{ "llm": { "conf": 0.4559348, "grade": "benign", "model": "Qwen/Qwen3.6-27B", "outcome": "benign", "interpretation": "Legitimate archive utility binary" }, "ml": { "v": "7", "eng": "2.3.1-beta.0", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.22276397, "rte": "az", "prob": 0.22276397 } ], "prob": 0.22276397, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.22276397049427032, "type": "xz" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.0000062187514231482055, "type": "python" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.000010788440704345703, "type": "elf" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.000007321437351492932, "type": "elf" } ], "version": "v18.18", "analyzed_at": "2026-07-24T00:22:42Z" }, "path": "zoo-2.10.1nb4.tgz", "raw": { "files": [ { "id": 0, "mol": "H(F₄)Md(He)", "sha": "80092f0918448f613467f573d488a8a805d0b11d24410c589fd422d6916e1d86", "path": "zoo-2.10.1nb4.tgz", "risk": 4, "size": 57480, "type": "xz", "facts": { "metrics": { "file": { "size": 57480.0, "entropy": 8.0, "size_bytes": 57480.0 }, "binary": { "overall_entropy": 8.0, "peak_region_bytes": 57344.0, "peak_region_entropy": 7.84 }, "consistency": { "extension_content_mismatch": 1.0, "extension_content_mismatch.archive_as_archive": 1.0 } } }, "traits": [ { "id": "micro-behaviors/fs/chmod/modify::python-path-chmod", "atk": "T1222", "mbc": "E1222", "conf": 0.8500000238418579, "crit": 3, "desc": "Python calls chmod to change permissions", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/directory/readdir::readdir-readdir", "conf": 0.6600000262260437, "crit": 3, "desc": "Uses readdir", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/fs/file/delete::unlink", "conf": 0.30000001192092896, "crit": 3, "desc": "Delete files", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/data/source/syntax/keyword::py-keyword-xor", "conf": 0.6000000238418579, "crit": 3, "desc": "Python bitwise XOR operator", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/file/binary::fseek-text", "atk": "T1005", "crit": 2, "desc": "References the CRT fseek file-position routine", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/fs/chmod/modify::syscall-chmod", "atk": "T1222", "mbc": "E1222", "conf": 0.6600000262260437, "crit": 3, "desc": "chmod syscall", "from": [ { "file": 2 } ] }, { "id": "metadata/hardening/missing::stripped-binary", "conf": 0.800000011920929, "crit": 3, "desc": "No full symbol table (likely stripped)", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/fs/file/open::fopen", "conf": 0.6600000262260437, "crit": 3, "desc": "Opens file with C fopen", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/fs/file/binary::fseek-func", "atk": "T1005", "conf": 0.4000000059604645, "crit": 2, "desc": "Seeks to position in file", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/fs/file/binary::file-manipulation", "atk": "T1005", "conf": 0.75, "crit": 3, "desc": "File content manipulation (read/write/seek)", "from": [ { "file": 2 }, { "file": 3 } ] }, { "id": "micro-behaviors/fs/file/binary::binary-read-write-ops", "atk": "T1005", "conf": 0.699999988079071, "crit": 3, "desc": "Binary file read/write operations", "from": [ { "file": 2 }, { "file": 3 } ] } ] }, { "ctx": [ { "b": "z.r:}B%5H(g:1!kfebsrfGymfgcdfFiY5Mlwn2K}x=]\u0026?A3czke)GOce)GOymSiq\u0026w]zZbvruQ9zF78ox([2hzGoVcw\u0026ZnKtP$pkaAR7eaBm%Ae?[F@az#jrw[Aeqzddr8D(#{qyZI!1a%oE0aAIjmB.\u003eOhvR3W3z/Y#lvR/P#Bz\u0026pAB7DFoA=kM4azC.mBy!(\u003eaA7\u003cmzGoVcw/$M9BrBc$xKM6}zyoJke)GOyv@Dl%x(X64wft#cx(+)Haw%*We^:joa{]@uvg1R^nfz8ipARwmb1=#]C{23%atC(pf^l@Sk#X%.3nb\u003e2aAIi6e[e\u0026de]Ckyh3$%jpZQDtlr)+vf\u003cFr*3nbdK3n9}re(Lp-pc?Py3vlSeay3Gvzddr@Ack#9By=O6A:@=%C4C.qz!pb7x(4v4azCZov@Dj6A+frkwN(]}z/PX4e(Lp-q=#\u003c\u003ep/x}:3naT/Dt^ZA3nbjyaBtktv}Fbuxj%*", "ln": 113, "col": 12, "line": 3 }, { "b": "aBm%Aazq9mq+e30mn(MKnL\u0026wTpFIlHnG.hPzWHi1aA.:pwft#jay/C6vru66vqYP#zddc@Byw)3ay/tay?m9#x(v)gaA7\u003cmw[=6)B0bgmay/tbAb]JhB7F(8w]zZbe^+f(aA.:pB0a)loL56WwO-@4x)7Rez/6DlwPI{bz/cXay?EWbx([39aARp9BrCjgC4C.qB8UL$wGV55C4\u003e\u0026bA%=S0aARpdaAy[dxjSi7w/@\u0026.b{mqFauh53ay]55wO#3)zF78gzxK4mwGV8uAaHegw/$Y1y?j-1vrt{g3na))t5Or^v{%l$B98tvwGUA0wft@8y?m9#x)a67C{3WyBAg/1", "ln": 613, "col": 3, "line": 30 }, { "b": "B98tvwN(]@wO#71vruj4zGu}jA=k!qwQ4Y@wN]H)xcqqfwGVbpwPxwzAaJJ[w[+*!az++ex(\u003e%me(kvKl$HgCBy!#9w[=6)B0bsdC{3Ncaz+FdwPw]ozE^r{wPRG]e^:)+v}YO1wPF#hvr\u0026#8wGU@2v@2T^aARJAA+e:0C4CXpB8UL$wGU]3v%8:8wN(])C{3Tey?mZ1wftF#y?mVu3nbdK3peGAay/tbzddr)B0a[jB9hthaARp9BrCWswGUA4v}YO1wGU(0zdK\u00263zE^/hCwhejaARpday/7[A:-E1wPz\u00260e\u003cZWkDt^ZeB-82bB8@Ejay]g#w[u0]zGE1jCYWImB7]MgazC)tB9hCvy?WD\u003ee*8nze(kv", "ln": 2153, "col": 15, "line": 78 }, { "b": "yJyRuzY?wXy?$jZvrMu}B7GkijAU^:wPP89A+69ff^g7oC4\u003eGdwO%Wse]$$se(U:(nd6DEvKKF\u003ci%]^Dy-)KD3qLI.x\u003e7ZtkT/Wnx)9{3wO#O%lVl*UvqYQvl$HBHA+PGmx(v(Omr\u0026=.A=-A\u003ez/6u1zE:8Y3s2e\u003ewmN@lwmM/{x(4v4aARJAvrb\u0026", "ln": 4645, "col": 36, "line": 171 }, { "b": "wOl3$BA{b@pgKYpePt-AzGFcPCYW$mv@@\u00269x(4v4aARJAB97\u0026dwmoH?aA8yAAclm/CYj0{eO5BewPRGGwmYN*By=Obx(4v4azbUjz6incv}YO1wK5TW3s2f0x(!wYy?W%jayPq2xLzT3ay/tcBy/uiB3J=y3s2f9AaAy0wK6Wmwft=3Coy*Aaz$+mwPw]9x(4v4kW!tGzCQWBeOo3mB7/c5kW]0YvpS)\u003ezE[36AV!$dy?mVMvq6^W3s2e)z/6u5zGFcLwmM/)z/6u5zGG}xBz\u0026plx(4v4kW$cNr7dcDw[.P8p^+Typ/4GKB7=Wumr\u0026=.A=-Blz/6u1zE^/j3rgXIazkn6wPzi}azbLjzddJez!pb6CYmkmBrC7izeAZ0woe(cB2\u003cTXp/4GKnG-s$zWF9{llHQ$vpG", "ln": 4897, "col": 24, "line": 182 }, { "b": "A+cw4wmPmZaARJAvqWh@A:@=%C4z!ux([2hBzbkdv@Dj3vqYQp3nbdK3na))Dt^ZA3nbjyaBtktBS=9pay/1%nLK80ADKq)tRd773sN%+xLzT3ax@C(y?l({e?O:-e(kvK", "ln": 5608, "col": 8, "line": 206 }, { "b": "apqT\u003cy?mZ1asIwIy?W^5diJ.CwGU]ix\u003eIc$vqE5#x(4v4ayO(7wPw]nxK#DixKM6}ayX[[zxJv#wmYo]Bz\u0026pzxK}JVA:@=%C4AoGavZ6YwPF#5A+cw7wO+}1wN(](w]}Q8ayO!\u003ex([6czxJ\u003efayP85azbt7wPF#ozY\u003cdnwGUA4v}YO1wGUYd3s!0\u003e", "ln": 6292, "col": 7, "line": 232 }, { "b": "D2[7szf4lJ3na))Dt^Zev{%l$vR3W8B7F(8vriM6z!