{ "ml": { "v": "7", "eng": "2.3.0-beta.0", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.12363249, "rte": "az", "prob": 0.12363249 } ], "prob": 0.12363249, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.12363249063491821, "type": "xz" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.01863124966621399, "type": "elf" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.0009059011936187744, "type": "c" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.0020224153995513916, "type": "c" } ], "version": "v18.18", "analyzed_at": "2026-07-07T09:56:50Z" }, "path": "raqm-0.10.4.tgz", "raw": { "files": [ { "id": 0, "ctx": [ { "b": "@wP48s]XK9\u003egl[e0STwA761smBt8:J\u0026s(kN7Hm1?7Y", "n": [ { "c": 2, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "o": 0, "z": 1, "cf": 1.0 } ], "ln": 0 } ], "mol": "Md(He)", "sha": "01d8b3e5b1215e4b00b2f38b2f95da48de4cf07973898ab1b3b093763ce8749a", "path": "raqm-0.10.4.tgz", "risk": 2, "size": 15448, "type": "xz", "facts": { "metrics": { "file": { "size": 15448.0, "entropy": 7.99, "size_bytes": 15448.0 }, "binary": { "overall_entropy": 7.99, "peak_region_bytes": 15360.0, "peak_region_entropy": 7.84 }, "consistency": { "extension_content_mismatch": 1.0, "extension_content_mismatch.archive_as_archive": 1.0 } } }, "traits": [ { "id": "micro-behaviors/dylib/library/libc::libc-internal-functions-b", "conf": 0.699999988079071, "crit": 2, "desc": "libc internal symbols cluster B", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/dylib/library/abi-graphics::cxx-abi-symbols-a", "conf": 0.800000011920929, "crit": 2, "desc": "C++ ABI symbols cluster A", "from": [ { "file": 1 } ] }, { "id": "metadata/build/artifact::elf-stripped-but-symtab-present", "conf": 0.6000000238418579, "crit": 3, "desc": "ELF stripped with .symtab present", "from": [ { "file": 1 } ] }, { "id": "metadata/hardening/mitigation::rpath-set", "conf": 0.699999988079071, "crit": 3, "desc": "RPATH/RUNPATH dynamic library path set", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/dylib/library/libc::libc-characteristic-cxa-finalize", "crit": 2, "desc": "libc characteristic cxa finalize", "from": [ { "file": 1 } ] } ] }, { "ctx": [ { "b": "E))420S-r400000000000@$H+0rr915eUxE00000kMy=:00000N0eJg0000000000kMA+z2lm0?9@)tZ1][S61on", "n": [ { "c": 3, "d": "Patterns associated with legitimate injectors to reduce FPs", "i": "objectives/evasion/process/injection/toolkit::legitimate-injector-patterns", "o": 0, "z": 21, "cf": 1.0 } ], "ln": 0 }, { "b": "003wuzFsg)uUj1\u0026x-IHEv%zA?w[=c\u003ey?Xib0af8zwPzu{x(!xcA:JB0vqPN.x(mK30af8NwOkZ#", "n": [ { "c": 3, "d": "Terminal socket exec helper context", "i": "micro-behaviors/process/fd/dup::unix-terminal-socket-exec-benign-context", "o": 2791, "z": 12, "cf": 0.949999988079071 } ], "ln": 2775 }, { "b": "wNx4\u0026z/5\u003c5BAh8kx8(pCB97\u00262yHpN+yHpWZx(0=\u0026vr3c\u003eB7GD2w].D]BA}?puUi.RwDkh0uS7DEwPv", "n": [ { "c": 3, "d": "Stack protector/canary enabled", "i": "metadata/hardening/build::stack-protector", "o": 3284, "z": 14, "cf": 0.8999999761581421 } ], "ln": 3268 }, { "b": "y?Wu\u003cA+O#%wn9Vqz.rZzy?Wu*e]$}-f!