{ "llm": { "conf": 0.9763039, "grade": "hostile", "model": "Qwen/Qwen3.8-27B", "outcome": "hostile", "interpretation": "Steals wallet secrets and clipboard" }, "ml": { "v": "7", "eng": "2.8.0", "lvl": 0, "conf": 100, "mods": [ { "cls": 2, "raw": 0.9646327, "rte": "az", "prob": 0.9646327 }, { "cls": 0, "raw": 0.74425733, "rte": "az/xpi", "prob": 0.74425733 } ], "prob": 0.9646327, "files": [ { "id": 0, "lvl": 0, "conf": 100, "prob": 0.9646326899528503, "type": "xpi" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.000019123157471767627, "type": "chrome-manifest" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.00003648797792266123, "type": "javascript" }, { "id": 5, "lvl": -1, "conf": 0, "prob": 0.00008346637332579121, "type": "javascript" }, { "id": 6, "lvl": -1, "conf": 0, "prob": 0.00003648797792266123, "type": "javascript" }, { "id": 7, "lvl": -1, "conf": 0, "prob": 0.00008577108383178711, "type": "html" }, { "id": 8, "lvl": -1, "conf": 0, "prob": 0.000015189250007097144, "type": "html" }, { "id": 12, "lvl": -1, "conf": 0, "prob": 0.000021825233488925733, "type": "javascript" }, { "id": 14, "lvl": -1, "conf": 0, "prob": 0.00008108218753477558, "type": "javascript" }, { "id": 18, "lvl": -1, "conf": 0, "prob": 0.000013957421288068872, "type": "registry" } ], "version": "v18.18", "analyzed_at": "2026-09-03T16:44:10Z" }, "path": "click_tracker-1092.0.1.xpi", "raw": { "files": [ { "id": 0, "ctx": [ { "b": "p!H([6Awys2MK\u00268000000000000000000r9003XJzdLtkBzU\u0026Uq+-t4fC7}3WeTO7C#H=lik\u003c^W6O#[[P#8W=hf2H#Yn*fxHe^o^QQS(:7DuvLDgG*YK2K4BZ5dB", "ln": 0 } ], "mol": "O₂(CaEu₂)H₅(Cm₈Db₅Os₂U₂)Md₂(Si)", "sha": "ff8cf95bdc0c52fa303b5b9ec4d3bdc853490501e0b30a4edffca4792edf1b6a", "path": "click_tracker-1092.0.1.xpi", "risk": 128, "size": 676411, "type": "xpi", "facts": { "metrics": { "file": { "size": 676411, "entropy": 8 }, "binary": { "peak_region_bytes": 661504, "peak_region_entropy": 7.84 }, "archive": { "file_count": 26, "member_count": 26, "script_count": 6, "zip_bomb_ratio": 5.34, "compressed_size": 672933, "directory_count": 0, "executable_count": 0, "extra_field_size": 0, "noise_file_count": 0, "compression.ratio": 0.37, "hidden_file_count": 0, "uncompressed_size": 1807284, "crc_collision_count": 1, "entry_comment_count": 0, "max_filename_length": 44, "rtlo_filename_count": 0, "format.regular_count": 26, "nested_archive_count": 0, "path_traversal_count": 0, "symlink_escape_count": 0, "security.setgid_count": 0, "security.setuid_count": 0, "security.sticky_count": 0, "double_extension_count": 0, "duplicate_member_count": 0, "security.symlink_count": 0, "unicode_filename_count": 0, "homoglyph_filename_count": 0, "security.encrypted_count": 0, "misplaced_executable_count": 0, "timing.mtime_dominant_count": 26, "timing.sentinel_mtime_count": 26, "security.world_writable_count": 0, "timing.mtime_dominant_fraction": 1, "compression.method_counts.deflate": 26 } } }, "ident": { "name": { "value": "Babby roll.", "source": "xpi.name", "verified": false }, "trust": "unsigned", "version": { "value": "1092.0.1", "source": "xpi.version", "verified": false } }, "traits": [ { "id": "micro-behaviors/os/clipboard/access::browser-paste-event-handler", "atk": "T1115", "conf": 0.86, "crit": 3, "desc": "Registers a browser paste-event handler", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/communications/http/request/payload::fetch-post-json-body", "conf": 0.93, "crit": 3, "desc": "fetch POST serializes a JSON request body" }, { "id": "micro-behaviors/communications/http/request/client::http-post-json", "atk": "T1071.001", "mbc": "C0002", "conf": 0.75, "crit": 3, "desc": "HTTP POST request with JSON content", "from": [ { "off": 770, "file": 3, "line": 38 }, { "off": 770, "file": 6, "line": 38 } ] }, { "id": "micro-behaviors/ui/window/form-input::dom-value-local-assignment", "conf": 0.9, "crit": 2, "desc": "DOM input value assigned locally", "from": [ { "file": 12 } ] }, { "id": "metadata/permission/manifest::extension-description-field", "conf": 0.95, "crit": 2, "desc": "Extension declares description field" }, { "id": "micro-behaviors/ui/window/manage/click::browser-click-listener", "conf": 0.88, "crit": 3, "desc": "Registers browser click event listener", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/browser-extension/lifecycle::persistent-background", "conf": 0.8, "crit": 3, "desc": "Extension uses persistent background page" }, { "id": "micro-behaviors/browser-extension/tabs::chrome-tabs-create-with-url-option", "conf": 0.95, "crit": 3, "desc": "Creates browser tab with URL option" }, { "id": "micro-behaviors/data/encode/char-code::fromcharcode-call", "conf": 0.9, "crit": 3, "desc": "Builds characters with String.fromCharCode", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/browser-extension/lifecycle::chrome-runtime-on-installed", "conf": 0.9, "crit": 3, "desc": "Handles browser extension install or update", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/browser-extension/permission/tabs::declared", "conf": 0.95, "crit": 3, "desc": "Declares \"tabs\" permission" }, { "id": "micro-behaviors/communications/http/form::form-submit-listener", "conf": 0.85, "crit": 3, "desc": "Registers a form submit event listener", "from": [ { "file": 12 } ] }, { "id": "objectives/credential-access/wallet/mnemonic::wallet-credential-entry-page", "atk": "T1555", "mbc": "B0028", "conf": 0.97, "crit": 4, "desc": "Wallet private-key or phrase entry page", "from": [ { "off": 5971, "file": 7, "line": 81 }, { "off": 1334, "file": 8, "line": 30 } ] }, { "id": "micro-behaviors/browser-extension/lifecycle::persistent-background-page", "conf": 0.7, "crit": 3, "desc": "Persistent extension background page" }, { "id": "metadata/permission/clipboard::permission-clipboard-read", "conf": 0.95, "crit": 3, "desc": "Extension requests clipboard read permission" }, { "id": "micro-behaviors/data/source/function/names::telemetry-handler-function", "conf": 0.94, "crit": 3, "desc": "Defines telemetry-style handler function", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/ui/window/form-input::browser-form-control-value-write", "conf": 0.88, "crit": 3, "desc": "Assigns a value into a form control" }, { "id": "micro-behaviors/communications/http/get::get-before-no-cors", "conf": 0.9, "crit": 3, "desc": "GET method before no-cors mode", "from": [ { "file": 5 } ] }, { "id": "objectives/credential-access/wallet/mnemonic::wallet-credential-input-surface", "atk": "T1555", "mbc": "B0028", "conf": 0.96, "crit": 4, "desc": "Wallet secret input surface", "from": [ { "file": 7 }, { "off": 1334, "file": 8, "line": 30 } ] }, { "id": "metadata/permission/manifest::extension-name-field", "conf": 0.95, "crit": 2, "desc": "Extension declares name field" }, { "id": "objectives/credential-access/wallet/mnemonic::wallet-seed-phrase-entry-label", "atk": "T1555", "mbc": "B0028", "conf": 0.96, "crit": 3, "desc": "Wallet seed phrase entry label", "from": [ { "file": 7 } ] }, { "id": "micro-behaviors/os/clipboard/monitor::javascript-clipboard-polling", "atk": "T1115", "conf": 0.9, "crit": 3, "desc": "JavaScript polls clipboard contents on a timer", "from": [ { "off": 1210, "file": 5, "line": 50 } ] }, { "id": "metadata/permission/manifest::extension-conventional-version", "conf": 0.95, "crit": 2, "desc": "Extension version uses dotted numeric format" }, { "id": "micro-behaviors/ui/window/form-input::dom-input-to-telemetry-callback", "conf": 0.94, "crit": 3, "desc": "Forwards a DOM input value to a telemetry-style callback", "from": [ { "off": 1028, "file": 12, "line": 23 }, { "off": 9492, "file": 14, "line": 240 } ] }, { "id": "objectives/credential-access/wallet/mnemonic::wallet-private-key-entry-label", "atk": "T1555", "mbc": "B0028", "conf": 0.96, "crit": 3, "desc": "Wallet private-key entry label", "from": [ { "off": 1510, "file": 8, "line": 34 } ] }, { "id": "micro-behaviors/browser-extension/permission/clipboard-read::declared", "conf": 0.95, "crit": 3, "desc": "Declares \"clipboardRead\" permission" }, { "id": "micro-behaviors/time/schedule/interval::setInterval", "conf": 0.5, "crit": 2, "desc": "Schedules a repeated callback with setInterval()", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/communications/http/request/client::post-method-text", "atk": "T1071.001", "mbc": "C0002", "conf": 0.94, "crit": 3, "desc": "Configures an HTTP POST request" }, { "id": "micro-behaviors/communications/http/header/content-type::application-json", "conf": 0.65, "crit": 3, "desc": "References the application/json media type", "from": [ { "file": 3 } ] }, { "id": "objectives/exfiltration/sensitive-data::js-wallet-secret-data-field", "atk": "T1041", "mbc": "B0030", "conf": 0.96, "crit": 4, "desc": "Wallet secret data object field", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/data/control-flow/error-handling::fetch-empty-catch-handler", "conf": 0.9, "crit": 3, "desc": "Fetch promise uses empty catch handler", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/data/serialize/json::json-stringify-identifier", "conf": 0.85, "crit": 3, "desc": "Serializes an identifier as JSON", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/os/clipboard/access::browser-clipboard-read", "atk": "T1115", "conf": 0.92, "crit": 3, "desc": "Reads from the browser clipboard", "from": [ { "file": 5 } ] }, { "id": "objectives/credential-access/wallet/mnemonic::wallet-credential-entry-label", "atk": "T1555", "mbc": "B0028", "conf": 0.97, "crit": 3, "desc": "Wallet secret-entry label", "from": [ { "file": 7 }, { "file": 8 } ] }, { "id": "micro-behaviors/communications/http/post::fetch-post-call", "atk": "T1071.001", "mbc": "C0002", "conf": 0.72, "crit": 3, "desc": "Sends an HTTP POST request with fetch()", "from": [ { "file": 3 } ] }, { "id": "objectives/exfiltration/stealer/credential/clipboard::clipboard-chunk-order-marker", "conf": 0.95, "crit": 4, "desc": "Ordered chunk upload query fields", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/communications/url/encoded::javascript-charcode-http-scheme-array", "atk": "T1027", "mbc": "B0032", "conf": 0.9, "crit": 3, "desc": "Array contains HTTP scheme character codes", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/data/source/function/names::telemetry-data-object-call", "conf": 