{ "ml": { "v": "7", "eng": "2.4.0-beta.1", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.1892737, "rte": "az", "prob": 0.1892737 }, { "cls": 0, "raw": 0.031909674, "rte": "az/nupkg", "prob": 0.031909674 } ], "prob": 0.30803978, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.3080397844314575, "type": "nupkg" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.0000073909759521484375, "type": "xml" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.000006983677394600818, "type": "xml" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.000007410844318656018, "type": "text" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.000007291635029105237, "type": "markdown" }, { "id": 5, "lvl": -1, "conf": 0, "prob": 0.000007927417755126953, "type": "png" }, { "id": 6, "lvl": -1, "conf": 0, "prob": 0.3080397844314575, "type": "pe" }, { "id": 7, "lvl": -1, "conf": 0, "prob": 0.000007271766662597656, "type": "xml" }, { "id": 8, "lvl": -1, "conf": 0, "prob": 0.00000712275505065918, "type": "xml" }, { "id": 9, "lvl": -1, "conf": 0, "prob": 0.0000073909759521484375, "type": "xml" }, { "id": 10, "lvl": -1, "conf": 0, "prob": 0.000009526808753435034, "type": "registry" } ], "version": "v18.18", "analyzed_at": "2026-07-24T07:44:21Z" }, "path": "Soenneker.Instantly.Suite.4.0.3837.nupkg", "raw": { "files": [ { "id": 0, "ctx": [ { "b": "p!H([6Awak2ML)P{GQ2*xyNbC00095000xb003wDwO=Ave]\u003eJtBcI!)y63abmC\u003e.mKAV)ZmOLp\u003eG5WL)rw$EBu=I3+HA}=BZecveRo*\u003cM9pz=rrYq$ie2m0lz/wbZm=nBMTSFEedp%^]ywCr\u003c.kJk2ka=Vn\u003e\u0026Lt", "n": [ { "c": 2, "d": "Archive contains an executable member", "i": "metadata/file/metrics::archive-contains-executable-member", "o": 0, "z": 31, "cf": 0.949999988079071 } ], "ln": 0 } ], "mol": "H(Cm)Md₂(BiPa)", "sha": "fbbce487c71f96eee86eff9b676d5039041cebeede784ebbf6dafab70fd5bf83", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Soenneker.Instantly.Suite/Soenneker.Instantly.Suite.4.0.3837.nupkg", "risk": 4, "size": 35755, "type": "nupkg", "facts": { "metrics": { "file": { "size": 35755.0, "entropy": 7.91, "size_bytes": 35755.0 }, "binary": { "overall_entropy": 7.91, "peak_region_bytes": 31744.0, "peak_region_entropy": 7.85 }, "archive": { "file_count": 10.0, "member_count": 10.0, "script_count": 0.0, "zip_bomb_ratio": 4.03, "directory_count": 0.0, "executable_count": 1.0, "extra_field_size": 0.0, "noise_file_count": 0.0, "total_compressed": 34447.0, "compression.ratio": 0.77, "hidden_file_count": 2.0, "total_uncompressed": 44678.0, "crc_collision_count": 0.0, "entry_comment_count": 0.0, "max_filename_length": 81.0, "rtlo_filename_count": 0.0, "format.regular_count": 10.0, "nested_archive_count": 0.0, "path_traversal_count": 0.0, "symlink_escape_count": 0.0, "security.setgid_count": 0.0, "security.setuid_count": 0.0, "security.sticky_count": 0.0, "double_extension_count": 0.0, "duplicate_member_count": 0.0, "security.symlink_count": 0.0, "unicode_filename_count": 0.0, "homoglyph_filename_count": 0.0, "security.encrypted_count": 0.0, "timing.mtime_unique_count": 4.0, "timing.mtime_unique_ratio": 0.4, "misplaced_executable_count": 1.0, "timing.mtime_dominant_count": 4.0, "timing.mtime_spread_seconds": 