{ "ml": { "v": "7", "eng": "2.2.0-beta.2", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.7417921, "rte": "az", "prob": 0.7417921 }, { "cls": 0, "raw": 0.00010165572, "rte": "az/tar", "prob": 0.00010165572 } ], "prob": 0.7417921, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.7417920827865601, "type": "apk_alpine" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.37116989493370056, "type": "elf" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.291656494140625, "type": "json" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.5031681656837463, "type": "text" } ], "version": "v18.18", "analyzed_at": "2026-07-03T11:46:02Z" }, "path": "libcxxabi1-18-18.1.8-r24.apk", "raw": { "files": [ { "id": 0, "ctx": [ { "b": "abZy8010L00rqA0}f7J5K#N\u003c?WvWJBr:QaUSkRyHcg77IVyCPiMvg28Y^ge+c\u003e.=%RBSQp", "n": [ { "c": 2, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "o": 0, "z": 1, "cf": 1.0 } ], "ln": 0 } ], "mol": "O(Er)", "sha": "0335ebe41c5d6f656f102917b32bcb918f561b8959e3232b2adb3a3abae85edc", "path": "/data/samples/good/foraged/wolfi/wolfi.dev/_/libcxxabi1-18/libcxxabi1-18-18.1.8-r24.apk", "risk": 2, "size": 133248, "type": "apk_alpine", "facts": { "metrics": { "file": { "size": 133248.0, "entropy": 7.99, "size_bytes": 133248.0 }, "parse": { "error_count": 1.0 }, "binary": { "overall_entropy": 7.99, "peak_region_bytes": 133120.0, "peak_region_entropy": 7.83 } } }, "traits": [ { "id": "micro-behaviors/dylib/library/libc::libc-internal-functions-b", "conf": 0.699999988079071, "crit": 2, "desc": "libc internal symbols cluster B", "from": [ { "file": 1 } ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-package-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package name field", "from": [ { "file": 3 } ] }, { "id": "metadata/package/files/system-package::spdx-document-version", "conf": 0.8999999761581421, "crit": 1, "desc": "SPDX document version field" }, { "id": "metadata/build/artifact::elf-stripped-but-symtab-present", "conf": 0.6000000238418579, "crit": 3, "desc": "ELF stripped with .symtab present", "from": [ { "file": 1 } ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-version-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package version field", "from": [ { "file": 3 } ] }, { "id": "metadata/package/files/system-package::spdx-document-id", "conf": 0.8999999761581421, "crit": 1, "desc": "SPDX document identifier" }, { "id": "metadata/package/files/system-package::alpine-pkginfo-origin-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package origin field", "from": [ { "file": 3 } ] }, { "id": "metadata/package/files/system-package::spdx-sbom-document", "conf": 0.9800000190734863, "crit": 2, "desc": "SPDX SBOM document", "from": [ { "file": 2 } ] }, { "id": "metadata/package/files/system-package::spdx-melange-creator", "conf": 0.8999999761581421, "crit": 1, "desc": "Melange SPDX creator", "from": [ { "file": 2 } ] }, { "id": "metadata/package/files/system-package::melange-pkginfo-generator", "conf": 0.8999999761581421, "crit": 1, "desc": "Melange-generated package metadata", "from": [ { "file": 3 } ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-basename", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package info file" }, { "id": "metadata/package/files/system-package::alpine-apk-pkginfo", "conf": 0.9700000286102295, "crit": 2, "desc": "Alpine/Wolfi package info metadata", "from": [ { "off": 95, "file": 3, "line": 6 } ] }, { "id": "metadata/package/files/system-package::wolfi-pkginfo-maintainer", "conf": 0.8999999761581421, "crit": 1, "desc": "Wolfi package maintainer field", "from": [ { "file": 3 } ] }, { "id": "metadata/package/files/system-package::spdx-melange-namespace", "conf": 0.8999999761581421, "crit": 1, "desc": "Melange SPDX document namespace" }, { "id": "micro-behaviors/dylib/library/libc::libc-characteristic-cxa-finalize", "crit": 2, "desc": "libc