{ "ml": { "v": "7", "eng": "2.2.0-beta.2", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.6463421, "rte": "az", "prob": 0.6463421 }, { "cls": 0, "raw": 0.39387754, "rte": "az/nupkg", "prob": 0.39387754 } ], "prob": 0.6463421, "skip": [ { "rte": "az/zip", "why": "unavailable" }, { "rte": "az/zip", "why": "unavailable" } ], "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.6463420987129211, "type": "nupkg" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.00012001395225524902, "type": "xml" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.012489467859268188, "type": "xml" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.6463420987129211, "type": "pe" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "xml" }, { "id": 5, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "xml" }, { "id": 6, "lvl": -1, "conf": 0, "prob": 0.00012001395225524902, "type": "xml" }, { "id": 7, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "registry" } ], "version": "v18.18", "analyzed_at": "2026-06-29T12:47:47Z" }, "path": "Elvia.Ifs.Extensions.Api.Models.1.0.28.nupkg", "raw": { "files": [ { "id": 0, "mol": "O(Al)H₂(CmDb)", "sha": "beb0fe44fcb59cd3f6b896c9cbdc645798edda4d923b062476dfc2b4e1e440ab", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Elvia.Ifs.Extensions.Api.Models/Elvia.Ifs.Extensions.Api.Models.1.0.28.nupkg", "risk": 4, "size": 174265, "type": "nupkg", "facts": { "metrics": { "file": { "size": 174265.0, "entropy": 7.98, "size_bytes": 174265.0 }, "binary": { "overall_entropy": 7.98, "peak_region_bytes": 149504.0, "peak_region_entropy": 7.83 }, "archive": { "file_count": 7.0, "member_count": 7.0, "script_count": 0.0, "zip_bomb_ratio": 12.88, "directory_count": 0.0, "executable_count": 1.0, "extra_field_size": 0.0, "noise_file_count": 0.0, "total_compressed": 173221.0, "compression.ratio": 0.19, "hidden_file_count": 2.0, "total_uncompressed": 896362.0, "crc_collision_count": 0.0, "entry_comment_count": 0.0, "max_filename_length": 81.0, "rtlo_filename_count": 0.0, "format.regular_count": 7.0, "nested_archive_count": 0.0, "path_traversal_count": 0.0, "symlink_escape_count": 0.0, "security.setgid_count": 0.0, "security.setuid_count": 0.0, "security.sticky_count": 0.0, "double_extension_count": 0.0, "duplicate_member_count": 0.0, "security.symlink_count": 0.0, "unicode_filename_count": 0.0, "homoglyph_filename_count": 0.0, "security.encrypted_count": 0.0, "timing.mtime_unique_count": 3.0, "timing.mtime_unique_ratio": 0.43, "misplaced_executable_count": 1.0, "timing.mtime_outlier_count": 3.0, "timing.mtime_dominant_count": 4.0, "timing.mtime_spread_seconds": 25172.0, "timing.sentinel_mtime_count": 0.0, "security.world_writable_count": 0.0, "timing.mtime_dominant_fraction": 0.57, "compression.method_counts.stored": 1.0, "compression.method_counts.deflate": 6.0 } } }, "ident": { "name": { "value": "Elvia.Ifs.Extensions.Api.Models", "source": "nupkg.title", "verified": false }, "trust": "unsigned", "authors": [ { "name": "Elvia AS", "role": "author", "source": "nupkg.authors" } ], "version": { "value": "1.0.28", "source": "nupkg.version", "verified": false }, "identifier": { "value": "Elvia.Ifs.Extensions.Api.Models", "source": "nupkg.id", "verified": false } }, "traits": [ { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "from": [ { "file": 3 } ] }, { "id": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "conf": 1.0, "crit": 3, "desc": "JSON polymorphism runtime marker", "from": [ { "file": 3 } ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "from": [ { "file": 3 } ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/os/registry/access::powershell-policy-state-signed--restricted", "conf": 0.8399999737739563, "crit": 1, "desc": "PowerShell signed policy state (Restricted)", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/communications/http/server/managed::http-request-get", "conf": 1.0, "crit": 3, "desc": "Access to ASP.NET Request object", "from": [ { "file": 3 } ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "from": [ { "file": 3 } ] }, { "id": "metadata/package/versioning::version-word-lower", "conf": 0.4000000059604645, "crit": 2, "desc": "version word (lowercase)", "from": [ { "file": 3 } ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "from": [ { "file": 3 } ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/data/db/linq::linq-queries", "conf": 0.699999988079071, "crit": 3, "desc": "LINQ query operations", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "from": [ { "file": 3 } ] } ] }, { "depth": 1, "facts": { "metrics": { "file": { "size": 521.0, "entropy": 5.19, "size_bytes": 521.0 }, "binary": { "overall_entropy": 5.19, "peak_region_bytes": 521.0, "peak_region_entropy": 5.19 } } }, "id": 1, "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Elvia.Ifs.Extensions.Api.Models/Elvia.Ifs.Extensions.Api.Models.1.0.28.nupkg!!_rels/.rels", "sha": "9be842bfe3765edebfef8c4d447d37abbfb9715de26466cf050d02e0fa7d957d", "size": 521, "type": "xml" }, { "ctx": [ { "b": "[4ls%kx}3YaA?spB7]MgjT8QkfD}SJzEWP}x(mMDb6w0teJs}sj]", "n": [ { "c": 2, "d": "NuGet nuspec manifest file", "i": "metadata/build/manifest::nuspec-file", "o": 0, "z": 38, "cf": 0.9800000190734863 } ], "ln": 1, "addr": 0 }, { "b": "jAa.syHH\u003c!aB4:tzGv@+xMOuniXJdcv}YB\u003cvrj5rx\u003e8g4B8LVje[n*pfk$ufyHH\u003c\u0026zF7QTfFLvpfF$I3B-RIkv\u003eJ1EwfKh", "ln": 2, "addr": 42 }, { "b": "arS^-wPRu\u003evrt{w", "ln": 3, "addr": 118 }, { "b": "arR^HjyJwOxM4{jk1fphx\u003c\u0026bIq-(ZwB-.qnA=Tz", "ln": 6, "addr": 206 }, { "b": "arR^Hjy\u00262Av@=p5BzkVhk0%maByw)3B09\u003eIpJET\u003cz/M$yB7]J8aARpdazCCeeOffGwO#N6z/fRsk#pc9jtgkRB7ol8Acb/jzAX", "ln": 7, "addr": 238 }, { "b": "arR^HjAt1Lz/YSmz/QaCBA}?pjTaJMBrR\u0026qz/6u9BuH*8f/Rg8hE[Z4v\u003e}U9hdXG#wIN.8vLP-Ih!1^QhdZxdwmvFQf\u003eJu*atk[", "n": [ { "c": 2, "d": "NuGet package declares repository", "i": "metadata/package/files/nuget::nuspec-repository", "o": 321, "z": 30, "cf": 0.8999999761581421 } ], "ln": 8, "addr": 317 }, { "b": "arR^Hjy\u00262xwO#3\u0026zEWx(B3o", "n": [ { "c": 2, "d": "NuGet package declares dependencies", "i": "metadata/package/files/nuget::nuspec-dependencies", "o": 401, "z": 74, "cf": 0.8999999761581421 } ], "ln": 9, "addr": 397 }, { "b": "arR^HarS^VA=l8taAR4jxjVfOA:-/@Cw?IqjTa=PBtkE4fD@W", "ln": 10, "addr": 416 }, { "b": "arR^HarR^Hjy\u00262xwO#3\u0026zEW@mx\u003efvJo\u003e!9Tz/Y\u0026eBs]\u003e2A86$^lVm0Re\u003ey8aA4TQ\u003evruTjwPG4rC4CYnx(v(La#R5ce?!