{
  "ml": {
    "v": "7",
    "id": 1,
    "lvl": 25,
    "conf": 92,
    "prob": 0.9900000095367432,
    "type": "gz",
    "version": "v18.18",
    "analyzed_at": "2026-08-25T14:12:54Z"
  },
  "path": "softvence-omega-hugojes_AI.tar.gz",
  "raw": {
    "files": [
      {
        "id": 1,
        "mol": "O₅(As₃CSErXe)H₄(Cm₆CrDb₅Po)Md₂(PtPa)",
        "pid": 0,
        "rel": "fetched",
        "sha": "76c00ec704ffbd2f3892a0daa10a70a9d4e09b8f9b44e30fc46f9a3bd74a0470",
        "via": "https://github.com/softvence-omega/hugojes_AI/archive/HEAD.tar.gz",
        "path": "https://github.com/softvence-omega/hugojes_AI/archive/HEAD.tar.gz",
        "risk": 508,
        "size": 1356280,
        "type": "gz",
        "depth": 1,
        "facts": {
          "metrics": {
            "file": {
              "size": 1356280,
              "entropy": 8
            },
            "binary": {
              "peak_region_bytes": 1348088,
              "peak_region_entropy": 7.85
            }
          }
        },
        "traits": [
          {
            "id": "objectives/anti-static/obfuscation/obfuscator/js-obfuscator::hex-name-mangling",
            "atk": "T1027",
            "mbc": "B0032",
            "conf": 0.9,
            "crit": 3,
            "desc": "Hex-prefixed identifier names (obfuscation)",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "objectives/anti-static/obfuscation/obfuscator/js-obfuscator::global-require-module-aliasing",
            "atk": "T1027.002",
            "mbc": "B0024",
            "conf": 0.98,
            "crit": 4,
            "desc": "Global require and module aliasing",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/url/rpc::ethereum-drpc-host-fragment",
            "conf": 0.9,
            "crit": 3,
            "desc": "Split dRPC Ethereum host fragment",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "micro-behaviors/data/source/property/computed::js-global-require-alias",
            "conf": 0.9,
            "crit": 3,
            "desc": "Assigns require to computed global property",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "objectives/anti-static/obfuscation/obfuscator/js-obfuscator::hex-variable-names",
            "atk": "T1027",
            "mbc": "B0032",
            "conf": 0.85,
            "crit": 3,
            "desc": "Hex-prefixed variable names (_0x pattern)",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "objectives/anti-static/obfuscation/obfuscator/js-obfuscator::strong-js-obfuscation",
            "atk": "T1027.002",
            "mbc": "B0032",
            "conf": 0.95,
            "crit": 3,
            "desc": "Strong JavaScript obfuscation indicators",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "objectives/supply-chain/install-hook/tasks::vscode-concealed-media-masquerade-autorun",
            "atk": "T1547, T1036.008, T1564.003",
            "conf": 0.99,
            "crit": 5,
            "desc": "Concealed folder-open task runs disguised media file",
            "from": [
              {
                "off": 575,
                "file": 2,
                "line": 21
              }
            ]
          },
          {
            "id": "micro-behaviors/data/source/dynamic/load::node-computed-require-call",
            "conf": 0.88,
            "crit": 3,
            "desc": "Loads a computed module with Node.js require",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "objectives/anti-static/obfuscation/obfuscator/js-obfuscator::string-array-rotation",
            "atk": "T1027",
            "conf": 0.9,
            "crit": 3,
            "desc": "String array with rotation decoder",
            "from": [
              {
                "off": 1775,
                "file": 1,
                "line": 1
              }
            ]
          },
          {
            "id": "objectives/anti-static/obfuscation/obfuscator/js-obfuscator::advanced-array-shuffling",
            "atk": "T1027.002",
            "conf": 0.95,
            "crit": 3,
            "desc": "Advanced array shuffling algorithm",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "objectives/execution/trigger/ide::ide-auto-run-task",
            "conf": 0.95,
            "crit": 3,
            "desc": "VS Code task runs on open",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/services/blockchain::explorer-module-account-fragment",
            "conf": 0.88,
            "crit": 3,
            "desc": "Block-explorer module=account query fragment",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "objectives/anti-static/obfuscation/obfuscator/js-obfuscator::shift-keyword",
            "atk": "T1027",
            "mbc": "B0032",
            "conf": 0.6,
            "crit": 1,
            "desc": "Shift keyword in decoder candidate",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "micro-behaviors/data/control-flow/error-handling::catch-before-await-or-require",
            "conf": 0.88,
            "crit": 3,
            "desc": "Catch block precedes await or require call",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "metadata/package/config::task-reveal-never",
            "conf": 0.86,
            "crit": 3,
            "desc": "VS Code task suppresses terminal reveal",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "objectives/evasion/masquerade/extension-mismatch::script-named-as-font",
            "atk": "T1036.008",
            "conf": 0.95,
            "crit": 4,
            "desc": "Script content under a font extension",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "objectives/anti-static/obfuscation/string/encoding::js-global-manipulation",
            "atk": "T1027.002",
            "conf": 0.85,
            "crit": 4,
