{ "llm": { "conf": 0.82810575, "grade": "benign", "model": "Qwen/Qwen3.6-27B", "outcome": "benign", "interpretation": "Legitimate .NET library metadata" }, "ml": { "v": "7", "eng": "2.3.0-beta.0", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.7544368, "rte": "az", "prob": 0.7544368 }, { "cls": 0, "raw": 0.01727295, "rte": "az/nupkg", "prob": 0.01727295 } ], "prob": 0.7544368, "skip": [ { "rte": "az/zip", "why": "unavailable" }, { "rte": "az/zip", "why": "unavailable" } ], "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.7544367909431458, "type": "nupkg" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.00012001395225524902, "type": "xml" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.010053783655166626, "type": "xml" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.005262881517410278, "type": "text" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.6386661529541016, "type": "pe" }, { "id": 5, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "xml" }, { "id": 6, "lvl": -1, "conf": 0, "prob": 0.6386661529541016, "type": "pe" }, { "id": 7, "lvl": -1, "conf": 0, "prob": 0.7544367909431458, "type": "xml" }, { "id": 8, "lvl": -1, "conf": 0, "prob": 0.6386661529541016, "type": "pe" }, { "id": 9, "lvl": -1, "conf": 0, "prob": 0.7544367909431458, "type": "xml" }, { "id": 10, "lvl": -1, "conf": 0, "prob": 0.6386661529541016, "type": "pe" }, { "id": 11, "lvl": -1, "conf": 0, "prob": 0.7544367909431458, "type": "xml" }, { "id": 12, "lvl": -1, "conf": 0, "prob": 0.00006663799285888672, "type": "png" }, { "id": 13, "lvl": -1, "conf": 0, "prob": 0.7544367909431458, "type": "xml" }, { "id": 14, "lvl": -1, "conf": 0, "prob": 0.00012001395225524902, "type": "xml" }, { "id": 15, "lvl": -1, "conf": 0, "prob": 0.7544367909431458, "type": "registry" } ], "version": "v18.18", "analyzed_at": "2026-07-07T01:56:52Z" }, "path": "ChilliCream.Nitro.Adapters.OpenApi.16.2.3-p.2.nupkg", "raw": { "files": [ { "id": 0, "mol": "O(Al)H(Db)", "sha": "6845083bcb2af9cef59123a880c7e0d6e02dc566d7e0171eb6ae5257e0c86e74", "path": "ChilliCream.Nitro.Adapters.OpenApi.16.2.3-p.2.nupkg", "risk": 3, "size": 77222, "type": "nupkg", "facts": { "metrics": { "file": { "size": 77222.0, "entropy": 7.97, "size_bytes": 77222.0 }, "binary": { "overall_entropy": 7.97, "peak_region_bytes": 74752.0, "peak_region_entropy": 7.82 }, "archive": { "file_count": 15.0, "member_count": 15.0, "script_count": 0.0, "zip_bomb_ratio": 7.51, "directory_count": 0.0, "executable_count": 4.0, "extra_field_size": 0.0, "noise_file_count": 0.0, "total_compressed": 74894.0, "compression.ratio": 0.44, "hidden_file_count": 2.0, "total_uncompressed": 168992.0, "crc_collision_count": 3.0, "entry_comment_count": 0.0, "max_filename_length": 81.0, "rtlo_filename_count": 0.0, "format.regular_count": 15.0, "nested_archive_count": 0.0, "path_traversal_count": 0.0, "symlink_escape_count": 0.0, "security.setgid_count": 0.0, "security.setuid_count": 0.0, "security.sticky_count": 0.0, "double_extension_count": 0.0, "duplicate_member_count": 0.0, "security.symlink_count": 0.0, "unicode_filename_count": 0.0, "homoglyph_filename_count": 0.0, "security.encrypted_count": 0.0, "timing.mtime_unique_count": 2.0, "timing.mtime_unique_ratio": 0.13, "misplaced_executable_count": 4.0, "timing.mtime_outlier_count": 1.0, "timing.mtime_dominant_count": 14.0, "timing.mtime_spread_seconds": 25080.0, "timing.sentinel_mtime_count": 0.0, "security.world_writable_count": 0.0, "timing.mtime_dominant_fraction": 0.93, "compression.method_counts.stored": 1.0, "compression.method_counts.deflate": 14.0 } } }, "ident": { "name": { "value": "ChilliCream.Nitro.Adapters.OpenApi", "source": "nupkg.title", "verified": false }, "urls": [ { "url": "https://chillicream.com/", "kind": "homepage", "source": "nupkg.project_url" }, { "url": "https://github.com/ChilliCream/graphql-platform.git", "kind": "repository", "source": "nupkg.repository_url" } ], "trust": "unsigned", "authors": [ { "name": "ChilliCream authors and contributors", "role": "author", "source": "nupkg.authors" } ], "version": { "value": "16.2.3-p.2", "source": "nupkg.version", "verified": false }, "identifier": { "value": "ChilliCream.Nitro.Adapters.OpenApi", "source": "nupkg.id", "verified": false } }, "traits": [ { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/data/db/linq::linq-queries", "conf": 0.699999988079071, "crit": 3, "desc": "LINQ query operations", "from": [ { "file": 4 } ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "from": [ { "file": 4 } ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "from": [ { "file": 4 } ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "from": [ { "file": 4 } ] }, { "id": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "conf": 1.0, "crit": 3, "desc": "JSON polymorphism runtime marker", "from": [ { "file": 4 } ] }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "from": [ { "file": 4 } ], "spans": [ [ 0, 26 ] ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "from": [ { "file": 4 } ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "from": [ { "file": 4 }, { "file": 6 }, { "file": 8 }, { "file": 10 } ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" } ] }, { "id": 1, "sha": "dbcbc3511cc06cbdd346003ae607cf2221cade9515c5f0a2f6a41d25ae384ec4", "path": "ChilliCream.Nitro.Adapters.OpenApi.16.2.3-p.2.nupkg!!