{ "ml": { "v": "7", "eng": "2.3.0-beta.1", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.5027308, "rte": "az", "prob": 0.5027308 }, { "cls": 0, "raw": 0.22333097, "rte": "az/nupkg", "prob": 0.22333097 } ], "prob": 0.5027308, "skip": [ { "rte": "az/zip", "why": "unavailable" }, { "rte": "az/zip", "why": "unavailable" } ], "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.5027307868003845, "type": "nupkg" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.00012001395225524902, "type": "xml" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.012121975421905518, "type": "xml" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.1754968762397766, "type": "pe" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "xml" }, { "id": 5, "lvl": -1, "conf": 0, "prob": 0.011974960565567017, "type": "markdown" }, { "id": 6, "lvl": -1, "conf": 0, "prob": 0.0000756382942199707, "type": "png" }, { "id": 7, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "xml" }, { "id": 8, "lvl": -1, "conf": 0, "prob": 0.00012001395225524902, "type": "xml" }, { "id": 9, "lvl": -1, "conf": 0, "prob": 0.00020036101341247559, "type": "registry" } ], "version": "v18.18", "analyzed_at": "2026-07-10T06:35:31Z" }, "path": "SoftwareExtravaganza.Whizbang.Transports.HotChocolate.0.845.2-alpha.2.nupkg", "raw": { "files": [ { "id": 0, "mol": "O(Al)H₂(CmDb)", "sha": "ff10059d3623a36c32b6976c748e5116d2823201f3c575a4b7a6a66f69a7b74f", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/SoftwareExtravaganza.Whizbang.Transports.HotChocolate/SoftwareExtravaganza.Whizbang.Transports.HotChocolate.0.845.2-alpha.2.nupkg", "risk": 4, "size": 50324, "type": "nupkg", "facts": { "metrics": { "file": { "size": 50324.0, "entropy": 7.94, "size_bytes": 50324.0 }, "binary": { "overall_entropy": 7.94, "peak_region_bytes": 46080.0, "peak_region_entropy": 7.83 }, "archive": { "file_count": 9.0, "member_count": 9.0, "script_count": 0.0, "zip_bomb_ratio": 7.73, "directory_count": 0.0, "executable_count": 1.0, "extra_field_size": 0.0, "noise_file_count": 0.0, "total_compressed": 49022.0, "compression.ratio": 0.28, "hidden_file_count": 2.0, "total_uncompressed": 173250.0, "crc_collision_count": 0.0, "entry_comment_count": 0.0, "max_filename_length": 81.0, "rtlo_filename_count": 0.0, "format.regular_count": 9.0, "nested_archive_count": 0.0, "path_traversal_count": 0.0, "symlink_escape_count": 0.0, "security.setgid_count": 0.0, "security.setuid_count": 0.0, "security.sticky_count": 0.0, "double_extension_count": 0.0, "duplicate_member_count": 0.0, "security.symlink_count": 0.0, "unicode_filename_count": 0.0, "homoglyph_filename_count": 0.0, "security.encrypted_count": 0.0, "timing.mtime_unique_count": 4.0, "timing.mtime_unique_ratio": 0.44, "misplaced_executable_count": 1.0, "timing.mtime_dominant_count": 4.0, "timing.mtime_spread_seconds": 25108.0, "timing.sentinel_mtime_count": 0.0, "security.world_writable_count": 0.0, "timing.mtime_dominant_fraction": 0.44, "compression.method_counts.stored": 1.0, "compression.method_counts.deflate": 8.0 } } }, "ident": { "name": { "value": "SoftwareExtravaganza.Whizbang.Transports.HotChocolate", "source": "nupkg.title", "verified": false }, "urls": [ { "url": "https://whizba.ng/", "kind": "homepage", "source": "nupkg.project_url" }, { "url": "https://github.com/whizbang-lib/whizbang", "kind": "repository", "source": "nupkg.repository_url" } ], "trust": "unsigned", "authors": [ { "name": "Phil Carbone", "role": "author", "source": "nupkg.authors" } ], "version": { "value": "0.845.2-alpha.2", "source": "nupkg.version", "verified": false }, "identifier": { "value": "SoftwareExtravaganza.Whizbang.Transports.HotChocolate", "source": "nupkg.id", "verified": false } }, "traits": [ { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "from": [ { "file": 3 } ] }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/communications/http/server/managed::http-context", "conf": 1.0, "crit": 3, "desc": "Access to ASP.NET HttpContext", "from": [ { "file": 3 } ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "micro-behaviors/communications/http/server/managed::http-request-get", "conf": 1.0, "crit": 3, "desc": "Access to ASP.NET Request object", "from": [ { "file": 3 } ] }, { "id": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "conf": 1.0, "crit": 3, "desc": "JSON polymorphism runtime marker", "from": [ { "file": 3 } ] }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "from": [ { "file": 3 } ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "from": [ { "file": 3 } ] }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/data/db/linq::linq-queries", "conf": 0.699999988079071, "crit": 3, "desc": "LINQ query operations", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/data/db/linq::expression-visitor", "conf": 0.6000000238418579, "crit": 3, "desc": "ExpressionVisitor class", "from": [ { "file": 3 } ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/data/db/linq::system-linq-expressions", "conf": 0.6000000238418579, "crit": 3, "desc": "System.Linq.Expressions namespace", "from": [ { "file": 3 } ] } ] }, { "depth": 1, "facts": { "metrics": { "file": { "size": 543.0, "entropy": 5.2, "size_bytes": 543.0 }, "binary": { "overall_entropy": 5.2, "peak_region_bytes": 543.0, "peak_region_entropy": 5.2 } } }, "id": 1, "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/SoftwareExtravaganza.Whizbang.Transports.HotChocolate/SoftwareExtravaganza.Whizbang.Transports.HotChocolate.0.845.2-alpha.2.nupkg!!_rels/.rels", "pid": 0, "sha": "f56b379f78bc4b6f05c985241cfa584ec52e8c2a675e9522927e74e3ffa7a0d9", "size": 543, "type": "xml" }, { "ctx": [ { "b": "[4ls%kx}3YaA?spB7]MgjT8QkfD}SJzEWP}x(mMDb6w0teJs}sj]", "n": [ { "c": 2, "d": "NuGet nuspec manifest file", "i": "metadata/build/manifest::nuspec-file", "o": 0, "z": 60, "cf": 0.9800000190734863 } ], "ln": 1, "addr": 0 }, { "b": "jAa.syHH\u003c!aB4:tzGv@+xMOuniXJdcv}YB\u003cvrj5rx\u003e8g4B8LVje[n*pfk$ufyHH\u003c\u0026zF7QTfFLvpfF$I3B-RIkv\u003eJ1EwfKh", "ln": 2, "addr": 42 }, { "b": "arS^-wPRu\u003evrt{w", "ln": 3, "addr": 118 }, { "b": "arR^Hjy-qGD2^RixMMB9z/x#xx\u003eIa3aI$92gb7EvaA}HkDsyr2xdW}lvMVqNz/x#xx\u003eIa3j]", "ln": 13, "addr": 624 }, { "b": "arR^HjAL1AB3seUwO#Pwwo8ycwO@S2ADlaywP?T5Bs?MLB-H#azF782z/^ajz//(dBrC)vA=iKIwOb:\u0026v@#B6zxJ!cB8$=5x(mMawnca7vru0)wPw]jz/Z2kA+friy-)q3v@Dy0ay[]1AaK5jvs06pwI4$mA=#ebwNY!6jtg!+xlcl", "ln": 14, "addr": 682 }, { "b": "arR^HjAt1Lz/YSmz/QaCBA}?pjTaJMBrR\u0026IA+)(.xMOunB2\u003e%cxk8E3BZ=$kz/4dKxLz^4vqYZfy?WuiCw7YpvQTd!a%punvqYN*jTa]Tw]/RswNPa\u003cfjXTqwO=p7a%pxlzeB0ejT8Z[g?FTSiw\u003eqPvpS!TvL?WPh-ke2hEXTShd!T7v}GgYg=mm7f\u003ezKKffP", "n": [ { "c": 2, "d": "NuGet package declares repository", "i": "metadata/package/files/nuget::nuspec-repository", "o": 826, "z": 105, "cf": 0.8999999761581421 } ], "ln": 15, "addr": 822 }, { "b": "arR^Hjy\u00262xwO#3\u0026zEWx(B3o", "n": [ { "c": 2, "d": "NuGet package declares dependencies", "i": "metadata/package/files/nuget::nuspec-dependencies", "o": 981, "z": 416, "cf": 0.8999999761581421 } ], "ln": 16, "addr": 977 }, { "b": "arR^HarS^VA=l8taAR4jxjVfOA:-/@Cw?IqjTa=PBtkE4fD@W", "ln": 17, "addr": 996 }, { "b": "arR^HarR^Hjy\u00262xwO#3\u0026zEW@mx\u003efvJq/un\u0026CvtJ6mr\u0026]{vrM6(vqZy1e(#.2Dsyr2xd=L\u0026A+cBqC4CYnx(v(La$$Seg=l)veN-EmxKJIGa%pDwv@co#wJ.k7B.LV5ej1eZy\u003cytrA=SAEffP", "ln": 18, "addr": 1036 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 1527.0, "entropy": 5.14, "size_bytes": 1527.0 }, "binary": { "overall_entropy": 5.14, "peak_region_bytes": 1527.0, "peak_region_entropy": 5.11 } } }, "id": 2, "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/SoftwareExtravaganza.Whizbang.Transports.HotChocolate/SoftwareExtravaganza.Whizbang.Transports.HotChocolate.0.845.2-alpha.2.nupkg!!SoftwareExtravaganza.Whizbang.Transports.HotChocolate.nuspec", "pid": 0, "risk": 1, "sha": "dfa6e17c9972f85de8e560eb0e0033e280260d89da8a25687dde612468ccf862", "size": 1527, "traits": [ { "id": "metadata/package/files/nuget::nuspec-dependencies", "conf": 0.8999999761581421, "crit": 2, "desc": "NuGet package declares dependencies", "spans": [ [ 981, 416 ] ] }, { "id": "metadata/package/files/nuget::nuspec-repository", "conf": 0.8999999761581421, "crit": 2, "desc": "NuGet package declares repository", "spans": [ [ 826, 105 ] ] }, { "id": "metadata/build/manifest::nuspec-file", "conf": 0.9800000190734863, "crit": 2, "desc": "NuGet nuspec manifest file", "spans": [ [ 0, 60 ] ] } ], "type": "xml" }, { "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J\u0026m(", "n": [ { "c": 3, "d": "HTTP fingerprinting evasion campaign", "i": "objectives/command-and-control/infrastructure/user-agent::http-fingerprinting-campaign", "o": 0, "z": 34, "cf": 0.8999999761581421 } ], "ln": 0 }, { "b": "00000000000000000000jE=xK00000nb@R\u00260SSx7H=+UqJ9VF:0rr91000000000000", "n": [ { "c": 1, "d": "PE standard code/data section", "i": "metadata/binary/section/names::pe-code-data-standard-section", "o": 512, "z": 5, "cf": 0.8999999761581421 } ], "ln": 496 }, { "b": "huFnl000c7dand@3mV2Qlq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn", "n": [ { "c": 3, "d": "Recognized PE anti-analysis marker", "i": "objectives/anti-analysis/debugger-detect/combined-checks::evasion-aware-recognized-pe-marker", "o": 7816, "z": 4, "cf": 1.0 } ], "ln": 7800 }, { "b": "x(mTbx\u003c\u003e*SxMvV)wjZqiq!oDYA+PSvp\u0026Zn/v}/)\u003cy!ndqlVm0=wO+^%x(v(Xwb{WZByd*:xjkW(Dsp]fz/eb", "n": [ { "c": 1, "d": "Regex component marker", "i": "objectives/persistence/login/scheduled-task/com::task-action-principal-properties--rx-6", "o": 18239, "z": 19, "cf": 0.8799999952316284 } ], "ln": 18223 }, { "b": "yHpBnvpK7!zF8BMwO+(SjxlDlA.f!jwNPaXA.Z4WwJ\u003c)puQwghyIvW0mRMBIwb[.\u003ewO${]Bv*1lwNPaXA.Z4WwJ\u003c)puQwghyIvW0mG", "n": [ { "c": 1, "d": "Regex component marker", "i": "objectives/persistence/login/scheduled-task/com::task-action-principal-properties--rx-9", "o": 18533, "z": 33, "cf": 0.8799999952316284 } ], "ln": 18517 }, { "b": "yHpBnvpK7!zF8BMwO+(SjxlDlA.f!ey*?3{rc-B]B3swDuQwghyIvW0mRMBIwb[.\u003ewO${]Bv*1gy*?3{rc-B]B3swDuQwghyIvW0mG", "n": [ { "c": 1, "d": "Regex component marker", "i": "objectives/persistence/login/scheduled-task/com::task-action-principal-properties--rx-9", "o": 19060, "z": 33, "cf": 0.8799999952316284 } ], "ln": 19044 }, { "b": "B.aJXB8a6=vqf*(vR/PQq*ACawO\u003c4[x(m]yqfuC\u003cD0$e#wDkq0B.bPsvpB4:0af!?A+PF*A+5.", "n": [ { "c": 3, "d": "LINQ query operations", "i": "micro-behaviors/data/db/linq::linq-queries", "o": 19588, "z": 11, "cf": 0.699999988079071 } ], "ln": 19572 }, { "b": "zdN-VwjQouwmY^RvqPMQxjVf(rDz.(nN$w6vpS}\u0026pgn0J0cqZ[uSzeUA.f!jwNPaXA.Z4WwDlvOBye0UzEEB8nN$w6vpS}\u0026pgn0J0cqZ[uSpPOve", "n": [ { "c": 1, "d": "Regex component marker", "i": "objectives/persistence/login/scheduled-task/com::task-action-principal-properties--rx-9", "o": 19869, "z": 20, "cf": 0.8799999952316284 } ], "ln": 19853 }, { "b": "z/66anN$h8vqfNTD2Nr{xjVf(rDz.