{ "llm": { "conf": 0.7343273, "grade": "benign", "model": "Qwen/Qwen3.6-27B", "review": false, "outcome": "benign", "interpretation": "Legitimate Microsoft-signed Xamarin library" }, "ml": { "v": "7", "eng": "2.2.0-rc.1", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.62046754, "rte": "az", "prob": 0.62046754 }, { "cls": 0, "raw": 0.72269785, "rte": "az/zip", "prob": 0.72269785 } ], "prob": 0.62046754, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.6204675436019897, "type": "nupkg" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.6204675436019897, "type": "xml" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.000041544437408447266, "type": "xml" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.000012367963790893555, "type": "zip" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.6204675436019897, "type": "xml" }, { "id": 5, "lvl": -1, "conf": 0, "prob": 0.6204675436019897, "type": "text" }, { "id": 6, "lvl": -1, "conf": 0, "prob": 0.000011553366675798316, "type": "jar" }, { "id": 7, "lvl": -1, "conf": 0, "prob": 0.6204675436019897, "type": "java_class" }, { "id": 8, "lvl": -1, "conf": 0, "prob": 0.6204675436019897, "type": "java_class" }, { "id": 9, "lvl": -1, "conf": 0, "prob": 0.6204675436019897, "type": "java_class" }, { "id": 10, "lvl": -1, "conf": 0, "prob": 0.6204675436019897, "type": "java_class" }, { "id": 11, "lvl": -1, "conf": 0, "prob": 0.6204675436019897, "type": "java_class" }, { "id": 12, "lvl": -1, "conf": 0, "prob": 0.6204675436019897, "type": "java_class" }, { "id": 13, "lvl": -1, "conf": 0, "prob": 0.6204675436019897, "type": "java_class" }, { "id": 14, "lvl": -1, "conf": 0, "prob": 0.6204675436019897, "type": "java_class" }, { "id": 15, "lvl": -1, "conf": 0, "prob": 0.6204675436019897, "type": "java_class" }, { "id": 16, "lvl": -1, "conf": 0, "prob": 0.6204675436019897, "type": "java_class" }, { "id": 17, "lvl": -1, "conf": 0, "prob": 0.6204675436019897, "type": "java_class" }, { "id": 18, "lvl": -1, "conf": 0, "prob": 0.6204675436019897, "type": "java_class" }, { "id": 19, "lvl": -1, "conf": 0, "prob": 0.6204675436019897, "type": "java_class" }, { "id": 20, "lvl": -1, "conf": 0, "prob": 0.6204675436019897, "type": "java_class" }, { "id": 21, "lvl": -1, "conf": 0, "prob": 0.6204675436019897, "type": "java_class" }, { "id": 22, "lvl": -1, "conf": 0, "prob": 0.6204675436019897, "type": "java_class" }, { "id": 23, "lvl": -1, "conf": 0, "prob": 0.6204675436019897, "type": "java_class" }, { "id": 24, "lvl": -1, "conf": 0, "prob": 0.6204675436019897, "type": "json" }, { "id": 25, "lvl": -1, "conf": 0, "prob": 0.000013460715308610816, "type": "text" }, { "id": 26, "lvl": -1, "conf": 0, "prob": 0.000012367963790893555, "type": "zip" }, { "id": 27, "lvl": -1, "conf": 0, "prob": 0.6204675436019897, "type": "xml" }, { "id": 28, "lvl": -1, "conf": 0, "prob": 0.6204675436019897, "type": "text" }, { "id": 29, "lvl": -1, "conf": 0, "prob": 0.6204675436019897, "type": "jar" }, { "id": 30, "lvl": -1, "conf": 0, "prob": 0.6204675436019897, "type": "java_class" }, { "id": 31, "lvl": -1, "conf": 0, "prob": 0.6204675436019897, "type": "java_class" }, { "id": 32, "lvl": -1, "conf": 0, "prob": 0.6204675436019897, "type": "java_class" }, { "id": 33, "lvl": -1, "conf": 0, "prob": 0.6204675436019897, "type": "java_class" }, { "id": 34, "lvl": -1, "conf": 0, "prob": 0.6204675436019897, "type": "java_class" }, { "id": 35, "lvl": -1, "conf": 0, "prob": 0.6204675436019897, "type": "java_class" }, { "id": 36, "lvl": -1, "conf": 0, "prob": 0.6204675436019897, "type": "java_class" }, { "id": 37, "lvl": -1, "conf": 0, "prob": 0.6204675436019897, "type": "java_class" }, { "id": 38, "lvl": -1, "conf": 0, "prob": 0.6204675436019897, "type": "java_class" }, { "id": 39, "lvl": -1, "conf": 0, "prob": 0.6204675436019897, "type": "java_class" }, { "id": 40, "lvl": -1, "conf": 0, "prob": 0.6204675436019897, "type": "java_class" }, { "id": 41, "lvl": -1, "conf": 0, "prob": 0.6204675436019897, "type": "java_class" }, { "id": 42, "lvl": -1, "conf": 0, "prob": 0.6204675436019897, "type": "java_class" }, { "id": 43, "lvl": -1, "conf": 0, "prob": 0.6204675436019897, "type": "java_class" }, { "id": 44, "lvl": -1, "conf": 0, "prob": 0.6204675436019897, "type": "java_class" }, { "id": 45, "lvl": -1, "conf": 0, "prob": 0.6204675436019897, "type": "java_class" }, { "id": 46, "lvl": -1, "conf": 0, "prob": 0.6204675436019897, "type": "java_class" }, { "id": 47, "lvl": -1, "conf": 0, "prob": 0.6204675436019897, "type": "json" }, { "id": 48, "lvl": -1, "conf": 0, "prob": 0.000013460715308610816, "type": "text" }, { "id": 49, "lvl": -1, "conf": 0, "prob": 0.000014076630577619653, "type": "png" }, { "id": 50, "lvl": -1, "conf": 0, "prob": 0.000012656052604143042, "type": "text" }, { "id": 51, "lvl": -1, "conf": 0, "prob": 0.6204675436019897, "type": "xml" }, { "id": 52, "lvl": -1, "conf": 0, "prob": 0.6204675436019897, "type": "xml" }, { "id": 53, "lvl": -1, "conf": 0, "prob": 0.370838463306427, "type": "pe" }, { "id": 54, "lvl": -1, "conf": 0, "prob": 0.6204675436019897, "type": "xml" }, { "id": 55, "lvl": -1, "conf": 0, "prob": 0.3801674544811249, "type": "pe" }, { "id": 56, "lvl": -1, "conf": 0, "prob": 0.6204675436019897, "type": "xml" }, { "id": 57, "lvl": -1, "conf": 0, "prob": 0.6204675436019897, "type": "markdown" }, { "id": 58, "lvl": -1, "conf": 0, "prob": 0.6204675436019897, "type": "xml" }, { "id": 59, "lvl": -1, "conf": 0, "prob": 0.6204675436019897, "type": "xml" }, { "id": 60, "lvl": -1, "conf": 0, "prob": 0.6204675436019897, "type": "markdown" }, { "id": 61, "lvl": -1, "conf": 0, "prob": 0.6204675436019897, "type": "xml" }, { "id": 62, "lvl": -1, "conf": 0, "prob": 0.6204675436019897, "type": "xml" }, { "id": 63, "lvl": -1, "conf": 0, "prob": 0.6204675436019897, "type": "registry" } ], "version": "v18.18", "analyzed_at": "2026-06-28T00:19:11Z" }, "path": "Xamarin.GooglePlayServices.Stats.117.1.0.10.nupkg", "raw": { "files": [ { "id": 0, "mol": "Md₂(BiSi₂)", "sha": "b382ac59fa974c04b3cafcef48f543705a3322b1145c6d4d208718eefcf057b9", "path": "Xamarin.GooglePlayServices.Stats.117.1.0.10.nupkg", "risk": 5, "size": 136984, "type": "nupkg", "facts": { "metrics": { "file": { "size": 136984.0, "entropy": 7.97, "size_bytes": 136984.0 }, "binary": { "overall_entropy": 7.97, "peak_region_bytes": 130048.0, "peak_region_entropy": 7.83 }, "archive": { "file_count": 21.0, "member_count": 21.0, "script_count": 0.0, "zip_bomb_ratio": 3.8, "directory_count": 0.0, "executable_count": 2.0, "extra_field_size": 0.0, "noise_file_count": 0.0, "total_compressed": 133474.0, "compression.ratio": 0.67, "hidden_file_count": 2.0, "total_uncompressed": 200451.0, "crc_collision_count": 5.0, "entry_comment_count": 0.0, "max_filename_length": 81.0, "rtlo_filename_count": 0.0, "format.regular_count": 21.0, "nested_archive_count": 0.0, "path_traversal_count": 0.0, "symlink_escape_count": 0.0, "security.setgid_count": 0.0, "security.setuid_count": 0.0, "security.sticky_count": 0.0, "double_extension_count": 0.0, "duplicate_member_count": 0.0, "security.symlink_count": 0.0, "unicode_filename_count": 0.0, "homoglyph_filename_count": 0.0, "security.encrypted_count": 0.0, "timing.mtime_unique_count": 9.0, "timing.mtime_unique_ratio": 0.43, "misplaced_executable_count": 2.0, "timing.mtime_dominant_count": 4.0, "timing.mtime_spread_seconds": 74566.0, "timing.sentinel_mtime_count": 0.0, "security.world_writable_count": 0.0, "timing.mtime_dominant_fraction": 0.19, "compression.method_counts.stored": 1.0, "compression.method_counts.deflate": 20.0 } } }, "ident": { "name": { "value": ".NET for Android and MAUI bindings for the Android Java library 'com.google.android.gms:play-services-stats'.", "source": "nupkg.title", "verified": false }, "urls": [ { "url": "https://aka.ms/android-libraries", "kind": "homepage", "source": "nupkg.project_url" }, { "url": "https://github.com/dotnet/android-libraries.git", "kind": "repository", "source": "nupkg.repository_url" } ], "trust": "unsigned", "authors": [ { "name": "Microsoft", "role": "author", "source": "nupkg.authors" } ], "version": { "value": "117.1.0.10", "source": "nupkg.version", "verified": false }, "identifier": { "value": "Xamarin.GooglePlayServices.Stats", "source": "nupkg.id", "verified": false } }, "traits": [ { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "from": [ { "file": 53 }, { "file": 55 } ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "metadata/signed/certificate/identity::pe-cert-issuer-microsoft-pca", "conf": 1.0, "crit": 2, "desc": "Issued by a Microsoft Code Signing PCA" }, { "id": "metadata/package/quality/false-positives::common-fp-context", "conf": 0.8999999761581421, "crit": 2, "desc": "Common false positive indicators (Delphi, ApiSet, etc.)", "from": [ { "file": 53 }, { "file": 55 } ] }, { "id": "metadata/signed/leaf::microsoft-corporation", "conf": 1.0, "crit": 3, "desc": "Signed by Microsoft Corporation", "from": [ { "file": 53 } ] }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "from": [ { "file": 53 } ], "spans": [ [ 0, 26 ] ] }, { "id": "metadata/signed/certificate/identity::pe-signature-verified-kv", "conf": 1.0, "crit": 2, "desc": "PE Authenticode signature verified metadata" }, { "id": "metadata/binary/layout::overlay-dominates-third", "conf": 0.9200000166893005, "crit": 3, "desc": "Overlay exceeds one-third", "from": [ { "file": 53 } ], "spans": [ [ 0, 27 ] ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "from": [ { "file": 53 } ] }, { "id": "metadata/signed/unknown::microsoft-corporation", "conf": 1.0, "crit": 3, "desc": "Authenticode chain CN: Microsoft Corporation", "from": [ { "file": 53 } ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "from": [ { "file": 53 } ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "from": [ { "file": 53 } ] }, { "id": "metadata/binary/layout::overlay-over-35pct", "conf": 0.9399999976158142, "crit": 3, "desc": "PE overlay exceeds thirty-five percent", "from": [ { "file": 55 } ] }, { "id": "metadata/binary/vendor::microsoft-corp-marker-cert", "conf": 0.8999999761581421, "crit": 1, "desc": "Microsoft vendor marker in certificate data", "from": [ { "file": 53 } ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "from": [ { "file": 53 } ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "from": [ { "file": 53 } ] }, { "id": "metadata/binary/vendor::microsoft-corp-marker-rsrc", "conf": 0.8999999761581421, "crit": 1, "desc": "Microsoft vendor marker in resource section", "from": [ { "file": 53 } ] }, { "id": "metadata/binary/debug::pdb-visual-studio", "crit": 3, "desc": "Visual Studio build path", "spans": [ [ 15468, 135 ] ] }, { "id": "metadata/signed/platform::microsoft", "conf": 0.9800000190734863, "crit": 2, "desc": "Microsoft-signed Windows binary", "from": [ { "off": 0, "file": 53 }, { "off": 0, "file": 55 } ] } ] }, { "id": 1, "sha": "4b1d70de97a10ea0518f735ca4e7c32a618b83e9722e4121a0f8060075a20e03", "path": "Xamarin.GooglePlayServices.Stats.117.1.0.10.nupkg!!_rels/.rels", "size": 526, "type": "xml", "depth": 1 }, { "ctx": [ { "b": "[4ls%kx}3YaA?spB7]MgjT8QkfD}SJzEWP}x(mMDb6w0teJs}sj]", "n": [ { "c": 2, "d": "NuGet nuspec manifest file", "i": "metadata/build/manifest::nuspec-file", "o": 0, "z": 39, "cf": 0.9800000190734863 } ], "ln": 1, "addr": 0 }, { "b": "jAa.syHH\u003c!aB4:tzGv@+xMOuniXJdcv}YB\u003cvrj5rx\u003e8g4B8LVje[n*pfk$ufyHH\u003c\u0026zF7QTfFLvpfF$I3B-RIkv\u003eJ1EwfKh", "ln": 2, "addr": 43 }, { "b": "arS^-wPRu\u003evrt{w", "ln": 3, "addr": 120 }, { "b": "arR^Hjy-qGD2^RixMMCPSus]Hv@=Hez!s8llVm0:z/Podx(v(wavf*WaAzgexMOqrA+fr6A=#28e\u003c7^%z/x#xx\u003eIa3j]", "ln": 15, "addr": 819 }, { "b": "arR^HjAL1AB3s?SzddE0zxJwdBzkt}v@%\u003ezz/4atz/oo8wIdzewo8Q5wg?IiB2[nRvr\u003cCCwPz%dv}xZkB97\u0026jB0a[iBzkt}v@#73wPz\u003caz/fb%j.5zEe[Y9vxkzcivqYQ@z!S-mxkIYJAbn%dePUGzC4\u003eC$B1IDPvruMKf/HZte?/yvByw*6j]", "ln": 16, "addr": 894 }, { "b": "arR^HjAt1Lz/YSmz/QaCBA}?pjTaJMBrR\u0026IA+)(.xMOunB2\u003e%cxk8E3BZ=$kz/4drz//(dBt46uwo8Q5wg.RivSC)$x\u003equrxk8DiayYw1zEWuyb64mbB1.irvpTBjzddc@a%pxlzeB0ejT8*[hdX:4v}5\u003eTvR5$Vh-1]Pi5a@0vkoR]vk}:NvRfjfiB:-$ggqvHffP", "n": [ { "c": 2, "d": "NuGet package declares repository", "i": "metadata/package/files/nuget::nuspec-repository", "o": 1045, "z": 109, "cf": 0.8999999761581421 } ], "ln": 17, "addr": 1041 }, { "b": "arR^Hjy\u00262xwO#3\u0026zEWx(B3o", "n": [ { "c": 2, "d": "NuGet package declares dependencies", "i": "metadata/package/files/nuget::nuspec-dependencies", "o": 1205, "z": 661, "cf": 0.8999999761581421 } ], "ln": 18, "addr": 1201 }, { "b": "arR^HarS^VA=l8taAR4jxjVfOA:-/@Cw?IqjTa=PBtkE4fFcZJwo8Q5whua@fD@W", "ln": 19, "addr": 1221 }, { "b": "arR^HarR^Hjy\u00262xwO#3\u0026zEW@mx\u003efvJsyD5PA+Pzzl2HjNz!S-:e\u003e/??vpKNnq*04#z/P}LlVm0Re(^1cy\u0026Z^yC4CYnx(v(La#7Y7e?![lhZfwUzEWH9wmW[Fl2puYatk[", "ln": 20, "addr": 1274 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 2004.0, "entropy": 5.1, "size_bytes": 2004.0 }, "binary": { "overall_entropy": 5.1, "peak_region_bytes": 2004.0, "peak_region_entropy": 5.02 } } }, "id": 2, "path": "Xamarin.GooglePlayServices.Stats.117.1.0.10.nupkg!!Xamarin.GooglePlayServices.Stats.nuspec", "risk": 1, "sha": "89a05ff8c7133145cdeafc0047b4ab59500b873788667f13859288d01544c037", "size": 2004, "traits": [ { "id": "metadata/build/manifest::nuspec-file", "conf": 0.9800000190734863, "crit": 2, "desc": "NuGet nuspec manifest file", "spans": [ [ 0, 39 ] ] }, { "id": "metadata/package/files/nuget::nuspec-repository", "conf": 0.8999999761581421, "crit": 2, "desc": "NuGet package declares repository", "spans": [ [ 1045, 109 ] ] }, { "id": "metadata/package/files/nuget::nuspec-dependencies", "conf": 0.8999999761581421, "crit": 2, "desc": "NuGet package declares dependencies", "spans": [ [ 1205, 661 ] ] } ], "type": "xml" }, { "depth": 1, "facts": { "metrics": { "file": { "size": 14756.0, "entropy": 7.96, "size_bytes": 14756.0 }, "binary": { "overall_entropy": 7.96, "peak_region_bytes": 14336.0, "peak_region_entropy": 7.81 }, "archive": { "file_count": 5.0, "member_count": 5.0, "script_count": 0.0, "zip_bomb_ratio": 11.51, "directory_count": 0.0, "executable_count": 5.0, "extra_field_size": 0.0, "noise_file_count": 0.0, "total_compressed": 14186.0, "compression.ratio": 0.15, "hidden_file_count": 0.0, "total_uncompressed": 94026.0, "crc_collision_count": 0.0, "entry_comment_count": 0.0, "max_filename_length": 25.0, "rtlo_filename_count": 0.0, "format.regular_count": 5.0, "nested_archive_count": 1.0, "path_traversal_count": 0.0, "symlink_escape_count": 0.0, "security.setgid_count": 0.0, "security.setuid_count": 0.0, "security.sticky_count": 0.0, "double_extension_count": 0.0, "duplicate_member_count": 0.0, "security.symlink_count": 0.0, "unicode_filename_count": 0.0, "homoglyph_filename_count": 0.0, "security.encrypted_count": 0.0, "timing.mtime_unique_count": 1.0, "timing.mtime_unique_ratio": 0.2, "misplaced_executable_count": 0.0, "timing.mtime_dominant_count": 5.0, "timing.mtime_spread_seconds": 0.0, "timing.sentinel_mtime_count": 0.0, "security.world_writable_count": 0.0, "timing.mtime_dominant_fraction": 1.0, "compression.method_counts.deflate": 5.0 } } }, "id": 