{ "llm": { "conf": 0.49426877, "grade": "benign", "model": "Qwen/Qwen3.6-27B", "outcome": "benign", "interpretation": "Legitimate NuGet package metadata" }, "ml": { "v": "7", "eng": "2.4.0", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.2094683, "rte": "az", "prob": 0.2094683 } ], "prob": 0.27752683, "skip": [ { "rte": "az/nupkg", "why": "unavailable" }, { "rte": "az/nupkg", "why": "unavailable" } ], "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.2775268256664276, "type": "nupkg" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.000012834866538469214, "type": "xml" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.000011483828529890161, "type": "xml" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.000008761882781982422, "type": "text" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.000012566645636979956, "type": "markdown" }, { "id": 5, "lvl": -1, "conf": 0, "prob": 0.00001428524683433352, "type": "png" }, { "id": 6, "lvl": -1, "conf": 0, "prob": 0.2775268256664276, "type": "pe" }, { "id": 7, "lvl": -1, "conf": 0, "prob": 0.000013142824172973633, "type": "xml" }, { "id": 8, "lvl": -1, "conf": 0, "prob": 0.000012248754501342773, "type": "xml" }, { "id": 9, "lvl": -1, "conf": 0, "prob": 0.000012834866538469214, "type": "xml" }, { "id": 10, "lvl": -1, "conf": 0, "prob": 0.000019609928131103516, "type": "registry" } ], "version": "v18.18", "analyzed_at": "2026-07-28T22:56:28Z" }, "path": "Soenneker.Validators.ZipCode.Exists.4.0.2528.nupkg", "raw": { "files": [ { "id": 0, "ctx": [ { "b": "p!H([6Awak2MTmC@9mIv=YxQS000Df000xb003wDwO=Ave]\u003eJtBcI!YyR\u0026sJmFD!svFm#uv:X{An/FIRWww/HO%bH2Ne7dDde8L+77i.-W0d0g{I/rsVMmW8bn]@+O^AvNi{*ei}KeH8h\u003eGQ4vL)040lGEQDLqh", "n": [ { "c": 2, "d": "Archive contains an executable member", "i": "metadata/file/metrics::archive-contains-executable-member", "o": 0, "z": 31, "cf": 0.949999988079071 } ], "ln": 0 } ], "mol": "H(Cm)Md₂(BiPa)", "sha": "7dd079f752da3042e7ac8a8c58555dce81401adac0a3cc5342d8ec7adbfba036", "path": "Soenneker.Validators.ZipCode.Exists.4.0.2528.nupkg", "risk": 4, "size": 38400, "type": "nupkg", "facts": { "metrics": { "file": { "size": 38400.0, "entropy": 7.93, "size_bytes": 38400.0 }, "binary": { "overall_entropy": 7.93, "peak_region_bytes": 32768.0, "peak_region_entropy": 7.84 }, "archive": { "file_count": 10.0, "member_count": 10.0, "script_count": 0.0, "zip_bomb_ratio": 4.52, "directory_count": 0.0, "executable_count": 1.0, "extra_field_size": 0.0, "noise_file_count": 0.0, "total_compressed": 37032.0, "compression.ratio": 0.73, "hidden_file_count": 2.0, "total_uncompressed": 50549.0, "crc_collision_count": 0.0, "entry_comment_count": 0.0, "max_filename_length": 81.0, "rtlo_filename_count": 0.0, "format.regular_count": 10.0, "nested_archive_count": 0.0, "path_traversal_count": 0.0, "symlink_escape_count": 0.0, "security.setgid_count": 0.0, "security.setuid_count": 0.0, "security.sticky_count": 0.0, "double_extension_count": 0.0, "duplicate_member_count": 0.0, "security.symlink_count": 0.0, "unicode_filename_count": 0.0, "homoglyph_filename_count": 0.0, "security.encrypted_count": 0.0, "timing.mtime_unique_count": 4.0, "timing.mtime_unique_ratio": 