{ "ml": { "v": "7", "eng": "2.2.0-beta.1", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.021059126, "rte": "az", "prob": 0.021059126 } ], "prob": 0.021059126, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.021059125661849976, "type": "apk_alpine" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.000053068000852363184, "type": "elf" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.000011821587577287573, "type": "shell" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.000018964210539706983, "type": "python" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.000007202228061942151, "type": "shell" }, { "id": 5, "lvl": -1, "conf": 0, "prob": 0.000010271866813127417, "type": "text" } ], "version": "v18.18", "analyzed_at": "2026-06-26T09:29:40Z" }, "path": "kamailio-dbtext-6.0.6-r0.apk", "raw": { "files": [ { "id": 0, "ctx": [ { "b": "abZy8000000T3{24[J!\u003enkh=HeH]u63?!Yp^*DIa!jX1m:JNrco?u{f=2H?Deg@xa3GU*X", "n": [ { "c": 2, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "o": 0, "z": 1, "cf": 1.0 } ], "ln": 0 } ], "mol": "H(F₄)Md(He)", "sha": "99485a35a3f5d71ef27567c8e3237b021b8173c8fd131bc0579760cd18f6a21d", "path": "kamailio-dbtext-6.0.6-r0.apk", "risk": 4, "size": 102971, "type": "apk_alpine", "facts": { "metrics": { "file": { "size": 102971.0, "entropy": 7.99, "size_bytes": 102971.0 }, "parse": { "error_count": 1.0 }, "binary": { "overall_entropy": 7.99, "peak_region_bytes": 102971.0, "peak_region_entropy": 7.85 } } }, "traits": [ { "id": "micro-behaviors/fs/directory/delete::rm-rf", "atk": "T1070.004", "mbc": "C0047", "conf": 0.800000011920929, "crit": 3, "desc": "rm -rf shell command", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/dylib/library/libc::libc-internal-functions-b", "conf": 0.699999988079071, "crit": 2, "desc": "libc internal symbols cluster B", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/dylib/library/family::cxx-abi-symbols", "conf": 0.800000011920929, "crit": 2, "desc": "C++ ABI symbols", "from": [ { "file": 1 } ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-package-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package name field", "from": [ { "file": 5 } ] }, { "id": "metadata/hardening/missing::stripped-binary", "conf": 0.800000011920929, "crit": 3, "desc": "No full symbol table (likely stripped)", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/dylib/library/libc::libc-characteristic-cxa-finalize", "crit": 2, "desc": "libc characteristic cxa finalize", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/directory/traverse::rm-rf-cmd", "conf": 0.6000000238418579, "crit": 2, "desc": "rm -rf command", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/fs/file/stat::stat-core", "conf": 0.800000011920929, "crit": 3, "desc": "Read file status and metadata (core)", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/file/copy::shutil-copy", "conf": 0.800000011920929, "crit": 3, "desc": "Copies a file (shutil.copy)", "from": [ { "file": 3 } ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-version-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package version field", "from": [ { "file": 5 } ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-basename", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package info file" }, { "id": "micro-behaviors/dylib/library/abi-graphics::cxx-abi-symbols-a", "conf": 0.800000011920929, "crit": 2, "desc": "C++ ABI symbols cluster A", "from": [ { "file": 1 } ] }, { "id": "objectives/impact/destroy/keywords::cleanup-verb--clean", "conf": 0.8799999952316284, "crit": 1, "desc": "Cleanup/action word: clean", "from": [ { "file": 3 } ] }, { "id": "objectives/execution/interpreter/eval/invoke::eval-call-python", "atk": "T1059", "mbc": "E1059", "conf": 0.4000000059604645, "crit": 3, "desc": "eval() call (Python)", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/fs/directory/readdir::readdir-closedir", "conf": 0.6600000262260437, "crit": 2, "desc": "Uses closedir", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/db/sql::sql-delete", "crit": 3, "desc": "DELETE FROM SQL keyword", "from": [ { "file": 1 } ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-origin-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package origin field", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/fs/directory/readdir::readdir-opendir", "conf": 0.6600000262260437, "crit": 2, "desc": "Uses opendir", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/file/open::fopen", "conf": 0.6600000262260437, "crit": 3, "desc": "Open files", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/db/sql::sql-select", "conf": 0.6000000238418579, "crit": 3, "desc": "SELECT SQL keyword in query", "from": [ { "file": 3 } ] }, { "id": "well-known/tool/detection/security-scanner::dangerous-query-keyword-denylist", "conf": 0.9200000166893005, "crit": 1, "desc": "Defensive dangerous query-keyword denylist", "from": [ { "file": 3 } ] } ] }, { "ctx": [ { "b": "E))420S-r400000000000@$H+0rr910000000000kMy=:00000sD-^^0000000000kMA+z3JJA(7xtiJ0rr911o", "n": [ { "c": 3, "d": "Strips toolchain banner but retains build-id", "i": "metadata/build/artifact::aggressive-strip", "o": 0, "z": 1, "cf": 1.0 } ], "ln": 0 }, { "b": "A-t+2y\u0026si5raflLwDl7Av%zA?w[=c\u003ey?Xib0af8zwPzu{x(!xcA:JB0vqPN.x(mK30af8NwOkZ#", "n": [ { "c": 2, "d": "Benign dual-mode socket exec context", "i": "objectives/command-and-control/reverse-shell/dup::unix-dual-mode-socket-exec-benign-context", "o": 5887, "z": 12, "cf": 0.949999988079071 } ], "ln": 5871 }, { "b": "uT)IOxK$K\u0026A+PAkg5$V*B97\u00262yHpN+yHpWZx(0=WvSU%!vpJ$ZuU0.?BAhqB0afnCByeM\u0026y?W-[B94", "n": [ { "c": 3, "d": "Stack protector/canary enabled", "i": "metadata/hardening/build::stack-protector", "o": 6149, "z": 14, "cf": 0.8999999761581421 } ], "ln": 6133 }, { "b": "wNxaZvpS}\u00260a]?VB-Ri@w]?J{yI%h-vSU%@A+PAkuVYZ=y?l%]z*bM1CMqt=y\u0026sxa0aV", "n": [ { "c": 2, "d": "Seeks to position in file", "i": "micro-behaviors/fs/file/binary::fseek-func", "o": 6324, "z": 6, "cf": 0.4000000059604645 } ], "ln": 6308 }, { "b": "uV]\u003c]0aYLXuT)+Xv@2B*BzkP60crl\u003cBo2\u0026XBye\u003c5vpS.Sx(4tXw]zT1zuaiRByfb#vR/Q.zE[1(w[LW%v/Q4GByfb#vR/Q.v/", "n": [ { "c": 4, "d": "Sets LD_PRELOAD hooks to hide filesystem", "i": "objectives/evasion/kernel-hide/userspace::preload-rootkit-hook-set", "o": 7270, "z": 5, "cf": 0.9200000166893005 }, { "c": 3, "d": "Read file status and metadata (core)", "i": "micro-behaviors/fs/file/stat::stat-core", "o": 7251, "z": 4, "cf": 0.800000011920929 }, { "c": 2, "d": "Get current calendar time (seconds)", "i": "micro-behaviors/time/query::time", "o": 7246, "z": 4, "cf": 0.30000001192092896 } ], "ln": 7230 }, { "b": "wN$\u003c.ByYrjBo2](B-.W8w]I)mv/Q4GByf0cx(n31BywS{wNxE@Ck#e.Byf0cx(n31Bn", "n": [ { "c": 2, "d": "Write single bytes to file", "i": "micro-behaviors/fs/file/write/direct::fputc", "o": 7344, "z": 5, "cf": 0.6600000262260437 } ], "ln": 7328 }, { "b": "wmxT/v@DgazeJY)A+e!Zz/xo9wnc5:v@c78wN]H}0bMvUv\u003eIRvB8iBMi5Ub4g+J\u0026/e?)upvQBj*CYUMVzVzCkB8\u0026{Ix\u003c@-hvqPB!yY", "n": [ { "c": 3, "d": "Architecture detection strings", "i": "objectives/discovery/host/software::arch-detection", "o": 8098, "z": 6, "cf": 0.5 }, { "c": 2, "d": "Uses closedir", "i": "micro-behaviors/fs/directory/readdir::readdir-closedir", "o": 8079, "z": 8, "cf": 0.6600000262260437 }, { "c": 2, "d": "Uses opendir", "i": "micro-behaviors/fs/directory/readdir::readdir-opendir", "o": 8071, "z": 7, "cf": 0.6600000262260437 } ], "ln": 8055 }, { "b": "uRS)-r8Lm\u0026rz#s[l@N5(lqgfxoh4]Qr4Gd.k#{AYqBKIWoJCH#mn\u003e-Wr7{j$p/G$-ml%sGo-", "n": [ { "c": 1, "d": "Benign context: deny/block-list word", "i": "objectives/credential-access/shell/history::shell-history-unless-cond-1--rx-3", "o": 140111, "z": 9, "cf": 0.30000001192092896 } ], "ln": 140095 }, { "b": "yHI6*x(4H4at$\u0026ae\u0026B?2CSmP*hz^6Xx(n6rdf9)/uVY\u003e7BrB^#vSU%=Aa{}miX-PNt@?", "n": [ { "c": 2, "d": "x86_64 architecture string", "i": "micro-behaviors/os/sysinfo/platform/string::arch-x86-64", "o": 140180, "z": 6, "cf": 0.30000001192092896 } ], "ln": 140164 }, { "b": "B7DFdB0bNyzY\u0026\u003emzF6pRfj/lnfkC0kvqfK(z.z93vQBj*CYU6jwmxT/vQTs?e[l}4hu", "n": [ { "c": 2, "d": "Reference to /etc configuration files", "i": "micro-behaviors/fs/path/config/system::config-etc", "o": 141779, "z": 5, "cf": 0.6600000262260437 } ], "ln": 141763 }, { "b": "c37wNc39Wbx(4u\u003eaARJAwmYN*By=ObA=k!qBywS{wG.xXwmw[/wQ5qttv.h+uT^C+wIdENhzNe", "n": [ { "c": 3, "d": "DELETE FROM SQL keyword", "i": "micro-behaviors/data/db/sql::sql-delete", "o": 143798, "z": 11, "cf": 0.5 } ], "ln": 143782 }, { "b": "diG{TiV].3dSV[Sc37wNzddi\u003eay/k0vqWj}03zWS4g9y[07omOlJxzJlJyUauVY\u003e7BrB^#vSR", "n": [ { "c": 1, "d": "Make install clean command", "i": "micro-behaviors/fs/build-artifacts::make-install-clean-command", "o": 149713, "z": 10, "cf": 1.0 } ], "ln": 149697 }, { "b": "00000000000000000000wmw[/wQ5qHB8JWwwNY^{00000x2*@T04@taB98CAvpxi?zF%Sde[Y6Ae]U\u0026H", "n": [ { "c": 2, "d": ".gnu_debuglink reference present", "i": "metadata/build/debug::elf-debuglink", "o": 168544, "z": 16, "cf": 1.0 } ], "ln": 168528 }, { "b": "y?bbiwb[k{zGNNBvrl8Ze[xlBB9RQ5e[xlBB98B5e]\u003eJtvj(8ozu8qfwO=xtwo\u00264)e[]iqBo0}nwQ5p", "n": [ { "c": 2, "d": "ELF dynstr section name", "i": "metadata/binary/linking/static::elf-dynstr-section-name", "o": 168635, "z": 7, "cf": 0.8999999761581421 }, { "c": 2, "d": "ELF dynsym section name", "i": "metadata/binary/linking/static::elf-dynsym-section-name", "o": 168627, "z": 7, "cf": 0.8999999761581421 } ], "ln": 168611 }, { "b": "vr?\u00269wmoN*e]\u003eJte]\u003e\u003ege[xlBvqPZ*04}]5Bo0}7vrt]Te[e)y04}]4BZFV\u003cvS=s1x(mX^", "n": [ { "c": 2, "d": "ELF dynamic section name", "i": "metadata/binary/linking/static::elf-dynamic-section-name", "o": 168750, "z": 8, "cf": 0.8999999761581421 } ], "ln": 168734 } ], "depth": 1, "facts": { "exp": [ [ "dbt_row_new" ], [ "dbt_table_update_flags" ], [ "dbt_update" ], [ "dbt_free_result" ], [ "dbt_bind_api" ], [ "dbt_table_add_row" ], [ "dbt_cache_print2" ], [ "dbt_default_connection" ], [ "db_text_read_buffer_size" ], [ "dbt_affected_rows" ], [ "db_mode" ], [ "exports" ], [ "dbt_load_file" ], [ "dbt_result_new" ], [ "dbt_table_free_rows" ], [ "dbt_print_table" ], [ "dbt_is_neq_type" ], [ "dbt_db_get_temp_table" ], [ "dbt_qsort_compare_temp" ], [ "dbt_init" ], [ "dbt_cache_get_db" ], [ "dbt_raw_query_update" ], [ "dbt_query" ], [ "dbt_get_refs" ], [ "module_interface_ver" ], [ "dbt_result_add_row" ], [ "dbt_print_table_rows" ], [ "dbt_delete" ], [ "dbt_column_free" ], [ "dbt_row_set_val" ], [ "module_version" ], [ "db_text_max_result_rows" ], [ "dbt_insert" ], [ "dbt_init_result" ], [ "mod_register" ], [ "fini" ], [ "dbt_table_free" ], [ "dbt_release_table" ], [ "module_flags" ], [ "dbt_build_where" ], [ "dbt_row_match" ], [ "dbt_use_table" ], [ "dbt_qsort_compar" ], [ "dbt_row_update_val" ], [ "dbt_table_new" ], [ "dbt_result_free" ], [ "dbt_sort_o_op" ], [ "dbt_fetch_result" ], [ "dbt_delim" ], [ "dbt_str_split" ], [ "dbt_is_database" ], [ "dbt_column_new" ], [ "empty_string" ], [ "dbt_raw_query_select" ], [ "dbt_raw_query_delete" ], [ "dbt_cache_destroy" ], [ "dbt_delim_str" ], [ "dbt_cache_print" ], [ "dbt_row_free" ], [ "log_regerror" ], [ "dbt_db_del_table" ], [ "dbt_sort_dres" ], [ "dbt_check_mtime" ], [ "dbt_mangle_columnselection" ], [ "dbt_close" ], [ "dbt_sort_jmpenv" ], [ "dbt_get_result" ], [ "dbt_result_extract_results" ], [ "dbt_clean_where" ], [ "dbt_print_table_row" ], [ "dbt_print_table_header" ], [ "dbt_init_cache" ], [ "init" ], [ "dbt_cmp_val" ], [ "dbt_raw_query_replace" ], [ "dbt_replace" ], [ "dbt_trim" ], [ "dbt_result_new_row" ], [ "dbt_project_result" ], [ "dbt_sort_result" ], [ "dbt_result_print" ], [ "dbt_sort_o_l" ], [ "dbt_sort_o_n" ], [ "dbt_table_check_row" ], [ "dbt_parse_orderbyclause" ], [ "dbt_raw_query_insert" ], [ "dbt_result_extract_fields" ], [ "dbt_get_next_result" ], [ "dbt_cache_check_db" ], [ "dbt_db_get_table" ], [ "dbt_print_table_content" ], [ "dbt_sort_result_temp" ], [ "dbt_print_table_row_ex" ], [ "dbt_raw_query" ] ], "imp": [ [ "", "longjmp" ], [ "", "strcpy" ], [ "", "setjmp" ], [ "", "stdout" ], [ "", "snprintf" ], [ "", "syscall" ], [ "", "process_no" ], [ "", "km_log_func" ], [ "", "qsort" ], [ "", "cxa_finalize" ], [ "", "shm_root" ], [ "", "dprint_color_reset" ], [ "", "open_memstream" ], [ "", "db_api_init" ], [ "", "get_debug_facility" ], [ "", "fflush" ], [ "", "strncasecmp" ], [ "", "log_level_info" ], [ "", "stack_chk_fail" ], [ "", "dprint_color" ], [ "", "fprintf" ], [ "", "deregister_frame_info" ], [ "", "log_prefix_val" ], [ "", "fseeko" ], [ "", "ITM_registerTMCloneTable" ], [ "", "db_free_rows" ], [ "", "strcasestr" ], [ "", "rpc_register_array" ], [ "", "strncpy" ], [ "", "my_pid" ], [ "", "strtok" ], [ "", "ITM_deregisterTMCloneTable" ], [ "", "regcomp" ], [ "", "fopen" ], [ "", "db_allocate_row" ], [ "", "db_allocate_columns" ], [ "", "dprint_crit" ], [ "", "ksr_is_main" ], [ "", "fclose" ], [ "", "regexec" ], [ "", "time" ], [ "", "opendir" ], [ "", "db_use_table" ], [ "", "fgetc" ], [ "", "regerror" ], [ "", "stderr" ], [ "", "fputc" ], [ "", "get_debug_level" ], [ "", "stat" ], [ "", "log_stderr" ], [ "", "ksr_slog_func" ], [ "", "db_free_result" ], [ "", "atoi" ], [ "", "db_allocate_rows" ], [ "", "db_free_columns" ], [ "", "regfree" ], [ "", "fputs" ], [ "", "log_color" ], [ "", "closedir" ], [ "", "db_new_result" ], [ "", "pkg_root" ], [ "", "register_frame_info" ], [ "", "strpbrk" ], [ "", "free" ] ], "sec": [ [ ".note.gnu.property", 680, 48, 1.94, "alloc" ], [ ".note.gnu.build-id", 728, 36, 4.14, "alloc" ], [ ".gnu.hash", 768, 1216, 4.24, "alloc" ], [ ".dynsym", 1984, 3840, 2.34, "alloc" ], [ ".dynstr", 5824, 2315, 4.32, "alloc" ], [ ".rela.dyn", 8144, 3576, 1.8, "alloc" ], [ ".relr.dyn", 11720, 40, 2.55, "alloc" ], [ ".init", 12288, 3, 1.58, "alloc,executable" ], [ ".text", 