{ "llm": { "conf": 0.82810575, "grade": "benign", "model": "Qwen/Qwen3.6-27B", "outcome": "benign", "interpretation": "Legitimate .NET library strings" }, "ml": { "v": "7", "eng": "2.3.0-beta.0", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.7544368, "rte": "az", "prob": 0.7544368 } ], "prob": 0.7544368, "skip": [ { "rte": "az/zip", "why": "unavailable" }, { "rte": "az/zip", "why": "unavailable" } ], "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.7544367909431458, "type": "nupkg" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.00012001395225524902, "type": "xml" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.008743494749069214, "type": "xml" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.683881938457489, "type": "pe" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.683881938457489, "type": "pe" }, { "id": 5, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "xml" }, { "id": 6, "lvl": -1, "conf": 0, "prob": 0.00012001395225524902, "type": "xml" }, { "id": 7, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "registry" } ], "version": "v18.18", "analyzed_at": "2026-07-09T11:30:44Z" }, "path": "FlowtideDotNet.Connector.Kafka.0.16.0-alpha9.nupkg", "raw": { "files": [ { "id": 0, "mol": "O(Al)H(Db)", "sha": "eba944bff8e05f292b6d39fd9fa68f126285435100074a60f3131cd3434a2bdc", "path": "FlowtideDotNet.Connector.Kafka.0.16.0-alpha9.nupkg", "risk": 3, "size": 53023, "type": "nupkg", "facts": { "metrics": { "file": { "size": 53023.0, "entropy": 7.96, "size_bytes": 53023.0 }, "binary": { "overall_entropy": 7.96, "peak_region_bytes": 50176.0, "peak_region_entropy": 7.8 }, "archive": { "file_count": 7.0, "member_count": 7.0, "script_count": 0.0, "zip_bomb_ratio": 5.23, "directory_count": 0.0, "executable_count": 2.0, "extra_field_size": 0.0, "noise_file_count": 0.0, "total_compressed": 51963.0, "compression.ratio": 0.51, "hidden_file_count": 2.0, "total_uncompressed": 101284.0, "crc_collision_count": 0.0, "entry_comment_count": 0.0, "max_filename_length": 81.0, "rtlo_filename_count": 0.0, "format.regular_count": 7.0, "nested_archive_count": 0.0, "path_traversal_count": 0.0, "symlink_escape_count": 0.0, "security.setgid_count": 0.0, "security.setuid_count": 0.0, "security.sticky_count": 0.0, "double_extension_count": 0.0, "duplicate_member_count": 0.0, "security.symlink_count": 0.0, "unicode_filename_count": 0.0, "homoglyph_filename_count": 0.0, "security.encrypted_count": 0.0, "timing.mtime_unique_count": 4.0, "timing.mtime_unique_ratio": 0.57, "misplaced_executable_count": 2.0, "timing.mtime_outlier_count": 3.0, "timing.mtime_dominant_count": 4.0, "timing.mtime_spread_seconds": 25124.0, "timing.sentinel_mtime_count": 0.0, "security.world_writable_count": 0.0, "timing.mtime_dominant_fraction": 0.57, "compression.method_counts.stored": 1.0, "compression.method_counts.deflate": 6.0 } } }, "ident": { "name": { "value": "FlowtideDotNet.Connector.Kafka", "source": "nupkg.title", "verified": false }, "trust": "unsigned", "authors": [ { "name": "FlowtideDotNet.Connector.Kafka", "role": "author", "source": "nupkg.authors" } ], "version": { "value": "0.16.0-alpha9", "source": "nupkg.version", "verified": false }, "identifier": { "value": "FlowtideDotNet.Connector.Kafka", "source": "nupkg.id", "verified": false } }, "traits": [ { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "conf": 1.0, "crit": 3, "desc": "JSON polymorphism runtime marker", "from": [ { "file": 3 } ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "from": [ { "file": 3 } ] }, { "id": "metadata/package/versioning::version-word-lower", "conf": 0.4000000059604645, "crit": 2, "desc": "version word (lowercase)", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/data/db/linq::linq-queries", "conf": 0.699999988079071, "crit": 3, "desc": "LINQ query operations", "from": [ { "file": 3 } ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "from": [ { "file": 3 } ] }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "from": [ { "file": 3 } ], "spans": [ [ 0, 26 ] ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "from": [ { "file": 3 } ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "from": [ { "file": 3 }, { "file": 4 } ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "from": [ { "file": 3 } ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "from": [ { "file": 3 } ] } ] }, { "depth": 1, "facts": { "metrics": { "file": { "size": 520.0, "entropy": 5.19, "size_bytes": 520.0 }, "binary": { "overall_entropy": 5.19, "peak_region_bytes": 520.0, "peak_region_entropy": 5.19 } } }, "id": 1, "path": "FlowtideDotNet.Connector.Kafka.0.16.0-alpha9.nupkg!!_rels/.rels", "sha": "63a5a9f6e4cf2526a311c2ff27cd21b258a2b95c127cbc9a7884b055d371849d", "size": 520, "type": "xml" }, { "ctx": [ { "b": "[4ls%kx}3YaA?spB7]MgjT8QkfD}SJzEWP}x(mMDb6w0teJs}sj]", "n": [ { "c": 2, "d": "NuGet nuspec manifest file", "i": "metadata/build/manifest::nuspec-file", "o": 0, "z": 37, "cf": 0.9800000190734863 } ], "ln": 1, "addr": 0 }, { "b": "jAa.syHH\u003c!aB4:tzGv@+xMOuniXJdcv}YB\u003cvrj5rx\u003e8g4B8LVje[n*pfk$ufyHH\u003c\u0026zF7QTfFLvpfF$I3B-RIkv\u003eJ1EwfKh", "ln": 2, "addr": 42 }, { "b": "arS^-wPRu\u003evrt{w", "ln": 3, "addr": 118 }, { "b": "arR^HjyJwOxM4{jk1ovbCxvLfwKHDUpgXJ1lVl\u003cWwN/?2AXp0[w[$*qfjx0BxM4{jj]", "ln": 6, "addr": 212 }, { "b": "arR^Hjy\u00262Av@=p5BzkVhk2tV$yHH\u003c!avG^Zv@=p5BzkVhjtgkRB7ol8Acb/jzAX", "ln": 7, "addr": 266 }, { "b": "arR^HjAt1Lz/YSmz/QaCBA}?pjTaJMBrR\u0026qz/6u9BuH*agg-pMh8eV2whlb2fFD@\u003cgDn\u00266hEOvKgbp\u003e1hA0JOwNP78i5SYtatk[", "n": [ { "c": 2, "d": "NuGet package declares repository", "i": "metadata/package/files/nuget::nuspec-repository", "o": 321, "z": 30, "cf": 0.8999999761581421 } ], "ln": 8, "addr": 317 }, { "b": "arR^Hjy\u00262xwO#3\u0026zEWx(B3o", "n": [ { "c": 2, "d": "NuGet package declares dependencies", "i": "metadata/package/files/nuget::nuspec-dependencies", "o": 401, "z": 864, "cf": 0.8999999761581421 } ], "ln": 9, "addr": 397 }, { "b": "arR^HarS^VA=l8taAR4jxjVfOA:-/@Cw?IqjTa=PBtkE4fD@W", "ln": 10, "addr": 416 }, { "b": "arR^HarR^Hjy\u00262xwO#3\u0026zEW@mx\u003efvJmR)0!Bzkn%l#NfxwPPK(z/PzkaA?spB7]MgjT8Njf/yTreN-EmxKJ[Baz2!cy\u0026%o1jT9jnx(4rhl2HaED3T4xB0q.Wj]", "ln": 11, "addr": 456 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 3213.0, "entropy": 4.99, "size_bytes": 3213.0 }, "binary": { "overall_entropy": 4.99, "peak_region_bytes": 3213.0, "peak_region_entropy": 5.1 } } }, "id": 2, "path": "FlowtideDotNet.Connector.Kafka.0.16.0-alpha9.nupkg!!FlowtideDotNet.Connector.Kafka.nuspec", "risk": 1, "sha": "ae4935422b958df321c95dfce02c4bb1c5766fa05f217f31bdf175b78b66870e", "size": 3213, "traits": [ { "id": "metadata/build/manifest::nuspec-file", "conf": 0.9800000190734863, "crit": 2, "desc": "NuGet nuspec manifest file", "spans": [ [ 0, 37 ] ] }, { "id": "metadata/package/files/nuget::nuspec-repository", "conf": 0.8999999761581421, "crit": 2, "desc": "NuGet package declares repository", "spans": [ [ 321, 30 ] ] }, { "id": "metadata/package/files/nuget::nuspec-dependencies", "conf": 0.8999999761581421, "crit": 2, "desc": "NuGet package declares dependencies", "spans": [ [ 401, 864 ] ] } ], "type": "xml" }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J+", "n": [ { "c": 3, "d": "HTTP fingerprinting evasion campaign", "i": "objectives/command-and-control/infrastructure/user-agent::http-fingerprinting-campaign", "o": 