{ "llm": { "conf": 0.82373506, "grade": "benign", "model": "Qwen/Qwen3.6-27B", "review": false, "outcome": "benign", "interpretation": "Legitimate library package" }, "ml": { "v": "7", "eng": "2.2.0", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.74819297, "rte": "az", "prob": 0.74819297 }, { "cls": 0, "raw": 0.17031771, "rte": "az/nupkg", "prob": 0.17031771 } ], "prob": 0.74819297, "skip": [ { "rte": "az/zip", "why": "unavailable" }, { "rte": "az/zip", "why": "unavailable" } ], "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.7481929659843445, "type": "nupkg" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.00012001395225524902, "type": "xml" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.008743494749069214, "type": "xml" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.005262881517410278, "type": "text" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.00006663799285888672, "type": "png" }, { "id": 5, "lvl": -1, "conf": 0, "prob": 0.1754968762397766, "type": "pe" }, { "id": 6, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "xml" }, { "id": 7, "lvl": -1, "conf": 0, "prob": 0.1754968762397766, "type": "pe" }, { "id": 8, "lvl": -1, "conf": 0, "prob": 0.7481929659843445, "type": "xml" }, { "id": 9, "lvl": -1, "conf": 0, "prob": 0.1754968762397766, "type": "pe" }, { "id": 10, "lvl": -1, "conf": 0, "prob": 0.7481929659843445, "type": "xml" }, { "id": 11, "lvl": -1, "conf": 0, "prob": 0.1754968762397766, "type": "pe" }, { "id": 12, "lvl": -1, "conf": 0, "prob": 0.7481929659843445, "type": "xml" }, { "id": 13, "lvl": -1, "conf": 0, "prob": 0.7481929659843445, "type": "xml" }, { "id": 14, "lvl": -1, "conf": 0, "prob": 0.00012001395225524902, "type": "xml" }, { "id": 15, "lvl": -1, "conf": 0, "prob": 0.7481929659843445, "type": "registry" } ], "version": "v18.18", "analyzed_at": "2026-06-29T19:47:47Z" }, "path": "HotChocolate.Types.MongoDb.16.4.0-p.8.nupkg", "raw": { "files": [ { "id": 0, "mol": "O(Al)H(Db)", "sha": "a8385253c92cf3840e1d2fd42a094a87c3decf4bba8a2a4f49ba7ab431342a9e", "path": "HotChocolate.Types.MongoDb.16.4.0-p.8.nupkg", "risk": 3, "size": 58620, "type": "nupkg", "facts": { "metrics": { "file": { "size": 58620.0, "entropy": 7.95, "size_bytes": 58620.0 }, "binary": { "overall_entropy": 7.95, "peak_region_bytes": 55296.0, "peak_region_entropy": 7.83 }, "archive": { "file_count": 15.0, "member_count": 15.0, "script_count": 0.0, "zip_bomb_ratio": 6.45, "directory_count": 0.0, "executable_count": 4.0, "extra_field_size": 0.0, "noise_file_count": 0.0, "total_compressed": 56422.0, "compression.ratio": 0.5, "hidden_file_count": 2.0, "total_uncompressed": 113522.0, "crc_collision_count": 3.0, "entry_comment_count": 0.0, "max_filename_length": 81.0, "rtlo_filename_count": 0.0, "format.regular_count": 15.0, "nested_archive_count": 0.0, "path_traversal_count": 0.0, "symlink_escape_count": 0.0, "security.setgid_count": 0.0, "security.setuid_count": 0.0, "security.sticky_count": 0.0, "double_extension_count": 0.0, "duplicate_member_count": 0.0, "security.symlink_count": 0.0, "unicode_filename_count": 0.0, "homoglyph_filename_count": 0.0, "security.encrypted_count": 0.0, "timing.mtime_unique_count": 2.0, "timing.mtime_unique_ratio": 0.13, "misplaced_executable_count": 4.0, "timing.mtime_outlier_count": 1.0, "timing.mtime_dominant_count": 14.0, "timing.mtime_spread_seconds": 24946.0, "timing.sentinel_mtime_count": 0.0, "security.world_writable_count": 0.0, "timing.mtime_dominant_fraction": 0.93, "compression.method_counts.stored": 1.0, "compression.method_counts.deflate": 14.0 } } }, "ident": { "name": { "value": "HotChocolate.Types.MongoDb", "source": "nupkg.title", "verified": false }, "urls": [ { "url": "https://chillicream.com/", "kind": "homepage", "source": "nupkg.project_url" }, { "url": "https://github.com/ChilliCream/graphql-platform.git", "kind": "repository", "source": "nupkg.repository_url" } ], "trust": "unsigned", "authors": [ { "name": "ChilliCream authors and contributors", "role": "author", "source": "nupkg.authors" } ], "version": { "value": "16.4.0-p.8", "source": "nupkg.version", "verified": false }, "identifier": { "value": "HotChocolate.Types.MongoDb", "source": "nupkg.id", "verified": false } }, "traits": [ { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "from": [ { "file": 5 } ] }, { "id": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "conf": 1.0, "crit": 3, "desc": "JSON polymorphism runtime marker", "from": [ { "file": 5 } ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "from": [ { "file": 5 } ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/data/db/mongodb::mongodb-name-reference", "conf": 0.800000011920929, "crit": 3, "desc": "MongoDB name reference", "from": [ { "file": 5 } ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "from": [ { "file": 5 }, { "file": 7 }, { "file": 9 }, { "file": 11 } ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "from": [ { "file": 5 } ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "from": [ { "file": 5 } ] }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "from": [ { "file": 5 } ], "spans": [ [ 0, 26 ] ] } ] }, { "id": 1, "sha": "35ccc0b4c7c1ab95a544bd3057ad916fe05c4f850e7502a3e9c4d244d06d21cb", "path": "HotChocolate.Types.MongoDb.16.4.0-p.8.nupkg!!