{ "llm": { "conf": 0.00006104082, "grade": "benign", "model": "qwen/qwen3.8-27b", "outcome": "benign", "interpretation": "Legitimate KDE editor RPM" }, "ml": { "v": "7", "eng": "2.8.0", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.0000911057, "rte": "az", "prob": 0.0000911057 }, { "cls": 0, "raw": 0.000000009934108, "rte": "az/rpm", "prob": 0.000000009934108 } ], "prob": 0.0000911057, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.00009110569953918457, "type": "rpm" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.00004017353057861328, "type": "elf" } ], "version": "v18.18", "analyzed_at": "2026-09-04T12:48:00Z" }, "path": "kwrite-26.07.90-1.fc45.aarch64.rpm", "raw": { "files": [ { "id": 0, "mol": "H(Cm)Md₂(BiPa)", "sha": "0cfe03f1879eaf4e5298e461988beca429fdc98bfeea5f2af58d35f0e578eef0", "path": "kwrite-26.07.90-1.fc45.aarch64.rpm", "risk": 3, "size": 713715, "type": "rpm", "facts": { "metrics": { "rpm": { "buildtime": 1785528929 }, "file": { "size": 713715, "entropy": 7.94 }, "binary": { "peak_region_bytes": 651251, "peak_region_entropy": 7.87 } } }, "ident": { "name": { "value": "kwrite", "source": "rpm.name", "verified": false }, "urls": [ { "url": "https://apps.kde.org/kate/", "kind": "homepage", "source": "rpm.url" } ], "trust": "unsigned", "authors": [ { "name": "Fedora Project", "role": "packager", "source": "rpm.packager" } ], "version": { "value": "26.07.90", "source": "rpm.version", "verified": false }, "organization": { "value": "Fedora Project", "source": "rpm.vendor", "verified": false } }, "traits": [ { "id": "metadata/binary/linking/runtime::library-loader-dep", "conf": 1.0, "crit": 3, "desc": "ELF directly depends on the dynamic loader", "from": [ { "file": 1 } ] }, { "id": "metadata/binary/linking/runtime::dynamic-loader-needed", "conf": 0.7, "crit": 3, "desc": "ELF needs the Linux dynamic loader" }, { "id": "metadata/binary/linking/runtime::glibc-needed", "conf": 1.0, "crit": 3, "desc": "ELF depends on glibc" }, { "id": "micro-behaviors/communications/http/url/domain::http-url-binary", "atk": "T1071.001", "mbc": "C0002", "conf": 0.7, "crit": 3, "desc": "Embedded HTTP or WebSocket URL", "from": [ { "file": 1 } ] }, { "id": "metadata/package/files/system-package::fedora-rpm-vendor", "conf": 0.99, "crit": 3, "desc": "Fedora Project RPM vendor identity" }, { "id": "metadata/package/files/system-package::rpm-signature-present", "conf": 0.95, "crit": 3, "desc": "RPM signature header is present" } ] }, { "ctx": [ { "b": "E))420S-r400000000000%2!g0rr91kRJfr00000kMy=:00000UM+ad0000000000kMA+z3\u0026\u0026J)aoiF-1][S61onA4kMy=:00000kMy=:00000kMy=:00000PAk8[00000PAk8[000002MK\u00268000000@@r31onA41oOS7000001oOS7000001oOS7000008VP\u003cr00000", "ln": 