0, "z": 34, "cf": 0.8999999761581421 } ], "ln": 0 }, { "b": "00000000000000000000:*RlI00000nb@R\u00260SSx7nkGo^jz1M[0rr91000000000000", "n": [ { "c": 1, "d": "PE standard code/data section", "i": "metadata/binary/section/names::pe-code-data-standard-section", "o": 512, "z": 5, "cf": 0.8999999761581421 } ], "ln": 496 }, { "b": "0^/d(00AxbB4MAj1$xPMlq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn", "n": [ { "c": 3, "d": "Recognized PE anti-analysis marker", "i": "objectives/anti-analysis/debugger-detect/combined-checks::evasion-aware-recognized-pe-marker", "o": 12872, "z": 4, "cf": 1.0 } ], "ln": 12856 }, { "b": "k4F2cf/Yj@o(BM+y?k^gq*ACawO\u003c4\u003epxjt]mR)0!Bzkn%l#NfxwPPK(z/fD7v@#Tfe\u003eYR+yHEigz/ff6B.bDje\u003eYR+yHEiwBAg@3zaeRVzGF\u0026@n]\u003c", "n": [ { "c": 2, "d": "System namespace reference", "i": "metadata/lang/compiler/managed::system-namespace", "o": 24023, "z": 9, "cf": 0.800000011920929 }, { "c": 1, "d": "Regex component marker", "i": "objectives/persistence/login/scheduled-task/com::task-scheduler-builder-methods--rx-1", "o": 24035, "z": 30, "cf": 0.8999999761581421 } ], "ln": 24007 }, { "b": "vR/PQnKWJtzdN-@vR/PQq*ACawO\u003c4[x(m]yl34r?v)$oTzdN-@vR/PQrbU6zD2vaXzGP/cA:-z", "n": [ { "c": 3, "d": "LINQ query operations", "i": "micro-behaviors/data/db/linq::linq-queries", "o": 25552, "z": 11, "cf": 0.699999988079071 } ], "ln": 25536 }, { "b": "yYF9VBydsPl$G\u003exzddkXmR)0!Bzkn%l#NfxwPPK(z/fD7v@#Tfe\u003eYR+yHF?!zGGDgzEEtYl2Z^OzE=BPBy/G3yYD}vz*cqqwmXeEBwuy?e\u003c\u003cL{zE)s1z/NE6vp\u003cp-e[w^m06$dapiyw?0b2\u003e+uQn:1z/oB(o\u003ewfWA^pP9A+eV@", "n": [ { "c": 3, "d": "References Windows executable or script", "i": "objectives/execution/interpreter/script/shell::windows-executable-ref", "o": 27678, "z": 4, "cf": 0.6000000238418579 }, { "c": 1, "d": "Regex component marker", "i": "objectives/persistence/login/scheduled-task/com::task-scheduler-builder-methods--rx-1", "o": 27594, "z": 39, "cf": 0.8999999761581421 } ], "ln": 27578 }, { "b": "z7Xs{z^)c\u003ex)Kifx(v\u003e?q*ACawO\u003c4$wOb:\u0026v@#B6zua-?BydyNzE^E6x(v\u003e?xjVf(p*[x^x([6czu9TOz#", "n": [ { "c": 2, "d": "Benign high-entropy PE context", "i": "metadata/package/quality/false-positives::benign-high-entropy-pe-context", "o": 28045, "z": 17, "cf": 0.949999988079071 } ], "ln": 28029 }, { "b": "z!%MkzC$T}A+c\u003c}B8L{@q*ACawO\u003c50wQ5qHn][]*0b2\u003e+uSp@oB8L{@s8@1%wMiOuB8L{@q/)4\u003evqOCR", "n": [ { "c": 3, "d": "JSON polymorphism runtime marker", "i": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "o": 28204, "z": 16, "cf": 1.0 } ], "ln": 28188 }, { "b": "B4{7Z08)VEz#-yGz/{10q*ACawO\u003c4[x(m[\u003crbUYSA+PA7l2Hj2y?m3}0afX=z!a02wPv=JBy)G", "n": [ { "c": 3, "d": "LINQ query operations", "i": "micro-behaviors/data/db/linq::linq-queries", "o": 28368, "z": 11, "cf": 0.699999988079071 } ], "ln": 28352 }, { "b": "xjSX]Byxo5o\u003c}{FxjV8-nKEAlzE)s1z/OMXzEEf?ASxP/zF\u003c2}Bz(g]vqYH^wPv=DzD7T\u003cxj\u003e^@07pygve", "n": [ { "c": 1, "d": "Regex component marker", "i": "objectives/persistence/login/scheduled-task/com::task-scheduler-builder-methods--rx-1", "o": 28628, "z": 17, "cf": 0.8999999761581421 } ], "ln": 28612 }, { "b": "Bzkn%l#NfxwPPK\u003evrl0jo\u003ewA!x\u003e8h:xjVf(o\u003ewA!x\u003e8h:q*ACawO\u003c4/x\u003c\u003eT(z/Z2mv@?R", "n": [ { "c": 3, "d": "Application has metrics/telemetry", "i": "metadata/package/quality/profile::has-metrics", "o": 29996, "z": 7, "cf": 0.8500000238418579 } ], "ln": 29980 }, { "b": "v}xR3x(v(/wPz%dv}xYYq*ACawO\u003c4$B-8qnzdLs\u003ezGGDgz/wS^A=#ebwPE\u0026ID2[7sz7X.ezGGPfwIct*ze:i9wPyZXA=#ebwPE", "n": [ { "c": 3, "d": "Packed binary marker", "i": "objectives/anti-static/obfuscation/eval/loader::packed-binary-marker", "o": 30126, "z": 30, "cf": 0.8500000238418579 } ], "ln": 30110 }, { "b": "lVl^-zeKy{v@DgazeKy{ojqBFvma%JzE)s1z/OMXzEEf?AZ+j{wO#N6z/fQ@mR)0!Bzkn%ojqBFvnZVBwli!