{ "llm": { "conf": 0.65191156, "grade": "benign", "model": "Qwen/Qwen3.6-27B", "outcome": "benign", "interpretation": "Standard .NET logging library" }, "ml": { "v": "7", "eng": "2.3.0-beta.0", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.5027308, "rte": "az", "prob": 0.5027308 }, { "cls": 0, "raw": 0.6552489, "rte": "az/nupkg", "prob": 0.6552489 } ], "prob": 0.5027308, "skip": [ { "rte": "az/zip", "why": "unavailable" }, { "rte": "az/zip", "why": "unavailable" } ], "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.5027307868003845, "type": "nupkg" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.00014418363571166992, "type": "xml" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.0007655620574951172, "type": "xml" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.00006663799285888672, "type": "png" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.009284406900405884, "type": "markdown" }, { "id": 5, "lvl": -1, "conf": 0, "prob": 0.040421515703201294, "type": "pe" }, { "id": 6, "lvl": -1, "conf": 0, "prob": 0.000015050172805786133, "type": "xml" }, { "id": 7, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "xml" }, { "id": 8, "lvl": -1, "conf": 0, "prob": 0.00003832578659057617, "type": "xml" }, { "id": 9, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "registry" } ], "version": "v18.18", "analyzed_at": "2026-07-07T02:03:50Z" }, "path": "SolTechnology.Core.Logging.1.2.0.nupkg", "raw": { "files": [ { "id": 0, "mol": "O₂(AlC)H₂(CmDb)", "sha": "877bdfef4ccab45d2dd4e53d5219ed8236003fd4a2f790dc30b9177ecb0eca12", "path": "SolTechnology.Core.Logging.1.2.0.nupkg", "risk": 5, "size": 191964, "type": "nupkg", "facts": { "metrics": { "file": { "size": 191964.0, "entropy": 7.99, "size_bytes": 191964.0 }, "binary": { "overall_entropy": 7.99, "peak_region_bytes": 185344.0, "peak_region_entropy": 7.86 }, "archive": { "file_count": 9.0, "member_count": 9.0, "script_count": 0.0, "zip_bomb_ratio": 4.74, "directory_count": 0.0, "executable_count": 1.0, "extra_field_size": 0.0, "noise_file_count": 0.0, "total_compressed": 190710.0, "compression.ratio": 0.74, "hidden_file_count": 2.0, "total_uncompressed": 256239.0, "crc_collision_count": 0.0, "entry_comment_count": 0.0, "max_filename_length": 81.0, "rtlo_filename_count": 0.0, "format.regular_count": 9.0, "nested_archive_count": 0.0, "path_traversal_count": 0.0, "symlink_escape_count": 0.0, "security.setgid_count": 0.0, "security.setuid_count": 0.0, "security.sticky_count": 0.0, "double_extension_count": 0.0, "duplicate_member_count": 0.0, "security.symlink_count": 0.0, "unicode_filename_count": 0.0, "homoglyph_filename_count": 0.0, "security.encrypted_count": 0.0, "timing.mtime_unique_count": 4.0, "timing.mtime_unique_ratio": 0.44, "misplaced_executable_count": 1.0, "timing.mtime_dominant_count": 4.0, "timing.mtime_spread_seconds": 25144.0, "timing.sentinel_mtime_count": 0.0, "security.world_writable_count": 0.0, "timing.mtime_dominant_fraction": 0.44, "compression.method_counts.stored": 1.0, "compression.method_counts.deflate": 8.0 } } }, "ident": { "name": { "value": "SolTechnology.Core Logging", "source": "nupkg.title", "verified": false }, "urls": [ { "url": "https://github.com/AdrianStrugala/SolTechnology.Core", "kind": "homepage", "source": "nupkg.project_url" }, { "url": "https://github.com/AdrianStrugala/SolTechnology.Core", "kind": "repository", "source": "nupkg.repository_url" } ], "trust": "unsigned", "authors": [ { "name": "Adrian Strugala", "role": "author", "source": "nupkg.authors" } ], "version": { "value": "1.2.0", "source": "nupkg.version", "verified": false }, "identifier": { "value": "SolTechnology.Core.Logging", "source": "nupkg.id", "verified": false } }, "traits": [ { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "objectives/command-and-control/dropper/staging/encrypted::dotnet-hexstring-conversion", "atk": "T1027", "mbc": "C0025", "conf": 0.8600000143051147, "crit": 1, "desc": ".NET hex string conversion", "from": [ { "file": 5 } ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "from": [ { "file": 5 } ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/data/db/linq::linq-queries", "conf": 0.699999988079071, "crit": 3, "desc": "LINQ query operations", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/communications/http/server/managed::http-request-get", "conf": 1.0, "crit": 3, "desc": "Access to ASP.NET Request object", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/communications/http/server/managed::http-item-setter", "conf": 1.0, "crit": 1, "desc": "Modification of HTTP context items", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/communications/http/server/managed::http-response-get", "conf": 1.0, "crit": 3, "desc": "Access to ASP.NET Response object", "from": [ { "file": 5 } ] }, { "id": "objectives/command-and-control/dropper/staging/encrypted::dotnet-stringbuilder-append", "atk": "T1027", "mbc": "C0025", "conf": 0.8199999928474426, "crit": 1, "desc": ".NET StringBuilder Append use", "from": [ { "file": 5 } ] }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "from": [ { "file": 5 } ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "from": [ { "file": 5 } ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/communications/http/server/managed::http-context-item-setter", "conf": 0.8500000238418579, "crit": 3, "desc": "Modification of HTTP context items", "from": [ { "off": 26828, "file": 5 } ] }, { "id": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "conf": 1.0, "crit": 3, "desc": "JSON polymorphism runtime marker", "from": [ { "file": 5 } ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "from": [ { "file": 5 } ] }, { "id": "objectives/command-and-control/beacon/network/http::qnx-dotnet-session-header", "atk": "T1071.001", "conf": 0.9399999976158142, "crit": 3, "desc": "QNX .NET session header", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/communications/http/server/managed::http-context", "conf": 1.0, "crit": 3, "desc": "Access to ASP.NET HttpContext", "from": [ { "file": 5 } ] } ] }, { "depth": 1, "facts": { "metrics": { "file": { "size": 516.0, "entropy": 5.14, "size_bytes": 516.0 }, "binary": { "overall_entropy": 5.14, "peak_region_bytes": 516.0, "peak_region_entropy": 5.14 } } }, "id": 1, "path": "SolTechnology.Core.Logging.1.2.0.nupkg!!