{ "llm": { "conf": 0.7524395, "grade": "benign", "model": "Qwen/Qwen3.6-27B", "outcome": "benign", "interpretation": "Legitimate .NET analyzer package" }, "ml": { "v": "7", "eng": "2.3.0-beta.0", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.5027308, "rte": "az", "prob": 0.5027308 }, { "cls": 0, "raw": 0.22333097, "rte": "az/nupkg", "prob": 0.22333097 } ], "prob": 0.6463421, "skip": [ { "rte": "az/zip", "why": "unavailable" }, { "rte": "az/zip", "why": "unavailable" } ], "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.6463420987129211, "type": "nupkg" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.00012001395225524902, "type": "xml" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.0012085139751434326, "type": "xml" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.6463420987129211, "type": "pe" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.011974960565567017, "type": "markdown" }, { "id": 5, "lvl": -1, "conf": 0, "prob": 0.0000756382942199707, "type": "png" }, { "id": 6, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "xml" }, { "id": 7, "lvl": -1, "conf": 0, "prob": 0.00012001395225524902, "type": "xml" }, { "id": 8, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "registry" } ], "version": "v18.18", "analyzed_at": "2026-07-07T04:42:35Z" }, "path": "SoftwareExtravaganza.Whizbang.Transports.HotChocolate.Generators.0.814.1-alpha.4.nupkg", "raw": { "files": [ { "id": 0, "mol": "O(Al)H₂(CmDb)", "sha": "bfbd75bfce819fdd31263478b836f40dfbabf771bd72907779618e6807423365", "path": "SoftwareExtravaganza.Whizbang.Transports.HotChocolate.Generators.0.814.1-alpha.4.nupkg", "risk": 4, "size": 62451, "type": "nupkg", "facts": { "metrics": { "file": { "size": 62451.0, "entropy": 7.96, "size_bytes": 62451.0 }, "binary": { "overall_entropy": 7.96, "peak_region_bytes": 58368.0, "peak_region_entropy": 7.81 }, "archive": { "file_count": 8.0, "member_count": 8.0, "script_count": 0.0, "zip_bomb_ratio": 7.73, "directory_count": 0.0, "executable_count": 1.0, "extra_field_size": 0.0, "noise_file_count": 0.0, "total_compressed": 61261.0, "compression.ratio": 0.34, "hidden_file_count": 2.0, "total_uncompressed": 179705.0, "crc_collision_count": 0.0, "entry_comment_count": 0.0, "max_filename_length": 81.0, "rtlo_filename_count": 0.0, "format.regular_count": 8.0, "nested_archive_count": 0.0, "path_traversal_count": 0.0, "symlink_escape_count": 0.0, "security.setgid_count": 0.0, "security.setuid_count": 0.0, "security.sticky_count": 0.0, "double_extension_count": 0.0, "duplicate_member_count": 0.0, "security.symlink_count": 0.0, "unicode_filename_count": 0.0, "homoglyph_filename_count": 0.0, "security.encrypted_count": 0.0, "timing.mtime_unique_count": 4.0, "timing.mtime_unique_ratio": 0.5, "misplaced_executable_count": 1.0, "timing.mtime_dominant_count": 4.0, "timing.mtime_spread_seconds": 25018.0, "timing.sentinel_mtime_count": 0.0, "security.world_writable_count": 0.0, "timing.mtime_dominant_fraction": 