{ "llm": { "conf": 0.7524395, "grade": "benign", "model": "Qwen/Qwen3.6-27B", "outcome": "benign", "interpretation": "Legitimate .NET library strings" }, "ml": { "v": "7", "eng": "2.3.0-beta.0", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.6463421, "rte": "az", "prob": 0.6463421 } ], "prob": 0.6463421, "skip": [ { "rte": "az/zip", "why": "unavailable" }, { "rte": "az/zip", "why": "unavailable" } ], "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.6463420987129211, "type": "nupkg" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.00012001395225524902, "type": "xml" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.008743494749069214, "type": "xml" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.005262881517410278, "type": "text" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "xml" }, { "id": 5, "lvl": -1, "conf": 0, "prob": 0.6463420987129211, "type": "xml" }, { "id": 6, "lvl": -1, "conf": 0, "prob": 0.00006663799285888672, "type": "png" }, { "id": 7, "lvl": -1, "conf": 0, "prob": 0.6463420987129211, "type": "pe" }, { "id": 8, "lvl": -1, "conf": 0, "prob": 0.6463420987129211, "type": "xml" }, { "id": 9, "lvl": -1, "conf": 0, "prob": 0.6463420987129211, "type": "pe" }, { "id": 10, "lvl": -1, "conf": 0, "prob": 0.6463420987129211, "type": "xml" }, { "id": 11, "lvl": -1, "conf": 0, "prob": 0.6463420987129211, "type": "pe" }, { "id": 12, "lvl": -1, "conf": 0, "prob": 0.6463420987129211, "type": "xml" }, { "id": 13, "lvl": -1, "conf": 0, "prob": 0.6463420987129211, "type": "pe" }, { "id": 14, "lvl": -1, "conf": 0, "prob": 0.6463420987129211, "type": "xml" }, { "id": 15, "lvl": -1, "conf": 0, "prob": 0.6463420987129211, "type": "xml" }, { "id": 16, "lvl": -1, "conf": 0, "prob": 0.00012001395225524902, "type": "xml" }, { "id": 17, "lvl": -1, "conf": 0, "prob": 0.6463420987129211, "type": "registry" } ], "version": "v18.18", "analyzed_at": "2026-07-07T00:40:06Z" }, "path": "HotChocolate.ApolloFederation.16.5.0-p.1.nupkg", "raw": { "files": [ { "id": 0, "mol": "O(Al)H₂(CmDb)", "sha": "b6ed013207bbbbf1941ac908cfb58587686a70aa48d3d272a8c30d8d0901eaad", "path": "HotChocolate.ApolloFederation.16.5.0-p.1.nupkg", "risk": 4, "size": 246018, "type": "nupkg", "facts": { "metrics": { "file": { "size": 246018.0, "entropy": 7.99, "size_bytes": 246018.0 }, "binary": { "overall_entropy": 7.99, "peak_region_bytes": 241664.0, "peak_region_entropy": 7.83 }, "archive": { "file_count": 17.0, "member_count": 17.0, "script_count": 0.0, "zip_bomb_ratio": 12.16, "directory_count": 0.0, "executable_count": 4.0, "extra_field_size": 0.0, "noise_file_count": 0.0, "total_compressed": 243446.0, "compression.ratio": 0.24, "hidden_file_count": 2.0, "total_uncompressed": 1005107.0, "crc_collision_count": 3.0, "entry_comment_count": 0.0, "max_filename_length": 81.0, "rtlo_filename_count": 0.0, "format.regular_count": 17.0, "nested_archive_count": 0.0, "path_traversal_count": 0.0, "symlink_escape_count": 0.0, "security.setgid_count": 0.0, "security.setuid_count": 0.0, "security.sticky_count": 0.0, "double_extension_count": 0.0, "duplicate_member_count": 0.0, "security.symlink_count": 0.0, "unicode_filename_count": 0.0, "homoglyph_filename_count": 0.0, "security.encrypted_count": 0.0, "timing.mtime_unique_count": 2.0, "timing.mtime_unique_ratio": 0.12, "misplaced_executable_count": 4.0, "timing.mtime_outlier_count": 1.0, "timing.mtime_dominant_count": 16.0, "timing.mtime_spread_seconds": 25112.0, "timing.sentinel_mtime_count": 0.0, "security.world_writable_count": 0.0, "timing.mtime_dominant_fraction": 0.94, "compression.method_counts.stored": 1.0, "compression.method_counts.deflate": 16.0 } } }, "ident": { "name": { "value": "HotChocolate.ApolloFederation", "source": "nupkg.title", "verified": false }, "urls": [ { "url": "https://chillicream.com/", "kind": "homepage", "source": "nupkg.project_url" }, { "url": "https://github.com/ChilliCream/graphql-platform.git", "kind": "repository", "source": "nupkg.repository_url" } ], "trust": "unsigned", "authors": [ { "name": "ChilliCream authors and contributors", "role": "author", "source": "nupkg.authors" } ], "version": { "value": "16.5.0-p.1", "source": "nupkg.version", "verified": false }, "identifier": { "value": "HotChocolate.ApolloFederation", "source": "nupkg.id", "verified": false } }, "traits": [ { "id": "micro-behaviors/communications/http/server/managed::http-request-get", "conf": 1.0, "crit": 3, "desc": "Access to ASP.NET Request object", "from": [ { "file": 7 } ] }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "from": [ { "file": 7 } ], "spans": [ [ 0, 26 ] ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "from": [ { "file": 7 } ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "from": [ { "file": 7 } ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "from": [ { "file": 7 }, { "file": 9 }, { "file": 11 }, { "file": 13 } ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "conf": 1.0, "crit": 3, "desc": "JSON polymorphism runtime marker", "from": [ { "file": 7 } ] }, { "id": "metadata/package/versioning::version-word-lower", "conf": 0.4000000059604645, "crit": 2, "desc": "version word (lowercase)", "from": [ { "file": 7 } ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "from": [ { "file": 7 } ] }, { "id": "micro-behaviors/data/db/linq::linq-queries", "conf": 0.699999988079071, "crit": 3, "desc": "LINQ query operations", "from": [ { "file": 7 } ] }, { "id": "micro-behaviors/data/db/linq::system-linq-expressions", "conf": 0.6000000238418579, "crit": 3, "desc": "System.Linq.Expressions namespace", "from": [ { "file": 7 } ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "from": [ { "file": 7 } ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "from": [ { "file": 7 } ] } ] }, { "id": 1, "sha": "da6868da7b1b8c190d77829b4b0e9a4fdd147c364ce4d44c9eb907faeee4fb8c", "path": "HotChocolate.ApolloFederation.16.5.0-p.1.nupkg!!_rels/.rels", "size": 519, "type": "xml", "depth": 1 }, { "ctx": [ { "b": "[4ls%kx}3YaA?spB7]MgjT8QkfD}SJzEWP}x(mMDb6w0teJs}sj]", "n": [ { "c": 2, "d": "NuGet nuspec manifest file", "i": "metadata/build/manifest::nuspec-file", "o": 0, "z": 36, "cf": 0.9800000190734863 } ], "ln": 1, "addr": 0 }, { "b": "jAa.syHH\u003c!aB4:tzGv@+xMOuniXJdcv}YB\u003cvrj5rx\u003e8g4B8LVje[n*pfk$ufyHH\u003c\u0026zF7QTfFLvpfF$I3B-RIkv\u003eJ1EwfKh", "ln": 2, "addr": 42 }, { "b": "arS^-wPRu\u003evrt{w", "ln": 3, "addr": 118 }, { "b": "arR^Hjy-qGD2^RixMMB9z/x#xx\u003eIa3aI$92gb7Bxat1ZPA+fr6zGE0*xLzp0x*V]LvqNbUzEUpYfjO{tD2^RixMMA", "ln": 14, "addr": 718 }, { "b": "arR^HjAL1AB3r9mvq])SoDVYox(4Q1lVM:Dz9fE[vp%TB", "ln": 15, "addr": 790 }, { "b": "arR^HjAt1Lz/YSmz/QaCBA}?pjT9ygBvZK-a%q2Gy=@$QBAzFyiXJd0x([3hvLheez7!m\u0026x(4Q1lVM:Dz7/Kxvq][1y+oQxvrua1A=0Bwx(\u003eKwv@Dj3x((GZwI^%Rw[9Pcf\u003eAmLg=vfAiB#!YhzFSHwh[0LggK\u0026IggK\u003c8v(4WRa%nK5", "n": [ { "c": 2, "d": "NuGet package declares repository", "i": "metadata/package/files/nuget::nuspec-repository", "o": 831, "z": 91, "cf": 0.8999999761581421 } ], "ln": 16, "addr": 827 }, { "b": "arR^Hjy\u00262xwO#3\u0026zEWx(B3o", "n": [ { "c": 2, "d": "NuGet package declares dependencies", "i": "metadata/package/files/nuget::nuspec-dependencies", "o": 972, "z": 501, "cf": 0.8999999761581421 } ], "ln": 17, "addr": 968 }, { "b": "arR^HarS^VA=l8taAR4jxjVfOA:-/@Cw?IqjTa=PBtkE4fD@W", "ln": 18, "addr": 987 }, { "b": "arR^HarR^Hjy\u00262xwO#3\u0026zEW@mx\u003efvJnn\u0026PqxM4y0y*?A%a%q5uA=U@kzAPf#hzc\u003ctfFdk@f^m-KCW\u003eMjwmW[FluN0UwgQ2:vqHjnwPz\u0026oatk[", "ln": 19, "addr": 1027 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 1601.0, "entropy": 