{ "ml": { "v": "7", "eng": "2.5.0-beta.0", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.24887414, "rte": "az", "prob": 0.24887414 }, { "cls": 0, "raw": 0.0012420416, "rte": "az/nupkg", "prob": 0.0012420416 } ], "prob": 0.27800378, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.2780037820339203, "type": "nupkg" }, { "id": 5, "lvl": -1, "conf": 0, "prob": 0.2780037820339203, "type": "pe" }, { "id": 7, "lvl": -1, "conf": 0, "prob": 0.2780037820339203, "type": "pe" }, { "id": 9, "lvl": -1, "conf": 0, "prob": 0.2780037820339203, "type": "pe" }, { "id": 11, "lvl": -1, "conf": 0, "prob": 0.2780037820339203, "type": "pe" }, { "id": 15, "lvl": -1, "conf": 0, "prob": 0.000019530454665073194, "type": "registry" } ], "version": "v18.18", "analyzed_at": "2026-08-02T17:09:02Z" }, "path": "Corvus.Json.CodeGeneration.6.5.2.10.nupkg", "raw": { "files": [ { "id": 0, "ctx": [ { "b": "p!H([6Awak2MN?5}DK1NDWEau000i8000xb003wDwO=Ave]\u003eJtBcI*OyqIUwH5VGma]+nutwDp3qRBdtPw*r)owXm7\u003e7s}pYzEdsp@V[PFB/r5AmS^4NAcmk!xP%exbJ1eRbM9d4lZK@f6EEmtKMM-Q[9Gn)ixd", "n": [ { "c": 2, "d": "Archive contains an executable member", "i": "metadata/file/metrics::archive-contains-executable-member", "o": 0, "z": 31, "cf": 0.949999988079071 } ], "ln": 0 } ], "mol": "H(Cm)Md₂(BiPa)", "sha": "2f0268b48c7629e1c7d2a83d4ee660e96a817d69041d774767ec1ed0c9445b58", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Corvus.Json.CodeGeneration.6/Corvus.Json.CodeGeneration.6.5.2.10.nupkg", "risk": 4, "size": 39795, "type": "nupkg", "facts": { "metrics": { "file": { "size": 39795.0, "entropy": 7.9, "size_bytes": 39795.0 }, "binary": { "overall_entropy": 7.9, "peak_region_bytes": 35840.0, "peak_region_entropy": 7.81 }, "archive": { "file_count": 15.0, "member_count": 15.0, "script_count": 0.0, "zip_bomb_ratio": 5.4, "directory_count": 0.0, "executable_count": 4.0, "extra_field_size": 0.0, "noise_file_count": 0.0, "total_compressed": 37541.0, "compression.ratio": 0.54, "hidden_file_count": 2.0, "total_uncompressed": 69510.0, "crc_collision_count": 3.0, "entry_comment_count": 0.0, "max_filename_length": 81.0, "rtlo_filename_count": 0.0, "format.regular_count": 15.0, "nested_archive_count": 0.0, "path_traversal_count": 0.0, "symlink_escape_count": 0.0, "security.setgid_count": 0.0, "security.setuid_count": 0.0, "security.sticky_count": 0.0, "double_extension_count": 0.0, "duplicate_member_count": 0.0, "security.symlink_count": 0.0, "unicode_filename_count": 0.0, "homoglyph_filename_count": 0.0, "security.encrypted_count": 0.0, "timing.mtime_unique_count": 7.0, "timing.mtime_unique_ratio": 0.47, "misplaced_executable_count": 4.0, "timing.mtime_dominant_count": 4.0, "timing.mtime_spread_seconds": 22874.0, "timing.sentinel_mtime_count": 0.0, "security.world_writable_count": 0.0, "timing.mtime_dominant_fraction": 0.27, "compression.method_counts.stored": 1.0, "compression.method_counts.deflate": 14.0 } } }, "ident": { "name": { "value": "Corvus.Json.CodeGeneration.6", "source": "nupkg.title", "verified": false }, "urls": [ { "url": "https://github.com/corvus-dotnet/Corvus.JsonSchema", "kind": "repository", "source": "nupkg.repository_url" } ], "trust": "unsigned", "authors": [ { "name": "Endjin Limited", "role": "author", "source": "nupkg.authors" } ], "version": { "value": "5.2.10", "source": "nupkg.version", "verified": false }, "identifier": { "value": "Corvus.Json.CodeGeneration.6", "source": "nupkg.id", "verified": false } }, "traits": [ { "id": "micro-behaviors/communications/http/url/domain::http-url-binary", "atk": "T1071.001", "mbc": "C0002", "conf": 0.699999988079071, "crit": 3, "desc": "Embedded HTTP or WebSocket URL", "from": [ { "file": 5 } ] }, { "id": "metadata/package/versioning::pe-companyname-field", "conf": 0.699999988079071, "crit": 3, "desc": "PE version metadata includes CompanyName", "from": [ { "file": 5 } ] }, { "id": "metadata/binary/layout::pe-no-signature-record", "conf": 0.949999988079071, "crit": 3, "desc": "PE has no signature record" }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET metadata root signature (BSJB)", "from": [ { "file": 5 } ] }, { "id": "metadata/binary/anomaly/provenance::pe-far-future-timestamp", "conf": 0.949999988079071, "crit": 2, "desc": "PE COFF timestamp encodes a future date" }, { "id": "metadata/build/reproducible::pe-reproducible-build", "conf": 1.0, "crit": 2, "desc": "Built with /Brepro (deterministic)" }, { "id": "metadata/binary/metrics/entropy::code-entropy-at-most-7-5", "conf": 0.699999988079071, "crit": 1, "desc": "Code entropy is 7.5 or lower", "from": [ { "file": 5 } ], "spans": [ [ 0, 26 ] ] }, { "id": "metadata/package/versioning::pe-filedescription-field", "conf": 0.699999988079071, "crit": 3, "desc": "PE version metadata includes FileDescription", "from": [ { "file": 5 } ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET managed assembly", "from": [ { "off": 1260, "file": 5 }, { "off": 1260, "file": 7 }, { "off": 1260, "file": 9 }, { "off": 1304, "file": 11 } ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 3, "desc": "PE version metadata includes FileVersion", "from": [ { "file": 5 } ] }, { "id": "metadata/package/versioning::pe-productversion-semver-git-hash", "conf": 0.8999999761581421, "crit": 3, "desc": "PE ProductVersion has SemVer git hash", "spans": [ [ 8296, 47 ], [ 8808, 47 ] ] }, { "id": "metadata/package/versioning::pe-internalname-field", "conf": 0.699999988079071, "crit": 3, "desc": "PE version metadata includes InternalName", "from": [ { "file": 5 } ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "from": [ { "file": 5 } ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR header (COM descriptor)" }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 3, "desc": "PE version metadata includes ProductVersion", "from": [ { "file": 5 } ] } ] }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J\u0026m(0ji6Sa?dLD+]{51x(+zoA=kPhvqNb%vqY$3BrC47aAzQxazCZol@c-7zeS@@e!5l%bME/A00000p^\u003eu:oAtj}x7}k50000000000?#B@z3JR{Y02+?q00\u0026M800000K#JBw03zmw06*", "ln": 0 }, { "b": "000000000000000kMy^J00000000000000000000AYs4000000nb@R\u00260SSx7(((AffCBG!0rr910000000000000000000000000000000000000000000000000000", "ln": 480 }, { "b": "edi\u003cb000jAl\u0026Wh]dIM}(000uQy6b\u003c+000jw0SSi8z:\u003cZb3m(xf0rr97dIKujlq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCnD\u003cfMJbyPQ)\u003eMR1!