{ "llm": { "conf": 0.577528, "grade": "benign", "model": "Qwen/Qwen3.6-27B", "review": false, "outcome": "benign", "interpretation": "Legitimate .NET library assembly" }, "ml": { "v": "7", "eng": "2.2.0", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.39646852, "rte": "az", "prob": 0.39646852 }, { "cls": 0, "raw": 0.053304166, "rte": "az/nupkg", "prob": 0.053304166 } ], "prob": 0.39646852, "skip": [ { "rte": "az/zip", "why": "unavailable" }, { "rte": "az/zip", "why": "unavailable" } ], "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.39646852016448975, "type": "nupkg" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.00012001395225524902, "type": "xml" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.008743494749069214, "type": "xml" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.005262881517410278, "type": "text" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.00006663799285888672, "type": "png" }, { "id": 5, "lvl": -1, "conf": 0, "prob": 0.047495484352111816, "type": "pe" }, { "id": 6, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "xml" }, { "id": 7, "lvl": -1, "conf": 0, "prob": 0.06613007187843323, "type": "pe" }, { "id": 8, "lvl": -1, "conf": 0, "prob": 0.39646852016448975, "type": "xml" }, { "id": 9, "lvl": -1, "conf": 0, "prob": 0.047495484352111816, "type": "pe" }, { "id": 10, "lvl": -1, "conf": 0, "prob": 0.39646852016448975, "type": "xml" }, { "id": 11, "lvl": -1, "conf": 0, "prob": 0.047495484352111816, "type": "pe" }, { "id": 12, "lvl": -1, "conf": 0, "prob": 0.39646852016448975, "type": "xml" }, { "id": 13, "lvl": -1, "conf": 0, "prob": 0.39646852016448975, "type": "xml" }, { "id": 14, "lvl": -1, "conf": 0, "prob": 0.00012001395225524902, "type": "xml" }, { "id": 15, "lvl": -1, "conf": 0, "prob": 0.39646852016448975, "type": "registry" } ], "version": "v18.18", "analyzed_at": "2026-06-29T18:34:36Z" }, "path": "HotChocolate.Subscriptions.Postgres.16.4.0-p.8.nupkg", "raw": { "files": [ { "id": 0, "mol": "O(Al)H₂(CmDb)", "sha": "c22089fc7b7f63b94b499a5dace4384531cb889e38875e7a0678c0ecdc7a1def", "path": "HotChocolate.Subscriptions.Postgres.16.4.0-p.8.nupkg", "risk": 3, "size": 103294, "type": "nupkg", "facts": { "metrics": { "file": { "size": 103294.0, "entropy": 7.98, "size_bytes": 103294.0 }, "binary": { "overall_entropy": 7.98, "peak_region_bytes": 100352.0, "peak_region_entropy": 7.82 }, "archive": { "file_count": 15.0, "member_count": 15.0, "script_count": 0.0, "zip_bomb_ratio": 5.42, "directory_count": 0.0, "executable_count": 4.0, "extra_field_size": 0.0, "noise_file_count": 0.0, "total_compressed": 100934.0, "compression.ratio": 0.45, "hidden_file_count": 2.0, "total_uncompressed": 225057.0, "crc_collision_count": 3.0, "entry_comment_count": 0.0, "max_filename_length": 81.0, "rtlo_filename_count": 0.0, "format.regular_count": 15.0, "nested_archive_count": 0.0, "path_traversal_count": 0.0, "symlink_escape_count": 0.0, "security.setgid_count": 0.0, "security.setuid_count": 0.0, "security.sticky_count": 0.0, "double_extension_count": 0.0, "duplicate_member_count": 0.0, "security.symlink_count": 0.0, "unicode_filename_count": 0.0, "homoglyph_filename_count": 0.0, "security.encrypted_count": 0.0, "timing.mtime_unique_count": 2.0, "timing.mtime_unique_ratio": 0.13, "misplaced_executable_count": 4.0, "timing.mtime_outlier_count": 1.0, "timing.mtime_dominant_count": 14.0, "timing.mtime_spread_seconds": 24938.0, "timing.sentinel_mtime_count": 0.0, "security.world_writable_count": 0.0, "timing.mtime_dominant_fraction": 0.93, "compression.method_counts.stored": 1.0, "compression.method_counts.deflate": 14.0 } } }, "ident": { "name": { "value": "HotChocolate.Subscriptions.Postgres", "source": "nupkg.title", "verified": false }, "urls": [ { "url": "https://chillicream.com/", "kind": "homepage", "source": "nupkg.project_url" }, { "url": "https://github.com/ChilliCream/graphql-platform.git", "kind": "repository", "source": "nupkg.repository_url" } ], "trust": "unsigned", "authors": [ { "name": "ChilliCream authors and contributors", "role": "author", "source": "nupkg.authors" } ], "version": { "value": "16.4.0-p.8", "source": "nupkg.version", "verified": false }, "identifier": { "value": "HotChocolate.Subscriptions.Postgres", "source": "nupkg.id", "verified": false } }, "traits": [ { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/data/db/access::db-parameter-class", "conf": 0.6000000238418579, "crit": 3, "desc": "DbParameter class", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/communications/http/websocket::websocket-send-async", "atk": "T1071.001", "mbc": "C0002", "conf": 0.8199999928474426, "crit": 3, "desc": "WebSocket async send method", "from": [ { "file": 5 } ] }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "from": [ { "file": 5 } ], "spans": [ [ 0, 26 ] ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/data/db/access::db-connection-class", "conf": 0.699999988079071, "crit": 3, "desc": "DbConnection class", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/data/db/access::execute-nonquery", "conf": 0.699999988079071, "crit": 3, "desc": "ExecuteNonQuery method", "from": [ { "file": 5 } ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "from": [ { "file": 5 } ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "from": [ { "file": 5 } ] }, { "id": "objectives/anti-analysis/self-modify/runtime::dotnet-random-nextbytes-token", "atk": "T1027.005", "conf": 0.8399999737739563, "crit": 3, "desc": ".NET random byte generation", "from": [ { "file": 5 } ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "micro-behaviors/data/db/access::db-command-class", "conf": 0.699999988079071, "crit": 3, "desc": "DbCommand class", "from": [ { "file": 5 } ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "from": [ { "file": 5 }, { "file": 7 }, { "file": 9 }, { "file": 11 } ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/communications/http/websocket::websocket-connect-async", "atk": "T1071.001", "mbc": "C0002", "conf": 0.8199999928474426, "crit": 3, "desc": "WebSocket async connect method", "from": [ { "file": 5 } ] } ] }, { "id": 1, "sha": "94f028ac645649c93f9300aea3771fb64db5036e30b58ac5fa9953f1abc0ea47", "path": "HotChocolate.Subscriptions.Postgres.16.4.0-p.8.nupkg!!_rels/.rels", "size": 525, "type": "xml", "depth": 1 }, { "ctx": [ { "b": "[4ls%kx}3YaA?spB7]MgjT8QkfD}SJzEWP}x(mMDb6w0teJs}sj]", "n": [ { "c": 2, "d": "NuGet nuspec manifest file", "i": "metadata/build/manifest::nuspec-file", "o": 0, "z": 42, "cf": 0.9800000190734863 } ], "ln": 1, "addr": 0 }, { "b": "jAa.syHH\u003c!aB4:tzGv@+xMOuniXJdcv}YB\u003cvrj5rx\u003e8g4B8LVje[n*pfk$ufyHH\u003c\u0026zF7QTfFLvpfF$I3B-RIkv\u003eJ1EwfKh", "ln": 2, "addr": 42 }, { "b": "arS^-wPRu\u003evrt{w", "ln": 3, "addr": 118 }, { "b": "arR^Hjy-qGD2^RixMMB9z/x#xx\u003eIa3aI$92gb7Bxat1ZPA+fr6zGE0*xLzp0x*V]LvqNbUzEUpYfjO{tD2^RixMMA", "ln": 14, "addr": 740 }, { "b": "arR^HjAL1AB3r9mvq])SoDVYox(4Q1lVM:Dz9fE[vp%TB", "ln": 15, "addr": 812 }, { "b": "arR^HjAt1Lz/YSmz/QaCBA}?pjT9ygBvZK-a%q2Gy=@$QBAzFyiXJd0x([3hvLheez7!m\u0026x(4Q1lVM:Dz7/Kxvq][1y+oQxvrua1A=0Bwx(\u003eKwv@Dj3x((GZwht}$wh2]Iv\u003e}L7vMlnSh-iGJgCJDMgg\u0026BNh-Cn7h8O!%vkY\u00260a%nK5", "n": [ { "c": 2, "d": "NuGet package declares repository", "i": "metadata/package/files/nuget::nuspec-repository", "o": 853, "z": 91, "cf": 0.8999999761581421 } ], "ln": 16, "addr": 849 }, { "b": "arR^Hjy\u00262xwO#3\u0026zEWx(B3o", "n": [ { "c": 2, "d": "NuGet package declares dependencies", "i": "metadata/package/files/nuget::nuspec-dependencies", "o": 994, "z": 916, "cf": 0.8999999761581421 } ], "ln": 17, "addr": 990 }, { "b": "arR^HarS^VA=l8taAR4jxjVfOA:-/@Cw?IqjTa=PBtkE4fD@W", "ln": 18, "addr": 1009 }, { "b": "arR^HarR^Hjy\u00262xwO#3\u0026zEW@mx\u003efvJnn\u0026PqxM4y0y*?A%e\u003e71@v%8)cz/df{z/ff3xlwl6BzkVhe\u003cS@/BAg/1BzkVhB0q-IwPz\u003caz/dYZf/yTve?!