33:"SampleDetailWrapper" 34:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$33"] 38:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 35:T56bc," ### What it does Checks for equal operands to comparison, logical and bitwise, difference and division binary operators (`==`, `>`, etc., `&&`, `||`, `&`, `|`, `^`, `-` and `/`). ### Why is this bad? This is usually just a typo or a copy and paste error. ### Known problems False negatives: We had some false positives regarding calls (notably [racer](https://github.com/phildawes/racer) had one instance of `x.pop() && x.pop()`), so we removed matching any function or method calls. We may introduce a list of known pure functions in the future. ### Example ```no_run # let x = 1; if x + 1 == x + 1 {} // or # let a = 3; # let b = 4; assert_eq!(a, a); ``` /rustc/41089d07a0a2afc16adfe28a760d94d73d7298a4/src/tools/clippy/clippy_lints\src\operators\mod.rs#L288" (Indicator: "github.com"), "the resulting syntax tree and as such cannot be linted from within `check_mod`. Instead, the `rustdoc::missing_documentation` lint may be used. #### Module Tests This lint does not implement detection of module tests (or other feature dependent elements for that matter). To lint the location of mod tests, the lint `items_after_test_module` can be used instead. ### Example ```no_run trait TraitUnordered { const A: bool; const C: bool; const B: bool; type SomeType; fn a(); fn c(); fn b(); } ``` Use instead: ```no_run trait TraitOrdered { const A: bool; const B: bool; const C: bool; type SomeType; fn a(); fn b(); fn c(); } ``` [cargo-pgo]: https://github.com/Kobzol/cargo-pgo/blob/main/README.md /rustc/41089d07a0a2afc16adfe28a760d94d73d7298a4/src/tools/clippy/clippy_lints\src\arbitrary_source_item_ordering.rs#L181.84.0" (Indicator: "github.com"), " ### What it does Checks for calls to `await` while holding a non-async-aware `MutexGuard`. ### Why is this bad? The Mutex types found in [`std::sync`](https://doc.rust-lang.org/stable/std/sync/) and [`parking_lot`](https://docs.rs/parking_lot/latest/parking_lot/) are not designed to operate in an async context across await points. There are two potential solutions. One is to use an async-aware `Mutex` type. Many asynchronous foundation crates provide such a `Mutex` type. The other solution is to ensure the mutex is unlocked before calling `await`, either by introducing a scope or an explicit call to [`Drop::drop`](https://doc.rust-lang.org/std/ops/trait.Drop.html). ### Known problems Will report false positive for explicitly dropped guards ([#6446](https://github.com/rust-lang/rust-clippy/issues/6446)). A workaround for this is to wrap the `.lock()` call in a block instead of explicitly dropping the guard. ### Example ```no_run # use std::sync::Mutex; # async fn baz() {} async fn foo" (Indicator: "github.com"), " ### What it does Checks for tuple<=>array conversions that are not done with `.into()`. ### Why is this bad? It may be unnecessary complexity. `.into()` works for converting tuples<=> arrays of up to 12 elements and conveys the intent more clearly, while also leaving less room for hard to spot bugs! ### Known issues The suggested code may hide potential asymmetry in some cases. See [#11085](https://github.com/rust-lang/rust-clippy/issues/11085) for more info. ### Example ```rust,ignore let t1 = &[(1, 2), (3, 4)]; let v1: Vec<[u32; 2]> = t1.iter().map(|&(a, b)| [a, b]).collect(); ``` Use instead: ```rust,ignore let t1 = &[(1, 2), (3, 4)]; let v1: Vec<[u32; 2]> = t1.iter().map(|&t| t.into()).collect(); ``` /rustc/41089d07a0a2afc16adfe28a760d94d73d7298a4/src/tools/clippy/clippy_lints\src\tuple_array_conversions.rs#L19h" (Indicator: "github.com"), " ### What it does Identifies good opportunities for a clamp function from std or core, and suggests using it. ### Why is this bad? clamp is much shorter, easier to read, and doesn't use any control flow. ### Limitations This lint will only trigger if max and min are known at compile time, and max is greater than min. ### Known issue(s) If the clamped variable is NaN this suggestion will cause the code to propagate NaN rather than returning either `max` or `min`. `clamp` functions will panic if `max < min`, `max.is_nan()`, or `min.is_nan()`. Some may consider panicking in these situations to be desirable, but it also may introduce panicking where there wasn't any before. See also [the discussion in the PR](https://github.com/rust-lang/rust-clippy/pull/9484#issuecomment-1278922613). ### Examples ```no_run # let (input, min, max) = (0, -2, 1); if input > max { max } else if input < min { min } else { input } # ; ``` ```no_run # let (input, min, max) = (0, -2, 1); " (Indicator: "github.com"), " ### What it does Checks for calls to `await` while holding a `RefCell`, `Ref`, or `RefMut`. ### Why is this bad? `RefCell` refs only check for exclusive mutable access at runtime. Holding a `RefCell` ref across an await suspension point risks panics from a mutable ref shared while other refs are outstanding. ### Known problems Will report false positive for explicitly dropped refs ([#6353](https://github.com/rust-lang/rust-clippy/issues/6353)). A workaround for this is to wrap the `.borrow[_mut]()` call in a block instead of explicitly dropping the ref. ### Example ```no_run # use std::cell::RefCell; # async fn baz() {} async fn