\u003coL.=bu5Y8x(mN800000+NTWNFb/MHbumUxoB}g75c8Xgbs+:9l\u0026Wh!tO3(n!b]WJ", "ln": 1212 }, { "b": "x-I\u003c/x-HCrAaJ]$oLFPWA:-+:lVm0*B-PfcB8L}GlVlHDm}DNHA::67z/df=e[w^m08[e:By/p?lVm0*B-PfcB8L}GlVlHDm}DNHA::67z/bLND2[7sz7XZ$w]83*BzkVh07gWBC6d\u003cUn][]*08[e:By/qwraQq@e\u003eQh6zu9TOq/)4]zF8mMwj7fAvr8uowObv[y\u0026\u0026l^By/Giz!@\u003c7wN[.YA+PA7nmuyDy?mR!qE%GPB97#ll2HaED2)Lq07*jfv{@??y*?vfl2HaED2)Lq04}=6z/L?gv}fR0ASx3-B97#ge\u003c%zZxkRTeBzkla07gWBC6d\u003cUn][]*e\u003c\u003cL/wK*rHwPzj3x(v(woj-x)z/Pxf0b2\u003e+uRs%QCw?IjA@Yc:B97#ge(D?fBzkP6e\u003c\u003cL]Aa%c1A-lK\u0026C4\u003eC$A@XQtvS=r@x(mMTz!9B2", "ln": 4746 }, { "b": "vpBv}vrcR[r=qFRvS=G}A^pL]xk8BeA^mUdz!0i+B.\u003eGbC#wi^x(!xpC(Q/:C$hB/p\u0026ZF[wPz)r0000{xAibOBo3mWiSH/kf92.!A@ZaUzu8l*A@YXIxAhPzz2^#Ae=Y!\u0026ASx.Lf92I.ASxIFw=M]MeDvE8hukxgA@YXIxAhPzz2^#Abld-/DJjGP3ihgGaoiI:aoiO=bMI\u0026+wDlrxa]\u003cU7aoiO=00%?H4fc.nEe\u003clE0036CSeicBogU$E\u0026!-DpX)+TxaoqGG10vN", "ln": 5242 }, { "b": "wEf$:mn$x:fFk3)0rrP#zE^G@zxIR!ze196wb(Pr0rrv5wO+{^B7CsKjokBvlVl{?A+Pf1Brz#wdiI5%wnk*@awuG^x()]%atLSagCf!oy?$kmx\u003eIa3B0bHmB7GxnwN)y[05KYRfgow-x(mH6aARpdaA?WkvpBv}vrcSow]zYjBzbkdl#(ZFBrAE:wnbE*wN/*m000De00\u003eCmga\u003epne?^n9gYWOfh7*Tpf!+aovLY]3iB\u003e38gbpT$fFWb$hzNlIfL041fLa-Nhd!\u003c7h8/b9h-iC)03Ivy97aS", "ln": 6062 }, { "b": "0000000000000000000000000000000000000000000000000000000000315c8Xg7YTL^000000000000000000310rr91fAq960000000000000000003100000nb@R\u0026su(\u0026^SSSq40000000000SSUcU00341qVHe8rSCL*qufR}nDqJ^p5[S3nDqG=mGui:00000Y-^*6000310SSx7000ua0SSx7000uakl7V-000001onA40SSi2000000000000000l\u0026Wh!0rud2ve$rFmGvc5yYF2DnDrSdw=", "ln": 7136 }, { "b": "008c-00031fAr^bfAr^bfAr{fvGn7Z004lzfAqaNlJz38z2!zMwDlPFBo3vZ002y!wDlrxx-J2JwDl=KaolG-xAhPzaolM+zVBnEve%:pBPujTve$rFC(O@!w=M-HASviZBo2$OwDi?Ml\u0026.lcve%)tBo0A-huj\u003c1wb{rzve$9zwDliuBo0][002g.4/=RglJz38z2!IPve$fBC(QOtve$cAwDhYg002B/zuahEy5?@Fzu7^VoAn=bz2!nIBo2\u003eLwb(Pf003Ed9rl9umGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up002v^zVB!TB]VT+A@W/)n=S]jzVBUPe=XlszVBqFwDkj2wDlPFwDl-Jve$xHx-J5Kzu8o?huiZS001+O2(\u003c#amGvc5yYF2DrSDXhASydXx-J5Kzu6Up001\u003eRe=WTbe=WQafArZ9fAq7M003EdaPIJynDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE002v^zVB!TB]VT+A@W/)n=S]jzVBUPe=XlszVBqFwDkj2wDlPFwDl-Jve$xHx-J5Kzu8o?hukufwb{ACyYBCn005k-h#\u0026%VoAnS7x8(uuyYD*5zVB.RC(R\u003c+x-I=CxAibO002v^zVB.RC(R\u003c+x-I=CxAibOaoi!\u0026v/N}Taoj?gzuahEy5?@Fzu7^VoAn=bz2!nIBo2\u003eLwb).Lg5%0dg5%9ge=W0]k(+Z3yYCNTASx!Nx8(PBBo3vZaolAZwDl=KwDl-JB]V7Nwb[jZ003:laPIJypxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE002v^zVB!TB]VT+A@W/)n=S]jzVBUPe=XlszVBqFwDkj2wDlPFwDl-Jve$xHx-J5Kzu8o?hukufwb{ACyYBCn003g59rl9upYLIozVBqFBPt[KBo25ove$cAwDhYg002v^zVB!TB]VT+A@W/)n=S]jzVBUPe=XlszVBqFwDkj2wDlPFwDl-Jve$xHx-J5Kzu8o?huiZS004VLfAqaNpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001\u003eRe=WTbe=WQafArQ6humg^gxorkhVL\u0026rwb[H/gYPohg5%9gw=KH+g5$!:h#\u003e\u0026pg5%olhukAhwb[E!hVLJiwDliuh#\u003e/ow=K*\u003eg5%fihVNB\u0026hukVoh2]Gl0024W2(\u003c#ak(+%aA@Y+Kz2!2ByYF.XaokBxwDl-JA@Y[OzVBUP001\u003eRe=WTbe=WQafArZ9fAq7M000000000000000000000000000", "ln": 7450 }, { "b": "00000000000000000000000000000000000000000000000000000000000005axM3\u0026*ncLSeTy00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", "ln": 8656 } ], "depth": 1, "facts": { "imp": [ [ "mscoree", "CorDllMain" ] ], "sec": [ [ ".text", 512, 6656, 5.63, "r-x" ], [ ".rsrc", 7168, 1536, 2.95, "r--" ], [ ".reloc", 8704, 512, 0.08, "r--" ] ], "metrics": { "pe": { "checksum": 0, "timestamp": 3314284390, "image_size": 32768, "headers_size": 512, "checksum_valid": 0, "clr.is_il_only": 1, "file_alignment": 512, "resource_count": 1, "has_version_info": 1, "checksum_stripped": 1, "computed_checksum": 69939, "headers_size_ratio": 0.06, "prose_section_count": 0, "reloc_overhang_bytes": 500, "reloc_overhang_ratio": 0.98, "clr.is_32bit_required": 0, "bss_like_section_count": 0, "clr.is_32bit_preferred": 0, "clr.strong_name_signed": 0, "section_overflow_count": 0, "clr.is_native_entrypoint": 0, "misaligned_section_count": 0, "version.identity_entropy": 4.08, "base_relocation_block_count": 1, "base_relocation_entry_count": 1, "declared_data_directory_count": 6, "version.identity_symbol_ratio": 0.11, "executable_prose_section_count": 0, "directory_section_mismatch_count": 0 }, "file": { "size": 9216, "entropy": 4.94 }, "binary": { "is_pie": 1, "code_entropy": 5.63, "string_count": 155, "entropy_variance": 5.14, "avg_string_length": 20.52, "max_string_length": 142, "peak_region_bytes": 2048, "code_to_data_ratio": 1, "peak_region_entropy": 5.52, "string_length_stddev": 15.01, "largest_section_ratio": 0.72, "sentence_string_count": 5, "sentence_string_ratio": 0.03, "high_entropy_string_count": 0 }, "imports": { "count": 1 }, "sections": { "count": 3, "code_size": 6656, "entropy_max": 5.63, "entropy_mean": 2.89, "name_entropy": 3.03, "writable_count": 0, "executable_count": 1, "nonstandard_count": 0, "executable_writable_count": 0 }, "consistency": { "internal_name_original_filename_mismatch": 0 }, "dependencies": { "count": 1 } } }, "id": 5, "mol": "H(Cm)Md₃(BiPaSi)", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Corvus.Json.CodeGeneration.6/Corvus.Json.CodeGeneration.6.5.2.10.nupkg!!lib/net10.0/Corvus.Json.CodeGeneration.6.dll", "pid": 0, "risk": 5, "sha": "3f9b251671b4af689326e3169dcaa6b03896c6a102bcf5540c9f68a10f7a7599", "size": 9216, "traits": [ { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR header (COM descriptor)" }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET metadata root signature (BSJB)", "spans": [ [ 1260, 0 ] ] }, { "id": "metadata/binary/metrics/entropy::code-entropy-at-most-7-5", "conf": 0.7, "crit": 1, "desc": "Code entropy is 7.5 or lower", "spans": [ [ 0, 0 ] ] }, { "id": "metadata/binary/resource::pe-resource-version-first", "conf": 1.0, "crit": 2, "desc": "PE first resource is RT_VERSION" }, { "id": "metadata/binary/symbols/imports::single-import-raw", "conf": 0.7, "crit": 1, "desc": "PE import table has exactly one entry", "spans": [ [ 0, 0 ] ] }, { "id": "metadata/build/reproducible::pe-reproducible-build", "conf": 1.0, "crit": 2, "desc": "Built with /Brepro (deterministic)" }, { "id": "metadata/file/magic/identity::pe-dos-stub", "conf": 1.0, "crit": 2, "desc": "PE/DOS MZ header at file start", "spans": [ [ 0, 0 ] ] }, { "id": "metadata/lang/compiler/managed::reflection-namespace", "conf": 0.7, "crit": 2, "desc": ".NET System.Reflection namespace reference", "spans": [ [ 4833, 0 ] ] }, { "id": "metadata/package/versioning::pe-companyname-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes CompanyName", "spans": [ [ 7602, 11 ] ] }, { "id": "metadata/package/versioning::pe-filedescription-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes FileDescription", "spans": [ [ 7666, 15 ] ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes FileVersion", "spans": [ [ 7766, 11 ] ] }, { "id": "metadata/package/versioning::pe-internalname-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes InternalName", "spans": [ [ 7818, 12 ] ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes ProductVersion", "spans": [ [ 8266, 14 ] ] }, { "id": "metadata/package/versioning::pe-productversion-semver-git-hash", "conf": 0.9, "crit": 3, "desc": "PE ProductVersion has SemVer git hash", "spans": [ [ 8296, 47 ] ] }, { "id": "metadata/package/versioning::pe-version-file-version-value", "conf": 0.9, "crit": 3, "desc": "PE version resource carries a file version", "spans": [ [ 7792, 8 ] ] }, { "id": "metadata/package/versioning::pe-version-product-name-value", "conf": 0.9, "crit": 3, "desc": "PE version resource names a product", "spans": [ [ 8200, 28 ] ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.8, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 7262, 0 ] ] }, { "id": "metadata/binary/anomaly/provenance::pe-far-future-timestamp", "conf": 0.95, "crit": 2, "desc": "PE COFF timestamp encodes a future date" }, { "id": "metadata/binary/symbols/imports::single-import-count", "conf": 0.7, "crit": 3, "desc": "PE with single import", "spans": [ [ 0, 20 ] ] }, { "id": "metadata/signed/trust-level::unsigned-missing-signature-record", "conf": 0.9, "crit": 2, "desc": "PE lacks signature record" }, { "id": "micro-behaviors/communications/http/url/domain::http-url-binary", "atk": "T1071.001", "mbc": "C0002", "conf": 0.7, "crit": 3, "desc": "Embedded HTTP or WebSocket URL", "spans": [ [ 5306, 23 ] ] }, { "id": "objectives/evasion/indicator-removal/timestamps::header-timestamp-post-2030", "atk": "T1070.006", "conf": 0.78, "crit": 1, "desc": "PE header timestamp after 2030", "spans": [ [ 0, 0 ] ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET managed assembly", "uses": [ 0, 1 ], "spans": [ [ 1260, 0 ] ] }, { "id": "metadata/signed/trust-level::unsigned", "conf": 1.0, "crit": 3, "desc": "Binary is not digitally signed", "uses": [ 19 ] } ], "type": "pe" }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J\u0026m(0ji6Sa?dLD+]{51x(+zoA=kPhvqNb%vqY$3BrC47aAzQxazCZol@c-7zeS@@e!5l%bME/A00000", "n": [ { "c": 2, "d": "PE contains exactly one resource entry", "i": "metadata/binary/resource::pe-single-version-resource", "o": 0, "z": 24, "cf": 1.0 } ], "ln": 0 }, { "b": "000000000000000kMy^J00000000000000000000Ax0{#00000nb@R\u00260SSx7(((AffCBG!0rr91000000000000000000000000000000000000000000000000000000000000000008H../00B+\u0026ASDduA4i+}0@@r7a18ay000uQ8H.X!00B+K6efH*kMy=:0rr9i5=:0/7BP%$016tsA.#/pA3#C3016ts11jfI04OVZA=RiXA3#C3016tsc(h\u003c-3k9ys6=NbM0s71\u0026000uQ3kUfk0W[]^017gQ6efK?wb#Vg00000a0#%Y0003C7ap7301bCD7BQj501bCD7:{v701bCD87lH901bCD8yMTb01bCD8Z(^d01bCD94h{f01bCD9vJ6h01bCD9W\u0026ij01bCD9%\u003ctu000w2b{9ExbME/KQ9Q(?c)X\u0026[3zF**3[9C501bCD9$oRC000w2b{9QBc\u0026:kOQ9Q((c[bb@3zF**5gx1d01bCD9$Y[K000w2b{9:Fec2USQ9Q({c[LA03zF**6EUNl01bCD9#cgS000w2b{9)JfAq7WQ9Q($c[$Y43zF**7:}ct01bCD9#ME.000w2b{a3NgYNH.Q9Q)2c]y#83zF**94iYB01bCD9##:*000w2b{afRh#\u0026{=Q9Q)6c]?nc3zF**asGnJ01bCDa0A3]000w2b{arVjobu*Q9Q)ac{mLg3zF**bQ+?R01bCDa0\u0026s1000w2Fb]SI1AK!F00W@P000cK9S^-c", "n": [ { "c": 1, "d": "No section reaches compression-grade entropy", "i": "metadata/binary/metrics/threshold::no-compression-grade-section", "o": 512, "z": 512, "cf": 0.8999999761581421 } ], "ln": 480 }, { "b": "edi\u003cb000jAl\u0026Wh]dIM}(000uQy6b\u003c+000jw0SSi8z:\u003cZb3m(xf0rr97dIKujlq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCnD\u003cfMJbyPQ)\u003eMR1!\u003coL.=bu5Y8x(mN800000+NTWNFb/MHbumUxoB}g75c8Xgbs+:9l\u0026Wh!tO3(n!b]WJ", "n": [ { "c": 2, "d": ".NET metadata root signature (BSJB)", "i": "metadata/binary/framework::dotnet-metadata", "o": 1260, "z": 4, "cf": 1.0 } ], "ln": 1212 }, { "b": "x-I\u003c/x-HCrAaJ]$oLFPWA:-+:lVm0*B-PfcB8L}GlVlHDm}DNHA::67z/df=e[w^m08[e:By/p?lVm0*B-PfcB8L}GlVlHDm}DNHA::67z/bLND2[7sz7XZ$w]83*BzkVh07gWBC6d\u003cUn][]*08[e:By/qwraQq@e\u003eQh6zu9TOq/)4]zF8mMwj7fAvr8uowObv[y\u0026\u0026l^By/Giz!@\u003c7wN[.YA+PA7nmuyDy?mR!qE%GPB97#ll2HaED2)Lq07*jfv{@??y*?vfl2HaED2)Lq04}=6z/L?gv}fR0ASx3-B97#ge\u003c%zZxkRTeBzkla07gWBC6d\u003cUn][]*e\u003c\u003cL/wK*rHwPzj3x(v(woj-x)z/Pxf0b2\u003e+uRs%QCw?IjA@Yc:B97#ge(D?fBzkP6e\u003c\u003cL]Aa%c1A-lK\u0026C4\u003eC$A@XQtvS=r@x(mMTz!9B2", "n": [ { "c": 2, "d": ".NET System.Diagnostics namespace reference", "i": "metadata/lang/compiler/managed::diagnostics-namespace", "o": 4980, "z": 18, "cf": 0.75 }, { "c": 2, "d": ".NET System.Reflection namespace reference", "i": "metadata/lang/compiler/managed::reflection-namespace", "o": 4833, "z": 17, "cf": 0.699999988079071 }, { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 4863, "z": 16, "cf": 0.8500000238418579 }, { "c": 2, "d": ".dll extension reference", "i": "micro-behaviors/fs/path/extension::dll-dup", "o": 4794, "z": 4, "cf": 0.5 } ], "ln": 4746 }, { "b": "vpBv}vrcR[r=qFRvS=G}A^pL]xk8BeA^mUdz!0i+B.\u003eGbC#wi^x(!xpC(Q/:C$hB/p\u0026ZF[wPz)r0000{xAibOBo3mWiSH/kf92.!A@ZaUzu8l*A@YXIxAhPzz2^#Ae=Y!\u0026ASx.Lf92I.ASxIFw=M]MeDvE8hukxgA@YXIxAhPzz2^#Abld-/DJjGP3ihgGaoiI:aoiO=bMI\u0026+wDlrxa]\u003cU7aoiO=00%?H4fc.nEe\u003clE003u*8-D\u003cFFKWa+VGVE9Gsy):aoqGG10vN", "n": [ { "c": 3, "d": "Embedded HTTP or WebSocket URL", "i": "micro-behaviors/communications/http/url/domain::http-url-binary", "o": 5306, "z": 23, "cf": 0.699999988079071 } ], "ln": 5242 }, { "b": "zdJ#9pdnb8i4=(#0rrP#zE^G@zxIR!ze196wb(Pr0rrv5wO+{^B7CsKjokBvlVl{?A+Pf1Brz#wdiI5%wnk*@awuG^x()]%atLSagCf!oy?