\u003e@A+fAdwP]:-e\u00262dph8u\u003cxa%pDwv@co#wJ.k7B.LV5ej1eZy\u003cytrA=SAEffP", "ln": 11, "addr": 456 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 638.0, "entropy": 5.15, "size_bytes": 638.0 }, "binary": { "overall_entropy": 5.15, "peak_region_bytes": 638.0, "peak_region_entropy": 5.15 } } }, "id": 2, "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Elvia.Ifs.Extensions.Api.Models/Elvia.Ifs.Extensions.Api.Models.1.0.28.nupkg!!Elvia.Ifs.Extensions.Api.Models.nuspec", "risk": 1, "sha": "7efe7f34f9954e08f7b85883485fa8e89f00de1c20204348eee932ac4f88f77a", "size": 638, "traits": [ { "id": "metadata/package/files/nuget::nuspec-dependencies", "conf": 0.8999999761581421, "crit": 2, "desc": "NuGet package declares dependencies", "spans": [ [ 401, 74 ] ] }, { "id": "metadata/package/files/nuget::nuspec-repository", "conf": 0.8999999761581421, "crit": 2, "desc": "NuGet package declares repository", "spans": [ [ 321, 30 ] ] }, { "id": "metadata/build/manifest::nuspec-file", "conf": 0.9800000190734863, "crit": 2, "desc": "NuGet nuspec manifest file", "spans": [ [ 0, 38 ] ] } ], "type": "xml" }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J+", "n": [ { "c": 3, "d": "HTTP fingerprinting evasion campaign", "i": "objectives/command-and-control/infrastructure/user-agent::http-fingerprinting-campaign", "o": 0, "z": 34, "cf": 0.8999999761581421 } ], "ln": 0 }, { "b": "00000000000000000000i7s5K00000nb@R\u00260SSx7Ot(L?p)}H!0rr91000000000000", "n": [ { "c": 1, "d": "PE standard code/data section", "i": "metadata/binary/section/names::pe-code-data-standard-section", "o": 512, "z": 5, "cf": 0.8999999761581421 } ], "ln": 496 }, { "b": "?Woz!dJOTt9rl6DdGxCGlq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn", "n": [ { "c": 3, "d": "Recognized PE anti-analysis marker", "i": "objectives/anti-analysis/debugger-detect/combined-checks::evasion-aware-recognized-pe-marker", "o": 35996, "z": 4, "cf": 1.0 } ], "ln": 35980 }, { "b": "wPyvM0cqZ[uSzeUA.f^wxjVf(lV)D(z/66aqE%]*z/fSgvR/QQB7Gw-wb{WZBydyTB98tqwPyWWB8V5nB7]91wMr!.A.f^wxjVf(p\u0026ZF?wN/*QwNPaXA-Ef(A.f^wB7GD2p\u0026ZF?wN/*QwNPaXA-Ef(A.f^wxjVf(o\u003c}{FxjV9-B7Gw-wb{WZByd:JzEEf?A-Ef(A.f^wxjVf(p\u0026ZF?wN/*RvqYH^wPy^(wPyvM0cqZ[uR\u003e=YygQ)%o\u003c}{FxjV9-B7Gw-wb{mNBydyzB7FA\u003eA+/lbrDz.(nN}*xwPRoDvrl0YzV", "n": [ { "c": 1, "d": "Regex component marker", "i": "objectives/persistence/login/scheduled-task/com::task-action-principal-properties--rx-9", "o": 261794, "z": 29, "cf": 0.8799999952316284 } ], "ln": 261778 }, { "b": "yFO$YwPypLzE)\u0026%By!$.xjVf(l$7gGlVl\u003cWwN/*[wb{WZBydBABy^*TzF\u003c2}By!$.xjVf(nPNmqzF\u003c2}By!$.B7GD2nPNmqzF\u003c2}By!