{ "llm": { "conf": 0.77668667, "grade": "benign", "model": "Qwen/Qwen3.6-27B", "review": false, "outcome": "benign", "interpretation": "Legitimate .NET NuGet package" }, "ml": { "v": "7", "eng": "2.2.0-rc.1", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.15567887, "rte": "az", "prob": 0.15567887 } ], "prob": 0.6809809, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.680980920791626, "type": "nupkg" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.000010261933311994653, "type": "xml" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.00003731250762939453, "type": "xml" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.00011619925498962402, "type": "pe" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.000020613273591152392, "type": "pe" }, { "id": 5, "lvl": -1, "conf": 0, "prob": 0.680980920791626, "type": "pe" }, { "id": 6, "lvl": -1, "conf": 0, "prob": 0.00000961621572059812, "type": "xml" }, { "id": 7, "lvl": -1, "conf": 0, "prob": 0.000010907649993896484, "type": "xml" }, { "id": 8, "lvl": -1, "conf": 0, "prob": 0.00001085797975974856, "type": "registry" } ], "version": "v18.18", "analyzed_at": "2026-06-26T18:10:43Z" }, "path": "GarageGroup.Infra.Azure.Handler.Generator.1.1.0.nupkg", "raw": { "files": [ { "id": 0, "mol": "O(Al)H₂(CmDb)", "sha": "b954209563c03693a5a785274aaff3d4ac50ab417d5a8948aaa1223c019f723a", "path": "GarageGroup.Infra.Azure.Handler.Generator.1.1.0.nupkg", "risk": 4, "size": 51453, "type": "nupkg", "facts": { "metrics": { "file": { "size": 51453.0, "entropy": 7.96, "size_bytes": 51453.0 }, "binary": { "overall_entropy": 7.96, "peak_region_bytes": 48128.0, "peak_region_entropy": 7.84 }, "archive": { "file_count": 8.0, "member_count": 8.0, "script_count": 0.0, "zip_bomb_ratio": 2.54, "directory_count": 0.0, "executable_count": 3.0, "extra_field_size": 0.0, "noise_file_count": 0.0, "total_compressed": 50097.0, "compression.ratio": 0.48, "hidden_file_count": 2.0, "total_uncompressed": 103657.0, "crc_collision_count": 0.0, "entry_comment_count": 0.0, "max_filename_length": 81.0, "rtlo_filename_count": 0.0, "format.regular_count": 8.0, "nested_archive_count": 0.0, "path_traversal_count": 0.0, "symlink_escape_count": 0.0, "security.setgid_count": 0.0, "security.setuid_count": 0.0, "security.sticky_count": 0.0, "double_extension_count": 0.0, "duplicate_member_count": 0.0, "security.symlink_count": 0.0, "unicode_filename_count": 0.0, "homoglyph_filename_count": 0.0, "security.encrypted_count": 0.0, "timing.mtime_unique_count": 5.0, "timing.mtime_unique_ratio": 0.63, "misplaced_executable_count": 3.0, "timing.mtime_dominant_count": 4.0, "timing.mtime_spread_seconds": 5996436.0, "timing.sentinel_mtime_count": 0.0, "security.world_writable_count": 0.0, "timing.mtime_dominant_fraction": 0.5, "compression.method_counts.stored": 1.0, "compression.method_counts.deflate": 7.0 } } }, "ident": { "name": { "value": "GarageGroup.Infra.Azure.Handler.Generator", "source": "nupkg.title", "verified": false }, "trust": "unsigned", "authors": [ { "name": "GarageGroup.Infra.Azure.Handler.Generator", "role": "author", "source": "nupkg.authors" } ], "version": { "value": "1.1.0", "source": "nupkg.version", "verified": false }, "identifier": { "value": "GarageGroup.Infra.Azure.Handler.Generator", "source": "nupkg.id", "verified": false } }, "traits": [ { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "from": [ { "file": 3 }, { "file": 4 }, { "file": 5 } ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "from": [ { "file": 3 } ] }, { "id": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "conf": 1.0, "crit": 3, "desc": "JSON polymorphism runtime marker", "from": [ { "file": 3 } ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/communications/http/server/managed::http-response-get", "conf": 1.0, "crit": 3, "desc": "Access to ASP.NET Response object", "from": [ { "file": 5 } ] }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "from": [ { "file": 3 } ], "spans": [ [ 0, 26 ] ] }, { "id": "micro-behaviors/data/db/linq::linq-queries", "conf": 0.699999988079071, "crit": 3, "desc": "LINQ query operations", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "from": [ { "file": 3 } ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "from": [ { "file": 3 } ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "from": [ { "file": 3 } ] } ] }, { "depth": 1, "facts": { "metrics": { "file": { "size": 531.0, "entropy": 5.18, "size_bytes": 531.0 }, "binary": { "overall_entropy": 5.18, "peak_region_bytes": 531.0, "peak_region_entropy": 5.18 } } }, "id": 1, "path": "GarageGroup.Infra.Azure.Handler.Generator.1.1.0.nupkg!!_rels/.rels", "sha": "ed15bc20b304b8208fb995412b8bc4186451d8656ace28f7b8d5e2a0ee93e8b5", "size": 531, "type": "xml" }, { "ctx": [ { "b": "[4ls%kx}3YaA?spB7]MgjT8QkfD}SJzEWP}x(mMDb6w0teJs}sj]", "n": [ { "c": 2, "d": "NuGet nuspec manifest file", "i": "metadata/build/manifest::nuspec-file", "o": 0, "z": 48, "cf": 0.9800000190734863 } ], "ln": 1, "addr": 0 }, { "b": "jAa.syHH\u003c!aB4:tzGv@+xMOuniXJdcv}YB\u003cvrj5rx\u003e8g4B8LVje[n*pfk$ufyHH\u003c\u0026zF7QTfFLmmfGgU5B-RIkv\u003eJ1EwfKh", "ln": 2, "addr": 42 }, { "b": "arS^-wPRu\u003evrt{w", "ln": 3, "addr": 118 }, { "b": "arR^HjyJwOxM4{jk1x44vp%dwA=l8te\u003eG})A:ZN^DuBmte\u003exz*wnC*$e\u003eoF\u003cwPzj3z/N@[vrDW9z/P[.", "ln": 6, "addr": 215 }, { "b": "arR^Hjy\u00262Av@=p5BzkVhk2tV$yHH\u003c!avG^Zv@=p5BzkVhjtgkRB7ol8Acb/jzAX", "ln": 7, "addr": 280 }, { "b": "arR^HjAt1Lz/YSmz/QaCBA}?pjTaJMBrR\u0026qz/6u9BuH*bg+{*DfF+QvgC}d5wNY7cfGgWxg?g5JgbSS4hzX(5wJqR8wIvZuatk[", "n": [ { "c": 2, "d": "NuGet package declares repository", "i": "metadata/package/files/nuget::nuspec-repository", "o": 335, "z": 30, "cf": 0.8999999761581421 } ], "ln": 8, "addr": 331 }, { "b": "arS^1zdN/$wmoN*j]", "ln": 9, "addr": 411 }, { "b": "jtgUZv@2H=wJ*", "ln": 10, "addr": 425 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 435.0, "entropy": 5.13, "size_bytes": 435.0 }, "binary": { "overall_entropy": 5.13, "peak_region_bytes": 435.0, "peak_region_entropy": 5.13 } } }, "id": 2, "path": "GarageGroup.Infra.Azure.Handler.Generator.1.1.0.nupkg!!GarageGroup.Infra.Azure.Handler.Generator.nuspec", "risk": 1, "sha": "8f8862cb377fea44ba9d6edceeb8cbf4491c9f7ec760407df8e271666f08eab4", "size": 435, "traits": [ { "id": "metadata/package/files/nuget::nuspec-repository", "conf": 0.8999999761581421, "crit": 2, "desc": "NuGet package declares repository", "spans": [ [ 335, 30 ] ] }, { "id": "metadata/build/manifest::nuspec-file", "conf": 0.9800000190734863, "crit": 2, "desc": "NuGet nuspec manifest file", "spans": [ [ 0, 48 ] ] } ], "type": "xml" }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J\u0026m(0ji6SaP", "n": [ { "c": 3, "d": "HTTP fingerprinting evasion campaign", "i": "objectives/command-and-control/infrastructure/user-agent::http-fingerprinting-campaign", "o": 0, "z": 34, "cf": 0.8999999761581421 } ], "ln": 0 }, { "b": "00000000000000000000tXTls00000nb@R\u00260SSx794.c\u003c\u00265Z]s0rr91000000000000", "n": [ { "c": 1, "d": "PE standard code/data section", "i": "metadata/binary/section/names::pe-code-data-standard-section", "o": 512, "z": 5, "cf": 0.8999999761581421 } ], "ln": 496 }, { "b": "0^+%*00Bb!Hx4qYdGxCGlq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn", "n": [ { "c": 3, "d": "Benign PE anti-analysis context", "i": "objectives/anti-analysis/debugger-detect/combined-checks::evasion-aware-benign-pe-context", "o": 3868, "z": 4, "cf": 1.0 } ], "ln": 3852 }, { "b": "y\u003cy8oB1P[aBy/uhx(v)ge[w^m06A53uTDMDBwu%{yYE49D2m2eyYE3@x\u003eq9\u003eq*Aj?", "n": [ { "c": 3, "d": "References Windows executable or script", "i": "objectives/execution/interpreter/script/shell::windows-executable-ref", "o": 13302, "z": 4, "cf": 0.6000000238418579 } ], "ln": 13286 }, { "b": "z/eG+A+O@#x)Kifx(v\u003e?q*ACawO\u003c4$wOb:\u0026v@#B6zu9l}z!