{ "llm": { "conf": 0.7524395, "grade": "benign", "model": "Qwen/Qwen3.6-27B", "review": false, "outcome": "benign", "interpretation": "Legitimate .NET library package" }, "ml": { "v": "7", "eng": "2.2.0-rc.1", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.6463421, "rte": "az", "prob": 0.6463421 } ], "prob": 0.6463421, "skip": [ { "rte": "az/zip", "why": "unavailable" }, { "rte": "az/zip", "why": "unavailable" } ], "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.6463420987129211, "type": "nupkg" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.00012001395225524902, "type": "xml" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.008743494749069214, "type": "xml" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.005262881517410278, "type": "text" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.00006663799285888672, "type": "png" }, { "id": 5, "lvl": -1, "conf": 0, "prob": 0.6463420987129211, "type": "pe" }, { "id": 6, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "xml" }, { "id": 7, "lvl": -1, "conf": 0, "prob": 0.6386661529541016, "type": "pe" }, { "id": 8, "lvl": -1, "conf": 0, "prob": 0.6463420987129211, "type": "xml" }, { "id": 9, "lvl": -1, "conf": 0, "prob": 0.6463420987129211, "type": "pe" }, { "id": 10, "lvl": -1, "conf": 0, "prob": 0.6463420987129211, "type": "xml" }, { "id": 11, "lvl": -1, "conf": 0, "prob": 0.6463420987129211, "type": "pe" }, { "id": 12, "lvl": -1, "conf": 0, "prob": 0.6463420987129211, "type": "xml" }, { "id": 13, "lvl": -1, "conf": 0, "prob": 0.6463420987129211, "type": "xml" }, { "id": 14, "lvl": -1, "conf": 0, "prob": 0.00012001395225524902, "type": "xml" }, { "id": 15, "lvl": -1, "conf": 0, "prob": 0.6463420987129211, "type": "registry" } ], "version": "v18.18", "analyzed_at": "2026-06-29T18:01:02Z" }, "path": "CookieCrumble.HotChocolate.16.4.0-p.8.nupkg", "raw": { "files": [ { "id": 0, "mol": "O(Al)H₂(CmDb)", "sha": "e0dbd5390e94d943d267d7eb8de443327acf8833b9b7758186e49286009fa467", "path": "CookieCrumble.HotChocolate.16.4.0-p.8.nupkg", "risk": 4, "size": 117754, "type": "nupkg", "facts": { "metrics": { "file": { "size": 117754.0, "entropy": 7.99, "size_bytes": 117754.0 }, "binary": { "overall_entropy": 7.99, "peak_region_bytes": 113664.0, "peak_region_entropy": 7.82 }, "archive": { "file_count": 15.0, "member_count": 15.0, "script_count": 0.0, "zip_bomb_ratio": 4.71, "directory_count": 0.0, "executable_count": 4.0, "extra_field_size": 0.0, "noise_file_count": 0.0, "total_compressed": 115554.0, "compression.ratio": 0.47, "hidden_file_count": 2.0, "total_uncompressed": 243537.0, "crc_collision_count": 3.0, "entry_comment_count": 0.0, "max_filename_length": 81.0, "rtlo_filename_count": 0.0, "format.regular_count": 15.0, "nested_archive_count": 0.0, "path_traversal_count": 0.0, "symlink_escape_count": 0.0, "security.setgid_count": 0.0, "security.setuid_count": 0.0, "security.sticky_count": 0.0, "double_extension_count": 0.0, "duplicate_member_count": 0.0, "security.symlink_count": 0.0, "unicode_filename_count": 0.0, "homoglyph_filename_count": 0.0, "security.encrypted_count": 0.0, "timing.mtime_unique_count": 2.0, "timing.mtime_unique_ratio": 0.13, "misplaced_executable_count": 4.0, "timing.mtime_outlier_count": 1.0, "timing.mtime_dominant_count": 14.0, "timing.mtime_spread_seconds": 25060.0, "timing.sentinel_mtime_count": 0.0, "security.world_writable_count": 0.0, "timing.mtime_dominant_fraction": 0.93, "compression.method_counts.stored": 1.0, "compression.method_counts.deflate": 14.0 } } }, "ident": { "name": { "value": "CookieCrumble.HotChocolate", "source": "nupkg.title", "verified": false }, "urls": [ { "url": "https://chillicream.com/", "kind": "homepage", "source": "nupkg.project_url" }, { "url": "https://github.com/ChilliCream/graphql-platform.git", "kind": "repository", "source": "nupkg.repository_url" } ], "trust": "unsigned", "authors": [ { "name": "ChilliCream authors and contributors", "role": "author", "source": "nupkg.authors" } ], "version": { "value": "16.4.0-p.8", "source": "nupkg.version", "verified": false }, "identifier": { "value": "CookieCrumble.HotChocolate", "source": "nupkg.id", "verified": false } }, "traits": [ { "id": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "conf": 1.0, "crit": 3, "desc": "JSON polymorphism runtime marker", "from": [ { "file": 5 } ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "from": [ { "file": 5 }, { "file": 7 }, { "file": 9 }, { "file": 11 } ] }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "from": [ { "file": 5 } ], "spans": [ [ 0, 26 ] ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "from": [ { "file": 5 } ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/communications/http/server/managed::http-request-get", "conf": 1.0, "crit": 3, "desc": "Access to ASP.NET Request object", "from": [ { "file": 5 } ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "from": [ { "file": 5 } ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/data/db/linq::linq-queries", "conf": 0.699999988079071, "crit": 3, "desc": "LINQ query operations", "from": [ { "file": 5 } ] } ] }, { "id": 1, "sha": "00ea1a22808ce0c073504353676d01dc63fca7cd8901e8bf8bcf4063d78d2040", "path": "CookieCrumble.HotChocolate.16.4.0-p.8.nupkg!!