{ "llm": { "conf": 0.9637203, "grade": "hostile", "model": "Qwen/Qwen3.8-27B", "outcome": "hostile", "interpretation": "C2, persistence, wallet theft" }, "ml": { "v": "7", "eng": "2.8.0", "lvl": 0, "conf": 100, "mods": [ { "cls": 2, "raw": 0.94585127, "rte": "az", "prob": 0.94585127 }, { "cls": 0, "raw": 0.4404172, "rte": "az/python_sdist", "prob": 0.4404172 } ], "prob": 0.94585127, "files": [ { "id": 0, "lvl": 0, "conf": 100, "prob": 0.9458512663841248, "type": "python_sdist" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.00012109676754334942, "type": "python" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.0012722810497507453, "type": "python" } ], "version": "v18.18", "analyzed_at": "2026-09-04T00:27:43Z" }, "path": "web3_tool_sdk-1.0.0.tar.gz", "raw": { "files": [ { "id": 0, "ctx": [ { "b": "abZy8000000@}T\u0026(U\u003eJo5yk1?6=.=ZqyxPjjNge(qQo+xyz]fcHbFVks!YxRgo3z29xhgv{8LOD6dr+b1\u003eYEQkVcIYK9ysW?z[H\u0026SjE(T/P\u003eBpeQF!ErfP!EIi(CfZ7DSX{g(LS1IjQ:rJslI)0DozeMR", "ln": 0 } ], "mol": "O(C)H₇(Cm₇CrDb₂F₂Os₆Po₃U)Md₂(BkPa)", "sha": "e443ccc57cdc7861e284e472a95e8b926e424b8158b23b37a058d5b2c4ec1fa9", "path": "web3_tool_sdk-1.0.0.tar.gz", "risk": 17, "size": 1653, "type": "python_sdist", "facts": { "metrics": { "file": { "size": 1653, "entropy": 7.88 }, "parse": { "error_count": 1 }, "binary": { "peak_region_bytes": 1653, "peak_region_entropy": 7.78 } } }, "ident": { "name": { "value": "web3-tool-sdk", "source": "python.name", "verified": false }, "trust": "unsigned", "version": { "value": "1.0.0", "source": "python.version", "verified": false }, "identifier": { "value": "web3-tool-sdk", "source": "python.name", "verified": false } }, "traits": [ { "id": "micro-behaviors/fs/file/open::write-append-create-mode", "conf": 0.85, "crit": 3, "desc": "Python file opened for write or append" }, { "id": "micro-behaviors/os/sysinfo/platform/runtime::platform-system", "atk": "T1082", "conf": 0.7, "crit": 3, "desc": "Queries the OS with platform.system()", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/os/autorun/scheduled::crontab-shell-pipe", "conf": 0.9, "crit": 3, "desc": "Python shell-pipes a cron entry into crontab", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/os/registry/access::winreg-openkey", "conf": 0.8, "crit": 3, "desc": "Opens a Windows registry key", "from": [ { "file": 3 } ] }, { "id": "metadata/build/pip::root-setup-py-path", "conf": 0.98, "crit": 1, "desc": "Shallow setup.py path candidate", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/http/header/content-type::python-json-content-type", "conf": 0.94, "crit": 1, "desc": "Python JSON content type", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/communications/http/url/scheme::cleartext-http-url-code-literal", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Code embeds cleartext HTTP URL literal", "from": [ { "file": 3 } ] }, { "id": "metadata/build/pip::packaging-setuptools-import", "conf": 0.95, "crit": 3, "desc": "setuptools packaging import", "from": [ { "file": 1 } ] }, { "id": "metadata/package/dependencies/declaration::setup-requests-dependency", "conf": 0.9, "crit": 3, "desc": "setup.py declares requests dependency", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/time/sleep/interval::python-sleep-call", "conf": 0.65, "crit": 2, "desc": "Pauses execution with a Python sleep call", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/process/create/thread::python-daemon-thread", "conf": 0.8, "crit": 3, "desc": "Creates a daemon thread in Python", "from": [ { "file": 3 } ] }, { "id": "metadata/build/pip::packaging-setup-api-import", "conf": 0.95, "crit": 3, "desc": "Packaging setup API import or call", "from": [ { "file": 1 } ], "uses": [ 7 ] }, { "id": "micro-behaviors/crypto/symmetric/xor/loop::xor-modulo-key-loop", "atk": "T1027", "mbc": "B0032", "conf": 0.8, "crit": 3, "desc": "XOR loop uses repeating-key modulo indexing", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/os/autorun/scheduled::crontab-echo-pipe", "conf": 0.9, "crit": 3, "desc": "Echoes a generated entry into crontab" }, { "id": "micro-behaviors/communications/http/client/library::urllib-request-client-import", "conf": 0.82, "crit": 3, "desc": "Imports Python urllib.request through direct or from-import syntax", "from": [ { "file": 3 } ], "uses": [ 16 ] }, { "id": "micro-behaviors/process/interpreter/shell::shell-init-path", "conf": 0.84, "crit": 3, "desc": "Shell startup file path reference", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/communications/http/client/library::urllib-request", "conf": 