{ "llm": { "conf": 0.5606617, "grade": "benign", "model": "Qwen/Qwen3.6-27B", "review": false, "outcome": "benign", "interpretation": "Legitimate open-source video codec package" }, "ml": { "v": "7", "eng": "2.2.0-beta.1", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.07726467, "rte": "az", "prob": 0.07726467 } ], "prob": 0.37237376, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.3723737597465515, "type": "apk_alpine" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.07428556680679321, "type": "elf" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.028645306825637817, "type": "elf" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.33140063285827637, "type": "json" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.3723737597465515, "type": "text" } ], "version": "v18.18", "analyzed_at": "2026-07-02T03:01:51Z" }, "path": "aom-3.13.3-r0.apk", "raw": { "files": [ { "id": 0, "ctx": [ { "b": "abZy8010L00rqzkzfK.)^RczrZHCua/le6eQf^+(t%rEr*IH#2-5U9S}%l[^iV[-2xEG2A", "n": [ { "c": 2, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "o": 0, "z": 1, "cf": 1.0 } ], "ln": 0 } ], "mol": "H₂(FU)", "sha": "39d22785ca986f998e5283ad3047818abf225d67e8fcbeb08456bf200f9fd743", "path": "aom-3.13.3-r0.apk", "risk": 3, "size": 789442, "type": "apk_alpine", "facts": { "metrics": { "file": { "size": 789442.0, "entropy": 8.0, "size_bytes": 789442.0 }, "parse": { "error_count": 1.0 }, "binary": { "overall_entropy": 8.0, "peak_region_bytes": 778178.0, "peak_region_entropy": 7.84 } } }, "traits": [ { "id": "micro-behaviors/fs/file/binary::binary-read-write-ops", "atk": "T1005", "conf": 0.699999988079071, "crit": 3, "desc": "Binary file read/write operations", "from": [ { "off": 7399, "file": 1 }, { "off": 4661, "file": 2 } ] }, { "id": "metadata/binary/metrics/threshold::high-string-count-1000", "conf": 0.699999988079071, "crit": 2, "desc": "High string count over 1000", "from": [ { "file": 1 } ], "spans": [ [ 0, 29 ] ] }, { "id": "metadata/package/files/system-package::spdx-melange-creator", "conf": 0.8999999761581421, "crit": 1, "desc": "Melange SPDX creator", "from": [ { "file": 3 } ] }, { "id": "metadata/package/files/system-package::spdx-wolfi-apk-purl", "conf": 0.8999999761581421, "crit": 1, "desc": "Wolfi APK package URL in SPDX", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/ui/help::usage-help", "conf": 0.699999988079071, "crit": 2, "desc": "Short -h help flag", "from": [ { "file": 1 } ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-basename", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package info file" }, { "id": "metadata/package/files/system-package::wolfi-pkginfo-maintainer", "conf": 0.8999999761581421, "crit": 1, "desc": "Wolfi package maintainer field", "from": [ { "file": 4 } ] }, { "id": "metadata/binary/metrics/threshold::many-imports-50", "conf": 1.0, "crit": 1, "desc": "Binary has 50+ imports", "from": [ { "file": 1 } ], "spans": [ [ 0, 21 ] ] }, { "id": "metadata/package/files/system-package::alpine-apk-pkginfo", "conf": 0.9700000286102295, "crit": 2, "desc": "Alpine/Wolfi package info metadata", "from": [ { "off": 85, "file": 4, "line": 6 } ] }, { "id": "micro-behaviors/ui/help::options-title-string", "crit": 1, "desc": "Options: label in binary strings", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/file/binary::fseek-func", "atk": "T1005", "conf": 0.4000000059604645, "crit": 2, "desc": "Seeks to position in file", "from": [ { "file": 1 } ] }, { "id": "metadata/package/files/system-package::spdx-apk-pkginfo-source", "conf": 0.8999999761581421, "crit": 1, "desc": "SPDX references APK DB package info", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/dylib/library/libc::libc-internal-functions-b", "conf": 0.699999988079071, "crit": 2, "desc": "libc internal symbols cluster B", "from": [ { "file": 1 }, { "file": 2 } ] }, { "id": "micro-behaviors/dylib/library/libc::libc-characteristic-cxa-finalize", "crit": 2, "desc": "libc characteristic cxa finalize", "from": [ { "file": 1 } ] }, { "id": "metadata/package/files/system-package::spdx-document-version", "conf": 0.8999999761581421, "crit": 1, "desc": "SPDX document version field" }, { "id": "micro-behaviors/ui/help::usage-title", "crit": 2, "desc": "Usage: label (title case)", "from": [ { "file": 1 } ], "spans": [ [ 735040, 28 ] ] }, { "id": "micro-behaviors/ui/help::usage-label", "conf": 0.75, "crit": 1, "desc": "Command line usage text", "from": [ { "file": 1 }, { "file": 2 } ], "spans": [ [ 735040, 28 ] ] }, { "id": "metadata/package/files/system-package::spdx-melange-namespace", "conf": 0.8999999761581421, "crit": 1, "desc": "Melange SPDX document namespace" }, { "id": "micro-behaviors/ui/help::options-title", "crit": 2, "desc": "Options: label", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/file/binary::fseek-text", "atk": "T1005", "crit": 2, "desc": "fseek API string", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/ui/help::usage-title-string", "crit": 1, "desc": "Usage: label in binary strings", "from": [ { "file": 1 } ], "spans": [ [ 735040, 28 ] ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-version-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package version field", "from": [ { "file": 4 } ] }, { "id": "metadata/package/files/system-package::spdx-sbom-document", "conf": 0.9800000190734863, "crit": 2, "desc": "SPDX SBOM document", "from": [ { "file": 3 } ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-origin-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package origin field", "from": [ { "file": 4 } ] }, { "id": "metadata/package/files/system-package::melange-pkginfo-generator", "conf": 0.8999999761581421, "crit": 1, "desc": "Melange-generated package metadata", "from": [ { "file": 4 } ] }, { "id": "metadata/package/files/system-package::spdx-document-id", "conf": 0.8999999761581421, "crit": 1, "desc": "SPDX document identifier" }, { "id": "metadata/build/artifact::elf-stripped-but-symtab-present", "conf": 0.6000000238418579, "crit": 3, "desc": "ELF stripped with .symtab present", "from": [ { "file": 1 } ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-package-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package name field", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/ui/help::has-help", "conf": 0.8500000238418579, "crit": 3, "desc": "Contains help or usage information", "from": [ { "file": 1 }, { "file": 2 } ] } ] }, { "ctx": [ { "b": "E))420S-r400000000000@$H+0rr91vcET\u003e00000kMy=:00000v4dVb0000000000kMA+z4feS[aPJR+1][S61on", "n": [ { "c": 2, "d": "ELF program interpreter metadata", "i": "metadata/binary/linking/runtime::interpreter", "o": 0, "z": 1, "cf": 1.0 } ], "ln": 0 }, { "b": "[hysE000000rr9100000fkLuihz^76wg.RizGQgQCSmPkhz^4cz.r^B000003\u0026*ncH5.hN0rr911][S6Fc?