_rels/.rels", "size": 524, "type": "xml", "depth": 1 }, { "ctx": [ { "b": "[4ls%kx}3YaA?spB7]MgjT8QkfD}SJzEWP}x(mMDb6w0teJs}sj]", "n": [ { "c": 2, "d": "NuGet nuspec manifest file", "i": "metadata/build/manifest::nuspec-file", "o": 0, "z": 41, "cf": 0.9800000190734863 } ], "ln": 1, "addr": 0 }, { "b": "jAa.syHH\u003c!aB4:tzGv@+xMOuniXJdcv}YB\u003cvrj5rx\u003e8g4B8LVje[n*pfk$ufyHH\u003c\u0026zF7QTfFLvpfF$I3B-RIkv\u003eJ1EwfKh", "ln": 2, "addr": 42 }, { "b": "arS^-wPRu\u003evrt{w", "ln": 3, "addr": 118 }, { "b": "arR^Hjy-qGD2^RixMMB9z/x#xx\u003eIa3aI$92gb7Bxat1ZPA+fr6zGE0*xLzp0x*V]LvqNbUzEUpYfjO{tD2^RixMMA", "ln": 14, "addr": 683 }, { "b": "arR^HjAL1AB3r9mvq])SoDVYox(4Q1lVM:Dz9fE[vp%TB", "ln": 15, "addr": 755 }, { "b": "arR^HjAt1Lz/YSmz/QaCBA}?pjT9ygBvZK-a%q2Gy=@$QBAzFyiXJd0x([3hvLheez7!m\u0026x(4Q1lVM:Dz7/Kxvq][1y+oQxvrua1A=0Bwx(\u003eKwv@Dj3x((GZg?phTiaDFQiB\u003e9eh8^xEiasY#f/Z{Fiw\u003ekRwNWRVi5SZbf!$B]a%nK5", "n": [ { "c": 2, "d": "NuGet package declares repository", "i": "metadata/package/files/nuget::nuspec-repository", "o": 796, "z": 91, "cf": 0.8999999761581421 } ], "ln": 16, "addr": 792 }, { "b": "arR^Hjy\u00262xwO#3\u0026zEWx(B3o", "n": [ { "c": 2, "d": "NuGet package declares dependencies", "i": "metadata/package/files/nuget::nuspec-dependencies", "o": 937, "z": 891, "cf": 0.8999999761581421 } ], "ln": 17, "addr": 933 }, { "b": "arR^HarS^VA=l8taAR4jxjVfOA:-/@Cw?IqjTa=PBtkE4fD@W", "ln": 18, "addr": 952 }, { "b": "arR^HarR^Hjy\u00262xwO#3\u0026zEW@mx\u003efvJnn\u0026PqxM4y0y*?A%e\u003cT2RAcbViB1QmcwO%!Mx!z+\u003eA+cBqC4CYnx(v(La#7#dga\u003evmA4S)\u0026az2!cy\u0026%o1jT9jnx(4rhl2HaED3T4xB0q.Wj]", "ln": 19, "addr": 992 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 2086.0, "entropy": 5.09, "size_bytes": 2086.0 }, "binary": { "overall_entropy": 5.09, "peak_region_bytes": 2048.0, "peak_region_entropy": 5.07 } } }, "id": 2, "path": "ChilliCream.Nitro.Adapters.OpenApi.16.2.3-p.2.nupkg!!ChilliCream.Nitro.Adapters.OpenApi.nuspec", "risk": 1, "sha": "3878bad6d05e54e8a92f9f8174ff549156761278e59c4466a5eda49269b02a43", "size": 2086, "traits": [ { "id": "metadata/package/files/nuget::nuspec-dependencies", "conf": 0.8999999761581421, "crit": 2, "desc": "NuGet package declares dependencies", "spans": [ [ 937, 891 ] ] }, { "id": "metadata/build/manifest::nuspec-file", "conf": 0.9800000190734863, "crit": 2, "desc": "NuGet nuspec manifest file", "spans": [ [ 0, 41 ] ] }, { "id": "metadata/package/files/nuget::nuspec-repository", "conf": 0.8999999761581421, "crit": 2, "desc": "NuGet package declares repository", "spans": [ [ 796, 91 ] ] } ], "type": "xml" }, { "id": 3, "sha": "5f6f7fb421872122ae2c7c395c0e4ed232cb5653b42215106eba532c4001b215", "path": "ChilliCream.Nitro.Adapters.OpenApi.16.2.3-p.2.nupkg!!LICENSE", "risk": 1, "size": 1083, "type": "text", "depth": 1 }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J\u0026m(0jh", "n": [ { "c": 3, "d": "HTTP fingerprinting evasion campaign", "i": "objectives/command-and-control/infrastructure/user-agent::http-fingerprinting-campaign", "o": 0, "z": 34, "cf": 0.8999999761581421 } ], "ln": 0 }, { "b": "000000000000000000000*-(!00000nb@R\u00260SSx7oG@HSnlbY\u003c0rr91000000000000", "n": [ { "c": 1, "d": "PE standard code/data section", "i": "metadata/binary/section/names::pe-code-data-standard-section", "o": 512, "z": 5, "cf": 0.8999999761581421 } ], "ln": 496 }, { "b": "dJix:000vL1$x*b1$x*blq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn", "n": [ { "c": 3, "d": "Recognized PE anti-analysis marker", "i": "objectives/anti-analysis/debugger-detect/combined-checks::evasion-aware-recognized-pe-marker", "o": 8524, "z": 4, "cf": 1.0 } ], "ln": 8508 }, { "b": "nPNsBBy/uhx(v(Svrt]Tq*ACawO\u003c50wQ5qHn][]*e(Mt4x\u003c\u003e*(Dsp]fz/dg4wPRu\u003evrt]Tq*ACawO\u003c50", "n": [ { "c": 3, "d": "JSON polymorphism runtime marker", "i": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "o": 18722, "z": 16, "cf": 1.0 } ], "ln": 18706 }, { "b": "l1BzyBy/Gle(cB$zB5kQe[w^m0b2\u003e+uRbuJz2^HWB97#g07I0Ez2=}px(4Q1lVM:D", "n": [ { "c": 3, "d": "References Windows executable or script", "i": "objectives/execution/interpreter/script/shell::windows-executable-ref", "o": 20949, "z": 4, "cf": 0.6000000238418579 } ], "ln": 20933 }, { "b": "x!As}A+O@#x)Kifx(v\u003e?q*ACawO\u003c50wQ5qHn][]*e(Mt4x\u003c\u003e*(Dsp]fz/bLND2[7sz7XZ$w]83*BzkVh0cqZ[uRa)Fz/PzRz/f91BzkVh07}rJzB[FUz/PzR", "n": [ { "c": 2, "d": "Benign high-entropy PE context", "i": "metadata/package/quality/false-positives::benign-high-entropy-pe-context", "o": 21055, "z": 17, "cf": 0.949999988079071 }, { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 21024, "z": 16, "cf": 0.8500000238418579 } ], "ln": 21008 }, { "b": "vqPN.wmY*(A+PGmx(v\u003e?q*ACawO\u003c50wQ5qHn][]*07g^rvru6LzeBAqvpB4:mq^l+wPzi*y?lgQw]vVw", "n": [ { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 21384, "z": 16, "cf": 0.8500000238418579 } ], "ln": 21368 }, { "b": "D2Ns^zF0!!xkzG}vqE$=q*ACawO\u003c50wQ5qHn][]*e(Mt4x\u003c\u003e*(Dsp]fz/dg4wPRu\u003evrt{gnLj5xzD7[2", "n": [ { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 21465, "z": 16, "cf": 0.8500000238418579 } ], "ln": 21449 }, { "b": "B8L})A=k]dA==N#zF0!!q*ACawO\u003c4[x(m[\u003cnKESwBz(1ZBAzLqvS=^7p\u0026ZF$x\u003eg^}08)#Wx(mL", "n": [ { "c": 3, "d": "LINQ query operations", "i": "micro-behaviors/data/db/linq::linq-queries", "o": 21639, "z": 11, "cf": 0.699999988079071 } ], "ln": 21623 }, { "b": "wPzG[y?XibnmuyDy?mR!q*ACawO\u003c4!z!9AEz/49]z/6Dcy?mR!lVM:DBy!/PAaJ]MAa}:Uwn(E3zGFoTw[=c%BzkT", "n": [ { "c": 3, "d": ".NET dynamic code generation capability", "i": "metadata/lang/compiler/managed::dotnet-dynamic-code", "o": 21971, "z": 23, "cf": 0.8500000238418579 } ], "ln": 21955 }, { "b": "x(mN8004NF0rrf3r8[Eaq*ACawO\u003c50wQ5qHn][]*e(Mt4x\u003c\u003e*(Dsp]fz/dg1B8L}?zF%-ppgn0NzF8^:y?Wy8efE(pB97#ge(VzbBs{gbz/d9Gr+lq)x(v(Lf!