{ "llm": { "conf": 0.5505989, "grade": "benign", "model": "Qwen/Qwen3.6-27B", "outcome": "benign", "interpretation": "Legitimate industrial protocol library" }, "ml": { "v": "7", "eng": "2.4.0", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.24580659, "rte": "az", "prob": 0.24580659 }, { "cls": 0, "raw": 0.0024475753, "rte": "az/nupkg", "prob": 0.0024475753 } ], "prob": 0.35799843, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.35799843072891235, "type": "nupkg" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.000012814998626708984, "type": "xml" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.000011483828529890161, "type": "xml" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.35799843072891235, "type": "pe" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.000012248754501342773, "type": "xml" }, { "id": 5, "lvl": -1, "conf": 0, "prob": 0.000012814998626708984, "type": "xml" }, { "id": 6, "lvl": -1, "conf": 0, "prob": 0.000022530555725097656, "type": "registry" } ], "version": "v18.18", "analyzed_at": "2026-07-28T17:25:01Z" }, "path": "LFDCC.IEC60870.CS101.4.0.2.nupkg", "raw": { "files": [ { "id": 0, "ctx": [ { "b": "p!H([6Awak2MN^){GRWwPiAGu00900000xb003wDwO=Ave]\u003eJtBcI!\u003ey63abm=dGu:H!#x7SUI-i]++qc*H$C\u003efB(9XSxj:YdT\u003can?4aPieu$(e.q{qQap[}OVKQ]3)S18{1x)kZ9COr[oM@{9:/WNi#=J1m%3J", "n": [ { "c": 2, "d": "Archive contains an executable member", "i": "metadata/file/metrics::archive-contains-executable-member", "o": 0, "z": 31, "cf": 0.949999988079071 } ], "ln": 0 } ], "mol": "H(Cm)Md₂(BiPa)", "sha": "e2d6f477fca53f9bc6dac26fab6aade27b1e91422653ab456a538ab611dd26a6", "path": "LFDCC.IEC60870.CS101.4.0.2.nupkg", "risk": 4, "size": 50915, "type": "nupkg", "facts": { "metrics": { "file": { "size": 50915.0, "entropy": 7.96, "size_bytes": 50915.0 }, "binary": { "overall_entropy": 7.96, "peak_region_bytes": 47104.0, "peak_region_entropy": 7.84 }, "archive": { "file_count": 6.0, "member_count": 6.0, "script_count": 0.0, "zip_bomb_ratio": 2.57, "directory_count": 0.0, "executable_count": 1.0, "extra_field_size": 0.0, "noise_file_count": 0.0, "total_compressed": 50075.0, "compression.ratio": 0.47, "hidden_file_count": 2.0, "total_uncompressed": 107314.0, "crc_collision_count": 0.0, "entry_comment_count": 0.0, "max_filename_length": 81.0, "rtlo_filename_count": 0.0, "format.regular_count": 6.0, "nested_archive_count": 0.0, "path_traversal_count": 0.0, "symlink_escape_count": 0.0, "security.setgid_count": 0.0, "security.setuid_count": 0.0, "security.sticky_count": 0.0, "double_extension_count": 0.0, "duplicate_member_count": 0.0, "security.symlink_count": 0.0, "unicode_filename_count": 0.0, "homoglyph_filename_count": 0.0, "security.encrypted_count": 0.0, "timing.mtime_unique_count": 2.0, "timing.mtime_unique_ratio": 0.33, "misplaced_executable_count": 1.0, "timing.mtime_outlier_count": 1.0, "timing.mtime_dominant_count": 5.0, "timing.mtime_spread_seconds": 25170.0, "timing.sentinel_mtime_count": 0.0, "security.world_writable_count": 0.0, "timing.mtime_dominant_fraction": 0.83, "compression.method_counts.stored": 1.0, "compression.method_counts.deflate": 5.0 } } }, "ident": { "name": { "value": "LFDCC.IEC60870.CS101", "source": "nupkg.title", "verified": false }, "trust": "unsigned", "authors": [ { "name": "LFDCC", "role": "author", "source": "nupkg.authors" } ], "version": { "value": "4.0.2", "source": "nupkg.version", "verified": false }, "identifier": { "value": "LFDCC.IEC60870.CS101", "source": "nupkg.id", "verified": false } }, "traits": [ { "id": "metadata/binary/anomaly/provenance::pe-far-future-timestamp", "conf": 0.949999988079071, "crit": 2, "desc": "PE COFF timestamp encodes a future date" }, { "id": "metadata/binary/metrics/entropy::code-entropy-at-most-7-5", "conf": 0.699999988079071, "crit": 1, "desc": "Code entropy is 7.5 or lower", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/communications/socket/create::tcpclient-dotnet-str", "conf": 0.8500000238418579, "crit": 3, "desc": ".NET TcpClient class reference", "from": [ { "file": 3 } ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 3, "desc": "PE version metadata includes FileVersion", "from": [ { "file": 3 } ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET managed assembly", "from": [ { "off": 38632, "file": 3 } ] }, { "id": "metadata/build/reproducible::pe-reproducible-build", "conf": 1.0, "crit": 2, "desc": "Built with /Brepro (deterministic)" }, { "id": "metadata/package/versioning::pe-filedescription-field", "conf": 0.699999988079071, "crit": 3, "desc": "PE version metadata includes FileDescription", "from": [ { "file": 3 } ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET metadata root signature (BSJB)", "from": [ { "file": 3 } ] }, { "id": "metadata/package/versioning::pe-companyname-field", "conf": 0.699999988079071, "crit": 3, "desc": "PE version metadata includes CompanyName", "from": [ { "file": 3 } ] }, { "id": "metadata/binary/layout::pe-no-signature-record", "conf": 0.949999988079071, "crit": 3, "desc": "PE has no signature record" }, { "id": "metadata/package/versioning::pe-internalname-field", "conf": 0.699999988079071, "crit": 3, "desc": "PE version metadata includes InternalName", "from": [ { "file": 3 } ] }, { "id": "metadata/package/versioning::pe-productversion-semver-git-hash", "conf": 0.8999999761581421, "crit": 3, "desc": "PE ProductVersion has SemVer git hash" }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR header (COM descriptor)" }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "from": [ { "file": 3 } ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 3, "desc": "PE version metadata includes ProductVersion", "from": [ { "file": 3 } ] } ] }, { "depth": 1, "facts": { "metrics": { "file": { "size": 510.0, "entropy": 5.24, "size_bytes": 510.0 }, "binary": { "overall_entropy": 5.24, "peak_region_bytes": 510.0, "peak_region_entropy": 5.24 } } }, "id": 1, "path": "LFDCC.IEC60870.CS101.4.0.2.nupkg!!_rels/.rels", "pid": 0, "sha": "1e651ebae1c1ad0f363a4b92a041b22102548f650dfc2289a525ab364d0029f6", "size": 510, "type": "xml" }, { "ctx": [ { "b": "[4ls%kx}3YaA?spB7]MgjT8QkfD}SJzEWP}x(mMDb6w0teJs}sj{\u003cz\u003evpK7YxjSigzes9hjTaMYBz%n]flpSpwO\u003e\u003c%e]trjA=l2qw]]Unz/4dDvpK7Yxk8l@fetjogCpBtfk+]NAaJJiCYNytj{\u0026zPjz!UKvpS!*vlL2varR^?x\u003efz3mNPQhe\u003eFG0hzv9HfFkZ\u003ef!