0.9, "crit": 3, "desc": "Telemetry-style call receives data object", "from": [ { "file": 12 } ] }, { "id": "objectives/credential-access/wallet/mnemonic::wallet-private-key-input-label", "atk": "T1555", "mbc": "B0028", "conf": 0.96, "crit": 3, "desc": "Wallet private-key input label", "from": [ { "file": 8 } ] }, { "id": "objectives/credential-access/wallet/mnemonic::wallet-private-key-import-label", "atk": "T1555", "mbc": "B0028", "conf": 0.96, "crit": 3, "desc": "Wallet private-key import label", "from": [ { "file": 8 } ] }, { "id": "micro-behaviors/communications/http/get::javascript-get-method-text", "conf": 0.94, "crit": 3, "desc": "Configures an HTTP GET request" }, { "id": "micro-behaviors/communications/http/header/content-type::json-header", "conf": 0.9, "crit": 3, "desc": "References HTTP Content-Type application/json", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/communications/http/client/response-body::js-response-text-read", "conf": 0.82, "crit": 3, "desc": "JavaScript reads HTTP response text", "from": [ { "file": 3 } ] }, { "id": "objectives/credential-access/wallet/mnemonic::numbered-wallet-word-inputs", "atk": "T1555", "mbc": "B0028", "conf": 0.95, "crit": 4, "desc": "Numbered wallet word input grid", "from": [ { "file": 7 } ] }, { "id": "micro-behaviors/data/encode/url::encode-uri-component-call", "conf": 0.7, "crit": 3, "desc": "URL-encodes data via encodeURIComponent", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/browser-extension/tabs::chrome-tabs-create", "conf": 0.9, "crit": 3, "desc": "Opens a new browser tab", "from": [ { "file": 5 } ] }, { "id": "metadata/file/format/browser-extension::web-extension-root-manifest", "conf": 0.95, "crit": 1, "desc": "Archive contains root WebExtension manifest" }, { "id": "metadata/signed/platform::cose-manifest", "conf": 1.0, "crit": 1, "desc": "Archive contains Mozilla COSE digest manifest" }, { "id": "metadata/signed/platform::cose-signature", "conf": 1.0, "crit": 1, "desc": "Archive contains Mozilla COSE signature file" }, { "id": "metadata/signed/platform::pkcs7-signature", "conf": 1.0, "crit": 1, "desc": "Archive contains Mozilla PKCS#7 signature file" }, { "id": "metadata/signed/platform::pkcs7-signature-file", "conf": 1.0, "crit": 1, "desc": "Archive contains Mozilla PKCS#7 digest list" }, { "id": "metadata/signed/platform::mozilla-extension", "conf": 0.95, "crit": 3, "desc": "Contains Mozilla add-on signing artifacts" } ] }, { "id": 2, "mol": "HMd", "sha": "e09daa0ac3e176767ee31ccddad59ba41efc9d07cd258b229e4864d5ca1807af", "path": "click_tracker-1092.0.1.xpi!!manifest.json", "risk": 3, "size": 717, "type": "chrome-manifest", "depth": 1 }, { "ctx": [ { "b": "v@DmaBrCvoy-\u003e\u003e-c[co4j%kgVarR^Hv@DmaBrCTowN(]Datw3$louqyfcAnfaztth3lQDlapoklarUfjzGx[xzGP/qauZ\u0026K3lQDlarR^HaAIa9wfrxBiw-n]arR^HarR^HB7F][as!M?fGpP\u003carR^HarR^HB7F][as!M?fGgJ\u0026arR^HarR^HB7F][as!M{hWQVIarT@K3jm)#arUfjzGx[xAa9\u003c4q!oPUwO#QhauZ\u0026Kb4kCfe]UGyb3^nq3lQDlay/tcB95KnwN/T?wGTbUc$ddpdiH=qax9x5x(mMow].*blUG[GlVlHDc[Wb8vrcxqi%)8MarR1larR!pz/fSraAhvtBz\u0026o+ay]4[z!9Actqm/*efDV4hy]$9f/yN9f!\u003eBmat(bfat=2dat=2.dlv\u003eVarR^larR^Hv@DmaBrCKwauZ\u0026+B.#gLA+e^7v}v5pvpJ^#az@.Mx^\u003ee/j%ggParR^HarR!nv}cSiasH}DkoIsacM\u003eC)cNQt=d\u003ceZXaswJzarR^Hdlv\u003ezarR^Hv@DmaBrCKhBz8^Way]4[z!9ActqOoAdiHb-Aa9\u003c4q!oPUwO#Qhe]2rszyx4bv@C)?c%FI!t}4i:3jm)#arUYoBAIRwaAhvtBz\u0026oLaAhoxd\u003ce!tBz9-yEld=yvrlZiv\u003c2xazEW^5z/cXcz!%l3v@$BRBAh89B0$PGDKp(rx\u003ew+pwQF(ED2Ntkw/$UdjV$0cvRPE:BrSeOwPS6nzAwgjarU=DD3Y(varR!pz/fSraz@q+aBsCrarR^Haz$R8wJy}TqEK3zC{3f%y\u00260W8a$K6zarR^Hay/tay?m9#wN[8GiV{?0By^7xz*9PUed9HxarR^Hv@b\u003c\u003czGF]\u003cA=U@kzAn):f!LdjfD@4ParR^HarSo?e[CwjarR!Pi%)8MapoklarUfjzGx[xA+frhz/fScauZ\u0026QCvticazbhbv}WoazepQHefGoDarR^HarUJjBzbP6iV]RypG7jped9HxarR^HxK$Q.wPz\u0026MaBtjPlVl\u003c:wO#Pwrc-B]b03?\u003cvq{g4x\u003e7N[x(v(xyiarha%qp+3lQDlarR!oz!abOawbNdpa*QfA+PA7x\u003ezSszyEazarR^HarUDhwPh6]x)a5GaARTDwEoL5arV7Yi%)8MapoklarUxgasInwB8V5nB7D$xyBHxmCvticaAz4mAbPSnwIe7oCYUt.i%)8MEir3dByO#jwHO:GEf$x", "ln": 0, "col": 1, "line": 1 } ], "depth": 1, "facts": { "imp": [ [ "", "String.fromCharCode" ], [ "", "decode" ], [ "", "nums.reduce" ], [ "", "decode" ], [ "", "pathSegments.join" ], [ "", "decode" ], [ "", "Date.now" ], [ "", "fetch" ], [ "", "kml" ], [ "", "JSON.stringify" ], [ "", "response.text" ] ], "mbr": [ "Date.now", "JSON.stringify", "String.fromCharCode", "nums.reduce", "pathSegments.join", "response.ok", "response.text" ], "tgt": [ "Date.now", "JSON.stringify", "String.fromCharCode", "decode", "fetch", "kml", "nums.reduce", "pathSegments.join", "response.text" ], "funcs": [ [ "anonymous", 12 ], [ "anonymous", 220 ], [ "anonymous", 355 ], [ "collectMetrics", 516 ] ], "metrics": { "ast": { "op.ne": 1, "op.add": 9, "op.lor": 1, "op.lnot": 1, "max_depth": 15, "call_count": 11, "node_count": 377, "member_count": 7, "max_array_len": 7, "op_density.ne": 0, "op_density.add": 0.02, "op_density.lor": 0, "op_density.lnot": 0, "max_concat_chain": 3, "member_depth_max": 2, "max_numeric_array": 7 }, "file": { "size": 967, "entropy": 4.67 }, "text": { "lines": 46, "top_char": 101, "max_ws_run": 1, "digit_ratio": 0.08, "space_count": 264, "char_entropy": 4.67, "unique_chars": 69, "top_char_null": 0, "string_density": 0.22, "top_char_ratio": 0.06, "avg_line_length": 20.04, "max_line_length": 64, "empty_line_ratio": 0.24, "last_line_length": 1, "whitespace_ratio": 0.32, "identifier_density": 1.26, "line_length_stddev": 17.72, "normalized_string_count": 1.47, "trailing_whitespace_lines": 6, "suspicious_identifier_ratio": 0.09, "normalized_unique_identifiers": 5.97 }, "binds": { "count": 10 }, "binary": { "peak_region_bytes": 967, "peak_region_entropy": 4.67 }, "source": { "function_count": 1 }, "strings": { "bytes": 63, "count": 10, "avg_length": 6.3, "max_length": 16, "avg_entropy": 2.16, "empty_count": 2, "entropy_stddev": 1.04 }, "comments": { "chars": 7, "count": 1, "lines": 1, "to_code_ratio": 0.02 }, "functions": { "count": 1, "nested": 1, "density": 8.7, "anonymous": 3, "avg_params": 1.25, "code_ratio": 1.04, "max_params": 3, "one_liners": 1, "length_stddev": 10.56, "avg_name_length": 14, "no_params_count": 1, "avg_length_lines": 12, "max_length_lines": 24, "min_length_lines": 1, "avg_nesting_depth": 0.5, "max_nesting_depth": 1, "single_char_params": 3, "avg_param_name_length": 1.8 }, "identifiers": { "count": 58, "unique": 33, "avg_length": 5.58, "max_length": 14, "min_length": 1, "avg_entropy": 1.9, "reuse_ratio": 0.57, "length_stddev": 3.52, "sequential_names": 3, "single_char_count": 3, "single_char_ratio": 0.09, "all_lowercase_ratio": 0.76, "all_uppercase_ratio": 0.03 } } }, "id": 3, "mol": "O(As)H₃(Cm₆CrDb₅)", "path": "click_tracker-1092.0.1.xpi!!app.js", "pid": 0, "risk": 44, "sha": "006ad0c6911c84f8405036498658532b84ddd41494c6bb1f9c1310eddc3bd014", "size": 967, "traits": [ { "id": "micro-behaviors/communications/http/post::post", "atk": "T1071.001", "mbc": "C0002", "conf": 0.7, "crit": 3, "desc": "HTTP POST method string literal", "spans": [ [ 778, 6 ] ] }, { "id": "micro-behaviors/communications/http/post::request-options-post-method", "atk": "T1071.001", "mbc": "C0002", "conf": 0.86, "crit": 3, "desc": "Sets POST as an HTTP request method", "spans": [ [ 770, 14 ] ] }, { "id": "micro-behaviors/communications/url/encoded::javascript-charcode-http-scheme-array", "atk": "T1027", "mbc": "B0032", "conf": 0.9, "crit": 3, "desc": "Array contains HTTP scheme character codes", "spans": [ [ 288, 32 ] ] }, { "id": "micro-behaviors/crypto/library/blockchain/brand-wallet::wallet-brand-rabby", "conf": 1.0, "crit": 3, "desc": "Rabby wallet brand reference", "spans": [ [ 624, 5 ] ] }, { "id": "micro-behaviors/data/control-flow/error-handling::empty-catch-block", "conf": 0.9, "crit": 3, "desc": "JavaScript silently discards caught errors", "spans": [ [ 963, 2 ] ] }, { "id": "micro-behaviors/data/encode/arithmetic::seed-offset-integer-array", "atk": "T1027", "mbc": "B0032", "conf": 0.85, "crit": 3, "desc": "Integer array hides constants as offsets", "spans": [ [ 75, 84 ] ] }, { "id": "micro-behaviors/data/serialize/json::json-stringify-identifier", "conf": 0.85, "crit": 3, "desc": "Serializes an identifier as JSON", "spans": [ [ 853, 14 ] ] }, { "id": "micro-behaviors/data/source/function/names::telemetry-handler-function", "conf": 0.94, "crit": 3, "desc": "Defines telemetry-style handler function", "spans": [ [ 516, 14 ] ] }, { "id": "micro-behaviors/communications/http/client/response-body::js-response-text-read", "conf": 0.82, "crit": 3, "desc": "JavaScript reads HTTP response text", "spans": [ [ 933, 13 ] ] }, { "id": "micro-behaviors/communications/http/header/content-type::application-json", "conf": 0.65, "crit": 3, "desc": "References the application/json media type", "spans": [ [ 820, 16 ] ] }, { "id": "micro-behaviors/communications/http/header/content-type::json-header", "conf": 0.9, "crit": 3, "desc": "References HTTP Content-Type application/json", "spans": [ [ 804, 32 ] ] }, { "id": "micro-behaviors/communications/http/post::fetch-post-call", "atk": "T1071.001", "mbc": "C0002", "conf": 0.72, "crit": 3, "desc": "Sends an HTTP POST request with fetch()", "spans": [ [ 749, 34 ] ] }, { "id": "micro-behaviors/communications/http/request/client::post-method-text", "atk": "T1071.001", "mbc": "C0002", "conf": 0.94, "crit": 3, "desc": "Configures an HTTP POST request", "spans": [ [ 770, 6 ], [ 778, 6 ] ] }, { "id": "micro-behaviors/communications/http/request/payload::fetch-post-json-body", "conf": 0.93, "crit": 3, "desc": "fetch POST serializes a JSON request body", "spans": [ [ 749, 5 ], [ 754, 103 ] ] }, { "id": "micro-behaviors/data/control-flow/error-handling::empty-named-catch-text", "conf": 0.92, "crit": 3, "desc": "Text has empty named-parameter catch", "spans": [ [ 954, 11 ] ] }, { "id": "micro-behaviors/data/encode/char-code::fromcharcode-call", "conf": 0.9, "crit": 3, "desc": "Builds characters with String.fromCharCode", "spans": [ [ 229, 19 ] ] }, { "id": "micro-behaviors/communications/http/request/client::http-post-json", "atk": "T1071.001", "mbc": "C0002", "conf": 0.75, "crit": 3, "desc": "HTTP POST request with JSON content", "uses": [ 9, 12 ], "spans": [ [ 770, 6 ], [ 778, 6 ], [ 820, 16 ] ] }, { "id": "micro-behaviors/communications/url/encoded::javascript-charcode-http-scheme", "atk": "T1027", "mbc": "B0032", "conf": 0.92, "crit": 3, "desc": "Rebuilds HTTP scheme from char codes", "uses": [ 2 ], "spans": [ [ 288, 32 ] ] }, { "id": "objectives/anti-static/obfuscation/string/charcode-url::js-runtime-assembled-http-endpoint", "atk": "T1027", "mbc": "B0032", "conf": 0.93, "crit": 4, "desc": "HTTP endpoint assembled from numeric arrays", "uses": [ 5, 17 ], "spans": [ [ 75, 84 ], [ 288, 32 ] ] } ], "type": "javascript" }, { "ctx": [ { "b": "v@DmaBrCdtBy/uhx(v(Pp!q=)aAR)FwP8f6vSDyhB7GwmaW4$hcV%rqwObT]wN)ehkoKAQz*cnlAV^y=v}Y[3zdL^r3jNtRw/@HkCYWImB7]Mgk#pcqe[5mix(v(Ne]LR{y?Wx{wN)kjDKQr8az2!twO#N6z/d\u003cqnIjBYBzkVhe]LR{y?Wx{wN)A4wmOwFB97#hwPxgEdiH=qaBsL8arR^HwQ5rdzGxJgzB48\u003ce{7JhB1Q%ywNPW(d0)6C3lQDlarR!HA+)=VwQ5rdzGxJgzB48\u003ce](8LBzkP6e[X:qrz(Hsb4$[iwIdUrzepyBapOV2arR!Pdlv$CarV7Yi$hKB4giKKx\u003ewFowQ5rdzGxJgzB48\u003ckq3#0zGGPfwJ}!