{ "ml": { "v": "7", "eng": "2.3.0-beta.1", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.5183116, "rte": "az", "prob": 0.5183116 }, { "cls": 0, "raw": 0.09920555, "rte": "az/nupkg", "prob": 0.09920555 } ], "prob": 0.5183116, "skip": [ { "rte": "az/zip", "why": "unavailable" }, { "rte": "az/zip", "why": "unavailable" } ], "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.518311619758606, "type": "nupkg" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.00012001395225524902, "type": "xml" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.013034194707870483, "type": "xml" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.009458214044570923, "type": "markdown" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.33747148513793945, "type": "pe" }, { "id": 5, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "xml" }, { "id": 6, "lvl": -1, "conf": 0, "prob": 0.00012001395225524902, "type": "xml" }, { "id": 7, "lvl": -1, "conf": 0, "prob": 0.0003479123115539551, "type": "registry" } ], "version": "v18.18", "analyzed_at": "2026-07-09T20:35:07Z" }, "path": "DotCarbon.Plugins.Notification.0.1.1.nupkg", "raw": { "files": [ { "id": 0, "mol": "O(Al)H(Db)", "sha": "716cf5be8bd375b5e80df84e65617875e0ce9631d7985208e2ececc4e398118a", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/DotCarbon.Plugins.Notification/DotCarbon.Plugins.Notification.0.1.1.nupkg", "risk": 3, "size": 29001, "type": "nupkg", "facts": { "metrics": { "file": { "size": 29001.0, "entropy": 7.89, "size_bytes": 29001.0 }, "binary": { "overall_entropy": 7.89, "peak_region_bytes": 27648.0, "peak_region_entropy": 7.8 }, "archive": { "file_count": 7.0, "member_count": 7.0, "script_count": 0.0, "zip_bomb_ratio": 2.41, "directory_count": 0.0, "executable_count": 1.0, "extra_field_size": 0.0, "noise_file_count": 0.0, "total_compressed": 28013.0, "compression.ratio": 0.59, "hidden_file_count": 2.0, "total_uncompressed": 47152.0, "crc_collision_count": 0.0, "entry_comment_count": 0.0, "max_filename_length": 81.0, "rtlo_filename_count": 0.0, "format.regular_count": 7.0, "nested_archive_count": 0.0, "path_traversal_count": 0.0, "symlink_escape_count": 0.0, "security.setgid_count": 0.0, "security.setuid_count": 0.0, "security.sticky_count": 0.0, "double_extension_count": 0.0, "duplicate_member_count": 0.0, "security.symlink_count": 0.0, "unicode_filename_count": 0.0, "homoglyph_filename_count": 0.0, "security.encrypted_count": 0.0, "timing.mtime_unique_count": 3.0, "timing.mtime_unique_ratio": 0.43, "misplaced_executable_count": 1.0, "timing.mtime_outlier_count": 2.0, "timing.mtime_dominant_count": 5.0, "timing.mtime_spread_seconds": 25164.0, "timing.sentinel_mtime_count": 0.0, "security.world_writable_count": 0.0, "timing.mtime_dominant_fraction": 0.71, "compression.method_counts.stored": 1.0, "compression.method_counts.deflate": 6.0 } } }, "ident": { "name": { "value": "DotCarbon.Plugins.Notification", "source": "nupkg.title", "verified": false }, "urls": [ { "url": "https://github.com/DanKaufmanDev/dotcarbon", "kind": "homepage", "source": "nupkg.project_url" }, { "url": "https://github.com/DanKaufmanDev/dotcarbon", "kind": "repository", "source": "nupkg.repository_url" } ], "trust": "unsigned", "authors": [ { "name": "DanKaufmanDev", "role": "author", "source": "nupkg.authors" } ], "version": { "value": "0.1.1", "source": "nupkg.version", "verified": false }, "identifier": { "value": "DotCarbon.Plugins.Notification", "source": "nupkg.id", "verified": false } }, "traits": [ { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "from": [ { "file": 4 } ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "from": [ { "file": 4 } ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "from": [ { "file": 4 } ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/process/create/hidden::dotnet-create-no-window", "atk": "T1564.003", "conf": 0.8600000143051147, "crit": 2, "desc": ".NET process window suppression", "from": [ { "file": 4 } ] }, { "id": "objectives/evasion/process/hidden/execution::use-shell-execute", "conf": 0.7799999713897705, "crit": 1, "desc": "Process shell execute configuration", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/process/create/spawn::diagnostics-namespace-dotnet", "conf": 0.75, "crit": 1, "desc": ".NET process namespace token", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/data/string/library::dotnet-stringbuilder-append", "conf": 0.8199999928474426, "crit": 3, "desc": ".NET StringBuilder Append use", "from": [ { "file": 4 } ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "from": [ { "file": 4 } ] }, { "id": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "conf": 1.0, "crit": 3, "desc": "JSON polymorphism runtime marker", "from": [ { "file": 4 } ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "from": [ { "file": 4 } ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/process/create/spawn::process-token-dotnet", "conf": 0.699999988079071, "crit": 1, "desc": ".NET Process type token", "from": [ { "file": 4 } ] } ] }, { "depth": 1, "facts": { "metrics": { "file": { "size": 520.0, "entropy": 5.16, "size_bytes": 520.0 }, "binary": { "overall_entropy": 5.16, "peak_region_bytes": 520.0, "peak_region_entropy": 5.16 } } }, "id": 1, "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/DotCarbon.Plugins.Notification/DotCarbon.Plugins.Notification.0.1.1.nupkg!!_rels/.rels", "pid": 0, "sha": "421a052e62ba3e87d86e765d411114b488ba201591ab0f58062e4c2f38dc2e34", "size": 520, "type": "xml" }, { "ctx": [ { "b": "[4ls%kx}3YaA?spB7]MgjT8QkfD}SJzEWP}x(mMDb6w0teJs}sj]", "n": [ { "c": 2, "d": "NuGet nuspec manifest file", "i": "metadata/build/manifest::nuspec-file", "o": 0, "z": 37, "cf": 0.9800000190734863 } ], "ln": 1, "addr": 0 }, { "b": "jAa.syHH\u003c!aB4:tzGv@+xMOuniXJdcv}YB\u003cvrj5rx\u003e8g4B8LVje[n*pfk$ufyHH\u003c\u0026zF7QTfFLvpfF$I3B-RIkv\u003eJ1EwfKh", "ln": 2, "addr": 42 }, { "b": "arS^-wPRu\u003evrt{w", "ln": 3, "addr": 118 }, { "b": "arR^Hjy-qGD2^RixMMB9z/x#xx\u003eIa3aI$92l#Nfmvrb*}zAGNZz/x#xx\u003eIa3j]", "ln": 12, "addr": 522 }, { "b": "arR^HjAL1AB3sbCB8b(oA3fvovS(D%Coy\u003crz//YhzY\u003cdgB-Igsv@=HeB1IuEvrua1A+#}fz//(dBuzi#vp%TB", "ln": 13, "addr": 572 }, { "b": "arR^HjAt1Lz/YSmz/QaCBA}?pjTaJMBrR\u0026IA+)(.xMOunB2\u003e%cxk8E3BZ=$kz/4c}vqX.DB.kG0zBw5VfjY0yv{%y!z/c:wv@Dj3x((GZhdy2Ig=mlGvL](Gv(2#3wmmhJf\u003eB)7w?