%ldCxj)vzxJvgAa%o5y?W=#iTNGhp-{@aatCLSw[=c[ata^wePt-AzGE1Gapo.)aBm%A3sMHGB8Mhwv}xY*e\u003eF\u003eZa%Fc!3ncysatBi{w/#hewEp4Rav#]Sz!9M]x\u003eqrcx(+zrAaJJ[w[+*!efF?Gazbt7wO${[wPF#hvr\u0026#8wGV5pAbYScwN({4zxK4mwGUG3zeAZ0wd0c!zE\u003c{", "ln": 8054, "col": 37, "line": 297 }, { "b": "vR6a*3s)\u003c(vpB4:wftubaARpdaA.:pAX5tPxLzJgx(+zrzY\u0026+iwnbKZBy!#lazbLjaz2!aze:r5iTNGhp-{@aatCLSl2{EGx)a5gxjU%(A::67z/cXlx(dNaazC)tgAX8UwO#71vruj4zGu}sw[AFA3na[Dar\u00260Lh3#/\u003eAV/jqA+cwczF0*czddK2z/cXavScyhazg", "ln": 17157, "col": 49, "line": 631 }, { "b": "az\u003eW#zFs03A%=t@wGUA5ay]58v@=o)wN(]$zxK4mwGSDLnMW9Cz!0{bwO#P#BzkVhazbLjaARpd3na))v}YZ$wgfeY3s!0\u003ezddr)e^:jcpZO*OpZO*wavuGnxLzJgzeS%0w[+*%ay!\u00265B7GznBzbkdB98tvwN(][D1gV8v\u003c2/6woz^2vqYO2ay/t2wGSx*qBq(Q3tai%az1$\u003exDQ-7v}YO1wN(]}x(4u6Bz\u0026phwGV5cz*c7wvriM1ao", "ln": 17611, "col": 49, "line": 647 }, { "b": "y?m9#B0bysy\u003cvdBxK@r5vru74BrCjczE)\u0026%BzkVhaA7\u003c0e\u003eEgbByY97e[=^yCw7YbwEp4RaAITnx(tRqi:KGEB7Gf0v@#=mvqG:5xjU%(A::67z/fRswQ4Y@Ac9jAxK@r5vru74BrCHtwIb8Fra]?=3naT/iTPwgvrb^^By/FnxK#i}aAIakvrb^#wPF#oxK@q#x(4u#ve", "ln": 34882, "col": 3, "line": 1295 }, { "b": "nfyw[oHR\u003e!CVX6IsxFVFtRd7uwO(y8A::0lazbt7wGVbpwN(]]B-Ihlxcqe4v@2^@x9{njA3c?we(C1Uvrb\u003c\u003ex)a5{zEEx[e*aRiyyjq#ayX+?yJTOsz!pb2A:@=%C4z1kq+e2Pq:\u003ca$k$\u003eiMa{}*#ze:JbB8@-:dj=PNx)IfZdgdXanfyl0m]G:@xK#67w[=6)B0a[iwGUC[x(mMavpS[Wwft#jayPdgvrb\u003c\u003ex)a5gz/cXaaz#aneLPd}l@c-7", "ln": 36500, "col": 3, "line": 1357 }, { "b": "vqE68w/$I8wnc6}v@#TfC{3{qzFGO[w/$Y1y?mVgCv+/aaz(4uwN({9zY\u0026FaayPq2xLzT3ayYQsBzbkdB9hCkA=(CmATD-5ayMxxdOi.+B9R?GwO\u003c4be(UTOtRcphga\u003emmdiIP6wGUI(ByuqjwN/U4wPA5szeS%0w[+*%3naT/kNIZzB0baowNPW%C{3WoxKL^*wN)zoax8\u0026/w?vOsBAg/1BzkS9ayPq2xLzT3B0a$kwNPW(wftG5AV!7PeD", "ln": 42367, "col": 41, "line": 1538 }, { "b": "xLzJgz!0p1A=L-4aA}Hgzvf!{w[=6)aztg]ayX[[zxJwdv}YO1wN({4zxJvgy\u0026si7wPxwmx(4u#vqPM#B9R?GwO?=5wIdQFavf\u003cUxjjh7qZ\u0026?$zE:(3CYW$mv@#B6zxKdiB0a[kBy/rdBy!#9z/cXa3uG)0A=+(keOnZkwO${[wGV5tB97#gasH!Nxd+r3q.pykqZ\u003csae(UTOtRcphga\u003emndiH]0v}Yp*xjSifvriMdvpS{(Bzb98aA)", "ln": 43153, "col": 36, "line": 1565 }, { "b": "B8L]b3t1D(wO=f]zGE1hz/6DlwPI{bz/cXcz!9AgaA}Hkv}V#RayO!?AcbV4azbLjaA.:pazCZ2e\u003eEgiz/mlne(kvKqEKDNvqE5We*9F?A=bDfauTWXvNb0ID2d5je]t3uwg?LlzE[9qwO=fnv@DiFefGdIzY*DLx([2hqEKDNC)WnOxkR\u003ckz/d0DCxdRzwErJ)", "ln": 46145, "col": 14, "line": 1654 } ], "depth": 1, "facts": { "imp": [ [ "", "locating.I" ], [ "", "type" ], [ "", "end" ], [ "", "character" ], [ "", "tab" ], [ "", "delete" ], [ "", "add" ], [ "", "filter" ], [ "", "current" ], [ "", "compression" ], [ "", "supplied.sp.I" ], [ "", "systems" ], [ "", "bits" ], [ "", "chmod" ], [ "", "code" ], [ "", "the.B.The.B" ], [ "", "features" ], [ "", "usually.I" ], [ "", "extracting.I" ], [ "", "only.B.BR.To" ], [ "", "addition" ], [ "", "mode" ], [ "", "shorthand.B" ], [ "", "shorthand.BR" ], [ "", "compress" ], [ "", "fiz" ], [ "", "backup" ], [ "", "utime" ], [ "", "compatibility" ], [ "", "compatiblity" ], [ "", "DOS.I.I" ], [ "", "system" ], [ "", "filename" ], [ "", "mode" ], [ "", "older" ], [ "", "who" ] ], "mbr": [ "Although.I", "Aztec.The", "Bnumber.B", "CHANGES.PP", "Currently.I", "DESCRIPTION.I", "DOS.I", "DOS.I.I", "DOS.I.This", "Extracting.I", "H.PP", "H.PP.I", "J.Brian", "L.Barnes", "PC.TP", "PP.I", "PP.TP", "PP.TP.B", "PP.TP.BR", "R.PP", "R.PP.SH", "Since.I", "The.B", "VMS.PP", "VMS.PP.Gardner", "When.I", "a.B", "a.B.TP", "a.B.TP.TP", "a.B.TP.TP.TP", "a.IP", "abbreviated.Expert", "aborted.The", "achieved.sp", "achieved.sp.I", "achieved.sp.I.BR", "added.And", "added.PP", "added.PP.TP", "added.PP.TP.B", "addition.It", "algorithm.This", "allow.I", "allowed.PP", "allowed.PP.TP", "allowed.PP.TP.B", "almost.Availability", "already.I", "amount.To", "an.I", "an.To", "anu.PP", "any.FATAL", "archive.A", "archive.Any", "archive.B", "archive.Files", "archive.For", "archive.Generations", "archive.I", "archive.If", "archive.PP", "archive.PP.I", "archive.PP.TP", "archive.PP.TP.B", "archive.PP.TP.B.PP", "archive.PP.TP.B.PP.TP", "archive.PP.TP.B.PP.TP.B", "archive.SH", "archive.TP", "archive.The", "archive.This", "archive.Trial", "archives.It", "archives.PP", "archives.PP.TP", "archives.PP.TP.B", "artifact.PP", "artifact.PP.sp", "asterisk.Thus", "asterisk.Thus.B", "attributes.Currently", "aun.Since", "auncfM.And", "available.PP", "available.PP.I", "available.TP", "backup.B", "backup.B.bak", "based.Instead", "be.BR", "be.I", "becomes.BR", "being.It", "bilf.c", "bits.Their", "both.I", "bugs.PP", "by.B", "by.I", "c.TE", "c.TE.fi", "c.TE.fi.PD", "c.TE.fi.PD.PP", "c.TE.fi.PD.PP.sh", "categories.WARNINGS", "cause.I", "causes.I", "character.All", "character.B", "character.BR", "character.Each", "character.sp", "characters.B", "characters.PP", "characters.PP.TP", "characters.PP.TP.B", "col.It", "combination.B", "combination.B.TP", "combination.B.TP.B", "command.Applied", "command.B", "command.BR", "command.I", "command.IP", "command.PP", "command.PP.TP", "command.PP.TP.B", "command.Since", "command.This", "command.With", "commands.Applying", "commands.Choose", "commands.Extended", "commands.I", "commands.I.B", "commands.PP", "commands.PP.TP", "commands.PP.TP.B", "commands.PP.sh", "comment.PP", "comments.If", "complete.PP", "compressed.It", "compressed.SH", "compressed.SH.B", "compressed.SH.B.RB", "compression.Furthermore", "compression.If", "continues.PP", "copy.I", "correctly.If", "cpio.PP", "crdos1.crd", "crdos1.crd.ge", "crdos1.crd.ge.com", "created.sp", "cs.bsu", "cs.bsu.edu", "currently.I", "currently.I.I", "damaged.I", "data.The", "defined.When", "deleted.A", "described.B", "described.B.PP", "described.B.PP.TP", "described.B.PP.TP.BR", "described.B.PP.TP.BR.In", "described.B.PP.TP.BR.In.B", "described.B.PP.TP.BR.In.B.B", "described.PP", "dhesi.For", "directories.PP", "directory.If", "done.I", "dot.B", "dot.PP", "dot.PP.sh", "downward.I", "downward.I.SH", "downward.I.SH.I", "e.g", "e.g.AmigaDOS", "e.g.MS", "e.g.archive", "effect.Thus", "empty.Support", "enhanced.Self", "entry.In", "entry.This", "equivalent.B", "errors.PP", "errors.PP.TP", "errors.PP.TP.B", "especially.B", "example.IP", "exclusive.PP", "exclusive.PP.TP", "exclusive.PP.TP.B", "exist.In", "existing.I", "explicitly.If", "extract.If", "extracted.Also", "extracting.I", "extracting.PP", "extracting.PP.I", "extracting.PP.I.PP", "extracting.PP.I.PP.TP", "extracting.PP.I.PP.TP.B", "extraction.B", "extraction.TP", "fast.TP", "fast.TP.TP", "file.Data", "file.I", "file.I.I", "file.I.I.I", "file.I.I.I.B", "file.IP", "file.PP", "file.PP.TP", "file.PP.TP.B", "filename.PP", "filename.PP.TP", "filename.PP.TP.B", "filename.TP", "filename.Under", "filenames.B", "filenames.The", "filenames.The.B", "files.For", "files.If", "files.PP", "files.PP.TP", "files.PP.TP.B", "files.TP", "files.The", "files.The.B", "files.Unless", "files.When", "files.Wildcards", "files.sp", "first.Other", "fixes.PP", "fiz.SH", "follows.PP", "follows.PP.TP", "follows.PP.TP.B", "follows.PP.TP.B.PP", "follows.PP.TP.B.PP.TP", "follows.PP.TP.B.PP.TP.B", "follows.PP.Table", "force.I", "form.B", "future.I", "future.I.SH", "generation.Thus", "generations.For", "generations.Generations", "given.The", "given.The.B", "gives.BR", "greatly.TP", "h.SH", "i.e", "i.e.delete", "implemented.PP", "input.I", "interspersed.B", "it.BR", "it.Possible", "it.Should", "it.You", "itself.I", "itself.I.Previous", "itself.I.Previous.I", "itself.I.Previous.I.This", "itself.I.Previous.I.This.PP", "just.BR", "kept.In", "l.If", "l.Novice", "labelled.BR", "later.sp", "lfq.If", "lfqmg.If", "lfqmgAc.The", "limit.Thus", "line.ERRORS", "line.It", "listed.And", "listed.Deleted", "listed.For", "listed.If", "listed.PP", "listed.PP.TP", "listed.PP.TP.B", "listed.Thus", "listed.sp", "listing.If", "listing.sp", "listings.TP", "locating.I", "locating.I.PP", "lower.As", "maintained.I", "maintained.I.Version", "makes.I", "match.As", "match.The", "mechanism.If", "mention.PP", "method.PP", "method.PP.TP", "method.PP.TP.B", "modifier.B", "modifier.BR", "modifier.I", "modifier.PP", "modifier.PP.sh", "modifiers.B", "modifiers.The", "more.This", "move.B", "multiple.sp", "name.It", "names.In", "necessary.PP", "needed.All", "negligence.If", "neither.B", "nor.B", "number.A", "number.As", "number.Currently", "number.Currently.I", "number.PP", "number.PP.TP", "number.PP.TP.B", "number.This", "numbered.I", "numbered.I.So", "occurred.TP", "of.B", "of.B.B", "of.BR", "of.BR.bak", "of.BR.bak.PP", "of.I", "one.If", "only.A", "only.B", "only.B.BR", "only.B.BR.To", "only.B.BR.To.B", "only.It", "operating.I", "original.PP", "orthogonal.This", "otherwise.PP", "otherwise.PP.TP", "otherwise.PP.TP.B", "otherwise.PP.TP.B.Error", "output.PP", "output.PP.TP", "output.PP.TP.B", "output.Spurious", "output.This", "overwritten.Neither", "overwritten.sp", "packed.If", "packed.This", "packing.PP", "pathname.Any", "performance.A", "performing.The", "performing.The.B", "performing.The.B.When", "performing.The.B.When.B", "performing.The.B.When.B.When", "permissible.You", "placed.B", "planned.PP", "port.I", "possible.I", "possible.PP", "print.B", "print.I", "program.I", "quoted.When", "quotes.For", "quotes.Under", "range.All", "release.PP", "release.SH", "replaced.Packing", "reported.PP", "reported.PP.TP", "reported.PP.TP.B", "reported.SH", "s.TP", "selective.PP", "selective.PP.TP", "selective.PP.TP.B", "serve.Thus", "sh.br", "sh.br.ne", "shorthand.B", "shorthand.B.Similarly", "shorthand.B.Similarly.B", "shorthand.BR", "shorthand.BR.Both", "shorthand.BR.Both.B", "similar.B", "skipped.This", "skyler.mavd", "skyler.mavd.honeywell", "skyler.mavd.honeywell.com", "so.TP", "so.sp", "sources.IP", "sp.TS", "specifically.This", "specified.B", "specified.PP", "specified.PP.Archives", "specified.PP.Archives.PP", "specified.PP.Archives.PP.B", "specified.PP.Archives.PP.B.zoo", "specified.PP.TP", "specified.PP.TP.B", "specifies.B", "stages.First", "stdio.h", "suggestions.PP", "supplied.I", "supplied.I.PP", "supplied.sp", "supplied.sp.I", "supplied.sp.I.sp", "suppressed.PP", "suppressed.PP.sh", "synonymous.If", "system.TP", "t.confirmed", "temporary.sp", "temporary.sp.RB", "temporary.sp.RB.bak", "test.B", "the.B", "the.B.The", "the.B.The.B", "the.BR", "the.I", "the.PP", "the.PP.I", "the.sp", "then.I", "then.I.h", "these.IP", "these.The", "this.R", "this.R.D", "this.R.D.na", "this.R.D.na.TH", "thought.PP", "time.Extracting", "timezone.The", "to.B", "to.I", "too.FATAL", "trailer.When", "trailer.When.sp", "twice.It", "uncompressed.TP", "undeletion.If", "undeletion.If.PP", "undeletion.If.PP.sp", "undeletion.If.PP.sp.I", "undeletion.If.PP.sp.I.BR", "understandable.PP", "used.On", "used.TP", "used.Under", "used.sp", "user.For", "using.B", "using.B.PP", "using.B.PP.TP", "using.B.PP.TP.B", "using.B.PP.TP.B.PP", "using.B.PP.TP.B.PP.TP", "using.B.PP.TP.B.PP.TP.B", "using.I", "usually.I", "utilities.In", "v.Id", "valid.PP", "value.For", "value.If", "value.If.B", "value.If.B.B", "well.However", "well.TP", "well.TP.TP", "whenever.I", "where.B", "where.I", "whole.If", "whole.This", "work.Then", "x.PP", "x.PP.TP", "x.PP.TP.B", "x.PP.TP.B.PP", "x.PP.TP.B.PP.TP", "x.PP.TP.B.PP.TP.B", "x.PP.TP.B.PP.TP.B.Normally", "xyz.zoo", "zoo.B", "zoo.BR", "zoo.PP", "zoo.RB", "zoo.c" ], "tgt": [ "A", "DOS.I.I", "add", "addition", "backup", "bits", "character", "chmod", "code", "compatibility", "compatiblity", "compress", "compression", "current", "delete", "end", "extracting.I", "features", "filename", "filter", "fiz", "g", "locating.I", "m", "mode", "older", "only.B.BR.To", "shorthand.B", "shorthand.BR", "supplied.sp.I", "system", "systems", "tab", "the.B.The.B", "type", "usually.I", "utime", "who" ], "metrics": { "ast": { "op.add": 13, "op.bor": 2, "op.div": 29, "op.lor": 47, "op.mod": 1, "op.mul": 8, "op.pow": 12, "op.sub": 111, "op.xor": 1, "op.band": 1, "op.land": 107, "max_depth": 21, "call_count": 45, "node_count": 13195, "op.floordiv": 2, "member_count": 528, "max_array_len": 11, "op_density.add": 0, "op_density.bor": 0, "op_density.div": 0, "op_density.lor": 0, "op_density.mod": 0, "op_density.mul": 0, "op_density.pow": 0, "op_density.sub": 0.01, "op_density.xor": 0, "op_density.band": 0, "op_density.land": 0.01, "max_concat_chain": 8, "member_depth_max": 8, "self_compare_count": 3, "op_density.floordiv": 0 }, "file": { "size": 46684, "entropy": 4.72 }, "text": { "lines": 1672, "top_char": 