{ "ml": { "v": "7", "eng": "2.12.0-beta.1", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.019210598, "rte": "az", "prob": 0.019210598 }, { "cls": 0, "raw": 0.0154132545, "rte": "az/tar", "prob": 0.0154132545 } ], "prob": 0.019210598, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.01921059750020504, "type": "apk_alpine" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.000012894471183244605, "type": "json" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.000014781951904296875, "type": "elf" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.000017523765563964844, "type": "yaml" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.000013977289199829102, "type": "text" }, { "id": 5, "lvl": -1, "conf": 0, "prob": 0.000013232231140136719, "type": "registry" } ], "version": "v18.18", "analyzed_at": "2026-09-23T02:23:55Z" }, "path": "php-8.3-exif-8.3.35-r0.apk", "raw": { "files": [ { "id": 0, "mol": "K(Li)O(As)H₂(F₃Os)Md₂(Pa₂)", "sha": "139fad3f47806f00237b5d1c37edf96cb234158db5667a3e2ed238c2a89927aa", "path": "php-8.3-exif-8.3.35-r0.apk", "risk": 8, "size": 59020, "type": "apk_alpine", "facts": { "metrics": { "apk": { "signed": 0, "subpackage": 1, "depend_count": 5, "declared_size": 150210 }, "file": { "size": 59020, "entropy": 7.99 }, "binary": { "peak_region_bytes": 55948, "peak_region_entropy": 7.82 } } }, "ident": { "name": { "value": "php-8.3-exif", "source": "apk.pkgname", "verified": false }, "trust": "unsigned", "emails": [ "wolfi" ], "authors": [ { "role": "maintainer", "email": "wolfi", "source": "apk.maintainer" } ], "project": { "value": "php-8.3", "source": "apk.origin", "verified": false }, "version": { "value": "8.3.35-r0", "source": "apk.pkgver", "verified": false }, "producer": { "value": "melange", "source": "apk.builder", "verified": false }, "unique_ids": { "vcs_commit": "415185f0d2f1e1f40a29f994198e16ad2b89bda6", "apk_datahash": "5959137d868f11e32ead58a818a387f4193eceb963d906a7e2db74b00968066a" } }, "traits": [ { "id": "metadata/package/files/system-package::alpine-apk-pkginfo", "conf": 0.97, "crit": 2, "desc": "Alpine/Wolfi package info metadata", "from": [ { "off": 93, "file": 4, "line": 6 } ], "uses": [ 12, 15, 16, 17 ] }, { "id": "micro-behaviors/fs/file/stat::stat-core", "conf": 0.8, "crit": 3, "desc": "References stat-family file-status API", "from": [ { "file": 2 } ] }, { "id": "metadata/package/files/system-package::melange-pkginfo-generator", "conf": 0.9, "crit": 3, "desc": "Melange-generated package metadata", "from": [ { "file": 4 } ] }, { "id": "metadata/package/files/system-package::wolfi-pkginfo-maintainer", "conf": 0.9, "crit": 3, "desc": "Wolfi package maintainer field", "from": [ { "file": 4 } ] }, { "id": "metadata/package/files/system-package::spdx-wolfi-apk-purl", "conf": 0.9, "crit": 3, "desc": "Wolfi APK package URL in SPDX", "from": [ { "file": 1 } ] }, { "id": "well-known/lib/runtime/scripted/php-runtime::runtime-lib-path", "conf": 0.96, "crit": 3, "desc": "PHP runtime library path", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/os/service/daemon::apache2", "conf": 0.7, "crit": 3, "desc": "apache2 daemon reference" }, { "id": "metadata/package/files/dependency::os-image-root-file-path", "conf": 0.94, "crit": 3, "desc": "Root-level OS directory path", "from": [ { "file": 2 } ] }, { "id": "metadata/package/files/system-package::spdx-sbom-document", "conf": 0.98, "crit": 2, "desc": "SPDX SBOM document", "from": [ { "file": 1 } ], "uses": [ 14, 20 ] }, { "id": "metadata/lang/natural::lang-english--atom-6", "conf": 