{ "llm": { "conf": 0.6460633, "grade": "benign", "model": "Qwen/Qwen3.6-27B", "outcome": "benign", "interpretation": "Legitimate .NET library strings" }, "ml": { "v": "7", "eng": "2.3.0-beta.0", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.4943762, "rte": "az", "prob": 0.4943762 } ], "prob": 0.4943762, "skip": [ { "rte": "az/zip", "why": "unavailable" }, { "rte": "az/zip", "why": "unavailable" } ], "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.49437621235847473, "type": "nupkg" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.00012001395225524902, "type": "xml" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.008743494749069214, "type": "xml" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.008203089237213135, "type": "markdown" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.04494369029998779, "type": "pe" }, { "id": 5, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "xml" }, { "id": 6, "lvl": -1, "conf": 0, "prob": 0.04494369029998779, "type": "pe" }, { "id": 7, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "xml" }, { "id": 8, "lvl": -1, "conf": 0, "prob": 0.04494369029998779, "type": "pe" }, { "id": 9, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "xml" }, { "id": 10, "lvl": -1, "conf": 0, "prob": 0.49437621235847473, "type": "xml" }, { "id": 11, "lvl": -1, "conf": 0, "prob": 0.00012001395225524902, "type": "xml" }, { "id": 12, "lvl": -1, "conf": 0, "prob": 0.49437621235847473, "type": "registry" } ], "version": "v18.18", "analyzed_at": "2026-07-07T12:20:22Z" }, "path": "Facet.Dashboard.6.6.8-preview.pr389.110.nupkg", "raw": { "files": [ { "id": 0, "mol": "O(Al)H₂(CmDb)", "sha": "d720c82de9bb1ca96bfa12784d44b859737600d2e926c01521b797c3084ad3df", "path": "Facet.Dashboard.6.6.8-preview.pr389.110.nupkg", "risk": 4, "size": 93017, "type": "nupkg", "facts": { "metrics": { "file": { "size": 93017.0, "entropy": 7.98, "size_bytes": 93017.0 }, "binary": { "overall_entropy": 7.98, "peak_region_bytes": 88064.0, "peak_region_entropy": 7.84 }, "archive": { "file_count": 12.0, "member_count": 12.0, "script_count": 0.0, "zip_bomb_ratio": 7.09, "directory_count": 0.0, "executable_count": 3.0, "extra_field_size": 0.0, "noise_file_count": 0.0, "total_compressed": 91407.0, "compression.ratio": 0.36, "hidden_file_count": 2.0, "total_uncompressed": 251271.0, "crc_collision_count": 2.0, "entry_comment_count": 0.0, "max_filename_length": 81.0, "rtlo_filename_count": 0.0, "format.regular_count": 12.0, "nested_archive_count": 0.0, "path_traversal_count": 0.0, "symlink_escape_count": 0.0, "security.setgid_count": 0.0, "security.setuid_count": 0.0, "security.sticky_count": 0.0, "double_extension_count": 0.0, "duplicate_member_count": 0.0, "security.symlink_count": 0.0, "unicode_filename_count": 0.0, "homoglyph_filename_count": 0.0, "security.encrypted_count": 0.0, "timing.mtime_unique_count": 4.0, "timing.mtime_unique_ratio": 0.33, "misplaced_executable_count": 3.0, "timing.mtime_dominant_count": 6.0, "timing.mtime_spread_seconds": 25160.0, "timing.sentinel_mtime_count": 0.0, "security.world_writable_count": 0.0, "timing.mtime_dominant_fraction": 0.5, "compression.method_counts.stored": 1.0, "compression.method_counts.deflate": 11.0 } } }, "ident": { "name": { "value": "Facet Dashboard", "source": "nupkg.title", "verified": false }, "urls": [ { "url": "https://github.com/Tim-Maes/Facet", "kind": "repository", "source": "nupkg.repository_url" } ], "trust": "unsigned", "authors": [ { "name": "Tim Maes", "role": "author", "source": "nupkg.authors" } ], "version": { "value": "6.6.8-preview.pr389.110", "source": "nupkg.version", "verified": false }, "identifier": { "value": "Facet.Dashboard", "source": "nupkg.id", "verified": false } }, "traits": [ { "id": "micro-behaviors/communications/http/server/managed::http-response-get", "conf": 1.0, "crit": 3, "desc": "Access to ASP.NET Response object", "from": [ { "file": 4 } ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "from": [ { "file": 4 } ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "from": [ { "file": 4 } ] }, { "id": "objectives/anti-analysis/self-modify/runtime::dotnet-getexecutingassembly-token", "atk": "T1027.005", "conf": 0.8799999952316284, "crit": 3, "desc": ".NET current assembly lookup", "from": [ { "file": 4 } ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "micro-behaviors/communications/http/server/managed::http-request-get", "conf": 1.0, "crit": 3, "desc": "Access to ASP.NET Request object", "from": [ { "file": 4 } ] }, { "id": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "conf": 1.0, "crit": 3, "desc": "JSON polymorphism runtime marker", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/data/db/linq::linq-queries", "conf": 0.699999988079071, "crit": 3, "desc": "LINQ query operations", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/communications/http/server/managed::http-context-item-setter", "conf": 0.8500000238418579, "crit": 3, "desc": "Modification of HTTP context items", "from": [ { "off": 32830, "file": 4 }, { "off": 32830, "file": 6 }, { "off": 32830, "file": 8 } ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/communications/http/server/managed::http-context", "conf": 1.0, "crit": 3, "desc": "Access to ASP.NET HttpContext", "from": [ { "file": 4 } ] }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/communications/http/server/managed::http-item-setter", "conf": 1.0, "crit": 1, "desc": "Modification of HTTP context items", "from": [ { "file": 4 } ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "from": [ { "file": 4 } ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "from": [ { "file": 4 }, { "file": 6 }, { "file": 8 } ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "from": [ { "file": 4 } ] } ] }, { "id": 1, "sha": "45ae77b3afb8ac8b6e5cd9f6419aeb454350a82933402920da544335ca91e250", "path": "Facet.Dashboard.6.6.8-preview.pr389.110.nupkg!!