101, "max_ws_run": 3, "digit_ratio": 0.01, "space_count": 6870, "char_entropy": 4.72, "unique_chars": 94, "top_char_null": 0, "string_density": 0.03, "top_char_ratio": 0.09, "avg_line_length": 26.92, "max_line_length": 78, "last_line_length": 11, "whitespace_ratio": 0.18, "identifier_density": 4.36, "line_length_stddev": 23.84, "normalized_string_count": 1.2, "repeated_char_sequences": 3, "trailing_whitespace_lines": 155, "suspicious_identifier_ratio": 0.03, "normalized_unique_identifiers": 123.09 }, "binary": { "peak_region_bytes": 11868, "peak_region_entropy": 5.19 }, "strings": { "bytes": 390, "count": 49, "avg_length": 7.96, "max_length": 37, "avg_entropy": 2.39, "empty_count": 10, "entropy_stddev": 1.08 }, "identifiers": { "count": 7285, "unique": 1318, "avg_length": 6.26, "max_length": 22, "min_length": 1, "avg_entropy": 2.23, "reuse_ratio": 0.18, "length_stddev": 2.79, "has_digit_ratio": 0, "sequential_names": 40, "base64_like_names": 1, "single_char_count": 40, "single_char_ratio": 0.03, "high_entropy_count": 3, "high_entropy_ratio": 0, "all_lowercase_ratio": 0.8, "all_uppercase_ratio": 0.05, "repeated_char_names": 1, "numeric_suffix_count": 5, "underscore_prefix_count": 1 } } }, "id": 1, "mol": "O₂(AsI)H₄(DbF₂OsPo₂)", "path": "zoo-2.10.1nb4.tgz!!man/man1/zoo.1", "pid": 3, "risk": 7, "sha": "cbaa940aea2c9e15c7b8c342b4ff428a3a37d33d7bda047f7cc5e42d38f2f8f0", "size": 46684, "traits": [ { "id": "metadata/lang/natural::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"", "spans": [ [ 786, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-2", "conf": 0.8, "crit": 1, "desc": "English function-word token \"and\"", "spans": [ [ 661, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-3", "conf": 0.8, "crit": 1, "desc": "English function-word token \"that\"", "spans": [ [ 758, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-4", "conf": 0.8, "crit": 1, "desc": "English function-word token \"have\"", "spans": [ [ 6340, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "spans": [ [ 161, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-6", "conf": 0.8, "crit": 1, "desc": "English function-word token \"with\"", "spans": [ [ 176, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-7", "conf": 0.8, "crit": 1, "desc": "English function-word token \"this\"", "spans": [ [ 307, 0 ] ] }, { "id": "micro-behaviors/data/archive/staging::archive-output-variable", "conf": 0.9, "crit": 3, "desc": "Archive staging variable name", "spans": [ [ 36564, 12 ] ] }, { "id": "micro-behaviors/os/privilege/check::source-privileged-account-reference", "conf": 0.86, "crit": 3, "desc": "Source references a privileged account", "spans": [ [ 42431, 9 ] ] }, { "id": "micro-behaviors/process/create/exec::system-api-call", "atk": "T1059", "conf": 0.85, "crit": 3, "desc": "System-named API reference", "spans": [ [ 43217, 6 ] ] }, { "id": "micro-behaviors/process/create/shell/target::shell-exec-script-path", "conf": 0.85, "crit": 3, "desc": "Shell runs a script by path", "spans": [ [ 362, 6 ] ] }, { "id": "objectives/impact/ransom/encrypt/runtime-generated::destructive-action-b", "atk": "T1486", "conf": 0.94, "crit": 3, "desc": "Destructive or exfiltration verb with target", "spans": [ [ 2217, 13 ], [ 2307, 13 ], [ 4961, 12 ] ] }, { "id": "micro-behaviors/fs/chmod/modify::python-path-chmod", "atk": "T1222", "mbc": "E1222", "conf": 0.85, "crit": 3, "desc": "Python calls chmod to change permissions", "spans": [ [ 17675, 5 ] ] }, { "id": "micro-behaviors/fs/directory/traverse::traverse-readdir-walk-find", "conf": 0.85, "crit": 2, "desc": "Traverses directories using common APIs", "spans": [ [ 8118, 0 ] ] }, { "id": "objectives/anti-static/obfuscation/code-metrics/identifiers::py-sequential-identifiers", "atk": "T1027", "mbc": "B0032", "conf": 0.8, "crit": 3, "desc": "Excessive sequential identifiers" }, { "id": "micro-behaviors/fs/directory/traverse::recursive-directory-traversal", "conf": 0.86, "crit": 3, "desc": "Recursive directory traversal logic", "uses": [ 13 ], "spans": [ [ 8118, 7 ] ] } ], "type": "python" }, { "ctx": [ { "b": "E))420S-r400000000000@$H+0rr915fR2N00000kMy=:00000xJb0j0000000000kMA+z2MN9\u00269rm5V1][S61onA4kMy=:00000kMy=:00000kMy=:00000ZYsAn00000ZYsAn000002MK\u00268000000@@r31onA400ic20000000ic20000000ic2000007x", "n": [ { "c": 3, "d": "No full symbol table (likely stripped)", "i": "metadata/hardening/missing::stripped-binary", "o": 0, "z": 25, "cf": 0.800000011920929 } ], "ln": 0 }, { "b": "0rr9100000flItRfkLuiwQ4=@fkLeKwO+%=B8I3U2lj-71onA40rr91pgXJlq:ZP=kN:UO1onA41onA40@@r3p*)Da0000000000lJv8^m/SI?00000g5}pO00000", "n": [ { "c": 1, "d": "Repeated 0x07 byte constant", "i": "micro-behaviors/mem/protect/modify::repeated-07-byte-constant", "o": 536, "z": 4, "cf": 0.25 } ], "ln": 504 }, { "b": "0SSik000000000000000000000001h0SSij0000000000000000000000000y?Wu*e]$}-f!@-vwn=A#zua9Oz/P}1A+eV}y\u0026r!-B8$\u00261zE@(Sv}f7\u003eA@YMVx(mR+uTEtPA+e($B97#luUjs!zdN6*zF0!!B7]o8vqC{WB7F]#0crm5v@le+A+eV\u0026wnc5:uTE+)z!A@@zdJY:wO(H1Bo3x7Aar\u003cj0cJf}x(mX^zddl%z^@=:wO(p5C4yUXn{jMtwOkZ#By/FWy*?yawPE\u0026)BAg(1Bo2]+y\u0026%/j0crm5v@MX[uTE+[uVQsfx(mN80crm5A:@^60afkTD2Nt4BywS=0a].Sz/YE\u0026A+fb%zdJYOuVQm2wPN][BAg(8ASxP.zeS}+w]}Q2yYF6\u003eA+PSb0af8OBAg(1ByeJ\u003eyxdZGB4cdvzGY-mz/bL@BAhneAcRB\u003cuVQr$v@2BYxLQ%/BZYr30af8Px(dAsfAu6mByO#)ASxDNv%zA?w[=c\u003ey?Xib0af8NwOkZ#By/G1w].r%wNxd?w]vVRuVQsdv@MZ2v}YSTw]I^8zGGE\u003cC5RFozGGE\u003cuTE\u003e#vS=n.uTE\u003e@A:%6luT)++0a{m.vpPvPyJBPezeYFZuV*E8zdN=CfAtD!w[LW%B6\u0026A\u003cyxdZGw]\u002665BtU-Lw]I)mv/P$DB7Gk$zdJY:yH?d10ax$XCXIm1w]@6ozEW9%wDl7AzdNM]AcU/2xLNPPuVQgbx(n38uT)++0blH.BAz^duTER/v{%E[zdLNU0c075A@Y/\u003cAaJ[!uU\u003cB=v{-}/x(\u003ct@BAhhezua3JB97\u00262yHpN+yHpWZx(0=YB7F]#0af?