12304, 123021, 6.17, "alloc,executable" ], [ ".fini", 135325, 3, 1.58, "alloc,executable" ], [ ".rodata", 139264, 12527, 5.22, "alloc" ], [ ".eh_frame_hdr", 151792, 692, 5.32, "alloc" ], [ ".eh_frame", 152488, 12432, 5.35, "alloc" ], [ ".init_array", 166104, 8, 1.06, "write,alloc" ], [ ".fini_array", 166112, 8, 1.06, "write,alloc" ], [ ".data.rel.ro", 166120, 208, 2.06, "write,alloc" ], [ ".dynamic", 166328, 448, 1.35, "write,alloc" ], [ ".got", 166776, 1160, 0.03, "write,alloc" ], [ ".data", 167936, 608, 1.11, "write,alloc" ], [ ".gnu_debuglink", 168544, 24, 3.83, "" ], [ ".shstrtab", 168568, 222, 4.19, "" ] ], "metrics": { "elf": { "bits": 64.0, "entry": 0.0, "has_got": 1.0, "has_plt": 0.0, "has_note": 1.0, "note_count": 2.0, "nx_enabled": 1.0, "has_dt_relr": 1.0, "has_runpath": 1.0, "dynrel_count": 0.0, "dynsym_count": 160.0, "has_build_id": 1.0, "has_eh_frame": 1.0, "has_gnu_hash": 1.0, "stack_canary": 1.0, "symtab_count": 0.0, "dynrela_count": 149.0, "has_debuglink": 1.0, "little_endian": 1.0, "dt_flags_1_raw": 1.0, "pltreloc_count": 0.0, "build_id_length": 20.0, "executable_stack": 0.0, "fini_array_count": 1.0, "init_array_count": 1.0, "wx_segment_count": 0.0, "program_header_count": 11.0, "gnu_stack_section_absent": 0.0, "load_segment_max_file_size": 123040.0, "stripped_but_symtab_present": 0.0, "load_segment_max_memory_size": 123040.0, "section_relocation_group_count": 1.0, "stripped_metadata_section_count": 8.0 }, "file": { "size": 170264.0, "entropy": 6.08, "size_bytes": 170264.0 }, "binary": { "is_pie": 0.0, "has_overlay": 1.0, "is_stripped": 1.0, "code_entropy": 6.17, "data_entropy": 0.72, "overlay_size": 1474.0, "string_count": 536.0, "overlay_ratio": 0.01, "overall_entropy": 6.08, "overlay_entropy": 1.47, "entropy_variance": 3.0, "avg_string_length": 23.81, "max_string_length": 293.0, "peak_region_bytes": 100352.0, "code_to_data_ratio": 0.98, "peak_region_entropy": 6.27, "string_length_stddev": 19.68, "largest_section_ratio": 0.72, "sentence_string_count": 116.0, "sentence_string_ratio": 0.22, "high_entropy_string_count": 0.0 }, "exports": { "count": 95.0 }, "imports": { "count": 64.0 }, "sections": { "count": 23.0, "code_size": 123027.0, "entropy_max": 6.17, "entropy_mean": 2.92, "name_entropy": 4.14, "writable_count": 7.0, "executable_count": 3.0, "nonstandard_count": 6.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } } }, "id": 1, "mol": "H(F₂)Md(He)", "path": "kamailio-dbtext-6.0.6-r0.apk!!usr/lib/kamailio/modules/db_text.so", "risk": 3, "sha": "b143827153d7427e01d1b2686494751777b66d2512264dcdd901369ef058db83", "size": 170264, "traits": [ { "id": "micro-behaviors/fs/directory/readdir::readdir-opendir", "conf": 0.6600000262260437, "crit": 2, "desc": "Uses opendir", "spans": [ [ 8071, 7 ] ] }, { "id": "micro-behaviors/fs/file/open::fopen", "conf": 0.6600000262260437, "crit": 3, "desc": "Open files", "spans": [ [ 7270, 5 ] ] }, { "id": "micro-behaviors/data/db/sql::sql-delete", "crit": 3, "desc": "DELETE FROM SQL keyword", "spans": [ [ 143798, 11 ] ] }, { "id": "micro-behaviors/fs/directory/readdir::readdir-closedir", "conf": 0.6600000262260437, "crit": 2, "desc": "Uses closedir", "spans": [ [ 8079, 8 ] ] }, { "id": "micro-behaviors/dylib/library/libc::libc-characteristic-cxa-finalize", "crit": 2, "desc": "libc characteristic cxa finalize", "spans": [ [ 5887, 12 ] ] }, { "id": "micro-behaviors/fs/file/stat::stat-core", "conf": 0.800000011920929, "crit": 3, "desc": "Read file status and metadata (core)", "spans": [ [ 7251, 4 ] ] }, { "id": "metadata/hardening/missing::stripped-binary", "conf": 0.800000011920929, "crit": 3, "desc": "No full symbol table (likely stripped)", "spans": [ [ 0, 25 ] ] }, { "id": "micro-behaviors/dylib/library/libc::libc-internal-functions-b", "conf": 0.699999988079071, "crit": 2, "desc": "libc internal symbols cluster B", "spans": [ [ 5887, 12 ] ] }, { "id": "micro-behaviors/dylib/library/abi-graphics::cxx-abi-symbols-a", "conf": 0.800000011920929, "crit": 2, "desc": "C++ ABI symbols cluster A", "spans": [ [ 5887, 12 ] ] }, { "id": "micro-behaviors/dylib/library/family::cxx-abi-symbols", "conf": 0.800000011920929, "crit": 2, "desc": "C++ ABI symbols", "spans": [ [ 5887, 12 ] ] } ], "type": "elf" }, { "ctx": [ { "b": "bl", "n": [ { "c": 2, "d": "Several local variable assignments", "i": "metadata/file/metrics::shell-multiple-local-assignments", "o": 0, "z": 18, "cf": 0.6000000238418579 } ], "ln": 1, "addr": 0 }, { "b": "boP]{A+PGmazbLjayO!\u003ex(mMavqYP#wo8QcAa%i5awlcWvqfK(zY?Cmr7f[*aAR43y?mU", "ln": 2, "addr": 2 }, { "b": "bl", "ln": 3, "addr": 58 }, { "b": "", "ln": 32, "addr": 800 }, { "b": "ze0)1zY*k(lr3xQr3i!Ce*a.Cvrld2xcpS0y-)t7y?mVgvrsKMbT:$ap^F5Ka]", "ln": 33, "addr": 801 }, { "b": "A+#{JA+lBtl{+lSk#Zw", "n": [ { "c": 3, "d": "Shell execution capability", "i": "objectives/impact/wipe/disk/mass-delete::shell-exec-capability", "o": 851, "z": 6, "cf": 1.0 } ], "ln": 34, "addr": 851 }, { "b": "Ee", "ln": 35, "addr": 867 }, { "b": "", "ln": 36, "addr": 869 } ], "depth": 1, "facts": { "imp": [ [ "", "merr" ], [ "", "merr" ], [ "", "exit" ], [ "", "exit" ], [ "", "minfo" ], [ "", "minfo" ], [ "", "rm" ], [ "", "rm" ], [ "", "merr" ], [ "", "merr" ], [ "", "exit" ], [ "", "exit" ], [ "", "minfo" ], [ "", "minfo" ], [ "", "mkdir" ], [ "", "mkdir" ], [ "", "mdbg" ], [ "", "mdbg" ], [ "", "cp" ], [ "", "cp" ], [ "", "merr" ], [ "", "merr" ], [ "", "exit" ], [ "", "exit" ], [ "", "get_answer" ], [ "", "get_answer" ], [ "", "presence_create" ], [ "", "presence_create" ], [ "", "get_answer" ], [ "", "get_answer" ], [ "", "extra_create" ], [ "", "extra_create" ], [ "", "merr" ], [ "", "merr" ], [ "", "exit" ], [ "", "exit" ], [ "", "minfo" ], [ "", "minfo" ], [ "", "mkdir" ], [ "", "mkdir" ], [ "", "mdbg" ], [ "", "mdbg" ], [ "", "cp" ], [ "", "cp" ], [ "", "merr" ], [ "", "merr" ], [ "", "exit" ], [ "", "exit" ], [ "", "merr" ], [ "", "merr" ], [ "", "exit" ], [ "", "exit" ], [ "", "minfo" ], [ "", "minfo" ], [ "", "mdbg" ], [ "", "mdbg" ], [ "", "cp" ], [ "", "cp" ], [ "", "merr" ], [ "", "merr" ], [ "", "exit" ], [ "", "exit" ] ], "tgt": [ "cp", "exit", "extra_create", "get_answer", "mdbg", "merr", "minfo", "mkdir", "presence_create", "rm" ], "metrics": { "ast": { "op.ne": 7.0, "max_depth": 9.0, "bind_count": 7.0, "call_count": 31.0, "node_count": 565.0, "op_density.ne": 0.01, "identifier_count": 27.0, "string_literal_count": 26.0 }, "file": { "size": 2410.0, "entropy": 5.21, "size_bytes": 2410.0 }, "text": { "tab_count": 19.0, "digit_ratio": 0.03, "space_count": 341.0, "total_lines": 113.0, "char_entropy": 5.21, "mixed_indent": 1.0, "unique_chars": 76.0, "string_density": 0.23, "avg_line_length": 20.33, "max_line_length": 92.0, "empty_line_ratio": 0.2, "last_line_length": 21.0, "whitespace_ratio": 0.2, "most_common_ratio": 0.07, "identifier_density": 1.09, "line_length_stddev": 21.97, "normalized_string_count": 2.45, "repeated_char_sequences": 1.0, "suspicious_string_ratio": 