{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2024:V2J3HNQFWF6JPYIAWGGCRTGEBM","short_pith_number":"pith:V2J3HNQF","canonical_record":{"source":{"id":"2406.04027","kind":"arxiv","version":2},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2024-06-06T12:55:50Z","cross_cats_sorted":["cs.SE"],"title_canon_sha256":"e2df73adc3a4c779de77b2d8b643622689b5565bfb8abafa0644cf51c5912644","abstract_canon_sha256":"186c978724050b9268e8488b8c0c95ef6354f6e8e6234600f38e5a2c470d0999"},"schema_version":"1.0"},"canonical_sha256":"ae93b3b605b17c97e100b18c28ccc40b3dce4e73a1f893586f3ffff7bd7fded6","source":{"kind":"arxiv","id":"2406.04027","version":2},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2406.04027","created_at":"2026-07-05T08:34:20Z"},{"alias_kind":"arxiv_version","alias_value":"2406.04027v2","created_at":"2026-07-05T08:34:20Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2406.04027","created_at":"2026-07-05T08:34:20Z"},{"alias_kind":"pith_short_12","alias_value":"V2J3HNQFWF6J","created_at":"2026-07-05T08:34:20Z"},{"alias_kind":"pith_short_16","alias_value":"V2J3HNQFWF6JPYIA","created_at":"2026-07-05T08:34:20Z"},{"alias_kind":"pith_short_8","alias_value":"V2J3HNQF","created_at":"2026-07-05T08:34:20Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2024:V2J3HNQFWF6JPYIAWGGCRTGEBM","target":"record","payload":{"canonical_record":{"source":{"id":"2406.04027","kind":"arxiv","version":2},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2024-06-06T12:55:50Z","cross_cats_sorted":["cs.SE"],"title_canon_sha256":"e2df73adc3a4c779de77b2d8b643622689b5565bfb8abafa0644cf51c5912644","abstract_canon_sha256":"186c978724050b9268e8488b8c0c95ef6354f6e8e6234600f38e5a2c470d0999"},"schema_version":"1.0"},"canonical_sha256":"ae93b3b605b17c97e100b18c28ccc40b3dce4e73a1f893586f3ffff7bd7fded6","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T08:34:20.164997Z","signature_b64":"052a9x454lTInn4LCD0necL3l6AYvwzxfckvFuUKbFbDt/IcQuU88iHyK3EU+HPdeAOUVe7RVCO0tzI8NzDDBA==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"ae93b3b605b17c97e100b18c28ccc40b3dce4e73a1f893586f3ffff7bd7fded6","last_reissued_at":"2026-07-05T08:34:20.164338Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T08:34:20.164338Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2406.04027","source_version":2,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T08:34:20Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"C+OfoIosxcckTIsnXqz0AOsmY05Hmnz9OuGYXvdlaMFERb5mretWnlK7DG2vHZL8CvX0iVGBy0E2mjnUrVzdAQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-18T16:54:02.285582Z"},"content_sha256":"3d3125db37c7edc6f073fe1390808ce14bfe06197907ad3c30e1f4c3fa252129","schema_version":"1.0","event_id":"sha256:3d3125db37c7edc6f073fe1390808ce14bfe06197907ad3c30e1f4c3fa252129"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2024:V2J3HNQFWF6JPYIAWGGCRTGEBM","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"PowerPeeler: A Precise and General Dynamic Deobfuscation Method for PowerShell Scripts","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":["cs.SE"],"primary_cat":"cs.CR","authors_text":"Chenyang Zhang, Haixin Duan, Huajun Chai, Jun Tao, Lingyun Ying, Ruijie Li","submitted_at":"2024-06-06T12:55:50Z","abstract_excerpt":"PowerShell is a powerful and versatile task automation tool. Unfortunately, it is also widely abused by cyber attackers. To bypass malware detection and hinder threat analysis, attackers often employ diverse techniques to obfuscate malicious PowerShell scripts. Existing deobfuscation tools suffer from the limitation of static analysis, which fails to simulate the real deobfuscation process accurately.\n  In this paper, we propose PowerPeeler. To the best of our knowledge, it is the first dynamic PowerShell script deobfuscation approach at the instruction level. It utilizes expression-related Ab"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2406.04027","kind":"arxiv","version":2},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2406.04027/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T08:34:20Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"x5GkVytAScY/qKwDAq0T/WZCGQfdWY16ZciaCAbHSjNUMVUiZ9lex/t9YhUSsElPa/PS09SymmA6w1L5WI+bBg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-18T16:54:02.286431Z"},"content_sha256":"2fd263f06a5b7303619baf77f2b1bb3daba1da05d4055373c8e5555e98dffe7b","schema_version":"1.0","event_id":"sha256:2fd263f06a5b7303619baf77f2b1bb3daba1da05d4055373c8e5555e98dffe7b"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/V2J3HNQFWF6JPYIAWGGCRTGEBM/bundle.json","state_url":"https://pith.science