0.5, "compression.method_counts.stored": 1.0, "compression.method_counts.deflate": 7.0 } } }, "ident": { "name": { "value": "SoftwareExtravaganza.Whizbang.Transports.HotChocolate.Generators", "source": "nupkg.title", "verified": false }, "urls": [ { "url": "https://whizba.ng/", "kind": "homepage", "source": "nupkg.project_url" }, { "url": "https://github.com/whizbang-lib/whizbang", "kind": "repository", "source": "nupkg.repository_url" } ], "trust": "unsigned", "authors": [ { "name": "Phil Carbone", "role": "author", "source": "nupkg.authors" } ], "version": { "value": "0.814.1-alpha.4", "source": "nupkg.version", "verified": false }, "identifier": { "value": "SoftwareExtravaganza.Whizbang.Transports.HotChocolate.Generators", "source": "nupkg.id", "verified": false } }, "traits": [ { "id": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "conf": 1.0, "crit": 3, "desc": "JSON polymorphism runtime marker", "from": [ { "file": 3 } ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "from": [ { "file": 3 } ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "from": [ { "file": 3 } ] }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/communications/http/server/managed::http-request-get", "conf": 1.0, "crit": 3, "desc": "Access to ASP.NET Request object", "from": [ { "file": 3 } ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/data/db/linq::linq-queries", "conf": 0.699999988079071, "crit": 3, "desc": "LINQ query operations", "from": [ { "file": 3 } ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "from": [ { "file": 3 } ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "from": [ { "file": 3 } ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" } ] }, { "depth": 1, "facts": { "metrics": { "file": { "size": 554.0, "entropy": 5.21, "size_bytes": 554.0 }, "binary": { "overall_entropy": 5.21, "peak_region_bytes": 554.0, "peak_region_entropy": 5.21 } } }, "id": 1, "path": "SoftwareExtravaganza.Whizbang.Transports.HotChocolate.Generators.0.814.1-alpha.4.nupkg!!_rels/.rels", "sha": "6188eed9f2cb6cb147a649810778327cbc64442a46142b7f451bb20efc09c243", "size": 554, "type": "xml" }, { "ctx": [ { "b": "[4ls%kx}3YaA?spB7]MgjT8QkfD}SJzEWP}x(mMDb6w0teJs}sj]", "n": [ { "c": 2, "d": "NuGet nuspec manifest file", "i": "metadata/build/manifest::nuspec-file", "o": 0, "z": 71, "cf": 0.9800000190734863 } ], "ln": 1, "addr": 0 }, { "b": "jAa.syHH\u003c!aB4:tzGv@+xMOuniXJdcv}YB\u003cvrj5rx\u003e8g4B8LVje[n*pfk$ufyHH\u003c\u0026zF7QTfFLpnf!+m#B-RIkv\u003eJ1EwfKh", "ln": 2, "addr": 42 }, { "b": "arS^-wPRu\u003evrt{w", "ln": 3, "addr": 118 }, { "b": "arR^Hjy-qGD2^RixMMB9z/x#xx\u003eIa3aI$92gb7EvaA}HkDsyr2xdW}lvMVqNz/x#xx\u003eIa3j]", "ln": 14, "addr": 748 }, { "b": "arR^HjAL1AB3seUwO#Pwwo8ycwO@S2ADlaywP?T5Bs?MLB-H#azF782z/^ajz//(dBrC)vA=iKIwOb:\u0026v@#B6zxJ!cB8$=5x(mMawnca7vru0)wPw]jz/Z2kA+friy-)q3v@Dy0ay[]1AaK5jvs06pwI4$mA=#ebwNY!6jtg!