3, "path": "Xamarin.GooglePlayServices.Stats.117.1.0.10.nupkg!!lib/net10.0-android36.0/play-services-stats.aar", "risk": 1, "sha": "51b4db6c043ce5e3fcd97e727237a46be1a92c033aaa8eaaef6ae746f19b42ba", "size": 14756, "traits": [ { "id": "metadata/package/metrics::compact-jar-archive", "conf": 0.8999999761581421, "crit": 2, "desc": "Compact JAR archive size", "from": [ { "file": 6 } ] }, { "id": "micro-behaviors/os/env/access::jvm-system-class-ref", "conf": 0.8600000143051147, "crit": 2, "desc": "JVM System class reference" }, { "id": "metadata/binary/metrics/structural::many-imports", "conf": 0.800000011920929, "crit": 2, "desc": "High number of imported symbols (\u003e80)", "from": [ { "file": 18 } ] } ], "type": "zip" }, { "id": 4, "sha": "85ccdcc9532e8509925a28ef5ca3de418665ec2aa202e970f9c605de4e0e6bcb", "path": "lib/net10.0-android36.0/play-services-stats.aar!!lib/net10.0-android36.0/play-services-stats.aar!AndroidManifest.xml", "size": 226, "type": "xml", "depth": 2 }, { "id": 5, "sha": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "path": "lib/net10.0-android36.0/play-services-stats.aar!!lib/net10.0-android36.0/play-services-stats.aar!R.txt", "size": 0, "type": "text", "depth": 2 }, { "depth": 2, "facts": { "metrics": { "jar": { "class_count": 17.0, "entry_count": 19.0, "signature_count": 0.0, "embedded_jar_count": 0.0 }, "file": { "size": 21345.0, "entropy": 5.7, "size_bytes": 21345.0 }, "binary": { "overall_entropy": 5.7, "peak_region_bytes": 11264.0, "peak_region_entropy": 5.66 }, "archive": { "file_count": 19.0, "member_count": 19.0, "script_count": 0.0, "zip_bomb_ratio": 1.0, "directory_count": 0.0, "executable_count": 0.0, "extra_field_size": 0.0, "noise_file_count": 0.0, "total_compressed": 18247.0, "compression.ratio": 1.0, "hidden_file_count": 0.0, "total_uncompressed": 18247.0, "crc_collision_count": 0.0, "entry_comment_count": 0.0, "max_filename_length": 64.0, "rtlo_filename_count": 0.0, "format.regular_count": 19.0, "nested_archive_count": 0.0, "path_traversal_count": 0.0, "symlink_escape_count": 0.0, "security.setgid_count": 0.0, "security.setuid_count": 0.0, "security.sticky_count": 0.0, "double_extension_count": 0.0, "duplicate_member_count": 0.0, "security.symlink_count": 0.0, "unicode_filename_count": 0.0, "homoglyph_filename_count": 0.0, "security.encrypted_count": 0.0, "timing.mtime_unique_count": 1.0, "timing.mtime_unique_ratio": 0.05, "misplaced_executable_count": 0.0, "timing.mtime_dominant_count": 19.0, "timing.mtime_spread_seconds": 0.0, "timing.sentinel_mtime_count": 0.0, "security.world_writable_count": 0.0, "timing.mtime_dominant_fraction": 1.0, "compression.method_counts.stored": 19.0 } } }, "id": 6, "ident": { "trust": "unsigned", "producer": { "value": "singlejar", "source": "jar.manifest.created_by", "verified": false } }, "path": "lib/net10.0-android36.0/play-services-stats.aar!!lib/net10.0-android36.0/play-services-stats.aar!classes.jar", "risk": 1, "sha": "0dc51d1b3d0c189af05d113b08a2070c8ed7d1b811de3e599b01b7797abdb61d", "size": 21345, "traits": [ { "id": "metadata/binary/metrics/structural::many-imports", "conf": 0.800000011920929, "crit": 2, "desc": "High number of imported symbols (\u003e80)", "from": [ { "file": 41 } ] }, { "id": "micro-behaviors/os/env/access::jvm-system-class-ref", "conf": 0.8600000143051147, "crit": 2, "desc": "JVM System class reference" }, { "id": "metadata/package/metrics::compact-jar-archive", "conf": 0.8999999761581421, "crit": 2, "desc": "Compact JAR archive size", "spans": [ [ 0, 26 ] ] } ], "type": "jar" }, { "id": 7, "sha": "b7b09fd69b0c8d7d011f0893f5fb6776c2d25c0e7636dd11a5be996928b8e730", "path": "lib/net10.0-android36.0/play-services-stats.aar!classes.jar!!lib/net10.0-android36.0/play-services-stats.aar!classes.jar!com/google/android/gms/internal/stats/zza.class", "size": 279, "type": "java_class", "depth": 3 }, { "id": 8, "sha": "03f9a7b3f29c6bfc033383647ddd0d26410cd8a738d0bb71aa7e842034788ed2", "path": "lib/net10.0-android36.0/play-services-stats.aar!classes.jar!!lib/net10.0-android36.0/play-services-stats.aar!classes.jar!com/google/android/gms/internal/stats/zzb.class", "size": 696, "type": "java_class", "depth": 3 }, { "id": 9, "sha": "391769a9b4e63bd68b095ce088b2132a12193f8be9de1fccb1fdb9896184426e", "path": "lib/net10.0-android36.0/play-services-stats.aar!classes.jar!!lib/net10.0-android36.0/play-services-stats.aar!classes.jar!com/google/android/gms/internal/stats/zzc.class", "size": 167, "type": "java_class", "depth": 3 }, { "id": 10, "sha": "447f05ba32e1c57d085ac8bc52547797095da39d853a943639e69edd71a5ddff", "path": "lib/net10.0-android36.0/play-services-stats.aar!classes.jar!!lib/net10.0-android36.0/play-services-stats.aar!classes.jar!com/google/android/gms/internal/stats/zzd.class", "size": 279, "type": "java_class", "depth": 3 }, { "id": 11, "sha": "0fc8c2a4be4624071104dec08cf1cf2f7c7f0e721192ea8008d600bffd1f0b30", "path": "lib/net10.0-android36.0/play-services-stats.aar!classes.jar!!lib/net10.0-android36.0/play-services-stats.aar!classes.jar!com/google/android/gms/internal/stats/zze.class", "size": 167, "type": "java_class", "depth": 3 }, { "id": 12, "sha": "69b0c60bb7361459d2771bc654497d27ed1d99e1d966ebb0120dfea4e1b6727d", "path": "lib/net10.0-android36.0/play-services-stats.aar!classes.jar!!lib/net10.0-android36.0/play-services-stats.aar!classes.jar!com/google/android/gms/internal/stats/zzf.class", "size": 167, "type": "java_class", "depth": 3 }, { "id": 13, "sha": "c9458ac66b56d0b83b0ad132c898436f296ada4e4eedfacb3e25c336e1337cd2", "path": "lib/net10.0-android36.0/play-services-stats.aar!classes.jar!!lib/net10.0-android36.0/play-services-stats.aar!classes.jar!com/google/android/gms/internal/stats/zzg.class", "size": 389, "type": "java_class", "depth": 3 }, { "id": 14, "sha": "f21777de9d8857fba432b8cc3097c7714ea2e4c30df51d673c7de24f23f76fd4", "path": "lib/net10.0-android36.0/play-services-stats.aar!classes.jar!!lib/net10.0-android36.0/play-services-stats.aar!classes.jar!com/google/android/gms/internal/stats/zzh.class", "size": 524, "type": "java_class", "depth": 3 }, { "id": 15, "sha": "3c0baa2e186238de9385803366e9f6875c8ba08ee1fa6664b84d1ef24714e905", "path": "lib/net10.0-android36.0/play-services-stats.aar!classes.jar!!lib/net10.0-android36.0/play-services-stats.aar!classes.jar!com/google/android/gms/internal/stats/zzi.class", "size": 432, "type": "java_class", "depth": 3 }, { "id": 16, "sha": "52990e40c6a1251802323e24eed088daf5f96e4623fca256fac58d95c862beb1", "path": "lib/net10.0-android36.0/play-services-stats.aar!classes.jar!!lib/net10.0-android36.0/play-services-stats.aar!classes.jar!com/google/android/gms/stats/CodePackage.class", "size": 1024, "type": "java_class", "depth": 3 }, { "id": 17, "sha": "da8530b03863109bbb7f809f77c495206eb83c420294fd749a731e35e66b78b4", "path": "lib/net10.0-android36.0/play-services-stats.aar!classes.jar!!lib/net10.0-android36.0/play-services-stats.aar!classes.jar!com/google/android/gms/stats/GCoreWakefulBroadcastReceiver.class", "size": 910, "type": "java_class", "depth": 3 }, { "id": 18, "sha": "7df909d8a27e7a7b2507c40aa1434df2030f8cb253fe19e9486c9465d59e1904", "path": "lib/net10.0-android36.0/play-services-stats.aar!classes.jar!!lib/net10.0-android36.0/play-services-stats.aar!classes.jar!com/google/android/gms/stats/WakeLock.class", "risk": 1, "size": 11716, "type": "java_class", "depth": 3 }, { "id": 19, "sha": "6947562da5d18d005a509b7e9cfbf9c6bf2a37254029cf208374cee27f5adad2", "path": "lib/net10.0-android36.0/play-services-stats.aar!classes.jar!!lib/net10.0-android36.0/play-services-stats.aar!classes.jar!com/google/android/gms/stats/zza.class", "size": 