{ "ml": { "v": "7", "eng": "2.3.0-beta.1", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.999049, "rte": "az", "prob": 0.999049 }, { "cls": 0, "raw": 0.58429205, "rte": "az/nupkg", "prob": 0.58429205 } ], "prob": 0.999049, "skip": [ { "rte": "az/zip", "why": "unavailable" }, { "rte": "az/zip", "why": "unavailable" } ], "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.9990490078926086, "type": "nupkg" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.00012001395225524902, "type": "xml" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.010131001472473145, "type": "xml" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.9987329244613647, "type": "pe" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "xml" }, { "id": 5, "lvl": -1, "conf": 0, "prob": 0.00012001395225524902, "type": "xml" }, { "id": 6, "lvl": -1, "conf": 0, "prob": 0.00020629167556762695, "type": "registry" } ], "version": "v18.18", "analyzed_at": "2026-07-11T04:12:03Z" }, "path": "linker.messenger.rpolicy.2.0.16.nupkg", "raw": { "files": [ { "id": 0, "mol": "O(As)H(Db)", "sha": "60d60c242ce15296d40209cf63790ffee8531042524a3ef75d4dd33269eec969", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/linker.messenger.rpolicy/linker.messenger.rpolicy.2.0.16.nupkg", "risk": 34, "size": 26089, "type": "nupkg", "facts": { "metrics": { "file": { "size": 26089.0, "entropy": 7.87, "size_bytes": 26089.0 }, "binary": { "overall_entropy": 7.87, "peak_region_bytes": 22528.0, "peak_region_entropy": 7.83 }, "archive": { "file_count": 6.0, "member_count": 6.0, "script_count": 0.0, "zip_bomb_ratio": 2.18, "directory_count": 0.0, "executable_count": 1.0, "extra_field_size": 0.0, "noise_file_count": 0.0, "total_compressed": 25221.0, "compression.ratio": 0.83, "hidden_file_count": 2.0, "total_uncompressed": 30265.0, "crc_collision_count": 0.0, "entry_comment_count": 0.0, "max_filename_length": 81.0, "rtlo_filename_count": 0.0, "format.regular_count": 6.0, "nested_archive_count": 0.0, "path_traversal_count": 0.0, "symlink_escape_count": 0.0, "security.setgid_count": 0.0, "security.setuid_count": 0.0, "security.sticky_count": 0.0, "double_extension_count": 0.0, "duplicate_member_count": 0.0, "security.symlink_count": 0.0, "unicode_filename_count": 0.0, "homoglyph_filename_count": 0.0, "security.encrypted_count": 0.0, "timing.mtime_unique_count": 3.0, "timing.mtime_unique_ratio": 0.5, "misplaced_executable_count": 1.0, "timing.mtime_outlier_count": 2.0, "timing.mtime_dominant_count": 4.0, "timing.mtime_spread_seconds": 25102.0, "timing.sentinel_mtime_count": 0.0, "security.world_writable_count": 0.0, "timing.mtime_dominant_fraction": 0.67, "compression.method_counts.stored": 1.0, "compression.method_counts.deflate": 5.0 } } }, "ident": { "name": { "value": "linker messenger route policy", "source": "nupkg.title", "verified": false }, "urls": [ { "url": "https://github.com/snltty/linker", "kind": "homepage", "source": "nupkg.project_url" }, { "url": "https://github.com/snltty/linker", "kind": "repository", "source": "nupkg.repository_url" } ], "trust": "unsigned", "authors": [ { "name": "snltty", "role": "author", "source": "nupkg.authors" } ], "version": { "value": "2.0.16", "source": "nupkg.version", "verified": false }, "identifier": { "value": "linker.messenger.rpolicy", "source": "nupkg.id", "verified": false } }, "traits": [ { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "from": [ { "file": 3 } ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/data/db/linq::linq-queries", "conf": 0.699999988079071, "crit": 3, "desc": "LINQ query operations", "from": [ { "file": 3 } ] }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "from": [ { "file": 3 } ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "from": [ { "file": 3 } ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "from": [ { "file": 3 } ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "from": [ { "file": 3 } ] }, { "id": "objectives/anti-static/obfuscation/binary-metrics/shape::high-code-entropy", "atk": "T1045", "mbc": "B0032", "conf": 0.800000011920929, "crit": 4, "desc": "High code section entropy", "from": [ { "file": 3 } ] } ] }, { "depth": 1, "facts": { "metrics": { "file": { "size": 514.0, "entropy": 5.17, "size_bytes": 514.0 }, "binary": { "overall_entropy": 5.17, "peak_region_bytes": 514.0, "peak_region_entropy": 5.17 } } }, "id": 1, "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/linker.messenger.rpolicy/linker.messenger.rpolicy.2.0.16.nupkg!!_rels/.rels", "pid": 0, "sha": "8e4f6e0c1e69c3984efda960342a82c38c062f81bbd346a44576af21adf339f8", "size": 514, "type": "xml" }, { "ctx": [ { "b": "[4ls%kx}3YaA?spB7]MgjT8QkfD}SJzEWP}x(mMDb6w0teJs}sj]", "n": [ { "c": 2, "d": "NuGet nuspec manifest file", "i": "metadata/build/manifest::nuspec-file", "o": 0, "z": 31, "cf": 0.9800000190734863 } ], "ln": 1, "addr": 0 }, { "b": "jAa.syHH\u003c!aB4:tzGv@+xMOuniXJdcv}YB\u003cvrj5rx\u003e8g4B8LVje[n*pfk$ufyHH\u003c\u0026zF7QTfFLvpfF$I3B-RIkv\u003eJ1EwfKh", "ln": 2, "addr": 42 }, { "b": "arS^-wPRu\u003evrt{w", "ln": 3, "addr": 118 }, { "b": "arR^HjAt1HwNPT\u003eph+k=B3szOzFJ*7az\u003eXhB7Gl4wPw]8CYE.BBy^M/A+f5#vrl0Pz//Mij]", "ln": 10, "addr": 401 }, { "b": "arR^Hjy-qGD2^RixMMBVzFTApC%0-\u0026z/x#xx\u003eIa3j]", "ln": 11, "addr": 459 }, { "b": "arR^HjAt1Lz/YSmz/QaCBA}?pjTaJMBrR\u0026IA+)(.xMOunB2\u003e%cxk8E3BZ=$kz/4dGzFTApC}S#FzFJ*7a%pxlzeB0ejT8NqgD4cGw?(nRh.X/5f\u003er40wI=d@iwLhQwhv*Rf/JV2wmmhDg?dZLffP", "n": [ { "c": 2, "d": "NuGet package declares repository", "i": "metadata/package/files/nuget::nuspec-repository", "o": 497, "z": 69, "cf": 0.8999999761581421 } ], "ln": 12, "addr": 493 }, { "b": "arR^Hjy\u00262xwO#3\u0026zEWx(B3o", "n": [ { "c": 2, "d": "NuGet package declares dependencies", "i": "metadata/package/files/nuget::nuspec-dependencies", "o": 616, "z": 73, "cf": 0.8999999761581421 } ], "ln": 13, "addr": 612 }, { "b": "arR^HarS^VA=l8taAR4jxjVfOA:-/@Cw?IqjTa=PBt$)bb0C", "ln": 14, "addr": 631 }, { "b": "arR^HarR^Hjy\u00262xwO#3\u0026zEW@mx\u003efvJy?W^5wPxzuwPI{7zF9K3a%q5uA=U@kzAPg0e?![jhx\u003cnPCW\u003eMjwmW[FluN0UwgQ2:vqHjnwPz\u0026oatk[", "ln": 15, "addr": 670 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 817.0, "entropy": 4.94, "size_bytes": 817.0 }, "binary": { "overall_entropy": 4.94, "peak_region_bytes": 817.0, "peak_region_entropy": 4.94 } } }, "id": 2, "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/linker.messenger.rpolicy/linker.messenger.rpolicy.2.0.16.nupkg!!linker.messenger.rpolicy.nuspec", "pid": 0, "risk": 