_rels/.rels", "size": 516, "type": "xml", "depth": 1 }, { "ctx": [ { "b": "[4ls%kx}3YaA?spB7]MgjT8QkfD}SJzEWP}x(mMDb6w0teJs}sj]", "n": [ { "c": 2, "d": "NuGet nuspec manifest file", "i": "metadata/build/manifest::nuspec-file", "o": 0, "z": 33, "cf": 0.9800000190734863 } ], "ln": 1, "addr": 0 }, { "b": "jAa.syHH\u003c!aB4:tzGv@+xMOuniXJdcv}YB\u003cvrj5rx\u003e8g4B8LVje[n*pfk$ufyHH\u003c\u0026zF7QTfFLvpfF$I3B-RIkv\u003eJ1EwfKh", "ln": 2, "addr": 42 }, { "b": "arS^-wPRu\u003evrt{w", "ln": 3, "addr": 118 }, { "b": "arR^Hjy-qGD2^RixMMB9z/x#xx\u003eIa3aI$92gb7Bxat1ZPA+fr6zGE0*xLzp0x*V]LvqNbUzEUpYfjO{tD2^RixMMA", "ln": 14, "addr": 709 }, { "b": "arR^HjAL1AB3r9mvq])SoDVYox(4Q1lVM:Dz9fE[vp%TB", "ln": 15, "addr": 781 }, { "b": "arR^HjAt1Lz/YSmz/QaCBA}?pjT9ygBvZK-a%q2Gy=@$QBAzFyiXJd0x([3hvLheez7!m\u0026x(4Q1lVM:Dz7/Kxvq][1y+oQxvrua1A=0Bwx(\u003eKwv@Dj3x((GZwht}$wh2]Iv\u003e}L7vMlnSh-iGJgCJDMgg\u0026BNh-Cn7h8O!%vkY\u00260a%nK5", "n": [ { "c": 2, "d": "NuGet package declares repository", "i": "metadata/package/files/nuget::nuspec-repository", "o": 822, "z": 91, "cf": 0.8999999761581421 } ], "ln": 16, "addr": 818 }, { "b": "arR^Hjy\u00262xwO#3\u0026zEWx(B3o", "n": [ { "c": 2, "d": "NuGet package declares dependencies", "i": "metadata/package/files/nuget::nuspec-dependencies", "o": 963, "z": 869, "cf": 0.8999999761581421 } ], "ln": 17, "addr": 959 }, { "b": "arR^HarS^VA=l8taAR4jxjVfOA:-/@Cw?IqjTa=PBtkE4fD@W", "ln": 18, "addr": 978 }, { "b": "arR^HarR^Hjy\u00262xwO#3\u0026zEW@mx\u003efvJnn\u0026PqxM4y0y*?A%e(WanwPG4rC4CYnx(v(La#7#dg+HElA4T9]az2!cy\u0026%o1jT9jnx(4rhl2HaED3T4xB0q.Wj]", "ln": 19, "addr": 1018 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 2612.0, "entropy": 5.03, "size_bytes": 2612.0 }, "binary": { "overall_entropy": 5.03, "peak_region_bytes": 2612.0, "peak_region_entropy": 5.06 } } }, "id": 2, "path": "HotChocolate.Types.MongoDb.16.4.0-p.8.nupkg!!HotChocolate.Types.MongoDb.nuspec", "risk": 1, "sha": "2bd8addb7e7fdaca37e860e4950b2418483db3bb4ddbaf6772ca85edf7b8b971", "size": 2612, "traits": [ { "id": "metadata/package/files/nuget::nuspec-dependencies", "conf": 0.8999999761581421, "crit": 2, "desc": "NuGet package declares dependencies", "spans": [ [ 963, 869 ] ] }, { "id": "metadata/package/files/nuget::nuspec-repository", "conf": 0.8999999761581421, "crit": 2, "desc": "NuGet package declares repository", "spans": [ [ 822, 91 ] ] }, { "id": "metadata/build/manifest::nuspec-file", "conf": 0.9800000190734863, "crit": 2, "desc": "NuGet nuspec manifest file", "spans": [ [ 0, 33 ] ] } ], "type": "xml" }, { "id": 3, "sha": "5f6f7fb421872122ae2c7c395c0e4ed232cb5653b42215106eba532c4001b215", "path": "HotChocolate.Types.MongoDb.16.4.0-p.8.nupkg!!LICENSE", "risk": 1, "size": 1083, "type": "text", "depth": 1 }, { "id": 4, "sha": "e61dd2ec3dbe645faf7479b18258213374a5104455ca72c80213c36b0ecf0fee", "path": "HotChocolate.Types.MongoDb.16.4.0-p.8.nupkg!!hotchocolate-icon.png", "size": 5938, "type": "png", "depth": 1 }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J+", "n": [ { "c": 3, "d": "HTTP fingerprinting evasion campaign", "i": "objectives/command-and-control/infrastructure/user-agent::http-fingerprinting-campaign", "o": 0, "z": 34, "cf": 0.8999999761581421 } ], "ln": 0 }, { "b": "00000000000000000000@z@$000000nb@R\u00260SSx71tfVOZ:e%X0rr9100000-8uTo\u003eL", "n": [ { "c": 1, "d": "PE standard code/data section", "i": "metadata/binary/section/names::pe-code-data-standard-section", "o": 512, "z": 5, "cf": 0.8999999761581421 } ], "ln": 496 }, { "b": "c\u003c6CH1%$/z11joL00T=1lq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn", "n": [ { "c": 3, "d": "Recognized PE anti-analysis marker", "i": "objectives/anti-analysis/debugger-detect/combined-checks::evasion-aware-recognized-pe-marker", "o": 4100, "z": 4, "cf": 1.0 } ], "ln": 4084 }, { "b": "By^77D2Ntoe\u003e{n4xkZgEe[w^m077:BzCCs\u003cyYF9VBydQYwO?ACD2[7sz2!P/B8Mhw", "n": [ { "c": 3, "d": "References Windows executable or script", "i": "objectives/execution/interpreter/script/shell::windows-executable-ref", "o": 9648, "z": 4, "cf": 0.6000000238418579 } ], "ln": 9632 }, { "b": "zE^r@v%HT-ygQ)%x(v\u003e?q*ACawO\u003c4$wOb:\u0026v@#B6zu9vwvp?(BwPzo{z/e0*v}xR3x(v\u003e?xjVf(pHX6Iv/", "n": [ { "c": 2, "d": "Benign high-entropy PE context", "i": "metadata/package/quality/false-positives::benign-high-entropy-pe-context", "o": 9808, "z": 17, "cf": 0.949999988079071 } ], "ln": 9792 }, { "b": "x(v\u003e?wmY*(A+PGmx(v\u003e?o(B]Zz:V]Aluv6.07.3IlUHyFz!@\u003c7wIc}[CYUMgB8L{@q*ACawO\u003c50wQ5qHn][]*07g)BBAIRnnP5cU077:BzD7s!wPI%4zeYFDrc-B]", "n": [ { "c": 3, "d": "MongoDB name reference", "i": "micro-behaviors/data/db/mongodb::mongodb-name-reference", "o": 9932, "z": 7, "cf": 0.800000011920929 }, { "c": 3, "d": "JSON polymorphism runtime marker", "i": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "o": 9968, "z": 16, "cf": 1.0 } ], "ln": 9916 }, { "b": "qE%]/B-H#6o\u003c}{FxjV8-q*ACawO\u003c4!z!9AEz/49]z/6Dcy?mR!ra{q\u003cCsVpYAaK4\u0026luv6.rc-B]o\u003c@0WwPv=HD2vZ", "n": [ { "c": 3, "d": ".NET dynamic code generation capability", "i": "metadata/lang/compiler/managed::dotnet-dynamic-code", "o": 10129, "z": 23, "cf": 0.8500000238418579 } ], "ln": 10113 }, { "b": "\u0026@PhX=DtQ\u00260rr91KPkvYy/tR2By/qwqE%]/B-H#6B1Qv4B8Mhwv}wLHvpS}\u0026efF!Jv@Dy7x\u003c@Ror+lq)x(v(Lg+HEmfFk4gavyo/BAIRnj-j?NBAg/aefE=ivR/:*oj-xFz!