{ "llm": { "conf": 0.516177, "grade": "benign", "model": "Qwen/Qwen3.6-27B", "outcome": "benign", "interpretation": "Legitimate NuGet package metadata" }, "ml": { "v": "7", "eng": "2.4.0", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.1892737, "rte": "az", "prob": 0.1892737 }, { "cls": 0, "raw": 0.031909674, "rte": "az/nupkg", "prob": 0.031909674 } ], "prob": 0.30882424, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.30882424116134644, "type": "nupkg" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.0000073909759521484375, "type": "xml" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.000006983677394600818, "type": "xml" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.000007410844318656018, "type": "text" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.000007291635029105237, "type": "markdown" }, { "id": 5, "lvl": -1, "conf": 0, "prob": 0.000007927417755126953, "type": "png" }, { "id": 6, "lvl": -1, "conf": 0, "prob": 0.30882424116134644, "type": "pe" }, { "id": 7, "lvl": -1, "conf": 0, "prob": 0.000007450580596923828, "type": "xml" }, { "id": 8, "lvl": -1, "conf": 0, "prob": 0.00000712275505065918, "type": "xml" }, { "id": 9, "lvl": -1, "conf": 0, "prob": 0.0000073909759521484375, "type": "xml" }, { "id": 10, "lvl": -1, "conf": 0, "prob": 0.000009367863640363794, "type": "registry" } ], "version": "v18.18", "analyzed_at": "2026-07-28T12:53:37Z" }, "path": "Soenneker.Utils.Logger.4.0.518.nupkg", "raw": { "files": [ { "id": 0, "ctx": [ { "b": "p!H([6Awak2MNm}@9fB(X?b9b00002000xb003wDwO=Ave]\u003eJtBcI*AyqIUAm^\u003e+.KB9hv-(nH?6SS}uM2^E$Rn72T]m[PGD\u00267S#PP3.X0o-?(Zubiam%6rHJctZ-2/u}r]1x4O.ri{O7KiSZeCy\u003cvy}Jzh6b4\u003e", "n": [ { "c": 2, "d": "Archive contains an executable member", "i": "metadata/file/metrics::archive-contains-executable-member", "o": 0, "z": 31, "cf": 0.949999988079071 } ], "ln": 0 } ], "mol": "H(Cm)Md₂(BiPa)", "sha": "47567371e94d03ba56f59f76caa8d6ff790f38a0ab97f62040c8ef3f79615f03", "path": "Soenneker.Utils.Logger.4.0.518.nupkg", "risk": 4, "size": 36630, "type": "nupkg", "facts": { "metrics": { "file": { "size": 36630.0, "entropy": 7.92, "size_bytes": 36630.0 }, "binary": { "overall_entropy": 7.92, "peak_region_bytes": 33792.0, "peak_region_entropy": 7.84 }, "archive": { "file_count": 10.0, "member_count": 10.0, "script_count": 0.0, "zip_bomb_ratio": 4.02, "directory_count": 0.0, "executable_count": 1.0, "extra_field_size": 0.0, "noise_file_count": 0.0, "total_compressed": 35340.0, "compression.ratio": 0.75, "hidden_file_count": 2.0, "total_uncompressed": 47293.0, "crc_collision_count": 0.0, "entry_comment_count": 0.0, "max_filename_length": 81.0, "rtlo_filename_count": 0.0, "format.regular_count": 10.0, "nested_archive_count": 0.0, "path_traversal_count": 0.0, "symlink_escape_count": 0.0, "security.setgid_count": 