{ "ml": { "v": "7", "eng": "2.3.0-beta.1", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.47187454, "rte": "az", "prob": 0.47187454 }, { "cls": 0, "raw": 0.13577136, "rte": "az/nupkg", "prob": 0.13577136 } ], "prob": 0.47187454, "skip": [ { "rte": "az/zip", "why": "unavailable" }, { "rte": "az/zip", "why": "unavailable" } ], "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.47187453508377075, "type": "nupkg" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.00012001395225524902, "type": "xml" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.012121975421905518, "type": "xml" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.3861871659755707, "type": "pe" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.3861871659755707, "type": "pe" }, { "id": 5, "lvl": -1, "conf": 0, "prob": 0.000041097402572631836, "type": "xml" }, { "id": 6, "lvl": -1, "conf": 0, "prob": 0.00012001395225524902, "type": "xml" }, { "id": 7, "lvl": -1, "conf": 0, "prob": 0.00020629167556762695, "type": "registry" } ], "version": "v18.18", "analyzed_at": "2026-07-11T04:23:45Z" }, "path": "MDriven.WPFViewModelExternalControls.core.7.2.0.17427.nupkg", "raw": { "files": [ { "id": 0, "mol": "O(C)H(Os)", "sha": "a108271db1f2dbd2c9e2f6050f1de3ae7cd0777282b75862bb9481abfc336940", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/MDriven.WPFViewModelExternalControls.core/MDriven.WPFViewModelExternalControls.core.7.2.0.17427.nupkg", "risk": 3, "size": 51159, "type": "nupkg", "facts": { "metrics": { "file": { "size": 51159.0, "entropy": 7.96, "size_bytes": 51159.0 }, "binary": { "overall_entropy": 7.96, "peak_region_bytes": 47104.0, "peak_region_entropy": 7.82 }, "archive": { "file_count": 7.0, "member_count": 7.0, "script_count": 0.0, "zip_bomb_ratio": 4.17, "directory_count": 0.0, "executable_count": 2.0, "extra_field_size": 0.0, "noise_file_count": 0.0, "total_compressed": 50013.0, "compression.ratio": 0.49, "hidden_file_count": 2.0, "total_uncompressed": 103036.0, "crc_collision_count": 0.0, "entry_comment_count": 0.0, "max_filename_length": 81.0, "rtlo_filename_count": 0.0, "format.regular_count": 7.0, "nested_archive_count": 0.0, "path_traversal_count": 0.0, "symlink_escape_count": 0.0, "security.setgid_count": 0.0, "security.setuid_count": 0.0, "security.sticky_count": 0.0, "double_extension_count": 0.0, "duplicate_member_count": 0.0, "security.symlink_count": 0.0, "unicode_filename_count": 0.0, "homoglyph_filename_count": 0.0, "security.encrypted_count": 0.0, "timing.mtime_unique_count": 4.0, "timing.mtime_unique_ratio": 0.57, "misplaced_executable_count": 2.0, "timing.mtime_outlier_count": 3.0, "timing.mtime_dominant_count": 4.0, "timing.mtime_spread_seconds": 32062.0, "timing.sentinel_mtime_count": 0.0, "security.world_writable_count": 0.0, "timing.mtime_dominant_fraction": 0.57, "compression.method_counts.stored": 1.0, "compression.method_counts.deflate": 6.0 } } }, "ident": { "name": { "value": "MDriven.WPFViewModelExternalControls.core", "source": "nupkg.title", "verified": false }, "trust": "unsigned", "authors": [ { "name": "MDriven.WPFViewModelExternalControls.core", "role": "author", "source": "nupkg.authors" } ], "version": { "value": "7.2.0.17427", "source": "nupkg.version", "verified": false }, "identifier": { "value": "MDriven.WPFViewModelExternalControls.core", "source": "nupkg.id", "verified": false } }, "traits": [ { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "from": [ { "file": 3 } ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "from": [ { "file": 3 } ] }, { "id": "metadata/package/versioning::semver-pattern", "conf": 0.699999988079071, "crit": 2, "desc": "Semantic version pattern", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "from": [ { "file": 3 } ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "from": [ { "file": 3 }, { "file": 4 } ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "from": [ { "file": 3 } ] }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "from": [ { "file": 3 } ], "spans": [ [ 0, 26 ] ] }, { "id": "micro-behaviors/os/clipboard/access::dotnet-clipboard-class", "conf": 0.8500000238418579, "crit": 3, "desc": "Clipboard class or symbol reference", "from": [ { "file": 3 } ] }, { "id": "objectives/command-and-control/infrastructure/domain/malicious::http-url-binary", "atk": "T1071.001", "mbc": "C0002", "conf": 0.699999988079071, "crit": 3, "desc": "Network URL with domain name (binary)", "from": [ { "file": 3 } ] }, { "id": "metadata/binary/debug::pdb-visual-studio", "crit": 3, "desc": "Visual Studio build path", "spans": [ [ 40520, 144 ] ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "from": [ { "file": 3 } ] } ] }, { "depth": 1, "facts": { "metrics": { "file": { "size": 535.0, "entropy": 5.25, "size_bytes": 535.0 }, "binary": { "overall_entropy": 5.25, "peak_region_bytes": 535.0, "peak_region_entropy": 5.25 } } }, "id": 1, "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/MDriven.WPFViewModelExternalControls.core/MDriven.WPFViewModelExternalControls.core.7.2.0.17427.nupkg!!_rels/.rels", "pid": 0, "sha": "1099547717c1a88f6d9f32236ea195c1498d1898455f855b60fd7f9d1ebdbf23", "size": 535, "type": "xml" }, { "ctx": [ { "b": "[4ls%kx}3YaA?spB7]MgjT8QkfD}SJzEWP}x(mMDb6w0teJs}sj]", "n": [ { "c": 2, "d": "NuGet nuspec manifest file", "i": "metadata/build/manifest::nuspec-file", "o": 0, "z": 48, "cf": 0.9800000190734863 } ], "ln": 1, "addr": 0 }, { "b": "jAa.syHH\u003c!aB4:tzGv@+xMOuniXJdcv}YB\u003cvrj5rx\u003e8g4B8LVje[n*pfk$ufyHH\u003c\u0026zF7QTfFLvpfF$I3B-RIkv\u003eJ1EwfKh", "ln": 2, "addr": 43 }, { "b": "arS^-wPRu\u003evrt{w", "ln": 3, "addr": 120 }, { "b": "arR^HjyJwOxM4{jk21B=x)a69e($\u003esr+Vb?o(BMNy^\u0026O\u003cwPzV%y^SbUBAhqoB1Q%vA+du^vrDW9z/P[.", "ln": 6, "addr": 226 }, { "b": "arR^Hjy\u00262Av@=p5BzkVhk2tV$yHH\u003c!avG^Zv@=p5BzkVhjtgkRB7ol8Acb/jzAX", "ln": 7, "addr": 292 }, { "b": "arR^HjAt1Lz/YSmz/QaCBA}?pjTaJMBrR?Xj]", "n": [ { "c": 2, "d": "NuGet package declares repository", "i": "metadata/package/files/nuget::nuspec-repository", "o": 348, "z": 17, "cf": 0.8999999761581421 } ], "ln": 8, "addr": 344 }, { "b": "arR^Hjy\u00262xwO#3\u0026zEWx(B3o", "n": [ { "c": 2, "d": "NuGet package declares dependencies", "i": "metadata/package/files/nuget::nuspec-dependencies", "o": 379, "z": 894, "cf": 0.8999999761581421 } ], "ln": 9, "addr": 375 }, { "b": "arR^HarS^VA=l8taAR4jxjVfOA:-/@Cw?IqjT8HNmn#-%vqPO1z/PRIe\u0026Lyrb0C", "ln": 10, "addr": 395 }, { "b": "arR^HarR^Hjy\u00262xwO#3\u0026zEW@mx\u003efvJo*\u003c2oC4CLznmuyDy?mVuzE)]*Byx5$vrb)5aA?spB7]MgjT8*qga\u003emkf/H{AhZfwQCW\u003eMjwmW[FluN0UwgQ2:vqHjnwPz\u0026oatk[", "ln": 11, "addr": 447 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 2300.0, "entropy": 5.14, "size_bytes": 2300.0 }, "binary": { "overall_entropy": 5.14, "peak_region_bytes": 2300.0, "peak_region_entropy": 5.11 } } }, "id": 2, "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/MDriven.WPFViewModelExternalControls.core/MDriven.WPFViewModelExternalControls.core.7.2.0.17427.nupkg!!MDriven.WPFViewModelExternalControls.core.nuspec", "pid": 0, "risk": 1, "sha": "be9afd69b115345af31e1b19ea4173c33e311e760e0ae0b129a2a4d8374b32a8", "size": 2300, "traits": [ { "id": "metadata/build/manifest::nuspec-file", "conf": 0.9800000190734863, "crit": 2, "desc": "NuGet nuspec manifest file", "spans": [ [ 0, 48 ] ] }, { "id": "metadata/package/files/nuget::nuspec-repository", "conf": 0.8999999761581421, "crit": 2, "desc": "NuGet package declares repository", "spans": [ [ 348, 17 ] ] }, { "id": "metadata/package/files/nuget::nuspec-dependencies", "conf": 0.8999999761581421, "crit": 2, "desc": "NuGet package declares dependencies", "spans": [ [ 379, 894 ] ] } ], "type": "xml" }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J\u0026m(0ji6Sa?dLD+(", "n": [ { "c": 3, "d": "HTTP fingerprinting evasion campaign", "i": "objectives/command-and-control/infrastructure/user-agent::http-fingerprinting-campaign", "o": 0, "z": 34, "cf": 0.8999999761581421 } ], "ln": 0 }, { "b": "00000000000000000000*}iQ!00000nb@R\u00260SSx7FkDpDQ/^V$2(\u003c@900000b=Z[B\u003eL", "n": [ { "c": 1, "d": "PE standard code/data section", "i": "metadata/binary/section/names::pe-code-data-standard-section", "o": 512, "z": 5, "cf": 0.8999999761581421 } ], "ln": 496 }, { "b": "00ijGq2*O0z.?v[1]{aMlq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn", "n": [ { "c": 3, "d": "Recognized PE anti-analysis marker", "i": "objectives/anti-analysis/debugger-detect/combined-checks::evasion-aware-recognized-pe-marker", "o": 13184, "z": 4, "cf": 1.0 } ], "ln": 13168 }, { "b": "A=k]dA==O3wPRu\u003evrt]Tzf6i9A+]D008[e:By/qwlVl^SwN/*@z/fRGm}DNHA+P1-C5pZ?", "n": [ { "c": 2, "d": "mscorlib reference", "i": "metadata/lang/compiler/managed::mscorlib", "o": 21841, "z": 8, "cf": 0.8999999761581421 } ], "ln": 21825 }, { "b": "y?mVuzE)]*Byx5$vrb(UlU{EQvSbW}wb]nlD17Y2A+2eSAct:(qE%/-vpJ\u003cGnL-\u0026jq!o#)x-", "n": [ { "c": 3, "d": "Clipboard class or symbol reference", "i": "micro-behaviors/os/clipboard/access::dotnet-clipboard-class", "o": 22727, "z": 9, "cf": 0.8500000238418579 } ], "ln": 22711 }, { "b": "zEEuGz/fVqz!%FEv@Dy0e[w^m08)#+y?lyWwKy3ByYD\u003ewp*[A!wKy3ByYD\u003ewlUg7I", "n": [ { "c": 3, "d": "References Windows executable or script", "i": "objectives/execution/interpreter/script/shell::windows-executable-ref", "o": 25239, "z": 4, "cf": 0.6000000238418579 } ], "ln": 25223 }, { "b": "vmLuLwjp3yBu%zUx(v\u003e?q*ACawO\u003c4$wOb:\u0026v@#B6zu9mIwO\u003c!My\u00260V)BzkVh07gWvB.#1:wObT]x([6czu", "n": [ { "c": 2, "d": "Benign high-entropy PE context", "i": "metadata/package/quality/false-positives::benign-high-entropy-pe-context", "o": 25855, "z": 17, "cf": 0.949999988079071 } ], "ln": 25839 }, { "b": "oj-xqC4CMknmuyDy?mR!q*ACawO\u003c4!z!9AEz/49]z/6Dcy?mR!mpQmmwPz%dv}whxy\u0026A%a0b#v!vqPN$wPv=(wPRn", "n": [ { "c": 3, "d": ".NET dynamic code generation capability", "i": "metadata/lang/compiler/managed::dotnet-dynamic-code", "o": 26501, "z": 23, "cf": 0.8500000238418579 } ], "ln": 26485 }, { "b": "z/L?gv@#Tf04}+\u003eBz(g1nKEAkAbPS9zGFl:zF\u003c2}Bz(g1nKESwBz(1}D2Ns.wPIv4x(FfjASw{Rz/xodBA{m", "n": [ { "c": 1, "d": "Regex component marker", "i": "objectives/persistence/login/scheduled-task/com::task-scheduler-builder-methods--rx-1", "o": 26739, "z": 19, "cf": 0.8999999761581421 } ], "ln": 26723 }, { "b": "v@?Ssv@A$#wPz%dv}xYYq*ACawO\u003c4$B-8qnzdLs\u003ezGGDgz/wS^A=#ebwPE\u0026ID2[7sz7X.ezGGPfwIct*ze:i9wPyZXA=#ebwPE", "n": [ { "c": 3, "d": "Packed binary marker", "i": "objectives/anti-static/obfuscation/eval/loader::packed-binary-marker", "o": 26839, "z": 30, "cf": 0.8500000238418579 } ], "ln": 26823 }, { "b": "wPhi#wmYT*C#4):wN//Zq*ACawO\u003c53x(mE1CxkxhvrcdaA4TZHz/6DizE)ZclVl\u003cWwN/?2AXoZ$zF\u003c2}Bo2V-wQcTYy^.#EBo2VTz!}*Qv@}YTv@DfRwQcWTv/", "n": [ { "c": 1, "d": "Regex component marker", "i": "objectives/persistence/login/scheduled-task/com::task-scheduler-builder-methods--rx-1", "o": 28277, "z": 49, "cf": 0.8999999761581421 } ], "ln": 28261 }, { "b": "0rrv0l#)0+wO}FF9@#uWlVl{?A+Pf1Brz#wdiHx1gbHaFl#)0+wO}FFdGGI}o*\u003c2oC4CLlx-", "n": [ { "c": 2, "d": "Copyright notice", "i": "metadata/package/license::copyright-word", "o": 35619, "z": 9, "cf": 0.6000000238418579 } ], "ln": 35603 }, { "b": "0rr910003100000o-Ukle(1\u0026mmSI{OwP@6kyB\u0026H$A=U@kzASe1e\u0026Lyr0ru7e6H)aKzdN{fA+!6SB8U@7C$}^+wFu:(mn$y0", "n": [ { "c": 3, "d": "Recognized sparse-logic binary marker", "i": "objectives/anti-analysis/vm-detect/instruction::sparse-logic-recognized-marker", "o": 35758, "z": 6, "cf": 0.800000011920929 } ], "ln": 35720 }, { "b": "b[x$Q=DtQ\u00260rr91KPkvYy/tR2By/qwqE%]/B-H#6B1Qv4B8Mhwv}wLHvpS}\u0026efF!Jv@Dy7x\u003c@Ror+lq)x(v(Lg+HEmfFk4gavyo/BAIRnj-j?NBAg/aefE=ivR/:*oj-xFz!