{
  "ml": {
    "v": "7",
    "eng": "2.3.0-beta.1",
    "lvl": -1,
    "conf": 0,
    "mods": [
      {
        "cls": 0,
        "raw": 0.9999185,
        "rte": "az",
        "prob": 0.9999185
      },
      {
        "cls": 0,
        "raw": 0.58429205,
        "rte": "az/nupkg",
        "prob": 0.58429205
      }
    ],
    "prob": 0.9999185,
    "skip": [
      {
        "rte": "az/zip",
        "why": "unavailable"
      },
      {
        "rte": "az/zip",
        "why": "unavailable"
      }
    ],
    "files": [
      {
        "id": 0,
        "lvl": -1,
        "conf": 0,
        "prob": 0.999918520450592,
        "type": "nupkg"
      },
      {
        "id": 1,
        "lvl": -1,
        "conf": 0,
        "prob": 0.00012001395225524902,
        "type": "xml"
      },
      {
        "id": 2,
        "lvl": -1,
        "conf": 0,
        "prob": 0.013318806886672974,
        "type": "xml"
      },
      {
        "id": 3,
        "lvl": -1,
        "conf": 0,
        "prob": 0.00006663799285888672,
        "type": "png"
      },
      {
        "id": 4,
        "lvl": -1,
        "conf": 0,
        "prob": 0.9998993873596191,
        "type": "pe"
      },
      {
        "id": 5,
        "lvl": -1,
        "conf": 0,
        "prob": 0.000033408403396606445,
        "type": "xml"
      },
      {
        "id": 6,
        "lvl": -1,
        "conf": 0,
        "prob": 0.000033408403396606445,
        "type": "xml"
      },
      {
        "id": 7,
        "lvl": -1,
        "conf": 0,
        "prob": 0.00012001395225524902,
        "type": "xml"
      },
      {
        "id": 8,
        "lvl": -1,
        "conf": 0,
        "prob": 0.0003479123115539551,
        "type": "registry"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-07-10T19:50:17Z"
  },
  "path": "WolverineFx.Http.AspVersioning.6.17.1.nupkg",
  "raw": {
    "files": [
      {
        "id": 0,
        "mol": "O(As)H(Db)",
        "sha": "97a395fdf7a68117fa4aa7755c02cadd9e53aa693de2e729cfb10681c2541f66",
        "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/WolverineFx.Http.AspVersioning/WolverineFx.Http.AspVersioning.6.17.1.nupkg",
        "risk": 34,
        "size": 166591,
        "type": "nupkg",
        "facts": {
          "metrics": {
            "file": {
              "size": 166591.0,
              "entropy": 7.99,
              "size_bytes": 166591.0
            },
            "binary": {
              "overall_entropy": 7.99,
              "peak_region_bytes": 162816.0,
              "peak_region_entropy": 7.83
            },
            "archive": {
              "file_count": 8.0,
              "member_count": 8.0,
              "script_count": 0.0,
              "zip_bomb_ratio": 3.34,
              "directory_count": 0.0,
              "executable_count": 1.0,
              "extra_field_size": 0.0,
              "noise_file_count": 0.0,
              "total_compressed": 165445.0,
              "compression.ratio": 0.92,
              "hidden_file_count": 2.0,
              "total_uncompressed": 179176.0,
              "crc_collision_count": 0.0,
              "entry_comment_count": 0.0,
              "max_filename_length": 81.0,
              "rtlo_filename_count": 0.0,
              "format.regular_count": 8.0,
              "nested_archive_count": 0.0,
              "path_traversal_count": 0.0,
              "symlink_escape_count": 0.0,
              "security.setgid_count": 0.0,
              "security.setuid_count": 0.0,
              "security.sticky_count": 0.0,
              "double_extension_count": 0.0,
              "duplicate_member_count": 0.0,
              "security.symlink_count": 0.0,
              "unicode_filename_count": 0.0,
              "homoglyph_filename_count": 0.0,
              "security.encrypted_count": 0.0,
              "timing.mtime_unique_count": 4.0,
              "timing.mtime_unique_ratio": 0.5,
              "misplaced_executable_count": 1.0,
              "timing.mtime_outlier_count": 3.0,
              "timing.mtime_dominant_count": 5.0,
              "timing.mtime_spread_seconds": 25112.0,
              "timing.sentinel_mtime_count": 0.0,
              "security.world_writable_count": 0.0,
              "timing.mtime_dominant_fraction": 0.63,
              "compression.method_counts.stored": 1.0,
              "compression.method_counts.deflate": 7.0
            }
          }
        },
        "ident": {
          "name": {
            "value": "WolverineFx.Http.AspVersioning",
            "source": "nupkg.title",
