{ "ml": { "v": "7", "eng": "2.2.1", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.18228644, "rte": "az", "prob": 0.18228644 }, { "cls": 0, "raw": 0.0003350079, "rte": "az/tar", "prob": 0.0003350079 } ], "prob": 0.3266849, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.3266848921775818, "type": "pkg_arch" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.18228644132614136, "type": "elf" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.3266848921775818, "type": "text" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.00012001395225524902, "type": "text" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.0014469921588897705, "type": "text" }, { "id": 5, "lvl": -1, "conf": 0, "prob": 0.00020629167556762695, "type": "registry" } ], "version": "v18.18", "analyzed_at": "2026-07-09T10:29:06Z" }, "path": "vivaldi-ffmpeg-codecs-150.0.7871.113-1-x86_64.pkg.tar.zst", "raw": { "files": [ { "id": 0, "ctx": [ { "b": "d77-b1Bb\u003e$0e:)*5\u003c76r\u003cn(sEfERn1V.JA.vr+\u003eU4i-XA2{Orp!#U1?p\u003eQUmW\u003cir5.jlE7d\u003cL+k86[T6VAq:Z9Met]yZ6}r00rmF\u003cMz%8dd%izd/", "n": [ { "c": 2, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "o": 0, "z": 1, "cf": 1.0 } ], "ln": 0 } ], "mol": "H(Po)Md(He)", "sha": "4522bf6961cde86d37cc92172e83643a0569ef9272bc08cee331d89bd909cf31", "path": "/data/samples/unknown/foraged/arch/archlinux.org/_/vivaldi-ffmpeg-codecs/vivaldi-ffmpeg-codecs-150.0.7871.113-1-x86_64.pkg.tar.zst", "risk": 2, "size": 1279015, "type": "pkg_arch", "facts": { "metrics": { "file": { "size": 1279015.0, "entropy": 8.0, "size_bytes": 1279015.0 }, "parse": { "error_count": 1.0 }, "binary": { "overall_entropy": 8.0, "peak_region_bytes": 1278976.0, "peak_region_entropy": 7.86 } } }, "traits": [ { "id": "micro-behaviors/dylib/library/family::vdpau-ref", "conf": 0.8999999761581421, "crit": 2, "desc": "VDPAU video acceleration library", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/control/prctl::prctl-symbol", "conf": 0.8999999761581421, "crit": 3, "desc": "prctl process-control syscall symbol", "from": [ { "file": 1 } ] }, { "id": "well-known/lib/ffmpeg::ffmpeg-av-free", "conf": 0.8999999761581421, "crit": 1, "desc": "FFmpeg av_free symbol", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/dylib/library/libc::libc-characteristic-cxa-finalize", "crit": 2, "desc": "libc characteristic cxa finalize", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/dylib/library/libc::libc-internal-functions-b", "conf": 0.699999988079071, "crit": 2, "desc": "libc internal symbols cluster B", "from": [ { "file": 1 } ] }, { "id": "metadata/package/files/system-package::arch-pkgver-field", "conf": 0.9399999976158142, "crit": 1, "desc": "Arch pkgver metadata field", "from": [ { "file": 2 } ] }, { "id": "metadata/package/files/system-package::arch-makepkg-generated", "conf": 0.9599999785423279, "crit": 1, "desc": "Arch makepkg generated metadata", "from": [ { "file": 2 } ] }, { "id": "metadata/package/files/system-package::arch-package-arch-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Arch package architecture field", "from": [ { "file": 2 } ] }, { "id": "metadata/package/files/system-package::arch-pkgname-field", "conf": 0.9399999976158142, "crit": 1, "desc": "Arch pkgname metadata field", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/dylib/library/family::video-lib-marker", "conf": 0.8999999761581421, "crit": 2, "desc": "Video acceleration library markers (VA-API, VDPAU)", "from": [ { "file": 1 } ] }, { "id": "metadata/hardening/missing::stripped-binary", "conf": 0.800000011920929, "crit": 3, "desc": "No full symbol table (likely stripped)", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/dylib/library/family::graphics-lib-marker", "conf": 