{
  "ml": {
    "v": "7",
    "eng": "2.2.0-beta.2",
    "lvl": -1,
    "conf": 0,
    "mods": [
      {
        "cls": 0,
        "raw": 0.4480001,
        "rte": "az",
        "prob": 0.4480001
      },
      {
        "cls": 0,
        "raw": 0.16580324,
        "rte": "az/zip",
        "prob": 0.16580324
      }
    ],
    "prob": 0.4480001,
    "files": [
      {
        "id": 0,
        "lvl": -1,
        "conf": 0,
        "prob": 0.44800010323524475,
        "type": "crx"
      },
      {
        "id": 1,
        "lvl": -1,
        "conf": 0,
        "prob": 0.000012993812561035156,
        "type": "json"
      },
      {
        "id": 2,
        "lvl": -1,
        "conf": 0,
        "prob": 0.000033408403396606445,
        "type": "png"
      },
      {
        "id": 3,
        "lvl": -1,
        "conf": 0,
        "prob": 0.2451288104057312,
        "type": "png"
      },
      {
        "id": 4,
        "lvl": -1,
        "conf": 0,
        "prob": 0.000041365623474121094,
        "type": "png"
      },
      {
        "id": 5,
        "lvl": -1,
        "conf": 0,
        "prob": 0.000041365623474121094,
        "type": "png"
      },
      {
        "id": 6,
        "lvl": -1,
        "conf": 0,
        "prob": 0.00006663799285888672,
        "type": "json"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-07-05T21:57:23Z"
  },
  "path": "cebjegcbeonnjlllggekaaceficcbjop.crx",
  "raw": {
    "files": [
      {
        "id": 0,
        "ctx": [
          {
            "b": "lVK}s0@@r390Drx608iyRueD60u%ib1{(=lnqu\u003cF0rAi800v/N4/!qn0sw)W0rAgY}[Dw{v/",
            "n": [
              {
                "c": 3,
                "d": "Staged loader six file archive",
                "i": "objectives/command-and-control/backdoor/loader/archive::staged-loader-six-files",
                "o": 0,
                "z": 25,
                "cf": 0.949999988079071
              }
            ],
            "ln": 0
          }
        ],
        "mol": "O₂(AsC)",
        "sha": "95a1681aa2f5d143e2a6f2e97842c9de4a0109b6dfca6c94966178a23dfa17ce",
        "path": "/data/samples/unknown/foraged/chrome/google.com/chromewebstore.google.com/cebjegcbeonnjlllggekaaceficcbjop/cebjegcbeonnjlllggekaaceficcbjop.crx",
        "risk": 3,
        "size": 639844,
        "type": "crx",
        "facts": {
          "metrics": {
            "file": {
              "size": 639844.0,
              "entropy": 7.99,
              "size_bytes": 639844.0
            },
            "binary": {
              "overall_entropy": 7.99,
              "peak_region_bytes": 636928.0,
              "peak_region_entropy": 7.84
            },
            "archive": {
              "file_count": 6.0,
              "member_count": 8.0,
              "prefix_bytes": 1320.0,
              "script_count": 0.0,
              "zip_bomb_ratio": 3.84,
              "directory_count": 2.0,
              "executable_count": 0.0,
              "extra_field_size": 360.0,
              "noise_file_count": 0.0,
              "total_compressed": 636706.0,
              "compression.ratio": 1.0,
              "hidden_file_count": 0.0,
              "total_uncompressed": 637891.0,
              "crc_collision_count": 0.0,
              "entry_comment_count": 0.0,
              "max_filename_length": 32.0,
              "rtlo_filename_count": 0.0,
              "format.regular_count": 6.0,
              "nested_archive_count": 0.0,
              "path_traversal_count": 0.0,
              "symlink_escape_count": 0.0,
              "security.setgid_count": 0.0,
              "security.setuid_count": 0.0,
              "security.sticky_count": 0.0,
              "double_extension_count": 0.0,
              "duplicate_member_count": 0.0,
              "format.directory_count": 2.0,
              "security.symlink_count": 0.0,
              "unicode_filename_count": 0.0,
              "homoglyph_filename_count": 0.0,
