{ "ml": { "v": "7", "eng": "2.12.0-beta.2", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.000027050575, "rte": "az", "prob": 0.000027050575 }, { "cls": 0, "raw": 0.0003827413, "rte": "az/tar", "prob": 0.0003827413 } ], "prob": 0.00004218022, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.000042180221498711035, "type": "tar.gz" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.000012894471183244605, "type": "shell" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.000030348697691806592, "type": "zip" }, { "id": 35, "lvl": -1, "conf": 0, "prob": 0.000010152657523576636, "type": "xml" }, { "id": 38, "lvl": -1, "conf": 0, "prob": 0.000012348095879133325, "type": "xml" }, { "id": 47, "lvl": -1, "conf": 0, "prob": 0.000009795029654924292, "type": "text" }, { "id": 50, "lvl": -1, "conf": 0, "prob": 0.00003491838651825674, "type": "jar" }, { "id": 54, "lvl": -1, "conf": 0, "prob": 0.000012874603271484375, "type": "java_class" }, { "id": 59, "lvl": -1, "conf": 0, "prob": 0.000012000401511613745, "type": "java_class" }, { "id": 60, "lvl": -1, "conf": 0, "prob": 0.000006705522537231445, "type": "java_class" }, { "id": 61, "lvl": -1, "conf": 0, "prob": 0.00001276532839256106, "type": "java_class" }, { "id": 62, "lvl": -1, "conf": 0, "prob": 0.00001276532839256106, "type": "java_class" }, { "id": 63, "lvl": -1, "conf": 0, "prob": 0.00001973907092178706, "type": "java_class" }, { "id": 64, "lvl": -1, "conf": 0, "prob": 0.000013132889762346167, "type": "java_class" }, { "id": 68, "lvl": -1, "conf": 0, "prob": 0.000011960665688093286, "type": "java_class" }, { "id": 69, "lvl": -1, "conf": 0, "prob": 0.00001189112663269043, "type": "java_class" }, { "id": 70, "lvl": -1, "conf": 0, "prob": 0.000042180221498711035, "type": "java_class" }, { "id": 72, "lvl": -1, "conf": 0, "prob": 0.000024904808014980517, "type": "java_class" }, { "id": 74, "lvl": -1, "conf": 0, "prob": 0.000013738870620727539, "type": "java_class" }, { "id": 78, "lvl": -1, "conf": 0, "prob": 0.000011245409950788599, "type": "java_class" } ], "version": "v18.18", "analyzed_at": "2026-10-02T22:52:41Z" }, "path": "libreoffice-extension-coooder-1.1.2-8.src.tar.gz", "raw": { "fetched": [ { "kind": "dependency", "cached": false, "locator": "pkg:alpm/arch/libreoffice", "outcome": "unresolved", "fetched_at": 0, "source_offset": 10, "source_sha256": "164c56d741c73675f70e05854c3286367bf77e8cf061039620cb4ce238e757a7" }, { "kind": "dependency", "size": 411328, "cached": false, "status": 200, "headers": [ [ "server", "nginx/1.22.1" ], [ "date", "Fri, 02 Oct 2026 22:52:32 GMT" ], [ "content-type", "application/vnd.openofficeorg.extension" ], [ "content-length", "411328" ], [ "last-modified", "Thu, 05 Mar 2020 21:50:23 GMT" ], [ "connection", "keep-alive" ], [ "etag", "\"5e61741f-646c0\"" ], [ "referrer-policy", "strict-origin-when-cross-origin" ], [ "x-content-type-options", "nosniff" ], [ "x-frame-options", "SAMEORIGIN" ], [ "x-xss-protection", "1; mode=block" ], [ "content-security-policy", "default-src 'none'; connect-src 'self' https://piwik.documentfoundation.org; font-src 'self'; form-action 'self' https://auth.documentfoundation.org; frame-ancestors 'self'; frame-src 'self' https://www.google.com; img-src 'self' data: https://piwik.documentfoundation.org; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://piwik.documentfoundation.org https://www.google.com https://www.gstatic.com; style-src 'self' 'unsafe-inline'" ], [ "strict-transport-security", "max-age=31557600; includeSubDomains" ], [ "accept-ranges", "bytes" ] ], "locator": "https://extensions.libreoffice.org/assets/downloads/z/coooder-1-1-2.oxt", "outcome": "ok", "final_url": "https://extensions.libreoffice.org/assets/downloads/z/coooder-1-1-2.oxt", "fetched_at": 1790981552, "resolved_url": "https://extensions.libreoffice.org/assets/downloads/z/coooder-1-1-2.oxt", "source_offset": 256, "source_sha256": "164c56d741c73675f70e05854c3286367bf77e8cf061039620cb4ce238e757a7", "content_sha256": "81bf965b0e3ac6e728ced3e668ded76be9331cd15defe7b0a6bf44710b244373" } ], "files": [ { "id": 0, "mol": "O(Er)H(F)", "sha": "8bfb000e8d981ec87ff93d9f338d8e3ba6a68c3eff332820da1d773aa9802e24", "path": "/tmp/promoter-1870801103/8bfb000e8d981ec87ff93d9f338d8e3ba6a68c3eff332820da1d773aa9802e24/libreoffice-extension-coooder-1.1.2-8.src.tar.gz", "risk": 3, "size": 721, "type": "tar.gz", "facts": { "metrics": { "file": { "size": 721, "entropy": 7.66 }, "parse": { "error_count": 1 }, "binary": { "peak_region_bytes": 721, "peak_region_entropy": 7.66 } } }, "ident": { "name": { "value": "libreoffice-extension-coooder", "source": "file.basename", "verified": false }, "trust": "unsigned", "version": { "value": "1.1.2-8.src", "source": "file.basename", "verified": false } }, "traits": [ { "id": "micro-behaviors/fs/delete/file/command::rm-force-variable-target", "atk": "T1070.004", "mbc": "C0047", "conf": 0.9, "crit": 3, "desc": "Force-deletes a shell variable target", "from": [ { "file": 2 } ] }, { "id": "objectives/evasion/masquerade/file/lure::pdf-search-home-posix--rx-6", "atk": "T1036", "conf": 0.9, "crit": 3, "desc": "Downloads directory reference", "from": [ { "file": 2 } ] }, { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "from": [ { "file": 2 } ] }, { "id": "objectives/supply-chain/impersonation/package/pkgbuild::srcinfo-pkgver-match", "atk": "T1195.002", "conf": 0.6, "crit": 3, "desc": "PKGBUILD pkgver matches .SRCINFO" } ] }, { "ctx": [ { "b": "x(+z9aAI*CByxzpxLz9)y?WJ}BzkS9az2!twO#N6z/cXfz/M$4A+PSbAXnKyvrb\u003c\u003ejT.W^zH0PU3uZx9jTaMYBz#pZfe3)YBy/uhx(v)ge]klhA+ff3w[+:^e]L=yfj/xIwO#N6z/fRHbWUB$zdK)#y?Wx\u003czGxwLc)}XUp!Sk=3s)Z!wO#41jT.W]x\u003c#9]z!rP}v}v2p3uHcdA:@Vzc)AtDBz#pZfe3)YBy/uhx(v)ge]klhA+ff3w[+:^e]L=yfjw{ywPR#Dwn=Wfy\u0026r-)B1.?)bZS)ovqPO7eHkWZyId*4AXx6#fd?P8z*lvFdgf{5hfi[SB3g{0h!1EHwh#Uegb*{BgDw]7fF+yswO2segH%%bh-Lk3cN/xfAa9l(vp%c]c[co=3lQE9zGx]dy?$jCwfr6wAbf8%x(U\u003eHB8\u0026{Ix\u003c@-ix\u003c#9]z!rP}v}vrmxKL{)fj/xIwO#N6z/fRHa{]Cnv@JLxqxNeeB8\u003e=3x(Uyua%.byxjLZ%flItRfkLuifkLuiA+ff3w[+:^flp/nA+c[nCYWImB7]MgB1X!CzEEx[a{]CnA+#{Jw/@oyAbf8%x(U\u003eyx\u003c@-ix\u003c#9]z!rP}v}vrmxKL{)fj/xIwO#N6z/fRHv@Do@wPxBHDTyV0zdObEbZTGCxlE\u003cbfe1}heQYl\u0026CYUbpEf]", "ln": 138, "col": 18, "line": 7 } ], "depth": 1, "facts": { "imp": [ [ "", "install" ], [ "", "cp" ], [ "", "rm" ] ], "tgt": [ "cp", "install", "rm" ], "funcs": [ [ "package", 438 ] ], "metrics": { "ast": { "max_depth": 6, "call_count": 3, "node_count": 150, "op.floordiv": 2, "max_array_len": 1, "op_density.floordiv": 0.01 }, "file": { "size": 672, "entropy": 5.14 }, "text": { "lines": 19, "top_char": 101, "max_ws_run": 1, "digit_ratio": 0.05, "space_count": 29, "char_entropy": 5.14, "unique_chars": 59, "top_char_null": 0, "string_density": 0.58, "top_char_ratio": 0.09, "avg_line_length": 34.37, "max_line_length": 92, "empty_line_ratio": 0.11, "last_line_length": 1, "whitespace_ratio": 0.07, "identifier_density": 1.89, "line_length_stddev": 29.14, "encoded_string_ratio": 0.09, "normalized_string_count": 2.52, "normalized_unique_identifiers": 5.65 }, "binds": { "count": 11 }, "binary": { "peak_region_bytes": 672, "peak_region_entropy": 5.14 }, "source": { "function_count": 1 }, "strings": { "hex": 1, "bytes": 415, "count": 11, "url_count": 2, "avg_length": 37.73, "max_length": 81, "avg_entropy": 3.41, "entropy_stddev": 1.06 }, "comments": { "chars": 44, "count": 1, "lines": 1, "to_code_ratio": 0.06 }, "functions": { "count": 1, "density": 5.26, "avg_params": 3, "code_ratio": 0.26, "max_params": 3, "avg_name_length": 7, "avg_length_lines": 5, "max_length_lines": 5, "min_length_lines": 5, "avg_param_name_length": 3.67 }, "identifiers": { "count": 36, "unique": 24, "avg_length": 5.96, "max_length": 29, "min_length": 1, "avg_entropy": 2.01, "reuse_ratio": 0.67, "length_stddev": 5.23, "has_digit_ratio": 0.08, "single_char_count": 1, "single_char_ratio": 0.04, "high_entropy_count": 1, "high_entropy_ratio": 0.04, "all_lowercase_ratio": 0.71, "underscore_prefix_count": 1 } } }, "id": 2, "mol": "O(Er)H(F)", "path": "/tmp/promoter-1870801103/8bfb000e8d981ec87ff93d9f338d8e3ba6a68c3eff332820da1d773aa9802e24/libreoffice-extension-coooder-1.1.2-8.src.tar.gz!!libreoffice-extension-coooder/PKGBUILD", "pid": 0, "risk": 2, "sha": "2754e9a8f168d867700e4403b02bae86cddba6fbd8c57ec7d50d9f7ea28c5fa7", "size": 672, "traits": [ { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "spans": [ [ 173, 0 ] ] }, { "id": "micro-behaviors/fs/delete/file/command::rm-force-variable-target", "atk": "T1070.004", "mbc": "C0047", "conf": 0.9, "crit": 3, "desc": "Force-deletes a shell variable target", "spans": [ [ 584, 16 ] ] }, { "id": "objectives/evasion/masquerade/file/lure::pdf-search-home-posix--rx-6", "atk": "T1036", "conf": 0.9, "crit": 3, "desc": "Downloads directory reference", "spans": [ [ 350, 9 ] ] } ], "type": "shell" }, { "depth": 2, "facts": { "metrics": { "file": { "size": 411328, "entropy": 7.98 }, "binary": { "peak_region_bytes": 401408, "peak_region_entropy": 7.84 }, "archive": { "file_count": 124, "member_count": 124, "script_count": 0, "zip_bomb_ratio": 13.16, "compressed_size": 391162, "directory_count": 0, "executable_count": 0, "extra_field_size": 0, "noise_file_count": 0, "compression.ratio": 0.21, "hidden_file_count": 0, "uncompressed_size": 1906133, "crc_collision_count": 2, "entry_comment_count": 0, "max_filename_length": 45, "rtlo_filename_count": 0, "format.regular_count": 124, "nested_archive_count": 1, "path_traversal_count": 0, "symlink_escape_count": 0, "security.setgid_count": 0, "security.setuid_count": 0, "security.sticky_count": 0, "double_extension_count": 0, "duplicate_member_count": 0, "security.symlink_count": 0, "unicode_filename_count": 