{ "llm": { "conf": 0.82311934, "grade": "benign", "model": "Qwen/Qwen3.6-27B", "outcome": "benign", "interpretation": "Standard .NET API library" }, "ml": { "v": "7", "eng": "2.2.0", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.7473133, "rte": "az", "prob": 0.7473133 }, { "cls": 0, "raw": 0.22333097, "rte": "az/nupkg", "prob": 0.22333097 } ], "prob": 0.7473133, "skip": [ { "rte": "az/zip", "why": "unavailable" }, { "rte": "az/zip", "why": "unavailable" } ], "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.7473133206367493, "type": "nupkg" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.00012001395225524902, "type": "xml" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.010053783655166626, "type": "xml" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.00006663799285888672, "type": "png" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.009284406900405884, "type": "markdown" }, { "id": 5, "lvl": -1, "conf": 0, "prob": 0.1600397825241089, "type": "pe" }, { "id": 6, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "xml" }, { "id": 7, "lvl": -1, "conf": 0, "prob": 0.00014418363571166992, "type": "xml" }, { "id": 8, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "registry" } ], "version": "v18.18", "analyzed_at": "2026-07-07T05:25:50Z" }, "path": "SolTechnology.Core.Api.1.0.0.nupkg", "raw": { "files": [ { "id": 0, "mol": "O(Al)H₂(CmDb)", "sha": "adcd8d02b75a8323ccb5656eb8cbebdd12dd84412f0f555d6087eab750551de6", "path": "SolTechnology.Core.Api.1.0.0.nupkg", "risk": 4, "size": 180097, "type": "nupkg", "facts": { "metrics": { "file": { "size": 180097.0, "entropy": 7.99, "size_bytes": 180097.0 }, "binary": { "overall_entropy": 7.99, "peak_region_bytes": 176128.0, "peak_region_entropy": 7.84 }, "archive": { "file_count": 8.0, "member_count": 8.0, "script_count": 0.0, "zip_bomb_ratio": 2.65, "directory_count": 0.0, "executable_count": 1.0, "extra_field_size": 0.0, "noise_file_count": 0.0, "total_compressed": 179019.0, "compression.ratio": 0.85, "hidden_file_count": 2.0, "total_uncompressed": 209772.0, "crc_collision_count": 0.0, "entry_comment_count": 0.0, "max_filename_length": 81.0, "rtlo_filename_count": 0.0, "format.regular_count": 8.0, "nested_archive_count": 0.0, "path_traversal_count": 0.0, "symlink_escape_count": 0.0, "security.setgid_count": 0.0, "security.setuid_count": 0.0, "security.sticky_count": 0.0, "double_extension_count": 0.0, "duplicate_member_count": 0.0, "security.symlink_count": 0.0, "unicode_filename_count": 0.0, "homoglyph_filename_count": 0.0, "security.encrypted_count": 0.0, "timing.mtime_unique_count": 3.0, "timing.mtime_unique_ratio": 0.38, "misplaced_executable_count": 1.0, "timing.mtime_outlier_count": 3.0, "timing.mtime_dominant_count": 5.0, "timing.mtime_spread_seconds": 25132.0, "timing.sentinel_mtime_count": 0.0, "security.world_writable_count": 0.0, "timing.mtime_dominant_fraction": 0.63, "compression.method_counts.stored": 1.0, "compression.method_counts.deflate": 7.0 } } }, "ident": { "name": { "value": "SolTechnology.Core API", "source": "nupkg.title", "verified": false }, "urls": [ { "url": "https://github.com/AdrianStrugala/SolTechnology.Core", "kind": "homepage", "source": "nupkg.project_url" }, { "url": "https://github.com/AdrianStrugala/SolTechnology.Core", "kind": "repository", "source": "nupkg.repository_url" } ], "trust": "unsigned", "authors": [ { "name": "Adrian Strugala", "role": "author", "source": "nupkg.authors" } ], "version": { "value": "1.0.0", "source": "nupkg.version", "verified": false }, "identifier": { "value": "SolTechnology.Core.Api", "source": "nupkg.id", "verified": false } }, "traits": [ { "id": "metadata/package/versioning::version-word-lower", "conf": 0.4000000059604645, "crit": 2, "desc": "version word (lowercase)", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/communications/http/server/managed::http-response-get", "conf": 1.0, "crit": 3, "desc": "Access to ASP.NET Response object", "from": [ { "file": 5 } ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/communications/http/server/managed::http-item-setter", "conf": 1.0, "crit": 1, "desc": "Modification of HTTP context items", "from": [ { "file": 5 } ] }, { "id": "metadata/package/versioning::version-upper", "crit": 2, "desc": "VERSION word (uppercase)", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/communications/http/server/managed::http-context-item-setter", "conf": 0.8500000238418579, "crit": 3, "desc": "Modification of HTTP context items", "from": [ { "off": 20477, "file": 5 } ] }, { "id": "micro-behaviors/communications/http/server/managed::http-request-get", "conf": 1.0, "crit": 3, "desc": "Access to ASP.NET Request object", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/communications/http/server/managed::http-context", "conf": 1.0, "crit": 3, "desc": "Access to ASP.NET HttpContext", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "from": [ { "file": 5 } ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "from": [ { "file": 5 } ] }, { "id": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "conf": 1.0, "crit": 3, "desc": "JSON polymorphism runtime marker", "from": [ { "file": 5 } ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "from": [ { "file": 5 } ] }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/data/db/linq::linq-queries", "conf": 0.699999988079071, "crit": 3, "desc": "LINQ query operations", "from": [ { "file": 5 } ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "from": [ { "file": 5 } ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "from": [ { "file": 5 } ] } ] }, { "depth": 1, "facts": { "metrics": { "file": { "size": 512.0, "entropy": 5.21, "size_bytes": 512.0 }, "binary": { "overall_entropy": 5.21, "peak_region_bytes": 512.0, "peak_region_entropy": 5.21 } } }, "id": 1, "path": "SolTechnology.Core.Api.1.0.0.nupkg!!