+jle?![iefEr5y\u0026\u003c/uwJ:{xB-.Ujy+cY9BZ/f3v[QxUrbVL-", "n": [ { "c": 2, "d": "IPv4-like .NET assembly version", "i": "metadata/lang/compiler/managed::dotnet-ipv4-like-version", "o": 30280, "z": 16, "cf": 0.8500000238418579 }, { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 30208, "z": 16, "cf": 0.8500000238418579 } ], "ln": 30192 }, { "b": "zF8^:y?Wy80rr91r8[E8q*ACawO\u003c50wQ5qHn][]*e(Mt4x\u003c\u003e*(Dsp]fz/dg1B8L}/xkRTdwKyxNwncd1z/d9Gq*ACawO\u003c50wQ5qHn][]*efE#8A=U@kzAPZde?![ie?!?0lV)i!B-I4RzE)%j", "n": [ { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 30375, "z": 16, "cf": 0.8500000238418579 } ], "ln": 30359 }, { "b": "00000000000000000000000000000000000000315c8Xg7YTL^00000000000000000", "n": [ { "c": 1, "d": "PE resource section", "i": "metadata/binary/section/names::pe-resource-section", "o": 31232, "z": 5, "cf": 0.8999999761581421 } ], "ln": 31216 }, { "b": "0000000000000]ugYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006Xn[brp!0rrf35c8X", "n": [ { "c": 3, "d": "Recognized marker for timing checks", "i": "objectives/anti-analysis/timing/evasion::timing-anti-debug-recognized-marker", "o": 31326, "z": 15, "cf": 0.949999988079071 } ], "ln": 31310 }, { "b": "fAr{fvGn7Z002s=5Dz?ilJz38z2!IPve$fBC(QOtve$cAwDhYg002v^xAh-DyYFnKx-HH2ASxU", "n": [ { "c": 2, "d": "PE CompanyName metadata field", "i": "metadata/package/versioning::pe-companyname-field", "o": 31546, "z": 11, "cf": 0.699999988079071 } ], "ln": 31530 }, { "b": "zuaeDe=U\u003eK003)pbld-AmGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up002v^xAh-DyYFnKx-HH", "n": [ { "c": 2, "d": "PE FileDescription metadata field", "i": "metadata/package/versioning::pe-filedescription-field", "o": 31614, "z": 15, "cf": 0.699999988079071 } ], "ln": 31598 }, { "b": "k(+\u003c7x-Fbk001+O2(\u003c#amGvc5yYF2DrSDXhASydXx-J5Kzu6Up001.Nhukufg5@{bgxo3cfAq7M003)pcJBeEnDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE002v^xAh-DyYFnKx-HH2ASxUJ", "n": [ { "c": 3, "d": "Dotted-quad PE version metadata marker", "i": "objectives/command-and-control/infrastructure/ip::ipv4-version-metadata-marker", "o": 31726, "z": 11, "cf": 0.9399999976158142 }, { "c": 2, "d": "PE InternalName metadata field", "i": "metadata/package/versioning::pe-internalname-field", "o": 31778, "z": 12, "cf": 0.699999988079071 } ], "ln": 31710 }, { "b": "z#+d-ASx!Nx8(PBBn#pvlJz38z#+d-ASx!Nx8(PBBo0A-Sq[4vg5%0df-Tfkaoi$[aoluXAS", "n": [ { "c": 2, "d": "Copyright notice", "i": "metadata/package/license::copyright-word", "o": 31920, "z": 9, "cf": 0.6000000238418579 } ], "ln": 31904 }, { "b": "nDrSdv/OaY004fxcJBeEpxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE002v^xAh-DyYFnKx-HH2", "n": [ { "c": 2, "d": "PE OriginalFilename metadata field", "i": "metadata/package/versioning::pe-originalfilename-field", "o": 32014, "z": 16, "cf": 0.699999988079071 } ], "ln": 31998 }, { "b": "wb{ACyYBCn001LI1][V7pYLIozVBqFBPt[KBo25ove$cAwDhYg002:]x-JkPASy1T004@TgYNKRpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001.Nhukufg5@{bgxo0bz#Y", "n": [ { "c": 2, "d": "PE ProductName metadata field", "i": "metadata/package/versioning::pe-productname-field", "o": 32134, "z": 11, "cf": 0.699999988079071 }, { "c": 2, "d": "PE version resource metadata", "i": "metadata/package/versioning::version-resource-metadata", "o": 32178, "z": 14, "cf": 0.8999999761581421 } ], "ln": 32118 }, { "b": "000000000000000000000fvfX3\u0026*ncbStY6000000000000000000000000000000000", "n": [ { "c": 2, "d": "PE .reloc section presence", "i": "metadata/binary/section/names::reloc-section-presence", "o": 32768, "z": 6, "cf": 0.8999999761581421 } ], "ln": 32752 } ], "depth": 1, "facts": { "imp": [ [ "mscoree", "CorDllMain" ] ], "sec": [ [ ".text", 512, 30720, 5.98, "r-x" ], [ ".rsrc", 31232, 1536, 2.66, "r--" ], [ ".reloc", 32768, 512, 0.08, "r--" ] ], "metrics": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "resource_count": 1.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 98320.0, "reloc_overhang_bytes": 500.0, "reloc_overhang_ratio": 0.98, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "version.identity_entropy": 4.15, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0, "version.identity_symbol_ratio": 0.07 }, "file": { "size": 33280.0, "entropy": 5.78, "size_bytes": 33280.0 }, "binary": { "is_pie": 1.0, "code_entropy": 5.98, "string_count": 395.0, "overall_entropy": 5.78, "entropy_variance": 5.84, "avg_string_length": 23.85, "max_string_length": 166.0, "peak_region_bytes": 1024.0, "code_to_data_ratio": 1.0, "peak_region_entropy": 6.01, "string_length_stddev": 17.93, "largest_section_ratio": 0.92, "sentence_string_count": 14.0, "sentence_string_ratio": 0.04, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 30720.0, "entropy_max": 5.98, "entropy_mean": 2.91, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } } }, "id": 4, "mol": "O(Al)H(Db)", "path": "ChilliCream.Nitro.Adapters.OpenApi.16.2.3-p.2.nupkg!!lib/net10.0/ChilliCream.Nitro.Adapters.OpenApi.dll", "risk": 3, "sha": "fdfc90d956bbe2acb680a54d92a70a2c435c6e6288fe616d7af4e878618756f0", "size": 33280, "traits": [ { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 31326, 15 ] ] }, { "id": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "conf": 1.0, "crit": 3, "desc": "JSON polymorphism runtime marker", "spans": [ [ 18722, 16 ] ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "spans": [ [ 8524, 4 ] ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "spans": [ [ 31726, 11 ] ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "spans": [ [ 20949, 4 ] ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "spans": [ [ 32178, 14 ] ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "micro-behaviors/data/db/linq::linq-queries", "conf": 0.699999988079071, "crit": 3, "desc": "LINQ query operations", "spans": [ [ 21639, 11 ] ] }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "spans": [ [ 0, 26 ] ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "spans": [ [ 8524, 4 ] ] } ], "type": "pe" }, { "id": 5, "sha": "ebef83248b71cb736314cb1199b952e2d1d5146e292bc0021c32cdb1f7c02e08", "path": "ChilliCream.Nitro.Adapters.OpenApi.16.2.3-p.2.nupkg!!lib/net10.0/ChilliCream.Nitro.Adapters.OpenApi.xml", "size": 