{ "ml": { "v": "7", "eng": "2.2.0-beta.1", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.01891014, "rte": "az", "prob": 0.01891014 }, { "cls": 0, "raw": 0.03885786, "rte": "az/zip", "prob": 0.03885786 } ], "prob": 0.02688694, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.026886940002441406, "type": "zip" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.026886940002441406, "type": "github-actions" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.004034489393234253, "type": "text" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.0006021857261657715, "type": "go" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.00042504072189331055, "type": "go" }, { "id": 5, "lvl": -1, "conf": 0, "prob": 0.00019922852516174316, "type": "go" }, { "id": 6, "lvl": -1, "conf": 0, "prob": 0.0028411149978637695, "type": "go" }, { "id": 7, "lvl": -1, "conf": 0, "prob": 0.00006663799285888672, "type": "png" }, { "id": 8, "lvl": -1, "conf": 0, "prob": 0.026886940002441406, "type": "png" }, { "id": 9, "lvl": -1, "conf": 0, "prob": 0.026886940002441406, "type": "png" }, { "id": 10, "lvl": -1, "conf": 0, "prob": 0.026886940002441406, "type": "png" }, { "id": 11, "lvl": -1, "conf": 0, "prob": 0.026886940002441406, "type": "png" }, { "id": 12, "lvl": -1, "conf": 0, "prob": 0.0028169751167297363, "type": "go" }, { "id": 13, "lvl": -1, "conf": 0, "prob": 0.0007227063179016113, "type": "markdown" }, { "id": 14, "lvl": -1, "conf": 0, "prob": 0.0004137754440307617, "type": "text" } ], "version": "v18.18", "analyzed_at": "2026-07-04T11:15:20Z" }, "path": "github.com-kaleidora-dnsub-scanning-tool-v0.0.0-20260704073120-c834feb38744.zip", "raw": { "files": [ { "id": 0, "ctx": [ { "b": "p!H([6Awys2MK\u00268000000000000000003va003UCBzb/ae[n*pfkC0jwOCW[A:ZRizGx@fePUAgzF\u003cfaxdXjzz!}WZfFk4ifFb4lgbZ*BfF\u003eExgCHTseN{:@g?HrdgDmrIg+QE]x([1", "n": [ { "c": 2, "d": "Zip archive path", "i": "metadata/package/files/included::zip-archive-path", "o": 0, "z": 79, "cf": 0.949999988079071 } ], "ln": 0 } ], "mol": "H₂(Cm₄Po₃)Md₂(Bk)", "sha": "d058e903f993f8a4677d9a233286517375fffdf3e4c48f1c6df250697497a275", "path": "github.com-kaleidora-dnsub-scanning-tool-v0.0.0-20260704073120-c834feb38744.zip", "risk": 5, "size": 1711172, "type": "zip", "facts": { "metrics": { "file": { "size": 1711172.0, "entropy": 8.0, "size_bytes": 1711172.0 }, "binary": { "overall_entropy": 8.0, "peak_region_bytes": 1707008.0, "peak_region_entropy": 7.86 }, "archive": { "file_count": 19.0, "member_count": 19.0, "script_count": 0.0, "zip_bomb_ratio": 28.86, "directory_count": 0.0, "executable_count": 0.0, "extra_field_size": 0.0, "noise_file_count": 3.0, "total_compressed": 1705872.0, "compression.ratio": 0.89, "hidden_file_count": 5.0, "total_uncompressed": 1907612.0, "crc_collision_count": 0.0, "entry_comment_count": 0.0, "max_filename_length": 107.0, "rtlo_filename_count": 0.0, "format.regular_count": 19.0, "nested_archive_count": 0.0, "path_traversal_count": 0.0, "symlink_escape_count": 0.0, "security.setgid_count": 0.0, "security.setuid_count": 0.0, "security.sticky_count": 0.0, "double_extension_count": 0.0, "duplicate_member_count": 0.0, "security.symlink_count": 0.0, "unicode_filename_count": 0.0, "homoglyph_filename_count": 0.0, "security.encrypted_count": 0.0, "misplaced_executable_count": 0.0, "timing.mtime_dominant_count": 19.0, "timing.sentinel_mtime_count": 19.0, "security.world_writable_count": 0.0, "timing.mtime_dominant_fraction": 1.0, "compression.method_counts.deflate": 19.0 } } }, "traits": [ { "id": "micro-behaviors/communications/http/lib/netlib::go-http-newrequest", "atk": "T1071.001", "mbc": "C0002", "conf": 0.8999999761581421, "crit": 3, "desc": "Creates a new HTTP request", "from": [ { "file": 6 } ] }, { "id": "micro-behaviors/process/create/shell/lang::invoke-prefix", "conf": 0.699999988079071, "crit": 3, "desc": "Invoke- prefix for cmdlets", "from": [ { "file": 12 } ] }, { "id": "metadata/build/github-actions::github-push-action", "conf": 0.8999999761581421, "crit": 3, "desc": "GitHub push action step", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/http/headers::go-user-agent-set", "atk": "T1071.001", "conf": 0.800000011920929, "crit": 3, "desc": "Sets HTTP User-Agent header", "from": [ { "file": 6 } ] }, { "id": "metadata/build/github-actions::mutable-master-action-ref", "conf": 0.8799999952316284, "crit": 3, "desc": "Workflow action pinned to master", "from": [ { "file": 1 } ] }, { "id": "metadata/build/github-actions::scheduled-workflow-trigger", "conf": 0.8999999761581421, "crit": 3, "desc": "GitHub scheduled workflow trigger" }, { "id": "micro-behaviors/communications/socket/ssl::insecure-skip-verify", "conf": 0.800000011920929, "crit": 3, "desc": "InsecureSkipVerify (Go)", "from": [ { "file": 6 } ] }, { "id": "micro-behaviors/communications/http/lib/netlib::net-http-import", "atk": "T1071.001", "mbc": "C0002", "crit": 3, "desc": "net/http package import", "from": [ { "file": 6 } ] }, { "id": "micro-behaviors/process/create/shell/spawn::go-powershell-command-flag", "atk": "T1059", "conf": 0.699999988079071, "crit": 1, "desc": "PowerShell -Command flag as Go string", "from": [ { "file": 12 } ] }, { "id": "micro-behaviors/process/create/direct::exec-command", "atk": "T1059.003", "conf": 0.949999988079071, "crit": 3, "desc": "Go exec.Command call", "from": [ { "file": 12 } ] }, { "id": "metadata/file/profile/language::script-han", "conf": 0.800000011920929, "crit": 3, "desc": "CJK Han ideograph sequence", "from": [ { "file": 3 } ], "spans": [ [ 1, 21 ], [ 57, 18 ], [ 140, 9 ], [ 684, 24 ], [ 1755, 12 ], [ 2317, 12 ] ] }, { "id": "micro-behaviors/communications/http/user-agent::go-user-agent-header-set", "atk": "T1071.001", "mbc": "C0002", "conf": 0.8999999761581421, "crit": 3, "desc": "Sets HTTP User-Agent header", "from": [ { "file": 6 } ] }, { "id": "micro-behaviors/process/create/shell/spawn::go-windows-powershell-dispatch", "atk": "T1059", "conf": 0.8500000238418579, "crit": 3, "desc": "Go dispatches command via PowerShell", "from": [ { "off": 53, "file": 12, "line": 8 } ] }, { "id": "micro-behaviors/process/create/shell/lang::powershell-keyword", "conf": 0.699999988079071, "crit": 3, "desc": "powershell keyword", "from": [ { "file": 12 } ] } ] }, { "analysis_gaps": [ "embedded-source-incomplete" ], "ctx": [ { "b": "zEEx[iV}vyvr8!:4gm2\u003eiT(A93lQEgB-RjS4gjj2arUclvqYN*wPG)w3lQDlarR^Uaz\u003eL3zvD{}arR^HapOV2aAI4awN]}1wJyncarSlUv@=H9iV]Q@asXG-asXG-a}j\u003e*3tKG*B2\u003c:qarU9nBz\u003eI@z/6u9Buf\u003crarR^HA=(nvePkI/aA.dozGH1My*?A%B94\u0026#arR^HB97#jB2\u003c:qarR^HarSlUB-RbniV}\u003cvBzkVhB1.3pwN/H]B-Y((gyTWlarR^HarR!Jx([2H4gjj2arR^HarR!CwPz\u003caB960zA+e=)zGGP3y\u0026.SWw)]H%wEO$?arR^HarR^Hw[u6]xF0+aAcb+Oatsli4gjj2arR^HeG!