{ "llm": { "conf": 0.61778235, "grade": "benign", "model": "Qwen/Qwen3.6-27B", "review": false, "outcome": "benign", "interpretation": "Legitimate .NET framework library" }, "ml": { "v": "7", "eng": "2.2.0-rc.1", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.11217189, "rte": "az", "prob": 0.11217189 }, { "cls": 0, "raw": 0.29498243, "rte": "az/zip", "prob": 0.29498243 } ], "prob": 0.45397478, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.45397478342056274, "type": "nupkg" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.000010261933311994653, "type": "xml" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.000039329130231635645, "type": "xml" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.000010828177437360864, "type": "text" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.000011344750419084448, "type": "markdown" }, { "id": 5, "lvl": -1, "conf": 0, "prob": 0.000012487173080444336, "type": "xml" }, { "id": 6, "lvl": -1, "conf": 0, "prob": 0.00001387794782203855, "type": "png" }, { "id": 7, "lvl": -1, "conf": 0, "prob": 0.45397478342056274, "type": "pe" }, { "id": 8, "lvl": -1, "conf": 0, "prob": 0.000014702479347761255, "type": "xml" }, { "id": 9, "lvl": -1, "conf": 0, "prob": 0.45397478342056274, "type": "xml" }, { "id": 10, "lvl": -1, "conf": 0, "prob": 0.00001095732022804441, "type": "xml" }, { "id": 11, "lvl": -1, "conf": 0, "prob": 0.00001085797975974856, "type": "registry" } ], "version": "v18.18", "analyzed_at": "2026-06-27T03:20:10Z" }, "path": "HeimdallFramework.Server.3.0.5.nupkg", "raw": { "files": [ { "id": 0, "mol": "O(Al)H₂(CmDb)", "sha": "a45291a337b296f268d8a71c588246cab1d2ffa59830ba0309b3a8a71224a64e", "path": "HeimdallFramework.Server.3.0.5.nupkg", "risk": 4, "size": 127193, "type": "nupkg", "facts": { "metrics": { "file": { "size": 127193.0, "entropy": 7.99, "size_bytes": 127193.0 }, "binary": { "overall_entropy": 7.99, "peak_region_bytes": 121856.0, "peak_region_entropy": 7.83 }, "archive": { "file_count": 11.0, "member_count": 11.0, "script_count": 0.0, "zip_bomb_ratio": 10.13, "directory_count": 0.0, "executable_count": 1.0, "extra_field_size": 0.0, "noise_file_count": 0.0, "total_compressed": 125749.0, "compression.ratio": 0.25, "hidden_file_count": 2.0, "total_uncompressed": 498786.0, "crc_collision_count": 0.0, "entry_comment_count": 0.0, "max_filename_length": 81.0, "rtlo_filename_count": 0.0, "format.regular_count": 11.0, "nested_archive_count": 0.0, "path_traversal_count": 0.0, "symlink_escape_count": 0.0, "security.setgid_count": 0.0, "security.setuid_count": 0.0, "security.sticky_count": 0.0, "double_extension_count": 0.0, "duplicate_member_count": 0.0, "security.symlink_count": 0.0, "unicode_filename_count": 0.0, "homoglyph_filename_count": 0.0, "security.encrypted_count": 0.0, "timing.mtime_unique_count": 6.0, "timing.mtime_unique_ratio": 0.55, "misplaced_executable_count": 1.0, "timing.mtime_dominant_count": 4.0, "timing.mtime_spread_seconds": 2332656.0, "timing.sentinel_mtime_count": 0.0, "security.world_writable_count": 0.0, "timing.mtime_dominant_fraction": 0.36, "compression.method_counts.stored": 1.0, "compression.method_counts.deflate": 10.0 } } }, "ident": { "name": { "value": "HeimdallFramework.Server", "source": "nupkg.title", "verified": false }, "urls": [ { "url": "https://github.com/bradleyables22/Heimdall", "kind": "repository", "source": "nupkg.repository_url" } ], "trust": "unsigned", "authors": [ { "name": "Bradley Ables", "role": "author", "source": "nupkg.authors" } ], "version": { "value": "3.0.5", "source": "nupkg.version", "verified": false }, "identifier": { "value": "HeimdallFramework.Server", "source": "nupkg.id", "verified": false } }, "traits": [ { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "from": [ { "file": 7 } ] }, { "id": "micro-behaviors/communications/http/server/managed::http-request-get", "conf": 1.0, "crit": 3, "desc": "Access to ASP.NET Request object", "from": [ { "file": 7 } ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "micro-behaviors/communications/http/server/managed::http-headers-access", "conf": 0.8500000238418579, "crit": 3, "desc": "Access to server-side HTTP headers", "from": [ { "off": 121597, "file": 7 } ] }, { "id": "micro-behaviors/communications/http/server/managed::http-context", "conf": 1.0, "crit": 3, "desc": "Access to ASP.NET HttpContext", "from": [ { "file": 7 } ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "from": [ { "file": 7 } ] }, { "id": "micro-behaviors/communications/http/server/managed::http-item-setter", "conf": 1.0, "crit": 1, "desc": "Modification of HTTP context items", "from": [ { "file": 7 } ] }, { "id": "objectives/command-and-control/dropper/staging/encrypted::dotnet-stringbuilder-append", "atk": "T1027", "mbc": "C0025", "conf": 0.8199999928474426, "crit": 1, "desc": ".NET StringBuilder Append use", "from": [ { "file": 7 } ] }, { "id": "micro-behaviors/communications/http/server/managed::http-context-item-setter", "conf": 0.8500000238418579, "crit": 3, "desc": "Modification of HTTP context items", "from": [ { "off": 121597, "file": 7 } ] }, { "id": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "conf": 1.0, "crit": 3, "desc": "JSON polymorphism runtime marker", "from": [ { "file": 7 } ] }, { "id": "micro-behaviors/communications/http/server/managed::http-response-get", "conf": 1.0, "crit": 3, "desc": "Access to ASP.NET Response object", "from": [ { "file": 7 } ] }, { "id": "micro-behaviors/data/db/linq::linq-queries", "conf": 0.699999988079071, "crit": 3, "desc": "LINQ query operations", "from": [ { "file": 7 } ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "from": [ { "file": 7 } ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "from": [ { "file": 7 } ] }, { "id": "micro-behaviors/data/db/linq::system-linq-expressions", "conf": 0.6000000238418579, "crit": 3, "desc": "System.Linq.Expressions namespace", "from": [ { "file": 7 } ] }, { "id": "micro-behaviors/communications/http/server/managed::http-headers-getter", "conf": 1.0, "crit": 1, "desc": "Access to Headers getter", "from": [ { "file": 7 } ] }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "from": [ { "file": 7 } ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "from": [ { "file": 7 } ] }, { "id": "objectives/anti-analysis/self-modify/runtime::dotnet-getexecutingassembly-token", "atk": "T1027.005", "conf": 0.8799999952316284, "crit": 3, "desc": ".NET current assembly lookup", "from": [ { "file": 7 } ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "from": [ { "file": 7 } ] }, { "id": "metadata/package/versioning::version-word-lower", "conf": 0.4000000059604645, "crit": 2, "desc": "version word (lowercase)", "from": [ { "file": 7 } ] }, { "id": "objectives/command-and-control/dropper/staging/encrypted::dotnet-hexstring-conversion", "atk": "T1027", "mbc": "C0025", "conf": 0.8600000143051147, "crit": 1, "desc": ".NET hex string conversion", "from": [ { "file": 7 } ] } ] }, { "id": 1, "sha": "367caf0b5ed7c995e4a9d4a236bb35162fa2855088738bd0be8ac618856e8f7c", "path": "HeimdallFramework.Server.3.0.5.nupkg!!_rels/.rels", "size": 518, "type": "xml", "depth": 1 }, { "ctx": [ { "b": "[4ls%kx}3YaA?spB7]MgjT8QkfD}SJzEWP}x(mMDb6w0teJs}sj]", "n": [ { "c": 2, "d": "NuGet nuspec manifest file", "i": "metadata/build/manifest::nuspec-file", "o": 0, "z": 31, "cf": 0.9800000190734863 } ], "ln": 1, "addr": 0 }, { "b": "jAa.syHH\u003c!aB4:tzGv@+xMOuniXJdcv}YB\u003cvrj5rx\u003e8g4B8LVje[n*pfk$ufyHH\u003c\u0026zF7QTfFLsofG7O4B-RIkv\u003eJ1EwfKh", "ln": 2, "addr": 43 }, { "b": "arS^-wPRu\u003evrt{w", "ln": 3, "addr": 120 }, { "b": "arR^Hjy\u00262Av@=p5BzkVhk1Gm0zdE6\u003ey-)!gA=#2mePUSpwGU\u00267wmPH/CvtJ6efFIwwn(E3zGG}JayPd#ayO=4x(v(iAa%o5y?W=#azbLjav]EaoF6\u003c\u003cA=VsBB7GxnwPw]czGY@dvruj4zGvA)fjXTnv@=p5BzkVhj]", "ln": 11, "addr": 410 }, { "b": "arR^HjAL1AB3snGx(dx?y?$kaA:-/@Cw?Iqazt\u003ely-(UPqxOXmlM*z*v\u003c2i3AbGlev@Dy0az\u003e?6wnC?3vrb{4B8$[PflySnB3o", "ln": 12, "addr": 541 }, { "b": "arR^HjAt1Lz/YSmz/QaCBA}?pjTaJMBrR\u0026IA+)(.xMOunB2\u003e%cxk8E3BZ=$kz/4dpA:-G{wQdY[y?mVyga#gfx(dx?y?$prv@Dj3x((GZg=EoCwmmu8vpR5CvQ}zThdp0bi5JVNw[r#kggA41wIN^NhdON6a%nK5", "n": [ { "c": 2, "d": "NuGet package declares repository", "i": "metadata/package/files/nuget::nuspec-repository", "o": 625, "z": 79, "cf": 0.8999999761581421 } ], "ln": 13, "addr": 621 }, { "b": "arR^Hjy\u00262xwO#3\u0026zEWx(B3o", "ln": 14, "addr": 751 }, { "b": "arR^HarS^VA=l8taAR4jxjVfOA:-/@Cw?IqjTa=PBtkE4fD}R)j]", "ln": 15, "addr": 771 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 1036.0, "entropy": 5.03, "size_bytes": 1036.0 }, "binary": { "overall_entropy": 5.03, "peak_region_bytes": 1024.0, "peak_region_entropy": 5.03 } } }, "id": 2, "path": "HeimdallFramework.Server.3.0.5.nupkg!!HeimdallFramework.Server.nuspec", "risk": 1, "sha": "92c1fb1270c2696bb666175f9c8d821a47559896b66cd55a03adbbf7e1b15a2d", "size": 1036, "traits": [ { "id": "metadata/package/files/nuget::nuspec-repository", "conf": 0.8999999761581421, "crit": 2, "desc": "NuGet package declares repository", "spans": [ [ 625, 79 ] ] }, { "id": "metadata/build/manifest::nuspec-file", "conf": 0.9800000190734863, "crit": 2, "desc": "NuGet nuspec manifest file", "spans": [ [ 0, 31 ] ] } ], "type": "xml" }, { "ctx": [ { "b": "", "ln": 4, "addr": 46 }, { "b": "p?sV:x(!ufz/cXiB0bdcA+eZ9azk.6zGGD2efFLBwO005w/$O%vrc0(efG4MayPekaAg[jB8L}sz^)/%x(mT5xcpR9v@Dsi", "ln": 5, "addr": 47 }, { "b": "z!pblxLzJgB8LVjCvtJ6ayPd#ayPtjz!0G\u0026By!