{ "ml": { "v": "7", "eng": "2.2.0-beta.1", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.0000142554445, "rte": "az", "prob": 0.0000142554445 } ], "prob": 0.0000142554445, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.000014255444511945825, "type": "apk_alpine" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.000011642773642961401, "type": "elf" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.000013222296729509253, "type": "text" } ], "version": "v18.18", "analyzed_at": "2026-06-25T20:50:20Z" }, "path": "dovecot-mysql-2.4.3-r3.apk", "raw": { "files": [ { "id": 0, "ctx": [ { "b": "abZy8000000T3{24[J!\u003enkh=HeH]u63?!Yp^*DIa!jX1m:JNrco?u{f=2H?Deg@xa3GU*X", "n": [ { "c": 2, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "o": 0, "z": 1, "cf": 1.0 } ], "ln": 0 } ], "mol": "H(Db₂)Md(He)", "sha": "2bbb8ebe0799c28d4eaf51ef6f579970a34f1d79ea8b2d4d83c4f6b1ccce1e3a", "path": "dovecot-mysql-2.4.3-r3.apk", "risk": 2, "size": 9706, "type": "apk_alpine", "facts": { "metrics": { "file": { "size": 9706.0, "entropy": 7.96, "size_bytes": 9706.0 }, "parse": { "error_count": 1.0 }, "binary": { "overall_entropy": 7.96, "peak_region_bytes": 9706.0, "peak_region_entropy": 7.79 } } }, "traits": [ { "id": "micro-behaviors/dylib/library/family::cxx-abi-symbols", "conf": 0.800000011920929, "crit": 2, "desc": "C++ ABI symbols", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/dylib/library/libc::libc-characteristic-cxa-finalize", "crit": 2, "desc": "libc characteristic cxa finalize", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/db/influxdb::influxdb-flight-sql-ticket", "conf": 0.949999988079071, "crit": 3, "desc": "InfluxDB Arrow Flight SQL ticket", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/dylib/library/libc::libc-internal-functions-b", "conf": 0.699999988079071, "crit": 2, "desc": "libc internal symbols cluster B", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/db/mysql::mysqlclient", "conf": 0.8999999761581421, "crit": 3, "desc": "mysqlclient library", "from": [ { "file": 1 } ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-version-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package version field", "from": [ { "file": 2 } ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-package-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package name field", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/data/db/mysql::libmysql", "conf": 0.8999999761581421, "crit": 3, "desc": "libmysql library", "from": [ { "file": 1 } ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-origin-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package origin field", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/data/db/mysql::mysql-real-connect", "conf": 0.8999999761581421, "crit": 3, "desc": "mysql_real_connect function", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/dylib/library/abi-graphics::cxx-abi-symbols-a", "conf": 0.800000011920929, "crit": 2, "desc": "C++ ABI symbols cluster A", "from": [ { "file": 1 } ] }, { "id": "metadata/hardening/missing::stripped-binary", "conf": 0.800000011920929, "crit": 3, "desc": "No full symbol table (likely stripped)", "from": [ { "file": 1 } ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-basename", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package info file" } ] }, { "ctx": [ { "b": "E))420S-r400000000000@$H+0rr910000000000kMy=:00000/Kj:W0000000000kMA+z3JJA(82$GN0rr91", "n": [ { "c": 3, "d": "No full symbol table (likely stripped)", "i": "metadata/hardening/missing::stripped-binary", "o": 0, "z": 25, "cf": 0.800000011920929 } ], "ln": 0 }, { "b": "A-t+2y\u0026si5raflLwDl7Av%zA?w[=c\u003ey?Xib0af8zwPzu{x(!xcA:JB0vqPN.x(mK30af8NwOkZ#", "n": [ { "c": 2, "d": "Benign dual-mode socket exec context", "i": "objectives/command-and-control/reverse-shell/dup::unix-dual-mode-socket-exec-benign-context", "o": 3199, "z": 12, "cf": 0.949999988079071 } ], "ln": 3183 }, { "b": "v@#B6zEl*.wm6t0wPA4@B8=26ADL\u0026kD0+Q)B8=26A+frmy\u0026\u003c34wQ5r7A=ld4B8=26A+frmyY", "n": [ { "c": 3, "d": "InfluxDB Arrow Flight SQL ticket", "i": "micro-behaviors/data/db/influxdb::influxdb-flight-sql-ticket", "o": 3284, "z": 9, "cf": 0.949999988079071 } ], "ln": 3268 }, { "b": "ACO#[A=M8s0blv/z/oP4BzkP60czN?BAg]mA9)N8x(n380bW15ACO#]wPRA}uU\u003cp\u003e", "n": [ { "c": 2, "d": "Get current calendar time (seconds)", "i": "micro-behaviors/time/query::time", "o": 3562, "z": 4, "cf": 0.30000001192092896 } ], "ln": 3546 }, { "b": "B8=26w[u6]xKt^#Ck#G9B8=26ADL\u0026kC(RL%uU\u003cU0A9)Z3zdN6{wOb%]B7+L{ACP04B.bPsuUj1\u0026x(^%0wm5[\u003ewO#O\u0026B8=26wmw[!wPRp2Byxo50af8OBywV{uT)++uUi.XyYF3\u0026wO#P%v@=c?By+C[BAhhezua==vS=o{wPzc\u003cwD", "n": [ { "c": 3, "d": "Stack protector/canary enabled", "i": "metadata/hardening/build::stack-protector", "o": 3696, "z": 14, "cf": 0.8999999761581421 }, { "c": 3, "d": "InfluxDB Arrow Flight SQL ticket", "i": "micro-behaviors/data/db/influxdb::influxdb-flight-sql-ticket", "o": 3621, "z": 9, "cf": 0.949999988079071 } ], "ln": 3605 }, { "b": "uVQsfwoz?\u003ewNx1?A=k%#zfZhxy*Ri]vqGpXz/fD7v@}Y(ACO#)x(^^5zF\u003c2}Bo3x4y*QW\u003czF\u003c2}BzkVhuU/", "n": [ { "c": 3, "d": "mysql_real_connect function", "i": "micro-behaviors/data/db/mysql::mysql-real-connect", "o": 3847, "z": 18, "cf": 0.8999999761581421 } ], "ln": 3831 }, { "b": "uV*mcvp\u003c6JB8=26A+e?.wP?T5ByeD!wm5?PBy/96A^mT@C4CMkuTWFQuVQsf0a*s+zGGlbwPRo/AbYxawm6d\u003exj2Q#wObU30bk!L", "n": [ { "c": 2, "d": "event_add function", "i": "micro-behaviors/os/event/library/libevent::event-add", "o": 4320, "z": 18, "cf": 0.4000000059604645 } ], "ln": 4304 }, { "b": "e]$}-gxql9vQ?3cB-RvJCSmP*hz^4cz.r:Ay?Wu?A+PYdA:JWeB8=1GB8I4{x\u003c$}8B8=2ay?WD#Byc:Z000000SSo40SSl30rrf30SSl30rrf30SSl30r", "n": [ { "c": 3, "d": "libmysql library", "i": "micro-behaviors/data/db/mysql::libmysql", "o": 4759, "z": 8, "cf": 0.8999999761581421 }, { "c": 3, "d": "Architecture detection strings", "i": "objectives/discovery/host/software::arch-detection", "o": 4728, "z": 6, "cf": 0.5 } ], "ln": 4712 }, { "b": "y?bbiwb[k{zGNNBvrl8Ze[xlBB9RQ5e[xlBB98B5e[Y6Ae{p/DB7]Mg04}]4BUm\u0026GA=U@kzEmz:e]\u003eI", "n": [ { "c": 2, "d": "ELF dynstr section name", "i": "metadata/binary/linking/static::elf-dynstr-section-name", "o": 24871, "z": 7, "cf": 0.8999999761581421 }, { "c": 2, "d": "ELF dynsym section name", "i": "metadata/binary/linking/static::elf-dynsym-section-name", "o": 24863, "z": 7, "cf": 0.8999999761581421 } ], "ln": 24847 }, { "b": "vr?