{ "ml": { "v": "7", "eng": "2.3.0-beta.1", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.9999185, "rte": "az", "prob": 0.9999185 }, { "cls": 0, "raw": 0.18321884, "rte": "az/nupkg", "prob": 0.18321884 } ], "prob": 0.9999185, "skip": [ { "rte": "az/zip", "why": "unavailable" }, { "rte": "az/zip", "why": "unavailable" } ], "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.999918520450592, "type": "nupkg" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.00012001395225524902, "type": "xml" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.010236918926239014, "type": "xml" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.00006663799285888672, "type": "png" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.9998993873596191, "type": "pe" }, { "id": 5, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "xml" }, { "id": 6, "lvl": -1, "conf": 0, "prob": 0.9998993873596191, "type": "pe" }, { "id": 7, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "xml" }, { "id": 8, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "xml" }, { "id": 9, "lvl": -1, "conf": 0, "prob": 0.00012001395225524902, "type": "xml" }, { "id": 10, "lvl": -1, "conf": 0, "prob": 0.00020036101341247559, "type": "registry" } ], "version": "v18.18", "analyzed_at": "2026-07-10T19:29:43Z" }, "path": "WolverineFx.FluentValidation.6.17.1.nupkg", "raw": { "files": [ { "id": 0, "mol": "O(As)H(Db)", "sha": "5478aee8a4336f816ea337b2d6563727b5010c4b89fdb6bcd4811c23bdedad9b", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/WolverineFx.FluentValidation/WolverineFx.FluentValidation.6.17.1.nupkg", "risk": 34, "size": 182426, "type": "nupkg", "facts": { "metrics": { "file": { "size": 182426.0, "entropy": 7.99, "size_bytes": 182426.0 }, "binary": { "overall_entropy": 7.99, "peak_region_bytes": 178176.0, "peak_region_entropy": 7.83 }, "archive": { "file_count": 10.0, "member_count": 10.0, "script_count": 0.0, "zip_bomb_ratio": 4.39, "directory_count": 0.0, "executable_count": 2.0, "extra_field_size": 0.0, "noise_file_count": 0.0, "total_compressed": 180976.0, "compression.ratio": 0.87, "hidden_file_count": 2.0, "total_uncompressed": 207529.0, "crc_collision_count": 1.0, "entry_comment_count": 0.0, "max_filename_length": 81.0, "rtlo_filename_count": 0.0, "format.regular_count": 10.0, "nested_archive_count": 0.0, "path_traversal_count": 0.0, "symlink_escape_count": 0.0, "security.setgid_count": 0.0, "security.setuid_count": 0.0, "security.sticky_count": 0.0, "double_extension_count": 0.0, "duplicate_member_count": 0.0, "security.symlink_count": 0.0, "unicode_filename_count": 0.0, "homoglyph_filename_count": 0.0, "security.encrypted_count": 0.0, "timing.mtime_unique_count": 3.0, "timing.mtime_unique_ratio": 0.3, "misplaced_executable_count": 2.0, "timing.mtime_outlier_count": 2.0, "timing.mtime_dominant_count": 8.0, "timing.mtime_spread_seconds": 25084.0, "timing.sentinel_mtime_count": 0.0, "security.world_writable_count": 0.0, "timing.mtime_dominant_fraction": 0.8, "compression.method_counts.stored": 1.0, "compression.method_counts.deflate": 9.0 } } }, "ident": { "name": { "value": "WolverineFx.FluentValidation", "source": "nupkg.title", "verified": false }, "urls": [ { "url": "http://github.com/jasperfx/wolverine", "kind": "homepage", "source": "nupkg.project_url" }, { "url": "http://github.com/jasperfx/wolverine", "kind": "repository", "source": "nupkg.repository_url" } ], "trust": "unsigned", "authors": [ { "name": "Jeremy D. Miller", "role": "author", "source": "nupkg.authors" }, { "name": "Babu Annamalai", "role": "author", "source": "nupkg.authors" }, { "name": "Jaedyn Tonee", "role": "author", "source": "nupkg.authors" } ], "version": { "value": "6.17.1", "source": "nupkg.version", "verified": false }, "identifier": { "value": "WolverineFx.FluentValidation", "source": "nupkg.id", "verified": false } }, "traits": [ { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "from": [ { "file": 4 } ], "spans": [ [ 0, 26 ] ] }, { "id": "metadata/package/versioning::pe-file-version-ipv4-shape", "conf": 0.9200000166893005, "crit": 1, "desc": "PE FileVersion resembles IPv4", "spans": [ [ 24760, 7 ] ] }, { "id": "micro-behaviors/data/db/linq::linq-queries", "conf": 0.699999988079071, "crit": 3, "desc": "LINQ query operations", "from": [ { "file": 4 } ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "from": [ { "file": 4 } ] }, { "id": "objectives/anti-static/obfuscation/binary-metrics/shape::high-code-entropy", "atk": "T1045", "mbc": "B0032", "conf": 0.800000011920929, "crit": 4, "desc": "High code section entropy", "from": [ { "file": 4 } ], "spans": [ [ 0, 26 ] ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "from": [ { "file": 4 } ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "from": [ { "file": 4 }, { "file": 6 } ] }, { "id": "metadata/package/versioning::pe-product-version-ipv4-shape", "conf": 0.9200000166893005, "crit": 1, "desc": "PE ProductVersion resembles IPv4", "spans": [ [ 25052, 7 ] ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "from": [ { "file": 4 } ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "from": [ { "file": 4 } ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" } ] }, { "depth": 1, "facts": { "metrics": { "file": { "size": 518.0, "entropy": 5.18, "size_bytes": 518.0 }, "binary": { "overall_entropy": 5.18, "peak_region_bytes": 518.0, "peak_region_entropy": 5.18 } } }, "id": 1, "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/WolverineFx.FluentValidation/WolverineFx.FluentValidation.6.17.1.nupkg!!_rels/.rels", "pid": 0, "sha": "498b51684aa68441b6cb88f16e3a87d2b369a0f70e28275da2a14afc3ab3db10", "size": 518, "type": "xml" }, { "ctx": [ { "b": "[4ls%kx}3YaA?spB7]MgjT8QkfD}SJzEWP}x(mMDb6w0teJs}sj]", "n": [ { "c": 2, "d": "NuGet nuspec manifest file", "i": "metadata/build/manifest::nuspec-file", "o": 0, "z": 35, "cf": 0.9800000190734863 } ], "ln": 1, "addr": 0 }, { "b": "jAa.syHH\u003c!aB4:tzGv@+xMOuniXJdcv}YB\u003cvrj5rx\u003e8g4B8LVje[n*pfk$ufyHH\u003c\u0026zF7QTfFLvpfF$I3B-RIkv\u003eJ1EwfKh", "ln": 2, "addr": 42 }, { "b": "arS^-wPRu\u003evrt{w", "ln": 3, "addr": 118 }, { "b": "arR^HjAbsVygQ)%rDq[txMOuniXJd0x([3hvLheez7/TjB8UYhw{t$Mz!%PdA+PA5jtgU]z!-\u0026[Bx9u$j]", "ln": 10, "addr": 402 }, { "b": "arR^Hjy\u00262Av@=p5BzkVhk1ovhwO#Pjr://UwmoN]z/cXmx\u003eg:\u003cwP}N6wGUP6AV!C4y\u003c6xgx(mG8l2Z^Vx\u003e7N[x(v)gjtgkRB7ol8Acb/jzAX", "ln": 11, "addr": 468 }, { "b": "arR^HjAt1Lz/YSmz/QaCBA}?pjTaJMBrR\u0026IA+)(.xMOuniXJd0x([3hvLheez7/TjB8UYhw{t$Mz!%PdA+PA5a%punvqYN*jTa]Tw]/RswNPa\u003cfkUcizxZikz/6u9BuH*Uhz^9Awhb!