0.8, "crit": 1, "desc": "English function-word token \"with\"", "from": [ { "file": 2 } ] }, { "id": "metadata/lang/natural::lang-english--atom-4", "conf": 0.8, "crit": 1, "desc": "English function-word token \"have\"", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/fs/path/location::hardcoded-home-dir-path", "conf": 0.8, "crit": 3, "desc": "Hardcoded absolute home directory path" }, { "id": "metadata/package/files/system-package::alpine-pkginfo-basename", "conf": 0.9, "crit": 2, "desc": "Alpine/Wolfi package info file" }, { "id": "objectives/anti-static/obfuscation/payload/encrypted::aes-key-field-token", "atk": "T1573.001,T1027", "mbc": "C0027", "conf": 0.8, "crit": 3, "desc": "AES or generic key field name", "from": [ { "file": 2 } ] }, { "id": "metadata/package/files/system-package::spdx-document-id", "conf": 0.9, "crit": 3, "desc": "SPDX document identifier" }, { "id": "metadata/package/files/system-package::alpine-pkginfo-package-field", "conf": 0.9, "crit": 2, "desc": "Alpine/Wolfi package name field", "from": [ { "file": 4 } ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-origin-field", "conf": 0.9, "crit": 3, "desc": "Alpine/Wolfi package origin field", "from": [ { "file": 4 } ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-version-field", "conf": 0.9, "crit": 2, "desc": "Alpine/Wolfi package version field", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/fs/directory/mkdir::mkdir-command", "conf": 0.8, "crit": 3, "desc": "Shell invokes mkdir command" }, { "id": "metadata/package/files/system-package::spdx-apk-pkginfo-source", "conf": 0.9, "crit": 3, "desc": "SPDX references APK DB package info", "from": [ { "file": 1 } ] }, { "id": "metadata/package/files/system-package::spdx-document-version", "conf": 0.9, "crit": 3, "desc": "SPDX document version field" }, { "id": "metadata/file/format/structured::spdx-bom-document", "conf": 0.97, "crit": 3, "desc": "SPDX software bill of materials", "from": [ { "file": 1 } ] }, { "id": "metadata/package/files/system-package::alpine-versioned-apk-filename", "conf": 0.9, "crit": 3, "desc": "Alpine/Wolfi versioned apk package filename" }, { "id": "metadata/file/naming::archive-member-over-200kb", "conf": 0.9, "crit": 3, "desc": "Archive has member larger than 200 KB" }, { "id": "metadata/file/naming::archive-member-under-10kb", "conf": 0.9, "crit": 3, "desc": "Archive has a sub-10KB member" } ] }, { "ctx": [ { "b": "DKp(rb6dZlCVFx@B7]Mgb03?\u003cq=2\u003e:eIX}ma$K6zar\u003eu8Byv\u003cSv}xL0wG\u003ceTb11ZKeIO\u003eia$K6zar\u003c-Xl%92Gb03?\u003cq=2\u003e:qE%C(l@cfIo*}/Ra$K6zar\u003eYizdK[Lar\u003elkyB%HsA4K44gC9f.x\u003ew}Re\u0026baoh7-\u00265a$K6zar\u003eumv%8T1zGFSZzdN^cvpJ\u003c)iS", "ln": 0, "col": 1, "line": 1 }, { "b": "vru6[z/QaEiV]Ryk%[phm[217k#6Zomn+rX3lQDlarR^HarR^JA+e\u0026]A+fb#wMi}]wG\u003ceTb5?WBy:7zqarR^HarR^HarR\u003eGwObH]wO#0?oMaAHBz(gziV]R=yIbXpAbdaJz!%31fk$PzeJtvseOffvw\u003cwsdgCgEvePJKfvrb\u003c\u003ej:n}AuP6-CBUCH8hE{JyBAhp.Cw?qfx^9)barR^HarR!P3lQDlarR!jed9HxarR^Hb5?NpzddEgp*)\u003cHvp%dFB-ICtB7DKRar\u003c9Fp!TCFk#ZAKp9H2/arR!Ped9HxarV1rarR^HarR\u003eCvqPN1iV]R=xMbK.e\u0026bb9vqP*8ed9HxarR^", "ln": 1315, "col": 22, "line": 41 }, { "b": "pEd]Tmn^8RpFJ8+3lQDlarR^Jw[=6)B3TXLy\u003cytrwfK5Sw)]H%wH[fharR^Har\u003e(BB-H#6nP5cUb03?\u003cvpKq1x(W=}aAg+0yHH\u003c!azC.9zY\u0026Ujz/3Q.p!I{0lolkxe(khhnLR-Ja$K6zarR^Har\u003eSov}xL0wKyxNv@co#wN(#Car\u003cMRk#QYJqDcj-p9Ij@arR^HarR\u003eAx\u003e7Z(B7E:Jv@bN]wN(#Car\u003cSMp+sEQfFK+53lQDlarR^Jv@DsiA+Pf1Bw#*@BrS:*b2g{1q=ua.r7P\u003eXa$K6zarR^Har\u003euc", "ln": 3240, "col": 29, "line": 91 }, { "b": "vru6[z/QaEiV]Ryk%[phm[217k#6Zomn+rX3lQDlarR^HarR^JA+e\u0026]A+fb#wMi}]wG\u003ceTb5?WBy:7zqarR^HarR^HarR\u003eGwObH]wO#0?oMaAHBz(gziV]R=yIbXpAbdaJz!