{ "llm": { "conf": 0.79562926, "grade": "benign", "model": "Qwen/Qwen3.6-27B", "review": false, "outcome": "benign", "interpretation": "Legitimate .NET library assembly" }, "ml": { "v": "7", "eng": "2.2.0-rc.1", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.70804185, "rte": "az", "prob": 0.70804185 } ], "prob": 0.70804185, "skip": [ { "rte": "az/zip", "why": "unavailable" }, { "rte": "az/zip", "why": "unavailable" } ], "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.7080418467521667, "type": "nupkg" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.00012001395225524902, "type": "xml" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.012280523777008057, "type": "xml" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.005262881517410278, "type": "text" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.008093297481536865, "type": "markdown" }, { "id": 5, "lvl": -1, "conf": 0, "prob": 0.6386661529541016, "type": "pe" }, { "id": 6, "lvl": -1, "conf": 0, "prob": 0.00006663799285888672, "type": "png" }, { "id": 7, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "xml" }, { "id": 8, "lvl": -1, "conf": 0, "prob": 0.00012001395225524902, "type": "xml" }, { "id": 9, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "registry" } ], "version": "v18.18", "analyzed_at": "2026-06-29T09:43:30Z" }, "path": "Meshmakers.Octo.Services.Swagger.3.4.24.nupkg", "raw": { "files": [ { "id": 0, "mol": "O(Al)H₂(CmDb)", "sha": "fd515c74f5c5f7b21cc6d82e635f411495eef0c69abde2358e275584a713a4bf", "path": "Meshmakers.Octo.Services.Swagger.3.4.24.nupkg", "risk": 4, "size": 35763, "type": "nupkg", "facts": { "metrics": { "file": { "size": 35763.0, "entropy": 7.91, "size_bytes": 35763.0 }, "binary": { "overall_entropy": 7.91, "peak_region_bytes": 31744.0, "peak_region_entropy": 7.79 }, "archive": { "file_count": 9.0, "member_count": 9.0, "script_count": 0.0, "zip_bomb_ratio": 2.64, "directory_count": 0.0, "executable_count": 1.0, "extra_field_size": 0.0, "noise_file_count": 0.0, "total_compressed": 34569.0, "compression.ratio": 0.59, "hidden_file_count": 2.0, "total_uncompressed": 59064.0, "crc_collision_count": 0.0, "entry_comment_count": 0.0, "max_filename_length": 81.0, "rtlo_filename_count": 0.0, "format.regular_count": 9.0, "nested_archive_count": 0.0, "path_traversal_count": 0.0, "symlink_escape_count": 0.0, "security.setgid_count": 0.0, "security.setuid_count": 0.0, "security.sticky_count": 0.0, "double_extension_count": 0.0, "duplicate_member_count": 0.0, "security.symlink_count": 0.0, "unicode_filename_count": 0.0, "homoglyph_filename_count": 0.0, "security.encrypted_count": 0.0, "timing.mtime_unique_count": 5.0, "timing.mtime_unique_ratio": 0.56, "misplaced_executable_count": 1.0, "timing.mtime_dominant_count": 4.0, "timing.mtime_spread_seconds": 12690892.0, "timing.sentinel_mtime_count": 0.0, "security.world_writable_count": 0.0, "timing.mtime_dominant_fraction": 0.44, "compression.method_counts.stored": 1.0, "compression.method_counts.deflate": 