{
  "ml": {
    "v": "7",
    "eng": "2.5.0-beta.0",
    "lvl": -1,
    "conf": 0,
    "mods": [
      {
        "cls": 0,
        "raw": 0.000036189955,
        "rte": "az",
        "prob": 0.000036189955
      }
    ],
    "prob": 0.000036189955,
    "files": [
      {
        "id": 0,
        "lvl": -1,
        "conf": 0,
        "prob": 0.00003618995469878428,
        "type": "xz"
      },
      {
        "id": 1,
        "lvl": -1,
        "conf": 0,
        "prob": 0.000009715557098388672,
        "type": "elf"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-08-03T12:27:29Z"
  },
  "path": "sigrot-1.2nb1.tgz",
  "raw": {
    "files": [
      {
        "id": 0,
        "mol": "H(F)Md(He)",
        "sha": "89b1d6c7949fcd14ee761d79a0ffce1ac23055003031572a1004d82a4e151877",
        "path": "/data/samples/good/foraged/netbsd/netbsd.org/_/sigrot-1.2nb1/sigrot-1.2nb1.tgz",
        "risk": 2,
        "size": 8688,
        "type": "xz",
        "facts": {
          "metrics": {
            "file": {
              "size": 8688.0,
              "entropy": 7.98,
              "size_bytes": 8688.0
            },
            "binary": {
              "overall_entropy": 7.98,
              "peak_region_bytes": 8688.0,
              "peak_region_entropy": 7.83
            },
            "consistency": {
              "extension_content_mismatch": 1.0,
              "extension_content_mismatch.archive_as_archive": 1.0
            }
          }
        },
        "traits": [
          {
            "id": "micro-behaviors/fs/file/open::fopen",
            "conf": 0.6600000262260437,
            "crit": 3,
            "desc": "References C fopen file-open API",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "metadata/hardening/missing::stripped-binary",
            "conf": 0.800000011920929,
            "crit": 3,
            "desc": "No full symbol table (likely stripped)",
            "from": [
              {
                "file": 1
              }
            ]
          }
        ]
      },
      {
        "ctx": [
          {
            "b": "E))420S-r400000000000@$H+0rr91[cYi@00000kMy=:000007=hi)0000000000kMA+z2MN9\u00269rm5V1][S61onA4kMy=:00000kMy=:00000kMy=:00000ZYsAn00000ZYsAn000002MK\u00268000000@@r31onA400ic20000000ic20000000ic2000007x",
            "n": [
              {
                "c": 3,
                "d": "No full symbol table (likely stripped)",
                "i": "metadata/hardening/missing::stripped-binary",
                "o": 0,
                "z": 25,
                "cf": 0.800000011920929
              }
            ],
            "ln": 0
          },
          {
            "b": "0rr9100000flItRfkLuiwQ4=@fkLeKwO+%=B8I3U2lj-71onA40rr91pgXJlq:ZP=kN:UO1onA41onA40@@r3p*)Da00000000005Dz!ha]?Py000006951j0@@r3",
            "n": [
              {
                "c": 1,
                "d": "Repeated 0x07 byte constant",
                "i": "micro-behaviors/mem/protect/modify::repeated-07-byte-constant",
                "o": 536,
                "z": 4,
                "cf": 0.25
              }
            ],
            "ln": 504
          },
          {
            "b": "0rr9j000000000000000000000000C0rr9j0000000000000000000000000y?Wu*e]$}-f!@-qvScpe0aftLzFo8TuU0.*wOkZ#By/G1w].r%wNxd?w]vV\u003cBAg(dz#:lLAb](fzEEx[0af8OByxnGfAtDLC3!cUxk8BewPydOvrlH3A@YMOAc2xcBAh8kxla5+v@c78wDl7AB8\u003e]8Bo2]]v{%m!0af8OmGv1qC4\u003e#nzuaoYwPRzZuTE\u003e@vpK7Wv}YT+xlvT6wb]$zBzkP6h822quT[s?uUj1\u0026vqGU7wDl7AA+e($B97#luUjs!zdN6*zF0!!w]I^8zGGE\u003cw]I)mv/QvYwnc5:vru79x(\u003ct]B-.W8w]zT1zua3Wx\u003c$NVx(mTb0cra1x(n380b2\u003e+wO#U\u003euTE\u003e@vpK7Wv}YT+w)]y\u00260a{p-wORoMwO#2U000000002Cfcyk{000080000000013e*7b]0002mfDZt}00008000000000\u0026f^3C@0002ufDZt}00008000000002ufDZt}0002ufcyk{000060000300000000000002Kfcyk{000060000700000000",
            "n": [
              {
                "c": 3,
                "d": "Stack protector/canary enabled",
                "i": "metadata/hardening/build::stack-protector",
