{ "ml": { "v": "7", "eng": "2.5.0-beta.0", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.000053852797, "rte": "az", "prob": 0.000053852797 } ], "prob": 0.000053852797, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.00005385279655456543, "type": "xz" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.000016748905181884766, "type": "c" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.000012586514458234888, "type": "elf" } ], "version": "v18.18", "analyzed_at": "2026-08-03T07:53:16Z" }, "path": "libbstring-1.0.1.tgz", "raw": { "files": [ { "id": 0, "mol": "O(Er)", "sha": "420cd3770241de8c9014d3acbb013699bfc1682b5ebfadf4395dfbd0f84d2ee5", "path": "libbstring-1.0.1.tgz", "risk": 1, "size": 38308, "type": "xz", "facts": { "metrics": { "file": { "size": 38308.0, "entropy": 8.0, "size_bytes": 38308.0 }, "binary": { "overall_entropy": 8.0, "peak_region_bytes": 38308.0, "peak_region_entropy": 7.84 }, "consistency": { "extension_content_mismatch": 1.0, "extension_content_mismatch.archive_as_archive": 1.0 } } }, "traits": [ { "id": "objectives/evasion/kernel-hide/lkm/hiding::malware-mention-comment-backdoor", "conf": 1.0, "crit": 3, "desc": "Code explicitly mentions malware/backdoor" } ] }, { "ctx": [ { "b": "fdF8iz/x#xx\u003eIa3atLS8ga+mnf/p7IvrDxenonGRxBk\u003eiaxi2*B0b7ey?j-6B0bBgA=-Bxw/%AYBAhhivLe0gdHEpFaw#=Yx(!xpx\u003c#jbx(v(ivqYP#B-Rapx(k5mz/{8gwGUA0wftt}zEENhazbLjzf4lJCwhejaA8oyCwhejzV", "n": [ { "c": 2, "d": "Contains common English function words", "i": "metadata/file/profile/language::lang-english", "o": 37, "z": 4, "cf": 0.800000011920929 } ], "ln": 0, "col": 1, "line": 1 }, { "b": "dJ\u0026eqaz2Olz/M$sv}fU4B0ajToIuNyB0bHmBAIRwwN)z2asY2Klq{\u0026YuR\u003c-?oI4O]v}Yp\u003easW.cB98BTv@(:jc$vgkB95KlB98CpzF78kefFCovr9Gpdlv\u003ezfdFBUasXH6A+e*6ayMxWePV2Ox(mMaxjU%(A::63wftubayYzlAX.cCBAe=Ue^-ZJ3lQ/vra]#!azC)tzF%MjvqG+9aA.NtwN/p)B769maAImmv}u=%BrCsvB95KGA:-{dayMy5vqG:5Bz\u0026plA+e/gdj+/GdJ\u0026zyCv+@eAX5tEw/$@0y\u0026131c[coEzE:(4A+e/gdiJqjC4z!9wO2:4A+e=)w[=c]wftr4ayMyfvpKs@B0bWvBzbxa3lQ/vBzbkdvSMTiy?Wu3zeS%cy?j.qC4\u003ewczdc{{z/W4nzxK4mwGU\u00263zdE9*e[=wpvpK7-z/oUBaA}KwxDRwmzdK4%dJ\u0026now[CQ{wO#0?azCZovR6jYC4\u003e(qAV!