/pith/V2J3HNQFWF6JPYIAWGGCRTGEBM/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/V2J3HNQFWF6JPYIAWGGCRTGEBM/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-18T16:54:02Z","links":{"resolver":"https://pith.science/pith/V2J3HNQFWF6JPYIAWGGCRTGEBM","bundle":"https://pith.science/pith/V2J3HNQFWF6JPYIAWGGCRTGEBM/bundle.json","state":"https://pith.science/pith/V2J3HNQFWF6JPYIAWGGCRTGEBM/state.json","well_known_bundle":"https://pith.science/.well-known/pith/V2J3HNQFWF6JPYIAWGGCRTGEBM/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2024:V2J3HNQFWF6JPYIAWGGCRTGEBM","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"186c978724050b9268e8488b8c0c95ef6354f6e8e6234600f38e5a2c470d0999","cross_cats_sorted":["cs.SE"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2024-06-06T12:55:50Z","title_canon_sha256":"e2df73adc3a4c779de77b2d8b643622689b5565bfb8abafa0644cf51c5912644"},"schema_version":"1.0","source":{"id":"2406.04027","kind":"arxiv","version":2}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2406.04027","created_at":"2026-07-05T08:34:20Z"},{"alias_kind":"arxiv_version","alias_value":"2406.04027v2","created_at":"2026-07-05T08:34:20Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2406.04027","created_at":"2026-07-05T08:34:20Z"},{"alias_kind":"pith_short_12","alias_value":"V2J3HNQFWF6J","created_at":"2026-07-05T08:34:20Z"},{"alias_kind":"pith_short_16","alias_value":"V2J3HNQFWF6JPYIA","created_at":"2026-07-05T08:34:20Z"},{"alias_kind":"pith_short_8","alias_value":"V2J3HNQF","created_at":"2026-07-05T08:34:20Z"}],"graph_snapshots":[{"event_id":"sha256:2fd263f06a5b7303619baf77f2b1bb3daba1da05d4055373c8e5555e98dffe7b","target":"graph","created_at":"2026-07-05T08:34:20Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2406.04027/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"PowerShell is a powerful and versatile task automation tool. Unfortunately, it is also widely abused by cyber attackers. To bypass malware detection and hinder threat analysis, attackers often employ diverse techniques to obfuscate malicious PowerShell scripts. Existing deobfuscation tools suffer from the limitation of static analysis, which fails to simulate the real deobfuscation process accurately.\n  In this paper, we propose PowerPeeler. To the best of our knowledge, it is the first dynamic PowerShell script deobfuscation approach at the instruction level. It utilizes expression-related Ab","authors_text":"Chenyang Zhang, Haixin Duan, Huajun Chai, Jun Tao, Lingyun Ying, Ruijie Li","cross_cats":["cs.SE"],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2024-06-06T12:55:50Z","title":"PowerPeeler: A Precise and General Dynamic Deobfuscation Method for PowerShell Scripts"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2406.04027","kind":"arxiv","version":2},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:3d3125db37c7edc6f073fe1390808ce14bfe06197907ad3c30e1f4c3fa252129","target":"record","created_at":"2026-07-05T08:34:20Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"186c978724050b9268e8488b8c0c95ef6354f6e8e6234600f38e5a2c470d0999","cross_cats_sorted":["cs.SE"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2024-06-06T12:55:50Z","title_canon_sha256":"e2df73adc3a4c779de77b2d8b643622689b5565bfb8abafa0644cf51c5912644"},"schema_version":"1.0","source":{"id":"2406.04027","kind":"arxiv","version":2}},"canonical_sha256":"ae93b3b605b17c97e100b18c28ccc40b3dce4e73a1f893586f3ffff7bd7fded6","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"ae93b3b605b17c97e100b18c28ccc40b3dce4e73a1f893586f3ffff7bd7fded6","first_computed_at":"2026-07-05T08:34:20.164338Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T08:34:20.164338Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"052a9x454lTInn4LCD0necL3l6AYvwzxfckvFuUKbFbDt/IcQuU88iHyK3EU+HPdeAOUVe7RVCO0tzI8NzDDBA==","signature_status":"signed_v1","signed_at":"2026-07-05T08:34:20.164997Z","signed_message":"canonical_sha256_bytes"},"source_id":"2406.04027","source_kind":"arxiv","source_version":2}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:3d3125db37c7edc6f073fe1390808ce14bfe06197907ad3c30e1f4c3fa252129","sha256:2fd263f06a5b7303619baf77f2b1bb3daba1da05d4055373c8e5555e98dffe7b"],"state_sha256":"139b703ce4f4a28bdd48af522cb9c5b33f33fa388482a685d80b3c339b8732aa"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"jH/gcAUKAhH9Vl6z7Cz9TJh0az9Nii2qQuhgP4RCWhaNDHENL1AEPeouzhH9MxtbwD24pjW0FXnvX4JnwzzOBw==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-18T16:54:02.294652Z","bundle_sha256":"4413a6f8fa9b8af07448863ddbbc6f248f6074eab0799118934652e52ca15c8e"}}