0, "homoglyph_filename_count": 0, "security.encrypted_count": 0, "timing.mtime_unique_count": 1, "timing.mtime_unique_ratio": 0.01, "misplaced_executable_count": 0, "timing.mtime_dominant_count": 124, "timing.mtime_spread_seconds": 0, "timing.sentinel_mtime_count": 0, "security.world_writable_count": 0, "timing.mtime_dominant_fraction": 1, "compression.method_counts.deflate": 124 }, "consistency": { "extension_content_mismatch": 1, "extension_content_mismatch.archive_as_unknown": 1 } } }, "id": 3, "mol": "O₆(AlAsCaEuIXe)H₅(CmDb₃F₂Po₃Ti)Md", "path": "https://extensions.libreoffice.org/assets/downloads/z/coooder-1-1-2.oxt", "risk": 20, "sha": "81bf965b0e3ac6e728ced3e668ded76be9331cd15defe7b0a6bf44710b244373", "size": 411328, "traits": [ { "id": "micro-behaviors/process/info/current::getpath-ref", "conf": 0.8, "crit": 3, "desc": "Java getPath call reference" }, { "id": "metadata/package/license::copyright-word", "conf": 0.6, "crit": 2, "desc": "Copyright notice", "from": [ { "file": 44 } ] }, { "id": "metadata/package/files/archive-shape::jar-mid-compression-ratio", "conf": 0.92, "crit": 2, "desc": "Mid JAR compression ratio", "from": [ { "file": 47 } ] }, { "id": "metadata/binary/code/complexity::functions-at-most-24", "conf": 1.0, "crit": 2, "desc": "Binary has 24 or fewer functions" }, { "id": "metadata/file/data-blob::concealed-payload-mass-8k", "conf": 0.85, "crit": 2, "desc": "High-entropy region mass over 8KB" }, { "id": "micro-behaviors/communications/http/lib/urlconnection::jvm-url-class-ref", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "JVM URL class reference" }, { "id": "metadata/binary/symbols/count::many-imports-100", "conf": 1.0, "crit": 2, "desc": "Binary has 100+ imports" }, { "id": "metadata/lang/natural::lang-english", "conf": 0.8, "crit": 2, "desc": "Contains common English function words", "from": [ { "off": 319, "file": 44, "line": 9 }, { "file": 47 }, { "off": 507, "file": 65 }, { "off": 837, "file": 69 }, { "off": 3445, "file": 71 }, { "off": 116, "file": 92, "line": 4 } ], "uses": [ 19, 20, 21, 26, 52, 54, 60 ] }, { "id": "micro-behaviors/data/source/dynamic/reflect::java-class-forname-bytecode", "conf": 1.0, "crit": 3, "desc": "JVM Class.forName invocation" }, { "id": "micro-behaviors/fs/file/copy::read-ref", "conf": 0.75, "crit": 2, "desc": "Java read call reference" }, { "id": "metadata/file/format/markup::xml-widget-element-name", "conf": 0.99, "crit": 1, "desc": "XML widget element name", "from": [ { "file": 26 } ] }, { "id": "objectives/evasion/security-bypass/llm/prompt::llm-doc-numeric-rewrite", "atk": "T1562", "conf": 0.88, "crit": 1, "desc": "Numeric rewrite instruction", "from": [ { "file": 15 } ] }, { "id": "metadata/file/magic/identity::cafebabe-magic", "conf": 1.0, "crit": 2, "desc": "CAFEBABE magic at file start" }, { "id": "micro-behaviors/process/thread/lifecycle::jvm-thread-class-ref", "conf": 0.88, "crit": 2, "desc": "JVM Thread class reference" }, { "id": "micro-behaviors/data/source/dynamic/reflect::java-class-getmethod-bytecode", "conf": 1.0, "crit": 3, "desc": "JVM reflective method lookup" }, { "id": "metadata/package/testing/presence/fixture::package-test-directory-member", "conf": 0.96, "crit": 2, "desc": "Package test directory member" }, { "id": "metadata/binary/layout/entropy::high-overall-entropy-binary", "conf": 0.9, "crit": 2, "desc": "Binary overall entropy at least 6.0" }, { "id": "micro-behaviors/fs/path/location::jvm-hidden-path-component", "conf": 0.9, "crit": 2, "desc": "JVM class references a hidden path component" }, { "id": "objectives/anti-static/obfuscation/reflection/class::java-invoke-or-getmethod", "conf": 1.0, "crit": 1, "desc": "Java invoke or getMethod", "from": [ { "file": 47 }, { "off": 528, "file": 60 } ], "uses": [ 14 ] }, { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "from": [ { "file": 44 } ] }, { "id": "metadata/lang/natural::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"", "from": [ { "file": 44 } ] }, { "id": "metadata/lang/natural::lang-english--atom-3", "conf": 0.8, "crit": 1, "desc": "English function-word token \"that\"", "from": [ { "file": 44 } ] }, { "id": "micro-behaviors/process/create/spawn::java-runtime-getruntime-bytecode-symbol", "atk": "T1059", "mbc": "E1203", "conf": 0.92, "crit": 3, "desc": "Java bytecode Runtime accessor" }, { "id": "micro-behaviors/process/create/stdlib::jvm-runtime-class-ref", "conf": 0.9, "crit": 2, "desc": "JVM Runtime class reference" }, { "id": "micro-behaviors/fs/write/file/stage::jvm-hidden-stage-filename", "conf": 0.92, "crit": 1, "desc": "JVM class contains hidden staged filename" }, { "id": "metadata/file/string/identity::jvm-activate-constant", "conf": 0.9, "crit": 3, "desc": "JVM constant-pool activate string" }, { "id": "metadata/lang/natural::lang-english--atom-7", "conf": 0.8, "crit": 1, "desc": "English function-word token \"this\"", "from": [ { "file": 44 } ] }, { "id": "metadata/permission/prose::permission-permission-term-english", "conf": 0.9, "crit": 2, "desc": "Permission or access term", "from": [ { "file": 44 } ] }, { "id": "metadata/file/extension/identity::doc-or-config-extension", "conf": 1.0, "crit": 2, "desc": "Text, document, or config extension", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/directory/cwd::jvm-pwd-command-literal", "conf": 0.9, "crit": 1, "desc": "JVM pwd command literal" }, { "id": "metadata/package/license::gpl-word", "conf": 0.7, "crit": 2, "desc": "References the GPL license", "from": [ { "file": 44 } ] }, { "id": "objectives/credential-access/gaming/minecraft::minecraft-session-getter-id", "atk": "T1528", "mbc": "B0006", "conf": 0.96, "crit": 3, "desc": "Minecraft account ID getter helper" }, { "id": "micro-behaviors/process/create/spawn::java-getruntime-ref", "atk": "T1059", "mbc": "E1203", "conf": 0.84, "crit": 3, "desc": "Java getRuntime call reference" }, { "id": "metadata/file/archive::archive-at-least-10-members", "conf": 0.9, "crit": 3, "desc": "Archive contains at least ten members", "from": [ { "file": 47 } ] }, { "id": "metadata/permission/prose::permission-mandatory-language-english", "conf": 0.9, "crit": 2, "desc": "Forced or mandatory instruction wording", "from": [ { "file": 44 } ] }, { "id": "objectives/anti-static/obfuscation/reflection/class::dalvik-classloader", "atk": "T1406", "mbc": "F0006", "conf": 1.0, "crit": 3, "desc": "Dalvik ClassLoader type descriptor" }, { "id": "micro-behaviors/data/source/dynamic/reflect::jvm-reflect-method-class-ref", "conf": 0.9, "crit": 2, "desc": "JVM java.lang.reflect.Method class reference" }, { "id": "metadata/binary/code/complexity::functions-at-most-32", "conf": 1.0, "crit": 2, "desc": "Binary has 32 or fewer functions" }, { "id": "metadata/binary/symbols/count::many-imports-50", "conf": 1.0, "crit": 2, "desc": "Binary has 50+ imports" }, { "id": "metadata/package/testing/presence/harness::binary-test-directory", "conf": 1.0, "crit": 2, "desc": "Binary file in test directory" }, { "id": "micro-behaviors/process/create/spawn::java-runtime-class", "atk": "T1059", "mbc": "E1203", "conf": 0.86, "crit": 3, "desc": "Java Runtime class reference" }, { "id": "micro-behaviors/os/env/gate::jvm-string-equals-import", "conf": 0.94, "crit": 1, "desc": "JVM class imports String equals" }, { "id": "metadata/file/extension/identity::java-archive-basename", "conf": 0.95, "crit": 2, "desc": "Java archive basename", "from": [ { "file": 47 } ] }, { "id": "metadata/package/files/archive-member::no-path-traversal-members", "conf": 0.9, "crit": 2, "desc": "Archive has no path traversal members" }, { "id": "micro-behaviors/data/decode/hex::java-radix-16-static-call", "atk": "T1027", "conf": 0.88, "crit": 1, "desc": "Java pushes radix 16 before static call" }, { "id": "metadata/file/data-blob::binary-peak-region-mass-over-1k", "conf": 0.85, "crit": 2, "desc": "High-entropy binary region mass over 1KB" }, { "id": "micro-behaviors/communications/http/lib/urlconnection::java-url-class-bytecode", "atk": "T1071.001", "mbc": "C0002", "conf": 0.86, "crit": 3, "desc": "Java URL class reference" }, { "id": "micro-behaviors/data/db/postgresql::copy-table-source", "conf": 0.99, "crit": 1, "desc": "PostgreSQL COPY table source", "from": [ { "file": 44 } ] }, { "id": "metadata/binary/symbols/imports::jvm-system-class-reference", "conf": 0.86, "crit": 2, "desc": "JVM constant-pool System class reference" }, { "id": "metadata/permission/prose::permission-grant-verb-english", "conf": 0.9, "crit": 2, "desc": "Grant or authorization verb text", "from": [ { "file": 44 } ] }, { "id": "metadata/binary/symbols/count::many-imports-30", "conf": 1.0, "crit": 2, "desc": "Binary has 30+ imports" }, { "id": "micro-behaviors/process/io/stream::jvm-process-input-stream", "conf": 0.94, "crit": 3, "desc": "JVM process output stream access" }, { "id": "metadata/lang/natural::lang-english--atom-4", "conf": 0.8, "crit": 1, "desc": "English function-word token \"have\"", "from": [ { "file": 44 } ] }, { "id": "micro-behaviors/fs/read/file/handle::jvm-io-file-class-ref", "conf": 0.86, "crit": 3, "desc": "JVM File API class reference" }, { "id": "metadata/lang/natural::lang-english--atom-6", "conf": 0.8, "crit": 1, "desc": "English function-word token \"with\"", "from": [ { "file": 44 } ] }, { "id": "objectives/anti-static/obfuscation/reflection/class::java-reflective-invoke", "conf": 0.9, "crit": 3, "desc": "Reflective method invocation in bytecode", "from": [ { "file": 47 }, { "file": 60 } ], "uses": [ 18, 36 ] }, { "id": "objectives/execution/exploit/deserialization::xstream-scriptlet-string", "atk": "T1190", "mbc": "E1203", "conf": 0.96, "crit": 3, "desc": "Serialized server-page scriptlet string", "from": [ { "file": 