{ "ml": { "v": "7", "eng": "2.2.0-beta.2", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.5027308, "rte": "az", "prob": 0.5027308 }, { "cls": 0, "raw": 0.5068099, "rte": "az/nupkg", "prob": 0.5068099 } ], "prob": 0.63866615, "skip": [ { "rte": "az/zip", "why": "unavailable" }, { "rte": "az/zip", "why": "unavailable" } ], "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.6386661529541016, "type": "nupkg" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.00012001395225524902, "type": "xml" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.010274052619934082, "type": "xml" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.6386661529541016, "type": "pe" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "xml" }, { "id": 5, "lvl": -1, "conf": 0, "prob": 0.011974960565567017, "type": "markdown" }, { "id": 6, "lvl": -1, "conf": 0, "prob": 0.0000756382942199707, "type": "png" }, { "id": 7, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "xml" }, { "id": 8, "lvl": -1, "conf": 0, "prob": 0.00012001395225524902, "type": "xml" }, { "id": 9, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "registry" } ], "version": "v18.18", "analyzed_at": "2026-06-29T03:48:04Z" }, "path": "SoftwareExtravaganza.Whizbang.Data.Dapper.Custom.0.779.1-alpha.3.nupkg", "raw": { "files": [ { "id": 0, "mol": "O(Al)H₂(CmDb)", "sha": "b0d7730dcbefc3ee13a721f58de45f77a3038abe1a9b1ea0a19b37442ee2748a", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/SoftwareExtravaganza.Whizbang.Data.Dapper.Custom/SoftwareExtravaganza.Whizbang.Data.Dapper.Custom.0.779.1-alpha.3.nupkg", "risk": 4, "size": 49242, "type": "nupkg", "facts": { "metrics": { "file": { "size": 49242.0, "entropy": 7.94, "size_bytes": 49242.0 }, "binary": { "overall_entropy": 7.94, "peak_region_bytes": 45056.0, "peak_region_entropy": 7.82 }, "archive": { "file_count": 9.0, "member_count": 9.0, "script_count": 0.0, "zip_bomb_ratio": 8.35, "directory_count": 0.0, "executable_count": 1.0, "extra_field_size": 0.0, "noise_file_count": 0.0, "total_compressed": 47970.0, "compression.ratio": 0.29, "hidden_file_count": 2.0, "total_uncompressed": 164430.0, "crc_collision_count": 0.0, "entry_comment_count": 0.0, "max_filename_length": 81.0, "rtlo_filename_count": 0.0, "format.regular_count": 9.0, "nested_archive_count": 0.0, "path_traversal_count": 0.0, "symlink_escape_count": 0.0, "security.setgid_count": 0.0, "security.setuid_count": 0.0, "security.sticky_count": 0.0, "double_extension_count": 0.0, "duplicate_member_count": 0.0, "security.symlink_count": 0.0, "unicode_filename_count": 0.0, "homoglyph_filename_count": 0.0, "security.encrypted_count": 0.0, "timing.mtime_unique_count": 4.0, "timing.mtime_unique_ratio": 0.44, "misplaced_executable_count": 1.0, "timing.mtime_dominant_count": 4.0, "timing.mtime_spread_seconds": 24924.0, "timing.sentinel_mtime_count": 0.0, "security.world_writable_count": 0.0, "timing.mtime_dominant_fraction": 0.44, "compression.method_counts.stored": 1.0, "compression.method_counts.deflate": 8.0 } } }, "ident": { "name": { "value": "SoftwareExtravaganza.Whizbang.Data.Dapper.Custom", "source": "nupkg.title", "verified": false }, "urls": [ { "url": "https://whizba.ng/", "kind": "homepage", "source": "nupkg.project_url" }, { "url": "https://github.com/whizbang-lib/whizbang", "kind": "repository", "source": "nupkg.repository_url" } ], "trust": "unsigned", "authors": [ { "name": "Phil