%31fk$PzeJtvseOffvw\u003cwsdgCgEvePJKfvrb\u003c\u003ej:n}AuP6-CBUCH8hG9RIxk8lDAa\u003chxi4^0h3lQDlarR^HaBKOtarR^Haybr%arR!Ped9HxarV1rarR^HarR\u003eCvqPN1iV]R=xMbK.e\u0026b7\u003cCXH+led9HxarR^Hb2.rasv\u003e[8iV]RBp^!z-wO9IZz!0{bwO#P/z/o.Hl${WMv@#TfC}A#Gz#", "ln": 3565, "col": 22, "line": 100 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 5250, "entropy": 5.15 }, "json": { "parsed_bytes": 5250, "parse_limit_bytes": 76800 }, "binary": { "peak_region_bytes": 5250, "peak_region_entropy": 5.21 } } }, "id": 1, "mol": "Md₂(Pa)", "path": "php-8.3-exif-8.3.35-r0.apk!!var/lib/db/sbom/php-8.3-exif-8.3.35-r0.spdx.json", "pid": 0, "risk": 2, "sha": "4958a0610dbb2f53f700d6ed0407fddb8907750667c0b94f18e4507c2e52b821", "size": 5250, "traits": [ { "id": "metadata/file/format/structured::spdx-bom-document", "conf": 0.97, "crit": 3, "desc": "SPDX software bill of materials", "spans": [ [ 4, 21 ] ] }, { "id": "metadata/package/files/system-package::spdx-apk-pkginfo-source", "conf": 0.9, "crit": 3, "desc": "SPDX references APK DB package info", "spans": [ [ 3304, 44 ] ] }, { "id": "metadata/package/files/system-package::spdx-document-id", "conf": 0.9, "crit": 3, "desc": "SPDX document identifier" }, { "id": "metadata/package/files/system-package::spdx-document-version", "conf": 0.9, "crit": 3, "desc": "SPDX document version field" }, { "id": "metadata/package/files/system-package::spdx-wolfi-apk-purl", "conf": 0.9, "crit": 3, "desc": "Wolfi APK package URL in SPDX", "spans": [ [ 1379, 83 ], [ 1410, 14 ], [ 3629, 85 ] ] }, { "id": "metadata/package/files/system-package::spdx-sbom-document", "conf": 0.98, "crit": 2, "desc": "SPDX SBOM document", "uses": [ 2, 3 ] } ], "type": "json" }, { "ctx": [ { "b": "E))420S-r400000000000@$H+0rr910000000000kMy=:00000Z[7Mb0000000000kMA+z3JJA(9SNhX0rr911onA4000000000000000000000000000000kXHb$00000kXHb", "ln": 0 }, { "b": "0rr91000000SSi2q2*N@0rr911][S60000000AMcq2*N@00000(ZOu400000000000000000000000000000000000fARpP5=.[i00000000000000000000r%eH65c8Xg00000000000000000000s{1:85c8Xg00000000000000000000/Ah9N5c8X", "ln": 672 }, { "b": "UMs!85c8Xg00000000000000000000F=#bO5=-su[B3tS000003\u0026*nc000000af8CzeTr0B97\u0026hByewPuRai\u003euU0.*wOkZ#By/F(o*--nzE(^QvR/PQuRai\u003euVGZ\u003cx(!xcA-t+2y\u0026si5raflLwDl7Av%zA?w[=c\u003ey?Xib0b#Q\u003cuUKy\u0026z^NE7x(n31BywR", "ln": 2640 }, { "b": "x(mL-DsZ#8uU%}4BzkifBy!/#vrcB2uUaa+z!9N1xj2E?B94y?wOb%]wDl7AB97\u00262yHpN+yHpWZx(0=*xMdr\u0026A=M8suU17+A+e?.DsZ#8uVGZ\u003cx(!xcA:JJ#x\u003cUB?BAh8bB6\u0026H60d5i]wm6v*xk8BewPzc]z/fh{v@DmaByx6e0d5i]wm6E%A+e($B97#luUKy(uU6", "ln": 2916 }, { "b": "Aa\u003ch$xjVg0zdd6*BA}?p0afXUA9)WdA+eV@uUjs\u0026wDl7Uvp\u003c7TwO\u003e\u003c(y\u0026r!-zdNM]AcRC2wO(H1Bo2VVB98CkB-mtbwO#3=C5}RwA+PAkw=MWVzeBimwDl^[A=bY8zua3PB98Cuwoz?\u003euVoW$uVQsfwNPB.By/o80afXUA9)WdA+eV@uVP^\u0026yxdZXxMds1BAg@3zc}r{vpPvHCYml{DsZ#8uVQg9A+PAkw=M)]A:@%90crm5zEWK50d5i]wm6g@y\u0026\u003cx2D30R8w[u6]xKts*v@C)(zF5@}wO#3=zfoVpx\u003c#vfwNx1^v@C)(zF9r^z/f-fA=+(k0b#Q\u003cuVQsfwNPB.B97@bz^NB4A@Zo6vrqGRAa\u003ch$B98ClvqPv:wPRzZAa\u003ch$vQTs?zEEx[0bVp:v@le+uVZsluT[1(C4CYouVZi[B98CpzF5@}C42h]Accbcwoq:g0b#Q\u003cuUj1*wNxm+uVp7dA+eV@0b#Q\u003cuUj1*wNxm+uVQsfwNPAQDsZ#8uUi\u003e\u003ev}Yj\u0026wPI^jA:@U", "ln": 3475 }, { "b": "vrcB2uTW$/uT^}(y*Rm1z*8g]wPRo@z!a0bwDlKXvQ?3iz.r{FwQ4{3e]$}hm[=GvlTIP3f/e(2oI4MruOTk\u0026gxo{snKt^Kga\u003ex-m[=GvlTIP3ga\u003eA:0000200000000000000000ic200000000000000200ri300000000000000000000000020000", "ln": 4079 }, { "b": "nP5cOzFsi703%rKgdD9XrDz.