{
  "llm": {
    "conf": 0.99992365,
    "grade": "hostile",
    "model": "Qwen/Qwen3.6-27B",
    "review": false,
    "outcome": "hostile",
    "interpretation": "Staged loader and steganography detected"
  },
  "ml": {
    "v": "7",
    "eng": "2.2.0-beta.1",
    "lvl": 0,
    "conf": 100,
    "mods": [
      {
        "cls": 2,
        "raw": 0.9998909,
        "rte": "az",
        "prob": 0.9998909
      }
    ],
    "prob": 0.9998909,
    "files": [
      {
        "id": 0,
        "lvl": 0,
        "conf": 100,
        "prob": 0.999890923500061,
        "type": "crx"
      },
      {
        "id": 1,
        "lvl": -1,
        "conf": 0,
        "prob": 0.000012993812561035156,
        "type": "json"
      },
      {
        "id": 2,
        "lvl": -1,
        "conf": 0,
        "prob": 0.000033408403396606445,
        "type": "png"
      },
      {
        "id": 3,
        "lvl": -1,
        "conf": 0,
        "prob": 0.9990013837814331,
        "type": "png"
      },
      {
        "id": 4,
        "lvl": -1,
        "conf": 0,
        "prob": 0.000041365623474121094,
        "type": "png"
      },
      {
        "id": 5,
        "lvl": -1,
        "conf": 0,
        "prob": 0.000041365623474121094,
        "type": "png"
      },
      {
        "id": 6,
        "lvl": -1,
        "conf": 0,
        "prob": 0.00006663799285888672,
        "type": "json"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-07-05T23:02:52Z"
  },
  "path": "afglinofhnngepadnicjigajdehmdepp.crx",
  "raw": {
    "files": [
      {
        "id": 0,
        "ctx": [
          {
            "b": "lVK}s0@@r39T8Jz608iyRueD60u%ib1{(=lnqu\u003cF0rAi800v/N4/!qn0sw)W0rAgY}[Dw{v/",
            "n": [
              {
                "c": 3,
                "d": "Staged loader six file archive",
                "i": "objectives/command-and-control/backdoor/loader/archive::staged-loader-six-files",
                "o": 0,
                "z": 25,
                "cf": 0.949999988079071
              }
            ],
            "ln": 0
          }
        ],
        "mol": "O₂(AsC)",
        "sha": "59719af7fb92bba85ff6841705dcd51bef60499c5637bd94206b52eaa23adebf",
        "path": "afglinofhnngepadnicjigajdehmdepp.crx",
        "risk": 34,
        "size": 799743,
        "type": "crx",
        "facts": {
          "metrics": {
            "file": {
              "size": 799743.0,
              "entropy": 7.99,
              "size_bytes": 799743.0
            },
            "binary": {
              "overall_entropy": 7.99,
              "peak_region_bytes": 795648.0,
              "peak_region_entropy": 7.85
            },
            "archive": {
              "file_count": 6.0,
              "member_count": 8.0,
              "prefix_bytes": 1322.0,
              "script_count": 0.0,
              "zip_bomb_ratio": 3.86,
              "directory_count": 2.0,
              "executable_count": 0.0,
              "extra_field_size": 360.0,
              "noise_file_count": 0.0,
              "total_compressed": 796603.0,
              "compression.ratio": 1.0,
              "hidden_file_count": 0.0,
              "total_uncompressed": 797773.0,
              "crc_collision_count": 0.0,
              "entry_comment_count": 0.0,
              "max_filename_length": 32.0,
              "rtlo_filename_count": 0.0,
              "format.regular_count": 6.0,
              "nested_archive_count": 0.0,
              "path_traversal_count": 0.0,
              "symlink_escape_count": 0.0,
              "security.setgid_count": 0.0,
              "security.setuid_count": 0.0,
              "security.sticky_count": 0.0,
              "double_extension_count": 0.0,
              "duplicate_member_count": 0.0,
              "format.directory_count": 2.0,
              "security.symlink_count": 0.0,
              "unicode_filename_count": 0.0,
              "homoglyph_filename_count": 0.0,
              "security.encrypted_count": 0.0,
              "timing.mtime_unique_count": 1.0,
              "timing.mtime_unique_ratio": 0.13,
              "misplaced_executable_count": 0.0,
              "timing.mtime_dominant_count": 8.0,
              "timing.mtime_spread_seconds": 0.0,
              "timing.sentinel_mtime_count": 0.0,
              "security.world_writable_count": 0.0,
              "timing.mtime_dominant_fraction": 1.0,