=By^{Iv@#TfC%#@", "n": [ { "c": 1, "d": "Regex component marker", "i": "objectives/persistence/login/scheduled-task/com::task-scheduler-builder-methods--rx-1", "o": 30530, "z": 31, "cf": 0.8999999761581421 } ], "ln": 30514 }, { "b": "z/o-sBAg/eq!o#)wPz?(mR)0!Bzkn%l#NfxwPPK(z/PzwlVl\u003cWwN/?2A=Rj[wPRoTBZ[])B8}s)CXIkvx(mMVw[D9}BAmBVB.7", "n": [ { "c": 1, "d": "Regex component marker", "i": "objectives/persistence/login/scheduled-task/com::task-scheduler-builder-methods--rx-1", "o": 31083, "z": 30, "cf": 0.8999999761581421 } ], "ln": 31067 }, { "b": "yHHdWB-H#6mQY!Gz/Qa6nKEAlzE)s1z/O={B-H#6mQY!Gz/Qa6qE%GLCTDy!zE)s1z/O={B-H#6mQY!Gz/Qa6qE%oEs8@1%wKZ9rBz(hB0chTVwli!=By^{Iv@#R", "n": [ { "c": 1, "d": "Regex component marker", "i": "objectives/persistence/login/scheduled-task/com::task-scheduler-builder-methods--rx-1", "o": 32453, "z": 23, "cf": 0.8999999761581421 } ], "ln": 32437 }, { "b": "AbY-oBy!#9x(k5nxLzJgC4CYnx(v(iz!pbqz/{7yv@Dj6x(4v3e=+}L6AFgAqE%\u0026\u003cx(W+", "n": [ { "c": 3, "d": "Recognized sparse-logic binary marker", "i": "objectives/anti-analysis/vm-detect/instruction::sparse-logic-recognized-marker", "o": 38188, "z": 7, "cf": 0.800000011920929 } ], "ln": 38172 }, { "b": "00000000000000000000000000000000000000315c8Xg7YTL^00000000000000000", "n": [ { "c": 1, "d": "PE resource section", "i": "metadata/binary/section/names::pe-resource-section", "o": 39424, "z": 5, "cf": 0.8999999761581421 } ], "ln": 39408 }, { "b": "0000000000000iagYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006Xn[brp!0rrVh0000", "n": [ { "c": 3, "d": "Recognized marker for timing checks", "i": "objectives/anti-analysis/timing/evasion::timing-anti-debug-recognized-marker", "o": 39518, "z": 15, "cf": 0.949999988079071 } ], "ln": 39502 }, { "b": "fAr{fvGn7Z003s99@(rwlJz38z2!IPve$fBC(QOtve$cAwDhYg002E*yYFwNCk#Z+x-IVzwDk9", "n": [ { "c": 2, "d": "PE CompanyName metadata field", "i": "metadata/package/versioning::pe-companyname-field", "o": 39738, "z": 11, "cf": 0.699999988079071 } ], "ln": 39722 }, { "b": "w=MPDve{oc003Qh9@(rwmGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up002E*yYFwNCk#Z+x-IV", "n": [ { "c": 2, "d": "PE FileDescription metadata field", "i": "metadata/package/versioning::pe-filedescription-field", "o": 39834, "z": 15, "cf": 0.699999988079071 } ], "ln": 39818 }, { "b": "w=MPDve{oc001+O2(\u003c#amGvc5yYF2DrSDXhASydXx-J5Kzu6Up001XMe=WQahukuffArZ9fAq7M003Qhbld-AnDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE002E*yYFwNCk#Z+x-IVzwDk9#", "n": [ { "c": 3, "d": "Dotted-quad PE version metadata marker", "i": "objectives/command-and-control/infrastructure/ip::ipv4-version-metadata-marker", "o": 39938, "z": 11, "cf": 0.9399999976158142 }, { "c": 2, "d": "PE InternalName metadata field", "i": "metadata/package/versioning::pe-internalname-field", "o": 39990, "z": 12, "cf": 0.699999988079071 } ], "ln": 39922 }, { "b": "xAibO001bw003)pbld-Apxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE002E*yYFwNCk#Z+x-IVz", "n": [ { "c": 2, "d": "PE OriginalFilename metadata field", "i": "metadata/package/versioning::pe-originalfilename-field", "o": 40134, "z": 16, "cf": 0.699999988079071 } ], "ln": 40118 }, { "b": "wb{ACyYBCn003s99@(rwpYLIozVBqFBPt[KBo25ove$cAwDhYg002E*yYFwNCk#Z+x-IVzwDk9", "n": [ { "c": 2, "d": "PE ProductName metadata field", "i": "metadata/package/versioning::pe-productname-field", "o": 40246, "z": 11, "cf": 0.699999988079071 } ], "ln": 