_rels/.rels", "sha": "3bc78bf08a3150ce7fbfb4d56bdcd6140b0aaf8e6f240fd76e813405428064a8", "size": 512, "type": "xml" }, { "ctx": [ { "b": "[4ls%kx}3YaA?spB7]MgjT8QkfD}SJzEWP}x(mMDb6w0teJs}sj]", "n": [ { "c": 2, "d": "NuGet nuspec manifest file", "i": "metadata/build/manifest::nuspec-file", "o": 0, "z": 29, "cf": 0.9800000190734863 } ], "ln": 1, "addr": 0 }, { "b": "jAa.syHH\u003c!aB4:tzGv@+xMOuniXJdcv}YB\u003cvrj5rx\u003e8g4B8LVje[n*pfk$ufyHH\u003c\u0026zF7QTfFLvpfF$I3B-RIkv\u003eJ1EwfKh", "ln": 2, "addr": 42 }, { "b": "arS^-wPRu\u003evrt{w", "ln": 3, "addr": 118 }, { "b": "arR^Hjy-qGD2^RixMMCPSur@IgbZmNz!{K}wN/y\u003ez!%u8C%0-\u0026z/x#xx\u003eIa3j]", "ln": 14, "addr": 929 }, { "b": "arR^HjAL1AB3sU-y\u0026\u003ck#xL}:8z!Btrv@Dy0ayPk6ayPtgzE){1z/PziCv+k(Aa{CnwPI@ov@DmbA=k=gwPz\u0026mze0J\u003ey?m*0A+cw9x(4)5A=SvxA=kA6wO\u003e%?Byw)1B0bHnv(Dw3hZ0oPA=U@kzFs03ayPk6eP$YCB7]Mgx(mMaB9z59xjV9az/xo9vq]{6wn=NcwPP58B7/05A6b^}vp%TB", "ln": 15, "addr": 979 }, { "b": "arR^HjAt1Lz/YSmz/QaCBA}?pjTaJMBrR\u0026IA+)(.xMOunB2\u003e%cxk8E3BZ=$kz/4c[wo8x)zC$T$B.tc0vj$L$y/B$QxL}:8z!BtFlVm0Ra%punvqYN*jTa]Tw]/RswNPa\u003cfkUcsBy/Fpay/tbze18Pa#:axi5iALiwAi$gC-S0g=WMQh-S(Qh8O(Qwhk@Lvk6I#vpqfdg:j4}j]", "n": [ { "c": 2, "d": "NuGet package declares repository", "i": "metadata/package/files/nuget::nuspec-repository", "o": 1156, "z": 116, "cf": 0.8999999761581421 } ], "ln": 16, "addr": 1152 }, { "b": "arR^Hjy\u00262xwO#3\u0026zEWx(B3o", "n": [ { "c": 2, "d": "NuGet package declares dependencies", "i": "metadata/package/files/nuget::nuspec-dependencies", "o": 1322, "z": 871, "cf": 0.8999999761581421 } ], "ln": 17, "addr": 1318 }, { "b": "arR^HarS^VA=l8taAR4jxjVfOA:-/@Cw?IqjTa=PBtkE4fD@W", "ln": 18, "addr": 1337 }, { "b": "arR^HarR^Hjy\u00262xwO#3\u0026zEW@mx\u003efvJq/uFKwN/y\u003ez!%u8C}IE5A+c\u003c%z!AY%zF7doC4CYnx(v(La#7Y9e?!E(wQ4Z3B.25Db0{A^y?b7.zEEvbDs.bra%nK5", "ln": 19, "addr": 1377 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 2542.0, "entropy": 5.08, "size_bytes": 2542.0 }, "binary": { "overall_entropy": 5.08, "peak_region_bytes": 2542.0, "peak_region_entropy": 5.03 } } }, "id": 2, "path": "SolTechnology.Core.Api.1.0.0.nupkg!!SolTechnology.Core.Api.nuspec", "risk": 1, "sha": "54e8543a828f515cef602a9294b8db920d024a0d426f7f5babdb072c9297a08e", "size": 2542, "traits": [ { "id": "metadata/build/manifest::nuspec-file", "conf": 0.9800000190734863, "crit": 2, "desc": "NuGet nuspec manifest file", "spans": [ [ 0, 29 ] ] }, { "id": "metadata/package/files/nuget::nuspec-repository", "conf": 0.8999999761581421, "crit": 2, "desc": "NuGet package declares repository", "spans": [ [ 1156, 116 ] ] }, { "id": "metadata/package/files/nuget::nuspec-dependencies", "conf": 0.8999999761581421, "crit": 2, "desc": "NuGet package declares dependencies", "spans": [ [ 1322, 871 ] ] } ], "type": "xml" }, { "depth": 1, "facts": { "metrics": { "png": { "a_entropy": 1.63, "chunk_count": 38.0, "trailing_bytes": 0.0, "idat_chunk_count": 36.0, "text_chunk_bytes": 0.0, "chunks_after_iend": 0.0, "compression_ratio": 0.26, "unknown_chunk_count": 0.0 }, "file": { "size": 143205.0, "entropy": 7.99, "size_bytes": 143205.0 }, "image": { "width": 370.0, "height": 369.0, "channels": 4.0, "b_entropy": 3.12, "g_entropy": 3.08, "r_entropy": 3.16, "edge_density": 0.04, "pixel_entropy": 3.25, "histogram_flatness": 0.41 }, "binary": { "overall_entropy": 7.99, "peak_region_bytes": 143205.0, "peak_region_entropy": 7.83 } } }, "id": 3, "path": "SolTechnology.Core.Api.1.0.0.nupkg!!docs/mini-logo.png", "sha": "2e1f8280cb4993bed3e5c280ab1212a028bcb9b03f79a637e7366afe7bfeca00", "size": 143205, "traits": [ { "id": "metadata/package/files/included::png-extension-basename", "conf": 0.8999999761581421, "crit": 1, "desc": "Filename ends with .png", "spans": [ [ 0, 13 ] ] } ], "type": "png" }, { "ctx": [ { "b": "bo[sfz!@x:v}Y:#y\u0026r%ie\u003c\u003cL$wIcn/x-", "ln": 1, "addr": 0 }, { "b": "", "ln": 2, "addr": 26 }, { "b": "k#QPjpdnb8lVm0RazC.nwOl3(BzkVhaz+FiwPw]9z/M$xxK@q+z!@x:v}Y:#y\u0026r%iaAITkv@0Xtlul^Txcp]gazCZovqYP#D2E?Cave*}aAIHkvqx]", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 58, "z": 3, "cf": 0.800000011920929 } ], "ln": 3, "addr": 27 }, { "b": "dK[s=lM!rEfGgaJA=kA6wO\u003c?DByw)1B1eT\u003caAz4nB-IwvayF8UB9hqvjxaHLazbUjz6iI2zE^M{A=SvEx([3bB-X:qC4CXpBz(qixLzu%av]Ehp-%\u003e9AaK8w", "ln": 4, "addr": 119 }, { "b": "C4CYnx(v)gazC}swO+%3vTf8fwNPaXAX5twzE:(eA=k]9xjk)[B0a)lv@DydwO+^%x(v(ix\u003eet#A=k!qy\u0026r@eBz\u0026pCx(W=c\u0026^^moz/{dAz!pblxK@q}z*i(", "ln": 5, "addr": 216 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 18100.0, "entropy": 5.14, "size_bytes": 18100.0 }, "text": { "digit_ratio": 0.02, "space_count": 2422.0, "total_lines": 470.0, "char_entropy": 5.14, "unique_chars": 96.0, "lines_over_200": 1.0, "avg_line_length": 37.51, "high_byte_ratio": 0.01, "max_line_length": 229.0, "non_ascii_ratio": 0.01, "empty_line_ratio": 0.21, "last_line_length": 3.0, "whitespace_ratio": 0.16, "most_common_ratio": 0.08, "line_length_stddev": 38.23, "repeated_char_sequences": 17.0, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 12.0, "most_common_char_codepoint": 101.0 }, "binary": { "overall_entropy": 5.14, "peak_region_bytes": 17408.0, "peak_region_entropy": 5.26 } } }, "id": 4, "path": "SolTechnology.Core.Api.1.0.0.nupkg!!docs/readme.md", "risk": 1, "sha": "2c46d926625095dbbb3f4400935e1c55ae4917c1c13bfe867019607f0af1a32f", "size": 18100, "traits": [ { "id": "metadata/file/extension/identity::markdown-file-basename", "conf": 1.0, "crit": 1, "desc": "Markdown document file extension", "spans": [ [ 0, 9 ] ] }, { "id": "metadata/file/extension/identity::doc-or-config-extension", "conf": 1.0, "crit": 1, "desc": "Document or config file extension", "spans": [ [ 0, 9 ] ] }, { "id": "metadata/file/profile/language::lang-english", "conf": 0.800000011920929, "crit": 2, "desc": "English language detection", "spans": [ [ 58, 3 ] ] } ], "type": "markdown" }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J+", "n": [ { "c": 3, "d": "HTTP fingerprinting evasion campaign", "i": "objectives/command-and-control/infrastructure/user-agent::http-fingerprinting-campaign", "o": 