{ "ml": { "v": "7", "eng": "2.2.1", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.80784976, "rte": "az", "prob": 0.80784976 }, { "cls": 0, "raw": 0.09920555, "rte": "az/nupkg", "prob": 0.09920555 } ], "prob": 0.80784976, "skip": [ { "rte": "az/zip", "why": "unavailable" }, { "rte": "az/zip", "why": "unavailable" } ], "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.8078497648239136, "type": "nupkg" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.00012001395225524902, "type": "xml" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.013034194707870483, "type": "xml" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.017961472272872925, "type": "markdown" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.00006663799285888672, "type": "png" }, { "id": 5, "lvl": -1, "conf": 0, "prob": 0.7220720052719116, "type": "pe" }, { "id": 6, "lvl": -1, "conf": 0, "prob": 0.713941752910614, "type": "pe" }, { "id": 7, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "xml" }, { "id": 8, "lvl": -1, "conf": 0, "prob": 0.00012001395225524902, "type": "xml" }, { "id": 9, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "registry" } ], "version": "v18.18", "analyzed_at": "2026-07-09T10:30:33Z" }, "path": "BLite.Bson.5.0.3.nupkg", "raw": { "files": [ { "id": 0, "mol": "O(Al)H(Db)", "sha": "4907f2a8fec322082208007b118558618f430f4b6595c44713620f831bcd12da", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/BLite.Bson/BLite.Bson.5.0.3.nupkg", "risk": 3, "size": 104427, "type": "nupkg", "facts": { "metrics": { "file": { "size": 104427.0, "entropy": 7.99, "size_bytes": 104427.0 }, "binary": { "overall_entropy": 7.99, "peak_region_bytes": 100352.0, "peak_region_entropy": 7.83 }, "archive": { "file_count": 9.0, "member_count": 9.0, "script_count": 0.0, "zip_bomb_ratio": 2.77, "directory_count": 0.0, "executable_count": 2.0, "extra_field_size": 0.0, "noise_file_count": 0.0, "total_compressed": 103285.0, "compression.ratio": 0.49, "hidden_file_count": 2.0, "total_uncompressed": 212445.0, "crc_collision_count": 0.0, "entry_comment_count": 0.0, "max_filename_length": 81.0, "rtlo_filename_count": 0.0, "format.regular_count": 9.0, "nested_archive_count": 0.0, "path_traversal_count": 0.0, "symlink_escape_count": 0.0, "security.setgid_count": 0.0, "security.setuid_count": 0.0, "security.sticky_count": 0.0, "double_extension_count": 0.0, "duplicate_member_count": 0.0, "security.symlink_count": 0.0, "unicode_filename_count": 0.0, "homoglyph_filename_count": 0.0, "security.encrypted_count": 0.0, "timing.mtime_unique_count": 4.0, "timing.mtime_unique_ratio": 0.44, "misplaced_executable_count": 2.0, "timing.mtime_dominant_count": 4.0, "timing.mtime_spread_seconds": 25152.0, "timing.sentinel_mtime_count": 0.0, "security.world_writable_count": 0.0, "timing.mtime_dominant_fraction": 0.44, "compression.method_counts.stored": 1.0, "compression.method_counts.deflate": 8.0 } } }, "ident": { "name": { "value": "BLite.Bson", "source": "nupkg.title", "verified": false }, "urls": [ { "url": "https://github.com/EntglDb/BLite", "kind": "repository", "source": "nupkg.repository_url" } ], "trust": "unsigned", "authors": [ { "name": "BLite Team", "role": "author", "source": "nupkg.authors" } ], "version": { "value": "5.0.3", "source": "nupkg.version", "verified": false }, "identifier": { "value": "BLite.Bson", "source": "nupkg.id", "verified": false } }, "traits": [ { "id": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "conf": 1.0, "crit": 3, "desc": "JSON polymorphism runtime marker", "from": [ { "file": 5 } ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "from": [ { "file": 5 } ] }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "from": [ { "file": 5 } ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "metadata/package/versioning::version-word-lower", "conf": 0.4000000059604645, "crit": 2, "desc": "version word (lowercase)", "from": [ { "file": 5 } ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "from": [ { "file": 5 } ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "from": [ { "file": 5 }, { "file": 6 } ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "from": [ { "file": 5 } ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/data/decode/hex::dotnet-hexstring-conversion", "conf": 0.8600000143051147, "crit": 3, "desc": ".NET hex string conversion", "from": [ { "file": 5 } ] } ] }, { "depth": 1, "facts": { "metrics": { "file": { "size": 500.0, "entropy": 5.16, "size_bytes": 500.0 }, "binary": { "overall_entropy": 5.16, "peak_region_bytes": 500.0, "peak_region_entropy": 5.16 } } }, "id": 1, "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/BLite.Bson/BLite.Bson.5.0.3.nupkg!!_rels/.rels", "sha": "c3adb0c16c6832de264477c6804289b5c3a750faa115723b0177bef5ce3b52b9", "size": 500, "type": "xml" }, { "ctx": [ { "b": "[4ls%kx}3YaA?spB7]MgjT8QkfD}SJzEWP}x(mMDb6w0teJs}sj]", "n": [ { "c": 2, "d": "NuGet nuspec manifest file", "i": "metadata/build/manifest::nuspec-file", "o": 0, "z": 17, "cf": 0.9800000190734863 } ], "ln": 1, "addr": 0 }, { "b": "jAa.syHH\u003c!aB4:tzGv@+xMOuniXJdcv}YB\u003cvrj5rx\u003e8g4B8LVje[n*pfk$ufyHH\u003c\u0026zF7QTfFLvpfF$I3B-RIkv\u003eJ1EwfKh", "ln": 2, "addr": 42 }, { "b": "arS^-wPRu\u003evrt{w", "ln": 3, "addr": 118 }, { "b": "arR^Hjy\u00262Av@=p5BzkVhk0\u0026gzp9rFDA+O@#x)Kifx(v(ioLE%RvrcSow]zYjnnhZIeL{20w]zZbvqYN^avGTWvpAU^wGTAVxk8l{aMv{oaAIWAAbP=sB098gmn$x:fD:!wwfrH1mn$ydByx5$vrb)3ga\u003epzfjXTnv@=p5BzkVhj]", "ln": 11, "addr": 380 }, { "b": "arR^HjAL1AB3sbyBywS!B7DF9zdm6!wmYo]vSME9az#asACM+nwPPTXaz$+jB97\u0026dwmoH?gbf[$wPzYvvqG:#v{%E[z/cXmvrDobB-7]nC{4uuzddE0zAGN]vp%TB", "ln": 12, "addr": 518 }, { "b": "arR^HjAt1Lz/YSmz/QaCBA}?pjTaJMBrR\u0026IA+)(.xMOunB2\u003e%cxk8E3BZ=$kz/4c@zGGJcl$d/ooLFPWa%pxlzeB0ejTaC@f/Ra6i5\u0026T3vpJ!QgbR0FwhN\u003eeiC8\u003eTiaK)Sf!+pofF\u003eTAwhbnJffP", "n": [ { "c": 2, "d": "NuGet package declares repository", "i": "metadata/package/files/nuget::nuspec-repository", "o": 623, "z": 69, "cf": 0.8999999761581421 } ], "ln": 13, "addr": 619 }, { "b": "arR^Hjy\u00262xwO#3\u0026zEWx(B3o", "n": [ { "c": 2, "d": "NuGet package declares dependencies", "i": "metadata/package/files/nuget::nuspec-dependencies", "o": 742, "z": 124, "cf": 0.8999999761581421 } ], "ln": 14, "addr": 738 }, { "b": "arR^HarS^VA=l8taAR4jxjVfOA:-/@Cw?IqjTa=PBtkE4fD}R)j]", "ln": 15, "addr": 757 }, { "b": "arR^HarS^VA=l8taAR4jxjVfOA:-/@Cw?IqjT8HNmo0icvqYQ:A+3{Tf^n^", "ln": 16, "addr": 799 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 994.0, "entropy": 5.1, "size_bytes": 994.0 }, "binary": { "overall_entropy": 5.1, "peak_region_bytes": 994.0, "peak_region_entropy": 5.1 } } }, "id": 2, "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/BLite.Bson/BLite.Bson.5.0.3.nupkg!!BLite.Bson.nuspec", "risk": 1, "sha": "2a7847882bd4f5a1249b31adf2e74366cf707420709587afd84dc986c049adae", "size": 994, "traits": [ { "id": "metadata/build/manifest::nuspec-file", "conf": 0.9800000190734863, "crit": 2, "desc": "NuGet nuspec manifest file", "spans": [ [ 0, 17 ] ] }, { "id": "metadata/package/files/nuget::nuspec-repository", "conf": 0.8999999761581421, "crit": 2, "desc": "NuGet package declares repository", "spans": [ [ 623, 69 ] ] }, { "id": "metadata/package/files/nuget::nuspec-dependencies", "conf": 0.8999999761581421, "crit": 2, "desc": "NuGet package declares dependencies", "spans": [ [ 742, 124 ] ] } ], "type": "xml" }, { "ctx": [ { "b": "boV0mP==V}x()[}3l{=uav{iVxF04(A+olgzddr(wGTrrpFJ32vrt{!vrl05mq=:LzE\u003c@5z/M%Mpdna\u003e3jNtDaZmY:m}D^Fc$)ZAAc15[fkkooe]$YuwO+)#e[]kSzGPP6Bt4!