{ "ml": { "v": "7", "eng": "2.2.0-beta.2", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.80784976, "rte": "az", "prob": 0.80784976 }, { "cls": 0, "raw": 0.02564466, "rte": "az/nupkg", "prob": 0.02564466 } ], "prob": 0.80784976, "skip": [ { "rte": "az/zip", "why": "unavailable" }, { "rte": "az/zip", "why": "unavailable" } ], "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.8078497648239136, "type": "nupkg" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.00012001395225524902, "type": "xml" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.010053783655166626, "type": "xml" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.0023692846298217773, "type": "text" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.009255319833755493, "type": "markdown" }, { "id": 5, "lvl": -1, "conf": 0, "prob": 0.00006663799285888672, "type": "png" }, { "id": 6, "lvl": -1, "conf": 0, "prob": 0.7544367909431458, "type": "pe" }, { "id": 7, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "xml" }, { "id": 8, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "xml" }, { "id": 9, "lvl": -1, "conf": 0, "prob": 0.00012001395225524902, "type": "xml" }, { "id": 10, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "registry" } ], "version": "v18.18", "analyzed_at": "2026-07-02T13:14:19Z" }, "path": "Kuestenlogik.Surgewave.Wasm.0.3.0.nupkg", "raw": { "files": [ { "id": 0, "mol": "O(Al)H(Db)", "sha": "ae1d0d54d657cc9b14d71b0ef396ef7d1568350d8b9e2022eb46e5838b72752c", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Kuestenlogik.Surgewave.Wasm/Kuestenlogik.Surgewave.Wasm.0.3.0.nupkg", "risk": 3, "size": 73874, "type": "nupkg", "facts": { "metrics": { "file": { "size": 73874.0, "entropy": 7.98, "size_bytes": 73874.0 }, "binary": { "overall_entropy": 7.98, "peak_region_bytes": 69632.0, "peak_region_entropy": 7.83 }, "archive": { "file_count": 10.0, "member_count": 10.0, "script_count": 0.0, "zip_bomb_ratio": 6.33, "directory_count": 0.0, "executable_count": 1.0, "extra_field_size": 0.0, "noise_file_count": 0.0, "total_compressed": 72554.0, "compression.ratio": 0.49, "hidden_file_count": 2.0, "total_uncompressed": 147183.0, "crc_collision_count": 0.0, "entry_comment_count": 0.0, "max_filename_length": 81.0, "rtlo_filename_count": 0.0, "format.regular_count": 10.0, "nested_archive_count": 0.0, "path_traversal_count": 0.0, "symlink_escape_count": 0.0, "security.setgid_count": 0.0, "security.setuid_count": 0.0, "security.sticky_count": 0.0, "double_extension_count": 0.0, "duplicate_member_count": 0.0, "security.symlink_count": 0.0, "unicode_filename_count": 0.0, "homoglyph_filename_count": 0.0, "security.encrypted_count": 0.0, "timing.mtime_unique_count": 4.0, "timing.mtime_unique_ratio": 0.4, "misplaced_executable_count": 1.0, "timing.mtime_dominant_count": 4.0, "timing.mtime_spread_seconds": 24424.0, "timing.sentinel_mtime_count": 0.0, "security.world_writable_count": 0.0, "timing.mtime_dominant_fraction": 0.4, "compression.method_counts.stored": 1.0, "compression.method_counts.deflate": 9.0 } } }, "ident": { "name": { "value": "Kuestenlogik.Surgewave.Wasm", "source": "nupkg.title", "verified": false }, "urls": [ { "url": "https://surgewave.io/", "kind": "homepage", "source": "nupkg.project_url" }, { "url": "https://github.com/Kuestenlogik/Surgewave", "kind": "repository", "source": "nupkg.repository_url" } ], "trust": "unsigned", "authors": [ { "name": "Kuestenlogik", "role": "author", "source": "nupkg.authors" } ], "version": { "value": "0.3.0", "source": "nupkg.version", "verified": false }, "identifier": { "value": "Kuestenlogik.Surgewave.Wasm", "source": "nupkg.id", "verified": false } }, "traits": [ { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "from": [ { "file": 6 } ] }, { "id": "metadata/package/versioning::version-word-lower", "conf": 0.4000000059604645, "crit": 2, "desc": "version word (lowercase)", "from": [ { "file": 6 } ] }, { "id": "micro-behaviors/data/db/linq::linq-queries", "conf": 0.699999988079071, "crit": 3, "desc": "LINQ query operations", "from": [ { "file": 6 } ] }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "from": [ { "file": 6 } ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "from": [ { "file": 6 } ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "from": [ { "file": 6 } ] }, { "id": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "conf": 1.0, "crit": 3, "desc": "JSON polymorphism runtime marker", "from": [ { "file": 6 } ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "from": [ { "file": 6 } ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "from": [ { "file": 6 } ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "from": [ { "file": 6 } ] } ] }, { "depth": 1, "facts": { "metrics": { "file": { "size": 517.0, "entropy": 5.21, "size_bytes": 517.0 }, "binary": { "overall_entropy": 5.21, "peak_region_bytes": 517.0, "peak_region_entropy": 5.21 } } }, "id": 1, "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Kuestenlogik.Surgewave.Wasm/Kuestenlogik.Surgewave.Wasm.0.3.0.nupkg!!_rels/.rels", "sha": "fa509a9bd73826a3f34ccd8ef1120136f86cdac163d79465a162879e9aa0df00", "size": 517, "type": "xml" }, { "ctx": [ { "b": "[4ls%kx}3YaA?spB7]MgjT8QkfD}SJzEWP}x(mMDb6w0teJs}sj]", "n": [ { "c": 2, "d": "NuGet nuspec manifest file", "i": "metadata/build/manifest::nuspec-file", "o": 0, "z": 34, "cf": 0.9800000190734863 } ], "ln": 1, "addr": 0 }, { "b": "jAa.syHH\u003c!aB4:tzGv@+xMOuniXJdcv}YB\u003cvrj5rx\u003e8g4B8LVje[n*pfk$ufyHH\u003c\u0026zF7QTfFLvpfF$I3B-RIkv\u003eJ1EwfKh", "ln": 2, "addr": 42 }, { "b": "arS^-wPRu\u003evrt{w", "ln": 3, "addr": 118 }, { "b": "arR^Hjy-qGD2^RixMMB9z/x#xx\u003eIa3asH.GatLSahxUVgYMngazFTl7x\u003e]*:v@DsiA+Pf1BuP", "ln": 13, "addr": 632 }, { "b": "arR^HjAL1AB3sU/A+w%cvrMi8CvtMfaA}yavrlH3zdmsbaAhdtxk8m8aAH$ewmxF4wN({cvrlpcx(dAzflySnB3o", "ln": 14, "addr": 691 }, { "b": "arR^HjAt1Lz/YSmz/QaCBA}?pjTaJMBrR\u0026IA+)(.xMOunB2\u003e%cxk8E3BZ=$kz/4d2B.bSowO#s5xk8cmq*0a[wP}NawG\u0026mbz/6u9BuH*ShAtk5g?emKfLip4wmYsfhArPMhzO\u00266gH\u0026B6vQSX1h-J=Qw?V1+atk[", "n": [ { "c": 2, "d": "NuGet package declares repository", "i": "metadata/package/files/nuget::nuspec-repository", "o": 766, "z": 78, "cf": 0.8999999761581421 } ], "ln": 15, "addr": 762 }, { "b": "arR^Hjy\u00262xwO#3\u0026zEWx(B3o", "n": [ { "c": 2, "d": "NuGet package declares