+sAfkj@X3lQDlauT*UA=U@kzAY)ffFkayflQ]EB7]Mgj{\u0026zParS^PB-.qnA=TArmNPQhjtgb=BzbPkB3o{NarR^?y?Wx\u003czGxwiBA}?pjTaDZAb]JhB7]Mgb0FZ)r6h*Ix\u003e7Z(B7EJxarR^HjzX.wwO#N2rDq[txMOunB2\u003e%cy?Wx\u003czGxxge]C/AwPPLyA+v41nMm/9y?Wx\u003czGxw?A+)]DarR^Hjy\u00262Av@=p5BzkVhk1Oggat$]kh.V*veIO}laAhvtBz\u003eVcy-)LdvSC)$C{1IAvqGv\u0026v}xg7B-7U%y*?i\u003ewN({1x(mYey*?Q2AX5tOwPzG[y-)e7wfs\u0026sp-%\u003e2vqZd9z/P}Jay/k4wO#PyB7GxnwPxjxvS=y3BrCHtaw20?hzv9HfFk.hA+c\u003c=fjXTnv@=p5BzkVhj{\u0026zParS^Rz/x#xx\u003eIa3k0%mcD2^RixMLvLfFUKeoH.AqlP^2iz/x#xx\u003eIa3j{\u0026zParS^!wPhNex([olC{4iOAaIfRxk8Diay/tbze18Pa#?wpvMm[diw\u003ek8hEOKMi5$IYixpObiwC87iauzUvp?CUfL9g3g:j4}j{\u0026zParS^SwPhi#wmYT*x\u003equH3lQDlarR^?xl4{kA3fmhA+w%9mSI{OwP@6kyDS\u003eVwPP):fD@W/arR^HarR^Hjy\u00262xwO#3\u0026zEW@mx\u003efvJoH.AqlOp@0lPcRTh.V\u003cKz/PzkaA?spB7]MgjT8ZnfFka8az2!cy\u0026%o1jT9jnx(4rhl2HaED3T4xB0q.Wj{\u0026zParR^HarS^SwPhi#wmYT*C{3*ijT9*IB97#ge\u003eF?\u003ep\u0026yw@B0q-IwPz\u003caz/dYZi4=)qfD}SJCW\u003eMjwmW[FluN0UwgQ2:vqHjnwPz\u0026oatk[=arR^HarR^Hjy\u00262xwO#3\u0026zEW@mx\u003efvJrbV[?xJ5?VyH}PiaA?spB7]MgjT8WmfFkd9az2!cy\u0026%o1jT9jnx(4rhl2HaED3T4xB0q.Wj{\u0026zParR^Hjtgt/z/{1.3lQDlauRq/wPhi#wmYT*x\u003eqt", "n": [ { "c": 2, "d": "NuGet nuspec manifest file", "i": "metadata/build/manifest::nuspec-file", "o": 0, "z": 27, "cf": 0.9800000190734863 }, { "c": 2, "d": "NuGet package declares dependencies", "i": "metadata/package/files/nuget::nuspec-dependencies", "o": 42, "z": 829, "cf": 0.8999999761581421 } ], "ln": 0, "col": 1, "line": 1 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 993.0, "entropy": 5.2, "size_bytes": 993.0 }, "binary": { "overall_entropy": 5.2, "peak_region_bytes": 993.0, "peak_region_entropy": 5.2 } } }, "id": 2, "path": "LFDCC.IEC60870.CS101.4.0.2.nupkg!!LFDCC.IEC60870.CS101.nuspec", "pid": 0, "risk": 1, "sha": "382b517dfe6d289870cfbccdabc21e3623a5e17a03383f0826eb2ebfa82cc4a3", "size": 993, "traits": [ { "id": "metadata/package/files/nuget::nuspec-dependencies", "conf": 0.8999999761581421, "crit": 2, "desc": "NuGet package declares dependencies", "spans": [ [ 42, 829 ] ] }, { "id": "metadata/build/manifest::nuspec-file", "conf": 0.9800000190734863, "crit": 2, "desc": "NuGet nuspec manifest file", "spans": [ [ 0, 27 ] ] }, { "id": "metadata/package/files/nuget::nuspec-repository", "conf": 0.8999999761581421, "crit": 2, "desc": "NuGet package declares repository", "spans": [ [ 42, 530 ] ] } ], "type": "xml" }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J\u0026m(0ji6Sa?dLD+]{51x(+zoA=kPhvqNb%vqY$3BrC47aAzQxazCZol@c-7zeS@@e!5l%bME/A00000p^\u003eu:oA", "n": [ { "c": 2, "d": "PE contains exactly one resource entry", "i": "metadata/binary/resource::pe-single-version-resource", "o": 0, "z": 24, "cf": 1.0 } ], "ln": 0 }, { "b": "000000000000000kMy^J00000000000000000000CZow\u003c00000nb@R\u00260SSx7\u003e^gr\u0026AkR.R0rr91000000000000000000000000000000000000000000000000000000000000000009S^-b000uQ9S*V?000cKa{4\u003c{0rr95dJOUr0SSi6dK1]@Ef6xG1s+C]DJKlF1s+O%1apmK00B+)0W[(=017g%0W[rO00T[]0W[rO00T][0W[rO00SGbc\u003c6CH1{a]Q1POJb0Tf$S000iMdGPXO6ETs?00T]50S@Mtc\u003c{1P1$BS{c\u003cP!M1{a(P0@@r90T6[P000i81T\u003cPQ00T]50S@Jsc\u003eljS1$z870%xq^4GDFkdJOTt7YTKydJOUr1onA8dK1]@EfoJI1s+C]DJ:xH1s+O%1apsM00B+)0^+aK00B+}0T0\u0026P000cK9S^-b000uQ9S*V}000cKiSZYD000uc1apHR00B+)0^+pP00B+}0T0\u0026U000cK9S^-c000uQg6h!i000du[bJB)dMduP4fcwh18)Yf00T[M6efE/kl7V-0rr9i5=:r#000vO3\u0026{th5=.