35 } ] }, { "id": "micro-behaviors/fs/file/copy::close-ref", "conf": 0.75, "crit": 2, "desc": "Java close call reference" }, { "id": "micro-behaviors/time/sleep/interval::java-thread-sleep-bytecode", "conf": 0.9, "crit": 3, "desc": "Java bytecode thread sleep" }, { "id": "metadata/file/import::script-many-imports-10-small", "conf": 0.5, "crit": 2, "desc": "Small source file (\u003c=10KB) with 10+ imports" }, { "id": "metadata/lang/natural::lang-english--atom-2", "conf": 0.8, "crit": 1, "desc": "English function-word token \"and\"", "from": [ { "file": 44 } ] }, { "id": "metadata/binary/symbols/count::many-imports", "conf": 0.8, "crit": 2, "desc": "High number of imported symbols (\u003e80)" }, { "id": "micro-behaviors/data/embedded/payload/resource::java-class-getresourceasstream", "conf": 0.9, "crit": 3, "desc": "Java class-relative resource stream lookup" }, { "id": "metadata/file/format/media::media-container-recognized", "conf": 0.98, "crit": 2, "desc": "File carries a real container signature" }, { "id": "metadata/binary/code/complexity::few-functions-3", "conf": 1.0, "crit": 2, "desc": "Binary has 3+ functions" }, { "id": "objectives/evasion/security-bypass/llm/prompt::llm-doc-figure-change", "atk": "T1562", "conf": 0.88, "crit": 1, "desc": "Figure change instruction", "from": [ { "file": 15 } ] }, { "id": "metadata/package/files/archive-shape::jar-low-compression-ratio", "conf": 0.9, "crit": 2, "desc": "Low JAR compression ratio" }, { "id": "metadata/binary/symbols/count::many-imports-20", "conf": 1.0, "crit": 2, "desc": "Binary has 20+ imports" }, { "id": "micro-behaviors/process/info/current::touri-ref", "conf": 0.82, "crit": 3, "desc": "Java toURI call reference" }, { "id": "metadata/file/extension/identity::json-txt-md-basename", "conf": 1.0, "crit": 2, "desc": "JSON, text, or markdown filename extension", "from": [ { "file": 44 } ] }, { "id": "micro-behaviors/data/source/dynamic/reflect::java-method-invoke-bytecode", "conf": 1.0, "crit": 3, "desc": "JVM reflective method invocation" }, { "id": "objectives/impact/dos/disk::jvm-megabyte-byte-array-constant", "atk": "T1499.001", "conf": 0.94, "crit": 3, "desc": "JVM one-megabyte allocation constant" }, { "id": "metadata/binary/symbols/count::many-imports-25", "conf": 1.0, "crit": 2, "desc": "Binary has 25+ imports" }, { "id": "micro-behaviors/data/source/dynamic/reflect::java-bytecode-reflective-method-invoke", "conf": 0.94, "crit": 3, "desc": "JVM resolves and invokes method reflectively", "from": [ { "file": 47 }, { "off": 1837, "file": 60 } ], "uses": [ 8, 14, 70 ] }, { "id": "micro-behaviors/fs/path/extension::exe-name-or-extension", "conf": 0.5, "crit": 2, "desc": "References a Windows .exe filename or extension" }, { "id": "micro-behaviors/data/source/dynamic/reflect::java-urlclassloader-bytecode", "conf": 0.94, "crit": 3, "desc": "JVM URLClassLoader class reference" }, { "id": "micro-behaviors/data/string/conversion::tostring-token", "conf": 1.0, "crit": 3, "desc": "References the toString conversion method" }, { "id": "metadata/binary/symbols/count::many-imports-40", "conf": 1.0, "crit": 2, "desc": "Binary has 40+ imports" }, { "id": "micro-behaviors/fs/path/extension::java-executable-reference", "conf": 0.92, "crit": 3, "desc": "Java bytecode references an executable path" }, { "id": "objectives/exfiltration/messaging/discord::java-system-property-os", "atk": "T1567.002", "mbc": "E1041", "conf": 0.88, "crit": 3, "desc": "Java OS property collection" }, { "id": "metadata/binary/code/complexity::many-functions", "conf": 0.8, "crit": 2, "desc": "Binary has many functions (\u003e30)" }, { "id": "metadata/binary/symbols/imports::jvm-anonymous-inner-class-reference", "conf": 0.88, "crit": 2, "desc": "JVM class references an anonymous inner class" }, { "id": "objectives/anti-analysis/timing/evasion::kotlin-thread-sleep-check", "atk": "T1497.003", "conf": 0.94, "crit": 3, "desc": "Kotlin Thread.sleep call" }, { "id": "micro-behaviors/fs/read/file/handle::java-fileinputstream-class", "conf": 0.9, "crit": 3, "desc": "Java imports the FileInputStream reader" }, { "id": "metadata/file/archive::archive-at-least-6-members", "conf": 0.9, "crit": 1, "desc": "Archive contains at least six members" }, { "id": "metadata/file/magic/identity::jvm-classfile-magic", "conf": 1.0, "crit": 2, "desc": "JVM class-file magic in analyzed bytes" }, { "id": "metadata/binary/layout/entropy::low-overall-entropy-binary", "conf": 0.9, "crit": 2, "desc": "Binary has low overall entropy" }, { "id": "objectives/anti-static/obfuscation/reflection/class::dalvik-reflect-method", "atk": "T1406", "mbc": "F0006", "conf": 1.0, "crit": 3, "desc": "Dalvik reflect/Method type descriptor" }, { "id": "metadata/binary/code/complexity::no-functions", "conf": 0.5, "crit": 2, "desc": "Binary exposes at most three functions" }, { "id": "micro-behaviors/process/create/spawn::java-runtime-exec-bytecode-symbol", "atk": "T1059", "mbc": "E1203", "conf": 0.95, "crit": 3, "desc": "Java bytecode Runtime.exec call" }, { "id": "metadata/file/archive::archive-at-least-120-members", "conf": 0.98, "crit": 3, "desc": "Archive contains at least 120 members" }, { "id": "metadata/file/archive::archive-many-compressed-members", "conf": 0.9, "crit": 2, "desc": "Archive has many members" }, { "id": "metadata/file/extension/identity::archive-content-extension-mismatch", "conf": 0.95, "crit": 2, "desc": "Archive content mismatches filename extension" }, { "id": "micro-behaviors/data/archive/member::archive-member-text-like-name", "conf": 0.82, "crit": 1, "desc": "Archive member filename looks text-like" } ], "type": "zip" }, { "id": 35, "sha": "9b024786962fc649d5013139c1632a46c0319c847f8e6e9f91133d0091707b55", "path": "https://extensions.libreoffice.org/assets/downloads/z/coooder-1-1-2.oxt!!config/org/openoffice/langs/html4strict.xml", "risk": 1, "size": 6158, "type": "xml", "depth": 3 }, { "id": 38, "mol": "O(Xe)", "sha": "4c0ed0873e8701bc68f66e1935398fe74a73a498f536b695fa42e3a6a3617292", "path": "https://extensions.libreoffice.org/assets/downloads/z/coooder-1-1-2.oxt!!config/org/openoffice/langs/scala.xml", "risk": 1, "size": 3008, "type": "xml", "depth": 3 }, { "id": 47, "sha": "129c440d377686036be15a94320f5e062ecf3bddf744506e4bba72c16d35c869", "path": "https://extensions.libreoffice.org/assets/downloads/z/coooder-1-1-2.oxt!!licenses/lgpl-en.txt", "risk": 1, "size": 23246, "type": "text", "depth": 3 }, { "depth": 3, "facts": { "metrics": { "jar": { "class_count": 28, "entry_count": 30, "index_count": 0, "service_count": 0, "signature_count": 0, "native_lib_count": 0, "embedded_jar_count": 0, "manifest.entry_count": 0, "manifest.digest_count": 0, "signature_block_count": 0, "versioned_class_count": 0, "manifest.section_count": 0, "manifest.attribute_count": 2, "manifest.class_path_count": 0, "manifest.boot_class_path_count": 0 }, "file": { "size": 54858, "entropy": 7.92 }, "binary": { "peak_region_bytes": 51200, "peak_region_entropy": 7.81 }, "archive": { "file_count": 30, "member_count": 30, "script_count": 0, "zip_bomb_ratio": 2.24, "compressed_size": 49160, "directory_count": 0, "executable_count": 0, "extra_field_size": 4, "noise_file_count": 0, "compression.ratio": 0.48, "hidden_file_count": 0, "uncompressed_size": 103121, "crc_collision_count": 0, "entry_comment_count": 0, "max_filename_length": 73, "rtlo_filename_count": 0, "format.regular_count": 30, "nested_archive_count": 0, "path_traversal_count": 0, "symlink_escape_count": 0, "security.setgid_count": 0, "security.setuid_count": 0, "security.sticky_count": 0, "double_extension_count": 0, "duplicate_member_count": 0, "security.symlink_count": 0, "unicode_filename_count": 0, "homoglyph_filename_count": 0, "security.encrypted_count": 0, "timing.mtime_unique_count": 6, "timing.mtime_unique_ratio": 0.2, "misplaced_executable_count": 0, "timing.mtime_dominant_count": 10, "timing.mtime_spread_seconds": 4646680, "timing.sentinel_mtime_count": 0, "security.world_writable_count": 0, "timing.mtime_dominant_fraction": 0.33, "compression.method_counts.deflate": 30 } } }, "id": 50, "mol": "O₅(AlAsCaEuI)H₅(CmDb₃F₂Po₃Ti)Md", "path": "https://extensions.libreoffice.org/assets/downloads/z/coooder-1-1-2.oxt!!COOoder.jar", "pid": 0, "risk": 18, "sha": "2656c6a4c140cc76c8e7245c8f15cc8257de8359efd3c5afa8cd257e6761b00a", "size": 54858, "traits": [ { "id": "micro-behaviors/fs/read/file/handle::java-fileinputstream-class", "conf": 0.9, "crit": 3, "desc": "Java imports the FileInputStream reader" }, { "id": "micro-behaviors/data/source/dynamic/reflect::java-urlclassloader-bytecode", "conf": 0.94, "crit": 3, "desc": "JVM URLClassLoader class reference" }, { "id": "micro-behaviors/data/source/dynamic/reflect::jvm-reflect-method-class-ref", "conf": 0.9, "crit": 2, "desc": "JVM java.lang.reflect.Method class reference" }, { "id": "metadata/file/magic/identity::jvm-classfile-magic", "conf": 1.0, "crit": 2, "desc": "JVM class-file magic in analyzed bytes" }, { "id": "micro-behaviors/data/source/dynamic/reflect::java-method-invoke-bytecode", "conf": 1.0, "crit": 3, "desc": "JVM reflective method invocation" }, { "id": "objectives/credential-access/gaming/minecraft::minecraft-session-getter-id", "atk": "T1528", "mbc": "B0006", "conf": 0.96, "crit": 3, "desc": "Minecraft account ID getter helper" }, { "id": "objectives/anti-static/obfuscation/reflection/class::java-invoke-or-getmethod", "conf": 1.0, "crit": 1, "desc": "Java invoke or getMethod", "from": [ { "off": 528, "file": 60 } ], "uses": [ 11 ] }, { "id": "micro-behaviors/data/embedded/payload/resource::java-class-getresourceasstream", "conf": 0.9, "crit": 3, "desc": "Java class-relative resource stream