{ "ml": { "v": "7", "eng": "2.1.0", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.000010112922, "rte": "az", "prob": 0.000010112922 } ], "prob": 0.000012288491, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.000012288491234357934, "type": "apk_alpine" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.000012288491234357934, "type": "elf" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.000006794929504394531, "type": "text" } ], "version": "v18.18", "analyzed_at": "2026-06-23T15:56:47Z" }, "path": "harfbuzz-icu-13.2.1-r0.apk", "raw": { "files": [ { "id": 0, "ctx": [ { "b": "abZy8000000T3{24[J!\u003enkh=HeH]u63?!Yp^*DIa!jX1m:JNrco?u{f=2H?Deg@xa3GU*X", "ln": 0 } ], "mol": "Md(He)", "sha": "494d908992744644a495e6bf77c6a18f68b90a50d5f537d7a05019e996c6d26a", "path": "/data/samples/good/foraged/alpine/alpinelinux.org/_/harfbuzz-icu/harfbuzz-icu-13.2.1-r0.apk", "risk": 1, "size": 4535, "type": "apk_alpine", "facts": { "metrics": { "file": { "size": 4535.0, "entropy": 7.92, "size_bytes": 4535.0 }, "parse": { "error_count": 1.0 }, "binary": { "overall_entropy": 7.92 } } }, "traits": [ { "id": "micro-behaviors/dylib/library/libc::libc-characteristic-cxa-finalize", "crit": 2, "desc": "libc characteristic cxa finalize", "from": [ { "file": 1 } ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-origin-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package origin field", "from": [ { "file": 2 } ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-basename", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package info file" }, { "id": "metadata/package/files/system-package::alpine-pkginfo-version-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package version field", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/dylib/library/abi-graphics::cxx-abi-symbols-a", "conf": 0.800000011920929, "crit": 2, "desc": "C++ ABI symbols cluster A", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/dylib/library/libc::libc-internal-functions-b", "conf": 0.699999988079071, "crit": 2, "desc": "libc internal symbols cluster B", "from": [ { "file": 1 } ] }, { "id": "metadata/hardening/missing::stripped-binary", "conf": 0.800000011920929, "crit": 3, "desc": "No full symbol table (likely stripped)", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/dylib/library/family::cxx-abi-symbols", "conf": 0.800000011920929, "crit": 2, "desc": "C++ ABI symbols", "from": [ { "file": 1 } ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-package-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package name field", "from": [ { "file": 2 } ] } ] }, { "ctx": [ { "b": "E))420S-r400000000000@$H+0rr910000000000kMy=:00000[gT?x0000000000kMA+z3JJA(7626H0rr91", "n": [ { "c": 3, "d": "No full symbol table (likely stripped)", "i": "metadata/hardening/missing::stripped-binary", "o": 0, "z": 25, "cf": 0.800000011920929 } ], "ln": 0 }, { "b": "A-t+2y\u0026si5raflLwDl7Av%zA?w[=c\u003ey?Xib0af8zwPzu{x(!xcA:JB0vqPN.x(mK30af8NwOkZ#", "n": [ { "c": 3, "d": "Terminal socket exec helper context", "i": "micro-behaviors/process/fd/dup::unix-terminal-socket-exec-benign-context", "o": 1701, "z": 12, "cf": 0.949999988079071 } ], "ln": 1685 }, { "b": "z/]@tlUG[GgCSq@h#)q)B97\u00262yHpN+yHpWZx(0=.vQA?VBZGi1A+PGmuVZi[B7ol8Ac885B7ol8Ac8", "n": [ { "c": 3, "d": "Stack protector/canary enabled", "i": "metadata/hardening/build::stack-protector", "o": 1895, "z": 14, "cf": 0.8999999761581421 } ], "ln": 1879 }, { "b": "B8JV\u0026h#)=evQ?3cB-RvJCSmP*hz^4cz.r:Ay?Wu(vrb%?B:wu=x\u003e8orB8JV+09Au9sxC", "n": [ { "c": 3, "d": "Architecture detection strings", "i": "objectives/discovery/host/software::arch-detection", "o": 2470, "z": 6, "cf": 0.5 } ], "ln": 2454 }, { "b": "y?bbiwb[k{zGNNBvrl8Ze[xlBB9RQ5e[xlBB98B5e]\u003eJtvj(8ozu8qfwO=xtwo\u00264)e[]iqBo0}nwQ5p", "n": [ { "c": 2, "d": "ELF dynstr section name", "i": "metadata/binary/linking/static::elf-dynstr-section-name", "o": 