{ "llm": { "conf": 0.86549485, "grade": "benign", "model": "Qwen/Qwen3.6-27B", "outcome": "benign", "interpretation": "Legitimate .NET library metadata" }, "ml": { "v": "7", "eng": "2.3.0-beta.0", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.80784976, "rte": "az", "prob": 0.80784976 }, { "cls": 0, "raw": 0.01727295, "rte": "az/nupkg", "prob": 0.01727295 } ], "prob": 0.80784976, "skip": [ { "rte": "az/zip", "why": "unavailable" }, { "rte": "az/zip", "why": "unavailable" } ], "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.8078497648239136, "type": "nupkg" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.00012001395225524902, "type": "xml" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.01010921597480774, "type": "xml" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.005262881517410278, "type": "text" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.017961442470550537, "type": "markdown" }, { "id": 5, "lvl": -1, "conf": 0, "prob": 0.683881938457489, "type": "pe" }, { "id": 6, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "xml" }, { "id": 7, "lvl": -1, "conf": 0, "prob": 0.683881938457489, "type": "pe" }, { "id": 8, "lvl": -1, "conf": 0, "prob": 0.8078497648239136, "type": "xml" }, { "id": 9, "lvl": -1, "conf": 0, "prob": 0.683881938457489, "type": "pe" }, { "id": 10, "lvl": -1, "conf": 0, "prob": 0.8078497648239136, "type": "xml" }, { "id": 11, "lvl": -1, "conf": 0, "prob": 0.683881938457489, "type": "pe" }, { "id": 12, "lvl": -1, "conf": 0, "prob": 0.8078497648239136, "type": "xml" }, { "id": 13, "lvl": -1, "conf": 0, "prob": 0.8078497648239136, "type": "xml" }, { "id": 14, "lvl": -1, "conf": 0, "prob": 0.00012001395225524902, "type": "xml" }, { "id": 15, "lvl": -1, "conf": 0, "prob": 0.8078497648239136, "type": "registry" } ], "version": "v18.18", "analyzed_at": "2026-07-06T22:06:29Z" }, "path": "DNV.Vista.SDK.System.Text.Json.0.3.2-preview-4.nupkg", "raw": { "files": [ { "id": 0, "mol": "O(Al)H(Db)", "sha": "d120001b0dcccdb281bceb07840b4ec44bdee59f733927cc44b558c56439ea6c", "path": "DNV.Vista.SDK.System.Text.Json.0.3.2-preview-4.nupkg", "risk": 3, "size": 125704, "type": "nupkg", "facts": { "metrics": { "file": { "size": 125704.0, "entropy": 7.99, "size_bytes": 125704.0 }, "binary": { "overall_entropy": 7.99, "peak_region_bytes": 122880.0, "peak_region_entropy": 7.83 }, "archive": { "file_count": 15.0, "member_count": 15.0, "script_count": 0.0, "zip_bomb_ratio": 3.23, "directory_count": 0.0, "executable_count": 4.0, "extra_field_size": 0.0, "noise_file_count": 0.0, "total_compressed": 123494.0, "compression.ratio": 0.57, "hidden_file_count": 2.0, "total_uncompressed": 217740.0, "crc_collision_count": 3.0, "entry_comment_count": 0.0, "max_filename_length": 81.0, "rtlo_filename_count": 0.0, "format.regular_count": 15.0, "nested_archive_count": 0.0, "path_traversal_count": 0.0, "symlink_escape_count": 0.0, "security.setgid_count": 0.0, "security.setuid_count": 0.0, "security.sticky_count": 0.0, "double_extension_count": 0.0, "duplicate_member_count": 0.0, "security.symlink_count": 0.0, "unicode_filename_count": 0.0, "homoglyph_filename_count": 0.0, "security.encrypted_count": 0.0, "timing.mtime_unique_count": 6.0, "timing.mtime_unique_ratio": 0.4, "misplaced_executable_count": 4.0, "timing.mtime_dominant_count": 4.0, "timing.mtime_spread_seconds": 25154.0, "timing.sentinel_mtime_count": 0.0, "security.world_writable_count": 0.0, "timing.mtime_dominant_fraction": 0.27, "compression.method_counts.stored": 1.0, "compression.method_counts.deflate": 14.0 } } }, "ident": { "name": { "value": "DNV.Vista.SDK.System.Text.Json", "source": "nupkg.title", "verified": false }, "urls": [ { "url": "https://github.com/dnv-opensource/vista-sdk", "kind": "homepage", "source": "nupkg.project_url" }, { "url": "https://github.com/dnv-opensource/vista-sdk", "kind": "repository", "source": "nupkg.repository_url" } ], "trust": "unsigned", "authors": [ { "name": "Vista.SDK.System.Text.Json", "role": "author", "source": "nupkg.authors" } ], "version": { "value": "0.3.2-preview-4", "source": "nupkg.version", "verified": false }, "identifier": { "value": "DNV.Vista.SDK.System.Text.Json", "source": "nupkg.id", "verified": false } }, "traits": [ { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "from": [ { "file": 5 } ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "from": [ { "file": 5 } ] }, { "id": "metadata/package/versioning::version-word-lower", "conf": 0.4000000059604645, "crit": 2, "desc": "version word (lowercase)", "from": [ { "file": 5 } ] }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "from": [ { "file": 5 } ], "spans": [ [ 0, 26 ] ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "from": [ { "file": 5 } ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "from": [ { "file": 5 } ] }, { "id": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "conf": 1.0, "crit": 3, "desc": "JSON polymorphism runtime marker", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/data/db/linq::linq-queries", "conf": 0.699999988079071, "crit": 3, "desc": "LINQ query operations", "from": [ { "file": 5 } ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "from": [ { "file": 5 }, { "file": 7 }, { "file": 9 }, { "file": 11 } ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "from": [ { "file": 5 } ] } ] }, { "id": 1, "sha": "9459642ef12d5a2ef3a765c8ba27dec5f5ac557227b84cc4831d12d57a336233", "path": "DNV.Vista.SDK.System.Text.Json.0.3.2-preview-4.nupkg!!_rels/.rels", "size": 520, "type": "xml", "depth": 1 }, { "ctx": [ { "b": "[4ls%kx}3YaA?spB7]MgjT8QkfD}SJzEWP}x(mMDb6w0teJs}sj]", "n": [ { "c": 2, "d": "NuGet nuspec manifest file", "i": "metadata/build/manifest::nuspec-file", "o": 0, "z": 37, "cf": 0.9800000190734863 } ], "ln": 1, "addr": 0 }, { "b": "jAa.syHH\u003c!aB4:tzGv@+xMOuniXJdcv}YB\u003cvrj5rx\u003e8g4B8LVje[n*pfk$ufyHH\u003c\u0026zF7QTfFLvpfF$I3B-RIkv\u003eJ1EwfKh", "ln": 2, "addr": 42 }, { "b": "arS^-wPRu\u003evrt{w", "ln": 3, "addr": 118 }, { "b": "arR^Hjy-qGD2^RixMMB9z/x#xx\u003eIa3atLSah6tpZrV\u003cXbjtgh.AcVFrxj#xJ", "ln": 14, "addr": 772 }, { "b": "arR^HjAL1AB3sbLB%7skC4URlC4(1uzddE0BzkP6azC[neIPmBg=DK\u003eB8JS+ixe\u0026Pjtg!+xlcl", "ln": 15, "addr": 821 }, { "b": "arR^HjAt1Lz/YSmz/QaCBA}?pjTaJMBrR\u0026IA+)(.xMOunB2\u003e%cxk8E3BZ=$kz/4drzGWQIAaJ{dz/{8gwInjvB97?xB7x5gayYw1zEWuyb64mbB1.irvpTBjzddc@a%pxlzeB0ejTaw[f\u003eB(KiwJp1f/7QAiaK\u003c2g+\u0026P1vpRhGhzE0zw?