0.6000000238418579, "crit": 2, "desc": "Graphics/OpenGL library markers", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/dylib/library/abi-graphics::cxx-abi-symbols-a", "conf": 0.800000011920929, "crit": 2, "desc": "C++ ABI symbols cluster A", "from": [ { "file": 1 } ] }, { "id": "well-known/lib/ffmpeg::ffmpeg-av-malloc", "conf": 0.8999999761581421, "crit": 1, "desc": "FFmpeg av_malloc symbol", "from": [ { "file": 1 } ] } ] }, { "ctx": [ { "b": "E))420S-r400000000000@$H+0rr910000000000kMy=:00000fU]QD0000000000kMA+z3JJA(82$GN0rr911o", "n": [ { "c": 3, "d": "Recognized PE anti-analysis marker", "i": "objectives/anti-analysis/debugger-detect/combined-checks::evasion-aware-recognized-pe-marker", "o": 0, "z": 21, "cf": 1.0 } ], "ln": 0 }, { "b": "uT[s?uUj1\u0026vqGU7wDl7AB97\u00262yHpN+yHpWZx(0=^wO\u003e{@C(R\u003e@vqG:#v/P}Xv@C)?v{-?ZzE^9+wN+", "n": [ { "c": 3, "d": "Stack protector/canary enabled", "i": "metadata/hardening/build::stack-protector", "o": 5087, "z": 14, "cf": 0.8999999761581421 } ], "ln": 5071 }, { "b": "B7ol8Acc2suV6C1Bo2VPzdNM]AcU/2xLNPRC4kD3wN/7^vrb^[wPRH7B6\u003c3cuT[1(By/Ys0axtPA=.q2BzbYavpS.ZB-.htuU\u003cT\u003cyxer}xMvV)wm5?+zE-", "n": [ { "c": 3, "d": "FORTIFY_SOURCE hardening enabled", "i": "metadata/hardening/build::fortify", "o": 5244, "z": 10, "cf": 0.8500000238418579 }, { "c": 2, "d": "Abort program execution", "i": "micro-behaviors/os/signal/handler::abort", "o": 5285, "z": 5, "cf": 0.8999999761581421 } ], "ln": 5228 }, { "b": "wm6g@By/Y7wmY?7A=lj6Acb=lwNPaRv@=c?By+C\u003eBzbYavpS.Pz/f8)wmY?7A=lj6vrMd0wmYmTz/t", "n": [ { "c": 2, "d": "pthread threading library", "i": "micro-behaviors/process/threading/concurrency::pthread", "o": 5516, "z": 14, "cf": 0.5 } ], "ln": 5500 }, { "b": "wN/7VA+e/?v@DmbwQ5p%wQ5eHw=M)^zEWQaw=Mm.v@C)?v{-UXy\u0026r/\u003cv@DmbwQ5qM00", "n": [ { "c": 3, "d": "Network-capable library profile", "i": "objectives/supply-chain/trojanized/backdoor::network-library-profile", "o": 5637, "z": 5, "cf": 0.8999999761581421 } ], "ln": 5621 }, { "b": "0af8OzG6SgzGGF$v}YSTAb]DgyYE)!v@C)?v{-UXx\u003eIr\u003cwnb)(zGxJgzGvMkvrMd0wb", "n": [ { "c": 4, "d": "Uses prctl to manipulate process state", "i": "objectives/evasion/masquerade/process/rename::prctl-setname", "o": 5810, "z": 5, "cf": 0.800000011920929 } ], "ln": 5794 }, { "b": "wPRo%vqPMQy?da4AaP8UByx4!Acb=lwNPaRyhW*70cq\u003c(w=MsIA=+)[AbP@j0af7", "n": [ { "c": 1, "d": "libm tan import", "i": "micro-behaviors/dylib/library/libm::libm-tan-symbol", "o": 5892, "z": 3, "cf": 0.4000000059604645 } ], "ln": 5876 }, { "b": "0crm5zEWK50cq\u003c(v@Dz*v@c6[yHpZ=BAzklwDl7AwPz*ez^Ns0v{%E[z/bL)vqZ18y?mf%0ay4+z^M{?y\u0026r/\u003cv@DmbwQ5p%vrMv6uT)[\u003cB7Ct)", "n": [ { "c": 2, "d": "Get time from specified clock", "i": "micro-behaviors/time/query::clock_gettime", "o": 5962, "z": 13, "cf": 0.30000001192092896 }, { "c": 2, "d": "Delays execution (sleep/nanosleep)", "i": "objectives/anti-analysis/timing/evasion::delay-capability", "o": 5993, "z": 9, "cf": 0.5 } ], "ln": 5946 }, { "b": "A=2lbuVf){zEm9}Aclm5xjVgbx(dB1w[ks}0crm5A:@^60ay4TA+eV\u0026uUjs!zdJYQC4LVkzddJ[", "n": [ { "c": 2, "d": "Get current time with microsecond precision", "i": "micro-behaviors/time/query::gettimeofday", "o": 6103, "z": 12, "cf": 0.30000001192092896 } ], "ln": 6087 }, { "b": "z/PY6Byfi5A=U@kzuao?wQ5d]w]8y7ASxDNB98CjAcU/2xLNPRC4LVkzddJ[vqG:#v{-.:zGGDmBo2@\u003cBzkP6uVDc/BAg#nx(dzYB98CzBAdv\u0026C3/r4wOUT+A:-/@0aPCNy\u0026r!