{ "llm": { "conf": 0.55009544, "grade": "benign", "model": "Qwen/Qwen3.6-27B", "review": false, "outcome": "benign", "interpretation": "Legitimate OATH toolkit package" }, "ml": { "v": "7", "eng": "2.2.0-beta.1", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.06035641, "rte": "az", "prob": 0.06035641 } ], "prob": 0.35727915, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.3572791516780853, "type": "apk_alpine" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.06035640835762024, "type": "elf" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.05547836422920227, "type": "elf" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.20738321542739868, "type": "elf" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.07670646905899048, "type": "elf" }, { "id": 5, "lvl": -1, "conf": 0, "prob": 0.291656494140625, "type": "json" }, { "id": 6, "lvl": -1, "conf": 0, "prob": 0.3572791516780853, "type": "text" }, { "id": 7, "lvl": -1, "conf": 0, "prob": 0.000041037797927856445, "type": "xml" }, { "id": 8, "lvl": -1, "conf": 0, "prob": 0.000041037797927856445, "type": "xml" }, { "id": 9, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "xml" }, { "id": 10, "lvl": -1, "conf": 0, "prob": 0.000031888484954833984, "type": "xml" } ], "version": "v18.18", "analyzed_at": "2026-06-30T22:13:41Z" }, "path": "oath-toolkit-2.6.12-r9.apk", "raw": { "files": [ { "id": 0, "ctx": [ { "b": "abZy8010L00rqA0}/*\u00267L@LvxRn07uRJ{iX9fP]Pg+FDaUDt:@cB5T0Cde?\u003cBUC7M1}+hDfEaY2%nvo%2O3\u003eFL\u0026KWOB]", "n": [ { "c": 3, "d": "File content manipulation (read/write/seek)", "i": "micro-behaviors/fs/file/binary::file-manipulation", "o": 0, "z": 41, "cf": 0.75 } ], "ln": 0 } ], "mol": "H(F₄)Md(He)", "sha": "575a57838d74a27b7b394507dc2f00e8733f18c5ea18517956e8aff16848a32a", "path": "oath-toolkit-2.6.12-r9.apk", "risk": 5, "size": 129933, "type": "apk_alpine", "facts": { "metrics": { "file": { "size": 129933.0, "entropy": 7.99, "size_bytes": 129933.0 }, "parse": { "error_count": 1.0 }, "binary": { "overall_entropy": 7.99, "peak_region_bytes": 128909.0, "peak_region_entropy": 7.82 } } }, "traits": [ { "id": "metadata/package/files/system-package::alpine-pkginfo-origin-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package origin field", "from": [ { "file": 6 } ] }, { "id": "metadata/package/files/system-package::spdx-melange-namespace", "conf": 0.8999999761581421, "crit": 1, "desc": "Melange SPDX document namespace" }, { "id": "micro-behaviors/ui/help::usage-title", "crit": 2, "desc": "Usage: label (title case)", "from": [ { "file": 4 } ], "spans": [ [ 27712, 37 ], [ 44800, 42 ] ] }, { "id": "micro-behaviors/fs/chown::fchown-fn", "conf": 0.6600000262260437, "crit": 3, "desc": "Change file ownership by fd", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/ui/help::usage-label", "conf": 0.75, "crit": 1, "desc": "Command line usage text", "from": [ { "file": 2 }, { "file": 3 }, { "file": 4 } ], "spans": [ [ 27712, 37 ], [ 44800, 42 ] ] }, { "id": "micro-behaviors/fs/file/write/direct::write--fwrite", "conf": 0.6600000262260437, "crit": 2, "desc": "Write files (fwrite)", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/dylib/library/family::cxx-abi-symbols", "conf": 0.800000011920929, "crit": 2, "desc": "C++ ABI symbols", "from": [ { "file": 1 }, { "file": 2 }, { "file": 3 }, { "file": 4 } ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-version-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package version field", "from": [ { "file": 6 } ] }, { "id": "micro-behaviors/fs/file/write/direct::write", "conf": 0.6600000262260437, "crit": 2, "desc": "Write files", "from": [ { "off": 2955, "file": 2 }, { "off": 3418, "file": 3 } ] }, { "id": "micro-behaviors/ui/help::usage-title-string", "crit": 1, "desc": "Usage: label in binary strings", "from": [ { "file": 4 } ], "spans": [ [ 27712, 37 ], [ 44800, 42 ] ] }, { "id": "micro-behaviors/dylib/library/libc::libc-characteristic-cxa-finalize", "crit": 2, "desc": "libc characteristic cxa finalize", "from": [ { "file": 4 } ] }, { "id": "metadata/package/files/system-package::melange-pkginfo-generator", "conf": 0.8999999761581421, "crit": 1, "desc": "Melange-generated package metadata", "from": [ { "file": 6 } ] }, { "id": "metadata/package/files/system-package::spdx-apk-pkginfo-source", "conf": 0.8999999761581421, "crit": 1, "desc": "SPDX references APK DB package info", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/fs/file/open::fopen", "conf": 0.6600000262260437, "crit": 3, "desc": "Open files", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/chmod/modify::umask", "conf": 0.4000000059604645, "crit": 3, "desc": "Set file creation mask (umask)", "from": [ { "file": 1 } ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-basename", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package info file" }, { "id": "metadata/package/files/system-package::alpine-apk-pkginfo", "conf": 0.9700000286102295, "crit": 2, "desc": "Alpine/Wolfi package info metadata", "from": [ { "off": 93, "file": 6, "line": 6 } ] }, { "id": "micro-behaviors/fs/file/delete::unlink", "conf": 0.30000001192092896, "crit": 3, "desc": "Delete files", "from": [ { "file": 1 } ] }, { "id": "metadata/hardening/build::memcpy-chk", "conf": 0.8500000238418579, "crit": 3, "desc": "FORTIFY_SOURCE memcpy bounds check", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/dylib/library/abi-graphics::cxx-abi-symbols-a", "conf": 0.800000011920929, "crit": 2, "desc": "C++ ABI symbols cluster A", "from": [ { "file": 1 }, { "file": 2 }, { "file": 3 }, { "file": 4 } ] }, { "id": "metadata/package/files/system-package::spdx-wolfi-apk-purl", "conf": 0.8999999761581421, "crit": 1, "desc": "Wolfi APK package URL in SPDX", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/ui/help::version-text", "conf": 0.699999988079071, "crit": 2, "desc": "Version information string", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/dylib/library/libc::libc-internal-functions-b", "conf": 0.699999988079071, "crit": 2, "desc": "libc internal symbols cluster B", "from": [ { "file": 1 }, { "file": 2 }, { "file": 3 }, { "file": 4 } ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-package-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package name field", "from": [ { "file": 6 } ] }, { "id": "metadata/package/files/system-package::spdx-document-id", "conf": 0.8999999761581421, "crit": 1, "desc": "SPDX document identifier" }, { "id": "metadata/binary/metrics/threshold::many-imports-50", "conf": 1.0, "crit": 1, "desc": "Binary has 50+ imports", "from": [ { "file": 1 } ], "spans": [ [ 0, 21 ] ] }, { "id": "micro-behaviors/fs/file/stat::stat-core", "conf": 0.800000011920929, "crit": 3, "desc": "Read file status and metadata (core)", "from": [ { "file": 1 } ] }, { "id": "metadata/build/artifact::elf-stripped-but-symtab-present", "conf": 0.6000000238418579, "crit": 3, "desc": "ELF stripped with .symtab present", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/fs/file/binary::fseek-func", "atk": "T1005", "conf": 0.4000000059604645, "crit": 2, "desc": "Seeks to position in file", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/crypto/library/keyword::encrypt-keyword", "conf": 0.4000000059604645, "crit": 3, "desc": "Generic 'encrypt' term in strings", "from": [ { "file": 4 } ] }, { "id": "metadata/package/files/system-package::spdx-melange-creator", "conf": 0.8999999761581421, "crit": 1, "desc": "Melange SPDX creator", "from": [ { "file": 5 } ] }, { "id": "metadata/package/files/system-package::wolfi-pkginfo-maintainer", "conf": 0.8999999761581421, "crit": 1, "desc": "Wolfi package maintainer field", "from": [ { "file": 6 } ] }, { "id": "metadata/package/files/system-package::spdx-sbom-document", "conf": 0.9800000190734863, "crit": 2, "desc": "SPDX SBOM document", "from": [ { "file": 5 } ] }, { "id": "metadata/package/files/system-package::spdx-document-version", "conf": 0.8999999761581421, "crit": 1, "desc": "SPDX document version field" }, { "id": "metadata/build/archive::archive-native-bin-dir-entry", "conf": 0.8399999737739563, "crit": 1, "desc": "Member under bin/native/prebuilds dir" }, { "id": "metadata/build/archive::archive-elf-shared-library-entry", "conf": 0.8399999737739563, "crit": 1, "desc": "ELF shared library archive member" }, { "id": "micro-behaviors/fs/file/binary::file-manipulation", "atk": "T1005", "conf": 0.75, "crit": 3, "desc": "File content manipulation (read/write/seek)", "from": [ { "off": 3424, "file": 1 }, { "file": 2 }, { "file": 3 } ], "spans": [ [ 0, 41 ] ] }, { "id": "metadata/build/archive::archive-native-binary-entry", "conf": 0.8600000143051147, "crit": 1, "desc": "Archive bundles a native binary" } ] }, { "ctx": [ { "b": "E))420S-r400000000000@$H+0rr910000000000kMy=:00000noB}k0000000000kMA+z3JJA(9@)tZ0rr911on", "n": [ { "c": 2, "d": "ELF needed library metadata", "i": "metadata/binary/linking/runtime::needed-lib", "o": 0, "z": 1, "cf": 1.0 } ], "ln": 0 }, { "b": "A-t+2y\u0026si5raflLwDl7Av%zA?w[=c\u003ey?Xib0b(p/xKtE\u003ex(\u003ct[vruf\u0026wn=u%0b(p/xKtm.wN/H.", "n": [ { "c": 2, "d": "Benign terminal socket exec context", "i": "objectives/command-and-control/reverse-shell/dup::unix-terminal-socket-exec-benign-context", "o": 3136, "z": 12, "cf": 0.949999988079071 } ], "ln": 3120 }, { "b": "wDlNQy\u00261310a{m.wDl7AB97\u00262yHpN+yHpWZx(0=/vruf\u0026vQTs?gCSrGzEWP}wDl^[A:@%90crm5zES", "n": [ { "c": 3, "d": "Stack protector/canary enabled", "i": "metadata/hardening/build::stack-protector", "o": 3258, "z": 14, "cf": 0.8999999761581421 } ], "ln": 3242 }, { "b": "x\u003e7N[wNxO3wPz\u003c7x(4tXw]zT1zua3JxjVf}wO=6$0crm5Bz\u003e@4ASyf5A=ubmzdJY:yJKocwDlTSBzb36z//@9C42i3wmoN\u003eg5#cev{%g}x(dA*ASyf5A+oAczdJY\u0026zddH30a{p-wOVh:v@bZ+A+foi0af8wB8VelzGGF$v}YSTB98CswO}F", "n": [ { "c": 4, "d": "Sets LD_PRELOAD hooks to hide filesystem", "i": "objectives/evasion/kernel-hide/userspace::preload-rootkit-hook-set", "o": 3335, "z": 5, "cf": 0.9200000166893005 }, { "c": 3, "d": "Set file creation mask (umask)", "i": "micro-behaviors/fs/chmod/modify::umask", "o": 3418, "z": 5, "cf": 0.4000000059604645 }, { "c": 2, "d": "Seeks to position in file", "i": "micro-behaviors/fs/file/binary::fseek-func", "o": 3424, "z": 6, "cf": 0.4000000059604645 }, { "c": 2, "d": "localtime function (string)", "i": "micro-behaviors/time/query::localtime-string", "o": 3398, "z": 8, "cf": 0.20000000298023224 }, { "c": 2, "d": "Parse time string into time", "i": "micro-behaviors/time/query::strptime", "o": 3361, "z": 8, "cf": 0.20000000298023224 }, { "c": 2, "d": "Get current calendar time (seconds)", "i": "micro-behaviors/time/query::time", "o": 3413, "z": 4, "cf": 0.30000001192092896 } ], "ln": 3319 }, { "b": "C42i3wmoN\u003e0a].Sz/YE\u0026w]\u002665Bo3D3y?W^50af8EB8LLzgHCiBA==kxy?%8\u0026vruf\u0026Bz(nuuV]\u003c]x\u003egT]wDlsLxM59j0a]?VB-Ri@w]\u0026lnv/QKXzEEx[0b(p/xKtB\u003eBz$P1wO#71vru5Xz^^:3uUBw1A9)=%", "n": [ { "c": 4, "d": "Removes artifacts before memfd execution", "i": "objectives/evasion/fileless/memory::memfd-reexec-cleanup", "o": 3539, "z": 6, "cf": 0.9200000166893005 }, { "c": 3, "d": "Change file ownership by fd", "i": "micro-behaviors/fs/chown::fchown-fn", "o": 3583, "z": 6, "cf": 0.6600000262260437 }, { "c": 3, "d": "Read file status and metadata (core)", "i": "micro-behaviors/fs/file/stat::stat-core", "o": 3533, "z": 5, "cf": 0.800000011920929 }, { "c": 2, "d": "Rename files", "i": "micro-behaviors/fs/file/rename::rename-base", "o": 3603, "z": 6, "cf": 0.6600000262260437 } ], "ln": 3517 }, { "b": "w[u16z/L?{wO\u003e{@C(RhUzdNM]AcU/2xLNPWv@uy80af8BAclhlwDl:ZvqG:#v/QKXvqG:#v{%y#vr?\u0026YvScpe0af8OzG6SgzGGF$v}YSTy?Wu*e]$}-humMcvSbW%", "n": [ { "c": 3, "d": "FORTIFY_SOURCE memcpy bounds check", "i": "metadata/hardening/build::memcpy-chk", "o": 3938, "z": 10, "cf": 0.8500000238418579 }, { "c": 2, "d": "File descriptor manipulation and control", "i": "micro-behaviors/fs/file/handle::fcntl", "o": 3949, "z": 5, "cf": 0.4000000059604645 }, { "c": 2, "d": "Abort program execution", "i": "micro-behaviors/os/signal/handler::abort", "o": 3985, "z": 5, "cf": 0.8999999761581421 } ], "ln": 3922 }, { "b": "fAs^rlqG)Dnmab8hzcV-m[=GvlTIP3gCY23oI4MruOTk)07PZOlpk9ne?]f.m[=GvlJ", "n": [ { "c": 2, "d": "Benign network-capable library context", "i": "objectives/supply-chain/trojanized/backdoor::benign-network-library-context", "o": 4143, "z": 5, "cf": 0.8999999761581421 } ], "ln": 4127 }, { "b": "l]P9K0NTq(\u0026ZF?-f*{(X.o9k6=h]-\u003em2y6x-TjD\u003em2y4j-V-R}3eLZNm2xFH@Zl", "n": [ { "c": 1, "d": "ROR13 hash algorithm constant", "i": "objectives/anti-static/obfuscation/imports::ror13-hash-seed", "o": 30693, "z": 2, "cf": 0.800000011920929 } ], "ln": 30677 }, { "b": "^l[2Pl5A%F91E?M.n#:A.n)6Oa(LZw:CFrX.3SE.:CFqj3e)5zl\u003cZ$30MWV=[J^", "n": [ { "c": 1, "d": "ROR13 hash algorithm constant", "i": "objectives/anti-static/obfuscation/imports::ror13-hash-seed", "o": 30782, "z": 2, "cf": 0.800000011920929 } ], "ln": 30766 }, { "b": "mtX]Ig0$#/kf%bwWtA^b.oin*[RMbs=J.kh3O?Tq?[^trg5^3Y0R5Nm-Zy#\u003c.oJ", "n": [ { "c": 1, "d": "ROR13 hash algorithm constant", "i": "objectives/anti-static/obfuscation/imports::ror13-hash-seed", "o": 30842, "z": 2, "cf": 0.800000011920929 } ], "ln": 30826 }, { "b": "JKfE$*QlpZ=JV*{/=!f$.o0cPIp$uL[D5fp-\u003e/}dg5^3I.n=^n@ZqQ-0R5Nm?B4", "n": [ { "c": 1, "d": "ROR13 hash algorithm constant", "i": "objectives/anti-static/obfuscation/imports::ror13-hash-seed", "o": 30934, "z": 2, "cf": 0.800000011920929 } ], "ln": 30918 }, { "b": "?A.hkIn)xS0Z)7pIsVOz.oJGA?IGd^.WncPm2w!/.Y^F%3fasd.#XZ.0OfX@*c\u003e", "n": [ { "c": 1, "d": "ROR13 hash algorithm constant", "i": "objectives/anti-static/obfuscation/imports::ror13-hash-seed", "o": 31493, "z": 2, "cf": 0.800000011920929 } ], "ln": 31477 }, { "b": "?:4qtIta\u003cj0Z)7qItJe7.oSMB??*%v.WncQInGU\u003el)oDo3fasd]A0\u003ca^)Kk*mtR", "n": [ { "c": 1, "d": "ROR13 hash algorithm constant", "i": "objectives/anti-static/obfuscation/imports::ror13-hash-seed", "o": 31585, "z": 2, "cf": 0.800000011920929 } ], "ln": 31569 }, { "b": "ByxolA@Vgu0000000000k%^}bmmG^rnLhSHo?[FXqbQs(rArg6sZ0Npg=mfI%nSc0%nSc0%nSc0%nSc0%nSc0%nSc0%nSc0%nSc0", "n": [ { "c": 2, "d": "RFC4648 Base32 alphabet string (uppercase)", "i": "micro-behaviors/data/encode/base32::rfc4648-uppercase-alphabet", "o": 75552, "z": 32, "cf": 0.5 } ], "ln": 75536 }, { "b": "b4kI4xLzN1v@#\u003clwG\u003ceVCSmP*hz=Ra00000000000000000000000000000000000000", "n": [ { "c": 3, "d": "Architecture detection strings", "i": "objectives/discovery/host/software::arch-detection", "o": 83511, "z": 6, "cf": 0.5 } ], "ln": 83495 }, { "b": "wPy:AlU{WUwMi8Ey?iP.z!0i(BzkP6uVFz4oI4MruOTk?e\u0026rSouUKO1v\u003e]\u0026EB98CAz/](j", "n": [ { "c": 2, "d": "localtime function (string)", "i": "micro-behaviors/time/query::localtime-string", "o": 93916, "z": 8, "cf": 0.20000000298023224 } ], "ln": 93900 }, { "b": "BAhFivGn2[zGNNBvrl8Ze[xlBB9RQ5e[xlBB98B5e[Y6Ae{p/DB7]Mg04}]4BUm\u0026GA=U@kzEl]Oe[Y5", "n": [ { "c": 2, "d": "ELF dynstr section name", "i": "metadata/binary/linking/static::elf-dynstr-section-name", "o": 95316, "z": 7, "cf": 0.8999999761581421 }, { "c": 2, "d": "ELF dynsym section name", "i": "metadata/binary/linking/static::elf-dynsym-section-name", "o": 95308, "z": 7, "cf": 0.8999999761581421 } ], "ln": 95292 }, { "b": "vr?\u00269wmoN*e]\u003eJte]\u003e\u003ege[xlBvqPZ*04}!\u003cByte4vSMO\u003ce[n*pzdNQb000000000000000", "n": [ { "c": 2, "d": "ELF dynamic section name", "i": "metadata/binary/linking/static::elf-dynamic-section-name", "o": 95525, "z": 8, "cf": 0.8999999761581421 } ], "ln": 95509 } ], "depth": 1, "facts": { "exp": [ [ "oath_totp_validate2" ], [ "oath_totp_validate3" ], [ "oath_totp_validate4" ], [ "oath_totp_generate2" ], [ "LIBOATH_1.10.0" ], [ "oath_hotp_generate" ], [ "LIBOATH_1.2.0" ], [ "oath_base32_encode" ], [ "oath_strerror" ], [ "oath_check_version" ], [ "LIBOATH_1.8.0" ], [ "oath_totp_validate4_callback" ], [ "oath_totp_validate3_callback" ], [ "oath_totp_validate2_callback" ], [ "oath_totp_validate_callback" ], [ "oath_base32_decode" ], [ "oath_bin2hex" ], [ "LIBOATH_2.2.0" ], [ "oath_done" ], [ "LIBOATH_1.6.0" ], [ "oath_totp_validate" ], [ "oath_strerror_name" ], [ "oath_hotp_validate_callback" ], [ "oath_authenticate_usersfile" ], [ "oath_hex2bin" ], [ "LIBOATH_1.12.0" ], [ "oath_hotp_validate" ], [ "oath_init" ], [ "LIBOATH_1.4.0" ], [ "LIBOATH_2.6.0" ], [ "oath_totp_generate" ] ], "imp": [ [ "", "snprintf_chk" ], [ "", "free" ], [ "", "strverscmp" ], [ "", "abort" ], [ "", "errno_location" ], [ "", "unlink" ], [ "", "strncmp" ], [ "", "ITM_deregisterTMCloneTable" ], [ "", "localtime_r" ], [ "", "isoc23_strtoull" ], [ "", "ferror" ], [ "", "reallocarray" ], [ "", "fcntl" ], [ "", "fpurge" ], [ "", "fclose" ], [ "", "strlen" ], [ "", "stack_chk_fail" ], [ "", "memset" ], [ "", "close" ], [ "", "strtok_r" ], [ "", "memchr" ], [ "", "asprintf_chk" ], [ "", "calloc" ], [ "", "getdelim" ], [ "", "strcmp" ], [ "", "memcpy_chk" ], [ "", "feof" ], [ "", "gmon_start__" ], [ "", "umask" ], [ "", "clearerr" ], [ "", "memcpy" ], [ "", "time" ], [ "", "fileno" ], [ "", "malloc" ], [ "", "fflush" ], [ "", "mktime" ], [ "", "realloc" ], [ "", "fread_chk" ], [ "", "strftime" ], [ "", "fsync" ], [ "", "fseeko" ], [ "", "fchown" ], [ "", "fopen" ], [ "", "rename" ], [ "", "fprintf_chk" ], [ "", "ITM_registerTMCloneTable" ], [ "", "strdup" ], [ "", "strptime" ], [ "", "fstat" ], [ "", "cxa_finalize" ] ], "sec": [ [ ".gnu.hash", 680, 416, 3.87, "alloc" ], [ ".dynsym", 1096, 