{ "ml": { "v": "7", "eng": "2.2.0-beta.2", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.0012923181, "rte": "az", "prob": 0.0012923181 }, { "cls": 0, "raw": 0.0004944205, "rte": "az/tar", "prob": 0.0004944205 } ], "prob": 0.009477943, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.009477943181991577, "type": "apk_alpine" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.004617065191268921, "type": "elf" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.009477943181991577, "type": "elf" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.00004457433897187002, "type": "elf" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.00004457433897187002, "type": "elf" }, { "id": 5, "lvl": -1, "conf": 0, "prob": 0.000036388635635375977, "type": "elf" }, { "id": 6, "lvl": -1, "conf": 0, "prob": 0.00003714362901519053, "type": "elf" }, { "id": 7, "lvl": -1, "conf": 0, "prob": 0.000013679265975952148, "type": "shell" }, { "id": 8, "lvl": -1, "conf": 0, "prob": 0.000010838110938493628, "type": "text" } ], "version": "v18.18", "analyzed_at": "2026-06-26T10:54:19Z" }, "path": "dtc-1.7.2-r1.apk", "raw": { "files": [ { "id": 0, "ctx": [ { "b": "abZy8000000T3{24[J!\u003enkh=HeH]u63?!Yp^*DIa!jX1m:JNrco?u{f=2H?Deg@xa3GU*X", "n": [ { "c": 2, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "o": 0, "z": 1, "cf": 1.0 } ], "ln": 0 } ], "mol": "O₂(CI)H₃(F₃PoU)Md(He)", "sha": "3d029dc73adf7ee083be76c7120a4535ba0a4c5c764c989409a81769d3aca83e", "path": "/data/samples/good/foraged/alpine/alpinelinux.org/_/dtc/dtc-1.7.2-r1.apk", "risk": 6, "size": 80855, "type": "apk_alpine", "facts": { "metrics": { "file": { "size": 80855.0, "entropy": 7.99, "size_bytes": 80855.0 }, "parse": { "error_count": 1.0 }, "binary": { "overall_entropy": 7.99, "peak_region_bytes": 79831.0, "peak_region_entropy": 7.84 } } }, "traits": [ { "id": "micro-behaviors/process/create/shell/spawn::sh-dynamic-command-target", "conf": 0.6000000238418579, "crit": 3, "desc": "Shell command name from variable", "from": [ { "file": 7 } ] }, { "id": "micro-behaviors/ui/help::usage-title-string", "crit": 1, "desc": "Usage: label in binary strings", "from": [ { "file": 3 } ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-basename", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package info file" }, { "id": "micro-behaviors/fs/file/write/direct::write--fwrite", "conf": 0.6600000262260437, "crit": 2, "desc": "Write files (fwrite)", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/dylib/library/libc::libc-characteristic-cxa-finalize", "crit": 2, "desc": "libc characteristic cxa finalize", "from": [ { "file": 3 } ] }, { "id": "metadata/binary/metrics/threshold::many-imports-50", "conf": 1.0, "crit": 1, "desc": "Binary has 50+ imports", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/ui/help::usage-title", "crit": 2, "desc": "Usage: label (title case)", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/fs/file/stat::stat-core", "conf": 0.800000011920929, "crit": 3, "desc": "Read file status and metadata (core)", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/dylib/library/libc::libc-internal-functions-b", "conf": 0.699999988079071, "crit": 2, "desc": "libc internal symbols cluster B", "from": [ { "file": 1 }, { "file": 2 }, { "file": 3 }, { "file": 4 }, { "file": 5 }, { "file": 6 } ] }, { "id": "micro-behaviors/dylib/library/abi-graphics::cxx-abi-symbols-a", "conf": 0.800000011920929, "crit": 2, "desc": "C++ ABI symbols cluster A", "from": [ { "file": 1 }, { "file": 2 }, { "file": 3 }, { "file": 4 }, { "file": 5 }, { "file": 6 } ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-version-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package version field", "from": [ { "file": 8 } ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-origin-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package origin field", "from": [ { "file": 8 } ] }, { "id": "micro-behaviors/ui/help::usage-label", "conf": 0.75, "crit": 1, "desc": "Command line usage text", "from": [ { "file": 1 }, { "file": 2 }, { "file": 3 }, { "file": 4 }, { "file": 5 }, { "file": 6 } ] }, { "id": "micro-behaviors/fs/file/open::fopen", "conf": 0.6600000262260437, "crit": 3, "desc": "Open files", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/directory/readdir::readdir-closedir", "conf": 0.6600000262260437, "crit": 2, "desc": "Uses closedir", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/file/binary::file-manipulation", "atk": "T1005", "conf": 0.75, "crit": 3, "desc": "File content manipulation (read/write/seek)", "from": [ { "file": 1 }, { "file": 2 }, { "file": 3 }, { "file": 4 }, { "file": 5 }, { "file": 6 } ], "spans": [ [ 2354, 6 ], [ 2361, 5 ], [ 2781, 5 ] ] }, { "id": "metadata/binary/metrics/threshold::rich-sentence-strings-20pct", "conf": 0.800000011920929, "crit": 1, "desc": "Binary has many sentence-like strings", "from": [ { "file": 5 } ], "spans": [ [ 0, 35 ] ] }, { "id": "micro-behaviors/process/create/shell/spawn::bash-exec", "conf": 0.699999988079071, "crit": 3, "desc": "bash shell reference", "from": [ { "file": 7 } ] }, { "id": "micro-behaviors/fs/directory/readdir::readdir-opendir", "conf": 0.6600000262260437, "crit": 2, "desc": "Uses opendir", "from": [ { "file": 1 } ] }, { "id": "objectives/command-and-control/botnet/keywords::slave-term", "conf": 0.4000000059604645, "crit": 3, "desc": "Slave keyword", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/ui/help::options-title-string", "crit": 1, "desc": "Options: label in binary strings", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/fs/file/write/direct::write", "conf": 0.6600000262260437, "crit": 2, "desc": "Write files", "from": [ { "off": 2922, "file": 1 }, { "file": 2 }, { "off": 2732, "file": 3 }, { "off": 2422, "file": 4 }, { "off": 2570, "file": 5 }, { "off": 2165, "file": 6 } ], "spans": [ [ 2922, 6 ] ] }, { "id": "micro-behaviors/fs/file/binary::fseek-func", "atk": "T1005", "conf": 0.4000000059604645, "crit": 2, "desc": "Seeks to position in file", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/create/shell/spawn::shell-execution-comp", "atk": "T1059", "mbc": "E1059", "conf": 0.8999999761581421, "crit": 3, "desc": "Shell command execution capability", "from": [ { "file": 7 } ] }, { "id": "micro-behaviors/process/create/shell/spawn::shell-symbols", "conf": 0.8999999761581421, "crit": 3, "desc": "Shell execution symbols", "from": [ { "off": 0, "file": 7, "line": 1 } ] }, { "id": "micro-behaviors/fs/directory/readdir::readdir-readdir", "conf": 0.6600000262260437, "crit": 2, "desc": "Uses readdir", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/file/read::fread", "conf": 0.699999988079071, "crit": 2, "desc": "Read stream (fread)", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/file/read::read", "conf": 0.699999988079071, "crit": 2, "desc": "Read file descriptor (read/pread)", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/ui/help::has-help", "conf": 0.8500000238418579, "crit": 3, "desc": "Contains help or usage information", "from": [ { "file": 1 }, { "file": 2 }, { "file": 3 }, { "file": 4 }, { "file": 5 }, { "file": 6 } ] }, { "id": "metadata/hardening/missing::stripped-binary", "conf": 0.800000011920929, "crit": 3, "desc": "No full symbol table (likely stripped)", "from": [ { "file": 3 } ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-package-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package name field", "from": [ { "file": 8 } ] }, { "id": "micro-behaviors/ui/help::options-title", "crit": 2, "desc": "Options: label", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/fs/file/write/direct::write--write", "conf": 0.6600000262260437, "crit": 2, "desc": "Write files (write)", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/fs/file/binary::binary-read-write-ops", "atk": "T1005", "conf": 0.699999988079071, "crit": 3, "desc": "Binary file read/write operations", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/file/binary::fseek-text", "atk": "T1005", "crit": 2, "desc": "fseek API string", "from": [ { "file": 1 } ] }, { "id": "objectives/command-and-control/reverse-shell/pty::pty-dual-mode-backdoor-cond-2--inline-10027", "atk": "T1059.004", "mbc": "B0024", "conf": 0.9300000071525574, "crit": 3, "desc": "Regex component marker", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/file/binary::file-read-operation", "atk": "T1005", "conf": 0.75, "crit": 1, "desc": "File read operation", "from": [ { "file": 1 }, { "file": 2 }, { "file": 3 }, { "file": 4 }, { "file": 5 }, { "file": 6 } ], "spans": [ [ 2929, 5 ] ] }, { "id": "objectives/impact/infect/terms::flex-word", "conf": 1.0, "crit": 3, "desc": "flex lexer-generator tool name", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/file/read::fread-text", "conf": 0.6200000047683716, "crit": 2, "desc": "fread API string", "from": [ { "file": 1 } ] } ] }, { "ctx": [ { "b": "E))420S-r400000000000@$H+0rr91TTTqJ00000kMy=:00000U^%\u0026n0000000000kMA+z4feS[8upSP1][S61o", "n": [ { "c": 3, "d": "No full symbol table (likely stripped)", "i": "metadata/hardening/missing::stripped-binary", "o": 0, "z": 25, "cf": 0.800000011920929 } ], "ln": 0 }, { "b": "z9wB.y?Wuiy?bbmB-RvJCSmP*hz^4cz.r:A000030000=000010000600000Fb/MH1v8", "n": [ { "c": 3, "d": "Architecture detection strings", "i": "objectives/discovery/host/software::arch-detection", "o": 889, "z": 6, "cf": 0.5 } ], "ln": 873 }, { "b": "00000xjVf{0crm5v@MX[wQ4{h0chTVwmPy{0a{d*wO}G?BAhnezeYF[Acb/iwb{W)A=LV6ASyf5vrqGVy\u0026sxawnc5:B98Cuv@MX[uTE\u003e@vpK7Wv}YT+w)]y\u00260c075v}Yp\u003e0chTVy\u00261310crl)x(i](BAhFwy?