^\u003cMhEXQ3h8)y2g=O#4a%nK5", "n": [ { "c": 2, "d": "NuGet package declares repository", "i": "metadata/package/files/nuget::nuspec-repository", "o": 645, "z": 79, "cf": 0.8999999761581421 } ], "ln": 14, "addr": 641 }, { "b": "arR^Hjy\u00262xwO#3\u0026zEWx(B3o", "n": [ { "c": 2, "d": "NuGet package declares dependencies", "i": "metadata/package/files/nuget::nuspec-dependencies", "o": 774, "z": 74, "cf": 0.8999999761581421 } ], "ln": 15, "addr": 770 }, { "b": "arR^HarS^VA=l8taAR4jxjVfOA:-/@Cw?IqjTa=PBtkE4fD@W", "ln": 16, "addr": 789 }, { "b": "arR^HarR^Hjy\u00262xwO#3\u0026zEW@mx\u003efvJl#Nfmvrb*}zz1p{A+cBqC4CYnx(v(La$$S7e?[K)wQ4Z3B.25Db0{A^y?b7.zEEvbDs.bra%nK5", "ln": 17, "addr": 829 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 973.0, "entropy": 5.1, "size_bytes": 973.0 }, "binary": { "overall_entropy": 5.1, "peak_region_bytes": 973.0, "peak_region_entropy": 5.1 } } }, "id": 2, "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/DotCarbon.Plugins.Notification/DotCarbon.Plugins.Notification.0.1.1.nupkg!!DotCarbon.Plugins.Notification.nuspec", "pid": 0, "risk": 1, "sha": "b40943a02bdeaa206ab671da376855d054be06538ac65285ac52e09a3fca9d1e", "size": 973, "traits": [ { "id": "metadata/package/files/nuget::nuspec-dependencies", "conf": 0.8999999761581421, "crit": 2, "desc": "NuGet package declares dependencies", "spans": [ [ 774, 74 ] ] }, { "id": "metadata/package/files/nuget::nuspec-repository", "conf": 0.8999999761581421, "crit": 2, "desc": "NuGet package declares repository", "spans": [ [ 645, 79 ] ] }, { "id": "metadata/build/manifest::nuspec-file", "conf": 0.9800000190734863, "crit": 2, "desc": "NuGet nuspec manifest file", "spans": [ [ 0, 37 ] ] } ], "type": "xml" }, { "ctx": [ { "b": "dK)=cx(4r5w)]+5efG4GzH0=Qv@=HeB1IuEvrua1A+#}fwPITez/u?cAbY\u003evCwhejavvv@vqYP#Cv+kaBy!@}zF%ufxk7{#e?esT3rImZBy=Ouz/{7yx(n37A+n-\u0026wGVhhBz8!9zH0vGwNV=]A:-/@Cw?IqefGjRB-FQkAbYScv{%E[z/cXlz!A=]azCZolNab", "ln": 35, "col": 1, "line": 5 }, { "b": "v}xL0wJy@dnMn$zxMOunB2\u003e%cx(dGnB7/o0y?dPtx(tUlvpT1ZfkLujwO#N2eLO/oeN\u0026KswIe4ExdmamxMOunB2\u003e%cxk8E3BZ=$kz/4c}vqX.DB.kG0zBw5VfjY0yv{%y!z/djqy\u0026r=ozddc@fha@8mnu=IdgczAfjX^uj{?SGeIdqpl#Nfmvrb*}zxJ+bBAnNIz/)giB.LV5az$Rfx)a5gwmY*$Bz(avvq{g4x\u003e7N[x(v)gaA.:tzF78lxK@rgwNV^6BywV{aBd)FayP8bwNPa{azU\u003ekCoyHoAV/EqwGT#AayPd#aARpdazb+jy-)XnCv+!qz!paApdnb8w]zYjwP?T9D30.lzF786y\u0026:euax-S9AV/7lBy/G8vpJ\u003c\u003eA+fc0wPz\u0026mx(k5nxK@r8AaK5#BzkS9ao", "ln": 669, "col": 6, "line": 12 }, { "b": "e(1\u0026maz253B9R?GwO\u0026M4z/M$Cz/{7yvq{g4x\u003e7N[x(v(iy\u0026r%2v\u003en:mx(4u6vpJ!UB8@(PzE){lz/PSczF7HyvqYP#zEET3C4z^(qY]^(By/99vruj4zy#nFasX\u003ccB.LVleOP8Bv{%s+vRGT)BzkrcdK(O2FrRfzy?W\u0026$z^^V%efFFqvqG\u003c{B1wCCx(0", "ln": 1696, "col": 37, "line": 27 }, { "b": "zeAZ0wft#jay]5bwO=p7efF\u003eGwGV8kaAIjgA4RF8bo[sdB.Lu3aAITkA=.S}u%)wKvrl8?zG6?ykXa!Pv{%y!z/djrA+eW3wI4tfA3f1yeN-Qq3s^P?zfWZwAbVd]vrb*}zxJF3B{.R+u\u003cWlqx\u003e7{3vixV6ze:r1By=Osx([2hu[A%LwO(y5vru6*iTMh", "ln": 1969, "col": 40, "line": 29 }, { "b": "3l{=rnn\u0026X{x(\u003eFwz/PSm3jo6wl#Nfmvrb*}zxJwbA3e\u003eoaAR*Cazth1C4C.qBzb98aAIj8A+cwizE\u003c@mx(mE1Crc6ru%)vHzfWZwAbWDq\u0026/]$)LZ\u003c(^vrb*}zz2WBz/cWuarR^HarR^Hvq{fpaA}Kqwn=VyayPd#ayYFcy?aU#z/ff3xlwl6BzkVh", "ln": 2829, "col": 1, "line": 58 }, { "b": "A=kGhv@#B6zvc.Uu%)CLB7+[\u003cvrb*}zxJzhx(4q!u%)vH3po1XwmYvYB.