$kmx\u003eIa3B0bHmB7GxnwN)y[05KYRfgow-x(mH6aARpdaA?WkvpBv}vrcSow]zYjBzbkdl#(ZFBrAE:wnbE*wD", "n": [ { "c": 2, "d": "Copyright notice", "i": "metadata/package/license::copyright-word", "o": 6108, "z": 9, "cf": 0.6000000238418579 } ], "ln": 6060 }, { "b": "0000000000000000000000000000000000000000000000000000000000315c8Xg7YTL^000000000000000000310rr91fAq960000000000000000003100000nb@R\u0026su(\u0026^SSSq40000000000SSUcU00341qVHe8rSCL*qufR}nDqJ^p5[S3nDqG=mGui:00000Y-^*6000310SSx7000ua0SSx7000uakl7V-000001onA40SSi2000000000000000l\u0026Wh!0rud2ve$rFmGvc5yYF2DnDrSdw=", "n": [ { "c": 2, "d": "PE version resource metadata", "i": "metadata/package/versioning::version-resource-metadata", "o": 7262, "z": 15, "cf": 0.8999999761581421 }, { "c": 1, "d": "PE resource section", "i": "metadata/binary/section/names::pe-resource-section", "o": 7168, "z": 5, "cf": 0.8999999761581421 } ], "ln": 7136 }, { "b": "008c-00031fAr^bfAr^bfAr{fvGn7Z004lzfAqaNlJz38z2!zMwDlPFBo3vZ002y!wDlrxx-J2JwDl=KaolG-xAhPzaolM+zVBnEve%:pBPujTve$rFC(O@!w=M-HASviZBo2$OwDi?Ml\u0026.lcve%)tBo0A-huj\u003c1wb{rzve$9zwDliuBo0][002g.4/=RglJz38z2!IPve$fBC(QOtve$cAwDhYg002B/zuahEy5?@Fzu7^VoAn=bz2!nIBo2\u003eLwb(Pf003Ed9rl9umGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up002v^zVB!TB]VT+A@W/)n=S]jzVBUPe=XlszVBqFwDkj2wDlPFwDl-Jve$xHx-J5Kzu8o?huiZS001+O2(\u003c#amGvc5yYF2DrSDXhASydXx-J5Kzu6Up001\u003eRe=WTbe=WQafArZ9fAq7M003EdaPIJynDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE002v^zVB!TB]VT+A@W/)n=S]jzVBUPe=XlszVBqFwDkj2wDlPFwDl-Jve$xHx-J5Kzu8o?hukufwb{ACyYBCn005k-h#\u0026%VoAnS7x8(uuyYD*5zVB.RC(R\u003c+x-I=CxAibO002v^zVB.RC(R\u003c+x-I=CxAibOaoi!\u0026v/N}Taoj?gzuahEy5?@Fzu7^VoAn=bz2!nIBo2\u003eLwb).Lg5%0dg5%9ge=W0]k(+Z3yYCNTASx!Nx8(PBBo3vZaolAZwDl=KwDl-JB]V7Nwb[jZ003:laPIJypxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE002v^zVB!TB]VT+A@W/)n=S]jzVBUPe=XlszVBqFwDkj2wDlPFwDl-Jve$xHx-J5Kzu8o?hukufwb{ACyYBCn003g59rl9upYLIozVBqFBPt[KBo25ove$cAwDhYg002v^zVB!TB]VT+A@W/)n=S]jzVBUPe=XlszVBqFwDkj2wDlPFwDl-Jve$xHx-J5Kzu8o?huiZS004VLfAqaNpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001\u003eRe=WTbe=WQafArQ6humg^gxorkhVL\u0026rwb[H/gYPohg5%9gw=KH+g5$!:h#\u003e\u0026pg5%olhukAhwb[E!hVLJiwDliuh#\u003e/ow=K*\u003eg5%fihVNB\u0026hukVoh2]Gl0024W2(\u003c#ak(+%aA@Y+Kz2!2ByYF.XaokBxwDl-JA@Y[OzVBUP001\u003eRe=WTbe=WQafArZ9fAq7M000000000000000000000000000", "n": [ { "c": 3, "d": "PE version metadata includes CompanyName", "i": "metadata/package/versioning::pe-companyname-field", "o": 7602, "z": 11, "cf": 0.699999988079071 }, { "c": 3, "d": "PE version metadata includes FileDescription", "i": "metadata/package/versioning::pe-filedescription-field", "o": 7666, "z": 15, "cf": 0.699999988079071 }, { "c": 3, "d": "PE version metadata includes FileVersion", "i": "metadata/package/versioning::pe-fileversion-field", "o": 7766, "z": 11, "cf": 0.699999988079071 }, { "c": 3, "d": "PE version metadata includes InternalName", "i": "metadata/package/versioning::pe-internalname-field", "o": 7818, "z": 12, "cf": 0.699999988079071 }, { "c": 3, "d": "PE version metadata includes ProductVersion", "i": "metadata/package/versioning::pe-productversion-field", "o": 8266, "z": 14, "cf": 0.699999988079071 }, { "c": 3, "d": "PE ProductVersion has SemVer git hash", "i": "metadata/package/versioning::pe-productversion-semver-git-hash", "o": 8296, "z": 47, "cf": 0.8999999761581421 }, { "c": 2, "d": "PE OriginalFilename metadata field", "i": "metadata/package/versioning::pe-originalfilename-field", "o": 8066, "z": 16, "cf": 0.699999988079071 }, { "c": 1, "d": "Several short title-cased resource strings", "i": "metadata/binary/resource::short-titlecase-resource-words", "o": 7482, "z": 8, "cf": 0.800000011920929 }, { "c": 1, "d": "PE version company name populated", "i": "metadata/package/versioning::pe-company-name-populated", "o": 7628, "z": 14, "cf": 0.8500000238418579 }, { "c": 1, "d": "PE FileDescription field is populated", "i": "metadata/package/versioning::pe-file-description-present", "o": 7700, "z": 28, "cf": 0.949999988079071 }, { "c": 1, "d": "PE LegalCopyright field is populated", "i": "metadata/package/versioning::pe-legal-copyright-present", "o": 7948, "z": 55, "cf": 0.949999988079071 }, { "c": 1, "d": "PE ProductName field is populated", "i": "metadata/package/versioning::pe-product-name-present", "o": 8200, "z": 28, "cf": 0.949999988079071 }, { "c": 1, "d": "PE FileVersion value is present", "i": "metadata/package/versioning::version-info-file-version-present", "o": 7792, "z": 8, "cf": 0.949999988079071 } ], "ln": 7450 }, { "b": "00000000000000000000000000000000000000000000000000000000000005axM3\u0026*ncLSeTy00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", "n": [ { "c": 2, "d": "PE .reloc section presence", "i": "metadata/binary/section/names::reloc-section-presence", "o": 8704, "z": 6, "cf": 0.8999999761581421 } ], "ln": 8656 } ], "depth": 1, "facts": { "imp": [ [ "mscoree", "CorDllMain" ] ], "sec": [ [ ".text", 512, 6656, 5.63, "r-x" ], [ ".rsrc", 7168, 1536, 2.95, "r--" ], [ ".reloc", 8704, 512, 0.08, "r--" ] ], "metrics": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "clr.is_il_only": 1.0, "resource_count": 1.