_rels/.rels", "sha": "6f15aa60af525a464140c50c0a036a10f76789a1a96c98db4d378aafd264f16d", "size": 516, "type": "xml" }, { "ctx": [ { "b": "[4ls%kx}3YaA?spB7]MgjT8QkfD}SJzEWP}x(mMDb6w0teJs}sj]", "n": [ { "c": 2, "d": "NuGet nuspec manifest file", "i": "metadata/build/manifest::nuspec-file", "o": 0, "z": 33, "cf": 0.9800000190734863 } ], "ln": 1, "addr": 0 }, { "b": "jAa.syHH\u003c!aB4:tzGv@+xMOuniXJdcv}YB\u003cvrj5rx\u003e8g4B8LVje[n*pfk$ufyHH\u003c\u0026zF7QTfFLsofG7O4B-RIkv\u003eJ1EwfKh", "ln": 2, "addr": 42 }, { "b": "arS^-wPRu\u003evrt{w", "ln": 3, "addr": 118 }, { "b": "arR^Hjy-qGD2^RixMMCPSur@IgbZmNz!{K}wN/y\u003ez!%u8C%0-\u0026z/x#xx\u003eIa3j]", "ln": 14, "addr": 783 }, { "b": "arR^HjAL1AB3sU-y\u0026\u003ck#xL}:8z!Btrv@Dy0az+$exk8l@aAITBBZ]JoA+e=ky\u0026r%0x(mMavrly9wPRB2A+cwnA:-D(zF785x\u003c\u003eT(z/Z2mv@\u0026=hvSMa3C41\u0026]y?X0pay/tgA+f5}BzkVheOO-rzeTraBz(hlzF785z//(dBrC7mxKL}2jtg!+xlcl", "ln": 15, "addr": 833 }, { "b": "arR^HjAt1Lz/YSmz/QaCBA}?pjTaJMBrR\u0026IA+)(.xMOunB2\u003e%cxk8E3BZ=$kz/4c[wo8x)zC$T$B.tc0vj$L$y/B$QxL}:8z!BtFlVm0Ra%punvqYN*jTa]Tw]/RswNPa\u003cfkUcsBy/Fpay/tbze18Pa#:axi5iALiwAi$gC-S0g=WMQh-S(Qh8O(Qwhk@Lvk6I#vpqfdg:j4}j]", "n": [ { "c": 2, "d": "NuGet package declares repository", "i": "metadata/package/files/nuget::nuspec-repository", "o": 985, "z": 116, "cf": 0.8999999761581421 } ], "ln": 16, "addr": 981 }, { "b": "arR^Hjy\u00262xwO#3\u0026zEWx(B3o", "ln": 17, "addr": 1147 }, { "b": "arR^HarS^VA=l8taAR4jxjVfOA:-/@Cw?IqjTa=PBtkE4fD}R)j]", "ln": 18, "addr": 1166 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 1423.0, "entropy": 5.0, "size_bytes": 1423.0 }, "binary": { "overall_entropy": 5.0, "peak_region_bytes": 1423.0, "peak_region_entropy": 4.89 } } }, "id": 2, "path": "SolTechnology.Core.Logging.1.2.0.nupkg!!SolTechnology.Core.Logging.nuspec", "risk": 1, "sha": "f6b2a46084c95913bee8464264689d4db5ebf63b9518a5f240ee5ce2214361a3", "size": 1423, "traits": [ { "id": "metadata/build/manifest::nuspec-file", "conf": 0.9800000190734863, "crit": 2, "desc": "NuGet nuspec manifest file", "spans": [ [ 0, 33 ] ] }, { "id": "metadata/package/files/nuget::nuspec-repository", "conf": 0.8999999761581421, "crit": 2, "desc": "NuGet package declares repository", "spans": [ [ 985, 116 ] ] } ], "type": "xml" }, { "depth": 1, "facts": { "metrics": { "png": { "a_entropy": 1.63, "chunk_count": 38.0, "trailing_bytes": 0.0, "idat_chunk_count": 36.0, "text_chunk_bytes": 0.0, "chunks_after_iend": 0.0, "compression_ratio": 0.26, "unknown_chunk_count": 0.0 }, "file": { "size": 143205.0, "entropy": 7.99, "size_bytes": 143205.0 }, "image": { "width": 370.0, "height": 369.0, "channels": 4.0, "b_entropy": 3.12, "g_entropy": 3.08, "r_entropy": 3.16, "edge_density": 0.04, "pixel_entropy": 3.25, "histogram_flatness": 0.41 }, "binary": { "overall_entropy": 7.99, "peak_region_bytes": 143205.0, "peak_region_entropy": 7.83 } } }, "id": 3, "path": "SolTechnology.Core.Logging.1.2.0.nupkg!!docs/mini-logo.png", "sha": "2e1f8280cb4993bed3e5c280ab1212a028bcb9b03f79a637e7366afe7bfeca00", "size": 143205, "traits": [ { "id": "metadata/package/files/included::png-extension-basename", "conf": 0.8999999761581421, "crit": 1, "desc": "Filename ends with .png", "spans": [ [ 0, 13 ] ] } ], "type": "png" }, { "ctx": [ { "b": "bo[sfz!