#9wn+$2zdNQbvruj4zxJL9y?mVgd0fclar\u003c:5w]@l9A+cBzefG4May]4(yY", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 127, "z": 4, "cf": 0.800000011920929 } ], "ln": 6, "addr": 124 }, { "b": "x(k5nxK@q+z!s9nvrb{4Cwhejz/{dAA+frlA+P39x(v(uazC.6y\u0026%o5zF78ox([3bB-X:xx(dNavruj4zxK4mwGV2cxj#yd", "ln": 7, "addr": 202 }, { "b": "Bz\u0026pAB7D)Bv@DsiefF!FwnbU3efF!vA+w@maAhEjy?W%7efFFqB98CpvS=^7efG1RvR/:*wO#N2efFwswg}\u003ewaAIagyY", "ln": 8, "addr": 279 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 1070.0, "entropy": 5.1, "size_bytes": 1070.0 }, "binary": { "overall_entropy": 5.1, "peak_region_bytes": 1024.0, "peak_region_entropy": 5.1 } } }, "id": 3, "path": "HeimdallFramework.Server.3.0.5.nupkg!!LICENSE", "risk": 1, "sha": "948cf4d679f2d98537409f12af8642666f1480560654e1645a43ec312be8b706", "size": 1070, "traits": [ { "id": "metadata/file/profile/language::lang-english", "conf": 0.800000011920929, "crit": 2, "desc": "English language detection", "spans": [ [ 127, 4 ] ] } ], "type": "text" }, { "ctx": [ { "b": "boPJ*x(dx?y?#NYvqPO1z/PRCq!o#)wPv", "ln": 1, "addr": 0 }, { "b": "", "ln": 2, "addr": 28 }, { "b": "nm=HLwmop\u003cmSI{OwP@6kyC5K%A=#2maAhvtC4\u003eF#B0bNrwGToqp+CHir3jLDA+cwmwPz%9AV/yBzGGPfwGUP6AV^[:x(dx?y?#cPAa9x\u003caz2C3AbPDdBAn#Qv@DmbwO#PjvpKy[z/cXeCX7xcBzkVhefFwsBzku9A+w%7C{3*sBy/99vruj4zy=[%x\u003ezy7B95KCwPz%9AXhuzzGE1jC4CMkB1wCdrZO0GvrcE7vqE6bwO#3\u0026A+PA7aAIWAAbP=sefFwswft@nvrui[aAImswGUR%zE)\u0026%BzkVhe=", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 64, "z": 3, "cf": 0.800000011920929 } ], "ln": 3, "addr": 30 }, { "b": "", "ln": 4, "addr": 265 }, { "b": "nm=HLwmop\u003cazC)tvqWhUr834rw[=pbBrCgovqPO1z/PRow]zYjB7GxnwPxwkA+PYdzxI}Je*abbwGV59A=#2maAz4hwmY!5ay]z2B.$YcBAnNkzE:\u003eXr834ew].r)zdNQbB1wCxzE:(ixK@q}A=leywPw]4AbYScwPF#ovrc0(By!#9l@cJ1B-p(1By/IoBzbYkB.twgBzbkdnm=HLwmop\u003cay/k4wO#PjA=(nwx(dAl", "ln": 5, "addr": 267 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 17449.0, "entropy": 4.99, "size_bytes": 17449.0 }, "text": { "digit_ratio": 0.0, "space_count": 1932.0, "total_lines": 519.0, "char_entropy": 4.99, "unique_chars": 82.0, "lines_over_200": 18.0, "avg_line_length": 31.62, "max_line_length": 432.0, "empty_line_ratio": 0.29, "last_line_length": 3.0, "whitespace_ratio": 0.17, "most_common_ratio": 0.09, "line_length_stddev": 57.24, "repeated_char_sequences": 1.0, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 1.0, "most_common_char_codepoint": 101.0 }, "binary": { "overall_entropy": 4.99, "peak_region_bytes": 17408.0, "peak_region_entropy": 5.12 } } }, "id": 4, "path": "HeimdallFramework.Server.3.0.5.nupkg!!readme.md", "risk": 1, "sha": "542c527d4835824a368ac81bd11cffddcb347295e9c5415fd9e299d5240cbd1f", "size": 17449, "traits": [ { "id": "metadata/file/extension/identity::doc-or-config-extension", "conf": 1.0, "crit": 1, "desc": "Document or config file extension", "spans": [ [ 0, 9 ] ] }, { "id": "metadata/file/extension/identity::markdown-file-basename", "conf": 1.0, "crit": 1, "desc": "Markdown document file extension", "spans": [ [ 0, 9 ] ] }, { "id": "metadata/file/profile/language::lang-english", "conf": 0.800000011920929, "crit": 2, "desc": "English language detection", "spans": [ [ 64, 3 ] ] } ], "type": "markdown" }, { "id": 5, "sha": "d54c1f40cb3ecb570759257f506a3b74eeb507a611634322fc57d5e360b083d8", "path": "HeimdallFramework.Server.3.0.5.nupkg!!buildTransitive/HeimdallFramework.Server.targets", "size": 4471, "type": "xml", "depth": 1 }, { "id": 6, "sha": "bf92e7b71e4bde2fb530c8f71c0144208c22de9d85b3fc9882d9e6b919a8554a", "path": "HeimdallFramework.Server.3.0.5.nupkg!!favicon.png", "size": 2899, "type": "png", "depth": 1 }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J\u0026m(0ji6Sa?dLD+]{51x(+zoA=kPhvqNb%vqY$3BrC47aAzQxazCZol@c-7zeP", "n": [ { "c": 3, "d": "HTTP fingerprinting evasion campaign", "i": "objectives/command-and-control/infrastructure/user-agent::http-fingerprinting-campaign", "o": 0, "z": 