dependencies", "i": "metadata/package/files/nuget::nuspec-dependencies", "o": 894, "z": 748, "cf": 0.8999999761581421 } ], "ln": 16, "addr": 890 }, { "b": "arR^HarS^VA=l8taAR4jxjVfOA:-/@Cw?IqjTa=PBtkE4fD@W", "ln": 17, "addr": 909 }, { "b": "arR^HarR^Hjy\u00262xwO#3\u0026zEW@mx\u003efvJolB/!By/uaz!A^1e(M[kxjVo}C4Ao[z/fD7v@@[qC4CYnx(v(La$$S9e?!E(wQ4Z3B.25Db0{A^y?b7.zEEvbDs.bra%nK5", "ln": 18, "addr": 949 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 1762.0, "entropy": 5.1, "size_bytes": 1762.0 }, "binary": { "overall_entropy": 5.1, "peak_region_bytes": 1762.0, "peak_region_entropy": 5.14 } } }, "id": 2, "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Kuestenlogik.Surgewave.Wasm/Kuestenlogik.Surgewave.Wasm.0.3.0.nupkg!!Kuestenlogik.Surgewave.Wasm.nuspec", "risk": 1, "sha": "f60532bdbbebbd7ac41541a447dcbb2183fe537cac860675ba97bc68e0dc3948", "size": 1762, "traits": [ { "id": "metadata/package/files/nuget::nuspec-dependencies", "conf": 0.8999999761581421, "crit": 2, "desc": "NuGet package declares dependencies", "spans": [ [ 894, 748 ] ] }, { "id": "metadata/package/files/nuget::nuspec-repository", "conf": 0.8999999761581421, "crit": 2, "desc": "NuGet package declares repository", "spans": [ [ 766, 78 ] ] }, { "id": "metadata/build/manifest::nuspec-file", "conf": 0.9800000190734863, "crit": 2, "desc": "NuGet nuspec manifest file", "spans": [ [ 0, 34 ] ] } ], "type": "xml" }, { "depth": 1, "facts": { "metrics": { "file": { "size": 11358, "entropy": 4.43 }, "binary": { "peak_region_bytes": 11264, "peak_region_entropy": 4.62 } } }, "id": 3, "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Kuestenlogik.Surgewave.Wasm/Kuestenlogik.Surgewave.Wasm.0.3.0.nupkg!!LICENSE", "pid": 690, "risk": 1, "sha": "cfc7749b96f63bd31c3c42b5c471bf756814053e847c10f3eb003417bc523d30", "size": 11358, "traits": [ { "id": "metadata/lang/natural::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"" }, { "id": "metadata/lang/natural::lang-english--atom-2", "conf": 0.8, "crit": 1, "desc": "English function-word token \"and\"" }, { "id": "metadata/lang/natural::lang-english--atom-3", "conf": 0.8, "crit": 1, "desc": "English function-word token \"that\"" }, { "id": "metadata/lang/natural::lang-english--atom-4", "conf": 0.8, "crit": 1, "desc": "English function-word token \"have\"" }, { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"" }, { "id": "metadata/lang/natural::lang-english--atom-6", "conf": 0.8, "crit": 1, "desc": "English function-word token \"with\"" }, { "id": "metadata/lang/natural::lang-english--atom-7", "conf": 0.8, "crit": 1, "desc": "English function-word token \"this\"" }, { "id": "metadata/permission/prose::permission-grant-verb-english", "conf": 0.9, "crit": 2, "desc": "Grant or authorization verb text" }, { "id": "metadata/permission/prose::permission-mandatory-language-english", "conf": 0.9, "crit": 2, "desc": "Forced or mandatory instruction wording" }, { "id": "metadata/permission/prose::permission-permission-term-english", "conf": 0.9, "crit": 2, "desc": "Permission or access term" } ], "type": "text" }, { "ctx": [ { "b": "toNirnNi-TBAzFyiXJd0x([3hvLheez7!L8wPI%8zFTl7x\u003e]w2B-IbaCvtVafjwvjx(v)gfl.tPyI4y3CxkAEx!BWFy+Gmawm]EaB9qgBt{%xdBz#pZfe3%LBzb/ae[n*pfh3C0B97#hy\u0026r%2yCeReA+w%cvrMinvpKy[z/fRHCw?Iqw]8yfB1.3qe{RqIdgc", "ln": 0, "col": 1, "line": 1 }, { "b": "Aa9l\u0026wHf8=ga\u003emjvR*f#e]#hGdp1t}nKC{wq:\u0026bx3l{V(B-IbaCvtVa3jnmjra]?