lookup" }, { "id": "micro-behaviors/data/source/dynamic/reflect::java-bytecode-reflective-method-invoke", "conf": 0.94, "crit": 3, "desc": "JVM resolves and invokes method reflectively", "from": [ { "off": 1837, "file": 60 } ], "uses": [ 4, 11, 16 ] }, { "id": "micro-behaviors/process/create/spawn::java-runtime-getruntime-bytecode-symbol", "atk": "T1059", "mbc": "E1203", "conf": 0.92, "crit": 3, "desc": "Java bytecode Runtime accessor" }, { "id": "metadata/binary/symbols/count::many-imports-20", "conf": 1.0, "crit": 2, "desc": "Binary has 20+ imports" }, { "id": "micro-behaviors/data/source/dynamic/reflect::java-class-getmethod-bytecode", "conf": 1.0, "crit": 3, "desc": "JVM reflective method lookup" }, { "id": "micro-behaviors/process/info/current::touri-ref", "conf": 0.82, "crit": 3, "desc": "Java toURI call reference" }, { "id": "metadata/binary/code/complexity::no-functions", "conf": 0.5, "crit": 2, "desc": "Binary exposes at most three functions" }, { "id": "micro-behaviors/process/create/spawn::java-runtime-class", "atk": "T1059", "mbc": "E1203", "conf": 0.86, "crit": 3, "desc": "Java Runtime class reference" }, { "id": "objectives/anti-static/obfuscation/reflection/class::dalvik-classloader", "atk": "T1406", "mbc": "F0006", "conf": 1.0, "crit": 3, "desc": "Dalvik ClassLoader type descriptor" }, { "id": "micro-behaviors/data/source/dynamic/reflect::java-class-forname-bytecode", "conf": 1.0, "crit": 3, "desc": "JVM Class.forName invocation" }, { "id": "metadata/binary/symbols/count::many-imports", "conf": 0.8, "crit": 2, "desc": "High number of imported symbols (\u003e80)" }, { "id": "micro-behaviors/time/sleep/interval::java-thread-sleep-bytecode", "conf": 0.9, "crit": 3, "desc": "Java bytecode thread sleep" }, { "id": "metadata/binary/layout/entropy::low-overall-entropy-binary", "conf": 0.9, "crit": 2, "desc": "Binary has low overall entropy" }, { "id": "objectives/exfiltration/messaging/discord::java-system-property-os", "atk": "T1567.002", "mbc": "E1041", "conf": 0.88, "crit": 3, "desc": "Java OS property collection" }, { "id": "metadata/file/data-blob::binary-peak-region-mass-over-1k", "conf": 0.85, "crit": 2, "desc": "High-entropy binary region mass over 1KB" }, { "id": "metadata/binary/symbols/imports::jvm-system-class-reference", "conf": 0.86, "crit": 2, "desc": "JVM constant-pool System class reference" }, { "id": "micro-behaviors/communications/http/lib/urlconnection::java-url-class-bytecode", "atk": "T1071.001", "mbc": "C0002", "conf": 0.86, "crit": 3, "desc": "Java URL class reference" }, { "id": "micro-behaviors/process/io/stream::jvm-process-input-stream", "conf": 0.94, "crit": 3, "desc": "JVM process output stream access" }, { "id": "micro-behaviors/os/env/gate::jvm-string-equals-import", "conf": 0.94, "crit": 1, "desc": "JVM class imports String equals" }, { "id": "metadata/binary/symbols/count::many-imports-40", "conf": 1.0, "crit": 2, "desc": "Binary has 40+ imports" }, { "id": "micro-behaviors/process/thread/lifecycle::jvm-thread-class-ref", "conf": 0.88, "crit": 2, "desc": "JVM Thread class reference" }, { "id": "objectives/anti-static/obfuscation/reflection/class::dalvik-reflect-method", "atk": "T1406", "mbc": "F0006", "conf": 1.0, "crit": 3, "desc": "Dalvik reflect/Method type descriptor" }, { "id": "micro-behaviors/data/string/conversion::tostring-token", "conf": 1.0, "crit": 3, "desc": "References the toString conversion method" }, { "id": "metadata/binary/symbols/count::many-imports-25", "conf": 1.0, "crit": 2, "desc": "Binary has 25+ imports" }, { "id": "micro-behaviors/process/create/stdlib::jvm-runtime-class-ref", "conf": 0.9, "crit": 2, "desc": "JVM Runtime class reference" }, { "id": "micro-behaviors/fs/read/file/handle::jvm-io-file-class-ref", "conf": 0.86, "crit": 3, "desc": "JVM File API class reference" }, { "id": "metadata/file/import::script-many-imports-10-small", "conf": 0.5, "crit": 2, "desc": "Small source file (\u003c=10KB) with 10+ imports" }, { "id": "metadata/lang/natural::lang-english--atom-4", "conf": 0.8, "crit": 1, "desc": "English function-word token \"have\"" }, { "id": "micro-behaviors/process/create/spawn::java-runtime-exec-bytecode-symbol", "atk": "T1059", "mbc": "E1203", "conf": 0.95, "crit": 3, "desc": "Java bytecode Runtime.exec call" }, { "id": "micro-behaviors/fs/file/copy::read-ref", "conf": 0.75, "crit": 2, "desc": "Java read call reference" }, { "id": "metadata/binary/code/complexity::functions-at-most-32", "conf": 1.0, "crit": 2, "desc": "Binary has 32 or fewer functions" }, { "id": "micro-behaviors/fs/path/extension::java-executable-reference", "conf": 0.92, "crit": 3, "desc": "Java bytecode references an executable path" }, { "id": "metadata/binary/code/complexity::few-functions-3", "conf": 1.0, "crit": 2, "desc": "Binary has 3+ functions" }, { "id": "micro-behaviors/fs/path/extension::exe-name-or-extension", "conf": 0.5, "crit": 2, "desc": "References a Windows .exe filename or extension" }, { "id": "objectives/anti-static/obfuscation/reflection/class::java-reflective-invoke", "conf": 0.9, "crit": 3, "desc": "Reflective method invocation in bytecode", "from": [ { "file": 60 } ], "uses": [ 2, 6 ] }, { "id": "metadata/lang/natural::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"" }, { "id": "metadata/package/testing/presence/harness::binary-test-directory", "conf": 1.0, "crit": 2, "desc": "Binary file in test directory" }, { "id": "micro-behaviors/process/create/spawn::java-getruntime-ref", "atk": "T1059", "mbc": "E1203", "conf": 0.84, "crit": 3, "desc": "Java getRuntime call reference" }, { "id": "micro-behaviors/fs/file/copy::close-ref", "conf": 0.75, "crit": 2, "desc": "Java close call reference" }, { "id": "micro-behaviors/data/decode/hex::java-radix-16-static-call", "atk": "T1027", "conf": 0.88, "crit": 1, "desc": "Java pushes radix 16 before static call" }, { "id": "metadata/binary/code/complexity::many-functions", "conf": 0.8, "crit": 2, "desc": "Binary has many functions (\u003e30)" }, { "id": "metadata/binary/symbols/count::many-imports-30", "conf": 1.0, "crit": 2, "desc": "Binary has 30+ imports" }, { "id": "metadata/binary/code/complexity::functions-at-most-24", "conf": 1.0, "crit": 2, "desc": "Binary has 24 or fewer functions" }, { "id": "metadata/binary/symbols/count::many-imports-100", "conf": 1.0, "crit": 2, "desc": "Binary has 100+ imports" }, { "id": "metadata/binary/symbols/imports::jvm-anonymous-inner-class-reference", "conf": 0.88, "crit": 2, "desc": "JVM class references an anonymous inner class" }, { "id": "metadata/file/magic/identity::cafebabe-magic", "conf": 1.0, "crit": 2, "desc": "CAFEBABE magic at file start" }, { "id": "micro-behaviors/communications/http/lib/urlconnection::jvm-url-class-ref", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "JVM URL class reference" }, { "id": "metadata/file/string/identity::jvm-activate-constant", "conf": 0.9, "crit": 3, "desc": "JVM constant-pool activate string" }, { "id": "metadata/binary/symbols/count::many-imports-50", "conf": 1.0, "crit": 2, "desc": "Binary has 50+ imports" }, { "id": "objectives/impact/dos/disk::jvm-megabyte-byte-array-constant", "atk": "T1499.001", "conf": 0.94, "crit": 3, "desc": "JVM one-megabyte allocation constant" }, { "id": "micro-behaviors/fs/write/file/stage::jvm-hidden-stage-filename", "conf": 0.92, "crit": 1, "desc": "JVM class contains hidden staged filename" }, { "id": "metadata/file/data-blob::concealed-payload-mass-8k", "conf": 0.85, "crit": 2, "desc": "High-entropy region mass over 8KB" }, { "id": "micro-behaviors/fs/directory/cwd::jvm-pwd-command-literal", "conf": 0.9, "crit": 1, "desc": "JVM pwd command literal" }, { "id": "metadata/binary/layout/entropy::high-overall-entropy-binary", "conf": 0.9, "crit": 2, "desc": "Binary overall entropy at least 6.0" }, { "id": "micro-behaviors/fs/path/location::jvm-hidden-path-component", "conf": 0.9, "crit": 2, "desc": "JVM class references a hidden path component" }, { "id": "objectives/anti-analysis/timing/evasion::kotlin-thread-sleep-check", "atk": "T1497.003", "conf": 0.94, "crit": 3, "desc": "Kotlin Thread.sleep call" }, { "id": "micro-behaviors/process/info/current::getpath-ref", "conf": 0.8, "crit": 3, "desc": "Java getPath call reference" }, { "id": "metadata/file/archive::archive-at-least-10-members", "conf": 0.9, "crit": 3, "desc": "Archive contains at least ten members" }, { "id": "metadata/file/archive::archive-at-least-6-members", "conf": 0.9, "crit": 1, "desc": "Archive contains at least six members" }, { "id": "metadata/file/extension/identity::java-archive-basename", "conf": 0.95, "crit": 2, "desc": "Java archive basename" }, { "id": "metadata/package/files/archive-member::no-path-traversal-members", "conf": 0.9, "crit": 2, "desc": "Archive has no path traversal members" }, { "id": "metadata/package/files/archive-shape::jar-low-compression-ratio", "conf": 0.9, "crit": 2, "desc": "Low JAR compression ratio" }, { "id": "metadata/package/files/archive-shape::jar-mid-compression-ratio", "conf": 0.92, "crit": 2, "desc": "Mid JAR compression ratio" }, { "id": "metadata/package/testing/presence/fixture::package-test-directory-member", "conf": 0.96, "crit": 2, "desc": "Package test directory member" } ], "type": "jar" }, { "id": 54, "mol": "O(Ca)", "sha": "2411e69b6ae3c747f26453326164f5e1ea4105a971b637015944c269b9cb6a73", "path": "https://extensions.libreoffice.org/assets/downloads/z/coooder-1-1-2.oxt!!COOoder.jar!!org/openoffice/coooder/XLanguage.class", "risk": 1, "size": 1972, "type": "java_class", "depth": 4 }, { "id": 59, "mol": "H(Db)", "sha": "895b144cc57ac2c6d0b9e4f0465c8218e30dc56617a06ed71e0df0c77ece247d", "path": "https://extensions.libreoffice.org/assets/downloads/z/coooder-1-1-2.oxt!!COOoder.jar!!org/openoffice/coooder/comp/CompiledPatternsCache.class", "risk": 