{ "ml": { "v": "7", "eng": "2.2.0-rc.1", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.0015178522, "rte": "az", "prob": 0.0015178522 } ], "prob": 0.0015178522, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.0015178521862253547, "type": "nupkg" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.000010261933311994653, "type": "xml" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.00004094839096069336, "type": "xml" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.0005999009008519351, "type": "pe" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.000008692343726579566, "type": "markdown" }, { "id": 5, "lvl": -1, "conf": 0, "prob": 0.00000961621572059812, "type": "xml" }, { "id": 6, "lvl": -1, "conf": 0, "prob": 0.00001095732022804441, "type": "xml" }, { "id": 7, "lvl": -1, "conf": 0, "prob": 0.00001085797975974856, "type": "registry" } ], "version": "v18.18", "analyzed_at": "2026-06-28T22:04:30Z" }, "path": "Franz.Common.Messaging.Kafka.2.2.10.nupkg", "raw": { "files": [ { "id": 0, "mol": "O(Al)H₂(CmDb)", "sha": "8f9c5b99e534fae118ee5ece64e2333e90ff6ec043b819a1c9f5f81d868e1df4", "path": "Franz.Common.Messaging.Kafka.2.2.10.nupkg", "risk": 3, "size": 48371, "type": "nupkg", "facts": { "metrics": { "file": { "size": 48371.0, "entropy": 7.95, "size_bytes": 48371.0 }, "binary": { "overall_entropy": 7.95, "peak_region_bytes": 46080.0, "peak_region_entropy": 7.8 }, "archive": { "file_count": 7.0, "member_count": 7.0, "script_count": 0.0, "zip_bomb_ratio": 2.51, "directory_count": 0.0, "executable_count": 1.0, "extra_field_size": 0.0, "noise_file_count": 0.0, "total_compressed": 47391.0, "compression.ratio": 0.51, "hidden_file_count": 2.0, "total_uncompressed": 92037.0, "crc_collision_count": 0.0, "entry_comment_count": 0.0, "max_filename_length": 81.0, "rtlo_filename_count": 0.0, "format.regular_count": 7.0, "nested_archive_count": 0.0, "path_traversal_count": 0.0, "symlink_escape_count": 0.0, "security.setgid_count": 0.0, "security.setuid_count": 0.0, "security.sticky_count": 0.0, "double_extension_count": 0.0, "duplicate_member_count": 0.0, "security.symlink_count": 0.0, "unicode_filename_count": 0.0, "homoglyph_filename_count": 0.0, "security.encrypted_count": 0.0, "timing.mtime_unique_count": 4.0, "timing.mtime_unique_ratio": 0.57, "misplaced_executable_count": 1.0, "timing.mtime_outlier_count": 3.0, "timing.mtime_dominant_count": 4.0, "timing.mtime_spread_seconds": 25008.0, "timing.sentinel_mtime_count": 0.0, "security.world_writable_count": 0.0, "timing.mtime_dominant_fraction": 0.57, "compression.method_counts.stored": 1.0, "compression.method_counts.deflate": 6.0 } } }, "ident": { "name": { "value": "Franz.Common.Messaging.Kafka", "source": "nupkg.title", "verified": false }, "urls": [ { "url": "https://github.com/bestacio89/Franz.Common", "kind": "repository", "source": "nupkg.repository_url" } ], "trust": "unsigned", "authors": [ { "name": "Bernardo Estacio Abreu", "role": "author", "source": "nupkg.authors" } ], "version": { "value": "2.2.10", "source": "nupkg.version", "verified": false }, "identifier": { "value": "Franz.Common.Messaging.Kafka", "source": "nupkg.id", "verified": false } }, "traits": [ { "id": "micro-behaviors/communications/http/websocket::websocket-send-async", "atk": "T1071.001", "mbc": "C0002", "conf": 0.8199999928474426, "crit": 3, "desc": "WebSocket async send method", "from": [ { "file": 3 } ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "from": [ { "file": 3 } ] }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "from": [ { "file": 3 } ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "metadata/package/versioning::version-word-lower", "conf": 0.4000000059604645, "crit": 2, "desc": "version word (lowercase)", "from": [ { "file": 3 } ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/data/db/linq::linq-queries", "conf": 0.699999988079071, "crit": 3, "desc": "LINQ query operations", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "from": [ { "file": 3 } ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "from": [ { "file": 3 } ] }, { "id": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "conf": 1.0, "crit": 3, "desc": "JSON polymorphism runtime marker", "from": [ { "file": 3 } ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "from": [ { "file": 3 } ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "from": [ { "file": 3 } ] } ] }, { "depth": 1, "facts": { "metrics": { "file": { "size": 518.0, "entropy": 5.18, "size_bytes": 518.0 }, "binary": { "overall_entropy": 5.18, "peak_region_bytes": 518.0, "peak_region_entropy": 5.18 } } }, "id": 1, "path": "Franz.Common.Messaging.Kafka.2.2.10.nupkg!!_rels/.rels", "sha": "11c987d3c10a9b3805f67902a6bc887ec79bda388cc4074058bdf80cd6d5bd70", "size": 518, "type": "xml" }, { "ctx": [ { "b": "[4ls%kx}3YaA?spB7]MgjT8QkfD}SJzEWP}x(mMDb6w0teJs}sj]", "n": [ { "c": 2, "d": "NuGet nuspec manifest file", "i": "metadata/build/manifest::nuspec-file", "o": 0, "z": 35, "cf": 0.9800000190734863 } ], "ln": 1, "addr": 0 }, { "b": "jAa.syHH\u003c!aB4:tzGv@+xMOuniXJdcv}YB\u003cvrj5rx\u003e8g4B8LVje[n*pfk$ufyHH\u003c\u0026zF7QTfFLvpfF$I3B-RIkv\u003eJ1EwfKh", "ln": 2, "addr": 42 }, { "b": "arS^-wPRu\u003evrt{w", "ln": 3, "addr": 118 }, { "b": "arR^Hjy-qGD2^RixMMB9z/x#xx\u003eIa3asH.GatLSah6tj%A=brawn-OVB97\u00262x(taWvSD45jtgh.AcVFrxj#xJ", "ln": 11, "addr": 464 }, { "b": "arR^HjAL1AB3r6lvqZxllVl*Uz/cW$BzkM9BzkrcawDATx\u003c(a4AV!1-w[$/$qEK3zx()6DavQD+zGGGky-(C^v@=HewPz%dv}xZzflySnB3o", "ln": 12, "addr": 533 }, { "b": "arR^HjAt1Lz/YSmz/QaCBA}?pjTaJMBrR\u0026IA+)(.xMOunB2\u003e%cxk8E3BZ=$kz/4dpwPI%4v}/\u003cviwi\u003cxvqZxzlVl*Uz/c:wvSC){v}X1Hzddc@a%pxlzeB0ejTaq\u003ew?)?awN)LIh-0g0w?=q7wmmnMgbSPMfG9w]fF+H]i5ilAh8co$ffP", "n": [ { "c": 2, "d": "NuGet package declares repository", "i": "metadata/package/files/nuget::nuspec-repository", "o": 624, "z": 93, "cf": 0.8999999761581421 } ], "ln": 13, "addr": 620 }, { "b": "arR^Hjy\u00262xwO#3\u0026zEWx(B3o", "n": [ { "c": 2, "d": "NuGet package declares dependencies", "i": "metadata/package/files/nuget::nuspec-dependencies", "o": 767, "z": 545, "cf": 0.8999999761581421 } ], "ln": 14, "addr": 763 }, { "b": "arR^HarS^VA=l8taAR4jxjVfOA:-/@Cw?IqjTa=PBtkE4fD@W", "ln": 15, "addr": 782 }, { "b": "arR^HarR^Hjy\u00262xwO#3\u0026zEW@mx\u003efvJmSI{PDm?N6zeBiee\u003cTw)z//Afx(v)ga%q5uA=U@kzAPg0e\u002624lfD}SJCW\u003eMjwmW[FluN0UwgQ2:vqHjnwPz\u0026oatk[", "ln": 16, "addr": 822 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 1436.0, "entropy": 5.08, "size_bytes": 1436.0 }, "binary": { "overall_entropy": 5.08, "peak_region_bytes": 1436.0, "peak_region_entropy": 5.11 } } }, "id": 2, "path": "Franz.Common.Messaging.Kafka.2.2.10.nupkg!!Franz.Common.Messaging.Kafka.nuspec", "risk": 1, "sha": "e18f5eee6011e30fc293fa7b779031c51fe4d3b866bb1d627fd293bd95359e49", "size": 1436, "traits": [ { "id": "metadata/package/files/nuget::nuspec-dependencies", "conf": 0.8999999761581421, "crit": 2, "desc": "NuGet package declares dependencies", "spans": [ [ 767, 545 ] ] }, { "id": "metadata/build/manifest::nuspec-file", "conf": 0.9800000190734863, "crit": 2, "desc": "NuGet nuspec manifest file", "spans": [ [ 0, 35 ] ] }, { "id": "metadata/package/files/nuget::nuspec-repository", "conf": 0.8999999761581421, "crit": 2, "desc": "NuGet package declares repository", "spans": [ [ 624, 93 ] ] } ], "type": "xml" }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J\u0026m(", "n": [ { "c": 3, "d": "HTTP fingerprinting evasion campaign", "i": "objectives/command-and-control/infrastructure/user-agent::http-fingerprinting-campaign", "o": 0, "z": 34, "cf": 0.8999999761581421 } ], "ln": 0 }, { "b": "00000000000000000000EiX*[00000nb@R\u00260SSx7Fn1#-:HIoJ0rr91000000000000", "n": [ { "c": 1, "d": "PE standard code/data section", "i": "metadata/binary/section/names::pe-code-data-standard-section", "o": 512, "z": 5, "cf": 0.8999999761581421 } ], "ln": 496 }, { "b": "huFp0000c7d9.?[3mV2Qlq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn", "n": [ { "c": 3, "d": "Recognized PE anti-analysis marker", "i": "objectives/anti-analysis/debugger-detect/combined-checks::evasion-aware-recognized-pe-marker", "o": 19328, "z": 4, "cf": 1.0 } ], "ln": 19312 }, { "b": "nPNsBBy/uhx(v(Svrt]Tq*ACawO\u003c50wQ5qHn][]*e(Mt4x\u003c\u003e*(Dsp]fz/dg4wPRu\u003evrt]To\u003ewx!vp%dC", "n": [ { "c": 3, "d": "JSON polymorphism runtime marker", "i": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "o": 42053, "z": 16, "cf": 1.0 } ], "ln": 42037 }, { "b": "zGx@vwMiO!x\u003e6CID2v9(q!o\u0026Sl34r?v/PtCz!a02wKgx.zESVmx(!liB7ETUD2v9(lVl*XyY", "n": [ { "c": 3, "d": "WebSocket async send method", "i": "micro-behaviors/communications/http/websocket::websocket-send-async", "o": 42276, "z": 9, "cf": 0.8199999928474426 } ], "ln": 42260 }, { "b": "e\u003e][#B75Y}zF7N{vp\u003cp-e[w^m090SLz*a=+piyw?0b2\u003e+uSgJCB-IhrC#eK1Bz\u003eVc", "n": [ { "c": 3, "d": "References Windows executable or script", "i": "objectives/execution/interpreter/script/shell::windows-executable-ref", "o": 47539, "z": 4, "cf": 0.6000000238418579 } ], "ln": 47523 }, { "b": "lVl\u003cOy\u0026%rbBs{i{w[$*cl1B?Dzu8$kwj{uyyHGItze0\u003e/o\u003c@0dz/6DlwPI{bz/bLOzV", "n": [ { "c": 2, "d": "admin keyword", "i": "objectives/discovery/account/keywords::admin-keyword", "o": 47925, "z": 5, "cf": 0.20000000298023224 } ], "ln": 47909 }, { "b": "xd^a]A+O@#x)Kifx(v\u003e?q*ACawO\u003c50wQ5qHn][]*e(Mt4x\u003c\u003e*(Dsp]fz/bLvv@#B6zu9m5wPI{3xk8l@", "n": [ { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 48269, "z": 16, "cf": 0.8500000238418579 } ], "ln": 48253 }, { "b": "zE^r@v%HT-ygQ)%x(v\u003e?q*ACawO\u003c4$wOb:\u0026v@#B6zu9dDvqZxzlVl*Uz/dg9wOb:\u0026v@#B6zu9mbwPz%dv/", "n": [ { "c": 2, "d": "Benign high-entropy PE context", "i": "metadata/package/quality/false-positives::benign-high-entropy-pe-context", "o": 48470, "z": 17, "cf": 0.949999988079071 } ], "ln": 48454 }, { "b": "z/bLAA:-\u003cie\u003c\u003cL]zeTp(q*ACawO\u003c50wQ5qHn][]*0b2\u003e+uS7DzB8L{@q/)4]zF8sPze-{7x(!ig0buN[", "n": [ { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 48789, "z": 16, "cf": 0.8500000238418579 } ], "ln": 48773 }, { "b": "D2Ns^zF0!!xkzG}vqE$=q*ACawO\u003c50wQ5qHn][]*e(Mt4x\u003c\u003e*(Dsp]fz/dg4wPRu\u003evrt{gnLj5xzD7[2", "n": [ { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 48919, "z": 16, "cf": 0.8500000238418579 } ], "ln": 48903 }, { "b": "yHGOGzGx@qwPypYz/{10q*ACawO\u003c4[x(m[\u003crbUYSA+PA7l2Hj2y?m3}0b2\u003e+uR\u003e=Ywozx[ASyd", "n": [ { "c": 3, "d": "LINQ query operations", "i": "micro-behaviors/data/db/linq::linq-queries", "o": 49184, "z": 11, "cf": 0.699999988079071 } ], "ln": 49168 }, { "b": "zdMBWwmYNNA=lbnwmY=YnKEAlzE)s1x(v(=A=lbnwmY=YojqBFvma%JB9hthA.{^{C4\u003eF#ASwV#z/fD7v@#B6zBO5ABz(hBp\u0026ZF$x\u003eg^}0afkOzF\u003c2}BzkVhmQY!Gz/Qb1A=lbnwmY=Yl34r?", "n": [ { "c": 1, "d": "Regex component marker", "i": "objectives/persistence/login/scheduled-task/com::task-scheduler-builder-methods--rx-1", "o": 49363, "z": 19, "cf": 0.8999999761581421 } ], "ln": 49347 }, { "b": "vruj8BzklanmuyDy?mR!q*ACawO\u003c4!z!9AEz/49]z/6Dcy?mR!m}D^hzGGPmC$}^+wKZYUz9@kVBAhqoy?mR!rbVZ", "n": [ { "c": 3, "d": ".NET dynamic code generation capability", "i": "metadata/lang/compiler/managed::dotnet-dynamic-code", "o": 49961, "z": 23, "cf": 0.8500000238418579 } ], "ln": 49945 }, { "b": "By/qwlVl^SwN/*@z/fQ@mSI{PDm?N6zeBiee\u003e][#B75Y}zF7N{vp\u003cp-e\u003c\u003cL{zE)s1x(v)g0cqZ[uRU-Xp*[x^x([6czGt!Lx\u003e8g4B8LVje\u003e72b", "n": [ { "c": 1, "d": "Regex component marker", "i": "objectives/persistence/login/scheduled-task/com::task-scheduler-builder-methods--rx-1", "o": 53419, "z": 40, "cf": 0.8999999761581421 } ], "ln": 53403 }, { "b": "0rrv5wO+{^B7CsKe=+@3lVl{?A+Pf1Brz#wdiHx1gbQgvwPzV%A+68hmrrMVv}/\u003c7l1j\u003eCBP", "n": [ { "c": 2, "d": "Copyright notice", "i": "metadata/package/license::copyright-word", "o": 65196, "z": 9, "cf": 0.6000000238418579 } ], "ln": 65180 }, { "b": "wKgx.zEU\u003evuTC![08\u0026)#pdxnjzH9{5z/6ufzz1T{B8$=5x(mMoojqBFvj\u003c]=zF\u003c2}BzkVhB1P*#zF\u003c2}BzkVhp\u0026ZF$x\u003eg^}d)cjlB8V5swKgx.zEU\u003evuTC+)0a=fhuQF:HB98CBv@#TfB0bykaAR)FwPF#rx([1", "n": [ { "c": 1, "d": "Regex component marker", "i": "objectives/persistence/login/scheduled-task/com::task-scheduler-builder-methods--rx-1", "o": 66250, "z": 79, "cf": 0.8999999761581421 } ], "ln": 66234 }, { "b": "AbY-oBy!#9x(k5nxLzJgC4CYnx(v(iz!pbqz/{7yv@Dj6x(4v3e=+}L6AFgAqE%\u0026\u003cx(W+", "n": [ { "c": 3, "d": "Recognized sparse-logic binary marker", "i": "objectives/anti-analysis/vm-detect/instruction::sparse-logic-recognized-marker", "o": 66405, "z": 7, "cf": 0.800000011920929 } ], "ln": 66389 }, { "b": "zeBiee\u003e][#B75Y}zF7Hyr+lq)x(v(Lga\u003esmf!