{ "ml": { "v": "7", "eng": "2.0.1-rc.1", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.000072161354, "rte": "az", "prob": 0.000072161354 }, { "cls": 0, "raw": 0.00004181266, "rte": "az/scripts", "prob": 0.00004181266 }, { "cls": 0, "raw": 0.44695073, "rte": "az/javascript", "prob": 0.44695073 } ], "prob": 0.000072161354, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.00007216135418275371, "type": "javascript" } ], "version": "v18.18", "analyzed_at": "2026-06-15T10:00:42Z" }, "path": "setupExtractor.ts", "raw": { "v": "7", "tv": "061e3", "files": [ { "id": 0, "ctx": [ { "a": 0, "b": "x(d*cA=-Byvruf9w].*baszbpBz93-", "l": 1, "n": [ { "c": 2, "d": "JavaScript or TypeScript basename", "i": "metadata/lang/source::js-ts-source-basename", "o": 0, "z": 17 } ] }, { "a": 25, "b": "x(d*cA=-BoB0b7nz/3QAw]/LnCYW$mcP.", "l": 2 }, { "a": 52, "b": "x(d*cA=-BjCXI8qazbUjz6gimCXI8qcP.", "l": 3, "n": [ { "c": 3, "d": "axios library import or require", "i": "micro-behaviors/communications/http/lib/axios::axios-import-or-require", "o": 52, "z": 25 } ] }, { "a": 79, "b": "x(d*cA=-BJave*}uRr*\u003cefEnBq:\u003e4Vp!t1]qCnR:lrcPJl%\u0026INaBLwAA=k!qcOv28v@Dl%x\u003eG8ez/fSrvqZgdcP.", "l": 4 }, { "a": 150, "b": "", "l": 5 }, { "a": 151, "b": "wQ5fjA=-BjB9RUkazb+lv@#B6zxJFdCw.knvpR/KBAg/1Bz(gFdlnOFA=k/eB7EESz!S-CaBs", "l": 6 }, { "a": 210, "b": "arR^Hv@DmaBrCylvNK{JauZ\u0026^vrufnyhW*7c#:iBv}x.5e]\u003eJAz/{8gwPHWRBz9iFcV0HacN?a", "l": 7 }, { "a": 270, "b": "arR^Hv@DmaBrCWlA+w%9p*[DVauZ\u0026^vrufnyhW*7c#rQbl${V)asxQ5BAg/1Bz(gLwQ4=ldlv", "l": 8, "n": [ { "c": 2, "d": ".exe extension reference", "i": "micro-behaviors/fs/path/extension::exe-dup", "o": 321, "z": 4 } ] }, { "a": 329, "b": "", "l": 9 }, { "a": 330, "b": "arR^Hv@DmaBrCajCw.knvpSwUy-\u003e\u003e-u)H7=k#QiVk#pcWrz(IsfgybcA:-E1z/NEwCX7nA", "l": 10 }, { "a": 387, "b": "arR^HA+funA=91qwP]m[A=k/eB7D+dB9RUkasInwB8L(rwH[%AwOL^^Bsws}j%kg", "l": 11, "n": [ { "c": 2, "d": "new Promise() usage marker", "i": "metadata/lang/javascript-features::has-promise-new", "o": 398, "z": 12 } ] }, { "a": 439, "b": "arR^HarR^HBAhTHDJ", "l": 12 }, { "a": 453, "b": "arR^HarR^HarR^Hx\u003ewFoa.C^FwQ4{gBApxazEU8hx\u003c%FAAW-BWDJ", "l": 13 }, { "a": 554, "b": "arR^HarR^HarR^HEe", "l": 15 }, { "a": 568, "b": "", "l": 16 }, { "a": 569, "b": "arR^HarR^HarR^Hv@DmaBrCQnB8V5nB7DESayPF5x(\u003eFaCXI8qe[X:qc$EmuzFTl1wl0U^efGo", "l": 17, "n": [ { "c": 3, "d": "axios HTTP method calls", "i": "micro-behaviors/communications/http/lib/axios::axios-method-calls", "o": 604, "z": 9 } ] }, { "a": 629, "b": "arR^HarR^HarR^HarR^HA+frhz/fScrc-B]iV]!\u003eBAg@3z6{\u003e", "l": 18 }, { "a": 669, "b": "arR^HarR^HarR^HarR^HxK$Q.wPz\u0026MaBs", "l": 19, "n": [ { "c": 2, "d": "HTTP configuration field (headers)", "i": "micro-behaviors/communications/http/request/client::http-config-headers", "o": 684, "z": 9 } ] }, { "a": 696, "b": "arR^HarR^HarR^HarR^HarR^HcS?