{ "llm": { "conf": 0.35248232, "grade": "benign", "model": "Qwen/Qwen3.6-27B", "outcome": "benign", "interpretation": "Legitimate encryption library source code" }, "ml": { "v": "7", "eng": "2.3.0-beta.1", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.074974716, "rte": "az", "prob": 0.074974716 } ], "prob": 0.074974716, "skip": [ { "rte": "az/whl", "why": "unavailable" }, { "rte": "az/whl", "why": "unavailable" } ], "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.07497471570968628, "type": "whl" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.00003427267074584961, "type": "python" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.0012371838092803955, "type": "python" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.005262881517410278, "type": "text" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.019015371799468994, "type": "pkg_info" }, { "id": 5, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "text" }, { "id": 6, "lvl": -1, "conf": 0, "prob": 0.000306934118270874, "type": "registry" } ], "version": "v18.18", "analyzed_at": "2026-07-10T09:05:47Z" }, "path": "eggcrypt-3.0.0-py3-none-any.whl", "raw": { "files": [ { "id": 0, "ctx": [ { "b": "p!H([6Awak2MM+L(rHw-Ko^on001OJ000Yk003OyxjC$cAc9:uuUKy(ByexcAcU8b+fK8moheh-:JMj", "n": [ { "c": 2, "d": "Python wheel archive basename", "i": "metadata/file/extension/identity::python-wheel-basename", "o": 0, "z": 31, "cf": 0.949999988079071 } ], "ln": 0 } ], "mol": "O(As)H(Db)", "sha": "eaba7548af1855a4ceb69558e19a60f7cc2a9d799f2c4831376aecb592c8e0e3", "path": "eggcrypt-3.0.0-py3-none-any.whl", "risk": 3, "size": 3915, "type": "whl", "facts": { "metrics": { "whl": { "native_extension_count": 0.0 }, "file": { "size": 3915.0, "entropy": 7.67, "size_bytes": 3915.0 }, "binary": { "overall_entropy": 7.67, "peak_region_bytes": 3072.0, "peak_region_entropy": 7.78 }, "archive": { "file_count": 7.0, "member_count": 7.0, "script_count": 2.0, "zip_bomb_ratio": 3.81, "directory_count": 0.0, "executable_count": 0.0, "extra_field_size": 0.0, "noise_file_count": 0.0, "total_compressed": 2945.0, "compression.ratio": 0.37, "hidden_file_count": 0.0, "total_uncompressed": 7897.0, "crc_collision_count": 0.0, "entry_comment_count": 0.0, "max_filename_length": 41.0, "rtlo_filename_count": 0.0, "format.regular_count": 7.0, "nested_archive_count": 0.0, "path_traversal_count": 0.0, "symlink_escape_count": 0.0, "security.setgid_count": 0.0, "security.setuid_count": 0.0, "security.sticky_count": 0.0, "double_extension_count": 0.0, "duplicate_member_count": 0.0, "security.symlink_count": 0.0, "unicode_filename_count": 0.0, "homoglyph_filename_count": 0.0, "security.encrypted_count": 0.0, "timing.mtime_unique_count": 2.0, "timing.mtime_unique_ratio": 0.29, "misplaced_executable_count": 0.0, "timing.mtime_outlier_count": 2.0, "timing.mtime_dominant_count": 5.0, "timing.mtime_spread_seconds": 12.0, "timing.sentinel_mtime_count": 0.0, "security.world_writable_count": 0.0, "timing.mtime_dominant_fraction": 0.71, "compression.method_counts.deflate": 