34, "cf": 0.8999999761581421 }, { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 78, "z": 4, "cf": 0.800000011920929 } ], "ln": 0 }, { "b": "00000000000000000000N:}Ju00000nb@R\u00260SSx7J0GB:49X!M0rr91000000000000", "n": [ { "c": 1, "d": "PE standard code/data section", "i": "metadata/binary/section/names::pe-code-data-standard-section", "o": 512, "z": 5, "cf": 0.8999999761581421 } ], "ln": 496 }, { "b": "huFm@0SSu9c}:Tx3mV2Qlq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn", "n": [ { "c": 3, "d": "Benign PE anti-analysis context", "i": "objectives/anti-analysis/debugger-detect/combined-checks::evasion-aware-benign-pe-context", "o": 60044, "z": 4, "cf": 1.0 } ], "ln": 60028 }, { "b": "00icln!qKo0eJ@w0096Dt(T\u003c9024%o5cq\u0026/lj:Xg0n[O65cI#KdI9c(09hw=0097RiSGcX", "n": [ { "c": 3, "d": "Embedded LZMA compressed data", "i": "micro-behaviors/data/embedded/payload/compression::lzma-magic", "o": 91721, "z": 8, "cf": 0.699999988079071 } ], "ln": 91705 }, { "b": "o(BM+y?k^gk(:ERju=Kvq*ACawO\u003c4\u003epxiI2x\u003eqGSzF9W3wJ\u0026]\u003cjALdKA71bRvnH#.C4\u003eF#AS", "n": [ { "c": 2, "d": "System namespace reference", "i": "metadata/lang/compiler/managed::system-namespace", "o": 117243, "z": 9, "cf": 0.800000011920929 } ], "ln": 117227 }, { "b": "0b2\u003e+uR1QDp*[S=z^^eRAaa3dz^^eRm}D^rAZskD07pymwPRG.wO(y8A::0lpJZ+#B-Z7", "n": [ { "c": 1, "d": "Regex component marker", "i": "objectives/command-and-control/dropper/staging/encrypted::staged-payload-file-name--rx-1", "o": 119072, "z": 7, "cf": 0.8500000238418579 } ], "ln": 119056 }, { "b": "0b2\u003e+uR1QDq/(C*By!$.xjVf(qE%\u0026\u003cwPI@VvScpewN\u003e^ZwPRoSwPq\u003c7B96YSz/P@hwb]$PA+Pd", "n": [ { "c": 3, "d": "Access to ASP.NET Request object", "i": "micro-behaviors/communications/http/server/managed::http-request-get", "o": 119382, "z": 11, "cf": 1.0 } ], "ln": 119366 }, { "b": "uTDcdv@2^@xguPDy?9Jdnow@)lVl\u003c:wQ5qXyHpBnvpK7!zF8BMwO+(Sjv%B3wQ3yOuTDcdv@2=", "n": [ { "c": 3, "d": "Access to ASP.NET HttpContext", "i": "micro-behaviors/communications/http/server/managed::http-context", "o": 121597, "z": 11, "cf": 1.0 } ], "ln": 121581 }, { "b": "wDlvOBydyzzdNJJvrk#WxjVf(qE%]*z/fSc07.iNA8Hm*AbPSnwDlvOBye9\u0026x()]=x(dB1B-ZI)", "n": [ { "c": 3, "d": "Access to ASP.NET Response object", "i": "micro-behaviors/communications/http/server/managed::http-response-get", "o": 124219, "z": 12, "cf": 1.0 } ], "ln": 124203 }, { "b": "x(mL-m}D^vBAh8kx8\u003e[Hnm^3ABAh8kx8\u003eUuv@=Hez!s8zl340uwPQpTA+c\u003c]z/Z2mzF5@zx-", "n": [ { "c": 1, "d": ".NET hex string conversion", "i": "objectives/command-and-control/dropper/staging/encrypted::dotnet-hexstring-conversion", "o": 126298, "z": 9, "cf": 0.8600000143051147 } ], "ln": 126282 }, { "b": "A+5)4vqC{ZA+Pf2zEEtYq*ACawO\u003c4#wN/\u003e6x([RMp\u0026Zn/v}/)\u003cyYD?svqfO1p\u0026Zn/v}/)\u003cyYD+uAaJ[", "n": [ { "c": 2, "d": "System namespace reference", "i": "metadata/lang/compiler/managed::system-namespace", "o": 127925, "z": 15, "cf": 0.800000011920929 } ], "ln": 127909 }, { "b": "07ZWnzdE6\u003ey+wT$A=#2me[w^m090xoy?l1yByvKFy?%8JvpB4:nm=juwPydHy?%8F", "n": [ { "c": 3, "d": "References Windows executable or script", "i": "objectives/execution/interpreter/script/shell::windows-executable-ref", "o": 128201, "z": 4, "cf": 0.6000000238418579 } ], "ln": 128185 }, { "b": "A=kA6wO?AWwPRoJBy/p?B7GD2nPXJX0blK^z2^HWB97#g07gNhx(9\u0026Wy*?3{090#Mz2^NT", "n": [ { "c": 3, "d": "Modification of HTTP context items", "i": "micro-behaviors/communications/http/server/managed::http-context-item-setter", "o": 128526, "z": 8, "cf": 0.8500000238418579 } ], "ln": 128510 }, { "b": "uSq5Wxj\u003e^@rbU-OyH}w-xjVf(qE%\u0026\u003cwPI@)z!\u0026{40b2\u003e+uVGZ$B.bSorbVL-zuarXByfcdyH}w", "n": [ { "c": 3, "d": "Access to ASP.NET Request object", "i": "micro-behaviors/communications/http/server/managed::http-request-get", "o": 128890, "z": 11, "cf": 1.0 } ], "ln": 128874 }, { "b": "z7Xs{z^)c\u003ex)Kifx(v\u003e?q*ACawO\u003c50wQ5qHn][]*e(Mt4x\u003c\u003e*(Dsp]fz/bLHx\u003e8g4B8LVje\u003cTL$pgXJm", "n": [ { "c": 3, "d": "JSON polymorphism runtime marker", "i": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "o": 129401, "z": 16, "cf": 1.0 } ], "ln": 129385 }, { "b": "zE^r@v%HT-ygQ)%x(v\u003e?q*ACawO\u003c4$wOb:\u0026v@#B6zu9mbwPz%dv}w2Cy\u00260V)BzkVh07ZWnzdE6\u003ey/s[=B]", "n": [ { "c": 2, "d": "Benign high-entropy PE context", "i": "metadata/package/quality/false-positives::benign-high-entropy-pe-context", "o": 129556, "z": 17, "cf": 0.949999988079071 } ], "ln": 129540 }, { "b": "x(v\u003e?wmY*(A+PGmx(v\u003e?q*ACawO\u003c50wQ5qHn][]*08)#FBy!6=z/bL:z!ab=B8L{@A+eW2z/bLNBAh8k", "n": [ { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 130162, "z": 16, "cf": 0.8500000238418579 } ], "ln": 130146 }, { "b": "q*ACawO\u003c54zep*#x(m[\u003cq*ACawO\u003c4[x(m[\u003clui5%ASwjxwPq\u003c7B97x1yH}xEyf$sEp*[wAjALG", "n": [ { "c": 3, "d": "LINQ query operations", "i": "micro-behaviors/data/db/linq::linq-queries", "o": 130611, "z": 11, "cf": 0.699999988079071 } ], "ln": 130595 }, { "b": "x(n2\u003cz/{ekluN0UwmY=Yq/)4]zF8pUx(4r\u003eASwTwx(dx?y?