}tzdL:Jo(BMRw{CInvrlJkB-p(1By+)*arR^HarR^HA=(mXaBBR9arR^HarR^HarUhTcQZm1miA%=wmoN\u003easwV=sUg}peHs{Ib$H6yo/:O0cTWw\u003carR^HarR^HarUl9xM21swfs5UoIXd/3lQDlarR^HarR^o3lQDlarR^Uaz$R8wJy@3z/6u9BrC7bvqYZ?A$5E0arR^HarR!EB-6k.D(@\u003e9arR^HarR^HarUrhBrC7izF0P}at2fYz!0i(aA.:pAXp{uvqfK2b58adxLq0*i5r*uvqPE\u0026wPxzzBS}n4arR^HarR^HarUrhBrC7izF0P}at2fYz!0i(aA.:pAXqlrzdK?lbZT\u003eXxk8E3BZ=$zwPhNex([olD0+GlzE)\u0026hEsipG3lQDlarR^HarR!tx(\u003eFawmM/mk[aezarR^HarR^HapOV2arR^HarR^HayPqhtqftCb1$^5a}j(4arR^HarR^HayPqhtqozDb1$^5a}j(4arR^HarR^HayPqhtqxFEb1$^5a}j(4arR^HarR^HayPqhtqGLFb1$^5a}j(4arR^HarR^HayPqhtqPRGb1$^5a}j(4arR^HarR^HayPqhtqYXHb1$^5a}j(4arR^HarR^HayPqhtq/+Ib1$^5a}j(4arR^HarR^HayPqhtq]?Jb1$^5a}j(4arR^HarR^HayPqhtr2[Kb1$^5a}j(4arR^HarR^HayPqhtrb$Lb1$^5a}j(4arR^HarR^HapOV2arR^HarR^HaAy[dwizhxbVl{6l@cJ1b{jEWbvLRktr(Fxt[4b-arR^HarR^HapOV2arR^HarR^Hazkzgay/tbze18meO#QObZS%uA:6/fvqYQYEiGacarR^HarR^HarRa2arR^HarSlUzEEx[iV{}bBvZK-aw^i4xBLp\u003earR^HarR!HB7GzNayO!jz7/KoBzb/aePt\u0026NxF0U5BzkVhkY6}JBy/F43lQDlarR^HaA}KwxGuOfarR^HarR^HarUomA:@VwaARTDwEO$?arR^HarR^Hay]hbwN/?2A^oX*a$+5G3lQDlarR^HarR!tx([3hvQBj}yH}xAas8qXaAIa7A+fule\u003enGjnl4#-r8ldQp9s$k", "ln": 0, "col": 1, "line": 1 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 1180, "entropy": 4.37 }, "binary": { "peak_region_bytes": 1180, "peak_region_entropy": 4.39 } } }, "id": 1, "mol": "H₂(F₂Po₂)Md(Bk₄)", "path": "github.com-kaleidora-dnsub-scanning-tool-v0.0.0-20260704073120-c834feb38744.zip!!github.com/kaleidora/dnsub-scanning-tool@v0.0.0-20260704073120-c834feb38744/.github/workflows/main.yml", "pid": 0, "refs": [ { "to": "pkg:github/actions/checkout@v3", "off": 182, "kind": "dependency" }, { "to": "pkg:github/ad-m/github-push-action@master", "off": 1033, "kind": "dependency" } ], "risk": 4, "sha": "6a381f89de913d2686f043e9752adec3edc9e7208632a714db9b6c73dd72358d", "size": 1180, "traits": [ { "id": "metadata/build/ci/github-actions::repository-github-script-path", "conf": 0.95, "crit": 3, "desc": "Shell path under .github or actions", "from": [ { "file": 3 } ] }, { "id": "metadata/build/ci/github-actions::workflow-definition-path", "conf": 0.99, "crit": 3, "desc": "GitHub Actions workflow definition path" }, { "id": "metadata/build/ci/secret::action-secret-input", "conf": 0.95, "crit": 3, "desc": "Action input references workflow secret" }, { "id": "metadata/build/ci/secret::github-token-secret", "conf": 0.88, "crit": 3, "desc": "References Actions-provided GITHUB_TOKEN", "spans": [ [ 1157, 20 ] ] }, { "id": "metadata/build/ci/step::actions-checkout-step", "conf": 0.9, "crit": 3, "desc": "actions/checkout workflow step reference", "spans": [ [ 176, 25 ] ] }, { "id": "metadata/build/ci/step::github-push-action", "conf": 0.9, "crit": 3, "desc": "GitHub push action step" }, { "id": "metadata/build/ci/step::mutable-master-action-ref", "conf": 0.88, "crit": 3, "desc": "Workflow action uses mutable master ref" }, { "id": "metadata/build/ci/step::mutable-version-action-ref", "conf": 0.9, "crit": 3, "desc": "Workflow action uses mutable version tag" }, { "id": "metadata/build/ci/step::workflow-step-force-true", "conf": 0.9, "crit": 3, "desc": "Workflow step sets force input true" }, { "id": "metadata/build/ci/trigger::every-minute-workflow-schedule", "conf": 0.93, "crit": 3, "desc": "Workflow schedule runs every minute" }, { "id": "metadata/build/ci/trigger::scheduled-workflow-trigger", "conf": 0.9, "crit": 3, "desc": "GitHub scheduled workflow trigger" }, { "id": "metadata/build/ci/trigger::workflow-push-trigger", "conf": 0.9, "crit": 3, "desc": "GitHub Actions push workflow trigger", "spans": [ [ 14, 13 ] ] }, { "id": "micro-behaviors/fs/write/content::file-write-capability", "conf": 0.9, "crit": 3, "desc": "File content write capability", "from": [ { "file": 3 } ], "uses": [ 13, 14 ] }, { "id": "micro-behaviors/fs/write/file/redirect::shell-echo-file-write", "conf": 0.86, "crit": 3, "desc": "Shell echo redirects output to file", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/fs/write/file/redirect::shell-file-write-command", "conf": 0.86, "crit": 3, "desc": "Shell command writes output to a file", "from": [ { "file": 3 } ], "uses": [ 13 ] }, { "id": "micro-behaviors/process/create/shell/spawn::backtick-command-substitution", "conf": 1.0, "crit": 3, "desc": "Backtick shell command-substitution syntax", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/process/create/vcs/git::git-stage-all-script-command", "conf": 0.92, "crit": 3, "desc": "Script stages all Git changes", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/process/create/vcs/git::shell-git-commit", "atk": "T1059.004", "conf": 0.92, "crit": 3, "desc": "Commits changes to a Git repository", "from": [ { "file": 4 } ] }, { "id": "metadata/lang/natural/vocabulary/content-word::data-transfer-verb-token", "conf": 0.88, "crit": 1, "desc": "Data-transfer verb token", "spans": [ [ 23, 0 ] ] }, { "id": "metadata/lang/natural/vocabulary/content-word::english-edit-verb-token", "conf": 0.88, "crit": 1, "desc": "English edit-action verb token", "spans": [ [ 953, 0 ] ] }, { "id": "metadata/lang/natural/vocabulary/content-word::secret-data-term-token", "conf": 0.9, "crit": 1, "desc": "Secret-data term token", "spans": [ [ 1139, 0 ] ] }, { "id": "metadata/lang/natural/vocabulary/content-word::sensitive-target-term-token", "conf": 0.88, "crit": 1, "desc": "Secret, security, or environment terminology", "uses": [ 20 ], "spans": [ [ 1157, 0 ] ] } ], "type": "github_actions" }, { "ctx": [ { "b": "o?wqboLF0FzGxv@3lQDlavy6^D2^RixMLvBv\u003c@JQfFUEcq/#.YA-d43xBk7?arR!6wPzT4B8#5lzxJUmazttbwNY{cxl4A#By!