+xlcl", "ln": 15, "addr": 806 }, { "b": "arR^HjAt1Lz/YSmz/QaCBA}?pjTaJMBrR\u0026IA+)(.xMOunB2\u003e%cxk8E3BZ=$kz/4dKxLz^4vqYZfy?WuiCw7YpvQTd!a%punvqYN*jTa]Tw]/RswNPa\u003cfjXTqwO=p7a%pxlzeB0ejT8TpiwSuBfGz3Hwhb]Hiw+k1vMw4hiC7cdi5teTw[rVbhdXQ0wICwKffP", "n": [ { "c": 2, "d": "NuGet package declares repository", "i": "metadata/package/files/nuget::nuspec-repository", "o": 950, "z": 105, "cf": 0.8999999761581421 } ], "ln": 16, "addr": 946 }, { "b": "arS^1zdN/$wmoN*j]", "ln": 17, "addr": 1101 }, { "b": "jtgUZv@2H=wJ*", "ln": 18, "addr": 1115 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 1125.0, "entropy": 5.13, "size_bytes": 1125.0 }, "binary": { "overall_entropy": 5.13, "peak_region_bytes": 1125.0, "peak_region_entropy": 5.04 } } }, "id": 2, "path": "SoftwareExtravaganza.Whizbang.Transports.HotChocolate.Generators.0.814.1-alpha.4.nupkg!!SoftwareExtravaganza.Whizbang.Transports.HotChocolate.Generators.nuspec", "risk": 1, "sha": "204e6ec73a883eac550f504f2c2b495bda411958e9d09f3f08365dc2df93d5f4", "size": 1125, "traits": [ { "id": "metadata/build/manifest::nuspec-file", "conf": 0.9800000190734863, "crit": 2, "desc": "NuGet nuspec manifest file", "spans": [ [ 0, 71 ] ] }, { "id": "metadata/package/files/nuget::nuspec-repository", "conf": 0.8999999761581421, "crit": 2, "desc": "NuGet package declares repository", "spans": [ [ 950, 105 ] ] } ], "type": "xml" }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J\u0026m(0ji6Sa?dLD+]{51x(+zoA=kPhvqNb%vqY$3BrC47aAzQxazCZol@c-7zeP", "n": [ { "c": 3, "d": "HTTP fingerprinting evasion campaign", "i": "objectives/command-and-control/infrastructure/user-agent::http-fingerprinting-campaign", "o": 0, "z": 34, "cf": 0.8999999761581421 }, { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 78, "z": 4, "cf": 0.800000011920929 } ], "ln": 0 }, { "b": "00000000000000000000=#]A\u002600000nb@R\u00260SSx7v3yS\u003e5A9P?0rr9100000KB3%c=\u0026", "n": [ { "c": 1, "d": "PE standard code/data section", "i": "metadata/binary/section/names::pe-code-data-standard-section", "o": 512, "z": 5, "cf": 0.8999999761581421 } ], "ln": 496 }, { "b": "aAR)FwGUMeBy/uhx(v(iw]zYjs7(q]vQTd!awuu:B7GzB3nj4=aw^8%C4\u003eF#B0bD", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 24385, "z": 3, "cf": 0.800000011920929 } ], "ln": 24369 }, { "b": "C{4iOAaHe6CYWImB7]MgB0bWvBz8^/z/!uWz!0Z4vru6k3lQDAfe1CnvqG:5BzbxfayO(7wPw[VwmO+Px)Kk%zF8TOzGxxgc[coMzxF", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 24920, "z": 4, "cf": 0.800000011920929 } ], "ln": 24904 }, { "b": "vqNc8vqPNsb4tXey?d9$b0F$twGTJZBvf.Wv@Df(By=OnwPq\u003c7B95KoCX7xcBz(g", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 25057, "z": 3, "cf": 0.800000011920929 } ], "ln": 25041 }, { "b": "zeAZ4C%hMTatkx3av*0+B0bNrwGU(0zdK\u0026dw/#hewGUR%zE)\u0026%Bz(gxBzb98aAhu", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 25644, "z": 3, "cf": 0.800000011920929 } ], "ln": 25628 }, { "b": "ayYQsA+e($z/cXnvqPM#vqYP#B-Rb8aARJAxjU%(A::63aAqKnA^n^AwPRQ7wofv", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 27554, "z": 3, "cf": 0.800000011920929 } ], "ln": 27538 }, { "b": "wPzj3z/P[Kq!PPWwN)tmr+lq)x(v(LfFkstg+HHnfF1tlB.