456, "type": "java_class", "depth": 3 }, { "id": 20, "sha": "813e2aee8142a72ce3156665ced490f986e0e4d3c36c9e00446cb2b9d0fd81da", "path": "lib/net10.0-android36.0/play-services-stats.aar!classes.jar!!lib/net10.0-android36.0/play-services-stats.aar!classes.jar!com/google/android/gms/stats/zzb.class", "size": 261, "type": "java_class", "depth": 3 }, { "id": 21, "sha": "1aef10c2435bae255ba4d34236cad856efcba8f42a437fd7077063ff49da242c", "path": "lib/net10.0-android36.0/play-services-stats.aar!classes.jar!!lib/net10.0-android36.0/play-services-stats.aar!classes.jar!com/google/android/gms/stats/zzc.class", "size": 340, "type": "java_class", "depth": 3 }, { "id": 22, "sha": "6d4c6c9555d6c3767503406718fcaf4767c6c74c80ec82d17fe19fba0d8086f7", "path": "lib/net10.0-android36.0/play-services-stats.aar!classes.jar!!lib/net10.0-android36.0/play-services-stats.aar!classes.jar!com/google/android/gms/stats/zzd.class", "size": 158, "type": "java_class", "depth": 3 }, { "id": 23, "sha": "7a2dfdba34d086bf33d5ad0a6a6f7fc5563d8fd614f9a2a85937bf4370a6cbe4", "path": "lib/net10.0-android36.0/play-services-stats.aar!classes.jar!!lib/net10.0-android36.0/play-services-stats.aar!classes.jar!com/google/android/gms/stats/zze.class", "size": 158, "type": "java_class", "depth": 3 }, { "id": 24, "sha": "c8529ae3b11c3d7fa8aad6dee094ffb48463e67520b07c75701995f8942e7380", "path": "lib/net10.0-android36.0/play-services-stats.aar!!lib/net10.0-android36.0/play-services-stats.aar!third_party_licenses.json", "risk": 1, "size": 787, "type": "json", "depth": 2 }, { "id": 25, "sha": "80f044f8fb4473537b5b2d4e52b42b525622b17c6eea0975416df38b807e4eeb", "path": "lib/net10.0-android36.0/play-services-stats.aar!!lib/net10.0-android36.0/play-services-stats.aar!third_party_licenses.txt", "risk": 1, "size": 71668, "type": "text", "depth": 2 }, { "depth": 1, "facts": { "metrics": { "file": { "size": 14756.0, "entropy": 7.96, "size_bytes": 14756.0 }, "binary": { "overall_entropy": 7.96, "peak_region_bytes": 14336.0, "peak_region_entropy": 7.81 }, "archive": { "file_count": 5.0, "member_count": 5.0, "script_count": 0.0, "zip_bomb_ratio": 11.51, "directory_count": 0.0, "executable_count": 5.0, "extra_field_size": 0.0, "noise_file_count": 0.0, "total_compressed": 14186.0, "compression.ratio": 0.15, "hidden_file_count": 0.0, "total_uncompressed": 94026.0, "crc_collision_count": 0.0, "entry_comment_count": 0.0, "max_filename_length": 25.0, "rtlo_filename_count": 0.0, "format.regular_count": 5.0, "nested_archive_count": 1.0, "path_traversal_count": 0.0, "symlink_escape_count": 0.0, "security.setgid_count": 0.0, "security.setuid_count": 0.0, "security.sticky_count": 0.0, "double_extension_count": 0.0, "duplicate_member_count": 0.0, "security.symlink_count": 0.0, "unicode_filename_count": 0.0, "homoglyph_filename_count": 0.0, "security.encrypted_count": 0.0, "timing.mtime_unique_count": 1.0, "timing.mtime_unique_ratio": 0.2, "misplaced_executable_count": 0.0, "timing.mtime_dominant_count": 5.0, "timing.mtime_spread_seconds": 0.0, "timing.sentinel_mtime_count": 0.0, "security.world_writable_count": 0.0, "timing.mtime_dominant_fraction": 1.0, "compression.method_counts.deflate": 5.0 } } }, "id": 26, "path": "Xamarin.GooglePlayServices.Stats.117.1.0.10.nupkg!!lib/net9.0-android35.0/play-services-stats.aar", "risk": 1, "sha": "51b4db6c043ce5e3fcd97e727237a46be1a92c033aaa8eaaef6ae746f19b42ba", "size": 14756, "traits": [ { "id": "metadata/package/metrics::compact-jar-archive", "conf": 0.8999999761581421, "crit": 2, "desc": "Compact JAR archive size", "from": [ { "file": 6 } ] }, { "id": "micro-behaviors/os/env/access::jvm-system-class-ref", "conf": 0.8600000143051147, "crit": 2, "desc": "JVM System class reference" }, { "id": "metadata/binary/metrics/structural::many-imports", "conf": 0.800000011920929, "crit": 2, "desc": "High number of imported symbols (\u003e80)", "from": [ { "file": 18 } ] } ], "type": "zip" }, { "id": 27, "sha": "85ccdcc9532e8509925a28ef5ca3de418665ec2aa202e970f9c605de4e0e6bcb", "path": "lib/net9.0-android35.0/play-services-stats.aar!!lib/net9.0-android35.0/play-services-stats.aar!AndroidManifest.xml", "size": 226, "type": "xml", "depth": 2 }, { "id": 28, "sha": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "path": "lib/net9.0-android35.0/play-services-stats.aar!!lib/net9.0-android35.0/play-services-stats.aar!R.txt", "size": 0, "type": "text", "depth": 2 }, { "depth": 2, "facts": { "metrics": { "jar": { "class_count": 17.0, "entry_count": 19.0, "signature_count": 0.0, "embedded_jar_count": 0.0 }, "file": { "size": 21345.0, "entropy": 5.7, "size_bytes": 21345.0 }, "binary": { "overall_entropy": 5.7, "peak_region_bytes": 11264.0, "peak_region_entropy": 5.66 }, "archive": { "file_count": 19.0, "member_count": 19.0, "script_count": 0.0, "zip_bomb_ratio": 1.0, "directory_count": 0.0, "executable_count": 0.0, "extra_field_size": 0.0, "noise_file_count": 0.0, "total_compressed": 18247.0, "compression.ratio": 1.0, "hidden_file_count": 0.0, "total_uncompressed": 18247.0, "crc_collision_count": 0.0, "entry_comment_count": 0.0, "max_filename_length": 64.0, "rtlo_filename_count": 0.0, "format.regular_count": 19.0, "nested_archive_count": 0.0, "path_traversal_count": 0.0, "symlink_escape_count": 0.0, "security.setgid_count": 0.0, "security.setuid_count": 0.0, "security.sticky_count": 0.0, "double_extension_count": 0.0, "duplicate_member_count": 0.0, "security.symlink_count": 0.0, "unicode_filename_count": 0.0, "homoglyph_filename_count": 0.0, "security.encrypted_count": 0.0, "timing.mtime_unique_count": 1.0, "timing.mtime_unique_ratio": 0.05, "misplaced_executable_count": 0.0, "timing.mtime_dominant_count": 19.0, "timing.mtime_spread_seconds": 0.0, "timing.sentinel_mtime_count": 0.0, "security.world_writable_count": 0.0, "timing.mtime_dominant_fraction": 1.0, "compression.method_counts.stored": 19.0 } } }, "id": 29, "ident": { "trust": "unsigned", "producer": { "value": "singlejar", "source": "jar.manifest.created_by", "verified": false } }, "path": "lib/net9.0-android35.0/play-services-stats.aar!!lib/net9.0-android35.0/play-services-stats.aar!classes.jar", "risk": 1, "sha": "0dc51d1b3d0c189af05d113b08a2070c8ed7d1b811de3e599b01b7797abdb61d", "size": 21345, "traits": [ { "id": "metadata/binary/metrics/structural::many-imports", "conf": 0.800000011920929, "crit": 2, "desc": "High number of imported symbols (\u003e80)", "from": [ { "file": 41 } ] }, { "id": "micro-behaviors/os/env/access::jvm-system-class-ref", "conf": 0.8600000143051147, "crit": 2, "desc": "JVM System class reference" }, { "id": "metadata/package/metrics::compact-jar-archive", "conf": 0.8999999761581421, "crit": 2, "desc": "Compact JAR archive size", "spans": [ [ 0, 26 ] ] } ], "type": "jar" }, { "id": 30, "sha": "b7b09fd69b0c8d7d011f0893f5fb6776c2d25c0e7636dd11a5be996928b8e730", "path": "lib/net9.0-android35.0/play-services-stats.aar!classes.jar!!lib/net9.0-android35.0/play-services-stats.aar!classes.jar!com/google/android/gms/internal/stats/zza.class", "size": 279, "type": "java_class", "depth": 3 }, { "id": 31, "sha": "03f9a7b3f29c6bfc033383647ddd0d26410cd8a738d0bb71aa7e842034788ed2", "path": "lib/net9.0-android35.0/play-services-stats.aar!classes.jar!!lib/net9.0-android35.0/play-services-stats.aar!classes.jar!com/google/android/gms/internal/stats/zzb.class", "size": 696, "type": "java_class", "depth": 3 }, { "id": 