{jGH3pRH5.h", "n": [ { "c": 2, "d": "Reference to /lib64", "i": "micro-behaviors/fs/path/system::system-lib64", "o": 792, "z": 27, "cf": 0.6600000262260437 } ], "ln": 776 }, { "b": "B6\u0026\u003c8wO%}W0ae]er.+w6uTEq/CWU5}B$\u003eZguTEqVvrlG%BA}?puUKy\u0026z::Ukt2XJ$f!=%wv%v", "n": [ { "c": 2, "d": "GNU libstdc++ stdlib", "i": "micro-behaviors/dylib/library/libc::libstdcxx-ref", "o": 5850, "z": 10, "cf": 0.8999999761581421 } ], "ln": 5834 }, { "b": "uUKy(BvyuMuS{xIgbicyxkzo\u003ev%Al9vrlH3A=+V2vqfKOojIWmfKE:juJsCppe=l?g5", "n": [ { "c": 2, "d": "Benign network-capable library context", "i": "objectives/supply-chain/trojanized/backdoor::benign-network-library-context", "o": 6339, "z": 5, "cf": 0.8999999761581421 } ], "ln": 6323 }, { "b": "z/OVEv/Qs-xe87uy\u0026r}^AbP}2uSy#/x(mD*qE%](zdJYVxjVga0chT{x(mCYB97@bzuaS#BAmB]z/xo9hz+zvuVQr$v@2BYxLQ%!vqfJTw].D\u003ewb{g=x(\u003ct/wPRzZA:-\u0026@uVDc=B-.bbvr8uWwPz*fASxY-y\u0026]", "n": [ { "c": 3, "d": "Stack protector/canary enabled", "i": "metadata/hardening/build::stack-protector", "o": 7055, "z": 14, "cf": 0.8999999761581421 }, { "c": 2, "d": "Open files (64-bit)", "i": "micro-behaviors/fs/file/open::fopen64", "o": 7045, "z": 7, "cf": 0.6600000262260437 }, { "c": 2, "d": "Generic file read/write operations", "i": "micro-behaviors/fs/file/read-write::binary-file-ops", "o": 7070, "z": 5, "cf": 0.800000011920929 }, { "c": 2, "d": "Line-based file reading (fgets)", "i": "micro-behaviors/process/create/direct::fgets-loop", "o": 7021, "z": 5, "cf": 1.0 }, { "c": 2, "d": "Terminates process immediately without cleanup", "i": "micro-behaviors/process/terminate/signal::_exit", "o": 7076, "z": 4, "cf": 0.4000000059604645 }, { "c": 1, "d": "libm pow import", "i": "micro-behaviors/dylib/library/libm::libm-pow-symbol", "o": 7002, "z": 3, "cf": 0.4000000059604645 } ], "ln": 6986 }, { "b": "0bVp:zeTPe0crm5Bz\u003eW\u0026xjVgbx(dB1w[ks}0aP?Rvrb}1ASyh}zdJYVBy/o8z-fALB98CswO}G?BAhCAASxY.z!n#RuUG", "n": [ { "c": 2, "d": "Get current time with microsecond precision", "i": "micro-behaviors/time/query::gettimeofday", "o": 7130, "z": 12, "cf": 0.30000001192092896 }, { "c": 2, "d": "Get current calendar time (seconds)", "i": "micro-behaviors/time/query::time", "o": 7152, "z": 4, "cf": 0.30000001192092896 } ], "ln": 7114 }, { "b": "v}Y(.C5}LuA+PAkw=MgBv%zA?w[=c\u003ey?Xib0crm5v}Y(.w]}Q2yYFJ#A+foiz/L?/vqG:#v/QvS", "n": [ { "c": 2, "d": "C++ ABI symbols cluster A", "i": "micro-behaviors/dylib/library/abi-graphics::cxx-abi-symbols-a", "o": 7267, "z": 12, "cf": 0.800000011920929 } ], "ln": 7251 }, { "b": "z#:GWy\u0026sxa0bVp:B7GB[w]I)mv/QW:Ab]VgBy\u003eIWuUKO1v(VLRB8$\u00261zE@(\u0026BAhFwB.?4{wO\u003e{@C(RD2A+PSb0a{p-wOVixgYRPsA:@%90a{p-wORoMuUam#zF@(#z!0i$x(v\u003e?B98Cuv@le+y?Wu!z/4aFz.r*Cy?Wv1ByX(id\u003eU)Ye\u0026AYCx\u003c${iB8JV?0bMvUxjCBUB1RJLe?)uxx\u003c$N8B8JV?07PyzuO:q*07PZOlpk9ne\u00262A!m[=GvlTIP3ga\u003eA:m[=GvlS^C$gCgHpgbe", "n": [ { "c": 3, "d": "Binary file read/write operations", "i": "micro-behaviors/fs/file/binary::binary-read-write-ops", "o": 7383, "z": 8, "cf": 0.699999988079071 }, { "c": 2, "d": "libc version string pattern", "i": "micro-behaviors/dylib/library/libc::libc-version-string", "o": 7499, "z": 5, "cf": 0.800000011920929 }, { "c": 2, "d": "GNU libstdc++ stdlib", "i": "micro-behaviors/dylib/library/libc::libstdcxx-ref", "o": 7442, "z": 12, "cf": 0.8999999761581421 }, { "c": 2, "d": "fseek API string", "i": "micro-behaviors/fs/file/binary::fseek-text", "o": 7399, "z": 5, "cf": 0.5 }, { "c": 2, "d": "Write single bytes to file", "i": "micro-behaviors/fs/file/write/direct::fputc", "o": 7330, "z": 5, "cf": 0.6600000262260437 }, { "c": 2, "d": "Write files (fwrite)", "i": "micro-behaviors/fs/file/write/direct::write--fwrite", "o": 7376, "z": 6, "cf": 0.6600000262260437 } ], "ln": 7314 }, { "b": "w?BPoGA7#L008Q39@mRk4/$4{w!b$K008Q39@n\u003e\u003e{ppk9002MD\u003cV#)jr8Vts(\u003e/^70aX=Y", "n": [ { "c": 2, "d": "XGETBV instruction bytes", "i": "metadata/binary/instruction::xgetbv-instr", "o": 164134, "z": 8, "cf": 0.30000001192092896 } ], "ln": 164118 }, { "b": "Coz3Hvp%c]z/x/jz/fRsvqYP#wQ4{h0aYUIB.pXIB-.OBBrCgfy?mG)zdJY+B$\u003e-", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 778288, "z": 3, "cf": 0.800000011920929 } ], "ln": 778272 }, { "b": "y?W:2Bo3w$x(B5JyIv-gBzbkdw[=pbBrCDzx(m)jBrCgovqPN%0b3j*wb]RJwGTF", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 778538, "z": 3, "cf": 0.800000011920929 } ], "ln": 778522 }, { "b": "A=k/lBo1TwBrCa9Acb+ow]zYjv@C)?v/QjXAclmOvRG{owmY.4xAgwkBrCa9Acb:", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 778883, "z": 3, "cf": 0.800000011920929 } ], "ln": 778867 }, { "b": "z/cXmwPR%bv\u003c2(ozE)u3Cwhej0aY!+Bs?uvBAh890aQ12y?m^3yYFrXCR9SEBAg!w", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 780254, "z": 4, "cf": 0.800000011920929 } ], "ln": 780238 }, { "b": "ePtcsBzk\u0026hz/fQ@ze0(tAa9^ex([6czy]{zDsW7[vr:wyvrcE7BzkVhePUSLwDlpVvpB4:eD", "n": [ { "c": 2, "d": "Disk partitioning utility context", "i": "well-known/tool/sysadmin/disk-utility::disk-partition-context", "o": 780584, "z": 9, "cf": 0.8999999761581421 } ], "ln": 780568 }, { "b": "0cAB6ePtctB1IPIwoqF+ra]?=CwgPfxDRk9aAR*CePtctB1I9zAclm5BA.TPAa9!", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 782268, "z": 3, "cf": 0.800000011920929 } ], "ln": 782252 }, { "b": "ze:Pdg+}2\u003cwmYvYB.(d1B7ol4wO}G\u003czFKcdCwWz7wPz)bv{%fNv@Dg4v{%E\u003cwb{sOwO}", "n": [ { "c": 1, "d": "Terminal type screen identifier", "i": "micro-behaviors/process/tty/terminal::terminal-type-screen", "o": 782704, "z": 6, "cf": 0.800000011920929 } ], "ln": 782688 }, { "b": "AaJ]fc36y[y*?Q2A=Rj7BzbxfeK0-.AccvNdfaK5v@#TfiYZRxuVGZ^y\u0026131uTW[)", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 784776, "z": 4, "cf": 0.800000011920929 } ], "ln": 784760 }, { "b": "e[]Gv018IvBzkVhB2\u003cTd3pO\u0026xz!9B1av*l^vQT6}pJgz\u0026z/fRS3igAhvru66lVl\u003c:A=k+ppJgz\u0026z/fRS3igAawQd)dvqPM#p\u00266MIwO(0@BrBv#BzkVhB2\u003cTd3pdYEax9k\u003cv}/K?v\u003c1M^BzkVhB2\u003cTd3q2bBy\u0026%o1wftD3v@C)?A=TnG3igzQarR^Hao", "n": [ { "c": 3, "d": "Contains help or usage information", "i": "micro-behaviors/ui/help::has-help", "o": 786144, "z": 23, "cf": 0.8500000238418579 }, { "c": 2, "d": "Benign POSIX fd redirect shell context", "i": "objectives/command-and-control/reverse-shell/dup::posix-fd-redirect-shell-benign-context", "o": 786224, "z": 21, "cf": 0.9399999976158142 }, { "c": 2, "d": "Benign dual-mode socket exec context", "i": "objectives/command-and-control/reverse-shell/dup::unix-dual-mode-socket-exec-benign-context", "o": 786194, "z": 27, "cf": 0.949999988079071 }, { "c": 2, "d": "Benign terminal socket exec context", "i": "objectives/command-and-control/reverse-shell/dup::unix-terminal-socket-exec-benign-context", "o": 786170, "z": 21, "cf": 0.949999988079071 } ], "ln": 786128 }, { "b": "By!