{ "ml": { "v": "7", "eng": "2.2.0-beta.2", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.1310601, "rte": "az", "prob": 0.1310601 }, { "cls": 0, "raw": 0.2748915, "rte": "az/zip", "prob": 0.2748915 } ], "prob": 0.1310601, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.13106009364128113, "type": "zip" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.10864117741584778, "type": "javascript" } ], "version": "v18.18", "analyzed_at": "2026-07-01T12:19:15Z" }, "path": "7d9e501b578a7cfe2a1c2f31d78a7f62708518c0d142339fc4f554c4aa1dee90.zip", "raw": { "files": [ { "id": 0, "ctx": [ { "b": "p!H([6Awgm2MRevA8?f+RLC?#002980rsUJ002t%zE)A]Byf0cwO(d7zc}r{Aaa3ewO#P%vp%Q(wO(0@Brz#xCX5rRyie^Q(2LJHWLmG*]+n/Y{xs@3V]laosNl}V", "n": [ { "c": 2, "d": "Zip archive path", "i": "metadata/package/files/included::zip-archive-path", "o": 0, "z": 68, "cf": 0.949999988079071 } ], "ln": 0 } ], "mol": "O₂(AsXe)H₂(DbPo)", "sha": "7d9e501b578a7cfe2a1c2f31d78a7f62708518c0d142339fc4f554c4aa1dee90", "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/2022-11/7d9e501b578a7cfe2a1c2f31d78a7f62708518c0d142339fc4f554c4aa1dee90.zip", "risk": 4, "size": 34280, "type": "zip", "facts": { "metrics": { "file": { "size": 34280.0, "entropy": 7.99, "size_bytes": 34280.0 }, "binary": { "overall_entropy": 7.99, "peak_region_bytes": 33792.0, "peak_region_entropy": 7.83 }, "archive": { "file_count": 1.0, "member_count": 1.0, "script_count": 1.0, "zip_bomb_ratio": 2.82, "directory_count": 0.0, "executable_count": 0.0, "extra_field_size": 0.0, "noise_file_count": 0.0, "total_compressed": 34094.0, "compression.ratio": 0.35, "hidden_file_count": 0.0, "total_uncompressed": 96059.0, "crc_collision_count": 0.0, "entry_comment_count": 0.0, "max_filename_length": 44.0, "rtlo_filename_count": 0.0, "format.regular_count": 1.0, "nested_archive_count": 0.0, "path_traversal_count": 0.0, "symlink_escape_count": 0.0, "security.setgid_count": 0.0, "security.setuid_count": 0.0, "security.sticky_count": 0.0, "double_extension_count": 0.0, "duplicate_member_count": 0.0, "security.symlink_count": 0.0, "unicode_filename_count": 0.0, "homoglyph_filename_count": 0.0, "security.encrypted_count": 0.0, "timing.mtime_unique_count": 1.0, "timing.mtime_unique_ratio": 1.0, "misplaced_executable_count": 0.0, "timing.mtime_dominant_count": 1.0, "timing.mtime_spread_seconds": 0.0, "timing.sentinel_mtime_count": 0.0, "security.world_writable_count": 0.0, "timing.mtime_dominant_fraction": 1.0, "compression.method_counts.deflate": 1.0 } } }, "traits": [ { "id": "objectives/supply-chain/impersonation/homograph::url-non-ascii", "atk": "T1036", "mbc": "B0030", "conf": 0.6000000238418579, "crit": 3, "desc": "URL contains non-ASCII characters", "from": [ { "file": 1 } ] }, { "id": "objectives/supply-chain/trojanized/library/remote-eval::self-recursion-minus-one", "atk": "T1105", "conf": 0.8600000143051147, "crit": 1, "desc": "Recursive retry decrements counter", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/interpreter/eval::js-new-function-constructor", "conf": 0.699999988079071, "crit": 3, "desc": "JavaScript new Function constructor", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/url/encoded::js-commented-url-line-context", "atk": "T1027", "mbc": "B0032", "conf": 0.8999999761581421, "crit": 1, "desc": "JavaScript commented URL line context", "from": [ { "file": 1 } ] }, { "id": "objectives/command-and-control/remote-command/keywords::output", "conf": 0.20000000298023224, "crit": 1, "desc": "Output word for remote-command composites", "from": [ { "file": 1 } ] }, { "id": "objectives/anti-static/obfuscation/syntax::js-useless-arithmetic", "conf": 0.800000011920929, "crit": 3, "desc": "Binary op with identical operands (5-5, x===x)", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/url/encoded::encoded-url-mdn-doc-context", "atk": "T1027", "mbc": "B0032", "conf": 0.949999988079071, "crit": 1, "desc": "Encoded URL references MDN documentation", "from": [ { "file": 1 } ] }, { "id": "objectives/execution/interpreter/eval/dynamic::js-assign-global-this", "conf": 0.699999988079071, "crit": 3, "desc": "Assigning 'this' (global object) to a variable", "from": [ { "file": 1 } ] }, { "id": "metadata/file/string/identity::chunk-token", "conf": 0.949999988079071, "crit": 1, "desc": "Source chunk token", "from": [ { "file": 1 } ] }, { "id": "objectives/impact/destroy/keywords::delete-verb--delete", "conf": 0.8999999761581421, "crit": 1, "desc": "Destructive-action word: delete", "from": [ { "file": 1 } ] }, { "id": "metadata/file/format::vocab-object", "conf": 0.9700000286102295, "crit": 1, "desc": "Validation vocabulary object", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/url/encoded::encoded-url-public-doc-context", "atk": "T1027", "mbc": "B0032", "conf": 0.8999999761581421, "crit": 1, "desc": "Encoded URL public documentation", "from": [ { "file": 1 } ] }, { "id": "metadata/file/format::vocab-array", "conf": 0.9700000286102295, "crit": 1, "desc": "Validation vocabulary array", "from": [ { "file": 1 } ] }, { "id": "metadata/file/metrics::single-long-line", "conf": 0.8999999761581421, "crit": 1, "desc": "Very long line", "from": [ { "file": 1 } ] }, { "id": "metadata/file/format::vocab-string", "conf": 0.9700000286102295, "crit": 1, "desc": "Validation vocabulary string", "from": [ { "file": 1 } ] }, { "id": "metadata/file/format::vocab-number", "conf": 0.9700000286102295, "crit": 1, "desc": "Validation vocabulary number", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/encode/skip-step::js-concat-chain", "conf": 0.699999988079071, "crit": 3, "desc": "JavaScript massive string concatenation chain", "from": [ { "file": 1 } ] }, { "id": "metadata/file/format::vocab-boolean", "conf": 0.9700000286102295, "crit": 1, "desc": "Validation vocabulary boolean", "from": [ { "file": 1 } ] }, { "id": "objectives/supply-chain/trojanized/library/remote-eval::retry-guard-positive", "atk": "T1105", "conf": 0.8399999737739563, "crit": 1, "desc": "Retry guard checks positive counter", "from": [ { "file": 1 } ] } ] }, { "ctx": [ { "b": "fe1B\u003carR!bzE^s0B7ocewId.satCG6gCgM", "n": [ { "c": 3, "d": "Binary op with identical operands (5-5, x===x)", "i": "objectives/anti-static/obfuscation/syntax::js-useless-arithmetic", "o": 0, "z": 29, "cf": 0.800000011920929 } ], "ln": 1, "addr": 0 }, { "b": "w{503BzkVhaz2w6x(bmEDJ", "ln": 2, "addr": 28 }, { "b": "337unx=]LYz!rP)AYkHUz/{8wwP68rB82Sjd}rm3A==sLwmY{[d}JWAyK6tsxl4{kzE+:TB8kPfB75#qzG]#vyK4BPxlOFW", "n": [ { "c": 3, "d": "JavaScript massive string concatenation chain", "i": "micro-behaviors/data/encode/skip-step::js-concat-chain", "o": 52, "z": 65, "cf": 0.699999988079071 } ], "ln": 3, "addr": 46 }, { "b": "33{o5zG/qvhzEiHh-j\u003e-jS[\u0026TzGd-", "ln": 4, "addr": 123 }, { "b": "31E)\u003eB7]e@AYky=vqfR3h7pP", "ln": 5, "addr": 147 }, { "b": "Ee", "ln": 6, "addr": 167 }, { "b": "fe1B\u003carR!uBAzFyiXJdezE^s0B7ocewOMosz/PE", "n": [ { "c": 1, "d": "Encoded URL benign documentation or test context", "i": "micro-behaviors/communications/url/encoded::encoded-url-benign-context", "o": 169, "z": 15, "cf": 0.949999988079071 } ], "ln": 7, "addr": 169 }, { "b": "fe1B\u003carR^Pv\u003c@JQfFCHsgb7Esawci=wO(Ynl33ZPwO${$efEMcy?Wr}av*u/xj(m0yh+ZDvqYP#l#MNTzdNQblU{W-wftq#wfsDYC4C-px\u003eH\u003c@x)a5gqE%/=A=+(kB08!LmpZaOz/P[", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 257, "z": 3, "cf": 0.800000011920929 } ], "ln": 8, "addr": 201 }, { "b": "fe1B\u003carR!bzE^s0B7ocewGU?#C{3NcazbU9wO=SmwncabA+P09By!#9B-7-3AV/EqwGTYsr3l0\u003ev}xL0wI9", "ln": 9, "addr": 313 }, { "b": "", "ln": 10, "addr": 380 }, { "b": "w{503BzkVhazb50z/{aSc#AE8wPIT2efFwxA4AbBx(=i[vK@TEAD3eivjuK", "ln": 20, "addr": 667 }, { "b": "33gxevSc6$auZ?\u003eb0b", "ln": 21, "addr": 715 }, { "b": "31!9@asFvOwO(x$A::6jA+dcKjS[/ZvrMipj0nSRze:6bvruTjwI$U[atL(of/RlqBy/rdwPzj3B-I4Kd\u003eq.\u003eDJ", "n": [ { "c": 2, "d": "Iteration or loop pattern", "i": "micro-behaviors/data/control-flow/analysis::iteration-loop-pattern", "o": 730, "z": 6, "cf": 0.5 } ], "ln": 22, "addr": 730 }, { "b": "2)\u003eiWz/oUMauZ\u0026\u003ewNPW]wPxZTzdv9/B8bCuBy/rdwPzj3B-I4Kdlv", "ln": 23, "addr": 800 }, { "b": "2)\u003eV#zdmB1y9kUZxkz\u003csx^!4FzdmB1yaJ$kz/oUMeoCDuAaK5#BAIRnhyQY", "ln": 24, "addr": 843 }, { "b": "Ee", "ln": 27, "addr": 911 }, { "b": "fe1CZzGx]hvpQH0w/$G9x(mE1CvhL9z/M$ds7L\u0026xz/PS8A:Q2hB-qqrA=-]", "ln": 28, "addr": 913 }, { "b": "C42zlA=k(rauZ?