{ "ml": { "v": "7", "eng": "2.2.0-rc.1", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.000052034855, "rte": "az", "prob": 0.000052034855 } ], "prob": 0.00007399917, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.00007399916648864746, "type": "zst" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.00007399916648864746, "type": "elf" } ], "version": "v18.18", "analyzed_at": "2026-06-28T00:18:45Z" }, "path": "serial_cs.ko.zst", "raw": { "files": [ { "id": 0, "ctx": [ { "b": "d77-bQ{g)u09?nWyg[R=nF2\u0026z]L+!@(9DW09dZkpo8", "n": [ { "c": 2, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "o": 0, "z": 1, "cf": 1.0 } ], "ln": 0 } ], "mol": "O₂(AsC)", "sha": "172e920d1e36a7a020bc0069f70e57306c214a1c39659a3c1c84015648fb9564", "path": "serial_cs.ko.zst", "risk": 3, "size": 15157, "type": "zst", "facts": { "metrics": { "file": { "size": 15157.0, "entropy": 7.99, "size_bytes": 15157.0 }, "binary": { "overall_entropy": 7.99, "peak_region_bytes": 15157.0, "peak_region_entropy": 7.82 } } }, "traits": [ { "id": "micro-behaviors/communications/ip/literal::external-ipv4-binary", "conf": 0.8500000238418579, "crit": 2, "desc": "Hardcoded external IPv4 address", "from": [ { "file": 1 } ] }, { "id": "metadata/build/artifact::elf-stripped-but-symtab-present", "conf": 0.6000000238418579, "crit": 3, "desc": "ELF stripped with .symtab present", "from": [ { "file": 1 } ] }, { "id": "objectives/command-and-control/channel/redundancy::multi-channel-diversity", "atk": "T1071", "mbc": "B0030", "conf": 0.8500000238418579, "crit": 3, "desc": "C2 infrastructure using multiple communication methods", "from": [ { "file": 1 } ] }, { "id": "objectives/anti-static/obfuscation/payload/code-in-data::nop-sled-in-data", "conf": 0.6499999761581421, "crit": 3, "desc": "Repeated NOP-run pattern in executable section", "from": [ { "file": 1 } ] }, { "id": "metadata/package/license::gpl-word", "conf": 0.699999988079071, "crit": 2, "desc": "GPL license reference", "from": [ { "file": 1 } ] } ] }, { "ctx": [ { "b": "E))420S-r400000000000rtp-0rr9100000000000000000000apXzL0000000000kMy=:002m:f90Q800000000", "n": [ { "c": 3, "d": "Recognized XOR-loop byte-pattern marker", "i": "objectives/anti-analysis/self-modify/runtime::xor-loop-pattern-recognized-marker", "o": 0, "z": 12, "cf": 0.8999999761581421 } ], "ln": 0 }, { "b": "00000000000000000000KDtM=KDtM=KDtM=KDtM=\u003eL$O.09d6]XbVHe007%TnqVClg4%\u0026i0000fa4c8eKDtM=KDtM=KDtM=KDtM=\u003eL$O.098NFHU8Xe07.}", "n": [ { "c": 3, "d": "Repeated NOP-run pattern in executable section", "i": "objectives/anti-static/obfuscation/payload/code-in-data::nop-sled-in-data", "o": 296, "z": 47, "cf": 0.6499999761581421 } ], "ln": 280 }, { "b": "1POJ50cwzd00000t11khsZaf%l0V=.t}%+Z:UAGz%3XVT\u003e(pX-07\u00268pbRR=yZ\u0026Q3zpZzZI@@", "n": [ { "c": 3, "d": "Dotted-quad PE version metadata marker", "i": "objectives/command-and-control/infrastructure/ip::ipv4-version-metadata-marker", "o": 4187, "z": 9, "cf": 0.9399999976158142 } ], "ln": 4171 }, { "b": "t}#xz00000y?Wx\u003czGxwLm]h\u003eVwmY*(A+PGmx(v(Lwo8ycwPw]9z/M%%lRP{tk{gj", "n": [ { "c": 3, "d": "Terminal socket exec helper context", "i": "micro-behaviors/process/fd/dup::unix-terminal-socket-exec-benign-context", "o": 22184, "z": 3, "cf": 0.949999988079071 } ], "ln": 22168 }, { "b": "wNw}=zF0P}uT!q5wDl7AB97\u00262yHpN+yHpWZx(0=\u003cwPzG[y=BgcfKF\u003cixk8BewPzcqgbQ:)AbP=s0ab", "n": [ { "c": 3, "d": "Stack protector/canary enabled", "i": "metadata/hardening/build::stack-protector", "o": 32130, "z": 14, "cf": 0.8999999761581421 } ], "ln": 32114 } ], "depth": 1, "facts": { "exp": [ [ "this_module" ], [ "cleanup_module" ], [ "init_module" ], [ "pfx_init_module" ], [ "pfx_cleanup_module" ] ], "imp": [ [ "", "pcmcia_disable_device" ], [ "", "pcmcia_unregister_driver" ], [ "", "kfree" ], [ "", "serial8250_unregister_port" ], [ "", "dynamic_dev_dbg" ], [ "", "fentry__" ], [ "", "x86_indirect_thunk_rax" ], [ "", "dump_stack" ], [ "", "printk" ], [ "", "ref_stack_chk_guard" ], [ "", "stack_chk_fail" ], [ "", "dev_info" ], [ "", "ubsan_handle_out_of_bounds" ], [ "", "pcmcia_loop_config" ], [ "", "random_kmalloc_seed" ], [ "", "pcmcia_write_config_byte" ], [ "", "dev_warn" ], [ "", "x86_return_thunk" ], [ "", "pcmcia_request_io" ], [ "", "serial8250_resume_port" ], [ "", "kmalloc_cache_noprof" ], [ "", "pcmcia_read_config_byte" ], [ "", "pcmcia_register_driver" ], [ "", "serial8250_register_8250_port" ], [ "", "param_ops_int" ], [ "", "pcmcia_enable_device" ], [ "", "msleep" ], [ "", "serial8250_suspend_port" ], [ "", "kmalloc_caches" ] ], "sec": [ [ "__jump_table", 64, 64, 0.0, "write,alloc" ], [ ".rela__jump_table", 52520, 288, 1.52, "info_link" ], [ "__patchable_function_entries", 128, 168, 0.0, "write,alloc" ], [ ".rela__patchable_function_entries", 52808, 504, 1.38, "info_link" ], [ ".text", 296, 4549, 5.49, "alloc,executable" ], [ ".rela.text", 53312, 4296, 2.67, "info_link" ], [ ".data", 4848, 868, 1.5, "write,alloc" ], [ ".rela.data", 57608, 1104, 1.64, "info_link" ], [ ".rodata", 5720, 16201, 2.5, "alloc" ], [ ".rela.rodata", 58712, 5664, 2.1, "info_link" ], [ "__mcount_loc", 21921, 160, 0.0, "alloc" ], [ ".rela__mcount_loc", 64376, 480, 1.42, "info_link" ], [ ".init.text", 22088, 45, 2.51, "alloc,executable" ], [ ".rela.init.text", 64856, 96, 2.16, "info_link" ], [ ".exit.text", 22136, 40, 2.55, "alloc,executable" ], [ ".rela.exit.text", 64952, 72, 2.08, "info_link" ], [ ".modinfo", 22176, 8390, 4.68, "alloc" ], [ ".exit.data", 30568, 8, 0.0, "write,alloc" ], [ ".rela.exit.data", 65024, 24, 0.66, "info_link" ], [ ".init.data", 30576, 8, 0.0, "write,alloc" ], [ ".rela.init.data", 65048, 24, 0.66, "info_link" ], [ "__dyndbg", 30584, 224, 0.44, "write,alloc" ], [ ".rela__dyndbg", 65072, 384, 1.34, "info_link" ], [ "__param", 30808, 80, 0.5, "alloc" ], [ ".rela__param", 65456, 192, 1.2, "info_link" ], [ ".comment", 30888, 117, 4.05, "merge,strings" ], [ ".retpoline_sites", 31005, 24, 0.0, "alloc" ], [ ".rela.retpoline_sites", 65648, 144, 1.42, "info_link" ], [ ".return_sites", 31029, 116, 0.0, "alloc" ], [ ".rela.return_sites", 65792, 696, 1.64, "info_link" ], [ ".call_sites", 31145, 360, 0.0, "alloc" ], [ ".rela.call_sites", 66488, 2160, 1.82, "info_link" ], [ ".note.gnu.build-id", 31508, 36, 4.08, "alloc" ], [ ".note.package", 31544, 108, 4.73, "alloc" ], [ "__version_ext_names", 31656, 561, 4.45, "alloc" ], [ "__version_ext_crcs", 32224, 120, 5.98, "alloc" ], [ "__versions", 32344, 1920, 2.7, "alloc" ], [ ".gnu.linkonce.this_module", 34264, 1280, 0.08, "write,alloc" ], [ ".rela.gnu.linkonce.this_module", 