%8*wO\u003e{\u003cASyf5A=Vhq0af8wB8$]kByeS*x(0=\u003cBAhFwyYF6Uz!n#\u003cBAhhezuax(CW$J3x(\u003ctZuUam#zF@(#z!0i$x(v\u003e?w]?J{yxei.zdvB40aP?Rvrb}1ASyo7zG6SgzGGE\u003cB97@hB-WQ}Aclnj0a{g)BAmC6BAhnnwO}GWv@c78wDl^[A==kxyYFrXy\u00261310crm5v{%B\u0026v@le+z/xo9wnc5:z/x/bA+tw[ByX%6ASxDXzFsg)xjVg6AcbD6z/fg/B98CAz/](j0a{B}x()[^w].D\u003ewb{4Wz!Ph)BAg(8ASxDUx(mR+ADu5sBo2VPv%zA?w[=c\u003ey?Xib0bVp:zeTPe0crm5v@le+B98ClA=M8s0af8Hx\u003c$NV", "n": [ { "c": 4, "d": "Sets LD_PRELOAD hooks to hide filesystem", "i": "objectives/evasion/kernel-hide/userspace::preload-rootkit-hook-set", "o": 2610, "z": 5, "cf": 0.9200000166893005 }, { "c": 3, "d": "Stack protector/canary enabled", "i": "metadata/hardening/build::stack-protector", "o": 2663, "z": 14, "cf": 0.8999999761581421 }, { "c": 3, "d": "File content manipulation (read/write/seek)", "i": "micro-behaviors/fs/file/binary::file-manipulation", "o": 2781, "z": 5, "cf": 0.75 }, { "c": 3, "d": "Read file status and metadata (core)", "i": "micro-behaviors/fs/file/stat::stat-core", "o": 2639, "z": 4, "cf": 0.800000011920929 }, { "c": 3, "d": "Regex component marker", "i": "objectives/command-and-control/reverse-shell/pty::pty-dual-mode-backdoor-cond-2--inline-10027", "o": 2901, "z": 11, "cf": 0.9300000071525574 }, { "c": 3, "d": "Benign network-capable library context", "i": "objectives/supply-chain/trojanized/backdoor::benign-network-library-context", "o": 2724, "z": 11, "cf": 0.8999999761581421 }, { "c": 2, "d": "C++ standard library markers (libc++, libstdc++)", "i": "micro-behaviors/dylib/library/libc::cxx-stdlib-marker", "o": 2961, "z": 12, "cf": 0.8999999761581421 }, { "c": 2, "d": "Uses closedir", "i": "micro-behaviors/fs/directory/readdir::readdir-closedir", "o": 2644, "z": 8, "cf": 0.6600000262260437 }, { "c": 2, "d": "Uses opendir", "i": "micro-behaviors/fs/directory/readdir::readdir-opendir", "o": 2873, "z": 7, "cf": 0.6600000262260437 }, { "c": 2, "d": "Uses readdir", "i": "micro-behaviors/fs/directory/readdir::readdir-readdir", "o": 2602, "z": 7, "cf": 0.6600000262260437 }, { "c": 2, "d": "Generic file read/write operations", "i": "micro-behaviors/fs/file/read-write::binary-file-ops", "o": 2929, "z": 5, "cf": 0.800000011920929 }, { "c": 2, "d": "Write single bytes to file", "i": "micro-behaviors/fs/file/write/direct::fputc", "o": 2820, "z": 5, "cf": 0.6600000262260437 }, { "c": 2, "d": "Write files (fwrite)", "i": "micro-behaviors/fs/file/write/direct::write--fwrite", "o": 2922, "z": 6, "cf": 0.6600000262260437 }, { "c": 2, "d": "Terminates process immediately without cleanup", "i": "micro-behaviors/process/terminate/signal::_exit", "o": 2597, "z": 4, "cf": 0.4000000059604645 } ], "ln": 2581 }, { "b": "0a{m.wDlKXvQ?3cB-RvJCSmP*hz^4cz.r:AuTEtPA+e($B97#luUjs!zdN6*zF0!!uR7", "n": [ { "c": 2, "d": "x86_64 architecture string", "i": "micro-behaviors/os/sysinfo/platform/string::arch-x86-64", "o": 3047, "z": 6, "cf": 0.30000001192092896 } ], "ln": 3031 }, { "b": "zyoJGB7GCovScv4at4KPvqYP#eMh#RlVm9-wnS=paA8jgzxJF3AaJ]$wO#16azbr", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 65712, "z": 3, "cf": 0.800000011920929 } ], "ln": 65696 }, { "b": "efFFmw)]*#BAnNDzY*+[asH\u0026uAV![mvJY8%wftr4z6i+tBz#wAdf6XYpJZ+#B-X-", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 66273, "z": 3, "cf": 0.800000011920929 } ], "ln": 66257 }, { "b": "B8r4rB-.OBBsvg%2#a\u0026zwGV8dwGUC#z^\u003c?$BrCyhvrlJkjySOTwPH3Ty\u0026si7asH!", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 66400, "z": 3, "cf": 0.800000011920929 } ], "ln": 66384 }, { "b": "aA}mmzFs03B08(IA+e\u0026%CP.iABz8^vzF}9Jdf6XYmq=Kyy?kngx(^Y(y?j-2A=M8s", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 66954, "z": 4, "cf": 0.800000011920929 } ], "ln": 66938 }, { "b": "ay]59vqfL0df6XYp\u0026Zn/BrCWsx(+zgwO=rdvqYP#wQ4{h0163eA+PAkaA?spB7]Mg", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 67238, "z": 4, "cf": 0.800000011920929 } ], "ln": 67222 }, { "b": "y?aU$wGSvwAa{W1B8U?BB8kodwDlBZv@DydwN/*8bvLa[A+frkeN@vdy\u0026Z.hz/M$0pY", "n": [ { "c": 3, "d": "Slave keyword", "i": "objectives/command-and-control/botnet/keywords::slave-term", "o": 68018, "z": 5, "cf": 0.4000000059604645 } ], "ln": 68002 }, { "b": "zEEx[aAIjmB.\u003eOhzF%RtxKM6}az+Q$wnb{]ar\u0026H:a](+6x(\u003eFnvqPM#B7/Gmy?aVa", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 70133, "z": 4, "cf": 0.800000011920929 } ], "ln": 70117 }, { "b": "aAy[dxjVcbw]zYjp^W!%vSDf[xjShlz/M$rz/^agayYw9wm]E50blsXz/P(fv@@?rvpP", "n": [ { "c": 1, "d": "bridge interface", "i": "micro-behaviors/os/container/namespace::bridge-str", "o": 71220, "z": 6, "cf": 1.0 } ], "ln": 71204 }, { "b": "e\u00260AcwPz\u003caz/dPUc36y[rDzOYwJy}WA%-mIAcb/jzGv\u0026YeN6Jxt)ZNIAccedxK#10twmv=aW3@yrzl6^arR^HarQUbao", "n": [ { "c": 3, "d": "Benign socket shell helper context", "i": "micro-behaviors/process/fd/dup::posix-fd-redirect-shell-benign-context", "o": 79532, "z": 14, "cf": 0.9399999976158142 }, { "c": 3, "d": "Terminal socket exec helper context", "i": "micro-behaviors/process/fd/dup::unix-terminal-socket-exec-benign-context", "o": 79521, "z": 9, "cf": 0.949999988079071 } ], "ln": 79505 }, { "b": "By!(\u003eaA7\u003cmf-U/]Byw#dw]846aAI43zF\u003c3aazC.nwPzV%y-)qfA=k$IeOe*gaA7\u003cmvS=o{wPw]g", "n": [ { "c": 3, "d": "flex lexer-generator tool name", "i": "objectives/impact/infect/terms::flex-word", "o": 80065, "z": 4, "cf": 1.0 }, { "c": 3, "d": "Legitimate development tool indicators", "i": "objectives/impact/infect/terms::legitimate-tools", "o": 80070, "z": 7, "cf": 1.0 } ], "ln": 80049 }, { "b": "By^7qzGNNvB.LV5eOO.}e[]iBwPz.\u0026e[Y6Ae[!WmxAfU}D2vXGz2=h0D2vXBASv.jwO+^cwo\u00264)e]\u003eJtvj(InBo0}lwO=xtwo\u00264)e=", "n": [ { "c": 2, "d": "ELF dynstr section name", "i": "metadata/binary/linking/static::elf-dynstr-section-name", "o": 113163, "z": 7, "cf": 0.8999999761581421 }, { "c": 2, "d": "ELF dynsym section name", "i": "metadata/binary/linking/static::elf-dynsym-section-name", "o": 113155, "z": 7, "cf": 0.8999999761581421 }, { "c": 2, "d": "ELF interpreter section name", "i": "metadata/binary/linking/static::elf-interpreter-section-name", "o": 113137, "z": 7, "cf": 0.8999999761581421 } ], "ln": 113121 }, { "b": "vr?\u00269wmoN*e]\u003eJte]\u003e\u003ege[xlBvqPZ*04}]5Bo0}7vrt]Te[e)y04}=1zeA\u003c4Bn#pv00000", "n": [ { "c": 2, "d": "ELF dynamic section name", "i": "metadata/binary/linking/static::elf-dynamic-section-name", "o": 113288, "z": 8, "cf": 0.8999999761581421 } ], "ln": 113272 } ], "depth": 1, "facts": { "exp": [ [ "init" ], [ "fini" ] ], "imp": [ [ "", "putchar" ], [ "", "strcpy" ], [ "", "printf" ], [ "", "stdout" ], [ "", "strerror" ], [ "", "memmove" ], [ "", "getopt_long" ], [ "", "snprintf" ], [ "", "qsort" ], [ "", "getc" ], [ "", "cxa_finalize" ], [ "", "feof" ], [ "", "malloc" ], [ "", "optarg" ], [ "", "vsnprintf" ], [ "", "strtoll" ], [ "", "strtoul" ], [ "", "readdir" ], [ "", "stack_chk_fail" ], [ "", "isxdigit" ], [ "", "strtol" ], [ "", "strnlen" ], [ "", "strrchr" ], [ "", "write" ], [ "", "fprintf" ], [ "", "deregister_frame_info" ], [ "", "fseek" ], [ "", "ITM_registerTMCloneTable" ], [ "", "optind" ], [ "", "memchr" ], [ "", "stdin" ], [ "", "ferror" ], [ "", "read" ], [ "", "strncmp" ], [ "", "strncpy" ], [ "", "strcasecmp" ], [ "", "realloc" ], [ "", "memcmp" ], [ "", "fread" ], [ "", "ITM_deregisterTMCloneTable" ], [ "", "strtoull" ], [ "", "fopen" ], [ "", "clearerr" ], [ "", "fclose" ], [ "", "opendir" ], [ "", "assert_fail" ], [ "", "strcmp" ], [ "", "stderr" ], [ "", "fputc" ], [ "", "stat" ], [ "", "fwrite" ], [ "", "errno_location" ], [ "", "exit" ], [ "", "atoi" ], [ "", "strspn" ], [ "", "libc_start_main" ], [ "", "strlen" ], [ "", "open" ], [ "", "strchr" ], [ "", "fputs" ], [ "", "closedir" ], [ "", "register_frame_info" ], [ "", "close" ], [ "", "vfprintf" ], [ "", "free" ] ], "sec": [ [ ".note.gnu.property", 792, 48, 1.94, "alloc" ], [ ".note.gnu.build-id", 840, 36, 4.19, "alloc" ], [ ".interp", 876, 25, 4.05, "alloc" ], [ ".gnu.hash", 904, 44, 2.55, "alloc" ], [ ".dynsym", 952, 1632, 0.93, "alloc" ], [ ".dynstr", 2584, 575, 4.38, "alloc" ], [ ".rela.dyn", 3160, 240, 1.5, "alloc" ], [ ".rela.plt", 3400, 1320, 1.68, "alloc,info_link" ], [ ".relr.dyn", 4720, 152, 5.49, "alloc" ], [ ".init", 8192, 3, 1.58, "alloc,executable" ], [ ".plt", 8208, 896, 4.16, "alloc,executable" ], [ ".text", 9104, 53164, 6.31, "alloc,executable" ], [ ".fini", 62268, 3, 1.58, "alloc,executable" ], [ ".rodata", 65536, 21530, 5.68, "alloc" ], [ ".eh_frame_hdr", 87068, 2076, 5.28, "alloc" ], [ ".eh_frame", 89144, 13124, 5.1, "alloc" ], [ ".init_array", 103536, 8, 1.06, "write,alloc" ], [ ".fini_array", 103544, 8, 1.06, "write,alloc" ], [ ".data.rel.ro", 103552, 1896, 2.05, "write,alloc" ], [ ".dynamic", 105448, 496, 1.37, "write,alloc" ], [ ".got", 105944, 544, 1.59, "write,alloc" ], [ ".data", 106496, 6564, 1.8, "write,alloc" ], [ ".comment", 113060, 28, 3.99, "merge,strings" ], [ ".shstrtab", 113088, 234, 4.14, "" ] ], "metrics": { "elf": { "bits": 64.0, "entry": 10925.0, "has_got": 1.0, "has_plt": 1.0, "has_note": 1.0, "note_count": 2.0, "nx_enabled": 1.0, "has_dt_relr": 1.0, "dynrel_count": 0.0, "dynsym_count": 68.0, "has_build_id": 1.0, "has_eh_frame": 1.0, "has_gnu_hash": 1.0, "stack_canary": 1.0, "symtab_count": 0.0, "dynrela_count": 10.0, "little_endian": 1.0, "dt_flags_1_raw": 134217729.0, "pltreloc_count": 55.0, "build_id_length": 20.0, "executable_stack": 0.0, "fini_array_count": 1.0, "init_array_count": 1.0, "wx_segment_count": 0.0, "comment_entry_count": 1.0, "program_header_count": 13.0, "comment_distinct_count": 1.0, "gnu_stack_section_absent": 0.0, "load_segment_max_file_size": 54079.0, "stripped_but_symtab_present": 0.0, "load_segment_max_memory_size": 54079.0, "section_relocation_group_count": 2.0, "stripped_metadata_section_count": 7.0 }, "file": { "size": 114992.0, "entropy": 5.82, "size_bytes": 114992.0 }, "binary": { "is_pie": 1.0, "has_overlay": 1.0, "is_stripped": 1.0, "code_entropy": 6.28, "data_entropy": 1.81, "overlay_size": 1670.0, "string_count": 606.0, "overlay_ratio": 0.01, "overall_entropy": 5.82, "overlay_entropy": 1.51, "entropy_variance": 2.92, "avg_string_length": 23.26, "max_string_length": 163.0, "peak_region_bytes": 44032.0, "code_to_data_ratio": 0.85, "peak_region_entropy": 6.15, "string_length_stddev": 19.23, "largest_section_ratio": 0.46, "sentence_string_count": 222.0, "sentence_string_ratio": 0.37, "high_entropy_string_count": 3.0 }, "exports": { "count": 2.0 }, "imports": { "count": 65.0 }, "sections": { "count": 26.0, "code_size": 54066.0, "entropy_max": 6.31, "entropy_mean": 3.06, "name_entropy": 4.09, "writable_count": 7.0, "executable_count": 4.0, "nonstandard_count": 6.