{ "llm": { "conf": 0.8999418, "grade": "benign", "model": "Qwen/Qwen3.6-27B", "review": false, "outcome": "benign", "interpretation": "Legitimate .NET library assembly" }, "ml": { "v": "7", "eng": "2.2.0-rc.1", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.19194536, "rte": "az", "prob": 0.19194536 } ], "prob": 0.8570597, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.8570597171783447, "type": "nupkg" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.8570597171783447, "type": "xml" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.000041544437408447266, "type": "xml" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.000011404355063859839, "type": "markdown" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.8570597171783447, "type": "pe" }, { "id": 5, "lvl": -1, "conf": 0, "prob": 0.000011652708053588867, "type": "xml" }, { "id": 6, "lvl": -1, "conf": 0, "prob": 0.00002057353594864253, "type": "pe" }, { "id": 7, "lvl": -1, "conf": 0, "prob": 0.000011652708053588867, "type": "xml" }, { "id": 8, "lvl": -1, "conf": 0, "prob": 0.854792058467865, "type": "pe" }, { "id": 9, "lvl": -1, "conf": 0, "prob": 0.000011652708053588867, "type": "xml" }, { "id": 10, "lvl": -1, "conf": 0, "prob": 0.8570597171783447, "type": "xml" }, { "id": 11, "lvl": -1, "conf": 0, "prob": 0.000010907649993896484, "type": "xml" }, { "id": 12, "lvl": -1, "conf": 0, "prob": 0.00001085797975974856, "type": "registry" } ], "version": "v18.18", "analyzed_at": "2026-06-28T01:39:09Z" }, "path": "Artkinx.ScalarAspNetCore.Annotations.1.0.0-preview.10.nupkg", "raw": { "files": [ { "id": 0, "mol": "O(Al)H₂(CmDb)", "sha": "719923f7ee7cb003aede2e88c14c634f98856c184e3c6da2b2489c37a15fc431", "path": "Artkinx.ScalarAspNetCore.Annotations.1.0.0-preview.10.nupkg", "risk": 4, "size": 63560, "type": "nupkg", "facts": { "metrics": { "file": { "size": 63560.0, "entropy": 7.97, "size_bytes": 63560.0 }, "binary": { "overall_entropy": 7.97, "peak_region_bytes": 60416.0, "peak_region_entropy": 7.81 }, "archive": { "file_count": 12.0, "member_count": 12.0, "script_count": 0.0, "zip_bomb_ratio": 5.65, "directory_count": 0.0, "executable_count": 3.0, "extra_field_size": 0.0, "noise_file_count": 0.0, "total_compressed": 61656.0, "compression.ratio": 0.35, "hidden_file_count": 2.0, "total_uncompressed": 175559.0, "crc_collision_count": 0.0, "entry_comment_count": 0.0, "max_filename_length": 81.0, "rtlo_filename_count": 0.0, "format.regular_count": 12.0, "nested_archive_count": 0.0, "path_traversal_count": 0.0, "symlink_escape_count": 0.0, "security.setgid_count": 0.0, "security.setuid_count": 0.0, "security.sticky_count": 0.0, "double_extension_count": 0.0, "duplicate_member_count": 0.0, "security.symlink_count": 0.0, "unicode_filename_count": 0.0, "homoglyph_filename_count": 0.0, "security.encrypted_count": 0.0, "timing.mtime_unique_count": 4.0, "timing.mtime_unique_ratio": 0.33, "misplaced_executable_count": 3.0, "timing.mtime_dominant_count": 6.0, "timing.mtime_spread_seconds": 68284.0, "timing.sentinel_mtime_count": 0.0, "security.world_writable_count": 0.0, "timing.mtime_dominant_fraction": 0.5, "compression.method_counts.stored": 1.0, "compression.method_counts.deflate": 11.0 } } }, "ident": { "name": { "value": "Artkinx.ScalarAspNetCore.Annotations", "source": "nupkg.title", "verified": false }, "urls": [ { "url": "https://github.com/artkinx/ScalarAspNetCore.Annotations", "kind": "repository", "source": "nupkg.repository_url" } ], "trust": "unsigned", "authors": [ { "name": "Adunbi Moses", "role": "author", "source": "nupkg.authors" } ], "version": { "value": "1.0.0-preview.10", "source": "nupkg.version", "verified": false }, "identifier": { "value": "Artkinx.ScalarAspNetCore.Annotations", "source": "nupkg.id", "verified": false } }, "traits": [ { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/communications/http/server/managed::http-request-get", "conf": 1.0, "crit": 3, "desc": "Access to ASP.NET Request object", "from": [ { "file": 4 } ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "from": [ { "file": 4 } ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "from": [ { "file": 4 }, { "file": 6 }, { "file": 8 } ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "from": [ { "file": 4 } ] }, { "id": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "conf": 1.0, "crit": 3, "desc": "JSON polymorphism runtime marker", "from": [ { "file": 4 } ] }, { "id": "metadata/package/versioning::version-word-lower", "conf": 0.4000000059604645, "crit": 2, "desc": "version word (lowercase)", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/communications/http/server/managed::http-response-get", "conf": 1.0, "crit": 3, "desc": "Access to ASP.NET Response object", "from": [ { "file": 4 } ] }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "from": [ { "file": 4 } ], "spans": [ [ 0, 26 ] ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "micro-behaviors/data/db/linq::linq-queries", "conf": 0.699999988079071, "crit": 3, "desc": "LINQ query operations", "from": [ { "file": 4 } ] }, { "id": "metadata/binary/debug::pdb-visual-studio", "crit": 3, "desc": "Visual Studio build path", "spans": [ [ 10116, 143 ], [ 16180, 143 ] ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "from": [ { "file": 4 } ] } ] }, { "id": 1, "sha": "27ed66ea252ea913fe772dbd4573f3a4a5117b8e5ce59ba8ddff735c959d201f", "path": "Artkinx.ScalarAspNetCore.Annotations.1.0.0-preview.10.nupkg!!