{
  "ml": {
    "v": "7",
    "eng": "2.2.0-rc.1",
    "lvl": -1,
    "conf": 0,
    "mods": [
      {
        "cls": 0,
        "raw": 0.000044127304,
        "rte": "az",
        "prob": 0.000044127304
      }
    ],
    "prob": 0.00007290641,
    "files": [
      {
        "id": 0,
        "lvl": -1,
        "conf": 0,
        "prob": 0.0000729064122424461,
        "type": "zst"
      },
      {
        "id": 1,
        "lvl": -1,
        "conf": 0,
        "prob": 0.0000729064122424461,
        "type": "elf"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-06-28T01:27:24Z"
  },
  "path": "usbtv.ko.zst",
  "raw": {
    "files": [
      {
        "id": 0,
        "ctx": [
          {
            "b": "d77-bQ]AeJ01r@H8IOwpkql+[1a^x[JDnH*XKW3e}#",
            "n": [
              {
                "c": 2,
                "d": "Binary is not digitally signed",
                "i": "metadata/unsigned",
                "o": 0,
                "z": 1,
                "cf": 1.0
              }
            ],
            "ln": 0
          }
        ],
        "mol": "O₂(AsC)",
        "sha": "1bcb2f662c143e86d585f4b27eeb9931c631f53f380247e16167727b677cd6e5",
        "path": "usbtv.ko.zst",
        "risk": 3,
        "size": 34932,
        "type": "zst",
        "facts": {
          "metrics": {
            "file": {
              "size": 34932.0,
              "entropy": 7.99,
              "size_bytes": 34932.0
            },
            "binary": {
              "overall_entropy": 7.99,
              "peak_region_bytes": 34816.0,
              "peak_region_entropy": 7.83
            }
          }
        },
        "traits": [
          {
            "id": "objectives/command-and-control/backdoor/keywords::grabber-word",
            "conf": 0.75,
            "crit": 3,
            "desc": "Infostealer 'grabber' slang term",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "objectives/command-and-control/backdoor/keywords::suspicious-repo-name-a",
            "conf": 0.75,
            "crit": 3,
            "desc": "Suspicious repository name keywords",
            "from": [
              {
                "off": 12758,
                "file": 1
              }
            ]
          },
          {
            "id": "metadata/build/artifact::elf-stripped-but-symtab-present",
            "conf": 0.6000000238418579,
            "crit": 3,
            "desc": "ELF stripped with .symtab present",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "objectives/anti-static/obfuscation/payload/code-in-data::nop-sled-in-data",
            "conf": 0.6499999761581421,
            "crit": 3,
            "desc": "Repeated NOP-run pattern in executable section",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "metadata/package/license::gpl-word",
            "conf": 0.699999988079071,
            "crit": 2,
            "desc": "GPL license reference",
            "from": [
              {
                "file": 1
              }
            ]
          }
        ]
      },
      {
        "ctx": [
          {
            "b": "E))420S-r400000000000rtp-0rr91000000000000000000007%\u0026o-0000000000kMy=:002m:d/.4000000000",
            "n": [
              {
                "c": 3,
                "d": "Patterns associated with legitimate injectors to reduce FPs",
                "i": "objectives/evasion/process/injection/toolkit::legitimate-injector-patterns",
                "o": 0,
                "z": 21,
                "cf": 1.0
              }
            ],
            "ln": 0
          },
          {
            "b": "00000000000000000000KDtM=KDtM=KDtM=KDtM=\u003eL$O.098ND\u003cX[ZdPu40j07+d=:n=hu00000nqk/udObAN\u003eL$O.07.$7\u003eL$O.07-2{2\u003cql*002NglKiU",
            "n": [
              {
                "c": 3,
                "d": "Repeated NOP-run pattern in executable section",
                "i": "objectives/anti-static/obfuscation/payload/code-in-data::nop-sled-in-data",
                "o": 416,
                "z": 47,
                "cf": 0.6499999761581421
              }
            ],
            "ln": 400
          },
          {
            "b": "fFCBdl3lZLz.k17wmYW4m@\u00263EvR6M!001VYB.LV5fkLuuB:bGLAAl%)ya\u003cyqzGQgQh.D=",
            "n": [
              {
                "c": 3,
                "d": "Infostealer 'grabber' slang term",
                "i": "objectives/command-and-control/backdoor/keywords::grabber-word",
                "o": 12758,
                "z": 7,
                "cf": 0.75
              }
            ],
            "ln": 12742
          },
          {
            "b": "0001nx\u003e7Z(B7EH5BZY8elq{o9m]h\u003eVwmY*(A+PGmx(v(LmS\u0026==x\u003e7N=axqubr8$XbhY$x",
            "n": [
              {
                "c": 3,
                "d": "Terminal socket exec helper context",
                "i": "micro-behaviors/process/fd/dup::unix-terminal-socket-exec-benign-context",
                "o": 13889,
                "z": 3,