(nN$h8vqfNTD2Nr{B7GD2rDz.(nN$h8vqfNTD2Nr{xjVf(raP@QzGFDXlU{gBzb+!1wDl^.Bye0UzEEz", "n": [ { "c": 1, "d": "Regex component marker", "i": "objectives/persistence/login/scheduled-task/com::task-action-principal-properties--rx-9", "o": 20388, "z": 19, "cf": 0.8799999952316284 } ], "ln": 20372 }, { "b": "BywY*ByvESBAh88B-.f{n][]*p\u0026ye}zeTDlxLy%xBAzLqvS=^707gWwAa%c1AZ%XUwPzj3wN[8GBAh88B-.f{l3di?", "n": [ { "c": 3, "d": "JSON polymorphism runtime marker", "i": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "o": 21017, "z": 24, "cf": 1.0 } ], "ln": 21001 }, { "b": "vqC{kA=k!-CYWIqzEEtYB7GD2mp{dyv@#BdwL^zYzEWy1vqC{+wPRoBv@#\u003c4y/2d^zEWy1vqC{hy*?3{B5l)\u003ezEWy1vqC{xD2[7sz7Xg]y\u00260V)BzkVhB1Ql$ygQ)%o(BMNyYB", "n": [ { "c": 1, "d": "Regex component marker", "i": "objectives/persistence/login/scheduled-task/com::task-action-principal-properties--rx-6", "o": 22246, "z": 22, "cf": 0.8799999952316284 } ], "ln": 22230 }, { "b": "A==vPnn\u0026PqxM4y0y*?A%e[w^m0b2\u003e+uRbuJz2^HWB97#g0afqZBAg/1Bwl)]Bzj=:", "n": [ { "c": 3, "d": "References Windows executable or script", "i": "objectives/execution/interpreter/script/shell::windows-executable-ref", "o": 22414, "z": 4, "cf": 0.6000000238418579 } ], "ln": 22398 }, { "b": "zz1p{zF0P}B-H]jx(v\u003e?q*ACawO\u003c50wQ5qHn][]*e(Mt4x\u003c\u003e*(Dsp]fz/bLNwN/\u003e6x([R?CYW$mv@#B6", "n": [ { "c": 3, "d": "JSON polymorphism runtime marker", "i": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "o": 22870, "z": 16, "cf": 1.0 } ], "ln": 22854 }, { "b": "zEE0\u003cwL^z=ygQ)%x(v\u003e?q*ACawO\u003c4$wOb:\u0026v@#B6zu9mbwPz%dv}w2Cy\u00260V)BzkVh07pKxvpB4:nP5S\u003czV", "n": [ { "c": 2, "d": "Benign high-entropy PE context", "i": "metadata/package/quality/false-positives::benign-high-entropy-pe-context", "o": 23003, "z": 17, "cf": 0.949999988079071 } ], "ln": 22987 }, { "b": "z!@\u003c7wIcz@wN/\u003e8x(v\u003e?q*ACawO\u003c50wQ5qHn][]*06$daq!ZbZy?mZbzua3LAbYScwPH*?08m3DxM4AM", "n": [ { "c": 2, "d": "System.Text.Json library reference", "i": "micro-behaviors/data/serialize/json::json-system", "o": 23223, "z": 16, "cf": 0.8500000238418579 } ], "ln": 23207 }, { "b": "lVm0Re\u003ey8az#-yGz/{10q*ACawO\u003c4[x(m[\u003czdNM[wPv=-wPRoQA=lbnwmY=YnMfhvC4\u003eC$p\u0026ZE", "n": [ { "c": 3, "d": "LINQ query operations", "i": "micro-behaviors/data/db/linq::linq-queries", "o": 23343, "z": 11, "cf": 0.699999988079071 } ], "ln": 23327 }, { "b": "pJx#SAZC4IBAh8mAa%i5mr\u0026=(wPI{bz/eP\u0026B7]-mASxD\u0026x(!0gz/L?HpHX6Iv@$gOwO+)BwPIv4x(FfjAS", "n": [ { "c": 3, "d": "LINQ expression tree manipulation", "i": "micro-behaviors/data/db/linq::linq-expressions", "o": 23851, "z": 17, "cf": 0.75 } ], "ln": 23835 }, { "b": "wod--wPRoTwPz%dv}xYYq*ACawO\u003c4$B-8qnzdLs\u003ezGGDgz/wS^A=#ebwPE\u0026ID2[7sz7X.ezGGPfwIct*ze:i9wPyZXA=#ebwPE", "n": [ { "c": 3, "d": "Packed binary marker", "i": "objectives/anti-static/obfuscation/eval/loader::packed-binary-marker", "o": 24011, "z": 30, "cf": 0.8500000238418579 } ], "ln": 23995 }, { "b": "zdN-Vwj7fwx(c*{AaK7\u003cxjVf(rDz.