{ "ml": { "v": "7", "eng": "2.2.0-beta.2", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.00006181995, "rte": "az", "prob": 0.00006181995 }, { "cls": 0, "raw": 0.0001489222, "rte": "az/tar", "prob": 0.0001489222 } ], "prob": 0.00006181995, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.00006181994831422344, "type": "apk_alpine" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.00001422564218955813, "type": "elf" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.000010838110938493628, "type": "text" } ], "version": "v18.18", "analyzed_at": "2026-06-26T09:47:49Z" }, "path": "freeswitch-perl-1.10.12-r5.apk", "raw": { "files": [ { "id": 0, "ctx": [ { "b": "abZy8000000T3{24[J!\u003enkh=HeH]u63?!Yp^*DIa!jX1m:JNrco?u{f=2H?Deg@xa3GU*X", "n": [ { "c": 2, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "o": 0, "z": 1, "cf": 1.0 } ], "ln": 0 } ], "mol": "O(Al)", "sha": "8aa50fdaec878759fb901a5a53c820a9a9f64069e4698e0668cb3961955a170f", "path": "/data/samples/good/foraged/alpine/alpinelinux.org/_/freeswitch-perl/freeswitch-perl-1.10.12-r5.apk", "risk": 2, "size": 69406, "type": "apk_alpine", "facts": { "metrics": { "file": { "size": 69406.0, "entropy": 7.99, "size_bytes": 69406.0 }, "parse": { "error_count": 1.0 }, "binary": { "overall_entropy": 7.99, "peak_region_bytes": 68382.0, "peak_region_entropy": 7.82 } } }, "traits": [ { "id": "micro-behaviors/dylib/library/libc::libc-characteristic-cxa-finalize", "crit": 2, "desc": "libc characteristic cxa finalize", "from": [ { "file": 1 } ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-basename", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package info file" }, { "id": "metadata/package/files/system-package::alpine-pkginfo-version-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package version field", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/ui/help::usage-title-string", "crit": 1, "desc": "Usage: label in binary strings", "from": [ { "file": 1 } ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-origin-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package origin field", "from": [ { "file": 2 } ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-package-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package name field", "from": [ { "file": 2 } ] }, { "id": "metadata/binary/metrics/threshold::high-string-count-1000", "conf": 0.699999988079071, "crit": 2, "desc": "High string count over 1000", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/ui/help::usage-title", "crit": 2, "desc": "Usage: label (title case)", "from": [ { "file": 1 } ] }, { "id": "objectives/anti-analysis/self-modify/runtime::elf-manual-loader-cond-0--inline-10757", "conf": 0.8500000238418579, "crit": 3, "desc": "Regex component marker", "from": [ { "file": 1 } ] }, { "id": "metadata/binary/metrics/threshold::many-imports-50", "conf": 1.0, "crit": 1, "desc": "Binary has 50+ imports", "from": [ { "file": 1 } ] }, { "id": "metadata/binary/metrics/threshold::rich-sentence-strings-20pct", "conf": 0.800000011920929, "crit": 1, "desc": "Binary has many sentence-like