{
  "ml": {
    "v": "7",
    "eng": "2.2.0-beta.1",
    "lvl": -1,
    "conf": 0,
    "mods": [
      {
        "cls": 0,
        "raw": 0.000048230093,
        "rte": "az",
        "prob": 0.000048230093
      }
    ],
    "prob": 0.00007509192,
    "files": [
      {
        "id": 0,
        "lvl": -1,
        "conf": 0,
        "prob": 0.00007509192073484883,
        "type": "zst"
      },
      {
        "id": 1,
        "lvl": -1,
        "conf": 0,
        "prob": 0.00007509192073484883,
        "type": "elf"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-06-28T00:21:05Z"
  },
  "path": "yamaha-yas530.ko.zst",
  "raw": {
    "files": [
      {
        "id": 0,
        "ctx": [
          {
            "b": "d77-bQ}]m@0q7gft7#O\u0026kRRtu1bqn!TJb-P8\u0026iTs76",
            "n": [
              {
                "c": 2,
                "d": "Binary is not digitally signed",
                "i": "metadata/unsigned",
                "o": 0,
                "z": 1,
                "cf": 1.0
              }
            ],
            "ln": 0
          }
        ],
        "mol": "O₂(AsC)",
        "sha": "5a47513127ef0f22336c237360194e18c0b39bff6a0d0a65a0ed4850012baac9",
        "path": "yamaha-yas530.ko.zst",
        "risk": 3,
        "size": 18366,
        "type": "zst",
        "facts": {
          "metrics": {
            "file": {
              "size": 18366.0,
              "entropy": 7.98,
              "size_bytes": 18366.0
            },
            "binary": {
              "overall_entropy": 7.98,
              "peak_region_bytes": 18366.0,
              "peak_region_entropy": 7.82
            }
          }
        },
        "traits": [
          {
            "id": "metadata/package/license::gpl-word",
            "conf": 0.699999988079071,
            "crit": 2,
            "desc": "GPL license reference",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "objectives/command-and-control/channel/redundancy::multi-channel-diversity",
            "atk": "T1071",
            "mbc": "B0030",
            "conf": 0.8500000238418579,
            "crit": 3,
            "desc": "C2 infrastructure using multiple communication methods",
            "from": [
              {
                "off": 7353,
                "file": 1
              }
            ]
          },
          {
            "id": "micro-behaviors/ui/help::benign-cli-tool",
            "conf": 0.8500000238418579,
            "crit": 1,
            "desc": "Documented or licensed userland tool",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "objectives/anti-static/obfuscation/payload/code-in-data::nop-sled-in-data",
            "conf": 0.6499999761581421,
            "crit": 3,
            "desc": "Repeated NOP-run pattern in executable section",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/ip/literal::external-ipv4-binary",
            "conf": 0.8500000238418579,
            "crit": 2,
            "desc": "Hardcoded external IPv4 address",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "metadata/build/artifact::elf-stripped-but-symtab-present",
            "conf": 0.6000000238418579,
            "crit": 3,
            "desc": "ELF stripped with .symtab present",
            "from": [
              {
                "file": 1
              }
            ]
          }
        ]
      },
      {
        "ctx": [
          {
            "b": "E))420S-r400000000000rtp-0rr9100000000000000000000URl7T0000000000kMy=:002m:f-S)c00000000",
            "n": [
              {
                "c": 2,
                "d": "Binary has low average complexity",
                "i": "metadata/binary/metrics/threshold::avg-complexity-15-max",
                "o": 0,
                "z": 28,
                "cf": 1.0
              }
            ],
            "ln": 0
          },
          {
            "b": "00000000000000000000KDtM=KDtM=KDtM=KDtM=\u003eL$O.098NFHOa.H07.:TnjXQ0t}#xz000004\u003ca4pKDtM=KDtM=KDtM=KDtM=\u003eL$O.09b2Aq2*N}Xb=N",
            "n": [
              {
                "c": 3,
                "d": "Repeated NOP-run pattern in executable section",
                "i": "objectives/anti-static/obfuscation/payload/code-in-data::nop-sled-in-data",
                "o": 768,
                "z": 47,
                "cf": 0.6499999761581421
              }
            ],
            "ln": 752
          },
          {
            "b": "00000InB$Z4$%#-004(5t3Bo$l0V=.t}%+Z{a=Qi000004\u003c7!kKDtM=KDtM=KDtM=KDtN/00",
            "n": [
              {
                "c": 3,
                "d": "Hardcoded external IPv4 address",
                "i": "micro-behaviors/communications/ip/literal::external-ipv4-binary",