              "compression.method_counts.deflate": 8.0
            }
          }
        },
        "ident": {
          "trust": "self_signed",
          "identifier": {
            "value": "lfoeajgcchlidpicbabpmckkejpckcfb",
            "source": "crx.extension_id",
            "verified": true
          },
          "unique_ids": {
            "crx_id": "lfoeajgcchlidpicbabpmckkejpckcfb",
            "public_key_sha256": "b5e4096227b83f82101fc2aa49f2a251accde3d98471464dd17d1819b43786b0"
          }
        },
        "traits": [
          {
            "id": "objectives/anti-static/obfuscation/steganography/image::lsb-steganography-rgb-pattern",
            "atk": "T1027.003",
            "mbc": "B0032.001",
            "conf": 0.800000011920929,
            "crit": 4,
            "desc": "LSB stego pattern (RGB high + low-edge + entropy)",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "objectives/anti-static/obfuscation/steganography/image::b-channel-high",
            "atk": "T1027.003",
            "mbc": "B0032.001",
            "conf": 0.6000000238418579,
            "crit": 1,
            "desc": "Blue channel entropy above normal",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "objectives/anti-static/obfuscation/steganography/image::g-channel-high",
            "atk": "T1027.003",
            "mbc": "B0032.001",
            "conf": 0.6000000238418579,
            "crit": 1,
            "desc": "Green channel entropy above normal",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "objectives/anti-static/obfuscation/steganography/image::high-pixel-entropy",
            "atk": "T1027.003",
            "mbc": "B0032.001",
            "conf": 0.699999988079071,
            "crit": 1,
            "desc": "Image pixel entropy in steganographic range",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "objectives/anti-static/obfuscation/steganography/image::r-channel-high",
            "atk": "T1027.003",
            "mbc": "B0032.001",
            "conf": 0.6000000238418579,
            "crit": 1,
            "desc": "Red channel entropy above normal",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "metadata/image/metrics::low-edge-density",
            "conf": 0.6499999761581421,
            "crit": 1,
            "desc": "Low image edge density metric",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "metadata/permission/manifest::chrome-webstore-verified-contents",
            "conf": 0.949999988079071,
            "crit": 1,
            "desc": "Chrome Web Store verified contents"
          },
          {
            "id": "objectives/command-and-control/backdoor/loader/archive::staged-loader-six-files",
            "conf": 0.949999988079071,
            "crit": 3,
            "desc": "Staged loader six file archive",
            "spans": [
              [
                0,
                25
              ]
            ]
          },
          {
            "id": "metadata/permission/manifest::chrome-theme-tab-background-image",
            "conf": 0.949999988079071,
            "crit": 1,
            "desc": "Chrome theme tab background"
          },
          {
            "id": "metadata/permission/manifest::chrome-theme-toolbar-image",
            "conf": 0.949999988079071,
            "crit": 1,
            "desc": "Chrome theme toolbar image"
          },
          {
            "id": "metadata/permission/manifest::chrome-theme-frame-image",
            "conf": 0.949999988079071,
            "crit": 1,
            "desc": "Chrome theme frame image"
          },
          {
            "id": "metadata/permission/manifest::chrome-theme-ntp-background-image",
            "conf": 0.949999988079071,
            "crit": 1,
            "desc": "Chrome theme NTP background"
          },
          {
            "id": "metadata/signed/platform::web-extension-manifest",
            "conf": 1.0,
            "crit": 1,
            "desc": "Web-extension manifest.json at archive root"
          },
          {
            "id": "metadata/permission/manifest::chrome-theme-image-asset",
            "conf": 0.9599999785423279,
            "crit": 1,
            "desc": "Chrome theme image asset"
          }
        ]
      },
      {
        "ctx": [
          {
            "b": "DJ",
            "n": [
              {
                "c": 2,
                "d": "JSON data format",
