{ "ml": { "v": "7", "eng": "2.5.0-beta.0", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.27966627, "rte": "az", "prob": 0.27966627 }, { "cls": 0, "raw": 0.0014123917, "rte": "az/nupkg", "prob": 0.0014123917 } ], "prob": 0.27966627, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.2796662747859955, "type": "nupkg" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.00001142422388511477, "type": "xml" }, { "id": 6, "lvl": -1, "conf": 0, "prob": 0.27863287925720215, "type": "pe" }, { "id": 10, "lvl": -1, "conf": 0, "prob": 0.000012636184692382812, "type": "registry" } ], "version": "v18.18", "analyzed_at": "2026-08-01T18:38:41Z" }, "path": "Soenneker.GitHub.Client.4.0.2574.nupkg", "raw": { "files": [ { "id": 0, "ctx": [ { "b": "p!H([6Awak2MMaI@AK}L6\u003ewA/00033000xb003wDwO=Ave]\u003eJtBcI*OyqIUwm/N/Ia]/*svQ1Q/tRj.fi=udrz!(PMaC]aCELq-\u0026v\u003eYN]9g\u003e6Osy7oH=jDifUeV$=Jkfe+88{7uL(2fGsiFY{3.$\u003e:Yl2.IP]f]", "n": [ { "c": 2, "d": "Archive contains an executable member", "i": "metadata/file/metrics::archive-contains-executable-member", "o": 0, "z": 31, "cf": 0.949999988079071 } ], "ln": 0 } ], "mol": "H(Cm)Md₂(BiPa)", "sha": "31a1482e4fe4b02b9d059ffa7994d161708096e20c4bfa3470a24426616b70ec", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Soenneker.GitHub.Client/Soenneker.GitHub.Client.4.0.2574.nupkg", "risk": 4, "size": 36572, "type": "nupkg", "facts": { "metrics": { "file": { "size": 36572.0, "entropy": 7.91, "size_bytes": 36572.0 }, "binary": { "overall_entropy": 7.91, "peak_region_bytes": 32768.0, "peak_region_entropy": 7.84 }, "archive": { "file_count": 10.0, "member_count": 10.0, "script_count": 0.0, "zip_bomb_ratio": 4.98, "directory_count": 0.0, "executable_count": 1.0, "extra_field_size": 0.0, "noise_file_count": 0.0, "total_compressed": 35276.0, "compression.ratio": 0.75, "hidden_file_count": 2.0, "total_uncompressed": 46927.0, "crc_collision_count": 0.0, "entry_comment_count": 0.0, "max_filename_length": 81.0, "rtlo_filename_count": 0.0, "format.regular_count": 10.0, "nested_archive_count": 0.0, "path_traversal_count": 0.0, "symlink_escape_count": 0.0, "security.setgid_count": 0.0, "security.setuid_count": 0.0, "security.sticky_count": 0.0, "double_extension_count": 0.0, "duplicate_member_count": 0.0, "security.symlink_count": 0.0, "unicode_filename_count": 0.0, "homoglyph_filename_count": 0.0, "security.encrypted_count": 0.0, "timing.mtime_unique_count": 4.0, "timing.mtime_unique_ratio": 0.4, "misplaced_executable_count": 1.0, "timing.mtime_dominant_count": 4.0, "timing.mtime_spread_seconds": 25176.0, "timing.sentinel_mtime_count": 0.0, "security.world_writable_count": 0.0, "timing.mtime_dominant_fraction": 0.4, "compression.method_counts.stored": 1.0, "compression.method_counts.deflate": 9.0 } } }, "ident": { "name": { "value": "Soenneker.GitHub.Client", "source": "nupkg.title", "verified": false }, "urls": [ { "url": "https://github.com/soenneker/soenneker.github.client", "kind": "homepage", "source": "nupkg.project_url" }, { "url": "https://github.com/soenneker/soenneker.github.client", "kind": "repository", "source": "nupkg.repository_url" } ], "trust": "unsigned", "authors": [ { "name": "Jake Soenneker", "role": "author", "source": "nupkg.authors" } ], "version": { "value": "4.0.2574", "source": "nupkg.version", "verified": false }, "identifier": { "value": "Soenneker.GitHub.Client", "source": "nupkg.id", "verified": false } }, "traits": [ { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "from": [ { "file": 6 } ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR header (COM descriptor)" }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET metadata root signature (BSJB)", "from": [ { "file": 6 } ] }, { "id": "metadata/package/versioning::pe-productversion-semver-git-hash", "conf": 0.8999999761581421, "crit": 3, "desc": "PE ProductVersion has SemVer git hash" }, { "id": "metadata/binary/anomaly/provenance::pe-far-future-timestamp", "conf": 0.949999988079071, "crit": 2, "desc": "PE COFF timestamp encodes a future date" }, { "id": "micro-behaviors/communications/http/url/domain::http-url-binary", "atk": "T1071.001", "mbc": "C0002", "conf": 0.699999988079071, "crit": 3, "desc": "Embedded HTTP or WebSocket URL", "from": [ { "file": 6 } ] }, { "id": "metadata/binary/metrics/entropy::code-entropy-at-most-7-5", "conf": 0.699999988079071, "crit": 1, "desc": "Code entropy is 7.5 or lower", "from": [ { "file": 6 } ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 3, "desc": "PE version metadata includes ProductVersion", "from": [ { "file": 6 } ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 3, "desc": "PE version metadata includes FileVersion", "from": [ { "file": 6 } ] }, { "id": "metadata/binary/layout::pe-no-signature-record", "conf": 0.949999988079071, "crit": 3, "desc": "PE has no signature record" }, { "id": "metadata/package/versioning::pe-filedescription-field", "conf": 0.699999988079071, "crit": 3, "desc": "PE version metadata includes FileDescription", "from": [ { "file": 6 } ] }, { "id": "metadata/build/reproducible::pe-reproducible-build", "conf": 1.0, "crit": 2, "desc": "Built with /Brepro (deterministic)" }, { "id": "metadata/package/versioning::pe-companyname-field", "conf": 0.699999988079071, "crit": 3, "desc": "PE version metadata includes CompanyName", "from": [ { "file": 6 } ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET managed assembly", "from": [ { "off": 844, "file": 6 } ] }, { "id": "metadata/package/versioning::pe-internalname-field", "conf": 0.699999988079071, "crit": 3, "desc": "PE version metadata includes InternalName", "from": [ { "file": 6 } ] } ] }, { "ctx": [ { "b": "[4ls%kx}3YaA?spB7]MgjT8QkfD}SJzEWP}x(mMDb6w0teJs}sj{\u003cz\u003evpK7YxjSigzes9hjTaMYBz%n]flpSpwO\u003e\u003c%e]trjA=l2qw]]Unz/4dDvpK7Yxk8l@fetjogCpBtfk+]NAaJJiCYNytj{\u0026zPjz!UKvpS!