(hMhdXW2vk5(FffP", "n": [ { "c": 2, "d": "NuGet package declares repository", "i": "metadata/package/files/nuget::nuspec-repository", "o": 885, "z": 105, "cf": 0.8999999761581421 } ], "ln": 16, "addr": 881 }, { "b": "arR^Hjy\u00262xwO#3\u0026zEWx(B3o", "n": [ { "c": 2, "d": "NuGet package declares dependencies", "i": "metadata/package/files/nuget::nuspec-dependencies", "o": 1040, "z": 527, "cf": 0.8999999761581421 } ], "ln": 17, "addr": 1036 }, { "b": "arR^HarS^VA=l8taAR4jxjVfOA:-/@Cw?IqjTa=PBtkE4fD@W", "ln": 18, "addr": 1055 }, { "b": "arR^HarR^Hjy\u00262xwO#3\u0026zEW@mx\u003efvJl@3=nr+VR%vj\u003eFDocLH4wPz\u003caz/dYZfFkdlga^D=wP?^0Cp+S}az2!cy\u0026%o1jT9jnx(4rhl2HaED3T4xB0q.Wj]", "ln": 19, "addr": 1095 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 1701.0, "entropy": 5.19, "size_bytes": 1701.0 }, "binary": { "overall_entropy": 5.19, "peak_region_bytes": 1701.0, "peak_region_entropy": 5.23 } } }, "id": 2, "path": "DNV.Vista.SDK.System.Text.Json.0.3.2-preview-4.nupkg!!DNV.Vista.SDK.System.Text.Json.nuspec", "risk": 1, "sha": "989b8a328758a70db7de5f391794b7d707b3ab7cc5c318e530b4755c3c0ee102", "size": 1701, "traits": [ { "id": "metadata/package/files/nuget::nuspec-repository", "conf": 0.8999999761581421, "crit": 2, "desc": "NuGet package declares repository", "spans": [ [ 885, 105 ] ] }, { "id": "metadata/package/files/nuget::nuspec-dependencies", "conf": 0.8999999761581421, "crit": 2, "desc": "NuGet package declares dependencies", "spans": [ [ 1040, 527 ] ] }, { "id": "metadata/build/manifest::nuspec-file", "conf": 0.9800000190734863, "crit": 2, "desc": "NuGet nuspec manifest file", "spans": [ [ 0, 37 ] ] } ], "type": "xml" }, { "id": 3, "sha": "82022511eed9ff7c6da7d43e7e05b00eb0815aca52514da075fbeccaf6c33206", "path": "DNV.Vista.SDK.System.Text.Json.0.3.2-preview-4.nupkg!!LICENSE", "risk": 1, "size": 1060, "type": "text", "depth": 1 }, { "id": 4, "sha": "52d84a78e3fa5bda590ae35483309c20ffe52fae148da32e6173a7eaaecbb547", "path": "DNV.Vista.SDK.System.Text.Json.0.3.2-preview-4.nupkg!!README.md", "risk": 1, "size": 10828, "type": "markdown", "depth": 1 }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J+", "n": [ { "c": 3, "d": "HTTP fingerprinting evasion campaign", "i": "objectives/command-and-control/infrastructure/user-agent::http-fingerprinting-campaign", "o": 0, "z": 34, "cf": 0.8999999761581421 } ], "ln": 0 }, { "b": "00000000000000000000[Yy?i00000nb@R\u00260SSx7\u003eSn+A($3d%0rr91000000000000", "n": [ { "c": 1, "d": "PE standard code/data section", "i": "metadata/binary/section/names::pe-code-data-standard-section", "o": 512, "z": 5, "cf": 0.8999999761581421 } ], "ln": 496 }, { "b": "000jw9@#uGzY/5X3mV2Qlq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn", "n": [ { "c": 3, "d": "Recognized PE anti-analysis marker", "i": "objectives/anti-analysis/debugger-detect/combined-checks::evasion-aware-recognized-pe-marker", "o": 7656, "z": 4, "cf": 1.0 } ], "ln": 7640 }, { "b": "qCm7hwObH]wO#0?rz(G\u003cq*ACawO\u003c4\u003epxkMDy\u0026%q@uJs.IBydyTB98tql$7gC0cqZ[uQF%SBn", "n": [ { "c": 2, "d": "System namespace reference", "i": "metadata/lang/compiler/managed::system-namespace", "o": 20994, "z": 9, "cf": 0.800000011920929 } ], "ln": 20978 }, { "b": "vqY%]yYEHIB97?yq::nhq*ACawO\u003c50wQ5qHn][]*e[w^m0b2\u003e+uSy#TBw)E4vSc5.B7GD2rC(I)q*Aj?z!]z@", "n": [ { "c": 3, "d": "JSON polymorphism runtime marker", "i": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "o": 25408, "z": 16, "cf": 1.0 }, { "c": 3, "d": "References Windows executable or script", "i": "objectives/execution/interpreter/script/shell::windows-executable-ref", "o": 25424, "z": 4, "cf": 0.6000000238418579 } ], "ln": 25392 }, { "b": "zF8)TxK#3(r+lq)x(v\u003e?C4CYnx(v\u003e?xjVf(r+lq)x(v(XzF0*czddK2z/bL@wPRoWwPz?", "n": [ { "c": 3, "d": "Recognized sparse-logic binary marker", "i": "objectives/anti-analysis/vm-detect/instruction::sparse-logic-recognized-marker", "o": 25704, "z": 7, "cf": 0.800000011920929 } ], "ln": 25688 }, { "b": "z7Xs{z^)c\u003ex)Kifx(v\u003e?q*ACawO\u003c4$B-8qnzdLs#wPzG[y?Xi7BzkVh08[e:By/qwraQq@e\u003eQh6zz1\u003e0A+O@#x)Kifx(v\u003e?q*ACawO\u003c4$wOb:\u0026v@#B6zuarXByd{SB98Cpv@#B6zua-?Byd{SB98Cpv@#B6zu", "n": [ { "c": 2, "d": "Benign high-entropy PE context", "i": "metadata/package/quality/false-positives::benign-high-entropy-pe-context", "o": 26032, "z": 17, "cf": 0.949999988079071 }, { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 26001, "z": 16, "cf": 0.8500000238418579 }, { "c": 2, "d": "System.Runtime.serialization namespace ref", "i": "micro-behaviors/data/serialize/object::runtime-serialization-namespace", "o": 25972, "z": 28, "cf": 0.6000000238418579 } ], "ln": 25956 }, { "b": "e\u003eQh6zu9ZKB97?yq::nhq*ACawO\u003c50wQ5qHn][]*0b#vRyHH\u003c!n][]*0b2\u003e+uR\u003efMBy/Gg0cqZ[uR\u003efM", "n": [ { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 26217, "z": 16, "cf": 0.8500000238418579 } ], "ln": 26201 }, { "b": "z#:#]zdMT/vqP@-yJ:T%q*ACawO\u003c4[x(m[\u003cl$7gCq!p5TraflUy*?t:xjVf(nm=juwPv=(wPRn", "n": [ { "c": 3, "d": "LINQ query operations", "i": "micro-behaviors/data/db/linq::linq-queries", "o": 26361, "z": 11, "cf": 0.699999988079071 } ], "ln": 26345 }, { "b": "07pmqwMiwXwM9X@y?mU/q*ACawO\u003c4$B-8qnzdLs#wPzG[y?Xi7BzkVhe(lO5ze19aC4CZ{xjVf(qE%YNA+/Z@B7GD2qE%YN", "n": [ { "c": 2, "d": "System.Runtime.serialization namespace ref", "i": "micro-behaviors/data/serialize/object::runtime-serialization-namespace", "o": 26869, "z": 28, "cf": 0.6000000238418579 } ], "ln": 26853 }, { "b": "0rrv5wO+{^B7CsK8ux*MlVl{?A+Pf1BrAs)gbQgxpf5G6qVD/G8VY}\u00266:=6aarR^Hra]?=r+VR%viwGpocwgZv@2H=wPF#7z!9M]C{4ixwGV2oy?mVgvqYP#Ab]Vgv}/)#wPF#jw/%GprV\u003eBOB8$]eaw3D.z/PY6BzkVhax9x5BZ]JoA+bO2arR^HasHnZqZ\u0026?