1968, 1.56, "alloc" ], [ ".dynstr", 3064, 1177, 4.82, "alloc" ], [ ".gnu.version", 4242, 164, 2.39, "alloc" ], [ ".gnu.version_d", 4408, 308, 2.79, "alloc" ], [ ".gnu.version_r", 4720, 160, 3.2, "alloc" ], [ ".rela.dyn", 4880, 1536, 2.15, "alloc" ], [ ".rela.plt", 6416, 1320, 1.68, "alloc,info_link" ], [ ".init", 8192, 27, 4.31, "alloc,executable" ], [ ".plt", 8224, 896, 4.24, "alloc,executable" ], [ ".plt.got", 9120, 16, 3.58, "alloc,executable" ], [ ".plt.sec", 9136, 880, 3.95, "alloc,executable" ], [ ".text", 10048, 63196, 6.44, "alloc,executable" ], [ ".fini", 73244, 13, 3.24, "alloc,executable" ], [ ".rodata", 73728, 3852, 5.42, "alloc" ], [ ".eh_frame_hdr", 77580, 1212, 4.68, "alloc" ], [ ".eh_frame", 78792, 4548, 4.6, "alloc" ], [ ".note.gnu.property", 83344, 64, 1.91, "alloc" ], [ ".note.package", 83408, 112, 4.83, "alloc" ], [ ".init_array", 84272, 8, 1.06, "write,alloc" ], [ ".fini_array", 84280, 8, 1.06, "write,alloc" ], [ ".data.rel.ro", 84288, 672, 2.73, "write,alloc" ], [ ".dynamic", 84960, 528, 1.65, "write,alloc" ], [ ".got", 85488, 504, 1.64, "write,alloc" ], [ ".data", 86016, 8, 1.06, "write,alloc" ], [ ".comment", 86024, 31, 4.03, "merge,strings" ], [ ".symtab", 86056, 5568, 2.38, "" ], [ ".strtab", 91624, 3647, 4.97, "" ], [ ".shstrtab", 95271, 283, 4.21, "" ] ], "metrics": { "elf": { "bits": 64.0, "entry": 0.0, "has_got": 1.0, "has_plt": 1.0, "has_note": 1.0, "relacount": 60.0, "has_symtab": 1.0, "note_count": 2.0, "nx_enabled": 1.0, "has_cet_ibt": 1.0, "dynrel_count": 0.0, "dynsym_count": 82.0, "has_eh_frame": 1.0, "has_gnu_hash": 1.0, "stack_canary": 1.0, "symtab_count": 232.0, "dynrela_count": 64.0, "has_cet_shstk": 1.0, "little_endian": 1.0, "dt_flags_1_raw": 1.0, "pltreloc_count": 55.0, "dt_versym_count": 82.0, "executable_stack": 0.0, "fini_array_count": 1.0, "init_array_count": 1.0, "wx_segment_count": 0.0, "comment_entry_count": 1.0, "fortify_source_count": 5.0, "program_header_count": 11.0, "comment_distinct_count": 1.0, "gnu_stack_section_absent": 0.0, "load_segment_max_file_size": 65065.0, "stripped_but_symtab_present": 1.0, "load_segment_max_memory_size": 65065.0, "section_relocation_group_count": 2.0, "stripped_metadata_section_count": 5.0 }, "file": { "size": 97544.0, "entropy": 6.1, "size_bytes": 97544.0 }, "binary": { "is_pie": 0.0, "has_overlay": 1.0, "is_stripped": 0.0, "code_entropy": 6.38, "data_entropy": 2.06, "overlay_size": 1990.0, "string_count": 370.0, "overlay_ratio": 0.02, "overall_entropy": 6.1, "overlay_entropy": 1.6, "entropy_variance": 2.11, "avg_string_length": 15.49, "max_string_length": 95.0, "peak_region_bytes": 22528.0, "code_to_data_ratio": 0.97, "peak_region_entropy": 6.21, "string_length_stddev": 8.75, "largest_section_ratio": 0.65, "sentence_string_count": 29.0, "sentence_string_ratio": 0.08, "high_entropy_string_count": 0.0 }, "exports": { "count": 31.0 }, "imports": { "count": 50.0 }, "sections": { "count": 31.0, "code_size": 65028.0, "entropy_max": 6.44, "entropy_mean": 3.26, "name_entropy": 4.15, "writable_count": 7.0, "executable_count": 6.0, "nonstandard_count": 5.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } } }, "id": 1, "mol": "H(F₃)Md(He)", "path": "oath-toolkit-2.6.12-r9.apk!!usr/lib/liboath.so.0.1.3", "risk": 4, "sha": "ebd4161c2f63285dfddc6055cac4a06f9c336d9784c2e16cfacda91bf9709cfc", "size": 97544, "traits": [ { "id": "micro-behaviors/fs/file/binary::fseek-func", "atk": "T1005", "conf": 0.4000000059604645, "crit": 2, "desc": "Seeks to position in file", "spans": [ [ 3424, 6 ] ] }, { "id": "metadata/hardening/build::memcpy-chk", "conf": 0.8500000238418579, "crit": 3, "desc": "FORTIFY_SOURCE memcpy bounds check", "spans": [ [ 3938, 10 ] ] }, { "id": "micro-behaviors/fs/chown::fchown-fn", "conf": 0.6600000262260437, "crit": 3, "desc": "Change file ownership by fd", "spans": [ [ 3583, 6 ] ] }, { "id": "micro-behaviors/fs/chmod/modify::umask", "conf": 0.4000000059604645, "crit": 3, "desc": "Set file creation mask (umask)", "spans": [ [ 3418, 5 ] ] }, { "id": "micro-behaviors/fs/file/open::fopen", "conf": 0.6600000262260437, "crit": 3, "desc": "Open files", "spans": [ [ 3335, 5 ] ] }, { "id": "micro-behaviors/dylib/library/libc::libc-characteristic-cxa-finalize", "crit": 2, "desc": "libc characteristic cxa finalize", "spans": [ [ 3136, 12 ] ] }, { "id": "metadata/build/artifact::elf-stripped-but-symtab-present", "conf": 0.6000000238418579, "crit": 3, "desc": "ELF stripped with .symtab present", "spans": [ [ 0, 38 ] ] }, { "id": "metadata/binary/metrics/threshold::many-imports-50", "conf": 1.0, "crit": 1, "desc": "Binary has 50+ imports", "spans": [ [ 0, 21 ] ] }, { "id": "micro-behaviors/fs/file/stat::stat-core", "conf": 0.800000011920929, "crit": 3, "desc": "Read file status and metadata (core)", "spans": [ [ 3533, 5 ] ] }, { "id": "micro-behaviors/fs/file/delete::unlink", "conf": 0.30000001192092896, "crit": 3, "desc": "Delete files", "spans": [ [ 3539, 6 ] ] }, { "id": "micro-behaviors/dylib/library/libc::libc-internal-functions-b", "conf": 0.699999988079071, "crit": 2, "desc": "libc internal symbols cluster B", "spans": [ [ 3136, 12 ] ] }, { "id": "micro-behaviors/dylib/library/abi-graphics::cxx-abi-symbols-a", "conf": 0.800000011920929, "crit": 2, "desc": "C++ ABI symbols cluster A", "spans": [ [ 3136, 12 ] ] }, { "id": "micro-behaviors/dylib/library/family::cxx-abi-symbols", "conf": 0.800000011920929, "crit": 2, "desc": "C++ ABI symbols", "spans": [ [ 3136, 12 ] ] } ], "type": "elf" }, { "ctx": [ { "b": "E))420S-r400000000000@$H+0rr91as^A(00000kMy=:00000\u0026fTGA0000000000kMA+z4feS[aoiF-1][S61on", "n": [ { "c": 2, "d": "ELF program interpreter metadata", "i": "metadata/binary/linking/runtime::interpreter", "o": 0, "z": 1, "cf": 1.0 } ], "ln": 0 }, { "b": "00Ao4000000rr9100000fkLuihz^76wg.RizGQgQCSmPkhz^4cz.r^B000001onA4irf3V0rr911][S600e+[Fb{h.irf3", "n": [ { "c": 2, "d": "Reference to /lib64", "i": "micro-behaviors/fs/path/system::system-lib64", "o": 792, "z": 27, "cf": 0.6600000262260437 } ], "ln": 776 }, { "b": "z/e{6xM4{kuV6p?wDl7AB97\u00262yHpN+yHpWZx(0=RuVp41zGGF$v}YSTwQ4{h0crm5A:@^60c075v}Yp\u003e0a]!.A=k%#w]zT1zua:1A+]r80af8IwO\u003e{@D0+5{yxeA$wn=Qj0b(*#vrb#XA+eV}y\u0026r!-uTEz:A+PAkw=", "n": [ { "c": 4, "d": "Sets LD_PRELOAD hooks to hide filesystem", "i": "objectives/evasion/kernel-hide/userspace::preload-rootkit-hook-set", "o": 2725, "z": 5, "cf": 0.9200000166893005 }, { "c": 3, "d": "FORTIFY_SOURCE memcpy bounds check", "i": "metadata/hardening/build::memcpy-chk", "o": 2740, "z": 10, "cf": 0.8500000238418579 }, { "c": 3, "d": "Stack protector/canary enabled", "i": "metadata/hardening/build::stack-protector", "o": 2669, "z": 14, "cf": 0.8999999761581421 }, { "c": 2, "d": "Terminates process immediately without cleanup", "i": "micro-behaviors/process/terminate/signal::_exit", "o": 2697, "z": 4, "cf": 0.4000000059604645 } ], "ln": 2653 }, { "b": "Bye([x(i](ByX%6ASxDNv%zA?w[=c\u003ey?Xib0af8IwO(H1ByeQ7Abok#x()Y(xLNPWv@c78wDl7A", "n": [ { "c": 2, "d": "Benign network-capable library context", "i": "objectives/supply-chain/trojanized/backdoor::benign-network-library-context", "o": 2840, "z": 12, "cf": 0.8999999761581421 } ], "ln": 2824 }, { "b": "x(n38uT)++0bVp:B7GB[w]I)mv/QB^By/Gk0b#%%xl4A$uUKz3z!0i$x(v(@zEEx[0a{s:y\u002611\u0026w[=6)zF]I!CxdztwDl^[A:@%90af8AA=M5ouU\u003cT\u003cvruj4zua9Oz/P}1xjVg6AcbD6z/fg/w]\u002665Bo3x7A=bx7z#:lLAb](fzEEx[uUjB%yYE*HAb](fzu", "n": [ { "c": 3, "d": "Read file status and metadata (core)", "i": "micro-behaviors/fs/file/stat::stat-core", "o": 3004, "z": 5, "cf": 0.800000011920929 }, { "c": 2, "d": "Write single bytes to file", "i": "micro-behaviors/fs/file/write/direct::fputc", "o": 2904, "z": 5, "cf": 0.6600000262260437 }, { "c": 2, "d": "Write files (fwrite)", "i": "micro-behaviors/fs/file/write/direct::write--fwrite", "o": 2955, "z": 6, "cf": 0.6600000262260437 }, { "c": 2, "d": "Abort program execution", "i": "micro-behaviors/os/signal/handler::abort", "o": 2986, "z": 5, "cf": 0.8999999761581421 }, { "c": 1, "d": "Regex component marker", "i": "objectives/command-and-control/reverse-shell/pty::pty-dual-mode-backdoor-cond-2--inline-10027", "o": 2992, "z": 11, "cf": 0.9300000071525574 } ], "ln": 2888 }, { "b": "hulAxlqQPNlTIP3fFk3Vm[=GvlTIP3gC/84oI4MruOTk)07PZOlpk9ne\u0026iL#oI4MruJ", "n": [ { "c": 2, "d": "libc version string pattern", "i": "micro-behaviors/dylib/library/libc::libc-version-string", "o": 3082, "z": 5, "cf": 0.800000011920929 } ], "ln": 3066 }, { "b": "zGxwim]h)5gB\u003eHem]05bm]h(4C4CYnx(v(igAZQRaz+FdwPw[Qc38m53rgXMB0be", "n": [ { "c": 2, "d": "GPL license reference", "i": "metadata/package/license::gpl-word", "o": 25484, "z": 3, "cf": 0.699999988079071 } ], "ln": 25468 }, { "b": "wN]H@BAh88B-.gqx(\u003e%mra]\u0026-wGUYdawLYPs3Y.Zk#7xZefG4MaARpdaz2!twO#PjAaK6bx([Ddwftubaz+Fg", "n": [ { "c": 2, "d": "GPL license warranty disclaimer string", "i": "metadata/package/license::gpl-warranty", "o": 25580, "z": 20, "cf": 0.6000000238418579 } ], "ln": 25564 }, { "b": "vqYP#wQ4{h00000arSmpefDI@C4CYnx(v(iarR^HarR^Haw^8)zGE1AwPz\u003caz/cXazE:(3CM", "n": [ { "c": 2, "d": "Benign terminal socket exec context", "i": "objectives/command-and-control/reverse-shell/dup::unix-terminal-socket-exec-benign-context", "o": 26612, "z": 9, "cf": 0.949999988079071 } ], "ln": 26596 }, { "b": "x\u003eIrnv@=VOmOcoxarR^Hss#D+iuR*yA==2cx\u003e7N[wGV8kaAImfzxKdqBz7TYawD=+wJy@SwPzF", "n": [ { "c": 2, "d": "certificate string reference", "i": "micro-behaviors/crypto/certificate/usage::certificate-ref", "o": 27353, "z": 11, "cf": 0.5 } ], "ln": 27337 }, { "b": "B97\u0026dwmoH?azC.jB-YkorDzOYwJy@MB8bocz/oCmttF6{nL-8!e?O+0tsIgTmo}I#e=U\u003eKo\u003c}{NAck#9By=N\u003ez/P@dvR/P#q*Aj%wPR%bv/", "n": [ { "c": 2, "d": "Benign dual-mode socket exec context", "i": "objectives/command-and-control/reverse-shell/dup::unix-dual-mode-socket-exec-benign-context", "o": 27712, "z": 37, "cf": 0.949999988079071 } ], "ln": 27696 }, { "b": "00000000000000000000lVl{?A+Pf1Brz(JasgLvq!Z8!zxIL\u0026B7F%8B8L}G00000Ow$Qe}#", "n": [ { "c": 2, "d": "Copyright notice", "i": "metadata/package/license::copyright-word", "o": 27840, "z": 9, "cf": 0.6000000238418579 } ], "ln": 27824 }, { "b": "b4kI4xLzN1v@#\u003clwG\u003ceVCSmP*hz=Ra00000000000000000000000000000000000000", "n": [ { "c": 3, "d": "Architecture detection strings", "i": "objectives/discovery/host/software::arch-detection", "o": 29887, "z": 6, "cf": 0.5 } ], "ln": 29871 }, { "b": "BAhFivGn34xMFooBywRUe[]iBwPz.\u0026e[Y6Ae[!WmxAfU}D2vXGz2=h0D2vXBASv.8zGNNPwPz\u003caz/bLcxkR\u0026AC4CYnx(v(@ASv.jwD", "n": [ { "c": 2, "d": "ELF dynstr section name", "i": "metadata/binary/linking/static::elf-dynstr-section-name", "o": 38893, "z": 7, "cf": 0.8999999761581421 }, { "c": 2, "d": "ELF dynsym section name", "i": "metadata/binary/linking/static::elf-dynsym-section-name", "o": 38885, "z": 7, "cf": 0.8999999761581421 }, { "c": 2, "d": "ELF interpreter section name", "i": "metadata/binary/linking/static::elf-interpreter-section-name", "o": 38867, "z": 7, "cf": 0.8999999761581421 } ], "ln": 38851 }, { "b": "vr?\u00269wmoN*e]\u003eJte]\u003e\u003ege[xlBvqPZ*04}!\u003cByte4vSMO\u003ce[n*pzdNQb000000000000000", "n": [ { "c": 2, "d": "ELF dynamic section name", "i": "metadata/binary/linking/static::elf-dynamic-section-name", "o": 39101, "z": 8, "cf": 0.8999999761581421 } ], "ln": 39085 } ], "depth": 1, "facts": { "exp": [ [ "stdout" ], [ "stderr" ], [ "stdin" ] ], "imp": [ [ "", "fileno" ], [ "", "pskc_global_done" ], [ "", "pskc_done" ], [ "", "memset" ], [ "", "pskc_free" ], [ "", "abort" ], [ "", "memset_explicit_chk" ], [ "", "fprintf_chk" ], [ "", "gmon_start__" ], [ "", "puts" ], [ "", "pskc_validate" ], [ "", "pskc_parse_from_memory" ], [ "", "exit" ], [ "", "fstat" ], [ "", "printf_chk" ], [ "", "optopt" ], [ "", "setvbuf" ], [ "", "putchar" ], [ "", "program_invocation_short_name" ], [ "", "progname_full" ], [ "", "strncmp" ], [ "", "malloc" ], [ "", "fopen" ], [ "", "memcpy_chk" ], [ "", "ITM_deregisterTMCloneTable" ], [ "", "fputc" ], [ "", "free" ], [ "", "strlen" ], [ "", "optind" ], [ "", "ITM_registerTMCloneTable" ], [ "", "ferror" ], [ "", "asprintf_chk" ], [ "", "opterr" ], [ "", "pskc_global_init" ], [ "", "strrchr" ], [ "", "pskc_strerror" ], [ "", "ftello" ], [ "", "optarg" ], [ "", "progname" ], [ "", "getopt_long" ], [ "", "pskc_output" ], [ "", "errno_location" ], [ "", "stack_chk_fail" ], [ "", "strcmp" ], [ "", "fread_chk" ], [ "", "pskc_check_version" ], [ "", "pskc_init" ], [ "", "fclose" ], [ "", "pskc_sign_x509" ], [ "", "program_invocation_name" ], [ "", "pskc_verify_x509crt" ], [ "", "fwrite" ], [ "", "realloc" ], [ "", "error" ], [ "", "libc_start_main" ], [ "", "pskc_global_log" ], [ "", "cxa_finalize" ] ], "sec": [ [ ".interp", 792, 28, 3.94, "alloc" ], [ ".gnu.hash", 824, 56, 3.27, "alloc" ], [ ".dynsym", 880, 1464, 1.06, "alloc" ], [ ".dynstr", 2344, 825, 4.77, "alloc" ], [ ".gnu.version", 3170, 122, 1.82, "alloc" ], [ ".gnu.version_r", 3296, 176, 3.19, "alloc" ], [ ".rela.dyn", 3472, 1344, 1.72, "alloc" ], [ ".rela.plt", 4816, 1056, 1.43, "alloc,info_link" ], [ ".init", 8192, 27, 4.24, "alloc,executable" ], [ ".plt", 8224, 720, 4.18, "alloc,executable" ], [ ".plt.got", 8944, 16, 3.38, "alloc,executable" ], [ ".plt.sec", 8960, 704, 3.73, "alloc,executable" ], [ ".text", 9664, 11124, 5.88, "alloc,executable" ], [ ".fini", 20788, 13, 3.24, "alloc,executable" ], [ ".rodata", 24576, 3584, 5.06, "alloc" ], [ ".eh_frame_hdr", 28160, 276, 4.27, "alloc" ], [ ".eh_frame", 28440, 1228, 4.9, "alloc" ], [ ".note.gnu.property", 29672, 80, 1.92, "alloc" ], [ ".note.ABI-tag", 29752, 32, 1.5, "alloc" ], [ ".note.package", 29784, 112, 4.83, "alloc" ], [ ".init_array", 31744, 8, 0.54, "write,alloc" ], [ ".fini_array", 31752, 8, 1.06, "write,alloc" ], [ ".data.rel.ro", 31760, 16, 1.31, "write,alloc" ], [ ".dynamic", 31776, 512, 1.5, "write,alloc" ], [ ".got", 32288, 480, 1.36, "write,alloc" ], [ ".data", 32768, 664, 1.16, "write,alloc" ], [ ".comment", 33432, 31, 4.03, "merge,strings" ], [ ".symtab", 33464, 2928, 1.95, "" ], [ ".strtab", 36392, 2448, 4.99, "" ], [ ".shstrtab", 38840, 290, 4.25, "" ] ], "metrics": { "elf": { "bits": 64.0, "entry": 11040.0, "has_got": 1.0, "has_plt": 1.0, "has_note": 1.0, "relacount": 40.0, "has_symtab": 1.0, "note_count": 3.0, "nx_enabled": 1.0, "has_cet_ibt": 1.0, "dynrel_count": 0.0, "dynsym_count": 61.0, "has_eh_frame": 1.0, "has_gnu_hash": 1.0, "stack_canary": 1.0, "symtab_count": 122.0, "dynrela_count": 56.0, "has_cet_shstk": 1.0, "little_endian": 1.0, "dt_flags_1_raw": 134217729.0, "pltreloc_count": 44.0, "dt_versym_count": 61.0, "executable_stack": 0.0, "fini_array_count": 1.0, "init_array_count": 1.0, "wx_segment_count": 0.0, "comment_entry_count": 1.0, "fortify_source_count": 6.0, "program_header_count": 13.0, "comment_distinct_count": 1.0, "gnu_stack_section_absent": 0.0, "load_segment_max_file_size": 12609.0, "stripped_but_symtab_present": 1.0, "load_segment_max_memory_size": 12609.0, "section_relocation_group_count": 2.0, "stripped_metadata_section_count": 5.0 }, "file": { "size": 41184.0, "entropy": 4.37, "size_bytes": 41184.0 }, "binary": { "is_pie": 1.0, "has_overlay": 1.0, "is_stripped": 0.0, "code_entropy": 5.65, "data_entropy": 1.32, "overlay_size": 2054.0, "string_count": 289.0, "overlay_ratio": 0.05, "overall_entropy": 4.37, "overlay_entropy": 1.45, "entropy_variance": 2.34, "avg_string_length": 21.3, "max_string_length": 169.0, "peak_region_bytes": 7168.0, "code_to_data_ratio": 0.88, "peak_region_entropy": 5.89, "string_length_stddev": 18.13, "largest_section_ratio": 0.27, "sentence_string_count": 55.0, "sentence_string_ratio": 0.19, "high_entropy_string_count": 0.0 }, "exports": { "count": 3.0 }, "imports": { "count": 57.0 }, "sections": { "count": 32.0, "code_size": 12604.0, "entropy_max": 5.88, "entropy_mean": 3.02, "name_entropy": 4.19, "writable_count": 7.0, "executable_count": 6.0, "nonstandard_count": 6.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 2.0 } } }, "id": 2, "mol": "H(F₂)Md(He)", "path": "oath-toolkit-2.6.12-r9.apk!!usr/bin/pskctool", "risk": 3, "sha": "87e8542e4f39b1c3afaef6025954eb9537080c3da3afd969e995e6218644be6f", "size": 41184, "traits": [ { "id": "micro-behaviors/fs/file/write/direct::write--fwrite", "conf": 0.6600000262260437, "crit": 2, "desc": "Write files (fwrite)", "spans": [ [ 2955, 6 ] ] }, { "id": "metadata/hardening/build::memcpy-chk", "conf": 0.8500000238418579, "crit": 3, "desc": "FORTIFY_SOURCE memcpy bounds check", "spans": [ [ 2740, 10 ] ] }, { "id": "micro-behaviors/ui/help::version-text", "conf": 0.699999988079071, "crit": 2, "desc": "Version information string", "spans": [ [ 26612, 9 ] ] }, { "id": "micro-behaviors/fs/file/open::fopen", "conf": 0.6600000262260437, "crit": 3, "desc": "Open files", "spans": [ [ 2725, 5 ] ] }, { "id": "micro-behaviors/dylib/library/libc::libc-characteristic-cxa-finalize", "crit": 2, "desc": "libc characteristic cxa finalize", "spans": [ [ 2840, 12 ] ] }, { "id": "metadata/build/artifact::elf-stripped-but-symtab-present", "conf": 0.6000000238418579, "crit": 3, "desc": "ELF stripped with .symtab present", "spans": [ [ 0, 38 ] ] }, { "id": "metadata/binary/metrics/threshold::many-imports-50", "conf": 1.0, "crit": 1, "desc": "Binary has 50+ imports", "spans": [ [ 0, 21 ] ] }, { "id": "micro-behaviors/ui/help::usage-title", "crit": 2, "desc": "Usage: label (title case)", "spans": [ [ 27712, 37 ] ] }, { "id": "micro-behaviors/ui/help::usage-title-string", "crit": 1, "desc": "Usage: label in binary