$.xjVf(p\u0026ZF?wN/*Hz/fD7v@#o)0cqZ[uR\u003e=YygQ)%lVl\u003cWwN/*[wb]IsB98Cpv@#o)07gWwAbo9cwN\u003e^tB-qqox\u003eqr.wO#Q3wb]CDx(n37", "n": [ { "c": 1, "d": "PowerShell signed policy state (Restricted)", "i": "micro-behaviors/os/registry/access::powershell-policy-state-signed--restricted", "o": 264515, "z": 10, "cf": 0.8399999737739563 }, { "c": 1, "d": "Regex component marker", "i": "objectives/persistence/login/scheduled-task/com::task-scheduler-builder-methods--rx-1", "o": 264405, "z": 17, "cf": 0.8999999761581421 } ], "ln": 264389 }, { "b": "yHpBnvpK7!zF8BMwO+(SjvAR1wKyxNzE)s1wN)#uuTDcdv@2^@xguPDy?9JdnPNmqzF\u003c2}By!#DyHpBnvpK7!zF8BMwO+(SjwZ6pygQ)%lVl\u003cWwN/*[wiK^ouQwghyIvW0mRMA", "n": [ { "c": 1, "d": "Regex component marker", "i": "objectives/persistence/login/scheduled-task/com::task-scheduler-builder-methods--rx-1", "o": 269724, "z": 30, "cf": 0.8999999761581421 } ], "ln": 269708 }, { "b": "yHpBnvpK7!zF8BMwO+(SjxlDlA-lK=wN/*\u003cvR/QtyHpBnvpK7!zF8BMwO+(Sjv\u003cgcBz(hlv{%gvvrl0TwPI*ezGxJ3y?k!CuTDb", "n": [ { "c": 3, "d": "Bulk sensitive server data list", "i": "objectives/exfiltration/cloud/sync-tool::bulk-sensitive-server-data-path", "o": 271902, "z": 31, "cf": 1.0 } ], "ln": 271886 }, { "b": "vpB4:07y^FzdN-@vR/PQxjVf(rDz.(q!o=Rv@#c*y?iP/wPRoVB7Gw\u003cwO+{/BywS{wDlvOBydNMB98tvx\u003e7N/lT+4EqE%]*z/fSgvR/PQA@", "n": [ { "c": 1, "d": "Regex component marker", "i": "objectives/exfiltration/cloud/sync-tool::bulk-sensitive-server-data-path--rx-8", "o": 293101, "z": 18, "cf": 1.0 } ], "ln": 293085 }, { "b": "B7]MgB1P:$x!Aa#wmYN#e[w^m07ZKswmGK*wN]dyB.\u003e\u003c]mqV\u0026vsz.\u003cOraQq@nowY+", "n": [ { "c": 3, "d": "References Windows executable or script", "i": "objectives/execution/interpreter/script/shell::windows-executable-ref", "o": 305849, "z": 4, "cf": 0.6000000238418579 } ], "ln": 305833 }, { "b": "BzkVh08[2HB97\u0026jx(v\u003e?q*ACawO\u003c50wQ5qHn][]*e(Mt4x\u003c\u003e*(Dsp]fz/bL/wPRoPA+w/#x)Kifx(v\u003e?", "n": [ { "c": 3, "d": "JSON polymorphism runtime marker", "i": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "o": 308167, "z": 16, "cf": 1.0 } ], "ln": 308151 }, { "b": "zu9muB5l)}ygQ)%x(v\u003e?q*ACawO\u003c4$wOb:\u0026v@#B6zu97yuSz5Qvru6/nmuKHv@C)?wm4Yxy\u00260V)BzkVh00", "n": [ { "c": 2, "d": "Benign high-entropy PE context", "i": "metadata/package/quality/false-positives::benign-high-entropy-pe-context", "o": 308441, "z": 17, "cf": 0.949999988079071 } ], "ln": 308425 }, { "b": "wkv5gx(!l8zGxlcyhW$\u0026q*ACawO\u003c50wQ5qHn][]*0b2\u003e+uS7DzB8L{@B7GD2qE%oTz/bLDw]*y:wO#P-", "n": [ { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 310538, "z": 16, "cf": 0.8500000238418579 } ], "ln": 310522 }, { "b": "B7GD2l1t1JC4(5zq!o}Gq*ACawO\u003c4[x(m[\u003cp*[xOxLzT3p*[wAnmuKHv@C)?wm5wCASwHCuSz4", "n": [ { "c": 3, "d": "LINQ query operations", "i": "micro-behaviors/data/db/linq::linq-queries", "o": 312266, "z": 11, "cf": 0.699999988079071 } ], "ln": 312250 }, { "b": "wNOtP0cqZ[uQnZzvnp\u003ezxjVf(qE%\u0026\u003cwPI%8wi\u003elEvnp\u003ezB7GD2qE%\u0026\u003cwPI%8wi\u003elEvnp\u003ezlVl\u0026", "n": [ { "c": 3, "d": "Access to ASP.NET Request object", "i": "micro-behaviors/communications/http/server/managed::http-request-get", "o": 315592, "z": 11, "cf": 1.0 } ], "ln": 315576 }, { "b": "AbY-oBy!