{ "ml": { "v": "7", "eng": "2.5.0-beta.0", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.000015497208, "rte": "az", "prob": 0.000015497208 }, { "cls": 0, "raw": 0.00021460652, "rte": "az/nupkg", "prob": 0.00021460652 } ], "prob": 0.000020553669, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.000020553668946377002, "type": "nupkg" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.000008761882781982422, "type": "text" }, { "id": 11, "lvl": -1, "conf": 0, "prob": 0.000014881293282087427, "type": "macho" }, { "id": 12, "lvl": -1, "conf": 0, "prob": 0.000012636184692382812, "type": "registry" } ], "version": "v18.18", "analyzed_at": "2026-08-02T15:46:21Z" }, "path": "Scout.osx-x64.0.6.0.nupkg", "raw": { "files": [ { "id": 0, "ctx": [ { "b": "p!H([6Awak2MK\u00268aZtfkE]QZ{001.R000l7002X:lQ::Gmo@!:Kj(o0Zwy#\u003cipft=W+s7VY{V!\u0026r*bH-+U\u003cDAf#N7Fqezc-?/*AKYkn\u003c\u0026:N/gklM({1Uc?=zJhuKKhO0rt\u0026H$WM\u003eDAj?u]Z8O\u003essgovq%EufJM\u003c", "n": [ { "c": 2, "d": "Archive contains an executable member", "i": "metadata/file/metrics::archive-contains-executable-member", "o": 0, "z": 31, "cf": 0.949999988079071 } ], "ln": 0 } ], "mol": "H(Ds)", "sha": "0691e3e32146b73cba894e5ab85eab05a97dcdf0e18e669dee299d6afa5f62cb", "path": "Scout.osx-x64.0.6.0.nupkg", "risk": 2, "size": 2922142, "type": "nupkg", "facts": { "metrics": { "file": { "size": 2922142.0, "entropy": 8.0, "size_bytes": 2922142.0 }, "binary": { "overall_entropy": 8.0, "peak_region_bytes": 2898944.0, "peak_region_entropy": 7.85 }, "archive": { "file_count": 12.0, "member_count": 12.0, "script_count": 0.0, "zip_bomb_ratio": 5.91, "directory_count": 0.0, "executable_count": 2.0, "extra_field_size": 0.0, "noise_file_count": 0.0, "total_compressed": 2920642.0, "compression.ratio": 0.45, "hidden_file_count": 2.0, "total_uncompressed": 6490675.0, "crc_collision_count": 0.0, "entry_comment_count": 0.0, "max_filename_length": 81.0, "rtlo_filename_count": 0.0, "format.regular_count": 12.0, "nested_archive_count": 0.0, "path_traversal_count": 0.0, "symlink_escape_count": 0.0, "security.setgid_count": 0.0, "security.setuid_count": 0.0, "security.sticky_count": 0.0, "double_extension_count": 0.0, "duplicate_member_count": 0.0, "security.symlink_count": 0.0, "unicode_filename_count": 0.0, "homoglyph_filename_count": 0.0, "security.encrypted_count": 0.0, "timing.mtime_unique_count": 2.0, "timing.mtime_unique_ratio": 0.17, "misplaced_executable_count": 0.0, "timing.mtime_outlier_count": 1.0, "timing.mtime_dominant_count": 11.0, "timing.mtime_spread_seconds": 18380760.0, "timing.sentinel_mtime_count": 0.0, "security.world_writable_count": 0.0, "timing.mtime_dominant_fraction": 0.92, "compression.method_counts.stored": 1.0, "compression.method_counts.deflate": 11.0 } } }, "ident": { "name": { "value": "Scout.osx-x64", "source": "nupkg.title", "verified": false }, "urls": [ { "url": "https://github.com/willibrandon/scout", "kind": "homepage", "source": "nupkg.project_url" }, { "url": "https://github.com/willibrandon/scout.git", "kind": "repository", "source": "nupkg.repository_url" } ], "trust": "unsigned", "authors": [ { "name": "willibrandon", "role": "author", "source": "nupkg.authors" } ], "version": { "value": "0.6.0", "source": "nupkg.version", "verified": false }, "identifier": { "value": "Scout.osx-x64", "source": "nupkg.id", "verified": false } }, "traits": [ { "id": "micro-behaviors/dylib/lookup::dladdr", "conf": 0.8500000238418579, "crit": 3, "desc": "Address to symbol lookup", "from": [ { "file": 11 } ] }, { "id": "micro-behaviors/communications/socket/tcp::create-socket", "crit": 3, "desc": "CreateSocket function", "from": [ { "file": 11 } ] } ] }, { "ctx": [ { "b": "o?wqboLF0FzGxv@3pw-JD2^RixMLvBv\u003c@JQfFUKelulHLwn=uds7#F!x\u003c\u003e\u003e13joQvA=2JiB7]MgazC)txK#i}vTf8eA:-\u003ccwN)tmw].D]aA7\u003cmv}Yp\u003exjSRpBz\u0026pgzH0vzwPz\u003cgzxJ\u003ebByw)3x(mMavix5#AcR!ew/#hex(+zrz!s9nvrb{4vqYP#vrlHdv}/v[wN(]]z!0{bwO#P#BzkVhazbt7wPF$xBzbkdb2-z(BA.elwG\u0026MOaARJAwmYg=3tBx2Bzbkdq/un\u0026CvtJ6aA}KwxM53naAz4mBAh89BzkVhefFUAv@co#x(mMaCwhejz/{dAy?W:2Byxo9z/cXtxK@rbx\u003eI8", "ln": 0, "col": 1, "line": 1 }, { "b": "z/f91BzkVhB2\u003cTnra]?=vpBd#wGUG3AcVFrxj#xfzF%Shv}u=\u003ezE:(ixLzJgAaK6bx(!ufz/cXnz//Y6wGV5cvqG:5vR3V@zEWH9wmYo]x(k54y?