#BXx(4r\u003eASwV%AbYScv{%E[z/d):x-", "n": [ { "c": 1, "d": ".NET StringBuilder Append use", "i": "objectives/command-and-control/dropper/staging/encrypted::dotnet-stringbuilder-append", "o": 131181, "z": 13, "cf": 0.8199999928474426 } ], "ln": 131165 }, { "b": "v@Dg4ASw^Kxgl\u0026Yz/L?Hnow@)lVl\u003c:wQ5q.v}f7\u003eB8M70l1BH%BAzE?z/fVdCYVkYv}x.5z/L?\u003eBAzE?z/fVdCYVkYv}x.5z/L?Hmq-", "n": [ { "c": 3, "d": "Access to ASP.NET HttpContext", "i": "micro-behaviors/communications/http/server/managed::http-context", "o": 132048, "z": 11, "cf": 1.0 } ], "ln": 132032 }, { "b": "z/6Dcy?mS=wPz%dv}xYYxjVf(qE%\u0026\u003cwPI@(wPz%dv}xYYuVP!0C4\u003eC$A@XQtvS=r@x(mMTz!9z", "n": [ { "c": 3, "d": "Access to ASP.NET Request object", "i": "micro-behaviors/communications/http/server/managed::http-request-get", "o": 132965, "z": 11, "cf": 1.0 } ], "ln": 132949 }, { "b": "By/uhx(v)g08^-TBzkS9now@)lVl\u003c:wQ5q=CYWImB7]MgA@X{CzeTDumr\u0026]=zGxJgzGt!RD2[7sz7XH@zGdo$CYmXmB8#5lzGt!\u003cwPRoTwNPQ?xK$ZFz!0i$x(v)g0afkOzGGDcBu]", "n": [ { "c": 3, "d": "Access to ASP.NET HttpContext", "i": "micro-behaviors/communications/http/server/managed::http-context", "o": 134751, "z": 11, "cf": 1.0 }, { "c": 3, "d": "LINQ expression tree manipulation", "i": "micro-behaviors/data/db/linq::linq-expressions", "o": 134790, "z": 23, "cf": 0.75 } ], "ln": 134735 }, { "b": "A=RjSA+PAko\u003ewfJwPz?(xjVf(nm=juwPz?(o\u003e!9Tz/Y\u0026eBs{1bBy/uhx(v)ge\u003efL\u003ewL^z=C4\u003eE", "n": [ { "c": 3, "d": "Access to server-side HTTP headers", "i": "micro-behaviors/communications/http/server/managed::http-headers-access", "o": 135699, "z": 11, "cf": 0.8500000238418579 } ], "ln": 135683 }, { "b": "BwMy/xI@+!Bo1)NmRMWIq*ACawO\u003es-z/+$Dz/fVdzGF={z/+$(wPRoPB-.OBBw^3}Bo3w[Byb", "n": [ { "c": 2, "d": "SYSTEMROOT environment variable", "i": "micro-behaviors/os/env/vars/system-info::systemroot-var", "o": 138176, "z": 10, "cf": 0.5 } ], "ln": 138160 }, { "b": "B94yXv@Dr$lU{WZwPI}[xjVf(qE%\u0026\u003cwPI}[lsBz5wPq\u003c7B94yMBAzF1wPq\u003c7B94yIvrt{Kx(!v", "n": [ { "c": 3, "d": "Access to ASP.NET Request object", "i": "micro-behaviors/communications/http/server/managed::http-request-get", "o": 138468, "z": 11, "cf": 1.0 } ], "ln": 138452 }, { "b": "07pKxvpB4:rb3hXz/{d4xjVf(qE%\u0026\u003cwPI@)x(dB1B-WR8wPRoSwPq\u003c7B97w}zdNTdBo2@+BydA", "n": [ { "c": 3, "d": "Access to ASP.NET Request object", "i": "micro-behaviors/communications/http/server/managed::http-request-get", "o": 138612, "z": 11, "cf": 1.0 } ], "ln": 138596 }, { "b": "BzkVhlVl\u003c:wQ5p%xjVf(now@)lVl\u003c:wQ5p%B7GD2now@)lVl\u003c:wQ5p%xMOunlVl\u003c:wQ5p%r+Vb?lVl\u003c:wQ5p%v@DmbwQ5p", "n": [ { "c": 3, "d": "Access to ASP.NET HttpContext", "i": "micro-behaviors/communications/http/server/managed::http-context", "o": 139011, "z": 11, "cf": 1.0 } ], "ln": 138995 }, { "b": "lT:!Ex(mMHB8$]fvR*q\u0026m}D^hCX7xcBzkS9l349Uzdmsb06$damSJA:l349Uzdmsb07QQxmq^i/C%MH)wO\u003e))", "n": [ { "c": 3, "d": ".NET current assembly lookup", "i": "objectives/anti-analysis/self-modify/runtime::dotnet-getexecutingassembly-token", "o": 139565, "z": 20, "cf": 0.8799999952316284 } ], "ln": 139549 }, { "b": "x8(SCA@ZpZwDl-Jaok*IBPuH-xAh@JASx!NDh}vNBo31PzVBUPaolD.wDl-JB]VjRv/Q6uA@Wr.Ck", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 140712, "z": 4, "cf": 0.800000011920929 }, { "c": 1, "d": "rust binary fs module vocabulary", "i": "objectives/impact/crypto-manipulation/keywords::rust-bin-fs-vocab", "o": 140703, "z": 8, "cf": 0.20000000298023224 } ], "ln": 140687 }, { "b": "0cncZ03zn-0bhBI0a=dG0cFo-03znU0a=dL0at\u003er0at\u003eH0at\u003cI0a(jH0ce5Z07W7", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 141070, "z": 3, "cf": 0.800000011920929 } ], "ln": 141054 }, { "b": "zua8BvGpiAwDi?MBo3jVaolAZwDl=KzVBONB]V7NaolG-xAhPzaok{LwDliuyYE(", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 142019, "z": 3, "cf": 0.800000011920929 } ], "ln": 142003 }, { "b": "04d:ElNI\u003cR0aV7F0a=dK03znV0b?