*vlL2varR^?x\u003efzaz!i*7wOU\u003c$e\u003eoR$noFw]lU{EFzGE#]x\u003efymarR^HjA+pRB7]Mgj#s(Ce\u00262pyg^0BmwPz\u003caz/d-CarR^HjyJwOxM4{jk1Ym0wGT]\u0026wO#x%yH}JGfjx0BxM4{jj{\u0026zParS^.x\u003e7Z(B7DFoD2NsTb4V1rA+frkx(v(kk21QFjtgI+v}xL0wJ*CzarR^?y?Wx\u003czGxw?A+){MBAzFyiXJd5x\u003e7Z(B7GzBzGPP6Bs}GLxd($Jr6h*Ix\u003e7Z(B7Fu(y^5gGarR^?x\u003e870k51IBzz2)Cxfm?Yv@DlG3lQDlauTWQvpTj^k2K*nl}{95zdC:ZA+eV\u0026zdL)rarR^HjAbsVygQ)%rDq[txMOunB2\u003e%cxk8E3BZ=$kz/4dGz!i*7wOU\u003c$flq5yzF\u003c33wPxzox([3hvLhebx\u003eqg7jtgU]z!-\u0026[Bx9u$j{\u0026zParS^SwPIv4x(Ffdz/d:8zxJweD2vamBzbYavpQ%hvp\u003c6[B7]J8y?mZbzxJLfAV!d/Bz\u003e@eBshbLm})6oBZ^ZOx\u003eqg7jtgkRB7ol8Acb/jzAXyIarR^?A+f5#vrl0Pz//Mik2(Mjvru66wmYZ\u003ezE^r@v%Gg}z!i*7wOU\u003c$e\u003e72bwO#N6z/fRGlVl\u003cOx\u003eINevruj4zxK4tat+Y8e\u0026UZxasFD\u003cfF\u003e^sjtg.^y?m3@wLNe=wPH3xarR^Hjy-qGD2^RixMMB9z/x#xx\u003eIa3aI$92gb7EteIY1nhxUR2yH[R!z!i*7wOU\u003c$jtgh.AcVFrxj#xJ3lQDlauT:OxlcmHx([3hvJYe%x\u003eqg7aA7+iz!\u003c6eaA.^uy-)jjatdLyBrCajBz+Vijtg!+xlclzarR^HjAt1Lz/YSmz/QaCBA}?pjTaJMBrR\u0026IA+)(.xMOunB2\u003e%cxk8E3BZ=$kz/4dGz!i*7wOU\u003c$flq5yzF\u003c33wPxzox([3hvLhebx\u003eqg7a%punvqYN*jTa]Tw]/RswNPa\u003cfkUcizxZikz/6u9BuH*9fFLssh.!+@wO0USv(u8NgCZ^{whDq7v}xdgv(lh4hArH3w\u0026IT(atk[=arR^Hjy\u00262xwO#3\u0026zEWx(B3o{NarR^HauTpSz/{1wByxi5wPQyZvqPO1z/PRRb5N", "n": [ { "c": 2, "d": "NuGet nuspec manifest file", "i": "metadata/build/manifest::nuspec-file", "o": 0, "z": 30, "cf": 0.9800000190734863 }, { "c": 2, "d": "NuGet package declares repository", "i": "metadata/package/files/nuget::nuspec-repository", "o": 42, "z": 876, "cf": 0.8999999761581421 } ], "ln": 0, "col": 1, "line": 1 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 1371.0, "entropy": 5.09, "size_bytes": 1371.0 }, "binary": { "overall_entropy": 5.09, "peak_region_bytes": 1371.0, "peak_region_entropy": 5.1 } } }, "id": 2, "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Soenneker.GitHub.Client/Soenneker.GitHub.Client.4.0.2574.nupkg!!Soenneker.GitHub.Client.nuspec", "pid": 0, "risk": 1, "sha": "19d2d0cbe6d20bce3f379754de4365ec0c57c2b950545b6c24a62f3a95570735", "size": 1371, "traits": [ { "id": "metadata/package/files/nuget::nuspec-repository", "conf": 0.8999999761581421, "crit": 2, "desc": "NuGet package declares repository", "spans": [ [ 42, 876 ] ] }, { "id": "metadata/build/manifest::nuspec-file", "conf": 0.9800000190734863, "crit": 2, "desc": "NuGet nuspec manifest file", "spans": [ [ 0, 30 ] ] } ], "type": "xml" }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J\u0026m(0ji6Sa?dLD+]{51x(+zoA=kPhvqNb%vqY$3BrC47aAzQxazCZol@c-7zeS@@e!5l%bME/A00000", "n": [ { "c": 2, "d": "PE contains exactly one resource entry", "i": "metadata/binary/resource::pe-single-version-resource", "o": 0, "z": 24, "cf": 1.0 } ], "ln": 0 }, { "b": "000000000000000kMy^J00000000000000000000hz+yl00000nb@R\u00260SSx7oD:xo!dzVX0rr91000000000000000000000000000000000000000000000000000000000000000009S^-8000uQ9S^-8000uQ9S*V?000cKiSZYA000uc1apgI00B^S0W[/:015=fEffDH1oFZO1onA80S@u91][ScA#a/R3uE3:01abQ000cK6efH*o-Ld[0rr9i1sLb/017m\u00260^+4I00Ery003%^0rr9I5cq]W0@@r7AUwAMA3$+/04PDq000vDlJva9A#+kX3uEl*015\u003cI9@(oF3mb){aohxGdMNST0SSi60%AJ=000uQn=\u003ctv000dJa]?PI18/s.017hh0^:$G00Ei+000uQg6h!7000dubME/KdK1{x0@@rK0Xbw}c\u003cfIId/}g2lq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn]Ati{byPQ)u\u003clPhPA+C%bu5Y8x(mN80000001F#exAe2jbumUxxBU1x5c8Xgbs+:9l\u0026Wh!CN:YNtMT%absli+vGlxd000000SSi3s0ady2[c!l0qVZL02tLm0rr91ec2UI2lj-71onA44GDFe5Dz!h1POJ5cia2C1onA4cia2C0rr910rr910rr910rr910SSi20rr912MK\u002680rr911onA4006k90rr91000i6R2+ij1]@xtx9wFt[b^ka1]{:^r0r{n", "n": [ { "c": 2, "d": ".NET metadata root signature (BSJB)", "i": "metadata/binary/framework::dotnet-metadata", "o": 844, "z": 4, "cf": 1.0 }, { "c": 1, "d": "PE standard code/data section", "i": "metadata/binary/section/names::pe-code-data-standard-section", "o": 512, "z": 5, "cf": 0.8999999761581421 } ], "ln": 480 }, { "b": "B.aJXB87+Em})6oBZ^ZOx\u003eqg7rDI}\u003e08)/EzF\u003c33wPxy[x(()*vLg2:x\u003eqg7e[w^m08[e:By/p?lT:\u003exwO=f\u003eBzkVhrbVL-zuafPzEWl]y*?B1z/eJ)yH}w-Bz\u003e@azu9QSA+PA7mr\u0026]=zGxJgzu94xzF0P}B-H]jx(v(TCYWImB7]Mg08drznP5cU", "n": [ { "c": 2, "d": ".dll extension reference", "i": "micro-behaviors/fs/path/extension::dll-dup", "o": 3443, "z": 4, "cf": 0.5 } ], "ln": 3395 }, { "b": "A::67z/bLHx\u003e8g4B8LVje\u003e72bwO#N6z/fRGl$HsGzE^r@v%HT-ygQ)%x(v\u003e?q*ACawO\u003c4$wOb:\u0026v@#B6zu9mbwPz%dv}w2Cy\u00260V)BzkVh08)/EzF\u003c33wPxz6BzkMje\u003cTM7zEVQVzF9=%Bz(3%rc0mIwmORMzF9=%Bz(3%l1BH@x(()*vNB%CwO#P\u0026BzkLSB5M^\u003cxkzd3zV", "n": [ { "c": 2, "d": ".NET System.Reflection namespace reference", "i": "metadata/lang/compiler/managed::reflection-namespace", "o": 3677, "z": 17, "cf": 0.699999988079071 } ], "ln": 3629 }, { "b": "m})6oBZ^ZOx\u003eqg7rDI}\u003eqE%GPB98ChASwW8z!AY]ASxD.z!AY]ASv.4Bz(g1q*ACawO\u003c4/x\u003c\u003eT(z/Z2mv@?SGD2[7sz7X.ezGGPfwIct*ze:i9wPyZXA=#ebwPE\u0026)wPz%dv}xYYl$G?Ixj\u003e{@xh9qPwPE\u0026Iz!i*7wOU\u003c$e\u003eoF\u003ce\u003e6V2zb$7YB.bQ]q*ACawO\u003c50xMvV)wn8", "n": [ { "c": 2, "d": ".NET System.Diagnostics namespace reference", "i": "metadata/lang/compiler/managed::diagnostics-namespace", "o": 3840, "z": 18, "cf": 0.75 } ], "ln": 3792 }, { "b": "e(1\u0026mlVm0Rl2Z=]r+lq)x(v(LB$\u003eW6fAzeM4IRxMvqPO1z/PRYx(!lfvr\u003eQRzdK2apdnb8f!+jl8ux*MxMOunB2\u003e%cB8LSczE)P{AXp\u003cuz2:LA0rrv5wO+{^B7CsKdGGI}lVl{?A+Pf1BrFD1atLSagC7vogbZmEvqxA%q/uk+zE)P{ASu860rtbCzxJweD2vamBzbYavpQ%hvp\u003c6[B7]J8y?mZbzxJLfAV!d/Bz\u003e@eBshbLm})6oBZ^ZOx\u003eqg7000Jg017LnfA", "n": [ { "c": 3, "d": "Embedded HTTP or WebSocket URL", "i": "micro-behaviors/communications/http/url/domain::http-url-binary", "o": 4984, "z": 21, "cf": 0.699999988079071 }, { "c": 2, "d": "Copyright notice", "i": "metadata/package/license::copyright-word", "o": 