$zE:\u003eYq+]bdi5APFf/.iIhZ0f-vqYQ:A+6klBz\u0026pkzEE0\u003cwGUA0wft@oAbY-oBrCZEwPz\u0026mvqYP#x(d*9wO(0@By/Gle^-ZzarR^Hl@3=nr+VR%vj\u003eFDod\u003cd*B97#ge(VzbBs{gbz/cXize:r5zdNQbB0a7NpFJ3NB-qqrA=-Bo", "n": [ { "c": 3, "d": "Bulk sensitive server data list", "i": "objectives/exfiltration/cloud/sync-tool::bulk-sensitive-server-data-path", "o": 31809, "z": 128, "cf": 1.0 }, { "c": 2, "d": "Copyright notice", "i": "metadata/package/license::copyright-word", "o": 31780, "z": 9, "cf": 0.6000000238418579 }, { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 32007, "z": 16, "cf": 0.8500000238418579 } ], "ln": 31764 }, { "b": "vpS}\u0026004Lv0rrc2r8[E8q*ACawO\u003c50wQ5qHn][]*e(Mt4x\u003c\u003e*(Dsp]fz/dg1B8L}/xkRTdwKyxNwncd1z/d9Gq*ACawO\u003c50wQ5qHn][]*efE#8A=U@kzAPZde?![ie?!?0lV)i!B-I4RzE)%jA:-=naw^h\u0026y?WxLwQdl[yH)", "n": [ { "c": 2, "d": "IPv4-like .NET assembly version", "i": "metadata/lang/compiler/managed::dotnet-ipv4-like-version", "o": 32480, "z": 16, "cf": 0.8500000238418579 }, { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 32410, "z": 16, "cf": 0.8500000238418579 } ], "ln": 32394 }, { "b": "x()]+Aa9l/004L@0rvU)q*ACawO\u003c50wQ5qHn][]*e(Mt4x\u003c\u003e*(Dsp]fz/dg1B8L}{BAh8kxglYXz9@kV", "n": [ { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 33529, "z": 16, "cf": 0.8500000238418579 } ], "ln": 33513 }, { "b": "00000000000000000000000000000000000000315c8Xg7YTL^00000000000000000", "n": [ { "c": 1, "d": "PE resource section", "i": "metadata/binary/section/names::pe-resource-section", "o": 44544, "z": 5, "cf": 0.8999999761581421 } ], "ln": 44528 }, { "b": "0000000000000AigYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006Xn[brp!0rr910rr9", "n": [ { "c": 3, "d": "Recognized marker for timing checks", "i": "objectives/anti-analysis/timing/evasion::timing-anti-debug-recognized-marker", "o": 44638, "z": 15, "cf": 0.949999988079071 } ], "ln": 44622 }, { "b": "aoiI:aoiI:001RK2lj=8lJz38z2!IPve$fBC(QOtve$cAwDhYg002y!p5[q{aojXcqVD^$003s98VP)smGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up00341x-JhOBo2.He=X/", "n": [ { "c": 2, "d": "PE CompanyName metadata field", "i": "metadata/package/versioning::pe-companyname-field", "o": 45438, "z": 11, "cf": 0.699999988079071 }, { "c": 2, "d": "PE FileDescription metadata field", "i": "metadata/package/versioning::pe-filedescription-field", "o": 45486, "z": 15, "cf": 0.699999988079071 } ], "ln": 45422 }, { "b": "A@ZaUzu6Up001XM2MK(9mGvc5yYF2DrSDXhASydXx-J5Kzu6Up001.Ne=WN9e=WN9e=WN9003s99@(rwnDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE00341x-JhOBo2.He=X/Il\u0026Y\u003cW", "n": [ { "c": 3, "d": "Dotted-quad PE version metadata marker", "i": "objectives/command-and-control/infrastructure/ip::ipv4-version-metadata-marker", "o": 45582, "z": 11, "cf": 0.9399999976158142 }, { "c": 2, "d": "PE InternalName metadata field", "i": "metadata/package/versioning::pe-internalname-field", "o": 45630, "z": 12, "cf": 0.699999988079071 } ], "ln": 45566 }, { "b": "rSBlxk(:*-003Qh9@(rwpxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE00341x-JhOBo2.He=X/I", "n": [ { "c": 2, "d": "PE OriginalFilename metadata field", "i": "metadata/package/versioning::pe-originalfilename-field", "o": 45806, "z": 16, "cf": 0.699999988079071 } ], "ln": 45790 }, { "b": "wb{ACyYBCn003418VP)spYLIozVBqFBPt[KBo25ove$cAwDhYg00341x-JhOBo2.He=X/Il\u0026Y\u003c", "n": [ { "c": 2, "d": "PE ProductName metadata field", "i": "metadata/package/versioning::pe-productname-field", "o": 45910, "z": 11, "cf": 0.699999988079071 } ], "ln": 45894 }, { "b": "A@ZaUzu6Up004PJf8#1MpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001.Ne=WN9e=WN9d/:5Vh2)", "n": [ { "c": 2, "d": "PE version resource metadata", "i": "metadata/package/versioning::version-resource-metadata", "o": 45998, "z": 14, "cf": 0.8999999761581421 } ], "ln": 45982 }, { "b": "000000000000000000000kFNm3\u0026*nc6GVo{000000000000000000000000000000000", "n": [ { "c": 2, "d": "PE .reloc section presence", "i": "metadata/binary/section/names::reloc-section-presence", "o": 46592, "z": 6, "cf": 0.8999999761581421 } ], "ln": 46576 } ], "depth": 1, "facts": { "imp": [ [ "mscoree", "CorDllMain" ] ], "sec": [ [ ".text", 512, 44032, 6.75, "r-x" ], [ ".rsrc", 44544, 2048, 2.88, "r--" ], [ ".reloc", 46592, 512, 0.08, "r--" ] ], "metrics": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "resource_count": 1.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 65402.0, "reloc_overhang_bytes": 500.0, "reloc_overhang_ratio": 0.98, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "version.identity_entropy": 4.06, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0, "version.identity_symbol_ratio": 0.14 }, "file": { "size": 47104.0, "entropy": 6.56, "size_bytes": 47104.0 }, "binary": { "is_pie": 1.0, "code_entropy": 6.75, "string_count": 534.0, "overall_entropy": 6.56, "entropy_variance": 7.48, "avg_string_length": 17.93, "max_string_length": 265.0, "peak_region_bytes": 10240.0, "code_to_data_ratio": 1.0, "peak_region_entropy": 7.8, "string_length_stddev": 20.59, "largest_section_ratio": 0.93, "sentence_string_count": 13.0, "sentence_string_ratio": 0.02, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 44032.0, "entropy_max": 6.75, "entropy_mean": 3.24, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } } }, "id": 5, "mol": "O(Al)H(Db)", "path": "DNV.Vista.SDK.System.Text.Json.0.3.2-preview-4.nupkg!!lib/net10.0/Vista.SDK.System.Text.Json.dll", "risk": 3, "sha": "77295f1198987611ee40791886979806c88a7d6e927e5e1b5eedddb2a392462f", "size": 47104, "traits": [ { "id": "micro-behaviors/data/db/linq::linq-queries", "conf": 0.699999988079071, "crit": 3, "desc": "LINQ query operations", "spans": [ [ 26361, 11 ] ] }, { "id": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "conf": 1.0, "crit": 3, "desc": "JSON polymorphism runtime marker", "spans": [ [ 25408, 16 ] ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 44638, 15 ] ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "spans": [ [ 7656, 4 ] ] }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "spans": [ [ 0, 26 ] ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "spans": [ [ 25424, 4 ] ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "spans": [ [ 45998, 14 ] ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "spans": [ [ 45582, 11 ] ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "metadata/package/versioning::version-word-lower", "conf": 0.4000000059604645, "crit": 2, "desc": "version word (lowercase)", "spans": [ [ 25704, 7 ] ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "spans": [ [ 7656, 4 ] ] } ], "type": "pe" }, { "id": 6, "sha": "8c849950ebdbe681667bdee37fa3612bf7ba7f12ca8f49d9cac58c122ed1081f", "path": "DNV.Vista.SDK.System.Text.Json.0.3.2-preview-4.nupkg!!lib/net10.0/Vista.SDK.System.Text.Json.xml", "size": 544, "type": "xml", "depth": 1 }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J+", "n": [ { "c": 3, "d": "HTTP fingerprinting evasion campaign", "i": "objectives/command-and-control/infrastructure/user-agent::http-fingerprinting-campaign", "o": 