc": "English function-word token \"this\"", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/communications/http/dynamic::dnr-search-path-filter", "conf": 0.86, "crit": 1, "desc": "DNR rule filters a search URL path", "from": [ { "file": 5 } ] } ] }, { "analysis_gaps": [ "flow-graph-limited", "flow-call-unavailable" ], "ctx": [ { "b": "zxIq.vrlF%3taA#v@#B6zxJInBy/uhx(v(qdiJ%AarR^Hv@DmaBrA}Dpdv/BuQEQ+og.MVpc?PyauZ?\u003ewQ5r7v@Dl%x\u003eFRK3lQDlay/tcB95K7sZKJ(pFjnFuRS)YmiB-ob6n9qB-Ipxi%)8MarUfjzGx[xmP9OXpFTRPmpe!Qo*{f/ar\u003eJqB97\u0026by*Rc\u0026Bz8\u003cW3jm)#arUfjzGx[xx(mTbauZ\u0026Sz/ff3xcou3aBsCrarR^HarR!GxLzJuv@Dl%x\u003eFLKay/tcw[+)t3lQDlaBMrU3lQDlay/tcB95KqwPQ\u003cZBAzkmxcotWc#JEgwH[%BD2vamjS[uBy\u0026:epau.)}arR^HarR^HzE[2mp\u0026ZF\u003ex(^\u0026lc#@)uz!%PdefF$AygQ)%diH=qaBsCrarR^HarR^HarR!GA^n^O3lQDlarR^HarR^HarR^Hay/89z/65rB98tvvp%dQB9RUkau{$)B9RUka%n]?b5zgcvqEb[e[X:qc%HN$zdN07aAz4nau.)}arR^HarR^HarR^HarR^HarR^HA+frgy\u003c6wrA+ft%zEEx[t}3a6arR^HarR^HarR^HarR^Qi%)8MarR^HarR^HarV7Pv{%E?xDOZmdiJ%AarR^HarR^HarR^HarR^Hv@Dmaz!@#qwPz*fAWUGFi%)8MarR^HarR^HarR^HarUYoygQ)%c[dj+arR^HarR^HarR^HEf}8tarR^HarV7Yi%(q", "ln": 11, "col": 12, "line": 1 }, { "b": "zET!qdiH=qaBsCrarR^HarR!vw/@HgCvticazkncq!p5)x(mMib5zgcvruj4zxZIUaBsCrarR^HarR^HarR!pz/fSray/RpraflSauZ\u0026QCvticay/89z/65rBywT1e]=2BA^o6W3lQDlarR^HarR^HarR^HaA.ZviV}/WiXJc@xMw3dwIdRlz!A($e[n*pflZ#pB98tvwHX%LvrVc]BrCjcBw(:)BzkS9c\u003c?7tarR^HarR^HarR^HarR^HarR\u003etCYVI/a{]CnarR^HarR^HarR^HarSaYdQT!marR^HarR^HarR^HEjmk+arR^HarR^HarR^Hw]zYjc$vgkB95KDvpyu$w/$PcB5VNSB15kU3lQDlarR^HarR^HarR^HazCBgc$dsdx(\u003eFgwPQ\u003cZBAzkmxdc.ZuQEQ+og.MVpc?PydjDx^3lQDlarR^HarR^HarR^HarR^Hay/89z/65rBywT1e]\u003eJuz*2XuBywShx\u003eeUO3lQDlarR^HarR^HarR^HaBKOtarR^HarR^HarR!P3lQDlarR^HarR^Hay/tcB95KvA8ZmPauZ\u0026QCvticay/89z/65rBywT1e]=2BA^o6W3lQDlarR^HarR^HarR^HaA.ZviV}/QDTRbbx(\u003eFgwPQ\u003cZBAzkmxda%uz!0i$x(v(kdsAWNed9HxarR^HarR^HarV7Yi%)8MarR^HarR^HarUxgasI5BrafkUcmf\u003cK", "ln": 1006, "col": 34, "line": 37 }, { "b": "vP$J(asnATy\u0026AuZvP$J(e[[\u0026BaBsCrarR^HarR^HarR^HarR!pz/fSraA.Tlvru6\u003erafkUjS[fSvqf*av}Y[3zdLtwvpBpgB-p(1By=\u003epA8ZmPtqftnx\u003ee+qDKp(rarR^HarR^HarR^HarR^HarU/Ey=SXYAaAy0wK{lJxEEXoraflufKlqNA+)oHb4V1veOP9zByx04wN(#led9HxarR^HarR^HarR^HarV7Yi%)8MarR^HarR^HarV7tarR^HarR^HEf}8tarV7]3jm)#arUfjzGx[xzddi\u003elVl\u003c-wO#PSvqG:5jS[fOD2r", "ln": 1585, "col": 30, "line": 52 }, { "b": "arR^HarR^HarR^HarR^Hv@DmaBrC14BzkVhrDq)#jS[SNCox)-oEHk\u003carR^HarR^HarR^HarR^HarR!mxMOunB2\u003e%cvq]{kbZTSDx(+[pz/ff3xd^Rix*=(RvqfRcfjw*lflP97vpKy[z/e}\u0026arR^HarR^HarR^HarR^Hdlv\u003eVarR^HarR^HarR^HarR!nv@#B6zDgZ[e]$PjA:@=Vvrb^[B1RJBBsntwv@#B6zxZROb4CLeB7Glhl1szoAc9oMi%)8MarR^HarR^HarR^HarU95BzkVhrDq[dB7F^2v}XXEA:-*ae]$PCc)A+xx\u003eezsaAR)FwMg#/l[7h8arR^HarR^HarR^HarR^HvpKy[z/eM}y+x^uvrb\u003c\u003ep*[xMzf2", "ln": 2076, "col": 1, "line": 65 }, { "b": "efFUAB97\u0026by^.YNwHPXFarR^HarR^HarR^HarR^Hw[u6]xEEq0BzkVhrDq[dBz\u003e91A+PA7c[cPb3lQDlarR^HarR^HarR^HayPF5x(\u003eFswPQ\u003cZBAzkmxda%lz/fSczGFlOy?$pDaARTDwHPXFarR^HarR^HarR^HEf}8tarR^HarV7tarR^HEld=yarR^H", "ln": 2400, "col": 57, "line": 70 }, { "b": "BrCjcBvf$:w[+)Bz/oA9wGTbUvrlZiv\u003c0fGau.[hDKp(rarR^HarUfjzGx[xv@Dp3x\u003equdjS[fSvqf*av}Y[3zdLtfz/oA9wPGFpwPQjOy::SqarR^HarR^HarR^Hwn=r[x(k%OBzbxfe[n*qw[+)gvq]{Gz/5]%zy=bqarR^HarR^HarR!AvqPNpavw}1mOc9SlR*GJnKV#Yk$%^03lQDlarR^HaBLX23lQDlarR^HazbLjasI5qBrCoujS(Buazz@Xay/tdyIvv3e]k9pxlm/GazAtRdiJ%AarR^HarR^HarR^Hv@DmaBrC7iz!\u003c5#pHX5YjS)u}pFJJYvrcB2c$vglyIvv3twmv}C42ifwHPXFarR^HarR^HarR^HpHX6Iv@%tswQetBv@Dp3x\u003ep7Hyag=Lvq)R4arR^HarR^HarR^HarR^HvrlZiv\u003c2L#C{2ml3lQDlarR^HarR^HarR^HarR^HayPF5x-", "ln": 2556, "col": 9, "line": 77 }, { "b": "BAzkmxddLbC}p7Fz/oA9wLV=ItwE!}t}valwQbyYjV%]ixlv{0a$i\u003cwarR^HarR^HarR^Qi%)8MarR^HarV7tarR^HEld=yarR^Hv@DmaBrCToBx0K8wMi8JauZ\u0026QB9RUkao", "ln": 2948, "col": 32, "line": 86 }, { "b": "vrVc]BrCToBw(:)BzkS9c)A+UAaHjAayFs$DWg3DmKis)Ep1mDBBtAYwfs8Vu%+gawpm\u0026diV]Q\u003cEpaG=3lQDlaBMrU3lQDlay/tcB95KyAaJ]!A+(\u003cYasItuvPur1efFUFl1t1JC4z^VaARTDwHO-+j%kgVarR^HarR^Hv}Y[3zdLtwvpBpgv@=c?By=\u003eEaA.ZviV@JMvPur1efFwhBzk]fiV@cTl1t1JC4z!Adlv\u003eVarR!Pi%(rqarR!pz/fSraA.Tlvru6Kvrl98jS(d}A+)oHC42ifwHO-+j%kgVarR^HarR^Hx\u003ewFoa:4*wdiJUxBAIRwi%)8MarR^HarUfjzGx[xB-Ip]vRN2Gaz$+maxqrkd0oMDdlv\u003eVarR^HarR!HA+[JXy5", "ln": 3301, "col": 13, "line": 97 }, { "b": "gb0x-z/djxzGx]dy?#szas^^warR^HarR^HarR!mcs{e4AaIfTDVS}nB1Q%vzF0P}e[F1cAaKCAwQ5qHD1*!LbZP\u003evarR^HarR^HarR^HarR!GxLzJuv@Dl%x\u003eG5znKJ[darR^HarR^HarR!Pcs}Bze[w(", "ln": 3970, "col": 56, "line": 119 }, { "b": "Bxh%[B7]Mga$m}Fi%(rqarR^HarR!pz/fSrazC.mByx04qE%[(jS[fSvqf*aw[u6]xEE}xv\u003en:H3lQDlarR^HarR^Hazts{wmY!5iV@+RarR^HarR^HarR^HarR^Hb13o^By/uieMv1mwG\u003ceTb4kCfy?Wx/BzkVhfktMDzxZRsarR^HarR^HarR^HEjLZFarR^HarR!Pdlv\u003eVarR^HarR!vw/@GBx(n0lvqG:TwPGFxyBHxM3lQDlarR^HarR^Hay/tcB8L(ae[G6zz/NlImriA!AV/NuBz8!hzGx]dy?$kmwPn[yi%)8MarR^HarR^HarUYoBAIRwi%)8MarR^HarV7tarR^HarR^Hv@DmaBrC7izF0P}auZ\u0026QCvticazC.mByx04qE%]4yiarhc[dj+arR^HarR^HvrVc]BrBz2z/6ifwIdzcy:YSkarR^HarR^HarR!5vRPE:Bs}cxBAh8bB0$KpzF0P}dk2ECA3#5oarR^HarR^HarR^HarR!nB9RUkasHDfwQb*HC42ifwNc-cjW6h}arR^HarR^HarR^Hao", "ln": 4412, "col": 50, "line": 130 }, { "b": "Byw)1B1RGAvrlv8asnATwmY\u003c\u003ex(4\u0026yA+eW2z/cWXjV%]ix(n0lvqG:7diJ%AarR^HarR^HarR^HvrVc]BrCjcBvf$:w[+)Bz/oA9wHF#?3lQDlarR^HarR^Hatkw\u003cw[=pbBrCQD", "ln": 5012, "col": 26, "line": 151 }, { "b": "q!p5)x(mMib4(4jwfJMEBAhIndjDX*DKp(rarR^HarR^HarR^HarUfjzGx[xwQ5q*zF0/fjS[fSvqf*av}Y[3zdLtpvqYH^wO(0@Bs}iqBw(:!w*/8\u00263lQDlarR^HarR^HarR^HayPF5x(\u003eFswPQ\u003cZBAzkmxda%nCYVI/a$K\u003cFCYVI{w]xqowgoOEarR^HarR^HarR^HarR^HvrVc]BrCToBw(:)BzkS9c)AkEBxh%[B7]Mga$K\u003cFCYVI{w]xqBwPz\u003caz/d0=3lQDlarR^HarR^HarR^Hay/tcB95Kxz*9r!az$+mavGTWwHF#?3lQDlarR^HarR^HarR^Hay/tcB95KszGx]dy?#HFBy=NTayDEwu[-\u003cMzF%.KxjVfVz/fVgc[cn?atFpLe]$\u0026yv}v4}arR^HarR^HarR^HarR^HarR^HeIWUQarR^HarR^HarR^HarR^QEi:eEfEh0.z*9*DwPQsGBy=\u003cHEpaWGy?Wx\u003cc[Nh6Ei:eSz*8KharR^HarR^HarR^HarR^HarR^VxjVfOB.