{ "ml": { "v": "7", "eng": "2.2.1", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.80260867, "rte": "az", "prob": 0.80260867 }, { "cls": 0, "raw": 0.09920555, "rte": "az/nupkg", "prob": 0.09920555 } ], "prob": 0.80260867, "skip": [ { "rte": "az/zip", "why": "unavailable" }, { "rte": "az/zip", "why": "unavailable" } ], "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.8026086688041687, "type": "nupkg" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.00012001395225524902, "type": "xml" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.008743494749069214, "type": "xml" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.008203089237213135, "type": "markdown" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.6386661529541016, "type": "pe" }, { "id": 5, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "xml" }, { "id": 6, "lvl": -1, "conf": 0, "prob": 0.00012001395225524902, "type": "xml" }, { "id": 7, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "registry" } ], "version": "v18.18", "analyzed_at": "2026-07-08T18:22:41Z" }, "path": "Hexalith.Tenants.Testing.3.1.0.nupkg", "raw": { "files": [ { "id": 0, "mol": "O(Al)H(Db)", "sha": "c6e15a925be2911575e9da83e1d2069a9c96d0fc9a7483f2939d5dc4d48bd16c", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Hexalith.Tenants.Testing/Hexalith.Tenants.Testing.3.1.0.nupkg", "risk": 3, "size": 27429, "type": "nupkg", "facts": { "metrics": { "file": { "size": 27429.0, "entropy": 7.88, "size_bytes": 27429.0 }, "binary": { "overall_entropy": 7.88, "peak_region_bytes": 23552.0, "peak_region_entropy": 7.83 }, "archive": { "file_count": 7.0, "member_count": 7.0, "script_count": 0.0, "zip_bomb_ratio": 4.47, "directory_count": 0.0, "executable_count": 1.0, "extra_field_size": 0.0, "noise_file_count": 0.0, "total_compressed": 26465.0, "compression.ratio": 0.56, "hidden_file_count": 2.0, "total_uncompressed": 46928.0, "crc_collision_count": 0.0, "entry_comment_count": 0.0, "max_filename_length": 81.0, "rtlo_filename_count": 0.0, "format.regular_count": 7.0, "nested_archive_count": 0.0, "path_traversal_count": 0.0, "symlink_escape_count": 0.0, "security.setgid_count": 0.0, "security.setuid_count": 0.0, "security.sticky_count": 0.0, "double_extension_count": 0.0, "duplicate_member_count": 0.0, "security.symlink_count": 0.0, "unicode_filename_count": 0.0, "homoglyph_filename_count": 0.0, "security.encrypted_count": 0.0, "timing.mtime_unique_count": 4.0, "timing.mtime_unique_ratio": 0.57, "misplaced_executable_count": 1.0, "timing.mtime_outlier_count": 3.0, "timing.mtime_dominant_count": 4.0, "timing.mtime_spread_seconds": 25164.0, "timing.sentinel_mtime_count": 0.0, "security.world_writable_count": 0.0, "timing.mtime_dominant_fraction": 0.57, "compression.method_counts.stored": 1.0, "compression.method_counts.deflate": 6.0 } } }, "ident": { "name": { "value": "Hexalith.Tenants.Testing", "source": "nupkg.title", "verified": false }, "urls": [ { "url": "https://github.com/Hexalith/Hexalith.Tenants", "kind": "homepage", "source": "nupkg.project_url" }, { "url": "https://github.com/Hexalith/Hexalith.Tenants", "kind": "repository", "source": "nupkg.repository_url" } ], "trust": "unsigned", "authors": [ { "name": "Hexalith Contributors", "role": "author", "source": "nupkg.authors" } ], "version": { "value": "3.1.0", "source": "nupkg.version", "verified": false }, "identifier": { "value": "Hexalith.Tenants.Testing", "source": "nupkg.id", "verified": false } }, "traits": [ { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "from": [ { "file": 4 } ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "conf": 1.0, "crit": 3, "desc": "JSON polymorphism runtime marker", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/data/db/linq::linq-queries", "conf": 0.699999988079071, "crit": 3, "desc": "LINQ query operations", "from": [ { "file": 4 } ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "from": [ { "file": 4 } ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "from": [ { "file": 4 } ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "from": [ { "file": 4 } ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "from": [ { "file": 4 } ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "from": [ { "file": 4 } ] } ] }, { "depth": 1, "facts": { "metrics": { "file": { "size": 514.0, "entropy": 5.15, "size_bytes": 514.0 }, "binary": { "overall_entropy": 5.15, "peak_region_bytes": 514.0, "peak_region_entropy": 5.15 } } }, "id": 1, "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Hexalith.Tenants.Testing/Hexalith.Tenants.Testing.3.1.0.nupkg!!_rels/.rels", "sha": "84a8085195044770a701e26d8db3b13b9c5cad3bb52fd9e106d8524af5ce81cc", "size": 514, "type": "xml" }, { "ctx": [ { "b": "[4ls%kx}3YaA?spB7]MgjT8QkfD}SJzEWP}x(mMDb6w0teJs}sj]", "n": [ { "c": 2, "d": "NuGet nuspec manifest file", "i": "metadata/build/manifest::nuspec-file", "o": 0, "z": 31, "cf": 0.9800000190734863 } ], "ln": 1, "addr": 0 }, { "b": "jAa.syHH\u003c!aB4:tzGv@+xMOuniXJdcv}YB\u003cvrj5rx\u003e8g4B8LVje[n*pfk$ufyHH\u003c\u0026zF7QTfFLvpfF$I3B-RIkv\u003eJ1EwfKh", "ln": 2, "addr": 42 }, { "b": "arS^-wPRu\u003evrt{w", "ln": 3, "addr": 118 }, { "b": "arR^Hjy\u00262Av@=p5BzkVhk23foBzisGwO${]BrCBezEEf?zdNQbaAIamC4\u003eC$azbLjatczTr3kT)x(4(lz/cW*wQ4T1x([2vmrSlWBw)p1A+du^wmY*(A+PGmx(v(M", "ln": 11, "addr": 453 }, { "b": "arR^HjAL1AB3sC-y\u0026\u003cwyBy/t#zEW@mBy/t#zGG}xwmoB$az2.czGG@rB-H#azF785z//(dBuzi#vp%TB", "ln": 12, "addr": 554 }, { "b": "arR^HjAt1Lz/YSmz/QaCBA}?pjTaJMBrR\u0026IA+)(.xMOunB2\u003e%cxk8E3BZ=$kz/4c#wQ4T1x([2wnm^3Oy?X08e(Vz1vqZgda%pxlzeB0ejTaz\u003cv}xdVgbH%GiaMShv(X9Wh8)v2wmn$9hzv71gCy*yi5iy6g=3r#ffP", "n": [ { "c": 2, "d": "NuGet package declares repository", "i": "metadata/package/files/nuget::nuspec-repository", "o": 623, "z": 81, "cf": 0.8999999761581421 } ], "ln": 13, "addr": 619 }, { "b": "arR^Hjy\u00262xwO#3\u0026zEWx(B3o", "n": [ { "c": 2, "d": "NuGet package declares dependencies", "i": "metadata/package/files/nuget::nuspec-dependencies", "o": 754, "z": 864, "cf": 0.8999999761581421 } ], "ln": 14, "addr": 750 }, { "b": "arR^HarS^VA=l8taAR4jxjVfOA:-/@Cw?IqjTa=PBtkE4fD@W", "ln": 15, "addr": 769 }, { "b": "arR^HarR^Hjy\u00262xwO#3\u0026zEW@mx\u003efvJnm^3Oy?X08e(Vz1vqZgde\u003c\u003cL{BAg/1BAnSGC4CYnx(v(La#p\u0026ae?!E(wQ4Z3B.25Db0{A^y?b7.zEEvbDs.bra%nK5", "ln": 16, "addr": 809 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 3676.0, "entropy": 4.97, "size_bytes": 3676.0 }, "binary": { "overall_entropy": 4.97, "peak_region_bytes": 3676.0, "peak_region_entropy": 5.05 } } }, "id": 2, "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Hexalith.Tenants.Testing/Hexalith.Tenants.Testing.3.1.0.nupkg!!Hexalith.Tenants.Testing.nuspec", "risk": 1, "sha": "e242484725bd58dc6b8b2f0af7a835878d191af456818c375e2bd5676e2dc53c", "size": 