\u003cV03znP0at\u003eJ0a=cM0at\u003cI0aV7v0aM1B0at\u003eF", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 142566, "z": 4, "cf": 0.800000011920929 } ], "ln": 142550 }, { "b": "nM#f:0ce6T0bRZm0a=dJ0cOuR0aM1u0cncC03znI0b.^E03znC07c:80b.^U0a=c", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 143144, "z": 3, "cf": 0.800000011920929 } ], "ln": 143128 }, { "b": "Bo2\u003eLEe\u003e(108kMQklb{dz2!wLaolM+wDl-JA@Y[OzVBUPjPDVaf-S*afAro%aok%Mzuae", "n": [ { "c": 3, "d": "Benign sparse-logic binary context", "i": "objectives/anti-analysis/vm-detect/instruction::sparse-logic-benign-context", "o": 145489, "z": 7, "cf": 0.800000011920929 } ], "ln": 145473 }, { "b": "0cwiZ03zm?009f%000rT0cwiT0b}]rjYqu50at\u003eH0bhBy03znX0at\u003eu0a=cM0ce5", "n": [ { "c": 2, "d": "Reference to a temporary directory", "i": "micro-behaviors/fs/temp/reference::temp-dir-reference", "o": 146086, "z": 3, "cf": 0.4000000059604645 } ], "ln": 146070 }, { "b": "z#:qDASygYx-IMwyYCNTB]VjRwDl]Oaok\u003cJwDliuve$AIA@Y+KaolG-xAhPzASxUJaol9QA@Wr", "n": [ { "c": 3, "d": "Access to ASP.NET HttpContext", "i": "micro-behaviors/communications/http/server/managed::http-context", "o": 152688, "z": 11, "cf": 1.0 } ], "ln": 152672 }, { "b": "00000000000000000000000000000000000000315c8Xg7YTL^00000000000000000", "n": [ { "c": 1, "d": "PE resource section", "i": "metadata/binary/section/names::pe-resource-section", "o": 178688, "z": 5, "cf": 0.8999999761581421 } ], "ln": 178672 }, { "b": "0000000000001LMgYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006Xn[brp!0rr910@@r", "n": [ { "c": 3, "d": "Benign context for timing checks", "i": "objectives/anti-analysis/timing/evasion::timing-anti-debug-benign-context", "o": 178782, "z": 15, "cf": 0.949999988079071 } ], "ln": 178766 }, { "b": "zua.Te=U\u003eK002aY4GDIflJz38z2!IPve$fBC(QOtve$cAwDhYg002s=ASxIFwb{ACwDl#QaojXcvGpiAwDl=K002K\u00265c8.hmGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up002K\u0026wDlAAz2!8Dve$9", "n": [ { "c": 2, "d": "PE CompanyName metadata field", "i": "metadata/package/versioning::pe-companyname-field", "o": 179226, "z": 11, "cf": 0.699999988079071 }, { "c": 2, "d": "PE FileDescription metadata field", "i": "metadata/package/versioning::pe-filedescription-field", "o": 179286, "z": 15, "cf": 0.699999988079071 } ], "ln": 179210 }, { "b": "ASym.wDl-J001XM2MK(9mGvc5yYF2DrSDXhASydXx-J5Kzu6Up001!Pe=WN9e=W:ee=WN9002K\u00266AwdlnDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE002K\u0026wDlAAz2!8Dve$9zyYD6/", "n": [ { "c": 3, "d": "Dotted-quad PE version metadata context", "i": "objectives/command-and-control/infrastructure/ip::ipv4-version-metadata-context", "o": 179358, "z": 11, "cf": 0.9399999976158142 }, { "c": 2, "d": "PE InternalName metadata field", "i": "metadata/package/versioning::pe-internalname-field", "o": 179406, "z": 12, "cf": 0.699999988079071 } ], "ln": 179342 }, { "b": "xAibO001bw002*}6Awdlpxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE002K\u0026wDlAAz2!8Dve$9z", "n": [ { "c": 2, "d": "PE OriginalFilename metadata field", "i": "metadata/package/versioning::pe-originalfilename-field", "o": 179518, "z": 16, "cf": 0.699999988079071 } ], "ln": 179502 }, { "b": "e=YzZyYFnK002m:5c8.hpYLIozVBqFBPt[KBo25ove$cAwDhYg002K\u0026wDlAAz2!8Dve$9zyYD6", "n": [ { "c": 2, "d": "PE ProductName metadata field", "i": "metadata/package/versioning::pe-productname-field", "o": 179598, "z": 11, "cf": 0.699999988079071 } ], "ln": 179582 }, { "b": "ASym.wDl-J004PJf8#1MpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001!Pe=WN9e=W:ed/.yahVJ", "n": [ { "c": 2, "d": "PE version resource metadata", "i": "metadata/package/versioning::version-resource-metadata", "o": 179662, "z": 14, "cf": 0.8999999761581421 } ], "ln": 179646 }, { "b": "000000000000000000000mg=E3\u0026*ncYFY-\u0026000000000000000000000000000000000", "n": [ { "c": 2, "d": "PE .reloc section presence", "i": "metadata/binary/section/names::reloc-section-presence", "o": 180224, "z": 6, "cf": 0.8999999761581421 } ], "ln": 180208 } ], "depth": 1, "facts": { "imp": [ [ "mscoree", "CorDllMain" ] ], "sec": [ [ ".text", 512, 178176, 6.01, "r-x" ], [ ".rsrc", 178688, 1536, 2.67, "r--" ], [ ".reloc", 180224, 512, 0.1, "r--" ] ], "metrics": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "resource_count": 1.