0.8, "crit": 3, "desc": "Imports Python urllib.request HTTP client", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/process/create/subprocess::import-subprocess", "atk": "T1059.006", "mbc": "E1059.006", "conf": 0.95, "crit": 3, "desc": "Imports Python's subprocess module", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/os/registry/manipulate::winreg-setvalue", "conf": 0.8, "crit": 3, "desc": "Sets a Windows registry value", "from": [ { "file": 3 } ] }, { "id": "objectives/persistence/system/cron/schedule::pipe-crontab", "atk": "T1053.003", "conf": 0.6, "crit": 3, "desc": "Pipe to crontab stdin", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/fs/directory/traverse::traverse-walk-call", "conf": 0.84, "crit": 3, "desc": "Calls os.walk for filesystem enumeration", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/communications/ip/literal::http-ip-url", "conf": 0.95, "crit": 3, "desc": "Contains an external-IP HTTP URL", "from": [ { "file": 3 } ], "uses": [ 37, 43 ] }, { "id": "micro-behaviors/communications/http/lib/urllib::urllib-word", "conf": 0.75, "crit": 3, "desc": "References Python urllib HTTP client", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/ui/framework/tkinter::tkinter-init", "conf": 0.9, "crit": 3, "desc": "Initializes Tkinter GUI", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/os/registry/access::python-reg-run-access", "mbc": "F0006", "conf": 0.95, "crit": 3, "desc": "Python Windows registry Run key access", "from": [ { "off": 697, "file": 3, "line": 20 } ], "uses": [ 51, 53 ] }, { "id": "micro-behaviors/communications/http/lib/urllib::urllib-urlopen-data", "conf": 0.85, "crit": 3, "desc": "urlopen with data parameter (potential POST)", "from": [ { "file": 3 } ] }, { "id": "metadata/build/pip::packaging-setuptools-imported-setup-call", "conf": 0.95, "crit": 3, "desc": "Imported setuptools setup call", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/encode/base64::import-base64", "conf": 0.9, "crit": 3, "desc": "Imports Python's base64 module", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/data/encode/base64::b64encode-call", "conf": 0.9, "crit": 3, "desc": "Encodes data with Python base64.b64encode()", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/data/control-flow/module-exec::module-level-side-effect-call", "conf": 0.82, "crit": 3, "desc": "Python module-level function call" }, { "id": "micro-behaviors/os/clipboard/access::tkinter-clipboard-get-method", "conf": 0.9, "crit": 3, "desc": "clipboard_get method call", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/time/sleep/interval::python-sleep-1s-plus", "conf": 0.75, "crit": 1, "desc": "Python one-second-plus sleep", "from": [ { "off": 2855, "file": 3, "line": 68 } ], "uses": [ 9, 40 ] }, { "id": "micro-behaviors/communications/http/lib/urllib::urllib-urlopen", "conf": 0.7, "crit": 3, "desc": "Calls urllib.request.urlopen", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/os/sysinfo/platform/runtime::python-platform-branch", "atk": "T1082", "conf": 0.82, "crit": 3, "desc": "Python branches on OS platform", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/os/autorun/scheduled::crontab-option", "conf": 0.6, "crit": 3, "desc": "crontab command option", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/communications/http/request/client::urllib-json-request-body", "conf": 0.9, "crit": 3, "desc": "urllib JSON request with body", "from": [ { "file": 3 } ], "uses": [ 14, 25, 38, 54 ] }, { "id": "micro-behaviors/communications/ip/direct::external-ipv4-http-endpoint", "atk": "T1071.001", "mbc": "C0002", "conf": 0.95, "crit": 3, "desc": "HTTP endpoint uses external IPv4", "from": [ { "file": 3 } ], "uses": [ 21 ] }, { "id": "micro-behaviors/communications/ip/literal::external-ipv4-http-url", "conf": 0.9, "crit": 1, "desc": "Text contains raw external-IP HTTP URL", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/communications/http/lib/urllib::urllib-request-object", "conf": 0.82, "crit": 3, "desc": "urllib Request object creation", "from": [ { "off": 504, "file": 3, "line": 14 } ], "uses": [ 45 ] }, { "id": "micro-behaviors/fs/read/file::file-read-content", "atk": "T1005", "mbc": "E1005", "conf": 0.6, "crit": 2, "desc": "Reads file content (Python)", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/time/sleep/interval::python-sleep-1s-plus-arg", "conf": 0.75, "crit": 1, "desc": "Python sleep waits at least one second", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/process/create/thread::python-thread-create", "conf": 