@g?wN2h8va0hdX:avp.CTvprU4w\u0026BoUi5$LWiaK(\u003catk[", "n": [ { "c": 2, "d": "NuGet package declares repository", "i": "metadata/package/files/nuget::nuspec-repository", "o": 559, "z": 98, "cf": 0.8999999761581421 } ], "ln": 12, "addr": 555 }, { "b": "arR^Hjy\u00262xwO#3\u0026zEWx(B3o", "n": [ { "c": 2, "d": "NuGet package declares dependencies", "i": "metadata/package/files/nuget::nuspec-dependencies", "o": 707, "z": 382, "cf": 0.8999999761581421 } ], "ln": 13, "addr": 703 }, { "b": "arR^HarS^VA=l8taAR4jxjVfOA:-/@Cw?IqjTa=PBtkE4fD@W", "ln": 14, "addr": 722 }, { "b": "arR^HarR^Hjy\u00262xwO#3\u0026zEW@mx\u003efvJs8R[#wPzH5wKZ[*aA?spB7]MgjT8^pf/HZta%pDwv@co#wJ.k7B.LV5ej1eZy\u003cytrA=SAEffP", "ln": 15, "addr": 762 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 1217.0, "entropy": 5.05, "size_bytes": 1217.0 }, "binary": { "overall_entropy": 5.05, "peak_region_bytes": 1217.0, "peak_region_entropy": 5.07 } } }, "id": 2, "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/WolverineFx.FluentValidation/WolverineFx.FluentValidation.6.17.1.nupkg!!WolverineFx.FluentValidation.nuspec", "pid": 0, "risk": 1, "sha": "2c150b357cee10df0034e5fdafccfe4f0ad045929a13cbcb469b98eca536888c", "size": 1217, "traits": [ { "id": "metadata/package/files/nuget::nuspec-dependencies", "conf": 0.8999999761581421, "crit": 2, "desc": "NuGet package declares dependencies", "spans": [ [ 707, 382 ] ] }, { "id": "metadata/build/manifest::nuspec-file", "conf": 0.9800000190734863, "crit": 2, "desc": "NuGet nuspec manifest file", "spans": [ [ 0, 35 ] ] }, { "id": "metadata/package/files/nuget::nuspec-repository", "conf": 0.8999999761581421, "crit": 2, "desc": "NuGet package declares repository", "spans": [ [ 559, 98 ] ] } ], "type": "xml" }, { "id": 3, "sha": "08cd479960139d26211ad2755aeced9cebce2fce7d48891bebbae0fa549ee183", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/WolverineFx.FluentValidation/WolverineFx.FluentValidation.6.17.1.nupkg!!logo.png", "size": 129350, "type": "png", "depth": 1 }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J+", "n": [ { "c": 4, "d": "High code section entropy", "i": "objectives/anti-static/obfuscation/binary-metrics/shape::high-code-entropy", "o": 0, "z": 26, "cf": 0.800000011920929 } ], "ln": 0 }, { "b": "00000000000000000000kyiwg00000nb@R\u00260SSx7l)@3nas^A(0rr91000000000000", "n": [ { "c": 1, "d": "PE standard code/data section", "i": "metadata/binary/section/names::pe-code-data-standard-section", "o": 512, "z": 5, "cf": 0.8999999761581421 } ], "ln": 496 }, { "b": "huFnK000udd0bB?3mV2Qlq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn", "n": [ { "c": 3, "d": "Recognized PE anti-analysis marker", "i": "objectives/anti-analysis/debugger-detect/combined-checks::evasion-aware-recognized-pe-marker", "o": 2628, "z": 4, "cf": 1.0 } ], "ln": 2612 }, { "b": "BzkP6e((L7B7]Mgx(mL-lVl\u003cWwN/*Nze:r5zdNQbvruj4zGw=}rc-B]B3\u003c+ZB7]J80b2\u003e+uSpDPyxe0UBydKOz^)c\u003e06$NywO#3Lx(){b", "n": [ { "c": 1, "d": "Regex component marker", "i": "objectives/persistence/login/scheduled-task/com::task-scheduler-builder-methods--rx-1", "o": 7474, "z": 36, "cf": 0.8999999761581421 } ], "ln": 7458 }, { "b": "mR)iUzGF]/y?WA*BzkVhe[w^m08[e:By/p?mq^l+08)xozu94jzEWl]y*?B1z/eJ)", "n": [ { "c": 3, "d": "References Windows executable or script", "i": "objectives/execution/interpreter/script/shell::windows-executable-ref", "o": 7604, "z": 4, "cf": 0.6000000238418579 } ], "ln": 7588 }, { "b": "lVm0Re(Dm)y?m9#x(v\u003e?q*ACawO\u003c4$wOb:\u0026v@#B6zu9mbwPz%dv}w2Cy\u00260V)BzkVh08EG3CW\u003er7BzkVh00", "n": [ { "c": 2, "d": "Benign high-entropy PE context", "i": "metadata/package/quality/false-positives::benign-high-entropy-pe-context", "o": 7929, "z": 17, "cf": 0.949999988079071 } ], "ln": 7913 }, { "b": "wPR\u003cd08m3DxM4AMzF0!!q*ACawO\u003c4[x(m[\u003crbUYSA+PA7l2Hj2y?m3}07*a2A=#ebwL^z=C4\u003eE", "n": [ { "c": 3, "d": "LINQ query operations", "i": "micro-behaviors/data/db/linq::linq-queries", "o": 8064, "z": 11, "cf": 0.699999988079071 } ], "ln": 8048 }, { "b": "4H(3MB98bdx\u003e7N[x(v)uz:OCXzE)s1nO@A.wO(0@Byxo9z/fR}z=z13wPHjPz/YSgxcpY2z/Z5wwGV28v}xv$wPF#5zxK7tvqY$3Byxo5wfs\u0026%AaI9NnmuNbz/fSrA=\u003e(lz/P]2x([2OA+xJiwO#QhazC.mAaJK3B0bNrwGVe8y?WA*Bz(gEB0bBAvR/:*ay/tcB98CBv@#TfB1OOmxK@rfvqGT*", "n": [ { "c": 1, "d": "Regex component marker", "i": "objectives/persistence/login/scheduled-task/com::task-scheduler-builder-methods--rx-1", "o": 12069, "z": 128, "cf": 0.8999999761581421 } ], "ln": 12053 }, { "b": "00000000000000000000000000000000000000315c8Xg7YTL^00000000000000000", "n": [ { "c": 1, "d": "PE resource section", "i": "metadata/binary/section/names::pe-resource-section", "o": 24064, "z": 5, "cf": 0.8999999761581421 } ], "ln": 24048 }, { "b": "0000000000007jBgYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006Xn[brp!0rr910000", "n": [ { "c": 3, "d": "Recognized marker for timing checks", "i": "objectives/anti-analysis/timing/evasion::timing-anti-debug-recognized-marker", "o": 24158, "z": 15, "cf": 0.949999988079071 } ], "ln": 24142 }, { "b": "x-J5Kzua.T004xDe=U[LlJz38z2!IPve$fBC(QOtve$cAwDhYg002Q\u003ewDl-JwDlMEC(O@!l\u0026X?taokaox-I@HyYF2DASwf3li7A]vGpJJaojXczuaLOve$cAve$9zve$0wi@?\u003eMve%\u003cswb{(Pzu7^", "n": [ { "c": 3, "d": "HTTP fingerprinting evasion campaign", "i": "objectives/command-and-control/infrastructure/user-agent::http-fingerprinting-campaign", "o": 24540, "z": 45, "cf": 0.8999999761581421 }, { "c": 2, "d": "PE CompanyName metadata field", "i": "metadata/package/versioning::pe-companyname-field", "o": 24514, "z": 11, "cf": 0.699999988079071 } ], "ln": 24498 }, { "b": "zuakFwDj^(003s98VP)smGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up00372zVBONB]V7NASx!", "n": [ { "c": 2, "d": "PE FileDescription metadata field", "i": "metadata/package/versioning::pe-filedescription-field", "o": 24638, "z": 15, "cf": 0.699999988079071 } ], "ln": 24622 }, { "b": "x-J5Kzu6Up001XM2MK(9mGvc5yYF2DrSDXhASydXx-J5Kzu6Up001XMe=WN9e=WN9e=WN9003s99@(rwnDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE00372zVBONB]V7NASx!NzuakF", "n": [ { "c": 3, "d": "Dotted-quad PE version metadata marker", "i": "objectives/command-and-control/infrastructure/ip::ipv4-version-metadata-marker", "o": 24760, "z": 7, "cf": 0.9399999976158142 }, { "c": 2, "d": "PE InternalName metadata field", "i": "metadata/package/versioning::pe-internalname-field", "o": 24782, "z": 12, "cf": 0.699999988079071 }, { "c": 2, "d": "PE version resource metadata", "i": "metadata/package/versioning::version-resource-metadata", "o": 24734, "z": 11, "cf": 0.8999999761581421 } ], "ln": 24718 }, { "b": "xAibO001bw003Qh9@(rwpxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE00372zVBONB]V7NASx!N", "n": [ { "c": 2, "d": "PE OriginalFilename metadata field", "i": "metadata/package/versioning::pe-originalfilename-field", "o": 24918, "z": 16, "cf": 0.699999988079071 } ], "ln": 24902 }, { "b": "wb{ACyYBCn001?Q2MK(9pYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001XMe=WN9e=WN9e=WN9001$U2MK(9k(+%aA@Y+Kz2!2ByYF.Xao", "n": [ { "c": 2, "d": "PE ProductVersion metadata field", "i": "metadata/package/versioning::pe-productversion-field", "o": 25022, "z": 14, "cf": 0.699999988079071 }, { "c": 1, "d": "PE version numbers look like IPv4", "i": "metadata/package/versioning::version-number-ipv4-metadata", "o": 25052, "z": 7, "cf": 0.949999988079071 } ], "ln": 25006 }, { "b": "000000000000000000000b}]r3\u0026*ncu][t*000000000000000000000000000000000", "n": [ { "c": 2, "d": "PE .reloc section presence", "i": "metadata/binary/section/names::reloc-section-presence", "o": 25600, "z": 6, "cf": 0.8999999761581421 } ], "ln": 25584 } ], "depth": 1, "facts": { "imp": [ [ "mscoree", "CorDllMain" ] ], "sec": [ [ ".text", 512, 23552, 7.12, "r-x" ], [ ".rsrc", 24064, 1536, 2.39, "r--" ], [ ".reloc", 25600, 512, 0.08, "r--" ] ], "metrics": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "resource_count": 1.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 53263.0, "reloc_overhang_bytes": 500.0, "reloc_overhang_ratio": 0.98, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "version.identity_entropy": 4.3, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0, "version.identity_symbol_ratio": 0.07 }, "file": { "size": 26112.0, "entropy": 6.79, "size_bytes": 26112.0 }, "binary": { "is_pie": 1.0, "code_entropy": 7.12, "string_count": 263.0, "overall_entropy": 6.79, "entropy_variance": 8.59, "avg_string_length": 22.31, "max_string_length": 368.0, "peak_region_bytes": 9216.0, "code_to_data_ratio": 1.0, "peak_region_entropy": 7.82, "string_length_stddev": 33.77, "largest_section_ratio": 0.9, "sentence_string_count": 12.0, "sentence_string_ratio": 0.05, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 23552.0, "entropy_max": 7.12, "entropy_mean": 3.2, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } } }, "id": 4, "mol": "O(As)H(Db)", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/WolverineFx.FluentValidation/WolverineFx.FluentValidation.6.17.1.nupkg!!lib/net10.0/Wolverine.FluentValidation.dll", "pid": 0, "risk": 34, "sha": "fac76ec0c48e6572c1ba7024f72988e079ed4e4c1bed35f8f5fb6266b9c8d656", "size": 26112, "traits": [ { "id": "metadata/package/versioning::pe-product-version-ipv4-shape", "conf": 0.9200000166893005, "crit": 1, "desc": "PE ProductVersion resembles IPv4", "spans": [ [ 25052, 7 ] ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 24158, 15 ] ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "spans": [ [ 24734, 11 ] ] }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "spans": [ [ 0, 26 ] ] }, { "id": "metadata/package/versioning::pe-file-version-ipv4-shape", "conf": 0.9200000166893005, "crit": 1, "desc": "PE FileVersion resembles IPv4", "spans": [ [ 24760, 7 ] ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "spans": [ [ 2628, 4 ] ] }, { "id": "micro-behaviors/data/db/linq::linq-queries", "conf": 0.699999988079071, "crit": 3, "desc": "LINQ query operations", "spans": [ [ 8064, 11 ] ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "spans": [ [ 25022, 14 ] ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "spans": [ [ 7604, 4 ] ] }, { "id": "objectives/anti-static/obfuscation/binary-metrics/shape::high-code-entropy", "atk": "T1045", "mbc": "B0032", "conf": 