#9x(k5nxLzJgC4CYnx(v(iz!pbqz/{7yv@Dj6x(4v3e=+}L6AFgAqE%\u0026\u003cx(W+", "n": [ { "c": 3, "d": "Recognized sparse-logic binary marker", "i": "objectives/anti-analysis/vm-detect/instruction::sparse-logic-recognized-marker", "o": 334800, "z": 7, "cf": 0.800000011920929 } ], "ln": 334784 }, { "b": "3JQkifGgNHfFAFb3\u0026{tkqBKC.mn)d=01n(d2r1t6eIF\u003ej000Sj01yRpeL]CloI4O]gD3]", "n": [ { "c": 2, "d": "HTTP REQUEST method", "i": "micro-behaviors/communications/http/request/client::request", "o": 336761, "z": 7, "cf": 0.699999988079071 } ], "ln": 336745 }, { "b": "0rrf300063004Lj0rvUeq*ACawO\u003c50wQ5qHn][]*e(Mt4x\u003c\u003e*(Dsp]fz/dg1B8L}{BAh8kxglYXz9@kVC4CYowPxsAq*ACawO\u003c50wQ5qHn][]*efE#8A=U@kzAPZde?![ie?!?0lV)i!B-I4RzE)%jA:-=naw^h\u0026y?WxLwQdl[yH)", "n": [ { "c": 2, "d": "IPv4-like .NET assembly version", "i": "metadata/lang/compiler/managed::dotnet-ipv4-like-version", "o": 337183, "z": 16, "cf": 0.8500000238418579 }, { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 337109, "z": 16, "cf": 0.8500000238418579 } ], "ln": 337093 }, { "b": "z/bTS004Lv0rrc2r8[E8q*ACawO\u003c50wQ5qHn][]*e(Mt4x\u003c\u003e*(Dsp]fz/dg1B8L}/xkRTdwKyxNwncd1z/d9Gq*ACawO\u003c50wQ5qHn][]*efE#8A=U@kzAPZde?![ie?!?0lV)i!B-I4RzE)%j", "n": [ { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 337442, "z": 16, "cf": 0.8500000238418579 } ], "ln": 337426 }, { "b": "00000000000000000000000000000000000000315c8Xg7YTL^00000000000000000", "n": [ { "c": 1, "d": "PE resource section", "i": "metadata/binary/section/names::pe-resource-section", "o": 338432, "z": 5, "cf": 0.8999999761581421 } ], "ln": 338416 }, { "b": "0000000000000SmgYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006Xn[brp!0rr910rr9", "n": [ { "c": 3, "d": "Recognized marker for timing checks", "i": "objectives/anti-analysis/timing/evasion::timing-anti-debug-recognized-marker", "o": 338526, "z": 15, "cf": 0.949999988079071 } ], "ln": 338510 }, { "b": "k(:ZYnDpvy001+O2(\u003c#alJz38z2!IPve$fBC(QOtve$cAwDhYg002B/yYFRUx-IMwaojXcqVD^$003m78uo^rmGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up002N\u003cw=M(Le=XruCMq*", "n": [ { "c": 2, "d": "PE CompanyName metadata field", "i": "metadata/package/versioning::pe-companyname-field", "o": 338866, "z": 11, "cf": 0.699999988079071 }, { "c": 2, "d": "PE FileDescription metadata field", "i": "metadata/package/versioning::pe-filedescription-field", "o": 338918, "z": 15, "cf": 0.699999988079071 } ], "ln": 338850 }, { "b": "wb{fvyYFIR001+O2(\u003c#amGvc5yYF2DrSDXhASydXx-J5Kzu6Up001.Ne=WN9e=WTbh#\u003eMhfAq7M003m79SMivnDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE002N\u003cw=M(Le=XruCMq*=wDlPF", "n": [ { "c": 3, "d": "Dotted-quad PE version metadata marker", "i": "objectives/command-and-control/infrastructure/ip::ipv4-version-metadata-marker", "o": 339010, "z": 11, "cf": 0.9399999976158142 }, { "c": 2, "d": "PE InternalName metadata field", "i": "metadata/package/versioning::pe-internalname-field", "o": 339062, "z": 12, "cf": 0.699999988079071 } ], "ln": 338994 }, { "b": "xAibO001bw003Kf9SMivpxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE002N\u003cw=M(Le=XruCMq*=", "n": [ { "c": 2, "d": "PE OriginalFilename metadata