            "verified": false
          },
          "urls": [
            {
              "url": "http://github.com/jasperfx/wolverine",
              "kind": "homepage",
              "source": "nupkg.project_url"
            },
            {
              "url": "http://github.com/jasperfx/wolverine",
              "kind": "repository",
              "source": "nupkg.repository_url"
            }
          ],
          "trust": "unsigned",
          "authors": [
            {
              "name": "Jeremy D. Miller",
              "role": "author",
              "source": "nupkg.authors"
            },
            {
              "name": "Babu Annamalai",
              "role": "author",
              "source": "nupkg.authors"
            },
            {
              "name": "Jaedyn Tonee",
              "role": "author",
              "source": "nupkg.authors"
            }
          ],
          "version": {
            "value": "6.17.1",
            "source": "nupkg.version",
            "verified": false
          },
          "identifier": {
            "value": "WolverineFx.Http.AspVersioning",
            "source": "nupkg.id",
            "verified": false
          }
        },
        "traits": [
          {
            "id": "metadata/package/versioning::pe-file-version-ipv4-shape",
            "conf": 0.9200000166893005,
            "crit": 1,
            "desc": "PE FileVersion resembles IPv4"
          },
          {
            "id": "objectives/anti-static/obfuscation/binary-metrics/shape::high-code-entropy",
            "atk": "T1045",
            "mbc": "B0032",
            "conf": 0.800000011920929,
            "crit": 4,
            "desc": "High code section entropy",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "metadata/package/versioning::pe-fileversion-field",
            "conf": 0.699999988079071,
            "crit": 2,
            "desc": "PE FileVersion metadata field",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "metadata/binary/framework::dotnet-assembly",
            "conf": 1.0,
            "crit": 2,
            "desc": ".NET Assembly (mscoree.dll)",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/path/extension::dll-dup",
            "crit": 2,
            "desc": ".dll extension reference",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "metadata/package/versioning::pe-productversion-field",
            "conf": 0.699999988079071,
            "crit": 2,
            "desc": "PE ProductVersion metadata field",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "metadata/package/versioning::pe-version-resource",
            "conf": 0.800000011920929,
            "crit": 2,
            "desc": "PE version resource structure",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "micro-behaviors/data/db/linq::linq-queries",
            "conf": 0.699999988079071,
            "crit": 3,
            "desc": "LINQ query operations",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "metadata/package/versioning::pe-product-version-ipv4-shape",
            "conf": 0.9200000166893005,
            "crit": 1,
            "desc": "PE ProductVersion resembles IPv4"
          },
          {
            "id": "metadata/binary/framework::clr-runtime-header",
            "conf": 1.0,
            "crit": 2,
            "desc": "PE CLR runtime header present (COM descriptor)"
          },
          {
            "id": "metadata/binary/framework::dotnet-metadata",
            "conf": 1.0,
            "crit": 2,
            "desc": ".NET Metadata Root (BSJB)",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal",
            "conf": 0.699999988079071,
            "crit": 1,
            "desc": ".NET code entropy in unpacked range",
            "from": [
              {
                "file": 4
              }
            ]
          }
        ]
      },
      {
        "depth": 1,
        "facts": {
          "metrics": {
            "file": {
              "size": 520.0,
              "entropy": 5.18,
              "size_bytes": 520.0
            },
            "binary": {
              "overall_entropy": 5.18,
              "peak_region_bytes": 520.0,
              "peak_region_entropy": 5.18
            }
          }
        },
        "id": 1,
        "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/WolverineFx.Http.AspVersioning/WolverineFx.Http.AspVersioning.6.17.1.nupkg!!_rels/.rels",
        "pid": 0,
        "sha": "c479e9e33456ad0b6ee146c932e2b1a61e3d6cea6843142ceeef1b8bf492e6b3",
        "size": 520,