                "o": 1895,
                "z": 14,
                "cf": 0.8999999761581421
              },
              {
                "c": 3,
                "d": "References a file-position API",
                "i": "micro-behaviors/fs/file/binary::file-position-api",
                "o": 1910,
                "z": 5,
                "cf": 0.7799999713897705
              },
              {
                "c": 3,
                "d": "References C fopen file-open API",
                "i": "micro-behaviors/fs/file/open::fopen",
                "o": 1861,
                "z": 5,
                "cf": 0.6600000262260437
              },
              {
                "c": 2,
                "d": "Versioned libc soname or symbol version",
                "i": "micro-behaviors/dylib/library/libc::libc-version-string",
                "o": 1617,
                "z": 9,
                "cf": 0.800000011920929
              },
              {
                "c": 2,
                "d": "Create directories",
                "i": "micro-behaviors/fs/directory/mkdir::mkdir-base",
                "o": 1843,
                "z": 5,
                "cf": 0.6600000262260437
              },
              {
                "c": 2,
                "d": "Reads or writes file data",
                "i": "micro-behaviors/fs/file/read-write::binary-file-ops",
                "o": 1739,
                "z": 6,
                "cf": 0.800000011920929
              },
              {
                "c": 2,
                "d": "Write single bytes to file",
                "i": "micro-behaviors/fs/file/write/direct::fputc",
                "o": 1837,
                "z": 5,
                "cf": 0.6600000262260437
              },
              {
                "c": 2,
                "d": "Reads process environment through getenv",
                "i": "micro-behaviors/os/env/access::native-getenv",
                "o": 1886,
                "z": 6,
                "cf": 0.800000011920929
              },
              {
                "c": 2,
                "d": "Abort program execution",
                "i": "micro-behaviors/os/signal/handler::abort",
                "o": 1628,
                "z": 5,
                "cf": 0.8999999761581421
              },
              {
                "c": 2,
                "d": "Terminates process immediately without cleanup",
                "i": "micro-behaviors/process/terminate/signal::_exit",
                "o": 1851,
                "z": 4,
                "cf": 0.4000000059604645
              }
            ],
            "ln": 1569
          },
          {
            "b": "nqVXs.!7Iiaa%Q]0001X\u003e\u003e\u003c/F%lfgA%nJ6000000nq3mm\u003eV^VU%44^X2/uSxnkz@G04@tbxkRd1B-I3[c37Z=A@W?lx\u003eIE8Bo3w@xj27/v}YO1wDlQVCYS}8A+e\u0026%CMq/cw[C+400000mn^2VqAt{/z/](bzyoJGv@=c?By=O9x(Usuc37m.3ik8D",
            "n": [
              {
                "c": 2,
                "d": "HOME environment variable",
                "i": "micro-behaviors/os/env/vars/user-info::home-var",
                "o": 7072,
                "z": 4,
                "cf": 0.5
              }
            ],
            "ln": 7024
          },
          {
            "b": "zELyAgb7Etf!+pvdiHu0e\u0026tmn07PyziV]?*vLYbZfFUBsfFCEnatCM5h7*M.bU?])lq{okay/ClfFloPB%5H(g:1Lcf/Q*vf!UpuatC/ogDduKhxV:MwPzAamr\u0026+]bMG8+wPQmql](D2A=-#!v@Dj3z/dgqeoSc\u003ce\u00262vdgb7Esfebpqgbf[9hAAYJiX-MoB8b/jy-(e\u003eA3czabU?])lq{okay/Clx!AsnB%5H(f^5k9f!+mmi4(%AatC\u0026pfFLQAh6uTLwPzAamr\u0026+]bMG8+wPQmql](D2A=+=4xk8loq.i8mf!Lj7gb7BpfekgmgCx}ai65\u0026OiYe]uyhWW7xcoS/A3czabU?])lq{okay/ClwO#3hq.i8mf!Lg6gb7BpfebvsfGgaei65-FiX@PnyhWW7xcoS/A3czabU?])lq{okay/Clzz1\u003csB%5H(f^5k9f!+mmi4(%AatC\u0026pfFLQAh6uTLwPzAamr\u0026+]bME/A0p!wp00000000000000000\u0026M800\u0026M800\u0026M800\u0026M802\u003e[r0096100000001F#dJ?G8awuiMwO-F=A=lbnwmYo]dK([F0p!wp00000000000000000\u0026M800",
            "n": [
              {
                "c": 2,
