Benign dotnet 3,357 installs Download

linker.messenger.rpolicy 2.0.16

“linker messenger route policy”

High code section entropyLINQ query operations
SHA-25660d60c242ce15296d40209cf63790ffee8531042524a3ef75d4dd33269eec969
URLhttps://api.nuget.org/v3-flatcontainer/linker.messenger.rpolicy/2.0.16/linker.messenger.rpolicy.2.0.16.nupkg
MaleculeO(As)H(Db)

Evidence

High code section entropy 0x0–0x40
0x04d5a90000300000004000000ffff0000MZ..............
0x10b8000000000000004000000000000000........@.......
0x2000000000000000000000000000000000................
0x3000000000000000000000000080000000................
0x400e1f ..
.NET Assembly (mscoree.dll) 0x378–0x3a8
0x37832036f2800000a6f2900000a2a0000002.o(...o)...*...
0x38842534a4201000100000000000c000000BSJB............
0x39876342e302e3330333139000000000500v4.0.30319......
0x3a86c000000 l...
.dll extension reference 0xb8e–0xbbe
0xb8e657373656e6765722e72706f6c696379essenger.rpolicy
0xb9e2e646c6c0053797374656d004a6f696e.dll.System.Join
0xbae005365637572697479416374696f6e00.SecurityAction.
0xbbe4d696372 Micr
LINQ query operations 0xc26–0xc56
0xc2665746f6e004d656d626572496e666f00eton.MemberInfo.
0xc3653797374656d2e4c696e710049536572System.Linq.ISer
0xc467669636550726f766964657200736572viceProvider.ser
0xc567669636550726f76696465 viceProvide
PE version resource structure 0x324e–0x327e
0x324e00000000000000000000f20334000000............4...
0x325e560053005f0056004500520053004900V.S._.V.E.R.S.I.
0x326e4f004e005f0049004e0046004f000000O.N._.I.N.F.O...
0x327e0000bd04effe000001000000020000 ...............

No evidence locations were recorded for this file. Raw result

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.