0.4, "misplaced_executable_count": 1.0, "timing.mtime_dominant_count": 4.0, "timing.mtime_spread_seconds": 25174.0, "timing.sentinel_mtime_count": 0.0, "security.world_writable_count": 0.0, "timing.mtime_dominant_fraction": 0.4, "compression.method_counts.stored": 1.0, "compression.method_counts.deflate": 9.0 } } }, "ident": { "name": { "value": "Soenneker.Validators.ZipCode.Exists", "source": "nupkg.title", "verified": false }, "urls": [ { "url": "https://github.com/soenneker/soenneker.validators.zipcode.exists", "kind": "homepage", "source": "nupkg.project_url" }, { "url": "https://github.com/soenneker/soenneker.validators.zipcode.exists", "kind": "repository", "source": "nupkg.repository_url" } ], "trust": "unsigned", "authors": [ { "name": "Jake Soenneker", "role": "author", "source": "nupkg.authors" } ], "version": { "value": "4.0.2528", "source": "nupkg.version", "verified": false }, "identifier": { "value": "Soenneker.Validators.ZipCode.Exists", "source": "nupkg.id", "verified": false } }, "traits": [ { "id": "micro-behaviors/communications/http/url/domain::http-url-binary", "atk": "T1071.001", "mbc": "C0002", "conf": 0.699999988079071, "crit": 3, "desc": "Embedded HTTP or WebSocket URL", "from": [ { "file": 6 } ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR header (COM descriptor)" }, { "id": "metadata/package/versioning::pe-internalname-field", "conf": 0.699999988079071, "crit": 3, "desc": "PE version metadata includes InternalName", "from": [ { "file": 6 } ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 3, "desc": "PE version metadata includes FileVersion", "from": [ { "file": 6 } ] }, { "id": "metadata/package/versioning::pe-filedescription-field", "conf": 0.699999988079071, "crit": 3, "desc": "PE version metadata includes FileDescription", "from": [ { "file": 6 } ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET managed assembly", "from": [ { "off": 1580, "file": 6 } ] }, { "id": "metadata/binary/anomaly/provenance::pe-far-future-timestamp", "conf": 0.949999988079071, "crit": 2, "desc": "PE COFF timestamp encodes a future date" }, { "id": "metadata/package/versioning::pe-companyname-field", "conf": 0.699999988079071, "crit": 3, "desc": "PE version metadata includes CompanyName", "from": [ { "file": 6 } ] }, { "id": "metadata/build/reproducible::pe-reproducible-build", "conf": 1.0, "crit": 2, "desc": "Built with /Brepro (deterministic)" }, { "id": "metadata/binary/metrics/entropy::code-entropy-at-most-7-5", "conf": 0.699999988079071, "crit": 1, "desc": "Code entropy is 7.5 or lower", "from": [ { "file": 6 } ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "from": [ { "file": 6 } ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 3, "desc": "PE version metadata includes ProductVersion", "from": [ { "file": 6 } ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET metadata root signature (BSJB)", "from": [ { "file": 6 } ] }, { "id": "metadata/package/versioning::pe-productversion-semver-git-hash", "conf": 0.8999999761581421, "crit": 3, "desc": "PE ProductVersion has SemVer git hash" }, { "id": "metadata/binary/layout::pe-no-signature-record", "conf": 0.949999988079071, "crit": 3, "desc": "PE has no signature record" } ] }, { "depth": 1, "facts": { "metrics": { "file": { "size": 525.0, "entropy": 5.17, "size_bytes": 525.0 }, "binary": { "overall_entropy": 5.17, "peak_region_bytes": 525.0, "peak_region_entropy": 5.17 } } }, "id": 1, "path": "Soenneker.Validators.ZipCode.Exists.4.0.2528.nupkg!!