=v@Dj6y?mZ1az2.czGE1xBAg@3ze0)2aAhd9By]Diz6iCeAV=#fmn$x:fFj?83joZOA+w%cvrMi8x(+z9ay/tbAbo9cwGUMcwO#PjB98ClvqPZ@xcqefvrua1A+#}dB.LVlaz2C3eP+[.wO#33z/cWIpdnb8f!::fFrRf]ve", "ln": 404, "col": 51, "line": 4 }, { "b": "x(k4VnG.$^AaJ\u003c1zE\u003c@dz!9B2efFIvvR67XwN(])A=k-8AV!$jAV/EnB98ECvqYP#wN]B+e*9Say?$j!vp\u003cp-at+Y8aA}KuwGUG3ze-{9x\u003c$^)x([RyB7/obB0bgmaARpdayYnlefG1LayPekaz2!iB98blxco\u0026Qw[$/$v@b\u003c\u003czGE0HlVl\u003cOy\u0026%p", "ln": 650, "col": 145, "line": 10 }, { "b": "aAITyA+fqmBzbl5ay]RnvpB4#e^.}qavG^Jz/{2nwGU\u00267v@=HewPz%dv}xZ7CwhejaAhEjflqnBayPd#aAz4kB.bSoflgSyy\u003cuvtaw3D-wPI@onPdMJwmoN*azbUjz6iz2xjSh@wP?=$wPF#ozY\u003cdnwGUG0z/]N$eG^@5Abok#vru66wmoN*vQTs?", "ln": 1123, "col": 132, "line": 14 }, { "b": "y?mW3z/o.uwP?T9D30.lzF78ox([2hBzbkdB8bGay\u0026Z.vxK#DivqG%}vpTTaxKM6}e^.}ndNFn(y\u0026*!iz/M$twPzy3A=2l5v}vbt3n0w*wPIM#zE)u3w].*baAI4kvru0)aA8cue(1\u0026matCL)CwhejaBmQtz.kEqAcSNmzE:(7z^NTcx(mMo3n0w]", "ln": 2319, "col": 46, "line": 35 }, { "b": "ayPslu[MIAAbf8]azbt7wPGyBx(n0lvqG:5vrrSjB-8qnzdLmvzF{Ufz/PRoA+flkx(W=}e^.}gboP\u003cax\u003e7{3q/(C*Bp5v8dPpB$A=-BCxK@q}A=k-8AYLW13sEmHvQTs\u003e3s[6+yH}JeA=(mxePq*)fGy)HiwrDGat4KPh83)wiYePGfD+1wv@:hoz.C)GwPI%8zFTl7x\u003e]wyB-IbaCvtVa3sEmH3joNFwO@SjxK@qodNOb(BAhqoaxp#.", "ln": 2621, "col": 10, "line": 43 }, { "b": "oi\u0026@VBAzFyiXJc%z//(dBs}AAv@=Hez!s8zv@Diqwn=Wfy\u0026r-)fjY0yzE)]yf!+jldj$@mu%)wKvrl8?xk8Dgv@c73wGUVdBz#pZfe3%LBzb/ae[n*pfh3C0B97#hy\u0026r%2yCeReA+w%cvrMimxk8C{v}lYXB-IbaCvtVa3s[6%zE)]jvS=y3wfsJ/wPI%8zFTl7x\u003e]t1B-IbaCvtVae]$\u0026DCPXOFaw#=!wNPT\u003e3s[6%zE)]jA=(mxeIg{Zz!-\u0026[BrCTBv\u003eQF$wPI%8zFTl7x\u003e]t1B-IbaCvtVae\u003c:O%yH}I[u%)vH3pX}", "ln": 3999, "col": 21, "line": 75 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 4998, "entropy": 5.11 }, "text": { "lines": 92, "top_char": 101, "max_ws_run": 1, "digit_ratio": 0.02, "space_count": 534, "char_entropy": 5.11, "unique_chars": 88, "top_char_null": 0, "lines_over_200": 2, "top_char_ratio": 0.09, "avg_line_length": 53.33, "max_line_length": 460, "non_ascii_ratio": 0, "empty_line_ratio": 0.28, "last_line_length": 428, "long_token_count": 1, "whitespace_ratio": 0.13, "line_length_stddev": 75.21 }, "binary": { "peak_region_bytes": 4998, "peak_region_entropy": 5.17 } } }, "id": 4, "mol": "Hâ‚‚(CmPo)", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Kuestenlogik.Surgewave.Wasm/Kuestenlogik.Surgewave.Wasm.0.3.0.nupkg!!README.md", "pid": 0, "risk": 2, "sha": "7d11a941737bad48b50644e680ffd6508275c5143d04bde274595516ec263fc3", "size": 4998, "traits": [ { "id": "metadata/lang/natural::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"", "spans": [ [ 452, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-2", "conf": 0.8, "crit": 1, "desc": "English function-word token \"and\"", "spans": [ [ 698, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-4", "conf": 0.8, "crit": 1, "desc": "English function-word