\u003clqh9nwJ$0tvR6vszGPP6Bs7Hoy\u0026stSA+e=gt{%xdBz#pZfe4J[Cp)=QxjVfqz/PFzAa9l(vp%d)fg5uDBy=)g3r[VTpix6rBrA$\u0026Cw.knvpTB+c$)ZAAc15[fkkooe]}", "ln": 0, "col": 1, "line": 1 }, { "b": "ayYFcy\u0026*!iA=k!qB7ol0ByO#bw]zYjdK]pzCXI2qz6i!eA+olgzddr(wHYeLvqYP#dK]:QA=i7ey\u0026131vruj4zyNa*aw3U$y?m^3A:-P(B0bsrwmY!0atczTr3k^:vruTjwPF#gx\u003e}o5u@I2MzAH(Zu[rBdo\u003ewfWA^o=Dk42]:vqYP#q/u/0v}u+", "ln": 817, "col": 69, "line": 12 }, { "b": "BAnMOdSe*tf!+jldK(MHzE:\u003etdSe*tB97\u0026dwmoH?ga\u003ephdJ)-3LPUf*A+/.sCwhejatczTr3j4GefE@gx([RKaxS5?vrc71efEUMry[.:vqYP#vqZukzE){hByx5$vrb)le?[}/z/6D4Bzki2wGV2ozGGPfwIaA04gkowtoM:qr7g743o/NZdT0W4", "ln": 1035, "col": 27, "line": 14 }, { "b": "z7d1UvqYP#dK]7xzE)\u0026%y?Xibwft]7By/uix(v(iAbPMbv}/H}dK)4[q!oI.BzbkdB7F\u003c6x(v)gayX[#z*9soz/M$hwPRu{y\u0026.cIz/M$mzGx]dy?$kiz*akK3o/Ouu%\u003cAJj%jxOBz+ViayO!\u003eaAg+0yHH\u003c!avn+oBy=NDeP$YCB7]Mgat\u003e=9e?^.", "ln": 1483, "col": 308, "line": 17 }, { "b": "B7GxlluN9Wu[rBdrD8FSBy^^Yy?)AfayEPGy?mZ1luN9Wu[rBdlVm9+BylKuxKM6}ayX[[zxHzUA+f9aC4ChldJ\u0026tzz/3R8l#MNTzdNQblVl^SwN/*@z/dWpnN%v{r6BXjvqYP#u{]oTvqPZ*lVl^SwN/*@z/e@nawV(\u003eC{3GAl34r?v{*B5vrc6\u003c", "ln": 1810, "col": 93, "line": 26 }, { "b": "mr\u0026=.A+P95v}vbtiV{[my?$j/nLSb9Ab](ux\u003eg^}asHR?qfuC\u003cD0$e#wND@fBzb98azbg@y\u0026Z.nx\u003e}o5mq^iYBA[##A:-/@Cw?IqayYFnaAzQxB0bysayX=1wGU\u00263Byw#r4gjWfdK[tcy?Wr!y?k7CiV{[my?$jWlRfV*BAg/cB75N2x(v)gaA}Kw", "ln": 2531, "col": 15, "line": 35 }, { "b": "xlwl6BzkVhdK(MKx(W={BzMjBz/cXtxK@q@z!%l3v@#B6zxJ!cBywY*Byu^Ara]#!ay/tcw[+[2A::67z/cXsAaJJ[w[+*$aA}Hkv}V#Kq+{dhw[+*)woe(mxM53fwftt)aA.:pwft#jayYFcy?aVgxK@r2zG6-uaARgtBrCglAV/TCB-FQozdm6!", "ln": 7870, "col": 117, "line": 142 }, { "b": "A::63B0a)lB-7]kB.8XovqYQ]z6i[dy\u0026*!swPw]9x(4uiay]57x)a6eaARpdaveB{eIYgwazULlaA?Ecaw+x$l}e{-q+fhfh8VN9hzu*cfFCg6x(){bvruj4zGvlTayPd#aAITyA+fqmBzbkdB75)bazCZoBzbkdhz^0{D30QuwO#0#D2N\u003epwftF#y?j-5wNPaXAV\u003cv(LPT\u003cZaAIakvrb^#wGV55y\u0026*!ix(4u6zE)x\u0026wN)z53jNtIu%)F=", "ln": 10320, "col": 70, "line": 204 }, { "b": "xLzMhA::63iV@=^e\u003c\u003c5SxK%.GBw=K?wJATxEir[Wl3u(-ADL\u0026kC@^6{z7Xa$xhJ!.A^px2iZ$(Maz(fzdlv$C4gj:wawV@/zD7g-wO(12A^n!!FrRf%wOkZ#By/E", "ln": 13778, "col": 27, "line": 287 }, { "b": "zEEu7r8=Ku4gl(]e(Mt6c)A.zB8#5lzAqinv\u003ciDDmq=QNwnb{]e(+\u003eui4^ZjBv7m{wPGmzAaa3dz^^f2dj=Pvx(dAWAa9SpmSJA:nn\u0026S\u003eB0@:(dlv$C4gj:waw#=Vwdn(PD30R4t%xDPvqH6$auZ\u0026.B$Mo@Bsns", "ln": 28296, "col": 16, "line": 591 }, { "b": "bo[s4z*9sCzY?w?x(4q?3nBdQdK)/4z/fbodMOXWxk8Dgv@c73wGUVdBz#pZfe3%LBzb/ae[n*pfkU-uwP\u00269jvScuwlqh9nwIdRfBykK+ga\u003cX0dNFn(y?b1BiV}*vz//(dBrC4nx(4r/4gj)zasX\u003cuwPI@ydG", "ln": 53897, "col": 2, "line": 1160 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 54756, "entropy": 5.3 }, "text": { "lines": 1183, "top_char": 101, "max_ws_run": 41, "digit_ratio": 0.01, "space_count": 6579, "char_entropy": 5.3, "unique_chars": 134, "top_char_null": 0, "lines_over_200": 42, "top_char_ratio": 0.08, "ascii_art_lines": 1, "avg_line_length": 44.29, "invisible_chars": 11, "max_line_length": 464, "non_ascii_ratio": 0.01, "empty_line_ratio": 0.24, "last_line_length": 82, "long_token_count": 4, "whitespace_ratio": 0.16, "line_length_stddev": 60.13, "repeated_char_sequences": 14, "trailing_whitespace_lines": 8 }, "binary": { "peak_region_bytes": 53732, "peak_region_entropy": 5.3 } } }, "id": 3, "mol": "H(Cr)", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/BLite.Bson/BLite.Bson.5.0.3.nupkg!!README.md", "pid": 0, "risk": 1, "sha": "6a230d7f54e1bbd9ffe69cb40c0badc55004d35e15c5fd15d915bdd9d772cd1d", "size": 54756, "traits": [ { "id": "micro-behaviors/crypto/kdf/algorithm::pbkdf2", "conf": 