_rels/.rels", "size": 530, "type": "xml", "depth": 1 }, { "ctx": [ { "b": "[4ls%kx}3YaA?spB7]MgjT8QkfD}SJzEWP}x(mMDb6w0teJs}sj]", "n": [ { "c": 2, "d": "NuGet nuspec manifest file", "i": "metadata/build/manifest::nuspec-file", "o": 0, "z": 43, "cf": 0.9800000190734863 } ], "ln": 1, "addr": 0 }, { "b": "jAa.syHH\u003c!aB4:tzGv@+xMOuniXJdcv}YB\u003cvrj5rx\u003e8g4B8LVje[n*pfk$ufyHH\u003c\u0026zF7QTfFLvpfF$I3B-RIkv\u003eJ1EwfKh", "ln": 2, "addr": 43 }, { "b": "arS^-wPRu\u003evrt{w", "ln": 3, "addr": 120 }, { "b": "arR^Hjy\u00262Av@=p5BzkVhk15%(y*?u)Bzk]fayPwlA+P09By/Iow]zYjv@Dl%x\u003eINex(mMaq!6lLvr9F^AaJ]Mp!q^uz!0{bwO#P#BzkVhazCZoe(1\u0026mayPd#ax9F)B7/39v@2)(e\u003c7^$wPIv4x(Ffdz/d-", "ln": 10, "addr": 402 }, { "b": "arR^HjAL1AB3sUPvqGv)aA8jgzEEG#aAI:nxj\u003e^@aAI:nB7/39v@2)(ayPtgzE){1z/Pzivq]{yflySnB3o", "ln": 11, "addr": 527 }, { "b": "arR^HjAt1Lz/YSmz/QaCBA}?pjTaJMBrR\u0026IA+)(.xMOunB2\u003e%cxk8E3BZ=$kz/4doA==8hzG)*kv{%gZAZs+=pgXJmz/Pzwl2HNUByxo9z/fRuay/tbze18Pa#%6^ialnKgC{\u003c}vk}ZJhAke6v}EGbiB:*1v}f7Yw\u0026Bmgias\u003cVwG\u0026lIj]", "n": [ { "c": 2, "d": "NuGet package declares repository", "i": "metadata/package/files/nuget::nuspec-repository", "o": 599, "z": 92, "cf": 0.8999999761581421 } ], "ln": 12, "addr": 595 }, { "b": "arR^Hjy\u00262xwO#3\u0026zEWx(B3o", "n": [ { "c": 2, "d": "NuGet package declares dependencies", "i": "metadata/package/files/nuget::nuspec-dependencies", "o": 742, "z": 791, "cf": 0.8999999761581421 } ], "ln": 13, "addr": 738 }, { "b": "arR^HarS^VA=l8taAR4jxjVfOA:-/@Cw?IqjTa=PBtkE4fD@W", "ln": 14, "addr": 758 }, { "b": "arR^HarR^Hjy\u00262xwO#3\u0026zEW@mx\u003efvJo\u003e!9Tz/Y\u0026eBs]\u003e2A86$^lVm0Re(cB$zB5kQa%q5uA=U@kzAPf#fFk4iiu/OSCW\u003eMjwmW[FluN0UwgQ2:vqHjnwPz\u0026oatk[", "ln": 15, "addr": 799 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 2097.0, "entropy": 5.05, "size_bytes": 2097.0 }, "binary": { "overall_entropy": 5.05, "peak_region_bytes": 2048.0, "peak_region_entropy": 5.13 } } }, "id": 2, "path": "Artkinx.ScalarAspNetCore.Annotations.1.0.0-preview.10.nupkg!!Artkinx.ScalarAspNetCore.Annotations.nuspec", "risk": 1, "sha": "2e26dd5da15a6c821e6b29d523d561bc7bc03aa9f8d630ddb777c424a37d14db", "size": 2097, "traits": [ { "id": "metadata/package/files/nuget::nuspec-dependencies", "conf": 0.8999999761581421, "crit": 2, "desc": "NuGet package declares dependencies", "spans": [ [ 742, 791 ] ] }, { "id": "metadata/build/manifest::nuspec-file", "conf": 0.9800000190734863, "crit": 2, "desc": "NuGet nuspec manifest file", "spans": [ [ 0, 43 ] ] }, { "id": "metadata/package/files/nuget::nuspec-repository", "conf": 0.8999999761581421, "crit": 2, "desc": "NuGet package declares repository", "spans": [ [ 599, 92 ] ] } ], "type": "xml" }, { "ctx": [ { "b": "boPo)BzCPdCRh{8vqGv)l340uwPQpTA+c\u003c?zF\u003cxmvruj4zGt", "n": [ { "c": 3, "d": "Recognized domain reference marker", "i": "objectives/command-and-control/infrastructure/domain/tld::recognized-reference-marker", "o": 0, "z": 9, "cf": 0.8999999761581421 } ], "ln": 1, "addr": 0 }, { "b": "", "ln": 2, "addr": 39 }, { "b": "u{O*PyIvWhe(Mm*y*?uIB8T(=Bvf$!wIcn^zF%S9BzkVhB6{bfA=lbnwmY*8wmYm!vrb^#x)a5gvruQix\u003c#jbwPF#az/M$gz/ff3xlwlezF782zE:(3zFiD@v}/*[ax}=OvqGv)t{%xdBz#pZfe3%LBzb/ae[n*pflpSiy*?uqB7nS{vr9!tpJf(.k#pb}wn+$2zdNQbvruj4zxJUhave}5e(1\u0026mavy6/wGUA2Abok#vruj4zGvAMnPV7@B-qqrA==vBvScv4asX\u003ctCvtMavS=f@y?k7CayPd#aARpdasX\u003covrujbwGT=/wO%!gnH=hjxjU%(A::67z/cXbB.LVlazC.nzY*Vcmn$x\u0026d\u003eQ", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 111, "z": 3, "cf": 0.800000011920929 } ], "ln": 3, "addr": 40 }, { "b": "", "ln": 4, "addr": 327 }, { "b": "bo[sbC4CYqx\u003eqF", "ln": 5, "addr": 328 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 2990.0, "entropy": 4.97, "size_bytes": 2990.0 }, "text": { "digit_ratio": 0.0, "space_count": 304.0, "total_lines": 94.0, "char_entropy": 4.97, "unique_chars": 71.0, "lines_over_200": 3.0, "avg_line_length": 30.81, "max_line_length": 306.0, "empty_line_ratio": 0.31, "last_line_length": 158.0, "whitespace_ratio": 0.13, "most_common_ratio": 0.07, "line_length_stddev": 56.04, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 1.0, "most_common_char_codepoint": 101.0 }, "binary": { "overall_entropy": 4.97, "peak_region_bytes": 2990.0, "peak_region_entropy": 4.97 } } }, "id": 3, "path": "Artkinx.ScalarAspNetCore.Annotations.1.0.0-preview.10.nupkg!!README.md", "risk": 1, "sha": "bb6321d9a40bfac92b95ac422762511f389e7d85bac55da6158fd13e204b017b", "size": 2990, "traits": [ { "id": "metadata/file/profile/language::lang-english", "conf": 0.800000011920929, "crit": 2, "desc": "English language detection", "spans": [ [ 111, 3 ] ] }, { "id": "metadata/file/extension/identity::markdown-file-basename", "conf": 1.0, "crit": 1, "desc": "Markdown document file extension", "spans": [ [ 0, 9 ] ] }, { "id": "metadata/file/extension/identity::doc-or-config-extension", "conf": 1.0, "crit": 1, "desc": "Document or config file extension", "spans": [ [ 0, 9 ] ] } ], "type": "markdown" }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J\u0026m(0ji6Sa?dLD+]{51x(+zoA=kPhvqNb%vqY$3BrC47aAzQxazCZol@c-7zeP", "n": [ { "c": 3, "d": "HTTP fingerprinting evasion campaign", "i": "objectives/command-and-control/infrastructure/user-agent::http-fingerprinting-campaign", "o": 0, "z": 34, "cf": 0.8999999761581421 }, { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 78, "z": 4, "cf": 0.800000011920929 } ], "ln": 0 }, { "b": "00000000000000000000TP5n200000nb@R\u00260SSx7V{$8@PTB?20rr91000000000000", "n": [ { "c": 1, "d": "PE standard code/data section", "i": "metadata/binary/section/names::pe-code-data-standard-section", "o": 512, "z": 5, "cf": 0.8999999761581421 } ], "ln": 496 }, { "b": "c%=(N1$yU@c%=(N1$xPMlq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn", "n": [ { "c": 3, "d": "Recognized PE anti-analysis marker", "i": "objectives/anti-analysis/debugger-detect/combined-checks::evasion-aware-recognized-pe-marker", "o": 10676, "z": 4, "cf": 1.0 } ], "ln": 10660 }, { "b": "x(mD}zF7N@wPRu\u003evrt]Tq*ACawO\u003c50wQ5qHn][]*e(Mt4x\u003c\u003e*(Dsp]fz/dg4wPRu\u003evrt]TxjVf(o\u003ewAP", "n": [ { "c": 3, "d": "JSON polymorphism runtime marker", "i": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "o": 20717, "z": 16, "cf": 1.0 } ], "ln": 20701 }, { "b": "lVm0Re\u003cTw)z//Afx(v)ge[w^m08NYOvR/Q)sz.\u003cOsZ=e-090JOBvZH\u003cyYEmvBy/L)", "n": [ { "c": 3, "d": "References Windows executable or script", "i": "objectives/execution/interpreter/script/shell::windows-executable-ref", "o": 24016, "z": 4, "cf": 0.6000000238418579 } ], "ln": 24000 }, { "b": "AaJ]MAa}:=By/uhx(v\u003e?C4CYnx(v\u003e?pJf(.l2ZKlAaK5#BzkVh0b(*/A::67z/bLND2[6", "n": [ { "c": 3, "d": "Recognized sparse-logic binary marker", "i": "objectives/anti-analysis/vm-detect/instruction::sparse-logic-recognized-marker", "o": 24231, "z": 7, "cf": 0.800000011920929 } ], "ln": 24215 }, { "b": "zE^r@v%HT-ygQ)%x(v\u003e?q*ACawO\u003c4$wOb:\u0026v@#B6zuarXBydQXm}DNHA+P2.D2Ns.wObT]x([6czu9grBn", "n": [ { "c": 2, "d": "Benign high-entropy PE context", "i": "metadata/package/quality/false-positives::benign-high-entropy-pe-context", "o": 24328, "z": 17, "cf": 0.949999988079071 } ], "ln": 24312 }, { "b": "wPIv4x(Ffdz/bLwB8L{@q*ACawO\u003c50wQ5qHn][]*08NYOvR/Q)n][]*08)#Wx(mMJz/6D4A+PPkzuaA)", "n": [ { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 24664, "z": 16, "cf": 0.8500000238418579 } ], "ln": 24648 }, { "b": "0bls.zVAvCvp%dMwNYPUq*ACawO\u003c4[x(m[\u003cxjVf(l3di?x\u003c#jbwL^z=C4\u003eF#ASwV#B-RUyz9-m", "n": [ { "c": 3, "d": "LINQ query operations", "i": "micro-behaviors/data/db/linq::linq-queries", "o": 24820, "z": 11, "cf": 0.699999988079071 } ], "ln": 24804 }, { "b": "ASxM\u003ex(4r\u003eASy31xK#h:q*ACawO\u003c4!z!9AEz/49]z/6Dcy?mR!l1BI8v}YB\u003cvn}nQzGxAdA=2xd07/$9wO%!Mx\u0026wH", "n": [ { "c": 3, "d": ".NET dynamic code generation capability", "i": "metadata/lang/compiler/managed::dotnet-dynamic-code", "o": 24923, "z": 23, "cf": 0.8500000238418579 } ], "ln": 24907 }, { "b": "By/qwl${7xzF%Prx\u003e8h:q*ACawO\u003c4$B-8qnzdLs\u003ezGGDgz/wS^A=#ebwPE\u0026ID2[7sz7X.ezGGPfwIct*ze:i9wPyZXA=#ebwPE\u0026twNY^{xk8l@o(BMNA@Yc:B97#ge(VzbBs{gbz/dg5z!9B207QQrwPzj3wKx)oxK%RIBAh8bA@Y\u0026:Byb", "n": [ { "c": 3, "d": "Packed binary marker", "i": "objectives/anti-static/obfuscation/eval/loader::packed-binary-marker", "o": 25903, "z": 30, "cf": 0.8500000238418579 }, { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 25981, "z": 16, "cf": 0.8500000238418579 } ], "ln": 25887 }, { "b": "zEEuGz/fVdzGF\u003c6AaK7\u003cxjVf(qE%]*z/fScA@Zn)Byd{SB8V5nB7Gy)pJf(.l2ZKowPI*ezGxxg", "n": [ { "c": 3, "d": "Access to ASP.NET Response object", "i": "micro-behaviors/communications/http/server/managed::http-response-get", "o": 26137, "z": 12, "cf": 1.0 } ], "ln": 26121 }, { "b": "wQ5p%lVWzJrbU6yA::j[xjVf(qE%\u0026\u003cwPI@Wz!aa[nL:qpzB5kQqE%\u0026\u003cwPI@Wz!aa[xjVf(oj-w", "n": [ { "c": 3, "d": "Access to ASP.NET Request object", "i": "micro-behaviors/communications/http/server/managed::http-request-get", "o": 28104, "z": 11, "cf": 1.0 } ], "ln": 28088 }, { "b": "wDl=KwDlPFBo3vZaok*Izu7^Vve$xHBo3sYx-IPxBPuH-wDi?Mw=M-HASviZve%*", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 28912, "z": 3, "cf": 0.800000011920929 } ], "ln": 28896 }, { "b": "0b?\u003cP004SJl\u0026Z=#w=MJBzuakFA@Wr.Bo2$OwDi?Mz#:!RA@ZmYx-IPxyYF2Daolu", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 29083, "z": 3, "cf": 0.800000011920929 } ], "ln": 29067 }, { "b": "wDl=KwDlPFBo3vZaok*Izu7^Vve$xHBo3sYx-IPxBPuH-wDi?MBo2$Ove$xHaok)K", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 30015, "z": 4, "cf": 0.800000011920929 } ], "ln": 29999 }, { "b": "0a=c.08rJ50bRZE004U/qVH+pwDliux-I-Bx-IYAA@Wr.Bo2$OwDi?MBo2\u003eLCMq*=aolG-zVy)WvGo%taok{Lx-JhOz#:XOve$MMwDllvaolrWzu7^VBo2$OwDi?MvGo*pwb{lxwDi?Mx-J2JaolG-xAhPzaoksuv/P{qyYE(zASviZrrbO\u003ce=W0]q#*OiwDi?MvGo*pwb{lxwDi?Mzua8Bz2!bE", "n": [ { "c": 3, "d": "Bulk sensitive server data list", "i": "objectives/exfiltration/cloud/sync-tool::bulk-sensitive-server-data-path", "o": 37729, "z": 128, "cf": 1.0 } ], "ln": 37713 }, { "b": "04[ms0b?