token \"have\"", "spans": [ [ 2367, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "spans": [ [ 490, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-6", "conf": 0.8, "crit": 1, "desc": "English function-word token \"with\"", "spans": [ [ 1171, 0 ] ] }, { "id": "micro-behaviors/communications/http/url/forge::public-code-forge-url", "conf": 0.9, "crit": 3, "desc": "References a public code-forge URL", "spans": [ [ 7, 19 ] ] }, { "id": "micro-behaviors/process/create/vcs/git::git-clone-command", "atk": "T1105", "conf": 0.9, "crit": 3, "desc": "Git clone command", "spans": [ [ 4063, 55 ] ] }, { "id": "micro-behaviors/process/create/vcs/git::public-forge-git-clone", "atk": "T1105", "conf": 0.92, "crit": 3, "desc": "Git clones a public code forge", "uses": [ 5, 6 ], "spans": [ [ 4063, 55 ], [ 4073, 19 ] ] } ], "type": "markdown" }, { "id": 5, "sha": "7f96b3f303615a3b7ad78a88e6836a2bd8e3d8583931775ed474642f03552818", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Kuestenlogik.Surgewave.Wasm/Kuestenlogik.Surgewave.Wasm.0.3.0.nupkg!!icon.png", "size": 4233, "type": "png", "depth": 1 }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J\u0026m(", "n": [ { "c": 3, "d": "HTTP fingerprinting evasion campaign", "i": "objectives/command-and-control/infrastructure/user-agent::http-fingerprinting-campaign", "o": 0, "z": 34, "cf": 0.8999999761581421 } ], "ln": 0 }, { "b": "00000000000000000000s#DxY00000nb@R\u00260SSx7Q*B94XsrK00rr91000000000000", "n": [ { "c": 1, "d": "PE standard code/data section", "i": "metadata/binary/section/names::pe-code-data-standard-section", "o": 512, "z": 5, "cf": 0.8999999761581421 } ], "ln": 496 }, { "b": "huFoQ000c7c}THu3mV2Qlq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn", "n": [ { "c": 3, "d": "Recognized PE anti-analysis marker", "i": "objectives/anti-analysis/debugger-detect/combined-checks::evasion-aware-recognized-pe-marker", "o": 16804, "z": 4, "cf": 1.0 } ], "ln": 16788 }, { "b": "gDtB$j#\u0026Q9o(BM+y?k^gq*ACawO\u003c4\u003epxjt]q*ACawO\u003c4!z!%l3v@#B6zGvB2wO#71x\u003e5+!oA", "n": [ { "c": 2, "d": "System namespace reference", "i": "metadata/lang/compiler/managed::system-namespace", "o": 33878, "z": 9, "cf": 0.800000011920929 } ], "ln": 33862 }, { "b": "Bu%$[zESVyB-Y]\u003cD2v9(l2pvQv/P\u003eAy\u002613107pyby\u00261310afnFvqG:#v/QdMBydQI00", "n": [ { "c": 1, "d": "Go allocation symbol text", "i": "micro-behaviors/mem/alloc/heap::go-alloc-symbol-text", "o": 34385, "z": 5, "cf": 0.7599999904632568 } ], "ln": 34369 }, { "b": "Byxo506AC1uTE\u003e@vru5XlVl\u003cWwN/?2A.Qa!vpS!*vl]0SA+P09By+CrB8$]fvR*r:wPRu\u003evrt{zBAzLqvS=^707gWwAa]", "n": [ { "c": 1, "d": "Regex component marker", "i": "objectives/persistence/login/scheduled-task/com::task-scheduler-builder-methods--rx-1", "o": 36648, "z": 26, "cf": 0.8999999761581421 } ], "ln": 36632 }, { "b": "yC5LdA+w%cvrMims7ce!e[w^m08NGOxk8lWz!%j\u0026uVo?7xk8lWz!