3371, "type": "xml", "depth": 1 }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J\u0026m(0jh", "n": [ { "c": 3, "d": "HTTP fingerprinting evasion campaign", "i": "objectives/command-and-control/infrastructure/user-agent::http-fingerprinting-campaign", "o": 0, "z": 34, "cf": 0.8999999761581421 } ], "ln": 0 }, { "b": "00000000000000000000zKHL900000nb@R\u00260SSx7tT5h*Q/^V$0rr91000000000000", "n": [ { "c": 1, "d": "PE standard code/data section", "i": "metadata/binary/section/names::pe-code-data-standard-section", "o": 512, "z": 5, "cf": 0.8999999761581421 } ], "ln": 496 }, { "b": "dJix+000vL1$x*b1$x*blq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn", "n": [ { "c": 3, "d": "Recognized PE anti-analysis marker", "i": "objectives/anti-analysis/debugger-detect/combined-checks::evasion-aware-recognized-pe-marker", "o": 8540, "z": 4, "cf": 1.0 } ], "ln": 8524 }, { "b": "nPNsBBy/uhx(v(Svrt]Tq*ACawO\u003c50wQ5qHn][]*e(Mt4x\u003c\u003e*(Dsp]fz/dg4wPRu\u003evrt]Tq*ACawO\u003c50", "n": [ { "c": 3, "d": "JSON polymorphism runtime marker", "i": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "o": 19030, "z": 16, "cf": 1.0 } ], "ln": 19014 }, { "b": "l1BzyBy/Gle(cB$zB5kQe[w^m0b2\u003e+uRbuJz2^HWB97#g07I0Ez2=}px(4Q1lVM:D", "n": [ { "c": 3, "d": "References Windows executable or script", "i": "objectives/execution/interpreter/script/shell::windows-executable-ref", "o": 21458, "z": 4, "cf": 0.6000000238418579 } ], "ln": 21442 }, { "b": "x!As}A+O@#x)Kifx(v\u003e?q*ACawO\u003c50wQ5qHn][]*e(Mt4x\u003c\u003e*(Dsp]fz/bLND2[7sz7XZ$w]83*BzkVh0cqZ[uRa)Fz/PzRz/f91BzkVh07}rJzB[FUz/PzR", "n": [ { "c": 2, "d": "Benign high-entropy PE context", "i": "metadata/package/quality/false-positives::benign-high-entropy-pe-context", "o": 21564, "z": 17, "cf": 0.949999988079071 }, { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 21533, "z": 16, "cf": 0.8500000238418579 } ], "ln": 21517 }, { "b": "vqPN.wmY*(A+PGmx(v\u003e?q*ACawO\u003c50wQ5qHn][]*07g^rvru6LzeBAqvpB4:mq^l+wPzi*y?lgQw]vVw", "n": [ { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 21974, "z": 16, "cf": 0.8500000238418579 } ], "ln": 21958 }, { "b": "D2Ns^zF0!!xkzG}vqE$=q*ACawO\u003c50wQ5qHn][]*e(Mt4x\u003c\u003e*(Dsp]fz/dg4wPRu\u003evrt{gnLj5xzD7[2", "n": [ { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 22055, "z": 16, "cf": 0.8500000238418579 } ], "ln": 22039 }, { "b": "B8L})A=k]dA==N#zF0!!q*ACawO\u003c4[x(m[\u003cnKESwBz(1ZBAzLqvS=^7p\u0026ZF$x\u003eg^}08)#Wx(mL", "n": [ { "c": 3, "d": "LINQ query operations", "i": "micro-behaviors/data/db/linq::linq-queries", "o": 22229, "z": 11, "cf": 0.699999988079071 } ], "ln": 22213 }, { "b": "wPzG[y?XibnmuyDy?mR!q*ACawO\u003c4!z!9AEz/49]z/6Dcy?mR!lVM:DBy!/PAaJ]MAa}:Uwn(E3zGFoTw[=c%BzkT", "n": [ { "c": 3, "d": ".NET dynamic code generation capability", "i": "metadata/lang/compiler/managed::dotnet-dynamic-code", "o": 22561, "z": 23, "cf": 0.8500000238418579 } ], "ln": 22545 }, { "b": "x(mN8004NF0rrf3r8[Eaq*ACawO\u003c50wQ5qHn][]*e(Mt4x\u003c\u003e*(Dsp]fz/dg1B8L}?zF%-ppgn0NzF8^:y?Wy8efE(pB97#ge(VzbBs{gbz/d9Gr+lq)x(v(Lf!\u003epme?![iefEr5y\u0026\u003c/uwJ:{xB-.Ujy+cY9BZ/f3v[QxUrbVL-", "n": [ { "c": 2, "d": "IPv4-like .NET assembly version", "i": "metadata/lang/compiler/managed::dotnet-ipv4-like-version", "o": 31154, "z": 16, "cf": 0.8500000238418579 }, { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 31082, "z": 16, "cf": 0.8500000238418579 } ], "ln": 31066 }, { "b": "zF8^:y?Wy80rr91r8[E8q*ACawO\u003c50wQ5qHn][]*e(Mt4x\u003c\u003e*(Dsp]fz/dg1B8L}/xkRTdwKyxNwncd1z/d9Gq*ACawO\u003c50wQ5qHn][]*efE#8A=U@kzAPZee?![ie?!?0lV)i!B-I4RzE)%j", "n": [ { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 31249, "z": 16, "cf": 0.8500000238418579 } ], "ln": 31233 }, { "b": "00000000000000000000000000000000000000315c8Xg7YTL^00000000000000000", "n": [ { "c": 1, "d": "PE resource section", "i": "metadata/binary/section/names::pe-resource-section", "o": 32256, "z": 5, "cf": 0.8999999761581421 } ], "ln": 32240 }, { "b": "0000000000000]ugYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006Xn[brp!0rrf35c8X", "n": [ { "c": 3, "d": "Recognized marker for timing checks", "i": "objectives/anti-analysis/timing/evasion::timing-anti-debug-recognized-marker", "o": 32350, "z": 15, "cf": 0.949999988079071 } ], "ln": 32334 }, { "b": "fAr{fvGn7Z002s=5Dz?ilJz38z2!IPve$fBC(QOtve$cAwDhYg002v^xAh-DyYFnKx-HH2ASxU", "n": [ { "c": 2, "d": "PE CompanyName metadata field", "i": "metadata/package/versioning::pe-companyname-field", "o": 32570, "z": 11, "cf": 0.699999988079071 } ], "ln": 32554 }, { "b": "zuaeDe=U\u003eK003)pbld-AmGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up002v^xAh-DyYFnKx-HH", "n": [ { "c": 2, "d": "PE FileDescription metadata field", "i": "metadata/package/versioning::pe-filedescription-field", "o": 32638, "z": 15, "cf": 0.699999988079071 } ], "ln": 32622 }, { "b": "k(+\u003c7x-Fbk001+O2(\u003c#amGvc5yYF2DrSDXhASydXx-J5Kzu6Up001.Nhukufg5@{bgxo3cfAq7M003)pcJBeEnDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE002v^xAh-DyYFnKx-HH2ASxUJ", "n": [ { "c": 3, "d": "Dotted-quad PE version metadata marker", "i": "objectives/command-and-control/infrastructure/ip::ipv4-version-metadata-marker", "o": 32750, "z": 11, "cf": 0.9399999976158142 }, { "c": 2, "d": "PE InternalName metadata field", "i": "metadata/package/versioning::pe-internalname-field", "o": 32802, "z": 12, "cf": 0.699999988079071 } ], "ln": 32734 }, { "b": "z#+d-ASx!Nx8(PBBn#pvlJz38z#+d-ASx!Nx8(PBBo0A-Sq[4vg5%0df-Tfkaoi$[aoluXAS", "n": [ { "c": 2, "d": "Copyright notice", "i": "metadata/package/license::copyright-word", "o": 32944, "z": 9, "cf": 0.6000000238418579 } ], "ln": 32928 }, { "b": "nDrSdv/OaY004fxcJBeEpxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE002v^xAh-DyYFnKx-HH2", "n": [ { "c": 2, "d": "PE OriginalFilename metadata field", "i": "metadata/package/versioning::pe-originalfilename-field", "o": 33038, "z": 16, "cf": 0.699999988079071 } ], "ln": 33022 }, { "b": "wb{ACyYBCn001LI1][V7pYLIozVBqFBPt[KBo25ove$cAwDhYg002:]x-JkPASy1T004@TgYNKRpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001.Nhukufg5@{bgxo0bz#Y", "n": [ { "c": 2, "d": "PE ProductName metadata field", "i": "metadata/package/versioning::pe-productname-field", "o": 33158, "z": 11, "cf": 0.699999988079071 }, { "c": 2, "d": "PE version resource metadata", "i": "metadata/package/versioning::version-resource-metadata", "o": 33202, "z": 14, "cf": 0.8999999761581421 } ], "ln": 33142 }, { "b": "000000000000000000000fvfX3\u0026*ncKu9vw000000000000000000000000000000000", "n": [ { "c": 2, "d": "PE .reloc section presence", "i": "metadata/binary/section/names::reloc-section-presence", "o": 33792, "z": 6, "cf": 0.8999999761581421 } ], "ln": 33776 } ], "depth": 1, "facts": { "imp": [ [ "mscoree", "CorDllMain" ] ], "sec": [ [ ".text", 512, 31744, 5.96, "r-x" ], [ ".rsrc", 32256, 1536, 2.66, "r--" ], [ ".reloc", 33792, 512, 0.08, "r--" ] ], "metrics": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "resource_count": 1.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 74998.0, "reloc_overhang_bytes": 500.0, "reloc_overhang_ratio": 0.98, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "version.identity_entropy": 4.15, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0, "version.identity_symbol_ratio": 0.07 }, "file": { "size": 34304.0, "entropy": 5.76, "size_bytes": 34304.0 }, "binary": { "is_pie": 1.0, "code_entropy": 5.96, "string_count": 408.0, "overall_entropy": 5.76, "entropy_variance": 5.79, "avg_string_length": 24.14, "max_string_length": 166.0, "peak_region_bytes": 2048.0, "code_to_data_ratio": 1.0, "peak_region_entropy": 5.94, "string_length_stddev": 17.75, "largest_section_ratio": 0.93, "sentence_string_count": 13.0, "sentence_string_ratio": 0.03, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 31744.0, "entropy_max": 5.96, "entropy_mean": 2.9, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } } }, "id": 6, "mol": "O(Al)H(Db)", "path": "ChilliCream.Nitro.Adapters.OpenApi.16.2.3-p.2.nupkg!!lib/net11.0/ChilliCream.Nitro.Adapters.OpenApi.dll", "risk": 3, "sha": "38cd7e0433d4b6eae8f82d866d56e72b9a1b87db426544d358df9c4ff57c4e80", "size": 34304, "traits": [ { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 32350, 15 ] ] }, { "id": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "conf": 1.0, "crit": 3, "desc": "JSON polymorphism runtime marker", "spans": [ [ 19030, 16 ] ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "spans": [ [ 8540, 4 ] ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "spans": [ [ 32750, 11 ] ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "spans": [ [ 21458, 4 ] ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "spans": [ [ 33202, 14 ] ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "micro-behaviors/data/db/linq::linq-queries", "conf": 0.699999988079071, "crit": 3, "desc": "LINQ query operations", "spans": [ [ 22229, 11 ] ] }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "spans": [ [ 0, 26 ] ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "spans": [ [ 8540, 4 ] ] } ], "type": "pe" }, { "id": 7, "sha": "ebef83248b71cb736314cb1199b952e2d1d5146e292bc0021c32cdb1f7c02e08", "path": "ChilliCream.Nitro.Adapters.OpenApi.16.2.3-p.2.nupkg!!lib/net11.0/ChilliCream.Nitro.Adapters.OpenApi.xml", "size": 3371, "type": "xml", "depth": 1 }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J\u0026m(0jh", "n": [ { "c": 3, "d": "HTTP fingerprinting evasion campaign", "i": "objectives/command-and-control/infrastructure/user-agent::http-fingerprinting-campaign", "o": 0, "z": 34, "cf": 0.8999999761581421 } ], "ln": 0 }, { "b": "000000000000000000006]@s{00000nb@R\u00260SSx7D]?rdek=DF0rr91000000000000", "n": [ { "c": 1, "d": "PE standard code/data section", "i": "metadata/binary/section/names::pe-code-data-standard-section", "o": 512, "z": 5, "cf": 0.8999999761581421 } ], "ln": 496 }, { "b": "dJixR000vL1$x*b1$x*blq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn", "n": [ { "c": 3, "d": "Recognized PE anti-analysis marker", "i": "objectives/anti-analysis/debugger-detect/combined-checks::evasion-aware-recognized-pe-marker", "o": 7548, "z": 4, "cf": 1.0 } ], "ln": 7532 }, { "b": "nPNsBBy/uhx(v(Svrt]Tq*ACawO\u003c50wQ5qHn][]*e(Mt4x\u003c\u003e*(Dsp]fz/dg4wPRu\u003evrt]Tq*ACawO\u003c50", "n": [ { "c": 3, "d": "JSON polymorphism runtime marker", "i": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "o": 16852, "z": 16, "cf": 1.0 } ], "ln": 16836 }, { "b": "l1BzyBy/Gle(cB$zB5kQe[w^m0b2\u003e+uRbuJz2^HWB97#g07I0Ez2=}px(4Q1lVM:D", "n": [ { "c": 3, "d": "References Windows executable or script", "i": "objectives/execution/interpreter/script/shell::windows-executable-ref", "o": 19079, "z": 4, "cf": 0.6000000238418579 } ], "ln": 19063 }, { "b": "x!As}A+O@#x)Kifx(v\u003e?q*ACawO\u003c50wQ5qHn][]*e(Mt4x\u003c\u003e*(Dsp]fz/bLND2[7sz7XZ$w]83*BzkVh0cqZ[uRa)Fz/PzRz/f91BzkVh07}rJzB[FUz/PzR", "n": [ { "c": 2, "d": "Benign high-entropy PE context", "i": "metadata/package/quality/false-positives::benign-high-entropy-pe-context", "o": 19185, "z": 17, "cf": 0.949999988079071 }, { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 19154, "z": 16, "cf": 0.8500000238418579 } ], "ln": 19138 }, { "b": "vqPN.wmY*(A+PGmx(v\u003e?q*ACawO\u003c50wQ5qHn][]*07g^rvru6LzeBAqvpB4:mq^l+wPzi*y?lgQw]vVw", "n": [ { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 19514, "z": 16, "cf": 0.8500000238418579 } ], "ln": 19498 }, { "b": "D2Ns^zF0!!xkzG}vqE$=q*ACawO\u003c50wQ5qHn][]*e(Mt4x\u003c\u003e*(Dsp]fz/dg4wPRu\u003evrt{gnLj5xzD7[2", "n": [ { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 19595, "z": 16, "cf": 0.8500000238418579 } ], "ln": 19579 }, { "b": "B8L})A=k]dA==N#zF0!!q*ACawO\u003c4[x(m[\u003cq/)4]zF8pUx(4r\u003eASxM\u003ex(4r\u003eASwNHvp%B*zGF+", "n": [ { "c": 3, "d": "LINQ query operations", "i": "micro-behaviors/data/db/linq::linq-queries", "o": 19753, "z": 11, "cf": 0.699999988079071 } ], "ln": 19737 }, { "b": "wPzG[y?XibnmuyDy?mR!q*ACawO\u003c4!z!9AEz/49]z/6Dcy?mR!lVM:DBy!