strings", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/dylib/library/libc::libc-internal-functions-b", "conf": 0.699999988079071, "crit": 2, "desc": "libc internal symbols cluster B", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/ui/help::usage-label", "conf": 0.75, "crit": 1, "desc": "Command line usage text", "from": [ { "off": 153141, "file": 1 } ] } ] }, { "ctx": [ { "b": "E))420S-r400000000000@$H+0rr910000000000kMy=:000007\u003eR[\u003c0000000000kMA+z3JJA(8upSP0rr911o", "n": [ { "c": 3, "d": "Benign PE anti-analysis context", "i": "objectives/anti-analysis/debugger-detect/combined-checks::evasion-aware-benign-pe-context", "o": 0, "z": 22, "cf": 1.0 } ], "ln": 0 }, { "b": "A-t+2y\u0026si5raflLwDl7Av%zA?w[=c\u003ey?Xib0af8zwPzu{x(!xcA:JB0vqPN.x(mK30af8NwOkZ#", "n": [ { "c": 3, "d": "Benign network-capable library context", "i": "objectives/supply-chain/trojanized/backdoor::benign-network-library-context", "o": 6223, "z": 12, "cf": 0.8999999761581421 } ], "ln": 6207 }, { "b": "x()\u0026#uU\u003cT[uVp41zGGE\u003cAaK6auT)[\u003czE\u0026/AoKzpLA=L-eByeJ@zGGDmBo2VPBzM29xjVf(vpS[?08Mu@BzbY4yH}+\u003eAcb=lwNPaRB7GDmAaJJ[w[+-P", "n": [ { "c": 2, "d": "Imports __tls_get_addr from the dynamic loader", "i": "metadata/binary/linking/runtime::imports-tls-get-addr", "o": 6342, "z": 12, "cf": 1.0 }, { "c": 2, "d": "Process forking", "i": "micro-behaviors/process/fork/clone::fork", "o": 6310, "z": 10, "cf": 0.6600000262260437 } ], "ln": 6294 }, { "b": "A=U^(p?sV-uUr}(uUBP.vpBd}Bo3x7A+]r808NlEy*R6\u003eCt?Jxp?sV-uVQx$B7GDjB]", "n": [ { "c": 2, "d": "Abort program execution", "i": "micro-behaviors/os/signal/handler::abort", "o": 6546, "z": 5, "cf": 0.8999999761581421 } ], "ln": 6530 }, { "b": "CX}n7Aa9^dwNxI2ASxDNB97\u00262yHpN+yHpWZx(0=\u003cBAg(8ASyf8x()\u0026#uVP^$vrb^#wNxI2A+PA70bR", "n": [ { "c": 3, "d": "Stack protector/canary enabled", "i": "metadata/hardening/build::stack-protector", "o": 6674, "z": 14, "cf": 0.8999999761581421 } ], "ln": 6658 }, { "b": "0ae]uy/2p(0ae]er.+w6uTEq/CWU5}B$\u003e:auTE\u003e*uT)[XB8$YgD2Nt4x(mK3mf3W#r7O/0lVh", "n": [ { "c": 2, "d": "GNU libstdc++ stdlib", "i": "micro-behaviors/dylib/library/libc::libstdcxx-ref", "o": 7874, "z": 10, "cf": 0.8999999761581421 } ], "ln": 7858 }, { "b": "zGx-jwNw}-wNPE-y\u0026r}^vSDf[xjR6twPzP]zeTDauVQw\u003cp?sV-uU%.4wNw[+wnbQ@08J", "n": [ { "c": 1, "d": "bridge interface", "i": "micro-behaviors/os/container/namespace::bridge-str", "o": 10461, "z": 6, "cf": 1.0 } ], "ln": 10445 }, { "b": "A+)vHzVBP/vQ?3cB-RvJCSmP*hz^4cz.r:Ay?Wu\u003cA+e*6CwheexFavAe?)uxx\u003c#d9wmEbue]$}-humMcvRogXuVN\u0026vz.r:AzeS@(AaK6ae]$}hm)/S", "n": [ { "c": 3, "d": "Architecture detection strings", "i": "objectives/discovery/host/software::arch-detection", "o": 11193, "z": 6, "cf": 0.5 }, { "c": 2, "d": "GNU libstdc++ stdlib", "i": "micro-behaviors/dylib/library/libc::libstdcxx-ref", "o": 11224, "z": 12, "cf": 0.8999999761581421 } ], "ln": 11177 }, { "b": "vS=^7mriA!ASw)ppdn4XrDzOYwJy@OB-88hzF7vDi@*NFash7euVovZxKL]YrDzOYwJy@PwPQBUz^)c\u003er:*2.vpB4:d0x3tuV6p?wH@1kA:J##y:?BCx(k5gwPRQ7wfrmvwPQBUz^)c\u003er:*2.vpB4:cOcw", "n": [ { "c": 3, "d": "Benign socket shell helper context", "i": "micro-behaviors/process/fd/dup::posix-fd-redirect-shell-benign-context", "o": 152891, "z": 43, "cf": 0.9399999976158142 }, { "c": 3, "d": "Terminal socket exec helper context", "i": "micro-behaviors/process/fd/dup::unix-terminal-socket-exec-benign-context", "o": 152859, "z": 17, "cf": 0.949999988079071 } ], "ln": 152843 }, { "b": "w/#hvAaHdtv}Yp\u003easX-srDzOYwJy@AwO+}1wNw2fqCy.uBTRrxy?taT0blr[zdN*5z!6$rwmYN*By!