{ "ml": { "v": "7", "eng": "2.3.0-beta.1", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.7751559, "rte": "az", "prob": 0.7751559 }, { "cls": 0, "raw": 0.09920555, "rte": "az/nupkg", "prob": 0.09920555 } ], "prob": 0.7751559, "skip": [ { "rte": "az/zip", "why": "unavailable" }, { "rte": "az/zip", "why": "unavailable" } ], "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.7751559019088745, "type": "nupkg" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.00012001395225524902, "type": "xml" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.008743494749069214, "type": "xml" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.005378752946853638, "type": "text" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.00011461973190307617, "type": "markdown" }, { "id": 5, "lvl": -1, "conf": 0, "prob": 0.00006663799285888672, "type": "png" }, { "id": 6, "lvl": -1, "conf": 0, "prob": 0.06320631504058838, "type": "pe" }, { "id": 7, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "xml" }, { "id": 8, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "xml" }, { "id": 9, "lvl": -1, "conf": 0, "prob": 0.00003331899642944336, "type": "xml" }, { "id": 10, "lvl": -1, "conf": 0, "prob": 0.00020036101341247559, "type": "registry" } ], "version": "v18.18", "analyzed_at": "2026-07-10T06:35:33Z" }, "path": "Soenneker.Extensions.ServiceCollection.4.0.215.nupkg", "raw": { "files": [ { "id": 0, "mol": "O(Al)H(Db)", "sha": "9ff804802f931fd624a628059b88c80be2d62fd2171a9398d64e14384da42902", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Soenneker.Extensions.ServiceCollection/Soenneker.Extensions.ServiceCollection.4.0.215.nupkg", "risk": 3, "size": 38189, "type": "nupkg", "facts": { "metrics": { "file": { "size": 38189.0, "entropy": 7.92, "size_bytes": 38189.0 }, "binary": { "overall_entropy": 7.92, "peak_region_bytes": 31744.0, "peak_region_entropy": 7.84 }, "archive": { "file_count": 10.0, "member_count": 10.0, "script_count": 0.0, "zip_bomb_ratio": 4.33, "directory_count": 0.0, "executable_count": 1.0, "extra_field_size": 0.0, "noise_file_count": 0.0, "total_compressed": 36803.0, "compression.ratio": 0.74, "hidden_file_count": 2.0, "total_uncompressed": 49534.0, "crc_collision_count": 0.0, "entry_comment_count": 0.0, "max_filename_length": 81.0, "rtlo_filename_count": 0.0, "format.regular_count": 10.0, "nested_archive_count": 0.0, "path_traversal_count": 0.0, "symlink_escape_count": 0.0, "security.setgid_count": 0.0, "security.setuid_count": 0.0, "security.sticky_count": 0.0, "double_extension_count": 0.0, "duplicate_member_count": 0.0, "security.symlink_count": 0.0, "unicode_filename_count": 0.0, "homoglyph_filename_count": 0.0, "security.encrypted_count": 0.0, "timing.mtime_unique_count": 4.0, "timing.mtime_unique_ratio": 0.4, "misplaced_executable_count": 1.0, "timing.mtime_dominant_count": 4.0, "timing.mtime_spread_seconds": 25166.0, "timing.sentinel_mtime_count": 0.0, "security.world_writable_count": 0.0, "timing.mtime_dominant_fraction": 0.4, "compression.method_counts.stored": 1.0, "compression.method_counts.deflate": 9.0 } } }, "ident": { "name": { "value": "Soenneker.Extensions.ServiceCollection", "source": "nupkg.title", "verified": false }, "urls": [ { "url": "https://github.com/soenneker/soenneker.extensions.servicecollection", "kind": "homepage", "source": "nupkg.project_url" }, { "url": "https://github.com/soenneker/soenneker.extensions.servicecollection", "kind": "repository", "source": "nupkg.repository_url" } ], "trust": "unsigned", "authors": [ { "name": "Jake Soenneker", "role": "author", "source": "nupkg.authors" } ], "version": { "value": "4.0.215", "source": "nupkg.version", "verified": false }, "identifier": { "value": "Soenneker.Extensions.ServiceCollection", "source": "nupkg.id", "verified": false } }, "traits": [ { "id": "micro-behaviors/data/decode/base64::dotnet-frombase64string-text", "conf": 0.8999999761581421, "crit": 3, "desc": ".NET FromBase64String reference", "from": [ { "file": 6 } ] }, { "id": "metadata/package/versioning::version-word-lower", "conf": 0.4000000059604645, "crit": 2, "desc": "version word (lowercase)", "from": [ { "file": 6 } ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "from": [ { "file": 6 } ] }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "from": [ { "file": 6 } ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "from": [ { "file": 6 } ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "from": [ { "file": 6 } ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "from": [ { "file": 6 } ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "from": [ { "file": 6 } ] }, { "id": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "conf": 1.0, "crit": 3, "desc": "JSON polymorphism runtime marker", "from": [ { "file": 6 } ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "from": [ { "file": 6 } ] } ] }, { "depth": 1, "facts": { "metrics": { "file": { "size": 528.0, "entropy": 5.16, "size_bytes": 528.0 }, "binary": { "overall_entropy": 5.16, "peak_region_bytes": 528.0, "peak_region_entropy": 5.16 } } }, "id": 1, "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Soenneker.Extensions.ServiceCollection/Soenneker.Extensions.ServiceCollection.4.0.215.nupkg!!_rels/.rels", "pid": 0, "sha": "2f5d6461832655cb2a62c16868f2bcfe227a5ca4fde50444f90721a8027f93f8", "size": 528, "type": "xml" }, { "ctx": [ { "b": "[4ls%kx}3YaA?spB7]MgjT8QkfD}SJzEWP}x(mMDb6w0teJs}sj]", "n": [ { "c": 2, "d": "NuGet nuspec manifest file", "i": "metadata/build/manifest::nuspec-file", "o": 0, "z": 45, "cf": 0.9800000190734863 } ], "ln": 1, "addr": 0 }, { "b": "jAa.syHH\u003c!aB4:tzGv@+xMOuniXJdcv}YB\u003cvrj5rx\u003e8g4B8LVje[n*pfk$ufyHH\u003c\u0026zF7QTfFLvpfF$I3B-RIkv\u003eJ1EwfKh", "ln": 2, "addr": 42 }, { "b": "arS^-wPRu\u003evrt{w", "ln": 3, "addr": 118 }, { "b": "arR^Hjy-qGD2^RixMMB9z/x#xx\u003eIa3aI$92gb7EveIY1nhxUR2yH[R!z!i*7wOU\u003c$jtgh.AcVFrxj#xJ", "ln": 14, "addr": 678 }, { "b": "arR^HjAL1AB3seWBy/uhx(v)gaAIamC4\u003eC$v@Dg1wN/*@z/cXeCYWImB7]MgazC[dA=#ebwN/T{y?m9#x(v(iB7Gxnx\u003e7Z:z!%l3v@#B6zGxxlBy/uhx(v(iv@(r(A=rdiz//(dBrC6ratdLyBuzi#vp%TB", "ln": 15, "addr": 743 }, { "b": "arR^HjAt1Lz/YSmz/QaCBA}?pjTaJMBrR\u0026IA+)(.xMOunB2\u003e%cxk8E3BZ=$kz/4dGz!i*7wOU\u003c$flq5yzF\u003c33wPxzmCYWImB7]MgB1RJBA=#ebwN/T{y?m9#x(v(kayYw1zEWuyb5H+5zxZikz/6u9BuH*8iwAJKfF)h]gCHQziBU0dhdZnNgI5H4v(4ZNh!1NKgDdcGi5SJoatk[", "n": [ { "c": 2, "d": "NuGet package declares repository", "i": "metadata/package/files/nuget::nuspec-repository", "o": 872, "z": 118, "cf": 0.8999999761581421 } ], "ln": 16, "addr": 868 }, { "b": "arR^Hjy\u00262xwO#3\u0026zEWx(B3o", "n": [ { "c": 2, "d": "NuGet package declares dependencies", "i": "metadata/package/files/nuget::nuspec-dependencies", "o": 1040, "z": 242, "cf": 0.8999999761581421 } ], "ln": 17, "addr": 1036 }, { "b": "arR^HarS^VA=l8taAR4jxjVfOA:-/@Cw?IqjTa=PBtkE4fD@W", "ln": 18, "addr": 1055 }, { "b": "arR^HarR^Hjy\u00262xwO#3\u0026zEW@mx\u003efvJl33#$r+lq)x(v)6zF7N@C4hZsC4CYnx(v(La#7=7fFk46az2!cy\u0026%o1jT9jnx(4rhl2HaED3T4xB0q.Wj]", "ln": 19, "addr": 1095 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 1600.0, "entropy": 5.0, "size_bytes": 1600.0 }, "binary": { "overall_entropy": 5.0, "peak_region_bytes": 1600.0, "peak_region_entropy": 4.98 } } }, "id": 2, "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Soenneker.Extensions.ServiceCollection/Soenneker.Extensions.ServiceCollection.4.0.215.nupkg!!Soenneker.Extensions.ServiceCollection.nuspec", "pid": 0, "risk": 1, "sha": "48a8d8be72be53feaa4282325229839ceb8ffd3b5e563fdcf5f9cb0e8f014013", "size": 1600, "traits": [ { "id": "metadata/package/files/nuget::nuspec-dependencies", "conf": 0.8999999761581421, "crit": 2, "desc": "NuGet package declares dependencies", "spans": [ [ 1040, 242 ] ] }, { "id": "metadata/package/files/nuget::nuspec-repository", "conf": 0.8999999761581421, "crit": 2, "desc": "NuGet package declares repository", "spans": [ [ 872, 118 ] ] }, { "id": "metadata/build/manifest::nuspec-file", "conf": 0.9800000190734863, "crit": 2, "desc": "NuGet nuspec manifest file", "spans": [ [ 0, 45 ] ] } ], "type": "xml" }, { "depth": 1, "facts": { "metrics": { "file": { "size": 1074, "entropy": 5.12 }, "binary": { "peak_region_bytes": 1024, "peak_region_entropy": 5.12 } } }, "id": 3, "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Soenneker.Extensions.ServiceCollection/Soenneker.Extensions.ServiceCollection.4.0.215.nupkg!!LICENSE", "pid": 0, "risk": 1, "sha": "b62828e034a362e03609738a440f8f486ffcce4970f0f1eb958cbd99be8c8a7b", "size": 1074, "traits": [ { "id": "metadata/permission/prose::permission-permission-term-english", "conf": 0.9, "crit": 2, "desc": "Permission or access term", "spans": [ [ 51, 0 ] ] } ], "type": "text" }, { "id": 4, "sha": "a0d8a06bf33eacb72e4a11336240b3c182af0d715eaed62cd692f009d70aa349", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Soenneker.Extensions.ServiceCollection/Soenneker.Extensions.ServiceCollection.4.0.215.nupkg!!README.md", "size": 1153, "type": "markdown", "depth": 1 }, { "id": 5, "sha": "93511e8937b27717eb154ee90eaf1655d4dbbad2865ecfc5a7d0bd794c945c49", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Soenneker.Extensions.ServiceCollection/Soenneker.Extensions.ServiceCollection.4.0.215.nupkg!!icon.png", "size": 16083, "type": "png", "depth": 1 }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J\u0026m(0ji6Sa?d", "n": [ { "c": 3, "d": "HTTP fingerprinting evasion campaign", "i": "objectives/command-and-control/infrastructure/user-agent::http-fingerprinting-campaign", "o": 0, "z": 34, "cf": 0.8999999761581421 } ], "ln": 0 }, { "b": "0000000000000000000096\u003cM800000nb@R\u00260SSx7M)hOhp-GDn0rr91000000000000", "n": [ { "c": 1, "d": "PE standard code/data section", "i": "metadata/binary/section/names::pe-code-data-standard-section", "o": 512, "z": 5, "cf": 0.8999999761581421 } ], "ln": 496 }, { "b": "000uLFcM5O1BSPp017gQlq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn", "n": [ { "c": 3, "d": "Recognized PE anti-analysis marker", "i": "objectives/anti-analysis/debugger-detect/combined-checks::evasion-aware-recognized-pe-marker", "o": 1432, "z": 4, "cf": 1.0 } ], "ln": 1416 }, { "b": "B7]MgB1QykA+PA7090#:mSJA:lsB}Dhz!uOA+PA708drz08)DHx(4Z20b2\u003e+uRC3Gxlm!!q/uk+zE)P{", "n": [ { "c": 3, "d": "Base64 decoding behavior", "i": "micro-behaviors/data/decode/base64::base64-decoding", "o": 5012, "z": 16, "cf": 0.949999988079071 } ], "ln": 4996 }, { "b": "wPz%dv}w2Cy\u00260V)BzkVhe[w^m08[e:By/p?l32$zvqV6hy\u002613ll2H%zA+Pf2zu9QS", "n": [ { "c": 3, "d": "References Windows executable or script", "i": "objectives/execution/interpreter/script/shell::windows-executable-ref", "o": 5090, "z": 4, "cf": 0.6000000238418579 } ], "ln": 5074 }, { "b": "zuaf+zF0P}B-H]jx(v\u003e?q*ACawO\u003c50wQ5qHn][]*e(Mt4x\u003c\u003e*(Dsp]fz/bLHx\u003e8g4B8LVje\u003e72bwO#N6", "n": [ { "c": 3, "d": "JSON polymorphism runtime marker", "i": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "o": 5254, "z": 16, "cf": 1.0 } ], "ln": 5238 }, { "b": "zE^r@v%HT-ygQ)%x(v\u003e?q*ACawO\u003c4$wOb:\u0026v@#B6zu9QNwO#x%yH}Jsmr\u0026]=zGxJgzGvBewPz%dv}w2CyY", "n": [ { "c": 2, "d": "Benign high-entropy PE context", "i": "metadata/package/quality/false-positives::benign-high-entropy-pe-context", "o": 5326, "z": 17, "cf": 0.949999988079071 } ], "ln": 5310 }, { "b": "A::67z/e0*v}xR3x(v\u003e?q*ACawO\u003c50wQ5qHn][]*08^xIB-Iv1zVA7AA4Ug5A=U@kzFs03e\u003ey8az#:@\u003c", "n": [ { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 5475, "z": 16, "cf": 0.8500000238418579 } ], "ln": 5459 }, { "b": "07pycB.tu3zF8WZwmY/Zq*ACawO\u003c4#wN/\u003e6x([RMlVND\u003eBz\u003e/jvq][9e)6$+iyvv#Bzku3v{%E\u003cA@Yb", "n": [ { "c": 2, "d": "System namespace reference", "i": "metadata/lang/compiler/managed::system-namespace", "o": 5949, "z": 15, "cf": 0.800000011920929 } ], "ln": 5933 }, { "b": "Bo2$OzVBqFA@VgRve$lDx-GZ+B]V7NASydXx-J5Kzu6Y/ZE50t0ce6X08JVl0bITH0aM0", "n": [ { "c": 3, "d": "Recognized sparse-logic binary marker", "i": "objectives/anti-analysis/vm-detect/instruction::sparse-logic-recognized-marker", "o": 6846, "z": 7, "cf": 0.800000011920929 } ], "ln": 6830 }, { "b": "0rrv5wO+{^B7CsKdGGI}lVl{?A+Pf1BrFD1atLSah7ZNqgbZmEvqxA%q/uk+zE)P{ASu890r", "n": [ { "c": 2, "d": "Copyright notice", "i": "metadata/package/license::copyright-word", "o": 8244, "z": 9, "cf": 0.6000000238418579 } ], "ln": 8228 }, { "b": "00000000000000000000000000000000000000315c8Xg7YTL^00000000000000000", "n": [ { "c": 1, "d": "PE resource section", "i": "metadata/binary/section/names::pe-resource-section", "o": 9216, "z": 5, "cf": 0.8999999761581421 } ], "ln": 9200 }, { "b": "0000000000000c9gYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006Xn[brp!0rr911onA", "n": [ { "c": 3, "d": "Recognized marker for timing checks", "i": "objectives/anti-analysis/timing/evasion::timing-anti-debug-recognized-marker", "o": 9310, "z": 15, "cf": 0.949999988079071 } ], "ln": 9294 }, { "b": "zVBqFA@Vgu002W)761vnlJz38z2!IPve$fBC(QOtve$cAwDhYg003WjBo3y.z#:}ViSH/kf934", "n": [ { "c": 2, "d": "PE CompanyName metadata field", "i": "metadata/package/versioning::pe-companyname-field", "o": 9678, "z": 11, "cf": 0.699999988079071 } ], "ln": 9662 }, { "b": "e=YwYzVBRO004fxcJBeEmGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up002{$zVBtGzuaLOwDlG", "n": [ { "c": 2, "d": "PE FileDescription metadata field", "i": "metadata/package/versioning::pe-filedescription-field", "o": 9754, "z": 15, "cf": 0.699999988079071 } ], "ln": 9738 }, { "b": "x-J5Kzu6Up001?Q3ig8bmGvc5yYF2DrSDXhASydXx-J5Kzu6Up001?Qe=WN9e=WTbf-T6he=WN9004fxd/YOInDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE002{$zVBtGzuaLOwDlGCwDl-J", "n": [ { "c": 3, "d": "Dotted-quad PE version metadata marker", "i": "objectives/command-and-control/infrastructure/ip::ipv4-version-metadata-marker", "o": 9874, "z": 11, "cf": 0.9399999976158142 }, { "c": 2, "d": "PE InternalName metadata field", "i": "metadata/package/versioning::pe-internalname-field", "o": 9926, "z": 12, "cf": 0.699999988079071 } ], "ln": 9858 }, { "b": "yxd]CASu7t004DFd/YOIpxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE002{$zVBtGzuaLOwDlGC", "n": [ { "c": 2, "d": "PE OriginalFilename metadata field", "i": "metadata/package/versioning::pe-originalfilename-field", "o": 10158, "z": 16, "cf": 0.699999988079071 } ], "ln": 10142 }, { "b": "wb{ACyYBCn003)pcJBeEpYLIozVBqFBPt[KBo25ove$cAwDhYg002{$zVBtGzuaLOwDlGCwDl-", "n": [ { "c": 2, "d": "PE ProductName metadata field", "i": "metadata/package/versioning::pe-productname-field", "o": 10286, "z": 11, "cf": 0.699999988079071 } ], "ln": 10270 }, { "b": "x-J5Kzu6Up004-Nf-RjOpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001?Qe=WN9e=WTbf-T6hd/.yairg=lirg]pfAr{fve@7-gxocff-TfkiriH*irh2sh2}g/v/Op+gxp$^hVLVmv/Op+w=KT/hVNp!gxm", "n": [ { "c": 2, "d": "PE ProductVersion has SemVer git hash", "i": "metadata/package/versioning::pe-productversion-semver-git-hash", "o": 10428, "z": 48, "cf": 0.8999999761581421 }, { "c": 2, "d": "PE version resource metadata", "i": "metadata/package/versioning::version-resource-metadata", "o": 10398, "z": 14, "cf": 0.8999999761581421 } ], "ln": 10382 }, { "b": "0000000000000000000006*I:3\u0026*ncjtu*o000000000000000000000000000000000", "n": [ { "c": 2, "d": "PE .reloc section presence", "i": "metadata/binary/section/names::reloc-section-presence", "o": 10752, "z": 6, "cf": 0.8999999761581421 } ], "ln": 10736 } ], "depth": 1, "facts": { "imp": [ [ "mscoree", "CorDllMain" ] ], "sec": [ [ ".text", 512, 8704, 5.59, "r-x" ], [ ".rsrc", 9216, 1536, 3.07, "r--" ], [ ".reloc", 10752, 512, 0.08, "r--" ] ], "metrics": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "resource_count": 1.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 73481.0, "reloc_overhang_bytes": 500.0, "reloc_overhang_ratio": 0.98, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "version.identity_entropy": 3.94, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0, "version.identity_symbol_ratio": 0.08 }, "file": { "size": 11264.0, "entropy": 5.06, "size_bytes": 11264.0 }, "binary": { "is_pie": 1.0, "code_entropy": 5.59, "string_count": 191.0, "overall_entropy": 5.06, "entropy_variance": 5.07, "avg_string_length": 22.32, "max_string_length": 108.0, "peak_region_bytes": 4096.0, "code_to_data_ratio": 1.0, "peak_region_entropy": 5.26, "string_length_stddev": 15.78, "largest_section_ratio": 0.77, "sentence_string_count": 8.0, "sentence_string_ratio": 0.04, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 8704.0, "entropy_max": 5.59, "entropy_mean": 2.91, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } } }, "id": 6, "mol": "O(Al)H(Db)", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Soenneker.Extensions.ServiceCollection/Soenneker.Extensions.ServiceCollection.4.0.215.nupkg!!lib/net10.0/Soenneker.Extensions.ServiceCollection.dll", "pid": 0, "risk": 3, "sha": "48dd09852dd986f63c6d97ff4f7baaf3055019752cefe51513f358e1ca39478b", "size": 11264, "traits": [ { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 9310, 15 ] ] }, { "id": "micro-behaviors/data/decode/base64::dotnet-frombase64string-text", "conf": 0.8999999761581421, "crit": 3, "desc": ".NET FromBase64String reference", "spans": [ [ 5012, 16 ] ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "spans": [ [ 9874, 11 ] ] }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "spans": [ [ 0, 26 ] ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "spans": [ [ 1432, 4 ] ] }, { "id": "metadata/package/versioning::version-word-lower", "conf": 0.4000000059604645, "crit": 2, "desc": "version word (lowercase)", "spans": [ [ 6846, 7 ] ] }, { "id": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "conf": 1.0, "crit": 3, "desc": "JSON polymorphism runtime marker", "spans": [ [ 5254, 16 ] ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "spans": [ [ 5090, 4 ] ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "spans": [ [ 10398, 14 ] ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "spans": [ [ 1432, 4 ] ] } ], "type": "pe" }, { "id": 7, "sha": "509beb3aae9a9be0d76d28e028c21ebe6e4f38d6f084fa0c51af121f1d7b7995", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Soenneker.Extensions.ServiceCollection/Soenneker.Extensions.ServiceCollection.4.0.215.nupkg!!lib/net10.0/Soenneker.Extensions.ServiceCollection.xml", "size": 3347, "type": "xml", "depth": 1 }, { "id": 8, "sha": "63feef730c8c6225c83eeeb608a1575fcac22006897782d889c10c4310523657", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Soenneker.Extensions.ServiceCollection/Soenneker.Extensions.ServiceCollection.4.0.215.nupkg!![Content_Types].xml", "size": 712, "type": "xml", "depth": 1 }, { "id": 9, "sha": "a126643b02104147acdf04ad31e981520d93284220a42c26c57b740fd2702808", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Soenneker.Extensions.ServiceCollection/Soenneker.Extensions.ServiceCollection.4.0.215.nupkg!!package/services/metadata/core-properties/4c250e46429b471bb0a149f94e42fe0f.psmdcp", "size": 790, "type": "xml", "depth": 1 }, { "ctx": [ { "b": "DM)3hz/ZhBBy/qkiWeD:xjVfeefX$uzdK[Lb2-z\u003ezF\u003c33wPxy(CYWImB7]MgB1Qy5A=#ebwKyxLy?m9#x(v(kefYmGA=U@kzx.a=", "n": [ { "c": 3, "d": "Registry release under 7 days old", "i": "metadata/registry::freshly-published", "o": 0, "z": 24, "cf": 1.0 } ], "ln": 0 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 1013.0, "entropy": 4.88, "size_bytes": 1013.0 }, "binary": { "overall_entropy": 4.88, "peak_region_bytes": 1013.0, "peak_region_entropy": 4.88 }, "registry": { "age_days": 0.0, "maintainers": 1.0, "published_at": 1783659781.0, "releases_24h": 1.0, "releases_48h": 1.0, "is_deprecated": 0.0, "release_count": 209.0, "downloads_total": 40074.0, "version_removed": 0.0, "package_age_days": 466.0, "first_published_at": 1743350133.0, "vulnerability_count": 0.0, "previous_published_at": 1783126902.0, "days_since_previous_release": 6.0 } } }, "id": 10, "mol": "Md", "path": "Soenneker.Extensions.ServiceCollection@4.0.215.registry.json", "pid": 0, "rel": "registry", "risk": 1, "role": "sidecar", "sha": "c810e85914f287a60cd76500ff832e26319d74b9db88271727988c24206e0c78", "size": 1013, "traits": [ { "id": "metadata/registry::freshly-published", "conf": 1.0, "crit": 3, "desc": "Registry release under 7 days old", "spans": [ [ 0, 24 ] ] } ], "type": "registry" } ], "omitted_files": 5, "rev": "e6071", "v": "8" } }