@-owO#2Uy?Wv0vr3cpB8JV+055FoAXzxExd[7nvG", "n": [ { "c": 3, "d": "Network-capable library profile", "i": "objectives/supply-chain/trojanized/backdoor::network-library-profile", "o": 4255, "z": 9, "cf": 0.8999999761581421 } ], "ln": 4239 }, { "b": "fFUBsfFCEnatCM5h7*M.bU?])lq{okay/Clx!AsnB%5H(f^5k9f!+mmi4(%AatC\u0026pfFLQAh6uTLwPzAamr\u0026+]bMG8+wPQmql](D2A=+=4xk8loq.i8mf!Lj7gb7BpfekgmgCx}ai65\u0026OiYe]uyhWW7xcoS/A3czabU?])lq{okay/ClwO#3hq.i8mf!Lg6gb7BpfebvsfGgaei65-FiX@PnyhWW7xcoS/A3czabU?])lq{okay/Clzz1\u003csB%5H(f^5k9f!+mmi4(%AatC\u0026pfFLQAh6uTLwPzAamr\u0026+]bME\u0026m=Jj7D00000000000000800008000080000800", "n": [ { "c": 2, "d": "NetBSD base system artifact", "i": "metadata/binary/provenance::netbsd-base-system-artifact", "o": 25005, "z": 8, "cf": 0.949999988079071 } ], "ln": 24989 }, { "b": "e]$YEBAhFivGn2]vrl8Ze[xlBB9RQ5e[xlBB98B5e]\u003eJtvj(8ozu8qfwO+^cAboQ@e[]iqBo0}jy\u0026?o", "n": [ { "c": 2, "d": "ELF dynstr section name", "i": "metadata/binary/linking/static::elf-dynstr-section-name", "o": 30412, "z": 7, "cf": 0.8999999761581421 }, { "c": 2, "d": "ELF dynsym section name", "i": "metadata/binary/linking/static::elf-dynsym-section-name", "o": 30404, "z": 7, "cf": 0.8999999761581421 } ], "ln": 30388 }, { "b": "v@.M4wmoN*e]\u003eJte]\u003e\u003ege[xlBvqPZ*04}]5Bs}JGBo0}7vrt]Te[e)y04}=1zeA\u003c4Bo0{(", "n": [ { "c": 2, "d": "ELF dynamic section name", "i": "metadata/binary/linking/static::elf-dynamic-section-name", "o": 30567, "z": 8, "cf": 0.8999999761581421 } ], "ln": 30551 } ], "depth": 1, "facts": { "exp": [ [ "raqm_set_text_utf8" ], [ "raqm_get_par_resolved_direction" ], [ "raqm_index_to_position" ], [ "raqm_set_freetype_face" ], [ "raqm_set_freetype_load_flags" ], [ "raqm_destroy" ], [ "raqm_layout" ], [ "raqm_set_text_utf16" ], [ "raqm_version_string" ], [ "raqm_set_freetype_load_flags_range" ], [ "raqm_version_atleast" ], [ "raqm_set_letter_spacing_range" ], [ "raqm_position_to_index" ], [ "raqm_reference" ], [ "raqm_set_invisible_glyph" ], [ "raqm_set_text" ], [ "raqm_get_glyphs" ], [ "raqm_clear_contents" ], [ "raqm_set_freetype_face_range" ], [ "raqm_set_par_direction" ], [ "raqm_set_language" ], [ "raqm_add_font_feature" ], [ "raqm_get_direction_at_index" ], [ "raqm_create" ], [ "raqm_version" ], [ "raqm_set_word_spacing_range" ] ], "imp": [ [ "", "hb_buffer_reset" ], [ "", "free" ], [ "", "register_frame_info" ], [ "", "hb_buffer_add_utf32" ], [ "", "fribidi_get_par_embedding_levels_ex" ], [ "", "hb_buffer_get_glyph_positions" ], [ "", "cxa_finalize" ], [ "", "hb_shape_full" ], [ "", "hb_buffer_destroy" ], [ "", "stack_chk_fail" ], [ "", "fribidi_get_bracket_types" ], [ "", "hb_feature_from_string" ], [ "", "hb_buffer_set_flags" ], [ "", "hb_buffer_set_script" ], [ "", "hb_unicode_funcs_get_default" ], [ "", "FT_Get_Transform" ], [ "", "hb_buffer_set_language" ], [ "", "hb_ft_font_set_load_flags" ], [ "", "hb_buffer_set_direction" ], [ "", "fribidi_get_bidi_types" ], [ "", "deregister_frame_info" ], [ "", "malloc" ], [ "", "Jv_RegisterClasses" ], [ "", "calloc" ], [ "", "hb_language_get_default" ], [ "", "memcpy" ], [ "", "assert13" ], [ "", "FT_Reference_Face" ], [ "", "hb_tag_from_string" ], [ "", "FT_Vector_Transform" ], [ "", "hb_buffer_set_invisible_glyph" ], [ "", "hb_ft_font_get_ft_face" ], [ "", "hb_language_from_string" ], [ "", "hb_buffer_get_length" ], [ "", "hb_unicode_general_category" ], [ "", "hb_font_destroy" ], [ "", "stack_chk_guard" ], [ "", "realloc" ], [ "", "hb_unicode_script" ], [ "", "hb_buffer_get_glyph_infos" ], [ "", "hb_ft_font_create_referenced" ], [ "", "FT_Done_Face" ], [ "", "hb_buffer_create" ] ], "sec": [ [ ".hash", 456, 568, 1.36, "alloc" ], [ ".dynsym", 1024, 1752, 1.72, "alloc" ], [ ".dynstr", 2776, 1521, 4.46, "alloc" ], [ ".rela.dyn", 4304, 264, 1.7, "alloc" ], [ ".rela.plt", 4568, 912, 1.62, "alloc,info_link" ], [ ".init", 5488, 14, 3.24, "alloc,executable" ], [ ".plt", 5504, 624, 4.06, "alloc,executable" ], [ ".plt.got", 6128, 32, 3.0, "alloc,executable" ], [ ".text", 6160, 11496, 6.33, "alloc,executable" ], [ ".fini", 17664, 14, 3.24, "alloc,executable" ], [ ".rodata", 17696, 378, 3.87, "alloc" ], [ ".eh_frame_hdr", 18076, 284, 4.54, "alloc" ], [ ".eh_frame", 18360, 1532, 5.14, "alloc" ], [ ".note.netbsd.ident", 19892, 24, 3.0, "alloc" ], [ ".note.netbsd.pax", 19916, 20, 1.56, "alloc" ], [ ".ctors", 24024, 16, 1.0, "write,alloc" ], [ ".dtors", 24040, 16, 1.0, "write,alloc" ], [ ".jcr", 24056, 8, 0.0, "write,alloc" ], [ ".data.rel.ro", 24064, 40, 1.35, "write,alloc" ], [ ".dynamic", 24104, 416, 1.31, "write,alloc" ], [ ".got", 24520, 40, 0.0, "write,alloc" ], [ ".got.plt", 24576, 328, 1.71, "write,alloc" ], [ ".data", 24904, 74, 0.31, "write,alloc" ], [ ".comment", 24978, 27, 3.78, "merge,strings" ], [ ".ident", 25005, 222, 4.7, "merge,strings" ], [ ".SUNW_ctf", 25228, 143, 2.89, "" ], [ ".symtab", 25376, 3072, 1.93, "" ], [ ".strtab", 28448, 1923, 4.69, "" ], [ ".shstrtab", 30371, 244, 4.16, "" ] ], "metrics": { "elf": { "bits": 64.0, "entry": 6160.0, "has_got": 1.0, "has_plt": 1.0, "has_note": 1.0, "has_rpath": 1.0, "relacount": 6.0, "has_symtab": 1.0, "note_count": 2.0, "nx_enabled": 1.0, "dynrel_count": 0.0, "dynsym_count": 73.0, "has_eh_frame": 1.0, "stack_canary": 1.0, "symtab_count": 128.0, "dynrela_count": 11.0, "little_endian": 1.0, "pltreloc_count": 38.0, "executable_stack": 0.0, "wx_segment_count": 