0.65, "crit": 3, "desc": "Creates a thread in Python", "from": [ { "file": 3 } ] }, { "id": "metadata/build/pip::root-setup-py", "conf": 0.98, "crit": 3, "desc": "Root Python setup.py packaging file", "from": [ { "file": 1 } ], "uses": [ 4, 11 ] }, { "id": "micro-behaviors/communications/ip/literal::http-ip-url-source-literal", "conf": 0.95, "crit": 1, "desc": "Source literal contains an external-IP HTTP URL", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/communications/http/request/client::python-request-data-argument", "conf": 0.84, "crit": 3, "desc": "Python Request call passes a body argument" }, { "id": "micro-behaviors/communications/http/lib/urllib::urllib-request-symbol", "conf": 0.82, "crit": 3, "desc": "urllib.request.Request symbol", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/communications/http/lib/urllib::urllib-urlopen-call-symbol", "conf": 0.85, "crit": 3, "desc": "Calls fully qualified urllib urlopen", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/communications/http/header/content-type::json-header", "conf": 0.9, "crit": 3, "desc": "References HTTP Content-Type application/json", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/fs/read/file::file-open-content", "atk": "T1005", "mbc": "E1005", "conf": 0.86, "crit": 2, "desc": "Opens file in default read mode" }, { "id": "micro-behaviors/process/create/subprocess::process-execution", "atk": "T1059.006", "conf": 0.8, "crit": 3, "desc": "Python launches a child process", "from": [ { "file": 3 } ], "uses": [ 50 ] }, { "id": "micro-behaviors/process/create/subprocess::run-ast", "atk": "T1059.006", "mbc": "C0017", "conf": 0.85, "crit": 3, "desc": "Calls subprocess.run to launch a process", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/os/registry/keys::currentversion-run", "conf": 0.75, "crit": 3, "desc": "Accesses Windows CurrentVersion Run key", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/communications/http/lib/urllib::urllib-request-data-body", "conf": 0.9, "crit": 3, "desc": "urllib Request carries an HTTP body" }, { "id": "micro-behaviors/os/registry/access::python-winreg-import", "conf": 1.0, "crit": 3, "desc": "Python winreg import", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/data/serialize/json::json-dumps-call", "conf": 0.9, "crit": 2, "desc": "Serializes data with Python json.dumps()", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/os/autorun/scheduled::crontab-string", "conf": 0.95, "crit": 3, "desc": "Crontab list or input command", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/communications/ip/literal::external-ipv4-url-script", "conf": 0.9, "crit": 3, "desc": "Script embeds external IPv4 URL", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/data/control-flow/analysis::while-loop", "conf": 0.3, "crit": 2, "desc": "While-loop control flow", "from": [ { "file": 3 } ] }, { "id": "objectives/command-and-control/dropper/python-script::python-currentversion-run", "atk": "T1105", "mbc": "B0024", "conf": 0.9, "crit": 3, "desc": "Writes a CurrentVersion Run path", "from": [ { "file": 3 } ] } ] }, { "ctx": [ { "b": "w].*baAIaoB-qCvz!%Fqx(d*cA=-BBwPS6l3uG^2B-n:DvqPNsb6NQcgC9Y!z!}1DwnrwuC4CYnx(v(La#7Y7e?!F2AcU/cz!a0bwPH1sb6NQcgHClxz!@^4wnrw{eno0yByx04uVGZ$B.L(cB3i.KA+flkwPI%mb3=:sD30.rzEmA}ADL#owPH0Uk0pXOhZfWT", "ln": 0, "col": 1, "line": 1 } ], "depth": 1, "facts": { "imp": [ [ "", "setup" ], [ "", "setup" ], [ "", "setuptools" ] ], "tgt": [ "setup" ], "metrics": { "ast": { "max_depth": 7, "call_count": 1, "node_count": 59, "max_array_len": 1 }, "file": { "size": 156, "entropy": 4.8 }, "text": { "lines": 2, "top_char": 101, "max_ws_run": 1, "digit_ratio": 0.06, "space_count": 3, "char_entropy": 4.8, "unique_chars": 38, "top_char_null": 0, "string_density": 2.5, "top_char_ratio": 0.09, "avg_line_length": 77, "max_line_length": 126, "last_line_length": 126, "long_token_count": 1, "whitespace_ratio": 0.03, "identifier_density": 4, "line_length_stddev": 49, "normalized_string_count": 3.54, "normalized_unique_identifiers": 7 }, "binary": { "peak_region_bytes": 156, "peak_region_entropy": 4.8 }, "imports": { "count": 2, "third_party_count": 2, "third_party_ratio": 1 }, "strings": { "bytes": 44, "count": 5, "avg_length": 8.8, "max_length": 13, "avg_entropy": 2.63, "entropy_stddev": 0.71 }, "identifiers": { "count": 8, "unique": 7, "avg_length": 9.57, "max_length": 16, "min_length": 4, "avg_entropy": 2.88, "reuse_ratio": 0.88, "length_stddev": 4.3, "high_entropy_count": 1, "high_entropy_ratio": 0.14, "all_lowercase_ratio": 1 } } }, "id": 1, "mol": "H(Db)Md₂(BkPa)", "path": "web3_tool_sdk-1.0.0.tar.gz!!web3-tool-sdk-1.0.0/setup.py", "pid": 0, "risk": 3, "sha": "b185079ccc5b309167b18aac54194701c2f94291a019c33c2d2d5a018e69ac0e", "size": 156, "traits": [ { "id": "metadata/build/pip::packaging-setuptools-import", "conf": 0.95, "crit": 3, "desc": "setuptools packaging import", "spans": [ [ 0, 15 ] ] }, { "id": "metadata/build/pip::packaging-setuptools-imported-setup-call", "conf": 0.95, "crit": 3, "desc": "Imported setuptools setup call", "spans": [ [ 0, 35 ] ] }, { "id": "metadata/build/pip::root-setup-py-path", "conf": 0.98, "crit": 1, "desc": "Shallow setup.py path candidate", "spans": [ [ 0, 0 ] ] }, { "id": "metadata/package/dependencies/declaration::setup-requests-dependency", "conf": 0.9, "crit": 3, "desc": "setup.py declares requests dependency", "spans": [ [ 101, 28 ] ] }, { "id": "micro-behaviors/data/control-flow/module-exec::module-level-side-effect-call", "conf": 0.82, "crit": 3, "desc": "Python module-level function call", "spans": [ [ 29, 103 ] ] }, { "id": "metadata/build/pip::packaging-setup-api-import", "conf": 0.95, "crit": 3, "desc": "Packaging setup API import or call", "uses": [ 0 ], "spans": [ [ 0, 15 ] ] }, { "id": "metadata/build/pip::root-setup-py", "conf": 0.98, "crit": 3, "desc": "Root Python setup.py packaging file", "uses": [ 2, 5 ], "spans": [ [ 0, 15 ] ] } ], "type": "python" }, { "ctx": [ { "b": "x(d*cA=-BxB1wCPD2\u003eIVyiarhefF$AefG7Qy\u00260/{e]\u003eJyB.bSoefFzgB7El^efG4GzdLmvBzbYavpT7\u0026xdLfAy*?A$z/PX4lOY=Ear\u003eGvBz%n]feLNtgbpZtgbgyoi50xHfFCglvq]{lzEENavrujbwI4t2v@DHcBAnSkocuwuvTi6bB0$lDCSe8yfNbxtehhrelm:*nlP3zGCRRYsfNbMpehhr9l[y3pmLOf$3pmrXauZ\u0026]b4j}?zE^W6a$K{DvRGT)BA]5Yb4j}%wG\u0026VHvpBd$BrSmWvpBd#wG\u0026VHvpBp?zGE7J3jprPw/$C(zEU89dlm!UarR!qauZ\u0026*BAe^udo!?\u0026i9!dFzEWP}wHF#marR^HCPYc(vTi6bB0$N6x\u003cz\u0026/awk{MasedDwO@[?dp16dz/M$mazCZoA:-\u0026#wHIwazyx3AdjCPDarR!EwPS6nzxHcmuM{QyayX=2wI#v$vM35OzEWP}wHI^Le[wK6z!9Acdgcz)wO95(B0$MFiTM#LarU=DC@=oParR^HarR!qvrt{2jS[GXz/dgrB.#8sd0)dXB7GxfvqPN1iV}^vzEU89dsAS$wO#0@wmWer3lQDlarR^HaA.Zvy?WuhA+flkwPI@CB-IqpAaJ]nB-Iqmx\u003c@YnwPq\u003c7B963jwPq\u003c7B95/$gaTLUvrt{vwmoN*efFRqvpS}\u0026B3j\u003c]lVl\u003c:wO#Pwrc-B]b03]RAbYScv{%E[z/djyB8L}uEjlY\u0026BzkP6z/{d+gBSUNarR!rCW\u003er7BugK-vrlF%3s)ZWayx80A=U@oBsnO03lQDlaARTHiTM#LarR^HarUxgaAhd9By]Diz7Y)PB97#gc[co4jS\u003e}Ix(mE1Cxj@?3lQDlarR^HarR^HazCXiz/P}xCwg@nwOht)arR^HarR^HarR!xauZ\u0026\u003ex(m%5xd=.FmoJ$+rz(Z-pe\u003eO2q:\u003cN\u003earR^HarR^HarR^HB09Q*AW1C2w]@l9A+eGIx\u003e8g4B8LVjtVUSSwn=WktTJTOA+fcgr+lq)x(v(]qGV\u003e33lQDlarR^HarR^HaA}KwxDRIkzGor3e(cB$zCaL^c#gvRB1wB/efGdJzGor3e\u003eXSouSfx)uSGD^ryFtVvriMiyDq!BarR^HarR^HarR^HarR!Jx(m%5xd^a]Bxh*^B.a0^c#%8Oar\u003cTcBzbPgq!o#)x\u003e7Y#efDR$aA}KqA+e(oqBK8.q^7Z{B9R*VwQ4=@B-.53y?j.tar?{Wv\u003c222x(d*cA=-AFas!NwuV6p?wNw^!d\u003cc3va%FDyarR^HarR^HwO=B0iTM#LarR^HarR^HarUxnAbP=saAIWmAb](bwPI]1arR^HarR^HarR^Hv@9nJaz8/EfeCp8dJ*h-dJ*h-AcVLsz/duNeN][Jx(d*cA=-BJuTEXVzdN6YEj3d3fjXTqfk+]Gy-\u003eF%cnuXKarR^HarR^HarR^HB9g@hA=kD0B8@%OB-5QtcN-FBz/fV9vJWmsatMblwmY{qzGP=ij0n9AxM21qDT*(ua$jTZay/CgzGGq@at1@(aAIjcy?#mlA=\u003e}AaARsmwP8ZkjU[I]arR^HarR^HarR^HA:{jPaA8rNAa9\u003c4e[GoDvqYQ#B7Gwub7qf$vQTs\u003eA:{px3lQDlarR^HarR^HazCBgz/WKIvrufnwQ4{gBAn\u003cJv\u003c%CCarR^HarR^HarR^HarR^HCwhejaA8jgzyxKndiJ5uaz9UwarR^HarR^HarR^HarR^HarR^Hx\u003ewFip\u003cC#JA=#ebwG\u0026mmz/^aozxJKzA+eV\u0026c[dg:arR^HarR^HarR^HarR^HarR^HarR^HCwhejaA8jgzyxKnefDcBa$jTyB0b6Q3lQDlarR^HarR^HarR^HarR^HarR^HarR^Haz9lIA+PSbc$TVdzG6(yxM4=Aat47CcUWBpz/P}xDTyb$vqPN.uWTpAco:7[wP/.AB.\u003e(0zxZIparR^HwQ4Y@Acab-Aa9*e3jprPw/$D4v{%m6dlm!UarR!uauZ\u0026=B1RAuBz9prCYm8ewoz%8AWSbXa$i\u003cwarR!sz/M$vemf@uB0bgmaA8rNCvtr6c$\u003e4\u003c3lQDlarR^HazbLjazbHlx(k59B2\u003cTJarR^HarR^HarR!sA3dp^z/WKIvrufnyhW*7c#{\u003cYw]o48arR^HarR^HarR^HBAhT/3lQDlarR^HarR^HarR^HaAFU*aA8rNAa9\u003c4e[X:qB7]@ic$WAE3lQDlarR^HarR^HarR^HazCBgB09T?gb7yofFBR/AV/ACjrMvjiV}{JzGGPgB.7[5arR^HarR^HarR^HarR!Az6g$:w]okqz*b=kc[bGCarR^HarR^HarR^HarR!vw/$#fBrC1fC{)+Sx(k5hz6iCeAV/DDx(k4$b6NEiy?mYjefYdDwN(#ob5p+na$K{EvpK7}A3u?SAb]Vovru68efX}GwO(v6x\u003e5trb64m8z*2YjC{j^-B7F\u003c4wPPaEb4CUsAcc1xefY4DA::32a$K{SvrlGlefX}xByx2{B88%Jb5?j7zGG/la$K{NwQeusz/Pzkt}4/warR^HarR^HarR^HarR^HarR^Hx\u003ewG9z/^alzz30LvrcEhCwhejc)zU\u003clOf(ldiJ5pwftG4ar-(\u003ca$^CAB%n%\u0026v@Dmbx(n683lQDlarR^HarR^HarR^HaA}KwxDRkjwO@]dA4AbyA=M8sB3gZYxkRTdwG\u0026MCvriM6xGvnCauZ\u0026VxFaspvpQ=zfFCgf3lQDlarR^HarR^HarR^HazCBgw]n.OjS\u003e}3wO#VniTM#LarR^HarR^HarR^HarR^HarUomAV/gjzE\u003c@8zxJBwB8U@fBsntrzxZI\u003c3lQDlarR^HarR^HarR^HarR^HarR^HazCBgb2zferZxXNa%pPqaz++fwGU]iar\u003c-MlScuLa%pPqaz++fwJyevarR^HarR^HarR^HarR^HarR^HarR^HarR!IauZ\u0026-x(mGmB8U@fBsns@a$l.Ff\u003cMzMBAh8mc[bGCarR^HarR^HarR^HarR^HarR^HarR^HarR!vw/#mTayxgrB$0+varR^HarR^HarR^HarR!ry\u0026:eG3lQDlarR^HarR^HarR^HarR^HaA}(HjS[/SBspSKy\u0026sJeAWSv?A@", "ln": 