Carbone", "role": "author", "source": "nupkg.authors" } ], "version": { "value": "0.779.1-alpha.3", "source": "nupkg.version", "verified": false }, "identifier": { "value": "SoftwareExtravaganza.Whizbang.Data.Dapper.Custom", "source": "nupkg.id", "verified": false } }, "traits": [ { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "from": [ { "file": 3 } ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "from": [ { "file": 3 } ] }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/communications/http/server/managed::http-response-get", "conf": 1.0, "crit": 3, "desc": "Access to ASP.NET Response object", "from": [ { "file": 3 } ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "from": [ { "file": 3 } ] }, { "id": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "conf": 1.0, "crit": 3, "desc": "JSON polymorphism runtime marker", "from": [ { "file": 3 } ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/data/db/access::db-connection-class", "conf": 0.699999988079071, "crit": 3, "desc": "DbConnection class", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/communications/http/server/managed::http-request-get", "conf": 1.0, "crit": 3, "desc": "Access to ASP.NET Request object", "from": [ { "file": 3 } ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/data/db/access::execute-scalar", "conf": 0.699999988079071, "crit": 3, "desc": "ExecuteScalar method", "from": [ { "file": 3 } ] } ] }, { "depth": 1, "facts": { "metrics": { "file": { "size": 538.0, "entropy": 5.18, "size_bytes": 538.0 }, "binary": { "overall_entropy": 5.18, "peak_region_bytes": 538.0, "peak_region_entropy": 5.18 } } }, "id": 1, "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/SoftwareExtravaganza.Whizbang.Data.Dapper.Custom/SoftwareExtravaganza.Whizbang.Data.Dapper.Custom.0.779.1-alpha.3.nupkg!!_rels/.rels", "sha": "29a3d684b78a3b0a1e64d5124f2c1fb35cb65100e43e38e8f8db9eb681525c79", "size": 538, "type": "xml" }, { "ctx": [ { "b": "[4ls%kx}3YaA?spB7]MgjT8QkfD}SJzEWP}x(mMDb6w0teJs}sj]", "n": [ { "c": 2, "d": "NuGet nuspec manifest file", "i": "metadata/build/manifest::nuspec-file", "o": 0, "z": 55, "cf": 0.9800000190734863 } ], "ln": 1, "addr": 0 }, { "b": "jAa.syHH\u003c!aB4:tzGv@+xMOuniXJdcv}YB\u003cvrj5rx\u003e8g4B8LVje[n*pfk$ufyHH\u003c\u0026zF7QTfFLvpfF$I3B-RIkv\u003eJ1EwfKh", "ln": 2, "addr": 42 }, { "b": "arS^-wPRu\u003evrt{w", "ln": 3, "addr": 118 }, { "b": "arR^Hjy-qGD2^RixMMB9z/x#xx\u003eIa3aI$92gb7EvaA}HkDsyr2xdW}lvMVqNz/x#xx\u003eIa3j]", "ln": 13, "addr": 616 }, { "b": "arR^HjAL1AB3seUwO#Pwwo8ycwO@S2ADlaywP?T5Bs?MLB-H#azF782z/^ajz//(dBrC)vA=iKIwOb:\u0026v@#B6zxJ!cB8$=5x(mMawnca7vru0)wPw]jz/Z2kA+friy-)q3v@Dy0ay[]1AaK5jvs06pwI4$mA=#ebwNY!6jtg!+xlcl", "ln": 14, "addr": 674 }, { "b": "arR^HjAt1Lz/YSmz/QaCBA}?pjTaJMBrR\u0026IA+)(.xMOunB2\u003e%cxk8E3BZ=$kz/4dKxLz^4vqYZfy?WuiCw7YpvQTd!a%punvqYN*jTa]Tw]/RswNPa\u003cfjXTqwO=p7a%pxlzeB0ejT8T[vk}\u003egi5ATbvl34$i5JK4wI^)Si5tePgb7Q{iwADLix5\u003cbvQQD6ffP", "n": [ { "c": 2, "d": "NuGet package declares repository", "i": "metadata/package/files/nuget::nuspec-repository", "o": 818, "z": 105, "cf": 0.8999999761581421 } ], "ln": 15, "addr": 814 }, { "b": "arR^Hjy\u00262xwO#3\u0026zEWx(B3o", "n": [ { "c": 2, "d": "NuGet package declares dependencies", "i": "metadata/package/files/nuget::nuspec-dependencies", "o": 973, "z": 455, "cf": 0.8999999761581421 } ], "ln": 16, "addr": 969 }, { "b": "arR^HarS^VA=l8taAR4jxjVfOA:-/@Cw?IqjTa=PBtkE4fD@W", "ln": 17, "addr": 