1, "sha": "ab0879433afc3408e5997aab78438c29090fb240092b68b647531fd5a3c4486e", "size": 817, "traits": [ { "id": "metadata/build/manifest::nuspec-file", "conf": 0.9800000190734863, "crit": 2, "desc": "NuGet nuspec manifest file", "spans": [ [ 0, 31 ] ] }, { "id": "metadata/package/files/nuget::nuspec-repository", "conf": 0.8999999761581421, "crit": 2, "desc": "NuGet package declares repository", "spans": [ [ 497, 69 ] ] }, { "id": "metadata/package/files/nuget::nuspec-dependencies", "conf": 0.8999999761581421, "crit": 2, "desc": "NuGet package declares dependencies", "spans": [ [ 616, 73 ] ] } ], "type": "xml" }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J+", "n": [ { "c": 4, "d": "High code section entropy", "i": "objectives/anti-static/obfuscation/binary-metrics/shape::high-code-entropy", "o": 0, "z": 26, "cf": 0.800000011920929 } ], "ln": 0 }, { "b": "00000000000000000000R+Ni(00000nb@R\u00260SSx7H-(-#]Bp\u003c30rr91000000000000", "n": [ { "c": 1, "d": "PE standard code/data section", "i": "metadata/binary/section/names::pe-code-data-standard-section", "o": 512, "z": 5, "cf": 0.8999999761581421 } ], "ln": 496 }, { "b": "g6qCy000vAdf6tPdGxCGlq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn", "n": [ { "c": 3, "d": "Recognized PE anti-analysis marker", "i": "objectives/anti-analysis/debugger-detect/combined-checks::evasion-aware-recognized-pe-marker", "o": 904, "z": 4, "cf": 1.0 } ], "ln": 888 }, { "b": "wPI{7zF9K3e]\u003e]Hy?Wy8e[w^m08[e:By/p?n]FAY08)DsB-IhrC%L}Zx(v\u003e?o\u003e!9T", "n": [ { "c": 3, "d": "References Windows executable or script", "i": "objectives/execution/interpreter/script/shell::windows-executable-ref", "o": 2974, "z": 4, "cf": 0.6000000238418579 } ], "ln": 2958 }, { "b": "zE^r@v%HT-ygQ)%x(v\u003e?q*ACawO\u003c4$wOb:\u0026v@#B6zu9mbwPz%dv}w2Cy\u00260V)BzkVh0cqZ(C4\u003eC$lVl^SwD", "n": [ { "c": 2, "d": "Benign high-entropy PE context", "i": "metadata/package/quality/false-positives::benign-high-entropy-pe-context", "o": 3047, "z": 17, "cf": 0.949999988079071 } ], "ln": 3031 }, { "b": "wPR\u003cd08m3wvR6NKzF0!!q*ACawO\u003c4[x(m[\u003cnMfhvC4\u003eC$p\u0026ZF$x\u003eg^}0cqZ(C4\u003eC$p\u0026ZF$x\u003eg=", "n": [ { "c": 3, "d": "LINQ query operations", "i": "micro-behaviors/data/db/linq::linq-queries", "o": 3126, "z": 11, "cf": 0.699999988079071 } ], "ln": 3110 }, { "b": "wmY/ZoMaMRwPy:}AaK7\u003cq*ACawO\u003c4{wPPL3A+Px8Bzk]fA@YcIA=#ebwKyxLy?m9#x(v(/wPv", "n": [ { "c": 2, "d": "System namespace reference", "i": "metadata/lang/compiler/managed::system-namespace", "o": 3330, "z": 10, "cf": 0.800000011920929 } ], "ln": 3314 }, { "b": "A=#ebwKQ\u0026=wO#N6z/fQ@q*ACawO\u003c4#wN/\u003e6x([RMp?sV:x(!ufz/fQ@o\u003e!9Tz/Y\u0026eBs{1bBy/uhx(v\u003e", "n": [ { "c": 2, "d": "System namespace reference", "i": "metadata/lang/compiler/managed::system-namespace", "o": 3420, "z": 15, "cf": 0.800000011920929 } ], "ln": 3404 }, { "b": "q*ACawO\u003c4$B-8qnzdLmvr+lq)x(v(Li4=)qfFk4gavyo/BAIRnj-j?NBAg/aefE=ivR/:*oj-xFz!