0, "col": 1, "line": 1 }, { "b": "arR^HarR!rCW\u003er7BugK-vrlF%arR^HBAhT/3lQDlarR^HazCXiz/P}xBzCPdBy/F1arR^HarR^HBrAZ?BzCPdBy/FBrbi)hj0nR$Cwhejwo8a5c[dk2v\u003c0]SBs}6tx(EK1vrb)=xjVfkdlwU]e[wKmBAhqBc[bGCarR^HarR!vw/$OavqYP#y?mGjv\u003c@J:atLSiayxgrv{p#Ji9^%uarR^HwQ4Y@Acab-Aa9*e3jprPw/$C%z/oOydlm!UarR!lB7nS@c[bGCarR!JxLzo]axix7wJyevarR^HarR!Gx(dAlB8kA0A40C2fFB{.arR^HarR^HuVPZ=zyu}v3uQrliV}^GwPz\u003caB95/V3t1D(wPh-LaAg+gA%^25A+eV\u0026x(mMora{q-vpQ^dvrc0(BuJ#Ez/oOCay[[(zeTqPrc0a)dk2W-vrcDrdgc", "ln": 2620, "col": 6, "line": 58 } ], "depth": 1, "facts": { "imp": [ [ "", "bytes" ], [ "", "str(d)[:48].encode" ], [ "", "str" ], [ "", "bytes" ], [ "", "len" ], [ "", "range" ], [ "", "len" ], [ "", "base64.b64encode(x).decode" ], [ "", "base64.b64encode" ], [ "", "json.dumps({\"username\": _enc(d)}).encode" ], [ "", "json.dumps" ], [ "", "enc" ], [ "", "urllib.request.urlopen" ], [ "", "urllib.request.Request" ], [ "", "platform.system" ], [ "", "winreg.OpenKey" ], [ "", "winreg.SetValueEx" ], [ "", "subprocess.run" ], [ "", "os.path.expanduser" ], [ "", "os.path.exists" ], [ "", "open" ], [ "", "f.read" ], [ "", "open" ], [ "", "f.write" ], [ "", "os.path.expanduser" ], [ "", "os.walk" ], [ "", "os.path.join" ], [ "", "os.path.getsize" ], [ "", "fn.lower" ], [ "", "any" ], [ "", "fn.startswith" ], [ "", "open" ], [ "", "fh.read" ], [ "", "c.split" ], [ "", "line.split(\"=\")[-1].strip" ], [ "", "line.split" ], [ "", "set" ], [ "", "c.lower().split" ], [ "", "c.lower" ], [ "", "len" ], [ "", "re.findall" ], [ "", "tkinter.Tk" ], [ "", "t.withdraw" ], [ "", "t.clipboard_get" ], [ "", "t.destroy" ], [ "", "len" ], [ "", "scan" ], [ "", "time.sleep" ], [ "", "scan" ], [ "", "persist" ], [ "", "threading.Thread(target=_loop, daemon=True).start" ], [ "", "threading.Thread" ], [ "", "base64" ], [ "", "json" ], [ "", "os" ], [ "", "platform" ], [ "", "re" ], [ "", "subprocess" ], [ "", "sys" ], [ "", "threading" ], [ "", "time" ], [ "", "tkinter" ], [ "", "urllib.request" ], [ "", "winreg" ] ], "mbr": [ "base64.b64encode", "base64.b64encode().decode", "c.lower", "c.lower().split", "c.split", "f.read", "f.write", "fh.read", "fn.lower", "fn.startswith", "json.dumps", "json.dumps().encode", "line.split", "os.path", "os.path.exists", "os.path.expanduser", "os.path.getsize", "os.path.join", "os.walk", "platform.system", "re.findall", "subprocess.run", "sys.executable", "t.clipboard_get", "t.destroy", "t.withdraw", "threading.Thread", "threading.Thread().start", "time.sleep", "tkinter.Tk", "urllib.request", "urllib.request.Request", "urllib.request.urlopen", "winreg.HKEY_CURRENT_USER", "winreg.KEY_SET_VALUE", "winreg.OpenKey", "winreg.REG_SZ", "winreg.SetValueEx" ], "tgt": [ "_enc", "_persist", "_s", "_scan", "any", "base64.b64encode", "base64.b64encode().decode", "bytes", "c.lower", "c.lower().split", "c.split", "f.read", "f.write", "fh.read", "fn.lower", "fn.startswith", "json.dumps", "json.dumps().encode", "len", "line.split", "open", "os.path.exists", "os.path.expanduser", "os.path.getsize", "os.path.join", "os.walk", "platform.system", "range", "re.findall", "set", "str", "subprocess.run", "t.clipboard_get", "t.destroy", "t.withdraw", "threading.Thread", "threading.Thread().start", "time.sleep", "tkinter.Tk", "urllib.request.Request", "urllib.request.urlopen", "winreg.OpenKey", "winreg.SetValueEx" ], "funcs": [ [ "_enc", 246 ], [ "_s", 395 ], [ "_persist", 617 ], [ "_scan", 1566 ], [ "_loop", 2806 ] ], "metrics": { "ast": { "op.add": 4, "op.lor": 2, "op.mod": 1, "op.sub": 1, "op.xor": 1, "op.band": 1, "op.land": 2, "max_depth": 23, "call_count": 56, "node_count": 1217, "member_count": 38, "max_array_len": 14, "op_density.add": 0, "op_density.lor": 0, "op_density.mod": 0, "op_density.sub": 0, "op_density.xor": 0, "op_density.band": 0, "op_density.land": 0, "max_concat_chain": 4, "member_depth_max": 3, "max_numeric_array": 8, "xor_mod_loop_count": 1, "infinite_loop_count": 1 }, "file": { "size": 2970, "entropy": 4.69 }, "text": { "lines": 73, "top_char": 101, "max_ws_run": 1, "digit_ratio": 0.05, "space_count": 877, "char_entropy": 4.69, "unique_chars": 89, "top_char_null": 0, "string_density": 0.63, "top_char_ratio": 0.05, "avg_line_length": 39.68, "max_line_length": 