1import{x as U,r as R,j as e,F as Z,s as L,d as C,L as V,z as I,i as X,G as ee,c as se,a4 as te,f as z}from"./index-Dyb6OM34.js";import{R as k}from"./ReportEvidenceSection-Cp_YXVRf.js";import{m as ae,a as re,A as ie,b as le,c as ne,d as _,h as T,e as oe}from"./AnalysisReportLayout-CdWGaJNv.js";import{u as ce}from"./reportNavigation-vW657kLt.js";import{K as D}from"./key-q5L-maK2.js";import{C as de}from"./crosshair-X8yaDzDG.js";import{B as Y}from"./bug-DIJEPH1O.js";import{S as me}from"./shield-alert-bUEox04e.js";import{L as xe}from"./link-2-BqkNTJFp.js";import{P as pe}from"./puzzle-8vm_s0bF.js";import{C as he}from"./chart-column-B_vjPNS7.js";import{T as be}from"./tag-N15Q4-t5.js";import{F as B}from"./folder-open-3lPEtZGE.js";import{T as fe}from"./terminal-C74NvM77.js";import{L as F}from"./lock-CUge5ZSL.js";import{C as P}from"./coins-DXeVUGKf.js";import"./info-_-dNPtcb.js";import"./runPresentation-DoqGxX4m.js";import"./download-DW53UI31.js";import"./shield-x-C5wlK0NS.js";import"./search-CJHE-yWd.js";const ge=[["path",{d:"M11.767 19.089c4.924.868 6.14-6.025 1.216-6.894m-1.216 6.894L5.86 18.047m5.908 1.042-.347 1.97m1.563-8.864c4.924.869 6.14-6.025 1.215-6.893m-1.215 6.893-3.94-.694m5.155-6.2L8.29 4.26m5.908 1.042.348-1.97M7.48 20.364l3.126-17.727",key:"yr8idg"}]],ye=U("bitcoin",ge);const je=[["rect",{width:"8",height:"4",x:"8",y:"2",rx:"1",ry:"1",key:"tgr4d6"}],["path",{d:"M8 4H6a2 2 0 0 0-2 2v14a2 2 0 0 0 2 2h12a2 2 0 0 0 2-2v-2",key:"4jdomd"}],["path",{d:"M16 4h2a2 2 0 0 1 2 2v4",key:"3hqy98"}],["path",{d:"M21 14H11",key:"1bme5i"}],["path",{d:"m15 10-4 4 4 4",key:"5dvupr"}]],ue=U("clipboard-copy",je);const Ne=[["path",{d:"M21.54 15H17a2 2 0 0 0-2 2v4.54",key:"1djwo0"}],["path",{d:"M7 3.34V5a3 3 0 0 0 3 3a2 2 0 0 1 2 2c0 1.1.9 2 2 2a2 2 0 0 0 2-2c0-1.1.9-2 2-2h3.17",key:"1tzkfa"}],["path",{d:"M11 21.95V18a2 2 0 0 0-2-2a2 2 0 0 1-2-2v-1a2 2 0 0 0-2-2H2.05",key:"14pb5j"}],["circle",{cx:"12",cy:"12",r:"10",key:"1mglay"}]],_e=U("earth",Ne);const we=[["line",{x1:"4",x2:"20",y1:"9",y2:"9",key:"4lhtct"}],["line",{x1:"4",x2:"20",y1:"15",y2:"15",key:"vyu0kd"}],["line",{x1:"10",x2:"8",y1:"3",y2:"21",key:"1ggp8o"}],["line",{x1:"16",x2:"14",y1:"3",y2:"21",key:"weycgp"}]],W=U("hash",we),ve="inline-flex w-fit items-center gap-2 rounded-md border border-slate-700/60 bg-slate-800/50 px-4 py-2 text-sm font-medium text-slate-300 transition-colors hover:border-slate-600 hover:bg-slate-800 hover:text-white",M={description:["description","summary"],author:["author","creator"],sourceUrl:["source_url","source","source_uri","reference_url","reference","url"],licenseUrl:["license_url","license_uri","licence_url","licence_uri","license","licence"]},H=["meta","metadata","meta_data","rule_meta","rule_metadata","ruleMeta","ruleMetadata"],E=n=>String(n).trim().replace(/([a-z0-9])([A-Z])/g,"$1_$2").toLowerCase().replace(/[\s-]+/g,"_"),K=(n,f)=>{if(!n||typeof n!="object")return"";const g=Object.entries(n).reduce((o,[m,w])=>(o[E(m)]=w,o),{});for(const o of f){const m=g[E(o)];if(m!=null&&m!=="")return String(m)}return""},q=n=>{if(!n||typeof n!="object")return[];const f=H.map(o=>n[o]).filter(o=>o&&typeof o=="object"&&!Array.isArray(o)),g=[n.rule,n.details,n.match].filter(o=>o&&typeof o=="object"&&!Array.isArray(o)).flatMap(o=>H.map(m=>o[m]).filter(m=>m&&typeof m=="object"&&!Array.isArray(m)));return[...f,...g]},O=(n,f)=>{const g=q(n);for(const o of g){const m=K(o,f);if(m)return m}return n&&typeof n=="object"?K(n,f):""},G=n=>{if(!n||typeof n!="object")return{description:"",author:"",sourceUrl:"",licenseUrl:"",extraMetaEntries:[]};const g=q(n).reduce((y,A)=>(Object.entries(A).forEach(([c,j])=>{const p=E(c);!(p in y)&&j!==void 0&&j!==null&&j!==""&&(y[p]=[c,j])}),y),{}),o=O(n,M.description)||n.description||"",m=O(n,M.author),w=O(n,M.sourceUrl),u=O(n,M.licenseUrl),N=new Set(Object.values(M).flat().map(E));return{description:o,author:m,sourceUrl:w,licenseUrl:u,extraMetaEntries:Object.values(g).filter(([y])=>!N.has(E(y)))}},J=n=>/^https?:\/\//i.test(n);function Je(){const{jobId:n}=I(),f=ce(),{getValidToken:g}