        "type": "xml"
      },
      {
        "ctx": [
          {
            "b": "[4ls%kx}3YaA?spB7]MgjT8QkfD}SJzEWP}x(mMDb6w0teJs}sj]",
            "n": [
              {
                "c": 2,
                "d": "NuGet nuspec manifest file",
                "i": "metadata/build/manifest::nuspec-file",
                "o": 0,
                "z": 37,
                "cf": 0.9800000190734863
              }
            ],
            "ln": 1,
            "addr": 0
          },
          {
            "b": "jAa.syHH\u003c!aB4:tzGv@+xMOuniXJdcv}YB\u003cvrj5rx\u003e8g4B8LVje[n*pfk$ufyHH\u003c\u0026zF7QTfFLvpfF$I3B-RIkv\u003eJ1EwfKh",
            "ln": 2,
            "addr": 42
          },
          {
            "b": "arS^-wPRu\u003evrt{w",
            "ln": 3,
            "addr": 118
          },
          {
            "b": "arR^HjAbsVygQ)%rDq[txMOuniXJd0x([3hvLheez7/TjB8UYhw{t$Mz!%PdA+PA5jtgU]z!-\u0026[Bx9u$j]",
            "ln": 10,
            "addr": 404
          },
          {
            "b": "arR^Hjy\u00262Av@=p5BzkVhk0:mee((L7B7]Mgx(mMax(n37xl4B5x(v(iw]zYjs8R[#wPzH5wGTJyr8sYazE^Z8x(n3ljtgkRB7ol8Acb/jzAX",
            "ln": 11,
            "addr": 470
          },
          {
            "b": "arR^HjAt1Lz/YSmz/QaCBA}?pjTaJMBrR\u0026IA+)(.xMOuniXJd0x([3hvLheez7/TjB8UYhw{t$Mz!%PdA+PA5a%punvqYN*jTa]Tw]/RswNPa\u003cfkUcizxZikz/6u9BuH*Uhz^9Awhb!@g?wN2h8va0hdX:avp.CTvprU4w\u0026BoUi5$LWiaK(\u003catk[",
            "n": [
              {
                "c": 2,
                "d": "NuGet package declares repository",
                "i": "metadata/package/files/nuget::nuspec-repository",
                "o": 561,
                "z": 98,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 12,
            "addr": 557
          },
          {
            "b": "arR^Hjy\u00262xwO#3\u0026zEWx(B3o",
            "n": [
              {
                "c": 2,
                "d": "NuGet package declares dependencies",
                "i": "metadata/package/files/nuget::nuspec-dependencies",
                "o": 709,
                "z": 162,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 13,
            "addr": 705
          },
          {
            "b": "arR^HarS^VA=l8taAR4jxjVfOA:-/@Cw?IqjTa=PBtkE4fD@W",
            "ln": 14,
            "addr": 724
          },
          {
            "b": "arR^HarR^Hjy\u00262xwO#3\u0026zEW@mx\u003efvJs8R[#wPzH5wKZ[%now@)a%q5uA=U@kzAPg4e?]pqf^m-KCW\u003eMjwmW[FluN0UwgQ2:vqHjnwPz\u0026oatk[",
            "ln": 15,
            "addr": 764
          }
        ],
        "depth": 1,
        "facts": {
          "metrics": {
            "file": {
              "size": 1012.0,
              "entropy": 5.12,
              "size_bytes": 1012.0
            },
            "binary": {
              "overall_entropy": 5.12,
              "peak_region_bytes": 1012.0,
              "peak_region_entropy": 5.12
            }
          }
        },
        "id": 2,
        "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/WolverineFx.Http.AspVersioning/WolverineFx.Http.AspVersioning.6.17.1.nupkg!!WolverineFx.Http.AspVersioning.nuspec",
        "pid": 0,
        "risk": 1,
        "sha": "388d442d407d61f70f361c1a9330547e01e07f756ea59ce9afddb65b415ee051",
        "size": 1012,
        "traits": [
          {
            "id": "metadata/package/files/nuget::nuspec-dependencies",
            "conf": 0.8999999761581421,
            "crit": 2,
            "desc": "NuGet package declares dependencies",
            "spans": [
              [
                709,
                162
              ]
            ]
          },
          {
            "id": "metadata/build/manifest::nuspec-file",
            "conf": 0.9800000190734863,
            "crit": 2,
            "desc": "NuGet nuspec manifest file",
            "spans": [
              [
                0,
                37
              ]
            ]
          },
          {
            "id": "metadata/package/files/nuget::nuspec-repository",
            "conf": 0.8999999761581421,
            "crit": 2,
            "desc": "NuGet package declares repository",
            "spans": [
              [
                561,
                98
              ]
            ]
          }
        ],
        "type": "xml"
      },
      {
        "ctx": [
          {
            "b": "Ibl@q4gj0X0000dnK#lE0005(0005(2Ngne0l-%JIu0RR32\u0026BrA@VgI.#G=E.#VbN4JtxF05FZ=sAD]GzeA\u003c4Bo3Ma",
            "n": [
              {
                "c": 1,
                "d": "File has a .png extension",