(nN$h8vqfNTD2Nto0cqZ[uSzeUA.f!ey*?3{rc-B]A@Y\u0026:Bye0UzEEB8nN$h8vqfNTD2Nto0cqZ[uSpPOve", "n": [ { "c": 1, "d": "Regex component marker", "i": "objectives/persistence/login/scheduled-task/com::task-action-principal-properties--rx-9", "o": 24280, "z": 20, "cf": 0.8799999952316284 } ], "ln": 24264 }, { "b": "ra{q-vpT7\u0026xd^d(B8b*%uUaF7A:-E1p\u0026Zn/v}/)\u003cy\u0026YO$wPRoTwN/\u003e6x([R%A+PA3x(EG%A@Zn)BydQSv@co#wKQ\u0026NwPh:9z/d%OByw)1A@Yc:B97#ge(Ms\u003eB-IhrC}IE2vqfO10b2\u003e+uQFTrx(d[\u003eB7GD2lU{gBzf2X:wD", "n": [ { "c": 2, "d": "System namespace reference", "i": "metadata/lang/compiler/managed::system-namespace", "o": 24828, "z": 15, "cf": 0.800000011920929 }, { "c": 1, "d": "Regex component marker", "i": "objectives/persistence/login/scheduled-task/com::task-action-principal-properties--rx-6", "o": 24758, "z": 18, "cf": 0.8799999952316284 } ], "ln": 24742 }, { "b": "B-IhrC%#$1wO#N6z/fQ@q*ACawO\u003c4[x(m]ymr\u0026=(wPI{bz/fQ@B7GD2p?sV:x(!ufz/fQ@uUaF7A:-E1p?sV:x(!s", "n": [ { "c": 3, "d": "LINQ query operations", "i": "micro-behaviors/data/db/linq::linq-queries", "o": 25287, "z": 11, "cf": 0.699999988079071 } ], "ln": 25271 }, { "b": "z/]@t08)#FA=.pGvrlI\u003cxjVf(qE%\u0026\u003cwPI}[now@)qE%\u0026\u003cwPI}[rbUDAB94yKx(mDJx(Xop08mw", "n": [ { "c": 3, "d": "Access to ASP.NET Request object", "i": "micro-behaviors/communications/http/server/managed::http-request-get", "o": 26499, "z": 11, "cf": 1.0 } ], "ln": 26483 }, { "b": "wmPH/CvtJ6lVl\u003c:wQ5p%now@)lVl\u003c:wQ5p%nM6bvz!%PdAZK+.By/Ys07/N\u0026B7ol8Acc2slVl\u0026", "n": [ { "c": 3, "d": "Access to ASP.NET HttpContext", "i": "micro-behaviors/communications/http/server/managed::http-context", "o": 26610, "z": 11, "cf": 1.0 } ], "ln": 26594 }, { "b": "0rrv5wO+{^B7CsKblm==lVl{?A+Pf1BrFD1atLSah6v9Rx)Kk%zF7Lqx\u003c}5xASDeSnn\u0026PqxA", "n": [ { "c": 2, "d": "Copyright notice", "i": "metadata/package/license::copyright-word", "o": 31034, "z": 9, "cf": 0.6000000238418579 } ], "ln": 31018 }, { "b": "00000000000000000000000000000000000000315c8Xg7YTL^00000000000000000", "n": [ { "c": 1, "d": "PE resource section", "i": "metadata/binary/section/names::pe-resource-section", "o": 32768, "z": 5, "cf": 0.8999999761581421 } ], "ln": 32752 }, { "b": "0000000000008S]gYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006Xn[brp!0rt*@0000", "n": [ { "c": 3, "d": "Recognized marker for timing checks", "i": "objectives/anti-analysis/timing/evasion::timing-anti-debug-recognized-marker", "o": 32862, "z": 15, "cf": 0.949999988079071 } ], "ln": 32846 }, { "b": "zVB!TBo0][0024W4fczelJz38z2!IPve$fBC(QOtve$cAwDhYg004iyxAh-DDh}yOve$fBx8\u003cH-yYFeHvGlxd003:laPIJymGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up00372xAh-DDh}yOve$f", "n": [ { "c": 2, "d": "PE CompanyName metadata field", "i": "metadata/package/versioning::pe-companyname-field", "o": 33326, "z": 11, "cf": 0.699999988079071 }, { "c": 2, "d": "PE FileDescription metadata field", "i": "metadata/package/versioning::pe-filedescription-field", "o": 33386, "z": 15, "cf": 0.699999988079071 } ], "ln": 33310 }, { "b": "ve$xHwDhYg001?Q3ig8bmGvc5yYF2DrSDXhASydXx-J5Kzu6Up001XMe=W\u003chgYPxke=WTbe=WN9003:lb(^@CnDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE00372xAh-DDh}yOve$fBx8\u003cK:", "n": [ { "c": 3, "d": "Dotted-quad PE version metadata marker", "i": "objectives/command-and-control/infrastructure/ip::ipv4-version-metadata-marker", "o": 33494, "z": 11, "cf": 0.9399999976158142 }, { "c": 2, "d": "PE InternalName metadata field", "i": "metadata/package/versioning::pe-internalname-field", "o": 33546, "z": 12, "cf": 0.699999988079071 } ], "ln": 33478 }, { "b": "eDxO!x-IPx0043tb(^@Cpxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE00372xAh-DDh}yOve$fB", "n": [ { "c": 2, "d": "PE OriginalFilename metadata field", "i": "metadata/package/versioning::pe-originalfilename-field", "o": 33750, "z": 16, "cf": 0.699999988079071 } ], "ln": 33734 }, { "b": "wb{ACyYBCn001+O2(\u003c#apYLIozVBqFBPt[KBo25ove$cAwDhYg00372xAh-DDh}yOve$fBx8?]i005q+irf6WpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001XMe=W\u003chgYPxke=WTbeDt", "n": [ { "c": 2, "d": "PE ProductName metadata field", "i": "metadata/package/versioning::pe-productname-field", "o": 33866, "z": 11, "cf": 0.699999988079071 }, { "c": 2, "d": "PE version resource metadata", "i": "metadata/package/versioning::version-resource-metadata", "o": 33918, "z": 14, "cf": 0.8999999761581421 } ], "ln": 33850 }, { "b": "000000000000000000000fvfX3\u0026*nctS.