                "i": "metadata/file/format::valid",
                "o": 0,
                "z": 13,
                "cf": 0.6000000238418579
              }
            ],
            "ln": 1,
            "addr": 0
          },
          {
            "b": "b6v\u003cnvru6/B-IpxiV]RWBAzFyiXJc@y?WD#BAoh\u0026xk.Z3y?kkez/4dGwPz%dv}vroAaAy0wIL]GA^e=V",
            "ln": 2,
            "addr": 2
          },
          {
            "b": "b5Q?awG\u003ceVs7#L]wPzQ3zF9J6Cvtr7Aa9Y%A=SAQb6EKrB7]Mgb03]5e?!F2b4Lnav@=p5BzkVhb03]ExK@rfx(!A9y-)Ljz!*Ftx([2hs7#L]wPzQ3zF9J6mR)0!wPz\u0026mB97\u0026dwoe(iB-X:Ix([2hx([zsvSDf}xML^FA+P2%ayPd#aA?EdA:-\u003ccaBdKmy\u0026sIuv@Dg4AXnK!b5H+ax\u003ey{$Byfi5A=U@kzx.a$efYgHwO(05i^S5+zdd6*B0rU(b6mHfzdN6^A:-/@b03]Zzdd6*B6HwuxK#3(uUjs!zdLtszF7dAb6mHfzdN6@z/oD3vr9LMb57[5xjVc?fly(szdN6@z/oD3vr9#tzF7dAb6mHfzdN6@vpAOMvpK7=A=l8rwfK5Ux(do\u003ewPI9fBzbl5wNxK/vQAOMv@2Z$z/]@de]UYva$K{WxK#3(uV6$8uT^CNyIdWaB-7.liWeoPvp%d)tRyhjwO(0=zGG\u00268vQS+Zxl4{kzE+wszF7ewefXOxy\u0026sunb075{w].r%wG\u003cftgbpKmf/.3vf!+v*efYgOz!@(\u003eAW0LGh.({xh.l*ut}vgwvpAO=wQ5qvi:ju{fF1}sgB$mmgf(BPBywS=vQS+Zxl4{kzE^9@wQ5qvi:jJ#eh/Brh85q!b4tFeyI^H2yHqf{CYUb\u003ctqv@/ehodvehn?lt}vgqBz$O@vpK7=A=l8rwfK6sgbQ{ugbQ{ugbQ{{efX$NA9)Y#CYUb\u003ctqX8=h83NsfKljNzGG\u00268y?W^5b05{^ehYpof!\u003eN(efXLCBAzCsuT^CNyIdWaB-7.li:jo?fF1[efKo8Tb6mKpBAnS!DM({wBAzCsB0rUHfFk7oeheXmgB$jjhzXS!efY4Nz/xodBzkrcb075{zGG\u00268vQS+Zxl4{kzE^9.y?WK1zdNQbb03]Sz/*8tz6yIPzGG\u00268vQS+Zxl4{kzE^9{wPhi?BrS:\u0026zF}aEwPhi?BrVcYEe",
            "ln": 3,
            "addr": 67
          }
        ],
        "depth": 1,
        "facts": {
          "metrics": {
            "file": {
              "size": 844.0,
              "entropy": 5.04,
              "size_bytes": 844.0
            },
            "json": {
              "parsed_bytes": 844.0,
              "parse_limit_bytes": 76800.0
            },
            "binary": {
              "overall_entropy": 5.04,
              "peak_region_bytes": 844.0,
              "peak_region_entropy": 5.04
            }
          }
        },
        "id": 1,
        "path": "afglinofhnngepadnicjigajdehmdepp.crx!!manifest.json",
        "risk": 1,
        "sha": "fba722dd7d176c1fdb3e053fdabb34980e29afa295cdbbcf9fb384318de71798",
        "size": 844,
        "traits": [
          {
            "id": "metadata/package/manifest/ecosystem::conda-about-description-field",
            "conf": 0.9200000166893005,
            "crit": 1,
            "desc": "Conda about long description",
            "spans": [
              [
                115,
                99
              ]
            ]
          },
          {
            "id": "metadata/file/format::valid",
            "conf": 0.6000000238418579,
            "crit": 2,
            "desc": "JSON data format",
            "spans": [
              [
                0,
                13
              ]
            ]
          },
          {
            "id": "metadata/file/extension/identity::web-asset-extension",
            "conf": 1.0,
            "crit": 1,
            "desc": "Web asset file extension (css/html/js/json)",
            "spans": [
              [
                0,
                13
              ]
            ]
          }
        ],
        "type": "json"
      },
      {
        "depth": 1,
        "facts": {
          "metrics": {
            "png": {
              "a_entropy": 0.0,
              "chunk_count": 4.0,
              "trailing_bytes": 0.0,
              "idat_chunk_count": 1.0,
              "text_chunk_bytes": 0.0,
              "chunks_after_iend": 0.0,
              "compression_ratio": 0.0,
              "unknown_chunk_count": 0.0
            },
            "file": {
              "size": 452.0,
              "entropy": 3.3,
              "size_bytes": 452.0
            },
            "image": {
              "width": 20.0,
              "height": 1920.0,
              "channels": 3.0,
              "b_entropy": 0.0,
              "g_entropy": 0.0,
              "r_entropy": 0.0,
              "edge_density": 0.0,
              "pixel_entropy": 1.58,
              "histogram_flatness": 0.2
            },
            "binary": {
              "overall_entropy": 3.3,
              "peak_region_bytes": 452.0,
              "peak_region_entropy": 3.3
            }
          }
        },
        "id": 2,