_rels/.rels", "size": 505, "type": "xml", "depth": 1 }, { "ctx": [ { "b": "[4ls%kx}3YaA?spB7]MgjT8QkfD}SJzEWP}x(mMDb6w0teJs}sj]", "n": [ { "c": 2, "d": "NuGet nuspec manifest file", "i": "metadata/build/manifest::nuspec-file", "o": 0, "z": 22, "cf": 0.9800000190734863 } ], "ln": 1, "addr": 0 }, { "b": "jAa.syHH\u003c!aB4:tzGv@+xMOuniXJdcv}YB\u003cvrj5rx\u003e8g4B8LVje[n*pfk$ufyHH\u003c\u0026zF7QTfFLvpfF$I3B-RIkv\u003eJ1EwfKh", "ln": 2, "addr": 42 }, { "b": "arS^-wPRu\u003evrt{w", "ln": 3, "addr": 118 }, { "b": "arR^Hjy\u00262Av@=p5BzkVhk2VVlxj\u003e^@eO]cpwGUI(B7/33vrb)3w]zYjC4(2uvqGU7x(mMamQY!rBrCTyB-H#6aAR)FwPF#5zE:(ixK$)#azkn6wPzj3wN(]}vpJ\u003e\u003cB0bgmave}5e(1\u0026mavy6/wGUA2Abok#vruj4zGvA)fjXTnv@=p5BzkVhj]", "ln": 11, "addr": 410 }, { "b": "arR^HjAL1AB3shAv}x:8wmoK)vSbW}wfu5fB9g]cx)Kifx(v(iB9z59xjV9avrly9wPRB2A+cw7Bz\u0026pvA=kY7v@#B6zxK1sB-H#6eOwTjwPzj3z/N@[Byw*6j]", "ln": 12, "addr": 556 }, { "b": "arR^HjAt1Lz/YSmz/QaCBA}?pjTaJMBrR\u0026IA+)(.xMOunB2\u003e%cxk8E3BZ=$kz/4dbx(bB@vp:HkmQY!rBrR\u0026qz/6u9BuH*bwmmtHhA0uIiwrcyfFUHAvM4TGixgRawhdNKv(4TIf/7H}iC8+Batk[", "n": [ { "c": 2, "d": "NuGet package declares repository", "i": "metadata/package/files/nuget::nuspec-repository", "o": 658, "z": 70, "cf": 0.8999999761581421 } ], "ln": 13, "addr": 654 }, { "b": "arR^Hjy\u00262xwO#3\u0026zEWx(B3o", "n": [ { "c": 2, "d": "NuGet package declares dependencies", "i": "metadata/package/files/nuget::nuspec-dependencies", "o": 778, "z": 392, "cf": 0.8999999761581421 } ], "ln": 14, "addr": 774 }, { "b": "arR^HarS^VA=l8taAR4jxjVfOA:-/@Cw?IqjTa=PBtkE4fD@W", "ln": 15, "addr": 793 }, { "b": "arR^HarR^Hjy\u00262xwO#3\u0026zEW@mx\u003efvJmQY!rBs]\u003e3BAh88B-.hoa%q5uA=U@kzAPg4e\u0026CswePt-wC4\u003eJie]U?!i5@PCf!:^]wQ4Z3B.25Db0{A^y?b7.zEEvbDs.bra%nK5", "ln": 16, "addr": 833 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 1720.0, "entropy": 4.99, "size_bytes": 1720.0 }, "binary": { "overall_entropy": 4.99, "peak_region_bytes": 1720.0, "peak_region_entropy": 5.07 } } }, "id": 2, "path": "Facet.Dashboard.6.6.8-preview.pr389.110.nupkg!!Facet.Dashboard.nuspec", "risk": 1, "sha": "3a3391af49fc4063ffbeabaaf3cd4b81707c68c4afe68344c0b7cd85aa36ec79", "size": 1720, "traits": [ { "id": "metadata/build/manifest::nuspec-file", "conf": 0.9800000190734863, "crit": 2, "desc": "NuGet nuspec manifest file", "spans": [ [ 0, 22 ] ] }, { "id": "metadata/package/files/nuget::nuspec-repository", "conf": 0.8999999761581421, "crit": 2, "desc": "NuGet package declares repository", "spans": [ [ 658, 70 ] ] }, { "id": "metadata/package/files/nuget::nuspec-dependencies", "conf": 0.8999999761581421, "crit": 2, "desc": "NuGet package declares dependencies", "spans": [ [ 778, 392 ] ] } ], "type": "xml" }, { "ctx": [ { "b": "boPD:v}x:ml$7dIvSbW}wb", "n": [ { "c": 3, "d": "Recognized domain reference marker", "i": "objectives/command-and-control/infrastructure/domain/tld::recognized-reference-marker", "o": 0, "z": 9, "cf": 0.8999999761581421 } ], "ln": 1, "addr": 0 }, { "b": "", "ln": 2, "addr": 18 }, { "b": "k{f9Ivp%j:AXh9wyH[S0vrl9\u003ez^^V%azbLjaA?EuBZY92DtdnfayP85avY^HwPP5oz/{8gwGV8uAaK8kvqYP#Bzbl1AV/1azE)\u0026%By!#9w)]gXBAnNszxKjyB-FQkAbYScv{%E[z/df", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 44, "z": 3, "cf": 0.800000011920929 } ], "ln": 3, "addr": 19 }, { "b": "", "ln": 4, "addr": 131 }, { "b": "bo[s0wO(t", "ln": 5, "addr": 132 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 6453.0, "entropy": 5.0, "size_bytes": 6453.0 }, "text": { "digit_ratio": 0.01, "space_count": 1045.0, "total_lines": 248.0, "char_entropy": 5.0, "unique_chars": 86.0, "ascii_art_lines": 1.0, "avg_line_length": 25.02, "max_line_length": 172.0, "empty_line_ratio": 0.23, "last_line_length": 115.0, "whitespace_ratio": 0.2, "most_common_ratio": 0.08, "line_length_stddev": 28.15, "repeated_char_sequences": 16.0, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 10.0, "most_common_char_codepoint": 101.0 }, "binary": { "overall_entropy": 5.0, "peak_region_bytes": 5429.0, "peak_region_entropy": 5.0 } } }, "id": 3, "path": "Facet.Dashboard.6.6.8-preview.pr389.110.nupkg!!README.md", "risk": 1, "sha": "ebd8996f4fc3a52a7345b441da7c9c6327bc7ff694e9cb944131ecbe0fa05a1f", "size": 6453, "traits": [ { "id": "metadata/file/extension/identity::doc-or-config-extension", "conf": 1.0, "crit": 1, "desc": "Document or config file extension", "spans": [ [ 0, 9 ] ] }, { "id": "metadata/file/profile/language::lang-english", "conf": 0.800000011920929, "crit": 2, "desc": "English language detection", "spans": [ [ 44, 3 ] ] }, { "id": "metadata/file/extension/identity::markdown-file-basename", "conf": 1.0, "crit": 1, "desc": "Markdown document file extension", "spans": [ [ 0, 9 ] ] } ], "type": "markdown" }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J\u0026m(", "n": [ { "c": 3, "d": "HTTP fingerprinting evasion campaign", "i": "objectives/command-and-control/infrastructure/user-agent::http-fingerprinting-campaign", "o": 0, "z": 34, "cf": 0.8999999761581421 } ], "ln": 0 }, { "b": "00000000000000000000-rcbv00000nb@R\u00260SSx7r8AR}[oL6m0rr9100000m9CShu\u0026", "n": [ { "c": 1, "d": "PE standard code/data section", "i": "metadata/binary/section/names::pe-code-data-standard-section", "o": 512, "z": 5, "cf": 0.8999999761581421 } ], "ln": 496 }, { "b": "huFnA000c7c[tq#3mV2Qlq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn", "n": [ { "c": 3, "d": "Recognized PE anti-analysis marker", "i": "objectives/anti-analysis/debugger-detect/combined-checks::evasion-aware-recognized-pe-marker", "o": 13140, "z": 4, "cf": 1.0 } ], "ln": 13124 }, { "b": "u]XiHo(BM+y?k^gju=Kvq*ACawO\u003c4\u003epxi+8B98tql3di?x\u003c#jbwKG%Gve@zNv/QdMBydQXl\u0026", "n": [ { "c": 2, "d": "System namespace