{
  "ml": {
    "v": "7",
    "eng": "2.2.0-rc.1",
    "lvl": -1,
    "conf": 0,
    "mods": [
      {
        "cls": 0,
        "raw": 0.00004998843,
        "rte": "az",
        "prob": 0.00004998843
      }
    ],
    "prob": 0.00007085999,
    "files": [
      {
        "id": 0,
        "lvl": -1,
        "conf": 0,
        "prob": 0.00007085999095579609,
        "type": "zst"
      },
      {
        "id": 1,
        "lvl": -1,
        "conf": 0,
        "prob": 0.00007085999095579609,
        "type": "elf"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-06-28T01:10:30Z"
  },
  "path": "hexium_gemini.ko.zst",
  "raw": {
    "files": [
      {
        "id": 0,
        "ctx": [
          {
            "b": "d77-bQ+MDZ0hO]X+h/SZn!r%QyyBZ1-w?k#2w\u003e$dOD",
            "n": [
              {
                "c": 2,
                "d": "Binary is not digitally signed",
                "i": "metadata/unsigned",
                "o": 0,
                "z": 1,
                "cf": 1.0
              }
            ],
            "ln": 0
          }
        ],
        "mol": "O₂(AsC)",
        "sha": "907349b923e13f64301a031857e2962fbec9e3b6b2441f593d7d6904975109fe",
        "path": "hexium_gemini.ko.zst",
        "risk": 3,
        "size": 25830,
        "type": "zst",
        "facts": {
          "metrics": {
            "file": {
              "size": 25830.0,
              "entropy": 7.99,
              "size_bytes": 25830.0
            },
            "binary": {
              "overall_entropy": 7.99,
              "peak_region_bytes": 24576.0,
              "peak_region_entropy": 7.83
            }
          }
        },
        "traits": [
          {
            "id": "objectives/anti-static/obfuscation/payload/code-in-data::nop-sled-in-data",
            "conf": 0.6499999761581421,
            "crit": 3,
            "desc": "Repeated NOP-run pattern in executable section",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "objectives/command-and-control/backdoor/keywords::suspicious-repo-name-a",
            "conf": 0.75,
            "crit": 3,
            "desc": "Suspicious repository name keywords",
            "from": [
              {
                "off": 7797,
                "file": 1
              }
            ]
          },
          {
            "id": "metadata/package/license::gpl-word",
            "conf": 0.699999988079071,
            "crit": 2,
            "desc": "GPL license reference",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "metadata/build/artifact::elf-stripped-but-symtab-present",
            "conf": 0.6000000238418579,
            "crit": 3,
            "desc": "ELF stripped with .symtab present",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "objectives/command-and-control/backdoor/keywords::grabber-word",
            "conf": 0.75,
            "crit": 3,
            "desc": "Infostealer 'grabber' slang term",
            "from": [
              {
                "file": 1
              }
            ]
          }
        ]
      },
      {
        "ctx": [
          {
            "b": "E))420S-r400000000000rtp-0rr9100000000000000000000axOTA0000000000kMy=:002m:eDvs400000000",
            "n": [
              {
                "c": 3,
                "d": "Recognized XOR-loop byte-pattern marker",
                "i": "objectives/anti-analysis/self-modify/runtime::xor-loop-pattern-recognized-marker",
                "o": 0,
                "z": 16,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 0
          },
          {
            "b": "00000000000000000000KDtM=KDtM=KDtM=KDtM=\u003eL$O.098ND\u003cV#\u003cAnqWjqI(jt\u003e008Y@000001ATYSKvUk+nSw9y2\u003cql*002MD?@\u003e4u002PIYD\u003en}004S",
            "n": [
              {
                "c": 3,
                "d": "Repeated NOP-run pattern in executable section",
                "i": "objectives/anti-static/obfuscation/payload/code-in-data::nop-sled-in-data",
                "o": 320,
                "z": 47,
                "cf": 0.6499999761581421
              }
            ],
            "ln": 304
          },
          {
            "b": "y?mc1w]zYjvpS[?wPI]nfNa($gi:ca00000xK#B5B.$F#wO(d0x/Wv.B0@E#axz64nLY",
            "n": [
              {
                "c": 2,
                "d": "Hex byte format string",
                "i": "micro-behaviors/data/encode/payload::hex-byte-format",
                "o": 7452,
                "z": 6,
                "cf": 0.6000000238418579
              }
            ],
            "ln": 7436
          },
          {
            "b": "y?mc1w]zYjvpS[?wPI]nfNa($gi:ca00a(?wQ4{izc{{!ze0)4iV}{vzF\u003cxmaAz4ax(:",
            "n": [
              {
                "c": 2,
                "d": "Hex byte format string",
                "i": "micro-behaviors/data/encode/payload::hex-byte-format",
                "o": 7671,
                "z": 6,
                "cf": 0.6000000238418579
              }
            ],
            "ln": 7655
          },
          {
            "b": "z6iF5ze0)4cM)2wvqPM#xl4A\u0026vR6Nic1Et.000000000LvS=y3wg}+kzGQgQx(Nf\u003eyICH",
