{ "ml": { "v": "7", "eng": "2.2.0-beta.2", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.5896908, "rte": "az", "prob": 0.5896908 }, { "cls": 0, "raw": 0.07788077, "rte": "az/nupkg", "prob": 0.07788077 } ], "prob": 0.5896908, "skip": [ { "rte": "az/zip", "why": "unavailable" }, { "rte": "az/zip", "why": "unavailable" } ], "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.5896908044815063, "type": "nupkg" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.00012001395225524902, "type": "xml" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.010274052619934082, "type": "xml" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.4802100658416748, "type": "pe" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "xml" }, { "id": 5, "lvl": -1, "conf": 0, "prob": 0.011974960565567017, "type": "markdown" }, { "id": 6, "lvl": -1, "conf": 0, "prob": 0.0000756382942199707, "type": "png" }, { "id": 7, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "xml" }, { "id": 8, "lvl": -1, "conf": 0, "prob": 0.00012001395225524902, "type": "xml" }, { "id": 9, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "registry" } ], "version": "v18.18", "analyzed_at": "2026-06-29T20:33:06Z" }, "path": "SoftwareExtravaganza.Whizbang.Transports.RabbitMQ.0.783.1-alpha.11.nupkg", "raw": { "files": [ { "id": 0, "mol": "O(Al)H₂(CmDb)", "sha": "cfe773d9ea84ece91a709c0862e48633a8c5c8260c145896e1d718f48fa999f7", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/SoftwareExtravaganza.Whizbang.Transports.RabbitMQ/SoftwareExtravaganza.Whizbang.Transports.RabbitMQ.0.783.1-alpha.11.nupkg", "risk": 3, "size": 71710, "type": "nupkg", "facts": { "metrics": { "file": { "size": 71710.0, "entropy": 7.97, "size_bytes": 71710.0 }, "binary": { "overall_entropy": 7.97, "peak_region_bytes": 67584.0, "peak_region_entropy": 7.83 }, "archive": { "file_count": 9.0, "member_count": 9.0, "script_count": 0.0, "zip_bomb_ratio": 7.73, "directory_count": 0.0, "executable_count": 1.0, "extra_field_size": 0.0, "noise_file_count": 0.0, "total_compressed": 70432.0, "compression.ratio": 0.31, "hidden_file_count": 2.0, "total_uncompressed": 227519.0, "crc_collision_count": 0.0, "entry_comment_count": 0.0, "max_filename_length": 81.0, "rtlo_filename_count": 0.0, "format.regular_count": 9.0, "nested_archive_count": 0.0, "path_traversal_count": 0.0, "symlink_escape_count": 0.0, "security.setgid_count": 0.0, "security.setuid_count": 0.0, "security.sticky_count": 0.0, "double_extension_count": 0.0, "duplicate_member_count": 0.0, "security.symlink_count": 0.0, "unicode_filename_count": 0.0, "homoglyph_filename_count": 0.0, "security.encrypted_count": 0.0, "timing.mtime_unique_count": 4.0, "timing.mtime_unique_ratio": 0.44, "misplaced_executable_count": 1.0, "timing.mtime_dominant_count": 4.0, "timing.mtime_spread_seconds": 25110.0, "timing.sentinel_mtime_count": 0.0, "security.world_writable_count": 0.0, "timing.mtime_dominant_fraction": 0.44, "compression.method_counts.stored": 1.0, "compression.method_counts.deflate": 8.0 } } }, "ident": { "name": { "value": "SoftwareExtravaganza.Whizbang.Transports.RabbitMQ", "source": "nupkg.title", "verified": false }, "urls": [ { "url": "https://whizba.ng/", "kind": "homepage", "source": "nupkg.project_url" }, { "url": "https://github.com/whizbang-lib/whizbang", "kind": "repository", "source": "nupkg.repository_url" } ], "trust": "unsigned", "authors": [ { "name": "Phil Carbone", "role": "author", "source": "nupkg.authors" } ], "version": { "value": "0.783.1-alpha.11", "source": "nupkg.version", "verified": false }, "identifier": { "value": "SoftwareExtravaganza.Whizbang.Transports.RabbitMQ", "source": "nupkg.id", "verified": false } }, "traits": [ { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "from": [ { "file": 3 } ] }, { "id": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "conf": 1.0, "crit": 3, "desc": "JSON polymorphism runtime marker", "from": [ { "file": 3 } ] }, { "id": "objectives/command-and-control/dropper/staging/encrypted::dotnet-stringbuilder-append", "atk": "T1027", "mbc": "C0025", "conf": 0.8199999928474426, "crit": 1, "desc": ".NET StringBuilder Append use", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/data/db/linq::linq-queries", "conf": 0.699999988079071, "crit": 3, "desc": "LINQ query operations", "from": [ { "file": 3 } ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "from": [ { "file": 3 } ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "from": [ { "file": 3 } ] }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "from": [ { "file": 3 } ] }, { "id": "metadata/package/versioning::semver-pattern", "conf": 0.699999988079071, "crit": 2, "desc": "Semantic version pattern", "from": [ { "file": 3 } ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "objectives/command-and-control/dropper/staging/encrypted::dotnet-hexstring-conversion", "atk": "T1027", "mbc": "C0025", "conf": 0.8600000143051147, "crit": 1, "desc": ".NET hex string conversion", "from": [ { "file": 3 } ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "from": [ { "file": 3 } ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/communications/http/websocket::websocket-send-async", "atk": "T1071.001", "mbc": "C0002", "conf": 0.8199999928474426, "crit": 3, "desc": "WebSocket async send method", "from": [ { "file": 3 } ] } ] }, { "depth": 1, "facts": { "metrics": { "file": { "size": 539.0, "entropy": 5.2, "size_bytes": 539.0 }, "binary": { "overall_entropy": 5.2, "peak_region_bytes": 539.0, "peak_region_entropy": 5.2 } } }, "id": 1, "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/SoftwareExtravaganza.Whizbang.Transports.RabbitMQ/SoftwareExtravaganza.Whizbang.Transports.RabbitMQ.0.783.1-alpha.11.nupkg!!_rels/.rels", "sha": "abe077c9564829b331fb790600814d5778988956fe999704cf7d8f7fd81c1524", "size": 539, "type": "xml" }, { "ctx": [ { "b": "[4ls%kx}3YaA?spB7]MgjT8QkfD}SJzEWP}x(mMDb6w0teJs}sj]", "n": [ { "c": 2, "d": "NuGet nuspec manifest file", "i": "metadata/build/manifest::nuspec-file", "o": 0, "z": 56, "cf": 0.9800000190734863 } ], "ln": 1, "addr": 0 }, { "b": "jAa.syHH\u003c!aB4:tzGv@+xMOuniXJdcv}YB\u003cvrj5rx\u003e8g4B8LVje[n*pfk$ufyHH\u003c\u0026zF7QTfFLvpfF$I3B-RIkv\u003eJ1EwfKh", "ln": 2, "addr": 42 }, { "b": "arS^-wPRu\u003evrt{w", "ln": 3, "addr": 118 }, { "b": "arR^Hjy-qGD2^RixMMB9z/x#xx\u003eIa3aI$92gb7EvaA}HkDsyr2xdW}lvMVqNz/x#xx\u003eIa3j]", "ln": 13, "addr": 614 }, { "b": "arR^HjAL1AB3seUwO#Pwwo8ycwO@S2ADlaywP?T5Bs?MLB-H#azF782z/^ajz//(dBrC)vA=iKIwOb:\u0026v@#B6zxJ!cB8$=5x(mMawnca7vru0)wPw]jz/Z2kA+friy-)q3v@Dy0ay[]1AaK5jvs06pwI4$mA=#ebwNY!6jtg!+xlcl", "ln": 14, "addr": 672 }, { "b": "arR^HjAt1Lz/YSmz/QaCBA}?pjTaJMBrR\u0026IA+)(.xMOunB2\u003e%cxk8E3BZ=$kz/4dKxLz^4vqYZfy?WuiCw7YpvQTd!a%punvqYN*jTa]Tw]/RswNPa\u003cfjXTqwO=p7a%pxlzeB0ejTaC}ixe/Ow[rYcg=eV4ggSa0iwJNah^{hPv}dAegb\u0026Y6fFUQAfF:)}ffP", "n": [ { "c": 2, "d": "NuGet package declares repository", "i": "metadata/package/files/nuget::nuspec-repository", "o": 816, "z": 105, "cf": 0.8999999761581421 } ], "ln": 15, "addr": 812 }, { "b": "arR^Hjy\u00262xwO#3\u0026zEWx(B3o", "n": [ { "c": 2, "d": "NuGet package declares dependencies", "i": "metadata/package/files/nuget::nuspec-dependencies", "o": 971, "z": 545, "cf": 0.8999999761581421 } ], "ln": 16, "addr": 967 }, { "b": "arR^HarS^VA=l8taAR4jxjVfOA:-/@Cw?IqjTa=PBtkE4fD@W", "ln": 17, "addr": 986 }, { "b": "arR^HarR^Hjy\u00262xwO#3\u0026zEW@mx\u003efvJq/un\u0026CvtJ6mr\u0026]{vrM6(vqZy1e(#.2Dsyr2xd=L\u0026A+cBqC4CYnx(v(La$$Sdi5rfweN-EmxKJIFf^m-KCW\u003eMjwmW[FluN0UwgQ2:vqHjnwPz\u0026oatk[", "ln": 18, "addr": 1026 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 1642.0, "entropy": 5.13, "size_bytes": 1642.0 }, "binary": { "overall_entropy": 5.13, "peak_region_bytes": 1642.0, "peak_region_entropy": 5.12 } } }, "id": 2, "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/SoftwareExtravaganza.Whizbang.Transports.RabbitMQ/SoftwareExtravaganza.Whizbang.Transports.RabbitMQ.0.783.1-alpha.11.nupkg!!SoftwareExtravaganza.Whizbang.Transports.RabbitMQ.nuspec", "risk": 1, "sha": "b869526961b94485fd7cbddf32d74cd045e55a6b8d8f21208d0abcac38bf16d9", "size": 1642, "traits": [ { "id": "metadata/package/files/nuget::nuspec-dependencies", "conf": 0.8999999761581421, "crit": 2, "desc": "NuGet package declares dependencies", "spans": [ [ 971, 545 ] ] }, { "id": "metadata/package/files/nuget::nuspec-repository", "conf": 0.8999999761581421, "crit": 2, "desc": "NuGet package declares repository", "spans": [ [ 816, 105 ] ] }, { "id": "metadata/build/manifest::nuspec-file", "conf": 0.9800000190734863, "crit": 2, "desc": "NuGet nuspec manifest file", "spans": [ [ 0, 56 ] ] } ], "type": "xml" }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J\u0026m(0ji6Sa?dLD+]{51x(+zoA=kPhvqNb%vqY$3BrC47aAzQxazCZol@c-7zeP", "n": [ { "c": 3, "d": "HTTP fingerprinting evasion campaign", "i": "objectives/command-and-control/infrastructure/user-agent::http-fingerprinting-campaign", "o": 0, "z": 34, "cf": 0.8999999761581421 }, { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 78, "z": 4, "cf": 0.800000011920929 } ], "ln": 0 }, { "b": "00000000000000000000JcLB700000nb@R\u00260SSx79gcZap#zrN0rr91000000000000", "n": [ { "c": 1, "d": "PE standard code/data section", "i": "metadata/binary/section/names::pe-code-data-standard-section", "o": 512, "z": 5, "cf": 0.8999999761581421 } ], "ln": 496 }, { "b": "c\u003eDvUd\u003e2Yz017b?000uQlq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn", "n": [ { "c": 3, "d": "Recognized PE anti-analysis marker", "i": "objectives/anti-analysis/debugger-detect/combined-checks::evasion-aware-recognized-pe-marker", "o": 31260, "z": 4, "cf": 1.0 } ], "ln": 31244 }, { "b": "Acb/jzB5t?zEU\u003etuTCF!jyrqDA+el\u0026lVl\u003cWwN/*@z/eG}vru6Pz/fohz/PMfxfG^iuOzExA=l8xx(mMRwQcD%uTCJx06AU-B8V5swKgx.zES", "n": [ { "c": 1, "d": "Regex component marker", "i": "objectives/persistence/login/scheduled-task/com::task-scheduler-builder-methods--rx-1", "o": 48934, "z": 38, "cf": 0.8999999761581421 } ], "ln": 48918 }, { "b": "Acb/jzB5t?zEU\u003etuTCI/jyrqDA+el\u0026lVl\u003cWwN/*@z/eG}vru6Pz/fohz/PMfxfG^iuOIKyl1BI7vpAXWBwkRiA:-\u003cbAbP=sk4m(af-Ts1BZC", "n": [ { "c": 1, "d": "Regex component marker", "i": "objectives/persistence/login/scheduled-task/com::task-scheduler-builder-methods--rx-1", "o": 49147, "z": 38, "cf": 0.8999999761581421 } ], "ln": 49131 }, { "b": "A=L-eBvoXRvr\u003e3]uTCL*jyrqDA+el\u0026lVl\u003cWwN/*@z/eG}vru6Pz/fohz/PMfxfG^iuORQzl1BI7vpAXWBwkRiA:-\u003cbAbP=sk4m(ag5%B2BZC", "n": [ { "c": 1, "d": "Regex component marker", "i": "objectives/persistence/login/scheduled-task/com::task-scheduler-builder-methods--rx-1", "o": 49828, "z": 38, "cf": 0.8999999761581421 } ], "ln": 49812 }, { "b": "A=l8xx(mMRwQcD%uTCO?jyrqDA+el\u0026lVl\u003cWwN/*@z/eG}vru6Pz/fohz/PMfxfG^iuO.WAp\u0026ZF$x(!0bzCLE]wN[hEzddc@B3T\u003e)zEU\u003evuTA", "n": [ { "c": 1, "d": "Regex component marker", "i": "objectives/persistence/login/scheduled-task/com::task-scheduler-builder-methods--rx-1", "o": 50317, "z": 38, "cf": 0.8999999761581421 } ], "ln": 50301 }, { "b": "y?mcAxKL^@wO:K/uTCR\u0026jyrqDA+el\u0026lVl\u003cWwN/*@z/eG}vru6Pz/fohz/PMfxfG^iuO?:Bl1BI7vpAXWBwkRiA:-\u003cbAbP=sk4m(agYPT4BZC", "n": [ { "c": 1, "d": "Regex component marker", "i": "objectives/persistence/login/scheduled-task/com::task-scheduler-builder-methods--rx-1", "o": 50510, "z": 38, "cf": 0.8999999761581421 } ], "ln": 50494 }, { "b": "z/e@t06AC7uTF1$vq[46jyr2AlVl\u003cWwN/*@z/eD:v@DK4A^pPav}f7YwmYpqB9RUkk4F2cf/n}[uVpc%y?W%7lVm0Rl34r?v)jBguOTFsjyq#mv}#", "n": [ { "c": 1, "d": "Regex component marker", "i": "objectives/persistence/login/scheduled-task/com::task-scheduler-builder-methods--rx-1", "o": 50610, "z": 42, "cf": 0.8999999761581421 } ], "ln": 50594 }, { "b": "jw]:dBu%$[zEU\u003evuTC+)jvsd2vru6Fz/fD7v@#B6zDyK]xI@z-A^o@(D2vaQwm5X606AC7uTF1$vq[gajyq=gzE^M{o\u003ewx!vp%dvvqfL2", "n": [ { "c": 1, "d": "Regex component marker", "i": "objectives/persistence/login/scheduled-task/com::task-scheduler-builder-methods--rx-1", "o": 51255, "z": 36, "cf": 0.8999999761581421 } ], "ln": 51239 }, { "b": "l34r?v)jBguO%?zju++9jvsd2vru6Fz/fD7v@#B6zDyK]xI@z-A^o@(D2vaQwm5X706A$]wozZ1j]!8u098=!pes}^uRJ%/q:A]xuR9S=", "n": [ { "c": 1, "d": "Regex component marker", "i": "objectives/persistence/login/scheduled-task/com::task-scheduler-builder-methods--rx-1", "o": 51341, "z": 36, "cf": 0.8999999761581421 } ], "ln": 51325 }, { "b": "k$1dt0ab.swPRoEvrt]Tq*ACawO\u003c50wQ5qHn][]*e(Mt4x\u003c\u003e*(Dsp]fz/dg4wPRu\u003evrt]TxjVf(o\u003ewAP", "n": [ { "c": 3, "d": "JSON polymorphism runtime marker", "i": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "o": 51523, "z": 16, "cf": 1.0 } ], "ln": 51507 }, { "b": "xjT$Lv}xv$wN[8FD2v9(q!o\u0026Sl34r?v/PwGwP.MJx(mDEB9RUk08[2HB7ol8vR4\u0026DD2v9(uJ", "n": [ { "c": 3, "d": "WebSocket async send method", "i": "micro-behaviors/communications/http/websocket::websocket-send-async", "o": 51884, "z": 9, "cf": 0.8199999928474426 } ], "ln": 51868 }, { "b": "x(mL-m}D^vBAh8kx8\u003e[Hnm^3ABAh8kx8(1Dx)Kk%zF7N?z/PzwqG3Y1x(mL-oMaMwwPR%rx-", "n": [ { "c": 1, "d": ".NET hex string conversion", "i": "objectives/command-and-control/dropper/staging/encrypted::dotnet-hexstring-conversion", "o": 56128, "z": 9, "cf": 0.8600000143051147 } ], "ln": 56112 }, { "b": "zGx=nA==vPqEK3zx()6De[w^m090SLz*a=+piyw?08^lmvRG{Uqa229zF\u003c34p\u0026yn*", "n": [ { "c": 3, "d": "References Windows executable or script", "i": "objectives/execution/interpreter/script/shell::windows-executable-ref", "o": 56790, "z": 4, "cf": 0.6000000238418579 } ], "ln": 56774 }, { "b": "zE^r@v%HT-ygQ)%x(v\u003e?q*ACawO\u003c4$wOb:\u0026v@#B6zu9mbwPz%dv}w2Cy\u00260V)BzkVh07/K@zF\u003c2}BzkVh00", "n": [ { "c": 2, "d": "Benign high-entropy PE context", "i": "metadata/package/quality/false-positives::benign-high-entropy-pe-context", "o": 57298, "z": 17, "cf": 0.949999988079071 } ], "ln": 57282 }, { "b": "z/bL@BZ/A4A+PGmx(v\u003e?q*ACawO\u003c50wQ5qHn][]*0cqZ[uS7DzB8L{@xjVf(lU{WZwM08FB8L{@v@c78", "n": [ { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 57698, "z": 16, "cf": 0.8500000238418579 } ], "ln": 57682 }, { "b": "zVAHyzdm6%nP5cU0cr8Vq*ACawO\u003c4[x(m[\u003crbUYSA+PA7l2Hj2y?m3}0af?*C#wiZwk^O\u003cx(mL", "n": [ { "c": 3, "d": "LINQ query operations", "i": "micro-behaviors/data/db/linq::linq-queries", "o": 57878, "z": 11, "cf": 0.699999988079071 } ], "ln": 57862 }, { "b": "B8aGYBzbP6luN0UwmY=Yq/)4]zF8pUx(4r\u003eASwW4wNPy%xHuDAv@3cLB.LV5wPv=kk6gdsvS=y3wb", "n": [ { "c": 1, "d": ".NET StringBuilder Append use", "i": "objectives/command-and-control/dropper/staging/encrypted::dotnet-stringbuilder-append", "o": 58026, "z": 13, "cf": 0.8199999928474426 } ], "ln": 58010 }, { "b": "nmuyDy?mR!xKL^?y?mR!q*ACawO\u003c4!z!9AEz/49]z/6Dcy?mR!nKmAyzEV1wB7]bKz/fSszdN./l34r?v)$MLzGGN", "n": [ { "c": 3, "d": ".NET dynamic code generation capability", "i": "metadata/lang/compiler/managed::dotnet-dynamic-code", "o": 58237, "z": 23, "cf": 0.8500000238418579 } ], "ln": 58221 }, { "b": "v}xR3x(v(/wPz%dv}xYYq*ACawO\u003c4$B-8qnzdLs\u003ezGGDgz/wS^A=#ebwPE\u0026ID2[7sz7X.ezGGPfwIct*ze:i9wPyZXA=#ebwPE", "n": [ { "c": 3, "d": "Packed binary marker", "i": "objectives/anti-static/obfuscation/eval/loader::packed-binary-marker", "o": 58920, "z": 30, "cf": 0.8500000238418579 } ], "ln": 58904 }, { "b": "Bo22nq2?Zsv/Qfxve$fBzuakFyYCNTA@Y\u003eNBPuH-wb{JFCk#HXaol0NzVB!Taolx", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 63874, "z": 3, "cf": 0.800000011920929 } ], "ln": 63858 }, { "b": "0cnb.0b.^P0cwh-0cnc.0b}{S0b?\u003cT0cwiL0aV6L0aC}N03znt0at\u003ep0aC}x0cwin08S", "n": [ { "c": 3, "d": "Recognized sparse-logic binary marker", "i": "objectives/anti-analysis/vm-detect/instruction::sparse-logic-recognized-marker", "o": 66450, "z": 6, "cf": 0.800000011920929 } ], "ln": 66434 }, { "b": "0ds?\u00260aC}D0aV7P03znQ0cnb.0b.^P0cwh-0cOuJ0bITH0aV6L07)k\u002608AO\u002603zm\u0026", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 66977, "z": 4, "cf": 0.800000011920929 } ], "ln": 66961 }, { "b": "0a=du0b?\u003cX0a=dJ0a=dv03zmQarQV80a=dK0a=dL0cwiP0b.^H03znK0b8vv0b.=", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 72678, "z": 3, "cf": 0.800000011920929 } ], "ln": 72662 }, { "b": "0cOuN0bITN0b}{H03zn-0c[M-0a=cM0bRZU0cncZ03znP0at\u003eJ0a=cM0at\u003eB03znI", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 73422, "z": 4, "cf": 0.800000011920929 } ], "ln": 73406 }, { "b": "ASviZ0dYRM03zng0b.^T0cFoZ0a=cM0cwiO0a=cM0bRZE0cncY0at\u003eu0a=cM0cwh", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 73569, "z": 3, "cf": 0.800000011920929 } ], "ln": 73553 }, { "b": "A@ZmYve%{uwDi?M0bBg!aokvvxAhPzaollUwDl=KA@YRGx8(Gyaol6Pve$uGaok\u003c", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 74178, "z": 3, "cf": 0.800000011920929 } ], "ln": 74162 }, { "b": "0rrv5wO+{^B7CsKblm==lVl{?A+Pf1BrFD1atLSah6v9Rx)Kk%zF7Lqx\u003c}5xyxjAEqEK3zx-", "n": [ { "c": 2, "d": "Copyright notice", "i": "metadata/package/license::copyright-word", "o": 83862, "z": 9, "cf": 0.6000000238418579 } ], "ln": 83846 }, { "b": "xd=FVB98Chv@#B6zGvuKr+lq)x(v(Lf!+jle?![iefEr5y\u0026\u003c/uwJ:{xB-.Ujy+cY9BZ/f3v[QxUrbVL-", "n": [ { "c": 2, "d": "IPv4-like .NET assembly version", "i": "metadata/lang/compiler/managed::dotnet-ipv4-like-version", "o": 84350, "z": 16, "cf": 0.8500000238418579 } ], "ln": 84334 }, { "b": "00000000000000000000000000000000000000315c8Xg7YTL^00000000000000000", "n": [ { "c": 1, "d": "PE resource section", "i": "metadata/binary/section/names::pe-resource-section", "o": 89088, "z": 5, "cf": 0.8999999761581421 } ], "ln": 89072 }, { "b": "0000000000007vGgYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006Xn[brp!0rrSj0000", "n": [ { "c": 3, "d": "Recognized marker for timing checks", "i": "objectives/anti-analysis/timing/evasion::timing-anti-debug-recognized-marker", "o": 89182, "z": 15, "cf": 0.949999988079071 } ], "ln": 89166 }, { "b": "zua+Ue=U\u003eK0024W4fczelJz38z2!IPve$fBC(QOtve$cAwDhYg004iyxAh-DDh}yOve$fBx8\u003cH-yYFeHvGlxd003Ed9rl9umGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up00372xAh-DDh}yOve$f", "n": [ { "c": 2, "d": "PE CompanyName metadata field", "i": "metadata/package/versioning::pe-companyname-field", "o": 89634, "z": 11, "cf": 0.699999988079071 }, { "c": 2, "d": "PE FileDescription metadata field", "i": "metadata/package/versioning::pe-filedescription-field", "o": 89694, "z": 15, "cf": 0.699999988079071 } ], "ln": 89618 }, { "b": "Bo22nq2*N@001?Q3ig8bmGvc5yYF2DrSDXhASydXx-J5Kzu6Up001XMe=W*gh#\u003e-me=WQae=WN9003EdaPIJynDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE00372xAh-DDh}yOve$fBx8\u003cK:", "n": [ { "c": 3, "d": "Dotted-quad PE version metadata marker", "i": "objectives/command-and-control/infrastructure/ip::ipv4-version-metadata-marker", "o": 89794, "z": 11, "cf": 0.9399999976158142 }, { "c": 2, "d": "PE InternalName metadata field", "i": "metadata/package/versioning::pe-internalname-field", "o": 89846, "z": 12, "cf": 0.699999988079071 } ], "ln": 89778 }, { "b": "eDxO!x-IPx003:laPIJypxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE00372xAh-DDh}yOve$fB", "n": [ { "c": 2, "d": "PE OriginalFilename metadata field", "i": "metadata/package/versioning::pe-originalfilename-field", "o": 90042, "z": 16, "cf": 0.699999988079071 } ], "ln": 90026 }, { "b": "wb{ACyYBCn001+O2(\u003c#apYLIozVBqFBPt[KBo25ove$cAwDhYg00372xAh-DDh}yOve$fBx8?]i005w^iSGfXpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001XMe=W*gh#\u003e-me=WQaeDt", "n": [ { "c": 2, "d": "PE ProductName metadata field", "i": "metadata/package/versioning::pe-productname-field", "o": 90150, "z": 11, "cf": 0.699999988079071 }, { "c": 2, "d": "PE version resource metadata", "i": "metadata/package/versioning::version-resource-metadata", "o": 90202, "z": 14, "cf": 0.8999999761581421 } ], "ln": 90134 }, { "b": "000000000000000000000b}@s3\u0026*ncTt{mX000000000000000000000000000000000", "n": [ { "c": 2, "d": "PE .reloc section presence", "i": "metadata/binary/section/names::reloc-section-presence", "o": 90624, "z": 6, "cf": 0.8999999761581421 } ], "ln": 90608 } ], "depth": 1, "facts": { "imp": [ [ "mscoree", "CorDllMain" ] ], "sec": [ [ ".text", 512, 88576, 5.87, "r-x" ], [ ".rsrc", 89088, 1536, 3.05, "r--" ], [ ".reloc", 90624, 512, 0.1, "r--" ] ], "metrics": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "resource_count": 1.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 152901.0, "reloc_overhang_bytes": 500.0, "reloc_overhang_ratio": 0.98, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "version.identity_entropy": 4.11, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0, "version.identity_symbol_ratio": 0.06 }, "file": { "size": 91136.0, "entropy": 5.81, "size_bytes": 91136.0 }, "binary": { "is_pie": 1.0, "code_entropy": 5.87, "string_count": 896.0, "overall_entropy": 5.81, "entropy_variance": 5.55, "avg_string_length": 25.93, "max_string_length": 196.0, "peak_region_bytes": 4096.0, "code_to_data_ratio": 1.0, "peak_region_entropy": 6.37, "string_length_stddev": 24.53, "largest_section_ratio": 0.97, "sentence_string_count": 97.0, "sentence_string_ratio": 0.11, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 88576.0, "entropy_max": 5.87, "entropy_mean": 3.01, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } } }, "id": 3, "mol": "O(Al)H₂(CmDb)", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/SoftwareExtravaganza.Whizbang.Transports.RabbitMQ/SoftwareExtravaganza.Whizbang.Transports.RabbitMQ.0.783.1-alpha.11.nupkg!!lib/net10.0/Whizbang.Transports.RabbitMQ.dll", "risk": 3, "sha": "fa8d87a5391fd1453564b05f17618f3c6f2270d9c06da1f8d33d84a178332a98", "size": 91136, "traits": [ { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "spans": [ [ 89794, 11 ] ] }, { "id": "metadata/package/versioning::semver-pattern", "conf": 0.699999988079071, "crit": 2, "desc": "Semantic version pattern", "spans": [ [ 66450, 6 ] ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 89182, 15 ] ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "spans": [ [ 56790, 4 ] ] }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "spans": [ [ 0, 26 ] ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "spans": [ [ 31260, 4 ] ] }, { "id": "objectives/command-and-control/dropper/staging/encrypted::dotnet-stringbuilder-append", "atk": "T1027", "mbc": "C0025", "conf": 0.8199999928474426, "crit": 1, "desc": ".NET StringBuilder Append use", "spans": [ [ 58026, 13 ] ] }, { "id": "objectives/command-and-control/dropper/staging/encrypted::dotnet-hexstring-conversion", "atk": "T1027", "mbc": "C0025", "conf": 0.8600000143051147, "crit": 1, "desc": ".NET hex string conversion", "spans": [ [ 56128, 9 ] ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "spans": [ [ 90202, 14 ] ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "micro-behaviors/data/db/linq::linq-queries", "conf": 0.699999988079071, "crit": 3, "desc": "LINQ query operations", "spans": [ [ 57878, 11 ] ] }, { "id": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "conf": 1.0, "crit": 3, "desc": "JSON polymorphism runtime marker", "spans": [ [ 51523, 16 ] ] }, { "id": "micro-behaviors/communications/http/websocket::websocket-send-async", "atk": "T1071.001", "mbc": "C0002", "conf": 0.8199999928474426, "crit": 3, "desc": "WebSocket async send method", "spans": [ [ 51884, 9 ] ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "spans": [ [ 31260, 4 ] ] } ], "type": "pe" }, { "ctx": [ { "b": "ju[7cy-)[jA=U@kzAPf#e?!Flj]", "n": [ { "c": 1, "d": "Document or config file extension", "i": "metadata/file/extension/identity::doc-or-config-extension", "o": 0, "z": 32, "cf": 1.0 } ], "ln": 1, "addr": 0 }, { "b": "jy\u0026wuj]", "ln": 2, "addr": 22 }, { "b": "arR^HjyJqLwO\u003e))C%h", "ln": 3, "addr": 28 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 46816.0, "entropy": 4.72, "size_bytes": 46816.0 }, "binary": { "overall_entropy": 4.72, "peak_region_bytes": 40672.0, "peak_region_entropy": 4.94 } } }, "id": 4, "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/SoftwareExtravaganza.Whizbang.Transports.RabbitMQ/SoftwareExtravaganza.Whizbang.Transports.RabbitMQ.0.783.1-alpha.11.nupkg!!lib/net10.0/Whizbang.Transports.RabbitMQ.xml", "pid": 0, "sha": "06959a1cec6ff9819eeeaed330aebd4fb1a2f6e485b9c040af26bf5d7100fb7b", "size": 46816, "traits": [ { "id": "metadata/file/extension/identity::doc-or-config-extension", "conf": 1.0, "crit": 1, "desc": "Document or config file extension", "spans": [ [ 0, 32 ] ] } ], "type": "xml" }, { "ctx": [ { "b": "lrc#RpdD{NwfKi8z/fVqx\u003c#jbx(mMCfjv3KjtgUq3jn[mayP82xkP\u003cRv}xL1wPw$U3lQDNvixl7wOa7HxMOunB2\u003e%cxk8E3BZ=$kz/4dKxLz^4vqYZfy?WuiCw7YpvQTd!fjwvjx(v)gfl.tPyI4y3CxkAEx!BWFy:859x(dG9B8\u003e+Nb4#7uAc15[fk20vxMW=pv@DiqCw7YpvQTd!eO]cgfl.8zDsyr2xd)X6BzkVhB1.-QA+/o6z*cmQv}^Mvzep\u003emvpT0", "ln": 304, "col": 18, "line": 8 }, { "b": "vqGT\u003czAPgNwO#Q3AW0Xfvixl7wOa7HxMOunB2\u003e%cCw7YpvQQ)bxcGJqwNP9(Bzbkdw{4{aay]z2B.$YcByxo9z/cXaBrC^vx)Kk%e]Cq:fjv4bfk9d93jnvpeEz?fboQ63C{3g4x)Kk%zF8fv3n0wIdNE@WDtdnfaw=S\u0026w]zZbvqYN^dK(O2FrRfsatLS*B0bgmePt-Gv}x.5az\u003eXhB75Y)ay]hcAa9\u0026#xDRIkBz8!ywPzYivqG:#v{%E[z/fRsz/cXtxK@r1z/^avvrue\u0026eG=I)pgnlUC4z^ZpGeDGA=k!ql$7u-pI%.[dJ)-3LPS[yB-H#6azkn6wPzj3z/P[wCwh8eaz2.cA^m", "ln": 2082, "col": 5, "line": 31 }, { "b": "BzkP6aA?spx\u003ez6?vruj4zxJ\u003efaz\u003eXhB75Y)azth3wnC*$B1wCOz/{eozF7HyvqYP#wP?T5BrCTmxK#3?A%:GwdK)?$C4CGdAaK5jmr\u0026=.A+P95v}vbtaMv{oaw#]-xDP(mmiDU]AbY-oBrC^wBz8!bz!9A4zEEZ5xjk)@z/d9GwnbE+zF%Prx\u003e8h", "ln": 2451, "col": 29, "line": 39 }, { "b": "A%-m7dPf?/wPh:fA=SYWaMv{oax9w\u003cBy/o1B8@EvwPI{3xjSi0vqYQ(wPz\u0026mBzb98aAz46wODs0ay/tbzddr)B0a[ewft\u0026iz!a02wGUMcwO#Qhe*absAaHRxvp\u003c6[CwhejazbC3CXHS6wGV28B8V5nB7DFoD2Ntoe^.}ndNW#(Aa9\u0026#xK#ildJ)-3", "ln": 2652, "col": 16, "line": 42 }, { "b": "BrCgoz/3RdC4CMkaAITBwNPB%e*9-6wncj3wozr%y\u003cvdpvrl9lBAg/1yH}30w]zYjx(mB3wO(0@Byw#dze0T6vruj4zy#n6dK[b6zGxxgdK(O2FrRfzz/6DiB75J]wGU#nwPA5sAb](iwN/*@z/fRsz*2YjaAg[jB8UY2Bzk]fay[]5vix=dBz8=", "ln": 2968, "col": 51, "line": 48 }, { "b": "x(v\u003e@eG=I)mmFy!z/Pzif!