{ "llm": { "conf": 0.5023162, "grade": "benign", "model": "Qwen/Qwen3.6-27B", "outcome": "benign", "interpretation": "Legitimate NuGet package library" }, "ml": { "v": "7", "eng": "2.5.0-beta.0", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.28902313, "rte": "az", "prob": 0.28902313 }, { "cls": 0, "raw": 0.001367271, "rte": "az/nupkg", "prob": 0.001367271 } ], "prob": 0.28902313, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.28902313113212585, "type": "nupkg" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.00001142422388511477, "type": "xml" }, { "id": 6, "lvl": -1, "conf": 0, "prob": 0.27977636456489563, "type": "pe" }, { "id": 10, "lvl": -1, "conf": 0, "prob": 0.000012636184692382812, "type": "registry" } ], "version": "v18.18", "analyzed_at": "2026-08-02T01:15:34Z" }, "path": "Soenneker.Dictionaries.Singletons.LeasedExpiration.4.0.13.nupkg", "raw": { "files": [ { "id": 0, "ctx": [ { "b": "p!H([6Awak2MP.-@AH?rNaBa{000#u000xb003wDwO=Ave]\u003eJtBcI*OyqIUsHw#Pna]+o9W+r^zgg#rSEYkmq!6/jKkfePe?tJZ2p@ZpR.27!ciQ.tQN4vL9PMW=rF*DUirJ:-TTlqNL\u003cb#2hQXLWK8mu!}!e(Z", "n": [ { "c": 2, "d": "Archive contains an executable member", "i": "metadata/file/metrics::archive-contains-executable-member", "o": 0, "z": 31, "cf": 0.949999988079071 } ], "ln": 0 } ], "mol": "H(Cm)Md₂(BiPa)", "sha": "74f998dfd57a8676ed43f6a1848fe2641c433150bef66d124dabcec311ea8057", "path": "Soenneker.Dictionaries.Singletons.LeasedExpiration.4.0.13.nupkg", "risk": 4, "size": 35816, "type": "nupkg", "facts": { "metrics": { "file": { "size": 35816.0, "entropy": 7.91, "size_bytes": 35816.0 }, "binary": { "overall_entropy": 7.91, "peak_region_bytes": 32768.0, "peak_region_entropy": 7.84 }, "archive": { "file_count": 10.0, "member_count": 10.0, "script_count": 0.0, "zip_bomb_ratio": 3.7, "directory_count": 0.0, "executable_count": 1.0, "extra_field_size": 0.0, "noise_file_count": 0.0, "total_compressed": 34358.0, "compression.ratio": 0.79, "hidden_file_count": 2.0, "total_uncompressed": 43564.0, "crc_collision_count": 0.0, "entry_comment_count": 0.0, "max_filename_length": 81.0, "rtlo_filename_count": 0.0, "format.regular_count": 10.0, "nested_archive_count": 0.0, "path_traversal_count": 0.0, "symlink_escape_count": 0.0, "security.setgid_count": 0.0, "security.setuid_count": 0.0, "security.sticky_count": 0.0, "double_extension_count": 0.0, "duplicate_member_count": 0.0, "security.symlink_count": 0.0, "unicode_filename_count": 0.0, "homoglyph_filename_count": 0.0, "security.encrypted_count": 0.0, "timing.mtime_unique_count": 4.0, "timing.mtime_unique_ratio": 0.4, "misplaced_executable_count": 1.0, "timing.mtime_dominant_count": 4.0, "timing.mtime_spread_seconds": 25172.0, "timing.sentinel_mtime_count": 0.0, "security.world_writable_count": 0.0, "timing.mtime_dominant_fraction": 0.4, "compression.method_counts.stored": 1.0, "compression.method_counts.deflate": 9.0 } } }, "ident": { "name": { "value": "Soenneker.Dictionaries.Singletons.LeasedExpiration", "source": "nupkg.title", "verified": false }, "urls": [ { "url": "https://github.com/soenneker/soenneker.dictionaries.singletons.leasedexpiration", "kind": "homepage", "source": "nupkg.project_url" }, { "url": "https://github.com/soenneker/soenneker.dictionaries.singletons.leasedexpiration", "kind": "repository", "source": "nupkg.repository_url" } ], "trust": "unsigned", "authors": [ { "name": "Jake Soenneker", "role": "author", "source": "nupkg.authors" } ], "version": { "value": "4.0.13", "source": "nupkg.version", "verified": false }, "identifier": { "value": "Soenneker.Dictionaries.Singletons.LeasedExpiration", "source": "nupkg.id", "verified": false } }, "traits": [ { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "from": [ { "file": 6 } ] }, { "id": "metadata/package/versioning::pe-filedescription-field", "conf": 0.699999988079071, "crit": 3, "desc": "PE version metadata includes FileDescription", "from": [ { "file": 6 } ] }, { "id": "metadata/binary/layout::pe-no-signature-record", "conf": 0.949999988079071, "crit": 3, "desc": "PE has no signature record" }, { "id": "metadata/package/versioning::pe-internalname-field", "conf": 0.699999988079071, "crit": 3, "desc": "PE version metadata includes InternalName", "from": [ { "file": 6 } ] }, { "id": "micro-behaviors/communications/http/url/domain::http-url-binary", "atk": "T1071.001", "mbc": "C0002", "conf": 0.699999988079071, "crit": 3, "desc": "Embedded HTTP or WebSocket URL", "from": [ { "file": 6 } ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET metadata root signature (BSJB)", "from": [ { "file": 6 } ] }, { "id": "metadata/binary/metrics/entropy::code-entropy-at-most-7-5", "conf": 0.699999988079071, "crit": 1, "desc": "Code entropy is 7.5 or lower", "from": [ { "file": 6 } ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET managed assembly", "from": [ { "off": 680, "file": 6 } ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 3, "desc": "PE version metadata includes ProductVersion", "from": [ { "file": 6 } ] }, { "id": "metadata/package/versioning::pe-productversion-semver-git-hash", "conf": 0.8999999761581421, "crit": 3, "desc": "PE ProductVersion has SemVer git hash" }, { "id": "metadata/build/reproducible::pe-reproducible-build", "conf": 1.0, "crit": 2, "desc": "Built with /Brepro (deterministic)" }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR header (COM descriptor)" }, { "id": "metadata/binary/anomaly/provenance::pe-far-future-timestamp", "conf": 0.949999988079071, "crit": 2, "desc": "PE COFF timestamp encodes a future date" }, { "id": "metadata/package/versioning::pe-companyname-field", "conf": 0.699999988079071, "crit": 3, "desc": "PE version metadata includes CompanyName", "from": [ { "file": 6 } ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 3, "desc": "PE version metadata includes FileVersion", "from": [ { "file": 6 } ] } ] }, { "ctx": [ { "b": "[4ls%kx}3YaA?spB7]MgjT8QkfD}SJzEWP}x(mMDb6w0teJs}sj{\u003cz\u003evpK7YxjSigzes9hjTaMYBz%n]flpSpwO\u003e\u003c%e]trjA=l2qw]]Unz/4dDvpK7Yxk8l@fetjogCpBtfk+]NAaJJiCYNytj{\u0026zPjz!UKvpS!