{ "ml": { "v": "7", "eng": "2.5.0-beta.0", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.0000017682711, "rte": "az", "prob": 0.0000017682711 }, { "cls": 0, "raw": 0.00046883026, "rte": "az/rpm", "prob": 0.00046883026 } ], "prob": 0.0000047783055, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.000004778305537911365, "type": "rpm" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.000004778305537911365, "type": "elf" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.0000037550926208496094, "type": "shell" } ], "version": "v18.18", "analyzed_at": "2026-08-10T17:20:25Z" }, "path": "konsole-26.07.90-1.fc45.aarch64.rpm", "raw": { "files": [ { "id": 0, "ctx": [ { "b": ")w]Wf0@@r3003!MzGx-jwI2U}e?/jpiwr3te[OPIh2)QR000000000000000000000000000000000000000000000000000000500000000000000000000J\u0026?HC000000000a003/I0000.00007003/s00", "n": [ { "c": 2, "d": "Archive has near-maximum entropy", "i": "metadata/file/metrics::high-entropy-archive", "o": 0, "z": 29, "cf": 0.8999999761581421 } ], "ln": 0 } ], "mol": "H(Cm)Md₂(BiPa)", "sha": "9d302d228b657d969f04033490205733d9d5cb044cafb3c146227eef06b1d0e0", "path": "konsole-26.07.90-1.fc45.aarch64.rpm", "risk": 3, "size": 1467190, "type": "rpm", "facts": { "metrics": { "rpm": { "buildtime": 1785529087.0 }, "file": { "size": 1467190.0, "entropy": 7.98, "size_bytes": 1467190.0 }, "binary": { "overall_entropy": 7.98, "peak_region_bytes": 1395510.0, "peak_region_entropy": 7.96 } } }, "ident": { "name": { "value": "konsole", "source": "rpm.name", "verified": false }, "urls": [ { "url": "https://www.kde.org/applications/system/konsole/", "kind": "homepage", "source": "rpm.url" } ], "trust": "unsigned", "authors": [ { "name": "Fedora Project", "role": "packager", "source": "rpm.packager" } ], "version": { "value": "26.07.90", "source": "rpm.version", "verified": false }, "organization": { "value": "Fedora Project", "source": "rpm.vendor", "verified": false } }, "traits": [ { "id": "metadata/binary/linking/runtime::dynamic-loader-needed", "conf": 0.699999988079071, "crit": 3, "desc": "ELF needs the Linux dynamic loader" }, { "id": "metadata/file/profile/language::lang-english--atom-2", "conf": 0.800000011920929, "crit": 2, "desc": "Contains common English function words", "from": [ { "file": 2 } ], "spans": [ [ 39646, 3 ] ] }, { "id": "metadata/file/profile/language::lang-english--atom-5", "conf": 0.800000011920929, "crit": 2, "desc": "Contains common English function words", "from": [ { "file": 2 } ] }, { "id": "metadata/file/profile/language::lang-english--atom-7", "conf": 0.800000011920929, "crit": 2, "desc": "Contains common English function words", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/communications/http/url/domain::http-url-binary", "atk": "T1071.001", "mbc": "C0002", "conf": 0.699999988079071, "crit": 3, "desc": "Embedded HTTP or WebSocket URL", "from": [ { "file": 1 } ] }, { "id": "metadata/file/profile/language::lang-english--atom-1", "conf": 0.800000011920929, "crit": 2, "desc": "Contains common English function words", "from": [ { "file": 2 } ], "spans": [ [ 40562, 3 ], [ 41015, 3 ] ] }, { "id": "metadata/binary/linking/runtime::library-loader-dep", "conf": 1.0, "crit": 3, "desc": "ELF directly depends on the dynamic loader", "from": [ { "file": 1 } ] }, { "id": "metadata/binary/linking/runtime::glibc-needed", "conf": 1.0, "crit": 3, "desc": "ELF depends on glibc" }, { "id": "metadata/package/files/system-package::fedora-rpm-vendor", "conf": 0.9900000095367432, "crit": 3, "desc": "Fedora Project RPM vendor identity" }, { "id": "metadata/package/files/system-package::rpm-signature-present", "conf": 