_rels/.rels", "size": 516, "type": "xml", "depth": 1 }, { "ctx": [ { "b": "[4ls%kx}3YaA?spB7]MgjT8QkfD}SJzEWP}x(mMDb6w0teJs}sj]", "n": [ { "c": 2, "d": "NuGet nuspec manifest file", "i": "metadata/build/manifest::nuspec-file", "o": 0, "z": 33, "cf": 0.9800000190734863 } ], "ln": 1, "addr": 0 }, { "b": "jAa.syHH\u003c!aB4:tzGv@+xMOuniXJdcv}YB\u003cvrj5rx\u003e8g4B8LVje[n*pfk$ufyHH\u003c\u0026zF7QTfFLvpfF$I3B-RIkv\u003eJ1EwfKh", "ln": 2, "addr": 42 }, { "b": "arS^-wPRu\u003evrt{w", "ln": 3, "addr": 118 }, { "b": "arR^Hjy-qGD2^RixMMB9z/x#xx\u003eIa3aI$92gb7Bxat1ZPA+fr6zGE0*xLzp0x*V]LvqNbUzEUpYfjO{tD2^RixMMA", "ln": 14, "addr": 683 }, { "b": "arR^HjAL1AB3rJuvq{p3z/^a3wPI%czF77VxLzp0x*V]LvqOaWByw*6j]", "ln": 15, "addr": 755 }, { "b": "arR^HjAt1Lz/YSmz/QaCBA}?pjT9ygBvZK-a%q2Gy=@$QBAzFyiXJd0x([3hvLheez7!m\u0026x(4Q1lVM:Dz7/Kxvq][1y+oQxvrua1A=0Bwx(\u003eKwv@Dj3x((GZwht}$wh2]Iv\u003e}L7vMlnSh-iGJgCJDMgg\u0026BNh-Cn7h8O!%vkY\u00260a%nK5", "n": [ { "c": 2, "d": "NuGet package declares repository", "i": "metadata/package/files/nuget::nuspec-repository", "o": 805, "z": 91, "cf": 0.8999999761581421 } ], "ln": 16, "addr": 801 }, { "b": "arR^Hjy\u00262xwO#3\u0026zEWx(B3o", "n": [ { "c": 2, "d": "NuGet package declares dependencies", "i": "metadata/package/files/nuget::nuspec-dependencies", "o": 946, "z": 834, "cf": 0.8999999761581421 } ], "ln": 17, "addr": 942 }, { "b": "arR^HarS^VA=l8taAR4jxjVfOA:-/@Cw?IqjTa=PBtkE4fD@W", "ln": 18, "addr": 961 }, { "b": "arR^HarR^Hjy\u00262xwO#3\u0026zEW@mx\u003efvJlVl)Ux\u003eoULB.$P7wG\u0026muwPz\u003caz/dYZf/yTve?!\u003e@e\u0026U3$wQ4Z3B.25Db0{A^y?b7.zEEvbDs.bra%nK5", "ln": 19, "addr": 1001 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 3243.0, "entropy": 5.04, "size_bytes": 3243.0 }, "binary": { "overall_entropy": 5.04, "peak_region_bytes": 3243.0, "peak_region_entropy": 5.05 } } }, "id": 2, "path": "CookieCrumble.HotChocolate.16.4.0-p.8.nupkg!!CookieCrumble.HotChocolate.nuspec", "risk": 1, "sha": "c67f4814d39b22307595198615f67506f0cb62aa4687a52435e0967b081ee25d", "size": 3243, "traits": [ { "id": "metadata/package/files/nuget::nuspec-dependencies", "conf": 0.8999999761581421, "crit": 2, "desc": "NuGet package declares dependencies", "spans": [ [ 946, 834 ] ] }, { "id": "metadata/build/manifest::nuspec-file", "conf": 0.9800000190734863, "crit": 2, "desc": "NuGet nuspec manifest file", "spans": [ [ 0, 33 ] ] }, { "id": "metadata/package/files/nuget::nuspec-repository", "conf": 0.8999999761581421, "crit": 2, "desc": "NuGet package declares repository", "spans": [ [ 805, 91 ] ] } ], "type": "xml" }, { "id": 3, "sha": "5f6f7fb421872122ae2c7c395c0e4ed232cb5653b42215106eba532c4001b215", "path": "CookieCrumble.HotChocolate.16.4.0-p.8.nupkg!!LICENSE", "risk": 1, "size": 1083, "type": "text", "depth": 1 }, { "id": 4, "sha": "7cb3e1016b011ea14fa28d085a35710c3aeefbd4749a298010f18140ca6e0729", "path": "CookieCrumble.HotChocolate.16.4.0-p.8.nupkg!!cookiecrumble-icon.png", "size": 7429, "type": "png", "depth": 1 }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J+", "n": [ { "c": 3, "d": "HTTP fingerprinting evasion campaign", "i": "objectives/command-and-control/infrastructure/user-agent::http-fingerprinting-campaign", "o": 0, "z": 34, "cf": 0.8999999761581421 } ], "ln": 0 }, { "b": "00000000000000000000jluIy00000nb@R\u00260SSx7\u003eXQq1]Myim0rr91000000000000", "n": [ { "c": 1, "d": "PE standard code/data section", "i": "metadata/binary/section/names::pe-code-data-standard-section", "o": 512, "z": 5, "cf": 0.8999999761581421 } ], "ln": 496 }, { "b": "huFn]000c7c}jjq3mV2Qlq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn", "n": [ { "c": 3, "d": "Recognized PE anti-analysis marker", "i": "objectives/anti-analysis/debugger-detect/combined-checks::evasion-aware-recognized-pe-marker", "o": 20456, "z": 4, "cf": 1.0 } ], "ln": 20440 }, { "b": "j#\u0026Q9o(BM+y?k^gju=Kvq*ACawO\u003c4\u003epxj-4xjVf(q!6GLzd9AiA+eW3wKguFzEAJpo\u003ewfWAS", "n": [ { "c": 2, "d": "System namespace reference", "i": "metadata/lang/compiler/managed::system-namespace", "o": 34488, "z": 9, "cf": 0.800000011920929 } ], "ln": 34472 }, { "b": "vR/Qdnn\u0026PqxM4y0y*?A%e[w^m090SLz*a=+piyw?07*71B8V5nB7Fo(A+eV@08^xp", "n": [ { "c": 3, "d": "References Windows executable or script", "i": "objectives/execution/interpreter/script/shell::windows-executable-ref", "o": 37967, "z": 4, "cf": 0.6000000238418579 } ], "ln": 37951 }, { "b": "zE^r@v%HT-ygQ)%x(v\u003e?q*ACawO\u003c4$wOb:\u0026v@#B6zu9mbwPz%dv}w2Cy\u00260V)BzkVh09iJAB.9{Uy\u00260V)Bn", "n": [ { "c": 2, "d": "Benign high-entropy PE context", "i": "metadata/package/quality/false-positives::benign-high-entropy-pe-context", "o": 38285, "z": 17, "cf": 0.949999988079071 } ], "ln": 38269 }, { "b": "z!@\u003c7wIc}[CYUMgB8L{@q*ACawO\u003c50wQ5qHn][]*09shPBy^*FzF%Abv{%gCB8L{@rbUxIz/bLNBAh8k", "n": [ { "c": 3, "d": "JSON polymorphism runtime marker", "i": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "o": 38537, "z": 16, "cf": 1.0 } ], "ln": 38521 }, { "b": "y/2d\u003cz#-EKwO(G+A=k)%q*ACawO\u003c4{wPPK}BAzE4nn\u0026PqxM4y0y*?A%e(V\u003e1zGx=nA=-{8BAv", "n": [ { "c": 2, "d": "System namespace reference", "i": "metadata/lang/compiler/managed::system-namespace", "o": 38747, "z": 10, "cf": 0.800000011920929 } ], "ln": 38731 }, { "b": "vq])SoH%nEz#:J\u003ez/{10q*ACawO\u003c4[x(m[\u003cs8@1%wLNw+vR6MWq/)4\u003evqO[NvpS}\u002608mPLBzkW", "n": [ { "c": 3, "d": "LINQ query operations", "i": "micro-behaviors/data/db/linq::linq-queries", "o": 38813, "z": 11, "cf": 0.699999988079071 } ], "ln": 38797 }, { "b": "07pycB.tu3zF8WZwmY/Zq*ACawO\u003c50wQ5qHn][]*e(3s}wPE\u0026:wPRoDz/6DfwPRG]mq^i/x\u003eqt=v@Dj6", "n": [ { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 40074, "z": 16, "cf": 0.8500000238418579 } ], "ln": 40058 }, { "b": "Bye6SA+O@\u003ey?lgQwmY#=xjVf(qE%\u0026\u003cwPI@+zE^s60b#\u003c$BvG$?09shPBy^)Uwi\u003elRvr?