{ "ml": { "v": "7", "eng": "2.2.1", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.80784976, "rte": "az", "prob": 0.80784976 }, { "cls": 0, "raw": 0.09920555, "rte": "az/nupkg", "prob": 0.09920555 } ], "prob": 0.80784976, "skip": [ { "rte": "az/zip", "why": "unavailable" }, { "rte": "az/zip", "why": "unavailable" } ], "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.8078497648239136, "type": "nupkg" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.00012001395225524902, "type": "xml" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.008743494749069214, "type": "xml" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.008600890636444092, "type": "markdown" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.00006663799285888672, "type": "png" }, { "id": 5, "lvl": -1, "conf": 0, "prob": 0.6386661529541016, "type": "pe" }, { "id": 6, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "xml" }, { "id": 7, "lvl": -1, "conf": 0, "prob": 0.00003832578659057617, "type": "xml" }, { "id": 8, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "registry" } ], "version": "v18.18", "analyzed_at": "2026-07-08T01:04:20Z" }, "path": "Elarion.Settings.0.2.4-preview.90.1.nupkg", "raw": { "files": [ { "id": 0, "mol": "O(Al)H(Db)", "sha": "e1f8b35b889b0efba3778ab28d3006950d9c0acac7abe576731262a03c2712cc", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Elarion.Settings/Elarion.Settings.0.2.4-preview.90.1.nupkg", "risk": 3, "size": 35693, "type": "nupkg", "facts": { "metrics": { "file": { "size": 35693.0, "entropy": 7.92, "size_bytes": 35693.0 }, "binary": { "overall_entropy": 7.92, "peak_region_bytes": 32768.0, "peak_region_entropy": 7.81 }, "archive": { "file_count": 8.0, "member_count": 8.0, "script_count": 0.0, "zip_bomb_ratio": 3.1, "directory_count": 0.0, "executable_count": 1.0, "extra_field_size": 0.0, "noise_file_count": 0.0, "total_compressed": 34669.0, "compression.ratio": 0.56, "hidden_file_count": 2.0, "total_uncompressed": 61710.0, "crc_collision_count": 0.0, "entry_comment_count": 0.0, "max_filename_length": 81.0, "rtlo_filename_count": 0.0, "format.regular_count": 8.0, "nested_archive_count": 0.0, "path_traversal_count": 0.0, "symlink_escape_count": 0.0, "security.setgid_count": 0.0, "security.setuid_count": 0.0, "security.sticky_count": 0.0, "double_extension_count": 0.0, "duplicate_member_count": 0.0, "security.symlink_count": 0.0, "unicode_filename_count": 0.0, "homoglyph_filename_count": 0.0, "security.encrypted_count": 0.0, "timing.mtime_unique_count": 4.0, "timing.mtime_unique_ratio": 0.5, "misplaced_executable_count": 1.0, "timing.mtime_dominant_count": 4.0, "timing.mtime_spread_seconds": 25156.0, "timing.sentinel_mtime_count": 0.0, "security.world_writable_count": 0.0, "timing.mtime_dominant_fraction": 0.5, "compression.method_counts.stored": 1.0, "compression.method_counts.deflate": 7.0 } } }, "ident": { "name": { "value": "Elarion.Settings", "source": "nupkg.title", "verified": false }, "urls": [ { "url": "https://elarion.wimmesberger.dev/", "kind": "homepage", "source": "nupkg.project_url" }, { "url": "https://github.com/swimmesberger/Elarion.git", "kind": "repository", "source": "nupkg.repository_url" } ], "trust": "unsigned", "authors": [ { "name": "Simon Wimmesberger", "role": "author", "source": "nupkg.authors" } ], "version": { "value": "0.2.4-preview.90.1", "source": "nupkg.version", "verified": false }, "identifier": { "value": "Elarion.Settings", "source": "nupkg.id", "verified": false } }, "traits": [ { "id": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "conf": 1.0, "crit": 3, "desc": "JSON polymorphism runtime marker", "from": [ { "file": 5 } ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "from": [ { "file": 5 } ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "from": [ { "file": 5 } ] }, { "id": "metadata/package/versioning::version-word-lower", "conf": 0.4000000059604645, "crit": 2, "desc": "version word (lowercase)", "from": [ { "file": 5 } ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "from": [ { "file": 5 } ] }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "from": [ { "file": 5 } ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "from": [ { "file": 5 } ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/data/string/library::dotnet-stringbuilder-append", "conf": 0.8199999928474426, "crit": 3, "desc": ".NET StringBuilder Append use", "from": [ { "file": 5 } ] } ] }, { "depth": 1, "facts": { "metrics": { "file": { "size": 506.0, "entropy": 5.19, "size_bytes": 506.0 }, "binary": { "overall_entropy": 5.19, "peak_region_bytes": 506.0, "peak_region_entropy": 5.19 } } }, "id": 1, "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Elarion.Settings/Elarion.Settings.0.2.4-preview.90.1.nupkg!!_rels/.rels", "sha": "49726c9f6b2496a0884d09f9baecc7ca37cc36dbee406705dc0028dc8fabdb74", "size": 506, "type": "xml" }, { "ctx": [ { "b": "[4ls%kx}3YaA?spB7]MgjT8QkfD}SJzEWP}x(mMDb6w0teJs}sj]", "n": [ { "c": 2, "d": "NuGet nuspec manifest file", "i": "metadata/build/manifest::nuspec-file", "o": 0, "z": 23, "cf": 0.9800000190734863 } ], "ln": 1, "addr": 0 }, { "b": "jAa.syHH\u003c!aB4:tzGv@+xMOuniXJdcv}YB\u003cvrj5rx\u003e8g4B8LVje[n*pfk$ufyHH\u003c\u0026zF7QTfFLvpfF$I3B-RIkv\u003eJ1EwfKh", "ln": 2, "addr": 42 }, { "b": "arS^-wPRu\u003evrt{w", "ln": 3, "addr": 118 }, { "b": "arR^Hjy-qGD2^RixMMB9z/x#xx\u003eIa3asH.Gax8#\u003ez/cX0x(dY#B7eZ3xjV9CfjO{tD2^RixMMA", "ln": 13, "addr": 729 }, { "b": "arR^HjAL1AB3seKvrc72zxJXnz/ddEAap2cv@JMiz/{8gwI4LazE)\u0026%Bz(gxA=l2nD2s:nz//(dBrC1kAbGlev@Dy0ay/k0vqWV9A:@=%By!%7B-I4ov@VKgayO$ovp%d?BAoL$Byw*6j]", "ln": 14, "addr": 789 }, { "b": "arR^HjAt1Lz/YSmz/QaCBA}?pjTaJMBrR\u0026IA+)(.xMOunB2\u003e%cxk8E3BZ=$kz/4dGCwg]hwPIr(A+w%7fgxX=A+PDfe[X)ua%punvqYN*jTa]Tw]/RswNPa\u003cfkUcizxZikz/6u9BuH*7v(3bQf\u003ejVJiw$q1iwSK6g*%/KwIu1#iw\u0026=MfG7[5vkx!}w?