@x:v}Y:#y\u0026r%ie\u003c\u003cL$wIcU{xj\u003e{@x8", "ln": 1, "addr": 0 }, { "b": "", "ln": 2, "addr": 30 }, { "b": "p\u0026ZF+BZ]Jcz/ddEwNPa{az+$exk8l@aAhvnze19aC4C.qw]zYjk#QPjpdnb8lVm0RaA8cuBz(avz!n", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 67, "z": 3, "cf": 0.800000011920929 } ], "ln": 3, "addr": 31 }, { "b": "u}\u003euBA=l2qw]]T]CYWImB7]MgB1Qd8xj\u003e{@xj9tmp\u003c3O\u003cazC{ux(k54zE:(nz/{7yvq{fdxjVgaayMx]gEA:7z/6Dfx\u003c\u003e[3", "ln": 4, "addr": 94 }, { "b": "v@DydwO+^%x(v(ix\u003eeu8zxJIlwPA5sA+flkwPI@AaAITkBAITRvrVd2wGV28ADL\u0026lBrCdjC4CGdAaHedz!Bbxay]4[y*?u)Bzk]f", "ln": 5, "addr": 171 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 16053.0, "entropy": 5.15, "size_bytes": 16053.0 }, "text": { "digit_ratio": 0.02, "space_count": 2169.0, "total_lines": 413.0, "char_entropy": 5.15, "unique_chars": 99.0, "lines_over_200": 1.0, "avg_line_length": 37.87, "high_byte_ratio": 0.01, "max_line_length": 213.0, "non_ascii_ratio": 0.01, "empty_line_ratio": 0.2, "last_line_length": 76.0, "long_token_count": 1.0, "whitespace_ratio": 0.16, "most_common_ratio": 0.08, "line_length_stddev": 37.21, "repeated_char_sequences": 12.0, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 23.0, "most_common_char_codepoint": 101.0 }, "binary": { "overall_entropy": 5.15, "peak_region_bytes": 10240.0, "peak_region_entropy": 5.43 } } }, "id": 4, "path": "SolTechnology.Core.Logging.1.2.0.nupkg!!docs/readme.md", "risk": 1, "sha": "e28f810e94420508aac3a404e4828354010fdc0083114db3d4b524273fc9ad8b", "size": 16053, "traits": [ { "id": "metadata/file/profile/language::lang-english", "conf": 0.800000011920929, "crit": 2, "desc": "English language detection", "spans": [ [ 67, 3 ] ] }, { "id": "metadata/file/extension/identity::doc-or-config-extension", "conf": 1.0, "crit": 1, "desc": "Document or config file extension", "spans": [ [ 0, 9 ] ] }, { "id": "metadata/file/extension/identity::markdown-file-basename", "conf": 1.0, "crit": 1, "desc": "Markdown document file extension", "spans": [ [ 0, 9 ] ] } ], "type": "markdown" }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J\u0026m(", "n": [ { "c": 3, "d": "HTTP fingerprinting evasion campaign", "i": "objectives/command-and-control/infrastructure/user-agent::http-fingerprinting-campaign", "o": 0, "z": 34, "cf": 0.8999999761581421 } ], "ln": 0 }, { "b": "000000000000000000000iDk300000nb@R\u00260SSx7YG=C%c#e!.0rr91000000000000", "n": [ { "c": 1, "d": "PE standard code/data section", "i": "metadata/binary/section/names::pe-code-data-standard-section", "o": 512, "z": 5, "cf": 0.8999999761581421 } ], "ln": 496 }, { "b": "huFn6000c7db$pc3mVlflq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn", "n": [ { "c": 3, "d": "Recognized PE anti-analysis marker", "i": "objectives/anti-analysis/debugger-detect/combined-checks::evasion-aware-recognized-pe-marker", "o": 8892, "z": 4, "cf": 1.0 } ], "ln": 8876 }, { "b": "mLNq1l]+lfo(BM+y?k^gq*ACawO\u003c4\u003epxiH{vqPNtpYJR0Byxiirb3hXB97\u0026cA6v7#jA2BYwD", "n": [ { "c": 2, "d": "System namespace reference", "i": "metadata/lang/compiler/managed::system-namespace", "o": 19618, "z": 9, "cf": 0.800000011920929 } ], "ln": 19602 }, { "b": "0b2\u003e+uR1QDq/(C*By!