{ "ml": { "v": "7", "eng": "2.2.0-beta.1", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.27509028, "rte": "az", "prob": 0.27509028 } ], "prob": 0.76213783, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.7621378302574158, "type": "nupkg" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.7621378302574158, "type": "xml" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.00004763404649565928, "type": "xml" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.7621378302574158, "type": "markdown" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.000012616316780622583, "type": "png" }, { "id": 5, "lvl": -1, "conf": 0, "prob": 0.00003762046617339365, "type": "pe" }, { "id": 6, "lvl": -1, "conf": 0, "prob": 0.00001189112663269043, "type": "xml" }, { "id": 7, "lvl": -1, "conf": 0, "prob": 0.7621378302574158, "type": "pe" }, { "id": 8, "lvl": -1, "conf": 0, "prob": 0.7621378302574158, "type": "xml" }, { "id": 9, "lvl": -1, "conf": 0, "prob": 0.7609249949455261, "type": "pe" }, { "id": 10, "lvl": -1, "conf": 0, "prob": 0.7621378302574158, "type": "xml" }, { "id": 11, "lvl": -1, "conf": 0, "prob": 0.7609249949455261, "type": "pe" }, { "id": 12, "lvl": -1, "conf": 0, "prob": 0.7621378302574158, "type": "xml" }, { "id": 13, "lvl": -1, "conf": 0, "prob": 0.00003762046617339365, "type": "pe" }, { "id": 14, "lvl": -1, "conf": 0, "prob": 0.7621378302574158, "type": "xml" }, { "id": 15, "lvl": -1, "conf": 0, "prob": 0.00003415346145629883, "type": "pe" }, { "id": 16, "lvl": -1, "conf": 0, "prob": 0.7621378302574158, "type": "xml" }, { "id": 17, "lvl": -1, "conf": 0, "prob": 0.7621378302574158, "type": "pe" }, { "id": 18, "lvl": -1, "conf": 0, "prob": 0.7621378302574158, "type": "xml" }, { "id": 19, "lvl": -1, "conf": 0, "prob": 0.7621378302574158, "type": "xml" }, { "id": 20, "lvl": -1, "conf": 0, "prob": 0.7621378302574158, "type": "xml" } ], "version": "v18.18", "analyzed_at": "2026-06-24T06:03:37Z" }, "path": "JJ.Framework.Existence.Core.4.7.7026.nupkg", "raw": { "files": [ { "id": 0, "mol": "O(Al)H₂(CmDb)", "sha": "edbbf1bae25250a9911b532f12b232d8094bda8325d20cdd4e8ab457fd70001d", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/JJ.Framework.Existence.Core/JJ.Framework.Existence.Core.4.7.7026.nupkg", "risk": 4, "size": 377929, "type": "nupkg", "facts": { "metrics": { "file": { "size": 377929.0, "entropy": 7.99, "size_bytes": 377929.0 }, "binary": { "overall_entropy": 7.99, "peak_region_bytes": 358400.0, "peak_region_entropy": 7.84 }, "archive": { "file_count": 21.0, "member_count": 21.0, "script_count": 0.0, "zip_bomb_ratio": 29.91, "directory_count": 0.0, "executable_count": 7.0, "extra_field_size": 0.0, "noise_file_count": 0.0, "total_compressed": 374681.0, "compression.ratio": 0.1, "hidden_file_count": 2.0, "total_uncompressed": 3764200.0, "crc_collision_count": 1.0, "entry_comment_count": 0.0, "max_filename_length": 81.0, "rtlo_filename_count": 0.0, "format.regular_count": 21.0, "nested_archive_count": 0.0, "path_traversal_count": 0.0, "symlink_escape_count": 0.0, "security.setgid_count": 0.0, "security.setuid_count": 0.0, "security.sticky_count": 0.0, "double_extension_count": 0.0, "duplicate_member_count": 0.0, "security.symlink_count": 0.0, "unicode_filename_count": 0.0, "homoglyph_filename_count": 0.0, "security.encrypted_count": 0.0, "timing.mtime_unique_count": 8.0, "timing.mtime_unique_ratio": 0.38, "misplaced_executable_count": 7.0, "timing.mtime_dominant_count": 6.0, "timing.mtime_spread_seconds": 29462.0, "timing.sentinel_mtime_count": 0.0, "security.world_writable_count": 0.0, "timing.mtime_dominant_fraction": 0.29, "compression.method_counts.stored": 1.0, "compression.method_counts.deflate": 20.0 } } }, "ident": { "name": { "value": "JJ.Framework.Existence.Core", "source": "nupkg.title", "verified": false }, "urls": [ { "url": "https://github.com/jjvanzon/JJ.Framework/tree/main/Framework/Existence.Core", "kind": "homepage", "source": "nupkg.project_url" }, { "url": "https://github.com/jjvanzon/JJ.Framework/tree/main/Framework/Existence.Core", "kind": "repository", "source": "nupkg.repository_url" } ], "trust": "unsigned", "authors": [ { "name": "JJ van Zon", "role": "author", "source": "nupkg.authors" } ], "version": { "value": "4.7.7026", "source": "nupkg.version", "verified": false }, "identifier": { "value": "JJ.Framework.Existence.Core", "source": "nupkg.id", "verified": false } }, "traits": [ { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "from": [ { "file": 5 } ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "from": [ { "file": 5 } ] }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "from": [ { "file": 5 } ], "spans": [ [ 0, 26 ] ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "from": [ { "file": 5 } ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "from": [ { "file": 5 } ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "from": [ { "file": 5 } ] }, { "id": "objectives/anti-analysis/self-modify/runtime::dotnet-getexecutingassembly-token", "atk": "T1027.005", "conf": 0.8799999952316284, "crit": 3, "desc": ".NET current assembly lookup", "from": [ { "file": 7 } ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "micro-behaviors/communications/http/server/managed::name-value-collection", "conf": 1.0, "crit": 3, "desc": "Usage of NameValueCollection (headers/params)", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/data/db/linq::linq-queries", "conf": 0.699999988079071, "crit": 3, "desc": "LINQ query operations", "from": [ { "file": 5 } ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "from": [ { "off": 25964, "file": 5 }, { "off": 25972, "file": 7 }, { "off": 25932, "file": 9 }, { "off": 25772, "file": 11 }, { "off": 25964, "file": 13 }, { "off": 30252, "file": 15 }, { "off": 25992, "file": 17 } ] } ] }, { "id": 1, "sha": "4c8f8475eaf13bc5041b78e2414e30677a924ee0f12c305c5197ddf2dfe73237", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/JJ.Framework.Existence.Core/JJ.Framework.Existence.Core.4.7.7026.nupkg!!_rels/.rels", "size": 521, "type": "xml", "depth": 1 }, { "id": 2, "sha": "41cc1ad2032904b1aa690fcf2df62c5a0560cc489cffae908fff0195ad9cd159", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/JJ.Framework.Existence.Core/JJ.Framework.Existence.Core.4.7.7026.nupkg!!JJ.Framework.Existence.Core.nuspec", "risk": 1, "size": 4393, "type": "xml", "depth": 1 }, { "id": 3, "sha": "970336ea1f4e8d20831b02afac12b9f135d0d57b2e389345554cc51df7508de4", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/JJ.Framework.Existence.Core/JJ.Framework.Existence.Core.4.7.7026.nupkg!!README.MD", "risk": 1, "size": 4881, "type": "markdown", "depth": 1 }, { "id": 4, "sha": "98b5f658c144a842e7107e58bf01d126d795fa08f338b62e976d17ab678328cf", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/JJ.Framework.Existence.Core/JJ.Framework.Existence.Core.4.7.7026.nupkg!!jj-icon-64x64-margin4.png", "size": 1649, "type": "png", "depth": 1 }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J+", "n": [ { "c": 3, "d": "HTTP fingerprinting evasion campaign", "i": "objectives/command-and-control/infrastructure/user-agent::http-fingerprinting-campaign", "o": 0, "z": 34, "cf": 0.8999999761581421 } ], "ln": 0 }, { "b": "000000000000000000002vEPk00000nb@R\u00260SSx7y\u003ezY/GXDIc0rr91000000000000", "n": [ { "c": 1, "d": "PE standard code/data section", "i": "metadata/binary/section/names::pe-code-data-standard-section", "o": 512, "z": 5, "cf": 0.8999999761581421 } ], "ln": 496 }, { "b": "00AvIqucX1z*.P=3mV\u0026wlq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn", "n": [ { "c": 2, "d": ".NET Metadata Root (BSJB)", "i": "metadata/binary/framework::dotnet-metadata", "o": 25964, "z": 4, "cf": 1.0 } ], "ln": 25948 }, { "b": "yC552x(!xczEWlglVm0Re[w^m0afIQy?