5024, "z": 9, "cf": 0.6000000238418579 } ], "ln": 4920 }, { "b": "0000000000000000000000000000000000000000000000000000000000315c8Xg7YTL^000000000000000000310rr91fAq960000000000000000003100000nb@R\u0026su(\u0026^F=(5N0000000000F=)[g00341qVHe8rSCL*qufR}nDqJ^p5[S3nDqG=mGui:00000Y-^*600031000c4000Go000c4000Gokl7V-000001onA40SSi2000000000000000l\u0026Wh!0rud2ve$rFmGvc5yYF2DnDrSdw=", "n": [ { "c": 2, "d": "PE version resource metadata", "i": "metadata/package/versioning::version-resource-metadata", "o": 6238, "z": 15, "cf": 0.8999999761581421 }, { "c": 1, "d": "PE resource section", "i": "metadata/binary/section/names::pe-resource-section", "o": 6144, "z": 5, "cf": 0.8999999761581421 } ], "ln": 6112 }, { "b": "006.n00031fAr^bfAr^bfAr{fvGn7Z004@TiSGfXlJz38z2!zMwDlPFBo3vZ002p+zu7^Vve$uGC(RZZv/NRKBo2$OASxUJve%*reDx?(ve%)twDi?MA@Y[OzuaqHyYF2DBo3jVzu7^Vw=M-HASviZpxj(8Bo3jVyxe5GBo0V*A@Wr.m/Wl6Bo1\u0026iBPt\u003eJlJy{5x-IYAzua+U002W)761vnlJz38z2!IPve$fBC(QOtve$cAwDhYg003WjBo3y.z#:}ViSH/kf934[zVBtGzuaLOwDlGCwDl-Je=YwYzVBRO003a37YTNpmGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up002{$zVBtGzuaLOwDlGCwDl-Je=Xxwx-JkPnc0=jvGn1XlJy{5x-IYAzua+U001[S3JHhcmGvc5yYF2DrSDXhASydXx-J5Kzu6Up001?Qe=WN9e=WTbh2]MngYPcdfAq7M003a38#{0tnDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE002{$zVBtGzuaLOwDlGCwDl-Je=Xxwx-JkPnc0=jvGn1XlJy{5x-IYAzua+Ue=YzZyYFnK003)pb(^@CoAnS7x8(uuyYD*5zVB.RC(R\u003c+x-I=CxAibO002v^zVB.RC(R\u003c+x-I=CxAibOaonwvaojd%fAr\u003cdgxo0bg5%0dg5%ijaok1lve$6ywDi?MqVH.owDlPFzuakFyxd]CASu7t003yb8#{0tpxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE002{$zVBtGzuaLOwDlGCwDl-Je=Xxwx-JkPnc0=jvGn1XlJy{5x-IYAzua+Ue=YzZyYFnK002*}7YTNppYLIozVBqFBPt[KBo25ove$cAwDhYg002{$zVBtGzuaLOwDlGCwDl-Je=Xxwx-JkPnc0=jvGn1XlJy{5x-IYAzua+U004/Pg5}sPpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001?Qe=WN9e=WTbh2]MngYP3ah2]rgf-S%egxoulf-UU.f-U++wDjH^h#)B*hukGjwDjH^gxofgve%*rgYPJoh2}a^wDliuiriK?h2]MngYPAlirg=lvGp0uh#\u003e/o002g.3JHhck(+%aA@Y+Kz2!2ByYF.XaokBxwDl-JA@Y[OzVBUP001?Qe=WN9e=WTbh2]MngYPcdfAq7M00000000000000000000", "n": [ { "c": 3, "d": "PE version metadata includes CompanyName", "i": "metadata/package/versioning::pe-companyname-field", "o": 6598, "z": 11, "cf": 0.699999988079071 }, { "c": 3, "d": "PE version metadata includes FileDescription", "i": "metadata/package/versioning::pe-filedescription-field", "o": 6674, "z": 15, "cf": 0.699999988079071 }, { "c": 3, "d": "PE version metadata includes FileVersion", "i": "metadata/package/versioning::pe-fileversion-field", "o": 6762, "z": 11, "cf": 0.699999988079071 }, { "c": 3, "d": "PE version metadata includes InternalName", "i": "metadata/package/versioning::pe-internalname-field", "o": 6818, "z": 12, "cf": 0.699999988079071 }, { "c": 3, "d": "PE version metadata includes ProductVersion", "i": "metadata/package/versioning::pe-productversion-field", "o": 7194, "z": 14, "cf": 0.699999988079071 }, { "c": 3, "d": "PE ProductVersion