5.03, "size_bytes": 1601.0 }, "binary": { "overall_entropy": 5.03, "peak_region_bytes": 1601.0, "peak_region_entropy": 5.04 } } }, "id": 2, "path": "HotChocolate.ApolloFederation.16.5.0-p.1.nupkg!!HotChocolate.ApolloFederation.nuspec", "risk": 1, "sha": "2faa60034b00c8a39f071795999a72310c63c9a05c5b6e6814909e4a6f3afad2", "size": 1601, "traits": [ { "id": "metadata/build/manifest::nuspec-file", "conf": 0.9800000190734863, "crit": 2, "desc": "NuGet nuspec manifest file", "spans": [ [ 0, 36 ] ] }, { "id": "metadata/package/files/nuget::nuspec-repository", "conf": 0.8999999761581421, "crit": 2, "desc": "NuGet package declares repository", "spans": [ [ 831, 91 ] ] }, { "id": "metadata/package/files/nuget::nuspec-dependencies", "conf": 0.8999999761581421, "crit": 2, "desc": "NuGet package declares dependencies", "spans": [ [ 972, 501 ] ] } ], "type": "xml" }, { "id": 3, "sha": "5f6f7fb421872122ae2c7c395c0e4ed232cb5653b42215106eba532c4001b215", "path": "HotChocolate.ApolloFederation.16.5.0-p.1.nupkg!!LICENSE", "risk": 1, "size": 1083, "type": "text", "depth": 1 }, { "id": 4, "sha": "a72dfe9efa735037b28f878c504d008df3aeb0e543ee61d427f3c1ab58c60008", "path": "HotChocolate.ApolloFederation.16.5.0-p.1.nupkg!!build/HotChocolate.ApolloFederation.props", "size": 288, "type": "xml", "depth": 1 }, { "id": 5, "sha": "5df8c604b6954141968024610a597dda735d97017e2b09fe073e06fad44bcd8b", "path": "HotChocolate.ApolloFederation.16.5.0-p.1.nupkg!!build/HotChocolate.ApolloFederation.targets", "size": 375, "type": "xml", "depth": 1 }, { "id": 6, "sha": "e61dd2ec3dbe645faf7479b18258213374a5104455ca72c80213c36b0ecf0fee", "path": "HotChocolate.ApolloFederation.16.5.0-p.1.nupkg!!hotchocolate-icon.png", "size": 5938, "type": "png", "depth": 1 }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J\u0026m(0ji6Sa?dLD+]{51x(+zoA=kPhvqNb%vqY$3BrC47aAzQxazCZol@c-7zeP", "n": [ { "c": 3, "d": "HTTP fingerprinting evasion campaign", "i": "objectives/command-and-control/infrastructure/user-agent::http-fingerprinting-campaign", "o": 0, "z": 34, "cf": 0.8999999761581421 }, { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 78, "z": 4, "cf": 0.800000011920929 } ], "ln": 0 }, { "b": "000000000000000000002!Qfr00000nb@R\u00260SSx7TB{MNeg7w$0rr9100000/S1@L:n", "n": [ { "c": 1, "d": "PE standard code/data section", "i": "metadata/binary/section/names::pe-code-data-standard-section", "o": 512, "z": 5, "cf": 0.8999999761581421 } ], "ln": 496 }, { "b": "DK6SL1AL{\u003c00Wv!001J0lq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn", "n": [ { "c": 3, "d": "Recognized PE anti-analysis marker", "i": "objectives/anti-analysis/debugger-detect/combined-checks::evasion-aware-recognized-pe-marker", "o": 26284, "z": 4, "cf": 1.0 } ], "ln": 26268 }, { "b": "wO#71x\u003e5+!oLFM\u0026jxaG%Bzbxftu}kcD2[7sz7Xg]y\u00260V)BzkVhB1P%]zE)\u003c5v\u003eHtJ", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 59525, "z": 4, "cf": 0.800000011920929 } ], "ln": 59509 }, { "b": "ze:r5By!$.C4(2iBy!$.xjVf(qE%\u0026\u003cwPI@VvScpewN\u003e^uxMw3nnOgs#zEWl]y*?B1z/eD:ADL*", "n": [ { "c": 3, "d": "Access to ASP.NET Request object", "i": "micro-behaviors/communications/http/server/managed::http-request-get", "o": 60134, "z": 11, "cf": 1.0 } ], "ln": 60118 }, { "b": "l2Z:Uy\u0026q^OwmY^\u0026BzkVhe[w^m090SLz*a=+piyw?0b2\u003e+uSzb.090(pA+\u003e.#A+\u003e.O", "n": [ { "c": 3, "d": "References Windows executable or script", "i": "objectives/execution/interpreter/script/shell::windows-executable-ref", "o": 67272, "z": 4, "cf": 0.6000000238418579 } ], "ln": 67256 }, { "b": "z/bLOA^pS5r+lq)x(v\u003e?C4CYnx(v\u003e?lVM:DBy!xZBxh*^B.a0^Ab]JhB7]Mg0cqHSA+eU", "n": [ { "c": 3, "d": "Recognized sparse-logic binary marker", "i": "objectives/anti-analysis/vm-detect/instruction::sparse-logic-recognized-marker", "o": 67722, "z": 7, "cf": 0.800000011920929 } ], "ln": 67706 }, { "b": "zE^r@v%HT-ygQ)%x(v\u003e?q*ACawO\u003c4$wOb:\u0026v@#B6zu9l}z!%l3v@#B6zu9mCBy/G8vpJ\u003erx\u003eq9\u003elVl^SwD", "n": [ { "c": 2, "d": "Benign high-entropy PE context", "i": "metadata/package/quality/false-positives::benign-high-entropy-pe-context", "o": 68749, "z": 17, "cf": 0.949999988079071 } ], "ln": 68733 }, { "b": "z!@\u003c7wIc}[CYUMgB8L{@q*ACawO\u003c50wQ5qHn][]*08)#Wx(mMJz/6D4A+PPkzu9NCBAIRw0b2\u003e+uSpYV", "n": [ { "c": 3, "d": "JSON polymorphism runtime marker", "i": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "o": 69988, "z": 16, "cf": 1.0 } ], "ln": 69972 }, { "b": "z!\u003cGm0cAH9wLv2XyJTN@q*ACawO\u003c4[x(m[\u003cq*ACawO\u003c4!z!%l3v@#B6zGvB2wO#71x\u003e5+!lVl=", "n": [ { "c": 3, "d": "LINQ query operations", "i": "micro-behaviors/data/db/linq::linq-queries", "o": 70258, "z": 11, "cf": 0.699999988079071 } ], "ln": 70242 }, { "b": "B3%OKvrDydnmuyDy?mR!q*ACawO\u003c4!z!9AEz/49]z/6Dcy?mR!nM6bvz!%PdAZK+ZAa%c1ASx--Byd{SB8L(rwPyc", "n": [ { "c": 3, "d": ".NET dynamic code generation capability", "i": "metadata/lang/compiler/managed::dotnet-dynamic-code", "o": 70863, "z": 23, "cf": 0.8500000238418579 } ], "ln": 70847 }, { "b": "wN/?2ASx6VC%L$Krc-B]nP5SYA:@W1Bz(g1mRcawA::67z/eK1AaIQUBy/G5wPh:fASwW0wPIv4x(FfjASwW5zGGDgw)]gXmRMBIwjg0Iv/", "n": [ { "c": 3, "d": "Method interception capability", "i": "micro-behaviors/process/hook/interception::interceptor-comp", "o": 71841, "z": 11, "cf": 0.75 } ], "ln": 71825 }, { "b": "wO(vaC%#$1wO#N6z/fQ@q*ACawO\u003c4[x(m]ymr\u0026=(wPI{bz/fQ@B7GD2oMaAHBzkVhA@X:HBvf.Wv@Df(By^77D2Nr", "n": [ { "c": 3, "d": "LINQ expression tree manipulation", "i": "micro-behaviors/data/db/linq::linq-expressions", "o": 74229, "z": 23, "cf": 0.75 } ], "ln": 74213 }, { "b": "A==NbAb](owPz)r0000@q#*OiwDi?Mw=Mxxwb{fvASxIFBo31PzVBUPaolM+wDl-", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 77942, "z": 3, "cf": 0.800000011920929 } ], "ln": 77926 }, { "b": "0cncK0aV6L0cwiV03znI0b.^O0b?\u003cV0at\u003eH0a=cM0cwiO0a=cM0a=dP0b}{H0aM0", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 91069, "z": 3, "cf": 0.800000011920929 } ], "ln": 91053 }, { "b": "0at\u003eH0a=cM0at\u003cI0aM1E0bRZB0bhBJ0at\u003eH0bhBK0b.=V0b?\u003cH03znN0bhBA0bITC", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 91371, "z": 4, "cf": 0.800000011920929 } ], "ln": 91355 }, { "b": "BPuH-x-J5Kzu7^VyYFwNx8(SCv/NRKw=M\u0026KzVBROaolrWBo2$OwDl-JaolD.BPt\u003e", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 92310, "z": 3, "cf": 0.800000011920929 } ], "ln": 92294 }, { "b": "zu7^VA@ZdVwDliue=ZBKnDrSdwb{rzv/P{qBo2\u003eLA@Wr.Bo3jVaok)KzVBROz#:!RA@Y[OBo31PzVBUPaolG-xAhDvBo0A-Bo2$OwDi?MBo2.HASx.LwDl/Laok%MyYF2Dz2!bEzua+Uaol9QA@Wr.ve%^qv/Q6uA@ZmYx-IPxyYF2DaolrWzuaFMC(O@!Bn#", "n": [ { "c": 3, "d": "Bulk sensitive server data list", "i": "objectives/exfiltration/cloud/sync-tool::bulk-sensitive-server-data-path", "o": 93702, "z": 106, "cf": 1.0 } ], "ln": 93686 }, { "b": "aolJ:A@Y+KASydXe=ZCpnDrSdwb{rzv/P{qBo2\u003eLA@Wr.Bo3jVaok)KzVBROz#:!RA@Y[OBo31PzVBUPaolG-xAhDvBo0A-Bo2$OwDi?MBo2.HASx.LwDl/Laok%MyYF2Dz2!bEzua+Uaol9QA@Wr.ve%^qv/Q6uA@ZmYx-IPxyYF2DaolrWzuaFMC(O@!Bo3jVaolG-xAhPzaok*IBPuH-xAhPz", "n": [ { "c": 1, "d": "Regex component marker", "i": "objectives/exfiltration/cloud/sync-tool::bulk-sensitive-server-data-path--rx-8", "o": 93916, "z": 128, "cf": 1.0 } ], "ln": 93900 }, { "b": "zz1y\u0026wmY^\u0026BzkVhrc-B]nP5SYA:@W1Bz(gIjw]:6x(!xcA.QE)wMi}]wPH4CuTCJB000f60096", "n": [ { "c": 1, "d": "Interceptor class reference", "i": "micro-behaviors/process/hook/interception::interceptor-class", "o": 98511, "z": 11, "cf": 0.6000000238418579 } ], "ln": 98495 }, { "b": ".W=.E=DtQ\u00260rr91KPkvYy/tR2By/qwqE%]/B-H#6B1Qv4B8Mhwv}wLHvpS}\u0026efF!Jv@Dy7x\u003c@Ror+lq)x(v(Lg+HEmfFk4gavyo/BAIRnj-j?NBAg/aefE=ivR/:*oj-xFz!