{ "ml": { "v": "7", "eng": "2.2.0-beta.1", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.040421516, "rte": "az", "prob": 0.040421516 }, { "cls": 2, "raw": 0.5242248, "rte": "az/nupkg", "prob": 0.5242248 } ], "prob": 0.040421516, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.040421515703201294, "type": "nupkg" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.00012001395225524902, "type": "xml" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.013105839490890503, "type": "xml" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.007079094648361206, "type": "pe" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "xml" }, { "id": 5, "lvl": -1, "conf": 0, "prob": 0.00012001395225524902, "type": "xml" } ], "version": "v18.18", "analyzed_at": "2026-07-03T12:04:13Z" }, "path": "JD.AI.Channels.Signal.1.1.688.nupkg", "raw": { "files": [ { "id": 0, "ctx": [ { "b": "p!H([6Awak2MQ[G\u003c6itukc2?c00931000xb003wDwO=Ave]\u003eJtBcI*OyqIUwm/N/Ia]+o+J@", "n": [ { "c": 3, "d": "Staged loader six file archive", "i": "objectives/command-and-control/backdoor/loader/archive::staged-loader-six-files", "o": 0, "z": 25, "cf": 0.949999988079071 } ], "ln": 0 } ], "mol": "O(C)H₂(CmPo)", "sha": "3452329112f8cc79c8bb2656450e4dd4edccd9f72275961ec09d82b00b38d57c", "path": "JD.AI.Channels.Signal.1.1.688.nupkg", "risk": 4, "size": 36471, "type": "nupkg", "facts": { "metrics": { "file": { "size": 36471.0, "entropy": 7.93, "size_bytes": 36471.0 }, "binary": { "overall_entropy": 7.93, "peak_region_bytes": 34816.0, "peak_region_entropy": 7.8 }, "archive": { "file_count": 6.0, "member_count": 6.0, "script_count": 0.0, "zip_bomb_ratio": 2.17, "directory_count": 0.0, "executable_count": 1.0, "extra_field_size": 0.0, "noise_file_count": 0.0, "total_compressed": 35613.0, "compression.ratio": 0.78, "hidden_file_count": 2.0, "total_uncompressed": 45804.0, "crc_collision_count": 0.0, "entry_comment_count": 0.0, "max_filename_length": 81.0, "rtlo_filename_count": 0.0, "format.regular_count": 6.0, "nested_archive_count": 0.0, "path_traversal_count": 0.0, "symlink_escape_count": 0.0, "security.setgid_count": 0.0, "security.setuid_count": 0.0, "security.sticky_count": 0.0, "double_extension_count": 0.0, "duplicate_member_count": 0.0, "security.symlink_count": 0.0, "unicode_filename_count": 0.0, "homoglyph_filename_count": 0.0, "security.encrypted_count": 0.0, "timing.mtime_unique_count": 3.0, "timing.mtime_unique_ratio": 0.5, "misplaced_executable_count": 1.0, "timing.mtime_outlier_count": 2.0, "timing.mtime_dominant_count": 4.0, "timing.mtime_spread_seconds": 25104.0, "timing.sentinel_mtime_count": 0.0, "security.world_writable_count": 0.0, "timing.mtime_dominant_fraction": 0.67, "compression.method_counts.stored": 1.0, "compression.method_counts.deflate": 5.0 } } }, "ident": { "name": { "value": "JD.AI.Channels.Signal", "source": "nupkg.title", "verified": false }, "urls": [ { "url": "https://github.com/JerrettDavis/JD.AI", "kind": "homepage", "source": "nupkg.project_url" }, { "url": "https://github.com/JerrettDavis/JD.AI", "kind": "repository", "source": "nupkg.repository_url" } ], "trust": "unsigned", "authors": [ { "name": "JD", "role": "author", "source": "nupkg.authors" } ], "version": { "value": "1.1.688", "source": "nupkg.version", "verified": false }, "identifier": { "value": "JD.AI.Channels.Signal", "source": "nupkg.id", "verified": false } }, "traits": [ { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/process/create/spawn::redirect-standard-input-dotnet", "conf": 0.800000011920929, "crit": 3, "desc": ".NET child stdin redirection", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/process/create/spawn::redirect-standard-error-dotnet", "conf": 0.8199999928474426, "crit": 3, "desc": ".NET child stderr redirection", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/communications/http/websocket::websocket-connect-async", "atk": "T1071.001", "mbc": "C0002", "conf": 0.8199999928474426, "crit": 3, "desc": "WebSocket async connect method", "from": [ { "file": 3 } ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "objectives/evasion/process/hidden/execution::use-shell-execute", "conf": 0.7799999713897705, "crit": 1, "desc": "Process shell execute configuration", "from": [ { "file": 3 } ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/process/create/spawn::diagnostics-namespace-dotnet", "conf": 0.75, "crit": 1, "desc": ".NET process namespace token", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "from": [ { "file": 3 } ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/process/create/spawn::redirect-standard-output-dotnet", "conf": 0.8199999928474426, "crit": 3, "desc": ".NET child stdout redirection", "from": [ { "file": 3 } ] }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "from": [ { "file": 3 } ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "from": [ { "off": 4924, "file": 3 } ] }, { "id": "micro-behaviors/process/create/spawn::dotnet-redirected-stdio", "conf": 0.8799999952316284, "crit": 3, "desc": ".NET child process stdio redirection", "from": [ { "off": 12506, "file": 3 } ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/process/create/spawn::process-token-dotnet", "conf": 0.699999988079071, "crit": 1, "desc": ".NET Process type token", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/process/create/hidden::dotnet-create-no-window", "atk": "T1564.003", "conf": 0.8600000143051147, "crit": 2, "desc": ".NET process window suppression", "from": [ { "file": 3 } ] }, { "id": "objectives/command-and-control/backdoor/loader/archive::staged-loader-six-files", "conf": 0.949999988079071, "crit": 3, "desc": "Staged loader six file archive", "spans": [ [ 0, 25 ] ] } ] }, { "depth": 1, "facts": { "metrics": { "file": { "size": 511.0, "entropy": 5.2, "size_bytes": 511.0 }, "binary": { "overall_entropy": 5.2, "peak_region_bytes": 511.0, "peak_region_entropy": 5.2 } } }, "id": 1, "path": "JD.AI.Channels.Signal.1.1.688.nupkg!!