has SemVer git hash", "i": "metadata/package/versioning::pe-productversion-semver-git-hash", "o": 7224, "z": 49, "cf": 0.8999999761581421 }, { "c": 2, "d": "PE OriginalFilename metadata field", "i": "metadata/package/versioning::pe-originalfilename-field", "o": 7018, "z": 16, "cf": 0.699999988079071 }, { "c": 1, "d": "Several short title-cased resource strings", "i": "metadata/binary/resource::short-titlecase-resource-words", "o": 6458, "z": 8, "cf": 0.800000011920929 }, { "c": 1, "d": "PE version company name populated", "i": "metadata/package/versioning::pe-company-name-populated", "o": 6624, "z": 21, "cf": 0.8500000238418579 }, { "c": 1, "d": "PE FileDescription field is populated", "i": "metadata/package/versioning::pe-file-description-present", "o": 6708, "z": 23, "cf": 0.949999988079071 }, { "c": 1, "d": "PE LegalCopyright field is populated", "i": "metadata/package/versioning::pe-legal-copyright-present", "o": 6936, "z": 37, "cf": 0.949999988079071 }, { "c": 1, "d": "PE ProductName field is populated", "i": "metadata/package/versioning::pe-product-name-present", "o": 7140, "z": 23, "cf": 0.949999988079071 }, { "c": 1, "d": "PE FileVersion value is present", "i": "metadata/package/versioning::version-info-file-version-present", "o": 6788, "z": 10, "cf": 0.949999988079071 } ], "ln": 6426 }, { "b": "00000000000000000000000000000000000000000000000000000000000005axM3\u0026*ncstQ0T00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", "n": [ { "c": 2, "d": "PE .reloc section presence", "i": "metadata/binary/section/names::reloc-section-presence", "o": 7680, "z": 6, "cf": 0.8999999761581421 } ], "ln": 7632 } ], "depth": 1, "facts": { "imp": [ [ "mscoree", "CorDllMain" ] ], "sec": [ [ ".text", 512, 5632, 5.27, "r-x" ], [ ".rsrc", 6144, 1536, 2.9, "r--" ], [ ".reloc", 7680, 512, 0.08, "r--" ] ], "metrics": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "clr.is_il_only": 1.0, "resource_count": 1.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 27137.0, "reloc_overhang_bytes": 500.0, "reloc_overhang_ratio": 0.98, "clr.is_32bit_required": 0.0, "bss_like_section_count": 0.0, "clr.is_32bit_preferred": 0.0, "clr.strong_name_signed": 0.0, "section_overflow_count": 0.0, "clr.is_native_entrypoint": 0.0, "misaligned_section_count": 0.0, "version.identity_entropy": 4.09, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0, "declared_data_directory_count": 6.0, "version.identity_symbol_ratio": 0.12 }, "file": { "size": 8192.0, "entropy": 4.55, "size_bytes": 8192.0 }, "binary": { "is_pie": 1.0, "code_entropy": 5.27, "string_count": 132.0, "overall_entropy": 4.55, "entropy_variance": 4.49, "avg_string_length": 20.88, "max_string_length": 78.0, "peak_region_bytes": 1024.0, "code_to_data_ratio": 1.0, "peak_region_entropy": 5.73, "string_length_stddev": 13.28, "largest_section_ratio": 0.69, "sentence_string_count": 6.0, "sentence_string_ratio": 