}BA}?pz!pbkwO+%3jV%]nz^)D)v@%7vcmf\u003cRwO+%hB7Gf1au.\u003eJaAIagw/@AEaAIagw*[\u003cID\u0026", "n": [ { "c": 1, "d": "Validation vocabulary object", "i": "metadata/file/format::vocab-object", "o": 989, "z": 6, "cf": 0.9700000286102295 } ], "ln": 29, "addr": 961 }, { "b": "arR^HarR^HarS7OD2Ntkw/$-5z^)c\u003eau.\u003egcVrEewN/*fasnATxkzG}vqEMey\u0026r=\u003ey-\u003e(7jS[xNz^)c\u003easnATxkzG}vqEwnE0+", "ln": 30, "addr": 1031 }, { "b": "arR^HarR^HarTc@zEW^5z/c%JA+funA=91wxLzJndjuR/E0+", "n": [ { "c": 2, "d": "Function constructor keyword", "i": "micro-behaviors/data/source/syntax/keyword::js-keyword-function-constructor", "o": 1120, "z": 8, "cf": 0.699999988079071 } ], "ln": 31, "addr": 1110 }, { "b": "arR^HarR^HarV2Vi@", "ln": 32, "addr": 1149 }, { "b": "", "ln": 33, "addr": 1163 }, { "b": "fe1CDvrMi8vTi6bB0bgmaARpdaz\u003e?gx\u003ez6\u003cwfrpfB-X:zz/^amDtdtqwN)kjC4CYnx(v(I", "ln": 34, "addr": 1164 }, { "b": "C42zll2}0OC#eK1Bz\u0026o+avg3*vr\u003cFAA=l5rBA}?pefE.$yew}?Bz\u0026o+awVDYwN/*mAb](sz/*nzwJG", "ln": 35, "addr": 1221 }, { "b": "C42zlq*Aj?z!@l\u003cz//[ujS[\u0026(AaJ%1ax9M5vSc69aW4$hcV%rqwObT]wN)ehkoJ)IzdmB1e]U\u0026HBz(nDAaHdMaz#sry=.", "n": [ { "c": 2, "d": "Compares value against the undefined string", "i": "micro-behaviors/data/control-flow/analysis::js-undefined-string-compare", "o": 1317, "z": 14, "cf": 0.6000000238418579 } ], "ln": 36, "addr": 1284 }, { "b": "", "ln": 37, "addr": 1359 }, { "b": "fe1CnA+eW3wGU#nx\u003e7{3A+e\u0026]A+fb#wGVe8A+O@\u003ey?mVgw]zYjB8UY4wftq\u003cv}x.5aARJAv@Dy0aAhvtBz(nDAaK8y", "ln": 38, "addr": 1360 }, { "b": "fe1CtB0a)lxk8K2zxKahy\u0026%qivix2$z!@#[zA!", "ln": 114, "addr": 4022 }, { "b": "w{503BzkVhazC)-z/oD6vqWGivRNtmDJ", "ln": 115, "addr": 4053 }, { "b": "arUYoBAIRwaA7.7au.\u003eJaARTDwGVwFaA7.7au.\u003eJazb4#B7DFwD)0JHq/)4]zF7OivqG:dz^)Dgau.\u003eJasyxivRPE:BrA[*z!@#[zE1RK", "n": [ { "c": 1, "d": "Validation vocabulary boolean", "i": "metadata/file/format::vocab-boolean", "o": 4153, "z": 7, "cf": 0.9700000286102295 } ], "ln": 116, "addr": 4079 }, { "b": "Ee", "ln": 117, "addr": 4164 }, { "b": "", "ln": 118, "addr": 4166 }, { "b": "Ee", "ln": 130, "addr": 4470 }, { "b": "", "ln": 131, "addr": 4472 }, { "b": "C42zlx(^i{A+PA7auZ\u0026?vp@LJB97#lc)}@nA+PA7cN?a", "n": [ { "c": 1, "d": "Validation vocabulary string", "i": "metadata/file/format::vocab-string", "o": 4499, "z": 6, "cf": 0.9700000286102295 } ], "ln": 132, "addr": 4473 }, { "b": "", "ln": 133, "addr": 4509 }, { "b": "C42zlx(^3(zdm6%auZ\u0026?vp@LJB97#lc)}=jzdm6%cN?a", "n": [ { "c": 1, "d": "Validation vocabulary number", "i": "metadata/file/format::vocab-number", "o": 4536, "z": 6, "cf": 0.9700000286102295 } ], "ln": 134, "addr": 4510 }, { "b": "", "ln": 135, "addr": 4546 }, { "b": "C42zlx(=WJBy=NTaAR48raQb)wPxgDl$7gGcN?a", "ln": 136, "addr": 4547 }, { "b": "31!9@asI8vzE+HBjS[/ZvrMipj0nxOzE+H+j-2p!B:dKEzF%LJdj]WWwmY^}j0nxOzE+HMd\u003e8P/", "ln": 150, "addr": 4868 }, { "b": "2)\u003erTasIqHx(55yzF%LJenY9swhkYUzE^s0x^(hdB7Gr0A::63fE.t", "ln": 151, "addr": 4929 }, { "b": "2)*]VBz(8dBZ5W9D3avAd06GGz!9#tt{8oMB8L=eC{)MGAXYg/vqG:penY9swhk-UvqG:pdlv", "n": [ { "c": 2, "d": "Computed property access through decoder calls", "i": "objectives/anti-static/obfuscation/code-metrics/runtime-indirection::computed-call-property-access-ast", "o": 4983, "z": 6, "cf": 0.949999988079071 } ], "ln": 152, "addr": 4973 }, { "b": "2)*]WvqG:pauZ\u0026:x(mDpd%k-uwPzGD", "ln": 153, "addr": 5032 }, { "b": "2)(1", "ln": 154, "addr": 5057 }, { "b": "", "ln": 171, "addr": 5542 }, { "b": "C42zlxKL%TvRPE:Bw#WYauZ\u0026?vp@LJB97#lc)}/1ygQ)%cN?a", "n": [ { "c": 1, "d": "Validation vocabulary object", "i": "metadata/file/format::vocab-object", "o": 5573, "z": 6, "cf": 0.9700000286102295 } ], "ln": 172, "addr": 5543 }, { "b": "", "ln": 173, "addr": 5583 }, { "b": "fe1CtB0a)lxk8K2zxKahy\u0026%qivqWh@A=LPlkl", "ln": 198, "addr": 6347 }, { "b": "fe1CowO+{\u003cvru74aARJAmmf^nh79C/zEET3C4z!7l2}0OC}J/Ll2}0OD0\u0026l", "ln": 199, "addr": 6377 }, { "b": "C42zlx(=NXA::kojS[SJBzk]fnPNgrA::koE0^5Uvp@LJB97#lc)}r3A::kvdlv", "n": [ { "c": 1, "d": "Validation vocabulary array", "i": "metadata/file/format::vocab-array", "o": 6467, "z": 5, "cf": 0.9700000286102295 } ], "ln": 200, "addr": 6425 }, { "b": "", "ln": 201, "addr": 6476 }, { "b": "fe1CtzGGDgzEEu7w{503BzkVhaARJAv}YB-yAN?mwPRP%AV!+9wQdVax(+z9zxJ\u003ewzxJ[sz/xodBA]0DvqPM#z!pb1z^)D?e=", "ln": 202, "addr": 6477 }, { "b": "arR^HC42zlB7]@ip\u0026ZF[wPz)rauZ\u0026WwPQ\u003c+DsY][z/xodBA]oAz!%l3v@#B6zyET", "ln": 241, "addr": 7502 }, { "b": "arR^HA+funA=91wD2Ntkw/#eeDsY][z/xodBA[#(jS(a\u0026B.$P0AWI$RclNwzDsY][z/xodBA[#)jS(B3cmf\u003cRx)Kt!A=k]dA==NHjuT/Yl0dFWqC]!-uRa0XmozR", "n": [ { "c": 1, "d": "Validation vocabulary number", "i": "metadata/file/format::vocab-number", "o": 7589, "z": 6, "cf": 0.9700000286102295 } ], "ln": 242, "addr": 7554 }, { "b": "arV7", "ln": 243, "addr": 7654 }, { "b": "", "ln": 302, "addr": 9845 }, { "b": "arSr\u003cavy6+B98CBv@#TfazC)tvixSgwN/B.y-)j@B7D%", "ln": 303, "addr": 9846 }, { "b": "arU\u0026oAV/swz/u*ZasyVqzGx]uBZ]JiAWJ{", "n": [ { "c": 2, "d": "Quoted constructor key check", "i": "micro-behaviors/data/source/prototype::js-proto-guard-constructor", "o": 9895, "z": 13, "cf": 0.8999999761581421 } ], "ln": 304, "addr": 9882 }, { "b": "arUxgasH]iB0JE*z^)DjaAhvtA48[RclKEEwQetHv@DmbvqfR2c#:iBA49jUyH}^je]U@OxEE?uz/vc!", "ln": 305, "addr": 9910 }, { "b": "", "ln": 306, "addr": 9975 }, { "b": "", "ln": 533, "addr": 17890 }, { "b": "fe1CDx(mA(aARpdaAz4aB.\u003eGbayE#OygQ)%e]U\u0026HBz(nDAaHUzz=p:#x(mM\u003eaAR)FwGV8aB98ECwn=ukBrC^CA+=!fz/L", "ln": 534, "addr": 17891 }, { "b": "fe1C?z/65dBA}?pB0bgmaw20Af!\u003ej4Cv.[tB7DF5azbt9xjVa5A+PAkx(mMaxK#sbx(!xgv\u003c2G6B97#4wgO\u003cjvrl0\u003c", "n": [ { "c": 2, "d": "fingerprint string", "i": "micro-behaviors/data/runtime/keywords::fingerprint-string", "o": 17999, "z": 11, "cf": 0.9399999976158142 } ], "ln": 535, "addr": 17966 }, { "b": "fe1C^zxK4mwGU\u00263BzbP6B1OObBshbLzF%Rtxl4M(BsXLzB-X:uBshbLBzbkdvR6R5aA}xtxk.(A", "ln": 536, "addr": 18039 }, { "b": "w{503BzkVhaAIWCwIN:zB-RXly=K3?xKM1ddsh", "ln": 537, "addr": 18100 }, { "b": "C42zlw]zYUvpJ$CvqPM#jS(a:z/OoPv}Wkv", "ln": 561, "addr": 18956 }, { "b": "arR^HxKL%SvqPM#jS(a=vri!E", "ln": 562, "addr": 18985 }, { "b": "arR^Hv@Dj3z/ec:x(\u003eEXax{j6y?m3}cOcw/wmYN*By=?9ec", "n": [ { "c": 1, "d": "Destructive-action word: delete", "i": "objectives/impact/destroy/keywords::delete-verb--delete", "o": 19034, "z": 6, "cf": 0.8999999761581421 } ], "ln": 563, "addr": 19006 }, { "b": "arR^Hzddx.vqfK2jS)@RxjVfjefFRmB53dXwH[@KB7GCvt@@", "ln": 564, "addr": 19044 }, { "b": "", "ln": 565, "addr": 19083 }, { "b": "arR^Hx\u003ewFowmYvYB.(evdiJLry9kUZpHX6Iv@%bqvRNtN", "ln": 640, "addr": 21116 }, { "b": "arR^Hx\u003ewFoy?mG%Bz8^VatL6!D)0upy9kV5az#sry:*GEwPS6nzxJ\u003ebyc8", "ln": 641, "addr": 21153 }, { "b": "arR^Hw]zYjd0x3tazC.7wQ2sXatC@2x(mD)CPY9\u003ey?mG%Bz9-Ux(mD)CQ\u003eo[aBs", "n": [ { "c": 2, "d": "Nested for loops (control-flow building block)", "i": "micro-behaviors/data/encode/permutation/loop::js-permutation-loop", "o": 21204, "z": 181, "cf": 0.8999999761581421 } ], "ln": 642, "addr": 21200 }, { "b": "arR^HarU\u0026oAV/BwB-H#6auZ\u0026QA+xJiwO#Qhtwm$=wQ4Gi", "ln": 643, "addr": 21251 }, { "b": "arR^HarR^HarUDhD2\u003e8\u003eazULlB4gp\u0026v\u003c(zpB-H#6dj+", "ln": 644, "addr": 21288 }, { "b": "fe1ClB8#5dzGu}eazkziwO@SevRPE:BrC^wBz8!9y?