%C*z/xA4B0bywaAIWmB97\u0026dBzkf1aAhmtBzkVhB0bykaARpdax9h\u003cBA.elwIaq%r7GC2q+]\u003eZs3Y.Mav#", "ln": 472, "col": 47, "line": 10 }, { "b": "l)bD8axg)2axH\u003cbqBa5SnKVM2pEVE3mn=Gzk#7xBlp\u003c\u003cxr9p:VmOcMOmn)bcmO=]8k{e#\u0026qDcjPrzkXRaw=6op!$1Uave:\u003cawLZcnLR-MnLR=Ao*}/Re*9.XawLYPmoh\u0026Lr3kagk$\u003c@{r7GB+k#*(PpF$alpF@r5pF+g(nK(rJav]p4l}70LavnG", "ln": 720, "col": 34, "line": 16 }, { "b": "r7GCQs4MsVefEkRnMehQm\u003c7o0pFAwEpGpvppEVE5qxOLaavw}1pdmJHnL-87s4MvZaxg)2ax869r98v-miCx7axg)2axqueawU(TpGf\u003eNqxOv@k$\u003c\u003cBm]HK4p9rIbmg8%?mPrCPqBJhB", "ln": 961, "col": 55, "line": 19 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 1073, "entropy": 5.1 }, "binary": { "peak_region_bytes": 1024, "peak_region_entropy": 5.1 } } }, "id": 1, "path": "Scout.osx-x64.0.6.0.nupkg!!LICENSE", "pid": 0, "risk": 1, "sha": "f74f925ccd6fc2f4b9bdf7682f6927a64809c8668e8232997c541cc6f992787b", "size": 1073, "traits": [ { "id": "metadata/lang/natural::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"", "spans": [ [ 180, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-2", "conf": 0.8, "crit": 1, "desc": "English function-word token \"and\"", "spans": [ [ 144, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "spans": [ [ 768, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-6", "conf": 0.8, "crit": 1, "desc": "English function-word token \"with\"", "spans": [ [ 1009, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-7", "conf": 0.8, "crit": 1, "desc": "English function-word token \"this\"", "spans": [ [ 130, 0 ] ] }, { "id": "metadata/package/license::mit-license-grant-text", "conf": 0.9, "crit": 2, "desc": "MIT license permission grant sentence", "spans": [ [ 50, 0 ] ] }, { "id": "metadata/permission/prose::permission-permission-term-english", "conf": 0.9, "crit": 2, "desc": "Permission or access term", "spans": [ [ 50, 0 ] ] }, { "id": "metadata/lang/natural::lang-english", "conf": 0.8, "crit": 2, "desc": "Contains common English function words", "uses": [ 0, 1, 2, 3, 4 ], "spans": [ [ 180, 0 ] ] } ], "type": "text" }, { "ctx": [ { "b": "=?^5d2lj-80@@r30SSi2761smspk9eG-E!D0000082%Tpnb@R\u0026uTDR}m[3PIqCNn)000000000000000000000rr91000000000000000000000000000000000000000082%TpxAFkmuTD=3sx2n20000000000000000rr910dXnN0000000000000", "n": [ { "c": 3, "d": "Patterns associated with legitimate injectors to reduce FPs", "i": "objectives/evasion/process/injection/toolkit::legitimate-injector-patterns", "o": 0, "z": 22, "cf": 1.0 } ], "ln": 0 }, { "b": "sx2n20000000000FAeS?0rr91Ky/Bi00000FAeS?2lj-7000000000000000000000000000000uTE.XygyQ/wPRQ6vqPMQuTD=3sx2n200000000005kb}40rr91", "n": [ { "c": 1, "d": "Repeated 0x07 byte constant", "i": "micro-behaviors/mem/protect/modify::repeated-07-byte-constant", "o": 708, "z": 4, "cf": 0.25 } ], "ln": 676 }, { "b": "00000000004GDFeaohxw3\u0026*ncflItRfkLuifjYuAwb(Pf000008VP\u003cr7YTKo^ZRbc\u003cukouVv=qA*!m@xg5}pOaohxw0rr91000Ge00j5s0rr910@@r300gvFdGxCG5c8Xg0000000000c\u0026:l$7YTKo\u00260PI+0000000000000003\u0026*ncfAq7M7YTKo0SSi207k9r00031flItRfkLuifkLuiv\u003ef5Zf!N0Zy?WtU3\u0026*nch#\u0026{U7YTKo0SSi20086W00031flItRfkLuifkLuiz^)D\u003ee\u003cRa2D2dh700000000003\u0026*ncfAq7M7YTKo0SSi23\u003c3Cf00031flItRfkLuifkLuiDm*{8wo\u002609vGlxd3\u0026*ncu\u0026Qfb7YTKo0SSi2003ZA001LJfh)dqBy/qxoLE%RvrcSDmSI{OwP@6kyJzc#z/]@dvruj4zz2KwvqPO1z/PRDr+lq)x(v)gfgdxZz/]@dvruj4zu6Up3\u0026*nch#\u0026{U7YTKo0SSi2002W@00031flItRfkLuifkLuiq*ACawO\u003c4^e[xlzx\u003c}5x000003\u0026*ncxAe2j7YTKo0SSi2003ZA005q+fh)dqBy/qxoLE%RvrcSDmSI{OwP@6kyJzc@z/PzUz/]@dvruj4zz2KwvqPO1z/PRDr+lq)x(v)gff}lUz/PzUz/]@dvruj4zu6Upcia2C5c8Xgi5s$yKwV5Udf6tF5c8Xg:C1450000000000000000000000000000000000000000000000000000", "n": [ { "c": 2, "d": "Mach-O linked dylib metadata", "i": "metadata/binary/linking/runtime::dylib", "o": 2496, "z": 23, "cf": 1.0 }, { "c": 2, "d": "Mach-O UUID metadata", "i": "metadata/build/reproducible::macho-uuid", "o": 2408, "z": 36, "cf": 1.0 } ], "ln": 2360 }, { "b": "0000000000000000000000000000000000000010nqVC0Gx%-3mF)b=004\u003e7{^*l:[jnyo\u003e.\u003c(:nq?SW\u003eSeXz0eTe9Gmh!XD\u003cCT0\u003cCut6(L2h8{^*r=[jnEq\u003e\u0026+4a", "n": [ { "c": 1, "d": "_main program entry symbol", "i": "metadata/lang/compiled::main-entry-symbol", "o": 3041, "z": 4, "cf": 0.5 } ], "ln": 3009 }, { "b": "^m2!i{Ru[h00kB%L!