{ "llm": { "conf": 0.77668667, "grade": "benign", "model": "Qwen/Qwen3.6-27B", "review": false, "outcome": "benign", "interpretation": "Legitimate .NET library package" }, "ml": { "v": "7", "eng": "2.2.0-rc.1", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.14809714, "rte": "az", "prob": 0.14809714 } ], "prob": 0.6809809, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.680980920791626, "type": "nupkg" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.680980920791626, "type": "xml" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.00004699826240539551, "type": "xml" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.000011612971320573706, "type": "markdown" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.000014692544937133789, "type": "png" }, { "id": 5, "lvl": -1, "conf": 0, "prob": 0.680980920791626, "type": "pe" }, { "id": 6, "lvl": -1, "conf": 0, "prob": 0.000011652708053588867, "type": "xml" }, { "id": 7, "lvl": -1, "conf": 0, "prob": 0.680980920791626, "type": "pe" }, { "id": 8, "lvl": -1, "conf": 0, "prob": 0.000011652708053588867, "type": "xml" }, { "id": 9, "lvl": -1, "conf": 0, "prob": 0.680980920791626, "type": "pe" }, { "id": 10, "lvl": -1, "conf": 0, "prob": 0.000011652708053588867, "type": "xml" }, { "id": 11, "lvl": -1, "conf": 0, "prob": 0.680980920791626, "type": "xml" }, { "id": 12, "lvl": -1, "conf": 0, "prob": 0.680980920791626, "type": "xml" }, { "id": 13, "lvl": -1, "conf": 0, "prob": 0.00001085797975974856, "type": "registry" } ], "version": "v18.18", "analyzed_at": "2026-06-28T11:14:45Z" }, "path": "Cratis.Arc.Swagger.20.48.0.nupkg", "raw": { "files": [ { "id": 0, "mol": "O(Al)H₂(CmDb)", "sha": "2c9fc7be0e450bb5d2d5b2dfeba9c431c0d446a3ba55e7056eb2501fbf907c19", "path": "Cratis.Arc.Swagger.20.48.0.nupkg", "risk": 4, "size": 128733, "type": "nupkg", "facts": { "metrics": { "file": { "size": 128733.0, "entropy": 7.99, "size_bytes": 128733.0 }, "binary": { "overall_entropy": 7.99, "peak_region_bytes": 122880.0, "peak_region_entropy": 7.85 }, "archive": { "file_count": 16.0, "member_count": 16.0, "script_count": 0.0, "zip_bomb_ratio": 7.63, "directory_count": 0.0, "executable_count": 3.0, "extra_field_size": 0.0, "noise_file_count": 0.0, "total_compressed": 126561.0, "compression.ratio": 0.48, "hidden_file_count": 2.0, "total_uncompressed": 261741.0, "crc_collision_count": 2.0, "entry_comment_count": 0.0, "max_filename_length": 81.0, "rtlo_filename_count": 0.0, "format.regular_count": 16.0, "nested_archive_count": 0.0, "path_traversal_count": 0.0, "symlink_escape_count": 0.0, "security.setgid_count": 0.0, "security.setuid_count": 0.0, "security.sticky_count": 0.0, "double_extension_count": 0.0, "duplicate_member_count": 0.0, "security.symlink_count": 0.0, "unicode_filename_count": 0.0, "homoglyph_filename_count": 0.0, "security.encrypted_count": 0.0, "timing.mtime_unique_count": 8.0, "timing.mtime_unique_ratio": 0.5, "misplaced_executable_count": 3.0, "timing.mtime_dominant_count": 4.0, "timing.mtime_spread_seconds": 25162.0, "timing.sentinel_mtime_count": 0.0, "security.world_writable_count": 0.0, "timing.mtime_dominant_fraction": 0.25, "compression.method_counts.stored": 1.0, "compression.method_counts.deflate": 15.0 } } }, "ident": { "name": { "value": "Cratis.Arc.Swagger", "source": "nupkg.title", "verified": false }, "urls": [ { "url": "https://github.com/cratis/arc", "kind": "homepage", "source": "nupkg.project_url" }, { "url": "https://github.com/cratis/arc", "kind": "repository", "source": "nupkg.repository_url" } ], "trust": "unsigned", "authors": [ { "name": "all contributors", "role": "author", "source": "nupkg.authors" } ], "version": { "value": "20.48.0", "source": "nupkg.version", "verified": false }, "identifier": { "value": "Cratis.Arc.Swagger", "source": "nupkg.id", "verified": false } }, "traits": [ { "id": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "conf": 1.0, "crit": 3, "desc": "JSON polymorphism runtime marker", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "from": [ { "file": 5 } ] }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "from": [ { "file": 5 } ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "from": [ { "file": 5 } ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/data/db/linq::linq-queries", "conf": 0.699999988079071, "crit": 3, "desc": "LINQ query operations", "from": [ { "file": 5 } ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "from": [ { "file": 5 }, { "file": 7 }, { "file": 9 } ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "from": [ { "file": 5 } ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/communications/http/server/managed::http-response-get", "conf": 1.0, "crit": 3, "desc": "Access to ASP.NET Response object", "from": [ { "file": 5 } ] } ] }, { "id": 1, "sha": "98cdc79bcf396b905e4ffde6306c963ccd0f0841b79e0a53b6be39fb491d7303", "path": "Cratis.Arc.Swagger.20.48.0.nupkg!!