                "o": 7353,
                "z": 9,
                "cf": 0.8500000238418579
              }
            ],
            "ln": 7337
          },
          {
            "b": "00000003LvC4\u003eC$aw1%zb}}90ay]z4B8AvEaz\u003eLev}V#hA%.)E00000004aYx\u003eI6\u0026",
            "n": [
              {
                "c": 2,
                "d": "Printf hex byte format",
                "i": "micro-behaviors/data/encode/payload::printf-hex-byte-format",
                "o": 13730,
                "z": 4,
                "cf": 0.6000000238418579
              }
            ],
            "ln": 13714
          },
          {
            "b": "t}#xz00000y?Wx\u003czGxwLm]h(4B$%5aB-.qnAY)9gzGQ1ys7b]YwOC(VwmY*(A+PE",
            "n": [
              {
                "c": 2,
                "d": "Benign terminal socket exec context",
                "i": "objectives/command-and-control/reverse-shell/dup::unix-terminal-socket-exec-benign-context",
                "o": 17872,
                "z": 3,
                "cf": 0.949999988079071
              }
            ],
            "ln": 17856
          },
          {
            "b": "v}x1/vqYQ]zeJ{aA@YMOB97\u00262yHpN+yHpWZx(0=RwmY{\u003eCvtJf0bV\u003e2wQ4M#z!0L.yJKocwNx7YBn#",
            "n": [
              {
                "c": 3,
                "d": "Stack protector/canary enabled",
                "i": "metadata/hardening/build::stack-protector",
                "o": 22527,
                "z": 14,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 22511
          }
        ],
        "depth": 1,
        "facts": {
          "exp": [
            [
              "this_module"
            ],
            [
              "cleanup_module"
            ],
            [
              "init_module"
            ],
            [
              "pfx_init_module"
            ],
            [
              "pfx_cleanup_module"
            ]
          ],
          "imp": [
            [
              "",
              "regmap_write"
            ],
            [
              "",
              "ktime_get_mono_fast_ns"
            ],
            [
              "",
              "pm_runtime_set_autosuspend_delay"
            ],
            [
              "",
              "iio_push_to_buffers"
            ],
            [
              "",
              "gpiod_set_value_cansleep"
            ],
            [
              "",
              "i2c_client_get_device_id"
            ],
            [
              "",
              "usleep_range_state"
            ],
            [
              "",
              "devm_gpiod_get_optional"
            ],
            [
              "",
              "dynamic_dev_dbg"
            ],
            [
              "",
              "fentry__"
            ],
            [
              "",
              "x86_indirect_thunk_rax"
            ],
            [
              "",
              "pm_runtime_set_status"
            ],
            [
              "",
              "add_device_randomness"
            ],
            [
              "",
              "dump_stack"
            ],
            [
              "",
              "ref_stack_chk_guard"
            ],
            [
              "",
              "devm_regmap_init_i2c"
            ],
            [
              "",
              "stack_chk_fail"
            ],
            [
              "",
              "pm_runtime_enable"
            ],
            [
              "",
              "regulator_bulk_disable"
            ],
            [
              "",
              "dev_info"
            ],
            [
              "",
              "ubsan_handle_out_of_bounds"
            ],
            [
              "",
              "iio_show_mount_matrix"
            ],
            [
              "",
              "i2c_register_driver"
            ],
            [
              "",
              "dev_err"
            ],
            [
              "",
              "memchr_inv"
            ],
            [
              "",
              "iio_device_register"
            ],
            [
              "",
              "mutex_lock"
            ],
            [
              "",
              "i2c_get_match_data"
            ],
            [
              "",
              "iio_read_mount_matrix"
            ],
            [
              "",
              "devm_iio_device_alloc"
            ],
            [
              "",
              "dev_warn"
            ],
            [
              "",
              "x86_return_thunk"
            ],
            [
              "",
              "regulator_bulk_enable"
            ],
            [
              "",