#lazbU9wGU]6ay/7[A+w@maARJAvqZukAaK6hz/cXovSV3)zFs03ayMy5z/x$earR^Hz!pblxLzJgB8LVjCvtJ6ayPd#ayPtjz!0G\u0026By!#9wn+$2zdNQbvruj4zxJL9y?mVgd0fclar\u003c:5w]@l9A+cBzefG4May]4(yZIpcarUxoaARpdax9h\u003cBA.elwGVhhBzbPnBrCQnB98Cpv@#B6zy=]AzEWH9wnb{]aA}KwxM53naz++ex()^9x(v(iBzbkdA+Pf1BAm^iarR!GzY\u003cgzwH[%lz/x$Maz(4cx\u003ezSwaz\u003eXgxjSRpAckSax(^@say]hcBAh88B-.gCaAIWmy?Wx\u003czGxwuayPd#fk\u003e\u003eNB7Gf73lQDlay/tex\u003equdz!pblxK@q+z!s9nvrb{gayPd#aARJAAaK6bx(\u003eFpwPz\u003cgzGu}xzY\u003cmqz/3RsxK@q+z!s9nvrb{4x(:R7arR!sB-IwlB7/b}aARJAwn-Piz.92LBZ/8%v@@\u0026nzY\u003cdnwGUP6y\u002613lx(mMav@Dl}x([6czGv\u0026C3lQDlaxi2=ayO.$C4z!az/x#xx\u003eIa3az#atx\u003e7Y%vqYP#BzbxfaAg[jze16jx(v(izF%Shv}u^7xKLZ[ayX[8x(mA%B.25]azCZovqG-!arR^Hv@Ds2wPF#jAV/BCvSMT1zGGP3y-)XnA==2lzGu}sw/#hewGT]\u0026w]@l9A+c\u003cg3lQDlaxg)2ax869r98v-miCf2aw+%ir.kXFl)9WtqY[Uga$K\u003crnMnkRrA78xk#HPDpe\u003evspEVD)pfwYjnLRV8avPyeqBKI.awU(xarR^HnLJ2PnKV2#aw2r}oJsFLpdDA[rA78opGeDgnLI=Qmmnm$pASRcmiCU$qC]!Qr7PISawUDHo*}@Eni{0Ik%!dpnMn?z3lQDlavX}4pdn8WavYd8avdbDk#HVNlSD/CqxO!oqCZd/miB(\u003el)bl2pdXhIqB%RNmnliCr4Yp+p9rqcavPs1pe\u0026umni]{yaxg)23lQDlavf1bnkAbZawU(TlR*JYqB%wHr3j.coHIrEqY[y}awtu)lqf/\u003cmO=]8k#7M9lRG^qo!mzPk$%Tnmn\u003es8qxO+mnjuz-arR^HoI4JpnLzYPsU7W%njuGGmn+m1p9q?$avev]nL-87pEVD]pFK\u003e!k%[Q5axhcmr3j$mawU%cmn^hUq:\u0026kWk#HoMnLR+#mP92Red9HxarTDWr3j$aawU(TnLQx}pFKUNlSuSMp9rRfr7FchnjsU1pEXq+k#Hb]pF@rmnjsU3q:?*8qxO+mnjuA0l}6ynnLR=Oaw2rJr7GB+arR^Hq+]\u003eZs3Y.Me=", "ln": 0, "col": 1, "line": 1 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 1129, "entropy": 4.96 }, "binary": { "peak_region_bytes": 1024, "peak_region_entropy": 4.96 } } }, "id": 2, "path": "github.com-kaleidora-dnsub-scanning-tool-v0.0.0-20260704073120-c834feb38744.zip!!github.com/kaleidora/dnsub-scanning-tool@v0.0.0-20260704073120-c834feb38744/LICENSE", "pid": 0, "risk": 1, "sha": "db39eae449f5ce1235300fe9c475152af9ecea8d575104540f3403e78d657ad3", "size": 1129, "supp": [ { "by": [ { "id": "path" } ], "id": "well-known/tool/development/vcs/github-web::github-repo-fetched-path", "crit": "notable", "kind": "unless" } ], "traits": [ { "id": "metadata/lang/natural::lang-english", "conf": 0.8, "crit": 2, "desc": "Contains common English function words", "uses": [ 3, 4, 5, 6, 7 ], "spans": [ [ 185, 0 ] ] }, { "id": "metadata/package/license::mit-license-grant-text", "conf": 0.9, "crit": 2, "desc": "MIT license permission grant sentence", "spans": [ [ 51, 0 ] ] }, { "id": "metadata/permission/prose::permission-permission-term-english", "conf": 0.9, "crit": 2, "desc": "Permission or access term", "spans": [ [ 51, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"", "spans": [ [ 185, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-2", "conf": 0.8, "crit": 1, "desc": "English function-word token \"and\"", "spans": [ [ 149, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "spans": [ [ 809, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-6", "conf": 0.8, "crit": 1, "desc": "English function-word token \"with\"", "spans": [ [ 1062, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-7", "conf": 0.8, "crit": 1, "desc": "English function-word token \"this\"", "spans": [ [ 135, 0 ] ] }, { "id": "micro-behaviors/data/llm/repository-directive::repository-edit-verb-token", "conf": 0.88, "crit": 1, "desc": "Repository-edit verb token", "spans": [ [ 317, 0 ] ] } ], "type": "text" }, { "analysis_gaps": [ "flow-graph-limited" ], "ctx": [ { "b": "Aa9l(vp%c]v@Dj3z/b)?x(d*cA=-AL3jd[/zEWP}x(mMpv@(/q3jd[*zfc%e2{K84a{[S2zddK1flgGswfIu!b5.JD3jd[}vrufb3jd[$BAh8kxlbm72{KCozET\u003c$2{KF9zdK)#dgcA9vr9Gbz!0MCB9RUke\u003e{FgwQ5MI3jpx/zET!im}D^uvqYQ]zbUK%x(mMiy-)CfBswtNBAh8kxcqKd33gieauzUdb4j}\u003cwmYv=xLzi%y\u0026a6dAb/]tBAI+JCZjPV3jgf!By/IoiZ1P\u0026u1e83wHIRwAW.t4A+frmy\u0026*^XjS)%mvTi6bDWMkcAV^zaaAy[dwg*R*CpmGuzE+v{wP}6\u003eB-H#6d0ffuwIc.@Cpj))rC(I}pgn3Uc[cO]3jgr.AV/6siZ1Ptj0nkWjrOD4azAtRaBsC4336P#B.(dxjS[fLAaJ]$c#@)uB.(dJayYRrwPI6@e\u003eG@5zyxsjzyw$tBy/Ixdp1wf34ic!A+funA=91vBAh8kxdd!iB9hqvdggFg3nj6@ZlvVlY5!W2\u003c/VddzSMXUv@(?QMwsLkWHcR?zET!+B-ZD5Bvga)c$WgfwO${[wGV5oA+PA7enn#Atu#q(A+PA7dshye32BJ\u0026yC5q0v@0Fw3jgS.B1y)yAYMv4B1QmcwO%$Ky?k2bx(4u#vqPNbz/WKbuS6o[qHAz7e(b?wqBJ(Jmso2{e(b?MsX.snfG7*Edgcy*x\u003ewG0A=Jr^zFr{l3jd2JzfdybA+PAkw*!\u003cwB-.OBBrCQnB9hqvazb4@y=S\u003e=tY7-pwPz/u3jd2VwPS6nzvcX#3jm8Tw]/OaA+PSbq/)4]zF7vwtZeXbtZeO4tZeO8a$jS/fi7$veJs7zwmYv:AV/pjB1P*@z/YFrdgcy*z!s5yq!oJQc[)h^z.s$1wOT.Lwgm\u0026)33OA[v@(/CpgXSJA+PSbAWU\u003crB14C633O0?z/6u1jTR^d3jg]erDz.sqCoLyBAhIn3jm8JA=Kr!e)07cBy=\u003emzyC]1329#]wPz/mj-j$IDKp5=w]hSxp\u0026Zn/By({Bz/{evB-X:DwPJ0gBrCg7x(2*RC3F]eem\u0026\u003cxdgcxf3jg]emR)i*xECqp32BJ\u0026yC5R8y\u0026r*0c[bHK3jnBt\u003c+P.{MAxqnHVD7Q\u003e9SvlKF.cwNb%\u003cp3taA#v\u003c1PRBza9/x(!xqc#-QpxDRwrA+PA7diH3Fz/oCyaz2Olz/NoHDKp6^efFIAAV^zaaA8rNq/(C\u0026c#-QpxEKn{x\u003ewG0A=Jo=jS[SRy-[6i2)\u003eS-BAIRwaARTDwH[%wx(1a.Ef{q/x\u003ewGaB1Q49ph+kyCXIkvc$NBtdiJ%A2)\u003eS-BAIRwazb4#B7D)BzFr[]34ic!A+funA=91ivqH0@efFIAATEj43jpx/zET!Rq=Vw4y?lvIzdMQRAa9E3c#-QpxL7%{wGV5oA+PA7diH3WBAh8kxdnfm3jglSAYMv5vrufnl${V\u0026Aa9\u003c4w[=6)dgcw[x(4u#vqPNpj-B?KxF8RWB7D+svruf{x(4uf3jgrUy?lK/w[C+4iZ4B\u003cBz9o}CYUuMvruf{x(4uf3jgrUy?mG)zdMHXy\u003cvc:jS[//A+PA7B1QBjx(c^\u003ew[C+4c$WgfwO${[wH[%ox(4uVB.kl1CQS$av@(*9x(4v1vrufzjZhikBAh8kxm1f6AX7*py?mG)zdMHXy\u003cvJPe[n%Cb7f!9336Q0B-IvxAa9\u003c4e\u003eQ4@zyx1oC4LD8wPh71xF7[\u0026dgcy?Ee", "ln": 0, "col": 1, "line": 1 } ], "depth": 1, "facts": { "imp": [ [ "", "rand.New" ], [ "", "rand.NewSource" ], [ "", "time.Now.UnixNano" ], [ "", "time.Now" ], [ "", "append" ], [ "", "r.Intn" ], [ "", "len" ], [ "", "string" ], [ "", "lock.Lock" ], [ "", "os.OpenFile" ], [ "", "fmt.Printf" ], [ "", "ofs.WriteString" ], [ "", "ofs.Close" ], [ "", "ofs.Seek" ], [ "", "csv.NewWriter" ], [ "", "w.Write" ], [ "", "fmt.Printf" ], [ "", "w.Flush" ], [ "", "lock.Unlock" ], [ "", "os.Stat" ], [ "", "os.IsNotExist" ], [ "", "path.Dir" ], [ "", "path.Base" ], [ "", "path.Ext" ], [ "", "strings.TrimSuffix" ], [ "", "path.Join" ], [ "", "encoding/csv" ], [ "", "fmt" ], [ "", "io" ], [ "", "math/rand" ], [ "", "os" ], [ "", "path" ], [ "", "strings" ], [ "", "sync" ], [ "", "time" ] ], "mbr": [ "csv.NewWriter", "fmt.Printf", "io.SeekEnd", "lock.Lock", "lock.Unlock", "ofs.Close", "ofs.Seek", "ofs.WriteString", "os.IsNotExist", "os.O_CREATE", "os.O_RDWR", "os.O_SYNC", "os.OpenFile", "os.Stat", "path.Base", "path.Dir", "path.Ext", "path.Join", "r.Intn", "rand.New", "rand.NewSource", "strings.TrimSuffix", "time.Now", "time.Now.UnixNano", "w.Comma", "w.Flush", "w.UseCRLF", "w.Write" ], "tgt": [ "append", "csv.NewWriter", "fmt.Printf", "len", "lock.Lock", "lock.Unlock", "ofs.Close", "ofs.Seek", "ofs.WriteString", "os.IsNotExist", "os.OpenFile", "os.Stat", "path.Base", "path.Dir", "path.Ext", "path.Join", "r.Intn", "rand.New", "rand.NewSource", "string", "strings.TrimSuffix", "time.Now", "time.Now.UnixNano", "w.Flush", "w.Write" ], "funcs": [ [ "GetRandomString", 134 ], [ "OutPutCsv", 442 ], [ "PathExists", 917 ], [ "CSVFileNameRepair", 1098 ] ], "metrics": { "ast": { "op.eq": 1, "op.lt": 1, "op.ne": 2, "op.add": 1, "op.bor": 2, "max_depth": 16, "call_count": 26, "node_count": 633, "member_count": 28, "op_density.eq": 0, "op_density.lt": 0, "op_density.ne": 0, "op_density.add": 0, "op_density.bor": 0, "max_array_length": 2, "max_concat_chain": 2, "max_member_depth": 3 }, "file": { "size": 1381, "entropy": 5.46 }, "text": { "lines": 83, "top_char": 101, "tab_count": 55, "digit_ratio": 0.01, "space_count": 66, "char_entropy": 5.46, "unique_chars": 100, "top_char_null": 0, "escape_density": 0.22, "import_density": 10.84, "string_density": 0.17, "top_char_ratio": 0.06, "avg_line_length": 15.65, "max_line_length": 68, "non_ascii_ratio": 0.03, "empty_line_ratio": 0.24, "hex_escape_count": 3, "last_line_length": 1, "whitespace_ratio": 0.15, "identifier_density": 1.55, "line_length_stddev": 16.66, "max_whitespace_run": 2, "normalized_import_count": 0.99, "normalized_string_count": 1.54, "normalized_function_count": 0.44, "imports_to_functions_ratio": 2.25, "strings_to_functions_ratio": 3.5, "suspicious_identifier_ratio": 0.06, "normalized_unique_identifiers": 10.67, "identifiers_to_functions_ratio": 17 }, "binary": { "peak_region_bytes": 1024, "peak_region_entropy": 5.54 }, "source": { "function_count": 4 }, "imports": { "count": 9, "stdlib_count": 9, "stdlib_ratio": 1 }, "strings": { "bytes": 127, "count": 14, "avg_length": 9.07, "max_length": 26, "avg_entropy": 2.5, "entropy_stddev": 1.06 }, "comments": { "chars": 55, "count": 3, "lines": 3, "to_code_ratio": 0.04 }, "functions": { "count": 4, "density": 4.82, "avg_params": 1.25, "code_ratio": 0.73, "max_params": 2, "length_stddev": 7.4, "avg_name_length": 12.75, "avg_length_lines": 15.25, "max_length_lines": 28, "min_length_lines": 10, "high_entropy_names": 2, "single_char_params": 1, "avg_param_name_length": 4.6 }, "identifiers": { "count": 129, "unique": 68, "avg_length": 5.53, "max_length": 17, "min_length": 1, "avg_entropy": 2.03, "reuse_ratio": 0.53, "length_stddev": 3.27, "sequential_names": 4, "single_char_count": 5, "single_char_ratio": 0.07, "high_entropy_count": 2, "high_entropy_ratio": 0.03, "all_lowercase_ratio": 0.49, "all_uppercase_ratio": 0.06, "underscore_prefix_count": 1 } } }, "id": 3, "mol": "H₃(DbFOs)Md(In₂)", "path": "github.com-kaleidora-dnsub-scanning-tool-v0.0.0-20260704073120-c834feb38744.zip!!github.com/kaleidora/dnsub-scanning-tool@v0.0.0-20260704073120-c834feb38744/common/common.go", "pid": 0, "risk": 4, "sha": "b3b0cf99b5197e6fbd1388d459a23812afe4839fa4b538db947d4be7cde5cfd0", "size": 1381, "traits": [ { "id": "metadata/import/go/encoding/csv::encoding/csv", "conf": 0.95, "crit": 3, "desc": "imports encoding/csv", "spans": [ [ 26, 12 ] ] }, { "id": "metadata/import/go/os::os", "conf": 0.95, "crit": 3, "desc": "imports os", "spans": [ [ 68, 2 ] ] }, { "id": "micro-behaviors/data/buffer/transfer::go-seek-call", "conf": 0.88, "crit": 3, "desc": "Go calls a Seek method", "spans": [ [ 704, 8 ] ] }, { "id": "micro-behaviors/data/buffer/transfer::go-write-method-call", "conf": 0.65, "crit": 3, "desc": "Go Write/WriteAt method call", "spans": [ [ 787, 7 ] ] }, { "id": "micro-behaviors/fs/file/open::os-openfile-create-flag", "conf": 0.9, "crit": 3, "desc": "os.OpenFile enables creation if absent", "spans": [ [ 511, 42 ] ] }, { "id": "micro-behaviors/fs/file/open::os-openfile-rdwr", "conf": 0.9, "crit": 3, "desc": "os.OpenFile with O_RDWR read-write flag", "spans": [ [ 511, 30 ] ] }, { "id": "micro-behaviors/os/random/prng/stdlib::go-intn-method-call", "conf": 0.85, "crit": 3, "desc": "Calls a bounded Go PRNG method", "spans": [ [ 363, 6 ] ] }, { "id": "micro-behaviors/os/random/prng/stdlib::go-new-source-call", "conf": 0.9, "crit": 3, "desc": "Constructs a seeded Go PRNG source", "spans": [ [ 266, 14 ] ] }, { "id": "metadata/import/go/fmt::fmt", "conf": 0.95, "crit": 2, "desc": "imports fmt", "spans": [ [ 42, 0 ] ] }, { "id": "metadata/import/go/io::io", "conf": 0.95, "crit": 2, "desc": "imports io", "spans": [ [ 49, 0 ] ] }, { "id": "metadata/import/go/math/rand::math/rand", "conf": 0.95, "crit": 2, "desc": "imports math/rand", "spans": [ [ 55, 0 ] ] }, { "id": "metadata/import/go/path::path", "conf": 0.95, "crit": 2, "desc": "imports path", "spans": [ [ 74, 0 ] ] }, { "id": "metadata/import/go/strings::strings", "conf": 0.95, "crit": 2, "desc": "imports strings", "spans": [ [ 82, 0 ] ] }, { "id": "metadata/import/go/sync::sync", "conf": 0.95, "crit": 2, "desc": "imports sync", "spans": [ [ 93, 0 ] ] }, { "id": "metadata/import/go/time::time", "conf": 0.95, "crit": 2, "desc": "imports time", "spans": [ [ 101, 0 ] ] }, { "id": "metadata/lang/natural/vocabulary/function-word::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "spans": [ [ 306, 0 ] ] } ], "type": "go" }, { "id": 