0.0, "security.setuid_count": 0.0, "security.sticky_count": 0.0, "double_extension_count": 0.0, "duplicate_member_count": 0.0, "security.symlink_count": 0.0, "unicode_filename_count": 0.0, "homoglyph_filename_count": 0.0, "security.encrypted_count": 0.0, "timing.mtime_unique_count": 4.0, "timing.mtime_unique_ratio": 0.4, "misplaced_executable_count": 1.0, "timing.mtime_dominant_count": 4.0, "timing.mtime_spread_seconds": 25174.0, "timing.sentinel_mtime_count": 0.0, "security.world_writable_count": 0.0, "timing.mtime_dominant_fraction": 0.4, "compression.method_counts.stored": 1.0, "compression.method_counts.deflate": 9.0 } } }, "ident": { "name": { "value": "Soenneker.Utils.Logger", "source": "nupkg.title", "verified": false }, "urls": [ { "url": "https://github.com/soenneker/soenneker.utils.logger", "kind": "homepage", "source": "nupkg.project_url" }, { "url": "https://github.com/soenneker/soenneker.utils.logger", "kind": "repository", "source": "nupkg.repository_url" } ], "trust": "unsigned", "authors": [ { "name": "Jake Soenneker", "role": "author", "source": "nupkg.authors" } ], "version": { "value": "4.0.518", "source": "nupkg.version", "verified": false }, "identifier": { "value": "Soenneker.Utils.Logger", "source": "nupkg.id", "verified": false } }, "traits": [ { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 3, "desc": "PE version metadata includes ProductVersion", "from": [ { "file": 6 } ] }, { "id": "metadata/binary/metrics/entropy::code-entropy-at-most-7-5", "conf": 0.699999988079071, "crit": 1, "desc": "Code entropy is 7.5 or lower", "from": [ { "file": 6 } ] }, { "id": "metadata/package/versioning::pe-filedescription-field", "conf": 0.699999988079071, "crit": 3, "desc": "PE version metadata includes FileDescription", "from": [ { "file": 6 } ] }, { "id": "metadata/binary/anomaly/provenance::pe-far-future-timestamp", "conf": 0.949999988079071, "crit": 2, "desc": "PE COFF timestamp encodes a future date" }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET metadata root signature (BSJB)", "from": [ { "file": 6 } ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "from": [ { "file": 6 } ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET managed assembly", "from": [ { "off": 844, "file": 6 } ] }, { "id": "metadata/build/reproducible::pe-reproducible-build", "conf": 1.0, "crit": 2, "desc": "Built with /Brepro (deterministic)" }, { "id": "metadata/package/versioning::pe-companyname-field", "conf": 0.699999988079071, "crit": 3, "desc": "PE version metadata includes CompanyName", "from": [ { "file": 6 } ] }, { "id": "micro-behaviors/communications/http/url/domain::http-url-binary", "atk": "T1071.001", "mbc": "C0002", "conf": 0.699999988079071, "crit": 3, "desc": "Hardcoded network URL with domain name", "from": [ { "file": 6 } ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR header (COM descriptor)" }, { "id": "metadata/package/versioning::pe-internalname-field", "conf": 0.699999988079071, "crit": 3, "desc": "PE version metadata includes InternalName", "from": [ { "file": 6 } ] }, { "id": "metadata/binary/layout::pe-no-signature-record", "conf": 0.949999988079071, "crit": 3, "desc": "PE has no signature record" }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 3, "desc": "PE version metadata includes FileVersion", "from": [ { "file": 6 } ] }, { "id": "metadata/package/versioning::pe-productversion-semver-git-hash", "conf": 0.8999999761581421, "crit": 3, "desc": "PE ProductVersion has SemVer git hash" } ] }, { "depth": 1, "facts": { "metrics": { "file": { "size": 512.0, "entropy": 5.19, "size_bytes": 512.0 }, "binary": { "overall_entropy": 5.19, "peak_region_bytes": 512.0, "peak_region_entropy": 5.19 } } }, "id": 1, "path": "Soenneker.Utils.Logger.4.0.518.nupkg!!_rels/.rels", "pid": 0, "sha": "7d91393a79b874aeb651011cd526d36f85c452970d2b2ea1649a19f7c6824c36", "size": 512, "type": "xml" }, { "ctx": [ { "b": "[4ls%kx}3YaA?spB7]MgjT8QkfD}SJzEWP}x(mMDb6w0teJs}sj{\u003cz\u003evpK7YxjSigzes9hjTaMYBz%n]flpSpwO\u003e\u003c%e]trjA=l2qw]]Unz/4dDvpK7Yxk8l@fetjogCpBtfk+]NAaJJiCYNytj{\u0026zPjz!UKvpS!*vlL2varR^?x\u003efzaz!i*7wOU\u003c$e(^1cy\u0026.j5z!AY]AY=0?wiHtyarR^?C4CYnx(v(Mg+HEmh8d6MflQ]EB7]Mgj{\u0026zParS^PB-.qnA=TApvqxA%q/uk+zE)P{AY=0-B-.qnA=TzKarR^HjzX.wwO#N2aAR)FwJ.kGCYmXmB8#5lzx.nsnMm/9y?Wx\u003czGxwM3lQDlauTEOv}xL0wMr+!k4]4WAc15[fkLujwO#N2B1RuMxjVfqz/PFzo?wqDfkLujwO#N2rDq[t3lQDlauTvFz/d:Mv@DlqAbGqJfkj{mzAXyIarR^?A+eV\u0026zdL[eml%somj@B/jtg.^vpTj^j{\u0026zParS^=A=kY7v@$Z\u003ey^8JOBz#pZfe3%LBzb/ae[n*pflq5yzF\u003c33wPxCBz!i*7wOU\u003c$e{hnIy\u0026.jBz!AY]AY=0]A=kY7v@$Z\u003ey^5gGarR^?wmY*(A+PGmx(v(Mk{gq\u003ewOc73aA.^uy?X0paz++3A::0lay]4(y?W^1aA}KwxDQk+A+Pudxcq2exj\u003e{@xfm?TwPIv4x(Ffdz/d-CarR^HjAt1HwNPT\u003eph+k=B3rPywmoN\u003eay]55wO#3\u0026zEW@mq/uk+zE)P{AXoU1z/6h#B1QH4y\u0026%qQz/oDkaARJAg+HEmgC*j5bq}nmdlGn7wO+{^B7F9+By/IS3lQDlauTdLAcVFrxj#xJlVl{?A+Pf1BrFD1atLSagC7vogbZmEvqxA%q/uk+zE)P{AY=0+z/x#xx\u003eIa3j{\u0026zParS^*vp%TBB7Gxay\u0026r@eB-.tlB0a%qatdLyBrCajBz+Vijtg!+xlclzarR^HjAt1Lz/YSmz/QaCBA}?pjTaJMBrR\u0026IA+)(.xMOunB2\u003e%cxk8E3BZ=$kz/4dGz!i*7wOU\u003c$flq5yzF\u003c33wPxzCBzkMje]kDsxjV9cayYw1zEWuyb64mbB1.irvpTBjzddc@a%pxlzeB0ejTaw)ggT(OgbSVNh!s\u003c6vkfDCia+fff!\u003eK]wJ10SwNYjhgb-Y3vko2HffPZ=arR^?wmYZ\u003ezE^r@v}/H}j{\u0026zParR^HjzeXMB-nEBvrc0(BvHpVzdN{fA+^/Zzu", "n": [ { "c": 2, "d": "NuGet nuspec manifest file", "i": "metadata/build/manifest::nuspec-file", "o": 0, "z": 29, "cf": 0.9800000190734863 }, { "c": 2, "d": "NuGet package declares repository", "i": "metadata/package/files/nuget::nuspec-repository", "o": 42, "z": 847, "cf": 0.8999999761581421 } ], "ln": 0, "col": 1, "line": 