0, "z": 34, "cf": 0.8999999761581421 } ], "ln": 0 }, { "b": "00000000000000000000pS-Uq00000nb@R\u00260SSx7\u003eSn+A\u003eW:.]0rr91000000000000", "n": [ { "c": 1, "d": "PE standard code/data section", "i": "metadata/binary/section/names::pe-code-data-standard-section", "o": 512, "z": 5, "cf": 0.8999999761581421 } ], "ln": 496 }, { "b": "000jw9@#uGzY/5X3mV2Qlq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn", "n": [ { "c": 3, "d": "Recognized PE anti-analysis marker", "i": "objectives/anti-analysis/debugger-detect/combined-checks::evasion-aware-recognized-pe-marker", "o": 7656, "z": 4, "cf": 1.0 } ], "ln": 7640 }, { "b": "qCm7hwObH]wO#0?rz(G\u003cq*ACawO\u003c4\u003epxkMDy\u0026%q@uJs.IBydyTB98tql$7gC0cqZ[uQF%SBn", "n": [ { "c": 2, "d": "System namespace reference", "i": "metadata/lang/compiler/managed::system-namespace", "o": 20994, "z": 9, "cf": 0.800000011920929 } ], "ln": 20978 }, { "b": "vqY%]yYEHIB97?yq::nhq*ACawO\u003c50wQ5qHn][]*e[w^m0b2\u003e+uSy#TBw)E4vSc5.B7GD2rC(I)q*Aj?z!]z@", "n": [ { "c": 3, "d": "JSON polymorphism runtime marker", "i": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "o": 25408, "z": 16, "cf": 1.0 }, { "c": 3, "d": "References Windows executable or script", "i": "objectives/execution/interpreter/script/shell::windows-executable-ref", "o": 25424, "z": 4, "cf": 0.6000000238418579 } ], "ln": 25392 }, { "b": "zF8)TxK#3(r+lq)x(v\u003e?C4CYnx(v\u003e?xjVf(r+lq)x(v(XzF0*czddK2z/bL@wPRoWwPz?", "n": [ { "c": 3, "d": "Recognized sparse-logic binary marker", "i": "objectives/anti-analysis/vm-detect/instruction::sparse-logic-recognized-marker", "o": 25704, "z": 7, "cf": 0.800000011920929 } ], "ln": 25688 }, { "b": "z7Xs{z^)c\u003ex)Kifx(v\u003e?q*ACawO\u003c4$B-8qnzdLs#wPzG[y?Xi7BzkVh08[e:By/qwraQq@e\u003eQh6zz1\u003e0A+O@#x)Kifx(v\u003e?q*ACawO\u003c4$wOb:\u0026v@#B6zuarXByd{SB98Cpv@#B6zua-?Byd{SB98Cpv@#B6zu", "n": [ { "c": 2, "d": "Benign high-entropy PE context", "i": "metadata/package/quality/false-positives::benign-high-entropy-pe-context", "o": 26032, "z": 17, "cf": 0.949999988079071 }, { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 26001, "z": 16, "cf": 0.8500000238418579 }, { "c": 2, "d": "System.Runtime.serialization namespace ref", "i": "micro-behaviors/data/serialize/object::runtime-serialization-namespace", "o": 25972, "z": 28, "cf": 0.6000000238418579 } ], "ln": 25956 }, { "b": "e\u003eQh6zu9ZKB97?yq::nhq*ACawO\u003c50wQ5qHn][]*0b#vRyHH\u003c!n][]*0b2\u003e+uR\u003efMBy/Gg0cqZ[uR\u003efM", "n": [ { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 26217, "z": 16, "cf": 0.8500000238418579 } ], "ln": 26201 }, { "b": "z#:#]zdMT/vqP@-yJ:T%q*ACawO\u003c4[x(m[\u003cl$7gCq!p5TraflUy*?t:xjVf(nm=juwPv=(wPRn", "n": [ { "c": 3, "d": "LINQ query operations", "i": "micro-behaviors/data/db/linq::linq-queries", "o": 26361, "z": 11, "cf": 0.699999988079071 } ], "ln": 26345 }, { "b": "07pmqwMiwXwM9X@y?mU/q*ACawO\u003c4$B-8qnzdLs#wPzG[y?Xi7BzkVhe(lO5ze19aC4CZ{xjVf(qE%YNA+/Z@B7GD2qE%YN", "n": [ { "c": 2, "d": "System.Runtime.serialization namespace ref", "i": "micro-behaviors/data/serialize/object::runtime-serialization-namespace", "o": 26869, "z": 28, "cf": 0.6000000238418579 } ], "ln": 26853 }, { "b": "0rrv5wO+{^B7CsK8ux*MlVl{?A+Pf1BrAs)gbQgxpf5G6qVD/G8VY}\u00266:=6aarR^Hra]?=r+VR%viwGpocwgZv@2H=wPF#7z!9M]C{4ixwGV2oy?mVgvqYP#Ab]Vgv}/)#wPF#jw/%GprV\u003eBOB8$]eaw3D.z/PY6BzkVhax9x5BZ]JoA+bO2arR^HasHnZqZ\u0026?$zE:\u003eYq+]bdi5APFf/.iIhZ0f-vqYQ:A+6klBz\u0026pkzEE0\u003cwGUA0wft@oAbY-oBrCZEwPz\u0026mvqYP#x(d*9wO(0@By/Gle^-ZzarR^Hl@3=nr+VR%vj\u003eFDod\u003cd*B97#ge(VzbBs{gbz/cXize:r5zdNQbB0a7NpFJ3NB-qqrA=-Bo", "n": [ { "c": 3, "d": "Bulk sensitive server data list", "i": "objectives/exfiltration/cloud/sync-tool::bulk-sensitive-server-data-path", "o": 31807, "z": 128, "cf": 1.0 }, { "c": 2, "d": "Copyright notice", "i": "metadata/package/license::copyright-word", "o": 31778, "z": 9, "cf": 0.6000000238418579 }, { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 32005, "z": 16, "cf": 0.8500000238418579 } ], "ln": 31762 }, { "b": "vpS}\u0026004Lu0rrc2r8[E7q*ACawO\u003c50wQ5qHn][]*e(Mt4x\u003c\u003e*(Dsp]fz/dg1B8L}/xkRTdwKyxNwncd1z/d9Gq*ACawO\u003c50wQ5qHn][]*efE#8A=U@kzAP%ifFk4ifF1tlB.(exA+dyKwP-9nvqEFqp\u003c3k-x\u003e6!EC#OY$wD", "n": [ { "c": 2, "d": "IPv4-like .NET assembly version", "i": "metadata/lang/compiler/managed::dotnet-ipv4-like-version", "o": 32478, "z": 15, "cf": 0.8500000238418579 }, { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 32408, "z": 16, "cf": 0.8500000238418579 } ], "ln": 32392 }, { "b": "x()]+Aa9l/004L}0rvU(q*ACawO\u003c50wQ5qHn][]*e(Mt4x\u003c\u003e*(Dsp]fz/dg1B8L}{BAh8kxglYXz9@kV", "n": [ { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 33526, "z": 16, "cf": 0.8500000238418579 } ], "ln": 33510 }, { "b": "2%%)W/957aA^TPVMc\u003ccNyTj85V.$ARLx.QSOHClml\u003c.$+]akL^\u0026/3q4cTjdWQ@r", "n": [ { "c": 1, "d": "Polynomial hash multiply-by-31 instruction", "i": "objectives/anti-static/obfuscation/imports::djb2-multiply-31", "o": 36362, "z": 2, "cf": 0.699999988079071 } ], "ln": 36346 }, { "b": "00000000000000000000000000000000000000315c8Xg7YTL^00000000000000000", "n": [ { "c": 1, "d": "PE resource section", "i": "metadata/binary/section/names::pe-resource-section", "o": 44544, "z": 5, "cf": 0.8999999761581421 } ], "ln": 44528 }, { "b": "0000000000000AigYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006Xn[brp!0rr910rr9", "n": [ { "c": 3, "d": "Recognized marker for timing checks", "i": "objectives/anti-analysis/timing/evasion::timing-anti-debug-recognized-marker", "o": 44638, "z": 15, "cf": 0.949999988079071 } ], "ln": 44622 }, { "b": "aoiI:aoiI:001RK2lj=8lJz38z2!IPve$fBC(QOtve$cAwDhYg002y!p5[q{aojXcqVD^$003s98VP)smGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up00341x-JhOBo2.He=X/", "n": [ { "c": 2, "d": "PE CompanyName metadata field", "i": "metadata/package/versioning::pe-companyname-field", "o": 45438, "z": 11, "cf": 0.699999988079071 }, { "c": 2, "d": "PE FileDescription metadata field", "i": "metadata/package/versioning::pe-filedescription-field", "o": 45486, "z": 15, "cf": 0.699999988079071 } ], "ln": 45422 }, { "b": "A@ZaUzu6Up001XM2MK(9mGvc5yYF2DrSDXhASydXx-J5Kzu6Up001.Ne=WN9e=WN9e=WN9003s99@(rwnDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE00341x-JhOBo2.He=X/Il\u0026Y\u003cW", "n": [ { "c": 3, "d": "Dotted-quad PE version metadata