(lVl*UwO#O\u0026rDz.(lVl*UwO#PUzEWP}x(mL-lVl{?A+Pf1Bo1WDAcVFrxj#xtp?T=?z!B90Aa\u0026*607gWzD2^RixML\u003c}wncd7ASx6LB.$P9vqfKgmRMWIrc-B]090SOzdmx\u003ex(2y@x(dAXD2Nr{ra{z\u003evS2Q*y+wm\u0026x\u003eIa300", "ln": 66642 }, { "b": "wO#NcAZs.SvrhAEzddEbqEKDQwDkezAbP/uA+dNKvrkETy\u0026%p?mSh^By!OzTxlm/UzzKd!zanC:zddI^mq=QQD2N\u003etz/eiVC(Q]juS6x:lqg%lwO=A/zEWQ9A+e:5wN\u003e^xlsiRXm)Y)XC4CGhl3mo/09qG]qB:kzoL5xUy\u0026-f:y\u0026%PezEET9AXNL}lsiRXm)Y)XC4CGhnO\u0026i=ze0(@Bz(gP09qG]qB:kzoL5xUy\u0026.{VvpK6MlVl^VA.P$:A+P:#lJ", "ln": 70025 }, { "b": "wnb{]azCFaz/PA1iV]^@B0*}/mS\u0026-[xK#ibwQ4{3aAg+fB7]J8az2Olz/P[wxKM6}ayX[[zxK1yAbY\u0026eB8$]60000000000nO\u0026iOxjkQ0A+eV}y\u0026r/(BzkS9aA7\u003cmB-7-3w[=c]wftF#y?j-gwN/*@z/bKPlVm9-wft=dBrC7ize:StwGV5dDsXjq", "ln": 75420 }, { "b": "00000p\u0026yC!zGGP3y\u00261wtx(n95y?WA5wO#3)vqYT$B1wCQA^qwpxcpR}vqfQ4Cwhejay]g#w[u0]zGE1jzE^D\u0026zF\u003c3bB0a}6w]zZ3azCXfx(mH1BrCg7x(4{jwI9@.nO\u0026iOxjkQ0nK=8\u003cB7]@iiV{g2d\u003ccJ\u003cb}}eTdLSX3jS(C6b}}eTau*]4CQk42", "ln": 76196 }, { "b": "0rreo1onA42(\u003c@9000000SSnp1onA40@@r3000001onA4tMs:7EJ5jdmNQ2LDM)MSAaHjOb4kCaa$K{RB0rT?Cw?qfx^b8LzEEx[b03]!xMbK.e\u0026aX5b6EKrB7]Mgb03]ce\u0026baoh7-\u00265a$K{DA:@=%By!%7B-I4qiWe/dhEwv0b7fB\u003e0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", "ln": 79720 }, { "b": "000000000000000000000000000000000000000000000000000000000000FpmE#00000kZ\u0026Xk000000aV9g00000}VD{1000000000000000000000000000000000000aM3f000000r\u0026G700000000000000000000000000rr9100000Z*Nlz000002l+b", "ln": 83264 }, { "b": "l\u0026Wh!000000000000000j0K+a0000000000000005c8Xg0000000000000000rr9100000JrGpZ000004GDFe00000MJWu?000003\u0026*nc000000b}]r000004fcwd00000@o\u003cQ=0000082%Tp00000A76^c000008VP\u003cr000002MK\u00268000008uo:q00000", "ln": 97072 } ], "depth": 1, "facts": { "exp": [ [ "get_module" ] ], "imp": [ [ "", "free" ], [ "", "try_convert_to_string" ], [ "", "zend_vspprintf" ], [ "", "zend_multibyte_fetch_encoding" ], [ "", "add_assoc_zval_ex" ], [ "", "add_index_long" ], [ "", "zend_parse_parameters" ], [ "", "strncmp" ], [ "", "ITM_deregisterTMCloneTable" ], [ "", "php_image_type_to_mime_type" ], [ "", "ap_php_snprintf" ], [ "", "estrdup" ], [ "", "safe_emalloc" ], [ "", "php_stream_stdio_ops" ], [ "", "strlen" ], [ "", "stack_chk_fail" ], [ "", "php_info_print_table_row" ], [ "", "add_assoc_double_ex" ], [ "", "zend_parse_arg_str_slow" ], [ "", "zend_unregister_ini_entries_ex" ], [ "", "module_registry" ], [ "", "zend_wrong_parameters_count_error" ], [ "", "expf" ], [ "", "zend_hash_init" ], [ "", "zend_multibyte_encoding_converter" ], [ "", "add_assoc_string_ex" ], [ "", "memset" ], [ "", "OnUpdateString" ], [ "", "strnlen" ], [ "", "zend_spprintf" ], [ "", "zend_hash_index_find" ], [ "", "memcmp" ], [ "", "strcmp" ], [ "", "php_stream_getc" ], [ "", "zend_register_long_constant" ], [ "", "php_error_docref" ], [ "", "gmon_start__" ], [ "", "stat" ], [ "", "zend_register_ini_entries_ex" ], [ "", "php_info_print_table_end" ], [ "", "memcpy" ], [ "", "display_ini_entries" ], [ "", "zend_hash_destroy" ], [ "", "zend_parse_arg_bool_slow" ], [ "", "add_index_double" ], [ "", "php_file_le_stream" ], [ "", "php_getimagetype" ], [ "", "zend_argument_value_error" ], [ "", "php_verror" ], [ "", "malloc" ], [ "", "add_assoc_null_ex" ], [ "", "zend_hash_str_find" ], [ "", "zend_try_assign_typed_ref_long" ], [ "", "php_basename" ], [ "", "zend_wrong_parameter_error" ], [ "", "efree" ], [ "", "php_stream_seek" ], [ "", "memmove" ], [ "", "zend_new_array_0" ], [ "", "php_stream_open_wrapper_ex" ], [ "", "zval_ptr_dtor" ], [ "", "php_stream_free" ], [ "", "zend_hash_index_add_new" ], [ "", "php_stream_read" ], [ "", "zend_error" ], [ "", "estrndup" ], [ "", "zend_multibyte_parse_encoding_list" ], [ "", "emalloc" ], [ "", "php_stream_tell" ], [ "", "php_file_le_pstream" ], [ "", "safe_erealloc" ], [ "", "add_assoc_long_ex" ], [ "", "zend_fetch_resource2" ], [ "", "ITM_registerTMCloneTable" ], [ "", "add_assoc_stringl_ex" ], [ "", "zend_hash_index_add" ], [ "", "php_info_print_table_start" ], [ "", "cxa_finalize" ], [ "", "strstr" ], [ "", "add_index_string" ] ], "sec": [ [ ".gnu.hash", 680, 36, 1.89, "alloc" ], [ ".dynsym", 720, 1968, 1.09, "alloc" ], [ ".dynstr", 2688, 1483, 4.47, "alloc" ], [ ".gnu.version", 4172, 164, 0.57, "alloc" ], [ ".gnu.version_r", 4336, 80, 2.87, "alloc" ], [ ".rela.dyn", 4416, 20496, 2.42, "alloc" ], [ ".rela.plt", 24912, 1776, 1.72, "alloc,info_link" ], [ ".init", 28672, 27, 4.24, "alloc,executable" ], [ ".plt", 28704, 1200, 4.3, "alloc,executable" ], [ ".plt.got", 29904, 16, 3.58, "alloc,executable" ], [ ".plt.sec", 29920, 1184, 3.95, "alloc,executable" ], [ ".text", 31104, 30332, 6.08, "alloc,executable" ], [ ".fini", 61436, 13, 3.24, "alloc,executable" ], [ ".rodata", 65536, 11584, 5.34, "alloc" ], [ ".eh_frame_hdr", 77120, 372, 4.47, "alloc" ], [ ".eh_frame", 77496, 2188, 5.36, "alloc" ], [ ".note.gnu.property", 79688, 64, 1.91, "alloc" ], [ ".note.package", 79752, 108, 4.83, "alloc" ], [ ".init_array", 83312, 8, 1.06, "write,alloc" ], [ ".fini_array", 83320, 8, 1.06, "write,alloc" ], [ ".data.rel.ro", 83328, 13792, 2.46, "write,alloc" ], [ ".dynamic", 97120, 496, 1.58, "write,alloc" ], [ ".got", 97616, 664, 1.66, "write,alloc" ], [ ".data", 98304, 200, 1.25, "write,alloc" ], [ ".comment", 98504, 30, 4.06, "merge,strings" ], [ ".symtab", 98536, 4032, 2.08, "" ], [ ".strtab", 102568, 3333, 4.85, "" ], [ ".shstrtab", 105901, 268, 4.19, "" ] ], "metrics": { "elf": { "bits": 64, "entry": 0, "has_got": 1, "has_plt": 1, "has_note": 1, "relacount": 848, "has_symtab": 1, "note_count": 2, "nx_enabled": 1, "has_cet_ibt": 1, "dynrel_count": 0, "dynsym_count": 82, "has_eh_frame": 1, "has_gnu_hash": 1, "no_gnu_stack": 0, "stack_canary": 1, "symtab_count": 168, "dynrela_count": 854, "has_cet_shstk": 1, "little_endian": 1, "dt_flags_1_raw": 1, "pltreloc_count": 74, "dt_versym_count": 82, "executable_stack": 0, "fini_array_count": 1, "init_array_count": 1, "wx_segment_count": 0, "comment_entry_count": 1, "program_header_count": 11, "stripped_with_symtab": 1, "comment_distinct_count": 1, "executable_segment_count": 1, "load_segment_max_file_size": 32777, "load_segment_max_memory_size": 32777, "section_relocation_group_count": 2, "stripped_metadata_section_count": 5 }, "file": { "size": 108096, "entropy": 4.65 }, "binary": { "is_pie": 0, "has_overlay": 1, "is_stripped": 0, "code_entropy": 5.94, "data_entropy": 2.38, "overlay_size": 1927, "string_count": 851, "overlay_ratio": 0.02, "overlay_entropy": 1.56, "entropy_variance": 2.43, "avg_string_length": 16.02, "max_string_length": 130, "peak_region_bytes": 25600, "code_to_data_ratio": 0.68, "peak_region_entropy": 6.02, "string_length_stddev": 10.44, "largest_section_ratio": 0.28, "sentence_string_count": 57, "sentence_string_ratio": 0.07, "high_entropy_string_count": 0 }, "exports": { "count": 1, "api_count": 1 }, "imports": { "count": 80 }, "sections": { "count": 30, "code_size": 32772, "entropy_max": 6.08, "entropy_mean": 3.09, "name_entropy": 4.14, "writable_count": 7, "executable_count": 6, "nonstandard_count": 5, "executable_writable_count": 0 }, "dependencies": { "count": 1 } } }, "id": 2, "mol": "K(Li)O(As)H(F)Md(Pa)", "path": "php-8.3-exif-8.3.35-r0.apk!!usr/lib/php/modules/exif.so", "pid": 0, "risk": 4, "sha": "06bffeac6f84b02c5fa52ab3721e9dae385b367c976f8f4e4edf77f1887a5057", "size": 108096, "traits": [ { "id": "metadata/lang/natural::lang-english--atom-4", "conf": 0.8, "crit": 1, "desc": "English function-word token \"have\"", "spans": [ [ 75468, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-6", "conf": 0.8, "crit": 1, "desc": "English function-word token \"with\"", "spans": [ [ 76244, 0 ] ] }, { "id": "metadata/package/files/dependency::os-image-root-file-path", "conf": 0.94, "crit": 3, "desc": "Root-level OS directory path" }, { "id": "objectives/anti-static/obfuscation/payload/encrypted::aes-key-field-token", "atk": "T1573.001,T1027", "mbc": "C0027", "conf": 0.8, "crit": 3, "desc": "AES or generic key field name", "spans": [ [ 70089, 13 ] ] }, { "id": "well-known/lib/runtime/scripted/php-runtime::runtime-lib-path", "conf": 0.96, "crit": 3, "desc": "PHP runtime library path" }, { "id": "micro-behaviors/fs/file/stat::stat-core", "conf": 0.8, "crit": 3, "desc": "References stat-family file-status API", "spans": [ [ 3757, 4 ] ] } ], "type": "elf" }, { "ctx": [ { "b": "xD^=\u003carR^HarR^HarQ#mz/PS7x(VuZc#A:wwO(xeeO3pqarR^HarR^HarQ#hv}GB\u003ewJ.p!zejl8zeZ{harR^HarR^HarQ#cyH?d1at4KPa%ZYgB95PkarR^HarR^HarQ#3wPI%2w{4{aAa9\u003c4jTqB@wNPy]vruf9a%ZYgB95PP3jm)#arR^HarR^H33Htixk8Dgv@Dl%x\u003eFLueOw)rvQT6}eIgywwft@4w[rP9x(W={Bz(hBar\u00267Pz/PS7x(Uy8arR^H", "ln": 14943, "col": 59, "line": 490 }, { "b": "oHhAzmpeI:t3to4pEUWlarR^HarR^HasNTuarR^HarR^Hazb+xDoAJ4Ab]VgBy(Tyc37BRa%Z=yDu{+TD)0Gwwfrmvfj4\u003c!i=/mGv}vYbt}dGXcM)^VBAeGQwfrm8zyl\u003euarR^HarR^HarUf5B7DErbY!6Fx(EA?z/6DizE)ZcB0q-vzvdHearR^HarR^HcNQ3:asZOsfFbp\u003cdK+YEarR^HarR^Hapi1cx-", "ln": 20084, "col": 13, "line": 628 }, { "b": "f:Y3CeG!}tzdL:JlVl{?azt\u003esAayOhz/fefvR6d\u0026A+cwczGx]dy?$kaz/M$eAcMBharR^HA=(nviV@!SarR^HarUJpwnc6bePq*=xM4:0fjG6ry?bhowO+^)xjSVkB-YoQxMbK.e\u0026bd(ByM$jAa9l\u0026wIKPnarR^Hay/vkfj/lnfjw*dv}YBefkbDHAayOhz/feffkbovwImInx(4rkzdNJ(zF9Jjz/{dPAa\u003chxi4^0uwPRAnvq]T+xK@}LxMOunwg?wgzE%j#at1ZNvqPNpawDoWwGTMZB97\u0026byZIpcarUYEzGv\u0026Y", "ln": 24582, "col": 36, "line": 764 }, { "b": "vpK7YxjVcB3lQDyaz$R8wJy@MxMbK.e\u0026b7?z/ff3x9]+7arUSqAaJ\u003c1zE\u003e\u003coarR^HarSlUA=(nviV@!SarR^HarR^HarUJpwnc6bePq*RfkbovwImInx(4rkzdNJ(zF9Jjz/{dPAa\u003chxi4^0sv@Dl%x\u003eG8gByM$yxMbRmz/fetwfIv6arR^HarR^Haz(oAAa\u003chyx(mSpAb](cBZ]Jcz/cWJxM4:0fjG6ry?bhowO+^)xjSVkB-YoQxMbK.e\u0026b7?z/ff3xd)?rv\u003eR!mA4=fzA4U\u003cxx:L$9arUiaAaJ]$wO#0(wPG)tarR^HarUYEzGGPf", "ln": 25906, "col": 5, "line": 799 }, { "b": "arSlUA=(nviV@!SarR^HarR^HarUluAbP=savPyimnu=MpFK?}l}HotB-RNRy?WuiAa\u003chzzeS%cy?mU{arR^HarR^HarUJpwnc6bePq*RfkbovwImInx(4rkzdNJ(zF9Jjz/{dPAa\u003chxi4^0svQ\u003cm-Bz8\u003cKbT\u003e*mmnu=MpFK?}l}Hn-arR^HarR^HarUJAar\u0026ELz/65svS=y3wg}!hy*?i]wI4?yBt4PDA4K44gCp1xsx4Z:q+o+Wq^R{:qzhG?zddK1e]$}Pay2l@arR^HarR^HapfkBxM4:0fjG6ry?bhowO+^)xjSVkB-YoQxMbK.e=", "ln": 27697, "col": 5, "line": 857 }, { "b": "arSlUA=(nviV@!SarR^HarR^HarUluAbP=savPyimnu=MpFK?