characteristic cxa finalize", "from": [ { "file": 1 } ] }, { "id": "metadata/package/files/system-package::spdx-apk-pkginfo-source", "conf": 0.8999999761581421, "crit": 1, "desc": "SPDX references APK DB package info", "from": [ { "file": 2 } ] }, { "id": "objectives/evasion/process/injection/memory::asm-manual-import-parsing-cond-2--inline-18287", "conf": 0.8999999761581421, "crit": 3, "desc": "High export-count binary context", "from": [ { "file": 1 } ] }, { "id": "metadata/package/files/system-package::spdx-wolfi-apk-purl", "conf": 0.8999999761581421, "crit": 1, "desc": "Wolfi APK package URL in SPDX", "from": [ { "file": 2 } ] } ] }, { "ctx": [ { "b": "E))420S-r400000000000@$H+0rr910000000000kMy=:00000kM.h\u003c0000000000kMA+z3JJA(aPJR+0rr911on", "n": [ { "c": 3, "d": "Patterns associated with legitimate injectors to reduce FPs", "i": "objectives/evasion/process/injection/toolkit::legitimate-injector-patterns", "o": 0, "z": 22, "cf": 1.0 } ], "ln": 0 }, { "b": "A-t+2y\u0026si5raflLwDl7Av%zA?w[=c\u003ey?Xib0af8yCWT@*vpS.PvrlI\u003cuTEq/vp9CVy\u0026r/(By!/\u003c", "n": [ { "c": 2, "d": "C++ ABI symbols cluster A", "i": "micro-behaviors/dylib/library/abi-graphics::cxx-abi-symbols-a", "o": 15288, "z": 12, "cf": 0.800000011920929 } ], "ln": 15272 }, { "b": "rC)1{zE^9LwPJ0hwDl7AB97\u00262yHpN+yHpWZx(0=Rt2PJ6By/Gfx(mv3wP!5Xt2PI$g\u0026)kIuV*l$CYi", "n": [ { "c": 3, "d": "Stack protector/canary enabled", "i": "metadata/hardening/build::stack-protector", "o": 15685, "z": 14, "cf": 0.8999999761581421 } ], "ln": 15669 }, { "b": "x(n38uT)++0ae]er.+w6uTEq/CWU5}B$\u003eZguTEqVvrlG%BA}?puUKy\u0026z::Ukt2XJ$f!=%wv%v", "n": [ { "c": 3, "d": "Network-capable library profile", "i": "objectives/supply-chain/trojanized/backdoor::network-library-profile", "o": 16022, "z": 10, "cf": 0.8999999761581421 } ], "ln": 16006 }, { "b": "vrlI\u003cuTEq/vp9U\u0026vrb)=vpBd}Bo2VKq/\u003c-JxjVf(B-7=nAaJK3wN]@:uS{xIf!^-/wD", "n": [ { "c": 2, "d": "Abort program execution", "i": "micro-behaviors/os/signal/handler::abort", "o": 16325, "z": 5, "cf": 0.8999999761581421 } ], "ln": 16309 }, { "b": "B8$YgD2Nt4x(mK3mf3X4vrlH3A=+V2vqfJTuTEt?zEEx@v{-.OB94y?t2X6*f!=%wv%AlbvRG#", "n": [ { "c": 2, "d": "Characteristic libc export __assert_fail", "i": "micro-behaviors/dylib/library/libc::libc-characteristic-assert-fail", "o": 19085, "z": 11, "cf": 0.5 } ], "ln": 19069 }, { "b": "0bMvUB-8zqzE+wvz.r:Ay?Wu*d\u003et4qx!BEBe?)t@oI4MruOTk\u002607PZOlpk9ne?]l:m[=GvlTIP3f/e(2oI4MruOTk\u003c07PZOlpg", "n": [ { "c": 2, "d": "libc version string pattern", "i": "micro-behaviors/dylib/library/libc::libc-version-string", "o": 22374, "z": 5, "cf": 0.800000011920929 }, { "c": 2, "d": "LLVM libc++ stdlib", "i": "micro-behaviors/dylib/library/libc::libcxx-ref", "o": 22349, "z": 9, "cf": 0.8999999761581421 } ], "ln": 22333 }, { "b": "wOtB-y\u0026r=\u003ey\u0026YO$ByWA[uTER-vQ\u003cv@uVZa9uVP!2azb4@y\u0026%=fazCZouTEq/vp9UUByeV%zV", "n": [ { "c": 2, "d": "LLVM libc++ stdlib", "i": "micro-behaviors/dylib/library/libc::libcxx-ref", "o": 221585, "z": 9, "cf": 0.8999999761581421 } ], "ln": 221569 }, { "b": "fEXb0g+HNpfAtf)y?vx7v@bN\u003excqweA=U@kzxHU[e?[$r0c03[A+eV\u00260000000000000000000000", "n": [ { "c": 3, "d": "Terminal socket exec helper context", "i": "micro-behaviors/process/fd/dup::unix-terminal-socket-exec-benign-context", "o": 282701, "z": 13, "cf": 0.949999988079071 } ], "ln": 282685 }, { "b": "y?bbiwb[k{zGNNBvrl8Ze[xlBB9RQ5e[xlBB98B5e[Y6Ae{p/DB7]Mg04}]4BUm\u0026GA=U@kzEmz:e]\u003eI", "n": [ { "c": 2, "d": "ELF dynstr section name", "i": "metadata/binary/linking/static::elf-dynstr-section-name", "o": 393791, "z": 7, "cf": 0.8999999761581421 }, { "c": 2, "d": "ELF dynsym section name", "i": "metadata/binary/linking/static::elf-dynsym-section-name", "o": 393783, "z": 7, "cf": 0.8999999761581421 } ], "ln": 393767 }, { "b": "vr?\u00269wmoN*e]\u003eJte]\u003e\u003ege[xlBvqPZ*04}!