%8JD2NsZz!%j\u0026nmuNbz!%j\u0026nmuNqwNPaB", "n": [ { "c": 3, "d": "References Windows executable or script", "i": "objectives/execution/interpreter/script/shell::windows-executable-ref", "o": 110112, "z": 4, "cf": 0.6000000238418579 } ], "ln": 110096 }, { "b": "091k.wKyxLy?m9#x(v\u003e?pgn0Jr://!wKyxLy?m9#x(v\u003e?q/)4]zF8sPy\u00260V)BzkVh099]PA+5:4wN[wOwO(F", "n": [ { "c": 3, "d": "Usage of NameValueCollection (headers/params)", "i": "micro-behaviors/communications/http/server/managed::name-value-collection", "o": 110627, "z": 19, "cf": 1.0 } ], "ln": 110611 }, { "b": "z/x#3zVAspB4*H\u003cyJTN@q*ACawO\u003c4[x(m[\u003cq*ACawO\u003c4!z!%l3v@#B6zGvB2wO#71x\u003e5+!lVl=", "n": [ { "c": 3, "d": "LINQ query operations", "i": "micro-behaviors/data/db/linq::linq-queries", "o": 110944, "z": 11, "cf": 0.699999988079071 } ], "ln": 110928 }, { "b": "00000000000000000000000000000000000000315c8Xg7YTL^00000000000000000", "n": [ { "c": 1, "d": "PE resource section", "i": "metadata/binary/section/names::pe-resource-section", "o": 148480, "z": 5, "cf": 0.8999999761581421 } ], "ln": 148464 }, { "b": "0000000000007dBgYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006Xn[brp!0rru81onA", "n": [ { "c": 2, "d": "PE version resource metadata", "i": "metadata/package/versioning::version-resource-metadata", "o": 148574, "z": 15, "cf": 0.8999999761581421 } ], "ln": 148558 }, { "b": "aol9QBo0][001[S3JHhclJz38z2!IPve$fBC(QOtve$cAwDhYg002Q\u003en=P$lB]U}Jzu7^Vs]-Evzu6Up003yb8#{0tmGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up002Q\u003en=QEzmGvDeve$c", "n": [ { "c": 2, "d": "PE CompanyName metadata field", "i": "metadata/package/versioning::pe-companyname-field", "o": 149242, "z": 11, "cf": 0.699999988079071 }, { "c": 2, "d": "PE FileDescription metadata field", "i": "metadata/package/versioning::pe-filedescription-field", "o": 149298, "z": 15, "cf": 0.699999988079071 } ], "ln": 149226 }, { "b": "lJz38ASxUJ001[S3JHhcmGvc5yYF2DrSDXhASydXx-J5Kzu6Up001?Qe=W*ge=W*gfAr\u003cdhukuffAq7M003ybaohAxnDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE002Q\u003en=QEzmGvDeve$cAwDl]O", "n": [ { "c": 2, "d": "PE FileVersion metadata field", "i": "metadata/package/versioning::pe-fileversion-field", "o": 149394, "z": 11, "cf": 0.699999988079071 }, { "c": 2, "d": "PE InternalName metadata field", "i": "metadata/package/versioning::pe-internalname-field", "o": 149450, "z": 12, "cf": 0.699999988079071 } ], "ln": 149378 }, { "b": "z#+d-ASx!Nx8(PBBn#pvlJz38z#+d-ASx!Nx8(PBBo0A-Sq[4vg5%0df-T0faoi$[aojd%fA", "n": [ { "c": 2, "d": "Copyright notice", "i": "metadata/package/license::copyright-word", "o": 149576, "z": 9, "cf": 0.6000000238418579 } ], "ln": 149560 }, { "b": "aokNBzVBUP003WjaohAxpxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE002Q\u003en=QEzmGvDeve$cA", "n": [ { "c": 2, "d": "PE OriginalFilename metadata field", "i": "metadata/package/versioning::pe-originalfilename-field", "o": 149666, "z": 16, "cf": 0.699999988079071 } ], "ln": 149650 }, { "b": "e=YzZyYFnK003a38#{0tpYLIozVBqFBPt[KBo25ove$cAwDhYg002Q\u003en=QEzmGvDeve$cAwDl]", "n": [ { "c": 2, "d": "PE ProductName metadata field", "i": "metadata/package/versioning::pe-productname-field", "o": 149770, "z": 11, "cf": 0.699999988079071 } ], "ln": 149754 }, { "b": "lJz38ASxUJ004/Pg5}sPpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001?Qe=W*ge=W*gfAr\u003cdhui", "n": [ { "c": 2, "d": "PE ProductVersion metadata field", "i": "metadata/package/versioning::pe-productversion-field", "o": 149858, "z": 14, "cf": 0.699999988079071 } ], "ln": 149842 }, { "b": "000000000000000000000ak\u003cd3\u0026*ncc[\u003eS3000000000000000000000000000000000", "n": [ { "c": 2, "d": "PE .reloc section presence", "i": "metadata/binary/section/names::reloc-section-presence", "o": 150528, "z": 6, "cf": 0.8999999761581421 } ], "ln": 150512 } ], "depth": 1, "facts": { "imp": [ [ "mscoree", "CorDllMain" ] ], "sec": [ [ ".text", 512, 147968, 5.37, "r-x" ], [ ".rsrc", 148480, 2048, 2.89, "r--" ], [ ".reloc", 150528, 512, 0.1, "r--" ] ], "metrics": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "resource_count": 1.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 154968.0, "reloc_overhang_bytes": 500.0, "reloc_overhang_ratio": 0.98, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "version.identity_entropy": 4.14, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0, "version.identity_symbol_ratio": 0.09 }, "file": { "size": 151040.0, "entropy": 5.33, "size_bytes": 151040.0 }, "binary": { "is_pie": 1.0, "code_entropy": 5.37, "string_count": 433.0, "overall_entropy": 5.33, "entropy_variance": 4.63, "avg_string_length": 21.04, "max_string_length": 211.0, "peak_region_bytes": 2048.0, "code_to_data_ratio": 1.0, "peak_region_entropy": 5.86, "string_length_stddev": 19.62, "largest_section_ratio": 0.98, "sentence_string_count": 7.0, "sentence_string_ratio": 0.02, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 147968.0, "entropy_max": 5.37, "entropy_mean": 2.79, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } } }, "id": 5, "mol": "H₂(CmDb)", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/JJ.Framework.Existence.Core/JJ.Framework.Existence.Core.4.7.7026.nupkg!!lib/net10.0/JJ.Framework.Existence.Core.dll", "risk": 3, "sha": "d80e940afbbb1cbbe4221c1f30ec9f12da59f58faa09d102cdda00b471dc9e05", "size": 151040, "traits": [ { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "spans": [ [ 149858, 14 ] ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "spans": [ [ 110112, 4 ] ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 148574, 15 ] ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "spans": [ [ 149394, 11 ] ] }, { "id": "micro-behaviors/communications/http/server/managed::name-value-collection", "conf": 1.0, "crit": 3, "desc": "Usage of NameValueCollection (headers/params)", "spans": [ [ 110627, 19 ] ] }, { "id": "micro-behaviors/data/db/linq::linq-queries", "conf": 0.699999988079071, "crit": 3, "desc": "LINQ query operations", "spans": [ [ 110944, 11 ] ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "spans": [ [ 25964, 4 ] ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "spans": [ [ 0, 26 ] ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "spans": [ [ 25964, 4 ] ] } ], "type": "pe" }, { "id": 