0.800000011920929, "crit": 4, "desc": "High code section entropy", "spans": [ [ 0, 26 ] ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "spans": [ [ 2628, 4 ] ] } ], "type": "pe" }, { "id": 5, "sha": "5e90557af12dc182a7ce837175b84952164e9b904e0d8422c8f87e2a5b6b3de0", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/WolverineFx.FluentValidation/WolverineFx.FluentValidation.6.17.1.nupkg!!lib/net10.0/Wolverine.FluentValidation.xml", "size": 4975, "type": "xml", "depth": 1 }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J+", "n": [ { "c": 4, "d": "High code section entropy", "i": "objectives/anti-static/obfuscation/binary-metrics/shape::high-code-entropy", "o": 0, "z": 26, "cf": 0.800000011920929 } ], "ln": 0 }, { "b": "00000000000000000000XoXbP00000nb@R\u00260SSx7l)@3n04O3H0rr91000000000000", "n": [ { "c": 1, "d": "PE standard code/data section", "i": "metadata/binary/section/names::pe-code-data-standard-section", "o": 512, "z": 5, "cf": 0.8999999761581421 } ], "ln": 496 }, { "b": "huFnK000udd0bB?3mV2Qlq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn", "n": [ { "c": 3, "d": "Recognized PE anti-analysis marker", "i": "objectives/anti-analysis/debugger-detect/combined-checks::evasion-aware-recognized-pe-marker", "o": 2628, "z": 4, "cf": 1.0 } ], "ln": 2612 }, { "b": "BzkP6e((L7B7]Mgx(mL-lVl\u003cWwN/*Nze:r5zdNQbvruj4zGw=}rc-B]B3\u003c+ZB7]J80b2\u003e+uSpDPyxe0UBydKOz^)c\u003e06$NywO#3Lx(){b", "n": [ { "c": 1, "d": "Regex component marker", "i": "objectives/persistence/login/scheduled-task/com::task-scheduler-builder-methods--rx-1", "o": 7470, "z": 36, "cf": 0.8999999761581421 } ], "ln": 7454 }, { "b": "mR)iUzGF]/y?WA*BzkVhe[w^m08[e:By/p?mq^l+08)xozu94jzEWl]y*?B1z/eJ)", "n": [ { "c": 3, "d": "References Windows executable or script", "i": "objectives/execution/interpreter/script/shell::windows-executable-ref", "o": 7600, "z": 4, "cf": 0.6000000238418579 } ], "ln": 7584 }, { "b": "lVm0Re(Dm)y?m9#x(v\u003e?q*ACawO\u003c4$wOb:\u0026v@#B6zu9mbwPz%dv}w2Cy\u00260V)BzkVh08EG3CW\u003er7BzkVh00", "n": [ { "c": 2, "d": "Benign high-entropy PE context", "i": "metadata/package/quality/false-positives::benign-high-entropy-pe-context", "o": 7925, "z": 17, "cf": 0.949999988079071 } ], "ln": 7909 }, { "b": "wPR\u003cd08m3DxM4AMzF0!!q*ACawO\u003c4[x(m[\u003crbUYSA+PA7l2Hj2y?m3}07*a2A=#ebwL^z=C4\u003eE", "n": [ { "c": 3, "d": "LINQ query operations", "i": "micro-behaviors/data/db/linq::linq-queries", "o": 8060, "z": 11, "cf": 0.699999988079071 } ], "ln": 8044 }, { "b": "4H(3MB98bdx\u003e7N[x(v)uz:OCXzE)s1nO@A.wO(0@Byxo9z/fR}z=z13wPHjPz/YSgxcpY2z/Z5wwGV28v}xv$wPF#5zxK7tvqY$3Byxo5wfs\u0026%AaI9NnmuNbz/fSrA=\u003e(lz/P]2x([2OA+xJiwO#QhazC.mAaJK3B0bNrwGVe8y?WA*Bz(gEB0bBAvR/:*ay/tcB98CBv@#TfB1OOmxK@rfvqGT*", "n": [ { "c": 1, "d": "Regex component marker", "i": "objectives/persistence/login/scheduled-task/com::task-scheduler-builder-methods--rx-1", "o": 12037, "z": 128, "cf": 0.8999999761581421 } ], "ln": 12021 }, { "b": "00000000000000000000000000000000000000315c8Xg7YTL^00000000000000000", "n": [ { "c": 1, "d": "PE resource section", "i": "metadata/binary/section/names::pe-resource-section", "o": 24064, "z": 5, "cf": 0.8999999761581421 } ], "ln": 24048 }, { "b": "0000000000007jBgYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006Xn[brp!0rr910000", "n": [ { "c": 3, "d": "Recognized marker for timing checks", "i": "objectives/anti-analysis/timing/evasion::timing-anti-debug-recognized-marker", "o": 24158, "z": 15, "cf": 0.949999988079071 } ], "ln": 24142 }, { "b": "x-J5Kzua.T004xDe=U[LlJz38z2!IPve$fBC(QOtve$cAwDhYg002Q\u003ewDl-JwDlMEC(O@!l\u0026X?taokaox-I@HyYF2DASwf3li7A]vGpJJaojXczuaLOve$cAve$9zve$0wi@?