reference", "i": "metadata/lang/compiler/managed::system-namespace", "o": 24619, "z": 9, "cf": 0.800000011920929 } ], "ln": 24603 }, { "b": "wDlvOBydyzzdNJJvrk#WxjVf(qE%]*z/fSc07.iNA8Hm*AbPSnwDkbjB8V5swDk8rwNPW(08^xF", "n": [ { "c": 3, "d": "Access to ASP.NET Response object", "i": "micro-behaviors/communications/http/server/managed::http-response-get", "o": 27969, "z": 12, "cf": 1.0 } ], "ln": 27953 }, { "b": "07HybwPPK)vrl9\u003ez^^V%e[w^m07QQrwPzj3wKG%FxKU)*A+4Z.zeohxwPQsGB7/33", "n": [ { "c": 3, "d": "References Windows executable or script", "i": "objectives/execution/interpreter/script/shell::windows-executable-ref", "o": 28975, "z": 4, "cf": 0.6000000238418579 } ], "ln": 28959 }, { "b": "zdNM[wPxwyz*9*EBzU*]m}D^pvqY^\u003ewPI@\u003ewPI^jA:@VVBAg@3z2!iWBydQYwO?A*wPRoJBy/p?q*ACawO?AVz2!S]08[2S07ggjv}xE)vruj4zD7J", "n": [ { "c": 3, "d": "Modification of HTTP context items", "i": "micro-behaviors/communications/http/server/managed::http-context-item-setter", "o": 29321, "z": 8, "cf": 0.8500000238418579 }, { "c": 2, "d": ".NET manifest resource stream access", "i": "micro-behaviors/data/embedded/payload/resource::dotnet-getmanifestresourcestream", "o": 29286, "z": 25, "cf": 0.8500000238418579 } ], "ln": 29270 }, { "b": "zeqQUv%8T1zGGrex(v\u003e?q*ACawO\u003c50wQ5qHn][]*e(Mt4x\u003c\u003e*(Dsp]fz/bLMwPq\u003cbA+dKVBzbPkx)Kif", "n": [ { "c": 3, "d": "JSON polymorphism runtime marker", "i": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "o": 29522, "z": 16, "cf": 1.0 } ], "ln": 29506 }, { "b": "zuauUB5l)}ygQ)%x(v\u003e?q*ACawO\u003c4$wOb:\u0026v@#B6zu9mbwPz%dv}w2Cy\u00260V)BzkVh0b2\u003e+uRbraz!%l3v/", "n": [ { "c": 2, "d": "Benign high-entropy PE context", "i": "metadata/package/quality/false-positives::benign-high-entropy-pe-context", "o": 29647, "z": 17, "cf": 0.949999988079071 } ], "ln": 29631 }, { "b": "z/bLNwPQv=v}xR3x(v\u003e?q*ACawO\u003c50wQ5qHn][]*08)#Wx(mMJz/6D4A+PPkzu8$kwk^hWxkzd3z/bLA", "n": [ { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 29875, "z": 16, "cf": 0.8500000238418579 } ], "ln": 29859 }, { "b": "l340uwPQpTA+c\u003c]BAzE4q*ACawO\u003c4[x(m[\u003cjv%P(wPq\u003cbA+e=Byf$sEp*[wAjxcPBwLl-PwiK-", "n": [ { "c": 3, "d": "LINQ query operations", "i": "micro-behaviors/data/db/linq::linq-queries", "o": 30091, "z": 11, "cf": 0.699999988079071 } ], "ln": 30075 }, { "b": "z/6Dcy?mS=wPz%dv}xYYxjVf(qE%\u0026\u003cwPI@(wPz%dv}xYYB7Gxnx\u003e7Z}07pycB.tu3zF8WZwmY/", "n": [ { "c": 3, "d": "Access to ASP.NET Request object", "i": "micro-behaviors/communications/http/server/managed::http-request-get", "o": 31360, "z": 11, "cf": 1.0 } ], "ln": 31344 }, { "b": "wQ5p%q*ACawO\u003c50wQ5p%now@)lVl\u003c:wQ5p%v@DmbwQ5p%xjVf(qG3Y1wL^zUw[=F\u0026B7GD2qG3W", "n": [ { "c": 3, "d": "Access to ASP.NET HttpContext", "i": "micro-behaviors/communications/http/server/managed::http-context", "o": 32830, "z": 11, "cf": 1.0 } ], "ln": 32814 }, { "b": "zCUm/x\u003e8z*xjVf(oj-wGm}D^hCX7xcBzkS9l349Uzdmsb07?lgD2[7sz9-k:wO\u003e))C(QlDB7ociwPymXz/4{X", "n": [ { "c": 3, "d": ".NET current assembly lookup", "i": "objectives/anti-analysis/self-modify/runtime::dotnet-getexecutingassembly-token", "o": 33044, "z": 20, "cf": 0.8799999952316284 } ], "ln": 33028 }, { "b": "v/QJHzVB?UzVBwHBn#pMz2!RSv/QAEASx[Qx-IPx02GIMwDl/LA@ZpZve$fBwb{3rASxRI", "n": [ { "c": 2, "d": "mscorlib reference", "i": "metadata/lang/compiler/managed::mscorlib", "o": 37719, "z": 8, "cf": 0.8999999761581421 } ], "ln": 37703 }, { "b": "i4rW^u\u003cK#66Aure?beZ/jofB5B]VdPaolM+x-IYACk%@fzVC1ZjPDVafAri}fAri}g5%chaojd%gYOZ1aol0Nx-I@HyYDP#a](GXzVBUPwDi[OaolD.Bo3sYzVBLMwDj\u003c[a](9MBPuBZASxUJzua+UlJz38yYFwNASvo-aolD.Bo3sYzVBLMwDjpZCk#s", "n": [ { "c": 1, "d": "Encoded HTML tag fragment", "i": "objectives/anti-static/obfuscation/encoding/content::encoded-html-tag-fragment", "o": 42248, "z": 103, "cf": 0.699999988079071 } ], "ln": 42232 }, { "b": "iV{vnfGPQ:arR^HarR^HarR!qx(!lfvr\u003c)Rw]846i%)8MarR^HarR^HarU9ex\u003eIrn", "n": [ { "c": 3, "d": "Development toolchain indicators", "i": "metadata/build/toolchain::development-toolchain-indicators", "o": 46094, "z": 4, "cf": 1.0 } ], "ln": 46078 }, { "b": "00000000000000000000000000000000000000315c8Xg7YTL^00000000000000000", "n": [ { "c": 1, "d": "PE resource section", "i": "metadata/binary/section/names::pe-resource-section", "o": 58880, "z": 5, "cf": 0.8999999761581421 } ], "ln": 58864 }, { "b": "0000000000003WngYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006Xn[brp!0rrr71][S", "n": [ { "c": 3, "d": "Recognized marker for timing checks", "i": "objectives/anti-analysis/timing/evasion::timing-anti-debug-recognized-marker", "o": 58974, "z": 15, "cf": 0.949999988079071 } ], "ln": 58958 }, { "b": "zua.Te=U\u003eK001+O2(\u003c#alJz38z2!IPve$fBC(QOtve$cAwDhYg002%#x-I#Iaokaove%\u003csA@Vgu002K\u00265c8.hmGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up002E*ve%^qwDl/Le=Xo", "n": [ { "c": 2, "d": "PE CompanyName metadata field", "i": "metadata/package/versioning::pe-companyname-field", "o": 59450, "z": 11, "cf": 0.699999988079071 }, { "c": 2, "d": "PE FileDescription metadata field", "i": "metadata/package/versioning::pe-filedescription-field", "o": 59502, "z": 15, "cf": 0.699999988079071 } ], "ln": 59434 }, { "b": "zVBhCASxRI001XM2MK(9mGvc5yYF2DrSDXhASydXx-J5Kzu6Up001[Se=W^fe=W\u003che=WN9002K\u00266AwdlnDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE002E*ve%^qwDl/Le=Xotve$uG", "n": [ { "c": 3, "d": "Dotted-quad PE version metadata marker", "i": "objectives/command-and-control/infrastructure/ip::ipv4-version-metadata-marker", "o": 59574, "z": 11, "cf": 0.9399999976158142 }, { "c": 2, "d": "PE InternalName metadata field", "i": "metadata/package/versioning::pe-internalname-field", "o": 59622, "z": 12, "cf": 0.699999988079071 } ], "ln": 59558 }, { "b": "xAibO001bw002*}6Awdlpxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE002E*ve%^qwDl/Le=Xot", "n": [ { "c": 2, "d": "PE OriginalFilename metadata field", "i": "metadata/package/versioning::pe-originalfilename-field", "o": 59734, "z": 16, "cf": 0.699999988079071 } ], "ln": 59718 }, { "b": "e=YzZyYFnK002m:5c8.hpYLIozVBqFBPt[KBo25ove$cAwDhYg002E*ve%^qwDl/Le=Xotve$u", "n": [ { "c": 2, "d": "PE ProductName metadata field", "i": "metadata/package/versioning::pe-productname-field", "o": 59814, "z": 11, "cf": 0.699999988079071 } ], "ln": 59798 }, { "b": "zVBhCASxRI005\u003e@k(Z]=pYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001[Se=W^fe=W\u003cheDx.