{ "ml": { "v": "7", "eng": "2.2.0-beta.2", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.63866615, "rte": "az", "prob": 0.63866615 }, { "cls": 0, "raw": 0.44056717, "rte": "az/nupkg", "prob": 0.44056717 } ], "prob": 0.63866615, "skip": [ { "rte": "az/zip", "why": "unavailable" }, { "rte": "az/zip", "why": "unavailable" } ], "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.6386661529541016, "type": "nupkg" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.00012001395225524902, "type": "xml" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.010236918926239014, "type": "xml" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.1600397825241089, "type": "pe" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "xml" }, { "id": 5, "lvl": -1, "conf": 0, "prob": 0.1600397825241089, "type": "pe" }, { "id": 6, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "xml" }, { "id": 7, "lvl": -1, "conf": 0, "prob": 0.00006663799285888672, "type": "png" }, { "id": 8, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "xml" }, { "id": 9, "lvl": -1, "conf": 0, "prob": 0.00012001395225524902, "type": "xml" }, { "id": 10, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "registry" } ], "version": "v18.18", "analyzed_at": "2026-06-29T20:22:49Z" }, "path": "Polecat.AspNetCore.4.7.0.nupkg", "raw": { "files": [ { "id": 0, "mol": "O(Al)H₂(CmDb)", "sha": "20c9d9f4aea130dc842943c963a3d4895121e97485e448d770321f93509f9300", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Polecat.AspNetCore/Polecat.AspNetCore.4.7.0.nupkg", "risk": 4, "size": 97964, "type": "nupkg", "facts": { "metrics": { "file": { "size": 97964.0, "entropy": 7.98, "size_bytes": 97964.0 }, "binary": { "overall_entropy": 7.98, "peak_region_bytes": 93184.0, "peak_region_entropy": 7.84 }, "archive": { "file_count": 10.0, "member_count": 10.0, "script_count": 0.0, "zip_bomb_ratio": 5.02, "directory_count": 0.0, "executable_count": 2.0, "extra_field_size": 0.0, "noise_file_count": 0.0, "total_compressed": 96598.0, "compression.ratio": 0.65, "hidden_file_count": 2.0, "total_uncompressed": 147603.0, "crc_collision_count": 1.0, "entry_comment_count": 0.0, "max_filename_length": 81.0, "rtlo_filename_count": 0.0, "format.regular_count": 10.0, "nested_archive_count": 0.0, "path_traversal_count": 0.0, "symlink_escape_count": 0.0, "security.setgid_count": 0.0, "security.setuid_count": 0.0, "security.sticky_count": 0.0, "double_extension_count": 0.0, "duplicate_member_count": 0.0, "security.symlink_count": 0.0, "unicode_filename_count": 0.0, "homoglyph_filename_count": 0.0, "security.encrypted_count": 0.0, "timing.mtime_unique_count": 6.0, "timing.mtime_unique_ratio": 0.6, "misplaced_executable_count": 2.0, "timing.mtime_dominant_count": 4.0, "timing.mtime_spread_seconds": 25170.0, "timing.sentinel_mtime_count": 0.0, "security.world_writable_count": 0.0, "timing.mtime_dominant_fraction": 0.4, "compression.method_counts.stored": 1.0, "compression.method_counts.deflate": 9.0 } } }, "ident": { "name": { "value": "Polecat.AspNetCore", "source": "nupkg.title", "verified": false }, "urls": [ { "url": "https://polecat.netlify.app/", "kind": "homepage", "source": "nupkg.project_url" }, { "url": "https://github.com/JasperFx/polecat", "kind": "repository", "source": "nupkg.repository_url" } ], "trust": "unsigned", "authors": [ { "name": "Jeremy D. Miller", "role": "author", "source": "nupkg.authors" } ], "version": { "value": "4.7.0", "source": "nupkg.version", "verified": false }, "identifier": { "value": "Polecat.AspNetCore", "source": "nupkg.id", "verified": false } }, "traits": [ { "id": "micro-behaviors/communications/http/server/managed::http-item-setter", "conf": 1.0, "crit": 1, "desc": "Modification of HTTP context items", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "from": [ { "file": 3 } ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "from": [ { "file": 3 } ] }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/communications/http/server/managed::http-request-get", "conf": 1.0, "crit": 3, "desc": "Access to ASP.NET Request object", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/data/db/linq::system-linq-expressions", "conf": 0.6000000238418579, "crit": 3, "desc": "System.Linq.Expressions namespace", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/communications/http/server/managed::http-response-get", "conf": 