/PAaJ]MAa}:Uwn(E3zGFoTw[=c%BzkT", "n": [ { "c": 3, "d": ".NET dynamic code generation capability", "i": "metadata/lang/compiler/managed::dotnet-dynamic-code", "o": 20035, "z": 23, "cf": 0.8500000238418579 } ], "ln": 20019 }, { "b": "x(mN8004ND0rrf3r8[E9q*ACawO\u003c50wQ5qHn][]*e(Mt4x\u003c\u003e*(Dsp]fz/dg1B8L}?zF%-ppgn0NzF8^:y?Wy8efE(pB97#ge(VzbBs{gbz/d9Gr+lq)x(v(Li4=)qfFk4gavyo/BAIRnj-j?NBAg/aefE=ivR/:*oj-xFz!\u0026[", "n": [ { "c": 2, "d": "IPv4-like .NET assembly version", "i": "metadata/lang/compiler/managed::dotnet-ipv4-like-version", "o": 28254, "z": 15, "cf": 0.8500000238418579 }, { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 28182, "z": 16, "cf": 0.8500000238418579 } ], "ln": 28166 }, { "b": "zF8^:y?Wy80rr91r8[E7q*ACawO\u003c50wQ5qHn][]*e(Mt4x\u003c\u003e*(Dsp]fz/dg1B8L}/xkRTdwKyxNwncd1z/d9Gq*ACawO\u003c50wQ5qHn][]*efE#8A=U@kzAP%ifFk4ifF1tlB.(exA+dyKwP-9n", "n": [ { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 28348, "z": 16, "cf": 0.8500000238418579 } ], "ln": 28332 }, { "b": "00000000000000000000000000000000000000315c8Xg7YTL^00000000000000000", "n": [ { "c": 1, "d": "PE resource section", "i": "metadata/binary/section/names::pe-resource-section", "o": 29184, "z": 5, "cf": 0.8999999761581421 } ], "ln": 29168 }, { "b": "0000000000000]ugYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006Xn[brp!0rrf35c8X", "n": [ { "c": 3, "d": "Recognized marker for timing checks", "i": "objectives/anti-analysis/timing/evasion::timing-anti-debug-recognized-marker", "o": 29278, "z": 15, "cf": 0.949999988079071 } ], "ln": 29262 }, { "b": "fAr{fvGn7Z002s=5Dz?ilJz38z2!IPve$fBC(QOtve$cAwDhYg002v^xAh-DyYFnKx-HH2ASxU", "n": [ { "c": 2, "d": "PE CompanyName metadata field", "i": "metadata/package/versioning::pe-companyname-field", "o": 29498, "z": 11, "cf": 0.699999988079071 } ], "ln": 29482 }, { "b": "zuaeDe=U\u003eK003)pbld-AmGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up002v^xAh-DyYFnKx-HH", "n": [ { "c": 2, "d": "PE FileDescription metadata field", "i": "metadata/package/versioning::pe-filedescription-field", "o": 29566, "z": 15, "cf": 0.699999988079071 } ], "ln": 29550 }, { "b": "k(+\u003c7x-Fbk001+O2(\u003c#amGvc5yYF2DrSDXhASydXx-J5Kzu6Up001.Nhukufg5@{bgxo3cfAq7M003)pcJBeEnDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE002v^xAh-DyYFnKx-HH2ASxUJ", "n": [ { "c": 3, "d": "Dotted-quad PE version metadata marker", "i": "objectives/command-and-control/infrastructure/ip::ipv4-version-metadata-marker", "o": 29678, "z": 11, "cf": 0.9399999976158142 }, { "c": 2, "d": "PE InternalName metadata field", "i": "metadata/package/versioning::pe-internalname-field", "o": 29730, "z": 12, "cf": 0.699999988079071 } ], "ln": 29662 }, { "b": "z#+d-ASx!Nx8(PBBn#pvlJz38z#+d-ASx!Nx8(PBBo0A-Sq[4vg5%0df-Tfkaoi$[aoluXAS", "n": [ { "c": 2, "d": "Copyright notice", "i": "metadata/package/license::copyright-word", "o": 29872, "z": 9, "cf": 0.6000000238418579 } ], "ln": 29856 }, { "b": "nDrSdv/OaY004fxcJBeEpxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE002v^xAh-DyYFnKx-HH2", "n": [ { "c": 2, "d": "PE OriginalFilename metadata field", "i": "metadata/package/versioning::pe-originalfilename-field", "o": 29966, "z": 16, "cf": 0.699999988079071 } ], "ln": 29950 }, { "b": "wb{ACyYBCn001LI1][V7pYLIozVBqFBPt[KBo25ove$cAwDhYg002:]x-JkPASy1T004@TgYNKRpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001.Nhukufg5@{bgxo0bz#Y", "n": [ { "c": 2, "d": "PE ProductName metadata field", "i": "metadata/package/versioning::pe-productname-field", "o": 30086, "z": 11, "cf": 0.699999988079071 }, { "c": 2, "d": "PE version resource metadata", "i": "metadata/package/versioning::version-resource-metadata", "o": 30130, "z": 14, "cf": 0.8999999761581421 } ], "ln": 30070 }, { "b": "000000000000000000000dU4H3\u0026*nci6Nxy000000000000000000000000000000000", "n": [ { "c": 2, "d": "PE .reloc section presence", "i": "metadata/binary/section/names::reloc-section-presence", "o": 30720, "z": 6, "cf": 0.8999999761581421 } ], "ln": 30704 } ], "depth": 1, "facts": { "imp": [ [ "mscoree", "CorDllMain" ] ], "sec": [ [ ".text", 512, 28672, 5.95, "r-x" ], [ ".rsrc", 29184, 1536, 2.66, "r--" ], [ ".reloc", 30720, 512, 0.08, "r--" ] ], "metrics": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "resource_count": 1.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 46045.0, "reloc_overhang_bytes": 500.0, "reloc_overhang_ratio": 0.98, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "version.identity_entropy": 4.15, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0, "version.identity_symbol_ratio": 0.07 }, "file": { "size": 31232.0, "entropy": 5.73, "size_bytes": 31232.0 }, "binary": { "is_pie": 1.0, "code_entropy": 5.95, "string_count": 380.0, "overall_entropy": 5.73, "entropy_variance": 5.76, "avg_string_length": 23.32, "max_string_length": 165.0, "peak_region_bytes": 5120.0, "code_to_data_ratio": 1.0, "peak_region_entropy": 5.8, "string_length_stddev": 17.87, "largest_section_ratio": 0.92, "sentence_string_count": 14.0, "sentence_string_ratio": 0.04, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 28672.0, "entropy_max": 5.95, "entropy_mean": 2.89, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } } }, "id": 