{ "ml": { "v": "7", "eng": "2.12.0-beta.0", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.27646345, "rte": "az", "prob": 0.27646345 }, { "cls": 0, "raw": 0.010562043, "rte": "az/nupkg", "prob": 0.010562043 } ], "prob": 0.27646345, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.27646344900131226, "type": "nupkg" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.00001477201749366941, "type": "powershell" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.000018616517991176806, "type": "xml" }, { "id": 6, "lvl": -1, "conf": 0, "prob": 0.00002927581408584956, "type": "pe" }, { "id": 7, "lvl": -1, "conf": 0, "prob": 0.000039696693420410156, "type": "pe" }, { "id": 8, "lvl": -1, "conf": 0, "prob": 0.000011046727195207495, "type": "powershell" }, { "id": 9, "lvl": -1, "conf": 0, "prob": 0.000015834966688998975, "type": "powershell" } ], "version": "v18.18", "analyzed_at": "2026-09-22T12:24:54Z" }, "path": "AWS.Tools.CodePipeline.5.0.303.nupkg", "raw": { "files": [ { "id": 0, "mol": "K(Li)O₂(AsC₂)H₅(Cm₆DbFOs₂Po₂)Md₅(Bi₃Pa₂Si₄)", "sha": "a043bd890bb5ef1a62f92b3d576e5a6174360184bd0cf5d62a857fe7343cc932", "path": "AWS.Tools.CodePipeline.5.0.303.nupkg", "risk": 23, "size": 299687, "type": "nupkg", "facts": { "metrics": { "file": { "size": 299687, "entropy": 8 }, "binary": { "peak_region_bytes": 294912, "peak_region_entropy": 7.83 }, "archive": { "file_count": 13, "member_count": 13, "script_count": 3, "zip_bomb_ratio": 15.08, "compressed_size": 297931, "directory_count": 0, "executable_count": 2, "extra_field_size": 0, "noise_file_count": 0, "compression.ratio": 0.18, "hidden_file_count": 1, "uncompressed_size": 1626811, "crc_collision_count": 0, "entry_comment_count": 0, "max_filename_length": 81, "rtlo_filename_count": 0, "format.regular_count": 13, "nested_archive_count": 0, "path_traversal_count": 0, "symlink_escape_count": 0, "security.setgid_count": 0, "security.setuid_count": 0, "security.sticky_count": 0, "double_extension_count": 0, "duplicate_member_count": 0, "security.symlink_count": 0, "unicode_filename_count": 0, "homoglyph_filename_count": 0, "security.encrypted_count": 0, "timing.mtime_unique_count": 8, "timing.mtime_unique_ratio": 0.62, "misplaced_executable_count": 2, "timing.mtime_dominant_count": 4, "timing.mtime_spread_seconds": 4834, "timing.sentinel_mtime_count": 0, "security.world_writable_count": 0, "timing.mtime_dominant_fraction": 0.31, "compression.method_counts.deflate": 13 } } }, "ident": { "name": { "value": "AWS.Tools.CodePipeline", "source": "nupkg.title", "verified": false }, "urls": [ { "url": "https://github.com/aws/aws-tools-for-powershell", "kind": "homepage", "source": "nupkg.project_url" } ], "trust": "unsigned", "authors": [ { "name": "Amazon.com", "role": "author", "source": "nupkg.authors" }, { "name": "Inc", "role": "author", "source": "nupkg.authors" } ], "version": { "value": "5.0.303", "source": "nupkg.version", "verified": false }, "identifier": { "value": "AWS.Tools.CodePipeline", "source": "nupkg.id", "verified": false } }, "traits": [ { "id": "metadata/package/versioning/scheme::version-info-file-version-present", "conf": 0.95, "crit": 3, "desc": "PE FileVersion value is present" }, { "id": "micro-behaviors/os/group/membership::privileged-local-group-name", "atk": "T1098", "conf": 0.9, "crit": 3, "desc": "References a privileged local group", "from": [ { "file": 8 } ] }, { "id": "micro-behaviors/communications/http/message::powershell-http-url-literal", "conf": 0.75, "crit": 3, "desc": "PowerShell HTTP/HTTPS URL literal", "from": [ { "file": 8 } ] }, { "id": "metadata/build/reproducible::pe-reproducible-build", "conf": 1.0, "crit": 2, "desc": "Built with /Brepro (deterministic)" }, { "id": "metadata/lang/scripted::type-accelerator", "conf": 0.78, "crit": 2, "desc": "PowerShell type accelerator syntax", "from": [ { "file": 9 } ] }, { "id": "metadata/binary/code/entropy::code-entropy-at-most-7-5", "conf": 0.7, "crit": 2, "desc": "Code entropy is 7.5 or lower", "from": [ { "file": 6 } ] }, { "id": "metadata/signed/unknown::amazon-web-services-inc.", "conf": 1.0, "crit": 3, "desc": "Authenticode chain CN: Amazon Web Services, Inc.", "from": [ { "file": 6 } ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR header (COM descriptor)" }, { "id": "metadata/package/versioning/scheme::pe-filedescription-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes FileDescription", "from": [ { "file": 6 } ] }, { "id": "metadata/encoded-payload/base64-base64", "conf": 0.9, "crit": 3, "desc": "Encoded content decoded: base64 → base64" }, { "id": "metadata/lang/scripted::function-blocks", "conf": 0.82, "crit": 2, "desc": "PowerShell function block syntax", "from": [ { "file": 9 } ] }, { "id": "metadata/package/versioning/scheme::pe-fileversion-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes FileVersion", "from": [ { "file": 6 } ] }, { "id": "metadata/encoded-payload/base64", "conf": 0.9, "crit": 3, "desc": "Encoded content decoded: base64" }, { "id": "micro-behaviors/process/interpreter/eval/direct::powershell-iex-call", "atk": "T1059.001", "mbc": "E1059", "conf": 0.9, "crit": 3, "desc": "PowerShell invokes Invoke-Expression (IEX)", "from": [ { "file": 9 } ] }, { "id": "metadata/package/versioning/scheme::pe-companyname-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes CompanyName", "from": [ { "file": 6 } ] }, { "id": "micro-behaviors/communications/url/encoded::encoded-http-url", "atk": "T1027", "mbc": "B0032", "conf": 0.85, "crit": 3, "desc": "Encoded URL decoded to http(s)", "from": [ { "file": 3 } ] }, { "id": "metadata/package/versioning/scheme::pe-productname-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes ProductName", "from": [ { "file": 6 } ] }, { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "from": [ { "file": 5 } ] }, { "id": "metadata/binary/layout/overlay::image-under-768kb", "conf": 0.9, "crit": 3, "desc": "PE mapped image under 768 KiB", "from": [ { "file": 6 } ] }, { "id": "objectives/command-and-control/backdoor/loader/managed-reflect::ps-invoke-token", "atk": "T1620", "mbc": "B0024", "conf": 0.8, "crit": 3, "desc": "PowerShell Invoke token", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/data/manipulation::dotnet-item-setter-token", "conf": 0.65, "crit": 3, "desc": ".NET set_Item method reference", "from": [ { "file": 7 } ] }, { "id": "micro-behaviors/communications/http/url/path::image-file-url", "conf": 0.85, "crit": 3, "desc": "HTTP URL targets an image file", "from": [ { "file": 8 } ] }, { "id": "metadata/signed/leaf::amazon-web-services-inc.", "conf": 1.0, "crit": 3, "desc": "Signed by Amazon Web Services, Inc.", "from": [ { "file": 6 } ] }, { "id": "metadata/lang/natural::lang-english--atom-2", "conf": 0.8, "crit": 1, "desc": "English function-word token \"and\"", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/communications/url/encoded::authenticode-script-signature-context", "atk": "T1027", "mbc": "B0032", "conf": 0.98, "crit": 3, "desc": "Authenticode script signature block context", "from": [ { "file": 3 } ] }, { "id": "metadata/package/versioning/scheme::pe-productversion-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes ProductVersion", "from": [ { "file": 6 } ] }, { "id": "micro-behaviors/communications/http/client/managed::user-agent-accessor", "conf": 0.8, "crit": 3, "desc": "HttpClient UserAgent accessor", "from": [ { "file": 7 } ] }, { "id": "well-known/lib/cloud/aws-sdk-dotnet::aws-sdk-dotnet-core", "conf": 1.0, "crit": 3, "desc": "AWS SDK for .NET Core assembly", "from": [ { "file": 6 } ] }, { "id": "micro-behaviors/fs/path/extension::utf16-exe-suffix-token", "conf": 0.84, "crit": 3, "desc": "UTF-16 exe filename suffix token", "from": [ { "file": 7 } ] }, { "id": "micro-behaviors/process/interpreter/powershell/host::sma-namespace", "atk": "T1059.001", "mbc": "E1059", "conf": 0.85, "crit": 3, "desc": "System.Management.Automation import", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/communications/ip/literal::http-ip-url-text", "conf": 0.95, "crit": 3, "desc": "Non-source data contains external-IP HTTP URL", "from": [ { "file": 4 } ] }, { "id": "metadata/signed/trust-level::dotnet-strong-name-signed", "conf": 0.95, "crit": 3, "desc": "Managed assembly is strong-name signed", "from": [ { "file": 6 } ] }, { "id": "objectives/command-and-control/dropper/execution/fileless::curl-custom-ua-piped-powershell--rx-27", "conf": 0.9, "crit": 3, "desc": "Matches 'Invoke-Expression'", "from": [ { "file": 9 } ] }, { "id": "metadata/package/versioning/scheme::pe-productversion-semver-git-hash", "conf": 0.9, "crit": 3, "desc": "PE ProductVersion has SemVer git hash" }, { "id": "micro-behaviors/communications/http/url/forge::public-code-forge-url", "conf": 0.9, "crit": 3, "desc": "References a public code-forge URL", "from": [ { "file": 8 } ] }, { "id": "metadata/signed/certificate/identity::pe-signature-verified", "conf": 1.0, "crit": 2, "desc": "PE Authenticode integrity check reports intact" }, { "id": "metadata/package/versioning/scheme::pe-internalname-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes InternalName", "from": [ { "file": 6 } ] }, { "id": "micro-behaviors/os/sysinfo/platform/version::os-version", "conf": 0.8, "crit": 3, "desc": "Queries OS version info", "from": [ { "file": 9 } ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET managed assembly", "from": [ { "off": 48132, "file": 6 }, { "off": 137540, "file": 7 } ], "uses": [ 7, 45 ] }, { "id": "micro-behaviors/data/parse/vocabulary::credentials-path-tail", "conf": 0.4, "crit": 3, "desc": "Path ending in credentials", "from": [ { "file": 6 } ] }, { "id": "objectives/anti-static/obfuscation/payload/encrypted::aes-key-field-token", "atk": "T1573.001,T1027", "mbc": "C0027", "conf": 0.8, "crit": 3, "desc": "AES or generic key field name", "from": [ { "file": 7 } ] }, { "id": "metadata/signed/certificate/identity::powershell-signature-block", "conf": 0.95, "crit": 3, "desc": "PowerShell Authenticode signature block", "from": [ { "file": 3 } ] }, { "id": "metadata/package/versioning/scheme::pe-version-product-name-value", "conf": 0.9, "crit": 3, "desc": "PE version resource names a product" }, { "id": "metadata/lang/natural::lang-english--atom-7", "conf": 0.8, "crit": 1, "desc": "English function-word token \"this\"", "from": [ { "file": 5 } ] }, { "id": "metadata/lang/natural::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"", "from": [ { "file": 5 } ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET metadata root signature (BSJB)", "from": [ { "file": 6 } ] }, { "id": "metadata/lang/natural::lang-english--atom-3", "conf": 0.8, "crit": 1, "desc": "English function-word token \"that\"", "from": [ { "file": 5 } ] }, { "id": "metadata/binary/symbols/imports::single-import-count", "conf": 0.7, "crit": 3, "desc": "PE with single import", "from": [ { "file": 6 } ] }, { "id": "metadata/lang/natural::lang-english--atom-4", "conf": 0.8, "crit": 1, "desc": "English function-word token \"have\"", "from": [ { "file": 5 } ] }, { "id": "metadata/binary/provenance/build::pe-far-future-timestamp", "conf": 0.95, "crit": 3, "desc": "PE COFF timestamp encodes a future date" }, { "id": "metadata/signed/certificate/identity::pe-signature-verified-kv", "conf": 1.0, "crit": 2, "desc": "PE Authenticode signer cryptography verifies" }, { "id": "metadata/lang/natural::lang-english--atom-6", "conf": 0.8, "crit": 1, "desc": "English function-word token \"with\"", "from": [ { "file": 5 } ] }, { "id": "metadata/package/versioning/scheme::pe-version-file-version-value", "conf": 0.9, "crit": 3, "desc": "PE version resource carries a file version" }, { "id": "metadata/signed/trust-level::signer-evidence-present", "conf": 1.0, "crit": 3, "desc": "Platform or developer signing evidence", "from": [ { "file": 6 }, { "file": 7 } ], "uses": [ 35, 50 ] }, { "id": "metadata/file/naming::many-high-entropy-identifiers", "conf": 0.7, "crit": 2, "desc": "High proportion of high-entropy identifiers", "from": [ { "file": 3 } ] }, { "id": "metadata/package/versioning/scheme::pe-version-resource", "conf": 0.8, "crit": 2, "desc": "PE version resource structure", "from": [ { "file": 6 } ] }, { "id": "metadata/file/archive::archive-paired-executable-members", "conf": 0.88, "crit": 3, "desc": "Archive contains two or more executables" }, { "id": "metadata/package/files/nuget::nupkg-multiple-executable-members", "conf": 0.98, "crit": 3, "desc": "NuGet package has multiple executable members" }, { "id": "metadata/file/archive::archive-misplaced-executable-member", "conf": 0.9, "crit": 3, "desc": "Archive executable in atypical path" } ] }, { "ctx": [ { "b": "[4lsVavy6TwL^8WwO=6#wEO#BwPPH\u0026y?Ws0at3t%zdK?WwPPH\u003ep^FPkx(v($vR/QFz^)=geMMp@B.8W=wPPH\u003ep^FPkx(v($vR/QFz^(yOB94\u0026#q!p55l2pmzB095fvqPM#m}D=]lR{6UBzkVhvpB4:ra]#^wkDYPBA{F%vSJUzr://!wGTGOBs/\u003cRl1t1Jz/e#)y?lNVx(W-XvrcEnn]Ffjx(!w93r7ITeKsh!vriLypgn0Jav*0+eKJubz^(aCByw)1B095nvqH6$av*0+eKJubz^(aCByw)14gl3BBs/^{x\u003c(69eLY.\u003ewGTGOBs/\u003cRra]#^wkDYPBA{F%vNK^HvqfL0at3S5y\u0026%qim}D=]lR{-}x(W-XvrcEnn]FfbwPRu{yZ*ZX3pPhUz/P}Ko(BM+y?lsLzdm6%at2(}x\u003c(69dH=.fax7\u003c4ar@0}wOkZ{aAImfzEETfA+cw5y\u0026r*04gjs5o?v{0BwVgkok!09xM^(Xk#zbVz+iJyAb4:coMrS\u003ek#y6}m0.c]lt7aExLRlEt2w0.l1-RQk$13%lt7jS4gjs5lt5.Ql0l=nl1-RPz+1\u003e)vn]JDlt7jSlt5.Ql0l=nl1-R$o*-5Jl3C:-k%XvBnh$/LsW)j3lQ-)?n\u003e@5I4gjs5oisc0rz=sOk%X7ek%X7ek%X7ek%X7ek$11-o*HE6lSVSBq:A(?l3Df[k#ySFlpj7Oi5tUmxhAIGryeY04gjs5v(l@0r-\u0026GZsv)p9zEMQ3rX4fWf*Pq-xL}Po", "ln": 0, "col": 1, "line": 1 }, { "b": "xluToze-T5o*HE6lSm${q+pBOl@uxtlW8J@o?fzLlWz3\u003clt64]lp1:Nl2oO3o\u0026s#nmr.)5r-8Z!4gjs5mr-#Bvol#Uq8hf$wj5WQvR[?:m]R=Rlt64]lp2V(mmZ@Bwo*4Fvol#UsU:36wj5j?vLPSZol@)ylt64]4gjs5lp1sBnO.jys#6[Zt3axJnKWris#6-6qclOtwlqDqvR[\u003eRnKVVYnK=r}vLZ\u003e]q7$B.nn8Hdo\u003e)mzo\u0026KMc4gjs5o*?o\u003eo*?o\u003es7(8so)M", "ln": 652, "col": 7, "line": 13 }, { "b": "lu+\u003c+lp:*{v]L:f4gjs5lt6}Klt5.Rlq.lpl0mt[vmToIv)\u003elUoFORyv(3z[t1ryDvoliuv@td^sU-0Vo*@?/lQL]+k#ySKlv7{+4gjs5xLGnuwjPQxpIz!isU-DYt3axJv%G}Evol#UsU:36wj5j?vLPSXqB+Lvvo36sv@tgovol#TqclOtwlqDq4gjs5vR[\u003eRqDu$1vLP}$q7$BYsU\u0026V7o*%a[k}#wInoW%2o*}S$qa\u003ch9z:X\u003evpI\u003c=0wjP0AoNeTkv@lBooL)WD4gjs5s#6]et3axJoL)KFvPboQvol#Uq8hf$wjpfJs#6+Tv(3\u003emv@jXTsU:2Er+$xKvLZ[IqbYt!v@lBlni{xD4gjs5r-gR:lpaW@ms4l\u003clt6tpxhJ\u003etl3+**lt6FtxhJ\u003etlp14:l@v8Vok!09xM^(Xk#y6AlqZ3pxj\u003cU1k$as?4gjs5Az/sYm0ID$wN/K)vq^}/h/Jy#A7%!Rl@lJ\u003cB7F(]s./W0yCxPWDh", "ln": 1992, "col": 55, "line": 32 }, { "b": "v)\u003elUoFORyv(3z[t1ryDvoliuv@td^sU-0Vo*}GvlQL]+k#ySKlv7{+xLHN^wjPQxpIz!isU-DY4gjs5t3axJv%G}Evol#UsU:36wj5j?vLPSXqB+Lvvo36sv@tgAv@ts[wjGWorC::twjo#ZoL)KIwje:Llt64]4gjs5nk.Aop^^Pco*\u0026Ydph@MNxLHdTwjPQxpIz!isU\u0026V\u003eo)FQivol#UsU:36wj5j?vLPSXqB+Lvvo36sv@tgA4gjs5v@ts[wjGWorC::twjo#ZoL)KIvNJH(lt64]nk?/ymPqVMo*JnVli", "ln": 4120, "col": 7, "line": 64 }, { "b": "v@tE?sU:37oHzcsvR[?Zo\u0026tFBmP0qRr-8Z/4gjs5mrZQ*qBLXNnK(l)t0\u003eRRvLP@+v%QNTo*.ipk}#wdl3MacqcbF=wO\u003cCInK^lbs.Qi4t3axLvoliuv%Joh4gjs5q=+?\u003eoLM{Zl19uel@v8Vok!09xM^(Xk#y6qlqZ3pxj\u003c.hk$17cl0na[xj\u003c.3k$:HDw(8M8m0QT\u003e", "ln": 5648, "col": 39, "line": 86 }, { "b": "lt64]nk\u0026ISl{%sllt6}Klt5.Rlq.kXl3+)+BwVger-gR-lp\u003cW?o?v\u0026{o?4]\u003erBFi\u003cxLPtvwjPQx4gjs5pIz!isU\u0026V\u003eo)FQivol#UsU:36wj5j?vLPSXqB+Lvvo36sv@tgAv@ts[wjGWoqHhkevLQ?$rwFxdvR]}74gjs5s$@SGqb*zppGgH%q:\u003cc3pEF69o*?M$q7$B-oL)KIvNJKZz:)lfr5v=NvmToIv)\u003elUoFPv*vNK7ot1ryD4gjs5voliuv@td^sU-0VoFxv-s#6[Zt3axJr.b?qv(420t18{Pq8gdEt2[yqs#4%OvR]TOrwl\u0026}o*\u0026+Lrwn8M4gjs5o)QCao\u003e($to\u0026T}Po\u0026A]:v@lBlxiFe5lQL]+k#ySKlu+\u003c+lp\u003cWro?v\u0026zo*.=FlQL]+k#ySKlv7{:xLq6$4gjs5wjPQxpIz!ivLQY8v)-a?vol#UsU:36wj5j?vLPSYsv37YolTJ9lqZ-No*IAxryZZRwjP0AoNeTksYXvm4gjs5v@tg\u003coL)WDs#6]et3axJoL)KFvPboQvol#Uq8hf$wjxExwlqOXt31P)pdm{3t1qQ)vol#Zvoks7rCUz%4gjs5pddx9phAV%qb*mDpddV$o\u003e)c=qb/#bsU\u0026V7o*JL+k}#wImr.P@o*I6?l@v8Vok!09xM^(Xk#y6AlqZ3p4gjs5xj\u003c!5k$L6yyhe0dAb5#Bfk$5\u0026D01Pcq!]MMh!(A9p?rZszfm:dA@", "ln": 6568, "col": 7, "line": 100 }, { "b": "lt64]lp1:Nl2oO3o\u0026tFBmP0qRr-8Z!mrZQTvol#Uq8hf$wj7MNq=+?\u003eoLN3-o**%hk}#wdl3M9X4gjs5qB+Lvvo36sv@tdRr.b?qv(420t0\u003eREpd4uFvokg1rwNJ^vPU%ovR]Q/rCUz%pddx9ph93]q:\u003cc2pe\u003ewe4gjs5o\u003e($tpe:FEqb/#dnn8Hdo\u003e)*PpEEG6o*?o\u003eo*?o\u003es7(8so)Qq]o\u0026Kzjo\u003e)xSpGgsKs876po\u0026k$QlS3#O4gjs5r-8Z:mr.v8rEd8oo*R\u0026Ik}#wdlUGg\u0026qB+Lvvo36sv@td+nKWDrsP", "ln": 9152, "col": 7, "line": 138 }, { "b": "t3axJoL)KFvPkW8lt6}Klt5.Rlq.lpl2P}8vmToIv)\u003elUoFPvRsU:36wjPBqt1ryDvoliuv@td^4gjs5sU-0VoFxv-s#6[Zt3axJr.b?qv(420t18{Pr.3$Ft2[xLsYWt4voks7rCUz%pddx9phAV%qb*awphivA4gjs5o\u003e)Y%qb/#bsU\u0026V7o?49jk}#wInoW%mo?5ofr.C+Tz:)8:rbDq5wjP0AoNeTkv@lBooL)WDs#6]et3axJ4gjs5oL)KFvPboQvol#Uq8hf$wjxExwlqOXt31P)pdwc2vPMPfwjGahv[guTs$@SGqb*zppGgH%q:\u003cc2pe\u003eww4gjs5o*?Mcq7$B-oL)KIvNJH{lt64]nk?/ym]R=Ro*JzZltZp2l{Tmgl25XVlt7aExLRlExM=aKlu+\u003exl@v8V4gjs5ok!09xM^(Xk#y6AlqZ3pxj\u003c!5k$J\u003e4pI\u0026KizDot4gC%2\u003clS(-aw=", "ln": 10512, "col": 7, "line": 158 }, { "b": "oFxv-s#6[Zt3axJr.b?qv(420t1hbcvLZ[Mpd3)Nv@td/qfMehr-gR-lpu3wpIJfLz:X2DpdXPl4gjs5vmToIv)\u003elUoFPv*vNJ}kt1ryDvoliuv@td^sU-0VoFxv-s#6[Zt3axJr.b?qv(420t1hbcvLZ[Mpd3)N4gjs5v@lBlnKlGEr-gR:lpbEimTvu(lt6FtxhJ\u003etlp1g!lW8W9sXh^*l0mUSvNjG\u003co*HE6lSm${q+pBOl@uxt4gjs5lW8J@k@qe2k#x{IDuKvhxf{[{lv7s-wnT?WC49p4C$.i(AbEs7", "ln": 13096, "col": 7, "line": 196 } ], "depth": 1, "facts": { "imp": [ [ "", "Set-Alias" ], [ "", "Set-Alias" ], [ "", "Set-Alias" ], [ "", "Set-Alias" ], [ "", "Export-ModuleMember" ] ], "tgt": [ "Export-ModuleMember", "Set-Alias" ], "metrics": { "ast": { "max_depth": 7, "call_count": 5, "node_count": 334 }, "file": { "size": 17351, "entropy": 6.02 }, "text": { "lines": 259, "top_char": 65, "max_ws_run": 1, "digit_ratio": 0.13, "space_count": 279, "char_entropy": 6.02, "unique_chars": 73, "top_char_null": 0, "top_char_ratio": 0.03, "avg_line_length": 64.99, "max_line_length": 87, "non_ascii_ratio": 0, "empty_line_ratio": 0, "last_line_length": 27, "whitespace_ratio": 0.05, "identifier_density": 0.05, "line_length_stddev": 7.4, "suspicious_comment_ratio": 1.91, "normalized_unique_identifiers": 1.37 }, "binary": { "peak_region_bytes": 17351, "peak_region_entropy": 6.04 }, "comments": { "chars": 16518, "count": 253, "lines": 253, "base64": 249, "hack_count": 2, "high_entropy": 233, "to_code_ratio": 42.17 }, "identifiers": { "count": 14, "unique": 11, "avg_length": 19.73, "max_length": 33, "min_length": 1, "avg_entropy": 3.54, "reuse_ratio": 0.79, "length_stddev": 8.85, "single_char_count": 1, "single_char_ratio": 0.09, "high_entropy_count": 9, "high_entropy_ratio": 0.82 } } }, "id": 3, "mol": "H(Cm)Md₂(Si)", "path": "AWS.Tools.CodePipeline.5.0.303.nupkg!!AWS.Tools.CodePipeline.Aliases.psm1", "pid": 0, "risk": 4, "sha": "046525d13660cc9432ab6343720f787e3e7085a61db248319523bed0e66c0a59", "size": 17351, "traits": [ { "id": "metadata/lang/natural::lang-english--atom-2", "conf": 0.8, "crit": 1, "desc": "English function-word token \"and\"", "spans": [ [ 5680, 64 ] ] }, { "id": "metadata/signed/certificate/identity::powershell-signature-block", "conf": 0.95, "crit": 3, "desc": "PowerShell Authenticode signature block", "spans": [ [ 343, 29 ] ] }, { "id": "micro-behaviors/communications/url/encoded::authenticode-script-signature-context", "atk": "T1027", "mbc": "B0032", "conf": 0.98, "crit": 3, "desc": "Authenticode script signature block context", "spans": [ [ 343, 29 ] ] }, { "id": "metadata/file/naming::many-high-entropy-identifiers", "conf": 0.7, "crit": 2, "desc": "High proportion of high-entropy identifiers" }, { "id": "micro-behaviors/communications/url/encoded::encoded-http-url", "atk": "T1027", "mbc": "B0032", "conf": 0.85, "crit": 3, "desc": "Encoded URL decoded to http(s)", "spans": [ [ 2142, 54 ], [ 13160, 48 ] ] }, { "id": "metadata/encoded-payload/base64", "conf": 0.9, "crit": 3, "desc": "Encoded content decoded: base64", "spans": [ [ 716, 22 ], [ 2212, 49 ], [ 4184, 49 ], [ 6632, 49 ], [ 6768, 49 ], [ 6972, 49 ], [ 9216, 49 ], [ 10712, 49 ] ] }, { "id": "metadata/encoded-payload/base64-base64", "conf": 0.9, "crit": 3, "desc": "Encoded content decoded: base64 → base64", "spans": [ [ 10576, 29 ] ] } ], "type": "powershell" }, { "ctx": [ { "b": "vqF4VzEEx[k0i^)A:-/@By/F[vqH6$aAz4kB.L(cwizbUA=\u003e}qaA?glx\u003c\u003eE!wLuVMxlm/Ib4+n1B7DKVq*ACawO\u003c4]vqYH^wO(0@Bs]\u003e4Bz(28BzkVhe(kFlA+e=)zGGP3y=\u003cv\u0026vrb^[wPRH7r://!wJ\u0026jfAa9=}zdN*2AY#PsB9RUBvr+v=wO\u003cQ[flqzRByxzTjAa.HvqPN$wPz\u0026QjAa.HvqPN$wPw]lwPq\u003cbA+e=Ab1u0SB7DKrC42A9vpB4:oL59OBz9/Yw)]H%wG\u0026mf", "ln": 4257, "col": 4258, "line": 1 }, { "b": "arR^HqE$2=B7]MglUG[CxjTUBauZevarR^HarR^HqE$2=B7]MgnN@@b4gjj2arR^Hmq^iYBA{(by-\u003e\u003e-xMOuniXJczg+HHwg+HHsf!LgHstaAcvLpD3n[z)Qx(m#WwO(t{3lQDlarR!2vru74BvyB=v%8)cz/dPB3lQDlarR^HavQr\u003ez/OlSByw)1B2\u003c:qarR^HarR^HarT3\u0026wmV(Daxi5(wP8ZkmriA!AT-u#arR^HarR^HawDA*B75Y)auZ\u0026DxK@q{v@#z", "ln": 42921, "col": 5, "line": 85 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 733719, "entropy": 4.91 }, "binary": { "peak_region_bytes": 415744, "peak_region_entropy": 5.25 } } }, "id": 4, "mol": "H₂(CmPo)", "path": "AWS.Tools.CodePipeline.5.0.303.nupkg!!AWS.Tools.CodePipeline.dll-Help.xml", "pid": 0, "risk": 2, "sha": "c9eb687ff9e2a7cbb7cd34edda47019eeff4dc985b51a2121cbf753fb546ea59", "size": 733719, "traits": [ { "id": "micro-behaviors/process/interpreter/powershell/host::sma-namespace", "atk": "T1059.001", "mbc": "E1059", "conf": 0.85, "crit": 3, "desc": "System.Management.Automation import", "spans": [ [ 4321, 28 ] ] }, { "id": "micro-behaviors/communications/ip/literal::http-ip-url-text", "conf": 0.95, "crit": 3, "desc": "Non-source data contains external-IP HTTP URL", "spans": [ [ 42985, 19 ] ] } ], "type": "xml" }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J\u0026m(0ji6Sa?dLD+]{51x(+zoA=kPhvqNb%vqY$3BrC47aAzQxazCZol@c-7zeS@@e!5l%bME/A00000p^\u003eu:oAtj}ND3]F0000000000?