\u003e\u003e%wNPQcdgdguarR^HarR^HarR^HarR^HarSpUz=p:#x(mMidgdguarR^HarR^HarR^HarR^HarSpTy?Wx\u003cc[Nh6EpbbzarR^HarR^HarR^HarR^HvrVc]Bn", "ln": 5162, "col": 28, "line": 154 }, { "b": "vqf*ax(n0lvqG:ddlv\u003eVarR^HarR^HarR^HarR!nCvticaAIaorc-B]rafz/dlv\u003eVarR^HarR^HarR^HarR!pz/fSrazk?hwfs2TvrVc]BrCjcBw(:)BzkS9c)AqDx\u003eezsaARTDwHPXFarR^HarR^HarR^HarR^Hv}Y[3zdLtgwN/K+A::67C4BAWBw=W\u0026B.bSoe{hbzvru6GD2v5cx\u003e74-y?mVoDKp(rarR^HarR^HarR^HarR^HarUYozeTPeqGV!!nN#)6ax{Naed9HxarR^HarR^HarR^HarR^HarU96wkWL^wPG)Ptm8F}arR^HarR^HarR^HarR^HarR^HarV1rarR^HarR^HarR^HarR^HarR^HarR^HarR^Hx\u003efmEf!rUOarR^HarR^HarR^HarR^HarR^HarR^HarR!CA+PDjx([RYatCzOarR^HarR^HarR^HarR^HarR^HarR^HarR^HvpKy[z/dPUDKp(rarR^HarR^HarR^HarR^HarR^HarR^HarR^HarU=KAaI6Mb64m9x(W={BrSmyarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HA+e=}A+e:5iV@+RarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HA+e({CVe-]B98brB-.tozAn[FxMOunB2\u003e%cB7F^2v}WFuDVS}nB1Q%vzF0P}e[5Zkl#M{Jx(ntLv@=/EB7F^2v}WGlxMcgKjZqkDcsHzax(v(Lwof8gB.LwHbZTfDx\u003ehSsw[=pbBw(:VA:@=CBAhInu[qTcarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR!Ped9HxarR^HarR^HarR^HarR^HarR^HarR^HarV7-3lQDlarR^HarR^HarR^HarR^HarR^HarR^Hay/tcwncd1z/dPUDKp(rarR^HarR^HarR^HarR^HarR^HarR^HarR^HarUYoxjVrSx(4)5AYLsJxMOunB2\u003e%cB7F^2v}WFuDVS}nB1Q%vzF0P}e[5Zkl#M{Jx(ntLB7F^2v}WIze?eqTed9HxarR^HarR^HarR^HarR^HarR^HarR^HarR^HarUxtrDq[Bx(4)5AZKnRwM9eTB7]-gC4AYSw)]H%wH[fharR^HarR^HarR^HarR^HarR^HarR^HarR^HarR!EwPI^jA:@VWD2NtoiV}SJzddc@uUjs!zdK[%ed9HxarR^HarR^HarR^HarR^HarR^HarR^HarV7-3lQDlarR^HarR^HarR^HarR^HarR^HaBL^FarR^HarR^HarR^HarR^HarR^Ht}us9arR^HarR^HarR^HarR!Pdlv\u003eVarR^HarR^HarR^HarR!HAaAy0wKxJ$l2Hjbp/H\u003ejc[dj+arR^HarR^HarR^HarR^Hx\u003ewFovrVc]BrCjcBw(:)BzkS9c@:tRlR*GJnKV#Yk$}", "ln": 5746, "col": 19, "line": 166 }, { "b": "z/fSraAIaorC(I*B97\u0026by-\u003e\u003e-vrlZiv\u003c0fGau.[hDKp(rarR^HarUfjzGx[xB-7]hB97\u0026by/LH(auZ\u0026PxMOunB2\u003e%cB-7]hB97\u0026by+u#WBzbxfe[n*qw[+)gvq]{Gz/5]%zHBf5x\u003efvLDKp(rarR^HarR^HarU=tx(+[pz/ff3xd!sAx(n0lvqG:Kl\u003c+4VarR^HarV7Vxlv{0jTtw.Cvticazkncq!p5)x(mMib4(4jwfJMEBAhIndsCO=3lQDlarR^Hay/89z/65rA=(nwx(dAlB7GC[zFs0fByx04rz(HsB-7]hB97\u0026by/LH(efDt\u0026au.[hDWNt83lQDlaBMrUarR^HA+funA=91D3lQDlarR^HazC.cBsW+warR^HarR!vzGx]dy?#TJzE^M{AX4LuarR^HarR!FByxiiB-o(WzE^M{AX4LuarR^HarR!twPQ\u003cZBAzkmxdKxjarR!Pi%{xy3nj4Pm}DNHA::63wftp", "ln": 8199, "col": 6, "line": 225 } ], "depth": 1, "facts": { "imp": [ [ "", "Promise" ], [ "", "resolve" ], [ "", "console.error" ], [ "", "reject" ], [ "", "Promise" ], [ "", "resolve" ], [ "", "console.error" ], [ "", "reject" ], [ "", "getSetting" ], [ "", "chrome.tabs.query" ], [ "", "getSetting" ], [ "", "getSetting" ], [ "", "chrome.tabs.remove" ], [ "", "chrome.tabs.query" ], [ "", "getSetting" ], [ "", "chrome.tabs.update" ], [ "", "updateHash" ], [ "", "getSetting" ], [ "", "getSetting" ], [ "", "getSetting" ], [ "", "getSetting" ], [ "", "URL" ], [ "", "actionUrl.searchParams.set" ], [ "", "actionUrl.searchParams.set" ], [ "", "actionUrl.searchParams.set" ], [ "", "fetch" ], [ "", "actionUrl.toString" ], [ "", "setSetting" ], [ "", "chrome.cookies.getAll" ], [ "", "JSON.parse" ], [ "", "Object.keys.map" ], [ "", "Object.keys" ], [ "", "setSetting" ], [ "", "getSetting" ], [ "", "getSetting" ], [ "", "getSetting" ], [ "", "setSetting" ], [ "", "chrome.tabs.create" ], [ "", "URL" ], [ "", "urlObj.toString" ], [ "", "URL" ], [ "", "urlObj.searchParams.set" ], [ "", "urlObj.toString" ], [ "", "getSetting" ], [ "", "getSetting" ], [ "", "getSetting" ], [ "", "getSetting" ], [ "", "getSetting" ], [ "", "fetch" ], [ "", "console.error" ], [ "", "installRes.json" ], [ "", "Promise.all" ], [ "", "Object.entries.map" ], [ "", "Object.entries" ], [ "", "setSetting" ], [ "", "getConfigCookie" ], [ "", "getSetting" ], [ "", "chrome.management.getSelf" ], [ "", "setSetting" ], [ "", "setSetting" ], [ "", "Date" ], [ "", "now.getMonth" ], [ "", "now.getDate" ], [ "", "now.getFullYear.toString.slice" ], [ "", "now.getFullYear.toString" ], [ "", "now.getFullYear" ], [ "", "setSetting" ], [ "", "install" ], [ "", "setTypeTag" ], [ "", "getSetting" ], [ "", "chrome.declarativeNetRequest.updateDynamicRules" ], [ "", "updateCWSAndLPTab" ], [ "", "getSetting" ], [ "", "getSetting" ], [ "", "getSetting" ], [ "", "getSetting" ], [ "", "URL" ], [ "", "tyUrl.searchParams.set" ], [ "", "tyUrl.searchParams.set" ], [ "", "tyUrl.searchParams.set" ], [ "", "tyUrl.searchParams.set" ], [ "", "openUrl" ], [ "", "tyUrl.toString" ], [ "", "console.error" ], [ "", "startupHandler" ], [ "", "setSetting" ], [ "", "makeConsentCall" ], [ "", "setUninstall" ], [ "", "getSetting" ], [ "", "chrome.runtime.setUninstallURL" ] ], "mbr": [ "JSON.parse", "Object.entries", "Object.entries.map", "Object.keys", "Object.keys.map", "Promise.all", "actionUrl.searchParams", "actionUrl.searchParams.set", "actionUrl.toString", "chrome.cookies", "chrome.cookies.getAll", "chrome.declarativeNetRequest", "chrome.declarativeNetRequest.updateDynamicRules", "chrome.management", "chrome.management.getSelf", "chrome.runtime", "chrome.runtime.setUninstallURL", "chrome.storage", "chrome.tabs", "chrome.tabs.create", "chrome.tabs.query", "chrome.tabs.remove", "chrome.tabs.update", "console.error", "cookies.length", "details.reason", "extInfo.id", "extInfo.version", "installRes.json", "installRes.ok", "now.getDate", "now.getFullYear", "now.getFullYear.toString", "now.getFullYear.toString.slice", "now.getMonth", "tab.id", "tyUrl.searchParams", "tyUrl.searchParams.set", "tyUrl.toString", "urlObj.hash", "urlObj.searchParams", "urlObj.searchParams.set", "urlObj.toString" ], "tgt": [ "Date", "JSON.parse", "Object.entries", "Object.entries.map", "Object.keys", "Object.keys.map", "Promise", "Promise.all", "URL", "actionUrl.searchParams.set", "actionUrl.toString", "chrome.cookies.getAll", "chrome.declarativeNetRequest.updateDynamicRules", "chrome.management.getSelf", "chrome.runtime.setUninstallURL", "chrome.tabs.create", "chrome.tabs.query", "chrome.tabs.remove", "chrome.tabs.update", "console.error", "fetch", "getConfigCookie", "getSetting", "install", "installRes.json", "makeConsentCall", "now.getDate", "now.getFullYear", "now.getFullYear.toString", "now.getFullYear.toString.slice", "now.getMonth", "openUrl", "reject", "resolve", "setSetting", "setTypeTag", "setUninstall", "startupHandler", "tyUrl.searchParams.set", "tyUrl.toString", "updateCWSAndLPTab", "updateHash", "urlObj.searchParams.set", "urlObj.toString" ], "funcs": [ [ "extension", 20 ], [ "config", 186 ], [ "anonymous", 259 ], [ "anonymous", 303 ], [ "ret", 412 ], [ "anonymous", 613 ], [ "anonymous", 664 ], [ "anonymous", 825 ], [ "anonymous", 1003 ], [ "anonymous", 1831 ], [ "anonymous", 2576 ], [ "key", 2904 ], [ "anonymous", 3047 ], [ "anonymous", 3394 ], [ "anonymous", 3519 ], [ "anonymous", 3695 ], [ "anonymous", 3881 ], [ "anonymous", 4819 ], [ "details", 4968 ], [ "anonymous", 8127 ], [ "anonymous", 8219 ], [ "anonymous", 8453 ] ], "metrics": { "ast": { "op.eq": 3, "op.lt": 1, "op.add": 2, "op.lor": 3, "op.sub": 3, "op.land": 6, "op.lnot": 4, "max_depth": 27, "call_count": 94, "node_count": 2318, "member_count": 43, "op_density.eq": 0, "op_density.lt": 0, "op_density.add": 0, "op_density.lor": 0, "op_density.sub": 0, "op_density.land": 0, "op_density.lnot": 0, "max_array_length": 1, "max_concat_chain": 2, "max_member_depth": 4 }, "file": { "size": 8622, "entropy": 4.13 }, "text": { "lines": 239, "top_char": 116, "digit_ratio": 0.01, "space_count": 3448, "char_entropy": 4.13, "unique_chars": 82, "top_char_null": 0, "escape_density": 0.01, "string_density": 0.22, "top_char_ratio": 0.05, "avg_line_length": 35.08, "max_line_length": 158, "empty_line_ratio": 0.08, "last_line_length": 45, "long_token_count": 1, "whitespace_ratio": 0.43, "identifier_density": 1.47, "line_length_stddev": 23.18, "max_whitespace_run": 1, "octal_escape_count": 1, "normalized_string_count": 3.43, "repeated_char_sequences": 139, "suspicious_string_ratio": 0.04, "anonymous_function_ratio": 0.95, "normalized_function_count": 1.42, "strings_to_functions_ratio": 2.41, "suspicious_identifier_ratio": 0.05, "normalized_unique_identifiers": 14.81, "identifiers_to_functions_ratio": 5.32 }, "binds": { "count": 46 }, "binary": { "peak_region_bytes": 2478, "peak_region_entropy": 4.68 }, "source": { "function_count": 1 }, "strings": { "bytes": 1541, "count": 53, "shell": 2, "url_count": 5, "avg_length": 29.08, "max_length": 421, "avg_entropy": 2.86, "entropy_stddev": 0.77 }, "comments": { "chars": 82, "count": 3, "lines": 3, "to_code_ratio": 0.01 }, "functions": { "count": 1, "nested": 8, "density": 9.21, "anonymous": 21, "avg_params": 0.77, "code_ratio": 1.98, "max_params": 3, "one_liners": 2, "length_stddev": 48.8, "over_100_lines": 1, "avg_name_length": 9, "no_params_count": 14, "avg_length_lines": 21.55, "max_length_lines": 235, "min_length_lines": 1, "avg_nesting_depth": 1.36, "max_nesting_depth": 3, "avg_param_name_length": 4.88 }, "identifiers": { "count": 352, "unique": 117, "avg_length": 7.45, "max_length": 24, "min_length": 1, "avg_entropy": 2.36, "reuse_ratio": 0.33, "length_stddev": 4.42, "sequential_names": 6, "single_char_count": 6, "single_char_ratio": 0.05, "high_entropy_count": 3, "high_entropy_ratio": 0.03, "all_lowercase_ratio": 0.51, "all_uppercase_ratio": 0.04 } } }, "id": 5, "mol": "O₂(IEr)H₃(Cm₇Br₃Po)Md(Pa)", "path": "/usr/local/var/cyclotron/tmp.noindex/cyclotron-84c78eba/samples/216a1efa0410/oadlamjbejlcfifalhbnmhggeinoegjc.crx!!lib/ext.js", "pid": 0, "risk": 199, "sha": "e5b2833e837950a4e92e3e62afaacfecf04ff76c6f88078a64faf819d9209ce9", "size": 8622, "traits": [ { "id": "objectives/impact/ui/manipulation/traffic::runtime-search-dnr-hijack", "atk": "T1176,T1185", "conf": 0.98, "crit": 5, "desc": "Extension redirects main-frame search traffic externally", "uses": [ 1, 19, 32 ] }, { "id": "micro-behaviors/communications/http/dynamic::dnr-main-frame-search-redirect", "conf": 0.93, "crit": 4, "desc": "DNR main-frame search redirect", "uses": [ 22, 23, 38 ], "spans": [ [ 6168, 16 ], [ 6528, 65 ], [ 6710, 10 ] ] }, { "id": "objectives/evasion/security-bypass/policy/browser::close-webstore-tab", "atk": "T1562", "conf": 0.98, "crit": 4, "desc": "Closes Chrome Web Store tab", "uses": [ 11, 12, 28 ], "spans": [ [ 1102, 11 ], [ 1141, 26 ] ] }, { "id": "metadata/package/files/runtime::javascript-lib-tree-artifact", "conf": 0.95, "crit": 3, "desc": "JavaScript file under lib" }, { "id": "micro-behaviors/browser-extension/lifecycle::chrome-namespace-core", "conf": 0.95, "crit": 3, "desc": "Uses core Chrome extension APIs" }, { "id": "micro-behaviors/browser-extension/lifecycle::chrome-runtime-api", "conf": 0.9, "crit": 3, "desc": "Uses the Chrome runtime API", "spans": [ [ 8408, 16 ] ] }, { "id": "micro-behaviors/browser-extension/lifecycle::runtime-set-uninstall-url", "conf": 0.9, "crit": 3, "desc": "Sets a browser extension uninstall URL", "spans": [ [ 8408, 54 ] ] }, { "id": "micro-behaviors/browser-extension/management::browser-management-api", "conf": 0.9, "crit": 3, "desc": "Accesses the browser extension management API" }, { "id": "micro-behaviors/browser-extension/tabs::chrome-tabs-api", "conf": 0.9, "crit": 3, "desc": "References the WebExtension tabs API", "spans": [ [ 1095, 11 ], [ 1371, 18 ], [ 1649, 18 ], [ 3433, 18 ] ] }, { "id": "micro-behaviors/browser-extension/tabs::chrome-tabs-create", "conf": 0.9, "crit": 3, "desc": "Opens a new browser tab", "spans": [ [ 3433, 18 ] ] }, { "id": "micro-behaviors/browser-extension/tabs::chrome-tabs-create-with-url-option", "conf": 0.95, "crit": 3, "desc": "Creates browser tab with URL option", "spans": [ [ 3433, 53 ] ] }, { "id": "micro-behaviors/browser-extension/tabs::chrome-tabs-query", "conf": 