8, "mol": "O(Al)H(Db)", "path": "ChilliCream.Nitro.Adapters.OpenApi.16.2.3-p.2.nupkg!!lib/net8.0/ChilliCream.Nitro.Adapters.OpenApi.dll", "risk": 3, "sha": "692f6495aa324955ed4e320bfb1cef21cdcbfb79e027df338d38845b48579fde", "size": 31232, "traits": [ { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 29278, 15 ] ] }, { "id": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "conf": 1.0, "crit": 3, "desc": "JSON polymorphism runtime marker", "spans": [ [ 16852, 16 ] ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "spans": [ [ 7548, 4 ] ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "spans": [ [ 29678, 11 ] ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "spans": [ [ 19079, 4 ] ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "spans": [ [ 30130, 14 ] ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "micro-behaviors/data/db/linq::linq-queries", "conf": 0.699999988079071, "crit": 3, "desc": "LINQ query operations", "spans": [ [ 19753, 11 ] ] }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "spans": [ [ 0, 26 ] ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "spans": [ [ 7548, 4 ] ] } ], "type": "pe" }, { "id": 9, "sha": "ebef83248b71cb736314cb1199b952e2d1d5146e292bc0021c32cdb1f7c02e08", "path": "ChilliCream.Nitro.Adapters.OpenApi.16.2.3-p.2.nupkg!!lib/net8.0/ChilliCream.Nitro.Adapters.OpenApi.xml", "size": 3371, "type": "xml", "depth": 1 }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J\u0026m(0jh", "n": [ { "c": 3, "d": "HTTP fingerprinting evasion campaign", "i": "objectives/command-and-control/infrastructure/user-agent::http-fingerprinting-campaign", "o": 0, "z": 34, "cf": 0.8999999761581421 } ], "ln": 0 }, { "b": "00000000000000000000nTGFT00000nb@R\u00260SSx7y^d[1A902t0rr91000000000000", "n": [ { "c": 1, "d": "PE standard code/data section", "i": "metadata/binary/section/names::pe-code-data-standard-section", "o": 512, "z": 5, "cf": 0.8999999761581421 } ], "ln": 496 }, { "b": "dJix+000vL1$x*b1$x*blq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn", "n": [ { "c": 3, "d": "Recognized PE anti-analysis marker", "i": "objectives/anti-analysis/debugger-detect/combined-checks::evasion-aware-recognized-pe-marker", "o": 8556, "z": 4, "cf": 1.0 } ], "ln": 8540 }, { "b": "nPNsBBy/uhx(v(Svrt]Tq*ACawO\u003c50wQ5qHn][]*e(Mt4x\u003c\u003e*(Dsp]fz/dg4wPRu\u003evrt]Tq*ACawO\u003c50", "n": [ { "c": 3, "d": "JSON polymorphism runtime marker", "i": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "o": 18898, "z": 16, "cf": 1.0 } ], "ln": 18882 }, { "b": "l1BzyBy/Gle(cB$zB5kQe[w^m0b2\u003e+uRbuJz2^HWB97#g07I0Ez2=}px(4Q1lVM:D", "n": [ { "c": 3, "d": "References Windows executable or script", "i": "objectives/execution/interpreter/script/shell::windows-executable-ref", "o": 21189, "z": 4, "cf": 0.6000000238418579 } ], "ln": 21173 }, { "b": "x!As}A+O@#x)Kifx(v\u003e?q*ACawO\u003c50wQ5qHn][]*e(Mt4x\u003c\u003e*(Dsp]fz/bLND2[7sz7XZ$w]83*BzkVh0cqZ[uRa)Fz/PzRz/f91BzkVh07}rJzB[FUz/PzR", "n": [ { "c": 2, "d": "Benign high-entropy PE context", "i": "metadata/package/quality/false-positives::benign-high-entropy-pe-context", "o": 21295, "z": 17, "cf": 0.949999988079071 }, { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 21264, "z": 16, "cf": 0.8500000238418579 } ], "ln": 21248 }, { "b": "vqPN.wmY*(A+PGmx(v\u003e?q*ACawO\u003c50wQ5qHn][]*07g^rvru6LzeBAqvpB4:mq^l+wPzi*y?lgQw]vVw", "n": [ { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 21624, "z": 16, "cf": 0.8500000238418579 } ], "ln": 21608 }, { "b": "D2Ns^zF0!!xkzG}vqE$=q*ACawO\u003c50wQ5qHn][]*e(Mt4x\u003c\u003e*(Dsp]fz/dg4wPRu\u003evrt{gnLj5xzD7[2", "n": [ { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 21705, "z": 16, "cf": 0.8500000238418579 } ], "ln": 21689 }, { "b": "B8L})A=k]dA==N#zF0!!q*ACawO\u003c4[x(m[\u003cnKESwBz(1ZBAzLqvS=^7p\u0026ZF$x\u003eg^}08)#Wx(mL", "n": [ { "c": 3, "d": "LINQ query operations", "i": "micro-behaviors/data/db/linq::linq-queries", "o": 21879, "z": 11, "cf": 0.699999988079071 } ], "ln": 21863 }, { "b": "wPzG[y?XibnmuyDy?mR!q*ACawO\u003c4!z!9AEz/49]z/6Dcy?mR!lVM:DBy!/PAaJ]MAa}:Uwn(E3zGFoTw[=c%BzkT", "n": [ { "c": 3, "d": ".NET dynamic code generation capability", "i": "metadata/lang/compiler/managed::dotnet-dynamic-code", "o": 22211, "z": 23, "cf": 0.8500000238418579 } ], "ln": 22195 }, { "b": "x(mN8004ND0rrf3r8[E9q*ACawO\u003c50wQ5qHn][]*e(Mt4x\u003c\u003e*(Dsp]fz/dg1B8L}?zF%-ppgn0NzF8^:y?Wy8efE(pB97#ge(VzbBs{gbz/d9Gr+lq)x(v(Liw90rfFk4gavyo/BAIRnj-j?NBAg/aefE=ivR/:*oj-xFz!\u0026[", "n": [ { "c": 2, "d": "IPv4-like .NET assembly version", "i": "metadata/lang/compiler/managed::dotnet-ipv4-like-version", "o": 30609, "z": 15, "cf": 0.8500000238418579 }, { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 30537, "z": 16, "cf": 0.8500000238418579 } ], "ln": 30521 }, { "b": "zF8^:y?Wy80rr91r8[E7q*ACawO\u003c50wQ5qHn][]*e(Mt4x\u003c\u003e*(Dsp]fz/dg1B8L}/xkRTdwKyxNwncd1z/d9Gq*ACawO\u003c50wQ5qHn][]*efE#8A=U@kzAQ0jfFk4ifF1tlB.(exA+dyKwP-9n", "n": [ { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 30703, "z": 16, "cf": 0.8500000238418579 } ], "ln": 30687 }, { "b": "00000000000000000000000000000000000000315c8Xg7YTL^00000000000000000", "n": [ { "c": 1, "d": "PE resource section", "i": "metadata/binary/section/names::pe-resource-section", "o": 31744, "z": 5, "cf": 0.8999999761581421 } ], "ln": 31728 }, { "b": "0000000000000]ugYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006Xn[brp!0rrf35c8X", "n": [ { "c": 3, "d": "Recognized marker for timing checks", "i": "objectives/anti-analysis/timing/evasion::timing-anti-debug-recognized-marker", "o": 31838, "z": 15, "cf": 0.949999988079071 } ], "ln": 31822 }, { "b": "fAr{fvGn7Z002s=5Dz?ilJz38z2!IPve$fBC(QOtve$cAwDhYg002v^xAh-DyYFnKx-HH2ASxU", "n": [ { "c": 2, "d": "PE CompanyName metadata field", "i": "metadata/package/versioning::pe-companyname-field", "o": 