strings", "spans": [ [ 27712, 37 ] ] }, { "id": "micro-behaviors/fs/file/stat::stat-core", "conf": 0.800000011920929, "crit": 3, "desc": "Read file status and metadata (core)", "spans": [ [ 3004, 5 ] ] }, { "id": "micro-behaviors/fs/file/write/direct::write", "conf": 0.6600000262260437, "crit": 2, "desc": "Write files", "spans": [ [ 2955, 6 ] ] }, { "id": "micro-behaviors/dylib/library/libc::libc-internal-functions-b", "conf": 0.699999988079071, "crit": 2, "desc": "libc internal symbols cluster B", "spans": [ [ 2840, 12 ] ] }, { "id": "micro-behaviors/ui/help::usage-label", "conf": 0.75, "crit": 1, "desc": "Command line usage text", "spans": [ [ 27712, 37 ] ] }, { "id": "micro-behaviors/dylib/library/abi-graphics::cxx-abi-symbols-a", "conf": 0.800000011920929, "crit": 2, "desc": "C++ ABI symbols cluster A", "spans": [ [ 2840, 12 ] ] }, { "id": "micro-behaviors/dylib/library/family::cxx-abi-symbols", "conf": 0.800000011920929, "crit": 2, "desc": "C++ ABI symbols", "spans": [ [ 2840, 12 ] ] } ], "type": "elf" }, { "ctx": [ { "b": "E))420S-r400000000000@$H+0rr9107l!!00000kMy=:00000I0\u003erz0000000000kMA+z4feS[aoiF-1][S61on", "n": [ { "c": 2, "d": "ELF program interpreter metadata", "i": "metadata/binary/linking/runtime::interpreter", "o": 0, "z": 1, "cf": 1.0 } ], "ln": 0 }, { "b": "A18^E000000rr9100000fkLuihz^76wg.RizGQgQCSmPkhz^4cz.r^B000001POJ5m/SI?0rr911][S6005X)Fb{hY0000", "n": [ { "c": 2, "d": "Reference to /lib64", "i": "micro-behaviors/fs/path/system::system-lib64", "o": 792, "z": 27, "cf": 0.6600000262260437 } ], "ln": 776 }, { "b": "BzkVhuVP[0A=+VavqPMQv@c6[yHpZ=BAzklwDl7Av%00nwNxK$B-qqhA:JT3v/QQ%B7GB[uTE\u003e@vpK7Wv}YT+w)]y\u00260af8LA+PAkw)Y4Yyxd%!wN$\u003cMCXIm1B98CkB-ms/uUr}(wmYN\u003ez2!T0A=LV6ASy63ByO#)ASyf5A=tGdyxd%+AaJ[!BzkP6xkES+z!0i(BzkP6uVDc/BAhhezua3Jv%00nwNw[Ny\u0026r!-B-8niBy/uk0af8IwO\u003e{@D0+5{yxdZGx(!i5gbAoUBAhFwyYFJ#wn=Qj0b(*#vrb#XxkI:8zdN6{0af8OAb]VgBy[(\u0026xLNP?BAg#nx(dzYuTEz:A+PAkw)Y4Yyxeo(Bz(bu0bVdXy\u0026r!-uTEQ", "n": [ { "c": 4, "d": "Sets LD_PRELOAD hooks to hide filesystem", "i": "objectives/evasion/kernel-hide/userspace::preload-rootkit-hook-set", "o": 3109, "z": 5, "cf": 0.9200000166893005 }, { "c": 3, "d": "FORTIFY_SOURCE memcpy bounds check", "i": "metadata/hardening/build::memcpy-chk", "o": 3166, "z": 10, "cf": 0.8500000238418579 }, { "c": 3, "d": "Stack protector/canary enabled", "i": "metadata/hardening/build::stack-protector", "o": 3029, "z": 14, "cf": 0.8999999761581421 }, { "c": 2, "d": "Environment variable modification", "i": "micro-behaviors/os/env/vars/access::set", "o": 3155, "z": 8, "cf": 0.5 }, { "c": 2, "d": "Terminates process immediately without cleanup", "i": "micro-behaviors/process/terminate/signal::_exit", "o": 3062, "z": 4, "cf": 0.4000000059604645 }, { "c": 2, "d": "Get time from specified clock", "i": "micro-behaviors/time/query::clock_gettime", "o": 2987, "z": 13, "cf": 0.30000001192092896 }, { "c": 2, "d": "Convert time to UTC time", "i": "micro-behaviors/time/query::gmtime", "o": 3207, "z": 8, "cf": 0.20000000298023224 }, { "c": 2, "d": "localtime function (string)", "i": "micro-behaviors/time/query::localtime-string", "o": 3123, "z": 8, "cf": 0.20000000298023224 }, { "c": 2, "d": "Get current calendar time (seconds)", "i": "micro-behaviors/time/query::time", "o": 3234, "z": 4, "cf": 0.30000001192092896 } ], "ln": 2971 }, { "b": "B97@7A=Id%yJKocwDl7Av%zA?w[=c\u003ey?Xib0crm5v}Y(.xjVf@zGV1(v@c78wDl7Avrlydx(n38uT)++0bVp:B7GB[uTEI*z^$KUuVQsfBz(qr0a{g)ByLq?AcbViASy60z!B90zc}0{C5H(0BzkVhuV6p?wDlNUzdvKg0a{B}x()[^B98CjzeYFZuUam#zF@(#z!0i$x(v\u003e?vpBd}Bo2@+Bz(buuU\u003cT#x8)0{A=bx7z#:lLAb](fzEEx[uUjB%yYE*HAb](fzu", "n": [ { "c": 2, "d": "Write single bytes to file", "i": "micro-behaviors/fs/file/write/direct::fputc", "o": 3374, "z": 5, "cf": 0.6600000262260437 }, { "c": 2, "d": "Write files (fwrite)", "i": "micro-behaviors/fs/file/write/direct::write--fwrite", "o": 3418, "z": 6, "cf": 0.6600000262260437 }, { "c": 2, "d": "Environment variable access functions", "i": "micro-behaviors/os/env/vars/access::env-access-comp", "o": 3321, "z": 6, "cf": 0.4000000059604645 }, { "c": 2, "d": "Abort program execution", "i": "micro-behaviors/os/signal/handler::abort", "o": 3449, "z": 5, "cf": 0.8999999761581421 }, { "c": 2, "d": "Benign network-capable library context", "i": "objectives/supply-chain/trojanized/backdoor::benign-network-library-context", "o": 3301, "z": 12, "cf": 0.8999999761581421 }, { "c": 1, "d": "Regex component marker", "i": "objectives/command-and-control/reverse-shell/pty::pty-dual-mode-backdoor-cond-2--inline-10027", "o": 3455, "z": 11, "cf": 0.9300000071525574 } ], "ln": 3285 }, { "b": "08b%JpEd@JuOKe/ga\u003elXm[=GvlTIP3f/e(2oI4MruOTk\u0026e\u0026iL#oI4MruOTk[07PZOli", "n": [ { "c": 2, "d": "libc version string pattern", "i": "micro-behaviors/dylib/library/libc::libc-version-string", "o": 3582, "z": 5, "cf": 0.800000011920929 } ], "ln": 3566 }, { "b": "zGxwim]h)5gB\u003eHem]05bm]h(4C4CYnx(v(igAZQRaz+FdwPw[Qc38m53rgXMB0be", "n": [ { "c": 2, "d": "GPL license reference", "i": "metadata/package/license::gpl-word", "o": 42860, "z": 3, "cf": 0.699999988079071 } ], "ln": 42844 }, { "b": "wN]H@BAh88B-.gqx(\u003e%mra]\u0026-wGUYdawLYPs3Y.Zk#7xZefG4MaARpdaz2!twO#PjAaK6bx([Ddwftubaz+Fg", "n": [ { "c": 2, "d": "GPL license warranty disclaimer string", "i": "metadata/package/license::gpl-warranty", "o": 42956, "z": 20, "cf": 0.6000000238418579 } ], "ln": 42940 }, { "b": "vrDydj-s}Adf6tF00000rDzOYwJy@Lvrug8z/oCmttF6{nL-8!e?O+0tt4y/ax}Svp*EuVe?Nb700000m}DNHA::63ayPd#aA?gfx\u003egT]wGT=mr7D", "n": [ { "c": 2, "d": "Benign terminal socket exec context", "i": "objectives/command-and-control/reverse-shell/dup::unix-terminal-socket-exec-benign-context", "o": 44800, "z": 42, "cf": 0.949999988079071 } ], "ln": 44784 }, { "b": "00000000000000000000lVl{?A+Pf1Brz(JatLS8iv#K/ax8#\u003ez/cW\u0026z/YG4B8#nqe=U\u003eK00", "n": [ { "c": 2, "d": "Copyright notice", "i": "metadata/package/license::copyright-word", "o": 45088, "z": 9, "cf": 0.6000000238418579 } ], "ln": 45072 }, { "b": "b4kI4xLzN1v@#\u003clwG\u003ceVCSmP*hz=Ra00000000000000000000000000000000000000", "n": [ { "c": 3, "d": "Architecture detection strings", "i": "objectives/discovery/host/software::arch-detection", "o": 49607, "z": 6, "cf": 0.5 } ], "ln": 49591 }, { "b": "B-Y(soI4MruOTk?e\u0026rSBz!0i(BzkP6uVFz4oI4MruOTk?e\u0026rSouUKO1v\u003e]\u0026EB98CAz/](j", "n": [ { "c": 2, "d": "localtime function (string)", "i": "micro-behaviors/time/query::localtime-string", "o": 58955, "z": 8, "cf": 0.20000000298023224 } ], "ln": 58939 }, { "b": "zdL$5oI4MruOTk?e\u0026rSBz!0i(BzkP6uVHC)B98CwvSDlHm[=GvlTIP3ga\u003eA:xjU%[wPR\u003cf", "n": [ { "c": 2, "d": "localtime function (string)", "i": "micro-behaviors/time/query::localtime-string", "o": 60240, "z": 8, "cf": 0.20000000298023224 } ], "ln": 60224 }, { "b": "BAhFivGn34xMFooBywRUe[]iBwPz.\u0026e[Y6Ae[!WmxAfU}D2vXGz2=h0D2vXBASv.8zGNNPwPz\u003caz/bLcxkR\u0026AC4CYnx(v(@ASv.jwD", "n": [ { "c": 2, "d": "ELF dynstr section name", "i": "metadata/binary/linking/static::elf-dynstr-section-name", "o": 61078, "z": 7, "cf": 0.8999999761581421 }, { "c": 2, "d": "ELF dynsym section name", "i": "metadata/binary/linking/static::elf-dynsym-section-name", "o": 61070, "z": 7, "cf": 0.8999999761581421 }, { "c": 2, "d": "ELF interpreter section name", "i": "metadata/binary/linking/static::elf-interpreter-section-name", "o": 61052, "z": 7, "cf": 0.8999999761581421 } ], "ln": 61036 }, { "b": "vr?\u00269wmoN*e]\u003eJte]\u003e\u003ege[xlBvqPZ*04}!