1.0, "crit": 3, "desc": "Access to ASP.NET Response object", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/communications/http/server/managed::http-context", "conf": 1.0, "crit": 3, "desc": "Access to ASP.NET HttpContext", "from": [ { "file": 3 } ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "from": [ { "file": 3 } ] }, { "id": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "conf": 1.0, "crit": 3, "desc": "JSON polymorphism runtime marker", "from": [ { "file": 3 } ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "metadata/package/versioning::version-word-lower", "conf": 0.4000000059604645, "crit": 2, "desc": "version word (lowercase)", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/communications/http/server/managed::http-context-item-setter", "conf": 0.8500000238418579, "crit": 3, "desc": "Modification of HTTP context items", "from": [ { "off": 21769, "file": 3 }, { "off": 21761, "file": 5 } ] }, { "id": "micro-behaviors/data/db/linq::linq-queries", "conf": 0.699999988079071, "crit": 3, "desc": "LINQ query operations", "from": [ { "file": 3 } ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "from": [ { "file": 3 } ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "from": [ { "file": 3 }, { "file": 5 } ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "from": [ { "file": 3 } ] } ] }, { "depth": 1, "facts": { "metrics": { "file": { "size": 508.0, "entropy": 5.18, "size_bytes": 508.0 }, "binary": { "overall_entropy": 5.18, "peak_region_bytes": 508.0, "peak_region_entropy": 5.18 } } }, "id": 1, "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Polecat.AspNetCore/Polecat.AspNetCore.4.7.0.nupkg!!_rels/.rels", "sha": "8322a8c329b1fcf6bab55474d0992dbd26be3e3dff2dc654577159ce365775c5", "size": 508, "type": "xml" }, { "ctx": [ { "b": "[4ls%kx}3YaA?spB7]MgjT8QkfD}SJzEWP}x(mMDb6w0teJs}sj]", "n": [ { "c": 2, "d": "NuGet nuspec manifest file", "i": "metadata/build/manifest::nuspec-file", "o": 0, "z": 25, "cf": 0.9800000190734863 } ], "ln": 1, "addr": 0 }, { "b": "jAa.syHH\u003c!aB4:tzGv@+xMOuniXJdcv}YB\u003cvrj5rx\u003e8g4B8LVje[n*pfk$ufyHH\u003c\u0026zF7QTfFLvpfF$I3B-RIkv\u003eJ1EwfKh", "ln": 2, "addr": 42 }, { "b": "arS^-wPRu\u003evrt{w", "ln": 3, "addr": 118 }, { "b": "arR^HjAbsVygQ)%rDq[txMOunB2\u003e%cAbPM7v{%EizE){ax\u003ezSyvq{fsjtgU]z!-\u0026[Bx9u$j]", "ln": 10, "addr": 363 }, { "b": "arR^Hjy\u00262Av@=p5BzkVhk1Gm3AaK6hazbLjaw=#)wN/d\u003ceN\u0026c#yH}30l340uwPQpTA+cw4AbYScv{%E[z/fRUfjXTnv@=p5BzkVhj]", "ln": 11, "addr": 421 }, { "b": "arR^HjAt1Lz/YSmz/QaCBA}?pjTaJMBrR\u0026IA+)(.xMOunB2\u003e%cxk8E3BZ=$kz/4d1vrly0AZ\u003epbAbPM7v{%E6ay/tbze18Pb4rL*iBVIThA9H4i59xDv(2[{hzw.%fK[PGgbyQ[g=l%#w?#kOhZfv$j]", "n": [ { "c": 2, "d": "NuGet package declares repository", "i": "metadata/package/files/nuget::nuspec-repository", "o": 507, "z": 72, "cf": 0.8999999761581421 } ], "ln": 12, "addr": 503 }, { "b": "arR^Hjy\u00262xwO#3\u0026zEWx(B3o", "n": [ { "c": 2, "d": "NuGet package declares dependencies", "i": "metadata/package/files/nuget::nuspec-dependencies", "o": 629, "z": 206, "cf": 0.8999999761581421 } ], "ln": 13, "addr": 625 }, { "b": "arR^HarS^VA=l8taAR4jxjVfOA:-/@Cw?IqjTa=PBtkE4fD@W", "ln": 14, "addr": 644 }, { "b": "arR^HarR^Hjy\u00262xwO#3\u0026zEW@mx\u003efvJp\u0026yeYv{%E6aA?spB7]MgjT8Znh.D^daz2!cy\u0026%o1jT9jnx(4rhl2HaED3T4xB0q.Wj]", "ln": 15, "addr": 684 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 1241.0, "entropy": 4.99, "size_bytes": 1241.0 }, "binary": { "overall_entropy": 4.99, "peak_region_bytes": 1024.0, "peak_region_entropy": 5.03 } } }, "id": 2, "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Polecat.AspNetCore/Polecat.AspNetCore.4.7.0.nupkg!!Polecat.AspNetCore.nuspec", "risk": 1, "sha": "a78bb0e6d251931d9a6f4c0720ab42ead482a050a0e2315131ab13b87c0663db", "size": 1241, "traits": [ { "id": "metadata/package/files/nuget::nuspec-dependencies", "conf": 0.8999999761581421, "crit": 2, "desc": "NuGet package declares dependencies", "spans": [ [ 629, 206 ] ] }, { "id": "metadata/package/files/nuget::nuspec-repository", "conf": 0.8999999761581421, "crit": 2, "desc": "NuGet package declares repository", "spans": [ [ 507, 72 ] ] }, { "id": "metadata/build/manifest::nuspec-file", "conf": 0.9800000190734863, "crit": 2, "desc": "NuGet nuspec manifest file", "spans": [ [ 0, 