\u0026{4jZ{uevkRKLhzEiFg?wv2iu}EFB97#ge(Dn4z/{8gwPGF4B-8qnzdMQRB8Mhwv}wOIBohBx00Ao40000008L%H", "n": [ { "c": 2, "d": "mscorlib reference", "i": "metadata/lang/compiler/managed::mscorlib", "o": 13780, "z": 128, "cf": 0.8999999761581421 } ], "ln": 13764 }, { "b": "00000000000000000000000000000000000000315c8Xg7YTL^00000000000000000", "n": [ { "c": 1, "d": "PE resource section", "i": "metadata/binary/section/names::pe-resource-section", "o": 15360, "z": 5, "cf": 0.8999999761581421 } ], "ln": 15344 }, { "b": "00000000000043xgYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006Xn[brp!0rrl55c8X", "n": [ { "c": 3, "d": "Recognized marker for timing checks", "i": "objectives/anti-analysis/timing/evasion::timing-anti-debug-recognized-marker", "o": 15454, "z": 15, "cf": 0.949999988079071 } ], "ln": 15438 }, { "b": "zVAf9vGlxd002s=5Dz?ilJz38z2!IPve$fBC(QOtve$cAwDhYg002v^xAh-DyYFnKx-HH2ASxU", "n": [ { "c": 2, "d": "PE CompanyName metadata field", "i": "metadata/package/versioning::pe-companyname-field", "o": 15794, "z": 11, "cf": 0.699999988079071 } ], "ln": 15778 }, { "b": "zuaeDe=U\u003eK003s98VP)smGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up002K\u0026zVB\u003eVlJy^1zVBn", "n": [ { "c": 2, "d": "PE FileDescription metadata field", "i": "metadata/package/versioning::pe-filedescription-field", "o": 15862, "z": 15, "cf": 0.699999988079071 } ], "ln": 15846 }, { "b": "zVAf9vGlxd001+O2(\u003c#amGvc5yYF2DrSDXhASydXx-J5Kzu6Up001.NhukufgYPcdfArZ9fAq7M003s99@(rwnDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE002K\u0026zVB\u003eVlJy^1zVBnEzVBON", "n": [ { "c": 3, "d": "Dotted-quad PE version metadata marker", "i": "objectives/command-and-control/infrastructure/ip::ipv4-version-metadata-marker", "o": 15958, "z": 11, "cf": 0.9399999976158142 }, { "c": 2, "d": "PE InternalName metadata field", "i": "metadata/package/versioning::pe-internalname-field", "o": 16010, "z": 12, "cf": 0.699999988079071 } ], "ln": 15942 }, { "b": "z#+d-ASx!Nx8(PBBn#pvlJz38z#+d-ASx!Nx8(PBBo0A-Sq[4vg5%0df-Tfkaoi$[aoluXAS", "n": [ { "c": 2, "d": "Copyright notice", "i": "metadata/package/license::copyright-word", "o": 16136, "z": 9, "cf": 0.6000000238418579 } ], "ln": 16120 }, { "b": "nDrSdv/OaY003Qh9@(rwpxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE002K\u0026zVB\u003eVlJy^1zVBnE", "n": [ { "c": 2, "d": "PE OriginalFilename metadata field", "i": "metadata/package/versioning::pe-originalfilename-field", "o": 16230, "z": 16, "cf": 0.699999988079071 } ], "ln": 16214 }, { "b": "wb{ACyYBCn002aY4GDIfpYLIozVBqFBPt[KBo25ove$cAwDhYg002K\u0026zVB\u003eVaoj+exAh@Jv/QAEyYE(zBo2\u003eL004@TgYNKRpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001.NhukufgYPcdfArW8z#Y", "n": [ { "c": 2, "d": "PE ProductName metadata field", "i": "metadata/package/versioning::pe-productname-field", "o": 16334, "z": 11, "cf": 0.699999988079071 }, { "c": 2, "d": "PE version resource metadata", "i": "metadata/package/versioning::version-resource-metadata", "o": 16394, "z": 14, "cf": 0.8999999761581421 } ], "ln": 16318 }, { "b": "0000000000000000000008JT}3\u0026*ncaufu3000000000000000000000000000000000", "n": [ { "c": 2, "d": "PE .reloc section presence", "i": "metadata/binary/section/names::reloc-section-presence", "o": 16896, "z": 6, "cf": 0.8999999761581421 } ], "ln": 16880 } ], "depth": 1, "facts": { "imp": [ [ "mscoree", "CorDllMain" ] ], "sec": [ [ ".text", 512, 14848, 5.76, "r-x" ], [ ".rsrc", 15360, 1536, 2.83, "r--" ], [ ".reloc", 16896, 512, 0.08, "r--" ] ], "metrics": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "resource_count": 1.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 32209.0, "reloc_overhang_bytes": 500.0, "reloc_overhang_ratio": 0.98, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "version.identity_entropy": 4.27, "clr.managed_resource_count": 1.0, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0, "clr.managed_resource_max_size": 739.0, "version.identity_symbol_ratio": 0.05, "clr.managed_resource_max_entropy": 4.93 }, "file": { "size": 17408.0, "entropy": 5.39, "size_bytes": 17408.0 }, "binary": { "is_pie": 1.0, "code_entropy": 5.76, "string_count": 268.0, "overall_entropy": 5.39, "entropy_variance": 5.37, "avg_string_length": 19.71, "max_string_length": 145.0, "peak_region_bytes": 4096.0, "code_to_data_ratio": 1.0, "peak_region_entropy": 5.56, "string_length_stddev": 17.74, "largest_section_ratio": 0.85, "sentence_string_count": 10.0, "sentence_string_ratio": 0.04, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 14848.0, "entropy_max": 5.76, "entropy_mean": 2.89, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } } }, "id": 5, "mol": "O(Al)H(Db)", "path": "HotChocolate.Types.MongoDb.16.4.0-p.8.nupkg!!lib/net10.0/HotChocolate.Types.MongoDb.dll", "risk": 3, "sha": "e0c0f7bbdecf4a24307829a0f95a9f7578955359479b1f2b5666a222dde82cbe", "size": 17408, "traits": [ { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "spans": [ [ 16394, 14 ] ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "spans": [ [ 9648, 4 ] ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "spans": [ [ 15958, 11 ] ] }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "spans": [ [ 0, 26 ] ] }, { "id": "micro-behaviors/data/db/mongodb::mongodb-name-reference", "conf": 0.800000011920929, "crit": 