\u0026{4jZ{uevkRKLhzEiFg?wv2iu}EFB97#ge(Dn4z/{8gwPGF4B-8qnzdMQRB8Mhwv}wOIBohBx00ri30000008L%H", "n": [ { "c": 2, "d": "mscorlib reference", "i": "metadata/lang/compiler/managed::mscorlib", "o": 36148, "z": 128, "cf": 0.8999999761581421 } ], "ln": 36132 }, { "b": "05T\u0026U000Ge000Z90=qBexMOuniXJdcv}YB\u003cvrj5tAaJ{izer*5A=2lbB1RxKxd[agA+//peN@ZoAa9\u003c5vRGT)BA]I{fFCx/0096300J", "n": [ { "c": 3, "d": "Network URL with domain name (binary)", "i": "objectives/command-and-control/infrastructure/domain/malicious::http-url-binary", "o": 37206, "z": 34, "cf": 0.699999988079071 } ], "ln": 37190 }, { "b": ":\u003eJ{?YrTP.EqS}I0rr91v(^\u003e8vq]T:y?lyKygQ)%B7foay?bpPf/JuUz/{8gwN4@FwnDo\u003es5qv!x\u003eqG.z!9A}mr\u0026]=A=br4lVl\u003c:A=k=ne[n*uwN6d.yfTervS=r*zE)]Dh.[Sjl#)0+wO%b4p!1G1wP{\u003c!wmYNCCYWIqzEEuGz/fVqz!%FEv@Dy0e]Uug08(AOgbQ@\u0026:sFAX:\u003eJ{?YrTP.EqS}IMF09oys0zd", "n": [ { "c": 3, "d": "Visual Studio build path", "i": "metadata/binary/debug::pdb-visual-studio", "o": 40440, "z": 136, "cf": 0.5 } ], "ln": 40424 }, { "b": "00000000000000000000000000000000000000315c8Xg7YTL^00000000000000000", "n": [ { "c": 1, "d": "PE resource section", "i": "metadata/binary/section/names::pe-resource-section", "o": 40960, "z": 5, "cf": 0.8999999761581421 } ], "ln": 40944 }, { "b": "0000000000001nEgYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006Xn[brp!0rrf32lkz", "n": [ { "c": 3, "d": "Recognized marker for timing checks", "i": "objectives/anti-analysis/timing/evasion::timing-anti-debug-recognized-marker", "o": 41054, "z": 15, "cf": 0.949999988079071 } ], "ln": 41038 }, { "b": "fAr{fvGn7Z001[S3JHhclJz38z2!IPve$fBC(QOtve$cAwDhYg002Z[l\u0026.lcx-JqRwDlPFaojXcli3#=003Ed9rl9umGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up00372pYJ@+rSD?lwDl]", "n": [ { "c": 2, "d": "PE CompanyName metadata field", "i": "metadata/package/versioning::pe-companyname-field", "o": 41274, "z": 11, "cf": 0.699999988079071 }, { "c": 2, "d": "PE FileDescription metadata field", "i": "metadata/package/versioning::pe-filedescription-field", "o": 41330, "z": 15, "cf": 0.699999988079071 } ], "ln": 41258 }, { "b": "zVBONA@Vgu001$U3\u0026*qdmGvc5yYF2DrSDXhASydXx-J5Kzu6Up001}Te=WTbe=WN9e=WQahVLVmg5%lk004xDe=U[LnDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE002Z[l\u0026.lcx-JqRwDlPFe=X@M", "n": [ { "c": 3, "d": "Dotted-quad PE version metadata marker", "i": "objectives/command-and-control/infrastructure/ip::ipv4-version-metadata-marker", "o": 41430, "z": 11, "cf": 0.9399999976158142 }, { "c": 2, "d": "PE InternalName metadata field", "i": "metadata/package/versioning::pe-internalname-field", "o": 41486, "z": 12, "cf": 0.699999988079071 } ], "ln": 41414 }, { "b": "zu7^Vk(:jK004VLe=U[Lpxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE002Z[l\u0026.lcx-JqRwDlPF", "n": [ { "c": 2, "d": "PE OriginalFilename metadata field", "i": "metadata/package/versioning::pe-originalfilename-field", "o": 41818, "z": 16, "cf": 0.699999988079071 } ], "ln": 41802 }, { "b": "e=YzZyYFnK001XM2MK(9pYLIozVBqFBPt[KBo25ove$cAwDhYg002Z[l\u0026.lcx-JqRwDlPF002aY3\u0026*qdpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001}Te=WTbe=WN9e=WQahVJ", "n": [ { "c": 2, "d": "PE ProductName metadata field", "i": "metadata/package/versioning::pe-productname-field", "o": 41950, "z": 