_rels/.rels", "sha": "c1493f7a4657555d3f34ded6ba5c3a92b48f81b18476cb934078bc8e61c6c593", "size": 511, "type": "xml" }, { "ctx": [ { "b": "[4ls%kx}3YaA?spB7]MgjT8QkfD}SJzEWP}x(mMDb6w0teJs}sj]", "n": [ { "c": 2, "d": "NuGet nuspec manifest file", "i": "metadata/build/manifest::nuspec-file", "o": 0, "z": 28, "cf": 0.9800000190734863 } ], "ln": 1, "addr": 0 }, { "b": "jAa.syHH\u003c!aB4:tzGv@+xMOuniXJdcv}YB\u003cvrj5rx\u003e8g4B8LVje[n*pfk$ufyHH\u003c\u0026zF7QTfFLvpfF$I3B-RIkv\u003eJ1EwfKh", "ln": 2, "addr": 42 }, { "b": "arS^-wPRu\u003evrt{w", "ln": 3, "addr": 118 }, { "b": "arR^Hjy-qGD2^RixMMB9z/x#xx\u003eIa3asH.Gawb3Oavf*WaAzgexMOqrA+fr6A=#28e\u003c7^%z/x#xx\u003eIa3j]", "ln": 11, "addr": 507 }, { "b": "arR^HjAL1AB3s2DaAImfzEEu7v}Yp*zE)Sbxjk)[Cvt+VflySnB3o", "ln": 12, "addr": 573 }, { "b": "arR^HjAt1Lz/YSmz/QaCBA}?pjTaJMBrR\u0026IA+)(.xMOunB2\u003e%cxk8E3BZ=$kz/4d1wPz*5BAx]VC4(1Jn\u003c\u003eo$nG]o!z/6u9BuH*7vQ}zOggrf%vLIz7g+Z^@wmxdbgCQ\u003cywJaddwh^%Pvpzf9gbp\u003clatk[", "n": [ { "c": 2, "d": "NuGet package declares repository", "i": "metadata/package/files/nuget::nuspec-repository", "o": 620, "z": 74, "cf": 0.8999999761581421 } ], "ln": 13, "addr": 616 }, { "b": "arR^Hjy\u00262xwO#3\u0026zEWx(B3o", "n": [ { "c": 2, "d": "NuGet package declares dependencies", "i": "metadata/package/files/nuget::nuspec-dependencies", "o": 744, "z": 74, "cf": 0.8999999761581421 } ], "ln": 14, "addr": 740 }, { "b": "arR^HarS^VA=l8taAR4jxjVfOA:-/@Cw?IqjTa=PBtkE4fD@W", "ln": 15, "addr": 759 }, { "b": "arR^HarR^Hjy\u00262xwO#3\u0026zEW@mx\u003efvJn\u003c\u003eo$nIiwGA+cBqC4CYnx(v(La#7Y8e\u0026CWGa%pDwv@co#wJ.k7B.LV5ej1eZy\u003cytrA=SAEffP", "ln": 16, "addr": 799 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 941.0, "entropy": 5.18, "size_bytes": 941.0 }, "binary": { "overall_entropy": 5.18, "peak_region_bytes": 941.0, "peak_region_entropy": 5.18 } } }, "id": 2, "path": "JD.AI.Channels.Signal.1.1.688.nupkg!!JD.AI.Channels.Signal.nuspec", "risk": 1, "sha": "6a7caa492c49421c9c565ef1d000bf3431aa92be9cfeed03a90df58abc3c12ce", "size": 941, "traits": [ { "id": "metadata/build/manifest::nuspec-file", "conf": 0.9800000190734863, "crit": 2, "desc": "NuGet nuspec manifest file", "spans": [ [ 0, 28 ] ] }, { "id": "metadata/package/files/nuget::nuspec-repository", "conf": 0.8999999761581421, "crit": 2, "desc": "NuGet package declares repository", "spans": [ [ 620, 74 ] ] }, { "id": "metadata/package/files/nuget::nuspec-dependencies", "conf": 0.8999999761581421, "crit": 2, "desc": "NuGet package declares dependencies", "spans": [ [ 744, 74 ] ] } ], "type": "xml" }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J+", "n": [ { "c": 3, "d": "HTTP fingerprinting evasion campaign", "i": "objectives/command-and-control/infrastructure/user-agent::http-fingerprinting-campaign", "o": 0, "z": 34, "cf": 0.8999999761581421 } ], "ln": 0 }, { "b": "00000000000000000000abQ3#00000nb@R\u00260SSx7jtu*o/El!20rr91000000000000", "n": [ { "c": 1, "d": "PE standard code/data section", "i": "metadata/binary/section/names::pe-code-data-standard-section", "o": 512, "z": 5, "cf": 0.8999999761581421 } ], "ln": 496 }, { "b": "huFm.000c7c@*lE3mV2Qlq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn", "n": [ { "c": 2, "d": ".NET Metadata Root (BSJB)", "i": "metadata/binary/framework::dotnet-metadata", "o": 4924, "z": 4, "cf": 1.0 } ], "ln": 4908 }, { "b": "zF%ArzeTMrrc-B]fKMZqjvs48zE)s1l34r?v)jBguOKLvjwx:8B.