{ "ml": { "v": "7", "eng": "2.1.0", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.000015775362, "rte": "az", "prob": 0.000015775362 }, { "cls": 0, "raw": 0.00067320466, "rte": "az/zip", "prob": 0.00067320466 } ], "prob": 0.000015775362, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.000015775362044223584, "type": "zip" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.00001432498265785398, "type": "lua" } ], "version": "v18.18", "analyzed_at": "2026-06-23T16:21:34Z" }, "path": "crayon-0.5-1.src.rock", "raw": { "files": [ { "id": 0, "ctx": [ { "b": "p!H([6Awak2MPYQpd+Y%W9!pw005q=000-l8#%F?vr(^eeIF!meIO\u003e#z!0N7AaJJVr0-KbA)ZQ-A)ZQ-", "ln": 0 } ], "mol": "O(Er)", "sha": "43a22e88bffb6ab1ac61bd185754354915f04c493eb637e037c253d4be69ee14", "path": "crayon-0.5-1.src.rock", "risk": 1, "size": 2744, "type": "zip", "facts": { "metrics": { "file": { "size": 2744.0, "entropy": 7.81, "size_bytes": 2744.0 }, "binary": { "overall_entropy": 7.81 }, "archive": { "file_count": 2.0, "member_count": 2.0, "script_count": 1.0, "zip_bomb_ratio": 5.16, "directory_count": 0.0, "executable_count": 0.0, "extra_field_size": 48.0, "noise_file_count": 0.0, "total_compressed": 2404.0, "compression.ratio": 0.21, "hidden_file_count": 0.0, "total_uncompressed": 11592.0, "crc_collision_count": 0.0, "entry_comment_count": 0.0, "max_filename_length": 21.0, "rtlo_filename_count": 0.0, "format.regular_count": 2.0, "nested_archive_count": 0.0, "path_traversal_count": 0.0, "symlink_escape_count": 0.0, "security.setgid_count": 0.0, "security.setuid_count": 0.0, "security.sticky_count": 0.0, "double_extension_count": 0.0, "duplicate_member_count": 0.0, "security.symlink_count": 0.0, "unicode_filename_count": 0.0, "homoglyph_filename_count": 0.0, "security.encrypted_count": 0.0, "timing.mtime_unique_count": 1.0, "timing.mtime_unique_ratio": 0.5, "misplaced_executable_count": 0.0, "timing.mtime_dominant_count": 2.0, "timing.mtime_spread_seconds": 0.0, "timing.sentinel_mtime_count": 0.0, "security.world_writable_count": 0.0, "timing.mtime_dominant_fraction": 1.0, "compression.method_counts.deflate": 2.0 }, "consistency": { "extension_content_mismatch": 1.0, "extension_content_mismatch.archive_as_unknown": 1.0 } } }, "traits": [ { "id": "objectives/evasion/indicator-removal/logs::lua-open-write-mode", "atk": "T1070.002", "conf": 0.8199999928474426, "crit": 3, "desc": "Lua opens file in write mode", "from": [ { "file": 1 } ] }, { "id": "objectives/impact/destroy/keywords::delete-verb--delete", "conf": 0.8999999761581421, "crit": 1, "desc": "Destructive-action word: delete", "from": [ { "file": 1 } ] } ] }, { "ctx": [ { "b": "y\u0026r/(y-)+fADL\u0026lBAnM/aAz4kB.L(cc)AXyADL\u0026lBAnSP", "ln": 1, "addr": 0 }, { "b": "y\u0026r/(y-)!qv@2T$auZ\u0026/wPq\u003cbA+cTyB8LM7wPPaB", "ln": 2, "addr": 37 }, { "b": "y\u0026r/(y-)Flz/cWXaAz4kB.L(cc)@ItB8L}GB75V(cN/", "ln": 3, "addr": 70 }, { "b": "arR^HzfdyquT)IXy-\u003e\u003e-w{503BzkVhc$u:raztXmBz+J7wH[%yz/P}G", "ln": 15, "addr": 268 }, { "b": "arR^HarR^Hy\u0026r/(y-)!gy?s!MaBwI", "ln": 16, "addr": 313 }, { "b": "arR^HarR^HB7GDgwPRv5vpB4:d05%ow?k5(A::lizBnkOwO#Ps", "ln": 17, "addr": 337 }, { "b": "", "ln": 18, "addr": 378 }, { "b": "arR^HarR^HB7Gf1e[/fABz+J7wGTbUxM4%lzEEx[aA8oyb5zgcvqGQ}B95P", "ln": 19, "addr": 379 }, { "b": "arR^HarR^HB7Gf1e]U-HBrAZ?AbP=saA8oyi5\u0026(T", "ln": 20, "addr": 427 }, { "b": "arR^HarR^HB7Gf1e{hhJauZ\u0026*wO+%hxM4%lzEEx[atbn?b03[\u003ce?On*z/Z2vx(mMiB7Gf1e]U-HBsv", "ln": 21, "addr": 460 }, { "b": "arR^HarR^HarR^HA+funA=91vBAh8kxd!mFvKMqey?tqxA+)oYeot]Nx(mMoy?mGjAa9\u003cgwPzVqdlP?kvruQ5A=7", "ln": 25, "addr": 602 }, { "b": "arR^HarR^HwO#2", "ln": 26, "addr": 673 }, { "b": "arR^HarR^Hx\u003ewG9z/^9IB-IqtByxiiB9ztuxEC6rBAzE.fe1H#aA8oyB-IqtByxiiB9ztuxEC6rBAzFyiXJcgdjDxYxK#5", "ln": 27, "addr": 685 }, { "b": "arR^HarR^HarR^HB7Gf1e{hhJauZ?