%j\u0026ra{q\u003cCs=yw", "n": [ { "c": 3, "d": "References Windows executable or script", "i": "objectives/execution/interpreter/script/shell::windows-executable-ref", "o": 38360, "z": 4, "cf": 0.6000000238418579 } ], "ln": 38344 }, { "b": "z7Xs{z^)c\u003ex)Kifx(v\u003e?q*ACawO\u003c50wQ5qHn][]*e(Mt4x\u003c\u003e*(Dsp]fz/bLBwPQjFBzkVh07/K@zF0P}", "n": [ { "c": 3, "d": "JSON polymorphism runtime marker", "i": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "o": 39065, "z": 16, "cf": 1.0 } ], "ln": 39049 }, { "b": "zE^r@v%HT-ygQ)%x(v\u003e?q*ACawO\u003c4$wOb:\u0026v@#B6zu9l}z!%l3v@#B6zu9mbwPz%dv}w2Cy\u00260V)BzkVh00", "n": [ { "c": 2, "d": "Benign high-entropy PE context", "i": "metadata/package/quality/false-positives::benign-high-entropy-pe-context", "o": 39180, "z": 17, "cf": 0.949999988079071 } ], "ln": 39164 }, { "b": "B7GD2l$HBHA+PGmx(v\u003e?q*ACawO\u003c50wQ5qHn][]*08)#Wx(mMJz/6D4A+PPkzu8$kwk^hWxkzd3z/bLN", "n": [ { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 39480, "z": 16, "cf": 0.8500000238418579 } ], "ln": 39464 }, { "b": "xk8lPzF0!!q/(}%0cr8Vq*ACawO\u003c4[x(m[\u003cq*ACawO\u003c4!z!%l3v@#B6zGvB2wO#71x\u003e5+!lVl=", "n": [ { "c": 3, "d": "LINQ query operations", "i": "micro-behaviors/data/db/linq::linq-queries", "o": 39645, "z": 11, "cf": 0.699999988079071 } ], "ln": 39629 }, { "b": "z/L?gv@#Tf04}+\u003eBz(g1s7ce!q/u/0v}w2CzF\u003c2}Bz(g1s7ce!q!Zb+lVl\u003cWwN/?2ASyi1Aa@/UBAdw8vqH6$p\u0026{ZTzf6t^BAdw1B-ZD4AS", "n": [ { "c": 1, "d": "Regex component marker", "i": "objectives/persistence/login/scheduled-task/com::task-scheduler-builder-methods--rx-1", "o": 40557, "z": 19, "cf": 0.8999999761581421 } ], "ln": 40541 }, { "b": "Bo29CygQ)%08)DBwN//ZolB/!By/uaz!A^1e(M[kxjVo}C4Ao[z/fD7v@}YswN/T@B98CBv@}Ywz/Z20Byxo5m}D=xs7ce!Bzg", "n": [ { "c": 1, "d": "Regex component marker", "i": "objectives/persistence/login/scheduled-task/com::task-scheduler-builder-methods--rx-1", "o": 42098, "z": 30, "cf": 0.8999999761581421 } ], "ln": 42082 }, { "b": "zua2zv/QrBzVB?UwDhYrve$9zyYFwNv/MGtwb{fvve$9zyYFwNv/MGvpYLqiBPu4Ox-", "n": [ { "c": 1, "d": "Go allocation symbol text", "i": "micro-behaviors/mem/alloc/heap::go-alloc-symbol-text", "o": 44420, "z": 5, "cf": 0.7599999904632568 } ], "ln": 44404 }, { "b": "0rrv5wO+{^B7CsKbMN(!lVl{?A+Pf1Brz#wdiHx1gbZmF.[p5jwO#s5xk8bY0dZ7g0dY(bwD", "n": [ { "c": 2, "d": "Copyright notice", "i": "metadata/package/license::copyright-word", "o": 54565, "z": 9, "cf": 0.6000000238418579 } ], "ln": 54549 }, { "b": "AbY-oBy!#9x(k5nxLzJgC4CYnx(v(iz!pbqz/{7yv@Dj6x(4v3e=+}L6AFgAqE%\u0026\u003cx(W+", "n": [ { "c": 3, "d": "Recognized sparse-logic binary marker", "i": "objectives/anti-analysis/vm-detect/instruction::sparse-logic-recognized-marker", "o": 55877, "z": 7, "cf": 0.800000011920929 } ], "ln": 55861 }, { "b": "2($2eBA}?p004Lj0rvUeq*ACawO\u003c50wQ5qHn][]*e(Mt4x\u003c\u003e*(Dsp]fz/dg1B8L}{BAh8kxglYXz9@kVC4CYowPxsAq*ACawO\u003c50wQ5qHn][]*efE#8A=U@kzAPZde?![ie?!?0lV)i!B-I4RzE)%jA:-=naw^h\u0026y?WxLwQdl[yH)", "n": [ { "c": 2, "d": "IPv4-like .NET assembly version", "i": "metadata/lang/compiler/managed::dotnet-ipv4-like-version", "o": 56780, "z": 16, "cf": 0.8500000238418579 }, { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 56706, "z": 16, "cf": 0.8500000238418579 } ], "ln": 56690 }, { "b": "00000000000000000000000000000000000000315c8Xg7YTL^00000000000000000", "n": [ { "c": 1, "d": "PE resource