^y\u0026sJeA:J]%vQxaxwO#2UflItRfk$YtfkLui00026koQ1b00008000000000Ej%o[a0002.koQ1b000080000000000LPZ2b0002]koQ1b000080000000000Ofm\u003ej0002Sk{ljd00008000000001Pq6t]t", "n": [ { "c": 3, "d": "FORTIFY_SOURCE hardening enabled", "i": "metadata/hardening/build::fortify", "o": 3267, "z": 10, "cf": 0.8500000238418579 }, { "c": 3, "d": "Stack protector/canary enabled", "i": "metadata/hardening/build::stack-protector", "o": 3441, "z": 14, "cf": 0.8999999761581421 }, { "c": 3, "d": "chmod syscall", "i": "micro-behaviors/fs/chmod/modify::syscall-chmod", "o": 3103, "z": 5, "cf": 0.6600000262260437 }, { "c": 3, "d": "Uses readdir", "i": "micro-behaviors/fs/directory/readdir::readdir-readdir", "o": 2945, "z": 7, "cf": 0.6600000262260437 }, { "c": 3, "d": "File content manipulation (read/write/seek)", "i": "micro-behaviors/fs/file/binary::file-manipulation", "o": 3456, "z": 5, "cf": 0.75 }, { "c": 3, "d": "Delete files", "i": "micro-behaviors/fs/file/delete::unlink", "o": 2978, "z": 6, "cf": 0.30000001192092896 }, { "c": 3, "d": "Opens file with C fopen", "i": "micro-behaviors/fs/file/open::fopen", "o": 3415, "z": 5, "cf": 0.6600000262260437 }, { "c": 2, "d": "FORTIFY_SOURCE memcpy bounds check", "i": "metadata/hardening/build::memcpy-chk", "o": 3365, "z": 10, "cf": 0.8500000238418579 }, { "c": 2, "d": "libc version string pattern", "i": "micro-behaviors/dylib/library/libc::libc-version-string", "o": 2849, "z": 9, "cf": 0.800000011920929 }, { "c": 2, "d": "Create directories", "i": "micro-behaviors/fs/directory/mkdir::mkdir-base", "o": 3340, "z": 5, "cf": 0.6600000262260437 }, { "c": 2, "d": "Reads or writes file data", "i": "micro-behaviors/fs/file/read-write::binary-file-ops", "o": 3278, "z": 5, "cf": 0.800000011920929 }, { "c": 2, "d": "Rename files", "i": "micro-behaviors/fs/file/rename::rename-base", "o": 3081, "z": 6, "cf": 0.6600000262260437 }, { "c": 2, "d": "Check if file exists", "i": "micro-behaviors/fs/file/stat::stat-exists", "o": 2888, "z": 6, "cf": 0.6600000262260437 }, { "c": 2, "d": "Truncate file", "i": "micro-behaviors/fs/file/truncate::truncate", "o": 3353, "z": 9, "cf": 0.5 }, { "c": 2, "d": "Write single bytes to file", "i": "micro-behaviors/fs/file/write/direct::fputc", "o": 3325, "z": 5, "cf": 0.6600000262260437 }, { "c": 2, "d": "References fwrite file-write API", "i": "micro-behaviors/fs/file/write/direct::write--fwrite", "o": 3115, "z": 6, "cf": 0.6600000262260437 }, { "c": 2, "d": "Create temporary file securely", "i": "micro-behaviors/fs/temp/mktemp::mkstemp-fn", "o": 3284, "z": 7, "cf": 0.6600000262260437 }, { "c": 2, "d": "Abort program execution", "i": "micro-behaviors/os/signal/handler::abort", "o": 2867, "z": 5, "cf": 0.8999999761581421 }, { "c": 2, "d": "Install signal handler", "i": "micro-behaviors/os/signal/handler::signal", "o": 2925, "z": 6, "cf": 0.8999999761581421 }, { "c": 2, "d": "Terminates process immediately without cleanup", "i": "micro-behaviors/process/terminate/signal::_exit", "o": 3348, "z": 4, "cf": 0.4000000059604645 }, { "c": 2, "d": "Detect if running in terminal (isatty)", "i": "micro-behaviors/process/tty/terminal::isatty", "o": 3390, "z": 6, "cf": 0.5 } ], "ln": 2801 }, { "b": "fAq4L0000000000002Mx(\u003ch*AgYNFCGtX5k001ULlV)A\u0026wO#Pjv@Dj3wO#Pjw]zYjc37hyB2\u003cTdaBBexwO#2=07g)HA+fcgayPq2xLzT3ay/tbzdNQbazC)T06SN?0ax[TxLzT3aolBj09TqViV]K\u003eA@Vgu002DdA=k$vA+eV\u0026x(mMax(m)jBrCe", "n": [ { "c": 2, "d": "Contains common English function words", "i": "metadata/file/profile/language::lang-english", "o": 61586, "z": 3, "cf": 0.800000011920929 } ], "ln": 61538 }, { "b": "0rr9{0rrau07?6KvqGT*az#ssvR6N5c36y[0000^z/5@$zE)u3wnc74vqPM#vqYP#w[=6)zEEx[aARKuaz+$lxcvPZzE)x\u0026wN(]fBS+dsBy/IOash7eiY^saeK6jn0001nvrlKfBAfz+aAz46wODs0wft=jy?$kkz!T9hwPwaTfd)lGd/YNoDh))", "n": [ { "c": 2, "d": "Contains common English function words", "i": "metadata/file/profile/language::lang-english", "o": 62041, "z": 3, "cf": 0.800000011920929 } ], "ln": 61993 }, { "b": "qBKL+qCFt.z/M%?pe\u003cUWdiJzqC{4iEay/tcBzkSnwIbO/0000000000c{]BalVl{?A+Pf1BrAp#iwzTOvq6!1avG)OB7(:GeG^/bzEWQ4zdN-$x\u003c\u003e*2B-RapAaK6bx([Ddwb(Pf3pwGBz/YFjvix5#zeAZ0wftG8z/3Rvx([35zxKpOayPd#aBmQtzY\u0026$sao", "n": [ { "c": 2, "d": "Copyright notice", "i": "metadata/package/license::copyright-word", "o": 62348, "z": 9, "cf": 0.6000000238418579 } ], "ln": 62300 }, { "b": "w[=6)B0bgmatmhrzxJUhBz\u0026pyvrMimDt^ZO0000000000c@s.\u003evrl05B7F]9BzbkdB-Rbmaz\u003eL8BZY8ew]zYjvix5#ze:r5By=O9wPIv4x(Ffdz/cXow/$P4zeAZ0wofvL3ig5aavy6:zddr)B0bgmaBwIVzdNc[iV]K/arR^HarV5az!9M]x\u003eqq", "n": [ { "c": 2, "d": "Contains common English function words", "i": "metadata/file/profile/language::lang-english", "o": 62580, "z": 3, "cf": 0.800000011920929 } ], "ln": 62532 }, { "b": "BtkA#e[l2yvrcDBfdFO:00000001k^vpS)\u003ewn+$2zdNQbvruj4zxJL9y?mVgCwhejaztF4xDQ/6ze:JbB8#5lzu7[7wQ5rqvpKy4w[=6)B0bgmBz\u0026pzxK@q@B-IIlzGE1ix(W={Bz(hB00000001k^wQ5rqvpKy4vixS9zF9=%azbt7wGUA0wft@i", "n": [ { "c": 2, "d": "Contains common English function words", "i": "metadata/file/profile/language::lang-english", "o": 64202, "z": 4, "cf": 0.800000011920929 } ], "ln": 64154 }, { "b": "Aa9\u003c4zEEx[B0bHmy*?B1C4z!rzY\u0026LjA=L-eBrCadA+e:5z/Qa6001b:arR^HarS7IvqPM#fj/lnfkboBBAnNlwN/T}wPF$Dfj/lnfkboBBAn(h001b:arSrWeG!RHBAg/1BrCWzaAIWmwnc79efDP0ay/C6vru66B9g@5x(XnqvriMewO2y-wfrDDwb", "n": [ { "c": 2, "d": "Reference to /etc configuration files", "i": "micro-behaviors/fs/path/config/system::config-etc", "o": 65726, "z": 5, "cf": 0.6600000262260437 }, { "c": 1, "d": "Relative executable path string", "i": "micro-behaviors/process/create/local-exec::native-relative-executable-string", "o": 65753, "z": 5, "cf": 0.8799999952316284 } ], "ln": 65678 }, { "b": "ay]51wPRG]azbt7wPGEh07e^\u0026w[=6)azth8ayPwlvpJ$Zwftx2zeA\u003c4Bs)Lwra]?=vrb\u003c\u003ex)a5gx(+zdze:Pxe?3=yc$^aewPzj3x(v)gaA7\u003e7dj$P20000008c%wxlm/farR^]mJ-*Lx)Ktkph+t0avGTWwGS9rarR!ax(dzY05c8Xn)#QbwNXv", "n": [ { "c": 2, "d": "Contains common English function words", "i": "metadata/file/profile/language::lang-english", "o": 69687, "z": 3, "cf": 0.800000011920929 } ], "ln": 69639 }, { "b": "ggQv+rYRvux(mT4B.@mAwPz\u003caz/cXow/$n}zY\u0026}ewN]v.aARJAwQ5rqvpKy4Bzbxfazbt7wI9@.dMOX.x(W={Bz(hBaz2CjA^n^Avr\u0026#8wGUG3A=MqwBy!