\u0026wzGP^", "n": [ { "c": 3, "d": "Access to ASP.NET Request object", "i": "micro-behaviors/communications/http/server/managed::http-request-get", "o": 42524, "z": 11, "cf": 1.0 } ], "ln": 42508 }, { "b": "00000000000000000000000000000000000000315c8Xg7YTL^00000000000000000", "n": [ { "c": 1, "d": "PE resource section", "i": "metadata/binary/section/names::pe-resource-section", "o": 51712, "z": 5, "cf": 0.8999999761581421 } ], "ln": 51696 }, { "b": "000000000000902gYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006Xn[brp!0rrl55c8X", "n": [ { "c": 3, "d": "Recognized marker for timing checks", "i": "objectives/anti-analysis/timing/evasion::timing-anti-debug-recognized-marker", "o": 51806, "z": 15, "cf": 0.949999988079071 } ], "ln": 51790 }, { "b": "fAr{fvGn7Z002s=5Dz?ilJz38z2!IPve$fBC(QOtve$cAwDhYg002v^xAh-DyYFnKx-HH2ASxU", "n": [ { "c": 2, "d": "PE CompanyName metadata field", "i": "metadata/package/versioning::pe-companyname-field", "o": 52026, "z": 11, "cf": 0.699999988079071 } ], "ln": 52010 }, { "b": "zuaeDe=U\u003eK003s98VP)smGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up002v^zVBXQyxe5GwDk6", "n": [ { "c": 2, "d": "PE FileDescription metadata field", "i": "metadata/package/versioning::pe-filedescription-field", "o": 52094, "z": 15, "cf": 0.699999988079071 } ], "ln": 52078 }, { "b": "ve$xHwDhYg001+O2(\u003c#amGvc5yYF2DrSDXhASydXx-J5Kzu6Up001.NhukufgYPcdfArZ9fAq7M003s99@(rwnDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE002v^zVBXQyxe5GwDk6$ASyjZ", "n": [ { "c": 3, "d": "Dotted-quad PE version metadata marker", "i": "objectives/command-and-control/infrastructure/ip::ipv4-version-metadata-marker", "o": 52190, "z": 11, "cf": 0.9399999976158142 }, { "c": 2, "d": "PE InternalName metadata field", "i": "metadata/package/versioning::pe-internalname-field", "o": 52242, "z": 12, "cf": 0.699999988079071 } ], "ln": 52174 }, { "b": "z#+d-ASx!Nx8(PBBn#pvlJz38z#+d-ASx!Nx8(PBBo0A-Sq[4vg5%0df-Tfkaoi$[aoluXAS", "n": [ { "c": 2, "d": "Copyright notice", "i": "metadata/package/license::copyright-word", "o": 52368, "z": 9, "cf": 0.6000000238418579 } ], "ln": 52352 }, { "b": "nDrSdv/OaY003Qh9@(rwpxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE002v^zVBXQyxe5GwDk6$", "n": [ { "c": 2, "d": "PE OriginalFilename metadata field", "i": "metadata/package/versioning::pe-originalfilename-field", "o": 52462, "z": 16, "cf": 0.699999988079071 } ], "ln": 52446 }, { "b": "wb{ACyYBCn002g.4/=RgpYLIozVBqFBPt[KBo25ove$cAwDhYg002v^zVBXQyxe5GwDi?MlJzc", "n": [ { "c": 2, "d": "PE ProductName metadata field", "i": "metadata/package/versioning::pe-productname-field", "o": 52566, "z": 11, "cf": 0.699999988079071 } ], "ln": 52550 }, { "b": "vGpiAwDhYg004@TgYNKRpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001.NhukufgYPcdfArW8z#Y", "n": [ { "c": 2, "d": "PE version resource metadata", "i": "metadata/package/versioning::version-resource-metadata", "o": 52630, "z": 14, "cf": 0.8999999761581421 } ], "ln": 52614 }, { "b": "000000000000000000000n)?S3\u0026*nctS8MZ000000000000000000000000000000000", "n": [ { "c": 2, "d": "PE .reloc section presence", "i": "metadata/binary/section/names::reloc-section-presence", "o": 53248, "z": 6, "cf": 0.8999999761581421 } ], "ln": 53232 } ], "depth": 1, "facts": { "imp": [ [ "mscoree", "CorDllMain" ] ], "sec": [ [ ".text", 512, 51200, 5.94, "r-x" ], [ ".rsrc", 51712, 1536, 2.59, "r--" ], [ ".reloc", 53248, 512, 0.08, "r--" ] ], "metrics": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "resource_count": 1.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 109625.0, "reloc_overhang_bytes": 500.0, "reloc_overhang_ratio": 0.98, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "version.identity_entropy": 3.99, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0, "version.identity_symbol_ratio": 0.04 }, "file": { "size": 53760.0, "entropy": 5.81, "size_bytes": 53760.0 }, "binary": { "is_pie": 1.0, "code_entropy": 5.94, "string_count": 602.0, "overall_entropy": 5.81, "entropy_variance": 5.76, "avg_string_length": 18.75, "max_string_length": 151.0, "peak_region_bytes": 4096.0, "code_to_data_ratio": 1.0, "peak_region_entropy": 6.01, "string_length_stddev": 15.85, "largest_section_ratio": 0.95, "sentence_string_count": 6.0, "sentence_string_ratio": 0.01, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 51200.0, "entropy_max": 5.94, "entropy_mean": 2.87, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } } }, "id": 5, "mol": "O(Al)H₂(CmDb)", "path": "CookieCrumble.HotChocolate.16.4.0-p.8.nupkg!!lib/net10.0/CookieCrumble.HotChocolate.dll", "risk": 4, "sha": "8cd490cf9f61d38f3b108cdae6a0eaab00634bb135d4ec6e6eb5b920f8c80ecc", "size": 53760, "traits": [ { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "spans": [ [ 52630, 14 ] ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "spans": [ [ 37967, 4 ] ] }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "spans": [ [ 0, 26 ] ] }, { "id": "micro-behaviors/data/db/linq::linq-queries", "conf": 0.699999988079071, "crit": 3, "desc": "LINQ query operations", "spans": [ [ 38813, 11 ] ] }, { "id": "micro-behaviors/communications/http/server/managed::http-request-get", "conf": 1.0, "crit": 3, "desc": "Access to ASP.NET Request object", "spans": [ [ 42524, 11 ] ] }, { "id": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "conf": 1.0, "crit": 3, "desc": "JSON polymorphism runtime marker", "spans": [ [ 38537, 16 ] ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "spans": [ [ 52190, 11 ] ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "spans": [ [ 20456, 4 ] ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 51806, 15 ] ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "spans": [ [ 20456, 4 ] ] } ], "type": "pe" }, { "id": 6, "sha": "b59237614b9820aa02907a49746df9fd2e624430c7b132696856a3fc510c57f2", "path": "CookieCrumble.HotChocolate.16.4.0-p.8.nupkg!!lib/net10.0/CookieCrumble.HotChocolate.xml", "size": 2781, "type": "xml", "depth": 1 }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J+", "n": [ { "c": 3, "d": "HTTP fingerprinting evasion campaign", "i": "objectives/command-and-control/infrastructure/user-agent::http-fingerprinting-campaign", "o": 0, "z": 34, "cf": 0.8999999761581421 } ], "ln": 0 }, { "b": "00000000000000000000]tgFc00000nb@R\u00260SSx7GJ!AR5m$[x0rr91000000000000", "n": [ { "c": 1, "d": "PE standard code/data section", "i": "metadata/binary/section/names::pe-code-data-standard-section", "o": 512, "z": 5, "cf": 0.8999999761581421 } ], "ln": 496 }, { "b": "LMgW/c@o)z1$fMO017gQlq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn", "n": [ { "c": 3, "d": "Recognized PE anti-analysis marker", "i": "objectives/anti-analysis/debugger-detect/combined-checks::evasion-aware-recognized-pe-marker", "o": 15748, "z": 4, "cf": 1.0 } ], "ln": 15732 }, { "b": "j#\u0026Q9o(BM+y?k^gju=Kvq*ACawO\u003c4\u003epxj-4xjVf(q!6GLzd9AiA+eW3wKguFzEAJpo\u003ewfWAS", "n": [ { "c": 2, "d": "System namespace reference", "i": "metadata/lang/compiler/managed::system-namespace", "o": 27309, "z": 9, "cf": 0.800000011920929 } ], "ln": 27293 }, { "b": "vR/Qdnn\u0026PqxM4y0y*?A%e[w^m090SLz*a=+piyw?07*71B8V5nB7Fo(A+eV@08^xp", "n": [ { "c": 3, "d": "References Windows executable or script", "i": "objectives/execution/interpreter/script/shell::windows-executable-ref", "o": 30622, "z": 4, "cf": 0.6000000238418579 } ], "ln": 30606 }, { "b": "zE^r@v%HT-ygQ)%x(v\u003e?q*ACawO\u003c4$wOb:\u0026v@#B6zu9mbwPz%dv}w2Cy\u00260V)BzkVh09iJAB.9{Uy\u00260V)Bn", "n": [ { "c": 2, "d": "Benign high-entropy PE context", "i": "metadata/package/quality/false-positives::benign-high-entropy-pe-context", "o": 30940, "z": 17, "cf": 0.949999988079071 } ], "ln": 30924 }, { "b": "z!@\u003c7wIc}[CYUMgB8L{@q*ACawO\u003c50wQ5qHn][]*09shPBy^*FzF%Abv{%gCB8L{@rbUxIz/bLNBAh8k", "n": [ { "c": 3, "d": "JSON polymorphism runtime marker", "i": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "o": 31179, "z": 16, "cf": 1.0 } ], "ln": 31163 }, { "b": "y/2d\u003cz#-EKwO(G+A=k)%q*ACawO\u003c4{wPPK}BAzE4nn\u0026PqxM4y0y*?A%e(V\u003e1zGx=nA=-{8BAv", "n": [ { "c": 2, "d": "System namespace reference", "i": "metadata/lang/compiler/managed::system-namespace", "o": 31389, "z": 10, "cf": 0.800000011920929 } ], "ln": 31373 }, { "b": "vq])SoH%nEz#:J\u003ez/{10q*ACawO\u003c4[x(m[\u003cs8@1%wLNw+vR6MWq/)4\u003evqO[NvpS}\u002608mPLBzkW", "n": [ { "c": 3, "d": "LINQ query operations", "i": "micro-behaviors/data/db/linq::linq-queries", "o": 31455, "z": 11, "cf": 0.699999988079071 } ], "ln": 31439 }, { "b": "07pycB.tu3zF8WZwmY/Zq*ACawO\u003c50wQ5qHn][]*e(3s}wPE\u0026:wPRoDz/6DfwPRG]mq^i/x\u003eqt=v@Dj6", "n": [ { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 32623, "z": 16, "cf": 0.8500000238418579 } ], "ln": 32607 }, { "b": "Bye6SA+O@\u003ey?lgQwmY#=xjVf(qE%\u0026\u003cwPI@+zE^s60b#\u003c$BvG$?09shPBy^)Uwi\u003elRvr?\u0026wzGP^", "n": [ { "c": 3, "d": "Access to ASP.NET Request object", "i": "micro-behaviors/communications/http/server/managed::http-request-get", "o": 35060, "z": 11, "cf": 1.0 } ], "ln": 35044 }, { "b": "00000000000000000000000000000000000000315c8Xg7YTL^00000000000000000", "n": [ { "c": 1, "d": "PE resource section", "i": "metadata/binary/section/names::pe-resource-section", "o": 42496, "z": 5, "cf": 0.8999999761581421 } ], "ln": 42480 }, { "b": "000000000000902gYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006Xn[brp!0rrl55c8X", "n": [ { "c": 3, "d": "Recognized marker for timing checks", "i": "objectives/anti-analysis/timing/evasion::timing-anti-debug-recognized-marker", "o": 42590, "z": 15, "cf": 0.949999988079071 } ], "ln": 42574 }, { "b": "fAr{fvGn7Z002s=5Dz?ilJz38z2!IPve$fBC(QOtve$cAwDhYg002v^xAh-DyYFnKx-HH2ASxU", "n": [ { "c": 2, "d": "PE CompanyName metadata field", "i": "metadata/package/versioning::pe-companyname-field", "o": 42810, "z": 11, "cf": 0.699999988079071 } ], "ln": 42794 }, { "b": "zuaeDe=U\u003eK003s98VP)smGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up002v^zVBXQyxe5GwDk6", "n": [ { "c": 2, "d": "PE FileDescription metadata field", "i": "metadata/package/versioning::pe-filedescription-field", "o": 42878, "z": 15, "cf": 0.699999988079071 } ], "ln": 42862 }, { "b": "ve$xHwDhYg001+O2(\u003c#amGvc5yYF2DrSDXhASydXx-J5Kzu6Up001.NhukufgYPcdfArZ9fAq7M003s99@(rwnDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE002v^zVBXQyxe5GwDk6$ASyjZ", "n": [ { "c": 3, "d": "Dotted-quad PE version metadata marker", "i": "objectives/command-and-control/infrastructure/ip::ipv4-version-metadata-marker", "o": 42974, "z": 11, "cf": 0.9399999976158142 }, { "c": 2, "d": "PE InternalName metadata field", "i": "metadata/package/versioning::pe-internalname-field", "o": 43026, "z": 12, "cf": 0.699999988079071 } ], "ln": 42958 }, { "b": "z#+d-ASx!Nx8(PBBn#pvlJz38z#+d-ASx!Nx8(PBBo0A-Sq[4vg5%0df-Tfkaoi$[aoluXAS", "n": [ { "c": 2, "d": "Copyright notice", "i": "metadata/package/license::copyright-word", "o": 43152, "z": 9, "cf": 0.6000000238418579 } ], "ln": 43136 }, { "b": "nDrSdv/OaY003Qh9@(rwpxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE002v^zVBXQyxe5GwDk6$", "n": [ { "c": 2, "d": "PE OriginalFilename metadata field", "i": "metadata/package/versioning::pe-originalfilename-field", "o": 43246, "z": 16, "cf": 0.699999988079071 } ], "ln": 43230 }, { "b": "wb{ACyYBCn002g.4/=RgpYLIozVBqFBPt[KBo25ove$cAwDhYg002v^zVBXQyxe5GwDi?MlJzc", "n": [ { "c": 2, "d": "PE ProductName metadata field", "i": "metadata/package/versioning::pe-productname-field", "o": 43350, "z": 11, "cf": 0.699999988079071 } ], "ln": 43334 }, { "b": "vGpiAwDhYg004@TgYNKRpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001.NhukufgYPcdfArW8z#Y", "n": [ { "c": 2, "d": "PE version resource metadata", "i": "metadata/package/versioning::version-resource-metadata", "o": 43414, "z": 14, "cf": 0.8999999761581421 } ], "ln": 43398 }, { "b": "000000000000000000000kFNm3\u0026*nc6F/Z?000000000000000000000000000000000", "n": [ { "c": 2, "d": "PE .reloc section presence", "i": "metadata/binary/section/names::reloc-section-presence", "o": 44032, "z": 6, "cf": 0.8999999761581421 } ], "ln": 44016 } ], "depth": 1, "facts": { "imp": [ [ "mscoree", "CorDllMain" ] ], "sec": [ [ ".text", 512, 41984, 5.92, "r-x" ], [ ".rsrc", 42496, 1536, 2.59, "r--" ], [ ".reloc", 44032, 512, 0.08, "r--" ] ], "metrics": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "resource_count": 1.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 104407.0, "reloc_overhang_bytes": 500.0, "reloc_overhang_ratio": 0.98, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "version.identity_entropy": 3.99, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0, "version.identity_symbol_ratio": 0.04 }, "file": { "size": 44544.0, "entropy": 5.77, "size_bytes": 44544.0 }, "binary": { "is_pie": 1.0, "code_entropy": 5.92, "string_count": 565.0, "overall_entropy": 5.77, "entropy_variance": 5.72, "avg_string_length": 17.51, "max_string_length": 151.0, "peak_region_bytes": 2048.0, "code_to_data_ratio": 1.0, "peak_region_entropy": 6.17, "string_length_stddev": 12.72, "largest_section_ratio": 0.94, "sentence_string_count": 6.0, "sentence_string_ratio": 0.01, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 41984.0, "entropy_max": 5.92, "entropy_mean": 2.86, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } } }, "id": 7, "mol": "O(Al)H₂(CmDb)", "path": "CookieCrumble.HotChocolate.16.4.0-p.8.nupkg!!lib/net11.0/CookieCrumble.HotChocolate.dll", "risk": 4, "sha": "df3853eeea72b0357ee63a449dabbea3d3cb8c63ba43bb4d8e3fc39d16101759", "size": 44544, "traits": [ { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "spans": [ [ 43414, 14 ] ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "spans": [ [ 30622, 4 ] ] }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "spans": [ [ 0, 26 ] ] }, { "id": "micro-behaviors/data/db/linq::linq-queries", "conf": 0.699999988079071, "crit": 3, "desc": "LINQ query operations", "spans": [ [ 31455, 11 ] ] }, { "id": "micro-behaviors/communications/http/server/managed::http-request-get", "conf": 1.0, "crit": 3, "desc": "Access to ASP.NET Request object", "spans": [ [ 35060, 11 ] ] }, { "id": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "conf": 1.0, "crit": 3, "desc": "JSON polymorphism runtime marker", "spans": [ [ 31179, 16 ] ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "spans": [ [ 42974, 11 ] ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "spans": [ [ 15748, 4 ] ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 42590, 15 ] ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "spans": [ [ 15748, 4 ] ] } ], "type": "pe" }, { "id": 8, "sha": "b59237614b9820aa02907a49746df9fd2e624430c7b132696856a3fc510c57f2", "path": "CookieCrumble.HotChocolate.16.4.0-p.8.nupkg!!lib/net11.0/CookieCrumble.HotChocolate.xml", "size": 2781, "type": "xml", "depth": 1 }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J+", "n": [ { "c": 3, "d": "HTTP fingerprinting evasion campaign", "i": "objectives/command-and-control/infrastructure/user-agent::http-fingerprinting-campaign", "o": 0, "z": 34, "cf": 0.8999999761581421 } ], "ln": 0 }, { "b": "00000000000000000000i{3zx00000nb@R\u00260SSx7\u003eXQq1]Myim0rr91000000000000", "n": [ { "c": 1, "d": "PE standard code/data section", "i": "metadata/binary/section/names::pe-code-data-standard-section", "o": 512, "z": 5, "cf": 0.8999999761581421 } ], "ln": 496 }, { "b": "huFn]000c7c}jjq3mV2Qlq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn", "n": [ { "c": 3, "d": "Recognized PE anti-analysis marker", "i": "objectives/anti-analysis/debugger-detect/combined-checks::evasion-aware-recognized-pe-marker", "o": 20456, "z": 4, "cf": 1.0 } ], "ln": 20440 }, { "b": "j#\u0026Q9o(BM+y?k^gju=Kvq*ACawO\u003c4\u003epxj-4xjVf(q!6GLzd9AiA+eW3wKguFzEAJpo\u003ewfWAS", "n": [ { "c": 2, "d": "System namespace reference", "i": "metadata/lang/compiler/managed::system-namespace", "o": 34488, "z": 9, "cf": 0.800000011920929 } ], "ln": 34472 }, { "b": "vR/Qdnn\u0026PqxM4y0y*?A%e[w^m090SLz*a=+piyw?07*71B8V5nB7Fo(A+eV@08^xp", "n": [ { "c": 3, "d": "References Windows executable or script", "i": "objectives/execution/interpreter/script/shell::windows-executable-ref", "o": 37967, "z": 4, "cf": 0.6000000238418579 } ], "ln": 37951 }, { "b": "zE^r@v%HT-ygQ)%x(v\u003e?q*ACawO\u003c4$wOb:\u0026v@#B6zu9mbwPz%dv}w2Cy\u00260V)BzkVh09iJAB.9{Uy\u00260V)Bn", "n": [ { "c": 2, "d": "Benign high-entropy PE context", "i": "metadata/package/quality/false-positives::benign-high-entropy-pe-context", "o": 38285, "z": 17, "cf": 0.949999988079071 } ], "ln": 38269 }, { "b": "z!