12391, "z": 7, "cf": 0.8999999761581421 }, { "c": 2, "d": "ELF dynsym section name", "i": "metadata/binary/linking/static::elf-dynsym-section-name", "o": 12383, "z": 7, "cf": 0.8999999761581421 } ], "ln": 12367 }, { "b": "A::j[e[O*nx\u003cUp?A::j[e[xlBvqPZ*04}]5Bo0}7vrt]Te[e)y04}=1zeA\u003c4Bn#pv00000", "n": [ { "c": 2, "d": "ELF dynamic section name", "i": "metadata/binary/linking/static::elf-dynamic-section-name", "o": 12493, "z": 8, "cf": 0.8999999761581421 } ], "ln": 12477 } ], "depth": 1, "facts": { "exp": [ [ "hb_icu_get_unicode_funcs" ], [ "fini" ], [ "hb_icu_script_to_script" ], [ "hb_icu_script_from_script" ], [ "init" ] ], "imp": [ [ "", "unorm2_composePair_78" ], [ "", "cxa_finalize" ], [ "", "hb_unicode_funcs_set_mirroring_func" ], [ "", "ITM_deregisterTMCloneTable" ], [ "", "hb_unicode_funcs_destroy" ], [ "", "unorm2_getNFCInstance_78" ], [ "", "uscript_getScript_78" ], [ "", "stack_chk_fail" ], [ "", "hb_script_from_string" ], [ "", "hb_unicode_funcs_make_immutable" ], [ "", "hb_unicode_funcs_get_empty" ], [ "", "hb_unicode_funcs_set_general_category_func" ], [ "", "hb_unicode_funcs_set_compose_func" ], [ "", "u_getIntPropertyValue_78" ], [ "", "u_countChar32_78" ], [ "", "deregister_frame_info" ], [ "", "unorm2_getRawDecomposition_78" ], [ "", "register_frame_info" ], [ "", "hb_unicode_funcs_set_combining_class_func" ], [ "", "uscript_getCode_78" ], [ "", "u_charMirror_78" ], [ "", "hb_unicode_funcs_set_script_func" ], [ "", "ITM_registerTMCloneTable" ], [ "", "hb_unicode_funcs_set_decompose_func" ], [ "", "uscript_getShortName_78" ], [ "", "u_getCombiningClass_78" ], [ "", "hb_unicode_funcs_create" ] ], "sec": [ [ ".note.gnu.property", 680, 48, 1.87, "alloc" ], [ ".note.gnu.build-id", 728, 36, 4.19, "alloc" ], [ ".gnu.hash", 768, 68, 3.43, "alloc" ], [ ".dynsym", 840, 792, 1.13, "alloc" ], [ ".dynstr", 1632, 880, 4.66, "alloc" ], [ ".rela.dyn", 2512, 672, 1.37, "alloc" ], [ ".relr.dyn", 3184, 24, 1.22, "alloc" ], [ ".init", 4096, 3, 1.58, "alloc,executable" ], [ ".text", 4112, 1381, 5.77, "alloc,executable" ], [ ".fini", 5493, 3, 1.58, "alloc,executable" ], [ ".rodata", 8192, 116, 1.96, "alloc" ], [ ".eh_frame_hdr", 8308, 84, 3.43, "alloc" ], [ ".eh_frame", 8392, 308, 4.22, "alloc" ], [ ".init_array", 11544, 8, 1.06, "write,alloc" ], [ ".fini_array", 11552, 8, 1.06, "write,alloc" ], [ ".dynamic", 11560, 480, 1.28, "write,alloc" ], [ ".got", 12040, 248, 0.08, "write,alloc" ], [ ".data", 12288, 8, 0.54, "write,alloc" ], [ ".comment", 12296, 28, 3.99, "merge,strings" ], [ ".shstrtab", 12324, 203, 4.17, "" ] ], "metrics": { "elf": { "bits": 64.0, "entry": 0.0, "has_got": 1.0, "has_plt": 0.0, "has_note": 1.0, "note_count": 2.0, "nx_enabled": 1.0, "has_dt_relr": 1.0, "dynrel_count": 0.0, "dynsym_count": 33.0, "has_build_id": 1.0, "has_eh_frame": 1.0, "has_gnu_hash": 1.0, "stack_canary": 1.0, "symtab_count": 0.0, "dynrela_count": 28.0, "little_endian": 1.0, "dt_flags_1_raw": 1.0, "pltreloc_count": 0.0, "build_id_length": 20.0, "executable_stack": 0.0, "fini_array_count": 1.0, "init_array_count": 1.0, "wx_segment_count": 0.0, "comment_entry_count": 1.0, "program_header_count": 11.0, "comment_distinct_count": 1.0, "gnu_stack_section_absent": 0.0, "load_segment_max_file_size": 3208.0, "stripped_but_symtab_present": 0.0, "load_segment_max_memory_size": 3208.0, "section_relocation_group_count": 1.0, "stripped_metadata_section_count": 7.0 }, "file": { "size": 13936.0, "entropy": 2.31, "size_bytes": 13936.0 }, "binary": { "is_pie": 0.0, "has_overlay": 1.0, "is_stripped": 1.0, "code_entropy": 5.76, "data_entropy": 0.87, "overlay_size": 1409.0, "string_count": 57.0, "overlay_ratio": 0.1, "overall_entropy": 2.31, "overlay_entropy": 1.31, "entropy_variance": 2.52, "avg_string_length": 18.18, "max_string_length": 42.0, "peak_region_bytes": 1024.0, "code_to_data_ratio": 0.65, "peak_region_entropy": 5.68, "string_length_stddev": 9.76, "largest_section_ratio": 0.1, "sentence_string_count": 1.0, "sentence_string_ratio": 0.02, "high_entropy_string_count": 0.0 }, "exports": { "count": 5.0 }, "imports": { "count": 27.0 }, "sections": { "count": 22.0, "code_size": 1387.0, "entropy_max": 5.77, "entropy_mean": 2.43, "name_entropy": 4.12, "writable_count": 6.0, "executable_count": 3.0, "nonstandard_count": 5.