                "i": "metadata/package/files/included::png-extension-basename",
                "o": 0,
                "z": 8,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 0
          }
        ],
        "depth": 1,
        "facts": {
          "metrics": {
            "png": {
              "a_entropy": 1.3,
              "chunk_count": 5.0,
              "trailing_bytes": 0.0,
              "idat_chunk_count": 1.0,
              "text_chunk_bytes": 51.0,
              "chunks_after_iend": 0.0,
              "compression_ratio": 0.13,
              "unknown_chunk_count": 0.0
            },
            "file": {
              "size": 129350.0,
              "entropy": 7.99,
              "size_bytes": 129350.0
            },
            "image": {
              "width": 500.0,
              "height": 500.0,
              "channels": 4.0,
              "b_entropy": 2.47,
              "g_entropy": 3.02,
              "r_entropy": 3.14,
              "edge_density": 0.02,
              "pixel_entropy": 3.23,
              "histogram_flatness": 0.4
            },
            "binary": {
              "overall_entropy": 7.99,
              "peak_region_bytes": 128000.0,
              "peak_region_entropy": 7.84
            }
          }
        },
        "id": 3,
        "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/WolverineFx.Http.AspVersioning/WolverineFx.Http.AspVersioning.6.17.1.nupkg!!logo.png",
        "pid": 0,
        "sha": "08cd479960139d26211ad2755aeced9cebce2fce7d48891bebbae0fa549ee183",
        "size": 129350,
        "traits": [
          {
            "id": "metadata/package/files/included::png-extension-basename",
            "conf": 0.8999999761581421,
            "crit": 1,
            "desc": "File has a .png extension",
            "spans": [
              [
                0,
                8
              ]
            ]
          }
        ],
        "type": "png"
      },
      {
        "ctx": [
          {
            "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J+",
            "n": [
              {
                "c": 4,
                "d": "High code section entropy",
                "i": "objectives/anti-static/obfuscation/binary-metrics/shape::high-code-entropy",
                "o": 0,
                "z": 26,
                "cf": 0.800000011920929
              }
            ],
            "ln": 0
          },
          {
            "b": "00000000000000000000dusDe00000nb@R\u00260SSx7KspefPFlAD0rr91000000000000",
            "n": [
              {
                "c": 1,
                "d": "PE standard code/data section",
                "i": "metadata/binary/section/names::pe-code-data-standard-section",
                "o": 512,
                "z": 5,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 496
          },
          {
            "b": "fAq7WdK\u003eKy1onA66-Fg:lq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn",
            "n": [
              {
                "c": 3,
                "d": "Recognized PE anti-analysis marker",
                "i": "objectives/anti-analysis/debugger-detect/combined-checks::evasion-aware-recognized-pe-marker",
                "o": 2960,
                "z": 4,
                "cf": 1.0
              }
            ],
            "ln": 2944
          },
          {
            "b": "Bz@\u0026#B8Ue\u003eA=U@kzFs03e[w^m08[e:By/qwlVl^SwN/*@z/fRGm}DNHA+P2onLA\u0026t",
            "n": [
              {
                "c": 3,
                "d": "References Windows executable or script",
                "i": "objectives/execution/interpreter/script/shell::windows-executable-ref",
                "o": 10136,
                "z": 4,
                "cf": 0.6000000238418579
              }
            ],
            "ln": 10120
          },
          {
            "b": "zE^r@v%HT-ygQ)%x(v\u003e?q*ACawO\u003c4$wOb:\u0026v@#B6zu9l}z!%l3v@#B6zu9BIBw)s3AbP=swN[kOv}xR3x-",
            "n": [
              {
                "c": 2,
                "d": "Benign high-entropy PE context",
                "i": "metadata/package/quality/false-positives::benign-high-entropy-pe-context",
                "o": 10624,
                "z": 17,
                "cf": 0.949999988079071
              }
            ],
            "ln": 10608
          },
          {
            "b": "r+lq)x(v)6zF7N)BAzE4q*ACawO\u003c4[x(m[\u003cq*ACawO\u003c4!z!%l3v@#B6zGvB2wO#71x\u003e5+!lVl=",
            "n": [
              {
                "c": 3,