/V4\u0026r/m{0rOR*BUl7s=X6KA{Ru?f02P\u0026Gl5A-Mf#bJ=4/$5K^5md\u003e5\u003c.e(13#W#01.yrk[xi}m2xm10001H528h/004K\u0026c+6fS0dUPOmteE0c4(g4B1\u0026ECtv2cnf#gp0004JWQceIS0dYdzmkqPg@S^G6(KXZcavM*HZ^FY3.gRZ(", "n": [ { "c": 2, "d": "XGETBV instruction bytes", "i": "metadata/binary/instruction::xgetbv-instr", "o": 17382, "z": 8, "cf": 0.30000001192092896 } ], "ln": 17334 }, { "b": "mVvLw00000m#WU4l[cc()Ge4713}!tl5Ce2IqEK#-ZNDs-ZNGt-ZNJu-ZNMv-ZNPw-ZNSxG$}^ZmkrLEEyYA33pho80001M{h\u003eOgEy/G4tTpywBYp[\u003eB?o@K0SSi2(9gi*07-2lC.%\u003ct0NKw\u0026.1ZDU5j?UuFb/MHnb", "n": [ { "c": 1, "d": "Stack string construction pattern (5+", "i": "objectives/anti-static/obfuscation/control-flow/logic::stack-string-construction", "o": 349138, "z": 29, "cf": 0.4000000059604645 } ], "ln": 349106 }, { "b": "5jzGXJq@}U07S1KFj7\u003ca.r}wS\u003el12b}9x(dIo+z!-ZM)c-ZM{d-ZM%e-ZN0f-ZN3g-ZN6hG${xszj\u003e#9mkrLEEx0o\u00264NEYc0001M{78?s0001HEx9u\u003cBu}}UB.\u003cQdo@*N(0SSi2(b-]907\u00268qieM3N0MW/:.1ZDU2M", "n": [ { "c": 1, "d": "Stack string construction pattern (5+", "i": "objectives/anti-static/obfuscation/control-flow/logic::stack-string-construction", "o": 368351, "z": 29, "cf": 0.4000000059604645 } ], "ln": 368319 }, { "b": "f#ctj-1lcstTqWZuTpNV6-Xmm.]z\u0026V0002.BH\u003ca9I-x]t:P8qa/\u003e7:pGA7#L002Mz%8Y$}nqVB]r-qLC}@!*df91p{-XCm{Gz$)[4cP)^f93[\u0026\u003e\u0026G\u003e+%4c.CnqNZUl0^\u003cmXd[#A0k/r?kMB!PIri@/X?s5qZ\u0026Q0g4^jzlf93R:1A:\u00264Z*j\u003ew0j\u003c/-I-t2bRPn-pw!b$K002Mz{79z6H5RWJ.3E(!6-XmmBT*xZIrdVjnqV}{%46#?1)ARhf91L112m[*G$$hM0096gmzRJE-0xNM.\u0026N\u003e?Iri%gX?s4rZ*j?*9@]qiIrd38k#{]PGx#c1ItG\u002641!*JD07-1FnqP^[Io=HWXeUFH0e7p[4#nQl001:?iM.\u003e=:P8qvg0h{t{v=u7Buh%5-Z\u003e}P", "n": [ { "c": 3, "d": "TCP connection operations", "i": "micro-behaviors/communications/socket/tcp::connect-comp", "o": 523790, "z": 12, "cf": 0.6600000262260437 } ], "ln": 523726 }, { "b": "lKlkvA$y)0?:\u0026yr2WpQm\u0026koesw[AUaaa%Q]00010nqVC0JyNU/.!6A3l\u0026Wi!nqVC0I:{(P.!6A3l\u0026Wi!nqVB]s3Y\u003eMry6O.np*b-0SSi\u003eJu6yCeDws#[ji(jndOeCla(7O%nLyVZ}=Pta9nk=IqQ{Q-e1D", "n": [ { "c": 1, "d": "C++ std vector symbol", "i": "metadata/lang/compiled::stl-vector-symbol", "o": 670001, "z": 27, "cf": 0.5 } ], "ln": 669969 }, { "b": "KDtM=KDtM5nr2=ul}ND[2lj-7\u003eW2K\u0026%4572nr2$F-@FkyByY17kM\u003e!s-Y%.(nr0!.\u00266EAmGlWd\u003eBRWJaj=l^d07-902Uo)B\u003eYO/r%bZE5\u003e/ccz%lFZbKDtM=KDtM=Kn", "n": [ { "c": 1, "d": "Encoded HTTP URL recognized marker", "i": "objectives/anti-static/obfuscation/encoding/content::encoded-http-url-recognized-marker", "o": 2742697, "z": 5, "cf": 0.8500000238418579 } ], "ln": 2742665 }, { "b": "%0o\u003eKblm-\u0026k/$qK%0p1Oblm-\u0026m9l.OFi%qp[zBoDkMH(=fI?(L096d4q1jU*eMI\u003c6ePtiuwIL\u0026XwPz\u003caz/bLbeP$YCB7]Mg08M3Xmku0dzFKcdCwXKqB0a[mvqfK^vR/P#c}W6gazC)tB-7ShvqfK^vR/Q83ii)\u0026qBJt-b}ZV*azC)tvrM6[y**^?wGSx[nMl*DB08=Idgc5-C4293vpB4:0cJf/", "n": [ { "c": 2, "d": "__cstring section entropy at least 4.5", "i": "metadata/binary/metrics/structural::high-entropy-cstring", "o": 3652852, "z": 32, "cf": 1.0 } ], "ln": 3652804 }, { "b": "Bw)o\u0026v@21SDsW7hfFk4ig5@)TeIfLix(\u003e{UeIe8Hav!^wt)ZM-eIeLCzFshnCwhejaz$Rfx)a5gv@#@EeIeK%toEP[yggQ/aybrOarR^MA0=N%eIeLCzFshAeIeK%toDv9aybrOeIeLanP5l:eIeLaax]%!BywV{rb#zSwGUm=03AybtoEH4ay/ta", "n": [ { "c": 2, "d": "Contains common English function words", "i": "metadata/file/profile/language::lang-english", "o": 3654791, "z": 4, "cf": 0.800000011920929 } ], "ln": 3654743 }, { "b": "A8*!1x(mD}zF77$3ij4zByw#:BAg@lB4*H+q!ZL?08)#WwPI]^z!z:PC4CE\u00263rgXIaAz4kB.L(cwftP7B98CBv@#B6zxK1iBAnNkA+cwhz/^ayB-qqrA=+(6ayYQsBzbkdv%8*jwO#PjlR{=n3ihL9dK([$dJ?b}y!XtLzxI[HqBJ(tuQNsZk%[f", "n": [ { "c": 2, "d": "Contains common English function words", "i": "metadata/file/profile/language::lang-english", "o": 3654992, "z": 3, "cf": 0.800000011920929 } ], "ln": 3654944 }, { "b": "07Pyzz/fScA=#1*wO(vaC(Q-NB7Gxnx(mMac3\u003c8AvTi6bB08\u003eSe\u0026d8Zzdj}pw]zYjm)!zdz/oAbwO2*{zF787vqfK?wb[#nzeB0eBzkS9ashtAayYRrwPF#az/M$eaAz4ax(v(iw)]y\u0026wN\u003e^dz/f6cA=L-eBrB7viV}siB97\u0026hBzkS9avOZa08M8", "n": [ { "c": 2, "d": "Contains common English function words", "i": "metadata/file/profile/language::lang-english", "o": 3657502, "z": 3, "cf": 0.800000011920929 } ], "ln": 3657454 }, { "b": "pI%#]0aQ4Xvru6\u003eB.