{
  "ml": {
    "v": "7",
    "eng": "2.2.0-rc.1",
    "lvl": -1,
    "conf": 0,
    "mods": [
      {
        "cls": 0,
        "raw": 0.00004752477,
        "rte": "az",
        "prob": 0.00004752477
      }
    ],
    "prob": 0.00006962816,
    "files": [
      {
        "id": 0,
        "lvl": -1,
        "conf": 0,
        "prob": 0.00006962815677979961,
        "type": "zst"
      },
      {
        "id": 1,
        "lvl": -1,
        "conf": 0,
        "prob": 0.00006962815677979961,
        "type": "elf"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-06-28T00:13:54Z"
  },
  "path": "ascot2e.ko.zst",
  "raw": {
    "files": [
      {
        "id": 0,
        "ctx": [
          {
            "b": "d77-bwc5+vLl4bp(0MH.M$M-uH/fhqfFED%G5xj}ao",
            "n": [
              {
                "c": 2,
                "d": "Binary is not digitally signed",
                "i": "metadata/unsigned",
                "o": 0,
                "z": 1,
                "cf": 1.0
              }
            ],
            "ln": 0
          }
        ],
        "mol": "O₂(AsC)",
        "sha": "6ca891a1caa6a1d29c8d331ccbfa9d6dc9c5b8acd4e7950ebea77a2275c077f5",
        "path": "ascot2e.ko.zst",
        "risk": 3,
        "size": 12911,
        "type": "zst",
        "facts": {
          "metrics": {
            "file": {
              "size": 12911.0,
              "entropy": 7.98,
              "size_bytes": 12911.0
            },
            "binary": {
              "overall_entropy": 7.98,
              "peak_region_bytes": 12911.0,
              "peak_region_entropy": 7.82
            }
          }
        },
        "traits": [
          {
            "id": "objectives/anti-static/obfuscation/payload/code-in-data::nop-sled-in-data",
            "conf": 0.6499999761581421,
            "crit": 3,
            "desc": "Repeated NOP-run pattern in executable section",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "objectives/command-and-control/channel/redundancy::multi-channel-diversity",
            "atk": "T1071",
            "mbc": "B0030",
            "conf": 0.8500000238418579,
            "crit": 3,
            "desc": "C2 infrastructure using multiple communication methods",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/ip/literal::external-ipv4-binary",
            "conf": 0.8500000238418579,
            "crit": 2,
            "desc": "Hardcoded external IPv4 address",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "metadata/build/artifact::elf-stripped-but-symtab-present",
            "conf": 0.6000000238418579,
            "crit": 3,
            "desc": "ELF stripped with .symtab present",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "metadata/package/license::gpl-word",
            "conf": 0.699999988079071,
            "crit": 2,
            "desc": "GPL license reference",
            "from": [
              {
                "file": 1
              }
            ]
          }
        ]
      },
      {
        "ctx": [
          {
            "b": "E))420S-r400000000000rtp-0rr9100000000000000000000fRwyC0000000000kMy=:002m:c\u0026+Q{00000000",
            "n": [
              {
                "c": 3,
                "d": "Recognized XOR-loop byte-pattern marker",
                "i": "objectives/anti-analysis/self-modify/runtime::xor-loop-pattern-recognized-marker",
                "o": 0,
                "z": 10,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 0
          },
          {
            "b": "00000000000000000000KDtM=KDtM=KDtM=KDtM=\u003eL$O.07-367Y%:rrCqD%0@@r(Ire311#i[F{a=Qi00000Ky\u00268S4\u003ccD800000KDtM=KDtM=KDtM=KDtL",
            "n": [
              {
                "c": 3,
                "d": "Repeated NOP-run pattern in executable section",
                "i": "objectives/anti-static/obfuscation/payload/code-in-data::nop-sled-in-data",
                "o": 320,
                "z": 47,
                "cf": 0.6499999761581421
              }
            ],
            "ln": 304
          },
          {
            "b": "mC8fxd*k[M004cWt1BI5sZaf%l0V=.t}%+Z:UAGz%lfH-008i.0000f9@][+e!o4S0000000",
            "n": [
              {
                "c": 3,
                "d": "Dotted-quad PE version metadata marker",
                "i": "objectives/command-and-control/infrastructure/ip::ipv4-version-metadata-marker",
                "o": 2631,
                "z": 9,
                "cf": 0.9399999976158142
              }
            ],
            "ln": 2615
          },
          {