988 }, { "b": "arR^HarR^Hjy\u00262xwO#3\u0026zEW@mx\u003efvJq/un\u0026CvtJ6mr\u0026]{vrM6(vqZy1e(#.2Dsyr2xd=L\u0026A+cBqC4CYnx(v(La$$Sdh-SGBeN-EmxKJIHa%pDwv@co#wJ.k7B.LV5ej1eZy\u003cytrA=SAEffP", "ln": 18, "addr": 1028 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 1546.0, "entropy": 5.13, "size_bytes": 1546.0 }, "binary": { "overall_entropy": 5.13, "peak_region_bytes": 1546.0, "peak_region_entropy": 5.12 } } }, "id": 2, "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/SoftwareExtravaganza.Whizbang.Data.Dapper.Custom/SoftwareExtravaganza.Whizbang.Data.Dapper.Custom.0.779.1-alpha.3.nupkg!!SoftwareExtravaganza.Whizbang.Data.Dapper.Custom.nuspec", "risk": 1, "sha": "4c7393786433d2e6822fea1a30fb7ea48c091f471400a7c563f3038a61b5cdf7", "size": 1546, "traits": [ { "id": "metadata/package/files/nuget::nuspec-dependencies", "conf": 0.8999999761581421, "crit": 2, "desc": "NuGet package declares dependencies", "spans": [ [ 973, 455 ] ] }, { "id": "metadata/package/files/nuget::nuspec-repository", "conf": 0.8999999761581421, "crit": 2, "desc": "NuGet package declares repository", "spans": [ [ 818, 105 ] ] }, { "id": "metadata/build/manifest::nuspec-file", "conf": 0.9800000190734863, "crit": 2, "desc": "NuGet nuspec manifest file", "spans": [ [ 0, 55 ] ] } ], "type": "xml" }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J+", "n": [ { "c": 3, "d": "HTTP fingerprinting evasion campaign", "i": "objectives/command-and-control/infrastructure/user-agent::http-fingerprinting-campaign", "o": 0, "z": 34, "cf": 0.8999999761581421 } ], "ln": 0 }, { "b": "00000000000000000000keWB300000nb@R\u00260SSx7@80B]bYJ!:0rr91000000000000", "n": [ { "c": 1, "d": "PE standard code/data section", "i": "metadata/binary/section/names::pe-code-data-standard-section", "o": 512, "z": 5, "cf": 0.8999999761581421 } ], "ln": 496 }, { "b": "huFn\u003e000c7c{dIg3mV2Qlq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn", "n": [ { "c": 3, "d": "Recognized PE anti-analysis marker", "i": "objectives/anti-analysis/debugger-detect/combined-checks::evasion-aware-recognized-pe-marker", "o": 13308, "z": 4, "cf": 1.0 } ], "ln": 13292 }, { "b": "q/)4\u003evqOCRwO#PTvrt]Tq*ACawO\u003c50wQ5qHn][]*e(Mt4x\u003c\u003e*(Dsp]fz/dg4wPRu\u003evrt]TxjVf(o\u003ewAP", "n": [ { "c": 3, "d": "JSON polymorphism runtime marker", "i": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "o": 27270, "z": 16, "cf": 1.0 } ], "ln": 27254 }, { "b": "zGG}^wPSccwO%!PD2v9(lVM:DBy^*TzF\u003c2}BzkVhl34r?v/O@xwN/\u003e8wM98Ey*?uIB9RUk08^xHwPQjVD2v9(qfuC\u003cC#FA{xkzcPAZTE", "n": [ { "c": 3, "d": "SQL command execution", "i": "micro-behaviors/data/db/access::sql-command", "o": 27751, "z": 13, "cf": 0.8500000238418579 }, { "c": 1, "d": "Regex component marker", "i": "objectives/persistence/login/scheduled-task/com::task-scheduler-builder-methods--rx-1", "o": 27729, "z": 21, "cf": 0.8999999761581421 } ], "ln": 27713 }, { "b": "nN}*fw]}Q8mrSlWBv*0yxjVf(qE%\u0026\u003cwPI@+wb{TYADL\u0026lBv*0yB7GD2p*[S=z^^eRAaa3dz^^eRq*ACawO\u003c4!z!