{ "ml": { "v": "7", "eng": "2.2.1", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.18228644, "rte": "az", "prob": 0.18228644 } ], "prob": 0.18228644, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.18228644132614136, "type": "rpm" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.10702136158943176, "type": "elf" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.10702136158943176, "type": "elf" } ], "version": "v18.18", "analyzed_at": "2026-07-08T01:05:46Z" }, "path": "wasmedge-0.17.1-1.fc45.aarch64.rpm", "raw": { "files": [ { "id": 0, "ctx": [ { "b": ")w]Wf0@@r3004jKB8tG0xjSUGe?]pqf!Cajw[9UP00", "n": [ { "c": 2, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "o": 0, "z": 1, "cf": 1.0 } ], "ln": 0 } ], "mol": "Md(He)", "sha": "4fff490bda861cb9196ce2e8e182a8e0c7627e9c2daf843a7d69004ae7754b2a", "path": "/data/samples/unknown/foraged/fedora/fedoraproject.org/_/wasmedge/wasmedge-0.17.1-1.fc45.aarch64.rpm", "risk": 1, "size": 703014, "type": "rpm", "facts": { "metrics": { "rpm": { "buildtime": 1783343396.0 }, "file": { "size": 703014.0, "entropy": 7.99, "size_bytes": 703014.0 }, "binary": { "overall_entropy": 7.99, "peak_region_bytes": 689702.0, "peak_region_entropy": 7.86 } } }, "ident": { "name": { "value": "wasmedge", "source": "rpm.name", "verified": false }, "urls": [ { "url": "https://github.com/WasmEdge/WasmEdge", "kind": "homepage", "source": "rpm.url" } ], "trust": "unsigned", "authors": [ { "name": "Fedora Project", "role": "packager", "source": "rpm.packager" } ], "version": { "value": "0.17.1", "source": "rpm.version", "verified": false }, "organization": { "value": "Fedora Project", "source": "rpm.vendor", "verified": false } }, "traits": [ { "id": "micro-behaviors/dylib/library/abi-graphics::cxx-abi-symbols-a", "conf": 0.800000011920929, "crit": 2, "desc": "C++ ABI symbols cluster A", "from": [ { "file": 1 }, { "file": 2 } ] }, { "id": "metadata/hardening/missing::stripped-binary", "conf": 0.800000011920929, "crit": 3, "desc": "No full symbol table (likely stripped)", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/dylib/library/libc::libc-internal-functions-b", "conf": 0.699999988079071, "crit": 2, "desc": "libc internal symbols cluster B", "from": [ { "file": 1 }, { "file": 2 } ] }, { "id": "micro-behaviors/dylib/library/libc::libc-characteristic-cxa-finalize", "crit": 2, "desc": "libc characteristic cxa finalize", "from": [ { "file": 1 } ] } ] }, { "ctx": [ { "b": "E))420S-r400000000000%2!g0rr91kNvz\u003c00000kMy=:00000S09h40000000000kMA+z3\u0026", "n": [ { "c": 3, "d": "Strips toolchain banner but retains build-id", "i": "metadata/build/artifact::aggressive-strip", "o": 0, "z": 1, "cf": 1.0 } ], "ln": 0 }, { "b": "F08E3x\u003c@-iwg.RizGQgQvpsg^xF}X1B8JV=00093000ua00031000i6004\u003cMa]@/$m7rN", "n": [ { "c": 3, "d": "Architecture detection strings", "i": "objectives/discovery/host/software::arch-detection", "o": 786, "z": 7, "cf": 0.5 } ], "ln": 770 }, { "b": "vQ\u0026+^ByxiiuU%j=zua3Jv%zA?w[=c\u003ey?Xib0axtPA=.p*nMnz\u003eA+e($B97#lr82.