-xNaMnBo3e?zdvm10af8RB8C@qx(n38uT)++0ay4TxjVf(v/", "n": [ { "c": 2, "d": "FORTIFY_SOURCE strcpy bounds check", "i": "metadata/hardening/build::strcpy-chk", "o": 6232, "z": 10, "cf": 0.8500000238418579 }, { "c": 2, "d": "Convert time to UTC time", "i": "micro-behaviors/time/query::gmtime", "o": 6266, "z": 8, "cf": 0.20000000298023224 }, { "c": 2, "d": "Format time as string", "i": "micro-behaviors/time/query::strftime", "o": 6275, "z": 8, "cf": 0.20000000298023224 }, { "c": 1, "d": "libm exp import", "i": "micro-behaviors/dylib/library/libm::libm-exp-symbol", "o": 6220, "z": 3, "cf": 0.4000000059604645 }, { "c": 1, "d": "libm hypot import", "i": "micro-behaviors/dylib/library/libm::libm-hypot-symbol", "o": 6312, "z": 5, "cf": 0.4000000059604645 } ], "ln": 6204 }, { "b": "v/P}XuUjs!zdN6^A+e!ZvrM0\u0026A:-/@uT)[\u003czE\u0026/RC3!\u003c4wN$\u003cNwn=A#zua-?BARbow=MB-wNP9Hw[bT}B7Ct)BAhFwB.?50BAhFwwb{aQz!0L.vrM0{vqG:#v/P}XuU1C1vqPZ*uUA$\u003cuVQ76By^iYiw+8KAbWWwBn", "n": [ { "c": 3, "d": "Recognized media codec/engine library (FFmpeg or VideoLAN)", "i": "well-known/lib/videolan::media-codec-lib", "o": 6583, "z": 7, "cf": 0.949999988079071 }, { "c": 2, "d": "Generic file read/write operations", "i": "micro-behaviors/fs/file/read-write::binary-file-ops", "o": 6606, "z": 5, "cf": 0.800000011920929 }, { "c": 2, "d": "Process forking", "i": "micro-behaviors/process/fork/clone::fork", "o": 6568, "z": 14, "cf": 0.6600000262260437 }, { "c": 2, "d": "FFmpeg/Libav multimedia library marker", "i": "well-known/lib/ffmpeg::ffmpeg-lib-marker", "o": 6640, "z": 9, "cf": 0.949999988079071 } ], "ln": 6552 }, { "b": "y*Ru%A=U@kzuaY}B-7Z\u0026AbP}2vrt{}g5#xfzFf2Wz/YN(Byx620axwQA@YS\u0026x(i]!z!x5ZvpBoTz/xo9hz+zCv@uy8hz+zIx\u003c${iB8JV?0bMvUv\u003eI?ve\u0026AY1oI4MruOTk\u0026h2{cunKt^Kga\u003esx07PZOlpk9ne\u00262u=m[=Gv", "n": [ { "c": 2, "d": "libc version string pattern", "i": "micro-behaviors/dylib/library/libc::libc-version-string", "o": 6943, "z": 5, "cf": 0.800000011920929 }, { "c": 2, "d": "Open files (legacy 64-bit)", "i": "micro-behaviors/fs/file/open::open64", "o": 6908, "z": 6, "cf": 0.6600000262260437 }, { "c": 1, "d": "libm cos import", "i": "micro-behaviors/dylib/library/libm::libm-cos-symbol", "o": 6890, "z": 3, "cf": 0.4000000059604645 }, { "c": 1, "d": "libm pow import", "i": "micro-behaviors/dylib/library/libm::libm-pow-symbol", "o": 6864, "z": 3, "cf": 0.4000000059604645 }, { "c": 1, "d": "libm sin import", "i": "micro-behaviors/dylib/library/libm::libm-sin-symbol", "o": 6895, "z": 3, "cf": 0.4000000059604645 } ], "ln": 6848 }, { "b": "0000+.rz+654ieZm?r3p4/$3BiP9gln5QlM2\u003cG[j%nOg%(k8.%WHr{u54iC]0MWU?\u00266v(z", "n": [ { "c": 2, "d": "XGETBV instruction bytes", "i": "metadata/binary/instruction::xgetbv-instr", "o": 211677, "z": 8, "cf": 0.30000001192092896 } ], "ln": 211661 }, { "b": "Gw^4CWIfLb\u0026\u003eT*:iQ^Ms1R?1qGtmHVGtvNWIt]\u003e#{k8f.xHdCK%4LJ3B\u003c07c.hl0+.A(351b2L", "n": [ { "c": 1, "d": "DJB2 hash algorithm constant (5381)", "i": "objectives/anti-static/obfuscation/imports::djb2-hash-constant", "o": 498775, "z": 11, "cf": 0.75 } ], "ln": 498759 }, { "b": "0000000000000000027YlVl{?A+Pf1Bn#pv0000000000000000000000000N1v+Kx\u003eyySAS", "n": [ { "c": 2, "d": "Copyright notice", "i": "metadata/package/license::copyright-word", "o": 2714776, "z": 9, "cf": 0.6000000238418579 } ], "ln": 2714760 }, { "b": "vSMc*y?W%jc\u0026^:}wmYmTCw7YjwO=74Bo1D7pJyeXzGGrex(v\u003e?vSMc*y?W%j0ax?=y?Wx/Bn", "n": [ { "c": 1, "d": "Allow-list vocabulary", "i": "objectives/credential-access/shell/history::allow-list-vocabulary", "o": 2717780, "z": 9, "cf": 0.30000001192092896 } ], "ln": 2717764 }, { "b": "vR2K+B-}gIg=feahF=}8C4tM2BPuViDndf\u003ewDl$2Dndf:wDlQ\u003ef/x2HB$$:/wDlQ\u003eg5", "n": [ { "c": 3, "d": "Terminal socket exec helper context", "i": "micro-behaviors/process/fd/dup::unix-terminal-socket-exec-benign-context", "o": 2720640, "z": 5, "cf": 0.949999988079071 } ], "ln": 2720624 }, { "b": "e?