6, "sha": "78d5a5e9a726edfd6282e35d00f8001778359d45e9f37f2aac217ebaf98a0304", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/JJ.Framework.Existence.Core/JJ.Framework.Existence.Core.4.7.7026.nupkg!!lib/net10.0/JJ.Framework.Existence.Core.xml", "size": 383345, "type": "xml", "depth": 1 }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J\u0026m(0ji6Sa?dLD+]{51x(+zoA=kPhvqNb%vqY$3BrC47aAzQxazCZol@c-7zeP", "n": [ { "c": 3, "d": "HTTP fingerprinting evasion campaign", "i": "objectives/command-and-control/infrastructure/user-agent::http-fingerprinting-campaign", "o": 0, "z": 34, "cf": 0.8999999761581421 }, { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 78, "z": 4, "cf": 0.800000011920929 } ], "ln": 0 }, { "b": "00000000000000000000)Q31}00000nb@R\u00260SSx7BB%L[wzma+0rr91000000000000", "n": [ { "c": 1, "d": "PE standard code/data section", "i": "metadata/binary/section/names::pe-code-data-standard-section", "o": 512, "z": 5, "cf": 0.8999999761581421 } ], "ln": 496 }, { "b": "00AvIw=I/lz*?V^3mV\u0026wlq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn", "n": [ { "c": 2, "d": ".NET Metadata Root (BSJB)", "i": "metadata/binary/framework::dotnet-metadata", "o": 25972, "z": 4, "cf": 1.0 } ], "ln": 25956 }, { "b": "wO#71x\u003e5+!oLFM\u0026jxaG%Bzbxftu}kcD2[7sz7Xg]y\u00260V)BzkVhB1P%]zE)\u003c5v\u003eHtJ", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 106515, "z": 4, "cf": 0.800000011920929 } ], "ln": 106499 }, { "b": "yC552x(!xczEWlglVm0Re[w^m0afIQy?%8JD2NsZz!%j\u0026nmuNbz!%j\u0026nmuNqwNPaB", "n": [ { "c": 3, "d": "References Windows executable or script", "i": "objectives/execution/interpreter/script/shell::windows-executable-ref", "o": 109700, "z": 4, "cf": 0.6000000238418579 } ], "ln": 109684 }, { "b": "091k.wKyxLy?m9#x(v\u003e?pgn0Jr://!wKyxLy?m9#x(v\u003e?q/)4]zF8sPy\u00260V)BzkVh099]PA+5:4wN[wOwO(F", "n": [ { "c": 3, "d": "Usage of NameValueCollection (headers/params)", "i": "micro-behaviors/communications/http/server/managed::name-value-collection", "o": 110239, "z": 19, "cf": 1.0 } ], "ln": 110223 }, { "b": "z/x#3zVAspB4*H\u003cyJTN@q*ACawO\u003c4[x(m[\u003cq*ACawO\u003c4!z!%l3v@#B6zGvB2wO#71x\u003e5+!lVl=", "n": [ { "c": 3, "d": "LINQ query operations", "i": "micro-behaviors/data/db/linq::linq-queries", "o": 110556, "z": 11, "cf": 0.699999988079071 } ], "ln": 110540 }, { "b": "03znW0b}{W0bhBK0b.^B0bIST0b}{D0ce6F0bRZE0cwiL0ce6X03zn-0b8vv0cwh-", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 116087, "z": 4, "cf": 0.800000011920929 } ], "ln": 116071 }, { "b": "03zne08AO*089wY07c-=07^e^08rIP03znn0bhBI0bhBP0a=dv03zn.0at\u003et0a=c", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 118301, "z": 3, "cf": 0.800000011920929 } ], "ln": 118285 }, { "b": "z2!zMx-J2Jx8\u003cK:aom93n=RD-fAr^bfAs3iaoi$[aojXcqufO{k(+3/aoj$kp5)\u0026=q#!@VaojXcASyaWve$MMe=XlsASxUJve$xHwDkp4zua.TBo2.HzuaeDwDi?Mv/P{qyYFnKwDllvaol9Qzua+UwDl-Jzua8ByYFnKC(PC%aokdpzVB\u003eVaok*Iaolu", "n": [ { "c": 1, "d": "Encoded HTML tag fragment", "i": "objectives/anti-static/obfuscation/encoding/content::encoded-html-tag-fragment", "o": 122696, "z": 103, "cf": 0.699999988079071 } ], "ln": 122680 }, { "b": "03zn:0cncK0aV6L0at\u003eG03znW0aC}y0a=du0cwh(03zn=0b8vD0aM1x03znZ0a=c", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 127901, "z": 3, "cf": 0.800000011920929 } ], "ln": 127885 }, { "b": "fAr^bf-S)caoi$[aoj.dk(:*-mf1Cgq#*53pYJ]:qVE{uve$fBwb).LBo2$OwDlA", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 128976, "z": 3, "cf": 0.800000011920929 } ], "ln": 128960 }, { "b": "z2!zMx-J2Jx8\u003cK:aom0qn=RD-fAr^bf-T3gaoi$[aoj[imf36.mf3i=nDq9Taok7nnDqV?q#!@VaokptwDlrxyYF2Dv/QPJx-J5Kzu7^Vv/QAEBPujTwb).Lve$xHBo2\u003eLz2!IPBo0A-Bo3jVaok)KzVBUPA@ZpZASyjZv/QPJaok*Iaol3OwDlPFwDl-", "n": [ { "c": 1, "d": "Encoded HTML tag fragment", "i": "objectives/anti-static/obfuscation/encoding/content::encoded-html-tag-fragment", "o": 134248, "z": 103, "cf": 0.699999988079071 } ], "ln": 134232 }, { "b": "07c-{0bITK0bhBJ0a#o$0cncY0a=dE0aC}A0c[L!0bhBO03zn:0cncK0aV6L0aC}J0cwh-0b}{R0b?\u003cT0bITX03znK0b?\u003cO0b}{D0cwiP0aC}A0a=cM0cXAS0cwiO03znc08A", "n": [ { "c": 3, "d": ".NET current assembly lookup", "i": "objectives/anti-analysis/self-modify/runtime::dotnet-getexecutingassembly-token", "o": 136179, "z": 20, "cf": 0.8799999952316284 }, { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 136141, "z": 4, "cf": 0.800000011920929 } ], "ln": 136125 }, { "b": "00000000000000000000000000000000000000315c8Xg7YTL^00000000000000000", "n": [ { "c": 1, "d": "PE resource section", "i": "metadata/binary/section/names::pe-resource-section", "o": 148480, "z": 5, "cf": 0.8999999761581421 } ], "ln": 148464 }, { "b": "0000000000007dBgYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006Xn[brp!0rru81onA", "n": [ { "c": 2, "d": "PE version resource metadata", "i": "metadata/package/versioning::version-resource-metadata", "o": 148574, "z": 15, "cf": 0.8999999761581421 } ], "ln": 148558 }, { "b": "aol9QBo0][001[S3JHhclJz38z2!IPve$fBC(QOtve$cAwDhYg002Q\u003en=P$lB]U}Jzu7^Vs]-Evzu6Up003yb8#{0tmGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up002Q\u003en=QEzmGvDeve$c", "n": [ { "c": 2, "d": "PE CompanyName metadata field", "i": "metadata/package/versioning::pe-companyname-field", "o": 149242, "z": 11, "cf": 0.699999988079071 }, { "c": 2, "d": "PE FileDescription metadata field", "i": "metadata/package/versioning::pe-filedescription-field", "o": 149298, "z": 15, "cf": 0.699999988079071 } ], "ln": 149226 }, { "b": "lJz38ASxUJ001[S3JHhcmGvc5yYF2DrSDXhASydXx-J5Kzu6Up001?Qe=W*ge=W*gfAr\u003cdhukuffAq7M003ybaohAxnDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE002Q\u003en=QEzmGvDeve$cAwDl]O", "n": [ { "c": 2, "d": "PE FileVersion metadata field", "i": "metadata/package/versioning::pe-fileversion-field", "o": 149394, "z": 11, "cf": 0.699999988079071 }, { "c": 2, "d": "PE InternalName metadata field", "i": "metadata/package/versioning::pe-internalname-field", "o": 149450, "z": 12, "cf": 0.699999988079071 } ], "ln": 149378 }, { "b": "z#+d-ASx!Nx8(PBBn#pvlJz38z#+d-ASx!Nx8(PBBo0A-Sq[4vg5%0df-T0faoi$[aojd%fA", "n": [ { "c": 2, "d": "Copyright notice", "i": "metadata/package/license::copyright-word", "o": 149576, "z": 9, "cf": 0.6000000238418579 } ], "ln": 149560 }, { "b": "aokNBzVBUP003WjaohAxpxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE002Q\u003en=QEzmGvDeve$cA", "n": [ { "c": 2, "d": "PE OriginalFilename metadata field", "i": "metadata/package/versioning::pe-originalfilename-field", "o": 149666, "z": 16, "cf": 0.699999988079071 } ], "ln": 149650 }, { "b": "e=YzZyYFnK003a38#{0tpYLIozVBqFBPt[KBo25ove$cAwDhYg002Q\u003en=QEzmGvDeve$cAwDl]", "n": [ { "c": 2, "d": "PE ProductName metadata field", "i": "metadata/package/versioning::pe-productname-field", "o": 149770, "z": 11, "cf": 0.699999988079071 } ], "ln": 149754 }, { "b": "lJz38ASxUJ004/Pg5}sPpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001?Qe=W*ge=W*gfAr\u003cdhui", "n": [ { "c": 2, "d": "PE ProductVersion metadata field", "i": "metadata/package/versioning::pe-productversion-field", "o": 149858, "z": 14, "cf": 0.699999988079071 } ], "ln": 149842 }, { "b": "000000000000000000000ak\u003cd3\u0026*nc5hj7:000000000000000000000000000000000", "n": [ { "c": 2, "d": "PE .reloc section presence", "i": "metadata/binary/section/names::reloc-section-presence", "o": 150528, "z": 6, "cf": 0.8999999761581421 } ], "ln": 150512 } ], "depth": 1, "facts": { "imp": [ [ "mscoree", "CorDllMain" ] ], "sec": [ [ ".text", 512, 147968, 5.43, "r-x" ], [ ".rsrc", 148480, 2048, 2.89, "r--" ], [ ".reloc", 150528, 512, 0.1, "r--" ] ], "metrics": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "resource_count": 1.