{ "ml": { "v": "7", "eng": "2.3.0", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.14798284, "rte": "az", "prob": 0.14798284 }, { "cls": 0, "raw": 0.00040870905, "rte": "az/whl", "prob": 0.00040870905 } ], "prob": 0.14798284, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.14798283576965332, "type": "whl" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.0076904296875, "type": "python" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.008222907781600952, "type": "python" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.0003281235694885254, "type": "python" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.007709085941314697, "type": "python" }, { "id": 5, "lvl": -1, "conf": 0, "prob": 0.0076904296875, "type": "python" }, { "id": 6, "lvl": -1, "conf": 0, "prob": 0.007709085941314697, "type": "python" }, { "id": 7, "lvl": -1, "conf": 0, "prob": 0.008222907781600952, "type": "python" }, { "id": 8, "lvl": -1, "conf": 0, "prob": 0.007709085941314697, "type": "python" }, { "id": 9, "lvl": -1, "conf": 0, "prob": 0.007709085941314697, "type": "python" }, { "id": 10, "lvl": -1, "conf": 0, "prob": 0.007709085941314697, "type": "python" }, { "id": 11, "lvl": -1, "conf": 0, "prob": 0.007709085941314697, "type": "python" }, { "id": 12, "lvl": -1, "conf": 0, "prob": 0.007709085941314697, "type": "python" }, { "id": 13, "lvl": -1, "conf": 0, "prob": 0.007709085941314697, "type": "python" }, { "id": 14, "lvl": -1, "conf": 0, "prob": 0.00014570355415344238, "type": "python" }, { "id": 15, "lvl": -1, "conf": 0, "prob": 0.007709085941314697, "type": "python" }, { "id": 16, "lvl": -1, "conf": 0, "prob": 0.008222907781600952, "type": "python" }, { "id": 17, "lvl": -1, "conf": 0, "prob": 0.007709085941314697, "type": "python" }, { "id": 18, "lvl": -1, "conf": 0, "prob": 0.009042680263519287, "type": "python" }, { "id": 19, "lvl": -1, "conf": 0, "prob": 0.00020620226860046387, "type": "python" }, { "id": 20, "lvl": -1, "conf": 0, "prob": 0.0076904296875, "type": "python" }, { "id": 21, "lvl": -1, "conf": 0, "prob": 0.0076904296875, "type": "python" }, { "id": 22, "lvl": -1, "conf": 0, "prob": 0.008878320455551147, "type": "python" }, { "id": 23, "lvl": -1, "conf": 0, "prob": 0.0076904296875, "type": "python" }, { "id": 24, "lvl": -1, "conf": 0, "prob": 0.05431506037712097, "type": "text" }, { "id": 25, "lvl": -1, "conf": 0, "prob": 0.00005120038986206055, "type": "pkg_info" }, { "id": 26, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "text" }, { "id": 27, "lvl": -1, "conf": 0, "prob": 0.00020629167556762695, "type": "registry" } ], "version": "v18.18", "analyzed_at": "2026-07-12T00:15:57Z" }, "path": "zeromodel-0.1.1a1-py3-none-any.whl", "raw": { "files": [ { "id": 0, "ctx": [ { "b": "p!H([6Awak2MQg3(S+=n?ASv\u0026004iL000-l004sRA=k/kwmYNguTEI+x()Y?e]V8:r.Ew\u003ehw0Oc:Bs+G7j@]\u003euIm^p(8\u003e6I0O+X?mm2qG:r\u00269/t9qIq@}W9NA.5v0Zl[JpAe6?Qypi)SLZFYw!lgy}yeFHZfw=EwgtP0*7Ju\u0026!T.@5bc7x\u003c#SYdP)-XL}-qKJGMTU!/s*3e", "n": [ { "c": 2, "d": "Python wheel archive basename", "i": "metadata/file/extension/identity::python-wheel-basename", "o": 0, "z": 34, "cf": 0.949999988079071 } ], "ln": 0 } ], "mol": "H₂(Db₂F)", "sha": "edba23bfece4a24a02717841a5f3fffe699fbd912078c78bc033ba7054a4be6a", "path": "/data/samples/unknown/foraged/python/pythonhosted.org/pypi.org/zeromodel/zeromodel-0.1.1a1-py3-none-any.whl", "risk": 3, "size": 50669, "type": "whl", "facts": { "metrics": { "whl": { "native_extension_count": 0.0 }, "file": { "size": 50669.0, "entropy": 7.96, "size_bytes": 50669.0 }, "binary": { "overall_entropy": 7.96, "peak_region_bytes": 48128.0, "peak_region_entropy": 7.83 }, "archive": { "file_count": 28.0, "member_count": 28.0, "script_count": 23.0, "zip_bomb_ratio": 4.27, "directory_count": 0.0, "executable_count": 0.0, "extra_field_size": 0.0, "noise_file_count": 0.0, "total_compressed": 47117.0, "compression.ratio": 0.3, "hidden_file_count": 0.0, "total_uncompressed": 159596.0, "crc_collision_count": 0.0, "entry_comment_count": 0.0, "max_filename_length": 44.0, "rtlo_filename_count": 0.0, "format.regular_count": 28.0, "nested_archive_count": 0.0, "path_traversal_count": 0.0, "symlink_escape_count": 0.0, "security.setgid_count": 0.0, "security.setuid_count": 0.0, "security.sticky_count": 0.0, "double_extension_count": 0.0, "duplicate_member_count": 0.0, "security.symlink_count": 0.0, "unicode_filename_count": 0.0, "homoglyph_filename_count": 0.0, "security.encrypted_count": 0.0, "timing.mtime_unique_count": 2.0, "timing.mtime_unique_ratio": 0.07, "misplaced_executable_count": 0.0, "timing.mtime_outlier_count": 5.0, "timing.mtime_dominant_count": 23.0, "timing.mtime_spread_seconds": 2888.0, "timing.sentinel_mtime_count": 0.0, "security.world_writable_count": 0.0, "timing.mtime_dominant_fraction": 0.82, "compression.method_counts.deflate": 28.0 } } }, "ident": { "name": { "value": "zeromodel", "source": "whl.distribution", "verified": false }, "trust": "unsigned", "emails": [ "ernanhughes@gmail.com" ], "authors": [ { "name": "Ernan Hughes", "role": "author", "email": "ernanhughes@gmail.com", "source": "whl.author" } ], "version": { "value": "0.1.1a1", "source": "whl.version", "verified": false } }, "traits": [ { "id": "micro-behaviors/data/compress/library::zlib-compress-symbol", "conf": 0.8999999761581421, "crit": 3, "desc": "zlib.compress symbol", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/data/serialize/json::json-loads-call", "conf": 0.8999999761581421, "crit": 3, "desc": "Python json.loads call", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/fs/file/write/direct::python-pathlib-write-bytes-call", "conf": 0.8799999952316284, "crit": 3, "desc": "Writes bytes via pathlib", "from": [ { "file": 14 } ] } ] }, { "ctx": [ { "b": "a%FjmwPzY-z!9A}aAhEjy?Wx4Aa9l(vp%c]B9hInvpJ\u003e3a%Fi", "n": [ { "c": 2, "d": "Python file extension", "i": "metadata/file/extension/identity::py", "o": 0, "z": 11, "cf": 1.0 } ], "ln": 1, "addr": 0 }, { "b": "w].*baywF/B-.+DwNw^!x(d*cA=-BjzF\u003cxmvruj4zGt", "n": [ { "c": 1, "d": "Python import-from statement", "i": "micro-behaviors/data/source/language::python-import-from-statement", "o": 41, "z": 34, "cf": 0.800000011920929 } ], "ln": 2, "addr": 41 }, { "b": "", "ln": 3, "addr": 77 }, { "b": "w].*batd8yBzkt}v@@\u0026cze:AlBrBm=D2E?EqE%uLAaHNyq!6-^wMi8Ey?kdur.#HRA==2cvpKygaxzrklUg7IefE$\u0026o\u0026tLnx(v(uaxzrkr://UwmoN]z/e0:A=k$HayYFcy?c)@Abt", "ln": 4, "addr": 79 } ], "depth": 1, "facts": { "imp": [ [ "", ".artifact" ], [ "", ".artifact.LayoutRecipe" ], [ "", ".artifact.ScoreTable" ], [ "", ".artifact.VPMArtifact" ], [ "", ".artifact.VPMCell" ], [ "", ".artifact.VPMRegion" ], [ "", ".artifact.VPMValidationError" ], [ "", ".artifact.build_vpm" ], [ "", ".bundle" ], [ "", ".bundle.from_bundle" ], [ "", ".bundle.to_bundle" ], [ "", ".compare" ], [ "", ".compare.VPMComparison" ], [ "", ".compare.compare_fields" ], [ "", ".compose" ], [ "", ".compose.as_field" ], [ "", ".compose.vpm_add" ], [ "", ".compose.vpm_and" ], [ "", ".compose.vpm_not" ], [ "", ".compose.vpm_or" ], [ "", ".compose.vpm_subtract" ], [ "", ".compose.vpm_xor" ], [ "", ".controller" ], [ "", ".controller.Decision" ], [ "", ".controller.Policy" ], [ "", ".controller.Signal" ], [ "", ".controller.Thresholds" ], [ "", ".controller.VPMController" ], [ "", ".controller.VPMRow" ], [ "", ".controller.default_controller" ], [ "", ".critic" ], [ "", ".critic.CRITIC_METRICS" ], [ "", ".critic.CriticAssessment" ], [ "", ".critic.CriticObservation" ], [ "", ".critic.build_critic_vpm" ], [ "", ".critic.critic_recipe" ], [ "", ".critic.observations_from_critic_lines" ], [ "", ".edge" ], [ "", ".edge.TopLeftGate" ], [ "", ".edge.TopLeftGateResult" ], [ "", ".hierarchy" ], [ "", ".hierarchy.HierarchyLevel" ], [ "", ".hierarchy.build_pyramid" ], [ "", ".hierarchy.reduce_blocks" ], [ "", ".learning" ], [ "", ".learning.LEARNING_METRICS" ], [ "", ".learning.LearningAssessment" ], [ "", ".learning.LearningObservation" ], [ "", ".learning.build_learning_vpm" ], [ "", ".learning.learning_recipe" ], [ "", ".manifold" ], [ "", ".manifold.DecisionManifold" ], [ "", ".manifold.ManifoldFrame" ], [ "", ".manifold.ManifoldSummary" ], [ "", ".manifold.ManifoldTransition" ], [ "", ".manifold.build_decision_manifold" ], [ "", ".manifold.find_inflection_points" ], [ "", ".metrics" ], [ "", ".metrics.CANONICAL_METRICS" ], [ "", ".metrics.metric_ids_for_rows" ], [ "", ".metrics.pack_metrics" ], [ "", ".metrics.score_table_from_metric_rows" ], [ "", ".phos" ], [ "", ".phos.PHOSResult" ], [ "", ".phos.guarded_pack_artifact" ], [ "", ".phos.image_entropy" ], [ "", ".phos.pack_artifact" ], [ "", ".phos.phos_sort_pack" ], [ "", ".phos.robust01" ], [ "", ".phos.to_square" ], [ "", ".phos.top_left_concentration" ], [ "", ".render" ], [ "", ".render.png_bytes" ], [ "", ".render.svg_text" ], [ "", ".render.to_uint8" ], [ "", ".render.write_png" ], [ "", ".render.write_svg" ], [ "", ".spatial" ], [ "", ".spatial.SpatialOptimizationResult" ], [ "", ".spatial.SpatialOptimizer" ], [ "", ".spatial.build_optimized_view" ], [ "", ".spatial.optimize_view_profile" ], [ "", ".training" ], [ "", ".training.TRAINING_METRICS" ], [ "", ".training.TrainingCheckpoint" ], [ "", ".training.TrainingProgressAssessment" ], [ "", ".training.build_training_progress_vpm" ], [ "", ".training.training_progress_recipe" ], [ "", ".views" ], [ "", ".views.ViewProfile" ], [ "", ".views.ViewSet" ], [ "", ".views.build_view" ], [ "", ".views.build_views" ] ], "metrics": { "ast": { "max_depth": 5.0, "bind_count": 2.0, "call_count": 0.0, "node_count": 755.0, "identifier_count": 96.0, "string_literal_count": 79.0, "array_literal_max_length": 77.0 }, "file": { "size": 3447.0, "entropy": 4.89, "size_bytes": 3447.0 }, "text": { "digit_ratio": 0.0, "space_count": 427.0, "total_lines": 101.0, "char_entropy": 4.89, "unique_chars": 57.0, "string_density": 0.78, "avg_line_length": 32.13, "max_line_length": 142.0, "empty_line_ratio": 0.03, "last_line_length": 1.0, "whitespace_ratio": 0.18, "most_common_ratio": 0.07, "identifier_density": 0.95, "line_length_stddev": 31.39, "encoded_string_ratio": 0.04, "normalized_string_count": 7.86, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 1.0, "most_common_char_codepoint": 105.0, "normalized_unique_identifiers": 14.42 }, "binds": { "count": 2.0 }, "binary": { "overall_entropy": 4.89, "peak_region_bytes": 3072.0, "peak_region_entropy": 5.0 }, "imports": { "count": 93.0, "relative_ratio": 1.0, "unique_modules": 93.0, "relative_imports": 93.0, "third_party_count": 93.0, "third_party_ratio": 1.0 }, "strings": { "total": 79.0, "avg_length": 14.1, "max_length": 37.0, "avg_entropy": 3.23, "total_bytes": 1114.0, "entropy_stddev": 0.4, "base64_candidates": 3.0 }, "identifiers": { "count": 96.0, "total": 96.0, "avg_length": 12.61, "max_length": 30.0, "min_length": 4.0, "avg_entropy": 3.07, "reuse_ratio": 1.0, "unique_count": 96.0, "length_stddev": 5.86, "has_digit_ratio": 0.02, "high_entropy_count": 17.0, "high_entropy_ratio": 0.18, "all_lowercase_ratio": 0.61, "all_uppercase_ratio": 0.04, "numeric_suffix_count": 2.0, "double_underscore_count": 2.0, "underscore_prefix_count": 2.0 } } }, "id": 1, "path": "/data/samples/unknown/foraged/python/pythonhosted.org/pypi.org/zeromodel/zeromodel-0.1.1a1-py3-none-any.whl!!zeromodel/__init__.py", "pid": 0, "risk": 1, "sha": "5904f76fc31c62f1be6b357b419280403f8e281ff066e187a82352cc41602a38", "size": 3447, "traits": [ { "id": "metadata/file/extension/identity::py", "conf": 1.0, "crit": 2, "desc": "Python file extension", "spans": [ [ 0, 11 ] ] }, { "id": "metadata/file/metrics::low-overall-entropy-source", "conf": 0.8999999761581421, "crit": 2, "desc": "Script overall entropy stays low", "spans": [ [ 0, 29 ] ] }, { "id": "metadata/file/extension/identity::python-artifact-extension", "conf": 1.0, "crit": 1, "desc": "Python artifact file extension (py/pyi/pyc)", "spans": [ [ 0, 11 ] ] } ], "type": "python" }, { "ctx": [ { "b": "a%Fj5zeBAqvpB4:axAh$BZY8ep\u0026ye:v%Gg\u003evq)t$A==2cvpKy4yH}K7wO-$", "n": [ { "c": 2, "d": "Python file extension", "i": "metadata/file/extension/identity::py", "o": 0, "z": 11, "cf": 1.0 }, { "c": 1, "d": "Defensive collector captured fields", "i": "well-known/tool/detection/security-scanner::evidence-collector-captured-fields", "o": 31, "z": 8, "cf": 0.8999999761581421 } ], "ln": 1, "addr": 0 }, { "b": "", "ln": 2, "addr": 49 }, { "b": "ra]#!az(4cB.\u003eRix(d*9wO(0@BAnNDxK@rczddl%wPI@oB-RbaB.\u0026gzg9x+iA=jV\u003cwmYN1B9hInvpJ\u003ef", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 51, "z": 4, "cf": 0.800000011920929 } ], "ln": 3, "addr": 51 }, { "b": "", "ln": 4, "addr": 117 }, { "b": "eG!Ceq!6-^wMi8Ey?m0ZiV@3GzFsi7az#sswPzG{aA?gfB.bRpAboVraAITkvR/P#A=ldAvqYP#zdN*fx\u003e5o1wmYU2x\u003ez6\u003cA=S\u0026", "ln": 5, "addr": 119 }, { "b": "A+e($z/d9GBzbYaB7/GdwgO\u003czz/{ekAX5tKAV/yhzFJ%7xcqkqy?j-cB-.XswmV)9xLzJgzeS%cy?kj", "ln": 10, "addr": 427 }, { "b": "a%Fi", "ln": 11, "addr": 492 }, { "b": "w].*baywF/B-.+DwNw^!x(d*cA=-BjzF\u003cxmvruj4zGt", "n": [ { "c": 1, "d": "Python import-from statement", "i": "micro-behaviors/data/source/language::python-import-from-statement", "o": 497, "z": 34, "cf": 0.800000011920929 } ], "ln": 12, "addr": 497 }, { "b": "", "ln": 13, "addr": 533 }, { "b": "w].*bay[]5vpKaZB8$]lazCXiz/P}xwmoN*v@bN{B1wCCx\u003eq9\u003e", "ln": 14, "addr": 535 }, { "b": "arR^HarR^HA+funA=90]vq{g1zF8^^z*lLbD2NsyDVKpHc#gm)ayw-3wO3g0uUTU2zyxVSazbLjazSIJB%7HpaA?gfB.9gtBy/rgc[fM[", "ln": 37, "addr": 1224 }, { "b": "arR^Hx\u003ewG4B7]JkByx5%wHI.gy\u0026%quasI5uB95@QBAILswHP5?", "ln": 38, "addr": 1310 }, { "b": "arR^HarR^HA+funA=91wB-qedc%{ObwO3g0uUTU2zyxVSazbLjaA!(wzxKahy\u0026%qr", "n": [ { "c": 2, "d": "Iteration or loop pattern", "i": "micro-behaviors/data/control-flow/analysis::iteration-loop-pattern", "o": 1388, "z": 10, "cf": 0.5 } ], "ln": 39, "addr": 1352 }, { "b": "arR^HA+funA=91yvqH6$", "ln": 40, "addr": 1406 }, { "b": "", "ln": 41, "addr": 1424 }, { "b": "wmYu}uT)IZz/fo0vqGp=B8L@6vTi6bB0#iuy\u0026%qIavf)\u003cdiHiaayYRrwPG)", "ln": 52, "addr": 1749 }, { "b": "arR^Ha%FjfwPzG[y?XibaAIahvqZg3v\u003c2o1zGGDcBrC^wBz8!rBywS{wGU=1C{3Kkwft@8Aa9=}Bz(gxv}Y^{v}xZla%Fi", "ln": 53, "addr": 1798 }, { "b": "arR^HA+funA=91mB8L}Gwoz:dB0}", "n": [ { "c": 2, "d": "Python json.dumps call", "i": "micro-behaviors/data/serialize/json::json-dumps-call", "o": 1886, "z": 10, "cf": 0.8999999761581421 } ], "ln": 54, "addr": 1875 }, { "b": "arR^HarR^HuVY%\u0026Cvb9az/c$DvqH6$dj+", "ln": 55, "addr": 1899 }, { "b": "arR^HarR^HB8M8vuU:j#B3iGyB.99", "ln": 56, "addr": 1927 }, { "b": "", "ln": 62, "addr": 2064 }, { "b": "wmYu}uVP)?gbQ%%xK#ApC42ifwJy@1zH0VNeJ$p#BAfz", "ln": 63, "addr": 2066 }, { "b": "arR^HA+funA=91kvrl9#x\u003c@YoxKJUNhyI{xvqZ13x\u003e7N/uUTU2zEl\u003c#By/IwC42ifwHP5XxK#B0x\u003eI0#BsnN", "n": [ { "c": 2, "d": "Python SHA256 hex digest", "i": "micro-behaviors/crypto/hash/digest::python-sha256-hexdigest", "o": 2114, "z": 55, "cf": 0.8999999761581421 } ], "ln": 64, "addr": 2103 }, { "b": "", "ln": 65, "addr": 2172 }, { "b": "", "ln": 66, "addr": 2174 }, { "b": "arR^Hwoz\u003ccx\u003e7N[wPG)PoLFM\u0026txs[bt{8oMtu}", "ln": 69, "addr": 2269 }, { "b": "arR^Hw]zYjx(){6azCZoC42ifwPG)", "ln": 70, "addr": 2301 }, { "b": "arR^HarR^Hx\u003ewG4By/qix(k5mwO2:u", "n": [ { "c": 1, "d": "Python in-membership check", "i": "micro-behaviors/data/control-flow/membership::in-membership-check", "o": 2334, "z": 16, "cf": 0.30000001192092896 } ], "ln": 71, "addr": 2326 }, { "b": "arR^HarR^HarR^Hwoz\u003ccx\u003e7N[wPGFjAbYxawghelwO\u0026\u003c", "ln": 72, "addr": 2352 }, { "b": "arR^HarR^HB7F{2e[5p3c#0^mz7b", "ln": 73, "addr": 2389 }, { "b": "arR^HarR^HBAhT/", "ln": 140, "addr": 4988 }, { "b": "arR^HarR^HarR^HA+funA=91vwO+%hzdN*fx\u003e7H:wofwqzE^s6c#AKqA+P2\u003cx\u003eeT", "ln": 141, "addr": 5002 }, { "b": "arR^HarR^HwQ4Y@Ac9j6vqH6$mriA!AV!!iaz2!ciS", "n": [ { "c": 1, "d": "Python except branch for crypto fallback cluster", "i": "objectives/command-and-control/dropper/staging/encrypted::dual-crypto-bcrypt-fallback--rx-4", "o": 5063, "z": 6, "cf": 0.30000001192092896 } ], "ln": 142, "addr": 5055 }, { "b": "arR^HarR^HarR^HA:-W6wGU2Io\u0026+Xsx\u003egT]x(v(TA=M8sc)zVeyI[6mzxJ!cBAh89uUK3[x(k5lwN/B[wJy}WB0q.Maz\u003eXiA+P2\u003cx\u003eeUnw].*baz2!c", "ln": 143, "addr": 5090 }, { "b": "", "ln": 144, "addr": 5184 }, { "b": "arR^HarR^Hx\u003ewF$z!%MkzEmf[zE:(cz/^aozxKoIB8Mhwv}u\u0026nar\u003exwAbok#x(\u003eLEiS", "ln": 230, "addr": 8768 }, { "b": "arR^HarR^HarR^HA:-W6wGU2Io\u0026+Xsx\u003egT]x(v(TA=M8sc)zVeB9hCvz/P@hwftx2y\u0026%PjuVf%}wPw]ex(mDxash4Laseduz!%MkzEmf[zE+f", "ln": 231, "addr": 8823 }, { "b": "arR^HarR^Hx\u003ewF$z!%MkzEmf[zE:\u003eMjS\u003e}WCYmFkv}*3eiS", "n": [ { "c": 1, "d": "String literal equality/membership check", "i": "objectives/anti-analysis/geofencing/target-gating::string-literal-equality-check", "o": 8935, "z": 13, "cf": 0.9200000166893005 } ], "ln": 232, "addr": 8912 }, { "b": "arR^HarR^HarR^HzdN*fx\u003e7H:woe\u003eRay/taB.#26z/Px1AXq0oBsntIwPR%bv{-}XB0r4", "ln": 233, "addr": 8951 }, { "b": "arR^HarR^HarR^Hx\u003ewG9z/^aoB7]JkByx5%wHIzbBAh89uUK4(efG4SAbo8maA8oyy?mGjzdN*fx\u003e7H:wofgxjV%]wiS", "ln": 234, "addr": 9008 }, { "b": "arR^HarR^HA=leev@DHcBsXLKwPR%bv{-.:B-8pzjS[/Sy?tqvz/{8gwIe4qvq]=", "ln": 346, "addr": 12973 }, { "b": "arR^HarR^Hx\u003ewGez/P@hwghIgy?tquz*bMbA+5:4diG=%az++kBsqfrzF9JeA=leev@DHcBswU1", "ln": 347, "addr": 13026 }, { "b": "arR^HarR^HarR^HA:-W6wGU2Io\u0026+Xsx\u003egT]x(v(TA=M8sc)AXICvboewmY^7zfo]wayX[8vixf8y?$kkwPzTgByxo9z/cXow/#ekB-H#6aAzyAB0r4", "n": [ { "c": 1, "d": "Crypto permutation marker", "i": "micro-behaviors/crypto/library/blockchain::crypto-permutation-word", "o": 13151, "z": 11, "cf": 0.8999999761581421 } ], "ln": 348, "addr": 13088 }, { "b": "arR^HarR^Hx\u003ewGez/P@hwghIgy?tqfz!%MkzEms5wmY^gar-(\u003cy?W%jc#@:lxjSGdwPR%bv{-.:B-8pIdlm", "ln": 349, "addr": 13181 }, { "b": "arR^HarR^HarR^HA:-W6wGU2Io\u0026+Xsx\u003egT]x(v(TA=M8sc)Aety\u0026%PjuVf%}wPw]gB-RTEvR3V\u003cazb+jy-)XdA=2@vvruj4zxJ\u003efaAIEzA:@V6zdN*fx\u003e8iddf", "ln": 350, "addr": 13249 }, { "b": "", "ln": 385, "addr": 14943 }, { "b": "arR^HwmYu}Bz\u003eI%x\u003e8lkB7Gf1diHiaavG{NBx-*dAX5t0zH2IG", "ln": 386, "addr": 14945 }, { "b": "arR^HarR^HAaa3dz^^f0jS[/Sy?tqwz^Ni?wO#Q7BA}kjvr(WcvpQ=n", "n": [ { "c": 1, "d": "Exploit marker indicators", "i": "objectives/privilege-escalation/exploit/vulnerabilities::tunables-exploit-marker", "o": 14995, "z": 7, "cf": 1.0 } ], "ln": 387, "addr": 14987 }, { "b": "arR^HarR^HAaa3dz^^fXb4kIlx\u003ey^-Bye-)b3=rOaAIagw?EIjBzkt}v@#6(wb", "ln": 388, "addr": 15033 }, { "b": "arR^HarR^HA+funA=91svr(WcvpP", "ln": 389, "addr": 15084 }, { "b": "", "ln": 533, "addr": 20873 }, { "b": "arR^HwmYvYB.(ebAb](uwO${]v}u=CaBs", "ln": 534, "addr": 20875 }, { "b": "arR^HarR^Hb6dWBA:@V/wnbW/B95P!ar\u003e(uvkoX#iWF?\u003easedKv@Dy0uVYZ=y?kkfx\u003eI0#BsW", "n": [ { "c": 2, "d": "sha256 hash algorithm", "i": "micro-behaviors/crypto/hash/digest::sha256-keyword", "o": 20929, "z": 6, "cf": 0.6000000238418579 } ], "ln": 535, "addr": 20903 }, { "b": "arR^HarR^Hb64m8x(ES\u003cwnbW/B95P!ar\u003e(uvkoX#iWF?\u003easedJwN/B[wIdIcxjVdaec", "ln": 536, "addr": 20963 }, { "b": "arR^HarR^Hb5*$hwO#Qhb03\u0026Jt}t", "ln": 537, "addr": 21018 } ], "depth": 1, "facts": { "imp": [ [ "", "isinstance" ], [ "", "MappingProxyType" ], [ "", "str" ], [ "", "freeze_json" ], [ "", "value.items" ], [ "", "isinstance" ], [ "", "tuple" ], [ "", "freeze_json" ], [ "", "isinstance" ], [ "", "str" ], [ "", "thaw_json" ], [ "", "value.items" ], [ "", "isinstance" ], [ "", "thaw_json" ], [ "", "json.dumps" ], [ "", "thaw_json" ], [ "", "hashlib.sha256(_canonical_json_bytes(value)).hexdigest" ], [ "", "hashlib.sha256" ], [ "", "canonical_json_bytes" ], [ "", "set" ], [ "", "duplicates.append" ], [ "", "seen.add" ], [ "", "\", \".join" ], [ "", "sorted" ], [ "", "set" ], [ "", "VPMValidationError" ], [ "", "dataclass" ], [ "", "field" ], [ "", "np.array" ], [ "", "tuple" ], [ "", "str" ], [ "", "tuple" ], [ "", "str" ], [ "", "object.__setattr__" ], [ "", "object.__setattr__" ], [ "", "object.__setattr__" ], [ "", "object.__setattr__" ], [ "", "freeze_json" ], [ "", "self.validate" ], [ "", "VPMValidationError" ], [ "", "len" ], [ "", "len" ], [ "", "VPMValidationError" ], [ "", "len" ], [ "", "len" ], [ "", "VPMValidationError" ], [ "", "VPMValidationError" ], [ "", "validate_unique" ], [ "", "validate_unique" ], [ "", "np.isfinite(self.values).all" ], [ "", "np.isfinite" ], [ "", "VPMValidationError" ], [ "", "sha256_hex" ], [ "", "self.to_identity_payload" ], [ "", "self.metric_ids.index" ], [ "", "VPMValidationError" ], [ "", "self.values.tolist" ], [ "", "list" ], [ "", "list" ], [ "", "thaw_json" ], [ "", "self.to_identity_payload" ], [ "", "cls" ], [ "", "data.get" ], [ "", "dataclass" ], [ "", "freeze_json" ], [ "", "object.__setattr__" ], [ "", "self.validate_shape" ], [ "", "cls" ], [ "", "str" ], [ "", "self.data.get" ], [ "", "sha256_hex" ], [ "", "self.to_dict" ], [ "", "self.data.get" ], [ "", "VPMValidationError" ], [ "", "self.data.get" ], [ "", "self.data.get" ], [ "", "self.data.get" ], [ "", "self.data.get" ], [ "", "isinstance" ], [ "", "VPMValidationError" ], [ "", "isinstance" ], [ "", "VPMValidationError" ], [ "", "isinstance" ], [ "", "VPMValidationError" ], [ "", "row_order.get" ], [ "", "VPMValidationError" ], [ "", "row_order.get" ], [ "", "row_order.get" ], [ "", "isinstance" ], [ "", "len" ], [ "", "VPMValidationError" ], [ "", "isinstance" ], [ "", "VPMValidationError" ], [ "", "VPMValidationError" ], [ "", "key.get" ], [ "", "VPMValidationError" ], [ "", "VPMValidationError" ], [ "", "VPMValidationError" ], [ "", "row_order.get" ], [ "", "VPMValidationError" ], [ "", "column_order.get" ], [ "", "VPMValidationError" ], [ "", "column_order.get" ], [ "", "isinstance" ], [ "", "len" ], [ "", "VPMValidationError" ], [ "", "validate_unique" ], [ "", "str" ], [ "", "normalization.get" ], [ "", "VPMValidationError" ], [ "", "row_order.get" ], [ "", "row_order.get" ], [ "", "table.metric_index" ], [ "", "str" ], [ "", "table.metric_index" ], [ "", "str" ], [ "", "thaw_json" ], [ "", "dataclass" ], [ "", "dataclass" ], [ "", "len" ], [ "", "len" ], [ "", "VPMValidationError" ], [ "", "float" ], [ "", "np.mean" ], [ "", "dataclass" ], [ "", "np.array" ], [ "", "tuple" ], [ "", "int" ], [ "", "tuple" ], [ "", "int" ], [ "", "freeze_json" ], [ "", "object.__setattr__" ], [ "", "object.__setattr__" ], [ "", "object.__setattr__" ], [ "", "object.