{ "ml": { "v": "7", "eng": "2.2.0-beta.2", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.80784976, "rte": "az", "prob": 0.80784976 }, { "cls": 0, "raw": 0.09920555, "rte": "az/nupkg", "prob": 0.09920555 } ], "prob": 0.80784976, "skip": [ { "rte": "az/zip", "why": "unavailable" }, { "rte": "az/zip", "why": "unavailable" } ], "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.8078497648239136, "type": "nupkg" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.00012001395225524902, "type": "xml" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.012559682130813599, "type": "xml" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.008621662855148315, "type": "markdown" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.683881938457489, "type": "pe" }, { "id": 5, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "xml" }, { "id": 6, "lvl": -1, "conf": 0, "prob": 0.00012001395225524902, "type": "xml" }, { "id": 7, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "registry" } ], "version": "v18.18", "analyzed_at": "2026-07-03T22:03:49Z" }, "path": "Sanet.MakaMek.Assets.0.60.7-preview.nupkg", "raw": { "files": [ { "id": 0, "mol": "O(Al)H(Db)", "sha": "c84e24f25a1f38ee81db68e859e83ccea5880a758d4adff1b99fccc9224a46cb", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Sanet.MakaMek.Assets/Sanet.MakaMek.Assets.0.60.7-preview.nupkg", "risk": 3, "size": 39219, "type": "nupkg", "facts": { "metrics": { "file": { "size": 39219.0, "entropy": 7.94, "size_bytes": 39219.0 }, "binary": { "overall_entropy": 7.94, "peak_region_bytes": 36864.0, "peak_region_entropy": 7.81 }, "archive": { "file_count": 7.0, "member_count": 7.0, "script_count": 0.0, "zip_bomb_ratio": 4.52, "directory_count": 0.0, "executable_count": 1.0, "extra_field_size": 0.0, "noise_file_count": 0.0, "total_compressed": 38271.0, "compression.ratio": 0.47, "hidden_file_count": 2.0, "total_uncompressed": 81275.0, "crc_collision_count": 0.0, "entry_comment_count": 0.0, "max_filename_length": 81.0, "rtlo_filename_count": 0.0, "format.regular_count": 7.0, "nested_archive_count": 0.0, "path_traversal_count": 0.0, "symlink_escape_count": 0.0, "security.setgid_count": 0.0, "security.setuid_count": 0.0, "security.sticky_count": 0.0, "double_extension_count": 0.0, "duplicate_member_count": 0.0, "security.symlink_count": 0.0, "unicode_filename_count": 0.0, "homoglyph_filename_count": 0.0, "security.encrypted_count": 0.0, "timing.mtime_unique_count": 3.0, "timing.mtime_unique_ratio": 0.43, "misplaced_executable_count": 1.0, "timing.mtime_outlier_count": 2.0, "timing.mtime_dominant_count": 5.0, "timing.mtime_spread_seconds": 25168.0, "timing.sentinel_mtime_count": 0.0, "security.world_writable_count": 0.0, "timing.mtime_dominant_fraction": 0.71, "compression.method_counts.stored": 1.0, "compression.method_counts.deflate": 6.0 } } }, "ident": { "name": { "value": "Sanet.MakaMek.Assets", "source": "nupkg.title", "verified": false }, "trust": "unsigned", "authors": [ { "name": "Anton