32, "sha": "391769a9b4e63bd68b095ce088b2132a12193f8be9de1fccb1fdb9896184426e", "path": "lib/net9.0-android35.0/play-services-stats.aar!classes.jar!!lib/net9.0-android35.0/play-services-stats.aar!classes.jar!com/google/android/gms/internal/stats/zzc.class", "size": 167, "type": "java_class", "depth": 3 }, { "id": 33, "sha": "447f05ba32e1c57d085ac8bc52547797095da39d853a943639e69edd71a5ddff", "path": "lib/net9.0-android35.0/play-services-stats.aar!classes.jar!!lib/net9.0-android35.0/play-services-stats.aar!classes.jar!com/google/android/gms/internal/stats/zzd.class", "size": 279, "type": "java_class", "depth": 3 }, { "id": 34, "sha": "0fc8c2a4be4624071104dec08cf1cf2f7c7f0e721192ea8008d600bffd1f0b30", "path": "lib/net9.0-android35.0/play-services-stats.aar!classes.jar!!lib/net9.0-android35.0/play-services-stats.aar!classes.jar!com/google/android/gms/internal/stats/zze.class", "size": 167, "type": "java_class", "depth": 3 }, { "id": 35, "sha": "69b0c60bb7361459d2771bc654497d27ed1d99e1d966ebb0120dfea4e1b6727d", "path": "lib/net9.0-android35.0/play-services-stats.aar!classes.jar!!lib/net9.0-android35.0/play-services-stats.aar!classes.jar!com/google/android/gms/internal/stats/zzf.class", "size": 167, "type": "java_class", "depth": 3 }, { "id": 36, "sha": "c9458ac66b56d0b83b0ad132c898436f296ada4e4eedfacb3e25c336e1337cd2", "path": "lib/net9.0-android35.0/play-services-stats.aar!classes.jar!!lib/net9.0-android35.0/play-services-stats.aar!classes.jar!com/google/android/gms/internal/stats/zzg.class", "size": 389, "type": "java_class", "depth": 3 }, { "id": 37, "sha": "f21777de9d8857fba432b8cc3097c7714ea2e4c30df51d673c7de24f23f76fd4", "path": "lib/net9.0-android35.0/play-services-stats.aar!classes.jar!!lib/net9.0-android35.0/play-services-stats.aar!classes.jar!com/google/android/gms/internal/stats/zzh.class", "size": 524, "type": "java_class", "depth": 3 }, { "id": 38, "sha": "3c0baa2e186238de9385803366e9f6875c8ba08ee1fa6664b84d1ef24714e905", "path": "lib/net9.0-android35.0/play-services-stats.aar!classes.jar!!lib/net9.0-android35.0/play-services-stats.aar!classes.jar!com/google/android/gms/internal/stats/zzi.class", "size": 432, "type": "java_class", "depth": 3 }, { "id": 39, "sha": "52990e40c6a1251802323e24eed088daf5f96e4623fca256fac58d95c862beb1", "path": "lib/net9.0-android35.0/play-services-stats.aar!classes.jar!!lib/net9.0-android35.0/play-services-stats.aar!classes.jar!com/google/android/gms/stats/CodePackage.class", "size": 1024, "type": "java_class", "depth": 3 }, { "id": 40, "sha": "da8530b03863109bbb7f809f77c495206eb83c420294fd749a731e35e66b78b4", "path": "lib/net9.0-android35.0/play-services-stats.aar!classes.jar!!lib/net9.0-android35.0/play-services-stats.aar!classes.jar!com/google/android/gms/stats/GCoreWakefulBroadcastReceiver.class", "size": 910, "type": "java_class", "depth": 3 }, { "id": 41, "sha": "7df909d8a27e7a7b2507c40aa1434df2030f8cb253fe19e9486c9465d59e1904", "path": "lib/net9.0-android35.0/play-services-stats.aar!classes.jar!!lib/net9.0-android35.0/play-services-stats.aar!classes.jar!com/google/android/gms/stats/WakeLock.class", "risk": 1, "size": 11716, "type": "java_class", "depth": 3 }, { "id": 42, "sha": "6947562da5d18d005a509b7e9cfbf9c6bf2a37254029cf208374cee27f5adad2", "path": "lib/net9.0-android35.0/play-services-stats.aar!classes.jar!!lib/net9.0-android35.0/play-services-stats.aar!classes.jar!com/google/android/gms/stats/zza.class", "size": 456, "type": "java_class", "depth": 3 }, { "id": 43, "sha": "813e2aee8142a72ce3156665ced490f986e0e4d3c36c9e00446cb2b9d0fd81da", "path": "lib/net9.0-android35.0/play-services-stats.aar!classes.jar!!lib/net9.0-android35.0/play-services-stats.aar!classes.jar!com/google/android/gms/stats/zzb.class", "size": 261, "type": "java_class", "depth": 3 }, { "id": 44, "sha": "1aef10c2435bae255ba4d34236cad856efcba8f42a437fd7077063ff49da242c", "path": "lib/net9.0-android35.0/play-services-stats.aar!classes.jar!!lib/net9.0-android35.0/play-services-stats.aar!classes.jar!com/google/android/gms/stats/zzc.class", "size": 340, "type": "java_class", "depth": 3 }, { "id": 45, "sha": "6d4c6c9555d6c3767503406718fcaf4767c6c74c80ec82d17fe19fba0d8086f7", "path": "lib/net9.0-android35.0/play-services-stats.aar!classes.jar!!lib/net9.0-android35.0/play-services-stats.aar!classes.jar!com/google/android/gms/stats/zzd.class", "size": 158, "type": "java_class", "depth": 3 }, { "id": 46, "sha": "7a2dfdba34d086bf33d5ad0a6a6f7fc5563d8fd614f9a2a85937bf4370a6cbe4", "path": "lib/net9.0-android35.0/play-services-stats.aar!classes.jar!!lib/net9.0-android35.0/play-services-stats.aar!classes.jar!com/google/android/gms/stats/zze.class", "size": 158, "type": "java_class", "depth": 3 }, { "id": 47, "sha": "c8529ae3b11c3d7fa8aad6dee094ffb48463e67520b07c75701995f8942e7380", "path": "lib/net9.0-android35.0/play-services-stats.aar!!lib/net9.0-android35.0/play-services-stats.aar!third_party_licenses.json", "risk": 1, "size": 787, "type": "json", "depth": 2 }, { "id": 48, "sha": "80f044f8fb4473537b5b2d4e52b42b525622b17c6eea0975416df38b807e4eeb", "path": "lib/net9.0-android35.0/play-services-stats.aar!!lib/net9.0-android35.0/play-services-stats.aar!third_party_licenses.txt", "risk": 1, "size": 71668, "type": "text", "depth": 2 }, { "id": 49, "sha": "8fcf6f6cd575c0f8c643691765a7db2a4b3b104bfbff34646555f5ccffdb2895", "path": "Xamarin.GooglePlayServices.Stats.117.1.0.10.nupkg!!icon.png", "size": 2140, "type": "png", "depth": 1 }, { "id": 50, "sha": "f0482595937e7a95f5473a6c08a2319eae9c58892e4780960abd182790c69084", "path": "Xamarin.GooglePlayServices.Stats.117.1.0.10.nupkg!!THIRD-PARTY-NOTICES.txt", "risk": 1, "size": 18129, "type": "text", "depth": 1 }, { "id": 51, "sha": "6e67b724f3423dca37c1292c0c1b502fdf6cfa23198a828adfc5b33d23f74601", "path": "Xamarin.GooglePlayServices.Stats.117.1.0.10.nupkg!!build/net10.0-android36.0/Xamarin.GooglePlayServices.Stats.targets", "size": 1515, "type": "xml", "depth": 1 }, { "id": 52, "sha": "6e67b724f3423dca37c1292c0c1b502fdf6cfa23198a828adfc5b33d23f74601", "path": "Xamarin.GooglePlayServices.Stats.117.1.0.10.nupkg!!buildTransitive/net10.0-android36.0/Xamarin.GooglePlayServices.Stats.targets", "size": 1515, "type": "xml", "depth": 1 }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J\u0026m(", "n": [ { "c": 3, "d": "Signed by Microsoft Corporation", "i": "metadata/signed/leaf::microsoft-corporation", "o": 0, "z": 1, "cf": 1.0 } ], "ln": 0 }, { "b": "00000000000000000000Ol#r%00000nb@R\u00260SSx7p+8IC@4!rM0rr91000000000000", "n": [ { "c": 1, "d": "PE standard code/data section", "i": "metadata/binary/section/names::pe-code-data-standard-section", "o": 512, "z": 5, "cf": 0.8999999761581421 } ], "ln": 496 }, { "b": "000vEi@/l/Feng=1s:xKlq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn", "n": [ { "c": 3, "d": "Recognized PE anti-analysis marker", "i": "objectives/anti-analysis/debugger-detect/combined-checks::evasion-aware-recognized-pe-marker", "o": 3408, "z": 4, "cf": 1.0 } ], "ln": 3392 }, { "b": "vr\u003e^.A=#ebwPGF5Byxoje[w^m07QKo08[e:By/p?oMaAHBzkVh07{Wyvj\u003ekZzF7N/", "n": [ { "c": 3, "d": "References Windows executable or script", "i": "objectives/execution/interpreter/script/shell::windows-executable-ref", "o": 10751, "z": 4, "cf": 0.6000000238418579 } ], "ln": 10735 }, { "b": "08)DsB-IhrC%L}Zx(v\u003e?q*ACawO\u003c4$wOb:\u0026v@#B6zu9pDx\u0026GaYzGxJlx(v\u003e?lT:!Ex(mMJz/f-fzGGPhzu", "n": [ { "c": 2, "d": "Benign high-entropy PE context", "i": "metadata/package/quality/false-positives::benign-high-entropy-pe-context", "o": 10865, "z": 17, "cf": 0.949999988079071 } ], "ln": 10849 }, { "b": "nP5P\u003evqYN^o\u003ewAWz!9[?q*ACawO\u003c4$B-8qnzdLs\u003ezGGDgz/wS^A=#ebwPE\u0026ID2[7sz7X.ezGGPfwIct*ze:i9wPyZXA=#ebwPE", "n": [ { "c": 3, "d": "Packed binary marker", "i": "objectives/anti-static/obfuscation/eval/loader::packed-binary-marker", "o": 11401, "z": 30, "cf": 0.8500000238418579 } ], "ln": 11385 }, { "b": "AbP=se\u003c\u003cL$wIc#8x(4?