__setattr__" ], [ "", "object.__setattr__" ], [ "", "object.__setattr__" ], [ "", "object.__setattr__" ], [ "", "self.compute_artifact_id" ], [ "", "object.__setattr__" ], [ "", "self.validate" ], [ "", "VPMValidationError" ], [ "", "self.source.validate" ], [ "", "self.recipe.validate_against" ], [ "", "sorted" ], [ "", "list" ], [ "", "range" ], [ "", "VPMValidationError" ], [ "", "sorted" ], [ "", "list" ], [ "", "range" ], [ "", "VPMValidationError" ], [ "", "VPMValidationError" ], [ "", "np.isfinite(self.normalized_values).all" ], [ "", "np.isfinite" ], [ "", "VPMValidationError" ], [ "", "self.normalized_values.min" ], [ "", "self.normalized_values.max" ], [ "", "VPMValidationError" ], [ "", "self.compute_artifact_id" ], [ "", "VPMValidationError" ], [ "", "sha256_hex" ], [ "", "self.to_identity_payload" ], [ "", "self.source.to_identity_payload" ], [ "", "self.recipe.to_dict" ], [ "", "self.normalized_values.tolist" ], [ "", "list" ], [ "", "list" ], [ "", "thaw_json" ], [ "", "self.to_identity_payload" ], [ "", "cls" ], [ "", "ScoreTable.from_dict" ], [ "", "LayoutRecipe.from_dict" ], [ "", "data.get" ], [ "", "data.get" ], [ "", "data.get" ], [ "", "len" ], [ "", "IndexError" ], [ "", "len" ], [ "", "IndexError" ], [ "", "VPMCell" ], [ "", "float" ], [ "", "float" ], [ "", "tuple" ], [ "", "range" ], [ "", "rows.indices" ], [ "", "len" ], [ "", "tuple" ], [ "", "range" ], [ "", "columns.indices" ], [ "", "len" ], [ "", "tuple" ], [ "", "self.cell" ], [ "", "VPMValidationError" ], [ "", "VPMRegion" ], [ "", "table.values.astype" ], [ "", "values.min" ], [ "", "values.max" ], [ "", "np.zeros_like" ], [ "", "np.clip" ], [ "", "table.metric_index" ], [ "", "str" ], [ "", "float" ], [ "", "float" ], [ "", "table.metric_index" ], [ "", "str" ], [ "", "float" ], [ "", "str" ], [ "", "float" ], [ "", "tuple" ], [ "", "range" ], [ "", "len" ], [ "", "tuple" ], [ "", "row_order.get" ], [ "", "row_order.get" ], [ "", "tuple" ], [ "", "sorted" ], [ "", "cmp_to_key" ], [ "", "compare_lexicographic" ], [ "", "tuple" ], [ "", "sorted" ], [ "", "weighted_score" ], [ "", "VPMValidationError" ], [ "", "tuple" ], [ "", "range" ], [ "", "len" ], [ "", "tuple" ], [ "", "table.metric_index" ], [ "", "str" ], [ "", "score_table.validate" ], [ "", "recipe.validate_against" ], [ "", "normalize_per_metric_minmax" ], [ "", "bool" ], [ "", "normalization.get" ], [ "", "compile_row_order" ], [ "", "compile_column_order" ], [ "", "np.ix_" ], [ "", "default_provenance.update" ], [ "", "dict" ], [ "", "VPMArtifact" ], [ "", "Any" ], [ "", "Dict" ], [ "", "List" ], [ "", "Mapping" ], [ "", "MappingProxyType" ], [ "", "Optional" ], [ "", "Sequence" ], [ "", "Set" ], [ "", "Tuple" ], [ "", "Union" ], [ "", "cmp_to_key" ], [ "", "dataclass" ], [ "", "dataclasses" ], [ "", "field" ], [ "", "functools" ], [ "", "hashlib" ], [ "", "json" ], [ "", "numpy" ], [ "", "types" ], [ "", "typing" ] ], "mbr": [ "LayoutRecipe.from_dict", "ScoreTable.from_dict", "cell.normalized_value", "column_order.get", "column_order.kind", "column_order.metric_ids", "columns.indices", "data.get", "data.layout_recipe", "data.metric_ids", "data.row_ids", "data.source", "data.values", "data.view", "default_provenance.update", "duplicates.append", "hashlib.sha256", "hashlib.sha256().hexdigest", "json.dumps", "json.dumps().encode", "key.direction", "key.get", "key.metric_id", "key.weight", "normalization.get", "np.array", "np.clip", "np.float64", "np.isfinite", "np.isfinite().all", "np.ix_", "np.mean", "np.ndarray", "np.zeros_like", "object.__setattr__", "payload.artifact_id", "recipe.data", "recipe.data.column_order", "recipe.data.normalization", "recipe.data.row_order", "recipe.digest", "recipe.validate_against", "row_order.get", "row_order.kind", "rows.indices", "score_table.digest", "score_table.validate", "seen.add", "self.artifact_id", "self.cell", "self.cells", "self.column_order", "self.columns", "self.compute_artifact_id", "self.data", "self.data.column_order", "self.data.get", "self.data.row_order", "self.metadata", "self.metric_ids", "self.metric_ids.index", "self.normalized_values", "self.normalized_values.flags", "self.normalized_values.flags.writeable", "self.normalized_values.max", "self.normalized_values.min", "self.normalized_values.shape", "self.normalized_values.size", "self.normalized_values.tolist", "self.provenance", "self.recipe", "self.recipe.to_dict", "self.recipe.validate_against", "self.row_ids", "self.row_order", "self.rows", "self.source", "self.source.metric_ids", "self.source.row_ids", "self.source.shape", "self.source.to_identity_payload", "self.source.validate", "self.source.values", "self.spec_version", "self.to_dict", "self.to_identity_payload", "self.validate", "self.validate_shape", "self.values", "self.values.flags", "self.values.flags.writeable", "self.values.ndim", "self.values.shape", "self.values.tolist", "table.metric_ids", "table.metric_index", "table.row_ids", "table.values", "table.values.astype", "value.items", "values.max", "values.min", "view.column_order", "view.normalized_values", "view.row_order" ], "tgt": [ "IndexError", "LayoutRecipe.from_dict", "MappingProxyType", "ScoreTable.from_dict", "VPMArtifact", "VPMCell", "VPMRegion", "VPMValidationError", "_canonical_json_bytes", "_compare_lexicographic", "_compile_column_order", "_compile_row_order", "_freeze_json", "_normalize_per_metric_minmax", "_sha256_hex", "_thaw_json", "_validate_unique", "_weighted_score", "bool", "cls", "cmp_to_key", "column_order.get", "columns.indices", "data.get", "dataclass", "default_provenance.update", "dict", "duplicates.append", "field", "float", "hashlib.sha256", "hashlib.sha256().hexdigest", "int", "isinstance", "json.dumps", "json.dumps().encode", "key.get", "len", "list", "normalization.get", "np.array", "np.clip", "np.isfinite", "np.isfinite().all", "np.ix_", "np.mean", "np.zeros_like", "object.__setattr__", "range", "recipe.validate_against", "row_order.get", "rows.indices", "score_table.validate", "seen.add", "self.cell", "self.compute_artifact_id", "self.data.get", "self.metric_ids.index", "self.normalized_values.max", "self.normalized_values.min", "self.normalized_values.tolist", "self.recipe.to_dict", "self.recipe.validate_against", "self.source.to_identity_payload", "self.source.validate", "self.to_dict", "self.to_identity_payload", "self.validate", "self.validate_shape", "self.values.tolist", "set", "sorted", "str", "table.metric_index", "table.values.astype", "tuple", "value.items", "values.max", "values.min" ], "metrics": { "ast": { "op.add": 2.0, "op.div": 1.0, "op.lor": 13.0, "op.mod": 17.0, "op.mul": 1.0, "op.sub": 8.0, "op.land": 2.0, "max_depth": 18.0, "bind_count": 69.0, "call_count": 242.0, "node_count": 5776.0, "member_count": 105.0, "op_density.add": 0.0, "op_density.div": 0.0, "op_density.lor": 0.0, "op_density.mod": 0.0, "op_density.mul": 0.0, "op_density.sub": 0.0, "op_density.land": 0.0, "identifier_count": 188.0, "member_depth_max": 4.0, "string_literal_count": 169.0, "array_literal_max_length": 3.0, "string_concat_chain_max_length": 2.0 }, "file": { "size": 21359.0, "entropy": 4.72, "size_bytes": 21359.0 }, "text": { "digit_ratio": 0.0, "space_count": 4620.0, "total_lines": 549.0, "char_entropy": 4.72, "unique_chars": 80.0, "string_density": 0.31, "avg_line_length": 36.91, "max_line_length": 103.0, "empty_line_ratio": 0.17, "last_line_length": 5.0, "whitespace_ratio": 0.27, "most_common_ratio": 0.07, "identifier_density": 2.23, "line_length_stddev": 