+7batj\u0026!dNWY:AaK5tdJ)-3LPSwpvqE5%vrt{2vpJ!UB8@EFx([2hB8Mhwv}vl8wO#71vru6\u003eaz(4cwO=z{eG=I)qG3R)D2s:6z/{8gwGTGOzE)\u0026%Bz(hvdK(O2FrRfzz/6Dcy?khux(dA7Cwh8izF787z/M$vwN/p\u003cBz?", "ln": 4728, "col": 87, "line": 78 }, { "b": "v}vl8wO#71vru6\u003eaA?gfB.8XlvRPE:BAm=@bo[s3wPS3dzF77\u003cByxiiwN(bPu%)wKvrl8?wn=NcwPP56wmM*4vpK7YxjSh:z!s9nvrb{FCYW$mC422(zHb.zs7(q]vQTd!e\u003c\u003cL$wEq*Mu\u003cWltwO00axK@q\u003cqfuO.yAML$vrcDjxlv{0wNcY$BAzFyiXJb", "ln": 5072, "col": 21, "line": 83 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 5682, "entropy": 5.2 }, "text": { "lines": 107, "top_char": 101, "max_ws_run": 26, "digit_ratio": 0.01, "space_count": 602, "char_entropy": 5.2, "unique_chars": 83, "top_char_null": 0, "lines_over_200": 4, "top_char_ratio": 0.07, "avg_line_length": 52.1, "max_line_length": 226, "non_ascii_ratio": 0.03, "empty_line_ratio": 0.27, "last_line_length": 14, "long_token_count": 1, "whitespace_ratio": 0.12, "line_length_stddev": 58.31, "repeated_char_sequences": 9 }, "binary": { "peak_region_bytes": 5682, "peak_region_entropy": 5.28 } } }, "id": 5, "mol": "H(Cm)", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/SoftwareExtravaganza.Whizbang.Transports.RabbitMQ/SoftwareExtravaganza.Whizbang.Transports.RabbitMQ.0.783.1-alpha.11.nupkg!!README.md", "pid": 0, "risk": 1, "sha": "39ec231770e710b1351884d0b8923b125b6996d103322ae616f87890cc74896f", "size": 5682, "traits": [ { "id": "metadata/lang/natural::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"", "spans": [ [ 2130, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-2", "conf": 0.8, "crit": 1, "desc": "English function-word token \"and\"", "spans": [ [ 2499, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-3", "conf": 0.8, "crit": 1, "desc": "English function-word token \"that\"", "spans": [ [ 2700, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "spans": [ [ 3016, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-6", "conf": 0.8, "crit": 1, "desc": "English function-word token \"with\"", "spans": [ [ 2264, 0 ] ] }, { "id": "micro-behaviors/communications/http/url/forge::public-code-forge-url", "conf": 0.9, "crit": 3, "desc": "References a public code-forge URL", "spans": [ [ 368, 19 ] ] } ], "type": "markdown" }, { "id": 6, "sha": "c61516016362b41ef84710a6a4a2b39f70a06d4b0c65f3d2ca9ebfd2de62348d", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/SoftwareExtravaganza.Whizbang.Transports.RabbitMQ/SoftwareExtravaganza.Whizbang.Transports.RabbitMQ.0.783.1-alpha.11.nupkg!!logo.png", "size": 67200, "type": "png", "depth": 1 }, { "id": 7, "sha": "b858fadd5794c5a53fcbaa7a45db7aa5f6ab1fd173ba71cc2625214ee1509c6a", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/SoftwareExtravaganza.Whizbang.Transports.RabbitMQ/SoftwareExtravaganza.Whizbang.Transports.RabbitMQ.0.783.1-alpha.11.nupkg!![Content_Types].xml", "size": 644, "type": "xml", "depth": 1 }, { "id": 8, "sha": "878e42b4fa43dc9f4f51ef2916afc61e0ba1e4fe2a69a3344b364d175a62616c", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/SoftwareExtravaganza.Whizbang.Transports.RabbitMQ/SoftwareExtravaganza.Whizbang.Transports.RabbitMQ.0.783.1-alpha.11.nupkg!!package/services/metadata/core-properties/43826bace6ac4aff8f9b1e1915871ece.psmdcp", "size": 865, "type": "xml", "depth": 1 }, { "id": 9, "sha": "b6ae1a125e5b493fc8a5f1beac9aa3ac5b9ea9ced5bcc184a037564817203772", "path": "SoftwareExtravaganza.Whizbang.Transports.RabbitMQ@0.783.1-alpha.11.registry.json", "size": 902, "type": "registry", "depth": 1 } ], "omitted_files": 4, "rev": "46112", "v": "8" } }