            "desc": "Global object manipulation pattern",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "objectives/supply-chain/install-hook/tasks::tasks-run-on-open",
            "conf": 1.0,
            "crit": 3,
            "desc": "VSCode task runs on folder open",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "metadata/package/config::vscode-task-shell-command",
            "conf": 0.8,
            "crit": 3,
            "desc": "VS Code task uses shell execution",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "micro-behaviors/crypto/library/blockchain/client::etherhiding-campaign-wallet-prefix-unicode",
            "conf": 0.95,
            "crit": 4,
            "desc": "Unicode-escaped EtherHiding wallet prefix",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "micro-behaviors/data/compress/library::node-zlib-import",
            "conf": 0.9,
            "crit": 3,
            "desc": "Imports the Node.js zlib module",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "metadata/lang/javascript-features::global-alias-require",
            "conf": 0.95,
            "crit": 4,
            "desc": "Aliasing require to a global variable",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "metadata/lang/javascript-features::js-obfuscator-while-loop",
            "conf": 0.9,
            "crit": 1,
            "desc": "javascript-obfuscator while(!![]) loop",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/url/rpc::ethereum-1rpc-path-fragment",
            "conf": 0.9,
            "crit": 3,
            "desc": "Split 1RPC Ethereum path fragment",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "objectives/anti-static/obfuscation/obfuscator/js-obfuscator::push-shift-bracket-pattern",
            "atk": "T1027",
            "conf": 0.9,
            "crit": 3,
            "desc": "Bracket-notation push/shift self-rotation",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "objectives/supply-chain/install-hook/tasks::vscode-task-media-masquerade",
            "atk": "T1547, T1036.008",
            "conf": 0.98,
            "crit": 3,
            "desc": "VSCode autorun runs disguised media file",
            "from": [
              {
                "file": 2
              },
              {
                "off": 758,
                "file": 3,
                "line": 21
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/response::x-payload-header-prefix",
            "mbc": "C0002",
            "conf": 0.94,
            "crit": 3,
            "desc": "HTTP x-payload response header prefix",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "objectives/anti-static/obfuscation/obfuscator/js-obfuscator::global-bracket-require-alias",
            "atk": "T1027.002",
            "mbc": "B0032",
            "conf": 0.94,
            "crit": 4,
            "desc": "Obfuscated quoted global require alias",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "objectives/anti-static/obfuscation/obfuscator/js-obfuscator::global-bracket-module-alias",
            "atk": "T1027.002",
            "mbc": "B0032",
            "conf": 0.88,
            "crit": 4,
            "desc": "Module aliased to global via bracket notation",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "objectives/anti-static/obfuscation/obfuscator/js-obfuscator::any-name-mangling",
            "atk": "T1027",
            "mbc": "B0032",
            "conf": 0.9,
            "crit": 3,
            "desc": "Obfuscator-style name mangling",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "objectives/anti-static/obfuscation/obfuscator/js-obfuscator::while-not-space-zero",
            "atk": "T1027",
            "conf": 0.85,
            "crit": 3,
            "desc": "while(!![]) with space infinite loop",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "micro-behaviors/process/create/spawn::windowshide-obfuscated-expression",
            "conf": 0.9,
            "crit": 3,
            "desc": "Obfuscated windowsHide expression",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "objectives/anti-static/obfuscation/instruction/junk-insertion::leading-whitespace-padded-line",
            "atk": "T1027",
            "mbc": "B0032",
            "conf": 0.9,
            "crit": 4,
            "desc": "Extreme leading whitespace hides source code",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "objectives/anti-static/obfuscation/obfuscator/js-obfuscator::infinite-loop",
            "atk": "T1027",
            "conf": 0.9,
            "crit": 3,
            "desc": "Obfuscated infinite loop (while(!![]) pattern)",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "micro-behaviors/data/source/property/computed::js-computed-member-variable-assignment",
            "conf": 0.9,
            "crit": 3,
            "desc": "Assigns through a computed JavaScript member",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "objectives/supply-chain/install-hook/tasks::vscode-task-concealment",
            "conf": 0.9,
            "crit": 4,
            "desc": "VSCode task with concealment properties",
            "from": [
              {
                "off": 680,
                "file": 2,
                "line": 25
              },
              {
                "off": 758,
                "file": 3,
                "line": 21
              }
            ]
          },
          {
            "id": "objectives/supply-chain/install-hook/tasks::vscode-task-persistence",
            "atk": "T1547",
            "mbc": "C0032",
            "conf": 0.96,
            "crit": 4,
            "desc": "VSCode folder-open task runs a fetch or exec command",
            "from": [
              {
                "file": 2
              },
              {
                "off": 758,