#6$l@c=Smo0RZvRnbEvpB4:o\u003e!GVm0iu=azC)tB7GCovqYP#Bzbkdv@=c?By/09zeZRbx(mv1C{3TowPF#iz/^akCXIkviV].\u00263ihw{03#C$BPtlUz^)J]z6iU6B-7Y5x(mMav@=c?By/09ze.JUAa%o5c[codk$K:sl)9=", "n": [ { "c": 2, "d": "Contains common English function words", "i": "metadata/file/profile/language::lang-english", "o": 3658885, "z": 3, "cf": 0.800000011920929 } ], "ln": 3658837 }, { "b": "ash7Kc)-yM3ii[yz^)J]z6iU6B-7Y5x(mMav@=c?By/09zeZQCzddYjzF%RtxKM6}az2!ev%8)8aAg[jze16jx(v)gdlnO.CX7xdc)-{-avXT*oHRt(c37gSc1FCi08\u0026\u003e]A=kA6wO\u0026MlA+PSfzF78lzY\u0026LgwNPW(woz:daAg+fwO#P%CxdztwNxy\u003c", "n": [ { "c": 2, "d": "Contains common English function words", "i": "metadata/file/profile/language::lang-english", "o": 3659141, "z": 4, "cf": 0.800000011920929 } ], "ln": 3659093 }, { "b": "e]imMv{@\u003eXwPINiwDjx5A=kCvB7Gf1flqkzBzR12055zsB1.cDfjOTnz/{10fk$@Iv\u003eR[my?ttqz/]@tx(mK303A\u003co03A\u003coc37gPdSVZUA@YY.A=l8t04X9@dSVZUdSVZUdSVZUB08=Iaoj6lA=kCvB7Gf1fjOTnz/{10b}rb9i:B=)tv6u@iWF?EfGIlvA@Z5*zeTDu03#XjA@W\u003egwO(vaC}KkXwNxa+wPzj1v}Zb/xLz3#vrb\u003c\u003ex\u003e7N/uU%v\u003ez/Qbgy?W:2BryMpzdNN5A^ooNx(dL", "n": [ { "c": 2, "d": "Reads own cgroup (/proc/self/cgroup)", "i": "micro-behaviors/fs/proc/container::container-self-cgroup", "o": 3659808, "z": 17, "cf": 0.6600000262260437 }, { "c": 2, "d": "Read mount info from /proc/self/mountinfo", "i": "micro-behaviors/fs/proc/mounts::mounts-mountinfo", "o": 3659742, "z": 20, "cf": 0.6600000262260437 } ], "ln": 3659694 }, { "b": "uU0.*wObp\u003cx)KtkCwhejayX+\u0026aAImywDkb1k#He{z/xi8wmV)3z/^aoze:r5zdNQbwN\u003e^NwPQ\u003cVC4ChZwOkZ#By/E)B-8nyAbY-oBy!#9A+frlz/Pziy\u0026r/(BzkVhaz7", "n": [ { "c": 1, "d": "Uses an opcode for cloud tasking", "i": "objectives/command-and-control/channel/deaddrop/cloud-storage::workdrive-opcode-marker", "o": 3662018, "z": 6, "cf": 0.9200000166893005 } ], "ln": 3661986 }, { "b": "0000000000000000000000000000000000000000B7ochBrAm\u0026hzcWac#%3vxl4N5atC-af!Ld5v@Dj6vrui)y?kduA+fzpg=NuKwhX4dhA95(0000000000@OK:lk.^T@1wG6U1:71Q2B#8O2/N6L3ge4I3kA", "n": [ { "c": 1, "d": "Large __TEXT,__const section (300KB+)", "i": "metadata/binary/section/metrics::macho-large-const-section", "o": 3662976, "z": 30, "cf": 0.699999988079071 } ], "ln": 3662944 }, { "b": "z/5{8vf2nv00pnH00jrK002.QwN$\u0026w000000000003\u003eGMz/{dOl3mo/zddJ{e[w^mek{?nBy/qwp\u0026Zn[vru6klVm0RoLE${=\u0026sc7wDh}[wF]nPyxauyj.ng80000000000001\u0026OD2[7sz7XU9x)9{bwIct*A+d{UvLhhcy=272z/{dOl3mo/zddJ{", "n": [ { "c": 2, "d": ".dll extension reference", "i": "micro-behaviors/fs/path/extension::dll-dup", "o": 3666941, "z": 4, "cf": 0.5 } ], "ln": 3666893 }, { "b": "j5uo\u003cpZOZI3zQD98=v3bqvi!g3whm:}+)?400002^@ky6s7b/+nmuyDy?j}+ra{q-vpShMz!@G[A+!l*wO\u0026F.vqYH^wN[+NA+eV\u0026nN@+uFys%NLoy0Gr0\u0026Q9\u003c5l6X0000000008oMaAR5\u003c{OPwncd1z/d69Fys%NLox#DrseZayGgGq000000000eo(B]-Bz?", "n": [ { "c": 2, "d": "References a worker, thread, or goroutine pool", "i": "micro-behaviors/process/create/workers::worker-pool", "o": 3722562, "z": 10, "cf": 0.6000000238418579 } ], "ln": 3722514 }, { "b": "y\u002606ZA=2Jdvru6\u003e008i9FE8zvtB=#s2xHF5(K\u003eDIl2pvQv/MI(o9VZz!3mp27c#+Mz^#%ZA=kJ1008gP2p6D3Vc?49^eTdD!4@^2\u003esV49031pmADL#owL^qVzGGDgkMy", "n": [ { "c": 1, "d": "Go allocation symbol bytes", "i": "micro-behaviors/mem/alloc/heap::go-alloc-symbol-bytes", "o": 3884884, "z": 6, "cf": 0.7599999904632568 } ], "ln": 3884852 }, { "b": "b5Q?bz/W9-00000004u\u0026BA}?pb03]Tz/fVdCYUbXb4Lb7viN:Vb5*$jxD/Fq00000003OK00000004u\u0026zddJ@xD/Fq00000004u\u0026BA}?pb03]+vru0)a$K{Gvrt{4i^S4", "n": [ { "c": 1, "d": "File task data field", "i": "objectives/command-and-control/backdoor/tasking/filesystem::websocket-task-data-field", "o": 4173194, "z": 7, "cf": 0.8799999952316284 } ], "ln": 4173162 }, { "b": "vTi6bayPqeB-7.jz!rQ5wPP3{00000eDt+J00000vqZd200000ax{DJe*7b]vqHc@D2\u0026@=efB])00000eIh6+vpJ\u003cGs3Y.VnLR=paAITyAbYx0aAIa5A:@=%zF783", "n": [ { "c": 1, "d": "Terminal type ansi identifier", "i": "micro-behaviors/process/tty/terminal::terminal-type-ansi", "o": 4174624, "z": 4, "cf": 0.800000011920929 } ], "ln": 4174592 }, { "b": "e-0Ggk\u0026:96Kn?QOfpVWnlaz(zOFK9iSt\u003c)8Lg{\u003eC/(#t+zOII6yWQXYi%7hvk%^}bmmG^rnLhSHo?