{ "ml": { "v": "7", "eng": "2.1.0", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.000019043684, "rte": "az", "prob": 0.000019043684 } ], "prob": 0.00003344814, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.00003344814103911631, "type": "apk_alpine" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.00003344814103911631, "type": "elf" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.000006794929504394531, "type": "text" } ], "version": "v18.18", "analyzed_at": "2026-06-23T19:58:31Z" }, "path": "avahi-compat-libdns_sd-0.9_rc4-r1.apk", "raw": { "files": [ { "id": 0, "ctx": [ { "b": "abZy8000000T3{24[J!\u003enkh=HeH]u63?!Yp^*DIa!jX1m:JNrco?u{f=2H?Deg@xa3GU*X", "ln": 0 } ], "mol": "H(Cm)Md(He)", "sha": "0f8df9de7444e6f3f67292a16f829f431e81df49bc8fea06ddcd64cb4382c4b1", "path": "/data/samples/unknown/foraged/alpine/alpinelinux.org/_/avahi-compat-libdns_sd/avahi-compat-libdns_sd-0.9_rc4-r1.apk", "risk": 3, "size": 14678, "type": "apk_alpine", "facts": { "metrics": { "file": { "size": 14678.0, "entropy": 7.98, "size_bytes": 14678.0 }, "parse": { "error_count": 1.0 }, "binary": { "overall_entropy": 7.98 } } }, "traits": [ { "id": "micro-behaviors/fs/file/write/direct::write", "conf": 0.6600000262260437, "crit": 2, "desc": "Write files", "from": [ { "off": 4402, "file": 1 } ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-origin-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package origin field", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/fs/file/write/direct::write--write", "conf": 0.6600000262260437, "crit": 2, "desc": "Write files (write)", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/dylib/library/family::cxx-abi-symbols", "conf": 0.800000011920929, "crit": 2, "desc": "C++ ABI symbols", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/socket/multiplex::poll-multiplex", "crit": 3, "desc": "poll() I/O multiplexing", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/file/binary::file-read-operation", "atk": "T1005", "conf": 0.75, "crit": 1, "desc": "File read operation", "from": [ { "file": 1 } ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-version-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package version field", "from": [ { "file": 2 } ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-basename", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package info file" }, { "id": "micro-behaviors/dylib/library/libc::libc-internal-functions-b", "conf": 0.699999988079071, "crit": 2, "desc": "libc internal symbols cluster B", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/dylib/library/libc::libc-characteristic-cxa-finalize", "crit": 2, "desc": "libc characteristic cxa finalize", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/ip/parse::ntohs-symbol", "conf": 0.6600000262260437, "crit": 3, "desc": "Converts network to host short", "from": [ { "file": 1 } ] }, { "id": "metadata/hardening/missing::stripped-binary", "conf": 0.800000011920929, "crit": 3, "desc": "No full symbol table (likely stripped)", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/dylib/library/abi-graphics::cxx-abi-symbols-a", "conf": 0.800000011920929, "crit": 2, "desc": "C++ ABI symbols cluster A", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/ip/parse::htons-symbol", "conf": 0.6600000262260437, "crit": 3, "desc": "Converts host to network short", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/file/read::read", "conf": 0.699999988079071, "crit": 2, "desc": "Read file descriptor (read/pread)", "from": [ { "file": 1 } ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-package-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package name field", "from": [ { "file": 2 } ] } ] }, { "ctx": [ { "b": "E))420S-r400000000000@$H+0rr910000000000kMy=:00000[pgGs0000000000kMA+z3JH", "ln": 0 }, { "b": "A-t+2y\u0026si5raflLwDl7Av%zA?w[=c\u003ey?Xib0af8zwPzu{x(!xcA:JB0vqPN.x(mK30af8NwOkZ#By/G1w].r%wNxd?w]vVRuTX1%wPz)1w)]y\u00260chTVwb]$zwPz*ez^Ns0v{%E[z/bL@BAg@kA=k%#B97@7AS", "ln": 4103 }, { "b": "vpS.ZB-.htuV*m5z!0L.AbPMe0c03[A+eV\u0026uU%}cwQ4M#z!0L.vrM6)x\u003cUB?BAhUl", "ln": 4262 }, { "b": "A^q28A=l8tuT[1\u003eze17(CxdztwDl^=xj+\u003c]y\u0026:ff0c03[A+eV\u0026uVP{]zddH30c03[AS", "ln": 4386 }, { "b": "y\u00260E0B-4h2BAhhezua3JB97\u00262yHpN+yHpWZx(0=TC425#uUaa%A^q28A=l8tuVG.0wPN]XC425#uTS", "ln": 4463 }, { "b": "vqPN.yhW*70crm5v{%DVxMOfgA@YS(vq6vZB98CpzF9r)x(!x6w].D]0ay4VxLy*{x-", "ln": 4657 }, { "b": "wNxy{y\u00260E1wPRo\u003eB-7W?Acb=lwNPaRv@=c?By+Cupe+85A=#ebwKpAQCxmr}vrM6)x\u003cV6)A=blbzGt", "ln": 5191 }, { "b": "x)Kt$zEEx[uVQsfwoz?\u003ezGG/gA@YS(vq6vZwO#QgD0+i8z/{2azE[1(vrM6)x\u003cUv^x-", "ln": 5543 }, { "b": "B9R?yz!x5Wy\u0026sxay\u0026r}^xjVf@zGV1@x\u003c$H]vq6vbv@b\u003c\u003czGEHLz.r*Cy?Wu!C425#eN@ZozeTqAB8JV!0bMvUv\u003eIRvB8iBMi5Ub4g+J\u0026/e?)uxx\u003c$Q\u003cB6\u003c00e]$}-f-RgN0000002QW}0000000S", "ln": 6251 }, { "b": "cP@*SzxI58atw4fmN/\u0026Efk$@Iv\u003eR[my?ttiCX3\u003e6B-7#jz*c7F0c.\u003c(zz2A0d069GwNxKdazS8ZjS\u003c", "ln": 24962 }, { "b": "y?bbiwb[k{zGNNBvrl8Ze[xlBB9RQ5e[xlBB98B5e]\u003eJtvj(8ozu8qfwO=xtwo\u00264)e[]iqBo0}nwQ5p", "ln": 32847 }, { "b": "A::j[e[O*nx\u003cUp?A::j[e[xlBvqPZ*04}]5Bo0}7vrt]Te[e)y04}=1zeA\u003c4Bn#pv00000", "ln": 32957 } ], "depth": 1, "facts": { "exp": [ [ "TXTRecordGetCount" ], [ "DNSServiceConstructFullName" ], [ "init" ], [ "fini" ], [ "DNSServiceRefSockFD" ], [ "DNSServiceEnumerateDomains" ], [ "TXTRecordGetValuePtr" ], [ "DNSServiceAddRecord" ], [ "DNSServiceReconfirmRecord" ], [ "avahi_exe_name" ], [ "avahi_warn_unsupported" ], [ "DNSServiceQueryRecord" ], [ "DNSServiceRegister" ], [ "DNSServiceProcessResult" ], [ "TXTRecordDeallocate" ], [ "TXTRecordGetItemAtIndex" ], [ "TXTRecordSetValue" ], [ "TXTRecordContainsKey" ], [ "DNSServiceRefDeallocate" ], [ "avahi_warn_linkage" ], [ "DNSServiceUpdateRecord" ], [ "DNSServiceCreateConnection" ], [ "avahi_warn" ], [ "TXTRecordGetLength" ], [ "DNSServiceBrowse" ], [ "DNSServiceRemoveRecord" ], [ "DNSServiceResolve" ], [ "DNSServiceRegisterRecord" ], [ "TXTRecordGetBytesPtr" ], [ "TXTRecordCreate" ], [ "TXTRecordRemoveValue" ] ], "imp": [ [ "", "avahi_simple_poll_prepare" ], [ "", "avahi_service_browser_new" ], [ "", "pthread_create" ], [ "", "strerror" ], [ "", "avahi_simple_poll_free" ], [ "", "memmove" ], [ "", "snprintf" ], [ "", "avahi_simple_poll_get" ], [ "", "getenv" ], [ "", "avahi_entry_group_reset" ], [ "", "readlink" ], [ "", "avahi_string_list_equal" ], [ "", "avahi_malloc0" ], [ "", "cxa_finalize" ], [ "", "vsnprintf" ], [ "", "avahi_entry_group_add_service_subtype" ], [ "", "stack_chk_fail" ], [ "", "avahi_free" ], [ "", "avahi_entry_group_add_service_strlst" ], [ "", "strrchr" ], [ "", "avahi_strndup" ], [ "", "write" ], [ "", "fprintf" ], [ "", "strcat" ], [ "", "deregister_frame_info" ], [ "", "avahi_strdup" ], [ "", "avahi_client_get_domain_name" ], [ "", "avahi_realloc" ], [ "", "ITM_registerTMCloneTable" ], [ "", "avahi_service_name_join" ], [ "", "memchr" ], [ "", "avahi_entry_group_update_service_txt_strlst" ], [ "", "avahi_normalize_name_strdup" ], [ "", "read" ], [ "", "avahi_client_free" ], [ "", "openlog" ], [ "", "closelog" ], [ "", "strncmp" ], [ "", "avahi_simple_poll_new" ], [ "", "strncpy" ], [ "", "pthread_sigmask" ], [ "", "avahi_malloc" ], [ "", "sigfillset" ], [ "", "avahi_is_valid_service_type_generic" ], [ "", "ITM_deregisterTMCloneTable" ], [ "", "avahi_client_new" ], [ "", "avahi_string_list_parse" ], [ "", "avahi_client_get_state" ], [ "", "avahi_is_valid_service_subtype" ], [ "", "avahi_is_valid_service_type_strict" ], [ "", "avahi_entry_group_get_state" ], [ "", "ntohs" ], [ "", "pthread_mutexattr_settype" ], [ "", "assert_fail" ], [ "", "poll" ], [ "", "syslog" ], [ "", "avahi_string_list_add" ], [ "", "pthread_mutex_unlock" ], [ "", "avahi_client_errno" ], [ "", "strcspn" ], [ "", "stderr" ], [ "", "avahi_strdup_printf" ], [ "", "avahi_entry_group_commit" ], [ "", "avahi_string_list_serialize" ], [ "", "avahi_alternative_service_name" ], [ "", "pthread_self" ], [ "", "pthread_mutexattr_init" ], [ "", "socketpair" ], [ "", "avahi_record_browser_new" ], [ "", "avahi_simple_poll_dispatch" ], [ "", "htons" ], [ "", "pthread_mutex_destroy" ], [ "", "pthread_mutex_lock" ], [ "", "errno_location" ], [ "", "avahi_simple_poll_set_func" ], [ "", "avahi_string_list_free" ], [ "", "avahi_domain_browser_new" ], [ "", "pthread_mutex_init" ], [ "", "avahi_client_get_host_name" ], [ "", "strlen" ], [ "", "strchr" ], [ "", "avahi_service_resolver_new" ], [ "", "avahi_entry_group_new" ], [ "", "avahi_simple_poll_run" ], [ "", "pthread_join" ], [ "", "avahi_simple_poll_wakeup" ], [ "", "register_frame_info" ], [ "", "close" ] ], "sec": [ [ ".note.gnu.property", 680, 48, 1.94, "alloc" ], [ ".note.gnu.build-id", 728, 36, 4.06, "alloc" ], [ ".gnu.hash", 768, 408, 4.07, "alloc" ], [ ".dynsym", 1176, 2880, 1.55, "alloc" ], [ ".dynstr", 4056, 2297, 4.64, "alloc" ], [ ".rela.dyn", 6360, 2232, 1.5, "alloc" ], [ ".relr.dyn", 8592, 24, 0.98, "alloc" ], [ ".init", 12288, 3, 1.58, "alloc,executable" ], [ ".text", 12304, 11910, 6.08, "alloc,executable" ], [ ".fini", 24214, 3, 1.58, "alloc,executable" ], [ ".rodata", 24576, 2400, 4.84, "alloc" ], [ ".eh_frame_hdr", 26976, 428, 4.74, "alloc" ], [ ".eh_frame", 27408, 2732, 4.97, "alloc" ], [ ".init_array", 31520, 8, 1.06, "write,alloc" ], [ ".fini_array", 31528, 8, 1.06, "write,alloc" ], [ ".dynamic", 31536, 464, 1.29, "write,alloc" ], [ ".got", 32000, 768, 0.03, "write,alloc" ], [ ".data", 32768, 8, 0.54, "write,alloc" ], [ ".comment", 32776, 28, 3.99, "merge,strings" ], [ ".shstrtab", 32804, 203, 4.17, "" ] ], "metrics": { "elf": { "bits": 64.0, "entry": 0.0, "has_got": 1.0, "has_plt": 0.0, "has_note": 