0.15, "most_common_char_is_null": 0.0, "suspicious_comment_ratio": 0.1, "max_inline_whitespace_run": 13.0, "most_common_char_codepoint": 101.0, "normalized_unique_identifiers": 3.96 }, "binds": { "count": 7.0 }, "calls": { "count": 31.0 }, "binary": { "overall_entropy": 5.21, "peak_region_bytes": 2410.0, "peak_region_entropy": 5.17 }, "source": { "function_count": 4.0 }, "strings": { "total": 26.0, "avg_length": 28.27, "max_length": 50.0, "path_count": 3.0, "avg_entropy": 3.61, "total_bytes": 735.0, "entropy_stddev": 1.14, "embedded_code_candidates": 4.0 }, "comments": { "chars": 607.0, "lines": 18.0, "total": 21.0, "to_code_ratio": 0.19, "empty_comments": 3.0, "high_entropy_comments": 2.0 }, "functions": { "count": 4.0, "avg_params": 5.25, "max_params": 9.0, "length_stddev": 7.23, "avg_name_length": 13.75, "avg_length_lines": 21.5, "max_length_lines": 32.0, "min_length_lines": 12.0, "many_params_count": 1.0, "avg_param_name_length": 53.0, "density_per_100_lines": 3.54, "code_in_functions_ratio": 0.76 }, "consistency": { "extension_content_mismatch": 1.0, "extension_content_mismatch.script_as_unknown": 1.0 }, "identifiers": { "count": 27.0, "total": 123.0, "avg_length": 8.56, "max_length": 23.0, "min_length": 1.0, "avg_entropy": 2.34, "reuse_ratio": 0.22, "unique_count": 27.0, "length_stddev": 5.95, "has_digit_ratio": 0.04, "single_char_count": 2.0, "single_char_ratio": 0.07, "high_entropy_count": 1.0, "high_entropy_ratio": 0.04, "all_lowercase_ratio": 0.44, "all_uppercase_ratio": 0.41 } } }, "id": 2, "mol": "H(F)", "path": "kamailio-dbtext-6.0.6-r0.apk!!usr/lib/kamailio/kamctl/kamdbctl.dbtext", "risk": 1, "sha": "3c217d972b16d6351c0eb4c6d6a5582834e703c4ce0e1b80f3e42af16c14bced", "size": 2410, "traits": [ { "id": "micro-behaviors/fs/directory/traverse::rm-rf-cmd", "conf": 0.6000000238418579, "crit": 2, "desc": "rm -rf command", "spans": [ [ 851, 6 ] ] }, { "id": "micro-behaviors/fs/directory/delete::rm-rf", "atk": "T1070.004", "mbc": "C0047", "conf": 0.800000011920929, "crit": 3, "desc": "rm -rf shell command", "spans": [ [ 851, 6 ] ] } ], "type": "shell" }, { "ctx": [ { "b": "boXZ.B8\u0026{yx(kOyD30.rzzI", "n": [ { "c": 2, "d": "Python file extension", "i": "metadata/file/extension/identity::py", "o": 0, "z": 11, "cf": 1.0 } ], "ln": 1, "addr": 0 }, { "b": "bl", "ln": 2, "addr": 19 }, { "b": "boPu(AcVFrxj#xfgb7ywav*u*xkzc4nP52\u003cavf*Waw#]^xMOqrqE%]XA=#28e=", "n": [ { "c": 2, "d": "Copyright notice", "i": "metadata/package/license::copyright-word", "o": 23, "z": 9, "cf": 0.6000000238418579 } ], "ln": 3, "addr": 21 }, { "b": "", "ln": 4, "addr": 71 }, { "b": "a%Fjfqa@MTx\u003e}o5vpJ!UB8@Euvr(B8azbLjay[@6wQ5qH", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 97, "z": 3, "cf": 0.800000011920929 } ], "ln": 5, "addr": 72 }, { "b": "", "ln": 6, "addr": 109 }, { "b": "ra]#!az(4cB.\u003eRiAb](ux\u003eg^@aARpdazkIkwGUP6AV/dazdvW7aARJAx(n37A:-E1aA}KwxDQ?{By/Ysazbt7wPE", "ln": 7, "addr": 110 }, { "b": "x(d*cA=-BBxMXAhyY", "ln": 14, "addr": 280 }, { "b": "x(d*cA=-BBD2\u0026", "ln": 15, "addr": 294 }, { "b": "x(d*cA=-BCwO(x#x(4t", "n": [ { "c": 2, "d": "Reference to tempfile module", "i": "micro-behaviors/fs/temp/reference::tempfile-ref", "o": 312, "z": 8, "cf": 0.699999988079071 } ], "ln": 16, "addr": 305 }, { "b": "x(d*cA=-BCx(dz", "ln": 17, "addr": 321 }, { "b": "", "ln": 18, "addr": 333 }, { "b": "uTEk:BzbPkuTB{sasy\u0026lA=2l5kXC1Nxkzciv@Dibc}E]\u0026zddr8q!P-.wO(12D1zdFcJ", "ln": 19, "addr": 334 }, { "b": "", "ln": 20, "addr": 388 }, { "b": "x\u003ewFnl{:\u003cwsx4WPuQNsHryXzVx(k5iB1R3wC4\u003e#nzAm", "n": [ { "c": 2, "d": "os.environ attribute", "i": "micro-behaviors/os/env/access::os-environ-symbol", "o": 412, "z": 10, "cf": 0.6000000238418579 } ], "ln": 21, "addr": 389 }, { "b": "arR^Hl}6Bxm\u003c6@qz/WKxzGY-mz/e=bl{:\u003cwsx4WPuQNsHryXAx", "ln": 22, "addr": 424 }, { "b": "wO=B0iS", "ln": 23, "addr": 465 }, { "b": "arR^Ha%FjcA=lbnwmY*8v@Dm5wN/*@z/cXtzY\u0026EhwmxT(CYU6svrt{!vrl0ja%Fi", "ln": 34, "addr": 590 }, { "b": "", "ln": 35, "addr": 642 }, { "b": "arR^HqBKIMqDujOuSQ33l@Li\u003eax{i(mnccqr3%jtcQZx%mn#Y6efDrup^^PGmjfSecRm6imn^8jefDrsmn$S=", "n": [ { "c": 2, "d": "Benign application or testing context", "i": "well-known/tool/detection/security-scanner::multi-app-stealer-benign-context", "o": 676, "z": 6, "cf": 0.8999999761581421 } ], "ln": 36, "addr": 643 }, { "b": "arR^HarR^HarR^HarR^HarR^HarS4jk$\u003eoEqZTascRm6jpBvXocQ}0fo^.FmcR)Sdmn+G:asxGUcOcw/s4C+TmjfR", "ln": 37, "addr": 712 }, { "b": "arR^HarR^HarR^HarR^HarR^HarS40pGpd?cOcw/lR*DAk#Yi.asxDIl)\u003cJdcQyVUt(", "ln": 38, "addr": 784 }, { "b": "arR^HarR^HB7Gf1e)\u0026WwA:J^4vpJ\u003eZz!@@}AV^H/cTQjGlr3xQr765Wp^E#TmmpGUrA9s7r8Mp.m{/QJ", "ln": 58, "addr": 1948 }, { "b": "arR^HarR^HB7Gf1e)\u0026NaA+fb}Abn@)wOu0#wmY^7jS(aVuQNjWmoAISlsiLPqD31LuR:W3uR\u003c3^mnu=*uNC", "ln": 59, "addr": 2013 }, { "b": "arR^HarR^Hx\u003ewG9z/^auB1RAuBz9pvB7x09c#r*ivruj4zyEQ", "n": [ { "c": 2, "d": "Checks file existence (os.path.exists)", "i": "micro-behaviors/fs/file/stat::path-exists", "o": 2095, "z": 13, "cf": 0.8500000238418579 } ], "ln": 60, "addr": 2080 }, { "b": "arR^HarR^HarR^HA:-W6wGT/TA=U!XA=M8sc#r*ivruj4zxHCLcM)bAaz#atayMy6x(W={Bz(hBcN/", "ln": 61, "addr": 2120 }, { "b": "", "ln": 62, "addr": 2183 }, { "b": "arR^HarR^HCw7MdwNw}-vrDT5auZ\u0026*wO+%hBz\u003e@azGx36wO+%hBz\u003e@azGvBAzE^s6c)@7!mn=M4diHb-f/\u0026O", "ln": 115, "addr": 4011 }, { "b": "arR^HarR^HB7Gf1e[n*qwncd1z/fRsjS[/Sy?tqbp*[x=wL=/HA=SSRasw^Rz!T8qCw7MdwNw}-vrDT5dj=O?k#6/}df", "ln": 116, "addr": 4079 }, { "b": "arR^HarR^Hw]zYjv@Dl}azCZoB7Gf1e[n*qwncd1z/fRS", "n": [ { "c": 2, "d": "Iteration or loop pattern", "i": "micro-behaviors/data/control-flow/analysis::iteration-loop-pattern", "o": 4160, "z": 13, "cf": 0.5 } ], "ln": 117, "addr": 4153 }, { "b": "arR^HarR^HarR^HB7Gf1e[n*qwncd1z/fS2v@Dl}t{8oMB7Gf1e)?4*v{%s/lUG[GB0#9vy?tqfz/f91BzkVhB6Ac)zE^34", "ln": 118, "addr": 4190 }, { "b": "arR^HarR^Hl$G?Ixdbb{z/f91BzkVhB0a[iwGUh6B6Qdob{mnuy?tqfz/f91BzkVhB14", "ln": 119, "addr": 4267 }, { "b": "arR^HarR^HboQ@zA3f7hw/#qhwPzu8v@bN@B7C", "ln": 121, "addr": 4323 }, { "b": "arR^HarR^HvivYQB7Gf1e{82EwO#MwAbPXzdf", "ln": 122, "addr": 4354 }, { "b": "arR^HarR^HCw7YbwGUz7aW3}}s4C+Tmjga", "n": [ { "c": 2, "d": "while loop pattern", "i": "micro-behaviors/data/control-flow/analysis::while-loop", "o": 4384, "z": 27, "cf": 0.30000001192092896 } ], "ln": 123, "addr": 4384 }, { "b": "arR^HarR^HarR^HvivYQB7Gf1e{82EwO#MwAbPXzdf", "ln": 124, "addr": 4412 }, { "b": "", "ln": 125, "addr": 4446 }, { "b": "arR^HarR^HBAhT/", "ln": 361, "addr": 13869 }, { "b": "arR^HarR^HarR^HC42ifwIdOezE+dyvj9G", "ln": 362, "addr": 13882 }, { "b": "arR^HarR^HwQ4Y@Ac9i\u003eCW\u003er7BzkVhiS", "n": [ { "c": 2, "d": "Error handling keywords", "i": "micro-behaviors/crypto/symmetric/fernet::error-handling-keywords", "o": 13918, "z": 16, "cf": 1.0 } ], "ln": 363, "addr": 13910 }, { "b": "arR^HarR^HarR^HA+funA=91yvqH6$", "ln": 364, "addr": 13936 }, { "b": "", "ln": 