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } } }, "id": 1, "mol": "O₂(CI)H₂(F₃U)Md(He)", "path": "/data/samples/good/foraged/alpine/alpinelinux.org/_/dtc/dtc-1.7.2-r1.apk!!usr/bin/dtc", "risk": 6, "sha": "7569f98a09a93ff55636187003e3e0ae8fdc9a9629377184a3b950075a8ef30b", "size": 114992, "traits": [ { "id": "micro-behaviors/fs/file/read::read", "conf": 0.699999988079071, "crit": 2, "desc": "Read file descriptor (read/pread)", "spans": [ [ 2930, 4 ] ] }, { "id": "micro-behaviors/ui/help::options-title-string", "crit": 1, "desc": "Options: label in binary strings", "spans": [ [ 79532, 14 ] ] }, { "id": "micro-behaviors/fs/file/binary::fseek-func", "atk": "T1005", "conf": 0.4000000059604645, "crit": 2, "desc": "Seeks to position in file", "spans": [ [ 2781, 5 ] ] }, { "id": "micro-behaviors/fs/directory/readdir::readdir-opendir", "conf": 0.6600000262260437, "crit": 2, "desc": "Uses opendir", "spans": [ [ 2873, 7 ] ] }, { "id": "objectives/impact/infect/terms::flex-word", "conf": 1.0, "crit": 3, "desc": "flex lexer-generator tool name", "spans": [ [ 80065, 4 ] ] }, { "id": "micro-behaviors/fs/file/read::fread-text", "conf": 0.6200000047683716, "crit": 2, "desc": "fread API string", "spans": [ [ 2929, 5 ] ] }, { "id": "micro-behaviors/fs/directory/readdir::readdir-readdir", "conf": 0.6600000262260437, "crit": 2, "desc": "Uses readdir", "spans": [ [ 2602, 7 ] ] }, { "id": "micro-behaviors/ui/help::usage-title-string", "crit": 1, "desc": "Usage: label in binary strings", "spans": [ [ 79521, 9 ] ] }, { "id": "micro-behaviors/fs/file/read::fread", "conf": 0.699999988079071, "crit": 2, "desc": "Read stream (fread)", "spans": [ [ 2929, 5 ] ] }, { "id": "micro-behaviors/fs/file/write/direct::write--write", "conf": 0.6600000262260437, "crit": 2, "desc": "Write files (write)", "spans": [ [ 2923, 5 ] ] }, { "id": "micro-behaviors/ui/help::usage-title", "crit": 2, "desc": "Usage: label (title case)", "spans": [ [ 79521, 9 ] ] }, { "id": "objectives/command-and-control/botnet/keywords::slave-term", "conf": 0.4000000059604645, "crit": 3, "desc": "Slave keyword", "spans": [ [ 68018, 5 ] ] }, { "id": "metadata/binary/metrics/threshold::rich-sentence-strings-20pct", "conf": 0.800000011920929, "crit": 1, "desc": "Binary has many sentence-like strings", "spans": [ [ 0, 35 ] ] }, { "id": "micro-behaviors/fs/directory/readdir::readdir-closedir", "conf": 0.6600000262260437, "crit": 2, "desc": "Uses closedir", "spans": [ [ 2644, 8 ] ] }, { "id": "micro-behaviors/fs/file/binary::fseek-text", "atk": "T1005", "crit": 2, "desc": "fseek API string", "spans": [ [ 2781, 5 ] ] }, { "id": "micro-behaviors/dylib/library/libc::libc-characteristic-cxa-finalize", "crit": 2, "desc": "libc characteristic cxa finalize", "spans": [ [ 2961, 12 ] ] }, { "id": "micro-behaviors/ui/help::options-title", "crit": 2, "desc": "Options: label", "spans": [ [ 79532, 14 ] ] }, { "id": "metadata/binary/metrics/threshold::many-imports-50", "conf": 1.0, "crit": 1, "desc": "Binary has 50+ imports", "spans": [ [ 0, 21 ] ] }, { "id": "micro-behaviors/fs/file/write/direct::write--fwrite", "conf": 0.6600000262260437, "crit": 2, "desc": "Write files (fwrite)", "spans": [ [ 2922, 6 ] ] }, { "id": "micro-behaviors/fs/file/open::fopen", "conf": 0.6600000262260437, "crit": 3, "desc": "Open files", "spans": [ [ 2610, 5 ] ] }, { "id": "objectives/command-and-control/reverse-shell/pty::pty-dual-mode-backdoor-cond-2--inline-10027", "atk": "T1059.004", "mbc": "B0024", "conf": 0.9300000071525574, "crit": 3, "desc": "Regex component marker", "spans": [ [ 2901, 11 ] ] }, { "id": "metadata/hardening/missing::stripped-binary", "conf": 0.800000011920929, "crit": 3, "desc": "No full symbol table (likely stripped)", "spans": [ [ 0, 25 ] ] }, { "id": "micro-behaviors/fs/file/stat::stat-core", "conf": 0.800000011920929, "crit": 3, "desc": "Read file status and metadata (core)", "spans": [ [ 2639, 4 ] ] }, { "id": "micro-behaviors/fs/file/binary::file-manipulation", "atk": "T1005", "conf": 0.75, "crit": 3, "desc": "File content manipulation (read/write/seek)", "spans": [ [ 2781, 5 ] ] }, { "id": "micro-behaviors/dylib/library/libc::libc-internal-functions-b", "conf": 0.699999988079071, "crit": 2, "desc": "libc internal symbols cluster B", "spans": [ [ 2961, 12 ] ] }, { "id": "micro-behaviors/fs/file/binary::file-read-operation", "atk": "T1005", "conf": 0.75, "crit": 1, "desc": "File read operation", "spans": [ [ 2929, 5 ], [ 2930, 4 ] ] }, { "id": "micro-behaviors/fs/file/write/direct::write", "conf": 0.6600000262260437, "crit": 2, "desc": "Write files", "spans": [ [ 2922, 6 ], [ 2923, 5 ] ] }, { "id": "micro-behaviors/ui/help::has-help", "conf": 0.8500000238418579, "crit": 3, "desc": "Contains help or usage information", "spans": [ [ 79521, 9 ], [ 79532, 14 ] ] }, { "id": "micro-behaviors/fs/file/binary::binary-read-write-ops", "atk": "T1005", "conf": 0.699999988079071, "crit": 3, "desc": "Binary file read/write operations", "spans": [ [ 2781, 5 ] ] }, { "id": "micro-behaviors/ui/help::usage-label", "conf": 0.75, "crit": 1, "desc": "Command line usage text", "spans": [ [ 79521, 9 ], [ 79532, 14 ] ] }, { "id": "micro-behaviors/dylib/library/abi-graphics::cxx-abi-symbols-a", "conf": 0.800000011920929, "crit": 2, "desc": "C++ ABI symbols cluster A", "spans": [ [ 2961, 12 ] ] } ], "type": "elf" }, { "ctx": [ { "b": "E))420S-r400000000000@$H+0rr91H.G*?00000kMy=:00000aAmwY0000000000kMA+z4feS[8upSP1][S6", "n": [ { "c": 3, "d": "No full symbol table (likely stripped)", "i": "metadata/hardening/missing::stripped-binary", "o": 0, "z": 25, "cf": 0.800000011920929 } ], "ln": 0 }, { "b": "00000xjVf{0crm5v@MX[wQ4{h0a{a=vru0)0a{d*wO}G?BAhzixMs8]BAhneAcRB\u003cuVQr$v@2BYxLQ%!vqfJTAclnjxKL]YA+eV}y\u0026r!-B97@bzua3JvrlH3A=+V2vqfJTB98CAz!]z{BAhhezua3JwPz*ez^Ns0v{%E[z/bK", "n": [ { "c": 4, "d": "Sets LD_PRELOAD hooks to hide filesystem", "i": "objectives/evasion/kernel-hide/userspace::preload-rootkit-hook-set", "o": 2154, "z": 5, "cf": 0.9200000166893005 }, { "c": 3, "d": "Stack protector/canary enabled", "i": "metadata/hardening/build::stack-protector", "o": 2178, "z": 14, "cf": 0.8999999761581421 }, { "c": 3, "d": "Benign network-capable library context", "i": "objectives/supply-chain/trojanized/backdoor::benign-network-library-context", "o": 2217, "z": 11, "cf": 0.8999999761581421 }, { "c": 2, "d": "Terminates process immediately without cleanup", "i": "micro-behaviors/process/terminate/signal::_exit", "o": 2141, "z": 4, "cf": 0.4000000059604645 } ], "ln": 2125 }, { "b": "B8C@qx(n380crl)z/{d4w]I)mv/QaWB-.W8B98Cuy?mF:w[bT}B7Ct*vqG:#v/QN(wb", "n": [ { "c": 2, "d": "Write single bytes to file", "i": "micro-behaviors/fs/file/write/direct::fputc", "o": 2286, "z": 5, "cf": 0.6600000262260437 } ], "ln": 2270 }, { "b": "Bye\u003c5zF5@\u003cBAhFwB.\u003e\u003c]w{nofBy+C:A+eV\u00260crm5v}Y(.uUj1\u0026x-IHEv%zA?w[=c\u003ey?Xib0crm5v@le+B98ClA=M8s0af8Hx\u003c$NVB97\u0026hBye([", "n": [ { "c": 3, "d": "File content manipulation (read/write/seek)", "i": "micro-behaviors/fs/file/binary::file-manipulation", "o": 2354, "z": 6, "cf": 0.75 }, { "c": 2, "d": "C++ standard library markers (libc++, libstdc++)", "i": "micro-behaviors/dylib/library/libc::cxx-stdlib-marker", "o": 2382, "z": 12, "cf": 0.8999999761581421 }, { "c": 2, "d": "Generic file read/write operations", "i": "micro-behaviors/fs/file/read-write::binary-file-ops", "o": 2361, "z": 5, "cf": 0.800000011920929 } ], "ln": 2338 }, { "b": "0a{m.wDlKXvQ?3cB-RvJCSmP*hz^4cz.r:AuTEtPA+e($B97#luUjs!zdN6*zF0!!uR7", "n": [ { "c": 3, "d": "Architecture detection strings", "i": "objectives/discovery/host/software::arch-detection", "o": 2460, "z": 6, "cf": 0.5 } ], "ln": 2444 }, { "b": "e\u00260AcwPz\u003caz/dPUc36y[rDzOYwJy}WA%-mIAcb/jzGv\u0026YeN6Jxt)ZNIAccedxK#10twmv=aW3@yrzl6^arR^HarQUbao", "n": [ { "c": 3, "d": "Benign socket shell helper context", "i": "micro-behaviors/process/fd/dup::posix-fd-redirect-shell-benign-context", "o": 16883, "z": 14, "cf": 0.9399999976158142 }, { "c": 3, "d": "Terminal socket exec helper context", "i": "micro-behaviors/process/fd/dup::unix-terminal-socket-exec-benign-context", "o": 16872, "z": 9, "cf": 0.949999988079071 } ], "ln": 16856 }, { "b": "y\u0026].8DOlW^Ee)\u003e/Byw#dw]846aAI43zF\u003c3aazC.nwPzV%y-)qfA=k$IeOe*gaA7\u003cmvS=o{wPw]g", "n": [ { "c": 3, "d": "flex lexer-generator tool name", "i": "objectives/impact/infect/terms::flex-word", "o": 17256, "z": 4, "cf": 1.0 }, { "c": 3, "d": "Legitimate development tool indicators", "i": "objectives/impact/infect/terms::legitimate-tools", "o": 17261, "z": 7, "cf": 1.0 } ], "ln": 17240 }, { "b": "By^7qzGNNvB.LV5eOO.}e[]iBwPz.\u0026e[Y6Ae[!WmxAfU}D2vXGz2=h0D2vXBASv.jwO+^cwo\u00264)e]\u003eJtvj(InBo0}lwO=xtwo\u00264)e=", "n": [ { "c": 2, "d": "ELF dynstr section name", "i": "metadata/binary/linking/static::elf-dynstr-section-name", "o": 28795, "z": 7, "cf": 0.8999999761581421 }, { "c": 2, "d": "ELF dynsym section name", "i": "metadata/binary/linking/static::elf-dynsym-section-name", "o": 28787, "z": 7, "cf": 0.8999999761581421 }, { "c": 2, "d": "ELF interpreter section name", "i": "metadata/binary/linking/static::elf-interpreter-section-name", "o": 28769, "z": 7, "cf": 0.8999999761581421 } ], "ln": 28753 }, { "b": "vr?\u00269wmoN*e]\u003eJte]\u003e\u003ege[xlBvqPZ*04}]5Bo0}7vrt]Te[e)y04}=1zeA\u003c4Bn#pv00000", "n": [ { "c": 2, "d": "ELF dynamic section name", "i": "metadata/binary/linking/static::elf-dynamic-section-name", "o": 28920, "z": 8, "cf": 0.8999999761581421 } ], "ln": 28904 } ], "depth": 1, "facts": { "exp": [ [ "init" ], [ "fini" ] ], "imp": [ [ "", "putchar" ], [ "", "strcpy" ], [ "", "printf" ], [ "", "stdout" ], [ "", "strerror" ], [ "", "getopt_long" ], [ "", "getc" ], [ "", "cxa_finalize" ], [ "", "malloc" ], [ "", "vsnprintf" ], [ "", "stack_chk_fail" ], [ "", "strtol" ], [ "", "strnlen" ], [ "", "strrchr" ], [ "", "write" ], [ "", "fprintf" ], [ "", "deregister_frame_info" ], [ "", "ITM_registerTMCloneTable" ], [ "", "stdin" ], [ "", "ferror" ], [ "", "read" ], [ "", "strncpy" ], [ "", "realloc" ], [ "", "fread" ], [ "", "ITM_deregisterTMCloneTable" ], [ "", "strtoull" ], [ "", "fopen" ], [ "", "fnmatch" ], [ "", "clearerr" ], [ "", "fclose" ], [ "", "assert_fail" ], [ "", "strcmp" ], [ "", "stderr" ], [ "", "fputc" ], [ "", "fwrite" ], [ "", "errno_location" ], [ "", "exit" ], [ "", "libc_start_main" ], [ "", "strlen" ], [ "", "open" ], [ "", "strchr" ], [ "", "fputs" ], [ "", "register_frame_info" ], [ "", "close" ], [ "", "vfprintf" ], [ "", "free" ] ], "sec": [ [ ".note.gnu.property", 792, 48, 1.94, "alloc" ], [ ".note.gnu.build-id", 840, 36, 4.25, "alloc" ], [ ".interp", 876, 25, 4.05, "alloc" ], [ ".gnu.hash", 904, 44, 2.55, "alloc" ], [ ".dynsym", 952, 1176, 0.87, "alloc" ], [ ".dynstr", 2128, 444, 4.4, "alloc" ], [ ".rela.dyn", 2576, 192, 1.23, "alloc" ], [ ".rela.plt", 2768, 912, 1.42, "alloc,info_link" ], [ ".relr.dyn", 3680, 24, 2.17, "alloc" ], [ ".init", 4096, 3, 1.58, "alloc,executable" ], [ ".plt", 4112, 624, 3.86, "alloc,executable" ], [ ".text", 4736, 10625, 6.24, "alloc,executable" ], [ ".fini", 15361, 3, 1.58, "alloc,executable" ], [ ".rodata", 16384, 4054, 5.14, "alloc" ], [ ".eh_frame_hdr", 20440, 572, 4.69, "alloc" ], [ ".eh_frame", 21016, 2588, 4.72, "alloc" ], [ ".init_array", 27344, 8, 1.06, "write,alloc" ], [ ".fini_array", 27352, 8, 1.06, "write,alloc" ], [ ".data.rel.ro", 27360, 400, 1.27, "write,alloc" ], [ ".dynamic", 27760, 496, 1.3, "write,alloc" ], [ ".got", 28256, 392, 1.49, "write,alloc" ], [ ".data", 28672, 20, 1.02, "write,alloc" ], [ ".comment", 28692, 28, 3.99, "merge,strings" ], [ ".shstrtab", 28720, 234, 4.14, "" ] ], "metrics": { "elf": { "bits": 64.0, "entry": 5256.0, "has_got": 1.0, "has_plt": 1.0, "has_note": 1.0, "note_count": 2.0, "nx_enabled": 1.0, "has_dt_relr": 1.0, "dynrel_count": 0.0, "dynsym_count": 49.0, "has_build_id": 1.0, "has_eh_frame": 1.0, "has_gnu_hash": 1.0, "stack_canary": 1.0, "symtab_count": 0.0, "dynrela_count": 8.0, "little_endian": 1.0, "dt_flags_1_raw": 134217729.0, "pltreloc_count": 38.0, "build_id_length": 20.0, "executable_stack": 0.0, "fini_array_count": 1.0, "init_array_count": 1.0, "wx_segment_count": 0.0, "comment_entry_count": 1.0, "program_header_count": 13.0, "comment_distinct_count": 1.0, "gnu_stack_section_absent": 0.0, "load_segment_max_file_size": 11268.0, "stripped_but_symtab_present": 0.0, "load_segment_max_memory_size": 11268.0, "section_relocation_group_count": 2.0, "stripped_metadata_section_count": 7.0 }, "file": { "size": 30624.0, "entropy": 4.69, "size_bytes": 30624.0 }, "binary": { "is_pie": 1.0, "has_overlay": 1.0, "is_stripped": 1.0, "code_entropy": 6.1, "data_entropy": 1.34, "overlay_size": 1670.0, "string_count": 137.0, "overlay_ratio": 0.05, "overall_entropy": 4.69, "overlay_entropy": 1.39, "entropy_variance": 2.62, "avg_string_length": 16.1, "max_string_length": 79.0, "peak_region_bytes": 9216.0, "code_to_data_ratio": 0.89, "peak_region_entropy": 6.18, "string_length_stddev": 14.09, "largest_section_ratio": 0.35, "sentence_string_count": 27.0, "sentence_string_ratio": 0.2, "high_entropy_string_count": 0.0 }, "exports": { "count": 2.0 }, "imports": { "count": 46.0 }, "sections": { "count": 26.0, "code_size": 11255.0, "entropy_max": 6.24, "entropy_mean": 2.75, "name_entropy": 4.09, "writable_count": 7.0, "executable_count": 4.0, "nonstandard_count": 6.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } } }, "id": 2, "mol": "O(I)H₂(F₂U)Md(He)", "path": "/data/samples/good/foraged/alpine/alpinelinux.org/_/dtc/dtc-1.7.2-r1.apk!!usr/bin/convert-dtsv0", "risk": 4, "sha": "199445c130442300d9bdd7d7f60ecaf32de1d23a064c6268ba2d6bff082f1fee", "size": 30624, "traits": [ { "id": "micro-behaviors/fs/file/read::read", "conf": 0.699999988079071, "crit": 2, "desc": "Read file descriptor (read/pread)", "spans": [ [ 2362, 4 ] ] }, { "id": "micro-behaviors/ui/help::options-title-string", "crit": 1, "desc": "Options: label in binary strings", "spans": [ [ 16883, 14 ] ] }, { "id": "objectives/impact/infect/terms::flex-word", "conf": 1.0, "crit": 3, "desc": "flex lexer-generator tool name", "spans": [ [ 17256, 4 ] ] }, { "id": "micro-behaviors/fs/file/read::fread-text", "conf": 0.6200000047683716, "crit": 2, "desc": "fread API string", "spans": [ [ 2361, 5 ] ] }, { "id": "micro-behaviors/ui/help::usage-title-string", "crit": 1, "desc": "Usage: label in binary strings", "spans": [ [ 16872, 9 ] ] }, { "id": "micro-behaviors/fs/file/read::fread", "conf": 0.699999988079071, "crit": 2, "desc": "Read stream (fread)", "spans": [ [ 2361, 5 ] ] }, { "id": "micro-behaviors/fs/file/write/direct::write--write", "conf": 0.6600000262260437, "crit": 2, "desc": "Write files (write)", "spans": [ [ 2355, 5 ] ] }, { "id": "micro-behaviors/ui/help::usage-title", "crit": 2, "desc": "Usage: label (title case)", "spans": [ [ 16872, 9 ] ] }, { "id": "micro-behaviors/dylib/library/libc::libc-characteristic-cxa-finalize", "crit": 2, "desc": "libc characteristic cxa finalize", "spans": [ [ 2382, 12 ] ] }, { "id": "micro-behaviors/ui/help::options-title", "crit": 2, "desc": "Options: label", "spans": [ [ 16883, 14 ] ] }, { "id": "micro-behaviors/fs/file/write/direct::write--fwrite", "conf": 0.6600000262260437, "crit": 2, "desc": "Write files (fwrite)", "spans": [ [ 2354, 6 ] ] }, { "id": "micro-behaviors/fs/file/open::fopen", "conf": 0.6600000262260437, "crit": 3, "desc": "Open files", "spans": [ [ 2154, 5 ] ] }, { "id": "metadata/hardening/missing::stripped-binary", "conf": 0.800000011920929, "crit": 3, "desc": "No full symbol table (likely stripped)", "spans": [ [ 0, 25 ] ] }, { "id": "micro-behaviors/dylib/library/libc::libc-internal-functions-b", "conf": 0.699999988079071, "crit": 2, "desc": "libc internal symbols cluster B", "spans": [ [ 2382, 12 ] ] }, { "id": "micro-behaviors/fs/file/binary::file-read-operation", "atk": "T1005", "conf": 0.75, "crit": 1, "desc": "File read operation", "spans": [ [ 2361, 5 ], [ 2362, 4 ] ] }, { "id": "micro-behaviors/fs/file/write/direct::write", "conf": 0.6600000262260437, "crit": 2, "desc": "Write files", "spans": [ [ 2354, 6 ], [ 2355, 5 ] ] }, { "id": "micro-behaviors/ui/help::has-help", "conf": 0.8500000238418579, "crit": 3, "desc": "Contains help or usage information", "spans": [ [ 16872, 9 ], [ 16883, 14 ] ] }, { "id": "micro-behaviors/ui/help::usage-label", "conf": 0.75, "crit": 1, "desc": "Command line usage text", "spans": [ [ 16872, 9 ], [ 16883, 14 ] ] }, { "id": "micro-behaviors/fs/file/binary::file-manipulation", "atk": "T1005", "conf": 0.75, "crit": 3, "desc": "File content manipulation (read/write/seek)", "spans": [ [ 2354, 6 ], [ 2355, 5 ], [ 2361, 5 ], [ 2362, 4 ] ] }, { "id": "micro-behaviors/dylib/library/abi-graphics::cxx-abi-symbols-a", "conf": 0.800000011920929, "crit": 2, "desc": "C++ ABI symbols cluster A", "spans": [ [ 2382, 12 ] ] } ], "type": "elf" }, { "ctx": [ { "b": "E))420S-r400000000000@$H+0rr91.6]u:00000kMy=:00000fKT}Y0000000000kMA+z4feS[8#{]T1][S6", "n": [ { "c": 3, "d": "No full symbol table (likely stripped)", "i": "metadata/hardening/missing::stripped-binary", "o": 0, "z": 25, "cf": 0.800000011920929 } ], "ln": 0 }, { "b": "?$aVqy?Wuiy?bbmB-RvJCSmP*hz^4cz.r:A000030000O000010000600000Fb/MH1v8", "n": [ { "c": 3, "d": "Architecture detection strings", "i": "objectives/discovery/host/software::arch-detection", "o": 889, "z": 6, "cf": 0.5 } ], "ln": 873 }, { "b": "000000096100000003wkv%zA?w[=c\u003ey?Xib0af8OBywV{uT)++uUi.XyYFJ#A=bY8zua:1A=LV6ASxDNwmY^)xk8BewPzc\u0026AS", "n": [ { "c": 3, "d": "Stack protector/canary enabled", "i": "metadata/hardening/build::stack-protector", "o": 2218, "z": 14, "cf": 0.8999999761581421 }, { "c": 3, "d": "Benign network-capable library context", "i": "objectives/supply-chain/trojanized/backdoor::benign-network-library-context", "o": 2203, "z": 12, "cf": 0.8999999761581421 } ], "ln": 2187 }, { "b": "B9g@fz!9A^zEEx[y?mF:wQ4{h0b(*#x(mCYB98Cuv@MX[AclnjxKL]YA+eV}y\u0026r!-uTEk.B7GxluUi.XyYFJ#A==ko0af8AA=M5ouU\u003cT\u003cvruj4zuaY*vpPvYB8C@qx(n380crl)z/{d4w]I)mv/QaWB-.W8zddl%z^@=*B7nS@w=M:*Byxi50crl)wD", "n": [ { "c": 3, "d": "File content manipulation (read/write/seek)", "i": "micro-behaviors/fs/file/binary::file-manipulation", "o": 2610, "z": 4, "cf": 0.75 }, { "c": 2, "d": "Characteristic libc export __assert_fail", "i": "micro-behaviors/dylib/library/libc::libc-characteristic-assert-fail", "o": 2574, "z": 11, "cf": 0.5 }, { "c": 2, "d": "Write single bytes to file", "i": "micro-behaviors/fs/file/write/direct::fputc", "o": 2632, "z": 5, "cf": 0.6600000262260437 }, { "c": 2, "d": "Terminates process immediately without cleanup", "i": "micro-behaviors/process/terminate/signal::_exit", "o": 2536, "z": 4, "cf": 0.4000000059604645 } ], "ln": 2520 }, { "b": "Bz(buuU\u003cT#x8(BTz/YE\u0026z/xo90aftLzFo8(BAg(dz#:lLy?Wu*uVQr$A=+V9vqfPVCxdztwDl)=Ab]VgBy\u003eI+A+e!Zy?Wu\u003cwooCBz.r:Ay?Wu*e]t-Ly+o(\u003ehEwv0e]$}-f-T)slpKvxuOKe*000000rrc20rrf30rrf3", "n": [ { "c": 2, "d": "Generic file read/write operations", "i": "micro-behaviors/fs/file/read-write::binary-file-ops", "o": 2696, "z": 4, "cf": 0.800000011920929 }, { "c": 2, "d": "Write files (write)", "i": "micro-behaviors/fs/file/write/direct::write--write", "o": 2732, "z": 5, "cf": 0.6600000262260437 }, { "c": 2, "d": "x86_64 architecture string", "i": "micro-behaviors/os/sysinfo/platform/string::arch-x86-64", "o": 2774, "z": 6, "cf": 0.30000001192092896 } ], "ln": 2680 }, { "b": "e\u00260AcwPz\u003caz/dPUc36y[rDzOYwJy}WA%-mIAcb/jzGv\u0026YeN6Jxt)ZNIAccedxK#10twmv=aW3@yrzl6^arR^HarQUbao", "n": [ { "c": 3, "d": "Benign socket shell helper context", "i": "micro-behaviors/process/fd/dup::posix-fd-redirect-shell-benign-context", "o": 17219, "z": 14, "cf": 0.9399999976158142 }, { "c": 3, "d": "Terminal socket exec helper context", "i": "micro-behaviors/process/fd/dup::unix-terminal-socket-exec-benign-context", "o": 17208, "z": 9, "cf": 0.949999988079071 } ], "ln": 17192 }, { "b": "By^7qzGNNvB.LV5eOO.}e[]iBwPz.\u0026e[Y6Ae[!WmxAfU}D2vXGz2=h0D2vXBASv.8zGNNPwPz\u003caz/bLcxkR\u0026AC4CYnx(v(@ASv.jwD", "n": [ { "c": 2, "d": "ELF dynstr section name", "i": "metadata/binary/linking/static::elf-dynstr-section-name", "o": 24687, "z": 7, "cf": 0.8999999761581421 }, { "c": 2, "d": "ELF dynsym section name", "i": "metadata/binary/linking/static::elf-dynsym-section-name", "o": 24679, "z": 7, "cf": 0.8999999761581421 }, { "c": 2, "d": "ELF interpreter section name", "i": "metadata/binary/linking/static::elf-interpreter-section-name", "o": 24661, "z": 7, "cf": 0.8999999761581421 } ], "ln": 24645 }, { "b": "vr?\u00269wmoN*e]\u003eJte]\u003e\u003ege[xlBvqPZ*04}]5Bo0}7vrt]Te[e)y04}=1zeA\u003c4Bn#pv00000", "n": [ { "c": 2, "d": "ELF dynamic section name", "i": "metadata/binary/linking/static::elf-dynamic-section-name", "o": 24840, "z": 8, "cf": 0.8999999761581421 } ], "ln": 24824 } ], "depth": 1, "facts": { "exp": [ [ "init" ], [ "fini" ] ], "imp": [ [ "", "putchar" ], [ "", "printf" ], [ "", "stdout" ], [ "", "fdt_add_subnode" ], [ "", "strerror" ], [ "", "fdt_pack" ], [ "", "getopt_long" ], [ "", "cxa_finalize" ], [ "", "fdt_strerror" ], [ "", "malloc" ], [ "", "optarg" ], [ "", "vsnprintf" ], [ "", "fdt_add_subnode_namelen" ], [ "", "stack_chk_fail" ], [ "", "fdt_subnode_offset_namelen" ], [ "", "fdt_open_into" ], [ "", "strtol" ], [ "", "strnlen" ], [ "", "strrchr" ], [ "", "write" ], [ "", "fprintf" ], [ "", "deregister_frame_info" ], [ "", "fdt_del_node" ], [ "", "ITM_registerTMCloneTable" ], [ "", "optind" ], [ "", "read" ], [ "", "strncpy" ], [ "", "realloc" ], [ "", "sscanf" ], [ "", "ITM_deregisterTMCloneTable" ], [ "", "fdt_setprop" ], [ "", "assert_fail" ], [ "", "strcmp" ], [ "", "stderr" ], [ "", "fputc" ], [ "", "fdt_delprop" ], [ "", "fdt_path_offset" ], [ "", "errno_location" ], [ "", "exit" ], [ "", "libc_start_main" ], [ "", "strlen" ], [ "", "open" ], [ "", "strchr" ], [ "", "fputs" ], [ "", "register_frame_info" ], [ "", "fdt_get_property" ], [ "", "close" ], [ "", "vfprintf" ], [ "", "free" ] ], "sec": [ [ ".note.gnu.property", 792, 48, 1.94, "alloc" ], [ ".note.gnu.build-id", 840, 36, 4.25, "alloc" ], [ ".interp", 876, 25, 4.05, "alloc" ], [ ".gnu.hash", 904, 44, 2.55, "alloc" ], [ ".dynsym", 952, 1248, 0.99, "alloc" ], [ ".dynstr", 2200, 597, 4.47, "alloc" ], [ ".gnu.version", 2798, 104, 1.37, "alloc" ], [ ".gnu.version_r", 2904, 32, 2.09, "alloc" ], [ ".rela.dyn", 2936, 216, 1.25, "alloc" ], [ ".rela.plt", 3152, 960, 1.42, "alloc,info_link" ], [ ".relr.dyn", 4112, 24, 1.95, "alloc" ], [ ".init", 8192, 3, 1.58, "alloc,executable" ], [ ".plt", 8208, 656, 3.86, "alloc,executable" ], [ ".text", 8864, 5747, 6.24, "alloc,executable" ], [ ".fini", 14611, 3, 1.58, "alloc,executable" ], [ ".rodata", 16384, 1629, 5.2, "alloc" ], [ ".eh_frame_hdr", 18016, 212, 4.26, "alloc" ], [ ".eh_frame", 18232, 1164, 4.78, "alloc" ], [ ".init_array", 23184, 8, 1.06, "write,alloc" ], [ ".fini_array", 23192, 8, 1.06, "write,alloc" ], [ ".data.rel.ro", 23200, 384, 0.94, "write,alloc" ], [ ".dynamic", 23584, 560, 1.46, "write,alloc" ], [ ".got", 24144, 416, 1.46, "write,alloc" ], [ ".data", 24576, 8, 0.54, "write,alloc" ], [ ".comment", 24584, 28, 3.99, "merge,strings" ], [ ".shstrtab", 24612, 262, 4.18, "" ] ], "metrics": { "elf": { "bits": 64.0, "entry": 10689.0, "has_got": 1.0, "has_plt": 1.0, "has_note": 1.0, "note_count": 2.0, "nx_enabled": 1.0, "has_dt_relr": 1.0, "dynrel_count": 0.0, "dynsym_count": 52.0, "has_build_id": 1.0, "has_eh_frame": 1.0, "has_gnu_hash": 1.0, "stack_canary": 1.0, "symtab_count": 0.0, "dynrela_count": 9.0, "little_endian": 1.0, "dt_flags_1_raw": 134217729.0, "pltreloc_count": 40.0, "build_id_length": 20.0, "dt_versym_count": 52.0, "executable_stack": 0.0, "fini_array_count": 1.0, "init_array_count": 1.0, "wx_segment_count": 0.0, "comment_entry_count": 1.0, "program_header_count": 13.0, "comment_distinct_count": 1.0, "gnu_stack_section_absent": 0.0, "load_segment_max_file_size": 6422.0, "stripped_but_symtab_present": 0.0, "load_segment_max_memory_size": 6422.0, "section_relocation_group_count": 2.0, "stripped_metadata_section_count": 7.0 }, "file": { "size": 26672.0, "entropy": 3.54, "size_bytes": 26672.0 }, "binary": { "is_pie": 1.0, "has_overlay": 1.0, "is_stripped": 1.0, "code_entropy": 5.99, "data_entropy": 1.31, "overlay_size": 1798.0, "string_count": 131.0, "overlay_ratio": 0.07, "overall_entropy": 3.54, "overlay_entropy": 1.44, "entropy_variance": 2.56, "avg_string_length": 18.11, "max_string_length": 428.0, "peak_region_bytes": 5120.0, "code_to_data_ratio": 0.82, "peak_region_entropy": 6.2, "string_length_stddev": 38.0, "largest_section_ratio": 0.22, "sentence_string_count": 26.0, "sentence_string_ratio": 0.2, "high_entropy_string_count": 0.0 }, "exports": { "count": 2.0 }, "imports": { "count": 49.0 }, "sections": { "count": 28.0, "code_size": 6409.0, "entropy_max": 6.24, "entropy_mean": 2.64, "name_entropy": 4.13, "writable_count": 7.0, "executable_count": 4.0, "nonstandard_count": 6.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 2.0 } } }, "id": 3, "mol": "H₂(FU)Md(He)", "path": "/data/samples/good/foraged/alpine/alpinelinux.org/_/dtc/dtc-1.7.2-r1.apk!!usr/bin/fdtput", "risk": 3, "sha": "c0158112c0c5dde515be0d38f1e616b9a72499b2ffad805a2ac01be8445688da", "size": 26672, "traits": [ { "id": "micro-behaviors/fs/file/read::read", "conf": 0.699999988079071, "crit": 2, "desc": "Read file descriptor (read/pread)", "spans": [ [ 2610, 4 ] ] }, { "id": "micro-behaviors/ui/help::options-title-string", "crit": 1, "desc": "Options: label in binary strings", "spans": [ [ 17219, 14 ] ] }, { "id": "micro-behaviors/ui/help::usage-title-string", "crit": 1, "desc": "Usage: label in binary strings", "spans": [ [ 17208, 9 ] ] }, { "id": "micro-behaviors/fs/file/write/direct::write--write", "conf": 0.6600000262260437, "crit": 2, "desc": "Write files (write)", "spans": [ [ 2732, 5 ] ] }, { "id": "micro-behaviors/ui/help::usage-title", "crit": 2, "desc": "Usage: label (title case)", "spans": [ [ 17208, 9 ] ] }, { "id": "micro-behaviors/dylib/library/libc::libc-characteristic-cxa-finalize", "crit": 2, "desc": "libc characteristic cxa finalize", "spans": [ [ 2203, 12 ] ] }, { "id": "micro-behaviors/ui/help::options-title", "crit": 2, "desc": "Options: label", "spans": [ [ 17219, 14 ] ] }, { "id": "metadata/hardening/missing::stripped-binary", "conf": 0.800000011920929, "crit": 3, "desc": "No full symbol table (likely stripped)", "spans": [ [ 0, 25 ] ] }, { "id": "micro-behaviors/dylib/library/libc::libc-internal-functions-b", "conf": 0.699999988079071, "crit": 2, "desc": "libc internal symbols cluster B", "spans": [ [ 2203, 12 ] ] }, { "id": "micro-behaviors/fs/file/binary::file-read-operation", "atk": "T1005", "conf": 0.75, "crit": 1, "desc": "File read operation", "spans": [ [ 2610, 4 ] ] }, { "id": "micro-behaviors/fs/file/write/direct::write", "conf": 0.6600000262260437, "crit": 2, "desc": "Write files", "spans": [ [ 2732, 5 ] ] }, { "id": "micro-behaviors/ui/help::has-help", "conf": 0.8500000238418579, "crit": 3, "desc": "Contains help or usage information", "spans": [ [ 17208, 9 ], [ 17219, 14 ] ] }, { "id": "micro-behaviors/ui/help::usage-label", "conf": 0.75, "crit": 1, "desc": "Command line usage text", "spans": [ [ 17208, 9 ], [ 17219, 14 ] ] }, { "id": "micro-behaviors/fs/file/binary::file-manipulation", "atk": "T1005", "conf": 0.75, "crit": 3, "desc": "File content manipulation (read/write/seek)", "spans": [ [ 2610, 4 ], [ 2732, 5 ] ] }, { "id": "micro-behaviors/dylib/library/abi-graphics::cxx-abi-symbols-a", "conf": 0.800000011920929, "crit": 2, "desc": "C++ ABI symbols cluster A", "spans": [ [ 2203, 12 ] ] } ], "type": "elf" }, { "ctx": [ { "b": "E))420S-r400000000000@$H+0rr917-9eL00000kMy=:00000fHkWs0000000000kMA+z4feS[8#{]T1][S6", "n": [ { "c": 3, "d": "No full symbol table (likely stripped)", "i": "metadata/hardening/missing::stripped-binary", "o": 0, "z": 25, "cf": 0.800000011920929 } ], "ln": 0 }, { "b": "dz?Mcy?Wuiy?bbmB-RvJCSmP*hz^4cz.r:A000030000G000010000600000Fb/MH1v8", "n": [ { "c": 3, "d": "Architecture detection strings", "i": "objectives/discovery/host/software::arch-detection", "o": 889, "z": 6, "cf": 0.5 } ], "ln": 873 }, { "b": "000000096100000003wkv%zA?w[=c\u003ey?Xib0af8OBywV{uT)++uUi.XyYFJ#A=bY8zua3JwmY^)xk8BewPzc\u0026A:-/@uUKy\u0026zV", "n": [ { "c": 3, "d": "Stack protector/canary enabled", "i": "metadata/hardening/build::stack-protector", "o": 2026, "z": 14, "cf": 0.8999999761581421 }, { "c": 3, "d": "Benign network-capable library context", "i": "objectives/supply-chain/trojanized/backdoor::benign-network-library-context", "o": 2011, "z": 12, "cf": 0.8999999761581421 } ], "ln": 1995 }, { "b": "Bye%fwPzP}D0+00Abo!1wQ4{h0b(*#x(mCYB98Cuv@MX[AclnjxKL]YA+eV}y\u0026r!-uTEk.B7GxluUi.XyYFJ#A==ko0af8AA=M5ouU\u003cT\u003cvruj4zuaY*vpPvYB8C@qx(n380crl)z/{d4w]I)mv/QaWB-.W8zddl%z^@==AcbJex8)0{wmY!40afCTx-", "n": [ { "c": 3, "d": "File content manipulation (read/write/seek)", "i": "micro-behaviors/fs/file/binary::file-manipulation", "o": 2307, "z": 4, "cf": 0.75 }, { "c": 2, "d": "Characteristic libc export __assert_fail", "i": "micro-behaviors/dylib/library/libc::libc-characteristic-assert-fail", "o": 2271, "z": 11, "cf": 0.5 }, { "c": 2, "d": "Write single bytes to file", "i": "micro-behaviors/fs/file/write/direct::fputc", "o": 2329, "z": 5, "cf": 0.6600000262260437 }, { "c": 2, "d": "Terminates process immediately without cleanup", "i": "micro-behaviors/process/terminate/signal::_exit", "o": 2233, "z": 4, "cf": 0.4000000059604645 } ], "ln": 2217 }, { "b": "Bz(buuU\u003cT#x8(BTz/YE\u0026z/xo90aftLzFo8(BAg(dz#:lLy?Wu*uVQr$A=+V9vqfPVCxdztwDl)=Ab]VgBy\u003eI+A+e!Zy?Wu\u003cwooCBz.r:Ay?Wu*e]t-Ly+o(\u003ehEwv0e]$}-f-T)slpKvxuOKe*000000rrc20rrc20SSl3", "n": [ { "c": 2, "d": "Generic file read/write operations", "i": "micro-behaviors/fs/file/read-write::binary-file-ops", "o": 2386, "z": 4, "cf": 0.800000011920929 }, { "c": 2, "d": "Write files (write)", "i": "micro-behaviors/fs/file/write/direct::write--write", "o": 2422, "z": 5, "cf": 0.6600000262260437 }, { "c": 2, "d": "x86_64 architecture string", "i": "micro-behaviors/os/sysinfo/platform/string::arch-x86-64", "o": 2464, "z": 6, "cf": 0.30000001192092896 } ], "ln": 2370 }, { "b": "e\u00260AcwPz\u003caz/dPUc36y[rDzOYwJy}WA%-mIAcb/jzGv\u0026YeN6Jxt)ZNIAccedxK#10twmv=aW3@yrzl6^arR^HarQUbao", "n": [ { "c": 3, "d": "Benign socket shell helper context", "i": "micro-behaviors/process/fd/dup::posix-fd-redirect-shell-benign-context", "o": 13132, "z": 14, "cf": 0.9399999976158142 }, { "c": 3, "d": "Terminal socket exec helper context", "i": "micro-behaviors/process/fd/dup::unix-terminal-socket-exec-benign-context", "o": 13121, "z": 9, "cf": 0.949999988079071 } ], "ln": 13105 }, { "b": "By^7qzGNNvB.LV5eOO.}e[]iBwPz.\u0026e[Y6Ae[!WmxAfU}D2vXGz2=h0D2vXBASv.8zGNNPwPz\u003caz/bLcxkR\u0026AC4CYnx(v(@ASv.jwD", "n": [ { "c": 2, "d": "ELF dynstr section name", "i": "metadata/binary/linking/static::elf-dynstr-section-name", "o": 16495, "z": 7, "cf": 0.8999999761581421 }, { "c": 2, "d": "ELF dynsym section name", "i": "metadata/binary/linking/static::elf-dynsym-section-name", "o": 16487, "z": 7, "cf": 0.8999999761581421 }, { "c": 2, "d": "ELF interpreter section name", "i": "metadata/binary/linking/static::elf-interpreter-section-name", "o": 16469, "z": 7, "cf": 0.8999999761581421 } ], "ln": 16453 }, { "b": "vr?