1, "size": 1388, "type": "java_class", "depth": 4 }, { "id": 60, "sha": "620e40c39ff59b5ca9fde89ce6ac52d3efc664815bc14ad6e8111570bcf79448", "path": "https://extensions.libreoffice.org/assets/downloads/z/coooder-1-1-2.oxt!!COOoder.jar!!org/openoffice/coooder/comp/DefinitionsConstants.class", "risk": 1, "size": 2062, "type": "java_class", "depth": 4 }, { "id": 61, "mol": "O(Ca)H(Db)", "sha": "a35e2387c057315e0f6aeaeb7a3fd8c9192f5a6130ffe2c3b1e840a5597986a6", "path": "https://extensions.libreoffice.org/assets/downloads/z/coooder-1-1-2.oxt!!COOoder.jar!!org/openoffice/coooder/comp/HighlighterImpl.class", "risk": 2, "size": 14205, "type": "java_class", "depth": 4 }, { "id": 62, "mol": "O(Ca)H(Db)", "sha": "e7b5674b703fff0cb4eab1847806c8b947ae94b31e98ecbc6cd006974dc4dbce", "path": "https://extensions.libreoffice.org/assets/downloads/z/coooder-1-1-2.oxt!!COOoder.jar!!org/openoffice/coooder/comp/LanguageImpl.class", "risk": 2, "size": 16901, "type": "java_class", "depth": 4 }, { "ctx": [ { "b": "+kO#^0000O0hx=00S-oOz/PFzz/xo9z!rP}v}vr6z/oM8wPxClz/6CDqE%GPB98ChBzkVhnmuyDy?mR(00Ar55nCS%vj#C9zF7Q#vRPE:Bo8vCjzwXEBuPZ911kQ00rrl\u0026z!9z", "ln": 0 }, { "b": "vqYZhq/)4]zF6vT9SNn.00W1OBZY9c0rr\u0026.oLO0Vvj#C9zF7Q#vRPE:Bup{P2MLtw02kFT3\u0026?HLbMN(KxjVfVwPRQ7wb#V}c}[w:C404uvqYZhq/)4]zF84noLO0Vvj#C9zF7Q\u0026y*?yaj1i\u003crvrM6jy*?i]flgSoy?m9#fhl21xM4Ay3ihyMc\u003cG-10rr%KvrM6jy*?i]flgSoy?m9#fhl21xM4z\u002604v)$0rrsrzGY@lwDq=\u003ec}[w:C404uvqYZhpHX6Iv@%!poLO0Vvj#C9zF7Q#vRPE:Bup{Bygho]fkL6mxd)4\u0026ygQ)%i%L:p0rsMUz/4dGB-5\u003cNByxhyy*?i]fizd!zF9=%lVl*Xz/fc7BvGXGBz(hB2((NTfB4Oh0rrWCvrM6jy*?i]fh)dqBy/p$05jEe0rrjkA=IfX6?\u0026vJC3$", "ln": 464 }, { "b": "00bT(00M\u003eGvs0k201?[tvrM6jy*?i]fgfL:B8%zz00)jGBx0K8wPE\u003eL5nbM@mQY!Gz/Qa$wPRQ7wb#VGoLO0Vvj#C9zF7RywOb:\u0026v@%v#wPRQ7wif!(0Dd#s5\u003e)4GC404uvqYZhpHX6Iv@%^k00cTi02ngxvrM6jy*?i]fgya}wPh:9z/dSq01z\u003eGvpK7Evq]gOvR/PX07u[*8ED\u0026}A+PSbqE%GPB98CFq!o#)x\u003e7ZCzF0!/04ff*v@DiqB9hvNB97\u0026hflgSpx(!xpC}P", "ln": 1100 }, { "b": "BzkLAl2}0OC$.{[Bp51T00@]hx8}#KqE%GPB98ChBzkVhnmuyDy?mStv@bN{B7Gz102kGF3\u0026\u003e2xyxjzGxjVf.wPI^jA:@VDB5Ng3wNPAR04xr\u0026ygho]fkL6mxd)h9A+PA7j1i\u003crvrM6jx(tT@zG6-uq/)4\u003evqO7h0bR-p7\u00260G5vj#tkfhc7$wLNw+vR6NTwNPaXAT8O.0rs0LvrM6jx(tT@zG6-uq/)4\u003evqO[NvpS}\u00263ij@zAsq*J0ce8u7:@6)vrM6jx(tT@zG6-uq/)4\u003evqO7PrTF*", "ln": 1523 }, { "b": "vpS}\u0026j1jhq0bITV3\u0026\u003eIL836ZyA+eV\u0026oLFxQ2MPeK000ua8VUl]0ds?+0rrmAA+Pv$02kG-3\u0026\u003e!TFDk-Qw]zY+vqPMR03%3!ygho]fkL6mxd)h9A+PA7j1i\u003crvrM6jy*?i]fgfL:B8%zI0aM1Y3\u0026\u003e}X9@#uzvpS)Q0epFq2loIW0269QC404rz.BWTmr\u0026rNAcb/jzvcwW0eR9:Iu0?Y00M\u003eGz/YE%0e{]m2lo.:0269QC404rz.BX1Acln3BAg@3z3*nM0fmJ*Kn$yz00EvSDsW9S11kP\u00263ijMoLmdCQ0f)M+17#g!0rr\u0026.nHWtFvrM6jy*?i]fhD4(wN/*z0rr\u0026", "ln": 1773 } ], "depth": 4, "facts": { "imp": [ [ "", "java/io/InputStreamReader" ], [ "", "java/lang/System" ], [ "", "java/lang/Object" ], [ "", "java/lang/Exception" ], [ "", "java/util/ArrayList" ], [ "", "com/sun/star/registry/XRegistryKey" ], [ "", "java/lang/Boolean" ], [ "", "java/lang/Class" ], [ "", "java/lang/reflect/Method" ], [ "", "java/io/InputStream" ], [ "", "java/io/LineNumberReader" ], [ "", "java/lang/Throwable" ], [ "", "java/io/IOException" ], [ "", "com/sun/star/lang/XSingleComponentFactory" ], [ "", "java/lang/String" ], [ "", "[Ljava/lang/Class;" ], [ "", "java/io/PrintStream" ], [ "java/util/ArrayList", "java/util/ArrayList.add" ], [ "java/util/ArrayList", "add" ], [ "java/lang/Object", "java/lang/Object.\u003cinit\u003e" ], [ "java/lang/Object", "\u003cinit\u003e" ], [ "java/lang/Class", "java/lang/Class.forName" ], [ "java/lang/Class", "forName" ], [ "java/lang/Class", "java/lang/Class.getMethod" ], [ "java/lang/Class", "getMethod" ], [ "java/lang/reflect/Method", "java/lang/reflect/Method.invoke" ], [ "java/lang/reflect/Method", "invoke" ], [ "java/lang/String", "java/lang/String.equals" ], [ "java/lang/String", "equals" ], [ "java/lang/String", "java/lang/String.trim" ], [ "java/lang/String", "trim" ], [ "java/io/IOException", "java/io/IOException.printStackTrace" ], [ "java/io/IOException", "printStackTrace" ], [ "java/io/LineNumberReader", "java/io/LineNumberReader.close" ], [ "java/io/LineNumberReader", "close" ], [ "java/lang/Exception", "java/lang/Exception.printStackTrace" ], [ "java/lang/Exception", "printStackTrace" ], [ "java/lang/System", "java/lang/System.err" ], [ "java/lang/System", "err" ], [ "org/openoffice/coooder/comp/RegistrationHandler", "org/openoffice/coooder/comp/RegistrationHandler.findServicesImplementationClasses" ], [ "org/openoffice/coooder/comp/RegistrationHandler", "findServicesImplementationClasses" ], [ "java/util/ArrayList", "java/util/ArrayList.\u003cinit\u003e" ], [ "java/util/ArrayList", "\u003cinit\u003e" ], [ "java/io/InputStreamReader", "java/io/InputStreamReader.\u003cinit\u003e" ], [ "java/io/InputStreamReader", "\u003cinit\u003e" ], [ "java/io/InputStream", "java/io/InputStream.close" ], [ "java/io/InputStream", "close" ], [ "java/lang/Boolean", "java/lang/Boolean.booleanValue" ], [ "java/lang/Boolean", "booleanValue" ], [ "java/io/PrintStream", "java/io/PrintStream.println" ], [ "java/io/PrintStream", "println" ], [ "java/lang/Class", "java/lang/Class.getResourceAsStream" ], [ "java/lang/Class", "getResourceAsStream" ], [ "java/io/LineNumberReader", "java/io/LineNumberReader.readLine" ], [ "java/io/LineNumberReader", "readLine" ], [ "java/util/ArrayList", "java/util/ArrayList.size" ], [ "java/util/ArrayList", "size" ], [ "java/util/ArrayList", "java/util/ArrayList.get" ], [ "java/util/ArrayList", "get" ], [ "java/io/LineNumberReader", "java/io/LineNumberReader.\u003cinit\u003e" ], [ "java/io/LineNumberReader", "\u003cinit\u003e" ], [ "java/lang/Class", "java/lang/Class.getCanonicalName" ], [ "java/lang/Class", "getCanonicalName" ] ], "metrics": { "file": { "size": 3836, "entropy": 5.7 }, "class": { "major_version": 50, "interface_count": 0, "method_ref_count": 23, "constant_pool_size": 163, "external_class_count": 17 }, "binary": { "peak_region_bytes": 3836, "peak_region_entropy": 5.33 }, "imports": { "count": 40 }, "functions": { "count": 4 } } }, "id": 63, "mol": "O(As)H(Db₂)", "path": "https://extensions.libreoffice.org/assets/downloads/z/coooder-1-1-2.oxt!!COOoder.jar!!org/openoffice/coooder/comp/RegistrationHandler.class", "pid": 47, "risk": 4, "sha": "361e654ade6bad988ba0dff8be7331330cb68145c8073cd81a348d14a2b84cca", "size": 3836, "traits": [ { "id": "metadata/binary/code/complexity::few-functions-3", "conf": 1.0, "crit": 2, "desc": "Binary has 3+ functions" }, { "id": "metadata/binary/code/complexity::functions-at-most-24", "conf": 1.0, "crit": 2, "desc": "Binary has 24 or fewer functions" }, { "id": "metadata/binary/code/complexity::functions-at-most-32", "conf": 1.0, "crit": 2, "desc": "Binary has 32 or fewer functions" }, { "id": "metadata/binary/symbols/count::many-imports-20", "conf": 1.0, "crit": 2, "desc": "Binary has 20+ imports" }, { "id": "metadata/binary/symbols/count::many-imports-25", "conf": 1.0, "crit": 2, "desc": "Binary has 25+ imports" }, { "id": "metadata/binary/symbols/count::many-imports-30", "conf": 1.0, "crit": 2, "desc": "Binary has 30+ imports" }, { "id": "metadata/binary/symbols/count::many-imports-40", "conf": 1.0, "crit": 2, "desc": "Binary has 40+ imports" }, { "id": "metadata/binary/symbols/imports::jvm-system-class-reference", "conf": 0.86, "crit": 2, "desc": "JVM constant-pool System class reference" }, { "id": "metadata/file/data-blob::binary-peak-region-mass-over-1k", "conf": 0.85, "crit": 2, "desc": "High-entropy binary region mass over 1KB" }, { "id": "metadata/file/import::script-many-imports-10-small", "conf": 0.5, "crit": 2, "desc": "Small source file (\u003c=10KB) with 10+ imports" }, { "id": "metadata/file/magic/identity::cafebabe-magic", "conf": 1.0, "crit": 2, "desc": "CAFEBABE magic at file start", "spans": [ [ 0, 0 ] ] }, { "id": "metadata/file/magic/identity::jvm-classfile-magic", "conf": 1.0, "crit": 2, "desc": "JVM class-file magic in analyzed bytes", "spans": [ [ 0, 0 ] ] }, { "id": "micro-behaviors/data/embedded/payload/resource::java-class-getresourceasstream", "conf": 0.9, "crit": 3, "desc": "Java class-relative resource stream lookup", "spans": [ [ 1587, 35 ] ] }, { "id": "micro-behaviors/data/source/dynamic/reflect::java-class-forname-bytecode", "conf": 1.0, "crit": 3, "desc": "JVM Class.forName invocation", "spans": [ [ 1837, 23 ] ] }, { "id": "micro-behaviors/data/source/dynamic/reflect::java-class-getmethod-bytecode", "conf": 1.0, "crit": 3, "desc": "JVM reflective method lookup", "spans": [ [ 528, 25 ] ] }, { "id": "micro-behaviors/data/source/dynamic/reflect::java-method-invoke-bytecode", "conf": 1.0, "crit": 3, "desc": "JVM reflective method invocation", "spans": [ [ 647, 31 ] ] }, { "id": "micro-behaviors/data/source/dynamic/reflect::jvm-reflect-method-class-ref", "conf": 0.9, "crit": 2, "desc": "JVM java.lang.reflect.Method class reference" }, { "id": "micro-behaviors/fs/file/copy::close-ref", "conf": 0.75, "crit": 2, "desc": "Java close call reference", "spans": [ [ 1943, 0 ] ] }, { "id": "objectives/anti-static/obfuscation/reflection/class::dalvik-reflect-method", "atk": "T1406", "mbc": "F0006", "conf": 1.0, "crit": 3, "desc": "Dalvik reflect/Method type descriptor", "spans": [ [ 540, 64 ], [ 1164, 26 ] ] }, { "id": "objectives/anti-static/obfuscation/reflection/class::java-invoke-or-getmethod", "conf": 1.0, "crit": 1, "desc": "Java invoke or getMethod", "uses": [ 14 ], "spans": [ [ 528, 0 ] ] }, { "id": "micro-behaviors/data/source/dynamic/reflect::java-bytecode-reflective-method-invoke", "conf": 