*vlL2varR^?x\u003efzaz!i*7wOU\u003c$e\u003c%z-BzkVhvrc6[B1Qy9zF9=%Bz(5re\u003e/?+B7F(JCYmwqvruj4zAGN^wiHtyarR^?C4CYnx(v(Mg+HEmf/7{BC4CYnx(v(M3lQDlauT7PBzbPkB3ri8yH[R!z!i*7wOU\u003c$jtgb=BzbPkB3o{NarR^?y?Wx\u003czGxwiBA}?pjTaDZAb]JhB7]Mgb0FZ)r6h*Ix\u003e7Z(B7EJxarR^HjzX.wwO#N2rDq[txMOunB2\u003e%cy?Wx\u003czGxxge]C/AwPPLyA+v41nMm/9y?Wx\u003czGxw?A+)]DarR^HjzwqzzA.=Az/dgDzF86+x\u003e870j{\u0026zParS^!wNPa^wJ\u003c0Xk$1Boe]tbYflgSjwnL)w3lQDlauTQ-z!-\u0026[Bx9u$k4]4WAc15[fk20vxMW=pv@DiqB8LSczE)P{AXzGLwO#x%yH}JswnbK}x(v($A+P9ae]$-Axkzd3z/fRGy?m3@wN]v%Aa%u3BzkVhjtgU]z!-\u0026[Bx9u$j{\u0026zParS^SwPIv4x(Ffdz/d:rxMvV)wg.\u003ehw[r93wNPT\u003ewft@czF9=%Bz(5raA}KwxDR21y?j-2CYmwqvruj4zxJw9wft@4w[r8}x(!liB75(qjtgkRB7ol8Acb/jzAXyIarR^?v@DsiA+Pf1BuS6gAcVFrxj#xf.L[UkfFUKen)#HDax9h\u0026zF\u003c33wPx)^v@DsiA+Pf1BuQ3OarR^?Byw*6k4FwqBzkVhvrc6[B0bKrzF9=%Bz(5raz+Q$B7F([CYmwqvruj4zxK1mzF9=%Bz(4twQ5fdA::67z/cXlwNPT\u003ewftY1vrl05B8kM3x(mMawnbK}x(v($A^n^zwNPT\u003ewmZ18x(WT7x(v)gx(mN1wPR\u003cdwnbK}x(v($A^n^CvRPE:BrC7mxKL}2ay]zjzE)]jv\u003cr9GzE)]LflySnB3o{NarR^?A+fidB7]-mA^n^HD2NsTb4\u003eRia%q2Gy=@$QBAzFyiXJd0x([3hvLheez7/%GwO#x%yH}JtB8LSczE)P{AXp)pv@#B6zEEN1wPGFBx(mN1wPR\u003cdB1Rouvrl0\u003cwQ5fdA::67z/c:wvSC){v}X1Hzddc@a%pxlzeB0ejT8)xfGy*@gD46FfG0q%gC\u0026SLvp.hFw[0IOvMm!ch-irFhz!]LvMtRPffPZ=arR^?wmYZ\u003ezE^r@v}/H}j{\u0026zParR^HjzeXMB-nEBvrc0(BvHpVzdN{fA+^/Zzu", "n": [ { "c": 2, "d": "NuGet nuspec manifest file", "i": "metadata/build/manifest::nuspec-file", "o": 0, "z": 57, "cf": 0.9800000190734863 } ], "ln": 0, "col": 1, "line": 1 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 1294.0, "entropy": 4.94, "size_bytes": 1294.0 }, "binary": { "overall_entropy": 4.94, "peak_region_bytes": 1294.0, "peak_region_entropy": 4.89 } } }, "id": 2, "path": "Soenneker.Dictionaries.Singletons.LeasedExpiration.4.0.13.nupkg!!Soenneker.Dictionaries.Singletons.LeasedExpiration.nuspec", "pid": 0, "risk": 1, "sha": "90a9108b9c9407d73f3ed1905ed9ccc59a1ab7f6a2868eb06682ec54d4bec071", "size": 1294, "traits": [ { "id": "metadata/build/manifest::nuspec-file", "conf": 0.9800000190734863, "crit": 2, "desc": "NuGet nuspec manifest file", "spans": [ [ 0, 57 ] ] }, { "id": "metadata/package/files/nuget::nuspec-repository", "conf": 0.8999999761581421, "crit": 2, "desc": "NuGet package declares repository", "spans": [ [ 42, 963 ] ] } ], "type": "xml" }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J\u0026m(0ji6Sa?dLD+]{51x(+zoA=kPhvqNb%vqY$3BrC47aAzQxazCZol@c-7zeS@@e!5l%bME/A00000p^\u003eu:oAtj}PcBG60000000000?