+jlefEr5y\u0026\u003c/uwJ:{xB-.Ujy+cY9BZ/f3v[QxUrbVL-zAR(Wy?%7KgYWO1q*ACawO\u003c50wQ5qHn][]*e(MXhA:@VJwO#71vruj4zvFrOe?![jg+HHrfFLlY", "n": [ { "c": 2, "d": "IPv4-like .NET assembly version", "i": "metadata/lang/compiler/managed::dotnet-ipv4-like-version", "o": 66692, "z": 16, "cf": 0.8500000238418579 }, { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 66752, "z": 16, "cf": 0.8500000238418579 } ], "ln": 66676 }, { "b": "00000000000000000000000000000000000000315c8Xg7YTL^00000000000000000", "n": [ { "c": 1, "d": "PE resource section", "i": "metadata/binary/section/names::pe-resource-section", "o": 67584, "z": 5, "cf": 0.8999999761581421 } ], "ln": 67568 }, { "b": "0000000000005C\u003cgYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006Xn[brp!0rrf30SSi", "n": [ { "c": 3, "d": "Recognized marker for timing checks", "i": "objectives/anti-analysis/timing/evasion::timing-anti-debug-recognized-marker", "o": 67678, "z": 15, "cf": 0.949999988079071 } ], "ln": 67662 }, { "b": "zVB!Tyxb%!002:]7xsEolJz38z2!IPve$fBC(QOtve$cAwDhYg002s=wDl-Jzua8BASxRIzVy)", "n": [ { "c": 2, "d": "PE CompanyName metadata field", "i": "metadata/package/versioning::pe-companyname-field", "o": 68018, "z": 11, "cf": 0.699999988079071 } ], "ln": 68002 }, { "b": "ASxUJBPqyw003Ed9rl9umGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up002E*ASxIFzua$.e=Xl", "n": [ { "c": 2, "d": "PE FileDescription metadata field", "i": "metadata/package/versioning::pe-filedescription-field", "o": 68098, "z": 15, "cf": 0.699999988079071 } ], "ln": 68082 }, { "b": "w=MPDve{oc001RK2lj=8mGvc5yYF2DrSDXhASydXx-J5Kzu6Up001+Oe=WTbe=WQafAq7M003EdaPIJynDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE002E*ASxIFzua$.e=XlszVBRO", "n": [ { "c": 3, "d": "Dotted-quad PE version metadata marker", "i": "objectives/command-and-control/infrastructure/ip::ipv4-version-metadata-marker", "o": 68198, "z": 11, "cf": 0.9399999976158142 }, { "c": 2, "d": "PE InternalName metadata field", "i": "metadata/package/versioning::pe-internalname-field", "o": 68246, "z": 12, "cf": 0.699999988079071 } ], "ln": 68182 }, { "b": "vGpAGwDl\u0026M003:laPIJypxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE002E*ASxIFzua$.e=Xls", "n": [ { "c": 2, "d": "PE OriginalFilename metadata field", "i": "metadata/package/versioning::pe-originalfilename-field", "o": 68466, "z": 16, "cf": 0.699999988079071 } ], "ln": 68450 }, { "b": "wb{ACyYBCn003g59rl9upYLIozVBqFBPt[KBo25ove$cAwDhYg002E*ASxIFzua$.e=XlszVBR", "n": [ { "c": 2, "d": "PE ProductName metadata field", "i": "metadata/package/versioning::pe-productname-field", "o": 68574, "z": 11, "cf": 0.699999988079071 } ], "ln": 68558 }, { "b": "w=MPDve{oc004VLfAqaNpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001+Oe=WTbe=WQafArQ6ve{", "n": [ { "c": 2, "d": "PE version resource metadata", "i": "metadata/package/versioning::version-resource-metadata", "o": 68666, "z": 14, "cf": 0.8999999761581421 } ], "ln": 68650 }, { "b": "0000000000000000000003zpx3\u0026*ncPFMSG000000000000000000000000000000000", "n": [ { "c": 2, "d": "PE .reloc section presence", "i": "metadata/binary/section/names::reloc-section-presence", "o": 69120, "z": 6, "cf": 0.8999999761581421 } ], "ln": 69104 } ], "depth": 1, "facts": { "imp": [ [ "mscoree", "CorDllMain" ] ], "sec": [ [ ".text", 512, 67072, 6.15, "r-x" ], [ ".rsrc", 67584, 1536, 2.93, "r--" ], [ ".reloc", 69120, 512, 0.1, "r--" ] ], "metrics": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "resource_count": 1.