40230 }, { "b": "w=MPDve{oc005eZhVJ\u003cUpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001XMe=WQahukuffArW8ve{", "n": [ { "c": 2, "d": "PE version resource metadata", "i": "metadata/package/versioning::version-resource-metadata", "o": 40342, "z": 14, "cf": 0.8999999761581421 } ], "ln": 40326 }, { "b": "000000000000000000000i=C63\u0026*nc(]a[A000000000000000000000000000000000", "n": [ { "c": 2, "d": "PE .reloc section presence", "i": "metadata/binary/section/names::reloc-section-presence", "o": 40960, "z": 6, "cf": 0.8999999761581421 } ], "ln": 40944 } ], "depth": 1, "facts": { "imp": [ [ "mscoree", "CorDllMain" ] ], "sec": [ [ ".text", 512, 38912, 6.02, "r-x" ], [ ".rsrc", 39424, 1536, 2.56, "r--" ], [ ".reloc", 40960, 512, 0.08, "r--" ] ], "metrics": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "resource_count": 1.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 91079.0, "reloc_overhang_bytes": 500.0, "reloc_overhang_ratio": 0.98, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "version.identity_entropy": 4.02, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0, "version.identity_symbol_ratio": 0.07 }, "file": { "size": 41472.0, "entropy": 5.86, "size_bytes": 41472.0 }, "binary": { "is_pie": 1.0, "code_entropy": 6.02, "string_count": 569.0, "overall_entropy": 5.86, "entropy_variance": 5.94, "avg_string_length": 19.15, "max_string_length": 125.0, "peak_region_bytes": 3072.0, "code_to_data_ratio": 1.0, "peak_region_entropy": 6.15, "string_length_stddev": 14.65, "largest_section_ratio": 0.94, "sentence_string_count": 10.0, "sentence_string_ratio": 0.02, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 38912.0, "entropy_max": 6.02, "entropy_mean": 2.89, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } } }, "id": 3, "mol": "O(Al)H(Db)", "path": "FlowtideDotNet.Connector.Kafka.0.16.0-alpha9.nupkg!!lib/net10.0/FlowtideDotNet.Connector.Kafka.dll", "risk": 3, "sha": "585eb361f4af2f38ce3063c58b4258af9e7b82465f9f76316915e59163264017", "size": 41472, "traits": [ { "id": "metadata/package/versioning::version-word-lower", "conf": 0.4000000059604645, "crit": 2, "desc": "version word (lowercase)", "spans": [ [ 38188, 7 ] ] }, { "id": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "conf": 1.0, "crit": 3, "desc": "JSON polymorphism runtime marker", "spans": [ [ 28204, 16 ] ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "spans": [ [ 39938, 11 ] ] }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "spans": [ [ 0, 26 ] ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "spans": [ [ 12872, 4 ] ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "spans": [ [ 27678, 4 ] ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 39518, 15 ] ] }, { "id": "micro-behaviors/data/db/linq::linq-queries", "conf": 0.699999988079071, "crit": 3, "desc": "LINQ query operations", "spans": [ [ 25552, 11 ], [ 28368, 11 ] ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "spans": [ [ 40342, 14 ] ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "spans": [ [ 12872, 4 ] ] } ], "type": "pe" }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J+", "n": [ { "c": 3, "d": "HTTP fingerprinting evasion campaign", "i": "objectives/command-and-control/infrastructure/user-agent::http-fingerprinting-campaign", "o": 0, "z": 34, "cf": 0.8999999761581421 } ], "ln": 0 }, { "b": "000000000000000000006U1by00000nb@R\u00260SSx7M@0+.ia-c\u003c0rr91000000000000", "n": [ { "c": 1, "d": "PE standard code/data section", "i": "metadata/binary/section/names::pe-code-data-standard-section", "o": 512, "z": 5, "cf": 0.8999999761581421 } ], "ln": 496 }, { "b": "0^/d(00AxbB4MAj1$xPMlq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn", "n": [ { "c": 3, "d": "Recognized PE anti-analysis marker", "i": "objectives/anti-analysis/debugger-detect/combined-checks::evasion-aware-recognized-pe-marker", "o": 12952, "z": 4, "cf": 1.0 } ], "ln": 12936 }, { "b": "k4F2cf/Yj@o(BM+y?k^gq*ACawO\u003c4\u003epxjt]mR)0!Bzkn%l#NfxwPPK(z/fD7v@#Tfe\u003eYR+yHEigz/ff6B.bDje\u003eYR+yHEiwBAg@3zaeRVzGF\u0026@n]\u003c", "n": [ { "c": 2, "d": "System namespace reference", "i": "metadata/lang/compiler/managed::system-namespace", "o": 24103, "z": 9, "cf": 0.800000011920929 }, { "c": 1, "d": "Regex component marker", "i": "objectives/persistence/login/scheduled-task/com::task-scheduler-builder-methods--rx-1", "o": 24115, "z": 30, "cf": 0.8999999761581421 } ], "ln": 24087 }, { "b": "vR/PQnKWJtzdN-@vR/PQq*ACawO\u003c4[x(m]yl34r?v)$oTzdN-@vR/PQrbU6zD2vaXzGP/cA:-z", "n": [ { "c": 3, "d": "LINQ query operations", "i": "micro-behaviors/data/db/linq::linq-queries", "o": 25632, "z": 11, "cf": 0.699999988079071 } ], "ln": 25616 }, { "b": "yYF9VBydsPl$G\u003exzddkXmR)0!Bzkn%l#NfxwPPK(z/fD7v@#Tfe\u003eYR+yHF?!zGGDgzEEtYl2Z^OzE=BPBy/G3yYD}vz*cqqwmXeEBwuy?e\u003c\u003cL{zE)s1z/NE6vp\u003cp-e[w^m06$dapiyw?0b2\u003e+uQn:1z/oB(o\u003ewfWA^pP9A+eV@", "n": [ { "c": 3, "d": "References Windows executable or script", "i": "objectives/execution/interpreter/script/shell::windows-executable-ref", "o": 27758, "z": 4, "cf": 0.6000000238418579 }, { "c": 1, "d": "Regex component marker", "i": "objectives/persistence/login/scheduled-task/com::task-scheduler-builder-methods--rx-1", "o": 27674, "z": 39, "cf": 0.8999999761581421 } ], "ln": 27658 }, { "b": "z7Xs{z^)c\u003ex)Kifx(v\u003e?q*ACawO\u003c4$wOb:\u0026v@#B6zua-?BydyNzE^E6x(v\u003e?xjVf(p*[x^x([6czu9TOz#", "n": [ { "c": 2, "d": "Benign high-entropy PE context", "i": "metadata/package/quality/false-positives::benign-high-entropy-pe-context", "o": 28125, "z": 17, "cf": 0.949999988079071 } ], "ln": 28109 }, { "b": "z!%MkzC$T}A+c\u003c}B8L{@q*ACawO\u003c50wQ5qHn][]*0b2\u003e+uSp@oB8L{@s8@1%wMiOuB8L{@q/)4\u003evqOCR", "n": [ { "c": 3, "d": "JSON polymorphism runtime marker", "i": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "o": 28284, "z": 16, "cf": 1.0 } ], "ln": 28268 }, { "b": "B4{7Z08)VEz#-yGz/{10q*ACawO\u003c4[x(m[\u003crbUYSA+PA7l2Hj2y?m3}0afX=z!a02wPv=JBy)G", "n": [ { "c": 3, "d": "LINQ query operations", "i": "micro-behaviors/data/db/linq::linq-queries", "o": 28448, "z": 11, "cf": 0.699999988079071 } ], "ln": 28432 }, { "b": "xjSX]Byxo5o\u003c}{FxjV8-nKEAlzE)s1z/OMXzEEf?ASxP/zF\u003c2}Bz(g]vqYH^wPv=DzD7T\u003cxj\u003e^@07pygve", "n": [ { "c": 1, "d": "Regex component marker", "i": "objectives/persistence/login/scheduled-task/com::task-scheduler-builder-methods--rx-1", "o": 28708, "z": 17, "cf": 0.8999999761581421 } ], "ln": 28692 }, { "b": "Bzkn%l#NfxwPPK\u003evrl0jo\u003ewA!x\u003e8h:xjVf(o\u003ewA!x\u003e8h:q*ACawO\u003c4/x\u003c\u003eT(z/Z2mv@?R", "n": [ { "c": 3, "d": "Application has metrics/telemetry", "i": "metadata/package/quality/profile::has-metrics", "o": 30076, "z": 7, "cf": 0.8500000238418579 } ], "ln": 30060 }, { "b": "v}xR3x(v(/wPz%dv}xYYq*ACawO\u003c4$B-8qnzdLs\u003ezGGDgz/wS^A=#ebwPE\u0026ID2[7sz7X.ezGGPfwIct*ze:i9wPyZXA=#ebwPE", "n": [ { "c": 3, "d": "Packed binary marker", "i": "objectives/anti-static/obfuscation/eval/loader::packed-binary-marker", "o": 30206, "z": 30, "cf": 0.8500000238418579 } ], "ln": 30190 }, { "b": "lVl^-zeKy{v@DgazeKy{ojqBFvma%JzE)s1z/OMXzEEf?AZ+j{wO#N6z/fQ@mR)0!Bzkn%ojqBFvnZVBwli!=By^{Iv@#TfC%#@", "n": [ { "c": 1, "d": "Regex component marker", "i": "objectives/persistence/login/scheduled-task/com::task-scheduler-builder-methods--rx-1", "o": 30610, "z": 31, "cf": 0.8999999761581421 } ], "ln": 30594 }, { "b": "z/o-sBAg/eq!o#)wPz?