%l3v@#B6zGvB2wO#71x\u003e5+!lVl=", "n": [ { "c": 3, "d": "Access to ASP.NET Request object", "i": "micro-behaviors/communications/http/server/managed::http-request-get", "o": 28060, "z": 11, "cf": 1.0 }, { "c": 1, "d": "Regex component marker", "i": "objectives/command-and-control/dropper/staging/encrypted::staged-payload-file-name--rx-1", "o": 28096, "z": 7, "cf": 0.8500000238418579 } ], "ln": 28044 }, { "b": "yHpBnvpK7!zF8BMwO+(Sjvs48zE)s1x(v(UvpKy$A^o\u0026:uTDcdv@2^@xguPDy?9JUwPRoWvqH6$okeoO07}rJzDpgZB.aiWzE--VA=g", "n": [ { "c": 1, "d": "Regex component marker", "i": "objectives/persistence/login/scheduled-task/com::task-scheduler-builder-methods--rx-1", "o": 28819, "z": 34, "cf": 0.8999999761581421 } ], "ln": 28803 }, { "b": "o\u003ewx!vp%duzGYPcz/xm/xjVf(qE%]*z/fScmq^oWy\u0026so70cqZ[uS7DRAbPSnwKQGWwO=p7wDlpV", "n": [ { "c": 3, "d": "Access to ASP.NET Response object", "i": "micro-behaviors/communications/http/server/managed::http-response-get", "o": 29215, "z": 12, "cf": 1.0 } ], "ln": 29199 }, { "b": "AZB!+Cxmh4y?lK!vru5XlVl\u003cWwN/*@z/eG}vru5Xju+GbuVQr$By+CrB8$]fvR*r:wPRu\u003evrt{zBAzK", "n": [ { "c": 1, "d": "Regex component marker", "i": "objectives/persistence/login/scheduled-task/com::task-scheduler-builder-methods--rx-1", "o": 29539, "z": 15, "cf": 0.8999999761581421 } ], "ln": 29523 }, { "b": "Byu^\u0026vq{f%AXo.4B98tqe[w^m090SLz*a=+piyw?07QQxqE%oEq/MQNm}D^fy?m3)", "n": [ { "c": 3, "d": "References Windows executable or script", "i": "objectives/execution/interpreter/script/shell::windows-executable-ref", "o": 30750, "z": 4, "cf": 0.6000000238418579 } ], "ln": 30734 }, { "b": "zEWl]y*?B1z/eJ)yH}w-mq^f?A+dQRzF\u003c2}BzkVhpJf(.07/N/rb#z+B75N2x(v\u003e?ls\u003c!zzD7T+zGxk@BzkVh0cAl\u0026zGxk@BzkVh08[e:By/qwqE%DRwN/*@z/bLDlVl^SwN/*@z/bLDl$eJ4zF\u003c2}BzkVh0aP}+zE)s1x(v\u003e?z/x5HwmPy@x(v\u003e?lVl*UvqYQz", "n": [ { "c": 3, "d": "SQL database connection capability", "i": "micro-behaviors/data/db/access::sql-connection", "o": 31409, "z": 12, "cf": 0.8500000238418579 }, { "c": 2, "d": "Benign high-entropy PE context", "i": "metadata/package/quality/false-positives::benign-high-entropy-pe-context", "o": 31378, "z": 17, "cf": 0.949999988079071 }, { "c": 1, "d": "Regex component marker", "i": "objectives/persistence/login/scheduled-task/com::task-scheduler-builder-methods--rx-1", "o": 31313, "z": 20, "cf": 0.8999999761581421 } ], "ln": 31297 }, { "b": "By/qwl$7gCe\u003c\u003cL]zeTp(q*ACawO\u003c50wQ5qHn][]*0bVp?vpS!*vm\u003ePVzua-/z/xnWB8L{@uVG.0Bz(hh", "n": [ { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 31635, "z": 16, "cf": 0.8500000238418579 } ], "ln": 31619 }, { "b": "e[X:quRbrpwNPaBzFTN#xjVf(lVl\u003cWwN/*@z/e3Mv@#TfC(QA7vNC6KzE)s1x(v(UvpKy$A^mT{z/fD7v@#B6zBO5ABz(hB09r\u0026FDsyr2xd=L\u0026A+b", "n": [ { "c": 3, "d": "DbConnection class", "i": "micro-behaviors/data/db/access::db-connection-class", "o": 34283, "z": 12, "cf": 0.699999988079071 }, { "c": 1, "d": "Regex component marker", "i": "objectives/persistence/login/scheduled-task/com::task-scheduler-builder-methods--rx-1", "o": 34260, "z": 21, "cf": 0.8999999761581421 } ], "ln": 34244 }, { "b": "0rrv5wO+{^B7CsKblm==lVl{?A+Pf1BrFD1atLSah6v9Rx)Kk%zF7Lqx\u003c}5xzVG\u0026MlsB}Dao", "n": [ { "c": 2, "d": "Copyright notice", "i": "metadata/package/license::copyright-word", "o": 40520, "z": 9, "cf": 0.6000000238418579 } ], "ln": 40504 }, { "b": "00000000000000000000000000000000000000315c8Xg7YTL^00000000000000000", "n": [ { "c": 1, "d": "PE resource section", "i": "metadata/binary/section/names::pe-resource-section", "o": 43008, "z": 5, "cf": 0.8999999761581421 } ], "ln": 42992 }, { "b": "0000000000007jCgYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006Xn[brp!0rrGf0000", "n": [ { "c": 3, "d": "Recognized marker for timing checks", "i": "objectives/anti-analysis/timing/evasion::timing-anti-debug-recognized-marker", "o": 