\u003cN0b?\u003cT004X\u0026qVH+pwDliux-I-Bx-IYAA@Wr.Bo2$OwDi?Mv/QAEyYFwNASviZzVBwHaolG-xAhPzaok\u003cJve%*rx8(Gyaol9Qzu7^VBo2$OwDi?MqVHqcve$9zve$rFaokywnDpvyaokvvxAhPzaok)KzVBONzVB!Taok)Kve$fBaok\u003cJwDi?Mwb{fvw=MJBzuakFwb).LBPuE.x-J2J", "n": [ { "c": 1, "d": "Regex component marker", "i": "objectives/exfiltration/cloud/sync-tool::bulk-sensitive-server-data-path--rx-8", "o": 40139, "z": 128, "cf": 1.0 } ], "ln": 40123 }, { "b": "ve$xHx-J5Kzu9ldwb(Qtq#*OiwDi?MBPupVx-JbMBPt$MaolD.Bo3sYx-J2Jx8\u003c4", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 42062, "z": 3, "cf": 0.800000011920929 } ], "ln": 42046 }, { "b": "yYFwNASviZzVB!TaolG-xAhPzz2!bEaolD.Bo3sYx-J2Jx8\u003c4Ove$lDz#:XOx-IYA", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 42659, "z": 4, "cf": 0.800000011920929 } ], "ln": 42643 }, { "b": "0bhBx0cFo-0a=dK03znT0bhBG0a=cM08\u0026(c0at\u003ez0at\u003eF08APl0a=dJ0at\u003eH0bhBK0b.=", "n": [ { "c": 2, "d": "Startup directory keyword", "i": "micro-behaviors/os/autorun/keyword::startup-keyword", "o": 45893, "z": 7, "cf": 0.5 } ], "ln": 45877 }, { "b": "wDl@PBo0@]v/QMIB]RHQx-I#Ive%{uwDjv-z#:+Qx8?]Dx-I#Ive%{uwDjv-y5\u0026hMwDluy00", "n": [ { "c": 2, "d": "PNG image format MIME type", "i": "micro-behaviors/data/encode/image/gdiplus::png-encoder-clsid", "o": 53048, "z": 9, "cf": 0.8500000238418579 } ], "ln": 53032 }, { "b": "B-H#6m}DNHA::6dA=S=Or+lq)x(v(Lf!+jle\u0026+KrefEr5y\u0026\u003c/uwJ:{xB-.Ujy+cY9BZ/f3v[QxUrbVL-", "n": [ { "c": 2, "d": "IPv4-like .NET assembly version", "i": "metadata/lang/compiler/managed::dotnet-ipv4-like-version", "o": 57144, "z": 16, "cf": 0.8500000238418579 } ], "ln": 57128 }, { "b": "fr83GJMh*oxG\u003c(80rr91lPOE\u003eA=kY7v@#=%Ab]VotVkcvy*?upl340uwPQpTA+c\u003c?zF\u003cxmvruj4zGx5GA==8hzG)^jv{%gZAZs+=pgXJmz/Pzwl2HNUByxo9z/fS3z^)D^qE%VQvrl0+zE)]AfFk4:l2}6.x(neFq!6lLvraUPA86$^lVm0Re\u003cTw)z//Afx(v)ge]Uug08(AOgbQ@\u0026\u003ch6Y%fr85gJMh*oxG\u003c(8)y+P/HK6sW", "n": [ { "c": 3, "d": "Visual Studio build path", "i": "metadata/binary/debug::pdb-visual-studio", "o": 57536, "z": 144, "cf": 0.5 } ], "ln": 57520 }, { "b": "00000000000000000000000000000000000000315c8Xg7YTL^00000000000000000", "n": [ { "c": 1, "d": "PE resource section", "i": "metadata/binary/section/names::pe-resource-section", "o": 57856, "z": 5, "cf": 0.8999999761581421 } ], "ln": 57840 }, { "b": "00000000000086.gYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006Xn[brp!0rr910rr9", "n": [ { "c": 3, "d": "Recognized marker for timing checks", "i": "objectives/anti-analysis/timing/evasion::timing-anti-debug-recognized-marker", "o": 57950, "z": 15, "cf": 0.949999988079071 } ], "ln": 57934 }, { "b": "yYF2De=U\u003eK0024W4fczelJz38z2!IPve$fBC(QOtve$cAwDhYg002p+wb{-LzuabCx-GmQo-P8iA@Y+KA@Vgu0043tb(^@CmGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up002p+ASygYyxe5Gzua[", "n": [ { "c": 2, "d": "PE CompanyName metadata field", "i": "metadata/package/versioning::pe-companyname-field", "o": 58382, "z": 11, "cf": 0.699999988079071 }, { "c": 2, "d": "PE FileDescription metadata field", "i": "metadata/package/versioning::pe-filedescription-field", "o": 58442, "z": 15, "cf": 0.699999988079071 } ], "ln": 58366 }, { "b": "zVBUPA@Vgu001XM2MK(9mGvc5yYF2DrSDXhASydXx-J5Kzu6Up001.Ne=WN9e=WN9e=WN90043tdf6wGnDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE002p+ASygYyxe5Gzua[Ye=X/I", "n": [ { "c": 3, "d": "Dotted-quad PE version metadata marker", "i": "objectives/command-and-control/infrastructure/ip::ipv4-version-metadata-marker", "o": 58558, "z": 11, "cf": 0.9399999976158142 }, { "c": 2, "d": "PE InternalName metadata field", "i": "metadata/package/versioning::pe-internalname-field", "o": 58606, "z": 12, "cf": 0.699999988079071 } ], "ln": 58542 }, { "b": "xAibO001bw004rBdf6wGpxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE002p+ASygYyxe5Gzua[Y", "n": [ { "c": 2, "d": "PE OriginalFilename metadata field", "i": "metadata/package/versioning::pe-originalfilename-field", "o": 58762, "z": 16, "cf": 0.699999988079071 } ], "ln": 58746 }, { "b": "wb{ACyYBCn003:lb(^@CpYLIozVBqFBPt[KBo25ove$cAwDhYg002p+ASygYyxe5Gzua[Ye=X/", "n": [ { "c": 2, "d": "PE ProductName metadata field", "i": "metadata/package/versioning::pe-productname-field", "o": 58886, "z": 11, "cf": 0.699999988079071 } ], "ln": 58870 }, { "b": "zVBUPA@Vgu005q+irf6WpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001.Ne=WN9e=WN9eDx.\u0026ASu", "n": [ { "c": 2, "d": "PE version resource metadata", "i": "metadata/package/versioning::version-resource-metadata", "o": 58994, "z": 14, "cf": 0.8999999761581421 } ], "ln": 58978 }, { "b": "000000000000000000000pP%*3\u0026*nc+S=7c000000000000000000000000000000000", "n": [ { "c": 2, "d": "PE .reloc section presence", "i": "metadata/binary/section/names::reloc-section-presence", "o": 59392, "z": 6, "cf": 0.8999999761581421 } ], "ln": 59376 } ], "depth": 1, "facts": { "imp": [ [ "mscoree", "CorDllMain" ] ], "sec": [ [ ".text", 512, 57344, 5.19, "r-x" ], [ ".rsrc", 57856, 1536, 3.0, "r--" ], [ ".reloc", 59392, 512, 0.08, "r--" ] ], "metrics": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "resource_count": 1.