0, "z": 34, "cf": 0.8999999761581421 } ], "ln": 0 }, { "b": "000000000000000000000e**S00000nb@R\u00260SSx795ES}=@y5C0rr91000000000000", "n": [ { "c": 1, "d": "PE standard code/data section", "i": "metadata/binary/section/names::pe-code-data-standard-section", "o": 512, "z": 5, "cf": 0.8999999761581421 } ], "ln": 496 }, { "b": "8uo:/dJOXg/z\u003e)UdGxCGlq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn", "n": [ { "c": 3, "d": "Recognized PE anti-analysis marker", "i": "objectives/anti-analysis/debugger-detect/combined-checks::evasion-aware-recognized-pe-marker", "o": 5660, "z": 4, "cf": 1.0 } ], "ln": 5644 }, { "b": "xjVf(nPNmqze:r5By!$.xjVf(qE%\u0026\u003cwPI@VvScpewN\u003e^NwPRoJB3\u003cwNv}xE)vruj4zC\u003e4=B.bQ", "n": [ { "c": 3, "d": "Access to ASP.NET Request object", "i": "micro-behaviors/communications/http/server/managed::http-request-get", "o": 13637, "z": 11, "cf": 1.0 } ], "ln": 13621 }, { "b": "y?WA*BzkVhmQZ1EB-I3[xjVf(qE%]*z/fSc06z@0uTD(Px()]UB8L}]wPI*ezGxv?now@)qE%]*", "n": [ { "c": 3, "d": "Access to ASP.NET Response object", "i": "micro-behaviors/communications/http/server/managed::http-response-get", "o": 14488, "z": 12, "cf": 1.0 } ], "ln": 14472 }, { "b": "xL}:8z!BtFlVm0Re\u003cTC\u003ce[w^m090SLz*a=+piyw?0cqZ[uSh8RB98brB-.gXAa@u:", "n": [ { "c": 3, "d": "References Windows executable or script", "i": "objectives/execution/interpreter/script/shell::windows-executable-ref", "o": 15768, "z": 4, "cf": 0.6000000238418579 } ], "ln": 15752 }, { "b": "A=kA6wO?AWwPRoJBy/p?B7GD2nPXJX08[e:By/p?lt{^UwNPDRrb3hXq/De.0b2\u003e+uSRnZ", "n": [ { "c": 3, "d": "Modification of HTTP context items", "i": "micro-behaviors/communications/http/server/managed::http-context-item-setter", "o": 15845, "z": 8, "cf": 0.8500000238418579 } ], "ln": 15829 }, { "b": "zE^r@v%HT-ygQ)%x(v\u003e?q*ACawO\u003c4$wOb:\u0026v@#B6zu9mbwPz%dv}w2Cy\u00260V)BzkVh08m3nx\u003c\u003c$^AaIyPyY", "n": [ { "c": 2, "d": "Benign high-entropy PE context", "i": "metadata/package/quality/false-positives::benign-high-entropy-pe-context", "o": 16131, "z": 17, "cf": 0.949999988079071 } ], "ln": 16115 }, { "b": "B7]Mgl$HBHA+PGmx(v\u003e?q*ACawO\u003c50wQ5qHn][]*08)#Wx(mMJz/6D4A+PPkzu9TRC%L$Kq!ZbZy?mZb", "n": [ { "c": 3, "d": "JSON polymorphism runtime marker", "i": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "o": 16537, "z": 16, "cf": 1.0 } ], "ln": 16521 }, { "b": "r+lq)x(v)6zF7N)BAzE4q*ACawO\u003c4{wPPK}BAzE4q*ACawO\u003c4[x(m[\u003crbUYSA+PA7l2Hj2y?m3}07/E}x\u0026X!=B7]MgqE%n", "n": [ { "c": 3, "d": "LINQ query operations", "i": "micro-behaviors/data/db/linq::linq-queries", "o": 16675, "z": 11, "cf": 0.699999988079071 }, { "c": 2, "d": "System namespace reference", "i": "metadata/lang/compiler/managed::system-namespace", "o": 16659, "z": 10, "cf": 0.800000011920929 } ], "ln": 16643 }, { "b": "x\u003e7N[x(v(/wPz%dv}xYYq*ACawO\u003c4$B-8qnzdLs\u003ezGGDgz/wS^A=#ebwPE\u0026ID2[7sz7X.ezGGPfwIct*ze:i9wPyZXA=#ebwPE\u0026:wPRoSwPq\u003c7B97t(A=#ebwPE\u0026)wPz%dv}xYYl$G?Ixj\u003e{@xh9qPwPE", "n": [ { "c": 3, "d": "Access to ASP.NET Request object", "i": "micro-behaviors/communications/http/server/managed::http-request-get", "o": 17659, "z": 11, "cf": 1.0 }, { "c": 3, "d": "Packed binary marker", "i": "objectives/anti-static/obfuscation/eval/loader::packed-binary-marker", "o": 17596, "z": 30, "cf": 0.8500000238418579 } ], "ln": 17580 }, { "b": "BzaM-AbP=s0chT\u0026z/P}1xjVf(qE%\u0026\u003cwPI}[now@)qE%\u0026\u003cwPI}[o(Ch^pgXV(08[e:By/qwraQp", "n": [ { "c": 3, "d": "Access to ASP.NET Request object", "i": "micro-behaviors/communications/http/server/managed::http-request-get", "o": 20332, "z": 11, "cf": 1.0 } ], "ln": 20316 }, { "b": "BzkVhlVl\u003c:wQ5p%xjVf(now@)lVl\u003c:wQ5p%p\u0026ZF-y?mDKwPRu{y\u0026.%ZzGGDmBo2/?zGGDmBo37", "n": [ { "c": 3, "d": "Access to ASP.NET HttpContext", "i": "micro-behaviors/communications/http/server/managed::http-context", "o": 20477, "z": 11, "cf": 1.0 } ], "ln": 20461 }, { "b": "0ce6W0a=dF0cwh-0cncZ0at\u003ep0bITD03znc08JU!03zn+0a=dJ0cncO0b?\u003cP004L8PE7f", "n": [ { "c": 3, "d": "Recognized sparse-logic binary marker", "i": "objectives/anti-analysis/vm-detect/instruction::sparse-logic-recognized-marker", "o": 21033, "z": 7, "cf": 0.800000011920929 } ], "ln": 21017 }, { "b": "cJFq\u0026cJEfE0ukbveDw6ppYK5!eDw/Kmf3i=qVGw?pxjb\u00260rTCA02)3Xc\u0026=TnwDlVHASxU", "n": [ { "c": 2, "d": "Contains version information", "i": "metadata/package/quality/profile::versioned", "o": 23620, "z": 7, "cf": 0.8500000238418579 } ], "ln": 23604 }, { "b": "00000000000000000000000000000000000000315c8Xg7YTL^00000000000000000", "n": [ { "c": 1, "d": "PE resource section", "i": "metadata/binary/section/names::pe-resource-section", "o": 28160, "z": 5, "cf": 0.8999999761581421 } ], "ln": 28144 }, { "b": "0000000000005w\u003cgYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006Xn[brp!0rr910rr9", "n": [ { "c": 3, "d": "Recognized marker for timing checks", "i": "objectives/anti-analysis/timing/evasion::timing-anti-debug-recognized-marker", "o": 28254, "z": 15, "cf": 0.949999988079071 } ], "ln": 28238 }, { "b": "zVBROz2!bEzua+UA@Vgumf4GhwDl-JC(R{^xAh-DzuaqHaolV!zVB[WaoloVwDlowwb).LBo3jVaolD.xAh-Dz#.0Xve}zIv/QrBwDlcszu7^Vk(:*-pYJ9Fp5)Y.q#!3vlJz38ASxUJaolP=wDlftaojXcpYK5!iSHo5ve$fBaokptmGt^Qaojt2h#\u003eS", "n": [ { "c": 1, "d": "Encoded HTML tag fragment", "i": "objectives/anti-static/obfuscation/encoding/content::encoded-html-tag-fragment", "o": 28492, "z": 103, "cf": 0.699999988079071 } ], "ln": 28476 }, { "b": "x-J2Jx8\u003cK:002g.4/=RglJz38z2!IPve$fBC(QOtve$cAwDhYg002{$zVBONaokvvwDliuxAh]", "n": [ { "c": 2, "d": "PE CompanyName metadata field", "i": "metadata/package/versioning::pe-companyname-field", "o": 29210, "z": 11, "cf": 0.699999988079071 } ], "ln": 29194 }, { "b": "zVBzIC(N*A003417xsEomGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up002{$zVBONq#*Ffv/Qf", "n": [ { "c": 2, "d": "PE FileDescription metadata field", "i": "metadata/package/versioning::pe-filedescription-field", "o": 