@!B.LV5eLetTiV{:?nLzJVnKL9", "l": 20, "n": [ { "c": 3, "d": "X-Build header", "i": "micro-behaviors/communications/http/headers::x-header-build", "o": 717, "z": 7 } ] }, { "a": 740, "b": "arR^HarR^HarR^HarR^HarR^HcS?@^Aa{)%moI00ave*}uRr*\u003c", "l": 21 }, { "a": 781, "b": "arR^HarR^HarR^HarR^HEe", "l": 22 }, { "a": 799, "b": "arR^HarR^HarR^HEjmk", "l": 23 }, { "a": 815, "b": "", "l": 24 }, { "a": 816, "b": "arR^HarR^HarR^Hv@DmaBrC^Fx(){bauZ\u0026VB1Q%ywNPW(s8@1%wM9X\u003ewNPB7Byxi5wPQ:SBz99+", "l": 25, "n": [ { "c": 3, "d": "JavaScript file write operation", "i": "micro-behaviors/fs/write/file/direct::js-file-write", "o": 845, "z": 19 } ] }, { "a": 877, "b": "arR^HarR^HarR^HA+frhz/fSce[wyjvj(IkAaHCwA+PSbAW:6", "l": 26, "n": [ { "c": 1, "d": "response.data property access", "i": "micro-behaviors/communications/http/response::response-data-property-access", "o": 889, "z": 13 } ] }, { "a": 917, "b": "", "l": 27 }, { "a": 918, "b": "arR^HarR^HarR^HCxdztwPxzwzyu(Ax(mTaxEttNc[co4j%kg", "l": 28 }, { "a": 1001, "b": "", "l": 31 }, { "a": 1002, "b": "arR^HarR^HarR^HCxdztwPxzwzyu(zA=M8scOcw*wPz/uau.[hDJ", "l": 32 }, { "a": 1044, "b": "arR^HarR^HarR^HarR^Hx\u003ewFow]/OoCXIkvB5Nv4v\u003c(CcA+w%9p*[DVdjDxKB1RPMy?W^5q*Am\u003cd0e)rxjVfYvrufii@", "l": 33, "n": [ { "c": 2, "d": "Delete file synchronously (fs.unlinkSync)", "i": "micro-behaviors/fs/file/delete::fs-unlinkSync", "o": 1093, "z": 12 } ] }, { "a": 1118, "b": "arR^HarR^HarR^HEjmk", "l": 34 }, { "a": 1134, "b": "", "l": 35 } ], "mol": "H₂(Cm₃F)", "sha": "fd52eaf5adf6f7d78810a85e8bb14589478deef573bcd02731e61037d4be5201", "fact": { "id": "javascript", "imp": [ [ "", "path.join" ], [ "", "path.join" ], [ "", "fs.existsSync" ], [ "", "fs.mkdirSync" ], [ "", "axios.get" ], [ "", "fs.createWriteStream" ], [ "", "response.data.pipe" ], [ "", "writer.on" ], [ "", "resolve" ], [ "", "writer.on" ], [ "", "fs.existsSync" ], [ "", "fs.unlinkSync" ], [ "", "../config/constants" ], [ "", "axios" ], [ "", "fs-extra" ], [ "", "path" ] ], "mbr": [ "axios.get", "fs.createWriteStream", "fs.existsSync", "fs.mkdirSync", "fs.unlinkSync", "path.join", "process.resourcesPath", "response.data", "response.data.pipe", "writer.on" ], "met": { "ast": { "op.lnot": 1.0, "max_depth": 21.0, "bind_count": 5.0, "call_count": 13.0, "node_count": 361.0, "member_count": 10.0, "op_density.lnot": 0.0, "identifier_count": 31.0, "member_depth_max": 3.0, "string_literal_count": 12.0 }, "file": { "size": 1181.0, "entropy": 4.47, "size_bytes": 1181.0 }, "text": { "space_count": 368.0, "total_lines": 40.0, "char_entropy": 4.47, "unique_chars": 59.0, "string_density": 0.3, "avg_line_length": 28.53, "max_line_length": 73.0, "empty_line_ratio": 0.2, "last_line_length": 1.0, "whitespace_ratio": 0.35, "most_common_ratio": 0.06, "identifier_density": 1.45, "line_length_stddev": 22.79, "normalized_string_count": 1.9, "repeated_char_sequences": 18.0, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 