(exA+dyKwP-9nvqEFqp\u003c3k-x\u003e6!EC#OY$wD", "n": [ { "c": 2, "d": "IPv4-like .NET assembly version", "i": "metadata/lang/compiler/managed::dotnet-ipv4-like-version", "o": 30142, "z": 17, "cf": 0.8500000238418579 } ], "ln": 30126 }, { "b": "x\u003e6!EC#OY$wO%UGB.\u003e\u003e4lq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn", "n": [ { "c": 3, "d": "Recognized PE anti-analysis marker", "i": "objectives/anti-analysis/debugger-detect/combined-checks::evasion-aware-recognized-pe-marker", "o": 30304, "z": 4, "cf": 1.0 } ], "ln": 30288 }, { "b": "uQmT\u003cqB%hPr7gd?k$%=Fq*ACawO\u003c4\u003epxi{Xq=-@^pFBLHpdeCTpdd]OnLSk(k#Z/YnKuARmf", "n": [ { "c": 2, "d": "System namespace reference", "i": "metadata/lang/compiler/managed::system-namespace", "o": 58030, "z": 9, "cf": 0.800000011920929 } ], "ln": 58014 }, { "b": "uS7DRB.(e0D2Ns\u0026vqPMQxjVf(qE%\u0026\u003cwPI@)D2Ns\u0026vqPMQB7GD2qE%\u0026\u003cwPI@)D2Ns\u0026vqPMQxjVe", "n": [ { "c": 3, "d": "Access to ASP.NET Request object", "i": "micro-behaviors/communications/http/server/managed::http-request-get", "o": 61719, "z": 11, "cf": 1.0 } ], "ln": 61703 }, { "b": "xjVf(rDq)QB7GD2rDq)Qm}D^pvqY^\u003ewPI@\u003ewPI^jA:@VVBAg@3z2!iWBydQYwO?ACD2[7sz2^anB7^\u003cQxk.*8BzbH\u003eq#", "n": [ { "c": 2, "d": ".NET manifest resource stream access", "i": "micro-behaviors/data/embedded/payload/resource::dotnet-getmanifestresourcestream", "o": 66566, "z": 25, "cf": 0.8500000238418579 } ], "ln": 66550 }, { "b": "z7Xs{z^)c\u003ex)Kifx(v\u003e?q*ACawO\u003c50wQ5qHn][]*e(Mt4x\u003c\u003e*(Dsp]fz/bL/wPRoFzEE0\u003cwL^z=ygQ)%", "n": [ { "c": 3, "d": "JSON polymorphism runtime marker", "i": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "o": 66873, "z": 16, "cf": 1.0 } ], "ln": 66857 }, { "b": "zEE0\u003cwL^z=ygQ)%x(v\u003e?q*ACawO\u003c4$wOb:\u0026v@#B6zu9gEz/{1^z!%l3v@#B6zu9pIz/ecVzF%MblVl\u003cMx-", "n": [ { "c": 2, "d": "Benign high-entropy PE context", "i": "metadata/package/quality/false-positives::benign-high-entropy-pe-context", "o": 66946, "z": 17, "cf": 0.949999988079071 } ], "ln": 66930 }, { "b": "pgX6kB.%M(v}xR3x(v\u003e?q*ACawO\u003c50wQ5qHn][]*090(7vqZ13x\u003e7N/n][]*08)#Wx(mMJz/6D4A+PPk", "n": [ { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 67188, "z": 16, "cf": 0.8500000238418579 } ], "ln": 67172 }, { "b": "x(+)]q!PPWz#-yGz/{10q*ACawO\u003c4[x(m[\u003clU{sxASwEuvr8u+wO\u003e)/ASx3WA+eV@qE%oEwPv+", "n": [ { "c": 3, "d": "LINQ query operations", "i": "micro-behaviors/data/db/linq::linq-queries", "o": 67453, "z": 11, "cf": 0.699999988079071 } ], "ln": 67437 }, { "b": "wPRoJB5l)\u003ezddEgoj-wGq*ACawO\u003c4#wN/\u003e6x([RMlVND\u003eBz\u003e/jvq][90b2\u003e+uQn:OwO\u003e))C(RF*Bydx", "n": [ { "c": 2, "d": "System namespace reference", "i": "metadata/lang/compiler/managed::system-namespace", "o": 71963, "z": 15, "cf": 0.800000011920929 } ], "ln": 71947 }, { "b": "0rrv5wO+{^B7CsKblm==lVl{?A+Pf1BrFD1atLSah6v9Rx)Kk%zF7Lqx\u003c}5xFue+KFtMj.A@", "n": [ { "c": 2, "d": "Copyright notice", "i": "metadata/package/license::copyright-word", "o": 87503, "z": 9, "cf": 0.6000000238418579 } ], "ln": 87487 }, { "b": "AZT.Wo\u003c}:N0bV^!z/PA2e[w^m000000rjtBav2]b0000000000000000000000000", "n": [ { "c": 3, "d": "References Windows executable or script", "i": "objectives/execution/interpreter/script/shell::windows-executable-ref", "o": 88293, "z": 4, "cf": 0.6000000238418579 } ], "ln": 88277 }, { "b": "00000000000000000000000000000000000000315c8Xg7YTL^00000000000000000", "n": [ { "c": 1, "d": "PE resource section", "i": "metadata/binary/section/names::pe-resource-section", "o": 88576, "z": 5, "cf": 0.8999999761581421 } ], "ln": 88560 }, { "b": "0000000000005!#gYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006Xn[brp!0rs.O0000", "n": [ { "c": 3, "d": "Recognized marker for timing checks", "i": "objectives/anti-analysis/timing/evasion::timing-anti-debug-recognized-marker", "o": 88670, "z": 15, "cf": 0.949999988079071 } ], "ln": 88654 }, { "b": "zua.Te=U\u003eK0024W4fczelJz38z2!IPve$fBC(QOtve$cAwDhYg004iyxAh-DDh}yOve$fBx8\u003cH-yYFeHvGlxd004JHec2XJmGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up00372xAh-DDh}yOve$f", "n": [ { "c": 2, "d": "PE CompanyName metadata field", "i": "metadata/package/versioning::pe-companyname-field", "o": 89250, "z": 11, "cf": 0.699999988079071 }, { "c": 2, "d": "PE FileDescription metadata field", "i": "metadata/package/versioning::pe-filedescription-field", "o": 89310, "z": 15, "cf": 0.699999988079071 } ], "ln": 89234 }, { "b": "Bo3jVASydX001?Q3ig8bmGvc5yYF2DrSDXhASydXx-J5Kzu6Up001XMe=W\u003chf-T3ge=WQae=WN9004JHfAqaNnDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE00372xAh-DDh}yOve$fBx8\u003cK:", "n": [ { "c": 3, "d": "Dotted-quad PE version metadata marker", "i": "objectives/command-and-control/infrastructure/ip::ipv4-version-metadata-marker", "o": 89438, "z": 11, "cf": 0.9399999976158142 }, { "c": 2, "d": "PE InternalName metadata field", "i": "metadata/package/versioning::pe-internalname-field", "o": 89490, "z": 12, "cf": 0.699999988079071 } ], "ln": 89422 }, { "b": "eDxO!x-IPx004/PfAqaNpxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE00372xAh-DDh}yOve$fB", "n": [ { "c": 2, "d": "PE OriginalFilename metadata field", "i": "metadata/package/versioning::pe-originalfilename-field", "o": 89714, "z": 16, "cf": 0.699999988079071 } ], "ln": 89698 }, { "b": "e=YzZyYFnK001+O2(\u003c#apYLIozVBqFBPt[KBo25ove$cAwDhYg00372xAh-DDh}yOve$fBx8?]i005q+irf6WpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001XMe=W\u003chf-T3ge=WQaeDt", "n": [ { "c": 2, "d": "PE ProductName metadata field", "i": "metadata/package/versioning::pe-productname-field", "o": 89850, "z": 11, "cf": 0.699999988079071 }, { "c": 2, "d": "PE version resource metadata", "i": "metadata/package/versioning::version-resource-metadata", "o": 89902, "z": 14, "cf": 0.8999999761581421 } ], "ln": 89834 }, { "b": "gYPcdf-S*afAq7M000000b}@s3\u0026*nc[hpmD000000000000000000000000000000000", "n": [ { "c": 2, "d": "PE .reloc section presence", "i": "metadata/binary/section/names::reloc-section-presence", "o": 90112, "z": 6, "cf": 0.8999999761581421 } ], "ln": 90096 } ], "depth": 1, "facts": { "imp": [ [ "mscoree", "CorDllMain" ] ], "sec": [ [ ".text", 512, 88064, 5.97, "r-x" ], [ ".rsrc", 88576, 1536, 3.44, "r--" ], [ ".reloc", 90112, 512, 0.1, "r--" ] ], "metrics": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "resource_count": 1.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 97618.0, "reloc_overhang_bytes": 500.0, "reloc_overhang_ratio": 0.98, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "version.identity_entropy": 4.29, "clr.managed_resource_count": 4.0, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0, "clr.managed_resource_max_size": 2699.0, "version.identity_symbol_ratio": 0.06, "clr.managed_resource_max_entropy": 5.22 }, "file": { "size": 90624.0, "entropy": 5.9, "size_bytes": 90624.0 }, "binary": { "is_pie": 1.0, "code_entropy": 5.97, "string_count": 969.0, "overall_entropy": 5.9, "entropy_variance": 5.77, "avg_string_length": 23.16, "max_string_length": 179.0, "peak_region_bytes": 1024.0, "code_to_data_ratio": 1.0, "peak_region_entropy": 6.45, "string_length_stddev": 19.05, "largest_section_ratio": 0.97, "sentence_string_count": 86.0, "sentence_string_ratio": 0.09, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 88064.0, "entropy_max": 5.97, "entropy_mean": 3.17, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } } }, "id": 3, "mol": "O(Al)H₂(CmDb)", "path": "SoftwareExtravaganza.Whizbang.Transports.HotChocolate.Generators.0.814.1-alpha.4.nupkg!!analyzers/dotnet/cs/Whizbang.Transports.HotChocolate.Generators.dll", "risk": 4, "sha": "b1e8e063dced12e51fa4ce27496964e45cd11716755ce084f02fca93e519ce08", "size": 90624, "traits": [ { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "spans": [ [ 89438, 11 ] ] }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "spans": [ [ 0, 26 ] ] }, { "id": "micro-behaviors/communications/http/server/managed::http-request-get", "conf": 1.0, "crit": 3, "desc": "Access to ASP.NET Request object", "spans": [ [ 61719, 11 ] ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "spans": [ [ 88293, 4 ] ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 88670, 15 ] ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "spans": [ [ 30304, 4 ] ] }, { "id": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "conf": 1.0, "crit": 3, "desc": "JSON polymorphism runtime marker", "spans": [ [ 66873, 16 ] ] }, { "id": "micro-behaviors/data/db/linq::linq-queries", "conf": 0.699999988079071, "crit": 3, "desc": "LINQ query operations", "spans": [ [ 67453, 11 ] ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "spans": [ [ 89902, 14 ] ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "spans": [ [ 30304, 4 ] ] } ], "type": "pe" }, { "ctx": [ { "b": "lrc#RpdD{NwfKi8z/fVqx\u003c#jbx(mMCfjv3KjtgUq3jn[mayP82xkP\u003cRv}xL1wPw$U3lQDNvixl7wOa7HxMOunB2\u003e%cxk8E3BZ=$kz/4dKxLz^4vqYZfy?WuiCw7YpvQTd!fjwvjx(v)gfl.tPyI4y3CxkAEx!BWFy:859x(dG9B8\u003e+Nb4#7uAc15[fk20vxMW=pv@DiqCw7YpvQTd!eO]cgfl.8zDsyr2xd)X6BzkVhB1.