@z/fb=vpB4:0aeq%o\u003cW", "n": [ { "c": 3, "d": "Terminal socket exec helper context", "i": "micro-behaviors/process/fd/dup::unix-terminal-socket-exec-benign-context", "o": 1405, "z": 12, "cf": 0.949999988079071 }, { "c": 2, "d": "Abort program execution", "i": "micro-behaviors/os/signal/handler::abort", "o": 1418, "z": 5, "cf": 0.8999999761581421 } ], "ln": 1389 }, { "b": "B8$YfByxii0afqFvrt]Tm[=GvlTJbCnNB\u003e+uS6r^qufiXnKt^Kga\u003epu07PZOlpk9ne=", "n": [ { "c": 3, "d": "Network-capable library profile", "i": "objectives/supply-chain/trojanized/backdoor::network-library-profile", "o": 1631, "z": 5, "cf": 0.8999999761581421 } ], "ln": 1615 }, { "b": "b4kI4xLzN1v@#\u003clwG\u003ceVvpsg^xF}W\u003eefY1NlVuPXiWe6MwJzF.i+z@lz/Po9A=kY7v@%:", "n": [ { "c": 2, "d": "aarch64 architecture string", "i": "micro-behaviors/os/sysinfo/platform/string::arch-aarch64", "o": 3090, "z": 7, "cf": 0.30000001192092896 } ], "ln": 3074 }, { "b": "00000000000000000000CvtMfwN]B+v\u003exw!f/HZteIO\u003e\u0026v(c4}vpsg^xF}X1wmYj)x8?]iPKoru@wP48s]XK9\u003egl[e1I\u003c%vH:KtD761sm00", "n": [ { "c": 2, "d": ".gnu_debuglink reference present", "i": "metadata/build/debug::elf-debuglink", "o": 65540, "z": 37, "cf": 1.0 } ], "ln": 65524 }, { "b": "By^7qzGNNvB.LV5eOO.}e[]iBwPz.\u0026e[Y6Ae[!WmxAfU}D2vXGz2=h0D2vXBASv.8zGNNPwPz\u003caz/bLcxkR\u0026AC4CYnx(v(@ASv.jwD", "n": [ { "c": 2, "d": "ELF dynstr section name", "i": "metadata/binary/linking/static::elf-dynstr-section-name", "o": 66728, "z": 7, "cf": 0.8999999761581421 }, { "c": 2, "d": "ELF dynsym section name", "i": "metadata/binary/linking/static::elf-dynsym-section-name", "o": 66720, "z": 7, "cf": 0.8999999761581421 }, { "c": 2, "d": "ELF interpreter section name", "i": "metadata/binary/linking/static::elf-interpreter-section-name", "o": 66702, "z": 7, "cf": 0.8999999761581421 } ], "ln": 66686 }, { "b": "vr?\u00269wmoN*e]\u003eJte]\u003e\u003ege[xlBvqPZ*04}]5Bo0}7vrt]Te[e)y04}]4BZFV\u003cvS=s1x(mX^e[Y6AuU0.SB.tk[BytdH00000000000000000000000000000000000000", "n": [ { "c": 2, "d": "ELF dynamic section name", "i": "metadata/binary/linking/static::elf-dynamic-section-name", "o": 66928, "z": 8, "cf": 0.8999999761581421 }, { "c": 2, "d": "ELF .gnu_debugdata section (mini debug info)", "i": "micro-behaviors/data/embedded/payload/compression::gnu-debugdata-section", "o": 66968, "z": 14, "cf": 0.8999999761581421 } ], "ln": 66912 } ], "depth": 1, "facts": { "exp": [ [ "start" ], [ "IO_stdin_used" ] ], "imp": [ [ "", "WasmEdge_Driver_Compiler" ], [ "", "ITM_registerTMCloneTable" ], [ "", "libc_start_main" ], [ "", "ITM_deregisterTMCloneTable" ], [ "", "gmon_start__" ], [ "", "abort" ], [ "", "cxa_finalize" ] ], "sec": [ [ ".note.gnu.build-id", 736, 36, 4.19, "alloc" ], [ ".interp", 772, 