foo(x: &RefCell) { let mut y = x.borrow_mut(); *y += 1; baz().await; } async fn bar(x: &RefCell) { let mut y = x.borrow_mut(); *y += 1; drop(y); // explicit drop baz().await; } ``` Use instead: ```no_run # use std::cell::RefCell; # async fn baz() {} async fn foo(x: &RefCell) { { let mut y = x.borrow_mut(); " (Indicator: "github.com"), " ### What it does Checks for initialization of an identical `struct` from another instance of the type, either by copying a base without setting any field or by moving all fields individually. ### Why is this bad? Readability suffers from unnecessary struct building. ### Example ```no_run struct S { s: String } let a = S { s: String::from("Hello, world!") }; let b = S { ..a }; ``` Use instead: ```no_run struct S { s: String } let a = S { s: String::from("Hello, world!") }; let b = a; ``` The struct literal ``S { ..a }`` in the assignment to ``b`` could be replaced with just ``a``. ### Known Problems Has false positives when the base is a place expression that cannot be moved out of, see [#10547](https://github.com/rust-lang/rust-clippy/issues/10547). Empty structs are ignored by the lint. /rustc/41089d07a0a2afc16adfe28a760d94d73d7298a4/src/tools/clippy/clippy_lints\src\unnecessary_struct_initialization.rs#L10" (Indicator: "github.com"), " ### What it does This lint warns about the use of literals as `write!`/`writeln!` args. ### Why is this bad? Using literals as `writeln!` args is [inefficient] and unnecessary (i.e., just put the literal in the format string) ### Example ```no_run # use std::fmt::Write; # let mut buf = String::new(); writeln!(buf, "{}", "foo"); ``` Use instead: ```no_run # use std::fmt::Write; # let mut buf = String::new(); writeln!(buf, "foo"); ``` [inefficient]: https://github.com/matthiaskrgr/rust-str-bench /rustc/41089d07a0a2afc16adfe28a760d94d73d7298a4/src/tools/clippy/clippy_lints\src\write\mod.rs#L152" (Indicator: "github.com"), " ### What it does Checks the doc comments have unbroken links, mostly caused by bad formatted links such as broken across multiple lines. ### Why is this bad? Because documentation generated by rustdoc will be broken since expected links won't be links and just text. ### Examples This link is broken: ```no_run /// [example of a bad link](https:// /// github.com/rust-lang/rust-clippy/) pub fn do_something() {} ``` It shouldn't be broken across multiple lines to work: ```no_run /// [example of a good link](https://github.com/rust-lang/rust-clippy/) pub fn do_something() {} ``` /rustc/41089d07a0a2afc16adfe28a760d94d73d7298a4/src/tools/clippy/clippy_lints\src\doc\mod.rs#L431.90.0(" (Indicator: "github.com"), " ### What it does Checks for usage of `Mutex` where `X` is an integral type. ### Why restrict this? Using a mutex just to make access to a plain integer sequential is shooting flies with cannons. `std::sync::atomic::AtomicUsize` is leaner and faster. On the other hand, `Mutex`es are, in general, easier to verify correctness. An atomic does not behave the same as an equivalent mutex. See [this issue](https://github.com/rust-lang/rust-clippy/issues/4295)'s commentary for more details. ### Known problems * This lint cannot detect if the mutex is actually used for waiting before a critical section. * This lint has a false positive that warns without considering the case where `Mutex` is used together with `Condvar`. * This lint suggest using `AtomicU64` instead of `Mutex`, but `AtomicU64` is not available on some 32-bit platforms. ### Example ```no_run # use std::sync::Mutex; let x = Mutex::new(0usize); ``` Use instead: ```no_run # use std::sync::atomic::AtomicUsize; l" (Indicator: "github.com"), " ### What it does Checks for imports ending in `::{self}`. ### Why restrict this? In most cases, this can be written much more cleanly by omitting `::{self}`. ### Known problems Removing `::{self}` will cause any non-module items at the same path to also be imported. This might cause a naming conflict ([rust-lang/rustfmt#3568](https://github.com/rust-lang/rustfmt/issues/3568)). This lint makes no attempt to detect this scenario and that is why it is a restriction lint. ### Example ```no_run use std::io::{self}; ``` Use instead: ```no_run use std::io; ``` /rustc/41089d07a0a2afc16adfe28a760d94d73d7298a4/src/tools/clippy/clippy_lints\src\unnecessary_self_imports.rs#L7" (Indicator: "github.com"), " fn private() {} // ok pub fn not_private() {} // missing #[inline] } impl Bar for PubBaz { fn bar() {} // missing #[inline] fn def_bar() {} // missing #[inline] } ``` [small]: https://github.com/rust-lang/rust/pull/116505 /rustc/41089d07a0a2afc16adfe28a760d94d73d7298a4/src/tools/clippy/clippy_lints\src\missing_inline.rs#L8" (Indicator: "github.com"), " ### What it does Detects manual `std::default::Default` implementations that are identical to a derived implementation. ### Why is this bad? It is less concise. ### Example ```no_run struct Foo { bar: bool } impl Default for Foo { fn default() -> Self { Self { bar: false } } } ``` Use instead: ```no_run #[derive(Default)] struct Foo { bar: bool } ``` ### Known problems Derive macros [sometimes use incorrect bounds](https://github.com/rust-lang/rust/issues/26925) in generic types and the user defined `impl` may be more generalized or specialized than what derive will produce. This lint can't detect the manual `impl` has