{
  "ml": {
    "v": "7",
    "eng": "2.2.0-rc.1",
    "lvl": -1,
    "conf": 0,
    "mods": [
      {
        "cls": 0,
        "raw": 0.00005008777,
        "rte": "az",
        "prob": 0.00005008777
      }
    ],
    "prob": 0.00006702542,
    "files": [
      {
        "id": 0,
        "lvl": -1,
        "conf": 0,
        "prob": 0.00006702542304992676,
        "type": "zst"
      },
      {
        "id": 1,
        "lvl": -1,
        "conf": 0,
        "prob": 0.00006702542304992676,
        "type": "elf"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-06-28T00:15:17Z"
  },
  "path": "ivtv-alsa.ko.zst",
  "raw": {
    "files": [
      {
        "id": 0,
        "ctx": [
          {
            "b": "d77-bQ\u003e%%f0cz]Pi^J4\u003elR%.31cx34hHe#+lp%ciV\u0026",
            "n": [
              {
                "c": 2,
                "d": "Binary is not digitally signed",
                "i": "metadata/unsigned",
                "o": 0,
                "z": 1,
                "cf": 1.0
              }
            ],
            "ln": 0
          }
        ],
        "mol": "O₂(AsC)",
        "sha": "10ed4089be2110489cbc33bc0d55aa9b1d366c16bb181334fbe862c0bcfa9d4b",
        "path": "ivtv-alsa.ko.zst",
        "risk": 3,
        "size": 30901,
        "type": "zst",
        "facts": {
          "metrics": {
            "file": {
              "size": 30901.0,
              "entropy": 7.99,
              "size_bytes": 30901.0
            },
            "binary": {
              "overall_entropy": 7.99,
              "peak_region_bytes": 30720.0,
              "peak_region_entropy": 7.84
            }
          }
        },
        "traits": [
          {
            "id": "metadata/build/artifact::elf-stripped-but-symtab-present",
            "conf": 0.6000000238418579,
            "crit": 3,
            "desc": "ELF stripped with .symtab present",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/ip/literal::external-ipv4-binary",
            "conf": 0.8500000238418579,
            "crit": 2,
            "desc": "Hardcoded external IPv4 address",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "metadata/package/license::gpl-word",
            "conf": 0.699999988079071,
            "crit": 2,
            "desc": "GPL license reference",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "objectives/command-and-control/channel/redundancy::multi-channel-diversity",
            "atk": "T1071",
            "mbc": "B0030",
            "conf": 0.8500000238418579,
            "crit": 3,
            "desc": "C2 infrastructure using multiple communication methods",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "objectives/anti-static/obfuscation/payload/code-in-data::nop-sled-in-data",
            "conf": 0.6499999761581421,
            "crit": 3,
            "desc": "Repeated NOP-run pattern in executable section",
            "from": [
              {
                "file": 1
              }
            ]
          }
        ]
      },
      {
        "ctx": [
          {
            "b": "E))420S-r400000000000rtp-0rr9100000000000000000000{\u003cr8x0000000000kMy=:002m:d/.4000000000",
            "n": [
              {
                "c": 3,
                "d": "Recognized XOR-loop byte-pattern marker",
                "i": "objectives/anti-analysis/self-modify/runtime::xor-loop-pattern-recognized-marker",
                "o": 0,
                "z": 12,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 0
          },
          {
            "b": "00000000000000000000KDtM=KDtM=KDtM=KDtM=\u003eL$O.07.?zBxIQmItfR#\u003cW+3\u003c2Uo(*Ko2sYnqm7=av}zbnqkGl3Rnr\u0026Fii/i00000nqP!g\u003eL$O.07-1",
            "n": [
              {
                "c": 3,
                "d": "Repeated NOP-run pattern in executable section",
                "i": "objectives/anti-static/obfuscation/payload/code-in-data::nop-sled-in-data",
                "o": 168,
                "z": 47,
                "cf": 0.6499999761581421
              }
            ],
            "ln": 152
          },
          {
            "b": "d*k[M000K-W/uydt11k9sZaf%l0V=.t}%+Z:UAGz%3XVTmkq{G00000g4{EunxnNE0000\u0026-@",
            "n": [
              {
                "c": 3,
                "d": "Dotted-quad PE version metadata marker",
                "i": "objectives/command-and-control/infrastructure/ip::ipv4-version-metadata-marker",
                "o": 2692,
                "z": 9,
                "cf": 0.9399999976158142
              }
            ],
            "ln": 2676
          },
          {
            "b": "zAPZbg+HM:y?Wx\u003czGxwLm]h\u003eVwmY*(A+PGmx(v(LlS=91g+*\u003cvlS=91g+*)hk$\u003eh",
            "n": [
              {
                "c": 3,
                "d": "Terminal socket exec helper context",
                "i": "micro-behaviors/process/fd/dup::unix-terminal-socket-exec-benign-context",
                "o": 6102,
                "z": 3,
                "cf": 0.949999988079071
              }
            ],
            "ln": 6086
          },
          {
            "b": "B98ClvqPv]zFTl3yxdZGB97\u00262yHpN+yHpWZx(0=\u003cBAhnnwO}GZC64[mv@bN/zc}vaA+eV@0af8QvSI",