7.0 } } }, "ident": { "name": { "value": "eggcrypt", "source": "whl.distribution", "verified": false }, "trust": "unsigned", "authors": [ { "name": "Egglord", "role": "author", "source": "whl.author" } ], "version": { "value": "3.0.0", "source": "whl.version", "verified": false } }, "traits": [ { "id": "metadata/package/quality/ecosystem::pkginfo-version-field", "conf": 0.8999999761581421, "crit": 1, "desc": "PKG-INFO declares package version", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/data/encode/xor::xor-decoding-loop", "conf": 0.800000011920929, "crit": 3, "desc": "XOR decoding loop with modulo", "from": [ { "file": 2 } ] }, { "id": "objectives/anti-static/obfuscation/eval/dropper::py-chr-join-decode", "atk": "T1027", "conf": 0.8500000238418579, "crit": 3, "desc": "chr-join character assembly transform", "from": [ { "file": 2 } ] }, { "id": "metadata/package/quality/ecosystem::pkginfo-core-metadata", "conf": 1.0, "crit": 1, "desc": "Python core metadata marker", "from": [ { "file": 4 } ] }, { "id": "metadata/package/quality/ecosystem::pkginfo-name-field", "conf": 0.8999999761581421, "crit": 1, "desc": "PKG-INFO declares package name", "from": [ { "file": 4 } ] }, { "id": "metadata/package/quality/ecosystem::pkginfo-summary-field", "conf": 0.8999999761581421, "crit": 1, "desc": "PKG-INFO declares package summary", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/crypto/library/keyword::encrypt-keyword", "conf": 0.4000000059604645, "crit": 3, "desc": "Generic 'encrypt' term in strings", "from": [ { "file": 1 } ] }, { "id": "objectives/supply-chain/impersonation/package/wheel-sdist::pkginfo-security-claim-1--secur", "atk": "T1036.005", "mbc": "F0004", "conf": 0.6499999761581421, "crit": 1, "desc": "pkginfo security claim 1 (secur)" }, { "id": "metadata/package/quality/ecosystem::pkginfo-license-file", "conf": 0.8999999761581421, "crit": 1, "desc": "PKG-INFO declares license file", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/data/encode/xor::xor-bytearray-mutating-loop", "atk": "T1027", "mbc": "B0032", "conf": 0.9200000166893005, "crit": 3, "desc": "bytearray in-place XOR mutation loop", "from": [ { "file": 2 } ] } ] }, { "ctx": [ { "b": "w].*batdkrxcp]9AbP=saz2C2A^qRCefFFmv@=\u003clBsXLIwQb*HxKL%}", "n": [ { "c": 2, "d": "Python file extension", "i": "metadata/file/extension/identity::py", "o": 0, "z": 11, "cf": 1.0 }, { "c": 1, "d": "Literal 'encrypt' crypto-operation term", "i": "micro-behaviors/crypto/library/keyword::encrypt-keyword", "o": 17, "z": 7, "cf": 0.4000000059604645 } ], "ln": 1, "addr": 0 }, { "b": "", "ln": 2, "addr": 45 } ], "depth": 1, "facts": { "imp": [ [ "", ".egg" ], [ "", ".egg.decrypt" ], [ "", ".egg.encrypt" ], [ "", ".egg.hash" ], [ "", ".egg.key" ] ], "metrics": { "ast": { "max_depth": 4.0, "call_count": 0.0, "node_count": 20.0, "identifier_count": 5.0 }, "file": { "size": 45.0, "entropy": 4.15, "size_bytes": 45.0 }, "text": { "space_count": 6.0, "total_lines": 1.0, "char_entropy": 4.15, "unique_chars": 21.0, "avg_line_length": 