#9sU@?}B98ClvqNQ%fjXTqfk+]GyYDIlB.?4Bz!9A?iV].\u00263igAiBAg@3z6hz/wmZ0Dao", "n": [ { "c": 2, "d": "/dev/null (legitimate discard device)", "i": "micro-behaviors/fs/path/device/special::dev-null", "o": 786423, "z": 9, "cf": 1.0 } ], "ln": 786407 }, { "b": "vrM6[y**^?wEnzq00000rDzOYwJy}WB09O-Acb/jzGv#:ePh+xB97=3x(4u#vqPM#B8\u003e+$w[=6)zEEx[3ig5a000003r84!wNPA#BzkP6vQTs?asF/[BzkP6", "n": [ { "c": 2, "d": "Benign network-capable utility context", "i": "objectives/supply-chain/trojanized/backdoor::benign-network-client-context", "o": 811496, "z": 48, "cf": 0.8999999761581421 } ], "ln": 811480 }, { "b": "arU9gwfrDQxK$)\u003cxMLvBeODNk07Hyhy?mc1Bz\u0026pywPP58xMw3dvixSlvSL%{Aboj", "n": [ { "c": 2, "d": "Short -h help flag", "i": "micro-behaviors/ui/help::usage-help", "o": 812563, "z": 3, "cf": 0.699999988079071 } ], "ln": 812547 }, { "b": "b4kI4xLzN1v@#\u003clwG\u003ceVCSmP*hz=Ra00000000000000000000000000000000000000", "n": [ { "c": 3, "d": "Architecture detection strings", "i": "objectives/discovery/host/software::arch-detection", "o": 896870, "z": 6, "cf": 0.5 } ], "ln": 896854 }, { "b": "xj2H:ByO$:uS{xIgbicyxkzo\u003ev%Al9vrlH3A=+V2vqfKOojIWmfKE:juQdaPnKt^Dso", "n": [ { "c": 2, "d": "glibc reference", "i": "micro-behaviors/dylib/library/libc::glibc-ref", "o": 980259, "z": 5, "cf": 0.30000001192092896 } ], "ln": 980243 }, { "b": "m}D^ovpK1?xgl$zuS{h+uTEC-BZFT6CRH%XuVZi[CYN$Ex(mMPpe=l[uTEq/CRH{cggBWkx-", "n": [ { "c": 2, "d": "GNU libstdc++ stdlib", "i": "micro-behaviors/dylib/library/libc::libstdcxx-ref", "o": 1015571, "z": 9, "cf": 0.8999999761581421 } ], "ln": 1015555 }, { "b": "BAhFivGn34xMFooBywRUe[]iBwPz.\u0026e[Y6Ae[!WmxAfU}D2vXGz2=h0D2vXBASv.8zGNNPwPz\u003caz/bLcxkR\u0026AC4CYnx(v(@ASv.jwD", "n": [ { "c": 2, "d": "ELF dynstr section name", "i": "metadata/binary/linking/static::elf-dynstr-section-name", "o": 1022556, "z": 7, "cf": 0.8999999761581421 }, { "c": 2, "d": "ELF dynsym section name", "i": "metadata/binary/linking/static::elf-dynsym-section-name", "o": 1022548, "z": 7, "cf": 0.8999999761581421 }, { "c": 2, "d": "ELF interpreter section name", "i": "metadata/binary/linking/static::elf-interpreter-section-name", "o": 1022530, "z": 7, "cf": 0.8999999761581421 } ], "ln": 1022514 }, { "b": "vr?\u00269wmoN*e]\u003eJte]\u003e\u003ege[xlBvqPZ*04}!\u003cByte4vSMO\u003ce[n*pzdNQb000000000000000", "n": [ { "c": 2, "d": "ELF dynamic section name", "i": "metadata/binary/linking/static::elf-dynamic-section-name", "o": 1022782, "z": 8, "cf": 0.8999999761581421 } ], "ln": 1022766 } ], "depth": 1, "facts": { "exp": [ [ "stdout" ], [ "stderr" ], [ "ZNKSt5ctypeIcE8do_widenEc" ], [ "ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE6resizeEmc" ], [ "ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE10_M_replaceEmmPKcm" ], [ "stdin" ], [ "ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE9_M_mutateEmmPKcm" ], [ "ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE15_M_replace_coldEPcmPKcmm" ] ], "imp": [ [ "", "ftell" ], [ "", "Znam" ], [ "", "errno_location" ], [ "", "printf" ], [ "", "aom_codec_error" ], [ "", "ZNSt8__detail15_List_node_base7_M_hookEPS0_" ], [ "", "rewind" ], [ "", "ZSt29_Rb_tree_insert_and_rebalancebPSt18_Rb_tree_node_baseS0_RS_" ], [ "", "clearerr" ], [ "", "ZTVSt9basic_iosIcSt11char_traitsIcEE" ], [ "", "strstr" ], [ "", "ZNSt13basic_filebufIcSt11char_traitsIcEE5closeEv" ], [ "", "ZNKSt12__basic_fileIcE7is_openEv" ], [ "", "ZNSt14basic_ifstreamIcSt11char_traitsIcEED1Ev" ], [ "", "aom_rb_read_literal" ], [ "", "ZSt7nothrow" ], [ "", "aom_codec_encode" ], [ "", "aom_img_plane_height" ], [ "", "getc" ], [ "", "aom_codec_set_option" ], [ "", "ZNSt8ios_baseC2Ev" ], [ "", "ZSt21__glibcxx_assert_failPKciS0_S0_" ], [ "", "strtoul" ], [ "", "aom_codec_get_global_headers" ], [ "", "aom_rb_bytes_read" ], [ "", "ZNSt8ios_baseD2Ev" ], [ "", "strerror" ], [ "", "strchr" ], [ "", "cxa_begin_catch" ], [ "", "aom_codec_av1_dx" ], [ "", "aom_codec_get_cx_data" ], [ "", "strlen" ], [ "", "memcmp" ], [ "", "aom_codec_enc_config_default" ], [ "", "strncmp" ], [ "", "log10" ], [ "", "aom_codec_iface_name" ], [ "", "ZSt20__throw_length_errorPKc" ], [ "", "memset" ], [ "", "aom_codec_destroy" ], [ "", "ZSt28_Rb_tree_rebalance_for_erasePSt18_Rb_tree_node_baseRS_" ], [ "", "ZdlPvRKSt9nothrow_t" ], [ "", "vsnprintf" ], [ "", "ZTVSt15basic_streambufIcSt11char_traitsIcEE" ], [ "", "calloc" ], [ "", "ZdaPvRKSt9nothrow_t" ], [ "", "ZSt18_Rb_tree_incrementPSt18_Rb_tree_node_base" ], [ "", "ZTVN10__cxxabiv117__class_type_infoE" ], [ "", "ZSt19__throw_logic_errorPKc" ], [ "", "aom_codec_enc_init_ver" ], [ "", "libc_start_main" ], [ "", "strtod" ], [ "", "log" ], [ "", "memcpy" ], [ "", "aom_rb_read_bit" ], [ "", "ZNSt13basic_filebufIcSt11char_traitsIcEE4openEPKcSt13_Ios_Openmode" ], [ "", "time" ], [ "", "isoc99_sscanf" ], [ "", "ZTVSt14basic_ifstreamIcSt11char_traitsIcEE" ], [ "", "fclose" ], [ "", "Znwm" ], [ "", "rand_r" ], [ "", "ZdlPvm" ], [ "", "aom_read_obu_header_and_size" ], [ "", "ZNSt13basic_filebufIcSt11char_traitsIcEEC1Ev" ], [ "", "ZSt18_Rb_tree_decrementPSt18_Rb_tree_node_base" ], [ "", "aom_codec_err_to_string" ], [ "", "aom_codec_control" ], [ "", "fseek" ], [ "", "memchr" ], [ "", "stack_chk_fail" ], [ "", "fopen64" ], [ "", "ZNKSt5ctypeIcE13_M_widen_initEv" ], [ "", "fflush" ], [ "", "aom_img_alloc" ], [ "", "free" ], [ "", "exit" ], [ "", "fputc" ], [ "", "ZSt16__throw_bad_castv" ], [ "", "ZdaPv" ], [ "", "ZTVN10__cxxabiv120__si_class_type_infoE" ], [ "", "malloc" ], [ "", "vfprintf" ], [ "", "ZNSt9basic_iosIcSt11char_traitsIcEE4initEPSt15basic_streambufIcS1_E" ], [ "", "ZNSi5seekgElSt12_Ios_Seekdir" ], [ "", "aom_rb_read_uvlc" ], [ "", "putchar" ], [ "", "strcmp" ], [ "", "strtol" ], [ "", "ZNSt6localeD1Ev" ], [ "", "cxa_throw_bad_array_new_length" ], [ "", "fprintf" ], [ "", "aom_codec_decode" ], [ "", "fread" ], [ "", "aom_codec_dec_init_ver" ], [ "", "ZSt24__throw_out_of_range_fmtPKcz" ], [ "", "ZTVSt13basic_filebufIcSt11char_traitsIcEE" ], [ "", "ftello64" ], [ "", "puts" ], [ "", "feof" ], [ "", "ZNSt13basic_filebufIcSt11char_traitsIcEED1Ev" ], [ "", "ZSt21ios_base_library_initv" ], [ "", "aom_codec_av1_cx" ], [ "", "fgets" ], [ "", "snprintf" ], [ "", "aom_codec_version_str" ], [ "", "gettimeofday" ], [ "", "memmove" ], [ "", "ZNSt8__detail15_List_node_base9_M_unhookEv" ], [ "", "cxa_end_catch" ], [ "", "realloc" ], [ "", "ZnamRKSt9nothrow_t" ], [ "", "fseeko64" ], [ "", "aom_codec_error_detail" ], [ "", "gxx_personality_v0" ], [ "", "ZNSt9basic_iosIcSt11char_traitsIcEE5clearESt12_Ios_Iostate" ], [ "", "ZNSi5tellgEv" ], [ "", "pow" ], [ "", "aom_img_plane_width" ], [ "", "ITM_deregisterTMCloneTable" ], [ "", "Unwind_Resume" ], [ "", "ZSt7getlineIcSt11char_traitsIcESaIcEERSt13basic_istreamIT_T0_ES7_RNSt7__cxx1112basic_stringIS4_S5_T1_EES4_" ], [ "", "ZNSt12__basic_fileIcED1Ev" ], [ "", "ferror" ], [ "", "gmon_start__" ], [ "", "cxa_pure_virtual" ], [ "", "ITM_registerTMCloneTable" ], [ "", "fwrite" ], [ "", "ZdaPvm" ], [ "", "ZTTSt14basic_ifstreamIcSt11char_traitsIcEE" ], [ "", "ZnwmRKSt9nothrow_t" ], [ "", "isoc23_strtol" ], [ "", "aom_img_free" ], [ "", "cxa_finalize" ] ], "sec": [ [ ".interp", 792, 28, 3.94, "alloc" ], [ ".gnu.hash", 824, 108, 3.84, "alloc" ], [ ".dynsym", 936, 3432, 1.26, "alloc" ], [ ".dynstr", 4368, 3370, 5.01, "alloc" ], [ ".gnu.version", 7738, 286, 1.98, "alloc" ], [ ".gnu.version_r", 8024, 368, 3.45, "alloc" ], [ ".rela.dyn", 8392, 20712, 2.48, "alloc" ], [ ".rela.plt", 29104, 2760, 1.76, "alloc,info_link" ], [ ".init", 32768, 27, 4.31, "alloc,executable" ], [ ".plt", 32800, 1856, 4.34, "alloc,executable" ], [ ".plt.got", 34656, 16, 3.58, "alloc,executable" ], [ ".plt.sec", 34672, 1840, 3.99, "alloc,executable" ], [ ".text", 36544, 741071, 6.51, "alloc,executable" ], [ ".fini", 777616, 13, 3.24, "alloc,executable" ], [ ".rodata", 778240, 46968, 5.59, "alloc" ], [ ".eh_frame_hdr", 825208, 12460, 5.74, "alloc" ], [ ".eh_frame", 837672, 56684, 5.33, "alloc" ], [ ".gcc_except_table", 894356, 2302, 5.24, "alloc" ], [ ".note.gnu.property", 896664, 80, 1.96, "alloc" ], [ ".note.ABI-tag", 896744, 32, 1.5, "alloc" ], [ ".note.package", 896776, 104, 4.79, "alloc" ], [ ".init_array", 899088, 8, 1.06, "write,alloc" ], [ ".fini_array", 899096, 8, 0.54, "write,alloc" ], [ ".data.rel.ro", 899104, 12488, 2.05, "write,alloc" ], [ ".dynamic", 911592, 576, 1.59, "write,alloc" ], [ ".got", 912168, 1216, 1.89, "write,alloc" ], [ ".data", 913408, 24, 0.74, "write,alloc" ], [ ".comment", 913432, 31, 4.03, "merge,strings" ], [ ".symtab", 913464, 48744, 3.11, "" ], [ ".strtab", 962208, 60295, 5.51, "" ], [ ".shstrtab", 1022503, 308, 4.28, "" ] ], "metrics": { "elf": { "bits": 64.0, "entry": 59744.0, "has_got": 1.0, "has_plt": 1.0, "has_note": 1.0, "relacount": 822.0, "has_symtab": 1.0, "note_count": 3.0, "nx_enabled": 1.0, "has_cet_ibt": 1.0, "dynrel_count": 0.0, "dynsym_count": 143.0, "has_eh_frame": 1.0, "has_gnu_hash": 1.0, "stack_canary": 1.0, "symtab_count": 2031.0, "dynrela_count": 863.0, "has_cet_shstk": 1.0, "little_endian": 1.0, "dt_flags_1_raw": 134217729.0, "pltreloc_count": 115.0, "dt_versym_count": 143.0, "executable_stack": 0.0, "fini_array_count": 1.0, "init_array_count": 1.0, "wx_segment_count": 0.0, "comment_entry_count": 1.0, "program_header_count": 13.0, "comment_distinct_count": 1.0, "gnu_stack_section_absent": 0.0, "load_segment_max_file_size": 744861.0, "stripped_but_symtab_present": 1.0, "load_segment_max_memory_size": 744861.0, "section_relocation_group_count": 2.0, "stripped_metadata_section_count": 5.0 }, "file": { "size": 1024928.0, "entropy": 6.48, "size_bytes": 1024928.0 }, "binary": { "is_pie": 1.0, "has_overlay": 1.0, "is_stripped": 0.0, "code_entropy": 6.5, "data_entropy": 2.01, "overlay_size": 2117.0, "string_count": 3146.0, "overlay_ratio": 0.0, "overall_entropy": 6.48, "overlay_entropy": 1.65, "entropy_variance": 2.7, "avg_string_length": 30.45, "max_string_length": 297.0, "peak_region_bytes": 286720.0, "code_to_data_ratio": 0.98, "peak_region_entropy": 6.41, "string_length_stddev": 26.71, "largest_section_ratio": 0.72, "sentence_string_count": 469.0, "sentence_string_ratio": 0.15, "high_entropy_string_count": 0.0 }, "exports": { "count": 8.0 }, "imports": { "count": 134.0 }, "sections": { "count": 33.0, "code_size": 744823.0, "entropy_max": 6.51, "entropy_mean": 3.38, "name_entropy": 4.23, "writable_count": 7.0, "executable_count": 6.0, "nonstandard_count": 7.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 5.0 } } }, "id": 1, "mol": "H₂(FU)", "path": "aom-3.13.3-r0.apk!!usr/bin/aomenc", "risk": 3, "sha": "5f2dc7aebf4bbff4c3c5e7a17e6fba5b3661e3c45e5c6acb1a28f2a079139ecb", "size": 1024928, "traits": [ { "id": "micro-behaviors/fs/file/binary::fseek-func", "atk": "T1005", "conf": 0.4000000059604645, "crit": 2, "desc": "Seeks to position in file", "spans": [ [ 7383, 8 ], [ 7399, 5 ] ] }, { "id": "micro-behaviors/ui/help::options-title-string", "crit": 1, "desc": "Options: label in binary strings", "spans": [ [ 786144, 23 ], [ 786170, 21 ], [ 786194, 27 ], [ 786224, 21 ] ] }, { "id": "micro-behaviors/ui/help::options-title", "crit": 2, "desc": "Options: label", "spans": [ [ 786144, 23 ], [ 786170, 21 ], [ 786194, 27 ], [ 786224, 21 ] ] }, { "id": "micro-behaviors/ui/help::usage-help", "conf": 0.699999988079071, "crit": 2, "desc": "Short -h help flag", "spans": [ [ 812563, 3 ] ] }, { "id": "micro-behaviors/fs/file/binary::fseek-text", "atk": "T1005", "crit": 2, "desc": "fseek API string", "spans": [ [ 7399, 5 ] ] }, { "id": "micro-behaviors/dylib/library/libc::libc-characteristic-cxa-finalize", "crit": 2, "desc": "libc characteristic cxa finalize", "spans": [ [ 7267, 12 ] ] }, { "id": "metadata/build/artifact::elf-stripped-but-symtab-present", "conf": 0.6000000238418579, "crit": 3, "desc": "ELF stripped with .symtab present", "spans": [ [ 0, 38 ] ] }, { "id": "metadata/binary/metrics/threshold::many-imports-50", "conf": 1.0, "crit": 1, "desc": "Binary has 50+ imports", "spans": [ [ 0, 22 ] ] }, { "id": "micro-behaviors/ui/help::usage-title", "crit": 2, "desc": "Usage: label (title case)", "spans": [ [ 811496, 48 ] ] }, { "id": "micro-behaviors/ui/help::usage-title-string", "crit": 1, "desc": "Usage: label in binary strings", "spans": [ [ 811496, 48 ] ] }, { "id": "metadata/binary/metrics/threshold::high-string-count-1000", "conf": 0.699999988079071, "crit": 2, "desc": "High string count over 1000", "spans": [ [ 0, 29 ] ] }, { "id": "micro-behaviors/ui/help::has-help", "conf": 0.8500000238418579, "crit": 3, "desc": "Contains help or usage information", "spans": [ [ 786144, 23 ], [ 786170, 21 ], [ 786194, 27 ], [ 786224, 21 ], [ 811496, 48 ] ] }, { "id": "micro-behaviors/fs/file/binary::binary-read-write-ops", "atk": "T1005", "conf": 0.699999988079071, "crit": 3, "desc": "Binary file read/write operations", "spans": [ [ 7383, 8 ], [ 7399, 5 ] ] }, { "id": "micro-behaviors/dylib/library/libc::libc-internal-functions-b", "conf": 0.699999988079071, "crit": 2, "desc": "libc internal symbols cluster B", "spans": [ [ 7267, 12 ] ] }, { "id": "micro-behaviors/ui/help::usage-label", "conf": 0.75, "crit": 1, "desc": "Command line usage text", "spans": [ [ 786144, 23 ], [ 786170, 21 ], [ 786194, 27 ], [ 786224, 21 ], [ 811496, 48 ] ] } ], "type": "elf" }, { "ctx": [ { "b": "E))420S-r400000000000@$H+0rr91POAHE00000kMy=:00000\u00266v?M0000000000kMA+z4feS[aPJR+1][S61on", "n": [ { "c": 2, "d": "ELF program interpreter metadata", "i": "metadata/binary/linking/runtime::interpreter", "o": 0, "z": 1, "cf": 1.0 } ], "ln": 0 }, { "b": "fG5[h000000rr9100000fkLuihz^76wg.RizGQgQCSmPkhz^4cz.r^B000001onA4s]XK50rr911][S600e+[Fb{h.s]XK", "n": [ { "c": 2, "d": "Reference to /lib64", "i": "micro-behaviors/fs/path/system::system-lib64", "o": 792, "z": 27, "cf": 0.6600000262260437 } ], "ln": 776 }, { "b": "B7CtUt5E+=0ae]er.+w6uTEq/CWU5}B$\u003eZguTEqVvrlG%BA}?puUKy\u0026z::Ukt2XJ$f!=%wv%v", "n": [ { "c": 2, "d": "GNU libstdc++ stdlib", "i": "micro-behaviors/dylib/library/libc::libstdcxx-ref", "o": 3904, "z": 10, "cf": 0.8999999761581421 } ], "ln": 3888 }, { "b": "BzbYkCvbB(uS{xIgbicyxkzo\u003ev%Al9vrlH3A=+V2vqfKOojIWmfKE:juJsCpzG/{$uJ", "n": [ { "c": 2, "d": "Benign network-capable library context", "i": "objectives/supply-chain/trojanized/backdoor::benign-network-library-context", "o": 4095, "z": 5, "cf": 0.8999999761581421 } ], "ln": 4079 }, { "b": "0ae-zCwg@9uS7DRB.$W\u0026w[LW%A@Zk(Cwg@90cr3%A+PAkw=M)]wnb]Yw]zT1zz\u003crKuTE\u003e@vpK7Wv}YT+w)]y\u00260a{m.vpPvHCXIm1A:-\u0026@uVDc-wO(p5C4yU^wPS3dzdNS$wmo--B98CAz!]z}x(dzYB98CswO}G?BAhCAASxY.z!n#\u003cByYrjBo3t)vqG:#v/Qj:vruQp0bVdXy\u0026r!-uTER-vQ\u0026+^ByxiiuU%j=zua:1wmY!40af8yCWT@\u003ex(mu}x)Ks\u003cB98CjxMs8+By/o80aPCNy\u0026r!-w[bT}B7Ct*wO(H1Bo2](B-.9[C4LYlx(n380a{g)BAmC6BAhFwB.?4{wO\u003e{@C(RD2A+PSb0a{p-wOVixgYRPsA:@%90a{p-wORo!BAhnezeYF\u003ex\u003c$H?z7Y)Fe\u00269Gzx\u003c#d9wmEbue]$}-humMcvR)-sz.r{Fy?Wu\u003ev}e\u003e!e]$}-f-V37vQ?1", "n": [ { "c": 3, "d": "Stack protector/canary enabled", "i": "metadata/hardening/build::stack-protector", "o": 4414, "z": 14, "cf": 0.8999999761581421 }, { "c": 3, "d": "Binary file read/write operations", "i": "micro-behaviors/fs/file/binary::binary-read-write-ops", "o": 4645, "z": 8, "cf": 0.699999988079071 }, { "c": 2, "d": "C++ ABI symbols cluster A", "i": "micro-behaviors/dylib/library/abi-graphics::cxx-abi-symbols-a", "o": 4555, "z": 12, "cf": 0.800000011920929 }, { "c": 2, "d": "GNU libstdc++ stdlib", "i": "micro-behaviors/dylib/library/libc::libstdcxx-ref", "o": 4687, "z": 12, "cf": 0.8999999761581421 }, { "c": 2, "d": "fseek API string", "i": "micro-behaviors/fs/file/binary::fseek-text", "o": 4661, "z": 5, "cf": 0.5 }, { "c": 2, "d": "Open files (64-bit)", "i": "micro-behaviors/fs/file/open::fopen64", "o": 4404, "z": 7, "cf": 0.6600000262260437 }, { "c": 2, "d": "Generic file read/write operations", "i": "micro-behaviors/fs/file/read-write::binary-file-ops", "o": 4429, "z": 5, "cf": 0.800000011920929 }, { "c": 2, "d": "Write single bytes to file", "i": "micro-behaviors/fs/file/write/direct::fputc", "o": 4602, "z": 5, "cf": 0.6600000262260437 }, { "c": 2, "d": "Write files (fwrite)", "i": "micro-behaviors/fs/file/write/direct::write--fwrite", "o": 4638, "z": 6, "cf": 0.6600000262260437 }, { "c": 2, "d": "Line-based file reading (fgets)", "i": "micro-behaviors/process/create/direct::fgets-loop", "o": 4376, "z": 5, "cf": 1.0 }, { "c": 2, "d": "Terminates process immediately without cleanup", "i": "micro-behaviors/process/terminate/signal::_exit", "o": 4435, "z": 4, "cf": 0.4000000059604645 }, { "c": 2, "d": "Detect if running in terminal (isatty)", "i": "micro-behaviors/process/tty/terminal::isatty", "o": 4514, "z": 6, "cf": 0.5 }, { "c": 2, "d": "Get current time with microsecond precision", "i": "micro-behaviors/time/query::gettimeofday", "o": 4455, "z": 12, "cf": 0.30000001192092896 }, { "c": 2, "d": "Get current calendar time (seconds)", "i": "micro-behaviors/time/query::time", "o": 4475, "z": 4, "cf": 0.30000001192092896 } ], "ln": 4360 }, { "b": "e\u0026bau07f\u003c\u003ck%!dIf!LlZm[=GvlS^C$gCgHpgCw/0oI4MrsxF]^e\u0026kgnh2{cunKt^Dso", "n": [ { "c": 2, "d": "libc version string pattern", "i": "micro-behaviors/dylib/library/libc::libc-version-string", "o": 4793, "z": 5, "cf": 0.800000011920929 } ], "ln": 4777 }, { "b": "w?BPoGA7#L008Q39@mRk4/$4{w!b$K008Q39@n\u003e\u003e{ppk9002MD\u003cV#)jr8Vts(\u003e/^70aX=Y", "n": [ { "c": 2, "d": "XGETBV instruction bytes", "i": "metadata/binary/instruction::xgetbv-instr", "o": 90630, "z": 8, "cf": 0.30000001192092896 } ], "ln": 90614 }, { "b": "Coz3Hvp%c]z/x/jz/fRsvqYP#wQ4{h07l/$wNY^{08E-VAclmBw[=6)zEEx[0b=@", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 708652, "z": 3, "cf": 0.800000011920929 } ], "ln": 708636 }, { "b": "y?W:2Bo3w$x(B5JyIv-gBzbkdw[=pbBrCDzx(m)jBrCgovqPN%0b3j*wb]RJwGTF", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 708904, "z": 3, "cf": 0.800000011920929 } ], "ln": 708888 }, { "b": "A=k/lBo1TwBrCa9Acb+ow]zYjv@C)?v/QjXAclmOvRG{owmY.4xAgwkBrCa9Acb:", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 709257, "z": 3, "cf": 0.800000011920929 } ], "ln": 709241 }, { "b": "z/cXmwPR%bv\u003c2(ozE)u3Cwhej0aY!+Bs?uvBAh890aQ12y?m^3yYFrXCR9SEBAg!w", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 710653, "z": 4, "cf": 0.800000011920929 } ], "ln": 710637 }, { "b": "ePtcsBzk\u0026hz/fQ@ze0(tAa9^ex([6czy]{zDsW7[vr:wyvrcE7BzkVhePUSLwDlpVvpB4:eD", "n": [ { "c": 2, "d": "Disk partitioning utility context", "i": "well-known/tool/sysadmin/disk-utility::disk-partition-context", "o": 710983, "z": 9, "cf": 0.8999999761581421 } ], "ln": 710967 }, { "b": "0cAB6ePtctB1IPIwoqF+ra]?