%l3v@#B6zu9BIBw)s3AbP=swN[kOv}xR3x-", "n": [ { "c": 2, "d": "Benign high-entropy PE context", "i": "metadata/package/quality/false-positives::benign-high-entropy-pe-context", "o": 13820, "z": 17, "cf": 0.949999988079071 } ], "ln": 13804 }, { "b": "y\u00260V)BzkVhe\u003c\u003cL@C#OXZq*ACawO\u003c4[x(m[\u003cl32$DA+PA7q/u/0v}w2CwmXLS08[e:By/qwlVl=", "n": [ { "c": 3, "d": "LINQ query operations", "i": "micro-behaviors/data/db/linq::linq-queries", "o": 14042, "z": 11, "cf": 0.699999988079071 } ], "ln": 14026 }, { "b": "lJzleASyaWwDlPFBn#q7qVI7yA@ZpZwDlMEe=X\u0026JwDl@PBo0][n=S]jzVBUPe=X/IwDl-Jx-IMwyYFeH", "n": [ { "c": 3, "d": "JSON polymorphism runtime marker", "i": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "o": 16568, "z": 16, "cf": 1.0 } ], "ln": 16552 }, { "b": "00000000000000000000000000000000000000315c8Xg7YTL^00000000000000000", "n": [ { "c": 1, "d": "PE resource section", "i": "metadata/binary/section/names::pe-resource-section", "o": 19968, "z": 5, "cf": 0.8999999761581421 } ], "ln": 19952 }, { "b": "0000000000003WogYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006Xn[brp!0rrc20000", "n": [ { "c": 3, "d": "Benign context for timing checks", "i": "objectives/anti-analysis/timing/evasion::timing-anti-debug-benign-context", "o": 20062, "z": 15, "cf": 0.949999988079071 } ], "ln": 20046 }, { "b": "ASydXe=U\u003eK001RK2lj=8lJz38z2!IPve$fBC(QOtve$cAwDhYg003%rw=M=Ive%^qyxatm0049vcia5DmGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up002B/ve$rFyYF.XmGvM", "n": [ { "c": 2, "d": "PE CompanyName metadata field", "i": "metadata/package/versioning::pe-companyname-field", "o": 20554, "z": 11, "cf": 0.699999988079071 }, { "c": 2, "d": "PE FileDescription metadata field", "i": "metadata/package/versioning::pe-filedescription-field", "o": 20602, "z": 15, "cf": 0.699999988079071 } ], "ln": 20538 }, { "b": "x-J5Kzua.T001XM2MK(9mGvc5yYF2DrSDXhASydXx-J5Kzu6Up001XMe=WQae=WN9e=WN90049vdGxFHnDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE002B/ve$rFyYF.XmGvMhzuaeD", "n": [ { "c": 3, "d": "Dotted-quad PE version metadata context", "i": "objectives/command-and-control/infrastructure/ip::ipv4-version-metadata-context", "o": 20718, "z": 11, "cf": 0.9399999976158142 }, { "c": 2, "d": "PE InternalName metadata field", "i": "metadata/package/versioning::pe-internalname-field", "o": 20766, "z": 12, "cf": 0.699999988079071 } ], "ln": 20702 }, { "b": "z#+d-ASx!Nx8(PBBn#pvlJz38z#+d-ASx!Nx8(PBBo0A-Sq[4vg5%0dg5%cheDvKafAr\u003cdhu", "n": [ { "c": 2, "d": "Copyright notice", "i": "metadata/package/license::copyright-word", "o": 20912, "z": 9, "cf": 0.6000000238418579 } ], "ln": 20896 }, { "b": "B]VBXC(N*A004xDdGxFHpxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE002B/ve$rFyYF.XmGvMh", "n": [ { "c": 2, "d": "PE OriginalFilename metadata field", "i": "metadata/package/versioning::pe-originalfilename-field", "o": 21026, "z": 16, "cf": 0.699999988079071 } ], "ln": 21010 }, { "b": "e=YzZyYFnK003*ncia5DpYLIozVBqFBPt[KBo25ove$cAwDhYg002B/ve$rFyYF.XmGvMhzuae", "n": [ { "c": 2, "d": "PE ProductName metadata field", "i": "metadata/package/versioning::pe-productname-field", "o": 