\u0026{4jZ{uevkRKLhzEiFg?wv2iu}EFB97#ge(Dn4z/{8gwPGF4B-8qnzdMQRB8Mhwv}wOIBohBx02U+p0000008L%H", "n": [ { "c": 2, "d": "mscorlib reference", "i": "metadata/lang/compiler/managed::mscorlib", "o": 101608, "z": 128, "cf": 0.8999999761581421 } ], "ln": 101592 }, { "b": "xcpR9n([$mB7occwIa0Vl2pvQCxj)HB7GxkaARJAvqY$3Byxo5azbt0y?dPfvqYP#BA}?pB0bWvBz8!9wmPy@x(v($y-)OaBywY*ByuqazF0*czddK2z/dfdgGn40azkziwO@S0zH0vBwPhW3B7Glhvruj4zxJP", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 104946, "z": 3, "cf": 0.800000011920929 } ], "ln": 104898 }, { "b": "00000000000000000000000000000000000000315c8Xg7YTL^00000000000000000", "n": [ { "c": 1, "d": "PE resource section", "i": "metadata/binary/section/names::pe-resource-section", "o": 106496, "z": 5, "cf": 0.8999999761581421 } ], "ln": 106480 }, { "b": "0000000000004(VgYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006Xn[brp!0rro65c8X", "n": [ { "c": 3, "d": "Recognized marker for timing checks", "i": "objectives/anti-analysis/timing/evasion::timing-anti-debug-recognized-marker", "o": 106590, "z": 15, "cf": 0.949999988079071 } ], "ln": 106574 }, { "b": "Bo2\u003eLe=U\u003eK002s=5Dz?ilJz38z2!IPve$fBC(QOtve$cAwDhYg002v^xAh-DyYFnKx-HH2ASxU", "n": [ { "c": 2, "d": "PE CompanyName metadata field", "i": "metadata/package/versioning::pe-companyname-field", "o": 106942, "z": 11, "cf": 0.699999988079071 } ], "ln": 106926 }, { "b": "zuaeDe=U\u003eK003Kf9SMivmGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up002K\u0026zVB\u003eVlJy^1zVBn", "n": [ { "c": 2, "d": "PE FileDescription metadata field", "i": "metadata/package/versioning::pe-filedescription-field", "o": 107010, "z": 15, "cf": 0.699999988079071 } ], "ln": 106994 }, { "b": "Bo31PzVBUP001+O2(\u003c#amGvc5yYF2DrSDXhASydXx-J5Kzu6Up001.Nhukufh2]lefArZ9fAq7M003Kfa]?SznDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE002K\u0026zVB\u003eVlJy^1zVBnEzVBON", "n": [ { "c": 3, "d": "Dotted-quad PE version metadata marker", "i": "objectives/command-and-control/infrastructure/ip::ipv4-version-metadata-marker", "o": 107110, "z": 11, "cf": 0.9399999976158142 }, { "c": 2, "d": "PE InternalName metadata field", "i": "metadata/package/versioning::pe-internalname-field", "o": 107162, "z": 12, "cf": 0.699999988079071 } ], "ln": 107094 }, { "b": "z#+d-ASx!Nx8(PBBn#pvlJz38z#+d-ASx!Nx8(PBBo0A-Sq[4vg5%0df-Tfkaoi$[aoluXAS", "n": [ { "c": 2, "d": "Copyright notice", "i": "metadata/package/license::copyright-word", "o": 107292, "z": 9, "cf": 0.6000000238418579 } ], "ln": 107276 }, { "b": "nDrSdv/OaY003*na]?Szpxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE002K\u0026zVB\u003eVlJy^1zVBnE", "n": [ { "c": 2, "d": "PE OriginalFilename metadata field", "i": "metadata/package/versioning::pe-originalfilename-field", "o": 107386, "z": 16, "cf": 0.699999988079071 } ], "ln": 107370 }, { "b": "e=YzZyYFnK002aY4GDIfpYLIozVBqFBPt[KBo25ove$cAwDhYg002K\u0026zVB\u003eVaoj+exAh@Jv/QAEyYE(zBo2\u003eL004@TgYNKRpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001.Nhukufh2]lefArW8z#Y", "n": [ { "c": 2, "d": "PE ProductName metadata field", "i": "metadata/package/versioning::pe-productname-field", "o": 107494, "z": 11, "cf": 0.699999988079071 }, { "c": 2, "d": "PE version resource metadata", "i": "metadata/package/versioning::version-resource-metadata", "o": 107554, "z": 14, "cf": 0.8999999761581421 } ], "ln": 107478 }, { "b": "000000000000000000000i=F73\u0026*ncc{dFf000000000000000000000000000000000", "n": [ { "c": 2, "d": "PE .reloc section presence", "i": "metadata/binary/section/names::reloc-section-presence", "o": 108032, "z": 6, "cf": 0.8999999761581421 } ], "ln": 108016 } ], "depth": 1, "facts": { "imp": [ [ "mscoree", "CorDllMain" ] ], "sec": [ [ ".text", 512, 105984, 6.02, "r-x" ], [ ".rsrc", 106496, 1536, 2.86, "r--" ], [ ".reloc", 108032, 512, 0.1, "r--" ] ], "metrics": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "resource_count": 1.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 132862.0, "reloc_overhang_bytes": 500.0, "reloc_overhang_ratio": 0.98, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "version.identity_entropy": 4.0, "clr.managed_resource_count": 1.0, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0, "clr.managed_resource_max_size": 4035.0, "version.identity_symbol_ratio": 0.03, "clr.managed_resource_max_entropy": 4.71 }, "file": { "size": 108544.0, "entropy": 5.96, "size_bytes": 108544.0 }, "binary": { "is_pie": 1.0, "code_entropy": 6.02, "string_count": 1234.0, "overall_entropy": 5.96, "entropy_variance": 5.84, "avg_string_length": 23.67, "max_string_length": 292.0, "peak_region_bytes": 2048.0, "code_to_data_ratio": 1.0, "peak_region_entropy": 6.71, "string_length_stddev": 23.22, "largest_section_ratio": 0.98, "sentence_string_count": 71.0, "sentence_string_ratio": 0.06, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 105984.0, "entropy_max": 6.02, "entropy_mean": 2.99, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } } }, "id": 7, "mol": "O(Al)H₂(CmDb)", "path": "HotChocolate.ApolloFederation.16.5.0-p.1.nupkg!!lib/net10.0/HotChocolate.ApolloFederation.dll", "risk": 4, "sha": "039d525ecc8916f6b74d434458a2d089e30c9453830eb8d20395ccb63eee52d6", "size": 108544, "traits": [ { "id": "micro-behaviors/data/db/linq::system-linq-expressions", "conf": 0.6000000238418579, "crit": 3, "desc": "System.Linq.Expressions namespace", "spans": [ [ 74229, 23 ] ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "spans": [ [ 107554, 14 ] ] }, { "id": "micro-behaviors/data/db/linq::linq-queries", "conf": 0.699999988079071, "crit": 3, "desc": "LINQ query operations", "spans": [ [ 70258, 11 ], [ 74229, 11 ] ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 106590, 15 ] ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "spans": [ [ 0, 26 ] ] }, { "id": "micro-behaviors/communications/http/server/managed::http-request-get", "conf": 1.0, "crit": 3, "desc": "Access to ASP.NET Request object", "spans": [ [ 60134, 11 ] ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "spans": [ [ 26284, 4 ] ] }, { "id": "metadata/package/versioning::version-word-lower", "conf": 0.4000000059604645, "crit": 2, "desc": "version word (lowercase)", "spans": [ [ 67722, 7 ] ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "spans": [ [ 67272, 4 ] ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "spans": [ [ 107110, 11 ] ] }, { "id": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "conf": 1.0, "crit": 3, "desc": "JSON polymorphism runtime marker", "spans": [ [ 69988, 16 ] ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "spans": [ [ 26284, 4 ] ] } ], "type": "pe" }, { "id": 8, "sha": "f3d2ad1838e013632068fbfe1c75fc4fe1f52dd33ef2b4274255d440d8daa138", "path": "HotChocolate.ApolloFederation.16.5.0-p.1.nupkg!!lib/net10.0/HotChocolate.ApolloFederation.xml", "size": 137303, "type": "xml", "depth": 1 }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J\u0026m(0ji6Sa?dLD+]{51x(+zoA=kPhvqNb%vqY$3BrC47aAzQxazCZol@c-7zeP", "n": [ { "c": 3, "d": "HTTP fingerprinting evasion campaign", "i": "objectives/command-and-control/infrastructure/user-agent::http-fingerprinting-campaign", "o": 0, "z": 34, "cf": 0.8999999761581421 }, { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 78, "z": 4, "cf": 0.800000011920929 } ], "ln": 0 }, { "b": "00000000000000000000:G\u003e)E00000nb@R\u00260SSx7FpNX27:e[W0rr9100000N4:PY:n", "n": [ { "c": 1, "d": "PE standard code/data section", "i": "metadata/binary/section/names::pe-code-data-standard-section", "o": 512, "z": 5, "cf": 0.8999999761581421 } ], "ln": 496 }, { "b": "D?EBt1AL{\u003c00Wv=001J0lq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn", "n": [ { "c": 3, "d": "Recognized PE anti-analysis marker", "i": "objectives/anti-analysis/debugger-detect/combined-checks::evasion-aware-recognized-pe-marker", "o": 25472, "z": 4, "cf": 1.0 } ], "ln": 25456 }, { "b": "wO#71x\u003e5+!oLFM\u0026jxaG%Bzbxftu}kcD2[7sz7Xg]y\u00260V)BzkVhB1P%]zE)\u003c5v\u003eHtJ", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 57973, "z": 4, "cf": 0.800000011920929 } ], "ln": 57957 }, { "b": "ze:r5By!