{ "llm": { "conf": 0.73918676, "grade": "benign", "model": "Qwen/Qwen3.6-27B", "review": false, "outcome": "benign", "interpretation": "Legitimate .NET library package" }, "ml": { "v": "7", "eng": "2.2.0-rc.1", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.19501834, "rte": "az", "prob": 0.19501834 } ], "prob": 0.62740964, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.6274096369743347, "type": "nupkg" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.000010311603546142578, "type": "xml" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.000041544437408447266, "type": "xml" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.6274096369743347, "type": "pe" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.000011652708053588867, "type": "xml" }, { "id": 5, "lvl": -1, "conf": 0, "prob": 0.000013381242752075195, "type": "png" }, { "id": 6, "lvl": -1, "conf": 0, "prob": 0.000010033448234025855, "type": "xml" }, { "id": 7, "lvl": -1, "conf": 0, "prob": 0.00001012285520118894, "type": "xml" }, { "id": 8, "lvl": -1, "conf": 0, "prob": 0.00001085797975974856, "type": "xml" }, { "id": 9, "lvl": -1, "conf": 0, "prob": 0.00001085797975974856, "type": "registry" } ], "version": "v18.18", "analyzed_at": "2026-06-27T04:59:47Z" }, "path": "Lombiq.Hosting.MediaTheme.Bridge.8.0.1-alpha.12.osoe-925.nupkg", "raw": { "files": [ { "id": 0, "mol": "O(Al)H₂(CmDb)", "sha": "493a149d94031d23f2cf5511d5b2e16455b34ad90024b109d5a5e5ee844b60d4", "path": "Lombiq.Hosting.MediaTheme.Bridge.8.0.1-alpha.12.osoe-925.nupkg", "risk": 4, "size": 63292, "type": "nupkg", "facts": { "metrics": { "file": { "size": 63292.0, "entropy": 7.97, "size_bytes": 63292.0 }, "binary": { "overall_entropy": 7.97, "peak_region_bytes": 60416.0, "peak_region_entropy": 7.81 }, "archive": { "file_count": 9.0, "member_count": 9.0, "script_count": 0.0, "zip_bomb_ratio": 4.03, "directory_count": 0.0, "executable_count": 1.0, "extra_field_size": 0.0, "noise_file_count": 0.0, "total_compressed": 61952.0, "compression.ratio": 0.5, "hidden_file_count": 2.0, "total_uncompressed": 122928.0, "crc_collision_count": 0.0, "entry_comment_count": 0.0, "max_filename_length": 81.0, "rtlo_filename_count": 0.0, "format.regular_count": 9.0, "nested_archive_count": 0.0, "path_traversal_count": 0.0, "symlink_escape_count": 0.0, "security.setgid_count": 0.0, "security.setuid_count": 0.0, "security.sticky_count": 0.0, "double_extension_count": 0.0, "duplicate_member_count": 0.0, "security.symlink_count": 0.0, "unicode_filename_count": 0.0, "homoglyph_filename_count": 0.0, "security.encrypted_count": 0.0, "timing.mtime_unique_count": 5.0, "timing.mtime_unique_ratio": 0.56, "misplaced_executable_count": 1.0, "timing.mtime_dominant_count": 4.0, "timing.mtime_spread_seconds": 716394.0, "timing.sentinel_mtime_count": 0.0, "security.world_writable_count": 0.0, "timing.mtime_dominant_fraction": 0.44, "compression.method_counts.stored": 1.0, "compression.method_counts.deflate": 8.0 } } }, "ident": { "name": { "value": "Lombiq Hosting - Media Theme Bridge for Orchard Core", "source": "nupkg.title", "verified": false }, "urls": [ { "url": "https://github.com/Lombiq/Hosting-Media-Theme", "kind": "homepage", "source": "nupkg.project_url" }, { "url": "https://github.com/Lombiq/Hosting-Media-Theme", "kind": "repository", "source": "nupkg.repository_url" } ], "trust": "unsigned", "authors": [ { "name": "Lombiq Technologies", "role": "author", "source": "nupkg.authors" } ], "version": { "value": "8.0.1-alpha.12.osoe-925", "source": "nupkg.version", "verified": false }, "identifier": { "value": "Lombiq.Hosting.MediaTheme.Bridge", "source": "nupkg.id", "verified": false } }, "traits": [ { "id": "metadata/package/versioning::version-word-lower", "conf": 0.4000000059604645, "crit": 2, "desc": "version word (lowercase)", "from": [ { "file": 3 } ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "from": [ { "file": 3 } ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "from": [ { "file": 3 } ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/communications/http/server/managed::http-resource-get", "conf": 1.0, "crit": 3, "desc": "Access to ASP.NET Resource object", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/communications/http/server/managed::http-context-item-setter", "conf": 0.8500000238418579, "crit": 3, "desc": "Modification of HTTP context items", "from": [ { "off": 58268, "file": 3 } ] }, { "id": "micro-behaviors/data/db/linq::linq-queries", "conf": 0.699999988079071, "crit": 3, "desc": "LINQ query operations", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/data/db/linq::system-linq-expressions", "conf": 0.6000000238418579, "crit": 3, "desc": "System.Linq.Expressions namespace", "from": [ { "file": 3 } ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "from": [ { "file": 3 } ] }, { "id": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "conf": 1.0, "crit": 3, "desc": "JSON polymorphism runtime marker", "from": [ { "file": 3 } ] }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "from": [ { "file": 3 } ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "micro-behaviors/communications/http/server/managed::http-request-get", "conf": 1.0, "crit": 3, "desc": "Access to ASP.NET Request object", "from": [ { "file": 3 } ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/communications/http/server/managed::http-context", "conf": 1.0, "crit": 3, "desc": "Access to ASP.NET HttpContext", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/communications/http/server/managed::http-item-setter", "conf": 1.0, "crit": 1, "desc": "Modification of HTTP context items", "from": [ { "file": 3 } ] } ] }, { "depth": 1, "facts": { "metrics": { "file": { "size": 522.0, "entropy": 5.21, "size_bytes": 522.0 }, "binary": { "overall_entropy": 5.21, "peak_region_bytes": 522.0, "peak_region_entropy": 5.21 } } }, "id": 1, "path": "Lombiq.Hosting.MediaTheme.Bridge.8.0.1-alpha.12.osoe-925.nupkg!!_rels/.rels", "sha": "77916514f65deb6c2c9e234c1715fa4044dd8307738ecbda6eaf069f72896458", "size": 522, "type": "xml" }, { "ctx": [ { "b": "[4ls%kx}3YaA?spB7]MgjT8QkfD}SJzEWP}x(mMDb6w0teJs}sj]", "n": [ { "c": 2, "d": "NuGet nuspec manifest file", "i": "metadata/build/manifest::nuspec-file", "o": 0, "z": 39, "cf": 0.9800000190734863 } ], "ln": 1, "addr": 0 }, { "b": "jAa.syHH\u003c!aB4:tzGv@+xMOuniXJdcv}YB\u003cvrj5rx\u003e8g4B8LVje[n*pfk$ufyHH\u003c\u0026zF7QTfFLvpfF$I3B-RIkv\u003eJ1EwfKh", "ln": 2, "addr": 42 }, { "b": "arS^-wPRu\u003evrt{w", "ln": 3, "addr": 118 }, { "b": "arR^Hjy-qGD2^RixMMB9z/x#xx\u003eIa3aI$92gb7EsefES8zdmj0axh]ZxL}:8z!A=}B0ad#wg/$$v@DsiA+Pf1BuP", "ln": 13, "addr": 756 }, { "b": "arR^HjAL1AB3rxuv}Yp\u003ewj7oQwGTV+zdmj0avg6/pgXJmz/Pzio\u003ev\u003cHviwo.wozZ1jtg!