25172.0, "timing.sentinel_mtime_count": 0.0, "security.world_writable_count": 0.0, "timing.mtime_dominant_fraction": 0.4, "compression.method_counts.stored": 1.0, "compression.method_counts.deflate": 9.0 } } }, "ident": { "name": { "value": "Soenneker.Instantly.Suite", "source": "nupkg.title", "verified": false }, "urls": [ { "url": "https://github.com/soenneker/soenneker.instantly.suite", "kind": "homepage", "source": "nupkg.project_url" }, { "url": "https://github.com/soenneker/soenneker.instantly.suite", "kind": "repository", "source": "nupkg.repository_url" } ], "trust": "unsigned", "authors": [ { "name": "Jake Soenneker", "role": "author", "source": "nupkg.authors" } ], "version": { "value": "4.0.3837", "source": "nupkg.version", "verified": false }, "identifier": { "value": "Soenneker.Instantly.Suite", "source": "nupkg.id", "verified": false } }, "traits": [ { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "from": [ { "file": 6 } ] }, { "id": "metadata/package/versioning::pe-productversion-semver-git-hash", "conf": 0.8999999761581421, "crit": 3, "desc": "PE ProductVersion has SemVer git hash" }, { "id": "micro-behaviors/communications/http/url/domain::http-url-binary", "atk": "T1071.001", "mbc": "C0002", "conf": 0.699999988079071, "crit": 3, "desc": "Hardcoded network URL with domain name", "from": [ { "file": 6 } ] }, { "id": "metadata/binary/metrics/entropy::code-entropy-at-most-7-5", "conf": 0.699999988079071, "crit": 1, "desc": "Code entropy is 7.5 or lower", "from": [ { "file": 6 } ] }, { "id": "metadata/binary/layout::pe-no-signature-record", "conf": 0.949999988079071, "crit": 3, "desc": "PE has no signature record" }, { "id": "metadata/package/versioning::pe-internalname-field", "conf": 0.699999988079071, "crit": 3, "desc": "PE version metadata includes InternalName", "from": [ { "file": 6 } ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 3, "desc": "PE version metadata includes ProductVersion", "from": [ { "file": 6 } ] }, { "id": "metadata/package/versioning::pe-companyname-field", "conf": 0.699999988079071, "crit": 3, "desc": "PE version metadata includes CompanyName", "from": [ { "file": 6 } ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR header (COM descriptor)" }, { "id": "metadata/package/versioning::pe-filedescription-field", "conf": 0.699999988079071, "crit": 3, "desc": "PE version metadata includes FileDescription", "from": [ { "file": 6 } ] }, { "id": "metadata/build/reproducible::pe-reproducible-build", "conf": 1.0, "crit": 2, "desc": "Built with /Brepro (deterministic)" }, { "id": "metadata/binary/anomaly/provenance::pe-far-future-timestamp", "conf": 0.949999988079071, "crit": 2, "desc": "PE COFF timestamp encodes a future date" }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET managed assembly", "from": [ { "off": 704, "file": 6 } ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 3, "desc": "PE version metadata includes FileVersion", "from": [ { "file": 6 } ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET metadata root signature (BSJB)", "from": [ { "file": 6 } ] } ] }, { "depth": 1, "facts": { "metrics": { "file": { "size": 515.0, "entropy": 5.15, "size_bytes": 515.0 }, "binary": { "overall_entropy": 5.15, "peak_region_bytes": 515.0, "peak_region_entropy": 5.15 } } }, "id": 1, "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Soenneker.Instantly.Suite/Soenneker.Instantly.Suite.4.0.3837.nupkg!!