\u003exMOuniXJcgatbn?B7Gf1e{hhJ", "ln": 28, "addr": 761 }, { "b": "arR^HarR^HwO#2", "ln": 29, "addr": 806 }, { "b": "arR^HarR^HarR^HarR^HarR^Ve*bmYAaHCxA9)G\u003ezdLdse?Om\u003ce*q.", "ln": 83, "addr": 2747 }, { "b": "arR^HarR^HADL\u0026kC{2l)a$)FnByuu", "ln": 84, "addr": 2791 }, { "b": "arR^HarR^Hy\u0026r/(y-):vjS[=RADL\u0026lBAo6BwO+}1wQs", "ln": 85, "addr": 2815 }, { "b": "arR^HarR^HarR^HB-IpvjS[/Sy?tqxA+)uXADL\u0026kC}n", "ln": 86, "addr": 2850 }, { "b": "arR^HarR^HarR^HAa9=}zf3*.aBwuLauZ\u0026(A9)G\u003ezdOa", "ln": 87, "addr": 2885 }, { "b": "arR^HarR^HwO#2", "ln": 317, "addr": 10218 }, { "b": "", "ln": 318, "addr": 10230 }, { "b": "arR^HarR^Hy\u0026r/(y-)sjjS[DSe]LYuzyxahy?mG)zdLmvb6LjW", "ln": 319, "addr": 10231 }, { "b": "arR^HarR^Hw\u0026+cRx()]mAXqDBCYUw", "ln": 320, "addr": 10272 }, { "b": "arR^HarR^Hw\u0026:Brz/YFrdf", "ln": 321, "addr": 10296 } ], "depth": 1, "facts": { "imp": [ [ "", "require" ], [ "", "require" ], [ "", "require" ], [ "", "setmetatable" ], [ "", "tostring" ], [ "", "string.sub" ], [ "", "string.len" ], [ "", "urlstartswith" ], [ "", "urlstartswith" ], [ "", "pcall" ], [ "", "tostring" ], [ "", "error" ], [ "", "error" ], [ "", "tonumber" ], [ "", "tostring" ], [ "", "error" ], [ "", "error" ], [ "", "setmetatable" ], [ "", "requests.get" ], [ "", "error" ], [ "", "r.json" ], [ "", "assert" ], [ "", "type" ], [ "", "type" ], [ "", "CrayonExperiment" ], [ "", "assert" ], [ "", "type" ], [ "", "type" ], [ "", "CrayonExperiment" ], [ "", "assert" ], [ "", "type" ], [ "", "type" ], [ "", "requests.delete" ], [ "", "error" ], [ "", "pairs" ], [ "", "setmetatable" ], [ "", "setmetatable" ], [ "", "setmetatable" ], [ "", "error" ], [ "", "init_from_file" ], [ "", "init_empty" ], [ "", "init_from_existing" ], [ "", "setmetatable" ], [ "", "requests.post" ], [ "", "json.encode" ], [ "", "error" ], [ "", "requests.get" ], [ "", "error" ], [ "", "r.json" ], [ "", "update_steps" ], [ "", "update_steps" ], [ "", "io.open" ], [ "", "assert" ], [ "", "requests.post" ], [ "", "error" ], [ "", "get_name_list" ], [ "", "socket.gettime" ], [ "", "requests.post" ], [ "", "error" ], [ "", "pairs" ], [ "", "assert" ], [ "", "type" ], [ "", "type" ], [ "", "self.add_scalar_value" ], [ "", "requests.get" ], [ "", "error" ], [ "", "r.json" ], [ "", "get_name_list" ], [ "", "socket.gettime" ], [ "", "check_histogram_data" ], [ "", "requests.post" ], [ "", "error" ], [ "", "requests.get" ], [ "", "error" ], [ "", "r.json" ], [ "", "error" ], [ "", "pairs" ], [ "", "error" ], [ "", "pairs" ], [ "", "error" ], [ "", "tostring" ], [ "", "socket.gettime" ], [ "", "requests.get" ], [ "", "error" ], [ "", "io.open" ], [ "", "requests.get" ], [ "", "error" ], [ "", "r.json" ], [ "", "pairs" ], [ "", "print" ], [ "", "eval_function" ], [ "", "print" ], [ "", "cjson.safe" ], [ "", "requests" ], [ "", "socket" ] ], "mbr": [ "CrayonClient.__index", "CrayonExperiment.__index", "io.open", "json.encode", "mt.