25 ] ] } ], "type": "xml" }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J\u0026m(", "n": [ { "c": 3, "d": "HTTP fingerprinting evasion campaign", "i": "objectives/command-and-control/infrastructure/user-agent::http-fingerprinting-campaign", "o": 0, "z": 34, "cf": 0.8999999761581421 } ], "ln": 0 }, { "b": "00000000000000000000jcxNz00000nb@R\u00260SSx7y=}:#Q/dl[0rr91000000000000", "n": [ { "c": 1, "d": "PE standard code/data section", "i": "metadata/binary/section/names::pe-code-data-standard-section", "o": 512, "z": 5, "cf": 0.8999999761581421 } ], "ln": 496 }, { "b": "huFnI000udd3:\u0026k3mV2Qlq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn", "n": [ { "c": 3, "d": "Recognized PE anti-analysis marker", "i": "objectives/anti-analysis/debugger-detect/combined-checks::evasion-aware-recognized-pe-marker", "o": 8044, "z": 4, "cf": 1.0 } ], "ln": 8028 }, { "b": "j#\u0026Q9o(BM+y?k^gju=Kvq*ACawO\u003c4\u003epxjt]xjVf(nP5G\u0026Bw(W.wO\u003e\u0026QB7GD2nP5G\u0026Bw(W.wD", "n": [ { "c": 2, "d": "System namespace reference", "i": "metadata/lang/compiler/managed::system-namespace", "o": 16835, "z": 9, "cf": 0.800000011920929 } ], "ln": 16819 }, { "b": "Bye9\u0026x()]TzE^r@By!$.xjVf(qE%\u0026\u003cwPI@VvScpewN\u003e^wz!S.ZuV*B3m%eJR06CdczdL[BuTDn", "n": [ { "c": 3, "d": "Access to ASP.NET Request object", "i": "micro-behaviors/communications/http/server/managed::http-request-get", "o": 17274, "z": 11, "cf": 1.0 } ], "ln": 17258 }, { "b": "A=U@kzA.=wuQ!:vy?9JdC4CYnx(v(Mx\u003cUjpx\u003eq9\u003e06CslA=#2mnP5cUk51whmRMBIwb[Z", "n": [ { "c": 3, "d": "Recognized sparse-logic binary marker", "i": "objectives/anti-analysis/vm-detect/instruction::sparse-logic-recognized-marker", "o": 17349, "z": 7, "cf": 0.800000011920929 } ], "ln": 17333 }, { "b": "wDlvOBydyzzdNJJvrk#WxjVf(qE%]*z/fSc07}rJzC\u003eB-qE%]*z/fSc07.iNA8Hm*AbPSnwDktz", "n": [ { "c": 3, "d": "Access to ASP.NET Response object", "i": "micro-behaviors/communications/http/server/managed::http-response-get", "o": 18461, "z": 12, "cf": 1.0 } ], "ln": 18445 }, { "b": "y?m9+Bs]\u003e2A86$^lVm0Re[w^m090SLz*a=+piyw?08)#WwNPAQB7GD2nPXJX08[e:By/p?lt{^UwNPDRlT:\u003exwO=f\u003eBzkVhrbVL-", "n": [ { "c": 3, "d": "Modification of HTTP context items", "i": "micro-behaviors/communications/http/server/managed::http-context-item-setter", "o": 19515, "z": 8, "cf": 0.8500000238418579 }, { "c": 3, "d": "References Windows executable or script", "i": "objectives/execution/interpreter/script/shell::windows-executable-ref", "o": 19491, "z": 4, "cf": 0.6000000238418579 } ], "ln": 19475 }, { "b": "A+dQRzF0P}B-H]jx(v\u003e?q*ACawO\u003c50wQ5qHn][]*e(Mt4x\u003c\u003e*(Dsp]fz/bLHx\u003e8g4B8LVje\u003e72bwO#N6", "n": [ { "c": 3, "d": "JSON polymorphism runtime marker", "i": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "o": 19681, "z": 16, "cf": 1.0 } ], "ln": 19665 }, { "b": "x(v\u003e?nL\u003cCCygQ)%x(v\u003e?q*ACawO\u003c4$wOb:\u0026v@#B6zu9pIz/ecVzF%MblVl\u003cMx([6czua-?BydBEw)]*#Bn", "n": [ { "c": 2, "d": "Benign high-entropy PE context", "i": "metadata/package/quality/false-positives::benign-high-entropy-pe-context", "o": 19765, "z": 17, "cf": 0.949999988079071 } ], "ln": 19749 }, { "b": "B7GD2l$HBHA+PGmx(v\u003e?q*ACawO\u003c50wQ5qHn][]*0b#v*By/Gg08m3DxM4AMzF0!!o\u003ewfJwPyvWw]vVZ", "n": [ { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 19915, "z": 16, "cf": 0.8500000238418579 } ], "ln": 19899 }, { "b": "wIcI}Bz}jOvq[.Sz/{10q*ACawO\u003c4[x(m[\u003cp\u0026yeYv{%EioLFx:06CdczdL[CuTD=evr8ugAb]\u003c", "n": [ { "c": 3, "d": "LINQ query operations", "i": "micro-behaviors/data/db/linq::linq-queries", "o": 20026, "z": 11, "cf": 0.699999988079071 } ], "ln": 20010 }, { "b": "z/6Dcy?mS=wPz%dv}xYYxjVf(qE%\u0026\u003cwPI@(wPz%dv}xYYl$G?Ixj\u003e{@xh9qPwPE\u0026:wPRo?vq]S", "n": [ { "c": 3, "d": "Access to ASP.NET Request object", "i": "micro-behaviors/communications/http/server/managed::http-request-get", "o": 20565, "z": 11, "cf": 1.0 } ], "ln": 20549 }, { "b": "AbPDdBvyB@wO#N6z/fQ@q*ACawO\u003c4[x(m]ymr\u0026=(wPI{bz/fQ@o\u003e!9Tz/Y\u0026eBs{1bBy/uhx(v)ge\u003c%n\u0026wO#3\u0026zEW}", "n": [ { "c": 3, "d": "LINQ expression tree manipulation", "i": "micro-behaviors/data/db/linq::linq-expressions", "o": 20941, "z": 23, "cf": 0.75 } ], "ln": 20925 }, { "b": "vrcC\u0026mRcWKxIq\u0026RwPI}[xjVf(qE%\u0026\u003cwPI}[n][]*qGcbzwPq\u003c7B94yAfG@\u0026JnmuyDy?lsJA8Hl", "n": [ { "c": 3, "d": "Access to ASP.NET Request object", "i": "micro-behaviors/communications/http/server/managed::http-request-get", "o": 21642, "z": 11, "cf": 1.0 } ], "ln": 21626 }, { "b": "Bye0UCYS}bwPRoUwQ5p%now@)lVl\u003c:wQ5p%xMOunlVl\u003c:wQ5p%v@DmbwQ5p%n)#^WwPym+090\u003e", "n": [ { "c": 3, "d": "Access to ASP.NET HttpContext", "i": "micro-behaviors/communications/http/server/managed::http-context", "o": 21769, "z": 11, "cf": 1.0 } ], "ln": 21753 }, { "b": "vr(WcvpTB4BzbYkB.twgq*ACawO\u003c50wQ5qHn][]*cVZzJwOb:\u0026v@#BdwGU]mwPzQ9vpTB4c}XM0zC\u003eB-", "n": [ { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 28811, "z": 16, "cf": 0.8500000238418579 } ], "ln": 28795 }, { "b": "wPw]nxK@qUq+{duqCY.6Aaa3dz^^f0BA}?pB0bTuviwGFn?IkLpGeDDz/fSszdN:eaAIh", "n": [ { "c": 1, "d": "Regex component marker", "i": "objectives/command-and-control/dropper/staging/encrypted::staged-payload-file-name--rx-1", "o": 29141, "z": 7, "cf": 0.8500000238418579 } ], "ln": 29125 }, { "b": "00000000000000000000000000000000000000315c8Xg7YTL^00000000000000000", "n": [ { "c": 1, "d": "PE resource section", "i": "metadata/binary/section/names::pe-resource-section", "o": 30208, "z": 5, "cf": 0.8999999761581421 } ], "ln": 30192 }, { "b": "0000000000008S[gYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006Xn[brp!0rru81onA", "n": [ { "c": 3, "d": "Recognized marker for timing checks", "i": "objectives/anti-analysis/timing/evasion::timing-anti-debug-recognized-marker", "o": 30302, "z": 15, "cf": 0.949999988079071 } ], "ln": 30286 }, { "b": "zVBUPA@Vgu002s=5Dz?ilJz38z2!IPve$fBC(QOtve$cAwDhYg002Q\u003ewDl-JwDlMEC(O@!l\u0026X?", "n": [ { "c": 2, "d": "PE CompanyName metadata field", "i": "metadata/package/versioning::pe-companyname-field", "o": 30650, "z": 11, "cf": 0.699999988079071 } ], "ln": 30634 }, { "b": "yYF2DASu7t002:]6954kmGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up002*}zVBONwDliuve$x", "n": [ { "c": 2, "d": "PE FileDescription metadata field", "i": "metadata/package/versioning::pe-filedescription-field", "o": 30718, "z": 15, "cf": 0.699999988079071 } ], "ln": 30702 }, { "b": "zVB!TwDhYg001XM2MK(9mGvc5yYF2DrSDXhASydXx-J5Kzu6Up001?Qe=W*ge=WN9e=WN9002:]7xsEonDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE002*}zVBONwDliuve$xHe=Xfq", "n": [ { "c": 3, "d": "Dotted-quad PE version metadata marker", "i": "objectives/command-and-control/infrastructure/ip::ipv4-version-metadata-marker", "o": 30798, "z": 11, "cf": 0.9399999976158142 }, { "c": 2, "d": "PE InternalName metadata field", "i": "metadata/package/versioning::pe-internalname-field", "o": 30846, "z": 12, "cf": 0.699999988079071 } ], "ln": 30782 }, { "b": "xAibO001bw003417xsEopxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE002*}zVBONwDliuve$xH", "n": [ { "c": 2, "d": "PE OriginalFilename metadata field", "i": "metadata/package/versioning::pe-originalfilename-field", "o": 30966, "z": 16, "cf": 0.699999988079071 } ], "ln": 30950 }, { "b": "wb{ACyYBCn002E*6954kpYLIozVBqFBPt[KBo25ove$cAwDhYg002*}zVBONwDliuve$xHe=Xf", "n": [ { "c": 2, "d": "PE ProductName metadata field", "i": "metadata/package/versioning::pe-productname-field", "o": 31054, "z": 11, "cf": 0.699999988079071 } ], "ln": 31038 }, { "b": "zVB!TwDhYg004PJf8#1MpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001?Qe=W*ge=WN9d/:2Uirf", "n": [ { "c": 2, "d": "PE version resource metadata", "i": "metadata/package/versioning::version-resource-metadata", "o": 31126, "z": 14, "cf": 0.8999999761581421 } ], "ln": 31110 }, { "b": "000000000000000000000fvfX3\u0026*nctRVoV000000000000000000000000000000000", "n": [ { "c": 2, "d": "PE .reloc section presence", "i": "metadata/binary/section/names::reloc-section-presence", "o": 31744, "z": 6, "cf": 0.8999999761581421 } ], "ln": 31728 } ], "depth": 1, "facts": { "imp": [ [ "mscoree", "CorDllMain" ] ], "sec": [ [ ".text", 512, 29696, 5.83, "r-x" ], [ ".rsrc", 30208, 1536, 2.53, "r--" ], [ ".reloc", 31744, 512, 0.08, "r--" ] ], "metrics": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "resource_count": 1.