\u003cq*ACawO\u003c4#wN/\u003e6x([RMp?sV:x(!ufz/fQ@uTD=TAaI{Uxk8BeA::67z/fQ", "n": [ { "c": 2, "d": "System namespace reference", "i": "metadata/lang/compiler/managed::system-namespace", "o": 11651, "z": 15, "cf": 0.800000011920929 } ], "ln": 11635 }, { "b": "q*ACawO\u003c4$B-8qnzdLmvr+lq)x(v(Lf!+jle?![iefEr5y\u0026\u003c/uwJ:{xB-.Ujy+cY9BZ/f3v[QxUrbVL-", "n": [ { "c": 2, "d": "IPv4-like .NET assembly version", "i": "metadata/lang/compiler/managed::dotnet-ipv4-like-version", "o": 14451, "z": 16, "cf": 0.8500000238418579 } ], "ln": 14435 }, { "b": "qE%VQvrk#W05BSQf2BOgo\u003e!9Tz/Y\u0026eBrA}?A=t@qvruj4zz04$y?$kmx\u003eIa3B0bHmB7GxnwN)y[0dY.60dLB+ao", "n": [ { "c": 3, "d": "Recognized service tool vendor markers", "i": "well-known/malware/trojan/elex::service-reconfig-recognized-vendor-marker", "o": 15144, "z": 21, "cf": 0.949999988079071 } ], "ln": 15128 }, { "b": "xk.Z3y?kkczE^^ax\u003ee\u0026ezf4:Sy*?PvB7Gxnx\u003e7Z}ePV2xBAn/Z4giKK4gjj2arQT:3\u0026{tk", "n": [ { "c": 1, "d": "rust binary fs module vocabulary", "i": "objectives/impact/crypto-manipulation/keywords::rust-bin-fs-vocab", "o": 15287, "z": 8, "cf": 0.20000000298023224 } ], "ln": 15271 }, { "b": "mPpB6IUyh#(]U@}0rr91lPOEXtWIX[A+!]mtYTd.wO#71vru6\u003etW}X?e[Y9vxkzcivqYQ@z!S-mxkIYxAbn%dePUGzC4\u003eC$B1IDPvruM}z^)D^qE%VQvrl0+zE)]AfFk4hvqYQ@z!S-rhzcW*syD5PA+Pzzm@JrUy?lBVvr\u003e^.A=#ebwPGF5Byxoje]Uug08(AOgbQ@\u0026H1Yu}mPpDc3INSF(]U@}9WmA]{YJ.b", "n": [ { "c": 3, "d": "Visual Studio build path", "i": "metadata/binary/debug::pdb-visual-studio", "o": 16824, "z": 136, "cf": 0.5 } ], "ln": 16808 }, { "b": "00000000000000000000000000000000000000315c8Xg7YTL^00000000000000000", "n": [ { "c": 1, "d": "PE resource section", "i": "metadata/binary/section/names::pe-resource-section", "o": 17408, "z": 5, "cf": 0.8999999761581421 } ], "ln": 17392 }, { "b": "0000000000002y\u003cgYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006Xn[brp!0rr910rr9", "n": [ { "c": 3, "d": "Recognized marker for timing checks", "i": "objectives/anti-analysis/timing/evasion::timing-anti-debug-recognized-marker", "o": 17502, "z": 15, "cf": 0.949999988079071 } ], "ln": 17486 }, { "b": "aoiI:aoiI:001?Q3ig8blJz38z2!IPve$fBC(QOtve$cAwDhYg002Z[x-ISyASy1TA@ZaUw=M]M003:laPIJymGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up003a3ve$cAve$rFx-J2", "n": [ { "c": 2, "d": "PE CompanyName metadata field", "i": "metadata/package/versioning::pe-companyname-field", "o": 18002, "z": 11, "cf": 0.699999988079071 }, { "c": 2, "d": "PE FileDescription metadata field", "i": "metadata/package/versioning::pe-filedescription-field", "o": 18054, "z": 15, "cf": 0.699999988079071 } ], "ln": 17986 }, { "b": "ve$xHA@Vgu001XM2MK(9mGvc5yYF2DrSDXhASydXx-J5Kzu6Up001.Ne=WN9e=WN9e=WN9003:lb(^@CnDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE003a3ve$cAve$rFx-J2Je=Xxw", "n": [ { "c": 3, "d": "Dotted-quad PE version metadata marker", "i": "objectives/command-and-control/infrastructure/ip::ipv4-version-metadata-marker", "o": 18162, "z": 11, "cf": 0.9399999976158142 }, { "c": 2, "d": "PE InternalName metadata field", "i": "metadata/package/versioning::pe-internalname-field", "o": 18210, "z": 12, "cf": 0.699999988079071 } ], "ln": 18146 }, { "b": "0ce6N0a#pB0cwhv0i2@v08iDc0aM1H0b?\u003cU0b?\u003cH0cwh-07c:80ce6U0b?\u003cT0at\u003eH0bhBK0b.=?03znc0bITK03z", "n": [ { "c": 3, "d": "Recognized resource API loader marker", "i": "objectives/command-and-control/dropper/execution/resource::pe-resource-api-loader-recognized-marker", "o": 18351, "z": 21, "cf": 0.9200000166893005 } ], "ln": 18335 }, { "b": "B]V7Nwb[jZ0043tb(^@Cpxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE003a3ve$cAve$rFx-J2J", "n": [ { "c": 2, "d": "PE OriginalFilename metadata field", "i": "metadata/package/versioning::pe-originalfilename-field", "o": 18446, "z": 16, "cf": 0.699999988079071 } ], "ln": 18430 }, { "b": "wb{ACyYBCn003EdaPIJypYLIozVBqFBPt[KBo25ove$cAwDhYg003a3ve$cAve$rFx-J2Je=Xx", "n": [ { "c": 2, "d": "PE ProductName metadata field", "i": "metadata/package/versioning::pe-productname-field", "o": 18562, "z": 11, "cf": 0.699999988079071 } ], "ln": 18546 }, { "b": "ve$xHA@Vgu004PJf8#1MpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001.Ne=WN9e=WN9d/.Hdve{", "n": [ { "c": 2, "d": "PE version resource metadata", "i": "metadata/package/versioning::version-resource-metadata", "o": 18662, "z": 14, "cf": 0.8999999761581421 } ], "ln": 18646 }, { "b": "000000000000000000000ak^b3\u0026*ncYF6r=000000000000000000000000000000000", "n": [ { "c": 2, "d": "PE .reloc section presence", "i": "metadata/binary/section/names::reloc-section-presence", "o": 18944, "z": 6, "cf": 0.8999999761581421 } ], "ln": 18928 }, { "b": "dnsI^A=l2qw]]d[z/o.ulUgpWx\u003ez6?vru66l3mo.z/PMlC{1\u003c@f!\u003ev67y-bRfGp:Cgb7Nxf/St", "n": [ { "c": 2, "d": "certificate string reference", "i": "micro-behaviors/crypto/certificate/usage::certificate-ref", "o": 21296, "z": 11, "cf": 0.5 } ], "ln": 21280 }, { "b": "eKRPQh.=Qjbl!lI1oPqSo\u003e!9Tz/Y\u0026eBrBK%zdLp$Byx39ax8\u0026(C4\u003eC$PN)^yfOfJLfOfDlPAtk@0S\u003c2\u003e0006wQPyneiD6pp", "n": [ { "c": 2, "d": "Microsoft timestamp certificate chain", "i": "micro-behaviors/data/embedded/certificate::microsoft-timestamp-chain", "o": 23834, "z": 28, "cf": 0.949999988079071 } ], "ln": 23818 }, { "b": "vruj4zzrE(bNauJ1oPqTo\u003e!9Tz/Y\u0026eBrBK%zdLp$Byx39aw+A\u003eatLS9fFBK:4kG*}gbg^ziwSVLiA^jdgb*)Af/H*EgDvoLs]", "n": [ { "c": 2, "d": "Microsoft timestamp certificate chain", "i": "micro-behaviors/data/embedded/certificate::microsoft-timestamp-chain", "o": 24012, "z": 29, "cf": 0.949999988079071 } ], "ln": 23996 } ], "depth": 1, "facts": { "imp": [ [ "mscoree", "CorDllMain" ] ], "sec": [ [ ".text", 512, 16896, 5.61, "r-x" ], [ ".rsrc", 17408, 1536, 3.2, "r--" ], [ ".reloc", 18944, 512, 0.08, "r--" ] ], "metrics": { "pe": { "checksum": 71165.0, "checksum_valid": 1.0, "resource_count": 1.0, "cert_table_size": 10040.0, "has_version_info": 1.0, "computed_checksum": 71165.0, "reloc_overhang_bytes": 500.0, "reloc_overhang_ratio": 0.98, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "version.identity_entropy": 4.19, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0, "version.identity_symbol_ratio": 0.05 }, "file": { "size": 29496.0, "entropy": 6.33, "size_bytes": 29496.0 }, "binary": { "is_pie": 1.0, "has_overlay": 1.0, "code_entropy": 5.61, "overlay_size": 10040.0, "string_count": 343.0, "overlay_ratio": 0.34, "overall_entropy": 6.33, "overlay_entropy": 7.52, "entropy_variance": 5.13, "avg_string_length": 23.16, "max_string_length": 139.0, "peak_region_bytes": 6968.0, "code_to_data_ratio": 1.0, "peak_region_entropy": 7.6, "string_length_stddev": 20.64, "largest_section_ratio": 0.57, "sentence_string_count": 17.0, "sentence_string_ratio": 0.05, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 16896.0, "entropy_max": 5.61, "entropy_mean": 2.97, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } } }, "id": 53, "mol": "Md₂(BiSi₂)", "path": "Xamarin.GooglePlayServices.Stats.117.1.0.10.nupkg!!lib/net10.0-android36.0/Xamarin.GooglePlayServices.Stats.dll", "risk": 5, "sha": "eb053d3d5b627ac2a30b9164f96eecc58541a62739076b9a341233f02c044e60", "size": 29496, "traits": [ { "id": "metadata/signed/unknown::microsoft-corporation", "conf": 1.0, "crit": 3, "desc": "Authenticode chain CN: Microsoft