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 29158.0, "reloc_overhang_bytes": 500.0, "reloc_overhang_ratio": 0.98, "clr.is_32bit_required": 0.0, "bss_like_section_count": 0.0, "clr.is_32bit_preferred": 0.0, "clr.strong_name_signed": 0.0, "section_overflow_count": 0.0, "clr.is_native_entrypoint": 0.0, "misaligned_section_count": 0.0, "version.identity_entropy": 4.08, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0, "declared_data_directory_count": 6.0, "version.identity_symbol_ratio": 0.11 }, "file": { "size": 9216.0, "entropy": 4.94, "size_bytes": 9216.0 }, "binary": { "is_pie": 1.0, "code_entropy": 5.63, "string_count": 156.0, "overall_entropy": 4.94, "entropy_variance": 5.13, "avg_string_length": 20.37, "max_string_length": 141.0, "peak_region_bytes": 2048.0, "code_to_data_ratio": 1.0, "peak_region_entropy": 5.52, "string_length_stddev": 14.92, "largest_section_ratio": 0.72, "sentence_string_count": 5.0, "sentence_string_ratio": 0.03, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 6656.0, "entropy_max": 5.63, "entropy_mean": 2.89, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } } }, "id": 7, "mol": "H(Cm)Md₂(BiPa)", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Corvus.Json.CodeGeneration.6/Corvus.Json.CodeGeneration.6.5.2.10.nupkg!!lib/net8.0/Corvus.Json.CodeGeneration.6.dll", "pid": 0, "risk": 4, "sha": "b899e8f119b08bb3bda921490e1e3f0937bd225b9bc116d4baa3a60fa52657de", "size": 9216, "traits": [ { "id": "metadata/package/versioning::pe-companyname-field", "conf": 0.699999988079071, "crit": 3, "desc": "PE version metadata includes CompanyName", "spans": [ [ 7602, 11 ] ] }, { "id": "metadata/package/versioning::pe-internalname-field", "conf": 0.699999988079071, "crit": 3, "desc": "PE version metadata includes InternalName", "spans": [ [ 7818, 12 ] ] }, { "id": "metadata/package/versioning::pe-filedescription-field", "conf": 0.699999988079071, "crit": 3, "desc": "PE version metadata includes FileDescription", "spans": [ [ 7666, 15 ] ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 3, "desc": "PE version metadata includes FileVersion", "spans": [ [ 7766, 11 ] ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 3, "desc": "PE version metadata includes ProductVersion", "spans": [ [ 8266, 14 ] ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET metadata root signature (BSJB)", "spans": [ [ 1260, 4 ] ] }, { "id": "metadata/binary/metrics/entropy::code-entropy-at-most-7-5", "conf": 0.699999988079071, "crit": 1, "desc": "Code entropy is 7.5 or lower", "spans": [ [ 0, 26 ] ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 7262, 15 ] ] }, { "id": "metadata/build/reproducible::pe-reproducible-build", "conf": 1.0, "crit": 2, "desc": "Built with /Brepro (deterministic)" }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR header (COM descriptor)" }, { "id": "metadata/package/versioning::pe-productversion-semver-git-hash", "conf": 0.8999999761581421, "crit": 3, "desc": "PE ProductVersion has SemVer git hash", "spans": [ [ 8296, 47 ] ] }, { "id": "metadata/binary/anomaly/provenance::pe-far-future-timestamp", "conf": 0.949999988079071, "crit": 2, "desc": "PE COFF timestamp encodes a future date" }, { "id": "micro-behaviors/communications/http/url/domain::http-url-binary", "atk": "T1071.001", "mbc": "C0002", "conf": 0.699999988079071, "crit": 3, "desc": "Embedded HTTP or WebSocket URL", "spans": [ [ 5306, 23 ] ] }, { "id": "metadata/binary/layout::pe-no-signature-record", "conf": 0.949999988079071, "crit": 3, "desc": "PE has no signature record" }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET managed assembly", "spans": [ [ 1260, 4 ] ] } ], "type": "pe" }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J\u0026m(0ji6Sa?dLD+]{51x(+zoA=kPhvqNb%vqY$3BrC47aAzQxazCZol@c-7zeS@@e!5l%bME/A00000p^\u003eu:oAtj}Hz2DE0000000000?#B@z3JR{Y02+?q00\u0026M800000K#JBw03zmw06*", "ln": 0 }, { "b": "000000000000000kMy^J00000000000000000000Ax0{#00000nb@R\u00260SSx7(((AffCBG!0rr910000000000000000000000000000000000000000000000000000", "ln": 480 }, { "b": "edi\u003cb000jAl\u0026Wh]dIM}(000uQy6b\u003c+000jw0SSi8z:\u003cZb3m(xf0rr97dIKujlq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCnD\u003cfMJbyPQ)\u003eMR1!\u003coL.=bu5Y8x(mN800000+NTWNFb/MHbumUxoB}g75c8Xgbs+:9l\u0026Wh!tO3(n!b]WJ", "ln": 1212 }, { "b": "x-I\u003c/x-HCrAaJ]$oLFPWA:-+:lVm0*B-PfcB8L}GlVlHDm}DNHA::67z/df=e[w^m08[e:By/p?lVm0*B-PfcB8L}GlVlHDm}DNHA::67z/bLND2[7sz7XZ$w]83*BzkVh07gWBC6d\u003cUn][]*08[e:By/qwraQq@e\u003eQh6zu9TOq/)4]zF8mMwj7fAvr8uowObv[y\u0026\u0026l^By/Giz!@\u003c7wN[.YA+PA7nmuyDy?mR!qE%GPB97#ll2HaED2)Lq07*jfv{@??y*?vfl2HaED2)Lq04}=6z/L?gv}fR0ASx3-B97#ge\u003c%zZxkRTeBzkla07gWBC6d\u003cUn][]*e\u003c\u003cL/wK*rHwPzj3x(v(woj-x)z/Pxf0b2\u003e+uRs%QCw?IjA@Yc:B97#ge(D?fBzkP6e\u003c\u003cL]Aa%c1A-lK\u0026C4\u003eC$A@XQtvS=r@x(mMTz!9B2", "ln": 4746 }, { "b": "vpBv}vrcR[r=qFRvS=G}A^pL]xk8BeA^mUdz!0i+B.\u003eGbC#wi^x(!xpC(Q/:C$hB/p\u0026ZF[wPz)r0000{xAibOBo3mWiSH/kf92.!A@ZaUzu8l*A@YXIxAhPzz2^#Ae=Y!\u0026ASx.Lf92I.ASxIFw=M]MeDvE8hukxgA@YXIxAhPzz2^#Abld-/DJjGP3ihgGaoiI:aoiO=bMI\u0026+wDlrxa]\u003cU7aoiO=00%?H4fc.nEe\u003clE000$\u003cNg)7y]?zW2CVx(qToFUcaoqGG10vN", "ln": 5242 }, { "b": "zdJ#9pdnb8iw9000rrP#zE^G@zxIR!ze196wb(Pr0rrv5wO+{^B7CsKjokBvlVl{?A+Pf1Brz#wdiI5%wnk*@awuG^x()]%atLSagCf!oy?$kmx\u003eIa3B0bHmB7GxnwN)y[05KYRfgow-x(mH6aARpdaA?WkvpBv}vrcSow]zYjBzbkdl#(ZFBrAE:wnbE*wN/*m000De00\u003eCmga\u003epne?^n9gYWOfh7*Tpf!+aovLY]3iB\u003e38gbpT$fFWb$hzNlIfL041fLa-Nhd!\u003c7h8/b9h-iC)03Ivy97aS", "ln": 6060 }, { "b": "0000000000000000000000000000000000000000000000000000000000315c8Xg7YTL^000000000000000000310rr91fAq960000000000000000003100000nb@R\u0026su(\u0026^SSSq40000000000SSUcU00341qVHe8rSCL*qufR}nDqJ^p5[S3nDqG=mGui:00000Y-^*6000310SSx7000ua0SSx7000uakl7V-000001onA40SSi2000000000000000l\u0026Wh!0rud2ve$rFmGvc5yYF2DnDrSdw=", "ln": 7136 }, { "b": "008c-00031fAr^bfAr^bfAr{fvGn7Z004lzfAqaNlJz38z2!zMwDlPFBo3vZ002y!wDlrxx-J2JwDl=KaolG-xAhPzaolM+zVBnEve%:pBPujTve$rFC(O@!w=M-HASviZBo2$OwDi?Ml\u0026.lcve%)tBo0A-huj\u003c1wb{rzve$9zwDliuBo0][002g.4/=RglJz38z2!IPve$fBC(QOtve$cAwDhYg002B/zuahEy5?@Fzu7^VoAn=bz2!nIBo2\u003eLwb(Pf003Ed9rl9umGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up002v^zVB!TB]VT+A@W/)n=S]jzVBUPe=XlszVBqFwDkj2wDlPFwDl-Jve$xHx-J5Kzu8o?huiZS001+O2(\u003c#amGvc5yYF2DrSDXhASydXx-J5Kzu6Up001\u003eRe=WTbe=WQafArZ9fAq7M003EdaPIJynDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE002v^zVB!TB]VT+A@W/)n=S]jzVBUPe=XlszVBqFwDkj2wDlPFwDl-Jve$xHx-J5Kzu8o?hukufwb{ACyYBCn005k-h#\u0026%VoAnS7x8(uuyYD*5zVB.RC(R\u003c+x-I=CxAibO002v^zVB.RC(R\u003c+x-I=CxAibOaoi!\u0026v/N}Taoj?gzuahEy5?