0 }, { "b": "uTEC.z/e{6ByxiiuTA!uuU\u003cB=v{:q0vrcD%zddc@0af8yCWT@\u003ex(mu}x)Ks\u003cvpBd}Bo3e?zdvKg0ae[/yItH.zE=Npv]C6*0ae]8oees$oMaAHy?Xibwk^O\u003cx(mMyBz\u003e91A+PA7mrOVrt23!goh6nlvqGU7wN[.YA+PA7l[}bN0af8OBywV{uT)++uUi.XyYE*Hv%zA?vru79x(\u003ctZt241Hvru6DAbWM\u003cx(mTbp\u0026ZbkAbYScv{%E[z/d{.wNPW{z/e0M0ae]8f/zV#z!0i(x)Ku3q/)4]zF7ZUB7GCVAbYScv{%E[z/d%Yzddc@mn==kfI$eZBy^:UA::j[uS{hVfIsYvz/{d\u0026ve", "ln": 2327 }, { "b": "z/6u1zE=BPzE(TMA=U/jh/J!Qv}x.5mn==khC(?WA+dKQAbok#vruj4zua3JxjVf[B:e7ryYE*HB97\u00262yHpN+yHpZ%vrb(Uy?Wu]vru71A+PY9By^7Cz.r!6e?/jpiwpCHx\u003c%.8hBzz6wKf\u003cqz/fRGB8JV?0bMvUogy*hf/T56B8JV?0bMvUogy*cluNunwb", "ln": 4139 }, { "b": "y?WuQBt=H8A+c\u003eAz.r{Fy?Wu*e]$}-humM7eO]csB:bGDvrb\u003c\u003ehz^4cz.r:Am[=GvlTIP3f/G8fByc{am[=GvlTJbCnNB\u003e+uS6r^qufiXnKt^Kga\u003evt08W\u0026BhzcZs0000000000000000000000000000000000000000000000000000000000000000", "ln": 4336 }, { "b": "0@@r31][=a0SSi21onA40SSi20SSo4000000@@r32lj-7000i60@@x50@@x50SSGa0009300000000c4000310rsOP000Mg001bw005vFMiEr?2MN9}0000000031", "ln": 4574 }, { "b": "002U[A+PSb002U[A+PSbat1ZnwQ5qtmpZaOz/L*T001ASdiHx1fFC7lfFUEcra]?=ojq{Navgc(xM4{j003!BwId[wx8(ZQBy^avCxdztwDhYg002@eBrCdjv@C)(zF787z/M$xxK@q#x(4u6Bz\u0026puAaJ]t00000003OFv@C)(zF5}H00000002=5C4\u003eO$By=OpzY\u003cdnx(+zkx(mGm003?HzE\u0026!F002=5C4\u003eO$By=OpzY\u003cdnx(+zbz!%Mkzy$[?00000003IEy\u0026%Pj002]dvpQH5xK@q@z/fVdzGG}xz!pbkByY96e=U\u003eK002#iwGUP0y?i", "ln": 13142 }, { "b": "t(T\u003c800000g5%ije=WN9hVLDgirg-k0000000000jof6}z2!hGaol6PwDlAAx8(PBBo1D7a]\u003cz0hukGja]\u0026.=Ck#sSwb{YKxAgf}a]\u003cF2f-S%ea]\u0026.=A@ZjXv/OT(a]\u003cU7f92+/ve$xHwDjv-z2^#AA@YXIzVB\u003eVe=Y?\u003czuaqHa]\u003cm@j]+M.xAibOBo3mWA@Xl3f90T9yxd=yBo2\u003eLeDxtZwb{rzBo3jVASvY(zVB!Tx8?]iA@Zs.vGplBx-JkPkMCl[BPu4OA@W/)yxd(BwDjs.zVB!Tx8?]izVB!Tx8\u003cK:yxd(BwDjs.yxeLUASx!NBo2\u003eL00000iSH/kyxeLUASx!NBo2\u003eLf92+/Ck#T-x-JkPwDjs", "ln": 13496 }, { "b": "v/MGe00000v/QAEyYFOTz2!CN00000x-Fbk00000A@ZpZwb{rzzu6Up00000Bo2\u003eLz2!IPw=MJByYF2D0000000000BPuBZyYFIR0000000000f92+/Ck#T-x-JkPwDjv-A@Y+KA@ZmYx-J5Kzua.T0000000000000g0d77-bu(ZgzdGBU+OfOVD\u003eMfA@", "ln": 13856 }, { "b": "1Pm#8Eyl(mVsT\u003en[tdP+[XQ+gGghdmCVCy(rHE3BmV+qu+x+XsA86GmN3x@/dUe}QqG$*pvP(}!G^%w{dMP1hO!7J#2^41@)D(-\u003eAaT9vs/29V\u003e:lOwlfK+$)yCEzORad(=sa$sI4P=k0q7f%)t^UD4vu=W\u0026u1p{7wMb4d$j%l*+)cOHMrarUv.+]V/iT-UG7V]30y8z1UR=d/g%Cvw@Qg/FSG{oy5!tBnTiyy:nbREDLW]O\u003eL+p#%35X*69T-P+\u003cf-?d\u003eXHVVQwAsm)}E!5wAwm-Ev4G*03-\u003e9Uy#b=$1vqhYK9+u$J$vj2pCW:zw{5zchVy-)T$im)!2FV2\u0026@=DjWi6x8m3eY:V$(7.x8c6O]c2BHTqiH(1Ckq/E*{lgA9:gkWL6C!az$Vj8BJ6GnJ)FJY%\u003cl}-n7l{%Cab/$2wKtfu[3-#Ltnsg!OH^R%p1J?MFH.gEE5FMAygbp4frum4jZt}g\u0026S^pMfPYAR5ILBU5+1T2q111]5--Q^YjxOSKobgh61(upyMhw1G8?V%R1\u003e=EjEPtv?N#(\u0026qf:))SHxFFgU1-(\u003cDS.R1Dpdzncn7\u003eZ/b6M+bS7AoKxh$9kdzAh75Qt21HN3O3Ae5D)SNVHCJyDS)O]uuEQ\u003eV\u003cZ@r!6}Oa6.t]QeJdHKi-=@gF%h%.