$mz/3RsxK@rcByVIgx\u003c#9\u003eA^n^tB-7Yhx(v)gefG4FwO@SjxLzJgvqG:#Cxj9ldJ\u0026dxv@DydwN/*8Cvt+tz!pb7A+e/@zF78lxK@r6wO(vaC{4ixvrrS2y\u002613lB0bdgxj$\u003c%az+RjwO-G0z!9A4Bz\u0026phwEoLfazC.7wPhi#wmYU2azbUjz6i}lwPIA9zdc{{zY\u003c7iwmYv!zFsibz/fRG3lQ/K3pmV\u003cqErm2lqf%razC.n3sWH^BAg#lwO0o1xKL{7dSW423jnBodHEpFawDoWwGUz7v@DsiaA7\u003cmBzbkdAa9*ewN(]$zxJzfBAh8kxd:JldHEpFaxi2=ay/tex\u003ep/$vSMTix(mMax(+zqwPS6nzE)u3x\u003ewGfxK#i}azC)tzF{UeA=M8sefF\u003eMxK#jdx(^\u0026dpe%$YazC)7asXHOwPS6nzE)uh3lQ/K3pmV\u003cqErm2lqf%rayYzl", "n": [ { "c": 4, "d": "Code explicitly mentions malware/backdoor", "i": "objectives/evasion/kernel-hide/lkm/hiding::malware-mention-comment", "o": 4593, "z": 468, "cf": 1.0 } ], "ln": 4497, "col": 2, "line": 150 }, { "b": "3jgA:BrC4lBAhFuA9)SdjS)6\u0026r8N6(qC]4*vSMTiBzU#7B9X@(atC=oay2lWw]zYjc{6HtaBtko3jd2Zvp9?+B95KlB98CAze-\u0026\u003cA+xi5B96F^tNy=zC41:0Byxiic$mmtA==equTW$/y?W%jefF+qB97\u0026hxdk[+tNy=zvSMTiBzU#7AV^H/vS(l[z/PY6", "n": [ { "c": 2, "d": "Contains an unconditional loop header", "i": "micro-behaviors/data/control-flow/loop::infinite-loop-header", "o": 38161, "z": 8, "cf": 1.0 } ], "ln": 38113, "col": 36, "line": 1093 }, { "b": "xk.{ly\u003cvdiB0b7cwPR#ovriM6z!%ldCxk!LasWZvdJ?#az!9z^asXHCA3dp^w]zT1zyuRWe?Om}i%)8WazCBgc$WAEayVDRayX${BAn\u0026UvOQMEByM:xw[LW%v\u003en:mA4AaVtY7]ri%)8Way5F}wmGK*wEoLf3lQ/vc@aY5wGV8dvrrSgzFTOvz/fbeBn", "n": [ { "c": 2, "d": "References the CRT fopen file-open routine", "i": "micro-behaviors/fs/file/open::fopen-text", "o": 40165, "z": 5, "cf": 0.6200000047683716 } ], "ln": 40117, "col": 46, "line": 1145 }, { "b": "ra]?=A+eV\u0026p\u0026{.2w{503BzkVhaAhmkzGGDgazC)tv@Dj6vrui)y?j-kx([2hw].D\u003ewft@8zddK2v@\u003cgzwQ4Y@Ac9jAxKL#\u0026asXHFBrCEjwN({3z/^auvSV3)zxK4mwGV5oA+eV@ay[]5vixf5z/3R9azbt7wIb98xK@r2zGGDcBzkVhazC)tBzb98ao", "n": [ { "c": 2, "d": "References the CRT fread file-read routine", "i": "micro-behaviors/fs/file/read::fread-text", "o": 40737, "z": 5, "cf": 0.6200000047683716 } ], "ln": 40689, "col": 4, "line": 1166 } ], "depth": 1, "facts": { "imp": [ [ "", "\u003cconfig.h\u003e" ], [ "", "\u003cctype.h\u003e" ], [ "", "\u003climits.h\u003e" ], [ "", "\u003cstdarg.h\u003e" ], [ "", "\u003cstring.h\u003e" ] ], "metrics": { "ast": { "op.eq": 1.0, "op.ge": 1.0, "op.gt": 2.0, "op.le": 1.0, "op.lor": 1.0, "op.sub": 2.0, "op.land": 1.0, "max_depth": 13.0, "bind_count": 4.0, "call_count": 0.0, "node_count": 2831.0, "op_density.eq": 0.0, "op_density.ge": 0.0, "op_density.gt": 0.0, "op_density.le": 0.0, "op_density.lor": 0.0, "op_density.sub": 0.0, "op_density.land": 0.0, "identifier_count": 198.0, "string_literal_count": 1.0 }, "file": { "size": 61473.0, "entropy": 4.77, "size_bytes": 61473.0 }, "text": { "tab_count": 241.0, "digit_ratio": 0.01, "space_count": 10312.0, "total_lines": 1773.0, "char_entropy": 