_rels/.rels", "pid": 0, "sha": "effeeb3f2e893b1bbe6027c96e12bbc232d7bc16df323f45a43141bc11fc3347", "size": 515, "type": "xml" }, { "ctx": [ { "b": "[4ls%kx}3YaA?spB7]MgjT8QkfD}SJzEWP}x(mMDb6w0teJs}sj{\u003cz\u003evpK7YxjSigzes9hjTaMYBz%n]flpSpwO\u003e\u003c%e]trjA=l2qw]]Unz/4dDvpK7Yxk8l@fetjogCpBtfk+]NAaJJiCYNytj{\u0026zPjz!UKvpS!*vlL2varR^?x\u003efzaz!i*7wOU\u003c$e\u003eG@4Byx6ey\u003cvTiB.L@ejtgzVj{\u0026zParS^\u0026wPz\u003caz/d-}e?![li5rGQflQ]EB7]Mgj{\u0026zParS^PB-.qnA=TApvqxA%q/uk+zE)P{AY=0-B-.qnA=TzKarR^HjzX.wwO#N2aAR)FwJ.kGCYmXmB8#5lzx.nsnMm/9y?Wx\u003czGxwM3lQDlauTEOv}xL0wMr+!k4]4WAc15[fkLujwO#N2B1RuMxjVfqz/PFzo?wqDfkLujwO#N2rDq[t3lQDlauTvFz/d:Mv@DlqAbGqJfkj{mzAXyIarR^?A+eV\u0026zdL[eml%somj@B/jtg.^vpTj^j{\u0026zParS^=A=kY7v@$Z\u003ey^8JOBz#pZfe3%LBzb/ae[n*pflq5yzF\u003c33wPxCBz!i*7wOU\u003c$e[]iAByx6ey\u003cvTOB.L@ejtgU]z!-\u0026[Bx9u$j{\u0026zParS^SwPIv4x(Ffdz/d:8ay/tbAb]J6wO#N6C4z!qB.L@eaA7\u003cmB-.tlx([Ryy?Wv0vrc6[B0b7kAV^}\u003eB97\u0026dBzMjPvqd9gave*}jtgkRB7ol8Acb/jzAXyIarR^?A+f5#vrl0Pz//Mik2(Mjvru66wmYZ\u003ezE^r@v%Gg}z!i*7wOU\u003c$e\u003eG@4Byx6ey\u003cvT0zEEvbBzklaaARJAg+HEmf/p^DasFD\u003egCH)sjtg.^y?m3@wLNe=wPH3xarR^Hjy-qGD2^RixMMB9z/x#xx\u003eIa3aI$92gb7EueIY1nhxUR2yH[R!z!i*7wOU\u003c$jtgh.AcVFrxj#xJ3lQDlauT:OxlcmJzGx]dzGGYuaAIWtBy=OrwPzG%x\u003e7N[x(v(iy?m3=B0a[evqHjhx\u003e8ibB-.tlayO$bx(n0lvqZg6D2[axBy/Ppx(1]4B7/05A3eXfBz+Viay=Sse]Clxjtg!+xlclzarR^HjAt1Lz/YSmz/QaCBA}?pjTaJMBrR\u0026IA+)(.xMOunB2\u003e%cxk8E3BZ=$kz/4dGz!i*7wOU\u003c$flq5yzF\u003c33wPxzqzGx]dzGGYue]#eHBy=TsvSC){v}X1Hzddc@a%pxlzeB0ejTat?vL/+)v}vwLf\u003eB\u0026Og=vp7gI5B7hz]87gD5/Oixn/LwmNPchE[0OffPZ=arR^?wmYZ\u003ezE^r@v}/H}j{\u0026zParR^HjzeXMB-nEBvrc0(BvHpVzdN{fA+^/Zzu", "n": [ { "c": 2, "d": "NuGet nuspec manifest file", "i": "metadata/build/manifest::nuspec-file", "o": 0, "z": 32, "cf": 0.9800000190734863 }, { "c": 2, "d": "NuGet package declares repository", "i": "metadata/package/files/nuget::nuspec-repository", "o": 42, "z": 927, "cf": 0.8999999761581421 } ], "ln": 0, "col": 1, "line": 1 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 1738.0, "entropy": 5.04, "size_bytes": 1738.0 }, "binary": { "overall_entropy": 5.04, "peak_region_bytes": 1738.0, "peak_region_entropy": 5.05 } } }, "id": 2, "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Soenneker.Instantly.Suite/Soenneker.Instantly.Suite.4.0.3837.nupkg!!Soenneker.Instantly.Suite.nuspec", "pid": 0, "risk": 1, "sha": "cb1356a49cacfebd3c76bfccda13178f309fbef7a8d90fa0785e9bae5e705668", "size": 1738, "traits": [ { "id": "metadata/package/files/nuget::nuspec-repository", "conf": 0.8999999761581421, "crit": 2, "desc": "NuGet package declares repository", "spans": [ [ 42, 927 ] ] }, { "id": "metadata/build/manifest::nuspec-file", "conf": 0.9800000190734863, "crit": 2, "desc": "NuGet nuspec manifest file", "spans": [ [ 0, 32 ] ] } ], "type": "xml" }, { "ctx": [ { "b": "o?wqboLF0FzGxv@3pw-JD2^RixMLvBv\u003c@JQfFUEpgb7Evawc6TwGT]\u0026wO#x%yH}I[3q+qOze16jx(v(ix(+zgwPzu\u003eC{3:uvqZf#wgO\u003cnA+e/8z!pb4xKL{]wH[%CzY\u0026FaC{46qA=VepaA7.hvqfQ[zF782ay/teC)XF4aARphB0bKxw]@l9A+cw4zE:\u003e#B8#nfx\u003c(9{wftA3v%8T1zGGrex(v(iw[=6)B08(MxK@qgq/un\u0026CvtJ6a$k5=Bz\u0026pjwNPxZx(k5nxK@q+z!s9nvrb{4Cwhejz/{dAA+frlA+P39x(v(uazC.6y\u0026%o5zF78ox([3bB-X:xx(dNavruj4zxK4mwGV2cxj}", "ln": 0, "col": 1, "line": 1 }, { "b": "z/f91BzkVhB2\u003cTnra]?