0.94, "crit": 3, "desc": "JVM resolves and invokes method reflectively", "uses": [ 13, 14, 15 ], "spans": [ [ 528, 25 ], [ 647, 31 ], [ 1837, 23 ] ] }, { "id": "objectives/anti-static/obfuscation/reflection/class::java-reflective-invoke", "conf": 0.9, "crit": 3, "desc": "Reflective method invocation in bytecode", "uses": [ 16, 19 ], "spans": [ [ 528, 25 ] ] } ], "type": "java_class" }, { "id": 64, "mol": "O(Ca)", "sha": "db48ef7643427c0e7aa1567637413f50c7cd4624e42906a1ffd69d2a55ddcd20", "path": "https://extensions.libreoffice.org/assets/downloads/z/coooder-1-1-2.oxt!!COOoder.jar!!org/openoffice/coooder/comp/SetNode.class", "risk": 1, "size": 1600, "type": "java_class", "depth": 4 }, { "id": 68, "mol": "H₂(DbF)", "sha": "78a5ddd030456d8e7034dc643a8b233d40ca77ea17668cde494a69b984aa1e03", "path": "https://extensions.libreoffice.org/assets/downloads/z/coooder-1-1-2.oxt!!COOoder.jar!!org/openoffice/coooder/comp/test/SyntaxTest.class", "risk": 2, "size": 4449, "type": "java_class", "depth": 4 }, { "id": 69, "mol": "H(Db)", "sha": "597145d2986199a7bb7be8cd1272014ff3abd9b1119aaeb4f7e058da9326d3f1", "path": "https://extensions.libreoffice.org/assets/downloads/z/coooder-1-1-2.oxt!!COOoder.jar!!org/openoffice/coooder/comp/test/base/Bootstrap$1.class", "risk": 1, "size": 1697, "type": "java_class", "depth": 4 }, { "ctx": [ { "b": "+kO#^0000O0DXLD0S-oOz/PFzz/xo9z!rP}v}vr6z/oM8wPxClz/6CDBy/JnfjFvhwIlw*z/*5xA:-[(00Ar55nCS%vj#C9zF7Q#vRPE:Bo8vIzc}9$vpS}WuUTZ%0rrd70rrx", "ln": 0 }, { "b": "vqYZhq/)4]zF83WrTF\u002670h{b5RVu=dygho]fkL6mxd(R*vrlF#0i2%#0rrQxwPQpQvrlG-z^^f/ASDdTc[d\u00268vrM6jy*?i]fgfL:B8$2[vpS}\u0026i%\u003e@*0iuOeTPkH802e{ZAck\u00269y\u0026A%auT^}(BAqLAvq(kEp:/1LvrM6jy*?i]fh($kx(mMBtte^uC404uvqYZhq/)4]zF848ygho]fkL6mxd(R*vrlG-z^^f/AYUZzygho]fkL6mxd)4\u0026ygQ)%i@]r!x(mS(w[=6)0rr:aygho]fkL6mxd)h9A+PA7i@]r}vScgbB98ChA9)M)A:-/@By/Gl0rrpxvqf+60rr{fygho]flIwJy+Fj{B.$Ygvruj4zAv\u003e00D4]r0z9p(1A4T+wDq=qvScgbB98Chz#/@6c}[w:C404wwPPO9qCoC]vrlG-z^^f/AYUZzv@DiqB9hvNB97\u0026hflIeJfiyOWze:AhwO#PSz/fVdCYV1L0j\u0026ghd}rHmflqnNflqkzAXy{vze.dwwO=r%AXx:$z/*5xA:-]QCW\u003er7BzkVh2MRHr02]/]az+$avqE5@z/6DizE)Zcay/tcBy/YsaQOjW0kn\u003cw4GJpg0kFQn2xaVozEEx[3il.0.vcBZ0k[)r3UK3)p\u0026ZF[wPz)r0rsC{oLO0Vvj#C9zF7R3BAh8kxfdLoygho]fkL6mxd)h9A+PA7i%U\u0026a0rrvax(mE1Cxj8\u003eI2+Q90lCk-0rrEFByxiiB606$xAn8Fc}[w:C404uvqYZhq/)4]zF83Ws{LbL0rrHGz!rP}v}vo7CX4cX=h^[IB8LV5x\u003e7YY0mg.]2lrcL04zz@z7/%Mzzc6Mvra2qx\u003c@-rBzkLApgnlUC4BuYvSC)$C$-c+wmY=\u00260mH}$0rrHuwPQ*YB8Mhwv}tVvivENovrM6jy*?i]fgfL:B8$2[vpS}\u0026j4%x$C404uvqYZhq/)4]zF83WoLO0Vvj#tkfgGU(wJHd$!=t:\u0026zF{Uow[C:!wGUMewN/\u003e8vpB4:azbLmzE:)}0n4qL7IWx4vj#C9zF7R3BAh8kxf{-Py?d9$2MSMV00vvYzWDG@0knWr?2NG!ygho]flIwJy+FW{zE^W53in\u0026Y5deA)0n[m=\u0026q?\u003cr00)ENCYVR$zF5$I11kP\u003c1+lNL%nSc0@%w+*0o:T/\u003ek+L)ygho]fkL6mxd(}%zF6vT\u003e(x#H00)W+q/)4]zF5$I6^#W6oLO0Vvj#C9zF7R3BAh8kxfcC2/8UdC0po^O0rrsjAbYxawb#VZc}[w:C404uvqYZhq/)4]zF83WoLO0Vvj#C9zF7R3BAh8kxf{-Py?d9$i%\u003e#t0pQx%\u003e(ykO02c?goLO0Vvj#C9zF7R3BAh8kxfcC2]8F", "ln": 3030 }, { "b": "2MT]a01pC%z!%u4yH.3?v}#tJ0S-oleN-d0wPh-OAa%o5en!)kwJZq11owGaj9tN.i%\u003e#)0se]h2ls/pygho]fkL6mxd)e9zGGPfwEFOC0sw\u0026c3ti{(qGV(0x(dzZ02l[hoLO0Vvj#C9zF7R2B-8qnzdL^o0r@Mk3\u0026{!r4GMLjwQ4=@0rsI@tte^uC404uvqYZhq/)4]zF83WoLO0Vvj#C9zF7R0A=kD0B8%zI0t2nA2ltzq01\u0026%OC404uvqYZhp\u0026ZF:wPI]30ttFF0rrQxwPQHYAcln3BAg@3z2\u003cRMc[d\u00268vrM6jx(tT@zG6-uq/)4\u003evqO7j0h6ud3\u0026}dB7Y:Qsz/{d502ngxvrM6jx(tU3A+PAkq/)4\u003evqO7i0u7$s1vC%Gapn8H0uqHG9rvhZ00EmPAaG4IkpxiuvrM6jx(tT@zG6-uq/)4\u003evqO81ygho]fkktTp\u0026Zn/Bw)p4wNPBqoLO0Vvj#A", "ln": 4215 }, { "b": "zza+6lVl\u003cWwN/*JCW\u003er7BzkVh1POJ500001]A\u003eQ+0yE7)lid5$ygho]fkL6mxd)j$A+eV\u00263\u0026@-%mf9w(B8kA0z#/}wc}U{?3imQqm*]wc0z0j\u003e7:@6)vrM6jy*?i]fgya}wPh:9z/dS=rTeT$0rs3MvrM6jy*?i]fh=}gBzkP6mr\u0026rNAcb/jzuf.wy\u0026r-)wPv!K8ba^NC404wwPPO9qCoC]vrlG-z^^f/AYTp44r$M+v{%gvz/fVdCYS@^2xJWMw[+:^0rrvppIaiMv}tVv4OQRCC404rz.BN]y?kWe010Zyx(ESUvqPMR00)7Kwi\u003elRvr?\u003eN0Dn5t6hidHC404uvqYZhp\u0026ZF:wPI]O0rr*UoMaAHy/s[=C4\u003eC$o\u003c}{FxjV8:01n", "ln": 5050 }, { "b": "z/dSq031WEvrM6jy*?i]fh=}gBzkP6mr\u0026rNAcb/jzAv\u003e06?\u0026vJC404uvqYZhmr\u0026rNAcb/jzAw77v/VMCygho]fk+uyfi7[zlU{gLB4*HXwmY=^0C8oif(I8Bfk\u003e/vzF%c0x\u003e7Zcv@Dp7wmY^mv@Dj6fly=DBt49iB7E0\u003ez/o-sBAg/ebRYM9x8}#pp?:(WiV[+gwc3xM01G3A0rt$BoLO0Vvj#C9zF7R3BAh8kxfe!4vrM6jx(tT@zG6-uq/)4\u003evqO81ygho]fkkt", "ln": 5559 } ], "depth": 4, "facts": { "imp": [ [ "", "java/io/File" ], [ "", "com/sun/star/comp/helper/ComponentContextEntry" ], [ "", "com/sun/star/comp/helper/BootstrapException" ], [ "", "com/sun/star/uno/UnoRuntime" ], [ "", "java/lang/Object" ], [ "", "java/util/Enumeration" ], [ "", "com/sun/star/bridge/UnoUrlResolver" ], [ "", "com/sun/star/lang/XMultiServiceFactory" ], [ "", "java/lang/String" ], [ "", "com/sun/star/bridge/XUnoUrlResolver" ], [ "", "com/sun/star/comp/loader/JavaLoader" ], [ "", "com/sun/star/lang/XMultiComponentFactory" ], [ "", "com/sun/star/connection/NoConnectException" ], [ "", "java/net/URLClassLoader" ], [ "", "java/lang/Runtime" ], [ "", "com/sun/star/lang/XInitialization" ], [ "", "[Ljava/lang/Object;" ], [ "", "com/sun/star/lib/util/NativeLibraryLoader" ], [ "", "com/sun/star/uno/XComponentContext" ], [ "", "org/openoffice/coooder/comp/test/base/Bootstrap$1" ], [ "", "com/sun/star/lang/XSingleComponentFactory" ], [ "", "com/sun/star/loader/XImplementationLoader" ], [ "", "java/lang/StringBuilder" ], [ "", "java/lang/Thread" ], [ "", "java/lang/Exception" ], [ "", "java/lang/Class" ], [ "", "java/util/Hashtable" ], [ "", "java/lang/Process" ], [ "", "java/util/Random" ], [ "", "[Ljava/lang/String;" ], [ "", "java/lang/System" ], [ "", "java/lang/RuntimeException" ], [ "", "com/sun/star/comp/helper/ComponentContext" ], [ "", "java/lang/Long" ], [ "", "com/sun/star/container/XSet" ], [ "java/util/Random", "java/util/Random.\u003cinit\u003e" ], [ "java/util/Random", "\u003cinit\u003e" ], [ "java/lang/Long", "java/lang/Long.toString" ], [ "java/lang/Long", "toString" ], [ "java/util/Hashtable", "java/util/Hashtable.size" ], [ "java/util/Hashtable", "size" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.append" ], [ "java/lang/StringBuilder", "append" ], [ "java/lang/Runtime", "java/lang/Runtime.getRuntime" ], [ "java/lang/Runtime", "getRuntime" ], [ "java/lang/Process", "java/lang/Process.getErrorStream" ], [ "java/lang/Process", "getErrorStream" ], [ "com/sun/star/comp/helper/ComponentContext", "com/sun/star/comp/helper/ComponentContext.\u003cinit\u003e" ], [ "com/sun/star/comp/helper/ComponentContext", "\u003cinit\u003e" ], [ "org/openoffice/coooder/comp/test/base/Bootstrap", "org/openoffice/coooder/comp/test/base/Bootstrap.createInitialComponentContext" ], [ "org/openoffice/coooder/comp/test/base/Bootstrap", "createInitialComponentContext" ], [ "com/sun/star/bridge/XUnoUrlResolver", "com/sun/star/bridge/XUnoUrlResolver.resolve" ], [ "com/sun/star/bridge/XUnoUrlResolver", "resolve" ], [ "org/openoffice/coooder/comp/test/base/Bootstrap", "org/openoffice/coooder/comp/test/base/Bootstrap.cppuhelper_bootstrap" ], [ "org/openoffice/coooder/comp/test/base/Bootstrap", "cppuhelper_bootstrap" ], [ "java/lang/System", "java/lang/System.getProperty" ], [ "java/lang/System", "getProperty" ], [ "com/sun/star/bridge/UnoUrlResolver", "com/sun/star/bridge/UnoUrlResolver.create" ], [ "com/sun/star/bridge/UnoUrlResolver", "create" ], [ "java/util/Hashtable", "java/util/Hashtable.put" ], [ "java/util/Hashtable", "put" ], [ "com/sun/star/lang/XInitialization", "com/sun/star/lang/XInitialization.initialize" ], [ "com/sun/star/lang/XInitialization", "initialize" ], [ "java/lang/Class", "java/lang/Class.getClassLoader" ], [ "java/lang/Class", "getClassLoader" ], [ "java/lang/System", "java/lang/System.err" ], [ "java/lang/System", "err" ], [ "com/sun/star/comp/loader/JavaLoader", "com/sun/star/comp/loader/JavaLoader.\u003cinit\u003e" ], [ "com/sun/star/comp/loader/JavaLoader", "\u003cinit\u003e" ], [ "java/lang/System", "java/lang/System.out" ], [ "java/lang/System", "out" ], [ "java/lang/Object", "java/lang/Object.\u003cinit\u003e" ], [ "java/lang/Object", "\u003cinit\u003e" ], [ "com/sun/star/lang/XSingleComponentFactory", "com/sun/star/lang/XSingleComponentFactory.createInstanceWithContext" ], [ "com/sun/star/lang/XSingleComponentFactory", "createInstanceWithContext" ], [ "com/sun/star/uno/UnoRuntime", "com/sun/star/uno/UnoRuntime.queryInterface" ], [ "com/sun/star/uno/UnoRuntime", "queryInterface" ], [ "java/lang/System", "java/lang/System.loadLibrary" ], [ "java/lang/System", "loadLibrary" ], [ "java/util/Random", "java/util/Random.nextLong" ], [ "java/util/Random", "nextLong" ], [ "com/sun/star/container/XSet", "com/sun/star/container/XSet.insert" ], [ "com/sun/star/container/XSet", "insert" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.\u003cinit\u003e" ], [ "java/lang/StringBuilder", "\u003cinit\u003e" ], [ "com/sun/star/uno/XComponentContext", "com/sun/star/uno/XComponentContext.getServiceManager" ], [ "com/sun/star/uno/XComponentContext", "getServiceManager" ], [ "java/util/Enumeration", "java/util/Enumeration.hasMoreElements" ], [ "java/util/Enumeration", "hasMoreElements" ], [ "com/sun/star/loader/XImplementationLoader", "com/sun/star/loader/XImplementationLoader.activate" ], [ "com/sun/star/loader/XImplementationLoader", "activate" ], [ "com/sun/star/comp/helper/BootstrapException", "com/sun/star/comp/helper/BootstrapException.\u003cinit\u003e" ], [ "com/sun/star/comp/helper/BootstrapException", "\u003cinit\u003e" ], [ "java/io/File", "java/io/File.getPath" ], [ "java/io/File", "getPath" ], [ "com/sun/star/lib/util/NativeLibraryLoader", "com/sun/star/lib/util/NativeLibraryLoader.getResource" ], [ "com/sun/star/lib/util/NativeLibraryLoader", "getResource" ], [ "com/sun/star/comp/helper/BootstrapException", "com/sun/star/comp/helper/BootstrapException.