#^000000000000000000000000000000000", "n": [ { "c": 2, "d": "PE .reloc section presence", "i": "metadata/binary/section/names::reloc-section-presence", "o": 34304, "z": 6, "cf": 0.8999999761581421 } ], "ln": 34288 } ], "depth": 1, "facts": { "imp": [ [ "mscoree", "CorDllMain" ] ], "sec": [ [ ".text", 512, 32256, 5.98, "r-x" ], [ ".rsrc", 32768, 1536, 3.1, "r--" ], [ ".reloc", 34304, 512, 0.08, "r--" ] ], "metrics": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "resource_count": 1.0, "has_version_info": 1.0, "checksum_stripped": 1.0, "computed_checksum": 58860.0, "reloc_overhang_bytes": 500.0, "reloc_overhang_ratio": 0.98, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "version.identity_entropy": 4.24, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0, "version.identity_symbol_ratio": 0.06 }, "file": { "size": 34816.0, "entropy": 5.8, "size_bytes": 34816.0 }, "binary": { "is_pie": 1.0, "code_entropy": 5.98, "string_count": 533.0, "overall_entropy": 5.8, "entropy_variance": 5.79, "avg_string_length": 20.62, "max_string_length": 110.0, "peak_region_bytes": 1024.0, "code_to_data_ratio": 1.0, "peak_region_entropy": 6.21, "string_length_stddev": 15.21, "largest_section_ratio": 0.93, "sentence_string_count": 7.0, "sentence_string_ratio": 0.01, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 3.0, "code_size": 32256.0, "entropy_max": 5.98, "entropy_mean": 3.05, "name_entropy": 3.03, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } } }, "id": 3, "mol": "O(Al)H₂(CmDb)", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/SoftwareExtravaganza.Whizbang.Transports.HotChocolate/SoftwareExtravaganza.Whizbang.Transports.HotChocolate.0.845.2-alpha.2.nupkg!!lib/net10.0/Whizbang.Transports.HotChocolate.dll", "pid": 0, "risk": 4, "sha": "bd2891fc40c9431769f644ff2116bd325a6d7d74baf6da4e6c363588ab28daaf", "size": 34816, "traits": [ { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure", "spans": [ [ 32862, 15 ] ] }, { "id": "micro-behaviors/data/db/linq::expression-visitor", "conf": 0.6000000238418579, "crit": 3, "desc": "ExpressionVisitor class", "spans": [ [ 23851, 17 ] ] }, { "id": "micro-behaviors/communications/http/server/managed::http-request-get", "conf": 1.0, "crit": 3, "desc": "Access to ASP.NET Request object", "spans": [ [ 26499, 11 ] ] }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field", "spans": [ [ 33494, 11 ] ] }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range", "spans": [ [ 0, 26 ] ] }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)", "spans": [ [ 7816, 4 ] ] }, { "id": "objectives/anti-analysis/self-modify/runtime::json-polymorphism-runtime-ref", "conf": 1.0, "crit": 3, "desc": "JSON polymorphism runtime marker", "spans": [ [ 21017, 24 ], [ 22870, 16 ] ] }, { "id": "micro-behaviors/data/db/linq::system-linq-expressions", "conf": 0.6000000238418579, "crit": 3, "desc": "System.Linq.Expressions namespace", "spans": [ [ 25287, 23 ] ] }, { "id": "micro-behaviors/data/db/linq::linq-queries", "conf": 0.699999988079071, "crit": 3, "desc": "LINQ query operations", "spans": [ [ 19588, 11 ], [ 23343, 11 ], [ 