_rels/.rels", "pid": 0, "sha": "e77e6f0b5f43c888279b75c5cb589791330fffebb305aa6c052c6443714b7c90", "size": 525, "type": "xml" }, { "ctx": [ { "b": "[4ls%kx}3YaA?spB7]MgjT8QkfD}SJzEWP}x(mMDb6w0teJs}sj{\u003cz\u003evpK7YxjSigzes9hjTaMYBz%n]flpSpwO\u003e\u003c%e]trjA=l2qw]]Unz/4dDvpK7Yxk8l@fetjogCpBtfk+]NAaJJiCYNytj{\u0026zPjz!UKvpS!*vlL2varR^?x\u003efzaz!i*7wOU\u003c$e((y%x\u003egT]z/P[Kt4}}yz!9Aimr\u0026J/BAoL$x\u003efymarR^HjA+pRB7]Mgj#s(Ce\u00262pti6n\u003cqwPz\u003caz/d-CarR^HjyJwOxM4{jk1Ym0wGT]\u0026wO#x%yH}JGfjx0BxM4{jj{\u0026zParS^.x\u003e7Z(B7DFoD2NsTb4V1rA+frkx(v(kk21QFjtgI+v}xL0wJ*CzarR^?y?Wx\u003czGxw?A+){MBAzFyiXJd5x\u003e7Z(B7GzBzGPP6Bs}GLxd($Jr6h*Ix\u003e7Z(B7Fu(y^5gGarR^?x\u003e870k51IBzz2)Cxfm?Yv@DlG3lQDlauTWQvpTj^k2K*nl}{95zdC:ZA+eV\u0026zdL)rarR^HjAbsVygQ)%rDq[txMOunB2\u003e%cxk8E3BZ=$kz/4dGz!i*7wOU\u003c$flq5yzF\u003c33wPxzDvqGT*vruBdB1R=MAar/%wIdLsx(!xqjtgU]z!-\u0026[Bx9u$j{\u0026zParS^SwPIv4x(Ffdz/d:8aA?gfx\u003egT]x(v(izeS%cy?j-0xK$W?x(mMaw]zYjwQ4{gBy/u1wGU]6axqt.t4}}yz!9B2efG7OwmoN\u003ewftz\u003ex(55qc#0oovrM6[y**^?wHP.{wmY*(A+PGmx(v(M3lQDlauTWQy?m3@wLNe=wPH4nAaAy0wGUI{AaJ]$wO#16ax9h\u0026zF\u003c33wPxz7vqGT*vruBdB1QH4y?WA*Bz(gxBz\u0026oUe?![pgCZd4bqR2cg:$KuA+f5#vrl0Pz//Mij{\u0026zParS^Rz/x#xx\u003eIa3k0%mcD2^RixMLxlSur@IgbyHqfFUKen)#HDax9h\u0026zF\u003c33wPx)^v@DsiA+Pf1BuQ3OarR^?Byw*6k6yvJx\u003egT]z/P[wDtdtdz!9A4wQ4{gBAnNzz/Z2ey-)\u003ewAc0dFx(EN2wmYs%x(!xqC42i3wmoN#AV!\u003cpatdLyBrC7mxKL}2ay]zjzE)]LflySnB3o{NarR^?A+fidB7]-mA^n^HD2NsTb4\u003eRia%q2Gy=@$QBAzFyiXJd0x([3hvLheez7/%GwO#x%yH}JtB8LSczE)P{AXqJzy?WA*Bz(hve{.kJv@C)?e[GowB98EEayYw1zEWuyb64mbB1.irvpTBjzddc@a%pxlzeB0ejT8Q?vM38MhA2b9gbZ*{w?(b0h8EcIwhN!bvMd^Ni51?@f/p}3hF16PffPZ=arR^?wmYZ\u003ezE^r@v}/H}j{\u0026zParR^HjzeXMB-nEBvrc0(BvHpVzdN{fA+^/Zzu", "n": [ { "c": 2, "d": "NuGet nuspec manifest file", "i": "metadata/build/manifest::nuspec-file", "o": 0, "z": 42, "cf": 0.9800000190734863 }, { "c": 2, "d": "NuGet package declares repository", "i": "metadata/package/files/nuget::nuspec-repository", "o": 42, "z": 979, "cf": 0.8999999761581421 } ], "ln": 0, "col": 1, "line": 1 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 1618.0, "entropy": 5.08, "size_bytes": 1618.0 }, "binary": { "overall_entropy": 5.08, "peak_region_bytes": 1618.0, "peak_region_entropy": 5.02 } } }, "id": 2, "path": "Soenneker.Validators.ZipCode.Exists.4.0.2528.nupkg!!Soenneker.Validators.ZipCode.Exists.nuspec", "pid": 0, "risk": 1, "sha": "c7f264ae8219a6839a2a0ba4b8bf5b029adc49d6f165b7338be7b02c7c6c0b42", "size": 1618, "traits": [ { "id": "metadata/package/files/nuget::nuspec-repository", "conf": 0.8999999761581421, "crit": 2, "desc": "NuGet package declares repository", "spans": [ [ 42, 979 ] ] }, { "id": "objectives/command-and-control/dropper/execution/jphp::jphp-http-zip-url", "conf": 0.9399999976158142, "crit": 1, "desc": "JPHP hardcoded HTTP ZIP