                "d": "NetBSD base system artifact",
                "i": "metadata/binary/provenance::netbsd-base-system-artifact",
                "o": 12623,
                "z": 8,
                "cf": 0.949999988079071
              },
              {
                "c": 1,
                "d": "Compact C type format section",
                "i": "metadata/vendor/identity::sunw-ctf-section",
                "o": 12964,
                "z": 9,
                "cf": 0.949999988079071
              }
            ],
            "ln": 12575
          },
          {
            "b": "00031000000000GdK(MozY?.ZvR6u#p\u0026ZF$x\u003eg^=asX\u0026\u003c001S)xMFooBywRUe[]iBwPz.\u0026e]CPHwId\u003eiByGr4e[[\u003cczGC\u003ehzF%Sde]ClxvSM6jAa9$\u003ee[!WmxAfU}D2vXGz2=h0D2vXBASv.jwO+^cwo\u00264)e]\u003eJtvj(InBo0}czFsg)e]USGe[Y9A04@w8CYS{rw[=c%04@qgwmoN*04}?@uUjs!zdN6/wo4V5wOtB.A:-/@04}=6z/P[0e[x6xA=Rjkygzn:e[xlBvqPZ*04}]5Bs}JGBo0}7vrt]Te[e)y04}=1zeA\u003c4Bo0{(rzDR5v@#q.0000000000000000000000000000000000000000000000000000000000000000000000",
            "n": [
              {
                "c": 2,
                "d": "ELF dynamic section name",
                "i": "metadata/binary/linking/runtime::elf-dynamic-section-name",
                "o": 13282,
                "z": 8,
                "cf": 1.0
              },
              {
                "c": 2,
                "d": "ELF dynstr section name",
                "i": "metadata/binary/linking/runtime::elf-dynstr-section-name",
                "o": 13176,
                "z": 7,
                "cf": 1.0
              },
              {
                "c": 2,
                "d": "ELF dynsym section name",
                "i": "metadata/binary/linking/runtime::elf-dynsym-section-name",
                "o": 13168,
                "z": 7,
                "cf": 1.0
              },
              {
                "c": 2,
                "d": "ELF interpreter section name",
                "i": "metadata/binary/linking/runtime::elf-interpreter-section-name",
                "o": 13118,
                "z": 7,
                "cf": 1.0
              }
            ],
            "ln": 13070
          }
        ],
        "depth": 1,
        "facts": {
          "exp": [
            [
              "progname"
            ],
            [
              "ps_strings"
            ],
            [
              "environ"
            ]
          ],
          "imp": [
            [
              "",
              "abort"
            ],
            [
              "",
              "deregister_frame_info"
            ],
            [
              "",
              "strcmp"
            ],
            [
              "",
              "stat50"
            ],
            [
              "",
              "Jv_RegisterClasses"
            ],
            [
              "",
              "fclose"
            ],
            [
              "",
              "srget"
            ],
            [
              "",
              "fscanf"
            ],
            [
              "",
              "printf"
            ],
            [
              "",
              "sF"
            ],
            [
              "",
              "fgetc"
            ],
            [
              "",
              "stack_chk_guard"
            ],
            [
              "",
              "time50"
            ],
            [
              "",
              "cxa_finalize"
            ],
            [
              "",
              "register_frame_info"
            ],
            [
              "",
              "exit"
            ],
            [
              "",
              "fprintf"
            ],
            [
              "",
              "fputc"
            ],
            [
              "",
              "mkdir"
            ],
            [
              "",
              "atexit"
            ],
            [
              "",
              "puts"
            ],
            [
              "",