25287, 11 ] ] }, { "id": "micro-behaviors/fs/path/extension::dll-dup", "crit": 2, "desc": ".dll extension reference", "spans": [ [ 22414, 4 ] ] }, { "id": "micro-behaviors/communications/http/server/managed::http-context", "conf": 1.0, "crit": 3, "desc": "Access to ASP.NET HttpContext", "spans": [ [ 26610, 11 ] ] }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field", "spans": [ [ 33918, 14 ] ] }, { "id": "metadata/binary/framework::dotnet-assembly", "conf": 1.0, "crit": 2, "desc": ".NET Assembly (mscoree.dll)", "spans": [ [ 7816, 4 ] ] } ], "type": "pe" }, { "id": 4, "sha": "5c76421623f35472789a6196fbab39fca13abd0908cf73f944befe6fc6585a9f", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/SoftwareExtravaganza.Whizbang.Transports.HotChocolate/SoftwareExtravaganza.Whizbang.Transports.HotChocolate.0.845.2-alpha.2.nupkg!!lib/net10.0/Whizbang.Transports.HotChocolate.xml", "size": 48968, "type": "xml", "depth": 1 }, { "ctx": [ { "b": "lrc#RpdD{NwfKi8z/fVqx\u003c#jbx(mMCfjv3KjtgUq3jn[mayP82xkP\u003cRv}xL1wPw$U3lQDNvixl7wOa7HxMOunB2\u003e%cxk8E3BZ=$kz/4dKxLz^4vqYZfy?WuiCw7YpvQTd!fjwvjx(v)gfl.tPyI4y3CxkAEx!BWFy:859x(dG9B8\u003e+Nb4#7uAc15[fk20vxMW=pv@DiqCw7YpvQTd!eO]cgfl.8zDsyr2xd)X6BzkVhB1.-QA+/o6z*cmQv}^Mvzep\u003emvpT0", "ln": 304, "col": 18, "line": 8 }, { "b": "vqGT\u003czAPgNwO#Q3AW0Xfvixl7wOa7HxMOunB2\u003e%cCw7YpvQQ)bxcGJqwNP9(Bzbkdw{4{aay]z2B.$YcByxo9z/cXaBrC^vx)Kk%e]Cq:fjv4bfk9d93jnvpeEz?fboQ63C{3g4x)Kk%zF8fv3n0wIdNE@WDtdnfaw=S\u0026w]zZbvqYN^dK(O2FrRfsatLS*B0bgmePt-Gv}x.5az\u003eXhB75Y)ay]hcAa9\u0026#xDRIkBz8!ywPzYivqG:#v{%E[z/fRsz/cXtxK@r1z/^avvrue\u0026eG=I)pgnlUC4z^ZpGeDGA=k!ql$7u-pI%.[dJ)-3LPS[yB-H#6azkn6wPzj3z/P[wCwh8eaz2.cA^m", "ln": 2082, "col": 5, "line": 31 }, { "b": "BzkP6aA?spx\u003ez6?vruj4zxJ\u003efaz\u003eXhB75Y)azth3wnC*$B1wCOz/{eozF7HyvqYP#wP?T5BrCTmxK#3?A%:GwdK)?$C4CGdAaK5jmr\u0026=.A+P95v}vbtaMv{oaw#]-xDP(mmiDU]AbY-oBrC^wBz8!bz!9A4zEEZ5xjk)@z/d9GwnbE+zF%Prx\u003e8h", "ln": 2451, "col": 29, "line": 39 }, { "b": "A%-m7dPf?/wPh:fA=SYWaMv{oax9w\u003cBy/o1B8@EvwPI{3xjSi0vqYQ(wPz\u0026mBzb98aAz46wODs0ay/tbzddr)B0a[ewft\u0026iz!a02wGUMcwO#Qhe*absAaHRxvp\u003c6[CwhejazbC3CXHS6wGV28B8V5nB7DFoD2Ntoe^.}ndNW#(Aa9\u0026#xK#ildJ)-3", "ln": 2652, "col": 16, "line": 42 }, { "b": "BrCgoz/3RdC4CMkaAITBwNPB%e*9-6wncj3wozr%y\u003cvdpvrl9lBAg/1yH}30w]zYjx(mB3wO(0@Byw#dze0T6vruj4zy#n6dK[b6zGxxgdK(O2FrRfzz/6DiB75J]wGU#nwPA5sAb](iwN/*@z/fRsz*2YjaAg[jB8UY2Bzk]fay[]5vix=dBz8=", "ln": 2968, "col": 51, "line": 48 }, { "b": "x(v\u003e@eG=I)mmFy!z/Pzif!+7batj\u0026!dNWY:AaK5tdJ)-3LPSwpvqE5%vrt{2vpJ!UB8@EFx([2hB8Mhwv}vl8wO#71vru6\u003eaz(4cwO=z{eG=I)qG3R)D2s:6z/{8gwGTGOzE)\u0026%Bz(hvdK(O2FrRfzz/6Dcy?khux(dA7Cwh8izF787z/M$vwN/p\u003cBz?", "ln": 4728, "col": 87, "line": 78 }, { "b": "v}vl8wO#71vru6\u003eaA?gfB.8XlvRPE:BAm=@bo[s3wPS3dzF77\u003cByxiiwN(bPu%)wKvrl8?wn=NcwPP56wmM*4vpK7YxjSh:z!s9nvrb{FCYW$mC422(zHb.zs7(q]vQTd!e\u003c\u003cL$wEq*Mu\u003cWltwO00axK@q\u003cqfuO.yAML$vrcDjxlv{0wNcY$BAzFyiXJb", "ln": 5072, "col": 21, "line": 83 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 5682, "entropy": 5.2 }, "text": { "lines": 107, "top_char": 101, "max_ws_run": 26, "digit_ratio": 0.01, "space_count": 602, "char_entropy": 5.2, "unique_chars": 83, "top_char_null": 0, "lines_over_200": 4, "top_char_ratio": 0.07, "avg_line_length": 52.1, "max_line_length": 226, "non_ascii_ratio": 0.03, "empty_line_ratio": 0.27, "last_line_length": 14, "long_token_count": 1, "whitespace_ratio": 0.12, "line_length_stddev": 58.31, "repeated_char_sequences": 9 }, "binary": { "peak_region_bytes": 5682, "peak_region_entropy": 5.28 } } }, "id": 