            "b": "Btvz*aw1sQash7KA+e(afNa($gi:{.x)Ktkc1Et.00000c389\u0026x!\u003cfvCxa*rvqfK?wizkHaAz4ajTz^qCPZ*lzAPpR3ig5ac389\u0026nISTQA^5TrvqfK?wizkHayO!\u003eAY\u003eZ5gi:{ZwOjdLfFW\u003eW0000000000c389\u0026x!\u003cfvA+3q8vqfK?wizkHayO!\u003eAY\u003eZ5gi:{ZwOjdLfFW\u003eW0000000000q/uM0ave{[pGf8rayL",
            "n": [
              {
                "c": 2,
                "d": "Hex byte format string",
                "i": "micro-behaviors/data/encode/payload::hex-byte-format",
                "o": 5476,
                "z": 6,
                "cf": 0.6000000238418579
              }
            ],
            "ln": 5460
          },
          {
            "b": "0000000000y?Wx\u003czGxwLm]h\u003eVvrDW9z/O0PzF0/LzE){jA4VfN0aYUZv@=p5BzkT",
            "n": [
              {
                "c": 3,
                "d": "Terminal socket exec helper context",
                "i": "micro-behaviors/process/fd/dup::unix-terminal-socket-exec-benign-context",
                "o": 6658,
                "z": 3,
                "cf": 0.949999988079071
              }
            ],
            "ln": 6642
          },
          {
            "b": "0bjh#uVZr%zGxA3ASxDNB97\u00262yHpN+yHpWZx(0=RwmY{\u003eCvtJf0chH=wn=r(yI^G@y\u0026r/\u003cB7F][0bz",
            "n": [
              {
                "c": 3,
                "d": "Stack protector/canary enabled",
                "i": "metadata/hardening/build::stack-protector",
                "o": 8159,
                "z": 14,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 8143
          }
        ],
        "depth": 1,
        "facts": {
          "exp": [
            [
              "this_module"
            ],
            [
              "ascot2e_attach"
            ],
            [
              "pfx_ascot2e_attach"
            ]
          ],
          "imp": [
            [
              "",
              "memcpy"
            ],
            [
              "",
              "kfree"
            ],
            [
              "",
              "dynamic_dev_dbg"
            ],
            [
              "",
              "fentry__"
            ],
            [
              "",
              "x86_indirect_thunk_rax"
            ],
            [
              "",
              "dump_stack"
            ],
            [
              "",
              "ref_stack_chk_guard"
            ],
            [
              "",
              "stack_chk_fail"
            ],
            [
              "",
              "dev_info"
            ],
            [
              "",
              "print_hex_dump"
            ],
            [
              "",
              "ubsan_handle_out_of_bounds"
            ],
            [
              "",
              "random_kmalloc_seed"
            ],
            [
              "",
              "dev_warn"
            ],
            [
              "",
              "x86_return_thunk"
            ],
            [
              "",
              "kmalloc_cache_noprof"
            ],
            [
              "",
              "i2c_transfer"
            ],
            [
              "",
              "msleep"
            ],
            [
              "",
              "kmalloc_caches"
            ]
          ],
          "sec": [
            [
              "__ksymtab_gpl",
              64,
              12,
              0.0,
              "alloc"
            ],
            [
              ".rela__ksymtab_gpl",
              29952,
              72,
              0.77,
              "info_link"
            ],
            [
              "__kcrctab_gpl",
              76,
              4,
              2.0,
              "alloc"
            ],
            [
              "__jump_table",
              80,
              160,
              0.0,
              "write,alloc"
            ],
            [
              ".rela__jump_table",
              30024,
              720,
              1.64,
              "info_link"
            ],
            [
              "__patchable_function_entries",
              240,
              80,
              0.0,
              "write,alloc"
            ],
            [
              ".rela__patchable_function_entries",
              30744,
              240,
              1.26,
              "info_link"
            ],
            [
              ".text",
              320,
              4472,
              5.38,
              "alloc,executable"
            ],
            [
              ".rela.text",
              30984,
              4680,
              2.51,
              "info_link"