              "fopen"
            ],
            [
              "",
              "libc_init"
            ],
            [
              "",
              "sprintf"
            ],
            [
              "",
              "getenv"
            ],
            [
              "",
              "stack_chk_fail"
            ],
            [
              "",
              "fseek"
            ]
          ],
          "sec": [
            [
              ".interp",
              512,
              23,
              3.82,
              "alloc"
            ],
            [
              ".note.netbsd.ident",
              536,
              24,
              3.0,
              "alloc"
            ],
            [
              ".note.netbsd.pax",
              560,
              20,
              1.56,
              "alloc"
            ],
            [
              ".hash",
              584,
              212,
              1.48,
              "alloc"
            ],
            [
              ".dynsym",
              800,
              816,
              1.09,
              "alloc"
            ],
            [
              ".dynstr",
              1616,
              305,
              4.33,
              "alloc"
            ],
            [
              ".rela.dyn",
              1928,
              216,
              1.7,
              "alloc"
            ],
            [
              ".rela.plt",
              2144,
              504,
              1.55,
              "alloc,info_link"
            ],
            [
              ".init",
              2656,
              14,
              3.24,
              "alloc,executable"
            ],
            [
              ".plt",
              2672,
              352,
              3.77,
              "alloc,executable"
            ],
            [
              ".plt.got",
              3024,
              32,
              3.31,
              "alloc,executable"
            ],
            [
              ".text",
              3056,
              3994,
              5.71,
              "alloc,executable"
            ],
            [
              ".fini",
              7056,
              14,
              3.24,
              "alloc,executable"
            ],
            [
              ".rodata",
              7072,
              368,
              4.76,
              "alloc"
            ],
            [
              ".eh_frame_hdr",
              7440,
              140,
              3.94,
              "alloc"
            ],
            [
              ".eh_frame",
              7584,
              604,
              4.45,
              "alloc"
            ],
            [
              ".ctors",
              11824,
              16,
              1.0,
              "write,alloc"
            ],
            [
              ".dtors",
              11840,
              16,
              1.0,
              "write,alloc"
            ],
            [
              ".jcr",
              11856,
              8,
              0.0,
              "write,alloc"
            ],
            [
              ".dynamic",
              11864,
              368,
              1.25,
              "write,alloc"
            ],
            [
              ".got",
              12232,
              56,
              0.39,
              "write,alloc"
            ],
            [
              ".got.plt",
              12288,
              192,
              1.65,
              "write,alloc"
            ],
            [
              ".data",
              12480,
              82,
              0.54,
              "write,alloc"
            ],
            [
              ".comment",
              12562,
              61,
              4.11,
              "merge,strings"
            ],
            [
              ".ident",
              12623,
              338,
              4.84,
              "merge,strings"
            ],
            [
              ".SUNW_ctf",
              12964,
              143,