#Y4flCi5=-2Z4GMLj5=-U{3JQkg5=^p/0rrln04m\u003cF04OVZD\u003c*2Q1sLk\u0026017h10Vcm%000cKhuFjm000c7zV{dw1$xPM6efH*-Sb#s0SSijBcV?b1{$LoEf]#P1oJ]U000cFeDWsI1T\u003ew\u003e015=r0vO#?017p.A#$wZ3m=q.c)eG\u00263vJr.", "n": [ { "c": 1, "d": "No section reaches compression-grade entropy", "i": "metadata/binary/metrics/threshold::no-compression-grade-section", "o": 512, "z": 512, "cf": 0.8999999761581421 } ], "ln": 480 }, { "b": "1oJ$B0rrlJY-n3tdGxCG0t2kh000Ge-):#ag5}pPhuFo20rrl8d82VY3mV2Qlq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCnekDlCbyPQ)M})XZl[[Vwbu5Y8x(mN800000*\u003c/w85gvIUbumUx)5f):5c8Xgbs+:9l\u0026Wh!@hoO}Bq\u003ehW", "n": [ { "c": 2, "d": ".NET metadata root signature (BSJB)", "i": "metadata/binary/framework::dotnet-metadata", "o": 38632, "z": 4, "cf": 1.0 } ], "ln": 38584 }, { "b": "wODs0wiKKhuO.WAqGV\u003eJz/oOXB9RUkk4F2cf/e\u003e)lVl\u003cWwN/*FB9RUkk4F2cf/e\u003e)q/(C*Bu%$[zEU\u003evuTCJA06B+kB3qD*uO?:BqE%oEmSI{OwKgx.zEU\u003evuTCJB07I9Gv{?d]", "n": [ { "c": 1, "d": ".NET ConnectAsync method token", "i": "micro-behaviors/communications/http/websocket::connect-async-method-token", "o": 59722, "z": 12, "cf": 0.8199999928474426 } ], "ln": 59690 }, { "b": "mm*JGuSfxXr7P\u003eX08=lMmm*JKpdFU\u0026mmg3CpFH)?qBa5Ro?wq\u003eq:\u003c5MnL-7Yq*ACawO\u003c4\u003epxk3sByd)ypYLctByd%lq2\u003eluBydZuq2\u003eluBydBcqug=HBydBcqufJ\u003epGgaSpFta:qC{p*0b2\u003e+uQEv.08((+lQ:{L08=l:mo0R]q:\u003cO\u003ep/p7Rmn)a+qBKC.mf", "n": [ { "c": 2, "d": ".NET core namespace reference", "i": "metadata/lang/compiler/managed::system-namespace", "o": 60853, "z": 9, "cf": 0.800000011920929 } ], "ln": 60805 }, { "b": "o\u003ewx!vp%cKzdN^fvp%cKlVl*Xvrb{FCW\u003ez}zF9IXmq=TczGY@lwDk5dxk8lPzGY@lwDkqyrDz.(l$7gClU{gLB1]$7vqfK^vR/PQnPN)MwPygEByvKMvrlGBl3uWJy**^?wDkp\u003clPcRTh.V\u003cKqV", "n": [ { "c": 1, "d": "BeginInvoke member-name token", "i": "micro-behaviors/process/interpreter/reflection/runtime::begin-invoke-token", "o": 63481, "z": 11, "cf": 0.699999988079071 }, { "c": 1, "d": "EndInvoke member-name token", "i": "micro-behaviors/process/interpreter/reflection/runtime::end-invoke-token", "o": 63471, "z": 9, "cf": 0.699999988079071 } ], "ln": 63439 }, { "b": "vr\u003e*^zdJYCD2[7sz7X.ezGGPfwDk!Lx()]Wx(mFZlVl*Jx(mFZnKmAyzEVQ!vru6PvpJ$+zE\u0026/CB-7c1vru6PvpJ$+zE\u0026/DwPQ\u003c)vru6PvpJ$+zE\u0026/?Byxo5o\u003c}KBx(mF", "n": [ { "c": 1, "d": "Combine method-name token", "i": "micro-behaviors/data/string/library::dotnet-combine-method-token", "o": 64141, "z": 7, "cf": 0.7200000286102295 } ], "ln": 64109 }, { "b": "z/Py?nOq{VA+bkHwPz%9AZBhQwDkXtA8Qs?B7]MglU{EFzGFiNB7CtHwO+{^B7Ct}vqf*$zF8BSA-cE\u0026AbPSnwDk8lz/YE\u0026l${ZYz/YE\u0026m}D^ix(4uGvru5XxjVf(lsC1EqEG", "n": [ { "c": 1, "d": "References WCF ClientBase class", "i": "micro-behaviors/communications/ipc/wcf::dotnet-wcf-clientbase", "o": 64388, "z": 10, "cf": 1.0 } ], "ln": 64356 }, { "b": "A+PSb07gWwAa%c1AZ%XUwPzj3wN[8GBAh88B-.f{m}DNHA::63wj7oCwKgAWA+P09By+CxwO#71vruBdp*)\u003cHvp%dqBAzLqvS=^706$ZGA+P09By!D[vp%dqBAzLqvS=^707pycB.tt}vR/QwBAv", "n": [ { "c": 1, "d": "WCF generated code attribute", "i": "micro-behaviors/communications/ipc/wcf::dotnet-wcf-generated-code-attribute", "o": 64754, "z": 22, "cf": 0.8999999761581421 } ], "ln": 64722 }, { "b": "B7]o8vqC{fAbYxawk3YVwPzi}07ggjv}xDRuVYZ\u003cyYE3}lPcRTh.V\u003cKq.Y%Xe[w^m07?liB7GwWvrt{By*?yaf\u0026r78B.a3+y?%8yB5^o)AZTtTvma\u003ctB8%9lB.bYbmS\u0026J-07gWxBAhqo0b2\u003e+uQwgxwM9X\u003ewNPAQuVP!0x\u003c\u003e*RBAg@3z2^{:BAg@3", "n": [ { "c": 2, "d": ".dll extension reference", "i": "micro-behaviors/fs/path/extension::dll-dup", "o": 66310, "z": 4, "cf": 0.5 } ], "ln": 66262 }, { "b": "wN/*@z/bL)B.