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 58072.0, "reloc_overhang_bytes": 500.0, "reloc_overhang_ratio": 0.98, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "version.identity_entropy": 4.1, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0, "version.identity_symbol_ratio": 0.06 }, "file": { "size": 32256.0, "entropy": 5.62, "size_bytes": 32256.0 }, "binary": { "is_pie": 1.0, "code_entropy": 5.83, "string_count": 422.0, "overall_entropy": 5.62, "entropy_variance": 5.55, "avg_string_length": 22.45, "max_string_length": 368.0, "peak_region_bytes": 2048.0, "code_to_data_ratio": 1.0, "peak_region_entropy": 6.05, "string_length_stddev": 35.06, "largest_section_ratio": 0.92, "sentence_string_count": 21.0, "sentence_string_ratio": 0.05, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 29696.0, "entropy_max": 5.83, "entropy_mean": 2.82, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } } }, "id": 3, "mol": "O(Al)H₂(CmDb)", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Polecat.AspNetCore/Polecat.AspNetCore.4.7.0.nupkg!!lib/net10.0/Polecat.AspNetCore.dll", "risk": 4, "sha": "51078ecae4abecd967900d75d4905c0cb0eea2d69744d40b6fb96956840e41c5", "size": 32256, "traits": [ { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "spans": [ [ 30798, 11 ] ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 30302, 15 ] ] }, { "id": "micro-behaviors/data/db/linq::system-linq-expressions", "conf": 0.6000000238418579, "crit": 3, "desc": "System.Linq.Expressions namespace", "spans": [ [ 20941, 23 ] ] }, { "id": "micro-behaviors/communications/http/server/managed::http-context", "conf": 1.0, "crit": 3, "desc": "Access to ASP.NET HttpContext", "spans": [ [ 21769, 11 ] ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "spans": [ [ 19491, 4 ] ] }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "spans": [ [ 0, 26 ] ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "spans": [ [ 8044, 4 ] ] }, { "id": "metadata/package/versioning::version-word-lower", "conf": 0.4000000059604645, "crit": 2, "desc": "version word (lowercase)", "spans": [ [ 17349, 7 ] ] }, { "id": "micro-behaviors/communications/http/server/managed::http-request-get", "conf": 1.0, "crit": 3, "desc": "Access to ASP.NET Request object", "spans": [ [ 17274, 11 ], [ 20565, 11 ], [ 21642, 11 ] ] }, { "id": "micro-behaviors/communications/http/server/managed::http-item-setter", "conf": 1.0, "crit": 1, "desc": "Modification of HTTP context items", "spans": [ [ 19515, 8 ] ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "spans": [ [ 31126, 14 ] ] }, { "id": "micro-behaviors/communications/http/server/managed::http-response-get", "conf": 1.0, "crit": 3, "desc": "Access to ASP.NET Response object", "spans": [ [ 18461, 12 ] ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "micro-behaviors/data/db/linq::linq-queries", "conf": 0.699999988079071, "crit": 3, "desc": "LINQ query operations", "spans": [ [ 20026, 11 ], [ 20941, 11 ] ] }, { "id": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "conf": 1.0, "crit": 3, "desc": "JSON polymorphism runtime marker", "spans": [ [ 19681, 16 ] ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "spans": [ [ 8044, 4 ] ] }, { "id": "micro-behaviors/communications/http/server/managed::http-context-item-setter", "conf": 0.8500000238418579, "crit": 3, "desc": "Modification of HTTP context items", "spans": [ [ 19515, 8 ], [ 21769, 11 ] ] } ], "type": "pe" }, { "depth": 1, "facts": { "metrics": { "file": { "size": 7820.0, "entropy": 4.58, "size_bytes": 7820.0 }, "binary": { "overall_entropy": 4.58, "peak_region_bytes": 7820.0, "peak_region_entropy": 4.66 } } }, "id": 4, "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Polecat.AspNetCore/Polecat.AspNetCore.4.7.0.nupkg!!lib/net10.0/Polecat.AspNetCore.xml", "sha": "d965a314de59c94015f8d730b4db255d4b54143ad5d84ce11fc1b2335f740ff7", "size": 7820, "traits": [ { "id": "metadata/file/extension/identity::doc-or-config-extension", "conf": 1.0, "crit": 1, "desc": "Document or config file extension", "spans": [ [ 0, 22 ] ] } ], "type": "xml" }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J\u0026m(", "n": [ { "c": 3, "d": "HTTP fingerprinting evasion campaign", "i": "objectives/command-and-control/infrastructure/user-agent::http-fingerprinting-campaign", "o": 0, "z": 34, "cf": 0.8999999761581421 } ], "ln": 0 }, { "b": "000000000000000000007lOT$00000nb@R\u00260SSx7y=}:#FkVBF0rr91000000000000", "n": [ { "c": 1, "d": "PE standard code/data section", "i": "metadata/binary/section/names::pe-code-data-standard-section", "o": 512, "z": 5, "cf": 