URL", "spans": [ [ 428, 53 ] ] }, { "id": "metadata/build/manifest::nuspec-file", "conf": 0.9800000190734863, "crit": 2, "desc": "NuGet nuspec manifest file", "spans": [ [ 0, 42 ] ] } ], "type": "xml" }, { "depth": 1, "facts": { "metrics": { "file": { "size": 1076, "entropy": 5.13 }, "binary": { "peak_region_bytes": 1024, "peak_region_entropy": 5.13 } } }, "id": 3, "path": "Soenneker.Validators.ZipCode.Exists.4.0.2528.nupkg!!LICENSE", "pid": 0, "risk": 1, "sha": "f7982c6d623a596f15d5597575e5f6cde25dec380c4fb8da31cd721ea4c088b2", "size": 1076, "traits": [ { "id": "metadata/permission/prose::permission-permission-term-english", "conf": 0.9, "crit": 2, "desc": "Permission or access term", "spans": [ [ 53, 0 ] ] } ], "type": "text" }, { "id": 4, "sha": "f5d180476447034b66cf579939fcf09bb5bfaf575672cc2c1a0f74326ddfe5ef", "path": "Soenneker.Validators.ZipCode.Exists.4.0.2528.nupkg!!README.md", "size": 1150, "type": "markdown", "depth": 1 }, { "id": 5, "sha": "93511e8937b27717eb154ee90eaf1655d4dbbad2865ecfc5a7d0bd794c945c49", "path": "Soenneker.Validators.ZipCode.Exists.4.0.2528.nupkg!!icon.png", "size": 16083, "type": "png", "depth": 1 }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J\u0026m(0ji6Sa?dLD+]{51x(+zoA=kPhvqNb%vqY$3BrC47aAzQxazCZol@c-7zeS@@e!5l%bME/A00000p^\u003eu:oAtj", "n": [ { "c": 2, "d": "PE contains exactly one resource entry", "i": "metadata/binary/resource::pe-single-version-resource", "o": 0, "z": 24, "cf": 1.0 } ], "ln": 0 }, { "b": "000000000000000kMy^J00000000000000000000)MQWK00000nb@R\u00260SSx7ef\u003eh}LO%J40rr91000000000000000000000000000000000000000000000000000000000000000009S^-c000uQ9S^-c000uQ9S*V?000cKiSZYE000uc1apgI00B^W0S%??000uc1BQvL00AubEfoJI1oFV71{L5c26gZ-019=!000vO0SSi6dGxCG6efE/kl7V-0rr9i5=:s2000vO1][Sa5=.#Y2lj-b5=-2Z2MK\u0026c5=-U{1POJ95=^p-000cm04m\u003cF04OVZD\u003cfMJ1sLt(017gQ6efE/m/SI?0SSij5=:s5000vO3\u0026*ng5=.#Y4GDFi5=-2Z4fcwh5=-5.4/=Oj5=-U{3JHef5=^p/000cm04m)G04OVZD\u003c/#P1sLC]017hh0^:$G00Ei+000uQg6h!7000dubME/KdOo:\u003cb(^]Lc)!]]3mC#R04Oa2n=*y?000uOdf6tPc\u003cfIId/}g28..G%iro9W0@@rk0^+7J00ASgDJ%JJ1pCz+s{t^8+M4Ry2yuNN00Ery003%tDK6PK1Ab^\u003c017aT001I.1RH$!eDt+T69F{Jc[UG13n1KB79%ro1POJ90UCM-2(\u003c@d0^\u003egL00A]q0W[lM04V)I00002DKfVL1qp[tD\u003cG=M1Pxbu000@t6^Tin1POJ95^fQp000un2yuKM00APRf-RgX7z^\u003e?DK6PK1Ac3}017aV", "n": [ { "c": 1, "d": "No section reaches compression-grade entropy", "i": "metadata/binary/metrics/threshold::no-compression-grade-section", "o": 512, "z": 512, "cf": 0.8999999761581421 } ], "ln": 480 }, { "b": "0^\u003eyR00AMQlJv8[dGxCG0t2kh000Ge^CB{wdf6tGhuFmm000c7c}14n3mV2Qlq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn2NyzgbyPQ)Bo?\u003cDD\u003cY]Obu5Y8x(mN800000[dL^4V\u0026y7abumUxQ.A!e5c8Xgbs+:9l\u0026Wh!V\u003eJGu?