$P0A.*pCwN/*@z/bLAx(4uOvrlJ?wOk\u003c\u003ezGFV{q!oDXx(v\u003e?q*ACawO\u003c4$wOb:\u0026v@#B6zu8$kwk^qMC4B3VzF\u003c2}BzkVh07QQxq/2(=wKyxNzE)s1x(v\u003e?zddHcwPydRzF\u003c2}BzkVh07/K]x\u003eqg7lVl\u003cWwN/*@z/bL+z/fD7v@#B6zua-?v@#B6zu9QDzu", "n": [ { "c": 2, "d": ".NET System.Reflection namespace reference", "i": "metadata/lang/compiler/managed::reflection-namespace", "o": 66896, "z": 17, "cf": 0.699999988079071 } ], "ln": 66848 }, { "b": "wMi8VyFwwZxM4AFB.LV5wPv=kk6gdsvS=y3wmY=YB7Gl1wPv=TB7Gl1luM)LwPv=sx(^=)A+4:VluM)LwPv=vwPQmYw[CQ{0aH7.w[t#.l1j+MBvG$XwMiXUzGxA3ASu", "n": [ { "c": 1, "d": "Notification-related notify or sender keyword", "i": "micro-behaviors/ui/window/notify/keywords::notification-config-word", "o": 67514, "z": 6, "cf": 0.8600000143051147 } ], "ln": 67482 }, { "b": "vqYQ(wPv=VB7xz:vqYQ(wPv=HwPQyQy?lHQvpTTOvqYQ(wPv=.x(4uUwNPa{nmuyDy?mR!xKL^?y?mR!q*ACawO\u003c4!z!9AEz/49]z/6Dcy?mR!mPq8$mSI{OwPv=DCwZ#j0crl\u003cBy^*MvqYZ?wkDYPvqPN$wPv=(Byxo5lUG[CxjUQvvqG:?vpK7Hvrb^[wPRH70chTVwjQcDwnC*$p*[xMzdN*2ASxJ?woy^Yv}xv$wN[tuzE^M{A.{g+vqPN$wPv=\u003ewN/p=C4Cg", "n": [ { "c": 3, "d": ".NET dynamic code generation capability", "i": "metadata/lang/compiler/managed::dotnet-dynamic-code", "o": 68325, "z": 23, "cf": 0.8500000238418579 } ], "ln": 68261 }, { "b": "mriA!ASwQvBvy7\u0026zdN-@Bz(g1e[o0wASw*LzFsihASyh}zdNTdBwl/Rw[b(Zq*ACawO\u003c4/x\u003c\u003eT(z/Z2mv@?SHz=HW?CVnx]wLD(Py?W%4v@Dl}A@Yc:B97#ge(D?fBzkP6e\u003eG@5wPzZdq!o#)x\u003e7Z}08[e:By/qwqGV(0x(dAllVl*Xx(4v3q!o#)x\u003e7Z}07pycB.tu3zF8WZwmY/Zwn=vcq!o\u0026So\u003ewx!vp%d)07QQxl3uWJy**^?wKZxIwPE\u0026WC4293vpB4:mRMWI", "n": [ { "c": 2, "d": ".NET System.Diagnostics namespace reference", "i": "metadata/lang/compiler/managed::diagnostics-namespace", "o": 69266, "z": 18, "cf": 0.75 }, { "c": 2, "d": ".NET interop services reference", "i": "metadata/lang/compiler/managed::runtime-interop", "o": 69308, "z": 30, "cf": 0.75 } ], "ln": 69218 }, { "b": "B9hqv0chT(B.(d1nO8x^fFL}hx\u003eqg707HWswKyoFwO#O\u0026w[=6)lU{EFzGC\u003eTv@LvTB8#5lzBnkOwO#O\u0026rax(my?WD#Bo26ECscgXwO#O\u0026m}D^hy?mD{zGC\u003eSwO#3SwOk\u003c\u003ezGC\u003eFx(4uVwOk\u003c\u003ezGC\u003e\u003ewPRoMwO#d5xISkswOk\u003c\u003ezGC\u003eSwO#3LvrlJ?wOk\u003c\u003ezGC\u003e\u003ewPRoDB-IIlzGC\u003e\u003ewPRoDz/]@t0afkOB-8p3xjVf(lVm5DB7GD2lVm5Dv/", "n": [ { "c": 3, "d": ".NET TcpClient class reference", "i": "micro-behaviors/communications/socket/create::tcpclient-dotnet-str", "o": 70604, "z": 9, "cf": 0.8500000238418579 } ], "ln": 70540 }, { "b": "0ce6J0aM1J0b?\u003cT0c[L!0ce6J0aM1u0bhBR0a=dv001/D0a=du05jEc05jEv0bITH0a=dF0cwh-0bITN0b?\u003cR03znM0ce6W0b?\u003cT06g95001/D0a=du05jEc05jEL0a=dJ0cOuN0ce5Z0bITN0b?\u003cR03znM0ce6W0b?\u003cT06g95002O*07u(P09f7X03znu09G", "n": [ { "c": 2, "d": "Detects loop/jump control transfer in assembly", "i": "micro-behaviors/crypto/symmetric/xor/loop::asm-loop-control-transfer", "o": 79653, "z": 10, "cf": 0.699999988079071 } ], "ln": 79605 }, { "b": "l${ZYy*?P:vqPMYe(1\u0026maug#c3ipbgoH.AqlJv8{0rrv5wO+{^B7CsK836ZKlVl{?A+Pf1BrAs)gbZmGmNPQh004L90rvU4nKU#?hzv9HfFbdlf!+s8Ab](sz!0Z4az++3A::0lasHYcy*?i\u003ewN)DpzEN3\u003cvqYN^wftY5zFHwhvr(B8efG1BA+O@#ayPd#ao", "n": [ { "c": 2, "d": "Copyright notice", "i": "metadata/package/license::copyright-word", "o": 86823, "z": 9, "cf": 0.6000000238418579 } ], "ln": 86775 }, { "b": "UJy^{k#gCX003Kg09rcrBZ]8-z!0M]Bs]}0A+c\u003e4z/{8gwK*rHwPzj3z/NxKr+lq)x(v(LgCgvlgCgvjavyo/BAIRnj-j?NBAg/aefE=ivR/:*oj-xFz!