+xlcl", "ln": 14, "addr": 827 }, { "b": "arR^HjAt1Lz/YSmz/QaCBA}?pjTaJMBrR\u0026IA+)(.xMOunB2\u003e%cxk8E3BZ=$kz/4d3z/5@$Aw6\u003e3B98blxdV??wnbE7ra]\u0026WwG\u0026mbz/6u9BuH*6w))x7iBT*8gDd6Eg?pcbwIt(1g=WE7hzO(1iaDISvpRc8h.W9katk[", "n": [ { "c": 2, "d": "NuGet package declares repository", "i": "metadata/package/files/nuget::nuspec-repository", "o": 891, "z": 82, "cf": 0.8999999761581421 } ], "ln": 15, "addr": 887 }, { "b": "arR^Hjy\u00262xwO#3\u0026zEWx(B3o", "n": [ { "c": 2, "d": "NuGet package declares dependencies", "i": "metadata/package/files/nuget::nuspec-dependencies", "o": 1023, "z": 522, "cf": 0.8999999761581421 } ], "ln": 16, "addr": 1019 }, { "b": "arR^HarS^VA=l8taAR4jxjVfOA:-/@Cw?IqjTa=PBtkE4fD@W", "ln": 17, "addr": 1038 }, { "b": "arR^HarR^Hjy\u00262xwO#3\u0026zEW@mx\u003efvJoMa=Sx(L:@wO=r$B.\u003cG\u003eBy/uhx(v)ga%q5uA=U@kzAPf#f!Lgkf!D*IAa\u0026Vjf!+j#B8LRwiwJDoaz2!cy\u0026%o1jT9jnx(4rhl2HaED3T4xB0q.Wj]", "ln": 18, "addr": 1078 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 1834.0, "entropy": 5.15, "size_bytes": 1834.0 }, "binary": { "overall_entropy": 5.15, "peak_region_bytes": 1834.0, "peak_region_entropy": 5.14 } } }, "id": 2, "path": "Lombiq.Hosting.MediaTheme.Bridge.8.0.1-alpha.12.osoe-925.nupkg!!Lombiq.Hosting.MediaTheme.Bridge.nuspec", "risk": 1, "sha": "0e685a025074f7854818671363de53b1b80edefc5d5a9dc7d08ebb8534b7b807", "size": 1834, "traits": [ { "id": "metadata/package/files/nuget::nuspec-repository", "conf": 0.8999999761581421, "crit": 2, "desc": "NuGet package declares repository", "spans": [ [ 891, 82 ] ] }, { "id": "metadata/package/files/nuget::nuspec-dependencies", "conf": 0.8999999761581421, "crit": 2, "desc": "NuGet package declares dependencies", "spans": [ [ 1023, 522 ] ] }, { "id": "metadata/build/manifest::nuspec-file", "conf": 0.9800000190734863, "crit": 2, "desc": "NuGet nuspec manifest file", "spans": [ [ 0, 39 ] ] } ], "type": "xml" }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J\u0026m(0ji6Sa?dLD+]{51x(+zoA=kPhvqNb%vqY$3BrC47aAzQxazCZol@c-7zeP", "n": [ { "c": 3, "d": "HTTP fingerprinting evasion campaign", "i": "objectives/command-and-control/infrastructure/user-agent::http-fingerprinting-campaign", "o": 0, "z": 34, "cf": 0.8999999761581421 }, { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 78, "z": 4, "cf": 0.800000011920929 } ], "ln": 0 }, { "b": "00000000000000000000=X?/700000nb@R\u00260SSx7Q\u003cJdxFB0mo0rr9100000bXWnVpY", "n": [ { "c": 1, "d": "PE standard code/data section", "i": "metadata/binary/section/names::pe-code-data-standard-section", "o": 512, "z": 5, "cf": 0.8999999761581421 } ], "ln": 496 }, { "b": "huFn80rrl8c)wV(3mV2Qlq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn", "n": [ { "c": 3, "d": "Benign PE anti-analysis context", "i": "objectives/anti-analysis/debugger-detect/combined-checks::evasion-aware-benign-pe-context", "o": 24228, "z": 4, "cf": 1.0 } ], "ln": 24212 }, { "b": "vruj4zBw5TvqfL0j]!aNq*ACawO\u003c4\u003epxk3sByd#Eq*ACawO\u003c4!z!