0.9, "crit": 3, "desc": "Queries open browser tabs", "spans": [ [ 1102, 11 ] ] }, { "id": "micro-behaviors/browser-extension/tabs::chrome-tabs-remove", "conf": 0.9, "crit": 3, "desc": "Closes a browser tab" }, { "id": "micro-behaviors/browser-extension/tabs::chrome-tabs-update", "conf": 0.9, "crit": 3, "desc": "Updates a browser tab", "spans": [ [ 1649, 18 ] ] }, { "id": "micro-behaviors/browser-extension/tabs::chrome-tabs-update-with-url", "conf": 0.9, "crit": 3, "desc": "Updates a browser tab URL", "spans": [ [ 1656, 51 ] ] }, { "id": "micro-behaviors/browser-extension/tabs::tab-create-url-field", "conf": 0.9, "crit": 3, "desc": "Opens a browser tab at a destination" }, { "id": "micro-behaviors/communications/http/cookies::chrome-cookies-get-all", "conf": 0.9, "crit": 3, "desc": "Enumerates extension-accessible cookies", "spans": [ [ 2620, 21 ] ] }, { "id": "micro-behaviors/communications/http/cookies::chrome-cookies-get-all-text", "conf": 0.9, "crit": 3, "desc": "Enumerates cookies via extension API text", "spans": [ [ 2620, 22 ] ] }, { "id": "micro-behaviors/communications/http/cookies::extension-config-cookie-name", "atk": "T1041", "conf": 0.9, "crit": 3, "desc": "Extension configuration cookie name", "spans": [ [ 75, 10 ] ] }, { "id": "micro-behaviors/communications/http/dynamic::dnr-external-redirect-target", "conf": 0.92, "crit": 3, "desc": "DNR redirect uses an external HTTP target", "uses": [ 20 ], "spans": [ [ 5874, 28 ], [ 6266, 28 ] ] }, { "id": "micro-behaviors/communications/http/dynamic::dnr-external-regex-substitution-target", "conf": 0.92, "crit": 3, "desc": "DNR redirect uses an external regex target", "uses": [ 21, 30 ] }, { "id": "micro-behaviors/communications/http/dynamic::dnr-external-regex-substitution-url", "conf": 0.92, "crit": 3, "desc": "External URL in regex substitution field" }, { "id": "micro-behaviors/communications/http/dynamic::dnr-main-frame-resource", "conf": 0.85, "crit": 3, "desc": "DNR main-frame resource" }, { "id": "micro-behaviors/communications/http/dynamic::dnr-redirect-action", "conf": 0.9, "crit": 3, "desc": "DNR redirect action", "spans": [ [ 6168, 16 ] ] }, { "id": "micro-behaviors/communications/http/header/content-type::application-json", "conf": 0.65, "crit": 3, "desc": "References the application/json media type", "spans": [ [ 4529, 16 ] ] }, { "id": "micro-behaviors/communications/http/header/content-type::json-header", "conf": 0.9, "crit": 3, "desc": "References HTTP Content-Type application/json", "spans": [ [ 4513, 32 ] ] }, { "id": "micro-behaviors/communications/http/message::http-url-literal", "conf": 0.75, "crit": 3, "desc": "HTTP URL string literal", "spans": [ [ 2140, 12 ], [ 6286, 15 ], [ 8263, 18 ] ] }, { "id": "micro-behaviors/communications/http/url/build::http-url-template-literal", "conf": 0.94, "crit": 3, "desc": "Builds an HTTP URL with interpolation", "spans": [ [ 6286, 83 ] ] }, { "id": "micro-behaviors/communications/http/url/domain::chrome-webstore-listing-url", "conf": 0.75, "crit": 3, "desc": "Chrome Web Store listing URL" }, { "id": "micro-behaviors/communications/http/url/query::query-parameter-mutation", "conf": 0.82, "crit": 3, "desc": "Mutates a URL query parameter collection", "spans": [ [ 2237, 17 ] ] }, { "id": "micro-behaviors/process/hook/webextension::chrome-declarative-net-request", "conf": 0.9, "crit": 3, "desc": "WebExtension declarativeNetRequest API", "spans": [ [ 5874, 28 ] ] }, { "id": "micro-behaviors/process/hook/webextension::chrome-dnr-update-dynamic-rules", "conf": 0.92, "crit": 3, "desc": "Chrome updates dynamic DNR rules", "spans": [ [ 5874, 47 ] ] }, { "id": "micro-behaviors/process/hook/webextension::declarative-net-request-update", "conf": 0.92, "crit": 3, "desc": "Updates declarativeNetRequest rules", "uses": [ 31 ], "spans": [ [ 5874, 47 ] ] }, { "id": "metadata/lang/javascript-features::async-await", "conf": 0.9, "crit": 2, "desc": "ES2017 async/await syntax" }, { "id": "metadata/lang/javascript-features::template-literal", "conf": 0.9, "crit": 2, "desc": "ES6 template literal syntax" }, { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"" }, { "id": "metadata/lang/natural::lang-english--atom-6", "conf": 0.8, "crit": 1, "desc": "English function-word token \"with\"" }, { "id": "metadata/lang/natural::lang-english--atom-7", "conf": 0.8, "crit": 1, "desc": "English function-word token \"this\"" }, { "id": "micro-behaviors/communications/http/dynamic::dnr-search-path-filter", "conf": 0.86, "crit": 1, "desc": "DNR rule filters a search URL path" } ], "type": "javascript" }, { "ctx": [ { "b": "w{503BzkVhaA}yaqE%\u0026\u003cwPI@wwQ5qFay/tcw[+)baBsCrarR!ywPP5eB5l)}v}x.5x(mMMx(Xopq!oxTv}V#Fazb4#B7EAu3lQDlay/tcB95KCwPS6lmRM):Bw(:VA:@=XB.\u003eRijS[fOD2vamc[co4j%kgVarR^HarR^Hx\u003ewFox(^9\u003ez!0v1B7]J8mRM):Bw(:VA:@=iaBsCrarR^HarR^", "ln": 0, "col": 1, "line": 1 }, { "b": "auZ\u0026?A=\u003e}P3jm)#arR^HarU=DC{4CvarR^HarR^HarR^Hfe1CnxK$W?azCBgBzbxfazC)tBzbkdw[=pbBrCTovrb\u003c\u003e3lQDlarR^HarR^Hay/tcB95KBwPJ0gBrAZ?vrVc]BrC7bA=k/ae]#bMA:-P(e]kDovqEMewPPt8b4+LfB97t(vrb\u003c\u003eb3=SV3lQDlarR^HarR^Hay/tcB95KKazbtdB97t(vrb\u003c\u003eaBLv}aAz4mB.