exactly equal bounds, and therefore this lint is disabled for types with generic parameters. /rustc/41089d07a0a2afc16adfe28a760d94d73d7298a4/src/tools/clippy/clippy_lints\src\derivable_impls.rs#L17" (Indicator: "github.com"), " ### What it does When sorting primitive values (integers, bools, chars, as well as arrays, slices, and tuples of such items), it is typically better to use an unstable sort than a stable sort. ### Why is this bad? Typically, using a stable sort consumes more memory and cpu cycles. Because values which compare equal are identical, preserving their relative order (the guarantee that a stable sort provides) means nothing, while the extra costs still apply. ### Known problems As pointed out in [issue #8241](https://github.com/rust-lang/rust-clippy/issues/8241), a stable sort can instead be significantly faster for certain scenarios (eg. when a sorted vector is extended with new data and resorted). For more information and benchmarking results, please refer to the issue linked above. ### Example ```no_run let mut vec = vec![2, 1, 3]; vec.sort(); ``` Use instead: ```no_run let mut vec = vec![2, 1, 3]; vec.sort_unstable(); ``` /rustc/41089d07a0a2afc16adfe28a760d94d73d7298a4/src/tools/c" (Indicator: "github.com"), " ### What it does Checks for lint groups with the same priority as lints in the `Cargo.toml` [`[lints]` table](https://doc.rust-lang.org/cargo/reference/manifest.html#the-lints-section). This lint will be removed once [cargo#12918](https://github.com/rust-lang/cargo/issues/12918) is resolved. ### Why is this bad? The order of lints in the `[lints]` is ignored, to have a lint override a group the `priority` field needs to be used, otherwise the sort order is undefined. ### Known problems Does not check lints inherited using `lints.workspace = true` ### Example ```toml # Passed as `--allow=clippy::similar_names --warn=clippy::pedantic` # which results in `similar_names` being `warn` [lints.clippy] pedantic = "warn" similar_names = "allow" ``` Use instead: ```toml # Passed as `--warn=clippy::pedantic --allow=clippy::similar_names` # which results in `similar_names` being `allow` [lints.clippy] pedantic = { level = "warn", priority = -1 } similar_names = "allow" ``` /rustc/41089d07a0a" (Indicator: "github.com"), " ### What it does Checks for usage of `Mutex` where an atomic will do. ### Why restrict this? Using a mutex just to make access to a plain bool or reference sequential is shooting flies with cannons. `std::sync::atomic::AtomicBool` and `std::sync::atomic::AtomicPtr` are leaner and faster. On the other hand, `Mutex`es are, in general, easier to verify correctness. An atomic does not behave the same as an equivalent mutex. See [this issue](https://github.com/rust-lang/rust-clippy/issues/4295)'s commentary for more details. ### Known problems * This lint cannot detect if the mutex is actually used for waiting before a critical section. * This lint has a false positive that warns without considering the case where `Mutex` is used together with `Condvar`. ### Example ```no_run # let y = true; # use std::sync::Mutex; let x = Mutex::new(&y); ``` Use instead: ```no_run # let y = true; # use std::sync::atomic::AtomicBool; let x = AtomicBool::new(y); ``` /rustc/41089d07a0a2afc16ad" (Indicator: "github.com"), " ### What it does This lint checks for functions that take immutable references and return mutable ones. This will not trigger if no unsafe code exists as there are multiple safe functions which will do this transformation To be on the conservative side, if there's at least one mutable reference with the output lifetime, this lint will not trigger. ### Why is this bad? Creating a mutable reference which can be repeatably derived from an immutable reference is unsound as it allows creating multiple live mutable references to the same object. This [error](https://github.com/rust-lang/rust/issues/39465) actually lead to an interim Rust release 1.15.1. ### Known problems This pattern is used by memory allocators to allow allocating multiple objects while returning mutable references to each one. So long as different mutable references are returned each time such a function may be safe. ### Example ```ignore fn foo(&Foo) -> &mut Bar { .. } ``` /rustc/41089d07a0a2afc16adfe28a760d94d73d7298a" (Indicator: "github.com"), " ### What it does Checks for loops with a range bound that is a mutable variable. ### Why is this bad? One might think that modifying the mutable variable changes the loop bounds. It doesn't. ### Known problems False positive when mutation is followed by a `break`, but the `break` is not immediately after the mutation: ```no_run let mut x = 5; for _ in 0..x { x += 1; // x is a range bound that is mutated ..; // some other expression break; // leaves the loop, so mutation is not an issue } ``` False positive on nested loops ([#6072](https://github.com/rust-lang/rust-clippy/issues/6072)) ### Example ```no_run let mut foo = 42; for i in 0..foo { foo -= 1; println!