              "security.encrypted_count": 0.0,
              "timing.mtime_unique_count": 1.0,
              "timing.mtime_unique_ratio": 0.13,
              "misplaced_executable_count": 0.0,
              "timing.mtime_dominant_count": 8.0,
              "timing.mtime_spread_seconds": 0.0,
              "timing.sentinel_mtime_count": 0.0,
              "security.world_writable_count": 0.0,
              "timing.mtime_dominant_fraction": 1.0,
              "compression.method_counts.deflate": 8.0
            }
          }
        },
        "ident": {
          "trust": "self_signed",
          "identifier": {
            "value": "lfoeajgcchlidpicbabpmckkejpckcfb",
            "source": "crx.extension_id",
            "verified": true
          },
          "unique_ids": {
            "crx_id": "lfoeajgcchlidpicbabpmckkejpckcfb",
            "public_key_sha256": "b5e4096227b83f82101fc2aa49f2a251accde3d98471464dd17d1819b43786b0"
          }
        },
        "traits": [
          {
            "id": "objectives/anti-static/obfuscation/steganography/image::b-channel-high",
            "atk": "T1027.003",
            "mbc": "B0032.001",
            "conf": 0.6000000238418579,
            "crit": 1,
            "desc": "Blue channel entropy above normal",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "objectives/anti-static/obfuscation/steganography/image::g-channel-high",
            "atk": "T1027.003",
            "mbc": "B0032.001",
            "conf": 0.6000000238418579,
            "crit": 1,
            "desc": "Green channel entropy above normal",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "objectives/anti-static/obfuscation/steganography/image::high-pixel-entropy",
            "atk": "T1027.003",
            "mbc": "B0032.001",
            "conf": 0.699999988079071,
            "crit": 1,
            "desc": "Image pixel entropy in steganographic range",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "objectives/anti-static/obfuscation/steganography/image::lsb-steganography-rgb-pattern",
            "atk": "T1027.003",
            "mbc": "B0032.001",
            "conf": 0.800000011920929,
            "crit": 3,
            "desc": "LSB stego pattern (RGB high + low-edge + entropy)",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "metadata/image/metrics::low-edge-density",
            "conf": 0.6499999761581421,
            "crit": 1,
            "desc": "Low image edge density metric",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "objectives/anti-static/obfuscation/steganography/image::r-channel-high",
            "atk": "T1027.003",
            "mbc": "B0032.001",
            "conf": 0.6000000238418579,
            "crit": 1,
            "desc": "Red channel entropy above normal",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "metadata/permission/manifest::chrome-theme-toolbar-image",
            "conf": 0.949999988079071,
            "crit": 1,
            "desc": "Chrome theme toolbar image"
          },
          {
            "id": "metadata/permission/manifest::chrome-theme-tab-background-image",
            "conf": 0.949999988079071,
            "crit": 1,
            "desc": "Chrome theme tab background"
          },
          {
            "id": "metadata/permission/manifest::chrome-theme-frame-image",
            "conf": 0.949999988079071,
            "crit": 1,
            "desc": "Chrome theme frame image"
          },
          {
            "id": "metadata/permission/manifest::chrome-theme-ntp-background-image",
            "conf": 0.949999988079071,
            "crit": 1,
            "desc": "Chrome theme NTP background"
          },
          {
            "id": "metadata/permission/manifest::chrome-webstore-verified-contents",
            "conf": 0.949999988079071,
            "crit": 1,
            "desc": "Chrome Web Store verified contents"
          },
          {