%l3v@#B6zGvB2wO#71x\u003e5+!oLFM\u0026jxaG%Bzbxftu}kcD2[7sz7Xg]y\u00260V)BzkVhB1P%]zE)\u003c5v\u003eHtJ", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 47331, "z": 4, "cf": 0.800000011920929 }, { "c": 2, "d": "System namespace reference", "i": "metadata/lang/compiler/managed::system-namespace", "o": 47279, "z": 9, "cf": 0.800000011920929 } ], "ln": 47263 }, { "b": "wPhE7D2mbgBw)a2A:@UXxjVf(qE%]/B-H#607QQxnmuNMlVlHD090xto(BMN07}rJzCCaXwDkID", "n": [ { "c": 3, "d": "Access to ASP.NET Resource object", "i": "micro-behaviors/communications/http/server/managed::http-resource-get", "o": 49974, "z": 12, "cf": 1.0 } ], "ln": 49958 }, { "b": "z!\u0026[:nKWJtzdN-@vR/PQq*ACawO\u003c4[x(m]yl34r?v)$oTzdN-@vR/PQl32FjB.$YgvpB4:07/M", "n": [ { "c": 3, "d": "LINQ query operations", "i": "micro-behaviors/data/db/linq::linq-queries", "o": 50216, "z": 11, "cf": 0.699999988079071 } ], "ln": 50200 }, { "b": "wN]H-ra]\u0026WwIcq\u0026x\u003eg\u003c/e[w^m08ESBxKL{(lVm0Re\u003e6V3x(XcfzdNQbe(MB{y?%8C", "n": [ { "c": 3, "d": "References Windows executable or script", "i": "objectives/execution/interpreter/script/shell::windows-executable-ref", "o": 53930, "z": 4, "cf": 0.6000000238418579 } ], "ln": 53914 }, { "b": "wO#71x\u003e5+!oLFM\u0026jxaG%B7GD2nPXJX08[e:By/qwlVl^SwN/*@z/fRGnLA\u0026tBs}SCBydQYwO?ACwO+{/Bwcy\u0026Bv*N=z2^{SBy/p?q*ACawO?ADA+L", "n": [ { "c": 3, "d": "Modification of HTTP context items", "i": "micro-behaviors/communications/http/server/managed::http-context-item-setter", "o": 54702, "z": 8, "cf": 0.8500000238418579 } ], "ln": 54686 }, { "b": "zE^r@v%HT-ygQ)%x(v\u003e?q*ACawO\u003c4$wOb:\u0026v@#B6zu9l}z!%l3v@#B6zu9mbwPz%dv}w2Cy\u00260V)BzkVh00", "n": [ { "c": 2, "d": "Benign high-entropy PE context", "i": "metadata/package/quality/false-positives::benign-high-entropy-pe-context", "o": 55363, "z": 17, "cf": 0.949999988079071 } ], "ln": 55347 }, { "b": "x\u003c#9\u003eA+P9ae\u003c\u003cL]zeTp(q*ACawO\u003c50wQ5qHn][]*0b2\u003e+uRkxTzua-?BydTYz/bLNBAh8kxg3POAa9^3", "n": [ { "c": 3, "d": "JSON polymorphism runtime marker", "i": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "o": 55572, "z": 16, "cf": 1.0 } ], "ln": 55556 }, { "b": "l340uwPQpTA+c\u003c]BAzE4q/(C*BAIK5q*ACawO\u003c4[x(m[\u003cjyJnwvlOBkuSo\u003cgASx3-B97#ge\u003c\u003cL[y?m9#x(v\u003e", "n": [ { "c": 3, "d": "LINQ query operations", "i": "micro-behaviors/data/db/linq::linq-queries", "o": 55976, "z": 11, "cf": 0.699999988079071 }, { "c": 2, "d": "Startup directory keyword", "i": "micro-behaviors/os/autorun/keyword::startup-keyword", "o": 55968, "z": 7, "cf": 0.5 } ], "ln": 55952 }, { "b": "wLE8NwO:Uxv}x.5z/L?Hnow@)lVl\u003c:wQ5q.v}f7\u003eB8M70xMOunlVl\u003c:wQ5q.v}f7\u003eB8M70nKWH", "n": [ { "c": 3, "d": "Access to ASP.NET HttpContext", "i": "micro-behaviors/communications/http/server/managed::http-context", "o": 58268, "z": 11, "cf": 1.0 } ], "ln": 58252 }, { "b": "z/6Dcy?mS=wPz%dv}xYYxjVf(qE%\u0026\u003cwPI@(wPz%dv}xYYB7Gxnx\u003e7Z}07pycB.tu3zF8WZwmY/Zq*ACawO\u003c50wQ5qHn][]*e(3s}wPE\u0026wwPQyMvruTjwKH9GwO#3\u0026zEWx(A@Y-Z", "n": [ { "c": 3, "d": "Access to ASP.NET