#B@z3JR{Y03?TD00\u0026M800000NNd8R03zmw0ak", "ln": 0 }, { "b": "3\u0026*nc0dUdK00ic204XiL000000000000000kMy^J00000000000000000000C%RPk00000nb@R\u00260SSx71LJ?QKy!K]2(\u003c@9000000000000000LT2rJFb/MH00000000000000000000000000000000000000009S*V?000cKa{4\u003c{0rr95dL.5N8uo:ABRaPN0v/n{11k8*017gQ6efK?ASu7t0rr9i0W[cJ00T-31$1yh000uk1s%=Z1AbpX015=Q9SMfEc)5A?3m#?]0W]8\u0026019=\u0026000vAaPIGH0Tp4%000uc25+Z^015/jB0H.=3mb=M1%\u003clH3uEJ]019S(000uL0@-xL000vEdf6tPzZ\u003e.!3mYu-c[tn$3u4D}017ba000ucc[UG13mZGac[+M23iyngc[\u003eS33izRg000uO1POJbc\u0026%wG1$yU}c]7=53mW7#DJBfE1s+O%1apjJ00B+)0^+4I00B+}0T0\u0026N000cK9S*V(000cKa{4\u003c{1POJ9dJOUr1][SadK1]@EfGVK1s+C]DJ%JJ1s+O%1apyO00B=z0W]\u00268015^O0@@r7z.}B]3mV2Q6efK?}tZG}0SSij0W[oN00SHB0rras0W]]a019T5000uOhVJ*+3iynS5Dz!n4h5:\u003eh#\u0026{=267NY0b%tD000uT0v\u0026es0@@Jk0TAT8000ucA-\u0026wxA40^F017n62lDp:000iK0rr9Ib}PYQA+tvLAb]7Y0c00x000vLz*RS!1{UhT3JHehz*hu:1{cgX000iP7Y[ZU003%^i@/l/edhJ1U(B=yc{vRh3izQ+000iO5Eev=4fcwj", "ln": 464 }, { "b": "1PO:SNf0u\u003edJOTtyYTOzdHD\u003ete{3y-00W$y0SSuM9S^:a0SSMS9S{tn0SSMSlq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCnSp*h\u003ebyPQ)6..Oc7!BYcbu5Y8x(mN800000ei\u003cjo0c!FzbumUxevUYX5c8Xgbs+:9l\u0026Wh!jH+y(riui3", "ln": 48084 }, { "b": "y?9Jdl3mo.wO#Q7v{%E[z/d{XzF0P}B-H]jx(v(@q!oDVwPQ)\u0026yH}xEyHpBnvpK7!zF8BMwO+(Sjvr}0wO#P?z!\u0026{4k5jIjlsBwtx(mMMx\u003eq9\u003e06AR+x\u003eqg7qE%\u0026\u003cwPI@)z!\u0026[", "ln": 115757 }, { "b": "vrcD?x(dAVvqYZ?0cqZ[uSh5PA=+n{zdMQNzF9IXnP5Y\u0026yH)GUwPRoWvrc6\u003cvR/PQB7GD2r:*2.vpB4:08NxGwO=6#wMAkWx\u003c\u003eE!wDlvOByd*^Bz#wAr:*2.vpB4:0cn", "ln": 118123 }, { "b": "zGxJlx(v(*D2Nr{B7GD2rb#z+B7]-gz/eK1AaG2FByw/[rb#z+B7]-gz/eK1AaG2rCX7xcBz(h0D2Nr{l03#-l}Yd1z/Py?l1sXFz*c2ewm]ECz^(QQB8V5nB7Ctqv@2$2CwH\u00263xjU4Qx(W-XvrcEnn]FfpwPI*ezGxv?B7GD2q!o#)x\u003e7ZLwPI*ezGxv?rafAqwPI^jA:@VUwPI*ezGxv?rC([!xhSqZz/{8gwM08XAbPSnwDkzrB97w\u0026xlcJ", "ln": 118968 }, { "b": "vqfJTl1t1Jz/e0*wN/\u003e8x(v(SwPRu{yYD+5q.z3/z!%FElVlHDp?:(Wy?W=#e[w^m0b2\u003e+uSzb.B6?pMzF0P}B-H]jx(v(?A+\u003e.%wPRoVA+]/7lVl\u003cOx\u003eINevruj4zDgZ[0cqZ[uQF:Hw[+[2A::67z/eM}yYF9VByd%TBAzkmxldAVxLzG$p*[x^", "ln": 122130 }, { "b": "0cqZ[uSQ/FxM4*8uQn*RxK#76x\u003e7N[x(v\u003e?B7GD2l3mo.wO#Q7v{%E[z/bL/wPRoNC$z)%z!0i$x(v\u003e?q*ACawO\u003c4]vqYH^wO(0@Bs]\u003e4Bz(28BzkVh08NxGwO=6#wKH9ty*?u)BzkVh06$apx(v(*D2Ns.wN/K+A::67z/bLxvqG:Cs5S4eA=#ebwLWnRA::67z/bL/wPRoOz:wI/z+k4ZA::67z/bL@wPRoOz:wI/z+k4ZA::67z/bL@wPRoDz/ff3xlwl6BzkVh09r-v", "ln": 123069 }, { "b": "v@#B6zua-?Bye9XvRxW#yHp4HA+w%9l1t1Jz/bL@wPRoUvrc0(Bu%zUx(v\u003e?q*ACawO\u003c4$wOb:\u0026v@#B6zu9l}z!%l3v@#B6zu9:HvRxW#yEz-Cx(mTbx(v\u003e?s7L\u0026fCW\u003er7BzkVh06$EgDt^X1wPz%dv}w8Nv}xR3x(v\u003e?xjVf(nP5ASAZ+j.wPh:9z/bLvA+xJiwO#PUCM", "ln": 123429 }, { "b": "wN/\u003e8z/L\u00260wPRoFCX7xcBz(g1l1t1Jz/eK1AaIE.wN/\u003e8z/L?\u003cwPRoKz^)+/q*ACawO\u003c4/x\u003c\u003eT(z/Z2mv@?SGD2[7sz7X.ezGGPfwIct*ze:i9wPyZXA=#ebwPE\u0026twNY^{xk8l@o(BMNA@Y\u0026:Byd\u003cUAaJ\u003c1zE(mYwN/\u003e8x(v(/B.$#7A+P9a0cqZ[uR\u003e=YAaK6ix\u003eqt=B7C", "ln": 124773 }, { "b": "A@Yc:B97#ge(VI8wNPa-zF7O3vrlj906%W+lVM:GwO#Q7vqG#+xjVf(uQF%RA+fcglVM:GwO#Q7vqG#+v@=c\u003ewO#Q7vqG#+B7GD2p\u0026ye^x(mMZwPz%dv}wFSx(mA{Aa9N70b2\u003e+uRklCl$HEGx(4?\u003cra]#^wkDYPBA{F%vNK^HvqfL00b2\u003e+uQ!Ery\u0026%=fl$HEGx(4?\u003cB7GD2mQZ1EB-I4YwPRu{y\u0026YO?wPRoFCX7xcBzkVhl$HEGx(4?\u003cB7GB", "ln": 125148 }, { "b": "lVl\u003cOx(X5Zze-][Bo2x.x()]ZvRPE:Bo2@+Byd%Ty?m9#0cqZ[uSgJLwN//Zq*ACawO\u003c4{wPN]uwPhE7C%L}Zx(v(TCX7xcBzkVhraf/WwPN]Gq:Uzjy?mX*lVl\u003cOx(X5Tp!CUnlV3vIwPN]tz/ff3A=1fura]#^wkDYPBA{F%vNC0yy?mX*xjVf(nPNykzE\u0026", "ln": 125927 }, { "b": "qugndA@ZaUBPuBZv/Q6udf6wTqVHweyYF2Dv/QPJ07/-Zzua?Wve$9zx-IVzaolM+ve$9zBPt$Maol0NzVB!Taoi$[qVHweyYF2Dv/QPJaoluXve$rFve$cAwDl/LwDl-Je=U{6]h#6i0cFn:0at\u003eF0a=cM0b}{D0cncY0bhBJ0a#oO03?LZ0cFn", "ln": 130166 }, { "b": "BPt$Maol0NzVB!TaoluXve$rFve$cAwDl/LwDl-JaokptwDl=KzVB[WASxOHwDk0@ASx$SaolP=xAh-Dv/Qfxaol9QA@Wr.z2^#AASx\u003ePwDllvaok*IA@Wr.ASxUJAr7aYx-JeNwDllve=W0]nDrSdaok)Kve$uGwDi?MC(R:.BPrJ:vGo%tyYFeH", "ln": 130335 }, { "b": "yYFIR02XDgx-JhOBo2wxwDlftxAh@JzVBLMA@VgLr@=!ivGp6wzVBXQyxezQ0aeF3wDl]OeDwcrpYJ\u0026.BPuE.Bo3jVz2=\u003c4v/QPJx-J5Kzu9SoC(R^-wDi?Mc\u0026=QmASxUJ", "ln": 142308 }, { "b": "BPt$MA@W/)0tOAhBPuH-r@=!ivGp6wzVBXQyxatBr@=!ivGp6wzVBXQyxatm007iWiv-J-*dWpw{XAIfR:{^\u003caoqGG10vNA1T0*D5Fkc*0rAVnaoRYP4H@%LaozMN4H0%", "ln": 160766 }, { "b": "wL^8WwO=6#wDhZX=\u0026BaGl1BHnlR{V(B8Mhwv}wRFx956j0U[TRAbY-oBApw]z/](bp\u0026ZF:wPI[[r8[Ebq*ACawO\u003c4]vqYH^wO(0@Bs]\u003e4Bz(28BzkVhe\u003c\u003cL{w[=p5nO@APv@%mAq*ACawO\u003c4]vqYH^wO(0@Bs]\u003e4Bz(28BzkVhefE#8A=U@kzAP^dfFk4ifF1tlB.(exA+dyKwP-9nvqEFqp\u003c3k-x\u003e6!EC#OY$wO%T!f\u003ea-Ji5JQ5whub2wIVgMlVl\u003cOx(X5Zze-][BohBx01w@e0rr911wS(MwDhZX[C@RElT:!EB0bNrwGTouqY[CCwmXOKAaJ\u003c1zE\u003c}\u0026vp@FHB8Mhwv}u=Gp!q^FAaK5#BzkVhe=(2L9s-xKAaK5#BzkVh0rr913SHLEqE%]/B-H#6r8sc8wO+{/Bw=W(B-Iw0D2NtBG-", "ln": 172113 }, { "b": "o(BMNy+wW}xhSqZz/{8gwM08XAbPSnwH[@\u0026s5S3=od\u0026OIwmXOKAaJ\u003c1zE\u003evwr+lq)x(v(Lg+HEmfFk4gavyo/BAIRnj-j?NBAg/aefE=ivR/:*oj-xFz!\u0026{4jVCzUv\u003e{24fGiP7iaU04g\u003es9S05WI\u0026zE\u003c@eAV^U+vr#\u003cfe\u003c\u003cL/wL^8WwO=6#wIcX}wmYNfrafAqwPI+", "ln": 172478 }, { "b": "AbPSnwQ{gFxLzJgv@k:)wPP59z!i#jzF%RtxjU%(A::63ayPekaA8yAAclmPra]?=B7Gxnx\u003e7Y%A+frhz/fScasItSAaHdTzdd:ezz1p{wmXOKAaJ\u003c1zE\u003eB{z!9A}e(Vm(qE%]/B-H#6qE%]*z/fScdiJ8haAz4nB-IwhwftubaAIHkv}/L2x(mL", "ln": 172644 }, { "b": "C{4fEwN/B^D1?eeasw:twO+{/BrA4Xe=U)4/z$%Qq/(C*Bq42rp?:(Wy?W=#mr\u0026xNB-.tozuo/q0U[TRAbY-oBApw]z/](bp\u0026ZF:wPI[[r8[Ebq*ACawO\u003c4]vqYH^wD", "ln": 193558 }, { "b": "000000000000000000000000000000000000000000000000000000000000000000000000000000315c8Xg7YTL^000000000000000000310rr91fAq960000000000000000003100000nb@R\u0026syqjhaoRVA0000000000aoTI300341qVHe8rSCL*qufR}nDqJ^p5[S3nDqG=mGui:00000Y-^*600031000f5001UM000f5001UMkl7V-000001onA40SSi2000000000000000l\u0026Wh!0rud2ve$rFmGvc5yYF2DnDrSdw=", "ln": 206288 }, { "b": "00031qVH[tASx!NzuaqHmGvc5yYF2DnDrSdw=M-H003ma00031fAr^bfAr^bfAr{fvGn7Z002m:5c8.hlJz38z2!IPve$fBC(QOtve$cAwDhYg002p+z2^#ADh}\u003c-zu8o?v/QAEz2=9!aoj$kzuaeD003417xsEomGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up002p+r@=e0e=X\u0026JzVBXQyYFIRe=XlszVBqFwDkKbx-J8LwDlJDx-J2JwDhYg001XM2MK(9mGvc5yYF2DrSDXhASydXx-J5Kzu6Up001\u003eRe=WN9e=WWcfAr)e003418VP)snDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE002p+r@=e0e=X\u0026JzVBXQyYFIRe=XlszVBqFwDkKbx-J8LwDlJDx-J2JwDjs.wb{ACyYBCn00620lJvb!oAnS7x8(uuyYD*5zVB.RC(R\u003c+x-I=CxAibO002v^zVB.RC(R\u003c+x-I=CxAibOaojXcz2^#ADh}\u003c-zu8o?v/QAEz2=9!aoj$kzuaeDe=W0]zVB!Taol9QBo3vZaok*Iw=MAyx-I@Hx-IMwBo2\u003eLA@W/)aojXcyYFnKaokptx-I=CxAibOA@Wr.qugndA@Y+KASym.wDllve=U\u003eK003s98VP)spxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE002p+r@=e0e=X\u0026JzVBXQyYFIRe=XlszVBqFwDkKbx-J8LwDlJDx-J2JwDjs.wb{ACyYBCn002)%82%WqpYLIozVBqFBPt[KBo25ove$cAwDhYg002p+r@=e0aokvvzVBXQyYFIRaol0NzVB!TaokjrzVB$YwDl-JqVHFhwDlJDyYBCn004-Nf-RjOpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001\u003eRe=WN9e=WWcfAr)ed/:2UwDlrxf-TcjfAr{fhukDigxolivGo\u003cqgYQ$+h#)B*h2]JmgxorkwDjB+v/Q0sve@m!w=KT/f-TilfAs6jwb{3rwb[N?v/Q6ugYNHQ002aY3ig8bk(+%aA@Y+Kz2!2ByYF.XaokBxwDl-JA@Y[OzVBUP001\u003eRe=WN9e=WWcfAr)ee=WN90000000000000000000000000", "ln": 206586 }, { "b": "00000000000000000000000000000000000000000000000000000000000006*R^3\u0026*ncOh76A00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", "ln": 207824 }, { "b": "3iC!X0rx)%KAk9(Yx0l\u0026jtm%kx/2a)RZi$qaWbyN/JD8Idw]shT9f@RU6Rav4A6}x]bBF+7vb2vMU^+zVu=2-5Z]-E!=!fl4]KH?O!X8JZmRxa7fKTTUv%bs.M{:}Nqc^#L*H4g5h8\u003c(]9o%hBustV\u0026W\u003eMT)Jy64ars@veZAY?prnT]aZ{\u0026%(JLpm(@$yv(=EF$TtAgHV3H3ICGrsNw(\u00266ar9kd?e4nrLfXGH{+6NBOT\u0026TvB\u003cU=iQ+I5d^*(vCC*p0chk-*oeC/Nm$-i\u003cs%i0f.K/WI\u003cQe^lVV][2vsK-mv3F\u003czfz*xqNEzJK%EaXZy#T@vE=u3G#miX:3\u003egEeXX/ig+w.SE?\u003cxwGvhYReaYWgMHS{AT0kK7w13x]3@1C0e#lluXcvMUy+p[zH2N8!LKX+hb=j\u003emh18\u003eg5\u003c.K#/f$*Ylz7c5G70l(vI7Z)8jOvqUr^/#q\u0026w1ouU]9f[B5{Au\u0026F5X2x4]3@Xrej0WzV11RsL]s*PE!Fq@}@?N/gTR3:\u0026K#..l.\u003eNeRGS7150NFC9KnS[c5DE14Pld]BIo96WN25)DApFkkGQN!k[K-l\u003cQ+nOf#.pQ79T7xD}XVEw9+vC-2}])z)uu$I+?jvmphPd@gLgJZ(Lj{EHmA\u0026{2G*uM(N^K/@qm$\u003cR[m60rrd}F=PEqF=Psm4*Abo9tnCO@@-GV0%5D5fDyu1ruhLL76Cur/w?FhAB09G?.5La\u003eEN4-91L?09%I*E9u$X7fCYfMU%c6t1nGS30O0F-8vcAkv}macfB!o?ruhOJ0SJo90%eHTfCsS)ruiv*3[@1)2Rc8W1Qbbk12bie2Rc8W", "ln": 208848 }, { "b": "1{m\u003cd3kjpyzdd:ezxJ1(vJXPXA=#ebwPGyBnP52\u003cf=8IU1{m\u003cd3LK1Gl}.OzvqYP#rbVX\u003eB1[\u003c)ao?{F1oPqPl2y4Rz/cX0wNV=XwPz%dv}xZjaw3DXe??