27, 4.21, "alloc" ], [ ".gnu.hash", 800, 80, 5.03, "alloc" ], [ ".dynsym", 880, 504, 1.31, "alloc" ], [ ".dynstr", 1384, 346, 4.67, "alloc" ], [ ".gnu.version", 1730, 42, 1.38, "alloc" ], [ ".gnu.version_r", 1776, 96, 2.52, "alloc" ], [ ".rela.dyn", 1872, 96, 1.5, "alloc" ], [ ".rela.plt", 1968, 120, 1.65, "alloc,info_link" ], [ ".relr.dyn", 2088, 24, 1.37, "alloc" ], [ ".init", 2112, 28, 3.9, "alloc,executable" ], [ ".plt", 2144, 152, 4.33, "alloc,executable" ], [ ".text", 2304, 360, 5.1, "alloc,executable" ], [ ".fini", 2664, 24, 3.72, "alloc,executable" ], [ ".rodata", 2688, 4, 1.5, "alloc,merge" ], [ ".eh_frame_hdr", 2692, 60, 2.97, "alloc" ], [ ".eh_frame", 2752, 184, 3.46, "alloc" ], [ ".note.gnu.property", 2936, 32, 1.69, "alloc" ], [ ".note.ABI-tag", 2968, 32, 1.56, "alloc" ], [ ".note.package", 3000, 144, 4.81, "alloc" ], [ ".init_array", 64808, 8, 1.06, "write,alloc" ], [ ".fini_array", 64816, 8, 1.06, "write,alloc" ], [ ".data.rel.ro", 64824, 8, 1.55, "write,alloc" ], [ ".dynamic", 64832, 592, 1.45, "write,alloc" ], [ ".got", 65424, 112, 0.81, "write,alloc" ], [ ".data", 65536, 4, 0.0, "write,alloc" ], [ ".gnu_debuglink", 65540, 44, 4.47, "" ], [ ".gnu_debugdata", 65584, 1088, 7.78, "" ], [ ".shstrtab", 66672, 311, 4.28, "" ] ], "metrics": { "elf": { "bits": 64.0, "entry": 2368.0, "has_got": 1.0, "has_plt": 1.0, "has_note": 1.0, "note_count": 4.0, "nx_enabled": 1.0, "has_dt_relr": 1.0, "has_runpath": 1.0, "dynrel_count": 0.0, "dynsym_count": 21.0, "has_build_id": 1.0, "has_eh_frame": 1.0, "has_gnu_hash": 1.0, "symtab_count": 0.0, "dynrela_count": 4.0, "has_debuglink": 1.0, "little_endian": 1.0, "dt_flags_1_raw": 134217729.0, "pltreloc_count": 5.0, "build_id_length": 20.0, "dt_versym_count": 21.0, "has_aarch64_bti": 1.0, "has_aarch64_pac": 1.0, "executable_stack": 0.0, "fini_array_count": 1.0, "init_array_count": 1.0, "wx_segment_count": 0.0, "program_header_count": 12.0, "dt_runpath_uses_origin": 1.0, "gnu_stack_section_absent": 0.0, "load_segment_max_file_size": 3144.0, "stripped_but_symtab_present": 0.0, "load_segment_max_memory_size": 3144.0, "section_relocation_group_count": 2.0, "stripped_metadata_section_count": 8.0 }, "file": { "size": 68968.0, "entropy": 0.63, "size_bytes": 68968.0 }, "binary": { "is_pie": 1.0, "has_overlay": 1.0, "is_stripped": 1.0, "code_entropy": 4.77, "data_entropy": 1.34, "overlay_size": 1985.0, "string_count": 52.0, "overlay_ratio": 0.03, "overall_entropy": 0.63, "overlay_entropy": 1.4, "entropy_variance": 3.15, "avg_string_length": 14.42, "max_string_length": 124.0, "peak_region_bytes": 1024.0, "code_to_data_ratio": 0.44, "peak_region_entropy": 7.78, "string_length_stddev": 16.64, "largest_section_ratio": 0.02, "sentence_string_count": 0.0, "sentence_string_ratio": 0.0, "high_entropy_string_count": 0.0 }, "exports": { "count": 2.0 }, "imports": { "count": 7.0 }, "sections": { "count": 31.0, "code_size": 564.0, "entropy_max": 7.78, "entropy_mean": 2.87, "name_entropy": 4.23, "writable_count": 7.0, "executable_count": 4.0, "nonstandard_count": 10.