(d^atk[", "n": [ { "c": 2, "d": "NuGet package declares repository", "i": "metadata/package/files/nuget::nuspec-repository", "o": 907, "z": 106, "cf": 0.8999999761581421 } ], "ln": 15, "addr": 903 }, { "b": "arR^Hjy\u00262xwO#3\u0026zEWx(B3o", "n": [ { "c": 2, "d": "NuGet package declares dependencies", "i": "metadata/package/files/nuget::nuspec-dependencies", "o": 1063, "z": 297, "cf": 0.8999999761581421 } ], "ln": 16, "addr": 1059 }, { "b": "arR^HarS^VA=l8taAR4jxjVfOA:-/@Cw?IqjTa=PBtkE4fD@W", "ln": 17, "addr": 1078 }, { "b": "arR^HarR^Hjy\u00262xwO#3\u0026zEW@mx\u003efvJmqMyMx(v(wl1j[SA:-E1x(v)ga%q5uA=U@kzAPf$e\u002624oePt-wC4\u003eJie\u0026+Qrf^m-KCW\u003eMjwmW[FluN0UwgQ2:vqHjnwPz\u0026oatk[", "ln": 18, "addr": 1118 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 1525.0, "entropy": 5.03, "size_bytes": 1525.0 }, "binary": { "overall_entropy": 5.03, "peak_region_bytes": 1525.0, "peak_region_entropy": 4.97 } } }, "id": 2, "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Elarion.Settings/Elarion.Settings.0.2.4-preview.90.1.nupkg!!Elarion.Settings.nuspec", "risk": 1, "sha": "42fb4b02bb4747459ea73615de7d8ff8f9153c9ddd7d6acf30051d5fe8b0b51d", "size": 1525, "traits": [ { "id": "metadata/build/manifest::nuspec-file", "conf": 0.9800000190734863, "crit": 2, "desc": "NuGet nuspec manifest file", "spans": [ [ 0, 23 ] ] }, { "id": "metadata/package/files/nuget::nuspec-repository", "conf": 0.8999999761581421, "crit": 2, "desc": "NuGet package declares repository", "spans": [ [ 907, 106 ] ] }, { "id": "metadata/package/files/nuget::nuspec-dependencies", "conf": 0.8999999761581421, "crit": 2, "desc": "NuGet package declares dependencies", "spans": [ [ 1063, 297 ] ] } ], "type": "xml" }, { "ctx": [ { "b": "Aa@*7B-I4S3lQDNB8Mhwv}u^1wN]H-jT8p[A+e\u0026]A=S*xz!%ujePUAnwO(0tay[]3yBHCIB8\u003e=iwPQ6VxMOunB2\u003e%cA::eAxk8E3BZ/GmwPzp0zGGDcBs}6wz7/%Ox(dY#B7eZ3xjV9pmqMyMx(v(xzddc@fjY0hB1.GPvR/:*fjF%gzE+ziy*?u#z/ddovqY%]AXhxNvqZd9vrb{%Bs?3iA+^pGC4S0.3lQDNB8Mhwv}u^1wN]H-jT8p[A+e\u0026]A=S*xz!%ujePUAnwO(0taz++8xMK", "ln": 23, "col": 2, "line": 3 }, { "b": "Bz9/Yhz^9iayP8djT9shvrc72zxN}?LPSnhAbok#vruj4zxJLivqPO1z/PRow]zYje(1\u0026mb0Dt@fk$SnBAIRnj{?SDdOT?(B.\u003eRvvQTs?wftL]zE^M{AV/snAaJ\u003c1zE)(uay/tbAa%c1eP+YzwGV28xk8BeA::67z/d9Gn(FIXeMbzjaztXmBzkS9efEUOp-%\u003c#z!%Fqw]zYjk$JhcxjU$5B1wCxzE:(hv}YB:B.\u003eS1azL?7B1O{(3jogjv@bN]wGUY8By/uiaz$+nBrCWzaBd)FAV!\u003egwmW?By?mYhB8Mhwv}u=}wO#71vruBdB0b1iaARpdaA}Kux(mMoawM?$A=(nwx(dA7A+e\u003c0wN/*@z/cXsv{%m)x(mMo3jnmjk$JUCvrujbwGUDcay]58x\u003eIrAdK(M.xK@rcvqPM#xKL^?y?mTdaARp9BrCKvCv+!qD2E?Cave*}ayPq4az2!pz/YG2aARJAk$JhcxjU$5B0a[jax}Mcp*CF.BAzFyiXJd6z!9A}v@DmbwQ5roA=l5rv@Dfox(tByBz(8lB0fE)LPTQIzE)\u0026%By!#9w].*baBd)FAV!\u003egwmV((BrC7ize:i9wGV8ezdLmvCwhejaz#9uB7Gr0A::63aARKuy-)n1w[=c%BzkVhB0byway]Rly?Wx/By!#9B7n({zddGr3jo#Xtsg$/c$)ZAAc15[fk20vxMW=pv@DiqB9ztnzdN=$wPzA{AXx\u003c$vrc72zzbBdBzkVhB1.-QA+/o6z*cmQv}^Mvzep\u003emvpT1Ze]#hGdp1unBAzFyiXJd0x([3hvLheez7/%Ox(dY#B7eZ3xjV9pmqMyMx(v(xvpKy[z/fRHCw?Iqw]8yfB1.3qe{RqIdgfo5", "ln": 510, "col": 133, "line": 6 }, { "b": "ayFb[B97#ge\u003c%zZxkRTeBzklau[rBAx([2hzF{T@l}XUkwPhi#wmYT*C)UVpw]zZ1wN({4zxKjyBU1UzzE:(3C4CYtazth3wnC*$aAIHgzxJw9wftYbxcqn9z/xngx(+zdzGoD3xK$Y%CwhejaARpday!?