29274, "z": 15, "cf": 0.699999988079071 } ], "ln": 29258 }, { "b": "k(+\u003c7x-Fbk001XM2MK(9mGvc5yYF2DrSDXhASydXx-J5Kzu6Up001.Ne=WN9e=WN9e=WN9003418VP)snDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE002{$zVBONq#*Ffv/QfxzuaOP", "n": [ { "c": 3, "d": "Dotted-quad PE version metadata marker", "i": "objectives/command-and-control/infrastructure/ip::ipv4-version-metadata-marker", "o": 29362, "z": 11, "cf": 0.9399999976158142 }, { "c": 2, "d": "PE InternalName metadata field", "i": "metadata/package/versioning::pe-internalname-field", "o": 29410, "z": 12, "cf": 0.699999988079071 } ], "ln": 29346 }, { "b": "yYFwNx8)hS003s98VP)spxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE002{$zVBONq#*Ffv/Qfx", "n": [ { "c": 2, "d": "PE OriginalFilename metadata field", "i": "metadata/package/versioning::pe-originalfilename-field", "o": 29578, "z": 16, "cf": 0.699999988079071 } ], "ln": 29562 }, { "b": "wb{ACyYBCn002:]7xsEopYLIozVBqFBPt[KBo25ove$cAwDhYg002{$zVBONq#*Ffv/QfxzuaO", "n": [ { "c": 2, "d": "PE ProductName metadata field", "i": "metadata/package/versioning::pe-productname-field", "o": 29674, "z": 11, "cf": 0.699999988079071 } ], "ln": 29658 }, { "b": "k(+\u003c7x-Fbk004PJf8#1MpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001.Ne=WN9e=WN9d/.Hdw=I", "n": [ { "c": 2, "d": "PE version resource metadata", "i": "metadata/package/versioning::version-resource-metadata", "o": 29754, "z": 14, "cf": 0.8999999761581421 } ], "ln": 29738 }, { "b": "000000000000000000000dU4H3\u0026*ncauGM6000000000000000000000000000000000", "n": [ { "c": 2, "d": "PE .reloc section presence", "i": "metadata/binary/section/names::reloc-section-presence", "o": 30208, "z": 6, "cf": 0.8999999761581421 } ], "ln": 30192 } ], "depth": 1, "facts": { "imp": [ [ "mscoree", "CorDllMain" ] ], "sec": [ [ ".text", 512, 27648, 5.85, "r-x" ], [ ".rsrc", 28160, 2048, 3.08, "r--" ], [ ".reloc", 30208, 512, 0.08, "r--" ] ], "metrics": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "resource_count": 1.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 53180.0, "reloc_overhang_bytes": 500.0, "reloc_overhang_ratio": 0.98, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "version.identity_entropy": 3.85, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0, "version.identity_symbol_ratio": 0.07 }, "file": { "size": 30720.0, "entropy": 5.61, "size_bytes": 30720.0 }, "binary": { "is_pie": 1.0, "code_entropy": 5.85, "string_count": 518.0, "overall_entropy": 5.61, "entropy_variance": 5.54, "avg_string_length": 21.21, "max_string_length": 356.0, "peak_region_bytes": 1024.0, "code_to_data_ratio": 1.0, "peak_region_entropy": 6.17, "string_length_stddev": 25.37, "largest_section_ratio": 0.9, "sentence_string_count": 12.0, "sentence_string_ratio": 0.02, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 27648.0, "entropy_max": 5.85, "entropy_mean": 3.0, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } } }, "id": 