1.0, "note_count": 2.0, "nx_enabled": 1.0, "has_dt_relr": 1.0, "dynrel_count": 0.0, "dynsym_count": 120.0, "has_build_id": 1.0, "has_eh_frame": 1.0, "has_gnu_hash": 1.0, "stack_canary": 1.0, "symtab_count": 0.0, "dynrela_count": 93.0, "little_endian": 1.0, "dt_flags_1_raw": 1.0, "pltreloc_count": 0.0, "build_id_length": 20.0, "executable_stack": 0.0, "fini_array_count": 1.0, "init_array_count": 1.0, "wx_segment_count": 0.0, "comment_entry_count": 1.0, "program_header_count": 11.0, "comment_distinct_count": 1.0, "gnu_stack_section_absent": 0.0, "load_segment_max_file_size": 11929.0, "stripped_but_symtab_present": 0.0, "load_segment_max_memory_size": 11929.0, "section_relocation_group_count": 1.0, "stripped_metadata_section_count": 7.0 }, "file": { "size": 34416.0, "entropy": 4.62, "size_bytes": 34416.0 }, "binary": { "is_pie": 0.0, "has_overlay": 1.0, "is_stripped": 1.0, "code_entropy": 6.07, "data_entropy": 0.51, "overlay_size": 1409.0, "string_count": 188.0, "overlay_ratio": 0.04, "overall_entropy": 4.62, "overlay_entropy": 1.33, "entropy_variance": 3.22, "avg_string_length": 17.97, "max_string_length": 134.0, "code_to_data_ratio": 0.9, "string_length_stddev": 13.5, "largest_section_ratio": 0.35, "sentence_string_count": 12.0, "sentence_string_ratio": 0.06, "high_entropy_string_count": 0.0 }, "exports": { "count": 31.0 }, "imports": { "count": 88.0 }, "sections": { "count": 22.0, "code_size": 11916.0, "entropy_max": 6.08, "entropy_mean": 2.73, "name_entropy": 4.12, "writable_count": 6.0, "executable_count": 3.0, "nonstandard_count": 5.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 3.0 } } }, "id": 1, "mol": "H(Cm)Md(He)", "path": "/data/samples/unknown/foraged/alpine/alpinelinux.org/_/avahi-compat-libdns_sd/avahi-compat-libdns_sd-0.9_rc4-r1.apk!!usr/lib/libdns_sd.so.1.0.0", "risk": 3, "sha": "5a156d2be3b43fa85819781221d867f5733e8f187d956469ca00348dbd42f217", "size": 34416, "traits": [ { "id": "micro-behaviors/communications/ip/parse::ntohs-symbol", "conf": 0.6600000262260437, "crit": 3, "desc": "Converts network to host short", "spans": [ [ 5559, 5 ] ] }, { "id": "micro-behaviors/fs/file/write/direct::write--write", "conf": 0.6600000262260437, "crit": 2, "desc": "Write files (write)", "spans": [ [ 4402, 5 ] ] }, { "id": "micro-behaviors/dylib/library/libc::libc-characteristic-cxa-finalize", "crit": 2, "desc": "libc characteristic cxa finalize", "spans": [ [ 4119, 12 ] ] }, { "id": "micro-behaviors/fs/file/read::read", "conf": 0.699999988079071, "crit": 2, "desc": "Read file descriptor (read/pread)", "spans": [ [ 4192, 4 ] ] }, { "id": "micro-behaviors/communications/ip/parse::htons-symbol", "conf": 0.6600000262260437, "crit": 3, "desc": "Converts host to network short", "spans": [ [ 4673, 5 ] ] }, { "id": "micro-behaviors/communications/socket/multiplex::poll-multiplex", "crit": 3, "desc": "poll() I/O multiplexing", "spans": [ [ 4278, 4 ] ] }, { "id": "metadata/hardening/missing::stripped-binary", "conf": 0.800000011920929, "crit": 3, "desc": "No full symbol table (likely stripped)", "spans": [ [ 0, 25 ] ] }, { "id": "micro-behaviors/fs/file/binary::file-read-operation", "atk": "T1005", "conf": 0.75, "crit": 1, "desc": "File read operation", "spans": [ [ 4192, 4 ] ] }, { "id": "micro-behaviors/fs/file/write/direct::write", "conf": 0.6600000262260437, "crit": 2, "desc": "Write files", "spans": [ [ 4402, 5 ] ] }, { "id": "micro-behaviors/dylib/library/libc::libc-internal-functions-b", "conf": 0.699999988079071, "crit": 2, "desc": "libc internal symbols cluster B", "spans": [ [ 4119, 12 ] ] }, { "id": "micro-behaviors/dylib/library/abi-graphics::cxx-abi-symbols-a", "conf": 0.800000011920929, "crit": 2, "desc": "C++ ABI symbols cluster A", "spans": [ [ 4119, 12 ] ] }, { "id": "micro-behaviors/dylib/library/family::cxx-abi-symbols", "conf": 0.800000011920929, "crit": 2, "desc": "C++ ABI symbols", "spans": [ [ 4119, 12 ] ] } ], "type": "elf" }, { "ctx": [ { "b": "boPG/zE)\u0026%By!#9vTf88vS=y3wfrVXf/Q^tuVGThePJJ", "ln": 1, "addr": 0 }, { "b": "boRbIx(mMaw)]E^A=k(raA?spB7]MgatCG8h.D\u0026", "ln": 2, "addr": 36 }, { "b": "Abf97vqPM#jS[fRvq6vbv@Dj6vrs8qx\u003c$Q\u003cB6\u003c00", "ln": 3, "addr": 68 }, { "b": "Abf9fwPw[RattAduVGTkePJM", "ln": 4, "addr": 101 }, { "b": "Abf8%wPIu7jS)BjvSC)$x\u003equdw]zYjl2Z^VwGTrTzFB9jAV/i!pe+54B8V5nwmY^7v@Dj6vrui)x(4H9C(", "ln": 5, "addr": 121 }, { "b": "B-IpvjS[AWBz#pZfe4J[Cp)rEvq6vcz/PFz", "ln": 6, "addr": 187 }, { "b": "B7]@iauZ\u00266g=c{B", "ln": 9, "addr": 297 }, { "b": "vrb\u003c\u003eauZ\u0026(i5Ub4gY", "ln": 10, "addr": 310 }, { "b": "z/PM8x(k4RayPC4xLv", "ln": 11, "addr": 324 }, { "b": "v@Dj3x(\u003eEXatV2lf/JVNh.WiGgb7K{whDn2gb--0wmELUgb}iFw\u0026scNhz^fAf-", "ln": 12, "addr": 339 }, { "b": "zddc@Byw)3wPw[RawMu!vqYH+y-(8-Aa6\u003eKzEWQ7vl!mqAa%i3y?W^fCRi]PxfD", "ln": 13, "addr": 389 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 705.0, "entropy": 5.22, "size_bytes": 705.0 }, "binary": { "overall_entropy": 5.22 } } }, "id": 2, "path": "/data/samples/unknown/foraged/alpine/alpinelinux.org/_/avahi-compat-libdns_sd/avahi-compat-libdns_sd-0.9_rc4-r1.apk!!.PKGINFO", "risk": 1, "sha": "90e8221ee3a82b29dd5611a6a6dac3640125e300080bf759ceff2fa02c077767", "size": 705, "traits": [ { "id": "metadata/package/files/system-package::alpine-pkginfo-origin-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package origin field", "spans": [ [ 324, 14 ] ] }, { "id": "metadata/package/files/system-package::arch-pkgname-field", "conf": 0.9399999976158142, "crit": 1, "desc": "Arch pkgname metadata field", "spans": [ [ 68, 32 ] ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-basename", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package info file" }, { "id": "metadata/package/files/system-package::alpine-pkginfo-package-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package name field", "spans": [ [ 68, 32 ] ] }, { "id": "metadata/package/files/system-package::arch-pkgver-field", "conf": 0.9399999976158142, "crit": 1, "desc": "Arch pkgver metadata field", "spans": [ [ 101, 19 ] ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-version-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package version field", "spans": [ [ 101, 19 ] ] }, { "id": "metadata/package/files/system-package::alpine-apk-pkginfo", "conf": 0.9700000286102295, "crit": 2, "desc": "Alpine/Wolfi package info metadata", "spans": [ [ 68, 32 ], [ 101, 19 ], [ 324, 14 ] ] } ], "type": "text" } ], "rev": "b520a", "v": "8" } }