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 178716.0, "reloc_overhang_bytes": 500.0, "reloc_overhang_ratio": 0.98, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "version.identity_entropy": 4.14, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0, "version.identity_symbol_ratio": 0.09 }, "file": { "size": 151040.0, "entropy": 5.38, "size_bytes": 151040.0 }, "binary": { "is_pie": 1.0, "code_entropy": 5.43, "string_count": 495.0, "overall_entropy": 5.38, "entropy_variance": 4.73, "avg_string_length": 41.33, "max_string_length": 1003.0, "peak_region_bytes": 2048.0, "code_to_data_ratio": 1.0, "peak_region_entropy": 5.83, "string_length_stddev": 99.86, "largest_section_ratio": 0.98, "sentence_string_count": 39.0, "sentence_string_ratio": 0.08, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 147968.0, "entropy_max": 5.43, "entropy_mean": 2.8, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } } }, "id": 7, "mol": "O(Al)H₂(CmDb)", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/JJ.Framework.Existence.Core/JJ.Framework.Existence.Core.4.7.7026.nupkg!!lib/net6.0/JJ.Framework.Existence.Core.dll", "risk": 4, "sha": "5da21cb857f2b51ace4185a1d467d54edd5aaa1c0021bf915e9c949f806a7f11", "size": 151040, "traits": [ { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "spans": [ [ 149858, 14 ] ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "spans": [ [ 109700, 4 ] ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 148574, 15 ] ] }, { "id": "objectives/anti-analysis/self-modify/runtime::dotnet-getexecutingassembly-token", "atk": "T1027.005", "conf": 0.8799999952316284, "crit": 3, "desc": ".NET current assembly lookup", "spans": [ [ 136179, 20 ] ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "spans": [ [ 149394, 11 ] ] }, { "id": "micro-behaviors/communications/http/server/managed::name-value-collection", "conf": 1.0, "crit": 3, "desc": "Usage of NameValueCollection (headers/params)", "spans": [ [ 110239, 19 ] ] }, { "id": "micro-behaviors/data/db/linq::linq-queries", "conf": 0.699999988079071, "crit": 3, "desc": "LINQ query operations", "spans": [ [ 110556, 11 ] ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "spans": [ [ 25972, 4 ] ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "spans": [ [ 0, 26 ] ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "spans": [ [ 25972, 4 ] ] } ], "type": "pe" }, { "id": 8, "sha": "a602ecb6d1409b903bfa7f6d491a63e6545c4c15813cf90278547ebdf710105d", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/JJ.Framework.Existence.Core/JJ.Framework.Existence.Core.4.7.7026.nupkg!!lib/net6.0/JJ.Framework.Existence.Core.xml", "size": 378943, "type": "xml", "depth": 1 }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J\u0026m(0ji6Sa?dLD+]{51x(+zoA=kPhvqNb%vqY$3BrC47aAzQxazCZol@c-7zeP", "n": [ { "c": 3, "d": "HTTP fingerprinting evasion campaign", "i": "objectives/command-and-control/infrastructure/user-agent::http-fingerprinting-campaign", "o": 0, "z": 34, "cf": 0.8999999761581421 }, { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 78, "z": 4, "cf": 0.800000011920929 } ], "ln": 0 }, { "b": "00000000000000000000Hf:]Y00000nb@R\u00260SSx7oOirBb?-n00rr91000000000000", "n": [ { "c": 1, "d": "PE standard code/data section", "i": "metadata/binary/section/names::pe-code-data-standard-section", "o": 512, "z": 5, "cf": 0.8999999761581421 } ], "ln": 496 }, { "b": "00AvIwb(Pjz*?V^3mV\u0026wlq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn", "n": [ { "c": 2, "d": ".NET Metadata Root (BSJB)", "i": "metadata/binary/framework::dotnet-metadata", "o": 25932, "z": 4, "cf": 1.0 } ], "ln": 25916 }, { "b": "wO#71x\u003e5+!oLFM\u0026jxaG%Bzbxftu}kcD2[7sz7Xg]y\u00260V)BzkVhB1P%]zE)\u003c5v\u003eHtJ", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 106259, "z": 4, "cf": 0.800000011920929 } ], "ln": 106243 }, { "b": "yC552x(!xczEWlglVm0Re[w^m0afIQy?%8JD2NsZz!%j\u0026nmuNbz!%j\u0026nmuNqwNPaB", "n": [ { "c": 3, "d": "References Windows executable or script", "i": "objectives/execution/interpreter/script/shell::windows-executable-ref", "o": 109386, "z": 4, "cf": 0.6000000238418579 } ], "ln": 109370 }, { "b": "091k.wKyxLy?m9#x(v\u003e?pgn0Jr://!wKyxLy?m9#x(v\u003e?q/)4]zF8sPy\u00260V)BzkVh099]PA+5:4wN[wOwO(F", "n": [ { "c": 3, "d": "Usage of NameValueCollection (headers/params)", "i": "micro-behaviors/communications/http/server/managed::name-value-collection", "o": 109909, "z": 19, "cf": 1.0 } ], "ln": 109893 }, { "b": "z/x#3zVAspB4*H\u003cyJTN@q*ACawO\u003c4[x(m[\u003cq*ACawO\u003c4!z!%l3v@#B6zGvB2wO#71x\u003e5+!lVl=", "n": [ { "c": 3, "d": "LINQ query operations", "i": "micro-behaviors/data/db/linq::linq-queries", "o": 110226, "z": 11, "cf": 0.699999988079071 } ], "ln": 110210 }, { "b": "03znW0b}{W0bhBK0b.^B0bIST0b}{D0ce6F0bRZE0cwiL0ce6X03zn-0b8vv0cwh-", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 115755, "z": 4, "cf": 0.800000011920929 } ], "ln": 115739 }, { "b": "03zne08AO*089wY07c-=07^e^08rIP03znn0bhBI0bhBP0a=dv03zn.0at\u003et0a=c", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 117969, "z": 3, "cf": 0.800000011920929 } ], "ln": 117953 }, { "b": "z2!zMx-J2Jx8\u003cK:aom93n=RD-fAr^bfAs3iaoi$[aojXcqufO{k(+3/aoj$kp5)\u0026=q#!@VaojXcASyaWve$MMe=XlsASxUJve$xHwDkp4zua.TBo2.HzuaeDwDi?Mv/P{qyYFnKwDllvaol9Qzua+UwDl-Jzua8ByYFnKC(PC%aokdpzVB\u003eVaok*Iaolu", "n": [ { "c": 1, "d": "Encoded HTML tag fragment", "i": "objectives/anti-static/obfuscation/encoding/content::encoded-html-tag-fragment", "o": 122364, "z": 103, "cf": 0.699999988079071 } ], "ln": 122348 }, { "b": "03zn:0cncK0aV6L0at\u003eG03znW0aC}y0a=du0cwh(03zn=0b8vD0aM1x03znZ0a=c", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 127569, "z": 3, "cf": 0.800000011920929 } ], "ln": 127553 }, { "b": "fAr^bf-S)caoi$[aoj.dk(:*-mf1Cgq#*53pYJ]:qVE{uve$fBwb).LBo2$OwDlA", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 128644, "z": 3, "cf": 0.800000011920929 } ], "ln": 128628 }, { "b": "z2!zMx-J2Jx8\u003cK:aom0qn=RD-fAr^bf-T3gaoi$[aoj[imf36.mf3i=nDq9Taok7nnDqV?q#!@VaokptwDlrxyYF2Dv/QPJx-J5Kzu7^Vv/QAEBPujTwb).Lve$xHBo2\u003eLz2!IPBo0A-Bo3jVaok)KzVBUPA@ZpZASyjZv/QPJaok*Iaol3OwDlPFwDl-", "n": [ { "c": 1, "d": "Encoded HTML tag fragment", "i": "objectives/anti-static/obfuscation/encoding/content::encoded-html-tag-fragment", "o": 133916, "z": 103, "cf": 0.699999988079071 } ], "ln": 133900 }, { "b": "07c-{0bITK0bhBJ0a#o$0cncY0a=dE0aC}A0c[L!0bhBO03zn:0cncK0aV6L0aC}J0cwh-0b}{R0b?\u003cT0bITX03znK0b?