@Fzu7^VoAn=bz2!nIBo2\u003eLwb).Lg5%0dg5%9ge=W0]k(+Z3yYCNTASx!Nx8(PBBo3vZaolAZwDl=KwDl-JB]V7Nwb[jZ003:laPIJypxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE002v^zVB!TB]VT+A@W/)n=S]jzVBUPe=XlszVBqFwDkj2wDlPFwDl-Jve$xHx-J5Kzu8o?hukufwb{ACyYBCn003g59rl9upYLIozVBqFBPt[KBo25ove$cAwDhYg002v^zVB!TB]VT+A@W/)n=S]jzVBUPe=XlszVBqFwDkj2wDlPFwDl-Jve$xHx-J5Kzu8o?huiZS004VLfAqaNpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001\u003eRe=WTbe=WQafArQ6humg^gxorkhVL\u0026rwb[H/gYPohg5%9gw=KH+g5$!:h#\u003e\u0026pg5%olhukAhwb[E!hVLJiwDliuh#\u003e/ow=K*\u003eg5%fihVNB\u0026hukVoh2]Gl0024W2(\u003c#ak(+%aA@Y+Kz2!2ByYF.XaokBxwDl-JA@Y[OzVBUP001\u003eRe=WTbe=WQafArZ9fAq7M000000000000000000000000000", "ln": 7450 }, { "b": "00000000000000000000000000000000000000000000000000000000000005axM3\u0026*ncLSeTy00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", "ln": 8656 } ], "depth": 1, "facts": { "imp": [ [ "mscoree", "CorDllMain" ] ], "sec": [ [ ".text", 512, 6656, 5.63, "r-x" ], [ ".rsrc", 7168, 1536, 2.95, "r--" ], [ ".reloc", 8704, 512, 0.08, "r--" ] ], "metrics": { "pe": { "checksum": 0, "timestamp": 2944995975, "image_size": 32768, "headers_size": 512, "checksum_valid": 0, "clr.is_il_only": 1, "file_alignment": 512, "resource_count": 1, "has_version_info": 1, "checksum_stripped": 1, "computed_checksum": 18429, "headers_size_ratio": 0.06, "prose_section_count": 0, "reloc_overhang_bytes": 500, "reloc_overhang_ratio": 0.98, "clr.is_32bit_required": 0, "bss_like_section_count": 0, "clr.is_32bit_preferred": 0, "clr.strong_name_signed": 0, "section_overflow_count": 0, "clr.is_native_entrypoint": 0, "misaligned_section_count": 0, "version.identity_entropy": 4.08, "base_relocation_block_count": 1, "base_relocation_entry_count": 1, "declared_data_directory_count": 6, "version.identity_symbol_ratio": 0.11, "executable_prose_section_count": 0, "directory_section_mismatch_count": 0 }, "file": { "size": 9216, "entropy": 4.94 }, "binary": { "is_pie": 1, "code_entropy": 5.63, "string_count": 156, "entropy_variance": 5.14, "avg_string_length": 20.37, "max_string_length": 141, "peak_region_bytes": 2048, "code_to_data_ratio": 1, "peak_region_entropy": 5.51, "string_length_stddev": 14.92, "largest_section_ratio": 0.72, "sentence_string_count": 5, "sentence_string_ratio": 0.03, "high_entropy_string_count": 0 }, "imports": { "count": 1 }, "sections": { "count": 3, "code_size": 6656, "entropy_max": 5.63, "entropy_mean": 2.89, "name_entropy": 3.03, "writable_count": 0, "executable_count": 1, "nonstandard_count": 0, "executable_writable_count": 0 }, "consistency": { "internal_name_original_filename_mismatch": 0 }, "dependencies": { "count": 1 } } }, "id": 9, "mol": "H(Cm)Md₃(BiPaSi)", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Corvus.Json.CodeGeneration.6/Corvus.Json.CodeGeneration.6.5.2.10.nupkg!!lib/net9.0/Corvus.Json.CodeGeneration.6.dll", "pid": 0, "risk": 5, "sha": "3848b354e334dedbc616a8d3279cd99852275e57ab69a7f3ccd4f05d449525bc", "size": 9216, "traits": [ { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR header (COM descriptor)" }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET metadata root signature (BSJB)", "spans": [ [ 1260, 0 ] ] }, { "id": "metadata/binary/metrics/entropy::code-entropy-at-most-7-5", "conf": 0.7, "crit": 1, "desc": "Code entropy is 7.5 or lower", "spans": [ [ 0, 0 ] ] }, { "id": "metadata/binary/resource::pe-resource-version-first", "conf": 1.0, "crit": 2, "desc": "PE first resource is RT_VERSION" }, { "id": "metadata/binary/symbols/imports::single-import-raw", "conf": 0.7, "crit": 1, "desc": "PE import table has exactly one entry", "spans": [ [ 0, 0 ] ] }, { "id": "metadata/build/reproducible::pe-reproducible-build", "conf": 1.0, "crit": 2, "desc": "Built with /Brepro (deterministic)" }, { "id": "metadata/file/magic/identity::pe-dos-stub", "conf": 1.0, "crit": 2, "desc": "PE/DOS MZ header at file start", "spans": [ [ 0, 0 ] ] }, { "id": "metadata/lang/compiler/managed::reflection-namespace", "conf": 0.7, "crit": 2, "desc": ".NET System.Reflection namespace reference", "spans": [ [ 4833, 0 ] ] }, { "id": "metadata/package/versioning::pe-companyname-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes CompanyName", "spans": [ [ 7602, 11 ] ] }, { "id": "metadata/package/versioning::pe-filedescription-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes FileDescription", "spans": [ [ 7666, 15 ] ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes FileVersion", "spans": [ [ 7766, 11 ] ] }, { "id": "metadata/package/versioning::pe-internalname-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes InternalName", "spans": [ [ 7818, 12 ] ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.7, "crit": 3, "desc": "PE version metadata includes ProductVersion", "spans": [ [ 8266, 14 ] ] }, { "id": "metadata/package/versioning::pe-productversion-semver-git-hash", "conf": 0.9, "crit": 3, "desc": "PE ProductVersion has SemVer git hash", "spans": [ [ 8296, 47 ] ] }, { "id": "metadata/package/versioning::pe-version-file-version-value", "conf": 0.9, "crit": 3, "desc": "PE version resource carries a file version", "spans": [ [ 7792, 8 ] ] }, { "id": "metadata/package/versioning::pe-version-product-name-value", "conf": 0.9, "crit": 3, "desc": "PE version resource names a product", "spans": [ [ 8200, 28 ] ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.8, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 7262, 0 ] ] }, { "id": "metadata/binary/anomaly/provenance::pe-far-future-timestamp", "conf": 0.95, "crit": 2, "desc": "PE COFF timestamp encodes a future date" }, { "id": "metadata/binary/symbols/imports::single-import-count", "conf": 0.7, "crit": 3, "desc": "PE with single import", "spans": [ [ 0, 20 ] ] }, { "id": "metadata/signed/trust-level::unsigned-missing-signature-record", "conf": 0.9, "crit": 2, "desc": "PE lacks signature record" }, { "id": "micro-behaviors/communications/http/url/domain::http-url-binary", "atk": "T1071.001", "mbc": "C0002", "conf": 0.7, "crit": 3, "desc": "Embedded HTTP or WebSocket URL", "spans": [ [ 5306, 23 ] ] }, { "id": "objectives/evasion/indicator-removal/timestamps::header-timestamp-post-2030", "atk": "T1070.006", "conf": 0.78, "crit": 1, "desc": "PE header timestamp after 2030", "spans": [ [ 0, 0 ] ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET managed assembly", "uses": [ 0, 1 ], "spans": [ [ 1260, 0 ] ] }, { "id": "metadata/signed/trust-level::unsigned", "conf": 1.0, "crit": 3, "desc": "Binary is not digitally signed", "uses": [ 19 ] } ], "type": "pe" }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J\u0026m(0ji6Sa?dLD+]{51x(+zoA=kPhvqNb%vqY$3BrC47aAzQxazCZol@c-7zeS@@e!5l%bME/A00000", "n": [ { "c": 2, "d": "PE contains exactly one resource entry", "i": "metadata/binary/resource::pe-single-version-resource", "o": 0, "z": 24, "cf": 1.0 } ], "ln": 0 }, { "b": "000000000000000kMy^J00000000000000000000q91WS00000nb@R\u00260SSx77:x1X*.x!?0rr91000000000000000000000000000000000000000000000000000000000000000009S^-3000uQuihI^000uc7MxKq00awY1dT=u000cKiSZYv000uc1apgI00B=j0W[PW015=fEf6xG1s=Clc\u003eDvU3iyrT0@@r7dJi:t000cK8GC\u0026U0b%zCE*b(M1rP1j5Dz!rdJi:s000cK6efE/9@(ov0rr9iA.