marker", "i": "objectives/command-and-control/infrastructure/ip::ipv4-version-metadata-marker", "o": 45582, "z": 11, "cf": 0.9399999976158142 }, { "c": 2, "d": "PE InternalName metadata field", "i": "metadata/package/versioning::pe-internalname-field", "o": 45630, "z": 12, "cf": 0.699999988079071 } ], "ln": 45566 }, { "b": "rSBlxk(:*-003Qh9@(rwpxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE00341x-JhOBo2.He=X/I", "n": [ { "c": 2, "d": "PE OriginalFilename metadata field", "i": "metadata/package/versioning::pe-originalfilename-field", "o": 45806, "z": 16, "cf": 0.699999988079071 } ], "ln": 45790 }, { "b": "wb{ACyYBCn003418VP)spYLIozVBqFBPt[KBo25ove$cAwDhYg00341x-JhOBo2.He=X/Il\u0026Y\u003c", "n": [ { "c": 2, "d": "PE ProductName metadata field", "i": "metadata/package/versioning::pe-productname-field", "o": 45910, "z": 11, "cf": 0.699999988079071 } ], "ln": 45894 }, { "b": "A@ZaUzu6Up004PJf8#1MpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001.Ne=WN9e=WN9d/:5Vh2)", "n": [ { "c": 2, "d": "PE version resource metadata", "i": "metadata/package/versioning::version-resource-metadata", "o": 45998, "z": 14, "cf": 0.8999999761581421 } ], "ln": 45982 }, { "b": "000000000000000000000kFNm3\u0026*ncA5)$0000000000000000000000000000000000", "n": [ { "c": 2, "d": "PE .reloc section presence", "i": "metadata/binary/section/names::reloc-section-presence", "o": 46592, "z": 6, "cf": 0.8999999761581421 } ], "ln": 46576 } ], "depth": 1, "facts": { "imp": [ [ "mscoree", "CorDllMain" ] ], "sec": [ [ ".text", 512, 44032, 6.74, "r-x" ], [ ".rsrc", 44544, 2048, 2.88, "r--" ], [ ".reloc", 46592, 512, 0.08, "r--" ] ], "metrics": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "resource_count": 1.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 70450.0, "reloc_overhang_bytes": 500.0, "reloc_overhang_ratio": 0.98, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "version.identity_entropy": 4.06, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0, "version.identity_symbol_ratio": 0.14 }, "file": { "size": 47104.0, "entropy": 6.54, "size_bytes": 47104.0 }, "binary": { "is_pie": 1.0, "code_entropy": 6.74, "string_count": 541.0, "overall_entropy": 6.54, "entropy_variance": 7.44, "avg_string_length": 17.73, "max_string_length": 265.0, "peak_region_bytes": 10240.0, "code_to_data_ratio": 1.0, "peak_region_entropy": 7.82, "string_length_stddev": 20.48, "largest_section_ratio": 0.93, "sentence_string_count": 13.0, "sentence_string_ratio": 0.02, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 44032.0, "entropy_max": 6.74, "entropy_mean": 3.23, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } } }, "id": 7, "mol": "O(Al)H(Db)", "path": "DNV.Vista.SDK.System.Text.Json.0.3.2-preview-4.nupkg!!lib/net8.0/Vista.SDK.System.Text.Json.dll", "risk": 3, "sha": "a7d5470a527a964eab3d55ff6a4cf16d57e38671e4e943a0c8655d5e724a9e5c", "size": 47104, "traits": [ { "id": "micro-behaviors/data/db/linq::linq-queries", "conf": 0.699999988079071, "crit": 3, "desc": "LINQ query operations", "spans": [ [ 26361, 11 ] ] }, { "id": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "conf": 1.0, "crit": 3, "desc": "JSON polymorphism runtime marker", "spans": [ [ 25408, 16 ] ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 44638, 15 ] ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "spans": [ [ 7656, 4 ] ] }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "spans": [ [ 0, 26 ] ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "spans": [ [ 25424, 4 ] ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "spans": [ [ 45998, 14 ] ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "spans": [ [ 45582, 11 ] ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "metadata/package/versioning::version-word-lower", "conf": 0.4000000059604645, "crit": 2, "desc": "version word (lowercase)", "spans": [ [ 25704, 7 ] ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "spans": [ [ 7656, 4 ] ] } ], "type": "pe" }, { "id": 8, "sha": "8c849950ebdbe681667bdee37fa3612bf7ba7f12ca8f49d9cac58c122ed1081f", "path": "DNV.Vista.SDK.System.Text.Json.0.3.2-preview-4.nupkg!!lib/net8.0/Vista.SDK.System.Text.Json.xml", "size": 544, "type": "xml", "depth": 1 }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J+", "n": [ { "c": 3, "d": "HTTP fingerprinting evasion campaign", "i": "objectives/command-and-control/infrastructure/user-agent::http-fingerprinting-campaign", "o": 0, "z": 34, "cf": 0.8999999761581421 } ], "ln": 0 }, { "b": "00000000000000000000GVTn{00000nb@R\u00260SSx7\u003eSn+A\u003eW:.]0rr91000000000000", "n": [ { "c": 1, "d": "PE standard code/data section", "i": "metadata/binary/section/names::pe-code-data-standard-section", "o": 512, "z": 5, "cf": 0.8999999761581421 } ], "ln": 496 }, { "b": "000jw9@#uGzY/5X3mV2Qlq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn", "n": [ { "c": 3, "d": "Recognized PE anti-analysis marker", "i": "objectives/anti-analysis/debugger-detect/combined-checks::evasion-aware-recognized-pe-marker", "o": 7656, "z": 4, "cf": 1.0 } ], "ln": 7640 }, { "b": "qCm7hwObH]wO#0?rz(G\u003cq*ACawO\u003c4\u003epxkMDy\u0026%q@uJs.IBydyTB98tql$7gC0cqZ[uQF%SBn", "n": [ { "c": 2, "d": "System namespace reference", "i": "metadata/lang/compiler/managed::system-namespace", "o": 20994, "z": 9, "cf": 0.800000011920929 } ], "ln": 20978 }, { "b": "vqY%]yYEHIB97?yq::nhq*ACawO\u003c50wQ5qHn][]*e[w^m0b2\u003e+uSy#TBw)E4vSc5.B7GD2rC(I)q*Aj?z!]z@", "n": [ { "c": 3, "d": "JSON polymorphism runtime marker", "i": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "o": 25408, "z": 16, "cf": 1.0 }, { "c": 3, "d": "References Windows executable or script", "i": "objectives/execution/interpreter/script/shell::windows-executable-ref", "o": 25424, "z": 4, "cf": 0.6000000238418579 } ], "ln": 25392 }, { "b": "zF8)TxK#3(r+lq)x(v\u003e?C4CYnx(v\u003e?xjVf(r+lq)x(v(XzF0*czddK2z/bL@wPRoWwPz?", "n": [ { "c": 3, "d": "Recognized sparse-logic binary marker", "i": "objectives/anti-analysis/vm-detect/instruction::sparse-logic-recognized-marker", "o": 25704, "z": 7, "cf": 0.800000011920929 } ], "ln": 25688 }, { "b": "z7Xs{z^)c\u003ex)Kifx(v\u003e?q*ACawO\u003c4$B-8qnzdLs#wPzG[y?Xi7BzkVh08[e:By/qwraQq@e\u003eQh6zz1\u003e0A+O@#x)Kifx(v\u003e?q*ACawO\u003c4$wOb:\u0026v@#B6zuarXByd{SB98Cpv@#B6zua-?Byd{SB98Cpv@#B6zu", "n": [ { "c": 2, "d": "Benign high-entropy PE context", "i": "metadata/package/quality/false-positives::benign-high-entropy-pe-context", "o": 