1=X(),[o,m]=R.useState(null),[w,u]=R.useState(!0),[N,y]=R.useState(null);R.useEffect(()=>{const c=async()=>{const j=g();if(!j){y("Authentication required"),u(!1);return}try{const p=await fetch("https://api.bluelanternsecurity.io/results",{method:"POST",headers:{Authorization:`${j}`,"Content-Type":"application/json"},body:JSON.stringify({jobId:n})}),v=await p.text();let b;try{b=JSON.parse(v)}catch{throw new Error("Failed to parse JSON response")}if(!p.ok)throw new Error(`HTTP error! status: ${p.status}`);let s=b;if(b.body&&typeof b.body=="string")try{s=JSON.parse(b.body)}catch{}s.result?(m(s.result),u(!1)):s.status==="Running"||s.status==="Queued"?setTimeout(c,2e3):s.filename||s.results?(m(s),u(!1)):(y(s.error||"Report data unavailable"),u(!1))}catch(p){console.error("Error fetching report:",p),y(p.message||"Failed to load report"),u(!1)}};c()},[n,g]);const A=()=>{if(!o)return;const c=[];c.push(["Section","Field","Value","Description"]),o.filename&&c.push(["Report Summary","Filename",o.filename]),o.analyzed_at&&c.push(["Report Summary","Analyzed At",o.analyzed_at]),o.status&&c.push(["Report Summary","Status",o.status]),o.security_score&&c.push(["Report Summary","Security Score",o.security_score]),(o.results&&o.results.length>0?o.results:[o]).forEach((a,t)=>{const r=o.results&&o.results.length>1?`Result ${t+1} - `:"";if(a.file_type){c.push([`${r}File Type`,"Detected MIME",a.file_type.detected_mime||"",""]);const i=a.file_type.extension_mismatch,l=!a.file_type.file_extension&&a.file_type.detected_mime;c.push([`${r}File Type`,"Extension Mismatch",i?"Yes":l?"Missing Extension":"No",""]),c.push([`${r}File Type`,"File Extension",a.file_type.file_extension||"None",""]),a.file_type.binary_format&&c.push([`${r}File Type`,"Binary Format",a.file_type.binary_format,""])}if(a.file_size){const i=a.file_size>1048576?`${(a.file_size/1048576).toFixed(2)} MB`:`${(a.file_size/1024).toFixed(1)} KB`;c.push([`${r}File Info`,"File Size",i])}if(a.hashes&&Object.entries(a.hashes).forEach(([i,l])=>{c.push([`${r}Hashes`,i.toUpperCase(),l])}),a.yara_matches!==void 0&&(a.yara_matches&&a.yara_matches.length>0?a.yara_matches.forEach((i,l)=>{const d=typeof i=="string"?i:i.rule||i.name||JSON.stringify(i),x=G(i);c.push([`${r}YARA Matches`,`Match ${l+1}`,d,x.description||""]),c.push([`${r}YARA Matches`,`Match ${l+1} Author`,x.author||"",""]),c.push([`${r}YARA Matches`,`Match ${l+1} Source URL`,x.sourceUrl||"",""]),c.push([`${r}YARA Matches`,`Match ${l+1} License URL`,x.licenseUrl||"",""])}):c.push([`${r}YARA Matches`,"Result","No matches detected"])),a.malicious_strings&&a.malicious_strings.red_flags&&Object.entries(a.malicious_strings.red_flags).forEach(([i,l])=>{Array.isArray(l)?l.forEach(d=>{c.push([`${r}Red Flags`,i.replace(/_/g," "),d.value||JSON.stringify(d),d.description||""])}):c.push([`${r}Red Flags`,i.replace(/_/g," "),typeof l=="string"?l:JSON.stringify(l),""])}),a.extract_iocs?.iocs&&Object.entries(a.extract_iocs.iocs).forEach(([i,l])=>{Array.isArray(l)&&l.forEach(d=>{c.push([`${r}IOCs`,i.replace(/_/g," "),d,""])})}),a.sections){const i=a.sections;i.analysis_mode&&c.push([`${r}Section Analysis`,"Analysis Mode",i.analysis_mode,""]),i.window_size&&c.push([`${r}Section Analysis`,"Window Size",`${i.window_size} bytes`,""]),i.window_stride&&c.push([`${r}Section Analysis`,"Window Stride",`${i.window_stride} bytes`,""]),i.total_sections!==void 0&&c.push([`${r}Section Analysis`,"Total Windows",i.total_sections,""]),i.reported_sections!==void 0&&c.push([`${r}Section Analysis`,"Reported Sections",i.reported_sections,""]),i.distribution_note&&c.push([`${r}Section Analysis`,"Distribution Note",i.distribution_note,""]),i.deduplicated_overlaps&&c.push([`${r}Section Analysis`,"Deduplicated Overlaps",i.deduplicated_overlaps,""]),Array.isArray(i.sections)&&i.sections.forEach(l=>{const d=l.anomalies?Object.entries(l.anomalies).filter(([,S])=>S===!0).map(([S])=>S.replace(/_/g," ")).join("; "):"",x=l.blob_types?.length>0?`blobs: ${l.blob_types.join(", ")}`:"",h=[d,x].filter(Boolean).join("; "),$=l.offset_start!==void 0?`0x${l.offset_start.toString(16)}-0x${l.offset_end.toString(16)}`:"";c.push([`${r}Section Windows`,l.name,`Entropy: ${l.entropy}, Severity: ${l.severity||"unknown"}, Size: ${l.raw_size||""}, Offset: ${$}
1`,h||"None"])})}a.whole_file_entropy!==void 0&&c.push([`${r}Entropy`,"Whole File",typeof a.whole_file_entropy=="number"?a.whole_file_entropy.toFixed(2):a.whole_file_entropy]),a.checks_enabled&&c.push([`${r}Analysis`,"Checks Enabled",Array.isArray(a.checks_enabled)?a.checks_enabled.join(", "):a.checks_enabled])});const p=c.map(a=>a.map(t=>{const r=String(t);return r.includes(",")||r.includes('"')||r.includes(` 2`)?`"${r.replace(/"/g,'""')}"`:r}).join(",")).join(` 3`),v=new Blob([p],{type:"text/csv"}),b=window.URL.createObjectURL(v),s=document.createElement("a");s.href=b,s.download=`malware_report_${n}.csv`,document.body.appendChild(s),s.click(),document.body.removeChild(s),window.URL.revokeObjectURL(b)};return w?e.jsx("div",{className:"min-h-screen bg-slate-950 text-white flex items-center justify-center",children:e.jsxs("div",{className:"text-center",children:[e.jsx("div",{className:"w-16 h-16 mx-auto mb-4 border-4 border-emerald-500/30 border-t-emerald-500 rounded-full animate-spin"}),e.jsx("p",{className:"text-lg text-slate-300",children:"Loading malware analysis..."