_rels/.rels", "size": 508, "type": "xml", "depth": 1 }, { "ctx": [ { "b": "[4ls%kx}3YaA?spB7]MgjT8QkfD}SJzEWP}x(mMDb6w0teJs}sj]", "n": [ { "c": 2, "d": "NuGet nuspec manifest file", "i": "metadata/build/manifest::nuspec-file", "o": 0, "z": 25, "cf": 0.9800000190734863 } ], "ln": 1, "addr": 0 }, { "b": "jAa.syHH\u003c!aB4:tzGv@+xMOuniXJdcv}YB\u003cvrj5rx\u003e8g4B8LVje[n*pfk$ufyHH\u003c\u0026zF7QTfFLvpfF$I3B-RIkv\u003eJ1EwfKh", "ln": 2, "addr": 42 }, { "b": "arS^-wPRu\u003evrt{w", "ln": 3, "addr": 118 }, { "b": "arR^Hjy\u00262Av@=p5BzkVhk2tV$yHH\u003c!avG^Zv@=p5BzkVhjtgkRB7ol8Acb/jzAX", "ln": 12, "addr": 455 }, { "b": "arR^Hjy-qGD2^RixMMB9z/x#xx\u003eIa3avyfTBzk!UfjO{tD2^RixMMA", "ln": 13, "addr": 506 }, { "b": "arR^HjAt1Lz/YSmz/QaCBA}?pjTaJMBrR\u0026IA+)(.xMOunB2\u003e%cxk8E3BZ=$kz/4dqA::67B1Z%xv\u003ci48A:-\u0026}xGWLWwOc0pxK$Q.B1.xsx(kaqv@Dj3x((GZfLa/Ki5te8i5ifygb*%Ci5rJNhdny5g*%@MhF3CWwh(CTgb?6Ca%nK5", "n": [ { "c": 2, "d": "NuGet package declares repository", "i": "metadata/package/files/nuget::nuspec-repository", "o": 554, "z": 91, "cf": 0.8999999761581421 } ], "ln": 14, "addr": 550 }, { "b": "arR^Hjy\u00262xwO#3\u0026zEWx(B3o", "n": [ { "c": 2, "d": "NuGet package declares dependencies", "i": "metadata/package/files/nuget::nuspec-dependencies", "o": 695, "z": 852, "cf": 0.8999999761581421 } ], "ln": 15, "addr": 691 }, { "b": "arR^HarS^VA=l8taAR4jxjVfOA:-/@Cw?IqjTa=PBtkE4fD@W", "ln": 16, "addr": 710 }, { "b": "arR^HarR^Hjy\u00262xwO#3\u0026zEW@mx\u003efvJlVMQSx(+))A:{poC4CYnx(v(La#g\u00268g=N9wa%pDwv@co#wJ.k7B.LV5ej1eZy\u003cytrA=SAEffP", "ln": 17, "addr": 750 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 4609.0, "entropy": 4.95, "size_bytes": 4609.0 }, "binary": { "overall_entropy": 4.95, "peak_region_bytes": 4609.0, "peak_region_entropy": 5.1 } } }, "id": 2, "path": "Cratis.Arc.Swagger.20.48.0.nupkg!!Cratis.Arc.Swagger.nuspec", "risk": 1, "sha": "14cd56fb004697446dcf74fc6af1937426fafe91238566e71cc2e60da229e0b1", "size": 4609, "traits": [ { "id": "metadata/package/files/nuget::nuspec-dependencies", "conf": 0.8999999761581421, "crit": 2, "desc": "NuGet package declares dependencies", "spans": [ [ 695, 852 ] ] }, { "id": "metadata/build/manifest::nuspec-file", "conf": 0.9800000190734863, "crit": 2, "desc": "NuGet nuspec manifest file", "spans": [ [ 0, 25 ] ] }, { "id": "metadata/package/files/nuget::nuspec-repository", "conf": 0.8999999761581421, "crit": 2, "desc": "NuGet package declares repository", "spans": [ [ 554, 91 ] ] } ], "type": "xml" }, { "ctx": [ { "b": "fe4J[Cp)=LzeabAv@DiqAa9l(vp%d8kX1?yBzk!Hvrb\u003cb3jn15avpi+y?dO]3r[VTe(1\u0026mavpi+y?c*1xMOunB2\u003e%cxk8E3BZ=$kz/4dqA::67B1Z%xv\u003eRn2BzkVhB1.-QA+/o6z*cmQwn=NcwPPIkB.LV5e{RqIfjFv2xjSYpC4Smfc$)ZAAc15[fk20vxMW=pv@Diqv@=11x(+}oA:{+hv@#B6zGvEPz/PS9y\u0026sJsfjY0yzE)]wvS=y3wg\u0026dAy:/Y}aZmL", "ln": 228, "col": 85, "line": 6 }, { "b": "v}W0bzY\u0026Iix(4r]zF784z/fSgB97#hBrC1hAbok#vruj4zGu}fvrl0\u003caA8cuBzbkdv@Dl{wPh:jayX[}x(mD7lS3-We^+f(aA7\u003e7wPz\u0026mwQ5rdzGxJgzGu}jz/M$hx\u003ey%*A+fcgazbU5zdN{fA+/.svqYP#x(+zaB.LVlaA8cuBz(avz!paTq=28wmn$x%z/PzwawV(^aA7\u003cmBzbkdBAg/7BAnNyw/%xWv\u003c2C[B0bgraARpd3sX3\u0026wm]Q]xcpU{BA.qczxK4mwGUC\u003cv@2S", "ln": 839, "col": 44, "line": 16 }, { "b": "avg3TaAhvtC4\u003eF#B0a)lBz(8lefFChy\u00260V[asX\u003cqA=lhFm}DNHA::6dAW\u0026KYBzb98azkn6wPzj3wPF$[D2Ns[v@=p5Bp8I@wmV(}z/M$vwN/T\u003ezFsAdwftr3Bzkt}v@#=mzddJ@xLzu%aARpday/CaBy/GbvixG2aA}HcBrCpsay/tcB7]e@A+e=7", "ln": 1078, "col": 47, "line": 18 }, { "b": "lVl\u003c:A+P09BzkS93jovpaBd)FaA}miBrCWzazM4oA3e\u003ejBz\u0026phB.LV5x(mMaBzbxfaAz4jz/YSmz/QaCvqYP#AbP/sx\u003c$[7ay/tcBAh88B-.tnxdLfAy?m3@wGV28w[u09Bz\u0026pav@DmbA+P09BzkS9t{}rUl#MNTzdNQbvruj4zzbHrzGG]kvS=^b", "ln": 1680, "col": 4, "line": 31 }, { "b": "x(!0gwPFg=ra]?=w]zH4z*b]kxcpS6wGU@jwPzv4B.L]hBy/IoBz\u0026pCz/PRoCwhejaARphB0bHmAbP/iBz(hBe^.}nax{D[mn$x?d{TMpBAzFyiXJc%z//(dBs}AAv@=Hez!s8zv@DiqwO%8xB1X%{3mWf5ph:VOatC=8t{%xdBz#pZfe4iYwmYH%", "ln": 1854, "col": 12, "line": 35 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 3459, "entropy": 4.97 }, "text": { "lines": 75, "top_char": 116, "max_ws_run": 1, "digit_ratio": 0, "space_count": 374, "char_entropy": 4.97, "unique_chars": 78, "top_char_null": 0, "top_char_ratio": 0.07, "avg_line_length": 45.12, "max_line_length": 198, "non_ascii_ratio": 0, "empty_line_ratio": 0.31, "last_line_length": 3, "long_token_count": 6, "whitespace_ratio": 0.13, "line_length_stddev": 54.68 }, "binary": { "peak_region_bytes": 3072, "peak_region_entropy": 4.98 } } }, "id": 3, "mol": "H(Cm)", "path": "Cratis.Arc.Swagger.20.48.0.nupkg!!README.md", "pid": 0, "risk": 1, "sha": "07795aebfb7c6e237682c3a1d079e165be89a88dd745721f7a232b22a5fe8503", "size": 3459, "traits": [ { "id": "metadata/lang/natural::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"", "spans": [ [ 887, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-2", "conf": 0.8, "crit": 1, "desc": "English function-word token \"and\"", "spans": [ [ 959, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-3", "conf": 0.8, "crit": 1, "desc": "English function-word token \"that\"", "spans": [ [ 1126, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "spans": [ [ 934, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-6", "conf": 0.8, "crit": 1, "desc": "English function-word token \"with\"", "spans": [ [ 1902, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-7", "conf": 0.8, "crit": 1, "desc": "English function-word token \"this\"", "spans": [ [ 1728, 0 ] ] }, { "id": "micro-behaviors/communications/http/url/forge::public-code-forge-url", "conf": 0.9, "crit": 3, "desc": "References a public code-forge URL", "spans": [ [ 292, 19 ] ] } ], "type": "markdown" }, { "id": 4, "sha": "ffb2d8025ae6d20176b7b148bb6167664727fbc091de4536e3b21bfa8d066ce3", "path": "Cratis.Arc.Swagger.20.48.0.nupkg!!logo.png", "size": 8117, "type": "png", "depth": 1 }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J+", "n": [ { "c": 3, "d": "HTTP fingerprinting evasion campaign", "i": "objectives/command-and-control/infrastructure/user-agent::http-fingerprinting-campaign", "o": 0, "z": 34, "cf": 0.8999999761581421 } ], "ln": 0 }, { "b": "00000000000000000000bcp?B00000nb@R\u00260SSx7H!vZFCWHHK0rr91000000000000", "n": [ { "c": 1, "d": "PE standard code/data section", "i": "metadata/binary/section/names::pe-code-data-standard-section", "o": 512, "z": 5, "cf": 0.8999999761581421 } ], "ln": 496 }, { "b": "015^O6Awaodba.43mV2Qlq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn", "n": [ { "c": 3, "d": "Recognized PE anti-analysis marker", "i": "objectives/anti-analysis/debugger-detect/combined-checks::evasion-aware-recognized-pe-marker", "o": 11656, "z": 4, "cf": 1.0 } ], "ln": 11640 }, { "b": "zFa6808)#FA==w7x([1*qfuC\u003cC%=H/zE)s1x(v(WwNPy%xAg[LwPA5!wNPy%xAg+vv@=Hez!s8zpJf(.l2ZJrrS", "n": [ { "c": 1, "d": "Regex component marker", "i": "objectives/persistence/login/scheduled-task/com::task-scheduler-builder-methods--rx-1", "o": 24624, "z": 21, "cf": 0.8999999761581421 } ], "ln": 24608 }, { "b": "vruj8e\u003cTI/e(M$5xj\u003e^@e[w^m08[e:By/qwlVl^SwN/*@z/fRGm}DNHA+P2onLA\u0026t", "n": [ { "c": 3, "d": "References Windows executable or script", "i": "objectives/execution/interpreter/script/shell::windows-executable-ref", "o": 24757, "z": 4, "cf": 0.6000000238418579 } ], "ln": 24741 }, { "b": "zE^r@v%HT-ygQ)%x(v\u003e?q*ACawO\u003c4$wOb:\u0026v@#B6zu94Avruj8e(Dm)y?m9#x(v\u003e?nKEAjy?m9#x(v\u003e?lJ", "n": [ { "c": 2, "d": "Benign high-entropy PE context", "i": "metadata/package/quality/false-positives::benign-high-entropy-pe-context", "o": 25544, "z": 17, "cf": 0.949999988079071 } ], "ln": 25528 }, { "b": "x(v\u003e?lVMQSx(+[0B8L{@q*ACawO\u003c50wQ5qHn][]*08)#Wx(mMJz/6D4A+PPkzu9QXB97#ge\u003c\u003cL[y?m9#", "n": [ { "c": 3, "d": "JSON polymorphism runtime marker", "i": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "o": 25878, "z": 16, "cf": 1.0 } ], "ln": 25862 }, { "b": "wPQpTA+c\u003c]BAzE4yJ:T%q*ACawO\u003c4[x(m[\u003cq*ACawO\u003c4!z!%l3v@#B6zGvB2wO#71x\u003e5+!lVl=", "n": [ { "c": 3, "d": "LINQ query operations", "i": "micro-behaviors/data/db/linq::linq-queries", "o": 26205, "z": 11, "cf": 0.699999988079071 } ], "ln": 26189 }, { "b": "Bzkk[BzkVhnmuyDy?mR!nMPFjq/ueYwPQpTzF\u003c2}BzkVhnmuyDy?mR!nL-/pwPz%5vR/QMB.bPsnmuyDy?mR!nL%RwA^pE", "n": [ { "c": 1, "d": "Regex component marker", "i": "objectives/persistence/login/scheduled-task/com::task-scheduler-builder-methods--rx-1", "o": 27091, "z": 27, "cf": 0.8999999761581421 } ], "ln": 27075 }, { "b": "wM98LwO\u003e\u003c%07g^nBzk!Go\u003ewA!x\u003e8h:q*ACawO\u003c4/x\u003c\u003eT(z/Z2mv@?SqA::67B1Qg9zEE5", "n": [ { "c": 3, "d": "Application has metrics/telemetry", "i": "metadata/package/quality/profile::has-metrics", "o": 28509, "z": 7, "cf": 0.8500000238418579 } ], "ln": 28493 }, { "b": "A@XNFvruj8e(V\u003e1v}xYYq*ACawO\u003c4$B-8qnzdLs\u003ezGGDgz/wS^A=#ebwPE\u0026ID2[7sz7X.ezGGPfwIct*ze:i9wPyZXA=#ebwPE", "n": [ { "c": 3, "d": "Packed binary marker", "i": "objectives/anti-static/obfuscation/eval/loader::packed-binary-marker", "o": 28584, "z": 30, "cf": 0.8500000238418579 } ], "ln": 28568 }, { "b": "07pycB.tu3zF8WZwmY/Zq*ACawO\u003c50wQ5qHn][]*e(3s}wPE\u0026:wPRoBB8$]fvR/:\u0026A@Y3Bv@2H=wM08K", "n": [ { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 28679, "z": 16, "cf": 0.8500000238418579 } ], "ln": 28663 }, { "b": "A@X^1wPzHdwN[+=AaK7\u003cxjVf(qE%]*z/fScA@Y0PwO%!Mx\u0026nI-AbPSnwPE\u0026sz/6u1zE=aMzGGDm", "n": [ { "c": 3, "d": "Access to ASP.NET Response object", "i": "micro-behaviors/communications/http/server/managed::http-response-get", "o": 28905, "z": 12, "cf": 1.0 } ], "ln": 28889 }, { "b": "AaK6iC%#$1wO#N6z/fQ@q*ACawO\u003c4#wN/\u003e6x([RMp?sV:x(!ufz/fQ@o\u003e!9Tz/Y\u0026eBs]\u003e2A86$^lVl#", "n": [ { "c": 2, "d": "System namespace reference", "i": "metadata/lang/compiler/managed::system-namespace", "o": 29333, "z": 15, "cf": 0.800000011920929 } ], "ln": 29317 }, { "b": "zGG/qA@X^fwNPazz!9A}nP5SYA:@W1Bz(hv06$ZGA+P09By!AWA+w%9A@XZwBvP[WwPzG{l2{P", "n": [ { "c": 3, "d": "Method interception capability", "i": "micro-behaviors/process/hook/interception::interceptor-comp", "o": 30194, "z": 11, "cf": 0.75 } ], "ln": 30178 }, { "b": "0a=cM001e+0aM1E0bRZM0at\u003eB0aV6L0b}{D0c[MX0b?\u003cC0aV6f4m*Fc0b.^E0bITD000l", "n": [ { "c": 1, "d": "Regex component marker", "i": "objectives/command-and-control/dropper/staging/encrypted::staged-payload-file-name--rx-1", "o": 32978, "z": 7, "cf": 0.8500000238418579 } ], "ln": 32962 }, { "b": "q*ACawO\u003c4$B-8qnzdLmvr+lq)x(v(Lf!