            "n": [
              {
                "c": 3,
                "d": "Stack protector/canary enabled",
                "i": "metadata/hardening/build::stack-protector",
                "o": 7453,
                "z": 14,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 7437
          },
          {
            "b": "zddJ@xKtpYB7kh[g\u0026a{OvrlZiv{-.:zF\u003c2}BzkVh0ax}UuUaa%A^mT[B7nM#BZ!()C3!/#BAhTbB]",
            "n": [
              {
                "c": 2,
                "d": "async_connect function",
                "i": "micro-behaviors/os/event/library/boost-asio::async-connect",
                "o": 73172,
                "z": 13,
                "cf": 0.4000000059604645
              }
            ],
            "ln": 73156
          }
        ],
        "depth": 1,
        "facts": {
          "exp": [
            [
              "this_module"
            ],
            [
              "cleanup_module"
            ],
            [
              "init_module"
            ],
            [
              "pfx_snd_ivtv_pcm_create"
            ],
            [
              "pfx_init_module"
            ],
            [
              "snd_ivtv_pcm_create"
            ],
            [
              "pfx_cleanup_module"
            ],
            [
              "ivtv_alsa_debug"
            ]
          ],
          "imp": [
            [
              "",
              "ivtv_start_v4l2_encode_stream"
            ],
            [
              "",
              "driver_find"
            ],
            [
              "",
              "snprintf"
            ],
            [
              "",
              "snd_pcm_new"
            ],
            [
              "",
              "snd_card_register"
            ],
            [
              "",
              "snd_card_free"
            ],
            [
              "",
              "param_array_ops"
            ],
            [
              "",
              "memcpy"
            ],
            [
              "",
              "kfree"
            ],
            [
              "",
              "raw_spin_lock_irqsave"
            ],
            [
              "",
              "fentry__"
            ],
            [
              "",
              "ivtv_release_stream"
            ],
            [
              "",
              "printk"
            ],
            [
              "",
              "ref_stack_chk_guard"
            ],
            [
              "",
              "snd_pcm_stream_unlock"
            ],
            [
              "",
              "stack_chk_fail"
            ],
            [
              "",
              "strnlen"
            ],
            [
              "",
              "ivtv_claim_stream"
            ],
            [
              "",
              "ubsan_handle_out_of_bounds"
            ],
            [
              "",
              "sized_strscpy"
            ],
            [
              "",
              "snd_card_new"
            ],
            [
              "",
              "random_kmalloc_seed"
            ],
            [
              "",
              "mutex_lock"
            ],
            [
              "",
              "ivtv_stop_v4l2_encode_stream"
            ],
            [
              "",
              "snd_pcm_set_ops"
            ],
            [
              "",
              "fortify_panic"
            ],
            [
              "",
              "raw_spin_unlock_irqrestore"
            ],
            [
              "",
              "snd_pcm_set_managed_buffer_all"
            ],
            [
              "",
              "x86_return_thunk"
            ],
            [
              "",
              "snd_pcm_hw_constraint_integer"
            ],
            [
              "",
              "snd_pcm_stream_lock"
            ],
            [
              "",
              "mutex_unlock"
            ],
            [
              "",
              "driver_for_each_device"
            ],
            [
              "",
              "kmalloc_cache_noprof"
            ],
            [
              "",
              "ivtv_init_on_first_open"
            ],
            [
              "",
              "snd_pcm_period_elapsed"
            ],
            [
              "",
              "param_ops_int"
            ],
            [
              "",
              "ivtv_ext_init"
            ],
            [
              "",
              "pci_bus_type"
            ],
            [
              "",
              "kmalloc_caches"
            ]
          ],
          "sec": [
            [
              "__patchable_function_entries",
              64,
              104,
              0.0,
              "write,alloc"
            ],
            [
              ".rela__patchable_function_entries",
              88592,
              312,
              1.26,
              "info_link"
            ],
            [
              ".text",
              168,
              3146,
              5.03,
              "alloc,executable"
            ],
            [
              ".rela.text",
              88904,
              4248,
              2.49,