/Jr-hU6zGNrTayPq6", "n": [ { "c": 3, "d": "Linker and terminal benign dual-mode forwarding", "i": "micro-behaviors/process/fd/dup::unix-dual-mode-socket-exec-benign-context", "o": 153053, "z": 28, "cf": 0.9399999976158142 } ], "ln": 153037 }, { "b": "D2NsqcRmupo\u003ewi+asX-srDzOYwJy@AwO+}1wNv-1nHOT\u003ey?taT0blr[zdN*5z!6$rwmYN*By!/Bp!r2=ayPq6B.$Yc", "n": [ { "c": 2, "d": "Usage: label (title case)", "i": "micro-behaviors/ui/help::usage-title", "o": 153141, "z": 24, "cf": 0.5 } ], "ln": 153125 }, { "b": "z!pblD2NsqcQyN2asX-srDzOYwJy@FzG6-uuT)IXy*{*.yHqd8vru6/ByeT5zEW^5z/e{6wPPtwwO+%fw{503BzkVhdlvJzzxJ!cBzbP6asy(vAclnfv{%g\u0026vQS+ZuVQr$By+", "n": [ { "c": 2, "d": "Usage: label (title case)", "i": "micro-behaviors/ui/help::usage-title", "o": 153217, "z": 58, "cf": 0.5 } ], "ln": 153201 }, { "b": "w/#hvAaHdtC5I89asX-srDzOYwJy@FzG6-uuT)IXy*{*.yHqd8vru6/Byfc6A+eV\u0026q/(C\u0026wNxH\u0026Bsqiwy?tkuxMvV)wk^OUBy=).0blr[zdN*5z!6$rx(m)jByeJ^y\u00260M?v@2B)Byxo5", "n": [ { "c": 2, "d": "Usage: label (title case)", "i": "micro-behaviors/ui/help::usage-title", "o": 153446, "z": 64, "cf": 0.5 } ], "ln": 153430 }, { "b": "w/#hvAaHdtC5I89asX-srDzOYwJy@FzG6-uuT)IXy*{*.yHqd8vru6/ByeQ7BAg!%B7GCwB7Gf1em\u003c6FA:ZyU0blr[zdN*5z!6$rx(m)jByeJ^y\u00260M?v@2B)Byxo5", "n": [ { "c": 2, "d": "Usage: label (title case)", "i": "micro-behaviors/ui/help::usage-title", "o": 153687, "z": 52, "cf": 0.5 } ], "ln": 153671 }, { "b": "w/#hvAaHdtC5I89asX-srDzOYwJy@FzG6-uuT)IXy*{*.yHqd8vru6/ByeT5zEW9}xldB3wPPtwwO+%fw{503vrc14dlvJzzxJ!cBzbP6asy(vAclnfv{%g\u0026vQS+ZuVQr$By+", "n": [ { "c": 2, "d": "Usage: label (title case)", "i": "micro-behaviors/ui/help::usage-title", "o": 153904, "z": 58, "cf": 0.5 } ], "ln": 153888 }, { "b": "00000000000000000000zeS@(AaK6ae]$}-wmYj)x8?]iH3gk504@taB98CAvpxi?zF%Sde[Y6Ae]U\u0026Hz#", "n": [ { "c": 2, "d": ".gnu_debuglink reference present", "i": "metadata/build/debug::elf-debuglink", "o": 229872, "z": 17, "cf": 1.0 } ], "ln": 229856 }, { "b": "y?bbiwb[k{zGNNBvrl8Ze[xlBB9RQ5e[xlBB98B5e[Y6Ae{p/DB7]Mg04}]4BUm\u0026GA=U@kzEmz:e]\u003eI", "n": [ { "c": 2, "d": "ELF dynstr section name", "i": "metadata/binary/linking/static::elf-dynstr-section-name", "o": 229963, "z": 7, "cf": 0.8999999761581421 }, { "c": 2, "d": "ELF dynsym section name", "i": "metadata/binary/linking/static::elf-dynsym-section-name", "o": 229955, "z": 7, "cf": 0.8999999761581421 } ], "ln": 229939 }, { "b": "vr?