3676, "traits": [ { "id": "metadata/package/files/nuget::nuspec-dependencies", "conf": 0.8999999761581421, "crit": 2, "desc": "NuGet package declares dependencies", "spans": [ [ 754, 864 ] ] }, { "id": "metadata/build/manifest::nuspec-file", "conf": 0.9800000190734863, "crit": 2, "desc": "NuGet nuspec manifest file", "spans": [ [ 0, 31 ] ] }, { "id": "metadata/package/files/nuget::nuspec-repository", "conf": 0.8999999761581421, "crit": 2, "desc": "NuGet package declares repository", "spans": [ [ 623, 81 ] ] } ], "type": "xml" }, { "ctx": [ { "b": "boPJ*CWUA5Bz9pawO${]BAm=@toNirnNi-TBAzFyiXJd0x([3hvLheez7!B\u003eCWUA5Bz9r#wQ4T1x([2vraP@QzGG}MvpKy[z/fRHCw?Iqw]8yfB1.3qe{RqIfjFv2xjSYpC4Smfc$)ZAAc15[fk20vxMW=pv@Diqnm^3Oy?X08fgYV0vqGU1xF9m}zEEB8B1Z%iBzkVhB1.-QA+/o6z*cmQv}+", "ln": 0, "col": 1, "line": 1 }, { "b": "eQp]zy\u0026sIIB9qgBt{@xrlQ::GmjwMJo)7n]x!sBrzEEB8az\u003eL8vp%d*wO#Pjw]zYjBzbkdnm^3Oy?X08az253B9R?GwO\u003c4xluN0UBrCHtaz2.czGE1xz/{8gx(mMmavFH(qy\u0026@0zE:\u003expdnb8l340VA+c^ABzbxfaAIamC4\u003eC$aAhvtC4\u003eF#B0a)lv@Dj6y?mZ1aARgjvqZffy?WG)v%IN2wGY#.LPTNUz/3RbA+eW3x(v(ivqYP#B-RbmePL=CwGUA5B7]o8zdNQbaARJAv@Dl%", "ln": 366, "col": 58, "line": 5 }, { "b": "zEEB8ay]hcv@DK4A^n!!FrRf#xMw3lxj@z@ay/tbzddr)eO5)oC4CLlk#pb}Bzb98aAhEjy?W%7wPF#8z/5]%zxJIlwO#QhazbLjay]zmzGx]uwNPA#x(n37xl4B5x(v(w3jn15avY{JBAIRnA%-maasX\u003cuwO${]BrBm\u003ew[tE$v@bZ0o\u003c}{FxjU{\u003e", "ln": 612, "col": 223, "line": 7 }, { "b": "vp%d*wO#PtdJ)-3LPSn5wftq#wft]7zeTPeaA.:pA=SvnA=k!qBy/t#zGG}xCwhejaAzypwI4w1B7F(8vpJ!UB8@DLpJ{X/AX5t2z/fVqx\u003c#jbz/NxKqE%oEwPxjxvqYP#A=k=9ayX[}vrMv6AV!}hw]zZ1wO(0@Bp6PxdK)@8z^)c\u003eavfKPx(mTaBAg/ix(v(sdJ)-3LPSqhz/+", "ln": 884, "col": 18, "line": 12 }, { "b": "zddc@u\u003cWk=bo[sgwPI@oqE%\u0026\u003cx(W^4wO#Qh3jo7ny-)Xty?$kmwPq\u003c7B98ECzfo]waAg+gB0bNrwGV28y?m=#zGE1jCXIkvx(mMaBy/JnaAhvtygQ)%B1OOkB-5szwPI@oAb](iwN/?6azC.7x)ai3BZY95C}Hjvx([2hBzbkdv%8*jwO#Pje(1\u0026m", "ln": 7292, "col": 35, "line": 109 }, { "b": "rC(I)aA/K-wQ4=@B-.53y?j-3A=k!qu$9?/fh=v$wNPT\u003efk+uyf!+jlu[I=[u%)wKvrl8?wn=NcwPP5pwPI@oBy/JnB1Z6}CWUA5Bz9pawO${]BAo64z/fVqvpKz2e(Vz6BAo9awQ4T1x([2vraP@QzGG}LlVl\u003c:A:-E1B1QB6B98EQv@(Qfz!ZyDv\u003c1U", "ln": 7629, "col": 308, "line": 113 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 8538, "entropy": 4.87 }, "text": { "lines": 129, "top_char": 101, "max_ws_run": 28, "digit_ratio": 0, "space_count": 1067, "char_entropy": 4.87, "unique_chars": 79, "top_char_null": 0, "lines_over_200": 7, "top_char_ratio": 0.09, "ascii_art_lines": 1, "avg_line_length": 65.19, "max_line_length": 353, "non_ascii_ratio": 0.01, "empty_line_ratio": 0.26, "last_line_length": 95, "long_token_count": 2, "whitespace_ratio": 0.14, "line_length_stddev": 74.84, "repeated_char_sequences": 17 }, "binary": { "peak_region_bytes": 7514, "peak_region_entropy": 4.98 } } }, "id": 3, "mol": "H(Cm)", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Hexalith.Tenants.Testing/Hexalith.Tenants.Testing.3.1.0.nupkg!!README.md", "pid": 0, "risk": 1, "sha": "2d6a7d28808ef615b8bbe603fcfede76b3fae06b0e7d338154baf782df958a71", "size": 8538, "traits": [ { "id": "metadata/lang/natural::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"", "spans": [ [ 418, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-2", "conf": 0.8, "crit": 1, "desc": "English function-word token \"and\"", "spans": [ [ 473, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-3", "conf": 