Benign dotnet 54,334 installs Download

Soenneker.Extensions.Documents.Named 4.0.290

“A collection of helpful NamedDocument extension methods”

PE has no signature recordMarkdown references a remote image

Evidence

Embedded HTTP or WebSocket URL 0xc3b–0xc9b
0xc3b6d65092e4e45542031302e301a010015me..NET 10.0....
0xc4b68747470733a2f2f736f656e6e656b65https://soenneke
0xc5b722e636f6d00000c01000752656c6561r.com......Relea
0xc6b736500002a010025436f707972696768se..*..%Copyrigh
⋯3 more rows
PE version metadata includes CompanyName 0x11b2–0x11e2
0x11b268006f006400730000004c0016000100h.o.d.s...L.....
0x11c243006f006d00700061006e0079004e00C.o.m.p.a.n.y.N.
0x11d261006d00650000000000680074007400a.m.e.....h.t.t.
0x11e2700073003a002f002f0073 p.s.:././.s
PE version metadata includes FileDescription 0x11fe–0x122e
0x11fe2e0063006f006d000000720025000100..c.o.m...r.%...
0x120e460069006c0065004400650073006300F.i.l.e.D.e.s.c.
0x121e720069007000740069006f006e000000r.i.p.t.i.o.n...
0x122e000053006f0065006e006e0065006b ..S.o.e.n.n.e.k
PE version metadata includes FileVersion 0x1272–0x12d2
0x12726d00650064000000000034000a000100m.e.d.....4.....
0x1282460069006c0065005600650072007300F.i.l.e.V.e.r.s.
0x129269006f006e000000000034002e003000i.o.n.....4...0.
0x12a22e003200390030002e00300000007200..2.9.0...0...r.
0x12b22900010049006e007400650072006e00)...I.n.t.e.r.n.
0x12c261006c004e0061006d00650000005300a.l.N.a.m.e...S.
0x12d26f0065006e006e0065006b0065007200o.e.n.n.e.k.e.r.
PE version metadata includes ProductVersion 0x1472–0x14e2
0x14726d006500640000000000860031000100m.e.d.......1...
0x1482500072006f0064007500630074005600P.r.o.d.u.c.t.V.
0x149265007200730069006f006e0000003400e.r.s.i.o.n...4.
0x14a22e0030002e003200390030002b003900..0...2.9.0.+.9.
0x14b262003400640032003800360030003200b.4.d.2.8.6.0.2.
0x14c2340065003500620065006300350030004.e.5.b.e.c.5.0.
0x14d2370062003000660062003400610038007.b.0.f.b.4.a.8.
0x14e23400620030006300610033006400 4.b.0.c.a.3.d.

No evidence locations were recorded for this file. Raw result

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.