@\u003c7wIc}[CYUMgB8L{@q*ACawO\u003c50wQ5qHn][]*09shPBy^*FzF%Abv{%gCB8L{@rbUxIz/bLNBAh8k", "n": [ { "c": 3, "d": "JSON polymorphism runtime marker", "i": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "o": 38537, "z": 16, "cf": 1.0 } ], "ln": 38521 }, { "b": "y/2d\u003cz#-EKwO(G+A=k)%q*ACawO\u003c4{wPPK}BAzE4nn\u0026PqxM4y0y*?A%e(V\u003e1zGx=nA=-{8BAv", "n": [ { "c": 2, "d": "System namespace reference", "i": "metadata/lang/compiler/managed::system-namespace", "o": 38747, "z": 10, "cf": 0.800000011920929 } ], "ln": 38731 }, { "b": "vq])SoH%nEz#:J\u003ez/{10q*ACawO\u003c4[x(m[\u003cs8@1%wLNw+vR6MWq/)4\u003evqO[NvpS}\u002608mPLBzkW", "n": [ { "c": 3, "d": "LINQ query operations", "i": "micro-behaviors/data/db/linq::linq-queries", "o": 38813, "z": 11, "cf": 0.699999988079071 } ], "ln": 38797 }, { "b": "07pycB.tu3zF8WZwmY/Zq*ACawO\u003c50wQ5qHn][]*e(3s}wPE\u0026:wPRoDz/6DfwPRG]mq^i/x\u003eqt=v@Dj6", "n": [ { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 40074, "z": 16, "cf": 0.8500000238418579 } ], "ln": 40058 }, { "b": "Bye6SA+O@\u003ey?lgQwmY#=xjVf(qE%\u0026\u003cwPI@+zE^s60b#\u003c$BvG$?09shPBy^)Uwi\u003elRvr?\u0026wzGP^", "n": [ { "c": 3, "d": "Access to ASP.NET Request object", "i": "micro-behaviors/communications/http/server/managed::http-request-get", "o": 42524, "z": 11, "cf": 1.0 } ], "ln": 42508 }, { "b": "00000000000000000000000000000000000000315c8Xg7YTL^00000000000000000", "n": [ { "c": 1, "d": "PE resource section", "i": "metadata/binary/section/names::pe-resource-section", "o": 51712, "z": 5, "cf": 0.8999999761581421 } ], "ln": 51696 }, { "b": "000000000000902gYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006Xn[brp!0rrl55c8X", "n": [ { "c": 3, "d": "Recognized marker for timing checks", "i": "objectives/anti-analysis/timing/evasion::timing-anti-debug-recognized-marker", "o": 51806, "z": 15, "cf": 0.949999988079071 } ], "ln": 51790 }, { "b": "fAr{fvGn7Z002s=5Dz?ilJz38z2!IPve$fBC(QOtve$cAwDhYg002v^xAh-DyYFnKx-HH2ASxU", "n": [ { "c": 2, "d": "PE CompanyName metadata field", "i": "metadata/package/versioning::pe-companyname-field", "o": 52026, "z": 11, "cf": 0.699999988079071 } ], "ln": 52010 }, { "b": "zuaeDe=U\u003eK003s98VP)smGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up002v^zVBXQyxe5GwDk6", "n": [ { "c": 2, "d": "PE FileDescription metadata field", "i": "metadata/package/versioning::pe-filedescription-field", "o": 52094, "z": 15, "cf": 0.699999988079071 } ], "ln": 52078 }, { "b": "ve$xHwDhYg001+O2(\u003c#amGvc5yYF2DrSDXhASydXx-J5Kzu6Up001.NhukufgYPcdfArZ9fAq7M003s99@(rwnDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE002v^zVBXQyxe5GwDk6$ASyjZ", "n": [ { "c": 3, "d": "Dotted-quad PE version metadata marker", "i": "objectives/command-and-control/infrastructure/ip::ipv4-version-metadata-marker", "o": 52190, "z": 11, "cf": 0.9399999976158142 }, { "c": 2, "d": "PE InternalName metadata field", "i": "metadata/package/versioning::pe-internalname-field", "o": 52242, "z": 12, "cf": 0.699999988079071 } ], "ln": 52174 }, { "b": "z#+d-ASx!Nx8(PBBn#pvlJz38z#+d-ASx!Nx8(PBBo0A-Sq[4vg5%0df-Tfkaoi$[aoluXAS", "n": [ { "c": 2, "d": "Copyright notice", "i": "metadata/package/license::copyright-word", "o": 52368, "z": 9, "cf": 0.6000000238418579 } ], "ln": 52352 }, { "b": "nDrSdv/OaY003Qh9@(rwpxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE002v^zVBXQyxe5GwDk6$", "n": [ { "c": 2, "d": "PE OriginalFilename metadata field", "i": "metadata/package/versioning::pe-originalfilename-field", "o": 52462, "z": 16, "cf": 0.699999988079071 } ], "ln": 52446 }, { "b": "wb{ACyYBCn002g.4/=RgpYLIozVBqFBPt[KBo25ove$cAwDhYg002v^zVBXQyxe5GwDi?MlJzc", "n": [ { "c": 2, "d": "PE ProductName metadata field", "i": "metadata/package/versioning::pe-productname-field", "o": 52566, "z": 11, "cf": 0.699999988079071 } ], "ln": 52550 }, { "b": "vGpiAwDhYg004@TgYNKRpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001.NhukufgYPcdfArW8z#Y", "n": [ { "c": 2, "d": "PE version resource metadata", "i": "metadata/package/versioning::version-resource-metadata", "o": 52630, "z": 14, "cf": 0.8999999761581421 } ], "ln": 52614 }, { "b": "000000000000000000000n)?S3\u0026*nctS8MZ000000000000000000000000000000000", "n": [ { "c": 2, "d": "PE .reloc section presence", "i": "metadata/binary/section/names::reloc-section-presence", "o": 53248, "z": 6, "cf": 0.8999999761581421 } ], "ln": 53232 } ], "depth": 1, "facts": { "imp": [ [ "mscoree", "CorDllMain" ] ], "sec": [ [ ".text", 512, 51200, 5.94, "r-x" ], [ ".rsrc", 51712, 1536, 2.59, "r--" ], [ ".reloc", 53248, 512, 0.08, "r--" ] ], "metrics": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "resource_count": 1.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 93697.0, "reloc_overhang_bytes": 500.0, "reloc_overhang_ratio": 0.98, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "version.identity_entropy": 3.99, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0, "version.identity_symbol_ratio": 0.04 }, "file": { "size": 53760.0, "entropy": 5.81, "size_bytes": 53760.0 }, "binary": { "is_pie": 1.0, "code_entropy": 5.94, "string_count": 602.0, "overall_entropy": 5.81, "entropy_variance": 5.76, "avg_string_length": 18.73, "max_string_length": 150.0, "peak_region_bytes": 4096.0, "code_to_data_ratio": 1.0, "peak_region_entropy": 6.01, "string_length_stddev": 15.82, "largest_section_ratio": 0.95, "sentence_string_count": 6.0, "sentence_string_ratio": 0.01, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 51200.0, "entropy_max": 5.94, "entropy_mean": 2.87, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } } }, "id": 