{
  "date": "2026-10-24",
  "scope": "Offline, read-only analysis of preserved artifacts and inert synthetic traffic",
  "malware_executed": false,
  "network_traffic_sent": false,
  "yara": {
    "engine": "YARA 4.5.0",
    "compile": "passed",
    "rules_sha256": "966a5b7ef23f7a5618d90cb86aa90a9498d45fb5f751497d2674717c76f0ac56",
    "corpus_objects": 288,
    "corpus_bytes": 113385513,
    "matches": {
      "LOBERA_SciSvc_Exact_SHA256": [
        "c982651f1b8bcbe02f7469c8fc89970697cfc684a9df783d4cfa9175fe912e4f"
      ],
      "LOBERA_SciSvc_Structural_Triage": [
        "c982651f1b8bcbe02f7469c8fc89970697cfc684a9df783d4cfa9175fe912e4f"
      ]
    },
    "unique_matching_objects": 1,
    "other_objects_without_matches": 287,
    "corpus_scope": "Preserved mixed incident/tooling archive; not a cleanware benchmark.",
    "limitations": [
      "The exact rule identifies this sample, not variants.",
      "One structural match supports triage of this artifact; it does not establish malware-family or actor attribution.",
      "The redirected laboratory derivative was not available as a clear sample in the inspected annex; no derivative YARA test is claimed.",
      "No representative enterprise cleanware or broad family corpus was available."
    ]
  },
  "suricata": {
    "engine": "This is Suricata version 7.0.3 RELEASE",
    "compile": "passed",
    "mode": "Passive IDS; offline PCAP replay with -r; no network interface opened",
    "rules_sha256": "7eec91f9b40a01dbe838af0e29c86749d96120f5caf9afcd5c84b613037fa224",
    "lab": {
      "pcap_sha256": "7e6ac4c7cd0c72a41a7e49be7ea7ffab6382d397b8298514ecf902c492245eaa",
      "pcap_bytes": 625298,
      "alert_counts_by_sid": {
        "9902402": 1,
        "9902401": 1
      },
      "total_alerts": 2,
      "scope": "Preserved isolated-laboratory session of redirected derivative; not production incident telemetry"
    },
    "synthetic": {
      "pcap_sha256": "4cc040697a839fe307886c69393174abc92a1bf0852bcbfe185c26d9ce921858",
      "packets": 272,
      "cases": 30,
      "positive_cases": 11,
      "negative_cases": 19,
      "passed": 30,
      "failures": [],
      "coverage": [
        "TCP segmentation across markers and content boundaries",
        "coalesced records",
        "stream prefix padding",
        "alternate TCP ports",
        "changed markers and length/type/profile fields",
        "HOME_NET scope",
        "direction",
        "markers-only negative"
      ]
    },
    "limitations": [
      "Two byte signatures cover the observed registration and request shapes, not the full application protocol.",
      "The registration rule requires the default_V3.0.0.0_SciSvc_ prefix and fixed observed lengths; variants can evade it.",
      "Declared lengths are matched as bytes; the rules do not validate complete record availability or parse arbitrary command bodies.",
      "No representative production traffic or throughput test; no general false-positive-rate claim.",
      "Alert counts are engine events, not a guaranteed one-alert-per-application-message metric.",
      "Payload encryption, capture gaps, inspection limits, evasion, and other protocol states were not covered."
    ]
  }
}