\u003cO0b}{D0cwiP0aC}A0a=cM0cXAS0cwiO03znc08A", "n": [ { "c": 3, "d": ".NET current assembly lookup", "i": "objectives/anti-analysis/self-modify/runtime::dotnet-getexecutingassembly-token", "o": 135847, "z": 20, "cf": 0.8799999952316284 }, { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 135809, "z": 4, "cf": 0.800000011920929 } ], "ln": 135793 }, { "b": "00000000000000000000000000000000000000315c8Xg7YTL^00000000000000000", "n": [ { "c": 1, "d": "PE resource section", "i": "metadata/binary/section/names::pe-resource-section", "o": 147968, "z": 5, "cf": 0.8999999761581421 } ], "ln": 147952 }, { "b": "0000000000007dBgYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006Xn[brp!0rru81onA", "n": [ { "c": 2, "d": "PE version resource metadata", "i": "metadata/package/versioning::version-resource-metadata", "o": 148062, "z": 15, "cf": 0.8999999761581421 } ], "ln": 148046 }, { "b": "aol9QBo0][001[S3JHhclJz38z2!IPve$fBC(QOtve$cAwDhYg002Q\u003en=P$lB]U}Jzu7^Vs]-Evzu6Up003yb8#{0tmGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up002Q\u003en=QEzmGvDeve$c", "n": [ { "c": 2, "d": "PE CompanyName metadata field", "i": "metadata/package/versioning::pe-companyname-field", "o": 148730, "z": 11, "cf": 0.699999988079071 }, { "c": 2, "d": "PE FileDescription metadata field", "i": "metadata/package/versioning::pe-filedescription-field", "o": 148786, "z": 15, "cf": 0.699999988079071 } ], "ln": 148714 }, { "b": "lJz38ASxUJ001[S3JHhcmGvc5yYF2DrSDXhASydXx-J5Kzu6Up001?Qe=W*ge=W*gfAr\u003cdhukuffAq7M003ybaohAxnDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE002Q\u003en=QEzmGvDeve$cAwDl]O", "n": [ { "c": 2, "d": "PE FileVersion metadata field", "i": "metadata/package/versioning::pe-fileversion-field", "o": 148882, "z": 11, "cf": 0.699999988079071 }, { "c": 2, "d": "PE InternalName metadata field", "i": "metadata/package/versioning::pe-internalname-field", "o": 148938, "z": 12, "cf": 0.699999988079071 } ], "ln": 148866 }, { "b": "z#+d-ASx!Nx8(PBBn#pvlJz38z#+d-ASx!Nx8(PBBo0A-Sq[4vg5%0df-T0faoi$[aojd%fA", "n": [ { "c": 2, "d": "Copyright notice", "i": "metadata/package/license::copyright-word", "o": 149064, "z": 9, "cf": 0.6000000238418579 } ], "ln": 149048 }, { "b": "aokNBzVBUP003WjaohAxpxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE002Q\u003en=QEzmGvDeve$cA", "n": [ { "c": 2, "d": "PE OriginalFilename metadata field", "i": "metadata/package/versioning::pe-originalfilename-field", "o": 149154, "z": 16, "cf": 0.699999988079071 } ], "ln": 149138 }, { "b": "e=YzZyYFnK003a38#{0tpYLIozVBqFBPt[KBo25ove$cAwDhYg002Q\u003en=QEzmGvDeve$cAwDl]", "n": [ { "c": 2, "d": "PE ProductName metadata field", "i": "metadata/package/versioning::pe-productname-field", "o": 149258, "z": 11, "cf": 0.699999988079071 } ], "ln": 149242 }, { "b": "lJz38ASxUJ004/Pg5}sPpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001?Qe=W*ge=W*gfAr\u003cdhui", "n": [ { "c": 2, "d": "PE ProductVersion metadata field", "i": "metadata/package/versioning::pe-productversion-field", "o": 149346, "z": 14, "cf": 0.699999988079071 } ], "ln": 149330 }, { "b": "0000000000000000000008JZ%3\u0026*ncS6ggY000000000000000000000000000000000", "n": [ { "c": 2, "d": "PE .reloc section presence", "i": "metadata/binary/section/names::reloc-section-presence", "o": 150016, "z": 6, "cf": 0.8999999761581421 } ], "ln": 150000 } ], "depth": 1, "facts": { "imp": [ [ "mscoree", "CorDllMain" ] ], "sec": [ [ ".text", 512, 147456, 5.44, "r-x" ], [ ".rsrc", 147968, 2048, 2.89, "r--" ], [ ".reloc", 150016, 512, 0.1, "r--" ] ], "metrics": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "resource_count": 1.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 197951.0, "reloc_overhang_bytes": 500.0, "reloc_overhang_ratio": 0.98, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "version.identity_entropy": 4.14, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0, "version.identity_symbol_ratio": 0.09 }, "file": { "size": 150528.0, "entropy": 5.4, "size_bytes": 150528.0 }, "binary": { "is_pie": 1.0, "code_entropy": 5.44, "string_count": 490.0, "overall_entropy": 5.4, "entropy_variance": 4.75, "avg_string_length": 41.62, "max_string_length": 1003.0, "peak_region_bytes": 5120.0, "code_to_data_ratio": 1.0, "peak_region_entropy": 5.49, "string_length_stddev": 100.33, "largest_section_ratio": 0.98, "sentence_string_count": 39.0, "sentence_string_ratio": 0.08, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 147456.0, "entropy_max": 5.44, "entropy_mean": 2.81, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } } }, "id": 9, "mol": "O(Al)H₂(CmDb)", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/JJ.Framework.Existence.Core/JJ.Framework.Existence.Core.4.7.7026.nupkg!!lib/net7.0/JJ.Framework.Existence.Core.dll", "risk": 4, "sha": "e68e482155f819364b365e3ccaf16a9c04c633943148ddddbb1c16e3b24f4806", "size": 150528, "traits": [ { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "spans": [ [ 149346, 14 ] ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "spans": [ [ 109386, 4 ] ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 148062, 15 ] ] }, { "id": "objectives/anti-analysis/self-modify/runtime::dotnet-getexecutingassembly-token", "atk": "T1027.005", "conf": 0.8799999952316284, "crit": 3, "desc": ".NET current assembly lookup", "spans": [ [ 135847, 20 ] ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "spans": [ [ 148882, 11 ] ] }, { "id": "micro-behaviors/communications/http/server/managed::name-value-collection", "conf": 1.0, "crit": 3, "desc": "Usage of NameValueCollection (headers/params)", "spans": [ [ 109909, 19 ] ] }, { "id": "micro-behaviors/data/db/linq::linq-queries", "conf": 0.699999988079071, "crit": 3, "desc": "LINQ query operations", "spans": [ [ 110226, 11 ] ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "spans": [ [ 25932, 4 ] ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "spans": [ [ 0, 26 ] ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "spans": [ [ 25932, 4 ] ] } ], "type": "pe" }, { "id": 10, "sha": "7f8a052e69a7c9c1f5e24e660b6c1708e54c6443fda92d192374525ee3d135be", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/JJ.Framework.Existence.Core/JJ.Framework.Existence.Core.4.7.7026.nupkg!!lib/net7.0/JJ.Framework.Existence.Core.xml", "size": 378070, "type": "xml", "depth": 1 }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J\u0026m(0ji6Sa?dLD+]{51x(+zoA=kPhvqNb%vqY$3BrC47aAzQxazCZol@c-7zeP", "n": [ { "c": 3, "d": "HTTP fingerprinting evasion campaign", "i": "objectives/command-and-control/infrastructure/user-agent::http-fingerprinting-campaign", "o": 0, "z": 34, "cf": 0.8999999761581421 }, { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 78, "z": 4, "cf": 0.800000011920929 } ], "ln": 0 }, { "b": "00000000000000000000WP-!k00000nb@R\u00260SSx7TBZAL]W:9z0rr91000000000000", "n": [ { "c": 1, "d": "PE standard code/data section", "i": "metadata/binary/section/names::pe-code-data-standard-section", "o": 512, "z": 5, "cf": 0.8999999761581421 } ], "ln": 496 }, { "b": "00AvIve{ogz*.P=3mV\u0026wlq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn", "n": [ { "c": 2, "d": ".NET Metadata Root (BSJB)", "i": "metadata/binary/framework::dotnet-metadata", "o": 25772, "z": 4, "cf": 1.0 } ], "ln": 25756 }, { "b": "wO#71x\u003e5+!oLFM\u0026jxaG%Bzbxftu}kcD2[7sz7Xg]y\u00260V)BzkVhB1P%]zE)\u003c5v\u003eHtJ", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 105847, "z": 4, "cf": 0.800000011920929 } ], "ln": 105831 }, { "b": "yC552x(!xczEWlglVm0Re[w^m0afIQy?