("{i}"); // prints numbers from 0 to 41, not 0 to 21 } ``` /rustc/41089d07a0a2afc16adfe28a760d94d73d7298a4/src/tools/clippy/clippy_lints\src\loops\mod.rs#L517" (Indicator: "github.com"), "estion, and passing the argument, as both references and pointers, to a function that needs the memory address. For further details, refer to [this issue](https://github.com/rust-lang/rust-clippy/issues/5953) that explains a real case in which this false positive led to an **undefined behavior** introduced with unsafe code. ### Example ```no_run fn foo(v: &u32) {} ``` Use instead: ```no_run fn foo(v: u32) {} ``` /rustc/41089d07a0a2afc16adfe28a760d94d73d7298a4/src/tools/clippy/clippy_lints\src\pass_by_ref_or_value.rs#L56" (Indicator: "github.com"), " ### What it does Checks to see if common metadata is defined in `Cargo.toml`. See: ### Why is this bad? It will be more difficult for users to discover the purpose of the crate, and key information related to it. ### Example ```toml # This `Cargo.toml` is missing a description field: [package] name = "clippy" version = "0.0.212" repository = "https://github.com/rust-lang/rust-clippy" license = "MIT OR Apache-2.0" keywords = ["clippy", "lint", "plugin"] categories = ["development-tools", "development-tools::cargo-plugins"] ``` Should include a description field like: ```toml # This `Cargo.toml` includes all common metadata [package] name = "clippy" version = "0.0.212" description = "A bunch of helpful lints to avoid common pitfalls in Rust" repository = "https://github.com/rust-lang/rust-clippy" license = "MIT OR Apache-2.0" keywords = ["clippy", "lint", "plugin"] ca" (Indicator: "github.com"), " ### What it does Checks for `Mutex::lock` calls in `if let` expression with lock calls in any of the else blocks. ### Disabled starting in Edition 2024 This lint is effectively disabled starting in Edition 2024 as `if let ... else` scoping was reworked such that this is no longer an issue. See [Proposal: stabilize if_let_rescope for Edition 2024](https://github.com/rust-lang/rust/issues/131154) ### Why is this bad? The Mutex lock remains held for the whole `if let ... else` block and deadlocks. ### Example ```rust,ignore if let Ok(thing) = mutex.lock() { do_thing(); } else { mutex.lock(); } ``` Should be written ```rust,ignore let locked = mutex.lock(); if let Ok(thing) = locked { do_thing(thing); } else { use_locked(locked); } ``` /rustc/41089d07a0a2afc16adfe28a760d94d73d7298a4/src/tools/clippy/clippy_lints\src\if_let_mutex.rs#L121.45.0(" (Indicator: "github.com"), " Whether to suggest reordering constructor fields when initializers are present. Warnings produced by this configuration aren't necessarily fixed by just reordering the fields. Even if the suggested code would compile, it can change semantics if the initializer expressions have side effects. The following example [from rust-clippy#11846] shows how the suggestion can run into borrow check errors: ```rust struct MyStruct { vector: Vec, length: usize } fn main() { let vector = vec![1,2,3]; MyStruct { length: vector.len(), vector}; } ``` [from rust-clippy#11846]: https://github.com/rust-lang/rust-clippy/issues/11846#issuecomment-1820747924 missing_errors_docmissing_panics_docmissing_safety_doctoo_long_first_doc_paragraphunnecessary_safety_doc" (Indicator: "github.com"), " ### What it does Checks for floating point literals that approximate constants which are defined in [`std::f32::consts`](https://doc.rust-lang.org/stable/std/f32/consts/#constants) or [`std::f64::consts`](https://doc.rust-lang.org/stable/std/f64/consts/#constants), respectively, suggesting to use the predefined constant. ### Why is this bad? Usually, the definition in the standard library is more precise than what people come up with. If you find that your definition is actually more precise, please [file a Rust issue](https://github.com/rust-lang/rust/issues). ### Example ```no_run let x = 3.14; let y = 1_f64 / x; ``` Use instead: ```no_run let x = std::f32::consts::PI; let y = std::f64::consts::FRAC_1_PI; ``` /rustc/41089d07a0a2afc16adfe28a760d94d73d7298a4/src/tools/clippy/clippy_lints\src\approx_const.rs#L11" (Indicator: "github.com"), " ### What it does Checks for usage of unconstrained numeric literals which may cause default numeric fallback in type inference. Default numeric fallback means that if numeric types have not yet been bound to concrete types at the end of type inference, then integer type is bound to `i32`, and similarly floating type is bound to `f64`. See [RFC0212](https://github.com/rust-lang/rfcs/blob/master/text/0212-restore-int-fallback.md) for more information about the fallback. ### Why restrict this? To ensure that every numeric type is chosen explicitly rather than implicitly. ### Known problems This lint is implemented using a custom algorithm independent of rustc's inference, which results in many false positives and false negatives. ### Example ```no_run let i = 10; let f = 1.23; ``` Use instead: ```no_run let i = 10_i32; let f = 1.23_f64; ``` /rustc/41089d07a0a2afc16adfe28a760d94d73d7298a4/src/tools/clippy/clippy_lints\src\default_numeric_fallback.rs#L151.52.0" (Indicator: "github.com"), " ### What it does This lint warns about the use of literals as `print!`/`println!` args. ### Why is this bad? Using literals as `println!` args is [inefficient] and unnecessary (i.e., just put the literal in the format string) ### Example ```no_run println!("{}", "foo"); ``` use the literal without formatting: ```no_run println!