\u00269wmoN*e]\u003eJte]\u003e\u003ege[xlBvqPZ*04}]5Bo0}7vrt]Te[e)y04}=1zeA\u003c4Bn#pv00000", "n": [ { "c": 2, "d": "ELF dynamic section name", "i": "metadata/binary/linking/static::elf-dynamic-section-name", "o": 25014, "z": 8, "cf": 0.8999999761581421 } ], "ln": 24998 } ], "depth": 1, "facts": { "exp": [ [ "driver_mysql_version" ], [ "mysql_setting_parser_info" ], [ "driver_mysql_db" ], [ "driver_mysql_init" ], [ "fini" ], [ "driver_mysql_result" ], [ "init" ], [ "driver_mysql_deinit" ], [ "driver_mysql_error_result" ] ], "imp": [ [ "", "mysql_real_escape_string" ], [ "", "mysql_real_connect" ], [ "", "mysql_errno" ], [ "", "ioloop_time" ], [ "", "buffer_append_space_unsafe" ], [ "", "mysql_fetch_fields" ], [ "", "mysql_close" ], [ "", "event_add_str" ], [ "", "event_want_level" ], [ "", "mysql_escape_string" ], [ "", "mysql_affected_rows" ], [ "", "event_unref" ], [ "", "cxa_finalize" ], [ "", "t_buffer_get" ], [ "", "settings_file_has_path" ], [ "", "sql_result_next_row" ], [ "", "sql_transaction_add_query" ], [ "", "i_fatal_status" ], [ "", "buffer_append" ], [ "", "mysql_num_fields" ], [ "", "i_strdup" ], [ "", "mysql_fetch_lengths" ], [ "", "event_send_abort" ], [ "", "event_category_sql" ], [ "", "event_set_append_log_prefix" ], [ "", "mysql_free_result" ], [ "", "io_loop_time_refresh" ], [ "", "sql_init_common" ], [ "", "stack_chk_fail" ], [ "", "t_strdup" ], [ "", "i_panic" ], [ "", "sql_transaction_finished_event" ], [ "", "driver_sqlpool_init" ], [ "", "sql_query_s" ], [ "", "mysql_options" ], [ "", "deregister_frame_info" ], [ "", "ITM_registerTMCloneTable" ], [ "", "settings_equal" ], [ "", "event_create_passthrough" ], [ "", "e_info" ], [ "", "mysql_query" ], [ "", "t_buffer_alloc" ], [ "", "event_add_category" ], [ "", "binary_to_hex_append" ], [ "", "sql_driver_register" ], [ "", "str_c" ], [ "", "mysql_fetch_row" ], [ "", "mysql_store_result" ], [ "", "buffer_append_c" ], [ "", "ITM_deregisterTMCloneTable" ], [ "", "settings_get" ], [ "", "sql_ref" ], [ "", "event_create" ], [ "", "mysql_next_result" ], [ "", "sql_db_set_state" ], [ "", "mysql_init" ], [ "", "time" ], [ "", "strcmp" ], [ "", "e_error" ], [ "", "buffer_create_dynamic_max" ], [ "", "sql_not_connected_result" ], [ "", "sql_transaction_rollback" ], [ "", "buffer_get_modifiable_data" ], [ "", "ssl_setting_parser_info" ], [ "", "sql_disconnect" ], [ "", "mysql_error" ], [ "", "sql_result_get_error" ], [ "", "pool_alloconly_create" ], [ "", "sql_unref" ], [ "", "ssl_client_settings_get" ], [ "", "strlen" ], [ "", "default_pool" ], [ "", "event_drop_parent_log_prefixes" ], [ "", "buffer_free" ], [ "", "sql_driver_unregister" ], [ "", "sql_result_unref" ], [ "", "sql_query_finished_event" ], [ "", "t_strdup_printf" ], [ "", "event_get_ptr" ], [ "", "e_debug" ], [ "", "register_frame_info" ], [ "", "t_str_new" ], [ "", "sql_connect" ], [ "", "sql_connection_log_finished" ] ], "sec": [ [ ".note.gnu.property", 680, 48, 1.87, "alloc" ], [ ".note.gnu.build-id", 728, 36, 4.02, "alloc" ], [ ".gnu.hash", 768, 112, 3.78, "alloc" ], [ ".dynsym", 880, 2256, 1.25, "alloc" ], [ ".dynstr", 3136, 1641, 4.4, "alloc" ], [ ".gnu.version", 4778, 188, 1.34, "alloc" ], [ ".gnu.version_r", 4968, 32, 2.17, "alloc" ], [ ".rela.dyn", 5000, 2064, 1.5, "alloc" ], [ ".relr.dyn", 7064, 48, 3.41, "alloc" ], [ ".init", 8192, 3, 1.58, "alloc,executable" ], [ ".text", 8208, 5614, 5.89, "alloc,executable" ], [ ".fini", 13822, 3, 1.58, "alloc,executable" ], [ ".rodata", 16384, 1383, 4.87, "alloc" ], [ ".eh_frame_hdr", 17768, 260, 4.28, "alloc" ], [ ".eh_frame", 18032, 1308, 4.67, "alloc" ], [ ".init_array", 21808, 8, 1.06, "write,alloc" ], [ ".fini_array", 21816, 8, 1.06, "write,alloc" ], [ ".data.rel.ro", 21824, 1552, 0.83, "write,alloc" ], [ ".dynamic", 23376, 496, 1.43, "write,alloc" ], [ ".got", 23872, 704, 