\u00269wmoN*e]\u003eJte]\u003e\u003ege[xlBvqPZ*04}]5Bo0}7vrt]Te[e)y04}=1zeA\u003c4Bn#pv00000", "n": [ { "c": 2, "d": "ELF dynamic section name", "i": "metadata/binary/linking/static::elf-dynamic-section-name", "o": 16648, "z": 8, "cf": 0.8999999761581421 } ], "ln": 16632 } ], "depth": 1, "facts": { "exp": [ [ "init" ], [ "fini" ] ], "imp": [ [ "", "putchar" ], [ "", "printf" ], [ "", "stdout" ], [ "", "strerror" ], [ "", "fdt_pack" ], [ "", "getopt_long" ], [ "", "fdt_overlay_apply" ], [ "", "cxa_finalize" ], [ "", "fdt_strerror" ], [ "", "malloc" ], [ "", "optarg" ], [ "", "vsnprintf" ], [ "", "stack_chk_fail" ], [ "", "fdt_open_into" ], [ "", "strtol" ], [ "", "strnlen" ], [ "", "write" ], [ "", "fprintf" ], [ "", "deregister_frame_info" ], [ "", "ITM_registerTMCloneTable" ], [ "", "optind" ], [ "", "read" ], [ "", "strncpy" ], [ "", "realloc" ], [ "", "ITM_deregisterTMCloneTable" ], [ "", "assert_fail" ], [ "", "strcmp" ], [ "", "stderr" ], [ "", "fputc" ], [ "", "fdt_path_offset" ], [ "", "errno_location" ], [ "", "exit" ], [ "", "libc_start_main" ], [ "", "strlen" ], [ "", "open" ], [ "", "strchr" ], [ "", "fputs" ], [ "", "register_frame_info" ], [ "", "close" ], [ "", "vfprintf" ], [ "", "free" ] ], "sec": [ [ ".note.gnu.property", 792, 48, 1.94, "alloc" ], [ ".note.gnu.build-id", 840, 36, 4.11, "alloc" ], [ ".interp", 876, 25, 4.05, "alloc" ], [ ".gnu.hash", 904, 44, 2.55, "alloc" ], [ ".dynsym", 952, 1056, 0.95, "alloc" ], [ ".dynstr", 2008, 479, 4.53, "alloc" ], [ ".gnu.version", 2488, 88, 1.25, "alloc" ], [ ".gnu.version_r", 2576, 32, 2.05, "alloc" ], [ ".rela.dyn", 2608, 216, 1.25, "alloc" ], [ ".rela.plt", 2824, 768, 1.41, "alloc,info_link" ], [ ".relr.dyn", 3592, 24, 1.52, "alloc" ], [ ".init", 4096, 3, 1.58, "alloc,executable" ], [ ".plt", 4112, 528, 3.83, "alloc,executable" ], [ ".text", 4640, 4878, 6.23, "alloc,executable" ], [ ".fini", 9518, 3, 1.58, "alloc,executable" ], [ ".rodata", 12288, 1205, 5.14, "alloc" ], [ ".eh_frame_hdr", 13496, 196, 4.2, "alloc" ], [ ".eh_frame", 13696, 1036, 4.78, "alloc" ], [ ".init_array", 15184, 8, 1.06, "write,alloc" ], [ ".fini_array", 15192, 8, 1.06, "write,alloc" ], [ ".data.rel.ro", 15200, 256, 0.87, "write,alloc" ], [ ".dynamic", 15456, 560, 1.42, "write,alloc" ], [ ".got", 16016, 352, 1.4, "write,alloc" ], [ ".data", 16384, 8, 0.54, "write,alloc" ], [ ".comment", 16392, 28, 3.99, "merge,strings" ], [ ".shstrtab", 16420, 262, 4.18, "" ] ], "metrics": { "elf": { "bits": 64.0, "entry": 5912.0, "has_got": 1.0, "has_plt": 1.0, "has_note": 1.0, "note_count": 2.0, "nx_enabled": 1.0, "has_dt_relr": 1.0, "dynrel_count": 0.0, "dynsym_count": 44.0, "has_build_id": 1.0, "has_eh_frame": 1.0, "has_gnu_hash": 1.0, "stack_canary": 1.0, "symtab_count": 0.0, "dynrela_count": 9.0, "little_endian": 1.0, "dt_flags_1_raw": 134217729.0, "pltreloc_count": 32.0, "build_id_length": 20.0, "dt_versym_count": 44.0, "executable_stack": 0.0, "fini_array_count": 1.0, "init_array_count": 1.0, "wx_segment_count": 0.0, "comment_entry_count": 1.0, "program_header_count": 13.0, "comment_distinct_count": 1.0, "gnu_stack_section_absent": 0.0, "load_segment_max_file_size": 5425.0, "stripped_but_symtab_present": 0.0, "load_segment_max_memory_size": 5425.0, "section_relocation_group_count": 2.0, "stripped_metadata_section_count": 7.0 }, "file": { "size": 18480.0, "entropy": 4.13, "size_bytes": 18480.0 }, "binary": { "is_pie": 1.0, "has_overlay": 1.0, "is_stripped": 1.0, "code_entropy": 5.99, "data_entropy": 1.28, "overlay_size": 1798.0, "string_count": 112.0, "overlay_ratio": 0.1, "overall_entropy": 4.13, "overlay_entropy": 1.42, "entropy_variance": 2.6, "avg_string_length": 14.88, "max_string_length": 105.0, "peak_region_bytes": 4096.0, "code_to_data_ratio": 0.82, "peak_region_entropy": 6.14, "string_length_stddev": 14.9, "largest_section_ratio": 0.26, "sentence_string_count": 22.0, "sentence_string_ratio": 0.2, "high_entropy_string_count": 0.0 }, "exports": { "count": 2.0 }, "imports": { "count": 41.0 }, "sections": { "count": 28.0, "code_size": 5412.0, "entropy_max": 6.23, "entropy_mean": 2.6, "name_entropy": 4.13, "writable_count": 7.0, "executable_count": 4.0, "nonstandard_count": 6.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 2.0 } } }, "id": 4, "mol": "H₂(FU)Md(He)", "path": "/data/samples/good/foraged/alpine/alpinelinux.org/_/dtc/dtc-1.7.2-r1.apk!!usr/bin/fdtoverlay", "risk": 3, "sha": "b9f6ab771468e3c136ce8d058fd044d0328cd9e5e50aea2516c13ad8ec2dd876", "size": 18480, "traits": [ { "id": "micro-behaviors/fs/file/read::read", "conf": 0.699999988079071, "crit": 2, "desc": "Read file descriptor (read/pread)", "spans": [ [ 2307, 4 ] ] }, { "id": "micro-behaviors/ui/help::options-title-string", "crit": 1, "desc": "Options: label in binary strings", "spans": [ [ 13132, 14 ] ] }, { "id": "micro-behaviors/ui/help::usage-title-string", "crit": 1, "desc": "Usage: label in binary strings", "spans": [ [ 13121, 9 ] ] }, { "id": "micro-behaviors/fs/file/write/direct::write--write", "conf": 0.6600000262260437, "crit": 2, "desc": "Write files (write)", "spans": [ [ 2422, 5 ] ] }, { "id": "micro-behaviors/ui/help::usage-title", "crit": 2, "desc": "Usage: label (title case)", "spans": [ [ 13121, 9 ] ] }, { "id": "micro-behaviors/dylib/library/libc::libc-characteristic-cxa-finalize", "crit": 2, "desc": "libc characteristic cxa finalize", "spans": [ [ 2011, 12 ] ] }, { "id": "micro-behaviors/ui/help::options-title", "crit": 2, "desc": "Options: label", "spans": [ [ 13132, 14 ] ] }, { "id": "metadata/hardening/missing::stripped-binary", "conf": 0.800000011920929, "crit": 3, "desc": "No full symbol table (likely stripped)", "spans": [ [ 0, 25 ] ] }, { "id": "micro-behaviors/dylib/library/libc::libc-internal-functions-b", "conf": 0.699999988079071, "crit": 2, "desc": "libc internal symbols cluster B", "spans": [ [ 2011, 12 ] ] }, { "id": "micro-behaviors/fs/file/binary::file-read-operation", "atk": "T1005", "conf": 0.75, "crit": 1, "desc": "File read operation", "spans": [ [ 2307, 4 ] ] }, { "id": "micro-behaviors/fs/file/write/direct::write", "conf": 0.6600000262260437, "crit": 2, "desc": "Write files", "spans": [ [ 2422, 5 ] ] }, { "id": "micro-behaviors/ui/help::has-help", "conf": 0.8500000238418579, "crit": 3, "desc": "Contains help or usage information", "spans": [ [ 13121, 9 ], [ 13132, 14 ] ] }, { "id": "micro-behaviors/ui/help::usage-label", "conf": 0.75, "crit": 1, "desc": "Command line usage text", "spans": [ [ 13121, 9 ], [ 13132, 14 ] ] }, { "id": "micro-behaviors/fs/file/binary::file-manipulation", "atk": "T1005", "conf": 0.75, "crit": 3, "desc": "File content manipulation (read/write/seek)", "spans": [ [ 2307, 4 ], [ 2422, 5 ] ] }, { "id": "micro-behaviors/dylib/library/abi-graphics::cxx-abi-symbols-a", "conf": 0.800000011920929, "crit": 2, "desc": "C++ ABI symbols cluster A", "spans": [ [ 2011, 12 ] ] } ], "type": "elf" }, { "ctx": [ { "b": "E))420S-r400000000000@$H+0rr91r2tPn00000kMy=:00000fHkWs0000000000kMA+z4feS[8#{]T1][S6", "n": [ { "c": 3, "d": "No full symbol table (likely stripped)", "i": "metadata/hardening/missing::stripped-binary", "o": 0, "z": 25, "cf": 0.800000011920929 } ], "ln": 0 }, { "b": "Es\u003cHjy?Wuiy?bbmB-RvJCSmP*hz^4cz.r:A000030000L000010000600000Fb/MH1v8", "n": [ { "c": 3, "d": "Architecture detection strings", "i": "objectives/discovery/host/software::arch-detection", "o": 889, "z": 6, "cf": 0.5 } ], "ln": 873 }, { "b": "000000096100000003wkv%zA?w[=c\u003ey?Xib0af8OBywV{uT)++uUi.XyYFJ#A=bY8zua3JwmY^)xk8BewPzc\u0026A:-/@uUKy\u0026zV", "n": [ { "c": 3, "d": "Stack protector/canary enabled", "i": "metadata/hardening/build::stack-protector", "o": 2146, "z": 14, "cf": 0.8999999761581421 }, { "c": 3, "d": "Benign network-capable library context", "i": "objectives/supply-chain/trojanized/backdoor::benign-network-library-context", "o": 2131, "z": 12, "cf": 0.8999999761581421 } ], "ln": 2115 }, { "b": "Aa9\u003c4uVfK*B7GB[w[l0\u003cxjVg7A=k]7vThs0w[D9}Bo2]-Bye]%CYWqmvp]NLwoqf\u003ewPR)iz/tX/CXIm1z/x/jzE--*BAhneAcRC5B-.bbvr8u*wNPy\u003ez^@=OuTX1%wPz)1w)]y\u00260crm5Bz\u003e%}uTEw+A=b/5y\u0026r/(BzkVh0chTVwb{^]zG6SgzGGE\u003cB97@hB-WQ}Aclnj0a{g)BAmC0vqG:#v/QB^Byxi50crl)wPz!\u003euUKy(Bo2@+Bz(buuU\u003cT#x8(K/A+PSb0aP?-B7Ct\u0026AaJ[!uUj1\u0026x-Ji@A:@%90af8Hx\u003c$NVB97\u0026hBye([x(i[", "n": [ { "c": 3, "d": "File content manipulation (read/write/seek)", "i": "micro-behaviors/fs/file/binary::file-manipulation", "o": 2497, "z": 4, "cf": 0.75 }, { "c": 2, "d": "Characteristic libc export __assert_fail", "i": "micro-behaviors/dylib/library/libc::libc-characteristic-assert-fail", "o": 2461, "z": 11, "cf": 0.5 }, { "c": 2, "d": "Generic file read/write operations", "i": "micro-behaviors/fs/file/read-write::binary-file-ops", "o": 2583, "z": 4, "cf": 0.800000011920929 }, { "c": 2, "d": "Write single bytes to file", "i": "micro-behaviors/fs/file/write/direct::fputc", "o": 2519, "z": 5, "cf": 0.6600000262260437 }, { "c": 2, "d": "Write files (fwrite)", "i": "micro-behaviors/fs/file/write/direct::write--fwrite", "o": 2570, "z": 6, "cf": 0.6600000262260437 }, { "c": 2, "d": "Terminates process immediately without cleanup", "i": "micro-behaviors/process/terminate/signal::_exit", "o": 2423, "z": 4, "cf": 0.4000000059604645 }, { "c": 1, "d": "Android getprop platform marker", "i": "objectives/privilege-escalation/elevation-control/setuid/syscall::android-getprop-platform-marker", "o": 2380, "z": 7, "cf": 0.8999999761581421 } ], "ln": 2364 }, { "b": "e]$}-f-V37vQ?3cB-RvJCSmP*hz^4cz.r:AoI4Mul@WIFe\u00260zb009620096200962009", "n": [ { "c": 2, "d": "x86_64 architecture string", "i": "micro-behaviors/os/sysinfo/platform/string::arch-x86-64", "o": 2655, "z": 6, "cf": 0.30000001192092896 } ], "ln": 2639 }, { "b": "e\u00260AcwPz\u003caz/dPUc36y[rDzOYwJy}WA%-mIAcb/jzGv\u0026YeN6Jxt)ZNIAccedxK#10twmv=aW3@yrzl6^arR^HarQUbao", "n": [ { "c": 3, "d": "Benign socket shell helper context", "i": "micro-behaviors/process/fd/dup::posix-fd-redirect-shell-benign-context", "o": 13043, "z": 14, "cf": 0.9399999976158142 }, { "c": 3, "d": "Terminal socket exec helper context", "i": "micro-behaviors/process/fd/dup::unix-terminal-socket-exec-benign-context", "o": 13032, "z": 9, "cf": 0.949999988079071 } ], "ln": 13016 }, { "b": "By^7qzGNNvB.LV5eOO.}e[]iBwPz.\u0026e[Y6Ae[!WmxAfU}D2vXGz2=h0D2vXBASv.8zGNNPwPz\u003caz/bLcxkR\u0026AC4CYnx(v(@ASv.jwD", "n": [ { "c": 2, "d": "ELF dynstr section name", "i": "metadata/binary/linking/static::elf-dynstr-section-name", "o": 16495, "z": 7, "cf": 0.8999999761581421 }, { "c": 2, "d": "ELF dynsym section name", "i": "metadata/binary/linking/static::elf-dynsym-section-name", "o": 16487, "z": 7, "cf": 0.8999999761581421 }, { "c": 2, "d": "ELF interpreter section name", "i": "metadata/binary/linking/static::elf-interpreter-section-name", "o": 16469, "z": 7, "cf": 0.8999999761581421 } ], "ln": 16453 }, { "b": "vr?