\u0026ASu", "n": [ { "c": 2, "d": "PE version resource metadata", "i": "metadata/package/versioning::version-resource-metadata", "o": 59878, "z": 14, "cf": 0.8999999761581421 } ], "ln": 59862 }, { "b": "00000000000000000000000313\u0026*nc\u003eRAhs000000000000000000000000000000000", "n": [ { "c": 2, "d": "PE .reloc section presence", "i": "metadata/binary/section/names::reloc-section-presence", "o": 60416, "z": 6, "cf": 0.8999999761581421 } ], "ln": 60400 } ], "depth": 1, "facts": { "imp": [ [ "mscoree", "CorDllMain" ] ], "sec": [ [ ".text", 512, 58368, 5.87, "r-x" ], [ ".rsrc", 58880, 1536, 2.82, "r--" ], [ ".reloc", 60416, 512, 0.08, "r--" ] ], "metrics": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "resource_count": 1.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 103532.0, "reloc_overhang_bytes": 500.0, "reloc_overhang_ratio": 0.98, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "version.identity_entropy": 3.95, "clr.managed_resource_count": 1.0, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0, "clr.managed_resource_max_size": 11203.0, "version.identity_symbol_ratio": 0.05, "clr.managed_resource_max_entropy": 4.13 }, "file": { "size": 60928.0, "entropy": 5.77, "size_bytes": 60928.0 }, "binary": { "is_pie": 1.0, "code_entropy": 5.87, "string_count": 854.0, "overall_entropy": 5.77, "entropy_variance": 5.59, "avg_string_length": 22.19, "max_string_length": 775.0, "peak_region_bytes": 2048.0, "code_to_data_ratio": 1.0, "peak_region_entropy": 6.05, "string_length_stddev": 32.37, "largest_section_ratio": 0.96, "sentence_string_count": 77.0, "sentence_string_ratio": 0.09, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 58368.0, "entropy_max": 5.87, "entropy_mean": 2.92, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } } }, "id": 4, "mol": "O(Al)H₂(CmDb)", "path": "Facet.Dashboard.6.6.8-preview.pr389.110.nupkg!!lib/net10.0/Facet.Dashboard.dll", "risk": 4, "sha": "4aabaf8833832f0a304acd69fbe064498bd5d6d6325aed99ecd897415a9b3f2a", "size": 60928, "traits": [ { "id": "micro-behaviors/communications/http/server/managed::http-response-get", "conf": 1.0, "crit": 3, "desc": "Access to ASP.NET Response object", "spans": [ [ 27969, 12 ] ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "spans": [ [ 59878, 14 ] ] }, { "id": "micro-behaviors/data/db/linq::linq-queries", "conf": 0.699999988079071, "crit": 3, "desc": "LINQ query operations", "spans": [ [ 30091, 11 ] ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 58974, 15 ] ] }, { "id": "micro-behaviors/communications/http/server/managed::http-item-setter", "conf": 1.0, "crit": 1, "desc": "Modification of HTTP context items", "spans": [ [ 29321, 8 ] ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "objectives/anti-analysis/self-modify/runtime::dotnet-getexecutingassembly-token", "atk": "T1027.005", "conf": 0.8799999952316284, "crit": 3, "desc": ".NET current assembly lookup", "spans": [ [ 33044, 20 ] ] }, { "id": "micro-behaviors/communications/http/server/managed::http-context", "conf": 1.0, "crit": 3, "desc": "Access to ASP.NET HttpContext", "spans": [ [ 32830, 11 ] ] }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "spans": [ [ 0, 26 ] ] }, { "id": "micro-behaviors/communications/http/server/managed::http-request-get", "conf": 1.0, "crit": 3, "desc": "Access to ASP.NET Request object", "spans": [ [ 31360, 11 ] ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "spans": [ [ 13140, 4 ] ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "spans": [ [ 28975, 4 ] ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "spans": [ [ 59574, 11 ] ] }, { "id": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "conf": 1.0, "crit": 3, "desc": "JSON polymorphism runtime marker", "spans": [ [ 29522, 16 ] ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "spans": [ [ 13140, 4 ] ] }, { "id": "micro-behaviors/communications/http/server/managed::http-context-item-setter", "conf": 0.8500000238418579, "crit": 3, "desc": "Modification of HTTP context items", "spans": [ [ 29321, 8 ], [ 32830, 11 ] ] } ], "type": "pe" }, { "id": 5, "sha": "a61c26ca3ed4fa7b2553b8cda81bda093482f5eb78ed8fef273e8902406e876a", "path": "Facet.Dashboard.6.6.8-preview.pr389.110.nupkg!!lib/net10.0/Facet.Dashboard.xml", "size": 15147, "type": "xml", "depth": 1 }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J\u0026m(", "n": [ { "c": 3, "d": "HTTP fingerprinting evasion campaign", "i": "objectives/command-and-control/infrastructure/user-agent::http-fingerprinting-campaign", "o": 0, "z": 34, "cf": 0.8999999761581421 } ], "ln": 0 }, { "b": "00000000000000000000.