26.59, "normalized_string_count": 7.21, "repeated_char_sequences": 115.0, "suspicious_string_ratio": 0.03, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 1.0, "most_common_char_codepoint": 101.0, "suspicious_identifier_ratio": 0.01, "normalized_unique_identifiers": 20.66 }, "binds": { "count": 69.0 }, "calls": { "count": 242.0 }, "binary": { "overall_entropy": 4.72, "peak_region_bytes": 15215.0, "peak_region_entropy": 5.0 }, "source": { "class_count": 6.0, "function_count": 26.0 }, "imports": { "count": 20.0, "stdlib_count": 6.0, "stdlib_ratio": 0.3, "unique_modules": 20.0, "aliased_imports": 1.0, "third_party_count": 14.0, "third_party_ratio": 0.7 }, "members": { "count": 105.0 }, "strings": { "total": 169.0, "avg_length": 22.83, "max_length": 493.0, "avg_entropy": 3.09, "sql_strings": 3.0, "total_bytes": 3858.0, "entropy_stddev": 0.83, "shell_command_strings": 2.0 }, "functions": { "count": 32.0, "avg_params": 1.89, "max_params": 9.0, "length_stddev": 10.98, "avg_name_length": 11.51, "avg_length_lines": 10.84, "max_length_lines": 52.0, "min_length_lines": 2.0, "many_params_count": 1.0, "high_entropy_names": 4.0, "avg_param_name_length": 5.7, "density_per_100_lines": 6.74, "code_in_functions_ratio": 0.73 }, "identifiers": { "count": 188.0, "total": 1227.0, "avg_length": 8.28, "max_length": 28.0, "min_length": 1.0, "avg_entropy": 2.57, "reuse_ratio": 0.15, "unique_count": 188.0, "length_stddev": 4.71, "has_digit_ratio": 0.02, "sequential_names": 2.0, "single_char_count": 2.0, "single_char_ratio": 0.01, "high_entropy_count": 13.0, "high_entropy_ratio": 0.07, "all_lowercase_ratio": 0.87, "all_uppercase_ratio": 0.01, "numeric_suffix_count": 2.0, "double_underscore_count": 2.0, "underscore_prefix_count": 12.0 } } }, "id": 2, "path": "/data/samples/unknown/foraged/python/pythonhosted.org/pypi.org/zeromodel/zeromodel-0.1.1a1-py3-none-any.whl!!zeromodel/artifact.py", "pid": 0, "risk": 1, "sha": "06d841f9e2243c61583add406dd3141d001b516edd0e9a7b21fc5150c1630b2a", "size": 21359, "traits": [ { "id": "metadata/file/extension/identity::py", "conf": 1.0, "crit": 2, "desc": "Python file extension", "spans": [ [ 0, 11 ] ] }, { "id": "metadata/file/metrics::low-overall-entropy-source", "conf": 0.8999999761581421, "crit": 2, "desc": "Script overall entropy stays low", "spans": [ [ 0, 29 ] ] }, { "id": "micro-behaviors/crypto/hash/digest::python-sha256-hexdigest", "conf": 0.8999999761581421, "crit": 2, "desc": "Python SHA256 hex digest", "spans": [ [ 2114, 55 ] ] } ], "type": "python" }, { "ctx": [ { "b": "a%Fj8z/Y#owPI]nvS=N0y?j-gwPzG[y?Xi7BzkVhazbLjaxzrkayPqjx\u003ey^-BAo5Ua%E", "n": [ { "c": 2, "d": "Python file extension", "i": "metadata/file/extension/identity::py", "o": 0, "z": 9, "cf": 1.0 }, { "c": 1, "d": "Defensive collector captured fields", "i": "well-known/tool/detection/security-scanner::evidence-collector-captured-fields", "o": 41, "z": 9, "cf": 0.8999999761581421 } ], "ln": 1, "addr": 0 }, { "b": "w].*baywF/B-.+DwNw^!x(d*cA=-BjzF\u003cxmvruj4zGt", "n": [ { "c": 1, "d": "Python import-from statement", "i": "micro-behaviors/data/source/language::python-import-from-statement", "o": 56, "z": 34, "cf": 0.800000011920929 } ], "ln": 2, "addr": 56 }, { "b": "", "ln": 3, "addr": 92 }, { "b": "x(d*cA=-BsB8L{", "ln": 4, "addr": 94 }, { "b": "", "ln": 10, "addr": 219 }, { "b": "lrc=GoHSq?mn^5QpFJ2}ar\u003e#Fz7PjtzE^M{feaN", "ln": 11, "addr": 221 }, { "b": "o*IJCmNZlPuRS)YmiB-ob5H+ax\u003ey{$Bs}rHz/c:", "n": [ { "c": 1, "d": "Config source endpoint marker", "i": "objectives/command-and-control/dropper/delivery/multistage::stage-config-endpoint-retrieve--config-source", "o": 271, "z": 13, "cf": 1.0 } ], "ln": 12, "addr": 254 }, { "b": "", "ln": 13, "addr": 287 }, { "b": "", "ln": 14, "addr": 289 }, { "b": "arR^HByxi5wPP4Taw=G*xEE?dBz99", "ln": 24, "addr": 591 }, { "b": "arR^HByxi5wPPLzvrb{%Bs}ACwnc6jAa9=#zGG}.rc0a)efFIGx(!x6z!?HnA=\u003e}x", "ln": 25, "addr": 616 }, { "b": "arR^HAaa3dz^^f0jS[GXz/dgrB.#8sc$mspwnC*:zddr@w[u49c$ddrx\u003ey^-Bsw:-B8M8vuU:j#B3iGyB.99Dx(mD)zGF2%efFwqy\u0026sJ8zEEACmQZaOwHN", "n": [ { "c": 2, "d": "Python json.dumps call", "i": "micro-behaviors/data/serialize/json::json-dumps-call", "o": 684, "z": 10, "cf": 0.8999999761581421 }, { "c": 1, "d": "Exploit marker indicators", "i": "objectives/privilege-escalation/exploit/vulnerabilities::tunables-exploit-marker", "o": 674, "z": 7, "cf": 1.0 } ], "ln": 26, "addr": 670 }, { "b": "arR^HCwhejaBm:vw[=6)e)q$dmRMWId0e)rxjVfoar(1NefFCvze:JbB8#5lzASqWAaS*2wIddTp*VQVmOD9EmmnNEvriMqw\u0026Y", "n": [ { "c": 1, "d": "Python ZipFile class reference", "i": "micro-behaviors/data/archive/extract/zip::python-zipfile-class", "o": 775, "z": 15, "cf": 0.800000011920929 } ], "ln": 27, "addr": 766 }, { "b": "arR^HarR^HDs!^NA+PSbB98BJo*IJCmNZlPuRS)YmjYN2vr(WcvpQ!", "ln": 28, "addr": 846 }, { "b": "arR^HA+funA=91wvrc0(Bn", "ln": 29, "addr": 891 }, { "b": "arR^HB8Mhwv}u=Caw=G*xEE?dBz99", "ln": 34, "addr": 1015 }, { "b": "arR^HCwhejaBm:vw[=6)e)q$dmRMWId06rHA:@Viar\u003e?IdiJ5uaBmSX", "ln": 35, "addr": 1040 }, { "b": "arR^HarR^HAaa3dz^^f0jS[GXz/dgzz^^f$d0/FTA+eV\u0026c@005nK=cEr9@x^o*{G-wmYm?wmWekB-.jEi3G!2", "n": [ { "c": 3, "d": "Python json.loads call", "i": "micro-behaviors/data/serialize/json::json-loads-call", "o": 1104, "z": 10, "cf": 0.8999999761581421 }, { "c": 2, "d": "Reads file content (Python)", "i": "micro-behaviors/fs/read/file::file-read-content", "o": 1117, "z": 6, "cf": 0.6000000238418579 } ], "ln": 36, "addr": 1086 }, { "b": "arR^Hx\u003ewGbvr(WcvpR06wPPsAvS=N0y?l%%wPz\u003caz/c:Far-(\u003clrc=GoHSq?mn^5QpFJ}", "ln": 37, "addr": 1156 }, { "b": "arR^HarR^HA:-W6wGU2Zy\u0026%qTA=M8sc)zVeB9hCvz/P@hwftu7zE^M{uV{13B7]MgiV].?a%nfOAaa3dz^^fexjVfkb4tXjwnC*:C4CYnx(v(kdjC", "ln": 38, "addr": 1213 } ], "depth": 1, "facts": { "imp": [ [ "", "artifact.to_dict" ], [ "", "Path" ], [ "", "target.parent.mkdir" ], [ "", "json.dumps" ], [ "", "bundle_manifest" ], [ "", "zipfile.ZipFile" ], [ "", "zf.writestr" ], [ "", "Path" ], [ "", "zipfile.ZipFile" ], [ "", "json.loads" ], [ "", "zf.read(MANIFEST_NAME).decode" ], [ "", "zf.read" ], [ "", "payload.get" ], [ "", "ValueError" ], [ "", "payload.get" ], [ "", "VPMArtifact.from_dict" ], [ "", ".artifact" ], [ "", ".artifact.VPMArtifact" ], [ "", "Any" ], [ "", "Mapping" ], [ "", "Path" ], [ "", "json" ], [ "", "pathlib" ], [ "", "typing" ], [ "", "zipfile" ] ], "mbr": [ "VPMArtifact.from_dict", "artifact.to_dict", "json.dumps", "json.loads", "payload.artifact", "payload.get", "target.parent", "target.parent.mkdir", "zf.read", "zf.read().decode", "zf.writestr", "zipfile.ZIP_DEFLATED", "zipfile.ZipFile" ], "tgt": [ "Path", "VPMArtifact.from_dict", "ValueError", "artifact.to_dict", "bundle_manifest", "json.dumps", "json.loads", "payload.get", "target.parent.mkdir", "zf.read", "zf.read().decode", "zf.writestr", "zipfile.ZipFile" ], "metrics": { "ast": { "op.bor": 2.0, "op.mod": 1.0, "max_depth": 13.0, "bind_count": 6.0, "call_count": 16.0, "node_count": 409.0, "member_count": 13.0, "op_density.bor": 0.0, "op_density.mod": 0.0, "identifier_count": 41.0, "member_depth_max": 3.0, "string_literal_count": 14.0 }, "file": { "size": 1360.0, "entropy": 5.13, "size_bytes": 1360.0 }, "text": { "digit_ratio": 0.0, "space_count": 184.0, "total_lines": 39.0, "char_entropy": 5.13, "unique_chars": 68.0, "string_density": 0.36, "avg_line_length": 32.87, "max_line_length": 94.0, "empty_line_ratio": 0.23, "last_line_length": 53.0, "whitespace_ratio": 0.19, "most_common_ratio": 0.06, "identifier_density": 