43102, "z": 15, "cf": 0.949999988079071 } ], "ln": 43086 }, { "b": "Bo3N^e=U\u003eK0024W4fczelJz38z2!IPve$fBC(QOtve$cAwDhYg004iyxAh-DDh}yOve$fBx8\u003cH-yYFeHvGlxd003yb8#{0tmGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up00372xAh-DDh}yOve$f", "n": [ { "c": 2, "d": "PE CompanyName metadata field", "i": "metadata/package/versioning::pe-companyname-field", "o": 43562, "z": 11, "cf": 0.699999988079071 }, { "c": 2, "d": "PE FileDescription metadata field", "i": "metadata/package/versioning::pe-filedescription-field", "o": 43622, "z": 15, "cf": 0.699999988079071 } ], "ln": 43546 }, { "b": "A@ZpZzVBRO001?Q3ig8bmGvc5yYF2DrSDXhASydXx-J5Kzu6Up001XMe=W*ghVL\u0026re=WQae=WN9003ybaohAxnDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE00372xAh-DDh}yOve$fBx8\u003cK:", "n": [ { "c": 3, "d": "Dotted-quad PE version metadata marker", "i": "objectives/command-and-control/infrastructure/ip::ipv4-version-metadata-marker", "o": 43718, "z": 11, "cf": 0.9399999976158142 }, { "c": 2, "d": "PE InternalName metadata field", "i": "metadata/package/versioning::pe-internalname-field", "o": 43770, "z": 12, "cf": 0.699999988079071 } ], "ln": 43702 }, { "b": "eDxO!x-IPx003WjaohAxpxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE00372xAh-DDh}yOve$fB", "n": [ { "c": 2, "d": "PE OriginalFilename metadata field", "i": "metadata/package/versioning::pe-originalfilename-field", "o": 43962, "z": 16, "cf": 0.699999988079071 } ], "ln": 43946 }, { "b": "e=YzZyYFnK001+O2(\u003c#apYLIozVBqFBPt[KBo25ove$cAwDhYg00372xAh-DDh}yOve$fBx8?]i005q+irf6WpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001XMe=W*ghVL\u0026re=WQaeDt", "n": [ { "c": 2, "d": "PE ProductName metadata field", "i": "metadata/package/versioning::pe-productname-field", "o": 44066, "z": 11, "cf": 0.699999988079071 }, { "c": 2, "d": "PE version resource metadata", "i": "metadata/package/versioning::version-resource-metadata", "o": 44118, "z": 14, "cf": 0.8999999761581421 } ], "ln": 44050 }, { "b": "000000000000000000000kFNm3\u0026*ncu]d\u0026-000000000000000000000000000000000", "n": [ { "c": 2, "d": "PE .reloc section presence", "i": "metadata/binary/section/names::reloc-section-presence", "o": 44544, "z": 6, "cf": 0.8999999761581421 } ], "ln": 44528 } ], "depth": 1, "facts": { "imp": [ [ "mscoree", "CorDllMain" ] ], "sec": [ [ ".text", 512, 42496, 5.94, "r-x" ], [ ".rsrc", 43008, 1536, 3.04, "r--" ], [ ".reloc", 44544, 512, 0.08, "r--" ] ], "metrics": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "resource_count": 1.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 93701.0, "reloc_overhang_bytes": 500.0, "reloc_overhang_ratio": 0.98, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "version.identity_entropy": 4.21, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0, "version.identity_symbol_ratio": 0.09 }, "file": { "size": 45056.0, "entropy": 5.8, "size_bytes": 45056.0 }, "binary": { "is_pie": 1.0, "code_entropy": 5.94, "string_count": 471.0, "overall_entropy": 5.8, "entropy_variance": 5.72, "avg_string_length": 21.7, "max_string_length": 170.0, "peak_region_bytes": 3072.0, "code_to_data_ratio": 1.0, "peak_region_entropy": 6.11, "string_length_stddev": 18.09, "largest_section_ratio": 0.94, "sentence_string_count": 11.0, "sentence_string_ratio": 0.02, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 42496.0, "entropy_max": 5.94, "entropy_mean": 3.02, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } } }, "id": 