\u0026[", "n": [ { "c": 2, "d": "IPv4-like .NET assembly version", "i": "metadata/lang/compiler/managed::dotnet-ipv4-like-version", "o": 4247, "z": 15, "cf": 0.8500000238418579 } ], "ln": 4231 }, { "b": "00000000000000000000000000000000000000315c8Xg7YTL^00000000000000000", "n": [ { "c": 1, "d": "PE resource section", "i": "metadata/binary/section/names::pe-resource-section", "o": 12800, "z": 5, "cf": 0.8999999761581421 } ], "ln": 12784 }, { "b": "0000000000008M(gYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006Xn[brp!0rr910SSi", "n": [ { "c": 3, "d": "Recognized marker for timing checks", "i": "objectives/anti-analysis/timing/evasion::timing-anti-debug-recognized-marker", "o": 12894, "z": 15, "cf": 0.949999988079071 } ], "ln": 12878 }, { "b": "yYFeHv/Q=O001RK2lj=8lJz38z2!IPve$fBC(QOtve$cAwDhYg0046uzuaFMBo3y.C(N*A003g582%WqmGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up003*nx-J2Jyxd]CASvY", "n": [ { "c": 2, "d": "PE CompanyName metadata field", "i": "metadata/package/versioning::pe-companyname-field", "o": 13198, "z": 11, "cf": 0.699999988079071 }, { "c": 2, "d": "PE FileDescription metadata field", "i": "metadata/package/versioning::pe-filedescription-field", "o": 13246, "z": 15, "cf": 0.699999988079071 } ], "ln": 13182 }, { "b": "x-ISyC(N*A001RK2lj=8mGvc5yYF2DrSDXhASydXx-J5Kzu6Up001+Oe=WN9e=WQahuiZS003g59rl9unDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE003*nx-J2Jyxd]CASvY(z2!bE", "n": [ { "c": 3, "d": "Dotted-quad PE version metadata marker", "i": "objectives/command-and-control/infrastructure/ip::ipv4-version-metadata-marker", "o": 13338, "z": 11, "cf": 0.9399999976158142 }, { "c": 2, "d": "PE InternalName metadata field", "i": "metadata/package/versioning::pe-internalname-field", "o": 13386, "z": 12, "cf": 0.699999988079071 } ], "ln": 13322 }, { "b": "Bo3y.C(N*A003Ed9rl9upxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE003*nx-J2Jyxd]CASvY(", "n": [ { "c": 2, "d": "PE OriginalFilename metadata field", "i": "metadata/package/versioning::pe-originalfilename-field", "o": 13530, "z": 16, "cf": 0.699999988079071 } ], "ln": 13514 }, { "b": "wb{ACyYBCn002)%82%WqpYLIozVBqFBPt[KBo25ove$cAwDhYg003*nx-J2Jyxd]CASvY(z2!b", "n": [ { "c": 2, "d": "PE ProductName metadata field", "i": "metadata/package/versioning::pe-productname-field", "o": 13630, "z": 11, "cf": 0.699999988079071 } ], "ln": 13614 }, { "b": "x-ISyC(N*A004VLfAqaNpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001+Oe=WN9e=WQahuklcfAr%ggxorkhukPmw=KN^hums?hVLJiwDjW\u0026f-U.:g5%olwDjK!g5%0dirg/mw=Mouwb[y=w=K:\u0026f-TcjwD", "n": [ { "c": 2, "d": "PE ProductVersion has SemVer git hash", "i": "metadata/package/versioning::pe-productversion-semver-git-hash", "o": 13744, "z": 47, "cf": 0.8999999761581421 }, { "c": 2, "d": "PE version resource metadata", "i": "metadata/package/versioning::version-resource-metadata", "o": 13714, "z": 14, "cf": 0.8999999761581421 } ], "ln": 13698 }, { "b": "0000000000000000000006*I:3\u0026*nc:uxO7000000000000000000000000000000000", "n": [ { "c": 2, "d": "PE .reloc section presence", "i": "metadata/binary/section/names::reloc-section-presence", "o": 14336, "z": 6, "cf": 0.8999999761581421 } ], "ln": 14320 } ], "depth": 1, "facts": { "imp": [ [ "mscoree", "CorDllMain" ] ], "sec": [ [ ".text", 512, 12288, 7.37, "r-x" ], [ ".rsrc", 12800, 1536, 2.5, "r--" ], [ ".reloc", 14336, 512, 0.08, "r--" ] ], "metrics": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "resource_count": 1.