            "n": [
              {
                "c": 3,
                "d": "Infostealer 'grabber' slang term",
                "i": "objectives/command-and-control/backdoor/keywords::grabber-word",
                "o": 7797,
                "z": 7,
                "cf": 0.75
              }
            ],
            "ln": 7781
          },
          {
            "b": "Z+L(N00000y?Wx\u003czGxwLm]h\u003eVvrDW9z/O0nx\u003e7*+wO-FWB-8blwfs0Kx\u003e7*+wO:Q",
            "n": [
              {
                "c": 3,
                "d": "Terminal socket exec helper context",
                "i": "micro-behaviors/process/fd/dup::unix-terminal-socket-exec-benign-context",
                "o": 9050,
                "z": 3,
                "cf": 0.949999988079071
              }
            ],
            "ln": 9034
          },
          {
            "b": "ggKWjzdmTeuWcf]ASxDNB97\u00262yHpN+yHpWZx(0=RAb]VgBzy\u003e%vqYQ]zc}6}vqG:#v{:p*wN\u003e^Rzd9",
            "n": [
              {
                "c": 3,
                "d": "Stack protector/canary enabled",
                "i": "metadata/hardening/build::stack-protector",
                "o": 10879,
                "z": 14,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 10863
          },
          {
            "b": "zddJ@xKtpYB7kh[g\u0026a{OvrlZiv{-.:zF\u003c2}BzkVh0ax}UuUaa%A^mT[B7nM#BZ!()C3!/#BAhTbB]",
            "n": [
              {
                "c": 2,
                "d": "async_connect function",
                "i": "micro-behaviors/os/event/library/boost-asio::async-connect",
                "o": 67109,
                "z": 13,
                "cf": 0.4000000059604645
              }
            ],
            "ln": 67093
          }
        ],
        "depth": 1,
        "facts": {
          "exp": [
            [
              "this_module"
            ],
            [
              "cleanup_module"
            ],
            [
              "init_module"
            ],
            [
              "pfx_init_module"
            ],
            [
              "pfx_cleanup_module"
            ]
          ],
          "imp": [
            [
              "",
              "saa7146_unregister_extension"
            ],
            [
              "",
              "saa7146_vv_init"
            ],
            [
              "",
              "saa7146_i2c_adapter_prepare"
            ],
            [
              "",
              "kfree"
            ],
            [
              "",
              "saa7146_vv_release"
            ],
            [
              "",
              "fentry__"
            ],
            [
              "",
              "dump_stack"
            ],
            [
              "",
              "printk"
            ],
            [
              "",
              "ref_stack_chk_guard"
            ],
            [
              "",
              "stack_chk_fail"
            ],
            [
              "",
              "video_devdata"
            ],
            [
              "",
              "saa7146_register_extension"
            ],
            [
              "",
              "i2c_smbus_xfer"
            ],
            [
              "",
              "i2c_del_adapter"
            ],
            [
              "",
              "ubsan_handle_out_of_bounds"
            ],
            [
              "",
              "random_kmalloc_seed"
            ],
            [
              "",
              "saa7146_unregister_device"
            ],
            [
              "",
              "x86_return_thunk"
            ],
            [
              "",
              "saa7146_register_device"
            ],
            [
              "",
              "i2c_add_adapter"
            ],
            [
              "",
              "dynamic_pr_debug"
            ],
            [
              "",
              "kmalloc_cache_noprof"
            ],
            [
              "",
              "saa7146_setgpio"
            ],
            [
              "",
              "param_ops_int"
            ],
            [
              "",
              "kmalloc_caches"
            ]
          ],
          "sec": [
            [
              "__jump_table",
              64,
              176,
              0.0,
              "write,alloc"
            ],
            [
              ".rela__jump_table",
              77176,
              792,
              1.66,
              "info_link"
            ],
            [
              "__patchable_function_entries",
              240,
              80,
              0.0,
              "write,alloc"
            ],
            [
              ".rela__patchable_function_entries",
              77968,
              240,
              1.22,
              "info_link"
            ],
            [
              ".text",
              320,
              2929,
              4.74,
              "alloc,executable"
            ],
            [
              ".rela.text",
              78208,
              4728,
              2.5,
              "info_link"