%8JD2NsZz!%j\u0026nmuNbz!%j\u0026nmuNqwNPaB", "n": [ { "c": 3, "d": "References Windows executable or script", "i": "objectives/execution/interpreter/script/shell::windows-executable-ref", "o": 108923, "z": 4, "cf": 0.6000000238418579 } ], "ln": 108907 }, { "b": "091k.wKyxLy?m9#x(v\u003e?pgn0Jr://!wKyxLy?m9#x(v\u003e?q/)4]zF8sPy\u00260V)BzkVh099]PA+5:4wN[wOwO(F", "n": [ { "c": 3, "d": "Usage of NameValueCollection (headers/params)", "i": "micro-behaviors/communications/http/server/managed::name-value-collection", "o": 109438, "z": 19, "cf": 1.0 } ], "ln": 109422 }, { "b": "z/x#3zVAspB4*H\u003cyJTN@q*ACawO\u003c4[x(m[\u003cq*ACawO\u003c4!z!%l3v@#B6zGvB2wO#71x\u003e5+!lVl=", "n": [ { "c": 3, "d": "LINQ query operations", "i": "micro-behaviors/data/db/linq::linq-queries", "o": 109755, "z": 11, "cf": 0.699999988079071 } ], "ln": 109739 }, { "b": "03znW0b}{W0bhBK0b.^B0bIST0b}{D0ce6F0bRZE0cwiL0ce6X03zn-0b8vv0cwh-", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 115181, "z": 4, "cf": 0.800000011920929 } ], "ln": 115165 }, { "b": "03zne08AO*089wY07c-=07^e^08rIP03znn0bhBI0bhBP0a=dv03zn.0at\u003et0a=c", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 117395, "z": 3, "cf": 0.800000011920929 } ], "ln": 117379 }, { "b": "z2!zMx-J2Jx8\u003cK:aom93n=RD-fAr^bfAs3iaoi$[aojXcqufO{k(+3/aoj$kp5)\u0026=q#!@VaojXcASyaWve$MMe=XlsASxUJve$xHwDkp4zua.TBo2.HzuaeDwDi?Mv/P{qyYFnKwDllvaol9Qzua+UwDl-Jzua8ByYFnKC(PC%aokdpzVB\u003eVaok*Iaolu", "n": [ { "c": 1, "d": "Encoded HTML tag fragment", "i": "objectives/anti-static/obfuscation/encoding/content::encoded-html-tag-fragment", "o": 121790, "z": 103, "cf": 0.699999988079071 } ], "ln": 121774 }, { "b": "03zn:0cncK0aV6L0at\u003eG03znW0aC}y0a=du0cwh(03zn=0b8vD0aM1x03znZ0a=c", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 126995, "z": 3, "cf": 0.800000011920929 } ], "ln": 126979 }, { "b": "fAr^bf-S)caoi$[aoj.dk(:*-mf1Cgq#*53pYJ]:qVE{uve$fBwb).LBo2$OwDlA", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 128070, "z": 3, "cf": 0.800000011920929 } ], "ln": 128054 }, { "b": "z2!zMx-J2Jx8\u003cK:aom0qn=RD-fAr^bf-T3gaoi$[aoj[imf36.mf3i=nDq9Taok7nnDqV?q#!@VaokptwDlrxyYF2Dv/QPJx-J5Kzu7^Vv/QAEBPujTwb).Lve$xHBo2\u003eLz2!IPBo0A-Bo3jVaok)KzVBUPA@ZpZASyjZv/QPJaok*Iaol3OwDlPFwDl-", "n": [ { "c": 1, "d": "Encoded HTML tag fragment", "i": "objectives/anti-static/obfuscation/encoding/content::encoded-html-tag-fragment", "o": 133342, "z": 103, "cf": 0.699999988079071 } ], "ln": 133326 }, { "b": "07c-{0bITK0bhBJ0a#o$0cncY0a=dE0aC}A0c[L!0bhBO03zn:0cncK0aV6L0aC}J0cwh-0b}{R0b?\u003cT0bITX03znK0b?\u003cO0b}{D0cwiP0aC}A0a=cM0cXAS0cwiO03znc08A", "n": [ { "c": 3, "d": ".NET current assembly lookup", "i": "objectives/anti-analysis/self-modify/runtime::dotnet-getexecutingassembly-token", "o": 135273, "z": 20, "cf": 0.8799999952316284 }, { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 135235, "z": 4, "cf": 0.800000011920929 } ], "ln": 135219 }, { "b": "00000000000000000000000000000000000000315c8Xg7YTL^00000000000000000", "n": [ { "c": 1, "d": "PE resource section", "i": "metadata/binary/section/names::pe-resource-section", "o": 146944, "z": 5, "cf": 0.8999999761581421 } ], "ln": 146928 }, { "b": "0000000000007dBgYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006Xn[brp!0rru81onA", "n": [ { "c": 2, "d": "PE version resource metadata", "i": "metadata/package/versioning::version-resource-metadata", "o": 147038, "z": 15, "cf": 0.8999999761581421 } ], "ln": 147022 }, { "b": "aol9QBo0][001[S3JHhclJz38z2!IPve$fBC(QOtve$cAwDhYg002Q\u003en=P$lB]U}Jzu7^Vs]-Evzu6Up003yb8#{0tmGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up002Q\u003en=QEzmGvDeve$c", "n": [ { "c": 2, "d": "PE CompanyName metadata field", "i": "metadata/package/versioning::pe-companyname-field", "o": 147706, "z": 11, "cf": 0.699999988079071 }, { "c": 2, "d": "PE FileDescription metadata field", "i": "metadata/package/versioning::pe-filedescription-field", "o": 147762, "z": 15, "cf": 0.699999988079071 } ], "ln": 147690 }, { "b": "lJz38ASxUJ001[S3JHhcmGvc5yYF2DrSDXhASydXx-J5Kzu6Up001?Qe=W*ge=W*gfAr\u003cdhukuffAq7M003ybaohAxnDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE002Q\u003en=QEzmGvDeve$cAwDl]O", "n": [ { "c": 2, "d": "PE FileVersion metadata field", "i": "metadata/package/versioning::pe-fileversion-field", "o": 147858, "z": 11, "cf": 0.699999988079071 }, { "c": 2, "d": "PE InternalName metadata field", "i": "metadata/package/versioning::pe-internalname-field", "o": 147914, "z": 12, "cf": 0.699999988079071 } ], "ln": 147842 }, { "b": "z#+d-ASx!Nx8(PBBn#pvlJz38z#+d-ASx!Nx8(PBBo0A-Sq[4vg5%0df-T0faoi$[aojd%fA", "n": [ { "c": 2, "d": "Copyright notice", "i": "metadata/package/license::copyright-word", "o": 148040, "z": 9, "cf": 0.6000000238418579 } ], "ln": 148024 }, { "b": "aokNBzVBUP003WjaohAxpxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE002Q\u003en=QEzmGvDeve$cA", "n": [ { "c": 2, "d": "PE OriginalFilename metadata field", "i": "metadata/package/versioning::pe-originalfilename-field", "o": 148130, "z": 16, "cf": 0.699999988079071 } ], "ln": 148114 }, { "b": "e=YzZyYFnK003a38#{0tpYLIozVBqFBPt[KBo25ove$cAwDhYg002Q\u003en=QEzmGvDeve$cAwDl]", "n": [ { "c": 2, "d": "PE ProductName metadata field", "i": "metadata/package/versioning::pe-productname-field", "o": 148234, "z": 11, "cf": 0.699999988079071 } ], "ln": 148218 }, { "b": "lJz38ASxUJ004/Pg5}sPpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001?Qe=W*ge=W*gfAr\u003cdhui", "n": [ { "c": 2, "d": "PE ProductVersion metadata field", "i": "metadata/package/versioning::pe-productversion-field", "o": 148322, "z": 14, "cf": 0.699999988079071 } ], "ln": 148306 }, { "b": "0000000000000000000008JZ%3\u0026*nc/Gf6k000000000000000000000000000000000", "n": [ { "c": 2, "d": "PE .reloc section presence", "i": "metadata/binary/section/names::reloc-section-presence", "o": 148992, "z": 6, "cf": 0.8999999761581421 } ], "ln": 148976 } ], "depth": 1, "facts": { "imp": [ [ "mscoree", "CorDllMain" ] ], "sec": [ [ ".text", 512, 146432, 5.44, "r-x" ], [ ".rsrc", 146944, 2048, 2.89, "r--" ], [ ".reloc", 148992, 512, 0.1, "r--" ] ], "metrics": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "resource_count": 1.