@y?W^1aA.:pAV!!2A=l2uayP853lQEkA:X", "ln": 6266, "col": 54, "line": 92 }, { "b": "mq^cWv}YB]u[0Yn3l{=rnP5P\u003evqG-!3sEmHCX}m7jrVpdavf%=y?Wx/BzkVhaz++3A::0laMv{oaARpdaAIEzA:@V6xjU%(A::6dAV/Bpx(Fbox(n0awmV)9xK@qP", "ln": 6456, "col": 46, "line": 94 }, { "b": "v@Dx@Bz(hvefG4FwGUY8eP26oz/QaCB7n({wozZ1AX5tyB-IIlzGEEMB7GwmvpJ!UB8@(PvqYP#BzbkdwmYvYB.(dxvrDW9z/PMrwPxyCl$HsGzE^/hz/fxpaA8cuu}\u003euBA=l2qw]]T]CYWImB7]MgB1O}IayO-2BAg/1BzkVhB08\u003e%l@CP\u003cfFLHnaMr", "ln": 7273, "col": 103, "line": 118 }, { "b": "aAz4mB.(dxv{@\u003eXx(mMac$2tKwjpryA+PDfnmuyDy?mSOvpJ$+zF7vDu[0YJqE%\u0026\u003cx(W=}ayYQsu%u0bv}YBZvR/QYu[U[(lT:FrwL3=.vqGT*vru6^u)3\u003eeCYW$mv@#o)azbUjz6itbA+c^Ak$1Q5fFCjudj#-\u003c3vA$2u}1)uA+PDfe\u003c\u003c5SxLzu%e(lFc", "ln": 7802, "col": 153, "line": 119 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 20953, "entropy": 5.07 }, "text": { "lines": 181, "top_char": 101, "max_ws_run": 1, "digit_ratio": 0, "space_count": 1757, "char_entropy": 5.07, "unique_chars": 98, "top_char_null": 0, "lines_over_200": 40, "lines_over_500": 2, "top_char_ratio": 0.09, "avg_line_length": 114.76, "lines_over_1000": 1, "max_line_length": 1226, "non_ascii_ratio": 0.01, "empty_line_ratio": 0.17, "last_line_length": 111, "long_token_count": 32, "whitespace_ratio": 0.09, "line_length_stddev": 144.99, "repeated_char_sequences": 5 }, "binary": { "peak_region_bytes": 20953, "peak_region_entropy": 5.12 } } }, "id": 3, "mol": "Hâ‚‚(CmDb)", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Elarion.Settings/Elarion.Settings.0.2.4-preview.90.1.nupkg!!README.md", "pid": 0, "risk": 2, "sha": "59b3d9c87942df2d44c25df8656d36fe790783d2309aadcb2160278fb2dbc4d8", "size": 20953, "traits": [ { "id": "metadata/lang/natural::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"", "spans": [ [ 767, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-2", "conf": 0.8, "crit": 1, "desc": "English function-word token \"and\"", "spans": [ [ 685, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-3", "conf": 0.8, "crit": 1, "desc": "English function-word token \"that\"", "spans": [ [ 855, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "spans": [ [ 558, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-6", "conf": 0.8, "crit": 1, "desc": "English function-word token \"with\"", "spans": [ [ 994, 0 ] ] }, { "id": "micro-behaviors/communications/http/url/forge::github-raw-url", "conf": 0.92, "crit": 3, "desc": "GitHub raw-content URL", "spans": [ [ 87, 34 ] ] }, { "id": "micro-behaviors/communications/http/url/forge::public-code-forge-url", "conf": 0.9, "crit": 3, "desc": "References a public code-forge URL", "spans": [ [ 1059, 19 ] ] }, { "id": "micro-behaviors/data/llm/wire-marker::ai-agent-term-reference", "conf": 0.8, "crit": 3, "desc": "References the phrase \"AI agent\"", "spans": [ [ 674, 8 ] ] } ], "type": "markdown" }, { "depth": 1, "id": 4, "ident": { "trust": "unsigned", "producer": { "value": "www.inkscape.org", "source": "png.text.software", "verified": false } }, "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Elarion.Settings/Elarion.Settings.0.2.4-preview.90.1.nupkg!!icon.png", "pid": 0, "risk": 1, "sha": "1c55b4dc2927fddf0e662eb55abdc408419f1a37441199f9dfb138bd53f3eeb1", "size": 