0.949999988079071, "crit": 3, "desc": "RPM signature header is present" } ] }, { "ctx": [ { "b": "E))420S-r400000000000%2!g0rr91Fnb5:00000kMy=:00000A0MEA0000000000kMA+z3\u0026\u0026J)aoiF-1][S61onA4kMy=:00000kMy=:00000kMy=:00000PAk8[00000PAk8[000002MK\u00268000000@@r31onA41oOS7000001oOS7000001oOS7000008VP\u003cr00000", "n": [ { "c": 3, "d": "ELF directly depends on the dynamic loader", "i": "metadata/binary/linking/runtime::library-loader-dep", "o": 0, "z": 32, "cf": 1.0 } ], "ln": 0 }, { "b": "uTEC.z/e{6ByxiiuTA!uuU\u003cB=v{:q0vrcD%zddc@0af8yCWT@\u003ex(mu}x)Ks\u003cvpBd}Bo2VPv%zA?vru79x(\u003ctZs#Qkhf/T5Yv]b*dq.RMSfKB/!t24ZBhCl.Zv{%g/DsZR=BAh8kxe\u003e0Kq/)4]zF8yY0ae]8f/zV#z!0i(x)Ku3q/)4]zF8u(mrOVruVQr$v@2BYxLQ%!vqfJTuS{hVfIsYvz/{d\u0026vrt{kf({]FpJy8RzFsA9BzkVhl#M{Jx(lvqoeea$lv0V:l2}0OC(RhPpbaB}l1j+PBvoLVvl4+bwi\u003euWxM4]WqCe@Cq/)4]zF8)6uSeZ!q.?YToeGHCA+\u003e..t23!aof)39B-Z2WByvgrwmO4", "n": [ { "c": 3, "d": "Stack protector/canary enabled", "i": "metadata/hardening/build::stack-protector", "o": 4780, "z": 14, "cf": 0.8999999761581421 }, { "c": 2, "d": "Abort program execution", "i": "micro-behaviors/os/signal/handler::abort", "o": 4679, "z": 5, "cf": 0.8999999761581421 }, { "c": 1, "d": "__cxa_atexit runtime registration symbol", "i": "metadata/lang/compiled::cxa-atexit-symbol", "o": 4687, "z": 10, "cf": 0.5 } ], "ln": 4631 }, { "b": "z/do:zE[2-zGx]dzEWlDB]U(Mpd)q%og9Snw[+)FA=l8thFuJuoj-xqp!Lo#z/xo9hz+zzy\u0026sxa0ae]8oeed#p\u0026ZG0C#F*gy?ksRwo8a5nPXJXraQq@mnL%vp*[6QBy/F\u003coePNAwN/*@qCe#Dp*[fKBAz86qCe@Cq/)4]zF8Zyhd5vhz!%ujqG3w.mf0", "n": [ { "c": 2, "d": "Open files (legacy 64-bit)", "i": "micro-behaviors/fs/file/open::open64", "o": 6893, "z": 6, "cf": 0.6600000262260437 } ], "ln": 6845 }, { "b": "ha7![wM9eTB7]-gC4(5zmf3W#pba.9lVl*UvqYQHx(mGUvrcB2AZRSJB]U(RxjVf[B:e7ryYE*CwnC7=z2^{Dr8#:GfKFf%CZ9Uax)8i^fKFgdx\u003cUv^vrlG%BA}?puUKy\u0026z::Ukt4zCCB]U(MzG/{$uTE\u003e@vpK7Wv}YT+xlvT6wb{BWvRY[1B8L(avq{frB8JV^hzcWxe\u0026+P=y?Wu]z/fSmy?mNax)9[", "n": [ { "c": 2, "d": "IFUNC-related markers", "i": "metadata/binary/linking/runtime::ifunc-markers", "o": 11119, "z": 9, "cf": 0.4000000059604645 }, { "c": 2, "d": "GNU libstdc++ stdlib", "i": "micro-behaviors/dylib/library/libc::libstdcxx-ref", "o": 11144, "z": 10, "cf": 0.8999999761581421 } ], "ln": 11071 }, { "b": "lVm0Rl1BIAzGvBKz.r{Fy?WuQBt=JNB-PfRz.r{Fy?WuQBt=H8A+c\u003eAz.r{Fy?Wv1ByX(id\u003eU)Ye\u0026AYCx\u003c$N8B8JV?0bMf$y?W^fCR9ujA:@=vg+J\u0026/e?)t@oI4MruOTk*hVMY%uP4)KsxE\u003cQnNBh8gxo^Asv2nBuOKe?e\u0026-]4oI4MrsxF]^e\u0026iM9Byc{Uf!\u0026U#oI4MruQm1IuQN\u003e2qBKnS07PZOlpk9ne\u0026br:000000000000000000", "n": [ { "c": 2, "d": "Versioned libc soname or symbol version", "i": "micro-behaviors/dylib/library/libc::libc-version-string", "o": 11566, "z": 7, "cf": 0.800000011920929 }, { "c": 2, "d": "GNU libstdc++ stdlib", "i": "micro-behaviors/dylib/library/libc::libstdcxx-ref", "o": 11519, "z": 12, "cf": 0.8999999761581421 } ], "ln": 11471 }, { "b": "1onA400093000001POS8000001][-9000c41POJ52lj-7000930@@G81POYa000001onJ70000000000000001POV92MK\u002681POJ500000000f5000931POS80SSr5", "n": [ { "c": 1, "d": "Repeated 0x07 byte constant", "i": "micro-behaviors/mem/protect/modify::repeated-07-byte-constant", "o": 11792, "z": 4, "cf": 0.25 } ], "ln": 11760 }, { "b": "x8\u003eOEA=-A{x(mD)zEN:ex8\u003eCkzE)\u0026%y-)O6x(n33x(mH5efFzAxcp/2CX7}svqYP#xjU%(A:-=bx(d*fz*2YewO#Qh002]nvR6O4awlP^xj#w!002\u0026owP?