\u0026{4j-kyUyZh:GfFkdlfAq7R0rrc200\u0026P93JHeb000000000005tg5?2EEIpYZQ%0c4#s0iyCD0ixx90000", "n": [ { "c": 2, "d": "IPv4-like .NET assembly version", "i": "metadata/lang/compiler/managed::dotnet-ipv4-like-version", "o": 88839, "z": 15, "cf": 0.8500000238418579 } ], "ln": 88791 }, { "b": "0000000000000000000000000000000000000000000000000000000000315c8Xg7YTL^000000000000000000310rr91fAq960000000000000000003100000nb@R\u0026sBZzLGAInP0000000000GAKai00341qVHe8rSCL*qufR}nDqJ^p5[S3nDqG=mGui:00000Y-^*600031000c400062000c400062kl7V-000001onA40SSi2000000000000000l\u0026Wh!0rud2ve$rFmGvc5yYF2DnDrSdw=", "n": [ { "c": 2, "d": "PE version resource metadata", "i": "metadata/package/versioning::version-resource-metadata", "o": 89694, "z": 15, "cf": 0.8999999761581421 }, { "c": 1, "d": "PE resource section", "i": "metadata/binary/section/names::pe-resource-section", "o": 89600, "z": 5, "cf": 0.8999999761581421 } ], "ln": 89568 }, { "b": "006!p00031fAr^bfAr^bfAr{fvGn7Z0015vG8+]LlJz38z2!zMwDlPFBo3vZ002N\u003cmf2WPaojq1fAs6jhVLJieDvTdeDvH9fAr*caoluXASy1TBo3jVv/QAEyYCNTyYFeH", "n": [ { "c": 1, "d": "Several short title-cased resource strings", "i": "metadata/binary/resource::short-titlecase-resource-words", "o": 89914, "z": 8, "cf": 0.800000011920929 } ], "ln": 89882 }, { "b": "0bITz0b.^D0a=dv03znT0bhBJ0bzMS0bITz0c[MQ0ce5\u003c03zn.0a=dJ0bhBw0bIST0at\u003eB0aV6L08@}=08JUr0cwiY0at\u003eB0cncV0b?\u003cT0cwh(03znK0bITH0a=dF", "n": [ { "c": 1, "d": "Several short title-cased resource strings", "i": "metadata/binary/resource::short-titlecase-resource-words", "o": 90057, "z": 4, "cf": 0.800000011920929 } ], "ln": 90025 }, { "b": "wDl-Jdf7E\u003cvGpJJx-I@HBo0A-zVBUPaoj$kmf2WPhukAhh#\u003e(qfArZ9lJz38ASxUJe=U\u003eK001LI1][V7lJz38z2!IPve$fBC(QOtve$cAwDhYg002W)mGt*RlJxEN002E*4/=RgmGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up002N\u003cmf2WPhukAhh#\u003e(qfArZ9lJy3+f-S)cf-RgN001XM2MK(9mGvc5yYF2DrSDXhASydXx-J5Kzu6Up001?Qe=WN9e=WTbe=WN9002E*6954knDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE002N\u003cmf2WPhukAhh#\u003e(qfArZ9lJy3+f-S)cf-S*awb{ACyYBCn002:]6-XmmoAnS7x8(uuyYD*5zVB.RC(R\u003c+x-I=CxAibO002v^zVB.RC(R\u003c+x-I=CxAibOaojd%fAr\u003cdhuj\u003c1oAmJZl\u0026YNOlJv8^002:]6954kpxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE002N\u003cmf2WPhukAhh#\u003e(qfArZ9lJy3+f-S)cf-S*awb{ACyYBCn002g.4/=RgpYLIozVBqFBPt[KBo25ove$cAwDhYg002N\u003cmf2WPhukAhh#\u003e(qfArZ9lJy3+f-S)cf-RgN004PJf8#1MpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001?Qe=WN9e=WTbd/.KegxorkvGnv/wb{9tirg]pve@m!humd=hVNm^h#\u003e@swb{iwirh5tv/Ov^irg=lwDjT?h#)y/wb[Q\u0026ve%)thVL\u0026rfAtU:hVL-ogYNHQ001$U2MK(9k(+%aA@Y+Kz2!2ByYF.XaokBxwDl-JA@Y[OzVBUP001?Qe=WN9e=WTbe=WN9000000000000000000000000000000", "n": [ { "c": 3, "d": "PE version metadata includes CompanyName", "i": "metadata/package/versioning::pe-companyname-field", "o": 90202, "z": 11, "cf": 0.699999988079071 }, { "c": 3, "d": "PE version metadata includes FileDescription", "i": "metadata/package/versioning::pe-filedescription-field", "o": 90246, "z": 15, "cf": 0.699999988079071 }, { "c": 3, "d": "PE version metadata includes FileVersion", "i": "metadata/package/versioning::pe-fileversion-field", "o": 90318, "z": 11, "cf": 0.699999988079071 }, { "c": 3, "d": "PE version metadata includes InternalName", "i": "metadata/package/versioning::pe-internalname-field", "o": 90366, "z": 12, "cf": 0.699999988079071 }, { "c": 3, "d": "PE version metadata includes ProductVersion", "i": "metadata/package/versioning::pe-productversion-field", "o": 90662, "z": 14, "cf": 0.699999988079071 }, { "c": 3, "d": "PE ProductVersion has SemVer git hash", "i": "metadata/package/versioning::pe-productversion-semver-git-hash", "o": 90692, "z": 46, "cf": 0.8999999761581421 }, { "c": 2, "d": "PE OriginalFilename metadata field", "i": "metadata/package/versioning::pe-originalfilename-field", "o": 90518, "z": 16, "cf": 0.699999988079071 }, { "c": 1, "d": "PE version company name populated", "i": "metadata/package/versioning::pe-company-name-populated", "o": 90228, "z": 5, "cf": 0.8500000238418579 }, { "c": 1, "d": "PE FileDescription field is populated", "i": "metadata/package/versioning::pe-file-description-present", "o": 90280, "z": 14, "cf": 0.949999988079071 }, { "c": 1, "d": "PE LegalCopyright field is populated", "i": "metadata/package/versioning::pe-legal-copyright-present", "o": 90468, "z": 20, "cf": 0.949999988079071 }, { "c": 1, "d": "PE ProductName field is populated", "i": "metadata/package/versioning::pe-product-name-present", "o": 90624, "z": 14, "cf": 0.949999988079071 }, { "c": 1, "d": "PE FileVersion value is present", "i": "metadata/package/versioning::version-info-file-version-present", "o": 90344, "z": 7, "cf": 0.949999988079071 } ], "ln": 90138 }, { "b": "0000000000000000000000000000000000000000000000000000000000000b}@s3\u0026*ncM]UiE00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", "n": [ { "c": 2, "d": "PE .reloc section presence", "i": "metadata/binary/section/names::reloc-section-presence", "o": 91136, "z": 6, "cf": 0.8999999761581421 } ], "ln": 91088 } ], "depth": 1, "facts": { "imp": [ [ "mscoree", "CorDllMain" ] ], "sec": [ [ ".text", 512, 89088, 5.79, "r-x" ], [ ".rsrc", 89600, 1536, 2.9, "r--" ], [ ".reloc", 91136, 512, 0.1, "r--" ] ], "metrics": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "clr.is_il_only": 1.0, "resource_count": 1.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 155664.0, "reloc_overhang_bytes": 500.0, "reloc_overhang_ratio": 0.98, "clr.is_32bit_required": 0.0, "bss_like_section_count": 0.0, "clr.is_32bit_preferred": 0.0, "clr.strong_name_signed": 0.0, "section_overflow_count": 0.0, "clr.is_native_entrypoint": 0.0, "misaligned_section_count": 0.0, "version.identity_entropy": 3.44, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0, "version.identity_symbol_ratio": 0.55 }, "file": { "size": 91648.0, "entropy": 5.73, "size_bytes": 91648.0 }, "binary": { "is_pie": 1.0, "code_entropy": 5.79, "string_count": 919.0, "overall_entropy": 5.73, "entropy_variance": 5.4, "avg_string_length": 20.16, "max_string_length": 130.0, "peak_region_bytes": 4096.0, "code_to_data_ratio": 1.0, "peak_region_entropy": 6.15, "string_length_stddev": 14.74, "largest_section_ratio": 0.97, "sentence_string_count": 151.0, "sentence_string_ratio": 0.16, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 89088.0, "entropy_max": 5.79, "entropy_mean": 2.93, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } } }, "id": 3, "mol": "H(Cm)Md₂(BiPa)", "path": "LFDCC.IEC60870.CS101.4.0.2.nupkg!!lib/net8.0/IEC60870.CS101.dll", "pid": 