3, "desc": "MongoDB name reference", "spans": [ [ 9932, 7 ] ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 15454, 15 ] ] }, { "id": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "conf": 1.0, "crit": 3, "desc": "JSON polymorphism runtime marker", "spans": [ [ 9968, 16 ] ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "spans": [ [ 4100, 4 ] ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "spans": [ [ 4100, 4 ] ] } ], "type": "pe" }, { "id": 6, "sha": "8f0221dfa65c7c1a564d9d86de13e0f3d883c12c50bf7595636ef419c679cfaa", "path": "HotChocolate.Types.MongoDb.16.4.0-p.8.nupkg!!lib/net10.0/HotChocolate.Types.MongoDb.xml", "size": 5107, "type": "xml", "depth": 1 }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J+", "n": [ { "c": 3, "d": "HTTP fingerprinting evasion campaign", "i": "objectives/command-and-control/infrastructure/user-agent::http-fingerprinting-campaign", "o": 0, "z": 34, "cf": 0.8999999761581421 } ], "ln": 0 }, { "b": "00000000000000000000@z@$000000nb@R\u00260SSx71tfVOZ:e%X0rr9100000-8uTo\u003eL", "n": [ { "c": 1, "d": "PE standard code/data section", "i": "metadata/binary/section/names::pe-code-data-standard-section", "o": 512, "z": 5, "cf": 0.8999999761581421 } ], "ln": 496 }, { "b": "c\u003c6CH1%$/z11joL00T=1lq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn", "n": [ { "c": 3, "d": "Recognized PE anti-analysis marker", "i": "objectives/anti-analysis/debugger-detect/combined-checks::evasion-aware-recognized-pe-marker", "o": 4100, "z": 4, "cf": 1.0 } ], "ln": 4084 }, { "b": "By^77D2Ntoe\u003e{n4xkZgEe[w^m077:BzCCs\u003cyYF9VBydQYwO?ACD2[7sz2!P/B8Mhw", "n": [ { "c": 3, "d": "References Windows executable or script", "i": "objectives/execution/interpreter/script/shell::windows-executable-ref", "o": 9648, "z": 4, "cf": 0.6000000238418579 } ], "ln": 9632 }, { "b": "zE^r@v%HT-ygQ)%x(v\u003e?q*ACawO\u003c4$wOb:\u0026v@#B6zu9vwvp?(BwPzo{z/e0*v}xR3x(v\u003e?xjVf(pHX6Iv/", "n": [ { "c": 2, "d": "Benign high-entropy PE context", "i": "metadata/package/quality/false-positives::benign-high-entropy-pe-context", "o": 9808, "z": 17, "cf": 0.949999988079071 } ], "ln": 9792 }, { "b": "x(v\u003e?wmY*(A+PGmx(v\u003e?o(B]Zz:V]Aluv6.07.3IlUHyFz!@\u003c7wIc}[CYUMgB8L{@q*ACawO\u003c50wQ5qHn][]*07g)BBAIRnnP5cU077:BzD7s!wPI%4zeYFDrc-B]", "n": [ { "c": 3, "d": "MongoDB name reference", "i": "micro-behaviors/data/db/mongodb::mongodb-name-reference", "o": 9932, "z": 7, "cf": 0.800000011920929 }, { "c": 3, "d": "JSON polymorphism runtime marker", "i": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "o": 9968, "z": 16, "cf": 1.0 } ], "ln": 9916 }, { "b": "qE%]/B-H#6o\u003c}{FxjV8-q*ACawO\u003c4!z!9AEz/49]z/6Dcy?mR!ra{q\u003cCsVpYAaK4\u0026luv6.rc-B]o\u003c@0WwPv=HD2vZ", "n": [ { "c": 3, "d": ".NET dynamic code generation capability", "i": "metadata/lang/compiler/managed::dotnet-dynamic-code", "o": 10129, "z": 23, "cf": 0.8500000238418579 } ], "ln": 10113 }, { "b": "\u0026@PhX=DtQ\u00260rr91KPkvYy/tR2By/qwqE%]/B-H#6B1Qv4B8Mhwv}wLHvpS}\u0026efF!Jv@Dy7x\u003c@Ror+lq)x(v(Lg+HEmfFk4gavyo/BAIRnj-j?NBAg/aefE=ivR/:*oj-xFz!\u0026{4jZ{uevkRKLhzEiFg?wv2iu}EFB97#ge(Dn4z/{8gwPGF4B-8qnzdMQRB8Mhwv}wOIBohBx00Ao40000008L%H", "n": [ { "c": 2, "d": "mscorlib reference", "i": "metadata/lang/compiler/managed::mscorlib", "o": 13780, "z": 128, "cf": 0.8999999761581421 } ], "ln": 13764 }, { "b": "00000000000000000000000000000000000000315c8Xg7YTL^00000000000000000", "n": [ { "c": 1, "d": "PE resource section", "i": "metadata/binary/section/names::pe-resource-section", "o": 15360, "z": 5, "cf": 0.8999999761581421 } ], "ln": 15344 }, { "b": "00000000000043xgYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006Xn[brp!0rrl55c8X", "n": [ { "c": 3, "d": "Recognized marker for timing checks", "i": "objectives/anti-analysis/timing/evasion::timing-anti-debug-recognized-marker", "o": 15454, "z": 15, "cf": 0.949999988079071 } ], "ln": 15438 }, { "b": "zVAf9vGlxd002s=5Dz?ilJz38z2!IPve$fBC(QOtve$cAwDhYg002v^xAh-DyYFnKx-HH2ASxU", "n": [ { "c": 2, "d": "PE CompanyName metadata field", "i": "metadata/package/versioning::pe-companyname-field", "o": 15794, "z": 11, "cf": 0.699999988079071 } ], "ln": 15778 }, { "b": "zuaeDe=U\u003eK003s98VP)smGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up002K\u0026zVB\u003eVlJy^1zVBn", "n": [ { "c": 2, "d": "PE FileDescription metadata field", "i": "metadata/package/versioning::pe-filedescription-field", "o": 15862, "z": 15, "cf": 0.699999988079071 } ], "ln": 15846 }, { "b": "zVAf9vGlxd001+O2(\u003c#amGvc5yYF2DrSDXhASydXx-J5Kzu6Up001.NhukufgYPcdfArZ9fAq7M003s99@(rwnDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE002K\u0026zVB\u003eVlJy^1zVBnEzVBON", "n": [ { "c": 3, "d": "Dotted-quad PE version metadata marker", "i": "objectives/command-and-control/infrastructure/ip::ipv4-version-metadata-marker", "o": 15958, "z": 11, "cf": 0.9399999976158142 }, { "c": 2, "d": "PE InternalName metadata field", "i": "metadata/package/versioning::pe-internalname-field", "o": 16010, "z": 12, "cf": 0.699999988079071 } ], "ln": 15942 }, { "b": "z#+d-ASx!Nx8(PBBn#pvlJz38z#+d-ASx!Nx8(PBBo0A-Sq[4vg5%0df-Tfkaoi$[aoluXAS", "n": [ { "c": 2, "d": "Copyright notice", "i": "metadata/package/license::copyright-word", "o": 16136, "z": 9, "cf": 0.6000000238418579 } ], "ln": 16120 }, { "b": "nDrSdv/OaY003Qh9@(rwpxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE002K\u0026zVB\u003eVlJy^1zVBnE", "n": [ { "c": 2, "d": "PE OriginalFilename metadata field", "i": "metadata/package/versioning::pe-originalfilename-field", "o": 16230, "z": 16, "cf": 0.699999988079071 } ], "ln": 16214 }, { "b": "wb{ACyYBCn002aY4GDIfpYLIozVBqFBPt[KBo25ove$cAwDhYg002K\u0026zVB\u003eVaoj+exAh@Jv/QAEyYE(zBo2\u003eL004@TgYNKRpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001.NhukufgYPcdfArW8z#Y", "n": [ { "c": 2, "d": "PE ProductName metadata field", "i": "metadata/package/versioning::pe-productname-field", "o": 16334, "z": 11, "cf": 0.699999988079071 }, { "c": 2, "d": "PE version resource metadata", "i": "metadata/package/versioning::version-resource-metadata", "o": 16394, "z": 14, "cf": 0.8999999761581421 } ], "ln": 16318 }, { "b": "0000000000000000000008JT}3\u0026*ncaufu3000000000000000000000000000000000", "n": [ { "c": 2, "d": "PE .reloc section presence", "i": "metadata/binary/section/names::reloc-section-presence", "o": 16896, "z": 6, "cf": 0.8999999761581421 } ], "ln": 16880 } ], "depth": 1, "facts": { "imp": [ [ "mscoree", "CorDllMain" ] ], "sec": [ [ ".text", 512, 14848, 5.76, "r-x" ], [ ".rsrc", 15360, 1536, 2.83, "r--" ], [ ".reloc", 16896, 512, 0.08, "r--" ] ], "metrics": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "resource_count": 1.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 49573.0, "reloc_overhang_bytes": 500.0, "reloc_overhang_ratio": 0.98, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "version.identity_entropy": 4.27, "clr.managed_resource_count": 1.0, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0, "clr.managed_resource_max_size": 739.0, "version.identity_symbol_ratio": 0.05, "clr.managed_resource_max_entropy": 4.93 }, "file": { "size": 17408.0, "entropy": 5.39, "size_bytes": 17408.0 }, "binary": { "is_pie": 1.0, "code_entropy": 5.76, "string_count": 268.0, "overall_entropy": 5.39, "entropy_variance": 5.37, "avg_string_length": 19.71, "max_string_length": 145.0, "peak_region_bytes": 4096.0, "code_to_data_ratio": 1.0, "peak_region_entropy": 5.56, "string_length_stddev": 17.74, "largest_section_ratio": 0.85, "sentence_string_count": 10.0, "sentence_string_ratio": 0.04, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 14848.0, "entropy_max": 5.76, "entropy_mean": 2.89, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } } }, "id": 7, "mol": "O(Al)H(Db)", "path": "HotChocolate.Types.MongoDb.16.4.0-p.8.nupkg!!lib/net11.0/HotChocolate.Types.MongoDb.dll", "risk": 3, "sha": "89f257342223aea2f31c3b186cb62e77265557c51bb919721d5415971c81f42b", "size": 17408, "traits": [ { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "spans": [ [ 16394, 14 ] ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "spans": [ [ 9648, 4 ] ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "spans": [ [ 15958, 11 ] ] }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "spans": [ [ 0, 26 ] ] }, { "id": "micro-behaviors/data/db/mongodb::mongodb-name-reference", "conf": 0.800000011920929, "crit": 3, "desc": "MongoDB name reference", "spans": [ [ 9932, 7 ] ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 15454, 15 ] ] }, { "id": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "conf": 1.0, "crit": 3, "desc": "JSON polymorphism runtime marker", "spans": [ [ 9968, 16 ] ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "spans": [ [ 4100, 4 ] ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "spans": [ [ 4100, 4 ] ] } ], "type": "pe" }, { "id": 8, "sha": "8f0221dfa65c7c1a564d9d86de13e0f3d883c12c50bf7595636ef419c679cfaa", "path": "HotChocolate.Types.MongoDb.16.4.0-p.8.nupkg!!lib/net11.0/HotChocolate.Types.MongoDb.xml", "size": 5107, "type": "xml", "depth": 1 }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J+", "n": [ { "c": 3, "d": "HTTP fingerprinting evasion campaign", "i": "objectives/command-and-control/infrastructure/user-agent::http-fingerprinting-campaign", "o": 0, "z": 34, "cf": 0.8999999761581421 } ], "ln": 0 }, { "b": "00000000000000000000/Je4M00000nb@R\u00260SSx71tfVOOfXdn0rr9100000PI\u003e*\u003c\u003eL", "n": [ { "c": 1, "d": "PE standard code/data section", "i": "metadata/binary/section/names::pe-code-data-standard-section", "o": 512, "z": 5, "cf": 0.8999999761581421 } ], "ln": 496 }, { "b": "c\u003c6CH1%$/z11joL00T=1lq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn", "n": [ { "c": 3, "d": "Recognized PE anti-analysis marker", "i": "objectives/anti-analysis/debugger-detect/combined-checks::evasion-aware-recognized-pe-marker", "o": 4100, "z": 4, "cf": 1.0 } ], "ln": 4084 }, { "b": "By^77D2Ntoe\u003e{n4xkZgEe[w^m077:BzCCs\u003cyYF9VBydQYwO?ACD2[7sz2!P/B8Mhw", "n": [ { "c": 3, "d": "References Windows executable or script", "i": "objectives/execution/interpreter/script/shell::windows-executable-ref", "o": 9640, "z": 4, "cf": 0.6000000238418579 } ], "ln": 9624 }, { "b": "zE^r@v%HT-ygQ)%x(v\u003e?q*ACawO\u003c4$wOb:\u0026v@#B6zu9vwvp?(BwPzo{z/e0*v}xR3x(v\u003e?xjVf(pHX6Iv/", "n": [ { "c": 2, "d": "Benign high-entropy PE context", "i": "metadata/package/quality/false-positives::benign-high-entropy-pe-context", "o": 9800, "z": 17, "cf": 0.949999988079071 } ], "ln": 9784 }, { "b": "x(v\u003e?wmY*(A+PGmx(v\u003e?o(B]Zz:V]Aluv6.07.3IlUHyFz!