\u003cByte4vSMO\u003ce[n*pzdNQb000000000000000", "n": [ { "c": 2, "d": "ELF dynamic section name", "i": "metadata/binary/linking/static::elf-dynamic-section-name", "o": 61286, "z": 8, "cf": 0.8999999761581421 } ], "ln": 61270 } ], "depth": 1, "facts": { "exp": [ [ "stdin" ], [ "stdout" ] ], "imp": [ [ "", "ctype_toupper_loc" ], [ "", "getenv" ], [ "", "oath_base32_decode" ], [ "", "isoc23_strtoul" ], [ "", "progname" ], [ "", "free" ], [ "", "putchar" ], [ "", "libc_start_main" ], [ "", "abort" ], [ "", "errno_location" ], [ "", "strncmp" ], [ "", "ITM_deregisterTMCloneTable" ], [ "", "localtime_r" ], [ "", "isoc23_strtoull" ], [ "", "puts" ], [ "", "clock_gettime" ], [ "", "setenv" ], [ "", "oath_strerror" ], [ "", "fclose" ], [ "", "optind" ], [ "", "strlen" ], [ "", "stack_chk_fail" ], [ "", "oath_check_version" ], [ "", "getopt_long" ], [ "", "strchr" ], [ "", "strrchr" ], [ "", "gmtime_r" ], [ "", "memset" ], [ "", "oath_bin2hex" ], [ "", "oath_totp_validate4" ], [ "", "fputc" ], [ "", "asprintf_chk" ], [ "", "getdelim" ], [ "", "strcmp" ], [ "", "optarg" ], [ "", "memcpy_chk" ], [ "", "gmon_start__" ], [ "", "memcpy" ], [ "", "program_invocation_name" ], [ "", "tzset" ], [ "", "optopt" ], [ "", "time" ], [ "", "isoc23_strtol" ], [ "", "oath_hotp_validate" ], [ "", "oath_hex2bin" ], [ "", "malloc" ], [ "", "oath_done" ], [ "", "mktime" ], [ "", "strpbrk" ], [ "", "oath_base32_encode" ], [ "", "printf_chk" ], [ "", "timegm" ], [ "", "strftime" ], [ "", "error" ], [ "", "progname_full" ], [ "", "fopen" ], [ "", "unsetenv" ], [ "", "oath_init" ], [ "", "oath_hotp_generate" ], [ "", "exit" ], [ "", "fwrite" ], [ "", "fprintf_chk" ], [ "", "ITM_registerTMCloneTable" ], [ "", "oath_totp_generate2" ], [ "", "strdup" ], [ "", "program_invocation_short_name" ], [ "", "opterr" ], [ "", "ctype_b_loc" ], [ "", "stderr" ], [ "", "sprintf_chk" ], [ "", "cxa_finalize" ] ], "sec": [ [ ".interp", 792, 28, 3.94, "alloc" ], [ ".gnu.hash", 824, 56, 2.73, "alloc" ], [ ".dynsym", 880, 1776, 1.07, "alloc" ], [ ".dynstr", 2656, 1024, 4.79, "alloc" ], [ ".gnu.version", 3680, 148, 2.02, "alloc" ], [ ".gnu.version_r", 3832, 240, 3.38, "alloc" ], [ ".rela.dyn", 4072, 4320, 1.87, "alloc" ], [ ".rela.plt", 8392, 1368, 1.45, "alloc,info_link" ], [ ".init", 12288, 27, 4.24, "alloc,executable" ], [ ".plt", 12320, 928, 4.24, "alloc,executable" ], [ ".plt.got", 13248, 16, 3.38, "alloc,executable" ], [ ".plt.sec", 13264, 912, 3.73, "alloc,executable" ], [ ".text", 14208, 26711, 6.1, "alloc,executable" ], [ ".fini", 40920, 13, 3.24, "alloc,executable" ], [ ".rodata", 40960, 6144, 5.81, "alloc" ], [ ".eh_frame_hdr", 47104, 396, 4.36, "alloc" ], [ ".eh_frame", 47504, 1884, 5.0, "alloc" ], [ ".note.gnu.property", 49392, 80, 1.92, "alloc" ], [ ".note.ABI-tag", 49472, 32, 1.5, "alloc" ], [ ".note.package", 49504, 112, 4.83, "alloc" ], [ ".init_array", 49808, 8, 1.06, "write,alloc" ], [ ".fini_array", 49816, 8, 1.06, "write,alloc" ], [ ".data.rel.ro", 49824, 2320, 2.76, "write,alloc" ], [ ".dynamic", 52144, 512, 1.53, "write,alloc" ], [ ".got", 52656, 584, 1.45, "write,alloc" ], [ ".data", 53248, 584, 1.17, "write,alloc" ], [ ".comment", 53832, 31, 4.03, "merge,strings" ], [ ".symtab", 53864, 4032, 2.08, "" ], [ ".strtab", 57896, 3129, 4.98, "" ], [ ".shstrtab", 61025, 290, 4.25, "" ] ], "metrics": { "elf": { "bits": 64.0, "entry": 17408.0, "has_got": 1.0, "has_plt": 1.0, "has_note": 1.0, "relacount": 165.0, "has_symtab": 1.0, "note_count": 3.0, "nx_enabled": 1.0, "has_cet_ibt": 1.0, "dynrel_count": 0.0, "dynsym_count": 74.0, "has_eh_frame": 1.0, "has_gnu_hash": 1.0, "stack_canary": 1.0, "symtab_count": 168.0, "dynrela_count": 180.0, "has_cet_shstk": 1.0, "little_endian": 1.0, "dt_flags_1_raw": 134217729.0, "pltreloc_count": 57.0, "dt_versym_count": 74.0, "executable_stack": 0.0, "fini_array_count": 1.0, "init_array_count": 1.0, "wx_segment_count": 0.0, "comment_entry_count": 1.0, "fortify_source_count": 5.0, "program_header_count": 13.0, "comment_distinct_count": 1.0, "gnu_stack_section_absent": 0.0, "load_segment_max_file_size": 28645.0, "stripped_but_symtab_present": 1.0, "load_segment_max_memory_size": 28645.0, "section_relocation_group_count": 2.0, "stripped_metadata_section_count": 5.0 }, "file": { "size": 63368.0, "entropy": 5.31, "size_bytes": 63368.0 }, "binary": { "is_pie": 1.0, "has_overlay": 1.0, "is_stripped": 0.0, "code_entropy": 5.96, "data_entropy": 2.17, "overlay_size": 2053.0, "string_count": 414.0, "overlay_ratio": 0.03, "overall_entropy": 5.31, "overlay_entropy": 1.49, "entropy_variance": 2.3, "avg_string_length": 17.5, "max_string_length": 211.0, "peak_region_bytes": 11264.0, "code_to_data_ratio": 0.88, "peak_region_entropy": 6.14, "string_length_stddev": 17.84, "largest_section_ratio": 0.42, "sentence_string_count": 57.0, "sentence_string_ratio": 0.14, "high_entropy_string_count": 0.0 }, "exports": { "count": 2.0 }, "imports": { "count": 71.0 }, "sections": { "count": 32.0, "code_size": 28607.0, "entropy_max": 6.1, "entropy_mean": 3.13, "name_entropy": 4.19, "writable_count": 7.0, "executable_count": 6.0, "nonstandard_count": 6.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 2.0 } } }, "id": 3, "mol": "H(F)Md(He)", "path": "oath-toolkit-2.6.12-r9.apk!!usr/bin/oathtool", "risk": 3, "sha": "21859c102ec6db781ae396ee4b53a9e72b5f9692ff50c30131c35b65fc29d0cf", "size": 63368, "traits": [ { "id": "micro-behaviors/fs/file/write/direct::write--fwrite", "conf": 0.6600000262260437, "crit": 2, "desc": "Write files (fwrite)", "spans": [ [ 3418, 6 ] ] }, { "id": "metadata/hardening/build::memcpy-chk", "conf": 0.8500000238418579, "crit": 3, "desc": "FORTIFY_SOURCE memcpy bounds check", "spans": [ [ 3166, 10 ] ] }, { "id": "micro-behaviors/fs/file/open::fopen", "conf": 0.6600000262260437, "crit": 3, "desc": "Open files", "spans": [ [ 3109, 5 ] ] }, { "id": "micro-behaviors/dylib/library/libc::libc-characteristic-cxa-finalize", "crit": 2, "desc": "libc characteristic cxa finalize", "spans": [ [ 3301, 12 ] ] }, { "id": "metadata/build/artifact::elf-stripped-but-symtab-present", "conf": 0.6000000238418579, "crit": 3, "desc": "ELF stripped with .symtab present", "spans": [ [ 0, 38 ] ] }, { "id": "metadata/binary/metrics/threshold::many-imports-50", "conf": 1.0, "crit": 1, "desc": "Binary has 50+ imports", "spans": [ [ 0, 21 ] ] }, { "id": "micro-behaviors/ui/help::usage-title", "crit": 2, "desc": "Usage: label (title case)", "spans": [ [ 44800, 42 ] ] }, { "id": "micro-behaviors/ui/help::usage-title-string", "crit": 1, "desc": "Usage: label in binary strings", "spans": [ [ 44800, 42 ] ] }, { "id": "micro-behaviors/fs/file/write/direct::write", "conf": 0.6600000262260437, "crit": 2, "desc": "Write files", "spans": [ [ 3418, 6 ] ] }, { "id": "micro-behaviors/dylib/library/libc::libc-internal-functions-b", "conf": 0.699999988079071, "crit": 2, "desc": "libc internal symbols cluster B", "spans": [ [ 3301, 12 ] ] }, { "id": "micro-behaviors/ui/help::usage-label", "conf": 0.75, "crit": 1, "desc": "Command line usage text", "spans": [ [ 44800, 42 ] ] }, { "id": "micro-behaviors/dylib/library/abi-graphics::cxx-abi-symbols-a", "conf": 0.800000011920929, "crit": 2, "desc": "C++ ABI symbols cluster A", "spans": [ [ 3301, 12 ] ] }, { "id": "micro-behaviors/dylib/library/family::cxx-abi-symbols", "conf": 0.800000011920929, "crit": 2, "desc": "C++ ABI symbols", "spans": [ [ 3301, 12 ] ] } ], "type": "elf" }, { "ctx": [ { "b": "E))420S-r400000000000@$H+0rr910000000000kMy=:00000u\u003ccMh0000000000kMA+z3JJA(9@)tZ0rr911on", "n": [ { "c": 2, "d": "ELF needed library metadata", "i": "metadata/binary/linking/runtime::needed-lib", "o": 0, "z": 1, "cf": 1.0 } ], "ln": 0 }, { "b": "A-t+2y\u0026si5raflLwDl7Av%zA?w[=c\u003ey?Xib0c00{v{-\u003e+z^)c\u003euU17)wDl%(y^S2IvqZjbp*[x=", "n": [ { "c": 2, "d": "Benign network-capable library context", "i": "objectives/supply-chain/trojanized/backdoor::benign-network-library-context", "o": 6056, "z": 12, "cf": 0.8999999761581421 } ], "ln": 6040 }, { "b": "C42DhA+PAkw)Y4YyxdZGB97\u00262yHpN+yHpWZx(0=*B8bn)xkzG}vqGp+zFsg)CX}m*zFsh?vrcB2ASu", "n": [ { "c": 3, "d": "Stack protector/canary enabled", "i": "metadata/hardening/build::stack-protector", "o": 6177, "z": 14, "cf": 0.8999999761581421 } ], "ln": 6161 }, { "b": "B7F\u003c4wPN]?vqG:#v/P\u003eyzdNM]AcU/2xLNP!B8bn)xjVf(yH}=#wmoN*uT+]IB7F\u003c4wPN]\u003eB87", "n": [ { "c": 3, "d": "FORTIFY_SOURCE memcpy bounds check", "i": "metadata/hardening/build::memcpy-chk", "o": 7921, "z": 10, "cf": 0.8500000238418579 } ], "ln": 7905 }, { "b": "x(!i5gbAoUBAhFwB.\u003e\u003c]B98CwBzkP60c00{v{:y/y?WA*By+C%zercXxK#3?pgXSCvrcB2", "n": [ { "c": 2, "d": "Parse time string into time", "i": "micro-behaviors/time/query::strptime", "o": 9016, "z": 8, "cf": 0.20000000298023224 } ], "ln": 9000 }, { "b": "BA?)cCX}m(wP{HPx(4qWB98CmBzkP60c\u0026u%pgXSGwQ5q:xLzo[0c\u0026u%pgXSCA=k)%Ac2/8", "n": [ { "c": 2, "d": "Format time as string", "i": "micro-behaviors/time/query::strftime", "o": 9193, "z": 8, "cf": 0.20000000298023224 } ], "ln": 9177 }, { "b": "ga\u003evngYQ3tnKt^Kga\u003ex-m[=GvlTIP3gbYb5oI4MruOTk?e\u0026rS0oI4MruOTk\u0026h#\u0026{U1o", "n": [ { "c": 2, "d": "libc version string pattern", "i": "micro-behaviors/dylib/library/libc::libc-version-string", "o": 9546, "z": 5, "cf": 0.800000011920929 } ], "ln": 9530 }, { "b": "mk=#fmn^2VqugoGA=k$vvQTs?hz=K!wN/T?x(mMawmoN*08MP!lTJ?*ohnn:pg3^%r8r", "n": [ { "c": 2, "d": "base64 encoding keyword", "i": "micro-behaviors/data/encoded::base64-token", "o": 45279, "z": 6, "cf": 0.699999988079071 } ], "ln": 45263 }, { "b": "k$?nAoI!nCpe$1SqB%jQlp1Kshz+z2nLRMHsPAOZyI[6mzxKahy\u0026%r3z/PY6BrC:ny\u0026%qic3oh-r8rM-zEWZjAc87KzGGD5A+PSv09iVKx\u003ezR\u003crC(R\u003ev}#6jwN/+aAc8", "n": [ { "c": 3, "d": "Encryption API usage markers", "i": "micro-behaviors/crypto/library/keyword::encryption-functions", "o": 45510, "z": 7, "cf": 0.5 }, { "c": 2, "d": "base64 encoding keyword", "i": "micro-behaviors/data/encoded::base64-token", "o": 45463, "z": 6, "cf": 0.699999988079071 } ], "ln": 45447 }, { "b": "axi5(wKHMMw]{6Rc3oK{2)*]hwQby#B75Y)iSHoGA@VHM2#CLRx\u003e8Ahq/(C*BvoLVwJy}WA%.", "n": [ { "c": 2, "d": "Benign terminal socket exec context", "i": "objectives/command-and-control/reverse-shell/dup::unix-terminal-socket-exec-benign-context", "o": 46795, "z": 10, "cf": 0.949999988079071 } ], "ln": 46779 }, { "b": "%nSc0%nSc0%nSc0%nSc0k%^}bmmG^rnLhSHo?