              "info_link"
            ],
            [
              ".data",
              3320,
              288,
              2.46,
              "write,alloc"
            ],
            [
              ".rela.data",
              93152,
              144,
              1.27,
              "info_link"
            ],
            [
              ".rodata",
              3608,
              1904,
              4.69,
              "alloc"
            ],
            [
              ".rela.rodata",
              93296,
              168,
              1.27,
              "info_link"
            ],
            [
              ".comment",
              5512,
              156,
              4.05,
              "merge,strings"
            ],
            [
              ".init.text",
              5672,
              58,
              2.62,
              "alloc,executable"
            ],
            [
              ".rela.init.text",
              93464,
              144,
              2.05,
              "info_link"
            ],
            [
              "__mcount_loc",
              5730,
              88,
              0.0,
              "alloc"
            ],
            [
              ".rela__mcount_loc",
              93608,
              264,
              1.35,
              "info_link"
            ],
            [
              ".exit.text",
              5824,
              235,
              3.76,
              "alloc,executable"
            ],
            [
              ".rela.exit.text",
              93872,
              456,
              1.99,
              "info_link"
            ],
            [
              ".exit.data",
              6064,
              8,
              0.0,
              "write,alloc"
            ],
            [
              ".rela.exit.data",
              94328,
              24,
              0.5,
              "info_link"
            ],
            [
              ".init.data",
              6072,
              8,
              0.0,
              "write,alloc"
            ],
            [
              ".rela.init.data",
              94352,
              24,
              0.5,
              "info_link"
            ],
            [
              ".modinfo",
              6080,
              509,
              5.28,
              "alloc"
            ],
            [
              "__param",
              6592,
              120,
              0.53,
              "alloc"
            ],
            [
              ".rela__param",
              94376,
              288,
              1.11,
              "info_link"
            ],
            [
              ".note.package",
              6712,
              216,
              4.73,
              "alloc"
            ],
            [
              ".smp_locks",
              6928,
              12,
              0.0,
              "alloc"
            ],
            [
              ".rela.smp_locks",
              94664,
              72,
              1.29,
              "info_link"
            ],
            [
              ".return_sites",
              6940,
              72,
              0.0,
              "alloc"
            ],
            [
              ".rela.return_sites",
              94736,
              432,
              1.56,
              "info_link"
            ],
            [
              ".call_sites",
              7012,
              316,
              0.0,
              "alloc"
            ],
            [
              ".rela.call_sites",
              95168,
              1896,
              1.77,
              "info_link"
            ],
            [
              ".note.gnu.build-id",
              7328,
              36,
              4.25,
              "alloc"
            ],
            [
              "__version_ext_names",
              7368,
              726,
              4.34,
              "alloc"
            ],
            [
              "__version_ext_crcs",
              8096,
              164,
              6.65,
              "alloc"
            ],
            [
              "__versions",
              8264,
              2624,
              2.63,
              "alloc"
            ],
            [
              ".gnu.linkonce.this_module",
              10888,
              1280,
              0.08,
              "write,alloc"
            ],
            [
              ".rela.gnu.linkonce.this_module",
              97064,
              48,
              1.05,
              "info_link"
            ],
            [
              ".note.Linux",
              12168,
              48,
              1.97,
              "alloc"
            ],
            [
              ".BTF",
              12216,
              71571,
              5.26,
              ""
            ],
            [
              ".symtab",
              83792,
              2904,
              1.84,
              ""
            ],
            [
              ".strtab",
              86696,
              1890,
              4.58,
              ""
            ],
            [
              ".shstrtab",
              97112,
              413,
              4.3,
              ""