section", "i": "metadata/binary/section/names::pe-resource-section", "o": 72192, "z": 5, "cf": 0.8999999761581421 } ], "ln": 72176 }, { "b": "0000000000000MlgYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006Xn[brp!0rri40000", "n": [ { "c": 3, "d": "Recognized marker for timing checks", "i": "objectives/anti-analysis/timing/evasion::timing-anti-debug-recognized-marker", "o": 72286, "z": 15, "cf": 0.949999988079071 } ], "ln": 72270 }, { "b": "zua.Te=U\u003eK0024W4fczelJz38z2!IPve$fBC(QOtve$cAwDhYg002T(BPt$MA@ZpZwDlPFyYFwNx8(SCyxatm003yb8#{0tmGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up002T(BPt$MA@ZpZwDlP", "n": [ { "c": 2, "d": "PE CompanyName metadata field", "i": "metadata/package/versioning::pe-companyname-field", "o": 72806, "z": 11, "cf": 0.699999988079071 }, { "c": 2, "d": "PE FileDescription metadata field", "i": "metadata/package/versioning::pe-filedescription-field", "o": 72866, "z": 15, "cf": 0.699999988079071 } ], "ln": 72790 }, { "b": "r@=UeA@Z4S001LI1][V7mGvc5yYF2DrSDXhASydXx-J5Kzu6Up001XMe=WWce=WN9003ybaohAxnDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE002T(BPt$MA@ZpZwDlPFyYFwN", "n": [ { "c": 3, "d": "Dotted-quad PE version metadata marker", "i": "objectives/command-and-control/infrastructure/ip::ipv4-version-metadata-marker", "o": 72962, "z": 11, "cf": 0.9399999976158142 }, { "c": 2, "d": "PE InternalName metadata field", "i": "metadata/package/versioning::pe-internalname-field", "o": 73006, "z": 12, "cf": 0.699999988079071 } ], "ln": 72946 }, { "b": "x8(SCyxatm003WjaohAxpxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE002T(BPt$MA@ZpZwDlPF", "n": [ { "c": 2, "d": "PE OriginalFilename metadata field", "i": "metadata/package/versioning::pe-originalfilename-field", "o": 73202, "z": 16, "cf": 0.699999988079071 } ], "ln": 73186 }, { "b": "e=YzZyYFnK003a38#{0tpYLIozVBqFBPt[KBo25ove$cAwDhYg002T(BPt$MA@ZpZwDlPFyYFw", "n": [ { "c": 2, "d": "PE ProductName metadata field", "i": "metadata/package/versioning::pe-productname-field", "o": 73306, "z": 11, "cf": 0.699999988079071 } ], "ln": 73290 }, { "b": "r@=UeA@Z4S004PJf8#1MpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001XMe=WWce=WN9d/:2Uhui", "n": [ { "c": 2, "d": "PE version resource metadata", "i": "metadata/package/versioning::version-resource-metadata", "o": 73394, "z": 14, "cf": 0.8999999761581421 } ], "ln": 73378 }, { "b": "0000000000000000000005aAN3\u0026*ncD]p%8000000000000000000000000000000000", "n": [ { "c": 2, "d": "PE .reloc section presence", "i": "metadata/binary/section/names::reloc-section-presence", "o": 73728, "z": 6, "cf": 0.8999999761581421 } ], "ln": 73712 } ], "depth": 1, "facts": { "imp": [ [ "mscoree", "CorDllMain" ] ], "sec": [ [ ".text", 512, 71680, 6.6, "r-x" ], [ ".rsrc", 72192, 1536, 3.16, "r--" ], [ ".reloc", 73728, 512, 0.1, "r--" ] ], "metrics": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "resource_count": 1.