#/pA084p0003F5=.[s5=?[C8uo:r1$gb+017g.7B*Ecc\u003e(TY3mV2Q6efK?wb#Vg00000a0#%Z0003C7ao)$01bCD7BQ4001bCD7:{g201bCD87ls401bCD8yME601bCD8Z(Q801bCD94h:a01bCD9vI)c01bCD9W\u00263e01bCD9%\u003ctp000w2b{9Ex9@(oFQ9Q(?c)eG\u00263zF**3[9n001bCD9$oRx000w2b{9QBbldYJQ9Q((c)O=)3zF**5gw?801bCD9$Y[F000w2b{9:FcJBbNQ9Q({c[25}3zF**6EUyg01bCD9#cgN000w2b{9)Jd/YLRQ9Q($c[Ct#3zF**7:{%o01bCD9#MEV000w2b{a3Nf8$$VQ9Q)2c[\u003eS33zF**94iJw01bCD9##:+000w2b{afRgxmyZQ9Q)6c]p]73zF**asG8E01bCDa0A3\u003c000w2b{arVhVJ*+Q9Q)a", "n": [ { "c": 1, "d": "No section reaches compression-grade entropy", "i": "metadata/binary/metrics/threshold::no-compression-grade-section", "o": 512, "z": 512, "cf": 0.8999999761581421 } ], "ln": 480 }, { "b": "edi\u003cg000jAkl7V\u003cdIM}*000uQy6b\u003c*000jw2lj-dz:sv63m(xf1][ScdIKujlq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCnpZl$2byPQ)YAXApjp7#/bu5Y8x(mN800000{Z^A9HYvzPbumUxFdR+Y5c8Xgbs+:9l\u0026Wh!Kp.D)oAUs}", "n": [ { "c": 2, "d": ".NET metadata root signature (BSJB)", "i": "metadata/binary/framework::dotnet-metadata", "o": 1304, "z": 4, "cf": 1.0 } ], "ln": 1256 }, { "b": "wO\u003e\u003cLvrue.xjVf(rDq^Nx(W[/lVm0*B-PfcB8L}GlVlHDm}DNHA::67z/df=e[w^m08[e:By/p?r+lq)x(v\u003e?lVm0*B-PfcB8L}GlVlHDm}DNHA::67z/bLND2[7sz7XZ$w]83*BzkVh07gWBC6d\u003cUn][]*08[e:By/qwraQq@e\u003eQh6zu9NCxk8BewPy7OvqHjgwPv=xr=qFRvS=G}A^o@*vqHjgwPv=6v@#Tf04}+\u003eBz(g1q*ACawO\u003c4/x\u003c\u003eT(z/Z2mv@?Sqz/Q2zB1Q7az/df{z!9AHwO#71vruj4zz1N[D3sgEwod--wPRoLwQeGrA+6j\u003eq*ACawO\u003c4$B-8qnzdLs!z/6Dcy?mS=wPz%dv}xYYl$G?Ixj\u003e{@xh9qPwPE", "n": [ { "c": 2, "d": ".NET System.Diagnostics namespace reference", "i": "metadata/lang/compiler/managed::diagnostics-namespace", "o": 5213, "z": 18, "cf": 0.75 }, { "c": 2, "d": ".NET System.Reflection namespace reference", "i": "metadata/lang/compiler/managed::reflection-namespace", "o": 5116, "z": 17, "cf": 0.699999988079071 }, { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 5146, "z": 16, "cf": 0.8500000238418579 }, { "c": 2, "d": ".dll extension reference", "i": "micro-behaviors/fs/path/extension::dll-dup", "o": 5069, "z": 4, "cf": 0.5 } ], "ln": 5021 }, { "b": "wO(vaC(Q(-v{@??y*?vfqE%GPB98CF0cSo\u003cvpBv}vrcS\u003ewOkZ#BAhTbrc0mOwPQ:?z/xodBA)\u0026^0000{xAibOBo3mWiSH/kf92.!A@ZaUzu8l*A@YXIxAhPzz2^#Ae=Y!\u0026ASx.Lf92I.ASxIFw=M]MeDvE8hukxgA@YXIxAhPzz2^#Abld:2DJnx)4fc.naoiI:aoiI:a]\u0026\u003e*ASxUJw=K1PiSHo5a](@\u0026fAuI3a]\u00265L3ikFOEe\u003clE004A2Gs3.L0Z:y*[@UZ#J}ik", "n": [ { "c": 3, "d": "Embedded HTTP or WebSocket URL", "i": "micro-behaviors/communications/http/url/domain::http-url-binary", "o": 5650, "z": 23, "cf": 0.699999988079071 } ], "ln": 5586 }, { "b": "Byx5$vrb)3ga\u003el]0rrP#zE^G@zxIR!ze196wb(Pr0rrv5wO+{^B7CsKjokBvlVl{?A+Pf1Brz#wdiI5%wnk*@awuG^x()]%atLSagCf!oy?$kmx\u003eIa3B0bHmB7GxnwN)y[05KYRfgow-x(mH6aARpdaA?WkvpBv}vrcSow]zYjBzbkdl#(ZFBrAE:wnbE*wD", "n": [ { "c": 2, "d": "Copyright notice", "i": "metadata/package/license::copyright-word", "o": 6463, "z": 9, "cf": 0.6000000238418579 } ], "ln": 6415 }, { "b": "0000000000000000000000000000000000000000000000000000000000315c8Xg7YTL^000000000000000000310rr91fAq960000000000000000003100000nb@R\u0026su(\u0026^SSSq40000000000SSUcU00341qVHe8rSCL*qufR}nDqJ^p5[S3nDqG=mGui:00000Y-^*6000310SSx7000ua0SSx7000uakl7V-000001onA40SSi2000000000000000l\u0026Wh!0rud2ve$rFmGvc5yYF2DnDrSdw=", "n": [ { "c": 2, "d": "PE version resource metadata", "i": "metadata/package/versioning::version-resource-metadata", "o": 7774, "z": 15, "cf": 0.8999999761581421 }, { "c": 1, "d": "PE resource section", "i": "metadata/binary/section/names::pe-resource-section", "o": 7680, "z": 5, "cf": 0.8999999761581421 } ], "ln": 7648 }, { "b": "008c-00031fAr^bfAr^bfAr{fvGn7Z004lzfAqaNlJz38z2!zMwDlPFBo3vZ002y!wDlrxx-J2JwDl=KaolG-xAhPzaolM+zVBnEve%:pBPujTve$rFC(O@!w=M-HASviZBo2$OwDi?Ml\u0026.lcve%)tBo0A-huj\u003c1wb{rzve$9zwDliuBo0][002g.4/=RglJz38z2!IPve$fBC(QOtve$cAwDhYg002B/zuahEy5?@Fzu7^VoAn=bz2!nIBo2\u003eLwb(Pf003Ed9rl9umGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up002v^zVB!TB]VT+A@W/)n=S]jzVBUPe=XlszVBqFwDkj2wDlPFwDl-Jve$xHx-J5Kzu8o?huiZS001+O2(\u003c#amGvc5yYF2DrSDXhASydXx-J5Kzu6Up001\u003eRe=WTbe=WQafArZ9fAq7M003EdaPIJynDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE002v^zVB!TB]VT+A@W/)n=S]jzVBUPe=XlszVBqFwDkj2wDlPFwDl-Jve$xHx-J5Kzu8o?hukufwb{ACyYBCn005k-h#\u0026%VoAnS7x8(uuyYD*5zVB.RC(R\u003c+x-I=CxAibO002v^zVB.RC(R\u003c+x-I=CxAibOaoi!\u0026v/N}Taoj?gzuahEy5?@Fzu7^VoAn=bz2!nIBo2\u003eLwb).Lg5%0dg5%9ge=W0]k(+Z3yYCNTASx!Nx8(PBBo3vZaolAZwDl=KwDl-JB]V7Nwb[jZ003:laPIJypxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE002v^zVB!TB]VT+A@W/)n=S]jzVBUPe=XlszVBqFwDkj2wDlPFwDl-Jve$xHx-J5Kzu8o?hukufwb{ACyYBCn003g59rl9upYLIozVBqFBPt[KBo25ove$cAwDhYg002v^zVB!TB]VT+A@W/)n=S]jzVBUPe=XlszVBqFwDkj2wDlPFwDl-Jve$xHx-J5Kzu8o?huiZS004VLfAqaNpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001\u003eRe=WTbe=WQafArQ6humg^gxorkhVL\u0026rwb[H/gYPohg5%9gw=KH+g5$!:h#\u003e\u0026pg5%olhukAhwb[E!hVLJiwDliuh#\u003e/ow=K*\u003eg5%fihVNB\u0026hukVoh2]Gl0024W2(\u003c#ak(+%aA@Y+Kz2!2ByYF.XaokBxwDl-JA@Y[OzVBUP001\u003eRe=WTbe=WQafArZ9fAq7M000000000000000000000000000", "n": [ { "c": 3, "d": "PE version metadata includes CompanyName", "i": "metadata/package/versioning::pe-companyname-field", "o": 8114, "z": 11, "cf": 0.699999988079071 }, { "c": 3, "d": "PE version metadata includes FileDescription", "i": "metadata/package/versioning::pe-filedescription-field", "o": 8178, "z": 15, "cf": 0.699999988079071 }, { "c": 3, "d": "PE version metadata includes FileVersion", "i": "metadata/package/versioning::pe-fileversion-field", "o": 8278, "z": 11, "cf": 0.699999988079071 }, { "c": 3, "d": "PE version metadata includes