$.C4(2iBy!$.xjVf(qE%\u0026\u003cwPI@VvScpewN\u003e^uxMw3nnOgs#zEWl]y*?B1z/eD:ADL*", "n": [ { "c": 3, "d": "Access to ASP.NET Request object", "i": "micro-behaviors/communications/http/server/managed::http-request-get", "o": 58559, "z": 11, "cf": 1.0 } ], "ln": 58543 }, { "b": "l2Z:Uy\u0026q^OwmY^\u0026BzkVhe[w^m090SLz*a=+piyw?0b2\u003e+uSzb.090(pA+\u003e.#A+\u003e.O", "n": [ { "c": 3, "d": "References Windows executable or script", "i": "objectives/execution/interpreter/script/shell::windows-executable-ref", "o": 65613, "z": 4, "cf": 0.6000000238418579 } ], "ln": 65597 }, { "b": "z/bLOA^pS5r+lq)x(v\u003e?C4CYnx(v\u003e?lVM:DBy!xZBxh*^B.a0^Ab]JhB7]Mg0cqHSA+eU", "n": [ { "c": 3, "d": "Recognized sparse-logic binary marker", "i": "objectives/anti-analysis/vm-detect/instruction::sparse-logic-recognized-marker", "o": 66063, "z": 7, "cf": 0.800000011920929 } ], "ln": 66047 }, { "b": "zE^r@v%HT-ygQ)%x(v\u003e?q*ACawO\u003c4$wOb:\u0026v@#B6zu9l}z!%l3v@#B6zu9mCBy/G8vpJ\u003erx\u003eq9\u003elVl^SwD", "n": [ { "c": 2, "d": "Benign high-entropy PE context", "i": "metadata/package/quality/false-positives::benign-high-entropy-pe-context", "o": 67090, "z": 17, "cf": 0.949999988079071 } ], "ln": 67074 }, { "b": "z!@\u003c7wIc}[CYUMgB8L{@q*ACawO\u003c50wQ5qHn][]*08)#Wx(mMJz/6D4A+PPkzu9NCBAIRw0b2\u003e+uSpYV", "n": [ { "c": 3, "d": "JSON polymorphism runtime marker", "i": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "o": 68316, "z": 16, "cf": 1.0 } ], "ln": 68300 }, { "b": "z!\u003cGm0cAH9wLv2XyJTN@q*ACawO\u003c4[x(m[\u003cq*ACawO\u003c4!z!%l3v@#B6zGvB2wO#71x\u003e5+!lVl=", "n": [ { "c": 3, "d": "LINQ query operations", "i": "micro-behaviors/data/db/linq::linq-queries", "o": 68586, "z": 11, "cf": 0.699999988079071 } ], "ln": 68570 }, { "b": "B3%OKvrDydnmuyDy?mR!q*ACawO\u003c4!z!9AEz/49]z/6Dcy?mR!nM6bvz!%PdAZK+ZAa%c1ASx--Byd{SB8L(rwPyc", "n": [ { "c": 3, "d": ".NET dynamic code generation capability", "i": "metadata/lang/compiler/managed::dotnet-dynamic-code", "o": 69186, "z": 23, "cf": 0.8500000238418579 } ], "ln": 69170 }, { "b": "wN/?2ASx6VC%L$Krc-B]nP5SYA:@W1Bz(g1mRcawA::67z/eK1AaIQUBy/G5wPh:fASwW0wPIv4x(FfjASwW5zGGDgw)]gXmRMBIwjg0Iv/", "n": [ { "c": 3, "d": "Method interception capability", "i": "micro-behaviors/process/hook/interception::interceptor-comp", "o": 70153, "z": 11, "cf": 0.75 } ], "ln": 70137 }, { "b": "wO(vaC%#$1wO#N6z/fQ@q*ACawO\u003c4[x(m]ymr\u0026=(wPI{bz/fQ@B7GD2oMaAHBzkVhA@X:HBvf.Wv@Df(By^77D2Nr", "n": [ { "c": 3, "d": "LINQ expression tree manipulation", "i": "micro-behaviors/data/db/linq::linq-expressions", "o": 72541, "z": 23, "cf": 0.75 } ], "ln": 72525 }, { "b": "wPz)r0b#%%AaK6iC(N?wq#*OiwDi?Mw=Mxxwb{fvASxIFBo31PzVBUPaolM+wDl-", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 76246, "z": 3, "cf": 0.800000011920929 } ], "ln": 76230 }, { "b": "03znL0a=dx0bhBJ0bhBP0bhBK0b.^T03zn=0bhBP0b8vD0b.=V0cwiO0a=cM0aV6", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 92557, "z": 3, "cf": 0.800000011920929 } ], "ln": 92541 }, { "b": "BZ/07vq])5B9hCvz/P}xw]zYjnn\u0026PqxM4y0y*?A%e=U\u003eX0rrxWhzc\u003ctfFk3V05%#", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 96268, "z": 3, "cf": 0.800000011920929 } ], "ln": 96252 }, { "b": "zz1y\u0026wmY^\u0026BzkVhrc-B]nP5SYA:@W1Bz(gIjw]:6x(!xcA.QE)wMi}]wPH4CuTCJB000f60096", "n": [ { "c": 1, "d": "Interceptor class reference", "i": "micro-behaviors/process/hook/interception::interceptor-class", "o": 96586, "z": 11, "cf": 0.6000000238418579 } ], "ln": 96570 }, { "b": "x\u003e7N[wN\u003e^x00000zVG\u0026MnP56Mv{%E\u003cB0bNyay/tbAbP/iBzkVhaARp9BrCWswGV86A+w%9az2w2zdNQbazC)tvpJ!UB8#58y?j-czFTOvBz\u0026pzxK@q{B-.qdzGGP5vru6\u003eaAIWAwPzB7vq])5B-RbmB1NB)eDC\u00261xMOunB2\u003e%cB8UY2B1Q)uz!%lde[wKpfj\u003e", "n": [ { "c": 3, "d": "Bulk sensitive server data list", "i": "objectives/exfiltration/cloud/sync-tool::bulk-sensitive-server-data-path", "o": 96758, "z": 106, "cf": 1.0 } ], "ln": 96742 }, { "b": "z/xoe09od2004Lh0rvUcnP56Mv{%E\u003cB0bNyay/tbAbP/iBzkVhaARp9BrCWswGV86A+w%9az2w2zdNQbazC)tvpJ!UB8#58y?j-czFTOvBz\u0026pzxK@q{B-.qdzGGP5vru6\u003eaAIWAwPzB7vq])5B-RbmB0bWvBz8!sxK@q{AbY\u0026oAb]V3By=N!s5Zq-v@Dr$B1NB)a]}VIB7/05wNP4:wDh]m00970", "n": [ { "c": 1, "d": "Regex component marker", "i": "objectives/exfiltration/cloud/sync-tool::bulk-sensitive-server-data-path--rx-8", "o": 98599, "z": 128, "cf": 1.0 } ], "ln": 98583 }, { "b": ".W=.E=DtQ\u00260rr91KPkvYy/tR2By/qwqE%]/B-H#6B1Qv4B8Mhwv}wLHvpS}\u0026efF!Jv@Dy7x\u003c@Ror+lq)x(v(Lg+HEmfFk4gavyo/BAIRnj-j?NBAg/aefE=ivR/:*oj-xFz!\u0026{4jZ{uevkRKLhzEiFg?wv2iu}EFB97#ge(Dn4z/{8gwPGF4B-8qnzdMQRB8Mhwv}wOIBohBx02U+p0000008L%H", "n": [ { "c": 2, "d": "mscorlib reference", "i": "metadata/lang/compiler/managed::mscorlib", "o": 99496, "z": 128, "cf": 0.8999999761581421 } ], "ln": 99480 }, { "b": "xcpR9n([$mB7occwIa0Vl2pvQCxj)HB7GxkaARJAvqY$3Byxo5azbt0y?dPfvqYP#BA}?pB0bWvBz8!9wmPy@x(v($y-)OaBywY*ByuqazF0*czddK2z/dfdgGn40azkziwO@S0zH0vBwPhW3B7Glhvruj4zxJP", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 102834, "z": 3, "cf": 0.800000011920929 } ], "ln": 102786 }, { "b": "00000000000000000000000000000000000000315c8Xg7YTL^00000000000000000", "n": [ { "c": 1, "d": "PE resource section", "i": "metadata/binary/section/names::pe-resource-section", "o": 103936, "z": 5, "cf": 0.8999999761581421 } ], "ln": 103920 }, { "b": "0000000000004(VgYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006Xn[brp!0rro65c8X", "n": [ { "c": 3, "d": "Recognized marker for timing checks", "i": "objectives/anti-analysis/timing/evasion::timing-anti-debug-recognized-marker", "o": 104030, "z": 15, "cf": 0.949999988079071 } ], "ln": 104014 }, { "b": "Bo2\u003eLe=U\u003eK002s=5Dz?ilJz38z2!IPve$fBC(QOtve$cAwDhYg002v^xAh-DyYFnKx-HH2ASxU", "n": [ { "c": 2, "d": "PE CompanyName metadata field", "i": "metadata/package/versioning::pe-companyname-field", "o": 104382, "z": 11, "cf": 0.699999988079071 } ], "ln": 104366 }, { "b": "zuaeDe=U\u003eK003Kf9SMivmGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up002K\u0026zVB\u003eVlJy^1zVBn", "n": [ { "c": 2, "d": "PE FileDescription metadata field", "i": "metadata/package/versioning::pe-filedescription-field", "o": 104450, "z": 15, "cf": 0.699999988079071 } ], "ln": 104434 }, { "b": "Bo31PzVBUP001+O2(\u003c#amGvc5yYF2DrSDXhASydXx-J5Kzu6Up001.Nhukufh2]lefArZ9fAq7M003Kfa]?SznDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE002K\u0026zVB\u003eVlJy^1zVBnEzVBON", "n": [ { "c": 3, "d": "Dotted-quad PE version metadata marker", "i": "objectives/command-and-control/infrastructure/ip::ipv4-version-metadata-marker", "o": 104550, "z": 11, "cf": 0.9399999976158142 }, { "c": 2, "d": "PE InternalName metadata field", "i": "metadata/package/versioning::pe-internalname-field", "o": 104602, "z": 12, "cf": 0.699999988079071 } ], "ln": 104534 }, { "b": "z#+d-ASx!Nx8(PBBn#pvlJz38z#+d-ASx!Nx8(PBBo0A-Sq[4vg5%0df-Tfkaoi$[aoluXAS", "n": [ { "c": 2, "d": "Copyright notice", "i": "metadata/package/license::copyright-word", "o": 104732, "z": 9, "cf": 0.6000000238418579 } ], "ln": 104716 }, { "b": "nDrSdv/OaY003*na]?Szpxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE002K\u0026zVB\u003eVlJy^1zVBnE", "n": [ { "c": 2, "d": "PE OriginalFilename metadata field", "i": "metadata/package/versioning::pe-originalfilename-field", "o": 104826, "z": 16, "cf": 0.699999988079071 } ], "ln": 104810 }, { "b": "e=YzZyYFnK002aY4GDIfpYLIozVBqFBPt[KBo25ove$cAwDhYg002K\u0026zVB\u003eVaoj+exAh@Jv/QAEyYE(zBo2\u003eL004@TgYNKRpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001.Nhukufh2]lefArW8z#Y", "n": [ { "c": 2, "d": "PE ProductName metadata field", "i": "metadata/package/versioning::pe-productname-field", "o": 104934, "z": 11, "cf": 0.699999988079071 }, { "c": 2, "d": "PE version resource metadata", "i": "metadata/package/versioning::version-resource-metadata", "o": 104994, "z": 14, "cf": 0.8999999761581421 } ], "ln": 104918 }, { "b": "000000000000000000000i=F73\u0026*nc\u003eRAhs000000000000000000000000000000000", "n": [ { "c": 2, "d": "PE .reloc section presence", "i": "metadata/binary/section/names::reloc-section-presence", "o": 105472, "z": 6, "cf": 0.8999999761581421 } ], "ln": 105456 } ], "depth": 1, "facts": { "imp": [ [ "mscoree", "CorDllMain" ] ], "sec": [ [ ".text", 512, 103424, 6.04, "r-x" ], [ ".rsrc", 103936, 1536, 2.86, "r--" ], [ ".reloc", 105472, 512, 0.1, "r--" ] ], "metrics": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "resource_count": 1.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 169778.0, "reloc_overhang_bytes": 500.0, "reloc_overhang_ratio": 0.98, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "version.identity_entropy": 4.0, "clr.managed_resource_count": 1.0, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0, "clr.managed_resource_max_size": 4035.0, "version.identity_symbol_ratio": 0.03, "clr.managed_resource_max_entropy": 4.71 }, "file": { "size": 105984.0, "entropy": 5.98, "size_bytes": 105984.0 }, "binary": { "is_pie": 1.0, "code_entropy": 6.04, "string_count": 1202.0, "overall_entropy": 5.98, "entropy_variance": 5.89, "avg_string_length": 22.6, "max_string_length": 292.0, "peak_region_bytes": 2048.0, "code_to_data_ratio": 1.0, "peak_region_entropy": 6.68, "string_length_stddev": 20.47, "largest_section_ratio": 0.98, "sentence_string_count": 57.0, "sentence_string_ratio": 0.05, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 103424.0, "entropy_max": 6.04, "entropy_mean": 3.0, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } } }, "id": 9, "mol": "O(Al)H₂(CmDb)", "path": "HotChocolate.ApolloFederation.16.5.0-p.1.nupkg!!lib/net11.0/HotChocolate.ApolloFederation.dll", "risk": 4, "sha": "de30aebc5a44a6697e7a920e91c9905c2199bbb30aa5a79ddb9ea65fe5281a51", "size": 105984, "traits": [ { "id": "micro-behaviors/data/db/linq::system-linq-expressions", "conf": 0.6000000238418579, "crit": 3, "desc": "System.Linq.Expressions namespace", "spans": [ [ 72541, 23 ] ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "spans": [ [ 104994, 14 ] ] }, { "id": "micro-behaviors/data/db/linq::linq-queries", "conf": 0.699999988079071, "crit": 3, "desc": "LINQ query operations", "spans": [ [ 68586, 11 ], [ 72541, 11 ] ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 104030, 15 ] ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "spans": [ [ 0, 26 ] ] }, { "id": "micro-behaviors/communications/http/server/managed::http-request-get", "conf": 1.0, "crit": 3, "desc": "Access to ASP.NET Request object", "spans": [ [ 58559, 11 ] ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "spans": [ [ 25472, 4 ] ] }, { "id": "metadata/package/versioning::version-word-lower", "conf": 0.4000000059604645, "crit": 2, "desc": "version word (lowercase)", "spans": [ [ 66063, 7 ] ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "spans": [ [ 65613, 4 ] ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "spans": [ [ 104550, 11 ] ] }, { "id": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "conf": 1.0, "crit": 3, "desc": "JSON polymorphism runtime marker", "spans": [ [ 68316, 16 ] ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "spans": [ [ 25472, 4 ] ] } ], "type": "pe" }, { "id": 10, "sha": "f3d2ad1838e013632068fbfe1c75fc4fe1f52dd33ef2b4274255d440d8daa138", "path": "HotChocolate.ApolloFederation.16.5.0-p.1.nupkg!!lib/net11.0/HotChocolate.ApolloFederation.xml", "size": 137303, "type": "xml", "depth": 1 }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J\u0026m(0ji6Sa?dLD+]{51x(+zoA=kPhvqNb%vqY$3BrC47aAzQxazCZol@c-7zeP", "n": [ { "c": 3, "d": "HTTP fingerprinting evasion campaign", "i": "objectives/command-and-control/infrastructure/user-agent::http-fingerprinting-campaign", "o": 0, "z": 34, "cf": 0.8999999761581421 }, { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 78, "z": 4, "cf": 0.800000011920929 } ], "ln": 0 }, { "b": "000000000000000000002Fp6q00000nb@R\u00260SSx7TB{MNeg7w$0rr9100000/S1@L:n", "n": [ { "c": 1, "d": "PE standard code/data section", "i": "metadata/binary/section/names::pe-code-data-standard-section", "o": 512, "z": 5, "cf": 0.8999999761581421 } ], "ln": 496 }, { "b": "DK6SL1AL{\u003c00Wv!001J0lq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn", "n": [ { "c": 3, "d": "Recognized PE anti-analysis marker", "i": "objectives/anti-analysis/debugger-detect/combined-checks::evasion-aware-recognized-pe-marker", "o": 26284, "z": 4, "cf": 1.0 } ], "ln": 26268 }, { "b": "wO#71x\u003e5+!oLFM\u0026jxaG%Bzbxftu}kcD2[7sz7Xg]y\u00260V)BzkVhB1P%]zE)\u003c5v\u003eHtJ", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 59525, "z": 4, "cf": 0.800000011920929 } ], "ln": 59509 }, { "b": "ze:r5By!$.C4(2iBy!$.xjVf(qE%\u0026\u003cwPI@VvScpewN\u003e^uxMw3nnOgs#zEWl]y*?B1z/eD:ADL*", "n": [ { "c": 3, "d": "Access to ASP.NET Request object", "i": "micro-behaviors/communications/http/server/managed::http-request-get", "o": 60134, "z": 11, "cf": 1.0 } ], "ln": 60118 }, { "b": "l2Z:Uy\u0026q^OwmY^\u0026BzkVhe[w^m090SLz*a=+piyw?0b2\u003e+uSzb.090(pA+\u003e.#A+\u003e.O", "n": [ { "c": 3, "d": "References Windows executable or script", "i": "objectives/execution/interpreter/script/shell::windows-executable-ref", "o": 67272, "z": 4, "cf": 0.6000000238418579 } ], "ln": 67256 }, { "b": "z/bLOA^pS5r+lq)x(v\u003e?C4CYnx(v\u003e?lVM:DBy!xZBxh*^B.a0^Ab]JhB7]Mg0cqHSA+eU", "n": [ { "c": 3, "d": "Recognized sparse-logic binary marker", "i": "objectives/anti-analysis/vm-detect/instruction::sparse-logic-recognized-marker", "o": 67722, "z": 7, "cf": 0.800000011920929 } ], "ln": 67706 }, { "b": "zE^r@v%HT-ygQ)%x(v\u003e?q*ACawO\u003c4$wOb:\u0026v@#B6zu9l}z!%l3v@#B6zu9mCBy/G8vpJ\u003erx\u003eq9\u003elVl^SwD", "n": [ { "c": 2, "d": "Benign high-entropy PE context", "i": "metadata/package/quality/false-positives::benign-high-entropy-pe-context", "o": 68749, "z": 17, "cf": 0.949999988079071 } ], "ln": 68733 }, { "b": "z!@\u003c7wIc}[CYUMgB8L{@q*ACawO\u003c50wQ5qHn][]*08)#Wx(mMJz/6D4A+PPkzu9NCBAIRw0b2\u003e+uSpYV", "n": [ { "c": 3, "d": "JSON polymorphism runtime marker", "i": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "o": 69988, "z": 16, "cf": 1.0 } ], "ln": 69972 }, { "b": "z!\u003cGm0cAH9wLv2XyJTN@q*ACawO\u003c4[x(m[\u003cq*ACawO\u003c4!z!%l3v@#B6zGvB2wO#71x\u003e5+!lVl=", "n": [ { "c": 3, "d": "LINQ query operations", "i": "micro-behaviors/data/db/linq::linq-queries", "o": 70258, "z": 11, "cf": 0.699999988079071 } ], "ln": 70242 }, { "b": "B3%OKvrDydnmuyDy?mR!q*ACawO\u003c4!z!9AEz/49]z/6Dcy?mR!nM6bvz!