44.0, "max_line_length": 44.0, "last_line_length": 44.0, "whitespace_ratio": 0.16, "most_common_ratio": 0.09, "identifier_density": 5.0, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 1.0, "most_common_char_codepoint": 114.0 }, "binary": { "overall_entropy": 4.15, "peak_region_bytes": 45.0, "peak_region_entropy": 4.15 }, "imports": { "count": 5.0, "relative_ratio": 1.0, "unique_modules": 5.0, "relative_imports": 5.0, "third_party_count": 5.0, "third_party_ratio": 1.0 }, "identifiers": { "count": 5.0, "total": 5.0, "avg_length": 4.8, "max_length": 7.0, "min_length": 3.0, "avg_entropy": 1.92, "reuse_ratio": 1.0, "unique_count": 5.0, "length_stddev": 1.83, "all_lowercase_ratio": 1.0 } } }, "id": 1, "path": "eggcrypt-3.0.0-py3-none-any.whl!!eggcrypt/__init__.py", "pid": 0, "risk": 1, "sha": "8a5f583fbe4731afc5d418a898d7adad15c027241f4c59a1baa6d5b95f6bbcec", "size": 45, "traits": [ { "id": "metadata/file/extension/identity::python-artifact-extension", "conf": 1.0, "crit": 1, "desc": "Python source, stub, or bytecode extension", "spans": [ [ 0, 11 ] ] }, { "id": "metadata/file/metrics::low-overall-entropy-source", "conf": 0.8999999761581421, "crit": 2, "desc": "Source file has low overall entropy", "spans": [ [ 0, 29 ] ] }, { "id": "metadata/file/extension/identity::py", "conf": 1.0, "crit": 2, "desc": "Python file extension", "spans": [ [ 0, 11 ] ] } ], "type": "python" }, { "ctx": [ { "b": "wmYu}xKL%}gal\u003cOA49*", "n": [ { "c": 4, "d": "Python single-byte stream-decode pattern (any form)", "i": "objectives/anti-static/obfuscation/encoding/arithmetic::python-stream-decode-aggregator", "o": 0, "z": 18, "cf": 0.9399999976158142 } ], "ln": 1, "addr": 0 }, { "b": "arR^Hx(m(MB98BJx(m(s", "ln": 2, "addr": 16 }, { "b": "arR^HniHfhCRR9iw\u0026s6Si5\u0026^7gCy!0gB$k8f/7KAiajNNfF+Twh-0oEehhrSg+Z{Ci5ilAixpXcf\u003eq%?fNbohgg+6aixgOWg?wNPi5$m", "ln": 3, "addr": 33 }, { "b": "arR^Hw]zYjx!i:px(k58zGP/cA::63c#0Nrdlm", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 121, "z": 3, "cf": 0.800000011920929 } ], "ln": 4, "addr": 117 }, { "b": "arR^HarR!Kj-tvKc$sXRc$$!ai4j", "ln": 5, "addr": 148 }, { "b": "arR^HarR!wj.Vi0", "ln": 6, "addr": 171 }, { "b": "arR^HarR^$twvCIj:l", "n": [ { "c": 3, "d": "bytearray in-place XOR mutation loop", "i": "micro-behaviors/data/encode/xor::xor-bytearray-mutating-loop", "o": 191, "z": 7, "cf": 0.9200000166893005 } ], "ln": 7, "addr": 184 }, { "b": "arR^HarR^$twvCbc}EMSt}dKMf!+pnfFCgmf\u003e8{/cnoWRw[CT!w[CT!w[CT!w[CS", "n": [ { "c": 1, "d": "Regex component marker", "i": "objectives/anti-static/obfuscation/encoding/arithmetic::add-mod-bytes-genexpr--rx-3", "o": 217, "z": 5, "cf": 0.9300000071525574 } ], "ln": 8, "addr": 199 }, { "b": "arR^HarR^$tpskpf!1z9u0YV+twvCcj#1$", "ln": 9, "addr": 251 }, { "b": "arR^HyH}=#B98B=cNQJYz!T8qw*.