#*2u00000nb@R\u00260SSx7r8AR}[oL6m0rr9100000m9CShu\u0026", "n": [ { "c": 1, "d": "PE standard code/data section", "i": "metadata/binary/section/names::pe-code-data-standard-section", "o": 512, "z": 5, "cf": 0.8999999761581421 } ], "ln": 496 }, { "b": "huFnA000c7c[tq#3mV2Qlq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn", "n": [ { "c": 3, "d": "Recognized PE anti-analysis marker", "i": "objectives/anti-analysis/debugger-detect/combined-checks::evasion-aware-recognized-pe-marker", "o": 13140, "z": 4, "cf": 1.0 } ], "ln": 13124 }, { "b": "u]XiHo(BM+y?k^gju=Kvq*ACawO\u003c4\u003epxi+8B98tql3di?x\u003c#jbwKG%Gve@zNv/QdMBydQXl\u0026", "n": [ { "c": 2, "d": "System namespace reference", "i": "metadata/lang/compiler/managed::system-namespace", "o": 24619, "z": 9, "cf": 0.800000011920929 } ], "ln": 24603 }, { "b": "wDlvOBydyzzdNJJvrk#WxjVf(qE%]*z/fSc07.iNA8Hm*AbPSnwDkbjB8V5swDk8rwNPW(08^xF", "n": [ { "c": 3, "d": "Access to ASP.NET Response object", "i": "micro-behaviors/communications/http/server/managed::http-response-get", "o": 27969, "z": 12, "cf": 1.0 } ], "ln": 27953 }, { "b": "07HybwPPK)vrl9\u003ez^^V%e[w^m07QQrwPzj3wKG%FxKU)*A+4Z.zeohxwPQsGB7/33", "n": [ { "c": 3, "d": "References Windows executable or script", "i": "objectives/execution/interpreter/script/shell::windows-executable-ref", "o": 28975, "z": 4, "cf": 0.6000000238418579 } ], "ln": 28959 }, { "b": "zdNM[wPxwyz*9*EBzU*]m}D^pvqY^\u003ewPI@\u003ewPI^jA:@VVBAg@3z2!iWBydQYwO?A*wPRoJBy/p?q*ACawO?AVz2!S]08[2S07ggjv}xE)vruj4zD7J", "n": [ { "c": 3, "d": "Modification of HTTP context items", "i": "micro-behaviors/communications/http/server/managed::http-context-item-setter", "o": 29321, "z": 8, "cf": 0.8500000238418579 }, { "c": 2, "d": ".NET manifest resource stream access", "i": "micro-behaviors/data/embedded/payload/resource::dotnet-getmanifestresourcestream", "o": 29286, "z": 25, "cf": 0.8500000238418579 } ], "ln": 29270 }, { "b": "zeqQUv%8T1zGGrex(v\u003e?q*ACawO\u003c50wQ5qHn][]*e(Mt4x\u003c\u003e*(Dsp]fz/bLMwPq\u003cbA+dKVBzbPkx)Kif", "n": [ { "c": 3, "d": "JSON polymorphism runtime marker", "i": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "o": 29522, "z": 16, "cf": 1.0 } ], "ln": 29506 }, { "b": "zuauUB5l)}ygQ)%x(v\u003e?q*ACawO\u003c4$wOb:\u0026v@#B6zu9mbwPz%dv}w2Cy\u00260V)BzkVh0b2\u003e+uRbraz!%l3v/", "n": [ { "c": 2, "d": "Benign high-entropy PE context", "i": "metadata/package/quality/false-positives::benign-high-entropy-pe-context", "o": 29647, "z": 17, "cf": 0.949999988079071 } ], "ln": 29631 }, { "b": "z/bLNwPQv=v}xR3x(v\u003e?q*ACawO\u003c50wQ5qHn][]*08)#Wx(mMJz/6D4A+PPkzu8$kwk^hWxkzd3z/bLA", "n": [ { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 29875, "z": 16, "cf": 0.8500000238418579 } ], "ln": 29859 }, { "b": "l340uwPQpTA+c\u003c]BAzE4q*ACawO\u003c4[x(m[\u003cjv%P(wPq\u003cbA+e=Byf$sEp*[wAjxcPBwLl-PwiK-", "n": [ { "c": 3, "d": "LINQ query operations", "i": "micro-behaviors/data/db/linq::linq-queries", "o": 30091, "z": 11, "cf": 0.699999988079071 } ], "ln": 30075 }, { "b": "z/6Dcy?mS=wPz%dv}xYYxjVf(qE%\u0026\u003cwPI@(wPz%dv}xYYB7Gxnx\u003e7Z}07pycB.tu3zF8WZwmY/", "n": [ { "c": 3, "d": "Access to ASP.NET Request object", "i": "micro-behaviors/communications/http/server/managed::http-request-get", "o": 31360, "z": 11, "cf": 1.0 } ], "ln": 31344 }, { "b": "wQ5p%q*ACawO\u003c50wQ5p%now@)lVl\u003c:wQ5p%v@DmbwQ5p%xjVf(qG3Y1wL^zUw[=F\u0026B7GD2qG3W", "n": [ { "c": 3, "d": "Access to ASP.NET HttpContext", "i": "micro-behaviors/communications/http/server/managed::http-context", "o": 32830, "z": 11, "cf": 1.0 } ], "ln": 32814 }, { "b": "zCUm/x\u003e8z*xjVf(oj-wGm}D^hCX7xcBzkS9l349Uzdmsb07?lgD2[7sz9-k:wO\u003e))C(QlDB7ociwPymXz/4{X", "n": [ { "c": 3, "d": ".NET current assembly lookup", "i": "objectives/anti-analysis/self-modify/runtime::dotnet-getexecutingassembly-token", "o": 33044, "z": 20, "cf": 0.8799999952316284 } ], "ln": 33028 }, { "b": "v/QJHzVB?UzVBwHBn#pMz2!RSv/QAEASx[Qx-IPx02GIMwDl/LA@ZpZve$fBwb{3rASxRI", "n": [ { "c": 2, "d": "mscorlib reference", "i": "metadata/lang/compiler/managed::mscorlib", "o": 37719, "z": 8, "cf": 0.8999999761581421 } ], "ln": 37703 }, { "b": "i4rW^u\u003cK#66Aure?beZ/jofB5B]VdPaolM+x-IYACk%@fzVC1ZjPDVafAri}fAri}g5%chaojd%gYOZ1aol0Nx-I@HyYDP#a](GXzVBUPwDi[OaolD.Bo3sYzVBLMwDj\u003c[a](9MBPuBZASxUJzua+UlJz38yYFwNASvo-aolD.Bo3sYzVBLMwDjpZCk#s", "n": [ { "c": 1, "d": "Encoded HTML tag fragment", "i": "objectives/anti-static/obfuscation/encoding/content::encoded-html-tag-fragment", "o": 42248, "z": 103, "cf": 0.699999988079071 } ], "ln": 42232 }, { "b": "iV{vnfGPQ:arR^HarR^HarR!qx(!lfvr\u003c)Rw]846i%)8MarR^HarR^HarU9ex\u003eIrn", "n": [ { "c": 3, "d": "Development toolchain indicators", "i": "metadata/build/toolchain::development-toolchain-indicators", "o": 46094, "z": 4, "cf": 1.0 } ], "ln": 46078 }, { "b": "00000000000000000000000000000000000000315c8Xg7YTL^00000000000000000", "n": [ { "c": 1, "d": "PE resource section", "i": "metadata/binary/section/names::pe-resource-section", "o": 58880, "z": 5, "cf": 0.8999999761581421 } ], "ln": 58864 }, { "b": "0000000000003WngYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006Xn[brp!0rrr71][S", "n": [ { "c": 3, "d": "Recognized marker for timing checks", "i": "objectives/anti-analysis/timing/evasion::timing-anti-debug-recognized-marker", "o": 58974, "z": 15, "cf": 0.949999988079071 } ], "ln": 58958 }, { "b": "zua.Te=U\u003eK001+O2(\u003c#alJz38z2!IPve$fBC(QOtve$cAwDhYg002%#x-I#Iaokaove%\u003csA@Vgu002K\u00265c8.hmGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up002E*ve%^qwDl/Le=Xo", "n": [ { "c": 2, "d": "PE CompanyName metadata field", "i": "metadata/package/versioning::pe-companyname-field", "o": 59450, "z": 11, "cf": 0.699999988079071 }, { "c": 2, "d": "PE FileDescription metadata field", "i": "metadata/package/versioning::pe-filedescription-field", "o": 59502, "z": 15, "cf": 0.699999988079071 } ], "ln": 59434 }, { "b": "zVBhCASxRI001XM2MK(9mGvc5yYF2DrSDXhASydXx-J5Kzu6Up001[Se=W^fe=W\u003che=WN9002K\u00266AwdlnDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE002E*ve%^qwDl/Le=Xotve$uG", "n": [ { "c": 3, "d": "Dotted-quad PE version metadata marker", "i": "objectives/command-and-control/infrastructure/ip::ipv4-version-metadata-marker", "o": 59574, "z": 11, "cf": 0.9399999976158142 }, { "c": 2, "d": "PE InternalName metadata field", "i": "metadata/package/versioning::pe-internalname-field", "o": 59622, "z": 12, "cf": 0.699999988079071 } ], "ln": 59558 }, { "b": "xAibO001bw002*}6Awdlpxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE002E*ve%^qwDl/Le=Xot", "n": [ { "c": 2, "d": "PE OriginalFilename metadata field", "i": "metadata/package/versioning::pe-originalfilename-field", "o": 59734, "z": 16, "cf": 0.699999988079071 } ], "ln": 59718 }, { "b": "e=YzZyYFnK002m:5c8.hpYLIozVBqFBPt[KBo25ove$cAwDhYg002E*ve%^qwDl/Le=Xotve$u", "n": [ { "c": 2, "d": "PE ProductName metadata field", "i": "metadata/package/versioning::pe-productname-field", "o": 59814, "z": 11, "cf": 0.699999988079071 } ], "ln": 59798 }, { "b": "zVBhCASxRI005\u003e@k(Z]=pYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001[Se=W^fe=W\u003cheDx.