            ]
          ],
          "metrics": {
            "elf": {
              "bits": 64.0,
              "entry": 0.0,
              "has_got": 0.0,
              "has_plt": 0.0,
              "has_note": 1.0,
              "has_symtab": 1.0,
              "note_count": 3.0,
              "nx_enabled": 1.0,
              "dynrel_count": 0.0,
              "dynsym_count": 0.0,
              "has_eh_frame": 0.0,
              "stack_canary": 1.0,
              "symtab_count": 121.0,
              "dynrela_count": 0.0,
              "little_endian": 1.0,
              "pltreloc_count": 0.0,
              "executable_stack": 0.0,
              "wx_segment_count": 0.0,
              "comment_entry_count": 4.0,
              "program_header_count": 0.0,
              "comment_distinct_count": 1.0,
              "gnu_stack_section_absent": 0.0,
              "load_segment_max_file_size": 0.0,
              "stripped_but_symtab_present": 1.0,
              "load_segment_max_memory_size": 0.0,
              "section_relocation_group_count": 14.0,
              "stripped_metadata_section_count": 5.0
            },
            "file": {
              "size": 101001.0,
              "entropy": 4.96,
              "size_bytes": 101001.0
            },
            "binary": {
              "is_pie": 0.0,
              "has_overlay": 1.0,
              "is_stripped": 0.0,
              "code_entropy": 4.9,
              "data_entropy": 0.48,
              "overlay_size": 3476.0,
              "string_count": 1761.0,
              "overlay_ratio": 0.03,
              "avg_complexity": 2.1,
              "max_complexity": 18.0,
              "huge_func_count": 0.0,
              "leaf_func_count": 14.0,
              "overall_entropy": 4.96,
              "overlay_entropy": 3.16,
              "tiny_func_count": 20.0,
              "avg_basic_blocks": 3.77,
              "entropy_variance": 3.47,
              "avg_string_length": 16.77,
              "max_string_length": 90.0,
              "peak_region_bytes": 649.0,
              "code_to_data_ratio": 0.67,
              "total_basic_blocks": 117.0,
              "peak_region_entropy": 7.57,
              "string_length_stddev": 8.96,
              "largest_section_ratio": 0.71,
              "sentence_string_count": 31.0,
              "sentence_string_ratio": 0.02,
              "high_entropy_string_count": 0.0
            },
            "exports": {
              "count": 8.0
            },
            "imports": {
              "count": 40.0
            },
            "sections": {
              "count": 43.0,
              "code_size": 3439.0,
              "entropy_max": 6.65,
              "entropy_mean": 2.21,
              "name_entropy": 4.21,
              "writable_count": 6.0,
              "executable_count": 3.0,
              "nonstandard_count": 35.0,
              "executable_writable_count": 0.0
            },
            "functions": {
              "count": 31.0
            },
            "dependencies": {
              "count": 0.0
            }
          }
        },
        "id": 1,
        "mol": "O₂(AsC)",
        "path": "ivtv-alsa.ko.zst!!ivtv-alsa.ko",
        "risk": 3,
        "sha": "15c6e7d89a71e2147ca5c59c65378d291a5b216cf7b7e0048b2ee22423e75d98",
        "size": 101001,
        "traits": [
          {
            "id": "metadata/build/artifact::elf-stripped-but-symtab-present",
            "conf": 0.6000000238418579,
            "crit": 3,
            "desc": "ELF stripped with .symtab present",
            "spans": [
              [
                0,
                38
              ]
            ]
          },
          {
            "id": "metadata/package/license::gpl-word",
            "conf": 0.699999988079071,
            "crit": 2,
            "desc": "GPL license reference",
            "spans": [
              [
                6102,
                3
              ]
            ]
          },
          {
            "id": "objectives/anti-static/obfuscation/payload/code-in-data::nop-sled-in-data",
            "conf": 0.6499999761581421,
            "crit": 3,
            "desc": "Repeated NOP-run pattern in executable section",
            "spans": [
              [
                168,
                47
              ]
            ]
          },
          {
            "id": "micro-behaviors/communications/ip/literal::external-ipv4-binary",
            "conf": 0.8500000238418579,
            "crit": 2,
            "desc": "Hardcoded external IPv4 address",
            "spans": [
              [
                2692,
                9
              ]
            ]
          },
          {
            "id": "objectives/command-and-control/channel/redundancy::multi-channel-diversity",
            "atk": "T1071",
            "mbc": "B0030",
            "conf": 0.8500000238418579,
            "crit": 3,
            "desc": "C2 infrastructure using multiple communication methods",
            "spans": [
              [
                2692,
                9
              ]
            ]
          }
        ],
        "type": "elf"
      }
    ],
    "rev": "46112",
    "v": "8"
  }
}