#%8X", "n": [ { "c": 2, "d": ".NET metadata root signature (BSJB)", "i": "metadata/binary/framework::dotnet-metadata", "o": 1580, "z": 4, "cf": 1.0 } ], "ln": 1532 }, { "b": "A^o@Ywk=#RAaJLWl1BH}x(4uXBzkLSB5MN!AaJLWl1BI7wPI^jA:@W4p*[DVrDI}\u003el32$mz/xn#06$dat4}}yz!9AFCXIkvB5(Z=x\u003egT]z/Oc+q!6-+wN\u003e^bCvticrC(\u003e^w[s:", "n": [ { "c": 1, "d": "Crypter AddResource token", "i": "objectives/command-and-control/dropper/builder::dotnet-crypter-add-resource", "o": 4045, "z": 11, "cf": 0.8799999952316284 } ], "ln": 4013 }, { "b": "A:@W4p*[DVrDI}\u003e08)/EzF\u003c33wPxz7vqGT*vruBdB1QTgA6[LOwIcz@x(!xqe[w^m08[e:By/p?lT:\u003exwO=f\u003eBzkVhrbVL-zuafPzEWl]y*?B1z/eJ)yH}w-Bz\u003e@azu9QSA+PA7mr\u0026]=zGxJgzu9ZCy\u0026%q*vrliMCYWImB7]Mg08mfqA=l2qw]]T]CYWImB7]MgB1P\u003c(AaJ]$wO#16nP5oOv@#B6zu9QXB97#ge(Dm)y?m9#x(v\u003e?nMfhvC4\u003eC$lVl^SwN/*@z/bLNwPQv=v}xR3x(v\u003e?q/uk+zE)P{AXpvlx(4\u0026yl34r?v]E8Vxkzd3z/bLOA^o@Ywk^hWxkzd3z/bLvwmOezy?lQ*x(37Rq!ZbZy?mZbzu8$kwkV#Wz/{8gwPHWRBzaV@x(37Rq!ZbZy?mZbzu8$kwlJX^lVlHDmr\u0026J/BApF\u003ey?WA*Bz(g=B5M^\u003cxkzd3z/bLAx(4uXBn", "n": [ { "c": 2, "d": ".NET System.Reflection namespace reference", "i": "metadata/lang/compiler/managed::reflection-namespace", "o": 5424, "z": 17, "cf": 0.699999988079071 }, { "c": 2, "d": ".dll extension reference", "i": "micro-behaviors/fs/path/extension::dll-dup", "o": 5294, "z": 4, "cf": 0.5 }, { "c": 1, "d": "Crypter AddResource token", "i": "objectives/command-and-control/dropper/builder::dotnet-crypter-add-resource", "o": 5544, "z": 11, "cf": 0.8799999952316284 } ], "ln": 5246 }, { "b": "x\u003egT]z/L?Hr://UwmoN#ASwWmx(DBTwmXhOx(!xqr://UwmoN#ASv.4Bz(g1q*ACawO\u003c4/x\u003c\u003eT(z/Z2mv@?SGD2[7sz7X.ezGGPfwIct*ze:i9wPyZXA=#ebwPE\u0026)wPz%dv}xYYq/uk+zE)P{AXpvlx(4\u0026yp*[DVB1Qv4B8Mhwv}xYYl$G?Ixj\u003e{@xh9qPwPE\u0026Iz!i*7wOR", "n": [ { "c": 2, "d": ".NET System.Diagnostics namespace reference", "i": "metadata/lang/compiler/managed::diagnostics-namespace", "o": 5854, "z": 18, "cf": 0.75 } ], "ln": 5806 }, { "b": "Dtds=z!9B2q!p4Jm}D^uwPJ0gBo2lJBw=W\u003eB.(d1q/(C*Bo23NC4BAWCYS{KA=LPl07y:zBA)\u0026^8f#o%0b}{F0b?\u003cF0a=dK04[m[0c!G=004Lms]-mpz#-l9zVBqFwD", "n": [ { "c": 1, "d": "Bare Start member-name string", "i": "micro-behaviors/process/create/spawn::process-start-member-token", "o": 6657, "z": 5, "cf": 0.7799999713897705 } ], "ln": 6625 }, { "b": "e(1\u0026mlVm0Rl2Z=]r+lq)x(v(LB$\u003eW6fAzeM4IRxMvqPO1z/PRYx(!lfvr\u003eQRzdK2apdnb8f!+jl8ux*MxMOunB2\u003e%cB8LSczE)P{AXp\u003cuz2:LA0rrv5wO+{^B7CsKdGGI}lVl{?A+Pf1BrFD1atLSagC7vogbZmEvqxA%q/uk+zE)P{ASu8A0rug!aA?gfx\u003egT]x(v(izeS%cy?j-0xK$W?x(mMaw]zYjwQ4{gBy/u1wGU]6axqt.t4}}yz!9B2efG7OwmoN\u003ewb", "n": [ { "c": 3, "d": "Embedded HTTP or WebSocket URL", "i": "micro-behaviors/communications/http/url/domain::http-url-binary", "o": 7718, "z": 21, "cf": 0.699999988079071 }, { "c": 2, "d": "Copyright notice", "i": "metadata/package/license::copyright-word", "o": 7758, "z": 9, "cf": 0.6000000238418579 } ], "ln": 7654 }, { "b": "x(DBTwmWwZCXIkvA@Vhs0rrNbwPhNex([olC#X)3kXLmYAc15[fk20vxMW=pv@DiqB8LSczE)P{AXzGLwO#x%yH}JsC42i3wmoN#A=S\u003cVx(EN2wmWx8CXIkvA@Vgz0rrc209og3qD4HBzF\u003c33wPxz7vqGT*vruBdB1QTgA6[LOwIcz@x(!xqe)q$dlJ", "n": [ { "c": 1, "d": "JPHP hardcoded HTTP ZIP URL", "i": "objectives/command-and-control/dropper/execution/jphp::jphp-http-zip-url", "o": 8019, "z": 53, "cf": 0.9399999976158142 } ], "ln": 7987 }, { "b": "0000000000000000000000000000000000000000000000000000000000315c8Xg7YTL^000000000000000000310rr91fAq960000000000000000003100000nb@R\u0026syqae9T8Jz00000000009Taw200341qVHe8rSCL*qufR}nDqJ^p5[S3nDqG=mGui:00000Y-^*600031000c4007{-000c4007{-kl7V-000001onA40SSi2000000000000000l\u0026Wh!0rud2ve$rFmGvc5yYF2DnDrSdw=", "n": [ { "c": 2, "d": "PE version resource metadata", "i": "metadata/package/versioning::version-resource-metadata", "o": 9310, "z": 15, "cf": 0.8999999761581421 }, { "c": 1, "d": "PE resource section", "i": "metadata/binary/section/names::pe-resource-section", "o": 9216, "z": 5, "cf": 0.8999999761581421 } ], "ln": 9184 }, { "b": "003g900031fAr^bfAr^bfAr{fvGn7Z0077uso5v4lJz38z2!zMwDlPFBo3vZ002p+aolM+ve$9zx-IVzve$xHx-J5Kzu7^Vz2!FOwb{-LyYF2Daok)KxAhPzv/QoAx-J2J", "n": [ { "c": 1, "d": "Several short title-cased resource strings", "i": "metadata/binary/resource::short-titlecase-resource-words", "o": 9530, "z": 8, "cf": 0.800000011920929 } ], "ln": 9498 }, { "b": "BPuvXwb{3rBo2\u003eLwb).Lwb{3rx-I@HC(O@!c\u0026^@Yw=J}Nve$DJve$0wyYE(zvGpiAwDjdV002W)761vnlJz38z2!IPve$fBC(QOtve$cAwDhYg003WjBo3y.z#:}ViSH/kf934[zVBtGzuaLOwDlGCwDl-Je=YwYzVBRO003%rbME\u0026BmGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up002{$zVBtGzuaLOwDlGCwDl-Je=X]Lve$9zx-IVzve$xHzVB!TA@W/)s]-mpz#-l9zVBqFwDjs.mf4Mjx-JhOBo3vZ001[S3JHhcmGvc5yYF2DrSDXhASydXx-J5Kzu6Up001?Qe=WN9e=WTbh2]xih#\u003eMhfAq7M003%rc\u0026:nFnDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE002{$zVBtGzuaLOwDlGCwDl-Je=X]Lve$9zx-IVzve$xHzVB!TA@W/)s]-mpz#-l9zVBqFwDjs.mf4Mjx-JhOBo3vZe=YzZyYFnK003)pb(^@CoAnS7x8(uuyYD*5zVB.RC(R\u003c+x-I=CxAibO002v^zVB.RC(R\u003c+x-I=CxAibOaonwvaojd%fAr\u003cdgxo0bg5%0dg5%ijaok1lve$6ywDi?MqVH.owDlPFzuakFyxd]CASu7t004lzc\u0026:nFpxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE002{$zVBtGzuaLOwDlGCwDl-Je=X]Lve$9zx-IVzve$xHzVB!TA@W/)s]-mpz#-l9zVBqFwDjs.mf4Mjx-JhOBo3vZe=YzZyYFnK", "n": [ { "c": 3, "d": "PE version metadata includes CompanyName", "i": "metadata/package/versioning::pe-companyname-field", "o": 9730, "z": 11, "cf": 0.699999988079071 }, { "c": 3, "d": "PE version metadata includes FileDescription", "i": "metadata/package/versioning::pe-filedescription-field", "o": 9806, "z": 15, "cf": 0.699999988079071 }, { "c": 3, "d": "PE version metadata includes FileVersion", "i": "metadata/package/versioning::pe-fileversion-field", "o": 9918, "z": 11, "cf": 0.699999988079071 }, { "c": 3, "d": "PE version metadata includes InternalName", "i": "metadata/package/versioning::pe-internalname-field", "o": 9974, "z": 12, "cf": 0.699999988079071 }, { "c": 2, "d": "PE OriginalFilename metadata field", "i": "metadata/package/versioning::pe-originalfilename-field", "o": 10198, "z": 16, "cf": 0.699999988079071 }, { "c": 1, "d": "PE version company name populated", "i": "metadata/package/versioning::pe-company-name-populated", "o": 9756, "z": 21, "cf": 0.8500000238418579 }, { "c": 1, "d": "PE FileDescription field is populated", "i": "metadata/package/versioning::pe-file-description-present", "o": 9840, "z": 35, "cf": 0.949999988079071 }, { "c": 1, "d": "PE LegalCopyright field is populated", "i": "metadata/package/versioning::pe-legal-copyright-present", "o": 10116, "z": 37, "cf": 0.949999988079071 }, { "c": 1, "d": "PE FileVersion value is present", "i": "metadata/package/versioning::version-info-file-version-present", "o": 9944, "z": 10, "cf": 