\u003cByte4vSMO\u003ce[n*pzdNQb04}![Abok$A@Vgu", "n": [ { "c": 2, "d": "ELF dynamic section name", "i": "metadata/binary/linking/static::elf-dynamic-section-name", "o": 394005, "z": 8, "cf": 0.8999999761581421 } ], "ln": 393989 } ], "depth": 1, "facts": { "exp": [ [ "cxa_guard_release" ], [ "ZSt10unexpectedv" ], [ "ZNKSt10bad_typeid4whatEv" ], [ "ZdlPvSt11align_val_tRKSt9nothrow_t" ], [ "cxa_pure_virtual" ], [ "ZTVSt9type_info" ], [ "ZTVSt20bad_array_new_length" ], [ "ZTSSt9bad_alloc" ], [ "ZdaPv" ], [ "ZTVSt15underflow_error" ], [ "ZTIN10__cxxabiv120__function_type_infoE" ], [ "ZNSt16invalid_argumentD1Ev" ], [ "ZTIN10__cxxabiv117__pbase_type_infoE" ], [ "cxa_end_catch" ], [ "cxa_free_dependent_exception" ], [ "ZTSN10__cxxabiv120__si_class_type_infoE" ], [ "ZnwmSt11align_val_t" ], [ "ZNSt10bad_typeidC1Ev" ], [ "ZTIN10__cxxabiv123__fundamental_type_infoE" ], [ "ZNSt15underflow_errorD2Ev" ], [ "ZNSt10bad_typeidD1Ev" ], [ "ZNKSt13bad_exception4whatEv" ], [ "ZNSt12length_errorD1Ev" ], [ "ZdaPvmSt11align_val_t" ], [ "ZTSSt12length_error" ], [ "ZTVSt16invalid_argument" ], [ "ZSt15set_new_handlerPFvvE" ], [ "ZNSt15underflow_errorD0Ev" ], [ "ZTVSt13bad_exception" ], [ "ZTVSt8bad_cast" ], [ "ZTSSt15underflow_error" ], [ "ZTVSt9bad_alloc" ], [ "ZTISt13bad_exception" ], [ "ZNSt12domain_errorD2Ev" ], [ "ZTSN10__cxxabiv117__class_type_infoE" ], [ "ZTSPDh" ], [ "ZTSPDi" ], [ "ZTSPDn" ], [ "ZSt13set_terminatePFvvE" ], [ "ZNSt11logic_errorD1Ev" ], [ "ZTSPDs" ], [ "ZTSPDu" ], [ "ZNSt12domain_errorD0Ev" ], [ "ZNSt9type_infoD1Ev" ], [ "ZTVN10__cxxabiv123__fundamental_type_infoE" ], [ "ZTIPKa" ], [ "ZTIPKb" ], [ "ZTIPKc" ], [ "ZdlPvSt11align_val_t" ], [ "ZTIPKd" ], [ "ZTIPKe" ], [ "ZTIPKf" ], [ "ZTIPKg" ], [ "ZTIPKh" ], [ "ZTIPKi" ], [ "ZTIPKj" ], [ "ZdaPvm" ], [ "ZTIPKl" ], [ "ZTIPKm" ], [ "ZTIPKn" ], [ "ZTIPKo" ], [ "ZTSN10__cxxabiv117__pbase_type_infoE" ], [ "ZTIPKs" ], [ "ZTIPKt" ], [ "ZTIPKv" ], [ "ZTSN10__cxxabiv129__pointer_to_member_type_infoE" ], [ "ZTIPKw" ], [ "ZTIPKx" ], [ "ZTIPKy" ], [ "cxa_rethrow_primary_exception" ], [ "ZTVSt12out_of_range" ], [ "cxa_rethrow" ], [ "ZTISt14overflow_error" ], [ "ZTSDh" ], [ "ZTSDi" ], [ "ZTVN10__cxxabiv116__enum_type_infoE" ], [ "ZTISt9exception" ], [ "ZTSDn" ], [ "ZTISt12out_of_range" ], [ "ZNSt14overflow_errorD1Ev" ], [ "ZTSDs" ], [ "ZTSDu" ], [ "ZSt9terminatev" ], [ "cxa_vec_ctor" ], [ "ZTIa" ], [ "ZTIb" ], [ "ZTIc" ], [ "ZTId" ], [ "ZTIe" ], [ "ZTIf" ], [ "ZTIg" ], [ "ZTIh" ], [ "ZTIi" ], [ "ZTIj" ], [ "ZTSN10__cxxabiv120__function_type_infoE" ], [ "ZTIl" ], [ "ZTIm" ], [ "ZTIn" ], [ "ZTIo" ], [ "cxa_terminate_handler" ], [ "cxa_current_exception_type" ], [ "ZTIs" ], [ "ZTIt" ], [ "cxa_vec_dtor" ], [ "ZTIv" ], [ "ZTIw" ], [ "ZTIx" ], [ "ZTIy" ], [ "ZTIN10__cxxabiv119__pointer_type_infoE" ], [ "ZTISt11logic_error" ], [ "ZNSt13runtime_errorD1Ev" ], [ "ZnamRKSt9nothrow_t" ], [ "ZNSt13bad_exceptionD2Ev" ], [ "cxa_call_unexpected" ], [ "ZTSSt9exception" ], [ "cxa_deleted_virtual" ], [ "ZdaPvSt11align_val_tRKSt9nothrow_t" ], [ "cxa_vec_cleanup" ], [ "ZNSt13bad_exceptionD0Ev" ], [ "ZNKSt20bad_array_new_length4whatEv" ], [ "cxa_free_exception" ], [ "ZNKSt8bad_cast4whatEv" ], [ "cxa_uncaught_exception" ], [ "ZTVN10__cxxabiv116__shim_type_infoE" ], [ "ZdlPv" ], [ "ZnwmRKSt9nothrow_t" ], [ "ZTIDh" ], [ "ZNSt9bad_allocC1Ev" ], [ "ZTIDi" ], [ "ZNKSt9exception4whatEv" ], [ "ZTSSt12out_of_range" ], [ "ZNSt11range_errorD2Ev" ], [ "ZTIDn" ], [ "ZTIN10__cxxabiv121__vmi_class_type_infoE" ], [ "ZTIDs" ], [ "ZTIDu" ], [ "ZTVN10__cxxabiv117__array_type_infoE" ], [ "cxa_vec_delete2" ], [ "cxa_vec_delete3" ], [ "ZNSt9bad_allocD1Ev" ], [ "ZNSt11range_errorD0Ev" ], [ "cxa_throw" ], [ "cxa_get_globals" ], [ "ZTVN10__cxxabiv129__pointer_to_member_type_infoE" ], [ "cxa_vec_cctor" ], [ "ZNSt9exceptionD1Ev" ], [ "ZNSt20bad_array_new_lengthC2Ev" ], [ "ZTVSt9exception" ], [ "ZTSSt13bad_exception" ], [ "ZTSSt10bad_typeid" ], [ "ZNSt12out_of_rangeD2Ev" ], [ "ZNSt8bad_castC1Ev" ], [ "cxa_allocate_exception" ], [ "ZdlPvmSt11align_val_t" ], [ "ZTVSt11range_error" ], [ "ZTSPKa" ], [ "ZTSPKb" ], [ "ZNSt20bad_array_new_lengthD2Ev" ], [ "ZTSPKc" ], [ "ZTSPKd" ], [ "ZTSPKe" ], [ "ZTSPKf" ], [ "ZTSPKg" ], [ "ZTSPKh" ], [ "ZTSPKi" ], [ "ZTSPKj" ], [ "ZTSPKl" ], [ "ZNSt8bad_castD1Ev" ], [ "ZNSt12out_of_rangeD0Ev" ], [ "ZTSPKm" ], [ "ZTSPKn" ], [ "ZTSPKo" ], [ "cxa_begin_catch" ], [ "ZTSPKs" ], [ "ZTSPKt" ], [ "ZTSPKv" ], [ "ZTISt15underflow_error" ], [ "ZTSPKw" ], [ "ZTSPKx" ], [ "ZNSt20bad_array_new_lengthD0Ev" ], [ "ZTSPKy" ], [ "cxa_vec_new" ], [ "ZTISt10bad_typeid" ], [ "ZSt13get_terminatev" ], [ "ZdlPvm" ], [ "ZTSSt16invalid_argument" ], [ "ZTVSt13runtime_error" ], [ "ZNSt16invalid_argumentD2Ev" ], [ "ZTVSt10bad_typeid" ], [ "cxa_init_primary_exception" ], [ "ZdlPvRKSt9nothrow_t" ], [ "cxa_vec_new2" ], [ "ZTISt13runtime_error" ], [ "cxa_vec_new3" ], [ "ZSt15get_new_handlerv" ], [ "cxa_current_primary_exception" ], [ "ZNSt16invalid_argumentD0Ev" ], [ "cxa_vec_delete" ], [ "ZTIN10__cxxabiv117__array_type_infoE" ], [ "ZTIN10__cxxabiv116__enum_type_infoE" ], [ "ZNSt10bad_typeidC2Ev" ], [ "cxa_increment_exception_refcount" ], [ "ZTVN10__cxxabiv119__pointer_type_infoE" ], [ "cxa_decrement_exception_refcount" ], [ "cxa_throw_bad_array_new_length" ], [ "ZTSSt11range_error" ], [ "ZNKSt11logic_error4whatEv" ], [ "ZTVSt12domain_error" ], [ "ZNSt10bad_typeidD2Ev" ], [ "ZNSt12length_errorD2Ev" ], [ "ZnamSt11align_val_t" ], [ "ZNSt15underflow_errorD1Ev" ], [ "cxa_unexpected_handler" ], [ "ZNSt10bad_typeidD0Ev" ], [ "cxa_uncaught_exceptions" ], [ "cxa_thread_atexit" ], [ "ZNSt12length_errorD0Ev" ], [ "ZTISt12domain_error" ], [ "ZTSSt8bad_cast" ], [ "ZNSt11logic_errorD2Ev" ], [ "cxa_get_exception_ptr" ], [ "ZnamSt11align_val_tRKSt9nothrow_t" ], [ "ZNSt12domain_errorD1Ev" ], [ "ZNSt9type_infoD2Ev" ], [ "ZdaPvSt11align_val_t" ], [ "ZNKSt13runtime_error4whatEv" ], [ "cxa_get_globals_fast" ], [ "cxa_guard_abort" ], [ "ZNSt11logic_errorD0Ev" ], [ "cxa_allocate_dependent_exception" ], [ "ZTIN10__cxxabiv116__shim_type_infoE" ], [ "ZNSt9type_infoD0Ev" ], [ "ZTVSt14overflow_error" ], [ "ZTIPKDh" ], [ "ZTIPKDi" ], [ "ZTSa" ], [ "ZTSb" ], [ "ZTSPKDh" ], [ "ZTSc" ], [ "ZTSd" ], [ "ZTSPKDi" ], [ "ZTSe" ], [ "ZTSf" ], [ "ZTIPKDn" ], [ "ZTSg" ], [ "ZTSh" ], [ "ZTSPKDn" ], [ "ZTSi" ], [ "ZTSj" ], [ "ZTIPKDs" ], [ "ZTSl" ], [ "ZTIPKDu" ], [ "ZTSm" ], [ "ZTSn" ], [ "ZTSPKDs" ], [ "ZTSo" ], [ "ZTSPKDu" ], [ "ZNSt14overflow_errorD2Ev" ], [ "ZTSs" ], [ "ZTSt" ], [ "ZTSN10__cxxabiv117__array_type_infoE" ], [ "ZTSv" ], [ "ZTSw" ], [ "ZTVN10__cxxabiv120__si_class_type_infoE" ], [ "ZTSx" ], [ "ZTSy" ], [ "ZTSN10__cxxabiv119__pointer_type_infoE" ], [ "ZTSSt12domain_error" ], [ "ZNSt14overflow_errorD0Ev" ], [ "ZTSPa" ], [ "ZTSPb" ], [ "ZTVSt11logic_error" ], [ "ZTSPc" ], [ "ZTSPd" ], [ "ZTSPe" ], [ "ZTSPf" ], [ "gxx_personality_v0" ], [ "ZTSPg" ], [ "ZTSPh" ], [ "ZTSPi" ], [ "ZTSPj" ], [ "ZTSPl" ], [ "ZTSPm" ], [ "ZTSPn" ], [ "ZTSPo" ], [ "ZTSN10__cxxabiv123__fundamental_type_infoE" ], [ "ZnwmSt11align_val_tRKSt9nothrow_t" ], [ "ZNSt13runtime_errorD2Ev" ], [ "cxa_bad_cast" ], [ "ZTSPs" ], [ "ZTVN10__cxxabiv117__class_type_infoE" ], [ "ZTSPt" ], [ "ZTIN10__cxxabiv129__pointer_to_member_type_infoE" ], [ "ZTSPv" ], [ "ZTSPw" ], [ "ZTSPx" ], [ "ZTSPy" ], [ "cxa_demangle" ], [ "ZTISt16invalid_argument" ], [ "ZdaPvRKSt9nothrow_t" ], [ "ZNSt13runtime_errorD0Ev" ], [ "ZNSt13bad_exceptionD1Ev" ], [ "ZTISt9type_info" ], [ "ZTSN10__cxxabiv121__vmi_class_type_infoE" ], [ "cxa_bad_typeid" ], [ "cxa_new_handler" ], [ "ZTIN10__cxxabiv120__si_class_type_infoE" ], [ "ZTISt20bad_array_new_length" ], [ "ZTSN10__cxxabiv116__enum_type_infoE" ], [ "ZTVN10__cxxabiv121__vmi_class_type_infoE" ], [ "ZNSt9bad_allocC2Ev" ], [ "ZTSSt13runtime_error" ], [ "ZTVN10__cxxabiv117__pbase_type_infoE" ], [ "ZTIPDh" ], [ "ZTIPDi" ], [ "ZNSt9bad_allocD2Ev" ], [ "ZTSSt9type_info" ], [ "ZTIPDn" ], [ "ZNSt11range_errorD1Ev" ], [ "ZTSSt11logic_error" ], [ "ZTIPDs" ], [ "ZTIPDu" ], [ "cxa_guard_acquire" ], [ "ZTIPa" ], [ "ZTIPb" ], [ "ZTIPc" ], [ "ZTIPd" ], [ "ZTIPe" ], [ "ZTIPf" ], [ "ZTIPg" ], [ "ZTISt8bad_cast" ], [ "ZTIPh" ], [ "ZTIPi" ], [ "ZNSt9bad_allocD0Ev" ], [ "ZSt14get_unexpectedv" ], [ "ZTIPj" ], [ "ZNSt9exceptionD2Ev" ], [ "ZNKSt9bad_alloc4whatEv" ], [ "dynamic_cast" ], [ "ZTIPl" ], [ "ZTIPm" ], [ "ZTIPn" ], [ "ZTIPo" ], [ "ZTIPs" ], [ "ZTIPt" ], [ "ZTVN10__cxxabiv120__function_type_infoE" ], [ "ZSt14set_unexpectedPFvvE" ], [ "ZTIPv" ], [ "ZTIPw" ], [ "ZNSt8bad_castC2Ev" ], [ "ZTIPx" ], [ "ZTIPy" ], [ "ZTVSt12length_error" ], [ "ZNSt9exceptionD0Ev" ], [ "ZNSt20bad_array_new_lengthC1Ev" ], [ "ZTISt9bad_alloc" ], [ "ZTIN10__cxxabiv117__class_type_infoE" ], [ "ZNSt12out_of_rangeD1Ev" ], [ "ZNSt8bad_castD2Ev" ], [ "Znwm" ], [ "Znam" ], [ "ZNSt20bad_array_new_lengthD1Ev" ], [ "ZTSSt14overflow_error" ], [ "ZTSSt20bad_array_new_length" ], [ "ZTSN10__cxxabiv116__shim_type_infoE" ], [ "ZTISt11range_error" ], [ "ZTISt12length_error" ], [ "ZNSt8bad_castD0Ev" ] ], "imp": [ [ "", "Unwind_GetRegionStart" ], [ "", "free" ], [ "", "vfprintf_chk" ], [ "", "Unwind_RaiseException" ], [ "", "abort" ], [ "", "Unwind_SetIP" ], [ "", "ITM_deregisterTMCloneTable" ], [ "", "Unwind_GetLanguageSpecificData" ], [ "", "pthread_cond_broadcast" ], [ "", "cxa_thread_atexit_impl" ], [ "", "pthread_getspecific" ], [ "", "pthread_cond_wait" ], [ "", "strlen" ], [ "", "stack_chk_fail" ], [ "", "assert_fail" ], [ "", "pthread_key_create" ], [ "", "memset" ], [ "", "memchr" ], [ "", "calloc" ], [ "", "strcmp" ], [ "", "syscall" ], [ "", "gmon_start__" ], [ "", "memcpy" ], [ "", "pthread_mutex_unlock" ], [ "", "malloc" ], [ "", "vsnprintf_chk" ], [ "", "realloc" ], [ "", "Unwind_Resume" ], [ "", "memmove" ], [ "", "Unwind_GetIP" ], [ "", "Unwind_SetGR" ], [ "", "ITM_registerTMCloneTable" ], [ "", "aligned_alloc" ], [ "", "pthread_once" ], [ "", "cxa_finalize" ], [ "", "pthread_mutex_lock" ], [ "", "pthread_setspecific" ], [ "", "ctype_b_loc" ], [ "", "Unwind_DeleteException" ], [ "", "stderr" ] ], "sec": [ [ ".note.gnu.build-id", 680, 36, 4.19, "alloc" ], [ ".gnu.hash", 720, 4676, 4.32, "alloc" ], [ ".dynsym", 5400, 9816, 2.77, "alloc" ], [ ".dynstr", 15216, 7297, 4.97, "alloc" ], [ ".gnu.version", 22514, 818, 1.26, "alloc" ], [ ".gnu.version_r", 23336, 160, 3.21, "alloc" ], [ ".rela.dyn", 23496, 39984, 2.39, "alloc" ], [ ".rela.plt", 63480, 1752, 1.76, "alloc,info_link" ], [ ".init", 65536, 27, 4.31, "alloc,executable" ], [ ".plt", 65568, 1184, 4.3, "alloc,executable" ], [ ".plt.got", 66752, 96, 3.7, "alloc,executable" ], [ ".plt.sec", 66848, 1168, 3.94, "alloc,executable" ], [ ".text", 68016, 146939, 6.37, "alloc,executable" ], [ "__lcxx_override", 214960, 302, 5.51, "alloc,executable" ], [ ".fini", 215264, 13, 3.24, "alloc,executable" ], [ ".rodata", 217088, 13528, 5.67, "alloc" ], [ ".eh_frame_hdr", 230616, 4980, 5.35, "alloc" ], [ ".eh_frame", 235600, 25740, 5.08, "alloc" ], [ ".gcc_except_table", 261340, 1572, 4.93, "alloc" ], [ ".note.gnu.property", 262912, 32, 1.87, "alloc" ], [ ".init_array", 266384, 8, 1.55, "write,alloc" ], [ ".fini_array", 266392, 8, 1.55, "write,alloc" ], [ ".data.rel.ro", 266400, 14816, 2.2, "write,alloc" ], [ ".dynamic", 281216, 528, 1.6, "write,alloc" ], [ ".got", 281744, 880, 1.54, "write,alloc" ], [ ".data", 282624, 40, 1.7, "write,alloc" ], [ ".comment", 282664, 58, 4.48, "merge,strings" ], [ ".deplibs", 282722, 8, 3.0, "merge,strings" ], [ ".symtab", 282736, 31152, 3.14, "" ], [ ".strtab", 313888, 79839, 5.23, "" ], [ ".shstrtab", 393727, 316, 4.29, "" ] ], "metrics": { "elf": { "bits": 64.0, "entry": 0.0, "has_got": 1.0, "has_plt": 1.0, "has_note": 1.0, "relacount": 1188.0, "has_symtab": 