0, "risk": 4, "sha": "952b91be4e997fff7fd932c317baee095ad48d847f6aa39cc821c386277f5d95", "size": 91648, "traits": [ { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR header (COM descriptor)" }, { "id": "metadata/binary/metrics/entropy::code-entropy-at-most-7-5", "conf": 0.699999988079071, "crit": 1, "desc": "Code entropy is 7.5 or lower", "spans": [ [ 0, 26 ] ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 89694, 15 ] ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET metadata root signature (BSJB)", "spans": [ [ 38632, 4 ] ] }, { "id": "metadata/build/reproducible::pe-reproducible-build", "conf": 1.0, "crit": 2, "desc": "Built with /Brepro (deterministic)" }, { "id": "micro-behaviors/communications/socket/create::tcpclient-dotnet-str", "conf": 0.8500000238418579, "crit": 3, "desc": ".NET TcpClient class reference", "spans": [ [ 70604, 9 ] ] }, { "id": "metadata/package/versioning::pe-companyname-field", "conf": 0.699999988079071, "crit": 3, "desc": "PE version metadata includes CompanyName", "spans": [ [ 90202, 11 ] ] }, { "id": "metadata/package/versioning::pe-internalname-field", "conf": 0.699999988079071, "crit": 3, "desc": "PE version metadata includes InternalName", "spans": [ [ 90366, 12 ] ] }, { "id": "metadata/package/versioning::pe-filedescription-field", "conf": 0.699999988079071, "crit": 3, "desc": "PE version metadata includes FileDescription", "spans": [ [ 90246, 15 ] ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 3, "desc": "PE version metadata includes FileVersion", "spans": [ [ 90318, 11 ] ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 3, "desc": "PE version metadata includes ProductVersion", "spans": [ [ 90662, 14 ] ] }, { "id": "metadata/package/versioning::pe-productversion-semver-git-hash", "conf": 0.8999999761581421, "crit": 3, "desc": "PE ProductVersion has SemVer git hash", "spans": [ [ 90692, 46 ] ] }, { "id": "metadata/binary/anomaly/provenance::pe-far-future-timestamp", "conf": 0.949999988079071, "crit": 2, "desc": "PE COFF timestamp encodes a future date" }, { "id": "metadata/binary/layout::pe-no-signature-record", "conf": 0.949999988079071, "crit": 3, "desc": "PE has no signature record" }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET managed assembly", "spans": [ [ 38632, 4 ] ] } ], "type": "pe" }, { "depth": 1, "facts": { "metrics": { "file": { "size": 459, "entropy": 4.83 }, "binary": { "peak_region_bytes": 459, "peak_region_entropy": 4.83 } } }, "id": 4, "path": "LFDCC.IEC60870.CS101.4.0.2.nupkg!![Content_Types].xml", "pid": 0, "risk": 1, "sha": "3dae54f1e2761fb41379f8d05e7fdb903b62ecd0ec1c65fc68fd02c91c3671cf", "size": 459, "traits": [ { "id": "metadata/file/extension/identity::doc-or-config-extension", "conf": 1.0, "crit": 2, "desc": "Text, document, or config extension" } ], "type": "xml" }, { "id": 5, "sha": "9177214f0e2114d12819c29ddc3d8033ea070c2703957852b7ee976a3c058f16", "path": "LFDCC.IEC60870.CS101.4.0.2.nupkg!!package/services/metadata/core-properties/e14014f5d8cf46afa0073eb8f7ba13a0.psmdcp", "size": 724, "type": "xml", "depth": 1 }, { "id": 6, "mol": "Md", "sha": "d65d18344ee80c2e2e5d1939e9706ee0b7cf801c85c5ea06aa4445df08726ed1", "path": "LFDCC.IEC60870.CS101@4.0.2.registry.json", "risk": 1, "size": 914, "type": "registry", "depth": 1 } ], "omitted_files": 2, "rev": "02e2e", "v": "8" } }