=CwgPfxDRk9aAR*CePtctB1I9zAclm5BA.TPAa9!", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 712667, "z": 3, "cf": 0.800000011920929 } ], "ln": 712651 }, { "b": "ze:Pdg+}2\u003cwmYvYB.(d1B7ol4wO}G\u003czFKcdCwWz7wPz)bv{%fNv@Dg4v{%E\u003cwb{sOwO}", "n": [ { "c": 1, "d": "Terminal type screen identifier", "i": "micro-behaviors/process/tty/terminal::terminal-type-screen", "o": 713103, "z": 6, "cf": 0.800000011920929 } ], "ln": 713087 }, { "b": "z/fiez/ddrCYS}5B724(BzbxfeK0-.AccvNdfaK5v@#TfiYZRxuVGZ^y\u0026131uTW[)", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 714927, "z": 4, "cf": 0.800000011920929 } ], "ln": 714911 }, { "b": "00000z^)\u003c1wN^+zpEn57Aaa3dz^^f0y?mG%Bz8!sz/l+mvrc0(e^.NUz^)\u003c1wN^+zmQZ0", "n": [ { "c": 1, "d": "payload keyword", "i": "objectives/command-and-control/dropper/keywords::payload", "o": 733708, "z": 7, "cf": 0.6000000238418579 } ], "ln": 733692 }, { "b": "Byuq3B.kk%ATz^D00000rDzOYwJy}WB09O-Acb/jzGv#:w[=6)zEEx[3jl+krDzZ]eIgTEy\u0026yIszY\u003cajwGV8dwGUPcy?$kg", "n": [ { "c": 2, "d": "Benign terminal socket exec context", "i": "objectives/command-and-control/reverse-shell/dup::unix-terminal-socket-exec-benign-context", "o": 735040, "z": 28, "cf": 0.949999988079071 } ], "ln": 735024 }, { "b": "b4kI4xLzN1v@#\u003clwG\u003ceVCSmP*hz=Ra00000000000000000000000000000000000000", "n": [ { "c": 3, "d": "Architecture detection strings", "i": "objectives/discovery/host/software::arch-detection", "o": 815350, "z": 6, "cf": 0.5 } ], "ln": 815334 }, { "b": "xj2H:ByO$:uS{xIgbicyxkzo\u003ev%Al9vrlH3A=+V2vqfKOojIWmfKE:juQdaPnKt^Dso", "n": [ { "c": 2, "d": "glibc reference", "i": "micro-behaviors/dylib/library/libc::glibc-ref", "o": 894064, "z": 5, "cf": 0.30000001192092896 } ], "ln": 894048 }, { "b": "BAhFivGn34xMFooBywRUe[]iBwPz.\u0026e[Y6Ae[!WmxAfU}D2vXGz2=h0D2vXBASv.8zGNNPwPz\u003caz/bLcxkR\u0026AC4CYnx(v(@ASv.jwD", "n": [ { "c": 2, "d": "ELF dynstr section name", "i": "metadata/binary/linking/static::elf-dynstr-section-name", "o": 934110, "z": 7, "cf": 0.8999999761581421 }, { "c": 2, "d": "ELF dynsym section name", "i": "metadata/binary/linking/static::elf-dynsym-section-name", "o": 934102, "z": 7, "cf": 0.8999999761581421 }, { "c": 2, "d": "ELF interpreter section name", "i": "metadata/binary/linking/static::elf-interpreter-section-name", "o": 934084, "z": 7, "cf": 0.8999999761581421 } ], "ln": 934068 }, { "b": "vr?\u00269wmoN*e]\u003eJte]\u003e\u003ege[xlBvqPZ*04}!\u003cByte4vSMO\u003ce[n*pzdNQb000000000000000", "n": [ { "c": 2, "d": "ELF dynamic section name", "i": "metadata/binary/linking/static::elf-dynamic-section-name", "o": 934336, "z": 8, "cf": 0.8999999761581421 } ], "ln": 934320 } ], "depth": 1, "facts": { "exp": [ [ "stdout" ], [ "stderr" ], [ "stdin" ] ], "imp": [ [ "", "ftell" ], [ "", "Znam" ], [ "", "printf" ], [ "", "aom_codec_error" ], [ "", "ZNSt8__detail15_List_node_base7_M_hookEPS0_" ], [ "", "rewind" ], [ "", "ZSt29_Rb_tree_insert_and_rebalancebPSt18_Rb_tree_node_baseS0_RS_" ], [ "", "strstr" ], [ "", "aom_rb_read_literal" ], [ "", "ZSt7nothrow" ], [ "", "aom_img_plane_height" ], [ "", "ZSt21__glibcxx_assert_failPKciS0_S0_" ], [ "", "strtoul" ], [ "", "aom_rb_bytes_read" ], [ "", "strchr" ], [ "", "aom_codec_av1_dx" ], [ "", "strlen" ], [ "", "strncmp" ], [ "", "log10" ], [ "", "aom_codec_iface_name" ], [ "", "ZSt20__throw_length_errorPKc" ], [ "", "memset" ], [ "", "aom_codec_destroy" ], [ "", "ZSt28_Rb_tree_rebalance_for_erasePSt18_Rb_tree_node_baseRS_" ], [ "", "ZdlPvRKSt9nothrow_t" ], [ "", "calloc" ], [ "", "ZdaPvRKSt9nothrow_t" ], [ "", "ZSt18_Rb_tree_incrementPSt18_Rb_tree_node_base" ], [ "", "ZTVN10__cxxabiv117__class_type_infoE" ], [ "", "ZSt19__throw_logic_errorPKc" ], [ "", "libc_start_main" ], [ "", "memcpy" ], [ "", "aom_rb_read_bit" ], [ "", "aom_codec_peek_stream_info" ], [ "", "time" ], [ "", "fclose" ], [ "", "Znwm" ], [ "", "rand_r" ], [ "", "ZdlPvm" ], [ "", "aom_read_obu_header_and_size" ], [ "", "ZSt18_Rb_tree_decrementPSt18_Rb_tree_node_base" ], [ "", "aom_codec_control" ], [ "", "fseek" ], [ "", "stack_chk_fail" ], [ "", "fopen64" ], [ "", "fputs" ], [ "", "aom_codec_get_frame" ], [ "", "aom_img_alloc" ], [ "", "free" ], [ "", "exit" ], [ "", "fputc" ], [ "", "ZdaPv" ], [ "", "ZTVN10__cxxabiv120__si_class_type_infoE" ], [ "", "aom_uleb_decode" ], [ "", "malloc" ], [ "", "vfprintf" ], [ "", "aom_codec_set_frame_buffer_functions" ], [ "", "aom_rb_read_uvlc" ], [ "", "strcmp" ], [ "", "strtol" ], [ "", "cxa_throw_bad_array_new_length" ], [ "", "fprintf" ], [ "", "aom_codec_decode" ], [ "", "fread" ], [ "", "aom_codec_dec_init_ver" ], [ "", "feof" ], [ "", "aom_codec_av1_cx" ], [ "", "fgets" ], [ "", "snprintf" ], [ "", "gettimeofday" ], [ "", "memmove" ], [ "", "ZNSt8__detail15_List_node_base9_M_unhookEv" ], [ "", "realloc" ], [ "", "ZnamRKSt9nothrow_t" ], [ "", "fseeko64" ], [ "", "aom_codec_error_detail" ], [ "", "gxx_personality_v0" ], [ "", "isatty" ], [ "", "aom_img_plane_width" ], [ "", "ITM_deregisterTMCloneTable" ], [ "", "Unwind_Resume" ], [ "", "aom_read_obu_header" ], [ "", "gmon_start__" ], [ "", "cxa_pure_virtual" ], [ "", "ITM_registerTMCloneTable" ], [ "", "fwrite" ], [ "", "ZdaPvm" ], [ "", "ZnwmRKSt9nothrow_t" ], [ "", "aom_img_free" ], [ "", "cxa_finalize" ] ], "sec": [ [ ".interp", 792, 28, 3.94, "alloc" ], [ ".gnu.hash", 824, 56, 3.32, "alloc" ], [ ".dynsym", 880, 2256, 1.13, "alloc" ], [ ".dynstr", 3136, 1755, 4.9, "alloc" ], [ ".gnu.version", 4892, 188, 1.69, "alloc" ], [ ".gnu.version_r", 5080, 256, 3.24, "alloc" ], [ ".rela.dyn", 5336, 17808, 2.51, "alloc" ], [ ".rela.plt", 23144, 1872, 1.72, "alloc,info_link" ], [ ".init", 28672, 27, 4.31, "alloc,executable" ], [ ".plt", 28704, 1264, 4.31, "alloc,executable" ], [ ".plt.got", 29968, 16, 3.45, "alloc,executable" ], [ ".plt.sec", 29984, 1248, 3.95, "alloc,executable" ], [ ".text", 31232, 673561, 6.49, "alloc,executable" ], [ ".fini", 704796, 13, 3.24, "alloc,executable" ], [ ".rodata", 708608, 38692, 5.65, "alloc" ], [ ".eh_frame_hdr", 747300, 12036, 5.69, "alloc" ], [ ".eh_frame", 759336, 54288, 5.31, "alloc" ], [ ".gcc_except_table", 813624, 1515, 4.64, "alloc" ], [ ".note.gnu.property", 815144, 80, 1.96, "alloc" ], [ ".note.ABI-tag", 815224, 32, 1.5, "alloc" ], [ ".note.package", 815256, 104, 4.79, "alloc" ], [ ".init_array", 817616, 8, 1.06, "write,alloc" ], [ ".fini_array", 817624, 8, 1.06, "write,alloc" ], [ ".data.rel.ro", 