8.0 } } }, "ident": { "name": { "value": "Meshmakers.Octo.Services.Swagger", "source": "nupkg.title", "verified": false }, "urls": [ { "url": "https://www.meshmakers.io/", "kind": "homepage", "source": "nupkg.project_url" }, { "url": "https://github.com/meshmakers/octo-common-services", "kind": "repository", "source": "nupkg.repository_url" } ], "trust": "unsigned", "authors": [ { "name": "meshmakers GmbH and Contributors", "role": "author", "source": "nupkg.authors" } ], "version": { "value": "3.4.24", "source": "nupkg.version", "verified": false }, "identifier": { "value": "Meshmakers.Octo.Services.Swagger", "source": "nupkg.id", "verified": false } }, "traits": [ { "id": "micro-behaviors/communications/http/server/managed::http-response-get", "conf": 1.0, "crit": 3, "desc": "Access to ASP.NET Response object", "from": [ { "file": 5 } ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "from": [ { "file": 5 } ] }, { "id": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "conf": 1.0, "crit": 3, "desc": "JSON polymorphism runtime marker", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/data/db/linq::linq-queries", "conf": 0.699999988079071, "crit": 3, "desc": "LINQ query operations", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "from": [ { "file": 5 } ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "from": [ { "file": 5 } ] }, { "id": "metadata/package/versioning::version-word-lower", "conf": 0.4000000059604645, "crit": 2, "desc": "version word (lowercase)", "from": [ { "file": 5 } ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "micro-behaviors/communications/http/server/managed::http-request-get", "conf": 1.0, "crit": 3, "desc": "Access to ASP.NET Request object", "from": [ { "file": 5 } ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "from": [ { "file": 5 } ] }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "from": [ { "file": 5 } ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "from": [ { "file": 5 } ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "from": [ { "file": 5 } ] } ] }, { "depth": 1, "facts": { "metrics": { "file": { "size": 522.0, "entropy": 5.18, "size_bytes": 522.0 }, "binary": { "overall_entropy": 5.18, "peak_region_bytes": 522.0, "peak_region_entropy": 5.18 } } }, "id": 1, "path": "Meshmakers.Octo.Services.Swagger.3.4.24.nupkg!!_rels/.rels", "sha": "95dde8d1c89b81bef2f2b2d3ea255f8564baa6bd14c8b8df2790bfbe7291ae19", "size": 522, "type": "xml" }, { "ctx": [ { "b": "[4ls%kx}3YaA?spB7]MgjT8QkfD}SJzEWP}x(mMDb6w0teJs}sj]", "n": [ { "c": 2, "d": "NuGet nuspec manifest file", "i": "metadata/build/manifest::nuspec-file", "o": 0, "z": 39, "cf": 0.9800000190734863 } ], "ln": 1, "addr": 0 }, { "b": "jAa.syHH\u003c!aB4:tzGv@+xMOuniXJdcv}YB\u003cvrj5rx\u003e8g4B8LVje[n*pfk$ufyHH\u003c\u0026zF7QTfFLvpfF$I3B-RIkv\u003eJ1EwfKh", "ln": 2, "addr": 42 }, { "b": "arS^-wPRu\u003evrt{w", "ln": 3, "addr": 118 }, { "b": "arR^Hjy-qGD2^RixMMA^v\u003c@JQfFUyngb7Ewaz\u003eXhxL?f[wPz\u0026mm@qZajtgh.AcVFrxj#xJ", "ln": 13, "addr": 542 }, { "b": "arR^HjAL1AB3rxfBz\u0026pjvrt{2zdN^4azC+ojtg!