#A", "n": [ { "c": 2, "d": "PE contains exactly one resource entry", "i": "metadata/binary/resource::pe-single-version-resource", "o": 0, "z": 24, "cf": 1.0 } ], "ln": 0 }, { "b": "000000000000000kMy^J00000000000000000000\u00264t0f00000nb@R\u00260SSx7S2#6u(\u003cJ\u003c]0rr9100000000000000000000000000000000000000000000000000000000000000000cisnLc\u003eVHW3mWIb0%w=Q6951tdK\u003eG41o*g/000uQdGPXP1T\u003e8=017h90S@Mec(8^.3mWIb0%w=Q7xsBxdK\u003eG41o*g\u003c000uQe=(aTc\u0026\u003cqFd\u003c+rElq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn2M$bcbyPQ)BozNzHY^XTbu5Y8x(mN800000@0io51onA4bumUx00@S95c8Xgbs+:9l\u0026Wh!5d5sp*YEJRbsli+vGlxd000000SSi3m\u0026}Zp2[c!l0qVZL02tLm0rr919rl6t0@@r32MK\u00268761sm2lj-782%Tp2lj-78VP\u003cr0@@r30rr910SSi20@@r30rr91006\u003eq0rr91000i6^/Ee+1]}^cZ5[Mt\u003c]zB:4/\u003eC*000i6blskm1]{)\u0026Llh0?E/U-n1]]5kLlh0?O=L2S1]{:^Llh0?sPKY*1{1k}Llh0?3\u0026#K]1]#\u003cELlh0?Y8/RF1]{1LZ5[Mt}t!ki3ii*3p6g?6o-NAY1]%?!}2Q:2P8!V*1][S9}2Q:22MTV41]}9)}2Q:269dz41]@\u0026E}2Q:22)l1=1][V7}2Q:2EGofB00000G-z8M000310rrc35c9*M8V{oA0rrc2P-tS79@(AD", "n": [ { "c": 2, "d": ".NET metadata root signature (BSJB)", "i": "metadata/binary/framework::dotnet-metadata", "o": 680, "z": 4, "cf": 1.0 }, { "c": 1, "d": "PE standard code/data section", "i": "metadata/binary/section/names::pe-code-data-standard-section", "o": 512, "z": 5, "cf": 0.8999999761581421 } ], "ln": 480 }, { "b": "wO#x%yH}Jsl${dMx(v($A+P9ae(MF4xkzd3z/fRGoL4TNwN[kOAa%u3BzkVhe[w^m08[e:By/p?rb3hXq/De.07ggjv}xE)vruj4zD7K\u0026wO}GDz!i*7wOU\u003c$e\u003c%z-BzkVhvrc6[B1Qy9zF9=%Bz(5re\u003e/?+B7F(JCYmwqvruj4zu9QNwO#x%yH}Js", "n": [ { "c": 2, "d": ".dll extension reference", "i": "micro-behaviors/fs/path/extension::dll-dup", "o": 2576, "z": 4, "cf": 0.5 } ], "ln": 2528 }, { "b": "B1Qy9zF9=%Bz(4\u0026wQetHoL4TNwN[kOAa%u3BzkVh0bk$WwKQ\u0026.x(WT7x(v\u003e?q*ACawO\u003c4$wOb:\u0026v@#B6zu8q0Bz(g1q*ACawO\u003c4/x\u003c\u003eT(z/Z2mv@?SGD2[7sz7X.ezGGPfwIct*ze:i9wPyZXA=#ebwPE\u0026twNY^{xk8l@o(BMNA@Yc:B97#ge(VI8wNPa-zF7O3vrlj908)/EzF\u003c33wPxy\u003ex\u003e8m0z/f07x\u003equrq!V", "n": [ { "c": 2, "d": ".NET System.Diagnostics namespace reference", "i": "metadata/lang/compiler/managed::diagnostics-namespace", "o": 2759, "z": 18, "cf": 0.75 }, { "c": 2, "d": ".NET System.Reflection namespace reference", "i": "metadata/lang/compiler/managed::reflection-namespace", "o": 2735, "z": 17, "cf": 0.699999988079071 } ], "ln": 2687 }, { "b": "e(1\u0026mlVm0Rl2Z=]r+lq)x(v(LB$\u003eW6fAzeM4IRxMvqPO1z/PRYx(!lfvr\u003eQRzdK2apdnb8f!+jl8ux*MxMOunB2\u003e%cB8LSczE)P{AXp\u003cuz2:LA0rrv5wO+{^B7CsKb()#*lVl{?A+Pf1BrFD1atLSahxUR2yH[R!z!i*7wOU\u003c$002Q(07x\u003e2A+eV\u0026ePUujwGU/2vrl0\u003caAImmxkzd3z/fRsCwhejazCw5wGUMeAa%u3BzkVhayPd#aAH$6wGUI$B8V5svqEK@00", "n": [ { "c": 3, "d": "Embedded HTTP or WebSocket URL", "i": "micro-behaviors/communications/http/url/domain::http-url-binary", "o": 3555, "z": 21, "cf": 0.699999988079071 }, { "c": 2, "d": "Copyright notice", "i": "metadata/package/license::copyright-word", "o": 3594, "z": 9, "cf": 0.6000000238418579 } ], "ln": 3491 }, { "b": "0000000000000000000000000000000000000000000000000000000000315c8Xg7YTL^000000000000000000310rr91fAq960000000000000000003100000nb@R\u0026su(\u0026^vG=-i0000000000vG!N*00341qVHe8rSCL*qufR}nDqJ^p5[S3nDqG=mGui:00000Y-^*600031000c4000Dd000c4000Ddkl7V-000001onA40SSi2000000000000000l\u0026Wh!0rud2ve$rFmGvc5yYF2DnDrSdw=", "n": [ { "c": 2, "d": "PE version resource metadata", "i": "metadata/package/versioning::version-resource-metadata", "o": 4702, "z": 15, "cf": 0.8999999761581421 }, { "c": 1, "d": "PE resource section", "i": "metadata/binary/section/names::pe-resource-section", "o": 4608, "z": 5, "cf": 0.8999999761581421 } ], "ln": 4576 }, { "b": "005O[00031fAr^bfAr^bfAr{fvGn7Z005!{mGrC?lJz38z2!zMwDlPFBo3vZ002%#xAi5MwDlcswb[gYA@YRGw=MxxaoliTwDlcsA@Y+Kwb).LA@Y[OzuaqHyYF2DBo3jVzua.TaolP=x-JkPxAfdP", "n": [ { "c": 1, "d": "Several short title-cased resource strings", "i": "metadata/binary/resource::short-titlecase-resource-words", "o": 4922, "z": 8, "cf": 0.800000011920929 } ], "ln": 4890 }, { "b": "CMqW.x-JeNve$xHx-J5Kzu7^Vve$fBwb).LA@YRGw=Mxxaok{Lx-JhOz#:!RA@YRGyYD6/002W)761vnlJz38z2!IPve$fBC(QOtve$cAwDhYg003WjBo3y.z#:}ViSH/kf934[zVBtGzuaLOwDlGCwDl-Je=YwYzVBRO0052VgxmBQmGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up002{$zVBtGzuaLOwDlGCwDl-Je=Xotx-ISyBo31PzVBUPve$rFx-IYAA@W/)qVHIizuaqHyYF2DBo3jVzua.Te=XMBwDlcsA@Y+Kwb]3#CMqW.x-JeNve$xHx-J5Kzu6Up001+O2(\u003c#amGvc5yYF2DrSDXhASydXx-J5Kzu6Up001?Qe=WN9e=WQagxo3cfAq7M0052VhVJ\u003cUnDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE002{$zVBtGzuaLOwDlGCwDl-Je=Xotx-ISyBo31PzVBUPve$rFx-IYAA@W/)qVHIizuaqHyYF2DBo3jVzua.Te=XMBwDlcsA@Y+Kwb]3#CMqW.x-JeNve$xHx-J5Kzu8o?wb{ACyYBCn003Kf", "n": [ { "c": 3, "d": "PE version metadata includes CompanyName", "i": "metadata/package/versioning::pe-companyname-field", "o": 5086, "z": 11, "cf": 0.699999988079071 }, { "c": 3, "d": "PE version metadata includes FileDescription", "i": "metadata/package/versioning::pe-filedescription-field", "o": 5162, "z": 15, "cf": 0.699999988079071 }, { "c": 3, "d": "PE version metadata includes FileVersion", "i": "metadata/package/versioning::pe-fileversion-field", "o": 5306, "z": 11, "cf": 0.699999988079071 }, { "c": 3, "d": "PE version metadata includes InternalName", "i": "metadata/package/versioning::pe-internalname-field", "o": 5358, "z": 12, "cf": 0.699999988079071 }, { "c": 1, "d": "PE version company name populated", "i": "metadata/package/versioning::pe-company-name-populated", "o": 5112, "z": 21, "cf": 0.8500000238418579 }, { "c": 1, "d": "PE FileDescription field is populated", "i": "metadata/package/versioning::pe-file-description-present", "o": 5196, "z": 50, "cf": 0.949999988079071 }, { "c": 1, "d": "PE FileVersion value is present", "i": "metadata/package/versioning::version-info-file-version-present", "o": 5332, "z": 8, "cf": 0.949999988079071 } ], "ln": 5022 }, { "b": "0rt^[wDluyve$9zlJz38z#+d-ASx!Nx8(PBBn#pvlJz38z#+d-ASx!Nx8(PBBo0A-Sq[4vg5%0dg5%ijaok1lve$6ywDi?MqVH.owDlPFzuakFyxd]CASu7tMh\u0026\u0026z0rt)}ASx!Nx8(SCzua8ByYD{8x-I@HwDlPFve$cAwDhYgqVH.owDlPFzuakFyxd]CASvY(l\u0026Z{3v/QPJx-J5Kzua8BASx!NwDl=Ke=X/Ix-J2Jx8(-FwDl/LzVBUPA@W/)oAnS7ve$uGwDh", "n": [ { "c": 2, "d": "PE