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 71034.0, "reloc_overhang_bytes": 500.0, "reloc_overhang_ratio": 0.98, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "version.identity_entropy": 4.18, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0, "version.identity_symbol_ratio": 0.05 }, "file": { "size": 59904.0, "entropy": 5.1, "size_bytes": 59904.0 }, "binary": { "is_pie": 1.0, "code_entropy": 5.19, "string_count": 575.0, "overall_entropy": 5.1, "entropy_variance": 4.37, "avg_string_length": 37.35, "max_string_length": 705.0, "peak_region_bytes": 1024.0, "code_to_data_ratio": 1.0, "peak_region_entropy": 6.01, "string_length_stddev": 83.75, "largest_section_ratio": 0.96, "sentence_string_count": 39.0, "sentence_string_ratio": 0.07, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 57344.0, "entropy_max": 5.19, "entropy_mean": 2.76, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } } }, "id": 4, "mol": "O(Al)H₂(CmDb)", "path": "Artkinx.ScalarAspNetCore.Annotations.1.0.0-preview.10.nupkg!!lib/net10.0/Artkinx.ScalarAspNetCore.Annotations.dll", "risk": 4, "sha": "90a2205138004c5cdbb25fa8ec0c3fe94b4bc0b9eacae8c8247642da160f6255", "size": 59904, "traits": [ { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "spans": [ [ 58994, 14 ] ] }, { "id": "metadata/package/versioning::version-word-lower", "conf": 0.4000000059604645, "crit": 2, "desc": "version word (lowercase)", "spans": [ [ 24231, 7 ] ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "spans": [ [ 24016, 4 ] ] }, { "id": "micro-behaviors/communications/http/server/managed::http-response-get", "conf": 1.0, "crit": 3, "desc": "Access to ASP.NET Response object", "spans": [ [ 26137, 12 ] ] }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "spans": [ [ 0, 26 ] ] }, { "id": "micro-behaviors/data/db/linq::linq-queries", "conf": 0.699999988079071, "crit": 3, "desc": "LINQ query operations", "spans": [ [ 24820, 11 ] ] }, { "id": "micro-behaviors/communications/http/server/managed::http-request-get", "conf": 1.0, "crit": 3, "desc": "Access to ASP.NET Request object", "spans": [ [ 28104, 11 ] ] }, { "id": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "conf": 1.0, "crit": 3, "desc": "JSON polymorphism runtime marker", "spans": [ [ 20717, 16 ] ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "spans": [ [ 58558, 11 ] ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "spans": [ [ 10676, 4 ] ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 57950, 15 ] ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "metadata/binary/debug::pdb-visual-studio", "crit": 3, "desc": "Visual Studio build path", "spans": [ [ 57536, 144 ] ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "spans": [ [ 10676, 4 ] ] } ], "type": "pe" }, { "id": 5, "sha": "d25e7e2bc0e29f383abae0d631adb97cfc7b98d6ecc7fce2559662fc65a7d06b", "path": "Artkinx.ScalarAspNetCore.Annotations.1.0.0-preview.10.nupkg!!lib/net10.0/Artkinx.ScalarAspNetCore.Annotations.xml", "size": 25575, "type": "xml", "depth": 1 }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J\u0026m(0ji6S", "n": [ { "c": 3, "d": "HTTP fingerprinting evasion campaign", "i": "objectives/command-and-control/infrastructure/user-agent::http-fingerprinting-campaign", "o": 0, "z": 34, "cf": 0.8999999761581421 } ], "ln": 0 }, { "b": "00000000000000000000z:\u003cZb00000nb@R\u00260SSx7GD{J$LPP@a0rr91000000000000", "n": [ { "c": 1, "d": "PE standard code/data section", "i": "metadata/binary/section/names::pe-code-data-standard-section", "o": 512, "z": 5, "cf": 0.8999999761581421 } ], "ln": 496 }, { "b": "9S)!\u003e000iM9S)!\u003e000iMlq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn", "n": [ { "c": 3, "d": "Recognized PE anti-analysis marker", "i": "objectives/anti-analysis/debugger-detect/combined-checks::evasion-aware-recognized-pe-marker", "o": 1668, "z": 4, "cf": 1.0 } ], "ln": 1652 }, { "b": "lVm0Re\u003cTw)z//Afx(v)ge[w^m08NYOvR/Q)sz.\u003cOsZ=e-090JOBvZH\u003cyYEmvBy/L)", "n": [ { "c": 3, "d": "References Windows executable or script", "i": "objectives/execution/interpreter/script/shell::windows-executable-ref", "o": 6737, "z": 4, "cf": 0.6000000238418579 } ], "ln": 6721 }, { "b": "07y^Fz2^KDCYV+#vqfPVq*ACawO\u003c4$wOb:\u0026v@#B6zuarXByd\u003c.B7]-gz/bLwvpT1Zp\u0026yz?BzkVh0b#\u003c$x-", "n": [ { "c": 2, "d": "Benign high-entropy PE context", "i": "metadata/package/quality/false-positives::benign-high-entropy-pe-context", "o": 6813, "z": 17, "cf": 0.949999988079071 } ], "ln": 6797 }, { "b": "zaX\u003e/zu9mBvp%dMwNYPUq*ACawO\u003c4[x(m[\u003cl1UjIASx--BydyNy\u0026ss]xjVf(ra]\u0026WwKyxLz/L*", "n": [ { "c": 3, "d": "LINQ query operations", "i": "micro-behaviors/data/db/linq::linq-queries", "o": 6938, "z": 11, "cf": 0.699999988079071 } ], "ln": 6922 }, { "b": "wDl@PBo0@]v/QMIB]RHQx-I#Ive%{uwDjv-z#:+Qx8?]Dx-I#Ive%{uwDjv-y5\u0026hMwDluy00", "n": [ { "c": 2, "d": "PNG image format MIME type", "i": "micro-behaviors/data/encode/image/gdiplus::png-encoder-clsid", "o": 7874, "z": 9, "cf": 0.8500000238418579 } ], "ln": 7858 }, { "b": "w4!QeKxC\u003e0CYL{^0rr91lPOE\u003eA=kY7v@#=%Ab]VotVkcvy*?upl340uwPQpTA+c\u003c?zF\u003cxmvruj4zGx5GA==8hzG)^jv{%gZAZs+=pgXJmz/Pzwl2HNUByxo9z/fS3z^)D^qE%VQvrl0+zE)]He?