}IiXSoDCZQ}Zw]zYjCPZZrav){", "n": [ { "c": 2, "d": "Iteration or loop pattern", "i": "micro-behaviors/data/control-flow/analysis::iteration-loop-pattern", "o": 310, "z": 10, "cf": 0.5 } ], "ln": 10, "addr": 279 }, { "b": "arR^HBz(m:B9hsFc$$g^djPmRwgg}pazbLjazAxpazCZowO#TcwPzj3wHIt9D0+SmAW-B", "ln": 11, "addr": 323 }, { "b": "arR^Hw]zYjx=}bcazC.jiS", "ln": 12, "addr": 379 }, { "b": "arR^Hz/{d+a%E", "ln": 14, "addr": 417 }, { "b": "arR^Hw]zYjx=}bcazULluVQsfiS", "ln": 15, "addr": 428 }, { "b": "arR^HarR^HC0fLSBsp\u0026Of/yD", "n": [ { "c": 2, "d": "Hex decoding via int(x, 16)", "i": "micro-behaviors/data/decode/hex::hex-decode-int-16", "o": 460, "z": 9, "cf": 0.699999988079071 } ], "ln": 16, "addr": 450 }, { "b": "arR^HarR^Hz/{dLj-+Z=d0v9?d0fxHdT0l!gbQ%sdf", "ln": 17, "addr": 470 }, { "b": "arR^Hz-]o*", "ln": 18, "addr": 504 }, { "b": "arR^HarR!ujT.Z(juLtOdsrKSau?$igbH^odjcC\u003ef*4MNh8V)nf!0", "ln": 28, "addr": 810 }, { "b": "arR^HarR!ujT:$[fNbP?gDdlMvMuwVg*@sMf/pybc[3/jjtF=Ldj)n6", "ln": 29, "addr": 853 }, { "b": "arR^Hv}Yp\u003eB3gZ3f!$Kwh8WxMiBMxbwmYv=xLzi%y\u0026a6dAb/]tBAI+JCZjPV", "n": [ { "c": 2, "d": "Lowercase hexadecimal alphabet string", "i": "metadata/file/string/charset::lowercase-hex-alphabet", "o": 909, "z": 16, "cf": 0.20000000298023224 } ], "ln": 30, "addr": 898 }, { "b": "arR^HCS^k{", "ln": 31, "addr": 947 }, { "b": "arR^HCw7YbwGUUECS/LIvrcA[xEbC)t}pdYxFh24gD2", "n": [ { "c": 2, "d": "while loop pattern", "i": "micro-behaviors/data/control-flow/analysis::while-loop", "o": 956, "z": 12, "cf": 0.30000001192092896 } ], "ln": 32, "addr": 956 }, { "b": "arR^Hz/{d+CRjqOx(4Plh83D", "ln": 33, "addr": 991 }, { "b": "arR^HA+funA=91rB-W", "ln": 34, "addr": 1011 }, { "b": "arR^Hw]zYjx=}bcaAy[dxjSFCenO)nc$D+dvjrS^", "ln": 60, "addr": 1636 }, { "b": "arR^HarR^HwmoN*twmwHj.d#yvoWB$f\u003cK", "ln": 61, "addr": 1669 }, { "b": "arR^HA+funA=90za$^RGx(ktexMtICdiJkvAV/PHx(k57vrt{b", "n": [ { "c": 3, "d": "chr-join character assembly transform", "i": "objectives/anti-static/obfuscation/eval/dropper::py-chr-join-decode", "o": 1710, "z": 9, "cf": 0.8500000238418579 } ], "ln": 62, "addr": 1696 }, { "b": "wmYu}B-7-7w[DgbwHI7$ByuQV", "ln": 63, "addr": 1737 }, { "b": "arR^HwmoN*jZh\u0026Bwgg}pazbLjay=KdzxJE#BywC", "ln": 64, "addr": 1758 }, { "b": "arR^HarR^Hx(n8#z!@@\u003eAbP/6j-j?PuVo}8", "ln": 102, "addr": 2902 }, { "b": "arR^HA+funA=91lzGV", "ln": 103, "addr": 2931 }, { "b": "wmYu}wO#0#D2N\u003cNBA?)UyH}=uiS", "n": [ { "c": 3, "d": "Encryption API usage markers", "i": "micro-behaviors/crypto/library/keyword::encryption-functions", "o": 2950, "z": 7, "cf": 0.5 } ], "ln": 104, "addr": 2946 }, { "b": "arR^Hw]zYjAV/7laAy[dxjSFCfEY3", "ln": 105, "addr": 2968 }, { "b": "arR^HarR^HBA?)\u003cCYdRfBy/Ysd0fYQeokVKzE^J]C{)DtC}r$+df", "ln": 106, "addr": 2992 } ], "depth": 1, "facts": { "imp": [ [ "", "str" ], [ "", "enumerate" ], [ "", "ord" ], [ "", "''.join" ], [ "", "sum" ], [ "", "ord" ], [ "", "enumerate" ], [ "", "ord" ], [ "", "int" ], [ "", "str" ], [ "", "chr" ], [ "", "int" ], [ "", "range" ], [ "", "len" ], [ "", "str" ], [ "", "ord" ], [ "", "map" ], [ "", "range" ], [ "", "len" ], [ "", "chr" ], [ "", "len" ], [ "", "chr" ], [ "", "int" ], [ "", "o.lstrip" ], [ "", "ord" ], [ "", "x.zfill" ], [ "", "hash2" ], [ "", "len" ], [ "", "int" ], [ "", "range" ], [ "", "stream.append" ], [ "", "len" ], [ "", "hash2" ], [ "", "list" ], [ "", "range" ], [ "", "range" ], [ "", "stream.pop" ], [ "", "sbox.append" ], [ "", "unused.pop" ], [ "", "str" ], [ "", "enumerate" ], [ "", "chr" ], [ "", "ord" ], [ "", "ord" ], [ "", "len" ], [ "", "ord" ], [ "", "range" ], [ "", "len" ], [ "", "\"\".join" ], [ "", "chr" ], [ "", "ord" ], [ "", "range" ], [ "", "len" ], [ "", "\"\".join" ], [ "", "chr" ], [ "", "ord" ], [ "", "range" ], [ "", "len" ], [ "", "rol" ], [ "", "\"\".join" ], [ "", "chr" ], [ "", "ord" ], [ "", "range" ], [ "", "len" ], [ "", "rol" ], [ "", "\"\".join" ], [ "", "chr" ], [ "", "xor_text" ], [ "", "str" ], [ "", "hash2" ], [ "", "str" ], [ "", "str" ], [ "", "makesbox" ], [ "", "int" ], [ "", "hash2" ], [ "", "str" ], [ "", "str" ], [ "", "\"\".join" ], [ "", "set" ], [ "", "range" ], [ "", "used.add" ], [ "", "perm.append" ], [ "", "len" ], [ "", "enumerate" ], [ "", "range" ], [ "", "xor_text" ], [ "", "roundkey" ], [ "", "round_sbox" ], [ "", "chr" ], [ "", "ord" ], [ "", "diffuse2" ], [ "", "diffuse" ], [ "", "make_perm" ], [ "", "len" ], [ "", "roundkey" ], [ "", "permute" ], [ "", "range" ], [ "", "xor_text" ], [ "", "hash2" ], [ "", "hash2" ], [ "", "hash2" ], [ "", "diffuse2" ], [ "", "make_perm" ], [ "", "len" ], [ "", "roundkey" ], [ "", "permute" ], [ "", "make_perm" ], [ "", "len" ], [ "", "roundkey" ], [ "", "permute" ], [ "", "inverse_perm" ], [ "", "undiffuse2" ], [ "", "range" ], [ "", "xor_text" ], [ "", "hash2" ], [ "", "hash2" ], [ "", "hash2" ], [ "", "range" ], [ "", "make_perm" ], [ "", "len" ], [ "", "roundkey" ], [ "", "permute" ], [ "", "inverse_perm" ], [ "", "undiffuse" ], [ "", "undiffuse2" ], [ "", "round_sbox" ], [ "", "enumerate" ], [ "", "chr" ], [ "", "ord" ], [ "", "xor_text" ], [ "", "roundkey" ], [ "", "range" ], [ "", "int" ], [ "", "time.time" ], [ "", "str" ], [ "", "time.time" ], [ "", "int" ], [ "", "int" ], [ "", "round" ], [ "", "str" ], [ "", "enumerate" ], [ "", "ord" ], [ "", "''.join" ], [ "", "sum" ], [ "", "ord" ], [ "", "enumerate" ], [ "", "ord" ], [ "", "int" ], [ "", "str" ], [ "", "chr" ], [ "", "int" ], [ "", "range" ], [ "", "len" ], [ "", "str" ], [ "", "ord" ], [ "", "map" ], [ "", "range" ], [ "", "len" ], [ "", "chr" ], [ "", "len" ], [ "", "chr" ], [ "", "int" ], [ "", "o.lstrip" ], [ "", "ord" ], [ "", "x.zfill" ], [ "", "time" ] ], "mbr": [ "o.lstrip", "perm.append", "sbox.append", "stream.append", "stream.pop", "time.time", "unused.pop", "used.add", "x.zfill" ], "tgt": [ "chr", "diffuse", "diffuse2", "enumerate", "hash2", "int", "inverse_perm", "len", "list", "make_perm", "makesbox", "map", "o.lstrip", "ord", "perm.append", "permute", "range", "rol", "round", "round_sbox", "roundkey", "sbox.append", "set", "str", "stream.append", "stream.pop", "sum", "time.time", "undiffuse", "undiffuse2", "unused.pop", "used.add", "x.zfill", "xor_text" ], "metrics": { "ast": { "op.add": 39.0, "op.bor": 3.0, "op.mod": 17.0, "op.mul": 20.0, "op.shl": 9.0, "op.shr": 