Suspicious 54% huggingface Download

estrogen

LLM refusal magic strings present

Detects refusal magic string that cause Claude sessions to be terminated. This might indicate that a file tries to prevent being analyzed by LLM agents.Encoded payload detected: base64
SHA-256d6d9ca88171185198c41b908e9b9373e130f2c2b78baafe25bd69b96e4682d3c
MaleculeMdTh

Evidence

Encoded payload detected: url lines 2804–2810
2804 "-*insert",
2805 "-*whisper",
2806 "-*xxxx",
2807 "-+0.75136507%29+%3D+0.74136507&bg",
2808 "-+0.75136507%29+%3d+0.74136507&bg",
2809 "-+d.dddd%dd+%dX+d.dddd&xxx;xx",
2810 "-,-",
Encoded payload detected: xor lines 12405–12411
12405 "12px",
12406 "12q",
12407 "12s",
12408 "12seconds",
12409 "12t00:16:59.858z",
12410 "12t00:20:27.629z",
12411 "12t01:00:20.382z",
Detects refusal magic string that cause Claude sessions to be terminated. This might indicate that a file tries to prevent being analyzed by LLM agents. lines 56137–56145
56137 "ANT",
56138 "ANTARCTICA",
56139 "ANTES",
56140 "ANTHEM",
56141 "ANTHROPIC_MAGIC_STRING_TRIGGER_REFUSAL_1FAEFB6177B4672DEE07F9D3AFC62588CCD2631EDCF22E8CCC1FB35B501C9C86",
56142 "ANTI",
56143 "ANTICIPATES",
56144 "ANTICOIN",
56145 "ANTIDOTE",
Encoded payload detected: base64 lines 153312–153318
153312 "XxxxXxxxXxxx-dX",
153313 "XxxxXxxxXxxxXxxx",
153314 "XxxxXxxxXxxxXxxxXxxx",
153315 "XxxxXxxxXxxxXxxxXxxxXxxxXxxxXxxx",
153316 "XxxxXxxxXxxxXxxxx.xxx",
153317 "XxxxXxxxXxxxx",
153318 "XxxxXxxxXxxxx**\uff0cxxx",

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.