}),e.jsx("p",{className:"text-sm text-slate-500 mt-2",children:"This may take a moment if the analysis is still running"})]})}):N||!o?e.jsx("div",{className:"min-h-screen bg-slate-950 text-white flex flex-col items-center justify-center p-8",children:e.jsxs("div",{className:"text-center max-w-2xl w-full",children:[e.jsx(L,{className:"w-16 h-16 text-yellow-400 mx-auto mb-4"}),e.jsx("h1",{className:"text-2xl font-bold mb-2",children:N||"Report Not Found"}),e.jsxs(V,{to:f.to,className:`${ve} mb-8`,children:["â ",f.label]})]})}):e.jsx(Q,{report:o,jobId:n,backLink:f,onDownload:A})}function Q({report:n,jobId:f,backLink:g,onDownload:o}
3){const[m,w]=R.useState({}),u=s=>w(a=>({...a,[s]:!a[s]})),N=s=>s>=7.5?{label:"Very High",color:"text-red-400",bg:"bg-red-500/10 border-red-500/20",desc:"Likely encrypted or packed"}:s>=6?{label:"High",color:"text-amber-300",bg:"bg-amber-500/15 border-amber-400/30",desc:"Possibly compressed or obfuscated"}:s>=4?{label:"Medium",color:"text-yellow-400",bg:"bg-yellow-500/10 border-yellow-500/20",desc:"Normal for mixed content"}:{label:"Low",color:"text-green-400",bg:"bg-green-500/10 border-green-500/20",desc:"Plain text or structured data"},y=s=>({critical:"text-red-400 bg-red-500/10",high:"text-amber-300 bg-amber-500/15",elevated:"text-yellow-400 bg-yellow-500/10",normal:"text-green-400 bg-green-500/10"})[s]||"text-slate-400 bg-slate-500/10",A=s=>{const a=s.anomalies?Object.entries(s.anomalies).filter(([,t])=>t===!0).map(([t])=>t.replace(/_/g," ")):[];return s.anomalies?.packer_hint&&a.push(`packer: ${s.anomalies.packer_hint}`),s.blob_types?.length>0&&a.push(`blobs: ${s.blob_types.join(", ")}`),a},c=s=>s.offset_start!==void 0?`0x${s.offset_start.toString(16)} â 0x${s.offset_end.toString(16)}`:"â",j=s=>s?`${(s/1024).toFixed(1)} KB`:"â",p=ae(n),v=p.flatMap(re),b=(s,a)=>{const t=v.find(r=>r.id===_(s,a))?.tone;return t==="fail"?"danger":t==="warn"?"warning":"neutral"};return e.jsx("div",{className:"analysis-report-page min-h-screen bg-slate-950 text-white",children:e.jsxs("div",{className:"relative max-w-6xl mx-auto px-4 pb-12 pt-24 sm:px-6 sm:pb-16 sm:pt-28",children:[e.jsx(ie,{kind:"Malware",backLink:g,analyzedAt:n.analyzed_at,jobId:f,onDownload:o,analyzeTo:"/static-malware-analyzer"}),e.jsx(le,{kind:"Malware",determination:n.determination,totalChecks:n.total_checks,failedChecks:n.number_failed_checks}),e.jsxs("div",{className:"email-message-details",children:[e.jsx("p",{className:"email-data-label",children:"Filename"}),e.jsx("p",{className:"email-data-value break-all",children:n.filename||p[0]?.filename||"Not reported"})]}),e.jsx(ne,{checks:v}),e.jsxs("div",{id:"analysis-evidence",className:"email-evidence-title analysis-scroll-target",children:[e.jsx("h2",{children:"Supporting evidence"}),e.jsx("p",{children:"Explore file properties, matched rules, indicators, and entropy measurements."})]}),!p.length&&e.jsx("p",{className:"email-data-notice",children:"Detailed file results were not included in this report."}),p.map((s,a)=>e.jsxs("div",{className:"analysis-file-evidence",children:[p.length>1&&e.jsx("h3",{className:"email-data-subheading",children:s.filename||`File ${a+1}`}),s.file_type&&e.jsxs(k,{id:_("file-type",a),title:"File type detection",description:"Compare the detected format with the file extension.",Icon:Z,tone:b("file-type",a),children:[e.jsxs("div",{className:"grid grid-cols-1 md:grid-cols-3 gap-4",children:[e.jsxs("div",{className:"p-4 rounded-lg bg-slate-900/50 border border-slate-800/80",children:[e.jsx("p",{className:"text-xs text-slate-500 mb-1 uppercase tracking-wider",children:"Detected MIME Type"}),e.jsx("p",{className:"text-lg font-semibold text-white font-mono",children:s.file_type.detected_mime||"Unknown"})]}),e.jsxs("div",{className:"p-4 rounded-lg bg-slate-900/50 border border-slate-800/80",children:[e.jsx("p",{className:"text-xs text-slate-500 mb-1 uppercase tracking-wider",children:"Extension Mismatch"}),(()=>{const t=s.file_type.extension_mismatch,r=!s.file_type.file_extension&&s.file_type.detected_mime;return t?e.jsxs("p",{className:"text-lg font-semibold text-red-400 flex items-center gap-1",children:[e.jsx(L,{className:"w-4 h-4"})," Yes"]}):r?e.jsxs("p",{className:"text-lg font-semibold