{ "ml": { "v": "7", "eng": "2.2.0-beta.1", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.07143422, "rte": "az", "prob": 0.07143422 } ], "prob": 0.07143422, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.07143422216176987, "type": "xz" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.01689508557319641, "type": "elf" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.000012487173080444336, "type": "deb" } ], "version": "v18.18", "analyzed_at": "2026-06-27T11:03:19Z" }, "path": "collectd-write_prometheus-5.12.0nb27.tgz", "raw": { "files": [ { "id": 0, "ctx": [ { "b": "@wP48s]XK9\u003egl[e0STwA761smBt8:J\u0026W$gclr%Nt7Y", "n": [ { "c": 2, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "o": 0, "z": 1, "cf": 1.0 } ], "ln": 0 } ], "mol": "H(Cm₅)Md(He)", "sha": "74bd8493a4dfdd25f39dd685fb0772498581e7dd60323e5734fcaf3df56ceec9", "path": "collectd-write_prometheus-5.12.0nb27.tgz", "risk": 4, "size": 20868, "type": "xz", "facts": { "metrics": { "file": { "size": 20868.0, "entropy": 7.99, "size_bytes": 20868.0 }, "binary": { "overall_entropy": 7.99, "peak_region_bytes": 20868.0, "peak_region_entropy": 7.84 }, "consistency": { "extension_content_mismatch": 1.0, "extension_content_mismatch.archive_as_archive": 1.0 } } }, "traits": [ { "id": "micro-behaviors/communications/ip/resolve::resolve-getnameinfo", "conf": 0.6600000262260437, "crit": 3, "desc": "Resolve endpoint with getnameinfo", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/dylib/library/family::collectd-plugin-marker--plugin-register", "conf": 0.8999999761581421, "crit": 2, "desc": "Collectd plugin marker (plugin_register_)", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/dylib/library/family::collectd-plugin-marker", "conf": 0.8999999761581421, "crit": 2, "desc": "Collectd plugin marker", "from": [ { "file": 1 } ] }, { "id": "metadata/build/artifact::elf-stripped-but-symtab-present", "conf": 0.6000000238418579, "crit": 3, "desc": "ELF stripped with .symtab present", "from": [ { "file": 1 } ] }, { "id": "metadata/hardening/mitigation::rpath-set", "conf": 0.699999988079071, "crit": 3, "desc": "RPATH/RUNPATH dynamic library path set", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/ip/resolve::resolve-getaddrinfo", "conf": 0.6600000262260437, "crit": 3, "desc": "Resolve endpoint with getaddrinfo", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/socket/listen::listen-sym", "atk": "T1071", "mbc": "C0001", "conf": 0.6000000238418579, "crit": 3, "desc": "listen function symbol", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/dylib/library/family::collectd-plugin-marker--plugin-log", "conf": 0.8999999761581421, "crit": 2, "desc": "Collectd plugin marker (plugin_log)", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/socket/options::options-set", "conf": 0.6600000262260437, "crit": 3, "desc": "Set socket options", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/socket/tcp::listen-symbol-text", "conf": 0.75, "crit": 3, "desc": "Listen API symbol text", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/dylib/library/family::collectd-plugin-marker--module-register", "conf": 0.8999999761581421, "crit": 2, "desc": "Collectd plugin marker (module_register)", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/dylib/library/libc::libc-internal-functions-b", "conf": 0.699999988079071, "crit": 2, "desc": "libc internal symbols cluster B", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/dylib/library/abi-graphics::cxx-abi-symbols-a", "conf": 0.800000011920929, "crit": 2, "desc": "C++ ABI symbols cluster A", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/http/server/listener::libmicrohttpd-start-daemon", "atk": "T1071.001", "mbc": "C0002", "conf": 0.8999999761581421, "crit": 3, "desc": "Starts libmicrohttpd HTTP daemon", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/dylib/library/libc::libc-characteristic-cxa-finalize", "crit": 2, "desc": "libc characteristic cxa finalize", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/socket/bind/function::bind", "conf": 0.75, "crit": 3, "desc": "Bind socket to address", "from": [ { "file": 1 } ] } ] }, { "ctx": [ { "b": "E))420S-r400000000000@$H+0rr9106*I:00000kMy=:00000KHLn\u003c0000000000kMA+z2lm0?aPJR+1][S61on", "n": [ { "c": 3, "d": "RPATH/RUNPATH dynamic library path set", "i": "metadata/hardening/mitigation::rpath-set", "o": 0, "z": 20, "cf": 0.699999988079071 } ], "ln": 0 }, { "b": "0000000000uUj1\u0026x-IHEv%zA?w[=c\u003ey?Xib0af8zwPzu{x(!xcA:JB0vqPN.x(mK30af8NwOkZ#", "n": [ { "c": 2, "d": "Benign network-capable library context", "i": "objectives/supply-chain/trojanized/backdoor::benign-network-library-context", "o": 5033, "z": 12, "cf": 0.8999999761581421 } ], "ln": 5017 }, { "b": "Ab]VgBy\u003eI]BAg]mz#:lLB97\u00262yHpN+yHpWZx(0=)B8C@qx(n380b#:%xk8l\u003cy\u0026r}^xjVf[wmPZ{zF0!!uTE\u003e)v@2T$gCw/IwPS0iv@314Bo2=:zE---x(!xczuarXBz+J7wOD3]zVBx\u0026wO2pXwo8y4w]vVVy\u0026sxa0af8AA=M5o0crj6AS", "n": [ { "c": 3, "d": "Stack protector/canary enabled", "i": "metadata/hardening/build::stack-protector", "o": 5207, "z": 14, "cf": 0.8999999761581421 }, { "c": 3, "d": "Resolve endpoint with getaddrinfo", "i": "micro-behaviors/communications/ip/resolve::resolve-getaddrinfo", "o": 5243, "z": 11, "cf": 0.6600000262260437 }, { "c": 3, "d": "Resolve endpoint with getnameinfo", "i": "micro-behaviors/communications/ip/resolve::resolve-getnameinfo", "o": 5289, "z": 11, "cf": 0.6600000262260437 }, { "c": 3, "d": "Bind socket to address", "i": "micro-behaviors/communications/socket/bind/function::bind", "o": 5277, "z": 4, "cf": 0.75 }, { "c": 3, "d": "Set socket options", "i": "micro-behaviors/communications/socket/options::options-set", "o": 5266, "z": 10, "cf": 0.6600000262260437 }, { "c": 3, "d": "Listen API symbol text", "i": "micro-behaviors/communications/socket/tcp::listen-symbol-text", "o": 5282, "z": 6, "cf": 0.75 }, { "c": 2, "d": "Benign dual-mode socket exec context", "i": "objectives/command-and-control/reverse-shell/dup::unix-dual-mode-socket-exec-benign-context", "o": 5232, "z": 10, "cf": 0.949999988079071 } ], "ln": 5191 }, { "b": "wPv=XuTXa]uT[a/vru5Xo?mVVB97\u0026hByeM!wO(v60crm5Aai\u003c60crm5y?mF:B98Cqz!T7?uTEk.B7Gxl", "n": [ { "c": 3, "d": "Starts libmicrohttpd HTTP daemon", "i": "micro-behaviors/communications/http/server/listener::libmicrohttpd-start-daemon", "o": 5424, "z": 16, "cf": 0.8999999761581421 } ], "ln": 5408 }, { "b": "zGGk)xjk{}wNw!UzFsg)zeS%cy?l%]wOkZ#By/E)AboVfx(mo#wOkZ#By/G1v@Dj6y?m\u0026#v@Dl%x\u003eEA+y\u0026%x8zEmA}xk8BewPzc(zFsg)AboVfx(mo#wOkZ#By/G1CxdztwDlW=B.tAauVGZ\u003cx(!xcA:JV$B8#5kx8()!B.tAauVGZ\u003cx(!xcA:J)3B-.ejCwWy{z^M\u003c\u003cA=k/aBzbldB6\u0026o:y?WD#Byex\u003evpA!:uVk", "n": [ { "c": 2, "d": "Benign POSIX fd redirect shell context", "i": "objectives/command-and-control/reverse-shell/dup::posix-fd-redirect-shell-benign-context", "o": 6163, "z": 30, "cf": 0.9399999976158142 }, { "c": 2, "d": "Benign terminal socket exec context", "i": "objectives/command-and-control/reverse-shell/dup::unix-terminal-socket-exec-benign-context", "o": 6147, "z": 15, "cf": 0.949999988079071 } ], "ln": 6131 }, { "b": "e\u0026S\u0026Ex\u003c$Z(A4ViIe?]3Wy?Wu*e]$}-f!@-owO#2UCxdztwNxy%z/66cxK#sce]$}hoI4MEqu", "n": [ { "c": 2, "d": "libc version string pattern", "i": "micro-behaviors/dylib/library/libc::libc-version-string", "o": 9453, "z": 9, "cf": 0.800000011920929 } ], "ln": 9437 }, { "b": "fFUBsfFCEnatCM5h7*M.bU?])lq{okay/Clx!AsnB%5H(f^5k9f!+mmi4(%AatC\u0026pfFLQAh6uTLwPzAamr\u0026+]bMG8+wPQmql](D2A=+=4xk8loq.i8mf!Lj7gb7BpfekgmgCx}ai64", "n": [ { "c": 2, "d": "NetBSD base system artifact", "i": "metadata/binary/provenance::netbsd-base-system-artifact", "o": 45835, "z": 8, "cf": 0.949999988079071 } ], "ln": 45819 }, { "b": "iYe]uyhWW7xcoS/A3czabU?])lq{okay/ClwO#3hq.i8mf!Lg6gb7BpfebvsfGgaei65-FiX@PnyhWW7xcoS/A3czabU?])lq{okay/Clzz1\u003csB%5H(f^5k9f!+mmi4(%AatC\u0026pfFLQA", "n": [ { "c": 2, "d": "NetBSD RCS ident keyword", "i": "metadata/binary/provenance::netbsd-rcs-id", "o": 45947, "z": 8, "cf": 0.8999999761581421 } ], "ln": 45931 }, { "b": "e]$YEBAhFivGn2]vrl8Ze[xlBB9RQ5e[xlBB98B5e[Y6Ae{p/DB7]Mg04}]4BUm\u0026GA=U@kzEmz:e]\u003eI", "n": [ { "c": 2, "d": "ELF dynstr section name", "i": "metadata/binary/linking/static::elf-dynstr-section-name", "o": 47010, "z": 7, "cf": 0.8999999761581421 }, { "c": 2, "d": "ELF dynsym section name", "i": "metadata/binary/linking/static::elf-dynsym-section-name", "o": 47002, "z": 7, "cf": 0.8999999761581421 } ], "ln": 46986 }, { "b": "v@.M4wmoN*e]\u003eJte]\u003e\u003ege[xlBvqPZ*04}]5Bs}JGBo0}7vrt]Te[e)y04}=1zeA\u003c4Bo0{(", "n": [ { "c": 2, "d": "ELF dynamic section name", "i": "metadata/binary/linking/static::elf-dynamic-section-name", "o": 47193, "z": 8, "cf": 0.8999999761581421 } ], "ln": 47177 } ], "depth": 1, "facts": { "exp": [ [ "io__prometheus__client__metric__pack_to_buffer" ], [ "io__prometheus__client__quantile__unpack" ], [ "io__prometheus__client__untyped__pack" ], [ "io__prometheus__client__counter__get_packed_size" ], [ "io__prometheus__client__bucket__pack_to_buffer" ], [ "io__prometheus__client__metric_family__unpack" ], [ "io__prometheus__client__untyped__free_unpacked" ], [ "io__prometheus__client__counter__descriptor" ], [ "io__prometheus__client__bucket__pack" ], [ "io__prometheus__client__counter__init" ], [ "io__prometheus__client__untyped__descriptor" ], [ "io__prometheus__client__untyped__get_packed_size" ], [ "io__prometheus__client__histogram__pack_to_buffer" ], [ "io__prometheus__client__summary__free_unpacked" ], [ "io__prometheus__client__metric__get_packed_size" ], [ "io__prometheus__client__gauge__descriptor" ], [ "io__prometheus__client__summary__pack" ], [ "io__prometheus__client__histogram__free_unpacked" ], [ "io__prometheus__client__label_pair__unpack" ], [ "io__prometheus__client__metric__unpack" ], [ "io__prometheus__client__quantile__init" ], [ "io__prometheus__client__metric_family__pack" ], [ "io__prometheus__client__metric_type__descriptor" ], [ "io__prometheus__client__histogram__pack" ], [ "io__prometheus__client__untyped__init" ], [ "io__prometheus__client__metric__pack" ], [ "io__prometheus__client__bucket__free_unpacked" ], [ "io__prometheus__client__label_pair__pack_to_buffer" ], [ "module_register" ], [ "io__prometheus__client__summary__get_packed_size" ], [ "io__prometheus__client__metric_family__free_unpacked" ], [ "io__prometheus__client__quantile__pack_to_buffer" ], [ "io__prometheus__client__bucket__unpack" ], [ "io__prometheus__client__metric_family__init" ], [ "io__prometheus__client__metric_family__pack_to_buffer" ], [ "io__prometheus__client__untyped__pack_to_buffer" ], [ "io__prometheus__client__metric__init" ], [ "io__prometheus__client__histogram__unpack" ], [ "io__prometheus__client__label_pair__descriptor" ], [ "io__prometheus__client__gauge__pack_to_buffer" ], [ "io__prometheus__client__counter__pack_to_buffer" ], [ "io__prometheus__client__summary__pack_to_buffer" ], [ "io__prometheus__client__label_pair__pack" ], [ "io__prometheus__client__summary__init" ], [ "io__prometheus__client__gauge__unpack" ], [ "io__prometheus__client__bucket__descriptor" ], [ "io__prometheus__client__label_pair__free_unpacked" ], [ "io__prometheus__client__histogram__descriptor" ], [ "io__prometheus__client__metric_family__get_packed_size" ], [ "io__prometheus__client__quantile__free_unpacked" ], [ "io__prometheus__client__gauge__get_packed_size" ], [ "io__prometheus__client__counter__free_unpacked" ], [ "io__prometheus__client__summary__unpack" ], [ "io__prometheus__client__quantile__get_packed_size" ], [ "io__prometheus__client__metric__free_unpacked" ], [ "io__prometheus__client__counter__unpack" ], [ "io__prometheus__client__gauge__free_unpacked" ], [ "io__prometheus__client__counter__pack" ], [ "io__prometheus__client__bucket__init" ], [ "io__prometheus__client__bucket__get_packed_size" ], [ "io__prometheus__client__label_pair__init" ], [ "io__prometheus__client__quantile__descriptor" ], [ "io__prometheus__client__quantile__pack" ], [ "io__prometheus__client__gauge__init" ], [ "io__prometheus__client__summary__descriptor" ], [ "io__prometheus__client__gauge__pack" ], [ "io__prometheus__client__metric__descriptor" ], [ "io__prometheus__client__histogram__init" ], [ "io__prometheus__client__label_pair__get_packed_size" ], [ "io__prometheus__client__metric_family__descriptor" ], [ "io__prometheus__client__histogram__get_packed_size" ], [ "io__prometheus__client__untyped__unpack" ] ], "imp": [ [ "", "realloc" ], [ "", "memmove" ], [ "", "cxa_finalize" ], [ "", "protobuf_c_message_pack" ], [ "", "strstr" ], [ "", "close" ], [ "", "c_avl_remove" ], [ "", "calloc" ], [ "", "freeaddrinfo" ], [ "", "free" ], [ "", "assert13" ], [ "", "MHD_destroy_response" ], [ "", "plugin_log" ], [ "", "ssnprintf" ], [ "", "hostname_g" ], [ "", "c_avl_pick" ], [ "", "plugin_get_ds" ], [ "", "c_avl_insert" ], [ "", "cf_util_get_string" ], [ "", "strpbrk" ], [ "", "cf_util_get_cdtime" ], [ "", "getnameinfo" ], [ "", "stack_chk_fail" ], [ "", "qsort" ], [ "", "c_avl_destroy" ], [ "", "MHD_create_response_from_buffer" ], [ "", "strjoin" ], [ "", "listen" ], [ "", "libc_mutex_unlock" ], [ "", "protobuf_c_message_free_unpacked" ], [ "", "MHD_queue_response" ], [ "", "stack_chk_guard" ], [ "", "plugin_register_complex_config" ], [ "", "c_avl_get_iterator" ], [ "", "c_complain" ], [ "", "protobuf_c_message_unpack" ], [ "", "c_avl_create" ], [ "", "c_avl_iterator_destroy" ], [ "", "socket30" ], [ "", "setsockopt" ], [ "", "c_avl_iterator_next" ], [ "", "sstrerror" ], [ "", "MHD_start_daemon" ], [ "", "c_avl_get" ], [ "", "protobuf_c_message_pack_to_buffer" ], [ "", "plugin_register_shutdown" ], [ "", "plugin_register_missing" ], [ "", "MHD_add_response_header" ], [ "", "vsnprintf" ], [ "", "errno" ], [ "", "deregister_frame_info" ], [ "", "register_frame_info" ], [ "", "plugin_register_init" ], [ "", "bsearch" ], [ "", "strcasecmp" ], [ "", "strdup" ], [ "", "getaddrinfo" ], [ "", "MHD_stop_daemon" ], [ "", "Jv_RegisterClasses" ], [ "", "plugin_register_write" ], [ "", "bind" ], [ "", "strlen" ], [ "", "libc_mutex_lock" ], [ "", "protobuf_c_buffer_simple_append" ], [ "", "cf_util_get_port_number" ], [ "", "strcmp" ], [ "", "MHD_lookup_connection_value" ], [ "", "protobuf_c_message_get_packed_size" ] ], "sec": [ [ ".hash", 456, 1108, 1.5, "alloc" ], [ ".dynsym", 1568, 3456, 1.99, "alloc" ], [ ".dynstr", 5024, 4498, 4.28, "alloc" ], [ ".gnu.version", 9522, 288, 0.96, "alloc" ], [ ".gnu.version_r", 9816, 32, 2.11, "alloc" ], [ ".rela.dyn", 9848, 3768, 2.09, "alloc" ], [ ".rela.plt", 13616, 1608, 1.69, "alloc,info_link" ], [ ".init", 15232, 14, 3.24, "alloc,executable" ], [ ".plt", 15248, 1088, 4.2, "alloc,executable" ], [ ".plt.got", 16336, 40, 3.24, "alloc,executable" ], [ ".text", 16384, 11005, 5.96, "alloc,executable" ], [ ".fini", 27392, 14, 3.24, "alloc,executable" ], [ ".rodata", 27424, 6616, 4.59, "alloc" ], [ ".eh_frame_hdr", 34040, 644, 4.69, "alloc" ], [ ".eh_frame", 34688, 2380, 4.38, "alloc" ], [ ".note.netbsd.ident", 37068, 24, 3.0, "alloc" ], [ ".note.netbsd.pax", 37092, 20, 1.56, "alloc" ], [ ".ctors", 40632, 16, 1.0, "write,alloc" ], [ ".dtors", 40648, 16, 1.0, "write,alloc" ], [ ".jcr", 40664, 8, 0.0, "write,alloc" ], [ ".data.rel.ro", 40672, 3640, 1.24, "write,alloc" ], [ ".dynamic", 44312, 592, 1.55, "write,alloc" ], [ ".got", 44904, 144, 0.0, "write,alloc" ], [ ".got.plt", 45056, 560, 1.83, "write,alloc" ], [ ".data", 45632, 176, 0.44, "write,alloc" ], [ ".comment", 45808, 27, 3.78, "merge,strings" ], [ ".ident", 45835, 222, 4.7, "merge,strings" ], [ ".SUNW_ctf", 46060, 143, 2.89, "" ], [ ".symtab", 46208, 744, 1.47, "" ], [ ".strtab", 46952, 17, 3.57, "" ], [ ".shstrtab", 46969, 272, 4.23, "" ] ], "metrics": { "elf": { "bits": 64.0, "entry": 16384.0, "has_got": 1.0, "has_plt": 1.0, "has_note": 1.0, "has_rpath": 1.0, "relacount": 119.0, "has_symtab": 1.0, "note_count": 2.0, "nx_enabled": 1.0, "dynrel_count": 0.0, "dynsym_count": 144.0, "has_eh_frame": 1.0, "stack_canary": 1.0, "symtab_count": 31.0, "dynrela_count": 157.0, "little_endian": 1.0, "pltreloc_count": 67.0, "dt_versym_count": 144.0, "executable_stack": 0.0, "wx_segment_count": 0.0, "comment_entry_count": 1.0, "program_header_count": 7.0, "comment_distinct_count": 1.0, "gnu_stack_section_absent": 1.0, "load_segment_max_file_size": 37112.0, "stripped_but_symtab_present": 1.0, "load_segment_max_memory_size": 37112.0, "section_relocation_group_count": 2.0, "stripped_metadata_section_count": 5.0 }, "file": { "size": 49360.0, "entropy": 4.49, "size_bytes": 49360.0 }, "binary": { "is_pie": 0.0, "has_overlay": 1.0, "is_stripped": 0.0, "code_entropy": 5.79, "data_entropy": 1.28, "overlay_size": 2119.0, "string_count": 298.0, "overlay_ratio": 0.04, "overall_entropy": 4.49, "overlay_entropy": 1.49, "entropy_variance": 2.38, "avg_string_length": 27.56, "max_string_length": 199.0, "peak_region_bytes": 9216.0, "code_to_data_ratio": 0.7, "peak_region_entropy": 5.89, "string_length_stddev": 21.63, "largest_section_ratio": 0.22, "sentence_string_count": 35.0, "sentence_string_ratio": 0.12, "high_entropy_string_count": 0.0 }, "exports": { "count": 72.0 }, "imports": { "count": 68.0 }, "sections": { "count": 33.0, "code_size": 12161.0, "entropy_max": 5.96, "entropy_mean": 2.59, "name_entropy": 4.18, "writable_count": 9.0, "executable_count": 5.0, "nonstandard_count": 8.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 12.0 } } }, "id": 1, "mol": "H(Cm₅)Md(He)", "path": "collectd-write_prometheus-5.12.0nb27.tgz!!lib/collectd/write_prometheus.so", "risk": 4, "sha": "3dcce733a86be72f355dcf65bcba80fa0eedc66d8b33a7aeb312316e9c3da559", "size": 49360, "traits": [ { "id": "micro-behaviors/communications/ip/resolve::resolve-getnameinfo", "conf": 0.6600000262260437, "crit": 3, "desc": "Resolve endpoint with getnameinfo", "spans": [ [ 5289, 11 ] ] }, { "id": "micro-behaviors/communications/socket/options::options-set", "conf": 0.6600000262260437, "crit": 3, "desc": "Set socket options", "spans": [ [ 5266, 10 ] ] }, { "id": "micro-behaviors/communications/socket/bind/function::bind", "conf": 0.75, "crit": 3, "desc": "Bind socket to address", "spans": [ [ 5277, 4 ] ] }, { "id": "micro-behaviors/dylib/library/family::collectd-plugin-marker--plugin-register", "conf": 