            "id": "objectives/command-and-control/backdoor/loader/archive::staged-loader-six-files",
            "conf": 0.949999988079071,
            "crit": 3,
            "desc": "Staged loader six file archive",
            "spans": [
              [
                0,
                25
              ]
            ]
          },
          {
            "id": "metadata/signed/platform::web-extension-manifest",
            "conf": 1.0,
            "crit": 1,
            "desc": "Web-extension manifest.json at archive root"
          },
          {
            "id": "metadata/permission/manifest::chrome-theme-image-asset",
            "conf": 0.9599999785423279,
            "crit": 1,
            "desc": "Chrome theme image asset"
          }
        ]
      },
      {
        "ctx": [
          {
            "b": "DJ",
            "n": [
              {
                "c": 2,
                "d": "JSON data format",
                "i": "metadata/file/format::valid",
                "o": 0,
                "z": 13,
                "cf": 0.6000000238418579
              }
            ],
            "ln": 1,
            "addr": 0
          },
          {
            "b": "b6v\u003cnvru6/B-IpxiV]RWBAzFyiXJc@y?WD#BAoh\u0026xk.Z3y?kkez/4dGwPz%dv}vroAaAy0wIL]GA^e=V",
            "ln": 2,
            "addr": 2
          },
          {
            "b": "b5Q?awG\u003ceVp\u003c3!$y?j-3z/PG4Bs?uvePbGGaA}mgy\u0026A*4wPw$Cb6EKrB7]Mgb03]5e?!F2b4Lnav@=p5BzkVhb03]AB-ICqwGUP6A+w%9eP25JzF%SrayPq4aAIydy?$kay\u0026sJeA=S=OC4CYtaAhvtze0)0zGE1Bx([2hvixh]zGGYaayPd#ay/7[A=2JdxcqeoA=t\u0026aay/taz/NDOefX}tzFrY]B97=jwPz\u003caz/c:WgB%.(xK#3(b075{x(do\u003ewPG4RDM)MBwO(0=w].r%wG\u003ceVx(do\u003ewPI9fBzbl5wNx4\u0026vqPNdAbGqjefYgHwO(0=Bz(8lvQTp3iWeoPvp%d)tRyhjwO(0=Bz(8lvQTpfAbGqjefYgHwO(0=BywS=vQS+Zxl4{kzE:}Lb57[5xjVc?fly(szdN6@vpAOMvpK7=A=l8rwg??sxcF(JBzbl5wNxs%A9)6.v@2Z$z/]@db03]Zzdd6*B6HwuxK#3(uV6$8uT^CNyIdWaB-7.xAbGqjEjMNLz!%ujB0rU(b4+\u003e7zdK[Ltqwh\u0026hz)3xgHhKQBz(8lvQTp3i:ju{g+pyoh7QExi9!6VBywS=By/Ysb05{-iv)6CehPd*efYgAvQAOMv@2Z$z/]@duVY\u003e7BrS+IgbpWqgb7Npf/.j0efXLwz!\u003ch#A+/37wQ5qvi:jv1eh/vpg=5z*b5RHwuT^CNyIdWaB-7.li:ju%h7QHuh7QHuhc?:SzGG\u00268By/Ysb05{=fF27nehYa!efX$NA9)A}zFHBStq!2\u0026h7QEphEd\u003cTvS=^mz/e]\u003evpK7=A=l8rwfK6sfF1[efF1[-EjMN:x(n3lb075{vS=^mz/fRui:jo\u003cg+pskgDl{te?]s\u003eEjMNYA=k]dA==2bB0rU(b5RHwuT^CNyIdWaB-7.%vqGT\u003czF-%5BrS:\u0026vScvgz/3WHb5RHwuT^CNyIdWaB-7.%A+fi3vrrXOb5RrJA+fi3vrrYwEsh",
            "ln": 3,
            "addr": 67
          }
        ],
        "depth": 1,
        "facts": {
          "metrics": {
            "file": {
              "size": 845.0,
              "entropy": 5.03,
              "size_bytes": 845.0
            },
            "json": {
              "parsed_bytes": 845.0,
              "parse_limit_bytes": 76800.0
            },
            "binary": {
              "overall_entropy": 5.03,
              "peak_region_bytes": 845.0,
              "peak_region_entropy": 5.03
            }
          }
        },
        "id": 1,
        "path": "/data/samples/unknown/foraged/chrome/google.com/chromewebstore.google.com/cebjegcbeonnjlllggekaaceficcbjop/cebjegcbeonnjlllggekaaceficcbjop.crx!!manifest.json",
        "risk": 1,
        "sha": "3080a813d0f253e90122c1b5eaf57dafb26d1fce19d74ad8068c182aff57dc94",
        "size": 845,
        "traits": [
          {
            "id": "metadata/package/manifest/ecosystem::conda-about-description-field",
            "conf": 0.9200000166893005,
            "crit": 1,
            "desc": "Conda about long description",
            "spans": [
              [
                123,
                96
              ]
            ]
          },
          {
            "id": "metadata/file/extension/identity::web-asset-extension",
            "conf": 1.0,
            "crit": 1,
            "desc": "Web asset file extension (css/html/js/json)",
            "spans": [
              [