(dxBzbxfaAhvtwozx[B0a)ldK]HRvqG:haAIagw?vIhzGGr3zE)u3zEET3C4z!9x(mv1C}7o^Cwhejaz#9uB7Gr0A::63aAzQxBzkP6aARJAx(n0lvqG:jaw3U$A+flk", "ln": 5449, "col": 18, "line": 151 }, { "b": "B9g]cax9x8wnb%8lN%VfvS=y3wft#jz!%Fqz/cX0x(mE1Cxkh=3jogtzyoJGxKM6}aARpdaARKuy?4c!x(kEAz/M$AvqZffvixS9ze:r5AV!?lx(4rAaxrF]ayMylx(mN1wI4Idy?j-gwO+%gv@DmbvqfQ\u003cwftu7x(4r5x(n0lwNPag3jpfGu$9L=", "ln": 5671, "col": 186, "line": 157 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 7383, "entropy": 5.12 }, "text": { "lines": 196, "top_char": 101, "max_ws_run": 18, "digit_ratio": 0.01, "space_count": 920, "char_entropy": 5.12, "unique_chars": 98, "top_char_null": 0, "lines_over_200": 3, "top_char_ratio": 0.06, "ascii_art_lines": 4, "avg_line_length": 36.67, "max_line_length": 311, "non_ascii_ratio": 0.01, "empty_line_ratio": 0.29, "last_line_length": 95, "long_token_count": 4, "whitespace_ratio": 0.15, "line_length_stddev": 51.44, "repeated_char_sequences": 9 }, "binary": { "peak_region_bytes": 7383, "peak_region_entropy": 5.16 } } }, "id": 3, "mol": "H(Cm)", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/DotCarbon.Plugins.Notification/DotCarbon.Plugins.Notification.0.1.1.nupkg!!README.md", "pid": 0, "risk": 1, "sha": "cc350f5499e5c378a1436fca3e1683378fa9b8f1c47eb4e660cb7c2e3b1110fe", "size": 7383, "traits": [ { "id": "metadata/lang/natural::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"", "spans": [ [ 868, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-2", "conf": 0.8, "crit": 1, "desc": "English function-word token \"and\"", "spans": [ [ 91, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-3", "conf": 0.8, "crit": 1, "desc": "English function-word token \"that\"", "spans": [ [ 2877, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-4", "conf": 0.8, "crit": 1, "desc": "English function-word token \"have\"", "spans": [ [ 5719, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "spans": [ [ 899, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-6", "conf": 0.8, "crit": 1, "desc": "English function-word token \"with\"", "spans": [ [ 83, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-7", "conf": 0.8, "crit": 1, "desc": "English function-word token \"this\"", "spans": [ [ 5497, 0 ] ] }, { "id": "micro-behaviors/communications/http/url/forge::public-code-forge-url", "conf": 0.9, "crit": 3, "desc": "References a public code-forge URL", "spans": [ [ 733, 19 ] ] } ], "type": "markdown" }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J+", "n": [ { "c": 3, "d": "HTTP fingerprinting evasion campaign", "i": "objectives/command-and-control/infrastructure/user-agent::http-fingerprinting-campaign", "o": 0, "z": 34, "cf": 0.8999999761581421 } ], "ln": 0 }, { "b": "00000000000000000000m@[Ug00000nb@R\u00260SSx7l]s@AYGue]0rr91000000000000", "n": [ { "c": 1, "d": "PE standard code/data section", "i": "metadata/binary/section/names::pe-code-data-standard-section", "o": 512, "z": 5, "cf": 0.8999999761581421 } ], "ln": 496 }, { "b": "huFmZ000c7d3jGf3mV2Qlq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn", "n": [ { "c": 3, "d": "Recognized PE anti-analysis marker", "i": "objectives/anti-analysis/debugger-detect/combined-checks::evasion-aware-recognized-pe-marker", "o": 5956, "z": 4, "cf": 1.0 } ], "ln": 5940 }, { "b": "nPNsBBy/uhx(v(Svrt]Tq*ACawO\u003c50wQ5qHn][]*e(Mt4x\u003c\u003e*(Dsp]fz/dg4wPRu\u003evrt]Tq*ACawO\u003c50", "n": [ { "c": 3, "d": "JSON polymorphism runtime marker", "i": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "o": 11901, "z": 16, "cf": 1.0 } ], "ln": 11885 }, { "b": "yHpBnvpK7!zF8BMwO+(Sq!o\u0026S06$NywO#2UqE%/-vpJ\u003cGxjVf(pgn0JB8UL$wDkki", "n": [ { "c": 1, "d": ".NET Socket Send/Receive methods (Send)", "i": "micro-behaviors/communications/socket/create::socket-receive-send-str--send", "o": 12247, "z": 4, "cf": 0.800000011920929 } ], "ln": 12231 }, { "b": "vRGT)BA{e]BAh88B-.f{B7GD2rDz.IxK#0@mr\u0026xNB-.f{s8@1%wLNw:y/T$XB.7L]wPRoEwObv[y\u0026\u0026Y^y\u0026%p", "n": [ { "c": 1, "d": ".NET hidden process launch setup", "i": "objectives/evasion/process/hidden/execution::dotnet-hidden-process-launch", "o": 13431, "z": 19, "cf": 0.9200000166893005 } ], "ln": 13415 }, { "b": "x(m#Aph+k*w[+:-BzkVhe[w^m0b#%%xl4A$0b2\u003e+uRbuJz2^vJwPzj3x(mMZD2[7s", "n": [ { "c": 3, "d": "References Windows executable or script", "i": "objectives/execution/interpreter/script/shell::windows-executable-ref", "o": 13822, "z": 4, "cf": 0.6000000238418579 } ], "ln": 13806 }, { "b": "zGvB9z//Y9x\u003e7N[x(v\u003e?q*ACawO\u003c50wQ5qHn][]*e(Mt4x\u003c\u003e*(Dsp]fz/bLND2[7sz7XZ$w]83*BzkVh0cqZ[uRa)Fz/PzRz/f91BzkVh07}rJzB[FUz/PzR", "n": [ { "c": 2, "d": "Benign high-entropy PE context", "i": "metadata/package/quality/false-positives::benign-high-entropy-pe-context", "o": 13967, "z": 17, "cf": 0.949999988079071 }, { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 13936, "z": 16, "cf": 0.8500000238418579 } ], "ln": 13920 }, { "b": "z/bLNwPQv=v}xR3x(v\u003e?q*ACawO\u003c50wQ5qHn][]*07}rJzD7[2wL3=KzVBJ[z/eK1AaIQUw]vVZy\u0026r=\u003ey=TQQD2[7sz7X!0CYUMgB8L}Gq!o#-vqGU7vruj4zz1T{BywY*Byu^[n][]*rc-A", "n": [ { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 14077, "z": 16, "cf": 0.8500000238418579 } ], "ln": 14061 }, { "b": "zVB\u0026\u0026Byd%*vrcDYzF0!!p\u0026ZF:wPI]\u003eByxiinP5cU07g^rvru6SA=k]dA==N#zF0!!n][]*p\u0026ZF[wPz)r", "n": [ { "c": 1, "d": ".NET Process type token", "i": "micro-behaviors/process/create/spawn::process-token-dotnet", "o": 14280, "z": 16, "cf": 0.699999988079071 } ], "ln": 14264 }, { "b": "B8aGYBzbP6luN0UwmY=Yq/)4]zF8pUx(4r\u003eASwi=Byex:B.LV5wPv=qx(mD)ASwZuC41rVA+PGmmf", "n": [ { "c": 3, "d": ".NET StringBuilder Append use", "i": "micro-behaviors/data/string/library::dotnet-stringbuilder-append", "o": 14402, "z": 13, "cf": 0.8199999928474426 } ], "ln": 14386 }, { "b": "wN[.YA+PA7nmuyDy?mR!q*ACawO\u003c4!z!9AEz/49]z/6Dcy?mR!raf\u0026-l3D:KBy/E)m}D^dCvticwPv=JBy)H8B8L{", "n": [ { "c": 3, "d": ".NET dynamic code generation capability", "i": "metadata/lang/compiler/managed::dotnet-dynamic-code", "o": 14569, "z": 23, "cf": 0.8500000238418579 } ], "ln": 14553 }, { "b": "07pycB.tu3zF8WZwmY/Zq*ACawO\u003c50wQ5qHn][]*e(3s}wPE\u0026zB8L})vrb^[wPRH7nP5cUr://!wPE\u0026y", "n": [ { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 15115, "z": 16, "cf": 0.8500000238418579 } ], "ln": 15099 }, { "b": "0b2\u003e+uQF:HC4CYowPz?(q*ACawO\u003c4/x\u003c\u003eT(z/Z2mv@\u003cn0A=kD0B8}sVB-72@z!0v1A@YcIzE=*.zE^WfA@X^Ms7#L.z*8", "n": [ { "c": 1, "d": ".NET process namespace token", "i": "micro-behaviors/process/create/spawn::diagnostics-namespace-dotnet", "o": 15462, "z": 26, "cf": 0.75 } ], "ln": 15446 }, { "b": "A+O@#x)KuhlVl\u003c:wQ5p%B7GD2lVM:DBy!i=s7#L.z*8gWwO#3Lx(n6r06$TCvr?