            ],
            [
              ".data",
              3256,
              3664,
              0.83,
              "write,alloc"
            ],
            [
              ".rela.data",
              82936,
              816,
              1.54,
              "info_link"
            ],
            [
              ".rodata",
              6920,
              1894,
              4.67,
              "alloc"
            ],
            [
              ".rela.rodata",
              83752,
              48,
              1.36,
              "info_link"
            ],
            [
              "__mcount_loc",
              8814,
              72,
              0.0,
              "alloc"
            ],
            [
              ".rela__mcount_loc",
              83800,
              216,
              1.3,
              "info_link"
            ],
            [
              ".init.text",
              8888,
              111,
              3.44,
              "alloc,executable"
            ],
            [
              ".rela.init.text",
              84016,
              264,
              1.99,
              "info_link"
            ],
            [
              ".exit.text",
              9000,
              42,
              2.7,
              "alloc,executable"
            ],
            [
              ".rela.exit.text",
              84280,
              72,
              1.94,
              "info_link"
            ],
            [
              ".modinfo",
              9042,
              456,
              5.16,
              "alloc"
            ],
            [
              ".exit.data",
              9504,
              8,
              0.0,
              "write,alloc"
            ],
            [
              ".rela.exit.data",
              84352,
              24,
              0.5,
              "info_link"
            ],
            [
              ".init.data",
              9512,
              8,
              0.0,
              "write,alloc"
            ],
            [
              ".rela.init.data",
              84376,
              24,
              0.5,
              "info_link"
            ],
            [
              "__dyndbg",
              9520,
              616,
              0.36,
              "write,alloc"
            ],
            [
              ".rela__dyndbg",
              84400,
              1056,
              1.52,
              "info_link"
            ],
            [
              "__param",
              10136,
              40,
              0.17,
              "alloc"
            ],
            [
              ".rela__param",
              85456,
              96,
              1.05,
              "info_link"
            ],
            [
              ".comment",
              10176,
              117,
              4.05,
              "merge,strings"
            ],
            [
              ".return_sites",
              10293,
              52,
              0.0,
              "alloc"
            ],
            [
              ".rela.return_sites",
              85552,
              312,
              1.47,
              "info_link"
            ],
            [
              ".call_sites",
              10345,
              292,
              0.0,
              "alloc"
            ],
            [
              ".rela.call_sites",
              85864,
              1752,
              1.75,
              "info_link"
            ],
            [
              ".note.gnu.build-id",
              10640,
              36,
              4.19,
              "alloc"
            ],
            [
              ".note.package",
              10676,
              108,
              4.73,
              "alloc"
            ],
            [
              "__version_ext_names",
              10784,
              475,
              4.47,
              "alloc"
            ],
            [
              "__version_ext_crcs",
              11264,
              104,
              6.01,
              "alloc"
            ],
            [
              "__versions",
              11368,
              1664,
              2.67,
              "alloc"
            ],
            [
              ".gnu.linkonce.this_module",
              13032,
              1280,
              0.11,
              "write,alloc"
            ],
            [
              ".rela.gnu.linkonce.this_module",
              87616,
              48,
              1.05,
              "info_link"
            ],
            [
              ".note.Linux",
              14312,
              48,
              1.97,
              "alloc"
            ],
            [
              ".BTF",
              14360,
              57869,
              5.19,
              ""
            ],
            [
              ".symtab",
              72232,
              2928,
              2.01,
              ""
            ],
            [
              ".strtab",
              75160,
              2012,
              4.78,
              ""
            ],
            [
              ".shstrtab",
              87664,