11, "cf": 0.699999988079071 }, { "c": 2, "d": "PE version resource metadata", "i": "metadata/package/versioning::version-resource-metadata", "o": 41998, "z": 14, "cf": 0.8999999761581421 } ], "ln": 41934 }, { "b": "000000000000000000000i=C63\u0026*nc@5:@V000000000000000000000000000000000", "n": [ { "c": 2, "d": "PE .reloc section presence", "i": "metadata/binary/section/names::reloc-section-presence", "o": 42496, "z": 6, "cf": 0.8999999761581421 } ], "ln": 42480 } ], "depth": 1, "facts": { "imp": [ [ "mscoree", "CorDllMain" ] ], "sec": [ [ ".text", 512, 40448, 5.78, "r-x" ], [ ".rsrc", 40960, 1536, 2.68, "r--" ], [ ".reloc", 42496, 512, 0.08, "r--" ] ], "metrics": { "pe": { "checksum": 67354.0, "checksum_valid": 1.0, "resource_count": 1.0, "has_version_info": 1.0, "computed_checksum": 67354.0, "reloc_overhang_bytes": 500.0, "reloc_overhang_ratio": 0.98, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "version.identity_entropy": 4.32, "clr.managed_resource_count": 1.0, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0, "clr.managed_resource_max_size": 3877.0, "version.identity_symbol_ratio": 0.0, "clr.managed_resource_max_entropy": 5.59 }, "file": { "size": 43008.0, "entropy": 5.63, "size_bytes": 43008.0 }, "binary": { "is_pie": 1.0, "code_entropy": 5.78, "string_count": 586.0, "overall_entropy": 5.63, "entropy_variance": 5.42, "avg_string_length": 19.04, "max_string_length": 606.0, "peak_region_bytes": 2048.0, "code_to_data_ratio": 1.0, "peak_region_entropy": 6.12, "string_length_stddev": 28.15, "largest_section_ratio": 0.94, "sentence_string_count": 18.0, "sentence_string_ratio": 0.03, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 40448.0, "entropy_max": 5.78, "entropy_mean": 2.85, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } } }, "id": 3, "mol": "O(C)H(Os)", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/MDriven.WPFViewModelExternalControls.core/MDriven.WPFViewModelExternalControls.core.7.2.0.17427.nupkg!!lib/net472/MDriven.WPFViewModelExternalControls.core.dll", "pid": 0, "risk": 3, "sha": "e3608bd22814a8a61aacdc0832581f41c6d041bb2122a8ab99682fdc10013ace", "size": 43008, "traits": [ { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "spans": [ [ 25239, 4 ] ] }, { "id": "metadata/binary/debug::pdb-visual-studio", "crit": 3, "desc": "Visual Studio build path", "spans": [ [ 40440, 136 ] ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "metadata/package/versioning::semver-pattern", "conf": 0.699999988079071, "crit": 2, "desc": "Semantic version pattern", "spans": [ [ 35758, 6 ] ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 41054, 15 ] ] }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "spans": [ [ 0, 26 ] ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "spans": [ [ 13184, 4 ] ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "spans": [ [ 41430, 11 ] ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "spans": [ [ 41998, 14 ] ] }, { "id": "objectives/command-and-control/infrastructure/domain/malicious::http-url-binary", "atk": "T1071.001", "mbc": "C0002", "conf": 0.699999988079071, "crit": 3, "desc": "Network URL with domain name (binary)", "spans": [ [ 37206, 34 ] ] }, { "id": "micro-behaviors/os/clipboard/access::dotnet-clipboard-class", "conf": 0.8500000238418579, "crit": 3, "desc": "Clipboard class or symbol reference", "spans": [ [ 22727, 9 ] ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "spans": [ [ 13184, 4 ] ] } ], "type": "pe" }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J\u0026m(0ji6Sa?dLD+(", "n": [ { "c": 3, "d": "HTTP fingerprinting evasion campaign", "i": "objectives/command-and-control/infrastructure/user-agent::http-fingerprinting-campaign", "o": 0, "z": 34, "cf": 0.8999999761581421 } ], "ln": 0 }, { "b": "00000000000000000000g}-\u003e?00000nb@R\u00260SSx7kV4HY6J\u003ezo2(\u003c@900000rh]]#2M", "n": [ { "c": 1, "d": "PE standard code/data section", "i": "metadata/binary/section/names::pe-code-data-standard-section", "o": 512, "z": 5, "cf": 0.8999999761581421 } ], "ln": 496 }, { "b": "?t^K9009Sh0000k060TL1R?1q0vv^Fc(J6=1]{aM0243*0fviY01P5f5Dz(VdGxCKz\u003cQI83mk/", "n": [ { "c": 1, "d": "DJB2 hash algorithm constant (5381)", "i": "objectives/anti-static/obfuscation/imports::djb2-hash-constant", "o": 5459, "z": 11, "cf": 0.75 } ], "ln": 5443 }, { "b": "00ijGpxgv$z.z7\u003c1]{aMlq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn", "n": [ { "c": 3, "d": "Recognized PE anti-analysis marker", "i": "objectives/anti-analysis/debugger-detect/combined-checks::evasion-aware-recognized-pe-marker", "o": 13120, "z": 4, "cf": 1.0 } ], "ln": 13104 }, { "b": "y?mVuzE)]*Byx5$vrb(UlU{EQvSbW}wb]nlD17Y2A+2eSAct:(qE%/-vpJ\u003cGnL-\u0026jq!o#)x-", "n": [ { "c": 3, "d": "Clipboard class or symbol reference", "i": "micro-behaviors/os/clipboard/access::dotnet-clipboard-class", "o": 22574, "z": 9, "cf": 0.8500000238418579 } ], "ln": 22558 }, { "b": "zEEuGz/fVqz!%FEv@Dy0e[w^m08)#+y?lyWwKy3ByYD\u003ewp*[A!wKy3ByYD\u003ewlUg7I", "n": [ { "c": 3, "d": "References Windows executable or script", "i": "objectives/execution/interpreter/script/shell::windows-executable-ref", "o": 25080, "z": 4, "cf": 0.6000000238418579 } ], "ln": 25064 }, { "b": "vmLuLwjp3yBu%zUx(v\u003e?q*ACawO\u003c4$wOb:\u0026v@#B6zu9mIwO\u003c!My\u00260V)BzkVh07gWvB.#1:wObT]x([6czu", "n": [ { "c": 2, "d": "Benign high-entropy PE context", "i": "metadata/package/quality/false-positives::benign-high-entropy-pe-context", "o": 25696, "z": 17, "cf": 0.949999988079071 } ], "ln": 25680 }, { "b": "oj-xqC4CMknmuyDy?mR!q*ACawO\u003c4!z!9AEz/49]z/6Dcy?mR!mpQmmwPz%dv}whxy\u0026A%a0b#v!vqPN$wPv=(wPRn", "n": [ { "c": 3, "d": ".NET dynamic code generation capability", "i": "metadata/lang/compiler/managed::dotnet-dynamic-code", "o": 26384, "z": 23, "cf": 0.8500000238418579 } ], "ln": 26368 }, { "b": "z/L?gv@#Tf04}+\u003eBz(g1nKEAkAbPS9zGFl:zF\u003c2}Bz(g1nKESwBz(1}D2Ns.wPIv4x(FfjASw{Rz/xodBA{m", "n": [ { "c": 1, "d": "Regex component marker", "i": "objectives/persistence/login/scheduled-task/com::task-scheduler-builder-methods--rx-1", "o": 26658, "z": 19, "cf": 0.8999999761581421 } ], "ln": 26642 }, { "b": "v@?Ssv@A$#wPz%dv}xYYq*ACawO\u003c4$B-8qnzdLs\u003ezGGDgz/wS^A=#ebwPE\u0026ID2[7sz7X.ezGGPfwIct*ze:i9wPyZXA=#ebwPE", "n": [ { "c": 3, "d": "Packed binary marker", "i": "objectives/anti-static/obfuscation/eval/loader::packed-binary-marker", "o": 26758, "z": 30, "cf": 0.8500000238418579 } ], "ln": 26742 }, { "b": "wPhi#wmYT*C#4):wN//Zq*ACawO\u003c53x(mE1CxkxhvrcdaA4TZHz/6DizE)ZclVl\u003cWwN/?2AXoZ$zF\u003c2}Bo2V-wQcTYy^.#EBo2VTz!}*Qv@}YTv@DfRwQcWTv/", "n": [ { "c": 1, "d": "Regex component marker", "i": "objectives/persistence/login/scheduled-task/com::task-scheduler-builder-methods--rx-1", "o": 28142, "z": 49, "cf": 0.8999999761581421 } ], "ln": 28126 }, { "b": "0rrv0l#)0+wO}FF9@#uWlVl{?A+Pf1Brz#wdiHx1gbHaFl#)0+wO}FFdGGI}o*\u003c2oC4CLlx-", "n": [ { "c": 2, "d": "Copyright notice", "i": "metadata/package/license::copyright-word", "o": 35489, "z": 9, "cf": 0.6000000238418579 } ], "ln": 35473 }, { "b": "ndU+3=DtQ\u00260rr91KPkvYy/tR2By/qwqE%]/B-H#6B1Qv4B8Mhwv}wLHvpS}\u0026efF!Jv@Dy7x\u003c@Ror+lq)x(v(Lg+HEmfFk4gavyo/BAIRnj-j?NBAg/aefE=ivR/:*oj-xFz!\u0026{4jZ{uevkRKLhzEiFg?wv2iu}EFB97#ge(Dn4z/{8gwPGF4B-8qnzdMQRB8Mhwv}wOIBohBx00ri30000008L%H", "n": [ { "c": 2, "d": "mscorlib reference", "i": "metadata/lang/compiler/managed::mscorlib", "o": 35940, "z": 128, "cf": 0.8999999761581421 } ], "ln": 35924 }, { "b": "wPIB2Byxo9z/d{XA+c^Ar+lq)x(v(Li4=)qfFk4gavyo/BAIRnj-j?NBAg/aefE=ivR/:*oj-xFz!