\u003eRM08[e:By/qwnLYs+D2[7sz7Xg]y\u00260V)BzkVhB1P%]zE)\u003c5v/P5dzE-", "n": [ { "c": 3, "d": "WebSocket async connect method", "i": "micro-behaviors/communications/http/websocket::websocket-connect-async", "o": 9130, "z": 12, "cf": 0.8199999928474426 }, { "c": 2, "d": "System namespace reference", "i": "metadata/lang/compiler/managed::system-namespace", "o": 9158, "z": 9, "cf": 0.800000011920929 } ], "ln": 9113 }, { "b": "wPydRzeAZ0wog4TD2v9(lVl\u003cWwN/*FB9RUk07pKxv@Dm5wN/*FB9RUk0b2\u003e+uUTU2zGoYa0cqZ[", "n": [ { "c": 1, "d": "Regex component marker", "i": "objectives/persistence/login/scheduled-task/com::task-scheduler-builder-methods--rx-1", "o": 9333, "z": 12, "cf": 0.8999999761581421 } ], "ln": 9317 }, { "b": "Bv*0ynP5SYA+]V7yH}2RxjVf(nPNmqzF\u003c2}By!$.l3D:KBx9j1vp\u003c7DzBntVAbo9cwN\u003e^NwPRoJB3\u003c\u003c", "n": [ { "c": 1, "d": "Regex component marker", "i": "objectives/persistence/login/scheduled-task/com::task-scheduler-builder-methods--rx-1", "o": 9470, "z": 15, "cf": 0.8999999761581421 } ], "ln": 9454 }, { "b": "vRGT)BA{e]BAh88B-.f{B7GD2rDz.IxK#0@mr\u0026xNB-.f{C42ifwDkRtzeTPe08)DHx\u003c\u003e*(DsW7PD2[7sz7X=", "n": [ { "c": 1, "d": ".NET hidden process launch setup", "i": "objectives/evasion/process/hidden/execution::dotnet-hidden-process-launch", "o": 10929, "z": 19, "cf": 0.9200000166893005 } ], "ln": 10913 }, { "b": "e\u003c\u003cqXzF\u003c34B1Qy9xkRc]e[w^m0843xyYF9VBydQYwO?A*wPRoJBy/p?q*ACawO?AW", "n": [ { "c": 3, "d": "References Windows executable or script", "i": "objectives/execution/interpreter/script/shell::windows-executable-ref", "o": 11234, "z": 4, "cf": 0.6000000238418579 } ], "ln": 11218 }, { "b": "v}xR3x(v\u003e?uU0ORzeTp(q*ACawO\u003c50wQ5qHn][]*08)#Wx(mMJz/6D4A+PPkzu9NSzua-?Byd%*vrcDYzF0!!p\u0026ZF:wPI]\u003eByxiinP5cU0cqZ[uSp-RwPI%4zeYFqyiarhA=tILyf$sEp*[wA", "n": [ { "c": 3, "d": ".NET child process stdio redirection", "i": "micro-behaviors/process/create/spawn::dotnet-redirected-stdio", "o": 11501, "z": 16, "cf": 0.8799999952316284 }, { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 11449, "z": 16, "cf": 0.8500000238418579 } ], "ln": 11433 }, { "b": "wPv=kk6gdsvS=y3wmY=Yq*ACawO\u003c4!z!9AEz/49]z/6Dcy?mR!lVl*UvqYQLvrb^[wPRH7090xFyE9eMx(){b07QP", "n": [ { "c": 3, "d": ".NET dynamic code generation capability", "i": "metadata/lang/compiler/managed::dotnet-dynamic-code", "o": 11705, "z": 23, "cf": 0.8500000238418579 } ], "ln": 11689 }, { "b": "07}rJzC$a!x\u003c\u003e*(Ds.9%B7GD2qE%xMA+e:5q/(C=wmoH?mriA!ASv.4Bz(g1e[nykz/L?RD2[7sz7Xj\u003cvp%E@B98baA@", "n": [ { "c": 3, "d": ".NET child stderr redirection", "i": "micro-behaviors/process/create/spawn::redirect-standard-error-dotnet", "o": 11816, "z": 25, "cf": 0.8199999928474426 } ], "ln": 11800 }, { "b": "0b2\u003e+uR\u003efKvqPN$wPz?