0.8, "crit": 1, "desc": "English function-word token \"that\"", "spans": [ [ 660, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "spans": [ [ 414, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-6", "conf": 0.8, "crit": 1, "desc": "English function-word token \"with\"", "spans": [ [ 932, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-7", "conf": 0.8, "crit": 1, "desc": "English function-word token \"this\"", "spans": [ [ 490, 0 ] ] }, { "id": "micro-behaviors/communications/http/url/forge::public-code-forge-url", "conf": 0.9, "crit": 3, "desc": "References a public code-forge URL", "spans": [ [ 27, 19 ] ] } ], "type": "markdown" }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J+", "n": [ { "c": 3, "d": "HTTP fingerprinting evasion campaign", "i": "objectives/command-and-control/infrastructure/user-agent::http-fingerprinting-campaign", "o": 0, "z": 34, "cf": 0.8999999761581421 } ], "ln": 0 }, { "b": "00000000000000000000V0)Xk00000nb@R\u00260SSx7{+I)IA4I4\u00260rr91000000000000", "n": [ { "c": 1, "d": "PE standard code/data section", "i": "metadata/binary/section/names::pe-code-data-standard-section", "o": 512, "z": 5, "cf": 0.8999999761581421 } ], "ln": 496 }, { "b": "1s+C]c]Rba3mVw+dGxCGlq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn", "n": [ { "c": 3, "d": "Recognized PE anti-analysis marker", "i": "objectives/anti-analysis/debugger-detect/combined-checks::evasion-aware-recognized-pe-marker", "o": 5624, "z": 4, "cf": 1.0 } ], "ln": 5608 }, { "b": "zF8KK0b2\u003e+uSzeUA.f^ww)]H(vQS+ZrDz.(nN}/?wObv[y\u0026\u0026f-z^)c\u003el1B?DzDg:?A.f^wxkzG}vqFkuze0(/B7Gw-wb{K(zE)\u0026*B7Gw-wb{4FBz(h1B7Gw-wb{:[wPyvM0b2\u003e+uSpPOvqZfUwb]bhBw#*?vqZfUwb", "n": [ { "c": 1, "d": "Regex component marker", "i": "objectives/persistence/login/scheduled-task/com::task-action-principal-properties--rx-9", "o": 10220, "z": 14, "cf": 0.8799999952316284 } ], "ln": 10204 }, { "b": "e(Vz1vqZgde(Vz6BzkS9e[w^m090SLz*a=+piyw?0cqZ[uRbuJz2^HWB97#g090SL", "n": [ { "c": 3, "d": "References Windows executable or script", "i": "objectives/execution/interpreter/script/shell::windows-executable-ref", "o": 11698, "z": 4, "cf": 0.6000000238418579 } ], "ln": 11682 }, { "b": "wO${]BwN0@ygQ)%x(v\u003e?q*ACawO\u003c4$wOb:\u0026v@#B6zu9ZCy\u0026%qRz!%l3v@#B6zu8$yxlw65zGFV%BwDHDve", "n": [ { "c": 2, "d": "Benign high-entropy PE context", "i": "metadata/package/quality/false-positives::benign-high-entropy-pe-context", "o": 11893, "z": 17, "cf": 0.949999988079071 } ], "ln": 11877 }, { "b": "x(v\u003e?wmY*(A+PGmx(v\u003e?q*ACawO\u003c50wQ5qHn][]*08)#Wx(mMJz/6D4A+PPkzu9yxzdm6%nP5cU08[e:By/qwoLFx:07g^rvru6WwO${]Bxrf#xIS?\u0026wPv=JzFs9kwL3A6", "n": [ { "c": 3, "d": "LINQ query operations", "i": "micro-behaviors/data/db/linq::linq-queries", "o": 12078, "z": 11, "cf": 0.699999988079071 }, { "c": 3, "d": "JSON polymorphism runtime marker", "i": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "o": 12033, "z": 16, "cf": 1.0 } ], "ln": 12017 }, { "b": "+Zg36+}m:G7?S?+0b?