0.75, "crit": 3, "desc": "PBKDF2 key-derivation reference", "spans": [ [ 10384, 8 ] ] } ], "type": "markdown" }, { "id": 4, "sha": "da7e9785dc5215c453557a6e2f32fe802bc08a6a78e5d98f0b647541e4debdf1", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/BLite.Bson/BLite.Bson.5.0.3.nupkg!!icon.png", "size": 33309, "type": "png", "depth": 1 }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J\u0026m(", "n": [ { "c": 3, "d": "HTTP fingerprinting evasion campaign", "i": "objectives/command-and-control/infrastructure/user-agent::http-fingerprinting-campaign", "o": 0, "z": 34, "cf": 0.8999999761581421 } ], "ln": 0 }, { "b": "000000000000000000002Kqu\u002600000nb@R\u00260SSx7:ANW+c#/j!0rr91000000000000", "n": [ { "c": 1, "d": "PE standard code/data section", "i": "metadata/binary/section/names::pe-code-data-standard-section", "o": 512, "z": 5, "cf": 0.8999999761581421 } ], "ln": 496 }, { "b": "Enx[z1o{s%0W{\u003eC00T[Mlq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn", "n": [ { "c": 3, "d": "Recognized PE anti-analysis marker", "i": "objectives/anti-analysis/debugger-detect/combined-checks::evasion-aware-recognized-pe-marker", "o": 23240, "z": 4, "cf": 1.0 } ], "ln": 23224 }, { "b": "mf3zfx()]Oz/]J9wLtI)q*ACawO\u003c4\u003epxkMDy\u0026%q@uJs.IByd^OB97#7q!6GLzd9A=wPRoOwD", "n": [ { "c": 2, "d": "System namespace reference", "i": "metadata/lang/compiler/managed::system-namespace", "o": 36510, "z": 9, "cf": 0.800000011920929 } ], "ln": 36494 }, { "b": "zF5@GA^pe^Bw)p4x(mL-mSJA:nm^3ABAh8kx8\u003e[Hnm^3ABAh8kx8(1Nx()]LA=LPlq/)4]zF5@ox\u003eG\u003eLwnbE\u0026q!Y(ZmG", "n": [ { "c": 3, "d": ".NET hex string conversion", "i": "micro-behaviors/data/decode/hex::dotnet-hexstring-conversion", "o": 39566, "z": 13, "cf": 0.8600000143051147 } ], "ln": 39550 }, { "b": "vqC{PyYD^}x()]sluv6.e[w^m0b2\u003e+uRU-WyYD+iwkmn-yYEKSx()]YB.\u003e\u003c]xjVf(", "n": [ { "c": 3, "d": "References Windows executable or script", "i": "objectives/execution/interpreter/script/shell::windows-executable-ref", "o": 39941, "z": 4, "cf": 0.6000000238418579 } ], "ln": 39925 }, { "b": "0b(*-q/#L\u003eA:-E1x(v\u003e?q*ACawO\u003c4$wOb:\u0026v@#B6zuarXByd\u003c.B7]-gz/bL@x)Kt!z/YSmx(v\u003e?uVo}8x-", "n": [ { "c": 2, "d": "Benign high-entropy PE context", "i": "metadata/package/quality/false-positives::benign-high-entropy-pe-context", "o": 40584, "z": 17, "cf": 0.949999988079071 } ], "ln": 40568 }, { "b": "mSJA:luv6.090(6B8L{@q*ACawO\u003c50wQ5qHn][]*07I0EzaX\u003e/zu9TOn][]*08)#Wx(mMJz/6D4A+PPk", "n": [ { "c": 3, "d": "JSON polymorphism runtime marker", "i": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "o": 40767, "z": 16, "cf": 1.0 } ], "ln": 40751 }, { "b": "Byw#Wx(4Q1B7F\u003c1zE^!*q*ACawO\u003c4$B-8qnzdLs\u003ezGGDgz/wS^A=#ebwPE\u0026ID2[7sz7X.ezGGPfwIct*ze:i9wPyZXA=#ebwPE", "n": [ { "c": 3, "d": "Packed binary marker", "i": "objectives/anti-static/obfuscation/eval/loader::packed-binary-marker", "o": 41705, "z": 30, "cf": 0.8500000238418579 } ], "ln": 41689 }, { "b": "wO(vaC%#$1wO#N6z/fQ@q*ACawO\u003c4#wN/\u003e6x([RMp?sV:x(!ufz/fQ@q*ACawO\u003c4!z!%l3v@#B6zGt^", "n": [ { "c": 2, "d": "System namespace reference", "i": "metadata/lang/compiler/managed::system-namespace", "o": 42072, "z": 15, "cf": 0.800000011920929 } ], "ln": 42056 }, { "b": "q*ACawO\u003c4$B-8qnzdLmvr+lq)x(v(Lf!+jle?![iefEr5y\u0026\u003c/uwJ:{xB-.Ujy+cY9BZ/f3v[QxUrbVL-", "n": [ { "c": 2, "d": "IPv4-like .NET assembly version", "i": "metadata/lang/compiler/managed::dotnet-ipv4-like-version", "o": 49468, "z": 16, "cf": 0.8500000238418579 } ], "ln": 49452 }, { "b": "AbY-oBy!