text-amber-300 flex items-center gap-1",children:[e.jsx(L,{className:"w-4 h-4"})," Missing Extension"]}):e.jsxs("p",{className:"text-lg font-semibold text-green-400 flex items-center gap-1",children:[e.jsx(C,{className:"w-4 h-4"})," No"]})})()]})]}),e.jsxs("div",{className:"grid grid-cols-1 md:grid-cols-2 gap-4 mt-4",children:[e.jsxs("div",{className:"p-4 rounded-lg bg-slate-900/50 border border-slate-800/80",children:[e.jsx("p",{className:"text-xs text-slate-500 mb-1 uppercase tracking-wider",children:"File Extension"}),e.jsx("p",{className:`text-lg font-semibold font-mono ${s.file_type.file_extension?"text-white":"text-amber-300"}`,children:s.file_type.file_extension||"None"})]}),s.file_type.binary_format&&e.jsxs("div",{className:"p-4 rounded-lg bg-slate-900/50 border border-slate-800/80",children:[e.jsx("p",{className:"text-xs text-slate-500 mb-1 uppercase tracking-wider",children:"Binary Format"}),e.jsx("p",{className:"text-lg font-semibold text-white font-mono",children:s.file_type.binary_format})]})]}),s.file_size&&e.jsxs("div",{className:"mt-4 p-3 rounded-lg bg-slate-900/30 border border-slate-700/30",children:[e.jsxs("span",{className:"text-sm text-slate-400",children:["File Size:"," "]}),e.jsx("span",{className:"text-sm text-white font-mono",children:s.file_size>1024*1024?`${(s.file_size/(1024*1024)).toFixed(2)} MB`:`${(s.file_size/1024).toFixed(1)} KB`})]})]}),s.hashes&&e.jsx(k,{id:_("file-hashes",a),title:"File hashes",description:"Cryptographic fingerprints for investigation and threat intelligence lookups.",Icon:D,tone:b("file-hashes",a),children:e.jsx("div",{className:"space-y-3",children:Object.entries(s.hashes).map(([t,r])=>e.jsxs("div",{className:"p-4 rounded-lg bg-slate-900/50 border border-slate-800/80 flex flex-col gap-3 sm:flex-row sm:items-center sm:justify-between",children:[e.jsxs("div",{className:"flex min-w-0 flex-col gap-2 sm:flex-row sm:items-center sm:gap-3",children:[e.jsx("span",{className:"text-xs text-slate-500 uppercase tracking-wider font-bold sm:w-16 sm:flex-shrink-0",children:t}),e.jsx("code",{className:"text-sm text-amber-400 font-mono break-all",children:r})]}),e.jsxs("button",{onClick:()=>navigator.clipboard.writeText(r),className:"inline-flex w-full items-center justify-center gap-2 rounded-lg bg-slate-800/80 px-3 py-2 text-slate-300 transition-colors hover:bg-slate-800 hover:text-white sm:w-auto
3sm:bg-transparent sm:px-2 sm:py-1 sm:text-slate-500",title:"Copy to clipboard","aria-label":`Copy ${t} hash`,children:[e.jsx(ue,{className:"w-4 h-4"}),e.jsx("span",{className:"text-sm font-medium sm:hidden",children:"Copy hash"})]})]},t))})}),s.yara_matches!==void 0&&e.jsx(k,{id:_("yara-matches",a),title:"YARA rule matching",description:"Matched signatures, rule metadata, and supporting strings.",Icon:de,tone:b("yara-matches",a),children:s.yara_matches&&s.yara_matches.length>0?e.jsxs("div",{className:"space-y-3",children:[e.jsx("div",{className:"px-4 py-3 rounded-lg bg-red-500/5 border border-red-500/10 mb-4",children:e.jsxs("p",{className:"text-sm text-red-300",children:[e.jsxs("span",{className:"font-semibold",children:[s.yara_matches.length," rule",s.yara_matches.length!==1?"s":""," matched"]}),e.jsxs("span",{className:"text-slate-500",children:[" ","â file matched known malware or suspicious activity signatures"]})]})}),s.yara_matches.map((t,r)=>{const i=typeof t=="string"?t:t.rule||t.name||JSON.stringify(t),l=typeof t=="object"&&t!==null,d=G(t);return e.jsxs("div",{className:"p-4 rounded-lg bg-red-500/10 border border-red-500/20",children:[e.jsxs("div",{className:"flex items-center gap-3 mb-1",children:[e.jsx("span",{className:"text-red-400 font-semibold",children:i}),l&&t.namespace&&t.namespace!=="default"&&e.jsx("span",{className:"px-2 py-0.5 rounded text-xs bg-slate-700/50 text-slate-400 font-mono",children:t.namespace}),l&&t.tags&&t.tags.length>0&&t.tags.map((x,h)=>e.jsx("span",{className:"px-2 py-0.5 rounded text-xs bg-red-500/10 text-red-300 border border-red-500/20",children:x},h))]}),l&&e.jsxs("dl",{className:"mt-3 grid grid-cols-1 gap-3 sm:grid-cols-2",children:[e.jsxs("div",{className:"rounded-lg bg-slate-900/50 border border-slate-800/80 p-3 sm:col-span-2",children:[e.jsx("dt",{className:"text-xs uppercase tracking-wider text-slate-500 mb-1",children:"Description"}),e.jsx("dd",{className:`text-sm ${d.description?"text-slate-300":"text-slate-500 italic"}`,children:d.description||"Not provided in YARA metadata"})]}),e.jsxs("div",{className:"rounded-lg bg-slate-900/50 border border-slate-800/80 