\u0026BB8L}\u003evqPZ@xhAI.x\u003e4", "n": [ { "c": 2, "d": ".NET process window suppression", "i": "micro-behaviors/process/create/hidden::dotnet-create-no-window", "o": 15885, "z": 18, "cf": 0.8600000143051147 } ], "ln": 15869 }, { "b": "aoiI:aoiI:aoiI:aohASz#:!RCk#gOASydXxAhPzyYFnK01*^.lJz38z2!zMve$fBwb(T[hgk", "n": [ { "c": 1, "d": "PowerShell launcher reference", "i": "objectives/execution/interpreter/script/wsh::powershell-launcher", "o": 18469, "z": 10, "cf": 0.8999999761581421 } ], "ln": 18453 }, { "b": "0rrv5wO+{^B7CsK8VY{OlVl{?A+Pf1BrFD1avHc\u0026lT+1Az/bKPe=+@3pgnlUC4z!lz//Y9x-", "n": [ { "c": 2, "d": "Copyright notice", "i": "metadata/package/license::copyright-word", "o": 20404, "z": 9, "cf": 0.6000000238418579 } ], "ln": 20388 }, { "b": "nP5PXzGxJlx)a4*r8[Eaq*ACawO\u003c50wQ5qHn][]*e(Mt4x\u003c\u003e*(Dsp]fz/dg1B8L}?zF%-ppgn0NzF8^:y?Wy8efE(pB97#ge(VzbBs{gbz/d9Gr+lq)x(v(Lf!+jle?![iefEr5y\u0026\u003c/uwJ:{xB-.Ujy+cY9BZ/f3v[QxUrbVL-", "n": [ { "c": 2, "d": "IPv4-like .NET assembly version", "i": "metadata/lang/compiler/managed::dotnet-ipv4-like-version", "o": 21280, "z": 16, "cf": 0.8500000238418579 }, { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 21208, "z": 16, "cf": 0.8500000238418579 } ], "ln": 21192 }, { "b": "v{%E[z/d\u003cYxla4MgYWO1q*ACawO\u003c50wQ5qHn][]*e(MXhA:@VJwO#71vruj4zvFrOe?![jg+HKxf!\u003eD:", "n": [ { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 21432, "z": 16, "cf": 0.8500000238418579 } ], "ln": 21416 }, { "b": "00000000000000000000000000000000000000315c8Xg7YTL^00000000000000000", "n": [ { "c": 1, "d": "PE resource section", "i": "metadata/binary/section/names::pe-resource-section", "o": 22016, "z": 5, "cf": 0.8999999761581421 } ], "ln": 22000 }, { "b": "0000000000001bAgYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006Xn[brp!0rrc20000", "n": [ { "c": 3, "d": "Recognized marker for timing checks", "i": "objectives/anti-analysis/timing/evasion::timing-anti-debug-recognized-marker", "o": 22110, "z": 15, "cf": 0.949999988079071 } ], "ln": 22094 }, { "b": "vGprDzu8o?001zE1onD5lJz38z2!IPve$fBC(QOtve$cAwDhYg002y!o8}uW003Qh9@(rwmGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up002y!zVB\u003eVlJyJ{ASxL", "n": [ { "c": 2, "d": "PE CompanyName metadata field", "i": "metadata/package/versioning::pe-companyname-field", "o": 22438, "z": 11, "cf": 0.699999988079071 }, { "c": 2, "d": "PE FileDescription metadata field", "i": "metadata/package/versioning::pe-filedescription-field", "o": 22478, "z": 15, "cf": 0.699999988079071 } ], "ln": 22422 }, { "b": "x-J5Kzu6Up001XM2MK(9mGvc5yYF2DrSDXhASydXx-J5Kzu6Up001XMe=WQae=WQae=WN9003Qhbld-AnDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE002y!zVB\u003eVlJyJ{ASxLGzVBUP", "n": [ { "c": 3, "d": "Dotted-quad PE version metadata marker", "i": "objectives/command-and-control/infrastructure/ip::ipv4-version-metadata-marker", "o": 22582, "z": 11, "cf": 0.9399999976158142 }, { "c": 2, "d": "PE InternalName metadata field", "i": "metadata/package/versioning::pe-internalname-field", "o": 22630, "z": 12, "cf": 0.699999988079071 } ], "ln": 22566 }, { "b": "ASxLGzVBUP003)pbld-Apxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE002y!zVB\u003eVlJyJ{ASxLG", "n": [ { "c": 2, "d": "PE OriginalFilename metadata field", "i": "metadata/package/versioning::pe-originalfilename-field", "o": 22814, "z": 16, "cf": 0.699999988079071 } ], "ln": 22798 }, { "b": "wb{ACyYBCn001?Q3ig8bpYLIozVBqFBPt[KBo25ove$cAwDhYg002y!zVB\u003eVlJyJ{ASxLGzVBUP004PJf8#1MpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001XMe=WQae=WQad/.BbvGo\u003cqg5%chh2]Pogxp\u003e:h2]uhve%^qgxoojhVNv*ve@1ZhukDiwDllvve%)tf-U++gxorkvGns!gxooj", "n": [ { "c": 2, "d": "PE ProductName metadata field", "i": "metadata/package/versioning::pe-productname-field", "o": 22926, "z": 11, "cf": 0.699999988079071 }, { "c": 2, "d": "PE ProductVersion has SemVer git hash", "i": "metadata/package/versioning::pe-productversion-semver-git-hash", "o": 23008, "z": 46, "cf": 0.8999999761581421 }, { "c": 2, "d": "PE version resource metadata", "i": "metadata/package/versioning::version-resource-metadata", "o": 22978, "z": 14, "cf": 0.8999999761581421 } ], "ln": 22910 }, { "b": "000000000000000000000b}]r3\u0026*ncxFPR*000000000000000000000000000000000", "n": [ { "c": 2, "d": "PE .reloc section presence", "i": "metadata/binary/section/names::reloc-section-presence", "o": 23552, "z": 6, "cf": 0.8999999761581421 } ], "ln": 23536 } ], "depth": 1, "facts": { "imp": [ [ "mscoree", "CorDllMain" ] ], "sec": [ [ ".text", 512, 21504, 5.77, "r-x" ], [ ".rsrc", 22016, 1536, 2.61, "r--" ], [ ".reloc", 23552, 512, 0.08, "r--" ] ], "metrics": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "resource_count": 1.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 38208.0, "reloc_overhang_bytes": 500.0, "reloc_overhang_ratio": 0.98, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "version.identity_entropy": 3.96, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0, "version.identity_symbol_ratio": 0.05 }, "file": { "size": 24064.0, "entropy": 5.49, "size_bytes": 24064.0 }, "binary": { "is_pie": 1.0, "code_entropy": 5.77, "string_count": 325.0, "overall_entropy": 5.49, "entropy_variance": 5.42, "avg_string_length": 20.09, "max_string_length": 138.0, "peak_region_bytes": 5120.0, "code_to_data_ratio": 1.0, "peak_region_entropy": 5.63, "string_length_stddev": 15.75, "largest_section_ratio": 0.89, "sentence_string_count": 11.0, "sentence_string_ratio": 0.03, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 21504.0, "entropy_max": 5.77, "entropy_mean": 2.82, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } } }, "id": 4, "mol": "O(Al)H(Db)", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/DotCarbon.Plugins.Notification/DotCarbon.Plugins.Notification.0.1.1.nupkg!!lib/net10.0/DotCarbon.Plugins.Notification.dll", "pid": 0, "risk": 3, "sha": "3a4502fe021b19285bc7164cfe113dee1156e1a6a13c2569dc89b7a45ece2b9f", "size": 24064, "traits": [ { "id": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "conf": 1.0, "crit": 3, "desc": "JSON polymorphism runtime marker", "spans": [ [ 11901, 16 ] ] }, { "id": "micro-behaviors/process/create/spawn::process-token-dotnet", "conf": 0.699999988079071, "crit": 1, "desc": ".NET Process type token", "spans": [ [ 14280, 16 ] ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "spans": [ [ 