4.77, "mixed_indent": 1.0, "unique_chars": 88.0, "escape_density": 0.06, "string_density": 0.0, "avg_line_length": 33.67, "max_line_length": 82.0, "empty_line_ratio": 0.08, "last_line_length": 22.0, "whitespace_ratio": 0.2, "most_common_ratio": 0.08, "identifier_density": 0.43, "line_length_stddev": 30.06, "octal_escape_count": 37.0, "normalized_string_count": 0.02, "repeated_char_sequences": 3.0, "most_common_char_is_null": 0.0, "suspicious_comment_ratio": 0.11, "max_inline_whitespace_run": 19.0, "most_common_char_codepoint": 116.0, "suspicious_identifier_ratio": 0.1, "normalized_unique_identifiers": 18.35 }, "binds": { "count": 4.0 }, "binary": { "overall_entropy": 4.77, "peak_region_bytes": 12288.0, "peak_region_entropy": 5.24 }, "source": { "class_count": 3.0 }, "imports": { "count": 5.0, "unique_modules": 5.0, "third_party_count": 5.0, "third_party_ratio": 1.0 }, "strings": { "total": 1.0, "avg_length": 1.0, "max_length": 1.0, "avg_entropy": 0.0, "total_bytes": 1.0 }, "comments": { "chars": 49381.0, "lines": 1227.0, "total": 138.0, "to_code_ratio": 2.25, "code_in_comments": 3.0, "base64_in_comments": 1.0, "high_entropy_comments": 14.0 }, "functions": { "count": 3.0 }, "identifiers": { "count": 198.0, "total": 768.0, "avg_length": 7.54, "max_length": 23.0, "min_length": 1.0, "avg_entropy": 2.37, "reuse_ratio": 0.26, "unique_count": 198.0, "length_stddev": 4.14, "has_digit_ratio": 0.06, "sequential_names": 19.0, "single_char_count": 14.0, "single_char_ratio": 0.07, "high_entropy_count": 1.0, "high_entropy_ratio": 0.01, "all_lowercase_ratio": 0.8, "all_uppercase_ratio": 0.07, "numeric_suffix_count": 5.0, "double_underscore_count": 2.0, "underscore_prefix_count": 4.0 } } }, "id": 1, "mol": "O(Er)", "path": "libbstring-1.0.1.tgz!!include/bstrlib.h", "pid": 0, "risk": 1, "sha": "e5d620f53969ba74a2b12d177a5480a223d65dfe74c6900bb0698524441638f7", "size": 61473, "traits": [ { "id": "objectives/evasion/kernel-hide/lkm/hiding::malware-mention-comment-backdoor", "conf": 1.0, "crit": 3, "desc": "Code explicitly mentions malware/backdoor", "spans": [ [ 4593, 468 ] ] } ], "type": "c" }, { "ctx": [ { "b": "E))420S-r400000000000@$H+0rr91FfL3]00000kMy=:00000AlXB-0000000000kMA+z2lm0?9rm5V1][S61onA4kMy=:00000kMy=:00000kMy=:00000HYEFQ00000HYEFQ000002MK\u00268000000rr911POJ50000000000000000000000000000", "n": [ { "c": 3, "d": "Patterns associated with legitimate injectors to reduce FPs", "i": "objectives/evasion/process/injection/toolkit::legitimate-injector-patterns", "o": 0, "z": 