(mR)0!Bzkn%l#NfxwPPK(z/PzwlVl\u003cWwN/?2A=Rj[wPRoTBZ[])B8}s)CXIkvx(mMVw[D9}BAmBVB.7", "n": [ { "c": 1, "d": "Regex component marker", "i": "objectives/persistence/login/scheduled-task/com::task-scheduler-builder-methods--rx-1", "o": 31163, "z": 30, "cf": 0.8999999761581421 } ], "ln": 31147 }, { "b": "yHHdWB-H#6mQY!Gz/Qa6nKEAlzE)s1z/O={B-H#6mQY!Gz/Qa6qE%GLCTDy!zE)s1z/O={B-H#6mQY!Gz/Qa6qE%oEs8@1%wKZ9rBz(hB0chTVwli!=By^{Iv@#R", "n": [ { "c": 1, "d": "Regex component marker", "i": "objectives/persistence/login/scheduled-task/com::task-scheduler-builder-methods--rx-1", "o": 32533, "z": 23, "cf": 0.8999999761581421 } ], "ln": 32517 }, { "b": "AbY-oBy!#9x(k5nxLzJgC4CYnx(v(iz!pbqz/{7yv@Dj6x(4v3e=+}L6AFgAqE%\u0026\u003cx(W+", "n": [ { "c": 3, "d": "Recognized sparse-logic binary marker", "i": "objectives/anti-analysis/vm-detect/instruction::sparse-logic-recognized-marker", "o": 38266, "z": 7, "cf": 0.800000011920929 } ], "ln": 38250 }, { "b": "00000000000000000000000000000000000000315c8Xg7YTL^00000000000000000", "n": [ { "c": 1, "d": "PE resource section", "i": "metadata/binary/section/names::pe-resource-section", "o": 39936, "z": 5, "cf": 0.8999999761581421 } ], "ln": 39920 }, { "b": "0000000000000iagYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006Xn[brp!0rrVh0000", "n": [ { "c": 3, "d": "Recognized marker for timing checks", "i": "objectives/anti-analysis/timing/evasion::timing-anti-debug-recognized-marker", "o": 40030, "z": 15, "cf": 0.949999988079071 } ], "ln": 40014 }, { "b": "fAr{fvGn7Z003s99@(rwlJz38z2!IPve$fBC(QOtve$cAwDhYg002E*yYFwNCk#Z+x-IVzwDk9", "n": [ { "c": 2, "d": "PE CompanyName metadata field", "i": "metadata/package/versioning::pe-companyname-field", "o": 40250, "z": 11, "cf": 0.699999988079071 } ], "ln": 40234 }, { "b": "w=MPDve{oc003Qh9@(rwmGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up002E*yYFwNCk#Z+x-IV", "n": [ { "c": 2, "d": "PE FileDescription metadata field", "i": "metadata/package/versioning::pe-filedescription-field", "o": 40346, "z": 15, "cf": 0.699999988079071 } ], "ln": 40330 }, { "b": "w=MPDve{oc001+O2(\u003c#amGvc5yYF2DrSDXhASydXx-J5Kzu6Up001XMe=WQahukuffArZ9fAq7M003Qhbld-AnDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE002E*yYFwNCk#Z+x-IVzwDk9#", "n": [ { "c": 3, "d": "Dotted-quad PE version metadata marker", "i": "objectives/command-and-control/infrastructure/ip::ipv4-version-metadata-marker", "o": 40450, "z": 11, "cf": 0.9399999976158142 }, { "c": 2, "d": "PE InternalName metadata field", "i": "metadata/package/versioning::pe-internalname-field", "o": 40502, "z": 12, "cf": 0.699999988079071 } ], "ln": 40434 }, { "b": "xAibO001bw003)pbld-Apxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE002E*yYFwNCk#Z+x-IVz", "n": [ { "c": 2, "d": "PE OriginalFilename metadata field", "i": "metadata/package/versioning::pe-originalfilename-field", "o": 40646, "z": 16, "cf": 0.699999988079071 } ], "ln": 40630 }, { "b": "wb{ACyYBCn003s99@(rwpYLIozVBqFBPt[KBo25ove$cAwDhYg002E*yYFwNCk#Z+x-IVzwDk9", "n": [ { "c": 2, "d": "PE ProductName metadata field", "i": "metadata/package/versioning::pe-productname-field", "o": 40758, "z": 11, "cf": 0.699999988079071 } ], "ln": 40742 }, { "b": "w=MPDve{oc005eZhVJ\u003cUpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001XMe=WQahukuffArW8ve{", "n": [ { "c": 2, "d": "PE version resource metadata", "i": "metadata/package/versioning::version-resource-metadata", "o": 40854, "z": 14, "cf": 0.8999999761581421 } ], "ln": 40838 }, { "b": "000000000000000000000i=C63\u0026*ncg=LEn000000000000000000000000000000000", "n": [ { "c": 2, "d": "PE .reloc section presence", "i": "metadata/binary/section/names::reloc-section-presence", "o": 41472, "z": 6, "cf": 0.8999999761581421 } ], "ln": 41456 } ], "depth": 1, "facts": { "imp": [ [ "mscoree", "CorDllMain" ] ], "sec": [ [ ".text", 512, 39424, 5.98, "r-x" ], [ ".rsrc", 39936, 1536, 2.56, "r--" ], [ ".reloc", 41472, 512, 0.08, "r--" ] ], "metrics": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "resource_count": 1.