{ "ml": { "v": "7", "eng": "2.2.0-beta.1", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.000013430913, "rte": "az", "prob": 0.000013430913 } ], "prob": 0.000013430913, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.00001343091298622312, "type": "apk_alpine" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.000010619561180646997, "type": "elf" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.000010887782082136255, "type": "elf" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.00001055002212524414, "type": "elf" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.000010172526344831567, "type": "elf" }, { "id": 5, "lvl": -1, "conf": 0, "prob": 0.000010619561180646997, "type": "elf" }, { "id": 6, "lvl": -1, "conf": 0, "prob": 0.000013142824172973633, "type": "text" } ], "version": "v18.18", "analyzed_at": "2026-06-25T20:48:38Z" }, "path": "dovecot-lua-2.4.3-r3.apk", "raw": { "files": [ { "id": 0, "ctx": [ { "b": "abZy8000000T3{24[J!\u003enkh=HeH]u63?!Yp^*DIa!jX1m:JNrco?u{f=2H?Deg@xa3GU*X", "n": [ { "c": 2, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "o": 0, "z": 1, "cf": 1.0 } ], "ln": 0 } ], "mol": "Md(He)", "sha": "3d252199b8cb6d196c159c1443d56c7a86c83f6793d234ca844c656692c716a7", "path": "dovecot-lua-2.4.3-r3.apk", "risk": 1, "size": 60292, "type": "apk_alpine", "facts": { "metrics": { "file": { "size": 60292.0, "entropy": 7.98, "size_bytes": 60292.0 }, "parse": { "error_count": 1.0 }, "binary": { "overall_entropy": 7.98, "peak_region_bytes": 59268.0, "peak_region_entropy": 7.81 } } }, "traits": [ { "id": "metadata/package/files/system-package::alpine-pkginfo-package-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package name field", "from": [ { "file": 6 } ] }, { "id": "micro-behaviors/dylib/library/libc::libc-characteristic-cxa-finalize", "crit": 2, "desc": "libc characteristic cxa finalize", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/dylib/library/family::cxx-abi-symbols", "conf": 0.800000011920929, "crit": 2, "desc": "C++ ABI symbols", "from": [ { "file": 1 }, { "file": 2 }, { "file": 3 }, { "file": 4 }, { "file": 5 } ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-origin-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package origin field", "from": [ { "file": 6 } ] }, { "id": "micro-behaviors/dylib/library/libc::libc-internal-functions-b", "conf": 0.699999988079071, "crit": 2, "desc": "libc internal symbols cluster B", "from": [ { "file": 1 }, { "file": 2 }, { "file": 3 }, { "file": 4 }, { "file": 5 } ] }, { "id": "metadata/hardening/missing::stripped-binary", "conf": 0.800000011920929, "crit": 3, "desc": "No full symbol table (likely stripped)", "from": [ { "file": 1 } ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-basename", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package info file" }, { "id": "metadata/package/files/system-package::alpine-pkginfo-version-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package version field", "from": [ { "file": 6 } ] }, { "id": "micro-behaviors/dylib/library/abi-graphics::cxx-abi-symbols-a", "conf": 0.800000011920929, "crit": 2, "desc": "C++ ABI symbols cluster A", "from": [ { "file": 1 }, { "file": 2 }, { "file": 3 }, { "file": 4 }, { "file": 5 } ] } ] }, { "ctx": [ { "b": "E))420S-r400000000000@$H+0rr910000000000kMy=:00000:AmE.0000000000kMA+z3JJA(7626H0rr911onA4000000000", "n": [ { "c": 3, "d": "No full symbol table (likely stripped)", "i": "metadata/hardening/missing::stripped-binary", "o": 0, "z": 25, "cf": 0.800000011920929 } ], "ln": 0 }, { "b": "A-t+2y\u0026si5raflLwDl7Av%zA?w[=c\u003ey?Xib0af8zwPzu{x(!xcA:JB0vqPN.x(mK30af8NwOkZ#", "n": [ { "c": 2, "d": "Benign dual-mode socket exec context", "i": "objectives/command-and-control/reverse-shell/dup::unix-dual-mode-socket-exec-benign-context", "o": 3319, "z": 12, "cf": 0.949999988079071 } ], "ln": 3303 }, { "b": "vp9$@B7/xhBAh8kx8(pCB97\u00262yHpN+yHpWZx(0==BZW%Jv}YB-yIvWdwOkN{0bVdUy*R6*zdN^cvpG", "n": [ { "c": 3, "d": "Stack protector/canary enabled", "i": "metadata/hardening/build::stack-protector", "o": 3899, "z": 14, "cf": 0.8999999761581421 } ], "ln": 3883 }, { "b": "e]$}-fAt{6vQ?3cB-RvJCSmP*hz^4cz.r:Ay?Wu?z*2Y4z/^NLBz(hdxjSVhBZV[zz.q", "n": [ { "c": 3, "d": "Architecture detection strings", "i": "objectives/discovery/host/software::arch-detection", "o": 4973, "z": 6, "cf": 0.5 } ], "ln": 4957 }, { "b": "zddc{eP(bCAXh9Ivj(4JgCH(\u0026oL4TFwN({9uVo}5c[coGvqG-WlT:\u003eIz/^amwPP3", "n": [ { "c": 1, "d": "memfd_create Linux syscall number (319)", "i": "objectives/evasion/fileless/memory::memfd_create-syscall-number--319", "o": 21070, "z": 3, "cf": 0.800000011920929 } ], "ln": 21054 }, { "b": "B7F^2v}U\u003cMB9RUkx(mL-vpTj?zua-?B8#5lzEmA}B98tvwN\u003e^:vrbZ^CYm8ewb{ETBn", "n": [ { "c": 2, "d": "admin keyword", "i": "objectives/discovery/account/keywords::admin-keyword", "o": 21232, "z": 5, "cf": 0.20000000298023224 } ], "ln": 21216 }, { "b": "y?bbiwb[k{zGNNBvrl8Ze[xlBB9RQ5e[xlBB98B5e]\u003eJtvj(8ozu8qfwO=xtwo\u00264)e[]iqBo0}nwQ5p", "n": [ { "c": 2, "d": "ELF dynstr section name", "i": "metadata/binary/linking/static::elf-dynstr-section-name", "o": 30015, "z": 7, "cf": 0.8999999761581421 }, { "c": 2, "d": "ELF dynsym section name", "i": "metadata/binary/linking/static::elf-dynsym-section-name", "o": 30007, "z": 7, "cf": 0.8999999761581421 } ], "ln": 29991 }, { "b": "A::j[e[O*nx\u003cUp?A::j[e[xlBvqPZ*04}]5Bo0}7vrt]Te[e)y04}=1zeA\u003c4Bn#pv00000", "n": [ { "c": 2, "d": "ELF dynamic section name", "i": "metadata/binary/linking/static::elf-dynamic-section-name", "o": 30117, "z": 8, "cf": 0.8999999761581421 } ], "ln": 30101 } ], "depth": 1, "facts": { "exp": [ [ "fini" ], [ "lua_storage_mailbox_attribute_set" ], [ "lua_storage_mail_user_register" ], [ "lua_storage_mail_register" ], [ "lua_storage_mailbox_register" ], [ "lua_storage_mailbox_attribute_list" ], [ "dlua_push_mailbox" ], [ "init" ], [ "lua_storage_mailbox_attribute_get" ], [ "lua_storage_cmp" ], [ "dlua_push_mail_user" ], [ "dlua_push_mail" ], [ "dlua_register_mail_storage" ] ], "imp": [ [ "", "t_push" ], [ "", "mailbox_get_status" ], [ "", "mail_user_get_home" ], [ "", "mail_namespace_find_inbox" ], [ "", "lua_setmetatable" ], [ "", "lua_pushvalue" ], [ "", "deregister_frame_info" ], [ "", "mailbox_sync" ], [ "", "t_strdup_printf" ], [ "", "lua_createtable" ], [ "", "strcmp" ], [ "", "mailbox_attribute_iter_next" ], [ "", "mailbox_alloc" ], [ "", "lua_touserdata" ], [ "", "mailbox_get_vname" ], [ "", "lua_pushcclosure" ], [ "", "memmove" ], [ "", "var_expand" ], [ "", "strncmp" ], [ "", "mailbox_get_name" ], [ "", "luaL_checkstack" ], [ "", "mailbox_transaction_begin" ], [ "", "i_panic" ], [ "", "ITM_deregisterTMCloneTable" ], [ "", "i_stream_get_error" ], [ "", "lua_gettop" ], [ "", "luaL_setmetatable" ], [ "", "mailbox_transaction_commit" ], [ "", "lua_typename" ], [ "", "buffer_append" ], [ "", "strstr" ], [ "", "mailbox_equals" ], [ "", "mailbox_get_namespace" ], [ "", "lua_newuserdata" ], [ "", "lua_pushlightuserdata" ], [ "", "mail_user_ref" ], [ "", "lua_rawseti" ], [ "", "lua_pushboolean" ], [ "", "mailbox_open" ], [ "", "luaL_checklstring" ], [ "", "mailbox_free" ], [ "", "mail_namespace_find" ], [ "", "lua_settop" ], [ "", "mail_user_unref" ], [ "", "mailbox_transaction_rollback" ], [ "", "luaL_setfuncs" ], [ "", "lua_rawget" ], [ "", "cxa_finalize" ], [ "", "register_frame_info" ], [ "", "mailbox_attribute_iter_init" ], [ "", "luaL_checkinteger" ], [ "", "mailbox_attribute_get_stream" ], [ "", "t_pop" ], [ "", "ITM_registerTMCloneTable" ], [ "", "dlua_set_members" ], [ "", "lua_pushstring" ], [ "", "i_stream_skip" ], [ "", "t_str_new" ], [ "", "lua_type" ], [ "", "mailbox_attribute_set" ], [ "", "lua_setfield" ], [ "", "mailbox_get_last_error" ], [ "", "luaL_newmetatable" ], [ "", "lua_rawset" ], [ "", "mailbox_attribute_iter_deinit" ], [ "", "mailbox_close" ], [ "", "lua_pushlstring" ], [ "", "mail_user_var_expand_params" ], [ "", "lua_tolstring" ], [ "", "pool_datastack_create" ], [ "", "i_stream_unref" ], [ "", "i_stream_read_data" ], [ "", "lua_pushnumber" ], [ "", "buffer_append_space_unsafe" ], [ "", "dlua_get_dovecot" ], [ "", "dluaL_error" ], [ "", "buffer_create_dynamic_max" ], [ "", "strlen" ], [ "", "i_stream_create_from_data" ], [ "", "stack_chk_fail" ], [ "", "lua_pushnil" ], [ "", "t_strdup_noconst" ] ], "sec": [ [ ".note.gnu.property", 680, 48, 1.94, "alloc" ], [ ".note.gnu.build-id", 728, 36, 4.25, "alloc" ], [ ".gnu.hash", 768, 180, 3.47, "alloc" ], [ ".dynsym", 952, 2304, 1.3, "alloc" ], [ ".dynstr", 3256, 1774, 4.39, "alloc" ], [ ".rela.dyn", 5032, 2160, 1.5, "alloc" ], [ ".relr.dyn", 7192, 48, 2.84, "alloc" ], [ ".init", 8192, 3, 1.58, "alloc,executable" ], [ ".text", 8208, 10135, 5.7, "alloc,executable" ], [ ".fini", 18343, 3, 1.58, "alloc,executable" ], [ ".rodata", 20480, 2402, 5.4, "alloc" ], [ ".eh_frame_hdr", 22884, 404, 4.65, "alloc" ], [ ".eh_frame", 23288, 2168, 4.79, "alloc" ], [ ".init_array", 27432, 8, 1.06, "write,alloc" ], [ ".fini_array", 27440, 8, 1.06, "write,alloc" ], [ ".dynamic", 27448, 480, 1.31, "write,alloc" ], [ ".got", 27928, 744, 0.03, "write,alloc" ], [ ".data", 28672, 1248, 1.71, "write,alloc" ], [ ".comment", 29920, 28, 3.99, "merge,strings" ], [ ".shstrtab", 29948, 203, 4.17, "" ] ], "metrics": { "elf": { "bits": 64.0, "entry": 0.0, "has_got": 1.0, "has_plt": 0.0, "has_note": 1.0, "note_count": 2.0, "nx_enabled": 1.0, "has_dt_relr": 1.0, "has_runpath": 1.0, "dynrel_count": 0.0, "dynsym_count": 96.0, "has_build_id": 1.0, "has_eh_frame": 1.0, "has_gnu_hash": 1.0, "stack_canary": 1.0, "symtab_count": 0.0, "dynrela_count": 90.0, "little_endian": 1.0, "dt_flags_1_raw": 1.0, "pltreloc_count": 0.0, "build_id_length": 20.0, "executable_stack": 0.0, "fini_array_count": 1.0, "init_array_count": 1.0, "wx_segment_count": 0.0, "comment_entry_count": 1.0, "program_header_count": 11.0, "comment_distinct_count": 1.0, "gnu_stack_section_absent": 0.0, "load_segment_max_file_size": 10154.0, "stripped_but_symtab_present": 0.0, "load_segment_max_memory_size": 10154.0, "section_relocation_group_count": 1.0, "stripped_metadata_section_count": 7.0 }, "file": { "size": 31560.0, "entropy": 4.39, "size_bytes": 31560.0 }, "binary": { "is_pie": 0.0, "has_overlay": 1.0, "is_stripped": 1.0, "code_entropy": 5.7, "data_entropy": 1.12, "overlay_size": 1409.0, "string_count": 231.0, "overlay_ratio": 0.04, "overall_entropy": 4.39, "overlay_entropy": 1.37, "entropy_variance": 2.78, "avg_string_length": 17.29, "max_string_length": 53.0, "peak_region_bytes": 13312.0, "code_to_data_ratio": 0.8, "peak_region_entropy": 5.52, "string_length_stddev": 9.1, "largest_section_ratio": 0.32, "sentence_string_count": 23.0, "sentence_string_ratio": 0.1, "high_entropy_string_count": 0.0 }, "exports": { "count": 13.0 }, "imports": { "count": 82.0 }, "sections": { "count": 22.0, "code_size": 10141.0, "entropy_max": 5.7, "entropy_mean": 2.84, "name_entropy": 4.12, "writable_count": 6.0, "executable_count": 3.0, "nonstandard_count": 5.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 3.0 } } }, "id": 1, "mol": "Md(He)", "path": "dovecot-lua-2.4.3-r3.apk!!usr/lib/dovecot/libdovecot-storage-lua.so.0.0.0", "risk": 1, "sha": "79ffe07552cce006e379c6ecc22c4a77c5f8f79dcd55ecb482b5778445db448b", "size": 31560, "traits": [ { "id": "micro-behaviors/dylib/library/libc::libc-characteristic-cxa-finalize", "crit": 2, "desc": "libc characteristic cxa finalize", "spans": [ [ 3319, 12 ] ] }, { "id": "metadata/hardening/missing::stripped-binary", "conf": 0.800000011920929, "crit": 3, "desc": "No full symbol table (likely stripped)", "spans": [ [ 0, 25 ] ] }, { "id": "micro-behaviors/dylib/library/libc::libc-internal-functions-b", "conf": 0.699999988079071, "crit": 2, "desc": "libc internal symbols cluster B", "spans": [ [ 3319, 12 ] ] }, { "id": "micro-behaviors/dylib/library/abi-graphics::cxx-abi-symbols-a", "conf": 0.800000011920929, "crit": 2, "desc": "C++ ABI symbols cluster A", "spans": [ [ 3319, 12 ] ] }, { "id": "micro-behaviors/dylib/library/family::cxx-abi-symbols", "conf": 0.800000011920929, "crit": 2, "desc": "C++ ABI symbols", "spans": [ [ 3319, 12 ] ] } ], "type": "elf" }, { "ctx": [ { "b": "E))420S-r400000000000@$H+0rr910000000000kMy=:00000svAk\u003c0000000000kMA+z3JJA(7xtiJ0rr91", "n": [ { "c": 3, "d": "No full symbol table (likely stripped)", "i": "metadata/hardening/missing::stripped-binary", "o": 0, "z": 25, "cf": 0.800000011920929 } ], "ln": 0 }, { "b": "A-t+2y\u0026si5raflLwDl7Av%zA?w[=c\u003ey?Xib0af8zwPzu{x(!xcA:JB0vqPN.x(mK30af8NwOkZ#", "n": [ { "c": 2, "d": "Benign dual-mode socket exec context", "i": "objectives/command-and-control/reverse-shell/dup::unix-dual-mode-socket-exec-benign-context", "o": 9087, "z": 12, "cf": 0.949999988079071 } ], "ln": 9071 }, { "b": "ASxS^BZW%JwPz*fASxDNB97\u00262yHpN+yHpWZx(0=\u003euVQsfwoz\u0026#Ab]VgBy\u003eI(z/oD0vqG:#v}G:)wNt", "n": [ { "c": 3, "d": "Stack protector/canary enabled", "i": "metadata/hardening/build::stack-protector", "o": 9220, "z": 14, "cf": 0.8999999761581421 } ], "ln": 9204 }, { "b": "vru5Xy\u0026%e[vruD%zFrOXy\u0026%eWuVf){zFT2@A@Y={wO#P%v@=c?By+C-C4CMkuTWFQuVQsf0a*s+zGGk}vru6[z/Qbgy\u0026%d^wP?T5ByeD!wm5?PBy/96A^mT}y\u0026%e[x(mTbuVY$4wNPaRBywS{wDlmSBZXS#v@=p5ByeT2z/5\u003c5Byxo50bM^^uVpdexMFoox(mL-y\u0026%e[xjVgbvpB4:0bM^^uVZjeB7Gx5vrt]Ty\u0026%e[B7GDnz/tX)BZXT0z!%GpA+PA70aY[*vp9$-vqG-Wy\u0026%e[xjVgbz/tX)BZXS\u0026wPRN3", "n": [ { "c": 3, "d": "Embedded Lua C API cluster", "i": "micro-behaviors/process/interpreter/lua::lua-c-api-cluster", "o": 9307, "z": 13, "cf": 0.9399999976158142 }, { "c": 2, "d": "event_add function", "i": "micro-behaviors/os/event/library/libevent::event-add", "o": 9334, "z": 13, "cf": 0.4000000059604645 }, { "c": 1, "d": "Regex component marker", "i": "micro-behaviors/process/interpreter/lua::lua-c-api-cluster--rx-12", "o": 9447, "z": 12, "cf": 0.9399999976158142 }, { "c": 1, "d": "Regex component marker", "i": "micro-behaviors/process/interpreter/lua::lua-c-api-cluster--rx-8", "o": 9432, "z": 14, "cf": 0.9399999976158142 } ], "ln": 9291 }, { "b": "B7/x7xj#yfB7Gx5vrt]Ty\u0026%e[B7GDnvpB4:0aY[*vpa7!BAzkmxj2Q^A=U/juUKy\u0026zVB\u0026\u0026BAzkm", "n": [ { "c": 1, "d": "Regex component marker", "i": "micro-behaviors/process/interpreter/lua::lua-c-api-cluster--rx-10", "o": 9709, "z": 12, "cf": 0.9399999976158142 } ], "ln": 9693 }, { "b": "Bo2=:zEENhuVZi[xK#z*y\u0026%eWuU\u003cT?woh\u003ckx(mL-wnDx%uVPZ$x(Ff3v@=c?By!