("foo"); ``` [inefficient]: https://github.com/matthiaskrgr/rust-str-bench /rustc/41089d07a0a2afc16adfe28a760d94d73d7298a4/src/tools/clippy/clippy_lints\src\write\mod.rs#L13" (Indicator: "github.com")36:T16fc,Found reference to API (Indicator: "FlushFileBuffers"; Source: "sample.bin"), Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "sample.bin"), Found reference to API (Indicator: "LCMapStringEx"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleW"; Source: "sample.bin"), Found reference to API (Indicator: "SetStdHandle"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcessId"; Source: "sample.bin"), Found reference to API (Indicator: "GetStartupInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "HeapAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "FlsFree"; Source: "sample.bin"), Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "sample.bin"), Found reference to API (Indicator: "FlsAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "HeapFree"; Source: "sample.bin"), Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeSListHead"; Source: "sample.bin"), Found reference to API (Indicator: "GetConsoleMode"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcessHeap"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcAddress"; Source: "sample.bin"), Found reference to API (Indicator: "RaiseException"; Source: "sample.bin"), Found reference to API (Indicator: "FindFirstFileExW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileW"; Source: "sample.bin"), Found reference to API (Indicator: "FlsGetValue"; Source: "sample.bin"), Found reference to API (Indicator: "GetConsoleScreenBufferInfo"; Source: "sample.bin"), Found reference to API (Indicator: "EncodePointer"; Source: "sample.bin"), Found reference to API (Indicator: "LeaveCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "EnterCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "WideCharToMultiByte"; Source: "sample.bin"), Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "FindClose"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleExW"; Source: "sample.bin"), Found reference to API (Indicator: "CompareStringEx"; Source: "sample.bin"), Found reference to API (Indicator: "LocaleNameToLCID"; Source: "sample.bin"), Found reference to API (Indicator: "AreFileApisANSI"; Source: "sample.bin"), Found reference to API (Indicator: "GetACP"; Source: "sample.bin"), Found reference to API (Indicator: "IsValidCodePage"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "ExitProcess"; Source: "sample.bin"), Found reference to API (Indicator: "HeapSize"; Source: "sample.bin"), Found reference to API (Indicator: "SetConsoleTextAttribute"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentThreadId"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileType"; Source: "sample.bin"), Found reference to API (Indicator: "GetCPInfo"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameW"; Source: "sample.bin"), Found reference to API (Indicator: "IsDebuggerPresent"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "sample.bin"), Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "GetStdHandle"; Source: "sample.bin"), Found reference to API (Indicator: "SetConsoleMode"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualProtect"; Source: "sample.bin"), Found reference to API (Indicator: "GetCommandLineA"; Source: "sample.bin"), Found reference to API (Indicator: "GetCommandLineW"; Source: "sample.bin"), Found reference to API (Indicator: "CompareStringW"; Source: "sample.bin"), Found reference to API (Indicator: "WriteFile"; Source: "sample.bin"), Found reference to API (Indicator: "FlsSetValue"; Source: "sample.bin"), Found reference to API (Indicator: "RtlCaptureContext"; Source: "sample.bin"), Found reference to API (Indicator: "GetOEMCP"; Source: "sample.bin"), Found reference to API (Indicator: "TerminateProcess"; Source: "sample.bin"), Found reference to API (Indicator: "FreeLibrary"; Source: "sample.bin"), Found reference to API (Indicator: "LCMapStringW"; Source: "sample.bin"), Found reference to API (Indicator: "FindNextFileW"; Source: "sample.bin"), Found reference to API (Indicator: "SetFilePointerEx"; Source: "sample.bin"), Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "sample.bin"), Found reference to API (Indicator: "WriteConsoleW"; Source: "sample.bin"), Found reference to API (Indicator: "RtlPcToFileHeader"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "MultiByteToWideChar"; Source: "sample.bin"), Found reference to API (Indicator: "HeapReAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "GetStringTypeW"; Source: "sample.bin"), Found reference to API (Indicator: "SetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "sample.bin"), Found reference to API (Indicator: "CloseHandle"; Source: "sample.bin")37:T218f,Pattern match: "https://github.com/phildawes/racer", Pattern match: "https://doc.rust-lang.org/std/sync/struct.arc.html", Pattern match: "https://github.com/kobzol/cargo-pgo/blob/main/readme.md", Pattern match: "https://doc.rust-lang.org/nomicon/ffi.html#the-nullable-pointer-optimization", Pattern match: "https://doc.rust-lang.org/core/fmt/trait.debug.html", Heuristic match: "cifailed to write whole buffer/cargo/registry/25cdd57fae9f0462\anstream-0.6.21\src\wincon.rs", Pattern match: "https://doc.rust-lang.org/reference/attributes/type_system.html", Pattern match: "https://doc.rust-lang.org/stable/std/sync/", Pattern match: "https://doc.rust-lang.org/std/fmt/index.html#formatting-traits", Pattern