0.03, "write,alloc" ], [ ".data", 24576, 200, 0.75, "write,alloc" ], [ ".comment", 24776, 28, 3.99, "merge,strings" ], [ ".shstrtab", 24804, 244, 4.18, "" ] ], "metrics": { "elf": { "bits": 64.0, "entry": 0.0, "has_got": 1.0, "has_plt": 0.0, "has_note": 1.0, "note_count": 2.0, "nx_enabled": 1.0, "has_dt_relr": 1.0, "dynrel_count": 0.0, "dynsym_count": 94.0, "has_build_id": 1.0, "has_eh_frame": 1.0, "has_gnu_hash": 1.0, "stack_canary": 1.0, "symtab_count": 0.0, "dynrela_count": 86.0, "little_endian": 1.0, "dt_flags_1_raw": 1.0, "pltreloc_count": 0.0, "build_id_length": 20.0, "dt_versym_count": 94.0, "executable_stack": 0.0, "fini_array_count": 1.0, "init_array_count": 1.0, "wx_segment_count": 0.0, "comment_entry_count": 1.0, "program_header_count": 11.0, "comment_distinct_count": 1.0, "gnu_stack_section_absent": 0.0, "load_segment_max_file_size": 7112.0, "stripped_but_symtab_present": 0.0, "load_segment_max_memory_size": 7112.0, "section_relocation_group_count": 1.0, "stripped_metadata_section_count": 7.0 }, "file": { "size": 26648.0, "entropy": 3.58, "size_bytes": 26648.0 }, "binary": { "is_pie": 0.0, "has_overlay": 1.0, "is_stripped": 1.0, "code_entropy": 5.89, "data_entropy": 0.74, "overlay_size": 1600.0, "string_count": 170.0, "overlay_ratio": 0.06, "overall_entropy": 3.58, "overlay_entropy": 1.42, "entropy_variance": 2.68, "avg_string_length": 17.98, "max_string_length": 93.0, "peak_region_bytes": 5120.0, "code_to_data_ratio": 0.65, "peak_region_entropy": 5.86, "string_length_stddev": 12.33, "largest_section_ratio": 0.21, "sentence_string_count": 20.0, "sentence_string_ratio": 0.12, "high_entropy_string_count": 0.0 }, "exports": { "count": 9.0 }, "imports": { "count": 84.0 }, "sections": { "count": 25.0, "code_size": 5620.0, "entropy_max": 5.89, "entropy_mean": 2.61, "name_entropy": 4.13, "writable_count": 7.0, "executable_count": 3.0, "nonstandard_count": 5.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 2.0 } } }, "id": 1, "mol": "H(Db₂)Md(He)", "path": "dovecot-mysql-2.4.3-r3.apk!!usr/lib/dovecot/libdriver_mysql.so", "risk": 2, "sha": "9faa21ef074f98b0e92a3cb1335a9a12fbfc32137d8ec10f354bf2ed829005f1", "size": 26648, "traits": [ { "id": "micro-behaviors/data/db/mysql::libmysql", "conf": 0.8999999761581421, "crit": 3, "desc": "libmysql library", "spans": [ [ 4759, 8 ] ] }, { "id": "micro-behaviors/data/db/mysql::mysql-real-connect", "conf": 0.8999999761581421, "crit": 3, "desc": "mysql_real_connect function", "spans": [ [ 3847, 18 ] ] }, { "id": "micro-behaviors/data/db/influxdb::influxdb-flight-sql-ticket", "conf": 0.949999988079071, "crit": 3, "desc": "InfluxDB Arrow Flight SQL ticket", "spans": [ [ 3284, 9 ], [ 3621, 9 ], [ 3652, 9 ] ] }, { "id": "micro-behaviors/data/db/mysql::mysqlclient", "conf": 0.8999999761581421, "crit": 3, "desc": "mysqlclient library", "spans": [ [ 4762, 11 ] ] }, { "id": "micro-behaviors/dylib/library/libc::libc-characteristic-cxa-finalize", "crit": 2, "desc": "libc characteristic cxa finalize", "spans": [ [ 3199, 12 ] ] }, { "id": "metadata/hardening/missing::stripped-binary", "conf": 0.800000011920929, "crit": 3, "desc": "No full symbol table (likely stripped)", "spans": [ [ 0, 25 ] ] }, { "id": "micro-behaviors/dylib/library/libc::libc-internal-functions-b", "conf": 0.699999988079071, "crit": 2, "desc": "libc internal symbols cluster B", "spans": [ [ 3199, 12 ] ] }, { "id": "micro-behaviors/dylib/library/abi-graphics::cxx-abi-symbols-a", "conf": 0.800000011920929, "crit": 2, "desc": "C++ ABI symbols cluster A", "spans": [ [ 3199, 12 ] ] }, { "id": "micro-behaviors/dylib/library/family::cxx-abi-symbols", "conf": 0.800000011920929, "crit": 2, "desc": "C++ ABI symbols", "spans": [ [ 3199, 12 ] ] } ], "type": "elf" }, { "ctx": [ { "b": "boPG/zE)\u0026%By!