Makarevich", "role": "author", "source": "nupkg.authors" } ], "version": { "value": "0.60.7-preview", "source": "nupkg.version", "verified": false }, "identifier": { "value": "Sanet.MakaMek.Assets", "source": "nupkg.id", "verified": false } }, "traits": [ { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "metadata/package/versioning::version-word-lower", "conf": 0.4000000059604645, "crit": 2, "desc": "version word (lowercase)", "from": [ { "file": 4 } ] }, { "id": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "conf": 1.0, "crit": 3, "desc": "JSON polymorphism runtime marker", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/data/db/linq::linq-queries", "conf": 0.699999988079071, "crit": 3, "desc": "LINQ query operations", "from": [ { "file": 4 } ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "from": [ { "file": 4 } ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "from": [ { "file": 4 } ] }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "from": [ { "file": 4 } ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "from": [ { "file": 4 } ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "from": [ { "file": 4 } ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "from": [ { "file": 4 } ] } ] }, { "depth": 1, "facts": { "metrics": { "file": { "size": 510.0, "entropy": 5.18, "size_bytes": 510.0 }, "binary": { "overall_entropy": 5.18, "peak_region_bytes": 510.0, "peak_region_entropy": 5.18 } } }, "id": 1, "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Sanet.MakaMek.Assets/Sanet.MakaMek.Assets.0.60.7-preview.nupkg!!_rels/.rels", "sha": "37d0383fdfa5721bd1fb21b100f6cf027e9dd402107a4915a2a0268984fa9e4d", "size": 510, "type": "xml" }, { "ctx": [ { "b": "[4ls%kx}3YaA?spB7]MgjT8QkfD}SJzEWP}x(mMDb6w0teJs}sj]", "n": [ { "c": 2, "d": "NuGet nuspec manifest file", "i": "metadata/build/manifest::nuspec-file", "o": 0, "z": 27, "cf": 0.9800000190734863 } ], "ln": 1, "addr": 0 }, { "b": "jAa.syHH\u003c!aB4:tzGv@+xMOuniXJdcv}YB\u003cvrj5rx\u003e8g4B8LVje[n*pfk$ufyHH\u003c\u0026zF7QTfFLvpfF$I3B-RIkv\u003eJ1EwfKh", "ln": 2, "addr": 42 }, { "b": "arS^-wPRu\u003evrt{w", "ln": 3, "addr": 118 }, { "b": "arR^HjAt1wwnL)wqBJ(to*{WKwiqI=wNPa^wJ*", "ln": 9, "addr": 366 }, { "b": "arR^Hjy\u00262Av@=p5BzkVhk0:6el3diWze:Otz!paVy*?yax\u003e5nLvruQcwMikJxDQ}@zdK\u00267ze:r5zdNQbvruj4zz04$B8$]mawDoZvp%d*wO#PLfjXTnv@=p5BzkVhj]", "ln": 10, "addr": 397 }, { "b": "arR^HjAt1Lz/YSmz/QaCBA}?pjTaJMBrR\u0026qz/6u9BuH*Uf/.3Hh^{lbgH\u003e2RwhX4dh.[\u003e$f\u003eB@Nw?=1%gI5o%v(b#1w\u0026j0vatk[", "n": [ { "c": 2, "d": "NuGet package declares repository", "i": "metadata/package/files/nuget::nuspec-repository", "o": 503, "z": 30, "cf": 0.8999999761581421 } ], "ln": 11, "addr": 499 }, { "b": "arR^Hjy\u00262xwO#3\u0026zEWx(B3o", "n": [ { "c": 2, "d": "NuGet package declares dependencies", "i": "metadata/package/files/nuget::nuspec-dependencies", "o": 583, "z": 269, "cf": 0.8999999761581421 } ], "ln": 12, "addr": 579 }, { "b": "arR^HarS^VA=l8taAR4jxjVfOA:-/@Cw?IqjTa=PBtkE4fD@W", "ln": 13, "addr": 598 }, { "b": "arR^HarR^Hjy\u00262xwO#3\u0026zEW@mx\u003efvJq^\u003cMPBs{o@yHG}GyC4$)A+cBqC4CYnx(v(La$$ScfFkpoAb]Jkx\u003eqGjaz2!cy\u0026%o1jT9jnx(4rhl2HaED3T4xB0q.Wj]", "ln": 14, "addr": 638 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 992.0, "entropy": 5.09, "size_bytes": 992.0 }, "binary": { "overall_entropy": 5.09, "peak_region_bytes": 992.0, "peak_region_entropy": 5.09 } } }, "id": 2, "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Sanet.MakaMek.Assets/Sanet.MakaMek.Assets.0.60.7-preview.nupkg!!Sanet.MakaMek.Assets.nuspec", "risk": 1, "sha": "b51c423512eacb3403b6161d6619a38335b3253bd79711f6df787672961180b8", "size": 992, "traits": [ { "id": "metadata/package/files/nuget::nuspec-dependencies", "conf": 0.8999999761581421, "crit": 2, "desc": "NuGet package declares dependencies", "spans": [ [ 583, 269 ] ] }, { "id": "metadata/package/files/nuget::nuspec-repository", "conf": 0.8999999761581421, "crit": 2, "desc": "NuGet package declares repository", "spans": [ [ 503, 30 ] ] }, { "id": "metadata/build/manifest::nuspec-file", "conf": 0.9800000190734863, "crit": 2, "desc": "NuGet nuspec manifest file", "spans": [ [ 0, 27 ] ] } ], "type": "xml" }, { "ctx": [ { "b": "w/#hrA=9Ervrl0\u003caAR43y?mZbA3fmhv@#A{B09!TBAztgraPMMefFzAx(4(lCwhejatczTr3i[HayPd#avgfVy\u0026si9vo2(K3jn15awWe(A=#edCm1WKvqxpCwOSA5B0a[eaA8jgzy]{FB-H#6aAR44Bzkk[y-)kazdl{}azkb1wGUO@vruTjx(mMaxk7^(BrC^oy?):5xcqzbAV/jcv}YN]wPGEDra]?=xjkT*azC)tx(n0hx(W=}ayYQsvqZ19xK#ibv@Dj6B-.hnazCXiy?mD{zGGrex(v(iz!paUvruQcwMikJxDQ![y\u00260V[ax}MKxjjICyH5u4BAzFyiXJd6wOkA", "ln": 44, "col": 34, "line": 3 }, { "b": "fdw2MB-X:rz!0{hx(mMaz/cXsx(d*9x\u003e7\u003e0C{3Kkwftq\u003cv}x.5x\u003c$^)x([Ryw]zYjvqG:5Abn%dwPz\u0026AaxJa%vqfN3Bz\u0026pqwO2*6xjkT*Abn%daAImlAbo8dvqYP#Ab]VhA+PSfDsXjcaz(4ax(4ujw[=pbBrC1fwfu8cvL8haA=VsBB-Rbmaz2=", "ln": 326, "col": 192, "line": 7 }, { "b": "aA/B\u003eg+{WshZ]7vbo[ATaw3A?y?mD{zGGD23n0x8lU{EFzGEEewPz%9AV!!fA3eOfv}YN#wN/?8A+eJ8xMOunB2\u003e%cxk8E3BZ=$kz/4dozGG/meP1{ivrb}5x\u003e7*fo\u003c}*Co\u003ew8[Cwg\u0026bfgPC/wI2rbA=l5rv@DfjeL6O*xE#[?C4CFwl2{EGx()]@BAIRndiJ?GBz8^{srI9(zeBAkx\u003e7N[x(v(iw]zYjy\u0026r/(y-)Xkvr\u0026hiawt6@az(mqBzkYgvr(B8aA}J", "ln": 958, "col": 128, "line": 16 }, { "b": "ml$^fCuEi$k%!0]y^?i4qz-n!gHT0TAZ:a$l}fdlfiH5if\u003e+Glgc4Y\u003eh:R.3C5G/JCr6qcghGAuk$1^HA:-VYvrbB[xK#x$n\u003eR%9Bwat/r7P@2A+YVly?\u003e::Cq0]4zBn.rwh(L[ydQ^rm[3P.rAp(3yc+M)h*n[5wLC\u0026%l1hPzrCkuHm[c9bD1P(uC@XO[nL.u:m)*j3Dtb3ow\u003c*DIg*}[jhBZwGDrsr)w(.M0CSdxOn)2?pCXoD3B2m(Hh8Y85wh)R5r+kX\u0026iz-\u003cqfFMpsz-6)#pd]E", "ln": 15295, "col": 423, "line": 106 }, { "b": "wft#cwGV5jy\u0026%\u0026lz/b)?bo[s8x\u003e7Z(B7CW=ra]?=B8Mhwv}u=)z!9A4w]zYjBzbxfaAhvtygQ)%azC)ty?Wx\u003czGxx1aA.NjwPw]nxK@qRpe@AbwO#71vqE5.BZ/f3v\u003c1DVv}xL0wGVdLe?!z1aAIa9aARpdax}JhlQ::Gmo}rnnKC{wq:\u0026bTw[=6)", "ln": 18065, "col": 8, "line": 123 }, { "b": "By!