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 2.0 } } }, "id": 1, "mol": "Md(He)", "path": "/data/samples/unknown/foraged/fedora/fedoraproject.org/_/wasmedge/wasmedge-0.17.1-1.fc45.aarch64.rpm!!usr/bin/wasmedgec", "risk": 1, "sha": "71f9dfba26e960ac7a286699e82ec2b69a2213b3a9f20e86408124ef68e01335", "size": 68968, "traits": [ { "id": "micro-behaviors/dylib/library/libc::libc-characteristic-cxa-finalize", "crit": 2, "desc": "libc characteristic cxa finalize", "spans": [ [ 1405, 12 ] ] }, { "id": "metadata/hardening/missing::stripped-binary", "conf": 0.800000011920929, "crit": 3, "desc": "No full symbol table (likely stripped)", "spans": [ [ 0, 25 ] ] }, { "id": "micro-behaviors/dylib/library/libc::libc-internal-functions-b", "conf": 0.699999988079071, "crit": 2, "desc": "libc internal symbols cluster B", "spans": [ [ 1405, 12 ] ] }, { "id": "micro-behaviors/dylib/library/abi-graphics::cxx-abi-symbols-a", "conf": 0.800000011920929, "crit": 2, "desc": "C++ ABI symbols cluster A", "spans": [ [ 1405, 12 ] ] } ], "type": "elf" }, { "ctx": [ { "b": "E))420S-r400000000000%2!g0rr91kNvz\u003c00000kMy=:00000S09h40000000000kMA+z3\u0026", "n": [ { "c": 3, "d": "Strips toolchain banner but retains build-id", "i": "metadata/build/artifact::aggressive-strip", "o": 0, "z": 1, "cf": 1.0 } ], "ln": 0 }, { "b": "-Oi4Zx\u003c@-iwg.RizGQgQvpsg^xF}X1B8JV=00093000ua00031000i6004\u003cMa]@/$m7rN", "n": [ { "c": 3, "d": "Architecture detection strings", "i": "objectives/discovery/host/software::arch-detection", "o": 786, "z": 7, "cf": 0.5 } ], "ln": 770 }, { "b": "vQ\u0026+^ByxiiuU%j=zua3Jv%zA?w[=c\u003ey?Xib0axtPA=.p*nMnz\u003eA+e($B97#lr82.@z/fb=vpB4:0aeq%o\u003cW", "n": [ { "c": 3, "d": "Terminal socket exec helper context", "i": "micro-behaviors/process/fd/dup::unix-terminal-socket-exec-benign-context", "o": 1405, "z": 12, "cf": 0.949999988079071 }, { "c": 2, "d": "Abort program execution", "i": "micro-behaviors/os/signal/handler::abort", "o": 1418, "z": 5, "cf": 0.8999999761581421 } ], "ln": 1389 }, { "b": "ve%v{q+YXGm[3=se?]l:m[=GvlTJbCnNB\u003e+uS6r^qufiXnKt^Kga\u003epu07PZOlpk9ne=", "n": [ { "c": 3, "d": "Network-capable library profile", "i": "objectives/supply-chain/trojanized/backdoor::network-library-profile", "o": 1644, "z": 5, "cf": 0.8999999761581421 } ], "ln": 1628 }, { "b": "b4kI4xLzN1v@#\u003clwG\u003ceVvpsg^xF}W\u003eefY1NlVuPXiWe6MwJzF.i+z@lz/Po9A=kY7v@%:", "n": [ { "c": 2, "d": "aarch64 architecture string", "i": "micro-behaviors/os/sysinfo/platform/string::arch-aarch64", "o": 3090, "z": 7, "cf": 0.30000001192092896 } ], "ln": 3074 }, { "b": "00000000000000000000CvtMfwN]B+eIF!ih.D*pf!N6Fg=l)]vrb\u003c\u003ehz^3%wNY^{000004wQn\u003e@wP48s]XK9\u003egl[e1I\u003e0wH:KtD761sm", "n": [ { "c": 2, "d": ".gnu_debuglink reference present", "i": "metadata/build/debug::elf-debuglink", "o": 65540, "z": 36, "cf": 1.0 } ], "ln": 65524 }, { "b": "By^7qzGNNvB.LV5eOO.