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 187364.0, "reloc_overhang_bytes": 500.0, "reloc_overhang_ratio": 0.98, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "version.identity_entropy": 4.14, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0, "version.identity_symbol_ratio": 0.09 }, "file": { "size": 149504.0, "entropy": 5.4, "size_bytes": 149504.0 }, "binary": { "is_pie": 1.0, "code_entropy": 5.44, "string_count": 478.0, "overall_entropy": 5.4, "entropy_variance": 4.75, "avg_string_length": 42.38, "max_string_length": 1003.0, "peak_region_bytes": 1024.0, "code_to_data_ratio": 1.0, "peak_region_entropy": 5.9, "string_length_stddev": 101.45, "largest_section_ratio": 0.98, "sentence_string_count": 38.0, "sentence_string_ratio": 0.08, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 146432.0, "entropy_max": 5.44, "entropy_mean": 2.81, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } } }, "id": 11, "mol": "O(Al)H₂(CmDb)", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/JJ.Framework.Existence.Core/JJ.Framework.Existence.Core.4.7.7026.nupkg!!lib/net8.0/JJ.Framework.Existence.Core.dll", "risk": 4, "sha": "e50b1a8fad901928b223e0c572a4d65a52503196f8491cb8f09e3f40d0fc6093", "size": 149504, "traits": [ { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "spans": [ [ 148322, 14 ] ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "spans": [ [ 108923, 4 ] ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 147038, 15 ] ] }, { "id": "objectives/anti-analysis/self-modify/runtime::dotnet-getexecutingassembly-token", "atk": "T1027.005", "conf": 0.8799999952316284, "crit": 3, "desc": ".NET current assembly lookup", "spans": [ [ 135273, 20 ] ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "spans": [ [ 147858, 11 ] ] }, { "id": "micro-behaviors/communications/http/server/managed::name-value-collection", "conf": 1.0, "crit": 3, "desc": "Usage of NameValueCollection (headers/params)", "spans": [ [ 109438, 19 ] ] }, { "id": "micro-behaviors/data/db/linq::linq-queries", "conf": 0.699999988079071, "crit": 3, "desc": "LINQ query operations", "spans": [ [ 109755, 11 ] ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "spans": [ [ 25772, 4 ] ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "spans": [ [ 0, 26 ] ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "spans": [ [ 25772, 4 ] ] } ], "type": "pe" }, { "id": 12, "sha": "cfae3b144b54d519c8eb955cdf20221896062bb547b8f748700b28c08b13e3aa", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/JJ.Framework.Existence.Core/JJ.Framework.Existence.Core.4.7.7026.nupkg!!lib/net8.0/JJ.Framework.Existence.Core.xml", "size": 377798, "type": "xml", "depth": 1 }, { "id": 13, "mol": "H₂(CmDb)", "sha": "4a47730f975113ce09e2050b695c515d5c6ebbf5cb5b30f7d3adfe7edb26b38c", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/JJ.Framework.Existence.Core/JJ.Framework.Existence.Core.4.7.7026.nupkg!!lib/net9.0/JJ.Framework.Existence.Core.dll", "risk": 3, "size": 151040, "type": "pe", "depth": 1 }, { "id": 14, "sha": "78d5a5e9a726edfd6282e35d00f8001778359d45e9f37f2aac217ebaf98a0304", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/JJ.Framework.Existence.Core/JJ.Framework.Existence.Core.4.7.7026.nupkg!!lib/net9.0/JJ.Framework.Existence.Core.xml", "size": 383345, "type": "xml", "depth": 1 }, { "id": 15, "mol": "H₂(CmDb)", "sha": "62c7f63543d8220454fba79f30644a9afe73fd9bc5725fe6fff3cb9c894a8493", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/JJ.Framework.Existence.Core/JJ.Framework.Existence.Core.4.7.7026.nupkg!!lib/netstandard2.0/JJ.Framework.Existence.Core.dll", "risk": 3, "size": 159232, "type": "pe", "depth": 1 }, { "id": 16, "sha": "159f4a91ddf95d8404ddff914411dcf4d0a34b7bba6161b1d4b565497554a775", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/JJ.Framework.Existence.Core/JJ.Framework.Existence.Core.4.7.7026.nupkg!!lib/netstandard2.0/JJ.Framework.Existence.Core.xml", "size": 386696, "type": "xml", "depth": 1 }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J\u0026m(0ji6Sa?dLD+]{51x(+zoA=kPhvqNb%vqY$3BrC47aAzQxazCZol@c-7zeP", "n": [ { "c": 3, "d": "HTTP fingerprinting evasion campaign", "i": "objectives/command-and-control/infrastructure/user-agent::http-fingerprinting-campaign", "o": 0, "z": 34, "cf": 0.8999999761581421 }, { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 78, "z": 4, "cf": 0.800000011920929 } ], "ln": 0 }, { "b": "00000000000000000000ERn=.00000nb@R\u00260SSx7H\u003etWc/Y8#j0rr91000000000000", "n": [ { "c": 1, "d": "PE standard code/data section", "i": "metadata/binary/section/names::pe-code-data-standard-section", "o": 512, "z": 5, "cf": 0.8999999761581421 } ], "ln": 496 }, { "b": "00AvIIu0RVz*RJ+3mV\u0026wlq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn", "n": [ { "c": 2, "d": ".NET Metadata Root (BSJB)", "i": "metadata/binary/framework::dotnet-metadata", "o": 25992, "z": 4, "cf": 1.0 } ], "ln": 25976 }, { "b": "wO#71x\u003e5+!oLFM\u0026jxaG%Bzbxftu}kcD2[7sz7Xg]y\u00260V)BzkVhB1P%]zE)\u003c5v\u003eHtJ", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 107603, "z": 4, "cf": 0.800000011920929 } ], "ln": 107587 }, { "b": "yC552x(!xczEWlglVm0Re[w^m0843xyYE*Tx(4O=rc-B]lVl^S07ZKtlVl^S07ZKt", "n": [ { "c": 3, "d": "References Windows executable or script", "i": "objectives/execution/interpreter/script/shell::windows-executable-ref", "o": 111445, "z": 4, "cf": 0.6000000238418579 } ], "ln": 111429 }, { "b": "091k.wKyxLy?m9#x(v\u003e?pgn0Jr://!wKyxLy?m9#x(v\u003e?q/)4]zF8sPy\u00260V)BzkVh083)GB3\u003c\u003eZy?m9#x(v\u003e", "n": [ { "c": 3, "d": "Usage of NameValueCollection (headers/params)", "i": "micro-behaviors/communications/http/server/managed::name-value-collection", "o": 112037, "z": 19, "cf": 1.0 } ], "ln": 112021 }, { "b": "z/x#3zVAspB4*H\u003cyJTN@q*ACawO\u003c4[x(m[\u003cq*ACawO\u003c4!z!%l3v@#B6zGvB2wO#71x\u003e5+!lVl=", "n": [ { "c": 3, "d": "LINQ query operations", "i": "micro-behaviors/data/db/linq::linq-queries", "o": 112329, "z": 11, "cf": 0.699999988079071 } ], "ln": 112313 }, { "b": "03znW0b}{W0bhBK0b.^B0bIST0b}{D0ce6F0bRZE0cwiL0ce6X03zn-0b8vv0cwh-", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 118115, "z": 4, "cf": 0.800000011920929 } ], "ln": 118099 }, { "b": "03zne08AO*089wY07c-=07^e^08rIP03znn0bhBI0bhBP0a=dv03zn.0at\u003et0a=c", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 120329, "z": 3, "cf": 0.800000011920929 } ], "ln": 120313 }, { "b": "z2!zMx-J2Jx8\u003cK:aom93n=RD-fAr^bfAs3iaoi$[aojXcqufO{k(+3/aoj$kp5)\u0026=q#!@VaojXcASyaWve$MMe=XlsASxUJve$xHwDkp4zua.TBo2.HzuaeDwDi?Mv/P{qyYFnKwDllvaol9Qzua+UwDl-Jzua8ByYFnKC(PC%aokdpzVB\u003eVaok*Iaolu", "n": [ { "c": 1, "d": "Encoded HTML tag fragment", "i": "objectives/anti-static/obfuscation/encoding/content::encoded-html-tag-fragment", "o": 124724, "z": 103, "cf": 0.699999988079071 } ], "ln": 124708 }, { "b": "03zn:0cncK0aV6L0at\u003eG03znW0aC}y0a=du0cwh(03zn=0b8vD0aM1x03znZ0a=c", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 129929, "z": 3, "cf": 0.800000011920929 } ], "ln": 129913 }, { "b": "fAr^bf-S)caoi$[aoj.dk(:*-mf1Cgq#*53pYJ]:qVE{uve$fBwb).LBo2$OwDlA", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 131004, "z": 3, "cf": 0.800000011920929 } ], "ln": 130988 }, { "b": "z2!zMx-J2Jx8\u003cK:aom0qn=RD-fAr^bf-T3gaoi$[aoj[imf36.mf3i=nDq9Taok7nnDqV?q#!@VaokptwDlrxyYF2Dv/QPJx-J5Kzu7^Vv/QAEBPujTwb).Lve$xHBo2\u003eLz2!IPBo0A-Bo3jVaok)KzVBUPA@ZpZASyjZv/QPJaok*Iaol3OwDlPFwDl-", "n": [ { "c": 1, "d": "Encoded HTML tag fragment", "i": "objectives/anti-static/obfuscation/encoding/content::encoded-html-tag-fragment", "o": 136276, "z": 103, "cf": 0.699999988079071 } ], "ln": 136260 }, { "b": "07c-{0bITK0bhBJ0a#o$0cncY0a=dE0aC}A0c[L!0bhBO03zn:0cncK0aV6L0aC}J0cwh-0b}{R0b?