0.8999999761581421 } ], "ln": 496 }, { "b": "huFnI000udd3:\u0026k3mV2Qlq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn", "n": [ { "c": 3, "d": "Recognized PE anti-analysis marker", "i": "objectives/anti-analysis/debugger-detect/combined-checks::evasion-aware-recognized-pe-marker", "o": 8044, "z": 4, "cf": 1.0 } ], "ln": 8028 }, { "b": "j#\u0026Q9o(BM+y?k^gju=Kvq*ACawO\u003c4\u003epxjt]xjVf(nP5G\u0026Bw(W.wO\u003e\u0026QB7GD2nP5G\u0026Bw(W.wD", "n": [ { "c": 2, "d": "System namespace reference", "i": "metadata/lang/compiler/managed::system-namespace", "o": 16827, "z": 9, "cf": 0.800000011920929 } ], "ln": 16811 }, { "b": "Bye9\u0026x()]TzE^r@By!$.xjVf(qE%\u0026\u003cwPI@VvScpewN\u003e^wz!S.ZuV*B3m%eJR06CdczdL[BuTDn", "n": [ { "c": 3, "d": "Access to ASP.NET Request object", "i": "micro-behaviors/communications/http/server/managed::http-request-get", "o": 17266, "z": 11, "cf": 1.0 } ], "ln": 17250 }, { "b": "A=U@kzA.=wuQ!:vy?9JdC4CYnx(v(Mx\u003cUjpx\u003eq9\u003e06CslA=#2mnP5cUk51whmRMBIwb[Z", "n": [ { "c": 3, "d": "Recognized sparse-logic binary marker", "i": "objectives/anti-analysis/vm-detect/instruction::sparse-logic-recognized-marker", "o": 17341, "z": 7, "cf": 0.800000011920929 } ], "ln": 17325 }, { "b": "wDlvOBydyzzdNJJvrk#WxjVf(qE%]*z/fSc07}rJzC\u003eB-qE%]*z/fSc07.iNA8Hm*AbPSnwDktz", "n": [ { "c": 3, "d": "Access to ASP.NET Response object", "i": "micro-behaviors/communications/http/server/managed::http-response-get", "o": 18453, "z": 12, "cf": 1.0 } ], "ln": 18437 }, { "b": "y?m9+Bs]\u003e2A86$^lVm0Re[w^m090SLz*a=+piyw?08)#WwNPAQB7GD2nPXJX08[e:By/p?lt{^UwNPDRlT:\u003exwO=f\u003eBzkVhrbVL-", "n": [ { "c": 3, "d": "Modification of HTTP context items", "i": "micro-behaviors/communications/http/server/managed::http-context-item-setter", "o": 19507, "z": 8, "cf": 0.8500000238418579 }, { "c": 3, "d": "References Windows executable or script", "i": "objectives/execution/interpreter/script/shell::windows-executable-ref", "o": 19483, "z": 4, "cf": 0.6000000238418579 } ], "ln": 19467 }, { "b": "A+dQRzF0P}B-H]jx(v\u003e?q*ACawO\u003c50wQ5qHn][]*e(Mt4x\u003c\u003e*(Dsp]fz/bLHx\u003e8g4B8LVje\u003e72bwO#N6", "n": [ { "c": 3, "d": "JSON polymorphism runtime marker", "i": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "o": 19673, "z": 16, "cf": 1.0 } ], "ln": 19657 }, { "b": "x(v\u003e?nL\u003cCCygQ)%x(v\u003e?q*ACawO\u003c4$wOb:\u0026v@#B6zu9pIz/ecVzF%MblVl\u003cMx([6czua-?BydBEw)]*#Bn", "n": [ { "c": 2, "d": "Benign high-entropy PE context", "i": "metadata/package/quality/false-positives::benign-high-entropy-pe-context", "o": 19757, "z": 17, "cf": 0.949999988079071 } ], "ln": 19741 }, { "b": "B7GD2l$HBHA+PGmx(v\u003e?q*ACawO\u003c50wQ5qHn][]*0b#v*By/Gg08m3DxM4AMzF0!!o\u003ewfJwPyvWw]vVZ", "n": [ { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 19907, "z": 16, "cf": 0.8500000238418579 } ], "ln": 19891 }, { "b": "wIcI}Bz}jOvq[.Sz/{10q*ACawO\u003c4[x(m[\u003cp\u0026yeYv{%EioLFx:06CdczdL[CuTD=evr8ugAb]\u003c", "n": [ { "c": 3, "d": "LINQ query operations", "i": "micro-behaviors/data/db/linq::linq-queries", "o": 20018, "z": 11, "cf": 0.699999988079071 } ], "ln": 20002 }, { "b": "z/6Dcy?mS=wPz%dv}xYYxjVf(qE%\u0026\u003cwPI@(wPz%dv}xYYl$G?Ixj\u003e{@xh9qPwPE\u0026:wPRo?vq]S", "n": [ { "c": 3, "d": "Access to ASP.NET Request object", "i": "micro-behaviors/communications/http/server/managed::http-request-get", "o": 20557, "z": 11, "cf": 1.0 } ], "ln": 20541 }, { "b": "AbPDdBvyB@wO#N6z/fQ@q*ACawO\u003c4[x(m]ymr\u0026=(wPI{bz/fQ@o\u003e!9Tz/Y\u0026eBs{1bBy/uhx(v)ge\u003c%n\u0026wO#3\u0026zEW}", "n": [ { "c": 3, "d": "LINQ expression tree manipulation", "i": "micro-behaviors/data/db/linq::linq-expressions", "o": 20933, "z": 23, "cf": 0.75 } ], "ln": 20917 }, { "b": "vrcC\u0026mRcWKxIq\u0026RwPI}[xjVf(qE%\u0026\u003cwPI}[n][]*qGcbzwPq\u003c7B94yAfG@\u0026JnmuyDy?lsJA8Hl", "n": [ { "c": 3, "d": "Access to ASP.NET Request object", "i": "micro-behaviors/communications/http/server/managed::http-request-get", "o": 21634, "z": 11, "cf": 1.0 } ], "ln": 21618 }, { "b": "Bye0UCYS}bwPRoUwQ5p%now@)lVl\u003c:wQ5p%xMOunlVl\u003c:wQ5p%v@DmbwQ5p%n)#^WwPym+090\u003e", "n": [ { "c": 3, "d": "Access to ASP.NET HttpContext", "i": "micro-behaviors/communications/http/server/managed::http-context", "o": 21761, "z": 11, "cf": 1.0 } ], "ln": 21745 }, { "b": "vr(WcvpTB4BzbYkB.twgq*ACawO\u003c50wQ5qHn][]*cVZzJwOb:\u0026v@#BdwGU]mwPzQ9vpTB4c}XM0zC\u003eB-", "n": [ { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 28775, "z": 16, "cf": 0.8500000238418579 } ], "ln": 28759 }, { "b": "wPw]nxK@qUq+{duqCY.6Aaa3dz^^f0BA}?pB0bTuviwGFn?IkLpGeDDz/fSszdN:eaAIh", "n": [ { "c": 1, "d": "Regex component marker", "i": "objectives/command-and-control/dropper/staging/encrypted::staged-payload-file-name--rx-1", "o": 29105, "z": 7, "cf": 0.8500000238418579 } ], "ln": 29089 }, { "b": "00000000000000000000000000000000000000315c8Xg7YTL^00000000000000000", "n": [ { "c": 1, "d": "PE resource section", "i": "metadata/binary/section/names::pe-resource-section", "o": 30208, "z": 5, "cf": 0.8999999761581421 } ], "ln": 30192 }, { "b": "0000000000008S[gYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006Xn[brp!0rru81onA", "n": [ { "c": 3, "d": "Recognized marker for timing checks", "i": "objectives/anti-analysis/timing/evasion::timing-anti-debug-recognized-marker", "o": 30302, "z": 15, "cf": 0.949999988079071 } ], "ln": 30286 }, { "b": "zVBUPA@Vgu002s=5Dz?ilJz38z2!IPve$fBC(QOtve$cAwDhYg002Q\u003ewDl-JwDlMEC(O@!l\u0026X?", "n": [ { "c": 2, "d": "PE CompanyName metadata field", "i": "metadata/package/versioning::pe-companyname-field", "o": 30650, "z": 11, "cf": 0.699999988079071 } ], "ln": 30634 }, { "b": "yYF2DASu7t002:]6954kmGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up002*}zVBONwDliuve$x", "n": [ { "c": 2, "d": "PE FileDescription metadata field", "i": "metadata/package/versioning::pe-filedescription-field", "o": 30718, "z": 15, "cf": 0.699999988079071 } ], "ln": 30702 }, { "b": "zVB!TwDhYg001XM2MK(9mGvc5yYF2DrSDXhASydXx-J5Kzu6Up001?Qe=W*ge=WN9e=WN9002:]7xsEonDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE002*}zVBONwDliuve$xHe=Xfq", "n": [ { "c": 3, "d": "Dotted-quad PE version metadata marker", "i": "objectives/command-and-control/infrastructure/ip::ipv4-version-metadata-marker", "o": 30798, "z": 11, "cf": 0.9399999976158142 }, { "c": 2, "d": "PE InternalName metadata field", "i": "metadata/package/versioning::pe-internalname-field", "o": 30846, "z": 12, "cf": 0.699999988079071 } ], "ln": 30782 }, { "b": "xAibO001bw003417xsEopxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE002*}zVBONwDliuve$xH", "n": [ { "c": 2, "d": "PE OriginalFilename metadata field", "i": "metadata/package/versioning::pe-originalfilename-field", "o": 30966, "z": 16, "cf": 0.699999988079071 } ], "ln": 30950 }, { "b": "wb{ACyYBCn002E*6954kpYLIozVBqFBPt[KBo25ove$cAwDhYg002*}zVBONwDliuve$xHe=Xf", "n": [ { "c": 2, "d": "PE ProductName metadata field", "i": "metadata/package/versioning::pe-productname-field", "o": 31054, "z": 11, "cf": 0.699999988079071 } ], "ln": 31038 }, { "b": "zVB!TwDhYg004PJf8#1MpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001?Qe=W*ge=WN9d/:2Uirf", "n": [ { "c": 2, "d": "PE version resource metadata", "i": "metadata/package/versioning::version-resource-metadata", "o": 31126, "z": 14, "cf": 0.8999999761581421 } ], "ln": 31110 }, { "b": "000000000000000000000fvfX3\u0026*nci5gEl000000000000000000000000000000000", "n": [ { "c": 2, "d": "PE .reloc section presence", "i": "metadata/binary/section/names::reloc-section-presence", "o": 31744, "z": 6, "cf": 0.8999999761581421 } ], "ln": 31728 } ], "depth": 1, "facts": { "imp": [ [ "mscoree", "CorDllMain" ] ], "sec": [ [ ".text", 512, 29696, 5.83, "r-x" ], [ ".rsrc", 30208, 1536, 2.53, "r--" ], [ ".reloc", 31744, 512, 0.08, "r--" ] ], "metrics": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "resource_count": 1.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 82131.0, "reloc_overhang_bytes": 500.0, "reloc_overhang_ratio": 0.98, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "version.identity_entropy": 4.1, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0, "version.identity_symbol_ratio": 0.06 }, "file": { "size": 32256.0, "entropy": 5.62, "size_bytes": 32256.0 }, "binary": { "is_pie": 1.0, "code_entropy": 5.83, "string_count": 422.0, "overall_entropy": 5.62, "entropy_variance": 5.54, "avg_string_length": 22.4, "max_string_length": 368.0, "peak_region_bytes": 2048.0, "code_to_data_ratio": 1.0, "peak_region_entropy": 6.05, "string_length_stddev": 35.06, "largest_section_ratio": 0.92, "sentence_string_count": 21.0, "sentence_string_ratio": 