817632, 12416, 1.75, "write,alloc" ], [ ".dynamic", 830048, 576, 1.57, "write,alloc" ], [ ".got", 830624, 864, 1.89, "write,alloc" ], [ ".data", 831488, 240, 1.79, "write,alloc" ], [ ".comment", 831728, 31, 4.03, "merge,strings" ], [ ".symtab", 831760, 46728, 3.13, "" ], [ ".strtab", 878488, 55569, 5.51, "" ], [ ".shstrtab", 934057, 308, 4.28, "" ] ], "metrics": { "elf": { "bits": 64.0, "entry": 34720.0, "has_got": 1.0, "has_plt": 1.0, "has_note": 1.0, "relacount": 707.0, "has_symtab": 1.0, "note_count": 3.0, "nx_enabled": 1.0, "has_cet_ibt": 1.0, "dynrel_count": 0.0, "dynsym_count": 94.0, "has_eh_frame": 1.0, "has_gnu_hash": 1.0, "stack_canary": 1.0, "symtab_count": 1947.0, "dynrela_count": 742.0, "has_cet_shstk": 1.0, "little_endian": 1.0, "dt_flags_1_raw": 134217729.0, "pltreloc_count": 78.0, "dt_versym_count": 94.0, "executable_stack": 0.0, "fini_array_count": 1.0, "init_array_count": 1.0, "wx_segment_count": 0.0, "comment_entry_count": 1.0, "program_header_count": 13.0, "comment_distinct_count": 1.0, "gnu_stack_section_absent": 0.0, "load_segment_max_file_size": 676137.0, "stripped_but_symtab_present": 1.0, "load_segment_max_memory_size": 676137.0, "section_relocation_group_count": 2.0, "stripped_metadata_section_count": 5.0 }, "file": { "size": 936480.0, "entropy": 6.44, "size_bytes": 936480.0 }, "binary": { "is_pie": 1.0, "has_overlay": 1.0, "is_stripped": 0.0, "code_entropy": 6.48, "data_entropy": 1.75, "overlay_size": 2115.0, "string_count": 2817.0, "overlay_ratio": 0.0, "overall_entropy": 6.44, "overlay_entropy": 1.63, "entropy_variance": 2.47, "avg_string_length": 29.43, "max_string_length": 283.0, "peak_region_bytes": 253952.0, "code_to_data_ratio": 0.98, "peak_region_entropy": 6.39, "string_length_stddev": 24.69, "largest_section_ratio": 0.72, "sentence_string_count": 398.0, "sentence_string_ratio": 0.14, "high_entropy_string_count": 0.0 }, "exports": { "count": 3.0 }, "imports": { "count": 90.0 }, "sections": { "count": 33.0, "code_size": 676129.0, "entropy_max": 6.49, "entropy_mean": 3.35, "name_entropy": 4.23, "writable_count": 7.0, "executable_count": 6.0, "nonstandard_count": 7.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 5.0 } } }, "id": 2, "mol": "H(F)", "path": "aom-3.13.3-r0.apk!!usr/bin/aomdec", "risk": 2, "sha": "445c1445e27539477ebe49b25e4c8ff8abf0b29602f1b34a53ec36c6c05eb0c6", "size": 936480, "traits": [ { "id": "micro-behaviors/fs/file/binary::fseek-func", "atk": "T1005", "conf": 0.4000000059604645, "crit": 2, "desc": "Seeks to position in file", "spans": [ [ 4645, 8 ], [ 4661, 5 ] ] }, { "id": "micro-behaviors/fs/file/binary::fseek-text", "atk": "T1005", "crit": 2, "desc": "fseek API string", "spans": [ [ 4661, 5 ] ] }, { "id": "micro-behaviors/dylib/library/libc::libc-characteristic-cxa-finalize", "crit": 2, "desc": "libc characteristic cxa finalize", "spans": [ [ 4555, 12 ] ] }, { "id": "metadata/build/artifact::elf-stripped-but-symtab-present", "conf": 0.6000000238418579, "crit": 3, "desc": "ELF stripped with .symtab present", "spans": [ [ 0, 38 ] ] }, { "id": "metadata/binary/metrics/threshold::many-imports-50", "conf": 1.0, "crit": 1, "desc": "Binary has 50+ imports", "spans": [ [ 0, 21 ] ] }, { "id": "micro-behaviors/ui/help::usage-title", "crit": 2, "desc": "Usage: label (title case)", "spans": [ [ 735040, 28 ] ] }, { "id": "micro-behaviors/ui/help::usage-title-string", "crit": 1, "desc": "Usage: label in binary strings", "spans": [ [ 735040, 28 ] ] }, { "id": "metadata/binary/metrics/threshold::high-string-count-1000", "conf": 0.699999988079071, "crit": 2, "desc": "High string count over 1000", "spans": [ [ 0, 29 ] ] }, { "id": "micro-behaviors/fs/file/binary::binary-read-write-ops", "atk": "T1005", "conf": 0.699999988079071, "crit": 3, "desc": "Binary file read/write operations", "spans": [ [ 4645, 8 ], [ 4661, 5 ] ] }, { "id": "micro-behaviors/dylib/library/libc::libc-internal-functions-b", "conf": 0.699999988079071, "crit": 2, "desc": "libc internal symbols cluster B", "spans": [ [ 4555, 12 ] ] }, { "id": "micro-behaviors/ui/help::usage-label", "conf": 0.75, "crit": 1, "desc": "Command line usage text", "spans": [ [ 735040, 28 ] ] } ], "type": "elf" }, { "ctx": [ { "b": "DJ", "n": [ { "c": 2, "d": "SPDX SBOM document", "i": "metadata/package/files/system-package::spdx-sbom-document", "o": 0, "z": 1, "cf": 0.9800000190734863 } ], "ln": 1, "addr": 0 }, { "b": "arR\u003eHAaBh]wPz\u003caz/c:War\u003c-Xl%82@e\u0026aX5", "ln": 2, "addr": 2 }, { "b": "arR\u003esvrt{Kx\u003e7Z(B7DKRar\u003cfufFb1ifD@4", "ln": 3, "addr": 31 }, { "b": "arR^Hb5y$6wO#N2oLFM\u0026r+lq)x(v(kiV]R5e\u00262gaec", "ln": 8, "addr": 246 }, { "b": "arR^Hb4CU8vruBdB0rT/tl", "ln": 9, "addr": 280 }, { "b": "arR^HarR\u003ecz/oCMaz\u003eXavqYZ?asIy!e\u0026kKuf!1p$", "n": [ { "c": 2, "d": "Melange-generated SPDX SBOM", "i": "metadata/package/files/system-package::melange-spdx-sbom", "o": 304, "z": 14, "cf": 0.9800000190734863 } ], "ln": 10, "addr": 298 }, { "b": "arR^HarR\u003e7A+w/#x)Kifx(v(Iavx*Jx(mNavrb)faw3DXa]", "ln": 11, "addr": 331 }, { "b": "arR^Ht}t", "ln": 12, "addr": 369 }, { "b": "arR^HarR^HarR\u003eGwObH]wO#0?lT+7Fxk.*ob03?\u003cp^EDwk$su}o*IJum[3r1ec", "ln": 41, "addr": 1264 }, { "b": "arR^HarR^HarR\u003eGwObH]wO#0?rc-B]b03?\u003cAclhqa$J", "ln": 42, "addr": 1314 }, { "b": "arR^HarR^HarR\u003eGwObH]wO#0?oMaAHBz(gziV]R=yIbXpAbdaJz!%31fjw^okR\u003e2EgCgEnAXGZ^A:@=CCSmP*hz!VYfFCmuwncabA=j9+z!%31a]", "n": [ { "c": 2, "d": "Wolfi APK SPDX SBOM", "i": "metadata/package/files/system-package::wolfi-apk-spdx-sbom", "o": 1349, "z": 74, "cf": 0.9800000190734863 } ], "ln": 43, "addr": 1349 }, { "b": "arR^HarR^HEe", "ln": 44, "addr": 1439 }, { "b": "arR^HarT@v", "ln": 45, "addr": 1449 }, { "b": "arR^HarR\u003esz*c8nz^^fIz!0i$x(v(kiV]RwpEd]Tmn^8RpFJ8+", "ln": 91, "addr": 3290 }, { "b": "arR^HarR\u003eux(4v4l2HaED3T4jb03\u0026UvqH0@ec", "ln": 92, "addr": 3331 }, { "b": "arR^HarR\u003eHz/{8gwL3=KzZ4j+b4j#3B.L(cwft\u00261v@2H=wGUY8w]w/7A=k!qk#ph%l{-{Sfd{6]m[DDBpA?s", "n": [ { "c": 1, "d": "SPDX references APK DB package info", "i": "metadata/package/files/system-package::spdx-apk-pkginfo-source", "o": 3382, "z": 44, "cf": 0.8999999761581421 } ], "ln": 93, "addr": 3361 }, { "b": "arR^HarR\u003eAx\u003e7Z(B7EZSzEWH9wmYo}iV]RwpEd]Tmn^8RpFJ8+", "ln": 94, "addr": 3429 }, { "b": "arR^HarR\u003eAx\u003e7Z(B7E:Jv@bN]wN(#Car\u003ccJl[HeClU{gNB7DKD", "ln": 95, "addr": 3470 }, { "b": "arR^HarR^HarR\u003eGwObH]wO#0?oMaAHBz(gziV]R=yIbXpAbdaJz!