%PdAZK+ZAa%c1ASx--Byd{SB8L(rwPyc", "n": [ { "c": 3, "d": ".NET dynamic code generation capability", "i": "metadata/lang/compiler/managed::dotnet-dynamic-code", "o": 70863, "z": 23, "cf": 0.8500000238418579 } ], "ln": 70847 }, { "b": "wN/?2ASx6VC%L$Krc-B]nP5SYA:@W1Bz(g1mRcawA::67z/eK1AaIQUBy/G5wPh:fASwW0wPIv4x(FfjASwW5zGGDgw)]gXmRMBIwjg0Iv/", "n": [ { "c": 3, "d": "Method interception capability", "i": "micro-behaviors/process/hook/interception::interceptor-comp", "o": 71841, "z": 11, "cf": 0.75 } ], "ln": 71825 }, { "b": "wO(vaC%#$1wO#N6z/fQ@q*ACawO\u003c4[x(m]ymr\u0026=(wPI{bz/fQ@B7GD2oMaAHBzkVhA@X:HBvf.Wv@Df(By^77D2Nr", "n": [ { "c": 3, "d": "LINQ expression tree manipulation", "i": "micro-behaviors/data/db/linq::linq-expressions", "o": 74229, "z": 23, "cf": 0.75 } ], "ln": 74213 }, { "b": "A==NbAb](owPz)r0000@q#*OiwDi?Mw=Mxxwb{fvASxIFBo31PzVBUPaolM+wDl-", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 77942, "z": 3, "cf": 0.800000011920929 } ], "ln": 77926 }, { "b": "0cncK0aV6L0cwiV03znI0b.^O0b?\u003cV0at\u003eH0a=cM0cwiO0a=cM0a=dP0b}{H0aM0", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 91069, "z": 3, "cf": 0.800000011920929 } ], "ln": 91053 }, { "b": "0at\u003eH0a=cM0at\u003cI0aM1E0bRZB0bhBJ0at\u003eH0bhBK0b.=V0b?\u003cH03znN0bhBA0bITC", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 91371, "z": 4, "cf": 0.800000011920929 } ], "ln": 91355 }, { "b": "BPuH-x-J5Kzu7^VyYFwNx8(SCv/NRKw=M\u0026KzVBROaolrWBo2$OwDl-JaolD.BPt\u003e", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 92310, "z": 3, "cf": 0.800000011920929 } ], "ln": 92294 }, { "b": "zu7^VA@ZdVwDliue=ZBKnDrSdwb{rzv/P{qBo2\u003eLA@Wr.Bo3jVaok)KzVBROz#:!RA@Y[OBo31PzVBUPaolG-xAhDvBo0A-Bo2$OwDi?MBo2.HASx.LwDl/Laok%MyYF2Dz2!bEzua+Uaol9QA@Wr.ve%^qv/Q6uA@ZmYx-IPxyYF2DaolrWzuaFMC(O@!Bn#", "n": [ { "c": 3, "d": "Bulk sensitive server data list", "i": "objectives/exfiltration/cloud/sync-tool::bulk-sensitive-server-data-path", "o": 93702, "z": 106, "cf": 1.0 } ], "ln": 93686 }, { "b": "aolJ:A@Y+KASydXe=ZCpnDrSdwb{rzv/P{qBo2\u003eLA@Wr.Bo3jVaok)KzVBROz#:!RA@Y[OBo31PzVBUPaolG-xAhDvBo0A-Bo2$OwDi?MBo2.HASx.LwDl/Laok%MyYF2Dz2!bEzua+Uaol9QA@Wr.ve%^qv/Q6uA@ZmYx-IPxyYF2DaolrWzuaFMC(O@!Bo3jVaolG-xAhPzaok*IBPuH-xAhPz", "n": [ { "c": 1, "d": "Regex component marker", "i": "objectives/exfiltration/cloud/sync-tool::bulk-sensitive-server-data-path--rx-8", "o": 93916, "z": 128, "cf": 1.0 } ], "ln": 93900 }, { "b": "zz1y\u0026wmY^\u0026BzkVhrc-B]nP5SYA:@W1Bz(gIjw]:6x(!xcA.QE)wMi}]wPH4CuTCJB000f60096", "n": [ { "c": 1, "d": "Interceptor class reference", "i": "micro-behaviors/process/hook/interception::interceptor-class", "o": 98509, "z": 11, "cf": 0.6000000238418579 } ], "ln": 98493 }, { "b": ".W=.E=DtQ\u00260rr91KPkvYy/tR2By/qwqE%]/B-H#6B1Qv4B8Mhwv}wLHvpS}\u0026efF!Jv@Dy7x\u003c@Ror+lq)x(v(Lg+HEmfFk4gavyo/BAIRnj-j?NBAg/aefE=ivR/:*oj-xFz!\u0026{4jZ{uevkRKLhzEiFg?wv2iu}EFB97#ge(Dn4z/{8gwPGF4B-8qnzdMQRB8Mhwv}wOIBohBx02U+p0000008L%H", "n": [ { "c": 2, "d": "mscorlib reference", "i": "metadata/lang/compiler/managed::mscorlib", "o": 101608, "z": 128, "cf": 0.8999999761581421 } ], "ln": 101592 }, { "b": "xcpR9n([$mB7occwIa0Vl2pvQCxj)HB7GxkaARJAvqY$3Byxo5azbt0y?dPfvqYP#BA}?pB0bWvBz8!9wmPy@x(v($y-)OaBywY*ByuqazF0*czddK2z/dfdgGn40azkziwO@S0zH0vBwPhW3B7Glhvruj4zxJP", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 104946, "z": 3, "cf": 0.800000011920929 } ], "ln": 104898 }, { "b": "00000000000000000000000000000000000000315c8Xg7YTL^00000000000000000", "n": [ { "c": 1, "d": "PE resource section", "i": "metadata/binary/section/names::pe-resource-section", "o": 106496, "z": 5, "cf": 0.8999999761581421 } ], "ln": 106480 }, { "b": "0000000000004(VgYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006Xn[brp!0rro65c8X", "n": [ { "c": 3, "d": "Recognized marker for timing checks", "i": "objectives/anti-analysis/timing/evasion::timing-anti-debug-recognized-marker", "o": 106590, "z": 15, "cf": 0.949999988079071 } ], "ln": 106574 }, { "b": "Bo2\u003eLe=U\u003eK002s=5Dz?ilJz38z2!IPve$fBC(QOtve$cAwDhYg002v^xAh-DyYFnKx-HH2ASxU", "n": [ { "c": 2, "d": "PE CompanyName metadata field", "i": "metadata/package/versioning::pe-companyname-field", "o": 106942, "z": 11, "cf": 0.699999988079071 } ], "ln": 106926 }, { "b": "zuaeDe=U\u003eK003Kf9SMivmGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up002K\u0026zVB\u003eVlJy^1zVBn", "n": [ { "c": 2, "d": "PE FileDescription metadata field", "i": "metadata/package/versioning::pe-filedescription-field", "o": 107010, "z": 15, "cf": 0.699999988079071 } ], "ln": 106994 }, { "b": "Bo31PzVBUP001+O2(\u003c#amGvc5yYF2DrSDXhASydXx-J5Kzu6Up001.Nhukufh2]lefArZ9fAq7M003Kfa]?SznDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE002K\u0026zVB\u003eVlJy^1zVBnEzVBON", "n": [ { "c": 3, "d": "Dotted-quad PE version metadata marker", "i": "objectives/command-and-control/infrastructure/ip::ipv4-version-metadata-marker", "o": 107110, "z": 11, "cf": 0.9399999976158142 }, { "c": 2, "d": "PE InternalName metadata field", "i": "metadata/package/versioning::pe-internalname-field", "o": 107162, "z": 12, "cf": 0.699999988079071 } ], "ln": 107094 }, { "b": "z#+d-ASx!Nx8(PBBn#pvlJz38z#+d-ASx!Nx8(PBBo0A-Sq[4vg5%0df-Tfkaoi$[aoluXAS", "n": [ { "c": 2, "d": "Copyright notice", "i": "metadata/package/license::copyright-word", "o": 107292, "z": 9, "cf": 0.6000000238418579 } ], "ln": 107276 }, { "b": "nDrSdv/OaY003*na]?Szpxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE002K\u0026zVB\u003eVlJy^1zVBnE", "n": [ { "c": 2, "d": "PE OriginalFilename metadata field", "i": "metadata/package/versioning::pe-originalfilename-field", "o": 107386, "z": 16, "cf": 0.699999988079071 } ], "ln": 107370 }, { "b": "e=YzZyYFnK002aY4GDIfpYLIozVBqFBPt[KBo25ove$cAwDhYg002K\u0026zVB\u003eVaoj+exAh@Jv/QAEyYE(zBo2\u003eL004@TgYNKRpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001.Nhukufh2]lefArW8z#Y", "n": [ { "c": 2, "d": "PE ProductName metadata field", "i": "metadata/package/versioning::pe-productname-field", "o": 107494, "z": 11, "cf": 0.699999988079071 }, { "c": 2, "d": "PE version resource metadata", "i": "metadata/package/versioning::version-resource-metadata", "o": 107554, "z": 14, "cf": 0.8999999761581421 } ], "ln": 107478 }, { "b": "000000000000000000000i=F73\u0026*ncc{dFf000000000000000000000000000000000", "n": [ { "c": 2, "d": "PE .reloc section presence", "i": "metadata/binary/section/names::reloc-section-presence", "o": 108032, "z": 6, "cf": 0.8999999761581421 } ], "ln": 108016 } ], "depth": 1, "facts": { "imp": [ [ "mscoree", "CorDllMain" ] ], "sec": [ [ ".text", 512, 105984, 6.02, "r-x" ], [ ".rsrc", 106496, 1536, 2.86, "r--" ], [ ".reloc", 108032, 512, 0.1, "r--" ] ], "metrics": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "resource_count": 1.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 162675.0, "reloc_overhang_bytes": 500.0, "reloc_overhang_ratio": 0.98, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "version.identity_entropy": 4.0, "clr.managed_resource_count": 1.0, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0, "clr.managed_resource_max_size": 4035.0, "version.identity_symbol_ratio": 0.03, "clr.managed_resource_max_entropy": 4.71 }, "file": { "size": 108544.0, "entropy": 5.96, "size_bytes": 108544.0 }, "binary": { "is_pie": 1.0, "code_entropy": 6.02, "string_count": 1235.0, "overall_entropy": 5.96, "entropy_variance": 5.84, "avg_string_length": 23.65, "max_string_length": 292.0, "peak_region_bytes": 2048.0, "code_to_data_ratio": 1.0, "peak_region_entropy": 6.71, "string_length_stddev": 23.21, "largest_section_ratio": 0.98, "sentence_string_count": 71.0, "sentence_string_ratio": 0.06, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 105984.0, "entropy_max": 6.02, "entropy_mean": 2.99, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } } }, "id": 11, "mol": "O(Al)H₂(CmDb)", "path": "HotChocolate.ApolloFederation.16.5.0-p.1.nupkg!!lib/net8.0/HotChocolate.ApolloFederation.dll", "risk": 