+jle?![iefEr5y\u0026\u003c/uwJ:{xB-.Ujy+cY9BZ/f3v[QxUrbVL-", "n": [ { "c": 2, "d": "IPv4-like .NET assembly version", "i": "metadata/lang/compiler/managed::dotnet-ipv4-like-version", "o": 35419, "z": 16, "cf": 0.8500000238418579 } ], "ln": 35403 }, { "b": "0rrv5wO+{^B7CsK6-!pClVl{?A+Pf1BrA}\u003evruj8000Ad00+khfFk4ifAq8e0rs-be?![id/", "n": [ { "c": 2, "d": "Copyright notice", "i": "metadata/package/license::copyright-word", "o": 36101, "z": 9, "cf": 0.6000000238418579 } ], "ln": 36085 }, { "b": "00000000000000000000000000000000000000315c8Xg7YTL^00000000000000000", "n": [ { "c": 1, "d": "PE resource section", "i": "metadata/binary/section/names::pe-resource-section", "o": 36864, "z": 5, "cf": 0.8999999761581421 } ], "ln": 36848 }, { "b": "0000000000005k=gYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006Xn[brp!0rr910rr9", "n": [ { "c": 3, "d": "Recognized marker for timing checks", "i": "objectives/anti-analysis/timing/evasion::timing-anti-debug-recognized-marker", "o": 36958, "z": 15, "cf": 0.949999988079071 } ], "ln": 36942 }, { "b": "fAr{fvGn7Z002s=5Dz?ilJz38z2!IPve$fBC(QOtve$cAwDhYg003BcyYFnKaok)KzVBUPBo3s", "n": [ { "c": 2, "d": "PE CompanyName metadata field", "i": "metadata/package/versioning::pe-companyname-field", "o": 37178, "z": 11, "cf": 0.699999988079071 } ], "ln": 37162 }, { "b": "zVB!TA@Vgu002:]6954kmGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up002v^ASxIFBo31PA@W/", "n": [ { "c": 2, "d": "PE FileDescription metadata field", "i": "metadata/package/versioning::pe-filedescription-field", "o": 37246, "z": 15, "cf": 0.699999988079071 } ], "ln": 37230 }, { "b": "x8(GyASu7t001XM2MK(9mGvc5yYF2DrSDXhASydXx-J5Kzu6Up001.Ne=WN9e=WN9e=WN9002:]7xsEonDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE002v^ASxIFBo31PA@W/)k(+{9", "n": [ { "c": 3, "d": "Dotted-quad PE version metadata marker", "i": "objectives/command-and-control/infrastructure/ip::ipv4-version-metadata-marker", "o": 37326, "z": 11, "cf": 0.9399999976158142 }, { "c": 2, "d": "PE InternalName metadata field", "i": "metadata/package/versioning::pe-internalname-field", "o": 37374, "z": 12, "cf": 0.699999988079071 } ], "ln": 37310 }, { "b": "Bo31PA@Vgu003417xsEopxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE002v^ASxIFBo31PA@W/)", "n": [ { "c": 2, "d": "PE OriginalFilename metadata field", "i": "metadata/package/versioning::pe-originalfilename-field", "o": 37526, "z": 16, "cf": 0.699999988079071 } ], "ln": 37510 }, { "b": "wb{ACyYBCn002E*6954kpYLIozVBqFBPt[KBo25ove$cAwDhYg002v^ASxIFBo31PA@W/)k(+{", "n": [ { "c": 2, "d": "PE ProductName metadata field", "i": "metadata/package/versioning::pe-productname-field", "o": 37614, "z": 11, "cf": 0.699999988079071 } ], "ln": 37598 }, { "b": "x8(GyASu7t004PJf8#1MpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001.Ne=WN9e=WN9d/.m6wDh", "n": [ { "c": 2, "d": "PE version resource metadata", "i": "metadata/package/versioning::version-resource-metadata", "o": 37686, "z": 14, "cf": 0.8999999761581421 } ], "ln": 37670 }, { "b": "000000000000000000000h6q(3\u0026*ncl{gII000000000000000000000000000000000", "n": [ { "c": 2, "d": "PE .reloc section presence", "i": "metadata/binary/section/names::reloc-section-presence", "o": 37888, "z": 6, "cf": 0.8999999761581421 } ], "ln": 37872 } ], "depth": 1, "facts": { "imp": [ [ "mscoree", "CorDllMain" ] ], "sec": [ [ ".text", 512, 36352, 5.88, "r-x" ], [ ".rsrc", 36864, 1024, 3.19, "r--" ], [ ".reloc", 37888, 512, 0.08, "r--" ] ], "metrics": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "resource_count": 1.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 95043.0, "reloc_overhang_bytes": 500.0, "reloc_overhang_ratio": 0.98, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "version.identity_entropy": 4.01, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0, "version.identity_symbol_ratio": 0.08 }, "file": { "size": 38400.0, "entropy": 5.75, "size_bytes": 38400.0 }, "binary": { "is_pie": 1.0, "code_entropy": 5.88, "string_count": 581.0, "overall_entropy": 5.75, "entropy_variance": 5.61, "avg_string_length": 21.67, "max_string_length": 143.0, "peak_region_bytes": 1024.0, "code_to_data_ratio": 1.0, "peak_region_entropy": 6.16, "string_length_stddev": 14.42, "largest_section_ratio": 0.95, "sentence_string_count": 13.0, "sentence_string_ratio": 0.02, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 36352.0, "entropy_max": 5.88, "entropy_mean": 3.05, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } } }, "id": 5, "mol": "O(Al)H₂(CmDb)", "path": "Cratis.Arc.Swagger.20.48.0.nupkg!!lib/net10.0/Cratis.Arc.Swagger.dll", "risk": 4, "sha": "4d3f3708a90526703e554b81245fbfd82a6f17d43b8a379f8b861b30a3a08b9e", "size": 38400, "traits": [ { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "spans": [ [ 37686, 14 ] ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "spans": [ [ 24757, 4 ] ] }, { "id": "micro-behaviors/communications/http/server/managed::http-response-get", "conf": 1.0, "crit": 3, "desc": "Access to ASP.NET Response object", "spans": [ [ 28905, 12 ] ] }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "spans": [ [ 0, 26 ] ] }, { "id": "micro-behaviors/data/db/linq::linq-queries", "conf": 0.699999988079071, "crit": 3, "desc": "LINQ query operations", "spans": [ [ 26205, 11 ] ] }, { "id": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "conf": 1.0, "crit": 3, "desc": "JSON polymorphism runtime marker", "spans": [ [ 25878, 16 ] ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "spans": [ [ 37326, 11 ] ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "spans": [ [ 11656, 4 ] ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 36958, 15 ] ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "spans": [ [ 11656, 4 ] ] } ], "type": "pe" }, { "id": 6, "sha": "2359c5a60f421a773d47f67e4b4c20b9ccd62382fe54fb68c0c829bd477084d7", "path": "Cratis.Arc.Swagger.20.48.0.nupkg!!lib/net10.0/Cratis.Arc.Swagger.xml", "size": 7571, "type": "xml", "depth": 1 }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J+", "n": [ { "c": 3, "d": "HTTP fingerprinting evasion campaign", "i": "objectives/command-and-control/infrastructure/user-agent::http-fingerprinting-campaign", "o": 0, "z": 34, "cf": 0.8999999761581421 } ], "ln": 0 }, { "b": "00000000000000000000a/$.A00000nb@R\u00260SSx7H!vZFCWHHK0rr91000000000000", "n": [ { "c": 1, "d": "PE standard code/data section", "i": "metadata/binary/section/names::pe-code-data-standard-section", "o": 512, "z": 5, "cf": 0.8999999761581421 } ], "ln": 496 }, { "b": "015^O6Awaodba.43mV2Qlq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn", "n": [ { "c": 3, "d": "Recognized PE anti-analysis marker", "i": "objectives/anti-analysis/debugger-detect/combined-checks::evasion-aware-recognized-pe-marker", "o": 11656, "z": 4, "cf": 1.0 } ], "ln": 11640 }, { "b": "zFa6808)#FA==w7x([1*qfuC\u003cC%=H/zE)s1x(v(WwNPy%xAg[LwPA5!wNPy%xAg+vv@=Hez!s8zpJf(.l2ZJrrS", "n": [ { "c": 1, "d": "Regex component marker", "i": "objectives/persistence/login/scheduled-task/com::task-scheduler-builder-methods--rx-1", "o": 24624, "z": 21, "cf": 0.8999999761581421 } ], "ln": 24608 }, { "b": "vruj8e\u003cTI/e(M$5xj\u003e^@e[w^m08[e:By/qwlVl^SwN/*@z/fRGm}DNHA+P2onLA\u0026t", "n": [ { "c": 3, "d": "References Windows executable or script", "i": "objectives/execution/interpreter/script/shell::windows-executable-ref", "o": 24757, "z": 4, "cf": 0.6000000238418579 } ], "ln": 24741 }, { "b": "zE^r@v%HT-ygQ)%x(v\u003e?q*ACawO\u003c4$wOb:\u0026v@#B6zu94Avruj8e(Dm)y?m9#x(v\u003e?nKEAjy?m9#x(v\u003e?lJ", "n": [ { "c": 2, "d": "Benign high-entropy PE context", "i": "metadata/package/quality/false-positives::benign-high-entropy-pe-context", "o": 25544, "z": 17, "cf": 0.949999988079071 } ], "ln": 25528 }, { "b": "x(v\u003e?lVMQSx(+[0B8L{@q*ACawO\u003c50wQ5qHn][]*08)#Wx(mMJz/6D4A+PPkzu9QXB97#ge\u003c\u003cL[y?m9#", "n": [ { "c": 3, "d": "JSON polymorphism runtime marker", "i": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "o": 25878, "z": 16, "cf": 1.0 } ], "ln": 25862 }, { "b": "wPQpTA+c\u003c]BAzE4yJ:T%q*ACawO\u003c4[x(m[\u003cq*ACawO\u003c4!z!%l3v@#B6zGvB2wO#71x\u003e5+!lVl=", "n": [ { "c": 3, "d": "LINQ query operations", "i": "micro-behaviors/data/db/linq::linq-queries", "o": 26205, "z": 11, "cf": 0.699999988079071 } ], "ln": 26189 }, { "b": "Bzkk[BzkVhnmuyDy?mR!nMPFjq/ueYwPQpTzF\u003c2}BzkVhnmuyDy?mR!nL-/pwPz%5vR/QMB.bPsnmuyDy?mR!nL%RwA^pE", "n": [ { "c": 1, "d": "Regex component marker", "i": "objectives/persistence/login/scheduled-task/com::task-scheduler-builder-methods--rx-1", "o": 27091, "z": 27, "cf": 0.8999999761581421 } ], "ln": 27075 }, { "b": "wM98LwO\u003e\u003c%07g^nBzk!Go\u003ewA!x\u003e8h:q*ACawO\u003c4/x\u003c\u003eT(z/Z2mv@?SqA::67B1Qg9zEE5", "n": [ { "c": 3, "d": "Application has metrics/telemetry", "i": "metadata/package/quality/profile::has-metrics", "o": 28509, "z": 7, "cf": 0.8500000238418579 } ], "ln": 28493 }, { "b": "A@XNFvruj8e(V\u003e1v}xYYq*ACawO\u003c4$B-8qnzdLs\u003ezGGDgz/wS^A=#ebwPE\u0026ID2[7sz7X.ezGGPfwIct*ze:i9wPyZXA=#ebwPE", "n": [ { "c": 3, "d": "Packed binary marker", "i": "objectives/anti-static/obfuscation/eval/loader::packed-binary-marker", "o": 28584, "z": 30, "cf": 0.8500000238418579 } ], "ln": 28568 }, { "b": "07pycB.tu3zF8WZwmY/Zq*ACawO\u003c50wQ5qHn][]*e(3s}wPE\u0026:wPRoBB8$]fvR/:\u0026A@Y3Bv@2H=wM08K", "n": [ { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 28679, "z": 16, "cf": 0.8500000238418579 } ], "ln": 28663 }, { "b": "A@X^1wPzHdwN[+=AaK7\u003cxjVf(qE%]*z/fScA@Y0PwO%!Mx\u0026nI-AbPSnwPE\u0026sz/6u1zE=aMzGGDm", "n": [ { "c": 3, "d": "Access to ASP.NET Response object", "i": "micro-behaviors/communications/http/server/managed::http-response-get", "o": 28905, "z": 12, "cf": 1.0 } ], "ln": 28889 }, { "b": "AaK6iC%#$1wO#N6z/fQ@q*ACawO\u003c4#wN/\u003e6x([RMp?sV:x(!ufz/fQ@o\u003e!9Tz/Y\u0026eBs]\u003e2A86$^lVl#", "n": [ { "c": 2, "d": "System namespace reference", "i": "metadata/lang/compiler/managed::system-namespace", "o": 29333, "z": 15, "cf": 0.800000011920929 } ], "ln": 29317 }, { "b": "zGG/qA@X^fwNPazz!9A}nP5SYA:@W1Bz(hv06$ZGA+P09By!AWA+w%9A@XZwBvP[WwPzG{l2{P", "n": [ { "c": 3, "d": "Method interception capability", "i": "micro-behaviors/process/hook/interception::interceptor-comp", "o": 30194, "z": 11, "cf": 0.75 } ], "ln": 30178 }, { "b": "0a=cM001e+0aM1E0bRZM0at\u003eB0aV6L0b}{D0c[MX0b?\u003cC0aV6f4m*Fc0b.^E0bITD000l", "n": [ { "c": 1, "d": "Regex component marker", "i": "objectives/command-and-control/dropper/staging/encrypted::staged-payload-file-name--rx-1", "o": 32978, "z": 7, "cf": 0.8500000238418579 } ], "ln": 32962 }, { "b": "q*ACawO\u003c4$B-8qnzdLmvr+lq)x(v(Li4=)qfFk4gavyo/BAIRnj-j?NBAg/aefE=ivR/:*oj-xFz!\u0026[", "n": [ { "c": 2, "d": "IPv4-like .NET assembly version", "i": "metadata/lang/compiler/managed::dotnet-ipv4-like-version", "o": 35419, "z": 15, "cf": 0.8500000238418579 } ], "ln": 35403 }, { "b": "0rrv5wO+{^B7CsK6-!pClVl{?A+Pf1BrA}\u003evruj8000Ad00+khfFk4ifAq8e0rs-be?![id/", "n": [ { "c": 2, "d": "Copyright notice", "i": "metadata/package/license::copyright-word", "o": 36098, "z": 9, "cf": 0.6000000238418579 } ], "ln": 36082 }, { "b": "00000000000000000000000000000000000000315c8Xg7YTL^00000000000000000", "n": [ { "c": 1, "d": "PE resource section", "i": "metadata/binary/section/names::pe-resource-section", "o": 36864, "z": 5, "cf": 0.8999999761581421 } ], "ln": 36848 }, { "b": "0000000000005k=gYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006Xn[brp!0rr910rr9", "n": [ { "c": 3, "d": "Recognized marker for timing checks", "i": "objectives/anti-analysis/timing/evasion::timing-anti-debug-recognized-marker", "o": 36958, "z": 