Benign dotnet 8,985 installs Download

Galosys.Foundation.AspNetCore.FeatureManagement 26.7.26.2

Legitimate NuGet package

“Galosys.Foundation快速开发库”

Markdown-style heading precedes a code fenceSecurity heading or confirmation requirement

Evidence

Visual Studio PDB build path Galosys.Foundation.AspNetCore.FeatureManagement.dll · 0xa8c–0xccc
⋯3 more rows
0xabc6cbce8499735a492daabfb9601000000l..I.5..........
0xacc443a5c70726f6a6563745c626173655cD:\project\base\
0xadc666f756e646174696f6e5c6672616d65foundation\frame
0xaec776f726b5c7372635c47616c6f737973work\src\Galosys
0xafc2e466f756e646174696f6e2e4173704e.Foundation.AspN
0xb0c6574436f72652e466561747572654d61etCore.FeatureMa
0xb1c6e6167656d656e745c6f626a5c52656cnagement\obj\Rel
0xb2c656173655c6e657431302e305c47616cease\net10.0\Gal
0xb3c6f7379732e466f756e646174696f6e2eosys.Foundation.
0xb4c4173704e6574436f72652e4665617475AspNetCore.Featu
0xb5c72654d616e6167656d656e742e706462reManagement.pdb
0xb6c0053484132353600fa84f4be6cbce8d9.SHA256.....l...
⋯13 more rows
0xc4cd80400000000000000000000d8043400..............4.
0xc5c0000560053005f005600450052005300..V.S._.V.E.R.S.
0xc6c49004f004e005f0049004e0046004f00I.O.N._.I.N.F.O.
0xc7c00000000bd04effe0000010007001a00................
⋯5 more rows
PE version metadata includes CompanyName Galosys.Foundation.AspNetCore.FeatureManagement.dll · 0xd1a–0xfca
⋯5 more rows
0xd6a69006f006e00eb5f1f90005fd153935ei.o.n.._..._.S.^
0xd7a000030000800010043006f006d007000..0.....C.o.m.p.
0xd8a61006e0079004e0061006d0065000000a.n.y.N.a.m.e...
0xd9a0000470061006c006f00730079007300..G.a.l.o.s.y.s.
0xdaa0000880030000100460069006c006500....0...F.i.l.e.
0xdba44006500730063007200690070007400D.e.s.c.r.i.p.t.
0xdca69006f006e0000000000470061006c00i.o.n.....G.a.l.
⋯5 more rows
0xe2a6d0065006e007400000034000a000100m.e.n.t...4.....
0xe3a460069006c0065005600650072007300F.i.l.e.V.e.r.s.
0xe4a69006f006e0000000000320036002e00i.o.n.....2.6...
0xe5a37002e00320036002e003200000088007...2.6...2.....
0xe6a3400010049006e007400650072006e004...I.n.t.e.r.n.
0xe7a61006c004e0061006d00650000004700a.l.N.a.m.e...G.
⋯21 more rows
PE version metadata includes ProductVersion Galosys.Foundation.AspNetCore.FeatureManagement.dll · 0xfe8–0x1138
⋯7 more rows
0x10586100670065006d0065006e0074000000a.g.e.m.e.n.t...
0x10688a0033000100500072006f0064007500..3...P.r.o.d.u.
0x107863007400560065007200730069006f00c.t.V.e.r.s.i.o.
0x10886e000000320036002e0037002e003200n...2.6...7...2.
0x109836002e0032002b0037003700370038006...2.+.7.7.7.8.
0x10a861003200350034003700640062003900a.2.5.4.7.d.b.9.
0x10b863006300350033003300610032003400c.c.5.3.3.a.2.4.
0x10c862003600630038003700650031003400b.6.c.8.7.e.1.4.
⋯7 more rows
Markdown-style heading precedes a code fence README.md · lines 1–18
⋯9 lines
10```
11
12### security
13
14```csharp
⋯4 lines
Large base64-encoded string (128+ chars) README.md · lines 26–29
26:8… = SecurityTemplate.AesDecrypt<SampleDto>(rt, key);
27
28var pub = "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDM9As4OkFLUyEmtqVJJaHkAf0xKR3aq38q6FqSi1vQfy1hUjhh/Z8k5NaT2WnmnchGUOoGsvwtKVAHrS62qvWzAPy7sauvG/O7hu1l+3SsrRDtv/O6hqRjEbPex/hpZM1opdkDtiiuHB5wHFYnD7JouWme9lNAViRcj4bXfqnZqwIDAQAB";
29string @private = "MIICeQIBADANBgkqhkiG9w0BAQEFAASCAmMwggJfAgEAAoGBAMz0Czg6QUtTISa2pUkloeQB/TEpHdqrfyroWpKLW9B/LWFSOGH9nyTk1pPZaeadyEZQ6gay/C0pUAetLraq9bMA/Luxq68b87uG7WX7dKytEO2/87qGpGMRs97H+GlkzWil2QO2KK4cHnAcVicPsmi5aZ72U0BWJFyPhtd+qdmrAgMBAAECgYEAvW67iAbgHt0BASVD9C3iSjpEaVHVlC165o/IVzaTcEx8Bz3Ve0zN8W3JnvIO3ebsG4HiLLr2Nk++9rltOc0eNeGMv7F1e/OFot1wN0ON6s1g4bYh1z5Uz8FcYiMWcqHHICrx+oSFeK9x+I2Zge7enQXcsVnqEhm77ZE5YczSryECQQD9nB58e5efYchF+cYbmURioX18cUMuhQbB9Aq2N55cd689Lg35KZqT8JQTp/8tQSdCJG8d2nU8VKspUKTEAuaDAkEAzuKIIoc9PVJvy90LhIPA9c1S8BPCI7EMCaTZqJ5o3VaR2dqvUZDGX7kL3kYkQ+n7mq3KIECvkEFzA+FOP96XuQJBAJQTK …

No evidence locations were recorded for this file. Raw result

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.