*J@A==8hzG)^jv{%gZAZs+=pgXJmz/Pzwl2HNUByxo9z/fRGAaAzTq+fhfh8UCcNlT\u003e:Y}M$/sZtJZB2}t}k1\u0026!L\u0026P#\u003c", "n": [ { "c": 3, "d": "Visual Studio build path", "i": "metadata/binary/debug::pdb-visual-studio", "o": 10116, "z": 143, "cf": 0.5 } ], "ln": 10100 }, { "b": "00000000000000000000000000000000000000315c8Xg7YTL^00000000000000000", "n": [ { "c": 1, "d": "PE resource section", "i": "metadata/binary/section/names::pe-resource-section", "o": 10752, "z": 5, "cf": 0.8999999761581421 } ], "ln": 10736 }, { "b": "00000000000086.gYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006Xn[brp!0rr910rr9", "n": [ { "c": 3, "d": "Recognized marker for timing checks", "i": "objectives/anti-analysis/timing/evasion::timing-anti-debug-recognized-marker", "o": 10846, "z": 15, "cf": 0.949999988079071 } ], "ln": 10830 }, { "b": "yYF2De=U\u003eK0024W4fczelJz38z2!IPve$fBC(QOtve$cAwDhYg002p+wb{-LzuabCx-GmQo-P8iA@Y+KA@Vgu0043tb(^@CmGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up002p+ASygYyxe5Gzua[", "n": [ { "c": 2, "d": "PE CompanyName metadata field", "i": "metadata/package/versioning::pe-companyname-field", "o": 11278, "z": 11, "cf": 0.699999988079071 }, { "c": 2, "d": "PE FileDescription metadata field", "i": "metadata/package/versioning::pe-filedescription-field", "o": 11338, "z": 15, "cf": 0.699999988079071 } ], "ln": 11262 }, { "b": "zVBUPA@Vgu001XM2MK(9mGvc5yYF2DrSDXhASydXx-J5Kzu6Up001.Ne=WN9e=WN9e=WN90043tdf6wGnDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE002p+ASygYyxe5Gzua[Ye=X/I", "n": [ { "c": 3, "d": "Dotted-quad PE version metadata marker", "i": "objectives/command-and-control/infrastructure/ip::ipv4-version-metadata-marker", "o": 11454, "z": 11, "cf": 0.9399999976158142 }, { "c": 2, "d": "PE InternalName metadata field", "i": "metadata/package/versioning::pe-internalname-field", "o": 11502, "z": 12, "cf": 0.699999988079071 } ], "ln": 11438 }, { "b": "xAibO001bw004rBdf6wGpxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE002p+ASygYyxe5Gzua[Y", "n": [ { "c": 2, "d": "PE OriginalFilename metadata field", "i": "metadata/package/versioning::pe-originalfilename-field", "o": 11658, "z": 16, "cf": 0.699999988079071 } ], "ln": 11642 }, { "b": "wb{ACyYBCn003:lb(^@CpYLIozVBqFBPt[KBo25ove$cAwDhYg002p+ASygYyxe5Gzua[Ye=X/", "n": [ { "c": 2, "d": "PE ProductName metadata field", "i": "metadata/package/versioning::pe-productname-field", "o": 11782, "z": 11, "cf": 0.699999988079071 } ], "ln": 11766 }, { "b": "zVBUPA@Vgu005q+irf6WpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001.Ne=WN9e=WN9eDx.\u0026ASu", "n": [ { "c": 2, "d": "PE version resource metadata", "i": "metadata/package/versioning::version-resource-metadata", "o": 11890, "z": 14, "cf": 0.8999999761581421 } ], "ln": 11874 }, { "b": "0000000000000000000006*I:3\u0026*ncKtW7s000000000000000000000000000000000", "n": [ { "c": 2, "d": "PE .reloc section presence", "i": "metadata/binary/section/names::reloc-section-presence", "o": 12288, "z": 6, "cf": 0.8999999761581421 } ], "ln": 12272 } ], "depth": 1, "facts": { "imp": [ [ "mscoree", "CorDllMain" ] ], "sec": [ [ ".text", 512, 10240, 5.47, "r-x" ], [ ".rsrc", 10752, 1536, 3.0, "r--" ], [ ".reloc", 12288, 512, 0.08, "r--" ] ], "metrics": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "resource_count": 1.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 50286.0, "reloc_overhang_bytes": 500.0, "reloc_overhang_ratio": 0.98, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "version.identity_entropy": 4.18, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0, "version.identity_symbol_ratio": 0.05 }, "file": { "size": 12800.0, "entropy": 5.01, "size_bytes": 12800.0 }, "binary": { "is_pie": 1.0, "code_entropy": 5.47, "string_count": 223.0, "overall_entropy": 5.01, "entropy_variance": 4.85, "avg_string_length": 18.42, "max_string_length": 143.0, "peak_region_bytes": 1024.0, "code_to_data_ratio": 1.0, "peak_region_entropy": 5.53, "string_length_stddev": 15.28, "largest_section_ratio": 0.8, "sentence_string_count": 3.0, "sentence_string_ratio": 0.01, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 10240.0, "entropy_max": 5.47, "entropy_mean": 2.85, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } } }, "id": 6, "mol": "H(Db)", "path": "Artkinx.ScalarAspNetCore.Annotations.1.0.0-preview.10.nupkg!!lib/net8.0/Artkinx.ScalarAspNetCore.Annotations.dll", "risk": 2, "sha": "ba9727fb853eab627d1ff31036d32e28ef7e3697644d36c0a343618af0a9de94", "size": 12800, "traits": [ { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "spans": [ [ 11890, 14 ] ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "spans": [ [ 6737, 4 ] ] }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "spans": [ [ 0, 26 ] ] }, { "id": "micro-behaviors/data/db/linq::linq-queries", "conf": 0.699999988079071, "crit": 3, "desc": "LINQ query operations", "spans": [ [ 6938, 11 ] ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "spans": [ [ 11454, 11 ] ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "spans": [ [ 