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 74739.0, "reloc_overhang_bytes": 500.0, "reloc_overhang_ratio": 0.98, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "version.identity_entropy": 3.73, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0, "version.identity_symbol_ratio": 0.07 }, "file": { "size": 14848.0, "entropy": 6.74, "size_bytes": 14848.0 }, "binary": { "is_pie": 1.0, "code_entropy": 7.37, "string_count": 125.0, "overall_entropy": 6.74, "entropy_variance": 9.19, "avg_string_length": 18.26, "max_string_length": 138.0, "peak_region_bytes": 7168.0, "code_to_data_ratio": 1.0, "peak_region_entropy": 7.81, "string_length_stddev": 15.13, "largest_section_ratio": 0.83, "sentence_string_count": 5.0, "sentence_string_ratio": 0.04, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 12288.0, "entropy_max": 7.37, "entropy_mean": 3.32, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } } }, "id": 3, "mol": "O(As)H(Db)", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/linker.messenger.rpolicy/linker.messenger.rpolicy.2.0.16.nupkg!!lib/net8.0/linker.messenger.rpolicy.dll", "pid": 0, "risk": 34, "sha": "4eb07f25567356985594f007d1a8bdb242c4ee662214167555c8f17cce2165ab", "size": 14848, "traits": [ { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "spans": [ [ 2974, 4 ] ] }, { "id": "micro-behaviors/data/db/linq::linq-queries", "conf": 0.699999988079071, "crit": 3, "desc": "LINQ query operations", "spans": [ [ 3126, 11 ] ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 12894, 15 ] ] }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "spans": [ [ 0, 26 ] ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "spans": [ [ 904, 4 ] ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "spans": [ [ 13338, 11 ] ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "spans": [ [ 13714, 14 ] ] }, { "id": "objectives/anti-static/obfuscation/binary-metrics/shape::high-code-entropy", "atk": "T1045", "mbc": "B0032", "conf": 0.800000011920929, "crit": 4, "desc": "High code section entropy", "spans": [ [ 0, 26 ] ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "spans": [ [ 904, 4 ] ] } ], "type": "pe" }, { "depth": 1, "facts": { "metrics": { "file": { "size": 459, "entropy": 4.83 }, "binary": { "peak_region_bytes": 459, "peak_region_entropy": 4.83 } } }, "id": 4, "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/linker.messenger.rpolicy/linker.messenger.rpolicy.2.0.16.nupkg!![Content_Types].xml", "pid": 0, "risk": 1, "sha": "3dae54f1e2761fb41379f8d05e7fdb903b62ecd0ec1c65fc68fd02c91c3671cf", "size": 459, "traits": [ { "id": "metadata/file/extension/identity::doc-or-config-extension", "conf": 1.0, "crit": 2, "desc": "Text, document, or config extension" } ], "type": "xml" }, { "id": 5, "sha": "c609027cdb5c78f008b601cc7b21e4721708f9a7dbca014a1a2c97fff4956920", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/linker.messenger.rpolicy/linker.messenger.rpolicy.2.0.16.nupkg!!package/services/metadata/core-properties/f2307481cc9b43edb7163d8f49b969b4.psmdcp", "size": 646, "type": "xml", "depth": 1 }, { "id": 6, "mol": "Md", "sha": "f49a540d623890e14e8936c11aec86a90bbeb94c725f79032de21de5101d6132", "path": "linker.messenger.rpolicy@2.0.16.registry.json", "risk": 1, "size": 883, "type": "registry", "depth": 1 } ], "omitted_files": 2, "rev": "c2d55", "v": "8" } }