=vpBd#wGUG3AcVFrxj#xfzF%Shv}u=\u003ezE:(ixLzJgAaK6bx(!ufz/cXnz//Y6wGV5cvqG:5vR3V@zEWH9wmYo]x(k54y?%C*z/xA4B0bywaAIWmB97\u0026dBzkf1aAhmtBzkVhB0bykaARpdax9h\u003cBA.elwIaq%r7GC2q+]\u003eZs3Y.Mav#", "ln": 475, "col": 47, "line": 10 }, { "b": "l)bD8axg)2axH\u003cbqBa5SnKVM2pEVE3mn=Gzk#7xBlp\u003c\u003cxr9p:VmOcMOmn)bcmO=]8k{e#\u0026qDcjPrzkXRaw=6op!$1Uave:\u003cawLZcnLR-MnLR=Ao*}/Re*9.XawLYPmoh\u0026Lr3kagk$\u003c@{r7GB+k#*(PpF$alpF@r5pF+g(nK(rJav]p4l}70LavnG", "ln": 723, "col": 34, "line": 16 }, { "b": "r7GCQs4MsVefEkRnMehQm\u003c7o0pFAwEpGpvppEVE5qxOLaavw}1pdmJHnL-87s4MvZaxg)2ax869r98v-miCx7axg)2axqueawU(TpGf\u003eNqxOv@k$\u003c\u003cBm]HK4p9rIbmg8%?mPrCPqBJhB", "ln": 964, "col": 55, "line": 19 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 1076, "entropy": 5.13 }, "binary": { "peak_region_bytes": 1024, "peak_region_entropy": 5.13 } } }, "id": 3, "mol": "K(Te)", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Soenneker.Instantly.Suite/Soenneker.Instantly.Suite.4.0.3837.nupkg!!LICENSE", "pid": 0, "risk": 1, "sha": "00792f4b9c7e6a8c02c3b3cc74051318b8e7e6b278dd8c776c98494bef7e468d", "size": 1076, "traits": [ { "id": "metadata/lang/natural::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"", "spans": [ [ 183, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-2", "conf": 0.8, "crit": 1, "desc": "English function-word token \"and\"", "spans": [ [ 147, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "spans": [ [ 771, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-6", "conf": 0.8, "crit": 1, "desc": "English function-word token \"with\"", "spans": [ [ 1012, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-7", "conf": 0.8, "crit": 1, "desc": "English function-word token \"this\"", "spans": [ [ 133, 0 ] ] }, { "id": "well-known/tool/development/vcs/github-web::github-repo-fetched-path", "conf": 0.98, "crit": 3, "desc": "Fetched github.com repository artifact" } ], "type": "text" }, { "id": 4, "sha": "758779cf57b03f34d1661af30412b4fe132f96f5dfea4536a35bbc76952b58f2", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Soenneker.Instantly.Suite/Soenneker.Instantly.Suite.4.0.3837.nupkg!!README.md", "size": 1028, "type": "markdown", "depth": 1 }, { "id": 5, "sha": "93511e8937b27717eb154ee90eaf1655d4dbbad2865ecfc5a7d0bd794c945c49", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Soenneker.Instantly.Suite/Soenneker.Instantly.Suite.4.0.3837.nupkg!!icon.png", "size": 16083, "type": "png", "depth": 1 }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J\u0026m(0ji6Sa?dLD+]{51x(+zoA=kPhvqNb%vqY$3BrC47aAzQxazCZol@c-7zeS@@e!5l%bME/A00000", "n": [ { "c": 2, "d": "PE contains exactly one resource entry", "i": "metadata/binary/resource::pe-single-version-resource", "o": 