\u003eMve%\u003cswb{(Pzu7^", "n": [ { "c": 3, "d": "HTTP fingerprinting evasion campaign", "i": "objectives/command-and-control/infrastructure/user-agent::http-fingerprinting-campaign", "o": 24540, "z": 45, "cf": 0.8999999761581421 }, { "c": 2, "d": "PE CompanyName metadata field", "i": "metadata/package/versioning::pe-companyname-field", "o": 24514, "z": 11, "cf": 0.699999988079071 } ], "ln": 24498 }, { "b": "zuakFwDj^(003s98VP)smGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up00372zVBONB]V7NASx!", "n": [ { "c": 2, "d": "PE FileDescription metadata field", "i": "metadata/package/versioning::pe-filedescription-field", "o": 24638, "z": 15, "cf": 0.699999988079071 } ], "ln": 24622 }, { "b": "x-J5Kzu6Up001XM2MK(9mGvc5yYF2DrSDXhASydXx-J5Kzu6Up001XMe=WN9e=WN9e=WN9003s99@(rwnDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE00372zVBONB]V7NASx!NzuakF", "n": [ { "c": 3, "d": "Dotted-quad PE version metadata marker", "i": "objectives/command-and-control/infrastructure/ip::ipv4-version-metadata-marker", "o": 24760, "z": 7, "cf": 0.9399999976158142 }, { "c": 2, "d": "PE InternalName metadata field", "i": "metadata/package/versioning::pe-internalname-field", "o": 24782, "z": 12, "cf": 0.699999988079071 }, { "c": 2, "d": "PE version resource metadata", "i": "metadata/package/versioning::version-resource-metadata", "o": 24734, "z": 11, "cf": 0.8999999761581421 } ], "ln": 24718 }, { "b": "xAibO001bw003Qh9@(rwpxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE00372zVBONB]V7NASx!N", "n": [ { "c": 2, "d": "PE OriginalFilename metadata field", "i": "metadata/package/versioning::pe-originalfilename-field", "o": 24918, "z": 16, "cf": 0.699999988079071 } ], "ln": 24902 }, { "b": "wb{ACyYBCn001?Q2MK(9pYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001XMe=WN9e=WN9e=WN9001$U2MK(9k(+%aA@Y+Kz2!2ByYF.Xao", "n": [ { "c": 2, "d": "PE ProductVersion metadata field", "i": "metadata/package/versioning::pe-productversion-field", "o": 25022, "z": 14, "cf": 0.699999988079071 }, { "c": 1, "d": "PE version numbers look like IPv4", "i": "metadata/package/versioning::version-number-ipv4-metadata", "o": 25052, "z": 7, "cf": 0.949999988079071 } ], "ln": 25006 }, { "b": "000000000000000000000b}]r3\u0026*nc/G60j000000000000000000000000000000000", "n": [ { "c": 2, "d": "PE .reloc section presence", "i": "metadata/binary/section/names::reloc-section-presence", "o": 25600, "z": 6, "cf": 0.8999999761581421 } ], "ln": 25584 } ], "depth": 1, "facts": { "imp": [ [ "mscoree", "CorDllMain" ] ], "sec": [ [ ".text", 512, 23552, 7.1, "r-x" ], [ ".rsrc", 24064, 1536, 2.39, "r--" ], [ ".reloc", 25600, 512, 0.08, "r--" ] ], "metrics": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "resource_count": 1.