21150, "z": 11, "cf": 0.699999988079071 } ], "ln": 21134 }, { "b": "x-J5Kzua.T004PJf8#1MpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001XMe=WQae=WN9d/:8Whui", "n": [ { "c": 2, "d": "PE version resource metadata", "i": "metadata/package/versioning::version-resource-metadata", "o": 21258, "z": 14, "cf": 0.8999999761581421 } ], "ln": 21242 }, { "b": "000000000000000000000ak^b3\u0026*ncD].lc000000000000000000000000000000000", "n": [ { "c": 2, "d": "PE .reloc section presence", "i": "metadata/binary/section/names::reloc-section-presence", "o": 21504, "z": 6, "cf": 0.8999999761581421 } ], "ln": 21488 } ], "depth": 1, "facts": { "imp": [ [ "mscoree", "CorDllMain" ] ], "sec": [ [ ".text", 512, 19456, 5.86, "r-x" ], [ ".rsrc", 19968, 1536, 3.29, "r--" ], [ ".reloc", 21504, 512, 0.08, "r--" ] ], "metrics": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "resource_count": 1.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 70037.0, "reloc_overhang_bytes": 500.0, "reloc_overhang_ratio": 0.98, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "version.identity_entropy": 4.32, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0, "version.identity_symbol_ratio": 0.05 }, "file": { "size": 22016.0, "entropy": 5.59, "size_bytes": 22016.0 }, "binary": { "is_pie": 1.0, "code_entropy": 5.86, "string_count": 299.0, "overall_entropy": 5.59, "entropy_variance": 5.59, "avg_string_length": 23.16, "max_string_length": 152.0, "peak_region_bytes": 5120.0, "code_to_data_ratio": 1.0, "peak_region_entropy": 5.53, "string_length_stddev": 18.09, "largest_section_ratio": 0.88, "sentence_string_count": 6.0, "sentence_string_ratio": 0.02, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 19456.0, "entropy_max": 5.86, "entropy_mean": 3.08, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } } }, "id": 3, "mol": "O(Al)H(Db)", "path": "GarageGroup.Infra.Azure.Handler.Generator.1.1.0.nupkg!!analyzers/dotnet/cs/EarlyFuncPack.CodeAnalysis.Extensions.dll", "risk": 3, "sha": "3eb29dae61c11a4b4ef09a38dfeb1f963c0c3a4deb18070d6eb79396aac0c125", "size": 22016, "traits": [ { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "spans": [ [ 0, 26 ] ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "spans": [ [ 20718, 11 ] ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "spans": [ [ 13302, 4 ] ] }, { "id": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "conf": 1.0, "crit": 3, "desc": "JSON polymorphism runtime marker", "spans": [ [ 16568, 16 ] ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 20062, 15 ] ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "spans": [ [ 3868, 4 ] ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "spans": [ [ 21258, 14 ] ] }, { "id": "micro-behaviors/data/db/linq::linq-queries", "conf": 0.699999988079071, "crit": 3, "desc": "LINQ query operations", "spans": [ [ 14042, 11 ] ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "spans": [ [ 3868, 4 ] ] } ], "type": "pe" }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J\u0026m(0ji6Sa?dLD", "n": [ { "c": 3, "d": "HTTP fingerprinting evasion campaign", "i": "objectives/command-and-control/infrastructure/user-agent::http-fingerprinting-campaign", "o": 0, "z": 34, "cf": 0.8999999761581421 } ], "ln": 0 }, { "b": "00000000000000000000gcbyn00000nb@R\u00260SSx7OfXdnfCsA^0rr91000000000000", "n": [ { "c": 1, "d": "PE standard code/data section", "i": "metadata/binary/section/names::pe-code-data-standard-section", "o": 512, "z": 5, "cf": 0.8999999761581421 } ], "ln": 496 }, { "b": "DK*8R1oPF?7xsBxdGxCGlq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn", "n": [ { "c": 3, "d": "Benign PE anti-analysis