\u00269wmoN*e]\u003eJte]\u003e\u003ege[xlBvqPZ*04}]5Bo0}7vrt]Te[e)y04}=1zeA\u003c4Bn#pv00000", "n": [ { "c": 2, "d": "ELF dynamic section name", "i": "metadata/binary/linking/static::elf-dynamic-section-name", "o": 16648, "z": 8, "cf": 0.8999999761581421 } ], "ln": 16632 } ], "depth": 1, "facts": { "exp": [ [ "init" ], [ "fini" ] ], "imp": [ [ "", "putchar" ], [ "", "printf" ], [ "", "stdout" ], [ "", "strerror" ], [ "", "getopt_long" ], [ "", "puts" ], [ "", "cxa_finalize" ], [ "", "fdt_strerror" ], [ "", "malloc" ], [ "", "optarg" ], [ "", "vsnprintf" ], [ "", "stack_chk_fail" ], [ "", "fdt_next_property_offset" ], [ "", "fdt_get_name" ], [ "", "strtol" ], [ "", "strnlen" ], [ "", "write" ], [ "", "fprintf" ], [ "", "deregister_frame_info" ], [ "", "ITM_registerTMCloneTable" ], [ "", "optind" ], [ "", "read" ], [ "", "strncpy" ], [ "", "fdt_next_tag" ], [ "", "realloc" ], [ "", "fdt_getprop_by_offset" ], [ "", "ITM_deregisterTMCloneTable" ], [ "", "assert_fail" ], [ "", "strcmp" ], [ "", "stderr" ], [ "", "fputc" ], [ "", "fdt_getprop" ], [ "", "fwrite" ], [ "", "fdt_path_offset" ], [ "", "errno_location" ], [ "", "exit" ], [ "", "fdt_first_property_offset" ], [ "", "libc_start_main" ], [ "", "strlen" ], [ "", "open" ], [ "", "strchr" ], [ "", "fputs" ], [ "", "register_frame_info" ], [ "", "close" ], [ "", "vfprintf" ], [ "", "free" ] ], "sec": [ [ ".note.gnu.property", 792, 48, 1.94, "alloc" ], [ ".note.gnu.build-id", 840, 36, 4.19, "alloc" ], [ ".interp", 876, 25, 4.05, "alloc" ], [ ".gnu.hash", 904, 44, 2.55, "alloc" ], [ ".dynsym", 952, 1176, 0.98, "alloc" ], [ ".dynstr", 2128, 550, 4.47, "alloc" ], [ ".gnu.version", 2678, 98, 1.32, "alloc" ], [ ".gnu.version_r", 2776, 32, 2.09, "alloc" ], [ ".rela.dyn", 2808, 216, 1.25, "alloc" ], [ ".rela.plt", 3024, 888, 1.42, "alloc,info_link" ], [ ".relr.dyn", 3912, 24, 1.49, "alloc" ], [ ".init", 4096, 3, 1.58, "alloc,executable" ], [ ".plt", 4112, 608, 3.86, "alloc,executable" ], [ ".text", 4720, 4898, 6.27, "alloc,executable" ], [ ".fini", 9618, 3, 1.58, "alloc,executable" ], [ ".rodata", 12288, 1357, 5.12, "alloc" ], [ ".eh_frame_hdr", 13648, 180, 4.12, "alloc" ], [ ".eh_frame", 13832, 988, 4.8, "alloc" ], [ ".init_array", 15120, 8, 1.06, "write,alloc" ], [ ".fini_array", 15128, 8, 0.54, "write,alloc" ], [ ".data.rel.ro", 15136, 288, 0.9, "write,alloc" ], [ ".dynamic", 15424, 560, 1.45, "write,alloc" ], [ ".got", 15984, 392, 1.45, "write,alloc" ], [ ".data", 16384, 8, 0.54, "write,alloc" ], [ ".comment", 16392, 28, 3.99, "merge,strings" ], [ ".shstrtab", 16420, 262, 4.18, "" ] ], "metrics": { "elf": { "bits": 64.0, "entry": 6228.0, "has_got": 1.0, "has_plt": 1.0, "has_note": 1.0, "note_count": 2.0, "nx_enabled": 1.0, "has_dt_relr": 1.0, "dynrel_count": 0.0, "dynsym_count": 49.0, "has_build_id": 1.0, "has_eh_frame": 1.0, "has_gnu_hash": 1.0, "stack_canary": 1.0, "symtab_count": 0.0, "dynrela_count": 9.0, "little_endian": 1.0, "dt_flags_1_raw": 134217729.0, "pltreloc_count": 37.0, "build_id_length": 20.0, "dt_versym_count": 49.0, "executable_stack": 0.0, "fini_array_count": 1.0, "init_array_count": 1.0, "wx_segment_count": 0.0, "comment_entry_count": 1.0, "program_header_count": 13.0, "comment_distinct_count": 1.0, "gnu_stack_section_absent": 0.0, "load_segment_max_file_size": 5525.0, "stripped_but_symtab_present": 0.0, "load_segment_max_memory_size": 5525.0, "section_relocation_group_count": 2.0, "stripped_metadata_section_count": 7.0 }, "file": { "size": 18480.0, "entropy": 4.24, "size_bytes": 18480.0 }, "binary": { "is_pie": 1.0, "has_overlay": 1.0, "is_stripped": 1.0, "code_entropy": 6.0, "data_entropy": 1.31, "overlay_size": 1798.0, "string_count": 118.0, "overlay_ratio": 0.1, "overall_entropy": 4.24, "overlay_entropy": 1.43, "entropy_variance": 2.65, "avg_string_length": 16.93, "max_string_length": 282.0, "peak_region_bytes": 4096.0, "code_to_data_ratio": 0.81, "peak_region_entropy": 6.16, "string_length_stddev": 26.75, "largest_section_ratio": 0.27, "sentence_string_count": 25.0, "sentence_string_ratio": 0.21, "high_entropy_string_count": 0.0 }, "exports": { "count": 2.0 }, "imports": { "count": 46.0 }, "sections": { "count": 28.0, "code_size": 5512.0, "entropy_max": 6.27, "entropy_mean": 2.59, "name_entropy": 4.13, "writable_count": 7.0, "executable_count": 4.0, "nonstandard_count": 6.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 2.0 } } }, "id": 5, "mol": "H₂(FU)Md(He)", "path": "/data/samples/good/foraged/alpine/alpinelinux.org/_/dtc/dtc-1.7.2-r1.apk!!usr/bin/fdtget", "risk": 3, "sha": "26bf87586c6332f98ee32677fcb5ea20e8736ece75fa4cd248f111dd5d4a9c2a", "size": 18480, "traits": [ { "id": "micro-behaviors/fs/file/read::read", "conf": 0.699999988079071, "crit": 2, "desc": "Read file descriptor (read/pread)", "spans": [ [ 2497, 4 ] ] }, { "id": "micro-behaviors/ui/help::options-title-string", "crit": 1, "desc": "Options: label in binary strings", "spans": [ [ 13043, 14 ] ] }, { "id": "micro-behaviors/ui/help::usage-title-string", "crit": 1, "desc": "Usage: label in binary strings", "spans": [ [ 13032, 9 ] ] }, { "id": "micro-behaviors/fs/file/write/direct::write--write", "conf": 0.6600000262260437, "crit": 2, "desc": "Write files (write)", "spans": [ [ 2571, 5 ] ] }, { "id": "micro-behaviors/ui/help::usage-title", "crit": 2, "desc": "Usage: label (title case)", "spans": [ [ 13032, 9 ] ] }, { "id": "metadata/binary/metrics/threshold::rich-sentence-strings-20pct", "conf": 0.800000011920929, "crit": 1, "desc": "Binary has many sentence-like strings", "spans": [ [ 0, 35 ] ] }, { "id": "micro-behaviors/dylib/library/libc::libc-characteristic-cxa-finalize", "crit": 2, "desc": "libc characteristic cxa finalize", "spans": [ [ 2131, 12 ] ] }, { "id": "micro-behaviors/ui/help::options-title", "crit": 2, "desc": "Options: label", "spans": [ [ 13043, 14 ] ] }, { "id": "micro-behaviors/fs/file/write/direct::write--fwrite", "conf": 0.6600000262260437, "crit": 2, "desc": "Write files (fwrite)", "spans": [ [ 2570, 6 ] ] }, { "id": "metadata/hardening/missing::stripped-binary", "conf": 0.800000011920929, "crit": 3, "desc": "No full symbol table (likely stripped)", "spans": [ [ 0, 25 ] ] }, { "id": "micro-behaviors/dylib/library/libc::libc-internal-functions-b", "conf": 0.699999988079071, "crit": 2, "desc": "libc internal symbols cluster B", "spans": [ [ 2131, 12 ] ] }, { "id": "micro-behaviors/fs/file/binary::file-read-operation", "atk": "T1005", "conf": 0.75, "crit": 1, "desc": "File read operation", "spans": [ [ 2497, 4 ] ] }, { "id": "micro-behaviors/fs/file/write/direct::write", "conf": 0.6600000262260437, "crit": 2, "desc": "Write files", "spans": [ [ 2570, 6 ], [ 2571, 5 ] ] }, { "id": "micro-behaviors/ui/help::has-help", "conf": 0.8500000238418579, "crit": 3, "desc": "Contains help or usage information", "spans": [ [ 13032, 9 ], [ 13043, 14 ] ] }, { "id": "micro-behaviors/ui/help::usage-label", "conf": 0.75, "crit": 1, "desc": "Command line usage text", "spans": [ [ 13032, 9 ], [ 13043, 14 ] ] }, { "id": "micro-behaviors/fs/file/binary::file-manipulation", "atk": "T1005", "conf": 0.75, "crit": 3, "desc": "File content manipulation (read/write/seek)", "spans": [ [ 2497, 4 ], [ 2570, 6 ], [ 2571, 5 ] ] }, { "id": "micro-behaviors/dylib/library/abi-graphics::cxx-abi-symbols-a", "conf": 0.800000011920929, "crit": 2, "desc": "C++ ABI symbols cluster A", "spans": [ [ 2131, 12 ] ] } ], "type": "elf" }, { "ctx": [ { "b": "E))420S-r400000000000@$H+0rr91ukAOw00000kMy=:000005j3o@0000000000kMA+z4feS[8upSP1][S6", "n": [ { "c": 3, "d": "No full symbol table (likely stripped)", "i": "metadata/hardening/missing::stripped-binary", "o": 0, "z": 25, "cf": 0.800000011920929 } ], "ln": 0 }, { "b": "{%dLCy?Wuiy?bbmB-RvJCSmP*hz^4cz.r:A000030000C000010000600000Fb/MH1v8", "n": [ { "c": 3, "d": "Architecture detection strings", "i": "objectives/discovery/host/software::arch-detection", "o": 889, "z": 6, "cf": 0.5 } ], "ln": 873 }, { "b": "b(^]B000010000000000wQ4{h0b(*#x(mCYB98Cuv@MX[uTE\u003e@vpK7Wv}YT+w)]y\u00260c075v}Yp\u003e0chTVy\u00261310bVp:v}Y(.uTEk.B7GxluUi.XyYFJ#A==ko0crm5y?mF:uTEw+A=b/5y\u0026r/(BzkVh0chTVwb{^]zG6SgzGGE\u003cB97@hB-WQ}Aclnj0a{g)BAmC6BAhnnwO}G+vqG:#v/QN(wmY!40afCT", "n": [ { "c": 3, "d": "Stack protector/canary enabled", "i": "metadata/hardening/build::stack-protector", "o": 1935, "z": 14, "cf": 0.8999999761581421 }, { "c": 3, "d": "File content manipulation (read/write/seek)", "i": "micro-behaviors/fs/file/binary::file-manipulation", "o": 2018, "z": 4, "cf": 0.75 }, { "c": 3, "d": "Benign network-capable library context", "i": "objectives/supply-chain/trojanized/backdoor::benign-network-library-context", "o": 1975, "z": 11, "cf": 0.8999999761581421 }, { "c": 2, "d": "Write single bytes to file", "i": "micro-behaviors/fs/file/write/direct::fputc", "o": 2040, "z": 5, "cf": 0.6600000262260437 }, { "c": 2, "d": "Terminates process immediately without cleanup", "i": "micro-behaviors/process/terminate/signal::_exit", "o": 1913, "z": 4, "cf": 0.4000000059604645 } ], "ln": 1897 }, { "b": "Bz(buuU\u003cT#x8(BTz/YE\u0026z/xo90crm5v}Y(.uUj1\u0026x-IHEv%zA?w[=c\u003ey?Xib0crm5v@le+B98ClA=M8s0af8Hx\u003c$NVB97\u0026hBye([x(i]{A+PSb0cR%[A+PAkw=MB-wN$\u003cTx\u003c$N8zfo]oeQflkuP6.[B8JV=0af8zwPzu{x(!xcA:JB0vqPN.x(mK30aep", "n": [ { "c": 2, "d": "C++ standard library markers (libc++, libstdc++)", "i": "micro-behaviors/dylib/library/libc::cxx-stdlib-marker", "o": 2118, "z": 12, "cf": 0.8999999761581421 }, { "c": 2, "d": "Generic file read/write operations", "i": "micro-behaviors/fs/file/read-write::binary-file-ops", "o": 2098, "z": 4, "cf": 0.800000011920929 }, { "c": 2, "d": "Write files (write)", "i": "micro-behaviors/fs/file/write/direct::write--write", "o": 2165, "z": 5, "cf": 0.6600000262260437 }, { "c": 2, "d": "x86_64 architecture string", "i": "micro-behaviors/os/sysinfo/platform/string::arch-x86-64", "o": 2195, "z": 6, "cf": 0.30000001192092896 } ], "ln": 2082 }, { "b": "e\u00260AcwPz\u003caz/dPUc36y[rDzOYwJy}WA%-mIAcb/jzGv\u0026YeN6Jxt)ZNIAccedxK#10twmv=aW3@yrzl6^arR^HarQUbao", "n": [ { "c": 3, "d": "Benign socket shell helper context", "i": "micro-behaviors/process/fd/dup::posix-fd-redirect-shell-benign-context", "o": 13517, "z": 14, "cf": 0.9399999976158142 }, { "c": 3, "d": "Terminal socket exec helper context", "i": "micro-behaviors/process/fd/dup::unix-terminal-socket-exec-benign-context", "o": 13506, "z": 9, "cf": 0.949999988079071 } ], "ln": 13490 }, { "b": "By^7qzGNNvB.LV5eOO.}e[]iBwPz.\u0026e[Y6Ae[!WmxAfU}D2vXGz2=h0D2vXBASv.jwO+^cwo\u00264)e]\u003eJtvj(InBo0}lwO=xtwo\u00264)e=", "n": [ { "c": 2, "d": "ELF dynstr section name", "i": "metadata/binary/linking/static::elf-dynstr-section-name", "o": 16495, "z": 7, "cf": 0.8999999761581421 }, { "c": 2, "d": "ELF dynsym section name", "i": "metadata/binary/linking/static::elf-dynsym-section-name", "o": 16487, "z": 7, "cf": 0.8999999761581421 }, { "c": 2, "d": "ELF interpreter section name", "i": "metadata/binary/linking/static::elf-interpreter-section-name", "o": 16469, "z": 7, "cf": 0.8999999761581421 } ], "ln": 16453 }, { "b": "vr?