\u003cT0bITX03znK0b?\u003cO0b}{D0cwiP0aC}A0a=cM0cXAS0cwiO03znc08A", "n": [ { "c": 3, "d": ".NET current assembly lookup", "i": "objectives/anti-analysis/self-modify/runtime::dotnet-getexecutingassembly-token", "o": 138207, "z": 20, "cf": 0.8799999952316284 }, { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 138169, "z": 4, "cf": 0.800000011920929 } ], "ln": 138153 }, { "b": "00000000000000000000000000000000000000315c8Xg7YTL^00000000000000000", "n": [ { "c": 1, "d": "PE resource section", "i": "metadata/binary/section/names::pe-resource-section", "o": 150528, "z": 5, "cf": 0.8999999761581421 } ], "ln": 150512 }, { "b": "0000000000007dBgYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006Xn[brp!0rru81onA", "n": [ { "c": 2, "d": "PE version resource metadata", "i": "metadata/package/versioning::version-resource-metadata", "o": 150622, "z": 15, "cf": 0.8999999761581421 } ], "ln": 150606 }, { "b": "aol9QBo0][001[S3JHhclJz38z2!IPve$fBC(QOtve$cAwDhYg002Q\u003en=P$lB]U}Jzu7^Vs]-Evzu6Up003yb8#{0tmGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up002Q\u003en=QEzmGvDeve$c", "n": [ { "c": 2, "d": "PE CompanyName metadata field", "i": "metadata/package/versioning::pe-companyname-field", "o": 151290, "z": 11, "cf": 0.699999988079071 }, { "c": 2, "d": "PE FileDescription metadata field", "i": "metadata/package/versioning::pe-filedescription-field", "o": 151346, "z": 15, "cf": 0.699999988079071 } ], "ln": 151274 }, { "b": "lJz38ASxUJ001[S3JHhcmGvc5yYF2DrSDXhASydXx-J5Kzu6Up001?Qe=W*ge=W*gfAr\u003cdhukuffAq7M003ybaohAxnDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE002Q\u003en=QEzmGvDeve$cAwDl]O", "n": [ { "c": 2, "d": "PE FileVersion metadata field", "i": "metadata/package/versioning::pe-fileversion-field", "o": 151442, "z": 11, "cf": 0.699999988079071 }, { "c": 2, "d": "PE InternalName metadata field", "i": "metadata/package/versioning::pe-internalname-field", "o": 151498, "z": 12, "cf": 0.699999988079071 } ], "ln": 151426 }, { "b": "z#+d-ASx!Nx8(PBBn#pvlJz38z#+d-ASx!Nx8(PBBo0A-Sq[4vg5%0df-T0faoi$[aojd%fA", "n": [ { "c": 2, "d": "Copyright notice", "i": "metadata/package/license::copyright-word", "o": 151624, "z": 9, "cf": 0.6000000238418579 } ], "ln": 151608 }, { "b": "aokNBzVBUP003WjaohAxpxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE002Q\u003en=QEzmGvDeve$cA", "n": [ { "c": 2, "d": "PE OriginalFilename metadata field", "i": "metadata/package/versioning::pe-originalfilename-field", "o": 151714, "z": 16, "cf": 0.699999988079071 } ], "ln": 151698 }, { "b": "e=YzZyYFnK003a38#{0tpYLIozVBqFBPt[KBo25ove$cAwDhYg002Q\u003en=QEzmGvDeve$cAwDl]", "n": [ { "c": 2, "d": "PE ProductName metadata field", "i": "metadata/package/versioning::pe-productname-field", "o": 151818, "z": 11, "cf": 0.699999988079071 } ], "ln": 151802 }, { "b": "lJz38ASxUJ004/Pg5}sPpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001?Qe=W*ge=W*gfAr\u003cdhui", "n": [ { "c": 2, "d": "PE ProductVersion metadata field", "i": "metadata/package/versioning::pe-productversion-field", "o": 151906, "z": 14, "cf": 0.699999988079071 } ], "ln": 151890 }, { "b": "000000000000000000000ak\u003cd3\u0026*ncPF#]K000000000000000000000000000000000", "n": [ { "c": 2, "d": "PE .reloc section presence", "i": "metadata/binary/section/names::reloc-section-presence", "o": 152576, "z": 6, "cf": 0.8999999761581421 } ], "ln": 152560 } ], "depth": 1, "facts": { "imp": [ [ "mscoree", "CorDllMain" ] ], "sec": [ [ ".text", 512, 150016, 5.42, "r-x" ], [ ".rsrc", 150528, 2048, 2.89, "r--" ], [ ".reloc", 152576, 512, 0.1, "r--" ] ], "metrics": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "resource_count": 1.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 178851.0, "reloc_overhang_bytes": 500.0, "reloc_overhang_ratio": 0.98, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "version.identity_entropy": 4.14, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0, "version.identity_symbol_ratio": 0.09 }, "file": { "size": 153088.0, "entropy": 5.38, "size_bytes": 153088.0 }, "binary": { "is_pie": 1.0, "code_entropy": 5.42, "string_count": 544.0, "overall_entropy": 5.38, "entropy_variance": 4.72, "avg_string_length": 39.28, "max_string_length": 1003.0, "peak_region_bytes": 1024.0, "code_to_data_ratio": 1.0, "peak_region_entropy": 5.85, "string_length_stddev": 95.68, "largest_section_ratio": 0.98, "sentence_string_count": 41.0, "sentence_string_ratio": 0.08, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 150016.0, "entropy_max": 5.42, "entropy_mean": 2.8, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } } }, "id": 17, "mol": "O(Al)H₂(CmDb)", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/JJ.Framework.Existence.Core/JJ.Framework.Existence.Core.4.7.7026.nupkg!!lib/netstandard2.1/JJ.Framework.Existence.Core.dll", "risk": 4, "sha": "36dcbf9f1cb2061a5fc5663f75d45db9569b37a7a870779738cd596fcb383fdc", "size": 153088, "traits": [ { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "spans": [ [ 151906, 14 ] ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "spans": [ [ 111445, 4 ] ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 150622, 15 ] ] }, { "id": "objectives/anti-analysis/self-modify/runtime::dotnet-getexecutingassembly-token", "atk": "T1027.005", "conf": 0.8799999952316284, "crit": 3, "desc": ".NET current assembly lookup", "spans": [ [ 138207, 20 ] ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "spans": [ [ 151442, 11 ] ] }, { "id": "micro-behaviors/communications/http/server/managed::name-value-collection", "conf": 1.0, "crit": 3, "desc": "Usage of NameValueCollection (headers/params)", "spans": [ [ 112037, 19 ] ] }, { "id": "micro-behaviors/data/db/linq::linq-queries", "conf": 0.699999988079071, "crit": 3, "desc": "LINQ query operations", "spans": [ [ 112329, 11 ] ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "spans": [ [ 25992, 4 ] ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "spans": [ [ 0, 26 ] ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "spans": [ [ 25992, 4 ] ] } ], "type": "pe" }, { "id": 18, "sha": "bb7a6f21ec381d2fa04c399a6a416263ca10172ae09ef667285756f75deaa4dd", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/JJ.Framework.Existence.Core/JJ.Framework.Existence.Core.4.7.7026.nupkg!!lib/netstandard2.1/JJ.Framework.Existence.Core.xml", "size": 384465, "type": "xml", "depth": 1 }, { "id": 19, "sha": "40fd018a9c6d322243f58ddfacaa170e43ef1f008dcb644df2b1ff92615d8ac1", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/JJ.Framework.Existence.Core/JJ.Framework.Existence.Core.4.7.7026.nupkg!![Content_Types].xml", "size": 653, "type": "xml", "depth": 1 }, { "id": 20, "sha": "4e6e5508c24f151daf05d25bae4e32a4698f65b4bf9437b01f4a756b596f67a6", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/JJ.Framework.Existence.Core/JJ.Framework.Existence.Core.4.7.7026.nupkg!!package/services/metadata/core-properties/f60054eddf7c4767b5bbd2d02798d007.psmdcp", "size": 987, "type": "xml", "depth": 1 } ], "omitted_files": 15, "rev": "33de0", "v": "8" } }