{ "ml": { "v": "7", "eng": "2.2.0-beta.2", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.7480017, "rte": "az", "prob": 0.7480017 }, { "cls": 0, "raw": 0.31715485, "rte": "az/nupkg", "prob": 0.31715485 } ], "prob": 0.7544368, "skip": [ { "rte": "az/zip", "why": "unavailable" }, { "rte": "az/zip", "why": "unavailable" } ], "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.7544367909431458, "type": "nupkg" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.00012001395225524902, "type": "xml" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.008743494749069214, "type": "xml" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.008093297481536865, "type": "markdown" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.7544367909431458, "type": "png" }, { "id": 5, "lvl": -1, "conf": 0, "prob": 0.7544367909431458, "type": "pe" }, { "id": 6, "lvl": -1, "conf": 0, "prob": 0.7544367909431458, "type": "xml" }, { "id": 7, "lvl": -1, "conf": 0, "prob": 0.6463420987129211, "type": "pe" }, { "id": 8, "lvl": -1, "conf": 0, "prob": 0.7544367909431458, "type": "xml" }, { "id": 9, "lvl": -1, "conf": 0, "prob": 0.6463420987129211, "type": "pe" }, { "id": 10, "lvl": -1, "conf": 0, "prob": 0.7544367909431458, "type": "xml" }, { "id": 11, "lvl": -1, "conf": 0, "prob": 0.6463420987129211, "type": "pe" }, { "id": 12, "lvl": -1, "conf": 0, "prob": 0.7544367909431458, "type": "xml" }, { "id": 13, "lvl": -1, "conf": 0, "prob": 0.7544367909431458, "type": "pe" }, { "id": 14, "lvl": -1, "conf": 0, "prob": 0.7544367909431458, "type": "xml" }, { "id": 15, "lvl": -1, "conf": 0, "prob": 0.7544367909431458, "type": "pe" }, { "id": 16, "lvl": -1, "conf": 0, "prob": 0.7544367909431458, "type": "xml" }, { "id": 17, "lvl": -1, "conf": 0, "prob": 0.000767439603805542, "type": "text" }, { "id": 18, "lvl": -1, "conf": 0, "prob": 0.7544367909431458, "type": "xml" }, { "id": 19, "lvl": -1, "conf": 0, "prob": 0.7544367909431458, "type": "xml" }, { "id": 20, "lvl": -1, "conf": 0, "prob": 0.7544367909431458, "type": "registry" } ], "version": "v18.18", "analyzed_at": "2026-06-29T03:49:56Z" }, "path": "Shiny.Notifications.5.1.0.nupkg", "raw": { "files": [ { "id": 0, "mol": "O(Al)H₂(CmDb)", "sha": "2e6b7847d044acb6e96472cfb9e05f2f1cff71ff9cf2ac81c7f4631ab33e3178", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Shiny.Notifications/Shiny.Notifications.5.1.0.nupkg", "risk": 4, "size": 378716, "type": "nupkg", "facts": { "metrics": { "file": { "size": 378716.0, "entropy": 8.0, "size_bytes": 378716.0 }, "binary": { "overall_entropy": 8.0, "peak_region_bytes": 370688.0, "peak_region_entropy": 7.84 }, "archive": { "file_count": 20.0, "member_count": 20.0, "script_count": 0.0, "zip_bomb_ratio": 8.64, "directory_count": 0.0, "executable_count": 6.0, "extra_field_size": 0.0, "noise_file_count": 0.0, "total_compressed": 375722.0, "compression.ratio": 0.31, "hidden_file_count": 2.0, "total_uncompressed": 1220137.0, "crc_collision_count": 1.0, "entry_comment_count": 0.0, "max_filename_length": 81.0, "rtlo_filename_count": 0.0, "format.regular_count": 20.0, "nested_archive_count": 0.0, "path_traversal_count": 0.0, "symlink_escape_count": 0.0, "security.setgid_count": 0.0, "security.setuid_count": 0.0, "security.sticky_count": 0.0, "double_extension_count": 0.0, "duplicate_member_count": 0.0, "security.symlink_count": 0.0, "unicode_filename_count": 0.0, "homoglyph_filename_count": 0.0, "security.encrypted_count": 0.0, "timing.mtime_unique_count": 8.0, "timing.mtime_unique_ratio": 0.4, "misplaced_executable_count": 6.0, "timing.mtime_dominant_count": 4.0, "timing.mtime_spread_seconds": 25156.0, "timing.sentinel_mtime_count": 0.0, "security.world_writable_count": 0.0, "timing.mtime_dominant_fraction": 0.2, "compression.method_counts.stored": 1.0, "compression.method_counts.deflate": 19.0 } } }, "ident": { "name": { "value": "Shiny.Notifications", "source": "nupkg.title", "verified": false }, "urls": [ { "url": "https://shinylib.net/", "kind": "homepage", "source": "nupkg.project_url" }, { "url": "https://github.com/shinyorg/shiny", "kind": "repository", "source": "nupkg.repository_url" } ], "trust": "unsigned", "authors": [ { "name": "Allan Ritchie", "role": "author", "source": "nupkg.authors" } ], "version": { "value": "5.1.0", "source": "nupkg.version", "verified": false }, "identifier": { "value": "Shiny.Notifications", "source": "nupkg.id", "verified": false } }, "traits": [ { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/communications/http/server/managed::http-request-get", "conf": 1.0, "crit": 3, "desc": "Access to ASP.NET Request object", "from": [ { "file": 7 } ] }, { "id": "micro-behaviors/data/db/linq::linq-queries", "conf": 0.699999988079071, "crit": 3, "desc": "LINQ query operations", "from": [ { "file": 5 } ] }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "from": [ { "file": 5 } ], "spans": [ [ 0, 26 ] ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "from": [ { "file": 5 } ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "from": [ { "file": 5 } ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "from": [ { "file": 5 }, { "file": 7 }, { "file": 9 }, { "file": 11 }, { "file": 13 }, { "file": 15 } ] }, { "id": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "conf": 1.0, "crit": 3, "desc": "JSON polymorphism runtime marker", "from": [ { "file": 5 } ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "from": [ { "file": 5 } ] } ] }, { "id": 1, "sha": "591b4b8a71bbfe306d1d1381901d71bd65691c29a16e69bce2f38de6dcdebdd8", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Shiny.Notifications/Shiny.Notifications.5.1.0.nupkg!!_rels/.rels", "size": 513, "type": "xml", "depth": 1 }, { "id": 2, "sha": "fd91fd6c497903c800d16534c7bd8cb81e74cf9d9abcc1a64875bfa5102d210d", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Shiny.Notifications/Shiny.Notifications.5.1.0.nupkg!!Shiny.Notifications.nuspec", "risk": 1, "size": 7256, "type": "xml", "depth": 1 }, { "id": 3, "sha": "ac919b5cceacd3c50d02943cc38b8719c4329a45747c70ee740934062930c0ab", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Shiny.Notifications/Shiny.Notifications.5.1.0.nupkg!!readme.md", "risk": 1, "size": 3173, "type": "markdown", "depth": 1 }, { "id": 4, "sha": "075d6875a700e4baa76a7ea1a7800f29723a6be9c157184c4bee107618597f4e", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Shiny.Notifications/Shiny.Notifications.5.1.0.nupkg!!icon.png", "size": 5687, "type": "png", "depth": 1 }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J\u0026m(", "n": [ { "c": 3, "d": "HTTP fingerprinting evasion campaign", "i": "objectives/command-and-control/infrastructure/user-agent::http-fingerprinting-campaign", "o": 0, "z": 34, "cf": 0.8999999761581421 } ], "ln": 0 }, { "b": "00000000000000000000AV$L+00000nb@R\u00260SSx7)a?TwA6\u003cTa0rr91000000000000", "n": [ { "c": 1, "d": "PE standard code/data section", "i": "metadata/binary/section/names::pe-code-data-standard-section", "o": 512, "z": 5, "cf": 0.8999999761581421 } ], "ln": 496 }, { "b": "huFmH0SSu9d60BI3mV2Qlq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn", "n": [ { "c": 3, "d": "Recognized PE anti-analysis marker", "i": "objectives/anti-analysis/debugger-detect/combined-checks::evasion-aware-recognized-pe-marker", "o": 49132, "z": 4, "cf": 1.0 } ], "ln": 49116 }, { "b": "e\u003c\u003cL{By/uie(kmxju=Kvq*ACawO\u003c4\u003epxiH@A=kD0B8#nuk2qkBzE^^ax\u003ee?(qVH#Hy\u0026%q@uJ", "n": [ { "c": 2, "d": "System namespace reference", "i": "metadata/lang/compiler/managed::system-namespace", "o": 94736, "z": 9, "cf": 0.800000011920929 } ], "ln": 94720 }, { "b": "nPNsBBy/uhx(v(Svrt]Tq*ACawO\u003c50wQ5qHn][]*e(Mt4x\u003c\u003e*(Dsp]fz/dg4wPRu\u003evrt]Tq*ACawO\u003c50", "n": [ { "c": 3, "d": "JSON polymorphism runtime marker", "i": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "o": 94857, "z": 16, "cf": 1.0 } ], "ln": 94841 }, { "b": "yHpBnvpK7!zF8BMwO+(Sjv9F0x(v)gk5jIjlsBwtx(mMMx\u003eq9\u003e06A+.zE)\u0026%By!