              429,
              4.32,
              ""
            ]
          ],
          "metrics": {
            "elf": {
              "bits": 64.0,
              "entry": 0.0,
              "has_got": 0.0,
              "has_plt": 0.0,
              "has_note": 1.0,
              "has_symtab": 1.0,
              "note_count": 3.0,
              "nx_enabled": 1.0,
              "dynrel_count": 0.0,
              "dynsym_count": 0.0,
              "has_eh_frame": 0.0,
              "stack_canary": 1.0,
              "symtab_count": 122.0,
              "dynrela_count": 0.0,
              "little_endian": 1.0,
              "pltreloc_count": 0.0,
              "executable_stack": 0.0,
              "wx_segment_count": 0.0,
              "comment_entry_count": 3.0,
              "program_header_count": 0.0,
              "comment_distinct_count": 1.0,
              "gnu_stack_section_absent": 0.0,
              "load_segment_max_file_size": 0.0,
              "stripped_but_symtab_present": 1.0,
              "load_segment_max_memory_size": 0.0,
              "section_relocation_group_count": 15.0,
              "stripped_metadata_section_count": 5.0
            },
            "file": {
              "size": 91697.0,
              "entropy": 4.65,
              "size_bytes": 91697.0
            },
            "binary": {
              "is_pie": 0.0,
              "has_overlay": 1.0,
              "is_stripped": 0.0,
              "code_entropy": 4.66,
              "data_entropy": 0.58,
              "overlay_size": 3604.0,
              "string_count": 1381.0,
              "overlay_ratio": 0.04,
              "avg_complexity": 1.72,
              "max_complexity": 13.0,
              "huge_func_count": 0.0,
              "leaf_func_count": 12.0,
              "overall_entropy": 4.65,
              "overlay_entropy": 3.13,
              "tiny_func_count": 19.0,
              "avg_basic_blocks": 3.45,
              "entropy_variance": 3.27,
              "avg_string_length": 17.54,
              "max_string_length": 90.0,
              "peak_region_bytes": 561.0,
              "code_to_data_ratio": 0.35,
              "total_basic_blocks": 100.0,
              "peak_region_entropy": 7.58,
              "string_length_stddev": 8.91,
              "largest_section_ratio": 0.63,
              "sentence_string_count": 24.0,
              "sentence_string_ratio": 0.02,
              "high_entropy_string_count": 0.0
            },
            "exports": {
              "count": 5.0
            },
            "imports": {
              "count": 25.0
            },
            "sections": {
              "count": 45.0,
              "code_size": 3082.0,
              "entropy_max": 6.01,
              "entropy_mean": 2.09,
              "name_entropy": 4.25,
              "writable_count": 8.0,
              "executable_count": 3.0,
              "nonstandard_count": 37.0,
              "executable_writable_count": 0.0
            },
            "functions": {
              "count": 29.0
            },
            "dependencies": {
              "count": 0.0
            }
          }
        },
        "id": 1,
        "mol": "O₂(AsC)",
        "path": "hexium_gemini.ko.zst!!hexium_gemini.ko",
        "risk": 3,
        "sha": "6f3cf916ca2b7b35c05391db7ecd3115bbf3d0bee5fbedad3fd56dd2754658ff",
        "size": 91697,
        "traits": [
          {
            "id": "metadata/build/artifact::elf-stripped-but-symtab-present",
            "conf": 0.6000000238418579,
            "crit": 3,
            "desc": "ELF stripped with .symtab present",
            "spans": [
              [
                0,
                38
              ]
            ]
          },
          {
            "id": "objectives/anti-static/obfuscation/payload/code-in-data::nop-sled-in-data",
            "conf": 0.6499999761581421,
            "crit": 3,
            "desc": "Repeated NOP-run pattern in executable section",
            "spans": [
              [
                320,
                47
              ]
            ]
          },
          {
            "id": "metadata/package/license::gpl-word",
            "conf": 0.699999988079071,
            "crit": 2,
            "desc": "GPL license reference",
            "spans": [
              [
                9050,
                3
              ]
            ]
          },
          {
            "id": "objectives/command-and-control/backdoor/keywords::grabber-word",
            "conf": 0.75,
            "crit": 3,
            "desc": "Infostealer 'grabber' slang term",
            "spans": [
              [
                7797,
                7
              ]
            ]
          },
          {
            "id": "objectives/command-and-control/backdoor/keywords::suspicious-repo-name-a",
            "conf": 0.75,
            "crit": 3,
            "desc": "Suspicious repository name keywords",
            "spans": [
              [
                7797,
                7
              ]
            ]
          }
        ],
        "type": "elf"
      }
    ],
    "v": "8"
  }
}