                "cf": 0.949999988079071
              },
              {
                "c": 2,
                "d": "BSD license reference",
                "i": "metadata/package/license::bsd-word",
                "o": 13885,
                "z": 3,
                "cf": 0.699999988079071
              }
            ],
            "ln": 13869
          },
          {
            "b": "z#+34vQB7%ByeM\u0026B]U(RB97\u00262yHpN+yHpWZx(0=\u0026wObB\u003cB-8qdCvtJfuVPT$B-H]jwDl)/wmYW^wmU",
            "n": [
              {
                "c": 3,
                "d": "Stack protector/canary enabled",
                "i": "metadata/hardening/build::stack-protector",
                "o": 16982,
                "z": 14,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 16966
          },
          {
            "b": "zddJ@xKtpYB7kh[g\u0026a{OvrlZiv{-.:zF\u003c2}BzkVh0ax}UuUaa%A^mT[B7nM#BZ!()C3!/#BAhTbB]",
            "n": [
              {
                "c": 2,
                "d": "async_connect function",
                "i": "micro-behaviors/os/event/library/boost-asio::async-connect",
                "o": 77605,
                "z": 13,
                "cf": 0.4000000059604645
              }
            ],
            "ln": 77589
          }
        ],
        "depth": 1,
        "facts": {
          "exp": [
            [
              "usbtv_set_regs"
            ],
            [
              "this_module"
            ],
            [
              "cleanup_module"
            ],
            [
              "pfx_usbtv_video_free"
            ],
            [
              "pfx_usbtv_video_init"
            ],
            [
              "init_module"
            ],
            [
              "pfx_usbtv_audio_init"
            ],
            [
              "pfx_usbtv_set_regs"
            ],
            [
              "pfx_init_module"
            ],
            [
              "pfx_usbtv_audio_free"
            ],
            [
              "pfx_cleanup_module"
            ],
            [
              "usbtv_audio_free"
            ],
            [
              "usbtv_video_free"
            ],
            [
              "usbtv_audio_init"
            ],
            [
              "usbtv_audio_suspend"
            ],
            [
              "pfx_usbtv_audio_resume"
            ],
            [
              "usbtv_audio_resume"
            ],
            [
              "pfx_usbtv_audio_suspend"
            ],
            [
              "usbtv_video_init"
            ]
          ],
          "imp": [
            [
              "",
              "vb2_queue_init"
            ],
            [
              "",
              "usb_alloc_urb"
            ],
            [
              "",
              "video_ioctl2"
            ],
            [
              "",
              "list_add_valid_or_report"
            ],
            [
              "",
              "usb_free_urb"
            ],
            [
              "",
              "v4l2_device_put"
            ],
            [
              "",
              "vb2_ioctl_streamoff"
            ],
            [
              "",
              "kmalloc_noprof"
            ],
            [
              "",
              "snprintf"
            ],
            [
              "",
              "snd_pcm_new"
            ],
            [
              "",
              "queue_work_on"
            ],
            [
              "",
              "snd_card_register"
            ],
            [
              "",
              "snd_card_free"
            ],
            [
              "",
              "bitmap_weight"
            ],
            [
              "",
              "usb_register_driver"
            ],
            [
              "",
              "v4l2_ctrl_handler_init_class"
            ],
            [
              "",
              "memcpy"
            ],
            [
              "",
              "kfree"
            ],
            [
              "",
              "vb2_ioctl_querybuf"
            ],
            [
              "",
              "v4l2_fh_open"
            ],
            [
              "",
              "raw_spin_lock_irqsave"
            ],
            [
              "",
              "vb2_video_unregister_device"
            ],
            [
              "",
              "fentry__"
            ],
            [
              "",
              "usb_clear_halt"
            ],
            [
              "",
              "ref_stack_chk_guard"
            ],
            [
              "",
              "v4l2_ctrl_handler_setup"
            ],
            [
              "",
              "usb_put_dev"
            ],
            [
              "",
              "stack_chk_fail"
            ],
            [
              "",
              "refcount_warn_saturate"
            ],
            [
              "",
              "video_devdata"
            ],
            [
              "",