#9x(k5nxLzJgC4CYnx(v(iz!pbqz/{7yv@Dj6x(4v3e=+}L6AFgAqE%\u0026\u003cx(W+", "n": [ { "c": 3, "d": "Recognized sparse-logic binary marker", "i": "objectives/anti-analysis/vm-detect/instruction::sparse-logic-recognized-marker", "o": 51870, "z": 7, "cf": 0.800000011920929 } ], "ln": 51854 }, { "b": "00000000000000000000000000000000000000315c8Xg7YTL^00000000000000000", "n": [ { "c": 1, "d": "PE resource section", "i": "metadata/binary/section/names::pe-resource-section", "o": 52736, "z": 5, "cf": 0.8999999761581421 } ], "ln": 52720 }, { "b": "0000000000000YogYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006Xn[brp!0rr911POJ", "n": [ { "c": 3, "d": "Recognized marker for timing checks", "i": "objectives/anti-analysis/timing/evasion::timing-anti-debug-recognized-marker", "o": 52830, "z": 15, "cf": 0.949999988079071 } ], "ln": 52814 }, { "b": "g5@{bf-RgN001[S3JHhclJz38z2!IPve$fBC(QOtve$cAwDhYg002s=oAn=bBo2\u003eLaokvvwDlcsz2:Lo002g.3JHhcmGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up002s=oAn=bBo2\u003eLe=XirA@ZaUzu6Up001XM2MK(9mGvc5yYF2DrSDXhASydXx-J5Kzu6Up001\u003eRe=WN9e=WWce=WN9002g.4/=RgnDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE002s=oAn=bBo2\u003eLe=XirA@ZaU", "n": [ { "c": 3, "d": "Dotted-quad PE version metadata marker", "i": "objectives/command-and-control/infrastructure/ip::ipv4-version-metadata-marker", "o": 53406, "z": 11, "cf": 0.9399999976158142 }, { "c": 2, "d": "PE CompanyName metadata field", "i": "metadata/package/versioning::pe-companyname-field", "o": 53286, "z": 11, "cf": 0.699999988079071 }, { "c": 2, "d": "PE FileDescription metadata field", "i": "metadata/package/versioning::pe-filedescription-field", "o": 53342, "z": 15, "cf": 0.699999988079071 }, { "c": 2, "d": "PE InternalName metadata field", "i": "metadata/package/versioning::pe-internalname-field", "o": 53454, "z": 12, "cf": 0.699999988079071 } ], "ln": 53270 }, { "b": "xAibO001bw002E*4/=Rgpxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE002s=oAn=bBo2\u003eLe=Xir", "n": [ { "c": 2, "d": "PE OriginalFilename metadata field", "i": "metadata/package/versioning::pe-originalfilename-field", "o": 53558, "z": 16, "cf": 0.699999988079071 } ], "ln": 53542 }, { "b": "wb{ACyYBCn001[S3JHhcpYLIozVBqFBPt[KBo25ove$cAwDhYg002s=oAn=bBo2\u003eLe=XirA@ZaUzu6Up004PJf8#1MpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001\u003eRe=WN9e=WWcd/:bXhVLMjh#\u003e(qwDjW\u0026h#\u003eVkve%Zov/Q0sve@4.h2]Mnh2}d!h2}a^w=K*\u003ew=MAyf-Tfkwb[E!wb[s:fAr^b", "n": [ { "c": 2, "d": "PE ProductName metadata field", "i": "metadata/package/versioning::pe-productname-field", "o": 53630, "z": 11, "cf": 0.699999988079071 }, { "c": 2, "d": "PE ProductVersion has SemVer git hash", "i": "metadata/package/versioning::pe-productversion-semver-git-hash", "o": 53716, "z": 46, "cf": 0.8999999761581421 }, { "c": 2, "d": "PE version resource metadata", "i": "metadata/package/versioning::version-resource-metadata", "o": 53686, "z": 14, "cf": 0.8999999761581421 } ], "ln": 53614 }, { "b": "000000000000000000000n)?S3\u0026*ncc{4ze000000000000000000000000000000000", "n": [ { "c": 2, "d": "PE .reloc section presence", "i": "metadata/binary/section/names::reloc-section-presence", "o": 54272, "z": 6, "cf": 0.8999999761581421 } ], "ln": 54256 } ], "depth": 1, "facts": { "imp": [ [ "mscoree", "CorDllMain" ] ], "sec": [ [ ".text", 512, 52224, 5.72, "r-x" ], [ ".rsrc", 52736, 1536, 2.63, "r--" ], [ ".reloc", 54272, 512, 0.08, "r--" ] ], "metrics": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "resource_count": 1.