15, "cf": 0.949999988079071 } ], "ln": 36942 }, { "b": "fAr{fvGn7Z002s=5Dz?ilJz38z2!IPve$fBC(QOtve$cAwDhYg003BcyYFnKaok)KzVBUPBo3s", "n": [ { "c": 2, "d": "PE CompanyName metadata field", "i": "metadata/package/versioning::pe-companyname-field", "o": 37178, "z": 11, "cf": 0.699999988079071 } ], "ln": 37162 }, { "b": "zVB!TA@Vgu002:]6954kmGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up002v^ASxIFBo31PA@W/", "n": [ { "c": 2, "d": "PE FileDescription metadata field", "i": "metadata/package/versioning::pe-filedescription-field", "o": 37246, "z": 15, "cf": 0.699999988079071 } ], "ln": 37230 }, { "b": "x8(GyASu7t001XM2MK(9mGvc5yYF2DrSDXhASydXx-J5Kzu6Up001.Ne=WN9e=WN9e=WN9002:]7xsEonDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE002v^ASxIFBo31PA@W/)k(+{9", "n": [ { "c": 3, "d": "Dotted-quad PE version metadata marker", "i": "objectives/command-and-control/infrastructure/ip::ipv4-version-metadata-marker", "o": 37326, "z": 11, "cf": 0.9399999976158142 }, { "c": 2, "d": "PE InternalName metadata field", "i": "metadata/package/versioning::pe-internalname-field", "o": 37374, "z": 12, "cf": 0.699999988079071 } ], "ln": 37310 }, { "b": "Bo31PA@Vgu003417xsEopxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE002v^ASxIFBo31PA@W/)", "n": [ { "c": 2, "d": "PE OriginalFilename metadata field", "i": "metadata/package/versioning::pe-originalfilename-field", "o": 37526, "z": 16, "cf": 0.699999988079071 } ], "ln": 37510 }, { "b": "wb{ACyYBCn002E*6954kpYLIozVBqFBPt[KBo25ove$cAwDhYg002v^ASxIFBo31PA@W/)k(+{", "n": [ { "c": 2, "d": "PE ProductName metadata field", "i": "metadata/package/versioning::pe-productname-field", "o": 37614, "z": 11, "cf": 0.699999988079071 } ], "ln": 37598 }, { "b": "x8(GyASu7t004PJf8#1MpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001.Ne=WN9e=WN9d/.m6wDh", "n": [ { "c": 2, "d": "PE version resource metadata", "i": "metadata/package/versioning::version-resource-metadata", "o": 37686, "z": 14, "cf": 0.8999999761581421 } ], "ln": 37670 }, { "b": "000000000000000000000h6q(3\u0026*ncl{gII000000000000000000000000000000000", "n": [ { "c": 2, "d": "PE .reloc section presence", "i": "metadata/binary/section/names::reloc-section-presence", "o": 37888, "z": 6, "cf": 0.8999999761581421 } ], "ln": 37872 } ], "depth": 1, "facts": { "imp": [ [ "mscoree", "CorDllMain" ] ], "sec": [ [ ".text", 512, 36352, 5.88, "r-x" ], [ ".rsrc", 36864, 1024, 3.19, "r--" ], [ ".reloc", 37888, 512, 0.08, "r--" ] ], "metrics": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "resource_count": 1.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 89137.0, "reloc_overhang_bytes": 500.0, "reloc_overhang_ratio": 0.98, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "version.identity_entropy": 4.01, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0, "version.identity_symbol_ratio": 0.08 }, "file": { "size": 38400.0, "entropy": 5.75, "size_bytes": 38400.0 }, "binary": { "is_pie": 1.0, "code_entropy": 5.88, "string_count": 582.0, "overall_entropy": 5.75, "entropy_variance": 5.61, "avg_string_length": 21.63, "max_string_length": 143.0, "peak_region_bytes": 1024.0, "code_to_data_ratio": 1.0, "peak_region_entropy": 6.16, "string_length_stddev": 14.39, "largest_section_ratio": 0.95, "sentence_string_count": 13.0, "sentence_string_ratio": 0.02, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 36352.0, "entropy_max": 5.88, "entropy_mean": 3.05, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } } }, "id": 7, "mol": "O(Al)H₂(CmDb)", "path": "Cratis.Arc.Swagger.20.48.0.nupkg!!lib/net8.0/Cratis.Arc.Swagger.dll", "risk": 4, "sha": "c06bef397d25cdeca193c0c547713a8e59081634deff10e173d94323f18418a4", "size": 38400, "traits": [ { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "spans": [ [ 37686, 14 ] ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "spans": [ [ 24757, 4 ] ] }, { "id": "micro-behaviors/communications/http/server/managed::http-response-get", "conf": 1.0, "crit": 3, "desc": "Access to ASP.NET Response object", "spans": [ [ 28905, 12 ] ] }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "spans": [ [ 0, 26 ] ] }, { "id": "micro-behaviors/data/db/linq::linq-queries", "conf": 0.699999988079071, "crit": 3, "desc": "LINQ query operations", "spans": [ [ 26205, 11 ] ] }, { "id": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "conf": 1.0, "crit": 3, "desc": "JSON polymorphism runtime marker", "spans": [ [ 25878, 16 ] ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "spans": [ [ 37326, 11 ] ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "spans": [ [ 11656, 4 ] ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 36958, 15 ] ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "spans": [ [ 11656, 4 ] ] } ], "type": "pe" }, { "id": 8, "sha": "2359c5a60f421a773d47f67e4b4c20b9ccd62382fe54fb68c0c829bd477084d7", "path": "Cratis.Arc.Swagger.20.48.0.nupkg!!lib/net8.0/Cratis.Arc.Swagger.xml", "size": 7571, "type": "xml", "depth": 1 }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J+", "n": [ { "c": 3, "d": "HTTP fingerprinting evasion campaign", "i": "objectives/command-and-control/infrastructure/user-agent::http-fingerprinting-campaign", "o": 0, "z": 34, "cf": 0.8999999761581421 } ], "ln": 0 }, { "b": "00000000000000000000a/$.A00000nb@R\u00260SSx7H!vZFCWHHK0rr91000000000000", "n": [ { "c": 1, "d": "PE standard code/data section", "i": "metadata/binary/section/names::pe-code-data-standard-section", "o": 