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 187805.0, "reloc_overhang_bytes": 500.0, "reloc_overhang_ratio": 0.98, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "version.identity_entropy": 3.74, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0, "version.identity_symbol_ratio": 0.05 }, "file": { "size": 180736.0, "entropy": 5.97, "size_bytes": 180736.0 }, "binary": { "is_pie": 1.0, "code_entropy": 6.01, "string_count": 1857.0, "overall_entropy": 5.97, "entropy_variance": 5.84, "avg_string_length": 19.32, "max_string_length": 218.0, "peak_region_bytes": 6144.0, "code_to_data_ratio": 1.0, "peak_region_entropy": 6.61, "string_length_stddev": 17.53, "largest_section_ratio": 0.99, "sentence_string_count": 121.0, "sentence_string_ratio": 0.07, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 178176.0, "entropy_max": 6.01, "entropy_mean": 2.93, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } } }, "id": 7, "mol": "O(Al)H₂(CmDb)", "path": "HeimdallFramework.Server.3.0.5.nupkg!!lib/net10.0/Heimdall.Server.dll", "risk": 4, "sha": "11c88f9045391fd7cd5b8ca9162cd75d082060956f0895bcc7cfe858e41e7fc5", "size": 180736, "traits": [ { "id": "objectives/anti-analysis/self-modify/runtime::dotnet-getexecutingassembly-token", "atk": "T1027.005", "conf": 0.8799999952316284, "crit": 3, "desc": ".NET current assembly lookup", "spans": [ [ 139565, 20 ] ] }, { "id": "micro-behaviors/communications/http/server/managed::http-request-get", "conf": 1.0, "crit": 3, "desc": "Access to ASP.NET Request object", "spans": [ [ 119382, 11 ], [ 128890, 11 ], [ 132965, 11 ], [ 138468, 11 ], [ 138612, 11 ] ] }, { "id": "micro-behaviors/data/db/linq::linq-queries", "conf": 0.699999988079071, "crit": 3, "desc": "LINQ query operations", "spans": [ [ 130611, 11 ], [ 134790, 11 ] ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "spans": [ [ 128201, 4 ] ] }, { "id": "metadata/package/versioning::version-word-lower", "conf": 0.4000000059604645, "crit": 2, "desc": "version word (lowercase)", "spans": [ [ 145489, 7 ] ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 178782, 15 ] ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "spans": [ [ 60044, 4 ] ] }, { "id": "micro-behaviors/data/db/linq::system-linq-expressions", "conf": 0.6000000238418579, "crit": 3, "desc": "System.Linq.Expressions namespace", "spans": [ [ 134790, 23 ] ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "spans": [ [ 179662, 14 ] ] }, { "id": "micro-behaviors/communications/http/server/managed::http-response-get", "conf": 1.0, "crit": 3, "desc": "Access to ASP.NET Response object", "spans": [ [ 124219, 12 ] ] }, { "id": "objectives/command-and-control/dropper/staging/encrypted::dotnet-hexstring-conversion", "atk": "T1027", "mbc": "C0025", "conf": 0.8600000143051147, "crit": 1, "desc": ".NET hex string conversion", "spans": [ [ 126298, 9 ] ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "spans": [ [ 179358, 11 ] ] }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "spans": [ [ 0, 26 ] ] }, { "id": "micro-behaviors/communications/http/server/managed::http-headers-getter", "conf": 1.0, "crit": 1, "desc": "Access to Headers getter", "spans": [ [ 135699, 11 ] ] }, { "id": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "conf": 1.0, "crit": 3, "desc": "JSON polymorphism runtime marker", "spans": [ [ 129401, 16 ] ] }, { "id": "micro-behaviors/communications/http/server/managed::http-context", "conf": 1.0, "crit": 3, "desc": "Access to ASP.NET HttpContext", "spans": [ [ 121597, 11 ], [ 132048, 11 ], [ 132071, 11 ], [ 134751, 11 ], [ 139011, 11 ], [ 139027, 11 ], [ 152688, 11 ] ] }, { "id": "micro-behaviors/communications/http/server/managed::http-item-setter", "conf": 1.0, "crit": 1, "desc": "Modification of HTTP context items", "spans": [ [ 128526, 8 ] ] }, { "id": "objectives/command-and-control/dropper/staging/encrypted::dotnet-stringbuilder-append", "atk": "T1027", "mbc": "C0025", "conf": 0.8199999928474426, "crit": 1, "desc": ".NET StringBuilder Append use", "spans": [ [ 131181, 13 ] ] }, { "id": "micro-behaviors/communications/http/server/managed::http-headers-access", "conf": 0.8500000238418579, "crit": 3, "desc": "Access to server-side HTTP headers", "spans": [ [ 119382, 11 ], [ 121597, 11 ], [ 128890, 11 ], [ 132048, 11 ], [ 132071, 11 ], [ 132965, 11 ], [ 134751, 11 ], [ 135699, 11 ] ] }, { "id": "micro-behaviors/communications/http/server/managed::http-context-item-setter", "conf": 0.8500000238418579, "crit": 3, "desc": "Modification of HTTP context items", "spans": [ [ 121597, 11 ], [ 128526, 8 ], [ 132048, 11 ], [ 132071, 11 ], [ 134751, 11 ], [ 139011, 11 ], [ 139027, 11 ], [ 152688, 11 ] ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "spans": [ [ 60044, 4 ] ] } ], "type": "pe" }, { "ctx": [ { "b": "arR^HarR^HarR^HlVM:DBy/IoviwfJC41rVA+PGmaA?WqwftP7C5H(0BzkVhay]hbwN/*@C4z!rxKM09A=(nvayO(7wPw]lwPI*ezGxwiB9z5iB1N", "ln": 465, "addr": 42451 }, { "b": "arR^HarR^HarR^Hjtg+#zeAZ4C%h", "ln": 466, "addr": 42543 }, { "b": "arR^HarR^HarR^HjAa.HvqNc8vqPNsb4+$nv@#B6zCT+-xD/SazxJInAbok#x([fpaAzysBy!