Request object", "i": "micro-behaviors/communications/http/server/managed::http-request-get", "o": 58841, "z": 11, "cf": 1.0 }, { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 58885, "z": 16, "cf": 0.8500000238418579 } ], "ln": 58825 }, { "b": "z!9A}A@Y\u0026:BydQYwO(F*B7GD2nPXJXA@Yc:B97#ge(Ms\u003eB-IhrC}IE2vqfO108[e:By/qwlVl^SwN/*@z/fRGm}DNHAS", "n": [ { "c": 2, "d": "System namespace reference", "i": "metadata/lang/compiler/managed::system-namespace", "o": 59680, "z": 15, "cf": 0.800000011920929 }, { "c": 1, "d": "Modification of HTTP context items", "i": "micro-behaviors/communications/http/server/managed::http-item-setter", "o": 59670, "z": 8, "cf": 1.0 } ], "ln": 59654 }, { "b": "wO(vaC%#$1wO#N6z/fQ@q*ACawO\u003c4[x(m]ymr\u0026=(wPI{bz/fQ@oMa=Sx(L:@z/Z2mzF7N@wN]H-ra]\u0026WwIcq\u0026x\u003eg\u0026", "n": [ { "c": 3, "d": "LINQ expression tree manipulation", "i": "micro-behaviors/data/db/linq::linq-expressions", "o": 60432, "z": 23, "cf": 0.75 } ], "ln": 60416 }, { "b": "B94y{wPRoNvqY^\u003ewPI}[xjVf(qE%\u0026\u003cwPI}[lsBz5wPq\u003c7B94yMBAzF1wPq\u003c7B94yNoLFM\u0026090\u003e", "n": [ { "c": 3, "d": "Access to ASP.NET Request object", "i": "micro-behaviors/communications/http/server/managed::http-request-get", "o": 63708, "z": 11, "cf": 1.0 } ], "ln": 63692 }, { "b": "BzkVhlVl\u003c:wQ5p%xjVf(now@)lVl\u003c:wQ5p%l3mo.z/PMrvruj4zB!hNwnC*$lVl\u003c:wQ5p%luM#", "n": [ { "c": 3, "d": "Access to ASP.NET HttpContext", "i": "micro-behaviors/communications/http/server/managed::http-context", "o": 64018, "z": 11, "cf": 1.0 } ], "ln": 64002 }, { "b": "zE^s60b2\u003e+uR\u003e=Ow[=F\u0026xjVf(qE%\u0026\u003cwPI@[A+[M)wObU308^xBz*2X-w\u003eluKp\u0026ZbVx)oRLwN]G", "n": [ { "c": 3, "d": "Access to ASP.NET Request object", "i": "micro-behaviors/communications/http/server/managed::http-request-get", "o": 64244, "z": 11, "cf": 1.0 } ], "ln": 64228 }, { "b": "z2!IPyYE(zBo2\u003eLA@Vhyq#*OiwDi?Mo-O-8wb{rzve}zIq#*OiwDlMEwDi?Mv/P{", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 65550, "z": 3, "cf": 0.800000011920929 } ], "ln": 65534 }, { "b": "z2!FOwb{fvyYBCCve$uGz#.D\u0026w=M-HASuaV3ihgGaoiI:aoiI:aoiI:aoiI:aoiI", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 67376, "z": 3, "cf": 0.800000011920929 } ], "ln": 67360 }, { "b": "0a(jH0ce6J03znQ0bRZP0b?\u003cT0cwiP0b.^H03znI0b.^Z03zno0a=dv0bhBw03zm", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 67684, "z": 3, "cf": 0.800000011920929 } ], "ln": 67668 }, { "b": "Ar7aYx-IVz05ENOxAhPzz2!bEaolP=x-JkPxAfdPBo2$OwDi?Mx8(SCB]V7Nzu7^V", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 68447, "z": 4, "cf": 0.800000011920929 } ], "ln": 68431 }, { "b": "0001m0rrb*Yt3D)CX}mtC4CYnx(v(La#7Y7a%pDmv@C)(zF89RB-.jEi3HNJ3oPE-eG!Z", "n": [ { "c": 3, "d": "Benign sparse-logic binary context", "i": "objectives/anti-analysis/vm-detect/instruction::sparse-logic-benign-context", "o": 84785, "z": 7, "cf": 0.800000011920929 } ], "ln": 84769 }, { "b": "03zmM000000000000000000000000000000000315c8Xg7YTL^00000000000000000", "n": [ { "c": 1, "d": "PE resource section", "i": "metadata/binary/section/names::pe-resource-section", "o": 93696, "z": 5, "cf": 0.8999999761581421 } ], "ln": 93680 }, { "b": "0000000000006wfgYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006Xn[brp!0rr912MK\u0026", "n": [ { "c": 3, "d": "Benign context for timing checks", "i": "objectives/anti-analysis/timing/evasion::timing-anti-debug-benign-context", "o": 93790, "z": 15, "cf": 0.949999988079071 } ], "ln": 93774 }, { "b": "zVBUPe=U\u003eK002K\u00266AwdllJz38z2!IPve$fBC(QOtve$cAwDhYg002W)zVBROvGp9xAr49Yq#*F", "n": [ { "c": 2, "d": "PE CompanyName metadata field", "i": "metadata/package/versioning::pe-companyname-field", "o": 94350, "z": 11, "cf": 0.699999988079071 } ], "ln": 94334 }, { "b": "x8(SCwDl=K003:laPIJymGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up002W)zVBROvGp9xAr4P", "n": [ { "c": 2, "d": "PE FileDescription metadata field", "i": "metadata/package/versioning::pe-filedescription-field", "o": 94422, "z": 15, "cf": 0.699999988079071 } ], "ln": 94406 }, { "b": "wb{lxwDhYg001XM2MK(9mGvc5yYF2DrSDXhASydXx-J5Kzu6Up001$Ue=WN9e=WQae=WN9003:lb(^@CnDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE002W)zVBROvGp9xAr4P\u003enc0Md", "n": [ { "c": 3, "d": "Dotted-quad PE version metadata context", "i": "objectives/command-and-control/infrastructure/ip::ipv4-version-metadata-context", "o": 94530, "z": 11, "cf": 0.9399999976158142 }, { "c": 2, "d": "PE InternalName metadata field", "i": "metadata/package/versioning::pe-internalname-field", "o": 94578, "z": 12, "cf": 0.699999988079071 } ], "ln": 94514 }, { "b": "z#+d-ASx!Nx8(PBBn#pvlJz38z#+d-ASx!Nx8(PBBo0A-Sq[4vg5%0dg5%6fec3^)oAn#hz2", "n": [ { "c": 2, "d": "Copyright notice", "i": "metadata/package/license::copyright-word", "o": 94716, "z": 9, "cf": 0.6000000238418579 } ], "ln": 94700 }, { "b": "Bo2?Ke=U\u003eK0043tb(^@Cpxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE002W)zVBROvGp9xAr4P\u003e", "n": [ { "c": 2, "d": "PE OriginalFilename metadata field", "i": "metadata/package/versioning::pe-originalfilename-field", "o": 94810, "z": 16, "cf": 0.699999988079071 } ], "ln": 94794 }, { "b": "wb{ACyYBCn003EdaPIJypYLIozVBqFBPt[KBo25ove$cAwDhYg002W)zVBROvGp9xAr4P\u003enc0M", "n": [ { "c": 2, "d": "PE ProductName metadata field", "i": "metadata/package/versioning::pe-productname-field", "o": 94926, "z": 11, "cf": 0.699999988079071 } ], "ln": 94910 }, { "b": "wb{lxwDhYg005\u003e@k(Z]=pYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001$Ue=WN9e=WQaeDxhVyYB", "n": [ { "c": 2, "d": "PE version resource metadata", "i": "metadata/package/versioning::version-resource-metadata", "o": 95026, "z": 14, "cf": 0.8999999761581421 } ], "ln": 95010 }, { "b": "000000000000000000000dU7I3\u0026*nc[h*QI000000000000000000000000000000000", "n": [ { "c": 2, "d": "PE .reloc section presence", "i": "metadata/binary/section/names::reloc-section-presence", "o": 95744, "z": 6, "cf": 0.8999999761581421 } ], "ln": 95728 } ], "depth": 1, "facts": { "imp": [ [ "mscoree", "CorDllMain" ] ], "sec": [ [ ".text", 512, 93184, 6.26, "r-x" ], [ ".rsrc", 93696, 2048, 2.74, "r--" ], [ ".reloc", 95744, 512, 0.1, "r--" ] ], "metrics": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "resource_count": 1.