-@A9zv#N6pdBK}.+EDU9]hIK66hGNWRT?3L{0a-XDD@Kv}vMa@jLw2MFtLBwgo3Ug(e}BU?\u003e8r67OAT-CNfiAWaFgjFQOKspHYe/Xd", "ln": 14304 }, { "b": "vru68efYmGA=U@kzx.a=gbZ:sh.E9AeIO\u003e\u0026v(c4!efXIyv}YN#wN/?8A+cBQb4j]2v}W+Sa$K{RB3\u003c[Tb03]TAaI6-z-RGwwn=G%Ab](iwN/*yw[tH\u003eA:.0=h6NCG0000000000000000000000000000000000000000000000000000000000000000000", "ln": 16143 }, { "b": "000000000000000000000000000000000000000000000000000sG8i00000yJ\u003c/kBy^3VhzcWxe\u0026+Qqf!N6Fg=l)]vrb\u003c\u003ehz^3%wNY^{00000iHZd]@wP48s]XK9\u003egl[e1I\u003cdaPFvU\u003e761sm00000mx+4V\u002629Qt?DZaCKWT}pj=c5\u0026IS6plQqCIhTr6dcG7M[UaWqy:v)3U*=I\u0026RE[@5G3HML\u0026.^\u003cvJT", "ln": 65512 }, { "b": "002$}8l*x:xzR-g00004sY$!TB7/SpA=+-004@ecBy^7qzGNNvB.LV5eOO.}e[]iBwPz.\u0026e[Y6Ae[!WmxAfU}D2vXGz2=h0D2vXBASv.8zGNNPwPz\u003caz/bLcxkR\u0026AC4CYnx(v(@ASv.jwO+^cwo\u00264)e]\u003eJtvj(InBo0}lwO=xtwo\u00264)e[]iqBo0}nwQ5p%e[O*nx-G=az!9o#ve}]\u003exKtv(vqPN.xA", "ln": 66906 }, { "b": "By^7zvpK7YxjR5}x(mTbuTW$}vr?\u00269w[=c%uTW$}vr?\u00269wmoN*e]\u003eJte]\u003e\u003ege[xlBvqPZ*04}]5Bo0}7vrt]Te]+#RwPz\u003caz/bLcvSMO\u003ce[Y6AuU0.SB.tJ8zFGk8xkR\u003c0wmYj)xjLB)ve{oc000000000000000000000000000000000000000000000000000000000000000000000000000000003JHeb2lj-70SSi200000?#S(U00000?#S(U00", "ln": 67132 } ], "depth": 1, "facts": { "imp": [ [ "", "ZN10QArrayData8allocateEPPS_xxxNS_16AllocationOptionE" ], [ "", "ZN7QString6_emptyE" ], [ "", "ZNK16KLocalizedString8toStringEv" ], [ "", "memcpy" ], [ "", "ZN16KLocalizedString20setApplicationDomainERK10QByteArray" ], [ "", "ZN8QVariantD1Ev" ], [ "", "ZN5QIconD1Ev" ], [ "", "ZN12KDBusServiceC1E6QFlagsINS_13StartupOptionEEP7QObject" ], [ "", "ZN18QCommandLineParserD1Ev" ], [ "", "ZN18QCommandLineOptionD1Ev" ], [ "", "ZN18QCommandLineParser7processERK16QCoreApplication" ], [ "", "qt_resourceFeatureZstd" ], [ "", "ZN18QCommandLineParser21addPositionalArgumentERK7QStringS2_S2_" ], [ "", "ZN14QStandardPaths16writableLocationENS_16StandardLocationE" ], [ "", "ZN16KLocalizedStringD1Ev" ], [ "", "ZN10KAboutData18setApplicationDataERKS_" ], [ "", "ZN10KAboutData14setProgramLogoERK8QVariant" ], [ "", "libc_start_main" ], [ "", "ZN10KAboutData18setDesktopFileNameERK7QString" ], [ "", "Z23qUnregisterResourceDataiPKhS0_S0_" ], [ "", "ZN10KAboutDataC1ERK7QStringS2_S2_S2_N13KAboutLicense10LicenseKeyES2_S2_S2_S2_" ], [ "", "gmon_start__" ], [ "", "Z21qRegisterResourceDataiPKhS0_S0_" ], [ "", "ZN12QApplicationD1Ev" ], [ "", "ZN10KAboutData21setOrganizationDomainERK10QByteArray" ], [ "", "cxa_finalize" ], [ "", "ZN7KateApp27initPostApplicationCreationER10KAboutData" ], [ "", "ZN12QApplication4execEv" ], [ "", "ZNK5QIconcv8QVariantEv" ], [ "", "ZN18QCommandLineOptionC1ERK5QListI7QStringERKS1_S6_S6_" ], [ "", "Z6ki18ndPKcS0_" ], [ "", "ZN15QGuiApplication13setWindowIconERK5QIcon" ], [ "", "ZN10KAboutData18processCommandLineEP18QCommandLineParser" ], [ "", "ZN18QCommandLineParserC1Ev" ], [ "", "ZN10KAboutDataD1Ev" ], [ "", "ZN18QCommandLineParser9addOptionERK18QCommandLineOption" ], [ "", "ZN10QArrayData10deallocateEPS_xx" ], [ "", "ITM_registerTMCloneTable" ], [ "", "ZN7KateAppD1Ev" ], [ "", "getauxval" ], [ "", "ITM_deregisterTMCloneTable" ], [ "", "qt_version_tag" ], [ "", "ZN10KAboutData14setProductNameERK10QByteArray" ], [ "", "ZN7KateApp26initPreApplicationCreationEb" ], [ "", "ZN12QApplicationC1ERiPPci" ], [ "", "abort" ], [ "", "ZN16QCoreApplication18setApplicationNameERK7QString" ], [ "", "cxa_atexit" ], [ "", "ZN7QStringC1ExN2Qt14InitializationE" ], [ "", "ZN10QByteArrayC1EPKcx" ], [ "", "stack_chk_guard" ], [ "", "ZN12KDBusServiceD1Ev" ], [ "", "stack_chk_fail" ], [ "", "ZN10KAboutData16setupCommandLineEP18QCommandLineParser" ], [ "", "ZN7KateAppC1ERK18QCommandLineParserNS_15ApplicationModeERK7QString" ], [ "", "ZN7KateApp4initEv" ], [ "", "ZN5QIconC1ERK7QString" ] ], "sec": [ [ ".note.gnu.build-id", 736, 36, 4.25, "alloc" ], [ ".interp", 772, 27, 4.21, "alloc" ], [ ".gnu.hash", 800, 28, 0.49, "alloc" ], [ ".dynsym", 832, 1440, 1.05, "alloc" ], [ ".dynstr", 2272, 2245, 5.26, "alloc" ], [ ".gnu.version", 4518, 120, 1.44, "alloc" ], [ ".gnu.version_r", 4640, 208, 2.72, "alloc" ], [ ".rela.dyn", 4848, 192, 1.6, "alloc" ], [ ".rela.plt", 5040, 1224, 1.92, "alloc,info_link" ], [ ".relr.dyn", 6264, 24, 1.61, "alloc" ], [ ".init", 6288, 28, 3.99, "alloc,executable" ], [ ".plt", 6320, 1256, 4.61, "alloc,executable" ], [ ".text", 7616, 5468, 5.83, "alloc,executable" ], [ ".fini", 13084, 24, 3.72, "alloc,executable" ], [ ".rodata", 13120, 2354, 6.8, "alloc" ], [ ".eh_frame_hdr", 15476, 116, 3.63, "alloc" ], [ ".eh_frame", 15592, 448, 4.06, "alloc" ], [ ".note.gnu.property", 16040, 32, 1.69, "alloc" ], [ ".note.ABI-tag", 16072, 32, 1.56, "alloc" ], [ ".note.package", 16104, 140, 4.85, "alloc" ], [ ".init_array", 64288, 24, 1.22, "write,alloc" ], [ ".fini_array", 64312, 8, 1.06, "write,alloc" ], [ ".data.rel.ro", 64320, 8, 1.55, "write,alloc" ], [ ".dynamic", 64328, 704, 1.47, "write,alloc" ], [ ".got", 65032, 504, 1.03, "write,alloc" ], [ ".data", 65536, 4, 0.0, "write,alloc" ], [ ".qtversion", 65544, 16, 0.99, "write,alloc" ], [ ".gnu_debuglink", 