\u003e@e\u0026U3$wQ4Z3B.25Db0{A^y?b7.zEEvbDs.bra%nK5", "ln": 19, "addr": 1049 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 2487.0, "entropy": 5.07, "size_bytes": 2487.0 }, "binary": { "overall_entropy": 5.07, "peak_region_bytes": 2487.0, "peak_region_entropy": 5.04 } } }, "id": 2, "path": "HotChocolate.Subscriptions.Postgres.16.4.0-p.8.nupkg!!HotChocolate.Subscriptions.Postgres.nuspec", "risk": 1, "sha": "de9b5bafbb178292fb2e8062aaf2ac5259d19b6714ac91e6b0a5a5c6ba84952a", "size": 2487, "traits": [ { "id": "metadata/package/files/nuget::nuspec-repository", "conf": 0.8999999761581421, "crit": 2, "desc": "NuGet package declares repository", "spans": [ [ 853, 91 ] ] }, { "id": "metadata/build/manifest::nuspec-file", "conf": 0.9800000190734863, "crit": 2, "desc": "NuGet nuspec manifest file", "spans": [ [ 0, 42 ] ] }, { "id": "metadata/package/files/nuget::nuspec-dependencies", "conf": 0.8999999761581421, "crit": 2, "desc": "NuGet package declares dependencies", "spans": [ [ 994, 916 ] ] } ], "type": "xml" }, { "id": 3, "sha": "5f6f7fb421872122ae2c7c395c0e4ed232cb5653b42215106eba532c4001b215", "path": "HotChocolate.Subscriptions.Postgres.16.4.0-p.8.nupkg!!LICENSE", "risk": 1, "size": 1083, "type": "text", "depth": 1 }, { "id": 4, "sha": "e61dd2ec3dbe645faf7479b18258213374a5104455ca72c80213c36b0ecf0fee", "path": "HotChocolate.Subscriptions.Postgres.16.4.0-p.8.nupkg!!hotchocolate-icon.png", "size": 5938, "type": "png", "depth": 1 }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J\u0026m(0ji4", "n": [ { "c": 3, "d": "HTTP fingerprinting evasion campaign", "i": "objectives/command-and-control/infrastructure/user-agent::http-fingerprinting-campaign", "o": 0, "z": 34, "cf": 0.8999999761581421 } ], "ln": 0 }, { "b": "00000000000000000000m9tMg00000nb@R\u00260SSx7KxRX+]KX760rr9100000GU^Y?so", "n": [ { "c": 1, "d": "PE standard code/data section", "i": "metadata/binary/section/names::pe-code-data-standard-section", "o": 512, "z": 5, "cf": 0.8999999761581421 } ], "ln": 496 }, { "b": "69Ypny5[qmieEUo00i{:t(T\u003cc00T#Y1@xwh00007DKZ2Q1p6n.000dum/SI@z(iNn3i$[!", "n": [ { "c": 3, "d": "Embedded LZMA compressed data", "i": "micro-behaviors/data/embedded/payload/compression::lzma-magic", "o": 7221, "z": 8, "cf": 0.699999988079071 } ], "ln": 7205 }, { "b": "huFoW000c7d4{Rv3mV2Qlq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn", "n": [ { "c": 3, "d": "Recognized PE anti-analysis marker", "i": "objectives/anti-analysis/debugger-detect/combined-checks::evasion-aware-recognized-pe-marker", "o": 15760, "z": 4, "cf": 1.0 } ], "ln": 15744 }, { "b": "BZFGi06AC7uTF1$vq[15jvs48zE)s1k4F2cf/e\u003e)pI@KrzF\u003c2}BuTkxuOKwqlsB}Dhz+y@lVl\u003cWwN/*FB9RUkk4F2cgYPT4BZFGj06AC7uTF1$vq[46jvA[8v@Dm5wN/*Cwb", "n": [ { "c": 3, "d": "WebSocket async connect method", "i": "micro-behaviors/communications/http/websocket::websocket-connect-async", "o": 27547, "z": 12, "cf": 0.8199999928474426 }, { "c": 2, "d": "base64 encoding keyword", "i": "micro-behaviors/data/encoded::base64-token", "o": 27539, "z": 6, "cf": 0.699999988079071 }, { "c": 1, "d": "Regex component marker", "i": "objectives/persistence/login/scheduled-task/com::task-scheduler-builder-methods--rx-1", "o": 27507, "z": 14, "cf": 0.8999999761581421 } ], "ln": 27491 }, { "b": "l34r?v/PqzwO%!PD2v9(pI@KrzF\u003c2}Bu%$[zESVxzC\u003e4Qz/fD7v@$1TD2v9(s7b/+l34r?v/O@xwN/\u003e8wLNeYqfuC\u003cC%MH%zESVNB9RUk090#:qE%oE0b2\u003e+uR\u003efRy\u0026r-)00", "n": [ { "c": 3, "d": "SQL command execution", "i": "micro-behaviors/data/db/access::sql-command", "o": 28092, "z": 15, "cf": 0.8500000238418579 }, { "c": 1, "d": "Regex component marker", "i": "objectives/persistence/login/scheduled-task/com::task-scheduler-builder-methods--rx-1", "o": 28050, "z": 14, "cf": 0.8999999761581421 } ], "ln": 28034 }, { "b": "z/PY6BAz88p*[S=z^^eRAaa3dz^^eRl1BHalVM:DBy^^SB-7-3wb]zylVl\u003cWwN/*@z/eG}vru6FxKL^\u003ewN\u003e^NwPRoQz/Z2kA+fqVxKL^@wO+Zvz/fD7v@#B6zBFR*vpB4!B7/b}0b2\u003e+uQFHnzF\u003c34s8@1%wPzcBz/fD7v@#B6zBFR*vpB4!B7/b}0af!YxkRc]wN\u003e^NwPRoJB3\u003cwNv}xE/wb]OHC#Fo@", "n": [ { "c": 1, "d": "Regex component marker", "i": "objectives/command-and-control/dropper/staging/encrypted::staged-payload-file-name--rx-1", "o": 28177, "z": 7, "cf": 0.8500000238418579 }, { "c": 1, "d": "Regex component marker", "i": "objectives/persistence/login/scheduled-task/com::task-scheduler-builder-methods--rx-1", "o": 28203, "z": 24, "cf": 0.8999999761581421 } ], "ln": 28161 }, { "b": "yHpBnvpK7!zF8BMwO+(Sjvs48zE)s1x(v(MyHpBnvpK7!zF8BMwO+(Sjx3xiB7ol8Acb/jzCLj[x(v)gk5jIjlsBwtx(mMMx\u003eq9\u003e06AR!zF\u003c2}BzkVhmQY!Gz/Qa!yHpBnvpK7!zF8BMwO+(Ss.RC-wb]2blVl*UvqYPQlVM:DBy^*TzeAZ0wb]wzxle6elVl*UvqYPQxjVe", "n": [ { "c": 3, "d": "DbCommand class", "i": "micro-behaviors/data/db/access::db-command-class", "o": 28873, "z": 9, "cf": 0.699999988079071 }, { "c": 1, "d": "Regex component marker", "i": "objectives/persistence/login/scheduled-task/com::task-scheduler-builder-methods--rx-1", "o": 28767, "z": 27, "cf": 0.8999999761581421 } ], "ln": 28751 }, { "b": "x(Ffdz/fRGp\u0026yz%xl4N8e[w^m08vGCB8=0@xjVf(nPXJX0blK^z2!iWByd%(B97#g", "n": [ { "c": 3, "d": "References Windows executable or script", "i": "objectives/execution/interpreter/script/shell::windows-executable-ref", "o": 31134, "z": 4, "cf": 0.6000000238418579 } ], "ln": 31118 }, { "b": "zE^r@v%HT-ygQ)%x(v\u003e?q*ACawO\u003c4$wOb:\u0026v@#B6zu9mbwPz%dv}w2Cy\u00260V)BzkVh08vGCB8=1)vrb^[wD", "n": [ { "c": 2, "d": "Benign high-entropy PE context", "i": "metadata/package/quality/false-positives::benign-high-entropy-pe-context", "o": 31426, "z": 17, "cf": 0.949999988079071 } ], "ln": 31410 }, { "b": "0cqZ[uQF:HzE)s1x(v\u003e?l$eJ4zF\u003c2}BzkVh08^xHx(4G{zGFS)xle6elVl\u003cWwN/*@z/bL/wPRoS", "n": [ { "c": 3, "d": "SQL database connection capability", "i": "micro-behaviors/data/db/access::sql-connection", "o": 31519, "z": 12, "cf": 0.8500000238418579 } ], "ln": 31503 }, { "b": "vqYQ(wPv=TxKL^?y?mR!q*ACawO\u003c4!z!9AEz/49]z/6Dcy?mR!l$e#3A:-/@By/E)ph\u003c\u0026!ACODWA:-/@By/E)s.RC-wi\u003eAFx(){b09iI", "n": [ { "c": 3, "d": ".NET dynamic code generation capability", "i": "metadata/lang/compiler/managed::dotnet-dynamic-code", "o": 32194, "z": 23, "cf": 0.8500000238418579 }, { "c": 3, "d": "Parameterized SQL queries (good practice)", "i": "micro-behaviors/data/db/access::sql-parameter", "o": 32218, "z": 11, "cf": 0.75 } ], "ln": 32178 }, { "b": "B985nwPE\u0026wwPQm:By/H[pgXV(lv0V:A@YcXvru6FxKL^\u003ewKQ=NzGFf+xla5FAa:liy!![\u003cx-", "n": [ { "c": 3, "d": ".NET random byte generation", "i": "objectives/anti-analysis/self-modify/runtime::dotnet-random-nextbytes-token", "o": 32971, "z": 9, "cf": 0.8399999737739563 } ], "ln": 32955 }, { "b": "z/Z2kA+fqVxKL^@wO-\u003eVq!o\u0026Sl34r?v)jBguOKqo089y[m[vMulUHyFz!@\u003c7wIc]7vSM41x-", "n": [ { "c": 3, "d": "WebSocket async send method", "i": "micro-behaviors/communications/http/websocket::websocket-send-async", "o": 40488, "z": 9, "cf": 0.8199999928474426 } ], "ln": 40472 }, { "b": "r0Jy6=DtQ\u00260rr91KPkvYy/tR2By/qwqE%]/B-H#6B1Qv4B8Mhwv}wLHvpS}\u0026efF!Jv@Dy7x\u003c@Ror+lq)x(v(Lg+HEmfFk4gavyo/BAIRnj-j?NBAg/aefE=ivR/:*oj-xFz!