3, "mol": "O₂(AlEr)H₂(CmDb)", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/SoftwareExtravaganza.Whizbang.Data.Dapper.Custom/SoftwareExtravaganza.Whizbang.Data.Dapper.Custom.0.779.1-alpha.3.nupkg!!lib/net10.0/Whizbang.Data.Dapper.Custom.dll", "risk": 5, "sha": "7ff906b8537d9818a371a50c04f334b1a38f5053cd2a15a11d03b0e06972355c", "size": 45056, "traits": [ { "id": "micro-behaviors/communications/http/server/managed::http-request-get", "conf": 1.0, "crit": 3, "desc": "Access to ASP.NET Request object", "spans": [ [ 28060, 11 ] ] }, { "id": "metadata/package/versioning::pe-product-name-present", "conf": 0.949999988079071, "crit": 1, "desc": "PE ProductName field is populated", "spans": [ [ 44092, 8 ] ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "objectives/anti-static/obfuscation/reflection/invoke::namespace-import", "conf": 0.699999988079071, "crit": 1, "desc": "Reflection method namespace token", "spans": [ [ 31378, 17 ] ] }, { "id": "metadata/package/versioning::pe-legal-copyright-present", "conf": 0.949999988079071, "crit": 1, "desc": "PE LegalCopyright field is populated", "spans": [ [ 43896, 30 ] ] }, { "id": "metadata/package/versioning::pe-file-description-present", "conf": 0.949999988079071, "crit": 1, "desc": "PE FileDescription field is populated", "spans": [ [ 43656, 27 ] ] }, { "id": "metadata/hardening/mitigation::pe-dep", "conf": 1.0, "crit": 2, "desc": "DEP / NX enabled (NX_COMPAT)" }, { "id": "metadata/binary/resource::pe-resource-version-first", "conf": 1.0, "crit": 2, "desc": "PE first resource is RT_VERSION" }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "spans": [ [ 44118, 14 ] ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "spans": [ [ 30750, 4 ] ] }, { "id": "metadata/hardening/mitigation::pe-aslr", "conf": 1.0, "crit": 2, "desc": "ASLR enabled (DYNAMIC_BASE)" }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 43102, 15 ] ] }, { "id": "micro-behaviors/process/create/spawn::start-method-token-dotnet", "conf": 0.550000011920929, "crit": 1, "desc": ".NET Start method token", "spans": [ [ 33770, 5 ] ] }, { "id": "micro-behaviors/process/create/spawn::diagnostics-namespace-token-dotnet", "conf": 0.6499999761581421, "crit": 1, "desc": ".NET Diagnostics namespace token", "spans": [ [ 32656, 18 ] ] }, { "id": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "conf": 1.0, "crit": 3, "desc": "JSON polymorphism runtime marker", "spans": [ [ 27270, 16 ] ] }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "spans": [ [ 0, 26 ] ] }, { "id": "micro-behaviors/data/db/access::execute-scalar", "conf": 0.699999988079071, "crit": 3, "desc": "ExecuteScalar method", "spans": [ [ 27751, 13 ] ] }, { "id": "micro-behaviors/data/db/access::db-connection-class", "conf": 0.699999988079071, "crit": 3, "desc": "DbConnection class", "spans": [ [ 31409, 12 ], [ 34283, 12 ] ] }, { "id": "metadata/binary/symbols/imports::single-import-raw", "conf": 0.699999988079071, "crit": 1, "desc": "PE import table has exactly one entry", "spans": [ [ 0, 20 ] ] }, { "id": "micro-behaviors/communications/http/server/managed::http-response-get", "conf": 1.0, "crit": 3, "desc": "Access to ASP.NET Response object", "spans": [ [ 29215, 12 ] ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "spans": [ [ 13308, 4 ] ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "spans": [ [ 43718, 11 ] ] }, { "id": "metadata/package/versioning::version-resource-metadata", "conf": 