#9w{503BzkVhaAg+hxDRwsv}V#[B09OPk6HZUwn=VAl2Z=}B76l6wiqIPj$X@JAa9=}z9v", "n": [ { "c": 2, "d": "Script overall entropy stays low", "i": "metadata/file/metrics::low-overall-entropy-source", "o": 42567, "z": 29, "cf": 0.8999999761581421 } ], "ln": 467, "addr": 42567 }, { "b": "arR^HarR^HarR^HjAa.HvqNc8vqPNsb4kI8B0r!lA+xJiwO#QhaAg+gB7F(8Bz\u0026pzxK@qUvrM6Tv@=p5BrCgrzEW^5z/df\u0026fk$uuvqOg", "ln": 468, "addr": 42683 }, { "b": "arR^HarR^HjtgL.zdm6%j]", "ln": 469, "addr": 42768 }, { "b": "arR^HarR^HarR^Hjtg+#zeAZ4C%h", "ln": 481, "addr": 43612 }, { "b": "arR^HarR^HarR^HjAa.HvqNc8vqPNsb4+$nv@#B6zCT+-xD/SazxJInAbok#x([fpaAzysBy!#9w{503BzkVhaAg+hxDRwsv}V#[B09OPk6HZUwn=VAl2Z=}Ab]Jevrb{wfjNf#jtgUZA:-/G", "n": [ { "c": 2, "d": "Script overall entropy stays low", "i": "metadata/file/metrics::low-overall-entropy-source", "o": 43636, "z": 29, "cf": 0.8999999761581421 } ], "ln": 482, "addr": 43636 }, { "b": "arR^HarR^HarR^HjAa.HvqNc8vqPNsb4kI8B0r!lA+xJiwO#QhaAg+gB7F(8Bz\u0026pzxK@qUvrM6Tv@=p5BrCgrzEW^5z/df\u0026fk$uuvqOg", "ln": 483, "addr": 43754 }, { "b": "arR^HarR^HarR^HjAa.HvqNc8vqPNsb6d%pA3vFBxK@q+q:?*ICvtCkzeS@@e\u003c7!avrb^[j]", "ln": 1222, "addr": 85013 }, { "b": "arR^HarR^HarR^HjAt1PB-Iwvk2=ibay/LmA+fcgayYFcy?d9$azC.mByx5%wIc7#A+funA=b}Z", "ln": 1223, "addr": 85072 }, { "b": "arR^HarR^HjtgL.zdm6%j]", "n": [ { "c": 2, "d": "javascript code embedded in string", "i": "metadata/lang/embedded::javascript", "o": 85134, "z": 102, "cf": 1.0 } ], "ln": 1224, "addr": 85134 }, { "b": "arR^HarR^Hjz!UDvR6N5zEEx[jT9PYnm=HLwmop\u003ce(Mt4C4CXDqE%-RwPzH5xd=U\u0026B.bDjnm=HLwmop\u003ce\u003exL/zdE6\u003ey^JnUy?d9$e(M?5mrSlWBsp7kB97#ge(M\u003ejx(mMjb0C", "ln": 1225, "addr": 85153 }, { "b": "arR^HarR^HarR^HjACTZzddEgj]", "ln": 1226, "addr": 85261 }, { "b": "arR^HarR^HarR^HjAa.HvqNc8vqPNsb4+\u003e7xkIi$BrS[FxK@q#A:-P$wO#PjvS=y3wmY^7Bz\u0026pCA:-]tjtgUZA:-/G", "ln": 1257, "addr": 87111 }, { "b": "arR^HarR^HarR^Hjy@+EwPh:9z/cXcA+e\u0026Cb2*Q4D2[7sz7Xa{xlw65zGFS@y?#K+v}xR3x(v(kk2=ioz*c7wCw7M9auTQKA:-*9wO965vqPNsb4+\u003e7xkIi$BrSw4azC)tjAC7Baz+F7xlOomwizbOB.\u003e\u003erffR0Jfj/xrwPh:9z/d-", "n": [ { "c": 2, "d": "javascript code embedded in string", "i": "metadata/lang/embedded::javascript", "o": 87272, "z": 104, "cf": 1.0 } ], "ln": 1258, "addr": 87185 }, { "b": "arR^HarR^HjtgL.zdm6%j]", "ln": 1259, "addr": 87326 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 276006.0, "entropy": 4.52, "size_bytes": 276006.0 }, "binary": { "overall_entropy": 4.52, "peak_region_bytes": 252454.0, "peak_region_entropy": 4.77 } } }, "id": 8, "path": "HeimdallFramework.Server.3.0.5.nupkg!!lib/net10.0/Heimdall.Server.xml", "risk": 1, "sha": "ab699f9c30103d49cfccf575cba235306f1b70661a371652e9f88f201f3df7dc", "size": 276006, "traits": [ { "id": "metadata/file/metrics::low-overall-entropy-source", "conf": 0.8999999761581421, "crit": 2, "desc": "Script overall entropy stays low", "spans": [ [ 42567, 29 ], [ 43636, 29 ] ] }, { "id": "metadata/lang/embedded::javascript", "conf": 1.0, "crit": 2, "desc": "javascript code embedded in string", "spans": [ [ 85134, 102 ], [ 87272, 104 ] ] }, { "id": "metadata/file/extension/identity::doc-or-config-extension", "conf": 1.0, "crit": 1, "desc": "Document or config file extension", "spans": [ [ 0, 19 ] ] } ], "type": "xml" }, { "id": 9, "sha": "df487b823dfc56efe8da9bcba8c859eb17e1ed5537d7b4503eefe445b8513492", "path": "HeimdallFramework.Server.3.0.5.nupkg!![Content_Types].xml", "size": 789, "type": "xml", "depth": 1 }, { "id": 10, "sha": "bb8be8941be46af0ba81c5c32e3698df4383651fe498e1d4c937e0278dc32b53", "path": "HeimdallFramework.Server.3.0.5.nupkg!!package/services/metadata/core-properties/0cea288794404a0eafa0e52071a10cdd.psmdcp", "size": 823, "type": "xml", "depth": 1 }, { "id": 11, "sha": "20ef9e2d174c9e829dbf34100a6a9176fd32cb7363b28b97f26a4d590c2cf602", "path": "HeimdallFramework.Server@3.0.5.registry.json", "size": 835, "type": "registry", "depth": 1 } ], "omitted_files": 6, "v": "8" } }