3239, "type": "png" }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J+", "n": [ { "c": 3, "d": "HTTP fingerprinting evasion campaign", "i": "objectives/command-and-control/infrastructure/user-agent::http-fingerprinting-campaign", "o": 0, "z": 34, "cf": 0.8999999761581421 } ], "ln": 0 }, { "b": "00000000000000000000jzaS]00000nb@R\u00260SSx7LRi1pPF==I0rr91000000000000", "n": [ { "c": 1, "d": "PE standard code/data section", "i": "metadata/binary/section/names::pe-code-data-standard-section", "o": 512, "z": 5, "cf": 0.8999999761581421 } ], "ln": 496 }, { "b": "c[25}3mV%nxAe2pdGxCGlq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn", "n": [ { "c": 3, "d": "Recognized PE anti-analysis marker", "i": "objectives/anti-analysis/debugger-detect/combined-checks::evasion-aware-recognized-pe-marker", "o": 4500, "z": 4, "cf": 1.0 } ], "ln": 4484 }, { "b": "pYJQ%BZ/f3B7/c9k2qkwB7Gxnx\u003e7Z}k2qkU0cR^!B.a]!08[e:By/qwraQq@e\u003eQh6zz1\u003e0A+O@#x)Kifx(v(wo\u003ewAPwmoN*06ACP08[e:Bn", "n": [ { "c": 3, "d": "JSON polymorphism runtime marker", "i": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "o": 11625, "z": 16, "cf": 1.0 }, { "c": 1, "d": "rust binary fs module vocabulary", "i": "objectives/impact/crypto-manipulation/keywords::rust-bin-fs-vocab", "o": 11604, "z": 8, "cf": 0.20000000298023224 } ], "ln": 11588 }, { "b": "mqMyMx(v(wq!p5)x(mN8e[w^m090SLz*a=+piyw?0cqZ[uRbuJz2!iWByd%(B97#g", "n": [ { "c": 3, "d": "References Windows executable or script", "i": "objectives/execution/interpreter/script/shell::windows-executable-ref", "o": 13492, "z": 4, "cf": 0.6000000238418579 } ], "ln": 13476 }, { "b": "wQ5f9v@#o)r+lq)x(v\u003e?C4CYnx(v\u003e?mqMyMx(v(wl1j[SA:-E1x(v)ge(Mt4x\u003c\u003e*(Dsp)", "n": [ { "c": 3, "d": "Recognized sparse-logic binary marker", "i": "objectives/anti-analysis/vm-detect/instruction::sparse-logic-recognized-marker", "o": 13674, "z": 7, "cf": 0.800000011920929 } ], "ln": 13658 }, { "b": "zE^r@v%HT-ygQ)%x(v\u003e?q*ACawO\u003c4$wOb:\u0026v@#B6zu9mbwPz%dv}w2Cy\u00260V)BzkVh06$TrB.$YcBwu%{yY", "n": [ { "c": 2, "d": "Benign high-entropy PE context", "i": "metadata/package/quality/false-positives::benign-high-entropy-pe-context", "o": 13802, "z": 17, "cf": 0.949999988079071 } ], "ln": 13786 }, { "b": "z/bLNwPQv=v}xR3x(v\u003e?q*ACawO\u003c50wQ5qHn][]*06$damqMyMx(v(YB8L{@q/)4]zF8sPze-{7x(!ig", "n": [ { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 13900, "z": 16, "cf": 0.8500000238418579 } ], "ln": 13884 }, { "b": "wPv=)x(dATA=lbnwmY=Yq/)4]zF8pUx(4r\u003eASwi=Byex:B.LV5wPv=Iz!\u0026{4nn\u0026rPwPv=-wPRoJA@", "n": [ { "c": 3, "d": ".NET StringBuilder Append use", "i": "micro-behaviors/data/string/library::dotnet-stringbuilder-append", "o": 14023, "z": 13, "cf": 0.8199999928474426 } ], "ln": 14007 }, { "b": "3\u0026{tkqE%VQvrk#W03}TCavy6^D2^RixMLvBv\u003c@K0x(d^aaxJn]zdN=$wPzA{ASu8\u0026*w}q8!C", "n": [ { "c": 2, "d": "Copyright notice", "i": "metadata/package/license::copyright-word", "o": 17922, "z": 9, "cf": 0.6000000238418579 } ], "ln": 17906 }, { "b": "00000000000000000000000000000000000000315c8Xg7YTL^00000000000000000", "n": [ { "c": 1, "d": "PE resource section", "i": "metadata/binary/section/names::pe-resource-section", "o": 18944, "z": 5, "cf": 0.8999999761581421 } ], "ln": 18928 }, { "b": "0000000000004lEgYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006Xn[brp!0rrf30000", "n": [ { "c": 3, "d": "Recognized marker for timing checks", "i": "objectives/anti-analysis/timing/evasion::timing-anti-debug-recognized-marker", "o": 19038, "z": 15, "cf": 0.949999988079071 } ], "ln": 19022 }, { "b": "z#:CHA@W/)002aY4GDIflJz38z2!IPve$fBC(QOtve$cAwDhYg0046uCk#sSz2!zMwDl=KvGo%tASx.LwDl-J002Q\u003e5Dz?imGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up002B/yYE(zASx!NzVBU", "n": [ { "c": 2, "d": "PE CompanyName metadata field", "i": "metadata/package/versioning::pe-companyname-field", "o": 19710, "z": 11, "cf": 0.699999988079071 }, { "c": 2, "d": "PE FileDescription metadata field", "i": "metadata/package/versioning::pe-filedescription-field", "o": 19770, "z": 15, "cf": 0.699999988079071 } ], "ln": 19694 }, { "b": "zuaqHA@Vgu001XM2MK(9mGvc5yYF2DrSDXhASydXx-J5Kzu6Up001XMe=WTbe=WZde=WN9002Q\u003e6-XmmnDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE002B/yYE(zASx!NzVBUPe=X/I", "n": [ { "c": 3, "d": "Dotted-quad PE version metadata marker", "i": "objectives/command-and-control/infrastructure/ip::ipv4-version-metadata-marker", "o": 19846, "z": 11, "cf": 0.9399999976158142 }, { "c": 2, "d": "PE InternalName metadata field", "i": "metadata/package/versioning::pe-internalname-field", "o": 19894, "z": 12, "cf": 0.699999988079071 } ], "ln": 19830 }, { "b": "x8(GyASu7t002)%6-Xmmpxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE002B/yYE(zASx!NzVBUP", "n": [ { "c": 2, "d": "PE OriginalFilename metadata field", "i": "metadata/package/versioning::pe-originalfilename-field", "o": 20074, "z": 16, "cf": 0.699999988079071 } ], "ln": 20058 }, { "b": "wb{ACyYBCn002s=5Dz?ipYLIozVBqFBPt[KBo25ove$cAwDhYg002B/yYE(zASx!NzVBUPe=X/", "n": [ { "c": 2, "d": "PE ProductName metadata field", "i": "metadata/package/versioning::pe-productname-field", "o": 20158, "z": 11, "cf": 0.699999988079071 } ], "ln": 20142 }, { "b": "zuaqHA@Vgu005I?jobxZpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001XMe=WTbe=WZdeDx.\u0026ASu", "n": [ { "c": 2, "d": "PE version resource metadata", "i": "metadata/package/versioning::version-resource-metadata", "o": 20226, "z": 14, "cf": 0.8999999761581421 } ], "ln": 20210 }, { "b": "000000000000000000000ak^b3\u0026*nctShS.000000000000000000000000000000000", "n": [ { "c": 2, "d": "PE .reloc section presence", "i": "metadata/binary/section/names::reloc-section-presence", "o": 20480, "z": 6, "cf": 0.8999999761581421 } ], "ln": 20464 } ], "depth": 1, "facts": { "imp": [ [ "mscoree", "CorDllMain" ] ], "sec": [ [ ".text", 512, 18432, 5.81, "r-x" ], [ ".rsrc", 18944, 1536, 3.32, "r--" ], [ ".reloc", 20480, 512, 0.08, "r--" ] ], "metrics": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "resource_count": 1.