                0,
                13
              ]
            ]
          },
          {
            "id": "metadata/file/format::valid",
            "conf": 0.6000000238418579,
            "crit": 2,
            "desc": "JSON data format",
            "spans": [
              [
                0,
                13
              ]
            ]
          }
        ],
        "type": "json"
      },
      {
        "ctx": [
          {
            "b": "Ibl@q4gj0X0000dnK#lE0000k000mO2M:#a071lPFDbVI32\u0026BrA@VgI.#G=E.#VbN4JtxF0E4a6k#-90)AlTN05aVUU\u003e5[Yao?Y",
            "n": [
              {
                "c": 1,
                "d": "PNG image file extension",
                "i": "metadata/package/files/included::png-extension-basename",
                "o": 0,
                "z": 15,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 0
          }
        ],
        "depth": 1,
        "facts": {
          "metrics": {
            "png": {
              "a_entropy": 0.0,
              "chunk_count": 4.0,
              "trailing_bytes": 0.0,
              "idat_chunk_count": 1.0,
              "text_chunk_bytes": 0.0,
              "chunks_after_iend": 0.0,
              "compression_ratio": 0.0,
              "unknown_chunk_count": 0.0
            },
            "file": {
              "size": 453.0,
              "entropy": 3.33,
              "size_bytes": 453.0
            },
            "image": {
              "width": 20.0,
              "height": 1920.0,
              "channels": 3.0,
              "b_entropy": 0.0,
              "g_entropy": 0.0,
              "r_entropy": 0.0,
              "edge_density": 0.0,
              "pixel_entropy": 1.58,
              "histogram_flatness": 0.2
            },
            "binary": {
              "overall_entropy": 3.33,
              "peak_region_bytes": 453.0,
              "peak_region_entropy": 3.33
            }
          }
        },
        "id": 2,
        "path": "/data/samples/unknown/foraged/chrome/google.com/chromewebstore.google.com/cebjegcbeonnjlllggekaaceficcbjop/cebjegcbeonnjlllggekaaceficcbjop.crx!!images/theme_frame.png",
        "pid": 0,
        "sha": "8933a1a19bc97b1d0b1011934ff43c6db4812e82c02acd43bb4aa78a6062d404",
        "size": 453,
        "traits": [
          {
            "id": "metadata/package/files/included::png-extension-basename",
            "conf": 0.8999999761581421,
            "crit": 1,
            "desc": "PNG image file extension",
            "spans": [
              [
                0,
                15
              ]
            ]
          }
        ],
        "type": "png"
      },
      {
        "ctx": [
          {
            "b": "Ibl@q4gj0X0000dnK#lE000gE0006O2M:#a0jfUe)/is/ay^@uo-Lftcia3@GA82G0001H\u003eL$",
            "n": [
              {
                "c": 3,
                "d": "LSB stego pattern (RGB high + low-edge + entropy)",
                "i": "objectives/anti-static/obfuscation/steganography/image::lsb-steganography-rgb-pattern",
                "o": 0,
                "z": 22,
                "cf": 0.800000011920929
              }
            ],
            "ln": 0
          }
        ],
        "depth": 1,
        "facts": {
          "metrics": {
            "png": {
              "a_entropy": 0.0,
              "chunk_count": 29.0,
              "trailing_bytes": 0.0,
              "idat_chunk_count": 20.0,
              "text_chunk_bytes": 114.0,
              "chunks_after_iend": 0.0,
              "compression_ratio": 0.27,
              "unknown_chunk_count": 0.0
            },
            "file": {
              "size": 634507.0,
              "entropy": 7.99,
              "size_bytes": 634507.0
            },
            "image": {
              "width": 1400.0,
              "height": 560.0,
              "channels": 3.0,
              "b_entropy": 7.19,
              "g_entropy": 7.08,