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 99792.0, "reloc_overhang_bytes": 500.0, "reloc_overhang_ratio": 0.98, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "version.identity_entropy": 3.51, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0, "version.identity_symbol_ratio": 0.07 }, "file": { "size": 54784.0, "entropy": 5.61, "size_bytes": 54784.0 }, "binary": { "is_pie": 1.0, "code_entropy": 5.72, "string_count": 618.0, "overall_entropy": 5.61, "entropy_variance": 5.32, "avg_string_length": 16.11, "max_string_length": 139.0, "peak_region_bytes": 5120.0, "code_to_data_ratio": 1.0, "peak_region_entropy": 5.88, "string_length_stddev": 12.18, "largest_section_ratio": 0.95, "sentence_string_count": 47.0, "sentence_string_ratio": 0.08, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 52224.0, "entropy_max": 5.72, "entropy_mean": 2.81, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } } }, "id": 5, "mol": "O(Al)H(Db)", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/BLite.Bson/BLite.Bson.5.0.3.nupkg!!lib/net10.0/BLite.Bson.dll", "risk": 3, "sha": "7ef72da436ef774c974880eac4dc50adf8a7a5e463e4c77e65657d1ce1f9a6fd", "size": 54784, "traits": [ { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "spans": [ [ 39941, 4 ] ] }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "spans": [ [ 0, 26 ] ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 52830, 15 ] ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "spans": [ [ 23240, 4 ] ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "conf": 1.0, "crit": 3, "desc": "JSON polymorphism runtime marker", "spans": [ [ 40767, 16 ] ] }, { "id": "micro-behaviors/data/decode/hex::dotnet-hexstring-conversion", "conf": 0.8600000143051147, "crit": 3, "desc": ".NET hex string conversion", "spans": [ [ 39566, 13 ], [ 39582, 9 ] ] }, { "id": "metadata/package/versioning::version-word-lower", "conf": 0.4000000059604645, "crit": 2, "desc": "version word (lowercase)", "spans": [ [ 51870, 7 ] ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "spans": [ [ 53406, 11 ] ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "spans": [ [ 53686, 14 ] ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "spans": [ [ 23240, 4 ] ] } ], "type": "pe" }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J\u0026m(", "n": [ { "c": 3, "d": "HTTP fingerprinting evasion campaign", "i": "objectives/command-and-control/infrastructure/user-agent::http-fingerprinting-campaign", "o": 0, "z": 34, "cf": 0.8999999761581421 } ], "ln": 0 }, { "b": "00000000000000000000+i5:800000nb@R\u00260SSx7LYD*87\u0026]VS0rr91000000000000", "n": [ { "c": 1, "d": "PE standard code/data section", "i": "metadata/binary/section/names::pe-code-data-standard-section", "o": 512, "z": 5, "cf": 0.8999999761581421 } ], "ln": 496 }, { "b": "Eo3sF1o{s%0W{[D00T[Mlq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn", "n": [ { "c": 3, "d": "Recognized PE anti-analysis marker", "i": "objectives/anti-analysis/debugger-detect/combined-checks::evasion-aware-recognized-pe-marker", "o": 21908, "z": 4, "cf": 1.0 } ], "ln": 21892 }, { "b": "mf3zfx()]Oz/]J9wLtI)q*ACawO\u003c4\u003epxkMDy\u0026%q@uJs.IByd^OB97#7q!6GLzd9A=wPRoOwD", "n": [ { "c": 2, "d": "System namespace reference", "i": "metadata/lang/compiler/managed::system-namespace", "o": 35151, "z": 9, "cf": 0.800000011920929 } ], "ln": 35135 }, { "b": "vqC{PyYD^}x()]sluv6.e[w^m0b2\u003e+uRU-WyYD+iwkmn-yYEKSx()]YB.\u003e\u003c]xjVf(", "n": [ { "c": 3, "d": "References Windows executable or script", "i": "objectives/execution/interpreter/script/shell::windows-executable-ref", "o": 38623, "z": 4, "cf": 0.6000000238418579 } ], "ln": 38607 }, { "b": "0b(*-q/#L\u003eA:-E1x(v\u003e?q*ACawO\u003c4$wOb:\u0026v@#B6zuarXByd\u003c.B7]-gz/bL@x)Kt!z/YSmx(v\u003e?uVo}8x-", "n": [ { "c": 2, "d": "Benign high-entropy PE context", "i": "metadata/package/quality/false-positives::benign-high-entropy-pe-context", "o": 39219, "z": 17, "cf": 0.949999988079071 } ], "ln": 39203 }, { "b": "mSJA:luv6.090(6B8L{@q*ACawO\u003c50wQ5qHn][]*07I0EzaX\u003e/zu9TOn][]*08)#Wx(mMJz/6D4A+PPk", "n": [ { "c": 3, "d": "JSON polymorphism runtime marker", "i": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "o": 39402, "z": 16, "cf": 1.0 } ], "ln": 39386 }, { "b": "Byw#Wx(4Q1B7F\u003c1zE^!