0, "z": 24, "cf": 1.0 } ], "ln": 0 }, { "b": "000000000000000kMy^J000000000000000000004LW}-00000nb@R\u00260SSx7Z-SQSg.fM^0rr91000000000000000000000000000000000000000000000000000000000000000009S^-7000uQ9S^-7000uQ9S*V?000cKiSZYz000uc1apgI00B^e0W[=-017a\u0026000uO7xsBxc(q{:3mD+(017a)000uM0Xf6ec(Sc^3mD\u003e]017a{000uO9SMfEc)5A?3mE1%0174OdGxCGlq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn00Ao4byPQ)yY\u003c.ri0YG:bu5Y8x(mN800000QZNk61onA4bumUxS0\u0026Ua5c8Xgbs+:9l\u0026Wh!Xc@uqD\u0026:oFbsli+vGlxd000000SSi3r#4we2)pkd0qVZL02tLm0rr919@(ov1POJ50rr911][S60@@r3aohxw8#]%s0rr910rr910rr910rr912MK\u002680rr91005w*0rr91000i64GXJ)1{09Nhu\u003cu=sPZL^1]$F2(JE}4uJ{Gg1{1q%EGG=OkM.k]1]@fn2lUkh3\u003cc.q1]%nS2lUkhaP.(K1]{**2lUkh]8Yd11]#*E2lUkhsoeTf1]$p$hu\u003cu=+)gVV1]%R-WGuZlz3diG1]#gmhu\u003cu=cJ=mh1]@VAhu\u003cu=iruL\u003c1{1J9WGu\u003cp83F^#4GGfa\u0026SZ1}J%e+[765mR4Hi)LT{6E-9SN[#hWpJb+ls)J", "n": [ { "c": 2, "d": ".NET metadata root signature (BSJB)", "i": "metadata/binary/framework::dotnet-metadata", "o": 704, "z": 4, "cf": 1.0 }, { "c": 1, "d": "PE standard code/data section", "i": "metadata/binary/section/names::pe-code-data-standard-section", "o": 512, "z": 5, "cf": 0.8999999761581421 } ], "ln": 480 }, { "b": "By/qwqGV(0x(dAlr+lq)x(v)6zF5@Fz!i*7wOU\u003c$e\u003eG@4Byx6ey\u003cvTiB.L@ee[w^m08[e:By/p?q/uk+zE)P{AXo}3B97\u0026dBzMjPr+lq=w[+:-BzkVh08mfqA=l2qw]]T]CYWImB7]MgB1P\u003c(AaJ]$wO#16nP5oOv@#B6zu9QXB97#ge(Dm)y?m9#x(v\u003e?nMfhvC4\u003eC$lVl^SwN/*@z/bLvwmOnHB97\u0026dBzMk3B.L@eq!ZbZy?mZbzu8$kwjZVWByx6ey\u003cwY=vpSwWx(37Rq!ZbZy?mZbzu8$kwjZVWByx6ey\u003cx5)A+Pa", "n": [ { "c": 2, "d": ".NET System.Reflection namespace reference", "i": "metadata/lang/compiler/managed::reflection-namespace", "o": 2867, "z": 17, "cf": 0.699999988079071 }, { "c": 2, "d": ".dll extension reference", "i": "micro-behaviors/fs/path/extension::dll-dup", "o": 2781, "z": 4, "cf": 0.5 } ], "ln": 2733 }, { "b": "z*ko7x(3WUxk8BeA:-$*nP5P\u003evqZg6C%(m\u0026rDI}\u003eqE%GPB98ChASv.4Bz(g1q*ACawO\u003c4/x\u003c\u003eT(z/Z2mv@?SGz!i*7wOU\u003c$e\u003eG@4Byx6ey\u003cvT0zEEvbBzkla08)/EzF\u003c33wPxy{zGx]dzGGYue\u003e/?+wod-HD2[7sz7X.ezGGPfwIct*ze:i9wPyZXA=#ebwPE\u0026)wPz%dv}t", "n": [ { "c": 2, "d": ".NET System.Diagnostics namespace reference", "i": "metadata/lang/compiler/managed::diagnostics-namespace", "o": 3351, "z": 18, "cf": 0.75 } ], "ln": 3303 }, { "b": "e(1\u0026mlVm0Rl2Z=]r+lq)x(v(LB$\u003eW6fAzeM4IRxMvqPO1z/PRYx(!lfvr\u003eQRzdK2apdnb8f!+jl8ux*MxMOunB2\u003e%cB8LSczE)P{AXp\u003cuz2:LA0rrv5wO+{^B7CsKdGGI}lVl{?A+Pf1BrFD1atLSag+yEpgbZmEvqxA%q/uk+zE)P{ASu8e0rtzKay/tbAb]J6wO#N6C4z!qB.L@eaA7\u003cmB-.tlx([Ryy?Wv0vrc6[B0b7kAV^}\u003eB97\u0026dBzMjPvqd9gave*}00", "n": [ { "c": 3, "d": "Hardcoded network URL with domain name", "i": "micro-behaviors/communications/http/url/domain::http-url-binary", "o": 4165, "z": 21, "cf": 0.699999988079071 }, { "c": 2, "d": "Copyright notice", "i": "metadata/package/license::copyright-word", "o": 4205, "z": 9, "cf": 0.6000000238418579 } ], "ln": 4101 }, { "b": "0000000000000000000000000000000000000000000000000000000000315c8Xg7YTL^000000000000000000310rr91fAq960000000000000000003100000nb@R\u0026su(\u0026^Q67C@0000000000Q69pM00341qVHe8rSCL*qufR}nDqJ^p5[S3nDqG=mGui:00000Y-^*600031000c4008%c000c4008%ckl7V-000001onA40SSi2000000000000000l\u0026Wh!0rud2ve$rFmGvc5yYF2DnDrSdw=", "n": [ { "c": 2, "d": "PE version resource metadata", "i": "metadata/package/versioning::version-resource-metadata", "o": 5214, "z": 15, "cf": 0.8999999761581421 }, { "c": 1, "d": "PE resource section", "i": "metadata/binary/section/names::pe-resource-section", "o": 5120, "z": 5, "cf": 0.8999999761581421 } ], "ln": 5088 }, { "b": "007\u003cT00031fAr^bfAr^bfAr{fvGn7Z005I?li42^lJz38z2!zMwDlPFBo3vZ002p+aok)KzVBROz#:[UwDlxzwDlPFA@Y[OB]V7NaolD.BPuaQBo2\u003eLaolrWw=J}NBPuH-x-I@Hx-JkPC(O@!yYFeHvGpAGve$rFx-IYAA@Wr.w=M-HASviZnDrSdA@ZpZve$fBBo3aSC(PC%ve$0wcJFh/aojXcpYK5!002W)761vnlJz38z2!IPve$fBC(QOtve$cAwDhYg003WjBo3y.z#:}ViSH/kf934[zVBtGzuaLOwDlGCwDl-Je=YwYzVBRO003m78uo^rmGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up002{$zVBtGzuaLOwDlGCwDl-Je=XDyzua.TBo2.Hzua+UyYF.Xe=X/IBPuaQBo2\u003eL001[S3JHhcmGvc5yYF2DrSDXhASydXx-J5Kzu6Up001?Qe=WN9e=WWch#\u003e-mhVLDgfAq7M003m79SMivnDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE002{$zVBtGzuaLOwDlGCwDl-Je=XDyzua.TBo2.Hzua+UyYF.Xe=X/IBPuaQBo2\u003eLe=YzZyYFnK003)pb(^@CoAnS7x8(uuyYD*5zVB.RC(R\u003c+x-I=CxAibO002v^zVB.RC(R\u003c+x-I=CxAibOaonwvaojd%fAr\u003cdgYP9cg5%0dg5%ijaok1lve$6ywDi?MqVH.owDlPFzuakFyxd]CASu7t003Kf9SMivpxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE002{$zVBtGzuaLOwDlGCwDl-Je=XDyzua.TBo2.Hzua+UyYF.Xe=X/IBPuaQBo2\u003eLe=YzZyYFnK002%#8uo^rpYLIozVBqFBPt[KBo25ove$cAwDhYg002{$zVBtGzuaLOwDlGCwDl-Je=XDyzua.TBo2.Hzua+UyYF.Xe=X/IBPuaQBo2\u003eL004/Pg5}sPpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001?Qe=WN9e=WWch#\u003e-mhVLudvGn7ZvGnj+fAr^bv/Q6uf-T6hf-U++v/OE*gYPAlhVNy?gxp$^h2]SphukPmw=KW*gxorkwDliuirh5tf-T9iwb{cuhumg^humm/002g.3JHhck(+%aA@Y+Kz2!2ByYF.XaokBxwDl-JA@Y[OzVBUP001?Qe=WN9e=WWch#\u003e-mhVLDgfAq7M00000000000000000000", "n": [ { "c": 3, "d": "PE version metadata includes CompanyName", "i": "metadata/package/versioning::pe-companyname-field", "o": 5590, "z": 11, "cf": 0.699999988079071 }, { "c": 3, "d": "PE version metadata includes FileDescription", "i": "metadata/package/versioning::pe-filedescription-field", "o": 5666, "z": 15, "cf": 0.699999988079071 }, { "c": 3, "d": "PE version metadata includes FileVersion", "i": "metadata/package/versioning::pe-fileversion-field", "o": 5758, "z": 11, "cf": 0.699999988079071 }, { "c": 3, "d": "PE version metadata includes InternalName", "i": "metadata/package/versioning::pe-internalname-field", "o": 5814, "z": 12, "cf": 0.699999988079071 }, { "c": 3, "d": "PE version metadata includes ProductVersion", "i": "metadata/package/versioning::pe-productversion-field", "o": 6202, "z": 14, "cf": 0.699999988079071 }, { "c": 3, "d": "PE ProductVersion has SemVer git hash", "i": "metadata/package/versioning::pe-productversion-semver-git-hash", "o": 6232, "z": 49, "cf": 0.8999999761581421 }, { "c": 2, "d": "PE OriginalFilename metadata field", "i": "metadata/package/versioning::pe-originalfilename-field", "o": 6018, "z": 16, "cf": 0.699999988079071 }, { "c": 1, "d": "Several short title-cased resource