                "d": "LINQ query operations",
                "i": "micro-behaviors/data/db/linq::linq-queries",
                "o": 10922,
                "z": 11,
                "cf": 0.699999988079071
              }
            ],
            "ln": 10906
          },
          {
            "b": "00000000000000000000000000000000000000315c8Xg7YTL^00000000000000000",
            "n": [
              {
                "c": 1,
                "d": "PE resource section",
                "i": "metadata/binary/section/names::pe-resource-section",
                "o": 29184,
                "z": 5,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 29168
          },
          {
            "b": "0000000000007TNgYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006Xn[brp!0rr910000",
            "n": [
              {
                "c": 3,
                "d": "Recognized marker for timing checks",
                "i": "objectives/anti-analysis/timing/evasion::timing-anti-debug-recognized-marker",
                "o": 29278,
                "z": 15,
                "cf": 0.949999988079071
              }
            ],
            "ln": 29262
          },
          {
            "b": "x-J2JBo3vZ004xDe=U[LlJz38z2!IPve$fBC(QOtve$cAwDhYg002Q\u003ewDl-JwDlMEC(O@!l\u0026X?taokaox-I@HyYF2DASwf3li7A]vGpJJaojXczuaLOve$cAve$9zve$0wi@?\u003eMve%\u003cswb{(Pzu7^",
            "n": [
              {
                "c": 3,
                "d": "HTTP fingerprinting evasion campaign",
                "i": "objectives/command-and-control/infrastructure/user-agent::http-fingerprinting-campaign",
                "o": 29660,
                "z": 45,
                "cf": 0.8999999761581421
              },
              {
                "c": 2,
                "d": "PE CompanyName metadata field",
                "i": "metadata/package/versioning::pe-companyname-field",
                "o": 29634,
                "z": 11,
                "cf": 0.699999988079071
              }
            ],
            "ln": 29618
          },
          {
            "b": "zuakFwDj^(003Ed9rl9umGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up00372zVBONB]V7NASx!",
            "n": [
              {
                "c": 2,
                "d": "PE FileDescription metadata field",
                "i": "metadata/package/versioning::pe-filedescription-field",
                "o": 29758,
                "z": 15,
                "cf": 0.699999988079071
              }
            ],
            "ln": 29742
          },
          {
            "b": "x-J2Jx8?]i001XM2MK(9mGvc5yYF2DrSDXhASydXx-J5Kzu6Up001XMe=WN9e=WN9e=WN9003EdaPIJynDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE00372zVBONB]V7NASx!NzuakF",
            "n": [
              {
                "c": 3,
                "d": "Dotted-quad PE version metadata marker",
                "i": "objectives/command-and-control/infrastructure/ip::ipv4-version-metadata-marker",
                "o": 29884,
                "z": 7,
                "cf": 0.9399999976158142
              },
              {
                "c": 2,
                "d": "PE InternalName metadata field",
                "i": "metadata/package/versioning::pe-internalname-field",
                "o": 29906,
                "z": 12,
                "cf": 0.699999988079071
              },
              {
                "c": 2,
                "d": "PE version resource metadata",
                "i": "metadata/package/versioning::version-resource-metadata",
                "o": 29858,
                "z": 11,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 29842
          },
          {
            "b": "xAibO001bw003:laPIJypxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE00372zVBONB]V7NASx!N",
            "n": [
              {
                "c": 2,
                "d": "PE OriginalFilename metadata field",
                "i": "metadata/package/versioning::pe-originalfilename-field",
                "o": 30046,
                "z": 16,
                "cf": 0.699999988079071
              }
            ],
            "ln": 30030
          },
          {
            "b": "wb{ACyYBCn001?Q2MK(9pYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001XMe=WN9e=WN9e=WN9001$U2MK(9k(+%aA@Y+Kz2!2ByYF.Xao",
            "n": [
              {
                "c": 2,
                "d": "PE ProductVersion metadata field",
                "i": "metadata/package/versioning::pe-productversion-field",
                "o": 30154,
                "z": 14,