26032, "z": 17, "cf": 0.949999988079071 }, { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 26001, "z": 16, "cf": 0.8500000238418579 }, { "c": 2, "d": "System.Runtime.serialization namespace ref", "i": "micro-behaviors/data/serialize/object::runtime-serialization-namespace", "o": 25972, "z": 28, "cf": 0.6000000238418579 } ], "ln": 25956 }, { "b": "e\u003eQh6zu9ZKB97?yq::nhq*ACawO\u003c50wQ5qHn][]*0b#vRyHH\u003c!n][]*0b2\u003e+uR\u003efMBy/Gg0cqZ[uR\u003efM", "n": [ { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 26217, "z": 16, "cf": 0.8500000238418579 } ], "ln": 26201 }, { "b": "z#:#]zdMT/vqP@-yJ:T%q*ACawO\u003c4[x(m[\u003cl$7gCq!p5TraflUy*?t:xjVf(nm=juwPv=(wPRn", "n": [ { "c": 3, "d": "LINQ query operations", "i": "micro-behaviors/data/db/linq::linq-queries", "o": 26361, "z": 11, "cf": 0.699999988079071 } ], "ln": 26345 }, { "b": "07pmqwMiwXwM9X@y?mU/q*ACawO\u003c4$B-8qnzdLs#wPzG[y?Xi7BzkVhe(lO5ze19aC4CZ{xjVf(qE%YNA+/Z@B7GD2qE%YN", "n": [ { "c": 2, "d": "System.Runtime.serialization namespace ref", "i": "micro-behaviors/data/serialize/object::runtime-serialization-namespace", "o": 26869, "z": 28, "cf": 0.6000000238418579 } ], "ln": 26853 }, { "b": "0rrv5wO+{^B7CsK8ux*MlVl{?A+Pf1BrAs)gbQgxpf5G6qVD/G8VY}\u00266:=6aarR^Hra]?=r+VR%viwGpocwgZv@2H=wPF#7z!9M]C{4ixwGV2oy?mVgvqYP#Ab]Vgv}/)#wPF#jw/%GprV\u003eBOB8$]eaw3D.z/PY6BzkVhax9x5BZ]JoA+bO2arR^HasHnZqZ\u0026?$zE:\u003eYq+]bdi5APFf/.iIhZ0f-vqYQ:A+6klBz\u0026pkzEE0\u003cwGUA0wft@oAbY-oBrCZEwPz\u0026mvqYP#x(d*9wO(0@By/Gle^-ZzarR^Hl@3=nr+VR%vj\u003eFDod\u003cd*B97#ge(VzbBs{gbz/cXize:r5zdNQbB0a7NpFJ3NB-qqrA=-Bo", "n": [ { "c": 3, "d": "Bulk sensitive server data list", "i": "objectives/exfiltration/cloud/sync-tool::bulk-sensitive-server-data-path", "o": 31807, "z": 128, "cf": 1.0 }, { "c": 2, "d": "Copyright notice", "i": "metadata/package/license::copyright-word", "o": 31778, "z": 9, "cf": 0.6000000238418579 }, { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 32005, "z": 16, "cf": 0.8500000238418579 } ], "ln": 31762 }, { "b": "vpS}\u0026004Lu0rrc2r8[E7q*ACawO\u003c50wQ5qHn][]*e(Mt4x\u003c\u003e*(Dsp]fz/dg1B8L}/xkRTdwKyxNwncd1z/d9Gq*ACawO\u003c50wQ5qHn][]*efE#8A=U@kzAQ0jfFk4ifF1tlB.(exA+dyKwP-9nvqEFqp\u003c3k-x\u003e6!EC#OY$wD", "n": [ { "c": 2, "d": "IPv4-like .NET assembly version", "i": "metadata/lang/compiler/managed::dotnet-ipv4-like-version", "o": 32478, "z": 15, "cf": 0.8500000238418579 }, { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 32408, "z": 16, "cf": 0.8500000238418579 } ], "ln": 32392 }, { "b": "x()]+Aa9l/004L}0rvU(q*ACawO\u003c50wQ5qHn][]*e(Mt4x\u003c\u003e*(Dsp]fz/dg1B8L}{BAh8kxglYXz9@kV", "n": [ { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 33526, "z": 16, "cf": 0.8500000238418579 } ], "ln": 33510 }, { "b": "00000000000000000000000000000000000000315c8Xg7YTL^00000000000000000", "n": [ { "c": 1, "d": "PE resource section", "i": "metadata/binary/section/names::pe-resource-section", "o": 44544, "z": 5, "cf": 0.8999999761581421 } ], "ln": 44528 }, { "b": "0000000000000AigYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006Xn[brp!0rr910rr9", "n": [ { "c": 3, "d": "Recognized marker for timing checks", "i": "objectives/anti-analysis/timing/evasion::timing-anti-debug-recognized-marker", "o": 44638, "z": 15, "cf": 0.949999988079071 } ], "ln": 44622 }, { "b": "aoiI:aoiI:001RK2lj=8lJz38z2!IPve$fBC(QOtve$cAwDhYg002y!p5[q{aojXcqVD^$003s98VP)smGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up00341x-JhOBo2.He=X/", "n": [ { "c": 2, "d": "PE CompanyName metadata field", "i": "metadata/package/versioning::pe-companyname-field", "o": 45438, "z": 11, "cf": 0.699999988079071 }, { "c": 2, "d": "PE FileDescription metadata field", "i": "metadata/package/versioning::pe-filedescription-field", "o": 45486, "z": 15, "cf": 0.699999988079071 } ], "ln": 45422 }, { "b": "A@ZaUzu6Up001XM2MK(9mGvc5yYF2DrSDXhASydXx-J5Kzu6Up001.Ne=WN9e=WN9e=WN9003s99@(rwnDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE00341x-JhOBo2.He=X/Il\u0026Y\u003cW", "n": [ { "c": 3, "d": "Dotted-quad PE version metadata marker", "i": "objectives/command-and-control/infrastructure/ip::ipv4-version-metadata-marker", "o": 45582, "z": 11, "cf": 0.9399999976158142 }, { "c": 2, "d": "PE InternalName metadata field", "i": "metadata/package/versioning::pe-internalname-field", "o": 45630, "z": 12, "cf": 0.699999988079071 } ], "ln": 45566 }, { "b": "rSBlxk(:*-003Qh9@(rwpxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE00341x-JhOBo2.He=X/I", "n": [ { "c": 2, "d": "PE OriginalFilename metadata field", "i": "metadata/package/versioning::pe-originalfilename-field", "o": 45806, "z": 16, "cf": 0.699999988079071 } ], "ln": 45790 }, { "b": "wb{ACyYBCn003418VP)spYLIozVBqFBPt[KBo25ove$cAwDhYg00341x-JhOBo2.He=X/Il\u0026Y\u003c", "n": [ { "c": 2, "d": "PE ProductName metadata field", "i": "metadata/package/versioning::pe-productname-field", "o": 45910, "z": 11, "cf": 0.699999988079071 } ], "ln": 45894 }, { "b": "A@ZaUzu6Up004PJf8#1MpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001.Ne=WN9e=WN9d/:5Vh2)", "n": [ { "c": 2, "d": "PE version resource metadata", "i": "metadata/package/versioning::version-resource-metadata", "o": 45998, "z": 14, "cf": 0.8999999761581421 } ], "ln": 45982 }, { "b": "000000000000000000000kFNm3\u0026*ncQ=FFQ000000000000000000000000000000000", "n": [ { "c": 2, "d": "PE .reloc section presence", "i": "metadata/binary/section/names::reloc-section-presence", "o": 46592, "z": 6, "cf": 0.8999999761581421 } ], "ln": 46576 } ], "depth": 1, "facts": { "imp": [ [ "mscoree", "CorDllMain" ] ], "sec": [ [ ".text", 512, 44032, 6.74, "r-x" ], [ ".rsrc", 44544, 2048, 2.88, "r--" ], [ ".reloc", 46592, 512, 0.08, "r--" ] ], "metrics": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "resource_count": 1.