(dY3jm)#arR^HarR^HarUxgasH\u0026oA=Vt3wNPQ?xEL6J3lQDlarR^HarR^HarR^HaAz4nB-IvY3lQDlarR^HarQ", "ln": 225, "col": 32, "line": 9 }, { "b": "arR^HarR^HaAz4nB-IvY3lQDlarR^HarR^HaBKO7arR^HarR^HarR^Hx\u003ewFoa.CCeB97t(vrb\u003c\u003easnATxlv{0asnATBA}?pdiJ%AarR^HarR^HarR^HarR^HBAhTHDKp(rarR^HarR^HarR^HarR^HarU9pvqf*av}Y[3zdLtgwN/K+A::67C4BAWBw=W\u0026B.bSoe{hbzvru6GD2v5cx\u003e74-y?mVoDKp(rarR^HarR^HarR^HarR^HarR^HarUYozeTPeqGV!!nN#)6ax{Naed8.barR^HarR^HarR^HarR^HarR^HarR!nwmOOXy?mVGax]f}arR^HarR^HarR^HarR^HarR^HarR^HarR!N3lQDlarR^HarR^HarR^HarR^HarR^HarR^HarR^HazCvEatCzO3lQDlarR^HarR^HarR^HarR^HarR^HarR^HarR^HaAhvnz/PMlC@^65ed8.barR^HarR^HarR^HarR^HarR^HarR^HarR^HarR!nv@#B6zAn[!3lQDlarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HaAR)FwJy}TA+e=}A+e:5a$K6darR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HA+e=}A+e:5iV@+RarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HA+e({CVe-]B98brB-.tozAn[FxMOunB2\u003e%cB7F^2v}WFuDT*#iw[+)gvq]{Gz/5]%zHBfFA^flUwNPQ?xFamqA6Fb3tWf0gBA}?pjTtw@D2NtycsHzax(v(Lwof8gB.LwHbZTfDx\u003ehT1ed9HxarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarV7-3lQDlarR^HarR^HarR^HarR^HarR^HarR^HarR^HaBL^F3lQDlarR^HarR^HarR^HarR^HarR^HarR^HarR^Hay/tcwncd1z/dPUDKp(rarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarUYoxjVrSx(4)5AYLsJxMOunB2\u003e%cB7F^2v}WFuDT*#iw[+)gvq]{Gz/5]%zHBfVwNPQ?xFg+^dK!:R3jm)#arR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarUxtrDq[Bx(4)5AZKnRwM9eTB7]-gC4AYSw)]H%wH[e}arR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HA+frgB-H#6rc-B]B2\u003eBFb5H+5zEm0@vqPN1t}us9arR^HarR^HarR^HarR^HarR^HarR^HarR^HarR!Ped9HxarR^HarR^HarR^HarR^HarR^HarR^HarV7-3lQDlarR^HarR^HarR^HarR^HarR^HaycJ9arR^HarR^HarR^HarR^HarR^HEjmk+3lQDlarR^HarR^HarR^HarR^HayPF5x(\u003eFcxMw3dwIe4Cz/Po0wId!qv{%gaB7GCwDMV{mA=Vt3wNPQ?xGvnTA=\u003e}oEjmk+arR^HarR^HarR^HarR^HarR^Hfe1CzAaJ]fwnc9[vR/P#Aa9x\u003cazCZovQS+Zxl4{kzE:\u003erz/fxpaA8dcwHN%earR^HarR^HarR^HarR^HarR!pxMw3dwIe7kvSKeiA+eW3wHE)darR^HarR^HarR^HarR^HarR^HarR!N3lQDlarR^HarR^HarR^HarR^HarR^HarR^HaA.ZviV}*zBAzFyiXJciDT*#iw[+)gB7]-cl#M{Jx(ntLwnc9[vR/Qekv]7YjTtw:xMw3dwIe1CzGGPfwIdXcEi@PHx\u003efvLDUmFnwpk!Fx\u003eqGKwO${=y?mc+ed9HxarR^HarR^HarR^HarR^HarR^HarR^HarU95Bzk]fiV@3yy\u0026:es3lQDlarR^HarR^HarR^HarR^HarR^HaBL^FarR^HarR^HarR^HarR^HarR^HarR^Hc[co4j%ki23lQDlarR^HarQ", "ln": 684, "col": 8, "line": 25 }, { "b": "B.\u003eRTA=M8sdiJ%AarR^HarR^HarR^HarR^HarR^Hv@Dmaz!@#qwPz*fAWSb2A=M8saAIaoBzkS9aA.SCA+e=}A+e:5aAzQvwJz1^aAzQvwKQSWz/No*3lQDlarR^HarR^", "ln": 2318, "col": 27, "line": 67 }, { "b": "Byw)1B09RfaBsCrarR^HarR!vw/@GearR^HarR^HarR^HwmY\u003c\u003ex(4\u0026yB-IpJB97\u0026hBApI$Bz97gxMOunB2\u003e%cB7F^2v}WFuDT*#iw[+)gvq]{Gz/5]%zHBfVwNPQ?xFi:x3lQDlarR^HasOBW3lQDlarR^HarR^HayPF5x(\u003eFswPS6lmRM):Bw(:VA:@=XB.?", "ln": 2763, "col": 40, "line": 80 }, { "b": "fe1CCwO(vewGV8dwGU/6B97#hwPw]4w]}Q8azbtdB95KCBZ[])B8$@oy-)O6ByO$\u003earR^HarR^HarR^Hv}Y[3zdLtzwNXzyC4\u003eO$BzkVhe]LR]wOb\u003e3wLMVSx\u003eH\u003c@wIe1mzeTPeoLFM\u0026wO#71c\u003c?7tarR^HarR^HarR^HarUMgC4\u003eO$BzkVhoLFM\u0026wO#713lQDlarR^HarR^HasPwVarR^HarR^HEf}8tarV7]3jm)#arUYoBAIRwaBsCrarR^HarR!AvrMu$vruj4zCj+=By/u3AX4LuarR!Pi%{xy3nj4Pm}DNH", "ln": 2934, "col": 13, "line": 85 } ], "depth": 1, "facts": { "imp": [ [ "", "chrome.storage.local.get" ], [ "", "ext.getSetting" ], [ "", "ext.getSetting" ], [ "", "chrome.declarativeNetRequest.updateDynamicRules" ], [ "", "chrome.storage.local.set" ], [ "", "chrome.tabs.create" ], [ "", "console.error" ], [ "", "console.error" ], [ "", "details.url.startsWith" ], [ "", "setupFirstSearchRule" ], [ "", "chrome.webNavigation.onBeforeNavigate.removeListener" ] ], "mbr": [ "chrome.declarativeNetRequest", "chrome.declarativeNetRequest.updateDynamicRules", "chrome.runtime", "chrome.runtime.id", "chrome.storage", "chrome.storage.local", "chrome.storage.local.get", "chrome.storage.local.set", "chrome.tabs", "chrome.tabs.create", "chrome.webNavigation", "chrome.webNavigation.onBeforeNavigate", "chrome.webNavigation.onBeforeNavigate.removeListener", "config.apiDomain", "config.siteDomain", "console.error", "details.url", "details.url.startsWith", "ext.getSetting" ], "tgt": [ "chrome.declarativeNetRequest.updateDynamicRules", "chrome.storage.local.get", "chrome.storage.local.set", "chrome.tabs.create", "chrome.webNavigation.onBeforeNavigate.removeListener", "console.error", "details.url.startsWith", "ext.getSetting", "setupFirstSearchRule" ], "funcs": [ [ "webRequest", 0 ], [ "anonymous", 110 ], [ "anonymous", 2260 ], [ "details", 2755 ] ], "metrics": { "ast": { "op.lor": 1, "op.land": 2, "op.lnot": 3, "max_depth": 29, "call_count": 11, "node_count": 558, "member_count": 19, "op_density.lor": 0, "op_density.land": 0, "op_density.lnot": 0.01, "max_array_length": 1, "max_member_depth": 4 }, "file": { "size": 3217, "entropy": 3.75 }, "text": { "lines": 97, "top_char": 101, "digit_ratio": 0.01, "space_count": 1457, "char_entropy": 3.75, "unique_chars": 71, "top_char_null": 0, "escape_density": 0.03, "string_density": 0.11, "top_char_ratio": 0.05, "avg_line_length": 32.16, "max_line_length": 153, "empty_line_ratio": 0.19, "last_line_length": 45, "whitespace_ratio": 0.48, "identifier_density": 0.88, "line_length_stddev": 28.22, "max_whitespace_run": 1, "octal_escape_count": 1, "normalized_string_count": 1.12, "repeated_char_sequences": 57, "suspicious_string_ratio": 0.09, "anonymous_function_ratio": 0.75, "normalized_function_count": 0.41, "strings_to_functions_ratio": 2.75, "normalized_unique_identifiers": 6.67, "identifiers_to_functions_ratio": 11 }, "binds": { "count": 8 }, "binary": { "peak_region_bytes": 2193, "peak_region_entropy": 3.97 }, "source": { "function_count": 1 }, "strings": { "bytes": 369, "count": 11, "url_count": 4, "avg_length": 33.55, "max_length": 90, "avg_entropy": 3.48, "entropy_stddev": 0.97, "embedded_code_candidates": 1 }, "comments": { "chars": 269, "count": 7, "lines": 7, "to_code_ratio": 0.08 }, "functions": { "count": 1, "nested": 2, "density": 4.12, "anonymous": 3, "avg_params": 0.5, "code_ratio": 1.87, "max_params": 2, "one_liners": 1, "length_stddev": 40.1, "avg_name_length": 10, "no_params_count": 3, "avg_length_lines": 45.25, "max_length_lines": 95, "min_length_lines": 1, "avg_nesting_depth": 1, "max_nesting_depth": 2, "avg_param_name_length": 4.5 }, "identifiers": { "count": 85, "unique": 44, "avg_length": 9.61, "max_length": 24, "min_length": 2, "avg_entropy": 2.64, "reuse_ratio": 0.52, "length_stddev": 5.65, "high_entropy_count": 4, "high_entropy_ratio": 0.09, "all_lowercase_ratio": 0.52 } } }, "id": 6, "mol": "O(I)H₄(Cm₃Br₂DbPo)Md(Pa)", "path": "/usr/local/var/cyclotron/tmp.noindex/cyclotron-84c78eba/samples/216a1efa0410/oadlamjbejlcfifalhbnmhggeinoegjc.crx!!lib/webRequest.js", "pid": 