/\u003ex(4tXvpJ!UB8}s*uUam#zF@(#z!0i$x(v\u003e?wNP7UwPIi\u0026A=M8suUo", "n": [ { "c": 2, "d": "Check if file exists", "i": "micro-behaviors/fs/file/stat::stat-exists", "o": 9963, "z": 6, "cf": 0.6600000262260437 }, { "c": 1, "d": "Regex component marker", "i": "micro-behaviors/process/interpreter/lua::lua-c-api-cluster--rx-10", "o": 9923, "z": 15, "cf": 0.9399999976158142 } ], "ln": 9907 }, { "b": "B98ClvqPv:wPRo%vqPMQy\u0026%e[y\u0026r-)0aY[*vpa7!Bye(@zdm6%A@Z30vp9$@B7/Dlzdm6%", "n": [ { "c": 1, "d": "Regex component marker", "i": "micro-behaviors/process/interpreter/lua::lua-c-api-cluster--rx-5", "o": 10105, "z": 8, "cf": 0.9399999976158142 } ], "ln": 10089 }, { "b": "z#:A+BZXS$wOkZ#By/E)y\u0026%e[Aclknv}fs[B9hIm0bM^^uVP!2xkzG}vqC{Oy\u0026%e[AclknuV{45BAh8kx8)3XB98CkB-pYhAb\u003e", "n": [ { "c": 1, "d": "Regex component marker", "i": "micro-behaviors/process/interpreter/lua::lua-c-api-cluster--rx-10", "o": 10306, "z": 16, "cf": 0.9399999976158142 }, { "c": 1, "d": "Regex component marker", "i": "micro-behaviors/process/interpreter/lua::lua-c-api-cluster--rx-11", "o": 10323, "z": 13, "cf": 0.9399999976158142 } ], "ln": 10290 }, { "b": "Bo2(}wO#P%x(mA/x(n1)wP?T5ByeD!wm6B)zdN)0yYF3\u0026wO#P%vpS[Qx(n1)wP?T5Byf92Bye]]zdJYUC4CMkuV*mcwPRo\u003ez/Ps", "n": [ { "c": 2, "d": "event_add function", "i": "micro-behaviors/os/event/library/libevent::event-add", "o": 10853, "z": 17, "cf": 0.4000000059604645 } ], "ln": 10837 }, { "b": "e]$}-fAt{6vQ?3cB-RvJCSmP*hz^4cz.r:Ay?Wu?z*2Y4z/^NEBZV[zz.rZzflItRfkH", "n": [ { "c": 3, "d": "Architecture detection strings", "i": "objectives/discovery/host/software::arch-detection", "o": 14513, "z": 6, "cf": 0.5 } ], "ln": 14497 }, { "b": "cPSv@A@Zr5vpJ\u003eTvpK6My\u0026%e[Aarr)y:ZPJefDlHefDlHdiJkhx(4u\u003eiV].\u002604f7lcM)bAao", "n": [ { "c": 1, "d": "Regex component marker", "i": "micro-behaviors/process/interpreter/lua::lua-c-api-cluster--rx-3", "o": 61688, "z": 9, "cf": 0.9399999976158142 } ], "ln": 61672 }, { "b": "wn=T5v@DC?uTEI+wmY#=vQTs?hz+zBzEWP}wDlmLv@C)?0bk!JwNY^{0bk!OzF0!!x\u003cQ", "n": [ { "c": 2, "d": "base64 encoding keyword", "i": "micro-behaviors/data/encoded::base64-token", "o": 62802, "z": 6, "cf": 0.699999988079071 } ], "ln": 62786 }, { "b": "v@b\u003c\u003czGC\u003eRwPI*ezGxwiAaa3dz^^f0A+eV\u0026az2Olz/N(Yc365Omm70AiV}r?qb{4-r5#c%mmxP!o\u00261UQavFH{k(:tKqCQgKaw$T9ryG?=ao", "n": [ { "c": 3, "d": "I/O multiplexing on sockets", "i": "micro-behaviors/communications/socket/multiplex::multiplex", "o": 63476, "z": 7, "cf": 0.6600000262260437 }, { "c": 1, "d": "payload keyword", "i": "objectives/command-and-control/dropper/keywords::payload", "o": 63446, "z": 7, "cf": 0.6000000238418579 } ], "ln": 63430 }, { "b": "rzl6^B98CBv@@\u00267y\u0026%e[xMOunuVG.0AbPSnwDkj?q#?5YyYE%NzF\u003cxmay/C6vru66A+flkwPI@Oao", "n": [ { "c": 2, "d": "HTTP response reference", "i": "micro-behaviors/communications/http/request/client::http-response", "o": 63592, "z": 13, "cf": 0.5 } ], "ln": 63576 }, { "b": "y?bbiwb[k{zGNNBvrl8Ze[xlBB9RQ5e[xlBB98B5e]\u003eJtvj(8ozu8qfwO=xtwo\u00264)e[]iqBo0}nwQ5p", "n": [ { "c": 2, "d": "ELF dynstr section name", "i": "metadata/binary/linking/static::elf-dynstr-section-name", "o": 83135, "z": 7, "cf": 0.8999999761581421 }, { "c": 2, "d": "ELF dynsym section name", "i": "metadata/binary/linking/static::elf-dynsym-section-name", "o": 83127, "z": 7, "cf": 0.8999999761581421 } ], "ln": 83111 }, { "b": "vr?\u00269wmoN*e]\u003eJte]\u003e\u003ege[xlBvqPZ*04}]5Bo0}7vrt]Te[e)y04}=1zeA\u003c4Bn#pv00000", "n": [ { "c": 2, "d": "ELF dynamic section name", "i": "metadata/binary/linking/static::elf-dynamic-section-name", "o": 83250, "z": 8, "cf": 0.8999999761581421 } ], "ln": 83234 } ], "depth": 1, "facts": { "exp": [ [ "dluaL_error" ], [ "dlua_table_get_luainteger_by_thread" ], [ "dlua_get_dovecot" ], [ "dlua_table_get_uint_by_str" ], [ "dlua_script_init" ], [ "dlua_table_get_uint_by_thread" ], [ "dlua_event_passthrough_abort" ], [ "dlua_check_dict" ], [ "dlua_push_vfstring" ], [ "dlua_check_event" ], [ "dlua_setting_parser_info" ], [ "dlua_strtable_to_kvarray" ], [ "dlua_table_get_by_int" ], [ "dlua_script_new_thread" ], [ "lua_dict_iterate" ], [ "dlua_script_has_function" ], [ "dlua_table_get_intmax_by_int" ], [ "event_category_lua" ], [ "dlua_table_get_int_by_str" ], [ "dlua_tls_get_int" ], [ "dlua_push_dns_client" ], [ "dlua_check_dns_client" ], [ "dlua_script_ref" ], [ "dlua_table_get_string_by_int" ], [ "dlua_tls_set_ptr" ], [ "dlua_table_get_data_by_int" ], [ "dlua_pcall_yieldable_resume" ], [ "dlua_table_get_bool_by_thread" ], [ "dlua_pcall" ], [ "dlua_init_thread_table" ], [ "dlua_script_create_auto" ], [ "dlua_dovecot_register" ], [ "dlua_table_get_bool_by_str" ], [ "dlua_free_thread_table" ], [ "dlua_table_get_string_by_thread" ], [ "dlua_dump_stack" ], [ "dlua_table_get_number_by_thread" ], [ "dlua_table_get_int_by_thread" ], [ "dlua_push_dict" ], [ "dlua_table_get_uintmax_by_str" ], [ "dlua_table_get_uint_by_int" ], [ "dlua_push_timeval" ], [ "dlua_script_create_stream" ], [ "dlua_table_get_luainteger_by_str" ], [ "dlua_dovecot_http_register" ], [ "dlua_table_get_number_by_str" ], [ "init" ], [ "dlua_set_members" ], [ "dlua_tls_set_int" ], [ "lua_dict_transaction_begin" ], [ "dlua_script_create_file" ], [ "dlua_dovecot_dict_register" ], [ "dlua_push_doveadm_client" ], [ "dlua_table_get_int_by_int" ], [ "dlua_script_create_string" ], [ "dlua_push_istream" ], [ "dlua_script_unref" ], [ "dlua_pcall_yieldable" ], [ "dlua_table_get_intmax_by_thread" ], [ "dlua_push_fstring" ], [ "dlua_script_close_thread" ], [ "dlua_table_get_by_thread" ], [ "dlua_table_get_by_str" ], [ "dlua_dovecot_doveadm_client_register" ], [ "dlua_table_get_bool_by_int" ], [ "dlua_register" ], [ "dlua_table_get_intmax_by_str" ], [ "dlua_push_ostream" ], [ "dlua_script_from_state" ], [ "dlua_table_get_string_by_str" ], [ "dlua_table_get_uintmax_by_int" ], [ "dlua_table_get_data_by_str" ], [ "dlua_table_get_luainteger_by_int" ], [ "dlua_tls_get_ptr" ], [ "fini" ], [ "dlua_table_to_array" ], [ "dlua_tls_clear" ], [ "dlua_table_get_uintmax_by_thread" ], [ "dlua_table_get_number_by_int" ], [ "lua_resume_compat" ], [ "lua_dict_check_key_prefix" ], [ "dlua_check_doveadm_client" ], [ "dlua_dovecot_io_register" ], [ "dlua_push_event" ], [ "dlua_table_get_data_by_thread" ] ], "imp": [ [ "", "event_log" ], [ "", "http_header_get_fields" ], [ "", "dict_transaction_set_non_atomic" ], [ "", "lua_rotate" ], [ "", "luaL_checkoption" ], [ "", "i_stream_have_bytes_left" ], [ "", "event_set_ptr" ], [ "", "t_strsplit_tabescaped" ], [ "", "i_stream_get_absolute_offset" ], [ "", "t_push" ], [ "", "doveadm_client_unref" ], [ "", "luaL_openlibs" ], [ "", "i_warning" ], [ "", "t_strdup_vprintf" ], [ "", "http_client_init_auto" ], [ "", "p_strdup_printf" ], [ "", "access" ], [ "", "event_unset_forced_debug" ], [ "", "luaL_loadfilex" ], [ "", "lua_setmetatable" ], [ "", "event_set_forced_debug" ], [ "", "lua_pushfstring" ], [ "", "lua_pushinteger" ], [ "", "base64_scheme" ], [ "", "lua_gettable" ], [ "", "lua_resume" ], [ "", "lua_tonumberx" ], [ "", "default_pool" ], [ "", "lua_pushvalue" ], [ "", "deregister_frame_info" ], [ "", "t_strdup" ], [ "", "str_printfa" ], [ "", "t_strdup_printf" ], [ "", "lua_createtable" ], [ "", "http_client_request_set_payload" ], [ "", "strcmp" ], [ "", "dict_iterate_set_async_callback" ], [ "", "http_client_deinit" ], [ "", "timeout_remove" ], [ "", "str_tabescape" ], [ "", "lua_seti" ], [ "", "event_get_ptr" ], [ "", "luaL_checktype" ], [ "", "lua_setglobal" ], [ "", "settings_instance_new" ], [ "", "lua_touserdata" ], [ "", "o_stream_ref" ], [ "", "lua_pushcclosure" ], [ "", "luaL_argerror" ], [ "", "var_expand" ], [ "", "strncmp" ], [ "", "luaL_tolstring" ], [ "", "lua_tointegerx" ], [ "", "str_new" ], [ "", "i_unreached" ], [ "", "event_add_int" ], [ "", "luaL_checkstack" ], [ "", "lua_pushthread" ], [ "", "dict_iterate_has_more" ], [ "", "http_client_request_add_header" ], [ "", "i_panic" ], [ "", "strrchr" ], [ "", "lua_tothread" ], [ "", "o_stream_unref" ], [ "", "dict_iterate_init" ], [ "", "i_stream_set_max_buffer_size" ], [ "", "lua_getfield" ], [ "", "luaL_checkudata" ], [ "", "lua_yieldk" ], [ "", "event_add_timeval" ], [ "", "ITM_deregisterTMCloneTable" ], [ "", "i_stream_get_error" ], [ "", "lua_gettop" ], [ "", "luaL_setmetatable" ], [ "", "lua_getglobal" ], [ "", "http_client_request_submit" ], [ "", "buffer_set_used_size" ], [ "", "event_get_parent" ], [ "", "event_ref" ], [ "", "pool_allocfree_create" ], [ "", "dns_client_lookup" ], [ "", "lua_typename" ], [ "", "dict_transaction_begin" ], [ "", "lua_newstate" ], [ "", "dict_iterate_values" ], [ "", "buffer_append" ], [ "", "settings_override" ], [ "", "lua_load" ], [ "", "dict_unset" ], [ "", "lua_atpanic" ], [ "", "event_set_always_log_source" ], [ "", "lua_newuserdata" ], [ "", "http_client_wait" ], [ "", "lua_pushlightuserdata" ], [ "", "o_stream_get_name" ], [ "", "strchr" ], [ "", "dict_transaction_rollback" ], [ "", "lua_getstack" ], [ "", "luaL_fileresult" ], [ "", "lua_rawseti" ], [ "", "lua_pushboolean" ], [ "", "event_create" ], [ "", "str_array_length" ], [ "", "i_gettimeofday" ], [ "", "event_unref" ], [ "", "binary_to_hex" ], [ "", "i_stream_get_data" ], [ "", "lua_settable" ], [ "", "luaL_checklstring" ], [ "", "io_remove" ], [ "", "buffer_free" ], [ "", "o_stream_sendv" ], [ "", "timeout_add_short" ], [ "", "lua_settop" ], [ "", "str_append_tabescaped" ], [ "", "event_set_name" ], [ "", "http_url_parse" ], [ "", "i_stream_create_copy_from_data" ], [ "", "luaL_setfuncs" ], [ "", "i_stream_read" ], [ "", "lua_rawget" ], [ "", "cxa_finalize" ], [ "", "register_frame_info" ], [ "", "t_strconcat" ], [ "", "setting_parser_info_find_key" ], [ "", "e_error" ], [ "", "buffer_delete" ], [ "", "luaL_optinteger" ], [ "", "dict_set" ], [ "", "i_error" ], [ "", "luaL_checkinteger" ], [ "", "lua_status" ], [ "", "event_set_append_log_prefix" ], [ "", "settings_file_get" ], [ "", "net_ip2addr" ], [ "", "t_pop" ], [ "", "lua_close" ], [ "", "settings_get" ], [ "", "lua_copy" ], [ "", "net_addr2ip" ], [ "", "ITM_registerTMCloneTable" ], [ "", "lua_toboolean" ], [ "", "http_client_request_set_event" ], [ "", "lua_newthread" ], [ "", "lua_next" ], [ "", "lua_pushstring" ], [ "", "i_stream_get_name" ], [ "", "http_client_setting_parser_info" ], [ "", "lua_getinfo" ], [ "", "i_stream_skip" ], [ "", "t_str_new" ], [ "", "dict_transaction_commit_async" ], [ "", "pool_alloconly_create" ], [ "", "luaL_loadstring" ], [ "", "event_send_abort" ], [ "", "dns_client_setting_parser_info" ], [ "", "lua_error" ], [ "", "lua_type" ], [ "", "lua_setfield" ], [ "", "luaL_newmetatable" ], [ "", "settings_instance_free" ], [ "", "e_debug" ], [ "", "io_add_istream" ], [ "", "event_add_category" ], [ "", "lua_rawset" ], [ "", "errno_location" ], [ "", "i_nanoseconds" ], [ "", "eacces_error_get" ], [ "", "event_replace_log_prefix" ], [ "", "lua_pushlstring" ], [ "", "dict_transaction_set_timestamp" ], [ "", "doveadm_client_cmd" ], [ "", "o_stream_set_max_buffer_size" ], [ "", "dict_iterate_deinit" ], [ "", "lua_rawgeti" ], [ "", "lua_tolstring" ], [ "", "pool_datastack_create" ], [ "", "i_stream_unref" ], [ "", "settings_root_find" ], [ "", "lua_pcallk" ], [ "", "event_want_level" ], [ "", "dict_lookup_async" ], [ "", "ssl_setting_parser_info" ], [ "", "http_client_request_unref" ], [ "", "i_debug" ], [ "", "memchr" ], [ "", "t_base64_scheme_encode" ], [ "", "i_stream_read_data" ], [ "", "buffer_append_c" ], [ "", "lua_pushnumber" ], [ "", "lua_getmetatable" ], [ "", "buffer_append_space_unsafe" ], [ "", "http_client_request_url" ], [ "", "str_c" ], [ "", "p_strdup" ], [ "", "o_stream_flush" ], [ "", "event_add_str" ], [ "", "t_str_tabunescape" ], [ "", "i_stream_ref" ], [ "", "t_base64_scheme_decode" ], [ "", "buffer_create_dynamic_max" ], [ "", "sha1_get_digest" ], [ "", "strlen" ], [ "", "event_inc_int" ], [ "", "luaL_unref" ], [ "", "stack_chk_fail" ], [ "", "event_create_passthrough" ], [ "", "http_client_request_remove_header" ], [ "", "lua_pushnil" ], [ "", "luaL_ref" ], [ "", "strcasecmp" ], [ "", "i_info" ], [ "", "i_stream_seek" ] ], "sec": [ [ ".note.gnu.property", 680, 48, 1.94, "alloc" ], [ ".note.gnu.build-id", 728, 36, 4.25, "alloc" ], [ ".gnu.hash", 768, 1076, 4.44, "alloc" ], [ ".dynsym", 1848, 7176, 1.69, "alloc" ], [ ".dynstr", 9024, 5538, 4.3, "alloc" ], [ ".rela.dyn", 14568, 6072, 1.84, "alloc" ], [ ".relr.dyn", 20640, 64, 3.92, "alloc" ], [ ".init", 24576, 3, 1.58, "alloc,executable" ], [ ".text", 24592, 32834, 5.79, "alloc,executable" ], [ ".fini", 57426, 3, 1.58, "alloc,executable" ], [ ".rodata", 61440, 5668, 4.94, "alloc" ], [ ".eh_frame_hdr", 67108, 1700, 5.24, "alloc" ], [ ".eh_frame", 68808, 8864, 4.88, "alloc" ], [ ".init_array", 78096, 8, 1.06, "write,alloc" ], [ ".fini_array", 78104, 8, 1.06, "write,alloc" ], [ ".data.rel.ro", 78112, 1280, 1.7, "write,alloc" ], [ ".dynamic", 79392, 480, 1.36, "write,alloc" ], [ ".got", 79872, 2032, 0.02, "write,alloc" ], [ ".data", 81920, 1120, 1.62, "write,alloc" ], [ ".comment", 83040, 28, 3.99, "merge,strings" ], [ ".shstrtab", 83068, 216, 4.15, "" ] ], "metrics": { "elf": { "bits": 64.0, "entry": 0.0, "has_got": 1.0, "has_plt": 0.0, "has_note": 1.0, "note_count": 2.0, "nx_enabled": 1.0, "has_dt_relr": 1.0, "has_runpath": 1.0, "dynrel_count": 0.0, "dynsym_count": 299.0, "has_build_id": 1.0, "has_eh_frame": 1.0, "has_gnu_hash": 1.0, "stack_canary": 1.0, "symtab_count": 