^aB-OWxvqfR3vqfQ\u003cAX5tLz/P@hwft#jawk9\u003egYNHQ002Y3A=Su\u003ez!i:3wDhYg002^", "n": [ { "c": 2, "d": "Contains common English function words", "i": "metadata/file/profile/language::lang-english--atom-2", "o": 39646, "z": 3, "cf": 0.800000011920929 } ], "ln": 39598 }, { "b": "B9g]caz2d%wN/?6002-4BAzhgvriLWBAzLqv}U\u0026x00000002x8wmV(}A=k!qBzbkdyJ:!xAb](iwN//?m}DNHA:-=bx(d*fz*2YewO#Qh0038eA^8kcyAL]Vy?W%ezu9QBxK#3?ayPd#aARgtBrCToy?m9#x(v(ix(d*fz*2YewO#Qh002z}zxI+\u0026y\u0026si500000002}/nG.$\u003cA=.oY00000002V6C4\u003e?pq/)4\u003ewPN[L002GewO1hbl)cC!A=.oY002@vwD", "n": [ { "c": 2, "d": "Contains common English function words", "i": "metadata/file/profile/language::lang-english--atom-1", "o": 40562, "z": 3, "cf": 0.800000011920929 }, { "c": 1, "d": "Indonesian function-word token", "i": "metadata/file/profile/language::lang-indonesian--atom-2", "o": 40656, "z": 3, "cf": 0.800000011920929 } ], "ln": 40514 }, { "b": "y?%7K00000ra]YTyJyRuzY\u0026[9zH0vyBzblaB1N!1eIgNMA:@VjA+fxmwDhYgfjXTqflzqY0000000000lVl\u003cOx\u003eHETA=U@kzu6Upok!Y?z!@#^x(mE1Ck}Qyq^\u003c\u0026Xm}DQQwPR%rpI@QCx(\u003csP00000qE%YRzdm6%s7#L.z*bb]DsW6R00000s7#L.z*aM!", "n": [ { "c": 2, "d": "/dev/tty terminal device", "i": "micro-behaviors/fs/path/device/terminal::dev-tty", "o": 40824, "z": 8, "cf": 1.0 } ], "ln": 40776 }, { "b": "06\u003eTuBzLH*090JIze0(@y-)qaB.\u003eGdz/L*T0000004qtaatC(ph.u^sgbpy6ra]?=ok!Y?z!@#cl$HKMy\u0026so7A=RiX09zSVuQm4UnMFbRnL-8*r8ldQp5\u003em]0839.q+{7QuQNjXq^SD(qDuvRmf0q/0839.q+{7QuQNjXq^SD(q=um-p5\u003em]0839.q+{7QuQNjXqV", "n": [ { "c": 2, "d": "Contains common English function words", "i": "metadata/file/profile/language::lang-english--atom-1", "o": 41015, "z": 3, "cf": 0.800000011920929 }, { "c": 1, "d": "Cloud credential source candidate for staging context", "i": "objectives/exfiltration/cloud/object-store::cloud-credential-source-reference", "o": 41040, "z": 20, "cf": 0.8999999761581421 } ], "ln": 40967 }, { "b": "kMCi)ASxOHv/QAEA@W=(f-S*azuakFBn#pv00000Bo2$OzVBROve$uGe=Y})BPuBZASxUJyYDZ2z#:[UzVB\u003eVzVBUPz2^#Ax-I@He=YwYzVBRO0000000000ve%*rve$lDBo2\u003eLwDj%}x8(=Gve$0wyYD6/", "n": [ { "c": 1, "d": "ProtonMail contact address", "i": "objectives/impact/ransom/native::protonmail-contact", "o": 41656, "z": 28, "cf": 0.699999988079071 } ], "ln": 41624 }, { "b": "A@W=(Bo2\u003eLASx}Rx-J2Jve$9z00000yxenMzua.TzVBONwDhYgg5%ije=WN9hVLDgirg-k0000000000xAibOBo3mWA@Xl3f90T9yxenMzua.TzVBONwDjs.yxd(BwDjs.zVB!Tx8\u003cN+0000000000A@Zs.vGplBx-JkPkMCl[BPu4OA@W/)yxd(BwDjs.zVB!Tx8?]izVB!Tx8\u003cK:yxd(BwDjs.yxenMzua.TzVBONwDjs.qVHweA@ZmYx-J5Kzu6Upve%^qBo31P", "n": [ { "c": 3, "d": "Embedded HTTP or WebSocket URL", "i": "micro-behaviors/communications/http/url/domain::http-url-binary", "o": 43016, "z": 24, "cf": 0.699999988079071 } ], "ln": 42952 }, { "b": "0000000000000000000000000000000000000000000000rr9100000000000sG8i00000yJ19iz!@#pgbZ:sh.E9AeIO\u003e\u0026v(c4}vpsg^xF}X1wmYj)x8?]i9rxV!@wP48s]XK9\u003egl[e1I*@B[j+5b761sm00000O1690\u00263N)%PJ}KZKWT}pj=c5\u0026IS6plQqCMjMBr:}UKh\u003c/)8.z)uVw\u003e9.Bl1lgccri=y)s*3D{9PK4mNUM+I6QkR4\u003cXUo6QPwR6DQLDzGuJ82QHXQ)n{spfakFFz3@qmXnla8+MXu%9\u003c[rd/@O4yEaWCuv}*j$v\u003etg\u003e/PI\u003ev.uWPmI!?Kzknr^h=](QmL!sV@D+#}5FtudAw\u003c5dR+d2\u0026i2ly2DbW@Pgqybr7?fYodHP@ZdW\u0026lf}jhqOR}XZwFQ\u003eU!)OkZ10yw{GAMNkTY7Rq74-IPQt0VlCvtzFufru\u003cZ(O6\u0026rCej#6#tU\u003cn(OI\u0026Du9B\u003cX*3.\u003e!$wkAQGyaKb32QZ\u003e.c#rz:YPI+i@.%c)F\u003c9w:=XAcSJHIycjY)!?Jr*rTRC2VMsxbb5*$8Xh{4Y!xq[V9VsTu[v(Kmdi2P1\u003em4zfn/kAE(T5#OvgYS1w@ZWW2H(\u003eJo.E0%KtL3y][b?/3pSU)LIclj?TVRQR1R\u0026}H+H#\u0026AO(+4L/AHV0qb@H[tJ-n=)uO.X}fIVpJ-/Y:)Tpy@[T\u0026v}DglGc5Ds.d\u00264+U.yF{8zEa2L443tNU\u003e*M/lnxECd@=\u0026Y?TomCm:\u0026[\u003eF%pChBBGbu", "n": [ { "c": 2, "d": ".gnu_debuglink reference present", "i": "metadata/build/debug::elf-debuglink", "o": 65560, "z": 37, "cf": 1.0 } ], "ln": 65504 }, { "b": "008\u003c-M}$09xzR-g00004sY$!TB7/SpA=+-004@ecBy^7qzGNNvB.LV5eOO.