\u0026{4jZ{uevkRKLhzEiFg?wv2iu}EFB97#ge(Dn4z/{8gwPGF4B-8qnzdMQRB8Mhwv}wOIBohBx01e=b0000008L%H", "n": [ { "c": 2, "d": "mscorlib reference", "i": "metadata/lang/compiler/managed::mscorlib", "o": 42132, "z": 128, "cf": 0.8999999761581421 } ], "ln": 42116 }, { "b": "00000000000000000000000000000000000000315c8Xg7YTL^00000000000000000", "n": [ { "c": 1, "d": "PE resource section", "i": "metadata/binary/section/names::pe-resource-section", "o": 44544, "z": 5, "cf": 0.8999999761581421 } ], "ln": 44528 }, { "b": "0000000000007pEgYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006Xn[brp!0rrl55c8X", "n": [ { "c": 3, "d": "Recognized marker for timing checks", "i": "objectives/anti-analysis/timing/evasion::timing-anti-debug-recognized-marker", "o": 44638, "z": 15, "cf": 0.949999988079071 } ], "ln": 44622 }, { "b": "wDl=Ke=U\u003eK002s=5Dz?ilJz38z2!IPve$fBC(QOtve$cAwDhYg002v^xAh-DyYFnKx-HH2ASxU", "n": [ { "c": 2, "d": "PE CompanyName metadata field", "i": "metadata/package/versioning::pe-companyname-field", "o": 45022, "z": 11, "cf": 0.699999988079071 } ], "ln": 45006 }, { "b": "zuaeDe=U\u003eK003%rbME\u0026BmGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up002K\u0026zVB\u003eVlJy^1zVBn", "n": [ { "c": 2, "d": "PE FileDescription metadata field", "i": "metadata/package/versioning::pe-filedescription-field", "o": 45090, "z": 15, "cf": 0.699999988079071 } ], "ln": 45074 }, { "b": "x8(@LwDl=K001+O2(\u003c#amGvc5yYF2DrSDXhASydXx-J5Kzu6Up001.NhukufgYPcdfArZ9fAq7M003%rc\u0026:nFnDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE002K\u0026zVB\u003eVlJy^1zVBnEzVBON", "n": [ { "c": 3, "d": "Dotted-quad PE version metadata marker", "i": "objectives/command-and-control/infrastructure/ip::ipv4-version-metadata-marker", "o": 45202, "z": 11, "cf": 0.9399999976158142 }, { "c": 2, "d": "PE InternalName metadata field", "i": "metadata/package/versioning::pe-internalname-field", "o": 45254, "z": 12, "cf": 0.699999988079071 } ], "ln": 45186 }, { "b": "z#+d-ASx!Nx8(PBBn#pvlJz38z#+d-ASx!Nx8(PBBo0A-Sq[4vg5%0df-Tfkaoi$[aoluXAS", "n": [ { "c": 2, "d": "Copyright notice", "i": "metadata/package/license::copyright-word", "o": 45396, "z": 9, "cf": 0.6000000238418579 } ], "ln": 45380 }, { "b": "nDrSdv/OaY004lzc\u0026:nFpxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE002K\u0026zVB\u003eVlJy^1zVBnE", "n": [ { "c": 2, "d": "PE OriginalFilename metadata field", "i": "metadata/package/versioning::pe-originalfilename-field", "o": 45490, "z": 16, "cf": 0.699999988079071 } ], "ln": 45474 }, { "b": "e=YzZyYFnK002aY4GDIfpYLIozVBqFBPt[KBo25ove$cAwDhYg002K\u0026zVB\u003eVaoj+exAh@Jv/QAEyYE(zBo2\u003eL004@TgYNKRpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001.NhukufgYPcdfArW8z#Y", "n": [ { "c": 2, "d": "PE ProductName metadata field", "i": "metadata/package/versioning::pe-productname-field", "o": 45610, "z": 11, "cf": 0.699999988079071 }, { "c": 2, "d": "PE version resource metadata", "i": "metadata/package/versioning::version-resource-metadata", "o": 45670, "z": 14, "cf": 0.8999999761581421 } ], "ln": 45594 }, { "b": "000000000000000000000kFNm3\u0026*ncwif+\u003e000000000000000000000000000000000", "n": [ { "c": 2, "d": "PE .reloc section presence", "i": "metadata/binary/section/names::reloc-section-presence", "o": 46080, "z": 6, "cf": 0.8999999761581421 } ], "ln": 46064 } ], "depth": 1, "facts": { "imp": [ [ "mscoree", "CorDllMain" ] ], "sec": [ [ ".text", 512, 44032, 5.92, "r-x" ], [ ".rsrc", 44544, 1536, 3.0, "r--" ], [ ".reloc", 46080, 512, 0.08, "r--" ] ], "metrics": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "resource_count": 1.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 84228.0, "reloc_overhang_bytes": 500.0, "reloc_overhang_ratio": 0.98, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "version.identity_entropy": 4.24, "clr.managed_resource_count": 1.0, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0, "clr.managed_resource_max_size": 1876.0, "version.identity_symbol_ratio": 0.05, "clr.managed_resource_max_entropy": 4.63 }, "file": { "size": 46592.0, "entropy": 5.79, "size_bytes": 46592.0 }, "binary": { "is_pie": 1.0, "code_entropy": 5.92, "string_count": 507.0, "overall_entropy": 5.79, "entropy_variance": 5.69, "avg_string_length": 23.22, "max_string_length": 160.0, "peak_region_bytes": 2048.0, "code_to_data_ratio": 1.0, "peak_region_entropy": 6.14, "string_length_stddev": 20.63, "largest_section_ratio": 0.95, "sentence_string_count": 19.0, "sentence_string_ratio": 0.04, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 44032.0, "entropy_max": 5.92, "entropy_mean": 3.0, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } } }, "id": 5, "mol": "O(Al)H₂(CmDb)", "path": "HotChocolate.Subscriptions.Postgres.16.4.0-p.8.nupkg!!lib/net10.0/HotChocolate.Subscriptions.Postgres.dll", "risk": 3, "sha": "0b4f727ade38e064f197f32df62a77098c3cc75e1a05d21e463858b462dc2919", "size": 46592, "traits": [ { "id": "objectives/anti-analysis/self-modify/runtime::dotnet-random-nextbytes-token", "atk": "T1027.005", "conf": 0.8399999737739563, "crit": 3, "desc": ".NET random byte generation", "spans": [ [ 32971, 9 ] ] }, { "id": "micro-behaviors/data/db/access::db-connection-class", "conf": 0.699999988079071, "crit": 3, "desc": "DbConnection class", "spans": [ [ 31519, 12 ] ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "spans": [ [ 15760, 4 ] ] }, { "id": "micro-behaviors/data/db/access::db-parameter-class", "conf": 0.6000000238418579, "crit": 3, "desc": "DbParameter class", "spans": [ [ 32218, 11 ] ] }, { "id": "micro-behaviors/data/db/access::db-command-class", "conf": 0.699999988079071, "crit": 3, "desc": "DbCommand class", "spans": [ [ 28873, 9 ] ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "spans": [ [ 45670, 14 ] ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "spans": [ [ 31134, 4 ] ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "spans": [ [ 45202, 11 ] ] }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "spans": [ [ 0, 26 ] ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 44638, 15 ] ] }, { "id": "micro-behaviors/data/db/access::execute-nonquery", "conf": 0.699999988079071, "crit": 3, "desc": "ExecuteNonQuery method", "spans": [ [ 28092, 15 ] ] }, { "id": "micro-behaviors/communications/http/websocket::websocket-send-async", "atk": "T1071.001", "mbc": "C0002", "conf": 0.8199999928474426, "crit": 3, "desc": "WebSocket async send method", "spans": [ [ 40488, 9 ] ] }, { "id": "micro-behaviors/communications/http/websocket::websocket-connect-async", "atk": "T1071.001", "mbc": "C0002", "conf": 0.8199999928474426, "crit": 3, "desc": "WebSocket async connect method", "spans": [ [ 27547, 12 ] ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "spans": [ [ 15760, 4 ] ] } ], "type": "pe" }, { "id": 6, "sha": "c69dfc153a9ebece0ef559d9d0568272b2c05c2f06f308200354492d1f2e1a07", "path": "HotChocolate.Subscriptions.Postgres.16.4.0-p.8.nupkg!!lib/net10.0/HotChocolate.Subscriptions.Postgres.xml", "size": 7924, "type": "xml", "depth": 1 }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J\u0026m(0ji4", "n": [ { "c": 3, "d": "HTTP fingerprinting evasion campaign", "i": "objectives/command-and-control/infrastructure/user-agent::http-fingerprinting-campaign", "o": 0, "z": 34, "cf": 0.8999999761581421 } ], "ln": 0 }, { "b": "00000000000000000000nqvfB00000nb@R\u00260SSx7bSC=7wjuL00rr9100000H\u003c/s7so", "n": [ { "c": 1, "d": "PE standard code/data section", "i": "metadata/binary/section/names::pe-code-data-standard-section", "o": 512, "z": 5, "cf": 0.8999999761581421 } ], "ln": 496 }, { "b": "000c6DRszt1oQ51000iMlq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn", "n": [ { "c": 3, "d": "Recognized PE anti-analysis marker", "i": "objectives/anti-analysis/debugger-detect/combined-checks::evasion-aware-recognized-pe-marker", "o": 6692, "z": 4, "cf": 1.0 } ], "ln": 6676 }, { "b": "zF\u003c34u[}ZFv@#B6zEtj1lsB}Dhz+zDwPRoVr7n?EB6\u003c6iw\u0026G=Mj#\u0026Q9o(BM+y?k^gq#=", "n": [ { "c": 2, "d": "base64 encoding keyword", "i": "micro-behaviors/data/encoded::base64-token", "o": 13845, "z": 6, "cf": 0.699999988079071 } ], "ln": 13829 }, { "b": "l34r?v/PqzwO%!PD2v9(pI@KrzF\u003c2}Bu%$[zESVxzC\u003e4Qz/fD7v@$1TD2v9(s7b/+l34r?v/O@xwN/\u003e8wLNeYqfuC\u003cC%MH%zESVNB9RUk090#:qE%oE0b2\u003e+uR\u003efRy\u0026r-)00", "n": [ { "c": 3, "d": "SQL command execution", "i": "micro-behaviors/data/db/access::sql-command", "o": 14147, "z": 15, "cf": 0.8500000238418579 }, { "c": 1, "d": "Regex component marker", "i": "objectives/persistence/login/scheduled-task/com::task-scheduler-builder-methods--rx-1", "o": 14105, "z": 14, "cf": 0.8999999761581421 } ], "ln": 14089 }, { "b": "z/PY6BAz88p*[S=z^^eRAaa3dz^^eRl1BHalVM:DBy^^SB-7-3wb]zylVl\u003cWwN/*@z/eG}vru6FxKL^\u003ewN\u003e^NwPRoQz/Z2kA+fqVxKL^@wO+Zvz/fD7v@#B6zBFR*vpB4!B7/b}0b2\u003e+uQFHnzF\u003c34s8@1%wPzcBz/fD7v@#B6zBFR*vpB4!B7/b}0af!YxkRc]wN\u003e^NwPRoJB3\u003cwNv}xE/wb]OHC#Fo@", "n": [ { "c": 1, "d": "Regex component marker", "i": "objectives/command-and-control/dropper/staging/encrypted::staged-payload-file-name--rx-1", "o": 14232, "z": 7, "cf": 0.8500000238418579 }, { "c": 1, "d": "Regex component marker", "i": "objectives/persistence/login/scheduled-task/com::task-scheduler-builder-methods--rx-1", "o": 14258, "z": 24, "cf": 0.8999999761581421 } ], "ln": 14216 }, { "b": "yHpBnvpK7!zF8BMwO+(Sjvs48zE)s1x(v(MyHpBnvpK7!zF8BMwO+(Sjx3xiB7ol8Acb/jzCLj[x(v)gk5jIjlsBwtx(mMMx\u003eq9\u003e06AR!zF\u003c2}BzkVhmQY!Gz/Qa!yHpBnvpK7!zF8BMwO+(Ss.RC-wb]2blVl*UvqYPQlVM:DBy^*TzeAZ0wb]wzxle6elVl*UvqYPQxjVe", "n": [ { "c": 3, "d": "DbCommand class", "i": "micro-behaviors/data/db/access::db-command-class", "o": 14905, "z": 9, "cf": 0.699999988079071 }, { "c": 1, "d": "Regex component marker", "i": "objectives/persistence/login/scheduled-task/com::task-scheduler-builder-methods--rx-1", "o": 14799, "z": 27, "cf": 0.8999999761581421 } ], "ln": 14783 }, { "b": "AZB!+Cxmh4y?lK!vru5XlVl\u003cWwN/*@z/eG}vru5XxjVf(lV)A\u0026wO#P*Byxo507gWwAbo9cwDkXIC#]1", "n": [ { "c": 1, "d": "Regex component marker", "i": "objectives/persistence/login/scheduled-task/com::task-scheduler-builder-methods--rx-1", "o": 15730, "z": 15, "cf": 0.8999999761581421 } ], "ln": 15714 }, { "b": "x(Ffdz/fRGp\u0026yz%xl4N8e[w^m08vGCB8=0@xjVf(nPXJX0blK^z2!iWByd%(B97#g", "n": [ { "c": 3, "d": "References Windows executable or script", "i": "objectives/execution/interpreter/script/shell::windows-executable-ref", "o": 17056, "z": 4, "cf": 0.6000000238418579 } ], "ln": 17040 }, { "b": "zE^r@v%HT-ygQ)%x(v\u003e?q*ACawO\u003c4$wOb:\u0026v@#B6zu9mbwPz%dv}w2Cy\u00260V)BzkVh08vGCB8=1)vrb^[wPRH7lVl^SwN/*@z/bL/wPRoDz/fD7v@#B6zua-?BydyNzF\u003c2}BzkVh07po-z/fD7v@#B6zu9NCB7]D8wO#P+Aa:liy^SbUzE)s1x(v\u003e?xjVf(qu", "n": [ { "c": 3, "d": "SQL database connection capability", "i": "micro-behaviors/data/db/access::sql-connection", "o": 17441, "z": 12, "cf": 0.8500000238418579 }, { "c": 2, "d": "Benign high-entropy PE context", "i": "metadata/package/quality/false-positives::benign-high-entropy-pe-context", "o": 17348, "z": 17, "cf": 0.949999988079071 }, { "c": 1, "d": "Regex component marker", "i": "objectives/persistence/login/scheduled-task/com::task-scheduler-builder-methods--rx-1", "o": 17411, "z": 14, "cf": 0.8999999761581421 } ], "ln": 17332 }, { "b": "vqYQ(wPv=TxKL^?y?mR!q*ACawO\u003c4!z!9AEz/49]z/6Dcy?mR!l$e#3A:-/@By/E)ph\u003c\u0026!ACODWA:-/@By/E)s.RC-wi\u003eAFx(){b07QP", "n": [ { "c": 3, "d": ".NET dynamic code generation capability", "i": "metadata/lang/compiler/managed::dotnet-dynamic-code", "o": 18047, "z": 23, "cf": 0.8500000238418579 }, { "c": 3, "d": "Parameterized SQL queries (good practice)", "i": "micro-behaviors/data/db/access::sql-parameter", "o": 18071, "z": 11, "cf": 0.75 } ], "ln": 18031 }, { "b": "B985nwPE\u0026wwPQm:By/H[pgXV(lv0V:A@YcXvru6FxKL^\u003ewKQ=NzGFf+xla5FAa:liy!![\u003cx-", "n": [ { "c": 3, "d": ".NET random byte generation", "i": "objectives/anti-analysis/self-modify/runtime::dotnet-random-nextbytes-token", "o": 18826, "z": 9, "cf": 0.8399999737739563 } ], "ln": 18810 }, { "b": "r0Jy6=DtQ\u00260rr91KPkvYy/tR2By/qwqE%]/B-H#6B1Qv4B8Mhwv}wLHvpS}\u0026efF!Jv@Dy7x\u003c@Ror+lq)x(v(Lg+HEmfFk4gavyo/BAIRnj-j?NBAg/aefE=ivR/:*oj-xFz!\u0026{4jZ{uevkRKLhzEiFg?wv2iu}EFB97#ge(Dn4z/{8gwPGF4B-8qnzdMQRB8Mhwv}wOIBohBx01e=b0000008L%H", "n": [ { "c": 2, "d": "mscorlib reference", "i": "metadata/lang/compiler/managed::mscorlib", "o": 24728, "z": 128, "cf": 0.8999999761581421 } ], "ln": 24712 }, { "b": "00000000000000000000000000000000000000315c8Xg7YTL^00000000000000000", "n": [ { "c": 1, "d": "PE resource section", "i": "metadata/binary/section/names::pe-resource-section", "o": 27136, "z": 5, "cf": 0.8999999761581421 } ], "ln": 27120 }, { "b": "0000000000007pEgYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006Xn[brp!0rrl55c8X", "n": [ { "c": 3, "d": "Recognized marker for timing checks", "i": "objectives/anti-analysis/timing/evasion::timing-anti-debug-recognized-marker", "o": 27230, "z": 15, "cf": 0.949999988079071 } ], "ln": 27214 }, { "b": "wDl=Ke=U\u003eK002s=5Dz?ilJz38z2!IPve$fBC(QOtve$cAwDhYg002v^xAh-DyYFnKx-HH2ASxU", "n": [ { "c": 2, "d": "PE CompanyName metadata field", "i": "metadata/package/versioning::pe-companyname-field", "o": 27614, "z": 11, "cf": 0.699999988079071 } ], "ln": 27598 }, { "b": "zuaeDe=U\u003eK003%rbME\u0026BmGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up002K\u0026zVB\u003eVlJy^1zVBn", "n": [ { "c": 2, "d": "PE FileDescription metadata field", "i": "metadata/package/versioning::pe-filedescription-field", "o": 27682, "z": 15, "cf": 0.699999988079071 } ], "ln": 27666 }, { "b": "x8(@LwDl=K001+O2(\u003c#amGvc5yYF2DrSDXhASydXx-J5Kzu6Up001.NhukufgYPcdfArZ9fAq7M003%rc\u0026:nFnDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE002K\u0026zVB\u003eVlJy^1zVBnEzVBON", "n": [ { "c": 3, "d": "Dotted-quad PE version metadata marker", "i": "objectives/command-and-control/infrastructure/ip::ipv4-version-metadata-marker", "o": 27794, "z": 11, "cf": 0.9399999976158142 }, { "c": 2, "d": "PE InternalName metadata field", "i": "metadata/package/versioning::pe-internalname-field", "o": 27846, "z": 12, "cf": 0.699999988079071 } ], "ln": 27778 }, { "b": "z#+d-ASx!Nx8(PBBn#pvlJz38z#+d-ASx!Nx8(PBBo0A-Sq[4vg5%0df-Tfkaoi$[aoluXAS", "n": [ { "c": 2, "d": "Copyright notice", "i": "metadata/package/license::copyright-word", "o": 27988, "z": 9, "cf": 0.6000000238418579 } ], "ln": 27972 }, { "b": "nDrSdv/OaY004lzc\u0026:nFpxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE002K\u0026zVB\u003eVlJy^1zVBnE", "n": [ { "c": 2, "d": "PE OriginalFilename metadata field", "i": "metadata/package/versioning::pe-originalfilename-field", "o": 28082, "z": 16, "cf": 0.699999988079071 } ], "ln": 28066 }, { "b": "e=YzZyYFnK002aY4GDIfpYLIozVBqFBPt[KBo25ove$cAwDhYg002K\u0026zVB\u003eVaoj+exAh@Jv/QAEyYE(zBo2\u003eL004@TgYNKRpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001.NhukufgYPcdfArW8z#Y", "n": [ { "c": 2, "d": "PE ProductName metadata field", "i": "metadata/package/versioning::pe-productname-field", "o": 28202, "z": 11, "cf": 0.699999988079071 }, { "c": 2, "d": "PE version resource metadata", "i": "metadata/package/versioning::version-resource-metadata", "o": 28262, "z": 14, "cf": 0.8999999761581421 } ], "ln": 28186 }, { "b": "000000000000000000000dU4H3\u0026*ncxG2[\u003e000000000000000000000000000000000", "n": [ { "c": 2, "d": "PE .reloc section presence", "i": "metadata/binary/section/names::reloc-section-presence", "o": 28672, "z": 6, "cf": 0.8999999761581421 } ], "ln": 28656 } ], "depth": 1, "facts": { "imp": [ [ "mscoree", "CorDllMain" ] ], "sec": [ [ ".text", 512, 26624, 5.84, "r-x" ], [ ".rsrc", 27136, 1536, 3.0, "r--" ], [ ".reloc", 28672, 512, 0.08, "r--" ] ], "metrics": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "resource_count": 1.