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 3.0 } } }, "id": 1, "mol": "Md(He)", "path": "/data/samples/good/foraged/alpine/alpinelinux.org/_/harfbuzz-icu/harfbuzz-icu-13.2.1-r0.apk!!usr/lib/libharfbuzz-icu.so.0.61321.0", "risk": 1, "sha": "20862e44a7658a4beeb86fd91e8f431d2c06fd23470ddeed034bf453700c93a1", "size": 13936, "traits": [ { "id": "micro-behaviors/dylib/library/libc::libc-characteristic-cxa-finalize", "crit": 2, "desc": "libc characteristic cxa finalize", "spans": [ [ 1701, 12 ] ] }, { "id": "metadata/hardening/missing::stripped-binary", "conf": 0.800000011920929, "crit": 3, "desc": "No full symbol table (likely stripped)", "spans": [ [ 0, 25 ] ] }, { "id": "micro-behaviors/dylib/library/libc::libc-internal-functions-b", "conf": 0.699999988079071, "crit": 2, "desc": "libc internal symbols cluster B", "spans": [ [ 1701, 12 ] ] }, { "id": "micro-behaviors/dylib/library/abi-graphics::cxx-abi-symbols-a", "conf": 0.800000011920929, "crit": 2, "desc": "C++ ABI symbols cluster A", "spans": [ [ 1701, 12 ] ] } ], "type": "elf" }, { "ctx": [ { "b": "boPG/zE)\u0026%By!#9vTf88vS=y3wfrVXf/HZsuVGThePJM", "ln": 1, "addr": 0 }, { "b": "boRbIx(mMaw)]E^A=k(raA?spB7]MgatCG8h.D\u0026", "ln": 2, "addr": 36 }, { "b": "Abf97vqPM#jS[ADA+n^6Du}eSv%4", "ln": 3, "addr": 68 }, { "b": "Abf9fwPw[RatCV8ga\u003epkAXE", "ln": 4, "addr": 91 }, { "b": "Abf8%wPIu7jS)p7A+n^6Du{Y9lSCmIB-qqrA=-Bux\u003c#9\u003eA^m", "ln": 5, "addr": 110 }, { "b": "B-IpvjS[AWBz#pZfe40EA+n^6Du}hRx([3hvLhwkf8", "ln": 6, "addr": 149 }, { "b": "B7]@iauZ\u00264gDvlH", "ln": 9, "addr": 264 }, { "b": "vrb\u003c\u003eauZ\u0026(i5Ub4gY", "ln": 10, "addr": 277 }, { "b": "z/PM8x(k4Razth7w[2[eDh", "ln": 11, "addr": 291 }, { "b": "v@Dj3x(\u003eEXatvvZgH%]Hf\u003c#:\u0026w[9.Uw?){PwmPgah8l%Bg*@yPf!)h[gg+2LgY", "ln": 12, "addr": 309 }, { "b": "zddc@Byw)3wPw[RawMu!vqYH+y-(8-Aa6\u003eKzEWQ7vl!mqAa%i3y?W^fCRi]PxfD", "ln": 13, "addr": 359 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 681.0, "entropy": 5.2, "size_bytes": 681.0 }, "binary": { "overall_entropy": 5.2 } } }, "id": 2, "path": "/data/samples/good/foraged/alpine/alpinelinux.org/_/harfbuzz-icu/harfbuzz-icu-13.2.1-r0.apk!!.PKGINFO", "risk": 1, "sha": "28b16decacb055acc96f0c1cb1d764a824d2903a2ae4e0577b57a11cb5ba193e", "size": 681, "traits": [ { "id": "metadata/package/files/system-package::alpine-pkginfo-origin-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package origin field", "spans": [ [ 291, 17 ] ] }, { "id": "metadata/package/files/system-package::arch-pkgname-field", "conf": 0.9399999976158142, "crit": 1, "desc": "Arch pkgname metadata field", "spans": [ [ 68, 22 ] ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-basename", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package info file" }, { "id": "metadata/package/files/system-package::alpine-pkginfo-package-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package name field", "spans": [ [ 68, 22 ] ] }, { "id": "metadata/package/files/system-package::arch-pkgver-field", "conf": 0.9399999976158142, "crit": 1, "desc": "Arch pkgver metadata field", "spans": [ [ 91, 18 ] ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-version-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package version field", "spans": [ [ 91, 18 ] ] }, { "id": "metadata/package/files/system-package::alpine-apk-pkginfo", "conf": 0.9700000286102295, "crit": 2, "desc": "Alpine/Wolfi package info metadata", "spans": [ [ 68, 22 ], [ 91, 18 ], [ 291, 17 ] ] } ], "type": "text" } ], "rev": "b520a", "v": "8" } }