            ],
            [
              ".data",
              4792,
              559,
              1.99,
              "write,alloc"
            ],
            [
              ".rela.data",
              35664,
              1008,
              1.47,
              "info_link"
            ],
            [
              ".rodata",
              5352,
              1218,
              4.44,
              "alloc"
            ],
            [
              ".rela.rodata",
              36672,
              120,
              1.54,
              "info_link"
            ],
            [
              "__mcount_loc",
              6570,
              80,
              0.0,
              "alloc"
            ],
            [
              ".rela__mcount_loc",
              36792,
              240,
              1.32,
              "info_link"
            ],
            [
              ".modinfo",
              6650,
              220,
              5.06,
              "alloc"
            ],
            [
              "__dyndbg",
              6872,
              560,
              0.38,
              "write,alloc"
            ],
            [
              ".rela__dyndbg",
              37032,
              960,
              1.5,
              "info_link"
            ],
            [
              ".comment",
              7432,
              117,
              4.05,
              "merge,strings"
            ],
            [
              ".retpoline_sites",
              7549,
              12,
              0.0,
              "alloc"
            ],
            [
              ".rela.retpoline_sites",
              37992,
              72,
              1.29,
              "info_link"
            ],
            [
              ".return_sites",
              7561,
              48,
              0.0,
              "alloc"
            ],
            [
              ".rela.return_sites",
              38064,
              288,
              1.5,
              "info_link"
            ],
            [
              ".call_sites",
              7609,
              372,
              0.0,
              "alloc"
            ],
            [
              ".rela.call_sites",
              38352,
              2232,
              1.84,
              "info_link"
            ],
            [
              ".note.gnu.build-id",
              7984,
              36,
              4.19,
              "alloc"
            ],
            [
              ".note.package",
              8020,
              108,
              4.74,
              "alloc"
            ],
            [
              "__ksymtab_strings",
              8128,
              16,
              3.16,
              "alloc,merge,strings"
            ],
            [
              "__version_ext_names",
              8144,
              293,
              4.35,
              "alloc"
            ],
            [
              "__version_ext_crcs",
              8440,
              76,
              5.53,
              "alloc"
            ],
            [
              "__versions",
              8520,
              1216,
              2.34,
              "alloc"
            ],
            [
              ".gnu.linkonce.this_module",
              9736,
              1280,
              0.06,
              "write,alloc"
            ],
            [
              ".note.Linux",
              11016,
              48,
              1.97,
              "alloc"
            ],
            [
              ".BTF",
              11064,
              15219,
              5.31,
              ""
            ],
            [
              ".symtab",
              26288,
              2160,
              1.96,
              ""
            ],
            [
              ".strtab",
              28448,
              1503,
              4.74,
              ""
            ],
            [
              ".shstrtab",
              40584,
              420,
              4.41,
              ""
            ]
          ],
          "metrics": {
            "elf": {
              "bits": 64.0,
              "entry": 0.0,
              "has_got": 0.0,
              "has_plt": 0.0,
              "has_note": 1.0,
              "has_symtab": 1.0,
              "note_count": 3.0,
              "nx_enabled": 1.0,
              "dynrel_count": 0.0,
              "dynsym_count": 0.0,
              "has_eh_frame": 0.0,
              "stack_canary": 1.0,
              "symtab_count": 90.0,
              "dynrela_count": 0.0,
              "little_endian": 1.0,