context", "i": "objectives/anti-analysis/debugger-detect/combined-checks::evasion-aware-benign-pe-context", "o": 1948, "z": 4, "cf": 1.0 } ], "ln": 1932 }, { "b": "x(+[9z/{8gwKpJNy?d9$e[w^m0a]}.vqF\u003e/zdmB108[e:By/p?r+lq)x(v\u003e?mq=T6", "n": [ { "c": 3, "d": "References Windows executable or script", "i": "objectives/execution/interpreter/script/shell::windows-executable-ref", "o": 4960, "z": 4, "cf": 0.6000000238418579 } ], "ln": 4944 }, { "b": "v@#B6zBF!?A+frkx(v\u003e?q*ACawO\u003c4$wOb:\u0026v@#B6zu9QDze0G#y\u0026sg\u003elVlHDoLFxQlVl*Xvrc76z/bLNBAh8kxg3POAa9^3B8L{@q*ACawO\u003c4[x(m[\u003cmpyjMC$8{]v]cPzyC4$)wmX5AvqHjgx(+[9z/{7", "n": [ { "c": 3, "d": "LINQ query operations", "i": "micro-behaviors/data/db/linq::linq-queries", "o": 5106, "z": 11, "cf": 0.699999988079071 }, { "c": 2, "d": "Benign high-entropy PE context", "i": "metadata/package/quality/false-positives::benign-high-entropy-pe-context", "o": 5042, "z": 17, "cf": 0.949999988079071 } ], "ln": 5026 }, { "b": "00000000000000000000000000000000000000315c8Xg7YTL^00000000000000000", "n": [ { "c": 1, "d": "PE resource section", "i": "metadata/binary/section/names::pe-resource-section", "o": 7680, "z": 5, "cf": 0.8999999761581421 } ], "ln": 7664 }, { "b": "0000000000004/UgYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006Xn[brp!0rrc20000", "n": [ { "c": 3, "d": "Benign context for timing checks", "i": "objectives/anti-analysis/timing/evasion::timing-anti-debug-benign-context", "o": 7774, "z": 15, "cf": 0.949999988079071 } ], "ln": 7758 }, { "b": "zVB!TA@W/)001RK2lj=8lJz38z2!IPve$fBC(QOtve$cAwDhYg003%rw=M=Ive%^qyxatm004rBdf6wGmGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up002B/ve$rFyYF.XmGvM", "n": [ { "c": 2, "d": "PE CompanyName metadata field", "i": "metadata/package/versioning::pe-companyname-field", "o": 8266, "z": 11, "cf": 0.699999988079071 }, { "c": 2, "d": "PE FileDescription metadata field", "i": "metadata/package/versioning::pe-filedescription-field", "o": 8314, "z": 15, "cf": 0.699999988079071 } ], "ln": 8250 }, { "b": "wb{fvASu7t001XM2MK(9mGvc5yYF2DrSDXhASydXx-J5Kzu6Up001XMe=WQae=WN9e=WN9004rBeDt!KnDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE002B/ve$rFyYF.XmGvMhzuaeD", "n": [ { "c": 3, "d": "Dotted-quad PE version metadata context", "i": "objectives/command-and-control/infrastructure/ip::ipv4-version-metadata-context", "o": 8438, "z": 11, "cf": 0.9399999976158142 }, { "c": 2, "d": "PE InternalName metadata field", "i": "metadata/package/versioning::pe-internalname-field", "o": 8486, "z": 12, "cf": 0.699999988079071 } ], "ln": 8422 }, { "b": "z#+d-ASx!Nx8(PBBn#pvlJz38z#+d-ASx!Nx8(PBBo0A-Sq[4vg5%0dg5%cheDvKafAr\u003cdhu", "n": [ { "c": 2, "d": "Copyright notice", "i": "metadata/package/license::copyright-word", "o": 8640, "z": 9, "cf": 0.6000000238418579 } ], "ln": 8624 }, { "b": "B]VBXC(N*A004PJeDt!Kpxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE002B/ve$rFyYF.XmGvMh", "n": [ { "c": 2, "d": "PE OriginalFilename metadata field", "i": "metadata/package/versioning::pe-originalfilename-field", "o": 8754, "z": 16, "cf": 0.699999988079071 } ], "ln": 8738 }, { "b": "wb{ACyYBCn0043tdf6wGpYLIozVBqFBPt[KBo25ove$cAwDhYg002B/ve$rFyYF.XmGvMhzuae", "n": [ { "c": 2, "d": "PE ProductName metadata field", "i": "metadata/package/versioning::pe-productname-field", "o": 8886, "z": 11, "cf": 0.699999988079071 } ], "ln": 8870 }, { "b": "wb{fvASu7t004PJf8#1MpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001XMe=WQae=WN9d/:8Whui", "n": [ { "c": 2, "d": "PE version resource metadata", "i": "metadata/package/versioning::version-resource-metadata", "o": 9002, "z": 14, "cf": 0.8999999761581421 } ], "ln": 8986 }, { "b": "0000000000000000000005axM3\u0026*ncr5$0V000000000000000000000000000000000", "n": [ { "c": 2, "d": "PE .reloc section presence", "i": "metadata/binary/section/names::reloc-section-presence", "o": 9216, "z": 6, "cf": 0.8999999761581421 } ], "ln": 9200 } ], "depth": 1, "facts": { "imp": [ [ "mscoree", "CorDllMain" ] ], "sec": [ [ ".text", 512, 7168, 5.41, "r-x" ], [ ".rsrc", 7680, 1536, 3.34, "r--" ], [ ".reloc", 9216, 512, 0.08, "r--" ] ], "metrics": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "resource_count": 1.