176, "empty_line_ratio": 0.08, "last_line_length": 51, "long_token_count": 1, "whitespace_ratio": 0.32, "identifier_density": 2.81, "line_length_stddev": 32.39, "normalized_string_count": 5.38, "repeated_char_sequences": 32, "suspicious_string_ratio": 0.13, "suspicious_identifier_ratio": 0.14, "normalized_unique_identifiers": 14.86 }, "binds": { "count": 19 }, "binary": { "peak_region_bytes": 1024, "peak_region_entropy": 5.15 }, "source": { "function_count": 5 }, "imports": { "count": 12, "stdlib_count": 10, "stdlib_ratio": 0.83, "third_party_count": 2, "third_party_ratio": 0.17 }, "strings": { "bytes": 516, "count": 46, "shell": 3, "url_count": 1, "avg_length": 11.22, "max_length": 59, "path_count": 3, "avg_entropy": 2.44, "entropy_stddev": 1.16, "embedded_code_candidates": 3 }, "functions": { "count": 5, "density": 6.85, "avg_params": 0.4, "code_ratio": 0.82, "max_params": 1, "length_stddev": 9.34, "avg_name_length": 4.8, "no_params_count": 3, "avg_length_lines": 12, "max_length_lines": 27, "min_length_lines": 4, "single_char_params": 2, "avg_param_name_length": 1 }, "identifiers": { "count": 205, "unique": 92, "avg_length": 4.86, "max_length": 17, "min_length": 1, "avg_entropy": 1.8, "reuse_ratio": 0.45, "length_stddev": 3.11, "has_digit_ratio": 0.03, "sequential_names": 13, "single_char_count": 13, "single_char_ratio": 0.14, "high_entropy_count": 1, "high_entropy_ratio": 0.01, "all_lowercase_ratio": 0.86, "all_uppercase_ratio": 0.07, "numeric_suffix_count": 2, "double_underscore_count": 1, "underscore_prefix_count": 7 } } }, "id": 3, "mol": "O₃(EuC₂P)H₇(Cm₇CrDb₂F₃Os₆Po₃U)", "path": "web3_tool_sdk-1.0.0.tar.gz!!web3-tool-sdk-1.0.0/web3_tool_sdk.py", "pid": 0, "risk": 169, "sha": "3f2ed9adf3b046a7871989d52dc51251f779932b63fe1f0346d69adbb7f05b7e", "size": 2970, "traits": [ { "id": "micro-behaviors/os/autorun/scheduled::crontab-echo-pipe", "conf": 0.9, "crit": 3, "desc": "Echoes a generated entry into crontab", "spans": [ [ 1166, 28 ] ] }, { "id": "micro-behaviors/communications/http/header/content-type::python-json-content-type", "conf": 0.94, "crit": 1, "desc": "Python JSON content type", "spans": [ [ 567, 0 ] ] }, { "id": "micro-behaviors/communications/http/lib/urllib::urllib-request-data-body", "conf": 0.9, "crit": 3, "desc": "urllib Request carries an HTTP body", "spans": [ [ 481, 103 ], [ 504, 82 ] ] }, { "id": "micro-behaviors/communications/http/lib/urllib::urllib-request-symbol", "conf": 0.82, "crit": 3, "desc": "urllib.request.Request symbol", "spans": [ [ 504, 22 ] ] }, { "id": "micro-behaviors/communications/http/lib/urllib::urllib-urlopen-call-symbol", "conf": 0.85, "crit": 3, "desc": "Calls fully qualified urllib urlopen", "spans": [ [ 481, 22 ] ] }, { "id": "micro-behaviors/communications/http/lib/urllib::urllib-urlopen-data", "conf": 0.85, "crit": 3, "desc": "urlopen with data parameter (potential POST)", "spans": [ [ 488, 48 ] ] }, { "id": "micro-behaviors/data/control-flow/analysis::while-loop", "conf": 0.3, "crit": 2, "desc": "While-loop control flow", "spans": [ [ 2831, 0 ] ] }, { "id": "micro-behaviors/data/serialize/json::json-dumps-call", "conf": 0.9, "crit": 2, "desc": "Serializes data with Python json.dumps()", "spans": [ [ 430, 0 ] ] }, { "id": "micro-behaviors/fs/directory/traverse::traverse-walk", "conf": 0.66, "crit": 2, "desc": "Traverse filesystem hierarchy (os.walk)", "spans": [ [ 1629, 0 ] ] }, { "id": "micro-behaviors/fs/directory/traverse::traverse-walk-call", "conf": 0.84, "crit": 3, "desc": "Calls os.walk for filesystem enumeration", "spans": [ [ 1629, 7 ] ] }, { "id": "micro-behaviors/fs/path/location::home-hidden-dotpath", "conf": 0.85, "crit": 3, "desc": "Hidden dot-entry under the home directory", "spans": [ [ 1265, 15 ] ] }, { "id": "micro-behaviors/fs/read/file::file-open-content", "atk": "T1005", "mbc": "E1005", "conf": 0.86, "crit": 2, "desc": "Opens file in default read mode", "spans": [ [ 1350, 0 ] ] }, { "id": "micro-behaviors/fs/read/file::file-read-content", "atk": "T1005", "mbc": "E1005", "conf": 0.6, "crit": 2, "desc": "Reads file content (Python)", "spans": [ [ 1403, 0 ] ] }, { "id": "micro-behaviors/os/autorun/scheduled::crontab-option", "conf": 0.6, "crit": 3, "desc": "crontab command option", "spans": [ [ 1166, 10 ] ] }, { "id": "micro-behaviors/os/autorun/scheduled::crontab-shell-pipe", "conf": 0.9, "crit": 3, "desc": "Python shell-pipes a cron entry into crontab", "spans": [ [ 1166, 48 ] ] }, { "id": "micro-behaviors/os/autorun/scheduled::crontab-string", "conf": 0.95, "crit": 3, "desc": "Crontab list or input