512, "z": 5, "cf": 0.8999999761581421 } ], "ln": 496 }, { "b": "015^O6Awaodba.43mV2Qlq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn", "n": [ { "c": 3, "d": "Recognized PE anti-analysis marker", "i": "objectives/anti-analysis/debugger-detect/combined-checks::evasion-aware-recognized-pe-marker", "o": 11656, "z": 4, "cf": 1.0 } ], "ln": 11640 }, { "b": "zFa6808)#FA==w7x([1*qfuC\u003cC%=H/zE)s1x(v(WwNPy%xAg[LwPA5!wNPy%xAg+vv@=Hez!s8zpJf(.l2ZJrrS", "n": [ { "c": 1, "d": "Regex component marker", "i": "objectives/persistence/login/scheduled-task/com::task-scheduler-builder-methods--rx-1", "o": 24624, "z": 21, "cf": 0.8999999761581421 } ], "ln": 24608 }, { "b": "vruj8e\u003cTI/e(M$5xj\u003e^@e[w^m08[e:By/qwlVl^SwN/*@z/fRGm}DNHA+P2onLA\u0026t", "n": [ { "c": 3, "d": "References Windows executable or script", "i": "objectives/execution/interpreter/script/shell::windows-executable-ref", "o": 24757, "z": 4, "cf": 0.6000000238418579 } ], "ln": 24741 }, { "b": "zE^r@v%HT-ygQ)%x(v\u003e?q*ACawO\u003c4$wOb:\u0026v@#B6zu94Avruj8e(Dm)y?m9#x(v\u003e?nKEAjy?m9#x(v\u003e?lJ", "n": [ { "c": 2, "d": "Benign high-entropy PE context", "i": "metadata/package/quality/false-positives::benign-high-entropy-pe-context", "o": 25544, "z": 17, "cf": 0.949999988079071 } ], "ln": 25528 }, { "b": "x(v\u003e?lVMQSx(+[0B8L{@q*ACawO\u003c50wQ5qHn][]*08)#Wx(mMJz/6D4A+PPkzu9QXB97#ge\u003c\u003cL[y?m9#", "n": [ { "c": 3, "d": "JSON polymorphism runtime marker", "i": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "o": 25878, "z": 16, "cf": 1.0 } ], "ln": 25862 }, { "b": "wPQpTA+c\u003c]BAzE4yJ:T%q*ACawO\u003c4[x(m[\u003cq*ACawO\u003c4!z!%l3v@#B6zGvB2wO#71x\u003e5+!lVl=", "n": [ { "c": 3, "d": "LINQ query operations", "i": "micro-behaviors/data/db/linq::linq-queries", "o": 26205, "z": 11, "cf": 0.699999988079071 } ], "ln": 26189 }, { "b": "Bzkk[BzkVhnmuyDy?mR!nMPFjq/ueYwPQpTzF\u003c2}BzkVhnmuyDy?mR!nL-/pwPz%5vR/QMB.bPsnmuyDy?mR!nL%RwA^pE", "n": [ { "c": 1, "d": "Regex component marker", "i": "objectives/persistence/login/scheduled-task/com::task-scheduler-builder-methods--rx-1", "o": 27091, "z": 27, "cf": 0.8999999761581421 } ], "ln": 27075 }, { "b": "wM98LwO\u003e\u003c%07g^nBzk!Go\u003ewA!x\u003e8h:q*ACawO\u003c4/x\u003c\u003eT(z/Z2mv@?SqA::67B1Qg9zEE5", "n": [ { "c": 3, "d": "Application has metrics/telemetry", "i": "metadata/package/quality/profile::has-metrics", "o": 28509, "z": 7, "cf": 0.8500000238418579 } ], "ln": 28493 }, { "b": "A@XNFvruj8e(V\u003e1v}xYYq*ACawO\u003c4$B-8qnzdLs\u003ezGGDgz/wS^A=#ebwPE\u0026ID2[7sz7X.ezGGPfwIct*ze:i9wPyZXA=#ebwPE", "n": [ { "c": 3, "d": "Packed binary marker", "i": "objectives/anti-static/obfuscation/eval/loader::packed-binary-marker", "o": 28584, "z": 30, "cf": 0.8500000238418579 } ], "ln": 28568 }, { "b": "07pycB.tu3zF8WZwmY/Zq*ACawO\u003c50wQ5qHn][]*e(3s}wPE\u0026:wPRoBB8$]fvR/:\u0026A@Y3Bv@2H=wM08K", "n": [ { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 28679, "z": 16, "cf": 0.8500000238418579 } ], "ln": 28663 }, { "b": "A@X^1wPzHdwN[+=AaK7\u003cxjVf(qE%]*z/fScA@Y0PwO%!Mx\u0026nI-AbPSnwPE\u0026sz/6u1zE=aMzGGDm", "n": [ { "c": 3, "d": "Access to ASP.NET Response object", "i": "micro-behaviors/communications/http/server/managed::http-response-get", "o": 28905, "z": 12, "cf": 1.0 } ], "ln": 28889 }, { "b": "AaK6iC%#$1wO#N6z/fQ@q*ACawO\u003c4#wN/\u003e6x([RMp?sV:x(!ufz/fQ@o\u003e!9Tz/Y\u0026eBs]\u003e2A86$^lVl#", "n": [ { "c": 2, "d": "System namespace reference", "i": "metadata/lang/compiler/managed::system-namespace", "o": 29333, "z": 15, "cf": 0.800000011920929 } ], "ln": 29317 }, { "b": "zGG/qA@X^fwNPazz!9A}nP5SYA:@W1Bz(hv06$ZGA+P09By!AWA+w%9A@XZwBvP[WwPzG{l2{P", "n": [ { "c": 3, "d": "Method interception capability", "i": "micro-behaviors/process/hook/interception::interceptor-comp", "o": 30194, "z": 11, "cf": 0.75 } ], "ln": 30178 }, { "b": "0a=cM001e+0aM1E0bRZM0at\u003eB0aV6L0b}{D0c[MX0b?\u003cC0aV6f4m*Fc0b.^E0bITD000l", "n": [ { "c": 1, "d": "Regex component marker", "i": "objectives/command-and-control/dropper/staging/encrypted::staged-payload-file-name--rx-1", "o": 32978, "z": 7, "cf": 0.8500000238418579 } ], "ln": 32962 }, { "b": "q*ACawO\u003c4$B-8qnzdLmvr+lq)x(v(Liw90rfFk4gavyo/BAIRnj-j?NBAg/aefE=ivR/:*oj-xFz!\u0026[", "n": [ { "c": 2, "d": "IPv4-like .NET assembly version", "i": "metadata/lang/compiler/managed::dotnet-ipv4-like-version", "o": 35419, "z": 15, "cf": 0.8500000238418579 } ], "ln": 35403 }, { "b": "0rrv5wO+{^B7CsK6-!pClVl{?A+Pf1BrA}\u003evruj8000Ad00+khfFk4ifAq8e0rs-be?![id/", "n": [ { "c": 2, "d": "Copyright notice", "i": "metadata/package/license::copyright-word", "o": 36098, "z": 9, "cf": 0.6000000238418579 } ], "ln": 36082 }, { "b": "00000000000000000000000000000000000000315c8Xg7YTL^00000000000000000", "n": [ { "c": 1, "d": "PE resource section", "i": "metadata/binary/section/names::pe-resource-section", "o": 36864, "z": 5, "cf": 0.8999999761581421 } ], "ln": 36848 }, { "b": "0000000000005k=gYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006Xn[brp!0rr910rr9", "n": [ { "c": 3, "d": "Recognized marker for timing checks", "i": "objectives/anti-analysis/timing/evasion::timing-anti-debug-recognized-marker", "o": 36958, "z": 15, "cf": 0.949999988079071 } ], "ln": 36942 }, { "b": "fAr{fvGn7Z002s=5Dz?ilJz38z2!IPve$fBC(QOtve$cAwDhYg003BcyYFnKaok)KzVBUPBo3s", "n": [ { "c": 2, "d": "PE CompanyName metadata