4, "sha": "898500160041bc529eb92279210f39f652e41be974739ca8fef8534f459b1404", "size": 108544, "traits": [ { "id": "micro-behaviors/data/db/linq::system-linq-expressions", "conf": 0.6000000238418579, "crit": 3, "desc": "System.Linq.Expressions namespace", "spans": [ [ 74229, 23 ] ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "spans": [ [ 107554, 14 ] ] }, { "id": "micro-behaviors/data/db/linq::linq-queries", "conf": 0.699999988079071, "crit": 3, "desc": "LINQ query operations", "spans": [ [ 70258, 11 ], [ 74229, 11 ] ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 106590, 15 ] ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "spans": [ [ 0, 26 ] ] }, { "id": "micro-behaviors/communications/http/server/managed::http-request-get", "conf": 1.0, "crit": 3, "desc": "Access to ASP.NET Request object", "spans": [ [ 60134, 11 ] ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "spans": [ [ 26284, 4 ] ] }, { "id": "metadata/package/versioning::version-word-lower", "conf": 0.4000000059604645, "crit": 2, "desc": "version word (lowercase)", "spans": [ [ 67722, 7 ] ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "spans": [ [ 67272, 4 ] ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "spans": [ [ 107110, 11 ] ] }, { "id": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "conf": 1.0, "crit": 3, "desc": "JSON polymorphism runtime marker", "spans": [ [ 69988, 16 ] ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "spans": [ [ 26284, 4 ] ] } ], "type": "pe" }, { "id": 12, "sha": "f3d2ad1838e013632068fbfe1c75fc4fe1f52dd33ef2b4274255d440d8daa138", "path": "HotChocolate.ApolloFederation.16.5.0-p.1.nupkg!!lib/net8.0/HotChocolate.ApolloFederation.xml", "size": 137303, "type": "xml", "depth": 1 }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J\u0026m(0ji6Sa?dLD+]{51x(+zoA=kPhvqNb%vqY$3BrC47aAzQxazCZol@c-7zeP", "n": [ { "c": 3, "d": "HTTP fingerprinting evasion campaign", "i": "objectives/command-and-control/infrastructure/user-agent::http-fingerprinting-campaign", "o": 0, "z": 34, "cf": 0.8999999761581421 }, { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 78, "z": 4, "cf": 0.800000011920929 } ], "ln": 0 }, { "b": "000000000000000000002Fp6q00000nb@R\u00260SSx7TB{MNeg7w$0rr9100000/S1@L:n", "n": [ { "c": 1, "d": "PE standard code/data section", "i": "metadata/binary/section/names::pe-code-data-standard-section", "o": 512, "z": 5, "cf": 0.8999999761581421 } ], "ln": 496 }, { "b": "DK6SL1AL{\u003c00Wv!001J0lq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn", "n": [ { "c": 3, "d": "Recognized PE anti-analysis marker", "i": "objectives/anti-analysis/debugger-detect/combined-checks::evasion-aware-recognized-pe-marker", "o": 26284, "z": 4, "cf": 1.0 } ], "ln": 26268 }, { "b": "wO#71x\u003e5+!oLFM\u0026jxaG%Bzbxftu}kcD2[7sz7Xg]y\u00260V)BzkVhB1P%]zE)\u003c5v\u003eHtJ", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 59525, "z": 4, "cf": 0.800000011920929 } ], "ln": 59509 }, { "b": "ze:r5By!$.C4(2iBy!$.xjVf(qE%\u0026\u003cwPI@VvScpewN\u003e^uxMw3nnOgs#zEWl]y*?B1z/eD:ADL*", "n": [ { "c": 3, "d": "Access to ASP.NET Request object", "i": "micro-behaviors/communications/http/server/managed::http-request-get", "o": 60134, "z": 11, "cf": 1.0 } ], "ln": 60118 }, { "b": "l2Z:Uy\u0026q^OwmY^\u0026BzkVhe[w^m090SLz*a=+piyw?0b2\u003e+uSzb.090(pA+\u003e.#A+\u003e.O", "n": [ { "c": 3, "d": "References Windows executable or script", "i": "objectives/execution/interpreter/script/shell::windows-executable-ref", "o": 67272, "z": 4, "cf": 0.6000000238418579 } ], "ln": 67256 }, { "b": "z/bLOA^pS5r+lq)x(v\u003e?C4CYnx(v\u003e?lVM:DBy!xZBxh*^B.a0^Ab]JhB7]Mg0cqHSA+eU", "n": [ { "c": 3, "d": "Recognized sparse-logic binary marker", "i": "objectives/anti-analysis/vm-detect/instruction::sparse-logic-recognized-marker", "o": 67722, "z": 7, "cf": 0.800000011920929 } ], "ln": 67706 }, { "b": "zE^r@v%HT-ygQ)%x(v\u003e?q*ACawO\u003c4$wOb:\u0026v@#B6zu9l}z!%l3v@#B6zu9mCBy/G8vpJ\u003erx\u003eq9\u003elVl^SwD", "n": [ { "c": 2, "d": "Benign high-entropy PE context", "i": "metadata/package/quality/false-positives::benign-high-entropy-pe-context", "o": 68749, "z": 17, "cf": 0.949999988079071 } ], "ln": 68733 }, { "b": "z!@\u003c7wIc}[CYUMgB8L{@q*ACawO\u003c50wQ5qHn][]*08)#Wx(mMJz/6D4A+PPkzu9NCBAIRw0b2\u003e+uSpYV", "n": [ { "c": 3, "d": "JSON polymorphism runtime marker", "i": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "o": 69988, "z": 16, "cf": 1.0 } ], "ln": 69972 }, { "b": "z!\u003cGm0cAH9wLv2XyJTN@q*ACawO\u003c4[x(m[\u003cq*ACawO\u003c4!z!%l3v@#B6zGvB2wO#71x\u003e5+!lVl=", "n": [ { "c": 3, "d": "LINQ query operations", "i": "micro-behaviors/data/db/linq::linq-queries", "o": 70258, "z": 11, "cf": 0.699999988079071 } ], "ln": 70242 }, { "b": "B3%OKvrDydnmuyDy?mR!q*ACawO\u003c4!z!9AEz/49]z/6Dcy?mR!nM6bvz!%PdAZK+ZAa%c1ASx--Byd{SB8L(rwPyc", "n": [ { "c": 3, "d": ".NET dynamic code generation capability", "i": "metadata/lang/compiler/managed::dotnet-dynamic-code", "o": 70863, "z": 23, "cf": 0.8500000238418579 } ], "ln": 70847 }, { "b": "wN/?2ASx6VC%L$Krc-B]nP5SYA:@W1Bz(g1mRcawA::67z/eK1AaIQUBy/G5wPh:fASwW0wPIv4x(FfjASwW5zGGDgw)]gXmRMBIwjg0Iv/", "n": [ { "c": 3, "d": "Method interception capability", "i": "micro-behaviors/process/hook/interception::interceptor-comp", "o": 71841, "z": 11, "cf": 0.75 } ], "ln": 71825 }, { "b": "wO(vaC%#$1wO#N6z/fQ@q*ACawO\u003c4[x(m]ymr\u0026=(wPI{bz/fQ@B7GD2oMaAHBzkVhA@X:HBvf.Wv@Df(By^77D2Nr", "n": [ { "c": 3, "d": "LINQ expression tree manipulation", "i": "micro-behaviors/data/db/linq::linq-expressions", "o": 74229, "z": 23, "cf": 0.75 } ], "ln": 74213 }, { "b": "A==NbAb](owPz)r0000@q#*OiwDi?Mw=Mxxwb{fvASxIFBo31PzVBUPaolM+wDl-", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 77942, "z": 3, "cf": 0.800000011920929 } ], "ln": 77926 }, { "b": "0cncK0aV6L0cwiV03znI0b.^O0b?\u003cV0at\u003eH0a=cM0cwiO0a=cM0a=dP0b}{H0aM0", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 91069, "z": 3, "cf": 0.800000011920929 } ], "ln": 91053 }, { "b": "0at\u003eH0a=cM0at\u003cI0aM1E0bRZB0bhBJ0at\u003eH0bhBK0b.=V0b?\u003cH03znN0bhBA0bITC", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 91371, "z": 4, "cf": 0.800000011920929 } ], "ln": 91355 }, { "b": "BPuH-x-J5Kzu7^VyYFwNx8(SCv/NRKw=M\u0026KzVBROaolrWBo2$OwDl-JaolD.BPt\u003e", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 92310, "z": 3, "cf": 0.800000011920929 } ], "ln": 92294 }, { "b": "zu7^VA@ZdVwDliue=ZBKnDrSdwb{rzv/P{qBo2\u003eLA@Wr.Bo3jVaok)KzVBROz#:!RA@Y[OBo31PzVBUPaolG-xAhDvBo0A-Bo2$OwDi?MBo2.HASx.LwDl/Laok%MyYF2Dz2!bEzua+Uaol9QA@Wr.ve%^qv/Q6uA@ZmYx-IPxyYF2DaolrWzuaFMC(O@!Bn#", "n": [ { "c": 3, "d": "Bulk sensitive server data list", "i": "objectives/exfiltration/cloud/sync-tool::bulk-sensitive-server-data-path", "o": 93702, "z": 106, "cf": 1.0 } ], "ln": 93686 }, { "b": "aolJ:A@Y+KASydXe=ZCpnDrSdwb{rzv/P{qBo2\u003eLA@Wr.Bo3jVaok)KzVBROz#:!RA@Y[OBo31PzVBUPaolG-xAhDvBo0A-Bo2$OwDi?MBo2.HASx.LwDl/Laok%MyYF2Dz2!bEzua+Uaol9QA@Wr.ve%^qv/Q6uA@ZmYx-IPxyYF2DaolrWzuaFMC(O@!Bo3jVaolG-xAhPzaok*IBPuH-xAhPz", "n": [ { "c": 1, "d": "Regex component marker", "i": "objectives/exfiltration/cloud/sync-tool::bulk-sensitive-server-data-path--rx-8", "o": 93916, "z": 128, "cf": 1.0 } ], "ln": 93900 }, { "b": "zz1y\u0026wmY^\u0026BzkVhrc-B]nP5SYA:@W1Bz(gIjw]:6x(!xcA.QE)wMi}]wPH4CuTCJB000f60096", "n": [ { "c": 1, "d": "Interceptor class reference", "i": "micro-behaviors/process/hook/interception::interceptor-class", "o": 98509, "z": 11, "cf": 0.6000000238418579 } ], "ln": 98493 }, { "b": ".W=.E=DtQ\u00260rr91KPkvYy/tR2By/qwqE%]/B-H#6B1Qv4B8Mhwv}wLHvpS}\u0026efF!Jv@Dy7x\u003c@Ror+lq)x(v(Lg+HEmfFk4gavyo/BAIRnj-j?NBAg/aefE=ivR/:*oj-xFz!