#YwPzG[y?XibA.*T@x(v)gk5jIj", "n": [ { "c": 1, "d": "Regex component marker", "i": "objectives/persistence/login/scheduled-task/com::task-action-principal-properties--rx-4", "o": 96425, "z": 24, "cf": 0.8799999952316284 } ], "ln": 96409 }, { "b": "zE--CwPQm:Aa9*el#DJnq!o\u0026S06$NywO#2Ul3lZLz=H\u003c!xjT.IzE--nvru6Wx(dAO", "n": [ { "c": 1, "d": ".NET Socket Send/Receive methods (Send)", "i": "micro-behaviors/communications/socket/create::socket-receive-send-str--send", "o": 96828, "z": 4, "cf": 0.800000011920929 } ], "ln": 96812 }, { "b": "zH0\u003cfz//Y9x\u003e7N[x(v)ge[w^m07pydz!9ATBAg@3z2^4ty?lK!A+eV@0b2\u003e+uRbuJ", "n": [ { "c": 3, "d": "References Windows executable or script", "i": "objectives/execution/interpreter/script/shell::windows-executable-ref", "o": 102085, "z": 4, "cf": 0.6000000238418579 } ], "ln": 102069 }, { "b": "y\u003cwx^zF0P}B-H]jx(v\u003e?q*ACawO\u003c50wQ5qHn][]*e(Mt4x\u003c\u003e*(Dsp]fz/bLNxLzvfe\u003e72bwO#N6z/fRG", "n": [ { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 102942, "z": 16, "cf": 0.8500000238418579 } ], "ln": 102926 }, { "b": "zE^r@v%HT-ygQ)%x(v\u003e?q*ACawO\u003c4$wOb:\u0026v@#B6zu9mbwPz%dv}w2Cy\u00260V)BzkVh0cqZ[uRa)Fz/PzRzV", "n": [ { "c": 2, "d": "Benign high-entropy PE context", "i": "metadata/package/quality/false-positives::benign-high-entropy-pe-context", "o": 103277, "z": 17, "cf": 0.949999988079071 } ], "ln": 103261 }, { "b": "B7GD2l$HBHA+PGmx(v\u003e?q*ACawO\u003c50wQ5qHn][]*06$daq!ZbZy?mZbzu94AwNPW(uSp-RwM\u003c1\u0026wL3=K", "n": [ { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 103552, "z": 16, "cf": 0.8500000238418579 } ], "ln": 103536 }, { "b": "D2Ns^zF0!!xkzG}vqE$=q*ACawO\u003c50wQ5qHn][]*e(Mt4x\u003c\u003e*(Dsp]fz/dg4wPRu\u003evrt{gnLj5xzD7[2", "n": [ { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 103653, "z": 16, "cf": 0.8500000238418579 } ], "ln": 103637 }, { "b": "AaJ]MAbU!QwPQB.z/{10q*ACawO\u003c4[x(m[\u003clU{sxASxfYx()]YB.$P0ASwyywo8Q5wg*Y0z*2*", "n": [ { "c": 3, "d": "LINQ query operations", "i": "micro-behaviors/data/db/linq::linq-queries", "o": 103984, "z": 11, "cf": 0.699999988079071 } ], "ln": 103968 }, { "b": "wPzG[y?XibnmuyDy?mR!q*ACawO\u003c4!z!9AEz/49]z/6Dcy?mR!lVl\u003cOx\u003eINewN[+GB8a6=vqf*{ASwQvBu$aVx()[", "n": [ { "c": 3, "d": ".NET dynamic code generation capability", "i": "metadata/lang/compiler/managed::dotnet-dynamic-code", "o": 105251, "z": 23, "cf": 0.8500000238418579 } ], "ln": 105235 }, { "b": "CYV?{xk8BeA::67z/fQ@p\u0026ZF[pgn0JuQngzx(v)g0b2\u003e+uQngzx(v)g0cqZ[uQngzx(v)g08mfqA=l2qw]]T]CYWImB7]MgB1Qd8xj\u003e{@xd=FV", "n": [ { "c": 1, "d": "Regex component marker", "i": "objectives/persistence/login/scheduled-task/com::task-action-principal-properties--rx-4", "o": 107538, "z": 16, "cf": 0.8799999952316284 } ], "ln": 107522 }, { "b": "ASx!Nz#:$Wx-J5Kzu6UEk(+x{Bo31PzVBUPA@VgPnDrPcz#:!RASygYve$fBv/Q6u01hZ", "n": [ { "c": 1, "d": "Regex component marker", "i": "objectives/persistence/login/scheduled-task/com::task-action-principal-properties--rx-4", "o": 112525, "z": 7, "cf": 0.8799999952316284 } ], "ln": 112509 }, { "b": "wO\u003c4!z!%l3v@#B6zGvuKr+lq)x(v(Lf!+jle?![iefEr5y\u0026\u003c/uwJ:{xB-.Ujy+cY9BZ/f3v[QxUrbVL-", "n": [ { "c": 2, "d": "IPv4-like .NET assembly version", "i": "metadata/lang/compiler/managed::dotnet-ipv4-like-version", "o": 130884, "z": 16, "cf": 0.8500000238418579 } ], "ln": 130868 }, { "b": "wj73szF\u003c34tu}jegYWO1q*ACawO\u003c50wQ5qHn][]*e(MXhA:@VJwO#71vruj4zvFrOe?![jg+HKxf!\u003eD:", "n": [ { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 131731, "z": 16, "cf": 0.8500000238418579 } ], "ln": 131715 }, { "b": "00000000000000000000000000000000000000315c8Xg7YTL^00000000000000000", "n": [ { "c": 1, "d": "PE resource section", "i": "metadata/binary/section/names::pe-resource-section", "o": 132608, "z": 5, "cf": 0.8999999761581421 } ], "ln": 132592 }, { "b": "000000000000623gYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006Xn[brp!0rrc21PR3", "n": [ { "c": 3, "d": "Recognized marker for timing checks", "i": "objectives/anti-analysis/timing/evasion::timing-anti-debug-recognized-marker", "o": 132702, "z": 15, "cf": 0.949999988079071 } ], "ln": 132686 }, { "b": "wDlowwb{VJ002aY4GDIflJz38z2!IPve$fBC(QOtve$cAwDhYg002p+yYFnKve$fBaokptx-JkPv/Qfxx-IYA002*}6AwdlmGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up002{$xAh-Dzua}Ze=XS", "n": [ { "c": 2, "d": "PE CompanyName metadata field", "i": "metadata/package/versioning::pe-companyname-field", "o": 133034, "z": 11, "cf": 0.699999988079071 }, { "c": 2, "d": "PE FileDescription metadata field", "i": "metadata/package/versioning::pe-filedescription-field", "o": 133094, "z": 15, "cf": 0.699999988079071 } ], "ln": 133018 }, { "b": "x-J5Kzua.T001+O2(\u003c#amGvc5yYF2DrSDXhASydXx-J5Kzu6Up001\u003eRe=WQae=WN9e=W*gf-RgN002*}7YTNpnDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE002{$xAh-Dzua}Ze=XSDzVB\u003eV", "n": [ { "c": 3, "d": "Dotted-quad PE version metadata marker", "i": "objectives/command-and-control/infrastructure/ip::ipv4-version-metadata-marker", "o": 133174, "z": 11, "cf": 0.9399999976158142 }, { "c": 2, "d": "PE InternalName metadata field", "i": "metadata/package/versioning::pe-internalname-field", "o": 133226, "z": 12, "cf": 0.699999988079071 } ], "ln": 133158 }, { "b": "xAibO001bw003a37YTNppxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE002{$xAh-Dzua}Ze=XSD", "n": [ { "c": 2, "d": "PE OriginalFilename metadata field", "i": "metadata/package/versioning::pe-originalfilename-field", "o": 133346, "z": 16, "cf": 0.699999988079071 } ], "ln": 133330 }, { "b": "e=YzZyYFnK002E*6954kpYLIozVBqFBPt[KBo25ove$cAwDhYg001bwc\u0026!b+wDl/Lf-S)ce=WN", "n": [ { "c": 2, "d": "PE ProductName metadata field", "i": "metadata/package/versioning::pe-productname-field", "o": 133434, "z": 11, "cf": 0.699999988079071 } ], "ln": 133418 }, { "b": "x-IVzdf6tF002W)6AwdlpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001\u003eRe=WQae=WN9e=W*gf-R", "n": [ { "c": 2, "d": "PE version resource metadata", "i": "metadata/package/versioning::version-resource-metadata", "o": 133506, "z": 14, "cf": 0.8999999761581421 } ], "ln": 133490 }, { "b": "0000000000000000000003zsy3\u0026*ncLRJjs000000000000000000000000000000000", "n": [ { "c": 2, "d": "PE .reloc section presence", "i": "metadata/binary/section/names::reloc-section-presence", "o": 134144, "z": 6, "cf": 0.8999999761581421 } ], "ln": 134128 } ], "depth": 1, "facts": { "imp": [ [ "mscoree", "CorDllMain" ] ], "sec": [ [ ".text", 512, 132096, 6.18, "r-x" ], [ ".rsrc", 132608, 1536, 2.4, "r--" ], [ ".reloc", 134144, 512, 0.1, "r--" ] ], "metrics": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "resource_count": 1.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 153052.0, "reloc_overhang_bytes": 500.0, "reloc_overhang_ratio": 0.98, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "version.identity_entropy": 4.33, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0, "version.identity_symbol_ratio": 0.16 }, "file": { "size": 134656.0, "entropy": 6.13, "size_bytes": 134656.0 }, "binary": { "is_pie": 1.0, "code_entropy": 6.18, "string_count": 1299.0, "overall_entropy": 6.13, "entropy_variance": 6.29, "avg_string_length": 21.05, "max_string_length": 162.0, "peak_region_bytes": 2048.0, "code_to_data_ratio": 1.0, "peak_region_entropy": 6.76, "string_length_stddev": 13.87, "largest_section_ratio": 0.98, "sentence_string_count": 36.0, "sentence_string_ratio": 0.03, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 132096.0, "entropy_max": 6.18, "entropy_mean": 2.9, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } } }, "id": 5, "mol": "O(Al)H(Db)", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Shiny.Notifications/Shiny.Notifications.5.1.0.nupkg!!lib/net10.0-android36.0/Shiny.Notifications.dll", "risk": 3, "sha": "4cc2cb51a7eeb71d09861e4ae0a22cd0c9208ae5c377293b27209e6f57fe4f3f", "size": 134656, "traits": [ { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "spans": [ [ 133174, 11 ] ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 132702, 15 ] ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "spans": [ [ 102085, 4 ] ] }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "spans": [ [ 0, 26 ] ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "spans": [ [ 49132, 4 ] ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "spans": [ [ 133506, 14 ] ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "micro-behaviors/data/db/linq::linq-queries", "conf": 0.699999988079071, "crit": 3, "desc": "LINQ query operations", "spans": [ [ 103984, 11 ] ] }, { "id": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "conf": 1.0, "crit": 3, "desc": "JSON polymorphism runtime marker", "spans": [ [ 94857, 16 ] ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "spans": [ [ 49132, 4 ] ] } ], "type": "pe" }, { "id": 6, "sha": "6a2bf363d108bb6b2a6eb6d3d2154e81d9c3e9a97e78d2a7e0e44518957a8843", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Shiny.Notifications/Shiny.Notifications.5.1.0.nupkg!!lib/net10.0-android36.0/Shiny.Notifications.xml", "size": 40765, "type": "xml", "depth": 1 }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J\u0026m(", "n": [ { "c": 3, "d": "HTTP fingerprinting evasion campaign", "i": "objectives/command-and-control/infrastructure/user-agent::http-fingerprinting-campaign", "o": 0, "z": 34, "cf": 0.8999999761581421 } ], "ln": 0 }, { "b": "00000000000000000000@+8xl00000nb@R\u00260SSx743*[]\u0026l.M90rr91000000000000", "n": [ { "c": 1, "d": "PE standard code/data section", "i": "metadata/binary/section/names::pe-code-data-standard-section", "o": 512, "z": 5, "cf": 0.8999999761581421 } ], "ln": 496 }, { "b": "huFn+0@@Dadb1?83mV2Qlq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn", "n": [ { "c": 3, "d": "Recognized PE anti-analysis marker", "i": "objectives/anti-analysis/debugger-detect/combined-checks::evasion-aware-recognized-pe-marker", "o": 96268, "z": 4, "cf": 1.0 } ], "ln": 96252 }, { "b": "z/oVbx(mv3wIMTNju=Kvq*ACawO\u003c4\u003epxiH@y*?A$z/PXUpYJQ/z/ff3xlwl6BzkVhk2qkwv/", "n": [ { "c": 2, "d": "System namespace reference", "i": "metadata/lang/compiler/managed::system-namespace", "o": 171817, "z": 9, "cf": 0.800000011920929 } ], "ln": 171801 }, { "b": "nPNsBBy/uhx(v(Svrt]Tq*ACawO\u003c50wQ5qHn][]*e(Mt4x\u003c\u003e*(Dsp]fz/dg4wPRu\u003evrt]Tq*ACawO\u003c50", "n": [ { "c": 3, "d": "JSON polymorphism runtime marker", "i": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "o": 172051, "z": 16, "cf": 1.0 } ], "ln": 172035 }, { "b": "yHpBnvpK7!zF8BMwO+(Sjv9F0x(v)gk5jIjlsBwtx(mMMx\u003eq9\u003e06B7#wPIB2Byxo9z/eu\u0026BzkVhB3swDuQwghyIvW0", "n": [ { "c": 1, "d": "Regex component marker", "i": "objectives/persistence/login/scheduled-task/com::task-action-principal-properties--rx-4", "o": 173348, "z": 24, "cf": 0.8799999952316284 } ], "ln": 173332 }, { "b": "yHpBnvpK7!zF8BMwO+(Sq!o\u0026S06$NywO#2Ul$7gGrb3hXokeoO0b2\u003e+uSgJCz/f7=", "n": [ { "c": 1, "d": ".NET Socket Send/Receive methods (Send)", "i": "micro-behaviors/communications/socket/create::socket-receive-send-str--send", "o": 173741, "z": 4, "cf": 0.800000011920929 } ], "ln": 173725 }, { "b": "zH0\u003cfz//Y9x\u003e7N[x(v)ge[w^m07g^rvru6/pe+ekyYF9VByd^wrDq)Qp\u0026ZF[pgn0J", "n": [ { "c": 3, "d": "References Windows executable or script", "i": "objectives/execution/interpreter/script/shell::windows-executable-ref", "o": 178856, "z": 4, "cf": 0.6000000238418579 } ], "ln": 178840 }, { "b": "vnZVQA+fr6zGGrex(v\u003e?q*ACawO\u003c50wQ5qHn][]*e(Mt4x\u003c\u003e*(Dsp]fz/bLNxLzvfe\u003e72bwO#N6z/fRG", "n": [ { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 180119, "z": 16, "cf": 0.8500000238418579 } ], "ln": 180103 }, { "b": "zE^r@v%HT-ygQ)%x(v\u003e?q*ACawO\u003c4$wOb:\u0026v@#B6zu9mbwPz%dv}w2Cy\u00260V)BzkVh0cqZ[uRa)Fz/PzRzV", "n": [ { "c": 2, "d": "Benign high-entropy PE context", "i": "metadata/package/quality/false-positives::benign-high-entropy-pe-context", "o": 180564, "z": 17, "cf": 0.949999988079071 } ], "ln": 180548 }, { "b": "z*2YjC#F\u0026#xjVdax(v\u003e?q*ACawO\u003c50wQ5qHn][]*08NYOA86?UwNwbHv{%g/DsZRRvqfL2A+ecWvrlv8", "n": [ { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 180986, "z": 16, "cf": 0.8500000238418579 } ], "ln": 180970 }, { "b": "D2Ns^zF0!!xkzG}vqE$=q*ACawO\u003c50wQ5qHn][]*e(Mt4x\u003c\u003e*(Dsp]fz/dg4wPRu\u003evrt{gnLj5xzD7[2", "n": [ { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 181171, "z": 16, "cf": 0.8500000238418579 } ], "ln": 181155 }, { "b": "A==N#zF0!!pJf(.l2Z=yq*ACawO\u003c4[x(m[\u003cxjVf(s.h2Z0cqZ[uS*@GASwEywNPPVpe:]gzdm5", "n": [ { "c": 3, "d": "LINQ query operations", "i": "micro-behaviors/data/db/linq::linq-queries", "o": 181464, "z": 11, "cf": 0.699999988079071 } ], "ln": 181448 }, { "b": "ze:r5BzkVhnmuyDy?mR!q*ACawO\u003c4!z!9AEz/49]z/6Dcy?mR!p\u0026ZF[pgn0JuSzeUASx--Bye3?wPv=rz/ff3xlwj", "n": [ { "c": 3, "d": ".NET dynamic code generation capability", "i": "metadata/lang/compiler/managed::dotnet-dynamic-code", "o": 183593, "z": 23, "cf": 0.8500000238418579 } ], "ln": 183577 }, { "b": "wPRu\u003evrt{RwPz%dv}xYYq*ACawO\u003c4$B-8qnzdLs\u003ezGGDgz/wS^A=#ebwPE\u0026ID2[7sz7X.ezGGPfwIct*ze:i9wPyZXA=#ebwPE", "n": [ { "c": 3, "d": "Packed binary marker", "i": "objectives/anti-static/obfuscation/eval/loader::packed-binary-marker", "o": 184815, "z": 30, "cf": 0.8500000238418579 } ], "ln": 184799 }, { "b": "CYV?{xk8BeA::67z/fQ@p\u0026ZF[pgn0JuQngzx(v)g0b2\u003e+uQngzx(v)g0cqZ[uQngzx(v)g08mfqA=l2qw]]T]CYWImB7]MgB1Qd8xj\u003e{@xd=FV", "n": [ { "c": 1, "d": "Regex component marker", "i": "objectives/persistence/login/scheduled-task/com::task-action-principal-properties--rx-4", "o": 186187, "z": 16, "cf": 0.8799999952316284 } ], "ln": 186171 }, { "b": "Bxh%[B7]Mgl3b!ivrlI\u003cxjVf(qE%\u0026\u003cwPI}[rzDqcBzku3v{%E[z/eD:ADL\u0026lBo2oUoLFM\u002608NX", "n": [ { "c": 3, "d": "Access to ASP.NET Request object", "i": "micro-behaviors/communications/http/server/managed::http-request-get", "o": 188976, "z": 11, "cf": 1.0 } ], "ln": 188960 }, { "b": "pxktlBo31PzVBUPA@VgJk(+x{Bo31PzVBUPA@VgPnDrPcz#:!RASygYve$fBv/Q6u01hZ", "n": [ { "c": 1, "d": "Regex component marker", "i": "objectives/persistence/login/scheduled-task/com::task-action-principal-properties--rx-4", "o": 194129, "z": 7, "cf": 0.8799999952316284 } ], "ln": 194113 }, { "b": "wO\u003c4!z!%l3v@#B6zGvuKr+lq)x(v(Lf!+jle?![iefEr5y\u0026\u003c/uwJ:{xB-.Ujy+cY9BZ/f3v[QxUrbVL-", "n": [ { "c": 2, "d": "IPv4-like .NET assembly version", "i": "metadata/lang/compiler/managed::dotnet-ipv4-like-version", "o": 214579, "z": 16, "cf": 0.8500000238418579 } ], "ln": 214563 }, { "b": "wKyctzF\u003c34tu}jegYWO1q*ACawO\u003c50wQ5qHn][]*e(MXhA:@VJwO#71vruj4zvFrOe?![jg+HKxf!\u003eD:", "n": [ { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 215414, "z": 16, "cf": 0.8500000238418579 } ], "ln": 215398 }, { "b": "00000000000000000000000000000000000000315c8Xg7YTL^00000000000000000", "n": [ { "c": 1, "d": "PE resource section", "i": "metadata/binary/section/names::pe-resource-section", "o": 216064, "z": 5, "cf": 0.8999999761581421 } ], "ln": 216048 }, { "b": "0000000000005.}gYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006Xn[brp!0rrc21PR3", "n": [ { "c": 3, "d": "Recognized marker for timing checks", "i": "objectives/anti-analysis/timing/evasion::timing-anti-debug-recognized-marker", "o": 216158, "z": 15, "cf": 0.949999988079071 } ], "ln": 216142 }, { "b": "wDlowwb{VJ002aY4GDIflJz38z2!IPve$fBC(QOtve$cAwDhYg002p+yYFnKve$fBaokptx-JkPv/Qfxx-IYA002*}6AwdlmGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up002{$xAh-Dzua}Ze=XS", "n": [ { "c": 2, "d": "PE CompanyName metadata field", "i": "metadata/package/versioning::pe-companyname-field", "o": 216490, "z": 11, "cf": 0.699999988079071 }, { "c": 2, "d": "PE FileDescription metadata field", "i": "metadata/package/versioning::pe-filedescription-field", "o": 216550, "z": 15, "cf": 0.699999988079071 } ], "ln": 216474 }, { "b": "x-J5Kzua.T001+O2(\u003c#amGvc5yYF2DrSDXhASydXx-J5Kzu6Up001\u003eRe=WQae=WN9e=W*gf-RgN002*}7YTNpnDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE002{$xAh-Dzua}Ze=XSDzVB\u003eV", "n": [ { "c": 3, "d": "Dotted-quad PE version metadata marker", "i": "objectives/command-and-control/infrastructure/ip::ipv4-version-metadata-marker", "o": 216630, "z": 11, "cf": 0.9399999976158142 }, { "c": 2, "d": "PE InternalName metadata field", "i": "metadata/package/versioning::pe-internalname-field", "o": 216682, "z": 12, "cf": 0.699999988079071 } ], "ln": 216614 }, { "b": "xAibO001bw003a37YTNppxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE002{$xAh-Dzua}Ze=XSD", "n": [ { "c": 2, "d": "PE OriginalFilename metadata field", "i": "metadata/package/versioning::pe-originalfilename-field", "o": 216802, "z": 16, "cf": 0.699999988079071 } ], "ln": 216786 }, { "b": "e=YzZyYFnK002g.4/=RgpYLIozVBqFBPt[KBo25ove$cAwDhYg001bwc\u0026!b+wDl/Lf-S)ce=WN", "n": [ { "c": 2, "d": "PE ProductName metadata field", "i": "metadata/package/versioning::pe-productname-field", "o": 216890, "z": 11, "cf": 0.699999988079071 } ], "ln": 216874 }, { "b": "zVB?Udf6tF002W)6AwdlpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001\u003eRe=WQae=WN9e=W*gf-R", "n": [ { "c": 2, "d": "PE version resource metadata", "i": "metadata/package/versioning::version-resource-metadata", "o": 216954, "z": 14, "cf": 0.8999999761581421 } ], "ln": 216938 }, { "b": "fArZ9hVLMj00000000000ak)e3\u0026*ncauoA4000000000000000000000000000000000", "n": [ { "c": 2, "d": "PE .reloc section presence", "i": "metadata/binary/section/names::reloc-section-presence", "o": 217088, "z": 6, "cf": 0.8999999761581421 } ], "ln": 217072 } ], "depth": 1, "facts": { "imp": [ [ "mscoree", "CorDllMain" ] ], "sec": [ [ ".text", 512, 215552, 6.18, "r-x" ], [ ".rsrc", 216064, 1024, 3.27, "r--" ], [ ".reloc", 217088, 512, 0.1, "r--" ] ], "metrics": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "resource_count": 1.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 244212.0, "reloc_overhang_bytes": 500.0, "reloc_overhang_ratio": 0.98, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "version.identity_entropy": 4.24, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0, "version.identity_symbol_ratio": 0.18 }, "file": { "size": 217600.0, "entropy": 6.16, "size_bytes": 217600.0 }, "binary": { "is_pie": 1.0, "code_entropy": 6.18, "string_count": 1562.0, "overall_entropy": 6.16, "entropy_variance": 6.17, "avg_string_length": 21.85, "max_string_length": 160.0, "peak_region_bytes": 4096.0, "code_to_data_ratio": 1.0, "peak_region_entropy": 6.56, "string_length_stddev": 13.25, "largest_section_ratio": 0.99, "sentence_string_count": 30.0, "sentence_string_ratio": 0.02, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 215552.0, "entropy_max": 6.18, "entropy_mean": 3.19, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } } }, "id": 7, "mol": "O(Al)H₂(CmDb)", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Shiny.Notifications/Shiny.Notifications.5.1.0.nupkg!!lib/net10.0-ios26.0/Shiny.Notifications.dll", "risk": 4, "sha": "04a18433521289168cb9fa98f7f413de2382d73aba000f5a2da0803daf59b81e", "size": 217600, "traits": [ { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "spans": [ [ 216630, 11 ] ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 216158, 15 ] ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "spans": [ [ 178856, 4 ] ] }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "spans": [ [ 0, 26 ] ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "spans": [ [ 96268, 4 ] ] }, { "id": "micro-behaviors/communications/http/server/managed::http-request-get", "conf": 1.0, "crit": 3, "desc": "Access to ASP.NET Request object", "spans": [ [ 188976, 11 ] ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "spans": [ [ 216954, 14 ] ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "micro-behaviors/data/db/linq::linq-queries", "conf": 0.699999988079071, "crit": 3, "desc": "LINQ query operations", "spans": [ [ 181464, 11 ] ] }, { "id": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "conf": 1.0, "crit": 3, "desc": "JSON polymorphism runtime marker", "spans": [ [ 172051, 16 ] ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "spans": [ [ 96268, 4 ] ] } ], "type": "pe" }, { "id": 8, "sha": "f985fef560d300ea1dd4785773fcaaaebcc4cf09cc9115687054933e4c260024", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Shiny.Notifications/Shiny.Notifications.5.1.0.nupkg!!lib/net10.0-ios26.0/Shiny.Notifications.xml", "size": 46148, "type": "xml", "depth": 1 }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J\u0026m(", "n": [ { "c": 3, "d": "HTTP fingerprinting evasion campaign", "i": "objectives/command-and-control/infrastructure/user-agent::http-fingerprinting-campaign", "o": 0, "z": 34, "cf": 0.8999999761581421 } ], "ln": 0 }, { "b": "00000000000000000000NR8Z500000nb@R\u00260SSx7rfWE:eysE#0rr91000000000000", "n": [ { "c": 1, "d": "PE standard code/data section", "i": "metadata/binary/section/names::pe-code-data-standard-section", "o": 512, "z": 5, "cf": 0.8999999761581421 } ], "ln": 496 }, { "b": "huFn+0@@Dada5g#3mV2Qlq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn", "n": [ { "c": 3, "d": "Recognized PE anti-analysis marker", "i": "objectives/anti-analysis/debugger-detect/combined-checks::evasion-aware-recognized-pe-marker", "o": 96084, "z": 4, "cf": 1.0 } ], "ln": 96068 }, { "b": "uPw9Go(BM+y?k^gju=Kvq*ACawO\u003c4\u003epxiH@y*?A$z/PXUpYJQ/z/ff3xlwl6BzkVhk2qkwv/", "n": [ { "c": 2, "d": "System namespace reference", "i": "metadata/lang/compiler/managed::system-namespace", "o": 171538, "z": 9, "cf": 0.800000011920929 } ], "ln": 171522 }, { "b": "nPNsBBy/uhx(v(Svrt]Tq*ACawO\u003c50wQ5qHn][]*e(Mt4x\u003c\u003e*(Dsp]fz/dg4wPRu\u003evrt]Tq*ACawO\u003c50", "n": [ { "c": 3, "d": "JSON polymorphism runtime marker", "i": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "o": 171758, "z": 16, "cf": 1.0 } ], "ln": 171742 }, { "b": "yHpBnvpK7!zF8BMwO+(Sjv9F0x(v)gk5jIjlsBwtx(mMMx\u003eq9\u003e06B7#wPIB2Byxo9z/eu\u0026BzkVhB3swDuQwghyIvW0", "n": [ { "c": 1, "d": "Regex component marker", "i": "objectives/persistence/login/scheduled-task/com::task-action-principal-properties--rx-4", "o": 173055, "z": 24, "cf": 0.8799999952316284 } ], "ln": 173039 }, { "b": "yHpBnvpK7!zF8BMwO+(Sq!o\u0026S06$NywO#2Ul$7gGrb3hXokeoO0b2\u003e+uSgJCz/f7=", "n": [ { "c": 1, "d": ".NET Socket Send/Receive methods (Send)", "i": "micro-behaviors/communications/socket/create::socket-receive-send-str--send", "o": 173448, "z": 4, "cf": 0.800000011920929 } ], "ln": 173432 }, { "b": "zH0\u003cfz//Y9x\u003e7N[x(v)ge[w^m07g^rvru6/pe+ekyYF9VByd^wrDq)Qp\u0026ZF[pgn0J", "n": [ { "c": 3, "d": "References Windows executable or script", "i": "objectives/execution/interpreter/script/shell::windows-executable-ref", "o": 178563, "z": 4, "cf": 0.6000000238418579 } ], "ln": 178547 }, { "b": "vnZVQA+fr6zGGrex(v\u003e?q*ACawO\u003c50wQ5qHn][]*e(Mt4x\u003c\u003e*(Dsp]fz/bLNxLzvfe\u003e72bwO#N6z/fRG", "n": [ { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 179793, "z": 16, "cf": 0.8500000238418579 } ], "ln": 179777 }, { "b": "zE^r@v%HT-ygQ)%x(v\u003e?q*ACawO\u003c4$wOb:\u0026v@#B6zu9mbwPz%dv}w2Cy\u00260V)BzkVh0cqZ[uRa)Fz/PzRzV", "n": [ { "c": 2, "d": "Benign high-entropy PE context", "i": "metadata/package/quality/false-positives::benign-high-entropy-pe-context", "o": 180238, "z": 17, "cf": 0.949999988079071 } ], "ln": 180222 }, { "b": "z*2YjC#F\u0026#xjVdax(v\u003e?q*ACawO\u003c50wQ5qHn][]*08NYOA86?UwNwbHv{%g/DsZRRvqfL2A+ecWvrlv8", "n": [ { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 180660, "z": 16, "cf": 0.8500000238418579 } ], "ln": 180644 }, { "b": "D2Ns^zF0!!xkzG}vqE$=q*ACawO\u003c50wQ5qHn][]*e(Mt4x\u003c\u003e*(Dsp]fz/dg4wPRu\u003evrt{gnLj5xzD7[2", "n": [ { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 180845, "z": 16, "cf": 0.8500000238418579 } ], "ln": 180829 }, { "b": "A==N#zF0!!pJf(.l2Z=yq*ACawO\u003c4[x(m[\u003cxjVf(s.h2Z0cqZ[uS*@GASwEywNPPVpe:]gzdm5", "n": [ { "c": 3, "d": "LINQ query operations", "i": "micro-behaviors/data/db/linq::linq-queries", "o": 181138, "z": 11, "cf": 0.699999988079071 } ], "ln": 181122 }, { "b": "ze:r5BzkVhnmuyDy?mR!q*ACawO\u003c4!z!9AEz/49]z/6Dcy?mR!p\u0026ZF[pgn0JuSzeUASx--Bye3?wPv=rz/ff3xlwj", "n": [ { "c": 3, "d": ".NET dynamic code generation capability", "i": "metadata/lang/compiler/managed::dotnet-dynamic-code", "o": 183237, "z": 23, "cf": 0.8500000238418579 } ], "ln": 183221 }, { "b": "wPRu\u003evrt{RwPz%dv}xYYq*ACawO\u003c4$B-8qnzdLs\u003ezGGDgz/wS^A=#ebwPE\u0026ID2[7sz7X.ezGGPfwIct*ze:i9wPyZXA=#ebwPE", "n": [ { "c": 3, "d": "Packed binary marker", "i": "objectives/anti-static/obfuscation/eval/loader::packed-binary-marker", "o": 184459, "z": 30, "cf": 0.8500000238418579 } ], "ln": 184443 }, { "b": "CYV?