1.0, "note_count": 2.0, "nx_enabled": 1.0, "has_cet_ibt": 1.0, "dynrel_count": 0.0, "dynsym_count": 409.0, "has_build_id": 1.0, "has_eh_frame": 1.0, "has_gnu_hash": 1.0, "stack_canary": 1.0, "symtab_count": 1298.0, "dynrela_count": 1666.0, "has_cet_shstk": 1.0, "little_endian": 1.0, "dt_flags_1_raw": 9.0, "pltreloc_count": 73.0, "build_id_length": 20.0, "dt_versym_count": 409.0, "executable_stack": 0.0, "fini_array_count": 1.0, "init_array_count": 1.0, "wx_segment_count": 0.0, "comment_entry_count": 2.0, "fortify_source_count": 2.0, "program_header_count": 11.0, "comment_distinct_count": 2.0, "gnu_stack_section_absent": 0.0, "load_segment_max_file_size": 149741.0, "stripped_but_symtab_present": 1.0, "load_segment_max_memory_size": 149741.0, "section_relocation_group_count": 2.0, "stripped_metadata_section_count": 5.0 }, "file": { "size": 396160.0, "entropy": 5.9, "size_bytes": 396160.0 }, "binary": { "is_pie": 0.0, "has_overlay": 1.0, "is_stripped": 0.0, "code_entropy": 6.33, "data_entropy": 2.15, "overlay_size": 2117.0, "string_count": 1669.0, "overlay_ratio": 0.01, "overall_entropy": 5.9, "overlay_entropy": 1.64, "entropy_variance": 2.17, "avg_string_length": 53.53, "max_string_length": 236.0, "peak_region_bytes": 1024.0, "code_to_data_ratio": 0.9, "peak_region_entropy": 6.99, "string_length_stddev": 47.37, "largest_section_ratio": 0.37, "sentence_string_count": 45.0, "sentence_string_ratio": 0.03, "high_entropy_string_count": 0.0 }, "exports": { "count": 368.0 }, "imports": { "count": 40.0 }, "sections": { "count": 33.0, "code_size": 149729.0, "entropy_max": 6.37, "entropy_mean": 3.53, "name_entropy": 4.24, "writable_count": 7.0, "executable_count": 7.0, "nonstandard_count": 8.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 2.0 } } }, "id": 1, "mol": "O(Er)", "path": "/data/samples/good/foraged/wolfi/wolfi.dev/_/libcxxabi1-18/libcxxabi1-18-18.1.8-r24.apk!!usr/lib/libc++abi.so.1.0", "risk": 2, "sha": "267041cdf634a9b4c8cbcdde332ff40e422d245bff660b5f59f739706bddb424", "size": 396160, "traits": [ { "id": "metadata/build/artifact::elf-stripped-but-symtab-present", "conf": 0.6000000238418579, "crit": 3, "desc": "ELF stripped with .symtab present", "spans": [ [ 0, 38 ] ] }, { "id": "micro-behaviors/dylib/library/libc::libc-characteristic-cxa-finalize", "crit": 2, "desc": "libc characteristic cxa finalize", "spans": [ [ 15288, 12 ] ] }, { "id": "objectives/evasion/process/injection/memory::asm-manual-import-parsing-cond-2--inline-18287", "conf": 0.8999999761581421, "crit": 3, "desc": "High export-count binary context", "spans": [ [ 0, 22 ] ] }, { "id": "micro-behaviors/dylib/library/libc::libc-internal-functions-b", "conf": 0.699999988079071, "crit": 2, "desc": "libc internal symbols cluster B", "spans": [ [ 15288, 12 ] ] } ], "type": "elf" }, { "ctx": [ { "b": "DJ", "n": [ { "c": 2, "d": "SPDX SBOM document", "i": "metadata/package/files/system-package::spdx-sbom-document", "o": 0, "z": 1, "cf": 0.9800000190734863 } ], "ln": 1, "addr": 0 }, { "b": "arR\u003eHAaBh]wPz\u003caz/c:War\u003c-Xl%82@e\u0026aX5", "ln": 2, "addr": 2 }, { "b": "arR\u003esvrt{Kx\u003e7Z(B7DKRar\u003cfufFb1ifD@4", "ln": 3, "addr": 31 }, { "b": "arR^Hb5y$6wO#N2oLFM\u0026r+lq)x(v(kiV]R5e\u00262gaec", "ln": 8, "addr": 257 }, { "b": "arR^Hb4CU8vruBdB0rT/tl", "ln": 9, "addr": 291 }, { "b": "arR^HarR\u003ecz/oCMaz\u003eXavqYZ?asIy!e\u0026kKuf!1p$", "n": [ { "c": 2, "d": "Melange-generated SPDX SBOM", "i": "metadata/package/files/system-package::melange-spdx-sbom", "o": 315, "z": 14, "cf": 0.9800000190734863 } ], "ln": 10, "addr": 309 }, { "b": "arR^HarR\u003e7A+w/#x)Kifx(v(Iavx*Jx(mNavrb)faw3DXa]", "ln": 11, "addr": 342 }, { "b": "arR^Ht}t", "ln": 12, "addr": 380 }, { "b": "arR^HarR^HarR\u003eGwObH]wO#0?lT+7Fxk.*ob03?\u003cp^EDwk$su}o*IJum[3r1ec", "ln": 41, "addr": 1295 }, { "b": "arR^HarR^HarR\u003eGwObH]wO#0?rc-B]b03?