#9vTf88vS=y3wfrVXf/Q^tuVGThePJJ", "n": [ { "c": 1, "d": "Alpine/Wolfi package info file", "i": "metadata/package/files/system-package::alpine-pkginfo-basename", "o": 0, "z": 1, "cf": 0.8999999761581421 } ], "ln": 1, "addr": 0 }, { "b": "boRbIx(mMaw)]E^A=k(raA?spB7]MgatCG8h.D\u0026", "ln": 2, "addr": 36 }, { "b": "Abf97vqPM#jS[oNC4Cf4Bs?uPB8=0", "n": [ { "c": 2, "d": "Alpine/Wolfi package info metadata", "i": "metadata/package/files/system-package::alpine-apk-pkginfo", "o": 68, "z": 23, "cf": 0.9700000286102295 } ], "ln": 3, "addr": 68 }, { "b": "Abf9fwPw[RatLMae\u0026b81gx", "n": [ { "c": 1, "d": "Alpine/Wolfi package version field", "i": "metadata/package/files/system-package::alpine-pkginfo-version-field", "o": 92, "z": 17, "cf": 0.8999999761581421 } ], "ln": 4, "addr": 92 }, { "b": "Abf8%wPIu7jS)EAq=cjhwo8ycwPw]9z/M%*z*2Y4z/+", "ln": 5, "addr": 110 }, { "b": "B-IpvjS[AWBz#pZfe4J[Cp)AAC4Cf4Bs}GLxd\u003c", "ln": 6, "addr": 145 }, { "b": "B7]@iauZ\u00265hA0xK", "ln": 9, "addr": 257 }, { "b": "vrb\u003c\u003eauZ\u0026(i5Ub4gY", "ln": 10, "addr": 270 }, { "b": "z/PM8x(k4Ray]zlwN/U2", "n": [ { "c": 1, "d": "Alpine/Wolfi package origin field", "i": "metadata/package/files/system-package::alpine-pkginfo-origin-field", "o": 284, "z": 16, "cf": 0.8999999761581421 } ], "ln": 11, "addr": 284 }, { "b": "v@Dj3x(\u003eEXayWfofGq0Ei5rxEixf3eh-S=If\u003c#!Dv(ub5w[r[Yh8l\u003cCv(Mh1wb", "ln": 12, "addr": 301 }, { "b": "zddc@Byw)3wPw[RawMu!vqYH+y-(8-Aa6\u003eKzEWQ7vl!mqAa%i3y?W^fCRi]PxfD", "ln": 13, "addr": 351 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 667.0, "entropy": 5.26, "size_bytes": 667.0 }, "binary": { "overall_entropy": 5.26, "peak_region_bytes": 667.0, "peak_region_entropy": 5.26 } } }, "id": 2, "path": "dovecot-mysql-2.4.3-r3.apk!!.PKGINFO", "risk": 1, "sha": "532eee1edfca6215e6a713322b3f7f346c5e3c7d934377c90536b89cbdc42541", "size": 667, "traits": [ { "id": "metadata/package/files/system-package::arch-pkgname-field", "conf": 0.9399999976158142, "crit": 1, "desc": "Arch pkgname metadata field", "spans": [ [ 68, 23 ] ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-version-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package version field", "spans": [ [ 92, 17 ] ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-basename", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package info file" }, { "id": "metadata/package/files/system-package::alpine-pkginfo-package-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package name field", "spans": [ [ 68, 23 ] ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-origin-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package origin field", "spans": [ [ 284, 16 ] ] }, { "id": "metadata/package/files/system-package::arch-pkgver-field", "conf": 0.9399999976158142, "crit": 1, "desc": "Arch pkgver metadata field", "spans": [ [ 92, 17 ] ] }, { "id": "metadata/package/files/system-package::alpine-apk-pkginfo", "conf": 0.9700000286102295, "crit": 2, "desc": "Alpine/Wolfi package info metadata", "spans": [ [ 68, 23 ], [ 92, 17 ], [ 284, 16 ] ] } ], "type": "text" } ], "rev": "868bd", "v": "8" } }