{xk8BeA::67z/fQ@p\u0026ZF[pgn0JuQngzx(v)g0b2\u003e+uQngzx(v)g0cqZ[uQngzx(v)g08mfqA=l2qw]]T]CYWImB7]MgB1Qd8xj\u003e{@xd=FV", "n": [ { "c": 1, "d": "Regex component marker", "i": "objectives/persistence/login/scheduled-task/com::task-action-principal-properties--rx-4", "o": 185831, "z": 16, "cf": 0.8799999952316284 } ], "ln": 185815 }, { "b": "Bxh%[B7]Mgl3b!ivrlI\u003cxjVf(qE%\u0026\u003cwPI}[rzDqcBzku3v{%E[z/eD:ADL\u0026lBo2oUoLFM\u002608NX", "n": [ { "c": 3, "d": "Access to ASP.NET Request object", "i": "micro-behaviors/communications/http/server/managed::http-request-get", "o": 188609, "z": 11, "cf": 1.0 } ], "ln": 188593 }, { "b": "pxktlBo31PzVBUPA@VgJk(+x{Bo31PzVBUPA@VgPnDrPcz#:!RASygYve$fBv/Q6u01hZ", "n": [ { "c": 1, "d": "Regex component marker", "i": "objectives/persistence/login/scheduled-task/com::task-action-principal-properties--rx-4", "o": 193785, "z": 7, "cf": 0.8799999952316284 } ], "ln": 193769 }, { "b": "wO\u003c4!z!%l3v@#B6zGvuKr+lq)x(v(Lf!+jle?![iefEr5y\u0026\u003c/uwJ:{xB-.Ujy+cY9BZ/f3v[QxUrbVL-", "n": [ { "c": 2, "d": "IPv4-like .NET assembly version", "i": "metadata/lang/compiler/managed::dotnet-ipv4-like-version", "o": 214215, "z": 16, "cf": 0.8500000238418579 } ], "ln": 214199 }, { "b": "wKyctzF\u003c34tu}jegYWO1q*ACawO\u003c50wQ5qHn][]*e(MXhA:@VJwO#71vruj4zvFrOe?![jg+HKxf!\u003eD:", "n": [ { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 215050, "z": 16, "cf": 0.8500000238418579 } ], "ln": 215034 }, { "b": "00000000000000000000000000000000000000315c8Xg7YTL^00000000000000000", "n": [ { "c": 1, "d": "PE resource section", "i": "metadata/binary/section/names::pe-resource-section", "o": 215552, "z": 5, "cf": 0.8999999761581421 } ], "ln": 215536 }, { "b": "0000000000006qbgYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006Xn[brp!0rrc21PR3", "n": [ { "c": 3, "d": "Recognized marker for timing checks", "i": "objectives/anti-analysis/timing/evasion::timing-anti-debug-recognized-marker", "o": 215646, "z": 15, "cf": 0.949999988079071 } ], "ln": 215630 }, { "b": "wDlowwb{VJ002aY4GDIflJz38z2!IPve$fBC(QOtve$cAwDhYg002p+yYFnKve$fBaokptx-JkPv/Qfxx-IYA002*}6AwdlmGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up002{$xAh-Dzua}Ze=XS", "n": [ { "c": 2, "d": "PE CompanyName metadata field", "i": "metadata/package/versioning::pe-companyname-field", "o": 215978, "z": 11, "cf": 0.699999988079071 }, { "c": 2, "d": "PE FileDescription metadata field", "i": "metadata/package/versioning::pe-filedescription-field", "o": 216038, "z": 15, "cf": 0.699999988079071 } ], "ln": 215962 }, { "b": "x-J5Kzua.T001+O2(\u003c#amGvc5yYF2DrSDXhASydXx-J5Kzu6Up001\u003eRe=WQae=WN9e=W*gf-RgN002*}7YTNpnDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE002{$xAh-Dzua}Ze=XSDzVB\u003eV", "n": [ { "c": 3, "d": "Dotted-quad PE version metadata marker", "i": "objectives/command-and-control/infrastructure/ip::ipv4-version-metadata-marker", "o": 216118, "z": 11, "cf": 0.9399999976158142 }, { "c": 2, "d": "PE InternalName metadata field", "i": "metadata/package/versioning::pe-internalname-field", "o": 216170, "z": 12, "cf": 0.699999988079071 } ], "ln": 216102 }, { "b": "xAibO001bw003a37YTNppxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE002{$xAh-Dzua}Ze=XSD", "n": [ { "c": 2, "d": "PE OriginalFilename metadata field", "i": "metadata/package/versioning::pe-originalfilename-field", "o": 216290, "z": 16, "cf": 0.699999988079071 } ], "ln": 216274 }, { "b": "e=YzZyYFnK002:]7xsEopYLIozVBqFBPt[KBo25ove$cAwDhYg001bwc\u0026!b+wDl/Lf-S)ce=WN", "n": [ { "c": 2, "d": "PE ProductName metadata field", "i": "metadata/package/versioning::pe-productname-field", "o": 216378, "z": 11, "cf": 0.699999988079071 } ], "ln": 216362 }, { "b": "A@ZpZdf6tF002W)6AwdlpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001\u003eRe=WQae=WN9e=W*gf-R", "n": [ { "c": 2, "d": "PE version resource metadata", "i": "metadata/package/versioning::version-resource-metadata", "o": 216458, "z": 14, "cf": 0.8999999761581421 } ], "ln": 216442 }, { "b": "000000000000000000000ak)e3\u0026*ncYF//\u003c000000000000000000000000000000000", "n": [ { "c": 2, "d": "PE .reloc section presence", "i": "metadata/binary/section/names::reloc-section-presence", "o": 217088, "z": 6, "cf": 0.8999999761581421 } ], "ln": 217072 } ], "depth": 1, "facts": { "imp": [ [ "mscoree", "CorDllMain" ] ], "sec": [ [ ".text", 512, 215040, 6.2, "r-x" ], [ ".rsrc", 215552, 1536, 2.42, "r--" ], [ ".reloc", 217088, 512, 0.1, "r--" ] ], "metrics": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "resource_count": 1.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 255744.0, "reloc_overhang_bytes": 500.0, "reloc_overhang_ratio": 0.98, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "version.identity_entropy": 4.27, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0, "version.identity_symbol_ratio": 0.15 }, "file": { "size": 217600.0, "entropy": 6.17, "size_bytes": 217600.0 }, "binary": { "is_pie": 1.0, "code_entropy": 6.2, "string_count": 1558.0, "overall_entropy": 6.17, "entropy_variance": 6.32, "avg_string_length": 21.87, "max_string_length": 160.0, "peak_region_bytes": 4096.0, "code_to_data_ratio": 1.0, "peak_region_entropy": 6.68, "string_length_stddev": 13.26, "largest_section_ratio": 0.99, "sentence_string_count": 30.0, "sentence_string_ratio": 0.02, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 215040.0, "entropy_max": 6.2, "entropy_mean": 2.91, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } } }, "id": 9, "mol": "O(Al)H₂(CmDb)", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Shiny.Notifications/Shiny.Notifications.5.1.0.nupkg!!lib/net10.0-maccatalyst26.0/Shiny.Notifications.dll", "risk": 4, "sha": "e4a54f1e1d226a51ac9afc5b7ff8b01cc37c44b4a286cb4c05859fb271a5b794", "size": 217600, "traits": [ { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "spans": [ [ 216118, 11 ] ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 215646, 15 ] ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "spans": [ [ 178563, 4 ] ] }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "spans": [ [ 0, 26 ] ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "spans": [ [ 96084, 4 ] ] }, { "id": "micro-behaviors/communications/http/server/managed::http-request-get", "conf": 1.0, "crit": 3, "desc": "Access to ASP.NET Request object", "spans": [ [ 188609, 11 ] ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "spans": [ [ 216458, 14 ] ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "micro-behaviors/data/db/linq::linq-queries", "conf": 0.699999988079071, "crit": 3, "desc": "LINQ query operations", "spans": [ [ 181138, 11 ] ] }, { "id": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "conf": 1.0, "crit": 3, "desc": "JSON polymorphism runtime marker", "spans": [ [ 171758, 16 ] ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "spans": [ [ 96084, 4 ] ] } ], "type": "pe" }, { "id": 10, "sha": "f985fef560d300ea1dd4785773fcaaaebcc4cf09cc9115687054933e4c260024", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Shiny.Notifications/Shiny.Notifications.5.1.0.nupkg!!lib/net10.0-maccatalyst26.0/Shiny.Notifications.xml", "size": 