$koxK@r8CwXKxA=k]dA==2bB0bgmaARpdaAg+gB7F(lx(i", "ln": 658, "addr": 21633 }, { "b": "fe1C^vRPE:BsqhVe=", "ln": 659, "addr": 21704 }, { "b": "fe1B@xMOunB2\u003e%cwmY{}y\u0026so7AXqiEDtdhivj(Fsxd)!lv@\u003cq8wNWq+vrM6Tv@=p5Bt3K6w[u0]zEWlhm@i9MvqGpDvRPE:BAo9hvRPE:Bt46zB7]o8df", "n": [ { "c": 1, "d": "Encoded URL references MDN documentation", "i": "micro-behaviors/communications/url/encoded::encoded-url-mdn-doc-context", "o": 21730, "z": 22, "cf": 0.949999988079071 } ], "ln": 660, "addr": 21718 }, { "b": "C42zlwQ5rdzE=K!zxI7+v@=c?By^:VB7]o8wPxhmwQetCi@", "ln": 661, "addr": 21812 }, { "b": "", "ln": 662, "addr": 21850 }, { "b": "arR^Hze0(gjS(Bu", "ln": 885, "addr": 28764 }, { "b": "arV7", "ln": 886, "addr": 28777 }, { "b": "arUYoBAIRwaz\u003e?gas!Nevrufnw]8y7AWTT\u003cBz9pEvqYQ]z73?QdJ*cRvr-[Daz\u003e?gas!M?djEs", "n": [ { "c": 2, "d": "Math.random invocation", "i": "micro-behaviors/os/random/prng/stdlib::math-random-call", "o": 28807, "z": 11, "cf": 1.0 } ], "ln": 887, "addr": 28781 }, { "b": "Ee", "ln": 888, "addr": 28841 }, { "b": "", "ln": 889, "addr": 28843 }, { "b": "fe1ClasIhEB8#58y\u003cvdnvrlK4AW-bPvr\u0026#qzY\u0026X7BrCWswGUG9A=L-eBrCWtzdN^gvqP%avriM1zxJUhBy/8@AXm", "ln": 890, "addr": 28844 }, { "b": "C42zlzF%.wjS)d3By^7xz*9sKD)03zzEW^5z/c%LaBs", "n": [ { "c": 3, "d": "Checks for timing jitter using Date differences", "i": "objectives/anti-analysis/timing/jitter::js-date-diff-jitter-pattern", "o": 28925, "z": 8, "cf": 1.0 } ], "ln": 891, "addr": 28915 }, { "b": "arUYoBAIRwaz$+mavGTWwHF#WxjVf:x(dAfdlv", "n": [ { "c": 2, "d": "JavaScript Date object construction", "i": "micro-behaviors/time/query::js-new-date", "o": 28959, "z": 8, "cf": 0.30000001192092896 } ], "ln": 892, "addr": 28950 }, { "b": "Eld", "ln": 893, "addr": 28981 }, { "b": "v}Yp\u003exjS$:cM\u003e#Py^\u0026v!y/\u003em^ejsM1avo7Jgh7iueoUo6wN3B1aAwOMfNC@%egzYNavY0\u003ctWg6fb56Z#i@", "ln": 894, "addr": 28984 }, { "b": "arV7]", "ln": 902, "addr": 29350 }, { "b": "arSr\u003caw#=-wQ4^cazbLjazCv$zGGP8D1?eeayMydwQbzuxKM09zE)x\u0026B0bNyayX[8wPIu\u0026AaJMj", "ln": 903, "addr": 29355 }, { "b": "arU\u0026oAV/BwB-H#6auZ?{c{G:uas!NIwQetBzddxje]2rszyu(WcN*e*aswP=i@", "n": [ { "c": 2, "d": "Generic file read/write operations", "i": "micro-behaviors/fs/file/read-write::binary-file-ops", "o": 29449, "z": 5, "cf": 0.800000011920929 } ], "ln": 904, "addr": 29416 }, { "b": "arU\u0026oAV/EnB97q\u003exjVsbauZ\u0026BwOjCRA42^CB-H#6dlv", "ln": 905, "addr": 29466 }, { "b": "arU\u0026oAV/ylAbn@)wM08LwQ5epjS)Tlxgm5:d06rHA:@Viasy!Hdlv", "ln": 906, "addr": 29501 }, { "b": "xM4{jwJh?2C0[lbw)wN}tP$Xjc%ZXit{aoqdlRG+iuSATgJm5Ic[64NA4#fytqyFAxELSBBuq0Kvn?k?o)p8Sc@%+/eK%R(h/-FscP.", "ln": 912, "addr": 29713 }, { "b": "", "ln": 913, "addr": 29796 }, { "b": "xM4\u003c3C%9J!lM!D}cPJRhdk\u0026Oqdqg!ZErlPBv@#c[BAz2dxMkCwwN)leaAR%LaA@lNydSX^x(X6exMOr9xluvTA=+]mwg6C", "n": [ { "c": 2, "d": "Uses sed for text processing", "i": "well-known/tool/development/cli::sed-processing", "o": 29836, "z": 3, "cf": 1.0 } ], "ln": 914, "addr": 29797 }, { "b": "fe1CtzGGDgzEEu7y?W%jaA7\u003cmnk@qSaz2Cjx([62B0b7kAV!}mv{%s\u003czF7N", "ln": 915, "addr": 29873 }, { "b": "C42zlwPIu\u0026AaI:LA3dp^DJ", "ln": 916, "addr": 29921 }, { "b": "Eld", "ln": 964, "addr": 31358 }, { "b": "", "ln": 965, "addr": 31361 }, { "b": "C42zlwPIu\u0026AaI{Uxgm5:auZ\u00262tWhU7D%yYttYa{]BUUTaida$Ngb7Ezfk0u", "n": [ { "c": 2, "d": "Decoded unicode-escape content", "i": "metadata/encoded-payload/unicode-escape", "o": 31362, "z": 30, "cf": 0.8999999761581421 } ], "ln": 966, "addr": 31362 }, { "b": "", "ln": 967, "addr": 31410 }, { "b": "", "ln": 968, "addr": 31411 }, { "b": "arU\u0026oAV!!hxlw65zGE0:aAIaoBzkS9B1RSAA+O@\u003ey?kW", "ln": 1028, "addr": 33633 }, { "b": "arUxgasHVsxlw65zGErIDJ", "ln": 1029, "addr": 33669 }, { "b": "arR^Hfe1CtzGx@vwGUz]vqfR2BrCWsx(W-oAa9^eC{3QnwmV($zFA-)BzkVhe*8MfrZ!O}fFUvmgbyZzi4j", "n": [ { "c": 1, "d": "References a CVE identifier", "i": "objectives/privilege-escalation/exploit/vulnerabilities::cve-mention", "o": 33738, "z": 14, "cf": 0.800000011920929 } ], "ln": 1030, "addr": 33687 }, { "b": "arR^Hx\u003ewFoa.1(2wL3AzzGGP8x\u003eqrqBy/Jnc$ddeB.$YcBswTYBzbYkCoy^mCoxs{A=k$D", "ln": 1031, "addr": 33754 }, { "b": "arR^HarS4Pvrc6\u003cvR/P#x(+zmz/^agayX=1wGUX$wO#Q7w[+*%iV]^)d\u003cenvxlw65zGC", "ln": 1032, "addr": 33811 }, { "b": "arU\u0026oAV/ylzE^s0i@", "ln": 1044, "addr": 34179 }, { "b": "arU=DC{4C", "ln": 1045, "addr": 34193 }, { "b": "arR^HA+fc0wPw[Raz$+mavZG\u003ev@#B6zyw}lxlw65zGEALcTOkLaAIEzA:@Vfi@", "n": [ { "c": 3, "d": "JavaScript new Function constructor", "i": "micro-behaviors/process/interpreter/eval::js-new-function-constructor", "o": 34214, "z": 13, "cf": 0.699999988079071 } ], "ln": 1046, "addr": 34201 }, { "b": "arV7Pv{%E?xDOZmdiJ%", "ln": 1047, "addr": 34251 }, { "b": "arR^HwIe4xB-H#6auZ\u0026*z/{8gwJG", "ln": 1048, "addr": 34267 }, { "b": "vrcy5C4Ax\u003ecV\u002619zf4^twPxE{gi1BSd@WS]y\u0026pBVx(liVwO\u003e{/wO=Kjd@efMvRPHHx\u003eYUqACc!9zd^c[zdUjBd}HZ%C4r0UBBn3RwoxmY", "ln": 1090, "addr": 35418 }, { "b": "C42zlx\u003efOHB-8qjAV^H/fGP", "ln": 1091, "addr": 35503 }, { "b": "w{503BzkVhaA.NoADL?:wghzqwObU3diJ%", "n": [ { "c": 1, "d": "Distinct telemetry ID fields (uniqueId)", "i": "objectives/collection/monitor/telemetry::telemetry-distinct-id-fields--uniqueid", "o": 35531, "z": 8, "cf": 0.8799999952316284 } ], "ln": 1092, "addr": 35522 }, { "b": "arU\u0026oAV/7bauZ?$d}@JYz/]@twPw[zaswJ#", "ln": 1093, "addr": 35550 }, { "b": "arUYoBAIRwaAhvjw[=GjkoK]=wObU3as!NGwfr]Qx\u003efp", "ln": 1094, "addr": 35579 }, { "b": "arR^Hw]zYjd0x3tazz@Yatt(1x=]IXy?mG%Bz9-Ux!7X.aBs", "ln": 1135, "addr": 37180 }, { "b": "arR^HarU9kxldo\u003et{8oMvScybwi\u003elGB6Au:au.\u003eJaAhd9v}xs(y?d9$au{#SA+xJiwO#Qhtx1I4x([6czyWkyauySOz/]@dl2{QVtwmw8", "ln": 1136, "addr": 37219 }, { "b": "arR^HEe", "n": [ { "c": 3, "d": "Executes script files", "i": "objectives/execution/condition/platform::executes-scripts", "o": 37308, "z": 11, "cf": 0.6000000238418579 } ], "ln": 1137, "addr": 37304 }, { "b": "arR^HCw7YbwGSyuz/YSmx(v(ijrO6Mxlw65zGG}Ly?mG%Bz99Cvrc14e]U@OxEEqfxlw65zGG@7AbP/iBzkVhd\u003es)Oi@", "ln": 1138, "addr": 37310 }, { "b": "arR^HA+funA=91hCX7xcBy^^SB-7.rw{503efFzuB-7.vaARphB1wCQxLzJsayPq6B16f", "ln": 1139, "addr": 37384 }, { "b": "", "ln": 1172, "addr": 38645 }, { "b": "fe1CtzGGDgzEEu7x(d*9wO(0@Byxo9z/cXow/$I8A+e:6A=U@rwGUw)y*?BcwO$(#w{503BzkVhe=", "ln": 1173, "addr": 38646 }, { "b": "w{503BzkVhazbB#BAz8ibRZYYzG6-uefFFmAcb+AaAITBx\u003e8loaA8yAAclmKaBs", "n": [ { "c": 1, "d": "Variable names suggesting command output", "i": "objectives/command-and-control/reverse-shell/dup::js-output-command-var", "o": 38749, "z": 6, "cf": 0.30000001192092896 } ], "ln": 1174, "addr": 38708 }, { "b": "arUPBBz#wAauZ\u0026=B-.OBBrC%Uax@bk", "ln": 1175, "addr": 38759 }, { "b": "arUxgasFyzwPh:8asnATwmY.4xDODYjS(BcaBs", "ln": 1176, "addr": 38784 }, { "b": "fe1CZBrC^wBz8!sxK@q{A+xJiwO#QhaAIWAAbol1wg^", "ln": 1232, "addr": 40633 }, { "b": "C42zlwmYN=C{2l)A+frll2{QXzdNQbB0$TyzEW^5z/c$nB-7XuaA}mdBsXLyA+xCxaBs", "ln": 1233, "addr": 40668 }, { "b": "arUYoBAIRwaAIaorb3hXz/{dIw{503BzkVhc[co=", "n": [ { "c": 2, "d": "setTimeout timer usage", "i": "micro-behaviors/time/schedule/interval::setTimeout", "o": 40732, "z": 10, "cf": 0.5 } ], "ln": 1234, "addr": 40723 }, { "b": "arR^HA+funA=91iB-7Xwvq{g4C{)MMy?$TBvrc14dlv", "ln": 1235, "addr": 40756 }, { "b": "arV7-aA}mdBsxo", "ln": 1236, "addr": 40791 }, { "b": "arR^Hx\u003ewFoa-IEkC4\u003e(qB08!RaA8jvx(v)ge]k9cwnb{]au.\u003eJazb4#B7D^yAb]Jkx(wcnauZ\u0026OzF%.X", "ln": 1273, "addr": 42112 }, { "b": "arR^HC42zlA+f8@x(mT5xcotWCvticat1Y:uV6!aat1ZPA+fAdz/{aIi@", "ln": 1274, "addr": 42177 }, { "b": "arR^Hv@DmbwQ5qtjS[\u0026Wx(=u", "n": [ { "c": 3, "d": "Assigning 'this' (global object) to a variable", "i": "objectives/execution/interpreter/eval/dynamic::js-assign-global-this", "o": 42227, "z": 15, "cf": 0.699999988079071 } ], "ln": 1275, "addr": 42223 }, { "b": "arR^Hvrc14auZ\u0026QA+xJiwO#Qhi@", "ln": 1276, "addr": 42243 }, { "b": "arR^Hx\u003ewFoA+f8@x(mT5xcor1ats{=D)0Dvzddc@x(mMaj%k5Tx(\u003e^DDJ", "ln": 1277, "addr": 42265 }, { "b": "C42zlw[=c[oKS0:nP56ICPYc(v@=c?By!o?wN]H+vru6LzE^s6mRM:JwPxgJf!2f", "ln": 1446, "addr": 47794 }, { "b": "", "ln": 1447, "addr": 47846 }, { "b": "wQ4^bv}*0}i6wS]tWgI:tWgJsnNbHJd{Ms:cTo[YtY\u003cpRtWgJstQJ=YtWgJstQJ=7A9MTMtQ%5:tWfr{tYKyXtWeTYtWgIRtQJ=YtWgIYBzj#+tWgJstWhhLtWeTYcTo[YtY:i#tWgJstWgJstWe^:tY:i#d)kyytWg@EtW@54tWhhLcV\u0026P#j6TdrcTo[btWeZ.tQ%5:tWgJstWgIYtQJuMtVs@Qj6V2KtWhqOtWgJstWgJstWgJscTn37tWgJscTn37tWgJstWgJstWqzQtYr{}d\u003etWCtX)UItQJ=YtWgJstWe^:tWgJstWeTYtQ%5btWgJstWgYxtWgJscTo[YtQ%5btQJ=YtWgJstQI4btWgIRtQJ=Yw)wOCcO4n-cVSD%vj=w4tR]X\u003cjZqk%cTo[YtQ%5btQH!4tWgI^tWhtPtWeTYtWgJstXdd/tWgJstWgIYtWgJstWgJstQH}8tQ%5bd{MsftWhRXtWgJstWeTYtWgJatWgIYtWgJstWe^:tQ%5btQJ=YtWgIYd\u003cXC9tWgJstWgJsA9MT*tQK]7tXmj*tWgJstWgJstWgJstQJ=YtWgJstQI4btWeTYtWgJstW}2zA41%stWgJstQK}ItWe^:tQiMVd{Ms:tYr{}tQJ=YtWgJsmo\u003c7DtWhqOtQ%5bayw!!tWeTYtWgI=tWgJstWgIYtWgJstWgIYtQK2^tWgI%tWhx0d\u003ceUktWeTYtWgI:tWgJstWgIYtWgMttWgJscTo[YtWgJscTn37tWgJFtQJ=YtWgJstWe^fd\u003e$pld{Msiy*pjIcTo[YtW7CXtWgJstQJ=YtWgJstQJ=YtWgJstWgIYtWgJstWgIYtWgJstQI4btWgJscTo[evo^4WtWgJsfKd\u003cktQKFNd@nDryccVHA^h!Oj8!BLw]{gBtQJ=Ypf.4mtQJ=YtWgIYtQJ=YtWgJstWgJstWgJsA:h\u003cJtQJ(-tX)T)wN5E?tWgJstWgJstWf%ctWeTYcTo[RdjX*SwH/ootSVgrtWgJstWgJstQJ=YtWgJstQJ=YtWgIYtWgJstWgIYtWgJstWgJstQJ=YtWgJstQJ=YtWgIYtWe^:tYIu6d\u003c#VFtQ%5btWgJstWgJstQJ=YtWgJstQJ=YtWgIYtWgJstWgIYtWeWZtWgJscTo[YtQ%5bnNbIjtWe^:tWgJJtWf*sd{Ms8tQJAOtYTc$tWgJstWgJsmQfh6cTo[YtWgJscTn37tWgJstWeTYtY9!KtWgJstWgIYd{Ms@tQK8/tQ$eatWgJstWgJBd{Msf", "n": [ { "c": 2, "d": "JavaScript built bundle marker", "i": "metadata/library/web-frameworks::javascript-built-bundle-marker", "o": 47847, "z": 512, "cf": 0.8999999761581421 } ], "ln": 1448, "addr": 47847 }, { "b": "", "ln": 1449, "addr": 48924 }, { "b": "", "ln": 1450, "addr": 48925 }, { "b": "arR^HC42zlx=]LYfF1t.wO#d5xDPCXxjVfUwO#d5xEEqfA::kxi@", "ln": 1472, "addr": 50902 }, { "b": "arR^Hx\u003ewFoBA}?pz!pbawoYjWjS(a\u0026B.