field", "i": "metadata/package/versioning::pe-companyname-field", "o": 37178, "z": 11, "cf": 0.699999988079071 } ], "ln": 37162 }, { "b": "zVB!TA@Vgu002:]6954kmGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up002v^ASxIFBo31PA@W/", "n": [ { "c": 2, "d": "PE FileDescription metadata field", "i": "metadata/package/versioning::pe-filedescription-field", "o": 37246, "z": 15, "cf": 0.699999988079071 } ], "ln": 37230 }, { "b": "x8(GyASu7t001XM2MK(9mGvc5yYF2DrSDXhASydXx-J5Kzu6Up001.Ne=WN9e=WN9e=WN9002:]7xsEonDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE002v^ASxIFBo31PA@W/)k(+{9", "n": [ { "c": 3, "d": "Dotted-quad PE version metadata marker", "i": "objectives/command-and-control/infrastructure/ip::ipv4-version-metadata-marker", "o": 37326, "z": 11, "cf": 0.9399999976158142 }, { "c": 2, "d": "PE InternalName metadata field", "i": "metadata/package/versioning::pe-internalname-field", "o": 37374, "z": 12, "cf": 0.699999988079071 } ], "ln": 37310 }, { "b": "Bo31PA@Vgu003417xsEopxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE002v^ASxIFBo31PA@W/)", "n": [ { "c": 2, "d": "PE OriginalFilename metadata field", "i": "metadata/package/versioning::pe-originalfilename-field", "o": 37526, "z": 16, "cf": 0.699999988079071 } ], "ln": 37510 }, { "b": "wb{ACyYBCn002E*6954kpYLIozVBqFBPt[KBo25ove$cAwDhYg002v^ASxIFBo31PA@W/)k(+{", "n": [ { "c": 2, "d": "PE ProductName metadata field", "i": "metadata/package/versioning::pe-productname-field", "o": 37614, "z": 11, "cf": 0.699999988079071 } ], "ln": 37598 }, { "b": "x8(GyASu7t004PJf8#1MpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001.Ne=WN9e=WN9d/.m6wDh", "n": [ { "c": 2, "d": "PE version resource metadata", "i": "metadata/package/versioning::version-resource-metadata", "o": 37686, "z": 14, "cf": 0.8999999761581421 } ], "ln": 37670 }, { "b": "000000000000000000000h6q(3\u0026*ncl{gII000000000000000000000000000000000", "n": [ { "c": 2, "d": "PE .reloc section presence", "i": "metadata/binary/section/names::reloc-section-presence", "o": 37888, "z": 6, "cf": 0.8999999761581421 } ], "ln": 37872 } ], "depth": 1, "facts": { "imp": [ [ "mscoree", "CorDllMain" ] ], "sec": [ [ ".text", 512, 36352, 5.88, "r-x" ], [ ".rsrc", 36864, 1024, 3.19, "r--" ], [ ".reloc", 37888, 512, 0.08, "r--" ] ], "metrics": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "resource_count": 1.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 84235.0, "reloc_overhang_bytes": 500.0, "reloc_overhang_ratio": 0.98, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "version.identity_entropy": 4.01, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0, "version.identity_symbol_ratio": 0.08 }, "file": { "size": 38400.0, "entropy": 5.75, "size_bytes": 38400.0 }, "binary": { "is_pie": 1.0, "code_entropy": 5.88, "string_count": 582.0, "overall_entropy": 5.75, "entropy_variance": 5.61, "avg_string_length": 21.63, "max_string_length": 143.0, "peak_region_bytes": 1024.0, "code_to_data_ratio": 1.0, "peak_region_entropy": 6.16, "string_length_stddev": 14.39, "largest_section_ratio": 0.95, "sentence_string_count": 13.0, "sentence_string_ratio": 0.02, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 36352.0, "entropy_max": 5.88, "entropy_mean": 3.05, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } } }, "id": 9, "mol": "O(Al)H₂(CmDb)", "path": "Cratis.Arc.Swagger.20.48.0.nupkg!!lib/net9.0/Cratis.Arc.Swagger.dll", "risk": 4, "sha": "69294bb20f9e20e72facef5c5b8c872b2396c633aa17ded2c2dd9f3e210d56a3", "size": 38400, "traits": [ { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "spans": [ [ 37686, 14 ] ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "spans": [ [ 24757, 4 ] ] }, { "id": "micro-behaviors/communications/http/server/managed::http-response-get", "conf": 1.0, "crit": 3, "desc": "Access to ASP.NET Response object", "spans": [ [ 28905, 12 ] ] }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "spans": [ [ 0, 26 ] ] }, { "id": "micro-behaviors/data/db/linq::linq-queries", "conf": 0.699999988079071, "crit": 3, "desc": "LINQ query operations", "spans": [ [ 26205, 11 ] ] }, { "id": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "conf": 1.0, "crit": 3, "desc": "JSON polymorphism runtime marker", "spans": [ [ 25878, 16 ] ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "spans": [ [ 37326, 11 ] ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "spans": [ [ 11656, 4 ] ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 36958, 15 ] ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "spans": [ [ 11656, 4 ] ] } ], "type": "pe" }, { "id": 10, "sha": "2359c5a60f421a773d47f67e4b4c20b9ccd62382fe54fb68c0c829bd477084d7", "path": "Cratis.Arc.Swagger.20.48.0.nupkg!!lib/net9.0/Cratis.Arc.Swagger.xml", "size": 7571, "type": "xml", "depth": 1 }, { "id": 11, "sha": "e4cec3f17158a319515365712b4a1936396b7bca5834cc4db411bef88c217999", "path": "Cratis.Arc.Swagger.20.48.0.nupkg!![Content_Types].xml", "size": 706, "type": "xml", "depth": 1 }, { "id": 12, "sha": "1195ac8eebc6e537469ef5c56caaeba34eb51b9aa8afc142459718f113124c2e", "path": "Cratis.Arc.Swagger.20.48.0.nupkg!!package/services/metadata/core-properties/ea32292ea53a49e4b7ff6fef3f942e4e.psmdcp", "size": 624, "type": "xml", "depth": 1 }, { "id": 13, "sha": "933e4a8d64df7472072835d71a62a2f477e0f52835ff598a6a999492647e92d9", "path": "Cratis.Arc.Swagger@20.48.0.registry.json", "size": 785, "type": "registry", "depth": 1 } ], "omitted_files": 8, "v": "8" } }