1 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 1366.0, "entropy": 5.07, "size_bytes": 1366.0 }, "binary": { "overall_entropy": 5.07, "peak_region_bytes": 1366.0, "peak_region_entropy": 5.06 } } }, "id": 2, "path": "Soenneker.Utils.Logger.4.0.518.nupkg!!Soenneker.Utils.Logger.nuspec", "pid": 0, "risk": 1, "sha": "20c974e3b228847f48188eb947228622d79ec5778bb3dc47db7df03277fc052c", "size": 1366, "traits": [ { "id": "metadata/build/manifest::nuspec-file", "conf": 0.9800000190734863, "crit": 2, "desc": "NuGet nuspec manifest file", "spans": [ [ 0, 29 ] ] }, { "id": "metadata/package/files/nuget::nuspec-repository", "conf": 0.8999999761581421, "crit": 2, "desc": "NuGet package declares repository", "spans": [ [ 42, 847 ] ] } ], "type": "xml" }, { "depth": 1, "facts": { "metrics": { "file": { "size": 1076, "entropy": 5.13 }, "binary": { "peak_region_bytes": 1024, "peak_region_entropy": 5.13 } } }, "id": 3, "path": "Soenneker.Utils.Logger.4.0.518.nupkg!!LICENSE", "pid": 0, "risk": 1, "sha": "f7982c6d623a596f15d5597575e5f6cde25dec380c4fb8da31cd721ea4c088b2", "size": 1076, "traits": [ { "id": "metadata/permission/prose::permission-permission-term-english", "conf": 0.9, "crit": 2, "desc": "Permission or access term", "spans": [ [ 53, 0 ] ] } ], "type": "text" }, { "id": 4, "sha": "f688369cdace950026648470b4d63d8291a95f1686142a839e5a20a4905d401f", "path": "Soenneker.Utils.Logger.4.0.518.nupkg!!README.md", "size": 986, "type": "markdown", "depth": 1 }, { "id": 5, "sha": "93511e8937b27717eb154ee90eaf1655d4dbbad2865ecfc5a7d0bd794c945c49", "path": "Soenneker.Utils.Logger.4.0.518.nupkg!!icon.png", "size": 16083, "type": "png", "depth": 1 }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J\u0026m(0ji6Sa?dLD+]{51x(+zoA=kPhvqNb%vqY$3BrC47aAzQxazCZol@c-7zeS@@e!5l%bME/A00000", "n": [ { "c": 2, "d": "PE contains exactly one resource entry", "i": "metadata/binary/resource::pe-single-version-resource", "o": 0, "z": 24, "cf": 1.0 } ], "ln": 0 }, { "b": "000000000000000kMy^J00000000000000000000\u00264C6g00000nb@R\u00260SSx7oD:xoFdhFU0rr91000000000000000000000000000000000000000000000000000000000000000009S^-6000uQ9S^-6000uQ9S*V?000cKiSZYy000uc1apgI00B+K8..u]lJv8^0rr9iEGPSJ1s%N6EGxGH1Aa$O0166Z1onA8ecsVP7iph\u003c01akU000cI761sw78g*a000vR1onA8?uT.]c(q{:3FW9h0t2kh0SS(lcPRkk000006efB!8VP\u003cr0SSijEGPSJ1ptt+3N=eU00W(P000ce1$fGL04PJ06efB!761sm0@@rkEGGMI1ptt+3N=eU00W(O000ce1$zwfc(J6=3mDhX00T]hc\u003cG.L1{eYZ000ucdLt=Z000vR0SSi6dGxCGlq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCnjoLS:byPQ)S0082[c5^(bu5Y8x(mN800000M\u003cJ/[1onA4bumUxOc/k@5c8Xgbs+:9l\u0026Wh!To[}c!b/QIbsli+vGlxd000000SSi3r#4Cg2[c!l0qVZL02tLm0rr91bME/A1POJ51onA43ig5a0@@r38#]%s8VP\u003cr0@@r30rr910rr910rr910rr911][S60SSi20rr91007^R0rr91000i6{YodM1]%8N*YN/Y?2LL14/(Ig000i6eDEWg1]@iop6p+3", "n": [ { "c": 2, "d": ".NET