1668, 4 ] ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 10846, 15 ] ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "metadata/binary/debug::pdb-visual-studio", "crit": 3, "desc": "Visual Studio build path", "spans": [ [ 10116, 143 ] ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "spans": [ [ 1668, 4 ] ] } ], "type": "pe" }, { "id": 7, "sha": "b8dfab9d87eb61d2c06a14bf09afb60982d2a467764243d0df13eab5aac1e0c1", "path": "Artkinx.ScalarAspNetCore.Annotations.1.0.0-preview.10.nupkg!!lib/net8.0/Artkinx.ScalarAspNetCore.Annotations.xml", "size": 14989, "type": "xml", "depth": 1 }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J\u0026m(0ji6S", "n": [ { "c": 3, "d": "HTTP fingerprinting evasion campaign", "i": "objectives/command-and-control/infrastructure/user-agent::http-fingerprinting-campaign", "o": 0, "z": 34, "cf": 0.8999999761581421 } ], "ln": 0 }, { "b": "00000000000000000000a6[{E00000nb@R\u00260SSx794I0?Tt6XP0rr91000000000000", "n": [ { "c": 1, "d": "PE standard code/data section", "i": "metadata/binary/section/names::pe-code-data-standard-section", "o": 512, "z": 5, "cf": 0.8999999761581421 } ], "ln": 496 }, { "b": "c\u003c{1P1$yU@c\u003c{1P1$xPMlq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn", "n": [ { "c": 3, "d": "Recognized PE anti-analysis marker", "i": "objectives/anti-analysis/debugger-detect/combined-checks::evasion-aware-recognized-pe-marker", "o": 3356, "z": 4, "cf": 1.0 } ], "ln": 3340 }, { "b": "y\u0026\u003cxgvrcDVz/PX.vrt]Tq*ACawO\u003c50wQ5qHn][]*e(Mt4x\u003c\u003e*(Dsp]fz/dg4wPRu\u003evrt]TxjVf(mq=TP", "n": [ { "c": 3, "d": "JSON polymorphism runtime marker", "i": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "o": 8606, "z": 16, "cf": 1.0 } ], "ln": 8590 }, { "b": "lVm0Re\u003cTw)z//Afx(v)ge[w^m08NYOvR/Q)sz.\u003cOsZ=e-090JOBvZH\u003cyYEmvBy/L)", "n": [ { "c": 3, "d": "References Windows executable or script", "i": "objectives/execution/interpreter/script/shell::windows-executable-ref", "o": 10628, "z": 4, "cf": 0.6000000238418579 } ], "ln": 10612 }, { "b": "zE^r@v%HT-ygQ)%x(v\u003e?q*ACawO\u003c4$wOb:\u0026v@#B6zuarXByd\u003c.B7]-gz/bLwvpT1Zp\u0026yz?BzkVh0b#\u003c$x-", "n": [ { "c": 2, "d": "Benign high-entropy PE context", "i": "metadata/package/quality/false-positives::benign-high-entropy-pe-context", "o": 10893, "z": 17, "cf": 0.949999988079071 } ], "ln": 10877 }, { "b": "wPIv4x(Ffdz/bLwB8L{@q*ACawO\u003c50wQ5qHn][]*08NYOvR/Q)n][]*08)#Wx(mMJz/6D4A+PPkzuarX", "n": [ { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 11011, "z": 16, "cf": 0.8500000238418579 } ], "ln": 10995 }, { "b": "C$z)=zVAvCvp%dMwNYPUq*ACawO\u003c4[x(m[\u003cl1BI8v}YB\u003cvn}nQzGxAdA=2xd07/$9wO%!Mx\u0026wH", "n": [ { "c": 3, "d": "LINQ query operations", "i": "micro-behaviors/data/db/linq::linq-queries", "o": 11123, "z": 11, "cf": 0.699999988079071 } ], "ln": 11107 }, { "b": "zEEuGz/fVdzGF\u003c6AaK7\u003cxjVf(qE%]*z/fScA@Y0PwO%!Mx\u0026nI-AbPSnwPE\u0026qA==8hzG)^jv{%gZ", "n": [ { "c": 3, "d": "Access to ASP.NET Response object", "i": "micro-behaviors/communications/http/server/managed::http-response-get", "o": 11709, "z": 12, "cf": 1.0 } ], "ln": 11693 }, { "b": "wDl@PBo0@]v/QMIB]RHQx-I#Ive%{uwDjv-z#:+Qx8?]Dx-I#Ive%{uwDjv-y5\u0026hMwDluy00", "n": [ { "c": 2, "d": "PNG image format MIME type", "i": "micro-behaviors/data/encode/image/gdiplus::png-encoder-clsid", "o": 13216, "z": 9, "cf": 0.8500000238418579 } ], "ln": 13200 }, { "b": "RNrE0KXrRM*InUM0rr91lPOE\u003eA=kY7v@#=%Ab]VotVkcvy*?upl340uwPQpTA+c\u003c?zF\u003cxmvruj4zGx5GA==8hzG)^jv{%gZAZs+=pgXJmz/Pzwl2HNUByxo9z/fS3z^)D^qE%VQvrl0+zE)]Ie?*J@A==8hzG)^jv{%gZAZs+=pgXJmz/Pzwl2HNUByxo9z/fRGAaAzTq+fhfh8UB-P/ipPWx6m*ot\u0026\u003cByC=AIGnyB8)=^{", "n": [ { "c": 3, "d": "Visual Studio build path", "i": "metadata/binary/debug::pdb-visual-studio", "o": 16180, "z": 143, "cf": 0.5 } ], "ln": 16164 }, { "b": "00000000000000000000000000000000000000315c8Xg7YTL^00000000000000000", "n": [ { "c": 1, "d": "PE resource section", "i": "metadata/binary/section/names::pe-resource-section", "o": 16896, "z": 5, "cf": 0.8999999761581421 } ], "ln": 16880 }, { "b": "00000000000086.gYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006Xn[brp!0rr910rr9", "n": [ { "c": 3, "d": "Recognized marker for timing checks", "i": "objectives/anti-analysis/timing/evasion::timing-anti-debug-recognized-marker", "o": 16990, "z": 15, "cf": 0.949999988079071 } ], "ln": 16974 }, { "b": "yYF2De=U\u003eK0024W4fczelJz38z2!IPve$fBC(QOtve$cAwDhYg002p+wb{-LzuabCx-GmQo-P8iA@Y+KA@Vgu0043tb(^@CmGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up002p+ASygYyxe5Gzua[", "n": [ { "c": 2, "d": "PE CompanyName metadata field", "i": "metadata/package/versioning::pe-companyname-field", "o": 17422, "z": 11, "cf": 0.699999988079071 }, { "c": 2, "d": "PE FileDescription metadata field", "i": "metadata/package/versioning::pe-filedescription-field", "o": 17482, "z": 15, "cf": 0.699999988079071 } ], "ln": 17406 }, { "b": "zVBUPA@Vgu001XM2MK(9mGvc5yYF2DrSDXhASydXx-J5Kzu6Up001.Ne=WN9e=WN9e=WN90043tdf6wGnDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE002p+ASygYyxe5Gzua[Ye=X/I", "n": [ { "c": 3, "d": "Dotted-quad PE