              "devm_regulator_bulk_get"
            ],
            [
              "",
              "iio_get_time_ns"
            ],
            [
              "",
              "iio_device_unregister"
            ],
            [
              "",
              "regmap_read"
            ],
            [
              "",
              "regmap_bulk_write"
            ],
            [
              "",
              "pm_runtime_resume"
            ],
            [
              "",
              "mutex_unlock"
            ],
            [
              "",
              "iio_triggered_buffer_setup_ext"
            ],
            [
              "",
              "pm_runtime_force_resume"
            ],
            [
              "",
              "ktime_get"
            ],
            [
              "",
              "regmap_bulk_read"
            ],
            [
              "",
              "dev_err_probe"
            ],
            [
              "",
              "iio_trigger_notify_done"
            ],
            [
              "",
              "pm_runtime_suspend"
            ],
            [
              "",
              "i2c_del_driver"
            ],
            [
              "",
              "ubsan_handle_load_invalid_value"
            ],
            [
              "",
              "pm_runtime_use_autosuspend"
            ],
            [
              "",
              "pm_runtime_disable"
            ],
            [
              "",
              "pm_runtime_force_suspend"
            ],
            [
              "",
              "pm_runtime_idle"
            ],
            [
              "",
              "SCT__might_resched"
            ],
            [
              "",
              "mutex_init_generic"
            ],
            [
              "",
              "iio_triggered_buffer_cleanup"
            ]
          ],
          "sec": [
            [
              "__jump_table",
              64,
              496,
              0.0,
              "write,alloc"
            ],
            [
              ".rela__jump_table",
              48264,
              2232,
              1.85,
              "info_link"
            ],
            [
              "__patchable_function_entries",
              560,
              208,
              0.0,
              "write,alloc"
            ],
            [
              ".rela__patchable_function_entries",
              50496,
              624,
              1.49,
              "info_link"
            ],
            [
              ".text",
              768,
              11177,
              5.46,
              "alloc,executable"
            ],
            [
              ".rela.text",
              51120,
              12672,
              2.69,
              "info_link"
            ],
            [
              ".data",
              11952,
              1058,
              1.29,
              "write,alloc"
            ],
            [
              ".rela.data",
              63792,
              1416,
              1.62,
              "info_link"
            ],
            [
              ".rodata",
              13016,
              4544,
              2.4,
              "alloc"
            ],
            [
              ".rela.rodata",
              65208,
              1416,
              1.85,
              "info_link"
            ],
            [
              "__mcount_loc",
              17560,
              200,
              0.0,
              "alloc"
            ],
            [
              ".rela__mcount_loc",
              66624,
              600,
              1.5,
              "info_link"
            ],
            [
              ".init.text",
              17760,
              54,
              2.72,
              "alloc,executable"
            ],
            [
              ".rela.init.text",
              67224,
              120,
              1.88,
              "info_link"
            ],
            [
              ".smp_locks",
              17816,
              8,
              0.0,
              "alloc"
            ],
            [
              ".rela.smp_locks",
              67344,
              48,
              1.21,
              "info_link"
            ],
            [
              ".exit.text",
              17824,
              40,
              2.55,
              "alloc,executable"
            ],
            [
              ".rela.exit.text",
              67392,
              72,
              1.94,
              "info_link"
            ],
            [
              ".modinfo",
              17864,
              577,
              5.06,
              "alloc"
            ],