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 87054.0, "reloc_overhang_bytes": 500.0, "reloc_overhang_ratio": 0.98, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "version.identity_entropy": 4.24, "clr.managed_resource_count": 1.0, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0, "clr.managed_resource_max_size": 1876.0, "version.identity_symbol_ratio": 0.05, "clr.managed_resource_max_entropy": 4.63 }, "file": { "size": 29184.0, "entropy": 5.63, "size_bytes": 29184.0 }, "binary": { "is_pie": 1.0, "code_entropy": 5.84, "string_count": 446.0, "overall_entropy": 5.63, "entropy_variance": 5.53, "avg_string_length": 20.53, "max_string_length": 160.0, "peak_region_bytes": 4096.0, "code_to_data_ratio": 1.0, "peak_region_entropy": 5.72, "string_length_stddev": 17.63, "largest_section_ratio": 0.91, "sentence_string_count": 19.0, "sentence_string_ratio": 0.04, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 26624.0, "entropy_max": 5.84, "entropy_mean": 2.98, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } } }, "id": 7, "mol": "O(Al)H(Db)", "path": "HotChocolate.Subscriptions.Postgres.16.4.0-p.8.nupkg!!lib/net11.0/HotChocolate.Subscriptions.Postgres.dll", "risk": 2, "sha": "20b1577ab2e57e389eb50385867e06c0cde0504f9bbe4128d75882c2188f52a9", "size": 29184, "traits": [ { "id": "objectives/anti-analysis/self-modify/runtime::dotnet-random-nextbytes-token", "atk": "T1027.005", "conf": 0.8399999737739563, "crit": 3, "desc": ".NET random byte generation", "spans": [ [ 18826, 9 ] ] }, { "id": "micro-behaviors/data/db/access::db-connection-class", "conf": 0.699999988079071, "crit": 3, "desc": "DbConnection class", "spans": [ [ 17441, 12 ] ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "spans": [ [ 6692, 4 ] ] }, { "id": "micro-behaviors/data/db/access::db-parameter-class", "conf": 0.6000000238418579, "crit": 3, "desc": "DbParameter class", "spans": [ [ 18071, 11 ] ] }, { "id": "micro-behaviors/data/db/access::db-command-class", "conf": 0.699999988079071, "crit": 3, "desc": "DbCommand class", "spans": [ [ 14905, 9 ] ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "spans": [ [ 28262, 14 ] ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "spans": [ [ 17056, 4 ] ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "spans": [ [ 27794, 11 ] ] }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "spans": [ [ 0, 26 ] ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 27230, 15 ] ] }, { "id": "micro-behaviors/data/db/access::execute-nonquery", "conf": 0.699999988079071, "crit": 3, "desc": "ExecuteNonQuery method", "spans": [ [ 14147, 15 ] ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "spans": [ [ 6692, 4 ] ] } ], "type": "pe" }, { "id": 8, "sha": "c69dfc153a9ebece0ef559d9d0568272b2c05c2f06f308200354492d1f2e1a07", "path": "HotChocolate.Subscriptions.Postgres.16.4.0-p.8.nupkg!!lib/net11.0/HotChocolate.Subscriptions.Postgres.xml", "size": 7924, "type": "xml", "depth": 1 }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J\u0026m(0ji4", "n": [ { "c": 3, "d": "HTTP fingerprinting evasion campaign", "i": "objectives/command-and-control/infrastructure/user-agent::http-fingerprinting-campaign", "o": 0, "z": 34, "cf": 0.8999999761581421 } ], "ln": 0 }, { "b": "000000000000000000006uZvQ00000nb@R\u00260SSx7PJ.x@V$opr0rr9100000rkFRnso", "n": [ { "c": 1, "d": "PE standard code/data section", "i": "metadata/binary/section/names::pe-code-data-standard-section", "o": 512, "z": 5, "cf": 0.8999999761581421 } ], "ln": 496 }, { "b": "69Ypny5[qmieEUo00i{:t(T\u003cc00T#Y1@xwh00007DKZ2Q1p6n.000dum/SI@z\u003e)vk3i$[!", "n": [ { "c": 3, "d": "Embedded LZMA compressed data", "i": "micro-behaviors/data/embedded/payload/compression::lzma-magic", "o": 7237, "z": 8, "cf": 0.699999988079071 } ], "ln": 7221 }, { "b": "huFoW000c7d4Qzs3mV2Qlq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn", "n": [ { "c": 3, "d": "Recognized PE anti-analysis marker", "i": "objectives/anti-analysis/debugger-detect/combined-checks::evasion-aware-recognized-pe-marker", "o": 15776, "z": 4, "cf": 1.0 } ], "ln": 15760 }, { "b": "Y:DZ#EGWH}763C%-TrKZ4/$2+766i[*6X8+Qylb\u003c1]$za(\u003cB0$oBN:21{1AjKot:/1r1-T", "n": [ { "c": 2, "d": "XGETBV instruction bytes", "i": "metadata/binary/instruction::xgetbv-instr", "o": 17744, "z": 8, "cf": 0.30000001192092896 } ], "ln": 17728 }, { "b": "BZFGi06AC7uTF1$vq[15jvs48zE)s1k4F2cf/e\u003e)pI@KrzF\u003c2}BuTkxuOKwqlsB}Dhz+y@lVl\u003cWwN/*FB9RUkk4F2cgYPT4BZFGj06AC7uTF1$vq[46jvA[8v@Dm5wN/*Cwb", "n": [ { "c": 3, "d": "WebSocket async connect method", "i": "micro-behaviors/communications/http/websocket::websocket-connect-async", "o": 27531, "z": 12, "cf": 0.8199999928474426 }, { "c": 2, "d": "base64 encoding keyword", "i": "micro-behaviors/data/encoded::base64-token", "o": 27523, "z": 6, "cf": 0.699999988079071 }, { "c": 1, "d": "Regex component marker", "i": "objectives/persistence/login/scheduled-task/com::task-scheduler-builder-methods--rx-1", "o": 27491, "z": 14, "cf": 0.8999999761581421 } ], "ln": 27475 }, { "b": "l34r?v/PqzwO%!PD2v9(pI@KrzF\u003c2}Bu%$[zESVxzC\u003e4Qz/fD7v@$1TD2v9(s7b/+l34r?v/O@xwN/\u003e8wLNeYqfuC\u003cC%MH%zESVNB9RUk090#:qE%oE0b2\u003e+uR\u003efRy\u0026r-)00", "n": [ { "c": 3, "d": "SQL command execution", "i": "micro-behaviors/data/db/access::sql-command", "o": 28076, "z": 15, "cf": 0.8500000238418579 }, { "c": 1, "d": "Regex component marker", "i": "objectives/persistence/login/scheduled-task/com::task-scheduler-builder-methods--rx-1", "o": 28034, "z": 14, "cf": 0.8999999761581421 } ], "ln": 28018 }, { "b": "z/PY6BAz88p*[S=z^^eRAaa3dz^^eRl1BHalVM:DBy^^SB-7-3wb]zylVl\u003cWwN/*@z/eG}vru6FxKL^\u003ewN\u003e^NwPRoQz/Z2kA+fqVxKL^@wO+Zvz/fD7v@#B6zBFR*vpB4!B7/b}0b2\u003e+uQFHnzF\u003c34s8@1%wPzcBz/fD7v@#B6zBFR*vpB4!B7/b}0af!YxkRc]wN\u003e^NwPRoJB3\u003cwNv}xE/wb]OHC#Fo@", "n": [ { "c": 1, "d": "Regex component marker", "i": "objectives/command-and-control/dropper/staging/encrypted::staged-payload-file-name--rx-1", "o": 28161, "z": 7, "cf": 0.8500000238418579 }, { "c": 1, "d": "Regex component marker", "i": "objectives/persistence/login/scheduled-task/com::task-scheduler-builder-methods--rx-1", "o": 28187, "z": 24, "cf": 0.8999999761581421 } ], "ln": 28145 }, { "b": "yHpBnvpK7!zF8BMwO+(Sjvs48zE)s1x(v(MyHpBnvpK7!zF8BMwO+(Sjx3xiB7ol8Acb/jzCLj[x(v)gk5jIjlsBwtx(mMMx\u003eq9\u003e06AR!zF\u003c2}BzkVhmQY!Gz/Qa!yHpBnvpK7!zF8BMwO+(Ss.RC-wb]2blVl*UvqYPQlVM:DBy^*TzeAZ0wb]wzxle6elVl*UvqYPQxjVe", "n": [ { "c": 3, "d": "DbCommand class", "i": "micro-behaviors/data/db/access::db-command-class", "o": 28857, "z": 9, "cf": 0.699999988079071 }, { "c": 1, "d": "Regex component marker", "i": "objectives/persistence/login/scheduled-task/com::task-scheduler-builder-methods--rx-1", "o": 28751, "z": 27, "cf": 0.8999999761581421 } ], "ln": 28735 }, { "b": "x(Ffdz/fRGp\u0026yz%xl4N8e[w^m08vGCB8=0@xjVf(nPXJX0blK^z2!iWByd%(B97#g", "n": [ { "c": 3, "d": "References Windows executable or script", "i": "objectives/execution/interpreter/script/shell::windows-executable-ref", "o": 31102, "z": 4, "cf": 0.6000000238418579 } ], "ln": 31086 }, { "b": "zE^r@v%HT-ygQ)%x(v\u003e?q*ACawO\u003c4$wOb:\u0026v@#B6zu9mbwPz%dv}w2Cy\u00260V)BzkVh08vGCB8=1)vrb^[wD", "n": [ { "c": 2, "d": "Benign high-entropy PE context", "i": "metadata/package/quality/false-positives::benign-high-entropy-pe-context", "o": 31394, "z": 17, "cf": 0.949999988079071 } ], "ln": 31378 }, { "b": "0cqZ[uQF:HzE)s1x(v\u003e?l$eJ4zF\u003c2}BzkVh08^xHx(4G{zGFS)xle6elVl\u003cWwN/*@z/bL/wPRoS", "n": [ { "c": 3, "d": "SQL database connection capability", "i": "micro-behaviors/data/db/access::sql-connection", "o": 31487, "z": 12, "cf": 0.8500000238418579 } ], "ln": 31471 }, { "b": "vqYQ(wPv=TxKL^?y?mR!q*ACawO\u003c4!z!9AEz/49]z/6Dcy?mR!l$e#3A:-/@By/E)ph\u003c\u0026!ACODWA:-/@By/E)s.RC-wi\u003eAFx(){b09iI", "n": [ { "c": 3, "d": ".NET dynamic code generation capability", "i": "metadata/lang/compiler/managed::dotnet-dynamic-code", "o": 32162, "z": 23, "cf": 0.8500000238418579 }, { "c": 3, "d": "Parameterized SQL queries (good practice)", "i": "micro-behaviors/data/db/access::sql-parameter", "o": 32186, "z": 11, "cf": 0.75 } ], "ln": 32146 }, { "b": "B985nwPE\u0026wwPQm:By/H[pgXV(lv0V:A@YcXvru6FxKL^\u003ewKQ=NzGFf+xla5FAa:liy!![\u003cx-", "n": [ { "c": 3, "d": ".NET random byte generation", "i": "objectives/anti-analysis/self-modify/runtime::dotnet-random-nextbytes-token", "o": 32939, "z": 9, "cf": 0.8399999737739563 } ], "ln": 32923 }, { "b": "z/Z2kA+fqVxKL^@wO-\u003eVq!o\u0026Sl34r?v)jBguOKqo089y[m[vMulUHyFz!@\u003c7wIc]7vSM41x-", "n": [ { "c": 3, "d": "WebSocket async send method", "i": "micro-behaviors/communications/http/websocket::websocket-send-async", "o": 40441, "z": 9, "cf": 0.8199999928474426 } ], "ln": 40425 }, { "b": "r0Jy6=DtQ\u00260rr91KPkvYy/tR2By/qwqE%]/B-H#6B1Qv4B8Mhwv}wLHvpS}\u0026efF!Jv@Dy7x\u003c@Ror+lq)x(v(Lg+HEmfFk4gavyo/BAIRnj-j?NBAg/aefE=ivR/:*oj-xFz!\u0026{4jZ{uevkRKLhzEiFg?wv2iu}EFB97#ge(Dn4z/{8gwPGF4B-8qnzdMQRB8Mhwv}wOIBohBx01e=b0000008L%H", "n": [ { "c": 2, "d": "mscorlib reference", "i": "metadata/lang/compiler/managed::mscorlib", "o": 42084, "z": 128, "cf": 0.8999999761581421 } ], "ln": 42068 }, { "b": "00000000000000000000000000000000000000315c8Xg7YTL^00000000000000000", "n": [ { "c": 1, "d": "PE resource section", "i": "metadata/binary/section/names::pe-resource-section", "o": 44544, "z": 5, "cf": 0.8999999761581421 } ], "ln": 44528 }, { "b": "0000000000007pEgYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006Xn[brp!0rrl55c8X", "n": [ { "c": 3, "d": "Recognized marker for timing checks", "i": "objectives/anti-analysis/timing/evasion::timing-anti-debug-recognized-marker", "o": 44638, "z": 15, "cf": 0.949999988079071 } ], "ln": 44622 }, { "b": "wDl=Ke=U\u003eK002s=5Dz?ilJz38z2!IPve$fBC(QOtve$cAwDhYg002v^xAh-DyYFnKx-HH2ASxU", "n": [ { "c": 2, "d": "PE CompanyName metadata field", "i": "metadata/package/versioning::pe-companyname-field", "o": 45022, "z": 11, "cf": 0.699999988079071 } ], "ln": 45006 }, { "b": "zuaeDe=U\u003eK003%rbME\u0026BmGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up002K\u0026zVB\u003eVlJy^1zVBn", "n": [ { "c": 2, "d": "PE FileDescription metadata field", "i": "metadata/package/versioning::pe-filedescription-field", "o": 45090, "z": 15, "cf": 0.699999988079071 } ], "ln": 45074 }, { "b": "x8(@LwDl=K001+O2(\u003c#amGvc5yYF2DrSDXhASydXx-J5Kzu6Up001.NhukufgYPcdfArZ9fAq7M003%rc\u0026:nFnDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE002K\u0026zVB\u003eVlJy^1zVBnEzVBON", "n": [ { "c": 3, "d": "Dotted-quad PE version metadata marker", "i": "objectives/command-and-control/infrastructure/ip::ipv4-version-metadata-marker", "o": 45202, "z": 11, "cf": 0.9399999976158142 }, { "c": 2, "d": "PE InternalName metadata field", "i": "metadata/package/versioning::pe-internalname-field", "o": 45254, "z": 12, "cf": 0.699999988079071 } ], "ln": 45186 }, { "b": "z#+d-ASx!Nx8(PBBn#pvlJz38z#+d-ASx!Nx8(PBBo0A-Sq[4vg5%0df-Tfkaoi$[aoluXAS", "n": [ { "c": 2, "d": "Copyright notice", "i": "metadata/package/license::copyright-word", "o": 45396, "z": 9, "cf": 0.6000000238418579 } ], "ln": 45380 }, { "b": "nDrSdv/OaY004lzc\u0026:nFpxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE002K\u0026zVB\u003eVlJy^1zVBnE", "n": [ { "c": 2, "d": "PE OriginalFilename metadata field", "i": "metadata/package/versioning::pe-originalfilename-field", "o": 45490, "z": 16, "cf": 0.699999988079071 } ], "ln": 45474 }, { "b": "e=YzZyYFnK002aY4GDIfpYLIozVBqFBPt[KBo25ove$cAwDhYg002K\u0026zVB\u003eVaoj+exAh@Jv/QAEyYE(zBo2\u003eL004@TgYNKRpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001.NhukufgYPcdfArW8z#Y", "n": [ { "c": 2, "d": "PE ProductName metadata field", "i": "metadata/package/versioning::pe-productname-field", "o": 45610, "z": 11, "cf": 0.699999988079071 }, { "c": 2, "d": "PE version resource metadata", "i": "metadata/package/versioning::version-resource-metadata", "o": 45670, "z": 14, "cf": 0.8999999761581421 } ], "ln": 45594 }, { "b": "000000000000000000000kFNm3\u0026*ncg=\u003eWq000000000000000000000000000000000", "n": [ { "c": 2, "d": "PE .reloc section presence", "i": "metadata/binary/section/names::reloc-section-presence", "o": 46080, "z": 6, "cf": 0.8999999761581421 } ], "ln": 46064 } ], "depth": 1, "facts": { "imp": [ [ "mscoree", "CorDllMain" ] ], "sec": [ [ ".text", 512, 44032, 5.92, "r-x" ], [ ".rsrc", 44544, 1536, 3.0, "r--" ], [ ".reloc", 46080, 512, 0.08, "r--" ] ], "metrics": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "resource_count": 1.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 89522.0, "reloc_overhang_bytes": 500.0, "reloc_overhang_ratio": 0.98, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "version.identity_entropy": 4.24, "clr.managed_resource_count": 1.0, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0, "clr.managed_resource_max_size": 1876.0, "version.identity_symbol_ratio": 0.05, "clr.managed_resource_max_entropy": 4.63 }, "file": { "size": 46592.0, "entropy": 5.78, "size_bytes": 46592.0 }, "binary": { "is_pie": 1.0, "code_entropy": 5.92, "string_count": 506.0, "overall_entropy": 5.78, "entropy_variance": 5.68, "avg_string_length": 23.24, "max_string_length": 159.0, "peak_region_bytes": 2048.0, "code_to_data_ratio": 1.0, "peak_region_entropy": 6.12, "string_length_stddev": 20.62, "largest_section_ratio": 0.95, "sentence_string_count": 19.0, "sentence_string_ratio": 0.04, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 44032.0, "entropy_max": 5.92, "entropy_mean": 3.0, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } } }, "id": 9, "mol": "O(Al)H₂(CmDb)", "path": "HotChocolate.Subscriptions.Postgres.16.4.0-p.8.nupkg!!lib/net8.0/HotChocolate.Subscriptions.Postgres.dll", "risk": 3, "sha": "75f997224cce9e393a4368cd02c3c532eee6acd592f0237bacc15009a072615e", "size": 46592, "traits": [ { "id": "objectives/anti-analysis/self-modify/runtime::dotnet-random-nextbytes-token", "atk": "T1027.005", "conf": 0.8399999737739563, "crit": 3, "desc": ".NET random byte generation", "spans": [ [ 32939, 9 ] ] }, { "id": "micro-behaviors/data/db/access::db-connection-class", "conf": 0.699999988079071, "crit": 3, "desc": "DbConnection class", "spans": [ [ 31487, 12 ] ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "spans": [ [ 15776, 4 ] ] }, { "id": "micro-behaviors/data/db/access::db-parameter-class", "conf": 