^n(o\u00268@Xs7#L.z*cmBvqYP#pG5]4ayY5bzddxj0aQ7Wwb[#9zbUL0wnb@ZzeBB", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 2723617, "z": 3, "cf": 0.800000011920929 } ], "ln": 2723601 }, { "b": "wnc6)v/O]hA:-CTvRfrOlumi\u003cwGTDXA:@V6clL()zF%M7zEWkTmqMKBBAhqqx\u003e5nKAS", "n": [ { "c": 1, "d": "Brute force reference", "i": "objectives/command-and-control/channel/p2p::brute-str", "o": 2724318, "z": 5, "cf": 1.0 } ], "ln": 2724302 }, { "b": "p?:AYz/NHclM/ilx(n1)vqZd206%KJnL7N3pe:.bvrcC\u0026vkY@HzfoVpx-IN1g*+9x", "n": [ { "c": 1, "d": "Terminal type ansi identifier", "i": "micro-behaviors/process/tty/terminal::terminal-type-ansi", "o": 2724875, "z": 4, "cf": 0.800000011920929 } ], "ln": 2724859 }, { "b": "azCX3xjR6ey\u00260/]zEWl2w]zYjpJf(.awDATx\u003c\u0026bIrXTO-x([r5v@2T^077ywAa9k", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 2726692, "z": 3, "cf": 0.800000011920929 } ], "ln": 2726676 }, { "b": "wmY^}C4Chov/QjMByPm\u0026x(FeCv\u003e[4fv}Pp\u0026ePLz5D1gF%z.l0F0aH4bh.Y7Gy?W=#vr8", "n": [ { "c": 2, "d": "C2/trojan tooling name suffix (e.g. havoc-c2)", "i": "objectives/command-and-control/backdoor/keywords::malware-infrastructure-suffix", "o": 2733788, "z": 6, "cf": 1.0 } ], "ln": 2733772 }, { "b": "Bye@@v%8:0zEW}(B7GCoBzbkdzGP/9wPw]iw/#heA+eV\u0026A@Z90B7GK}zGx(gaA}w", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 2737393, "z": 3, "cf": 0.800000011920929 } ], "ln": 2737377 }, { "b": "xcqqwAaG2\u003cy?Wx\u003c0ay1Xx(vv1wPz%dv}x1?D2Nr{vrD9{zY\u003cajA=#ebwGV8uAaG2zvqfQ4l3i", "n": [ { "c": 2, "d": "io_service class", "i": "micro-behaviors/os/event/library/boost-asio::io-service", "o": 2739007, "z": 10, "cf": 0.4000000059604645 } ], "ln": 2738991 }, { "b": "By/o5B94z3A=l5rv@Df\u003cvR/E.yIWZaBo3u9uVZ10wP8Zk098]\u003clVl\u003c:wQ5p%zeTOGze.r.z2", "n": [ { "c": 1, "d": "Blocklist vocabulary", "i": "objectives/credential-access/shell/history::blocklist-vocabulary", "o": 2739912, "z": 9, "cf": 0.30000001192092896 } ], "ln": 2739896 }, { "b": "vqZi@A^mT]x\u003e}p3xK$YOfjXTqflIqzzE^W505cb.gC*%Eh-J/-lpjdfmQY+owmYuMBAhIn0a]UQ", "n": [ { "c": 2, "d": "Access /dev/urandom", "i": "micro-behaviors/os/random/crypto::urandom", "o": 2747669, "z": 12, "cf": 1.0 } ], "ln": 2747653 }, { "b": "avGTWve%HTwl/f/at3}2l3mo.wO#Q7v)J*S07QQrB.L-8nP5SYyYE)MA@Zo3B.L]g0b2..B8}s#z!5\u0026VAr6S[wDlv+00", "n": [ { "c": 2, "d": "AuthenticAMD CPU vendor string", "i": "micro-behaviors/os/sysinfo/hardware::cpu-vendor-authenticamd", "o": 2753141, "z": 12, "cf": 0.4000000059604645 }, { "c": 2, "d": "GenuineIntel CPU vendor string", "i": "micro-behaviors/os/sysinfo/hardware::cpu-vendor-genuineintel", "o": 2753154, "z": 12, "cf": 0.4000000059604645 } ], "ln": 2753125 }, { "b": "w[ry\u003e0000006$WEB.$XjBzbxfaB2U1g:3%MA=U@kzxJU9az#9uCRRflaA?spB7]Mg", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 2753935, "z": 4, "cf": 0.800000011920929 } ], "ln": 2753919 }, { "b": "avy6TwN=\u0026Rx\u003c#9\u003eA^o8Rt1?HO000000000@B.Lu3rb3hXavf)VzddK2z/cWCqCoId", "n": [ { "c": 3, "d": "Benign socket shell helper context", "i": "micro-behaviors/process/fd/dup::posix-fd-redirect-shell-benign-context", "o": 2754741, "z": 4, "cf": 0.9399999976158142 } ], "ln": 2754725 }, { "b": "c}n2YB7=XtwPz\u003caz/d9GCwhejayP89xKJ2[xKL^@wO-^}00000nP5SYy-(q!wmYW4", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 2755208, "z": 4, "cf": 0.800000011920929 } ], "ln": 2755192 }, { "b": "v@Dmax\u003eg^}aARphzFa2kBzb98aA?Eqy*?A%aARpdaAIHkv\u003en:hA+cw9vrlJkBz\u0026pi", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 2763680, "z": 4, "cf": 0.800000011920929 } ], "ln": 2763664 }, { "b": "00000000000000000000k%^}bmmG^rnLhSHo?