\u003cD0at\u003ez04!gV0aV7D0bhBJ03U?Kv/QPJzVB!TiSJ^)yYFwNvG", "n": [ { "c": 2, "d": "admin keyword", "i": "objectives/discovery/account/keywords::admin-keyword", "o": 16055, "z": 5, "cf": 0.20000000298023224 } ], "ln": 16039 }, { "b": "00000000000000000000000000000000000000315c8Xg7YTL^00000000000000000", "n": [ { "c": 1, "d": "PE resource section", "i": "metadata/binary/section/names::pe-resource-section", "o": 17920, "z": 5, "cf": 0.8999999761581421 } ], "ln": 17904 }, { "b": "0000000000001$YgYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006Xn[brp!0rrc20@@r", "n": [ { "c": 3, "d": "Recognized marker for timing checks", "i": "objectives/anti-analysis/timing/evasion::timing-anti-debug-recognized-marker", "o": 18014, "z": 15, "cf": 0.949999988079071 } ], "ln": 17998 }, { "b": "Bo3jVASxUJ001+O2(\u003c#alJz38z2!IPve$fBC(QOtve$cAwDhYg002K\u0026wDl@Pve$9zx-JkPxAe2j003g582%WqmGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up002K\u0026wDl@Pve$9zx-Jk", "n": [ { "c": 2, "d": "PE CompanyName metadata field", "i": "metadata/package/versioning::pe-companyname-field", "o": 18398, "z": 11, "cf": 0.699999988079071 }, { "c": 2, "d": "PE FileDescription metadata field", "i": "metadata/package/versioning::pe-filedescription-field", "o": 18450, "z": 15, "cf": 0.699999988079071 } ], "ln": 18382 }, { "b": "x-J2Jx8?]i001XM2MK(9mGvc5yYF2DrSDXhASydXx-J5Kzu6Up001!Pe=WQae=WN9e=WN9003g59rl9unDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE002K\u0026wDl@Pve$9zx-JkPxAfT+", "n": [ { "c": 3, "d": "Dotted-quad PE version metadata marker", "i": "objectives/command-and-control/infrastructure/ip::ipv4-version-metadata-marker", "o": 18542, "z": 11, "cf": 0.9399999976158142 }, { "c": 2, "d": "PE InternalName metadata field", "i": "metadata/package/versioning::pe-internalname-field", "o": 18590, "z": 12, "cf": 0.699999988079071 } ], "ln": 18526 }, { "b": "xAibO001bw003Ed9rl9upxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE002K\u0026wDl@Pve$9zx-JkP", "n": [ { "c": 2, "d": "PE OriginalFilename metadata field", "i": "metadata/package/versioning::pe-originalfilename-field", "o": 18722, "z": 16, "cf": 0.699999988079071 } ], "ln": 18706 }, { "b": "wb{ACyYBCn002)%82%WqpYLIozVBqFBPt[KBo25ove$cAwDhYg002K\u0026wDl@Pve$9zx-JkPxAfT", "n": [ { "c": 2, "d": "PE ProductName metadata field", "i": "metadata/package/versioning::pe-productname-field", "o": 18822, "z": 11, "cf": 0.699999988079071 } ], "ln": 18806 }, { "b": "x-J2Jx8?]i004PJf8#1MpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001!Pe=WQae=WN9d/:8WfAtO.wDliuvGnd-gYPGnhukYpwb{iwv/Q0siriQ\u003ch#\u003e/oh#\u003eYlvGo{sve%^qh2]JmfAs3iv/Op+fAs9k", "n": [ { "c": 2, "d": "PE ProductVersion has SemVer git hash", "i": "metadata/package/versioning::pe-productversion-semver-git-hash", "o": 18936, "z": 46, "cf": 0.8999999761581421 }, { "c": 2, "d": "PE version resource metadata", "i": "metadata/package/versioning::version-resource-metadata", "o": 18906, "z": 14, "cf": 0.8999999761581421 } ], "ln": 18890 }, { "b": "000000000000000000000ak^b3\u0026*nc!g}17000000000000000000000000000000000", "n": [ { "c": 2, "d": "PE .reloc section presence", "i": "metadata/binary/section/names::reloc-section-presence", "o": 19456, "z": 6, "cf": 0.8999999761581421 } ], "ln": 19440 } ], "depth": 1, "facts": { "imp": [ [ "mscoree", "CorDllMain" ] ], "sec": [ [ ".text", 512, 17408, 5.7, "r-x" ], [ ".rsrc", 17920, 1536, 2.67, "r--" ], [ ".reloc", 19456, 512, 0.08, "r--" ] ], "metrics": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "resource_count": 1.