\u0026ASu", "n": [ { "c": 2, "d": "PE version resource metadata", "i": "metadata/package/versioning::version-resource-metadata", "o": 59878, "z": 14, "cf": 0.8999999761581421 } ], "ln": 59862 }, { "b": "00000000000000000000000313\u0026*nc\u003ctc=o000000000000000000000000000000000", "n": [ { "c": 2, "d": "PE .reloc section presence", "i": "metadata/binary/section/names::reloc-section-presence", "o": 60416, "z": 6, "cf": 0.8999999761581421 } ], "ln": 60400 } ], "depth": 1, "facts": { "imp": [ [ "mscoree", "CorDllMain" ] ], "sec": [ [ ".text", 512, 58368, 5.87, "r-x" ], [ ".rsrc", 58880, 1536, 2.82, "r--" ], [ ".reloc", 60416, 512, 0.08, "r--" ] ], "metrics": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "resource_count": 1.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 109467.0, "reloc_overhang_bytes": 500.0, "reloc_overhang_ratio": 0.98, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "version.identity_entropy": 3.95, "clr.managed_resource_count": 1.0, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0, "clr.managed_resource_max_size": 11203.0, "version.identity_symbol_ratio": 0.05, "clr.managed_resource_max_entropy": 4.13 }, "file": { "size": 60928.0, "entropy": 5.78, "size_bytes": 60928.0 }, "binary": { "is_pie": 1.0, "code_entropy": 5.87, "string_count": 856.0, "overall_entropy": 5.78, "entropy_variance": 5.59, "avg_string_length": 22.14, "max_string_length": 775.0, "peak_region_bytes": 2048.0, "code_to_data_ratio": 1.0, "peak_region_entropy": 6.05, "string_length_stddev": 32.34, "largest_section_ratio": 0.96, "sentence_string_count": 77.0, "sentence_string_ratio": 0.09, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 58368.0, "entropy_max": 5.87, "entropy_mean": 2.92, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } } }, "id": 6, "mol": "O(Al)H₂(CmDb)", "path": "Facet.Dashboard.6.6.8-preview.pr389.110.nupkg!!lib/net8.0/Facet.Dashboard.dll", "risk": 4, "sha": "6d412080a6281ce13705a9fbbad0343dcba614b5c8223c21c6c43d46b260de21", "size": 60928, "traits": [ { "id": "micro-behaviors/communications/http/server/managed::http-response-get", "conf": 1.0, "crit": 3, "desc": "Access to ASP.NET Response object", "spans": [ [ 27969, 12 ] ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "spans": [ [ 59878, 14 ] ] }, { "id": "micro-behaviors/data/db/linq::linq-queries", "conf": 0.699999988079071, "crit": 3, "desc": "LINQ query operations", "spans": [ [ 30091, 11 ] ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 58974, 15 ] ] }, { "id": "micro-behaviors/communications/http/server/managed::http-item-setter", "conf": 1.0, "crit": 1, "desc": "Modification of HTTP context items", "spans": [ [ 29321, 8 ] ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "objectives/anti-analysis/self-modify/runtime::dotnet-getexecutingassembly-token", "atk": "T1027.005", "conf": 0.8799999952316284, "crit": 3, "desc": ".NET current assembly lookup", "spans": [ [ 33044, 20 ] ] }, { "id": "micro-behaviors/communications/http/server/managed::http-context", "conf": 1.0, "crit": 3, "desc": "Access to ASP.NET HttpContext", "spans": [ [ 32830, 11 ] ] }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "spans": [ [ 0, 26 ] ] }, { "id": "micro-behaviors/communications/http/server/managed::http-request-get", "conf": 1.0, "crit": 3, "desc": "Access to ASP.NET Request object", "spans": [ [ 31360, 11 ] ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "spans": [ [ 13140, 4 ] ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "spans": [ [ 28975, 4 ] ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "spans": [ [ 59574, 11 ] ] }, { "id": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "conf": 1.0, "crit": 3, "desc": "JSON polymorphism runtime marker", "spans": [ [ 29522, 16 ] ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "spans": [ [ 13140, 4 ] ] }, { "id": "micro-behaviors/communications/http/server/managed::http-context-item-setter", "conf": 0.8500000238418579, "crit": 3, "desc": "Modification of HTTP context items", "spans": [ [ 29321, 8 ], [ 32830, 11 ] ] } ], "type": "pe" }, { "id": 7, "sha": "a61c26ca3ed4fa7b2553b8cda81bda093482f5eb78ed8fef273e8902406e876a", "path": "Facet.Dashboard.6.6.8-preview.pr389.110.nupkg!!lib/net8.0/Facet.Dashboard.xml", "size": 15147, "type": "xml", "depth": 1 }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J\u0026m(", "n": [ { "c": 3, "d": "HTTP fingerprinting evasion campaign", "i": "objectives/command-and-control/infrastructure/user-agent::http-fingerprinting-campaign", "o": 0, "z": 34, "cf": 0.8999999761581421 } ], "ln": 0 }, { "b": "00000000000000000000.