}e[]iBwPz.\u0026e[Y6Ae[!WmxAfU}D2vXGz2=h0D2vXBASv.8zGNNPwPz\u003caz/bLcxkR\u0026AC4CYnx(v(@ASv.jwD", "n": [ { "c": 2, "d": "ELF dynstr section name", "i": "metadata/binary/linking/static::elf-dynstr-section-name", "o": 66728, "z": 7, "cf": 0.8999999761581421 }, { "c": 2, "d": "ELF dynsym section name", "i": "metadata/binary/linking/static::elf-dynsym-section-name", "o": 66720, "z": 7, "cf": 0.8999999761581421 }, { "c": 2, "d": "ELF interpreter section name", "i": "metadata/binary/linking/static::elf-interpreter-section-name", "o": 66702, "z": 7, "cf": 0.8999999761581421 } ], "ln": 66686 }, { "b": "vr?\u00269wmoN*e]\u003eJte]\u003e\u003ege[xlBvqPZ*04}]5Bo0}7vrt]Te[e)y04}]4BZFV\u003cvS=s1x(mX^e[Y6AuU0.SB.tk[BytdH00000000000000000000000000000000000000", "n": [ { "c": 2, "d": "ELF dynamic section name", "i": "metadata/binary/linking/static::elf-dynamic-section-name", "o": 66928, "z": 8, "cf": 0.8999999761581421 }, { "c": 2, "d": "ELF .gnu_debugdata section (mini debug info)", "i": "micro-behaviors/data/embedded/payload/compression::gnu-debugdata-section", "o": 66968, "z": 14, "cf": 0.8999999761581421 } ], "ln": 66912 } ], "depth": 1, "facts": { "exp": [ [ "start" ], [ "IO_stdin_used" ] ], "imp": [ [ "", "ITM_registerTMCloneTable" ], [ "", "libc_start_main" ], [ "", "ITM_deregisterTMCloneTable" ], [ "", "gmon_start__" ], [ "", "abort" ], [ "", "cxa_finalize" ], [ "", "WasmEdge_Driver_UniTool" ] ], "sec": [ [ ".note.gnu.build-id", 736, 36, 4.06, "alloc" ], [ ".interp", 772, 27, 4.21, "alloc" ], [ ".gnu.hash", 800, 80, 5.03, "alloc" ], [ ".dynsym", 880, 504, 1.31, "alloc" ], [ ".dynstr", 1384, 345, 4.67, "alloc" ], [ ".gnu.version", 1730, 42, 1.38, "alloc" ], [ ".gnu.version_r", 1776, 96, 2.48, "alloc" ], [ ".rela.dyn", 1872, 96, 1.54, "alloc" ], [ ".rela.plt", 1968, 120, 1.62, "alloc,info_link" ], [ ".relr.dyn", 2088, 24, 1.37, "alloc" ], [ ".init", 2112, 28, 3.9, "alloc,executable" ], [ ".plt", 2144, 152, 4.33, "alloc,executable" ], [ ".text", 2304, 360, 5.12, "alloc,executable" ], [ ".fini", 2664, 24, 3.72, "alloc,executable" ], [ ".rodata", 2688, 4, 1.5, "alloc,merge" ], [ ".eh_frame_hdr", 2692, 60, 2.97, "alloc" ], [ ".eh_frame", 2752, 184, 3.46, "alloc" ], [ ".note.gnu.property", 2936, 32, 1.69, "alloc" ], [ ".note.ABI-tag", 2968, 32, 1.56, "alloc" ], [ ".note.package", 3000, 144, 4.81, "alloc" ], [ ".init_array", 64808, 8, 1.06, "write,alloc" ], [ ".fini_array", 64816, 8, 1.06, "write,alloc" ], [ ".data.rel.ro", 64824, 8, 1.55, "write,alloc" ], [ ".dynamic", 64832, 592, 1.45, "write,alloc" ], [ ".got", 65424, 112, 0.81, "write,alloc" ], [ ".data", 65536, 4, 0.0, "write,alloc" ], [ ".gnu_debuglink", 65540, 44, 4.46, "" ], [ ".gnu_debugdata", 65584, 1088, 7.78, "" ], [ ".shstrtab", 66672, 311, 4.28, "" ] ], "metrics": { "elf": { "bits": 64.0, "entry": 2368.0, "has_got": 1.0, "has_plt": 1.0, "has_note": 1.0, "note_count": 4.0, "nx_enabled": 1.0, "has_dt_relr": 1.0, "has_runpath": 1.0, "dynrel_count": 0.0, "dynsym_count": 21.0, "has_build_id": 1.0, "has_eh_frame": 1.0, "has_gnu_hash": 1.0, "symtab_count": 0.0, "dynrela_count": 4.0, "has_debuglink": 1.0, "little_endian": 1.0, "dt_flags_1_raw": 134217729.0, "pltreloc_count": 5.0, "build_id_length": 20.0, "dt_versym_count": 21.0, "has_aarch64_bti": 1.0, "has_aarch64_pac": 1.0, "executable_stack": 0.0, "fini_array_count": 1.0, "init_array_count": 1.0, "wx_segment_count": 0.0, "program_header_count": 12.0, "dt_runpath_uses_origin": 1.0, "gnu_stack_section_absent": 0.0, "load_segment_max_file_size": 3144.0, "stripped_but_symtab_present": 0.0, "load_segment_max_memory_size": 3144.0, "section_relocation_group_count": 2.0, "stripped_metadata_section_count": 8.0 }, "file": { "size": 68968.0, "entropy": 0.63, "size_bytes": 68968.0 }, "binary": { "is_pie": 1.0, "has_overlay": 1.0, "is_stripped": 1.0, "code_entropy": 4.79, "data_entropy": 1.34, "overlay_size": 1985.0, "string_count": 54.0, "overlay_ratio": 0.03, "overall_entropy": 0.63, "overlay_entropy": 1.4, "entropy_variance": 3.14, "avg_string_length": 14.0, "max_string_length": 124.0, "peak_region_bytes": 1024.0, "code_to_data_ratio": 0.44, "peak_region_entropy": 7.77, "string_length_stddev": 16.41, "largest_section_ratio": 0.02, "sentence_string_count": 0.0, "sentence_string_ratio": 0.0, "high_entropy_string_count": 0.0 }, "exports": { "count": 2.0 }, "imports": { "count": 7.0 }, "sections": { "count": 31.0, "code_size": 564.0, "entropy_max": 7.78, "entropy_mean": 2.87, "name_entropy": 4.23, "writable_count": 7.0, "executable_count": 4.0, "nonstandard_count": 10.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 2.0 } } }, "id": 2, "mol": "Md(He)", "path": "/data/samples/unknown/foraged/fedora/fedoraproject.org/_/wasmedge/wasmedge-0.17.1-1.fc45.aarch64.rpm!!usr/bin/wasmedge", "risk": 1, "sha": "7f77daf380c434be90bdc032f014d73dbf2ba11f6b69dd3ca843595ecec6910b", "size": 68968, "traits": [ { "id": "micro-behaviors/dylib/library/libc::libc-characteristic-cxa-finalize", "crit": 2, "desc": "libc characteristic cxa finalize", "spans": [ [ 1405, 12 ] ] }, { "id": "metadata/hardening/missing::stripped-binary", "conf": 0.800000011920929, "crit": 3, "desc": "No full symbol table (likely stripped)", "spans": [ [ 0, 25 ] ] }, { "id": "micro-behaviors/dylib/library/libc::libc-internal-functions-b", "conf": 0.699999988079071, "crit": 2, "desc": "libc internal symbols cluster B", "spans": [ [ 1405, 12 ] ] }, { "id": "micro-behaviors/dylib/library/abi-graphics::cxx-abi-symbols-a", "conf": 0.800000011920929, "crit": 2, "desc": "C++ ABI symbols cluster A", "spans": [ [ 1405, 12 ] ] } ], "type": "elf" } ], "rev": "2fd29", "v": "8" } }