              "kmalloc_large_noprof"
            ],
            [
              "",
              "vb2_fop_release"
            ],
            [
              "",
              "strnlen"
            ],
            [
              "",
              "usb_get_dev"
            ],
            [
              "",
              "usb_submit_urb"
            ],
            [
              "",
              "dev_info"
            ],
            [
              "",
              "ubsan_handle_out_of_bounds"
            ],
            [
              "",
              "sized_strscpy"
            ],
            [
              "",
              "snd_card_new"
            ],
            [
              "",
              "vb2_ioctl_dqbuf"
            ],
            [
              "",
              "vb2_ioctl_create_bufs"
            ],
            [
              "",
              "system_percpu_wq"
            ],
            [
              "",
              "vb2_ioctl_prepare_buf"
            ],
            [
              "",
              "random_kmalloc_seed"
            ],
            [
              "",
              "snd_pcm_stream_unlock_irqrestore"
            ],
            [
              "",
              "usb_control_msg"
            ],
            [
              "",
              "snd_card_free_when_closed"
            ],
            [
              "",
              "vb2_buffer_done"
            ],
            [
              "",
              "vb2_plane_vaddr"
            ],
            [
              "",
              "usb_set_interface"
            ],
            [
              "",
              "list_del_entry_valid_or_report"
            ],
            [
              "",
              "snd_pcm_set_ops"
            ],
            [
              "",
              "usb_deregister"
            ],
            [
              "",
              "vb2_ioctl_qbuf"
            ],
            [
              "",
              "fortify_panic"
            ],
            [
              "",
              "vb2_fop_mmap"
            ],
            [
              "",
              "raw_spin_unlock_irqrestore"
            ],
            [
              "",
              "vb2_vmalloc_memops"
            ],
            [
              "",
              "snd_pcm_set_managed_buffer_all"
            ],
            [
              "",
              "dev_warn"
            ],
            [
              "",
              "v4l2_device_disconnect"
            ],
            [
              "",
              "x86_return_thunk"
            ],
            [
              "",
              "vb2_fop_read"
            ],
            [
              "",
              "v4l2_device_register"
            ],
            [
              "",
              "video_register_device"
            ],
            [
              "",
              "kmalloc_cache_noprof"
            ],
            [
              "",
              "usb_kill_urb"
            ],
            [
              "",
              "ktime_get"
            ],
            [
              "",
              "cancel_work_sync"
            ],
            [
              "",
              "vb2_ioctl_streamon"
            ],
            [
              "",
              "vb2_fop_poll"
            ],
            [
              "",
              "v4l2_ctrl_new_std"
            ],
            [
              "",
              "v4l2_ctrl_handler_free"
            ],
            [
              "",
              "v4l2_device_unregister"
            ],
            [
              "",
              "snd_pcm_stream_lock_irqsave"
            ],
            [
              "",
              "snd_pcm_period_elapsed"
            ],
            [
              "",
              "video_device_release_empty"
            ],
            [
              "",
              "kmalloc_caches"
            ],
            [
              "",
              "mutex_init_generic"
            ],
            [
              "",
              "vb2_ioctl_reqbufs"
            ]
          ],
          "sec": [
            [
              "__bug_table",
              64,
              16,
              1.31,
              "write,alloc"
            ],
            [
              ".rela__bug_table",
              100816,
              72,
              0.98,
              "info_link"
            ],
            [
              "__patchable_function_entries",
              80,
              336,
              0.0,
              "write,alloc"
            ],
            [
              ".rela__patchable_function_entries",
              100888,
              1008,
              1.56,
              "info_link"
            ],
            [
              ".text",
              416,
              9368,
              5.45,
              "alloc,executable"
            ],
            [
              ".rela.text",
              101896,
              7728,
              2.7,
              "info_link"