            [
              ".exit.data",
              18448,
              8,
              0.0,
              "write,alloc"
            ],
            [
              ".rela.exit.data",
              67464,
              24,
              0.5,
              "info_link"
            ],
            [
              ".init.data",
              18456,
              8,
              0.0,
              "write,alloc"
            ],
            [
              ".rela.init.data",
              67488,
              24,
              0.5,
              "info_link"
            ],
            [
              "__dyndbg",
              18464,
              1736,
              0.48,
              "write,alloc"
            ],
            [
              ".rela__dyndbg",
              67512,
              2976,
              1.73,
              "info_link"
            ],
            [
              ".comment",
              20200,
              117,
              4.05,
              "merge,strings"
            ],
            [
              ".static_call_sites",
              20317,
              16,
              0.0,
              "write,alloc"
            ],
            [
              ".rela.static_call_sites",
              70488,
              96,
              1.11,
              "info_link"
            ],
            [
              ".retpoline_sites",
              20333,
              28,
              0.0,
              "alloc"
            ],
            [
              ".rela.retpoline_sites",
              70584,
              168,
              1.49,
              "info_link"
            ],
            [
              ".return_sites",
              20361,
              128,
              0.0,
              "alloc"
            ],
            [
              ".rela.return_sites",
              70752,
              768,
              1.71,
              "info_link"
            ],
            [
              ".call_sites",
              20489,
              992,
              0.0,
              "alloc"
            ],
            [
              ".rela.call_sites",
              71520,
              5952,
              2.03,
              "info_link"
            ],
            [
              ".note.gnu.build-id",
              21484,
              36,
              4.25,
              "alloc"
            ],
            [
              ".note.package",
              21520,
              108,
              4.73,
              "alloc"
            ],
            [
              "__version_ext_names",
              21632,
              1136,
              4.29,
              "alloc"
            ],
            [
              "__version_ext_crcs",
              22768,
              228,
              6.73,
              "alloc"
            ],
            [
              "__versions",
              23000,
              3648,
              2.81,
              "alloc"
            ],
            [
              ".gnu.linkonce.this_module",
              26648,
              1280,
              0.11,
              "write,alloc"
            ],
            [
              ".rela.gnu.linkonce.this_module",
              77472,
              48,
              1.05,
              "info_link"
            ],
            [
              ".note.Linux",
              27928,
              48,
              1.97,
              "alloc"
            ],
            [
              ".BTF",
              27976,
              11221,
              5.21,
              ""
            ],
            [
              ".symtab",
              39200,
              5064,
              2.17,
              ""
            ],
            [
              ".strtab",
              44264,
              3994,
              4.84,
              ""
            ],
            [
              ".shstrtab",
              77520,
              478,
              4.3,
              ""
            ]
          ],
          "metrics": {
            "elf": {
              "bits": 64.0,
              "entry": 0.0,
              "has_got": 0.0,
              "has_plt": 0.0,
              "has_note": 1.0,
              "has_symtab": 1.0,
              "note_count": 3.0,
              "nx_enabled": 1.0,
              "dynrel_count": 0.0,
              "dynsym_count": 0.0,
              "has_eh_frame": 0.0,
              "stack_canary": 1.0,
              "symtab_count": 211.0,
              "dynrela_count": 0.0,
              "little_endian": 1.0,
              "pltreloc_count": 0.0,
              "executable_stack": 0.0,
              "wx_segment_count": 0.0,
              "comment_entry_count": 3.0,
              "program_header_count": 0.0,
              "comment_distinct_count": 1.0,