Corporation" }, { "id": "metadata/signed/leaf::microsoft-corporation", "conf": 1.0, "crit": 3, "desc": "Signed by Microsoft Corporation" }, { "id": "metadata/binary/debug::pdb-visual-studio", "crit": 3, "desc": "Visual Studio build path", "spans": [ [ 16824, 136 ] ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "spans": [ [ 10751, 4 ] ] }, { "id": "metadata/signed/certificate/identity::pe-cert-issuer-microsoft-pca", "conf": 1.0, "crit": 2, "desc": "Issued by a Microsoft Code Signing PCA" }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "spans": [ [ 0, 26 ] ] }, { "id": "metadata/binary/vendor::microsoft-corp-marker-rsrc", "conf": 0.8999999761581421, "crit": 1, "desc": "Microsoft vendor marker in resource section", "spans": [ [ 18351, 21 ] ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "spans": [ [ 18162, 11 ] ] }, { "id": "metadata/binary/vendor::microsoft-corp-marker-cert", "conf": 0.8999999761581421, "crit": 1, "desc": "Microsoft vendor marker in certificate data", "spans": [ [ 15144, 21 ] ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "spans": [ [ 3408, 4 ] ] }, { "id": "metadata/signed/certificate/identity::pe-signature-verified-kv", "conf": 1.0, "crit": 2, "desc": "PE Authenticode signature verified metadata" }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 17502, 15 ] ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "spans": [ [ 18662, 14 ] ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "metadata/binary/layout::overlay-dominates-third", "conf": 0.9200000166893005, "crit": 3, "desc": "Overlay exceeds one-third", "spans": [ [ 0, 27 ] ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "spans": [ [ 3408, 4 ] ] }, { "id": "metadata/signed/platform::microsoft", "conf": 0.9800000190734863, "crit": 2, "desc": "Microsoft-signed Windows binary" }, { "id": "metadata/package/quality/false-positives::common-fp-context", "conf": 0.8999999761581421, "crit": 2, "desc": "Common false positive indicators (Delphi, ApiSet, etc.)" } ], "type": "pe" }, { "id": 54, "sha": "54c7ef584e90521b3ef595e6b2d86b534cea070af397d02e19186e5a56fc2b72", "path": "Xamarin.GooglePlayServices.Stats.117.1.0.10.nupkg!!lib/net10.0-android36.0/Xamarin.GooglePlayServices.Stats.xml", "size": 157, "type": "xml", "depth": 1 }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J\u0026m(", "n": [ { "c": 3, "d": "Signed by Microsoft Corporation", "i": "metadata/signed/leaf::microsoft-corporation", "o": 0, "z": 1, "cf": 1.0 } ], "ln": 0 }, { "b": "00000000000000000000pG)/000000nb@R\u00260SSx7\u00263XN9atA\u0026@0rr91000000000000", "n": [ { "c": 1, "d": "PE standard code/data section", "i": "metadata/binary/section/names::pe-code-data-standard-section", "o": 512, "z": 5, "cf": 0.8999999761581421 } ], "ln": 496 }, { "b": "000vEhuiZ:Feng=1s:xKlq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn", "n": [ { "c": 3, "d": "Recognized PE anti-analysis marker", "i": "objectives/anti-analysis/debugger-detect/combined-checks::evasion-aware-recognized-pe-marker", "o": 2784, "z": 4, "cf": 1.0 } ], "ln": 2768 }, { "b": "vr\u003e^.A=#ebwPGF5Byxoje[w^m07QKo08[e:By/p?oMaAHBzkVh07{Wyvj\u003ekZzF7N/", "n": [ { "c": 3, "d": "References Windows executable or script", "i": "objectives/execution/interpreter/script/shell::windows-executable-ref", "o": 9599, "z": 4, "cf": 0.6000000238418579 } ], "ln": 9583 }, { "b": "08)DsB-IhrC%L}Zx(v\u003e?q*ACawO\u003c4$wOb:\u0026v@#B6zu94xzeBie09S@OzVAyEx?hVIwnC*MCwZ#jB7/ob00", "n": [ { "c": 2, "d": "Benign high-entropy PE context", "i": "metadata/package/quality/false-positives::benign-high-entropy-pe-context", "o": 9713, "z": 17, "cf": 0.949999988079071 } ], "ln": 9697 }, { "b": "AbP=se\u003c\u003cL$wIc#8x(4?\u003cq*ACawO\u003c4#wN/\u003e6x([RMp?sV:x(!ufz/fQ@uTD=TAaI{Uxk8BeA::67z/fQ", "n": [ { "c": 2, "d": "System namespace reference", "i": "metadata/lang/compiler/managed::system-namespace", "o": 10428, "z": 15, "cf": 0.800000011920929 } ], "ln": 10412 }, { "b": "q*ACawO\u003c4$B-8qnzdLmvr+lq)x(v(Liw90rfFk4gavyo/BAIRnj-j?NBAg/aefE=ivR/:*oj-xFz!\u0026[", "n": [ { "c": 2, "d": "IPv4-like .NET assembly version", "i": "metadata/lang/compiler/managed::dotnet-ipv4-like-version", "o": 13106, "z": 15, "cf": 0.8500000238418579 } ], "ln": 13090 }, { "b": "qE%VQvrk#W05BSQf2BOgo\u003e!9Tz/Y\u0026eBrA}?A=t@qvruj4zz04$y?$kmx\u003eIa3B0bHmB7GxnwN)y[0dY.60dLB+ao", "n": [ { "c": 3, "d": "Recognized service tool vendor markers", "i": "well-known/malware/trojan/elex::service-reconfig-recognized-vendor-marker", "o": 13790, "z": 21, "cf": 0.949999988079071 } ], "ln": 13774 }, { "b": "xk.Z3y?kkczE^^ax\u003ee\u0026ezf4:Sy*?PvB7Gxnx\u003e7Z}ePV2xBAn/Z4giKK4gjj2arQT:3\u0026{tk", "n": [ { "c": 1, "d": "rust binary fs module vocabulary", "i": "objectives/impact/crypto-manipulation/keywords::rust-bin-fs-vocab", "o": 13933, "z": 8, "cf": 0.20000000298023224 } ], "ln": 13917 }, { "b": "V%j5dK]Ls[VEy(/0rr91lPOEXtWIX[A+!]mtYTd.wO#71vru6\u003etW}X?e[Y9vxkzcivqYQ@z!S-mxkIYxAbn%dePUGzC4\u003eC$B1IDPvruM}z^)D^qE%VQvrl0+zE)]Ie?!\u003e=zE^^ax\u003ef1Se?*KjvqPB[x(kK[z/oo8wL^hKC#Fo{C4\u003eC$B1QykvruMyAaAzTq+fhfh8UBJ%2\u003eXntN!T0%niOp!hYhlR?3JZ-pZU", "n": [ { "c": 3, "d": "Visual Studio build path", "i": "metadata/binary/debug::pdb-visual-studio", "o": 15468, "z": 135, "cf": 0.5 } ], "ln": 15452 }, { "b": "00000000000000000000000000000000000000315c8Xg7YTL^00000000000000000", "n": [ { "c": 1, "d": "PE resource section", "i": "metadata/binary/section/names::pe-resource-section", "o": 15872, "z": 5, "cf": 0.8999999761581421 } ], "ln": 15856 }, { "b": "0000000000002y\u003cgYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006Xn[brp!0rr910rr9", "n": [ { "c": 3, "d": "Recognized marker for timing checks", "i": "objectives/anti-analysis/timing/evasion::timing-anti-debug-recognized-marker", "o": 15966, "z": 15, "cf": 0.949999988079071 } ], "ln": 15950 }, { "b": "aoiI:aoiI:001?Q3ig8blJz38z2!IPve$fBC(QOtve$cAwDhYg002Z[x-ISyASy1TA@ZaUw=M]M003:laPIJymGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up003a3ve$cAve$rFx-J2", "n": [ { "c": 2, "d": "PE CompanyName metadata field", "i": "metadata/package/versioning::pe-companyname-field", "o": 16466, "z": 11, "cf": 0.699999988079071 }, { "c": 2, "d": "PE FileDescription metadata field", "i": "metadata/package/versioning::pe-filedescription-field", "o": 16518, "z": 15, "cf": 0.699999988079071 } ], "ln": 16450 }, { "b": "ve$xHA@Vgu001XM2MK(9mGvc5yYF2DrSDXhASydXx-J5Kzu6Up001.Ne=WN9e=WN9e=WN9003:lb(^@CnDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE003a3ve$cAve$rFx-J2Je=Xxw", "n": [ { "c": 3, "d": "Dotted-quad PE version metadata marker", "i": "objectives/command-and-control/infrastructure/ip::ipv4-version-metadata-marker", "o": 16626, "z": 11, "cf": 0.9399999976158142 }, { "c": 2, "d": "PE InternalName metadata field", "i": "metadata/package/versioning::pe-internalname-field", "o": 16674, "z": 12, "cf": 0.699999988079071 } ], "ln": 16610 }, { "b": "0ce6N0a#pB0cwhv0i2@v08iDc0aM1H0b?\u003cU0b?\u003cH0cwh-07c:80ce6U0b?\u003cT0at\u003eH0bhBK0b.