p-3",children:[e.jsx("dt",{className:"text-xs uppercase tracking-wider text-slate-500 mb-1",children:"Author"}),e.jsx("dd",{className:`text-sm break-words ${d.author?"text-slate-300":"text-slate-500 italic"}`,children:d.author||"Not provided"})]}),e.jsxs("div",{className:"rounded-lg bg-slate-900/50 border border-slate-800/80 p-3",children:[e.jsx("dt",{className:"text-xs uppercase tracking-wider text-slate-500 mb-1",children:"Source URL"}),e.jsx("dd",{className:"text-sm break-all",children:d.sourceUrl?J(d.sourceUrl)?e.jsx("a",{href:d.sourceUrl,target:"_blank",rel:"noreferrer",className:"text-emerald-300 hover:text-emerald-200 underline decoration-emerald-500/40 underline-offset-2",children:d.sourceUrl}):e.jsx("span",{className:"text-slate-300",children:d.sourceUrl}):e.jsx("span",{className:"text-slate-500 italic",children:"Not provided"})})]}),e.jsxs("div",{className:"rounded-lg bg-slate-900/50 border border-slate-800/80 p-3",children:[e.jsx("dt",{className:"text-xs uppercase tracking-wider text-slate-500 mb-1",children:"License URL"}),e.jsx("dd",{className:"text-sm break-all",children:d.licenseUrl?J(d.licenseUrl)?e.jsx("a",{href:d.licenseUrl,target:"_blank",rel:"noreferrer",className:"text-emerald-300 hover:text-emerald-200 underline decoration-emerald-500/40 underline-offset-2",children:d.licenseUrl}):e.jsx("span",{className:"text-slate-300",children:d.licenseUrl}):e.jsx("span",{className:"text-slate-500 italic",children:"Not provided"})})]})]}),l&&d.extraMetaEntries.length>0&&e.jsx("div",{className:"mt-3 flex flex-wrap gap-x-4 gap-y-1 text-xs text-slate-500",children:d.extraMetaEntries.map(([x,h])=>e.jsxs("span",{children:[e.jsxs("span",{className:"text-slate-400",children:[x,":"]})," ",String(h)]},x))}),l&&t.strings&&t.strings.length>0&&e.jsxs("div",{className:"mt-3",children:[e.jsx("p",{className:"text-xs text-slate-500 mb-1",children:"Matched strings:"}),e.jsx("div",{className:"flex flex-wrap gap-2",children:t.strings.map((x,h)=>e.jsx("code",{className:"px-2 py-0.5 rounded text-xs bg-slate-800 text-slate-300 font-mono border border-slate-800/80",children:typeof x=="str
3ing"?x:x.identifier||x.data||JSON.stringify(x)},h))})]})]},r)})]}):e.jsxs("div",{className:"p-4 rounded-lg bg-green-500/10 border border-green-500/20",children:[e.jsxs("p",{className:"text-green-400 font-semibold flex items-center gap-2",children:[e.jsx(C,{className:"w-4 h-4"})," No YARA rule matches detected"]}),e.jsx("p",{className:"text-sm text-slate-400 mt-1",children:"The file did not match any known malware signatures"})]})}),s.malicious_strings&&e.jsx(k,{id:_("string-analysis",a),title:"String analysis",description:"Patterns and strings flagged during static analysis.",Icon:Y,tone:b("string-analysis",a),children:Object.values(s.malicious_strings.red_flags||{}).some(T)?e.jsxs("div",{className:"p-4 rounded-lg bg-red-500/10 border border-red-500/20",children:[e.jsxs("p",{className:"text-red-400 font-semibold text-lg mb-3 flex items-center gap-2",children:[e.jsx(me,{className:"w-5 h-5"})," Red Flags Detected"]}),e.jsx("div",{className:"space-y-4",children:Object.entries(s.malicious_strings.red_flags).filter(([,t])=>T(t)).map(([t,r],i)=>e.jsxs("div",{children:[e.jsxs("button",{onClick:()=>u(`redflag_${a}_${t}`),"aria-expanded":!!m[`redflag_${a}_${t}`],className:"w-full flex items-center justify-between p-3 rounded-lg bg-red-500/5 border border-red-500/10 hover:border-red-500/30 transition-colors",children:[e.jsxs("span",{className:"text-sm font-semibold text-red-400 capitalize",children:[t.replace(/_/g," ")," ",Array.isArray(r)?`(${r.length})`:""]}),e.jsx("span",{className:"text-slate-500",children:m[`redflag_${a}_${t}`]?"â¼":"â¶"})]}),m[`redflag_${a}_${t}`]&&e.jsx("div",{className:"mt-2 space-y-1 max-h-64 overflow-y-auto",children:Array.isArray(r)?r.map((l,d)=>e.jsxs("div",{className:"px-4 py-2 rounded bg-slate-900/30 border border-slate-800/50 flex flex-col gap-1",children:[e.jsx("code",{className:"text-xs text-red-400 font-mono break-all",children:l.value||JSON.stringify(l)}),l.description&&e.jsx("span",{className:"text-xs text-slate-500",children:l.description})]},d)):e.jsx("div",{className:"px-4 py-2 rounded bg-slate-900/30 border border-slate-800/50",children:e.jsx("span",{className:"text-xs text-slate-300",children:typeof r=="string"?r:JSON.stringify(r)})})})]},i))})]}):s.malicious_strings.red_flags!