9, "mol": "O(Al)H₂(CmDb)", "path": "CookieCrumble.HotChocolate.16.4.0-p.8.nupkg!!lib/net8.0/CookieCrumble.HotChocolate.dll", "risk": 4, "sha": "1a078607c803a61104d47194235220b7d34781317f1e6284aa11f207a8ed21e0", "size": 53760, "traits": [ { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "spans": [ [ 52630, 14 ] ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "spans": [ [ 37967, 4 ] ] }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "spans": [ [ 0, 26 ] ] }, { "id": "micro-behaviors/data/db/linq::linq-queries", "conf": 0.699999988079071, "crit": 3, "desc": "LINQ query operations", "spans": [ [ 38813, 11 ] ] }, { "id": "micro-behaviors/communications/http/server/managed::http-request-get", "conf": 1.0, "crit": 3, "desc": "Access to ASP.NET Request object", "spans": [ [ 42524, 11 ] ] }, { "id": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "conf": 1.0, "crit": 3, "desc": "JSON polymorphism runtime marker", "spans": [ [ 38537, 16 ] ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "spans": [ [ 52190, 11 ] ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "spans": [ [ 20456, 4 ] ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 51806, 15 ] ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "spans": [ [ 20456, 4 ] ] } ], "type": "pe" }, { "id": 10, "sha": "b59237614b9820aa02907a49746df9fd2e624430c7b132696856a3fc510c57f2", "path": "CookieCrumble.HotChocolate.16.4.0-p.8.nupkg!!lib/net8.0/CookieCrumble.HotChocolate.xml", "size": 2781, "type": "xml", "depth": 1 }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J+", "n": [ { "c": 3, "d": "HTTP fingerprinting evasion campaign", "i": "objectives/command-and-control/infrastructure/user-agent::http-fingerprinting-campaign", "o": 0, "z": 34, "cf": 0.8999999761581421 } ], "ln": 0 }, { "b": "00000000000000000000i{3zx00000nb@R\u00260SSx7\u003eXQq1]Myim0rr91000000000000", "n": [ { "c": 1, "d": "PE standard code/data section", "i": "metadata/binary/section/names::pe-code-data-standard-section", "o": 512, "z": 5, "cf": 0.8999999761581421 } ], "ln": 496 }, { "b": "huFn]000c7c}jjq3mV2Qlq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn", "n": [ { "c": 3, "d": "Recognized PE anti-analysis marker", "i": "objectives/anti-analysis/debugger-detect/combined-checks::evasion-aware-recognized-pe-marker", "o": 20456, "z": 4, "cf": 1.0 } ], "ln": 20440 }, { "b": "j#\u0026Q9o(BM+y?k^gju=Kvq*ACawO\u003c4\u003epxj-4xjVf(q!6GLzd9AiA+eW3wKguFzEAJpo\u003ewfWAS", "n": [ { "c": 2, "d": "System namespace reference", "i": "metadata/lang/compiler/managed::system-namespace", "o": 34488, "z": 9, "cf": 0.800000011920929 } ], "ln": 34472 }, { "b": "vR/Qdnn\u0026PqxM4y0y*?A%e[w^m090SLz*a=+piyw?07*71B8V5nB7Fo(A+eV@08^xp", "n": [ { "c": 3, "d": "References Windows executable or script", "i": "objectives/execution/interpreter/script/shell::windows-executable-ref", "o": 37967, "z": 4, "cf": 0.6000000238418579 } ], "ln": 37951 }, { "b": "zE^r@v%HT-ygQ)%x(v\u003e?q*ACawO\u003c4$wOb:\u0026v@#B6zu9mbwPz%dv}w2Cy\u00260V)BzkVh09iJAB.9{Uy\u00260V)Bn", "n": [ { "c": 2, "d": "Benign high-entropy PE context", "i": "metadata/package/quality/false-positives::benign-high-entropy-pe-context", "o": 38285, "z": 17, "cf": 0.949999988079071 } ], "ln": 38269 }, { "b": "z!@\u003c7wIc}[CYUMgB8L{@q*ACawO\u003c50wQ5qHn][]*09shPBy^*FzF%Abv{%gCB8L{@rbUxIz/bLNBAh8k", "n": [ { "c": 3, "d": "JSON polymorphism runtime marker", "i": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "o": 38537, "z": 16, "cf": 1.0 } ], "ln": 38521 }, { "b": "y/2d\u003cz#-EKwO(G+A=k)%q*ACawO\u003c4{wPPK}BAzE4nn\u0026PqxM4y0y*?A%e(V\u003e1zGx=nA=-{8BAv", "n": [ { "c": 2, "d": "System namespace reference", "i": "metadata/lang/compiler/managed::system-namespace", "o": 38747, "z": 10, "cf": 0.800000011920929 } ], "ln": 38731 }, { "b": "vq])SoH%nEz#:J\u003ez/{10q*ACawO\u003c4[x(m[\u003cs8@1%wLNw+vR6MWq/)4\u003evqO[NvpS}\u002608mPLBzkW", "n": [ { "c": 3, "d": "LINQ query operations", "i": "micro-behaviors/data/db/linq::linq-queries", "o": 38813, "z": 11, "cf": 0.699999988079071 } ], "ln": 38797 }, { "b": "07pycB.tu3zF8WZwmY/Zq*ACawO\u003c50wQ5qHn][]*e(3s}wPE\u0026:wPRoDz/6DfwPRG]mq^i/x\u003eqt=v@Dj6", "n": [ { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 40074, "z": 16, "cf": 0.8500000238418579 } ], "ln": 40058 }, { "b": "Bye6SA+O@\u003ey?lgQwmY#=xjVf(qE%\u0026\u003cwPI@+zE^s60b#\u003c$BvG$?09shPBy^)Uwi\u003elRvr?\u0026wzGP^", "n": [ { "c": 3, "d": "Access to ASP.NET Request object", "i": "micro-behaviors/communications/http/server/managed::http-request-get", "o": 42524, "z": 11, "cf": 1.0 } ], "ln": 42508 }, { "b": "00000000000000000000000000000000000000315c8Xg7YTL^00000000000000000", "n": [ { "c": 1, "d": "PE resource section", "i": "metadata/binary/section/names::pe-resource-section", "o": 51712, "z": 5, "cf": 0.8999999761581421 } ], "ln": 51696 }, { "b": "000000000000902gYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006Xn[brp!0rrl55c8X", "n": [ { "c": 3, "d": "Recognized marker for timing checks", "i": "objectives/anti-analysis/timing/evasion::timing-anti-debug-recognized-marker", "o": 51806, "z": 15, "cf": 0.949999988079071 } ], "ln": 51790 }, { "b": "fAr{fvGn7Z002s=5Dz?ilJz38z2!IPve$fBC(QOtve$cAwDhYg002v^xAh-DyYFnKx-HH2ASxU", "n": [ { "c": 2, "d": "PE CompanyName metadata field", "i": "metadata/package/versioning::pe-companyname-field", "o": 52026, "z": 11, "cf": 0.699999988079071 } ], "ln": 52010 }, { "b": "zuaeDe=U\u003eK003s98VP)smGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up002v^zVBXQyxe5GwDk6", "n": [ { "c": 2, "d": "PE FileDescription metadata field", "i": "metadata/package/versioning::pe-filedescription-field", "o": 52094, "z": 15, "cf": 0.699999988079071 } ], "ln": 52078 }, { "b": "ve$xHwDhYg001+O2(\u003c#amGvc5yYF2DrSDXhASydXx-J5Kzu6Up001.NhukufgYPcdfArZ9fAq7M003s99@(rwnDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE002v^zVBXQyxe5GwDk6$ASyjZ", "n": [ { "c": 3, "d": "Dotted-quad PE version metadata marker", "i": "objectives/command-and-control/infrastructure/ip::ipv4-version-metadata-marker", "o": 52190, "z": 11, "cf": 0.9399999976158142 }, { "c": 2, "d": "PE InternalName metadata field", "i": "metadata/package/versioning::pe-internalname-field", "o": 52242, "z": 12, "cf": 0.699999988079071 } ], "ln": 52174 }, { "b": "z#+d-ASx!Nx8(PBBn#pvlJz38z#+d-ASx!Nx8(PBBo0A-Sq[4vg5%0df-Tfkaoi$[aoluXAS", "n": [ { "c": 2, "d": "Copyright notice", "i": "metadata/package/license::copyright-word", "o": 52368, "z": 9, "cf": 0.6000000238418579 } ], "ln": 52352 }, { "b": "nDrSdv/OaY003Qh9@(rwpxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE002v^zVBXQyxe5GwDk6$", "n": [ { "c": 2, "d": "PE OriginalFilename metadata field", "i": "metadata/package/versioning::pe-originalfilename-field", "o": 52462, "z": 16, "cf": 0.699999988079071 } ], "ln": 52446 }, { "b": "wb{ACyYBCn002g.4/=RgpYLIozVBqFBPt[KBo25ove$cAwDhYg002v^zVBXQyxe5GwDi?MlJzc", "n": [ { "c": 2, "d": "PE ProductName metadata field", "i": "metadata/package/versioning::pe-productname-field", "o": 52566, "z": 11, "cf": 0.699999988079071 } ], "ln": 52550 }, { "b": "vGpiAwDhYg004@TgYNKRpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001.NhukufgYPcdfArW8z#Y", "n": [ { "c": 2, "d": "PE version resource metadata", "i": "metadata/package/versioning::version-resource-metadata", "o": 52630, "z": 14, "cf": 0.8999999761581421 } ], "ln": 52614 }, { "b": "000000000000000000000n)?S3\u0026*nctS8MZ000000000000000000000000000000000", "n": [ { "c": 2, "d": "PE .reloc section presence", "i": "metadata/binary/section/names::reloc-section-presence", "o": 53248, "z": 6, "cf": 0.8999999761581421 } ], "ln": 53232 } ], "depth": 1, "facts": { "imp": [ [ "mscoree", "CorDllMain" ] ], "sec": [ [ ".text", 512, 51200, 5.94, "r-x" ], [ ".rsrc", 51712, 1536, 2.59, "r--" ], [ ".reloc", 53248, 512, 0.08, "r--" ] ], "metrics": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "resource_count": 1.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 81609.0, "reloc_overhang_bytes": 500.0, "reloc_overhang_ratio": 0.98, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "version.identity_entropy": 3.99, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0, "version.identity_symbol_ratio": 0.04 }, "file": { "size": 53760.0, "entropy": 5.81, "size_bytes": 53760.0 }, "binary": { "is_pie": 1.0, "code_entropy": 5.94, "string_count": 603.0, "overall_entropy": 5.81, "entropy_variance": 5.76, "avg_string_length": 18.71, "max_string_length": 150.0, "peak_region_bytes": 4096.0, "code_to_data_ratio": 1.0, "peak_region_entropy": 6.01, "string_length_stddev": 15.82, "largest_section_ratio": 0.95, "sentence_string_count": 6.0, "sentence_string_ratio": 0.01, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 51200.0, "entropy_max": 5.94, "entropy_mean": 2.87, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } } }, "id": 11, "mol": "O(Al)H₂(CmDb)", "path": "CookieCrumble.HotChocolate.16.4.0-p.8.nupkg!!lib/net9.0/CookieCrumble.HotChocolate.dll", "risk": 4, "sha": "7ec97445120c895a102947a5752f0aad8cbf3550eba0f714f36a64d151408342", "size": 53760, "traits": [ { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "spans": [ [ 52630, 14 ] ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "spans": [ [ 37967, 4 ] ] }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "spans": [ [ 0, 26 ] ] }, { "id": "micro-behaviors/data/db/linq::linq-queries", "conf": 0.699999988079071, "crit": 3, "desc": "LINQ query operations", "spans": [ [ 38813, 11 ] ] }, { "id": "micro-behaviors/communications/http/server/managed::http-request-get", "conf": 1.0, "crit": 3, "desc": "Access to ASP.NET Request object", "spans": [ [ 42524, 11 ] ] }, { "id": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "conf": 1.0, "crit": 3, "desc": "JSON polymorphism runtime marker", "spans": [ [ 38537, 16 ] ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "spans": [ [ 52190, 11 ] ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "spans": [ [ 20456, 4 ] ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 51806, 15 ] ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "spans": [ [ 20456, 4 ] ] } ], "type": "pe" }, { "id": 12, "sha": "b59237614b9820aa02907a49746df9fd2e624430c7b132696856a3fc510c57f2", "path": "CookieCrumble.HotChocolate.16.4.0-p.8.nupkg!!lib/net9.0/CookieCrumble.HotChocolate.xml", "size": 2781, "type": "xml", "depth": 1 }, { "id": 13, "sha": "afeb9584632638a4fd4b2f37aa41f4260475fb65f3200e6cf67c9ddaaf9d48bd", "path": "CookieCrumble.HotChocolate.16.4.0-p.8.nupkg!![Content_Types].xml", "size": 650, "type": "xml", "depth": 1 }, { "id": 14, "sha": "b7b3198d0854bf1f727bdd36f1a3e58be9b3bfb65700912f06dd13643c015faa", "path": "CookieCrumble.HotChocolate.16.4.0-p.8.nupkg!!package/services/metadata/core-properties/1834EF25DEE8A907F132695077E7DAAB.psmdcp", "size": 683, "type": "xml", "depth": 1 }, { "id": 15, "sha": "e675230f1360ae8d43769dd5eb0484b3a59b82c2c7cbbb961cd2b0b8446c16dc", "path": "CookieCrumble.HotChocolate@16.4.0-p.8.registry.json", "size": 815, "type": "registry", "depth": 1 } ], "omitted_files": 10, "v": "8" } }