#*2u00000nb@R\u00260SSx7r8AR}[oL6m0rr9100000m9CShu\u0026", "n": [ { "c": 1, "d": "PE standard code/data section", "i": "metadata/binary/section/names::pe-code-data-standard-section", "o": 512, "z": 5, "cf": 0.8999999761581421 } ], "ln": 496 }, { "b": "huFnA000c7c[tq#3mV2Qlq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn", "n": [ { "c": 3, "d": "Recognized PE anti-analysis marker", "i": "objectives/anti-analysis/debugger-detect/combined-checks::evasion-aware-recognized-pe-marker", "o": 13140, "z": 4, "cf": 1.0 } ], "ln": 13124 }, { "b": "u]XiHo(BM+y?k^gju=Kvq*ACawO\u003c4\u003epxi+8B98tql3di?x\u003c#jbwKG%Gve@zNv/QdMBydQXl\u0026", "n": [ { "c": 2, "d": "System namespace reference", "i": "metadata/lang/compiler/managed::system-namespace", "o": 24619, "z": 9, "cf": 0.800000011920929 } ], "ln": 24603 }, { "b": "wDlvOBydyzzdNJJvrk#WxjVf(qE%]*z/fSc07.iNA8Hm*AbPSnwDkbjB8V5swDk8rwNPW(08^xF", "n": [ { "c": 3, "d": "Access to ASP.NET Response object", "i": "micro-behaviors/communications/http/server/managed::http-response-get", "o": 27969, "z": 12, "cf": 1.0 } ], "ln": 27953 }, { "b": "07HybwPPK)vrl9\u003ez^^V%e[w^m07QQrwPzj3wKG%FxKU)*A+4Z.zeohxwPQsGB7/33", "n": [ { "c": 3, "d": "References Windows executable or script", "i": "objectives/execution/interpreter/script/shell::windows-executable-ref", "o": 28975, "z": 4, "cf": 0.6000000238418579 } ], "ln": 28959 }, { "b": "zdNM[wPxwyz*9*EBzU*]m}D^pvqY^\u003ewPI@\u003ewPI^jA:@VVBAg@3z2!iWBydQYwO?A*wPRoJBy/p?q*ACawO?AVz2!S]08[2S07ggjv}xE)vruj4zD7J", "n": [ { "c": 3, "d": "Modification of HTTP context items", "i": "micro-behaviors/communications/http/server/managed::http-context-item-setter", "o": 29321, "z": 8, "cf": 0.8500000238418579 }, { "c": 2, "d": ".NET manifest resource stream access", "i": "micro-behaviors/data/embedded/payload/resource::dotnet-getmanifestresourcestream", "o": 29286, "z": 25, "cf": 0.8500000238418579 } ], "ln": 29270 }, { "b": "zeqQUv%8T1zGGrex(v\u003e?q*ACawO\u003c50wQ5qHn][]*e(Mt4x\u003c\u003e*(Dsp]fz/bLMwPq\u003cbA+dKVBzbPkx)Kif", "n": [ { "c": 3, "d": "JSON polymorphism runtime marker", "i": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "o": 29522, "z": 16, "cf": 1.0 } ], "ln": 29506 }, { "b": "zuauUB5l)}ygQ)%x(v\u003e?q*ACawO\u003c4$wOb:\u0026v@#B6zu9mbwPz%dv}w2Cy\u00260V)BzkVh0b2\u003e+uRbraz!%l3v/", "n": [ { "c": 2, "d": "Benign high-entropy PE context", "i": "metadata/package/quality/false-positives::benign-high-entropy-pe-context", "o": 29647, "z": 17, "cf": 0.949999988079071 } ], "ln": 29631 }, { "b": "z/bLNwPQv=v}xR3x(v\u003e?q*ACawO\u003c50wQ5qHn][]*08)#Wx(mMJz/6D4A+PPkzu8$kwk^hWxkzd3z/bLA", "n": [ { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 29875, "z": 16, "cf": 0.8500000238418579 } ], "ln": 29859 }, { "b": "l340uwPQpTA+c\u003c]BAzE4q*ACawO\u003c4[x(m[\u003cjv%P(wPq\u003cbA+e=Byf$sEp*[wAjxcPBwLl-PwiK-", "n": [ { "c": 3, "d": "LINQ query operations", "i": "micro-behaviors/data/db/linq::linq-queries", "o": 30091, "z": 11, "cf": 0.699999988079071 } ], "ln": 30075 }, { "b": "z/6Dcy?mS=wPz%dv}xYYxjVf(qE%\u0026\u003cwPI@(wPz%dv}xYYB7Gxnx\u003e7Z}07pycB.tu3zF8WZwmY/", "n": [ { "c": 3, "d": "Access to ASP.NET Request object", "i": "micro-behaviors/communications/http/server/managed::http-request-get", "o": 31360, "z": 11, "cf": 1.0 } ], "ln": 31344 }, { "b": "wQ5p%q*ACawO\u003c50wQ5p%now@)lVl\u003c:wQ5p%v@DmbwQ5p%xjVf(qG3Y1wL^zUw[=F\u0026B7GD2qG3W", "n": [ { "c": 3, "d": "Access to ASP.NET HttpContext", "i": "micro-behaviors/communications/http/server/managed::http-context", "o": 32830, "z": 11, "cf": 1.0 } ], "ln": 32814 }, { "b": "zCUm/x\u003e8z*xjVf(oj-wGm}D^hCX7xcBzkS9l349Uzdmsb07?lgD2[7sz9-k:wO\u003e))C(QlDB7ociwPymXz/4{X", "n": [ { "c": 3, "d": ".NET current assembly lookup", "i": "objectives/anti-analysis/self-modify/runtime::dotnet-getexecutingassembly-token", "o": 33044, "z": 20, "cf": 0.8799999952316284 } ], "ln": 33028 }, { "b": "v/QJHzVB?UzVBwHBn#pMz2!RSv/QAEASx[Qx-IPx02GIMwDl/LA@ZpZve$fBwb{3rASxRI", "n": [ { "c": 2, "d": "mscorlib reference", "i": "metadata/lang/compiler/managed::mscorlib", "o": 37719, "z": 8, "cf": 0.8999999761581421 } ], "ln": 37703 }, { "b": "i4rW^u\u003cK#66Aure?beZ/jofB5B]VdPaolM+x-IYACk%@fzVC1ZjPDVafAri}fAri}g5%chaojd%gYOZ1aol0Nx-I@HyYDP#a](GXzVBUPwDi[OaolD.Bo3sYzVBLMwDj\u003c[a](9MBPuBZASxUJzua+UlJz38yYFwNASvo-aolD.Bo3sYzVBLMwDjpZCk#s", "n": [ { "c": 1, "d": "Encoded HTML tag fragment", "i": "objectives/anti-static/obfuscation/encoding/content::encoded-html-tag-fragment", "o": 42248, "z": 103, "cf": 0.699999988079071 } ], "ln": 42232 }, { "b": "iV{vnfGPQ:arR^HarR^HarR!qx(!lfvr\u003c)Rw]846i%)8MarR^HarR^HarU9ex\u003eIrn", "n": [ { "c": 3, "d": "Development toolchain indicators", "i": "metadata/build/toolchain::development-toolchain-indicators", "o": 46094, "z": 4, "cf": 1.0 } ], "ln": 46078 }, { "b": "00000000000000000000000000000000000000315c8Xg7YTL^00000000000000000", "n": [ { "c": 1, "d": "PE resource section", "i": "metadata/binary/section/names::pe-resource-section", "o": 58880, "z": 5, "cf": 0.8999999761581421 } ], "ln": 58864 }, { "b": "0000000000003WngYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006Xn[brp!0rrr71][S", "n": [ { "c": 3, "d": "Recognized marker for timing checks", "i": "objectives/anti-analysis/timing/evasion::timing-anti-debug-recognized-marker", "o": 58974, "z": 15, "cf": 0.949999988079071 } ], "ln": 58958 }, { "b": "zua.Te=U\u003eK001+O2(\u003c#alJz38z2!IPve$fBC(QOtve$cAwDhYg002%#x-I#Iaokaove%\u003csA@Vgu002K\u00265c8.hmGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up002E*ve%^qwDl/Le=Xo", "n": [ { "c": 2, "d": "PE CompanyName metadata field", "i": "metadata/package/versioning::pe-companyname-field", "o": 59450, "z": 11, "cf": 0.699999988079071 }, { "c": 2, "d": "PE FileDescription metadata field", "i": "metadata/package/versioning::pe-filedescription-field", "o": 59502, "z": 15, "cf": 0.699999988079071 } ], "ln": 59434 }, { "b": "zVBhCASxRI001XM2MK(9mGvc5yYF2DrSDXhASydXx-J5Kzu6Up001[Se=W^fe=W\u003che=WN9002K\u00266AwdlnDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE002E*ve%^qwDl/Le=Xotve$uG", "n": [ { "c": 3, "d": "Dotted-quad PE version metadata marker", "i": "objectives/command-and-control/infrastructure/ip::ipv4-version-metadata-marker", "o": 59574, "z": 11, "cf": 0.9399999976158142 }, { "c": 2, "d": "PE InternalName metadata field", "i": "metadata/package/versioning::pe-internalname-field", "o": 59622, "z": 12, "cf": 0.699999988079071 } ], "ln": 59558 }, { "b": "xAibO001bw002*}6Awdlpxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE002E*ve%^qwDl/Le=Xot", "n": [ { "c": 2, "d": "PE OriginalFilename metadata field", "i": "metadata/package/versioning::pe-originalfilename-field", "o": 59734, "z": 16, "cf": 0.699999988079071 } ], "ln": 59718 }, { "b": "e=YzZyYFnK002m:5c8.hpYLIozVBqFBPt[KBo25ove$cAwDhYg002E*ve%^qwDl/Le=Xotve$u", "n": [ { "c": 2, "d": "PE ProductName metadata field", "i": "metadata/package/versioning::pe-productname-field", "o": 59814, "z": 11, "cf": 0.699999988079071 } ], "ln": 59798 }, { "b": "zVBhCASxRI005\u003e@k(Z]=pYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001[Se=W^fe=W\u003cheDx.