$P0AWJpUDJ", "ln": 1473, "addr": 50944 }, { "b": "arR^HarUxgasH=mAV^K*fEXb\u003e", "n": [ { "c": 1, "d": "Retry guard checks positive counter", "i": "objectives/supply-chain/trojanized/library/remote-eval::retry-guard-positive", "o": 50984, "z": 12, "cf": 0.8399999737739563 } ], "ln": 1474, "addr": 50978 }, { "b": "arR^HarR^Hx=]LYx\u003ehDhk0p2xau{#.woYjTawDo^xFadgCQNopCPXHVy?mG%Bz9iFx^(a", "ln": 1475, "addr": 50999 }, { "b": "arR^HarV7PwO=B0aBs", "ln": 1476, "addr": 51055 }, { "b": "arR^HarUYoBAIRwazCwhau?}hfD-O5x\u003ehDhd\u003ceKGiV{1ei@", "ln": 1485, "addr": 51379 }, { "b": "arR^HEe", "ln": 1486, "addr": 51417 }, { "b": "arR^Hw]zYjc#0jpauZ\u0026Tx(UsWats{5azz@Vaz+Rbxlm/feG==fazCwhau?}hfD.X?azCwhauQ=.wO#d5xGEtJwoYjEjS[oHAW-bT", "n": [ { "c": 3, "d": "JS loop with non-standard increment (skip-step)", "i": "micro-behaviors/data/encode/skip-step::js-skip-step-loop-any", "o": 51427, "z": 74, "cf": 0.800000011920929 } ], "ln": 1487, "addr": 51423 }, { "b": "arR^HarUxgasHVsA::k$x\u003ehD]au.\u003eJazC}ez7cPFwPS6nzxJU7CSL", "ln": 1488, "addr": 51504 }, { "b": "arR^HEe", "ln": 1489, "addr": 51547 }, { "b": "arUxgasFyEB3T?!vr\u003eKXyH[]jvRNtvaA7.7auZ\u0026\u003cvqH6$B0$%oyahj", "ln": 1661, "addr": 62936 }, { "b": "arUxgasItSAaJ%1azbUjzaORQwQ2svjS(a\u0026B.$P0AWI#SD)06Avrb)cazbUjzaORQwQ2sXatt\u003e", "ln": 1662, "addr": 62980 }, { "b": "arUYoBAIRwazC.7wQ40.c#SNfefFUGwO\u0026$vw].*bnP56ICQT+0jS(Bu", "n": [ { "c": 2, "d": "JavaScript substring search call", "i": "micro-behaviors/data/string/search::js-includes-indexof-call", "o": 63049, "z": 8, "cf": 0.8199999928474426 } ], "ln": 1663, "addr": 63040 }, { "b": "Ee", "ln": 1664, "addr": 63085 }, { "b": "y?WD(jTTGtm{EADtSk[)tWe{!tWeTTtWfBddQljetWgJszcQsJcUlK/tWgIYtQJ=YtWeyRcTo[htWgJsuTc\u0026vcO5CbtWgJstQJ=YhE6G(tWgJstWeTYtWgJstQ%q?tWgJstWeTbd{KDbcTo[rtQK8/tWYd6tWhwQtS\u003cPxcTn2$tWgJstWgIYtWfl[tWgJstWgJscNq@4tWhkMcTo[jtWgJsz^lKLcWP96d{KCNtWe^8tWgJstWgJstWeKVcTn37tWgJscTo[YtWgJstWgI?tWgJstQJ=7tWe^ftWeWZtQ}/+v{yx^tWgJstWgJVtWgJstWgIYtWgJstQJ=7tWe*+cTo[YtWgJstQ-].mQfgPtWe^:cTo[YtWgJPtWe^:cU3y^nN9SNtWgJstWgJsi9W?otS(sthy\u0026PGtXNCFz.DI?j6V2BtWg\u0026KB6I%UtQKL%tXEv\u0026A5nXxtS(s%axI\u0026NtSk[ni4l\u003cni@", "ln": 1665, "addr": 63087 }, { "b": "Ee", "ln": 1708, "addr": 65798 }, { "b": "DsIkgv}v!JtWf9ojZqk%cTo[YtXdeBmls:VtWgJstQJPTtWeTYcTo[YtY9!KtWgJstWgJsyfU1GcTn37tWgJFtQH?ntQJ=YtWgJsd}q*?d{Ms[D[d(}tWgJstWgJstQ%5btQJ=YtWgIYwN5F*tWgIYtWgJstWgYxtWgJscTo[YtRGzgBx\u00266YtWhI7fJz*qwHQ8NtRGz/tQJ=YjZou\u003ctWg\u0026BcVSD%wN5FNtWfu}tWeT8vQ9d*tQJM5tWg@EtY1R7tQJ=YtWgIYB:Ev#tWgJstWht(tQJ=YtWgIYtQK@8tWgJltWgJstWgJstWg?.tQJ=YtWgIYtWe^:tWgJstWgJstS(sttWgJstQI4btVj(PjU53/tWeTYtWgI:e*az7tWgJstWgJsvo^5xtP^o0tQJ3DtWgJxtWhwZpf.4ptQK5#wM7WhnJOFdtUXJKtQJ=YtWgJsu%D@wtWgJstWgJrtQJ=7tWgJstQImhtWgJstWgJstWgJstWgJstY:i#tQI4btQ}rPtWe^:tWgJscTn37tWgJscTo[YtWgJstWgJstWgI:tQJ=7tWgJstQI4btWgJstWgJstWgJstWgJstQ%5btQKF}tR]VbcP.", "n": [ { "c": 2, "d": "Decoded unicode-escape content", "i": "metadata/encoded-payload/unicode-escape", "o": 65800, "z": 57, "cf": 0.8999999761581421 } ], "ln": 1709, "addr": 65800 }, { "b": "", "ln": 1710, "addr": 66287 }, { "b": "x(O04wOjdNu0HR+tQKLxtWfN1tWgJetQJ=7zcQsJtWeTYtWgJstWgJstWgJstWgJscTo[YtWeTYcTo[YtW7Dry?kaEDN\u003czHtWgJstWgJstQJ=YtWgIYtQJ=YtWgIYtWgJstWgJstWgJstWgJstu\u003eArcTn37tWgJBtQI4btQ-].d\u003et4HtWhbJtQ}mdtWeTYtWgJBtQJ=YtWgIYtWgJstWgIYtWfZ5tWgJscTo[YtY.]5x\u0026uJmj--bUtY%v1tQJiItWgIRtWgJsD0BP^tWgJstWgJshy\u00262WtWgJstQKxeyF#=?tWeTYcP@$(tWg]DtX^L:tWh8IcP+NrtQJ=Yd{Ms:cTo[YtWgI-tQI4ztQJ=YtWgJsd\u003es\u003eftWgJstQJ=YwN5FKfKd\u003c/cTn37tQ@PPtWgJstWgJBc}vI\u0026tWgJstWe))C3FoTtQH!4tWeTYcTo[YtWgJstWgJstWgJstWgJstWeTYcTo[/pch2$d\u003erbPtW7CXtWgJstWgJstQJ=YtWgJstQJ=YtWgIYtWgJstWgIYtWgJstWgJsDr:YWcTo[YtWgJ3tQI3Ltu\u0026K@j6TdQtWg-ytX48ABZefmtWgIYtQJ=YtWgJsA:h\u003cXtWe^:tYr{}c%Q1ZtWeTYtWgJscTo[YtY0Z[xK1^)tWeWZtWZietXmj+d{Ms$tWgJstWgJstWg#FtWeTYcTo[YtY0Z[tWheKtWgIRtWgIYA9MTMtWeTYcTo[YtQ%5:tWgJstWgJsq^rM?tQJ=Yd{Ms:tQ%5:tQI4btWgI.tP#jltWeTYcTo[brA@^ltWgJstWgJscTo[ttWg/AcWG35zcOC$tWhtPtSVg}tQJ=Yd@D\u003extQ%5bi4Ortd{Ms\u003ctQHU0tWgJscTn37tWgJstWgJstWgJstWgJstWgI(tQJ=7Cu!xTtXWIGwgG6ktWZ\u003e+tQIadtR6b+tWgJstQJ=Yd{Ms:tWeTYtWgJstWpPtv@A(5tQ%56pf.4etWeETtWgJscTo[YtWgJscTo[YtWgJstWeTYtW*@ytWgJstWgGrtWeTYcTo[YtXdd/d{Mt9tWg/Yv}]mNd{Msfc%Q1ZcTo[YtXe1ZtWgJscTo[YtWpOZtQJ=YtWgJsay5e=tWeZ.tQ%5btQK2^tQ%5:A9MTYtWgJstWgIYtQJ=YtWgJsgf!6?tWgJstWgI:tQJ=7xK1!EtQ\u0026#-d\u003es\u003cLtWgJstQH}8tWgJscTo[^tWgJstWgJsgB(YTtWgJstQJDPtWgJstWgJstR6b+tQ0ATtWgIYC}iGicPsami@", "ln": 1784, "addr": 68847 }, { "b": "", "ln": 1785, "addr": 69861 }, { "b": "fe1CLmRM{SwPxw9vru74aAIjsw[C\u003c\u003ct{%xdBz#pZfe3)Oe{z2Bx(ES]x\u003c\u0026SjA+v4Hx\u003e}AomRM{SwPD^XLuzsowPIj1xMW{0y?k4F", "n": [ { "c": 3, "d": "URL contains non-ASCII characters", "i": "objectives/supply-chain/impersonation/homograph::url-non-ascii", "o": 69888, "z": 39, "cf": 0.6000000238418579 } ], "ln": 1786, "addr": 69862 }, { "b": "", "ln": 1787, "addr": 69943 }, { "b": "Cv+\u0026qBV?9YtQK8sxe:l*zD{B8tWe^fwN3P\u003etWhqOcV\u0026P#d\u003eUvqtY:jQwgIpFzcQr@tWg.*xJ#{htWhk0y*pjVtWfu}cU3y^A:f#qtWf6\u0026tP^oRjU4ThvoE4Zz^lK\u0026tWhwagH8qztWe^xB6I%YtWhq3C3DzatWf9dd(g#%vjMRcg=u\u003cyvQ9eTtWg@EcT*m+A:f#etWe^:tXNCFyfU1PtWhg}AA\u003cXHtWhj#voB%t", "ln": 1788, "addr": 69944 }, { "b": "arUxgasIaIjV%{9B.\u003e\u003epE0^5HBZYr3diJ%", "ln": 1793, "addr": 70291 }, { "b": "arR^Hx\u003ewFoa.=0-A=LPloLFoNc#SNfdjDxTvRN2GaA?gfB.bRxz^)Dgi@", "ln": 1794, "addr": 70319 }, { "b": "arR^HA+funA=91rvRPa/vqYQ]z76siya:slzFa68at1Y\u003cdp21", "n": [ { "c": 2, "d": "Computed property access through decoder calls", "i": "objectives/anti-static/obfuscation/code-metrics/runtime-indirection::computed-call-property-access-ast", "o": 70380, "z": 6, "cf": 0.949999988079071 } ], "ln": 1795, "addr": 70365 }, { "b": "arV7", "ln": 1796, "addr": 70405 }, { "b": "arU\u0026oAV/Bize:r5auZ\u0026?z:wz:vr\u003cntvRNtN", "ln": 1797, "addr": 70409 }, { "b": "fe1CnxMXidayMylx(mN1wGUA4A::kox(n3haz(mqBzkYgwGUA4A::lmefFIjv}V#{z/fV9x(mT5xcpO(z/]@tu)6xdazbhewPv", "ln": 2137, "addr": 91424 }, { "b": "fe1CZBy/rge=", "ln": 2138, "addr": 91503 }, { "b": "w{503BzkVhay/8czFHUeA=LPlefFCvB-8pIaBs", "n": [ { "c": 1, "d": "Source chunk token", "i": "metadata/file/string/identity::chunk-token", "o": 91522, "z": 5, "cf": 0.949999988079071 } ], "ln": 2139, "addr": 91513 }, { "b": "arUxgasH-rB-8pzjV%{9B.