2.15, "line_length_stddev": 26.6, "normalized_string_count": 2.24, "suspicious_string_ratio": 0.14, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 1.0, "most_common_char_codepoint": 116.0, "normalized_unique_identifiers": 7.76 }, "binds": { "count": 6.0 }, "calls": { "count": 16.0 }, "binary": { "overall_entropy": 5.13, "peak_region_bytes": 1360.0, "peak_region_entropy": 5.11 }, "source": { "function_count": 3.0 }, "imports": { "count": 9.0, "stdlib_count": 4.0, "stdlib_ratio": 0.44, "relative_ratio": 0.22, "unique_modules": 9.0, "relative_imports": 2.0, "third_party_count": 5.0, "third_party_ratio": 0.56 }, "members": { "count": 13.0 }, "strings": { "total": 14.0, "avg_length": 19.21, "max_length": 55.0, "avg_entropy": 2.95, "total_bytes": 269.0, "entropy_stddev": 1.34, "shell_command_strings": 2.0 }, "functions": { "count": 3.0, "avg_params": 1.33, "max_params": 2.0, "length_stddev": 1.41, "avg_name_length": 11.67, "avg_length_lines": 7.0, "max_length_lines": 8.0, "min_length_lines": 5.0, "high_entropy_names": 1.0, "avg_param_name_length": 6.0, "density_per_100_lines": 7.69, "code_in_functions_ratio": 0.54 }, "identifiers": { "count": 41.0, "total": 84.0, "avg_length": 7.29, "max_length": 15.0, "min_length": 2.0, "avg_entropy": 2.53, "reuse_ratio": 0.49, "unique_count": 41.0, "length_stddev": 3.12, "high_entropy_count": 2.0, "high_entropy_ratio": 0.05, "all_lowercase_ratio": 0.78, "all_uppercase_ratio": 0.07 } } }, "id": 3, "mol": "H(Db)", "path": "/data/samples/unknown/foraged/python/pythonhosted.org/pypi.org/zeromodel/zeromodel-0.1.1a1-py3-none-any.whl!!zeromodel/bundle.py", "pid": 0, "risk": 1, "sha": "b24c6c4d34ebb3f653913633326b84c2f2df9149f9be74cf3e3dc7cffaab682d", "size": 1360, "traits": [ { "id": "micro-behaviors/data/serialize/json::json-loads-call", "conf": 0.8999999761581421, "crit": 3, "desc": "Python json.loads call", "spans": [ [ 1104, 10 ] ] } ], "type": "python" }, { "ctx": [ { "b": "a%Fj0x\u003ey%*A+fcgx\u003c\u003e*2vqYH\u0026D2)Xvaztt5AaK6hazbLjaxzrkayPqjx\u003ey^-BAnNkzE:(4x\u003eq9\u003eB1OTXa]", "n": [ { "c": 2, "d": "Python file extension", "i": "metadata/file/extension/identity::py", "o": 0, "z": 10, "cf": 1.0 } ], "ln": 1, "addr": 0 }, { "b": "w].*baywF/B-.+DwNw^!x(d*cA=-BjzF\u003cxmvruj4zGt", "n": [ { "c": 1, "d": "Python import-from statement", "i": "micro-behaviors/data/source/language::python-import-from-statement", "o": 67, "z": 34, "cf": 0.800000011920929 } ], "ln": 2, "addr": 67 }, { "b": "", "ln": 3, "addr": 103 }, { "b": "w].*bay[]5vpKaZB8$]lazCXiz/P}xwmoN*v@bN{A@", "ln": 4, "addr": 105 } ], "depth": 1, "facts": { "imp": [ [ "", "dataclass" ], [ "", "as_field" ], [ "", "as_field" ], [ "", "ValueError" ], [ "", "float" ], [ "", "np.sum" ], [ "", "np.clip" ], [ "", "float" ], [ "", "np.sum" ], [ "", "np.clip" ], [ "", "vpm_and" ], [ "", "vpm_xor" ], [ "", "vpm_add" ], [ "", "vpm_subtract" ], [ "", "float" ], [ "", "VPMComparison" ], [ "", "float" ], [ "", ".compose" ], [ "", ".compose.as_field" ], [ "", ".compose.vpm_add" ], [ "", ".compose.vpm_and" ], [ "", ".compose.vpm_subtract" ], [ "", ".compose.vpm_xor" ], [ "", "Any" ], [ "", "dataclass" ], [ "", "dataclasses" ], [ "", "numpy" ], [ "", "typing" ] ], "mbr": [ "base.shape", "np.clip", "np.ndarray", "np.sum", "tgt.shape" ], "tgt": [ "VPMComparison", "ValueError", "as_field", "dataclass", "float", "np.clip", "np.sum", "vpm_add", "vpm_and", "vpm_subtract", "vpm_xor" ], "metrics": { "ast": { "op.add": 2.0, "op.div": 1.0, "op.mod": 1.0, "op.mul": 1.0, "op.sub": 2.0, "max_depth": 12.0, "bind_count": 9.0, "call_count": 17.0, "node_count": 405.0, "member_count": 5.0, "op_density.add": 0.0, "op_density.div": 0.0, "op_density.mod": 0.0, "op_density.mul": 0.0, "op_density.sub": 0.0, "identifier_count": 36.0, "member_depth_max": 2.0, "string_literal_count": 3.0, "array_literal_max_length": 2.0, "string_concat_chain_max_length": 3.0 }, "file": { "size": 1521.0, "entropy": 4.72, "size_bytes": 1521.0 }, "text": { "digit_ratio": 0.01, "space_count": 275.0, "total_lines": 49.0, "char_entropy": 4.72, "unique_chars": 57.0, "string_density": 0.06, "avg_line_length": 29.04, "max_line_length": 106.0, "empty_line_ratio": 0.18, "last_line_length": 5.0, "whitespace_ratio": 0.25, "most_common_ratio": 0.07, "identifier_density": 2.24, "line_length_stddev": 25.14, "normalized_string_count": 0.43, "suspicious_string_ratio": 0.33, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 1.0, "most_common_char_codepoint": 97.0, "normalized_unique_identifiers": 6.41 }, "binds": { "count": 9.0 }, "calls": { "count": 17.0 }, "binary": { "overall_entropy": 4.72, "peak_region_bytes": 1521.0, "peak_region_entropy": 4.73 }, "source": { "class_count": 1.0, "function_count": 1.0 }, "imports": { "count": 11.0, "stdlib_count": 2.0, "stdlib_ratio": 0.18, "relative_ratio": 0.55, "unique_modules": 11.0, "aliased_imports": 1.0, "relative_imports": 6.0, "third_party_count": 9.0, "third_party_ratio": 0.82 }, "members": { "count": 5.0 }, "strings": { "total": 3.0, "avg_length": 101.67, "max_length": 190.0, "avg_entropy": 4.19, "total_bytes": 305.0, "entropy_stddev": 0.1, "shell_command_strings": 1.0 }, "functions": { "count": 2.0, "avg_params": 4.0, "max_params": 4.0, "avg_name_length": 14.0, "avg_length_lines": 27.0, "max_length_lines": 27.0, "min_length_lines": 27.0, "high_entropy_names": 1.0, "single_char_params": 1.0, "avg_param_name_length": 7.25, "density_per_100_lines": 2.04, "code_in_functions_ratio": 0.55 }, "identifiers": { "count": 36.0, "total": 110.0, "avg_length": 7.22, "max_length": 17.0, "min_length": 2.0, "avg_entropy": 2.44, "reuse_ratio": 0.33, "unique_count": 36.0, "length_stddev": 3.51, "high_entropy_count": 3.0, "high_entropy_ratio": 0.08, "all_lowercase_ratio": 0.92 } } }, "id": 4, "path": "/data/samples/unknown/foraged/python/pythonhosted.org/pypi.org/zeromodel/zeromodel-0.1.1a1-py3-none-any.whl!!zeromodel/compare.py", "pid": 0, "risk": 1, "sha": "822b39c708ed0e4f2d839ff8a4f8fca1e8f5cf91975ee7cef0603107f4417c5f", "size": 1521, "traits": [ { "id": "metadata/file/extension/identity::py", "conf": 1.0, "crit": 2, "desc": "Python file extension", "spans": [ [ 0, 10 ] ] }, { "id": "metadata/file/metrics::low-overall-entropy-source", "conf": 0.8999999761581421, "crit": 2, "desc": "Script overall entropy stays low", "spans": [ [ 0, 29 ] ] }, { "id": "metadata/file/extension/identity::python-artifact-extension", "conf": 1.0, "crit": 1, "desc": "Python artifact file extension (py/pyi/pyc)", "spans": [ [ 0, 10 ] ] } ], "type": "python" }, { "id": 5, "sha": "0e05e88a758bc4a901124454bf914889eca535ed7e1269c1ef0f676fd0db2ff9", "path": "/data/samples/unknown/foraged/python/pythonhosted.org/pypi.org/zeromodel/zeromodel-0.1.1a1-py3-none-any.whl!!zeromodel/compose.py", "risk": 1, "size": 2013, "type": "python", "depth": 1 }, { "id": 6, "sha": "f99247e0a21f665fe65128e084700f21b9b89c82c5c8efd2324f15369c4a669b", "path": "/data/samples/unknown/foraged/python/pythonhosted.org/pypi.org/zeromodel/zeromodel-0.1.1a1-py3-none-any.whl!!zeromodel/controller.py", "risk": 1, "size": 9891, "type": "python", "depth": 1 }, { "id": 7, "sha": "22c1eb02bf27991808731714538585281be20b8c6172ff4d5260e72eb2ec913e", "path": "/data/samples/unknown/foraged/python/pythonhosted.org/pypi.org/zeromodel/zeromodel-0.1.1a1-py3-none-any.whl!!zeromodel/critic.py", "risk": 1, "size": 15309, "type": "python", "depth": 1 }, { "id": 8, "sha": "0a28d7f962cae876516b4d6f02797902d9bb892e8244453b7db24d76265ee781", "path": "/data/samples/unknown/foraged/python/pythonhosted.org/pypi.org/zeromodel/zeromodel-0.1.1a1-py3-none-any.whl!!zeromodel/edge.py", "risk": 