field", "i": "metadata/package/versioning::pe-originalfilename-field", "o": 339194, "z": 16, "cf": 0.699999988079071 } ], "ln": 339178 }, { "b": "e=YzZyYFnK002%#8uo^rpYLIozVBqFBPt[KBo25ove$cAwDhYg002N\u003cw=M(Le=XruCMq*=wDlP", "n": [ { "c": 2, "d": "PE ProductName metadata field", "i": "metadata/package/versioning::pe-productname-field", "o": 339294, "z": 11, "cf": 0.699999988079071 } ], "ln": 339278 }, { "b": "wb{fvyYFIR004VLfAqaNpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001.Ne=WN9e=WTbh#\u003eDegYN", "n": [ { "c": 2, "d": "PE version resource metadata", "i": "metadata/package/versioning::version-resource-metadata", "o": 339378, "z": 14, "cf": 0.8999999761581421 } ], "ln": 339362 }, { "b": "0000000000000000000006*X/3\u0026*ncst*cV000000000000000000000000000000000", "n": [ { "c": 2, "d": "PE .reloc section presence", "i": "metadata/binary/section/names::reloc-section-presence", "o": 339968, "z": 6, "cf": 0.8999999761581421 } ], "ln": 339952 } ], "depth": 1, "facts": { "imp": [ [ "mscoree", "CorDllMain" ] ], "sec": [ [ ".text", 512, 337920, 5.78, "r-x" ], [ ".rsrc", 338432, 1536, 2.64, "r--" ], [ ".reloc", 339968, 512, 0.1, "r--" ] ], "metrics": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "resource_count": 1.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 351532.0, "reloc_overhang_bytes": 500.0, "reloc_overhang_ratio": 0.98, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "version.identity_entropy": 4.08, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0, "version.identity_symbol_ratio": 0.1 }, "file": { "size": 340480.0, "entropy": 5.76, "size_bytes": 340480.0 }, "binary": { "is_pie": 1.0, "code_entropy": 5.78, "string_count": 3410.0, "overall_entropy": 5.76, "entropy_variance": 5.39, "avg_string_length": 19.54, "max_string_length": 146.0, "peak_region_bytes": 4096.0, "code_to_data_ratio": 1.0, "peak_region_entropy": 5.57, "string_length_stddev": 9.14, "largest_section_ratio": 0.99, "sentence_string_count": 6.0, "sentence_string_ratio": 0.0, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 337920.0, "entropy_max": 5.78, "entropy_mean": 2.84, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } } }, "id": 3, "mol": "O(Al)H₂(CmDb)", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Elvia.Ifs.Extensions.Api.Models/Elvia.Ifs.Extensions.Api.Models.1.0.28.nupkg!!lib/net10.0/Ifs.Extensions.Api.Models.dll", "risk": 4, "sha": "3c261b729db02ccff3a15e8ca85f08fa322bea5494d38144c35abdc0903108d4", "size": 340480, "traits": [ { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "spans": [ [ 339010, 11 ] ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 338526, 15 ] ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "spans": [ [ 305849, 4 ] ] }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "spans": [ [ 0, 26 ] ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "spans": [ [ 35996, 4 ] ] }, { "id": "metadata/package/versioning::version-word-lower", "conf": 0.4000000059604645, "crit": 2, "desc": "version word (lowercase)", "spans": [ [ 334800, 7 ] ] }, { "id": "micro-behaviors/communications/http/server/managed::http-request-get", "conf": 