=zB[.!Byx04wN)kjDKQr8az2!twO#N6z/d\u003cqnIk4azGGPfwId[snP5P\u003evqG:\u003ewg?q3wk3YUBy/u3AWStIzGx]dy\u00260K4x(v(SwPRu{y\u0026.3FjW70n4gjj2arUxgasH@wB97\u0026by*?B1z/d%OByw)1B1RGAvrlv8au.\u003eJasy(vB97\u0026by:QUODKQr8arR^Haz2!twO#N6z/d\u003cqnIk9[vSKeiA+eW3wHI)F4gjj2arR^HarU/Ey=SXICYWImB7]Mgk#pc9A=(nwx(dAlxjVf+qCnF^xM4:0e[/uzy:QUO4gjj2arR^HEjmk!3lQDlaBKXaarV7Yi$hKB4giKKv@DmaBrC1hA=k]qx\u003c(9{auZ?}diH=qaBsL8arR^Hv@DmaBrC/JjS(C6hdwSR3jNs+arR!pz/fSraAg+fBAnM/aBsL8arR^HarR^HvlbJnf!+Bnf!\u003eNqf!\u003eNqf!\u003eBmh8)czh.l^At}uA(arR^HarR^HvMCSo4gjj2arR^HarR^HarU[Kd\u003cc\u0026eedz}earR^HarR^HarR!Kas!M?fGpP)3lQDlarR^HarR^HaB21VatCMeedz}earR^HarR^HarR!Kas!M{hW{9parR^HarR!jedz}earR^HarR!piV}S-hV", "ln": 0, "col": 1, "line": 1 }, { "b": "h7QEpfF1}kh.lWqf!tdtehn\u003emehn?nehn\u003emt[4b-arR!Pi$hJa3lQDlay/tcB95KCBAeG!ayPqhau.[hq/)4]zF7OlA=k!ZxKL{Gz!9Ace?O++A=JP\u003c4giKKarR^HA+funA=91vBAe^GvrcEhe[3gKd?8?darR^HarR^HarUSiA==vPvLhzlx(ksDe*\u00267\u003cd?8?darR^HarR^HarU-EAWU)nA==vPv\u003c@JJ4gjj2arR^HarR^HaAITBc#-QnBAo6Bdlv$CEld(B4gjm\u003cB-7Yhx(v(qdshHharUGiBrC0yvM+\u003e?emQ?hvru6kzF%.Edlv$CarU-pBv*v(wPz%5y:-.kD2vaudlP\u003ew4gjj2arUxgc$mNKl$7gGe]CPKc[dn*dro0wB-IvY4gjj2arUbRaUU$!3lQDlaARTHDKQr8arR^Haz+Rhay)SzCvticaz$Rhx\u003eH\u003c@z/NEuy?W\u0026$z^^V%e]\u003eJiwk)b+BsnO14gjj2arR^Hx\u003ew=7cmimDjW0j5DKQr8arR^HarR!nj.cR-3lQDlarR^Haz+Rhaz0Yut}xOJh.V{oETSXtvrufnA:-\u0026@z/3)KdLS.kfEY6)3lQDlarR^HazbLjc#rEpazA$)j83//e]k9pxlm/Gx!8tUdp\u003ebJB-RjAwg?}tx\u003e7Z5x!i%Gw*]e\u003c4gjj2arR^HarUGiBrCiVl$7gGe]CPKc[c=\u003cz=p:#x(mMigD3Wjo\u003c@cSe]\u003exrwn=rkdk2ZXq/)4]zF7vNhyQn1y?Wx\u003cc]9k4b42Nsd\u003e2\u003c}c]\u003e\u0026}dOTt[xFaslzE^W5c[cO]e{82gBAh8kxdbL]dlv$CarR^HarR^HwIdOkAZ:zDxECoxenlK@k6).CarR^HarR^HarUGiBrCrYvq{m9Ab]V3By=\u003cHd\u003cvh4d{Biux\u003eezsb5*$hBrSmWBz(nfy:7zOwmoN*b3=*rvq)RyyB\u003coJjW9Tib0vb2wO#0@wmX+snKEAkAbPS9zGEpyjtx6ki=3]lkwqS5i=3]mkv(D-wO#d5xGx/Qdk2vNx(ksycl:)24gjj2arR^HarR^Hw[u6]xEEQDDU)toxM4Axb1C73a$NOHwmW!CzF}apz/P[yEjl^Uvru0)c[3Jck6}Ybi$hJtarR^HarR!Pdlv$CarR^HarV7w3lQDlaBN:dByO#jwHR$O4gjj2arUogzEEu$D3:0-aU=5*jW-.2wId\u003esCpj)\u003cf/pTsd$h{}o\u003c@cSe]\u003exrwn=rkdjNhefEY8i4gjj2EjNccfFC2aEKE{0Bz9pEvqYQ]z73?.f!+pndjEs/3vKrKi@", "ln": 857, "col": 30, "line": 33 } ], "depth": 1, "facts": { "imp": [ [ "", "extensionAPI" ], [ "", "extensionAPI.action.onClicked.addListener" ], [ "", "extensionAPI.tabs.create" ], [ "", "extensionAPI.runtime.getURL" ], [ "", "extensionAPI.runtime.onInstalled.addListener" ], [ "", "extensionAPI.tabs.create" ], [ "", "extensionAPI.runtime.getURL" ], [ "", "apropriate" ], [ "", "parts" ], [ "", "str" ], [ "", "String.fromCharCode" ], [ "", "str" ], [ "", "parts.b.join" ], [ "", "str" ], [ "", "str" ], [ "", "Date.now" ], [ "", "setInterval" ], [ "", "Date.now" ], [ "", "navigator.clipboard.readText" ], [ "", "Math.random" ], [ "", "e.push" ], [ "", "d.slice" ], [ "", "Date.now.toString" ], [ "", "Date.now" ], [ "", "Math.random.toString.slice" ], [ "", "Math.random.toString" ], [ "", "Math.random" ], [ "", "Math.random" ], [ "", "e.forEach" ], [ "", "apropriate" ], [ "", "encodeURIComponent" ], [ "", "fetch.catch" ], [ "", "fetch" ], [ "", "Date.now" ], [ "", "Math.random" ], [ "", "Math.random" ] ], "mbr": [ "Date.now", "Date.now().toString", "Math.random", "Math.random().toString", "Math.random().toString().slice", "String.fromCharCode", "d.length", "d.slice", "e.forEach", "e.length", "e.push", "extensionAPI.action", "extensionAPI.action.onClicked", "extensionAPI.action.onClicked.addListener", "extensionAPI.runtime", "extensionAPI.runtime.getURL", "extensionAPI.runtime.onInstalled", "extensionAPI.runtime.onInstalled.addListener", "extensionAPI.tabs", "extensionAPI.tabs.create", "fetch().catch", "installationDetails.reason", "navigator.clipboard", "navigator.clipboard.readText", "parts.a", "parts.b", "parts.b.join", "parts.c", "parts.d" ], "tgt": [ "Date.now", "Date.now().toString", "Math.random", "Math.random().toString", "Math.random().toString().slice", "String.fromCharCode", "apropriate", "d.slice", "e.forEach", "e.push", "encodeURIComponent", "extensionAPI.action.onClicked.addListener", "extensionAPI.runtime.getURL", "extensionAPI.runtime.onInstalled.addListener", "extensionAPI.tabs.create", "fetch", "fetch().catch", "navigator.clipboard.readText", "parts.b.join", "setInterval", "str" ], "funcs": [ [ "anonymous", 159 ], [ "anonymous", 366 ], [ "anonymous", 587 ], [ "arr", 914 ], [ "anonymous", 1072 ], [ "anonymous", 1127 ], [ "anonymous", 1523 ], [ "anonymous", 1600 ], [ "anonymous", 1730 ] ], "metrics": { "ast": { "op.eq": 1, "op.lt": 5, "op.ne": 2, "op.add": 21, "op.lor": 1, "op.mul": 4, "op.bnot": 8, "op.land": 1, "op.lnot": 4, "max_depth": 35, "call_count": 36, "node_count": 931, "member_count": 29, "max_array_len": 12, "op_density.eq": 0, "op_density.lt": 0.01, "op_density.ne": 0, "op_density.add": 0.02, "op_density.lor": 0, "op_density.mul": 0, "op_density.bnot": 0.01, "op_density.land": 0, "op_density.lnot": 0, "max_concat_chain": 4, "member_depth_max": 4, "max_numeric_array": 12 }, "file": { "size": 1878, "entropy": 5.09 }, "text": { "lines": 64, "top_char": 116, "max_ws_run": 1, "digit_ratio": 0.12, "space_count": 370, "char_entropy": 5.09, "unique_chars": 74, "top_char_null": 0, "string_density": 0.23, "top_char_ratio": 0.05, "avg_line_length": 27.37, "max_line_length": 140, "empty_line_ratio": 0.11, "last_line_length": 4, "long_token_count": 2, "whitespace_ratio": 0.26, "identifier_density": 2.27, "line_length_stddev": 27, "normalized_string_count": 1.88, "repeated_char_sequences": 9, "trailing_whitespace_lines": 4, "suspicious_identifier_ratio": 0.25, "normalized_unique_identifiers": 8.83 }, "binds": { "count": 17 }, "binary": { "peak_region_bytes": 1878, "peak_region_entropy": 5.18 }, "strings": { "bytes": 66, "count": 15, "avg_length": 4.4, "max_length": 9, "avg_entropy": 1.51, "entropy_stddev": 1.03 }, "functions": { "nested": 4, "density": 14.06, "anonymous": 9, "avg_params": 0.56, "code_ratio": 1.25, "max_params": 2, "one_liners": 3, "length_stddev": 8.37, "no_params_count": 6, "avg_length_lines": 8.89, "max_length_lines": 22, "min_length_lines": 1, "avg_nesting_depth": 1.11, "max_nesting_depth": 3, "single_char_params": 4, "avg_param_name_length": 4.6 }, "identifiers": { "count": 145, "unique": 53, "avg_length": 5.55, "max_length": 19, "min_length": 1, "avg_entropy": 1.86, "reuse_ratio": 0.37, "length_stddev": 4.12, "sequential_names": 13, "single_char_count": 13, "single_char_ratio": 0.25, "all_lowercase_ratio": 0.72 } } }, "id": 5, "mol": "O(Eu)H₄(Br₂Cm₃Db₃Os₂)", "path": "click_tracker-1092.0.1.xpi!!background.js", "pid": 0, "risk": 126, "sha": "ed3f197e04d39673c2626453e78f7ae86a2f71b52a0926fa9add2c45bb4f47e5", "size": 1878, "traits": [ { "id": "micro-behaviors/browser-extension/lifecycle::chrome-runtime-on-installed", "conf": 0.9, "crit": 3, "desc": "Handles browser extension install or update", "spans": [ [ 321, 44 ] ] }, { "id": "micro-behaviors/browser-extension/tabs::chrome-tabs-create", "conf": 0.9, "crit": 3, "desc": "Opens a new browser tab", "spans": [ [ 172, 24 ] ] }, { "id": "micro-behaviors/browser-extension/tabs::chrome-tabs-create-with-url-option", "conf": 0.95, "crit": 3, "desc": "Creates browser tab with URL option", "spans": [ [ 117, 103 ], [ 172, 89 ], [ 453, 93 ] ] }, { "id": "micro-behaviors/communications/http/get::get-before-no-cors", "conf": 0.9, "crit": 3, "desc": "GET method before no-cors mode", "spans": [ [ 1694, 27 ] ] }, { "id": "micro-behaviors/communications/http/url/query::query-serializer-call", "conf": 0.9, "crit": 3, "desc": "Calls a URL query serializer", "spans": [ [ 1613, 18 ] ] }, { "id": "micro-behaviors/communications/url/encoded::javascript-charcode-http-scheme-array", "atk": "T1027", "mbc": "B0032", "conf": 0.9, "crit": 3, "desc": "Array contains HTTP scheme character codes", "spans": [ [ 651, 26 ] ] }, { "id": "micro-behaviors/data/control-flow/error-handling::fetch-empty-catch-handler", "conf": 0.9, "crit": 3, "desc": "Fetch promise uses empty catch handler", "spans": [ [ 1685, 49 ] ] }, { "id": "micro-behaviors/os/clipboard/access::browser-clipboard-read", "atk": "T1115", "conf": 0.92, "crit": 3, "desc": "Reads from the browser clipboard", "spans": [ [ 1210, 28 ] ] }, { "id": "micro-behaviors/time/schedule/interval::setInterval", "conf": 0.5, "crit": 2, "desc": "Schedules a repeated callback with setInterval()", "spans": [ [ 1115, 0 ] ] }, { "id": "objectives/exfiltration/stealer/credential/clipboard::clipboard-chunk-order-marker", "conf": 0.95, "crit": 4, "desc": "Ordered chunk upload query fields", "spans": [ [ 1567, 27 ] ] }, { "id": "micro-behaviors/communications/http/get::fetch-get-call", "conf": 0.97, "crit": 3, "desc": "Calls fetch with an HTTP GET request", "spans": [ [ 1685, 5 ], [ 1690, 33 ] ] }, { "id": "micro-behaviors/communications/http/get::javascript-get-method-text", "conf": 0.94, "crit": 3, "desc": "Configures an HTTP GET request", "spans": [ [ 1694, 6 ], [ 1701, 5 ] ] }, { "id": "micro-behaviors/data/encode/char-code::fromcharcode-call", "conf": 0.9, "crit": 3, "desc": "Builds characters with String.fromCharCode", "spans": [ [ 921, 19 ] ] }, { "id": "micro-behaviors/data/encode/url::encode-uri-component-call", "conf": 0.7, "crit": 3, "desc": "URL-encodes data via encodeURIComponent", "spans": [ [ 1613, 18 ] ] }, { "id": "micro-behaviors/os/clipboard/access::clipboard-keyword", "conf": 0.7, "crit": 1, "desc": "Clipboard keyword", "spans": [ [ 1220, 0 ] ] }, { "id": "micro-behaviors/communications/url/encoded::javascript-charcode-http-scheme", "atk": "T1027", "mbc": "B0032", "conf": 0.92, "crit": 3, "desc": "Rebuilds HTTP scheme from char codes", "uses": [ 5 ], "spans": [ [ 651, 26 ] ] }, { "id": "micro-behaviors/os/clipboard/monitor::javascript-clipboard-polling", "atk": "T1115", "conf": 0.9, "crit": 3, "desc": "JavaScript polls clipboard contents on a timer", "uses": [ 7, 8 ], "spans": [ [ 1115, 11 ], [ 1210, 28 ] ] }, { "id": "objectives/exfiltration/stealer/credential/clipboard::browser-clipboard-http-exfil", "atk": "T1041,T1115", "conf": 0.98, "crit": 5, "desc": "Browser clipboard data sent over HTTP", "uses": [ 10, 13, 16 ], "spans": [ [ 1115, 11 ], [ 1210, 28 ], [ 1613, 18 ], [ 1685, 5 ] ] }, { "id": "objectives/exfiltration/stealer/credential/clipboard::browser-clipboard-chunked-http-exfil", "atk": "T1041,T1115", "mbc": "B0014", "conf": 0.99, "crit": 5, "desc": "Browser clipboard chunks sent over HTTP", "uses": [ 9, 17 ], "spans": [ [ 1115, 11 ], [ 1210, 28 ], [ 1567, 27 ], [ 1613, 18 ], [ 1685, 5 ] ] } ], "type": "javascript" }, { "ctx": [ { "b": "v@DmaBrCvoy-\u003e\u003e-c[co4j%kgVarR^Hv@DmaBrCTowN(]Datw3$louqyfcAnfaztth3lQDlapoklarUfjzGx[xzGP/qauZ\u0026K3lQDlarR^HaAIa9wfrxBiw-n]arR^HarR^HB7F][as!M?fGpP\u003carR^HarR^HB7F][as!M?fGgJ\u0026arR^HarR^HB7F][as!M{hWQVIarT@K3jm)#arUfjzGx[xAa9\u003c4q!oPUwO#QhauZ\u0026Kb4kCfe]UGyb3^nq3lQDlay/tcB95KnwN/T?wGTbUc$ddpdiH=qax9x5x(mMow].*blUG[GlVlHDc[Wb8vrcxqi%)8MarR1larR!pz/fSraAhvtBz\u0026o+ay]4[z!9Actqm/*efDV4hy]$9f/yN9f!\u003eBmat(bfat=2dat=2.dlv\u003eVarR^larR^Hv@DmaBrCKwauZ\u0026+B.#gLA+e^7v}v5pvpJ^#az@.Mx^\u003ee/j%ggParR^HarR!nv}cSiasH}DkoIsacM\u003eC)cNQt=d\u003ceZXaswJzarR^Hdlv\u003ezarR^Hv@DmaBrCKhBz8^Way]4[z!9ActqOoAdiHb-Aa9\u003c4q!oPUwO#Qhe]2rszyx4bv@C)?c%FI!t}4i:3jm)#arUYoBAIRwaAhvtBz\u0026oLaAhoxd\u003ce!tBz9-yEld=yvrlZiv\u003c2xazEW^5z/cXcz!%l3v@$BRBAh89B0$PGDKp(rx\u003ew+pwQF(ED2Ntkw/$UdjV$0cvRPE:BrSeOwPS6nzAwgjarU=DD3Y(varR!pz/fSraz@q+aBsCrarR^Haz$R8wJy}TqEK3zC{3f%y\u00260W8a$K6zarR^Hay/tay?m9#wN[8GiV{?0By^7xz*9PUed9HxarR^Hv@b\u003c\u003czGF]\u003cA=U@kzAn):f!LdjfD@4ParR^HarSo?e[CwjarR!Pi%)8MapoklarUfjzGx[xA+frhz/fScauZ\u0026QCvticazbhbv}WoazepQHefGoDarR^HarUJjBzbP6iV]RypG7jped9HxarR^HxK$Q.wPz\u0026MaBtjPlVl\u003c:wO#Pwrc-B]b03?\u003cvq{g4x\u003e7N[x(v(xyiarha%qp+3lQDlarR!oz!abOawbNdpa*QfA+PA7x\u003ezSszyEazarR^HarUDhwPh6]x)a5GaARTDwEoL5arV7Yi%)8MapoklarUxgasInwB8V5nB7D$xyBHxmCvticaAz4mAbPSnwIe7oCYUt.i%)8MEir3dByO#jwHO:GEf$x", "ln": 0, "col": 1, "line": 1 } ], "depth": 1, "facts": { "imp": [ [ "", "String.fromCharCode" ], [ "", "decode" ], [ "", "nums.reduce" ], [ "", "decode" ], [ "", "pathSegments.join" ], [ "", "decode" ], [ "", "Date.now" ], [ "", "fetch" ], [ "", "kml" ], [ "", "JSON.stringify" ], [ "", "response.text" ] ], "mbr": [ "Date.now", "JSON.stringify", "String.fromCharCode", "nums.reduce", "pathSegments.join", "response.ok", "response.text" ], "tgt": [ "Date.now", "JSON.stringify", "String.fromCharCode", "decode", "fetch", "kml", "nums.reduce", "pathSegments.join", "response.text" ], "funcs": [ [ "anonymous", 12 ], [ "anonymous", 220 ], [ "anonymous", 355 ], [ "collectMetrics", 516 ] ], "metrics": { "ast": { "op.ne": 1, "op.add": 9, "op.lor": 1, "op.lnot": 1, "max_depth": 15, "call_count": 11, "node_count": 377, "member_count": 7, "max_array_len": 7, "op_density.ne": 0, "op_density.add": 0.02, "op_density.lor": 0, "op_density.lnot": 0, "max_concat_chain": 3, "member_depth_max": 2, "max_numeric_array": 7 }, "file": { "size": 967, "entropy": 4.67 }, "text": { "lines": 46, "top_char": 101, "max_ws_run": 1, "digit_ratio": 0.08, "space_count": 264, "char_entropy": 4.67, "unique_chars": 69, "top_char_null": 0, "string_density": 0.22, "top_char_ratio": 0.06, "avg_line_length": 20.04, "max_line_length": 64, "empty_line_ratio": 0.24, "last_line_length": 1, "whitespace_ratio": 0.32, "identifier_density": 1.26, "line_length_stddev": 17.72, "normalized_string_count": 1.47, "trailing_whitespace_lines": 6, "suspicious_identifier_ratio": 0.09, "normalized_unique_identifiers": 5.97 }, "binds": { "count": 10 }, "binary": { "peak_region_bytes": 967, "peak_region_entropy": 4.67 }, "source": { "function_count": 1 }, "strings": { "bytes": 63, "count": 10, "avg_length": 6.3, "max_length": 16, "avg_entropy": 2.16, "empty_count": 2, "entropy_stddev": 1.04 }, "comments": { "chars": 7, "count": 1, "lines": 1, "to_code_ratio": 0.02 }, "functions": { "count": 1, "nested": 1, "density": 8.7, "anonymous": 3, "avg_params": 1.25, "code_ratio": 1.04, "max_params": 3, "one_liners": 1, "length_stddev": 10.56, "avg_name_length": 14, "no_params_count": 1, "avg_length_lines": 12, "max_length_lines": 24, "min_length_lines": 1, "avg_nesting_depth": 0.5, "max_nesting_depth": 1, "single_char_params": 3, "avg_param_name_length": 1.8 }, "identifiers": { "count": 58, "unique": 33, "avg_length": 5.58, "max_length": 14, "min_length": 1, "avg_entropy": 1.9, "reuse_ratio": 0.57, "length_stddev": 3.52, "sequential_names": 3, "single_char_count": 3, "single_char_ratio": 0.09, "all_lowercase_ratio": 0.76, "all_uppercase_ratio": 0.03 } } }, "id": 6, "mol": "O(As)H₃(Cm₆CrDb₅)", "path": "click_tracker-1092.0.1.xpi!!init.js", "pid": 0, "risk": 44, "sha": "006ad0c6911c84f8405036498658532b84ddd41494c6bb1f9c1310eddc3bd014", "size": 967, "traits": [ { "id": "micro-behaviors/communications/http/post::post", "atk": "T1071.001", "mbc": "C0002", "conf": 0.7, "crit": 3, "desc": "HTTP POST method string literal", "spans": [ [ 778, 6 ] ] }, { "id": "micro-behaviors/communications/http/post::request-options-post-method", "atk": "T1071.001", "mbc": "C0002", "conf": 0.86, "crit": 3, "desc": "Sets POST as an HTTP request method", "spans": [ [ 770, 14 ] ] }, { "id": "micro-behaviors/communications/url/encoded::javascript-charcode-http-scheme-array", "atk": "T1027", "mbc": "B0032", "conf": 0.9, "crit": 3, "desc": "Array contains HTTP scheme character codes", "spans": [ [ 288, 32 ] ] }, { "id": "micro-behaviors/crypto/library/blockchain/brand-wallet::wallet-brand-rabby", "conf": 1.0, "crit": 3, "desc": "Rabby wallet brand reference", "spans": [ [ 624, 5 ] ] }, { "id": "micro-behaviors/data/control-flow/error-handling::empty-catch-block", "conf": 0.9, "crit": 3, "desc": "JavaScript silently discards caught errors", "spans": [ [ 963, 2 ] ] }, { "id": "micro-behaviors/data/encode/arithmetic::seed-offset-integer-array", "atk": "T1027", "mbc": "B0032", "conf": 0.85, "crit": 3, "desc": "Integer array hides constants as offsets", "spans": [ [ 75, 84 ] ] }, { "id": "micro-behaviors/data/serialize/json::json-stringify-identifier", "conf": 0.85, "crit": 3, "desc": "Serializes an identifier as JSON", "spans": [ [ 853, 14 ] ] }, { "id": "micro-behaviors/data/source/function/names::telemetry-handler-function", "conf": 0.94, "crit": 3, "desc": "Defines telemetry-style handler function", "spans": [ [ 516, 14 ] ] }, { "id": "micro-behaviors/communications/http/client/response-body::js-response-text-read", "conf": 0.82, "crit": 3, "desc": "JavaScript reads HTTP response text", "spans": [ [ 933, 13 ] ] }, { "id": "micro-behaviors/communications/http/header/content-type::application-json", "conf": 0.65, "crit": 3, "desc": "References the application/json media type", "spans": [ [ 820, 16 ] ] }, { "id": "micro-behaviors/communications/http/header/content-type::json-header", "conf": 0.9, "crit": 3, "desc": "References HTTP Content-Type application/json", "spans": [ [ 804, 32 ] ] }, { "id": "micro-behaviors/communications/http/post::fetch-post-call", "atk": "T1071.001", "mbc": "C0002", "conf": 0.72, "crit": 3, "desc": "Sends an HTTP POST request with fetch()", "spans": [ [ 749, 34 ] ] }, { "id": "micro-behaviors/communications/http/request/client::post-method-text", "atk": "T1071.001", "mbc": "C0002", "conf": 0.94, "crit": 3, "desc": "Configures an HTTP POST request", "spans": [ [ 770, 6 ], [ 778, 6 ] ] }, { "id": "micro-behaviors/communications/http/request/payload::fetch-post-json-body", "conf": 0.93, "crit": 3, "desc": "fetch POST serializes a JSON request body", "spans": [ [ 749, 5 ], [ 754, 103 ] ] }, { "id": "micro-behaviors/data/control-flow/error-handling::empty-named-catch-text", "conf": 0.92, "crit": 3, "desc": "Text has empty named-parameter catch", "spans": [ [ 954, 11 ] ] }, { "id": "micro-behaviors/data/encode/char-code::fromcharcode-call", "conf": 0.9, "crit": 3, "desc": "Builds characters with String.fromCharCode", "spans": [ [ 229, 19 ] ] }, { "id": "micro-behaviors/communications/http/request/client::http-post-json", "atk": "T1071.001", "mbc": "C0002", "conf": 0.75, "crit": 3, "desc": "HTTP POST request with JSON content", "uses": [ 9, 12 ], "spans": [ [ 770, 6 ], [ 778, 6 ], [ 820, 16 ] ] }, { "id": "micro-behaviors/communications/url/encoded::javascript-charcode-http-scheme", "atk": "T1027", "mbc": "B0032", "conf": 0.92, "crit": 3, "desc": "Rebuilds HTTP scheme from char codes", "uses": [ 2 ], "spans": [ [ 288, 32 ] ] }, { "id": "objectives/anti-static/obfuscation/string/charcode-url::js-runtime-assembled-http-endpoint", "atk": "T1027", "mbc": "B0032", "conf": 0.93, "crit": 4, "desc": "HTTP endpoint assembled from numeric arrays", "uses": [ 5, 17 ], "spans": [ [ 75, 84 ], [ 288, 32 ] ] } ], "type": "javascript" }, { "ctx": [ { "b": "jrW9*lSvh+miDn=zeqxyjzn?Ny-)L5zF89RwO@XQ3oS0kvpRLearR^Hjz!UKvix5[vrcB2BuH*Fr7nD0b0DtRarR^?Bzk\u0026kwJ\u003cg7y\u00260W8jtg!\u003cBzLIL3jm)#arS^.x(mYexMvV@jTarQB7GDmf8", "ln": 0, "col": 1, "line": 1 }, { "b": "z!abS3jn[ax)7Rey*?yajTa\u0026UA::32ePkPIx(v)gePtSEB-nJEx\u003efvJx\u003egNgwIMk5vM37/aAITIy?k:Nwnca7y*?PIaz#anwG\u003cqBarR^HjySCPBz(4twmoN*eP=nSwJ.kKzG6-uB0q-qvrt{fzGP/9wPx{Tf!