65560, 44, 4.56, "" ], [ ".gnu_debugdata", 65604, 1320, 7.84, "" ], [ ".shstrtab", 66924, 322, 4.3, "" ] ], "metrics": { "elf": { "bits": 64, "entry": 12352, "has_got": 1, "has_plt": 1, "has_note": 1, "note_count": 4, "nx_enabled": 1, "has_dt_relr": 1, "dynrel_count": 0, "dynsym_count": 60, "has_build_id": 1, "has_eh_frame": 1, "has_gnu_hash": 1, "no_gnu_stack": 0, "stack_canary": 1, "symtab_count": 0, "dynrela_count": 8, "has_debuglink": 1, "little_endian": 1, "dt_flags_1_raw": 134217729, "pltreloc_count": 51, "build_id_length": 20, "dt_versym_count": 60, "has_aarch64_bti": 1, "has_aarch64_pac": 1, "executable_stack": 0, "fini_array_count": 1, "init_array_count": 3, "wx_segment_count": 0, "program_header_count": 12, "stripped_with_symtab": 0, "has_direct_loader_dep": 1, "load_segment_max_file_size": 16244, "load_segment_max_memory_size": 16244, "section_relocation_group_count": 2, "stripped_metadata_section_count": 8 }, "file": { "size": 69296, "entropy": 2.09 }, "binary": { "is_pie": 1, "has_overlay": 1, "is_stripped": 1, "code_entropy": 5.59, "data_entropy": 1.28, "overlay_size": 2050, "string_count": 132, "overlay_ratio": 0.03, "overlay_entropy": 1.45, "entropy_variance": 3.89, "rizin_incomplete": 1, "avg_string_length": 23.11, "max_string_length": 122, "peak_region_bytes": 2048, "code_to_data_ratio": 0.84, "peak_region_entropy": 7.8, "string_length_stddev": 19.13, "largest_section_ratio": 0.08, "sentence_string_count": 9, "sentence_string_ratio": 0.07, "high_entropy_string_count": 0 }, "imports": { "count": 57 }, "sections": { "count": 32, "code_size": 6776, "entropy_max": 7.84, "entropy_mean": 2.98, "name_entropy": 4.25, "writable_count": 8, "executable_count": 4, "nonstandard_count": 11, "executable_writable_count": 0 }, "dependencies": { "count": 9 } } }, "id": 1, "mol": "H(Cm)Md(Bi)", "path": "kwrite-26.07.90-1.fc45.aarch64.rpm!!usr/bin/kwrite", "pid": 0, "risk": 2, "sha": "4801f9f9dbf84f6ffbaf82b8a2431a6b7fa028f16912a4e09da8a5a745ee9c62", "size": 69296, "traits": [ { "id": "metadata/binary/linking/runtime::dynamic-loader-needed", "conf": 0.7, "crit": 3, "desc": "ELF needs the Linux dynamic loader" }, { "id": "metadata/binary/linking/runtime::glibc-needed", "conf": 1.0, "crit": 3, "desc": "ELF depends on glibc" }, { "id": "metadata/binary/linking/runtime::library-loader-dep", "conf": 1.0, "crit": 3, "desc": "ELF directly depends on the dynamic loader", "spans": [ [ 0, 32 ] ] }, { "id": "micro-behaviors/communications/http/url/domain::http-url-binary", "atk": "T1071.001", "mbc": "C0002", "conf": 0.7, "crit": 3, "desc": "Embedded HTTP or WebSocket URL", "spans": [ [ 13640, 23 ] ] } ], "type": "elf" } ], "rev": "479f3", "v": "8" } }