                "file": 3,
                "line": 21
              }
            ]
          },
          {
            "id": "objectives/supply-chain/install-hook/tasks::tasks-echo-disabled",
            "conf": 0.9,
            "crit": 1,
            "desc": "VSCode task with echo disabled",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "objectives/anti-static/obfuscation/obfuscator/js-obfuscator::hex-name-mangling-with-string-table-rotation",
            "atk": "T1027.002",
            "mbc": "B0032",
            "conf": 0.94,
            "crit": 3,
            "desc": "Hex-named string-table decoder",
            "from": [
              {
                "off": 1775,
                "file": 1,
                "line": 1
              }
            ]
          },
          {
            "id": "micro-behaviors/data/control-flow/error-handling::empty-named-catch-block",
            "conf": 0.92,
            "crit": 3,
            "desc": "JavaScript empty named-parameter catch",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "objectives/anti-static/obfuscation/obfuscator/js-obfuscator::decoder-loop-keyword-triad",
            "atk": "T1027.002",
            "mbc": "B0032",
            "conf": 0.92,
            "crit": 3,
            "desc": "Infinite loop decoder with parseInt + push/shift keywords",
            "from": [
              {
                "off": 1135,
                "file": 1,
                "line": 1
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/url/path::etherhiding-hex-stage-path",
            "conf": 0.96,
            "crit": 4,
            "desc": "EtherHiding hex-prefixed second-stage HTTP path",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "objectives/anti-static/obfuscation/obfuscator/js-obfuscator::parseint-decoder-loop",
            "atk": "T1027",
            "mbc": "B0032",
            "conf": 0.9,
            "crit": 3,
            "desc": "while(!![]) try/parseInt decoder loop",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "metadata/package/error-handling::catch-keyword",
            "conf": 0.5,
            "crit": 2,
            "desc": "Contains a catch error handler",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/telemetry::device-model-report-parameter",
            "conf": 0.86,
            "crit": 3,
            "desc": "HTTP query includes device model parameter",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "micro-behaviors/crypto/library/blockchain/client::blockscout-host-fragment",
            "conf": 0.9,
            "crit": 3,
            "desc": "Split Blockscout Ethereum host fragment",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "objectives/supply-chain/install-hook/tasks::tasks-auto-approve-setting",
            "conf": 0.9,
            "crit": 4,
            "desc": "Workspace pre-approves automatic tasks",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "micro-behaviors/crypto/library/blockchain/client::etherhiding-campaign-wallet-prefix",
            "conf": 0.95,
            "crit": 4,
            "desc": "EtherHiding campaign Ethereum wallet prefix",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "metadata/package/error-handling::finally-keyword",
            "conf": 0.5,
            "crit": 2,
            "desc": "Contains a finally cleanup handler",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "objectives/anti-static/obfuscation/obfuscator/js-obfuscator::push-keyword",
            "atk": "T1027",
            "mbc": "B0032",
            "conf": 0.6,
            "crit": 1,
            "desc": "Push keyword in decoder candidate",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "objectives/anti-static/obfuscation/obfuscator/js-obfuscator::hex-function-names",
            "atk": "T1027",
            "mbc": "B0032",
            "conf": 0.9,
            "crit": 3,
            "desc": "Hex-prefixed function names (_0x pattern)",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/request/computed::js-computed-https-client-call",
            "conf": 0.86,
            "crit": 3,
            "desc": "Calls HTTPS through a computed property",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "micro-behaviors/data/control-flow/module-exec::async-iife-invoke",
            "conf": 0.7,
            "crit": 3,
            "desc": "Immediately invokes an async function"
          },
          {
            "id": "micro-behaviors/data/source/dynamic/load::node-dynamic-require-call",
            "conf": 0.82,
            "crit": 3,
            "desc": "Node dynamic require call",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "objectives/anti-static/obfuscation/obfuscator/js-obfuscator::global-alias-obfuscation",
            "atk": "T1027.002",
            "mbc": "B0024",
            "conf": 0.95,
            "crit": 5,
            "desc": "Global require/module aliasing with obfuscation",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "objectives/command-and-control/dropper/delivery/blockchain::obfuscated-etherhiding-hex-stage-dropper",
            "atk": "T1102,T1105,T1027,T1059.007",
            "mbc": "B0024,B0032",
            "conf": 0.97,
            "crit": 5,
            "desc": "Obfuscated EtherHiding hex-path stage dropper",
            "from": [
              {
                "off": 1034,
                "file": 1,
                "line": 1
              }
            ]
          },
          {
            "id": "objectives/supply-chain/install-hook/tasks::tasks-command-exec-media",
            "conf": 0.95,
            "crit": 4,
            "desc": "Task command runs font file via node",
            "from": [
              {
                "file": 2
              }
            ]
          }
        ]
      }
    ]
  }
}