365, "addr": 13961 }, { "b": "", "ln": 395, "addr": 14945 }, { "b": "arR^HarR^Hl2{QViS", "ln": 396, "addr": 14946 }, { "b": "arR^HarR^HarR^HADL\u0026kC@^6Ve[V^VcV-\u003cnwN/*8dJ\u0026tzz/3RsvpB4:j0$", "n": [ { "c": 3, "d": "SELECT SQL keyword in query", "i": "micro-behaviors/data/db/sql::sql-select", "o": 14985, "z": 13, "cf": 0.6000000238418579 } ], "ln": 397, "addr": 14960 }, { "b": "arR^HarR^HarR^HCxdztwPRQaBVHTOz/oB", "ln": 398, "addr": 15007 }, { "b": "", "ln": 399, "addr": 15035 }, { "b": "arR^HarR^Hm@GI(xMw3lxj@AfxK@rbz*cmBx(k5mwO+%hwmoN*az\u003eLev}YN]xcqqfwO\u0026L#xjkH(B95KDxK@q@z/f91BzkVhB1v", "ln": 643, "addr": 23608 }, { "b": "arR^HarR^Hx\u003ewGfxK#Diw[=ufwmYN*By=OpxK@rbz*9suwNP:@zF782aAhd9v}xs(y?d9$aA?gfB.8Wzx(k5iA+5:4aARJ", "ln": 644, "addr": 23687 }, { "b": "arR^HarR^HyH}6@aARpdazC}eA::67z/cXpA=kD0B8@EBvqYT9e*8o5w]}Q8CvtJ5ay/k0vqWigA3eObC{3WnAccvFC42ifwPGE", "n": [ { "c": 1, "d": "Cleanup/action word: clean", "i": "objectives/impact/destroy/keywords::cleanup-verb--clean", "o": 23816, "z": 5, "cf": 0.8799999952316284 } ], "ln": 645, "addr": 23763 }, { "b": "", "ln": 646, "addr": 23843 }, { "b": "arR^HarR^HqE%@)A=b}V", "ln": 647, "addr": 23844 }, { "b": "arR^HarR^HarR^HBAhT/", "ln": 999, "addr": 34442 }, { "b": "arR^HarR^HarR^HarR^Hx\u003ewGhvqE$", "ln": 1000, "addr": 34459 }, { "b": "arR^HarR^HarR^HarR^HarR^HC42hfjS[rVvqEunvqEv", "n": [ { "c": 3, "d": "eval() call (Python)", "i": "objectives/execution/interpreter/eval/invoke::eval-call-python", "o": 34509, "z": 4, "cf": 0.4000000059604645 } ], "ln": 1001, "addr": 34483 }, { "b": "arR^HarR^HarR^HwQ4Y@Ac9i$vqPNAA=M8sayPslwJx", "ln": 1002, "addr": 34519 }, { "b": "arR^HarR^HarR^HarR^HA:-W6wGTA^wN/\u003e8wKQSWz/NlNmQZ1EwN({9zY\u003c1cA=U!mc37hyzxHlDasv", "ln": 1003, "addr": 34554 }, { "b": "", "ln": 1078, "addr": 36704 }, { "b": "arR^HarR^HBAhT/", "ln": 1079, "addr": 36705 }, { "b": "arR^HarR^HarR^HB7Gf1e[OSpjS[VZwO@]mB1RAuBz9pwz!T8qB7Gf1e]kDovruj4zy=]KwO+%hBywS{wHPeMcVQN-", "n": [ { "c": 2, "d": "Python open() file call", "i": "micro-behaviors/fs/file/open::generic-dup", "o": 36740, "z": 5, "cf": 0.8999999761581421 } ], "ln": 1080, "addr": 36718 }, { "b": "arR^HarR^HarR^HB7Gf1e[!*8wmY^7jS[/Sy?tqbp\u0026ZF:wPI]-wNPaXAWSv", "ln": 1081, "addr": 36791 }, { "b": "", "ln": 1082, "addr": 36839 }, { "b": "", "ln": 1119, "addr": 38212 }, { "b": "arR^HarR^HmRM):BrC^Fx()]exK$Q.wPw]4zE:(2vrt{2Bz\u0026pgaARgiA3e+by?kc", "ln": 1120, "addr": 38213 }, { "b": "arR^HarR^HBzbl6az(4uwGV8dwGV8iA3e+by?j-hzY\u003c7iAbn@)wGV8dwGU]ix\u003eIc$vqE6dvpB4:azbt7wI9", "n": [ { "c": 2, "d": "Reference to a temporary directory", "i": "micro-behaviors/fs/temp/reference::temp-dir-reference", "o": 38287, "z": 3, "cf": 0.4000000059604645 } ], "ln": 1121, "addr": 38265 }, { "b": "arR^HarR^Ha%Fi", "ln": 1122, "addr": 38332 }, { "b": "arR^HarR^HB7Gf1e{7VwA9)i\u003ey?j.LaARgiAaS*2wIc.^zdNlSwO(y8A::0lmRMWIc[b", "n": [ { "c": 2, "d": "tempfile.NamedTemporaryFile call", "i": "micro-behaviors/fs/temp/mktemp::tempfile-named-temporary-file", "o": 38369, "z": 27, "cf": 0.8999999761581421 } ], "ln": 1123, "addr": 38344 }, { "b": "arR^HarR^Hl$G?IxdbcHwO(x[w[=6)iV]^)d\u003ce[Ay?tqwwO(x[w[=6)e]C9mwHN", "ln": 1124, "addr": 38399 }, { "b": "arR^HarR^HboRhJx()]exK$Q.wPv", "ln": 1125, "addr": 38450 }, { "b": "arR^HarR^HarR^HarR^HxK$Q.wPw[RaswERdjlk:azts{wmY=", "ln": 1136, "addr": 38868 }, { "b": "", "ln": 1137, "addr": 38908 }, { "b": "arR^HarR^HB7Gf1e{7VwA9)i\u003ey?kkyA+PSbc[5+uvpS}\u0026e]#bPx(CEHas!MZtY7]re[F{gz!9AcdjC", "n": [ { "c": 2, "d": "Python file or stream write() call", "i": "micro-behaviors/fs/file/write/direct::py-write-call", "o": 38917, "z": 20, "cf": 0.7799999713897705 } ], "ln": 1138, "addr": 38909 }, { "b": "", "ln": 1139, "addr": 38972 }, { "b": "arR^HarR^HboRhJx()]ewmoN*", "ln": 1140, "addr": 38973 }, { "b": "arR^HarR^HarR^HBywS{wNx4-y?j.LaA8rNAa9\u003c4e]2rszyxNqy?tqoz!0i$x(v(uaAIagw?FglvR/Q8", "ln": 1158, "addr": 39521 }, { "b": "arR^HarR^HarR^Hl$G?Ixdbb{z/x#ozF77rB0bNyash7RasecUBy/rduUj1*wH[%CvpB4:uUj1*wHP5", "ln": 1159, "addr": 39586 }, { "b": "arR^HarR^HarR^HB7/Yrx(2ziz/x$IB7Gf1e{7VwA9)i\u003ey?kkpvqPNbaAIagw?E[rv{%E[z/cWFasw/\u0026as!NQwO+%hBywS{wHN", "n": [ { "c": 3, "d": "Copies a file (shutil.copy)", "i": "micro-behaviors/fs/file/copy::shutil-copy", "o": 39662, "z": 11, "cf": 0.800000011920929 } ], "ln": 1160, "addr": 39650 }, { "b": "", "ln": 1161, "addr": 39729 }, { "b": "arR^HwmYu}uR\u003efKB7FfRx(XnyB7Gf1efG0+ay]51x(dNawPxjX", "ln": 1162, "addr": 39730 }, { "b": "", "ln": 1241, "addr": 41694 }, { "b": "x\u003ewF{uV6p?wNw^!jV%]nuTEUUx(mo+cPR", "ln": 1242, "addr": 41695 }, { "b": "arR^Hzddc@d06VPe[5^kB$0", "n": [ { "c": 2, "d": "Python sys.argv command-line access", "i": "micro-behaviors/os/sysinfo/platform/runtime::sys-argv-access", "o": 41731, "z": 8, "cf": 0.699999988079071 } ], "ln": 1243, "addr": 41722 }, { "b": "", "ln": 1244, "addr": 41741 } ], "depth": 1, "facts": { "imp": [ [ "", "print" ], [ "", "os.path.isdir" ], [ "", "ParseError" ], [ "", "getattr" ], [ "", "self.fd.close" ], [ "", "self.tokens.index" ], [ "", "len" ], [ "", "ParseError" ], [ "", "ParseError" ], [ "", "self.tokens.pop" ], [ "", "self.tokens.pop" ], [ "", "self.tokens.pop" ], [ "", "ParseError" ], [ "", "Debug" ], [ "", "Debug" ], [ "", "ParseError" ], [ "", "NotSupportedError" ], [ "", "self.tokens.index" ], [ "", "self._ParsePairs" ], [ "", "' '.join" ], [ "", "self._EscapeChars" ], [ "", "Debug" ], [ "", "self.tokens.pop" ], [ "", "self.tokens.pop" ], [ "", "Debug" ], [ "", "ParseError" ], [ "", "self.tokens.index" ], [ "", "ParseError" ], [ "", "' '.join" ], [ "", "ParseError" ], [ "", "self.tokens[1].startswith" ], [ "", "ParseError" ], [ "", "self._ReplaceParens" ], [ "", "cols_str.split" ], [ "", "col.strip" ], [ "", "ParseError" ], [ "", "col.split" ], [ "", "self._ParseColumnsConcatHelper" ], [ "", "col.split" ], [ "", "len" ], [ "", "ParseError" ], [ "", "len" ], [ "", "ParseError" ], [ "", "self._ReplaceStringLiterals" ], [ "", "self._ReplaceStringLiterals" ], [ "", "self.columns.append" ], [ "", "len" ], [ "", "ParseError" ], [ "", "len" ], [ "", "self._ReplaceStringLiterals" ], [ "", "self._ReplaceStringLiterals" ], [ "", "self.columns.append" ], [ "", "self._ReplaceStringLiterals(col, quotes=True).strip" ], [ "", "self._ReplaceStringLiterals" ], [ "", "ParseError" ], [ "", "self.columns.append" ], [ "", "Debug" ], [ "", "Debug" ], [ "", "Debug" ], [ "", "len" ], [ "", "ParseError" ], [ "", "col_split[1].startswith" ], [ "", "ParseError" ], [ "", "ParseError" ], [ "", "ParseError" ], [ "", "self._ReplaceStringLiterals" ], [ "", "self._ReplaceParens" ], [ "", "concat_cols_str.split" ], [ "", "concat_col.strip" ], [ "", "ParseError" ], [ "", "self._ReplaceStringLiterals" ], [ "", "ParseError" ], [ "", "concat_col_list.append" ], [ "", "self.columns.append" ], [ "", "ParseError" ], [ "", "self.tokens.pop" ], [ "", "self.tokens.pop" ], [ "", "self.tokens.pop" ], [ "", "ParseError" ], [ "", "self.tokens.pop" ], [ "", "self.tokens.pop" ], [ "", "self.tokens.pop" ], [ "", "ParseError" ], [ "", "Debug" ], [ "", "Debug" ], [ "", "self.tokens.pop" ], [ "", "ParseError" ], [ "", "self._ParsePairs" ], [ "", "' '.join" ], [ "", "self._ParsePairs" ], [ "", "' '.join" ], [ "", "len" ], [ "", "self.tokens[0].startswith" ], [ "", "ParseError" ], [ "", "self.tokens[2].startswith" ], [ "", "ParseError" ], [ "", "self._ReplaceParens(self.tokens[0]).split" ], [ "", "self._ReplaceParens" ], [ "", "self._ReplaceParens(self.tokens[2]).split" ], [ "", "self._ReplaceParens" ], [ "", "len" ], [ "", "len" ], [ "", "ParseError" ], [ "", "ParseError" ], [ "", "len" ], [ "", "vals[i].strip" ], [ "", "ParseError" ], [ "", "ParseError" ], [ "", "cols[i].strip" ], [ "", "self._ReplaceStringLiterals" ], [ "", "ParseError" ], [ "", "self._EscapeChars" ], [ "", "Debug" ], [ "", "value.find" ], [ "", "escaped.replace('\\\\', '\\\\\\\\').replace" ], [ "", "escaped.replace" ], [ "", "escaped.replace(':', '\\\\:').replace" ], [ "", "escaped.replace" ], [ "", "escaped.replace('\\r', '\\\\r').replace" ], [ "", "escaped.replace" ], [ "", "value.find" ], [ "", "escaped.replace('\\\\:', ':').replace" ], [ "", "escaped.replace" ], [ "", "escaped.replace('\\\\r', '\\r').replace" ], [ "", "escaped.replace" ], [ "", "escaped.replace('\\\\0', '\\0').replace" ], [ "", "escaped.replace" ], [ "", "self.ParseQuery" ], [ "", "self.OpenTable" ], [ "", "Debug" ], [ "", "self._RunSelect" ], [ "", "self._RunUpdate" ], [ "", "self._RunInsert" ], [ "", "self._RunDelete" ], [ "", "self.WriteTempTable" ], [ "", "self.MoveTableIntoPlace" ], [ "", "Debug" ], [ "", "getattr" ], [ "", "self.fd.close" ], [ "", "query.split" ], [ "", "self._Tokenize" ], [ "", "self._ParseCommand" ], [ "", "self._ParseOrderBy" ], [ "", "self._ParseConditions" ], [ "", "self._ParseColumns" ], [ "", "self._ParseTable" ], [ "", "self._ParseTargets" ], [ "", "ParseError" ], [ "", "self.tokens.pop" ], [ "", "Debug" ], [ "", "Debug" ], [ "", "int" ], [ "", "time.time" ], [ "", "self.args.lower" ], [ "", "self.args.lower().find" ], [ "", "self.args.lower" ], [ "", "self.args.replace('(', ' ( ').replace" ], [ "", "self.args.replace" ], [ "", "pad.replace(',', ' , ').replace(';', ' ; ').replace" ], [ "", "pad.replace(',', ' , ').replace" ], [ "", "pad.replace" ], [ "", "self._ParseOutBlocks" ], [ "", "self.args.split" ], [ "", "len" ], [ "", "self.tokens[i].upper" ], [ "", "self.tokens[i].upper" ], [ "", "Debug" ], [ "", "self._ParseOutHelper" ], [ "", "self._ParseOutHelper" ], [ "", "Debug" ], [ "", "Debug" ], [ "", "ExecuteError" ], [ "", "len" ], [ "", "ExecuteError" ], [ "", "values.append" ], [ "", "Debug" ], [ "", "s.strip().startswith" ], [ "", "s.strip" ], [ "", "int" ], [ "", "s.split" ], [ "", "s.strip().startswith" ], [ "", "s.strip" ], [ "", "int" ], [ "", "s.split" ], [ "", "self.parens[str_index].strip" ], [ "", "len" ], [ "", "self._MatchRow" ], [ "", "self.data.remove" ], [ "", "len" ], [ "", "self._MatchRow" ], [ "", "ExecuteError" ], [ "", "ExecuteError" ], [ "", "self._TypeCheck" ], [ "", "self._SortHeaderColumns" ], [ "", "ExecuteError" ], [ "", "self._GetNextAuto" ], [ "", "ExecuteError" ], [ "", "self.data.append" ], [ "", "seen.append" ], [ "", "ExecuteError" ], [ "", "self._SortHeaderColumns" ], [ "", "self._MatchRow" ], [ "", "concat_col.startswith" ], [ "", "concat_col.endswith" ], [ "", "concat_col.strip" ], [ "", "self.header.keys" ], [ "", "ExecuteError" ], [ "", "concat.strip" ], [ "", "ExecuteError" ], [ "", "col.startswith" ], [ "", "col.endswith" ], [ "", "col.strip" ], [ "", "self.header.keys" ], [ "", "ExecuteError" ], [ "", "match.append" ], [ "", "self._UnEscapeChars" ], [ "", "dataset.append" ], [ "", "Debug" ], [ "", "len" ], [ "", "self.header.keys" ], [ "", "ExecuteError" ], [ "", "self._PositionByCol" ], [ "", "self._SortMatrixByCol" ], [ "", "len" ], [ "", "dataset[i].insert" ], [ "", "dataset.sort" ], [ "", "len" ], [ "", "dataset[i].pop" ], [ "", "self.header.keys" ], [ "", "self.fd.readline().strip" ], [ "", "self.fd.readline" ], [ "", "header.split" ], [ "", "col.split" ], [ "", "col.split('(')[1].split(')')[0].split" ], [ "", "col.split('(')[1].split" ], [ "", "col.split" ], [ "", "col.split('(')[1].split" ], [ "", "col.split" ], [ "", "col.split('(')[1].split(')')[0].split(',')[1].lower" ], [ "", "col.split('(')[1].split(')')[0].split" ], [ "", "col.split('(')[1].split" ], [ "", "col.split" ], [ "", "col.split('(')[1].split(')')[0].split(',')[1].lower" ], [ "", "col.split('(')[1].split(')')[0].split" ], [ "", "col.split('(')[1].split" ], [ "", "col.split" ], [ "", "row.rstrip" ], [ "", "len" ], [ "", "self._ColByPosition" ], [ "", "self._TypeCheck" ], [ "", "self._ColByPosition" ], [ "", "self._TypeCheck" ], [ "", "ExecuteError" ], [ "", "data.append" ], [ "", "ExecuteError" ], [ "", "self.header[col]['type'].lower" ], [ "", "eval" ], [ "", "ExecuteError" ], [ "", "ExecuteError" ], [ "", "ExecuteError" ], [ "", "self.header.keys" ], [ "", "ExecuteError" ], [ "", "self.header.keys" ], [ "", "len" ], [ "", "ExecuteError" ], [ "", "open" ], [ "", "os.path.join" ], [ "", "self._ProcessHeader" ], [ "", "fcntl.flock" ], [ "", "self._GetData" ], [ "", "ExecuteError" ], [ "", "Debug" ], [ "", "self.header.keys" ], [ "", "ExecuteError" ], [ "", "self._TypeCheck" ], [ "", "self.header.keys" ], [ "", "ExecuteError" ], [ "", "self._TypeCheck" ], [ "", "Debug" ], [ "", "Debug" ], [ "", "Debug" ], [ "", "Debug" ], [ "", "Debug" ], [ "", "tempfile.NamedTemporaryFile" ], [ "", "Debug" ], [ "", "self._SortHeaderColumns" ], [ "", "self.temp_file.write" ], [ "", "(header.strip() + '\\n').encode" ], [ "", "header.strip" ], [ "", "self.temp_file.write" ], [ "", "(row_str[1:] + '\\n').encode" ], [ "", "self.temp_file.flush" ], [ "", "os.path.join" ], [ "", "Debug" ], [ "", "shutil.copy" ], [ "", "Debug" ], [ "", "s.split" ], [ "", "pair.split" ], [ "", "Debug" ], [ "", "len" ], [ "", "split[0].strip" ], [ "", "split[1].strip" ], [ "", "self._ReplaceStringLiterals" ], [ "", "split[1].strip" ], [ "", "len" ], [ "", "print" ], [ "", "sys.exit" ], [ "", "print" ], [ "", "sys.exit" ], [ "", "DBText" ], [ "", "conn.Execute" ], [ "", "' '.join" ], [ "", "print" ], [ "", "print" ], [ "", "print" ], [ "", "sys.exit" ], [ "", "main" ], [ "", "fcntl" ], [ "", "os" ], [ "", "shutil" ], [ "", "sys" ], [ "", "tempfile" ], [ "", "time" ] ], "mbr": [ "col.endswith", "col.split", "col.startswith", "col.strip", "cols_str.split", "concat.strip", "concat_col.endswith", "concat_col.startswith", "concat_col.strip", "concat_col_list.append", "concat_cols_str.split", "conn.Execute", "conn.command", "conn.table", "data.append", "dataset.append", "dataset.sort", "escaped.replace", "escaped.replace().replace", "fcntl.LOCK_EX", "fcntl.flock", "header.split", "header.strip", "match.append", "os.environ", "os.environ.DBTEXTDB_DEBUG", "os.environ.DBTEXT_PATH", "os.path", "os.path.isdir", "os.path.join", "pad.replace", "pad.replace().replace", "pad.replace().replace().replace", "pair.split", "query.split", "row.rstrip", "s.split", "s.strip", "s.strip().startswith", "seen.append", "self.ALL_COMMANDS", "self.MoveTableIntoPlace", "self.OpenTable", "self.ParseQuery", "self.RESERVED_WORDS", "self.WHERE_COMMANDS", "self.WriteTempTable", "self._ColByPosition", "self._EscapeChars", "self._GetData", "self._GetNextAuto", "self._MatchRow", "self._ParseColumns", "self._ParseColumnsConcatHelper", "self._ParseCommand", "self._ParseConditions", "self._ParseOrderBy", "self._ParseOutBlocks", "self._ParseOutHelper", "self._ParsePairs", "self._ParseTable", "self._ParseTargets", "self._PositionByCol", "self._ProcessHeader", "self._ReplaceParens", "self._ReplaceParens().split", "self._ReplaceStringLiterals", "self._ReplaceStringLiterals().strip", "self._RunDelete", "self._RunInsert", "self._RunSelect", "self._RunUpdate", "self._SortHeaderColumns", "self._SortMatrixByCol", "self._Tokenize", "self._TypeCheck", "self._UnEscapeChars", "self._paren_placeholder", "self._str_placeholder", "self.aliases", "self.args", "self.args.lower", "self.args.lower().find", "self.args.replace", "self.args.replace().replace", "self.args.split", "self.columns", "self.columns.append", "self.command", "self.conditions", "self.count", "self.data", "self.data.append", "self.data.remove", "self.fd", "self.fd.close", "self.fd.readline", "self.fd.readline().strip", "self.header", "self.header.keys", "self.location", "self.order_by", "self.orig_data", "self.parens", "self.strings", "self.table", "self.targets", "self.temp_file", "self.temp_file.flush", "self.temp_file.name", "self.temp_file.write", "self.tokens", "self.tokens.index", "self.tokens.pop", "shutil.copy", "sys.argv", "sys.exit", "tempfile.NamedTemporaryFile", "time.time", "value.find", "values.append" ], "tgt": [ "DBText", "Debug", "ExecuteError", "NotSupportedError", "ParseError", "col.endswith", "col.split", "col.startswith", "col.strip", "cols_str.split", "concat.strip", "concat_col.endswith", "concat_col.startswith", "concat_col.strip", "concat_col_list.append", "concat_cols_str.split", "conn.Execute", "data.append", "dataset.append", "dataset.sort", "escaped.replace", "escaped.replace().replace", "eval", "fcntl.flock", "getattr", "header.split", "header.strip", "int", "len", "main", "match.append", "open", "os.path.isdir", "os.path.join", "pad.replace", "pad.replace().replace", "pad.replace().replace().replace", "pair.split", "print", "query.split", "row.rstrip", "s.split", "s.strip", "s.strip().startswith", "seen.append", "self.MoveTableIntoPlace", "self.OpenTable", "self.ParseQuery", "self.WriteTempTable", "self._ColByPosition", "self._EscapeChars", "self._GetData", "self._GetNextAuto", "self._MatchRow", "self._ParseColumns", "self._ParseColumnsConcatHelper", "self._ParseCommand", "self._ParseConditions", "self._ParseOrderBy", "self._ParseOutBlocks", "self._ParseOutHelper", "self._ParsePairs", "self._ParseTable", "self._ParseTargets", "self._PositionByCol", "self._ProcessHeader", "self._ReplaceParens", "self._ReplaceParens().split", "self._ReplaceStringLiterals", "self._ReplaceStringLiterals().strip", "self._RunDelete", "self._RunInsert", "self._RunSelect", "self._RunUpdate", "self._SortHeaderColumns", "self._SortMatrixByCol", "self._Tokenize", "self._TypeCheck", "self._UnEscapeChars", "self.args.lower", "self.args.lower().find", "self.args.replace", "self.args.replace().replace", "self.args.split", "self.columns.append", "self.data.append", "self.data.remove", "self.fd.close", "self.fd.readline", "self.fd.readline().strip", "self.header.keys", "self.temp_file.flush", "self.temp_file.write", "self.tokens.index", "self.tokens.pop", "shutil.copy", "sys.exit", "tempfile.NamedTemporaryFile", "time.time", "value.find", "values.append" ], "metrics": { "ast": { "op.add": 53.0, "op.lor": 6.0, "op.mod": 54.0, "op.mul": 1.0, "op.sub": 4.0, "op.land": 12.0, "max_depth": 25.0, "bind_count": 231.0, "call_count": 323.0, "node_count": 9300.0, "member_count": 121.0, "op_density.add": 0.01, "op_density.lor": 0.0, "op_density.mod": 0.01, "op_density.mul": 0.0, "op_density.sub": 0.0, "op_density.land": 0.0, "identifier_count": 194.0, "member_depth_max": 4.0, "string_literal_count": 375.0, "array_literal_max_length": 15.0, "string_concat_chain_max_length": 3.0 }, "file": { "size": 41741.0, "entropy": 4.21, "size_bytes": 41741.0 }, "text": { "digit_ratio": 0.01, "space_count": 15186.0, "total_lines": 1243.0, "char_entropy": 4.21, "unique_chars": 85.0, "escape_density": 0.01, "string_density": 0.3, "ascii_art_lines": 2.0, "avg_line_length": 32.58, "max_line_length": 79.0, "empty_line_ratio": 0.19, "last_line_length": 18.0, "whitespace_ratio": 0.39, "most_common_ratio": 0.06, "identifier_density": 1.37, "line_length_stddev": 23.76, "octal_escape_count": 4.0, "normalized_string_count": 10.64, "repeated_char_sequences": 482.0, "suspicious_string_ratio": 0.03, "most_common_char_is_null": 0.0, "suspicious_comment_ratio": 0.02, "max_inline_whitespace_run": 8.0, "most_common_char_codepoint": 101.0, "suspicious_identifier_ratio": 0.03, "normalized_unique_identifiers": 18.87 }, "binds": { "count": 231.0 }, "calls": { "count": 323.0 }, "binary": { "overall_entropy": 4.21, "peak_region_bytes": 1024.0, "peak_region_entropy": 5.15 }, "source": { "class_count": 5.0, "function_count": 38.0 }, "imports": { "count": 6.0, "stdlib_count": 6.0, "stdlib_ratio": 1.0, "unique_modules": 6.0 }, "members": { "count": 121.0 }, "strings": { "total": 375.0, "avg_length": 29.46, "max_length": 675.0, "avg_entropy": 2.23, "email_count": 1.0, "empty_count": 18.0, "sql_strings": 10.0, "total_bytes": 11049.0, "entropy_stddev": 1.44 }, "comments": { "chars": 2751.0, "lines": 90.0, "total": 91.0, "hack_count": 1.0, "to_code_ratio": 0.08, "empty_comments": 1.0, "high_entropy_comments": 2.0 }, "functions": { "count": 43.0, "avg_params": 1.61, "max_params": 4.0, "length_stddev": 16.56, "avg_name_length": 12.11, "avg_length_lines": 30.24, "max_length_lines": 77.0, "min_length_lines": 3.0, "high_entropy_names": 8.0, "single_char_params": 3.0, "avg_param_name_length": 4.33, "density_per_100_lines": 3.06, "code_in_functions_ratio": 0.92 }, "identifiers": { "count": 194.0, "total": 1698.0, "avg_length": 7.85, "max_length": 25.0, "min_length": 1.0, "avg_entropy": 2.5, "reuse_ratio": 0.11, "unique_count": 194.0, "length_stddev": 4.14, "sequential_names": 5.0, "single_char_count": 5.0, "single_char_ratio": 0.03, "high_entropy_count": 10.0, "high_entropy_ratio": 0.05, "all_lowercase_ratio": 0.74, "all_uppercase_ratio": 0.03, "double_underscore_count": 4.0, "underscore_prefix_count": 34.0 } } }, "id": 3, "mol": "H(F)", "path": "kamailio-dbtext-6.0.6-r0.apk!!usr/lib/kamailio/kamctl/dbtextdb/dbtextdb.py", "risk": 2, "sha": "6afe5939e83fbee14b7816255517f5ff2cb66f1bf4890b4749a73654ebe53beb", "size": 41741, "traits": [ { "id": "objectives/execution/interpreter/eval/invoke::eval-call-python", "atk": "T1059", "mbc": "E1059", "conf": 