5, "mol": "O(Al)H₂(CmDb)", "path": "SolTechnology.Core.Api.1.0.0.nupkg!!lib/net10.0/SolTechnology.Core.Api.dll", "risk": 4, "sha": "e599f1fe92d69499bebb475f272a49281321a8f34d006eb1efa64f7612ce4eb2", "size": 30720, "traits": [ { "id": "micro-behaviors/communications/http/server/managed::http-response-get", "conf": 1.0, "crit": 3, "desc": "Access to ASP.NET Response object", "spans": [ [ 14488, 12 ] ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "spans": [ [ 29754, 14 ] ] }, { "id": "micro-behaviors/data/db/linq::linq-queries", "conf": 0.699999988079071, "crit": 3, "desc": "LINQ query operations", "spans": [ [ 16675, 11 ] ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 28254, 15 ] ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "conf": 1.0, "crit": 3, "desc": "JSON polymorphism runtime marker", "spans": [ [ 16537, 16 ] ] }, { "id": "micro-behaviors/communications/http/server/managed::http-item-setter", "conf": 1.0, "crit": 1, "desc": "Modification of HTTP context items", "spans": [ [ 15845, 8 ] ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "spans": [ [ 29362, 11 ] ] }, { "id": "metadata/package/versioning::version-upper", "crit": 2, "desc": "VERSION word (uppercase)", "spans": [ [ 23620, 7 ] ] }, { "id": "metadata/package/versioning::version-word-lower", "conf": 0.4000000059604645, "crit": 2, "desc": "version word (lowercase)", "spans": [ [ 21033, 7 ] ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "spans": [ [ 15768, 4 ] ] }, { "id": "micro-behaviors/communications/http/server/managed::http-request-get", "conf": 1.0, "crit": 3, "desc": "Access to ASP.NET Request object", "spans": [ [ 13637, 11 ], [ 17659, 11 ], [ 20332, 11 ] ] }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "spans": [ [ 0, 26 ] ] }, { "id": "micro-behaviors/communications/http/server/managed::http-context", "conf": 1.0, "crit": 3, "desc": "Access to ASP.NET HttpContext", "spans": [ [ 20477, 11 ] ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "spans": [ [ 5660, 4 ] ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "spans": [ [ 5660, 4 ] ] }, { "id": "micro-behaviors/communications/http/server/managed::http-context-item-setter", "conf": 0.8500000238418579, "crit": 3, "desc": "Modification of HTTP context items", "spans": [ [ 15845, 8 ], [ 20477, 11 ] ] } ], "type": "pe" }, { "id": 6, "sha": "014be50bead1e534b5c4260670332bbcb06ae1ba2fd5ee8f297a47d7605c8765", "path": "SolTechnology.Core.Api.1.0.0.nupkg!![Content_Types].xml", "size": 582, "type": "xml", "depth": 1 }, { "id": 7, "sha": "c37e20d37aebe65099a058a1d88ba3b3c357a6348fe271111b14d0f99b6fd265", "path": "SolTechnology.Core.Api.1.0.0.nupkg!!package/services/metadata/core-properties/1a3bf6c96b8e47f7953cb24971f040b7.psmdcp", "size": 1122, "type": "xml", "depth": 1 }, { "id": 8, "sha": "de84b8750e527bacb607d770a5d437e13d3fd8fc83cc3eca4e0d83ae72ad31b6", "path": "SolTechnology.Core.Api@1.0.0.registry.json", "size": 1142, "type": "registry", "depth": 1 } ], "omitted_files": 3, "rev": "20834", "v": "8" } }