=null?e.jsx("div",{className:"p-4 rounded-lg bg-green-500/10 border border-green-500/20",children:e.jsxs("p",{className:"text-green-400 font-semibold flex items-center gap-2",children:[e.jsx(C,{className:"w-4 h-4"})," No malicious string patterns detected"]})}):e.jsx("p",{className:"email-data-caption",children:"String pattern results were not included in this report."})}),s.extract_iocs&&e.jsxs(k,{id:_("ioc-extraction",a),title:"Extracted indicators",description:"Addresses and other indicators found in the file; these are observations, not proof of malware.",Icon:xe,tone:b("ioc-extraction",a),children:[s.extract_iocs.iocs&&(()=>{const t=s.extract_iocs.iocs,r=Object.values(t).reduce((i,l)=>i+(Array.isArray(l)?l.length:0),0);return e.jsxs("div",{className:"grid grid-cols-2 md:grid-cols-4 gap-4 mb-6",children:[e.jsxs("div",{className:"p-4 rounded-lg bg-slate-900/50 border border-slate-800/80",children:[e.jsx("p",{className:"text-xs text-slate-500 mb-1 uppercase tracking-wider",children:"Total IOCs"}),e.jsx("p",{className:"text-2xl font-bold text-cyan-300",children:r})]}),e.jsxs("div",{className:"p-4 rounded-lg bg-slate-900/50 border border-slate-800/80",children:[e.jsx("p",{className:"text-xs text-slate-500 mb-1 uppercase tracking-wider",children:"URLs"}),e.jsx("p",{className:"text-2xl font-bold text-cyan-300",children:t.url?.length||0})]}),e.jsxs("div",{className:"p-4 rounded-lg bg-slate-900/50 border border-slate-800/80",children:[e.jsx("p",{className:"text-xs text-slate-500 mb-1 uppercase tracking-wider",children:"IP Addresses"}),e.jsx("p",{className:"text-2xl font-bold text-amber-300",children:(t.ipv4?.length||0)+(t.ipv6?.length||0)})]}),e.jsxs("div",{className:"p-4 rounded-lg bg-slate-900/50 border border-slate-800/80",children:[e.jsx("p",{className:"text-xs text-slate-500 mb-1 uppercase tracking-wider",children:"Domains"}),e.jsx("p",{className:"text-2xl font-bold text-cyan-300",children:t.domain?.length||0})]})]})})(),s.extract_iocs.iocs&&(()=>{const t=[{key:"url",label:"URLs",icon:e.jsx(ee,{className:"w-4 h-4 inline"}),color:"violet"},{key:"ipv4",label:"IPv4 Addresses",icon:e.jsx(W,{className:"w-4 h-4 inline"}),color:"orange"},{key:"ipv6",label:"IPv6 Addresses",icon:e.jsx(W,{className:"w-4 h-4 inline"}),color:"orange"},{key:"domain",label:"Domains",icon:e.jsx(be,{className:"w-4 h-4 inline"}),color:"purple"},{key:"email",label:"Email Addresses",icon:e.jsx(se,{className:"w-4 h-4 inline"}),color:"pink"},{key:"windows_path",label:"Windows Paths",icon:e.jsx(B,{className:"w-4 h-4 inline"}),color:"blue"},{key:"unix_path",label:"Unix Paths",icon:e.jsx(B,{className:"w-4 h-4 inline"}),color:"blue"},{key:"registry_key",label:"Registry Keys",icon:e.jsx(te,{className:"w-4 h-4 inline"}),color:"amber"},{key:"shell_commands",label:"Shell Commands",icon:e.jsx(fe,{className:"w-4 h-4 inline"}),color:"red"},{key:"base64_blob",label:"Base64 Encoded Data",icon:e.jsx(F,{className:"w-4 h-4 inline"}),color:"yellow"},{key:"hex_blob",label:"Hex Blobs",icon:e.jsx(F,{className:"w-4 h-4 inline"}),color:"yellow"},{key:"url_encoded",label:"URL Encoded Data",icon:e.jsx(F,{className:"w-4 h-4 inline"}),color:"yellow"},{key:"bitcoin_address",label:"Bitcoin Addresses",icon:e.jsx(ye,{className:"w-4 h-4 inline"}),color:"amber"},{key:"ethereum_address",label:"Ethereum Addresses",icon:e.jsx(P,{className:"w-4 h-4 inline"}),color:"indigo"},{key:"monero_address",label:"Monero Addresses",icon:e.jsx(P,{className:"w-4 h-4 inline"}),color:"slate"},{key:"credentials_and_keys",label:"Credentials & Keys",icon:e.jsx(D,{className:"w-4 h-4 inline"}),color:"red"},{key:"user_agents",label:"User Agents",icon:e.jsx(_e,{className:"w-4 h-4 inline"}),color:"cyan"},{key:"pdb_debug_paths",label:"PDB Debug Paths",icon:e.jsx(Y,{className:"w-4 h-4 inline"}),color:"rose"},{key:"mutex_names",label:"Mutex Names",icon:e.jsx(F,{className:"w-4 h-4 inline"}),color:"teal"}],r=s.extract_iocs.iocs;return e.jsxs("div",{className:"space-y-3",children:[e.jsx("h3",{className:"text-sm font-semibold text-slate-400 uppercase tracking-wider mt-2",children:"Extracted IOCs"}),t.map(({key:i,label:l,icon:d,color:x})=>{const h=r[i];return!h||!Array.isArray(h)||h.length===0?null:e.jsxs("div",{children:[e.jsxs("button",{onClick:()=>u(`ioc_${i}_${a}`),"aria-expanded":!!m[`ioc_${i}_${a}`],className:"w-full flex items-center justify-between p-3 rounded-lg bg-slate-900/50 border border-slate-800/80 hover:border-slate-600 transition-colors",children:[e.jsxs("span",{className:"text-sm font-semibold text-slate-300",children:[d," ",l,"