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 96859.0, "reloc_overhang_bytes": 500.0, "reloc_overhang_ratio": 0.98, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "version.identity_entropy": 4.06, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0, "version.identity_symbol_ratio": 0.14 }, "file": { "size": 47104.0, "entropy": 6.55, "size_bytes": 47104.0 }, "binary": { "is_pie": 1.0, "code_entropy": 6.74, "string_count": 532.0, "overall_entropy": 6.55, "entropy_variance": 7.45, "avg_string_length": 17.96, "max_string_length": 265.0, "peak_region_bytes": 10240.0, "code_to_data_ratio": 1.0, "peak_region_entropy": 7.81, "string_length_stddev": 20.57, "largest_section_ratio": 0.93, "sentence_string_count": 13.0, "sentence_string_ratio": 0.02, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 44032.0, "entropy_max": 6.74, "entropy_mean": 3.23, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } } }, "id": 9, "mol": "O(Al)H(Db)", "path": "DNV.Vista.SDK.System.Text.Json.0.3.2-preview-4.nupkg!!lib/net9.0/Vista.SDK.System.Text.Json.dll", "risk": 3, "sha": "4aaa3a635128f6de5e15a0a1e7c2e92c335709541b8223482288ac5e1bccf313", "size": 47104, "traits": [ { "id": "micro-behaviors/data/db/linq::linq-queries", "conf": 0.699999988079071, "crit": 3, "desc": "LINQ query operations", "spans": [ [ 26361, 11 ] ] }, { "id": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "conf": 1.0, "crit": 3, "desc": "JSON polymorphism runtime marker", "spans": [ [ 25408, 16 ] ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 44638, 15 ] ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "spans": [ [ 7656, 4 ] ] }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "spans": [ [ 0, 26 ] ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "spans": [ [ 25424, 4 ] ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "spans": [ [ 45998, 14 ] ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "spans": [ [ 45582, 11 ] ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "metadata/package/versioning::version-word-lower", "conf": 0.4000000059604645, "crit": 2, "desc": "version word (lowercase)", "spans": [ [ 25704, 7 ] ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "spans": [ [ 7656, 4 ] ] } ], "type": "pe" }, { "id": 10, "sha": "8c849950ebdbe681667bdee37fa3612bf7ba7f12ca8f49d9cac58c122ed1081f", "path": "DNV.Vista.SDK.System.Text.Json.0.3.2-preview-4.nupkg!!lib/net9.0/Vista.SDK.System.Text.Json.xml", "size": 544, "type": "xml", "depth": 1 }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J+", "n": [ { "c": 3, "d": "HTTP fingerprinting evasion campaign", "i": "objectives/command-and-control/infrastructure/user-agent::http-fingerprinting-campaign", "o": 0, "z": 34, "cf": 0.8999999761581421 } ], "ln": 0 }, { "b": "00000000000000000000i(I7000000nb@R\u00260SSx7i6mfv1zmYm0rr91000000000000", "n": [ { "c": 1, "d": "PE standard code/data section", "i": "metadata/binary/section/names::pe-code-data-standard-section", "o": 512, "z": 5, "cf": 0.8999999761581421 } ], "ln": 496 }, { "b": "000jw9rucEzYO]V3mV2Qlq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn", "n": [ { "c": 3, "d": "Recognized PE anti-analysis marker", "i": "objectives/anti-analysis/debugger-detect/combined-checks::evasion-aware-recognized-pe-marker", "o": 7736, "z": 4, "cf": 1.0 } ], "ln": 7720 }, { "b": "qCm7hwObH]wO#0?rz(G\u003cq*ACawO\u003c4\u003epxkMDy\u0026%q@uJs.IBydyTB98tql$7gC0cqZ[uQF%SBn", "n": [ { "c": 2, "d": "System namespace reference", "i": "metadata/lang/compiler/managed::system-namespace", "o": 21176, "z": 9, "cf": 0.800000011920929 } ], "ln": 21160 }, { "b": "vqY%]yYEHIB97?yq::nhq*ACawO\u003c50wQ5qHn][]*e[w^m0b2\u003e+uSy#TBw)E4vSc5.B7GD2rC(I)q*Aj?z!]z@", "n": [ { "c": 3, "d": "JSON polymorphism runtime marker", "i": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "o": 25639, "z": 16, "cf": 1.0 }, { "c": 3, "d": "References Windows executable or script", "i": "objectives/execution/interpreter/script/shell::windows-executable-ref", "o": 25655, "z": 4, "cf": 0.6000000238418579 } ], "ln": 25623 }, { "b": "zF8)TxK#3(r+lq)x(v\u003e?C4CYnx(v\u003e?xjVf(r+lq)x(v(XzF0*czddK2z/bL@wPRoWwPz?", "n": [ { "c": 3, "d": "Recognized sparse-logic binary marker", "i": "objectives/anti-analysis/vm-detect/instruction::sparse-logic-recognized-marker", "o": 25935, "z": 7, "cf": 0.800000011920929 } ], "ln": 25919 }, { "b": "z7Xs{z^)c\u003ex)Kifx(v\u003e?q*ACawO\u003c4$B-8qnzdLs#wPzG[y?Xi7BzkVh08[e:By/qwraQq@e\u003eQh6zz1\u003e0A+O@#x)Kifx(v\u003e?q*ACawO\u003c4$wOb:\u0026v@#B6zuarXByd{SB98Cpv@#B6zua-?Byd{SB98Cpv@#B6zu", "n": [ { "c": 2, "d": "Benign high-entropy PE context", "i": "metadata/package/quality/false-positives::benign-high-entropy-pe-context", "o": 26263, "z": 17, "cf": 0.949999988079071 }, { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 26232, "z": 16, "cf": 0.8500000238418579 }, { "c": 2, "d": "System.Runtime.serialization namespace ref", "i": "micro-behaviors/data/serialize/object::runtime-serialization-namespace", "o": 26203, "z": 28, "cf": 0.6000000238418579 } ], "ln": 26187 }, { "b": "e\u003eQh6zu9ZKB97?yq::nhq*ACawO\u003c50wQ5qHn][]*0b#vRyHH\u003c!n][]*0b2\u003e+uR\u003efMBy/Gg0cqZ[uR\u003efM", "n": [ { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 26448, "z": 16, "cf": 0.8500000238418579 } ], "ln": 26432 }, { "b": "z#:#]zdMT/vqP@-yJ:T%q*ACawO\u003c4[x(m[\u003cl$7gCq!p5TraflUy*?t:xjVf(nm=juwPv=(wPRn", "n": [ { "c": 3, "d": "LINQ query operations", "i": "micro-behaviors/data/db/linq::linq-queries", "o": 26592, "z": 11, "cf": 0.699999988079071 } ], "ln": 26576 }, { "b": "0rrv5wO+{^B7CsK8ux*MlVl{?A+Pf1BrAs)gbQgxpf5G6qVD/G8VY}\u00266:=6aarR^Hra]?=r+VR%viwGpocwgZv@2H=wPF#7z!9M]C{4ixwGV2oy?mVgvqYP#Ab]Vgv}/)#wPF#jw/%GprV\u003eBOB8$]eaw3D.z/PY6BzkVhax9x5BZ]JoA+bO2arR^HasHnZqZ\u0026?$zE:\u003eYq+]bdi5APFf/.iIhZ0f-vqYQ:A+6klBz\u0026pkzEE0\u003cwGUA0wft@oAbY-oBrCZEwPz\u0026mvqYP#x(d*9wO(0@By/Gle^-ZzarR^Hl@3=nr+VR%vj\u003eFDod\u003cd*B97#ge(VzbBs{gbz/cXize:r5zdNQbB0a7NpFJ3NB-qqrA=-Bo", "n": [ { "c": 3, "d": "Bulk sensitive server data list", "i": "objectives/exfiltration/cloud/sync-tool::bulk-sensitive-server-data-path", "o": 32131, "z": 128, "cf": 1.0 }, { "c": 2, "d": "Copyright notice", "i": "metadata/package/license::copyright-word", "o": 32102, "z": 9, "cf": 0.6000000238418579 }, { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 32329, "z": 16, "cf": 0.8500000238418579 } ], "ln": 32086 }, { "b": "vpS}\u0026004Lu0rrc2r8[E7q*ACawO\u003c50wQ5qHn][]*e(Mt4x\u003c\u003e*(Dsp]fz/dg1B8L}/xkRTdwKyxNwncd1z/d9Gq*ACawO\u003c50wQ5qHn][]*efE#8A=U@kzAP)gfFk4ifF1tlB.