\u003e\u003epE0^5Dz/]@tauQ=3diJUxBAIRwax@bk", "ln": 2140, "addr": 91544 }, { "b": "arU\u0026oAV/ylB9hqvauZ\u0026Kt@@", "ln": 2141, "addr": 91589 }, { "b": "arU9gC@^6?z/65p", "ln": 2298, "addr": 95129 }, { "b": "arUfjzGGr3zGv\u0026Yv@DmbvqfR2ec", "ln": 2299, "addr": 95142 }, { "b": "arUxov@co#wPG)Pv@DmbvqfR2ec", "n": [ { "c": 1, "d": "JavaScript includes method", "i": "metadata/lang/scripted::includes-method", "o": 95166, "z": 8, "cf": 1.0 } ], "ln": 2300, "addr": 95164 }, { "b": "arUxov@co#wJy@zz/fV9x(m#y", "ln": 2301, "addr": 95186 }, { "b": "arUxoC5IeciV@cOC5Iecec", "ln": 2302, "addr": 95207 } ], "depth": 1, "facts": { "imp": [ [ "", "rzvi" ], [ "", "consider7" ], [ "", "VERSION" ], [ "", "rfdu.oiuyta" ], [ "", "symbolj" ], [ "", "temperature6" ], [ "", "floor4" ], [ "", "weather7" ], [ "", "symbolj" ], [ "", "glyyi" ], [ "", "root" ], [ "", "Function" ], [ "", "Function" ], [ "", "ArrayProto" ], [ "", "ObjProto" ], [ "", "SymbolProto" ], [ "", "push" ], [ "", "slice" ], [ "", "toString" ], [ "", "hasOwnProperty" ], [ "", "supportsArrayBuffer" ], [ "", "supportsDataView" ], [ "", "nativeIsArray" ], [ "", "nativeKeys" ], [ "", "nativeCreate" ], [ "", "nativeIsView" ], [ "", "isNaN" ], [ "", "isFinite" ], [ "", "hasEnumBug" ], [ "", "nonEnumerableProps" ], [ "", "MAX_ARRAY_INDEX" ], [ "", "Math.pow" ], [ "", "rgclga" ], [ "", "quotient8" ], [ "", "startIndex" ], [ "", "length" ], [ "", "Math.max" ], [ "", "rest" ], [ "", "Array" ], [ "", "index" ], [ "", "rest.index" ], [ "", "func.call" ], [ "", "func.call" ], [ "", "func.call" ], [ "", "args" ], [ "", "Array" ], [ "", "index" ], [ "", "args.index" ], [ "", "args.startIndex" ], [ "", "func.apply" ], [ "", "type" ], [ "", "toString.call" ], [ "", "tag" ], [ "", "toString.call" ], [ "", "isString" ], [ "", "tagTester" ], [ "", "isNumber" ], [ "", "tagTester" ], [ "", "isDate" ], [ "", "tagTester" ], [ "", "isRegExp" ], [ "", "tagTester" ], [ "", "isError" ], [ "", "tagTester" ], [ "", "isSymbol" ], [ "", "tagTester" ], [ "", "isArrayBuffer" ], [ "", "tagTester" ], [ "", "isFunction" ], [ "", "tagTester" ], [ "", "underi" ], [ "", "lvyuxg" ], [ "", "mind2" ], [ "", "lvyuxg" ], [ "", "soily" ], [ "", "stoodu.lvyuxg" ], [ "", "lvyuxg" ], [ "", "soily" ], [ "", "tall4" ], [ "", "stoodu.lvyuxg" ], [ "", "lvyuxg" ], [ "", "soily" ], [ "", "nodelist" ], [ "", "isFunction" ], [ "", "isFunction$1" ], [ "", "hasObjectTag" ], [ "", "tagTester" ], [ "", "hasStringTagBug" ], [ "", "hasObjectTag" ], [ "", "isIE11" ], [ "", "hasObjectTag" ], [ "", "isDataView" ], [ "", "tagTester" ], [ "", "wrong48" ], [ "", "isFunction$1" ], [ "", "isArrayBuffer" ], [ "", "isDataView$1" ], [ "", "isArray" ], [ "", "tagTester" ], [ "", "hasOwnProperty.call" ], [ "", "isArguments" ], [ "", "tagTester" ], [ "", "isArguments" ], [ "", "isArguments" ], [ "", "has$1" ], [ "", "isArguments$1" ], [ "", "isSymbol" ], [ "", "isFinite" ], [ "", "isNaN" ], [ "", "parseFloat" ], [ "", "isNumber" ], [ "", "isNaN" ], [ "", "sizeProperty" ], [ "", "getSizeProperty" ], [ "", "getByteLength" ], [ "", "shallowProperty" ], [ "", "isBufferLike" ], [ "", "createSizePropertyCheck" ], [ "", "typedArrayPattern" ], [ "", "nativeIsView" ], [ "", "isDataView$1" ], [ "", "isBufferLike" ], [ "", "typedArrayPattern.test" ], [ "", "toString.call" ], [ "", "isTypedArray$1" ], [ "", "constant" ], [ "", "getLength" ], [ "", "shallowProperty" ], [ "", "pnpw" ], [ "", "pnpw" ], [ "", "hash" ], [ "", "hash.keys.i" ], [ "", "hash.key" ], [ "", "keys.push" ], [ "", "keys" ], [ "", "emulatedSet" ], [ "", "nonEnumIdx" ], [ "", "constructor" ], [ "", "proto" ], [ "", "isFunction$1" ], [ "", "prop" ], [ "", "has$1" ], [ "", "keys.contains" ], [ "", "keys.push" ], [ "", "prop" ], [ "", "keys.contains" ], [ "", "keys.push" ], [ "", "isObject" ], [ "", "nativeKeys" ], [ "", "keys" ], [ "", "has$1" ], [ "", "keys.push" ], [ "", "collectNonEnumProps" ], [ "", "length" ], [ "", "getLength" ], [ "", "isArray" ], [ "", "isString" ], [ "", "isArguments$1" ], [ "", "getLength" ], [ "", "keys" ], [ "", "keys" ], [ "", "keys" ], [ "", "length" ], [ "", "obj" ], [ "", "Object" ], [ "", "key" ], [ "", "causer" ], [ "", "causer.substr" ], [ "", "1.VERSION" ], [ "", "1.prototype.value" ], [ "", "1.prototype.valueOf" ], [ "", "1.prototype.toJSON" ], [ "", "1.prototype.toString" ], [ "", "String" ], [ "", "getByteLength" ], [ "", "tagDataView" ], [ "", "type" ], [ "", "deepEq" ], [ "", "className" ], [ "", "toString.call" ], [ "", "toString.call" ], [ "", "isDataView$1" ], [ "", "isDataView$1" ], [ "", "className" ], [ "", "SymbolProto.valueOf.call" ], [ "", "SymbolProto.valueOf.call" ], [ "", "deepEq" ], [ "", "toBufferView" ], [ "", "toBufferView" ], [ "", "areArrays" ], [ "", "isTypedArray$1" ], [ "", "byteLength" ], [ "", "getByteLength" ], [ "", "getByteLength" ], [ "", "areArrays" ], [ "", "aCtor" ], [ "", "bCtor" ], [ "", "isFunction$1" ], [ "", "isFunction$1" ], [ "", "aStack" ], [ "", "bStack" ], [ "", "length" ], [ "", "aStack.push" ], [ "", "bStack.push" ], [ "", "length" ], [ "", "eq" ], [ "", "keys" ], [ "", "keys" ], [ "", "key" ], [ "", "length" ], [ "", "keys" ], [ "", "key" ], [ "", "has$1" ], [ "", "eq" ], [ "", "aStack.pop" ], [ "", "bStack.pop" ], [ "", "eq" ], [ "", "consider7" ], [ "", "isObject" ], [ "", "keys" ], [ "", "keys.push" ], [ "", "collectNonEnumProps" ], [ "", "rfdu" ], [ "", "languagenp" ], [ "", "famous3" ], [ "", "length" ], [ "", "getLength" ], [ "", "keys" ], [ "", "allKeys" ], [ "", "getLength" ], [ "", "isFunction$1" ], [ "", "isFunction$1" ], [ "", "forEachName" ], [ "", "hasName" ], [ "", "commonInit" ], [ "", "mapTail" ], [ "", "mapMethods" ], [ "", "commonInit.concat" ], [ "", "weakMapMethods" ], [ "", "commonInit.concat" ], [ "", "setMethods" ], [ "", "rfdu.oiuyta" ], [ "", "rfdu.oiuyta" ], [ "", "zhnnw" ], [ "", "isMap" ], [ "", "ie11fingerprint" ], [ "", "tagTester" ], [ "", "consider7" ], [ "", "smoxxmp" ], [ "", "zhnnw.stope" ], [ "", "isWeakMap" ], [ "", "ie11fingerprint" ], [ "", "tagTester" ], [ "", "isSet" ], [ "", "ie11fingerprint" ], [ "", "tagTester" ], [ "", "isWeakSet" ], [ "", "tagTester" ], [ "", "keys" ], [ "", "keys" ], [ "", "length" ], [ "", "values" ], [ "", "Array" ], [ "", "values.i" ], [ "", "keys" ], [ "", "keys" ], [ "", "length" ], [ "", "pairs" ], [ "", "Array" ], [ "", "pairs.i" ], [ "", "result" ], [ "", "keys" ], [ "", "keys" ], [ "", "length" ], [ "", "result.obj._keys.i" ], [ "", "names" ], [ "", "isFunction$1" ], [ "", "names.push" ], [ "", "names.sort" ], [ "", "length" ], [ "", "obj" ], [ "", "Object" ], [ "", "index" ], [ "", "source" ], [ "", "keys" ], [ "", "keysFunc" ], [ "", "key" ], [ "", "obj.key" ], [ "", "extend" ], [ "", "createAssigner" ], [ "", "extendOwn" ], [ "", "createAssigner" ], [ "", "defaults" ], [ "", "createAssigner" ], [ "", "soily" ], [ "", "isObject" ], [ "", "nativeCreate" ], [ "", "Ctor" ], [ "", "ctor" ], [ "", "Ctor.prototype" ], [ "", "result" ], [ "", "Ctor.prototype" ], [ "", "result" ], [ "", "baseCreate" ], [ "", "extendOwn" ], [ "", "isObject" ], [ "", "isArray" ], [ "", "obj.slice" ], [ "", "extend" ], [ "", "interceptor" ], [ "", "isArray" ], [ "", "1.toPath" ], [ "", "1.toPath" ], [ "", "length" ], [ "", "obj" ], [ "", "value" ], [ "", "deepGet" ], [ "", "toPath" ], [ "", "isUndefined" ], [ "", "valleya" ], [ "", "path" ], [ "", "toPath" ], [ "", "length" ], [ "", "key" ], [ "", "has$1" ], [ "", "obj" ], [ "", "attrs" ], [ "", "extendOwn" ], [ "", "isMatch" ], [ "", "path" ], [ "", "toPath" ], [ "", "deepGet" ], [ "", "func.call" ], [ "", "func.call" ], [ "", "func.call" ], [ "", "func.apply" ], [ "", "nature6" ], [ "", "warmh8" ], [ "", "isFunction$1" ], [ "", "optimizeCb" ], [ "", "isObject" ], [ "", "isArray" ], [ "", "matcher" ], [ "", "property" ], [ "", "baseIteratee" ], [ "", "stepd" ], [ "", "1.iteratee" ], [ "", "slave1" ], [ "", "oiuyta" ], [ "", "ugddk" ], [ "", "1.iteratee" ], [ "", "baseIteratee" ], [ "", "tall4" ], [ "", "moymqe" ], [ "", "iteratee" ], [ "", "cb" ], [ "", "keys" ], [ "", "keys" ], [ "", "length" ], [ "", "results" ], [ "", "index" ], [ "", "currentKey" ], [ "", "results.currentKey" ], [ "", "iteratee" ], [ "", "get" ], [ "", "differa" ], [ "", "accum" ], [ "", "Array" ], [ "", "Math.max" ], [ "", "iteratee" ], [ "", "optimizeCb" ], [ "", "accum.i" ], [ "", "iteratee" ], [ "", "exact2" ], [ "", "max" ], [ "", "min" ], [ "", "Math.floor" ], [ "", "Math.random" ], [ "", "now" ], [ "", "charge6" ], [ "", "mean2" ], [ "", "escaper" ], [ "", "source" ], [ "", "keys.join" ], [ "", "keys" ], [ "", "testRegexp" ], [ "", "RegExp" ], [ "", "replaceRegexp" ], [ "", "RegExp" ], [ "", "string" ], [ "", "testRegexp.test" ], [ "", "string.replace" ], [ "", "horse8" ], [ "", "hopey" ], [ "", "escapeMap" ], [ "", "zhnnw" ], [ "", "krth" ], [ "", "escape" ], [ "", "createEscaper" ], [ "", "dier" ], [ "", "unescapeMap" ], [ "", "invert" ], [ "", "unescape" ], [ "", "createEscaper" ], [ "", "templateSettings" ], [ "", "1.templateSettings" ], [ "", "voice4" ], [ "", "at3" ], [ "", "noMatch" ], [ "", "gkatlc5" ], [ "", "escapes" ], [ "", "escapeRegExp" ], [ "", "rbyfbab" ], [ "", "cutl" ], [ "", "some0x" ], [ "", "four2" ], [ "", "bareIdentifier" ], [ "", "sell2" ], [ "", "stope" ], [ "", "settings" ], [ "", "settings" ], [ "", "defaults" ], [ "", "matcher" ], [ "", "RegExp" ], [ "", "index" ], [ "", "source" ], [ "", "text.replace" ], [ "", "text.slice.replace" ], [ "", "text.slice" ], [ "", "index" ], [ "", "argument" ], [ "", "bareIdentifier.test" ], [ "", "source" ], [ "", "argument" ], [ "", "source" ], [ "", "render" ], [ "", "render" ], [ "", "e.source" ], [ "", "template" ], [ "", "render.call" ], [ "", "template.source" ], [ "", "stoodu" ], [ "", "busy2" ], [ "", "paint5" ], [ "", "path" ], [ "", "toPath" ], [ "", "length" ], [ "", "isFunction$1" ], [ "", "fallback.call" ], [ "", "prop" ], [ "", "prop" ], [ "", "obj" ], [ "", "isFunction$1" ], [ "", "prop.call" ], [ "", "thate" ], [ "", "arrive1" ], [ "", "idCounter" ], [ "", "id" ], [ "", "than1" ], [ "", "instance" ], [ "", "instance._chain" ], [ "", "peianj" ], [ "", "experiencex" ], [ "", "rosej" ], [ "", "sourceFunc.apply" ], [ "", "self" ], [ "", "baseCreate" ], [ "", "result" ], [ "", "sourceFunc.apply" ], [ "", "isObject" ], [ "", "zgocofwc" ], [ "", "partial" ], [ "", "restArguments" ], [ "", "placeholder" ], [ "", "bound" ], [ "", "position" ], [ "", "length" ], [ "", "args" ], [ "", "Array" ], [ "", "args.i" ], [ "", "args.push" ], [ "", "executeBound" ], [ "", "supportm" ], [ "", "partial.placeholder" ], [ "", "kcrar" ], [ "", "bind" ], [ "", "restArguments" ], [ "", "isFunction$1" ], [ "", "bound" ], [ "", "restArguments" ], [ "", "executeBound" ], [ "", "args.concat" ], [ "", "poorl" ], [ "", "wave95" ], [ "", "manyd" ], [ "", "isArrayLike" ], [ "", "createSizePropertyCheck" ], [ "", "output" ], [ "", "depth" ], [ "", "output.concat" ], [ "", "idx" ], [ "", "length" ], [ "", "getLength" ], [ "", "value" ], [ "", "isArrayLike" ], [ "", "isArray" ], [ "", "isArguments$1" ], [ "", "flatten$1" ], [ "", "idx" ], [ "", "len" ], [ "", "record0" ], [ "", "pairg" ], [ "", "bindAll" ], [ "", "restArguments" ], [ "", "keys" ], [ "", "flatten$1" ], [ "", "index" ], [ "", "key" ], [ "", "obj.key" ], [ "", "bind" ], [ "", "must79" ], [ "", "memoize" ], [ "", "cache" ], [ "", "address" ], [ "", "hasher.apply" ], [ "", "has$1" ], [ "", "cache.address" ], [ "", "func.apply" ], [ "", "memoize.cache" ], [ "", "delay" ], [ "", "restArguments" ], [ "", "setTimeout" ], [ "", "func.apply" ], [ "", "yxfri" ], [ "", "defer" ], [ "", "partial" ], [ "", "marbz" ], [ "", "feed7" ], [ "", "reachwv5" ], [ "", "qvrdjt" ], [ "", "timeout" ], [ "", "context" ], [ "", "args" ], [ "", "result" ], [ "", "previous" ], [ "", "options" ], [ "", "later" ], [ "", "previous" ], [ "", "now" ], [ "", "timeout" ], [ "", "result" ], [ "", "func.apply" ], [ "", "context" ], [ "", "args" ], [ "", "throttled" ], [ "", "now" ], [ "", "now" ], [ "", "previous" ], [ "", "remaining" ], [ "", "context" ], [ "", "args" ], [ "", "clearTimeout" ], [ "", "timeout" ], [ "", "previous" ], [ "", "result" ], [ "", "func.apply" ], [ "", "context" ], [ "", "args" ], [ "", "timeout" ], [ "", "setTimeout" ], [ "", "throttled.cancel" ], [ "", "clearTimeout" ], [ "", "previous" ], [ "", "timeout" ], [ "", "context" ], [ "", "args" ], [ "", "dwtl" ], [ "", "ccopu" ], [ "", "has5" ], [ "", "timeout" ], [ "", "previous" ], [ "", "args" ], [ "", "result" ], [ "", "context" ], [ "", "later" ], [ "", "passed" ], [ "", "now" ], [ "", "timeout" ], [ "", "setTimeout" ], [ "", "timeout" ], [ "", "result" ], [ "", "func.apply" ], [ "", "args" ], [ "", "context" ], [ "", "debounced" ], [ "", "restArguments" ], [ "", "context" ], [ "", "args" ], [ "", "previous" ], [ "", "now" ], [ "", "timeout" ], [ "", "setTimeout" ], [ "", "result" ], [ "", "func.apply" ], [ "", "debounced.cancel" ], [ "", "clearTimeout" ], [ "", "timeout" ], [ "", "args" ], [ "", "context" ], [ "", "trip5" ], [ "", "partial" ], [ "", "fxqllcct" ], [ "", "predicate.apply" ], [ "", "nxlvky" ], [ "", "devb" ], [ "", "args" ], [ "", "start" ], [ "", "result" ], [ "", "args.start.apply" ], [ "", "result" ], [ "", "args.i.call" ], [ "", "func.apply" ], [ "", "chartr" ], [ "", "memo" ], [ "", "memo" ], [ "", "func.apply" ], [ "", "func" ], [ "", "sljosao" ], [ "", "offer7" ], [ "", "psjop" ], [ "", "once" ], [ "", "partial" ], [ "", "courseo" ], [ "", "xgwu" ], [ "", "predicate" ], [ "", "cb" ], [ "", "keys" ], [ "", "keys" ], [ "", "key" ], [ "", "length" ], [ "", "key" ], [ "", "predicate" ], [ "", "ground9" ], [ "", "epxkya" ], [ "", "predicate" ], [ "", "cb" ], [ "", "length" ], [ "", "getLength" ], [ "", "index" ], [ "", "predicate" ], [ "", "findIndex" ], [ "", "createPredicateIndexFinder" ], [ "", "applea" ], [ "", "findLastIndex" ], [ "", "createPredicateIndexFinder" ], [ "", "exercise8" ], [ "", "scale4" ], [ "", "qxncw" ], [ "", "iteratee" ], [ "", "cb" ], [ "", "value" ], [ "", "iteratee" ], [ "", "low" ], [ "", "high" ], [ "", "getLength" ], [ "", "mid" ], [ "", "Math.floor" ], [ "", "iteratee" ], [ "", "low" ], [ "", "high" ], [ "", "saty" ], [ "", "length" ], [ "", "getLength" ], [ "", "Math.max" ], [ "", "length" ], [ "", "Math.min" ], [ "", "idx" ], [ "", "sortedIndex" ], [ "", "idx" ], [ "", "predicateFind" ], [ "", "slice.call" ], [ "", "idx" ], [ "", "biqmm" ], [ "", "six0" ], [ "", "front5" ], [ "", "indexOf" ], [ "", "createIndexFinder" ], [ "", "lvnssl" ], [ "", "lastIndexOf" ], [ "", "createIndexFinder" ], [ "", "me2" ], [ "", "repeatz" ], [ "", "keyFinder" ], [ "", "isArrayLike" ], [ "", "key" ], [ "", "keyFinder" ], [ "", "late8" ], [ "", "find" ], [ "", "matcher" ], [ "", "multiply0" ], [ "", "fznb" ], [ "", "iteratee" ], [ "", "optimizeCb" ], [ "", "length" ], [ "", "isArrayLike" ], [ "", "length" ], [ "", "iteratee" ], [ "", "keys" ], [ "", "keys" ], [ "", "length" ], [ "", "iteratee" ], [ "", "interest4" ], [ "", "iteratee" ], [ "", "cb" ], [ "", "keys" ], [ "", "isArrayLike" ], [ "", "keys" ], [ "", "length" ], [ "", "results" ], [ "", "Array" ], [ "", "index" ], [ "", "currentKey" ], [ "", "results.index" ], [ "", "iteratee" ], [ "", "atom3" ], [ "", "asrevapy2" ], [ "", "reducer" ], [ "", "keys" ], [ "", "isArrayLike" ], [ "", "keys" ], [ "", "length" ], [ "", "index" ], [ "", "memo" ], [ "", "currentKey" ], [ "", "memo" ], [ "", "iteratee" ], [ "", "initial" ], [ "", "reducer" ], [ "", "optimizeCb" ], [ "", "reduce" ], [ "", "createReduce" ], [ "", "qzrb" ], [ "", "governq" ], [ "", "reduceRight" ], [ "", "createReduce" ], [ "", "angera" ], [ "", "results" ], [ "", "predicate" ], [ "", "cb" ], [ "", "each" ], [ "", "predicate" ], [ "", "results.push" ], [ "", "captainjl" ], [ "", "ryokf" ], [ "", "filter" ], [ "", "negate" ], [ "", "cb" ], [ "", "predicate" ], [ "", "cb" ], [ "", "keys" ], [ "", "isArrayLike" ], [ "", "keys" ], [ "", "length" ], [ "", "index" ], [ "", "currentKey" ], [ "", "predicate" ], [ "", "best3" ], [ "", "predicate" ], [ "", "cb" ], [ "", "keys" ], [ "", "isArrayLike" ], [ "", "length" ], [ "", "index" ], [ "", "currentKey" ], [ "", "predicate" ], [ "", "nlqllq" ], [ "", "vtdwhy" ], [ "", "isArrayLike" ], [ "", "obj" ], [ "", "values" ], [ "", "fromIndex" ], [ "", "indexOf" ], [ "", "liee" ], [ "", "cat8" ], [ "", "clothe3" ], [ "", "invoke" ], [ "", "restArguments" ], [ "", "contextPath" ], [ "", "func" ], [ "", "isFunction$1" ], [ "", "func" ], [ "", "path" ], [ "", "toPath" ], [ "", "contextPath" ], [ "", "path.slice" ], [ "", "path" ], [ "", "map" ], [ "", "method" ], [ "", "context" ], [ "", "deepGet" ], [ "", "method" ], [ "", "method.apply" ], [ "", "city2" ], [ "", "sameh2" ], [ "", "wodud" ], [ "", "map" ], [ "", "property" ], [ "", "zcycce" ], [ "", "filter" ], [ "", "matcher" ], [ "", "result" ], [ "", "lastComputed" ], [ "", "value" ], [ "", "computed" ], [ "", "obj" ], [ "", "isArrayLike" ], [ "", "values" ], [ "", "length" ], [ "", "value" ], [ "", "result" ], [ "", "iteratee" ], [ "", "cb" ], [ "", "each" ], [ "", "computed" ], [ "", "iteratee" ], [ "", "result" ], [ "", "lastComputed" ], [ "", "feuk" ], [ "", "result" ], [ "", "lastComputed" ], [ "", "value" ], [ "", "computed" ], [ "", "obj" ], [ "", "isArrayLike" ], [ "", "values" ], [ "", "length" ], [ "", "value" ], [ "", "result" ], [ "", "iteratee" ], [ "", "cb" ], [ "", "each" ], [ "", "computed" ], [ "", "iteratee" ], [ "", "result" ], [ "", "lastComputed" ], [ "", "reStrSymbol" ], [ "", "pnerd" ], [ "", "isArray" ], [ "", "slice.call" ], [ "", "isString" ], [ "", "obj.match" ], [ "", "isArrayLike" ], [ "", "map" ], [ "", "values" ], [ "", "iqmfeg" ], [ "", "westu" ], [ "", "isArrayLike" ], [ "", "obj" ], [ "", "values" ], [ "", "random" ], [ "", "sample" ], [ "", "toArray" ], [ "", "length" ], [ "", "getLength" ], [ "", "Math.max" ], [ "", "Math.min" ], [ "", "last" ], [ "", "index" ], [ "", "rand" ], [ "", "random" ], [ "", "temp" ], [ "", "sample.index" ], [ "", "sample.rand" ], [ "", "sample.slice" ], [ "", "smiyzt" ], [ "", "sample" ], [ "", "fruite" ], [ "", "index" ], [ "", "iteratee" ], [ "", "cb" ], [ "", "pluck" ], [ "", "map.sort" ], [ "", "map" ], [ "", "iteratee" ], [ "", "vlwzdh" ], [ "", "result" ], [ "", "iteratee" ], [ "", "cb" ], [ "", "each" ], [ "", "key" ], [ "", "iteratee" ], [ "", "behavior" ], [ "", "yzdkdd" ], [ "", "vulbvf" ], [ "", "groupBy" ], [ "", "group" ], [ "", "has$1" ], [ "", "result.key.push" ], [ "", "result.key" ], [ "", "qqxijdg" ], [ "", "indexBy" ], [ "", "group" ], [ "", "result.key" ], [ "", "vamop" ], [ "", "hearua" ], [ "", "ltutec" ], [ "", "countBy" ], [ "", "group" ], [ "", "has$1" ], [ "", "result.key" ], [ "", "prepare4" ], [ "", "off7" ], [ "", "partition" ], [ "", "group" ], [ "", "isArrayLike" ], [ "", "tiny1" ], [ "", "pick" ], [ "", "restArguments" ], [ "", "result" ], [ "", "iteratee" ], [ "", "isFunction$1" ], [ "", "iteratee" ], [ "", "optimizeCb" ], [ "", "allKeys" ], [ "", "iteratee" ], [ "", "flatten$1" ], [ "", "obj" ], [ "", "Object" ], [ "", "length" ], [ "", "key" ], [ "", "value" ], [ "", "iteratee" ], [ "", "result.key" ], [ "", "omit" ], [ "", "restArguments" ], [ "", "iteratee" ], [ "", "context" ], [ "", "isFunction$1" ], [ "", "iteratee" ], [ "", "negate" ], [ "", "context" ], [ "", "map" ], [ "", "flatten$1" ], [ "", "iteratee" ], [ "", "contains" ], [ "", "pick" ], [ "", "jcvebxo" ], [ "", "slice.call" ], [ "", "Math.max" ], [ "", "initial" ], [ "", "othdq" ], [ "", "opposite0" ], [ "", "slice.call" ], [ "", "hcyfld" ], [ "", "freshg" ], [ "", "rest" ], [ "", "Math.max" ], [ "", "block1" ], [ "", "filter" ], [ "", "ikbfq" ], [ "", "flatten$1" ], [ "", "sit9" ], [ "", "sentencef" ], [ "", "difference" ], [ "", "restArguments" ], [ "", "rest" ], [ "", "flatten$1" ], [ "", "filter" ], [ "", "contains" ], [ "", "without" ], [ "", "restArguments" ], [ "", "difference" ], [ "", "soon59" ], [ "", "winter2" ], [ "", "isBoolean" ], [ "", "context" ], [ "", "iteratee" ], [ "", "isSorted" ], [ "", "iteratee" ], [ "", "cb" ], [ "", "result" ], [ "", "seen" ], [ "", "getLength" ], [ "", "value" ], [ "", "computed" ], [ "", "iteratee" ], [ "", "result.push" ], [ "", "seen" ], [ "", "contains" ], [ "", "seen.push" ], [ "", "result.push" ], [ "", "contains" ], [ "", "result.push" ], [ "", "listl" ], [ "", "union" ], [ "", "restArguments" ], [ "", "uniq" ], [ "", "flatten$1" ], [ "", "three5" ], [ "", "particularq" ], [ "", "result" ], [ "", "argsLength" ], [ "", "getLength" ], [ "", "item" ], [ "", "contains" ], [ "", "contains" ], [ "", "result.push" ], [ "", "total6" ], [ "", "max" ], [ "", "result" ], [ "", "Array" ], [ "", "index" ], [ "", "result.index" ], [ "", "pluck" ], [ "", "rule1d" ], [ "", "zip" ], [ "", "restArguments" ], [ "", "iikg" ], [ "", "hkkf" ], [ "", "result" ], [ "", "getLength" ], [ "", "result.list.i" ], [ "", "station6" ], [ "", "stop" ], [ "", "start" ], [ "", "step" ], [ "", "Math.max" ], [ "", "Math.ceil" ], [ "", "range" ], [ "", "Array" ], [ "", "idx" ], [ "", "range.idx" ], [ "", "result" ], [ "", "result.push" ], [ "", "slice.call" ], [ "", "1.chain" ], [ "", "each" ], [ "", "functions" ], [ "", "func" ], [ "", "1.name" ], [ "", "1.prototype.name" ], [ "", "args" ], [ "", "push.apply" ], [ "", "chainResult" ], [ "", "func.apply" ], [ "", "each" ], [ "", "method" ], [ "", "1.prototype.name" ], [ "", "obj" ], [ "", "method.apply" ], [ "", "chainResult" ], [ "", "each" ], [ "", "method" ], [ "", "1.prototype.name" ], [ "", "obj" ], [ "", "obj" ], [ "", "method.apply" ], [ "", "chainResult" ], [ "", "allExports" ], [ "", "mixin" ], [ "", "will7" ], [ "", "._" ] ], "mbr": [ "Array.isArray", "Array.prototype", "ArrayBuffer.isView", "ArrayProto.push", "ArrayProto.slice", "Ctor.prototype", "Date().getTime", "Date.now", "Math.ceil", "Math.floor", "Math.max", "Math.min", "Math.pow", "Math.random", "ObjProto.hasOwnProperty", "ObjProto.toString", "Object.create", "Object.keys", "Object.prototype", "Symbol.prototype", "SymbolProto.valueOf", "SymbolProto.valueOf.call", "_$1().chain", "_$1.VERSION", "_$1.iteratee", "_$1.prototype", "_$1.prototype.toJSON", "_$1.prototype.toString", "_$1.prototype.value", "_$1.prototype.valueOf", "_$1.templateSettings", "_$1.toPath", "_._", "_keys.length", "a._wrapped", "a.buffer", "a.byteOffset", "a.constructor", "a.length", "aStack.length", "aStack.pop", "aStack.push", "args.concat", "args.length", "args.push", "arguments.length", "array.length", "b._wrapped", "b.buffer", "b.byteOffset", "b.constructor", "b.length", "bStack.pop", "bStack.push", "bareIdentifier.test", "boundArgs.length", "bufferSource.buffer", "bufferSource.byteOffset", "causer.substr", "commonInit.concat", "constructor.prototype", "contextPath.length", "debounced.cancel", "e.source", "fallback.call", "func.apply", "func.call", "func.length", "global.global", "hasOwnProperty.call", "hasher.apply", "instance._chain", "keys().join", "keys().length", "keys.contains", "keys.length", "keys.push", "left.criteria", "left.index", "map().sort", "match.length", "max().length", "memoize.cache", "method.apply", "names.push", "names.sort", "nonEnumerableProps.length", "obj.buffer", "obj.constructor", "obj.getInt8", "obj.length", "obj.match", "obj.nodeType", "obj.slice", "options.leading", "options.trailing", "output.concat", "output.length", "partial.placeholder", "path.length", "path.slice", "predicate.apply", "prop.call", "push.apply", "render.call", "result.push", "results.push", "right.criteria", "right.index", "root.document", "root.document.childNodes", "sample.slice", "seen.push", "self.self", "settings.escape", "settings.evaluate", "settings.interpolate", "settings.variable", "shop5.length", "slice.call", "sourceFunc.apply", "sourceFunc.prototype", "string.replace", "template.source", "testRegexp.test", "text.replace", "text.slice", "text.slice().replace", "throttled.cancel", "toString.call", "typedArrayPattern.test", "value.length" ], "tgt": [ "Array", "ArrayBuffer", "Ctor", "DataView", "Date", "Date().getTime", "Error", "Function", "Function()", "Map", "Math.ceil", "Math.floor", "Math.max", "Math.min", "Math.pow", "Math.random", "Object", "RegExp", "String", "SymbolProto.valueOf.call", "TypeError", "Uint8Array", "_$1", "_$1().chain", "_$1.iteratee", "_$1.toPath", "_isFinite", "_isNaN", "aStack.pop", "aStack.push", "allKeys", "args.concat", "args.push", "bStack.pop", "bStack.push", "bareIdentifier.test", "baseCreate", "baseIteratee", "behavior", "bind", "causer.substr", "cb", "chainResult", "clearTimeout", "collectNonEnumProps", "commonInit.concat", "consider7", "constant", "contains", "createAssigner", "createEscaper", "createIndexFinder", "createPredicateIndexFinder", "createReduce", "createSizePropertyCheck", "ctor", "deepEq", "deepGet", "defaults", "difference", "each", "emulatedSet", "eq", "executeBound", "extend", "extendOwn", "fallback.call", "famous3", "filter", "find", "flatten$1", "func.apply", "func.call", "functions", "get", "getByteLength", "getLength", "getSizeProperty", "glyyi", "group", "has$1", "hasObjectTag", "hasOwnProperty.call", "hasher.apply", "ie11fingerprint", "indexOf", "initial", "interceptor", "invert", "isArguments", "isArguments$1", "isArray", "isArrayBuffer", "isArrayLike", "isBoolean", "isBufferLike", "isDataView$1", "isFunction$1", "isMatch", "isNaN", "isNumber", "isObject", "isString", "isSymbol", "isTypedArray$1", "isUndefined", "iteratee", "keyFinder", "keys", "keys().join", "keys.contains", "keys.push", "keysFunc", "languagenp", "lvyuxg", "map", "map().sort", "matcher", "max", "method.apply", "mixin", "names.push", "names.sort", "nativeCreate", "nativeIsView", "nativeKeys", "negate", "now", "obj.match", "obj.slice", "optimizeCb", "output.concat", "parseFloat", "partial", "path.slice", "pick", "pluck", "predicate", "predicate.apply", "predicateFind", "prop.call", "property", "push.apply", "quotient8", "random", "reducer", "render.call", "rest", "restArguments", "result.push", "results.push", "rgclga", "sample", "sample.slice", "seen.push", "setTimeout", "shallowProperty", "slice.call", "soily", "sortedIndex", "sourceFunc.apply", "string.replace", "tagTester", "testRegexp.test", "text.replace", "text.slice", "text.slice().replace", "toArray", "toBufferView", "toPath", "toString.call", "typedArrayPattern.test", "uniq", "values", "weather7", "will7" ], "metrics": { "ast": { "op.eq": 