\u003cinit\u003e" ], [ "com/sun/star/comp/helper/BootstrapException", "\u003cinit\u003e" ], [ "java/util/Hashtable", "java/util/Hashtable.get" ], [ "java/util/Hashtable", "get" ], [ "org/openoffice/coooder/comp/test/base/Bootstrap", "org/openoffice/coooder/comp/test/base/Bootstrap.insertBasicFactories" ], [ "org/openoffice/coooder/comp/test/base/Bootstrap", "insertBasicFactories" ], [ "java/util/Hashtable", "java/util/Hashtable.\u003cinit\u003e" ], [ "java/util/Hashtable", "\u003cinit\u003e" ], [ "java/util/Enumeration", "java/util/Enumeration.nextElement" ], [ "java/util/Enumeration", "nextElement" ], [ "java/lang/String", "java/lang/String.startsWith" ], [ "java/lang/String", "startsWith" ], [ "java/lang/Process", "java/lang/Process.getInputStream" ], [ "java/lang/Process", "getInputStream" ], [ "org/openoffice/coooder/comp/test/base/Bootstrap$1", "org/openoffice/coooder/comp/test/base/Bootstrap$1.start" ], [ "org/openoffice/coooder/comp/test/base/Bootstrap$1", "start" ], [ "com/sun/star/comp/helper/ComponentContextEntry", "com/sun/star/comp/helper/ComponentContextEntry.\u003cinit\u003e" ], [ "com/sun/star/comp/helper/ComponentContextEntry", "\u003cinit\u003e" ], [ "org/openoffice/coooder/comp/test/base/Bootstrap", "org/openoffice/coooder/comp/test/base/Bootstrap.pipe" ], [ "org/openoffice/coooder/comp/test/base/Bootstrap", "pipe" ], [ "com/sun/star/connection/NoConnectException", "com/sun/star/connection/NoConnectException.toString" ], [ "com/sun/star/connection/NoConnectException", "toString" ], [ "org/openoffice/coooder/comp/test/base/Bootstrap", "org/openoffice/coooder/comp/test/base/Bootstrap.defaultBootstrap_InitialComponentContext" ], [ "org/openoffice/coooder/comp/test/base/Bootstrap", "defaultBootstrap_InitialComponentContext" ], [ "java/lang/Thread", "java/lang/Thread.sleep" ], [ "java/lang/Thread", "sleep" ], [ "org/openoffice/coooder/comp/test/base/Bootstrap", "org/openoffice/coooder/comp/test/base/Bootstrap.m_loaded_juh" ], [ "org/openoffice/coooder/comp/test/base/Bootstrap", "m_loaded_juh" ], [ "java/util/Hashtable", "java/util/Hashtable.keys" ], [ "java/util/Hashtable", "keys" ], [ "java/lang/StringBuilder", "java/lang/StringBuilder.toString" ], [ "java/lang/StringBuilder", "toString" ], [ "java/lang/Runtime", "java/lang/Runtime.exec" ], [ "java/lang/Runtime", "exec" ], [ "org/openoffice/coooder/comp/test/base/Bootstrap$1", "org/openoffice/coooder/comp/test/base/Bootstrap$1.\u003cinit\u003e" ], [ "org/openoffice/coooder/comp/test/base/Bootstrap$1", "\u003cinit\u003e" ] ], "metrics": { "file": { "size": 8263, "entropy": 5.76 }, "class": { "major_version": 50, "interface_count": 0, "method_ref_count": 49, "constant_pool_size": 372, "external_class_count": 35 }, "binary": { "peak_region_bytes": 7168, "peak_region_entropy": 5.41 }, "imports": { "count": 84 }, "functions": { "count": 10 } } }, "id": 70, "mol": "O₃(AlAsEu)H₅(CmDb₂F₂Po₃Ti)Md", "path": "https://extensions.libreoffice.org/assets/downloads/z/coooder-1-1-2.oxt!!COOoder.jar!!org/openoffice/coooder/comp/test/base/Bootstrap.class", "pid": 47, "risk": 14, "sha": "7c8cd046c9afc425d8ca9d23a88b82e92b299f32d1cfbe329cece37d0fea8396", "size": 8263, "traits": [ { "id": "metadata/binary/code/complexity::few-functions-3", "conf": 1.0, "crit": 2, "desc": "Binary has 3+ functions" }, { "id": "metadata/binary/code/complexity::functions-at-most-24", "conf": 1.0, "crit": 2, "desc": "Binary has 24 or fewer functions" }, { "id": "metadata/binary/code/complexity::functions-at-most-32", "conf": 1.0, "crit": 2, "desc": "Binary has 32 or fewer functions" }, { "id": "metadata/binary/symbols/count::many-imports", "conf": 0.8, "crit": 2, "desc": "High number of imported symbols (\u003e80)" }, { "id": "metadata/binary/symbols/count::many-imports-20", "conf": 1.0, "crit": 2, "desc": "Binary has 20+ imports" }, { "id": "metadata/binary/symbols/count::many-imports-25", "conf": 1.0, "crit": 2, "desc": "Binary has 25+ imports" }, { "id": "metadata/binary/symbols/count::many-imports-30", "conf": 1.0, "crit": 2, "desc": "Binary has 30+ imports" }, { "id": "metadata/binary/symbols/count::many-imports-40", "conf": 1.0, "crit": 2, "desc": "Binary has 40+ imports" }, { "id": "metadata/binary/symbols/count::many-imports-50", "conf": 1.0, "crit": 2, "desc": "Binary has 50+ imports" }, { "id": "metadata/binary/symbols/imports::jvm-anonymous-inner-class-reference", "conf": 0.88, "crit": 2, "desc": "JVM class references an anonymous inner class" }, { "id": "metadata/binary/symbols/imports::jvm-system-class-reference", "conf": 0.86, "crit": 2, "desc": "JVM constant-pool System class reference" }, { "id": "metadata/file/data-blob::binary-peak-region-mass-over-1k", "conf": 0.85, "crit": 2, "desc": "High-entropy binary region mass over 1KB" }, { "id": "metadata/file/import::script-many-imports-10-small", "conf": 0.5, "crit": 2, "desc": "Small source file (\u003c=10KB) with 10+ imports" }, { "id": "metadata/file/magic/identity::cafebabe-magic", "conf": 1.0, "crit": 2, "desc": "CAFEBABE magic at file start", "spans": [ [ 0, 0 ] ] }, { "id": "metadata/file/magic/identity::jvm-classfile-magic", "conf": 1.0, "crit": 2, "desc": "JVM class-file magic in analyzed bytes", "spans": [ [ 0, 0 ] ] }, { "id": "metadata/file/string/identity::jvm-activate-constant", "conf": 0.9, "crit": 3, "desc": "JVM constant-pool activate string" }, { "id": "metadata/package/testing/presence/harness::binary-test-directory", "conf": 1.0, "crit": 2, "desc": "Binary file in test directory" }, { "id": "micro-behaviors/communications/http/lib/urlconnection::java-url-class-bytecode", "atk": "T1071.001", "mbc": "C0002", "conf": 0.86, "crit": 3, "desc": "Java URL class reference", "spans": [ [ 3354, 63 ], [ 5207, 25 ], [ 5623, 23 ] ] }, { "id": "micro-behaviors/data/source/dynamic/reflect::java-urlclassloader-bytecode", "conf": 0.94, "crit": 3, "desc": "JVM URLClassLoader class reference" }, { "id": "micro-behaviors/data/string/conversion::tostring-token", "conf": 1.0, "crit": 3, "desc": "References the toString conversion method", "spans": [ [ 3980, 8 ] ] }, { "id": "micro-behaviors/fs/path/extension::java-executable-reference", "conf": 0.92, "crit": 3, "desc": "Java bytecode references an executable path" }, { "id": "micro-behaviors/fs/read/file/handle::jvm-io-file-class-ref", "conf": 0.86, "crit": 3, "desc": "JVM File API class reference" }, { "id": "micro-behaviors/process/create/spawn::java-getruntime-ref", "atk": "T1059", "mbc": "E1203", "conf": 0.84, "crit": 3, "desc": "Java getRuntime call reference", "spans": [ [ 4304, 10 ] ] }, { "id": "micro-behaviors/process/create/spawn::java-runtime-class", "atk": "T1059", "mbc": "E1203", "conf": 0.86, "crit": 3, "desc": "Java Runtime class reference", "spans": [ [ 4279, 17 ] ] }, { "id": "micro-behaviors/process/create/spawn::java-runtime-getruntime-bytecode-symbol", "atk": "T1059", "mbc": "E1203", "conf": 0.92, "crit": 3, "desc": "Java bytecode Runtime accessor", "spans": [ [ 4304, 28 ] ] }, { "id": "micro-behaviors/process/create/stdlib::jvm-runtime-class-ref", "conf": 0.9, "crit": 2, "desc": "JVM Runtime class reference" }, { "id": "micro-behaviors/process/info/current::getpath-ref", "conf": 0.8, "crit": 3, "desc": "Java getPath call reference" }, { "id": "micro-behaviors/process/io/stream::jvm-process-input-stream", "conf": 0.94, "crit": 3, "desc": "JVM process output stream access", "spans": [ [ 4434, 32 ] ] }, { "id": "micro-behaviors/process/thread/lifecycle::jvm-thread-class-ref", "conf": 0.88, "crit": 2, "desc": "JVM Thread class reference" }, { "id": "micro-behaviors/time/sleep/interval::java-thread-sleep-bytecode", "conf": 0.9, "crit": 3, "desc": "Java bytecode thread sleep", "spans": [ [ 5114, 22 ] ] }, { "id": "objectives/anti-analysis/timing/evasion::kotlin-thread-sleep-check", "atk": "T1497.003", "conf": 0.94, "crit": 3, "desc": "Kotlin Thread.sleep call", "spans": [ [ 5124, 12 ] ] }, { "id": "objectives/anti-static/obfuscation/reflection/class::dalvik-classloader", "atk": "T1406", "mbc": "F0006", "conf": 1.0, "crit": 3, "desc": "Dalvik ClassLoader type descriptor", "spans": [ [ 3094, 25 ], [ 3155, 80 ], [ 3751, 57 ] ] }, { "id": "objectives/exfiltration/messaging/discord::java-system-property-os", "atk": "T1567.002", "mbc": "E1041", "conf": 0.88, "crit": 3, "desc": "Java OS property collection", "spans": [ [ 3515, 7 ] ] }, { "id": "micro-behaviors/fs/path/extension::exe-name-or-extension", "conf": 0.5, "crit": 2, "desc": "References a Windows .exe filename or extension", "spans": [ [ 3660, 0 ] ] }, { "id": "micro-behaviors/process/create/spawn::java-runtime-exec-bytecode-symbol", "atk": "T1059", "mbc": "E1203", "conf": 0.95, "crit": 3, "desc": "Java bytecode Runtime.exec call", "spans": [ [ 4351, 22 ] ] } ], "type": "java_class" }, { "ctx": [ { "b": "+kO#^0000O0i(+e0S-oRz/PFzz/xo9z!rP}v}vr6z/oM8wPxClz/6CDBy/JnfjFvhwIm53z=yp?Bw)r@By+WS1owGuyisAdBt4lDvqPO1z/PRDraQb)q/#!@wDq=pz9@kVBy/W", "ln": 0 }, { "b": "p\u0026Zn/Bw)p4wNPBq2MN3?02FTMvpB4:aARJAA=(mxBzbkdBy/JnA%.[j073[\u003ck(*%0ygho]fkktTp\u0026Zn/Bw)p4wNPA:07c-r0rrvzA+PAky\u0026fNWmf2*.07D$?6ky}", "ln": 805 }, { "b": "q/)4]zF83WoLO0Vvj#C9zF7R3BAh8kxfcw0yYKI?ra]?=z/xo9z!rP}v}vobzGx]dy?$.yvruf9C42A9vpB4:azC)tze16jx(mL\u003c07u(v2lnVy01rQJC404rz.BN]y?i}Nzu8r{0ce8u7IWx4vj#IfBt3S(oHAS8B8$2[vpS}\u00262ln\u0026D01rQJC404wwPPO9qCmz$zua?