[FXqbQs(rArg6sZ2lyv}od.xj#0]yIW\u003c9z/xYpB98LFCx!yVfFLssg=mfIi5@GxjPCDZ00000BA}?p00000%nz##00000000310SSr51onP91][(d2MK(92(\u003eqj3JHOn4fc\u003er4/^au4/^dv5DAsw4/^jx695ZD6-Y0H7xtoL4/^EE4/^au8upYR", "n": [ { "c": 2, "d": "Hardcoded standard base64 alphabet", "i": "micro-behaviors/data/encode/base64::alphabet-standard", "o": 4313760, "z": 64, "cf": 0.5 } ], "ln": 4313712 }, { "b": "i@/lXs]XK5CMmZzMJd0=WeZgb!bPEG]8F:\u003c5DI\u003eifAzdNp5$s{z2\u003cRp00000fFCgnfFUsrfF\u003eEvfG7QzfGp:Df!+spf!$Etf/gQxf/y:Bf/Q)Fgb7ErgbpQvgbH:zgbZ)Dgb}3HgCyQtgCQ:xgC*)BgD43FgDmfJg+Z:vg+{)zg=d3Dg=vfHg=NrLh83)xh8m3Bh8EfFh8WrJh8)DNhzv3zhzNfDhz^rHhA0DLhAiPPh.WfBh.)rFh-9DJh-rPNh-J-Ri4$", "n": [ { "c": 2, "d": "Sequential two-digit decimal lookup table", "i": "metadata/file/string/charset::sequential-decimal-lookup-table", "o": 4337792, "z": 66, "cf": 0.949999988079071 } ], "ln": 4337744 }, { "b": "\u003cn!JD]z[^?1ow]i6AGfObMPB%gYYYtl\u0026/%Zq#($0f!LdjfAq7M%nz##00000k%^}bmmG^rnLhSHo?[FXqbQs(rArg6sZ2lyv}od.xj#0]yIW\u003c9z/xYpB98LFCx!yVfFLssg=mfIi5@Gx0000000000zdN^fvp%cK0rr910o9OO0SSi2006\u0026N[}Fv?1onA400000F:YW]ts09T)GrH\u00262lj-700000000000uV6\u003ewBhu])u::8].y-o15x:l4GDFe00000", "n": [ { "c": 2, "d": "Hardcoded standard base64 alphabet", "i": "micro-behaviors/data/encode/base64::alphabet-standard", "o": 4338672, "z": 64, "cf": 0.5 } ], "ln": 4338624 }, { "b": "0b.^P0bhBP0at\u003ez0bhBy09/H708rH]06*I:0d\u003egJ05sJO03?KA000000a\u003cB1k}\u003e2GgC*%Eh-J*avQ\u0026}Wx7D050jS1e0g0P+03?KA0g:8\u00260fd3V0ds?E0b.=p09YB607)j\u003e05\u003c(T03Isx096720h6t)03.Ez0000007N1?06*I:0672V05sJO04O3H03?KA0384t0000000", "n": [ { "c": 2, "d": "Lowercase hexadecimal alphabet string", "i": "metadata/file/string/charset::lowercase-hex-alphabet", "o": 4351855, "z": 17, "cf": 0.20000000298023224 } ], "ln": 4351807 }, { "b": "FpJf2FpJf2FpJf2FpJf2FpJf2FpJf2FpJf2FpJf2{Y7o]MJd0=ecb.Jcia2CfFLssg=mfIi5$zRv}od.4?xfY4?xfY4?xfY4?xfY0@@x50rr911POV92lj@d009c61o!#m@%e]r3\u0026ZRA0rJx61o!#m2NH?C3\u003eiWS@%e]r3\u0026ZRA4IeQt%nSc0%nSc0%nSc0%nS900rJx6", "n": [ { "c": 2, "d": "Lowercase hexadecimal alphabet string", "i": "metadata/file/string/charset::lowercase-hex-alphabet", "o": 4360688, "z": 16, "cf": 0.20000000298023224 } ], "ln": 4360640 }, { "b": "=J0}BmGAF?WG3pceDt+JO=w-\u003cx-Ohlso5s3h#\u0026{U0001H0001H0001H0001HfFLssg=mfIi5%n\u003elQTvjfFLssg=mfIi5$zRv}od.4?xfY4?xfY4?xfY4?xfYFD7f1FD7f1FD7f1FD7f1]8F:\u003cWe*mc!=kWIeDt+JO=w-\u003cyYKIoso5s3h#\u0026{U0dU610dU610dU610dU610dU610dU610dU610dU61", "n": [ { "c": 2, "d": "Lowercase hexadecimal alphabet string", "i": "metadata/file/string/charset::lowercase-hex-alphabet", "o": 4361696, "z": 32, "cf": 0.20000000298023224 } ], "ln": 4361648 }, { "b": "By/GgvqE5$A=M8sazCZoAar{1ggb9AB.2+CdlnO)xM53fwft=dBrCHiv%8!(BzbxfaA?spB7]MgaA7\u003cmp^XbHg9yaCwPF#iz/^anvrMi8rC(IXz!9A4B9hCvz/P}1Aa9=#zGGM6B7Gznvrb{4Bz(7uwmYs\u003ey\u003cvdvwPI%8wfrpwBywV{ay/7@v@0H[", "n": [ { "c": 2, "d": "Contains common English function words", "i": "metadata/file/profile/language::lang-english", "o": 5322460, "z": 4, "cf": 0.800000011920929 } ], "ln": 5322412 }, { "b": "jS(C6wh(m%asnATjuT/vCW$z#w*).5B7]J8axqxgazC)twnc9[vR/Q^ayYQsBzbkdvq{g4x\u003e7N[x(v\u003e?B-Rnmxcphwp-%E[ay]hcvpB4:wftubaARpdayPkdy?Wx/BzkVh0b=jZwGUYdaARKuaz+$lxcp]aasFZlk#Hu8efDt\u003cp/pp*mjx=gc[nc", "n": [ { "c": 2, "d": "Contains common English function words", "i": "metadata/file/profile/language::lang-english", "o": 5324446, "z": 3, "cf": 0.800000011920929 } ], "ln": 5324398 }, { "b": "z/P@hwftG5AV^+tk{g2MByO##zF5@*vruQ5A=91fz/fV9x(m#mvqWi4By/qiBzb98azC)tzF%RtB9hCvz/P@hwftG5AV^+tk{g2MByO##zF5@[z/PSmAa9l/aAImywGUMev}xjZwN(]$zxItpk{g2MByO##zF5@-zGGDgzEEu7wPz*fAV=}RAa9\u003cg", "n": [ { "c": 2, "d": "Contains common English function words", "i": "metadata/file/profile/language::lang-english", "o": 5328456, "z": 4, "cf": 0.800000011920929 } ], "ln": 5328408 }, { "b": "u[-Aa27%:1fC\u003ei5Gty}H7Z{+7wYy-Is6Y$0rFP{p9pCR\u0026H}EB6CG5rEdDqlo@V3d\u003c]q^[*@hIi09i}!GYVj1hjcJ2wiPJ.OA1s.\u003eH]*(!r#pb+VwmTVL]c=X5O\u0026k*H7OhrV4-\u003ca7{O/cyz:sh5O\u0026k*H7OhrV4-\u003ca7{O/cyz:sh5O\u0026k*H7OhrV4-\u003ca7{O/cyz:sh5O\u0026k*H7OhrV4-\u003ca7{O/cyz:sh5O\u0026k*H7OhrU)b-JB]RJr^1hqs4\u003e{l\u003c0hecF033X^c\u003cD4z/.tG.-rNk58VUy{008={2rkr[ZY%\u003c.gnayx1@Le+1\u0026=KSfU*5#05\u003c(TCMF0dGaxU*7Y}$h0=rq\u003c0#P1opHBfK[bTk\u003ccOJmnOD5VZ0%\u003c${06\u0026:GP.OM?4b(Ei1@E)X003Rup]}$i4XO.)0@%URp@R861RA4-?