22, "cf": 1.0 } ], "ln": 0 }, { "b": "f-RgN00000rSAa1s]XK54fcwdIu0RR00000000002lj-700000l\u0026Wh!00000g5}pOjPCDZmf0q/FDbVI0000000000a]?Py00000e=U\u003eK00000000000000000000", "n": [ { "c": 1, "d": "Repeated 0x07 byte constant", "i": "micro-behaviors/mem/protect/modify::repeated-07-byte-constant", "o": 936, "z": 4, "cf": 0.25 } ], "ln": 904 }, { "b": "lU{gLB7Gy)zdNM]AcRB\u003cuVQr$v@2BYxLQ%/BZYr30afkTD2Nt4BywS=0aGCDByG640aGCRzEWu*ASxDNB97\u00262yHpN+yHpWZx(0=UB7fo7w]83@xlm!!vSMN3vpS^DvRGZ\u0026xMs8ZwmYN*By+CYwmY?7A=lj6vPl=IyYE{Yx\u003ehpbASxM\u0026BAg(gC(RqAwNP9HvN+6FyYE{=wPS0nASxMDwPhE1v{%E\u003c0aG[QBAz8mzuaczwP?T9B7CtXnP5PXA=:VZA=R", "n": [ { "c": 3, "d": "Stack protector/canary enabled", "i": "metadata/hardening/build::stack-protector", "o": 5118, "z": 14, "cf": 0.8999999761581421 } ], "ln": 5054 }, { "b": "B7CtXrDQ-Fv@C)?0aG81zEWP}wDlgxl$G\u003eDwmU:Iq/)4(rb3hX0crm5y?mF:B98CmBzkP60aF(rBvga\u003eAZKIGASxMEwPQpMvr8uSq!oDYA+d*WAclm5vS#(?AaJ[!vS#({A+PSbmR)i*xAhH=B60x@By^^WBAdv\u003cvrlH7xkNYUCxl\u0026ax()]My?\u003c2WCxlt%", "n": [ { "c": 2, "d": "Format time as string", "i": "micro-behaviors/time/query::strftime", "o": 5592, "z": 8, "cf": 0.20000000298023224 } ], "ln": 5544 }, { "b": "zddJ{0cSB3Ab]VgBy\u003eIZvrlH7xkRs1A=2lb0aGLUA=2lb0aHaYw]zZbvrt]Ty?Wu*e]$}-f!@-owO#2Uy?Wu/B98CpzF7Oyz.r:AflItRfk$YtfkLui0000000000^6jX[000002MK\u0026800000^6jX[00000d6:@}000002MK\u002680000029n/+00000ii\u003cUb00", "n": [ { "c": 2, "d": "Versioned libc soname or symbol version", "i": "micro-behaviors/dylib/library/libc::libc-version-string", "o": 6436, "z": 9, "cf": 0.800000011920929 } ], "ln": 6388 }, { "b": "nq3mm\u003e.Cx4%44^X2/uSxc1G4p4gi7n000000000000000000000000000000k%^}bmmG^rnLhSHo?[FXqbQs(rArg6sZ2lyv}od.xj#0]yIW\u003c9z/xYpB98LFCx!yVfFLssg=mfIi5@Gx000000uhb500Ao4E/GDGy(!R@90ulw)2}zGl\u003c9F\u0026*(}^rtM+3b?\u0026[9uA0cdvf{I.rGAInPG{qSqTonI6yNCe4*YNPSS*-$/3\u003cuRh/{.%vao.-B37H${gZ9\u003cV", "n": [ { "c": 2, "d": "Hardcoded standard base64 alphabet", "i": "micro-behaviors/data/encode/base64::alphabet-standard", "o": 36896, "z": 64, "cf": 0.5 } ], "ln": 36848 }, { "b": "000000a2N6@@Jf200Fw-0000007PyziV]?*vLYbZfFUBsfFCEnatCM5h7*M.bU?])lq{okay/Clx!AsnB%5H(f^5k9f!+mmi4(%AatC\u0026pfFLQAh6uTLwPzAamr\u0026+]bMG8+wPQmql](D2A=+=4xk8loq.i8mf!Lj7gb7BpfekgmgCx}ai65\u0026OiYe]uyhWW7xcoS/A3czabU?])lq{okay/ClwO#3hq.i8mf!Lg6gb7BpfebvsfGgaei65-FiX@PnyhWW7xcoS/A3czabU?])lq{okay/Clzz1\u003csB%5H(f^5k9f!