46148, "type": "xml", "depth": 1 }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J\u0026m(", "n": [ { "c": 3, "d": "HTTP fingerprinting evasion campaign", "i": "objectives/command-and-control/infrastructure/user-agent::http-fingerprinting-campaign", "o": 0, "z": 34, "cf": 0.8999999761581421 } ], "ln": 0 }, { "b": "00000000000000000000g+w!f00000nb@R\u00260SSx71Bg1F9j2UC0rr91000000000000", "n": [ { "c": 1, "d": "PE standard code/data section", "i": "metadata/binary/section/names::pe-code-data-standard-section", "o": 512, "z": 5, "cf": 0.8999999761581421 } ], "ln": 496 }, { "b": "huFm)0@@Dad3T@o3mV2Qlq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn", "n": [ { "c": 3, "d": "Recognized PE anti-analysis marker", "i": "objectives/anti-analysis/debugger-detect/combined-checks::evasion-aware-recognized-pe-marker", "o": 88836, "z": 4, "cf": 1.0 } ], "ln": 88820 }, { "b": "uPw9Go(BM+y?k^gju=Kvq*ACawO\u003c4\u003epxiH@y*?A$z/PXUpYJQ/z/ff3xlwl6BzkVhk2qkwv/", "n": [ { "c": 2, "d": "System namespace reference", "i": "metadata/lang/compiler/managed::system-namespace", "o": 157932, "z": 9, "cf": 0.800000011920929 } ], "ln": 157916 }, { "b": "nPNsBBy/uhx(v(Svrt]Tq*ACawO\u003c50wQ5qHn][]*e(Mt4x\u003c\u003e*(Dsp]fz/dg4wPRu\u003evrt]Tq*ACawO\u003c50", "n": [ { "c": 3, "d": "JSON polymorphism runtime marker", "i": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "o": 158132, "z": 16, "cf": 1.0 } ], "ln": 158116 }, { "b": "yHpBnvpK7!zF8BMwO+(Sjv9F0x(v)gk5jIjlsBwtx(mMMx\u003eq9\u003e06B7#wPIB2Byxo9z/eu\u0026BzkVhB3swDuQwghyIvW0", "n": [ { "c": 1, "d": "Regex component marker", "i": "objectives/persistence/login/scheduled-task/com::task-action-principal-properties--rx-4", "o": 159429, "z": 24, "cf": 0.8799999952316284 } ], "ln": 159413 }, { "b": "yHpBnvpK7!zF8BMwO+(Sq!o\u0026S06$NywO#2Ul$7gGrb3hXokeoO0b2\u003e+uSgJCz/f7=", "n": [ { "c": 1, "d": ".NET Socket Send/Receive methods (Send)", "i": "micro-behaviors/communications/socket/create::socket-receive-send-str--send", "o": 159822, "z": 4, "cf": 0.800000011920929 } ], "ln": 159806 }, { "b": "zH0\u003cfz//Y9x\u003e7N[x(v)ge[w^m07g^rvru6/pe+ekyYF9VByd^wrDq)Qp\u0026ZF[pgn0J", "n": [ { "c": 3, "d": "References Windows executable or script", "i": "objectives/execution/interpreter/script/shell::windows-executable-ref", "o": 165022, "z": 4, "cf": 0.6000000238418579 } ], "ln": 165006 }, { "b": "vnZVQA+fr6zGGrex(v\u003e?q*ACawO\u003c50wQ5qHn][]*e(Mt4x\u003c\u003e*(Dsp]fz/bLNxLzvfe\u003e72bwO#N6z/fRG", "n": [ { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 166233, "z": 16, "cf": 0.8500000238418579 } ], "ln": 166217 }, { "b": "zE^r@v%HT-ygQ)%x(v\u003e?q*ACawO\u003c4$wOb:\u0026v@#B6zu9mbwPz%dv}w2Cy\u00260V)BzkVh0cqZ[uRa)Fz/PzRzV", "n": [ { "c": 2, "d": "Benign high-entropy PE context", "i": "metadata/package/quality/false-positives::benign-high-entropy-pe-context", "o": 166551, "z": 17, "cf": 0.949999988079071 } ], "ln": 166535 }, { "b": "z*2YjC#F\u0026#xjVdax(v\u003e?q*ACawO\u003c50wQ5qHn][]*08NYOA86?UwNwbHv{%g/DsZRRvqfL2A+ecWvrlv8", "n": [ { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 166995, "z": 16, "cf": 0.8500000238418579 } ], "ln": 166979 }, { "b": "D2Ns^zF0!!xkzG}vqE$=q*ACawO\u003c50wQ5qHn][]*e(Mt4x\u003c\u003e*(Dsp]fz/dg4wPRu\u003evrt{gnLj5xzD7[2", "n": [ { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 167180, "z": 16, "cf": 0.8500000238418579 } ], "ln": 167164 }, { "b": "A==N#zF0!!pJf(.l2Z=yq*ACawO\u003c4[x(m[\u003cxjVf(s.h2Z0cqZ[uS*@GASwEywNPPVpe:]gzdm5", "n": [ { "c": 3, "d": "LINQ query operations", "i": "micro-behaviors/data/db/linq::linq-queries", "o": 167473, "z": 11, "cf": 0.699999988079071 } ], "ln": 167457 }, { "b": "ze:r5BzkVhnmuyDy?mR!q*ACawO\u003c4!z!9AEz/49]z/6Dcy?mR!p\u0026ZF[pgn0JuSzeUASx--Bye3?wPv=rz/ff3xlwj", "n": [ { "c": 3, "d": ".NET dynamic code generation capability", "i": "metadata/lang/compiler/managed::dotnet-dynamic-code", "o": 169444, "z": 23, "cf": 0.8500000238418579 } ], "ln": 169428 }, { "b": "wPRu\u003evrt{RwPz%dv}xYYq*ACawO\u003c4$B-8qnzdLs\u003ezGGDgz/wS^A=#ebwPE\u0026ID2[7sz7X.ezGGPfwIct*ze:i9wPyZXA=#ebwPE", "n": [ { "c": 3, "d": "Packed binary marker", "i": "objectives/anti-static/obfuscation/eval/loader::packed-binary-marker", "o": 170653, "z": 30, "cf": 0.8500000238418579 } ], "ln": 170637 }, { "b": "CYV?{xk8BeA::67z/fQ@p\u0026ZF[pgn0JuQngzx(v)g0b2\u003e+uQngzx(v)g0cqZ[uQngzx(v)g08mfqA=l2qw]]T]CYWImB7]MgB1Qd8xj\u003e{@xd=FV", "n": [ { "c": 1, "d": "Regex component marker", "i": "objectives/persistence/login/scheduled-task/com::task-action-principal-properties--rx-4", "o": 171840, "z": 16, "cf": 0.8799999952316284 } ], "ln": 171824 }, { "b": "q=WEIB7]Mgl3b!ivrlI\u003cxjVf(qE%\u0026\u003cwPI}[rzDqcBzku3v{%E[z/eD:ADL\u0026lBo2oUoLFM\u002608NX", "n": [ { "c": 3, "d": "Access to ASP.NET Request object", "i": "micro-behaviors/communications/http/server/managed::http-request-get", "o": 174497, "z": 11, "cf": 1.0 } ], "ln": 174481 }, { "b": "pxktlBo31PzVBUPA@VgJk(+x{Bo31PzVBUPA@VgPnDrPcz#:!RASygYve$fBv/Q6u01hZ", "n": [ { "c": 1, "d": "Regex component marker", "i": "objectives/persistence/login/scheduled-task/com::task-action-principal-properties--rx-4", "o": 179337, "z": 7, "cf": 0.8799999952316284 } ], "ln": 179321 }, { "b": "wO\u003c4!z!%l3v@#B6zGvuKr+lq)x(v(Lf!+jle?![iefEr5y\u0026\u003c/uwJ:{xB-.Ujy+cY9BZ/f3v[QxUrbVL-", "n": [ { "c": 2, "d": "IPv4-like .NET assembly version", "i": "metadata/lang/compiler/managed::dotnet-ipv4-like-version", "o": 199271, "z": 16, "cf": 0.8500000238418579 } ], "ln": 199255 }, { "b": "wKyctzF\u003c34tu}jegYWO1q*ACawO\u003c50wQ5qHn][]*e(MXhA:@VJwO#71vruj4zvFrOe?![jg+HKxf!\u003eD:", "n": [ { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 200106, "z": 16, "cf": 0.8500000238418579 } ], "ln": 200090 }, { "b": "00000000000000000000000000000000000000315c8Xg7YTL^00000000000000000", "n": [ { "c": 1, "d": "PE resource section", "i": "metadata/binary/section/names::pe-resource-section", "o": 200704, "z": 5, "cf": 0.8999999761581421 } ], "ln": 200688 }, { "b": "0000000000005\u003e#gYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006Xn[brp!0rrc21PR3", "n": [ { "c": 3, "d": "Recognized marker for timing checks", "i": "objectives/anti-analysis/timing/evasion::timing-anti-debug-recognized-marker", "o": 200798, "z": 15, "cf": 0.949999988079071 } ], "ln": 200782 }, { "b": "wDlowwb{VJ002aY4GDIflJz38z2!IPve$fBC(QOtve$cAwDhYg002p+yYFnKve$fBaokptx-JkPv/Qfxx-IYA002*}6AwdlmGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up002{$xAh-Dzua}Ze=XS", "n": [ { "c": 2, "d": "PE CompanyName metadata field", "i": "metadata/package/versioning::pe-companyname-field", "o": 201130, "z": 11, "cf": 0.699999988079071 }, { "c": 2, "d": "PE FileDescription metadata field", "i": "metadata/package/versioning::pe-filedescription-field", "o": 201190, "z": 15, "cf": 0.699999988079071 } ], "ln": 201114 }, { "b": "x-J5Kzua.T001+O2(\u003c#amGvc5yYF2DrSDXhASydXx-J5Kzu6Up001\u003eRe=WQae=WN9e=W*gf-RgN002*}7YTNpnDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE002{$xAh-Dzua}Ze=XSDzVB\u003eV", "n": [ { "c": 3, "d": "Dotted-quad PE version metadata marker", "i": "objectives/command-and-control/infrastructure/ip::ipv4-version-metadata-marker", "o": 201270, "z": 11, "cf": 0.9399999976158142 }, { "c": 2, "d": "PE InternalName metadata field", "i": "metadata/package/versioning::pe-internalname-field", "o": 201322, "z": 12, "cf": 0.699999988079071 } ], "ln": 201254 }, { "b": "xAibO001bw003a37YTNppxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE002{$xAh-Dzua}Ze=XSD", "n": [ { "c": 2, "d": "PE OriginalFilename metadata field", "i": "metadata/package/versioning::pe-originalfilename-field", "o": 201442, "z": 16, "cf": 0.699999988079071 } ], "ln": 201426 }, { "b": "e=YzZyYFnK002s=5Dz?ipYLIozVBqFBPt[KBo25ove$cAwDhYg001bwc\u0026!b+wDl/Lf-S)ce=WN", "n": [ { "c": 2, "d": "PE ProductName metadata field", "i": "metadata/package/versioning::pe-productname-field", "o": 201530, "z": 11, "cf": 0.699999988079071 } ], "ln": 201514 }, { "b": "zVB?Udf6tF002W)6AwdlpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001\u003eRe=WQae=WN9e=W*gf-R", "n": [ { "c": 2, "d": "PE version resource metadata", "i": "metadata/package/versioning::version-resource-metadata", "o": 201598, "z": 14, "cf": 0.8999999761581421 } ], "ln": 201582 }, { "b": "0000000000000000000003zvz3\u0026*ncr6piY000000000000000000000000000000000", "n": [ { "c": 2, "d": "PE .reloc section presence", "i": "metadata/binary/section/names::reloc-section-presence", "o": 202240, "z": 6, "cf": 0.8999999761581421 } ], "ln": 202224 } ], "depth": 1, "facts": { "imp": [ [ "mscoree", "CorDllMain" ] ], "sec": [ [ ".text", 512, 200192, 6.18, "r-x" ], [ ".rsrc", 200704, 1536, 2.4, "r--" ], [ ".reloc", 202240, 512, 0.1, "r--" ] ], "metrics": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "resource_count": 1.