4, "mol": "Md", "sha": "7b5bcb4731550eb80d2ef9811ca460b008904502cd2af286bfa6e5eb1aa07f67", "path": "github.com-kaleidora-dnsub-scanning-tool-v0.0.0-20260704073120-c834feb38744.zip!!github.com/kaleidora/dnsub-scanning-tool@v0.0.0-20260704073120-c834feb38744/common/queue.go", "risk": 1, "size": 983, "type": "go", "depth": 1 }, { "id": 5, "mol": "Md", "sha": "6b3ba354f370738d289205f752179254558b5bb6d2771ccc3407cddb7be072cb", "path": "github.com-kaleidora-dnsub-scanning-tool-v0.0.0-20260704073120-c834feb38744.zip!!github.com/kaleidora/dnsub-scanning-tool@v0.0.0-20260704073120-c834feb38744/core/dnstool.go", "risk": 1, "size": 2838, "type": "go", "depth": 1 }, { "analysis_gaps": [ "flow-graph-limited" ], "ctx": [ { "b": "Aa9l(vp%c]v@Dy03jpG:AbP=sasEN6b4CUsAcc1KBzM1x3jd[\u003cz.C*yB-.tla{[S2y\u0026r@g3jd[]wPPa62{Km#Bt4rHBz@Ah2{Kz3xjVsba{[S2B98CpzFa2m3jd[#x(dA93mMq?3uQMjwGTJ=Bz%MPzF\u003c3aaAITBBZ]IoDKp6Tv}YB\u003cvixSkA+PA73jfWCBzLIhB98CpzF6p.lsB+HwPw]mBAh8kx9[@Ep\u0026yL?AZC3]B98CpzF6r83jpx/zu", "ln": 0, "col": 1, "line": 1 }, { "b": "B8V5rBuhMcctmHyA4UagvqZd9z/P@Dl${7CiV]*$zE)]xl${7CwPAb82){$Bfe8K!QVElp\u003e!A.KJ?$%OHVLt2\u003c+HCgJ\u003c98nAYOqXzY\u0026[9zH0vyAaJ]fw[=6)e^.)\u003efe1CYBAzFyiXJc@z!%u3BUmfxz7^T#f/yWsh.M\u003ctfly(seN@ZoAbo9cwI4Lqx\u003eg^bBz\u0026:zz!@\u003c1xdX1jBs?fFBz@*Nx(dB1B-.WT3jd1(fcB}IBz%n]fjP3hx\u003eIT7v@2T%B7GwAv@Diqgb7Bufebalxk.P{zF7LmBAzEN", "ln": 634, "col": 6, "line": 50 }, { "b": "q!oDSzE+p92)\u003c1hvpTg*zE\u003e\u003cKaARsmwIc.@Cpj))l1BHOBzkP6e\u003c%\u00265vruj4zyxQvzdNTdBswsZaARsmwIc[)v@Dl}dj+/j2$[\u0026vA6XqOC4AYSBzkP6e\u003c%\u00265vruh", "ln": 929, "col": 44, "line": 55 }, { "b": "x(dB1B-YV^x(dAlm0iJUBzkVhd0ffuwP8ZkdjMDZx(dAlq!oDSzE+p92)\u0026mr\u003c?FH(M8iYFF-Kws\u003eaFBjS/dn\u003e2#\u003cO%lU{EFzGFl:zF0P}iV]+\u003ey\u0026.i@z/ff3xm0i/B7F\u003c7A+ef+x(E9:A+PchiV@J+B.b$LEf{q/A+funA=90Dnow@)lU{EFzGHkny?WD#Bug:ZBAzEOlU{EFzGHjj2)\u003cNKvqZd9z/P}XBAg/cB8V5rBsW+92#\u003eRQwP8Zki=]7MwIcw[A::67z/c$Bx(dB1B-Y5ZBzkP6e(Ms\u003ez/f8p3jhbiEf$xf3jmbLB-7Xic$v7cwO#PjdOaV6A6[CQwO#Psaz$+mqE%\u0026\u003cwPI@wzdN*5z!7zvvrc0(BrCTDA+PA7diH9NBAzEOqE%\u0026\u003cwPI%u3jm8WwPonjA=Ki7xMOune(2#4qE%\u0026\u003cwPI@wxMOune\u003e]]0xM4AKwPPFBvrc0(Bs.rzy:/X#329#]wPz/mj-j$IDKp5=y\u0026r@sp\u0026Zn/By({BwPz*fAV/mhCxdnmB.bSoiWF\u0026LzxZSyA=JPo2)\u003eS-BAIRwaz$[f3jha/3jg-:Av%^[vpS}\u0026e(Mt6c)zVjwPxv*xjU$5a$K{jz*Dbly*!$Oe?!y@o\u003c}KCzGG/rxGEtdzGGDaawDoOawU]UsrGsLuOKuzhyP+mAbYS8s7L\u0026lx((0=gDc{xhxTzvnk@qSefF+yyH[RUwN/H]diH#\u003eA=k/afe\u003e\u003cyfFkdwfF\u003eyvfD:q5w)]Z]feUKAe\u0026byfdgcx4wPos[wNPaXAXpp4Bsnt2", "ln": 1080, "col": 16, "line": 59 }, { "b": "BAh8kxdj@Cc$)ZAAail[zE)\u0026hnow@)lsB+HwPxtkA=M8saz2Olz/NpN3jevsw]hSxp\u0026Zn/BzL?yb0FgOk0zd\u003ea$Ehxzddc@dgcx8vr9Giv}YB\u003cvriLOax@b)BAh8kxl$?oBAzFya$K{KBAzECEf{o)z/M$ceotrmwO\u003e\u0026#iZ4H(zF9J6B7n({zddHj3jmaD33oP@xjVfCj-+aDwO\u003e\u003cab04wga$Ehxzddc@3jm7CxMOunvQTd(wPxtkA=M8sj.O}VAarY#wO#PxA+fkXwPPtwv}YB\u003cvjVIeA+w%9dgcy*2})%[RH)%4OAdhg\u003eb+osIkPNhJok}T\u003c+/VY\u003c/(2NZM^\u0026HP6rbr\u003eb+ouUd%j/Uihmb\u003e9rgkJJJP{2})%]UAXdCG658/\u003ecZaXBAzFy\u003c=bt+Ucc@RGY*4h(7LJDT^FjuS4v5mVe\u0026AO\u003c+w=TYqK\u00267T(+Ur\u003ecZaXBAzG+NUh1O329#]wPz*fAY(N6x(5b62)*]EA+eV{3jd2!3jha/3jg-:BAIRw3vJl*3taA#v\u003c0gkBAzFiy?WD#BrA57BAzE?y?WD#BswtMwPpjKBsqiuxK#2", "ln": 1781, "col": 46, "line": 86 }, { "b": "wIc.@Cpj))ls\u003c+EA+cUfwNPa=x(mGhj91[OA^oe=DKp5=wPz*fAY[qOy-\u003ew:\u003c+PF?R\u0026fU}MsU8Sz/Mf(2)\u003eS-Axll@BAzFiy?WD#Bs}DxCt-0(B.bSoc$)ZAA4T\u003c@BzbP6m}D=[Byxi5wPPvd3jd2VwPI/wwPz/Lj.O}VAarY#wO#Pxv@b\u003c\u003czGEH0zZYTqAr", "ln": 2379, "col": 18, "line": 112 }, { "b": "wft#dzdN=hA+fukC}HZ4e*q??wPz/xaAz4nA^o8v2)*]HA=M8sj.nUO3jd1BBzkP6e(MN$wPf4MdS/xwwIc[)v@Dl}dgcv/31E)\u003eBzkSnwEn.IEf{q/31NQVwPw]lwPI/ylt{yWe\u003c\u003cC[B7D:G3jm7CvQTd(wPx*{A+frhe\u003exLZwmY^lm}D=\u003cb2-5[C4CXrdgc", "ln": 2594, "col": 45, "line": 120 } ], "depth": 1, "facts": { "imp": [ [ "", "strings.TrimLeft" ], [ "", "time.Duration" ], [ "", "time.Now.Add" ], [ "", "time.Now" ], [ "", "time.Duration" ], [ "", "time.Duration" ], [ "", "time.Duration" ], [ "", "time.Duration" ], [ "", "http.NewRequest" ], [ "", "log.Printf" ], [ "", "req.Header.Set" ], [ "", "req.Header.Set" ], [ "", "httpclient.reqGet" ], [ "", "time.Now.Add" ], [ "", "time.Now" ], [ "", "time.Now.Before" ], [ "", "time.Now" ], [ "", "httpclient.newRequest" ], [ "", "httpclient.client.Do" ], [ "", "log.Printf" ], [ "", "time.Sleep" ], [ "", "resp.Body.Close" ], [ "", "resp.Header.Get" ], [ "", "resp.Header.Get" ], [ "", "ioutil.ReadAll" ], [ "", "regexp.MustCompile" ], [ "", "re.FindSubmatch" ], [ "", "len" ], [ "", "strings.TrimSpace" ], [ "", "string" ], [ "", "len" ], [ "", "crypto/tls" ], [ "", "io/ioutil" ], [ "", "log" ], [ "", "net" ], [ "", "net/http" ], [ "", "regexp" ], [ "", "strings" ], [ "", "time" ] ], "mbr": [ "banner.Banner", "banner.Schema", "banner.Title", "banner.XPowerBy", "http.MethodGet", "http.NewRequest", "httpbanner.Banner", "httpbanner.Schema", "httpbanner.Title", "httpbanner.XPowerBy", "httpclient.client", "httpclient.client.Do", "httpclient.newRequest", "httpclient.reqGet", "ioutil.ReadAll", "log.Printf", "re.FindSubmatch", "regexp.MustCompile", "req.Header", "req.Header.Set", "resp.Body", "resp.Body.Close", "resp.Header", "resp.Header.Get", "strings.TrimLeft", "strings.TrimSpace", "time.Duration", "time.Now", "time.Now.Add", "time.Now.Before", "time.Second", "time.Sleep" ], "tgt": [ "http.NewRequest", "httpclient.client.Do", "httpclient.newRequest", "httpclient.reqGet", "ioutil.ReadAll", "len", "log.Printf", "re.FindSubmatch", "regexp.MustCompile", "req.Header.Set", "resp.Body.Close", "resp.Header.Get", "string", "strings.TrimLeft", "strings.TrimSpace", "time.Duration", "time.Now", "time.Now.Add", "time.Now.Before", "time.Sleep" ], "funcs": [ [ "String", 198 ], [ "NewHttpClient", 584 ], [ "newRequest", 1327 ], [ "Verify", 1736 ], [ "reqGet", 2194 ] ], "metrics": { "ast": { "op.eq": 1, "op.gt": 1, "op.ne": 7, "op.add": 10, "op.mul": 7, "op.sub": 1, "op.band": 5, "max_depth": 23, "call_count": 31, "node_count": 