        "path": "afglinofhnngepadnicjigajdehmdepp.crx!!images/theme_frame.png",
        "sha": "91e578a42d350befa459d5cd88f9a0a81916f00ee7c04c19a5040d49bbcc2a00",
        "size": 452,
        "traits": [
          {
            "id": "metadata/package/files/included::png-extension-basename",
            "conf": 0.8999999761581421,
            "crit": 1,
            "desc": "Filename ends with .png",
            "spans": [
              [
                0,
                15
              ]
            ]
          }
        ],
        "type": "png"
      },
      {
        "ctx": [
          {
            "b": "Ibl@q4gj0X0000dnK#lE000gE0006O2M:#a0jfUe)/is/ay^@uo-Lftcia3@GA82G0001H\u003eL$",
            "n": [
              {
                "c": 4,
                "d": "LSB stego pattern (RGB high + low-edge + entropy)",
                "i": "objectives/anti-static/obfuscation/steganography/image::lsb-steganography-rgb-pattern",
                "o": 0,
                "z": 25,
                "cf": 0.800000011920929
              }
            ],
            "ln": 0
          }
        ],
        "depth": 1,
        "facts": {
          "metrics": {
            "png": {
              "a_entropy": 0.0,
              "chunk_count": 34.0,
              "trailing_bytes": 0.0,
              "idat_chunk_count": 25.0,
              "text_chunk_bytes": 114.0,
              "chunks_after_iend": 0.0,
              "compression_ratio": 0.34,
              "unknown_chunk_count": 0.0
            },
            "file": {
              "size": 794391.0,
              "entropy": 7.99,
              "size_bytes": 794391.0
            },
            "image": {
              "width": 1400.0,
              "height": 560.0,
              "channels": 3.0,
              "b_entropy": 7.25,
              "g_entropy": 7.61,
              "r_entropy": 7.7,
              "edge_density": 0.01,
              "pixel_entropy": 7.72,
              "histogram_flatness": 0.96
            },
            "binary": {
              "overall_entropy": 7.99,
              "peak_region_bytes": 794391.0,
              "peak_region_entropy": 7.85
            }
          }
        },
        "id": 3,
        "mol": "O(As)",
        "path": "afglinofhnngepadnicjigajdehmdepp.crx!!images/theme_ntp_background.png",
        "risk": 33,
        "sha": "fdb3064306dbaa25d0e6ae9c5b60cdf6f557a5cc934680f35dabc458df695c82",
        "size": 794391,
        "traits": [
          {
            "id": "objectives/anti-static/obfuscation/steganography/image::high-pixel-entropy",
            "atk": "T1027.003",
            "mbc": "B0032.001",
            "conf": 0.699999988079071,
            "crit": 1,
            "desc": "Image pixel entropy in steganographic range",
            "spans": [
              [
                0,
                26
              ]
            ]
          },
          {
            "id": "objectives/anti-static/obfuscation/steganography/image::b-channel-high",
            "atk": "T1027.003",
            "mbc": "B0032.001",
            "conf": 0.6000000238418579,
            "crit": 1,
            "desc": "Blue channel entropy above normal",
            "spans": [
              [
                0,
                22
              ]
            ]
          },
          {
            "id": "objectives/anti-static/obfuscation/steganography/image::g-channel-high",
            "atk": "T1027.003",
            "mbc": "B0032.001",
            "conf": 0.6000000238418579,
            "crit": 1,
            "desc": "Green channel entropy above normal",
            "spans": [
              [
                0,
                22
              ]
            ]
          },
          {
            "id": "objectives/anti-static/obfuscation/steganography/image::r-channel-high",
            "atk": "T1027.003",
            "mbc": "B0032.001",
            "conf": 0.6000000238418579,
            "crit": 1,
            "desc": "Red channel entropy above normal",
            "spans": [
              [
                0,
                22
              ]
            ]
          },
          {
            "id": "metadata/image/metrics::low-edge-density",
            "conf": 0.6499999761581421,
            "crit": 1,
            "desc": "Low image edge density metric",
            "spans": [
              [
                0,
                25
              ]