6.0, "op.sub": 22.0, "op.xor": 14.0, "op.band": 10.0, "max_depth": 16.0, "bind_count": 105.0, "call_count": 165.0, "node_count": 2839.0, "op.floordiv": 2.0, "member_count": 9.0, "op_density.add": 0.01, "op_density.bor": 0.0, "op_density.mod": 0.01, "op_density.mul": 0.01, "op_density.shl": 0.0, "op_density.shr": 0.0, "op_density.sub": 0.01, "op_density.xor": 0.0, "op_density.band": 0.0, "identifier_count": 70.0, "member_depth_max": 2.0, "xor_mod_loop_count": 3.0, "op_density.floordiv": 0.0, "string_literal_count": 24.0, "array_literal_max_length": 4.0, "numeric_array_max_length": 4.0, "string_concat_chain_max_length": 3.0 }, "file": { "size": 5368.0, "entropy": 4.88, "size_bytes": 5368.0 }, "text": { "digit_ratio": 0.15, "space_count": 1190.0, "total_lines": 183.0, "char_entropy": 4.88, "unique_chars": 68.0, "string_density": 0.13, "avg_line_length": 28.33, "max_line_length": 83.0, "last_line_length": 14.0, "whitespace_ratio": 0.26, "most_common_ratio": 0.05, "identifier_density": 3.41, "line_length_stddev": 14.94, "encoded_string_ratio": 0.08, "normalized_string_count": 1.77, "repeated_char_sequences": 14.0, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 1.0, "most_common_char_codepoint": 116.0, "suspicious_identifier_ratio": 0.17, "normalized_unique_identifiers": 9.31 }, "binds": { "count": 105.0 }, "calls": { "count": 165.0 }, "binary": { "overall_entropy": 4.88, "peak_region_bytes": 4344.0, "peak_region_entropy": 5.05 }, "source": { "function_count": 17.0 }, "imports": { "count": 1.0, "stdlib_count": 1.0, "stdlib_ratio": 1.0, "unique_modules": 1.0 }, "members": { "count": 9.0 }, "strings": { "total": 24.0, "avg_length": 4.5, "max_length": 36.0, "avg_entropy": 3.75, "empty_count": 18.0, "hex_strings": 2.0, "total_bytes": 108.0, "entropy_stddev": 1.03, "high_entropy_count": 2.0 }, "functions": { "count": 17.0, "avg_params": 1.35, "max_params": 2.0, "length_stddev": 10.08, "avg_name_length": 7.35, "no_params_count": 1.0, "avg_length_lines": 10.76, "max_length_lines": 34.0, "min_length_lines": 2.0, "single_char_params": 4.0, "numeric_suffix_names": 3.0, "avg_param_name_length": 2.96, "density_per_100_lines": 9.29, "code_in_functions_ratio": 1.0 }, "identifiers": { "count": 70.0, "total": 624.0, "avg_length": 4.53, "max_length": 12.0, "min_length": 1.0, "avg_entropy": 1.71, "reuse_ratio": 0.11, "unique_count": 70.0, "length_stddev": 2.78, "has_digit_ratio": 0.04, "sequential_names": 12.0, "single_char_count": 13.0, "single_char_ratio": 0.19, "all_lowercase_ratio": 0.94, "all_uppercase_ratio": 0.03, "numeric_suffix_count": 3.0, "underscore_prefix_count": 1.0 } } }, "id": 2, "mol": "O(As)H(Db)", "path": "eggcrypt-3.0.0-py3-none-any.whl!!eggcrypt/egg.py", "pid": 0, "risk": 3, "sha": "c65c513c91cdcda1db9d4c288caaf7e668ff547bbd79ab1b4354e404079fc18d", "size": 5368, "traits": [ { "id": "micro-behaviors/data/encode/xor::xor-bytearray-mutating-loop", "atk": "T1027", "mbc": "B0032", "conf": 0.9200000166893005, "crit": 3, "desc": "bytearray in-place XOR mutation loop", "spans": [ [ 191, 