                "cf": 0.699999988079071
              },
              {
                "c": 1,
                "d": "PE version numbers look like IPv4",
                "i": "metadata/package/versioning::version-number-ipv4-metadata",
                "o": 30184,
                "z": 7,
                "cf": 0.949999988079071
              }
            ],
            "ln": 30138
          },
          {
            "b": "000000000000000000000dU4H3\u0026*ncoG@HS000000000000000000000000000000000",
            "n": [
              {
                "c": 2,
                "d": "PE .reloc section presence",
                "i": "metadata/binary/section/names::reloc-section-presence",
                "o": 30720,
                "z": 6,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 30704
          }
        ],
        "depth": 1,
        "facts": {
          "imp": [
            [
              "mscoree",
              "CorDllMain"
            ]
          ],
          "sec": [
            [
              ".text",
              512,
              28672,
              7.19,
              "r-x"
            ],
            [
              ".rsrc",
              29184,
              1536,
              2.43,
              "r--"
            ],
            [
              ".reloc",
              30720,
              512,
              0.08,
              "r--"
            ]
          ],
          "metrics": {
            "pe": {
              "checksum": 0.0,
              "checksum_valid": 0.0,
              "resource_count": 1.0,
              "has_version_info": 1.0,
              "checksum_stripped": 1.0,
              "computed_checksum": 68236.0,
              "reloc_overhang_bytes": 500.0,
              "reloc_overhang_ratio": 0.98,
              "bss_like_section_count": 0.0,
              "section_overflow_count": 0.0,
              "misaligned_section_count": 0.0,
              "version.identity_entropy": 4.5,
              "base_relocation_block_count": 1.0,
              "base_relocation_entry_count": 1.0,
              "version.identity_symbol_ratio": 0.08
            },
            "file": {
              "size": 31232.0,
              "entropy": 6.9,
              "size_bytes": 31232.0
            },
            "binary": {
              "is_pie": 1.0,
              "code_entropy": 7.19,
              "string_count": 267.0,
              "overall_entropy": 6.9,
              "entropy_variance": 8.74,
              "avg_string_length": 21.97,
              "max_string_length": 176.0,
              "peak_region_bytes": 12288.0,
              "code_to_data_ratio": 1.0,
              "peak_region_entropy": 7.84,
              "string_length_stddev": 17.61,
              "largest_section_ratio": 0.92,
              "sentence_string_count": 7.0,
              "sentence_string_ratio": 0.03,
              "high_entropy_string_count": 0.0
            },
            "imports": {
              "count": 1.0
            },
            "sections": {
              "count": 3.0,
              "code_size": 28672.0,
              "entropy_max": 7.19,
              "entropy_mean": 3.23,
              "name_entropy": 3.03,
              "writable_count": 0.0,
              "executable_count": 1.0,
              "nonstandard_count": 0.0,
              "executable_writable_count": 0.0
            },
            "dependencies": {
              "count": 1.0
            }
          }
        },
        "id": 4,
        "mol": "O(As)H(Db)",
        "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/WolverineFx.Http.AspVersioning/WolverineFx.Http.AspVersioning.6.17.1.nupkg!!lib/net10.0/Wolverine.Http.AspVersioning.dll",
        "pid": 0,
        "risk": 34,
        "sha": "b0db3f505c2357157ddc81b237fea6a4b64100cccc906206d902a44155a71fdd",
        "size": 31232,
        "traits": [
          {
            "id": "metadata/package/versioning::pe-product-version-ipv4-shape",
            "conf": 0.9200000166893005,
            "crit": 1,
            "desc": "PE ProductVersion resembles IPv4",
            "spans": [
              [
                30184,
                7
              ]
            ]
          },
          {
            "id": "metadata/package/versioning::pe-version-resource",
            "conf": 0.800000011920929,
            "crit": 2,
            "desc": "PE version resource structure",
            "spans": [
              [
                29278,
                15
              ]
            ]
          },
          {
            "id": "metadata/binary/framework::clr-runtime-header",