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 242822.0, "reloc_overhang_bytes": 500.0, "reloc_overhang_ratio": 0.98, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "version.identity_entropy": 4.33, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0, "version.identity_symbol_ratio": 0.17 }, "file": { "size": 202752.0, "entropy": 6.15, "size_bytes": 202752.0 }, "binary": { "is_pie": 1.0, "code_entropy": 6.18, "string_count": 1486.0, "overall_entropy": 6.15, "entropy_variance": 6.29, "avg_string_length": 21.28, "max_string_length": 160.0, "peak_region_bytes": 5120.0, "code_to_data_ratio": 1.0, "peak_region_entropy": 6.53, "string_length_stddev": 13.02, "largest_section_ratio": 0.99, "sentence_string_count": 31.0, "sentence_string_ratio": 0.02, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 200192.0, "entropy_max": 6.18, "entropy_mean": 2.89, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } } }, "id": 11, "mol": "O(Al)H₂(CmDb)", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Shiny.Notifications/Shiny.Notifications.5.1.0.nupkg!!lib/net10.0-macos26.0/Shiny.Notifications.dll", "risk": 4, "sha": "09a8a3559fbd4471b877348ff564721401ad31094b6fd773e62c76bf5629d461", "size": 202752, "traits": [ { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "spans": [ [ 201270, 11 ] ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 200798, 15 ] ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "spans": [ [ 165022, 4 ] ] }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "spans": [ [ 0, 26 ] ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "spans": [ [ 88836, 4 ] ] }, { "id": "micro-behaviors/communications/http/server/managed::http-request-get", "conf": 1.0, "crit": 3, "desc": "Access to ASP.NET Request object", "spans": [ [ 174497, 11 ] ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "spans": [ [ 201598, 14 ] ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "micro-behaviors/data/db/linq::linq-queries", "conf": 0.699999988079071, "crit": 3, "desc": "LINQ query operations", "spans": [ [ 167473, 11 ] ] }, { "id": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "conf": 1.0, "crit": 3, "desc": "JSON polymorphism runtime marker", "spans": [ [ 158132, 16 ] ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "spans": [ [ 88836, 4 ] ] } ], "type": "pe" }, { "id": 12, "sha": "6efa5122931cfcd539262e7436300ab715fbbf2f0c28c8827cfac2b8e73d5c35", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Shiny.Notifications/Shiny.Notifications.5.1.0.nupkg!!lib/net10.0-macos26.0/Shiny.Notifications.xml", "size": 45011, "type": "xml", "depth": 1 }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J\u0026m(", "n": [ { "c": 3, "d": "HTTP fingerprinting evasion campaign", "i": "objectives/command-and-control/infrastructure/user-agent::http-fingerprinting-campaign", "o": 0, "z": 34, "cf": 0.8999999761581421 } ], "ln": 0 }, { "b": "00000000000000000000=s3.N00000nb@R\u00260SSx79f710KKsae0rr91000000000000", "n": [ { "c": 1, "d": "PE standard code/data section", "i": "metadata/binary/section/names::pe-code-data-standard-section", "o": 512, "z": 5, "cf": 0.8999999761581421 } ], "ln": 496 }, { "b": "(Jd4[0^=W600B.p0SSMSlq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn", "n": [ { "c": 3, "d": "Recognized PE anti-analysis marker", "i": "objectives/anti-analysis/debugger-detect/combined-checks::evasion-aware-recognized-pe-marker", "o": 28700, "z": 4, "cf": 1.0 } ], "ln": 28684 }, { "b": "uPw9Go(BM+y?k^gju=Kvq*ACawO\u003c4\u003epxiH!xKL^@wO+7HzEEf?AZ0q1jzX}GxjV9EpYJR0wD", "n": [ { "c": 2, "d": "System namespace reference", "i": "metadata/lang/compiler/managed::system-namespace", "o": 56798, "z": 9, "cf": 0.800000011920929 } ], "ln": 56782 }, { "b": "l2Z^Vx\u003e7N[x(v(Svrt]Tq*ACawO\u003c50wQ5qHn][]*e(Mt4x\u003c\u003e*(Dsp]fz/dg4wPRu\u003evrt]Tq*ACawO\u003c50", "n": [ { "c": 3, "d": "JSON polymorphism runtime marker", "i": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "o": 56932, "z": 16, "cf": 1.0 } ], "ln": 56916 }, { "b": "yHpBnvpK7!zF8BMwO+(Sjv9F0x(v)gk5jIjlsBwtx(mMMx\u003eq9\u003e06A+.zE)\u0026%By!#YwPzG[y?XibA.*T@x(v)gk5jIj", "n": [ { "c": 1, "d": "Regex component marker", "i": "objectives/persistence/login/scheduled-task/com::task-action-principal-properties--rx-4", "o": 57902, "z": 24, "cf": 0.8799999952316284 } ], "ln": 57886 }, { "b": "yHpBnvpK7!zF8BMwO+(Sq!o\u0026S06$NywO#2Ul$7gGrb3hXokeoO08NYOA86?UwNwwO", "n": [ { "c": 1, "d": ".NET Socket Send/Receive methods (Send)", "i": "micro-behaviors/communications/socket/create::socket-receive-send-str--send", "o": 58121, "z": 4, "cf": 0.800000011920929 } ], "ln": 58105 }, { "b": "zH0\u003cfz//Y9x\u003e7N[x(v)ge[w^m08drtwlrX+077*xy?cH-vrlJ)zeoh+wPRoJBy/p?", "n": [ { "c": 3, "d": "References Windows executable or script", "i": "objectives/execution/interpreter/script/shell::windows-executable-ref", "o": 61712, "z": 4, "cf": 0.6000000238418579 } ], "ln": 61696 }, { "b": "y\u003cwx^zF0P}B-H]jx(v\u003e?q*ACawO\u003c50wQ5qHn][]*e(Mt4x\u003c\u003e*(Dsp]fz/bLNxLzvfe\u003e72bwO#N6z/fRG", "n": [ { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 62241, "z": 16, "cf": 0.8500000238418579 } ], "ln": 62225 }, { "b": "zE^r@v%HT-ygQ)%x(v\u003e?q*ACawO\u003c4$wOb:\u0026v@#B6zu9mbwPz%dv}w2Cy\u00260V)BzkVh0cqZ[uRa)Fz/PzRzV", "n": [ { "c": 2, "d": "Benign high-entropy PE context", "i": "metadata/package/quality/false-positives::benign-high-entropy-pe-context", "o": 62474, "z": 17, "cf": 0.949999988079071 } ], "ln": 62458 }, { "b": "B7GD2l$HBHA+PGmx(v\u003e?q*ACawO\u003c50wQ5qHn][]*07g^rvru6/rb3hXt5Op\u0026nP5cU0b2\u003e+uSp-RwM\u003c1\u0026", "n": [ { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 62747, "z": 16, "cf": 0.8500000238418579 } ], "ln": 62731 }, { "b": "D2Ns^zF0!!xkzG}vqE$=q*ACawO\u003c50wQ5qHn][]*e(Mt4x\u003c\u003e*(Dsp]fz/dg4wPRu\u003evrt{gnLj5xzD7[2", "n": [ { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 62835, "z": 16, "cf": 0.8500000238418579 } ], "ln": 62819 }, { "b": "wO%!Mz#:@\u003cBydKUz/{10q*ACawO\u003c4[x(m[\u003clU{sxASxfYx()]YB.$P0ASw{Rz/wDWzdN6Nx(dz", "n": [ { "c": 3, "d": "LINQ query operations", "i": "micro-behaviors/data/db/linq::linq-queries", "o": 63099, "z": 11, "cf": 0.699999988079071 } ], "ln": 63083 }, { "b": "wN[.YA+PA7nmuyDy?mR!q*ACawO\u003c4!z!9AEz/49]z/6Dcy?mR!l2Z^Vx\u003e7N[x(v(Svrt{Bz/fV9x(mH507gWxw[+(", "n": [ { "c": 3, "d": ".NET dynamic code generation capability", "i": "metadata/lang/compiler/managed::dotnet-dynamic-code", "o": 64087, "z": 23, "cf": 0.8500000238418579 } ], "ln": 64071 }, { "b": "CYV?{xk8BeA::67z/fQ@p\u0026ZF[pgn0JuQngzx(v)g0b2\u003e+uQngzx(v)g0cqZ[uQngzx(v)g08mfqA=l2qw]]T]CYWImB7]MgB1Qd8xj\u003e{@xd=FV", "n": [ { "c": 1, "d": "Regex component marker", "i": "objectives/persistence/login/scheduled-task/com::task-action-principal-properties--rx-4", "o": 65706, "z": 16, "cf": 0.8799999952316284 } ], "ln": 65690 }, { "b": "C(R=4uRbcDADLYax([R2q*ACawO\u003c4#wN/\u003e6x([R2nM6bsz/YSmz/Qa(zGGPmC(Q/TzdMTSzGxJlx)ag", "n": [ { "c": 2, "d": "System namespace reference", "i": "metadata/lang/compiler/managed::system-namespace", "o": 67619, "z": 15, "cf": 0.800000011920929 } ], "ln": 67603 }, { "b": "ASx!Nz#:$Wx-J5Kzu6UEk(+x{Bo31PzVBUPA@VgPnDrPcz#:!RASygYve$fBv/Q6u01hZ", "n": [ { "c": 1, "d": "Regex component marker", "i": "objectives/persistence/login/scheduled-task/com::task-action-principal-properties--rx-4", "o": 69369, "z": 7, "cf": 0.8799999952316284 } ], "ln": 69353 }, { "b": "wO\u003c4!z!