0.949999988079071 } ], "ln": 9666 }, { "b": "xAfpT0rt{@ASy1Twb{-Lv/QPJp5[Y5z2!bE00000qVH.owDlPFzuakFyxd]CASvY(rSDLdyYFeHwb{3rBo3jVASydXe=Y5Px-J8LlJz38wb{fve=XruCMqBTA@ZpZA@VguHYxgg0rt{@ASy1Twb{-Lv/QPJrSDXhASydXx-J5Kzu6UpgYPcdfArZ9g5%fig5%old/.p7ve%:phukPmvGnp^hump*hVLPkhukAhve%)tg5%6fh2]GlgYPujiriN\u0026h2}4+wDlfthVNs/gYPGnfAtO.fAr*ch2]Powb[H/wDhYgj]+@\u003c0rty=A@ZmYwDlMEvGpiAC(O@!rSDXhASydXx-J5Kzu6UpgYPcdfArZ9g5%fig5%ole=WN900000000000000000000000", "n": [ { "c": 3, "d": "PE version metadata includes ProductVersion", "i": "metadata/package/versioning::pe-productversion-field", "o": 10422, "z": 14, "cf": 0.699999988079071 }, { "c": 3, "d": "PE ProductVersion has SemVer git hash", "i": "metadata/package/versioning::pe-productversion-semver-git-hash", "o": 10452, "z": 49, "cf": 0.8999999761581421 }, { "c": 1, "d": "Several short title-cased resource strings", "i": "metadata/binary/resource::short-titlecase-resource-words", "o": 10558, "z": 8, "cf": 0.800000011920929 }, { "c": 1, "d": "PE ProductName field is populated", "i": "metadata/package/versioning::pe-product-name-present", "o": 10344, "z": 35, "cf": 0.949999988079071 } ], "ln": 10312 }, { "b": "00000000000000000000000000000000000000000000000000000000000006*I:3\u0026*nc5hj7:00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", "n": [ { "c": 2, "d": "PE .reloc section presence", "i": "metadata/binary/section/names::reloc-section-presence", "o": 10752, "z": 6, "cf": 0.8999999761581421 } ], "ln": 10704 } ], "depth": 1, "facts": { "imp": [ [ "mscoree", "CorDllMain" ] ], "sec": [ [ ".text", 512, 8704, 5.56, "r-x" ], [ ".rsrc", 9216, 1536, 3.19, "r--" ], [ ".reloc", 10752, 512, 0.08, "r--" ] ], "metrics": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "clr.is_il_only": 1.0, "resource_count": 1.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 17918.0, "reloc_overhang_bytes": 500.0, "reloc_overhang_ratio": 0.98, "clr.is_32bit_required": 0.0, "bss_like_section_count": 0.0, "clr.is_32bit_preferred": 0.0, "clr.strong_name_signed": 0.0, "section_overflow_count": 0.0, "clr.is_native_entrypoint": 0.0, "misaligned_section_count": 0.0, "version.identity_entropy": 4.25, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0, "version.identity_symbol_ratio": 0.11 }, "file": { "size": 11264.0, "entropy": 5.04, "size_bytes": 11264.0 }, "binary": { "is_pie": 1.0, "code_entropy": 5.56, "string_count": 179.0, "overall_entropy": 5.04, "entropy_variance": 5.03, "avg_string_length": 22.26, "max_string_length": 102.0, "peak_region_bytes": 1024.0, "code_to_data_ratio": 1.0, "peak_region_entropy": 5.88, "string_length_stddev": 16.57, "largest_section_ratio": 0.77, "sentence_string_count": 6.0, "sentence_string_ratio": 0.03, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 8704.0, "entropy_max": 5.56, "entropy_mean": 2.94, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } } }, "id": 6, "mol": "H(Cm)Md₂(BiPa)", "path": "Soenneker.Validators.ZipCode.Exists.4.0.2528.nupkg!!lib/net10.0/Soenneker.Validators.ZipCode.Exists.dll", "pid": 0, "risk": 4, "sha": "af3756af7a1c50d564acb27713cc2476f3fe542fd70df22aa05d4ddd01194cdf", "size": 11264, "traits": [ { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET metadata root signature (BSJB)", "spans": [ [ 1580, 4 ] ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR header (COM descriptor)" }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 9310, 15 ] ] }, { "id": "metadata/build/reproducible::pe-reproducible-build", "conf": 1.0, "crit": 2, "desc": "Built with /Brepro (deterministic)" }, { "id": "metadata/binary/metrics/entropy::code-entropy-at-most-7-5", "conf": 0.699999988079071, "crit": 1, "desc": "Code entropy is 7.5 or lower", "spans": [ [ 0, 26 ] ] }, { "id": "metadata/package/versioning::pe-internalname-field", "conf": 0.699999988079071, "crit": 3, "desc": "PE version metadata includes InternalName", "spans": [ [ 9974, 12 ] ] }, { "id": "metadata/package/versioning::pe-filedescription-field", "conf": 0.699999988079071, "crit": 3, "desc": "PE version metadata includes FileDescription", "spans": [ [ 9806, 15 ] ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 3, "desc": "PE version metadata includes ProductVersion", "spans": [ [ 10422, 14 ] ] }, { "id": "metadata/package/versioning::pe-productversion-semver-git-hash", "conf": 0.8999999761581421, "crit": 3, "desc": "PE ProductVersion has SemVer git hash", "spans": [ [ 10452, 49 ] ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 3, "desc": "PE version metadata includes FileVersion", "spans": [ [ 9918, 11 ] ] }, { "id": "metadata/package/versioning::pe-companyname-field", "conf": 0.699999988079071, "crit": 3, "desc": "PE version metadata includes CompanyName", "spans": [ [ 9730, 11 ] ] }, { "id": "metadata/binary/layout::pe-no-signature-record", "conf": 0.949999988079071, "crit": 3, "desc": "PE has no signature record" }, { "id": "micro-behaviors/communications/http/url/domain::http-url-binary", "atk": "T1071.001", "mbc": "C0002", "conf": 0.699999988079071, "crit": 3, "desc": "Embedded HTTP or WebSocket URL", "spans": [ [ 7718, 21 ] ] }, { "id": "metadata/binary/anomaly/provenance::pe-far-future-timestamp", "conf": 0.949999988079071, "crit": 2, "desc": "PE COFF timestamp encodes a future date" }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET managed assembly", "spans": [ [ 1580, 4 ] ] } ], "type": "pe" }, { "id": 7, "sha": "c0638ccf1cbc51a041ca4cc9d5494e93c17497fc02bf4b942599da1015bb078e", "path": "Soenneker.Validators.ZipCode.Exists.4.0.2528.nupkg!!lib/net10.0/Soenneker.Validators.ZipCode.Exists.xml", "size": 4347, "type": "xml", "depth": 1 }, { "id": 8, "sha": "63feef730c8c6225c83eeeb608a1575fcac22006897782d889c10c4310523657", "path": "Soenneker.Validators.ZipCode.Exists.4.0.2528.nupkg!![Content_Types].xml", "size": 712, "type": "xml", "depth": 1 }, { "id": 9, "sha": "016aca8764cb8ad364bf6c973dccad4d32b8670510eed55833d4a0a487a6f32d", "path": "Soenneker.Validators.ZipCode.Exists.4.0.2528.nupkg!!package/services/metadata/core-properties/7a8204eb535a4b7a94c49bcd424cf137.psmdcp", "size": 790, "type": "xml", "depth": 1 }, { "id": 10, "mol": "Md", "sha": "7e55f9db5adce5f3915f28f985e54636407940832e25b520c228969cf1efad25", "path": "Soenneker.Validators.ZipCode.Exists@4.0.2528.registry.json", "risk": 1, "size": 1035, "type": "registry", "depth": 1 } ], "omitted_files": 6, "v": "8" } }