match: "http://www.unicode.org/reports/tr24/tr24-31.html#script_value_aliases", Heuristic match: "only `colorchoice` values can be `set`/cargo/registry/25cdd57fae9f0462\colorchoice-1.0.4\src\lib.rs", Pattern match: "https://github.com/rust-lang/rust-clippy/issues/11085", Pattern match: "https://doc.rust-lang.org/nomicon/send-and-sync.html", Pattern match: "https://doc.rust-lang.org/std/default/trait.default.html", Pattern match: "https://crates.io/crates/regex", Pattern match: "https://github.com/rust-lang/rust-clippy/pull/9484#issuecomment-1278922613", Pattern match: "https://github.com/rust-lang/rust-clippy/issues/6353", Pattern match: "https://doc.rust-lang.org/std/macro.dbg.html", Pattern match: "https://github.com/rust-lang/rust-clippy/issues/10547", Pattern match: "https://github.com/matthiaskrgr/rust-str-bench", Pattern match: "https://doc.rust-lang.org/rustc/lints/listing/warn-by-default.html#dead-code", Pattern match: "github.com/rust-lang/rust-clippy/", Pattern match: "https://rust-lang.github.io/api-guidelines/naming.html#casing-conforms-to-rfc-430-c-case", Pattern match: "https://github.com/rust-lang/rust-clippy/issues/4295", Pattern match: "https://github.com/rust-lang/rustfmt/issues/3568", Pattern match: "https://github.com/rust-lang/rust/pull/116505", Pattern match: "https://github.com/rust-lang/rust/issues/26925", Pattern match: "https://www.floating-point-gui.de/errors/comparison", Pattern match: "https://doc.rust-lang.org/reference/destructors.html#drop-scopes", Heuristic match: "/cargo/registry/25cdd57fae9f0462\anstyle-parse-0.2.7\src\params.rs", Pattern match: "https://en.wikipedia.org/wiki/yoda_conditions", Pattern match: "https://github.com/rust-lang/rust-clippy/issues/8241", Pattern match: "https://doc.rust-lang.org/cargo/reference/manifest.html#the-lints-section", Heuristic match: "error/cargo/registry/25cdd57fae9f0462\anstyle-parse-0.2.7\src\lib.rs", Pattern match: "https://www.reddit.com/r/rust/comments/3hb0wm/underhanded_rust_contest/cu5yuhr", Pattern match: "https://doc.rust-lang.org/std/thread/fn.sleep.html", Pattern match: "https://godbolt.org/z/ocrcenevq", Pattern match: "https://doc.rust-lang.org/1.81.0/std/option/index.html#representation", Pattern match: "https://github.com/rust-lang/rust/issues/39465", Pattern match: "https://doc.rust-lang.org/std/boxed/index.html", Pattern match: "https://github.com/rust-lang/rust-clippy/issues/6072", Pattern match: "https://github.com/rust-lang/rust-clippy/issues/5953", Pattern match: "https://doc.rust-lang.org/stable/std/process/struct.child.html#warning", Pattern match: "https://rust-lang.github.io/api-guidelines/documentation.html#cargotoml-includes-all-common-metadata-c-metadata", Pattern match: "https://docs.rs/thiserror", Pattern match: "https://github.com/rust-lang/rust/issues/131154", Pattern match: "https://doc.rust-lang.org/stable/std/pin/macro.pin.html", Pattern match: "https://doc.rust-lang.org/stable/std/primitive.char.html#method.is_digit", Heuristic match: "a display implementation returned an error unexpectedly/rustc/41089d07a0a2afc16adfe28a760d94d73d7298a4/library/alloc\src\string.rs", Pattern match: "http://llogiq.github.io/2015/07/30/traits.html", Heuristic match: "a formatting trait implementation returned an error when the underlying stream did not/rustc/41089d07a0a2afc16adfe28a760d94d73d7298a4/library/core\src\io\write.rs", Pattern match: "https://doc.rust-lang.org/std/string/trait.tostring.html#tymethod.to_string", Pattern match: "https://doc.rust-lang.org/std/path/struct.pathbuf.html#method.push", Pattern match: "https://doc.rust-lang.org/reference/expressions/struct-expr.html#functional-update-syntax", Pattern match: "https://doc.rust-lang.org/std/macro.thread_local.html", Pattern match: "https://github.com/rust-lang/rust-clippy/issues/11846#issuecomment-1820747924", Pattern match: "https://doc.rust-lang.org/std/fm", Heuristic match: "failed to wait for cargo?/rustc/41089d07a0a2afc16adfe28a760d94d73d7298a4/src/tools/clippy\src\main.rs", Pattern match: "https://doc.rust-lang.org/std/hash/trait.buildhasher.html#method.hash_one", Pattern match: "http://www.unicode.org/reports/tr15/", Pattern match: "https://doc.rust-lang.org/stable/std/f32/consts/#constants", Pattern match: "https://rust-lang.github.io/rust-clippy/main/#large_stack_arrays", Pattern match: "https://doc.rust-lang.org/std/slice/fn.from_raw_parts.html#safety", Heuristic match: "/cargo/registry/25cdd57fae9f0462\anstream-0.6.21\src\adapter\strip.rs", Pattern match: "https://doc.rust-lang.org/book/ch08-02-strings.html", Pattern match: "https://rust-lang.github.io/rfcs/2383-lint-reasons.html", Heuristic match: "/rustc/41089d07a0a2afc16adfe28a760d94d73d7298a4/library/std\src\io\stdio.rs", Pattern match: "https://github.com/rust-lang/rfcs/blob/master/text/0212-restore-int-fallback.md", Pattern match: "https://doc.rust-lang.org/std/str/fn.from_utf8.html", Pattern match: "https://doc.rust-lang.org/reference/expressions/operator-expr.html#overflow", Pattern match: "https://doc.rust-lang.org/reference/macros-by-example.html#hygiene", Pattern match: "http://www.unicode.org/reports/tr15/#norm_forms", Heuristic match: " ### what it does checks for reference-counted pointers (`arc`, `rc`, `rc::weak`, and `sync::weak`) in `vec![elem; len]` ### why is this bad? this will create `elem` once and clone it `len` times - doing so with `arc`/`rc`/`weak` is a bit misleading,", Pattern match: "https://rust-lang-nursery.github.io/edition-guide/rust-2018/cargo-and-crates-io/crates-io-disallows-wildcard-dependencies.html", Pattern match: "https://docs.rs/take_mut", Pattern match: "https://rust-lang.github.io/api-guidelines/naming.html#ad-hoc-conversions-follow-as_-to_-into_-conventions-c-conv", Pattern match: "https://doc.rust-lang.org/std/borrow/trait.toowned.html#tymethod.to_owned", Pattern match: "https://github.com/rust-lang/rust-clippy/issues/3793", Pattern match: "https://doc.rust-lang.org/book/patterns.html#multiple-patterns", Heuristic match: " ### what it does checks for usage of `std::mem::swap` with temporary values. ### why is this bad? storing a new value in place of a temporary value which will be dropped right after the `swap` is an inefficient way of performing an assignment. the s", Pattern match: "https://doc.rust-lang.org/stable/std/alloc/trait.globalalloc.html#method.alloc_zeroed", Pattern match: "https://doc.rust-lang.org/std/ptr/fn.read_unaligned.html", Pattern match: "https://github.com/rust-lang/rust/issues/44690", Heuristic match: "/rustc/41089d07a0a2afc16adfe28a760d94d73d7298a4/library/std\src\sync\once.rs", Pattern match: "https://doc.rust-lang.org/std/primitive.bool.html#impl-from%3cbool%3e-for-u8", Pattern match: "https://doc.rust-lang.org/nightly/rustc/lints/listing/deny-by-default.html#let-underscore-lock", Pattern match: "https://github.com/rust-lang/rust-clippy/issues/7306", Pattern match: "https://doc.rust-lang.org/std/primitive.str.html#method.splitn", Pattern match: "https://doc.rust-lang.org/stable/std/primitive.slice.html#method.chunks_exact", Pattern match: "https://doc.rust-lang.org/std/fs/fn.read.html", Pattern match: "https://github.com/rust-lang/rust/issues/37612", Pattern match: "https://doc.rust-lang.org/std/primitive.never.html", Pattern match: "https://doc.rust-lang.org/std/sync/struct.arc.html#thread-safety", Pattern match: "https://doc.rust-lang.org/stable/std/fmt/trait.debug.html#stability", Pattern match: "https://github.com/rust-lang/rust/issues/69826", Pattern match: "https://crates.io/crates/bytecount", Pattern match: "https://github.com/rust-lang/rust-clippy/issues/8496", Pattern match: "https://doc.rust-lang.org/reference/expressions.html?highlight=subexpression#evaluation-order-of-operands", Pattern match: "https://doc.rust-lang.org/std/path/struct.path.html#method.join", Pattern match: "https://github.com/rust-lang/rust-clippy/issues/5122"30:["$","$Lc",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"{\"@context\":\"https://schema.org\",\"@type\":\"TechArticle\",\"headline\":\"Sample b79598cb4fa3… — Score 0/100 — Hybrid Analysis\",\"description\":\"Threat analysis for sample b79598cb4fa3…. Threat score 0/100. 0/25 AV engines flagged this file. 0 malicious and 0 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.\",\"url\":\"/sample/b79598cb4fa354415f4e388d10fdcd270f3b56c1e5275da54bfcafb3bfa88c2e\",\"keywords\":[\"malware analysis\",\"sandbox report\",\"threat intelligence\",\"b79598cb4fa354415f4e388d10fdcd270f3b56c1e5275da54bfcafb3bfa88c2e\"],\"about\":{\"@type\":\"SoftwareApplication\",\"name\":\"cargo-clippy.exe\",\"applicationCategory\":[\"peexe\",\"64bits\",\"executable\"],\"identifier\":\"b79598cb4fa354415f4e388d10fdcd270f3b56c1e5275da54bfcafb3bfa88c2e\"},\"threatScore\":0,\"antivirusDetections\":{\"malicious\":0,\"total\":25},\"behavioralIndicators\":{\"malicious\":0,\"suspicious\":0},\"publisher\":{\"@type\":\"Organization\",\"name\":\"Hybrid Analysis\",\"url\":\"https://www.hybrid-analysis.com\"}}"}}],["$","$L34",null,{"initialData":{"schema_version":"1.0.17","sha256":"b79598cb4fa354415f4e388d10fdcd270f3b56c1e5275da54bfcafb3bfa88c2e","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"NOT_AVAILABLE","fastscan_status":"SUCCESS"},"verdict":"no specific threat","threat_score":0,"unified_at_epoch_ms":1794493252412,"unified_at":"2026-11-12T14:20:52.412Z","metadata":{"hashes":{"sha256":"b79598cb4fa354415f4e388d10fdcd270f3b56c1e5275da54bfcafb3bfa88c2e","sha1":"b6da9bde3ae6bb0d02a920e547a2b728136e98cd","md5":"0cfe0a1ee09502a8cddf6ed4dc72809f"},"file_info":{"file_name":"cargo-clippy.exe","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":1213952,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1794489045000,"last_seen":1794493245000,"last_multi_scan":1794493245000}},"detections":{"summary":{"verdict":"no specific threat","score":0,"tags":null},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":16},"sandbox_signatures":{"informative_count":29,"suspicious_count":0,"malicious_count":0,"total":29},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to retrieve/open a process (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve files based on search patterns"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"qsp","report_id":""}]}],"sandbox_signatures":[{"level":"informative","category":"General","name":"Contains artifacts from Rust programming language","description":"file/memory contains long string with (Indicator: \"/rustc/\"; Source: \"sample.bin\")","origin":"sample.bin","id":"string-943","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Found well known domains (string)","description":"$35","origin":"sample.bin","id":"string-135","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$36","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-272","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-315","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Found a reference to a known community page","description":"file/memory contains long string with (Indicator: \"youtube\"; Source: \"sample.bin\")","origin":"sample.bin","id":"string-10","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"cargo_clippy-54e312b38c6559bc.pdb\"","origin":"sample.bin","id":"string-7","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\"), Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.003","id":"string-206","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"sample.bin\"), Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-319","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://github.com\", Found HTTPS url \"https://doc.rust\", Found HTTPS url \"https://docs.rs\", Found HTTPS url \"https://www.unicode.org\", Found HTTPS url \"https://crates.io\", Found HTTPS url \"https://rust\", Found HTTPS url \"https://www.floating\", Found HTTPS url \"https://en.wikipedia.org\", Found HTTPS url \"https://www.reddit.com\", Found HTTPS url \"https://godbolt.org\", Found HTTPS url \"https://www.youtube.com\"","origin":"sample.bin","mitre_attack_id":"T1573","id":"string-98","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$37","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"file/memory contains long string with (Indicator: \"github.com\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"youtube.com\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1590","id":"string-761","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543","id":"string-167","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetEnvironmentStringsW\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-89","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.006","id":"string-249","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\"), Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.002","id":"string-661","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-427","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\"), Found reference to API \"GetEnvironmentStringsW\" (Indicator: \"GetEnvironmentStrings\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-85","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-317","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; Source: \"sample.bin\"), Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-83","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-164","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve files based on search patterns","description":"Found string \"where in this text.\n/rustc/41089d07a0a2afc16adfe28a760d94d73d7298a4/src/tools/clippy/clippy_lints\\src\\unicode.rs#L12\" (Indicator: \"where \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-484","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"file/memory contains long string with (Indicator: \" Sleep \"; Source: \"sample.bin\"), Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"sample.bin\"), Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-226","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.001","id":"string-318","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; Source: \"sample.bin\"), Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; Source: \"sample.bin\"), Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-148","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; Source: \"sample.bin\"), Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-183","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"sample.bin\"), Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"sample.bin\"), Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1489","id":"string-316","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-310","sources":[{"report_type":"qsp","report_id":""}]}],"intel_graph":{"map":{},"chains":[]}},"activity":{"stats":{"process_count":0,"spawned_processes_count":0,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":0,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":null,"processes":null,"all_imported_dlls":null},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{}}}]]}] 2c:[["$","title","0",{"children":"Sample b79598cb4fa3… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Threat analysis for sample b79598cb4fa3…. Threat score 0/100. 0/25 AV engines flagged this file. 0 malicious and 0 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/b79598cb4fa354415f4e388d10fdcd270f3b56c1e5275da54bfcafb3bfa88c2e"}],["$","meta","4",{"property":"og:title","content":"Sample b79598cb4fa3… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Threat analysis for sample b79598cb4fa3…. Threat score 0/100. 0/25 AV engines flagged this file. 0 malicious and 0 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/b79598cb4fa354415f4e388d10fdcd270f3b56c1e5275da54bfcafb3bfa88c2e"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Sample b79598cb4fa3… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Threat analysis for sample b79598cb4fa3…. Threat score 0/100. 0/25 AV engines flagged this file. 0 malicious and 0 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L38","11",{}]] 32:null