32058, "z": 11, "cf": 0.699999988079071 } ], "ln": 32042 }, { "b": "zuaeDe=U\u003eK003)pbld-AmGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up002v^xAh-DyYFnKx-HH", "n": [ { "c": 2, "d": "PE FileDescription metadata field", "i": "metadata/package/versioning::pe-filedescription-field", "o": 32126, "z": 15, "cf": 0.699999988079071 } ], "ln": 32110 }, { "b": "k(+\u003c7x-Fbk001+O2(\u003c#amGvc5yYF2DrSDXhASydXx-J5Kzu6Up001.Nhukufg5@{bgxo3cfAq7M003)pcJBeEnDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE002v^xAh-DyYFnKx-HH2ASxUJ", "n": [ { "c": 3, "d": "Dotted-quad PE version metadata marker", "i": "objectives/command-and-control/infrastructure/ip::ipv4-version-metadata-marker", "o": 32238, "z": 11, "cf": 0.9399999976158142 }, { "c": 2, "d": "PE InternalName metadata field", "i": "metadata/package/versioning::pe-internalname-field", "o": 32290, "z": 12, "cf": 0.699999988079071 } ], "ln": 32222 }, { "b": "z#+d-ASx!Nx8(PBBn#pvlJz38z#+d-ASx!Nx8(PBBo0A-Sq[4vg5%0df-Tfkaoi$[aoluXAS", "n": [ { "c": 2, "d": "Copyright notice", "i": "metadata/package/license::copyright-word", "o": 32432, "z": 9, "cf": 0.6000000238418579 } ], "ln": 32416 }, { "b": "nDrSdv/OaY004fxcJBeEpxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE002v^xAh-DyYFnKx-HH2", "n": [ { "c": 2, "d": "PE OriginalFilename metadata field", "i": "metadata/package/versioning::pe-originalfilename-field", "o": 32526, "z": 16, "cf": 0.699999988079071 } ], "ln": 32510 }, { "b": "wb{ACyYBCn001LI1][V7pYLIozVBqFBPt[KBo25ove$cAwDhYg002:]x-JkPASy1T004@TgYNKRpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001.Nhukufg5@{bgxo0bz#Y", "n": [ { "c": 2, "d": "PE ProductName metadata field", "i": "metadata/package/versioning::pe-productname-field", "o": 32646, "z": 11, "cf": 0.699999988079071 }, { "c": 2, "d": "PE version resource metadata", "i": "metadata/package/versioning::version-resource-metadata", "o": 32690, "z": 14, "cf": 0.8999999761581421 } ], "ln": 32630 }, { "b": "000000000000000000000fvfX3\u0026*ncy=zy{000000000000000000000000000000000", "n": [ { "c": 2, "d": "PE .reloc section presence", "i": "metadata/binary/section/names::reloc-section-presence", "o": 33280, "z": 6, "cf": 0.8999999761581421 } ], "ln": 33264 } ], "depth": 1, "facts": { "imp": [ [ "mscoree", "CorDllMain" ] ], "sec": [ [ ".text", 512, 31232, 5.94, "r-x" ], [ ".rsrc", 31744, 1536, 2.66, "r--" ], [ ".reloc", 33280, 512, 0.08, "r--" ] ], "metrics": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "resource_count": 1.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 67759.0, "reloc_overhang_bytes": 500.0, "reloc_overhang_ratio": 0.98, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "version.identity_entropy": 4.15, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0, "version.identity_symbol_ratio": 0.07 }, "file": { "size": 33792.0, "entropy": 5.74, "size_bytes": 33792.0 }, "binary": { "is_pie": 1.0, "code_entropy": 5.94, "string_count": 402.0, "overall_entropy": 5.74, "entropy_variance": 5.75, "avg_string_length": 23.71, "max_string_length": 165.0, "peak_region_bytes": 2048.0, "code_to_data_ratio": 1.0, "peak_region_entropy": 5.99, "string_length_stddev": 17.74, "largest_section_ratio": 0.92, "sentence_string_count": 14.0, "sentence_string_ratio": 0.03, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 31232.0, "entropy_max": 5.94, "entropy_mean": 2.89, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } } }, "id": 10, "mol": "O(Al)H(Db)", "path": "ChilliCream.Nitro.Adapters.OpenApi.16.2.3-p.2.nupkg!!lib/net9.0/ChilliCream.Nitro.Adapters.OpenApi.dll", "risk": 3, "sha": "0416a1126cc829111c3d08cea873de33e1f8e0ecacaa8090cd1774c02ef4ffeb", "size": 33792, "traits": [ { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 31838, 15 ] ] }, { "id": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "conf": 1.0, "crit": 3, "desc": "JSON polymorphism runtime marker", "spans": [ [ 18898, 16 ] ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "spans": [ [ 8556, 4 ] ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "spans": [ [ 32238, 11 ] ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "spans": [ [ 21189, 4 ] ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "spans": [ [ 32690, 14 ] ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "micro-behaviors/data/db/linq::linq-queries", "conf": 0.699999988079071, "crit": 3, "desc": "LINQ query operations", "spans": [ [ 21879, 11 ] ] }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "spans": [ [ 0, 26 ] ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "spans": [ [ 8556, 4 ] ] } ], "type": "pe" }, { "id": 11, "sha": "ebef83248b71cb736314cb1199b952e2d1d5146e292bc0021c32cdb1f7c02e08", "path": "ChilliCream.Nitro.Adapters.OpenApi.16.2.3-p.2.nupkg!!lib/net9.0/ChilliCream.Nitro.Adapters.OpenApi.xml", "size": 3371, "type": "xml", "depth": 1 }, { "id": 12, "sha": "8b57519dc3bda592686d433fd39c64bf4f12c2ec0328de411b1842e9d84e56de", "path": "ChilliCream.Nitro.Adapters.OpenApi.16.2.3-p.2.nupkg!!nitro-icon.png", "size": 4890, "type": "png", "depth": 1 }, { "id": 13, "sha": "afeb9584632638a4fd4b2f37aa41f4260475fb65f3200e6cf67c9ddaaf9d48bd", "path": "ChilliCream.Nitro.Adapters.OpenApi.16.2.3-p.2.nupkg!![Content_Types].xml", "size": 650, "type": "xml", "depth": 1 }, { "id": 14, "sha": "f4aec4419716dcd67137097581bcd0055ecd4459463a3b55f88d30b203015806", "path": "ChilliCream.Nitro.Adapters.OpenApi.16.2.3-p.2.nupkg!!package/services/metadata/core-properties/36E9519740578DCBC1518EEC76739566.psmdcp", "size": 682, "type": "xml", "depth": 1 }, { "id": 15, "sha": "89576c2878c791b3baea1750138e717c9715a73ab4b3bf019b232da23c4526c5", "path": "ChilliCream.Nitro.Adapters.OpenApi@16.5.0-p.1.registry.json", "size": 822, "type": "registry", "depth": 1 } ], "omitted_files": 10, "rev": "20834", "v": "8" } }