0.6000000238418579, "crit": 3, "desc": "DbParameter class", "spans": [ [ 32186, 11 ] ] }, { "id": "micro-behaviors/data/db/access::db-command-class", "conf": 0.699999988079071, "crit": 3, "desc": "DbCommand class", "spans": [ [ 28857, 9 ] ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "spans": [ [ 45670, 14 ] ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "spans": [ [ 31102, 4 ] ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "spans": [ [ 45202, 11 ] ] }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "spans": [ [ 0, 26 ] ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 44638, 15 ] ] }, { "id": "micro-behaviors/data/db/access::execute-nonquery", "conf": 0.699999988079071, "crit": 3, "desc": "ExecuteNonQuery method", "spans": [ [ 28076, 15 ] ] }, { "id": "micro-behaviors/communications/http/websocket::websocket-send-async", "atk": "T1071.001", "mbc": "C0002", "conf": 0.8199999928474426, "crit": 3, "desc": "WebSocket async send method", "spans": [ [ 40441, 9 ] ] }, { "id": "micro-behaviors/communications/http/websocket::websocket-connect-async", "atk": "T1071.001", "mbc": "C0002", "conf": 0.8199999928474426, "crit": 3, "desc": "WebSocket async connect method", "spans": [ [ 27531, 12 ] ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "spans": [ [ 15776, 4 ] ] } ], "type": "pe" }, { "id": 10, "sha": "c69dfc153a9ebece0ef559d9d0568272b2c05c2f06f308200354492d1f2e1a07", "path": "HotChocolate.Subscriptions.Postgres.16.4.0-p.8.nupkg!!lib/net8.0/HotChocolate.Subscriptions.Postgres.xml", "size": 7924, "type": "xml", "depth": 1 }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J\u0026m(0ji4", "n": [ { "c": 3, "d": "HTTP fingerprinting evasion campaign", "i": "objectives/command-and-control/infrastructure/user-agent::http-fingerprinting-campaign", "o": 0, "z": 34, "cf": 0.8999999761581421 } ], "ln": 0 }, { "b": "00000000000000000000kG:3b00000nb@R\u00260SSx7J9unZ]KX760rr9100000FwIo^so", "n": [ { "c": 1, "d": "PE standard code/data section", "i": "metadata/binary/section/names::pe-code-data-standard-section", "o": 512, "z": 5, "cf": 0.8999999761581421 } ], "ln": 496 }, { "b": "69Ypny5[qmieEUo00i{:t(T\u003cc00T#Y1@xwh00007DKZ2Q1p6n.000dum/SI@z(iNn3i$[!", "n": [ { "c": 3, "d": "Embedded LZMA compressed data", "i": "micro-behaviors/data/embedded/payload/compression::lzma-magic", "o": 7217, "z": 8, "cf": 0.699999988079071 } ], "ln": 7201 }, { "b": "huFoW000c7d4{Rv3mV2Qlq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn", "n": [ { "c": 3, "d": "Recognized PE anti-analysis marker", "i": "objectives/anti-analysis/debugger-detect/combined-checks::evasion-aware-recognized-pe-marker", "o": 15756, "z": 4, "cf": 1.0 } ], "ln": 15740 }, { "b": "BZFGi06AC7uTF1$vq[15jvs48zE)s1k4F2cf/e\u003e)pI@KrzF\u003c2}BuTkxuOKwqlsB}Dhz+y@lVl\u003cWwN/*FB9RUkk4F2cgYPT4BZFGj06AC7uTF1$vq[46jvA[8v@Dm5wN/*Cwb", "n": [ { "c": 3, "d": "WebSocket async connect method", "i": "micro-behaviors/communications/http/websocket::websocket-connect-async", "o": 27543, "z": 12, "cf": 0.8199999928474426 }, { "c": 2, "d": "base64 encoding keyword", "i": "micro-behaviors/data/encoded::base64-token", "o": 27535, "z": 6, "cf": 0.699999988079071 }, { "c": 1, "d": "Regex component marker", "i": "objectives/persistence/login/scheduled-task/com::task-scheduler-builder-methods--rx-1", "o": 27503, "z": 14, "cf": 0.8999999761581421 } ], "ln": 27487 }, { "b": "l34r?v/PqzwO%!PD2v9(pI@KrzF\u003c2}Bu%$[zESVxzC\u003e4Qz/fD7v@$1TD2v9(s7b/+l34r?v/O@xwN/\u003e8wLNeYqfuC\u003cC%MH%zESVNB9RUk090#:qE%oE0b2\u003e+uR\u003efRy\u0026r-)00", "n": [ { "c": 3, "d": "SQL command execution", "i": "micro-behaviors/data/db/access::sql-command", "o": 28088, "z": 15, "cf": 0.8500000238418579 }, { "c": 1, "d": "Regex component marker", "i": "objectives/persistence/login/scheduled-task/com::task-scheduler-builder-methods--rx-1", "o": 28046, "z": 14, "cf": 0.8999999761581421 } ], "ln": 28030 }, { "b": "z/PY6BAz88p*[S=z^^eRAaa3dz^^eRl1BHalVM:DBy^^SB-7-3wb]zylVl\u003cWwN/*@z/eG}vru6FxKL^\u003ewN\u003e^NwPRoQz/Z2kA+fqVxKL^@wO+Zvz/fD7v@#B6zBFR*vpB4!B7/b}0b2\u003e+uQFHnzF\u003c34s8@1%wPzcBz/fD7v@#B6zBFR*vpB4!B7/b}0af!YxkRc]wN\u003e^NwPRoJB3\u003cwNv}xE/wb]OHC#Fo@", "n": [ { "c": 1, "d": "Regex component marker", "i": "objectives/command-and-control/dropper/staging/encrypted::staged-payload-file-name--rx-1", "o": 28173, "z": 7, "cf": 0.8500000238418579 }, { "c": 1, "d": "Regex component marker", "i": "objectives/persistence/login/scheduled-task/com::task-scheduler-builder-methods--rx-1", "o": 28199, "z": 24, "cf": 0.8999999761581421 } ], "ln": 28157 }, { "b": "yHpBnvpK7!zF8BMwO+(Sjvs48zE)s1x(v(MyHpBnvpK7!zF8BMwO+(Sjx3xiB7ol8Acb/jzCLj[x(v)gk5jIjlsBwtx(mMMx\u003eq9\u003e06AR!zF\u003c2}BzkVhmQY!Gz/Qa!yHpBnvpK7!zF8BMwO+(Ss.RC-wb]2blVl*UvqYPQlVM:DBy^*TzeAZ0wb]wzxle6elVl*UvqYPQxjVe", "n": [ { "c": 3, "d": "DbCommand class", "i": "micro-behaviors/data/db/access::db-command-class", "o": 28869, "z": 9, "cf": 0.699999988079071 }, { "c": 1, "d": "Regex component marker", "i": "objectives/persistence/login/scheduled-task/com::task-scheduler-builder-methods--rx-1", "o": 28763, "z": 27, "cf": 0.8999999761581421 } ], "ln": 28747 }, { "b": "x(Ffdz/fRGp\u0026yz%xl4N8e[w^m08vGCB8=0@xjVf(nPXJX0blK^z2!iWByd%(B97#g", "n": [ { "c": 3, "d": "References Windows executable or script", "i": "objectives/execution/interpreter/script/shell::windows-executable-ref", "o": 31130, "z": 4, "cf": 0.6000000238418579 } ], "ln": 31114 }, { "b": "zE^r@v%HT-ygQ)%x(v\u003e?q*ACawO\u003c4$wOb:\u0026v@#B6zu9mbwPz%dv}w2Cy\u00260V)BzkVh08vGCB8=1)vrb^[wD", "n": [ { "c": 2, "d": "Benign high-entropy PE context", "i": "metadata/package/quality/false-positives::benign-high-entropy-pe-context", "o": 31422, "z": 17, "cf": 0.949999988079071 } ], "ln": 31406 }, { "b": "0cqZ[uQF:HzE)s1x(v\u003e?l$eJ4zF\u003c2}BzkVh08^xHx(4G{zGFS)xle6elVl\u003cWwN/*@z/bL/wPRoS", "n": [ { "c": 3, "d": "SQL database connection capability", "i": "micro-behaviors/data/db/access::sql-connection", "o": 31515, "z": 12, "cf": 0.8500000238418579 } ], "ln": 31499 }, { "b": "vqYQ(wPv=TxKL^?y?mR!q*ACawO\u003c4!z!9AEz/49]z/6Dcy?mR!l$e#3A:-/@By/E)ph\u003c\u0026!ACODWA:-/@By/E)s.RC-wi\u003eAFx(){b09iI", "n": [ { "c": 3, "d": ".NET dynamic code generation capability", "i": "metadata/lang/compiler/managed::dotnet-dynamic-code", "o": 32190, "z": 23, "cf": 0.8500000238418579 }, { "c": 3, "d": "Parameterized SQL queries (good practice)", "i": "micro-behaviors/data/db/access::sql-parameter", "o": 32214, "z": 11, "cf": 0.75 } ], "ln": 32174 }, { "b": "B985nwPE\u0026wwPQm:By/H[pgXV(lv0V:A@YcXvru6FxKL^\u003ewKQ=NzGFf+xla5FAa:liy!![\u003cx-", "n": [ { "c": 3, "d": ".NET random byte generation", "i": "objectives/anti-analysis/self-modify/runtime::dotnet-random-nextbytes-token", "o": 32967, "z": 9, "cf": 0.8399999737739563 } ], "ln": 32951 }, { "b": "z/Z2kA+fqVxKL^@wO-\u003eVq!o\u0026Sl34r?v)jBguOKqo089y[m[vMulUHyFz!@\u003c7wIc]7vSM41x-", "n": [ { "c": 3, "d": "WebSocket async send method", "i": "micro-behaviors/communications/http/websocket::websocket-send-async", "o": 40482, "z": 9, "cf": 0.8199999928474426 } ], "ln": 40466 }, { "b": "r0Jy6=DtQ\u00260rr91KPkvYy/tR2By/qwqE%]/B-H#6B1Qv4B8Mhwv}wLHvpS}\u0026efF!Jv@Dy7x\u003c@Ror+lq)x(v(Lg+HEmfFk4gavyo/BAIRnj-j?NBAg/aefE=ivR/:*oj-xFz!