\u0026ASu", "n": [ { "c": 2, "d": "PE version resource metadata", "i": "metadata/package/versioning::version-resource-metadata", "o": 59878, "z": 14, "cf": 0.8999999761581421 } ], "ln": 59862 }, { "b": "00000000000000000000000313\u0026*nc\u003ctc=o000000000000000000000000000000000", "n": [ { "c": 2, "d": "PE .reloc section presence", "i": "metadata/binary/section/names::reloc-section-presence", "o": 60416, "z": 6, "cf": 0.8999999761581421 } ], "ln": 60400 } ], "depth": 1, "facts": { "imp": [ [ "mscoree", "CorDllMain" ] ], "sec": [ [ ".text", 512, 58368, 5.87, "r-x" ], [ ".rsrc", 58880, 1536, 2.82, "r--" ], [ ".reloc", 60416, 512, 0.08, "r--" ] ], "metrics": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "resource_count": 1.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 97497.0, "reloc_overhang_bytes": 500.0, "reloc_overhang_ratio": 0.98, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "version.identity_entropy": 3.95, "clr.managed_resource_count": 1.0, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0, "clr.managed_resource_max_size": 11203.0, "version.identity_symbol_ratio": 0.05, "clr.managed_resource_max_entropy": 4.13 }, "file": { "size": 60928.0, "entropy": 5.78, "size_bytes": 60928.0 }, "binary": { "is_pie": 1.0, "code_entropy": 5.87, "string_count": 856.0, "overall_entropy": 5.78, "entropy_variance": 5.6, "avg_string_length": 22.14, "max_string_length": 775.0, "peak_region_bytes": 2048.0, "code_to_data_ratio": 1.0, "peak_region_entropy": 6.05, "string_length_stddev": 32.34, "largest_section_ratio": 0.96, "sentence_string_count": 77.0, "sentence_string_ratio": 0.09, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 58368.0, "entropy_max": 5.87, "entropy_mean": 2.92, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } } }, "id": 8, "mol": "O(Al)H₂(CmDb)", "path": "Facet.Dashboard.6.6.8-preview.pr389.110.nupkg!!lib/net9.0/Facet.Dashboard.dll", "risk": 4, "sha": "ff37c5961f0d585709f076171ea2466736f8013241fe6b0ca99797993ebc2b4d", "size": 60928, "traits": [ { "id": "micro-behaviors/communications/http/server/managed::http-response-get", "conf": 1.0, "crit": 3, "desc": "Access to ASP.NET Response object", "spans": [ [ 27969, 12 ] ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "spans": [ [ 59878, 14 ] ] }, { "id": "micro-behaviors/data/db/linq::linq-queries", "conf": 0.699999988079071, "crit": 3, "desc": "LINQ query operations", "spans": [ [ 30091, 11 ] ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 58974, 15 ] ] }, { "id": "micro-behaviors/communications/http/server/managed::http-item-setter", "conf": 1.0, "crit": 1, "desc": "Modification of HTTP context items", "spans": [ [ 29321, 8 ] ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "objectives/anti-analysis/self-modify/runtime::dotnet-getexecutingassembly-token", "atk": "T1027.005", "conf": 0.8799999952316284, "crit": 3, "desc": ".NET current assembly lookup", "spans": [ [ 33044, 20 ] ] }, { "id": "micro-behaviors/communications/http/server/managed::http-context", "conf": 1.0, "crit": 3, "desc": "Access to ASP.NET HttpContext", "spans": [ [ 32830, 11 ] ] }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "spans": [ [ 0, 26 ] ] }, { "id": "micro-behaviors/communications/http/server/managed::http-request-get", "conf": 1.0, "crit": 3, "desc": "Access to ASP.NET Request object", "spans": [ [ 31360, 11 ] ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "spans": [ [ 13140, 4 ] ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "spans": [ [ 28975, 4 ] ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "spans": [ [ 59574, 11 ] ] }, { "id": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "conf": 1.0, "crit": 3, "desc": "JSON polymorphism runtime marker", "spans": [ [ 29522, 16 ] ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "spans": [ [ 13140, 4 ] ] }, { "id": "micro-behaviors/communications/http/server/managed::http-context-item-setter", "conf": 0.8500000238418579, "crit": 3, "desc": "Modification of HTTP context items", "spans": [ [ 29321, 8 ], [ 32830, 11 ] ] } ], "type": "pe" }, { "id": 9, "sha": "a61c26ca3ed4fa7b2553b8cda81bda093482f5eb78ed8fef273e8902406e876a", "path": "Facet.Dashboard.6.6.8-preview.pr389.110.nupkg!!lib/net9.0/Facet.Dashboard.xml", "size": 15147, "type": "xml", "depth": 1 }, { "id": 10, "sha": "70b483c5066b0f062f2102cd8f0c4b2fde9e919b5a9204689dd67e64b0cc518e", "path": "Facet.Dashboard.6.6.8-preview.pr389.110.nupkg!![Content_Types].xml", "size": 582, "type": "xml", "depth": 1 }, { "id": 11, "sha": "f60b54f13a5f03a6e5fe0cdceb6aa6f5e0f3683325c6e3f7da39cd398b4ee5ec", "path": "Facet.Dashboard.6.6.8-preview.pr389.110.nupkg!!package/services/metadata/core-properties/f4092244a67444a4ac97b9a235c288ca.psmdcp", "size": 804, "type": "xml", "depth": 1 }, { "id": 12, "sha": "952d8bdb4d7125297d6423ad6624d91f2a136ef774931e15f6b28eae1675ab51", "path": "Facet.Dashboard@6.6.8-preview.pr389.110.registry.json", "size": 856, "type": "registry", "depth": 1 } ], "omitted_files": 7, "v": "8" } }