68648, 48, 1.19, "info_link" ], [ ".note.Linux", 35544, 48, 1.97, "alloc" ], [ ".BTF", 35592, 4457, 4.79, "" ], [ ".symtab", 40056, 6960, 2.36, "" ], [ ".strtab", 47016, 5497, 4.58, "" ], [ ".shstrtab", 68696, 451, 4.31, "" ] ], "metrics": { "elf": { "bits": 64.0, "entry": 0.0, "has_got": 0.0, "has_plt": 0.0, "has_note": 1.0, "has_symtab": 1.0, "note_count": 3.0, "nx_enabled": 1.0, "dynrel_count": 0.0, "dynsym_count": 0.0, "has_eh_frame": 0.0, "stack_canary": 1.0, "symtab_count": 290.0, "dynrela_count": 0.0, "little_endian": 1.0, "pltreloc_count": 0.0, "executable_stack": 0.0, "wx_segment_count": 0.0, "comment_entry_count": 3.0, "program_header_count": 0.0, "comment_distinct_count": 1.0, "gnu_stack_section_absent": 0.0, "load_segment_max_file_size": 0.0, "stripped_but_symtab_present": 1.0, "load_segment_max_memory_size": 0.0, "section_relocation_group_count": 16.0, "stripped_metadata_section_count": 5.0 }, "file": { "size": 72881.0, "entropy": 4.06, "size_bytes": 72881.0 }, "binary": { "is_pie": 0.0, "has_overlay": 1.0, "is_stripped": 0.0, "code_entropy": 5.43, "data_entropy": 0.57, "overlay_size": 3734.0, "string_count": 686.0, "overlay_ratio": 0.05, "avg_complexity": 2.94, "max_complexity": 26.0, "huge_func_count": 0.0, "leaf_func_count": 23.0, "overall_entropy": 4.06, "overlay_entropy": 3.06, "tiny_func_count": 30.0, "avg_basic_blocks": 4.75, "entropy_variance": 2.87, "avg_string_length": 24.86, "max_string_length": 90.0, "peak_region_bytes": 177.0, "code_to_data_ratio": 0.64, "total_basic_blocks": 228.0, "peak_region_entropy": 6.74, "string_length_stddev": 15.41, "largest_section_ratio": 0.22, "sentence_string_count": 56.0, "sentence_string_ratio": 0.08, "high_entropy_string_count": 0.0 }, "exports": { "count": 5.0 }, "imports": { "count": 29.0 }, "sections": { "count": 47.0, "code_size": 4634.0, "entropy_max": 5.98, "entropy_mean": 2.03, "name_entropy": 4.23, "writable_count": 8.0, "executable_count": 3.0, "nonstandard_count": 39.0, "executable_writable_count": 0.0 }, "functions": { "count": 48.0 }, "dependencies": { "count": 0.0 } } }, "id": 1, "mol": "O₂(AsC)", "path": "serial_cs.ko.zst!!serial_cs.ko", "risk": 3, "sha": "23ecd5f3d30a125e9caa3416b8cb1c3b7390a5b109f9efe3e71f584f0db36e93", "size": 72881, "traits": [ { "id": "metadata/build/artifact::elf-stripped-but-symtab-present", "conf": 0.6000000238418579, "crit": 3, "desc": "ELF stripped with .symtab present", "spans": [ [ 0, 38 ] ] }, { "id": "metadata/package/license::gpl-word", "conf": 0.699999988079071, "crit": 2, "desc": "GPL license reference", "spans": [ [ 22184, 3 ] ] }, { "id": "objectives/anti-static/obfuscation/payload/code-in-data::nop-sled-in-data", "conf": 0.6499999761581421, "crit": 3, "desc": "Repeated NOP-run pattern in executable section", "spans": [ [ 296, 47 ] ] }, { "id": "micro-behaviors/communications/ip/literal::external-ipv4-binary", "conf": 0.8500000238418579, "crit": 2, "desc": "Hardcoded external IPv4 address", "spans": [ [ 4187, 9 ] ] }, { "id": "objectives/command-and-control/channel/redundancy::multi-channel-diversity", "atk": "T1071", "mbc": "B0030", "conf": 0.8500000238418579, "crit": 3, "desc": "C2 infrastructure using multiple communication methods", "spans": [ [ 4187, 9 ] ] } ], "type": "elf" } ], "rev": "46112", "v": "8" } }