-QA+/o6z*cmQv}^Mvzep\u003emvpT0", "ln": 304, "col": 18, "line": 8 }, { "b": "vqGT\u003czAPgNwO#Q3AW0Xfvixl7wOa7HxMOunB2\u003e%cCw7YpvQQ)bxcGJqwNP9(Bzbkdw{4{aay]z2B.$YcByxo9z/cXaBrC^vx)Kk%e]Cq:fjv4bfk9d93jnvpeEz?fboQ63C{3g4x)Kk%zF8fv3n0wIdNE@WDtdnfaw=S\u0026w]zZbvqYN^dK(O2FrRfsatLS*B0bgmePt-Gv}x.5az\u003eXhB75Y)ay]hcAa9\u0026#xDRIkBz8!ywPzYivqG:#v{%E[z/fRsz/cXtxK@r1z/^avvrue\u0026eG=I)pgnlUC4z^ZpGeDGA=k!ql$7u-pI%.[dJ)-3LPS[yB-H#6azkn6wPzj3z/P[wCwh8eaz2.cA^m", "ln": 2082, "col": 5, "line": 31 }, { "b": "BzkP6aA?spx\u003ez6?vruj4zxJ\u003efaz\u003eXhB75Y)azth3wnC*$B1wCOz/{eozF7HyvqYP#wP?T5BrCTmxK#3?A%:GwdK)?$C4CGdAaK5jmr\u0026=.A+P95v}vbtaMv{oaw#]-xDP(mmiDU]AbY-oBrC^wBz8!bz!9A4zEEZ5xjk)@z/d9GwnbE+zF%Prx\u003e8h", "ln": 2451, "col": 29, "line": 39 }, { "b": "A%-m7dPf?/wPh:fA=SYWaMv{oax9w\u003cBy/o1B8@EvwPI{3xjSi0vqYQ(wPz\u0026mBzb98aAz46wODs0ay/tbzddr)B0a[ewft\u0026iz!a02wGUMcwO#Qhe*absAaHRxvp\u003c6[CwhejazbC3CXHS6wGV28B8V5nB7DFoD2Ntoe^.}ndNW#(Aa9\u0026#xK#ildJ)-3", "ln": 2652, "col": 16, "line": 42 }, { "b": "BrCgoz/3RdC4CMkaAITBwNPB%e*9-6wncj3wozr%y\u003cvdpvrl9lBAg/1yH}30w]zYjx(mB3wO(0@Byw#dze0T6vruj4zy#n6dK[b6zGxxgdK(O2FrRfzz/6DiB75J]wGU#nwPA5sAb](iwN/*@z/fRsz*2YjaAg[jB8UY2Bzk]fay[]5vix=dBz8=", "ln": 2968, "col": 51, "line": 48 }, { "b": "x(v\u003e@eG=I)mmFy!z/Pzif!+7batj\u0026!dNWY:AaK5tdJ)-3LPSwpvqE5%vrt{2vpJ!UB8@EFx([2hB8Mhwv}vl8wO#71vru6\u003eaz(4cwO=z{eG=I)qG3R)D2s:6z/{8gwGTGOzE)\u0026%Bz(hvdK(O2FrRfzz/6Dcy?khux(dA7Cwh8izF787z/M$vwN/p\u003cBz?", "ln": 4728, "col": 87, "line": 78 }, { "b": "v}vl8wO#71vru6\u003eaA?gfB.8XlvRPE:BAm=@bo[s3wPS3dzF77\u003cByxiiwN(bPu%)wKvrl8?wn=NcwPP56wmM*4vpK7YxjSh:z!s9nvrb{FCYW$mC422(zHb.zs7(q]vQTd!e\u003c\u003cL$wEq*Mu\u003cWltwO00axK@q\u003cqfuO.yAML$vrcDjxlv{0wNcY$BAzFyiXJb", "ln": 5072, "col": 21, "line": 83 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 5682, "entropy": 5.2 }, "text": { "lines": 107, "top_char": 101, "max_ws_run": 26, "digit_ratio": 0.01, "space_count": 602, "char_entropy": 5.2, "unique_chars": 83, "top_char_null": 0, "lines_over_200": 4, "top_char_ratio": 0.07, "avg_line_length": 52.1, "max_line_length": 226, "non_ascii_ratio": 0.03, "empty_line_ratio": 0.27, "last_line_length": 14, "long_token_count": 1, "whitespace_ratio": 0.12, "line_length_stddev": 58.31, "repeated_char_sequences": 9 }, "binary": { "peak_region_bytes": 5682, "peak_region_entropy": 5.28 } } }, "id": 4, "mol": "H(Cm)", "path": "SoftwareExtravaganza.Whizbang.Transports.HotChocolate.Generators.0.814.1-alpha.4.nupkg!!README.md", "pid": 0, "risk": 1, "sha": "39ec231770e710b1351884d0b8923b125b6996d103322ae616f87890cc74896f", "size": 5682, "traits": [ { "id": "metadata/lang/natural::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"", "spans": [ [ 2130, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-2", "conf": 0.8, "crit": 1, "desc": "English