\u003eTQa^2X2}yW2Hw8bT0rAu71a*Mm05f09IunwgFDhtWEd-Hge(}CPxm)00)Y30ycOHX", "ln": 212066 } ], "depth": 1, "facts": { "imp": [ [ "mscoree", "CorDllMain" ] ], "sec": [ [ ".text", 512, 205824, 5.99, "r-x" ], [ ".rsrc", 206336, 1536, 2.68, "r--" ], [ ".reloc", 207872, 512, 0.1, "r--" ] ], "metrics": { "pe": { "checksum": 225523, "timestamp": 3058361241, "image_size": 237568, "headers_size": 512, "checksum_valid": 1, "clr.is_il_only": 1, "file_alignment": 512, "resource_count": 1, "cert_table_size": 11944, "has_version_info": 1, "computed_checksum": 225523, "headers_size_ratio": 0, "prose_section_count": 0, "reloc_overhang_bytes": 500, "reloc_overhang_ratio": 0.98, "clr.is_32bit_required": 0, "bss_like_section_count": 0, "clr.is_32bit_preferred": 0, "clr.strong_name_signed": 1, "section_overflow_count": 0, "signature_expired_days": -202.48, "clr.is_native_entrypoint": 0, "clr.strong_name_sig_size": 128, "misaligned_section_count": 0, "version.identity_entropy": 4.38, "base_relocation_block_count": 1, "base_relocation_entry_count": 1, "declared_data_directory_count": 7, "version.identity_symbol_ratio": 0.07, "executable_prose_section_count": 0, "directory_section_mismatch_count": 0 }, "file": { "size": 220328, "entropy": 6.1 }, "binary": { "is_pie": 1, "has_overlay": 1, "code_entropy": 5.99, "overlay_size": 11944, "string_count": 1407, "overlay_ratio": 0.05, "overlay_entropy": 7.61, "entropy_variance": 5.8, "avg_string_length": 42.57, "max_string_length": 272, "peak_region_bytes": 11264, "code_to_data_ratio": 1, "peak_region_entropy": 7.6, "string_length_stddev": 53.14, "largest_section_ratio": 0.93, "sentence_string_count": 252, "sentence_string_ratio": 0.18, "high_entropy_string_count": 0 }, "imports": { "count": 1 }, "sections": { "count": 3, "code_size": 205824, "entropy_max": 5.99, "entropy_mean": 2.92, "name_entropy": 3.03, "writable_count": 0, "executable_count": 1, "nonstandard_count": 0, "executable_writable_count": 0 }, "consistency": { "internal_name_original_filename_mismatch": 0 }, "dependencies": { "count": 1 } } }, "id": 6, "ident": { "name": { "value": "AWS.Tools.CodePipeline.dll", "source": "pe.version.original_filename", "verified": false }, "title": { "value": "AWS.Tools.CodePipeline", "source": "pe.version.description", "verified": false }, "trust": "ca_signed", "signer": { "issuer": "CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\\, Inc.,C=US", "source": "pe.signatures[0]", "subject": "CN=Amazon Web Services\\, Inc.,OU=SDKs and Tools,O=Amazon Web Services\\, Inc.,L=Seattle,ST=Washington,C=US,SERIALNUMBER=4152954,BUSINESSCATEGORY=Private Organization,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553", "signed_at": "2026-09-21 19:35:54 UTC", "common_name": "Amazon Web Services, Inc.", "organization": "Amazon Web Services, Inc." }, "project": { "value": "AWS Tools for PowerShell", "source": "pe.version.product_name", "verified": false }, "version": { "value": "5.0.303", "source": "pe.version.file_version", "verified": false }, "build_path": { "value": "/codebuild/output/src2477/src/s3/00/aws-tools-for-powershell/modules/AWSPowerShell/Cmdlets/CodePipeline/obj/Release/netstandard2.0/AWS.Tools.CodePipeline.pdb", "source": "pe.debug.pdb.path", "verified": false }, "unique_ids": { "authenticode_thumbprint_sha256": "0e560c4aa37521a6a7ada5b846b3456e996bced7a0be5ccce65efae9346c2a49" }, "organization": { "value": "Amazon Web Services, Inc.", "source": "pe.signatures[0]", "verified": true } }, "mol": "K(Li)H(Po)Md₃(Bi₃PaSi₃)", "path": "AWS.Tools.CodePipeline.5.0.303.nupkg!!AWS.Tools.CodePipeline.dll", "pid": 0, "risk": 10, "sha": "932986832e9324b3239036e39ae908cfecade6fdd62747cbdf2e69ebe9d0e3d4", "size": 220328, "traits": [ { "id": "metadata/signed/unknown::amazon-web-services-inc.", "conf": 1.0, "crit": 3, "desc": "Authenticode chain CN: Amazon Web Services, Inc." }, { "id": "metadata/signed/leaf::amazon-web-services-inc.", "conf": 1.0, "crit": 3, "desc": "Signed by Amazon Web Services, Inc." }, { "id": "metadata/binary/code/entropy::code-entropy-at-most-7-5", "conf": 0.7, "crit": 2, "desc": "Code entropy is 7.5 or lower", "spans": [ [ 512, 205824 ] ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR header (COM descriptor)" }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET metadata root signature (BSJB)", "spans": [ [ 48132, 0 ] ] }, { "id": "metadata/binary/layout/overlay::image-under-768kb", "conf": 0.9, "crit": 3, "desc": "PE mapped image under 768 KiB" }, { "id": "metadata/build/reproducible::pe-reproducible-build", "conf": 1.0, "crit": 2, "desc": "Built with /Brepro (deterministic)" }, { "id": "metadata/lang/natural::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"", "spans": [ [ 172359, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-2", "conf": 0.8, "crit": 1, "desc": "English function-word token \"and\"", "spans": [ [ 212114, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "spans": [ [ 130214, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-7", "conf": 0.8, "crit": 1, "desc": "English function-word token \"this\"", "spans": [ [ 78, 0 ] ] }, { "id": "metadata/package/versioning/scheme::pe-companyname-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes CompanyName", "spans": [ [ 206650, 11 ] ] }, { "id": "metadata/package/versioning/scheme::pe-filedescription-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes FileDescription", "spans": [ [ 206714, 15 ] ] }, { "id": "metadata/package/versioning/scheme::pe-fileversion-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes FileVersion", "spans": [ [ 206802, 11 ] ] }, { "id": "metadata/package/versioning/scheme::pe-internalname-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes InternalName", "spans": [ [ 206850, 12 ] ] }, { "id": "metadata/package/versioning/scheme::pe-productversion-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes ProductVersion", "spans": [ [ 207290, 14 ] ] }, { "id": "metadata/package/versioning/scheme::pe-productversion-semver-git-hash", "conf": 0.9, "crit": 3, "desc": "PE ProductVersion has SemVer git hash", "spans": [ [ 207320, 48 ] ] }, { "id": "metadata/package/versioning/scheme::pe-version-file-version-value", "conf": 0.9, "crit": 3, "desc": "PE version resource carries a file version", "spans": [ [ 206828, 7 ] ] }, { "id": "metadata/package/versioning/scheme::pe-version-product-name-value", "conf": 0.9, "crit": 3, "desc": "PE version resource names a product", "spans": [ [ 207232, 24 ] ] }, { "id": "metadata/package/versioning/scheme::pe-version-resource", "conf": 0.8, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 206430, 0 ] ] }, { "id": "metadata/package/versioning/scheme::version-info-file-version-present", "conf": 0.95, "crit": 3, "desc": "PE FileVersion value is present", "spans": [ [ 206828, 7 ] ] }, { "id": "metadata/signed/certificate/identity::pe-signature-verified", "conf": 1.0, "crit": 2, "desc": "PE Authenticode integrity check reports intact" }, { "id": "metadata/signed/certificate/identity::pe-signature-verified-kv", "conf": 1.0, "crit": 2, "desc": "PE Authenticode signer cryptography verifies" }, { "id": "metadata/signed/trust-level::dotnet-strong-name-signed", "conf": 0.95, "crit": 3, "desc": "Managed assembly is strong-name signed" }, { "id": "micro-behaviors/process/interpreter/powershell/host::sma-namespace", "atk": "T1059.001", "mbc": "E1059", "conf": 0.85, "crit": 3, "desc": "System.Management.Automation import", "spans": [ [ 123133, 28 ], [ 172177, 128 ] ] }, { "id": "well-known/lib/cloud/aws-sdk-dotnet::aws-sdk-dotnet-core", "conf": 1.0, "crit": 3, "desc": "AWS SDK for .NET Core assembly", "spans": [ [ 119032, 11 ] ] }, { "id": "metadata/binary/provenance/build::pe-far-future-timestamp", "conf": 0.95, "crit": 3, "desc": "PE COFF timestamp encodes a future date" }, { "id": "metadata/binary/symbols/imports::single-import-count", "conf": 0.7, "crit": 3, "desc": "PE with single import" }, { "id": "metadata/package/versioning/scheme::pe-productname-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes ProductName", "spans": [ [ 207206, 11 ] ] }, { "id": "micro-behaviors/data/parse/vocabulary::credentials-path-tail", "conf": 0.4, "crit": 3, "desc": "Path ending in credentials", "spans": [ [ 125212, 11 ] ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET managed assembly", "uses": [ 3, 4 ], "spans": [ [ 48132, 0 ] ] }, { "id": "metadata/signed/trust-level::signer-evidence-present", "conf": 1.0, "crit": 3, "desc": "Platform or developer signing evidence", "uses": [ 21, 22 ] } ], "type": "pe" }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J\u0026m(0ji6Sa?dLD+]{51x(+zoA=kPhvqNb%vqY$3BrC47aAzQxazCZol@c-7zeS@@e!5l%bME/A00000p^\u003eu:oAtj}[yC%V0000000000?#B@z3JR{Y09PKa015Ya00000vTeaS03zmw0dU", "ln": 0 }, { "b": "3\u0026*nc0h6F}00ic20aVlk000000000000000kMy^J00000000000000000000lWn?n00000nb@R\u00260SSx7l]LeEl{H?O2(\u003c@9000000000000000H\u003c615Fb/MH00000000000000000000000000000000000000009S^-P000uQiSZY{000uc1apgI00B+\u0026ASDduA4pL.EGxGH1BQyM00AuK3ig5gB3P^a3mFjv015^F0rrasc{)$m3iCk!003%^l\u0026Wh]0=@z[00T\u0026u000uQ8GD+%0b%zaAY0*%A4h[gDJTrG1s:xK6efN\u0026p5\u003em]0rr9i7iq}B0171Nz:%^c3mb^)nb@R%z+f{e3mb^)nb@R%c\u003c6CH26ixp0171Oz+y6g3u5Pr019Ts000uuB4#Yn3jqj:000caz+*uk3mZHB0rrasA.uxjA41J.01akT000dyB}jMSFcb=K1s:xK6efH*li3#=00000B5q]q3md8d000jwqucX7b}6f400Wvt000uLc\u003ecdR25^xt017224GDFkz=cMn3md8h000jwqucX7B5J5s3mV%y1POJ9dJi:u000cK8H.[\u003e00B+\u0026EH2]N1s+ss2(\u003c@ddGxCG6efH*eck!K0SSijB5Sbt3mcEarr91ab]gA1000uL7JivP0171%00000063]xc%cDH3uGtI019TF000uLbldYz0020SkQY.m019^I000vAtl1Tgb[ZjS6+7fz8Wpj=000uL5=?[C4flCF25^=E01akW000dyq#=[9b]pG1000uL7h)jN0171*z=V]s3mc[%00000fP!QGso5sdB6eFy3u68F", "ln": 464 }, { "b": "00AvJzuG}xc\u0026\u003cwH3iyLoD#e#^1qgX.Jq@@e0S):!1onMM0%eDfA%.%G3mV2Qlq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn\u003e/:5cbyPQ)rlUBz)6M/[bu5Y8x(mN800000k.xarg^z3vbumUxBI!dW5c8Xgbs+:9l\u0026Wh!GU)\u0026\u003eZ\u003cDaZ", "ln": 137492 }, { "b": "wPRoMz!A0\u003cA+eV@k#HCTnPN*wBwcQ=q/)4\u003evqOqdp5[Tqz!A0\u003cA+eV@k#HCTq*ACawO\u003c4\u003epxjr^nL/y=mmf%wr8Wc#k#6Zomn:aUo\u0026z3Yk$K:sl%\u0026kEr7P\u003eXqVG9SoKy7Mr7P\u003eXqVHDwBye3?wKYl/qVH(IBye3?wKYl/qVGP*uSf@(lQ:{L08#lZm[3x:qV", "ln": 257410 }, { "b": "vqYZ?0afLJB97u5vruTklUG[CxjR6iCW\u003ez}zF9IXnP5Y\u0026yH)GzwPI^aC4ChXx(ET1x(mG.vrc6\u003cvR/PQmq^o.A=k\u0026jwO#P\u003cvrc6\u003cvR/PQq*ACawO\u003eB+vrM6[y**^?wDh", "ln": 264316 }, { "b": "lVl\u003cOx\u003eINevruj4zCUv(AaK6iC#P6dwDk2aBzkVhlVl\u003cOx\u003eINevruj4zCUv(AaK6iC#P6dwDl7VD2Nr{l03#-l}Yd1z/Py?xjVf(l2}6Yw)]g\u003eq/(}#wDl^.BydsOBzkt}v@$T\u003ez/Py?nPN*wBu%}?x\u003ey^-Bw)p1A+bkTvrcE7w)]g\u003eq/(}#wDlvOByd*YmQZ1EB-I3[B7GD2pI@Tgx(4{jwDkqyq!p5DzBO5Gy\u0026%=f0afUZmQZ1EB-I3[uUKM", "ln": 266693 }, { "b": "rDI}\u003e06$Bq08l)xB7!##yYEEMzddEaxKLZ[06%W+q::nhlVlHDp?:(Wy?W=#e[w^m0b2\u003e+uSzb.0cqZ[uSzb.0b2\u003e+uS7DUx(!0bzDgZ[0cqZ[uS7DUx(!0bzDgZ[07?lgwPQ*YC4(2iz/eM}yYE*.wP?^ex(v(?A+\u003e.*wPRoDz/ff3xlwl6BzkVh", "ln": 271331 }, { "b": "uR$@SA^pF\u0026A:-!+B7GD2qfuC\u003cC#d{\u0026vqM0oB5MT(qfuC\u003cC#d{\u0026vqM0KADL\u0026kC#d{\u0026vqM0SwPRoJBy/p?B7GD2nPXJX08d9FBxr3.xM4*8nPXJX08[e:By/p?lV)D(z/2Fuzdd:ezz1?fzGGPfwIcL(By/GgvqEL}A:-\u003cbw]zZb07H\u0026alt{^UwNPDRrb3hXq/De.08E=HA=L(8wmYSUxjVf(rbVL-zua-?Bye0=yH}w-xjVf(q!p2\u003ex(v(*", "ln": 271915 }, { "b": "z/fVhzGPxfx(v(*z!\u0026{407?lgwPQ)\u0026yH}w-xjVf(q!oDVwPQ)\u0026yH}w-B7GD2q!oDVwPQ)\u0026yH}w-nPN*wBw(:XA+ft(z!