0, "risk": 160, "sha": "f0e752157b560895569e087a47bff56988ec5a7c89fec8e9e264ab6703ef96d7", "size": 3217, "traits": [ { "id": "objectives/impact/ui/manipulation/traffic::runtime-search-dnr-hijack", "atk": "T1176,T1185", "conf": 0.98, "crit": 5, "desc": "Extension redirects main-frame search traffic externally", "uses": [ 1, 12, 24 ] }, { "id": "micro-behaviors/communications/http/dynamic::dnr-main-frame-search-redirect", "conf": 0.93, "crit": 4, "desc": "DNR main-frame search redirect", "uses": [ 15, 16, 27 ], "spans": [ [ 1137, 16 ], [ 1514, 60 ], [ 1701, 10 ] ] }, { "id": "metadata/package/files/runtime::javascript-lib-tree-artifact", "conf": 0.95, "crit": 3, "desc": "JavaScript file under lib" }, { "id": "micro-behaviors/browser-extension/lifecycle::chrome-namespace-core", "conf": 0.95, "crit": 3, "desc": "Uses core Chrome extension APIs" }, { "id": "micro-behaviors/browser-extension/lifecycle::chrome-runtime-api", "conf": 0.9, "crit": 3, "desc": "Uses the Chrome runtime API", "spans": [ [ 2119, 16 ] ] }, { "id": "micro-behaviors/browser-extension/lifecycle::chrome-webnavigation-api", "conf": 0.9, "crit": 3, "desc": "References the WebExtension webNavigation API" }, { "id": "micro-behaviors/browser-extension/lifecycle::chrome-webnavigation-before-navigate", "conf": 0.9, "crit": 3, "desc": "Observes navigation before it starts", "spans": [ [ 2998, 37 ] ] }, { "id": "micro-behaviors/browser-extension/tabs::chrome-tabs-api", "conf": 0.9, "crit": 3, "desc": "References the WebExtension tabs API", "spans": [ [ 1995, 18 ] ] }, { "id": "micro-behaviors/browser-extension/tabs::chrome-tabs-create", "conf": 0.9, "crit": 3, "desc": "Opens a new browser tab", "spans": [ [ 1995, 18 ] ] }, { "id": "micro-behaviors/browser-extension/tabs::chrome-tabs-create-with-url-option", "conf": 0.95, "crit": 3, "desc": "Creates browser tab with URL option", "spans": [ [ 1995, 103 ] ] }, { "id": "micro-behaviors/browser-extension/tabs::static-https-tab-opener", "conf": 0.9, "crit": 3, "desc": "Opens fixed HTTPS URL in browser tab" }, { "id": "micro-behaviors/browser-extension/tabs::tab-create-url-field", "conf": 0.9, "crit": 3, "desc": "Opens a browser tab at a destination" }, { "id": "micro-behaviors/communications/http/dynamic::dnr-external-redirect-target", "conf": 0.92, "crit": 3, "desc": "DNR redirect uses an external HTTP target", "uses": [ 13 ], "spans": [ [ 812, 28 ], [ 1244, 28 ] ] }, { "id": "micro-behaviors/communications/http/dynamic::dnr-external-regex-substitution-target", "conf": 0.92, "crit": 3, "desc": "DNR redirect uses an external regex target", "uses": [ 14, 22 ] }, { "id": "micro-behaviors/communications/http/dynamic::dnr-external-regex-substitution-url", "conf": 0.92, "crit": 3, "desc": "External URL in regex substitution field" }, { "id": "micro-behaviors/communications/http/dynamic::dnr-main-frame-resource", "conf": 0.85, "crit": 3, "desc": "DNR main-frame resource" }, { "id": "micro-behaviors/communications/http/dynamic::dnr-redirect-action", "conf": 0.9, "crit": 3, "desc": "DNR redirect action", "spans": [ [ 1137, 16 ] ] }, { "id": "micro-behaviors/communications/http/message::http-url-literal", "conf": 0.75, "crit": 3, "desc": "HTTP URL string literal", "spans": [ [ 1264, 15 ] ] }, { "id": "micro-behaviors/communications/http/url/build::http-url-template-literal", "conf": 0.94, "crit": 3, "desc": "Builds an HTTP URL with interpolation", "spans": [ [ 1264, 91 ], [ 2075, 75 ] ] }, { "id": "micro-behaviors/data/db/web-storage::chrome-storage-area-get", "conf": 0.9, "crit": 3, "desc": "Reads from any extension storage area" }, { "id": "micro-behaviors/data/db/web-storage::chrome-storage-local-get", "conf": 0.9, "crit": 3, "desc": "Reads data from extension local storage", "spans": [ [ 331, 24 ] ] }, { "id": "micro-behaviors/data/db/web-storage::chrome-storage-local-set", "conf": 0.9, "crit": 3, "desc": "Writes data to extension local storage", "spans": [ [ 1859, 24 ] ] }, { "id": "micro-behaviors/process/hook/webextension::chrome-declarative-net-request", "conf": 0.9, "crit": 3, "desc": "WebExtension declarativeNetRequest API", "spans": [ [ 812, 28 ] ] }, { "id": "micro-behaviors/process/hook/webextension::chrome-dnr-update-dynamic-rules", "conf": 0.92, "crit": 3, "desc": "Chrome updates dynamic DNR rules", "spans": [ [ 812, 47 ] ] }, { "id": "micro-behaviors/process/hook/webextension::declarative-net-request-update", "conf": 0.92, "crit": 3, "desc": "Updates declarativeNetRequest rules", "uses": [ 23 ], "spans": [ [ 812, 47 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"" }, { "id": "metadata/lang/natural::lang-english--atom-7", "conf": 0.8, "crit": 1, "desc": "English function-word token \"this\"" }, { "id": "micro-behaviors/communications/http/dynamic::dnr-search-path-filter", "conf": 0.86, "crit": 1, "desc": "DNR rule filters a search URL path" } ], "type": "javascript" }, { "ctx": [ { "b": "DKp%tAaAy0wNxO2y:7[.b4#7uAc15[fjO*jwO#Qhga)iTz!A($e[n*pflpYBC4\u003eC$flIkAvru6ofjP3Ea$K6darR^Hb5Q?awG\u003ceTb2-5YA:@=9mSJ6YxN7^M3lQDlar\u003e(uz/P@bzEEx[b03?\u003cq!oxTv}XtLwPIKga$K6zarR^JwmY*(A+PGmx(v(kiV]RCxLzJgwQ5rdzGxJgzxK7vwmoN\u003eB0b:DB-FQnwObv[y\u0026*!vwNPQ?xF7FW3lQDlar\u003e#uA=U@kzx.a:a#7Y9h7*QrfG7aa3lQDlar\u003eJfz/fRuiV@+RarR^HarR^Ha#7#1iV]RXv@DmafekvqAbGqjed9HxarR^HarR\u003c+i3Hyab57L9zGvD/i4/e/xcF(larR^HarR^Ha#p$#iV]RXv@DmafeCvoAbGqjed9HxarR^HarR\u003c.gb{Esar\u003eJfz/fRHf!$ZvAbGqj3lQDlaBL^FarR^Hb4s$\u003cyIdWaB-7.liV@+RarR^HarR^Hb6dsoC4\u003eC$uW3BeyH}JgiV]R\u003cz/PS8AXq9Fa{]CnarV7-3lQDlar\u003el7BzkVhb03\u0026[3lQDlarR^Har\u003eucw)]*#Bye-(z/c:WaBsCrarR^HarR^HarR^Jf/yjpar\u003eJfz/fRHf/yU6zF7dA3lQDlarR^HarR^Har\u0026T4b03?\u003cx\u003e870B1Yvfe]UYva$K6zarR^HarR^HarR^JgCQdnar\u003eJfz/fRHgCQO4zF7dA3lQDlarR^HarR^Har\u0026J}i3Hyab57L9zGvD=gb{[9zF7d2arR^HarR^HEjLZFarR^HarR^JwmYvYB.