#n00000l2{EGx)a5gxjU%(A::67z/cXlx(dNaazC)tc3og/m5f!Z8jpE73yQ}]8jpE7", "n": [ { "c": 2, "d": "Contains common English function words", "i": "metadata/file/profile/language::lang-english", "o": 69908, "z": 4, "cf": 0.800000011920929 } ], "ln": 69860 }, { "b": "h8WxMiyb#0l}6Nnnj=ADoIFnTp/ga?r8($2sxO/)usnbdEJY{Yb{\u003c#/dj\u003eJ100000000000000000000tsABKwPw[tB7oc9zdNQbazbLjash7KBzbl6aAR)FwGSS{pdev{0000000", "n": [ { "c": 1, "d": "Unusual character combinations", "i": "micro-behaviors/data/encode/xor::unusual-character-combinations", "o": 82592, "z": 13, "cf": 0.5 } ], "ln": 82560 }, { "b": "zELyAgb7Etf!+pvdiHu0e\u0026tmn07PyziV]?*vLYbZfFUBsfFCEnatCM5h7*M.bU?])lq{okay/ClfFloPB%5H(g:1Lcf/Q*vf!UpuatC/ogDduKhxV:MwPzAamr\u0026+]bMG8+wPQmql](D2A=-#!v@Dj3z/dgqeoSc\u003ce\u00262vdgb7Esfebpqgbf[9hAAYJiX-MoB8b/jy-(e\u003eA3czabU?])lq{okay/Clx!AsnB%5H(f^5k9f!+mmi4(%AatC\u0026pfFLQAh6uTLwPzAamr\u0026+]bMG8+wPQmql](D2A=+=4xk8loq.i8mf!Lj7gb7BpfekgmgCx}ai65\u0026OiYe]uyhWW7xcoS/A3czabU?])lq{okay/ClwO#3hq.i8mf!Lg6gb7BpfebvsfGgaei65-FiX@PnyhWW7xcoS/A3czabU?])lq{okay/Clzz1\u003csB%5H(f^5k9f!+mmi4(%AatC\u0026pfFLQAh6uTLwPzAamr\u0026+]bME\u0026m=Jj7D0000000000000080000800008000080000r000010000000000dK([\u003cph.mGvpA!:aw^8%C4\u003eF#wfruKdGxFs=Jj7D0000000000000080000800", "n": [ { "c": 2, "d": "NetBSD base system artifact", "i": "metadata/binary/provenance::netbsd-base-system-artifact", "o": 86437, "z": 8, "cf": 0.949999988079071 }, { "c": 1, "d": "Compact C type format section", "i": "metadata/vendor/identity::sunw-ctf-section", "o": 86776, "z": 9, "cf": 0.949999988079071 } ], "ln": 86389 }, { "b": "00031000000000GdK(MozY?.ZvR6u#p\u0026ZF$x\u003eg^=asX\u0026\u003c001S)xMFooBywRUe[]iBwPz.\u0026e]CPHwId\u003eiByGr4e[[\u003cczGC\u003ehzF%Sde]ClxvSM6jAa9$\u003ee[!WmxAfU}D2vXGz2=h0D2vXBASv.jwO+^cwo\u00264)e]\u003eJtvj(InBo0}czFsg)e]USGe[Y9A04@w8CYS{rw[=c%04@qgwmoN*04}?@uUjs!zdN6/wo4V5wOtB.A:-/@04}=6z/P[0e[x6xA=Rjkygzn:e[xlBvqPZ*04}]5Bs}JGBo0}7vrt]Te[e)y04}=1zeA\u003c4Bo0{(rzDR5v@#q.0000000000000000000000000000000000000000000000000000000000000000000000", "n": [ { "c": 2, "d": "ELF dynamic section name", "i": "metadata/binary/linking/static::elf-dynamic-section-name", "o": 87094, "z": 8, "cf": 0.8999999761581421 }, { "c": 2, "d": "ELF dynstr section name", "i": "metadata/binary/linking/static::elf-dynstr-section-name", "o": 86988, "z": 7, "cf": 0.8999999761581421 }, { "c": 2, "d": "ELF dynsym section name", "i": "metadata/binary/linking/static::elf-dynsym-section-name", "o": 86980, "z": 7, "cf": 0.8999999761581421 }, { "c": 2, "d": "ELF interpreter section name", "i": "metadata/binary/linking/static::elf-interpreter-section-name", "o": 86930, "z": 7, "cf": 0.8999999761581421 } ], "ln": 86882 } ], "depth": 1, "facts": { "exp": [ [ "readdir" ], [ "progname" ], [ "ps_strings" ], [ "environ" ], [ "basename" ] ], "imp": [ [ "", "fdopen" ], [ "", "abort" ], [ "", "realloc" ], [ "", "sscanf" ], [ "", "access" ], [ "", "deregister_frame_info" ], [ "", "signal" ], [ "", "lseek" ], [ "", "strcmp" ], [ "", "memset" ], [ "", "stpcpy" ], [ "", "unlink" ], [ "", "malloc" ], [ "", "memmove" ], [ "", "Jv_RegisterClasses" ], [ "", "strcat" ], [ "", "fflush" ], [ "", "strcpy" ], [ "", "strrchr" ], [ "", "ctype_tab_" ], [ "", "fclose" ], [ "", "rename" ], [ "", "srget" ], [ "", "strchr" ], [ "", "chmod" ], [ "", "ftell" ], [ "", "printf" ], [ "", "fwrite" ], [ "", "strcat_chk" ], [ "", "sF" ], [ "", "strncpy" ], [ "", "stack_chk_guard" ], [ "", "time50" ], [ "", "putchar" ], [ "", "cxa_finalize" ], [ "", "register_frame_info" ], [ "", "stpcpy_chk" ], [ "", "exit" ], [ "", "fprintf" ], [ "", "vprintf" ], [ "", "swbuf" ], [ "", "strcpy_chk" ], [ "", "fread" ], [ "", "mkstemp" ], [ "", "utimes50" ], [ "", "fgets_chk" ], [ "", "fstat50" ], [ "", "fputc" ], [ "", "mkdir" ], [ "", "atexit" ], [ "", "ftruncate" ], [ "", "memcpy_chk" ], [ "", "sprintf_chk" ], [ "", "isatty" ], [ "", "locatime50" ], [ "", "puts" ], [ "", "fopen" ], [ "", "libc_init" ], [ "", "strlen" ], [ "", "stack_chk_fail" ], [ "", "fseek" ], [ "", "tolower_tab_" ] ], "sec": [ [ ".interp", 512, 23, 3.82, "alloc" ], [ ".note.netbsd.ident", 536, 24, 3.0, "alloc" ], [ ".note.netbsd.pax", 560, 20, 1.56, "alloc" ], [ ".hash", 584, 560, 1.34, "alloc" ], [ ".dynsym", 1144, 1704, 1.17, "alloc" ], [ ".dynstr", 2848, 646, 4.42, "alloc" ], [ ".rela.dyn", 3496, 2736, 2.17, "alloc" ], [ ".rela.plt", 6232, 1296, 1.67, "alloc,info_link" ], [ ".init", 7536, 14, 3.24, "alloc,executable" ], [ ".plt", 7552, 880, 4.05, "alloc,executable" ], [ ".plt.got", 8432, 32, 3.19, "alloc,executable" ], [ ".text", 8464, 53077, 6.33, "alloc,executable" ], [ ".fini", 61552, 14, 3.24, "alloc,executable" ], [ ".rodata", 61568, 8964, 4.99, "alloc" ], [ ".eh_frame_hdr", 70532, 1252, 5.05, "alloc" ], [ ".eh_frame", 71784, 5836, 4.99, "alloc" ], [ ".ctors", 81408, 16, 1.0, "write,alloc" ], [ ".dtors", 81424, 16, 1.0, "write,alloc" ], [ ".jcr", 81440, 8, 0.0, "write,alloc" ], [ ".dynamic", 81448, 384, 1.31, "write,alloc" ], [ ".got", 81832, 88, 0.57, "write,alloc" ], [ ".got.plt", 81920, 456, 1.79, "write,alloc" ], [ ".data", 82400, 3976, 4.25, "write,alloc" ], [ ".comment", 86376, 61, 4.11, "merge,strings" ], [ ".ident", 86437, 338, 4.84, "merge,strings" ], [ ".SUNW_ctf", 86776, 143, 2.89, "" ], [ ".shstrtab", 86919, 223, 4.19, "" ] ], "metrics": { "elf": { "bits": 64.0, "entry": 8464.0, "has_got": 1.0, "has_plt": 1.0, "has_note": 1.0, "has_rpath": 1.0, "relacount": 106.0, "note_count": 2.0, "nx_enabled": 1.0, "dynrel_count": 0.0, "dynsym_count": 71.0, "has_eh_frame": 1.0, "stack_canary": 1.0, "symtab_count": 0.0, "dynrela_count": 114.0, "little_endian": 1.0, "dt_flags_1_raw": 134217728.0, "pltreloc_count": 54.0, "executable_stack": 0.0, "wx_segment_count": 0.0, "comment_entry_count": 2.0, "fortify_source_count": 6.0, "program_header_count": 8.0, "comment_distinct_count": 2.0, "gnu_stack_section_absent": 1.0, "load_segment_max_file_size": 77620.0, "stripped_but_symtab_present": 0.0, "load_segment_max_memory_size": 77620.0, "section_relocation_group_count": 2.0, "stripped_metadata_section_count": 7.0 }, "file": { "size": 89000.0, "entropy": 5.89, "size_bytes": 89000.0 }, "binary": { "is_pie": 1.0, "has_overlay": 1.0, "is_stripped": 1.0, "code_entropy": 6.29, "data_entropy": 3.7, "overlay_size": 1858.0, "string_count": 306.0, "overlay_ratio": 0.02, "overall_entropy": 5.89, "overlay_entropy": 1.47, "entropy_variance": 2.69, "avg_string_length": 27.66, "max_string_length": 111.0, "peak_region_bytes": 33792.0, "code_to_data_ratio": 0.92, "peak_region_entropy": 6.23, "string_length_stddev": 20.8, "largest_section_ratio": 0.6, "sentence_string_count": 182.0, "sentence_string_ratio": 0.59, "high_entropy_string_count": 1.0 }, "exports": { "count": 5.0 }, "imports": { "count": 62.0 }, "sections": { "count": 29.0, "code_size": 54017.0, "entropy_max": 6.33, "entropy_mean": 2.97, "name_entropy": 4.14, "writable_count": 8.0, "executable_count": 5.0, "nonstandard_count": 8.