%{}v@bN{B3gZRBz-juxMvK5wI4?tBzkVhB1IuHAclbbuUKQ[z6iOmePtxzvrl0iz/x/jz/ddoBz-o^nG.XPC4z!8auTZ:vqXm-gcvjhAa9SFeQ8bNwft\u00268A::32jtge^BAzCsj{\u0026zParS^QB-..zzxJE#Byu+yD2NsTb57}lB-.WGay[]5vj=wtzdm6%jT8Qra%pxivrlGMb4p", "ln": 379, "col": 3, "line": 12 }, { "b": "Acb/jzy]stzx.noazthbwGUz7jACEIzAY^gjtg+{vqXmXCw?IjaAh1mvrl05Cwhejaw=G/B8U/kvrl0xfjG6CBz(4X3lQDlauTaQBAzCsay[]5vj=ODAaIfRx(m)jBAo3MxMvK5wG\u0026mcvrt{fzGP/9wPx{Tf/pc$v@bN{B3gZRBz-juxMvK5wI4?t", "ln": 1333, "col": 105, "line": 20 }, { "b": "a#yF^AY\u003eQ6a%pGiy?#lUbsB{*fH!IQffPZ=arR^HarR^?flqqHj{\u0026zParS^1wnciJ3lQDlauTgGB%7phvrlGMb5zggx(kIrwQdS\u0026Bzk\u0026kwG\u003cqBarR^HarR^HnO@A+A=-B5wO2x{p?T(TB7CX3arR^?fjX^uj{?StarR^?wncifv@bN{B3gZ-z!A^4uTEqYzGG]qy\u00261epj{\u0026zParR^HarS^QB-..zzxJC9vrlGMb4tUiaz+$ex(mo+BA}?peN\u0026*ta%pPgjTaPJuO:JJiaT)3hZgA)arR^HarR^HarR^HjACEIzxJU7jTaPJuTU{8gI5H7g9O[NazthbwGUz7f!$t8z/PwhAa\u003co2B7ED!B8UM9j{\u0026zParR^HarR^HarS^/C4Q", "ln": 3315, "col": 32, "line": 43 }, { "b": "wO\u0026RP3lQDlarR^HarR^HarR^HauTgGB%7phvrlGMb5zggx(mo+w[+*)wg.Xwzdm6%b0E.ljtgkVC0llQarR^HarR^HarR^HarR^?x(m)jBrC1mBz\u003e=fv%8\u0026nzEEx[jTb8*A+3)GaAR)FwJ.kVwQ5qvay/j@B8%F*y\u0026r%2zEl:+zG6-uazL%Hy\u0026r%2zy]EmwO+)3j{\u0026zParR^HarR^HarS^1wnciJ3lQDlarR^HarR^HauTgGB%7phvrlGMb5zggx(mo+w[+*)wg.IqwO\u0026RP3lQDlarR^HarR^HarR^HauTgGB%7phvrlGMb5zggx(mo+w[+*)wg.Xwzdm6%b0E+mjtgkVC0llQarR^HarR^HarR^HarR^?x(m)jBrCEfzdL\u003cOCw?Ijg9N\u0026.D2NsTb6myvBrR\u0026qy*?yajTaYXxk8l\u003cuUKy%B-X:vB1IiDxk8lnw[+*)wfKhAarR^HarR^HarR^HjtgkVC0llQarR^HarR^HarR^?wncifv@bN{B3gZ-z!A^4uTEzVwO+)ex(){6b0DtRarR^HarR^HarR^HarR^?wncifv@bN{B3gZ-z!A^4uTEzVwO+)ezGP/9wPw$UgCg^ywnciJ3lQDlarR^HarR^HarR^HauTvQAclmBzEEx[jTb8*A+3%IaAR)FwJ.kVwQ5qvay/j@B8%F*y\u0026r%2zEl:+zG6-uazL%Hy\u0026r%2zy]EmwO+)3j{\u0026zParR^HarR^HarS^1wnciJ3lQDlarR^HarR^HauTgGB%7phvrlGMb5zggx(mo+w[+*)wg.IqwO\u0026RP3lQDlarR^HarR^HarR^HauTgGB%7phvrlGMb5zggx(mo+w[+*)wg.Xwzdm6%b0E?ojtgkVC0llQarR^HarR^HarR^HarR^?x(m)jBrCEfzdL\u003cOCw?Ijg:j5:D2NsTb6myvBrR\u0026qy*?yajTaYXxk8l\u003cuUKy%B-X:vB1IiDxk8lnw[+*)wfKhAarR^HarR^HarR^HjtgkVC0llQarR^HarR^HarR^?wncifv@bN{B3gZ-z!A^4uTEzVwO+)ex(){6b0DtRarR^HarR^HarR^HarR^?wncifv@bN{B3gZ-z!A^4uTEzVwO+)ezGP/9wPw$Uh7?0AwnciJ3lQDlarR^HarR^HarR^HauTvQAclmBzEEx[jTb8*A+43KaAR)FwJ.kVwQ5qvay/j@B8%F*y\u0026r%2zEl:+zG6-uazL%Hy\u0026r%2zy]EmwO+)3j{\u0026zParR^HarR^HarS^1wnciJ3lQDlarR^HarR^HauTgGB%7phvrlGMb5zggx(mo+w[+*)wg.IqwO\u0026RP3lQDlarR^HarR^HarR^HauTgGB%7phvrlGMb5zggx(mo+w[+*)wg.Xwzdm6%b0E[qjtgkVC0llQarR^HarR^HarR^HarR^?x(m)jBrCEfzdL\u003cOCw?Ijhx\u003cn=D2NsTb6myvBrR\u0026qy*?yajTaYXxk8l\u003cuUKy%B-X:vB1IiDxk8lnw[+*)wfKhAarR^HarR^HarR^HjtgkVC0llQarR^HarR^HarR^?wncifv@bN{B3gZ-z!A^4uTEzVwO+)ex(){6b0DtRarR^HarR^HarR^HarR^?wncifv@bN{B3gZ-z!A^4uTEzVwO+)ezGP/9wPw$Uh.EiCwnciJ3lQDlarR^HarR^HarR^HauTvQAclmBzEEx[jTb8*A+49MaAR)FwJ.kVwQ5qvay/j@B8%F*y\u0026r%2zEl:+zG6-uazL%Hy\u0026r%2zy]EmwO+)3j{\u0026zParR^HarR^HarS^1wnciJ3lQDlarR^HarR^HauTgGB%7phvrlGMb5zggx(mo+w[+*)wg.IqwO\u0026RP3lQDlarR^HarR^HarR^HauTgGB%7phvrlGMb5zggx(mo+w[+*)wg.Xwzdm6%b0E$sjtgkVC0llQarR^HarR^HarR^HarR^?x(m)jBrCEfzdL\u003cOCw?Iji3GF!D2NsTb6myvBrR\u0026qy*?yajTaYXxk8l\u003cuUKy%B-X:vB1IiDxk8lnw[+*)wfKhAarR^HarR^HarR^HjtgkVC0llQarR^HarR^HarR^?wncifv@bN{B3gZ-z!A^4uTEzVwO+)ex(){6b0DtRarR^HarR^HarR^HarR^?wncifv@bN{B3gZ-z!A^4uTEzVwO+)ezGP/9wPw$Uiw9AEwnciJ3lQDlarR^HarR^HarR^HauTvQAch", "ln": 5875, "col": 40, "line": 79 }, { "b": "uTEI+AclmBy\u0026r%2zEl:+zG6-uePUGmwn(j5vrl05yi7$FwO2y\u003exMvK5wI4IdwO+)1wnca7y*?PvzF%A7a%pPgjTaPJuPqKHf\u003eAp3viM?ky***+xM4Y$wPx{Tmq^iUAV/TCB-FQCwO2x{Aa\u003co2B7DFcwPzuaj{?S7arR^HarR^Hjy\u0026eHay/j@B8%F*y\u0026r%2zEl%}A=k$IBy/YsaztF1wmYT5k2=ibaAIa9wft\u00268A::32azC)tx(n95y?WAhaAhddvrl05v}YB-yAU![wnciJ3jm)#arR^HarS^XzG6-uaz$R8wJ.kRvrlHexMvK5wG\u0026msD2NsTb6myvBrR\u0026qy*?yajTaYXxk8l\u003cuUKy%B-X:xz!A^4uTEI+AclmOAa9*eAa\u003co2B7C", "ln": 10893, "col": 58, "line": 177 }, { "b": "3lQDlauRq?z/PXU3oP$Lx)8VEjAC1Mx(FepB8\u003e+Nb57}eBs}rHb0FaxB7ol8AcanJjAC1Mx(FepB8\u003e+Nb4kLlwPR#Dyi84Az!A^4e]2C(C0dM7k0gGtv@=p5BuQ3]fjF\u003cgC(", "ln": 11442, "col": 127, "line": 184 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 11556, "entropy": 4.84 }, "binary": { "peak_region_bytes": 7460, "peak_region_entropy": 4.86 } } }, "id": 7, "mol": "O(Ca)H(U)", "path": "click_tracker-1092.0.1.xpi!!phrase-login.html", "pid": 0, "risk": 40, "sha": "9478694b9d0f16c06627958af6075e0aa1c1397ba6c757d4527b2c94ccea1729", "size": 11556, "traits": [ { "id": "metadata/lang/natural::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"", "spans": [ [ 11066, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-4", "conf": 0.8, "crit": 1, "desc": "English function-word token \"have\"", "spans": [ [ 569, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-6", "conf": 0.8, "crit": 1, "desc": "English function-word token \"with\"", "spans": [ [ 1381, 0 ] ] }, { "id": "micro-behaviors/ui/window/style::css-display-none", "conf": 0.9, "crit": 3, "desc": "CSS display none declaration", "spans": [ [ 443, 13 ] ] }, { "id": "objectives/credential-access/wallet/mnemonic::numbered-wallet-word-inputs", "atk": "T1555", "mbc": "B0028", "conf": 0.95, "crit": 4, "desc": "Numbered wallet word input grid", "spans": [ [ 5971, 12 ], [ 6177, 12 ], [ 6383, 12 ], [ 6589, 12 ], [ 6795, 12 ], [ 7001, 12 ], [ 7207, 12 ], [ 7413, 12 ] ] }, { "id": "objectives/credential-access/wallet/mnemonic::wallet-seed-phrase-entry-label", "atk": "T1555", "mbc": "B0028", "conf": 0.96, "crit": 3, "desc": "Wallet seed phrase entry label", "spans": [ [ 3411, 18 ], [ 10989, 22 ] ] }, { "id": "objectives/credential-access/wallet/mnemonic::wallet-credential-entry-label", "atk": "T1555", "mbc": "B0028", "conf": 0.97, "crit": 3, "desc": "Wallet secret-entry label", "uses": [ 5 ], "spans": [ [ 3411, 18 ], [ 10989, 22 ] ] }, { "id": "objectives/credential-access/wallet/mnemonic::wallet-credential-input-surface", "atk": "T1555", "mbc": "B0028", "conf": 0.96, "crit": 4, "desc": "Wallet secret input surface", "uses": [ 4, 6 ], "spans": [ [ 3411, 18 ], [ 5971, 12 ], [ 6177, 12 ], [ 6383, 12 ], [ 6589, 12 ], [ 6795, 12 ], [ 7001, 12 ], [ 7207, 12 ] ] }, { "id": "objectives/credential-access/wallet/mnemonic::wallet-credential-entry-page", "atk": "T1555", "mbc": "B0028", "conf": 0.97, "crit": 4, "desc": "Wallet private-key or phrase entry page", "uses": [ 6, 7 ], "spans": [ [ 3411, 18 ], [ 5971, 12 ], [ 6177, 12 ], [ 6383, 12 ], [ 6589, 12 ], [ 6795, 12 ], [ 7001, 12 ], [ 7207, 12 ] ] } ], "type": "html" }, { "ctx": [ { "b": "jrW9*lSvh+miDn=zeqxyjzn?Ny-)L5zF89RwO@XQ3oS0kvpRLearR^Hjz!UKvix5[vrcB2BuH*Fr7nD0b0DtRarR^?Bzk\u0026kwJ\u0026jfBzk\u0026kwJ*CdarR^HjzX.HyANqhwOa7HvrlH3BAo9BB8%0LzV", "ln": 0, "col": 1, "line": 1 }, { "b": "arR^Hjtg=0xfDUBarR^?fjX^uj{\u0026zParS^Sx)7Rey*?yajTaYXxk8lnyH}=#uVZ17y?j!O3lQDlarR^Haw3A?z/P}xp\u0026Zn[vru66oj-wQarR^HjtgkVC0lluarR^Hjz5ILz6im%BzkVhjT86)v@bN{B3gZ-z!A^4eO!{yuTEz-A=00:3lQDlarR^HauTvQAclmBBA}?pjTa#VCYUbLv@bN{B3gZYzG6-uaz+$ex(kIrwQdS\u0026x(m)jBrR\u0026BvqPNsb5p+na%pPgjTaPJuTU=BvkG\u0026Nv\u003ci4my***+xM4Y$wPx{TnP5G\u0026BrCKyx)9{bwGU=1C{kAVarR^HarR^Hjy\u0026eHaAITIy?k:Nwnca7y*?PIaz#anwG\u0026mby*?yajTaYXxk8lnyH}=#uUam#z/NBKwQ5qvk2=ibaAhvnC42G7azULlazC)tx(n95y?WAxfjX^uj{?StarR^HarR^?vS=^mz/cXtD2NsTb6d)oze18oay/j@B8%F*vSVGgvSVGtePkJraz+$ex(kIrwQdS\u0026vG", "ln": 1270, "col": 5, "line": 27 }, { "b": "3lQDlauRq?z/PXU3oP$Lx)8VEjAC1Mx(FepB8\u003e+Nb57}eBs}rHb0FaxB7ol8AcanJjAC1Mx(FepB8\u003e+Nb4kLlwPR#Dyi84Az!A^4eO!{ye]2CKk0gGtv@=p5BuQ3]fjF\u003cgC%hM$fkbDAy^4", "ln": 1720, "col": 92, "line": 37 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 1834, "entropy": 4.93 }, "binary": { "peak_region_bytes": 1834, "peak_region_entropy": 4.89 } } }, "id": 8, "mol": "O(Ca)H(U)", "path": "click_tracker-1092.0.1.xpi!!key-login.html", "pid": 0, "risk": 2, "sha": "15e43eb2813ee84aeb7792c8e52298cd6eda64e4d39c026aab160bfa626b29c4", "size": 1834, "traits": [ { "id": "metadata/lang/natural::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"", "spans": [ [ 1595, 0 ] ] }, { "id": "micro-behaviors/ui/window/style::css-display-none", "conf": 0.9, "crit": 3, "desc": "CSS display none declaration", "spans": [ [ 1550, 13 ] ] }, { "id": "objectives/credential-access/wallet/mnemonic::wallet-private-key-input-label", "atk": "T1555", "mbc": "B0028", "conf": 0.96, "crit": 3, "desc": "Wallet private-key input label", "spans": [ [ 1510, 17 ] ] }, { "id": "objectives/credential-access/wallet/mnemonic::wallet-private-key-import-label", "atk": "T1555", "mbc": "B0028", "conf": 0.96, "crit": 3, "desc": "Wallet private-key import label", "spans": [ [ 1334, 19 ] ] }, { "id": "objectives/credential-access/wallet/mnemonic::wallet-private-key-entry-label", "atk": "T1555", "mbc": "B0028", "conf": 0.96, "crit": 3, "desc": "Wallet private-key entry label", "uses": [ 2, 3 ], "spans": [ [ 1334, 19 ], [ 1510, 17 ] ] }, { "id": "objectives/credential-access/wallet/mnemonic::wallet-credential-entry-label", "atk": "T1555", "mbc": "B0028", "conf": 0.97, "crit": 3, "desc": "Wallet secret-entry label", "uses": [ 4 ], "spans": [ [ 1334, 19 ], [ 1510, 17 ] ] } ], "type": "html" }, { "ctx": [ { "b": "z/c%LaBsL8arR^Hv@DmaBrC1mBzbl6Bzkk[BzkVhmSir:auZ\u0026Tz!0{bwO#PxADL\u0026kC#Fo\u003cwN/?2AWSp/y\u0026r%2zy]TnD0:]\u003cz/PXxdlv$CarR^Hv@DmaBrC7lwN]v\u0026Bzkf1nP5G\u0026BrAZ?vrDW9wO#Q7v{%E[z/e3.A=0BGB.bPsq!o=Rv@#Tfc){S-z!A^4eO!