(ebBzk\u0026kwG\u003ceTb2-5YA:@=9mSJ6YxN7^earR^HEjLZFarR^Jv}Y[3zdN6}wPS3dzFa2$z*2YjA+P5}B0rT/DKp(rarR^HarR\u003eHwNPQ?xKt.0z*2\u00269wPw$QaBsCrarR^HarR^HarR^JzEEx[b03?\u003cs7L?+ed9HxarR^HarR^HarR\u003exB6\u0026D?w)]*#BrS:*BAhIned9HxarR^HarR^HarR\u003etzEWP}x(mMciV]RDr7nD0a$K6zarR^HarR^HarR^JyH}^nz/PwjiV]R/wNPQ?xD!#marR^HarR^HarR^Hb4+nbx\u003e870uV*y9b03?\u003cxMOunB2\u003e%cB7F^2v}WGbA+fr9D2)L9A:@=mvq]{kzE)]yw)]\u003c%v@Dlqx\u003e869ed9HxarR^HarR^HarR\u003eHwNPQ?xKt[5y:7[.b4#7uAc15[flpYkA:@=nw].E7xNaVgvrb\u003c\u003eeN-Qje]ClxflpYkA:@=oDVJ+bA:@=ZwPzTeEiHiHarR^HarR^HarR^Hb6d)txjVdauV*y9b03?\u003cxMOunB2\u003e%czdN/$e[PcnB7/\u0026uwNPQ?xF0Uix!BpmBt4YTxeqh9B3j\u003e\u003ewNPQ?xJeL-zf7aH3lQDlarR^HaBKOtarR!Ped9HxarR\u003ewz/Z2cAaK6bx(!ufz/fRuiV}SJdMPjodLtsNwPIKgB7F^2v}WD5Aa{}xwPPNPb3=-barR^Hb5?alze16jx(v)gb03\u0026J3lQDlarR^Har\u003erlz!\u003c5#B0rdxarR^HarR^Hb6d\u003cAA:-P(a$K6zarR^HarR^JBywT1a$K6zarR^HarR^JwmYm!vrb^#x)a5.wPQ*YADL\u0026lBrSmyarR^HarR^Hb6NQcpgnrWxjk)@z/c:aarR^Ht}us9arR^JCv+k\u003cvpJ!UB8#58y?l%]wPI^jA:@W4b03\u0026J3lQDlarR^HaBsCrarR^HarR^HarR^JA+frgB-H#6B0rT/toW=\u003ez/fRHf/yU6zF7e0ed9HxarR^HarR^HarR\u003eBvru0)wPG4Rax{3LvqG:!B-Iqtj%Bn-3lQDlarR^HarR^Har\u003exwBy/uhx(v(@x\u003ehoeiV}SJdK5d9arR^HarR^HEf}8tarT@v3lQDlar\u003eVhzFrY]B97=jwPz\u003caz/c:WatTvM3i", "ln": 0, "col": 1, "line": 1 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 1529, "entropy": 4.43 }, "binary": { "peak_region_bytes": 1529, "peak_region_entropy": 4.41 } } }, "id": 7, "mol": "O₂(IS)H(Br₅)Md(Pm₅)", "path": "/usr/local/var/cyclotron/tmp.noindex/cyclotron-84c78eba/samples/216a1efa0410/oadlamjbejlcfifalhbnmhggeinoegjc.crx!!manifest.json", "pid": 0, "risk": 9, "sha": "48b46e5aaa12a8003780f5ab49f6318eedac53e0f5900ac6eaf86347951aa3d3", "size": 1529, "traits": [ { "id": "metadata/permission/cookie::permission-cookies", "conf": 0.9, "crit": 3, "desc": "Extension requests cookies permission", "spans": [ [ 1188, 62 ] ] }, { "id": "metadata/permission/cookie::permission-cookies-text", "conf": 0.9, "crit": 3, "desc": "Chrome manifest contains cookies permission", "spans": [ [ 1213, 9 ] ] }, { "id": "metadata/permission/extension-api::all-site-resources", "conf": 0.9, "crit": 3, "desc": "Extension exposes resources to all sites" }, { "id": "metadata/permission/manifest::chrome-default-search-provider", "conf": 0.95, "crit": 3, "desc": "Chrome default search provider override", "spans": [ [ 774, 4 ] ] }, { "id": "metadata/permission/manifest::chrome-search-provider-override", "conf": 0.95, "crit": 3, "desc": "Chrome search provider override", "spans": [ [ 950, 56 ] ] }, { "id": "metadata/permission/manifest::chrome-search-terms-template", "conf": 0.95, "crit": 3, "desc": "Chrome search terms template URL", "spans": [ [ 950, 56 ] ] }, { "id": "metadata/permission/manifest::extension-default-search-provider", "conf": 0.92, "crit": 3, "desc": "Extension sets a default search provider", "uses": [ 3, 4, 5 ], "spans": [ [ 774, 4 ], [ 950, 56 ] ] }, { "id": "metadata/permission/network::permission-declarative-net-request", "conf": 0.92, "crit": 3, "desc": "Declares declarativeNetRequest permission", "spans": [ [ 1188, 62 ] ] }, { "id": "metadata/permission/network::search-provider-rewrite-authority", "conf": 0.9, "crit": 3, "desc": "Search provider has request rewrite authority", "uses": [ 6, 7 ] }, { "id": "metadata/permission/storage::permission-storage", "conf": 0.9, "crit": 3, "desc": "Extension requests storage permission" }, { "id": "micro-behaviors/browser-extension/host-access/freshysearch-api.net::granted", "conf": 0.95, "crit": 3, "desc": "Manifest grants access to freshysearch-api.net" }, { "id": "micro-behaviors/browser-extension/permission/cookies::declared", "conf": 0.95, "crit": 3, "desc": "Declares \"cookies\" permission" }, { "id": "micro-behaviors/browser-extension/permission/declarative-net-request::declared", "conf": 0.95, "crit": 3, "desc": "Declares \"declarativeNetRequest\" permission" }, { "id": "micro-behaviors/browser-extension/permission/tabs::declared", "conf": 0.95, "crit": 3, "desc": "Declares \"tabs\" permission" }, { "id": "micro-behaviors/browser-extension/permission/web-navigation::declared", "conf": 0.95, "crit": 3, "desc": "Declares \"webNavigation\" permission" }, { "id": "objectives/impact/ui/manipulation/traffic::search-provider-search-token", "conf": 0.86, "crit": 3, "desc": "Search provider URL contains a search token", "spans": [ [ 950, 56 ] ] }, { "id": "objectives/impact/ui/manipulation/traffic::search-url-query-template", "conf": 0.9, "crit": 3, "desc": "Search URL query template", "spans": [ [ 950, 56 ] ] }, { "id": "objectives/supply-chain/hidden-payload/extensions/affiliate::search-api-service-host", "conf": 0.86, "crit": 3, "desc": "Search middleware service host", "spans": [ [ 950, 56 ] ] }, { "id": "objectives/supply-chain/hidden-payload/extensions/affiliate::search-provider-host-permission", "conf": 0.84, "crit": 3, "desc": "Search provider host permission" }, { "id": "metadata/permission/manifest::extension-conventional-version", "conf": 0.95, "crit": 2, "desc": "Extension version uses dotted numeric format" }, { "id": "metadata/permission/manifest::extension-description-field", "conf": 0.95, "crit": 2, "desc": "Extension declares description field" }, { "id": "metadata/permission/manifest::extension-name-field", "conf": 0.95, "crit": 2, "desc": "Extension declares name field" } ], "type": "chrome-manifest" }, { "ctx": [ { "b": "x(d*cA=+k\u0026A+PGmB0@kGx\u003c@-bCYUMMB0r4{3tBu@z/P}#v@=p5BAn\u0026Oy?WuiCv+kYwPq\u003c7B963HB0r4{3jpoYzGx[xwQ5qtjS[SNCoyEwBy/uhx(v(qdlv(Dz/fSray/tcw[+)2jS]7UarR^Hvq]{Gz/5]%zAn):w].E7xNaVgvrb\u003c\u003eeN-Qje]Clxa$K6zarR!Fx()]Oz/5]%zAn):w].E7xNaVgvrb\u003c\u003ee[n*pa$K6zarR!LnKLPZa#g(ka$K6zarR!HzFs0fByx04nKLPZa#g]ff/g):C@YLFzba+Fm]?rDs4NKqgc6C2ed9HxarUk{D2NsQar\u003eqted9HxarUVDwPA5)vrb^[B2\u003eBFb4(4jwfJMEb6n9HwG\u003ezh3vK#y3t1E7e[]iqBspTqzF0P}dlv\u003ezv@DmaBrC]MzEEZ5xjk)@z/el.B97#hwPw]wauZ\u0026\u003ewNXLGADL\u0026lBspZBBsXLAz/ff3xdk[H3s^:\u0026z/65rA=(nwx(dAlz/ec:B97\u0026by?mcfvpS[xx(!xczE)\u0026pwQ5qHx(n0lvqG:JvqYQ(wPxjY3s^:\u0026z/65rA=(nwx(dAlz/eG}vrcEjA4UNfwk3YUBy/u3AWUHzBs}SRvrcEjA7BzPwnC*$dlv(DxMw3dwIegrvOQuPx\u003eH\u003c@x(v(wz/d)Mw]zZ3pgnrWxjk)[e[5p3oLFM\u0026wO#71c#JEpx\u003eH\u003c@x(v(.x(!xczE)\u0026qi%(rFfcA+@zE)\u0026%By!