strings", "i": "metadata/binary/resource::short-titlecase-resource-words", "o": 5434, "z": 8, "cf": 0.800000011920929 }, { "c": 1, "d": "PE version company name populated", "i": "metadata/package/versioning::pe-company-name-populated", "o": 5616, "z": 21, "cf": 0.8500000238418579 }, { "c": 1, "d": "PE FileDescription field is populated", "i": "metadata/package/versioning::pe-file-description-present", "o": 5700, "z": 25, "cf": 0.949999988079071 }, { "c": 1, "d": "PE LegalCopyright field is populated", "i": "metadata/package/versioning::pe-legal-copyright-present", "o": 5936, "z": 37, "cf": 0.949999988079071 }, { "c": 1, "d": "PE ProductName field is populated", "i": "metadata/package/versioning::pe-product-name-present", "o": 6144, "z": 25, "cf": 0.949999988079071 }, { "c": 1, "d": "PE FileVersion value is present", "i": "metadata/package/versioning::version-info-file-version-present", "o": 5784, "z": 10, "cf": 0.949999988079071 } ], "ln": 5402 }, { "b": "00000000000000000000000000000000000000000000000000000000000005axM3\u0026*ncfFJLc00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", "n": [ { "c": 2, "d": "PE .reloc section presence", "i": "metadata/binary/section/names::reloc-section-presence", "o": 6656, "z": 6, "cf": 0.8999999761581421 } ], "ln": 6608 } ], "depth": 1, "facts": { "imp": [ [ "mscoree", "CorDllMain" ] ], "sec": [ [ ".text", 512, 4608, 5.24, "r-x" ], [ ".rsrc", 5120, 1536, 2.94, "r--" ], [ ".reloc", 6656, 512, 0.08, "r--" ] ], "metrics": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "clr.is_il_only": 1.0, "resource_count": 1.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 34521.0, "reloc_overhang_bytes": 500.0, "reloc_overhang_ratio": 0.98, "clr.is_32bit_required": 0.0, "bss_like_section_count": 0.0, "clr.is_32bit_preferred": 0.0, "clr.strong_name_signed": 0.0, "section_overflow_count": 0.0, "clr.is_native_entrypoint": 0.0, "misaligned_section_count": 0.0, "version.identity_entropy": 3.98, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0, "version.identity_symbol_ratio": 0.11 }, "file": { "size": 7168.0, "entropy": 4.46, "size_bytes": 7168.0 }, "binary": { "is_pie": 1.0, "code_entropy": 5.24, "string_count": 118.0, "overall_entropy": 4.46, "entropy_variance": 4.46, "avg_string_length": 24.84, "max_string_length": 82.0, "peak_region_bytes": 4096.0, "code_to_data_ratio": 1.0, "peak_region_entropy": 4.95, "string_length_stddev": 13.66, "largest_section_ratio": 0.64, "sentence_string_count": 5.0, "sentence_string_ratio": 0.04, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 4608.0, "entropy_max": 5.24, "entropy_mean": 2.75, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } } }, "id": 6, "mol": "H(Cm)Md₂(BiPa)", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Soenneker.Instantly.Suite/Soenneker.Instantly.Suite.4.0.3837.nupkg!!lib/net10.0/Soenneker.Instantly.Suite.dll", "pid": 0, "risk": 4, "sha": "c1277df9b94fe90b99eb56425e6982e48f133b310e2e7aa8862a6c6debef6428", "size": 7168, "traits": [ { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR header (COM descriptor)" }, { "id": "metadata/binary/metrics/entropy::code-entropy-at-most-7-5", "conf": 0.699999988079071, "crit": 1, "desc": "Code entropy