1.0, "crit": 3, "desc": "Access to ASP.NET Request object", "spans": [ [ 315592, 11 ] ] }, { "id": "micro-behaviors/os/registry/access::powershell-policy-state-signed--restricted", "conf": 0.8399999737739563, "crit": 1, "desc": "PowerShell signed policy state (Restricted)", "spans": [ [ 264515, 10 ] ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "spans": [ [ 339378, 14 ] ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "micro-behaviors/data/db/linq::linq-queries", "conf": 0.699999988079071, "crit": 3, "desc": "LINQ query operations", "spans": [ [ 312266, 11 ] ] }, { "id": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "conf": 1.0, "crit": 3, "desc": "JSON polymorphism runtime marker", "spans": [ [ 308167, 16 ] ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "spans": [ [ 35996, 4 ] ] } ], "type": "pe" }, { "depth": 1, "facts": { "metrics": { "file": { "size": 540566.0, "entropy": 4.39, "size_bytes": 540566.0 }, "binary": { "overall_entropy": 4.39, "peak_region_bytes": 495510.0, "peak_region_entropy": 4.64 } } }, "id": 4, "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Elvia.Ifs.Extensions.Api.Models/Elvia.Ifs.Extensions.Api.Models.1.0.28.nupkg!!lib/net10.0/Ifs.Extensions.Api.Models.xml", "sha": "c89935a3ce0e196eca7955df000e38054503d92e73553c34fd9b74a9ff4319b8", "size": 540566, "traits": [ { "id": "metadata/file/extension/identity::doc-or-config-extension", "conf": 1.0, "crit": 1, "desc": "Document or config file extension", "spans": [ [ 0, 29 ] ] } ], "type": "xml" }, { "ctx": [ { "b": "ju[7cy-)[jA=U@kzAPf#e?!E(wO#0@wnb{]jTb2\u003cw?t$^krYAprc-B]B0bZAy\u0026jqSb4#7uA5]T9B7n({zddGrz/xo9CX}nez/PY6BAo5", "n": [ { "c": 1, "d": "File uses a document or configuration extension", "i": "metadata/file/extension/identity::doc-or-config-extension", "o": 0, "z": 19, "cf": 1.0 } ], "ln": 0, "col": 1, "line": 1 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 521.0, "entropy": 4.81, "size_bytes": 521.0 }, "binary": { "overall_entropy": 4.81, "peak_region_bytes": 521.0, "peak_region_entropy": 4.81 } } }, "id": 5, "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Elvia.Ifs.Extensions.Api.Models/Elvia.Ifs.Extensions.Api.Models.1.0.28.nupkg!![Content_Types].xml", "pid": 0, "sha": "f105fbd7bc77c6b4f028e420b9a03ebe3384f0a0a287f5fdea16bd215f508868", "size": 521, "traits": [ { "id": "metadata/file/extension/identity::doc-or-config-extension", "conf": 1.0, "crit": 1, "desc": "File uses a document or configuration extension", "spans": [ [ 0, 19 ] ] } ], "type": "xml" }, { "id": 6, "sha": "b8c9903c6705efc1294fa1f14d0636e6325e75bef4f9071d315b4bf3fce49f19", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Elvia.Ifs.Extensions.Api.Models/Elvia.Ifs.Extensions.Api.Models.1.0.28.nupkg!!package/services/metadata/core-properties/a4360e4d7614450ab326e3e0c7894a7b.psmdcp", "size": 656, "type": "xml", "depth": 1 }, { "id": 7, "sha": "adf9798d2e9182c2f4b08a4d8c0cd4f9fc33a68012cc7b547dbf3f92c98ccad3", "path": "Elvia.Ifs.Extensions.Api.Models@1.0.28.registry.json", "size": 789, "type": "registry", "depth": 1 } ], "omitted_files": 2, "rev": "46112", "v": "8" } }