0.05, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 29696.0, "entropy_max": 5.83, "entropy_mean": 2.81, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } } }, "id": 5, "mol": "O(Al)H₂(CmDb)", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Polecat.AspNetCore/Polecat.AspNetCore.4.7.0.nupkg!!lib/net9.0/Polecat.AspNetCore.dll", "risk": 4, "sha": "7969e211790d04211c90fc2e0d6ad88fdf6c6b4a382d1fbd1d0a51bd5dd352d9", "size": 32256, "traits": [ { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "spans": [ [ 30798, 11 ] ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 30302, 15 ] ] }, { "id": "micro-behaviors/data/db/linq::system-linq-expressions", "conf": 0.6000000238418579, "crit": 3, "desc": "System.Linq.Expressions namespace", "spans": [ [ 20933, 23 ] ] }, { "id": "micro-behaviors/communications/http/server/managed::http-context", "conf": 1.0, "crit": 3, "desc": "Access to ASP.NET HttpContext", "spans": [ [ 21761, 11 ] ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "spans": [ [ 19483, 4 ] ] }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "spans": [ [ 0, 26 ] ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "spans": [ [ 8044, 4 ] ] }, { "id": "metadata/package/versioning::version-word-lower", "conf": 0.4000000059604645, "crit": 2, "desc": "version word (lowercase)", "spans": [ [ 17341, 7 ] ] }, { "id": "micro-behaviors/communications/http/server/managed::http-request-get", "conf": 1.0, "crit": 3, "desc": "Access to ASP.NET Request object", "spans": [ [ 17266, 11 ], [ 20557, 11 ], [ 21634, 11 ] ] }, { "id": "micro-behaviors/communications/http/server/managed::http-item-setter", "conf": 1.0, "crit": 1, "desc": "Modification of HTTP context items", "spans": [ [ 19507, 8 ] ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "spans": [ [ 31126, 14 ] ] }, { "id": "micro-behaviors/communications/http/server/managed::http-response-get", "conf": 1.0, "crit": 3, "desc": "Access to ASP.NET Response object", "spans": [ [ 18453, 12 ] ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "micro-behaviors/data/db/linq::linq-queries", "conf": 0.699999988079071, "crit": 3, "desc": "LINQ query operations", "spans": [ [ 20018, 11 ], [ 20933, 11 ] ] }, { "id": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "conf": 1.0, "crit": 3, "desc": "JSON polymorphism runtime marker", "spans": [ [ 19673, 16 ] ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "spans": [ [ 8044, 4 ] ] }, { "id": "micro-behaviors/communications/http/server/managed::http-context-item-setter", "conf": 0.8500000238418579, "crit": 3, "desc": "Modification of HTTP context items", "spans": [ [ 19507, 8 ], [ 21761, 11 ] ] } ], "type": "pe" }, { "depth": 1, "facts": { "metrics": { "file": { "size": 7820.0, "entropy": 4.58, "size_bytes": 7820.0 }, "binary": { "overall_entropy": 4.58, "peak_region_bytes": 7820.0, "peak_region_entropy": 4.66 } } }, "id": 6, "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Polecat.AspNetCore/Polecat.AspNetCore.4.7.0.nupkg!!lib/net9.0/Polecat.AspNetCore.xml", "sha": "d965a314de59c94015f8d730b4db255d4b54143ad5d84ce11fc1b2335f740ff7", "size": 7820, "traits": [ { "id": "metadata/file/extension/identity::doc-or-config-extension", "conf": 1.0, "crit": 1, "desc": "Document or config file extension", "spans": [ [ 0, 22 ] ] } ], "type": "xml" }, { "id": 7, "sha": "154e3a7bd85ca512d3373f714f4923be7eda96573a7489a92fbc6f97c7208314", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Polecat.AspNetCore/Polecat.AspNetCore.4.7.0.nupkg!!logo.png", "size": 51479, "type": "png", "depth": 1 }, { "id": 8, "sha": "bb4482711390851f61cd40db6dac8bbce14f88cdf251665a10c1bb38753e8af7", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Polecat.AspNetCore/Polecat.AspNetCore.4.7.0.nupkg!![Content_Types].xml", "size": 583, "type": "xml", "depth": 1 }, { "id": 9, "sha": "45a47587a3237c0a194ffbfd1387d58f8ed7c8145a4a7b0a20bf6c7b098ea204", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Polecat.AspNetCore/Polecat.AspNetCore.4.7.0.nupkg!!package/services/metadata/core-properties/0124342edb0745d6b1dde8f350e25f8d.psmdcp", "size": 653, "type": "xml", "depth": 1 }, { "id": 10, "sha": "caf8c3b1a91d6d57d138aa95c251cb7acdfa659b33274abd8632c49d484f00d6", "path": "Polecat.AspNetCore@4.7.0.registry.json", "size": 818, "type": "registry", "depth": 1 } ], "omitted_files": 4, "rev": "46112", "v": "8" } }