              "gnu_stack_section_absent": 0.0,
              "load_segment_max_file_size": 0.0,
              "stripped_but_symtab_present": 1.0,
              "load_segment_max_memory_size": 0.0,
              "section_relocation_group_count": 17.0,
              "stripped_metadata_section_count": 5.0
            },
            "file": {
              "size": 81857.0,
              "entropy": 4.0,
              "size_bytes": 81857.0
            },
            "binary": {
              "is_pie": 0.0,
              "has_overlay": 1.0,
              "is_stripped": 0.0,
              "code_entropy": 5.44,
              "data_entropy": 0.49,
              "overlay_size": 3859.0,
              "string_count": 576.0,
              "overlay_ratio": 0.05,
              "avg_complexity": 2.55,
              "max_complexity": 26.0,
              "huge_func_count": 0.0,
              "leaf_func_count": 28.0,
              "overall_entropy": 4.0,
              "overlay_entropy": 3.03,
              "tiny_func_count": 39.0,
              "avg_basic_blocks": 4.42,
              "entropy_variance": 3.17,
              "avg_string_length": 18.69,
              "max_string_length": 90.0,
              "peak_region_bytes": 1985.0,
              "code_to_data_ratio": 0.7,
              "total_basic_blocks": 287.0,
              "peak_region_entropy": 6.57,
              "string_length_stddev": 9.11,
              "largest_section_ratio": 0.15,
              "sentence_string_count": 25.0,
              "sentence_string_ratio": 0.04,
              "high_entropy_string_count": 0.0
            },
            "exports": {
              "count": 5.0
            },
            "imports": {
              "count": 56.0
            },
            "sections": {
              "count": 49.0,
              "code_size": 11271.0,
              "entropy_max": 6.73,
              "entropy_mean": 1.99,
              "name_entropy": 4.22,
              "writable_count": 9.0,
              "executable_count": 3.0,
              "nonstandard_count": 41.0,
              "executable_writable_count": 0.0
            },
            "functions": {
              "count": 65.0
            },
            "dependencies": {
              "count": 0.0
            }
          }
        },
        "id": 1,
        "mol": "O₂(AsC)",
        "path": "yamaha-yas530.ko.zst!!yamaha-yas530.ko",
        "risk": 3,
        "sha": "6d208f58f9c38ada9a73b1d9c9284a65faa5b4a83a1384f65bfdb803b97e3bef",
        "size": 81857,
        "traits": [
          {
            "id": "objectives/anti-static/obfuscation/payload/code-in-data::nop-sled-in-data",
            "conf": 0.6499999761581421,
            "crit": 3,
            "desc": "Repeated NOP-run pattern in executable section",
            "spans": [
              [
                768,
                47
              ]
            ]
          },
          {
            "id": "metadata/build/artifact::elf-stripped-but-symtab-present",
            "conf": 0.6000000238418579,
            "crit": 3,
            "desc": "ELF stripped with .symtab present",
            "spans": [
              [
                0,
                38
              ]
            ]
          },
          {
            "id": "metadata/package/license::gpl-word",
            "conf": 0.699999988079071,
            "crit": 2,
            "desc": "GPL license reference",
            "spans": [
              [
                17872,
                3
              ]
            ]
          },
          {
            "id": "micro-behaviors/communications/ip/literal::external-ipv4-binary",
            "conf": 0.8500000238418579,
            "crit": 2,
            "desc": "Hardcoded external IPv4 address",
            "spans": [
              [
                7353,
                9
              ]
            ]
          },
          {
            "id": "micro-behaviors/ui/help::benign-cli-tool",
            "conf": 0.8500000238418579,
            "crit": 1,
            "desc": "Documented or licensed userland tool",
            "spans": [
              [
                17872,
                3
              ]
            ]
          },
          {
            "id": "objectives/command-and-control/channel/redundancy::multi-channel-diversity",
            "atk": "T1071",
            "mbc": "B0030",
            "conf": 0.8500000238418579,
            "crit": 3,
            "desc": "C2 infrastructure using multiple communication methods",
            "spans": [
              [
                7353,
                9
              ]
            ]
          }
        ],
        "type": "elf"
      }
    ],
    "rev": "868bd",
    "v": "8"
  }
}