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 82645.0, "reloc_overhang_bytes": 500.0, "reloc_overhang_ratio": 0.98, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "version.identity_entropy": 4.34, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0, "version.identity_symbol_ratio": 0.08 }, "file": { "size": 69632.0, "entropy": 6.06, "size_bytes": 69632.0 }, "binary": { "is_pie": 1.0, "code_entropy": 6.15, "string_count": 893.0, "overall_entropy": 6.06, "entropy_variance": 6.11, "avg_string_length": 19.8, "max_string_length": 120.0, "peak_region_bytes": 3072.0, "code_to_data_ratio": 1.0, "peak_region_entropy": 6.38, "string_length_stddev": 13.0, "largest_section_ratio": 0.96, "sentence_string_count": 28.0, "sentence_string_ratio": 0.03, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 67072.0, "entropy_max": 6.15, "entropy_mean": 3.06, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } } }, "id": 3, "mol": "O(Al)H₂(CmDb)", "path": "Franz.Common.Messaging.Kafka.2.2.10.nupkg!!lib/net10.0/Franz.Common.Messaging.Kafka.dll", "risk": 3, "sha": "53942a439399047f52ee51c6b597530ee1f2747e93ef0263dbe4a11a3b537c2d", "size": 69632, "traits": [ { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "spans": [ [ 68666, 14 ] ] }, { "id": "metadata/package/versioning::version-word-lower", "conf": 0.4000000059604645, "crit": 2, "desc": "version word (lowercase)", "spans": [ [ 66405, 7 ] ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "spans": [ [ 47539, 4 ] ] }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "spans": [ [ 0, 26 ] ] }, { "id": "micro-behaviors/data/db/linq::linq-queries", "conf": 0.699999988079071, "crit": 3, "desc": "LINQ query operations", "spans": [ [ 49184, 11 ] ] }, { "id": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "conf": 1.0, "crit": 3, "desc": "JSON polymorphism runtime marker", "spans": [ [ 42053, 16 ] ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "spans": [ [ 68198, 11 ] ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "spans": [ [ 19328, 4 ] ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 67678, 15 ] ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "micro-behaviors/communications/http/websocket::websocket-send-async", "atk": "T1071.001", "mbc": "C0002", "conf": 0.8199999928474426, "crit": 3, "desc": "WebSocket async send method", "spans": [ [ 42276, 9 ] ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "spans": [ [ 19328, 4 ] ] } ], "type": "pe" }, { "ctx": [ { "b": "[4lsVavZxWzH9{5z/6ufzz1T{B8$=5x(mMoojqBFve", "ln": 1, "addr": 0 }, { "b": "", "ln": 2, "addr": 34 }, { "b": "k{e*ew[$/$BAg/cB8V5rBrCpnBy/99vruj4zxJLfAV/EqwGSDLmSI{PDltW$vqPO1z/PRydL8YMwPIM#zE)u3Bz\u0026pvA=lbnwmU", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 