0.0, "dynrela_count": 253.0, "little_endian": 1.0, "dt_flags_1_raw": 1.0, "pltreloc_count": 0.0, "build_id_length": 20.0, "executable_stack": 0.0, "fini_array_count": 1.0, "init_array_count": 1.0, "wx_segment_count": 0.0, "comment_entry_count": 1.0, "program_header_count": 11.0, "comment_distinct_count": 1.0, "gnu_stack_section_absent": 0.0, "load_segment_max_file_size": 32853.0, "stripped_but_symtab_present": 0.0, "load_segment_max_memory_size": 32853.0, "section_relocation_group_count": 1.0, "stripped_metadata_section_count": 7.0 }, "file": { "size": 84760.0, "entropy": 4.9, "size_bytes": 84760.0 }, "binary": { "is_pie": 0.0, "has_overlay": 1.0, "is_stripped": 1.0, "code_entropy": 5.78, "data_entropy": 0.95, "overlay_size": 1476.0, "string_count": 555.0, "overlay_ratio": 0.02, "overall_entropy": 4.9, "overlay_entropy": 1.43, "entropy_variance": 2.82, "avg_string_length": 17.75, "max_string_length": 91.0, "peak_region_bytes": 20480.0, "code_to_data_ratio": 0.87, "peak_region_entropy": 5.84, "string_length_stddev": 9.28, "largest_section_ratio": 0.39, "sentence_string_count": 80.0, "sentence_string_ratio": 0.14, "high_entropy_string_count": 0.0 }, "exports": { "count": 85.0 }, "imports": { "count": 213.0 }, "sections": { "count": 23.0, "code_size": 32840.0, "entropy_max": 5.79, "entropy_mean": 2.92, "name_entropy": 4.1, "writable_count": 7.0, "executable_count": 3.0, "nonstandard_count": 5.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 3.0 } } }, "id": 2, "mol": "Md(He)", "path": "dovecot-lua-2.4.3-r3.apk!!usr/lib/dovecot/libdovecot-lua.so.0.0.0", "risk": 1, "sha": "6b766c6fddf0ff518d40dc7d4112b1444cc749eede304a35d455086ce5cbd48a", "size": 84760, "traits": [ { "id": "micro-behaviors/dylib/library/libc::libc-characteristic-cxa-finalize", "crit": 2, "desc": "libc characteristic cxa finalize", "spans": [ [ 9087, 12 ] ] }, { "id": "metadata/hardening/missing::stripped-binary", "conf": 0.800000011920929, "crit": 3, "desc": "No full symbol table (likely stripped)", "spans": [ [ 0, 25 ] ] }, { "id": "micro-behaviors/dylib/library/libc::libc-internal-functions-b", "conf": 0.699999988079071, "crit": 2, "desc": "libc internal symbols cluster B", "spans": [ [ 9087, 12 ] ] }, { "id": "micro-behaviors/dylib/library/abi-graphics::cxx-abi-symbols-a", "conf": 0.800000011920929, "crit": 2, "desc": "C++ ABI symbols cluster A", "spans": [ [ 9087, 12 ] ] }, { "id": "micro-behaviors/dylib/library/family::cxx-abi-symbols", "conf": 0.800000011920929, "crit": 2, "desc": "C++ ABI symbols", "spans": [ [ 9087, 12 ] ] } ], "type": "elf" }, { "ctx": [ { "b": "E))420S-r400000000000@$H+0rr910000000000kMy=:00000CU[Cv0000000000kMA+z3JJA(7xtiJ0rr911onA400000000000000000", "n": [ { "c": 3, "d": "No full symbol table (likely stripped)", "i": "metadata/hardening/missing::stripped-binary", "o": 0, "z": 25, "cf": 0.800000011920929 } ], "ln": 0 }, { "b": "A-t+2y\u0026si5raflLwDl7Av%zA?w[=c\u003ey?Xib0af8zwPzu{x(!xcA:JB0vqPN.x(mK30af8NwOkZ#", "n": [ { "c": 2, "d": "Benign dual-mode socket exec context", "i": "objectives/command-and-control/reverse-shell/dup::unix-dual-mode-socket-exec-benign-context", "o": 2463, "z": 12, "cf": 0.949999988079071 } ], "ln": 2447 }, { "b": "0a*s+zGGlbwPRo%vqPMQwP?T5ByeD!wm6z1ASxS^BZXS#v@=p5ByeY\u0026B6\u0026K4zEW^5z/bL^uUam#zV", "n": [ { "c": 2, "d": "event_add function", "i": "micro-behaviors/os/event/library/libevent::event-add", "o": 2580, "z": 13, "cf": 0.4000000059604645 } ], "ln": 2564 }, { "b": "x(4d0B7Gx0B-8khw=MgBB97\u00262yHpN+yHpWZx(0==BZXS@B-RkqBAh8kx8(:\u003cvpa7!By]k#y?9JZBZU", "n": [ { "c": 3, "d": "Stack protector/canary enabled", "i": "metadata/hardening/build::stack-protector", "o": 2744, "z": 14, "cf": 0.8999999761581421 } ], "ln": 2728 }, { "b": "0bk!VvqY^?0crm5v@le+wP?T5ByeD!wm64*Bo32ZB-8khvpJ$Zwb{WZBAzkmxldB3wN/*@z/e][A@", "n": [ { "c": 2, "d": "event_add function", "i": "micro-behaviors/os/event/library/libevent::event-add", "o": 2915, "z": 13, "cf": 0.4000000059604645 } ], "ln": 2899 }, { "b": "uUay(zGGk}vru6[z/Qa6wP?T5ByeD!wm5?PBy/96A^mT@C4CMkuVP!2uTW[)wO#3=y\u0026r@[Ab]J4x)oR*y\u0026]", "n": [ { "c": 2, "d": "event_add function", "i": "micro-behaviors/os/event/library/libevent::event-add", "o": 3047, "z": 18, "cf": 0.4000000059604645 } ], "ln": 3031 }, { "b": "e]$}-fAt{6vQ?3cB-RvJCSmP*hz^4cz.r:Ay?Wulggb0yB7!]#z//Y9x\u003e7N[x(v(@y\u0026]", "n": [ { "c": 3, "d": "Architecture detection strings", "i": "objectives/discovery/host/software::arch-detection", "o": 3568, "z": 6, "cf": 0.5 } ], "ln": 3552 }, { "b": "y?bbiwb[k{zGNNBvrl8Ze[xlBB9RQ5e[xlBB98B5e]\u003eJtvj(8ozu8qfwO=xtwo\u00264)e[]iqBo0}nwQ5p", "n": [ { "c": 2, "d": "ELF dynstr section name", "i": "metadata/binary/linking/static::elf-dynstr-section-name", "o": 20703, "z": 7, "cf": 0.8999999761581421 }, { "c": 2, "d": "ELF dynsym section name", "i": "metadata/binary/linking/static::elf-dynsym-section-name", "o": 20695, "z": 7, "cf": 0.8999999761581421 } ], "ln": 20679 }, { "b": "vr?\u00269wmoN*e]\u003eJte]\u003e\u003ege[xlBvqPZ*04}]5Bo0}7vrt]Te[e)y04}=1zeA\u003c4Bn#pv00000", "n": [ { "c": 2, "d": "ELF dynamic section name", "i": "metadata/binary/linking/static::elf-dynamic-section-name", "o": 20818, "z": 8, "cf": 0.8999999761581421 } ], "ln": 20802 } ], "depth": 1, "facts": { "exp": [ [ "init" ], [ "push_notification_lua_plugin_deinit" ], [ "push_notification_lua_plugin_dependencies" ], [ "push_notification_lua_plugin_version" ], [ "push_notification_driver_lua" ], [ "fini" ], [ "push_notification_lua_plugin_init" ] ], "imp": [ [ "", "luaL_ref" ], [ "", "dlua_pcall" ], [ "", "push_notification_driver_unregister" ], [ "", "i_unreached" ], [ "", "dlua_dovecot_register" ], [ "", "event_want_level" ], [ "", "event_add_str" ], [ "", "push_notification_get_events" ], [ "", "p_strdup_printf" ], [ "", "p_strdup" ], [ "", "event_unref" ], [ "", "luaL_unref" ], [ "", "dlua_push_mail_user" ], [ "", "mail_user_unref" ], [ "", "cxa_finalize" ], [ "", "lua_pushnumber" ], [ "", "lua_setfield" ], [ "", "buffer_append" ], [ "", "push_notification_event_init" ], [ "", "event_send_abort" ], [ "", "push_notification_driver_register" ], [ "", "event_set_append_log_prefix" ], [ "", "dlua_script_unref" ], [ "", "mail_user_ref" ], [ "", "event_add_int" ], [ "", "stack_chk_fail" ], [ "", "str_array_length" ], [ "", "i_panic" ], [ "", "event_set_ptr" ], [ "", "lua_pushboolean" ], [ "", "deregister_frame_info" ], [ "", "ITM_registerTMCloneTable" ], [ "", "dlua_script_has_function" ], [ "", "lua_rawseti" ], [ "", "settings_section_escape" ], [ "", "event_add_category" ], [ "", "str_c" ], [ "", "buffer_append_c" ], [ "", "ITM_deregisterTMCloneTable" ], [ "", "event_create" ], [ "", "push_notification_get_event_category" ], [ "", "strcmp" ], [ "", "dlua_script_create_auto" ], [ "", "lua_pushstring" ], [ "", "dlua_script_init" ], [ "", "e_error" ], [ "", "event_set_name" ], [ "", "lua_gc" ], [ "", "lua_rawgeti" ], [ "", "event_get_pool" ], [ "", "strlen" ], [ "", "e_debug" ], [ "", "register_frame_info" ], [ "", "dlua_register_mail_storage" ], [ "", "t_str_new" ], [ "", "lua_createtable" ] ], "sec": [ [ ".note.gnu.property", 680, 48, 1.94, "alloc" ], [ ".note.gnu.build-id", 728, 36, 4.14, "alloc" ], [ ".gnu.hash", 768, 92, 3.57, "alloc" ], [ ".dynsym", 864, 1536, 1.2, "alloc" ], [ ".dynstr", 2400, 1235, 4.39, "alloc" ], [ ".rela.dyn", 3640, 1368, 1.45, "alloc" ], [ ".relr.dyn", 5008, 32, 1.31, "alloc" ], [ ".init", 8192, 3, 1.58, "alloc,executable" ], [ ".text", 8208, 5495, 5.8, "alloc,executable" ], [ ".fini", 13703, 3, 1.58, "alloc,executable" ], [ ".rodata", 16384, 1009, 4.91, "alloc" ], [ ".eh_frame_hdr", 17396, 172, 4.15, "alloc" ], [ ".eh_frame", 17568, 1004, 4.76, "alloc" ], [ ".init_array", 19440, 8, 1.06, "write,alloc" ], [ ".fini_array", 19448, 8, 1.06, "write,alloc" ], [ ".data.rel.ro", 19456, 80, 1.65, "write,alloc" ], [ ".dynamic", 19536, 464, 1.32, "write,alloc" ], [ ".got", 20000, 480, 0.04, "write,alloc" ], [ ".data", 20480, 128, 1.39, "write,alloc" ], [ ".comment", 20608, 28, 3.99, "merge,strings" ], [ ".shstrtab", 20636, 216, 4.15, "" ] ], "metrics": { "elf": { "bits": 64.0, "entry": 0.0, "has_got": 1.0, "has_plt": 0.0, "has_note": 1.0, "note_count": 2.0, "nx_enabled": 1.0, "has_dt_relr": 1.0, "has_runpath": 1.0, "dynrel_count": 0.0, "dynsym_count": 64.0, "has_build_id": 1.0, "has_eh_frame": 1.0, "has_gnu_hash": 1.0, "stack_canary": 1.0, "symtab_count": 0.0, "dynrela_count": 57.0, "little_endian": 1.0, "dt_flags_1_raw": 1.0, "pltreloc_count": 0.0, "build_id_length": 20.0, "executable_stack": 0.0, "fini_array_count": 1.0, "init_array_count": 1.0, "wx_segment_count": 0.0, "comment_entry_count": 1.0, "program_header_count": 11.0, "comment_distinct_count": 1.0, "gnu_stack_section_absent": 0.0, "load_segment_max_file_size": 5514.0, "stripped_but_symtab_present": 0.0, "load_segment_max_memory_size": 5514.0, "section_relocation_group_count": 1.0, "stripped_metadata_section_count": 7.0 }, "file": { "size": 22328.0, "entropy": 3.61, "size_bytes": 22328.0 }, "binary": { "is_pie": 0.0, "has_overlay": 1.0, "is_stripped": 1.0, "code_entropy": 5.79, "data_entropy": 0.82, "overlay_size": 1476.0, "string_count": 131.0, "overlay_ratio": 0.07, "overall_entropy": 3.61, "overlay_entropy": 1.33, "entropy_variance": 2.68, "avg_string_length": 17.14, "max_string_length": 49.0, "peak_region_bytes": 5120.0, "code_to_data_ratio": 0.82, "peak_region_entropy": 5.68, "string_length_stddev": 10.64, "largest_section_ratio": 0.25, "sentence_string_count": 9.0, "sentence_string_ratio": 0.07, "high_entropy_string_count": 0.0 }, "exports": { "count": 7.0 }, "imports": { "count": 56.0 }, "sections": { "count": 23.0, "code_size": 5501.0, "entropy_max": 5.8, "entropy_mean": 2.64, "name_entropy": 4.1, "writable_count": 7.0, "executable_count": 3.0, "nonstandard_count": 5.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 2.0 } } }, "id": 3, "mol": "Md(He)", "path": "dovecot-lua-2.4.3-r3.apk!!usr/lib/dovecot/lib22_push_notification_lua_plugin.so", "risk": 1, "sha": "811a12b03390b992e7dbda155da5aac1377ab176cbe75bc9ae356dee8da4e0c8", "size": 22328, "traits": [ { "id": "micro-behaviors/dylib/library/libc::libc-characteristic-cxa-finalize", "crit": 2, "desc": "libc characteristic cxa finalize", "spans": [ [ 2463, 12 ] ] }, { "id": "metadata/hardening/missing::stripped-binary", "conf": 0.800000011920929, "crit": 3, "desc": "No full symbol table (likely stripped)", "spans": [ [ 0, 25 ] ] }, { "id": "micro-behaviors/dylib/library/libc::libc-internal-functions-b", "conf": 0.699999988079071, "crit": 2, "desc": "libc internal symbols cluster B", "spans": [ [ 2463, 12 ] ] }, { "id": "micro-behaviors/dylib/library/abi-graphics::cxx-abi-symbols-a", "conf": 0.800000011920929, "crit": 2, "desc": "C++ ABI symbols cluster A", "spans": [ [ 2463, 12 ] ] }, { "id": "micro-behaviors/dylib/library/family::cxx-abi-symbols", "conf": 0.800000011920929, "crit": 2, "desc": "C++ ABI symbols", "spans": [ [ 2463, 12 ] ] } ], "type": "elf" }, { "ctx": [ { "b": "E))420S-r400000000000@$H+0rr910000000000kMy=:00000avb#c0000000000kMA+z3JJA(7xtiJ0rr911onA4", "n": [ { "c": 3, "d": "No full symbol table (likely stripped)", "i": "metadata/hardening/missing::stripped-binary", "o": 0, "z": 25, "cf": 0.800000011920929 } ], "ln": 0 }, { "b": "A-t+2y\u0026si5raflLwDl7Av%zA?w[=c\u003ey?Xib0af8zwPzu{x(!xcA:JB0vqPN.x(mK30af8NwOkZ#", "n": [ { "c": 2, "d": "Benign dual-mode socket exec context", "i": "objectives/command-and-control/reverse-shell/dup::unix-dual-mode-socket-exec-benign-context", "o": 2535, "z": 12, "cf": 0.949999988079071 } ], "ln": 2519 }, { "b": "B7GDnz/tX)BZXS\u0026v/P\u003eyB97\u00262yHpN+yHpWZx(0=XC4CMkuT[a/vru5XB7GDnx(mN8uUay(zGGk]wmP4Vx(4)5A:JY)zdJYTy\u0026%e[B7ol8AcbC%A+eW3wNw\u003e*Bz?d#uVQsfwov", "n": [ { "c": 3, "d": "Stack protector/canary enabled", "i": "metadata/hardening/build::stack-protector", "o": 2763, "z": 14, "cf": 0.8999999761581421 }, { "c": 2, "d": "event_add function", "i": "micro-behaviors/os/event/library/libevent::event-add", "o": 2791, "z": 30, "cf": 0.4000000059604645 } ], "ln": 2747 }, { "b": "e]$}-fAt{6vQ?3cB-RvJCSmP*hz^4cz.r:Ay?Wujf\u003c!^ax(4c)BZXS@y\u0026%x8zz30G051", "n": [ { "c": 3, "d": "Architecture detection strings", "i": "objectives/discovery/host/software::arch-detection", "o": 3864, "z": 6, "cf": 0.5 } ], "ln": 3848 }, { "b": "y?bbiwb[k{zGNNBvrl8Ze[xlBB9RQ5e[xlBB98B5e]\u003eJtvj(8ozu8qfwO=xtwo\u00264)e[]iqBo0}nwQ5p", "n": [ { "c": 2, "d": "ELF dynstr section name", "i": "metadata/binary/linking/static::elf-dynstr-section-name", "o": 16519, "z": 7, "cf": 0.8999999761581421 }, { "c": 2, "d": "ELF dynsym section name", "i": "metadata/binary/linking/static::elf-dynsym-section-name", "o": 16511, "z": 7, "cf": 0.8999999761581421 } ], "ln": 16495 }, { "b": "vr?\u00269wmoN*e]\u003eJte]\u003e\u003ege[xlBvqPZ*04}]5Bo0}7vrt]Te[e)y04}=1zeA\u003c4Bn#pv00000", "n": [ { "c": 2, "d": "ELF dynamic section name", "i": "metadata/binary/linking/static::elf-dynamic-section-name", "o": 16634, "z": 8, "cf": 0.8999999761581421 } ], "ln": 16618 } ], "depth": 1, "facts": { "exp": [ [ "init" ], [ "mail_lua_plugin_deinit" ], [ "mail_lua_plugin_init" ], [ "mail_lua_plugin_dependencies" ], [ "mail_lua_setting_parser_info" ], [ "mail_lua_plugin_get_script" ], [ "fini" ] ], "imp": [ [ "", "var_expand_parameter_iter_init" ], [ "", "dlua_register_mail_storage" ], [ "", "p_strdup_printf" ], [ "", "lua_tonumberx" ], [ "", "default_pool" ], [ "", "deregister_frame_info" ], [ "", "dlua_script_unref" ], [ "", "t_strdup_printf" ], [ "", "dlua_script_create_file" ], [ "", "strcmp" ], [ "", "settings_event_add_filter_name" ], [ "", "dlua_dovecot_register" ], [ "", "event_get_ptr" ], [ "", "i_strdup" ], [ "", "array_idx_modifiable_i" ], [ "", "i_panic" ], [ "", "ITM_deregisterTMCloneTable" ], [ "", "buffer_append" ], [ "", "var_expand_parameter_string_or_var" ], [ "", "dlua_script_create_auto" ], [ "", "mail_storage_hooks_remove" ], [ "", "array_lsearch_i" ], [ "", "event_create" ], [ "", "event_unref" ], [ "", "var_expand_state_set_transfer_data" ], [ "", "buffer_free" ], [ "", "lua_settop" ], [ "", "var_expand_parameter_any_or_var" ], [ "", "dlua_script_init" ], [ "", "var_expand_state_unset_transfer" ], [ "", "var_expand_parameter_key" ], [ "", "cxa_finalize" ], [ "", "register_frame_info" ], [ "", "e_error" ], [ "", "var_expand_unregister_filter" ], [ "", "array_idx_set_i" ], [ "", "mail_storage_hooks_add" ], [ "", "ITM_registerTMCloneTable" ], [ "", "var_expand_parameter_idx" ], [ "", "lua_pushstring" ], [ "", "event_send_abort" ], [ "", "buffer_get_modifiable_data" ], [ "", "mail_user_module_register" ], [ "", "e_debug" ], [ "", "dlua_pcall" ], [ "", "var_expand_parameter_iter_more" ], [ "", "var_expand_register_filter" ], [ "", "lua_pushlstring" ], [ "", "lua_tolstring" ], [ "", "pool_datastack_create" ], [ "", "event_want_level" ], [ "", "dlua_push_mail_user" ], [ "", "buffer_append_space_unsafe" ], [ "", "p_strdup" ], [ "", "lua_gc" ], [ "", "var_expand_parameter_iter_next" ], [ "", "buffer_create_dynamic_max" ], [ "", "stack_chk_fail" ], [ "", "dlua_script_has_function" ] ], "sec": [ [ ".note.gnu.property", 680, 48, 1.94, "alloc" ], [ ".note.gnu.build-id", 728, 36, 4.14, "alloc" ], [ ".gnu.hash", 768, 92, 3.48, "alloc" ], [ ".dynsym", 864, 1608, 1.22, "alloc" ], [ ".dynstr", 2472, 1446, 4.39, "alloc" ], [ ".rela.dyn", 3920, 1440, 1.46, "alloc" ], [ ".relr.dyn", 5360, 24, 1.69, "alloc" ], [ ".init", 8192, 3, 1.58, "alloc,executable" ], [ ".text", 8208, 3303, 5.86, "alloc,executable" ], [ ".fini", 11511, 3, 1.58, "alloc,executable" ], [ ".rodata", 12288, 480, 4.68, "alloc" ], [ ".eh_frame_hdr", 12768, 108, 3.85, "alloc" ], [ ".eh_frame", 12880, 640, 4.72, "alloc" ], [ ".init_array", 15088, 8, 1.06, "write,alloc" ], [ ".fini_array", 15096, 8, 1.06, "write,alloc" ], [ ".data.rel.ro", 15104, 288, 0.51, "write,alloc" ], [ ".dynamic", 15392, 496, 1.33, "write,alloc" ], [ ".got", 15888, 496, 0.04, "write,alloc" ], [ ".data", 16384, 40, 0.17, "write,alloc" ], [ ".comment", 16424, 28, 3.99, "merge,strings" ], [ ".shstrtab", 16452, 216, 4.15, "" ] ], "metrics": { "elf": { "bits": 64.0, "entry": 0.0, "has_got": 1.0, "has_plt": 0.0, "has_note": 1.0, "note_count": 2.0, "nx_enabled": 1.0, "has_dt_relr": 1.0, "has_runpath": 1.0, "dynrel_count": 0.0, "dynsym_count": 67.0, "has_build_id": 1.0, "has_eh_frame": 1.0, "has_gnu_hash": 1.0, "stack_canary": 1.0, "symtab_count": 0.0, "dynrela_count": 60.0, "little_endian": 1.0, "dt_flags_1_raw": 1.0, "pltreloc_count": 0.0, "build_id_length": 20.0, "executable_stack": 0.0, "fini_array_count": 1.0, "init_array_count": 1.0, "wx_segment_count": 0.0, "comment_entry_count": 1.0, "program_header_count": 11.0, "comment_distinct_count": 1.0, "gnu_stack_section_absent": 0.0, "load_segment_max_file_size": 5384.0, "stripped_but_symtab_present": 0.0, "load_segment_max_memory_size": 5384.0, "section_relocation_group_count": 1.0, "stripped_metadata_section_count": 7.0 }, "file": { "size": 18144.0, "entropy": 3.29, "size_bytes": 18144.0 }, "binary": { "is_pie": 0.0, "has_overlay": 1.0, "is_stripped": 1.0, "code_entropy": 5.85, "data_entropy": 0.64, "overlay_size": 1476.0, "string_count": 114.0, "overlay_ratio": 0.08, "overall_entropy": 3.29, "overlay_entropy": 1.34, "entropy_variance": 2.92, "avg_string_length": 17.74, "max_string_length": 45.0, "peak_region_bytes": 4096.0, "code_to_data_ratio": 0.71, "peak_region_entropy": 5.75, "string_length_stddev": 8.51, "largest_section_ratio": 0.18, "sentence_string_count": 10.0, "sentence_string_ratio": 0.09, "high_entropy_string_count": 0.0 }, "exports": { "count": 7.0 }, "imports": { "count": 59.0 }, "sections": { "count": 23.0, "code_size": 3309.0, "entropy_max": 5.86, "entropy_mean": 2.52, "name_entropy": 4.1, "writable_count": 7.0, "executable_count": 3.0, "nonstandard_count": 5.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 4.0 } } }, "id": 4, "mol": "Md(He)", "path": "dovecot-lua-2.4.3-r3.apk!!usr/lib/dovecot/lib01_mail_lua_plugin.so", "risk": 1, "sha": "55058ce5450d506e973742afd75bc77069c27f9e6c04a24a0a85dd6f65469cfd", "size": 18144, "traits": [ { "id": "micro-behaviors/dylib/library/libc::libc-characteristic-cxa-finalize", "crit": 2, "desc": "libc characteristic cxa finalize", "spans": [ [ 2535, 12 ] ] }, { "id": "metadata/hardening/missing::stripped-binary", "conf": 0.800000011920929, "crit": 3, "desc": "No full symbol table (likely stripped)", "spans": [ [ 0, 25 ] ] }, { "id": "micro-behaviors/dylib/library/libc::libc-internal-functions-b", "conf": 0.699999988079071, "crit": 2, "desc": "libc internal symbols cluster B", "spans": [ [ 2535, 12 ] ] }, { "id": "micro-behaviors/dylib/library/abi-graphics::cxx-abi-symbols-a", "conf": 0.800000011920929, "crit": 2, "desc": "C++ ABI symbols cluster A", "spans": [ [ 2535, 12 ] ] }, { "id": "micro-behaviors/dylib/library/family::cxx-abi-symbols", "conf": 0.800000011920929, "crit": 2, "desc": "C++ ABI symbols", "spans": [ [ 2535, 12 ] ] } ], "type": "elf" }, { "ctx": [ { "b": "E))420S-r400000000000@$H+0rr910000000000kMy=:00000Xn?MH0000000000kMA+z3JJA(7xtiJ0rr911o", "n": [ { "c": 3, "d": "No full symbol table (likely stripped)", "i": "metadata/hardening/missing::stripped-binary", "o": 0, "z": 25, "cf": 0.800000011920929 } ], "ln": 0 }, { "b": "A-t+2y\u0026si5raflLwDl7Av%zA?w[=c\u003ey?Xib0af8zwPzu{x(!xcA:JB0vqPN.x(mK30af8NwOkZ#", "n": [ { "c": 2, "d": "Benign dual-mode socket exec context", "i": "objectives/command-and-control/reverse-shell/dup::unix-dual-mode-socket-exec-benign-context", "o": 3527, "z": 12, "cf": 0.949999988079071 } ], "ln": 3511 }, { "b": "wPI%2B7GD2w[+*)wb]$zB97\u00262yHpN+yHpWZx(0=XC4CMkuW2{@Bye\u0026}C4CE\u0026wNw$VvS=q-wP?T5Byb", "n": [ { "c": 3, "d": "Stack protector/canary enabled", "i": "metadata/hardening/build::stack-protector", "o": 3957, "z": 14, "cf": 0.8999999761581421 } ], "ln": 3941 }, { "b": "e]$}-fAt{6vQ?3cB-RvJCSmP*hz^4cz.r:Ay?Wu!B-.qcvQA}]vj(Rt055FoAXzlyvLm", "n": [ { "c": 3, "d": "Architecture detection strings", "i": "objectives/discovery/host/software::arch-detection", "o": 5357, "z": 6, "cf": 0.5 } ], "ln": 5341 }, { "b": "y?bbiwb[k{zGNNBvrl8Ze[xlBB9RQ5e[xlBB98B5e]\u003eJtvj(8ozu8qfwO=xtwo\u00264)e[]iqBo0}nwQ5p", "n": [ { "c": 2, "d": "ELF dynstr section name", "i": "metadata/binary/linking/static::elf-dynstr-section-name", "o": 29215, "z": 7, "cf": 0.8999999761581421 }, { "c": 2, "d": "ELF dynsym section name", "i": "metadata/binary/linking/static::elf-dynsym-section-name", "o": 29207, "z": 7, "cf": 0.8999999761581421 } ], "ln": 29191 }, { "b": "vr?