metadata root signature (BSJB)", "i": "metadata/binary/framework::dotnet-metadata", "o": 844, "z": 4, "cf": 1.0 }, { "c": 1, "d": "PE standard code/data section", "i": "metadata/binary/section/names::pe-code-data-standard-section", "o": 512, "z": 5, "cf": 0.8999999761581421 } ], "ln": 480 }, { "b": "0bMN^mrSlWBwcm?wO.uuz!AY]A-Ei}yYEyLwO#x%yH}JsrDI}\u003eB1Qd8xj\u003e^@e[w^m08[e:By/p?lVl\u003cOx\u003eINevruj4zCj$Yxk8l@mr\u0026]=zGxJgzu9yBv@=Hez!s8zmr\u0026]=zGxJgzGvA$z/ff3xlwl6BzkVh07/K@zF0P}B-H]jx(v\u003e?q*ACawO\u003c4$wOb:\u0026v@#B6zu9vGxj\u003e^@p\u0026ZF$x\u003eg^}lVl^SwN/*@z/bLNz!i*7wOU\u003c$e(^1cy\u0026.j5z!AY]ASwW8z!AY]ASx--BydZWxj\u003e^@077*xy?cjTxj\u003e^@07g^rvru6Oz!AY]ASv.4Bz(g1e[nykz/L?RD2[7sz7Xj\u003cvp%E@B98baA@Yc:B97#ge(D?fBzkP6e\u003c\u003cL]Aa%c1A-lK\u0026C4\u003eC$A@XQtvS=r@x(mMTz!9B208)/EzF\u003c33wPxy[wO%a?zGP!%vqH6$A@X)Lxj\u003e^@mQY!Gz/Qa(CYWImB7]MgA@", "n": [ { "c": 2, "d": ".NET System.Diagnostics namespace reference", "i": "metadata/lang/compiler/managed::diagnostics-namespace", "o": 3261, "z": 18, "cf": 0.75 }, { "c": 2, "d": ".NET System.Reflection namespace reference", "i": "metadata/lang/compiler/managed::reflection-namespace", "o": 3138, "z": 17, "cf": 0.699999988079071 }, { "c": 2, "d": ".dll extension reference", "i": "micro-behaviors/fs/path/extension::dll-dup", "o": 3046, "z": 4, "cf": 0.5 } ], "ln": 2998 }, { "b": "e(1\u0026mlVm0Rl2Z=]r+lq)x(v(LB$\u003eW6fAzeM4IRxMvqPO1z/PRYx(!lfvr\u003eQRzdK2apdnb8f!+jl8ux*MxMOunB2\u003e%cB8LSczE)P{AXp\u003cuz2:LA0rrv5wO+{^B7CsKdGGI}lVl{?A+Pf1BrFD1atLSagC7vogbZmEvqxA%q/uk+zE)P{ASu820rs#yaA.:pw{4]jB-.tlx([Ryy?Wv0vrcSowmYg=x(mMaCwhejax8\u0026(x(4Z2az+$exk8l@000Gf00$FmfFkjqh#", "n": [ { "c": 3, "d": "Hardcoded network URL with domain name", "i": "micro-behaviors/communications/http/url/domain::http-url-binary", "o": 3884, "z": 21, "cf": 0.699999988079071 }, { "c": 2, "d": "Copyright notice", "i": "metadata/package/license::copyright-word", "o": 3924, "z": 9, "cf": 0.6000000238418579 } ], "ln": 3820 }, { "b": "0000000000000000000000000000000000000000000000000000000000315c8Xg7YTL^000000000000000000310rr91fAq960000000000000000003100000nb@R\u0026su(\u0026^BozNz0000000000BoBA200341qVHe8rSCL*qufR}nDqJ^p5[S3nDqG=mGui:00000Y-^*600031000c4000i8000c4000i8kl7V-000001onA40SSi2000000000000000l\u0026Wh!0rud2ve$rFmGvc5yYF2DnDrSdw=", "n": [ { "c": 2, "d": "PE version resource metadata", "i": "metadata/package/versioning::version-resource-metadata", "o": 5214, "z": 15, "cf": 0.8999999761581421 }, { "c": 1, "d": "PE resource section", "i": "metadata/binary/section/names::pe-resource-section", "o": 5120, "z": 5, "cf": 0.8999999761581421 } ], "ln": 5088 }, { "b": "006k900031fAr^bfAr^bfAr{fvGn7Z004VLhui:TlJz38z2!zMwDlPFBo3vZ002p+aolJ:A@Y+Kw=M@NyYCNTBPuH-x-I@Hx-JkPC(O@!yYFeHvGpAGve$rFC(O@!wb{fvve$9zx-J2Jx8\u003c4OCk#sSBo2$OaoksuwDl-Jx-I@HzVBzIaoliTzVBzIx8(SCzuaqH002W)761vnlJz38z2!IPve$fBC(QOtve$cAwDhYg003WjBo3y.z#:}ViSH/kf934[zVBtGzuaLOwDlGCwDl-Je=YwYzVBRO003417xsEomGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up002{$zVBtGzuaLOwDlGCwDl-Je=X(KBo31PyYFIRe=XMBzVBzIx8(GyASu7t001?Q3ig8bmGvc5yYF2DrSDXhASydXx-J5Kzu6Up001?Qe=WN9e=W:ef-Tfke=WN9003418VP)snDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE002{$zVBtGzuaLOwDlGCwDl-Je=X(KBo31PyYFIRe=XMBzVBzIx8(GyASvY(wb{ACyYBCn003)pb(^@CoAnS7x8(uuyYD*5zVB.RC(R\u003c+x-I=CxAibO002v^zVB.RC(R\u003c+x-I=CxAibOaonwvaojd%fAr\u003cdgxo0bg5%0dg5%ijaok1lve$6ywDi?MqVH.owDlPFzuakFyxd]CASu7t003s98VP)spxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE002{$zVBtGzuaLOwDlGCwDl-Je=X(KBo31PyYFIRe=XMBzVBzIx8(GyASvY(wb{ACyYBCn002:]7xsEopYLIozVBqFBPt[KBo25ove$cAwDhYg002{$zVBtGzuaLOwDlGCwDl-Je=X(KBo31PyYFIRe=XMBzVBzIx8(GyASu7t004-Nf-RjOpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001?Qe=WN9e=W:ef-Tfkd/:5VgYPohwb{9th#\u003eYlh2}j*v/OB/wDjN/gYQ}:f-S)cv/OE*w=K*\u003ehVLMjf-T6hve%\u003cshumg^h#)H\u0026vGo%tirg/mhump*h2}4+g5}pO002aY3ig8bk(+%aA@Y+Kz2!2ByYF.XaokBxwDl-JA@Y[OzVBUP001?Qe=WN9e=W:ef-Tfke=WN90000000000000000000000000", "n": [ { "c": 3, "d": "PE version metadata includes CompanyName", "i": "metadata/package/versioning::pe-companyname-field", "o": 5566, "z": 11, "cf": 0.699999988079071 }, { "c": 3, "d": "PE version metadata includes FileDescription", "i": "metadata/package/versioning::pe-filedescription-field", "o": 5642, "z": 15, "cf": 0.699999988079071 }, { "c": 3, "d": "PE version metadata includes FileVersion", "i": "metadata/package/versioning::pe-fileversion-field", "o": 5730, "z": 11, "cf": 0.699999988079071 }, { "c": 3, "d": "PE version metadata includes InternalName", "i": "metadata/package/versioning::pe-internalname-field", "o": 5782, "z": 12, "cf": 0.699999988079071 }, { "c": 3, "d": "PE version metadata includes ProductVersion", "i": "metadata/package/versioning::pe-productversion-field", "o": 6158, "z": 14, "cf": 0.699999988079071 }, { "c": 3, "d": "PE ProductVersion has SemVer git hash", "i": "metadata/package/versioning::pe-productversion-semver-git-hash", "o": 6188, "z": 48, "cf": 0.8999999761581421 }, { "c": 2, "d": "PE OriginalFilename metadata field", "i": "metadata/package/versioning::pe-originalfilename-field", "o": 5982, "z": 16, "cf": 0.699999988079071 }, { "c": 1, "d": "Several short title-cased resource strings", "i": "metadata/binary/resource::short-titlecase-resource-words", "o": 5434, "z": 8, "cf": 0.800000011920929 }, { "c": 1, "d": "PE version company name populated", "i": "metadata/package/versioning::pe-company-name-populated", "o": 5592, "z": 21, "cf": 0.8500000238418579 }, { "c": 1, "d": "PE FileDescription field is populated", "i": "metadata/package/versioning::pe-file-description-present", "o": 5676, "z": 