\u00269wmoN*e]\u003eJte]\u003e\u003ege[xlBvqPZ*04}]5Bo0}7vrt]Te[e)y04}=1zeA\u003c4Bn#pv00000", "n": [ { "c": 2, "d": "ELF dynamic section name", "i": "metadata/binary/linking/static::elf-dynamic-section-name", "o": 16620, "z": 8, "cf": 0.8999999761581421 } ], "ln": 16604 } ], "depth": 1, "facts": { "exp": [ [ "init" ], [ "fini" ] ], "imp": [ [ "", "putchar" ], [ "", "printf" ], [ "", "stdout" ], [ "", "strerror" ], [ "", "getopt_long" ], [ "", "puts" ], [ "", "cxa_finalize" ], [ "", "malloc" ], [ "", "vsnprintf" ], [ "", "stack_chk_fail" ], [ "", "strtol" ], [ "", "strnlen" ], [ "", "write" ], [ "", "fprintf" ], [ "", "deregister_frame_info" ], [ "", "ITM_registerTMCloneTable" ], [ "", "optind" ], [ "", "memchr" ], [ "", "read" ], [ "", "strncpy" ], [ "", "realloc" ], [ "", "ITM_deregisterTMCloneTable" ], [ "", "assert_fail" ], [ "", "strcmp" ], [ "", "stderr" ], [ "", "fputc" ], [ "", "errno_location" ], [ "", "exit" ], [ "", "libc_start_main" ], [ "", "strlen" ], [ "", "open" ], [ "", "strchr" ], [ "", "fputs" ], [ "", "register_frame_info" ], [ "", "close" ], [ "", "vfprintf" ], [ "", "free" ] ], "sec": [ [ ".note.gnu.property", 792, 48, 1.94, "alloc" ], [ ".note.gnu.build-id", 840, 36, 4.14, "alloc" ], [ ".interp", 876, 25, 4.05, "alloc" ], [ ".gnu.hash", 904, 44, 2.55, "alloc" ], [ ".dynsym", 952, 960, 0.88, "alloc" ], [ ".dynstr", 1912, 395, 4.43, "alloc" ], [ ".rela.dyn", 2312, 192, 1.23, "alloc" ], [ ".rela.plt", 2504, 696, 1.4, "alloc,info_link" ], [ ".relr.dyn", 3200, 24, 1.92, "alloc" ], [ ".init", 4096, 3, 1.58, "alloc,executable" ], [ ".plt", 4112, 480, 3.8, "alloc,executable" ], [ ".text", 4592, 5109, 6.25, "alloc,executable" ], [ ".fini", 9701, 3, 1.58, "alloc,executable" ], [ ".rodata", 12288, 1501, 5.38, "alloc" ], [ ".eh_frame_hdr", 13792, 220, 4.25, "alloc" ], [ ".eh_frame", 14016, 1100, 4.73, "alloc" ], [ ".init_array", 15216, 8, 1.06, "write,alloc" ], [ ".fini_array", 15224, 8, 1.06, "write,alloc" ], [ ".data.rel.ro", 15232, 320, 0.76, "write,alloc" ], [ ".dynamic", 15552, 496, 1.3, "write,alloc" ], [ ".got", 16048, 320, 1.37, "write,alloc" ], [ ".data", 16384, 8, 0.54, "write,alloc" ], [ ".comment", 16392, 28, 3.99, "merge,strings" ], [ ".shstrtab", 16420, 234, 4.14, "" ] ], "metrics": { "elf": { "bits": 64.0, "entry": 5982.0, "has_got": 1.0, "has_plt": 1.0, "has_note": 1.0, "note_count": 2.0, "nx_enabled": 1.0, "has_dt_relr": 1.0, "dynrel_count": 0.0, "dynsym_count": 40.0, "has_build_id": 1.0, "has_eh_frame": 1.0, "has_gnu_hash": 1.0, "stack_canary": 1.0, "symtab_count": 0.0, "dynrela_count": 8.0, "little_endian": 1.0, "dt_flags_1_raw": 134217729.0, "pltreloc_count": 29.0, "build_id_length": 20.0, "executable_stack": 0.0, "fini_array_count": 1.0, "init_array_count": 1.0, "wx_segment_count": 0.0, "comment_entry_count": 1.0, "program_header_count": 13.0, "comment_distinct_count": 1.0, "gnu_stack_section_absent": 0.0, "load_segment_max_file_size": 5608.0, "stripped_but_symtab_present": 0.0, "load_segment_max_memory_size": 5608.0, "section_relocation_group_count": 2.0, "stripped_metadata_section_count": 7.0 }, "file": { "size": 18320.0, "entropy": 4.28, "size_bytes": 18320.0 }, "binary": { "is_pie": 1.0, "has_overlay": 1.0, "is_stripped": 1.0, "code_entropy": 6.04, "data_entropy": 1.16, "overlay_size": 1666.0, "string_count": 105.0, "overlay_ratio": 0.09, "overall_entropy": 4.28, "overlay_entropy": 1.39, "entropy_variance": 2.77, "avg_string_length": 14.38, "max_string_length": 70.0, "peak_region_bytes": 4096.0, "code_to_data_ratio": 0.83, "peak_region_entropy": 6.16, "string_length_stddev": 11.32, "largest_section_ratio": 0.28, "sentence_string_count": 24.0, "sentence_string_ratio": 0.23, "high_entropy_string_count": 0.0 }, "exports": { "count": 2.0 }, "imports": { "count": 37.0 }, "sections": { "count": 26.0, "code_size": 5595.0, "entropy_max": 6.25, "entropy_mean": 2.68, "name_entropy": 4.09, "writable_count": 7.0, "executable_count": 4.0, "nonstandard_count": 6.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } } }, "id": 6, "mol": "H₂(FU)Md(He)", "path": "/data/samples/good/foraged/alpine/alpinelinux.org/_/dtc/dtc-1.7.2-r1.apk!!usr/bin/fdtdump", "risk": 3, "sha": "9c6a755f70921ad7028b8b27e2a2d56230bc6eece955e3e92ac792b501041295", "size": 18320, "traits": [ { "id": "micro-behaviors/fs/file/read::read", "conf": 0.699999988079071, "crit": 2, "desc": "Read file descriptor (read/pread)", "spans": [ [ 2018, 4 ] ] }, { "id": "micro-behaviors/ui/help::options-title-string", "crit": 1, "desc": "Options: label in binary strings", "spans": [ [ 13517, 14 ] ] }, { "id": "micro-behaviors/ui/help::usage-title-string", "crit": 1, "desc": "Usage: label in binary strings", "spans": [ [ 13506, 9 ] ] }, { "id": "micro-behaviors/fs/file/write/direct::write--write", "conf": 0.6600000262260437, "crit": 2, "desc": "Write files (write)", "spans": [ [ 2165, 5 ] ] }, { "id": "micro-behaviors/ui/help::usage-title", "crit": 2, "desc": "Usage: label (title case)", "spans": [ [ 13506, 9 ] ] }, { "id": "metadata/binary/metrics/threshold::rich-sentence-strings-20pct", "conf": 0.800000011920929, "crit": 1, "desc": "Binary has many sentence-like strings", "spans": [ [ 0, 35 ] ] }, { "id": "micro-behaviors/dylib/library/libc::libc-characteristic-cxa-finalize", "crit": 2, "desc": "libc characteristic cxa finalize", "spans": [ [ 2118, 12 ] ] }, { "id": "micro-behaviors/ui/help::options-title", "crit": 2, "desc": "Options: label", "spans": [ [ 13517, 14 ] ] }, { "id": "metadata/hardening/missing::stripped-binary", "conf": 0.800000011920929, "crit": 3, "desc": "No full symbol table (likely stripped)", "spans": [ [ 0, 25 ] ] }, { "id": "micro-behaviors/dylib/library/libc::libc-internal-functions-b", "conf": 0.699999988079071, "crit": 2, "desc": "libc internal symbols cluster B", "spans": [ [ 2118, 12 ] ] }, { "id": "micro-behaviors/fs/file/binary::file-read-operation", "atk": "T1005", "conf": 0.75, "crit": 1, "desc": "File read operation", "spans": [ [ 2018, 4 ] ] }, { "id": "micro-behaviors/fs/file/write/direct::write", "conf": 0.6600000262260437, "crit": 2, "desc": "Write files", "spans": [ [ 2165, 5 ] ] }, { "id": "micro-behaviors/ui/help::has-help", "conf": 0.8500000238418579, "crit": 3, "desc": "Contains help or usage information", "spans": [ [ 13506, 9 ], [ 13517, 14 ] ] }, { "id": "micro-behaviors/ui/help::usage-label", "conf": 0.75, "crit": 1, "desc": "Command line usage text", "spans": [ [ 13506, 9 ], [ 13517, 14 ] ] }, { "id": "micro-behaviors/fs/file/binary::file-manipulation", "atk": "T1005", "conf": 0.75, "crit": 3, "desc": "File content manipulation (read/write/seek)", "spans": [ [ 2018, 4 ], [ 2165, 5 ] ] }, { "id": "micro-behaviors/dylib/library/abi-graphics::cxx-abi-symbols-a", "conf": 0.800000011920929, "crit": 2, "desc": "C++ ABI symbols cluster A", "spans": [ [ 2118, 12 ] ] } ], "type": "elf" }, { "ctx": [ { "b": "boXf.vRGZkvQTs\u003e3l{V(p^!zqoLF0FzGxwvnN#yIBzku3wPx*Om]h(hga\u003emjz/NBCvru733jn12ra]#!aAI4kx(FepB-RbnaARpdayX=2xDPz=e?O+9az2!twO#N6z/dfmboPM\u0026aBd)FaA}miBrCWzay/7[zF9J6BzbxfaARJACw?IqaA}KwxDQ.axjU%(A+P2afjFTkflp!Taz\u003eL5wGV5pA+bO5aBd)FazbtjaARp9Bs)[c3pE\u0026Xj.eUA3jp\u0026)B-H#6uTW?.uVQdaBrz$XaBsCrarR^{r6qAJf^l@EarR!vw/$q2eO2$FbT+PQayd5KBzbl63jfo[pF%[Mr6s\u0026m3lQDlaz2w6w/$q2eD", "ln": 0, "col": 1, "line": 1 }, { "b": "DlsySnK=GNo*I-5ayd5KBzbl63jgoNxM21qrC(?*v@D0$x)Ku3azbLjzddJew]zYjbT+PQau?bc3jgo*x(\u003eEM3lQDlazbr{3lQDlas6uOlM^%Las6JFpF%[Mr3i+*ay]Onat4OMat4gFePS3^zY*ROa%YMQa{@-93tB8{toCgoar-(\u003cg9x\u003c:aARpdzvdHearUl9xM21qrDzOYwJy@AByY8$w/%iDwP?=$wGV8nwO14Fjy\u00262Dx\u003e7Y%BAg@7j%zakcnC]JarR!rCXImxf:.Jb3jprTw[AeqBS-^{B8Mhwv}x1QzE^9}z/P}xa%X(!diH-3B8Mhwv}x1QzE^9}z/P}xa%X]/dgc", "ln": 402, "col": 11, "line": 26 } ], "depth": 1, "facts": { "imp": [ [ "", "echo" ], [ "", "exit" ], [ "", "$DTC" ], [ "", "echo" ], [ "", "exit" ], [ "", "diff" ], [ "", "source_and_sort" ], [ "", "source_and_sort" ] ], "tgt": [ "$DTC", "diff", "echo", "exit", "source_and_sort" ], "funcs": [ [ "source_and_sort", 202 ] ], "metrics": { "ast": { "op.ne": 1, "max_depth": 9, "call_count": 8, "node_count": 200, "op_density.ne": 0.01 }, "file": { "size": 680, "entropy": 5.09 }, "text": { "lines": 39, "top_char": 101, "tab_count": 15, "max_ws_run": 1, "digit_ratio": 0.03, "space_count": 125, "char_entropy": 5.09, "mixed_indent": 1, "unique_chars": 68, "top_char_null": 0, "string_density": 0.26, "top_char_ratio": 0.06, "avg_line_length": 16.44, "max_line_length": 70, "empty_line_ratio": 0.21, "last_line_length": 55, "whitespace_ratio": 0.26, "identifier_density": 1.21, "line_length_stddev": 18.26, "normalized_string_count": 1.6, "normalized_unique_identifiers": 4.54 }, "binds": { "count": 5 }, "calls": { "dynamic_target_count": 1 }, "binary": { "peak_region_bytes": 680, "peak_region_entropy": 5.09 }, "source": { "function_count": 1 }, "strings": { "bytes": 94, "count": 10, "avg_length": 9.4, "max_length": 41, "avg_entropy": 2, "entropy_stddev": 1.07 }, "comments": { "chars": 193, "count": 6, "lines": 6, "to_code_ratio": 0.18 }, "functions": { "count": 1, "density": 2.56, "avg_params": 4, "code_ratio": 0.56, "max_params": 4, "avg_name_length": 15, "avg_length_lines": 22, "max_length_lines": 22, "min_length_lines": 22, "avg_param_name_length": 59.5 }, "identifiers": { "count": 47, "unique": 24, "avg_length": 3.42, "max_length": 15, "min_length": 1, "avg_entropy": 1.4, "reuse_ratio": 0.51, "length_stddev": 2.8, "has_digit_ratio": 0.08, "single_char_count": 3, "single_char_ratio": 0.13, "all_lowercase_ratio": 0.33, "all_uppercase_ratio": 0.13 } } }, "id": 7, "mol": "H₂(Po₂U)Md(Pa)", "path": "/data/samples/good/foraged/alpine/alpinelinux.org/_/dtc/dtc-1.7.2-r1.apk!!usr/bin/dtdiff", "pid": 0, "risk": 3, "sha": "5eb3282ed9b946e3fcfdbb7bdbb272da198960575af1ca2e216db23db72499f2", "size": 680, "traits": [ { "id": "metadata/lang/natural::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"", "spans": [ [ 77, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-3", "conf": 0.8, "crit": 1, "desc": "English function-word token \"that\"", "spans": [ [ 185, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "spans": [ [ 450, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-6", "conf": 0.8, "crit": 1, "desc": "English function-word token \"with\"", "spans": [ [ 141, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-7", "conf": 0.8, "crit": 1, "desc": "English function-word token \"this\"", "spans": [ [ 60, 0 ] ] }, { "id": "metadata/package/license::spdx-identifier", "conf": 0.9, "crit": 3, "desc": "SPDX license identifier", "spans": [ [ 15, 23 ] ] }, { "id": "micro-behaviors/ui/help::usage-colon-text", "conf": 0.92, "crit": 3, "desc": "Usage: help text marker", "spans": [ [ 562, 7 ] ] }, { "id": "micro-behaviors/process/create/local-exec::shell-variable-exec-with-args", "atk": "T1059.004", "conf": 0.9, "crit": 3, "desc": "Shell runs a variable command with args", "spans": [ [ 478, 13 ] ] }, { "id": "micro-behaviors/process/create/shell/spawn::sh-dynamic-command-target", "conf": 0.95, "crit": 3, "desc": "Shell command variable at a command boundary", "spans": [ [ 483, 4 ] ] } ], "type": "shell" }, { "id": 8, "sha": "148d3710315e4a9857c772b3343a3807a753fc0b1110ea2c809ad5178bc5dc90", "path": "/data/samples/good/foraged/alpine/alpinelinux.org/_/dtc/dtc-1.7.2-r1.apk!!.PKGINFO", "risk": 1, "size": 823, "type": "text", "depth": 1 } ], "omitted_files": 1, "rev": "af11a", "v": "8" } }