              "pltreloc_count": 0.0,
              "executable_stack": 0.0,
              "wx_segment_count": 0.0,
              "comment_entry_count": 3.0,
              "program_header_count": 0.0,
              "comment_distinct_count": 1.0,
              "gnu_stack_section_absent": 0.0,
              "load_segment_max_file_size": 0.0,
              "stripped_but_symtab_present": 1.0,
              "load_segment_max_memory_size": 0.0,
              "section_relocation_group_count": 11.0,
              "stripped_metadata_section_count": 5.0
            },
            "file": {
              "size": 44289.0,
              "entropy": 4.37,
              "size_bytes": 44289.0
            },
            "binary": {
              "is_pie": 0.0,
              "has_overlay": 1.0,
              "is_stripped": 0.0,
              "code_entropy": 5.38,
              "data_entropy": 0.53,
              "overlay_size": 3285.0,
              "string_count": 567.0,
              "overlay_ratio": 0.07,
              "avg_complexity": 2.61,
              "max_complexity": 38.0,
              "huge_func_count": 1.0,
              "leaf_func_count": 10.0,
              "overall_entropy": 4.37,
              "overlay_entropy": 3.21,
              "tiny_func_count": 17.0,
              "avg_basic_blocks": 4.93,
              "entropy_variance": 3.34,
              "avg_string_length": 15.31,
              "max_string_length": 90.0,
              "peak_region_bytes": 257.0,
              "code_to_data_ratio": 0.63,
              "total_basic_blocks": 138.0,
              "peak_region_entropy": 7.02,
              "string_length_stddev": 8.36,
              "largest_section_ratio": 0.34,
              "sentence_string_count": 14.0,
              "sentence_string_ratio": 0.02,
              "high_entropy_string_count": 0.0
            },
            "exports": {
              "count": 3.0
            },
            "imports": {
              "count": 18.0
            },
            "sections": {
              "count": 40.0,
              "code_size": 4472.0,
              "entropy_max": 5.53,
              "entropy_mean": 2.23,
              "name_entropy": 4.33,
              "writable_count": 6.0,
              "executable_count": 1.0,
              "nonstandard_count": 32.0,
              "executable_writable_count": 0.0
            },
            "functions": {
              "count": 28.0
            },
            "dependencies": {
              "count": 0.0
            }
          }
        },
        "id": 1,
        "mol": "O₂(AsC)",
        "path": "ascot2e.ko.zst!!ascot2e.ko",
        "risk": 3,
        "sha": "875e84137d7e095d03b9c9d4790443247e44fd5a650710942d9a4831654ce61a",
        "size": 44289,
        "traits": [
          {
            "id": "metadata/build/artifact::elf-stripped-but-symtab-present",
            "conf": 0.6000000238418579,
            "crit": 3,
            "desc": "ELF stripped with .symtab present",
            "spans": [
              [
                0,
                38
              ]
            ]
          },
          {
            "id": "objectives/anti-static/obfuscation/payload/code-in-data::nop-sled-in-data",
            "conf": 0.6499999761581421,
            "crit": 3,
            "desc": "Repeated NOP-run pattern in executable section",
            "spans": [
              [
                320,
                47
              ]
            ]
          },
          {
            "id": "metadata/package/license::gpl-word",
            "conf": 0.699999988079071,
            "crit": 2,
            "desc": "GPL license reference",
            "spans": [
              [
                6658,
                3
              ]
            ]
          },
          {
            "id": "micro-behaviors/communications/ip/literal::external-ipv4-binary",
            "conf": 0.8500000238418579,
            "crit": 2,
            "desc": "Hardcoded external IPv4 address",
            "spans": [
              [
                2631,
                9
              ]
            ]
          },
          {
            "id": "objectives/command-and-control/channel/redundancy::multi-channel-diversity",
            "atk": "T1071",
            "mbc": "B0030",
            "conf": 0.8500000238418579,
            "crit": 3,
            "desc": "C2 infrastructure using multiple communication methods",
            "spans": [
              [
                2631,
                9
              ]
            ]
          }
        ],
        "type": "elf"
      }
    ],
    "v": "8"
  }
}