\u0026{40af!Uv@=d5rbVL-zuarXBydyKx\u003eqg7rbVL-zua-?BydyKx\u003eqg7rbVL-zu9mHq!p5ry?WD#Bx0f]wO}GPv@b\u003c\u003czGF\u0026@yH}w-x8", "ln": 272295 }, { "b": "Bu%zUx(v\u003e?nPN*wBw#W?xjVfJv@#B6zua3=vrc0(Bu%zUx(v\u003e?uTWC^x(v\u003e?q*ACawO\u003c4$wOb:\u0026v@#B6zu94xwmXXYvrbp+B-H#6lVl\u003cWwN/*@z/bLJC4CYmx\u003eg^NByw/[lVl\u003cMx([6czuarXBydBEw[=c%BzkVh0cqZ[uQOEqx(mTbx(v\u003e?s7L\u0026Oz/ozVwObT]x([6czu", "ln": 274682 }, { "b": "mr\u0026xNB-.tozu9mHq!p5Avru74BvyB=v%8)cz/bLZy*?A%B96\u0026}wN/\u003e8x(v\u003e?q*ACawO\u003c50wQ5qHn][]*07?6IwPz:dy*?A%n][]*0b2\u003e+uS7DzB8L{@B7GD2qE%oTz/bL/wPRoEx(^Y(y?mcPwNPT#zua-?BydBIB75J]wN[XIvrlv807?lgwPQsOB75J]wN[XIvrlv8", "ln": 276886 }, { "b": "y?#NVA.pmVA@X^Mq!p5yz^)+/p\u0026ye^mSirDxLzG$p*[x^C$J0:A@YMZz^)+/q*ACawO\u003c4/x\u003c\u003eT(z/Z2mv@?S.wPRoDz/6u1zE^!*B7GD2lVl*UvqYQ%07?lgwPQpTzeAZ0wod-Tv@Dj3vqYQ%07I0Ezb1.Xy?W%4v@Dl}A@X{Gv@=Hez!s8zlsT*:l34r?v[yMWwPzx\u003ev}xYYq*ACawO\u003c4$B-8qnzdLs\u003ezGGDgz/wS^A=#ebwPE\u0026ID2[7sz7X.ezGGPfwIct*ze:i9wPyZXA=#ebwPE\u0026ID2[7sz7X!3A+eV\u0026x(mMoraf\u0026-B1QyfB-H#6A@XQtvS=r@x(mMTz!9B20b2\u003e+uRbcBy\u0026%o1A@Zn)Byb", "ln": 289748 }, { "b": "Bzkt}v@$7UwN]v\u0026Bzkf1A@X^Mq!p5pA==2cvpKyDA+e=)zGGP3y\u0026YO-vrcE7w)]g\u003elVM:GwO#Q7vqG#+v@=c\u003ewO#Q7vqG#+xjVf(p\u0026ye^x(mMZwPz%dv}wFSx(mA{Aa9N70cqZ[uR\u003eVSy?W^1q!o#)x\u003e7ZJA+PA3x(EG%A@X^Mq!p5Ez!%l7zF8)VA=#ebwL^zYzEWy1vqG#+uVo}1y?W^1q!o#)x\u003e7ZJA+PA3x(EG%A@Y\u0026:Byd:JByO#MADLW", "ln": 292210 }, { "b": "Bo2x.x()]PzE=KLygQ)%09shPBy!x)vrcD=vRPE:Bo3t)ADL\u0026lBwDvXwN//Zq*ACawO\u003c4{wPN]zB5MT(07pyqy\u0026sO+v@#B6zBF!Yv%8)cz/eJ.A+w%90b2\u003e+uQw)ByH}O/B7GD2luM^NwPN]zB5MT(luM^NwPN]VvS=f@wPN]+wPRoTwN/:(Bo3w[Byd%Tv@.", "ln": 295735 }, { "b": "zF7O3vrlj9e(MXhA:@W4e\u003eG8Ly\u0026%q*vrli.z/{8gwIcF:Bw=W\u003eB.(d1nPN*wBw=W\u003eB.(d1uVG.0B.(d1xjVf(rDz.(l1:+DBo2V\u003cB7GwTxjU$506$EgDt^X1wPz%dv}w2zx\u003eqg706$EgDt^W*z!9AQx(ET1x(mGHy?WD#Bo2VTy?WD#Bo1:EC4\u003e#nzF-%5Bo2l+B97#ge\u003c\u003cL[y?m9#x(v)ge\u003eoF\u003cwPzG{e\u003eFuID2vaXzGP/cA::6dAY=T8vr#\u003cfe=", "ln": 296311 }, { "b": "z#:CHyYFeHzuakFmf4MjwDliuBPuH-x-J5Kzu6UEr@=!ivGp6wzVBXQyxatFr@=!ivGp6wzVBXQyxdxng5}p\u003cm/V9Xq#/C?rrbt=uJrQ%o-NDVlJv8\u0026nDqM!03thvp5)M", "ln": 303958 }, { "b": "x-J5Kzu8r\u0026CMoq}ve$cADh]I%y5\u0026qPzVBUPeDvH9e=WQa0v8*?eDxhVz2!\u003eZeDxhVz#:OLeDx}]wDl-JA@Y[OzVBUP0sqN5pxjq[q#=[2f8$$Wy5\u0026eLvGn$1wb(PqzuaOPzuaeDwDhYtA@ZpZve$xHBPuE.04QRvzua?Wve$9zx-IVzp5]hjzuaeDwDkd0CMqjNwDlVHBo31PzVBUP04yIuzVx", "ln": 304270 }, { "b": "mf4MjwDliuBPuH-x-J5Kzu6U!ASxUJA@ZaUyYFRUwDllvlJz38zuanGx-I=CBPuBZve$xHx-J5Kzu6UUwDl@PwDliuBPuH-x-J5Kzu9MmwDl=KBPujTBn#pUwDl-JASy1TASwGcwDl/Lve$0wyYFIR04hsTCMq*=wDl-Jzua8ByYD)7CMqpPv/QSKBo31PzVBUPnDro305n3+CMq*=wDl-Jzua8ByYD)7CMqpPv/QSKBo31PzVBUPqVH}uz2!zMve$rFC(", "ln": 305388 }, { "b": "xAhDvzuaqHwDkp4wb{fvzua+Ux-I-Bx-IYAASu7YASxUJB]VjRA@Y[OzVBUPqVH}uz2!zMve$rFC(N*-wDlPFv/QJHC(R^-Bo31PzVBUPo8@J6C(N*RyYFwNv/P{qBo31PzVBUP01\u003ckKwDl(Nx-JhOx-J5Kzu6UMve%^qv/Q6uA@ZmYo8@J6C(Qzowb(PKA@Y+Kv/QJHwDl/Lk(+x{v/Q6uA@ZmYo8@J6C(N*ZA@Y+KA@ZmYx-J5Kzu9SozVBLMwD", "ln": 306734 }, { "b": "A@Zs.yYFLSA@VgNp5[\u00269CMq*=q#*?pyxd]Czu6UGCk#gOvGp6wzVBXQyxezQ01ixsx-I@HwDl=K09IU?zVBqFwDkKbx-J8LwDlJDx-J2JwDl6qg5%0df-T6hfAs3ifAs9k", "ln": 311706 }, { "b": "fAs3ifAs9ke=XYFBPuH-r@=!ivGp6wzVBXQyxatBCk#gOvGp6wzVBXQyxauwnDrSdB]U}JyYFeHwb]WhwDlftxAh@JzVBLMk(=3cBo2$OwDlPFBo31Pv/P{qBo31PzVBU", "ln": 314022 }, { "b": "qugndA@ZaUBPuBZv/Q6u01B8Kve$9zBPt$MA@VgLv/QrBx-IYAzua+UnDro303bOIx-JhOve%:pyYF2Dwb]HcwDlcsA@ZaUzu6UEwDlPFve%:pyYF2Dwb(PGyYE(zA@ZpZ", "ln": 316034 }, { "b": "08\u0026(t0at\u003eq0bzMmBYwA.0a=c#0cFoI0bITl0cwiH0aM1A03znX0at\u003eF0at\u003eA0a=dL0a=dJ03znU0cFo.0cwh-0aC}t03zn.0a=dL03znN0b?\u003cT03znM0b.^E0b}{R0bhBJ0cwh-0ce6J0cncU0bITT0cwiP0b?\u003cP000Kf0cncK07D@W08JU]003^", "ln": 316745 }, { "b": "5K=Xq0aV7G0b?\u003cK0b.^U004L4nDrSdB]U}JyYFeHwb).LlJz38zuanGx-I=CBPuBZve$xHx-J5Kzu8Y$aoj\u003ehnDqM!qVE{uve$fBwb).Lv/QSKA@ZpZzVBROaok%MzuahEz#:!Rx-J2JBo0A-ve$rFwDi?MzuaOPBo0A-A@Zs.z#:?SzVB!TBo2\u003e", "ln": 317013 }, { "b": "0a(jB0c!G(00dRxmGu0WpYKz]aok*IzuahEaoj!fBPt?IyYExlBo2.Hv/QoAaok*IASxUJaok%Mzua8BvGpiAwDllvec3^)vGpJJBo0A-Bo2$Ox-JhOaoluXve$rFBo31PBo31PzVBUPaok{LzVBtGA@Wr.zuaOPBo0A-A@Zs.z#:?SzVB!TBo0A-", "ln": 317538 }, { "b": "zD7p\u0026z*cm62MT]b0000002L.p6g2X#q::nhlVlHDp?:(Wy?W=#004LK0rvUFra]?=l2y4Rz/cX0wNV=XwPz%dv}xZ7q::n3w]zYje(1\u0026masG#@Bw)o\u0026zE^f@wfrSWfEXa@avf7cavy6TwL^8WwO=6#wIb8\u003es5Qkez!9AQx(ET1x(mG8x(+z9ay/r", "ln": 346415 }, { "b": "000000000000000000000000000000000000000000000000000000000000000000000000000000315c8Xg7YTL^000000000000000000310rr91fAq960000000000000000003100000nb@R\u0026sBZLPTowO70000000000ToyAX00341qVHe8rSCL*qufR}nDqJ^p5[S3nDqG=mGui:00000Y-^*600031000c44GH2t0003100000kl7V-000001onA40SSi2000000000000000l\u0026Wh!0rud2ve$rFmGvc5yYF2DnDrSdw=", "ln": 351184 }, { "b": "008i=00031fAr^bfAr^bfAr{fvGn7Z003WkR#M?#lJz38z2!zMwDlPFBo3vZ002%#xAhPzaojXcz2^#ADh}\u003c-zu7^Vr@=!ivGmIJqVHweASym.x-ISywDl=Kaoksul\u0026Y\u003cWaol0NzVB!Taoj1]p5)Y.q#!3v", "ln": 351514 }, { "b": "wDlJDx-IMwvGpiAwDi?Mve$lDz#:XOx-ISyve$xHx-J5Kzu7^VBPuvXwb{3rBo2\u003eLA@W/)002m:5c8.hlJz38z2!IPve$fBC(QOtve$cAwDhYg002p+z2^#ADh}\u003c-zu8o?v/QAEz2=9!aoj$kzuaeD002*}6AwdlmGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up002p+r@=e0qVGh=o8{NAlJz38wb{fvpYLhfz#:CHyYFeHzuakF001[S3JHhcmGvc5yYF2DrSDXhASydXx-J5Kzu6Up001?Qe=WN9e=WQafAr^be=WQagYNHQ002*}7YTNpnDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE002p+r@=e0qVGh=o8{NAlJz38wb{fvpYLhfz#:CHyYFeHzuakFe=YzZyYFnK00620lJvb!oAnS7x8(uuyYD*5zVB.RC(R\u003c+x-I=CxAibO002v^zVB.RC(R\u003c+x-I=CxAibOaojXcz2^#ADh}\u003c-zu8o?v/QAEz2=9!aoj$kzuaeDe=W0]zVB!Taol9QBo3vZaok*Iw=MAyx-I@Hx-IMwBo2\u003eLA@W/)aojXcyYFnKaokptx-I=", "ln": 351842 }, { "b": "0rrc2oAnS7x8(uuyYEAmASxIFwb{fvz2^#AASx\u003ePA@Vgu00000003a37YTNppxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE002p+r@=e0qVGh=o8{NAlJz38wb{fvpYLhfz#:CHyYFeHzuakFe=YzZyYFnK003EdaPIJypYLIozVBqFBPt[KBo25ove$cAwDhYg002p+z2^#ADh}\u003c-zu7^Vr@=!ivGmIJqVHweASym.x-ISywDl=Kaoksul\u0026Y\u003cWaol0NzVB!Taoj1]p5)Y.q#=)#004PJf8#1MpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001.Ne=WN9e=WN9d/-#ThVLJif-U.:h#\u003e=nirh5twDjZ\u003cv/Op+f-UX-wb{9tgxp\u003e:f-TilwDlowwDjE=h2]DkgYR7!ve%^qv/Oy!wb[N?iriQ\u003cw=KQ!f-RgN001$U2MK(9k(+%aA@Y+Kz2!2ByYF.XaokBxwDl-JA@Y[OzVBUP001?Qe=WN9e=WN9e=WN9000000000000000000000000000000", "ln": 352354 }, { "b": "0000000000000000000000000000000000000000000000000000000000000b@8w3\u0026*ncwh%R\u002600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", "ln": 353232 }, { "b": "3iC!X0rx)%KAk9(Yx0l\u0026jtm%kx/2a)RZi$qaWbyN/JD8Idw]shT9f@RU6Rav4A6}x]bBF+7vb2vMU^+zVu=2-5Z]-E!=!fl4]KH?O!X8JZmRxa7fKTTUv%bs.M{:}Nqc^#L*H4g5h8\u003c(]9o%hBustV\u0026W\u003eMT)Jy64ars@veZAY?prnT]aZ{\u0026%(JLpm(@$yv(=EF$TtAgHV3H3ICGrsNw(\u00266ar9kd?e4nrLfXGH{+6NBOT\u0026TvB\u003cU=iQ+I5d^*(vCC*p0chk-*oeC/Nm$-i\u003cs%i0f.K/WI\u003cQe^lVV][2vsK-mv3F\u003czfz*xqNEzJK%EaXZy#T@vE=u3G#miX:3\u003egEeXX/ig+w.SE?\u003cxwGvhYReaYWgMHS{AT0kK7w13x]3@1C0e#lluXcvMUy+p[zH2N8!LKX+hb=j\u003emh18\u003eg5\u003c.K#/f$*Ylz7c5G70l(vI7Z)8jOvqUr^/#q\u0026w1ouU]9f[B5{Au\u0026F5X2x4]3@Xrej0WzV11RsL]s*PE!Fq@}@?N/gTR3:\u0026K#..l.\u003eNeRGS7150NFC9KnS[c5DE14Pld]BIo96WN25)DApFkkGQN!k[K-l\u003cQ+nOf#.pQ79T7xD}XVEw9+vC-2}])z)uu$I+?jvmphPd@gLgJZ(Lj{EHmA\u0026{2G*uM(N^K/@qm$\u003cR[m60rrd}F=PEqF=Psm4*Abo9tnCO@@-GV0%5D5fDyu1ruhLL76Cur/w?FhAB09G?.5La\u003eEN4-91L?09%I*E9u$X7fCYfMU%c6t1nGS30O0F-8vcAkv}macfB!o?ruhOJ0SJo90%eHTfCsS)ruiv*3[@1)2Rc8W1Qbbk12bie2Rc8W", "ln": 354256 } ], "depth": 1, "facts": { "imp": [ [ "mscoree", "CorDllMain" ] ], "sec": [ [ ".text", 512, 350720, 6.06, "r-x" ], [ ".rsrc", 351232, 2048, 2.75, "r--" ], [ ".reloc", 353280, 512, 0.1, "r--" ] ], "metrics": { "pe": { "checksum": 425332, "timestamp": 2698041072, "image_size": 376832, "headers_size": 512, "checksum_valid": 1, "clr.is_il_only": 1, "file_alignment": 512, "resource_count": 1, "cert_table_size": 11944, "has_version_info": 1, "computed_checksum": 425332, "headers_size_ratio": 0, "prose_section_count": 0, "reloc_overhang_bytes": 500, "reloc_overhang_ratio": 0.98, "clr.is_32bit_required": 0, "bss_like_section_count": 0, "clr.is_32bit_preferred": 0, "clr.strong_name_signed": 1, "section_overflow_count": 0, "signature_expired_days": -202.48, "clr.is_native_entrypoint": 0, "clr.strong_name_sig_size": 128, "misaligned_section_count": 0, "version.identity_entropy": 4.61, "base_relocation_block_count": 1, "base_relocation_entry_count": 1, "declared_data_directory_count": 7, "version.identity_symbol_ratio": 0.06, "executable_prose_section_count": 0, "directory_section_mismatch_count": 0 }, "file": { "size": 365736, "entropy": 6.12 }, "binary": { "is_pie": 1, "has_overlay": 1, "code_entropy": 6.06, "overlay_size": 11944, "string_count": 2629, "overlay_ratio": 0.03, "overlay_entropy": 7.61, "entropy_variance": 5.94, "avg_string_length": 21.46, "max_string_length": 181, "peak_region_bytes": 11264, "code_to_data_ratio": 1, "peak_region_entropy": 7.6, "string_length_stddev": 18.25, "largest_section_ratio": 0.96, "sentence_string_count": 28, "sentence_string_ratio": 0.01, "high_entropy_string_count": 0 }, "imports": { "count": 1 }, "sections": { "count": 3, "code_size": 350720, "entropy_max": 6.06, "entropy_mean": 2.97, "name_entropy": 3.03, "writable_count": 0, "executable_count": 1, "nonstandard_count": 0, "executable_writable_count": 0 }, "consistency": { "internal_name_original_filename_mismatch": 0 }, "dependencies": { "count": 1 } } }, "id": 7, "ident": { "name": { "value": "AWSSDK.CodePipeline.dll", "source": "pe.version.original_filename", "verified": false }, "title": { "value": "AWSSDK.CodePipeline", "source": "pe.version.description", "verified": false }, "trust": "ca_signed", "signer": { "issuer": "CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\\, Inc.,C=US", "source": "pe.signatures[0]", "subject": "CN=Amazon Web Services\\, Inc.,OU=SDKs and Tools,O=Amazon Web Services\\, Inc.,L=Seattle,ST=Washington,C=US,SERIALNUMBER=4152954,BUSINESSCATEGORY=Private Organization,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553", "signed_at": "2026-09-21 18:41:36 UTC", "common_name": "Amazon Web Services, Inc.", "organization": "Amazon Web Services, Inc." }, "project": { "value": "Amazon Web Services SDK for .NET", "source": "pe.version.product_name", "verified": false }, "version": { "value": "4.0.100.14", "source": "pe.version.file_version", "verified": false }, "build_path": { "value": "/_/sdk/src/Services/CodePipeline/obj/AWSSDK.CodePipeline.NetStandard/Release/netstandard2.0/AWSSDK.CodePipeline.pdb", "source": "pe.debug.pdb.path", "verified": false }, "unique_ids": { "authenticode_thumbprint_sha256": "0e560c4aa37521a6a7ada5b846b3456e996bced7a0be5ccce65efae9346c2a49" }, "organization": { "value": "Amazon Web Services, Inc.", "source": "pe.signatures[0]", "verified": true } }, "mol": "K(Li)O(As)H₃(CmDbF)Md₃(Bi₃PaSi₃)", "path": "AWS.Tools.CodePipeline.5.0.303.nupkg!!AWSSDK.CodePipeline.dll", "pid": 0, "risk": 12, "sha": "b2d2fdef4ad1f63ad26deb425cf03db0eaae80b4759db657dfe4cb53a8071943", "size": 365736, "traits": [ { "id": "metadata/signed/unknown::amazon-web-services-inc.", "conf": 1.0, "crit": 3, "desc": "Authenticode chain CN: Amazon Web Services, Inc." }, { "id": "metadata/signed/leaf::amazon-web-services-inc.", "conf": 1.0, "crit": 3, "desc": "Signed by Amazon Web Services, Inc." }, { "id": "metadata/binary/code/entropy::code-entropy-at-most-7-5", "conf": 0.7, "crit": 2, "desc": "Code entropy is 7.5 or lower", "spans": [ [ 512, 350720 ] ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR header (COM descriptor)" }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET metadata root signature (BSJB)", "spans": [ [ 137540, 0 ] ] }, { "id": "metadata/binary/layout/overlay::image-under-768kb", "conf": 0.9, "crit": 3, "desc": "PE mapped image under 768 KiB" }, { "id": "metadata/build/reproducible::pe-reproducible-build", "conf": 1.0, "crit": 2, "desc": "Built with /Brepro (deterministic)" }, { "id": "metadata/lang/natural::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"", "spans": [ [ 346463, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-2", "conf": 0.8, "crit": 1, "desc": "English function-word token \"and\"", "spans": [ [ 317061, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "spans": [ [ 316793, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-7", "conf": 0.8, "crit": 1, "desc": "English function-word token \"this\"", "spans": [ [ 78, 0 ] ] }, { "id": "metadata/package/versioning/scheme::pe-companyname-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes CompanyName", "spans": [ [ 351906, 11 ] ] }, { "id": "metadata/package/versioning/scheme::pe-filedescription-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes FileDescription", "spans": [ [ 351970, 15 ] ] }, { "id": "metadata/package/versioning/scheme::pe-fileversion-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes FileVersion", "spans": [ [ 352050, 11 ] ] }, { "id": "metadata/package/versioning/scheme::pe-internalname-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes InternalName", "spans": [ [ 352106, 12 ] ] }, { "id": "metadata/package/versioning/scheme::pe-productversion-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes ProductVersion", "spans": [ [ 352590, 14 ] ] }, { "id": "metadata/package/versioning/scheme::pe-productversion-semver-git-hash", "conf": 0.9, "crit": 3, "desc": "PE ProductVersion has SemVer git hash", "spans": [ [ 352620, 46 ] ] }, { "id": "metadata/package/versioning/scheme::pe-version-file-version-value", "conf": 0.9, "crit": 3, "desc": "PE version resource carries a file version", "spans": [ [ 352076, 10 ] ] }, { "id": "metadata/package/versioning/scheme::pe-version-product-name-value", "conf": 0.9, "crit": 3, "desc": "PE version resource names a product", "spans": [ [ 352516, 32 ] ] }, { "id": "metadata/package/versioning/scheme::pe-version-resource", "conf": 0.8, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 351326, 0 ] ] }, { "id": "metadata/package/versioning/scheme::version-info-file-version-present", "conf": 0.95, "crit": 3, "desc": "PE FileVersion value is present", "spans": [ [ 352076, 10 ] ] }, { "id": "metadata/signed/certificate/identity::pe-signature-verified", "conf": 1.0, "crit": 2, "desc": "PE Authenticode integrity check reports intact" }, { "id": "metadata/signed/certificate/identity::pe-signature-verified-kv", "conf": 1.0, "crit": 2, "desc": "PE Authenticode signer cryptography verifies" }, { "id": "metadata/signed/trust-level::dotnet-strong-name-signed", "conf": 0.95, "crit": 3, "desc": "Managed assembly is strong-name signed" }, { "id": "micro-behaviors/communications/http/client/managed::user-agent-accessor", "conf": 0.8, "crit": 3, "desc": "HttpClient UserAgent accessor", "spans": [ [ 296375, 13 ] ] }, { "id": "micro-behaviors/data/manipulation::dotnet-item-setter-token", "conf": 0.65, "crit": 3, "desc": ".NET set_Item method reference", "spans": [ [ 271979, 8 ] ] }, { "id": "micro-behaviors/fs/path/extension::utf16-exe-suffix-token", "conf": 0.84, "crit": 3, "desc": "UTF-16 exe filename suffix token", "spans": [ [ 305452, 17 ] ] }, { "id": "objectives/anti-static/obfuscation/payload/encrypted::aes-key-field-token", "atk": "T1573.001,T1027", "mbc": "C0027", "conf": 0.8, "crit": 3, "desc": "AES or generic key field name", "spans": [ [ 306798, 13 ] ] }, { "id": "well-known/lib/cloud/aws-sdk-dotnet::aws-sdk-dotnet-core", "conf": 1.0, "crit": 3, "desc": "AWS SDK for .NET Core assembly", "spans": [ [ 266757, 11 ] ] }, { "id": "metadata/binary/provenance/build::pe-far-future-timestamp", "conf": 0.95, "crit": 3, "desc": "PE COFF timestamp encodes a future date" }, { "id": "metadata/binary/symbols/imports::single-import-count", "conf": 0.7, "crit": 3, "desc": "PE with single import" }, { "id": "metadata/package/versioning/scheme::pe-productname-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes ProductName", "spans": [ [ 352490, 11 ] ] }, { "id": "micro-behaviors/data/parse/vocabulary::credentials-path-tail", "conf": 0.4, "crit": 3, "desc": "Path ending in credentials", "spans": [ [ 292274, 11 ] ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET managed assembly", "uses": [ 3, 4 ], "spans": [ [ 137540, 0 ] ] }, { "id": "metadata/signed/trust-level::signer-evidence-present", "conf": 1.0, "crit": 3, "desc": "Platform or developer signing evidence", "uses": [ 21, 22 ] } ], "type": "pe" }, { "ctx": [ { "b": "bmK#8awD=+B.\u003eRizddr@w[u49azbLjaz(4cB.\u003eRicQy*je(V+cy\u0026.i@z!9AQx(ET1x(mGf4gjr?3jNtcDKQr8arR^Kax8=\u003cx(FepzeS%cy?j-cAV!?9zEENhaz(4cB.\u003eRiw[=6)ayPtjz!0G\u0026By!#9CwhejaARphB0bsdzFrY]B94\u0026#arR^HqG3F}o(BM+y?j.LasxDRq.z3/z!%FElVlHDp?:(Wy?W=#e[w^mcK*y(3lQDlar@1cB-qqrA=+(6aw=09wncd1z/fR93lQDlavy6:z#", "ln": 0, "col": 1, "line": 1 }, { "b": "wO#Q7w{CIvxLzJgzeS%cy?j4.arR^Hm]-bGauZ?{iwrlGfLj\u0026LeI]d(hz3:}w[9zMw?^^Eg=YeWg=w@3f!^6FcK*y(3lQDlar@0{B-.qnAV/pjaARphB0bsrwozZ14gjj2arS%)BzbPkauZ?{l2y4Rz/dgqz/43FnP52=", "ln": 367, "col": 29, "line": 15 }, { "b": "wEO$?arR^]z/6D4zH1#=zdK?MasxD(vr#\u003cfe[n*pefEJ4v\u003c.Y)4gjj2arR)KlVl{?A+Pf1BrCTDvru6$wO#Pjw]zYjBzbxfaz(4cB.\u003eQ#3lQDlavy6^D2^RixMLvWasxJ{AcVFrxj#xfl2y4Rz/dgqz/43FnP52\u003caA8oyx([zsvp\u003ca=y?Ws1wPGEDl2puWqFx=SBAnN5wPIB6C4ChpcK*y(3lQDlar@0%wPIv4x(Ffdz/cXow/#hewGUPczEW^5z/f01x([RyAb](ux\u003eg^=ayYQsBzbxfaz(4cB.\u003eQ#3lQDlavG^Zv@=p5BzkVhauZ?{ra]?=lVlHDp?:(Wy?W=#az(4cB.\u003eRiz!paTs5Qkvz/oDkazbLjaw^02wPyZ.wO=f9y?mZfay]5bwO=p7wPz\u0026mvqYP#vpTj?zFsflA::6dA=SvuvqYH^wGTouqY[CCwmXOKAaJ\u003c1zE\u003c@5A=k!qBzbkdp\u0026yL?A-lT.y?$knv@=p5BzkS9az2Clx(XcfzdNQbe*9-6aA8phwPw]nzY\u0026[9zEEf?az1$\u003exDPPxqY{c)A=#ebwH[%rzGx]dy?$koxK@q@z/P(fB8V5nwnb{]az(4cB.\u003eRi", "ln": 540, "col": 38, "line": 21 }, { "b": "q.z3/z!%FEmme*Yavf7ce(V+cy\u0026.jcgCgpjdj#5pra]?=zeS%cy?j.Ps5Q.Jz/oDke\u003eG@4Byx04wPw[wxMOunB2\u003e%cCxXl-AbP@iA=U]9y\u00260-)y\u00260W6C}JPBz7/\u003cpv@2H=wPGH\u003cs5Q.Jz/oDke\u003eG@4Byx04wPxBMaz\u003eL5wPF#dBrCd6B7]iaaARJAx(n0lvqG:haA.Tlvru66vqYP#B-7]hB97\u0026by-)?kwGTouq.z3/z!%FqzeS%cy?mVu4gl6Fx(+zuwPz\u003caz/cXow/%xvqY]3", "ln": 1028, "col": 252, "line": 28 }, { "b": "wft.$v]32QaxJk/zxJ$xzF\u003cfaxcqbgaxJn{wn=Wkaw^02wPyZ.wO=flatczTr3jUJvqPO1z/PRog+HZtg9yHQaz$+mwPw]cB0bHmADL#owN)zol2pTOA=brcx)a5gzeS%cy?mVg", "ln": 1357, "col": 128, "line": 30 }, { "b": "arR^Hp\u0026ZF:wPI{hAZs.QxLzN1v@#\u003clwGTbUcNPug4gjj2arR)Ko(BM+y?mVgBzb98az(mxBrC47azCXiz/P@hwftP7Bz\u0026pzxK@r0y\u0026r=\u003ey-)qbC4\u003e#nzF-%5BrCKyx(w2mBz\u0026poze:AlBzkS9aARphB0bsrwozZ14gjj2arTM[ADL#owN[INwozZ1", "ln": 2240, "col": 1, "line": 50 }, { "b": "lVlHDp?:(Wy?W=#e[w^mcK*z9arR^Q4giKKarR^HboP]{A+PGmazbt7wPF$xe]U\u003e^diJ.CvrrS2A+cwlB-5sozxK4mwGUF\u003ey\u00260W6cVZzwzGY-mz/fA6zGE1uA+PDjaARJAx(d*cA==2kxcqqfx(+zlz!a0bwEO$?arR!9v@=p5BApA1p\u0026ZF:wPI]n", "ln": 2675, "col": 17, "line": 61 }, { "b": "vrt{2jS)1p4gjj2arR^HarR^HarTS(xlbgUav4t5l03#jefDrIy\u0026sDbcOcw/s7#L.z*cmIefDrpq:\u003ekhBzkVhuQOEDyJKGlcOcw/p/x![x([6czEk+HA+cQHasx\u0026%zGQgKefDrmvpJ8icOcw/o\u003c}JVdgDRbarR^HarR^HarR!2x\u003e7Z(B7Fu(x=]LYcUNQzAc15[fjx6Ce[5Q9Dt^WNv@Diqvq]T+xK@+JeIF?94gjj2arR^HarR^HarTH3z!-\u0026[Bx9u}auZ?{xMOunB2\u003e%cxk8E3BZ=$kz/4doCxkACCxkuTz/oDkeOn{wePtSLwPz\u003c9wO=fg4gjj2arR^HarR^HarTl=z/eM}x=]LYcUNQzAc15[flpVteOn{wePbcwe[5Q9Dt^XBwNYZ(A=#ebwPGFlz/4dwzdd6*B1Y*Xq+Raxz.T1bCRH%ke]UYvcK*z9arR^HarR^HarR!8wO+{^B7F9+By/IojS(a=BAzFyiXJd0x([3hvLheez7/swB1Z%CB1IGLz!%FDw]zYwAbP@iA=U]9y?$+ly\u0026r=ozddc@fgen@pdE-DpE^3Owg4/[arR^HarR^HEglJaarR!P4gmH)3jNs!ax7\u003c4ar@0}wOkZ{aAImfzEETfA+cw5y\u0026r*04gjs5o?v{0Bu%54ok!09xM^(Xk#zbVz+iJyA8Yg(oMrG*k#y6}m0.c]lt7aExLRlEt2w0.l1-RQk$13%lt7jS4gjs5lt5.Ql0l=nl1-RPz+1\u003e)vn]JDlt7jSlt5.Ql0l=nl1-R$o*-5Jl3C:-k%XvBnh$/LsW)j3lQ-)?n\u003e@5I4gjs5oisc0rz=sOk%X7ek%X7ek%X7ek%X7ek$11-o*HE6lSVSBq:A(?l3Df[k#ySFlpj3{B.a-^wImT*BwD^C4gjs5o\u003e3[jgiWIJxd(U/n{1cNx(=4PB-fidxeTjrxjjd{mjSq2xj\u003esjo?v]BAz5O=l1-RNl1\u0026LXfK/h#wMK4S4gjs5d]4/[xluToze-T5o*HE6lSm${q+pBOl@uxtlW8J@o?fzLlWz3\u003clt64]lp1:Nl2oO3o\u0026s#nmr.)5r-8Z!4gjs5mr-#Bvol#Uq8hf$wj5WQvR[?:m]R=Rlt64]lp2V(mmZ@Bwo*4Fvol#UsU:36wj5j?vLPSZol@)ylt64]4gjs5lp1sBnO.jys#6[Zt3axJnKWris#6-6qclOtwlqDqvR[\u003eRnKVVYnK=r}vLZ\u003e]q7$B.nn8Hdo\u003e)mzo\u0026KMc4gjs5o*?o\u003eo*?o\u003es7(8so)PlMo\u0026Kzoo\u003e)xSpGgsKs876oo\u0026k$QlS3#Or-8Z:mr.v8rEd8mo*RMAk}#wdlUGg*4gjs5qB+Lvvo36sv@tdRq=+?\u003eo\u0026t+JmT506r-8Z/mr?cPwhv.r", "ln": 5660, "col": 12, "line": 156 }, { "b": "lu+\u003c+lp:*{v]L:f4gjs5lt6}Klt5.Rlq.lpl0mt[vmToIv)\u003elUoFORyv(3z[t1ryDvoliuv@td^sU-0Vo*@?/lQL]+k#ySKlv7{+4gjs5xLGnuwjPQxpIz!isU-DYt3axJv%G}Evol#UsU:36wj5j?vLPSXqB+Lvvo36sv@tgovol#TqclOtwlqDq4gjs5vR[\u003eRqDu$1vLP}$q7$BYsU\u0026V7o*%a[k}#wInoW%2o*}S$qa\u003ch9z:X\u003evpI\u003c=0wjP0AoNeTkv@lBooL)WD4gjs5s#6]et3axJoL)KFvPboQvol#Uq8hf$wjpfJs#6+Tv(3\u003emv@jXTsU:2Er+$xKvLZ[IqbYt!v@lBlni{xD4gjs5r-gR:lpaW@ms4l\u003clt6tpxhJ\u003etl3+**lt6FtxhJ\u003etlp14:l@v8Vok!09xM^(Xk#y6AlqZ3pxj\u003cU1k$as?4gjs5Az/sYm0ID$wN/K)vq^}/h/Jy#A7%!Rl@lJ\u003cB7F(]s./W0yCxPWDh", "ln": 7788, "col": 55, "line": 190 }, { "b": "v)\u003elUoFORyv(3z[t1ryDvoliuv@td^sU-0Vo*}GvlQL]+k#ySKlv7{+xLHN^wjPQxpIz!isU-DY4gjs5t3axJv%G}Evol#UsU:36wj5j?vLPSXqB+Lvvo36sv@tgAv@ts[wjGWorC::twjo#ZoL)KIwje:Llt64]4gjs5nk.Aop^^Pco*\u0026Ydph@MNxLHdTwjPQxpIz!isU\u0026V\u003eo)FQivol#UsU:36wj5j?vLPSXqB+Lvvo36sv@tgA4gjs5v@ts[wjGWorC::twjo#ZoL)KIvNJH(lt64]nk?