0.05, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 5632.0, "entropy_max": 5.27, "entropy_mean": 2.75, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } } }, "id": 6, "mol": "H(Cm)Md₂(BiPa)", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Soenneker.GitHub.Client/Soenneker.GitHub.Client.4.0.2574.nupkg!!lib/net10.0/Soenneker.GitHub.Client.dll", "pid": 0, "risk": 4, "sha": "88c80d7e30d0f1c14c480610de9446f20cf1c9c7ff65f554897d2ac615a2133a", "size": 8192, "traits": [ { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 3, "desc": "PE version metadata includes FileVersion", "spans": [ [ 6762, 11 ] ] }, { "id": "metadata/package/versioning::pe-filedescription-field", "conf": 0.699999988079071, "crit": 3, "desc": "PE version metadata includes FileDescription", "spans": [ [ 6674, 15 ] ] }, { "id": "metadata/package/versioning::pe-companyname-field", "conf": 0.699999988079071, "crit": 3, "desc": "PE version metadata includes CompanyName", "spans": [ [ 6598, 11 ] ] }, { "id": "metadata/binary/metrics/entropy::code-entropy-at-most-7-5", "conf": 0.699999988079071, "crit": 1, "desc": "Code entropy is 7.5 or lower", "spans": [ [ 0, 26 ] ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET metadata root signature (BSJB)", "spans": [ [ 844, 4 ] ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR header (COM descriptor)" }, { "id": "metadata/package/versioning::pe-internalname-field", "conf": 0.699999988079071, "crit": 3, "desc": "PE version metadata includes InternalName", "spans": [ [ 6818, 12 ] ] }, { "id": "metadata/package/versioning::pe-productversion-semver-git-hash", "conf": 0.8999999761581421, "crit": 3, "desc": "PE ProductVersion has SemVer git hash", "spans": [ [ 7224, 49 ] ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 3, "desc": "PE version metadata includes ProductVersion", "spans": [ [ 7194, 14 ] ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 6238, 15 ] ] }, { "id": "metadata/build/reproducible::pe-reproducible-build", "conf": 1.0, "crit": 2, "desc": "Built with /Brepro (deterministic)" }, { "id": "micro-behaviors/communications/http/url/domain::http-url-binary", "atk": "T1071.001", "mbc": "C0002", "conf": 0.699999988079071, "crit": 3, "desc": "Embedded HTTP or WebSocket URL", "spans": [ [ 4984, 21 ] ] }, { "id": "metadata/binary/anomaly/provenance::pe-far-future-timestamp", "conf": 0.949999988079071, "crit": 2, "desc": "PE COFF timestamp encodes a future date" }, { "id": "metadata/binary/layout::pe-no-signature-record", "conf": 0.949999988079071, "crit": 3, "desc": "PE has no signature record" }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET managed assembly", "spans": [ [ 844, 4 ] ] } ], "type": "pe" }, { "id": 10, "sha": "575158b79df4b71b3ed1ae04ffe8134431a97eb9656f4fa6ab7dc0ee4f3a828f", "path": "Soenneker.GitHub.Client@4.0.2574.registry.json", "size": 877, "type": "registry", "depth": 1 } ], "omitted_files": 1, "rev": "6096e", "v": "8" } }