[FXqbQs(rArg6sZ2lyv}od.xj#0]yIW\u003c9z/xYpB98LFCx!yVfFLssg=mfIi5@Gx0000000000000000000000000000000000000000", "n": [ { "c": 2, "d": "Hardcoded standard base64 alphabet", "i": "micro-behaviors/data/encode/base64::alphabet-standard", "o": 3171488, "z": 64, "cf": 0.5 } ], "ln": 3171472 }, { "b": "y?bbiwb[k{zGNNBvrl8Ze[xlBB9RQ5e[xlBB98B5e[Y6Ae{p/DB7]Mg04}]4BUm\u0026GA=U@kzEmz:e]\u003eI", "n": [ { "c": 2, "d": "ELF dynstr section name", "i": "metadata/binary/linking/static::elf-dynstr-section-name", "o": 3522663, "z": 7, "cf": 0.8999999761581421 }, { "c": 2, "d": "ELF dynsym section name", "i": "metadata/binary/linking/static::elf-dynsym-section-name", "o": 3522655, "z": 7, "cf": 0.8999999761581421 } ], "ln": 3522639 }, { "b": "vr?\u00269wmoN*e]\u003eJte]\u003e\u003ege[xlBvqPZ*04}]5Bo0}7vrt]Te[e)y04}=1zeA\u003c4Bn#pv00000", "n": [ { "c": 2, "d": "ELF dynamic section name", "i": "metadata/binary/linking/static::elf-dynamic-section-name", "o": 3522825, "z": 8, "cf": 0.8999999761581421 } ], "ln": 3522809 } ], "depth": 1, "facts": { "exp": [ [ "av_frame_unref" ], [ "av_dict_count" ], [ "avcodec_alloc_context3" ], [ "ff_h264_decode_init_vlc" ], [ "av_image_check_size" ], [ "av_free" ], [ "av_new_packet" ], [ "avcodec_open2" ], [ "av_packet_alloc" ], [ "av_get_cpu_flags" ], [ "avutil_version" ], [ "avcodec_flush_buffers" ], [ "avcodec_find_decoder" ], [ "av_force_cpu_flags" ], [ "avcodec_send_packet" ], [ "av_frame_alloc" ], [ "av_dict_get" ], [ "av_dict_set" ], [ "avcodec_descriptor_next" ], [ "avformat_version" ], [ "avcodec_get_name" ], [ "av_stream_get_first_dts" ], [ "av_samples_get_buffer_size" ], [ "av_packet_free" ], [ "avformat_find_stream_info" ], [ "av_frame_free" ], [ "av_strerror" ], [ "av_malloc" ], [ "avio_alloc_context" ], [ "av_packet_get_side_data" ], [ "avcodec_parameters_to_context" ], [ "av_dict_free" ], [ "avio_close" ], [ "avformat_free_context" ], [ "avcodec_receive_frame" ], [ "avcodec_descriptor_get" ], [ "av_strdup" ], [ "av_buffer_get_opaque" ], [ "avcodec_free_context" ], [ "av_seek_frame" ], [ "avformat_open_input" ], [ "avformat_close_input" ], [ "av_dynamic_hdr_smpte2094_app5_to_t35" ], [ "av_packet_copy_props" ], [ "av_max_alloc" ], [ "avformat_alloc_context" ], [ "avcodec_align_dimensions2" ], [ "av_packet_unref" ], [ "av_rescale_q" ], [ "av_get_bytes_per_sample" ], [ "av_init_packet" ], [ "av_log_set_level" ], [ "av_buffer_create" ], [ "avcodec_align_dimensions" ], [ "av_read_frame" ], [ "av_frame_clone" ] ], "imp": [ [ "", "pthread_join" ], [ "", "pthread_cond_destroy" ], [ "", "sincosf" ], [ "", "atan2" ], [ "", "powf" ], [ "", "frexp" ], [ "", "tanh" ], [ "", "memset" ], [ "", "snprintf" ], [ "", "posix_memalign" ], [ "", "abort" ], [ "", "exp" ], [ "", "memchr" ], [ "", "tan" ], [ "", "clock_gettime" ], [ "", "gmon_start__" ], [ "", "pthread_cond_signal" ], [ "", "isoc99_sscanf" ], [ "", "prctl" ], [ "", "gettimeofday" ], [ "", "setvbuf" ], [ "", "strncmp" ], [ "", "malloc" ], [ "", "memcpy_chk" ], [ "", "cos" ], [ "", "pthread_once" ], [ "", "pthread_mutex_init" ], [ "", "vsnprintf_chk" ], [ "", "hypot" ], [ "", "ITM_deregisterTMCloneTable" ], [ "", "pthread_create" ], [ "", "log" ], [ "", "free" ], [ "", "ldexpf" ], [ "", "atan" ], [ "", "strlen" ], [ "", "ITM_registerTMCloneTable" ], [ "", "pthread_cond_init" ], [ "", "cosh" ], [ "", "cxa_finalize" ], [ "", "log2f" ], [ "", "asin" ], [ "", "fdopen" ], [ "", "strrchr" ], [ "", "gmtime_r" ], [ "", "open64" ], [ "", "strstr" ], [ "", "strtol" ], [ "", "sched_getaffinity" ], [ "", "exp2" ], [ "", "fabs" ], [ "", "fcntl64" ], [ "", "strcpy_chk" ], [ "", "strspn" ], [ "", "memmove" ], [ "", "strchr" ], [ "", "cbrtf" ], [ "", "fread" ], [ "", "errno_location" ], [ "", "qsort" ], [ "", "clock" ], [ "", "sincos" ], [ "", "stack_chk_fail" ], [ "", "strcmp" ], [ "", "acos" ], [ "", "nanosleep" ], [ "", "pthread_cond_wait" ], [ "", "exp2f" ], [ "", "memcmp" ], [ "", "calloc" ], [ "", "xpg_strerror_r" ], [ "", "fclose" ], [ "", "sched_cpucount" ], [ "", "strtoull" ], [ "", "strcspn" ], [ "", "round" ], [ "", "snprintf_chk" ], [ "", "strtoll" ], [ "", "pthread_mutex_lock" ], [ "", "realloc" ], [ "", "floor" ], [ "", "sinf" ], [ "", "pthread_mutex_destroy" ], [ "", "pthread_cond_broadcast" ], [ "", "strftime" ], [ "", "pow" ], [ "", "strtoul" ], [ "", "pthread_mutex_unlock" ], [ "", "memcpy" ], [ "", "sin" ], [ "", "strtod" ], [ "", "sinh" ] ], "sec": [ [ ".note.gnu.build-id", 680, 36, 4.25, "alloc" ], [ ".gnu.hash", 720, 700, 4.42, "alloc" ], [ ".dynsym", 1424, 3576, 1.89, "alloc" ], [ ".dynstr", 5000, 2104, 4.67, "alloc" ], [ ".gnu.version", 7104, 298, 2.22, "alloc" ], [ ".gnu.version_r", 7408, 272, 3.28, "alloc" ], [ ".rela.dyn", 7680, 2208, 1.8, "alloc" ], [ ".relr.dyn", 9888, 2496, 5.52, "alloc" ], [ ".init", 16384, 27, 4.31, "alloc,executable" ], [ ".text", 16448, 2694572, 6.54, "alloc,executable" ], [ ".fini", 2711020, 13, 3.24, "alloc,executable" ], [ ".rodata", 2711552, 487568, 7.11, "alloc" ], [ ".eh_frame_hdr", 3199120, 19892, 6.14, "alloc" ], [ ".eh_frame", 3219016, 142680, 5.75, "alloc" ], [ ".note.gnu.property", 3361696, 32, 1.81, "alloc" ], [ ".init_array", 3365744, 8, 1.3, "write,alloc" ], [ ".fini_array", 3365752, 8, 1.55, "write,alloc" ], [ ".data.rel.ro", 3365760, 153256, 2.06, "write,alloc" ], [ ".dynamic", 3519016, 496, 1.48, "write,alloc" ], [ ".got", 3519512, 3032, 2.41, "write,alloc" ], [ ".data", 3522560, 28, 1.73, "write,alloc" ], [ ".comment", 3522588, 27, 3.75, "merge,strings" ], [ ".shstrtab", 3522615, 244, 4.18, "" ] ], "metrics": { "elf": { "bits": 64.0, "entry": 0.0, "has_got": 1.0, "has_plt": 0.0, "has_note": 1.0, "note_count": 2.0, "nx_enabled": 1.0, "has_dt_relr": 1.0, "dynrel_count": 0.0, "dynsym_count": 149.0, "has_build_id": 1.0, "has_eh_frame": 1.0, "has_gnu_hash": 1.0, "stack_canary": 1.0, "symtab_count": 0.0, "dynrela_count": 92.0, "has_cet_shstk": 1.0, "little_endian": 1.0, "dt_flags_1_raw": 1.0, "pltreloc_count": 0.0, "build_id_length": 20.0, "dt_versym_count": 149.0, "executable_stack": 0.0, "fini_array_count": 1.0, "init_array_count": 1.0, "wx_segment_count": 0.0, "comment_entry_count": 1.0, "fortify_source_count": 4.0, "program_header_count": 11.0, "comment_distinct_count": 1.0, "gnu_stack_section_absent": 0.0, "load_segment_max_file_size": 2694649.0, "stripped_but_symtab_present": 0.0, "load_segment_max_memory_size": 2694649.0, "section_relocation_group_count": 1.0, "stripped_metadata_section_count": 7.0 }, "file": { "size": 3524464.0, "entropy": 6.63, "size_bytes": 3524464.0 }, "binary": { "is_pie": 0.0, "has_overlay": 1.0, "is_stripped": 1.0, "code_entropy": 6.54, "data_entropy": 2.07, "overlay_size": 1605.0, "string_count": 4541.0, "overlay_ratio": 0.0, "overall_entropy": 6.63, "overlay_entropy": 1.63, "entropy_variance": 3.11, "avg_string_length": 20.41, "max_string_length": 32827.0, "peak_region_bytes": 63488.0, "code_to_data_ratio": 0.95, "peak_region_entropy": 7.85, "string_length_stddev": 487.07, "largest_section_ratio": 0.76, "sentence_string_count": 791.0, "sentence_string_ratio": 0.17, "high_entropy_string_count": 4.0 }, "exports": { "count": 56.0 }, "imports": { "count": 92.0 }, "sections": { "count": 25.0, "code_size": 2694612.0, "entropy_max": 7.11, "entropy_mean": 3.54, "name_entropy": 4.13, "writable_count": 7.0, "executable_count": 3.0, "nonstandard_count": 5.