            "conf": 1.0,
            "crit": 2,
            "desc": "PE CLR runtime header present (COM descriptor)"
          },
          {
            "id": "metadata/package/versioning::pe-fileversion-field",
            "conf": 0.699999988079071,
            "crit": 2,
            "desc": "PE FileVersion metadata field",
            "spans": [
              [
                29858,
                11
              ]
            ]
          },
          {
            "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal",
            "conf": 0.699999988079071,
            "crit": 1,
            "desc": ".NET code entropy in unpacked range",
            "spans": [
              [
                0,
                26
              ]
            ]
          },
          {
            "id": "metadata/package/versioning::pe-file-version-ipv4-shape",
            "conf": 0.9200000166893005,
            "crit": 1,
            "desc": "PE FileVersion resembles IPv4",
            "spans": [
              [
                29884,
                7
              ]
            ]
          },
          {
            "id": "metadata/binary/framework::dotnet-metadata",
            "conf": 1.0,
            "crit": 2,
            "desc": ".NET Metadata Root (BSJB)",
            "spans": [
              [
                2960,
                4
              ]
            ]
          },
          {
            "id": "micro-behaviors/data/db/linq::linq-queries",
            "conf": 0.699999988079071,
            "crit": 3,
            "desc": "LINQ query operations",
            "spans": [
              [
                10922,
                11
              ]
            ]
          },
          {
            "id": "metadata/package/versioning::pe-productversion-field",
            "conf": 0.699999988079071,
            "crit": 2,
            "desc": "PE ProductVersion metadata field",
            "spans": [
              [
                30154,
                14
              ]
            ]
          },
          {
            "id": "micro-behaviors/fs/path/extension::dll-dup",
            "crit": 2,
            "desc": ".dll extension reference",
            "spans": [
              [
                10136,
                4
              ]
            ]
          },
          {
            "id": "objectives/anti-static/obfuscation/binary-metrics/shape::high-code-entropy",
            "atk": "T1045",
            "mbc": "B0032",
            "conf": 0.800000011920929,
            "crit": 4,
            "desc": "High code section entropy",
            "spans": [
              [
                0,
                26
              ]
            ]
          },
          {
            "id": "metadata/binary/framework::dotnet-assembly",
            "conf": 1.0,
            "crit": 2,
            "desc": ".NET Assembly (mscoree.dll)",
            "spans": [
              [
                2960,
                4
              ]
            ]
          }
        ],
        "type": "pe"
      },
      {
        "id": 5,
        "sha": "6995689cc341131cb8b0a13d522ee07a083f7c89a4d1362527254656698657a7",
        "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/WolverineFx.Http.AspVersioning/WolverineFx.Http.AspVersioning.6.17.1.nupkg!!lib/net10.0/Wolverine.Http.AspVersioning.xml",
        "size": 2791,
        "type": "xml",
        "depth": 1
      },
      {
        "id": 6,
        "sha": "bb4482711390851f61cd40db6dac8bbce14f88cdf251665a10c1bb38753e8af7",
        "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/WolverineFx.Http.AspVersioning/WolverineFx.Http.AspVersioning.6.17.1.nupkg!![Content_Types].xml",
        "size": 583,
        "type": "xml",
        "depth": 1
      },
      {
        "id": 7,
        "sha": "c97cdfac9f75fe697fa5cd7982bc1cf41dc0410858a8fe30e6cb0762ce85b160",
        "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/WolverineFx.Http.AspVersioning/WolverineFx.Http.AspVersioning.6.17.1.nupkg!!package/services/metadata/core-properties/cfb20c47a9424522a5bb141026cd731e.psmdcp",
        "size": 701,
        "type": "xml",
        "depth": 1
      },
      {
        "id": 8,
        "mol": "Md",
        "sha": "e4db8f20504598ffca0cc951144c7ca51339a91de2771321aa0e2f6b4d252b73",
        "path": "WolverineFx.Http.AspVersioning@6.17.1.registry.json",
        "risk": 1,
        "size": 960,
        "type": "registry",
        "depth": 1
      }
    ],
    "omitted_files": 4,
    "rev": "b8372",
    "v": "8"
  }
}