\u0026[", "n": [ { "c": 2, "d": "IPv4-like .NET assembly version", "i": "metadata/lang/compiler/managed::dotnet-ipv4-like-version", "o": 36418, "z": 15, "cf": 0.8500000238418579 } ], "ln": 36402 }, { "b": "05T\u0026U000Ge000Z90=qBexMOuniXJdcv}YB\u003cvrj5tAaJ{izer*5A=2lbB1RxKxd[agA+//peN@ZoAa9\u003c5vRGT)BA]I{fFCx/0096300S", "n": [ { "c": 3, "d": "Network URL with domain name (binary)", "i": "objectives/command-and-control/infrastructure/domain/malicious::http-url-binary", "o": 37095, "z": 34, "cf": 0.699999988079071 } ], "ln": 37079 }, { "b": "hB*RkXSOz0UnOVy0rr91v(^\u003e8vq]T:y?lyKygQ)%B7foay?bpPf/JuUz/{8gwN4@FwnDo\u003es5qv!x\u003eqG.z!9A}mr\u0026]=A=br4lVl\u003c:A=k=ne[n*uwN6d.yfTervS=r*zE)]He?!(3x(mE1Cxm1-l#)0+wO%b4p!1G1wP{\u003c!wmYNCCYWIqzEEuGz/fVqz!%FEv@Dy0e]Uug08(AOgbQ@\u0026{WxVhhB*TaiG+?GUnOVy?/yXAQB^%x", "n": [ { "c": 3, "d": "Visual Studio build path", "i": "metadata/binary/debug::pdb-visual-studio", "o": 40520, "z": 144, "cf": 0.5 } ], "ln": 40504 }, { "b": "00000000000000000000000000000000000000315c8Xg7YTL^00000000000000000", "n": [ { "c": 1, "d": "PE resource section", "i": "metadata/binary/section/names::pe-resource-section", "o": 40960, "z": 5, "cf": 0.8999999761581421 } ], "ln": 40944 }, { "b": "0000000000001nEgYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006Xn[brp!0rrf32lkz", "n": [ { "c": 3, "d": "Recognized marker for timing checks", "i": "objectives/anti-analysis/timing/evasion::timing-anti-debug-recognized-marker", "o": 41054, "z": 15, "cf": 0.949999988079071 } ], "ln": 41038 }, { "b": "fAr{fvGn7Z001[S3JHhclJz38z2!IPve$fBC(QOtve$cAwDhYg002Z[l\u0026.lcx-JqRwDlPFaojXcli3#=003Ed9rl9umGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up00372pYJ@+rSD?lwDl]", "n": [ { "c": 2, "d": "PE CompanyName metadata field", "i": "metadata/package/versioning::pe-companyname-field", "o": 41274, "z": 11, "cf": 0.699999988079071 }, { "c": 2, "d": "PE FileDescription metadata field", "i": "metadata/package/versioning::pe-filedescription-field", "o": 41330, "z": 15, "cf": 0.699999988079071 } ], "ln": 41258 }, { "b": "zVBONA@Vgu001$U3\u0026*qdmGvc5yYF2DrSDXhASydXx-J5Kzu6Up001}Te=WTbe=WN9e=WQahVLVmg5%lk004xDe=U[LnDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE002Z[l\u0026.lcx-JqRwDlPFe=X@M", "n": [ { "c": 3, "d": "Dotted-quad PE version metadata marker", "i": "objectives/command-and-control/infrastructure/ip::ipv4-version-metadata-marker", "o": 41430, "z": 11, "cf": 0.9399999976158142 }, { "c": 2, "d": "PE InternalName metadata field", "i": "metadata/package/versioning::pe-internalname-field", "o": 41486, "z": 12, "cf": 0.699999988079071 } ], "ln": 41414 }, { "b": "zu7^Vk(:jK004VLe=U[Lpxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE002Z[l\u0026.lcx-JqRwDlPF", "n": [ { "c": 2, "d": "PE OriginalFilename metadata field", "i": "metadata/package/versioning::pe-originalfilename-field", "o": 41818, "z": 16, "cf": 0.699999988079071 } ], "ln": 41802 }, { "b": "e=YzZyYFnK001XM2MK(9pYLIozVBqFBPt[KBo25ove$cAwDhYg002Z[l\u0026.lcx-JqRwDlPF002aY3\u0026*qdpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001}Te=WTbe=WN9e=WQahVJ", "n": [ { "c": 2, "d": "PE ProductName metadata field", "i": "metadata/package/versioning::pe-productname-field", "o": 41950, "z": 11, "cf": 0.699999988079071 }, { "c": 2, "d": "PE version resource metadata", "i": "metadata/package/versioning::version-resource-metadata", "o": 41998, "z": 14, "cf": 0.8999999761581421 } ], "ln": 41934 }, { "b": "000000000000000000000i=C63\u0026*ncr6piY000000000000000000000000000000000", "n": [ { "c": 2, "d": "PE .reloc section presence", "i": "metadata/binary/section/names::reloc-section-presence", "o": 42496, "z": 6, "cf": 0.8999999761581421 } ], "ln": 42480 } ], "depth": 