%31fjw^okR\u003e2EgCgEnAXGZ^A:@=CCSmP*hz!VYfFCmuz/PM8x(l7xz/3V", "n": [ { "c": 1, "d": "Wolfi APK package URL in SPDX", "i": "metadata/package/files/system-package::spdx-wolfi-apk-purl", "o": 3914, "z": 72, "cf": 0.8999999761581421 } ], "ln": 107, "addr": 3914 }, { "b": "arR^HarR^HEe", "ln": 108, "addr": 4002 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 5424.0, "entropy": 5.13, "size_bytes": 5424.0 }, "json": { "parsed_bytes": 5424.0, "parse_limit_bytes": 76800.0 }, "binary": { "overall_entropy": 5.13, "peak_region_bytes": 5424.0, "peak_region_entropy": 5.18 } } }, "id": 3, "path": "aom-3.13.3-r0.apk!!var/lib/db/sbom/aom-3.13.3-r0.spdx.json", "risk": 1, "sha": "785694a299237d8ccca7b740308af82be3f014aad46e3c2e76dadd9169c47210", "size": 5424, "traits": [ { "id": "metadata/package/files/system-package::spdx-apk-pkginfo-source", "conf": 0.8999999761581421, "crit": 1, "desc": "SPDX references APK DB package info", "spans": [ [ 3382, 44 ] ] }, { "id": "metadata/package/files/system-package::spdx-melange-creator", "conf": 0.8999999761581421, "crit": 1, "desc": "Melange SPDX creator", "spans": [ [ 304, 14 ] ] }, { "id": "metadata/package/files/system-package::spdx-wolfi-apk-purl", "conf": 0.8999999761581421, "crit": 1, "desc": "Wolfi APK package URL in SPDX", "spans": [ [ 1349, 74 ], [ 1380, 14 ], [ 3914, 72 ] ] }, { "id": "metadata/package/files/system-package::spdx-melange-namespace", "conf": 0.8999999761581421, "crit": 1, "desc": "Melange SPDX document namespace" }, { "id": "metadata/file/format::valid", "conf": 0.6000000238418579, "crit": 2, "desc": "JSON data format", "spans": [ [ 0, 23 ] ] }, { "id": "metadata/package/files/system-package::spdx-document-version", "conf": 0.8999999761581421, "crit": 1, "desc": "SPDX document version field" }, { "id": "metadata/package/files/system-package::spdx-document-id", "conf": 0.8999999761581421, "crit": 1, "desc": "SPDX document identifier" }, { "id": "metadata/package/files/system-package::spdx-sbom-document", "conf": 0.9800000190734863, "crit": 2, "desc": "SPDX SBOM document" }, { "id": "metadata/package/files/system-package::melange-spdx-sbom", "conf": 0.9800000190734863, "crit": 2, "desc": "Melange-generated SPDX SBOM", "spans": [ [ 304, 14 ] ] }, { "id": "metadata/package/files/system-package::wolfi-apk-spdx-sbom", "conf": 0.9800000190734863, "crit": 2, "desc": "Wolfi APK SPDX SBOM", "spans": [ [ 1349, 74 ], [ 1380, 14 ], [ 3382, 44 ], [ 3914, 72 ] ] } ], "type": "json" }, { "ctx": [ { "b": "boPG/zE)\u0026%By!#9vTf8kwO+^)xjR", "n": [ { "c": 2, "d": "Melange-generated APK package info", "i": "metadata/package/files/system-package::melange-generated-apk-pkginfo", "o": 0, "z": 22, "cf": 0.9800000190734863 } ], "ln": 1, "addr": 0 }, { "b": "Abf97vqPM#jS[fKz2", "n": [ { "c": 2, "d": "Wolfi APK package info metadata", "i": "metadata/package/files/system-package::wolfi-apk-pkginfo", "o": 23, "z": 13, "cf": 0.9800000190734863 } ], "ln": 2, "addr": 23 }, { "b": "Abf9fwPw[RatUS8gCgEnAXE", "n": [ { "c": 2, "d": "Alpine/Wolfi package info metadata", "i": "metadata/package/files/system-package::alpine-apk-pkginfo", "o": 37, "z": 18, "cf": 0.9700000286102295 } ], "ln": 3, "addr": 37 }, { "b": "vrb\u003c\u003eauZ\u0026(i5Ub4gY", "ln": 4, "addr": 56 }, { "b": "B7]@iauZ\u00264ixn@OfF\u0026", "ln": 5, "addr": 70 }, { "b": "z/PM8x(k4RayPh9", "n": [ { "c": 1, "d": "Alpine/Wolfi package origin field", "i": "metadata/package/files/system-package::alpine-pkginfo-origin-field", "o": 85, "z": 12, "cf": 0.8999999761581421 } ], "ln": 6, "addr": 85 }, { "b": "Abf8%wPIu7jS)4by?Wr}v}u={z/M%@AaJ]fo\u003ev\u003cHviu%:pFAnXk#]Y.v@C)?v\u003c1Yro8", "ln": 7, "addr": 98 }, { "b": "B-IpvjS\u003c", "ln": 8, "addr": 152 }, { "b": "v@Dj3x(\u003eEXayN2.ixe(Ov(lkQwhk]Jh-S=IvLY+$wmPd9v\u003e]+)vkfO#whuk5g5", "ln": 9, "addr": 159 }, { "b": "zddc@Byw)3wPw[RaA}:uw[.", "n": [ { "c": 1, "d": "Wolfi package maintainer field", "i": "metadata/package/files/system-package::wolfi-pkginfo-maintainer", "o": 209, "z": 18, "cf": 0.8999999761581421 } ], "ln": 10, "addr": 209 }, { "b": "vS=y3wmPa\u003cwGTbUf/I3Gf/Q{yh82", "ln": 11, "addr": 228 }, { "b": "y?Wx\u003czGxwijS)6\u0026l[HeClU{gNB7C", "ln": 12, "addr": 251 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 568.0, "entropy": 5.1, "size_bytes": 568.0 }, "binary": { "overall_entropy": 5.1, "peak_region_bytes": 568.0, "peak_region_entropy": 5.1 } } }, "id": 4, "path": "aom-3.13.3-r0.apk!!.PKGINFO", "risk": 1, "sha": "a105f4f0df917684cf9e4240ab37ab90e35d55a29e072db3cddeadba83194952", "size": 568, "traits": [ { "id": "metadata/package/files/system-package::alpine-pkginfo-version-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package version field", "spans": [ [ 37, 18 ] ] }, { "id": "metadata/package/files/system-package::wolfi-pkginfo-maintainer", "conf": 0.8999999761581421, "crit": 1, "desc": "Wolfi package maintainer field", "spans": [ [ 209, 18 ] ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-package-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package name field", "spans": [ [ 23, 13 ] ] }, { "id": "metadata/package/files/system-package::arch-pkgname-field", "conf": 0.9399999976158142, "crit": 1, "desc": "Arch pkgname metadata field", "spans": [ [ 23, 13 ] ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-origin-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package origin field", "spans": [ [ 85, 12 ] ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-basename", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package info file" }, { "id": "metadata/package/files/system-package::melange-pkginfo-generator", "conf": 0.8999999761581421, "crit": 1, "desc": "Melange-generated package metadata", "spans": [ [ 0, 22 ] ] }, { "id": "metadata/package/files/system-package::alpine-apk-pkginfo", "conf": 0.9700000286102295, "crit": 2, "desc": "Alpine/Wolfi package info metadata", "spans": [ [ 23, 13 ], [ 37, 18 ], [ 85, 12 ] ] }, { "id": "metadata/package/files/system-package::wolfi-apk-pkginfo", "conf": 0.9800000190734863, "crit": 2, "desc": "Wolfi APK package info metadata", "spans": [ [ 23, 13 ], [ 37, 18 ], [ 85, 12 ], [ 209, 18 ] ] }, { "id": "metadata/package/files/system-package::melange-generated-apk-pkginfo", "conf": 0.9800000190734863, "crit": 2, "desc": "Melange-generated APK package info", "spans": [ [ 0, 22 ], [ 23, 13 ], [ 37, 18 ], [ 85, 12 ] ] } ], "type": "text" } ], "rev": "868bd", "v": "8" } }