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 81027.0, "reloc_overhang_bytes": 500.0, "reloc_overhang_ratio": 0.98, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "version.identity_entropy": 4.02, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0, "version.identity_symbol_ratio": 0.07 }, "file": { "size": 41984.0, "entropy": 5.81, "size_bytes": 41984.0 }, "binary": { "is_pie": 1.0, "code_entropy": 5.98, "string_count": 570.0, "overall_entropy": 5.81, "entropy_variance": 5.84, "avg_string_length": 19.11, "max_string_length": 124.0, "peak_region_bytes": 3072.0, "code_to_data_ratio": 1.0, "peak_region_entropy": 6.14, "string_length_stddev": 14.62, "largest_section_ratio": 0.94, "sentence_string_count": 10.0, "sentence_string_ratio": 0.02, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 39424.0, "entropy_max": 5.98, "entropy_mean": 2.87, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } } }, "id": 4, "mol": "O(Al)H(Db)", "path": "FlowtideDotNet.Connector.Kafka.0.16.0-alpha9.nupkg!!lib/net8.0/FlowtideDotNet.Connector.Kafka.dll", "risk": 3, "sha": "fe6f9595c7d198b5e148482e4ad7f5ad954a4c55ee4fdc68d23e8b2aef09000d", "size": 41984, "traits": [ { "id": "metadata/package/versioning::version-word-lower", "conf": 0.4000000059604645, "crit": 2, "desc": "version word (lowercase)", "spans": [ [ 38266, 7 ] ] }, { "id": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "conf": 1.0, "crit": 3, "desc": "JSON polymorphism runtime marker", "spans": [ [ 28284, 16 ] ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "spans": [ [ 40450, 11 ] ] }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "spans": [ [ 0, 26 ] ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "spans": [ [ 12952, 4 ] ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "spans": [ [ 27758, 4 ] ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 40030, 15 ] ] }, { "id": "micro-behaviors/data/db/linq::linq-queries", "conf": 0.699999988079071, "crit": 3, "desc": "LINQ query operations", "spans": [ [ 25632, 11 ], [ 28448, 11 ] ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "spans": [ [ 40854, 14 ] ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "spans": [ [ 12952, 4 ] ] } ], "type": "pe" }, { "depth": 1, "facts": { "metrics": { "file": { "size": 459, "entropy": 4.83 }, "binary": { "peak_region_bytes": 459, "peak_region_entropy": 4.83 } } }, "id": 5, "path": "FlowtideDotNet.Connector.Kafka.0.16.0-alpha9.nupkg!![Content_Types].xml", "pid": 0, "risk": 1, "sha": "3dae54f1e2761fb41379f8d05e7fdb903b62ecd0ec1c65fc68fd02c91c3671cf", "size": 459, "traits": [ { "id": "metadata/file/extension/identity::doc-or-config-extension", "conf": 1.0, "crit": 2, "desc": "Text, document, or config extension" } ], "type": "xml" }, { "id": 6, "sha": "1a8b206dd97478e9055a31de6920b2040b35fa78b2e8022a5460c1e89ad3e609", "path": "FlowtideDotNet.Connector.Kafka.0.16.0-alpha9.nupkg!!package/services/metadata/core-properties/342ccf99ca63480e9f49d0dd6da34811.psmdcp", "size": 656, "type": "xml", "depth": 1 }, { "id": 7, "sha": "0ba918952d5bb8a57f71267ab51a6ab83493b3d3f5bcb8d965968f8d3f848a28", "path": "FlowtideDotNet.Connector.Kafka@0.16.0-alpha9.registry.json", "size": 796, "type": "registry", "depth": 1 } ], "omitted_files": 2, "v": "8" } }