0.8999999761581421, "crit": 2, "desc": "Collectd plugin marker (plugin_register_)", "spans": [ [ 6163, 30 ], [ 6194, 20 ], [ 6215, 21 ], [ 6237, 23 ], [ 6261, 24 ] ] }, { "id": "micro-behaviors/dylib/library/family::collectd-plugin-marker--module-register", "conf": 0.8999999761581421, "crit": 2, "desc": "Collectd plugin marker (module_register)", "spans": [ [ 6147, 15 ] ] }, { "id": "metadata/hardening/mitigation::rpath-set", "conf": 0.699999988079071, "crit": 3, "desc": "RPATH/RUNPATH dynamic library path set", "spans": [ [ 0, 20 ] ] }, { "id": "micro-behaviors/dylib/library/family::collectd-plugin-marker--plugin-log", "conf": 0.8999999761581421, "crit": 2, "desc": "Collectd plugin marker (plugin_log)", "spans": [ [ 5232, 10 ] ] }, { "id": "micro-behaviors/communications/socket/listen::listen-sym", "atk": "T1071", "mbc": "C0001", "conf": 0.6000000238418579, "crit": 3, "desc": "listen function symbol", "spans": [ [ 5282, 6 ] ] }, { "id": "micro-behaviors/communications/socket/tcp::listen-symbol-text", "conf": 0.75, "crit": 3, "desc": "Listen API symbol text", "spans": [ [ 5282, 6 ] ] }, { "id": "micro-behaviors/communications/http/server/listener::libmicrohttpd-start-daemon", "atk": "T1071.001", "mbc": "C0002", "conf": 0.8999999761581421, "crit": 3, "desc": "Starts libmicrohttpd HTTP daemon", "spans": [ [ 5424, 16 ] ] }, { "id": "micro-behaviors/communications/ip/resolve::resolve-getaddrinfo", "conf": 0.6600000262260437, "crit": 3, "desc": "Resolve endpoint with getaddrinfo", "spans": [ [ 5243, 11 ] ] }, { "id": "micro-behaviors/dylib/library/libc::libc-characteristic-cxa-finalize", "crit": 2, "desc": "libc characteristic cxa finalize", "spans": [ [ 5033, 12 ] ] }, { "id": "metadata/build/artifact::elf-stripped-but-symtab-present", "conf": 0.6000000238418579, "crit": 3, "desc": "ELF stripped with .symtab present", "spans": [ [ 0, 38 ] ] }, { "id": "micro-behaviors/dylib/library/family::collectd-plugin-marker", "conf": 0.8999999761581421, "crit": 2, "desc": "Collectd plugin marker", "spans": [ [ 5232, 10 ], [ 6147, 15 ], [ 6163, 30 ], [ 6194, 20 ], [ 6215, 21 ], [ 6237, 23 ], [ 6261, 24 ] ] }, { "id": "micro-behaviors/dylib/library/libc::libc-internal-functions-b", "conf": 0.699999988079071, "crit": 2, "desc": "libc internal symbols cluster B", "spans": [ [ 5033, 12 ] ] }, { "id": "micro-behaviors/dylib/library/abi-graphics::cxx-abi-symbols-a", "conf": 0.800000011920929, "crit": 2, "desc": "C++ ABI symbols cluster A", "spans": [ [ 5033, 12 ] ] } ], "type": "elf" }, { "depth": 1, "facts": { "metrics": { "file": { "size": 63988.0, "entropy": 4.3, "size_bytes": 63988.0 }, "binary": { "overall_entropy": 4.3, "peak_region_bytes": 8192.0, "peak_region_entropy": 5.44 }, "consistency": { "extension_content_mismatch": 1.0, "extension_content_mismatch.archive_as_unknown": 1.0 } } }, "id": 2, "path": "collectd-write_prometheus-5.12.0nb27.tgz!!lib/collectd/write_prometheus.a", "sha": "47950d817decedd35ce5365b14be208472c6909500e3cfba008dd2ffb5908c41", "size": 63988, "type": "deb" } ], "rev": "868bd", "v": "8" } }