[FXqbQs(rArg6sZ2lyv}od.xj#0]yIW\u003c9z/xYpB98LFCx!yVfFLssg=mfIi5@Gx0uhb5l\u003c9F\u0026Hx4qOZ\u003ehQ^u\u003c3DfU.-tVHY^XTZ\u003e\u00263\u003c", "n": [ { "c": 2, "d": "Hardcoded standard base64 alphabet", "i": "micro-behaviors/data/encode/base64::alphabet-standard", "o": 48416, "z": 64, "cf": 0.5 } ], "ln": 48400 }, { "b": "b4kI4xLzN1v@#\u003clwG\u003ceVCSmP*hz=Ra00000000000000000000000000000000000000", "n": [ { "c": 3, "d": "Architecture detection strings", "i": "objectives/discovery/host/software::arch-detection", "o": 53191, "z": 6, "cf": 0.5 } ], "ln": 53175 }, { "b": "BAhFivGn2[zGNNBvrl8Ze[xlBB9RQ5e[xlBB98B5e[Y6Ae{p/DB7]Mg04}]4BUm\u0026GA=U@kzEl]Oe[Y5", "n": [ { "c": 2, "d": "ELF dynstr section name", "i": "metadata/binary/linking/static::elf-dynstr-section-name", "o": 66673, "z": 7, "cf": 0.8999999761581421 }, { "c": 2, "d": "ELF dynsym section name", "i": "metadata/binary/linking/static::elf-dynsym-section-name", "o": 66665, "z": 7, "cf": 0.8999999761581421 } ], "ln": 66649 }, { "b": "vr?\u00269wmoN*e]\u003eJte]\u003e\u003ege[xlBvqPZ*04}!\u003cByte4vSMO\u003ce[n*pzdNQb000000000000000", "n": [ { "c": 2, "d": "ELF dynamic section name", "i": "metadata/binary/linking/static::elf-dynamic-section-name", "o": 66882, "z": 8, "cf": 0.8999999761581421 } ], "ln": 66866 } ], "depth": 1, "facts": { "exp": [ [ "pskc_set_key_policy_pinusagemode" ], [ "pskc_get_key_id" ], [ "pskc_get_key_reference" ], [ "pskc_get_key_profileid" ], [ "pskc_get_device_serialno" ], [ "pskc_set_key_data_secret" ], [ "pskc_set_device_startdate" ], [ "pskc_set_device_devicebinding" ], [ "pskc_get_key_userid" ], [ "pskc_global_init" ], [ "pskc_get_key_algparm_resp_checkdigits" ], [ "pskc_str2keyusage" ], [ "pskc_global_log" ], [ "pskc_set_key_algparm_chall_encoding" ], [ "pskc_get_key_policy_pinkeyid" ], [ "pskc_free" ], [ "pskc_set_key_data_counter" ], [ "pskc_get_key_algparm_chall_max" ], [ "pskc_set_key_policy_pinmaxlength" ], [ "pskc_set_key_data_timedrift" ], [ "pskc_init" ], [ "pskc_get_key_algparm_resp_length" ], [ "pskc_get_device_devicebinding" ], [ "pskc_get_key_policy_pinminlength" ], [ "pskc_set_device_manufacturer" ], [ "pskc_set_device_userid" ], [ "pskc_set_key_algorithm" ], [ "pskc_strerror" ], [ "pskc_set_key_issuer" ], [ "pskc_set_device_serialno" ], [ "pskc_set_key_policy_pinencoding" ], [ "pskc_set_key_algparm_suite" ], [ "pskc_get_key_data_timedrift" ], [ "pskc_global_done" ], [ "pskc_keyusage2str" ], [ "pskc_get_key_policy_expirydate" ], [ "pskc_set_key_algparm_chall_checkdigits" ], [ "pskc_check_version" ], [ "pskc_set_key_algparm_resp_checkdigits" ], [ "pskc_get_key_algparm_resp_encoding" ], [ "pskc_set_device_model" ], [ "pskc_get_key_algparm_chall_min" ], [ "pskc_parse_from_memory" ], [ "pskc_get_key_policy_pinusagemode" ], [ "pskc_set_key_policy_keyusages" ], [ "pskc_set_device_issueno" ], [ "pskc_get_device_manufacturer" ], [ "pskc_get_key_friendlyname" ], [ "pskc_pinusagemode2str" ], [ "pskc_get_id" ], [ "pskc_get_key_algparm_suite" ], [ "pskc_done" ], [ "pskc_set_key_data_time" ], [ "pskc_add_keypackage" ], [ "pskc_set_id" ], [ "pskc_set_key_policy_pinmaxfailedattempts" ], [ "pskc_get_key_algparm_chall_checkdigits" ], [ "pskc_set_key_algparm_chall_max" ], [ "pskc_get_key_policy_keyusages" ], [ "pskc_set_key_algparm_resp_encoding" ], [ "pskc_get_key_policy_pinmaxlength" ], [ "pskc_get_cryptomodule_id" ], [ "pskc_get_key_issuer" ], [ "pskc_set_key_policy_numberoftransactions" ], [ "pskc_set_key_reference" ], [ "pskc_set_key_profileid" ], [ "pskc_get_version" ], [ "pskc_set_key_policy_expirydate" ], [ "pskc_get_key_data_timeinterval" ], [ "pskc_get_device_issueno" ], [ "pskc_set_key_userid" ], [ "pskc_get_key_data_b64secret" ], [ "pskc_set_key_algparm_chall_min" ], [ "pskc_verify_x509crt" ], [ "pskc_get_key_policy_pinmaxfailedattempts" ], [ "pskc_get_keypackage" ], [ "pskc_get_device_userid" ], [ "pskc_get_key_algorithm" ], [ "pskc_sign_x509" ], [ "pskc_get_key_policy_startdate" ], [ "pskc_set_key_friendlyname" ], [ "pskc_get_key_policy_numberoftransactions" ], [ "pskc_set_cryptomodule_id" ], [ "pskc_set_key_data_b64secret" ], [ "pskc_str2pinusagemode" ], [ "pskc_set_key_policy_startdate" ], [ "pskc_validate" ], [ "pskc_get_key_data_counter" ], [ "pskc_output" ], [ "pskc_get_signed_p" ], [ "pskc_get_key_data_secret" ], [ "pskc_strerror_name" ], [ "pskc_set_device_expirydate" ], [ "pskc_valueformat2str" ], [ "pskc_get_key_algparm_chall_encoding" ], [ "pskc_get_key_data_time" ], [ "pskc_set_key_algparm_resp_length" ], [ "pskc_get_device_startdate" ], [ "pskc_get_key_policy_pinencoding" ], [ "pskc_set_key_policy_pinminlength" ], [ "pskc_set_version" ], [ "LIBPSKC_2.2.0" ], [ "pskc_get_device_expirydate" ], [ "pskc_set_key_data_timeinterval" ], [ "pskc_set_key_id" ], [ "pskc_get_device_model" ], [ "pskc_str2valueformat" ], [ "pskc_build_xml" ], [ "LIBPSKC_2.0.0" ], [ "pskc_set_key_policy_pinkeyid" ] ], "imp": [ [ "", "isoc23_strtoul" ], [ "", "free" ], [ "", "xmlDocDumpFormatMemory" ], [ "", "strverscmp" ], [ "", "errno_location" ], [ "", "strncmp" ], [ "", "ITM_deregisterTMCloneTable" ], [ "", "isoc23_strtoull" ], [ "", "reallocarray" ], [ "", "xmlFreeDoc" ], [ "", "xmlNewDoc" ], [ "", "xmlNewChild" ], [ "", "strlen" ], [ "", "stack_chk_fail" ], [ "", "xmlNewTextChild" ], [ "", "xmlSchemaFreeValidCtxt" ], [ "", "xmlInitializeCatalog" ], [ "", "xmlInitParser" ], [ "", "memchr" ], [ "", "xmlCleanupParser" ], [ "", "xmlDocDumpMemory" ], [ "", "calloc" ], [ "", "strcmp" ], [ "", "xmlNewNs" ], [ "", "xmlSchemaFree" ], [ "", "memmove_chk" ], [ "", "memcpy_chk" ], [ "", "gmon_start__" ], [ "", "xmlLoadCatalog" ], [ "", "malloc" ], [ "", "vasprintf_chk" ], [ "", "xmlSchemaValidateDoc" ], [ "", "xmlNewProp" ], [ "", "realloc" ], [ "", "xmlSchemaFreeParserCtxt" ], [ "", "strftime" ], [ "", "memmove" ], [ "", "xmlSchemaParse" ], [ "", "xmlReadMemory" ], [ "", "xmlNewNode" ], [ "", "xmlFree" ], [ "", "xmlSchemaNewValidCtxt" ], [ "", "memset_chk" ], [ "", "ITM_registerTMCloneTable" ], [ "", "xmlDocGetRootElement" ], [ "", "strptime" ], [ "", "cxa_finalize" ], [ "", "xmlSchemaNewParserCtxt" ], [ "", "xmlDocSetRootElement" ] ], "sec": [ [ ".gnu.hash", 680, 1460, 4.31, "alloc" ], [ ".dynsym", 2144, 3840, 2.11, "alloc" ], [ ".dynstr", 5984, 3596, 4.56, "alloc" ], [ ".gnu.version", 9580, 320, 1.7, "alloc" ], [ ".gnu.version_d", 9904, 92, 2.48, "alloc" ], [ ".gnu.version_r", 10000, 112, 2.98, "alloc" ], [ ".rela.dyn", 10112, 528, 1.62, "alloc" ], [ ".rela.plt", 10640, 2256, 1.51, "alloc,info_link" ], [ ".init", 16384, 27, 4.24, "alloc,executable" ], [ ".plt", 16416, 1520, 4.3, "alloc,executable" ], [ ".plt.got", 17936, 16, 3.38, "alloc,executable" ], [ ".plt.sec", 17952, 1504, 3.77, "alloc,executable" ], [ ".text", 19456, 22124, 5.96, "alloc,executable" ], [ ".fini", 41580, 13, 3.24, "alloc,executable" ], [ ".rodata", 45056, 3424, 5.43, "alloc" ], [ ".eh_frame_hdr", 48480, 1092, 4.52, "alloc" ], [ ".eh_frame", 49576, 3448, 4.07, "alloc" ], [ ".note.gnu.property", 53024, 64, 1.91, "alloc" ], [ ".note.package", 53088, 112, 4.83, "alloc" ], [ ".init_array", 55792, 8, 1.06, "write,alloc" ], [ ".fini_array", 55800, 8, 1.06, "write,alloc" ], [ ".data.rel.ro", 55808, 168, 1.96, "write,alloc" ], [ ".dynamic", 55976, 544, 1.62, "write,alloc" ], [ ".got", 56520, 816, 1.72, "write,alloc" ], [ ".data", 57344, 8, 0.54, "write,alloc" ], [ ".comment", 57352, 31, 4.03, "merge,strings" ], [ ".symtab", 57384, 4896, 2.26, "" ], [ ".strtab", 62280, 4348, 4.75, "" ], [ ".shstrtab", 66628, 283, 4.21, "" ] ], "metrics": { "elf": { "bits": 64.0, "entry": 0.0, "has_got": 1.0, "has_plt": 1.0, "has_note": 1.0, "relacount": 17.0, "has_symtab": 1.0, "note_count": 2.0, "nx_enabled": 1.0, "has_cet_ibt": 1.0, "dynrel_count": 0.0, "dynsym_count": 160.0, "has_eh_frame": 1.0, "has_gnu_hash": 1.0, "stack_canary": 1.0, "symtab_count": 204.0, "dynrela_count": 22.0, "has_cet_shstk": 1.0, "little_endian": 1.0, "dt_flags_1_raw": 1.0, "pltreloc_count": 94.0, "dt_versym_count": 160.0, "executable_stack": 0.0, "fini_array_count": 1.0, "init_array_count": 1.0, "wx_segment_count": 0.0, "comment_entry_count": 1.0, "fortify_source_count": 4.0, "program_header_count": 11.0, "comment_distinct_count": 1.0, "gnu_stack_section_absent": 0.0, "load_segment_max_file_size": 25209.0, "stripped_but_symtab_present": 1.0, "load_segment_max_memory_size": 25209.0, "section_relocation_group_count": 2.0, "stripped_metadata_section_count": 5.0 }, "file": { "size": 68896.0, "entropy": 4.89, "size_bytes": 68896.0 }, "binary": { "is_pie": 0.0, "has_overlay": 1.0, "is_stripped": 0.0, "code_entropy": 5.73, "data_entropy": 1.7, "overlay_size": 1985.0, "string_count": 403.0, "overlay_ratio": 0.03, "overall_entropy": 4.89, "overlay_entropy": 1.48, "entropy_variance": 2.13, "avg_string_length": 18.26, "max_string_length": 95.0, "peak_region_bytes": 4096.0, "code_to_data_ratio": 0.94, "peak_region_entropy": 6.21, "string_length_stddev": 10.08, "largest_section_ratio": 0.32, "sentence_string_count": 53.0, "sentence_string_ratio": 0.13, "high_entropy_string_count": 1.0 }, "exports": { "count": 110.0 }, "imports": { "count": 49.0 }, "sections": { "count": 31.0, "code_size": 25204.0, "entropy_max": 5.96, "entropy_mean": 3.11, "name_entropy": 4.15, "writable_count": 7.0, "executable_count": 6.0, "nonstandard_count": 5.