22, "cf": 0.949999988079071 }, { "c": 1, "d": "PE LegalCopyright field is populated", "i": "metadata/package/versioning::pe-legal-copyright-present", "o": 5900, "z": 37, "cf": 0.949999988079071 }, { "c": 1, "d": "PE ProductName field is populated", "i": "metadata/package/versioning::pe-product-name-present", "o": 6104, "z": 22, "cf": 0.949999988079071 }, { "c": 1, "d": "PE FileVersion value is present", "i": "metadata/package/versioning::version-info-file-version-present", "o": 5756, "z": 9, "cf": 0.949999988079071 } ], "ln": 5402 }, { "b": "00000000000000000000000000000000000000000000000000000000000005axM3\u0026*nc05axM00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", "n": [ { "c": 2, "d": "PE .reloc section presence", "i": "metadata/binary/section/names::reloc-section-presence", "o": 6656, "z": 6, "cf": 0.8999999761581421 } ], "ln": 6608 } ], "depth": 1, "facts": { "imp": [ [ "mscoree", "CorDllMain" ] ], "sec": [ [ ".text", 512, 4608, 5.08, "r-x" ], [ ".rsrc", 5120, 1536, 2.83, "r--" ], [ ".reloc", 6656, 512, 0.06, "r--" ] ], "metrics": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "clr.is_il_only": 1.0, "resource_count": 1.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 50139.0, "reloc_overhang_bytes": 500.0, "reloc_overhang_ratio": 0.98, "clr.is_32bit_required": 0.0, "bss_like_section_count": 0.0, "clr.is_32bit_preferred": 0.0, "clr.strong_name_signed": 0.0, "section_overflow_count": 0.0, "clr.is_native_entrypoint": 0.0, "misaligned_section_count": 0.0, "version.identity_entropy": 3.98, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0, "version.identity_symbol_ratio": 0.12 }, "file": { "size": 7168.0, "entropy": 4.28, "size_bytes": 7168.0 }, "binary": { "is_pie": 1.0, "code_entropy": 5.08, "string_count": 114.0, "overall_entropy": 4.28, "entropy_variance": 4.22, "avg_string_length": 19.71, "max_string_length": 76.0, "peak_region_bytes": 1024.0, "code_to_data_ratio": 1.0, "peak_region_entropy": 5.67, "string_length_stddev": 12.68, "largest_section_ratio": 0.64, "sentence_string_count": 5.0, "sentence_string_ratio": 0.04, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 4608.0, "entropy_max": 5.08, "entropy_mean": 2.66, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } } }, "id": 6, "mol": "H(Cm)Md₂(BiPa)", "path": "Soenneker.Utils.Logger.4.0.518.nupkg!!lib/net10.0/Soenneker.Utils.Logger.dll", "pid": 0, "risk": 4, "sha": "e57806c4fb7f3c61a0e21d404c0b16205f4f6a1dd8b18f208cd242ba5b93a664", "size": 7168, "traits": [ { "id": "metadata/build/reproducible::pe-reproducible-build", "conf": 1.0, "crit": 2, "desc": "Built with /Brepro (deterministic)" }, { "id": "metadata/binary/metrics/entropy::code-entropy-at-most-7-5", "conf": 0.699999988079071, "crit": 1, "desc": "Code entropy is 7.5 or lower", "spans": [ [ 0, 26 ] ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 