1, "facts": { "imp": [ [ "mscoree", "CorDllMain" ] ], "sec": [ [ ".text", 512, 40448, 5.79, "r-x" ], [ ".rsrc", 40960, 1536, 2.68, "r--" ], [ ".reloc", 42496, 512, 0.08, "r--" ] ], "metrics": { "pe": { "checksum": 83377.0, "checksum_valid": 1.0, "resource_count": 1.0, "has_version_info": 1.0, "computed_checksum": 83377.0, "reloc_overhang_bytes": 500.0, "reloc_overhang_ratio": 0.98, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "version.identity_entropy": 4.32, "clr.managed_resource_count": 1.0, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0, "clr.managed_resource_max_size": 4168.0, "version.identity_symbol_ratio": 0.0, "clr.managed_resource_max_entropy": 5.61 }, "file": { "size": 43008.0, "entropy": 5.64, "size_bytes": 43008.0 }, "binary": { "is_pie": 1.0, "code_entropy": 5.79, "string_count": 581.0, "overall_entropy": 5.64, "entropy_variance": 5.45, "avg_string_length": 19.27, "max_string_length": 606.0, "peak_region_bytes": 3072.0, "code_to_data_ratio": 1.0, "peak_region_entropy": 6.11, "string_length_stddev": 28.47, "largest_section_ratio": 0.94, "sentence_string_count": 18.0, "sentence_string_ratio": 0.03, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 40448.0, "entropy_max": 5.79, "entropy_mean": 2.85, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } } }, "id": 4, "mol": "O(C)H(Os)", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/MDriven.WPFViewModelExternalControls.core/MDriven.WPFViewModelExternalControls.core.7.2.0.17427.nupkg!!lib/net8.0-windows7.0/MDriven.WPFViewModelExternalControls.core.dll", "pid": 0, "risk": 3, "sha": "79c0a728ff0053b919509143a5faa93363e0742c70e162cfef4ab10ed22bdb0a", "size": 43008, "traits": [ { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "spans": [ [ 25080, 4 ] ] }, { "id": "metadata/binary/debug::pdb-visual-studio", "crit": 3, "desc": "Visual Studio build path", "spans": [ [ 40520, 144 ] ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 41054, 15 ] ] }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "spans": [ [ 0, 26 ] ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "spans": [ [ 13120, 4 ] ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "spans": [ [ 41430, 11 ] ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "spans": [ [ 41998, 14 ] ] }, { "id": "objectives/command-and-control/infrastructure/domain/malicious::http-url-binary", "atk": "T1071.001", "mbc": "C0002", "conf": 0.699999988079071, "crit": 3, "desc": "Network URL with domain name (binary)", "spans": [ [ 37095, 34 ] ] }, { "id": "micro-behaviors/os/clipboard/access::dotnet-clipboard-class", "conf": 0.8500000238418579, "crit": 3, "desc": "Clipboard class or symbol reference", "spans": [ [ 22574, 9 ] ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "spans": [ [ 13120, 4 ] ] } ], "type": "pe" }, { "id": 5, "sha": "a5996b3a6ef9347901c74177578657d6d189531c61bc6bbe78a00d2c77af6f3a", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/MDriven.WPFViewModelExternalControls.core/MDriven.WPFViewModelExternalControls.core.7.2.0.17427.nupkg!![Content_Types].xml", "size": 465, "type": "xml", "depth": 1 }, { "id": 6, "sha": "590463020c039a9bedbfd8b44f3690d9df19b4cf36869c3a7e659a2b6f5ac041", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/MDriven.WPFViewModelExternalControls.core/MDriven.WPFViewModelExternalControls.core.7.2.0.17427.nupkg!!package/services/metadata/core-properties/dc1a3bc1b015484da93e53d31894f883.psmdcp", "size": 738, "type": "xml", "depth": 1 }, { "id": 7, "mol": "Md", "sha": "628a04fe96d97b8e6ad9f57dda2f4a83b46db517c67ca0d2f1e979f4e8558064", "path": "MDriven.WPFViewModelExternalControls.core@7.2.0.17427.registry.json", "risk": 1, "size": 842, "type": "registry", "depth": 1 } ], "omitted_files": 3, "rev": "c2d55", "v": "8" } }