\u0026{4jZ{uevkRKLhzEiFg?wv2iu}EFB97#ge(Dn4z/{8gwPGF4B-8qnzdMQRB8Mhwv}wOIBohBx01e=b0000008L%H", "n": [ { "c": 2, "d": "mscorlib reference", "i": "metadata/lang/compiler/managed::mscorlib", "o": 42128, "z": 128, "cf": 0.8999999761581421 } ], "ln": 42112 }, { "b": "00000000000000000000000000000000000000315c8Xg7YTL^00000000000000000", "n": [ { "c": 1, "d": "PE resource section", "i": "metadata/binary/section/names::pe-resource-section", "o": 44544, "z": 5, "cf": 0.8999999761581421 } ], "ln": 44528 }, { "b": "0000000000007pEgYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006Xn[brp!0rrl55c8X", "n": [ { "c": 3, "d": "Recognized marker for timing checks", "i": "objectives/anti-analysis/timing/evasion::timing-anti-debug-recognized-marker", "o": 44638, "z": 15, "cf": 0.949999988079071 } ], "ln": 44622 }, { "b": "wDl=Ke=U\u003eK002s=5Dz?ilJz38z2!IPve$fBC(QOtve$cAwDhYg002v^xAh-DyYFnKx-HH2ASxU", "n": [ { "c": 2, "d": "PE CompanyName metadata field", "i": "metadata/package/versioning::pe-companyname-field", "o": 45022, "z": 11, "cf": 0.699999988079071 } ], "ln": 45006 }, { "b": "zuaeDe=U\u003eK003%rbME\u0026BmGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up002K\u0026zVB\u003eVlJy^1zVBn", "n": [ { "c": 2, "d": "PE FileDescription metadata field", "i": "metadata/package/versioning::pe-filedescription-field", "o": 45090, "z": 15, "cf": 0.699999988079071 } ], "ln": 45074 }, { "b": "x8(@LwDl=K001+O2(\u003c#amGvc5yYF2DrSDXhASydXx-J5Kzu6Up001.NhukufgYPcdfArZ9fAq7M003%rc\u0026:nFnDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE002K\u0026zVB\u003eVlJy^1zVBnEzVBON", "n": [ { "c": 3, "d": "Dotted-quad PE version metadata marker", "i": "objectives/command-and-control/infrastructure/ip::ipv4-version-metadata-marker", "o": 45202, "z": 11, "cf": 0.9399999976158142 }, { "c": 2, "d": "PE InternalName metadata field", "i": "metadata/package/versioning::pe-internalname-field", "o": 45254, "z": 12, "cf": 0.699999988079071 } ], "ln": 45186 }, { "b": "z#+d-ASx!Nx8(PBBn#pvlJz38z#+d-ASx!Nx8(PBBo0A-Sq[4vg5%0df-Tfkaoi$[aoluXAS", "n": [ { "c": 2, "d": "Copyright notice", "i": "metadata/package/license::copyright-word", "o": 45396, "z": 9, "cf": 0.6000000238418579 } ], "ln": 45380 }, { "b": "nDrSdv/OaY004lzc\u0026:nFpxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE002K\u0026zVB\u003eVlJy^1zVBnE", "n": [ { "c": 2, "d": "PE OriginalFilename metadata field", "i": "metadata/package/versioning::pe-originalfilename-field", "o": 45490, "z": 16, "cf": 0.699999988079071 } ], "ln": 45474 }, { "b": "e=YzZyYFnK002aY4GDIfpYLIozVBqFBPt[KBo25ove$cAwDhYg002K\u0026zVB\u003eVaoj+exAh@Jv/QAEyYE(zBo2\u003eL004@TgYNKRpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001.NhukufgYPcdfArW8z#Y", "n": [ { "c": 2, "d": "PE ProductName metadata field", "i": "metadata/package/versioning::pe-productname-field", "o": 45610, "z": 11, "cf": 0.699999988079071 }, { "c": 2, "d": "PE version resource metadata", "i": "metadata/package/versioning::version-resource-metadata", "o": 45670, "z": 14, "cf": 0.8999999761581421 } ], "ln": 45594 }, { "b": "000000000000000000000kFNm3\u0026*ncu][t*000000000000000000000000000000000", "n": [ { "c": 2, "d": "PE .reloc section presence", "i": "metadata/binary/section/names::reloc-section-presence", "o": 46080, "z": 6, "cf": 0.8999999761581421 } ], "ln": 46064 } ], "depth": 1, "facts": { "imp": [ [ "mscoree", "CorDllMain" ] ], "sec": [ [ ".text", 512, 44032, 5.92, "r-x" ], [ ".rsrc", 44544, 1536, 3.0, "r--" ], [ ".reloc", 46080, 512, 0.08, "r--" ] ], "metrics": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "resource_count": 1.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 47511.0, "reloc_overhang_bytes": 500.0, "reloc_overhang_ratio": 0.98, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "version.identity_entropy": 4.24, "clr.managed_resource_count": 1.0, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0, "clr.managed_resource_max_size": 1876.0, "version.identity_symbol_ratio": 0.05, "clr.managed_resource_max_entropy": 4.63 }, "file": { "size": 46592.0, "entropy": 5.79, "size_bytes": 46592.0 }, "binary": { "is_pie": 1.0, "code_entropy": 5.92, "string_count": 508.0, "overall_entropy": 5.79, "entropy_variance": 5.69, "avg_string_length": 23.17, "max_string_length": 159.0, "peak_region_bytes": 2048.0, "code_to_data_ratio": 1.0, "peak_region_entropy": 6.15, "string_length_stddev": 20.6, "largest_section_ratio": 0.95, "sentence_string_count": 19.0, "sentence_string_ratio": 0.04, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 44032.0, "entropy_max": 5.92, "entropy_mean": 3.0, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } } }, "id": 11, "mol": "O(Al)H₂(CmDb)", "path": "HotChocolate.Subscriptions.Postgres.16.4.0-p.8.nupkg!!lib/net9.0/HotChocolate.Subscriptions.Postgres.dll", "risk": 3, "sha": "0fcbdd8d1c69de8457375266c0108cbd06038a43c25a5e753feea730874c5033", "size": 46592, "traits": [ { "id": "objectives/anti-analysis/self-modify/runtime::dotnet-random-nextbytes-token", "atk": "T1027.005", "conf": 0.8399999737739563, "crit": 3, "desc": ".NET random byte generation", "spans": [ [ 32967, 9 ] ] }, { "id": "micro-behaviors/data/db/access::db-connection-class", "conf": 0.699999988079071, "crit": 3, "desc": "DbConnection class", "spans": [ [ 31515, 12 ] ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "spans": [ [ 15756, 4 ] ] }, { "id": "micro-behaviors/data/db/access::db-parameter-class", "conf": 0.6000000238418579, "crit": 3, "desc": "DbParameter class", "spans": [ [ 32214, 11 ] ] }, { "id": "micro-behaviors/data/db/access::db-command-class", "conf": 0.699999988079071, "crit": 3, "desc": "DbCommand class", "spans": [ [ 28869, 9 ] ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "spans": [ [ 45670, 14 ] ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "spans": [ [ 31130, 4 ] ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "spans": [ [ 45202, 11 ] ] }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "spans": [ [ 0, 26 ] ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 44638, 15 ] ] }, { "id": "micro-behaviors/data/db/access::execute-nonquery", "conf": 0.699999988079071, "crit": 3, "desc": "ExecuteNonQuery method", "spans": [ [ 28088, 15 ] ] }, { "id": "micro-behaviors/communications/http/websocket::websocket-send-async", "atk": "T1071.001", "mbc": "C0002", "conf": 0.8199999928474426, "crit": 3, "desc": "WebSocket async send method", "spans": [ [ 40482, 9 ] ] }, { "id": "micro-behaviors/communications/http/websocket::websocket-connect-async", "atk": "T1071.001", "mbc": "C0002", "conf": 0.8199999928474426, "crit": 3, "desc": "WebSocket async connect method", "spans": [ [ 27543, 12 ] ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "spans": [ [ 15756, 4 ] ] } ], "type": "pe" }, { "id": 12, "sha": "c69dfc153a9ebece0ef559d9d0568272b2c05c2f06f308200354492d1f2e1a07", "path": "HotChocolate.Subscriptions.Postgres.16.4.0-p.8.nupkg!!lib/net9.0/HotChocolate.Subscriptions.Postgres.xml", "size": 7924, "type": "xml", "depth": 1 }, { "id": 13, "sha": "afeb9584632638a4fd4b2f37aa41f4260475fb65f3200e6cf67c9ddaaf9d48bd", "path": "HotChocolate.Subscriptions.Postgres.16.4.0-p.8.nupkg!![Content_Types].xml", "size": 650, "type": "xml", "depth": 1 }, { "id": 14, "sha": "12eee5e4481149939caf309959a6dd22be1da8256525b830e78aa8680a55e6c7", "path": "HotChocolate.Subscriptions.Postgres.16.4.0-p.8.nupkg!!package/services/metadata/core-properties/380115EC1EA62F416922720A51160DD5.psmdcp", "size": 732, "type": "xml", "depth": 1 }, { "id": 15, "sha": "910aae8babc41cb613529e2dd6e5d832175361a348e855b40896e5c01dc0f4ba", "path": "HotChocolate.Subscriptions.Postgres@16.4.0-p.8.registry.json", "size": 873, "type": "registry", "depth": 1 } ], "omitted_files": 10, "rev": "46112", "v": "8" } }