__call", "r.json", "r.status_code", "r.text", "requests.delete", "requests.get", "requests.post", "self.add_scalar_value", "self.client", "self.client.url", "self.get_histogram_values", "self.get_scalar_values", "self.hist_steps", "self.hostname", "self.port", "self.scalar_steps", "self.url", "self.xp_name", "socket.gettime", "string.len", "string.sub" ], "tgt": [ "CrayonExperiment", "__check_histogram_data", "__get_name_list", "__init_empty", "__init_from_existing", "__init_from_file", "__update_steps", "assert", "error", "eval_function", "io.open", "json.encode", "pairs", "pcall", "print", "r.json", "requests.delete", "requests.get", "requests.post", "require", "self.add_scalar_value", "setmetatable", "socket.gettime", "string.len", "string.sub", "tonumber", "tostring", "type", "urlstartswith" ], "metrics": { "ast": { "op.eq": 6.0, "op.gt": 1.0, "op.add": 3.0, "op.lor": 4.0, "op.land": 1.0, "op.lnot": 11.0, "max_depth": 19.0, "bind_count": 83.0, "call_count": 98.0, "node_count": 3128.0, "member_count": 25.0, "op_density.eq": 0.0, "op_density.gt": 0.0, "op_density.add": 0.0, "op_density.lor": 0.0, "op_density.land": 0.0, "op_density.lnot": 0.0, "identifier_count": 108.0, "member_depth_max": 3.0, "string_literal_count": 85.0, "array_literal_max_length": 5.0, "string_concat_chain_max_length": 2.0 }, "file": { "size": 11186.0, "entropy": 4.28, "size_bytes": 11186.0 }, "text": { "digit_ratio": 0.01, "space_count": 3410.0, "total_lines": 354.0, "char_entropy": 4.28, "unique_chars": 66.0, "string_density": 0.24, "avg_line_length": 30.6, "max_line_length": 103.0, "empty_line_ratio": 0.12, "last_line_length": 1.0, "whitespace_ratio": 0.34, "most_common_ratio": 0.07, "identifier_density": 1.82, "line_length_stddev": 22.94, "normalized_string_count": 4.52, "repeated_char_sequences": 98.0, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 1.0, "most_common_char_codepoint": 101.0, "suspicious_identifier_ratio": 0.03, "normalized_unique_identifiers": 12.75 }, "binds": { "count": 83.0 }, "calls": { "count": 98.0 }, "binary": { "overall_entropy": 4.28 }, "source": { "function_count": 1.0 }, "imports": { "count": 3.0, "unique_modules": 3.0, "third_party_count": 3.0, "third_party_ratio": 1.0 }, "members": { "count": 25.0 }, "strings": { "total": 85.0, "url_count": 3.0, "avg_length": 14.59, "max_length": 68.0, "path_count": 11.0, "avg_entropy": 2.25, "total_bytes": 1240.0, "entropy_stddev": 1.47 }, "comments": { "chars": 220.0, "lines": 10.0, "total": 10.0, "to_code_ratio": 0.03 }, "functions": { "count": 1.0 }, "identifiers": { "count": 108.0, "total": 644.0, "avg_length": 8.07, "max_length": 22.0, "min_length": 1.0, "avg_entropy": 2.35, "reuse_ratio": 0.17, "unique_count": 108.0, "length_stddev": 5.28, "sequential_names": 3.0, "single_char_count": 4.0, "single_char_ratio": 0.04, "high_entropy_count": 7.0, "high_entropy_ratio": 0.06, "all_lowercase_ratio": 0.98, "all_uppercase_ratio": 0.01, "double_underscore_count": 1.0, "underscore_prefix_count": 10.0 } } }, "id": 1, "mol": "O(Er)", "path": "crayon-0.5-1.src.rock!!crayon.lua", "risk": 1, "sha": "38a826898c8b84fba938b289ae657cd665092b71aa3de5fb51360e532e725105", "size": 11186, "traits": [ { "id": "objectives/evasion/indicator-removal/logs::lua-open-write-mode", "atk": "T1070.002", "conf": 0.8199999928474426, "crit": 3, "desc": "Lua opens file in write mode", "spans": [ [ 10249, 21 ] ] }, { "id": "objectives/impact/destroy/keywords::delete-verb--delete", "conf": 0.8999999761581421, "crit": 1, "desc": "Destructive-action word: delete", "spans": [ [ 2842, 6 ] ] } ], "type": "lua" } ], "rev": "b520a", "v": "8" } }