command", "spans": [ [ 1166, 10 ] ] }, { "id": "micro-behaviors/os/registry/access::python-winreg-import", "conf": 1.0, "crit": 3, "desc": "Python winreg import", "spans": [ [ 697, 13 ] ] }, { "id": "micro-behaviors/os/registry/access::winreg-openkey", "conf": 0.8, "crit": 3, "desc": "Opens a Windows registry key", "spans": [ [ 834, 14 ] ] }, { "id": "micro-behaviors/os/registry/manipulate::winreg-setvalue", "conf": 0.8, "crit": 3, "desc": "Sets a Windows registry value", "spans": [ [ 903, 17 ] ] }, { "id": "micro-behaviors/os/sysinfo/platform/runtime::platform-system", "atk": "T1082", "conf": 0.7, "crit": 3, "desc": "Queries the OS with platform.system()", "spans": [ [ 653, 15 ] ] }, { "id": "micro-behaviors/os/sysinfo/platform/runtime::python-platform-branch", "atk": "T1082", "conf": 0.82, "crit": 3, "desc": "Python branches on OS platform", "spans": [ [ 653, 29 ] ] }, { "id": "micro-behaviors/process/create/thread::python-daemon-thread", "conf": 0.8, "crit": 3, "desc": "Creates a daemon thread in Python", "spans": [ [ 2927, 33 ] ] }, { "id": "micro-behaviors/time/sleep/interval::python-sleep-1s-plus-arg", "conf": 0.75, "crit": 1, "desc": "Python sleep waits at least one second", "spans": [ [ 2859, 0 ] ] }, { "id": "micro-behaviors/time/sleep/interval::python-sleep-call", "conf": 0.65, "crit": 2, "desc": "Pauses execution with a Python sleep call", "spans": [ [ 2855, 0 ] ] }, { "id": "micro-behaviors/ui/framework/tkinter::tkinter-init", "conf": 0.9, "crit": 3, "desc": "Initializes Tkinter GUI", "spans": [ [ 2684, 10 ] ] }, { "id": "objectives/command-and-control/dropper/python-script::python-currentversion-run", "atk": "T1105", "mbc": "B0024", "conf": 0.9, "crit": 3, "desc": "Writes a CurrentVersion Run path", "spans": [ [ 797, 18 ] ] }, { "id": "objectives/persistence/system/cron/schedule::pipe-crontab", "atk": "T1053.003", "conf": 0.6, "crit": 3, "desc": "Pipe to crontab stdin", "spans": [ [ 1203, 11 ] ] }, { "id": "micro-behaviors/communications/http/client/library::urllib-request", "conf": 0.8, "crit": 3, "desc": "Imports Python urllib.request HTTP client", "spans": [ [ 26, 14 ] ] }, { "id": "micro-behaviors/communications/http/header/content-type::json-header", "conf": 0.9, "crit": 3, "desc": "References HTTP Content-Type application/json", "spans": [ [ 552, 31 ] ] }, { "id": "micro-behaviors/communications/http/lib/urllib::urllib-urlopen", "conf": 0.7, "crit": 3, "desc": "Calls urllib.request.urlopen", "spans": [ [ 481, 22 ] ] }, { "id": "micro-behaviors/communications/http/lib/urllib::urllib-word", "conf": 0.75, "crit": 3, "desc": "References Python urllib HTTP client", "spans": [ [ 481, 15 ] ] }, { "id": "micro-behaviors/communications/http/request/client::python-request-data-argument", "conf": 0.84, "crit": 3, "desc": "Python Request call passes a body argument", "spans": [ [ 481, 103 ], [ 504, 82 ] ] }, { "id": "micro-behaviors/communications/http/url/scheme::cleartext-http-url-code-literal", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Code embeds cleartext HTTP URL literal", "spans": [ [ 82, 20 ] ] }, { "id": "micro-behaviors/communications/ip/literal::external-ipv4-http-url", "conf": 0.9, "crit": 1, "desc": "Text contains raw external-IP HTTP URL", "spans": [ [ 82, 0 ] ] }, { "id": "micro-behaviors/communications/ip/literal::external-ipv4-url-script", "conf": 0.9, "crit": 3, "desc": "Script embeds external IPv4 URL", "spans": [ [ 82, 25 ] ] }, { "id": "micro-behaviors/communications/ip/literal::http-ip-url-source-literal", "conf": 0.95, "crit": 1, "desc": "Source literal contains an external-IP HTTP URL", "spans": [ [ 82, 0 ] ] }, { "id": "micro-behaviors/crypto/symmetric/xor/loop::xor-modulo-key-loop", "conf": 0.8, "crit": 3, "desc": "Loop XORs through modulo-indexed accumulator", "spans": [ [ 0, 29 ] ] }, { "id": "micro-behaviors/data/control-flow/module-exec::module-level-side-effect-call", "conf": 0.82, "crit": 3, "desc": "Python module-level function call", "spans": [ [ 2918, 51 ] ] }, { "id": "micro-behaviors/data/encode/base64::b64encode-call", "conf": 0.9, "crit": 3, "desc": "Encodes data with Python base64.b64encode()", "spans": [ [ 365, 16 ] ] }, { "id": "micro-behaviors/data/encode/base64::import-base64", "conf": 0.9, "crit": 3, "desc": "Imports Python's base64 module", "spans": [ [ 42, 6 ] ] }, { "id": "micro-behaviors/fs/directory/traverse::traverse-readdir-walk-find", "conf": 0.85, "crit": 2, "desc": "Traverses directories using common APIs", "spans": [ [ 1629, 0 ] ] }, { "id": "micro-behaviors/fs/file/open::write-append-create-mode", "conf": 