*q*ACawO\u003c4$B-8qnzdLs\u003ezGGDgz/wS^A=#ebwPE\u0026ID2[7sz7X.ezGGPfwIct*ze:i9wPyZXA=#ebwPE", "n": [ { "c": 3, "d": "Packed binary marker", "i": "objectives/anti-static/obfuscation/eval/loader::packed-binary-marker", "o": 40262, "z": 30, "cf": 0.8500000238418579 } ], "ln": 40246 }, { "b": "wO(vaC%#$1wO#N6z/fQ@q*ACawO\u003c4#wN/\u003e6x([RMp?sV:x(!ufz/fQ@q*ACawO\u003c4!z!%l3v@#B6zGt^", "n": [ { "c": 2, "d": "System namespace reference", "i": "metadata/lang/compiler/managed::system-namespace", "o": 40695, "z": 15, "cf": 0.800000011920929 } ], "ln": 40679 }, { "b": "wH[%wwPS0nvqYQ:A+3Zzr+lq)x(v(Lga\u003eplfFk4gavyo/BAIRnj-j?NBAg/aefE=ivR/:*oj-xFz!\u0026[", "n": [ { "c": 2, "d": "IPv4-like .NET assembly version", "i": "metadata/lang/compiler/managed::dotnet-ipv4-like-version", "o": 48507, "z": 15, "cf": 0.8500000238418579 } ], "ln": 48491 }, { "b": "AbY-oBy!#9x(k5nxLzJgC4CYnx(v(iz!pbqz/{7yv@Dj6x(4v3e=+}L6AFgAqE%\u0026\u003cx(W+", "n": [ { "c": 3, "d": "Recognized sparse-logic binary marker", "i": "objectives/anti-analysis/vm-detect/instruction::sparse-logic-recognized-marker", "o": 50811, "z": 7, "cf": 0.800000011920929 } ], "ln": 50795 }, { "b": "00000000000000000000000000000000000000315c8Xg7YTL^00000000000000000", "n": [ { "c": 1, "d": "PE resource section", "i": "metadata/binary/section/names::pe-resource-section", "o": 51712, "z": 5, "cf": 0.8999999761581421 } ], "ln": 51696 }, { "b": "0000000000000YogYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006Xn[brp!0rr911POJ", "n": [ { "c": 3, "d": "Recognized marker for timing checks", "i": "objectives/anti-analysis/timing/evasion::timing-anti-debug-recognized-marker", "o": 51806, "z": 15, "cf": 0.949999988079071 } ], "ln": 51790 }, { "b": "g5@{bf-RgN001[S3JHhclJz38z2!IPve$fBC(QOtve$cAwDhYg002s=oAn=bBo2\u003eLaokvvwDlcsz2:Lo002g.3JHhcmGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up002s=oAn=bBo2\u003eLe=XirA@ZaUzu6Up001XM2MK(9mGvc5yYF2DrSDXhASydXx-J5Kzu6Up001\u003eRe=WN9e=WWce=WN9002g.4/=RgnDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE002s=oAn=bBo2\u003eLe=XirA@ZaU", "n": [ { "c": 3, "d": "Dotted-quad PE version metadata marker", "i": "objectives/command-and-control/infrastructure/ip::ipv4-version-metadata-marker", "o": 52382, "z": 11, "cf": 0.9399999976158142 }, { "c": 2, "d": "PE CompanyName metadata field", "i": "metadata/package/versioning::pe-companyname-field", "o": 52262, "z": 11, "cf": 0.699999988079071 }, { "c": 2, "d": "PE FileDescription metadata field", "i": "metadata/package/versioning::pe-filedescription-field", "o": 52318, "z": 15, "cf": 0.699999988079071 }, { "c": 2, "d": "PE InternalName metadata field", "i": "metadata/package/versioning::pe-internalname-field", "o": 52430, "z": 12, "cf": 0.699999988079071 } ], "ln": 52246 }, { "b": "xAibO001bw002E*4/=Rgpxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE002s=oAn=bBo2\u003eLe=Xir", "n": [ { "c": 2, "d": "PE OriginalFilename metadata field", "i": "metadata/package/versioning::pe-originalfilename-field", "o": 52534, "z": 16, "cf": 0.699999988079071 } ], "ln": 52518 }, { "b": "wb{ACyYBCn001[S3JHhcpYLIozVBqFBPt[KBo25ove$cAwDhYg002s=oAn=bBo2\u003eLe=XirA@ZaUzu6Up004PJf8#1MpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001\u003eRe=WN9e=WWcd/:bXhVLMjh#\u003e(qwDjW\u0026h#\u003eVkve%Zov/Q0sve@4.h2]Mnh2}d!h2}a^w=K*\u003ew=MAyf-Tfkwb[E!wb[s:fAr^b", "n": [ { "c": 2, "d": "PE ProductName metadata field", "i": "metadata/package/versioning::pe-productname-field", "o": 52606, "z": 11, "cf": 