=?03znc0bITK03z", "n": [ { "c": 3, "d": "Recognized resource API loader marker", "i": "objectives/command-and-control/dropper/execution/resource::pe-resource-api-loader-recognized-marker", "o": 16815, "z": 21, "cf": 0.9200000166893005 } ], "ln": 16799 }, { "b": "B]V7Nwb[jZ0043tb(^@Cpxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE003a3ve$cAve$rFx-J2J", "n": [ { "c": 2, "d": "PE OriginalFilename metadata field", "i": "metadata/package/versioning::pe-originalfilename-field", "o": 16910, "z": 16, "cf": 0.699999988079071 } ], "ln": 16894 }, { "b": "wb{ACyYBCn003EdaPIJypYLIozVBqFBPt[KBo25ove$cAwDhYg003a3ve$cAve$rFx-J2Je=Xx", "n": [ { "c": 2, "d": "PE ProductName metadata field", "i": "metadata/package/versioning::pe-productname-field", "o": 17026, "z": 11, "cf": 0.699999988079071 } ], "ln": 17010 }, { "b": "ve$xHA@Vgu004PJf8#1MpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001.Ne=WN9e=WN9d/.Hdve{", "n": [ { "c": 2, "d": "PE version resource metadata", "i": "metadata/package/versioning::version-resource-metadata", "o": 17126, "z": 14, "cf": 0.8999999761581421 } ], "ln": 17110 }, { "b": "0000000000000000000008JT}3\u0026*ncA6141000000000000000000000000000000000", "n": [ { "c": 2, "d": "PE .reloc section presence", "i": "metadata/binary/section/names::reloc-section-presence", "o": 17408, "z": 6, "cf": 0.8999999761581421 } ], "ln": 17392 }, { "b": "dnsI^A=l2qw]]d[z/o.ulUgpWx\u003ez6?vru66l3mo.z/PMlC{1\u003c@f!\u003ev67y-bRfGp:Cgb7Nxf/St", "n": [ { "c": 2, "d": "certificate string reference", "i": "micro-behaviors/crypto/certificate/usage::certificate-ref", "o": 19760, "z": 11, "cf": 0.5 } ], "ln": 19744 }, { "b": "eKRPQh.=Qjbl!lI1oPqSo\u003e!9Tz/Y\u0026eBrBK%zdLp$Byx39ax8\u0026(C4\u003eC$PN)^vfOfJLfOfDlPAtk@0S\u003c2\u003e0006EhmbLWlZdi=", "n": [ { "c": 2, "d": "Microsoft timestamp certificate chain", "i": "micro-behaviors/data/embedded/certificate::microsoft-timestamp-chain", "o": 22298, "z": 28, "cf": 0.949999988079071 } ], "ln": 22282 }, { "b": "vruj4zzrE(bNauJ1oPqTo\u003e!9Tz/Y\u0026eBrBK%zdLp$Byx39aw+A\u003eatLS9fFBK:4kG*}gbg^ziw-AzgfLF6gb*)Af/H*Eg+ZQss]", "n": [ { "c": 2, "d": "Microsoft timestamp certificate chain", "i": "micro-behaviors/data/embedded/certificate::microsoft-timestamp-chain", "o": 22476, "z": 29, "cf": 0.949999988079071 } ], "ln": 22460 } ], "depth": 1, "facts": { "imp": [ [ "mscoree", "CorDllMain" ] ], "sec": [ [ ".text", 512, 15360, 5.63, "r-x" ], [ ".rsrc", 15872, 1536, 3.21, "r--" ], [ ".reloc", 17408, 512, 0.08, "r--" ] ], "metrics": { "pe": { "checksum": 38752.0, "checksum_valid": 1.0, "resource_count": 1.0, "cert_table_size": 10040.0, "has_version_info": 1.0, "computed_checksum": 38752.0, "reloc_overhang_bytes": 500.0, "reloc_overhang_ratio": 0.98, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "version.identity_entropy": 4.19, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0, "version.identity_symbol_ratio": 0.05 }, "file": { "size": 27960.0, "entropy": 6.37, "size_bytes": 27960.0 }, "binary": { "is_pie": 1.0, "has_overlay": 1.0, "code_entropy": 5.63, "overlay_size": 10040.0, "string_count": 335.0, "overlay_ratio": 0.36, "overall_entropy": 6.37, "overlay_entropy": 7.52, "entropy_variance": 5.16, "avg_string_length": 22.75, "max_string_length": 138.0, "peak_region_bytes": 8504.0, "code_to_data_ratio": 1.0, "peak_region_entropy": 7.51, "string_length_stddev": 20.7, "largest_section_ratio": 0.55, "sentence_string_count": 17.0, "sentence_string_ratio": 0.05, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 15360.0, "entropy_max": 5.63, "entropy_mean": 2.97, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } } }, "id": 55, "mol": "Md₂(BiSi₂)", "path": "Xamarin.GooglePlayServices.Stats.117.1.0.10.nupkg!!lib/net9.0-android35.0/Xamarin.GooglePlayServices.Stats.dll", "risk": 5, "sha": "5edea8084c318e71e25cbf674e5bf387e6b916ce0d306cc81c3b879b7bd2ea90", "size": 27960, "traits": [ { "id": "metadata/signed/unknown::microsoft-corporation", "conf": 1.0, "crit": 3, "desc": "Authenticode chain CN: Microsoft Corporation" }, { "id": "metadata/signed/leaf::microsoft-corporation", "conf": 1.0, "crit": 3, "desc": "Signed by Microsoft Corporation" }, { "id": "metadata/binary/debug::pdb-visual-studio", "crit": 3, "desc": "Visual Studio build path", "spans": [ [ 15468, 135 ] ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "spans": [ [ 9599, 4 ] ] }, { "id": "metadata/signed/certificate/identity::pe-cert-issuer-microsoft-pca", "conf": 1.0, "crit": 2, "desc": "Issued by a Microsoft Code Signing PCA" }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "spans": [ [ 0, 26 ] ] }, { "id": "metadata/binary/vendor::microsoft-corp-marker-rsrc", "conf": 0.8999999761581421, "crit": 1, "desc": "Microsoft vendor marker in resource section", "spans": [ [ 16815, 21 ] ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "spans": [ [ 16626, 11 ] ] }, { "id": "metadata/binary/vendor::microsoft-corp-marker-cert", "conf": 0.8999999761581421, "crit": 1, "desc": "Microsoft vendor marker in certificate data", "spans": [ [ 13790, 21 ] ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "spans": [ [ 2784, 4 ] ] }, { "id": "metadata/signed/certificate/identity::pe-signature-verified-kv", "conf": 1.0, "crit": 2, "desc": "PE Authenticode signature verified metadata" }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 15966, 15 ] ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "spans": [ [ 17126, 14 ] ] }, { "id": "metadata/binary/layout::overlay-over-35pct", "conf": 0.9399999976158142, "crit": 3, "desc": "PE overlay exceeds thirty-five percent", "spans": [ [ 0, 27 ] ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "metadata/binary/layout::overlay-dominates-third", "conf": 0.9200000166893005, "crit": 3, "desc": "Overlay exceeds one-third", "spans": [ [ 0, 27 ] ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "spans": [ [ 2784, 4 ] ] }, { "id": "metadata/signed/platform::microsoft", "conf": 0.9800000190734863, "crit": 2, "desc": "Microsoft-signed Windows binary" }, { "id": "metadata/package/quality/false-positives::common-fp-context", "conf": 0.8999999761581421, "crit": 2, "desc": "Common false positive indicators (Delphi, ApiSet, etc.)" } ], "type": "pe" }, { "id": 56, "sha": "54c7ef584e90521b3ef595e6b2d86b534cea070af397d02e19186e5a56fc2b72", "path": "Xamarin.GooglePlayServices.Stats.117.1.0.10.nupkg!!lib/net9.0-android35.0/Xamarin.GooglePlayServices.Stats.xml", "size": 157, "type": "xml", "depth": 1 }, { "id": 57, "sha": "7f92be6c840f2584494d4986060fe7dfe8bbf02d6ab122980fa1d43ffb2ecb0f", "path": "Xamarin.GooglePlayServices.Stats.117.1.0.10.nupkg!!LICENSE.md", "risk": 1, "size": 1480, "type": "markdown", "depth": 1 }, { "id": 58, "sha": "6e67b724f3423dca37c1292c0c1b502fdf6cfa23198a828adfc5b33d23f74601", "path": "Xamarin.GooglePlayServices.Stats.117.1.0.10.nupkg!!build/net9.0-android35.0/Xamarin.GooglePlayServices.Stats.targets", "size": 1515, "type": "xml", "depth": 1 }, { "id": 59, "sha": "6e67b724f3423dca37c1292c0c1b502fdf6cfa23198a828adfc5b33d23f74601", "path": "Xamarin.GooglePlayServices.Stats.117.1.0.10.nupkg!!buildTransitive/net9.0-android35.0/Xamarin.GooglePlayServices.Stats.targets", "size": 1515, "type": "xml", "depth": 1 }, { "id": 60, "sha": "ee061164842922fdbd8c35e5b573bdd32c638b10a35f68096dcd31bf1e365869", "path": "Xamarin.GooglePlayServices.Stats.117.1.0.10.nupkg!!readme.md", "size": 880, "type": "markdown", "depth": 1 }, { "id": 61, "sha": "9087f77f9b7af486baa71d086a5692547d59012eef6d12f04283288c311ba22e", "path": "Xamarin.GooglePlayServices.Stats.117.1.0.10.nupkg!![Content_Types].xml", "size": 909, "type": "xml", "depth": 1 }, { "id": 62, "sha": "6fbf23722666019a7eeef43b9a45ecfd38ae57379e644411a280bf1348123c4e", "path": "Xamarin.GooglePlayServices.Stats.117.1.0.10.nupkg!!package/services/metadata/core-properties/53cfd068828a473a8f62f8342bd8626a.psmdcp", "size": 897, "type": "xml", "depth": 1 }, { "id": 63, "sha": "f09d2cba3771e703c37db9b759bf545aa3534f704dcb9fe78cbac8801beba45c", "path": "Xamarin.GooglePlayServices.Stats@117.1.0.10.registry.json", "size": 894, "type": "registry", "depth": 1 } ], "omitted_files": 56, "rev": "46112", "v": "8" } }