0.0, "comment_entry_count": 1.0, "program_header_count": 7.0, "comment_distinct_count": 1.0, "gnu_stack_section_absent": 1.0, "load_segment_max_file_size": 19936.0, "stripped_but_symtab_present": 1.0, "load_segment_max_memory_size": 19936.0, "section_relocation_group_count": 2.0, "stripped_metadata_section_count": 5.0 }, "file": { "size": 32600.0, "entropy": 4.85, "size_bytes": 32600.0 }, "binary": { "is_pie": 0.0, "has_overlay": 1.0, "is_stripped": 0.0, "code_entropy": 6.2, "data_entropy": 1.29, "overlay_size": 1985.0, "string_count": 146.0, "overlay_ratio": 0.06, "overall_entropy": 4.85, "overlay_entropy": 1.42, "entropy_variance": 2.71, "avg_string_length": 16.86, "max_string_length": 57.0, "peak_region_bytes": 10240.0, "code_to_data_ratio": 0.93, "peak_region_entropy": 6.2, "string_length_stddev": 10.01, "largest_section_ratio": 0.35, "sentence_string_count": 6.0, "sentence_string_ratio": 0.04, "high_entropy_string_count": 0.0 }, "exports": { "count": 26.0 }, "imports": { "count": 43.0 }, "sections": { "count": 31.0, "code_size": 12180.0, "entropy_max": 6.33, "entropy_mean": 2.68, "name_entropy": 4.11, "writable_count": 9.0, "executable_count": 5.0, "nonstandard_count": 8.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 4.0 } } }, "id": 1, "mol": "Md(He)", "path": "raqm-0.10.4.tgz!!lib/libraqm.so.0.10.4", "risk": 2, "sha": "646aad5737abc11b33ea25b79c682c31be9846e9db9b483b01745576e94beea1", "size": 32600, "traits": [ { "id": "micro-behaviors/dylib/library/libc::libc-characteristic-cxa-finalize", "crit": 2, "desc": "libc characteristic cxa finalize", "spans": [ [ 2791, 12 ] ] }, { "id": "metadata/hardening/mitigation::rpath-set", "conf": 0.699999988079071, "crit": 3, "desc": "RPATH/RUNPATH dynamic library path set", "spans": [ [ 0, 20 ] ] }, { "id": "metadata/build/artifact::elf-stripped-but-symtab-present", "conf": 0.6000000238418579, "crit": 3, "desc": "ELF stripped with .symtab present", "spans": [ [ 0, 38 ] ] }, { "id": "micro-behaviors/dylib/library/libc::libc-internal-functions-b", "conf": 0.699999988079071, "crit": 2, "desc": "libc internal symbols cluster B", "spans": [ [ 2791, 12 ] ] }, { "id": "micro-behaviors/dylib/library/abi-graphics::cxx-abi-symbols-a", "conf": 0.800000011920929, "crit": 2, "desc": "C++ ABI symbols cluster A", "spans": [ [ 2791, 12 ] ] } ], "type": "elf" }, { "depth": 1, "facts": { "imp": [ [ "", "raqm_get_glyphs" ], [ "", "raqm_get_par_resolved_direction" ], [ "", "\u003cft2build.h\u003e" ], [ "", "\u003cstdbool.h\u003e" ], [ "", "\u003cstdint.h\u003e" ], [ "", "config.h" ], [ "", "raqm-version.h" ] ], "tgt": [ "raqm_get_glyphs", "raqm_get_par_resolved_direction" ], "metrics": { "ast": { "op.mul": 4, "max_depth": 11, "call_count": 2, "node_count": 733, "op_density.mul": 0.01 }, "file": { "size": 5990, "entropy": 4.75 }, "text": { "lines": 