1.0, "most_common_char_codepoint": 114.0, "normalized_unique_identifiers": 5.82 }, "binds": { "count": 5.0 }, "calls": { "count": 13.0 }, "binary": { "overall_entropy": 4.47 }, "source": { "function_count": 1.0 }, "imports": { "count": 4.0, "stdlib_count": 1.0, "stdlib_ratio": 0.25, "relative_ratio": 0.25, "unique_modules": 4.0, "relative_imports": 1.0, "third_party_count": 3.0, "third_party_ratio": 0.75 }, "members": { "count": 10.0 }, "strings": { "total": 12.0, "avg_length": 9.75, "max_length": 29.0, "path_count": 1.0, "avg_entropy": 2.67, "total_bytes": 117.0, "entropy_stddev": 0.79 }, "functions": { "count": 1.0, "anonymous": 3.0, "avg_params": 0.75, "max_params": 2.0, "length_stddev": 14.46, "avg_name_length": 17.0, "no_params_count": 2.0, "avg_length_lines": 17.25, "max_length_lines": 35.0, "min_length_lines": 3.0, "nested_functions": 2.0, "avg_nesting_depth": 1.25, "max_nesting_depth": 2.0, "avg_param_name_length": 5.33, "density_per_100_lines": 10.0, "code_in_functions_ratio": 1.73 }, "identifiers": { "count": 31.0, "total": 58.0, "avg_length": 7.58, "max_length": 17.0, "min_length": 2.0, "avg_entropy": 2.36, "reuse_ratio": 0.53, "unique_count": 31.0, "length_stddev": 3.84, "all_lowercase_ratio": 0.55, "all_uppercase_ratio": 0.1 } }, "str": [ [ 17, "u8", "path" ], [ 18, "u8", "path" ], [ 40, "u8", "fs-extra" ], [ 41, "u8", "fs-extra" ], [ 70, "u8", "axios" ], [ 71, "u8", "axios" ], [ 127, "u8", "../config/constants" ], [ 128, "u8", "../config/constants" ], [ 262, "u8", "lib" ], [ 263, "u8", "lib" ], [ 311, "u8", "Extractor.exe" ], [ 312, "u8", "Extractor.exe" ], [ 354, "u8", "${BASE_API_URL}/Extractor.exe" ], [ 370, "u8", "/Extractor.exe" ], [ 659, "u8", "stream" ], [ 660, "u8", "stream" ], [ 716, "u8", "X-Build-ID" ], [ 717, "u8", "X-Build-ID" ], [ 760, "u8", "X-Api-KEY" ], [ 761, "u8", "X-Api-KEY" ], [ 940, "u8", "finish" ], [ 941, "u8", "finish" ], [ 1024, "u8", "error" ], [ 1025, "u8", "error" ] ], "tgt": [ "Promise", "axios.get", "fs.createWriteStream", "fs.existsSync", "fs.mkdirSync", "fs.unlinkSync", "path.join", "resolve", "response.data.pipe", "writer.on" ], "val": { "file.stem": "setupExtractor", "file.basename": "setupExtractor.ts", "source.language": "typescript", "source.imports[0]": "../config/constants", "source.imports[1]": "axios", "source.imports[2]": "axios.get", "source.imports[3]": "fs-extra", "source.imports[4]": "fs.createWriteStream", "source.imports[5]": "fs.existsSync", "source.imports[6]": "fs.mkdirSync", "source.imports[7]": "fs.unlinkSync", "source.imports[8]": "path", "source.imports[9]": "path.join", "source.strings[0]": "${BASE_API_URL}/Extractor.exe", "source.strings[1]": "../config/constants", "source.strings[2]": "/Extractor.exe", "source.strings[3]": "Extractor.exe", "source.strings[4]": "X-Api-KEY", "source.strings[5]": "X-Build-ID", "source.strings[6]": "finish", "source.strings[7]": "fs-extra", "source.strings[8]": "stream", "source.has_imports": true, "source.imports[10]": "resolve", "source.imports[11]": "response.data.pipe", "source.imports[12]": "writer.on", "source.functions[0]": "anonymous", "source.functions[1]": "downloadExtractor" } }, "find": [ { "id": "micro-behaviors/communications/http/response::response-data-property-access", "mbc": "C0002", "conf": 0.699999988079071, "crit": 1, "desc": "response.data property access" }, { "id": "metadata/file/text/metrics::js-readable-source-context", "conf": 0.8999999761581421, "crit": 1, "desc": "Readable JavaScript source context" }, { "id": "metadata/file/text/metrics::js-typescript-source-file-context", "conf": 0.8999999761581421, "crit": 1, "desc": "TypeScript source file context" }, { "id": "micro-behaviors/communications/http/headers::x-header-build", "atk": "T1071.001", "mbc": "C0002", "crit": 3, "desc": "X-Build header" }, { "id": "micro-behaviors/communications/http/response::axios-client-reference", "mbc": "C0002", "conf": 0.8500000238418579, "crit": 1, "desc": "Axios client reference" }, { "id": "micro-behaviors/communications/http/get::axios-get-call", "atk": "T1071.001", "conf": 0.800000011920929, "crit": 3, "desc": "axios.get() HTTP GET request" }, { "id": "micro-behaviors/communications/http/request/client::http-config-headers", "conf": 0.30000001192092896, "crit": 2, "desc": "HTTP configuration field (headers)" }, { "id": "micro-behaviors/communications/http/lib/axios::axios", "atk": "T1071.001", "mbc": "C0002", "conf": 0.6000000238418579, "crit": 3, "desc": "axios library reference" }, { "id": "micro-behaviors/communications/http/lib/axios::axios-import-default", "atk": "T1071.001", "mbc": "C0002", "conf": 0.699999988079071, "crit": 3, "desc": "axios default import" }, { "id": "micro-behaviors/fs/write/file/direct::create-write-stream", "conf": 0.800000011920929, "crit": 3, "desc": "Creates a write stream" }, { "id": "micro-behaviors/communications/http/lib/axios::axios-method-calls", "atk": "T1071.001", "mbc": "C0002", "conf": 1.0, "crit": 3, "desc": "axios HTTP method calls" }, { "id": "micro-behaviors/fs/write/file/direct::js-file-write", "conf": 0.8999999761581421, "crit": 3, "desc": "JavaScript file write operation" }, { "id": "micro-behaviors/communications/http/lib/axios::axios-import-or-require", "atk": "T1071.001", "mbc": "C0002", "conf": 1.0, "crit": 3, "desc": "axios library import or require" }, { "id": "micro-behaviors/communications/http/lib/axios::request-axios", "atk": "T1071.001", "mbc": "C0002", "conf": 0.75, "crit": 3, "desc": "HTTP requests via axios" }, { "id": "micro-behaviors/communications/http/response::axios-response-data-access", "mbc": "C0002", "conf": 0.800000011920929, "crit": 3, "desc": "Accesses Axios response data payload" } ], "path": "/data/samples/bad/projects/Hades-Stealer/src/utils/setupExtractor.ts", "risk": 2, "size": 1181, "type": "javascript" } ] } }