#9B7Gr0A::63y\u003cvdiB0b1iCw.knvpS!Qy?j-0z/fVdzGEGr3q1?LD2E*FxKM6}ayPekay/tcv}xW#B0bHmxjk*\u003ex(mMaBzbkdB-Q#7wGU]6aARpdB7DF5B8$]mB1wCMy?m3@wGV28vpJ%[z/{dABz\u0026pswGUA6iV}\u003cGBz(4Hzddi*A+fAdv}Xbuzddc{e[n*p3jn15avfHMzF%-nwN]B\u003cwO#Qh3jnvcnP5P*x(W=}ayYQsttnWwvngrGt{%xdBz#pZfe4fNxjkT*yC6KCxd\u003eXveG!2avqY\u003e4aARJABzbkdlsB$Ty?lNSv}V#{z/6ulzFsirazbLjaARpdx(Utaz/fVhzGPJ3aAg+g", "ln": 18765, "col": 76, "line": 132 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 19508, "entropy": 4.01 }, "text": { "lines": 148, "top_char": 45, "max_ws_run": 680, "digit_ratio": 0.02, "space_count": 8162, "char_entropy": 4.01, "unique_chars": 97, "top_char_null": 0, "lines_over_200": 16, "lines_over_500": 14, "top_char_ratio": 0.05, "ascii_art_lines": 1, "avg_line_length": 130.81, "max_line_length": 913, "non_ascii_ratio": 0.01, "empty_line_ratio": 0.24, "last_line_length": 132, "long_token_count": 26, "whitespace_ratio": 0.43, "line_length_stddev": 260.07, "repeated_char_sequences": 33, "trailing_whitespace_lines": 3 }, "binary": { "peak_region_bytes": 3072, "peak_region_entropy": 5.35 } } }, "id": 3, "mol": "H(Cm)", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Sanet.MakaMek.Assets/Sanet.MakaMek.Assets.0.60.7-preview.nupkg!!README.md", "pid": 0, "risk": 2, "sha": "f46f9abcba02585964e491219c175792dffbc3d60301548cf0e6661149ac8f5b", "size": 19508, "traits": [ { "id": "metadata/lang/natural::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"", "spans": [ [ 220, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-2", "conf": 0.8, "crit": 1, "desc": "English function-word token \"and\"", "spans": [ [ 105, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-4", "conf": 0.8, "crit": 1, "desc": "English function-word token \"have\"", "spans": [ [ 18813, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "spans": [ [ 374, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-6", "conf": 0.8, "crit": 1, "desc": "English function-word token \"with\"", "spans": [ [ 92, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-7", "conf": 0.8, "crit": 1, "desc": "English function-word token \"this\"", "spans": [ [ 18113, 0 ] ] }, { "id": "micro-behaviors/communications/email/address::google-consumer-email-domain-suffix", "conf": 0.55, "crit": 3, "desc": "Gmail consumer email domain suffix", "spans": [ [ 18911, 10 ] ] }, { "id": "micro-behaviors/communications/http/url/forge::public-code-forge-url", "conf": 0.9, "crit": 3, "desc": "References a public code-forge URL", "spans": [ [ 1022, 19 ] ] } ], "type": "markdown" }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J+", "n": [ { "c": 3, "d": "HTTP fingerprinting evasion campaign", "i": "objectives/command-and-control/infrastructure/user-agent::http-fingerprinting-campaign", "o": 0, "z": 34, "cf": 0.8999999761581421 } ], "ln": 0 }, { "b": "00000000000000000000Y#ZlO00000nb@R\u00260SSx7H?3F=3$Gtr0rr91000000000000", "n": [ { "c": 1, "d": "PE standard code/data section", "i": "metadata/binary/section/names::pe-code-data-standard-section", "o": 512, "z": 5, "cf": 0.8999999761581421 } ], "ln": 496 }, { "b": "huFo?000c7d1qi%3mV2Qlq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn", "n": [ { "c": 3, "d": "Recognized PE anti-analysis marker", "i": "objectives/anti-analysis/debugger-detect/combined-checks::evasion-aware-recognized-pe-marker", "o": 