0.85, "crit": 3, "desc": "Python file opened for write or append", "spans": [ [ 1441, 13 ] ] }, { "id": "micro-behaviors/os/clipboard/access::clipboard-keyword", "conf": 0.7, "crit": 1, "desc": "Clipboard keyword", "spans": [ [ 2718, 0 ] ] }, { "id": "micro-behaviors/os/clipboard/access::tkinter-clipboard-get-method", "conf": 0.9, "crit": 3, "desc": "clipboard_get method call", "spans": [ [ 2716, 15 ] ] }, { "id": "micro-behaviors/os/registry/keys::currentversion-run", "conf": 0.75, "crit": 3, "desc": "Accesses Windows CurrentVersion Run key", "spans": [ [ 797, 19 ] ] }, { "id": "micro-behaviors/os/sysinfo/platform/string::os-string-windows", "conf": 0.4, "crit": 2, "desc": "Windows platform string", "spans": [ [ 768, 0 ] ] }, { "id": "micro-behaviors/process/create/subprocess::import-subprocess", "atk": "T1059.006", "mbc": "E1059.006", "conf": 0.95, "crit": 3, "desc": "Imports Python's subprocess module", "spans": [ [ 1045, 10 ] ] }, { "id": "micro-behaviors/process/create/subprocess::run-ast", "atk": "T1059.006", "mbc": "C0017", "conf": 0.85, "crit": 3, "desc": "Calls subprocess.run to launch a process", "spans": [ [ 1148, 14 ] ] }, { "id": "micro-behaviors/process/create/thread::python-thread-create", "conf": 0.65, "crit": 3, "desc": "Creates a thread in Python", "spans": [ [ 2927, 8 ] ] }, { "id": "micro-behaviors/process/interpreter/shell::shell-init-path", "conf": 0.84, "crit": 3, "desc": "Shell startup file path reference", "spans": [ [ 1278, 8 ] ] }, { "id": "objectives/persistence/login/startup/registry::software-run-key", "atk": "T1547.001", "conf": 0.7, "crit": 1, "desc": "References SOFTWARE Run path only", "spans": [ [ 770, 0 ] ] }, { "id": "micro-behaviors/communications/http/client/library::urllib-request-client-import", "conf": 0.82, "crit": 3, "desc": "Imports Python urllib.request through direct or from-import syntax", "uses": [ 27 ], "spans": [ [ 26, 14 ] ] }, { "id": "micro-behaviors/communications/http/lib/urllib::urllib-request-object", "conf": 0.82, "crit": 3, "desc": "urllib Request object creation", "uses": [ 3 ], "spans": [ [ 504, 22 ] ] }, { "id": "micro-behaviors/fs/directory/traverse::recursive-directory-traversal", "conf": 0.86, "crit": 3, "desc": "Recursive directory traversal logic", "uses": [ 8, 40 ], "spans": [ [ 1629, 7 ] ] }, { "id": "micro-behaviors/os/registry/access::python-reg-run-access", "mbc": "F0006", "conf": 0.95, "crit": 3, "desc": "Python Windows registry Run key access", "uses": [ 16, 44 ], "spans": [ [ 697, 13 ], [ 797, 19 ] ] }, { "id": "micro-behaviors/time/sleep/interval::python-sleep-1s-plus", "conf": 0.75, "crit": 1, "desc": "Python one-second-plus sleep", "uses": [ 22, 23 ], "spans": [ [ 2855, 0 ], [ 2859, 0 ] ] }, { "id": "objectives/execution/condition/platform::has-os-check", "conf": 0.6, "crit": 1, "desc": "Checks for OS platform", "uses": [ 45 ], "spans": [ [ 768, 0 ] ] }, { "id": "objectives/persistence/login/startup/registry::windows-registry-run", "atk": "T1547.001", "conf": 0.9, "crit": 3, "desc": "Accesses Windows registry Run key", "uses": [ 50 ], "spans": [ [ 770, 46 ] ] }, { "id": "micro-behaviors/communications/http/request/client::urllib-json-request-body", "conf": 0.9, "crit": 3, "desc": "urllib JSON request with body", "uses": [ 5, 7, 51, 52 ], "spans": [ [ 26, 14 ], [ 430, 10 ], [ 488, 48 ] ] }, { "id": "objectives/exfiltration/http/collect::collected-json-posted-to-external-ip", "atk": "T1041,T1071.001", "mbc": "E1041", "conf": 0.96, "crit": 5, "desc": "Collected data posted as JSON to external IP", "uses": [ 34, 58 ], "spans": [ [ 26, 14 ], [ 82, 25 ], [ 430, 10 ], [ 488, 48 ] ] }, { "id": "micro-behaviors/communications/ip/literal::http-ip-url", "conf": 0.95, "crit": 3, "desc": "Contains an external-IP HTTP URL", "uses": [ 33, 35 ], "spans": [ [ 82, 26 ] ] }, { "id": "micro-behaviors/process/create/subprocess::process-execution", "atk": "T1059.006", "conf": 0.8, "crit": 3, "desc": "Python launches a child process", "uses": [ 47 ], "spans": [ [ 1136, 27 ], [ 1148, 14 ] ] }, { "id": "micro-behaviors/communications/ip/direct::external-ipv4-http-endpoint", "atk": "T1071.001", "mbc": "C0002", "conf": 0.95, "crit": 3, "desc": "HTTP endpoint uses external IPv4", "uses": [ 60 ], "spans": [ [ 82, 26 ] ] }, { "id": "objectives/command-and-control/channel/http/transport::direct-ip-http-channel", "atk": "T1071.001", "mbc": "C0002", "conf": 0.93, "crit": 4, "desc": "Direct-IP HTTP communication channel", "uses": [ 60, 62 ], "spans": [ [ 82, 26 ] ] } ], "type": "python" } ], "rev": "479f3", "v": "8" } }