}e[]iBwPz.\u0026e[Y6Ae[!WmxAfU}D2vXGz2=h0D2vXBASv.8zGNNPwPz\u003caz/bLcxkR\u0026AC4CYnx(v(@ASv.jwO+^cwo\u00264)e]\u003eJtvj(InBo0}lwO=xtwo\u00264)e[]iqBo0}nwQ5p%e[O*nx-G=az!9o#ve}]\u003exKtv(vqPN.xA", "n": [ { "c": 2, "d": "ELF dynstr section name", "i": "metadata/binary/linking/runtime::elf-dynstr-section-name", "o": 67428, "z": 7, "cf": 1.0 }, { "c": 2, "d": "ELF dynsym section name", "i": "metadata/binary/linking/runtime::elf-dynsym-section-name", "o": 67420, "z": 7, "cf": 1.0 }, { "c": 2, "d": "ELF interpreter section name", "i": "metadata/binary/linking/runtime::elf-interpreter-section-name", "o": 67402, "z": 7, "cf": 1.0 } ], "ln": 67354 }, { "b": "By^7zvpK7YxjR5}x(mTbuTW$}vr?\u00269w[=c%uTW$}vr?\u00269wmoN*e]\u003eJte]\u003e\u003ege[xlBvqPZ*04}]5Bo0}7vrt]Te]+#RwPz\u003caz/bLcvSMO\u003ce[Y6AuU0.SB.tJ8zFGk8xkR\u003c0wmYj)xjLB)ve{oc000000000000000000000000000000000000000000000000000000000000000000000000000000003JHeb2lj-70SSi200000?#S(U00000?#S(U00", "n": [ { "c": 2, "d": "ELF dynamic section name", "i": "metadata/binary/linking/runtime::elf-dynamic-section-name", "o": 67628, "z": 8, "cf": 1.0 }, { "c": 2, "d": "ELF .gnu_debugdata section (mini debug info)", "i": "micro-behaviors/data/embedded/payload/compression::gnu-debugdata-section", "o": 67679, "z": 14, "cf": 0.8999999761581421 } ], "ln": 67580 } ], "depth": 1, "facts": { "imp": [ [ "", "memmove" ], [ "", "open64" ], [ "", "ZN10QArrayData8allocateEPPS_xxxNS_16AllocationOptionE" ], [ "", "ZN7QString13toUtf8_helperERKS_" ], [ "", "ZN7QObject10timerEventEP11QTimerEvent" ], [ "", "ZN7Konsole11ViewManager25toggleActionsBasedOnStateEv" ], [ "", "ZNK15QDBusConnection9interfaceEv" ], [ "", "ZN7Konsole11Application25populateCommandLineParserEP18QCommandLineParser" ], [ "", "ZN7Konsole15KonsoleSettings4selfEv" ], [ "", "ZN9QMetaType14registerHelperEPKN9QtPrivate18QMetaTypeInterfaceE" ], [ "", "ZNK16KLocalizedString8toStringEv" ], [ "", "ZN12KConfigGroupD1Ev" ], [ "", "ZN12QApplication5styleEv" ], [ "", "ZNK11QMetaObject4castEPK7QObject" ], [ "", "ZNK12KConfigGroup9readEntryEPKcRK8QVariant" ], [ "", "ZN16KLocalizedString20setApplicationDomainERK10QByteArray" ], [ "", "ZdlPv" ], [ "", "ZN8QVariantD1Ev" ], [ "", "ZN11KMainWindow13canBeRestoredEi" ], [ "", "ZN12QDBusMessageD1Ev" ], [ "", "ZN11QProxyStyle8unpolishEP7QWidget" ], [ "", "ZN10KAboutData9addCreditERK7QStringS2_S2_S2_RK4QUrl" ], [ "", "ZN5QIconD1Ev" ], [ "", "ZN12KDBusServiceC1E6QFlagsINS_13StartupOptionEEP7QObject" ], [ "", "ZN12KDBusService16staticMetaObjectE" ], [ "", "ZN18QCommandLineParserD1Ev" ], [ "", "ZN7QObject11connectImplEPKS_PPvS1_S3_PN9QtPrivate15QSlotObjectBaseEN2Qt14ConnectionTypeEPKiPK11QMetaObject" ], [ "", "ZN11QProxyStyle6polishER8QPalette" ], [ "", "ZNK11QProxyStyle15standardPaletteEv" ], [ "", "ZN10QTabWidget15setCurrentIndexEi" ], [ "", "ZN7Konsole11Application21slotActivateRequestedE5QListI7QStringERKS2_" ], [ "", "ZNK12KConfigGroup9readEntryEPKcS1_" ], [ "", "ZN15QDBusConnection10sessionBusEv" ], [ "", "ZN7QObject10childEventEP11QChildEvent" ], [ "", "ZN16KLocalizedStringD1Ev" ], [ "", "ZN10KAboutData9addAuthorERK7QStringS2_S2_S2_RK4QUrl" ], [ "", "ZN7Konsole11Application11newInstanceEv" ], [ "", "Z7ki18ndcPKcS0_S0_" ], [ "", "ZNK7Konsole10MainWindow11viewManagerEv" ], [ "", "ZN10KAboutData18setApplicationDataERKS_" ], [ "", "ZN7QWidget4showEv" ], [ "", "ZN12QDBusMessage12setArgumentsERK5QListI8QVariantE" ], [ "", "libc_start_main" ], [ "", "ZN10KAboutDataC1ERK7QStringS2_S2_S2_N13KAboutLicense10LicenseKeyES2_S2_S2_S2_" ], [ "", "ZN11QProxyStyle11qt_metacastEPKc" ], [ "", "ZN11KConfigBase5groupERK7QString" ], [ "", "gmon_start__" ], [ "", "ZN13KSharedConfig10openConfigERK7QString6QFlagsIN7KConfig8OpenFlagEEN14QStandardPaths16StandardLocationE" ], [ "", "ZN12KConfigGroup10writeEntryEPKcRK7QString6QFlagsIN11KConfigBase15WriteConfigFlagEE" ], [ "", "ZNK11QProxyStyle14itemPixmapRectERK5QRectiRK7QPixmap" ], [ "", "ZN10KAboutData21setOrganizationDomainERK10QByteArray" ], [ "", "ZN9QtPrivate20QStringList_containsEPK5QListI7QStringE11QStringViewN2Qt15CaseSensitivityE" ], [ "", "ZNK11QProxyStyle13layoutSpacingEN11QSizePolicy11ControlTypeES1_N2Qt11OrientationEPK12QStyleOptionPK7QWidget" ], [ "", "ZN18QCommandLineParser25setApplicationDescriptionERK7QString" ], [ "", "cxa_finalize" ], [ "", "ZN7QObject16disconnectNotifyERK11QMetaMethod" ], [ "", "ZNK8QVariant8toStringEv" ], [ "", "ZN7QObject11eventFilterEPS_P6QEvent" ], [ "", "ZN7Konsole19TabbedViewContainer16staticMetaObjectE" ], [ "", "ZN7Konsole11ApplicationD1Ev" ], [ "", "ZN7Konsole11ApplicationC1E14QSharedPointerI18QCommandLineParserERK5QListI7QStringE" ], [ "", "ZN12QApplication4execEv" ], [ "", "ZN8QVariantC1E9QMetaTypePKv" ], [ "", "ZN7QString13fromLocal8BitE14QByteArrayView" ], [ "", "strlen" ], [ "", "Z20qEnvironmentVariablePKc" ], [ "", "ZNK11QProxyStyle21hitTestComplexControlEN6QStyle14ComplexControlEPK19QStyleOptionComplexRK6QPointPK7QWidget" ], [ "", "ZN7QObject11customEventEP6QEvent" ], [ "", "ZN11KMainWindow7restoreEib" ], [ "", "ZN18QCommandLineParser7processERK5QListI7QStringE" ], [ "", "ZNK11QProxyStyle11pixelMetricEN6QStyle11PixelMetricEPK12QStyleOptionPK7QWidget" ], [ "", "ZN7Konsole11Application16getCustomCommandER5QListI7QStringE" ], [ "", "ZN9QMetaType7convertES_PKvS_Pv" ], [ "", "ZN16QCoreApplication4selfE" ], [ "", "ZN15QGuiApplication13setWindowIconERK5QIcon" ], [ "", "ZdlPvm" ], [ "", "ZN4QUrlD1Ev" ], [ "", "ZN10KAboutData18processCommandLineEP18QCommandLineParser" ], [ "", "ZNK11QProxyStyle14standardPixmapEN6QStyle14StandardPixmapEPK12QStyleOptionPK7QWidget" ], [ "", "ZN18QCommandLineParserC1Ev" ], [ "", "ZN9QtPrivate25QMetaTypeInterfaceWrapperIiE8metaTypeE" ], [ "", "ZN7Konsole11Application13newMainWindowEv" ], [ "", "ZN12KConfigGroup10writeEntryEPKcRK8QVariant6QFlagsIN11KConfigBase15WriteConfigFlagEE" ], [ "", "ZN10KAboutDataD1Ev" ], [ "", "ZN12KConfigGroupC1ERK28QExplicitlySharedDataPointerI13KSharedConfigERK7QString" ], [ "", "ZN11QMetaObject10ConnectionD1Ev" ], [ "", "ZNK11QProxyStyle14drawItemPixmapEP8QPainterRK5QRectiRK7QPixmap" ], [ "", "ZNK11QProxyStyle16sizeFromContentsEN6QStyle12ContentsTypeEPK12QStyleOptionRK5QSizePK7QWidget" ], [ "", "ZN10KIconTheme9initThemeEv" ], [ "", "Z7qputenvPKc14QByteArrayView" ], [ "", "ZNK10KAboutData16shortDescriptionEv" ], [ "", "ZTI11QProxyStyle" ], [ "", "ZN13KStyleManager9initStyleEv" ], [ "", "ZN5QIcon9fromThemeERK7QString" ], [ "", "ZN12KDBusService17activateRequestedERK5QListI7QStringERKS1_" ], [ "", "close" ], [ "", "ZN7QString10fromLatin1E14QByteArrayView" ], [ "", "ZNK11QProxyStyle13drawPrimitiveEN6QStyle16PrimitiveElementEPK12QStyleOptionP8QPainterPK7QWidget" ], [ "", "ZNK11QProxyStyle18drawComplexControlEN6QStyle14ComplexControlEPK19QStyleOptionComplexP8QPainterPK7QWidget" ], [ "", "ZNK12QDBusMessage9argumentsEv" ], [ "", "ZNK11QProxyStyle10metaObjectEv" ], [ "", "ZN10QArrayData10deallocateEPS_xx" ], [ "", "ZN7QObject13connectNotifyERK11QMetaMethod" ], [ "", "ZNK12QDBusMessage4typeEv" ], [ "", "ZNK11QMainWindow13centralWidgetEv" ], [ "", "ZNK12KConfigGroup6existsEv" ], [ "", "ITM_registerTMCloneTable" ], [ "", "ZN9QtPrivate20QStringList_containsEPK5QListI7QStringE13QLatin1StringN2Qt15CaseSensitivityE" ], [ "", "ZNK15QGuiApplication17isSessionRestoredEv" ], [ "", "ZN16QCoreApplication9argumentsEv" ], [ "", "ZN11QProxyStyle6polishEP7QWidget" ], [ "", "getauxval" ], [ "", "ZNK11QProxyStyle12standardIconEN6QStyle14StandardPixmapEPK12QStyleOptionPK7QWidget" ], [ "", "ITM_deregisterTMCloneTable" ], [ "", "qt_version_tag" ], [ "", "Znwm" ], [ "", "ZN15QDBusConnectionD1Ev" ], [ "", "ZNK11QProxyStyle11drawControlEN6QStyle14ControlElementEPK12QStyleOptionP8QPainterPK7QWidget" ], [ "", "ZN11QProxyStyleC2ERK7QString" ], [ "", "ZN12QApplication8setStyleEP6QStyle" ], [ "", "ZNK11QProxyStyle12itemTextRectERK12QFontMetricsRK5QRectibRK7QString" ], [ "", "ZN11QProxyStyle8unpolishEP12QApplication" ], [ "", "ZN11QProxyStyleD2Ev" ], [ "", "ZN8QVariantC1ERKS_" ], [ "", "ZNK11QProxyStyle19generatedIconPixmapEN5QIcon4ModeERK7QPixmapPK12QStyleOption" ], [ "", "ZN12QApplicationC1ERiPPci" ], [ "", "abort" ], [ "", "ZNK12KConfigGroup6hasKeyEPKc" ], [ "", "ZN11QProxyStyle11qt_metacallEN11QMetaObject4CallEiPPv" ], [ "", "ZN8QVariantC1ERK7QString" ], [ "", "ZN11QProxyStyle5eventEP6QEvent" ], [ "", "ZNK11QProxyStyle9styleHintEN6QStyle9StyleHintEPK12QStyleOptionPK7QWidgetP16QStyleHintReturn" ], [ "", "ZN11QProxyStyle6polishEP12QApplication" ], [ "", "ZN9QtPrivate25QMetaTypeInterfaceWrapperIbE8metaTypeE" ], [ "", "ZNK10QTabWidget5countEv" ], [ "", "ZNK11QProxyStyle14subElementRectEN6QStyle10SubElementEPK12QStyleOptionPK7QWidget" ], [ "", "cxa_atexit" ], [ "", "ZNK11QProxyStyle12drawItemTextEP8QPainterRK5QRectiRK8QPalettebRK7QStringNS5_9ColorRoleE" ], [ "", "ZTVN10__cxxabiv120__si_class_type_infoE" ], [ "", "ZN12KConfigGroup11deleteEntryEPKc6QFlagsIN11KConfigBase15WriteConfigFlagEE" ], [ "", "ZN4QUrlC1Ev" ], [ "", "ZN13KWindowSystem17isPlatformWaylandEv" ], [ "", "ZN10QByteArrayC1EPKcx" ], [ "", "ZNK15QDBusConnection4callERK12QDBusMessageN5QDBus8CallModeEi" ], [ "", "stack_chk_guard" ], [ "", "ZN12QDBusMessage16createMethodCallERK7QStringS2_S2_S2_" ], [ "", "ZN12KDBusServiceD1Ev" ], [ "", "ZNK6QStyle4nameEv" ], [ "", "stack_chk_fail" ], [ "", "ZN6KCrash10initializeEv" ], [ "", "ZNK11QProxyStyle14subControlRectEN6QStyle14ComplexControlEPK19QStyleOptionComplexNS0_10SubControlEPK7QWidget" ], [ "", "ZN10KAboutData16setupCommandLineEP18QCommandLineParser" ], [ "", "ZN10QArrayData19reallocateUnalignedEPS_PvxxNS_16AllocationOptionE" ] ], "sec": [ [ ".note.gnu.build-id", 736, 36, 4.25, "alloc" ], [ ".interp", 772, 27, 4.21, "alloc" ], [ ".gnu.hash", 800, 28, 0.49, "alloc" ], [ ".dynsym", 832, 3744, 1.18, "alloc" ], [ ".dynstr", 4576, 7165, 5.35, "alloc" ], [ ".gnu.version", 11742, 312, 1.69, "alloc" ], [ ".gnu.version_r", 12056, 304, 3.05, "alloc" ], [ ".rela.dyn", 12360, 1128, 1.81, "alloc" ], [ ".rela.plt", 13488, 3360, 2.02, "alloc,info_link" ], [ ".relr.dyn", 16848, 24, 2.28, "alloc" ], [ ".init", 16872, 28, 3.99, "alloc,executable" ], [ ".plt", 16912, 3392, 4.72, "alloc,executable" ], [ ".text", 20352, 19172, 6.05, "alloc,executable" ], [ ".fini", 39524, 24, 3.72, "alloc,executable" ], [ ".rodata", 39552, 3651, 3.97, "alloc" ], [ ".eh_frame_hdr", 43204, 212, 4.03, "alloc" ], [ ".eh_frame", 43416, 1136, 4.86, "alloc" ], [ ".note.gnu.property", 44552, 32, 1.69, "alloc" ], [ ".note.ABI-tag", 44584, 32, 1.56, "alloc" ], [ ".note.package", 44616, 144, 4.87, "alloc" ], [ ".init_array", 63080, 16, 1.31, "write,alloc" ], [ ".fini_array", 63096, 8, 1.06, "write,alloc" ], [ ".data.rel.ro", 63104, 328, 0.4, "write,alloc" ], [ ".dynamic", 63432, 848, 1.55, "write,alloc" ], [ ".got", 64280, 1256, 1.03, "write,alloc" ], [ ".data", 65536, 8, 0.54, "write,alloc" ], [ ".qtversion", 65544, 16, 0.99, "write,alloc" ], [ ".gnu_debuglink", 65560, 44, 4.66, "" ], [ ".gnu_debugdata", 65604, 1768, 7.87, "" ], [ ".shstrtab", 67372, 322, 4.3, "" ] ], "metrics": { "elf": { "bits": 64.0, "entry": 27264.0, "has_got": 1.0, "has_plt": 1.0, "has_note": 1.0, "note_count": 4.0, "nx_enabled": 1.0, "has_dt_relr": 1.0, "dynrel_count": 0.0, "dynsym_count": 156.0, "has_build_id": 1.0, "has_eh_frame": 1.0, "has_gnu_hash": 1.0, "stack_canary": 1.0, "symtab_count": 0.0, "dynrela_count": 47.0, "has_debuglink": 1.0, "little_endian": 1.0, "dt_flags_1_raw": 134217729.0, "pltreloc_count": 140.0, "build_id_length": 20.0, "dt_versym_count": 156.0, "has_aarch64_bti": 1.0, "has_aarch64_pac": 1.0, "executable_stack": 0.0, "fini_array_count": 1.0, "init_array_count": 2.0, "wx_segment_count": 0.0, "program_header_count": 12.0, "has_direct_loader_dep": 1.0, "gnu_stack_section_absent": 0.0, "load_segment_max_file_size": 44760.0, "stripped_but_symtab_present": 0.0, "load_segment_max_memory_size": 44760.0, "section_relocation_group_count": 2.0, "stripped_metadata_section_count": 8.0 }, "file": { "size": 69744.0, "entropy": 4.47, "size_bytes": 69744.0 }, "binary": { "is_pie": 1.0, "has_overlay": 1.0, "is_stripped": 1.0, "code_entropy": 5.85, "data_entropy": 1.13, "overlay_size": 2050.0, "string_count": 333.0, "overlay_ratio": 0.03, "overall_entropy": 4.47, "overlay_entropy": 1.49, "entropy_variance": 3.56, "avg_string_length": 28.66, "max_string_length": 125.0, "peak_region_bytes": 2048.0, "code_to_data_ratio": 0.9, "peak_region_entropy": 7.73, "string_length_stddev": 23.22, "largest_section_ratio": 0.27, "sentence_string_count": 16.0, "sentence_string_ratio": 0.05, "high_entropy_string_count": 0.0 }, "imports": { "count": 153.0 }, "sections": { "count": 32.0, "code_size": 22616.0, "entropy_max": 7.87, "entropy_mean": 2.98, "name_entropy": 4.25, "writable_count": 8.0, "executable_count": 4.0, "nonstandard_count": 11.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 18.0 } } }, "id": 1, "mol": "H(Cm)Md(Bi)", "path": "konsole-26.07.90-1.fc45.aarch64.rpm!!usr/bin/konsole", "pid": 0, "risk": 2, "sha": "5ec2a990be5050a09526014a39ce828969af62d9ce4271aa663239983e6943f5", "size": 69744, "traits": [ { "id": "metadata/binary/linking/runtime::library-loader-dep", "conf": 1.0, "crit": 3, "desc": "ELF directly depends on the dynamic loader", "spans": [ [ 0, 32 ] ] }, { "id": "metadata/binary/linking/runtime::dynamic-loader-needed", "conf": 0.699999988079071, "crit": 3, "desc": "ELF needs the Linux dynamic loader" }, { "id": "metadata/file/profile/language::lang-english--atom-1", "conf": 0.800000011920929, "crit": 2, "desc": "Contains common English function words", "spans": [ [ 40562, 3 ], [ 41015, 3 ] ] }, { "id": "metadata/binary/linking/runtime::glibc-needed", "conf": 1.0, "crit": 3, "desc": "ELF depends on glibc" }, { "id": "metadata/file/profile/language::lang-english--atom-2", "conf": 0.800000011920929, "crit": 2, "desc": "Contains common English function words", "spans": [ [ 39646, 3 ] ] }, { "id": "micro-behaviors/communications/http/url/domain::http-url-binary", "atk": "T1071.001", "mbc": "C0002", "conf": 0.699999988079071, "crit": 3, "desc": "Embedded HTTP or WebSocket URL", "spans": [ [ 43016, 24 ] ] } ], "type": "elf" }, { "ctx": [ { "b": "boXZ.B8\u0026{yx(kOBxBk%\u003eboOadxLzJgw[=6)azC)tx(k5nxK@r9BZ/f3v\u003c2r2zddc@e^.}garS@)v@Dj3vqYQcy?W=#aARKuy-)?ray/7[zF9J6Bzbkdv%8*jwO#PjBywSaB0bBxz!rZ1wGU]gBzkVhB1N!A3l{VorDzOYwJy@Hz/fSmy?mNaz!rZ1wGSgnAcb/jzASeKy\u0026%q[j8Y7Wx(v(LC42ifwJIH%e)PUdbmkUravQJ-ze:r5iV]!