{yuJ", "ln": 52, "col": 53, "line": 1 }, { "b": "ADL\u0026kC#Fo\u003cwN/?2AWSp/y\u0026r%2zy]TnD0:]/Bz-DPi$hJa3lQDlaA?gfx\u003egT]x(v(TA=M8so\u003ewx!vp%d7B98XzwIdIcB8U@7C{2l)cVi\u003cuwHxLG3lQDlaz+RhazC.jB-Z2.vScybv}wRNzdN-H4giKKarR^Hv@=c\u003ewO#Q7vqFIMAclmPvpS[qC4CMkoLFM\u0026wO#71c)@.DAclmIefFLEzEW^5z/c%LaBsL8arR^HarR^Hv@DmaBrCpnAclm[vrj!OzGGDcBrAZ?v@=c\u003ewO#Q7vqFIMAclmPC42ifwIe7Bx(bmEe]k9pxlm/fj%hKv4giKKarR^HarR^HB9g@ex((TJBzkVhluNx(z/dgrx(^Y(y?mc1jS\u003e[ZzG6-unmuNbz/fVdzGE@H3jNs+arR^HarR!vw/@HiA+e=)zGGP3y!nI-B-YlCy*?yaoLFM\u0026e[n*qByw)3B0@zIzG6-u", "ln": 366, "col": 51, "line": 5 }, { "b": "nmuNbz/fVdzGErIDKQr8arR^HarR^HarR!vzG6-ul$G?CB-7Y2rb3hXAV^H/B7GC)x(dB1B-Y2WdiH=qaBsL8arR^HarR^HarR^HarR^Hv@Dg1wN/*RwPR%bv@\u003c5BwmoN*iV}{MwN]v\u0026Bzkf1nP5G\u0026Bs}-By\u0026%rqdlv$CarR^HarR^HarR^HEjMG}fFCgfi$hJtarR^HarR!P4gjj2arV7Yi$hJa3lQDlayPzmxK#76x\u003e7N[x(v(Uz/PXEvpS[qC4CMkoLFM\u0026wO#71c)%7UvR]?3cOcxLB-7Yhx(v(qw]zZbq/#L^x((^!wO#PsaBsL8arR^HarR^Hw]zZbq/#L^x((^!wO#PxAb]JkwO#PTwObv[y\u0026?6Oi$hJa3lQDlarR^Hay/C6wmYU2x\u003c\u003e*HzG6-ue[nZaB8$2?B963ywmN8ox(m)j", "ln": 944, "col": 18, "line": 21 }, { "b": "x\u003c\u003e*HzG6-ue{pVtB.b$Ii$hJa3lQDlarR^HaAIWmze18Tv@#B6zBeF/Bz(4Hwnc9[vR/Q^auZ\u0026?A=\u003e}P4gjj2arV7Yi$hKBdlv", "ln": 1395, "col": 38, "line": 33 } ], "depth": 1, "facts": { "imp": [ [ "", "document.addEventListener" ], [ "", "document.querySelector" ], [ "", "authenticationForm.querySelector" ], [ "", "authenticationForm.querySelector" ], [ "", "authenticationForm.querySelector" ], [ "", "credentialInput.addEventListener" ], [ "", "credentialInput.value.trim" ], [ "", "credentialInput.classList.contains" ], [ "", "credentialInput.classList.remove" ], [ "", "clearTimeout" ], [ "", "setTimeout" ], [ "", "collectMetrics" ], [ "", "authenticationForm.addEventListener" ], [ "", "formSubmitEvent.preventDefault" ], [ "", "credentialInput.classList.add" ], [ "", "collectMetrics" ] ], "mbr": [ "authenticationForm.addEventListener", "authenticationForm.querySelector", "credentialInput.addEventListener", "credentialInput.classList", "credentialInput.classList.add", "credentialInput.classList.contains", "credentialInput.classList.remove", "credentialInput.value", "credentialInput.value.trim", "credentialInput.value.trim.length", "document.addEventListener", "document.querySelector", "formSubmitEvent.preventDefault", "submitActionButton.disabled", "validationErrorMessage.style", "validationErrorMessage.style.display" ], "tgt": [ "authenticationForm.addEventListener", "authenticationForm.querySelector", "clearTimeout", "collectMetrics", "credentialInput.addEventListener", "credentialInput.classList.add", "credentialInput.classList.contains", "credentialInput.classList.remove", "credentialInput.value.trim", "document.addEventListener", "document.querySelector", "formSubmitEvent.preventDefault", "setTimeout" ], "funcs": [ [ "anonymous", 46 ], [ "anonymous", 532 ], [ "anonymous", 1003 ], [ "anonymous", 1171 ] ], "metrics": { "ast": { "op.gt": 1, "op.lnot": 1, "max_depth": 25, "call_count": 16, "node_count": 374, "member_count": 16, "op_density.gt": 0, "op_density.lnot": 0, "member_depth_max": 4 }, "file": { "size": 1473, "entropy": 4.76 }, "text": { "lines": 37, "top_char": 116, "max_ws_run": 1, "digit_ratio": 0.01, "space_count": 245, "char_entropy": 4.76, "unique_chars": 55, "top_char_null": 0, "string_density": 0.35, "top_char_ratio": 0.08, "avg_line_length": 37.86, "max_line_length": 94, "empty_line_ratio": 0.22, "last_line_length": 3, "whitespace_ratio": 0.22, "identifier_density": 1.7, "line_length_stddev": 29.59, "encoded_string_ratio": 0.08, "normalized_string_count": 2.14, "repeated_char_sequences": 5, "normalized_unique_identifiers": 4.8 }, "binds": { "count": 11 }, "binary": { "peak_region_bytes": 1473, "peak_region_entropy": 4.74 }, "strings": { "bytes": 146, "count": 13, "avg_length": 11.23, "max_length": 22, "avg_entropy": 2.88, "entropy_stddev": 0.76, "base64_candidates": 1 }, "functions": { "nested": 2, "density": 10.81, "anonymous": 4, "avg_params": 0.25, "code_ratio": 1.78, "max_params": 1, "length_stddev": 12.84, "no_params_count": 3, "avg_length_lines": 16.5, "max_length_lines": 37, "min_length_lines": 3, "avg_nesting_depth": 1, "max_nesting_depth": 2, "avg_param_name_length": 15 }, "identifiers": { "count": 63, "unique": 25, "avg_length": 10.92, "max_length": 22, "min_length": 3, "avg_entropy": 2.86, "reuse_ratio": 0.4, "length_stddev": 5.28, "high_entropy_count": 4, "high_entropy_ratio": 0.16, "all_lowercase_ratio": 0.44 } } }, "id": 12, "mol": "O(Eu)H₃(CmDb₂U)Md(Pa)", "path": "click_tracker-1092.0.1.xpi!!assets/js/login-key.js", "pid": 0, "risk": 6, "sha": "0cae091d2c6a5ae26d6dbd0692cfa660485bbfe1c50e68f0236ef7157ab024fa", "size": 1473, "traits": [ { "id": "metadata/package/files/runtime::javascript-assets-tree-artifact", "conf": 0.95, "crit": 3, "desc": "JavaScript asset under assets directory" }, { "id": "micro-behaviors/communications/http/form::form-submit-listener", "conf": 0.85, "crit": 3, "desc": "Registers a form submit event listener", "spans": [ [ 1125, 35 ] ] }, { "id": "micro-behaviors/data/format/html::display-none-style", "conf": 0.88, "crit": 3, "desc": "Hides element with display none", "spans": [ [ 430, 22 ] ] }, { "id": "micro-behaviors/data/source/function/names::telemetry-data-object-call", "conf": 0.9, "crit": 3, "desc": "Telemetry-style call receives data object", "spans": [ [ 1028, 21 ] ] }, { "id": "micro-behaviors/ui/window/form-input::dom-value-local-assignment", "conf": 0.9, "crit": 2, "desc": "DOM input value assigned locally", "spans": [ [ 554, 0 ] ] }, { "id": "objectives/exfiltration/sensitive-data::js-input-value-data-field", "atk": "T1041", "mbc": "B0030", "conf": 0.9, "crit": 3, "desc": "DOM input value in object data", "spans": [ [ 1044, 27 ] ] }, { "id": "micro-behaviors/ui/window/form-input::dom-input-to-telemetry-callback", "conf": 0.94, "crit": 3, "desc": "Forwards a DOM input value to a telemetry-style callback", "uses": [ 3, 4 ], "spans": [ [ 554, 52 ], [ 1028, 21 ] ] } ], "type": "javascript" }, { "ctx": [ { "b": "l@cJAz/fVdzGFM\u003cvpS}WcOcxLB-7Yhx(v(ic[co=3lQDlay/tcB95KszG6-umRMBIwjprCzdNQbB09Q*wn+$2zdNQbe]=2BA^pO{y?m9#z/OcWy:ZU-yi7$yz!A^4eOnZdy?a[xi%)8MarUfjzGx[xB9g@ex((T-Bza0-BAzCsauZ\u0026Tz!0{bwO#PxADL\u0026kC#Fo\u003cwN/?2AWSpWx\u003egNeg?6(NwmYs1dlv\u003eVarR!pz/fSray/k0vra?QA=1c=BAzCsauZ\u0026Tz!0{bwO#PxADL\u0026kC#Fo\u003cwN/?2AWSpWx\u003egNdv(VkNvQ@%@dlv\u003eVarR!pz/fSrao", "ln": 54, "col": 28, "line": 3 }, { "b": "v@DmaBrCgfwO+)Nz/YSmx(v(ijS[YLA=U!-zGEpsx\u003eq9\u003emqMKLwO#PxzEEx[e]\u003eJxy***+c)%jSA+3KGaswJ=dlv\u003eVarR^HarR!sx\u003eq9\u003enP56ICUIQ=Aa%i5tv}OXy?cvXB7]-gz/e\u00266jS[uJwO+)Cy?mD{zGE@EarR^HEjmk+3lQDlazb+lv@#B6zxKahyY", "ln": 464, "col": 9, "line": 11 }, { "b": "B8U@7C}JPyvrlG-x(!wGvpS)%cUNj8wmYTadlv\u003eVarR^HarR!qz!0{bwO#PxxjVfNy?mD{zGFi\u003cnN%j[x\u003egNgv\u003eYSGh-k1/dk2aDvrlG-x(!wGA+f9aC4A6Hx(m)jBs/7QA=M8scN?a:3lQDlarR^Hay/tcB95KFx(^#$y?lgQAclm(x\u003eq9\u003eB09Q*l2}0OC}JYHz/3[pzG6-umG", "ln": 752, "col": 26, "line": 17 }, { "b": "x(mo+w[+*)wg.IqwO\u0026!ze]#bWy?kkfx(!lfvr\u0026$sjV%]nzF%A7cP.UTarR^HarR!Pdlv\u003ezarR^HarR^Hv@DmaBrC1dy^@bIy?dP-z/x\u0026nvru6\u003eauZ\u0026\u003cx(^#$y?lgQAclm(x\u003eq9\u003eB1R3EwPA5Aw[+*)wjprCzdNQbau.[hw[+*)wjprCzdNQbe{pVtB.9gEA+PwsdiG=%jS(a1dlv\u003eVarR^HarR!FBZ/i4Bu$4\u003exHl\u0026-Bz(4Hwnc9[vR/Q^auZ?\u003cvqG:Hx\u003eq9\u003eB5l^]B.\u003eGdwN)\u003ef3lQDlarR^Hay/tcB95KkzH1Y=wO.", "ln": 1001, "col": 46, "line": 21 }, { "b": "p\u0026yq}y*?A%wgnTF3lQDlarR^HarR^Hay/tcB95Kmz/5@$zE)uPxMvK5wGTbUC4(2ivR/QEzG6-umRMBIwoe82arR^HarR^HarR^HarR^Vzddxiw[+*)wjprCzdNQbau.[hw[+*)wjprCzdNQbe{pVtB.9gEA+PwsdjCPDarR^HarR^HarR^HarR^VyhW*7c){b+dlv\u003eVarR^HarR^HarR!py?m3}rb3hXz/{dIx(m)jBwN0@v}x.5x(mM.x(dB4dlv\u003eVarR^HarR^HarR!vzG6-up\u0026ZF:wPI{bzF8{.zdN-gjS[/SBw#%\u003ewP8Zkc[3I!jW70n3lQDlarR^HarR^HarR^Hay/tay?m9#o\u003ewA!x\u003e8ijDT{MbvlbJvz/5@$zE)uPxMvK5wQM0?3lQDlarR^HarR^HaBL^-f!+pndlv\u003ezarR^HarR^HEf{r7arR^HarR!EwPS6nzxJw7y^@bIy?dP-z/x\u0026nvru6\u003ei%)8MarV7t3lQDlazb+lv@#B6zxJ[sz!0v1B5lp^By^):wO#PrAa5", "ln": 1433, "col": 22, "line": 30 }, { "b": "wO#P=vRNtmDKp(rarR^HarUSiB97$ZC4CMkpHX5\u003eAb]JkwO#PTwObv[y\u0026?6Oi%)8MarR^HarUfjzGx[xv@b\u003c#vSbW}wjf\u003cFvn?8!A:@V6jS[YLB97$ZC4CMkpHX5\u003ev@b\u003c#vSbW}wjf\u003cFvix@BaA}Kqwn=VAv@b\u003c#vSbW}wjf\u003cFvlj/sarR^HarR!pz/fSraz2!tA:-E1wN[RCB97$)wQ5qtjS[lJx(EK1vrb)Dvrt{Rz/{8gwIdRbBvoLVvjiHBwQ5qAdlv\u003ezarR^HarR^Hv@DmaBrCEtA=2l3x)Ku3lU{EQvSbW}wk)b+BrAZ?wQ5rqvpKy\u003cwkDYQBy!A.CYUMUwPhD]v}v5wtYRzGxdLeMaswP\u003cBAh8jc[dj+arR^HarR^Hx\u003ewFoa-qjszddl{DsZROy?W\u0026$z^^V%raQq@diJUxBAIRwi%(rqarR^HarR!pz/fSraARgtBxry3wog4SA::kojS[SXA=2l3x)Ku3lU{EQvSbW}wk)b+Bs}SNy?W#tcM\u003c==i%)8MarR^HarUxgasItyCYW29A+6kSA=LPle]k9pxlm/fjV$}JfEXb+wPS6nzAwgjarR^HarR^Hv@DmaBrCKhB97$)vrc0(BvG$Qy?aUKaAg+gBy^):wO#P=vRNJqvrc0(Buo*LarR^HarR!pz/fSraAg+gBy!AWA+w}", "ln": 1864, "col": 39, "line": 44 }, { "b": "mRMBIwg?+dzdLtuwPhD]v}v5oCw?IjcOcw/cN*Ga3jm)#arR^HarUfjzGx[xz/PM8x(mu}p*[A!wKZxBy?aUKaAg+gBy!AWA+w%9mRMBIwigb9arR^HarR^Hw]zYjc#rEpaA}:AwjZ(OA::67z/cWXatt(1Cw?IjnPXJ:vruj4zxI4:By/Yss8Sa\u0026B3T?!vr\u003cFwwO#d5xGEtXz/PwWBy/G3BzkVhd\u003er4\u003eDKp(rarR^HarR^HarUfjzu", "ln": 2441, "col": 59, "line": 56 }, { "b": "arR^HEf{r7arR!vzG6-umRMBIwjprCzdNQbB1R6yAZ:zDxEEFbwO+)Cy?mD{zGE0:j%kgVarR^HarR^Hw[+*)wjprCzdNQbe[5p3mrSlWBwcy\u0026By/u3AWSqOvrlK4cOcxVA=kD0B8$e^B97$ZC4CMkdlv\u003eVarR^HarR!sx\u003eq9\u003emqMKLwO#PxvpS[qC4CMkoLFM\u0026wO#71c)@.DAclmIefFRmzE^M{nP5G\u0026BvG$Qy?cmUwnbT\u0026v{%E[z/d0=3lQDlarR^Hazbt0y?b$JwO(0@Bn", "ln": 3590, "col": 1, "line": 89 }, { "b": "arR!vw/@HozG6-umrSlWBwDvXe[]ixB-ZPdAaHdPjV%]nx(n06A=:=\u003ez/5rVB97$vdiJ%AarR^HarR^HarR^HarR^Hv@DmaBrCTIzGGM6B7]@iwkDYQBy^):wO#PjjS[SNCoxs$wO#PrcVAHn", "ln": 3954, "col": 10, "line": 97 }, { "b": "w[+*)wjprCzdNQbe{pVtB.8WUaswJ#3lQDlarR^HarR^HaBKOtarR^HarR!Pdlv\u003eVarR!Pdlv\u003ezarR^Hv@bZ+AZ\u003c$/z9\u0026w!Bz(4HvpS[qC4CMkoLFM\u0026wO#71c)@Ivx\u003e7{aefFCswNPQBy?#NVA=1oWwO+)#dlv\u003ezarR^HC42i3wmoN\u003el2pvbx\u003eq9\u003eB3\u003c\u003e-By/uic[dj+Ejmk+3s[6+B.$YcBs}0jwjpVMzGFM^B97#hwPxgDl@cJAz/fVdzGFM\u003cvpS}WcOcxLB-7Yhx(v(ic[co=", "ln": 4381, "col": 17, "line": 106 }, { "b": "wO+{/Bz(gFcOxjNxk8l\u003cwPz*fAXhxACYUqZi%(rqarR!vw/@Hrz!A^4l3mo.mSir:diJ%AarR^HarR^Hy\u0026r%2zB5z!xHV]Xz7YmcwjpVMzGFM^B97#hwPxgDB9g@ex(\u003eZNazb+lv@#B6zxHutz/PX[BZ/i4Bvyv:zGErIDKp(rarR^HarR^HarUomA=1-$vR]?3mrSlWBs}JMwP?T5BvoXLvrDydc[dj+3lQDlarR^HarR^HaAIWmze18Yz/PXYB-..zzz2ElB75J]wN(]DaAN", "ln": 4785, "col": 45, "line": 119 }, { "b": "lVl\u003c:vqfQ\u003cAV^H/wn+$2zdNQbe]=2BA^pO{y?m9#z/NlNe]kDsx(mo+w[+*)wofaEi%)8MarUfjzGx[xB7F][p?T(TB7FA\u003eA+4:VAclnzauZ\u0026Tz!0{bwO#PxADL\u0026kC#Fo\u003cwN/?2AZsITc){SZB1IiDxk8lnw[+*)wg5//3lQDlay/tcB95KCwO2yGxMvK5wMik=Bv*v?B-X-?ay]z2B.$YcBs}iqBvy1SzdNQblu#dkc)AwouPqKHf\u003eAp3viL", "ln": 5680, "col": 20, "line": 141 }, { "b": "apoklarUSpA::32rc-B]pJgz\u0026z/d):BAzCsB1R6yAZ:zDxEE!rBzkVhluNx(z/cWXj%kgVarR^HarR^Hz/x/jz/d):BAzCse[5p3mrSlWBwcy\u0026By/u3AWSqBy?Wx{cOcxLB-7Yhx(v(ic[co=3lQDlarR^HarR^Hay/tcB95KCwO+{/By!#ZD2NsqjS[\u0026Wx(+[twPQjWBAh88B-.gycUcUcvj=ODAaHyCi%)8MarR^HarR^HarUfjzGx[xB7Gf0v@#o)lVm9+BrAZ?Aa9^dwL3=Yd0fcpB1R9pBu$1\u003cA+P09By=\u003cFwmoN*ePbYFvR6NcdjEs=arR^HarR^HarR^Hv@DmaBrCToy?m9#wN[bIBAzCsoKRywy-\u003e\u003e-Bzbxfe{7VHBvf$:By/uii%(rqarR^HarR^HarR1larR^HarR^HarR!vw/@HywO+{/By!