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } } }, "id": 2, "mol": "H(F₄)Md(He)", "path": "zoo-2.10.1nb4.tgz!!bin/zoo", "pid": 0, "risk": 3, "sha": "c3464ce1f8006227dba30b70838b2c134dff61d350b49901c856e2c65df7649a", "size": 89000, "traits": [ { "id": "micro-behaviors/fs/file/binary::fseek-text", "atk": "T1005", "crit": 2, "desc": "References the CRT fseek file-position routine", "spans": [ [ 3456, 5 ] ] }, { "id": "micro-behaviors/fs/file/binary::fseek-func", "atk": "T1005", "conf": 0.4000000059604645, "crit": 2, "desc": "Seeks to position in file", "spans": [ [ 3456, 5 ] ] }, { "id": "micro-behaviors/fs/chmod/modify::syscall-chmod", "atk": "T1222", "mbc": "E1222", "conf": 0.6600000262260437, "crit": 3, "desc": "chmod syscall", "spans": [ [ 3103, 5 ] ] }, { "id": "metadata/hardening/missing::stripped-binary", "conf": 0.800000011920929, "crit": 3, "desc": "No full symbol table (likely stripped)", "spans": [ [ 0, 25 ] ] }, { "id": "micro-behaviors/fs/directory/readdir::readdir-readdir", "conf": 0.6600000262260437, "crit": 3, "desc": "Uses readdir", "spans": [ [ 2945, 7 ] ] }, { "id": "micro-behaviors/fs/file/delete::unlink", "conf": 0.30000001192092896, "crit": 3, "desc": "Delete files", "spans": [ [ 2978, 6 ] ] }, { "id": "micro-behaviors/fs/file/open::fopen", "conf": 0.6600000262260437, "crit": 3, "desc": "Opens file with C fopen", "spans": [ [ 3415, 5 ] ] }, { "id": "micro-behaviors/fs/file/binary::file-manipulation", "atk": "T1005", "conf": 0.75, "crit": 3, "desc": "File content manipulation (read/write/seek)", "spans": [ [ 3456, 5 ] ] }, { "id": "micro-behaviors/fs/file/binary::binary-read-write-ops", "atk": "T1005", "conf": 0.699999988079071, "crit": 3, "desc": "Binary file read/write operations", "spans": [ [ 3456, 5 ] ] } ], "type": "elf" }, { "ctx": [ { "b": "E))420S-r400000000000@$H+0rr91Fd8zT00000kMy=:00000Z=hq]0000000000kMA+z2MN9\u00269rm5V1][S61onA4kMy=:00000kMy=:00000kMy=:00000ZYsAn00000ZYsAn000002MK\u00268000000@@r31onA400ic20000000ic20000000ic2000007x", "n": [ { "c": 3, "d": "No full symbol table (likely stripped)", "i": "metadata/hardening/missing::stripped-binary", "o": 0, "z": 25, "cf": 0.800000011920929 } ], "ln": 0 }, { "b": "000060000ge=U\u003eK0000ge*7b]0000ge*7b]000262lj-7000002MK\u002680000003zmw00002000060000Ue=U\u003eK0000Ue*7b]0000Ue*7b]0001H0rr910001H0rr91", "n": [ { "c": 1, "d": "Repeated 0x07 byte constant", "i": "micro-behaviors/mem/protect/modify::repeated-07-byte-constant", "o": 265, "z": 4, "cf": 0.25 } ], "ln": 233 }, { "b": "0rr9j000000000000000000000000W0rr9i0000000000000000000000000y?Wu*e]$}-f!@-vwn=A#zua9Oz/P}1uUj1\u0026x-IHEwmY^)xk8BewPzc\u0026A:-/@uUKy\u0026zVBcKAb](fzEEx[0bVdXy\u0026r!-uRkGGqE%GPB97#llU{gLB7Gy)uTE+[uVQsfx(mN80afkTD2Nt4BywS=0a].Sz/YE\u0026uTE\u003e{xjVe+w]}Q2yYFA{x(n380a{B}x()[^uTE\u003ez0a*4\u003ex(Xcf0af8OBywV{uT)++uUsH\u0026A+2e?B-.bbvr8uPuT[s?uUj1\u0026vqGU7wDl7AA+e($B97#luUjs!zdN6*zF0!!w].D\u003ewb{WZByGx80a{g)ByLqVBy/YhBo3o5BAmB]z/xo90afLRvQ\u0026+VzFsg)zdNM]AcRC8BAhhezua3JB97\u00262yHpN+yHpWZx(0=YB7F]#0af?^y\u0026sJeA:J]%vQxaxwO#2UflItRfk$YtfkLui000000002mfcyk{00008000000000Ue*7b]0002mfDZt}00008000000002uh6q(00002ufDZt}00008000000002ufDZt}0002efcyk{000060000400000", "n": [ { "c": 3, "d": "Stack protector/canary enabled", "i": "metadata/hardening/build::stack-protector", "o": 1965, "z": 14, "cf": 0.8999999761581421 }, { "c": 3, "d": "File content manipulation (read/write/seek)", "i": "micro-behaviors/fs/file/binary::file-manipulation", "o": 1980, "z": 5, "cf": 0.75 }, { "c": 3, "d": "Opens file with C fopen", "i": "micro-behaviors/fs/file/open::fopen", "o": 1932, "z": 5, "cf": 0.6600000262260437 }, { "c": 2, "d": "libc version string pattern", "i": "micro-behaviors/dylib/library/libc::libc-version-string", "o": 1673, "z": 9, "cf": 0.800000011920929 }, { "c": 2, "d": "Reads or writes file data", "i": "micro-behaviors/fs/file/read-write::binary-file-ops", "o": 1901, "z": 5, "cf": 0.800000011920929 }, { "c": 2, "d": "Write single bytes to file", "i": "micro-behaviors/fs/file/write/direct::fputc", "o": 1914, "z": 5, "cf": 0.6600000262260437 }, { "c": 2, "d": "References fwrite file-write API", "i": "micro-behaviors/fs/file/write/direct::write--fwrite", "o": 1818, "z": 6, "cf": 0.6600000262260437 }, { "c": 2, "d": "Abort program execution", "i": "micro-behaviors/os/signal/handler::abort", "o": 1691, "z": 5, "cf": 0.8999999761581421 }, { "c": 2, "d": "Terminates process immediately without cleanup", "i": "micro-behaviors/process/terminate/signal::_exit", "o": 1922, "z": 4, "cf": 0.4000000059604645 } ], "ln": 1625 }, { "b": "zELyAgb7Etf!+pvdiHu0e\u0026tmn07PyziV]?*vLYbZfFUBsfFCEnatCM5h7*M.bU?])lq{okay/ClfFloPB%5H(g:1Lcf/Q*vf!UpuatC/ogDduKhxV:MwPzAamr\u0026+]bMG8+wPQmql](D2A=-#!v@Dj3z/dgqeoSc\u003ce\u00262vdgb7Esfebpqgbf[9hAAYJiX-MoB8b/jy-(e\u003eA3czabU?])lq{okay/Clx!AsnB%5H(f^5k9f!+mmi4(%AatC\u0026pfFLQAh6uTLwPzAamr\u0026+]bMG8+wPQmql](D2A=+=4xk8loq.i8mf!Lj7gb7BpfekgmgCx}ai65\u0026OiYe]uyhWW7xcoS/A3czabU?])lq{okay/ClwO#3hq.i8mf!Lg6gb7BpfebvsfGgaei65-FiX@PnyhWW7xcoS/A3czabU?])lq{okay/Clzz1\u003csB%5H(f^5k9f!+mmi4(%AatC\u0026pfFLQAh6uTLwPzAamr\u0026+]bME\u0026m=Jj7D0000000000000080000800008000080000r000010000000000dK([\u003cph.mGvpA!:aw^8%C4\u003eF#wfruKdGxFs=Jj7D0000000000000080000800", "n": [ { "c": 2, "d": "NetBSD base system artifact", "i": "metadata/binary/provenance::netbsd-base-system-artifact", "o": 13821, "z": 8, "cf": 0.949999988079071 }, { "c": 1, "d": "Compact C type format section", "i": "metadata/vendor/identity::sunw-ctf-section", "o": 14160, "z": 9, "cf": 0.949999988079071 } ], "ln": 13773 }, { "b": "00031000000000GdK(MozY?.ZvR6u#p\u0026ZF$x\u003eg^=asX\u0026\u003c001S)xMFooBywRUe[]iBwPz.