(q*ACawO\u003c4/x\u003c\u003eT(z/Z2mv@\u003cn0A=kD0B8}s*v@#+(B7GD2l2{QXzdNQbA@XNCzEW9%07H)Ezd9", "n": [ { "c": 1, "d": ".NET process namespace token", "i": "micro-behaviors/process/create/spawn::diagnostics-namespace-dotnet", "o": 12172, "z": 26, "cf": 0.75 } ], "ln": 12156 }, { "b": "Byd%*vqYQ:A+4:VAclm5B7GD2qE%xMA+e:5q/(C=wmoH?nP5G\u0026Bo2@+Byd%*vqYQ:A+4%*Bz#wA0cqZ[uS7DCx(W={Bw)o\u0026zE^f@wkvt\u0026Aclm5o(Ch^pgXV(07gWwzddr)lVl\u003c:wQ5p%xjVf(rDI.Cz*8h5wPRoDA+eW3wLNeBx(mE1Ck$0GzeAZ0wkEqTw[=F\u0026q/2(-xI-.Xw[=F\u0026ra]#!k(", "n": [ { "c": 3, "d": ".NET child stdin redirection", "i": "micro-behaviors/process/create/spawn::redirect-standard-input-dotnet", "o": 12461, "z": 25, "cf": 0.800000011920929 }, { "c": 3, "d": ".NET child stdout redirection", "i": "micro-behaviors/process/create/spawn::redirect-standard-output-dotnet", "o": 12506, "z": 26, "cf": 0.8199999928474426 }, { "c": 2, "d": ".NET process window suppression", "i": "micro-behaviors/process/create/hidden::dotnet-create-no-window", "o": 12568, "z": 18, "cf": 0.8600000143051147 } ], "ln": 12445 }, { "b": "0rrv5wO+{^B7CsKd//R%lVl{?A+Pf1Brz#wdiIkJe*9C@y-)+jxj#ydaAz4mwPz%9wg^\u0026Zrr", "n": [ { "c": 2, "d": "Copyright notice", "i": "metadata/package/license::copyright-word", "o": 15052, "z": 9, "cf": 0.6000000238418579 } ], "ln": 15036 }, { "b": "fg[R+k$I4R1owG506ynZh+DE\u003ck$JW@xKL^@wO=Auq!Y(ZvqEL{x\u003eIr(y^R(AzF\u003c34d)cgqzF\u003c2}Bu%$[zEU\u003evuTCJF002m+06r!ve\u003cS5YlUG[CzE)T9e(ME%zEEulq!Y(Z", "n": [ { "c": 1, "d": "Regex component marker", "i": "objectives/persistence/login/scheduled-task/com::task-scheduler-builder-methods--rx-1", "o": 15270, "z": 56, "cf": 0.8999999761581421 } ], "ln": 15254 }, { "b": "00000000000000000000000000000000000000315c8Xg7YTL^00000000000000000", "n": [ { "c": 1, "d": "PE resource section", "i": "metadata/binary/section/names::pe-resource-section", "o": 28160, "z": 5, "cf": 0.8999999761581421 } ], "ln": 28144 }, { "b": "0000000000002y\u0026gYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006Xn[brp!0rrc20ryZ", "n": [ { "c": 2, "d": "PE version resource metadata", "i": "metadata/package/versioning::version-resource-metadata", "o": 28254, "z": 15, "cf": 0.8999999761581421 } ], "ln": 28238 }, { "b": "pYJ\u0026.e=U\u003eK001tC0@@u4lJz38z2!IPve$fBC(QOtve$cAwDhYg002Q\u003el\u0026Wh!002%#761vnmGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up002Q\u003el\u0026X?tk(:ERe=Xl", "n": [ { "c": 2, "d": "PE CompanyName metadata field", "i": "metadata/package/versioning::pe-companyname-field", "o": 28658, "z": 11, "cf": 0.699999988079071 }, { "c": 2, "d": "PE FileDescription metadata field", "i": "metadata/package/versioning::pe-filedescription-field", "o": 28698, "z": 15, "cf": 0.699999988079071 } ], "ln": 28642 }, { "b": "x8(/Hve$9z002aY4GDIfmGvc5yYF2DrSDXhASydXx-J5Kzu6Up001.Ne=WQae=W^fh#\u003e]re=WQah2]Ajf-Til002%#8uo^rnDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE002Q\u003el\u0026X?tk(:ERe=XlsxAhDv", "n": [ { "c": 2, "d": "PE FileVersion metadata field", "i": "metadata/package/versioning::pe-fileversion-field", "o": 28782, "z": 11, "cf": 0.699999988079071 }, { "c": 2, "d": "PE InternalName metadata