+xlcl", "ln": 14, "addr": 599 }, { "b": "arR^HjAt1Lz/YSmz/QaCBA}?pjTaJMBrR\u0026IA+)(.xMOunB2\u003e%cxk8E3BZ=$kz/4dAwPIK4vqxB{B1.DwBz\u0026:vz/6ufzy]{vA=#ebwPG4rv@Dj3x((GZiwrDGw\u0026zL2iB#Scv\u003e/(0f\u003eh$0i5tbTh^{rdiaDwPiw+qTh8)GMa%nK5", "n": [ { "c": 2, "d": "NuGet package declares repository", "i": "metadata/package/files/nuget::nuspec-repository", "o": 639, "z": 87, "cf": 0.8999999761581421 } ], "ln": 15, "addr": 635 }, { "b": "arR^Hjy\u00262xwO#3\u0026zEWx(B3o", "n": [ { "c": 2, "d": "NuGet package declares dependencies", "i": "metadata/package/files/nuget::nuspec-dependencies", "o": 776, "z": 387, "cf": 0.8999999761581421 } ], "ln": 16, "addr": 772 }, { "b": "arR^HarS^VA=l8taAR4jxjVfOA:-/@Cw?IqjTa=PBtkE4fD@W", "ln": 17, "addr": 791 }, { "b": "arR^HarR^Hjy\u00262xwO#3\u0026zEW@mx\u003efvJl33#$r+lq)x(v)6zF7N@C4ic\u003cAa}:=AboDkwPw$qC4CYnx(v(La#7=7fFk46az2!cy\u0026%o1jT9jnx(4rhl2HaED3T4xB0q.Wj]", "ln": 18, "addr": 831 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 1307.0, "entropy": 5.16, "size_bytes": 1307.0 }, "binary": { "overall_entropy": 5.16, "peak_region_bytes": 1307.0, "peak_region_entropy": 5.16 } } }, "id": 2, "path": "Meshmakers.Octo.Services.Swagger.3.4.24.nupkg!!Meshmakers.Octo.Services.Swagger.nuspec", "risk": 1, "sha": "f1a5495d04872e1d99627a114aeb04ce167a9c9559c5c0cd9e721372efd47add", "size": 1307, "traits": [ { "id": "metadata/package/files/nuget::nuspec-dependencies", "conf": 0.8999999761581421, "crit": 2, "desc": "NuGet package declares dependencies", "spans": [ [ 776, 387 ] ] }, { "id": "metadata/build/manifest::nuspec-file", "conf": 0.9800000190734863, "crit": 2, "desc": "NuGet nuspec manifest file", "spans": [ [ 0, 39 ] ] }, { "id": "metadata/package/files/nuget::nuspec-repository", "conf": 0.8999999761581421, "crit": 2, "desc": "NuGet package declares repository", "spans": [ [ 639, 87 ] ] } ], "type": "xml" }, { "ctx": [ { "b": "o?wqboLF0FzGxv@3pw-JD2^RixMLvBv\u003c@JQfFUKezdN^4zddi\u003eA=S\u003cEzWD?FwPzT4B8#5lzxJUmazttbwNY{cxl4A#By!#lazbU9wGU]6ay/7[A+w@maARJAvqZukAaK6hz/cXovSV3)zFs03ayMy5z/x$ez!pblxLzJgB8LVjCvtJ6ayPd#ayPtjz!0G\u0026By!#9wn+$2zdNQbvruj4zxJL9y?mVgd0fclar\u003c:5w]@l9A+cBzefG4May]4(yZK(]aARpdax9h\u003cBA.elwGVhhBzbPnBrCQnB98Cpv@#B6zy=]AzEWH9wnb{]aA}KwxM53naz++ex()^9x(v(iBzbkdA+Pf1BAm!hzY\u003cgzwH[%lz/x$Maz(4cx\u003ezSwaz\u003eXgxjSRpAckSax(^@say]hcBAh88B-.gCaAIWmy?Wx\u003czGxwuayPd#fk\u003e\u003eNB7Gf73s!0[x\u003equdz!pblxK@q+z!s9nvrb{gayPd#aARJAAaK6bx(\u003eFpwPz\u003cgzGu}xzY\u003cmqz/3RsxK@q+z!s9nvrb{4x(:R[B-IwlB7/b}aARJAwn-Piz.92LBZ/8%v@@\u0026nzY\u003cdnwGUP6y\u002613lx(mMav@Dl}x([6czGv\u0026C3rgXIayO.