\u003cAclhqa$J", "ln": 42, "addr": 1345 }, { "b": "arR^HarR^HarR\u003eGwObH]wO#0?oMaAHBz(gziV]R=yIbXpAbdaJz!%31fkLuiv%AlbvRELGf/RAMi4={ri4Yeag^tz?v}X2Ii5Ub4g*CeSfFUK%x(!xpz-@q.y?vx9", "n": [ { "c": 2, "d": "Wolfi APK SPDX SBOM", "i": "metadata/package/files/system-package::wolfi-apk-spdx-sbom", "o": 1380, "z": 85, "cf": 0.9800000190734863 } ], "ln": 43, "addr": 1380 }, { "b": "arR^HarR^HEe", "ln": 44, "addr": 1481 }, { "b": "arR^HarT@v", "ln": 45, "addr": 1491 }, { "b": "arR^HarR\u003esz*c8nz^^fIz!0i$x(v(kiV]RwpEd]Tmn^8RpFJ8+", "ln": 91, "addr": 3257 }, { "b": "arR^HarR\u003eux(4v4l2HaED3T4jb03\u0026UvqH0@ec", "ln": 92, "addr": 3298 }, { "b": "arR^HarR\u003eHz/{8gwL3=KzZ4j+b4j#3B.L(cwft\u00261v@2H=wGUY8w]w/7A=k!qk#ph%l{-{Sfd{6]m[DDBpA?s", "n": [ { "c": 1, "d": "SPDX references APK DB package info", "i": "metadata/package/files/system-package::spdx-apk-pkginfo-source", "o": 3349, "z": 44, "cf": 0.8999999761581421 } ], "ln": 93, "addr": 3328 }, { "b": "arR^HarR\u003eAx\u003e7Z(B7EZSzEWH9wmYo}iV]RwpEd]Tmn^8RpFJ8+", "ln": 94, "addr": 3396 }, { "b": "arR^HarR\u003eAx\u003e7Z(B7E:Jv@bN]wN(#Car\u003c9\u003cvpJ$ZeIX}ja$J", "ln": 95, "addr": 3437 }, { "b": "arR^HarR^HarR\u003eGwObH]wO#0?oMaAHBz(gziV]R=yIbXpAbdaJz!%31fkLuiv%AlbvRELGf/RAMi4={ri4Yeag^tz?v}X2Ii5Ub4g*CeSfFUL8A+Pf2zAR/LC5n/=i3F", "n": [ { "c": 1, "d": "Wolfi APK package URL in SPDX", "i": "metadata/package/files/system-package::spdx-wolfi-apk-purl", "o": 5448, "z": 87, "cf": 0.8999999761581421 } ], "ln": 147, "addr": 5448 }, { "b": "arR^HarR^HEe", "ln": 148, "addr": 5551 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 7068.0, "entropy": 5.07, "size_bytes": 7068.0 }, "json": { "parsed_bytes": 7068.0, "parse_limit_bytes": 76800.0 }, "binary": { "overall_entropy": 5.07, "peak_region_bytes": 6044.0, "peak_region_entropy": 5.24 } } }, "id": 2, "path": "/data/samples/good/foraged/wolfi/wolfi.dev/_/libcxxabi1-18/libcxxabi1-18-18.1.8-r24.apk!!var/lib/db/sbom/libcxxabi1-18-18.1.8-r24.spdx.json", "risk": 1, "sha": "8ae1d278234fd17ceb1cbcd5aede1c7e25775f26cb65d7cd2454389277768782", "size": 7068, "traits": [ { "id": "metadata/package/files/system-package::spdx-document-id", "conf": 0.8999999761581421, "crit": 1, "desc": "SPDX document identifier" }, { "id": "metadata/package/files/system-package::spdx-melange-creator", "conf": 0.8999999761581421, "crit": 1, "desc": "Melange SPDX creator", "spans": [ [ 315, 14 ] ] }, { "id": "metadata/package/files/system-package::spdx-wolfi-apk-purl", "conf": 0.8999999761581421, "crit": 1, "desc": "Wolfi APK package URL in SPDX", "spans": [ [ 1380, 85 ], [ 1411, 14 ], [ 5448, 87 ] ] }, { "id": "metadata/package/files/system-package::spdx-apk-pkginfo-source", "conf": 0.8999999761581421, "crit": 1, "desc": "SPDX references APK DB package info", "spans": [ [ 3349, 44 ] ] }, { "id": "metadata/file/format::valid", "conf": 0.6000000238418579, "crit": 2, "desc": "JSON data format", "spans": [ [ 0, 34 ] ] }, { "id": "metadata/package/files/system-package::spdx-melange-namespace", "conf": 0.8999999761581421, "crit": 1, "desc": "Melange SPDX document namespace" }, { "id": "metadata/package/files/system-package::spdx-document-version", "conf": 0.8999999761581421, "crit": 1, "desc": "SPDX document version field" }, { "id": "metadata/package/files/system-package::spdx-sbom-document", "conf": 0.9800000190734863, "crit": 2, "desc": "SPDX SBOM document" }, { "id": "metadata/package/files/system-package::melange-spdx-sbom", "conf": 0.9800000190734863, "crit": 2, "desc": "Melange-generated SPDX SBOM", "spans": [ [ 315, 14 ] ] }, { "id": "metadata/package/files/system-package::wolfi-apk-spdx-sbom", "conf": 0.9800000190734863, "crit": 2, "desc": "Wolfi APK SPDX SBOM", "spans": [ [ 1380, 85 ], [ 1411, 14 ], [ 3349, 44 ], [ 5448, 87 ] ] } ], "type": "json" }, { "ctx": [ { "b": "boPG/zE)\u0026%By!