\u0026{4jZ{uevkRKLhzEiFg?wv2iu}EFB97#ge(Dn4z/{8gwPGF4B-8qnzdMQRB8Mhwv}wOIBohBx02U+p0000008L%H", "n": [ { "c": 2, "d": "mscorlib reference", "i": "metadata/lang/compiler/managed::mscorlib", "o": 101608, "z": 128, "cf": 0.8999999761581421 } ], "ln": 101592 }, { "b": "xcpR9n([$mB7occwIa0Vl2pvQCxj)HB7GxkaARJAvqY$3Byxo5azbt0y?dPfvqYP#BA}?pB0bWvBz8!9wmPy@x(v($y-)OaBywY*ByuqazF0*czddK2z/dfdgGn40azkziwO@S0zH0vBwPhW3B7Glhvruj4zxJP", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 104946, "z": 3, "cf": 0.800000011920929 } ], "ln": 104898 }, { "b": "00000000000000000000000000000000000000315c8Xg7YTL^00000000000000000", "n": [ { "c": 1, "d": "PE resource section", "i": "metadata/binary/section/names::pe-resource-section", "o": 106496, "z": 5, "cf": 0.8999999761581421 } ], "ln": 106480 }, { "b": "0000000000004(VgYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006Xn[brp!0rro65c8X", "n": [ { "c": 3, "d": "Recognized marker for timing checks", "i": "objectives/anti-analysis/timing/evasion::timing-anti-debug-recognized-marker", "o": 106590, "z": 15, "cf": 0.949999988079071 } ], "ln": 106574 }, { "b": "Bo2\u003eLe=U\u003eK002s=5Dz?ilJz38z2!IPve$fBC(QOtve$cAwDhYg002v^xAh-DyYFnKx-HH2ASxU", "n": [ { "c": 2, "d": "PE CompanyName metadata field", "i": "metadata/package/versioning::pe-companyname-field", "o": 106942, "z": 11, "cf": 0.699999988079071 } ], "ln": 106926 }, { "b": "zuaeDe=U\u003eK003Kf9SMivmGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up002K\u0026zVB\u003eVlJy^1zVBn", "n": [ { "c": 2, "d": "PE FileDescription metadata field", "i": "metadata/package/versioning::pe-filedescription-field", "o": 107010, "z": 15, "cf": 0.699999988079071 } ], "ln": 106994 }, { "b": "Bo31PzVBUP001+O2(\u003c#amGvc5yYF2DrSDXhASydXx-J5Kzu6Up001.Nhukufh2]lefArZ9fAq7M003Kfa]?SznDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE002K\u0026zVB\u003eVlJy^1zVBnEzVBON", "n": [ { "c": 3, "d": "Dotted-quad PE version metadata marker", "i": "objectives/command-and-control/infrastructure/ip::ipv4-version-metadata-marker", "o": 107110, "z": 11, "cf": 0.9399999976158142 }, { "c": 2, "d": "PE InternalName metadata field", "i": "metadata/package/versioning::pe-internalname-field", "o": 107162, "z": 12, "cf": 0.699999988079071 } ], "ln": 107094 }, { "b": "z#+d-ASx!Nx8(PBBn#pvlJz38z#+d-ASx!Nx8(PBBo0A-Sq[4vg5%0df-Tfkaoi$[aoluXAS", "n": [ { "c": 2, "d": "Copyright notice", "i": "metadata/package/license::copyright-word", "o": 107292, "z": 9, "cf": 0.6000000238418579 } ], "ln": 107276 }, { "b": "nDrSdv/OaY003*na]?Szpxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE002K\u0026zVB\u003eVlJy^1zVBnE", "n": [ { "c": 2, "d": "PE OriginalFilename metadata field", "i": "metadata/package/versioning::pe-originalfilename-field", "o": 107386, "z": 16, "cf": 0.699999988079071 } ], "ln": 107370 }, { "b": "e=YzZyYFnK002aY4GDIfpYLIozVBqFBPt[KBo25ove$cAwDhYg002K\u0026zVB\u003eVaoj+exAh@Jv/QAEyYE(zBo2\u003eL004@TgYNKRpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001.Nhukufh2]lefArW8z#Y", "n": [ { "c": 2, "d": "PE ProductName metadata field", "i": "metadata/package/versioning::pe-productname-field", "o": 107494, "z": 11, "cf": 0.699999988079071 }, { "c": 2, "d": "PE version resource metadata", "i": "metadata/package/versioning::version-resource-metadata", "o": 107554, "z": 14, "cf": 0.8999999761581421 } ], "ln": 107478 }, { "b": "000000000000000000000i=F73\u0026*ncc{dFf000000000000000000000000000000000", "n": [ { "c": 2, "d": "PE .reloc section presence", "i": "metadata/binary/section/names::reloc-section-presence", "o": 108032, "z": 6, "cf": 0.8999999761581421 } ], "ln": 108016 } ], "depth": 1, "facts": { "imp": [ [ "mscoree", "CorDllMain" ] ], "sec": [ [ ".text", 512, 105984, 6.02, "r-x" ], [ ".rsrc", 106496, 1536, 2.86, "r--" ], [ ".reloc", 108032, 512, 0.1, "r--" ] ], "metrics": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "resource_count": 1.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 171754.0, "reloc_overhang_bytes": 500.0, "reloc_overhang_ratio": 0.98, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "version.identity_entropy": 4.0, "clr.managed_resource_count": 1.0, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0, "clr.managed_resource_max_size": 4035.0, "version.identity_symbol_ratio": 0.03, "clr.managed_resource_max_entropy": 4.71 }, "file": { "size": 108544.0, "entropy": 5.96, "size_bytes": 108544.0 }, "binary": { "is_pie": 1.0, "code_entropy": 6.02, "string_count": 1235.0, "overall_entropy": 5.96, "entropy_variance": 5.84, "avg_string_length": 23.65, "max_string_length": 292.0, "peak_region_bytes": 2048.0, "code_to_data_ratio": 1.0, "peak_region_entropy": 6.71, "string_length_stddev": 23.21, "largest_section_ratio": 0.98, "sentence_string_count": 71.0, "sentence_string_ratio": 0.06, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 105984.0, "entropy_max": 6.02, "entropy_mean": 2.99, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } } }, "id": 13, "mol": "O(Al)H₂(CmDb)", "path": "HotChocolate.ApolloFederation.16.5.0-p.1.nupkg!!lib/net9.0/HotChocolate.ApolloFederation.dll", "risk": 4, "sha": "31a9d2cf531cbe71ba8be7db511d0254f4fdd6af593c40c795cd30776cc2ad5b", "size": 108544, "traits": [ { "id": "micro-behaviors/data/db/linq::system-linq-expressions", "conf": 0.6000000238418579, "crit": 3, "desc": "System.Linq.Expressions namespace", "spans": [ [ 74229, 23 ] ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "spans": [ [ 107554, 14 ] ] }, { "id": "micro-behaviors/data/db/linq::linq-queries", "conf": 0.699999988079071, "crit": 3, "desc": "LINQ query operations", "spans": [ [ 70258, 11 ], [ 74229, 11 ] ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 106590, 15 ] ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "spans": [ [ 0, 26 ] ] }, { "id": "micro-behaviors/communications/http/server/managed::http-request-get", "conf": 1.0, "crit": 3, "desc": "Access to ASP.NET Request object", "spans": [ [ 60134, 11 ] ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "spans": [ [ 26284, 4 ] ] }, { "id": "metadata/package/versioning::version-word-lower", "conf": 0.4000000059604645, "crit": 2, "desc": "version word (lowercase)", "spans": [ [ 67722, 7 ] ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "spans": [ [ 67272, 4 ] ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "spans": [ [ 107110, 11 ] ] }, { "id": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "conf": 1.0, "crit": 3, "desc": "JSON polymorphism runtime marker", "spans": [ [ 69988, 16 ] ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "spans": [ [ 26284, 4 ] ] } ], "type": "pe" }, { "id": 14, "sha": "f3d2ad1838e013632068fbfe1c75fc4fe1f52dd33ef2b4274255d440d8daa138", "path": "HotChocolate.ApolloFederation.16.5.0-p.1.nupkg!!lib/net9.0/HotChocolate.ApolloFederation.xml", "size": 137303, "type": "xml", "depth": 1 }, { "id": 15, "sha": "f4709b91a278a41b828633dbc6ed3705f6ed1f4fbaa3d7b36c6b859f8480620d", "path": "HotChocolate.ApolloFederation.16.5.0-p.1.nupkg!![Content_Types].xml", "size": 780, "type": "xml", "depth": 1 }, { "id": 16, "sha": "5b68025104a4687280fd7339e3116b6c782ffe370ab6b5dba03604455a34cfad", "path": "HotChocolate.ApolloFederation.16.5.0-p.1.nupkg!!package/services/metadata/core-properties/68396C36CD26407F41D3B9DD6A0902BC.psmdcp", "size": 710, "type": "xml", "depth": 1 }, { "id": 17, "sha": "7ba6bbf7eb99c4a27a86343856b5929044a47762072208616d8e66a4e8c8c12d", "path": "HotChocolate.ApolloFederation@16.5.0-p.1.registry.json", "size": 852, "type": "registry", "depth": 1 } ], "omitted_files": 12, "v": "8" } }