OriginalFilename metadata field", "i": "metadata/package/versioning::pe-originalfilename-field", "o": 5602, "z": 16, "cf": 0.699999988079071 }, { "c": 1, "d": "PE LegalCopyright field is populated", "i": "metadata/package/versioning::pe-legal-copyright-present", "o": 5532, "z": 32, "cf": 0.949999988079071 } ], "ln": 5500 }, { "b": "H5:1f0rt{@ASy1Twb{-Lv/QPJp5[Y5z2!bE00000qVH.owDlPFzuakFyxd]CASvY(l\u0026Z{3v/QPJx-J5Kzua8BASx!NwDl=Ke=X/Ix-J2Jx8(-FwDl/LzVBUPA@W/)oAnS7ve$uGwDllvmf4Mjz#:OLASxIFBo31PzVBUP00000GA9Xa0rt{@ASy1Twb{-Lv/QPJrSDXhASydXx-J5Kzu6UpgYPcdfArZ9f-T0fd/.Nfgxo9eirg-kvGng:hukMlhukAhh2}7=h2]AjgYR4^v/P{qwDjE=fAtX+vGnd-hVNp!h#)v!wDjT?h2]uhhukSngYR1=ve%:pirf3ViSGD^0rty=A@ZmYwDlMEvGpiAC(O@!rSDXhASydXx-J5Kzu6UpgYPcdfArZ9f-T0fe=WN900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003zmw3\u0026*nc06ZC-00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", "n": [ { "c": 3, "d": "PE version metadata includes ProductVersion", "i": "metadata/package/versioning::pe-productversion-field", "o": 5890, "z": 14, "cf": 0.699999988079071 }, { "c": 3, "d": "PE ProductVersion has SemVer git hash", "i": "metadata/package/versioning::pe-productversion-semver-git-hash", "o": 5920, "z": 47, "cf": 0.8999999761581421 }, { "c": 2, "d": "PE .reloc section presence", "i": "metadata/binary/section/names::reloc-section-presence", "o": 6144, "z": 6, "cf": 0.8999999761581421 }, { "c": 1, "d": "Several short title-cased resource strings", "i": "metadata/binary/resource::short-titlecase-resource-words", "o": 6022, "z": 8, "cf": 0.800000011920929 }, { "c": 1, "d": "PE ProductName field is populated", "i": "metadata/package/versioning::pe-product-name-present", "o": 5780, "z": 50, "cf": 0.949999988079071 } ], "ln": 5748 } ], "depth": 1, "facts": { "imp": [ [ "mscoree", "CorDllMain" ] ], "sec": [ [ ".text", 512, 4096, 5.28, "r-x" ], [ ".rsrc", 4608, 1536, 3.22, "r--" ], [ ".reloc", 6144, 512, 0.06, "r--" ] ], "metrics": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "clr.is_il_only": 1.0, "resource_count": 1.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 50548.0, "reloc_overhang_bytes": 500.0, "reloc_overhang_ratio": 0.98, "clr.is_32bit_required": 0.0, "bss_like_section_count": 0.0, "clr.is_32bit_preferred": 0.0, "clr.strong_name_signed": 0.0, "section_overflow_count": 0.0, "clr.is_native_entrypoint": 0.0, "misaligned_section_count": 0.0, "version.identity_entropy": 4.11, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0, "declared_data_directory_count": 6.0, "version.identity_symbol_ratio": 0.08 }, "file": { "size": 6656.0, "entropy": 4.46, "size_bytes": 6656.0 }, "binary": { "is_pie": 1.0, "code_entropy": 5.28, "string_count": 83.0, "overall_entropy": 4.46, "entropy_variance": 4.6, "avg_string_length": 25.39, "max_string_length": 132.0, "peak_region_bytes": 2048.0, "code_to_data_ratio": 1.0, "peak_region_entropy": 5.34, "string_length_stddev": 21.26, "largest_section_ratio": 0.62, "sentence_string_count": 