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 55248.0, "reloc_overhang_bytes": 500.0, "reloc_overhang_ratio": 0.98, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "version.identity_entropy": 4.3, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0, "version.identity_symbol_ratio": 0.07 }, "file": { "size": 26112.0, "entropy": 6.76, "size_bytes": 26112.0 }, "binary": { "is_pie": 1.0, "code_entropy": 7.1, "string_count": 265.0, "overall_entropy": 6.76, "entropy_variance": 8.52, "avg_string_length": 22.11, "max_string_length": 368.0, "peak_region_bytes": 9216.0, "code_to_data_ratio": 1.0, "peak_region_entropy": 7.82, "string_length_stddev": 33.68, "largest_section_ratio": 0.9, "sentence_string_count": 12.0, "sentence_string_ratio": 0.05, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 23552.0, "entropy_max": 7.1, "entropy_mean": 3.19, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } } }, "id": 6, "mol": "O(As)H(Db)", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/WolverineFx.FluentValidation/WolverineFx.FluentValidation.6.17.1.nupkg!!lib/net9.0/Wolverine.FluentValidation.dll", "pid": 0, "risk": 34, "sha": "023f7c21f603bc2e3e7ebf9c95544a164acbac3eda40ba9cc353044b76921fe5", "size": 26112, "traits": [ { "id": "metadata/package/versioning::pe-product-version-ipv4-shape", "conf": 0.9200000166893005, "crit": 1, "desc": "PE ProductVersion resembles IPv4", "spans": [ [ 25052, 7 ] ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 24158, 15 ] ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "spans": [ [ 24734, 11 ] ] }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "spans": [ [ 0, 26 ] ] }, { "id": "metadata/package/versioning::pe-file-version-ipv4-shape", "conf": 0.9200000166893005, "crit": 1, "desc": "PE FileVersion resembles IPv4", "spans": [ [ 24760, 7 ] ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "spans": [ [ 2628, 4 ] ] }, { "id": "micro-behaviors/data/db/linq::linq-queries", "conf": 0.699999988079071, "crit": 3, "desc": "LINQ query operations", "spans": [ [ 8060, 11 ] ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "spans": [ [ 25022, 14 ] ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "spans": [ [ 7600, 4 ] ] }, { "id": "objectives/anti-static/obfuscation/binary-metrics/shape::high-code-entropy", "atk": "T1045", "mbc": "B0032", "conf": 0.800000011920929, "crit": 4, "desc": "High code section entropy", "spans": [ [ 0, 26 ] ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "spans": [ [ 2628, 4 ] ] } ], "type": "pe" }, { "id": 7, "sha": "5e90557af12dc182a7ce837175b84952164e9b904e0d8422c8f87e2a5b6b3de0", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/WolverineFx.FluentValidation/WolverineFx.FluentValidation.6.17.1.nupkg!!lib/net9.0/Wolverine.FluentValidation.xml", "size": 4975, "type": "xml", "depth": 1 }, { "id": 8, "sha": "bb4482711390851f61cd40db6dac8bbce14f88cdf251665a10c1bb38753e8af7", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/WolverineFx.FluentValidation/WolverineFx.FluentValidation.6.17.1.nupkg!![Content_Types].xml", "size": 583, "type": "xml", "depth": 1 }, { "id": 9, "sha": "c646802fa3baa9b599c0f47efabbc7c05b8795ad7e503b7b7a61590799b06f1a", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/WolverineFx.FluentValidation/WolverineFx.FluentValidation.6.17.1.nupkg!!package/services/metadata/core-properties/920d224568374c82b6ed19d0b1bfa2e5.psmdcp", "size": 699, "type": "xml", "depth": 1 }, { "id": 10, "mol": "Md", "sha": "3fa519be0fbb824db1fb4b082a6550c58b10118d9e8bcd238abf6a0018e0c8ce", "path": "WolverineFx.FluentValidation@6.17.1.registry.json", "risk": 1, "size": 967, "type": "registry", "depth": 1 } ], "omitted_files": 6, "rev": "b8372", "v": "8" } }