}3]j091VLSXfLp0g17k6)U@?60MxA@\u0026%yQgY{L?S\u0026A8gr004TvRA0!\u003cpirQsoeA!NAILx2*:\u003ed4GDFfxAnyO0S.j*jILL60j4K#0nuctwO)b!Gf6FC09TfH{+(h\u003cf9lk#Gfo\u003eFIsqy#4$B)4.wL:I=n3gozEDeCaObPAy:x70vm)%J]8Mvrb(\u003cUF^8V^nn0{YyJYWwNCHVY]hC71VMJm7c326!H0iM*\u0026tVb.XVs}^TU-skw^2XuW3J{IhFK/@{6p?:U2JEQy7E/z=4+dhB3?ah@0J{ToMT]-pCq)mFI\u00266\u0026eKn]nc3EvWAXeUFI4a9S?IrfdbFd5!z0g)9i!=v?g", "n": [ { "c": 1, "d": "1KB region has high entropy", "i": "metadata/file/metrics::peak-region-cipher-entropy", "o": 6035456, "z": 512, "cf": 0.8500000238418579 } ], "ln": 6035424 }, { "b": "wO(vewNxd*vp%cKuTEw?x(\u003ctZuVZacuTX4/CXIm1uTWzZA=.p*vpJ!UB8}s*vrb\u003cmA:-\u0026@z/5\u0026\u003cB.gRXvrlydx(n380afeRwQ4{h0afeRz!PhUvSM9?A:@+.uT)IXy\u0026r!-uT)UYyYE*LxK\u003e*$0afkLz!0M\u0026xjVgbx(dzYuT)[\u003cv@2B:wPS3dzdN6(B7F\u0026*zG2O.v@c78wDl7Ey\u0026sxabU?c5k#6^ooAnBfy\u0026sxawnc5:uT[1}0afnJB7ocazE)s1CMq8Yy**\u003c+ASxDSy?4p1B7CtUwnC*$A=k%#uU0$\u003eAaJ[!uU0$]D2iK*woz\u0026D0afqZwN/(-uUaE[v%hz-uUaE@Bo2VWv@c78wDl7Hv@uy8bU?c5k#6^ooAnBiw]8QhxAhyKy\u0026r*00aftRAaJ]jl{TZLnLSRYsx5i]0aftRA++UZw=", "n": [ { "c": 3, "d": "Address to symbol lookup", "i": "micro-behaviors/dylib/lookup::dladdr", "o": 6362723, "z": 6, "cf": 0.8500000238418579 }, { "c": 2, "d": "arc4random function", "i": "micro-behaviors/os/random/crypto::arc4random", "o": 6362564, "z": 10, "cf": 0.800000011920929 } ], "ln": 6362516 }, { "b": "z+$mUBy]Diz2^{wD2[7szbaIYx)a5{lVl\u003c=wPz(YA=M8sp\u00266MZw]zZbrbUPwyYE*vD2[7szbaIYx)a5{lVM:DBy!x?v@2T$mrSlWBv7aZw[t#.uShk\u003eBy/q:vrujbwNv/BwNPW(q/ueYwPQv:wO#P^z/P}1uShk\u003eBy/q:vrujbwNv/BwNPW(ra{q-vpPvBq*ACawO\u003egJBzk]fuQOQHv@Dm5wN//ZuShk\u003eBy/q:vrujbwNv[)y\u0026131vru5XuShk\u003eBy/q:vrujbwNv]2z!0L.uShk\u003eBy/q:vrujbwNv]9Byxm\u003euSc", "n": [ { "c": 3, "d": "CreateSocket function", "i": "micro-behaviors/communications/socket/tcp::create-socket", "o": 6401407, "z": 12, "cf": 0.5 } ], "ln": 6401343 }, { "b": "h#)r8v@=couUr}(uVQr$A=+/8vrbZm0afXPA+d1kyh4=%v@Dj6x(4u/h#)r8v@=couUTp%uU%j[v}Yje0afXPA+d1kzddJ@xKr.0uVoH}wINRfvru0)uU0O!vp9I+wNPW(uUjr", "n": [ { "c": 1, "d": "JIT compilation runtime ref", "i": "objectives/anti-static/obfuscation/reflection/class::jit-runtime-ref-1", "o": 6406001, "z": 11, "cf": 0.8500000238418579 } ], "ln": 6405969 } ], "depth": 1, "facts": { "exp": [ [ "CompressionNative_Deflate" ], [ "CompressionNative_DeflateEnd" ], [ "CompressionNative_DeflateInit2_" ], [ "CompressionNative_Inflate" ], [ "CompressionNative_InflateEnd" ], [ "CompressionNative_InflateInit2_" ], [ "CompressionNative_InflateReset2_" ], [ "DotNetRuntimeDebugHeader" ], [ "RhNewString" ], [ "RhpAssignRefESI" ], [ "RhpByRefAssignRef" ], [ "RhpCallCatchFunclet" ], [ "RhpCallFilterFunclet" ], [ "RhpCallFinallyFunclet" ], [ "RhpCallPropagateExceptionCallback" ], [ "RhpCheckedAssignRefESI" ], [ "RhpCheckedLockCmpXchg" ], [ "RhpCheckedXchg" ], [ "RhpGcPoll" ], [ "RhpGcPollRare" ], [ "RhpGcProbeHijack" ], [ "RhpInitialInterfaceDispatch" ], [ "RhpInterfaceDispatch1" ], [ "RhpInterfaceDispatch16" ], [ "RhpInterfaceDispatch2" ], [ "RhpInterfaceDispatch32" ], [ "RhpInterfaceDispatch4" ], [ "RhpInterfaceDispatch64" ], [ "RhpInterfaceDispatch8" ], [ "RhpInterfaceDispatchSlow" ], [ "RhpNewArrayFast" ], [ "RhpNewFast" ], [ "RhpNewFinalizable" ], [ "RhpNewObject" ], [ "RhpNewPtrArrayFast" ], [ "RhpNewVariableSizeObject" ], [ "RhpPInvoke" ], [ "RhpPInvokeReturn" ], [ "RhpRethrow" ], [ "RhpStackProbe" ], [ "RhpThrowEx" ], [ "RhpThrowHwEx" ], [ "RhpUniversalTransition" ], [ "RhpUniversalTransition_DebugStepTailCall" ], [ "RhpWaitForGC" ], [ "SystemNative_Abort" ], [ "SystemNative_Access" ], [ "SystemNative_Calloc" ], [ "SystemNative_CanGetHiddenFlag" ], [ "SystemNative_Close" ], [ "SystemNative_CloseDir" ], [ "SystemNative_CloseSocketEventPort" ], [ "SystemNative_ConfigureTerminalForChildProcess" ], [ "SystemNative_ConvertErrorPalToPlatform" ], [ "SystemNative_ConvertErrorPlatformToPal" ], [ "SystemNative_CreateSocketEventBuffer" ], [ "SystemNative_CreateSocketEventPort" ], [ "SystemNative_CreateThread" ], [ "SystemNative_Disconnect" ], [ "SystemNative_FAllocate" ], [ "SystemNative_FLock" ], [ "SystemNative_FStat" ], [ "SystemNative_FSync" ], [ "SystemNative_FTruncate" ], [ "SystemNative_FcntlGetFD" ], [ "SystemNative_FcntlGetIsNonBlocking" ], [ "SystemNative_FcntlSetFD" ], [ "SystemNative_FcntlSetIsNonBlocking" ], [ "SystemNative_ForkAndExecProcess" ], [ "SystemNative_Free" ], [ "SystemNative_FreeEnviron" ], [ "SystemNative_FreeLibrary" ], [ "SystemNative_FreeSocketEventBuffer" ], [ "SystemNative_GetBytesAvailable" ], [ "SystemNative_GetCpuUtilization" ], [ "SystemNative_GetCryptographicallySecureRandomBytes" ], [ "SystemNative_GetCwd" ], [ "SystemNative_GetDomainSocketSizes" ], [ "SystemNative_GetEGid" ], [ "SystemNative_GetEUid" ], [ "SystemNative_GetEnv" ], [ "SystemNative_GetEnviron" ], [ "SystemNative_GetErrNo" ], [ "SystemNative_GetFileSystemType" ], [ "SystemNative_GetGroupList" ], [ "SystemNative_GetGroups" ], [ "SystemNative_GetHostName" ], [ "SystemNative_GetIPv4Address" ], [ "SystemNative_GetIPv6Address" ], [ "SystemNative_GetLoadLibraryError" ], [ "SystemNative_GetLowResolutionTimestamp" ], [ "SystemNative_GetMaximumAddressSize" ], [ "SystemNative_GetNonCryptographicallySecureRandomBytes" ], [ "SystemNative_GetPeerName" ], [ "SystemNative_GetPort" ], [ "SystemNative_GetProcAddress" ], [ "SystemNative_GetProcessPath" ], [ "SystemNative_GetPwNamR" ], [ "SystemNative_GetSid" ], [ "SystemNative_GetSockName" ], [ "SystemNative_GetSockOpt" ], [ "SystemNative_GetSocketAddressSizes" ], [ "SystemNative_GetSocketType" ], [ "SystemNative_GetSystemTimeAsTicks" ], [ "SystemNative_GetTimestamp" ], [ "SystemNative_HandleNonCanceledPosixSignal" ], [ "SystemNative_InitializeTerminalAndSignalHandling" ], [ "SystemNative_IsMemfdSupported" ], [ "SystemNative_Kill" ], [ "SystemNative_LChflagsCanSetHiddenFlag" ], [ "SystemNative_LSeek" ], [ "SystemNative_LStat" ], [ "SystemNative_LoadLibrary" ], [ "SystemNative_LogError" ], [ "SystemNative_LowLevelMonitor_Acquire" ], [ "SystemNative_LowLevelMonitor_Create" ], [ "SystemNative_LowLevelMonitor_Destroy" ], [ "SystemNative_LowLevelMonitor_Release" ], [ "SystemNative_LowLevelMonitor_Signal_Release" ], [ "SystemNative_LowLevelMonitor_TimedWait" ], [ "SystemNative_LowLevelMonitor_Wait" ], [ "SystemNative_MAdvise" ], [ "SystemNative_MMap" ], [ "SystemNative_MProtect" ], [ "SystemNative_MSync" ], [ "SystemNative_MUnmap" ], [ "SystemNative_Malloc" ], [ "SystemNative_MemfdCreate" ], [ "SystemNative_Open" ], [ "SystemNative_OpenDir" ], [ "SystemNative_PRead" ], [ "SystemNative_PWrite" ], [ "SystemNative_Pipe" ], [ "SystemNative_PlatformSupportsDualModeIPv4PacketInfo" ], [ "SystemNative_PosixFAdvise" ], [ "SystemNative_Read" ], [ "SystemNative_ReadDir" ], [ "SystemNative_ReadLink" ], [ "SystemNative_Receive" ], [ "SystemNative_ReceiveMessage" ], [ "SystemNative_RegisterForSigChld" ], [ "SystemNative_SchedGetCpu" ], [ "SystemNative_Send" ], [ "SystemNative_SendMessage" ], [ "SystemNative_SetDelayedSigChildConsoleConfigurationHandler" ], [ "SystemNative_SetErrNo" ], [ "SystemNative_SetIPv4MulticastOption" ], [ "SystemNative_SetLingerOption" ], [ "SystemNative_SetReceiveTimeout" ], [ "SystemNative_SetSendTimeout" ], [ "SystemNative_SetSockOpt" ], [ "SystemNative_ShmOpen" ], [ "SystemNative_ShmUnlink" ], [ "SystemNative_Shutdown" ], [ "SystemNative_Socket" ], [ "SystemNative_Stat" ], [ "SystemNative_StrErrorR" ], [ "SystemNative_SysConf" ], [ "SystemNative_TryChangeSocketEventRegistration" ], [ "SystemNative_Unlink" ], [ "SystemNative_WaitForSocketEvents" ], [ "SystemNative_WaitIdAnyExitedNoHangNoWait" ], [ "SystemNative_WaitPidExitedNoHang" ], [ "SystemNative_Write" ], [ "managed__Startup" ], [ "mh_execute_header" ], [ "pcre2_OP_lengths_8" ], [ "pcre2_auto_possessify_8" ], [ "pcre2_callout_end_delims_8" ], [ "pcre2_callout_start_delims_8" ], [ "pcre2_check_escape_8" ], [ "pcre2_ckd_smul" ], [ "pcre2_compile_class_nested_8" ], [ "pcre2_compile_class_not_nested_8" ], [ "pcre2_default_compile_context_8" ], [ "pcre2_default_match_context_8" ], [ "pcre2_default_tables_8" ], [ "pcre2_eclass_8" ], [ "pcre2_extuni_8" ], [ "pcre2_find_bracket_8" ], [ "pcre2_hspace_list_8" ], [ "pcre2_is_newline_8" ], [ "pcre2_jit_free_8" ], [ "pcre2_jit_get_size_8" ], [ "pcre2_jit_get_target_8" ], [ "pcre2_memctl_malloc_8" ], [ "pcre2_ord2utf_8" ], [ "pcre2_posix_class_maps8" ], [ "pcre2_script_run_8" ], [ "pcre2_strcmp_8" ], [ "pcre2_strcmp_c8_8" ], [ "pcre2_strcpy_c8_8" ], [ "pcre2_strlen_8" ], [ "pcre2_strncmp_8" ], [ "pcre2_strncmp_c8_8" ], [ "pcre2_study_8" ], [ "pcre2_ucd_boolprop_sets_8" ], [ "pcre2_ucd_caseless_sets_8" ], [ "pcre2_ucd_digit_sets_8" ], [ "pcre2_ucd_nocase_ranges_8" ], [ "pcre2_ucd_nocase_ranges_size_8" ], [ "pcre2_ucd_records_8" ], [ "pcre2_ucd_script_sets_8" ], [ "pcre2_ucd_stage1_8" ], [ "pcre2_ucd_stage2_8" ], [ "pcre2_ucd_turkish_dotted_i_caseset_8" ], [ "pcre2_ucp_gbtable_8" ], [ "pcre2_ucp_gentype_8" ], [ "pcre2_ucp_typerange_8" ], [ "pcre2_unicode_version_8" ], [ "pcre2_update_classbits_8" ], [ "pcre2_utf8_table1" ], [ "pcre2_utf8_table1_size" ], [ "pcre2_utf8_table2" ], [ "pcre2_utf8_table4" ], [ "pcre2_utt_8" ], [ "pcre2_utt_names_8" ], [ "pcre2_utt_size_8" ], [ "pcre2_valid_utf_8" ], [ "pcre2_vspace_list_8" ], [ "pcre2_was_newline_8" ], [ "pcre2_xclass_8" ], [ "main" ], [ "pcre2_code_free_8" ], [ "pcre2_compile_8" ], [ "pcre2_config_8" ], [ "pcre2_get_error_message_8" ], [ "pcre2_get_ovector_pointer_8" ], [ "pcre2_get_startchar_8" ], [ "pcre2_jit_compile_8" ], [ "pcre2_jit_match_8" ], [ "pcre2_match_8" ], [ "pcre2_match_data_create_from_pattern_8" ], [ "pcre2_match_data_free_8" ], [ "pcre2_pattern_info_8" ], [ "scout_entry" ] ], "sec": [ [ "__TEXT,__text", 3040, 1036800, 6.54, "r-x" ], [ "__TEXT,__managedcode", 1039840, 2604954, 6.47, "r-x" ], [ "__TEXT,__unbox", 3644796, 6825, 4.35, "r-x" ], [ "__TEXT,__stubs", 3651622, 1206, 3.91, "r-x" ], [ "__TEXT,__init_offsets", 3652828, 24, 3.03, "r-x" ], [ "__TEXT,__cstring", 3652852, 10036, 5.38, "r-x" ], [ "__TEXT,__const", 3662976, 1795728, 6.07, "r-x" ], [ "__TEXT,__objc_methname", 5458704, 35, 4.08, "r-x" ], [ "__TEXT,__unwind_info", 5458740, 94416, 6.29, "r-x" ], [ "__TEXT,__eh_frame", 5553160, 442948, 5.34, "r-x" ], [ "__DATA_CONST,__got", 5996544, 1880, 2.69, "rw-" ], [ "__DATA_CONST,__const", 5998432, 2176, 3.16, "rw-" ], [ "__DATA_CONST,__objc_imageinfo", 6000608, 8, 0.54, "rw-" ], [ "__DATA,__objc_selrefs", 6000640, 24, 2.06, "rw-" ], [ "__DATA,__objc_classrefs", 6000664, 8, 1.06, "rw-" ], [ "__DATA,.dotnet_eh_table", 6000672, 322311, 7.61, "rw-" ], [ "__DATA,__data", 6322992, 37872, 4.47, "rw-" ], [ "__DATA,__modules", 6360864, 8, 2.0, "rw-" ], [ "__DATA,__thread_vars", 6360872, 192, 1.02, "rw-" ], [ "__DATA,__thread_bss", 0, 272, 2.32, "rw-" ], [ "__DATA,hydrated", 0, 1330952, 6.57, "rw-" ], [ "__DATA,__bss", 0, 46892, 6.28, "rw-" ], [ "__DATA,__common", 0, 34137, 6.25, "rw-" ] ], "metrics": { "file": { "size": 6408992.0, "entropy": 6.7, "size_bytes": 6408992.0 }, "macho": { "pagezero_size": 4294967296.0, "has_main_command": 1.0, "wx_segment_count": 0.0, "has_chained_fixups": 1.0, "load_command_count": 22.0, "function_starts_count": 14572.0, "has_data_const_segment": 1.0 }, "binary": { "is_pie": 1.0, "has_overlay": 1.0, "is_stripped": 0.0, "code_entropy": 6.27, "data_entropy": 6.69, "overlay_size": 47928.0, "string_count": 7824.0, "overlay_ratio": 0.01, "overall_entropy": 6.7, "overlay_entropy": 5.79, "entropy_variance": 4.26, "avg_string_length": 23.46, "max_string_length": 510.0, "peak_region_bytes": 239616.0, "code_to_data_ratio": 0.77, "peak_region_entropy": 7.74, "string_length_stddev": 27.52, "largest_section_ratio": 0.41, "sentence_string_count": 290.0, "sentence_string_ratio": 0.04, "high_entropy_string_count": 5.0 }, "exports": { "count": 236.0 }, "sections": { "count": 23.0, "code_size": 5992972.0, "entropy_max": 7.61, "entropy_mean": 4.24, "name_entropy": 4.25, "writable_count": 13.0, "executable_count": 10.0, "nonstandard_count": 9.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 6.0 } } }, "id": 11, "mol": "H(Ds)", "path": "Scout.osx-x64.0.6.0.nupkg!!tools/any/osx-x64/scout-real", "pid": 0, "risk": 2, "sha": "98bd1bc7ebf00b06c4c38e4e98da73a4a23f585a904e74d45d953965ffb16d79", "size": 6408992, "traits": [ { "id": "micro-behaviors/communications/socket/tcp::create-socket", "crit": 3, "desc": "CreateSocket function", "spans": [ [ 523790, 12 ], [ 523902, 12 ], [ 6401407, 12 ], [ 6401445, 12 ] ] }, { "id": "micro-behaviors/dylib/lookup::dladdr", "conf": 0.8500000238418579, "crit": 3, "desc": "Address to symbol lookup", "spans": [ [ 6362723, 6 ] ] } ], "type": "macho" }, { "id": 12, "sha": "dd31f0414fcb58afedeab0a822dd713bf8ce9a99ca0f6434323abfe5f4722354", "path": "Scout.osx-x64@0.6.0.registry.json", "size": 837, "type": "registry", "depth": 1 } ], "omitted_files": 1, "rev": "3e1ed", "v": "8" } }