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 138766.0, "reloc_overhang_bytes": 500.0, "reloc_overhang_ratio": 0.98, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "version.identity_entropy": 4.23, "clr.managed_resource_count": 1.0, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0, "clr.managed_resource_max_size": 363.0, "version.identity_symbol_ratio": 0.07, "clr.managed_resource_max_entropy": 5.18 }, "file": { "size": 96256.0, "entropy": 6.17, "size_bytes": 96256.0 }, "binary": { "is_pie": 1.0, "code_entropy": 6.26, "string_count": 1158.0, "overall_entropy": 6.17, "entropy_variance": 6.36, "avg_string_length": 26.93, "max_string_length": 251.0, "peak_region_bytes": 4096.0, "code_to_data_ratio": 1.0, "peak_region_entropy": 7.8, "string_length_stddev": 26.85, "largest_section_ratio": 0.97, "sentence_string_count": 56.0, "sentence_string_ratio": 0.05, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 93184.0, "entropy_max": 6.26, "entropy_mean": 3.03, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } } }, "id": 3, "mol": "O(Al)H₂(CmDb)", "path": "Lombiq.Hosting.MediaTheme.Bridge.8.0.1-alpha.12.osoe-925.nupkg!!lib/net10.0/Lombiq.Hosting.MediaTheme.Bridge.dll", "risk": 4, "sha": "8d4c36ba90344fde383bd619068f3cbca18799395ecdb896ee4056cc785cc7eb", "size": 96256, "traits": [ { "id": "micro-behaviors/communications/http/server/managed::http-request-get", "conf": 1.0, "crit": 3, "desc": "Access to ASP.NET Request object", "spans": [ [ 58841, 11 ], [ 63708, 11 ], [ 64244, 11 ] ] }, { "id": "micro-behaviors/data/db/linq::linq-queries", "conf": 0.699999988079071, "crit": 3, "desc": "LINQ query operations", "spans": [ [ 50216, 11 ], [ 55976, 11 ], [ 60432, 11 ] ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "spans": [ [ 53930, 4 ] ] }, { "id": "metadata/package/versioning::version-word-lower", "conf": 0.4000000059604645, "crit": 2, "desc": "version word (lowercase)", "spans": [ [ 84785, 7 ] ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 93790, 15 ] ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "spans": [ [ 24228, 4 ] ] }, { "id": "micro-behaviors/data/db/linq::system-linq-expressions", "conf": 0.6000000238418579, "crit": 3, "desc": "System.Linq.Expressions namespace", "spans": [ [ 60432, 23 ] ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "spans": [ [ 95026, 14 ] ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "spans": [ [ 94530, 11 ] ] }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "spans": [ [ 0, 26 ] ] }, { "id": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "conf": 1.0, "crit": 3, "desc": "JSON polymorphism runtime marker", "spans": [ [ 55572, 16 ] ] }, { "id": "micro-behaviors/communications/http/server/managed::http-context", "conf": 1.0, "crit": 3, "desc": "Access to ASP.NET HttpContext", "spans": [ [ 58268, 11 ], [ 64018, 11 ] ] }, { "id": "micro-behaviors/communications/http/server/managed::http-item-setter", "conf": 1.0, "crit": 1, "desc": "Modification of HTTP context items", "spans": [ [ 54702, 8 ], [ 54736, 8 ], [ 59670, 8 ] ] }, { "id": "micro-behaviors/communications/http/server/managed::http-resource-get", "conf": 1.0, "crit": 3, "desc": "Access to ASP.NET Resource object", "spans": [ [ 49974, 12 ] ] }, { "id": "micro-behaviors/communications/http/server/managed::http-context-item-setter", "conf": 0.8500000238418579, "crit": 