/ymPqVMo*JnVli", "ln": 9916, "col": 7, "line": 222 }, { "b": "vPM2SvLP=MrX^Y\u0026nK=D\u003ev@tE?sU:37oHzcsvR[?Zo\u0026tFBmP0qRr-8Z/4gjs5mrZQ*qBLXNnK(l)t0\u003eRRvLP@+v%QNTo*.ipk}#wdl3MacqcbF=wO\u003cCInK^lbs.Qi4t3axLvoliuv%Joh4gjs5q=+?\u003eoLM{Zl19uel@v8Vok!09xM^(Xk#y6qlqZ3pxj\u003c.hk$17cl0na[xj\u003c.3k$:HDw(8M8m0QT\u003eh-AQi4gjs5xeSQ@h/SZ(hb!1dy^Z]?CxL]4fMg2K", "ln": 11428, "col": 23, "line": 244 }, { "b": "lt64]nk\u0026ISl{%sllt6}Klt5.Rlq.kXl3+)+BwVger-gR-lp\u003cW?o?v\u0026{o?4]\u003erBFi\u003cxLPtvwjPQx4gjs5pIz!isU\u0026V\u003eo)FQivol#UsU:36wj5j?vLPSXqB+Lvvo36sv@tgAv@ts[wjGWoqHhkevLQ?$rwFxdvR]}74gjs5s$@SGqb*zppGgH%q:\u003cc3pEF69o*?M$q7$B-oL)KIvNJKZz:)lfr5v=NvmToIv)\u003elUoFPv*vNK7ot1ryD4gjs5voliuv@td^sU-0VoFxv-s#6[Zt3axJr.b?qv(420t18{Pq8gdEt2[yqs#4%OvR]TOrwl\u0026}o*\u0026+Lrwn8M4gjs5o)QCao\u003e($to\u0026T}Po\u0026A]:v@lBlxiFe5lQL]+k#ySKlu+\u003c+lp\u003cWro?v\u0026zo*.=FlQL]+k#ySKlv7{:xLq6$4gjs5wjPQxpIz!ivLQY8v)-a?vol#UsU:36wj5j?vLPSYsv37YolTJ9lqZ-No*IAxryZZRwjP0AoNeTksYXvm4gjs5v@tg\u003coL)WDs#6]et3axJoL)KFvPboQvol#Uq8hf$wjxExwlqOXt31P)pdm{3t1qQ)vol#Zvoks7rCUz%4gjs5pddx9phAV%qb*mDpddV$o\u003e)c=qb/#bsU\u0026V7o*JL+k}#wImr.P@o*I6?l@v8Vok!09xM^(Xk#y6AlqZ3p4gjs5xj\u003c!5k$L6yyhe0dAb5#Bfk$5\u0026D01Pcq!]MMh!(A9p?rZszfm:dA@", "ln": 12364, "col": 7, "line": 258 }, { "b": "k}#wdltf7Xr-R}tmTvv3lt64]lp2J?l#bXts#6[Zt3axJoHzcsvR[?Zo\u0026TSap\u003cl5gr-8ZZms5So4gjs5vol#Uq8hf$wj5W-v@ts[wjGWonKWbynK=P%vPMPfwjGahv[guTt6SCkrwl\u0026}o*\u0026+LnK=DDqb*awph91t4gjs5o*?McnKVxvo\u0026Kz\u0026mT3Liphi6Ko*\u002609o*?o\u003eo*?rRmT3Ljpi]uNo*?\u003c7o)P!%pe(4ro?d{5lWz3\u003clt64]4gjs5lp1:Nl2oO3o\u0026tFBmP0qRr-8Z!mrZQTvol#Uq8hf$wj7MNq=+?\u003eoA", "ln": 14948, "col": 7, "line": 296 }, { "b": "v@td^sU-0Vo?3*blQL]+k#ySKlv7{+xLZdRwjPQxpIz!isU-DYt3axJv%G}Evol#UsU:36wj5j?4gjs5vLPSXqB+Lvvo36sv@tgAv@ts[wjGWoqHhkvvokg1rwNJ^vPU%ovR]TOrwl\u0026}o*\u0026+Lrwn8Mo\u003e)V-o\u003e($t4gjs5pe$4Qo\u0026A]:v@td/sA^[or-gR-lpLQir+:%3z:)xjry{v\u0026vmToIv)\u003elUoFPv*vNJ}kt1ryDvoliuv@td^4gjs5sU-0VoFxv-s#6[Zt3axJr.b?qv/", "ln": 16308, "col": 7, "line": 316 }, { "b": "qB+Lvvo36sv@tgAv@ts[wjGWorC::twjo#ZoL)KIwje:Llt64]nk.Aop^^Pco*\u0026Ydph@MNxLHdT4gjs5wjPQxpIz!isU\u0026V\u003eo)FQivol#UsU:36wj5j?vLPSXqB+Lvvo36sv@tgAv@ts[wjGWorC::twjo#ZoL)KI4gjs5vNJH{lt64]nk?/ym]R=Ro*JzZltZp2l{Tmgl25XVlt7aExLRlExM=aKlu+\u003exl@v8Vok!09xM^(Xk#y6A4gjs5lqZ3pxj\u003c!5k%/fVd%LF*nkIclp/o+rv]L/QC4U$\u0026Bw#gQw\u0026IOzxA", "ln": 18892, "col": 7, "line": 354 }, { "b": "heuS4wn\u003eWbr^wjyhelOQfM{t:y\u0026iVYphBATqBj\u003eHpbcl}r+\u003eSlqD43Wiwsq:mrI-?n?-$dryYtfrB=KCboPK3q7CveCxV\u00265k@rHFvmK6.xFr%/k@IzZiCJ5vCx#@1qGb!{y?^cQn?-}QpiH8BiyNvTwn\u003ey3r^wjAmTtHJboQFLr^v\u003eIqC6?Rn{jV1qBBwXhelSrCxVFMsWVp*fLrZrz*aMpk$smOqDus!k%XjhfH[GeAyS@0vLZzHmm4B\u003cboPxury5]cnKtZulu^uwiyD$ssz*]7d}-=RqdrvhsYWshwIm8dwJsQED1W", "ln": 21270, "col": 5, "line": 389 } ], "depth": 1, "facts": { "metrics": { "ast": { "max_depth": 69, "call_count": 0, "node_count": 1277, "max_array_len": 44 }, "file": { "size": 23147, "entropy": 6.01 }, "text": { "lines": 417, "top_char": 65, "max_ws_run": 4, "digit_ratio": 0.1, "space_count": 1525, "char_entropy": 6.01, "unique_chars": 82, "top_char_null": 0, "lines_over_200": 2, "string_density": 0.2, "top_char_ratio": 0.03, "avg_line_length": 53.51, "max_line_length": 408, "empty_line_ratio": 0.08, "last_line_length": 27, "whitespace_ratio": 0.1, "identifier_density": 0.09, "line_length_stddev": 31.57, "normalized_string_count": 4.16, "repeated_char_sequences": 8, "suspicious_string_ratio": 0.05, "suspicious_comment_ratio": 1.7, "trailing_whitespace_lines": 46, "normalized_unique_identifiers": 4.14 }, "binary": { "peak_region_bytes": 17003, "peak_region_entropy": 6.02 }, "strings": { "sql": 1, "bytes": 2606, "count": 85, "shell": 3, "url_count": 4, "avg_length": 30.66, "max_length": 841, "avg_entropy": 3.56, "empty_count": 5, "entropy_stddev": 0.83 }, "comments": { "chars": 18029, "count": 282, "empty": 2, "lines": 282, "base64": 249, "hack_count": 2, "high_entropy": 231, "to_code_ratio": 2.09 }, "identifiers": { "count": 36, "unique": 36, "avg_length": 12.67, "max_length": 22, "min_length": 4, "avg_entropy": 3.13, "reuse_ratio": 1, "length_stddev": 4.92, "high_entropy_count": 8, "high_entropy_ratio": 0.22, "all_uppercase_ratio": 0.03 } } }, "id": 8, "mol": "H₂(Cm₄Os)Md₂(Si)", "path": "AWS.Tools.CodePipeline.5.0.303.nupkg!!AWS.Tools.CodePipeline.psd1", "pid": 0, "risk": 6, "sha": "95f5819d29df78bfa9ff5c46d1bd89d3d67524e80ddb3fc006ff847f13396cfc", "size": 23147, "traits": [ { "id": "metadata/lang/natural::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"", "spans": [ [ 734, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-2", "conf": 0.8, "crit": 1, "desc": "English function-word token \"and\"", "spans": [ [ 864, 0 ], [ 11476, 64 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-3", "conf": 0.8, "crit": 1, "desc": "English function-word token \"that\"", "spans": [ [ 2288, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "spans": [ [ 21, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-6", "conf": 0.8, "crit": 1, "desc": "English function-word token \"with\"", "spans": [ [ 120, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-7", "conf": 0.8, "crit": 1, "desc": "English function-word token \"this\"", "spans": [ [ 125, 0 ] ] }, { "id": "metadata/signed/certificate/identity::powershell-signature-block", "conf": 0.95, "crit": 3, "desc": "PowerShell Authenticode signature block", "spans": [ [ 6139, 29 ] ] }, { "id": "micro-behaviors/communications/http/url/forge::public-code-forge-url", "conf": 0.9, "crit": 3, "desc": "References a public code-forge URL", "spans": [ [ 5872, 19 ] ] }, { "id": "micro-behaviors/communications/http/url/path::image-file-url", "conf": 0.85, "crit": 3, "desc": "HTTP URL targets an image file", "spans": [ [ 5945, 67 ] ] }, { "id": "micro-behaviors/communications/url/encoded::authenticode-script-signature-context", "atk": "T1027", "mbc": "B0032", "conf": 0.98, "crit": 3, "desc": "Authenticode script signature block context", "spans": [ [ 6139, 29 ] ] }, { "id": "micro-behaviors/os/group/membership::privileged-local-group-name", "atk": "T1098", "conf": 0.9, "crit": 3, "desc": "References a privileged local group", "spans": [ [ 868, 14 ] ] }, { "id": "micro-behaviors/communications/http/message::powershell-http-url-literal", "conf": 0.75, "crit": 3, "desc": "PowerShell HTTP/HTTPS URL literal", "spans": [ [ 1092, 29 ], [ 5809, 18 ], [ 5872, 18 ], [ 5945, 37 ] ] }, { "id": "micro-behaviors/communications/url/encoded::encoded-http-url", "atk": "T1027", "mbc": "B0032", "conf": 0.85, "crit": 3, "desc": "Encoded URL decoded to http(s)", "spans": [ [ 7938, 54 ], [ 21334, 54 ] ] }, { "id": "metadata/encoded-payload/base64", "conf": 0.9, "crit": 3, "desc": "Encoded content decoded: base64", "spans": [ [ 6512, 22 ], [ 8008, 49 ], [ 9980, 49 ], [ 12428, 49 ], [ 12564, 49 ], [ 12768, 49 ], [ 15012, 49 ], [ 18956, 49 ] ] }, { "id": "metadata/encoded-payload/base64-base64", "conf": 0.9, "crit": 3, "desc": "Encoded content decoded: base64 → base64", "spans": [ [ 16372, 29 ] ] } ], "type": "powershell" }, { "ctx": [ { "b": "boPo{Bz\u0026:zwO#71vru6\u003eayPq6B.$YcBrC7ize:r5By/GlazbLjaAg+fvqPN$wPz\u0026mz!pa\u003cl}XT\u0026z/fSrvqZfOy*?yaeO5Bkx)a5#aAR)FwGVbpwN(]$zxJCawnC?0B1N[eboPx)az#ataz(4cx\u003ezSkBzbxfazbt7wJI2GBrCBeC{3NcaA8BmA^8LrBAz8iay]Rnx(mMaC4CYnx(v(iB-p#lvpS}\u003ce!5c%3m6Oio\u003c}^PA-M:(B7]MgauZ?)p/yzaA=U@kzD74Ny?kj}q=WEIB7]Mge\u003e]+?z/Mo]x\u003ewFobYE*0vqo.3r+lq)x(v(ieOe]AgassP3vr)83jf^Ox()]rr+lqXz/YFjb1cY]vqPZ*ayPq6B.$YcBrC7ize:r5BzkVhaz#ataAIWAAbP=swN(]$zxI+]Cv+![xK#0@aA?spB7]MgatM23B8bGeAa%i5az+$8wg/5n3jg-:BAIRwapOWa4giKKboP*3Cv+![xK#0@cVZzFvrujbwGT(Zxk8BewPxv*A+xJiwO#PSz/6DfwPRH7ay/n0y?mYhx(+z9C4293vpB4:aA8cuB#p)aaA8oyxLz9)wPxyCmSiq\u0026y\u0026sJeAT-v2aA?spB7]MgefGdFay!?$aA.:paARpdaA?spB7]MgazCZoBzbkdrafl8CYm8eB7]Mgd\u003eq-Vz!a0bwGUY0azC.mByx04wN)z53m6U6xk8BeA::67z/d{VwnC?0l3uWJy**^?wGTbUc)S+Mo\u003c}^PA-M:(B7]Mgat4kqat\u003eO\u003ceL*yfaT!:ewPPH\u003ez/6u1zE:\u003e/wOkZ#By/FAl2{QXzdNQblVl*Xy?mZ1AV=@BviwcOzF%MbdiHiNAuDJAB.\u003e\u003ey4giKKboQYrBy/GgvqC", "ln": 0, "col": 1, "line": 1 }, { "b": "v@k:)wPP5kAV/jczFs6jy*?B1z/c0\u003eboQ]paARpdaA8jvx(v)gaAR43y?j4.w{503BzkVhaywM3B3T?VB.$YcBvf$-Abo9cwPyWWxk8BeA::67z/c%L4gmB\u003e3lQDlaAg+fvqMCXarR^Hc\u003ecIaarR^HarR!hB7ol8AcbM9z!0M*bY^Eox(FeXy\u0026r*0edz}earR^HarR!hxKL%}BywS{wNcN2vrb^[gdb[?y?mZfo\u003c}#I3lQDlasN:b4gjj2arUxgasFHQwD", "ln": 745, "col": 62, "line": 15 }, { "b": "B4{7Zto[e@A:-/WvqPNY4gjj2arR^HarR^HarUxgasFHBzdED]BwumYwPF$Cl2HiQbX7X4y?mY-vqPN%e\u003e/?]xlm/feOxeFfEWCrarR^HarR^HarR^HDKQr8arR^HarR^HarR^HarR^Lvrc14toVBMzeAZ0wfLq4jS(1WzdED]BwumYwPFp/arR^", "ln": 1226, "col": 41, "line": 34 }, { "b": "3lQDlarR^HarR^HarR^HaBsL8arR^HarR^HarR^HarR^HarR^HbXz4lauZ?\u0026txs[bx(mM?iYYSDzEW9%c)SquefDb$a$K\u0026ZAa9=}zbaIRwHO5}arR^HarR^HarR^HarR^HarR^HbXH}ivQT7lz/x/jz/fS2cQS2$Bz(1ZA+xJiwO#PSz/6DfwPRH7B0\u003el$bXv", "ln": 1847, "col": 47, "line": 53 }, { "b": "wPw]9B-7Yhx(v(iv}YB-yJyRpzxJCczeAZ0wft+#zdK\u00261z/f5[By/t#By!#9CwhejaAg+fvqPN$wPw]hvqPNd4gjs5l1BIuBzkVhvqG+9efG4FwGV5ovqYQ:A+3q5z!9A4Aa9\u003cgwPzVhw]zYjv@Dj6y?mZ1A=SvqB0bNyaAh4lwGV8dA=l8kxDN-\u003e", "ln": 2486, "col": 15, "line": 70 }, { "b": "A+xJiwO#Pjv@Dj6y?mZ5z/fRsw]zYjB7Gxnx\u003e7Y%l03#clVlHDp?:(Wy?W=#4giKK4gjvFp*VOdze:r5By/GlauZ\u0026]4gjj2arUSiA:-/kbX7+fzddr)pgn0JefDh", "ln": 2750, "col": 4, "line": 75 }, { "b": "arR^HaBsL8arR^HarR^HarR^HbZ7p[ar\u003c9\u003cAb](uvqEbsb0{A^y?a.vb13o=Aclnla$K{awPhE7C{j^-nP5Y\u0026yH[Xvb2-A5A:@V8efX58B95Pn3lQDlarR^HarR^HayYw5vquqVarR^HarR^HEglI)3lQDlarR^Har@0{zdd:ezz1p{wmXOKAaJ\u003c1zE\u003eB^v@#B6zCLE]wPwj!arR^HarR^HDKQr8arR^HarR^HarR^PbWRVCwPn?pm}z", "ln": 3445, "col": 4, "line": 92 }, { "b": "a%.wJA+5c/lVl*Xy?mZ1dK30-aBBR9arR^HarR^HmSirovpJ$5pHX6Iv@@\u0026uawMG(eL/?\u003cwN/*8q*ACawO\u003c4]vqYH^wO(0@Bs]\u003e4Bz(28BzkVhe\u003c\u003cL]Abo9cx(v(!wPJ0gBrz\u0026oefB", "ln": 6060, "col": 33, "line": 184 }, { "b": "z/6DfwPRGmas7DnzeAZ0wi\u003eoUefDiIvqxBvz/]@dp*[xMzdN*2AW.C84gjj2arR}tzdED]Bx0K8wGTbUnP5Y\u0026yH]7^CYmXmB8#5lzxHccl2y4Rz/dg7z*b=kq!P-Uy+w7(wnC?0B1P*Re*I?