65, "z": 3, "cf": 0.800000011920929 } ], "ln": 3, "addr": 35 }, { "b": "v@bZ+zy=]vwPRH7ze0)4B98baefFwswft\u0026iz!a02BzkVheOx9jwmV($zGGDgvpKy[z/cXwx([2hojqBFvixVgAa@*6ec", "ln": 4, "addr": 114 }, { "b": "Ab](cBZ]06B1wCxzE:(1z/fSszdN:ee=", "ln": 5, "addr": 188 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 6208.0, "entropy": 5.04, "size_bytes": 6208.0 }, "text": { "digit_ratio": 0.01, "space_count": 671.0, "total_lines": 268.0, "char_entropy": 5.04, "unique_chars": 106.0, "ascii_art_lines": 1.0, "avg_line_length": 22.16, "high_byte_ratio": 0.02, "invisible_chars": 6.0, "max_line_length": 127.0, "non_ascii_ratio": 0.02, "empty_line_ratio": 0.32, "last_line_length": 17.0, "whitespace_ratio": 0.15, "most_common_ratio": 0.07, "line_length_stddev": 24.49, "repeated_char_sequences": 1.0, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 1.0, "trailing_whitespace_lines": 3.0, "most_common_char_codepoint": 101.0 }, "binary": { "overall_entropy": 5.04, "peak_region_bytes": 6144.0, "peak_region_entropy": 5.07 } } }, "id": 4, "path": "Franz.Common.Messaging.Kafka.2.2.10.nupkg!!readme.md", "risk": 1, "sha": "7788177d045100aed4ff63cecbf6338b9a466b656ccfcf0d479dfde666bd02f8", "size": 6208, "traits": [ { "id": "metadata/file/profile/language::lang-english", "conf": 0.800000011920929, "crit": 2, "desc": "English language detection", "spans": [ [ 65, 3 ] ] }, { "id": "metadata/file/extension/identity::markdown-file-basename", "conf": 1.0, "crit": 1, "desc": "Markdown document file extension", "spans": [ [ 0, 9 ] ] }, { "id": "metadata/file/extension/identity::doc-or-config-extension", "conf": 1.0, "crit": 1, "desc": "Document or config file extension", "spans": [ [ 0, 9 ] ] } ], "type": "markdown" }, { "ctx": [ { "b": "ju[7cy-)[jA=U@kzAPf#e?!E(wO#0@wnb{]jTb2\u003cw?t$^krYAprc-B]B0bZAy\u0026jqSb4#7uA5]T9B7n({zddGrz/xo9CX}nez/PY6BAo5", "n": [ { "c": 1, "d": "File uses a document or configuration extension", "i": "metadata/file/extension/identity::doc-or-config-extension", "o": 0, "z": 19, "cf": 1.0 } ], "ln": 0, "col": 1, "line": 1 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 520.0, "entropy": 4.81, "size_bytes": 520.0 }, "binary": { "overall_entropy": 4.81, "peak_region_bytes": 520.0, "peak_region_entropy": 4.81 } } }, "id": 5, "path": "Franz.Common.Messaging.Kafka.2.2.10.nupkg!![Content_Types].xml", "pid": 0, "sha": "1a6670ec6cb20a6520f5d6b9be859fcd7416bef2ba0e8e40bfbf0aaab5409e4f", "size": 520, "traits": [ { "id": "metadata/file/extension/identity::doc-or-config-extension", "conf": 1.0, "crit": 1, "desc": "File uses a document or configuration extension", "spans": [ [ 0, 19 ] ] } ], "type": "xml" }, { "id": 6, "sha": "8d15a73f36543e594ea93429ef1aef6284701773c74122aead8afa47bc5978cc", "path": "Franz.Common.Messaging.Kafka.2.2.10.nupkg!!package/services/metadata/core-properties/7d66f437c43c48aa83eab8f9e66ce6b0.psmdcp", "size": 736, "type": "xml", "depth": 1 }, { "id": 7, "sha": "dcc5ffebef00281f2db9c7280cf870702e0d5effd0221686239d817f92b22cf3", "path": "Franz.Common.Messaging.Kafka@2.2.10.registry.json", "size": 800, "type": "registry", "depth": 1 } ], "omitted_files": 2, "v": "8" } }