220, "top_char": 116, "max_ws_run": 10, "digit_ratio": 0.01, "space_count": 1614, "char_entropy": 4.75, "unique_chars": 78, "top_char_null": 0, "string_density": 0.01, "top_char_ratio": 0.05, "avg_line_length": 26.23, "max_line_length": 84, "non_ascii_ratio": 0, "empty_line_ratio": 0.16, "last_line_length": 21, "whitespace_ratio": 0.31, "identifier_density": 0.88, "line_length_stddev": 22.61, "normalized_string_count": 0.2, "repeated_char_sequences": 41, "suspicious_comment_ratio": 0.4, "suspicious_identifier_ratio": 0.03, "normalized_unique_identifiers": 8.87 }, "binary": { "peak_region_bytes": 3072, "peak_region_entropy": 5.32 }, "source": { "class_count": 2 }, "imports": { "count": 5, "third_party_count": 5, "third_party_ratio": 1 }, "strings": { "bytes": 23, "count": 3, "avg_length": 7.67, "max_length": 14, "avg_entropy": 2.22, "entropy_stddev": 1.59 }, "comments": { "chars": 2288, "count": 5, "lines": 56, "high_entropy": 2, "to_code_ratio": 0.34 }, "functions": { "count": 2 }, "identifiers": { "count": 193, "unique": 69, "avg_length": 12.51, "max_length": 34, "min_length": 1, "avg_entropy": 2.81, "reuse_ratio": 0.36, "length_stddev": 8.39, "has_digit_ratio": 0.03, "sequential_names": 2, "single_char_count": 2, "single_char_ratio": 0.03, "high_entropy_count": 18, "high_entropy_ratio": 0.26, "all_lowercase_ratio": 0.83, "all_uppercase_ratio": 0.13, "numeric_suffix_count": 2, "underscore_prefix_count": 4 } } }, "id": 2, "path": "raqm-0.10.4.tgz!!include/raqm.h", "pid": 3074, "risk": 1, "sha": "eb1acbb11ae82ff93da2f8313ea78ef1611c83f18c9d2cc95ae89fc80d87e288", "size": 5990, "traits": [ { "id": "metadata/import/c/ft2build/h::ft2build/h", "conf": 0.95, "crit": 2, "desc": "imports \u003cft2build.h\u003e" }, { "id": "metadata/import/c/stdbool/h::stdbool/h", "conf": 0.95, "crit": 2, "desc": "imports \u003cstdbool.h\u003e" }, { "id": "metadata/import/c/stdint/h::stdint/h", "conf": 0.95, "crit": 2, "desc": "imports \u003cstdint.h\u003e" }, { "id": "metadata/import/c/config/h::config/h", "conf": 0.95, "crit": 2, "desc": "imports config.h" }, { "id": "metadata/import/c/raqm-version/h::raqm-version/h", "conf": 0.95, "crit": 2, "desc": "imports raqm-version.h" }, { "id": "metadata/file/comment::source-comment-bytes-over-300", "conf": 0.92, "crit": 2, "desc": "Source has over 300 comment bytes" }, { "id": "metadata/file/extension/identity::c-family-header-basename", "conf": 1.0, "crit": 2, "desc": "C-family header file basename" }, { "id": "metadata/lang/natural::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"" }, { "id": "metadata/lang/natural::lang-english--atom-2", "conf": 0.8, "crit": 1, "desc": "English function-word token \"and\"" }, { "id": "metadata/lang/natural::lang-english--atom-3", "conf": 0.8, "crit": 1, "desc": "English function-word token \"that\"" }, { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"" }, { "id": "metadata/lang/natural::lang-english--atom-6", "conf": 0.8, "crit": 1, "desc": "English function-word token \"with\"" }, { "id": "metadata/lang/natural::lang-english--atom-7", "conf": 0.8, "crit": 1, "desc": "English function-word token \"this\"" }, { "id": "micro-behaviors/data/source/syntax/directive::c-include-directive", "conf": 0.8, "crit": 2, "desc": "C-family include directive" }, { "id": "metadata/lang/natural::lang-english", "conf": 0.8, "crit": 2, "desc": "Contains common English function words", "uses": [ 7, 8, 9, 10, 11, 12 ] } ], "type": "c" }, { "ctx": [ { "b": "asXH3z/x#xx\u003eIa3aI$92gb7BqarTf)z!A($efEJ4v\u003eE", "ln": 2, "addr": 3 }, { "b": "asW", "ln": 3, "addr": 38 }, { "b": "asXGRra]#!azC)tAa9^eaA7\u003cmnmuKJluNQ2efFvzBy/YsaAIj8Aa%i5az++3A::0le=", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 45, "z": 4, "cf": 0.800000011920929 } ], "ln": 4, "addr": 41 }, { "b": "asW", "ln": 5, "addr": 95 }, { "b": "asXHgwPzT4B8#5lzxJUmazttbwNY{cxl4A#By!#laA}KwxM53naA}\u003cuBAz8iayO]6wO2Z\u0026zGE1fzE:(lx([3bB-W", "ln": 6, "addr": 98 } ], "depth": 1, "facts": { "metrics": { "ast": { "max_depth": 4.0, "call_count": 0.0, "node_count": 45.0, "identifier_count": 10.0 }, "file": { "size": 1542.0, "entropy": 5.35, "size_bytes": 1542.0 }, "text": { "tab_count": 2.0, "digit_ratio": 0.02, "space_count": 205.0, "total_lines": 44.0, "char_entropy": 5.35, "mixed_indent": 1.0, "unique_chars": 72.0, "avg_line_length": 34.05, "high_byte_ratio": 0.0, "max_line_length": 73.0, "non_ascii_ratio": 0.0, "empty_line_ratio": 0.14, "last_line_length": 29.0, "whitespace_ratio": 0.16, "most_common_ratio": 0.04, "identifier_density": 0.25, "line_length_stddev": 27.91, "most_common_char_is_null": 0.0, "suspicious_comment_ratio": 0.5, "max_inline_whitespace_run": 2.0, "most_common_char_codepoint": 73.0, "normalized_unique_identifiers": 1.83 }, "binary": { "overall_entropy": 5.35, "peak_region_bytes": 1542.0, "peak_region_entropy": 5.27 }, "comments": { "chars": 1121.0, "lines": 26.0, "total": 2.0, "to_code_ratio": 1.44, "high_entropy_comments": 1.0 }, "identifiers": { "count": 10.0, "total": 11.0, "avg_length": 13.5, "max_length": 20.0, "min_length": 5.0, "avg_entropy": 3.05, "reuse_ratio": 0.91, "unique_count": 10.0, "length_stddev": 6.02, "high_entropy_count": 2.0, "high_entropy_ratio": 0.2, "all_lowercase_ratio": 0.3, "all_uppercase_ratio": 0.7, "underscore_prefix_count": 2.0 } } }, "id": 3, "path": "raqm-0.10.4.tgz!!include/raqm-version.h", "risk": 1, "sha": "e0dcb887ef6668ea573c1243332eb429eec3469195e697f6361ff8dc07fed0de", "size": 1542, "traits": [ { "id": "metadata/file/profile/language::lang-english", "conf": 0.800000011920929, "crit": 2, "desc": "English language detection", "spans": [ [ 45, 4 ] ] } ], "type": "c" } ], "v": "8" } }