@\u003c7wIc}[CYUMgB8L{@q*ACawO\u003c50wQ5qHn][]*07g)BBAIRnnP5cU077:BzD7s!wPI%4zeYFDrc-B]", "n": [ { "c": 3, "d": "MongoDB name reference", "i": "micro-behaviors/data/db/mongodb::mongodb-name-reference", "o": 9924, "z": 7, "cf": 0.800000011920929 }, { "c": 3, "d": "JSON polymorphism runtime marker", "i": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "o": 9960, "z": 16, "cf": 1.0 } ], "ln": 9908 }, { "b": "qE%]/B-H#6o\u003c}{FxjV8-q*ACawO\u003c4!z!9AEz/49]z/6Dcy?mR!ra{q\u003cCsVpYAaK4\u0026luv6.rc-B]o\u003c@0WwPv=HD2vZ", "n": [ { "c": 3, "d": ".NET dynamic code generation capability", "i": "metadata/lang/compiler/managed::dotnet-dynamic-code", "o": 10121, "z": 23, "cf": 0.8500000238418579 } ], "ln": 10105 }, { "b": "\u0026@PhX=DtQ\u00260rr91KPkvYy/tR2By/qwqE%]/B-H#6B1Qv4B8Mhwv}wLHvpS}\u0026efF!Jv@Dy7x\u003c@Ror+lq)x(v(Lg+HEmfFk4gavyo/BAIRnj-j?NBAg/aefE=ivR/:*oj-xFz!\u0026{4jZ{uevkRKLhzEiFg?wv2iu}EFB97#ge(Dn4z/{8gwPGF4B-8qnzdMQRB8Mhwv}wOIBohBx00Ao40000008L%H", "n": [ { "c": 2, "d": "mscorlib reference", "i": "metadata/lang/compiler/managed::mscorlib", "o": 13744, "z": 128, "cf": 0.8999999761581421 } ], "ln": 13728 }, { "b": "yYBCn0093B03zmM00000000000000000000000315c8Xg7YTL^00000000000000000", "n": [ { "c": 1, "d": "PE resource section", "i": "metadata/binary/section/names::pe-resource-section", "o": 14848, "z": 5, "cf": 0.8999999761581421 } ], "ln": 14832 }, { "b": "00000000000043xgYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006Xn[brp!0rrl55c8X", "n": [ { "c": 3, "d": "Recognized marker for timing checks", "i": "objectives/anti-analysis/timing/evasion::timing-anti-debug-recognized-marker", "o": 14942, "z": 15, "cf": 0.949999988079071 } ], "ln": 14926 }, { "b": "zVAf9vGlxd002s=5Dz?ilJz38z2!IPve$fBC(QOtve$cAwDhYg002v^xAh-DyYFnKx-HH2ASxU", "n": [ { "c": 2, "d": "PE CompanyName metadata field", "i": "metadata/package/versioning::pe-companyname-field", "o": 15282, "z": 11, "cf": 0.699999988079071 } ], "ln": 15266 }, { "b": "zuaeDe=U\u003eK003s98VP)smGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up002K\u0026zVB\u003eVlJy^1zVBn", "n": [ { "c": 2, "d": "PE FileDescription metadata field", "i": "metadata/package/versioning::pe-filedescription-field", "o": 15350, "z": 15, "cf": 0.699999988079071 } ], "ln": 15334 }, { "b": "zVAf9vGlxd001+O2(\u003c#amGvc5yYF2DrSDXhASydXx-J5Kzu6Up001.NhukufgYPcdfArZ9fAq7M003s99@(rwnDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE002K\u0026zVB\u003eVlJy^1zVBnEzVBON", "n": [ { "c": 3, "d": "Dotted-quad PE version metadata marker", "i": "objectives/command-and-control/infrastructure/ip::ipv4-version-metadata-marker", "o": 15446, "z": 11, "cf": 0.9399999976158142 }, { "c": 2, "d": "PE InternalName metadata field", "i": "metadata/package/versioning::pe-internalname-field", "o": 15498, "z": 12, "cf": 0.699999988079071 } ], "ln": 15430 }, { "b": "z#+d-ASx!Nx8(PBBn#pvlJz38z#+d-ASx!Nx8(PBBo0A-Sq[4vg5%0df-Tfkaoi$[aoluXAS", "n": [ { "c": 2, "d": "Copyright notice", "i": "metadata/package/license::copyright-word", "o": 15624, "z": 9, "cf": 0.6000000238418579 } ], "ln": 15608 }, { "b": "nDrSdv/OaY003Qh9@(rwpxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE002K\u0026zVB\u003eVlJy^1zVBnE", "n": [ { "c": 2, "d": "PE OriginalFilename metadata field", "i": "metadata/package/versioning::pe-originalfilename-field", "o": 15718, "z": 16, "cf": 0.699999988079071 } ], "ln": 15702 }, { "b": "wb{ACyYBCn002aY4GDIfpYLIozVBqFBPt[KBo25ove$cAwDhYg002K\u0026zVB\u003eVaoj+exAh@Jv/QAEyYE(zBo2\u003eL004@TgYNKRpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001.NhukufgYPcdfArW8z#Y", "n": [ { "c": 2, "d": "PE ProductName metadata field", "i": "metadata/package/versioning::pe-productname-field", "o": 15822, "z": 11, "cf": 0.699999988079071 }, { "c": 2, "d": "PE version resource metadata", "i": "metadata/package/versioning::version-resource-metadata", "o": 15882, "z": 14, "cf": 0.8999999761581421 } ], "ln": 15806 }, { "b": "0000000000000000000008JT}3\u0026*nc{+@fM000000000000000000000000000000000", "n": [ { "c": 2, "d": "PE .reloc section presence", "i": "metadata/binary/section/names::reloc-section-presence", "o": 16384, "z": 6, "cf": 0.8999999761581421 } ], "ln": 16368 } ], "depth": 1, "facts": { "imp": [ [ "mscoree", "CorDllMain" ] ], "sec": [ [ ".text", 512, 14336, 5.88, "r-x" ], [ ".rsrc", 14848, 1536, 2.83, "r--" ], [ ".reloc", 16384, 512, 0.08, "r--" ] ], "metrics": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "resource_count": 1.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 28409.0, "reloc_overhang_bytes": 500.0, "reloc_overhang_ratio": 0.98, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "version.identity_entropy": 4.27, "clr.managed_resource_count": 1.0, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0, "clr.managed_resource_max_size": 739.0, "version.identity_symbol_ratio": 0.05, "clr.managed_resource_max_entropy": 4.93 }, "file": { "size": 16896.0, "entropy": 5.49, "size_bytes": 16896.0 }, "binary": { "is_pie": 1.0, "code_entropy": 5.88, "string_count": 268.0, "overall_entropy": 5.49, "entropy_variance": 5.61, "avg_string_length": 19.64, "max_string_length": 145.0, "peak_region_bytes": 4096.0, "code_to_data_ratio": 1.0, "peak_region_entropy": 5.54, "string_length_stddev": 17.71, "largest_section_ratio": 0.85, "sentence_string_count": 10.0, "sentence_string_ratio": 