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 47895.0, "reloc_overhang_bytes": 500.0, "reloc_overhang_ratio": 0.98, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "version.identity_entropy": 3.85, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0, "version.identity_symbol_ratio": 0.04 }, "file": { "size": 20992.0, "entropy": 5.53, "size_bytes": 20992.0 }, "binary": { "is_pie": 1.0, "code_entropy": 5.81, "string_count": 295.0, "overall_entropy": 5.53, "entropy_variance": 5.51, "avg_string_length": 17.53, "max_string_length": 213.0, "peak_region_bytes": 2048.0, "code_to_data_ratio": 1.0, "peak_region_entropy": 5.74, "string_length_stddev": 19.42, "largest_section_ratio": 0.88, "sentence_string_count": 6.0, "sentence_string_ratio": 0.02, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 18432.0, "entropy_max": 5.81, "entropy_mean": 3.07, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } } }, "id": 5, "mol": "O(Al)H(Db)", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Elarion.Settings/Elarion.Settings.0.2.4-preview.90.1.nupkg!!lib/net10.0/Elarion.Settings.dll", "risk": 3, "sha": "fc300204705f2efd7899b22e0379639835edc73a00684f0c1b36f1aeecc83d8a", "size": 20992, "traits": [ { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "spans": [ [ 19846, 11 ] ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "spans": [ [ 20226, 14 ] ] }, { "id": "micro-behaviors/data/string/library::dotnet-stringbuilder-append", "conf": 0.8199999928474426, "crit": 3, "desc": ".NET StringBuilder Append use", "spans": [ [ 14023, 13 ] ] }, { "id": "metadata/package/versioning::version-word-lower", "conf": 0.4000000059604645, "crit": 2, "desc": "version word (lowercase)", "spans": [ [ 13674, 7 ] ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "spans": [ [ 13492, 4 ] ] }, { "id": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "conf": 1.0, "crit": 3, "desc": "JSON polymorphism runtime marker", "spans": [ [ 11625, 16 ] ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "spans": [ [ 4500, 4 ] ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 19038, 15 ] ] }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "spans": [ [ 0, 26 ] ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "spans": [ [ 4500, 4 ] ] } ], "type": "pe" }, { "id": 6, "sha": "014be50bead1e534b5c4260670332bbcb06ae1ba2fd5ee8f297a47d7605c8765", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Elarion.Settings/Elarion.Settings.0.2.4-preview.90.1.nupkg!![Content_Types].xml", "size": 582, "type": "xml", "depth": 1 }, { "id": 7, "sha": "02bbf58bf52f7402097da345194941fec81246d2279f47a505a878fcd53a6b20", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Elarion.Settings/Elarion.Settings.0.2.4-preview.90.1.nupkg!!package/services/metadata/core-properties/4d58f3ee638c43659346b70958d4b8bc.psmdcp", "size": 925, "type": "xml", "depth": 1 }, { "id": 8, "sha": "90ee18c6c30af8e71ff6bab53681c933cf32ac56ab7cc94796cc219913a52a66", "path": "Elarion.Settings@0.2.4-preview.90.1.registry.json", "size": 1004, "type": "registry", "depth": 1 } ], "omitted_files": 3, "rev": "2fd29", "v": "8" } }