            ],
            [
              ".data",
              9784,
              678,
              1.76,
              "write,alloc"
            ],
            [
              ".rela.data",
              109624,
              528,
              1.54,
              "info_link"
            ],
            [
              ".rodata",
              10464,
              2768,
              3.23,
              "alloc"
            ],
            [
              ".rela.rodata",
              110152,
              840,
              1.66,
              "info_link"
            ],
            [
              ".comment",
              13232,
              195,
              4.05,
              "merge,strings"
            ],
            [
              ".init.text",
              13432,
              63,
              2.85,
              "alloc,executable"
            ],
            [
              ".rela.init.text",
              110992,
              144,
              1.87,
              "info_link"
            ],
            [
              "__mcount_loc",
              13495,
              312,
              0.0,
              "alloc"
            ],
            [
              ".rela__mcount_loc",
              111136,
              936,
              1.57,
              "info_link"
            ],
            [
              ".exit.text",
              13808,
              40,
              2.55,
              "alloc,executable"
            ],
            [
              ".rela.exit.text",
              112072,
              72,
              1.85,
              "info_link"
            ],
            [
              ".smp_locks",
              13848,
              8,
              0.0,
              "alloc"
            ],
            [
              ".rela.smp_locks",
              112144,
              48,
              1.01,
              "info_link"
            ],
            [
              ".exit.data",
              13856,
              8,
              0.0,
              "write,alloc"
            ],
            [
              ".rela.exit.data",
              112192,
              24,
              0.5,
              "info_link"
            ],
            [
              ".init.data",
              13864,
              8,
              0.0,
              "write,alloc"
            ],
            [
              ".rela.init.data",
              112216,
              24,
              0.5,
              "info_link"
            ],
            [
              ".modinfo",
              13872,
              467,
              5.14,
              "alloc"
            ],
            [
              ".note.package",
              14340,
              216,
              4.73,
              "alloc"
            ],
            [
              ".return_sites",
              14556,
              260,
              0.0,
              "alloc"
            ],
            [
              ".rela.return_sites",
              112240,
              1560,
              1.81,
              "info_link"
            ],
            [
              ".call_sites",
              14816,
              756,
              0.0,
              "alloc"
            ],
            [
              ".rela.call_sites",
              113800,
              4536,
              1.95,
              "info_link"
            ],
            [
              ".note.gnu.build-id",
              15572,
              36,
              4.06,
              "alloc"
            ],
            [
              "__version_ext_names",
              15608,
              1464,
              4.41,
              "alloc"
            ],
            [
              "__version_ext_crcs",
              17072,
              324,
              7.15,
              "alloc"
            ],
            [
              "__versions",
              17400,
              5184,
              2.71,
              "alloc"
            ],
            [
              ".gnu.linkonce.this_module",
              22584,
              1280,
              0.05,
              "write,alloc"
            ],
            [
              ".rela.gnu.linkonce.this_module",
              118336,
              48,
              1.05,
              "info_link"
            ],
            [
              ".note.Linux",
              23864,
              48,
              1.97,
              "alloc"
            ],
            [
              ".BTF",
              23912,
              68254,
              5.18,
              ""
            ],
            [
              ".symtab",
              92168,
              5304,
              2.01,
              ""
            ],
            [
              ".strtab",
              97472,
              3337,
              4.58,
              ""
            ],
            [
              ".shstrtab",
              118384,
              417,
              4.31,
              ""
            ]
          ],
          "metrics": {
            "elf": {