3(",h.length,")"]}),e.jsx("span",{className:"text-slate-500",children:m[`ioc_${i}_${a}`]?"â¼":"â¶"})]}),m[`ioc_${i}_${a}`]&&e.jsx("div",{className:"mt-2 space-y-1 max-h-64 overflow-y-auto",children:h.map(($,S)=>e.jsx("div",{className:"px-4 py-2 rounded bg-slate-900/30 border border-slate-800/50",children:e.jsx("code",{className:`text-xs text-${x}-400 font-mono break-all`,children:$})},S))})]},i)})]})})()]}),s.sections&&e.jsxs(k,{id:_("sectional-entropy",a),title:"Sectional entropy",description:"Inspect flagged regions, byte offsets, and structural anomalies.",Icon:pe,tone:b("sectional-entropy",a),children:[e.jsxs("div",{className:"grid grid-cols-2 md:grid-cols-4 gap-4 mb-6",children:[s.sections.analysis_mode&&e.jsxs("div",{className:"p-4 rounded-lg bg-slate-900/50 border border-slate-800/80",children:[e.jsx("p",{className:"text-xs text-slate-500 mb-1 uppercase tracking-wider",children:"Analysis Mode"}),e.jsx("p",{className:"text-sm font-semibold text-white capitalize",children:s.sections.analysis_mode.replace(/_/g," ")})]}),s.sections.window_size&&e.jsxs("div",{className:"p-4 rounded-lg bg-slate-900/50 border border-slate-800/80",children:[e.jsx("p",{className:"text-xs text-slate-500 mb-1 uppercase tracking-wider",children:"Window Size"}),e.jsxs("p",{className:"text-sm font-semibold text-white",children:[s.sections.window_size.toLocaleString()," bytes"]})]}),s.sections.total_sections!==void 0&&e.jsxs("div",{className:"p-4 rounded-lg bg-slate-900/50 border border-slate-800/80",children:[e.jsx("p",{className:"text-xs text-slate-500 mb-1 uppercase tracking-wider",children:"Total Windows"}),e.jsx("p",{className:"text-sm font-semibold text-white",children:s.sections.total_sections})]}),s.sections.reported_sections!==void 0&&e.jsxs("div",{className:"p-4 rounded-lg bg-slate-900/50 border border-slate-800/80",children:[e.jsx("p",{className:"text-xs text-slate-500 mb-1 uppercase tracking-wider",children:"Reported (Flagged)"}),e.jsxs("p",{className:`text-sm font-semibold ${s.sections.reported_sections>0?"text-amber-300":"text-green-400"}`,children:[s.sections.reported_sections," of"," ",s.sections.raw_reported_sections??s.sections.total_sections]})]})]}),s.sections.distribution_note&&e.jsx("div",{className:"mb-6 p-3 rounded-lg bg-cyan-500/10 border border-cyan-500/20",children:e.jsx("p",{className:"text-sm text-slate-300",children:s.sections.distribution_note})}),Array.isArray(s.sections.sections)&&s.sections.sections.length>0?e.jsxs(e.Fragment,{children:[e.jsx("div",{className:"space-y-4 lg:hidden",children:s.sections.sections.map((t,r)=>{const i=t.entropy||0,l=y(t.severity),d=N(i),x=A(t);return e.jsxs("div",{className:"rounded-xl border border-slate-800/80 bg-slate-900/40 p-4",children:[e.jsxs("div",{className:"flex flex-col gap-3 sm:flex-row sm:items-start sm:justify-between",children:[e.jsxs("div",{className:"min-w-0",children:[e.jsx("p",{className:"text-xs uppercase tracking-wider text-slate-500",children:"Window"}),e.jsx("p",{className:"mt-1 font-mono text-sm text-white break-all",children:t.name})]}),e.jsx("span",{className:`inline-flex w-fit px-2 py-1 rounded text-xs font-medium capitalize ${l}`,children:t.severity||"unknown"})]}),e.jsxs("div",{className:"mt-4 grid grid-cols-1 gap-3 sm:grid-cols-2",children:[e.jsxs("div",{className:"rounded-lg border border-slate-800/80 bg-slate-950/60 p-3",children:[e.jsx("p",{className:"text-[11px] uppercase tracking-wider text-slate-500",children:"Offset Range"}),e.jsx("p",{className:"mt-1 break-all font-mono text-xs text-slate-300",children:c(t)})]}),e.jsxs("div",{className:"rounded-lg border border-slate-800/80 bg-slate-950/60 p-3",children:[e.jsx("p",{className:"text-[11px] uppercase tracking-wider text-slate-500",children:"Window Size"}),e.jsx("p",{className:"mt-1 text-sm font-semibold text-white",children:j(t.raw_size)})]}),e.jsxs("div",{className:"rounded-lg border border-slate-800/80 bg-slate-950/60 p-3",children:[e.jsx("p",{className:"text-[11px] uppercase tracking-wider text-slate-500",children:"Entropy"}),e.jsx("p",{className:`mt-1 text-sm font-semibold ${d.color}`,children:i.toFixed(3)}),t.entropy_confidence&&t.entropy_confidence!