0.04, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 14336.0, "entropy_max": 5.88, "entropy_mean": 2.93, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } } }, "id": 9, "mol": "O(Al)H(Db)", "path": "HotChocolate.Types.MongoDb.16.4.0-p.8.nupkg!!lib/net8.0/HotChocolate.Types.MongoDb.dll", "risk": 3, "sha": "95aa1f15fbbc80080d4bb197f415105224f8344d73e6b2ef97742a0f66ae4fe6", "size": 16896, "traits": [ { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "spans": [ [ 15882, 14 ] ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "spans": [ [ 9640, 4 ] ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "spans": [ [ 15446, 11 ] ] }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "spans": [ [ 0, 26 ] ] }, { "id": "micro-behaviors/data/db/mongodb::mongodb-name-reference", "conf": 0.800000011920929, "crit": 3, "desc": "MongoDB name reference", "spans": [ [ 9924, 7 ] ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 14942, 15 ] ] }, { "id": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "conf": 1.0, "crit": 3, "desc": "JSON polymorphism runtime marker", "spans": [ [ 9960, 16 ] ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "spans": [ [ 4100, 4 ] ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "spans": [ [ 4100, 4 ] ] } ], "type": "pe" }, { "id": 10, "sha": "8f0221dfa65c7c1a564d9d86de13e0f3d883c12c50bf7595636ef419c679cfaa", "path": "HotChocolate.Types.MongoDb.16.4.0-p.8.nupkg!!lib/net8.0/HotChocolate.Types.MongoDb.xml", "size": 5107, "type": "xml", "depth": 1 }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J+", "n": [ { "c": 3, "d": "HTTP fingerprinting evasion campaign", "i": "objectives/command-and-control/infrastructure/user-agent::http-fingerprinting-campaign", "o": 0, "z": 34, "cf": 0.8999999761581421 } ], "ln": 0 }, { "b": "00000000000000000000/Je4M00000nb@R\u00260SSx71tfVOOfXdn0rr9100000PI\u003e*\u003c\u003eL", "n": [ { "c": 1, "d": "PE standard code/data section", "i": "metadata/binary/section/names::pe-code-data-standard-section", "o": 512, "z": 5, "cf": 0.8999999761581421 } ], "ln": 496 }, { "b": "c\u003c6CH1%$/z11joL00T=1lq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn", "n": [ { "c": 3, "d": "Recognized PE anti-analysis marker", "i": "objectives/anti-analysis/debugger-detect/combined-checks::evasion-aware-recognized-pe-marker", "o": 4100, "z": 4, "cf": 1.0 } ], "ln": 4084 }, { "b": "By^77D2Ntoe\u003e{n4xkZgEe[w^m077:BzCCs\u003cyYF9VBydQYwO?ACD2[7sz2!P/B8Mhw", "n": [ { "c": 3, "d": "References Windows executable or script", "i": "objectives/execution/interpreter/script/shell::windows-executable-ref", "o": 9640, "z": 4, "cf": 0.6000000238418579 } ], "ln": 9624 }, { "b": "zE^r@v%HT-ygQ)%x(v\u003e?q*ACawO\u003c4$wOb:\u0026v@#B6zu9vwvp?(BwPzo{z/e0*v}xR3x(v\u003e?xjVf(pHX6Iv/", "n": [ { "c": 2, "d": "Benign high-entropy PE context", "i": "metadata/package/quality/false-positives::benign-high-entropy-pe-context", "o": 9800, "z": 17, "cf": 0.949999988079071 } ], "ln": 9784 }, { "b": "x(v\u003e?wmY*(A+PGmx(v\u003e?o(B]Zz:V]Aluv6.07.3IlUHyFz!@\u003c7wIc}[CYUMgB8L{@q*ACawO\u003c50wQ5qHn][]*07g)BBAIRnnP5cU077:BzD7s!wPI%4zeYFDrc-B]", "n": [ { "c": 3, "d": "MongoDB name reference", "i": "micro-behaviors/data/db/mongodb::mongodb-name-reference", "o": 9924, "z": 7, "cf": 0.800000011920929 }, { "c": 3, "d": "JSON polymorphism runtime marker", "i": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "o": 9960, "z": 16, "cf": 1.0 } ], "ln": 9908 }, { "b": "qE%]/B-H#6o\u003c}{FxjV8-q*ACawO\u003c4!z!9AEz/49]z/6Dcy?mR!ra{q\u003cCsVpYAaK4\u0026luv6.rc-B]o\u003c@0WwPv=HD2vZ", "n": [ { "c": 3, "d": ".NET dynamic code generation capability", "i": "metadata/lang/compiler/managed::dotnet-dynamic-code", "o": 10121, "z": 23, "cf": 0.8500000238418579 } ], "ln": 10105 }, { "b": "\u0026@PhX=DtQ\u00260rr91KPkvYy/tR2By/qwqE%]/B-H#6B1Qv4B8Mhwv}wLHvpS}\u0026efF!Jv@Dy7x\u003c@Ror+lq)x(v(Lg+HEmfFk4gavyo/BAIRnj-j?NBAg/aefE=ivR/:*oj-xFz!\u0026{4jZ{uevkRKLhzEiFg?wv2iu}EFB97#ge(Dn4z/{8gwPGF4B-8qnzdMQRB8Mhwv}wOIBohBx00Ao40000008L%H", "n": [ { "c": 2, "d": "mscorlib reference", "i": "metadata/lang/compiler/managed::mscorlib", "o": 13744, "z": 128, "cf": 0.8999999761581421 } ], "ln": 13728 }, { "b": "yYBCn0093B03zmM00000000000000000000000315c8Xg7YTL^00000000000000000", "n": [ { "c": 1, "d": "PE resource section", "i": "metadata/binary/section/names::pe-resource-section", "o": 14848, "z": 5, "cf": 0.8999999761581421 } ], "ln": 14832 }, { "b": "00000000000043xgYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006Xn[brp!0rrl55c8X", "n": [ { "c": 3, "d": "Recognized marker for timing checks", "i": "objectives/anti-analysis/timing/evasion::timing-anti-debug-recognized-marker", "o": 14942, "z": 15, "cf": 0.949999988079071 } ], "ln": 14926 }, { "b": "zVAf9vGlxd002s=5Dz?ilJz38z2!IPve$fBC(QOtve$cAwDhYg002v^xAh-DyYFnKx-HH2ASxU", "n": [ { "c": 2, "d": "PE CompanyName metadata field", "i": "metadata/package/versioning::pe-companyname-field", "o": 15282, "z": 11, "cf": 0.699999988079071 } ], "ln": 15266 }, { "b": "zuaeDe=U\u003eK003s98VP)smGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up002K\u0026zVB\u003eVlJy^1zVBn", "n": [ { "c": 2, "d": "PE FileDescription metadata field", "i": "metadata/package/versioning::pe-filedescription-field", "o": 15350, "z": 15, "cf": 0.699999988079071 } ], "ln": 