\u00269wmoN*e]\u003eJte]\u003e\u003ege[xlBvqPZ*04}]5Bo0}7vrt]Te[e)y04}]4BZFV\u003cvS=s1x(mX^", "n": [ { "c": 2, "d": "ELF dynamic section name", "i": "metadata/binary/linking/static::elf-dynamic-section-name", "o": 230124, "z": 8, "cf": 0.8999999761581421 } ], "ln": 230108 } ], "depth": 1, "facts": { "exp": [ [ "init" ], [ "boot_freeswitch" ], [ "fini" ], [ "mod_perl_module_interface" ] ], "imp": [ [ "", "ZN11CoreSession10streamFileEPci" ], [ "", "Perl_mg_get" ], [ "", "switch_xml_bind_search_function_ret" ], [ "", "ZN11CoreSessionC2EPcPS_" ], [ "", "Perl_sv_setiv" ], [ "", "Perl_sv_bless" ], [ "", "ZN11CoreSession9originateEPS_PciP26switch_state_handler_table" ], [ "", "perl_free" ], [ "", "ZN11CoreSession5readyEv" ], [ "", "Perl_get_hv" ], [ "", "ZN6Stream9raw_writeEPKci" ], [ "", "ZN11CoreSession10insertFileEPKcS1_i" ], [ "", "errno_location" ], [ "", "console_clean_log" ], [ "", "ZN11CoreSession11flushEventsEv" ], [ "", "Perl_get_sv" ], [ "", "PL_thr_key" ], [ "", "switch_console_stream_write" ], [ "", "ZN11CoreSession19playAndDetectSpeechEPcS0_S0_" ], [ "", "consoleLog2" ], [ "", "perl_parse" ], [ "", "Perl_eval_pv" ], [ "", "Perl_sv_2bool_flags" ], [ "", "ZN11CoreSession9sendEventEP5Event" ], [ "", "floor" ], [ "", "ZdaPv" ], [ "", "ZN5Event4fireEv" ], [ "", "switch_separate_string" ], [ "", "Znwm" ], [ "", "switch_log_printf" ], [ "", "ZN11CoreSession12detectSpeechEPcS0_S0_S0_" ], [ "", "switch_xml_parse_str" ], [ "", "switch_loadable_module_create_module_interface" ], [ "", "ceil" ], [ "", "PL_veto_switch_non_tTHX_context" ], [ "", "ZN5Event9delHeaderEPKc" ], [ "", "dtmf_callback" ], [ "", "ZN3APIC1EP11CoreSession" ], [ "", "ZN5Event7addBodyEPKc" ], [ "", "ZN11CoreSession5printEPc" ], [ "", "ZN11CoreSession11hangupCauseEv" ], [ "", "perl_run" ], [ "", "Perl_sv_setpvf_nocontext" ], [ "", "switch_find_end_paren" ], [ "", "cxa_finalize" ], [ "", "email" ], [ "", "Perl_sv_2mortal" ], [ "", "strtoul" ], [ "", "malloc" ], [ "", "Perl_sv_setpv" ], [ "", "ZN11CoreSession7executeEPKcS1_" ], [ "", "ZN11CoreSession11consoleLog2EPcS0_S0_iS0_" ], [ "", "switch_channel_get_state" ], [ "", "ZN11CoreSession7destroyEv" ], [ "", "ZN11CoreSession15setDTMFCallbackEPvPc" ], [ "", "tls_get_addr" ], [ "", "switch_core_session_get_channel" ], [ "", "ZN13EventConsumer7cleanupEv" ], [ "", "strlen" ], [ "", "switch_threadattr_detach_set" ], [ "", "strtod" ], [ "", "ZN11CoreSession8getStateEv" ], [ "", "ZN11CoreSession13set_tts_parmsEPcS0_" ], [ "", "Perl_more_sv" ], [ "", "strtol" ], [ "", "perl_clone" ], [ "", "Znam" ], [ "", "ZN3API13executeStringEPKc" ], [ "", "Perl_gv_init_pvn" ], [ "", "ITM_deregisterTMCloneTable" ], [ "", "ZN5Event12chat_executeEPKcS1_" ], [ "", "ZN13EventConsumer3popEii" ], [ "", "perl_alloc" ], [ "", "consoleCleanLog" ], [ "", "ZN11CoreSession8transferEPcS0_S0_" ], [ "", "switch_mutex_unlock" ], [ "", "ZN5Event11setPriorityE17switch_priority_t" ], [ "", "ZN5EventC1EP12switch_eventi" ], [ "", "ZN6Stream4readEPi" ], [ "", "switch_mutex_init" ], [ "", "setGlobalVariable" ], [ "", "ZN11CoreSession13setHangupHookEPv" ], [ "", "switch_xml_free" ], [ "", "ITM_registerTMCloneTable" ], [ "", "switch_channel_get_private" ], [ "", "ZN7IVRMenu10bindActionEPcPKcS2_" ], [ "", "ZN11CoreSession10setPrivateEPcPv" ], [ "", "ZN11CoreSession13setAutoHangupEb" ], [ "", "SWITCH_GLOBAL_dirs" ], [ "", "ZN11CoreSession11setVariableEPcS0_" ], [ "", "gxx_personality_v0" ], [ "", "pthread_getspecific" ], [ "", "ZN5Event9getHeaderEPKc" ], [ "", "switch_xml_open_cfg" ], [ "", "switch_channel_test_ready" ], [ "", "ZN6StreamC1EP20switch_stream_handle" ], [ "", "PL_current_context" ], [ "", "ZN11CoreSession5sleepEii" ], [ "", "boot_DynaLoader" ], [ "", "Perl_sv_setref_pv" ], [ "", "ZN11CoreSession13waitForAnswerEPS_" ], [ "", "ZN11CoreSession13collectDigitsEii" ], [ "", "stack_chk_fail" ], [ "", "perl_construct" ], [ "", "ZN11CoreSessionC2Ev" ], [ "", "switch_loadable_module_create_interface" ], [ "", "ZN11CoreSession11flushDigitsEv" ], [ "", "switch_xml_parse_section_string" ], [ "", "ZN11CoreSession11hangupStateEv" ], [ "", "Perl_more_bodies" ], [ "", "Perl_sv_setsv_flags" ], [ "", "switch_mprintf" ], [ "", "Perl_sv_setpvn" ], [ "", "ZN13EventConsumer4bindEPKcS1_" ], [ "", "ZN11CoreSession14set_tts_paramsEPcS0_" ], [ "", "ZN11CoreSession10mediaReadyEv" ], [ "", "Perl_sv_free2" ], [ "", "ZN11CoreSession9getDigitsEiPciii" ], [ "", "switch_channel_set_private" ], [ "", "ZTI11CoreSession" ], [ "", "ZN11CoreSessionC2EP19switch_core_session" ], [ "", "ZN5Event5mergeEPS_" ], [ "", "ZN11CoreSession6hangupEPKc" ], [ "", "ZN5Event7getBodyEv" ], [ "", "Perl_sv_2uv_flags" ], [ "", "Perl_sv_newmortal" ], [ "", "switch_threadattr_create" ], [ "", "switch_snprintf" ], [ "", "switch_mutex_lock" ], [ "", "ZN11CoreSession8answeredEv" ], [ "", "switch_xml_attr_soft" ], [ "", "Perl_sv_2nv_flags" ], [ "", "ZN11CoreSession10getPrivateEPc" ], [ "", "ZN6Stream5writeEPKc" ], [ "", "perl_destruct" ], [ "", "switch_core_session_get_pool" ], [ "", "register_frame_info" ], [ "", "running" ], [ "", "ZN7IVRMenu7executeEP11CoreSessionPKc" ], [ "", "switch_core_event_hook_add_state_change" ], [ "", "switch_core_session_sprintf" ], [ "", "Perl_newSV" ], [ "", "console_log2" ], [ "", "ZN5Event9chat_sendEPKc" ], [ "", "Perl_newSViv" ], [ "", "switch_uuid_get" ], [ "", "Perl_set_context" ], [ "", "Perl_hv_common_key_len" ], [ "", "ZN13EventConsumerD1Ev" ], [ "", "ZN5Event9serializeEPKc" ], [ "", "abort" ], [ "", "ZN4DTMFC1Ecj" ], [ "", "ZN11CoreSession10recordFileEPciii" ], [ "", "Perl_gv_add_by_type" ], [ "", "ZN3API7getTimeEv" ], [ "", "hanguphook" ], [ "", "Perl_mg_find" ], [ "", "ZN11CoreSession10consoleLogEPcS0_" ], [ "", "ZN11CoreSession23process_callback_resultEPc" ], [ "", "ZN6StreamC1Ev" ], [ "", "Perl_sv_isobject" ], [ "", "switch_core_event_hook_remove_state_change" ], [ "", "ZN11CoreSession9getDigitsEiPci" ], [ "", "ZN11CoreSession16playAndGetDigitsEiiiiPcS0_S0_S0_PKciS2_" ], [ "", "ZN3API7executeEPKcS1_" ], [ "", "ZN11CoreSession6answerEv" ], [ "", "Perl_croak_nocontext" ], [ "", "switch_thread_create" ], [ "", "ZN11CoreSession9preAnswerEv" ], [ "", "switch_console_stream_raw_write" ], [ "", "bridge" ], [ "", "switch_core_session_get_uuid" ], [ "", "ZN11CoreSession4readEiiPKciS1_i" ], [ "", "ZN11CoreSession9sayPhraseEPKcS1_S1_" ], [ "", "strstr" ], [ "", "switch_threadattr_stacksize_set" ], [ "", "strcmp" ], [ "", "getGlobalVariable" ], [ "", "ZN11CoreSession5speakEPc" ], [ "", "deregister_frame_info" ], [ "", "Perl_sv_2iv_flags" ], [ "", "switch_core_perform_strdup" ], [ "", "Perl_switch_locale_context" ], [ "", "ZN5Event7getTypeEv" ], [ "", "free" ], [ "", "ZN11CoreSession9getXMLCDREv" ], [ "", "strchr" ], [ "", "ZN11CoreSession3sayEPKcS1_S1_S1_S1_" ], [ "", "Perl_newXS" ], [ "", "Perl_hv_common" ], [ "", "console_log" ], [ "", "ZN11CoreSession9getDigitsEiPcii" ], [ "", "ZN11CoreSession7bridgedEv" ], [ "", "Perl_newSVuv" ], [ "", "ZN11CoreSession11getVariableEPc" ], [ "", "switch_uuid_format" ], [ "", "Unwind_Resume" ], [ "", "strdup" ], [ "", "switch_xml_child" ], [ "", "ZdlPvm" ], [ "", "consoleLog" ], [ "", "ZN7IVRMenuC1EPS_PKcS2_S2_S2_S2_S2_S2_S2_S2_S2_iiiiii" ], [ "", "ZN6Stream8get_dataEv" ], [ "", "ZN11CoreSession13collectDigitsEi" ], [ "", "pthread_setspecific" ], [ "", "switch_msleep" ], [ "", "ZN11CoreSession12setEventDataEP5Event" ], [ "", "ZTVN10__cxxabiv120__si_class_type_infoE" ], [ "", "Perl_markstack_grow" ], [ "", "ZN5EventC1EPKcS1_" ], [ "", "ZN13EventConsumerC1EPKcS1_i" ], [ "", "strcpy" ], [ "", "ZN5Event9addHeaderEPKcS1_" ], [ "", "Perl_sv_backoff" ], [ "", "ZN11CoreSessionD2Ev" ], [ "", "Perl_sv_2pv_flags" ], [ "", "Perl_sv_magic" ] ], "sec": [ [ ".note.gnu.property", 680, 48, 1.94, "alloc" ], [ ".note.gnu.build-id", 728, 36, 4.14, "alloc" ], [ ".gnu.hash", 768, 60, 3.21, "alloc" ], [ ".dynsym", 832, 5328, 1.2, "alloc" ], [ ".dynstr", 6160, 5143, 4.94, "alloc" ], [ ".gnu.version", 11304, 444, 1.05, "alloc" ], [ ".gnu.version_r", 11752, 32, 2.17, "alloc" ], [ ".rela.dyn", 11784, 5256, 1.83, "alloc" ], [ ".relr.dyn", 17040, 152, 3.48, "alloc" ], [ ".init", 20480, 3, 1.58, "alloc,executable" ], [ ".text", 20496, 130482, 6.09, "alloc,executable" ], [ ".fini", 150978, 3, 1.58, "alloc,executable" ], [ ".rodata", 151552, 44720, 4.9, "alloc" ], [ ".eh_frame_hdr", 196272, 2148, 5.64, "alloc" ], [ ".eh_frame", 198424, 17280, 4.97, "alloc" ], [ ".gcc_except_table", 215704, 325, 4.69, "alloc" ], [ ".init_array", 219824, 8, 1.06, "write,alloc" ], [ ".fini_array", 219832, 8, 1.06, "write,alloc" ], [ ".data.rel.ro", 219840, 3112, 3.15, "write,alloc" ], [ ".dynamic", 222952, 560, 1.54, "write,alloc" ], [ ".got", 223512, 1752, 0.02, "write,alloc" ], [ ".data", 225280, 4592, 1.02, "write,alloc" ], [ ".gnu_debuglink", 229872, 24, 4.05, "" ], [ ".shstrtab", 229896, 268, 4.27, "" ] ], "metrics": { "elf": { "bits": 64.0, "entry": 0.0, "has_got": 1.0, "has_plt": 0.0, "has_note": 1.0, "note_count": 2.0, "nx_enabled": 1.0, "has_dt_relr": 1.0, "has_runpath": 1.0, "dynrel_count": 0.0, "dynsym_count": 222.0, "has_build_id": 1.0, "has_eh_frame": 1.0, "has_gnu_hash": 1.0, "stack_canary": 1.0, "symtab_count": 0.0, "dynrela_count": 219.0, "has_debuglink": 1.0, "little_endian": 1.0, "dt_flags_1_raw": 1.0, "pltreloc_count": 0.0, "build_id_length": 20.0, "dt_versym_count": 222.0, "executable_stack": 0.0, "fini_array_count": 1.0, "init_array_count": 1.0, "wx_segment_count": 0.0, "program_header_count": 11.0, "gnu_stack_section_absent": 0.0, "load_segment_max_file_size": 130501.0, "stripped_but_symtab_present": 0.0, "load_segment_max_memory_size": 130501.0, "section_relocation_group_count": 1.0, "stripped_metadata_section_count": 8.0 }, "file": { "size": 