InternalName", "i": "metadata/package/versioning::pe-internalname-field", "o": 8330, "z": 12, "cf": 0.699999988079071 }, { "c": 3, "d": "PE version metadata includes ProductVersion", "i": "metadata/package/versioning::pe-productversion-field", "o": 8778, "z": 14, "cf": 0.699999988079071 }, { "c": 3, "d": "PE ProductVersion has SemVer git hash", "i": "metadata/package/versioning::pe-productversion-semver-git-hash", "o": 8808, "z": 47, "cf": 0.8999999761581421 }, { "c": 2, "d": "PE OriginalFilename metadata field", "i": "metadata/package/versioning::pe-originalfilename-field", "o": 8578, "z": 16, "cf": 0.699999988079071 }, { "c": 1, "d": "Several short title-cased resource strings", "i": "metadata/binary/resource::short-titlecase-resource-words", "o": 7994, "z": 8, "cf": 0.800000011920929 }, { "c": 1, "d": "PE version company name populated", "i": "metadata/package/versioning::pe-company-name-populated", "o": 8140, "z": 14, "cf": 0.8500000238418579 }, { "c": 1, "d": "PE FileDescription field is populated", "i": "metadata/package/versioning::pe-file-description-present", "o": 8212, "z": 28, "cf": 0.949999988079071 }, { "c": 1, "d": "PE LegalCopyright field is populated", "i": "metadata/package/versioning::pe-legal-copyright-present", "o": 8460, "z": 55, "cf": 0.949999988079071 }, { "c": 1, "d": "PE ProductName field is populated", "i": "metadata/package/versioning::pe-product-name-present", "o": 8712, "z": 28, "cf": 0.949999988079071 }, { "c": 1, "d": "PE FileVersion value is present", "i": "metadata/package/versioning::version-info-file-version-present", "o": 8304, "z": 8, "cf": 0.949999988079071 } ], "ln": 7962 }, { "b": "00000000000000000000000000000000000000000000000000000000000005axM3\u0026*ncBufy400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", "n": [ { "c": 2, "d": "PE .reloc section presence", "i": "metadata/binary/section/names::reloc-section-presence", "o": 9216, "z": 6, "cf": 0.8999999761581421 } ], "ln": 9168 } ], "depth": 1, "facts": { "imp": [ [ "mscoree", "CorDllMain" ] ], "sec": [ [ ".text", 512, 7168, 5.61, "r-x" ], [ ".rsrc", 7680, 1536, 2.95, "r--" ], [ ".reloc", 9216, 512, 0.08, "r--" ] ], "metrics": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "clr.is_il_only": 1.0, "resource_count": 1.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 34226.0, "reloc_overhang_bytes": 500.0, "reloc_overhang_ratio": 0.98, "clr.is_32bit_required": 0.0, "bss_like_section_count": 0.0, "clr.is_32bit_preferred": 0.0, "clr.strong_name_signed": 0.0, "section_overflow_count": 0.0, "clr.is_native_entrypoint": 0.0, "misaligned_section_count": 0.0, "version.identity_entropy": 4.08, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0, "declared_data_directory_count": 6.0, "version.identity_symbol_ratio": 0.11 }, "file": { "size": 9728.0, "entropy": 4.97, "size_bytes": 9728.0 }, "binary": { "is_pie": 1.0, "code_entropy": 5.61, "string_count": 164.0, "overall_entropy": 4.97, "entropy_variance": 5.11, "avg_string_length": 20.13, "max_string_length": 149.0, "peak_region_bytes": 3072.0, "code_to_data_ratio": 1.0, "peak_region_entropy": 5.64, "string_length_stddev": 15.13, "largest_section_ratio": 0.74, "sentence_string_count": 6.0, "sentence_string_ratio": 0.04, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 7168.0, "entropy_max": 5.61, "entropy_mean": 2.88, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } } }, "id": 11, "mol": "H(Cm)Md₂(BiPa)", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Corvus.Json.CodeGeneration.6/Corvus.Json.CodeGeneration.6.5.2.10.nupkg!!lib/netstandard2.0/Corvus.Json.CodeGeneration.6.dll", "pid": 0, "risk": 4, "sha": "1fcfc31f20ffda9b3ff97c04436d1859699f487f003148a6ab2076738ffd67a7", "size": 9728, "traits": [ { "id": "metadata/package/versioning::pe-companyname-field", "conf": 0.699999988079071, "crit": 3, "desc": "PE version metadata includes CompanyName", "spans": [ [ 8114, 11 ] ] }, { "id": "metadata/package/versioning::pe-internalname-field", "conf": 0.699999988079071, "crit": 3, "desc": "PE version metadata includes InternalName", "spans": [ [ 8330, 12 ] ] }, { "id": "metadata/package/versioning::pe-filedescription-field", "conf": 0.699999988079071, "crit": 3, "desc": "PE version metadata includes FileDescription", "spans": [ [ 8178, 15 ] ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 3, "desc": "PE version metadata includes FileVersion", "spans": [ [ 8278, 11 ] ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 3, "desc": "PE version metadata includes ProductVersion", "spans": [ [ 8778, 14 ] ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET metadata root signature (BSJB)", "spans": [ [ 1304, 4 ] ] }, { "id": "metadata/binary/metrics/entropy::code-entropy-at-most-7-5", "conf": 0.699999988079071, "crit": 1, "desc": "Code entropy is 7.5 or lower", "spans": [ [ 0, 26 ] ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 7774, 15 ] ] }, { "id": "metadata/build/reproducible::pe-reproducible-build", "conf": 1.0, "crit": 2, "desc": "Built with /Brepro (deterministic)" }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR header (COM descriptor)" }, { "id": "metadata/package/versioning::pe-productversion-semver-git-hash", "conf": 0.8999999761581421, "crit": 3, "desc": "PE ProductVersion has SemVer git hash", "spans": [ [ 8808, 47 ] ] }, { "id": "metadata/binary/anomaly/provenance::pe-far-future-timestamp", "conf": 0.949999988079071, "crit": 2, "desc": "PE COFF timestamp encodes a future date" }, { "id": "micro-behaviors/communications/http/url/domain::http-url-binary", "atk": "T1071.001", "mbc": "C0002", "conf": 0.699999988079071, "crit": 3, "desc": "Embedded HTTP or WebSocket URL", "spans": [ [ 5650, 23 ] ] }, { "id": "metadata/binary/layout::pe-no-signature-record", "conf": 0.949999988079071, "crit": 3, "desc": "PE has no signature record" }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET managed assembly", "spans": [ [ 1304, 4 ] ] } ], "type": "pe" }, { "id": 15, "mol": "Md", "sha": "0bf63324172b0434fd354753a2a66c1130bac19ea9369f3762e051326fd83c7c", "path": "Corvus.Json.CodeGeneration.6@5.2.10.registry.json", "risk": 1, "size": 914, "type": "registry", "depth": 1 } ], "omitted_files": 1, "rev": "3e1ed", "v": "8" } }