1, "size": 1655, "type": "python", "depth": 1 }, { "id": 9, "sha": "db49aea053f2c7d16c58b2086307efab57f5f59e9d0ed8d614e25e6c47adb4d6", "path": "/data/samples/unknown/foraged/python/pythonhosted.org/pypi.org/zeromodel/zeromodel-0.1.1a1-py3-none-any.whl!!zeromodel/hierarchy.py", "risk": 1, "size": 2105, "type": "python", "depth": 1 }, { "id": 10, "sha": "2765d38f510ae448348736835fee16fb04a4c975a71af0e40294a28effa01813", "path": "/data/samples/unknown/foraged/python/pythonhosted.org/pypi.org/zeromodel/zeromodel-0.1.1a1-py3-none-any.whl!!zeromodel/learning.py", "risk": 1, "size": 9714, "type": "python", "depth": 1 }, { "id": 11, "sha": "b8b13d692e241cd85eee4d22362d2286abe64299194e03713fda0dc7eede3f4e", "path": "/data/samples/unknown/foraged/python/pythonhosted.org/pypi.org/zeromodel/zeromodel-0.1.1a1-py3-none-any.whl!!zeromodel/manifold.py", "risk": 1, "size": 13630, "type": "python", "depth": 1 }, { "id": 12, "sha": "906633cd464cdbab2252aac04755dc954102d6b12aebe92edfda089a8d4e901f", "path": "/data/samples/unknown/foraged/python/pythonhosted.org/pypi.org/zeromodel/zeromodel-0.1.1a1-py3-none-any.whl!!zeromodel/metrics.py", "risk": 1, "size": 4757, "type": "python", "depth": 1 }, { "id": 13, "sha": "7c89227fdb8fc8ff415f079bb14a037a6e9644967e31167348bc7649efee8ef3", "path": "/data/samples/unknown/foraged/python/pythonhosted.org/pypi.org/zeromodel/zeromodel-0.1.1a1-py3-none-any.whl!!zeromodel/phos.py", "risk": 1, "size": 5370, "type": "python", "depth": 1 }, { "ctx": [ { "b": "a%Fj0wPhi#wmYT*C}A\u0026Dxj#xfA+fc0wPzH5xcp(0y\u0026A%aB0b7kAV!K%A=jV\u003cwmYN1B$$V", "n": [ { "c": 2, "d": "Python file extension", "i": "metadata/file/extension/identity::py", "o": 0, "z": 9, "cf": 1.0 } ], "ln": 1, "addr": 0 }, { "b": "", "ln": 2, "addr": 57 }, { "b": "ra]?=p!\u003cI6CxdztwPw]cB0bgmBy/uix(v($y\u00261wtBzkSrayPd#aAITkzE^f@wg.RivSC)$C{43yy\u003cvSQnPV80A+PSbB0a[e", "ln": 3, "addr": 59 }, { "b": "i4XPNBrCjpvr({7vqGG$p!\u003cI6w].*bayMymCw/6zx(dB0B7]MgvqE67z/PY6y?XibwftF#wO+)f", "ln": 4, "addr": 137 }, { "b": "a%Fi", "ln": 5, "addr": 199 }, { "b": "w].*baywF/B-.+DwNw^!x(d*cA=-BjzF\u003cxmvruj4zGt", "n": [ { "c": 1, "d": "Python import-from statement", "i": "micro-behaviors/data/source/language::python-import-from-statement", "o": 204, "z": 34, "cf": 0.800000011920929 } ], "ln": 6, "addr": 204 }, { "b": "", "ln": 7, "addr": 240 }, { "b": "x(d*cA=-Bkx(mv2v}/S", "n": [ { "c": 1, "d": "binascii module import", "i": "objectives/anti-static/obfuscation/payload/encoded::binascii-import", "o": 242, "z": 15, "cf": 0.8999999761581421 } ], "ln": 8, "addr": 242 }, { "b": "x(d*cA=-BBBAhIlBn", "ln": 9, "addr": 259 }, { "b": "x(d*cA=-BIy?Wt", "ln": 10, "addr": 274 }, { "b": "w].*batdexze:AmwGUY7AbP=sayPs#w[+*)wb", "ln": 16, "addr": 361 }, { "b": "", "ln": 17, "addr": 392 }, { "b": "p!\u003cI/q+oFOk#Z\u0026ZmiB-ovJ]64i5%/gm{H7tzD}Avvo^W]", "n": [ { "c": 2, "d": "Decoded unicode-escape content", "i": "metadata/encoded-payload/unicode-escape", "o": 394, "z": 30, "cf": 0.8999999761581421 } ], "ln": 18, "addr": 394 }, { "b": "", "ln": 19, "addr": 432 }, { "b": "", "ln": 20, "addr": 434 }, { "b": "", "ln": 24, "addr": 574 }, { "b": "", "ln": 25, "addr": 576 }, { "b": "wmYu}uT)+(zFHUox(mDxayYRrwPGyBwmoN*iV})SBy/Ixat2=1vTi6bB2\u003c", "n": [ { "c": 1, "d": "Source chunk token", "i": "metadata/file/string/identity::chunk-token", "o": 583, "z": 5, "cf": 0.949999988079071 } ], "ln": 26, "addr": 578 }, { "b": "arR^Hv@=64jS[iFzEEP@x\u003eYhfA:{)Xc#iKmwfrxBwmoN*diG@WfNc5RmN/\u003cpmN^", "ln": 27, "addr": 626 }, { "b": "arR^HA+funA=91vBAhIlBs}Jvv@0FpaXr\u003eeaz+Rbc$D+dvjrSFd\u003ceRwzE:\u003euay[]5viv6yB98CBv@%txvpK73a%xJ4efFCyv\u003c}", "n": [ { "c": 1, "d": "struct.pack with network byte order", "i": "objectives/exfiltration/dns/ast::struct-pack-network-order", "o": 689, "z": 11, "cf": 0.8500000238418579 } ], "ln": 28, "addr": 678 }, { "b": "", "ln": 29, "addr": 758 }, { "b": "", "ln": 30, "addr": 760 }, { "b": "wmYu}AbGq}vTi6bB0$TmwO+)ravf)\u003cdiHiaayYRrwPG)", "ln": 31, "addr": 762 }, { "b": "arR^Ha%FjewPS6nzxJw9aug@Zx(\u003eFgA::lmv{%g+aw+*6ayYRrwGV5oA+PA7azbLjayMy8x\u003eq9\u003eaA8oyvrcE7w)]g\u003ee*qF-", "ln": 32, "addr": 799 }, { "b": "arR^Hx(do\u003ewGTbUBz\u003eJex(n2Lc$Wg8y?a%", "n": [ { "c": 1, "d": "Pixel or image marker", "i": "objectives/anti-static/obfuscation/steganography/lsb::pixel-image-marker", "o": 881, "z": 5, "cf": 0.7200000286102295 } ], "ln": 33, "addr": 877 }, { "b": "arR^HxK$)\u003cxML^FCwgPfxDPCXx(do\u003ewIe4qvq]=", "ln": 34, "addr": 906 }, { "b": "arR^Hx\u003eR3$auZ\u0026*BAhIlBs}Jvv@0FpaXtl(lpa19a$K\u003cXx\u003ehs0efFRqx\u003eIa3efD]6attt?fF1t2efDR}", "ln": 35, "addr": 939 }, { "b": "arR^HB7nS@y?W=#B09Q*vJ)0GyhW*7c$jx9CRy/}as!NGzdd6*txjUat}QkqvTi6bB0@EWw]zYjA=ldAx(k5lvqYZ?c$)gaxj#xodf", "n": [ { "c": 2, "d": "Iteration or loop pattern", "i": "micro-behaviors/data/control-flow/analysis::iteration-loop-pattern", "o": 1005, "z": 12, "cf": 0.5 } ], "ln": 36, "addr": 1005 }, { "b": "arR^HA+funA=90@pdFU\u0026nK(Jwr8(*+as!Nwv}Z15yBATonK#lEa$K\u003cJxK(cjas!Nwv}Z15yBATonKL\u003cza$K\u003c.y?Wuhv@Dj6A+frkd05)bzFT38wPGpHas!Nwv}Z15yBATonKVxxa$K\u003cCa%FD", "n": [ { "c": 3, "d": "zlib.compress symbol", "i": "micro-behaviors/data/compress/library::zlib-compress-symbol", "o": 1155, "z": 13, "cf": 0.8999999761581421 } ], "ln": 37, "addr": 1088 }, { "b": "", "ln": 38, "addr": 1205 }, { "b": "", "ln": 39, "addr": 1207 }, { "b": "arR^HByxi5wPP4Taw=G*xEE?dBz99", "ln": 42, "addr": 1324 }, { "b": "arR^HByxi5wPPLzvrb{%Bs}ACwnc6jAa9=#zGG}.rc0a)efFIGx(!x6z!?HnA=\u003e}x", "ln": 43, "addr": 1349 }, { "b": "arR^HByxi5wPPLGA+PSbuT!q5wPGnszF9r=D30Rsc$Wg8y?a$z", "n": [ { "c": 3, "d": "Writes bytes via pathlib", "i": "micro-behaviors/fs/file/write/direct::python-pathlib-write-bytes-call", "o": 1407, "z": 18, "cf": 0.8799999952316284 } ], "ln": 44, "addr": 1403 }, { "b": "arR^HA+funA=91wvrc0(Bn", "ln": 45, "addr": 1445 }, { "b": "", "ln": 46, "addr": 1464 }, { "b": "arR^HByxi5wPP4Taw=G*xEE?dBz99", "ln": 68, "addr": 2335 }, { "b": "arR^HByxi5wPPLzvrb{%Bs}ACwnc6jAa9=#zGG}.rc0a)efFIGx(!x6z!?HnA=\u003e}x", "ln": 69, "addr": 2360 }, { "b": "arR^HByxi5wPPLGA+PSbuVY\u003e7BsqiNxj2:(CYUuCx\u003eq9\u003eefFCly\u00260E1x)KtNv}xE)uVP}cwHPeMwO#0@wnb{]jTb2\u003cw?t$^df", "n": [ { "c": 2, "d": "Write text via pathlib", "i": "micro-behaviors/fs/write/file/direct::python-pathlib-write-text", "o": 2418, "z": 17, "cf": 0.8500000238418579 } ], "ln": 70, "addr": 2414 }, { "b": "arR^HA+funA=91wvrc0(Bn", "ln": 71, "addr": 2493 }, { "b": "", "ln": 72, "addr": 2512 } ], "depth": 1, "facts": { "imp": [ [ "", "as_field" ], [ "", "(np.clip(arr, 0.0, 1.0) * 255.0).round().astype" ], [ "", "(np.clip(arr, 0.0, 1.0) * 255.0).round" ], [ "", "np.clip" ], [ "", "binascii.crc32" ], [ "", "struct.pack" ], [ "", "len" ], [ "", "struct.pack" ], [ "", "to_uint8" ], [ "", "struct.pack" ], [ "", "b\"\".join" ], [ "", "image[row].tobytes" ], [ "", "range" ], [ "", "chunk" ], [ "", "chunk" ], [ "", "zlib.compress" ], [ "", "chunk" ], [ "", "Path" ], [ "", "target.parent.mkdir" ], [ "", "target.write_bytes" ], [ "", "png_bytes" ], [ "", "to_uint8" ], [ "", "range" ], [ "", "range" ], [ "", "int" ], [ "", "parts.append" ], [ "", "parts.append" ], [ "", "\"\".join" ], [ "", "Path" ], [ "", "target.parent.mkdir" ], [ "", "target.write_text" ], [ "", "svg_text" ], [ "", ".compose" ], [ "", ".compose.as_field" ], [ "", "Any" ], [ "", "Path" ], [ "", "binascii" ], [ "", "numpy" ], [ "", "pathlib" ], [ "", "struct" ], [ "", "typing" ], [ "", "zlib" ] ], "mbr": [ "binascii.crc32", "image.shape", "np.clip", "np.ndarray", "np.uint8", "parts.append", "struct.pack", "target.parent", "target.parent.mkdir", "target.write_bytes", "target.write_text", "zlib.compress" ], "tgt": [ "Path", "_chunk", "as_field", "binascii.crc32", "int", "len", "np.clip", "parts.append", "png_bytes", "range", "struct.pack", "svg_text", "target.parent.mkdir", "target.write_bytes", "target.write_text", "to_uint8", "zlib.compress" ], "metrics": { "ast": { "op.add": 8.0, "op.bor": 2.0, "op.mod": 2.0, "op.mul": 7.0, "op.band": 1.0, "max_depth": 13.0, "bind_count": 11.0, "call_count": 32.0, "node_count": 755.0, "member_count": 12.0, "op_density.add": 0.01, "op_density.bor": 0.0, "op_density.mod": 0.0, "op_density.mul": 0.01, "op_density.band": 0.0, "identifier_count": 60.0, "member_depth_max": 3.0, "string_literal_count": 19.0, "array_literal_max_length": 7.0, "string_concat_chain_max_length": 4.0 }, "file": { "size": 2512.0, "entropy": 5.06, "size_bytes": 2512.0 }, "text": { "digit_ratio": 0.03, "space_count": 433.0, "total_lines": 71.0, "char_entropy": 5.06, "unique_chars": 76.0, "escape_density": 0.12, "string_density": 0.27, "avg_line_length": 33.38, "max_line_length": 115.0, "empty_line_ratio": 0.24, "hex_escape_count": 3.0, "last_line_length": 17.0, "whitespace_ratio": 0.23, "most_common_ratio": 0.06, "identifier_density": 2.44, "line_length_stddev": 29.76, "normalized_string_count": 2.25, "repeated_char_sequences": 5.0, "suspicious_string_ratio": 0.05, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 1.0, "most_common_char_codepoint": 116.0, "normalized_unique_identifiers": 9.76 }, "binds": { "count": 11.0 }, "calls": { "count": 32.0 }, "binary": { "overall_entropy": 5.06, "peak_region_bytes": 2512.0, "peak_region_entropy": 5.07 }, "source": { "function_count": 6.0 }, "imports": { "count": 10.0, "stdlib_count": 5.0, "stdlib_ratio": 0.5, "relative_ratio": 0.2, "unique_modules": 10.0, "aliased_imports": 1.0, "relative_imports": 2.0, "third_party_count": 5.0, "third_party_ratio": 0.5 }, "members": { "count": 12.0 }, "strings": { "total": 19.0, "avg_length": 31.11, "max_length": 200.0, "avg_entropy": 2.79, "empty_count": 3.0, "sql_strings": 1.0, "total_bytes": 591.0, "entropy_stddev": 1.29 }, "functions": { "count": 6.0, "avg_params": 2.17, "max_params": 4.0, "length_stddev": 4.78, "avg_name_length": 8.17, "avg_length_lines": 6.83, "max_length_lines": 17.0, "min_length_lines": 3.0, "single_char_params": 2.0, "numeric_suffix_names": 1.0, "avg_param_name_length": 4.69, "density_per_100_lines": 8.45, "code_in_functions_ratio": 0.58 }, "identifiers": { "count": 60.0, "total": 173.0, "avg_length": 5.93, "max_length": 13.0, "min_length": 2.0, "avg_entropy": 2.3, "reuse_ratio": 0.35, "unique_count": 60.0, "length_stddev": 2.34, "has_digit_ratio": 0.05, "all_lowercase_ratio": 0.9, "all_uppercase_ratio": 0.02, "numeric_suffix_count": 3.0, "underscore_prefix_count": 1.0 } } }, "id": 14, "mol": "H₂(DbF)", "path": "/data/samples/unknown/foraged/python/pythonhosted.org/pypi.org/zeromodel/zeromodel-0.1.1a1-py3-none-any.whl!!zeromodel/render.py", "pid": 0, "risk": 2, "sha": "001a564bf5ca75c3a79e150f78fed910f45ee7c4fb5cc2002adcff3d36a6a070", "size": 2512, "traits": [ { "id": "micro-behaviors/data/compress/library::zlib-compress-symbol", "conf": 0.8999999761581421, "crit": 3, "desc": "zlib.compress symbol", "spans": [ [ 1155, 13 ] ] }, { "id": "micro-behaviors/fs/file/write/direct::python-pathlib-write-bytes-call", "conf": 0.8799999952316284, "crit": 3, "desc": "Writes bytes via pathlib", "spans": [ [ 1407, 18 ] ] } ], "type": "python" }, { "id": 15, "sha": "426f56b999e06a5e9553ed87ee5fcf3131bd1db99d2f1b9c04dcda91286b5aef", "path": "/data/samples/unknown/foraged/python/pythonhosted.org/pypi.org/zeromodel/zeromodel-0.1.1a1-py3-none-any.whl!!zeromodel/spatial.py", "risk": 1, "size": 12965, "type": "python", "depth": 1 }, { "id": 16, "sha": "020466a2707c5bcfc746a529d0b788a3dfaa087decaaefb86914f5b2e6972a9c", "path": "/data/samples/unknown/foraged/python/pythonhosted.org/pypi.org/zeromodel/zeromodel-0.1.1a1-py3-none-any.whl!!zeromodel/training.py", "risk": 1, "size": 12818, "type": "python", "depth": 1 }, { "id": 17, "sha": "3d3e875fbcbe148285911311b63a9b295ed67c8c4888e8aab9105b48b5b8f966", "path": "/data/samples/unknown/foraged/python/pythonhosted.org/pypi.org/zeromodel/zeromodel-0.1.1a1-py3-none-any.whl!!zeromodel/views.py", "risk": 1, "size": 7763, "type": "python", "depth": 1 }, { "id": 18, "sha": "90d15437fc19f9a6ab37bf0ab1d198b46809d63e1851ec00a5753ef180d19506", "path": "/data/samples/unknown/foraged/python/pythonhosted.org/pypi.org/zeromodel/zeromodel-0.1.1a1-py3-none-any.whl!!zeromodel/adapters/__init__.py", "risk": 1, "size": 787, "type": "python", "depth": 1 }, { "id": 19, "mol": "H(Db)", "sha": "e42ec65c1d7453f7409f8b9064234615b09a678765705024ffc51877c7b3acc0", "path": "/data/samples/unknown/foraged/python/pythonhosted.org/pypi.org/zeromodel/zeromodel-0.1.1a1-py3-none-any.whl!!zeromodel/adapters/common.py", "risk": 1, "size": 7238, "type": "python", "depth": 1 }, { "id": 20, "sha": "a2192159d4e42ae87757c4761b2209c88b4f904bf05427da605782d7545424ee", "path": "/data/samples/unknown/foraged/python/pythonhosted.org/pypi.org/zeromodel/zeromodel-0.1.1a1-py3-none-any.whl!!zeromodel/adapters/jsonl.py", "risk": 1, "size": 1575, "type": "python", "depth": 1 }, { "id": 21, "sha": "0e560c43c58e0915b3796c4691212ad93dcacc473c9e98abc2623a9ff22698d5", "path": "/data/samples/unknown/foraged/python/pythonhosted.org/pypi.org/zeromodel/zeromodel-0.1.1a1-py3-none-any.whl!!zeromodel/adapters/tensorboard.py", "risk": 1, "size": 1598, "type": "python", "depth": 1 }, { "id": 22, "sha": "0ea86fb635067b3791f5c457b867b765cc1193d80eb8ad850bb85412a59e1951", "path": "/data/samples/unknown/foraged/python/pythonhosted.org/pypi.org/zeromodel/zeromodel-0.1.1a1-py3-none-any.whl!!zeromodel/adapters/trackio.py", "risk": 1, "size": 1340, "type": "python", "depth": 1 }, { "id": 23, "sha": "48a58528aa41a6a2db5f450b5d669eaa1198a421cb7cea77339fd03ad39134f5", "path": "/data/samples/unknown/foraged/python/pythonhosted.org/pypi.org/zeromodel/zeromodel-0.1.1a1-py3-none-any.whl!!zeromodel/adapters/wandb.py", "risk": 1, "size": 1483, "type": "python", "depth": 1 }, { "id": 24, "sha": "3d0c017053a77d6b0af28530d920f237030b5ad79d4cc9adbea5cbd1c2fd94ed", "path": "/data/samples/unknown/foraged/python/pythonhosted.org/pypi.org/zeromodel/zeromodel-0.1.1a1-py3-none-any.whl!!zeromodel-0.1.1a1.dist-info/licenses/LICENSE", "risk": 1, "size": 1089, "type": "text", "depth": 1 }, { "id": 25, "sha": "6ae220ff8198c7900e1684a8ad1723df0a051e597c79f869e13915862ebcb4d2", "path": "/data/samples/unknown/foraged/python/pythonhosted.org/pypi.org/zeromodel/zeromodel-0.1.1a1-py3-none-any.whl!!zeromodel-0.1.1a1.dist-info/METADATA", "size": 13952, "type": "pkg_info", "depth": 1 }, { "id": 26, "sha": "4be6dea1487c4d412a4d0c2c415013557dd7fac35c16f62f8e50f4f66367ad77", "path": "/data/samples/unknown/foraged/python/pythonhosted.org/pypi.org/zeromodel/zeromodel-0.1.1a1-py3-none-any.whl!!zeromodel-0.1.1a1.dist-info/top_level.txt", "size": 10, "type": "text", "depth": 1 }, { "id": 27, "mol": "Md", "sha": "52c96f4fcfd037f07cac0c549f27c6a593593d35c5adea5c0a5b18c8fbd29bdf", "path": "zeromodel@0.1.1a1.registry.json", "risk": 1, "size": 848, "type": "registry", "depth": 1 } ], "omitted_files": 22, "rev": "9a8c9", "v": "8" } }