%l3v@#B6zGvuKr+lq)x(v(Lf!+jle?![iefEr5y\u0026\u003c/uwJ:{xB-.Ujy+cY9BZ/f3v[QxUrbVL-", "n": [ { "c": 2, "d": "IPv4-like .NET assembly version", "i": "metadata/lang/compiler/managed::dotnet-ipv4-like-version", "o": 82170, "z": 16, "cf": 0.8500000238418579 } ], "ln": 82154 }, { "b": "e\u003c\u003cqXzF\u003c34tu}jegYWO1q*ACawO\u003c50wQ5qHn][]*e(MXhA:@VJwO#71vruj4zvFrOe?![jg+HKxf!\u003eD:", "n": [ { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 82508, "z": 16, "cf": 0.8500000238418579 } ], "ln": 82492 }, { "b": "03zmM000000000000000000000000000000000315c8Xg7YTL^00000000000000000", "n": [ { "c": 1, "d": "PE resource section", "i": "metadata/binary/section/names::pe-resource-section", "o": 82944, "z": 5, "cf": 0.8999999761581421 } ], "ln": 82928 }, { "b": "0000000000006\u003ergYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006Xn[brp!0rrc21PR3", "n": [ { "c": 3, "d": "Recognized marker for timing checks", "i": "objectives/anti-analysis/timing/evasion::timing-anti-debug-recognized-marker", "o": 83038, "z": 15, "cf": 0.949999988079071 } ], "ln": 83022 }, { "b": "wDlowwb{VJ002aY4GDIflJz38z2!IPve$fBC(QOtve$cAwDhYg002p+yYFnKve$fBaokptx-JkPv/Qfxx-IYA002*}6AwdlmGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up002{$xAh-Dzua}Ze=XS", "n": [ { "c": 2, "d": "PE CompanyName metadata field", "i": "metadata/package/versioning::pe-companyname-field", "o": 83370, "z": 11, "cf": 0.699999988079071 }, { "c": 2, "d": "PE FileDescription metadata field", "i": "metadata/package/versioning::pe-filedescription-field", "o": 83430, "z": 15, "cf": 0.699999988079071 } ], "ln": 83354 }, { "b": "x-J5Kzua.T001+O2(\u003c#amGvc5yYF2DrSDXhASydXx-J5Kzu6Up001\u003eRe=WQae=WN9e=W*gf-RgN002*}7YTNpnDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE002{$xAh-Dzua}Ze=XSDzVB\u003eV", "n": [ { "c": 3, "d": "Dotted-quad PE version metadata marker", "i": "objectives/command-and-control/infrastructure/ip::ipv4-version-metadata-marker", "o": 83510, "z": 11, "cf": 0.9399999976158142 }, { "c": 2, "d": "PE InternalName metadata field", "i": "metadata/package/versioning::pe-internalname-field", "o": 83562, "z": 12, "cf": 0.699999988079071 } ], "ln": 83494 }, { "b": "xAibO001bw003a37YTNppxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE002{$xAh-Dzua}Ze=XSD", "n": [ { "c": 2, "d": "PE OriginalFilename metadata field", "i": "metadata/package/versioning::pe-originalfilename-field", "o": 83682, "z": 16, "cf": 0.699999988079071 } ], "ln": 83666 }, { "b": "e=YzZyYFnK003s99@(rwpYLIozVBqFBPt[KBo25ove$cAwDhYg001bwc\u0026!b+wDl/Lf-S)ce=WN", "n": [ { "c": 2, "d": "PE ProductName metadata field", "i": "metadata/package/versioning::pe-productname-field", "o": 83770, "z": 11, "cf": 0.699999988079071 } ], "ln": 83754 }, { "b": "e=WN9df6tF002W)6AwdlpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001\u003eRe=WQae=WN9e=W*gf-R", "n": [ { "c": 2, "d": "PE version resource metadata", "i": "metadata/package/versioning::version-resource-metadata", "o": 83866, "z": 14, "cf": 0.8999999761581421 } ], "ln": 83850 }, { "b": "000000000000000000000ak*c3\u0026*nc[g:[y000000000000000000000000000000000", "n": [ { "c": 2, "d": "PE .reloc section presence", "i": "metadata/binary/section/names::reloc-section-presence", "o": 84480, "z": 6, "cf": 0.8999999761581421 } ], "ln": 84464 } ], "depth": 1, "facts": { "imp": [ [ "mscoree", "CorDllMain" ] ], "sec": [ [ ".text", 512, 82432, 6.14, "r-x" ], [ ".rsrc", 82944, 1536, 2.46, "r--" ], [ ".reloc", 84480, 512, 0.1, "r--" ] ], "metrics": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "resource_count": 1.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 128792.0, "reloc_overhang_bytes": 500.0, "reloc_overhang_ratio": 0.98, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "version.identity_entropy": 4.4, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0, "version.identity_symbol_ratio": 0.33 }, "file": { "size": 84992.0, "entropy": 6.06, "size_bytes": 84992.0 }, "binary": { "is_pie": 1.0, "code_entropy": 6.14, "string_count": 854.0, "overall_entropy": 6.06, "entropy_variance": 6.17, "avg_string_length": 19.52, "max_string_length": 155.0, "peak_region_bytes": 5120.0, "code_to_data_ratio": 1.0, "peak_region_entropy": 6.14, "string_length_stddev": 12.82, "largest_section_ratio": 0.97, "sentence_string_count": 34.0, "sentence_string_ratio": 0.04, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 82432.0, "entropy_max": 6.14, "entropy_mean": 2.9, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } } }, "id": 13, "mol": "O(Al)H(Db)", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Shiny.Notifications/Shiny.Notifications.5.1.0.nupkg!!lib/net10.0-windows10.0.19041/Shiny.Notifications.dll", "risk": 3, "sha": "11e6d492523e04e99d9eaa188b3105c74e61d15bb4c2c52fee6a07947ff71432", "size": 84992, "traits": [ { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "spans": [ [ 83510, 11 ] ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 83038, 15 ] ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "spans": [ [ 61712, 4 ] ] }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "spans": [ [ 0, 26 ] ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "spans": [ [ 28700, 4 ] ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "spans": [ [ 83866, 14 ] ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "micro-behaviors/data/db/linq::linq-queries", "conf": 0.699999988079071, "crit": 3, "desc": "LINQ query operations", "spans": [ [ 63099, 11 ] ] }, { "id": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "conf": 1.0, "crit": 3, "desc": "JSON polymorphism runtime marker", "spans": [ [ 56932, 16 ] ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "spans": [ [ 28700, 4 ] ] } ], "type": "pe" }, { "id": 14, "sha": "3dfcdd3a62b0e77249f031c3b95abdb03e02c9325d859889902c9375e8cd6cd3", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Shiny.Notifications/Shiny.Notifications.5.1.0.nupkg!!lib/net10.0-windows10.0.19041/Shiny.Notifications.xml", "size": 37913, "type": "xml", "depth": 1 }, { "id": 15, "mol": "O(Al)H(Db)", "sha": "54b397ff2ef633ccf80403d3386983516c5ed81495d534ce8282d825fc2befe9", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Shiny.Notifications/Shiny.Notifications.5.1.0.nupkg!!lib/net10.0/Shiny.Notifications.dll", "risk": 3, "size": 75776, "type": "pe", "depth": 1 }, { "id": 16, "sha": "ece73c7e53c6f0dda5edb9e6ba82b25edbcae1ed8bfd17cd86d40be6211674f1", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Shiny.Notifications/Shiny.Notifications.5.1.0.nupkg!!lib/net10.0/Shiny.Notifications.xml", "size": 37364, "type": "xml", "depth": 1 }, { "id": 17, "sha": "bd529268e8af2025dc52503f2cf861225ae272241e4d63f66f6262a15c67f2f5", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Shiny.Notifications/Shiny.Notifications.5.1.0.nupkg!!readme.txt", "risk": 1, "size": 2295, "type": "text", "depth": 1 }, { "id": 18, "sha": "3d347727dfabd6029a9c768d07543d246305f26907eb2188cfcda13c71d5f732", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Shiny.Notifications/Shiny.Notifications.5.1.0.nupkg!![Content_Types].xml", "size": 716, "type": "xml", "depth": 1 }, { "id": 19, "sha": "1446f19e1ee350666088b8536719eae98de6ce16711885717464d7ba3e3ca04e", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Shiny.Notifications/Shiny.Notifications.5.1.0.nupkg!!package/services/metadata/core-properties/3acb3462a9254b8cb68676353ddce85f.psmdcp", "size": 779, "type": "xml", "depth": 1 }, { "id": 20, "sha": "7cb1b98a7dfa1625fa8f44d89a91cef510eb1fc155e446faed8fc55affd0002f", "path": "Shiny.Notifications@5.1.0.registry.json", "size": 796, "type": "registry", "depth": 1 } ], "omitted_files": 15, "rev": "46112", "v": "8" } }