is 7.5 or lower", "spans": [ [ 0, 26 ] ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 3, "desc": "PE version metadata includes ProductVersion", "spans": [ [ 6202, 14 ] ] }, { "id": "metadata/package/versioning::pe-internalname-field", "conf": 0.699999988079071, "crit": 3, "desc": "PE version metadata includes InternalName", "spans": [ [ 5814, 12 ] ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 5214, 15 ] ] }, { "id": "metadata/build/reproducible::pe-reproducible-build", "conf": 1.0, "crit": 2, "desc": "Built with /Brepro (deterministic)" }, { "id": "metadata/package/versioning::pe-companyname-field", "conf": 0.699999988079071, "crit": 3, "desc": "PE version metadata includes CompanyName", "spans": [ [ 5590, 11 ] ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET metadata root signature (BSJB)", "spans": [ [ 704, 4 ] ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 3, "desc": "PE version metadata includes FileVersion", "spans": [ [ 5758, 11 ] ] }, { "id": "metadata/package/versioning::pe-productversion-semver-git-hash", "conf": 0.8999999761581421, "crit": 3, "desc": "PE ProductVersion has SemVer git hash", "spans": [ [ 6232, 49 ] ] }, { "id": "metadata/package/versioning::pe-filedescription-field", "conf": 0.699999988079071, "crit": 3, "desc": "PE version metadata includes FileDescription", "spans": [ [ 5666, 15 ] ] }, { "id": "metadata/binary/layout::pe-no-signature-record", "conf": 0.949999988079071, "crit": 3, "desc": "PE has no signature record" }, { "id": "metadata/binary/anomaly/provenance::pe-far-future-timestamp", "conf": 0.949999988079071, "crit": 2, "desc": "PE COFF timestamp encodes a future date" }, { "id": "micro-behaviors/communications/http/url/domain::http-url-binary", "atk": "T1071.001", "mbc": "C0002", "conf": 0.699999988079071, "crit": 3, "desc": "Hardcoded network URL with domain name", "spans": [ [ 4165, 21 ] ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET managed assembly", "spans": [ [ 704, 4 ] ] } ], "type": "pe" }, { "id": 7, "sha": "abebc9992b98aea8f119a6ce80f07cbeb4733dc61bac2dee86c2f0959970832b", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Soenneker.Instantly.Suite/Soenneker.Instantly.Suite.4.0.3837.nupkg!!lib/net10.0/Soenneker.Instantly.Suite.xml", "size": 2605, "type": "xml", "depth": 1 }, { "id": 8, "sha": "63feef730c8c6225c83eeeb608a1575fcac22006897782d889c10c4310523657", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Soenneker.Instantly.Suite/Soenneker.Instantly.Suite.4.0.3837.nupkg!![Content_Types].xml", "size": 712, "type": "xml", "depth": 1 }, { "id": 9, "sha": "b5c7c1d17db9def99834bf7b3ccc7f5961a6a59921616b5d63125794197f39bb", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/Soenneker.Instantly.Suite/Soenneker.Instantly.Suite.4.0.3837.nupkg!!package/services/metadata/core-properties/cfaa0ace7e864dfb8e820364fb05b743.psmdcp", "size": 769, "type": "xml", "depth": 1 }, { "id": 10, "mol": "Md", "sha": "dc36863c9a524cef47c0811655225cee4baf9b1fc341e6cb00297b5f05bff8fa", "path": "Soenneker.Instantly.Suite@4.0.3837.registry.json", "risk": 1, "size": 983, "type": "registry", "depth": 1 } ], "omitted_files": 6, "rev": "50c7f", "v": "8" } }