5.0, "sentence_string_ratio": 0.06, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 4096.0, "entropy_max": 5.28, "entropy_mean": 2.85, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } } }, "id": 6, "mol": "H(Cm)Md₂(BiPa)", "path": "Soenneker.Dictionaries.Singletons.LeasedExpiration.4.0.13.nupkg!!lib/net10.0/Soenneker.Dictionaries.Singletons.LeasedExpiration.dll", "pid": 0, "risk": 4, "sha": "4ba9510405a2d99d15ec66a7c30d3bb6ff68e380a62411f38959d46167abb1d2", "size": 6656, "traits": [ { "id": "metadata/package/versioning::pe-companyname-field", "conf": 0.699999988079071, "crit": 3, "desc": "PE version metadata includes CompanyName", "spans": [ [ 5086, 11 ] ] }, { "id": "metadata/build/reproducible::pe-reproducible-build", "conf": 1.0, "crit": 2, "desc": "Built with /Brepro (deterministic)" }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 3, "desc": "PE version metadata includes ProductVersion", "spans": [ [ 5890, 14 ] ] }, { "id": "metadata/package/versioning::pe-productversion-semver-git-hash", "conf": 0.8999999761581421, "crit": 3, "desc": "PE ProductVersion has SemVer git hash", "spans": [ [ 5920, 47 ] ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET metadata root signature (BSJB)", "spans": [ [ 680, 4 ] ] }, { "id": "metadata/package/versioning::pe-internalname-field", "conf": 0.699999988079071, "crit": 3, "desc": "PE version metadata includes InternalName", "spans": [ [ 5358, 12 ] ] }, { "id": "metadata/binary/metrics/entropy::code-entropy-at-most-7-5", "conf": 0.699999988079071, "crit": 1, "desc": "Code entropy is 7.5 or lower", "spans": [ [ 0, 26 ] ] }, { "id": "metadata/package/versioning::pe-filedescription-field", "conf": 0.699999988079071, "crit": 3, "desc": "PE version metadata includes FileDescription", "spans": [ [ 5162, 15 ] ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR header (COM descriptor)" }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 3, "desc": "PE version metadata includes FileVersion", "spans": [ [ 5306, 11 ] ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 4702, 15 ] ] }, { "id": "metadata/binary/anomaly/provenance::pe-far-future-timestamp", "conf": 0.949999988079071, "crit": 2, "desc": "PE COFF timestamp encodes a future date" }, { "id": "metadata/binary/layout::pe-no-signature-record", "conf": 0.949999988079071, "crit": 3, "desc": "PE has no signature record" }, { "id": "micro-behaviors/communications/http/url/domain::http-url-binary", "atk": "T1071.001", "mbc": "C0002", "conf": 0.699999988079071, "crit": 3, "desc": "Embedded HTTP or WebSocket URL", "spans": [ [ 3555, 21 ] ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET managed assembly", "spans": [ [ 680, 4 ] ] } ], "type": "pe" }, { "id": 10, "sha": "ab0ea2687e76fcc3ceae3da87a22da3491a0652f84a76ffeda80dda2983225da", "path": "Soenneker.Dictionaries.Singletons.LeasedExpiration@4.0.13.registry.json", "size": 937, "type": "registry", "depth": 1 } ], "omitted_files": 1, "rev": "0ea32", "v": "8" } }