7 ] ] }, { "id": "micro-behaviors/data/encode/xor::xor-decoding-loop", "conf": 0.800000011920929, "crit": 3, "desc": "XOR decoding loop with modulo", "spans": [ [ 0, 29 ] ] }, { "id": "objectives/anti-static/obfuscation/eval/dropper::py-chr-join-decode", "atk": "T1027", "conf": 0.8500000238418579, "crit": 3, "desc": "chr-join character assembly transform", "spans": [ [ 1710, 9 ] ] }, { "id": "micro-behaviors/crypto/library/keyword::encrypt-keyword", "conf": 0.4000000059604645, "crit": 3, "desc": "Generic 'encrypt' term in strings", "spans": [ [ 2950, 7 ] ] } ], "type": "python" }, { "ctx": [ { "b": "", "ln": 4, "addr": 49 }, { "b": "p?sV:x(!ufz/cXiB0bdcA+eZ9azk.6zGGD2efFLBwO005w/$O%vrc0(efG4MayPekaAg[jB8L}sz^)/%x(mT5xcpR9v@Dsi", "ln": 5, "addr": 50 }, { "b": "z!pblxLzJgB8LVjCvtJ6ayPd#ayPtjz!0G\u0026By!#9wn+$2zdNQbvruj4zxJL9y?mVgd0fclar\u003c:5w]@l9A+cBzefG4May]4(yY", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 130, "z": 4, "cf": 0.800000011920929 } ], "ln": 6, "addr": 127 }, { "b": "x(k5nxK@q+z!s9nvrb{4Cwhejz/{dAA+frlA+P39x(v(uazC.6y\u0026%o5zF78ox([3bB-X:xx(dNavruj4zxK4mwGV2cxj#yd", "ln": 7, "addr": 205 }, { "b": "Bz\u0026pAB7D)Bv@DsiefF!FwnbU3efF!vA+w@maAhEjy?W%7efFFqB98CpvS=^7efG1RvR/:*wO#N2efFwswg}\u003ewaAIagyY", "ln": 8, "addr": 282 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 1073.0, "entropy": 5.11, "size_bytes": 1073.0 }, "binary": { "overall_entropy": 5.11, "peak_region_bytes": 1024.0, "peak_region_entropy": 5.11 } } }, "id": 3, "path": "eggcrypt-3.0.0-py3-none-any.whl!!eggcrypt-3.0.0.dist-info/licenses/LICENSE", "pid": 0, "risk": 1, "sha": "dd1df32c748141128d6154bbd256788f58db253e04407e7d4a1786a555e9b9d1", "size": 1073, "traits": [ { "id": "metadata/file/profile/language::lang-english", "conf": 0.800000011920929, "crit": 2, "desc": "English language detection", "spans": [ [ 130, 4 ] ] } ], "type": "text" }, { "ctx": [ { "b": "o\u003ewAPwmoN*eMMC6B7]MgiV{gggY", "n": [ { "c": 2, "d": "PyPI package has basic metadata", "i": "metadata/package/quality/ecosystem::pypi-basic-metadata", "o": 0, "z": 21, "cf": 0.949999988079071 } ], "ln": 1, "addr": 0 }, { "b": "pgn0JiV@0DxjC$cAc8", "n": [ { "c": 1, "d": "PKG-INFO declares package name", "i": "metadata/package/quality/ecosystem::pkginfo-name-field", "o": 22, "z": 14, "cf": 0.8999999761581421 } ], "ln": 2, "addr": 22 }, { "b": "r+lq)x(v(IatUS7e?^", "n": [ { "c": 1, "d": "PKG-INFO declares package version", "i": "metadata/package/quality/ecosystem::pkginfo-version-field", "o": 37, "z": 14, "cf": 0.8999999761581421 } ], "ln": 3, "addr": 37 }, { "b": "q/#}]vrcSOavdb?A+fumC{4ftv%8*6asIIDBrCpnzE)A]v}/H(BswtzzEWZjAcb/jzxJ[sz!B90z7V@4vriMbwQbWMefFRmB7=%JefFIwv@=\u003clBsnNXvqYP#wmYm\u003eD2N\u003cNdj$", "n": [ { "c": 1, "d": "PKG-INFO declares package summary", "i": "metadata/package/quality/ecosystem::pkginfo-summary-field", "o": 52, "z": 106, "cf": 0.8999999761581421 } ], "ln": 4, "addr": 52 }, { "b": "l3mo.z/N(Ymq3mHz/Pv", "ln": 5, "addr": 159 }, { "b": "oLF0FzGxwIawCBb", "ln": 6, "addr": 175 }, { "b": "qE%\u0026\u003cx(W^aeL{.mxM4=Hau?