function-word token \"and\"", "spans": [ [ 2499, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-3", "conf": 0.8, "crit": 1, "desc": "English function-word token \"that\"", "spans": [ [ 2700, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "spans": [ [ 3016, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-6", "conf": 0.8, "crit": 1, "desc": "English function-word token \"with\"", "spans": [ [ 2264, 0 ] ] }, { "id": "micro-behaviors/communications/http/url/forge::public-code-forge-url", "conf": 0.9, "crit": 3, "desc": "References a public code-forge URL", "spans": [ [ 368, 19 ] ] } ], "type": "markdown" }, { "ctx": [ { "b": "Ibl@q4gj0X0000dnK#lE00031000312M\u003e5b0bFVrq#=[0G\u003eS[wp!s2waAhvtw[=6)001BfEuzio.+.5^pG6YAIB6yXiaMY[)4LX:Wf/v35nD]19zx/o", "n": [ { "c": 1, "d": "File has a .png extension", "i": "metadata/package/files/included::png-extension-basename", "o": 0, "z": 8, "cf": 0.8999999761581421 } ], "ln": 0 } ], "depth": 1, "facts": { "metrics": { "png": { "a_entropy": 0.0, "chunk_count": 16.0, "trailing_bytes": 0.0, "idat_chunk_count": 9.0, "text_chunk_bytes": 0.0, "chunks_after_iend": 0.0, "compression_ratio": 1.03, "unknown_chunk_count": 0.0 }, "file": { "size": 67200.0, "entropy": 6.5, "size_bytes": 67200.0 }, "image": { "width": 256.0, "height": 256.0, "channels": 1.0, "b_entropy": 0.0, "g_entropy": 0.0, "r_entropy": 6.47, "edge_density": 0.17, "pixel_entropy": 6.47, "histogram_flatness": 0.81 }, "binary": { "overall_entropy": 6.5, "peak_region_bytes": 1024.0, "peak_region_entropy": 7.69 } } }, "id": 5, "path": "SoftwareExtravaganza.Whizbang.Transports.HotChocolate.Generators.0.814.1-alpha.4.nupkg!!logo.png", "pid": 0, "sha": "c61516016362b41ef84710a6a4a2b39f70a06d4b0c65f3d2ca9ebfd2de62348d", "size": 67200, "traits": [ { "id": "metadata/package/files/included::png-extension-basename", "conf": 0.8999999761581421, "crit": 1, "desc": "File has a .png extension", "spans": [ [ 0, 8 ] ] }, { "id": "metadata/image/metrics::png-incompressible-pixels", "conf": 0.699999988079071, "crit": 1, "desc": "PNG pixels have low compressibility", "spans": [ [ 0, 28 ] ] } ], "type": "png" }, { "id": 6, "sha": "014be50bead1e534b5c4260670332bbcb06ae1ba2fd5ee8f297a47d7605c8765", "path": "SoftwareExtravaganza.Whizbang.Transports.HotChocolate.Generators.0.814.1-alpha.4.nupkg!![Content_Types].xml", "size": 582, "type": "xml", "depth": 1 }, { "id": 7, "sha": "d8be964532ed1d6310d00ac574df5db38cc829709b9da800de59715eacdeeed9", "path": "SoftwareExtravaganza.Whizbang.Transports.HotChocolate.Generators.0.814.1-alpha.4.nupkg!!package/services/metadata/core-properties/1007653b4b9248baa48e9a23b7af05f5.psmdcp", "size": 943, "type": "xml", "depth": 1 }, { "id": 8, "sha": "5574c077246022d60fafb7e5c47442086d8d0ea4be83b52552945c46b884dd2d", "path": "SoftwareExtravaganza.Whizbang.Transports.HotChocolate.Generators@0.814.1-alpha.4.registry.json", "size": 978, "type": "registry", "depth": 1 } ], "omitted_files": 3, "rev": "20834", "v": "8" } }