#9vTf8kwO+^)xjR", "n": [ { "c": 2, "d": "Melange-generated APK package info", "i": "metadata/package/files/system-package::melange-generated-apk-pkginfo", "o": 0, "z": 22, "cf": 0.9800000190734863 } ], "ln": 1, "addr": 0 }, { "b": "Abf97vqPM#jS[MPvQ\u003cUcvpA}9eIPi", "n": [ { "c": 2, "d": "Wolfi APK package info metadata", "i": "metadata/package/files/system-package::wolfi-apk-pkginfo", "o": 23, "z": 23, "cf": 0.9800000190734863 } ], "ln": 2, "addr": 23 }, { "b": "Abf9fwPw[RatC\u0026df!LBqAXYD", "n": [ { "c": 2, "d": "Alpine/Wolfi package info metadata", "i": "metadata/package/files/system-package::alpine-apk-pkginfo", "o": 47, "z": 19, "cf": 0.9700000286102295 } ], "ln": 3, "addr": 47 }, { "b": "vrb\u003c\u003eauZ\u0026(i5Ub4gY", "ln": 4, "addr": 67 }, { "b": "B7]@iauZ\u00267gCH)Ahu", "ln": 5, "addr": 81 }, { "b": "z/PM8x(k4Raz+\u003eqz7NF4", "n": [ { "c": 1, "d": "Alpine/Wolfi package origin field", "i": "metadata/package/files/system-package::alpine-pkginfo-origin-field", "o": 95, "z": 16, "cf": 0.8999999761581421 } ], "ln": 6, "addr": 95 }, { "b": "Abf8%wPIu7jS)A(r.TYMx\u003c$N5d\u003cdbAnGY.", "ln": 7, "addr": 112 }, { "b": "B-IpvjS\u003c", "ln": 8, "addr": 140 }, { "b": "v@Dj3x(\u003eEXaui%\u0026v{}wSw\u00268q6gIgfeiwU8Oi5rrEiasT1gc46ChdOHMixe/OgY", "ln": 9, "addr": 147 }, { "b": "zddc@Byw)3wPw[RaA}:uw[.", "n": [ { "c": 1, "d": "Wolfi package maintainer field", "i": "metadata/package/files/system-package::wolfi-pkginfo-maintainer", "o": 197, "z": 18, "cf": 0.8999999761581421 } ], "ln": 10, "addr": 197 }, { "b": "vS=y3wmPa\u003cwGTbUf/I3GgbZ)yg=U", "ln": 11, "addr": 216 }, { "b": "y?Wx\u003czGxwijS)4fvpJ$ZeIX}j", "ln": 12, "addr": 239 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 523.0, "entropy": 5.14, "size_bytes": 523.0 }, "binary": { "overall_entropy": 5.14, "peak_region_bytes": 523.0, "peak_region_entropy": 5.14 } } }, "id": 3, "path": "/data/samples/good/foraged/wolfi/wolfi.dev/_/libcxxabi1-18/libcxxabi1-18-18.1.8-r24.apk!!.PKGINFO", "risk": 1, "sha": "772936e0520711bb2ae3d541420779da0ecfc50e15e8daaef6786ef4659aea78", "size": 523, "traits": [ { "id": "metadata/package/files/system-package::wolfi-pkginfo-maintainer", "conf": 0.8999999761581421, "crit": 1, "desc": "Wolfi package maintainer field", "spans": [ [ 197, 18 ] ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-origin-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package origin field", "spans": [ [ 95, 16 ] ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-package-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package name field", "spans": [ [ 23, 23 ] ] }, { "id": "metadata/package/files/system-package::melange-pkginfo-generator", "conf": 0.8999999761581421, "crit": 1, "desc": "Melange-generated package metadata", "spans": [ [ 0, 22 ] ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-basename", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package info file" }, { "id": "metadata/package/files/system-package::alpine-pkginfo-version-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package version field", "spans": [ [ 47, 19 ] ] }, { "id": "metadata/package/files/system-package::arch-pkgname-field", "conf": 0.9399999976158142, "crit": 1, "desc": "Arch pkgname metadata field", "spans": [ [ 23, 23 ] ] }, { "id": "metadata/package/files/system-package::alpine-apk-pkginfo", "conf": 0.9700000286102295, "crit": 2, "desc": "Alpine/Wolfi package info metadata", "spans": [ [ 23, 23 ], [ 47, 19 ], [ 95, 16 ] ] }, { "id": "metadata/package/files/system-package::melange-generated-apk-pkginfo", "conf": 0.9800000190734863, "crit": 2, "desc": "Melange-generated APK package info", "spans": [ [ 0, 22 ], [ 23, 23 ], [ 47, 19 ], [ 95, 16 ] ] }, { "id": "metadata/package/files/system-package::wolfi-apk-pkginfo", "conf": 0.9800000190734863, "crit": 2, "desc": "Wolfi APK package info metadata", "spans": [ [ 23, 23 ], [ 47, 19 ], [ 95, 16 ], [ 197, 18 ] ] } ], "type": "text" } ], "rev": "66111", "v": "8" } }