\u003cv@Dj3vqYQJvqPNdqE%/-vpJ\u003c%cOlX%aswJ=dmm@.y?mY]a}j(4arR!vw/@GNzF%RtbX7X4y?mY/D2NszaBsL8arR^HarR^HA+funA=8r[arR^HEglJaao", "ln": 7298, "col": 49, "line": 208 }, { "b": "zGFl:ze:r5By/F\u003cwOkZ#BAg/ix(v(ibTUynq!o=Rv@$7Rze:r5By/Glas6rJuSgJLwN/*Rvq(U.4giKKboP]Rm\u003c630ls\u003c!zzxK1mxkRd1B-I4ovR/%)yyHQ}awCB0B-ZF-n\u003eT8anOAoSpc?-!lVkK/B-q7.lRIF\u003elQsNrCTM\u003czpc@Pfxj#6[lrWkXml$MPmNoBeh9$}]AT-v2avoZfml$6FgEkUxmq\u003eXqCvsDpfHxz\u003cAZBzcml$6FgEkUxwLCJ{lQt]+k%W!lqaJV\u003ch^5Q^oHzlbgFgzom?2!Iawk/}Dr0*llp0[elp0[elp0[elp0[elp119CUHETm)*uBm]IYyy^AnxlQsNHk%^}8fhM^^C2f\u00266xJ^hUgZ%^pau82OnI\u003ePYfeN@Oo\u0026#gDoJi/SCSdu\u0026vqP7=k#yoxlQ-IzCv$L\u003ck$%{xmr7%^l{UDOlQtxKp+Vv4oj.gFspCPZas*hwo\u003eOPqokOSJCUHETm)*i{m]I#*gEL8elpk@%k$%\u003c[CTD^yn\u003cWe=rZG8Pr6+t3r83m\u003cCsuZUl@)eZoaqjMavQH0mpxndA8ww\u003eD1ooen[8TiCT\u003e.0svcT}rZG8[r7ft*gH$+*yHHpPA9j}%D1oo1ygn}LCUruGA6!hjrT/xXavnv*r7Q\u003e6A9t2kl%rX+fIaYDA9t2fxhI=aDsQbIxKU*Ny!m5@s4L\u003eNC49m8xhHuKCsVySpebE{Cth49DjpiaawCl\u0026CtgE\u003eCunD/pec46CUId6hbd*Wf\u00267+GhcjJVx?.DCCsbkgl@)eZm[4R]r-KDmr.U[Pm)O\u003efmmg-.o:}BOaw$ZCzEDKuy?4uWxh.\u003e?ye4PwCsD^Vl@)eZoHTg)gH@pKBY}pKzEDQwy?4uWBY*EWBwkX5CsV{Xl@)eZl\u003e6FFavQJ*mpxndA8ww\u003eD1ooerBY]EDsPJDyE{#/C49m8xhT4MCk", "ln": 11127, "col": 11, "line": 301 }, { "b": "lu+\u003c+lp:*{v]L:f4gjs5lt6}Klt5.Rlq.lpl0mt[vmToIv)\u003elUoFORyv(3z[t1ryDvoliuv@td^sU-0Vo*@?/lQL]+k#ySKlv7{+4gjs5xLGnuwjPQxpIz!isU-DYt3axJv%G}Evol#UsU:36wj5j?vLPSXqB+Lvvo36sv@tgovol#TqclOtwlqDq4gjs5vR[\u003eRqDu$1vLP}$q7$BYsU\u0026V7o*%a[k}#wInoW%2o*}S$qa\u003ch9z:X\u003evpI\u003c=0wjP0AoNeTkv@lBooL)WD4gjs5s#6]et3axJoL)KFvPboQvol#Uq8hf$wjpfJs#6+Tv(3\u003emv@jXTsU:2Er+$xKvLZ[IqbYt!v@lBlni{xD4gjs5r-gR:lpaW@ms4l\u003clt6tpxhJ\u003etl3+**lt6FtxhJ\u003etlp14:l@v8Vok!09xM^(Xk#y6AlqZ3pxj\u003cU1k$as?4gjs5Az/sYm0ID$wN/K)vq^}/h/Jy#A7%!Rl@lJ\u003cB7F(]s./W0yCxPWDh", "ln": 12840, "col": 55, "line": 328 }, { "b": "v)\u003elUoFORyv(3z[t1ryDvoliuv@td^sU-0Vo*}GvlQL]+k#ySKlv7{+xLHN^wjPQxpIz!isU-DY4gjs5t3axJv%G}Evol#UsU:36wj5j?vLPSXqB+Lvvo36sv@tgAv@ts[wjGWorC::twjo#ZoL)KIwje:Llt64]4gjs5nk.Aop^^Pco*\u0026Ydph@MNxLHdTwjPQxpIz!isU\u0026V\u003eo)FQivol#UsU:36wj5j?vLPSXqB+Lvvo36sv@tgA4gjs5v@ts[wjGWorC::twjo#ZoL)KIvNJH(lt64]nk?/ymPqVMo*JnVli", "ln": 14968, "col": 7, "line": 360 }, { "b": "vPM2SvLP=MrX^Y\u0026nK=D\u003ev@tE?sU:37oHzcsvR[?Zo\u0026tFBmP0qRr-8Z/4gjs5mrZQ*qBLXNnK(l)t0\u003eRRvLP@+v%QNTo*.ipk}#wdl3MacqcbF=wO\u003cCInK^lbs.Qi4t3axLvoliuv%Joh4gjs5q=+?\u003eoLM{Zl19uel@v8Vok!09xM^(Xk#y6qlqZ3pxj\u003c.hk$17cl0na[xj\u003c.3k$:HDw(8M8m0QT\u003eh-AQi4gjs5xeSQ@h/SZ(hb!1dy^Z]?CxL]4fMg2K", "ln": 16480, "col": 23, "line": 382 }, { "b": "lt64]nk\u0026ISl{%sllt6}Klt5.Rlq.kXl3+)+BwVger-gR-lp\u003cW?o?v\u0026{o?4]\u003erBFi\u003cxLPtvwjPQx4gjs5pIz!isU\u0026V\u003eo)FQivol#UsU:36wj5j?vLPSXqB+Lvvo36sv@tgAv@ts[wjGWoqHhkevLQ?$rwFxdvR]}74gjs5s$@SGqb*zppGgH%q:\u003cc3pEF69o*?M$q7$B-oL)KIvNJKZz:)lfr5v=NvmToIv)\u003elUoFPv*vNK7ot1ryD4gjs5voliuv@td^sU-0VoFxv-s#6[Zt3axJr.b?qv(420t18{Pq8gdEt2[yqs#4%OvR]TOrwl\u0026}o*\u0026+Lrwn8M4gjs5o)QCao\u003e($to\u0026T}Po\u0026A]:v@lBlxiFe5lQL]+k#ySKlu+\u003c+lp\u003cWro?v\u0026zo*.=FlQL]+k#ySKlv7{:xLq6$4gjs5wjPQxpIz!ivLQY8v)-a?vol#UsU:36wj5j?vLPSYsv37YolTJ9lqZ-No*IAxryZZRwjP0AoNeTksYXvm4gjs5v@tg\u003coL)WDs#6]et3axJoL)KFvPboQvol#Uq8hf$wjxExwlqOXt31P)pdm{3t1qQ)vol#Zvoks7rCUz%4gjs5pddx9phAV%qb*mDpddV$o\u003e)c=qb/#bsU\u0026V7o*JL+k}#wImr.P@o*I6?l@v8Vok!09xM^(Xk#y6AlqZ3p4gjs5xj\u003c!5k$L6yyhe0dAb5#Bfk$5\u0026D01Pcq!]MMh!(A9p?rZszfm:dA@", "ln": 17416, "col": 7, "line": 396 }, { "b": "lt64]lp1:Nl2oO3o\u0026tFBmP0qRr-8Z!mrZQTvol#Uq8hf$wj7MNq=+?\u003eoLN3-o**%hk}#wdl3M9X4gjs5qB+Lvvo36sv@tdRr.b?qv(420t0\u003eREpd4uFvokg1rwNJ^vPU%ovR]Q/rCUz%pddx9ph93]q:\u003cc2pe\u003ewe4gjs5o\u003e($tpe:FEqb/#dnn8Hdo\u003e)*PpEEG6o*?o\u003eo*?o\u003es7(8so)Qq]o\u0026Kzjo\u003e)xSpGgsKs876po\u0026k$QlS3#O4gjs5r-8Z:mr.v8rEd8oo*R\u0026Ik}#wdlUGg\u0026qB+Lvvo36sv@td+nKWDrsP", "ln": 20000, "col": 7, "line": 434 }, { "b": "t3axJoL)KFvPkW8lt6}Klt5.Rlq.lpl2P}8vmToIv)\u003elUoFPvRsU:36wjPBqt1ryDvoliuv@td^4gjs5sU-0VoFxv-s#6[Zt3axJr.b?qv(420t18{Pr.3$Ft2[xLsYWt4voks7rCUz%pddx9phAV%qb*awphivA4gjs5o\u003e)Y%qb/#bsU\u0026V7o?49jk}#wInoW%mo?5ofr.C+Tz:)8:rbDq5wjP0AoNeTkv@lBooL)WDs#6]et3axJ4gjs5oL)KFvPboQvol#Uq8hf$wjxExwlqOXt31P)pdwc2vPMPfwjGahv[guTs$@SGqb*zppGgH%q:\u003cc2pe\u003eww4gjs5o*?Mcq7$B-oL)KIvNJH{lt64]nk?/ym]R=Ro*JzZltZp2l{Tmgl25XVlt7aExLRlExM=aKlu+\u003exl@v8V4gjs5ok!09xM^(Xk#y6AlqZ3pxj\u003c!5k$J\u003e4pI\u0026KizDot4gC%2\u003clS(-aw=", "ln": 21360, "col": 7, "line": 454 }, { "b": "oFxv-s#6[Zt3axJr.b?qv(420t1hbcvLZ[Mpd3)Nv@td/qfMehr-gR-lpu3wpIJfLz:X2DpdXPl4gjs5vmToIv)\u003elUoFPv*vNJ}kt1ryDvoliuv@td^sU-0VoFxv-s#6[Zt3axJr.b?qv(420t1hbcvLZ[Mpd3)N4gjs5v@lBlnKlGEr-gR:lpbEimTvu(lt6FtxhJ\u003etlp1g!lW8W9sXh^*l0mUSvNjG\u003co*HE6lSm${q+pBOl@uxt4gjs5lW8J@k@qe2k#x{IDuKvhxf{[{lv7s-wnT?WC49p4C$.i(AbEs7", "ln": 23944, "col": 7, "line": 492 } ], "depth": 1, "facts": { "imp": [ [ "", "Write-Verbose" ], [ "", "Get-Command" ], [ "", "Register-ArgumentCompleter" ], [ "", "Where-Object" ], [ "", "ForEach-Object" ], [ "", "New-Object" ], [ "", "_awsArgumentCompleterRegistration" ], [ "", "Invoke-Expression" ], [ "", "Select-Object" ], [ "", "ForEach-Object" ], [ "", "Where-Object" ], [ "", "Sort-Object" ], [ "", "ForEach-Object" ], [ "", "Where-Object" ], [ "", "Select-Object" ], [ "", "Sort-Object" ], [ "", "ForEach-Object" ], [ "", "Where-Object" ], [ "", "ForEach-Object" ], [ "", "New-Object" ], [ "", "_awsArgumentCompleterRegistration" ] ], "tgt": [ "ForEach-Object", "Get-Command", "Invoke-Expression", "New-Object", "Register-ArgumentCompleter", "Select-Object", "Sort-Object", "Where-Object", "Write-Verbose", "_awsArgumentCompleterRegistration" ], "funcs": [ [ "anonymous", 793 ] ], "metrics": { "ast": { "max_depth": 67, "call_count": 21, "node_count": 4648, "max_array_len": 44 }, "file": { "size": 28199, "entropy": 5.95 }, "text": { "lines": 555, "top_char": 101, "tab_count": 2, "max_ws_run": 2, "digit_ratio": 0.09, "space_count": 2967, "char_entropy": 5.95, "mixed_indent": 1, "unique_chars": 92, "top_char_null": 0, "lines_over_200": 1, "string_density": 0.28, "top_char_ratio": 0.03, "avg_line_length": 48.81, "max_line_length": 218, "empty_line_ratio": 0.07, "last_line_length": 27, "long_token_count": 1, "whitespace_ratio": 0.14, "identifier_density": 0.36, "line_length_stddev": 28.92, "encoded_string_ratio": 0.01, "normalized_string_count": 6.58, "repeated_char_sequences": 105, "suspicious_string_ratio": 0.05, "suspicious_comment_ratio": 1.8, "trailing_whitespace_lines": 6, "normalized_unique_identifiers": 7.02 }, "binary": { "peak_region_bytes": 16935, "peak_region_entropy": 6.01 }, "source": { "function_count": 1 }, "strings": { "bytes": 3270, "count": 155, "shell": 5, "avg_length": 21.1, "max_length": 94, "avg_entropy": 3.44, "entropy_stddev": 0.84, "base64_candidates": 2, "embedded_code_candidates": 2 }, "comments": { "chars": 17748, "count": 275, "lines": 275, "base64": 263, "hack_count": 2, "high_entropy": 233, "to_code_ratio": 0.98 }, "functions": { "count": 1 }, "identifiers": { "count": 200, "unique": 64, "avg_length": 12.69, "max_length": 45, "min_length": 2, "avg_entropy": 3.02, "reuse_ratio": 0.32, "length_stddev": 7.72, "has_digit_ratio": 0.03, "high_entropy_count": 18, "high_entropy_ratio": 0.28, "numeric_suffix_count": 1, "underscore_prefix_count": 1 } } }, "id": 9, "mol": "O(C₂)H₃(CmOsPo)Md₂(Si)", "path": "AWS.Tools.CodePipeline.5.0.303.nupkg!!AWS.Tools.CodePipeline.Completers.psm1", "pid": 0, "risk": 8, "sha": "be9280016a08087c88ccbddaff34ec33f698f954a2204a0671515550fe477696", "size": 28199, "traits": [ { "id": "metadata/lang/natural::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"", "spans": [ [ 501, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-2", "conf": 0.8, "crit": 1, "desc": "English function-word token \"and\"", "spans": [ [ 1274, 0 ], [ 16528, 64 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "spans": [ [ 37, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-6", "conf": 0.8, "crit": 1, "desc": "English function-word token \"with\"", "spans": [ [ 2534, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-7", "conf": 0.8, "crit": 1, "desc": "English function-word token \"this\"", "spans": [ [ 120, 0 ] ] }, { "id": "metadata/lang/scripted::function-blocks", "conf": 0.82, "crit": 2, "desc": "PowerShell function block syntax", "spans": [ [ 793, 0 ] ] }, { "id": "metadata/lang/scripted::type-accelerator", "conf": 0.78, "crit": 2, "desc": "PowerShell type accelerator syntax", "spans": [ [ 1895, 0 ] ] }, { "id": "metadata/signed/certificate/identity::powershell-signature-block", "conf": 0.95, "crit": 3, "desc": "PowerShell Authenticode signature block", "spans": [ [ 11191, 29 ] ] }, { "id": "micro-behaviors/communications/url/encoded::authenticode-script-signature-context", "atk": "T1027", "mbc": "B0032", "conf": 0.98, "crit": 3, "desc": "Authenticode script signature block context", "spans": [ [ 11191, 29 ] ] }, { "id": "micro-behaviors/os/sysinfo/platform/version::os-version", "conf": 0.8, "crit": 3, "desc": "Queries OS version info", "spans": [ [ 199, 25 ] ] }, { "id": "micro-behaviors/process/interpreter/eval/direct::powershell-iex-call", "atk": "T1059.001", "mbc": "E1059", "conf": 0.9, "crit": 3, "desc": "PowerShell invokes Invoke-Expression (IEX)", "spans": [ [ 7362, 17 ] ] }, { "id": "objectives/command-and-control/backdoor/loader/managed-reflect::ps-invoke-token", "atk": "T1620", "mbc": "B0024", "conf": 0.8, "crit": 3, "desc": "PowerShell Invoke token", "spans": [ [ 3509, 6 ] ] }, { "id": "objectives/command-and-control/dropper/execution/fileless::curl-custom-ua-piped-powershell--rx-27", "conf": 0.9, "crit": 3, "desc": "Matches 'Invoke-Expression'", "spans": [ [ 7362, 17 ] ] }, { "id": "micro-behaviors/communications/url/encoded::encoded-http-url", "atk": "T1027", "mbc": "B0032", "conf": 0.85, "crit": 3, "desc": "Encoded URL decoded to http(s)", "spans": [ [ 12990, 54 ], [ 24008, 48 ] ] }, { "id": "metadata/encoded-payload/base64", "conf": 0.9, "crit": 3, "desc": "Encoded content decoded: base64", "spans": [ [ 11564, 22 ], [ 13060, 49 ], [ 15032, 49 ], [ 17480, 49 ], [ 17616, 49 ], [ 17820, 49 ], [ 20064, 49 ], [ 21560, 49 ] ] }, { "id": "metadata/encoded-payload/base64-base64", "conf": 0.9, "crit": 3, "desc": "Encoded content decoded: base64 → base64", "spans": [ [ 21424, 29 ] ] } ], "type": "powershell" } ], "v": "8" } }