0.8999999761581421, "crit": 2, "desc": "PE version resource metadata", "spans": [ [ 43102, 15 ], [ 43718, 11 ], [ 44118, 14 ] ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "spans": [ [ 13308, 4 ] ] }, { "id": "objectives/evasion/masquerade/identity/vendor::importless-microsoft-recognized-marker", "conf": 0.8999999761581421, "crit": 3, "desc": "Recognized Microsoft importless PE marker", "spans": [ [ 13308, 4 ] ] } ], "type": "pe" }, { "ctx": [ { "b": "ju[7cy-)[jA=U@kzAPf#e?!Flj{\u003cz.z^$%rarR^HjyJqLwO\u003e))C%hMTarR^HarR^?zEEx[k38AiDsyr2xd=OXByu^\u0026vq{f%AXo.4B98tqjtgOXzdL)rarR^", "ln": 0, "col": 1, "line": 1 }, { "b": "wJ.kii-*0eDsyr2xd=OXByu^\u0026vq{f%AXo.4B98tqe\u003c%b!AaK5TvNUJMv%8)iAXpjiwPA5ZB9RUku%\u003eYqq*ACawO\u003c4/vrt{gnKN2Pz/fD7v@#B6zy!.iB97#ge(M\u003ejx(mMmq*ACawO\u003c4}vRPE:BsZvoB97#ge\u003c%b\u0026vj\u003ebtvPmwRzGxk@BzkVhek{?nBy/qwra{q-vpT7\u0026xd=LWzEWl]y*?B1z/eJ)yH}xjb0DtRarR^HarR^HarR^?B9htpvrcSS3lQDlarR^HarR^HavQI", "ln": 649, "col": 20, "line": 16 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 29902, "entropy": 4.79 }, "binary": { "peak_region_bytes": 29696, "peak_region_entropy": 4.86 } } }, "id": 4, "mol": "H(Db)", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/SoftwareExtravaganza.Whizbang.Data.Dapper.Custom/SoftwareExtravaganza.Whizbang.Data.Dapper.Custom.0.779.1-alpha.3.nupkg!!lib/net10.0/Whizbang.Data.Dapper.Custom.xml", "pid": 0, "risk": 1, "sha": "807156ff99689b16e741821b5aa5f81e276018abaf2f381e6af3615bed198a70", "size": 29902, "traits": [ { "id": "micro-behaviors/data/serialize/object::dotnet-framework-assembly-type", "conf": 0.96, "crit": 3, "desc": "Assembly-qualified System type", "spans": [ [ 713, 27 ] ] } ], "type": "xml" }, { "ctx": [ { "b": "lrc#RpdD{NwfKi8z/fVqx\u003c#jbx(mMCfjv3KjtgUq3jn[mayP82xkP\u003cRv}xL1wPw$U3lQDNvixl7wOa7HxMOunB2\u003e%cxk8E3BZ=$kz/4dKxLz^4vqYZfy?WuiCw7YpvQTd!fjwvjx(v)gfl.tPyI4y3CxkAEx!BWFy:859x(dG9B8\u003e+Nb4#7uAc15[fk20vxMW=pv@DiqCw7YpvQTd!eO]cgfl.8zDsyr2xd)X6BzkVhB1.-QA+/o6z*cmQv}^Mvzep\u003emvpT0", "ln": 304, "col": 18, "line": 8 }, { "b": "vqGT\u003czAPgNwO#Q3AW0Xfvixl7wOa7HxMOunB2\u003e%cCw7YpvQQ)bxcGJqwNP9(Bzbkdw{4{aay]z2B.$YcByxo9z/cXaBrC^vx)Kk%e]Cq:fjv4bfk9d93jnvpeEz?fboQ63C{3g4x)Kk%zF8fv3n0wIdNE@WDtdnfaw=S\u0026w]zZbvqYN^dK(O2FrRfsatLS*B0bgmePt-Gv}x.5az\u003eXhB75Y)ay]hcAa9\u0026#xDRIkBz8!ywPzYivqG:#v{%E[z/fRsz/cXtxK@r1z/^avvrue\u0026eG=I)pgnlUC4z^ZpGeDGA=k!ql$7u-pI%.[dJ)-3LPS[yB-H#6azkn6wPzj3z/P[wCwh8eaz2.cA^m", "ln": 2082, "col": 5, "line": 31 }, { "b": "BzkP6aA?spx\u003ez6?vruj4zxJ\u003efaz\u003eXhB75Y)azth3wnC*$B1wCOz/{eozF7HyvqYP#wP?T5BrCTmxK#3?A%:GwdK)?$C4CGdAaK5jmr\u0026=.A+P95v}vbtaMv{oaw#]-xDP(mmiDU]AbY-oBrC^wBz8!bz!9A4zEEZ5xjk)@z/d9GwnbE+zF%Prx\u003e8h", "ln": 2451, "col": 29, "line": 39 }, { "b": "A%-m7dPf?/wPh:fA=SYWaMv{oax9w\u003cBy/o1B8@EvwPI{3xjSi0vqYQ(wPz\u0026mBzb98aAz46wODs0ay/tbzddr)B0a[ewft\u0026iz!a02wGUMcwO#Qhe*absAaHRxvp\u003c6[CwhejazbC3CXHS6wGV28B8V5nB7DFoD2Ntoe^.}ndNW#(Aa9\u0026#xK#ildJ)-3", "ln": 2652, "col": 16, "line": 42 }, { "b": "BrCgoz/3RdC4CMkaAITBwNPB%e*9-6wncj3wozr%y\u003cvdpvrl9lBAg/1yH}30w]zYjx(mB3wO(0@Byw#dze0T6vruj4zy#n6dK[b6zGxxgdK(O2FrRfzz/6DiB75J]wGU#nwPA5sAb](iwN/*@z/fRsz*2YjaAg[jB8UY2Bzk]fay[]5vix=dBz8=", "ln": 2968, "col": 51, "line": 48 }, { "b": "x(v\u003e@eG=I)mmFy!z/Pzif!