231832.0, "entropy": 6.02, "size_bytes": 231832.0 }, "binary": { "is_pie": 0.0, "has_overlay": 1.0, "is_stripped": 1.0, "code_entropy": 6.09, "data_entropy": 1.53, "overlay_size": 1668.0, "string_count": 1170.0, "overlay_ratio": 0.01, "overall_entropy": 6.02, "overlay_entropy": 1.54, "entropy_variance": 2.97, "avg_string_length": 41.5, "max_string_length": 228.0, "peak_region_bytes": 124928.0, "code_to_data_ratio": 0.93, "peak_region_entropy": 6.06, "string_length_stddev": 23.12, "largest_section_ratio": 0.56, "sentence_string_count": 415.0, "sentence_string_ratio": 0.35, "high_entropy_string_count": 0.0 }, "exports": { "count": 4.0 }, "imports": { "count": 217.0 }, "sections": { "count": 26.0, "code_size": 130488.0, "entropy_max": 6.09, "entropy_mean": 2.9, "name_entropy": 4.22, "writable_count": 7.0, "executable_count": 3.0, "nonstandard_count": 7.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 5.0 } } }, "id": 1, "mol": "O(Al)", "path": "/data/samples/good/foraged/alpine/alpinelinux.org/_/freeswitch-perl/freeswitch-perl-1.10.12-r5.apk!!usr/lib/freeswitch/mod/mod_perl.so", "risk": 2, "sha": "eada8997f74c0a36bd4416ecb5df365e261b592c5be12e3fc7820b07aa83324b", "size": 231832, "traits": [ { "id": "micro-behaviors/ui/help::usage-title-string", "crit": 1, "desc": "Usage: label in binary strings", "spans": [ [ 152859, 17 ], [ 152891, 43 ], [ 153053, 28 ], [ 153141, 24 ], [ 153217, 58 ], [ 153446, 64 ], [ 153687, 52 ], [ 153904, 58 ] ] }, { "id": "micro-behaviors/ui/help::usage-title", "crit": 2, "desc": "Usage: label (title case)", "spans": [ [ 152859, 17 ], [ 152891, 43 ], [ 153053, 28 ], [ 153141, 24 ], [ 153217, 58 ], [ 153446, 64 ], [ 153687, 52 ], [ 153904, 58 ] ] }, { "id": "metadata/binary/metrics/threshold::rich-sentence-strings-20pct", "conf": 0.800000011920929, "crit": 1, "desc": "Binary has many sentence-like strings", "spans": [ [ 0, 35 ] ] }, { "id": "micro-behaviors/dylib/library/libc::libc-characteristic-cxa-finalize", "crit": 2, "desc": "libc characteristic cxa finalize", "spans": [ [ 6223, 12 ] ] }, { "id": "metadata/binary/metrics/threshold::many-imports-50", "conf": 1.0, "crit": 1, "desc": "Binary has 50+ imports", "spans": [ [ 0, 22 ] ] }, { "id": "objectives/anti-analysis/self-modify/runtime::elf-manual-loader-cond-0--inline-10757", "conf": 0.8500000238418579, "crit": 3, "desc": "Regex component marker", "spans": [ [ 0, 22 ] ] }, { "id": "metadata/binary/metrics/threshold::high-string-count-1000", "conf": 0.699999988079071, "crit": 2, "desc": "High string count over 1000", "spans": [ [ 0, 29 ] ] }, { "id": "micro-behaviors/dylib/library/libc::libc-internal-functions-b", "conf": 0.699999988079071, "crit": 2, "desc": "libc internal symbols cluster B", "spans": [ [ 6223, 12 ] ] }, { "id": "micro-behaviors/ui/help::usage-label", "conf": 0.75, "crit": 1, "desc": "Command line usage text", "spans": [ [ 152859, 17 ], [ 152891, 43 ], [ 153053, 28 ], [ 153141, 24 ], [ 153217, 58 ], [ 153446, 64 ], [ 153687, 52 ], [ 153904, 58 ] ] } ], "type": "elf" }, { "ctx": [ { "b": "boPG/zE)\u0026%By!