#VxMvK5wMi}]wKHlNAbn%ddiJ%AarR^HarR^HarR^HarR^HB7Gf0v@#o)p?T(TB7Fr@AaIBKB8U@7C}KhICYVq\u003ezGGDcBrAZ?B7Gf0v@#o)luNx(", "ln": 6039, "col": 4, "line": 147 }, { "b": "wM9eRwN/*@z/ex\u0026Acla]wO#StaBsCrarR^HarR^HarR^HarR!CxMvK5wM9eRwN/*@z/ex\u0026Acla]wO#SyB98XzwIdIcB8U@7C{2l)cVi\u003cuwHxLDarR^HarR^HarR^HEf{r7arR^HarR^HarR1larR^HarR^HarR!FwO2yGxMvK5wMik=Bv*v?B-YlCy*?yaoLFM\u0026e[5p3c)@LtB8U@7C}A]LzE\u003egAi%)8MarR^HarR^HarUSiB8#qlA::32raQq@nP5G\u0026Bs}6tvrh", "ln": 6539, "col": 22, "line": 160 }, { "b": "BsnH?y\u0026r%2zEl:.x\u003eq9\u003eeOPrrz6{++B98XzwIdIcB8U@7C{2l)cVi\u003cuwHxLDarR^HarR^HarR^HarR^Hx(m)jBvy1SzdNQbe{pVtB.8WUaswJ#apoklarR^HarR^HarV7tarR^HarR^HEjmk+3lQDlarR^HapoklarR^HarUYow].E7xJw?*x\u003c$)\u0026mRMBIwkmn:vR6N]zF7vDi%)8MarV7t3lQDlazb+lv@#B6zxJCczEWl^y^z(Ns8Sa\u0026nP5G\u0026Bvy1SzdNQbB0@E", "ln": 7963, "col": 36, "line": 196 }, { "b": "B75Y)l${ZYy*?Pwv@bN{B4*p?Bs}0jwge*sx\u003eg:=zyl\u003e{3lQDlarR^HaBKOtarR^HarR^larR^HarR^Hv@DmaBrCTowN[RJA::32lVl*Jx(mG)auZ\u0026*wO2yGxMvK5wL3=UB-Z8!wO+)fC42ifwJHkwarR^HarR^HarR!py?m3}rb3hXz/{dIx(m)jBwN0@v}x.5x(mM.x(dB4dlv\u003eVarR^HarR^HarR!vzG6-up\u0026ZF:wPI{bzF8{.zdN-gjS[/SBw#%\u003ewP8Zkc[3I!jW70n3lQDlarR^HarR^HarR^Hay/tay?m9#o\u003ewA!x\u003e8ijDT{MbvlbJLwO2yGxMvK5wKyxMvRGZ\u003ewpk)*3lQDlarR^HarR^HaBL^-f!+pndlv\u003ez3lQDlaBLX23jma.arR!CvrlHexMvK5wL3=UB-Z8!wO+)fvpS[qC4CMkoLFM\u0026wO#71c)@.DAclmIefFLEzEW^5z/c%LaBsCrarR^HarR!vw/@HvvrlHexMvK5wL3=UB-Z8!wO+)fC42ifwId!gzFa68au*]4diJ%AarR^HarR^H3lQDlarR^Hay/tcB95KzvrlHexMvK5wKyxMvRGZ\u003ewfs2TAa9*eAa\u003co2B7E{XAclm(x\u003eq9\u003ee{pVtB.9SwarR^HarR^HarR^Hv@bZ+A-u:\u0026wP8Zkc#0NrB-ZD2z!0v1B7]J8rb3hXAW:6SarR^HarR^HarR^Hx(m)jBwN0@v}x.5x(mM.x(dB4auZ\u0026*wPQ)=zdNTdBsnK^au.[hDKp(rarR^HarR^HarR^HarUfjy\u00260V)Bwls*A+P38d0]GkByviMAa9*eAa\u003co2B7EZSzdmi%wN{iri%)8MarR^HarR^HarV7-atCM7fEY6\u003carR^HarR^HEf}8tarV7Yi%(rqarR!sB-7Yhx(v(iA+e\u003c6wPIJUz!A^4luNx(z/eP\u0026B7]8$y?X0pc[co=3lQDlarR^Hay/tcB95KszG6-unPN^vzE^s0wN(]DaAIa9wkD@Wvrl0KzG6-umRMBIwg?!jw]?K9s7#h!xDPFYfD.X?3lQDlarR^HarR^HaAIa9wkD@Wvrl0KzG6-umRMBIwg?!jw]?K9nm=HFxMLvXatt\u003e:arR^HarR^Hv@DmaBrCpnAclm\u0026z/fVdzGFr(x(!xqauZ\u0026*wO2yGxMvK5wL3=UB-Z8!wO+)fC42ifwIe7Bx(bmEar-)haswJ#3jmaEarR^HarR^Hy\u0026r%2zC$W!ze18UB-..zzz2ElB75J]wN(]Dar-dEzG6-unPN^vzE^s0wN(]gclN2uAclm\u0026z/fVdzGFr(x(!xqdlv\u003eVarR!P3vKu+3jprZv%8T1zGEHtwmObLwO#P-x(!xczE)\u0026p", "ln": 9428, "col": 25, "line": 237 }, { "b": "jS[bTDT.btBz(4+x(dB0B7]MgB1Rouw]]dCaA}Kqwn=VAB7oley\u00260j4AcL+L3lQDlaBKO7arR^larR^Hz/xo9p?T(TB7F6SzGOo*BAzCskq3wPwjpVMzGFM^B97#hwPxgDv@b\u003c?yBpUQw{503BzkVhc$v7cv@1IRwO#P=vRNtmDKp(rarR^HarUfgx\u003e7{EC4CMkpHX5\u003eB98ttp\u0026ZF[vp%1\u003cx(v(qdlv\u003ezarR^HarR^larR^HarR^Hx\u003ewFoAa\u003co2B7F6SzGO=]Acla*y?mD{zGEHLBA}Xle[wWqAbn%dau.\u003eJasy=qwQ2NKaBsCrarR^HarR^HarR!CxMvK5wLD-NBX)0}B-o==wO(0@Bs}SRD2d4Awnca7y*?PijS(a\u0026z/fbli%)8", "ln": 11469, "col": 43, "line": 296 }, { "b": "arR^HarR^HarU96yisPtp\u0026yq}A7%[YBX)0$x([6czyu}}3lQDlarR^HaBKOtarR!Pdlv\u003ezarR^larR^Hwn+$2zdNQbe[5p3mrSlWBwcy\u0026By/u3AWSqBy?Wx{cOcxLB-7Yhx(v(qv@b\u003c?yEJzTzGFV-yagoL3lQDlarR^HazCBgc#-\u003cuvrl0OwO#S!z/x\u0026rmqMKLwO#PxB98XzwIdIcB8U@7C{2mkjS(a:y?m\u0026sasnAxarR^HarR^HarR^Ha-Ianvrl0OwO#S!z/x\u0026rmqMKLwO#Pxv/", "ln": 11857, "col": 3, "line": 308 } ], "depth": 1, "facts": { "imp": [ [ "", "document.addEventListener" ], [ "", "document.querySelectorAll" ], [ "", "document.querySelector" ], [ "", "document.querySelector" ], [ "", "document.querySelector" ], [ "", "inputFieldElements.forEach" ], [ "", "parseInt" ], [ "", "fieldElement.name.replace" ], [ "", "document.querySelector" ], [ "", "validationErrorDisplay.classList.add" ], [ "", "document.getElementById.classList.remove" ], [ "", "document.getElementById" ], [ "", "Array.from.filter" ], [ "", "Array.from" ], [ "", "fieldElement.closest" ], [ "", "visibleInputFields.every" ], [ "", "fieldElement.value.trim" ], [ "", "visibleInputFields.some" ], [ "", "fieldElement.value.trim" ], [ "", "visibleInputFields.map.join" ], [ "", "visibleInputFields.map" ], [ "", "fieldElement.value.trim" ], [ "", "clearTimeout" ], [ "", "setTimeout" ], [ "", "collectMetrics" ], [ "", "pasteEventObj.preventDefault" ], [ "", "clipboardDataSource.getData" ], [ "", "extractedPasteText.replace.trim" ], [ "", "extractedPasteText.replace" ], [ "", "normalizedClipboardText.split" ], [ "", "parseInt" ], [ "", "pasteTargetField.name.replace" ], [ "", "setTimeout" ], [ "", "setTimeout" ], [ "", "originalPasteField.focus" ], [ "", "validateAllFieldsContent" ], [ "", "validateAllFieldsContent" ], [ "", "inputFieldElements.forEach" ], [ "", "validateAllFieldsContent" ], [ "", "document.getElementById" ], [ "", "inputFieldElements.forEach" ], [ "", "fieldElement.addEventListener" ], [ "", "fieldElement.addEventListener" ], [ "", "fieldElement.addEventListener" ], [ "", "fieldElement.addEventListener" ], [ "", "Event" ], [ "", "fieldElement.dispatchEvent" ], [ "", "clearFormButton.addEventListener" ], [ "", "validateAllFieldsContent" ], [ "", "document.addEventListener" ], [ "", "document.querySelector" ], [ "", "document.querySelector" ], [ "", "document.querySelector" ], [ "", "loginAuthForm.addEventListener" ], [ "", "formSubmitEvent.preventDefault" ], [ "", "formErrorDisplay.classList.contains" ], [ "", "formErrorDisplay.classList.remove" ], [ "", "document.getElementById.classList.add" ], [ "", "document.getElementById" ], [ "", "document.addEventListener" ], [ "", "document.querySelectorAll" ], [ "", "document.getElementById" ], [ "", "document.getElementById" ], [ "", "document.querySelector" ], [ "", "document.querySelector" ], [ "", "document.querySelectorAll" ], [ "", "document.getElementById" ], [ "", "document.getElementById" ], [ "", "document.getElementById" ], [ "", "phraseTypeOptionButtons.forEach" ], [ "", "optionButton.addEventListener" ], [ "", "parseInt" ], [ "", "seedPhraseTextInput.classList.add" ], [ "", "passphraseTextInput.classList.add" ], [ "", "displayWordInputElements" ], [ "", "displayWordInputElements" ], [ "", "passphraseTextInput.classList.remove" ], [ "", "concealAllWordInputElements" ], [ "", "seedPhraseTextInput.classList.remove" ], [ "", "concealAllWordInputElements" ], [ "", "seedPhraseTextInput.classList.remove" ], [ "", "passphraseTextInput.classList.remove" ], [ "", "seedPhraseWordInputs.forEach" ], [ "", "inputElement.closest" ], [ "", "seedPhraseWordInputs.forEach" ], [ "", "inputElement.closest" ], [ "", "refreshVisibleFieldNumbering" ], [ "", "seedPhraseWordInputs.forEach" ], [ "", "inputElement.closest" ], [ "", "document.querySelectorAll.forEach" ], [ "", "document.querySelectorAll" ], [ "", "fieldItem.querySelector" ], [ "", "displayWordInputElements" ], [ "", "document.addEventListener" ], [ "", "document.getElementById" ], [ "", "document.getElementById" ], [ "", "document.getElementById" ], [ "", "document.querySelector" ], [ "", "refreshLoginButtonVisibility" ], [ "", "seedPhraseInputField.addEventListener" ], [ "", "refreshLoginButtonVisibility" ], [ "", "seedPhraseInputField.classList.remove" ], [ "", "authErrorMessageDisplay.classList.add" ], [ "", "clearTimeout" ], [ "", "setTimeout" ], [ "", "collectMetrics" ], [ "", "passphraseInputField.addEventListener" ], [ "", "clearTimeout" ], [ "", "setTimeout" ], [ "", "collectMetrics" ], [ "", "seedPhraseInputField.value.trim" ], [ "", "document.addEventListener" ], [ "", "document.getElementById" ], [ "", "document.getElementById" ], [ "", "openPhraseMenuButton.getBoundingClientRect" ], [ "", "openPhraseMenuButton.addEventListener" ], [ "", "clickEventObj.stopPropagation" ], [ "", "adjustPopupMenuPosition" ], [ "", "document.addEventListener" ], [ "", "phraseMenuPopupElement.contains" ], [ "", "window.addEventListener" ], [ "", "adjustPopupMenuPosition" ] ], "mbr": [ "Array.from", "Array.from.filter", "authErrorMessageDisplay.classList", "authErrorMessageDisplay.classList.add", "buttonDimensions.bottom", "buttonDimensions.left", "clearFormButton.addEventListener", "clearFormButton.style", "clearFormButton.style.display", "clickEventObj.stopPropagation", "clickEventObj.target", "clipboardDataSource.getData", "document.addEventListener", "document.getElementById", "document.getElementById.classList", "document.getElementById.classList.add", "document.getElementById.classList.remove", "document.getElementById.value", "document.querySelector", "document.querySelectorAll", "document.querySelectorAll.forEach", "extractedPasteText.replace", "extractedPasteText.replace.trim", "fieldElement.addEventListener", "fieldElement.closest", "fieldElement.closest.style", "fieldElement.closest.style.display", "fieldElement.dispatchEvent", "fieldElement.name", "fieldElement.name.replace", "fieldElement.value", "fieldElement.value.trim", "fieldItem.querySelector", "fieldItem.querySelector.textContent", "fieldItem.style", "fieldItem.style.display", "formErrorDisplay.classList", "formErrorDisplay.classList.contains", "formErrorDisplay.classList.remove", "formSubmitEvent.preventDefault", "inputElement.closest", "inputElement.closest.style", "inputElement.closest.style.display", "inputElement.value", "inputEventObj.inputType", "inputFieldElements.forEach", "loginAuthForm.addEventListener", "loginSubmitButton.disabled", "normalizedClipboardText.split", "openPhraseMenuButton.addEventListener", "openPhraseMenuButton.getBoundingClientRect", "optionButton.addEventListener", "originalPasteField.focus", "passphraseInputField.addEventListener", "passphraseInputField.value", "passphraseInputField.value.length", "passphraseTextInput.classList", "passphraseTextInput.classList.add", "passphraseTextInput.classList.remove", "pasteEventObj.clipboardData", "pasteEventObj.preventDefault", "pasteEventObj.target", "pasteTargetField.name", "pasteTargetField.name.replace", "phraseMenuPopupElement.contains", "phraseMenuPopupElement.offsetHeight", "phraseMenuPopupElement.style", "phraseMenuPopupElement.style.bottom", "phraseMenuPopupElement.style.display", "phraseMenuPopupElement.style.left", "phraseMenuPopupElement.style.top", "phraseSelectionPopupMenu.style", "phraseSelectionPopupMenu.style.display", "phraseTypeOptionButtons.forEach", "seedPhraseInputField.addEventListener", "seedPhraseInputField.classList", "seedPhraseInputField.classList.remove", "seedPhraseInputField.offsetHeight", "seedPhraseInputField.offsetWidth", "seedPhraseInputField.value", "seedPhraseInputField.value.trim", "seedPhraseTextInput.classList", "seedPhraseTextInput.classList.add", "seedPhraseTextInput.classList.remove", "seedPhraseWordInputs.forEach", "selectedPhraseTypeDisplay.textContent", "submitAuthButton.disabled", "submitFormButton.disabled", "synthesizedPasteEvent.clipboardData", "textWordsArray.length", "validationErrorDisplay.classList", "validationErrorDisplay.classList.add", "visibleInputFields.every", "visibleInputFields.map", "visibleInputFields.map.join", "visibleInputFields.some", "window.addEventListener", "window.clipboardData", "window.innerHeight", "window.scrollX", "window.scrollY" ], "tgt": [ "Array.from", "Array.from.filter", "Event", "adjustPopupMenuPosition", "authErrorMessageDisplay.classList.add", "clearFormButton.addEventListener", "clearTimeout", "clickEventObj.stopPropagation", "clipboardDataSource.getData", "collectMetrics", "concealAllWordInputElements", "displayWordInputElements", "document.addEventListener", "document.getElementById", "document.getElementById.classList.add", "document.getElementById.classList.remove", "document.querySelector", "document.querySelectorAll", "document.querySelectorAll.forEach", "extractedPasteText.replace", "extractedPasteText.replace.trim", "fieldElement.addEventListener", "fieldElement.closest", "fieldElement.dispatchEvent", "fieldElement.name.replace", "fieldElement.value.trim", "fieldItem.querySelector", "formErrorDisplay.classList.contains", "formErrorDisplay.classList.remove", "formSubmitEvent.preventDefault", "inputElement.closest", "inputFieldElements.forEach", "loginAuthForm.addEventListener", "normalizedClipboardText.split", "openPhraseMenuButton.addEventListener", "openPhraseMenuButton.getBoundingClientRect", "optionButton.addEventListener", "originalPasteField.focus", "parseInt", "passphraseInputField.addEventListener", "passphraseTextInput.classList.add", "passphraseTextInput.classList.remove", "pasteEventObj.preventDefault", "pasteTargetField.name.replace", "phraseMenuPopupElement.contains", "phraseTypeOptionButtons.forEach", "refreshLoginButtonVisibility", "refreshVisibleFieldNumbering", "seedPhraseInputField.addEventListener", "seedPhraseInputField.classList.remove", "seedPhraseInputField.value.trim", "seedPhraseTextInput.classList.add", "seedPhraseTextInput.classList.remove", "seedPhraseWordInputs.forEach", "setTimeout", "validateAllFieldsContent", "validationErrorDisplay.classList.add", "visibleInputFields.every", "visibleInputFields.map", "visibleInputFields.map.join", "visibleInputFields.some", "window.addEventListener" ], "funcs": [ [ "anonymous", 73 ], [ "fieldElement", 438 ], [ "validateAllFieldsContent", 605 ], [ "fieldElement", 938 ], [ "fieldElement", 1117 ], [ "fieldElement", 1283 ], [ "fieldElement", 1521 ], [ "anonymous", 1686 ], [ "processPasteEvent", 1830 ], [ "anonymous", 3027 ], [ "anonymous", 3147 ], [ "handleInputFieldModification", 3233 ], [ "clearAllFormFields", 3322 ], [ "fieldElement", 3389 ], [ "fieldElement", 3628 ], [ "anonymous", 3918 ], [ "anonymous", 4254 ], [ "anonymous", 4592 ], [ "anonymous", 4890 ], [ "anonymous", 5337 ], [ "optionButton", 6077 ], [ "anonymous", 6142 ], [ "displayWordInputElements", 7618 ], [ "inputElement", 7705 ], [ "anonymous", 7852 ], [ "concealAllWordInputElements", 8140 ], [ "inputElement", 8218 ], [ "refreshVisibleFieldNumbering", 8376 ], [ "fieldItem", 8519 ], [ "anonymous", 8850 ], [ "anonymous", 9249 ], [ "anonymous", 9641 ], [ "anonymous", 9794 ], [ "anonymous", 10026 ], [ "refreshLoginButtonVisibility", 10139 ], [ "anonymous", 10520 ], [ "adjustPopupMenuPosition", 10691 ], [ "anonymous", 11581 ], [ "anonymous", 11956 ], [ "anonymous", 12295 ] ], "metrics": { "ast": { "op.eq": 5, "op.ge": 2, "op.gt": 4, "op.lt": 2, "op.ne": 6, "op.add": 6, "op.lor": 2, "op.sub": 2, "op.land": 6, "op.lnot": 6, "max_depth": 24, "call_count": 126, "node_count": 2992, "member_count": 101, "op_density.eq": 0, "op_density.ge": 0, "op_density.gt": 0, "op_density.lt": 0, "op_density.ne": 0, "op_density.add": 0, "op_density.lor": 0, "op_density.sub": 0, "op_density.land": 0, "op_density.lnot": 0, "max_concat_chain": 2, "member_depth_max": 4 }, "file": { "size": 12431, "entropy": 4.72 }, "text": { "lines": 327, "top_char": 101, "max_ws_run": 1, "digit_ratio": 0.01, "space_count": 2820, "char_entropy": 4.72, "unique_chars": 85, "top_char_null": 0, "string_density": 0.32, "top_char_ratio": 0.08, "avg_line_length": 37.02, "max_line_length": 110, "empty_line_ratio": 0.24, "last_line_length": 3, "whitespace_ratio": 0.25, "identifier_density": 1.52, "line_length_stddev": 30.38, "encoded_string_ratio": 0.05, "normalized_string_count": 5.86, "repeated_char_sequences": 99, "trailing_whitespace_lines": 17, "suspicious_identifier_ratio": 0.02, "normalized_unique_identifiers": 14.96 }, "binds": { "count": 77 }, "binary": { "peak_region_bytes": 8192, "peak_region_entropy": 5 }, "source": { "function_count": 9 }, "strings": { "bytes": 1004, "count": 106, "avg_length": 9.47, "max_length": 45, "avg_entropy": 2.74, "empty_count": 10, "entropy_stddev": 0.9, "base64_candidates": 5 }, "functions": { "count": 9, "nested": 16, "density": 12.23, "anonymous": 31, "avg_params": 0.2, "code_ratio": 2.04, "max_params": 2, "one_liners": 6, "length_stddev": 23.45, "over_100_lines": 1, "avg_name_length": 24.11, "no_params_count": 33, "avg_length_lines": 16.65, "max_length_lines": 112, "min_length_lines": 1, "avg_nesting_depth": 1.33, "max_nesting_depth": 3, "high_entropy_names": 7, "avg_param_name_length": 12.5 }, "identifiers": { "count": 497, "unique": 125, "avg_length": 13.68, "max_length": 28, "min_length": 3, "avg_entropy": 3.07, "reuse_ratio": 0.25, "length_stddev": 6.45, "high_entropy_count": 37, "high_entropy_ratio": 0.3, "all_lowercase_ratio": 0.23, "keyboard_pattern_names": 2 } } }, "id": 14, "mol": "O(Eu)H₄(CmDb₄Os₂U₄)Md(Pa)", "path": "click_tracker-1092.0.1.xpi!!assets/js/login.js", "pid": 0, "risk": 46, "sha": "c9e1cfa279daaab16b9a30a1b0506aefb37c2152e3fca37d222f32e3a1efdf65", "size": 12431, "traits": [ { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "spans": [ [ 2537, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-7", "conf": 0.8, "crit": 1, "desc": "English function-word token \"this\"", "spans": [ [ 6189, 0 ] ] }, { "id": "metadata/package/files/runtime::javascript-assets-tree-artifact", "conf": 0.95, "crit": 3, "desc": "JavaScript asset under assets directory" }, { "id": "micro-behaviors/communications/http/form::form-submit-listener", "conf": 0.85, "crit": 3, "desc": "Registers a form submit event listener", "spans": [ [ 4849, 30 ] ] }, { "id": "micro-behaviors/data/format/html::display-none-style", "conf": 0.88, "crit": 3, "desc": "Hides element with display none", "spans": [ [ 6603, 22 ] ] }, { "id": "micro-behaviors/data/source/function/names::telemetry-data-object-call", "conf": 0.9, "crit": 3, "desc": "Telemetry-style call receives data object", "spans": [ [ 1710, 21 ] ] }, { "id": "micro-behaviors/data/source/syntax/array::js-array-short-delimiter-join-call", "conf": 0.72, "crit": 3, "desc": "Joins array with a short delimiter", "spans": [ [ 1580, 10 ] ] }, { "id": "micro-behaviors/os/clipboard/read::browser-paste-event-handler", "atk": "T1115", "conf": 0.86, "crit": 3, "desc": "Registers a browser paste-event handler", "spans": [ [ 3654, 29 ] ] }, { "id": "micro-behaviors/os/clipboard/reference::browser-clipboard-api-marker", "atk": "T1115", "conf": 0.8, "crit": 3, "desc": "References a browser clipboard API", "spans": [ [ 1928, 13 ] ] }, { "id": "micro-behaviors/ui/window/click::browser-click-listener", "conf": 0.88, "crit": 3, "desc": "Registers browser click event listener", "spans": [ [ 4445, 32 ], [ 6103, 29 ], [ 11533, 37 ], [ 11921, 25 ] ] }, { "id": "micro-behaviors/ui/window/click::browser-global-click-listener", "conf": 0.94, "crit": 3, "desc": "Registers document-wide click event listener", "spans": [ [ 11921, 33 ] ] }, { "id": "micro-behaviors/ui/window/data-transfer::browser-data-transfer-text-read", "conf": 0.84, "crit": 3, "desc": "Reads text from browser data transfer", "spans": [ [ 2057, 16 ] ] }, { "id": "micro-behaviors/ui/window/dom-access::browser-queryselectorall-call", "conf": 0.86, "crit": 3, "desc": "Queries multiple DOM elements", "spans": [ [ 118, 25 ] ] }, { "id": "micro-behaviors/ui/window/form-input::browser-form-control-value-write", "conf": 0.88, "crit": 3, "desc": "Assigns a value into a form control", "spans": [ [ 8027, 23 ] ] }, { "id": "micro-behaviors/ui/window/form-input::dom-value-local-assignment", "conf": 0.9, "crit": 2, "desc": "DOM input value assigned locally", "spans": [ [ 9492, 0 ] ] }, { "id": "micro-behaviors/data/string/split::js-split-call", "conf": 0.8, "crit": 3, "desc": "Calls JavaScript split()", "spans": [ [ 2242, 29 ] ] }, { "id": "micro-behaviors/os/clipboard/reference::clipboard-keyword", "conf": 0.7, "crit": 3, "desc": "Clipboard keyword", "spans": [ [ 1928, 9 ] ] }, { "id": "micro-behaviors/ui/window/dom-access::dom-text-content-read", "conf": 0.82, "crit": 3, "desc": "Reads DOM text content", "spans": [ [ 6343, 12 ] ] }, { "id": "objectives/credential-access/wallet/keywords::seed-phrase-word", "conf": 0.5, "crit": 3, "desc": "seedPhrase credential field reference", "spans": [ [ 5744, 10 ] ] }, { "id": "objectives/exfiltration/sensitive-data::js-wallet-secret-data-field", "atk": "T1041", "mbc": "B0030", "conf": 0.96, "crit": 4, "desc": "Wallet secret data object field", "spans": [ [ 9681, 24 ], [ 10066, 24 ] ] }, { "id": "micro-behaviors/ui/window/form-input::dom-input-to-telemetry-callback", "conf": 0.94, "crit": 3, "desc": "Forwards a DOM input value to a telemetry-style callback", "uses": [ 5, 14 ], "spans": [ [ 9492, 53 ], [ 9665, 21 ] ] } ], "type": "javascript" }, { "id": 18, "mol": "O(S)Md", "sha": "757309aea169219638dab86df308dc51619d2ce12584d3a2ade3101277b98f9c", "path": "click-tracker@1092.0.1.registry.json", "risk": 2, "size": 819, "type": "registry", "depth": 1 } ], "omitted_files": 2, "rev": "479f3", "v": "8" } }