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 2.0 } } }, "id": 1, "mol": "H(Po)Md(He)", "path": "/data/samples/unknown/foraged/arch/archlinux.org/_/vivaldi-ffmpeg-codecs/vivaldi-ffmpeg-codecs-150.0.7871.113-1-x86_64.pkg.tar.zst!!opt/vivaldi/libffmpeg.so.8.1", "pid": 0, "risk": 2, "sha": "e6c4c8b7c6c2757cb1f71afbef6dfb07aaaaee736b654f0e2c6445c8a93c5624", "size": 3524464, "traits": [ { "id": "micro-behaviors/process/control/prctl::prctl-symbol", "conf": 0.8999999761581421, "crit": 3, "desc": "prctl process-control syscall symbol", "spans": [ [ 5810, 5 ] ] }, { "id": "well-known/lib/ffmpeg::ffmpeg-av-free", "conf": 0.8999999761581421, "crit": 1, "desc": "FFmpeg av_free symbol", "spans": [ [ 6583, 7 ] ] }, { "id": "well-known/lib/ffmpeg::ffmpeg-av-malloc", "conf": 0.8999999761581421, "crit": 1, "desc": "FFmpeg av_malloc symbol", "spans": [ [ 6640, 9 ] ] }, { "id": "micro-behaviors/dylib/library/family::vdpau-ref", "conf": 0.8999999761581421, "crit": 2, "desc": "VDPAU video acceleration library", "spans": [ [ 2720640, 5 ] ] }, { "id": "metadata/hardening/missing::stripped-binary", "conf": 0.800000011920929, "crit": 3, "desc": "No full symbol table (likely stripped)", "spans": [ [ 0, 25 ] ] }, { "id": "micro-behaviors/dylib/library/family::video-lib-marker", "conf": 0.8999999761581421, "crit": 2, "desc": "Video acceleration library markers (VA-API, VDPAU)", "spans": [ [ 2720640, 5 ] ] }, { "id": "micro-behaviors/dylib/library/family::graphics-lib-marker", "conf": 0.6000000238418579, "crit": 2, "desc": "Graphics/OpenGL library markers", "spans": [ [ 2720640, 5 ] ] } ], "type": "elf" }, { "ctx": [ { "b": "boPG/zE)\u0026%By!#9vTf8kvqxB[yIa+Ge?[$j", "n": [ { "c": 2, "d": "Arch package metadata manifest", "i": "metadata/package/files/system-package::arch-pkginfo-manifest", "o": 0, "z": 23, "cf": 0.9700000286102295 } ], "ln": 1, "addr": 0 }, { "b": "boRbIx(mMaw)]E^A=k(raA?spB7]MgatCG8h.D\u0026", "ln": 2, "addr": 29 }, { "b": "Abf97vqPM#jS[]ZC42h$x!r}eze:60eN@ZfwN/=", "n": [ { "c": 1, "d": "Arch pkgname metadata field", "i": "metadata/package/files/system-package::arch-pkgname-field", "o": 61, "z": 31, "cf": 0.9399999976158142 } ], "ln": 3, "addr": 61 }, { "b": "Abf8}vrl05jS[]ZC42h$x!r}eze:60eN@ZfwN/=", "ln": 4, "addr": 93 }, { "b": "CW$l8vivYQAbf9dD2NsTAbf7", "ln": 5, "addr": 125 }, { "b": "Abf9fwPw[RatC-ce?![pi5-MAf!\u003eEof-", "n": [ { "c": 1, "d": "Arch pkgver metadata field", "i": "metadata/package/files/system-package::arch-pkgver-field", "o": 145, "z": 25, "cf": 0.9399999976158142 } ], "ln": 6, "addr": 145 }, { "b": "Abf8%wPIu7jS[fzwncd1z/f01aAIWAAbP=sazbLjaAhvtAb]V7Byxinay/t2wN/^7w]zYjC4(bdy?dk", "ln": 7, "addr": 171 }, { "b": "B-IpvjS[AWBz#pZfe3*GA=k/eB.@:zz/oo8wPI^jA:@Vkv@Diqv}Y[3ze1cffly(wA+5J@vrcEnfj[*kAaJU", "ln": 8, "addr": 235 }, { "b": "Aa9l(vp%d(auZ\u0026syH[RRwP\u00260dwmY^7jzwOxe[wKpz!@@}AZj5Nv}YW)zGQgRz/PFO", "ln": 10, "addr": 326 }, { "b": "B7]@iauZ\u00266h8m0Bhz+", "ln": 11, "addr": 379 }, { "b": "vrb\u003c\u003eauZ\u0026(i5Ub4gY", "n": [ { "c": 1, "d": "Arch package architecture field", "i": "metadata/package/files/system-package::arch-package-arch-field", "o": 394, "z": 13, "cf": 0.8999999761581421 } ], "ln": 12, "addr": 394 }, { "b": "y?Wx\u003czGxwijS)A*p!SC@e?[}@AXh9oBy/E", "ln": 13, "addr": 408 }, { "b": "wmYZ\u003ezE:\u003eMazkI8vQ/", "ln": 14, "addr": 436 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 486.0, "entropy": 5.02, "size_bytes": 486.0 }, "binary": { "overall_entropy": 5.02, "peak_region_bytes": 486.0, "peak_region_entropy": 5.02 } } }, "id": 2, "path": "/data/samples/unknown/foraged/arch/archlinux.org/_/vivaldi-ffmpeg-codecs/vivaldi-ffmpeg-codecs-150.0.7871.113-1-x86_64.pkg.tar.zst!!.PKGINFO", "risk": 1, "sha": "6b3f36d076eadaa5cdb7b0c4bd174f69d4e8f57fb3c8d99d800fbed605d954a7", "size": 486, "traits": [ { "id": "metadata/package/files/system-package::arch-makepkg-generated", "conf": 0.9599999785423279, "crit": 1, "desc": "Arch makepkg generated metadata", "spans": [ [ 0, 23 ] ] }, { "id": "metadata/package/files/system-package::arch-package-arch-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Arch package architecture field", "spans": [ [ 394, 13 ] ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-package-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package name field", "spans": [ [ 61, 31 ] ] }, { "id": "metadata/package/files/system-package::arch-pkgname-field", "conf": 0.9399999976158142, "crit": 1, "desc": "Arch pkgname metadata field", "spans": [ [ 61, 31 ] ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-basename", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package info file" }, { "id": "metadata/package/files/system-package::arch-pkgver-field", "conf": 0.9399999976158142, "crit": 1, "desc": "Arch pkgver metadata field", "spans": [ [ 145, 25 ] ] }, { "id": "metadata/package/files/system-package::arch-pkginfo-manifest", "conf": 0.9700000286102295, "crit": 2, "desc": "Arch package metadata manifest", "spans": [ [ 0, 23 ], [ 61, 31 ], [ 145, 25 ], [ 394, 13 ] ] } ], "type": "text" }, { "depth": 1, "facts": { "metrics": { "file": { "size": 302.0, "entropy": 7.33, "size_bytes": 302.0 }, "binary": { "overall_entropy": 7.33, "peak_region_bytes": 302.0, "peak_region_entropy": 7.33 }, "consistency": { "extension_content_mismatch": 1.0, "extension_content_mismatch.archive_as_text": 1.0 } } }, "id": 3, "path": "/data/samples/unknown/foraged/arch/archlinux.org/_/vivaldi-ffmpeg-codecs/vivaldi-ffmpeg-codecs-150.0.7871.113-1-x86_64.pkg.tar.zst!!.MTREE", "sha": "7e4484ff068191461a6638ae7b0b3c4d417198244d5facfa6985f818b52cef47", "size": 302, "type": "text" }, { "depth": 1, "facts": { "metrics": { "file": { "size": 6572.0, "entropy": 4.9, "size_bytes": 6572.0 }, "binary": { "overall_entropy": 4.9, "peak_region_bytes": 6572.0, "peak_region_entropy": 5.03 } } }, "id": 4, "path": "/data/samples/unknown/foraged/arch/archlinux.org/_/vivaldi-ffmpeg-codecs/vivaldi-ffmpeg-codecs-150.0.7871.113-1-x86_64.pkg.tar.zst!!.BUILDINFO", "sha": "5560d9414c115988470ca898c0782bbf7697198be66b7acfa01f01b17d5f595e", "size": 6572, "traits": [ { "id": "metadata/package/files/system-package::alpine-pkginfo-package-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package name field", "spans": [ [ 11, 31 ] ] }, { "id": "metadata/package/files/system-package::arch-pkgname-field", "conf": 0.9399999976158142, "crit": 1, "desc": "Arch pkgname metadata field", "spans": [ [ 11, 31 ] ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-version-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package version field", "spans": [ [ 75, 25 ] ] }, { "id": "metadata/package/files/system-package::arch-pkgver-field", "conf": 0.9399999976158142, "crit": 1, "desc": "Arch pkgver metadata field", "spans": [ [ 75, 25 ] ] } ], "type": "text" }, { "ctx": [ { "b": "DM)3hz/ZhBBy/qkiWe0Mv}W5qb5Q?awG\u003ceVC4(bdy?dliw[C[0wOiP8z!9A?B0rdVC4CYnx(v(kiWcpofFk4ih-J-Je?]7peIOC2", "n": [ { "c": 3, "d": "Registry release under 7 days old", "i": "metadata/registry::freshly-published", "o": 0, "z": 24, "cf": 1.0 } ], "ln": 0 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 864.0, "entropy": 4.69, "size_bytes": 864.0 }, "binary": { "overall_entropy": 4.69, "peak_region_bytes": 864.0, "peak_region_entropy": 4.69 }, "registry": { "age_days": 0.0, "maintainers": 1.0, "published_at": 1783578347.0, "is_deprecated": 0.0 } } }, "id": 5, "mol": "Md", "path": "vivaldi-ffmpeg-codecs@150.0.7871.113-1.registry.json", "risk": 1, "sha": "3d6e2d0075ea6412276e3c8623a3224dc14ca7cc9ee6fd02b8d9ef3af5629dcf", "size": 864, "traits": [ { "id": "metadata/registry::freshly-published", "conf": 1.0, "crit": 3, "desc": "Registry release under 7 days old", "spans": [ [ 0, 24 ] ] } ], "type": "registry" } ], "rev": "22d02", "v": "8" } }