            ]
          },
          {
            "id": "objectives/anti-static/obfuscation/steganography/image::lsb-steganography-rgb-pattern",
            "atk": "T1027.003",
            "mbc": "B0032.001",
            "conf": 0.800000011920929,
            "crit": 4,
            "desc": "LSB stego pattern (RGB high + low-edge + entropy)",
            "spans": [
              [
                0,
                25
              ]
            ]
          }
        ],
        "type": "png"
      },
      {
        "depth": 1,
        "facts": {
          "metrics": {
            "png": {
              "a_entropy": 0.0,
              "chunk_count": 4.0,
              "trailing_bytes": 0.0,
              "idat_chunk_count": 1.0,
              "text_chunk_bytes": 0.0,
              "chunks_after_iend": 0.0,
              "compression_ratio": 0.02,
              "unknown_chunk_count": 0.0
            },
            "file": {
              "size": 132.0,
              "entropy": 5.28,
              "size_bytes": 132.0
            },
            "image": {
              "width": 20.0,
              "height": 120.0,
              "channels": 3.0,
              "b_entropy": 0.0,
              "g_entropy": 0.0,
              "r_entropy": 0.0,
              "edge_density": 0.0,
              "pixel_entropy": 1.58,
              "histogram_flatness": 0.2
            },
            "binary": {
              "overall_entropy": 5.28,
              "peak_region_bytes": 132.0,
              "peak_region_entropy": 5.28
            }
          }
        },
        "id": 4,
        "path": "afglinofhnngepadnicjigajdehmdepp.crx!!images/theme_tab_background.png",
        "sha": "3e5f146df1280a06923840a532edb9b2f73f17705d83dcc9dc165c48a3051a01",
        "size": 132,
        "traits": [
          {
            "id": "metadata/package/files/included::png-extension-basename",
            "conf": 0.8999999761581421,
            "crit": 1,
            "desc": "Filename ends with .png",
            "spans": [
              [
                0,
                24
              ]
            ]
          }
        ],
        "type": "png"
      },
      {
        "id": 5,
        "sha": "52414d1f58b8190b58faddc964d58c2b5bad26b2c76ce8100430c49b560025fe",
        "path": "afglinofhnngepadnicjigajdehmdepp.crx!!images/theme_toolbar.png",
        "size": 133,
        "type": "png",
        "depth": 1
      },
      {
        "ctx": [
          {
            "b": "tydM8wPIv4x(Ffdz/c:Wb6m\u003cpwOtH[xDRn9AV!$dy?j!wb6dEhzE)u=v@DmbwO#Pli^S5\u0026vr(WcvpQMyb4V3(ygn}QfJ}KnfJZ8z",
            "n": [
              {
                "c": 2,
                "d": "JSON data format",
                "i": "metadata/file/format::valid",
                "o": 0,
                "z": 22,
                "cf": 0.6000000238418579
              }
            ],
            "ln": 0
          }
        ],
        "depth": 1,
        "facts": {
          "metrics": {
            "file": {
              "size": 1821.0,
              "entropy": 5.97,
              "size_bytes": 1821.0
            },
            "json": {
              "parsed_bytes": 1821.0,
              "parse_limit_bytes": 76800.0
            },
            "binary": {
              "overall_entropy": 5.97,
              "peak_region_bytes": 1821.0,
              "peak_region_entropy": 6.03
            }
          }
        },
        "id": 6,
        "path": "afglinofhnngepadnicjigajdehmdepp.crx!!_metadata/verified_contents.json",
        "risk": 1,
        "sha": "dd56584ba5a2c03a847aa77ad09d3d4bfe9651da9b8af775e5e5c8e1aac261e8",
        "size": 1821,
        "traits": [
          {
            "id": "metadata/file/format::valid",
            "conf": 0.6000000238418579,
            "crit": 2,
            "desc": "JSON data format",
            "spans": [
              [
                0,
                22
              ]
            ]
          },
          {
            "id": "metadata/file/extension/identity::web-asset-extension",
            "conf": 1.0,
            "crit": 1,
            "desc": "Web asset file extension (css/html/js/json)",
            "spans": [
              [
                0,
                22
              ]
            ]
          }
        ],
        "type": "json"
      }
    ],
    "omitted_files": 1,
    "rev": "868bd",
    "v": "8"
  }
}