=="full"&&e.jsx("p",{className:"mt-1 text-xs text-slate-500",children:t.entropy_confidence})]}),e.jsxs("div",{className:"rounded-lg border border-slate-800/80 bg-slate-950/60 p-3",children:[e.jsx("p",{className:"text-[11px] uppercase tracking-wider text-slate-500",children:"Anomalies"}),x.length>0?e.jsx("div",{className:"mt-2 flex flex-wrap gap-1.5",children:x.map((h,$)=>e.jsx("span",{className:"px-2 py-0.5 rounded text-xs bg-red-500/10 text-red-400 border border-red-500/20",children:h},$))}):e.jsx("p",{className:"mt-1 text-xs text-green-400",children:"None"})]})]})]},r)})}),e.jsx("div",{className:"hidden overflow-x-auto lg:block",children:e.jsxs("table",{className:"w-full text-left",children:[e.jsx("thead",{className:"bg-slate-950/50 text-slate-400 text-xs uppercase tracking-wider border-b border-slate-700/50",children:e.jsxs("tr",{children:[e.jsx("th",{className:"px-4 py-3 font-medium",children:"Window"}),e.jsx("th",{className:"px-4 py-3 font-medium",children:"Offset Range"}),e.jsx("th",{className:"px-4 py-3 font-medium",children:"Size"}),e.jsx("th",{className:"px-4 py-3 font-medium",children:"Entropy"}),e.jsx("th",{className:"px-4 py-3 font-medium",children:"Severity"}),e.jsx("th",{className:"px-4 py-3 font-medium",children:"Anomalies"})]})}),e.jsx("tbody",{className:"divide-y divide-slate-800/50",children:s.sections.sections.map((t,r)=>{const i=t.entropy||0,l=y(t.severity),d=A(t);return e.jsxs("tr",{className:"hover:bg-slate-800/30 transition-colors",children:[e.jsx("td",{className:"px-4 py-3 font-mono text-sm text-white",children:t.name}),e.jsx("td",{className:"px-4 py-3 text-sm text-slate-400 font-mono",children:c(t)}),e.jsx("td",{className:"px-4 py-3 text-sm text-slate-400",children:j(t.raw_size)}),e.jsxs("td",{className:"px-4 py-3 text-sm",children:[e.jsx("span",{className:N(i).color,children:i.toFixed(3)}),t.entropy_confidence&&t.entropy_confidence!=="full"&&e.jsxs("span",{className:"text-xs text-slate-500 ml-1",children:["(",t.entro
3py_confidence,")"]})]}),e.jsx("td",{className:"px-4 py-3 text-sm",children:e.jsx("span",{className:`px-2 py-1 rounded text-xs font-medium capitalize ${l}`,children:t.severity||"unknown"})}),e.jsx("td",{className:"px-4 py-3 text-sm",children:d.length>0?e.jsx("div",{className:"flex flex-wrap gap-1",children:d.map((x,h)=>e.jsx("span",{className:"px-2 py-0.5 rounded text-xs bg-red-500/10 text-red-400 border border-red-500/20",children:x},h))}):e.jsx("span",{className:"text-xs text-green-400",children:"None"})})]},r)})})]})})]}):e.jsx("div",{className:"p-4 rounded-lg bg-green-500/10 border border-green-500/20",children:e.jsxs("p",{className:"text-green-400 font-semibold flex items-center gap-2",children:[e.jsx(C,{className:"w-4 h-4"})," No anomalous sections detected"]})}),(s.sections.suppressed_normal>0||s.sections.deduplicated_overlaps>0)&&e.jsxs("div",{className:"mt-4 flex flex-wrap gap-4 text-xs text-slate-500",children:[s.sections.suppressed_normal>0&&e.jsxs("span",{children:[s.sections.suppressed_normal," normal windows suppressed"]}),s.sections.deduplicated_overlaps>0&&e.jsxs("span",{children:[s.sections.deduplicated_overlaps," overlapping windows deduplicated"]})]})]}),s.whole_file_entropy!==void 0&&s.whole_file_entropy!==null&&e.jsx(k,{id:_("whole-file-entropy",a),title:"Whole-file entropy",description:"A measure of byte randomness that can indicate compression, encryption, or packing.",Icon:he,tone:b("whole-file-entropy",a),children:(()=>{const t=Number(s.whole_file_entropy);if(!Number.isFinite(t)||s.whole_file_entropy==="")return e.jsx("p",{className:"email-data-caption",children:"No numeric entropy measurement was reported."});const r=N(t),i=Math.min(t/8*100,100);return e.jsxs("div",{className:"space-y-4",children:[e.jsxs("div",{className:"flex items-end gap-4",children:[e.jsxs("div",{children:[e.jsx("p",{className:`text-4xl font-bold ${r.color}`,children:t.toFixed(2)}),e.jsx("p",{className:"text-sm text-slate-500",children:"out of 8.0 max"})]}),e.jsx("div",{className:`px-3 py-1 rounded-lg text-sm font-medium ${r.bg} border ${r.color}`,children:r.label})]}),e.jsxs("div",{className:"relative h-4 bg-slate-800 rounded-full overflow-hidden",children:[e.jsx("div",{className:`absolute inset-y-0 left-0 rounded-full transition-all duration-1000 ${t>=7.5?"bg-red-500":t>=6?"bg-amber-500":t>=4?"bg-amber-400":"bg-emerald-500"}`,style:{width:`${i}%`}}),e.jsxs("div",{className:"absolute inset-0 flex",children:[e.jsx("div",{className:"w-1/2 border-r border-slate-700/50"}),e.jsx("div",{className:"w-1/4 border-r border-slate-700/50"})]})]}),e.jsxs("p",{className:"text-sm text-slate-400",children:[r.desc,". Entropy alone does not establish whether a file is malicious."]})]})})()})]},a)),e.jsx(oe,{checks:v}),e.jsxs("footer",{className:"email-report-footer",children:[e.jsxs(V,{to:g.to,children:["â ",g.label]}),e.jsxs("span",{children:["Report ",f]})]})]})})}Q.propTypes={report:z.object.isRequired,jobId:z.string.isRequired,backLink:z.object.isRequired,onDownload:z.func.isRequired};export{Q as MalwareReportContent,Je as default};
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.