(exA+dyKwP-9nvqEFqp\u003c3k-x\u003e6!EC#OY$wD", "n": [ { "c": 2, "d": "IPv4-like .NET assembly version", "i": "metadata/lang/compiler/managed::dotnet-ipv4-like-version", "o": 32905, "z": 15, "cf": 0.8500000238418579 }, { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 32835, "z": 16, "cf": 0.8500000238418579 } ], "ln": 32819 }, { "b": "x()]+Aa9l/004Li0rvUdq*ACawO\u003c50wQ5qHn][]*e(Mt4x\u003c\u003e*(Dsp]fz/dg1B8L}{BAh8kxglYXz9@kV", "n": [ { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 33953, "z": 16, "cf": 0.8500000238418579 } ], "ln": 33937 }, { "b": "00000000000000000000000000000000000000315c8Xg7YTL^00000000000000000", "n": [ { "c": 1, "d": "PE resource section", "i": "metadata/binary/section/names::pe-resource-section", "o": 43008, "z": 5, "cf": 0.8999999761581421 } ], "ln": 42992 }, { "b": "0000000000000AigYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006Xn[brp!0rr910rr9", "n": [ { "c": 3, "d": "Recognized marker for timing checks", "i": "objectives/anti-analysis/timing/evasion::timing-anti-debug-recognized-marker", "o": 43102, "z": 15, "cf": 0.949999988079071 } ], "ln": 43086 }, { "b": "aoiI:aoiI:001RK2lj=8lJz38z2!IPve$fBC(QOtve$cAwDhYg002y!p5[q{aojXcqVD^$003s98VP)smGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up00341x-JhOBo2.He=X/", "n": [ { "c": 2, "d": "PE CompanyName metadata field", "i": "metadata/package/versioning::pe-companyname-field", "o": 43902, "z": 11, "cf": 0.699999988079071 }, { "c": 2, "d": "PE FileDescription metadata field", "i": "metadata/package/versioning::pe-filedescription-field", "o": 43950, "z": 15, "cf": 0.699999988079071 } ], "ln": 43886 }, { "b": "A@ZaUzu6Up001XM2MK(9mGvc5yYF2DrSDXhASydXx-J5Kzu6Up001.Ne=WN9e=WN9e=WN9003s99@(rwnDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE00341x-JhOBo2.He=X/Il\u0026Y\u003cW", "n": [ { "c": 3, "d": "Dotted-quad PE version metadata marker", "i": "objectives/command-and-control/infrastructure/ip::ipv4-version-metadata-marker", "o": 44046, "z": 11, "cf": 0.9399999976158142 }, { "c": 2, "d": "PE InternalName metadata field", "i": "metadata/package/versioning::pe-internalname-field", "o": 44094, "z": 12, "cf": 0.699999988079071 } ], "ln": 44030 }, { "b": "rSBlxk(:*-003Qh9@(rwpxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE00341x-JhOBo2.He=X/I", "n": [ { "c": 2, "d": "PE OriginalFilename metadata field", "i": "metadata/package/versioning::pe-originalfilename-field", "o": 44270, "z": 16, "cf": 0.699999988079071 } ], "ln": 44254 }, { "b": "wb{ACyYBCn003418VP)spYLIozVBqFBPt[KBo25ove$cAwDhYg00341x-JhOBo2.He=X/Il\u0026Y\u003c", "n": [ { "c": 2, "d": "PE ProductName metadata field", "i": "metadata/package/versioning::pe-productname-field", "o": 44374, "z": 11, "cf": 0.699999988079071 } ], "ln": 44358 }, { "b": "A@ZaUzu6Up004PJf8#1MpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001.Ne=WN9e=WN9d/:5Vh2)", "n": [ { "c": 2, "d": "PE version resource metadata", "i": "metadata/package/versioning::version-resource-metadata", "o": 44462, "z": 14, "cf": 0.8999999761581421 } ], "ln": 44446 }, { "b": "000000000000000000000kFNm3\u0026*nctR#GY000000000000000000000000000000000", "n": [ { "c": 2, "d": "PE .reloc section presence", "i": "metadata/binary/section/names::reloc-section-presence", "o": 45056, "z": 6, "cf": 0.8999999761581421 } ], "ln": 45040 } ], "depth": 1, "facts": { "imp": [ [ "mscoree", "CorDllMain" ] ], "sec": [ [ ".text", 512, 42496, 6.66, "r-x" ], [ ".rsrc", 43008, 2048, 2.88, "r--" ], [ ".reloc", 45056, 512, 0.08, "r--" ] ], "metrics": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "resource_count": 1.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 83073.0, "reloc_overhang_bytes": 500.0, "reloc_overhang_ratio": 0.98, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "version.identity_entropy": 4.06, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0, "version.identity_symbol_ratio": 0.14 }, "file": { "size": 45568.0, "entropy": 6.47, "size_bytes": 45568.0 }, "binary": { "is_pie": 1.0, "code_entropy": 6.66, "string_count": 542.0, "overall_entropy": 6.47, "entropy_variance": 7.27, "avg_string_length": 17.73, "max_string_length": 265.0, "peak_region_bytes": 7168.0, "code_to_data_ratio": 1.0, "peak_region_entropy": 7.8, "string_length_stddev": 19.53, "largest_section_ratio": 0.93, "sentence_string_count": 14.0, "sentence_string_ratio": 0.03, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 42496.0, "entropy_max": 6.66, "entropy_mean": 3.21, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } } }, "id": 11, "mol": "O(Al)H(Db)", "path": "DNV.Vista.SDK.System.Text.Json.0.3.2-preview-4.nupkg!!lib/netstandard2.0/Vista.SDK.System.Text.Json.dll", "risk": 3, "sha": "d7c31bdc6354b9a63a25fe5821dc32d1ce0fd9f00edd77c8c7d9436beea63509", "size": 45568, "traits": [ { "id": "micro-behaviors/data/db/linq::linq-queries", "conf": 0.699999988079071, "crit": 3, "desc": "LINQ query operations", "spans": [ [ 26592, 11 ] ] }, { "id": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "conf": 1.0, "crit": 3, "desc": "JSON polymorphism runtime marker", "spans": [ [ 25639, 16 ] ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 43102, 15 ] ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "spans": [ [ 7736, 4 ] ] }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "spans": [ [ 0, 26 ] ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "spans": [ [ 25655, 4 ] ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "spans": [ [ 44462, 14 ] ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "spans": [ [ 44046, 11 ] ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "metadata/package/versioning::version-word-lower", "conf": 0.4000000059604645, "crit": 2, "desc": "version word (lowercase)", "spans": [ [ 25935, 7 ] ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "spans": [ [ 7736, 4 ] ] } ], "type": "pe" }, { "id": 12, "sha": "8c849950ebdbe681667bdee37fa3612bf7ba7f12ca8f49d9cac58c122ed1081f", "path": "DNV.Vista.SDK.System.Text.Json.0.3.2-preview-4.nupkg!!lib/netstandard2.0/Vista.SDK.System.Text.Json.xml", "size": 544, "type": "xml", "depth": 1 }, { "id": 13, "sha": "3cbe179bcba7494405de7a39821048eef7bd6ed8be6d34a416337fe42053c0ec", "path": "DNV.Vista.SDK.System.Text.Json.0.3.2-preview-4.nupkg!![Content_Types].xml", "size": 650, "type": "xml", "depth": 1 }, { "id": 14, "sha": "3208fc5f7e9cd63945a6e45211211ba39be7787d61a29c328b87f7e99d2b2fe1", "path": "DNV.Vista.SDK.System.Text.Json.0.3.2-preview-4.nupkg!!package/services/metadata/core-properties/4f2c3092b9c34738a90ab7b0fe5d5f14.psmdcp", "size": 942, "type": "xml", "depth": 1 }, { "id": 15, "sha": "a2512e905a55f070e745f16fb0998d98aa542550cef7506f37c6f73bfef08456", "path": "DNV.Vista.SDK.System.Text.Json@0.3.2-preview-4.registry.json", "size": 1085, "type": "registry", "depth": 1 } ], "omitted_files": 10, "rev": "20834", "v": "8" } }