Benign dotnet 497,844 installs Download

Soenneker.Validators.ZipCode.Exists 4.0.2528

Legitimate NuGet package metadata

“A validation module checking for existence of US ZipCodes, updated daily (if available)”

PE has no signature recordPE ProductVersion has SemVer git hash

Evidence

.NET managed assembly 0x5fc–0x68c
0x5fc027c0c00000408284300000a2a000000.|.....(C...*...
0x60c0110000000000e00d1df001929000001............)...
0x61c36027c0c00000403284400000a2a00006.|.....(D...*..
0x62c42534a4201000100000000000c000000BSJB............
0x63c76342e302e3330333139000000000500v4.0.30319......
⋯5 more rows
Embedded HTTP or WebSocket URL 0x1de6–0x1eb6
⋯3 more rows
0x1e166d65092e4e45542031302e301a010015me..NET 10.0....
0x1e2668747470733a2f2f736f656e6e656b65https://soenneke
0x1e36722e636f6d00000c01000752656c6561r.com......Relea
0x1e46736500002a010025436f707972696768se..*..%Copyrigh
⋯7 more rows
PE version resource structure 0x23e0–0x24c0
⋯6 more rows
0x24400000000048000000586000001e050000....H...X`......
0x245000000000000000001e05340000005600..........4...V.
0x246053005f00560045005200530049004f00S._.V.E.R.S.I.O.
0x24704e005f0049004e0046004f0000000000N._.I.N.F.O.....
⋯5 more rows
PE version metadata includes CompanyName 0x25c2–0x2842
⋯3 more rows
0x25f262006c006500290000004c0016000100b.l.e.)...L.....
0x260243006f006d00700061006e0079004e00C.o.m.p.a.n.y.N.
0x261261006d00650000000000680074007400a.m.e.....h.t.t.
0x2622700073003a002f002f0073006f006500p.s.:././.s.o.e.
0x26326e006e0065006b00650072002e006300n.n.e.k.e.r...c.
0x26426f006d00000070002400010046006900o.m...p.$...F.i.
0x26526c006500440065007300630072006900l.e.D.e.s.c.r.i.
0x26627000740069006f006e00000000005300p.t.i.o.n.....S.
⋯3 more rows
0x26a26f00640065002e004500780069007300o.d.e...E.x.i.s.
0x26b274007300000036000b00010046006900t.s...6.....F.i.
0x26c26c006500560065007200730069006f00l.e.V.e.r.s.i.o.
0x26d26e000000000034002e0030002e003200n.....4...0...2.
0x26e23500320038002e0030000000000070005.2.8...0.....p.
0x26f22800010049006e007400650072006e00(...I.n.t.e.r.n.
0x270261006c004e0061006d00650000005300a.l.N.a.m.e...S.
⋯20 more rows
PE version metadata includes ProductVersion 0x2848–0x2978
⋯5 more rows
0x289843006f00640065002e00450078006900C.o.d.e...E.x.i.
0x28a873007400730000008800320001005000s.t.s.....2...P.
0x28b872006f00640075006300740056006500r.o.d.u.c.t.V.e.
0x28c87200730069006f006e00000034002e00r.s.i.o.n...4...
0x28d830002e0032003500320038002b0031000...2.5.2.8.+.1.
0x28e861006200360035006200360036006500a.b.6.5.b.6.6.e.
0x28f8370032003600300061006600320032007.2.6.0.a.f.2.2.
0x2908350035003400340039006400350061005.5.4.4.9.d.5.a.
⋯7 more rows

No evidence locations were recorded for this file. Raw result

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.