+7batj\u0026!dNWY:AaK5tdJ)-3LPSwpvqE5%vrt{2vpJ!UB8@EFx([2hB8Mhwv}vl8wO#71vru6\u003eaz(4cwO=z{eG=I)qG3R)D2s:6z/{8gwGTGOzE)\u0026%Bz(hvdK(O2FrRfzz/6Dcy?khux(dA7Cwh8izF787z/M$vwN/p\u003cBz?", "ln": 4728, "col": 87, "line": 78 }, { "b": "v}vl8wO#71vru6\u003eaA?gfB.8XlvRPE:BAm=@bo[s3wPS3dzF77\u003cByxiiwN(bPu%)wKvrl8?wn=NcwPP56wmM*4vpK7YxjSh:z!s9nvrb{FCYW$mC422(zHb.zs7(q]vQTd!e\u003c\u003cL$wEq*Mu\u003cWltwO00axK@q\u003cqfuO.yAML$vrcDjxlv{0wNcY$BAzFyiXJb", "ln": 5072, "col": 21, "line": 83 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 5682, "entropy": 5.2 }, "text": { "lines": 107, "top_char": 101, "max_ws_run": 26, "digit_ratio": 0.01, "space_count": 602, "char_entropy": 5.2, "unique_chars": 83, "top_char_null": 0, "lines_over_200": 4, "top_char_ratio": 0.07, "avg_line_length": 52.1, "max_line_length": 226, "non_ascii_ratio": 0.03, "empty_line_ratio": 0.27, "last_line_length": 14, "long_token_count": 1, "whitespace_ratio": 0.12, "line_length_stddev": 58.31, "repeated_char_sequences": 9 }, "binary": { "peak_region_bytes": 5682, "peak_region_entropy": 5.28 } } }, "id": 5, "mol": "H(Cm)", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/SoftwareExtravaganza.Whizbang.Data.Dapper.Custom/SoftwareExtravaganza.Whizbang.Data.Dapper.Custom.0.779.1-alpha.3.nupkg!!README.md", "pid": 0, "risk": 1, "sha": "39ec231770e710b1351884d0b8923b125b6996d103322ae616f87890cc74896f", "size": 5682, "traits": [ { "id": "metadata/lang/natural::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"", "spans": [ [ 2130, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-2", "conf": 0.8, "crit": 1, "desc": "English function-word token \"and\"", "spans": [ [ 2499, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-3", "conf": 0.8, "crit": 1, "desc": "English function-word token \"that\"", "spans": [ [ 2700, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "spans": [ [ 3016, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-6", "conf": 0.8, "crit": 1, "desc": "English function-word token \"with\"", "spans": [ [ 2264, 0 ] ] }, { "id": "micro-behaviors/communications/http/url/forge::public-code-forge-url", "conf": 0.9, "crit": 3, "desc": "References a public code-forge URL", "spans": [ [ 368, 19 ] ] } ], "type": "markdown" }, { "id": 6, "sha": "c61516016362b41ef84710a6a4a2b39f70a06d4b0c65f3d2ca9ebfd2de62348d", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/SoftwareExtravaganza.Whizbang.Data.Dapper.Custom/SoftwareExtravaganza.Whizbang.Data.Dapper.Custom.0.779.1-alpha.3.nupkg!!logo.png", "size": 67200, "type": "png", "depth": 1 }, { "id": 7, "sha": "b858fadd5794c5a53fcbaa7a45db7aa5f6ab1fd173ba71cc2625214ee1509c6a", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/SoftwareExtravaganza.Whizbang.Data.Dapper.Custom/SoftwareExtravaganza.Whizbang.Data.Dapper.Custom.0.779.1-alpha.3.nupkg!![Content_Types].xml", "size": 644, "type": "xml", "depth": 1 }, { "id": 8, "sha": "6c62dc5825f245b00b51305b8d99fc41a6c2abeafb0e0039f4fe83d42828ee83", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/SoftwareExtravaganza.Whizbang.Data.Dapper.Custom/SoftwareExtravaganza.Whizbang.Data.Dapper.Custom.0.779.1-alpha.3.nupkg!!package/services/metadata/core-properties/baaad58487a24356abebb6bf2a7894e2.psmdcp", "size": 867, "type": "xml", "depth": 1 }, { "id": 9, "sha": "39528cdf53993da6f9239740d818db50b43778c6cf0924c775054f1ffcc5680c", "path": "SoftwareExtravaganza.Whizbang.Data.Dapper.Custom@0.779.1-alpha.3.registry.json", "size": 902, "type": "registry", "depth": 1 } ], "omitted_files": 4, "rev": "46112", "v": "8" } }