18056, "z": 4, "cf": 1.0 } ], "ln": 18040 }, { "b": "BuTkxuPw9Go(BM+y?k^gq*ACawO\u003c4\u003epxk3sByd(BxjVf(qug(Gy\u0026%q@uJrS9B7^%IBytetwD", "n": [ { "c": 2, "d": "System namespace reference", "i": "metadata/lang/compiler/managed::system-namespace", "o": 31132, "z": 9, "cf": 0.800000011920929 } ], "ln": 31116 }, { "b": "Bs{o@yHG}GyC4[]B7GDme[w^m07QQxqE%]/B-H#6q/)4\u003evqM0Yzfg23BAg@3z2!A\u0026", "n": [ { "c": 3, "d": "References Windows executable or script", "i": "objectives/execution/interpreter/script/shell::windows-executable-ref", "o": 33581, "z": 4, "cf": 0.6000000238418579 } ], "ln": 33565 }, { "b": "08drznP5cUA=2lbx(v\u003e?q*ACawO\u003c50wQ5qHn][]*e(Mt4x\u003c\u003e*(Dsp]fz/bLND2[7sz7XZ$w]83*BzkVh0b2\u003e+uQOQGwN/*@z/bL@wPRoEx(W={BzkVh07ZWC", "n": [ { "c": 3, "d": "JSON polymorphism runtime marker", "i": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "o": 33882, "z": 16, "cf": 1.0 }, { "c": 2, "d": "Benign high-entropy PE context", "i": "metadata/package/quality/false-positives::benign-high-entropy-pe-context", "o": 33913, "z": 17, "cf": 0.949999988079071 } ], "ln": 33866 }, { "b": "B7GD2l$HBHA+PGmx(v\u003e?q*ACawO\u003c50wQ5qHn][]*08)#Wx(mMJz/6D4A+PPkzu9aoxjTULw]vVrCW\u003er7", "n": [ { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 34053, "z": 16, "cf": 0.8500000238418579 } ], "ln": 34037 }, { "b": "o\u003ew8)o\u003c}#vmpZ4xrbVZQq*ACawO\u003c4[x(m[\u003crbUYSA+PA7l2Hj2y?m3}08)#WwNPBNwNPaXASx5", "n": [ { "c": 3, "d": "LINQ query operations", "i": "micro-behaviors/data/db/linq::linq-queries", "o": 34165, "z": 11, "cf": 0.699999988079071 } ], "ln": 34149 }, { "b": "C(QuCBxh*\u003cx\u003c\u003e[3oj-wGq*ACawO\u003c4#wN/\u003e6x([RMlVND\u003eBz\u003e/jvq][907/\u003e5xj\u003e^@mQY!Gz/Qa6y\u0026r}", "n": [ { "c": 2, "d": "System namespace reference", "i": "metadata/lang/compiler/managed::system-namespace", "o": 36023, "z": 15, "cf": 0.800000011920929 } ], "ln": 36007 }, { "b": "0ce6W0at\u003ew0b.=V0aC}x0b?\u003cO0a=cM04d+[073W10b?\u003cO0a=d40aV7T04d:?0cOuN0ce5", "n": [ { "c": 3, "d": "Recognized sparse-logic binary marker", "i": "objectives/anti-analysis/vm-detect/instruction::sparse-logic-recognized-marker", "o": 36843, "z": 7, "cf": 0.800000011920929 } ], "ln": 36827 }, { "b": "00000000000000000000000000000000000000315c8Xg7YTL^00000000000000000", "n": [ { "c": 1, "d": "PE resource section", "i": "metadata/binary/section/names::pe-resource-section", "o": 44032, "z": 5, "cf": 0.8999999761581421 } ], "ln": 44016 }, { "b": "0000000000002s*gYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006Xn[brp!0rtjZ0000", "n": [ { "c": 3, "d": "Recognized marker for timing checks", "i": "objectives/anti-analysis/timing/evasion::timing-anti-debug-recognized-marker", "o": 44126, "z": 15, "cf": 0.949999988079071 } ], "ln": 44110 }, { "b": "wDlPFBn#pv002s=5Dz?ilJz38z2!IPve$fBC(QOtve$cAwDhYg002p+zua+UzVBUPaokaove$6", "n": [ { "c": 2, "d": "PE CompanyName metadata field", "i": "metadata/package/versioning::pe-companyname-field", "o": 44514, "z": 11, "cf": 