*0cXA/0rrpBz=GXb0rrVVdnjF+C404wwPPO9qB@}S0d1S)2lo8K01rQJC404wwPPO9qB}n%Ee[Y%00NE.rz(G\u003e01ZLcoLO0Vvj#IfBt3S(oGJNYAr7H$00@TR0rr-Xtte^uC404wwPPO9qCoe3rTF?V0egTTGAh6az/PFzz/xo9z!rP}v}vr6z/oM8wPxClz/6CDBy/JnfjFvhwIlw*z/*5xA:-[}0epGe0rrBnz/o-sBAg/e0rttjoLO0Vvj#IfBt3S(oHAS8B8$2[vpS}\u0026j1i\u003ckz/4dGB-5\u003cNByxhyB-8aJsvm1zAbPS9zGFl:zGGDmBuoH61Am^\u003exAn8rvQTs?l${Vx01IXqvrM6jx(tT]x(4ux0rrHqy*?yaoMauIwPv!K8ba^NC404wwPPO9qCoC]vrlG-z^^f/AYTHaJSxa\u003eygho]fkL6mxd)h9A+PA73JMm*K{p#H0rsrNz/4dGB-5\u003cNByxhyB-8aJsvm1zAbPS9zGFl:zGGDmBpnek0f^G:5OCV%q!o#)x\u003e7ZGvqYH^wPv!Kegq@vv@DiqB9hvNB97\u0026hfkL6mxd)vYB.(ellVl*Xz/b", "ln": 1419 }, { "b": "0SSl32((gI0rrGc0055W1POS8001t}W/u*^1gnas13JKZ6E{Y{0A*])gpEleWG4Rb0S:n\u003eZm\u003eO[U(B+70@@(j000]q1][S6li4b*f8#pUl\u0026WX%mf1qcl\u0026XIkm/Tb3001bw0@@r3ciaUU6951j001tCaPJX^0rrGc8uqh^dGxIId/YLH5Dz[j01F#h2lj=f04XcJ01Ybh00@SS0096c0000?00ic40000bdL4$de?c$h01Mml000625c8Xg4GDOh000", "ln": 2963 } ], "depth": 4, "facts": { "imp": [ [ "", "java/io/File" ], [ "", "java/net/URL" ], [ "", "org/openoffice/coooder/comp/test/base/Bootstrap" ], [ "", "java/lang/String" ], [ "", "java/net/URI" ], [ "", "com/sun/star/frame/XDesktop" ], [ "", "java/io/PrintStream" ], [ "", "com/sun/star/uno/UnoRuntime" ], [ "", "junit/framework/TestSuite" ], [ "", "[Ljava/lang/Class;" ], [ "", "com/sun/star/uno/XComponentContext" ], [ "", "java/net/URLClassLoader" ], [ "", "org/openoffice/coooder/comp/test/base/UnoTestCase" ], [ "", "com/sun/star/lang/XMultiComponentFactory" ], [ "", "java/lang/Exception" ], [ "", "java/lang/System" ], [ "org/openoffice/coooder/comp/test/base/UnoTestSuite", "org/openoffice/coooder/comp/test/base/UnoTestSuite.\u003cinit\u003e" ], [ "org/openoffice/coooder/comp/test/base/UnoTestSuite", "\u003cinit\u003e" ], [ "org/openoffice/coooder/comp/test/base/UnoTestSuite", "org/openoffice/coooder/comp/test/base/UnoTestSuite.startOffice" ], [ "org/openoffice/coooder/comp/test/base/UnoTestSuite", "startOffice" ], [ "junit/framework/TestSuite", "junit/framework/TestSuite.run" ], [ "junit/framework/TestSuite", "run" ], [ "org/openoffice/coooder/comp/test/base/UnoTestSuite", "org/openoffice/coooder/comp/test/base/UnoTestSuite.mContext" ], [ "org/openoffice/coooder/comp/test/base/UnoTestSuite", "mContext" ], [ "junit/framework/TestSuite", "junit/framework/TestSuite.\u003cinit\u003e" ], [ "junit/framework/TestSuite", "\u003cinit\u003e" ], [ "org/openoffice/coooder/comp/test/base/UnoTestSuite", "org/openoffice/coooder/comp/test/base/UnoTestSuite.addTest" ], [ "org/openoffice/coooder/comp/test/base/UnoTestSuite", "addTest" ], [ "org/openoffice/coooder/comp/test/base/UnoTestCase", "org/openoffice/coooder/comp/test/base/UnoTestCase.setContext" ], [ "org/openoffice/coooder/comp/test/base/UnoTestCase", "setContext" ], [ "java/io/File", "java/io/File.\u003cinit\u003e" ], [ "java/io/File", "\u003cinit\u003e" ], [ "com/sun/star/uno/XComponentContext", "com/sun/star/uno/XComponentContext.getServiceManager" ], [ "com/sun/star/uno/XComponentContext", "getServiceManager" ], [ "junit/framework/TestSuite", "junit/framework/TestSuite.\u003cinit\u003e" ], [ "junit/framework/TestSuite", "\u003cinit\u003e" ], [ "org/openoffice/coooder/comp/test/base/Bootstrap", "org/openoffice/coooder/comp/test/base/Bootstrap.bootstrap" ], [ "org/openoffice/coooder/comp/test/base/Bootstrap", "bootstrap" ], [ "java/io/PrintStream", "java/io/PrintStream.println" ], [ "java/io/PrintStream", "println" ], [ "java/lang/Exception", "java/lang/Exception.printStackTrace" ], [ "java/lang/Exception", "printStackTrace" ], [ "java/net/URI", "java/net/URI.toURL" ], [ "java/net/URI", "toURL" ], [ "org/openoffice/coooder/comp/test/base/UnoTestSuite", "org/openoffice/coooder/comp/test/base/UnoTestSuite.mHandleConnection" ], [ "org/openoffice/coooder/comp/test/base/UnoTestSuite", "mHandleConnection" ], [ "java/lang/System", "java/lang/System.err" ], [ "java/lang/System", "err" ], [ "java/net/URLClassLoader", "java/net/URLClassLoader.\u003cinit\u003e" ], [ "java/net/URLClassLoader", "\u003cinit\u003e" ], [ "com/sun/star/lang/XMultiComponentFactory", "com/sun/star/lang/XMultiComponentFactory.createInstanceWithContext" ], [ "com/sun/star/lang/XMultiComponentFactory", "createInstanceWithContext" ], [ "junit/framework/TestSuite", "junit/framework/TestSuite.runTest" ], [ "junit/framework/TestSuite", "runTest" ], [ "org/openoffice/coooder/comp/test/base/UnoTestSuite", "org/openoffice/coooder/comp/test/base/UnoTestSuite.stopOffice" ], [ "org/openoffice/coooder/comp/test/base/UnoTestSuite", "stopOffice" ], [ "java/lang/System", "java/lang/System.getProperty" ], [ "java/lang/System", "getProperty" ], [ "com/sun/star/uno/UnoRuntime", "com/sun/star/uno/UnoRuntime.queryInterface" ], [ "com/sun/star/uno/UnoRuntime", "queryInterface" ], [ "junit/framework/TestSuite", "junit/framework/TestSuite.\u003cinit\u003e" ], [ "junit/framework/TestSuite", "\u003cinit\u003e" ], [ "org/openoffice/coooder/comp/test/base/UnoTestSuite", "org/openoffice/coooder/comp/test/base/UnoTestSuite.setContext" ], [ "org/openoffice/coooder/comp/test/base/UnoTestSuite", "setContext" ], [ "junit/framework/TestSuite", "junit/framework/TestSuite.\u003cinit\u003e" ], [ "junit/framework/TestSuite", "\u003cinit\u003e" ], [ "java/io/File", "java/io/File.toURI" ], [ "java/io/File", "toURI" ], [ "com/sun/star/frame/XDesktop", "com/sun/star/frame/XDesktop.terminate" ], [ "com/sun/star/frame/XDesktop", "terminate" ], [ "junit/framework/TestSuite", "junit/framework/TestSuite.\u003cinit\u003e" ], [ "junit/framework/TestSuite", "\u003cinit\u003e" ], [ "java/lang/Exception", "java/lang/Exception.\u003cinit\u003e" ], [ "java/lang/Exception", "\u003cinit\u003e" ] ], "metrics": { "file": { "size": 4113, "entropy": 5.43 }, "class": { "major_version": 50, "interface_count": 0, "method_ref_count": 29, "constant_pool_size": 177, "external_class_count": 16 }, "binary": { "peak_region_bytes": 3072, "peak_region_entropy": 5.36 }, "imports": { "count": 45 }, "functions": { "count": 12 } } }, "id": 72, "mol": "O(I)H₄(CmDbFPo)", "path": "https://extensions.libreoffice.org/assets/downloads/z/coooder-1-1-2.oxt!!COOoder.jar!!org/openoffice/coooder/comp/test/base/UnoTestSuite.class", "pid": 47, "risk": 6, "sha": "4c17051d5add56cc06501f65b89505cc259e8bca01a800937d4761b613580b8b", "size": 4113, "traits": [ { "id": "metadata/binary/code/complexity::few-functions-3", "conf": 1.0, "crit": 2, "desc": "Binary has 3+ functions" }, { "id": "metadata/binary/code/complexity::functions-at-most-24", "conf": 1.0, "crit": 2, "desc": "Binary has 24 or fewer functions" }, { "id": "metadata/binary/code/complexity::functions-at-most-32", "conf": 1.0, "crit": 2, "desc": "Binary has 32 or fewer functions" }, { "id": "metadata/binary/symbols/count::many-imports-20", "conf": 1.0, "crit": 2, "desc": "Binary has 20+ imports" }, { "id": "metadata/binary/symbols/count::many-imports-25", "conf": 1.0, "crit": 2, "desc": "Binary has 25+ imports" }, { "id": "metadata/binary/symbols/count::many-imports-30", "conf": 1.0, "crit": 2, "desc": "Binary has 30+ imports" }, { "id": "metadata/binary/symbols/count::many-imports-40", "conf": 1.0, "crit": 2, "desc": "Binary has 40+ imports" }, { "id": "metadata/binary/symbols/imports::jvm-system-class-reference", "conf": 0.86, "crit": 2, "desc": "JVM constant-pool System class reference" }, { "id": "metadata/file/data-blob::binary-peak-region-mass-over-1k", "conf": 0.85, "crit": 2, "desc": "High-entropy binary region mass over 1KB" }, { "id": "metadata/file/import::script-many-imports-10-small", "conf": 0.5, "crit": 2, "desc": "Small source file (\u003c=10KB) with 10+ imports" }, { "id": "metadata/file/magic/identity::cafebabe-magic", "conf": 1.0, "crit": 2, "desc": "CAFEBABE magic at file start", "spans": [ [ 0, 0 ] ] }, { "id": "metadata/file/magic/identity::jvm-classfile-magic", "conf": 1.0, "crit": 2, "desc": "JVM class-file magic in analyzed bytes", "spans": [ [ 0, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"", "spans": [ [ 837, 0 ] ] }, { "id": "metadata/package/testing/presence/harness::binary-test-directory", "conf": 1.0, "crit": 2, "desc": "Binary file in test directory" }, { "id": "micro-behaviors/communications/http/lib/urlconnection::java-url-class-bytecode", "atk": "T1071.001", "mbc": "C0002", "conf": 0.86, "crit": 3, "desc": "Java URL class reference", "spans": [ [ 1532, 23 ], [ 1561, 12 ], [ 1649, 16 ], [ 1678, 18 ], [ 1774, 63 ], [ 1888, 25 ] ] }, { "id": "micro-behaviors/communications/http/lib/urlconnection::jvm-url-class-ref", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "JVM URL class reference" }, { "id": "micro-behaviors/data/source/dynamic/reflect::java-urlclassloader-bytecode", "conf": 0.94, "crit": 3, "desc": "JVM URLClassLoader class reference" }, { "id": "micro-behaviors/fs/read/file/handle::jvm-io-file-class-ref", "conf": 0.86, "crit": 3, "desc": "JVM File API class reference" }, { "id": "micro-behaviors/process/info/current::touri-ref", "conf": 0.82, "crit": 3, "desc": "Java toURI call reference" }, { "id": "objectives/impact/dos/disk::jvm-megabyte-byte-array-constant", "atk": "T1499.001", "conf": 0.94, "crit": 3, "desc": "JVM one-megabyte allocation constant", "spans": [ [ 3027, 14 ] ] } ], "type": "java_class" }, { "id": 74, "mol": "H₃(DbFPo)", "sha": "7022a335e55f89c4576b87acce59534f9ada4c99fd347ebf2b6dc2082a4b0de9", "path": "https://extensions.libreoffice.org/assets/downloads/z/coooder-1-1-2.oxt!!COOoder.jar!!org/openoffice/coooder/comp/theLanguagesManagerImpl.class", "risk": 3, "size": 8099, "type": "java_class", "depth": 4 }, { "id": 78, "mol": "H(Db)", "sha": "d95fb4f6723f1edaf06006ddb88b8648ac50c6a9760795fddf7d25ca084c100e", "path": "https://extensions.libreoffice.org/assets/downloads/z/coooder-1-1-2.oxt!!COOoder.jar!!org/openoffice/coooder/comp/ui/ParseTriggerImpl.class", "risk": 1, "size": 6112, "type": "java_class", "depth": 4 } ], "omitted_files": 13, "rev": "c1ea9", "v": "8" } }