87.0, "op.ge": 9.0, "op.gt": 13.0, "op.le": 5.0, "op.lt": 53.0, "op.ne": 45.0, "op.add": 107.0, "op.div": 6.0, "op.lor": 54.0, "op.mod": 1.0, "op.mul": 2.0, "op.sub": 41.0, "op.land": 68.0, "op.lnot": 67.0, "max_depth": 20.0, "bind_count": 610.0, "call_count": 467.0, "node_count": 30698.0, "member_count": 132.0, "op_density.eq": 0.0, "op_density.ge": 0.0, "op_density.gt": 0.0, "op_density.le": 0.0, "op_density.lt": 0.0, "op_density.ne": 0.0, "op_density.add": 0.0, "op_density.div": 0.0, "op_density.lor": 0.0, "op_density.mod": 0.0, "op_density.mul": 0.0, "op_density.sub": 0.0, "sequence_count": 3.0, "op_density.land": 0.0, "op_density.lnot": 0.0, "identifier_count": 623.0, "member_depth_max": 3.0, "self_compare_count": 2.0, "string_literal_count": 259.0, "identity_function_count": 1.0, "array_literal_max_length": 7.0, "const_return_function_count": 1.0, "const_return_function_ratio": 0.01, "string_concat_chain_max_length": 10.0 }, "file": { "size": 96059.0, "entropy": 4.97, "size_bytes": 96059.0 }, "text": { "tab_count": 62.0, "digit_ratio": 0.03, "space_count": 11716.0, "total_lines": 2354.0, "char_entropy": 4.97, "mixed_indent": 1.0, "unique_chars": 102.0, "escape_density": 0.23, "lines_over_200": 47.0, "lines_over_500": 19.0, "string_density": 0.11, "ascii_art_lines": 26.0, "avg_line_length": 39.81, "high_byte_ratio": 0.0, "lines_over_1000": 3.0, "max_line_length": 1076.0, "non_ascii_ratio": 0.0, "empty_line_ratio": 0.15, "last_line_length": 8.0, "long_token_count": 69.0, "whitespace_ratio": 0.15, "most_common_ratio": 0.16, "identifier_density": 1.58, "line_length_stddev": 77.02, "octal_escape_count": 151.0, "encoded_string_ratio": 0.0, "unicode_escape_count": 74.0, "normalized_string_count": 5.34, "repeated_char_sequences": 193.0, "suspicious_string_ratio": 0.03, "most_common_char_is_null": 0.0, "suspicious_comment_ratio": 0.05, "max_inline_whitespace_run": 5.0, "trailing_whitespace_lines": 1.0, "most_common_char_codepoint": 92.0, "suspicious_identifier_ratio": 0.02, "normalized_unique_identifiers": 55.62 }, "binds": { "count": 610.0 }, "calls": { "count": 467.0 }, "binary": { "overall_entropy": 4.97, "peak_region_bytes": 16384.0, "peak_region_entropy": 5.55 }, "source": { "function_count": 123.0 }, "members": { "count": 132.0 }, "strings": { "total": 259.0, "avg_length": 112.19, "max_length": 1063.0, "path_count": 1.0, "avg_entropy": 2.91, "email_count": 1.0, "empty_count": 7.0, "total_bytes": 29056.0, "entropy_stddev": 1.4, "base64_candidates": 1.0, "very_long_strings": 3.0, "high_entropy_count": 22.0, "shell_command_strings": 5.0, "embedded_code_candidates": 3.0 }, "comments": { "chars": 10887.0, "lines": 198.0, "total": 198.0, "to_code_ratio": 0.09, "url_in_comments": 3.0, "base64_in_comments": 4.0, "high_entropy_comments": 5.0 }, "functions": { "count": 123.0, "anonymous": 75.0, "avg_params": 1.83, "max_params": 7.0, "one_liners": 3.0, "length_stddev": 9.92, "over_100_lines": 1.0, "avg_name_length": 7.5, "no_params_count": 26.0, "avg_length_lines": 8.53, "max_length_lines": 103.0, "min_length_lines": 1.0, "nested_functions": 42.0, "avg_nesting_depth": 0.28, "max_nesting_depth": 2.0, "high_entropy_names": 3.0, "single_char_params": 14.0, "numeric_suffix_names": 5.0, "avg_param_name_length": 5.18, "density_per_100_lines": 8.41, "code_in_functions_ratio": 0.72 }, "identifiers": { "count": 623.0, "total": 3719.0, "avg_length": 6.9, "max_length": 26.0, "min_length": 1.0, "avg_entropy": 2.4, "reuse_ratio": 0.17, "unique_count": 623.0, "length_stddev": 3.1, "has_digit_ratio": 0.15, "sequential_names": 8.0, "base64_like_names": 3.0, "single_char_count": 9.0, "single_char_ratio": 0.01, "high_entropy_count": 8.0, "high_entropy_ratio": 0.01, "all_lowercase_ratio": 0.58, "all_uppercase_ratio": 0.0, "numeric_suffix_count": 85.0, "double_underscore_count": 1.0, "underscore_prefix_count": 12.0 } } }, "id": 1, "mol": "O₂(AsXe)H₂(DbPo)", "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/2022-11/7d9e501b578a7cfe2a1c2f31d78a7f62708518c0d142339fc4f554c4aa1dee90.zip!!Benefit_premium_repayment_agreement (dxe).js", "risk": 4, "sha": "60a1f6e1b5b6b885cfe50ed7a8e76cdba9063c2fada2cc51147d5062788b131b", "size": 96059, "traits": [ { "id": "metadata/file/format::vocab-number", "conf": 0.9700000286102295, "crit": 1, "desc": "Validation vocabulary number", "spans": [ [ 4536, 6 ], [ 7589, 6 ] ] }, { "id": "metadata/file/string/identity::chunk-token", "conf": 0.949999988079071, "crit": 1, "desc": "Source chunk token", "spans": [ [ 91522, 5 ] ] }, { "id": "micro-behaviors/communications/url/encoded::js-commented-url-line-context", "atk": "T1027", "mbc": "B0032", "conf": 0.8999999761581421, "crit": 1, "desc": "JavaScript commented URL line context", "spans": [ [ 169, 15 ] ] }, { "id": "metadata/file/format::vocab-string", "conf": 0.9700000286102295, "crit": 1, "desc": "Validation vocabulary string", "spans": [ [ 4499, 6 ] ] }, { "id": "micro-behaviors/communications/url/encoded::encoded-url-public-doc-context", "atk": "T1027", "mbc": "B0032", "conf": 0.8999999761581421, "crit": 1, "desc": "Encoded URL public documentation", "spans": [ [ 69899, 19 ] ] }, { "id": "metadata/file/format::vocab-array", "conf": 0.9700000286102295, "crit": 1, "desc": "Validation vocabulary array", "spans": [ [ 6467, 5 ] ] }, { "id": "objectives/command-and-control/remote-command/keywords::output", "conf": 0.20000000298023224, "crit": 1, "desc": "Output word for remote-command composites", "spans": [ [ 38749, 6 ] ] }, { "id": "metadata/file/format::vocab-object", "conf": 0.9700000286102295, "crit": 1, "desc": "Validation vocabulary object", "spans": [ [ 989, 6 ], [ 5573, 6 ] ] }, { "id": "micro-behaviors/communications/url/encoded::encoded-url-mdn-doc-context", "atk": "T1027", "mbc": "B0032", "conf": 0.949999988079071, "crit": 1, "desc": "Encoded URL references MDN documentation", "spans": [ [ 21730, 22 ] ] }, { "id": "metadata/file/format::vocab-boolean", "conf": 0.9700000286102295, "crit": 1, "desc": "Validation vocabulary boolean", "spans": [ [ 4153, 7 ] ] }, { "id": "metadata/file/metrics::single-long-line", "conf": 0.8999999761581421, "crit": 1, "desc": "Very long line", "spans": [ [ 47847, 1076 ] ] }, { "id": "objectives/supply-chain/impersonation/homograph::url-non-ascii", "atk": "T1036", "mbc": "B0030", "conf": 0.6000000238418579, "crit": 3, "desc": "URL contains non-ASCII characters", "spans": [ [ 69888, 39 ] ] }, { "id": "objectives/supply-chain/trojanized/library/remote-eval::retry-guard-positive", "atk": "T1105", "conf": 0.8399999737739563, "crit": 1, "desc": "Retry guard checks positive counter", "spans": [ [ 50984, 12 ] ] }, { "id": "micro-behaviors/data/encode/skip-step::js-concat-chain", "conf": 0.699999988079071, "crit": 3, "desc": "JavaScript massive string concatenation chain", "spans": [ [ 52, 65 ] ] }, { "id": "objectives/anti-static/obfuscation/syntax::js-useless-arithmetic", "conf": 0.800000011920929, "crit": 3, "desc": "Binary op with identical operands (5-5, x===x)", "spans": [ [ 0, 29 ] ] }, { "id": "objectives/execution/interpreter/eval/dynamic::js-assign-global-this", "conf": 0.699999988079071, "crit": 3, "desc": "Assigning 'this' (global object) to a variable", "spans": [ [ 42227, 15 ] ] }, { "id": "objectives/supply-chain/trojanized/library/remote-eval::self-recursion-minus-one", "atk": "T1105", "conf": 0.8600000143051147, "crit": 1, "desc": "Recursive retry decrements counter", "spans": [ [ 70380, 22 ] ] }, { "id": "micro-behaviors/process/interpreter/eval::js-new-function-constructor", "conf": 0.699999988079071, "crit": 3, "desc": "JavaScript new Function constructor", "spans": [ [ 34214, 13 ] ] }, { "id": "objectives/impact/destroy/keywords::delete-verb--delete", "conf": 0.8999999761581421, "crit": 1, "desc": "Destructive-action word: delete", "spans": [ [ 19034, 6 ] ] } ], "type": "javascript" } ], "rev": "46112", "v": "8" } }