field", "i": "metadata/package/versioning::pe-internalname-field", "o": 28842, "z": 12, "cf": 0.699999988079071 } ], "ln": 28766 }, { "b": "wDllve=U\u003eK003m78uo^rpxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE002Q\u003el\u0026X?tk(:ERe=Xls", "n": [ { "c": 2, "d": "PE OriginalFilename metadata field", "i": "metadata/package/versioning::pe-originalfilename-field", "o": 29042, "z": 16, "cf": 0.699999988079071 } ], "ln": 29026 }, { "b": "e=YzZyYFnK002W)761vnpYLIozVBqFBPt[KBo25ove$cAwDhYg002Q\u003el\u0026X?tk(:ERe=XlsxAhD", "n": [ { "c": 2, "d": "PE ProductName metadata field", "i": "metadata/package/versioning::pe-productname-field", "o": 29134, "z": 11, "cf": 0.699999988079071 } ], "ln": 29118 }, { "b": "x8(/Hve$9z002Q\u003e6954kpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001.Ne=WQae=W^fh#\u003e]rd/Y", "n": [ { "c": 2, "d": "PE ProductVersion metadata field", "i": "metadata/package/versioning::pe-productversion-field", "o": 29210, "z": 14, "cf": 0.699999988079071 } ], "ln": 29194 }, { "b": "000000000000000000000dU4H3\u0026*nckSO(B000000000000000000000000000000000", "n": [ { "c": 2, "d": "PE .reloc section presence", "i": "metadata/binary/section/names::reloc-section-presence", "o": 29696, "z": 6, "cf": 0.8999999761581421 } ], "ln": 29680 } ], "depth": 1, "facts": { "imp": [ [ "mscoree", "CorDllMain" ] ], "sec": [ [ ".text", 512, 27648, 7.08, "r-x" ], [ ".rsrc", 28160, 1536, 2.78, "r--" ], [ ".reloc", 29696, 512, 0.08, "r--" ] ], "metrics": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "resource_count": 1.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 64400.0, "reloc_overhang_bytes": 500.0, "reloc_overhang_ratio": 0.98, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "version.identity_entropy": 3.77, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0, "version.identity_symbol_ratio": 0.14 }, "file": { "size": 30208.0, "entropy": 6.8, "size_bytes": 30208.0 }, "binary": { "is_pie": 1.0, "code_entropy": 7.08, "string_count": 294.0, "overall_entropy": 6.8, "entropy_variance": 8.31, "avg_string_length": 16.17, "max_string_length": 80.0, "peak_region_bytes": 11264.0, "code_to_data_ratio": 1.0, "peak_region_entropy": 7.82, "string_length_stddev": 10.16, "largest_section_ratio": 0.92, "sentence_string_count": 7.0, "sentence_string_ratio": 0.02, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 27648.0, "entropy_max": 7.08, "entropy_mean": 3.31, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } } }, "id": 3, "mol": "H₂(CmPo)", "path": "JD.AI.Channels.Signal.1.1.688.nupkg!!lib/net10.0/JD.AI.Channels.Signal.dll", "risk": 3, "sha": "b06048675b88849fe97741d5d8a771d940425acddfd59f0a1cddd51c5e65c507", "size": 30208, "traits": [ { "id": "objectives/evasion/process/hidden/execution::use-shell-execute", "conf": 0.7799999713897705, "crit": 1, "desc": "Process shell execute configuration", "spans": [ [ 10929, 19 ] ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 28254, 15 ] ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "spans": [ [ 11234, 4 ] ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "spans": [ [ 29210, 14 ] ] }, { "id": "micro-behaviors/process/create/spawn::redirect-standard-input-dotnet", "conf": 0.800000011920929, "crit": 3, "desc": ".NET child stdin redirection", "spans": [ [ 12461, 25 ] ] }, { "id": "micro-behaviors/process/create/spawn::diagnostics-namespace-dotnet", "conf": 0.75, "crit": 1, "desc": ".NET process namespace token", "spans": [ [ 12172, 26 ] ] }, { "id": "micro-behaviors/process/create/spawn::redirect-standard-output-dotnet", "conf": 0.8199999928474426, "crit": 3, "desc": ".NET child stdout redirection", "spans": [ [ 12506, 26 ] ] }, { "id": "micro-behaviors/process/create/spawn::process-token-dotnet", "conf": 0.699999988079071, "crit": 1, "desc": ".NET Process type token", "spans": [ [ 11501, 16 ] ] }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "spans": [ [ 0, 26 ] ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "spans": [ [ 4924, 4 ] ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "spans": [ [ 28782, 11 ] ] }, { "id": "micro-behaviors/process/create/spawn::redirect-standard-error-dotnet", "conf": 0.8199999928474426, "crit": 3, "desc": ".NET child stderr redirection", "spans": [ [ 11816, 25 ] ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "micro-behaviors/communications/http/websocket::websocket-connect-async", "atk": "T1071.001", "mbc": "C0002", "conf": 0.8199999928474426, "crit": 3, "desc": "WebSocket async connect method", "spans": [ [ 9130, 12 ] ] }, { "id": "micro-behaviors/process/create/hidden::dotnet-create-no-window", "atk": "T1564.003", "conf": 0.8600000143051147, "crit": 2, "desc": ".NET process window suppression", "spans": [ [ 12568, 18 ] ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "spans": [ [ 4924, 4 ] ] }, { "id": "micro-behaviors/process/create/spawn::dotnet-redirected-stdio", "conf": 0.8799999952316284, "crit": 3, "desc": ".NET child process stdio redirection", "spans": [ [ 11501, 16 ], [ 11816, 25 ], [ 12461, 25 ], [ 12506, 26 ] ] } ], "type": "pe" }, { "depth": 1, "facts": { "metrics": { "file": { "size": 459, "entropy": 4.83 }, "binary": { "peak_region_bytes": 459, "peak_region_entropy": 4.83 } } }, "id": 4, "path": "JD.AI.Channels.Signal.1.1.688.nupkg!![Content_Types].xml", "pid": 0, "risk": 1, "sha": "3dae54f1e2761fb41379f8d05e7fdb903b62ecd0ec1c65fc68fd02c91c3671cf", "size": 459, "traits": [ { "id": "metadata/file/extension/identity::doc-or-config-extension", "conf": 1.0, "crit": 2, "desc": "Text, document, or config extension" } ], "type": "xml" }, { "depth": 1, "facts": { "metrics": { "file": { "size": 699.0, "entropy": 5.29, "size_bytes": 699.0 }, "binary": { "overall_entropy": 5.29, "peak_region_bytes": 699.0, "peak_region_entropy": 5.29 }, "consistency": { "extension_content_mismatch": 1.0, "extension_content_mismatch.config_as_unknown": 1.0 } } }, "id": 5, "path": "JD.AI.Channels.Signal.1.1.688.nupkg!!package/services/metadata/core-properties/609886e860bd4634ab40a660b90b3ccf.psmdcp", "sha": "29f554e96b211e37dbb98a134f6dea67a5afb981e8d614978767c5cb0990c60a", "size": 699, "type": "xml" } ], "rev": "868bd", "v": "8" } }