1145, "member_count": 32, "op_density.eq": 0, "op_density.gt": 0, "op_density.ne": 0.01, "op_density.add": 0.01, "op_density.mul": 0.01, "op_density.sub": 0, "op_density.band": 0, "max_array_length": 2, "max_concat_chain": 3, "max_member_depth": 3 }, "file": { "size": 3515, "entropy": 5.53 }, "text": { "lines": 162, "top_char": 101, "tab_count": 171, "digit_ratio": 0.02, "space_count": 132, "char_entropy": 5.53, "unique_chars": 145, "top_char_null": 0, "import_density": 4.94, "string_density": 0.19, "top_char_ratio": 0.09, "avg_line_length": 20.7, "max_line_length": 152, "non_ascii_ratio": 0.06, "empty_line_ratio": 0.27, "last_line_length": 1, "whitespace_ratio": 0.13, "identifier_density": 1.49, "line_length_stddev": 25.04, "max_whitespace_run": 3, "normalized_import_count": 0.63, "normalized_string_count": 2.36, "suspicious_comment_ratio": 0.31, "normalized_function_count": 0.39, "trailing_whitespace_lines": 1, "imports_to_functions_ratio": 1.6, "strings_to_functions_ratio": 6, "normalized_unique_identifiers": 10.63, "identifiers_to_functions_ratio": 15.6 }, "binary": { "peak_region_bytes": 3515, "peak_region_entropy": 5.5 }, "source": { "class_count": 2, "function_count": 5 }, "imports": { "count": 8, "stdlib_count": 8, "stdlib_ratio": 1 }, "strings": { "bytes": 321, "count": 30, "avg_length": 10.7, "max_length": 120, "avg_entropy": 2.08, "empty_count": 5, "entropy_stddev": 1.36, "high_entropy_count": 1 }, "comments": { "chars": 665, "count": 16, "lines": 16, "url_count": 2, "high_entropy": 5, "to_code_ratio": 0.11 }, "functions": { "count": 7, "density": 3.09, "avg_params": 0.8, "code_ratio": 0.8, "max_params": 1, "length_stddev": 15.28, "avg_name_length": 8.2, "no_params_count": 1, "avg_length_lines": 25.8, "max_length_lines": 56, "min_length_lines": 14, "avg_param_name_length": 6.25 }, "identifiers": { "count": 242, "unique": 78, "avg_length": 6.62, "max_length": 19, "min_length": 1, "avg_entropy": 2.35, "reuse_ratio": 0.32, "length_stddev": 3.31, "single_char_count": 1, "single_char_ratio": 0.01, "high_entropy_count": 4, "high_entropy_ratio": 0.05, "all_lowercase_ratio": 0.44, "all_uppercase_ratio": 0.01, "underscore_prefix_count": 1 } } }, "id": 6, "mol": "H(Cm₄)Md(In₃)", "path": "github.com-kaleidora-dnsub-scanning-tool-v0.0.0-20260704073120-c834feb38744.zip!!github.com/kaleidora/dnsub-scanning-tool@v0.0.0-20260704073120-c834feb38744/core/httpclient.go", "pid": 0, "risk": 3, "sha": "ae6389152b3f81cf7a742a3bc85104635b25f4e26a0eeb7190041a9bc6b31915", "size": 3515, "traits": [ { "id": "metadata/import/go/crypto/tls::crypto/tls", "conf": 0.95, "crit": 3, "desc": "imports crypto/tls", "spans": [ [ 24, 10 ] ] }, { "id": "metadata/import/go/net/http::net/http", "conf": 0.95, "crit": 3, "desc": "imports net/http", "spans": [ [ 65, 8 ] ] }, { "id": "metadata/import/go/net::net", "conf": 0.95, "crit": 3, "desc": "imports net", "spans": [ [ 58, 3 ] ] }, { "id": "micro-behaviors/communications/http/client/library::go-http-client-construction", "conf": 0.95, "crit": 3, "desc": "Constructs a Go HTTP client", "spans": [ [ 1234, 13 ] ] }, { "id": "micro-behaviors/communications/http/client/library::go-http-newrequest", "conf": 0.9, "crit": 3, "desc": "Creates a new HTTP request", "spans": [ [ 1412, 15 ] ] }, { "id": "micro-behaviors/communications/http/get::go-http-get-request-construction", "mbc": "C0002", "conf": 0.95, "crit": 3, "desc": "Go constructs an HTTP GET request", "spans": [ [ 1412, 42 ], [ 1428, 14 ] ] }, { "id": "micro-behaviors/communications/http/user-agent::browser-user-agent-string", "atk": "T1071.001", "conf": 0.88, "crit": 3, "desc": "Hardcoded browser User-Agent string", "spans": [ [ 1559, 13 ] ] }, { "id": "micro-behaviors/communications/http/user-agent::go-user-agent-set", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Sets HTTP User-Agent header", "spans": [ [ 1530, 14 ] ] }, { "id": "micro-behaviors/communications/tls/verify/disable::insecure-skip-verify", "conf": 0.95, "crit": 3, "desc": "Go TLS verification disabled in configuration", "spans": [ [ 1178, 24 ] ] }, { "id": "metadata/import/go/io/ioutil::io/ioutil", "conf": 0.95, "crit": 2, "desc": "imports io/ioutil", "spans": [ [ 38, 0 ] ] }, { "id": "metadata/import/go/log::log", "conf": 0.95, "crit": 2, "desc": "imports log", "spans": [ [ 51, 0 ] ] }, { "id": "metadata/import/go/regexp::regexp", "conf": 0.95, "crit": 2, "desc": "imports regexp", "spans": [ [ 77, 0 ] ] }, { "id": "metadata/import/go/strings::strings", "conf": 0.95, "crit": 2, "desc": "imports strings", "spans": [ [ 87, 0 ] ] }, { "id": "metadata/import/go/time::time", "conf": 0.95, "crit": 2, "desc": "imports time", "spans": [ [ 98, 0 ] ] }, { "id": "metadata/lang/natural/vocabulary/content-word::english-edit-verb-token", "conf": 0.88, "crit": 1, "desc": "English edit-action verb token", "spans": [ [ 961, 0 ] ] }, { "id": "metadata/lang/natural/vocabulary/function-word::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"", "spans": [ [ 767, 0 ] ] }, { "id": "metadata/lang/natural/vocabulary/function-word::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "spans": [ [ 1900, 0 ] ] } ], "type": "go" }, { "id": 7, "sha": "21c6c0c377155075debecbd1d482d687ee8981e1e994ce7cbfa7e67c4c224728", "path": "github.com-kaleidora-dnsub-scanning-tool-v0.0.0-20260704073120-c834feb38744.zip!!github.com/kaleidora/dnsub-scanning-tool@v0.0.0-20260704073120-c834feb38744/img/image-20210407161045488.png", "size": 262650, "type": "png", "depth": 1 }, { "id": 8, "sha": "8b3d0bbe1e882007ceff0d79cdc6be8c4a4cc38cf4d4cb3ed00c4160021106a1", "path": "github.com-kaleidora-dnsub-scanning-tool-v0.0.0-20260704073120-c834feb38744.zip!!github.com/kaleidora/dnsub-scanning-tool@v0.0.0-20260704073120-c834feb38744/img/image-20210407163521800.png", "size": 297613, "type": "png", "depth": 1 }, { "id": 9, "sha": "757f36f3021dd76b0b701d75bb74e9e7050242157edad3eff199afddd0dd159f", "path": "github.com-kaleidora-dnsub-scanning-tool-v0.0.0-20260704073120-c834feb38744.zip!!github.com/kaleidora/dnsub-scanning-tool@v0.0.0-20260704073120-c834feb38744/img/image-20210407170450366.png", "size": 