$C4z!az/x#xx\u003eIa3az#atx\u003e7Y%vqYP#BzbxfaAg[jze16jx(v(izF%Shv}u^7xKLZ[ayX[8x(mA%B.25]azCZovqG-!v@Ds2wPF#jAV/BCvSMT1zGGP3y-)XnA==2lzGu}sw/#hewGT]\u0026w]@l9A+c\u003cg3rfL+ax869r98v-miCf2aw+%ir.kXFl)9WtqY[Uga$K\u003crnMnkRrA78xk#HPDpe\u003evspEVD)pfwYjnLRV8avPyeqBKI.awU(xnLJ2PnKV2#aw2r}oJsFLpdDA[rA78opGeDgnLI=Qmmnm$pASRcmiCU$qC]!Qr7PISawUDHo*}@Eni{0Ik%!dpnMn?z3pWP^pdn8WavYd8avdbDk#HVNlSD/CqxO!oqCZd/miB(\u003el)bl2pdXhIqB%RNmnliCr4Yp+p9rqcavPs1pe\u0026umni]{yaxg)23pdV\u003enkAbZawU(TlR*JYqB%wHr3j.coHIrEqY[y}awtu)lqf/\u003cmO=]8k#7M9lRG^qo!mzPk$%Tnmn\u003es8qxO+mnjuz-oI4JpnLzYPsU7W%njuGGmn+m1p9q?$avev]nL-87pEVD]pFK\u003e!k%[Q5axhcmr3j$mawU%cmn^hUq:\u0026kWk#HoMnLR+#mP92RedbfMr3j$aawU(TnLQx}pFKUNlSuSMp9rRfr7FchnjsU1pEXq+k#Hb]pF@rmnjsU3q:?*8qxO+mnjuA0l}6ynnLR=Oaw2rJr7GB+q+]\u003eZs3Y.Me^.", "ln": 0, "col": 1, "line": 1 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 1070, "entropy": 5.1 }, "binary": { "peak_region_bytes": 1024, "peak_region_entropy": 5.1 } } }, "id": 3, "path": "Meshmakers.Octo.Services.Swagger.3.4.24.nupkg!!LICENSE", "pid": 0, "risk": 1, "sha": "4f8110c7e9f20d8eb3fd9f304b2b05f5afd7649cfd758baa301f564cdc3c83c9", "size": 1070, "traits": [ { "id": "metadata/lang/natural::lang-english", "conf": 0.8, "crit": 2, "desc": "Contains common English function words", "uses": [ 3, 4, 5, 6, 7 ], "spans": [ [ 177, 0 ] ] }, { "id": "metadata/package/license::mit-license-grant-text", "conf": 0.9, "crit": 2, "desc": "MIT license permission grant sentence", "spans": [ [ 47, 0 ] ] }, { "id": "metadata/permission/prose::permission-permission-term-english", "conf": 0.9, "crit": 2, "desc": "Permission or access term", "spans": [ [ 47, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"", "spans": [ [ 177, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-2", "conf": 0.8, "crit": 1, "desc": "English function-word token \"and\"", "spans": [ [ 141, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "spans": [ [ 765, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-6", "conf": 0.8, "crit": 1, "desc": "English function-word token \"with\"", "spans": [ [ 1006, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-7", "conf": 0.8, "crit": 1, "desc": "English function-word token \"this\"", "spans": [ [ 127, 0 ] ] } ], "type": "text" }, { "ctx": [ { "b": "boP=(Bz\u0026o?z/6ufzxI\u003e?A=#ebwPFg=q!PPWwN(]$zF0]$B98CBv@#\u003clwGU/6vSC)$x\u003equpaz\u003e?6wnC?3vrb{4vqYP#v@=HeB1H)ABAzkmxcpY5zEWl#zGu}yB7F(8vpKs@B8@ECxK@qZv@#S-wPIJcvQS+ZwO#33B7Gxnx\u003e7Z}e*abbwGV28AbP/iBz(hBaAR4jxjVgaatczTr3i)", "n": [ { "c": 2, "d": "Contains common English function words", "i": "metadata/file/profile/language::lang-english", "o": 68, "z": 3, "cf": 0.800000011920929 }, { "c": 1, "d": "File uses a document or configuration extension", "i": "metadata/file/extension/identity::doc-or-config-extension", "o": 0, "z": 9, "cf": 1.0 } ], "ln": 0, "col": 1, "line": 1 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 2509.0, "entropy": 4.86, "size_bytes": 2509.0 }, "text": { "digit_ratio": 0.0, "space_count": 243.0, "total_lines": 37.0, "char_entropy": 4.86, "unique_chars": 64.0, "lines_over_200": 6.0, "avg_line_length": 66.81, "max_line_length": 463.0, "empty_line_ratio": 0.35, "last_line_length": 31.0, "whitespace_ratio": 0.11, "most_common_ratio": 