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 53359.0, "reloc_overhang_bytes": 500.0, "reloc_overhang_ratio": 0.98, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "version.identity_entropy": 4.36, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0, "version.identity_symbol_ratio": 0.05 }, "file": { "size": 9728.0, "entropy": 4.86, "size_bytes": 9728.0 }, "binary": { "is_pie": 1.0, "code_entropy": 5.41, "string_count": 151.0, "overall_entropy": 4.86, "entropy_variance": 4.82, "avg_string_length": 18.61, "max_string_length": 158.0, "peak_region_bytes": 3072.0, "code_to_data_ratio": 1.0, "peak_region_entropy": 5.63, "string_length_stddev": 19.64, "largest_section_ratio": 0.74, "sentence_string_count": 7.0, "sentence_string_ratio": 0.05, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 7168.0, "entropy_max": 5.41, "entropy_mean": 2.95, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } } }, "id": 4, "mol": "H(Db)", "path": "GarageGroup.Infra.Azure.Handler.Generator.1.1.0.nupkg!!analyzers/dotnet/cs/EarlyFuncPack.CodeAnalysis.SourceBuilder.dll", "risk": 2, "sha": "340a8b089d9b6164d16a0127df453ef3112e4b9399b78f8512777228c80761d1", "size": 9728, "traits": [ { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "spans": [ [ 0, 26 ] ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "spans": [ [ 8438, 11 ] ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "spans": [ [ 4960, 4 ] ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 7774, 15 ] ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "spans": [ [ 1948, 4 ] ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "spans": [ [ 9002, 14 ] ] }, { "id": "micro-behaviors/data/db/linq::linq-queries", "conf": 0.699999988079071, "crit": 3, "desc": "LINQ query operations", "spans": [ [ 5106, 11 ] ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "spans": [ [ 1948, 4 ] ] } ], "type": "pe" }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J\u0026m(0ji6Sa?dLD+(", "n": [ { "c": 3, "d": "HTTP fingerprinting evasion campaign", "i": "objectives/command-and-control/infrastructure/user-agent::http-fingerprinting-campaign", "o": 0, "z": 34, "cf": 0.8999999761581421 } ], "ln": 0 }, { "b": "00000000000000000000pvXw+00000nb@R\u00260SSx7GKB\u0026Xy(XL@0rr91000000000000", "n": [ { "c": 1, "d": "PE standard code/data section", "i": "metadata/binary/section/names::pe-code-data-standard-section", "o": 512, "z": 5, "cf": 0.8999999761581421 } ], "ln": 496 }, { "b": "EiwQ\u003e3i?$30W]w@017gQlq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn", "n": [ { "c": 3, "d": "Benign PE anti-analysis context", "i": "objectives/anti-analysis/debugger-detect/combined-checks::evasion-aware-benign-pe-context", "o": 17284, "z": 4, "cf": 1.0 } ], "ln": 17268 }, { "b": "rc-B]l${ZYy*?P:vqPMQxjVf(qE%]*z/fScrc-B]l${ZYy*?P:vqPMQA+frhz/fScrc-B]l${ZY", "n": [ { "c": 3, "d": "Access to ASP.NET Response object", "i": "micro-behaviors/communications/http/server/managed::http-response-get", "o": 36610, "z": 12, "cf": 1.0 } ], "ln": 36594 }, { "b": "vqYQ(wPxy[wO#71vruBde[w^m08vDOpiyw?07*amzdmB107/)@BzbP6q*Aj?z!]z\u003c", "n": [ { "c": 3, "d": "References Windows executable or script", "i": "objectives/execution/interpreter/script/shell::windows-executable-ref", "o": 38727, "z": 4, "cf": 0.6000000238418579 } ], "ln": 38711 }, { "b": "y**^?wKgiKz//Afx(v\u003e?q*ACawO\u003c4$wOb:\u0026v@#B6zu9l}z!