0.699999988079071 } ], "ln": 44498 }, { "b": "x-ISyxAe2j002)%6-XmmmGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up002{$ve$fBwDl/Le=XP", "n": [ { "c": 2, "d": "PE FileDescription metadata field", "i": "metadata/package/versioning::pe-filedescription-field", "o": 44582, "z": 15, "cf": 0.699999988079071 } ], "ln": 44566 }, { "b": "wDl/LA@Vgu001+O2(\u003c#amGvc5yYF2DrSDXhASydXx-J5Kzu6Up001XMe=W^ffArZ9hVLDgfAq7M002)%82%WqnDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE002{$ve$fBwDl/Le=XPCve$6y", "n": [ { "c": 3, "d": "Dotted-quad PE version metadata marker", "i": "objectives/command-and-control/infrastructure/ip::ipv4-version-metadata-marker", "o": 44666, "z": 11, "cf": 0.9399999976158142 }, { "c": 2, "d": "PE InternalName metadata field", "i": "metadata/package/versioning::pe-internalname-field", "o": 44718, "z": 12, "cf": 0.699999988079071 } ], "ln": 44650 }, { "b": "xAibO001bw003g582%Wqpxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE002{$ve$fBwDl/Le=XPC", "n": [ { "c": 2, "d": "PE OriginalFilename metadata field", "i": "metadata/package/versioning::pe-originalfilename-field", "o": 44842, "z": 16, "cf": 0.699999988079071 } ], "ln": 44826 }, { "b": "wb{ACyYBCn002Q\u003e6-XmmpYLIozVBqFBPt[KBo25ove$cAwDhYg002{$ve$fBwDl/Le=XPCve$6", "n": [ { "c": 2, "d": "PE ProductName metadata field", "i": "metadata/package/versioning::pe-productname-field", "o": 44934, "z": 11, "cf": 0.699999988079071 } ], "ln": 44918 }, { "b": "wDl/LA@Vgu005k-h#\u0026%VpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001XMe=W^ffArZ9hVLAfz#Y", "n": [ { "c": 2, "d": "PE version resource metadata", "i": "metadata/package/versioning::version-resource-metadata", "o": 45010, "z": 14, "cf": 0.8999999761581421 } ], "ln": 44994 }, { "b": "000000000000000000000kFNm3\u0026*nc\u00265H=q000000000000000000000000000000000", "n": [ { "c": 2, "d": "PE .reloc section presence", "i": "metadata/binary/section/names::reloc-section-presence", "o": 45568, "z": 6, "cf": 0.8999999761581421 } ], "ln": 45552 } ], "depth": 1, "facts": { "imp": [ [ "mscoree", "CorDllMain" ] ], "sec": [ [ ".text", 512, 43520, 5.87, "r-x" ], [ ".rsrc", 44032, 1536, 2.72, "r--" ], [ ".reloc", 45568, 512, 0.08, "r--" ] ], "metrics": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "resource_count": 1.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 47254.0, "reloc_overhang_bytes": 500.0, "reloc_overhang_ratio": 0.98, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "version.identity_entropy": 3.72, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0, "version.identity_symbol_ratio": 0.07 }, "file": { "size": 46080.0, "entropy": 5.73, "size_bytes": 46080.0 }, "binary": { "is_pie": 1.0, "code_entropy": 5.87, "string_count": 453.0, "overall_entropy": 5.73, "entropy_variance": 5.61, "avg_string_length": 20.55, "max_string_length": 97.0, "peak_region_bytes": 2048.0, "code_to_data_ratio": 1.0, "peak_region_entropy": 6.03, "string_length_stddev": 17.38, "largest_section_ratio": 0.94, "sentence_string_count": 16.0, "sentence_string_ratio": 