#9vrrRYA+N6EfGgaHz*0lUfFUHdf/IcJh99GEav/d93i", "ln": 0, "col": 1, "line": 1 } ], "depth": 1, "facts": { "imp": [ [ "", "importScripts" ], [ "", "importScripts" ], [ "", "extension" ], [ "", "ext.init" ], [ "", "webRequest" ], [ "", "chrome.runtime.onInstalled.addListener" ], [ "", "chrome.runtime.onStartup.addListener" ], [ "", "chrome.webNavigation.onBeforeNavigate.addListener" ] ], "mbr": [ "chrome.runtime", "chrome.runtime.onInstalled", "chrome.runtime.onInstalled.addListener", "chrome.runtime.onStartup", "chrome.runtime.onStartup.addListener", "chrome.webNavigation", "chrome.webNavigation.onBeforeNavigate", "chrome.webNavigation.onBeforeNavigate.addListener", "ext.init", "ext.installHandler", "ext.startupHandler" ], "tgt": [ "chrome.runtime.onInstalled.addListener", "chrome.runtime.onStartup.addListener", "chrome.webNavigation.onBeforeNavigate.addListener", "ext.init", "extension", "importScripts", "webRequest" ], "metrics": { "ast": { "max_depth": 7, "call_count": 8, "node_count": 186, "member_count": 11, "max_array_length": 2, "max_member_depth": 4 }, "file": { "size": 617, "entropy": 5.19 }, "text": { "lines": 22, "top_char": 101, "digit_ratio": 0.06, "space_count": 52, "char_entropy": 5.19, "unique_chars": 65, "top_char_null": 0, "string_density": 0.41, "top_char_ratio": 0.08, "avg_line_length": 27.05, "max_line_length": 70, "empty_line_ratio": 0.23, "last_line_length": 45, "whitespace_ratio": 0.12, "identifier_density": 1.55, "line_length_stddev": 21.66, "max_whitespace_run": 1, "normalized_string_count": 1.92, "normalized_unique_identifiers": 4.93 }, "binds": { "count": 2 }, "binary": { "peak_region_bytes": 617, "peak_region_entropy": 5.19 }, "strings": { "bytes": 101, "count": 9, "avg_length": 11.22, "max_length": 26, "avg_entropy": 2.64, "domain_count": 2, "entropy_stddev": 1.26 }, "comments": { "chars": 43, "count": 1, "lines": 1, "to_code_ratio": 0.05 }, "identifiers": { "count": 34, "unique": 22, "avg_length": 9.68, "max_length": 18, "min_length": 3, "avg_entropy": 2.78, "reuse_ratio": 0.65, "length_stddev": 4.02, "all_lowercase_ratio": 0.27 } } }, "id": 8, "mol": "H₂(BrPo)", "path": "/usr/local/var/cyclotron/tmp.noindex/cyclotron-84c78eba/samples/216a1efa0410/oadlamjbejlcfifalhbnmhggeinoegjc.crx!!worker.js", "pid": 0, "risk": 2, "sha": "ca2ce97c69a84cd17b8530256787b501ac18589b86c6ba9382f2f34ef06085a7", "size": 617, "traits": [ { "id": "micro-behaviors/browser-extension/lifecycle::chrome-namespace-core", "conf": 0.95, "crit": 3, "desc": "Uses core Chrome extension APIs" }, { "id": "micro-behaviors/browser-extension/lifecycle::chrome-runtime-api", "conf": 0.9, "crit": 3, "desc": "Uses the Chrome runtime API", "spans": [ [ 381, 16 ] ] }, { "id": "micro-behaviors/browser-extension/lifecycle::chrome-runtime-on-installed", "conf": 0.9, "crit": 3, "desc": "Handles browser extension install or update", "spans": [ [ 381, 38 ] ] }, { "id": "micro-behaviors/browser-extension/lifecycle::chrome-runtime-on-startup", "conf": 0.9, "crit": 3, "desc": "Registers a browser-startup listener", "spans": [ [ 441, 36 ] ] }, { "id": "micro-behaviors/browser-extension/lifecycle::chrome-webnavigation-api", "conf": 0.9, "crit": 3, "desc": "References the WebExtension webNavigation API" }, { "id": "micro-behaviors/browser-extension/lifecycle::chrome-webnavigation-before-navigate", "conf": 0.9, "crit": 3, "desc": "Observes navigation before it starts", "spans": [ [ 499, 37 ] ] }, { "id": "micro-behaviors/process/interpreter/scripting::worker-importscripts-call", "atk": "T1059.007", "mbc": "C0017", "conf": 0.92, "crit": 3, "desc": "Worker imports additional scripts" } ], "type": "javascript" }, { "ctx": [ { "b": "tydM8wPIv4x(Ffdz/c:Wb6m\u003cpwOtH[xDRn9AV!$dy?j!wb6dEhzE)u=v@DmbwO#Pli^S5\u0026vr(WcvpQMyb4V3(ygn}QfJ}KnfJZ8zxK-/hy?4-ZhDIXQx\u003c2p$C3cOxw[9PjhD\u003c3JhCMUahbm\u003efx\u003ca2yzDZdqfIc1$x\u003e5]ixIAkwgd=h7x\u003cbv\u0026B6qWux?@L!h+v)NxK\u003cRCx?@CnA9j}RBZ]XRCUI{=BZ){0zB[L^x\u003e80uC4s65z={gqz+jXZx?-tQAaJ=UBy^{4sYEd(mPJG4hDrdCzco\u003c@qCy%[BxHsUo\u003e4%1oib1-D1o@?lq*{4pFKw(fL2D3izq$+x\u003e6U5fKWsuhC4+4ygn}QDq5SNge8NLBY%5ZB4HmwC49m9w)[h0DsofjhC4W]Ct}4bzCs$uzbBn4oKPUJzDom%p/h1Aye]N-qb7?sgG[KeC#OPXf\u003eBxCC#FG$nlOC.ByXD]x\u003eyp*h+v)NxK\u003cRCx?@CnA9j}RBZ]XRDqe9hCvCA0x?Q(^D15J?fJZ8zxK-/gx?@CnBXUw2t2[6ChcIXaA+5@@fL9:eA.P8vA8!OYm}Cj(z^2O0ygn@yq=tFQC#vQdr-zHFp*#dZg!zNsB7GR?CuF3Cz+jXZx\u003c\u003e7rC4bt-C1$CrBZ){0zB[L^x\u003e80uC4s65z={gqz+jXZx?\u0026C2Ctq)xA8Fz\u003erAI4PfKWy*hdYr%C#wAEr+kxhpFCXfpfgLdyG:h1xJYaGrAz.8q+/\u003eTg!*tfizq$+x\u003e6U5fKWsuhC4+gA9l)ny?ldmBZYeZx?Q(^D15J?fJZ8zxK-/gx?@Cnm{e!*f\u003er^DrATflpe\u003ej\u003eByN*3z++4Fpe#dmyGUBNC2IvMg/4j\u0026swq**zc6!tpF\u003e[1g!{Ctt1JP=B7GR?CuF3Cz+jXZx\u003c%OGx?Qr[y/$NDy?3NFy?2m#BZYeZx?Q(^D15J?fJZ8zxK-/gx?@Cmg/Mkdr8NKCfJG(5oib\u003etBY{Lkgf571w=", "ln": 0, "col": 1, "line": 1 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 2079, "entropy": 5.98 }, "json": { "parsed_bytes": 2079, "parse_limit_bytes": 76800 }, "binary": { "peak_region_bytes": 2048, "peak_region_entropy": 6.01 } } }, "id": 9, "mol": "H(Db)", "path": "/usr/local/var/cyclotron/tmp.noindex/cyclotron-84c78eba/samples/216a1efa0410/oadlamjbejlcfifalhbnmhggeinoegjc.crx!!_metadata/verified_contents.json", "pid": 0, "risk": 1, "sha": "80ff910b1e9cb1b6576b0a59864e83837649f47a4e734a06cdd711221e9f5b4e", "size": 2079, "traits": [ { "id": "micro-behaviors/data/serialize/schema-object::files-object-field", "conf": 0.8, "crit": 3, "desc": "JSON files object field" } ], "type": "json" } ], "v": "8" } }