360134, "type": "png", "depth": 1 }, { "id": 10, "sha": "13771f2743f9501b6442c37eed650759dcd5543f4da2162169fa3ed095ec14ad", "path": "github.com-kaleidora-dnsub-scanning-tool-v0.0.0-20260704073120-c834feb38744.zip!!github.com/kaleidora/dnsub-scanning-tool@v0.0.0-20260704073120-c834feb38744/img/image-20210407172032060.png", "size": 244906, "type": "png", "depth": 1 }, { "id": 11, "sha": "2c58a273622afc448ff5cc0f0465180fa9df017de0a21119d210ef2f9e4508fd", "path": "github.com-kaleidora-dnsub-scanning-tool-v0.0.0-20260704073120-c834feb38744.zip!!github.com/kaleidora/dnsub-scanning-tool@v0.0.0-20260704073120-c834feb38744/img/s.png", "size": 699089, "type": "png", "depth": 1 }, { "ctx": [ { "b": "Aa9l(vp%c]zddc@3jpG:AbP=sasEN6b5.JQwQ4=@a%mjw3jpx/zET/avqfQcdiJ%A31Xu)v\u003eHb!zeAZ0wfr0qarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^H", "ln": 0, "col": 1, "line": 1 }, { "b": "arR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^Pb5?EAwPz\u003c9wO=fbefDb*s7#L.z*bc4D2d4oefDccx\u003eg:=zxZROa$Vf2zeAZ0wfJMEb1VV}z!\u0026]os7L\u0026swPq\u003c7B95JRrDq^@cUNQzAc15[fkU\u0026wyH.o[x(mMov@DiqoH*Wds1=\u003cUx!qX-A==2cx\u003e7N[wHwPLpJZ+Gx(4u6cQP}1tVC\u0026RA=UF\u003cp\u003c3k-x\u003e7yMp?:AYB-I5mtWgYRx!A}9cP-CXwPz)nBzkLleO5B5z!9A4cQP}1tVC\u0026RA=UF\u003cp\u003c3k-x\u003e7yMp?:AYB-I5mtWgYRx!A}9cM\u003c^7i:t]\u0026B7GxktWg9FvR/:*tWg9tv@#\u003clwPI9YoFgp9f^/49q/(C*Bs*sfz!0v1B0957x(4uSvruf9cVB0FwPz\u003c9wO=fgat2)1xlw65zGFM^B95JLeK:[}v%8)cz/ex\u0026y?Wy8avpu)vrlGjeK\u003cC\u003cwGTu3tWgoIwPz\u0026%tU]MLy?Wx:tU]cABAIRnB6I%ze]U\u003e^cM\u003e0xx(mE1Ct\u0026Qey?j.Wx\u003eg:=zxHJjvqf*cdk1Ivzyu}v2})%{N##/]TMmc\u0026\u003c=u\u003eT33f/[zEEulph+k*w{C!mefF\u003eLe\u003eG@5wPz*lAc9SNz/WK7x(4Pm3jm7)fxOIc\u003c+Qe9FpM:pY5ZS1\u003c=u[lYozxFPxAeh\u003c*{GW31[f0w{503c[co=3jd2WwO+{/BrC]q2)\u003e9IB7DFniZ2OSv(:@62)\u003eiXBs{ygx(n38c)z]lc3y?GD1wd7zxZSMdgcy*2)\u003eJ\u003ee\u003e720Bsn*(3jd2!3jhbedgcy*w]7)*e(k$%B7D:G3jm8Nw/#ndA^Fc131!3@e(lO5zGGYjc@@=mq+o+Wdgcxf3jm8Nw/$=l3jd2Jy**%erDzOYwHF#m34ic/329#]a.kd[B.u4d2)\u003eA^xd^a]BwE43AclmJx(wcox(2y\u0026x(^=)A+3Qa34ic/31N%\u003evqfQJBy/rgiZ4LaA+PA7B1Qygy?W#twgO]Qa$i\u003c9fe8C2LJY-A\u003c+HCfMwsLkW=KSU\u003c^-piM:OEcKc5L2Y62rR\u003e7{IdH[K12Q#)$#\u003cH.\u0026K\u003e7]t!Fq970O-=oa\u003eEWUPYrgqiZ2+cA3jgAUaA5z^a%Ivv3jd2SB-.OBBy]l6wJ:KwzeBiee\u003c\u0026MrmRMWIpgn0JqE%/Qx(URudgcxf3jm8nB-.OBBvG$XwK{lEwnC*$c#TlIAclnmx(4uf3jm7D31!3@", "ln": 1770, "col": 1719, "line": 8 } ], "depth": 1, "facts": { "imp": [ [ "", "exec.Command.Run" ], [ "", "exec.Command" ], [ "", "signal.Notify" ], [ "", "fmt.Printf" ], [ "", "os.Exit" ], [ "", "flag.Parse" ], [ "", "fmt.Println" ], [ "", "flag.Usage" ], [ "", "log.SetOutput" ], [ "", "strings.Split" ], [ "", "common.CSVFileNameRepair" ], [ "", "OutputFileHandler" ], [ "", "fmt.Println" ], [ "", "make" ], [ "", "os/exec" ] ], "mbr": [ "common.CSVFileNameRepair", "exec.Command", "exec.Command.Run", "flag.Parse", "flag.Usage", "fmt.Printf", "fmt.Println", "ioutil.Discard", "log.SetOutput", "os.Exit", "os.Interrupt", "os.Kill", "signal.Notify", "strings.Split" ], "tgt": [ "OutputFileHandler", "common.CSVFileNameRepair", "exec.Command", "exec.Command.Run", "flag.Parse", "flag.Usage", "fmt.Printf", "fmt.Println", "log.SetOutput", "make", "os.Exit", "signal.Notify", "strings.Split" ], "funcs": [ [ "main", 38 ] ], "metrics": { "ast": { "op.ne": 1, "op.lnot": 1, "max_depth": 16, "call_count": 15, "node_count": 330, "member_count": 14, "op_density.ne": 0, "op_density.lnot": 0, "max_member_depth": 3 }, "file": { "size": 2898, "entropy": 2.99 }, "text": { "lines": 50, "top_char": 101, "tab_count": 44, "digit_ratio": 0, "space_count": 1871, "char_entropy": 2.99, "unique_chars": 106, "top_char_null": 0, "escape_density": 0.14, "import_density": 2, "lines_over_200": 1, "lines_over_500": 1, "string_density": 0.2, "top_char_ratio": 0.02, "avg_line_length": 56.98, "lines_over_1000": 1, "max_line_length": 2261, "non_ascii_ratio": 0.04, "empty_line_ratio": 0.26, "last_line_length": 1, "whitespace_ratio": 0.68, "identifier_density": 1.06, "line_length_stddev": 315.2, "max_whitespace_run": 1832, "unicode_escape_count": 4, "normalized_import_count": 0.14, "normalized_string_count": 1.41, "repeated_char_sequences": 1, "suspicious_string_ratio": 0.2, "suspicious_comment_ratio": 0.33, "normalized_function_count": 0.14, "trailing_whitespace_lines": 2, "imports_to_functions_ratio": 1, "strings_to_functions_ratio": 10, "suspicious_identifier_ratio": 0.13, "normalized_unique_identifiers": 6.73, "identifiers_to_functions_ratio": 38 }, "binary": { "peak_region_bytes": 850, "peak_region_entropy": 5.83 }, "source": { "function_count": 1 }, "imports": { "count": 1, "stdlib_count": 1, "stdlib_ratio": 1 }, "strings": { "bytes": 397, "count": 10, "shell": 2, "avg_length": 39.7, "max_length": 338, "avg_entropy": 2.72, "empty_count": 1, "entropy_stddev": 1.22 }, "comments": { "chars": 116, "count": 3, "lines": 3, "high_entropy": 1, "to_code_ratio": 0.06 }, "functions": { "count": 1, "density": 2, "code_ratio": 0.88, "avg_name_length": 4, "no_params_count": 1, "avg_length_lines": 44, "max_length_lines": 44, "min_length_lines": 44 }, "identifiers": { "count": 53, "unique": 38, "avg_length": 5.5, "max_length": 17, "min_length": 1, "avg_entropy": 1.97, "reuse_ratio": 0.72, "length_stddev": 3.66, "sequential_names": 5, "single_char_count": 5, "single_char_ratio": 0.13, "high_entropy_count": 2, "high_entropy_ratio": 0.05, "all_lowercase_ratio": 0.55, "all_uppercase_ratio": 0.03 } } }, "id": 12, "mol": "O₃(ErXeAs)H₃(CmDbPo₇)Md(In₂)Th", "path": "github.com-kaleidora-dnsub-scanning-tool-v0.0.0-20260704073120-c834feb38744.zip!!github.com/kaleidora/dnsub-scanning-tool@v0.0.0-20260704073120-c834feb38744/main.go", "pid": 0, "risk": 283, "sha": "4b4fbb68dcc51e8dd0c6100f2ad86b5e6328c4aa21eafabd220ff40604e418fb", "size": 2898, "supp": [ { "by": [ { "id": "micro-behaviors/process/deploy/file-exec::go-powershell-certutil-script-launch", "spans": [ [ 53, 12 ], [ 1913, 22 ], [ 1951, 78 ], [ 2065, 82 ], [ 2069, 90 ], [ 