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 130004.0, "reloc_overhang_bytes": 500.0, "reloc_overhang_ratio": 0.98, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "version.identity_entropy": 4.08, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0, "version.identity_symbol_ratio": 0.06 }, "file": { "size": 74240.0, "entropy": 6.5, "size_bytes": 74240.0 }, "binary": { "is_pie": 1.0, "code_entropy": 6.6, "string_count": 751.0, "overall_entropy": 6.5, "entropy_variance": 7.04, "avg_string_length": 20.37, "max_string_length": 140.0, "peak_region_bytes": 14336.0, "code_to_data_ratio": 1.0, "peak_region_entropy": 7.81, "string_length_stddev": 16.76, "largest_section_ratio": 0.97, "sentence_string_count": 55.0, "sentence_string_ratio": 0.07, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 71680.0, "entropy_max": 6.6, "entropy_mean": 3.29, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } } }, "id": 6, "mol": "O(Al)H(Db)", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Kuestenlogik.Surgewave.Wasm/Kuestenlogik.Surgewave.Wasm.0.3.0.nupkg!!lib/net10.0/Kuestenlogik.Surgewave.Wasm.dll", "risk": 3, "sha": "742664efc18854bf293012c6dd4b3f28ed1f399175cc068d03088f4596fb1e88", "size": 74240, "traits": [ { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "spans": [ [ 72962, 11 ] ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 72286, 15 ] ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "spans": [ [ 38360, 4 ] ] }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "spans": [ [ 0, 26 ] ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "spans": [ [ 16804, 4 ] ] }, { "id": "metadata/package/versioning::version-word-lower", "conf": 0.4000000059604645, "crit": 2, "desc": "version word (lowercase)", "spans": [ [ 55877, 7 ] ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "spans": [ [ 73394, 14 ] ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "micro-behaviors/data/db/linq::linq-queries", "conf": 0.699999988079071, "crit": 3, "desc": "LINQ query operations", "spans": [ [ 39645, 11 ] ] }, { "id": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "conf": 1.0, "crit": 3, "desc": "JSON polymorphism runtime marker", "spans": [ [ 39065, 16 ] ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "spans": [ [ 16804, 4 ] ] } ], "type": "pe" }, { "id": 7, "sha": "f02f674ae641e16b1e8ee291787a7de3561f4aa38f84217ff010883f55b7ec2e", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Kuestenlogik.Surgewave.Wasm/Kuestenlogik.Surgewave.Wasm.0.3.0.nupkg!!lib/net10.0/Kuestenlogik.Surgewave.Wasm.xml", "size": 35579, "type": "xml", "depth": 1 }, { "id": 8, "sha": "63feef730c8c6225c83eeeb608a1575fcac22006897782d889c10c4310523657", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Kuestenlogik.Surgewave.Wasm/Kuestenlogik.Surgewave.Wasm.0.3.0.nupkg!![Content_Types].xml", "size": 712, "type": "xml", "depth": 1 }, { "id": 9, "sha": "4c4f1b9a0b540932e0abc7a11e6f259a44de78fdb1f9ebbd7d6daf86ca9f5c6f", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Kuestenlogik.Surgewave.Wasm/Kuestenlogik.Surgewave.Wasm.0.3.0.nupkg!!package/services/metadata/core-properties/68f11925a7d14df0b5aa152194b835f9.psmdcp", "size": 797, "type": "xml", "depth": 1 }, { "id": 10, "sha": "bee03c903d9f78092730ee1408b1b2e853d0bb49ce5c40c02bc271627dbe5a52", "path": "Kuestenlogik.Surgewave.Wasm@0.3.0.registry.json", "size": 894, "type": "registry", "depth": 1 } ], "omitted_files": 5, "rev": "46112", "v": "8" } }