5214, 15 ] ] }, { "id": "metadata/package/versioning::pe-productversion-semver-git-hash", "conf": 0.8999999761581421, "crit": 3, "desc": "PE ProductVersion has SemVer git hash", "spans": [ [ 6188, 48 ] ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 3, "desc": "PE version metadata includes FileVersion", "spans": [ [ 5730, 11 ] ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR header (COM descriptor)" }, { "id": "metadata/package/versioning::pe-companyname-field", "conf": 0.699999988079071, "crit": 3, "desc": "PE version metadata includes CompanyName", "spans": [ [ 5566, 11 ] ] }, { "id": "metadata/package/versioning::pe-filedescription-field", "conf": 0.699999988079071, "crit": 3, "desc": "PE version metadata includes FileDescription", "spans": [ [ 5642, 15 ] ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 3, "desc": "PE version metadata includes ProductVersion", "spans": [ [ 6158, 14 ] ] }, { "id": "metadata/package/versioning::pe-internalname-field", "conf": 0.699999988079071, "crit": 3, "desc": "PE version metadata includes InternalName", "spans": [ [ 5782, 12 ] ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET metadata root signature (BSJB)", "spans": [ [ 844, 4 ] ] }, { "id": "metadata/binary/layout::pe-no-signature-record", "conf": 0.949999988079071, "crit": 3, "desc": "PE has no signature record" }, { "id": "micro-behaviors/communications/http/url/domain::http-url-binary", "atk": "T1071.001", "mbc": "C0002", "conf": 0.699999988079071, "crit": 3, "desc": "Hardcoded network URL with domain name", "spans": [ [ 3884, 21 ] ] }, { "id": "metadata/binary/anomaly/provenance::pe-far-future-timestamp", "conf": 0.949999988079071, "crit": 2, "desc": "PE COFF timestamp encodes a future date" }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET managed assembly", "spans": [ [ 844, 4 ] ] } ], "type": "pe" }, { "id": 7, "sha": "91a26f3a72928f1234a76ce27da5f26acb7fd14ed8ab2dac40f9bfe5951f2d1c", "path": "Soenneker.Utils.Logger.4.0.518.nupkg!!lib/net10.0/Soenneker.Utils.Logger.xml", "size": 5718, "type": "xml", "depth": 1 }, { "id": 8, "sha": "63feef730c8c6225c83eeeb608a1575fcac22006897782d889c10c4310523657", "path": "Soenneker.Utils.Logger.4.0.518.nupkg!![Content_Types].xml", "size": 712, "type": "xml", "depth": 1 }, { "id": 9, "sha": "594cc2b4bd1662de1527190887f523c189fd32d3ec7d00b8a36c2acda120f451", "path": "Soenneker.Utils.Logger.4.0.518.nupkg!!package/services/metadata/core-properties/6a52473749f740b0ae7a810f80353d37.psmdcp", "size": 688, "type": "xml", "depth": 1 }, { "id": 10, "mol": "Md", "sha": "644f1fb0be4c282e762e7a40b488b090538aacbd78ed77ac984ab9cdcdcb2882", "path": "Soenneker.Utils.Logger@4.0.518.registry.json", "risk": 1, "size": 961, "type": "registry", "depth": 1 } ], "omitted_files": 6, "rev": "488c9", "v": "8" } }