15334 }, { "b": "zVAf9vGlxd001+O2(\u003c#amGvc5yYF2DrSDXhASydXx-J5Kzu6Up001.NhukufgYPcdfArZ9fAq7M003s99@(rwnDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE002K\u0026zVB\u003eVlJy^1zVBnEzVBON", "n": [ { "c": 3, "d": "Dotted-quad PE version metadata marker", "i": "objectives/command-and-control/infrastructure/ip::ipv4-version-metadata-marker", "o": 15446, "z": 11, "cf": 0.9399999976158142 }, { "c": 2, "d": "PE InternalName metadata field", "i": "metadata/package/versioning::pe-internalname-field", "o": 15498, "z": 12, "cf": 0.699999988079071 } ], "ln": 15430 }, { "b": "z#+d-ASx!Nx8(PBBn#pvlJz38z#+d-ASx!Nx8(PBBo0A-Sq[4vg5%0df-Tfkaoi$[aoluXAS", "n": [ { "c": 2, "d": "Copyright notice", "i": "metadata/package/license::copyright-word", "o": 15624, "z": 9, "cf": 0.6000000238418579 } ], "ln": 15608 }, { "b": "nDrSdv/OaY003Qh9@(rwpxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE002K\u0026zVB\u003eVlJy^1zVBnE", "n": [ { "c": 2, "d": "PE OriginalFilename metadata field", "i": "metadata/package/versioning::pe-originalfilename-field", "o": 15718, "z": 16, "cf": 0.699999988079071 } ], "ln": 15702 }, { "b": "wb{ACyYBCn002aY4GDIfpYLIozVBqFBPt[KBo25ove$cAwDhYg002K\u0026zVB\u003eVaoj+exAh@Jv/QAEyYE(zBo2\u003eL004@TgYNKRpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001.NhukufgYPcdfArW8z#Y", "n": [ { "c": 2, "d": "PE ProductName metadata field", "i": "metadata/package/versioning::pe-productname-field", "o": 15822, "z": 11, "cf": 0.699999988079071 }, { "c": 2, "d": "PE version resource metadata", "i": "metadata/package/versioning::version-resource-metadata", "o": 15882, "z": 14, "cf": 0.8999999761581421 } ], "ln": 15806 }, { "b": "0000000000000000000008JT}3\u0026*nc{+@fM000000000000000000000000000000000", "n": [ { "c": 2, "d": "PE .reloc section presence", "i": "metadata/binary/section/names::reloc-section-presence", "o": 16384, "z": 6, "cf": 0.8999999761581421 } ], "ln": 16368 } ], "depth": 1, "facts": { "imp": [ [ "mscoree", "CorDllMain" ] ], "sec": [ [ ".text", 512, 14336, 5.88, "r-x" ], [ ".rsrc", 14848, 1536, 2.83, "r--" ], [ ".reloc", 16384, 512, 0.08, "r--" ] ], "metrics": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "resource_count": 1.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 64562.0, "reloc_overhang_bytes": 500.0, "reloc_overhang_ratio": 0.98, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "version.identity_entropy": 4.27, "clr.managed_resource_count": 1.0, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0, "clr.managed_resource_max_size": 739.0, "version.identity_symbol_ratio": 0.05, "clr.managed_resource_max_entropy": 4.93 }, "file": { "size": 16896.0, "entropy": 5.49, "size_bytes": 16896.0 }, "binary": { "is_pie": 1.0, "code_entropy": 5.88, "string_count": 268.0, "overall_entropy": 5.49, "entropy_variance": 5.61, "avg_string_length": 19.64, "max_string_length": 145.0, "peak_region_bytes": 4096.0, "code_to_data_ratio": 1.0, "peak_region_entropy": 5.54, "string_length_stddev": 17.71, "largest_section_ratio": 0.85, "sentence_string_count": 10.0, "sentence_string_ratio": 0.04, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 14336.0, "entropy_max": 5.88, "entropy_mean": 2.93, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } } }, "id": 11, "mol": "O(Al)H(Db)", "path": "HotChocolate.Types.MongoDb.16.4.0-p.8.nupkg!!lib/net9.0/HotChocolate.Types.MongoDb.dll", "risk": 3, "sha": "bad6cc10c6dd0d83c91a1dfd96327bc7b96f9670435d87847da1190b94dbbdc5", "size": 16896, "traits": [ { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "spans": [ [ 15882, 14 ] ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "spans": [ [ 9640, 4 ] ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "spans": [ [ 15446, 11 ] ] }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "spans": [ [ 0, 26 ] ] }, { "id": "micro-behaviors/data/db/mongodb::mongodb-name-reference", "conf": 0.800000011920929, "crit": 3, "desc": "MongoDB name reference", "spans": [ [ 9924, 7 ] ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 14942, 15 ] ] }, { "id": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "conf": 1.0, "crit": 3, "desc": "JSON polymorphism runtime marker", "spans": [ [ 9960, 16 ] ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "spans": [ [ 4100, 4 ] ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "spans": [ [ 4100, 4 ] ] } ], "type": "pe" }, { "id": 12, "sha": "8f0221dfa65c7c1a564d9d86de13e0f3d883c12c50bf7595636ef419c679cfaa", "path": "HotChocolate.Types.MongoDb.16.4.0-p.8.nupkg!!lib/net9.0/HotChocolate.Types.MongoDb.xml", "size": 5107, "type": "xml", "depth": 1 }, { "id": 13, "sha": "afeb9584632638a4fd4b2f37aa41f4260475fb65f3200e6cf67c9ddaaf9d48bd", "path": "HotChocolate.Types.MongoDb.16.4.0-p.8.nupkg!![Content_Types].xml", "size": 650, "type": "xml", "depth": 1 }, { "id": 14, "sha": "9492f7429599b3c30e431f8b93f7892632f6de3bf62271d3f18fab4a215bcda5", "path": "HotChocolate.Types.MongoDb.16.4.0-p.8.nupkg!!package/services/metadata/core-properties/DC0E92291BFD2436FC59CD8D69960331.psmdcp", "size": 701, "type": "xml", "depth": 1 }, { "id": 15, "sha": "8dfc5967930f70b60014bb4269d361eb573810d04a795bede46e8fb7b01d39ab", "path": "HotChocolate.Types.MongoDb@16.4.0-p.8.registry.json", "size": 843, "type": "registry", "depth": 1 } ], "omitted_files": 10, "rev": "46112", "v": "8" } }