3, "desc": "Modification of HTTP context items", "spans": [ [ 54702, 8 ], [ 54736, 8 ], [ 58268, 11 ], [ 59670, 8 ], [ 64018, 11 ] ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "spans": [ [ 24228, 4 ] ] } ], "type": "pe" }, { "depth": 1, "facts": { "metrics": { "file": { "size": 4844.0, "entropy": 4.46, "size_bytes": 4844.0 }, "binary": { "overall_entropy": 4.46, "peak_region_bytes": 4844.0, "peak_region_entropy": 4.49 } } }, "id": 4, "path": "Lombiq.Hosting.MediaTheme.Bridge.8.0.1-alpha.12.osoe-925.nupkg!!lib/net10.0/Lombiq.Hosting.MediaTheme.Bridge.xml", "sha": "7658e90238de5e5c41383213e2eaf4c4ddff04f13667d610a669f00682571b07", "size": 4844, "traits": [ { "id": "metadata/file/extension/identity::doc-or-config-extension", "conf": 1.0, "crit": 1, "desc": "Document or config file extension", "spans": [ [ 0, 36 ] ] } ], "type": "xml" }, { "depth": 1, "facts": { "metrics": { "png": { "a_entropy": 1.14, "idat_bytes": 4550, "chunk_count": 6, "trailing_bytes": 0, "idat_zlib_bytes": 4550, "idat_chunk_count": 1, "text_chunk_bytes": 0, "chunks_after_iend": 0, "compression_ratio": 0.07, "idat_unused_bytes": 0, "unknown_chunk_count": 0 }, "file": { "size": 4657, "entropy": 7.9 }, "image": { "width": 128, "height": 128, "channels": 4, "b_entropy": 2.76, "g_entropy": 2.76, "r_entropy": 2.74, "edge_density": 0.04, "pixel_entropy": 3.04, "histogram_flatness": 0.38 }, "media": { "gap_bytes": 0, "stowaway_bytes": 0, "trailing_bytes": 0, "stowaway_entropy": 0 }, "binary": { "peak_region_bytes": 4657, "peak_region_entropy": 7.79 } } }, "id": 5, "path": "Lombiq.Hosting.MediaTheme.Bridge.8.0.1-alpha.12.osoe-925.nupkg!!NuGetIcon.png", "pid": 0, "risk": 1, "sha": "3927d0575056df6919d270544a327c55396ee317af86d2c86bace121bcb65d79", "size": 4657, "traits": [ { "id": "metadata/file/format/media::media-container-recognized", "conf": 0.98, "crit": 2, "desc": "File carries a real container signature" }, { "id": "metadata/image/pixel::png-file-entropy-high", "conf": 0.9, "crit": 1, "desc": "PNG file entropy is at least 7.8" }, { "id": "metadata/package/files/included::png-extension-basename", "conf": 0.9, "crit": 2, "desc": "File has a .png extension" } ], "type": "png" }, { "id": 6, "sha": "b701826a5e9a0ab74470747dc901b2d24fd0db3ca69ed717c931a5d62343aa46", "path": "Lombiq.Hosting.MediaTheme.Bridge.8.0.1-alpha.12.osoe-925.nupkg!!build/Lombiq.Hosting.MediaTheme.Bridge.props", "size": 351, "type": "xml", "depth": 1 }, { "id": 7, "sha": "1643be922c0908230fada7e8b1019aa40f6db9534d8eb1291e21648b776abdb5", "path": "Lombiq.Hosting.MediaTheme.Bridge.8.0.1-alpha.12.osoe-925.nupkg!![Content_Types].xml", "size": 647, "type": "xml", "depth": 1 }, { "id": 8, "sha": "8f968ddacecd0b86358e5de89090701edfe9c527cac57866beef3e58e7198d0b", "path": "Lombiq.Hosting.MediaTheme.Bridge.8.0.1-alpha.12.osoe-925.nupkg!!package/services/metadata/core-properties/e18d7ac024424e56813e4b730e69b59d.psmdcp", "size": 836, "type": "xml", "depth": 1 }, { "id": 9, "sha": "885f78eef20179e340a1e08e741edbb3d8bfda99ae214bb6a014db6348e43cac", "path": "Lombiq.Hosting.MediaTheme.Bridge@8.0.1-alpha.12.osoe-925.registry.json", "size": 987, "type": "registry", "depth": 1 } ], "omitted_files": 4, "v": "8" } }