0.4000000059604645, "crit": 3, "desc": "eval() call (Python)", "spans": [ [ 34509, 4 ] ] }, { "id": "well-known/tool/detection/security-scanner::dangerous-query-keyword-denylist", "conf": 0.9200000166893005, "crit": 1, "desc": "Defensive dangerous query-keyword denylist", "spans": [ [ 676, 6 ] ] }, { "id": "micro-behaviors/fs/file/copy::shutil-copy", "conf": 0.800000011920929, "crit": 3, "desc": "Copies a file (shutil.copy)", "spans": [ [ 39662, 11 ] ] }, { "id": "objectives/impact/destroy/keywords::cleanup-verb--clean", "conf": 0.8799999952316284, "crit": 1, "desc": "Cleanup/action word: clean", "spans": [ [ 23816, 5 ] ] }, { "id": "micro-behaviors/data/db/sql::sql-select", "conf": 0.6000000238418579, "crit": 3, "desc": "SELECT SQL keyword in query", "spans": [ [ 14985, 13 ] ] } ], "type": "python" }, { "ctx": [ { "b": "bl", "n": [ { "c": 2, "d": "Tiny multi-line text script", "i": "metadata/file/profile/identity::tiny-text-script", "o": 0, "z": 24, "cf": 0.75 } ], "ln": 1, "addr": 0 }, { "b": "boQGmzGG]qy-)?rz!{Ldz/M$qvqfR3vqfQ[zF77+vqPB!y?W!", "ln": 2, "addr": 2 }, { "b": "bl", "ln": 3, "addr": 42 } ], "depth": 1, "facts": { "imp": [ [ "", "echo" ], [ "", "echo" ], [ "", "exit" ], [ "", "exit" ], [ "", "$MYLIBDIR/kamctl.sqlbase" ] ], "tgt": [ ".", "echo", "exit" ], "metrics": { "ast": { "max_depth": 7.0, "bind_count": 5.0, "call_count": 3.0, "node_count": 149.0, "identifier_count": 10.0, "string_literal_count": 8.0 }, "file": { "size": 720.0, "entropy": 5.25, "size_bytes": 720.0 }, "text": { "tab_count": 11.0, "digit_ratio": 0.0, "space_count": 50.0, "total_lines": 32.0, "char_entropy": 5.25, "unique_chars": 59.0, "string_density": 0.25, "ascii_art_lines": 2.0, "avg_line_length": 21.5, "max_line_length": 79.0, "empty_line_ratio": 0.16, "last_line_length": 40.0, "whitespace_ratio": 0.13, "most_common_ratio": 0.1, "identifier_density": 0.75, "line_length_stddev": 22.05, "normalized_string_count": 1.41, "repeated_char_sequences": 2.0, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 1.0, "most_common_char_codepoint": 61.0, "normalized_unique_identifiers": 2.0 }, "binds": { "count": 5.0 }, "calls": { "count": 3.0 }, "binary": { "overall_entropy": 5.25, "peak_region_bytes": 720.0, "peak_region_entropy": 5.25 }, "imports": { "count": 1.0, "unique_modules": 1.0, "third_party_count": 1.0, "third_party_ratio": 1.0 }, "strings": { "total": 8.0, "avg_length": 25.5, "max_length": 71.0, "path_count": 1.0, "avg_entropy": 3.68, "total_bytes": 204.0, "entropy_stddev": 0.84 }, "comments": { "chars": 207.0, "lines": 5.0, "total": 8.0, "to_code_ratio": 0.19, "empty_comments": 3.0 }, "consistency": { "extension_content_mismatch": 1.0, "extension_content_mismatch.script_as_unknown": 1.0 }, "identifiers": { "count": 10.0, "total": 24.0, "avg_length": 7.2, "max_length": 21.0, "min_length": 1.0, "avg_entropy": 2.15, "reuse_ratio": 0.42, "unique_count": 10.0, "length_stddev": 5.29, "single_char_count": 1.0, "single_char_ratio": 0.1, "all_lowercase_ratio": 0.2, "all_uppercase_ratio": 0.6 } } }, "id": 4, "path": "kamailio-dbtext-6.0.6-r0.apk!!usr/lib/kamailio/kamctl/kamctl.dbtext", "risk": 1, "sha": "3ebdecb74dd83f03743f3534af49fce4c5c09f876b38f9e4d7b2140e90fb1dd7", "size": 720, "traits": [ { "id": "metadata/build/package::cloud-marketplace-cleanup-path", "conf": 0.949999988079071, "crit": 1, "desc": "Cloud marketplace cleanup path", "spans": [ [ 0, 13 ] ] }, { "id": "metadata/file/profile/identity::tiny-text-script", "conf": 0.75, "crit": 2, "desc": "Tiny multi-line text script", "spans": [ [ 0, 24 ] ] }, { "id": "metadata/file/metrics::shell-multiple-local-assignments", "conf": 0.6000000238418579, "crit": 2, "desc": "Several local variable assignments", "spans": [ [ 0, 18 ] ] } ], "type": "shell" }, { "ctx": [ { "b": "boPG/zE)\u0026%By!#9vTf88vS=y3wfrVXf/HZsuVGThePJM", "n": [ { "c": 1, "d": "Alpine/Wolfi package info file", "i": "metadata/package/files/system-package::alpine-pkginfo-basename", "o": 0, "z": 1, "cf": 0.8999999761581421 } ], "ln": 1, "addr": 0 }, { "b": "boRbIx(mMaw)]E^A=k(raA?spB7]MgatCG8h.D\u0026", "ln": 2, "addr": 36 }, { "b": "Abf97vqPM#jS[JGzddc{x(tOlvSVgaBn", "n": [ { "c": 2, "d": "Alpine/Wolfi package info metadata", "i": "metadata/package/files/system-package::alpine-apk-pkginfo", "o": 68, "z": 25, "cf": 0.9700000286102295 } ], "ln": 3, "addr": 68 }, { "b": "Abf9fwPw[Rat$\u0026ae\u0026Cq4fA", "n": [ { "c": 1, "d": "Alpine/Wolfi package version field", "i": "metadata/package/files/system-package::alpine-pkginfo-version-field", "o": 94, "z": 17, "cf": 0.8999999761581421 } ], "ln": 4, "addr": 94 }, { "b": "Abf8%wPIu7jS)d3BywS!B7DF8A+PYdA=Svnz/M%*lr4JvBn", "ln": 5, "addr": 112 }, { "b": "B-IpvjS[AWBz#pZfe4J[Cp)Vtzddc{x(tRxA+v3", "ln": 6, "addr": 150 }, { "b": "B7]@iauZ\u00265gb}iFh2", "ln": 9, "addr": 263 }, { "b": "vrb\u003c\u003eauZ\u0026(i5Ub4gY", "ln": 10, "addr": 277 }, { "b": "z/PM8x(k4RazUz5vqfK(zV", "n": [ { "c": 1, "d": "Alpine/Wolfi package origin field", "i": "metadata/package/files/system-package::alpine-pkginfo-origin-field", "o": 291, "z": 17, "cf": 0.8999999761581421 } ], "ln": 11, "addr": 291 }, { "b": "v@Dj3x(\u003eEXayNn=hAr-LgIev0iwSMLgc4j7vQS.8h!uDew\u00268w2g=Nm4h.XU$h2", "ln": 12, "addr": 309 }, { "b": "zddc@Byw)3wPw[RawMu!xKL^3l2HsDy***(B09O.vqYZ?y^qABAa%i3y?W^fCRi]PxfD", "ln": 13, "addr": 359 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 616.0, "entropy": 5.18, "size_bytes": 616.0 }, "binary": { "overall_entropy": 5.18, "peak_region_bytes": 616.0, "peak_region_entropy": 5.18 } } }, "id": 5, "path": "kamailio-dbtext-6.0.6-r0.apk!!.PKGINFO", "risk": 1, "sha": "d39d7e07a9f1374669b25c41f90cb65b30498e3e7219307f85e647e0f954920e", "size": 616, "traits": [ { "id": "metadata/package/files/system-package::arch-pkgname-field", "conf": 0.9399999976158142, "crit": 1, "desc": "Arch pkgname metadata field", "spans": [ [ 68, 25 ] ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-version-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package version field", "spans": [ [ 94, 17 ] ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-basename", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package info file" }, { "id": "metadata/package/files/system-package::alpine-pkginfo-package-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package name field", "spans": [ [ 68, 25 ] ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-origin-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package origin field", "spans": [ [ 291, 17 ] ] }, { "id": "metadata/package/files/system-package::arch-pkgver-field", "conf": 0.9399999976158142, "crit": 1, "desc": "Arch pkgver metadata field", "spans": [ [ 94, 17 ] ] }, { "id": "metadata/package/files/system-package::alpine-apk-pkginfo", "conf": 0.9700000286102295, "crit": 2, "desc": "Alpine/Wolfi package info metadata", "spans": [ [ 68, 25 ], [ 94, 17 ], [ 291, 17 ] ] } ], "type": "text" } ], "rev": "868bd", "v": "8" } }