\u00269wmoN*e]\u003eJte]\u003e\u003ege[xlBvqPZ*04}]5Bo0}7vrt]Te[e)y04}=1zeA\u003c4Bn#pv00000", "n": [ { "c": 2, "d": "ELF dynamic section name", "i": "metadata/binary/linking/static::elf-dynamic-section-name", "o": 29330, "z": 8, "cf": 0.8999999761581421 } ], "ln": 29314 } ], "depth": 1, "facts": { "exp": [ [ "passdb_lua_plugin" ], [ "auth_lua_call_passdb_lookup" ], [ "auth_lua_userdb_iterate_deinit" ], [ "authdb_lua_init" ], [ "init" ], [ "fini" ], [ "auth_lua_call_password_verify" ], [ "auth_lua_userdb_iterate_next" ], [ "auth_lua_call_userdb_iterate_init" ], [ "userdb_lua_plugin" ], [ "auth_lua_script_get_default_cache_key" ], [ "auth_lua_script_init" ], [ "authdb_lua_deinit" ], [ "auth_lua_setting_parser_info" ], [ "auth_lua_call_userdb_lookup" ] ], "imp": [ [ "", "lua_touserdata" ], [ "", "lua_pushlightuserdata" ], [ "", "lua_isnumber" ], [ "", "auth_passdb_post_setting_parser_info" ], [ "", "password_verify" ], [ "", "dlua_pcall" ], [ "", "dec2str" ], [ "", "auth_request_get_var_expand_table" ], [ "", "i_unreached" ], [ "", "dlua_dovecot_register" ], [ "", "event_want_level" ], [ "", "lua_next" ], [ "", "p_strdup" ], [ "", "event_unref" ], [ "", "lua_gettop" ], [ "", "auth_request_set_userdb_fields" ], [ "", "luaL_checkstack" ], [ "", "auth_cache_parse_key_and_fields" ], [ "", "lua_tointegerx" ], [ "", "dlua_get_dovecot" ], [ "", "cxa_finalize" ], [ "", "luaL_checklstring" ], [ "", "lua_pushnumber" ], [ "", "password_get_scheme" ], [ "", "lua_setfield" ], [ "", "buffer_append" ], [ "", "lua_isstring" ], [ "", "lua_pushvalue" ], [ "", "event_send_abort" ], [ "", "passdb_unregister_module" ], [ "", "lua_pushnil" ], [ "", "auth_request_password_missing" ], [ "", "e_warning" ], [ "", "dlua_script_unref" ], [ "", "lua_settop" ], [ "", "lua_pushcclosure" ], [ "", "stack_chk_fail" ], [ "", "t_strdup" ], [ "", "i_panic" ], [ "", "lua_tolstring" ], [ "", "lua_type" ], [ "", "auth_request_set_userdb_field" ], [ "", "lua_pushboolean" ], [ "", "userdb_unregister_module" ], [ "", "null_strcmp" ], [ "", "deregister_frame_info" ], [ "", "dlua_push_event" ], [ "", "lua_setmetatable" ], [ "", "ITM_registerTMCloneTable" ], [ "", "dlua_script_has_function" ], [ "", "e_info" ], [ "", "lua_rawget" ], [ "", "auth_request_db_log_password_mismatch" ], [ "", "luaL_newmetatable" ], [ "", "dluaL_error" ], [ "", "luaL_setmetatable" ], [ "", "i_fatal" ], [ "", "ITM_deregisterTMCloneTable" ], [ "", "settings_get" ], [ "", "t_auth_request_var_expand" ], [ "", "event_create" ], [ "", "auth_fields_find" ], [ "", "array_idx_modifiable_i" ], [ "", "strcmp" ], [ "", "dlua_script_create_auto" ], [ "", "lua_pushstring" ], [ "", "dlua_script_init" ], [ "", "auth_request_db_password_verify" ], [ "", "passdb_register_module" ], [ "", "e_error" ], [ "", "buffer_create_dynamic_max" ], [ "", "userdb_register_module" ], [ "", "passdb_handle_credentials" ], [ "", "lua_gc" ], [ "", "dlua_set_members" ], [ "", "luaL_setfuncs" ], [ "", "auth_request_set_field" ], [ "", "auth_fields_exists" ], [ "", "auth_request_set_passdb_fields" ], [ "", "pool_alloconly_create" ], [ "", "password_decode" ], [ "", "t_strdup_printf" ], [ "", "lua_toboolean" ], [ "", "lua_typename" ], [ "", "e_debug" ], [ "", "register_frame_info" ], [ "", "strpbrk" ], [ "", "lua_createtable" ] ], "sec": [ [ ".note.gnu.property", 680, 48, 1.94, "alloc" ], [ ".note.gnu.build-id", 728, 36, 4.25, "alloc" ], [ ".gnu.hash", 768, 200, 3.78, "alloc" ], [ ".dynsym", 968, 2496, 1.37, "alloc" ], [ ".dynstr", 3464, 1939, 4.37, "alloc" ], [ ".rela.dyn", 5408, 2352, 1.51, "alloc" ], [ ".relr.dyn", 7760, 32, 2.94, "alloc" ], [ ".init", 8192, 3, 1.58, "alloc,executable" ], [ ".text", 8208, 8369, 5.8, "alloc,executable" ], [ ".fini", 16577, 3, 1.58, "alloc,executable" ], [ ".rodata", 20480, 2630, 5.12, "alloc" ], [ ".eh_frame_hdr", 23112, 332, 4.57, "alloc" ], [ ".eh_frame", 23448, 1880, 4.81, "alloc" ], [ ".init_array", 26928, 8, 1.06, "write,alloc" ], [ ".fini_array", 26936, 8, 1.06, "write,alloc" ], [ ".data.rel.ro", 26944, 432, 1.1, "write,alloc" ], [ ".dynamic", 27376, 464, 1.3, "write,alloc" ], [ ".got", 27840, 808, 0.03, "write,alloc" ], [ ".data", 28672, 448, 1.81, "write,alloc" ], [ ".comment", 29120, 28, 3.99, "merge,strings" ], [ ".shstrtab", 29148, 216, 4.15, "" ] ], "metrics": { "elf": { "bits": 64.0, "entry": 0.0, "has_got": 1.0, "has_plt": 0.0, "has_note": 1.0, "note_count": 2.0, "nx_enabled": 1.0, "has_dt_relr": 1.0, "has_runpath": 1.0, "dynrel_count": 0.0, "dynsym_count": 104.0, "has_build_id": 1.0, "has_eh_frame": 1.0, "has_gnu_hash": 1.0, "stack_canary": 1.0, "symtab_count": 0.0, "dynrela_count": 98.0, "little_endian": 1.0, "dt_flags_1_raw": 1.0, "pltreloc_count": 0.0, "build_id_length": 20.0, "executable_stack": 0.0, "fini_array_count": 1.0, "init_array_count": 1.0, "wx_segment_count": 0.0, "comment_entry_count": 1.0, "program_header_count": 11.0, "comment_distinct_count": 1.0, "gnu_stack_section_absent": 0.0, "load_segment_max_file_size": 8388.0, "stripped_but_symtab_present": 0.0, "load_segment_max_memory_size": 8388.0, "section_relocation_group_count": 1.0, "stripped_metadata_section_count": 7.0 }, "file": { "size": 30840.0, "entropy": 4.2, "size_bytes": 30840.0 }, "binary": { "is_pie": 0.0, "has_overlay": 1.0, "is_stripped": 1.0, "code_entropy": 5.8, "data_entropy": 0.89, "overlay_size": 1476.0, "string_count": 214.0, "overlay_ratio": 0.05, "overall_entropy": 4.2, "overlay_entropy": 1.38, "entropy_variance": 2.74, "avg_string_length": 20.27, "max_string_length": 75.0, "peak_region_bytes": 9216.0, "code_to_data_ratio": 0.79, "peak_region_entropy": 5.73, "string_length_stddev": 13.37, "largest_section_ratio": 0.27, "sentence_string_count": 31.0, "sentence_string_ratio": 0.14, "high_entropy_string_count": 0.0 }, "exports": { "count": 15.0 }, "imports": { "count": 88.0 }, "sections": { "count": 23.0, "code_size": 8375.0, "entropy_max": 5.8, "entropy_mean": 2.77, "name_entropy": 4.1, "writable_count": 7.0, "executable_count": 3.0, "nonstandard_count": 5.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 2.0 } } }, "id": 5, "mol": "Md(He)", "path": "dovecot-lua-2.4.3-r3.apk!!usr/lib/dovecot/auth/libauthdb_lua.so", "risk": 1, "sha": "a71ca2e8a179c823ddcf24a2e31df6d015cc2330f8932846590158e7e079e87a", "size": 30840, "traits": [ { "id": "micro-behaviors/dylib/library/libc::libc-characteristic-cxa-finalize", "crit": 2, "desc": "libc characteristic cxa finalize", "spans": [ [ 3527, 12 ] ] }, { "id": "metadata/hardening/missing::stripped-binary", "conf": 0.800000011920929, "crit": 3, "desc": "No full symbol table (likely stripped)", "spans": [ [ 0, 25 ] ] }, { "id": "micro-behaviors/dylib/library/libc::libc-internal-functions-b", "conf": 0.699999988079071, "crit": 2, "desc": "libc internal symbols cluster B", "spans": [ [ 3527, 12 ] ] }, { "id": "micro-behaviors/dylib/library/abi-graphics::cxx-abi-symbols-a", "conf": 0.800000011920929, "crit": 2, "desc": "C++ ABI symbols cluster A", "spans": [ [ 3527, 12 ] ] }, { "id": "micro-behaviors/dylib/library/family::cxx-abi-symbols", "conf": 0.800000011920929, "crit": 2, "desc": "C++ ABI symbols", "spans": [ [ 3527, 12 ] ] } ], "type": "elf" }, { "id": 6, "sha": "f8a6f59d9c95b5246db694457f9299e420f0a81e1318bf8751cc125c79538aff", "path": "dovecot-lua-2.4.3-r3.apk!!.PKGINFO", "risk": 1, "size": 873, "type": "text", "depth": 1 } ], "omitted_files": 1, "rev": "868bd", "v": "8" } }