$.xjVf(qE%\u0026\u003cwPI@VvScpewN\u003e^NwPRoJB3\u003cwNv}xE)vruj4zC\u003e4=B.bQ", "n": [ { "c": 3, "d": "Access to ASP.NET Request object", "i": "micro-behaviors/communications/http/server/managed::http-request-get", "o": 20098, "z": 11, "cf": 1.0 } ], "ln": 20082 }, { "b": "wnb{\u0026y!nnSz/PzRvrk#WxjVf(qE%]*z/fSc07y^Cx\u003e7*OwPI*ezGxv?now@)qE%]*z/fSc0chT(", "n": [ { "c": 3, "d": "Access to ASP.NET Response object", "i": "micro-behaviors/communications/http/server/managed::http-response-get", "o": 21526, "z": 12, "cf": 1.0 } ], "ln": 21510 }, { "b": "x(mL-m}D^vBAh8kx8\u003e[Hnm^3ABAh8kx8\u003e\u003eMvSMTix(mL-pI%9MvrcE7zF5@XCXIkvx(mL-o-", "n": [ { "c": 1, "d": ".NET hex string conversion", "i": "objectives/command-and-control/dropper/staging/encrypted::dotnet-hexstring-conversion", "o": 22751, "z": 9, "cf": 0.8600000143051147 } ], "ln": 22735 }, { "b": "z!BtFlVm0Re\u003e*g@xk8l@e[w^m07I9EyYEBFA=ld[w\u003e)F+yYEvAvpSwUyYEyQA+eV@0b2\u003e+uRbuJz2!S*BydQYwO?AWwPRoTD2[7sz2^1xB.}aTx(dAWAa9R:l32$zvqV", "n": [ { "c": 3, "d": "Modification of HTTP context items", "i": "micro-behaviors/communications/http/server/managed::http-context-item-setter", "o": 23301, "z": 8, "cf": 0.8500000238418579 }, { "c": 3, "d": "References Windows executable or script", "i": "objectives/execution/interpreter/script/shell::windows-executable-ref", "o": 23255, "z": 4, "cf": 0.6000000238418579 } ], "ln": 23239 }, { "b": "zE^r@v%HT-ygQ)%x(v\u003e?q*ACawO\u003c4$wOb:\u0026v@#B6zu9mbwPz%dv}w2Cy\u00260V)BzkVh07*4gwPA5-z!%l3v/", "n": [ { "c": 2, "d": "Benign high-entropy PE context", "i": "metadata/package/quality/false-positives::benign-high-entropy-pe-context", "o": 23513, "z": 17, "cf": 0.949999988079071 } ], "ln": 23497 }, { "b": "z/bLNwPQv=v}xR3x(v\u003e?lVl\u003cWwN/*@z/eD:B7GCZCW\u003er7BzkVh06$TrB.$YcBvyB:wPh:9z/bL^CW\u003er7BzkVh08[e:By/qwraQq@e\u003eQh6zu9QSA+PA7lVl*Xvrc76z/bLOA^o@Ywk^hWxkzd3zV", "n": [ { "c": 3, "d": "JSON polymorphism runtime marker", "i": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "o": 23750, "z": 16, "cf": 1.0 }, { "c": 1, "d": "Regex component marker", "i": "objectives/persistence/login/scheduled-task/com::task-scheduler-builder-methods--rx-1", "o": 23697, "z": 24, "cf": 0.8999999761581421 } ], "ln": 23681 }, { "b": "l340uwPQpTA+c\u003c]BAzE4q*ACawO\u003c4[x(m[\u003crbUYSA+PA7l2Hj2y?m3}07gBdASx0GvpR]uvpS{", "n": [ { "c": 3, "d": "LINQ query operations", "i": "micro-behaviors/data/db/linq::linq-queries", "o": 23864, "z": 11, "cf": 0.699999988079071 } ], "ln": 23848 }, { "b": "B8aGYBzbP6luN0UwmY=Yq/)4]zF8pUx(4r\u003eASwV%AbYScv{%E[z/d):x(4r\u003eASwi=Byex:B.LV5wD", "n": [ { "c": 1, "d": ".NET StringBuilder Append use", "i": "objectives/command-and-control/dropper/staging/encrypted::dotnet-stringbuilder-append", "o": 24005, "z": 13, "cf": 0.8199999928474426 } ], "ln": 23989 }, { "b": "wN[.YA+PA7nmuyDy?mR!q*ACawO\u003c4!z!9AEz/49]z/6Dcy?mR!o(BM+y?lgQB97\u0026by?mR!z*c8gASwWLrD8[*ASx2", "n": [ { "c": 3, "d": ".NET dynamic code generation capability", "i": "metadata/lang/compiler/managed::dotnet-dynamic-code", "o": 24198, "z": 23, "cf": 0.8500000238418579 } ], "ln": 24182 }, { "b": "Bz@\u0026#vSMTivpKy[z/fQ@o\u003e!9Tz/Y\u0026eBs]\u003e2A86$^lVm0Re\u003c\u003cL{zE)s1x(v)ge\u003cS@/BAg/1BzkVhA@Yc:B97#ge\u003c\u003cL[y?m9#x(v)g08mfqA=l2qw]]T\u003eB8T(=Bvf$!wIct*zF\u003c2}BzkVhA@X{Gv@=Hez!s8zmr\u0026]=zGxJgzGvBaAcb/jzGt!zwb", "n": [ { "c": 1, "d": "Regex component marker", "i": "objectives/persistence/login/scheduled-task/com::task-scheduler-builder-methods--rx-1", "o": 25782, "z": 45, "cf": 0.8999999761581421 } ], "ln": 25766 }, { "b": "Bo1)NlU{EFzGFfNz/P}1xjVf(qE%\u0026\u003cwPI}[mSJA:qE%\u0026\u003cwPI}[now@)qE%\u0026\u003cwPI}[A+flkwPI}", "n": [ { "c": 3, "d": "Access to ASP.NET Request object", "i": "micro-behaviors/communications/http/server/managed::http-request-get", "o": 26727, "z": 11, "cf": 1.0 } ], "ln": 26711 }, { "b": "wQ5p%q/(}%lVl\u003c:wQ5p%now@)lVl\u003c:wQ5p%q/(C*Bvf$:By/Ys0aP}+By/Ys08)#FA=+5/Ck%@", "n": [ { "c": 3, "d": "Access to ASP.NET HttpContext", "i": "micro-behaviors/communications/http/server/managed::http-context", "o": 26828, "z": 11, "cf": 1.0 } ], "ln": 26812 }, { "b": "000xW0bITH0cOuN000P:0bRZE0cwiY0bhBy0cnbu5IBc90cXAK0a#pA0a=dJ000%70cFo-0b8vJ0ce6N0d1SN0cwiP0b?\u003cP001xy0ce6T0c!G?04!gp0cFo-", "n": [ { "c": 3, "d": "Application has metrics/telemetry", "i": "metadata/package/quality/profile::has-metrics", "o": 27249, "z": 7, "cf": 0.8500000238418579 }, { "c": 2, "d": "Authorization header", "i": "micro-behaviors/communications/http/request/client::auth-header-dup", "o": 27284, "z": 13, "cf": 0.5 } ], "ln": 27233 }, { "b": "w=Ky.q#*?pyxd]Czu6XPso6]MqVHweA@ZmYx-J5Kzu8l*nDro30uUzzeDwYHwDl=KA@Y[OzVBUP", "n": [ { "c": 3, "d": "QNX .NET session header", "i": "objectives/command-and-control/beacon/network/http::qnx-dotnet-session-header", "o": 27486, "z": 12, "cf": 0.9399999976158142 } ], "ln": 27470 }, { "b": "xd=FVB98Chv@#B6zGvuKr+lq)x(v(Lf!+jle?![iefEr5y\u0026\u003c/uwJ:{xB-.Ujy+cY9BZ/f3v[QxUrbVL-", "n": [ { "c": 2, "d": "IPv4-like .NET assembly version", "i": "metadata/lang/compiler/managed::dotnet-ipv4-like-version", "o": 34804, "z": 16, "cf": 0.8500000238418579 } ], "ln": 34788 }, { "b": "00000000000000000000000000000000000000315c8Xg7YTL^00000000000000000", "n": [ { "c": 1, "d": "PE resource section", "i": "metadata/binary/section/names::pe-resource-section", "o": 36864, "z": 5, "cf": 0.8999999761581421 } ], "ln": 36848 }, { "b": "00000000000058:gYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006Xn[brp!0rrf30rr9", "n": [ { "c": 3, "d": "Recognized marker for timing checks", "i": "objectives/anti-analysis/timing/evasion::timing-anti-debug-recognized-marker", "o": 36958, "z": 15, "cf": 0.949999988079071 } ], "ln": 36942 }, { "b": "vGprDCMot@002g.4/=RglJz38z2!IPve$fBC(QOtve$cAwDhYg002{$zVBONaokvvwDliuxAh]", "n": [ { "c": 2, "d": "PE CompanyName metadata field", "i": "metadata/package/versioning::pe-companyname-field", "o": 37618, "z": 11, "cf": 0.699999988079071 } ], "ln": 37602 }, { "b": "zVBzIC(N*A003s98VP)smGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up002{$zVBONq#*Ffv/Qf", "n": [ { "c": 2, "d": "PE FileDescription metadata field", "i": "metadata/package/versioning::pe-filedescription-field", "o": 37682, "z": 15, "cf": 0.699999988079071 } ], "ln": 37666 }, { "b": "x-J2Jx8?]i001XM2MK(9mGvc5yYF2DrSDXhASydXx-J5Kzu6Up001.Ne=WTbe=WN9e=WN9003s99@(rwnDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE002{$zVBONq#*Ffv/QfxzuaOP", "n": [ { "c": 3, "d": "Dotted-quad PE version metadata marker", "i": "objectives/command-and-control/infrastructure/ip::ipv4-version-metadata-marker", "o": 37778, "z": 11, "cf": 0.9399999976158142 }, { "c": 2, "d": "PE InternalName metadata field", "i": "metadata/package/versioning::pe-internalname-field", "o": 37826, "z": 12, "cf": 0.699999988079071 } ], "ln": 37762 }, { "b": "yYFwNx8)hS003Qh9@(rwpxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE002{$zVBONq#*Ffv/Qfx", "n": [ { "c": 2, "d": "PE OriginalFilename metadata field", "i": "metadata/package/versioning::pe-originalfilename-field", "o": 38002, "z": 16, "cf": 0.699999988079071 } ], "ln": 37986 }, { "b": "wb{ACyYBCn003418VP)spYLIozVBqFBPt[KBo25ove$cAwDhYg002{$zVBONq#*Ffv/QfxzuaO", "n": [ { "c": 2, "d": "PE ProductName metadata field", "i": "metadata/package/versioning::pe-productname-field", "o": 38106, "z": 11, "cf": 0.699999988079071 } ], "ln": 38090 }, { "b": "x-J2Jx8?]i004PJf8#1MpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001.Ne=WTbe=WN9d/.Hdw=I", "n": [ { "c": 2, "d": "PE version resource metadata", "i": "metadata/package/versioning::version-resource-metadata", "o": 38194, "z": 14, "cf": 0.8999999761581421 } ], "ln": 38178 }, { "b": "000000000000000000000h6q(3\u0026*ncauYY8000000000000000000000000000000000", "n": [ { "c": 2, "d": "PE .reloc section presence", "i": "metadata/binary/section/names::reloc-section-presence", "o": 38400, "z": 6, "cf": 0.8999999761581421 } ], "ln": 38384 } ], "depth": 1, "facts": { "imp": [ [ "mscoree", "CorDllMain" ] ], "sec": [ [ ".text", 512, 36352, 5.93, "r-x" ], [ ".rsrc", 36864, 1536, 3.36, "r--" ], [ ".reloc", 38400, 512, 0.08, "r--" ] ], "metrics": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "resource_count": 1.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 78899.0, "reloc_overhang_bytes": 500.0, "reloc_overhang_ratio": 0.98, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "version.identity_entropy": 3.69, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0, "version.identity_symbol_ratio": 0.06 }, "file": { "size": 38912.0, "entropy": 5.77, "size_bytes": 38912.0 }, "binary": { "is_pie": 1.0, "code_entropy": 5.93, "string_count": 577.0, "overall_entropy": 5.77, "entropy_variance": 5.72, "avg_string_length": 19.33, "max_string_length": 207.0, "peak_region_bytes": 1024.0, "code_to_data_ratio": 1.0, "peak_region_entropy": 6.27, "string_length_stddev": 18.87, "largest_section_ratio": 0.93, "sentence_string_count": 23.0, "sentence_string_ratio": 0.04, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 36352.0, "entropy_max": 5.93, "entropy_mean": 3.12, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } } }, "id": 5, "mol": "O₂(AlC)H₂(CmDb)", "path": "SolTechnology.Core.Logging.1.2.0.nupkg!!lib/net10.0/SolTechnology.Core.Logging.dll", "risk": 5, "sha": "29c934f30eb4e1b8e5255b28634517119a69a06d14c2c9466c35e56d3ef6deff", "size": 38912, "traits": [ { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 36958, 15 ] ] }, { "id": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "conf": 1.0, "crit": 3, "desc": "JSON polymorphism runtime marker", "spans": [ [ 23750, 16 ] ] }, { "id": "micro-behaviors/communications/http/server/managed::http-response-get", "conf": 1.0, "crit": 3, "desc": "Access to ASP.NET Response object", "spans": [ [ 21526, 12 ] ] }, { "id": "micro-behaviors/communications/http/server/managed::http-item-setter", "conf": 1.0, "crit": 1, "desc": "Modification of HTTP context items", "spans": [ [ 23301, 8 ] ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "spans": [ [ 8892, 4 ] ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "spans": [ [ 37778, 11 ] ] }, { "id": "objectives/command-and-control/beacon/network/http::qnx-dotnet-session-header", "atk": "T1071.001", "conf": 0.9399999976158142, "crit": 3, "desc": "QNX .NET session header", "spans": [ [ 27486, 12 ] ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "spans": [ [ 23255, 4 ] ] }, { "id": "micro-behaviors/communications/http/server/managed::http-context", "conf": 1.0, "crit": 3, "desc": "Access to ASP.NET HttpContext", "spans": [ [ 26828, 11 ] ] }, { "id": "objectives/command-and-control/dropper/staging/encrypted::dotnet-hexstring-conversion", "atk": "T1027", "mbc": "C0025", "conf": 0.8600000143051147, "crit": 1, "desc": ".NET hex string conversion", "spans": [ [ 22751, 9 ] ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "spans": [ [ 38194, 14 ] ] }, { "id": "objectives/command-and-control/dropper/staging/encrypted::dotnet-stringbuilder-append", "atk": "T1027", "mbc": "C0025", "conf": 0.8199999928474426, "crit": 1, "desc": ".NET StringBuilder Append use", "spans": [ [ 24005, 13 ] ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "micro-behaviors/data/db/linq::linq-queries", "conf": 0.699999988079071, "crit": 3, "desc": "LINQ query operations", "spans": [ [ 23864, 11 ] ] }, { "id": "micro-behaviors/communications/http/server/managed::http-request-get", "conf": 1.0, "crit": 3, "desc": "Access to ASP.NET Request object", "spans": [ [ 20098, 11 ], [ 26727, 11 ] ] }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "spans": [ [ 0, 26 ] ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "spans": [ [ 8892, 4 ] ] }, { "id": "micro-behaviors/communications/http/server/managed::http-context-item-setter", "conf": 0.8500000238418579, "crit": 3, "desc": "Modification of HTTP context items", "spans": [ [ 23301, 8 ], [ 26828, 11 ] ] } ], "type": "pe" }, { "id": 6, "sha": "98aa8aba2db4dd678582132021ec9b42e86dd985597ce27f8bbfdb3c2bffabf5", "path": "SolTechnology.Core.Logging.1.2.0.nupkg!!lib/net10.0/SolTechnology.Core.Logging.xml", "size": 41550, "type": "xml", "depth": 1 }, { "id": 7, "sha": "b858fadd5794c5a53fcbaa7a45db7aa5f6ab1fd173ba71cc2625214ee1509c6a", "path": "SolTechnology.Core.Logging.1.2.0.nupkg!![Content_Types].xml", "size": 644, "type": "xml", "depth": 1 }, { "id": 8, "sha": "53c808b781350b6c8c61af95dc2c959f142afcff785a51a320cccfbfbda4305f", "path": "SolTechnology.Core.Logging.1.2.0.nupkg!!package/services/metadata/core-properties/ceac09aaf038466ab7f1afc65edf5eb5.psmdcp", "size": 947, "type": "xml", "depth": 1 }, { "id": 9, "sha": "9bba1dae185626b2f3a0ba3ba97e34536ded4ee80cdeff476f2fc8969811e36d", "path": "SolTechnology.Core.Logging@1.2.0.registry.json", "size": 998, "type": "registry", "depth": 1 } ], "omitted_files": 4, "rev": "20834", "v": "8" } }