0.04, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 43520.0, "entropy_max": 5.87, "entropy_mean": 2.89, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } } }, "id": 4, "mol": "O(Al)H(Db)", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Sanet.MakaMek.Assets/Sanet.MakaMek.Assets.0.60.7-preview.nupkg!!lib/net10.0/Sanet.MakaMek.Assets.dll", "risk": 3, "sha": "598e22ad0a514fe052d4715a43a6d0d11d9fd7076c01cd3e36b743199ea77db4", "size": 46080, "traits": [ { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "spans": [ [ 45010, 14 ] ] }, { "id": "micro-behaviors/data/db/linq::linq-queries", "conf": 0.699999988079071, "crit": 3, "desc": "LINQ query operations", "spans": [ [ 34165, 11 ] ] }, { "id": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "conf": 1.0, "crit": 3, "desc": "JSON polymorphism runtime marker", "spans": [ [ 33882, 16 ] ] }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "spans": [ [ 0, 26 ] ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "spans": [ [ 44666, 11 ] ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "spans": [ [ 18056, 4 ] ] }, { "id": "metadata/package/versioning::version-word-lower", "conf": 0.4000000059604645, "crit": 2, "desc": "version word (lowercase)", "spans": [ [ 36843, 7 ] ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 44126, 15 ] ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "spans": [ [ 33581, 4 ] ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "spans": [ [ 18056, 4 ] ] } ], "type": "pe" }, { "ctx": [ { "b": "ju[7cy-)[jA=U@kzAPf#e?!E(wO#0@wnb{]jTb2\u003cw?t$^krYAprc-B]B0bZAy\u0026jqSb4#7uA5]T9B7n({zddGrz/xo9CX}nez/PY6BAo5", "n": [ { "c": 1, "d": "File uses a document or configuration extension", "i": "metadata/file/extension/identity::doc-or-config-extension", "o": 0, "z": 19, "cf": 1.0 } ], "ln": 0, "col": 1, "line": 1 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 520.0, "entropy": 4.81, "size_bytes": 520.0 }, "binary": { "overall_entropy": 4.81, "peak_region_bytes": 520.0, "peak_region_entropy": 4.81 } } }, "id": 5, "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Sanet.MakaMek.Assets/Sanet.MakaMek.Assets.0.60.7-preview.nupkg!![Content_Types].xml", "pid": 0, "sha": "1a6670ec6cb20a6520f5d6b9be859fcd7416bef2ba0e8e40bfbf0aaab5409e4f", "size": 520, "traits": [ { "id": "metadata/file/extension/identity::doc-or-config-extension", "conf": 1.0, "crit": 1, "desc": "File uses a document or configuration extension", "spans": [ [ 0, 19 ] ] } ], "type": "xml" }, { "id": 6, "sha": "b0718eed2a58fa7b07734b13c6ac3102402e056bfd30e41c383d8d2f5b901dbd", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Sanet.MakaMek.Assets/Sanet.MakaMek.Assets.0.60.7-preview.nupkg!!package/services/metadata/core-properties/2311169ef8734007b18a1ab275bbf016.psmdcp", "size": 684, "type": "xml", "depth": 1 }, { "id": 7, "sha": "b2c2da49cc11cd41a591bad9b6d57a5c23c2c3225435a24a01de05f5157cf625", "path": "Sanet.MakaMek.Assets@0.60.7-preview.registry.json", "size": 825, "type": "registry", "depth": 1 } ], "omitted_files": 2, "rev": "299a3", "v": "8" } }