}l}HotB-RNRy?WuiAa\u003chzzeS%cy?mU{arR^HarR^HarUJpwnc6bePq*RfkbovwImInx(4rkzdNJ(zF9Jjz/{dPAa\u003chxi4^0svTo^Nfc\u0026$*r7fLXnL-8WuQNE-3lQDlarR^HarR!zB%4$ZxM4:0fjG6ry?bhowO+^)xjSVkB-YoQxMbK.e\u0026bdamoAITpe:.Wpe+H/nM4iJDnm9]zZ3re3lQDlarR^HarR^ka$)RFzdLwfB.LV5fkUopvqYZ?ePk=Nfk$PzeJtvseN!", "ln": 29114, "col": 5, "line": 904 }, { "b": "arR^HarR^Hazk.kB-qy.3lQDlarR^HarR^Hat1ZGA=l8tzEEx[iV})Ox(4q!arR^HarR^HarR^HarUrhwi7?/fFCf/arR^HarR^HarR^HarUJjzdm6%B2\u003cTJarR^HarR^HarR^HarR^UayYFcy?9\u003e}arR^HaAh4lwO=6#wJyevarR^HarR^UaA.:pB2\u003eB=wPI@DBAYxO", "ln": 29966, "col": 2, "line": 933 }, { "b": "arSlUA=(nviV@!SarR^HarR^HarUluAbP=savPyimnu=MpFK?}l}HotB-RNRy?WuiAa\u003chzzeS%cy?mU{arR^HarR^HarUJpwnc6bePq*RfkbovwImInx(4rkzdNJ(zF9Jjz/{dPAa\u003chxi4^0sv{%g+zE^f@a$\u003eigsx4Z:q+o+Wq^R{:qvjJ?arR^HarR^Hzfv3CfkbovwImInx(4rkzdNJ(zF9Jjz/{dPAa\u003chxi4^0ubT\u003e*mmnu=MpFK?}l}Hofv{%g+zE^f@e]$}Pay2l@arR^HarR^HapfkBxM4:0fjG6ry?bhowO+^)xjSVkB-YoQxMbK", "ln": 30510, "col": 5, "line": 951 }, { "b": "arSlUA=(nviV@!SarR^HarR^HarUluAbP=savPyimnu=MpFK?}l}HotB-RNRy?WuiAa\u003chzzeS%cy?mU{arR^HarR^HarUJpwnc6bePq*RfkbovwImInx(4rkzdNJ(zF9Jjz/{dPAa\u003chxi4^0sv%00nwG\u0026=MmoAITpe:.Wpe+H/nM2)rarR^HarR^Haz(oAa$)RFzdLwfB.LV5fkUopvqYZ?ePk=Nfk$PzeJtvsfc\u0026$*r7fLXnL-8WuQNE-fjP9HAaHUyzZ3re3lQDlarR^HarR^ka$)RFzdLwfB.LV5fkUopvqYZ?ePk=Nfk$PzeJtvs", "ln": 31946, "col": 5, "line": 998 }, { "b": "az\u003e?lB7]J8az++3A::0lay]55wO#3\u0026zEWx(B0bQDx(mMay?d5-arR^HarR^HarR^HarUYEzGv\u0026YD\u003cQ#sarR^HarR^HarR^HarUGhwg.q8wN/G#tNzO@arR^HarR^HarR^HarQ$xeOnZkwPH0Ua%pa$arR^HarR^HarR^HarR^H2}W-uCW\u003eMjwmWu8x(4v4jT86)tNzO@ao", "ln": 33030, "col": 30, "line": 1035 }, { "b": "arSlUA=(nviV@!SarR^HarR^HarUluAbP=savPyimnu=MpFK?}l}HotB-RNRy?WuiAa\u003chzzeS%cy?mU{arR^HarR^HarUJpwnc6bePq*RfkbovwImInx(4rkzdNJ(zF9Jjz/{dPAa\u003chxi4^0sv%8*da$\u003eigsx4Z:q+o+Wq^R{:qvjJ?arR^HarR^Hzfv3CfkbovwImInx(4rkzdNJ(zF9Jjz/{dPAa\u003chxi4^0ubT\u003e*mmnu=MpFK?}l}Hofv%8*de]$}Pay2l@arR^HarR^HapfkBxM4:0fjG6ry?bhowO+^)xjSVkB-YoQxMbK.e\u0026b6", "ln": 33354, "col": 5, "line": 1045 }, { "b": "Aa9l(vp%d)iTM#LarR^HarR^HarSlUy?d6dv}YB-yyhgbarR^HarR^HarSlUAa\u003chxi4^0sw]}#0arR^HarR^HvpJ!=B-8qxiTM#LarR^HarR^HA=(mKvrjELa%EvparR^HarR^HaA.:pA=TnGarR^HarR^HarR^HeG/gSwPzV%zdL:JvS=y3wc%C4arR^HarR^HarR^HB.LwEatCM7fA", "ln": 39584, "col": 11, "line": 1251 }, { "b": "arR^HarR^HAa%o5y?W=#iTM#LarR^HarR^HarSlUzEEx[iV}{CwN/G#w]zYjze16jx(mMay?Wv0vrcSowmYZ\u003ezE^r@v}/H}aA.:tzF78dwmM2\u0026arR^HarR^HarR^HaAzQxB2\u003eB\u003e3lQDlarR^HarR^HarR^Haz+O0eN@E9v@0h(3lQDlarR^HarR^HarR^HapfRKw[=6)B3gY\u003eay2l@", "ln": 40000, "col": 3, "line": 1269 }, { "b": "arR^HB7/c3y=SW.a{]CnarR^HarR^HarR^HxM4:0wnc6Bar\u00260parR^HarR^HarUrqz/{2uiTM#LarR^HarR^HarSlUxl4{kAbG93wJy@yB.LV53lQDlarR^HarR^HarR!tx\u003efmEf!+pn3lQDlarR^HarR^HarR!zwO\u003e)/A=TnGarR^HarR^HarR^HarR^HeG!IBx(4q!arR^HarUSqAaG", "ln": 41176, "col": 11, "line": 1307 }, { "b": "3lQDlarR^Hat1ZPxMbK.e\u0026b7(wPS39CYUJEz/ff3x9]+7arR^HarSlUzdN:2wN)x4x(jn2arR^HarR^Uaz\u003eXgxjUQ9B-ROAvRGY!arR^HarR^HeG/mQy?vxkvQTs?y*?QcB-W%karR^HaAhvtC4\u003eF#B2\u003cTJarR^HarR^UaAh1keOwTpBy/YsjVC5Ie\u0026bvpAXE?yarR!qwPIv4x(Ffdz/dP", "ln": 42088, "col": 15, "line": 1333 }, { "b": "xjSVkB-YoQxMbK.e\u0026b7(ze.cNmoAITpe:.Wpe+H/nM4iOze.aGzZ2JharR!qwPhi#wmYT*x\u003equD3lQDlarR!EB-8qnzdL:narR^HarR^HeG/1CA4K44gC9lRA4LNrzF0P}3lQDlarR^Hat1ZMwPzA{wg.n8zvdHearR^HarSlUzdN:2wN)xnB8(thx(jn2arR^HarR^UaA}:uw[-\u0026avrl0@vr(^lBp6ckarR^HAb](ux\u003eg^@iTM#LarR^HarSlUAa\u003chxxkIPJi4^0tgC{+8fBw{BarUiaB7oj", "ln": 43422, "col": 30, "line": 1378 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 213783, "entropy": 4.39 }, "binary": { "peak_region_bytes": 76567, "peak_region_entropy": 4.88 } } }, "id": 