=z/fSmy?mNaz!rZ1wGSf:z!%ujq!6GLzdL\u003eixLzN1pI@HnvpK7mrafl6z!%ujjTiA=fFCgma$1HSx(4O", "ln": 0, "col": 1, "line": 1 }, { "b": "y\u0026sunv}YB\u003cwGVbpwN(]$zxJCiA=L-eBrCWlvJYx5Bz\u0026p6xLzN1pI@HnvpK6}vqYP#Bzbkdrafl6z!%uj3l{VoBz\u0026pxwN({4zxK4mwGUP3C}GBG3l{Vopes?TiV}ynx(+zrv@=p5BrBpTq=B(WB-5sCx([35zxJvgyJ19iz!@#cBywS3Bz\u0026pzvqxA%wObK=v@%sCra]?=v}Yp*xjRz{arUxtayPkdy?WD\u003eaA8dlC{4iEay/LmA+fcgaAR43e*9@ixK#ibByt", "ln": 280, "col": 17, "line": 10 }, { "b": "wg!#El2H@\u003cv}Yp*xjVcbCw?vDBrC47aAH$mwN({9zY\u003cduay]hcyC2@s3l{VomSiq\u0026Bzbkdw{4{aaz++kBrCHlaAIWAAbP=swN({4Acb/jzGu}ezE:(kvqH6$B2\u003cTMarR^Ye*a}FzGx-jwGSMRy?W%jePt-Gw[=6)ePt-GAaK6ix\u003eqt)boO9Kga\u003cW", "ln": 540, "col": 16, "line": 15 }, { "b": "B8L(aat2fYx(!wFAb](ex(4ujAb](owPz)bwPG45arR^HwN/y(ar\u00260parR^HwQ4{hatsdmx:Lg(axrF]aAhvnzGGFkB7]J4wGUL]xM22cB0bvsBrCKvA=+-0y?i}#azt\u003esAc15[fk#5yB1RxIwO#d3z/{1Kz/PFzz/fx9zE)^fvSKgRfGz3Kh8vlMflE", "ln": 1175, "col": 15, "line": 33 } ], "depth": 1, "facts": { "imp": [ [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "exit" ], [ "", "printf" ] ], "tgt": [ "echo", "exit", "printf" ], "metrics": { "ast": { "op.eq": 1, "op.lnot": 1, "max_depth": 6, "call_count": 10, "node_count": 116, "op_density.eq": 0.01, "op_density.lnot": 0.01 }, "file": { "size": 1371, "entropy": 4.76 }, "text": { "lines": 40, "top_char": 101, "max_ws_run": 7, "digit_ratio": 0.03, "space_count": 222, "char_entropy": 4.76, "unique_chars": 61, "top_char_null": 0, "escape_density": 0.07, "string_density": 0.25, "top_char_ratio": 0.08, "avg_line_length": 33.27, "max_line_length": 84, "empty_line_ratio": 0.08, "last_line_length": 26, "whitespace_ratio": 0.19, "identifier_density": 0.57, "line_length_stddev": 28.85, "octal_escape_count": 1, "normalized_string_count": 1.58, "suspicious_comment_ratio": 0.12, "normalized_unique_identifiers": 0.94 }, "binary": { "peak_region_bytes": 1371, "peak_region_entropy": 4.74 }, "strings": { "bytes": 189, "count": 10, "avg_length": 18.9, "max_length": 60, "avg_entropy": 3.37, "empty_count": 4, "entropy_stddev": 1.14 }, "comments": { "chars": 985, "count": 25, "empty": 6, "lines": 19, "base64": 2, "high_entropy": 1, "to_code_ratio": 0.9, "url_in_comments": 2 }, "identifiers": { "count": 23, "unique": 5, "avg_length": 3.2, "max_length": 6, "min_length": 1, "avg_entropy": 1.32, "reuse_ratio": 0.22, "length_stddev": 1.94, "has_digit_ratio": 0.4, "single_char_count": 2, "single_char_ratio": 0.4, "all_lowercase_ratio": 0.6 } } }, "id": 2, "mol": "O(As)Md(Pa)", "path": "konsole-26.07.90-1.fc45.aarch64.rpm!!usr/bin/konsoleprofile", "pid": 0, "risk": 2, "sha": "546babd9407e10a0d0ea3c88406b12c660cd6d7764f726b71902d316b2a75958", "size": 1371, "traits": [ { "id": "metadata/lang/natural::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"", "spans": [ [ 35, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-2", "conf": 0.8, "crit": 1, "desc": "English function-word token \"and\"", "spans": [ [ 328, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "spans": [ [ 588, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-7", "conf": 0.8, "crit": 1, "desc": "English function-word token \"this\"", "spans": [ [ 19, 0 ] ] }, { "id": "metadata/package/files/dependency::os-image-root-file-path", "conf": 0.94, "crit": 3, "desc": "Root-level OS directory path" }, { "id": "objectives/anti-static/obfuscation/code-metrics/structure::sh-dense-eval-chains-unless-cond-1--rx-3", "atk": "T1027", "mbc": "B0032", "conf": 0.92, "crit": 3, "desc": "Command-line usage text marker", "spans": [ [ 128, 7 ] ] } ], "type": "shell" } ], "rev": "73866", "v": "8" } }