0.1, "line_length_stddev": 121.49, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 1.0, "most_common_char_codepoint": 101.0 }, "binary": { "overall_entropy": 4.86, "peak_region_bytes": 2509.0, "peak_region_entropy": 4.92 } } }, "id": 4, "path": "Meshmakers.Octo.Services.Swagger.3.4.24.nupkg!!README.md", "pid": 0, "risk": 1, "sha": "727ab645ce7b6f44c7a6e58d370b1b7bd317a25c9dd0343d8211134155126246", "size": 2509, "traits": [ { "id": "metadata/file/extension/identity::markdown-file-basename", "conf": 1.0, "crit": 1, "desc": "Markdown document file extension", "spans": [ [ 0, 9 ] ] }, { "id": "metadata/file/profile/language::lang-english", "conf": 0.800000011920929, "crit": 2, "desc": "Contains common English function words", "spans": [ [ 68, 3 ] ] }, { "id": "metadata/file/extension/identity::doc-or-config-extension", "conf": 1.0, "crit": 1, "desc": "File uses a document or configuration extension", "spans": [ [ 0, 9 ] ] } ], "type": "markdown" }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J\u0026m(", "n": [ { "c": 3, "d": "HTTP fingerprinting evasion campaign", "i": "objectives/command-and-control/infrastructure/user-agent::http-fingerprinting-campaign", "o": 0, "z": 34, "cf": 0.8999999761581421 } ], "ln": 0 }, { "b": "00000000000000000000nt#N?00000nb@R\u00260SSx7:v31dwmCPt0rr91000000000000", "n": [ { "c": 1, "d": "PE standard code/data section", "i": "metadata/binary/section/names::pe-code-data-standard-section", "o": 512, "z": 5, "cf": 0.8999999761581421 } ], "ln": 496 }, { "b": "019S.0rrDPtl1TgdGxCGlq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn", "n": [ { "c": 3, "d": "Recognized PE anti-analysis marker", "i": "objectives/anti-analysis/debugger-detect/combined-checks::evasion-aware-recognized-pe-marker", "o": 9928, "z": 4, "cf": 1.0 } ], "ln": 9912 }, { "b": "ry)f\u003cB7Fo]vp%j:A-CWhq*ACawO\u003c4\u003epxiH}Acb/jzGw0r0abZ$pJf(.l2ZKpv}YB\u003cve$vUxA", "n": [ { "c": 2, "d": "System namespace reference", "i": "metadata/lang/compiler/managed::system-namespace", "o": 20338, "z": 9, "cf": 0.800000011920929 } ], "ln": 20322 }, { "b": "x(mD}zF7N@wPRu\u003evrt]Tq*ACawO\u003c50wQ5qHn][]*e(Mt4x\u003c\u003e*(Dsp]fz/dg4wPRu\u003evrt]TxjVf(o\u003ewAP", "n": [ { "c": 3, "d": "JSON polymorphism runtime marker", "i": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "o": 20430, "z": 16, "cf": 1.0 } ], "ln": 20414 }, { "b": "q!o#)x\u003e7Z}e(M$5xj\u003e^@e[w^m08[e:By/qwsz.\u003cOB7GD2q/#L\u003cBzk\u0026tBy^:Sx\u0026X!=", "n": [ { "c": 3, "d": "References Windows executable or script", "i": "objectives/execution/interpreter/script/shell::windows-executable-ref", "o": 23800, "z": 4, "cf": 0.6000000238418579 } ], "ln": 23784 }, { "b": "w)]*#Bu%\u003eWr+lq)x(v\u003e?C4CYnx(v\u003e?s7L\u0026bAbYScv{%E[z/bL/wPRoMz!0i$x(v\u003e?pJf\u003e", "n": [ { "c": 3, "d": "Recognized sparse-logic binary marker", "i": "objectives/anti-analysis/vm-detect/instruction::sparse-logic-recognized-marker", "o": 24048, "z": 7, "cf": 0.800000011920929 } ], "ln": 24032 }, { "b": "zE^r@v%HT-ygQ)%x(v\u003e?q*ACawO\u003c4$wOb:\u0026v@#B6zu9mbwPz%dv}w2Cy\u00260V)BzkVh0cqZ(C4\u003eC$lVl^SwD", "n": [ { "c": 2, "d": "Benign high-entropy PE context", "i": "metadata/package/quality/false-positives::benign-high-entropy-pe-context", "o": 24472, "z": 17, "cf": 0.949999988079071 } ], "ln": 24456 }, { "b": "v@=p5BzkVh0b(*#x(v\u003e?q*ACawO\u003c50wQ5qHn][]*0buN[zuarXBydQSw]vVZwPRoNwPRQ7wjZVJzVBAY", "n": [ { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 24889, "z": 16, "cf": 0.8500000238418579 } ], "ln": 24873 }, { "b": "r+lq)x(v)6zF7N)BAzE4q*ACawO\u003c4{wPPK}BAzE4l2ZKawPIv4x(Ffdz/e6=z/{10q*ACawO\u003c4[x(m[\u003crbUYSA+PA7l2Hj2y?m3}07*a2A=#ebwL^z=C4\u003eE", "n": [ { "c": 3, "d": "LINQ query operations", "i": "micro-behaviors/data/db/linq::linq-queries", "o": 25087, "z": 11, "cf": 0.699999988079071 }, { "c": 2, "d": "System namespace reference", "i": "metadata/lang/compiler/managed::system-namespace", "o": 25051, "z": 10, "cf": 0.800000011920929 } ], "ln": 25035 }, { "b": "wN[.YA+PA7nmuyDy?mR!q*ACawO\u003c4!z!9AEz/49]z/6Dcy?mR!sz.\u003exz^#ZQxK#3?rb#z+B7PuhzdN./l1BI8v}YA", "n": [ { "c": 3, "d": ".NET dynamic code generation capability", "i": "metadata/lang/compiler/managed::dotnet-dynamic-code", "o": 25466, "z": 23, "cf": 0.8500000238418579 } ], "ln": 25450 }, { "b": "07pycB.tu3zF8WZwmY/Zq*ACawO\u003c50wQ5qHn][]*e(3s}wPE\u0026IwO+{/Bwu:+wPE\u0026:wPRoYzeqQUv]45P", "n": [ { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 26615, "z": 16, "cf": 0.8500000238418579 } ], "ln": 26599 }, { "b": "z/xoe0cqZ[uSgDMAaK7\u003cxjVf(qE%]*z/fScA@Zn)Byd{SB8V5nB7Gy)pJf(.l2ZKowPI*ezGxxg", "n": [ { "c": 3, "d": "Access to ASP.NET Response object", "i": "micro-behaviors/communications/http/server/managed::http-response-get", "o": 26892, "z": 12, "cf": 1.0 } ], "ln": 26876 }, { "b": "0aQa}0b2\u003e+uR\u003eVSx\u003e8z*xjVf(qE%\u0026\u003cwPI@Wz!aa[nL:qpzB5kQqE%\u0026\u003cwPI@Wz!aa[xjVf(oj-w", "n": [ { "c": 3, "d": "Access to ASP.NET Request object", "i": "micro-behaviors/communications/http/server/managed::http-request-get", "o": 29511, "z": 11, "cf": 1.0 } ], "ln": 29495 }, { "b": "B-H#6m}DNHA::6dA=S=Or+lq)x(v(Lf!+jle\u0026+KrefEr5y\u0026\u003c/uwJ:{xB-.Ujy+cY9BZ/f3v[QxUrbVL-", "n": [ { "c": 2, "d": "IPv4-like .NET assembly version", "i": "metadata/lang/compiler/managed::dotnet-ipv4-like-version", "o": 35260, "z": 16, "cf": 0.8500000238418579 } ], "ln": 35244 }, { "b": "00000000000000000000000000000000000000315c8Xg7YTL^00000000000000000", "n": [ { "c": 1, "d": "PE resource section", "i": "metadata/binary/section/names::pe-resource-section", "o": 35840, "z": 5, "cf": 0.8999999761581421 } ], "ln": 35824 }, { "b": "0000000000003a7gYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006Xn[brp!0rrl50@@r", "n": [ { "c": 3, "d": "Recognized marker for timing checks", "i": "objectives/anti-analysis/timing/evasion::timing-anti-debug-recognized-marker", "o": 35934, "z": 15, "cf": 0.949999988079071 } ], "ln": 35918 }, { "b": "fAr{fvGn7Z002m:5c8.hlJz38z2!IPve$fBC(QOtve$cAwDhYg003\u003cowDl=KxAh(Hve$6ywDl-", "n": [ { "c": 2, "d": "PE CompanyName metadata field", "i": "metadata/package/versioning::pe-companyname-field", "o": 36154, "z": 11, "cf": 0.699999988079071 } ], "ln": 36138 }, { "b": "m/WxavGn}0003:laPIJymGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up002Z[wDl=KxAh(Hve$6", "n": [ { "c": 2, "d": "PE FileDescription metadata field", "i": "metadata/package/versioning::pe-filedescription-field", "o": 36218, "z": 15, "cf": 0.699999988079071 } ], "ln": 36202 }, { "b": "x8(GyASu7t001+O2(\u003c#amGvc5yYF2DrSDXhASydXx-J5Kzu6Up001!Pe=WZde=WTbgYPcdfAq7M003:lb(^@CnDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE002Z[wDl=KxAh(Hve$6ywDl-J", "n": [ { "c": 3, "d": "Dotted-quad PE version metadata marker", "i": "objectives/command-and-control/infrastructure/ip::ipv4-version-metadata-marker", "o": 36326, "z": 11, "cf": 0.9399999976158142 }, { "c": 2, "d": "PE InternalName metadata field", "i": "metadata/package/versioning::pe-internalname-field", "o": 36378, "z": 12, "cf": 0.699999988079071 } ], "ln": 36310 }, { "b": "m/WxavGn}00043tb(^@Cpxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE002Z[wDl=KxAh(Hve$6y", "n": [ { "c": 2, "d": "PE OriginalFilename metadata field", "i": "metadata/package/versioning::pe-originalfilename-field", "o": 36582, "z": 16, "cf": 0.699999988079071 } ], "ln": 36566 }, { "b": "wb{ACyYBCn005C/jPCG.pYLIozVBqFBPt[KBo25ove$cAwDhYg0043tgxo3cgYPcdg5%chaoi$", "n": [ { "c": 2, "d": "PE ProductName metadata field", "i": "metadata/package/versioning::pe-productname-field", "o": 36698, "z": 11, "cf": 0.699999988079071 } ], "ln": 36682 }, { "b": "A@Y+Kdf6tF004/Pg5}sPpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001!Pe=WZde=WTbgYPcdfAq", "n": [ { "c": 2, "d": "PE version resource metadata", "i": "metadata/package/versioning::version-resource-metadata", "o": 36854, "z": 14, "cf": 0.8999999761581421 } ], "ln": 36838 }, { "b": "000000000000000000000h6q(3\u0026*ncxGl4)000000000000000000000000000000000", "n": [ { "c": 2, "d": "PE .reloc section presence", "i": "metadata/binary/section/names::reloc-section-presence", "o": 37376, "z": 6, "cf": 0.8999999761581421 } ], "ln": 37360 } ], "depth": 1, "facts": { "imp": [ [ "mscoree", "CorDllMain" ] ], "sec": [ [ ".text", 512, 35328, 6.02, "r-x" ], [ ".rsrc", 35840, 1536, 2.83, "r--" ], [ ".reloc", 37376, 512, 0.08, "r--" ] ], "metrics": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "resource_count": 1.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 90421.0, "reloc_overhang_bytes": 500.0, "reloc_overhang_ratio": 0.98, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "version.identity_entropy": 4.82, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0, "version.identity_symbol_ratio": 0.35 }, "file": { "size": 37888.0, "entropy": 5.85, "size_bytes": 37888.0 }, "binary": { "is_pie": 1.0, "code_entropy": 6.02, "string_count": 551.0, "overall_entropy": 5.85, "entropy_variance": 