3, "mol": "H₂(F₂Os)", "path": "php-8.3-exif-8.3.35-r0.apk!!.melange.yaml", "pid": 0, "risk": 3, "sha": "4049b422b9a58ba9008362d751641a1fdc8172ca3204e3fc4242f59c99caa47f", "size": 213783, "traits": [ { "id": "micro-behaviors/fs/directory/mkdir::mkdir-command", "conf": 0.8, "crit": 3, "desc": "Shell invokes mkdir command", "spans": [ [ 15007, 16 ], [ 24646, 52 ], [ 25970, 64 ], [ 27761, 65 ], [ 29178, 62 ], [ 30574, 67 ], [ 32010, 64 ], [ 33418, 63 ] ] }, { "id": "micro-behaviors/fs/path/location::hardcoded-home-dir-path", "conf": 0.8, "crit": 3, "desc": "Hardcoded absolute home directory path", "spans": [ [ 24654, 25 ], [ 25979, 25 ] ] }, { "id": "micro-behaviors/os/service/daemon::apache2", "conf": 0.7, "crit": 3, "desc": "apache2 daemon reference", "spans": [ [ 24690, 8 ] ] } ], "type": "yaml" }, { "ctx": [ { "b": "boPG/zE)\u0026%By!#9vTf8kwO+^)xjRA?yIdJ[zdK?MaAh1keJtvseOffvw^SG)xlE\u003cbauZ\u0026be\u0026baoh7-\u002653sN%+xDPCXCSmP*hz++Zx)KtkjS(EpfFUvp3u6%0xk8lajS[YSA4K44gyw8pxjLN{v\u003c0]Sra]?=moAbJaz2!twO#N6z/b]8A+(\u003cYapqQ%zeB0eauZ\u00267f/pWBhd!KMgg\u0026mLf\u003eJl@vko\u0026Pixn]JixgO8hEQbKvMlwSwmmw6zddc@Byw)3wPw[RaA}:uw[.PYB.LV5wmoN\u003eauZ\u00264h-SMCix5/Pg74\u0026iv}xL0wGTbUp!jzmgCgvo3s)Z!wO#33jS[PMA+w@]eN\u0026Bi3s)Z!wO#33jS[PMA+w@]eP(bPB7e\u003c33s)Z!wO#33jS[YSA4K44gC9f.x\u003ew@bz/ff3x9@fXAaJ]$auZ\u0026*z-N", "ln": 0, "col": 1, "line": 1 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 548, "entropy": 5.08 }, "binary": { "peak_region_bytes": 548, "peak_region_entropy": 5.08 } } }, "id": 4, "mol": "Md(Pa)", "path": "php-8.3-exif-8.3.35-r0.apk!!.PKGINFO", "pid": 0, "risk": 1, "sha": "4097f787870d834869434d6faf330bdc0d482a50b4d9730fb0fd0e57144f3290", "size": 548, "traits": [ { "id": "metadata/package/files/system-package::alpine-pkginfo-basename", "conf": 0.9, "crit": 2, "desc": "Alpine/Wolfi package info file" }, { "id": "metadata/package/files/system-package::alpine-pkginfo-origin-field", "conf": 0.9, "crit": 3, "desc": "Alpine/Wolfi package origin field", "spans": [ [ 93, 16 ] ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-package-field", "conf": 0.9, "crit": 2, "desc": "Alpine/Wolfi package name field", "spans": [ [ 23, 0 ] ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-version-field", "conf": 0.9, "crit": 2, "desc": "Alpine/Wolfi package version field", "spans": [ [ 46, 0 ] ] }, { "id": "metadata/package/files/system-package::melange-pkginfo-generator", "conf": 0.9, "crit": 3, "desc": "Melange-generated package metadata", "spans": [ [ 0, 22 ] ] }, { "id": "metadata/package/files/system-package::wolfi-pkginfo-maintainer", "conf": 0.9, "crit": 3, "desc": "Wolfi package maintainer field", "spans": [ [ 196, 18 ] ] }, { "id": "metadata/package/files/system-package::alpine-apk-pkginfo", "conf": 0.97, "crit": 2, "desc": "Alpine/Wolfi package info metadata", "uses": [ 0, 1, 2, 3 ], "spans": [ [ 23, 0 ] ] } ], "type": "text" }, { "depth": 1, "facts": { "metrics": { "file": { "size": 773, "entropy": 4.63 }, "binary": { "peak_region_bytes": 773, "peak_region_entropy": 4.63 }, "registry": { "age_days": 0, "published_at": 1790097582, "is_deprecated": 0 } } }, "id": 5, "mol": "Md(Re)", "path": "php-8.3-exif@8.3.35-r0.registry.json", "pid": 0, "rel": "registry", "risk": 1, "role": "sidecar", "sha": "45f4def4df6a939b54ff90466b375993c992991a6771ca14250345a8dd6ca341", "size": 773, "traits": [ { "id": "metadata/registry::freshly-published", "conf": 1.0, "crit": 3, "desc": "Release published within seven days" } ], "type": "registry" } ], "rev": "a041b", "v": "8" } }