22978, 14 ] ] }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "spans": [ [ 0, 26 ] ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "spans": [ [ 5956, 4 ] ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "spans": [ [ 13822, 4 ] ] }, { "id": "objectives/evasion/process/hidden/execution::use-shell-execute", "conf": 0.7799999713897705, "crit": 1, "desc": "Process shell execute configuration", "spans": [ [ 13431, 19 ] ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 22110, 15 ] ] }, { "id": "micro-behaviors/process/create/spawn::diagnostics-namespace-dotnet", "conf": 0.75, "crit": 1, "desc": ".NET process namespace token", "spans": [ [ 15462, 26 ] ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "spans": [ [ 22582, 11 ] ] }, { "id": "micro-behaviors/data/string/library::dotnet-stringbuilder-append", "conf": 0.8199999928474426, "crit": 3, "desc": ".NET StringBuilder Append use", "spans": [ [ 14402, 13 ] ] }, { "id": "micro-behaviors/process/create/hidden::dotnet-create-no-window", "atk": "T1564.003", "conf": 0.8600000143051147, "crit": 2, "desc": ".NET process window suppression", "spans": [ [ 15885, 18 ] ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "spans": [ [ 5956, 4 ] ] } ], "type": "pe" }, { "id": 5, "sha": "1a6670ec6cb20a6520f5d6b9be859fcd7416bef2ba0e8e40bfbf0aaab5409e4f", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/DotCarbon.Plugins.Notification/DotCarbon.Plugins.Notification.0.1.1.nupkg!![Content_Types].xml", "size": 520, "type": "xml", "depth": 1 }, { "id": 6, "sha": "18961ec4d6b839c8ab76526c57a8bb635cbc75ba84afed1f4a32a695e15f5fa2", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/DotCarbon.Plugins.Notification/DotCarbon.Plugins.Notification.0.1.1.nupkg!!package/services/metadata/core-properties/5ddc4093e01e4930ba3c7a214de20606.psmdcp", "size": 704, "type": "xml", "depth": 1 }, { "ctx": [ { "b": "DM)3hz/ZhBBy/qkiWeD:xjVfeefX$uzdK[Lb1cu\u003elT+1Az/dg7y\u0026%x8zGvB9z//Y9x\u003e7N[x(v(kefYmGA=U@kzx.a=fFk7jf^nd)", "n": [ { "c": 3, "d": "Package first seen under 7 days ago", "i": "metadata/registry::brand-new-package", "o": 0, "z": 32, "cf": 1.0 } ], "ln": 0 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 917.0, "entropy": 4.86, "size_bytes": 917.0 }, "binary": { "overall_entropy": 4.86, "peak_region_bytes": 917.0, "peak_region_entropy": 4.86 }, "registry": { "age_days": 0.0, "maintainers": 1.0, "published_at": 1783624503.0, "releases_24h": 1.0, "releases_48h": 1.0, "is_deprecated": 0.0, "release_count": 1.0, "downloads_total": 0.0, "version_removed": 0.0, "package_age_days": 0.0, "first_published_at": 1783624503.0, "vulnerability_count": 0.0 } } }, "id": 7, "mol": "Md", "path": "DotCarbon.Plugins.Notification@0.1.1.registry.json", "pid": 0, "rel": "registry", "risk": 1, "role": "sidecar", "sha": "cd8df030118e72c86d3c02c13cd5d41d7ec9279174f0b5fcbff8bccadbc384bd", "size": 917, "traits": [ { "id": "metadata/registry::freshly-published", "conf": 1.0, "crit": 3, "desc": "Registry release under 7 days old", "spans": [ [ 0, 24 ] ] }, { "id": "metadata/registry::brand-new-package", "conf": 1.0, "crit": 3, "desc": "Package first seen under 7 days ago", "spans": [ [ 0, 32 ] ] } ], "type": "registry" } ], "omitted_files": 2, "rev": "281fd", "v": "8" } }