version metadata marker", "i": "objectives/command-and-control/infrastructure/ip::ipv4-version-metadata-marker", "o": 17598, "z": 11, "cf": 0.9399999976158142 }, { "c": 2, "d": "PE InternalName metadata field", "i": "metadata/package/versioning::pe-internalname-field", "o": 17646, "z": 12, "cf": 0.699999988079071 } ], "ln": 17582 }, { "b": "xAibO001bw004rBdf6wGpxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE002p+ASygYyxe5Gzua[Y", "n": [ { "c": 2, "d": "PE OriginalFilename metadata field", "i": "metadata/package/versioning::pe-originalfilename-field", "o": 17802, "z": 16, "cf": 0.699999988079071 } ], "ln": 17786 }, { "b": "wb{ACyYBCn003:lb(^@CpYLIozVBqFBPt[KBo25ove$cAwDhYg002p+ASygYyxe5Gzua[Ye=X/", "n": [ { "c": 2, "d": "PE ProductName metadata field", "i": "metadata/package/versioning::pe-productname-field", "o": 17926, "z": 11, "cf": 0.699999988079071 } ], "ln": 17910 }, { "b": "zVBUPA@Vgu005q+irf6WpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001.Ne=WN9e=WN9eDx.\u0026ASu", "n": [ { "c": 2, "d": "PE version resource metadata", "i": "metadata/package/versioning::version-resource-metadata", "o": 18034, "z": 14, "cf": 0.8999999761581421 } ], "ln": 18018 }, { "b": "0000000000000000000008JT}3\u0026*nckT2eF000000000000000000000000000000000", "n": [ { "c": 2, "d": "PE .reloc section presence", "i": "metadata/binary/section/names::reloc-section-presence", "o": 18432, "z": 6, "cf": 0.8999999761581421 } ], "ln": 18416 } ], "depth": 1, "facts": { "imp": [ [ "mscoree", "CorDllMain" ] ], "sec": [ [ ".text", 512, 16384, 5.72, "r-x" ], [ ".rsrc", 16896, 1536, 3.0, "r--" ], [ ".reloc", 18432, 512, 0.08, "r--" ] ], "metrics": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "resource_count": 1.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 55856.0, "reloc_overhang_bytes": 500.0, "reloc_overhang_ratio": 0.98, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "version.identity_entropy": 4.18, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0, "version.identity_symbol_ratio": 0.05 }, "file": { "size": 18944.0, "entropy": 5.39, "size_bytes": 18944.0 }, "binary": { "is_pie": 1.0, "code_entropy": 5.72, "string_count": 332.0, "overall_entropy": 5.39, "entropy_variance": 5.31, "avg_string_length": 17.75, "max_string_length": 143.0, "peak_region_bytes": 2048.0, "code_to_data_ratio": 1.0, "peak_region_entropy": 5.82, "string_length_stddev": 13.43, "largest_section_ratio": 0.86, "sentence_string_count": 3.0, "sentence_string_ratio": 0.01, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 16384.0, "entropy_max": 5.72, "entropy_mean": 2.94, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } } }, "id": 8, "mol": "O(Al)H₂(CmDb)", "path": "Artkinx.ScalarAspNetCore.Annotations.1.0.0-preview.10.nupkg!!lib/net9.0/Artkinx.ScalarAspNetCore.Annotations.dll", "risk": 4, "sha": "ad75613b594432c0a823cb9a5610238ebdb70aeb04a61bdb6388015e12bcc43f", "size": 18944, "traits": [ { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "spans": [ [ 18034, 14 ] ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "spans": [ [ 10628, 4 ] ] }, { "id": "micro-behaviors/communications/http/server/managed::http-response-get", "conf": 1.0, "crit": 3, "desc": "Access to ASP.NET Response object", "spans": [ [ 11709, 12 ] ] }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "spans": [ [ 0, 26 ] ] }, { "id": "micro-behaviors/data/db/linq::linq-queries", "conf": 0.699999988079071, "crit": 3, "desc": "LINQ query operations", "spans": [ [ 11123, 11 ] ] }, { "id": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "conf": 1.0, "crit": 3, "desc": "JSON polymorphism runtime marker", "spans": [ [ 8606, 16 ] ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "spans": [ [ 17598, 11 ] ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "spans": [ [ 3356, 4 ] ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 16990, 15 ] ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "metadata/binary/debug::pdb-visual-studio", "crit": 3, "desc": "Visual Studio build path", "spans": [ [ 16180, 143 ] ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "spans": [ [ 3356, 4 ] ] } ], "type": "pe" }, { "id": 9, "sha": "d5064c26bbac4d1c7131ccfc45e0bd039f927932ce5a8b0c85550bcafeedf744", "path": "Artkinx.ScalarAspNetCore.Annotations.1.0.0-preview.10.nupkg!!lib/net9.0/Artkinx.ScalarAspNetCore.Annotations.xml", "size": 23382, "type": "xml", "depth": 1 }, { "id": 10, "sha": "53789202a7a62de78987becbf3ade1d56e9cb6e6fd525e8db9d2f1d352cb0425", "path": "Artkinx.ScalarAspNetCore.Annotations.1.0.0-preview.10.nupkg!![Content_Types].xml", "size": 590, "type": "xml", "depth": 1 }, { "id": 11, "sha": "b29f2c394a4439cfcbb50a6b5973e91ee69d32a134d2af496575d03aa221efc9", "path": "Artkinx.ScalarAspNetCore.Annotations.1.0.0-preview.10.nupkg!!package/services/metadata/core-properties/6acc3c0956154cb2a523ef95923ea8d3.psmdcp", "size": 777, "type": "xml", "depth": 1 }, { "id": 12, "sha": "83f537e10fd8ce0887abbec6971d56ef8fedde4351633c693aa18a44b02b331a", "path": "Artkinx.ScalarAspNetCore.Annotations@1.0.0-preview.10.registry.json", "size": 860, "type": "registry", "depth": 1 } ], "omitted_files": 7, "v": "8" } }