%l3v@#B6zu9ZCy\u0026%qRz!%l3v@#B6zuarXBn", "n": [ { "c": 2, "d": "Benign high-entropy PE context", "i": "metadata/package/quality/false-positives::benign-high-entropy-pe-context", "o": 39240, "z": 17, "cf": 0.949999988079071 } ], "ln": 39224 }, { "b": "y\u00260V)BzkVhe\u003c\u003cL@C#OXZq*ACawO\u003c4[x(m[\u003cl32$DA+PA7q/u/0v}w2CwmXLS08[e:By/qwlVl=", "n": [ { "c": 3, "d": "LINQ query operations", "i": "micro-behaviors/data/db/linq::linq-queries", "o": 39515, "z": 11, "cf": 0.699999988079071 } ], "ln": 39499 }, { "b": "Bo3sYx-IPxBPuH-wDhYNqVI7yA@ZpZwDlMEe=X\u0026JwDl@PBo0][n=S]jzVBUP03LnvC(R)=Bo2\u003eLz2=f*", "n": [ { "c": 3, "d": "JSON polymorphism runtime marker", "i": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "o": 43716, "z": 16, "cf": 1.0 } ], "ln": 43700 }, { "b": "0cwiO0b?\u003cT0bhBV0at\u003eH0bhBK0b.^g0a=dN0a=dD04[mq0aV7D0bhBJ001C@06{Qc00", "n": [ { "c": 2, "d": "admin keyword", "i": "objectives/discovery/account/keywords::admin-keyword", "o": 44559, "z": 5, "cf": 0.20000000298023224 } ], "ln": 44543 }, { "b": "00000000000000000000000000000000000000315c8Xg7YTL^00000000000000000", "n": [ { "c": 1, "d": "PE resource section", "i": "metadata/binary/section/names::pe-resource-section", "o": 54784, "z": 5, "cf": 0.8999999761581421 } ], "ln": 54768 }, { "b": "0000000000002$3gYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006Xn[brp!0rrc20rr9", "n": [ { "c": 3, "d": "Benign context for timing checks", "i": "objectives/anti-analysis/timing/evasion::timing-anti-debug-benign-context", "o": 54878, "z": 15, "cf": 0.949999988079071 } ], "ln": 54862 }, { "b": "fAr{fvGn7Z0049vdGxFHlJz38z2!IPve$fBC(QOtve$cAwDhYg002H?ve$rFve%{uwDkj2ASy1", "n": [ { "c": 2, "d": "PE CompanyName metadata field", "i": "metadata/package/versioning::pe-companyname-field", "o": 55098, "z": 11, "cf": 0.699999988079071 } ], "ln": 55082 }, { "b": "ve$xHzVB!T004xDdGxFHmGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up002H?ve$rFve%{uwDkj", "n": [ { "c": 2, "d": "PE FileDescription metadata field", "i": "metadata/package/versioning::pe-filedescription-field", "o": 55214, "z": 15, "cf": 0.699999988079071 } ], "ln": 55198 }, { "b": "ve$xHzVB!T001XM2MK(9mGvc5yYF2DrSDXhASydXx-J5Kzu6Up001.Ne=WQae=WN9e=WN9004xDe=U[LnDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE002H?ve$rFve%{uwDkj2ASy1T", "n": [ { "c": 3, "d": "Dotted-quad PE version metadata context", "i": "objectives/command-and-control/infrastructure/ip::ipv4-version-metadata-context", "o": 55338, "z": 11, "cf": 0.9399999976158142 }, { "c": 2, "d": "PE InternalName metadata field", "i": "metadata/package/versioning::pe-internalname-field", "o": 55386, "z": 12, "cf": 0.699999988079071 } ], "ln": 55322 }, { "b": "xAibO001bw004VLe=U[Lpxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE002H?ve$rFve%{uwDkj2", "n": [ { "c": 2, "d": "PE OriginalFilename metadata field", "i": "metadata/package/versioning::pe-originalfilename-field", "o": 55550, "z": 16, "cf": 0.699999988079071 } ], "ln": 55534 }, { "b": "e=YzZyYFnK0049vdGxFHpYLIozVBqFBPt[KBo25ove$cAwDhYg002H?ve$rFve%{uwDkj2ASy1", "n": [ { "c": 2, "d": "PE ProductName metadata field", "i": "metadata/package/versioning::pe-productname-field", "o": 55682, "z": 11, "cf": 0.699999988079071 } ], "ln": 55666 }, { "b": "ve$xHzVB!T004PJf8#1MpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001.Ne=WQae=WN9d/.HdgYN", "n": [ { "c": 2, "d": "PE version resource