              "bits": 64.0,
              "entry": 0.0,
              "has_got": 0.0,
              "has_plt": 0.0,
              "has_note": 1.0,
              "has_symtab": 1.0,
              "note_count": 3.0,
              "nx_enabled": 1.0,
              "dynrel_count": 0.0,
              "dynsym_count": 0.0,
              "has_eh_frame": 0.0,
              "stack_canary": 1.0,
              "symtab_count": 221.0,
              "dynrela_count": 0.0,
              "little_endian": 1.0,
              "pltreloc_count": 0.0,
              "executable_stack": 0.0,
              "wx_segment_count": 0.0,
              "comment_entry_count": 5.0,
              "program_header_count": 0.0,
              "comment_distinct_count": 1.0,
              "gnu_stack_section_absent": 0.0,
              "load_segment_max_file_size": 0.0,
              "stripped_but_symtab_present": 1.0,
              "load_segment_max_memory_size": 0.0,
              "section_relocation_group_count": 14.0,
              "stripped_metadata_section_count": 5.0
            },
            "file": {
              "size": 122281.0,
              "entropy": 4.76,
              "size_bytes": 122281.0
            },
            "binary": {
              "is_pie": 0.0,
              "has_overlay": 1.0,
              "is_stripped": 0.0,
              "code_entropy": 5.42,
              "data_entropy": 0.55,
              "overlay_size": 3480.0,
              "string_count": 1635.0,
              "overlay_ratio": 0.03,
              "avg_complexity": 2.47,
              "max_complexity": 16.0,
              "huge_func_count": 0.0,
              "leaf_func_count": 42.0,
              "overall_entropy": 4.76,
              "overlay_entropy": 3.19,
              "tiny_func_count": 55.0,
              "avg_basic_blocks": 4.01,
              "entropy_variance": 3.36,
              "avg_string_length": 16.97,
              "max_string_length": 90.0,
              "peak_region_bytes": 425.0,
              "code_to_data_ratio": 0.8,
              "total_basic_blocks": 373.0,
              "peak_region_entropy": 7.43,
              "string_length_stddev": 7.91,
              "largest_section_ratio": 0.56,
              "sentence_string_count": 17.0,
              "sentence_string_ratio": 0.01,
              "high_entropy_string_count": 0.0
            },
            "exports": {
              "count": 19.0
            },
            "imports": {
              "count": 80.0
            },
            "sections": {
              "count": 43.0,
              "code_size": 9471.0,
              "entropy_max": 7.15,
              "entropy_mean": 2.2,
              "name_entropy": 4.22,
              "writable_count": 7.0,
              "executable_count": 3.0,
              "nonstandard_count": 35.0,
              "executable_writable_count": 0.0
            },
            "functions": {
              "count": 93.0
            },
            "dependencies": {
              "count": 0.0
            }
          }
        },
        "id": 1,
        "mol": "O₂(AsC)",
        "path": "usbtv.ko.zst!!usbtv.ko",
        "risk": 3,
        "sha": "b03925ba907ec81241905e683c0a0e3f734f5a6b36589917352a3b126ef6c390",
        "size": 122281,
        "traits": [
          {
            "id": "metadata/build/artifact::elf-stripped-but-symtab-present",
            "conf": 0.6000000238418579,
            "crit": 3,
            "desc": "ELF stripped with .symtab present",
            "spans": [
              [
                0,
                38
              ]
            ]
          },
          {
            "id": "metadata/package/license::gpl-word",
            "conf": 0.699999988079071,
            "crit": 2,
            "desc": "GPL license reference",
            "spans": [
              [
                13889,
                3
              ]
            ]
          },
          {
            "id": "objectives/anti-static/obfuscation/payload/code-in-data::nop-sled-in-data",
            "conf": 0.6499999761581421,
            "crit": 3,
            "desc": "Repeated NOP-run pattern in executable section",
            "spans": [
              [
                416,
                47
              ]
            ]
          },
          {
            "id": "objectives/command-and-control/backdoor/keywords::grabber-word",
            "conf": 0.75,
            "crit": 3,
            "desc": "Infostealer 'grabber' slang term",
            "spans": [
              [
                12758,
                7
              ]
            ]
          },
          {
            "id": "objectives/command-and-control/backdoor/keywords::suspicious-repo-name-a",
            "conf": 0.75,
            "crit": 3,
            "desc": "Suspicious repository name keywords",
            "spans": [
              [
                12758,
                7
              ]
            ]
          }
        ],
        "type": "elf"
      }
    ],
    "rev": "46112",
    "v": "8"
  }
}