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 2.0 } } }, "id": 4, "mol": "Md(He)", "path": "oath-toolkit-2.6.12-r9.apk!!usr/lib/libpskc.so.0.0.1", "risk": 3, "sha": "f0f8b4b401f40e4b6dc13563b4cb6642ca307e32155dac21d183b80d816004bc", "size": 68896, "traits": [ { "id": "metadata/hardening/build::memcpy-chk", "conf": 0.8500000238418579, "crit": 3, "desc": "FORTIFY_SOURCE memcpy bounds check", "spans": [ [ 7921, 10 ] ] }, { "id": "micro-behaviors/dylib/library/libc::libc-characteristic-cxa-finalize", "crit": 2, "desc": "libc characteristic cxa finalize", "spans": [ [ 6056, 12 ] ] }, { "id": "metadata/build/artifact::elf-stripped-but-symtab-present", "conf": 0.6000000238418579, "crit": 3, "desc": "ELF stripped with .symtab present", "spans": [ [ 0, 38 ] ] }, { "id": "micro-behaviors/ui/help::usage-title", "crit": 2, "desc": "Usage: label (title case)", "spans": [ [ 46795, 10 ] ] }, { "id": "micro-behaviors/ui/help::usage-title-string", "crit": 1, "desc": "Usage: label in binary strings", "spans": [ [ 46795, 10 ] ] }, { "id": "micro-behaviors/crypto/library/keyword::encrypt-keyword", "conf": 0.4000000059604645, "crit": 3, "desc": "Generic 'encrypt' term in strings", "spans": [ [ 45510, 7 ] ] }, { "id": "micro-behaviors/dylib/library/libc::libc-internal-functions-b", "conf": 0.699999988079071, "crit": 2, "desc": "libc internal symbols cluster B", "spans": [ [ 6056, 12 ] ] }, { "id": "micro-behaviors/ui/help::usage-label", "conf": 0.75, "crit": 1, "desc": "Command line usage text", "spans": [ [ 46795, 10 ] ] }, { "id": "micro-behaviors/dylib/library/abi-graphics::cxx-abi-symbols-a", "conf": 0.800000011920929, "crit": 2, "desc": "C++ ABI symbols cluster A", "spans": [ [ 6056, 12 ] ] }, { "id": "micro-behaviors/dylib/library/family::cxx-abi-symbols", "conf": 0.800000011920929, "crit": 2, "desc": "C++ ABI symbols", "spans": [ [ 6056, 12 ] ] } ], "type": "elf" }, { "ctx": [ { "b": "DJ", "n": [ { "c": 2, "d": "SPDX SBOM document", "i": "metadata/package/files/system-package::spdx-sbom-document", "o": 0, "z": 1, "cf": 0.9800000190734863 } ], "ln": 1, "addr": 0 }, { "b": "arR\u003eHAaBh]wPz\u003caz/c:War\u003c-Xl%82@e\u0026aX5", "ln": 2, "addr": 2 }, { "b": "arR\u003esvrt{Kx\u003e7Z(B7DKRar\u003cfufFb1ifD@4", "ln": 3, "addr": 31 }, { "b": "arR^Hb5y$6wO#N2oLFM\u0026r+lq)x(v(kiV]R5e\u00262gaec", "ln": 8, "addr": 255 }, { "b": "arR^Hb4CU8vruBdB0rT/tl", "ln": 9, "addr": 289 }, { "b": "arR^HarR\u003ecz/oCMaz\u003eXavqYZ?asIy!e\u0026kEsf!1p$", "n": [ { "c": 2, "d": "Melange-generated SPDX SBOM", "i": "metadata/package/files/system-package::melange-spdx-sbom", "o": 313, "z": 14, "cf": 0.9800000190734863 } ], "ln": 10, "addr": 307 }, { "b": "arR^HarR\u003e7A+w/#x)Kifx(v(Iavx*Jx(mNavrb)faw3DXa]", "ln": 11, "addr": 340 }, { "b": "arR^Ht}t", "ln": 12, "addr": 378 }, { "b": "arR^HarR^HarR\u003eGwObH]wO#0?lT+7Fxk.*ob03?\u003cp^EDwk$su}o*IJum[3r1ec", "ln": 41, "addr": 1295 }, { "b": "arR^HarR^HarR\u003eGwObH]wO#0?rc-B]b03?\u003cAclhqa$J", "ln": 42, "addr": 1345 }, { "b": "arR^HarR^HarR\u003eGwObH]wO#0?oMaAHBz(gziV]R=yIbXpAbdaJz!%31fk\u003eovxF1sAz!%i6Bu?PlhzcZtePJ\u003covrb\u003c\u003ej:n}AuP6-CBUCH8hE{JyBAhp.Cw?qfx^9", "n": [ { "c": 2, "d": "Wolfi APK SPDX SBOM", "i": "metadata/package/files/system-package::wolfi-apk-spdx-sbom", "o": 1380, "z": 83, "cf": 0.9800000190734863 } ], "ln": 43, "addr": 1380 }, { "b": "arR^HarR^HEe", "ln": 44, "addr": 1479 }, { "b": "arR^HarT@v", "ln": 45, "addr": 1489 }, { "b": "arR^HarR\u003esz*c8nz^^fIz!0i$x(v(kiV]RwpEd]Tmn^8RpFJ8+", "ln": 91, "addr": 3375 }, { "b": "arR^HarR\u003eux(4v4l2HaED3T4jb03\u0026UvqH0@ec", "ln": 92, "addr": 3416 }, { "b": "arR^HarR\u003eHz/{8gwL3=KzZ4j+b4j#3B.L(cwft\u00261v@2H=wGUY8w]w/7A=k!qk#ph%l{-{Sfd{6]m[DDBpA?s", "n": [ { "c": 1, "d": "SPDX references APK DB package info", "i": "metadata/package/files/system-package::spdx-apk-pkginfo-source", "o": 3467, "z": 44, "cf": 0.8999999761581421 } ], "ln": 93, "addr": 3446 }, { "b": "arR^HarR\u003eAx\u003e7Z(B7EZSzEWH9wmYo}iV]RwpEd]Tmn^8RpFJ8+", "ln": 94, "addr": 3514 }, { "b": "arR^HarR\u003eAx\u003e7Z(B7E:Jv@bN]wN(#Car\u003crLoF54MfFdi-eO[\u003cqwPw$C", "ln": 95, "addr": 3555 }, { "b": "arR^HarR^HarR\u003eGwObH]wO#0?oMaAHBz(gziV]R=yIbXpAbdaJz!%31fk\u003eovxF1sAz!%i6Bu?PlhzcZtePJ\u003covrb\u003c\u003ej:n}AuP6-CBUCH8hG9RIxk8lDz^^:3eP+]Hy?):ba]", "n": [ { "c": 1, "d": "Wolfi APK package URL in SPDX", "i": "metadata/package/files/system-package::spdx-wolfi-apk-purl", "o": 5032, "z": 90, "cf": 0.8999999761581421 } ], "ln": 132, "addr": 5032 }, { "b": "arR^HarR^HEe", "ln": 133, "addr": 5138 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 6665.0, "entropy": 5.07, "size_bytes": 6665.0 }, "json": { "parsed_bytes": 6665.0, "parse_limit_bytes": 76800.0 }, "binary": { "overall_entropy": 5.07, "peak_region_bytes": 5641.0, "peak_region_entropy": 5.14 } } }, "id": 5, "path": "oath-toolkit-2.6.12-r9.apk!!var/lib/db/sbom/oath-toolkit-2.6.12-r9.spdx.json", "risk": 1, "sha": "26630c323017cf0ce0064d96e1d531c077b393db5e5a79d849ea18a26a3737ff", "size": 6665, "traits": [ { "id": "metadata/package/files/system-package::spdx-apk-pkginfo-source", "conf": 0.8999999761581421, "crit": 1, "desc": "SPDX references APK DB package info", "spans": [ [ 3467, 44 ] ] }, { "id": "metadata/package/files/system-package::spdx-melange-creator", "conf": 0.8999999761581421, "crit": 1, "desc": "Melange SPDX creator", "spans": [ [ 313, 14 ] ] }, { "id": "metadata/package/files/system-package::spdx-wolfi-apk-purl", "conf": 0.8999999761581421, "crit": 1, "desc": "Wolfi APK package URL in SPDX", "spans": [ [ 1380, 83 ], [ 1411, 14 ], [ 5032, 90 ] ] }, { "id": "metadata/package/files/system-package::spdx-melange-namespace", "conf": 0.8999999761581421, "crit": 1, "desc": "Melange SPDX document namespace" }, { "id": "metadata/file/format::valid", "conf": 0.6000000238418579, "crit": 2, "desc": "JSON data format", "spans": [ [ 0, 32 ] ] }, { "id": "metadata/package/files/system-package::spdx-document-version", "conf": 0.8999999761581421, "crit": 1, "desc": "SPDX document version field" }, { "id": "metadata/package/files/system-package::spdx-document-id", "conf": 0.8999999761581421, "crit": 1, "desc": "SPDX document identifier" }, { "id": "metadata/package/files/system-package::spdx-sbom-document", "conf": 0.9800000190734863, "crit": 2, "desc": "SPDX SBOM document" }, { "id": "metadata/package/files/system-package::melange-spdx-sbom", "conf": 0.9800000190734863, "crit": 2, "desc": "Melange-generated SPDX SBOM", "spans": [ [ 313, 14 ] ] }, { "id": "metadata/package/files/system-package::wolfi-apk-spdx-sbom", "conf": 0.9800000190734863, "crit": 2, "desc": "Wolfi APK SPDX SBOM", "spans": [ [ 1380, 83 ], [ 1411, 14 ], [ 3467, 44 ], [ 5032, 90 ] ] } ], "type": "json" }, { "id": 6, "sha": "2f29c27e72dd05db2410684b127f48c5cce01bfa79b4b360fe24f5bcbea01b96", "path": "oath-toolkit-2.6.12-r9.apk!!.PKGINFO", "risk": 1, "size": 707, "type": "text", "depth": 1 }, { "id": 7, "sha": "35cf8197da812c85e40d57891b35c94187569ed474a2dac813ce5090dafcd35c", "path": "oath-toolkit-2.6.12-r9.apk!!usr/share/xml/pskc/xmldsig-core-schema.xsd", "size": 10293, "type": "xml", "depth": 1 }, { "id": 8, "sha": "5dd57f074870e1d91f7eb814aa92967cefcce9011a86adf5e12a769fcf2a237e", "path": "oath-toolkit-2.6.12-r9.apk!!usr/share/xml/pskc/xenc-schema.xsd", "size": 5234, "type": "xml", "depth": 1 }, { "id": 9, "sha": "0e7c3b940ecd51c2481906b359a154b3cf6c4c426937ceadfa228102929a540c", "path": "oath-toolkit-2.6.12-r9.apk!!usr/share/xml/pskc/pskc-schema.xsd", "size": 13588, "type": "xml", "depth": 1 }, { "id": 10, "sha": "780d683757f24409988719fbf54030c09e271505f239d27b559aaa3e3b115950", "path": "oath-toolkit-2.6.12-r9.apk!!usr/share/xml/pskc/catalog-pskc.xml", "size": 628, "type": "xml", "depth": 1 } ], "omitted_files": 5, "rev": "868bd", "v": "8" } }