}Ae\u0026J", "ln": 7, "addr": 188 }, { "b": "l$HBHA+PGmx(v(vlVl\u003c:wO#Pwrc-B]iV@JQCYUPQvrcc]z*c7", "ln": 8, "addr": 211 }, { "b": "oLF0FzGxwvmRMWIiV}9/lQ::Gmf", "n": [ { "c": 2, "d": "PyPI package declares license metadata", "i": "metadata/package/quality/ecosystem::pypi-license-metadata", "o": 251, "z": 21, "cf": 0.9399999976158142 } ], "ln": 9, "addr": 251 }, { "b": "m0SVUze0Gvaz++4wO#N2eOnZkwD", "ln": 10, "addr": 273 }, { "b": "m0SVUze0GvaAz4kB.L(cB1IuRBzbPg", "ln": 11, "addr": 295 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 766.0, "entropy": 4.9, "size_bytes": 766.0 }, "binary": { "overall_entropy": 4.9, "peak_region_bytes": 766.0, "peak_region_entropy": 4.9 } } }, "id": 4, "path": "eggcrypt-3.0.0-py3-none-any.whl!!eggcrypt-3.0.0.dist-info/METADATA", "pid": 0, "risk": 1, "sha": "1398d3524f2c8eb26402287f8fb0974ce87482cbc4ae655335741e4a91778637", "size": 766, "traits": [ { "id": "metadata/package/quality/ecosystem::pkginfo-license-file", "conf": 0.8999999761581421, "crit": 1, "desc": "PKG-INFO declares license file", "spans": [ [ 251, 21 ] ] }, { "id": "metadata/package/quality/ecosystem::pkginfo-version-field", "conf": 0.8999999761581421, "crit": 1, "desc": "PKG-INFO declares package version", "spans": [ [ 37, 14 ] ] }, { "id": "metadata/package/manifest/author/identity::pypi-no-author-email", "conf": 0.699999988079071, "crit": 2, "desc": "PyPI metadata omits author email" }, { "id": "metadata/package/quality/ecosystem::pkginfo-core-metadata", "conf": 1.0, "crit": 1, "desc": "Python core metadata marker", "spans": [ [ 0, 21 ] ] }, { "id": "metadata/package/quality/ecosystem::pkginfo-name-field", "conf": 0.8999999761581421, "crit": 1, "desc": "PKG-INFO declares package name", "spans": [ [ 22, 14 ] ] }, { "id": "metadata/package/quality/ecosystem::pkginfo-summary-field", "conf": 0.8999999761581421, "crit": 1, "desc": "PKG-INFO declares package summary", "spans": [ [ 52, 106 ] ] }, { "id": "objectives/supply-chain/impersonation/package/wheel-sdist::pkginfo-security-claim-1--secur", "atk": "T1036.005", "mbc": "F0004", "conf": 0.6499999761581421, "crit": 1, "desc": "pkginfo security claim 1 (secur)" }, { "id": "metadata/package/quality/ecosystem::pypi-basic-metadata", "conf": 0.949999988079071, "crit": 2, "desc": "PyPI package has basic metadata", "spans": [ [ 0, 21 ], [ 22, 14 ], [ 37, 14 ], [ 52, 106 ] ] }, { "id": "metadata/package/quality/ecosystem::pypi-license-metadata", "conf": 0.9399999976158142, "crit": 2, "desc": "PyPI package declares license metadata", "spans": [ [ 0, 21 ], [ 251, 21 ] ] } ], "type": "pkg_info" }, { "id": 5, "sha": "05808d4652083ecbcd41fbb836885732d8bc865b0487d0312a173b701c3b93f5", "path": "eggcrypt-3.0.0-py3-none-any.whl!!eggcrypt-3.0.0.dist-info/top_level.txt", "size": 9, "type": "text", "depth": 1 }, { "id": 6, "mol": "Md", "sha": "8d3cd7cca3f3bdae0ab5c8429614a68f39b1ca21a83781e1011515adba95932c", "path": "eggcrypt@3.0.0.registry.json", "risk": 1, "size": 845, "type": "registry", "depth": 1 } ], "omitted_files": 2, "v": "8" } }