5, "mol": "H(Cm)", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/SoftwareExtravaganza.Whizbang.Transports.HotChocolate/SoftwareExtravaganza.Whizbang.Transports.HotChocolate.0.845.2-alpha.2.nupkg!!README.md", "pid": 0, "risk": 1, "sha": "39ec231770e710b1351884d0b8923b125b6996d103322ae616f87890cc74896f", "size": 5682, "traits": [ { "id": "metadata/lang/natural::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"", "spans": [ [ 2130, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-2", "conf": 0.8, "crit": 1, "desc": "English function-word token \"and\"", "spans": [ [ 2499, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-3", "conf": 0.8, "crit": 1, "desc": "English function-word token \"that\"", "spans": [ [ 2700, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "spans": [ [ 3016, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-6", "conf": 0.8, "crit": 1, "desc": "English function-word token \"with\"", "spans": [ [ 2264, 0 ] ] }, { "id": "micro-behaviors/communications/http/url/forge::public-code-forge-url", "conf": 0.9, "crit": 3, "desc": "References a public code-forge URL", "spans": [ [ 368, 19 ] ] } ], "type": "markdown" }, { "id": 6, "sha": "c61516016362b41ef84710a6a4a2b39f70a06d4b0c65f3d2ca9ebfd2de62348d", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/SoftwareExtravaganza.Whizbang.Transports.HotChocolate/SoftwareExtravaganza.Whizbang.Transports.HotChocolate.0.845.2-alpha.2.nupkg!!logo.png", "size": 67200, "type": "png", "depth": 1 }, { "id": 7, "sha": "b858fadd5794c5a53fcbaa7a45db7aa5f6ab1fd173ba71cc2625214ee1509c6a", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/SoftwareExtravaganza.Whizbang.Transports.HotChocolate/SoftwareExtravaganza.Whizbang.Transports.HotChocolate.0.845.2-alpha.2.nupkg!![Content_Types].xml", "size": 644, "type": "xml", "depth": 1 }, { "id": 8, "sha": "07c9315220987b7305918fdc2805445db29ae159f61bc254bd5df54a3f0c26d8", "path": "/data/samples/unknown/foraged/dotnet/nuget.org/_/SoftwareExtravaganza.Whizbang.Transports.HotChocolate/SoftwareExtravaganza.Whizbang.Transports.HotChocolate.0.845.2-alpha.2.nupkg!!package/services/metadata/core-properties/cf5aff5049b34f6abb960da80c607f10.psmdcp", "size": 875, "type": "xml", "depth": 1 }, { "ctx": [ { "b": "DM)3hz/ZhBBy/qkiWeD:xjVfeefX$uzdK[Lb2-z(BA.elwKQ\u0026=A::c1xjkX7vj\u003eR{x)Kk%zF7O3A:-\u003cbAbP=sB1Q14Bvf.Wv@Df(", "n": [ { "c": 3, "d": "Registry release under 7 days old", "i": "metadata/registry::freshly-published", "o": 0, "z": 24, "cf": 1.0 } ], "ln": 0 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 1015.0, "entropy": 4.99, "size_bytes": 1015.0 }, "binary": { "overall_entropy": 4.99, "peak_region_bytes": 1015.0, "peak_region_entropy": 4.99 }, "registry": { "age_days": 0.0, "maintainers": 1.0, "published_at": 1783659736.0, "releases_24h": 1.0, "releases_48h": 3.0, "is_deprecated": 0.0, "release_count": 171.0, "downloads_total": 11213.0, "version_removed": 0.0, "package_age_days": 154.0, "first_published_at": 1770321761.0, "vulnerability_count": 0.0, "previous_published_at": 1783564483.0, "days_since_previous_release": 1.0 } } }, "id": 9, "mol": "Md", "path": "SoftwareExtravaganza.Whizbang.Transports.HotChocolate@0.845.2-alpha.2.registry.json", "pid": 0, "rel": "registry", "risk": 1, "role": "sidecar", "sha": "3bbd65a24d5abfe6416cd5aada3587edc35d3cea6297d1986a8f6550ab1dddad", "size": 1015, "traits": [ { "id": "metadata/registry::freshly-published", "conf": 1.0, "crit": 3, "desc": "Registry release under 7 days old", "spans": [ [ 0, 24 ] ] } ], "type": "registry" } ], "omitted_files": 4, "rev": "e6071", "v": "8" } }