metadata", "i": "metadata/package/versioning::version-resource-metadata", "o": 55798, "z": 14, "cf": 0.8999999761581421 } ], "ln": 55782 }, { "b": "000000000000000000000pP%*3\u0026*ncA54y[000000000000000000000000000000000", "n": [ { "c": 2, "d": "PE .reloc section presence", "i": "metadata/binary/section/names::reloc-section-presence", "o": 56320, "z": 6, "cf": 0.8999999761581421 } ], "ln": 56304 } ], "depth": 1, "facts": { "imp": [ [ "mscoree", "CorDllMain" ] ], "sec": [ [ ".text", 512, 54272, 5.89, "r-x" ], [ ".rsrc", 54784, 1536, 2.7, "r--" ], [ ".reloc", 56320, 512, 0.08, "r--" ] ], "metrics": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "resource_count": 1.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 81772.0, "reloc_overhang_bytes": 500.0, "reloc_overhang_ratio": 0.98, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "version.identity_entropy": 3.79, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0, "version.identity_symbol_ratio": 0.1 }, "file": { "size": 56832.0, "entropy": 5.77, "size_bytes": 56832.0 }, "binary": { "is_pie": 1.0, "code_entropy": 5.89, "string_count": 624.0, "overall_entropy": 5.77, "entropy_variance": 5.64, "avg_string_length": 23.42, "max_string_length": 150.0, "peak_region_bytes": 2048.0, "code_to_data_ratio": 1.0, "peak_region_entropy": 6.07, "string_length_stddev": 16.42, "largest_section_ratio": 0.95, "sentence_string_count": 17.0, "sentence_string_ratio": 0.03, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 54272.0, "entropy_max": 5.89, "entropy_mean": 2.89, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } } }, "id": 5, "mol": "O(Al)H₂(CmDb)", "path": "GarageGroup.Infra.Azure.Handler.Generator.1.1.0.nupkg!!analyzers/dotnet/cs/GarageGroup.Infra.Azure.Handler.Generator.dll", "risk": 4, "sha": "2e2adf1012b3a7f696ef4646744c30d1391537a1869ae56fce8aa548d159b215", "size": 56832, "traits": [ { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "spans": [ [ 38727, 4 ] ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "spans": [ [ 55338, 11 ] ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 54878, 15 ] ] }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "spans": [ [ 0, 26 ] ] }, { "id": "micro-behaviors/communications/http/server/managed::http-response-get", "conf": 1.0, "crit": 3, "desc": "Access to ASP.NET Response object", "spans": [ [ 36610, 12 ] ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "spans": [ [ 55798, 14 ] ] }, { "id": "micro-behaviors/data/db/linq::linq-queries", "conf": 0.699999988079071, "crit": 3, "desc": "LINQ query operations", "spans": [ [ 39515, 11 ] ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "spans": [ [ 17284, 4 ] ] }, { "id": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "conf": 1.0, "crit": 3, "desc": "JSON polymorphism runtime marker", "spans": [ [ 43716, 16 ] ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "spans": [ [ 17284, 4 ] ] } ], "type": "pe" }, { "id": 6, "sha": "3dae54f1e2761fb41379f8d05e7fdb903b62ecd0ec1c65fc68fd02c91c3671cf", "path": "GarageGroup.Infra.Azure.Handler.Generator.1.1.0.nupkg!![Content_Types].xml", "size": 459, "type": "xml", "depth": 1 }, { "id": 7, "sha": "d909c965ab5621caeadbbf46db309a74208c1040cacdbb69d6e20c9c106601a2", "path": "GarageGroup.Infra.Azure.Handler.Generator.1.1.0.nupkg!!package/services/metadata/core-properties/cf109b0446974871912a6c10af4eee80.psmdcp", "size": 670, "type": "xml", "depth": 1 }, { "id": 8, "sha": "266d85d00868ebbf2d543497e1481d1250bad59c9615f4c44b242ffff382f670", "path": "GarageGroup.Infra.Azure.Handler.Generator@1.1.0.registry.json", "size": 801, "type": "registry", "depth": 1 } ], "omitted_files": 3, "v": "8" } }