              2.89,
              ""
            ],
            [
              ".shstrtab",
              13107,
              223,
              4.19,
              ""
            ]
          ],
          "metrics": {
            "elf": {
              "bits": 64.0,
              "entry": 3056.0,
              "has_got": 1.0,
              "has_plt": 1.0,
              "has_note": 1.0,
              "relacount": 3.0,
              "note_count": 2.0,
              "nx_enabled": 1.0,
              "dynrel_count": 0.0,
              "dynsym_count": 34.0,
              "has_eh_frame": 1.0,
              "stack_canary": 1.0,
              "symtab_count": 0.0,
              "dynrela_count": 9.0,
              "little_endian": 1.0,
              "dt_flags_1_raw": 134217728.0,
              "pltreloc_count": 21.0,
              "executable_stack": 0.0,
              "wx_segment_count": 0.0,
              "comment_entry_count": 2.0,
              "program_header_count": 8.0,
              "comment_distinct_count": 2.0,
              "gnu_stack_section_absent": 1.0,
              "load_segment_max_file_size": 8188.0,
              "stripped_but_symtab_present": 0.0,
              "load_segment_max_memory_size": 8188.0,
              "section_relocation_group_count": 2.0,
              "stripped_metadata_section_count": 7.0
            },
            "file": {
              "size": 15192.0,
              "entropy": 3.76,
              "size_bytes": 15192.0
            },
            "binary": {
              "is_pie": 1.0,
              "has_overlay": 1.0,
              "is_stripped": 1.0,
              "code_entropy": 5.52,
              "data_entropy": 1.18,
              "overlay_size": 1862.0,
              "string_count": 75.0,
              "overlay_ratio": 0.12,
              "overall_entropy": 3.76,
              "overlay_entropy": 1.4,
              "entropy_variance": 2.48,
              "avg_string_length": 15.63,
              "max_string_length": 61.0,
              "peak_region_bytes": 1024.0,
              "code_to_data_ratio": 0.86,
              "peak_region_entropy": 6.02,
              "string_length_stddev": 14.8,
              "largest_section_ratio": 0.26,
              "sentence_string_count": 16.0,
              "sentence_string_ratio": 0.21,
              "high_entropy_string_count": 0.0
            },
            "exports": {
              "count": 3.0
            },
            "imports": {
              "count": 27.0
            },
            "sections": {
              "count": 29.0,
              "code_size": 4406.0,
              "entropy_max": 5.71,
              "entropy_mean": 2.7,
              "name_entropy": 4.14,
              "writable_count": 8.0,
              "executable_count": 5.0,
              "nonstandard_count": 8.0,
              "executable_writable_count": 0.0
            },
            "dependencies": {
              "count": 1.0
            }
          }
        },
        "id": 1,
        "mol": "H(F)Md(He)",
        "path": "/data/samples/good/foraged/netbsd/netbsd.org/_/sigrot-1.2nb1/sigrot-1.2nb1.tgz!!bin/sigrot",
        "pid": 0,
        "risk": 2,
        "sha": "0706fd8ef0c3d3151fa001e7e2ac008af5bf70f7749206be05c48cae9ac171c9",
        "size": 15192,
        "traits": [
          {
            "id": "metadata/hardening/missing::stripped-binary",
            "conf": 0.800000011920929,
            "crit": 3,
            "desc": "No full symbol table (likely stripped)",
            "spans": [
              [
                0,
                25
              ]
            ]
          },
          {
            "id": "micro-behaviors/fs/file/open::fopen",
            "conf": 0.6600000262260437,
            "crit": 3,
            "desc": "References C fopen file-open API",
            "spans": [
              [
                1861,
                5
              ]
            ]
          }
        ],
        "type": "elf"
      }
    ],
    "rev": "935ec",
    "v": "8"
  }
}