\u0026e]CPHwId\u003eiByGr4e[[\u003cczGC\u003ehzF%Sde]ClxvSM6jAa9$\u003ee[!WmxAfU}D2vXGz2=h0D2vXBASv.jwO+^cwo\u00264)e]\u003eJtvj(InBo0}czFsg)e]USGe[Y9A04@w8CYS{rw[=c%04@qgwmoN*04}?@uUjs!zdN6/wo4V5wOtB.A:-/@04}=6z/P[0e[x6xA=Rjkygzn:e[xlBvqPZ*04}]5Bs}JGBo0}7vrt]Te[e)y04}=1zeA\u003c4Bo0{(rzDR5v@#q.0000000000000000000000000000000000000000000000000000000000000000000000", "n": [ { "c": 2, "d": "ELF dynamic section name", "i": "metadata/binary/linking/static::elf-dynamic-section-name", "o": 14478, "z": 8, "cf": 0.8999999761581421 }, { "c": 2, "d": "ELF dynstr section name", "i": "metadata/binary/linking/static::elf-dynstr-section-name", "o": 14372, "z": 7, "cf": 0.8999999761581421 }, { "c": 2, "d": "ELF dynsym section name", "i": "metadata/binary/linking/static::elf-dynsym-section-name", "o": 14364, "z": 7, "cf": 0.8999999761581421 }, { "c": 2, "d": "ELF interpreter section name", "i": "metadata/binary/linking/static::elf-interpreter-section-name", "o": 14314, "z": 7, "cf": 0.8999999761581421 } ], "ln": 14266 } ], "depth": 1, "facts": { "exp": [ [ "progname" ], [ "ps_strings" ], [ "environ" ] ], "imp": [ [ "", "fdopen" ], [ "", "abort" ], [ "", "deregister_frame_info" ], [ "", "malloc" ], [ "", "Jv_RegisterClasses" ], [ "", "ctype_tab_" ], [ "", "fclose" ], [ "", "srget" ], [ "", "ftell" ], [ "", "printf" ], [ "", "fwrite" ], [ "", "sF" ], [ "", "stack_chk_guard" ], [ "", "putchar" ], [ "", "cxa_finalize" ], [ "", "register_frame_info" ], [ "", "exit" ], [ "", "fread" ], [ "", "setbuf" ], [ "", "fputc" ], [ "", "atexit" ], [ "", "puts" ], [ "", "fopen" ], [ "", "libc_init" ], [ "", "memcpy" ], [ "", "strlen" ], [ "", "stack_chk_fail" ], [ "", "fseek" ], [ "", "tolower_tab_" ] ], "sec": [ [ ".interp", 512, 23, 3.82, "alloc" ], [ ".note.netbsd.ident", 536, 24, 3.0, "alloc" ], [ ".note.netbsd.pax", 560, 20, 1.56, "alloc" ], [ ".hash", 584, 220, 1.52, "alloc" ], [ ".dynsym", 808, 864, 1.1, "alloc" ], [ ".dynstr", 1672, 346, 4.41, "alloc" ], [ ".rela.dyn", 2024, 264, 1.68, "alloc" ], [ ".rela.plt", 2288, 504, 1.55, "alloc,info_link" ], [ ".init", 2800, 14, 3.24, "alloc,executable" ], [ ".plt", 2816, 352, 3.86, "alloc,executable" ], [ ".plt.got", 3168, 32, 3.19, "alloc,executable" ], [ ".text", 3200, 4976, 6.36, "alloc,executable" ], [ ".fini", 8176, 14, 3.24, "alloc,executable" ], [ ".rodata", 8192, 1301, 4.68, "alloc,merge,strings" ], [ ".eh_frame_hdr", 9496, 284, 4.28, "alloc" ], [ ".eh_frame", 9784, 1180, 4.6, "alloc" ], [ ".ctors", 11792, 16, 1.0, "write,alloc" ], [ ".dtors", 11808, 16, 1.0, "write,alloc" ], [ ".jcr", 11824, 8, 0.0, "write,alloc" ], [ ".dynamic", 11832, 384, 1.28, "write,alloc" ], [ ".got", 12216, 72, 0.32, "write,alloc" ], [ ".got.plt", 12288, 192, 1.63, "write,alloc" ], [ ".data", 12480, 1280, 4.17, "write,alloc" ], [ ".comment", 13760, 61, 4.11, "merge,strings" ], [ ".ident", 13821, 338, 4.84, "merge,strings" ], [ ".SUNW_ctf", 14160, 143, 2.89, "" ], [ ".shstrtab", 14303, 223, 4.19, "" ] ], "metrics": { "elf": { "bits": 64.0, "entry": 3200.0, "has_got": 1.0, "has_plt": 1.0, "has_note": 1.0, "has_rpath": 1.0, "relacount": 3.0, "note_count": 2.0, "nx_enabled": 1.0, "dynrel_count": 0.0, "dynsym_count": 36.0, "has_eh_frame": 1.0, "stack_canary": 1.0, "symtab_count": 0.0, "dynrela_count": 11.0, "little_endian": 1.0, "dt_flags_1_raw": 134217728.0, "pltreloc_count": 21.0, "executable_stack": 0.0, "wx_segment_count": 0.0, "comment_entry_count": 2.0, "program_header_count": 8.0, "comment_distinct_count": 2.0, "gnu_stack_section_absent": 1.0, "load_segment_max_file_size": 10964.0, "stripped_but_symtab_present": 0.0, "load_segment_max_memory_size": 10964.0, "section_relocation_group_count": 2.0, "stripped_metadata_section_count": 7.0 }, "file": { "size": 16384.0, "entropy": 4.95, "size_bytes": 16384.0 }, "binary": { "is_pie": 1.0, "has_overlay": 1.0, "is_stripped": 1.0, "code_entropy": 6.16, "data_entropy": 3.15, "overlay_size": 1858.0, "string_count": 89.0, "overlay_ratio": 0.11, "overall_entropy": 4.95, "overlay_entropy": 1.37, "entropy_variance": 2.58, "avg_string_length": 24.53, "max_string_length": 78.0, "peak_region_bytes": 4096.0, "code_to_data_ratio": 0.73, "peak_region_entropy": 6.27, "string_length_stddev": 25.68, "largest_section_ratio": 0.3, "sentence_string_count": 28.0, "sentence_string_ratio": 0.31, "high_entropy_string_count": 0.0 }, "exports": { "count": 3.0 }, "imports": { "count": 29.0 }, "sections": { "count": 29.0, "code_size": 5388.0, "entropy_max": 6.36, "entropy_mean": 2.87, "name_entropy": 4.14, "writable_count": 8.0, "executable_count": 5.0, "nonstandard_count": 8.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } } }, "id": 3, "mol": "H(F₂)Md(He)", "path": "zoo-2.10.1nb4.tgz!!bin/fiz", "pid": 0, "risk": 2, "sha": "e39de80cf6920a07872c0aeed9865590bb8a26410d2d290902a18f086b8b5c5c", "size": 16384, "traits": [ { "id": "micro-behaviors/fs/file/binary::fseek-text", "atk": "T1005", "crit": 2, "desc": "References the CRT fseek file-position routine", "spans": [ [ 1980, 5 ] ] }, { "id": "micro-behaviors/fs/file/binary::fseek-func", "atk": "T1005", "conf": 0.4000000059604645, "crit": 2, "desc": "Seeks to position in file", "spans": [ [ 1980, 5 ] ] }, { "id": "metadata/hardening/missing::stripped-binary", "conf": 0.800000011920929, "crit": 3, "desc": "No full symbol table (likely stripped)", "spans": [ [ 0, 25 ] ] }, { "id": "micro-behaviors/fs/file/open::fopen", "conf": 0.6600000262260437, "crit": 3, "desc": "Opens file with C fopen", "spans": [ [ 1932, 5 ] ] }, { "id": "micro-behaviors/fs/file/binary::file-manipulation", "atk": "T1005", "conf": 0.75, "crit": 3, "desc": "File content manipulation (read/write/seek)", "spans": [ [ 1980, 5 ] ] }, { "id": "micro-behaviors/fs/file/binary::binary-read-write-ops", "atk": "T1005", "conf": 0.699999988079071, "crit": 3, "desc": "Binary file read/write operations", "spans": [ [ 1980, 5 ] ] } ], "type": "elf" } ], "v": "8" } }