#9vTf88vS=y3wfrVXf/HZsuVGThePJM", "n": [ { "c": 1, "d": "Alpine/Wolfi package info file", "i": "metadata/package/files/system-package::alpine-pkginfo-basename", "o": 0, "z": 1, "cf": 0.8999999761581421 } ], "ln": 1, "addr": 0 }, { "b": "boRbIx(mMaw)]E^A=k(raA?spB7]MgatCG8h.D\u0026", "ln": 2, "addr": 36 }, { "b": "Abf97vqPM#jS[uSwO2}bx()\u0026#ePtowyY", "n": [ { "c": 2, "d": "Alpine/Wolfi package info metadata", "i": "metadata/package/files/system-package::alpine-apk-pkginfo", "o": 68, "z": 25, "cf": 0.9700000286102295 } ], "ln": 3, "addr": 68 }, { "b": "Abf9fwPw[RatCG6fFk7nePJY", "n": [ { "c": 1, "d": "Alpine/Wolfi package version field", "i": "metadata/package/files/system-package::alpine-pkginfo-version-field", "o": 94, "z": 19, "cf": 0.8999999761581421 } ], "ln": 4, "addr": 94 }, { "b": "Abf8%wPIu7jS)jmwO2}bx()\u0026#aw=S\u0026y-)OkwozZ1", "ln": 5, "addr": 114 }, { "b": "B-IpvjS[AWBz#pZfe4J[Cp)GFwO2}bx()\u0026#e]L=yf8", "ln": 6, "addr": 147 }, { "b": "B7]@iauZ\u00265gCH\u003cBg5", "ln": 9, "addr": 262 }, { "b": "vrb\u003c\u003eauZ\u0026(i5Ub4gY", "ln": 10, "addr": 276 }, { "b": "z/PM8x(k4RazbU9wPJ6fByO$", "n": [ { "c": 1, "d": "Alpine/Wolfi package origin field", "i": "metadata/package/files/system-package::alpine-pkginfo-origin-field", "o": 290, "z": 19, "cf": 0.8999999761581421 } ], "ln": 11, "addr": 290 }, { "b": "v@Dj3x(\u003eEXattJdg=vfCg+?0Aw\u0026IU8vp\u0026$SgCQ\u003c%h8]20g=442i51(3w\u0026qLbh2", "ln": 12, "addr": 310 }, { "b": "zddc@Byw)3wPw[RawMu!vqYH+y-(8-Aa6\u003eKzEWQ7vl!mqAa%i3y?W^fCRi]PxfD", "ln": 13, "addr": 360 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 672.0, "entropy": 5.16, "size_bytes": 672.0 }, "binary": { "overall_entropy": 5.16, "peak_region_bytes": 672.0, "peak_region_entropy": 5.16 } } }, "id": 2, "path": "/data/samples/good/foraged/alpine/alpinelinux.org/_/freeswitch-perl/freeswitch-perl-1.10.12-r5.apk!!.PKGINFO", "risk": 1, "sha": "eff8ec8af4c4be23c14fab073b379200892d953f6f8467c696a331732708955b", "size": 672, "traits": [ { "id": "metadata/package/files/system-package::arch-pkgver-field", "conf": 0.9399999976158142, "crit": 1, "desc": "Arch pkgver metadata field", "spans": [ [ 94, 19 ] ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-origin-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package origin field", "spans": [ [ 290, 19 ] ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-version-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package version field", "spans": [ [ 94, 19 ] ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-package-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package name field", "spans": [ [ 68, 25 ] ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-basename", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package info file" }, { "id": "metadata/package/files/system-package::arch-pkgname-field", "conf": 0.9399999976158142, "crit": 1, "desc": "Arch pkgname metadata field", "spans": [ [ 68, 25 ] ] }, { "id": "metadata/package/files/system-package::alpine-apk-pkginfo", "conf": 0.9700000286102295, "crit": 2, "desc": "Alpine/Wolfi package info metadata", "spans": [ [ 68, 25 ], [ 94, 19 ], [ 290, 19 ] ] } ], "type": "text" } ], "rev": "af11a", "v": "8" } }