              "r_entropy": 7.21,
              "edge_density": 0.0,
              "pixel_entropy": 7.56,
              "histogram_flatness": 0.95
            },
            "binary": {
              "overall_entropy": 7.99,
              "peak_region_bytes": 634507.0,
              "peak_region_entropy": 7.84
            }
          }
        },
        "id": 3,
        "mol": "O(As)",
        "path": "/data/samples/unknown/foraged/chrome/google.com/chromewebstore.google.com/cebjegcbeonnjlllggekaaceficcbjop/cebjegcbeonnjlllggekaaceficcbjop.crx!!images/theme_ntp_background.png",
        "risk": 1,
        "sha": "62c0391c3d037f08c5849fe237b721531cf23b31712ce34ab600d19fe75832e8",
        "size": 634507,
        "traits": [
          {
            "id": "metadata/image/metrics::low-edge-density",
            "conf": 0.6499999761581421,
            "crit": 1,
            "desc": "Low image edge density metric",
            "spans": [
              [
                0,
                25
              ]
            ]
          },
          {
            "id": "objectives/anti-static/obfuscation/steganography/image::r-channel-high",
            "atk": "T1027.003",
            "mbc": "B0032.001",
            "conf": 0.6000000238418579,
            "crit": 1,
            "desc": "Red channel entropy above normal",
            "spans": [
              [
                0,
                22
              ]
            ]
          },
          {
            "id": "objectives/anti-static/obfuscation/steganography/image::high-pixel-entropy",
            "atk": "T1027.003",
            "mbc": "B0032.001",
            "conf": 0.699999988079071,
            "crit": 1,
            "desc": "Image pixel entropy in steganographic range",
            "spans": [
              [
                0,
                26
              ]
            ]
          },
          {
            "id": "objectives/anti-static/obfuscation/steganography/image::b-channel-high",
            "atk": "T1027.003",
            "mbc": "B0032.001",
            "conf": 0.6000000238418579,
            "crit": 1,
            "desc": "Blue channel entropy above normal",
            "spans": [
              [
                0,
                22
              ]
            ]
          },
          {
            "id": "objectives/anti-static/obfuscation/steganography/image::g-channel-high",
            "atk": "T1027.003",
            "mbc": "B0032.001",
            "conf": 0.6000000238418579,
            "crit": 1,
            "desc": "Green channel entropy above normal",
            "spans": [
              [
                0,
                22
              ]
            ]
          },
          {
            "id": "objectives/anti-static/obfuscation/steganography/image::lsb-steganography-rgb-pattern",
            "atk": "T1027.003",
            "mbc": "B0032.001",
            "conf": 0.800000011920929,
            "crit": 3,
            "desc": "LSB stego pattern (RGB high + low-edge + entropy)",
            "spans": [
              [
                0,
                22
              ]
            ]
          }
        ],
        "type": "png"
      },
      {
        "ctx": [
          {
            "b": "Ibl@q4gj0X0000dnK#lE0000k0001z2M:#a0dAV(DJj3C32\u0026BrA@VgI.#G=E.#VbN4JtxF05^zpk#Z%u)AlTN05aVUU\u003e9@\u0026d:W810N6Qw*4z/M",
            "n": [
              {
                "c": 1,
                "d": "PNG image file extension",
                "i": "metadata/package/files/included::png-extension-basename",
                "o": 0,
                "z": 24,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 0
          }
        ],
        "depth": 1,
        "facts": {
          "metrics": {
            "png": {
              "a_entropy": 0.0,
              "chunk_count": 4.0,
              "trailing_bytes": 0.0,
              "idat_chunk_count": 1.0,
              "text_chunk_bytes": 0.0,