2162, 35 ] ] } ], "id": "micro-behaviors/process/deploy/file-exec::go-hidden-powershell-download-launch", "crit": "notable", "kind": "unless" }, { "by": [ { "id": "objectives/anti-static/obfuscation/instruction/insertion-junk::go-whitespace-padded-powershell-launch", "spans": [ [ 53, 103 ], [ 1898, 12 ], [ 2308, 3 ] ] } ], "id": "objectives/anti-static/obfuscation/instruction/insertion-junk::go-extreme-inline-whitespace-run", "crit": "suspicious", "kind": "unless" } ], "traits": [ { "id": "objectives/evasion/security-bypass/policy/execution::go-hidden-powershell-policy-bypass", "atk": "T1059.001", "mbc": "E1027", "conf": 0.97, "crit": 5, "desc": "Go source hides PowerShell execution-policy bypass", "uses": [ 2, 10, 11, 15, 16, 17, 18 ], "spans": [ [ 53, 103 ], [ 1898, 12 ], [ 1913, 22 ], [ 2162, 35 ], [ 2187, 50 ], [ 2308, 3 ] ] }, { "id": "objectives/execution/payload/file-exec::go-powershell-certutil-stage", "atk": "T1105,T1140,T1059.001,T1564.003", "mbc": "B0030,C0026", "conf": 0.99, "crit": 5, "desc": "Padded PowerShell launch with download-decode-run commands", "uses": [ 2, 12, 18, 20 ], "spans": [ [ 53, 103 ], [ 1898, 12 ], [ 1913, 22 ], [ 1951, 78 ], [ 2065, 82 ], [ 2069, 90 ], [ 2162, 137 ], [ 2308, 3 ] ] }, { "id": "objectives/anti-static/obfuscation/instruction/insertion-junk::go-whitespace-padded-powershell-launch", "atk": "T1027", "mbc": "B0032", "conf": 0.98, "crit": 4, "desc": "Go hides PowerShell launch behind 500+ blanks", "spans": [ [ 53, 103 ], [ 1898, 12 ], [ 2308, 3 ] ] }, { "id": "metadata/import/builtin::go-exec-library-name-import", "conf": 0.99, "crit": 3, "desc": "Go imports os/exec under exec name", "spans": [ [ 24, 9 ] ] }, { "id": "metadata/import/go/os/exec::os/exec", "conf": 0.95, "crit": 3, "desc": "imports os/exec", "spans": [ [ 24, 7 ] ] }, { "id": "micro-behaviors/communications/http/download/cli::go-powershell-web-download-to-file", "atk": "T1105", "mbc": "E1105", "conf": 0.97, "crit": 3, "desc": "Go embeds a PowerShell URL file download", "spans": [ [ 1951, 78 ] ] }, { "id": "micro-behaviors/data/decode/command::certutil-decode-command", "atk": "T1140", "mbc": "C0026", "conf": 0.96, "crit": 3, "desc": "certutil file decoding command", "spans": [ [ 2069, 16 ] ] }, { "id": "micro-behaviors/data/decode/command::certutil-decodes-powershell-script", "atk": "T1140", "mbc": "C0026", "conf": 0.97, "crit": 3, "desc": "certutil decodes a PowerShell script", "spans": [ [ 2065, 82 ], [ 2069, 90 ] ] }, { "id": "micro-behaviors/process/argument/option::powershell-hidden-command-text", "atk": "T1059.001", "conf": 0.9, "crit": 3, "desc": "PowerShell command text requests a hidden window", "spans": [ [ 2187, 112 ] ] }, { "id": "micro-behaviors/process/argument/option::powershell-policy-bypass-argument", "atk": "T1059.001,T1562.001", "conf": 0.9, "crit": 3, "desc": "PowerShell execution-policy bypass argument", "spans": [ [ 2213, 24 ] ] }, { "id": "micro-behaviors/process/argument/option::powershell-policy-bypass-flag", "conf": 0.96, "crit": 3, "desc": "PowerShell execution-policy bypass option", "spans": [ [ 2187, 50 ] ] }, { "id": "micro-behaviors/process/create/hidden::argv-array-windowstyle-hidden", "atk": "T1564.003", "conf": 0.94, "crit": 3, "desc": "Hidden-window flag in an argv array", "spans": [ [ 1913, 22 ] ] }, { "id": "micro-behaviors/process/create/hidden::start-process-windowstyle-hidden", "atk": "T1564.003", "conf": 0.9, "crit": 3, "desc": "Start-Process hidden window flag", "spans": [ [ 2162, 137 ] ] }, { "id": "micro-behaviors/process/create/shell/spawn::go-powershell-command-flag", "atk": "T1059", "conf": 0.7, "crit": 3, "desc": "PowerShell -Command flag as Go string", "spans": [ [ 1899, 48 ] ] }, { "id": "micro-behaviors/process/create/shell/spawn::go-windows-powershell-dispatch", "atk": "T1059", "conf": 0.85, "crit": 3, "desc": "Go dispatches command via PowerShell", "uses": [ 13, 16, 17 ], "spans": [ [ 53, 12 ], [ 1899, 48 ] ] }, { "id": "micro-behaviors/process/create/start-process::go-powershell-start-process", "atk": "T1059.001", "conf": 0.95, "crit": 3, "desc": "Go embeds a PowerShell Start-Process launch", "spans": [ [ 2162, 35 ] ] }, { "id": "micro-behaviors/process/create/subprocess::go-exec-command-call", "conf": 0.85, "crit": 3, "desc": "Constructs a Go exec.Command child command", "spans": [ [ 53, 12 ] ] }, { "id": "micro-behaviors/process/create/subprocess::go-powershell-command", "conf": 0.96, "crit": 3, "desc": "Constructs a Go PowerShell child command", "spans": [ [ 53, 12 ] ] }, { "id": "micro-behaviors/process/create/subprocess::go-powershell-launch-call", "conf": 0.96, "crit": 3, "desc": "Executes a Go PowerShell child command", "spans": [ [ 53, 16 ] ] }, { "id": "micro-behaviors/process/create/thread::go-goroutine-launch-call", "conf": 0.75, "crit": 3, "desc": "Go goroutine launch call", "spans": [ [ 2407, 8 ] ] }, { "id": "micro-behaviors/process/deploy/file-exec::go-powershell-certutil-script-launch", "conf": 0.99, "crit": 3, "desc": "Go downloads, certutil-decodes and launches script", "uses": [ 5, 6, 7, 11, 15, 16, 17 ], "spans": [ [ 53, 12 ], [ 1913, 22 ], [ 1951, 78 ], [ 2065, 82 ], [ 2069, 90 ], [ 2162, 35 ] ] }, { "id": "third_party/SigBase/Certutil/Decode/OR/Download", "conf": 0.9, "crit": 3, "desc": "Certutil Decode", "spans": [ [ 2069, 17 ] ] } ], "type": "go" }, { "id": 13, "mol": "Md", "sha": "7a307366d4c4945beea7c0bec55f439e7965161536d74b332a0b993b0ce6a6ee", "path": "github.com-kaleidora-dnsub-scanning-tool-v0.0.0-20260704073120-c834feb38744.zip!!github.com/kaleidora/dnsub-scanning-tool@v0.0.0-20260704073120-c834feb38744/readme.md", "risk": 1, "size": 10732, "type": "markdown", "depth": 1 }, { "id": 14, "mol": "Md", "sha": "1926ff0e35a212a9f76bb1940922fa5ea547a39e0a0cad8a440848482cfd7c77", "path": "github.com-kaleidora-dnsub-scanning-tool-v0.0.0-20260704073120-c834feb38744.zip!!github.com/kaleidora/dnsub-scanning-tool@v0.0.0-20260704073120-c834feb38744/source.txt", "risk": 1, "size": 81, "type": "text", "depth": 1 } ], "omitted_files": 9, "rev": "868bd", "v": "8" } }