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 72680.0, "reloc_overhang_bytes": 500.0, "reloc_overhang_ratio": 0.98, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "version.identity_entropy": 3.61, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0, "version.identity_symbol_ratio": 0.07 }, "file": { "size": 19968.0, "entropy": 5.37, "size_bytes": 19968.0 }, "binary": { "is_pie": 1.0, "code_entropy": 5.7, "string_count": 286.0, "overall_entropy": 5.37, "entropy_variance": 5.26, "avg_string_length": 17.34, "max_string_length": 129.0, "peak_region_bytes": 3072.0, "code_to_data_ratio": 1.0, "peak_region_entropy": 5.55, "string_length_stddev": 12.45, "largest_section_ratio": 0.87, "sentence_string_count": 7.0, "sentence_string_ratio": 0.02, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 17408.0, "entropy_max": 5.7, "entropy_mean": 2.82, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } } }, "id": 4, "mol": "O(Al)H(Db)", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Hexalith.Tenants.Testing/Hexalith.Tenants.Testing.3.1.0.nupkg!!lib/net10.0/Hexalith.Tenants.Testing.dll", "risk": 3, "sha": "de554ea0e5f55716bea005eda5862a23d5f3a7131b125956b6cf95dcd2f24686", "size": 19968, "traits": [ { "id": "micro-behaviors/data/db/linq::linq-queries", "conf": 0.699999988079071, "crit": 3, "desc": "LINQ query operations", "spans": [ [ 12078, 11 ] ] }, { "id": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "conf": 1.0, "crit": 3, "desc": "JSON polymorphism runtime marker", "spans": [ [ 12033, 16 ] ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "spans": [ [ 18542, 11 ] ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "spans": [ [ 11698, 4 ] ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "spans": [ [ 18906, 14 ] ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "spans": [ [ 5624, 4 ] ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "spans": [ [ 0, 26 ] ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 18014, 15 ] ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "spans": [ [ 5624, 4 ] ] } ], "type": "pe" }, { "ctx": [ { "b": "ju[7cy-)[jA=U@kzAPf#e?!E(wO#0@wnb{]jTb2\u003cw?t$^krYAprc-B]B0bZAy\u0026jqSb4#7uA5]T9B7n({zddGrz/xo9CX}nez/PY6BAo5", "n": [ { "c": 1, "d": "File uses a document or configuration extension", "i": "metadata/file/extension/identity::doc-or-config-extension", "o": 0, "z": 19, "cf": 1.0 } ], "ln": 0, "col": 1, "line": 1 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 520.0, "entropy": 4.81, "size_bytes": 520.0 }, "binary": { "overall_entropy": 4.81, "peak_region_bytes": 520.0, "peak_region_entropy": 4.81 } } }, "id": 5, "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Hexalith.Tenants.Testing/Hexalith.Tenants.Testing.3.1.0.nupkg!![Content_Types].xml", "pid": 0, "sha": "1a6670ec6cb20a6520f5d6b9be859fcd7416bef2ba0e8e40bfbf0aaab5409e4f", "size": 520, "traits": [ { "id": "metadata/file/extension/identity::doc-or-config-extension", "conf": 1.0, "crit": 1, "desc": "File uses a document or configuration extension", "spans": [ [ 0, 19 ] ] } ], "type": "xml" }, { "id": 6, "sha": "7fbd960b8ac09ac3095307f421b99cb93534b9f95ee2c42b26b956a202821564", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Hexalith.Tenants.Testing/Hexalith.Tenants.Testing.3.1.0.nupkg!!package/services/metadata/core-properties/efa252a9f10a4fdeb2c56a2c3fd59271.psmdcp", "size": 730, "type": "xml", "depth": 1 }, { "id": 7, "sha": "58501e189a416c9d2b7390821e018402bc070e80c8afea357ad48bb0ebd293cd", "path": "Hexalith.Tenants.Testing@3.1.0.registry.json", "size": 853, "type": "registry", "depth": 1 } ], "omitted_files": 2, "rev": "dac26", "v": "8" } }