+mmi4(%AatC\u0026pfFLQAh6uTLwPzAamr\u0026+]bME/A0p!wp00000000000000000\u0026M800\u0026M800\u0026M800\u0026M802\u003e[r0096100000001F#dJ?G8awuiMwO-F=A=lbnwmYo]dK([F0p!wp00000000000000000\u0026M800", "n": [ { "c": 2, "d": "NetBSD base system artifact", "i": "metadata/binary/provenance::netbsd-base-system-artifact", "o": 45659, "z": 8, "cf": 0.949999988079071 }, { "c": 1, "d": "Compact C type format section", "i": "metadata/vendor/identity::sunw-ctf-section", "o": 45884, "z": 9, "cf": 0.949999988079071 } ], "ln": 45611 }, { "b": "0aGUWv}Y[60aFGgvpPure]#qPBywRUe]#bPBywRUe]$YEBAhFivGn2]vrl8Ze[xlBB9RQ5e[xlBB98B5e]\u003eJtvj(8ozu8qfwO+^cAboQ@e[]iqBo0}jy\u0026?pxz/+$iBy/Ys04}\u003e$zFo86A=kF%Byte4wOtB.A:-/@uUA$\u003c04}?@uUjs!zdJY1zF%Sde]ClxvSM6jx\u003eg^)Bo0}hz//LyzE){0B7u[xvr.=8v@#TfA@W?6Bz(hv04@1@ASv.5D2v5cx\u003e4b}xk.(AAboQ@e[wyjve}]\u0026z/6u5zGC\u003ehq=MN]uT[g\u0026000000000000000000000000000000000000000000000000000000000000000000000000000000", "n": [ { "c": 2, "d": "ELF dynamic section name", "i": "metadata/binary/linking/runtime::elf-dynamic-section-name", "o": 52799, "z": 8, "cf": 1.0 }, { "c": 2, "d": "ELF dynstr section name", "i": "metadata/binary/linking/runtime::elf-dynstr-section-name", "o": 52657, "z": 7, "cf": 1.0 }, { "c": 2, "d": "ELF dynsym section name", "i": "metadata/binary/linking/runtime::elf-dynsym-section-name", "o": 52649, "z": 7, "cf": 1.0 } ], "ln": 52601 } ], "depth": 1, "facts": { "exp": [ [ "bsplitstr" ], [ "bseof" ], [ "binstrr" ], [ "bSetChar" ], [ "bassign" ], [ "bstricmp" ], [ "bsplits" ], [ "binsert" ], [ "bYEncode" ], [ "binstr" ], [ "bgets" ], [ "breplace" ], [ "bstrrchrp" ], [ "binsertch" ], [ "bssplitscb" ], [ "bsUuDecode" ], [ "bread" ], [ "bUuDecodeEx" ], [ "bsplit" ], [ "binstrcaseless" ], [ "bReverse" ], [ "bdestroy" ], [ "bninchrr" ], [ "bsunread" ], [ "binstrrcaseless" ], [ "bUuEncode" ], [ "bReplicate" ], [ "bconchar" ], [ "bsplitscb" ], [ "bstrListDestroy" ], [ "bjoin" ], [ "bstr2cstr" ], [ "bwsWriteFlush" ], [ "bsplitcb" ], [ "bwsIsEOF" ], [ "bStrfTime" ], [ "bcatblk" ], [ "bSetCstrChar" ], [ "bFill" ], [ "bvcformata" ], [ "bstrncmp" ], [ "biseqcaseless" ], [ "breada" ], [ "bfindreplace" ], [ "bninchr" ], [ "bdelete" ], [ "brtrimws" ], [ "bInsertChrs" ], [ "bTail" ], [ "bltrimws" ], [ "bwsOpen" ], [ "bconcat" ], [ "bgetsa" ], [ "bJustifyCenter" ], [ "bJustifyLeft" ], [ "bYDecode" ], [ "bsreada" ], [ "biseq" ], [ "bsread" ], [ "bBase64DecodeEx" ], [ "bfromcstralloc" ], [ "bisstemeqcaselessblk" ], [ "bstrcpy" ], [ "bJustifyMargin" ], [ "bstrnicmp" ], [ "bpattern" ], [ "bwsWriteBstr" ], [ "bBase64Encode" ], [ "bwsWriteBlk" ], [ "biseqcstr" ], [ "binchr" ], [ "bstrListCreate" ], [ "bassignblk" ], [ "bfindreplacecaseless" ], [ "bsbufflength" ], [ "bsreadlnsa" ], [ "balloc" ], [ "btolower" ], [ "ballocmin" ], [ "bwsClose" ], [ "bNetStr2Bstr" ], [ "bcstrfree" ], [ "bassigncstr" ], [ "bmidstr" ], [ "bformat" ], [ "bassignformat" ], [ "bstrcmp" ], [ "bsopen" ], [ "bwsBuffLength" ], [ "bspeek" ], [ "bassignmidstr" ], [ "bStr2NetStr" ], [ "bfromcstr" ], [ "bformata" ], [ "btoupper" ], [ "bstrListAlloc" ], [ "bisstemeqblk" ], [ "bssplitstrcb" ], [ "bcatcstr" ], [ "bsclose" ], [ "bstrListAllocMin" ], [ "btrimws" ], [ "btrunc" ], [ "bstrchrp" ], [ "bsreadlna" ], [ "bSecureInput" ], [ "blk2bstr" ], [ "bsetstr" ], [ "bassigngets" ], [ "bsFromBstr" ], [ "bJustifyRight" ], [ "bsplitstrcb" ], [ "bsreadln" ], [ "bsreadlns" ], [ "biseqcstrcaseless" ], [ "binchrr" ], [ "bHead" ] ], "imp": [ [ "", "memcmp" ], [ "", "realloc" ], [ "", "deregister_frame_info" ], [ "", "memset" ], [ "", "malloc" ], [ "", "memmove" ], [ "", "Jv_RegisterClasses" ], [ "", "ctype_tab_" ], [ "", "toupper_tab_" ], [ "", "stack_chk_guard" ], [ "", "cxa_finalize" ], [ "", "register_frame_info" ], [ "", "vsnprintf" ], [ "", "sprintf_chk" ], [ "", "free" ], [ "", "strftime" ], [ "", "memchr" ], [ "", "memcpy" ], [ "", "strlen" ], [ "", "stack_chk_fail" ], [ "", "tolower_tab_" ] ], "sec": [ [ ".hash", 456, 1100, 1.49, "alloc" ], [ ".dynsym", 1560, 3408, 2.48, "alloc" ], [ ".dynstr", 4968, 1513, 4.54, "alloc" ], [ ".rela.dyn", 6488, 312, 1.66, "alloc" ], [ ".rela.plt", 6800, 1320, 1.66, "alloc,info_link" ], [ ".init", 8128, 14, 3.24, "alloc,executable" ], [ ".plt", 8144, 896, 4.15, "alloc,executable" ], [ ".plt.got", 9040, 40, 3.12, "alloc,executable" ], [ ".text", 9088, 27759, 6.41, "alloc,executable" ], [ ".fini", 36848, 14, 3.24, "alloc,executable" ], [ ".rodata", 36864, 97, 5.19, "alloc" ], [ ".eh_frame_hdr", 36964, 1028, 5.06, "alloc" ], [ ".eh_frame", 37992, 5284, 5.21, "alloc" ], [ ".note.netbsd.ident", 43276, 24, 3.0, "alloc" ], [ ".note.netbsd.pax", 43300, 20, 1.56, "alloc" ], [ ".ctors", 44568, 16, 1.0, "write,alloc" ], [ ".dtors", 44584, 16, 1.0, "write,alloc" ], [ ".jcr", 44600, 8, 0.0, "write,alloc" ], [ ".dynamic", 44608, 368, 1.33, "write,alloc" ], [ ".got", 44976, 80, 0.0, "write,alloc" ], [ ".got.plt", 45056, 464, 1.79, "write,alloc" ], [ ".data", 45520, 112, 1.07, "write,alloc" ], [ ".comment", 45632, 27, 3.78, "merge,strings" ], [ ".ident", 45659, 222, 4.7, "merge,strings" ], [ ".SUNW_ctf", 