0.699999988079071 }, { "c": 2, "d": "PE ProductVersion has SemVer git hash", "i": "metadata/package/versioning::pe-productversion-semver-git-hash", "o": 52692, "z": 46, "cf": 0.8999999761581421 }, { "c": 2, "d": "PE version resource metadata", "i": "metadata/package/versioning::version-resource-metadata", "o": 52662, "z": 14, "cf": 0.8999999761581421 } ], "ln": 52590 }, { "b": "000000000000000000000n)?S3\u0026*nc(]a[A000000000000000000000000000000000", "n": [ { "c": 2, "d": "PE .reloc section presence", "i": "metadata/binary/section/names::reloc-section-presence", "o": 53248, "z": 6, "cf": 0.8999999761581421 } ], "ln": 53232 } ], "depth": 1, "facts": { "imp": [ [ "mscoree", "CorDllMain" ] ], "sec": [ [ ".text", 512, 51200, 5.72, "r-x" ], [ ".rsrc", 51712, 1536, 2.63, "r--" ], [ ".reloc", 53248, 512, 0.08, "r--" ] ], "metrics": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "resource_count": 1.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 80221.0, "reloc_overhang_bytes": 500.0, "reloc_overhang_ratio": 0.98, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "version.identity_entropy": 3.51, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0, "version.identity_symbol_ratio": 0.07 }, "file": { "size": 53760.0, "entropy": 5.6, "size_bytes": 53760.0 }, "binary": { "is_pie": 1.0, "code_entropy": 5.72, "string_count": 607.0, "overall_entropy": 5.6, "entropy_variance": 5.32, "avg_string_length": 16.74, "max_string_length": 135.0, "peak_region_bytes": 1024.0, "code_to_data_ratio": 1.0, "peak_region_entropy": 6.18, "string_length_stddev": 12.74, "largest_section_ratio": 0.95, "sentence_string_count": 56.0, "sentence_string_ratio": 0.09, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 51200.0, "entropy_max": 5.72, "entropy_mean": 2.81, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } } }, "id": 6, "mol": "O(Al)", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/BLite.Bson/BLite.Bson.5.0.3.nupkg!!lib/netstandard2.1/BLite.Bson.dll", "risk": 2, "sha": "20e33410f91e504d2062a64121805b30676aacf65937fac8d2fd8493583075dc", "size": 53760, "traits": [ { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "spans": [ [ 38623, 4 ] ] }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "spans": [ [ 0, 26 ] ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 51806, 15 ] ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "spans": [ [ 21908, 4 ] ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "conf": 1.0, "crit": 3, "desc": "JSON polymorphism runtime marker", "spans": [ [ 39402, 16 ] ] }, { "id": "metadata/package/versioning::version-word-lower", "conf": 0.4000000059604645, "crit": 2, "desc": "version word (lowercase)", "spans": [ [ 50811, 7 ] ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "spans": [ [ 52382, 11 ] ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "spans": [ [ 52662, 14 ] ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "spans": [ [ 21908, 4 ] ] } ], "type": "pe" }, { "id": 7, "sha": "014be50bead1e534b5c4260670332bbcb06ae1ba2fd5ee8f297a47d7605c8765", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/BLite.Bson/BLite.Bson.5.0.3.nupkg!![Content_Types].xml", "size": 582, "type": "xml", "depth": 1 }, { "id": 8, "sha": "fb24c59a594eba6c724455c2b3ee4df62f11c52162da2fe08009e192bd14227b", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/BLite.Bson/BLite.Bson.5.0.3.nupkg!!package/services/metadata/core-properties/56ae5ab6445d4aa1b7ad81aa78244b27.psmdcp", "size": 778, "type": "xml", "depth": 1 }, { "id": 9, "sha": "c048d32c4d899adfe53f0301fdcb9a10cf2393958ae2a370e679ee3f8cb9bb2c", "path": "BLite.Bson@5.0.3.registry.json", "size": 827, "type": "registry", "depth": 1 } ], "omitted_files": 4, "rev": "22d02", "v": "8" } }