              "chunks_after_iend": 0.0,
              "compression_ratio": 0.02,
              "unknown_chunk_count": 0.0
            },
            "file": {
              "size": 132.0,
              "entropy": 5.28,
              "size_bytes": 132.0
            },
            "image": {
              "width": 20.0,
              "height": 120.0,
              "channels": 3.0,
              "b_entropy": 0.0,
              "g_entropy": 0.0,
              "r_entropy": 0.0,
              "edge_density": 0.0,
              "pixel_entropy": 1.58,
              "histogram_flatness": 0.2
            },
            "binary": {
              "overall_entropy": 5.28,
              "peak_region_bytes": 132.0,
              "peak_region_entropy": 5.28
            }
          }
        },
        "id": 4,
        "path": "/data/samples/unknown/foraged/chrome/google.com/chromewebstore.google.com/cebjegcbeonnjlllggekaaceficcbjop/cebjegcbeonnjlllggekaaceficcbjop.crx!!images/theme_tab_background.png",
        "pid": 0,
        "sha": "c1c92de308b344864d7ffc946340b4120595909e026df0a5eeff2fde8db2df3d",
        "size": 132,
        "traits": [
          {
            "id": "metadata/package/files/included::png-extension-basename",
            "conf": 0.8999999761581421,
            "crit": 1,
            "desc": "PNG image file extension",
            "spans": [
              [
                0,
                24
              ]
            ]
          }
        ],
        "type": "png"
      },
      {
        "id": 5,
        "sha": "709ed5ed365b8bbabcac96c4367a9adb31149c0a2ab42311f4f9975eaee6f612",
        "path": "/data/samples/unknown/foraged/chrome/google.com/chromewebstore.google.com/cebjegcbeonnjlllggekaaceficcbjop/cebjegcbeonnjlllggekaaceficcbjop.crx!!images/theme_toolbar.png",
        "size": 133,
        "type": "png",
        "depth": 1
      },
      {
        "ctx": [
          {
            "b": "tydM8wPIv4x(Ffdz/c:Wb6m\u003cpwOtH[xDRn9AV!$dy?j!wb6dEhzE)u=v@DmbwO#Pli^S5\u0026vr(WcvpQMyb4V3(ygn}QfJ}KnfJZ8z",
            "n": [
              {
                "c": 2,
                "d": "JSON data format",
                "i": "metadata/file/format::valid",
                "o": 0,
                "z": 22,
                "cf": 0.6000000238418579
              }
            ],
            "ln": 0
          }
        ],
        "depth": 1,
        "facts": {
          "metrics": {
            "file": {
              "size": 1821.0,
              "entropy": 5.98,
              "size_bytes": 1821.0
            },
            "json": {
              "parsed_bytes": 1821.0,
              "parse_limit_bytes": 76800.0
            },
            "binary": {
              "overall_entropy": 5.98,
              "peak_region_bytes": 1821.0,
              "peak_region_entropy": 6.02
            }
          }
        },
        "id": 6,
        "path": "/data/samples/unknown/foraged/chrome/google.com/chromewebstore.google.com/cebjegcbeonnjlllggekaaceficcbjop/cebjegcbeonnjlllggekaaceficcbjop.crx!!_metadata/verified_contents.json",
        "risk": 1,
        "sha": "eb53553bb0646821ab50a68a359cfd18222d0bed1a50d175e69e2e085204ebe3",
        "size": 1821,
        "traits": [
          {
            "id": "metadata/file/extension/identity::web-asset-extension",
            "conf": 1.0,
            "crit": 1,
            "desc": "Web asset file extension (css/html/js/json)",
            "spans": [
              [
                0,
                22
              ]
            ]
          },
          {
            "id": "metadata/file/format::valid",
            "conf": 0.6000000238418579,
            "crit": 2,
            "desc": "JSON data format",
            "spans": [
              [
                0,
                22
              ]
            ]
          }
        ],
        "type": "json"
      }
    ],
    "omitted_files": 1,
    "rev": "bef57",
    "v": "8"
  }
}