45884, 143, 2.89, "" ], [ ".symtab", 46032, 4704, 2.44, "" ], [ ".strtab", 50736, 1880, 4.75, "" ], [ ".shstrtab", 52616, 226, 4.19, "" ] ], "metrics": { "elf": { "bits": 64.0, "entry": 9088.0, "has_got": 1.0, "has_plt": 1.0, "has_note": 1.0, "has_rpath": 1.0, "relacount": 3.0, "has_symtab": 1.0, "note_count": 2.0, "nx_enabled": 1.0, "dynrel_count": 0.0, "dynsym_count": 142.0, "has_eh_frame": 1.0, "stack_canary": 1.0, "symtab_count": 196.0, "dynrela_count": 13.0, "little_endian": 1.0, "pltreloc_count": 55.0, "executable_stack": 0.0, "wx_segment_count": 0.0, "comment_entry_count": 1.0, "fortify_source_count": 1.0, "program_header_count": 7.0, "comment_distinct_count": 1.0, "gnu_stack_section_absent": 1.0, "load_segment_max_file_size": 43320.0, "stripped_but_symtab_present": 1.0, "load_segment_max_memory_size": 43320.0, "section_relocation_group_count": 2.0, "stripped_metadata_section_count": 5.0 }, "file": { "size": 54704.0, "entropy": 5.7, "size_bytes": 54704.0 }, "binary": { "is_pie": 0.0, "has_overlay": 1.0, "is_stripped": 0.0, "code_entropy": 6.33, "data_entropy": 1.39, "overlay_size": 1862.0, "string_count": 209.0, "overlay_ratio": 0.03, "overall_entropy": 5.7, "overlay_entropy": 1.43, "entropy_variance": 2.84, "avg_string_length": 11.01, "max_string_length": 64.0, "peak_region_bytes": 25600.0, "code_to_data_ratio": 0.96, "peak_region_entropy": 6.3, "string_length_stddev": 8.39, "largest_section_ratio": 0.51, "sentence_string_count": 6.0, "sentence_string_ratio": 0.03, "high_entropy_string_count": 1.0 }, "exports": { "count": 117.0 }, "imports": { "count": 21.0 }, "sections": { "count": 29.0, "code_size": 28723.0, "entropy_max": 6.41, "entropy_mean": 2.89, "name_entropy": 4.14, "writable_count": 7.0, "executable_count": 5.0, "nonstandard_count": 8.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } } }, "id": 2, "path": "libbstring-1.0.1.tgz!!lib/libbstring.so.1.0.0", "pid": 0, "risk": 1, "sha": "ac62336948b943f486f21369681a426a6f9153c02558b0cc90f7cf80f4fac483", "size": 54704, "traits": [ { "id": "metadata/binary/linking/runtime::elf-dynamic-section-name", "conf": 1.0, "crit": 2, "desc": "ELF dynamic section name", "spans": [ [ 52799, 8 ] ] }, { "id": "metadata/binary/layout::shared-object-type", "conf": 1.0, "crit": 2, "desc": "ELF uses ET_DYN object type" }, { "id": "metadata/binary/linking/runtime::elf-dynstr-section-name", "conf": 1.0, "crit": 2, "desc": "ELF dynstr section name", "spans": [ [ 52657, 7 ] ] } ], "type": "elf" } ], "v": "8" } }