5.89, "avg_string_length": 20.27, "max_string_length": 139.0, "peak_region_bytes": 2048.0, "code_to_data_ratio": 1.0, "peak_region_entropy": 6.17, "string_length_stddev": 18.45, "largest_section_ratio": 0.93, "sentence_string_count": 10.0, "sentence_string_ratio": 0.02, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 35328.0, "entropy_max": 6.02, "entropy_mean": 2.98, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } } }, "id": 5, "mol": "O(Al)H₂(CmDb)", "path": "Meshmakers.Octo.Services.Swagger.3.4.24.nupkg!!lib/net10.0/Meshmakers.Octo.Services.Swagger.dll", "risk": 4, "sha": "dfaf13a6b00e299d107eade6ef359c93fc3baa76b7b3fbda7b66592465bb867d", "size": 37888, "traits": [ { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "spans": [ [ 36854, 14 ] ] }, { "id": "metadata/package/versioning::version-word-lower", "conf": 0.4000000059604645, "crit": 2, "desc": "version word (lowercase)", "spans": [ [ 24048, 7 ] ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "spans": [ [ 23800, 4 ] ] }, { "id": "micro-behaviors/communications/http/server/managed::http-response-get", "conf": 1.0, "crit": 3, "desc": "Access to ASP.NET Response object", "spans": [ [ 26892, 12 ] ] }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "spans": [ [ 0, 26 ] ] }, { "id": "micro-behaviors/data/db/linq::linq-queries", "conf": 0.699999988079071, "crit": 3, "desc": "LINQ query operations", "spans": [ [ 25087, 11 ] ] }, { "id": "micro-behaviors/communications/http/server/managed::http-request-get", "conf": 1.0, "crit": 3, "desc": "Access to ASP.NET Request object", "spans": [ [ 29511, 11 ] ] }, { "id": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "conf": 1.0, "crit": 3, "desc": "JSON polymorphism runtime marker", "spans": [ [ 20430, 16 ] ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "spans": [ [ 36326, 11 ] ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "spans": [ [ 9928, 4 ] ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 35934, 15 ] ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "spans": [ [ 9928, 4 ] ] } ], "type": "pe" }, { "id": 6, "sha": "2ecec209292b75d0f0204e04c48d5ecb444f21e0b3101c7d8e771ae3fe5b3918", "path": "Meshmakers.Octo.Services.Swagger.3.4.24.nupkg!!meshmakers64.png", "size": 1459, "type": "png", "depth": 1 }, { "id": 7, "sha": "cee4a045df741327cc7ccec97c910c7bf6ab610a2b1dc5acd90a67e7922eae20", "path": "Meshmakers.Octo.Services.Swagger.3.4.24.nupkg!![Content_Types].xml", "size": 649, "type": "xml", "depth": 1 }, { "id": 8, "sha": "999768358dbe06f1ae394cbc9d7c0126a4a76eda1551cb87b7f1d7881e185c82", "path": "Meshmakers.Octo.Services.Swagger.3.4.24.nupkg!!package/services/metadata/core-properties/ebe724a7d44b4ca08d1f2223ef19e553.psmdcp", "size": 673, "type": "xml", "depth": 1 }, { "id": 9, "sha": "b61af823402c1402a0d95d55dab4ffacd26c5fc90248270e58c3cabe04c0a572", "path": "Meshmakers.Octo.Services.Swagger@3.4.24.registry.json", "size": 810, "type": "registry", "depth": 1 } ], "omitted_files": 4, "v": "8" } }