{ "ml": { "v": "7", "eng": "2.2.0-rc.1", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.00004752477, "rte": "az", "prob": 0.00004752477 } ], "prob": 0.00006962816, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.00006962815677979961, "type": "zst" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.00006962815677979961, "type": "elf" } ], "version": "v18.18", "analyzed_at": "2026-06-28T01:20:26Z" }, "path": "nfcsim.ko.zst", "raw": { "files": [ { "id": 0, "ctx": [ { "b": "d77-bwz8P{6AMt*G*vTeN8]/MPA!Bd[pk9:0s%\u0026kkM", "n": [ { "c": 2, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "o": 0, "z": 1, "cf": 1.0 } ], "ln": 0 } ], "mol": "O₂(AsC)", "sha": "9f2bd4889ae7066a155b5bda6b53651b55f3507634e75ef11eddd9c9be294a9a", "path": "nfcsim.ko.zst", "risk": 3, "size": 8863, "type": "zst", "facts": { "metrics": { "file": { "size": 8863.0, "entropy": 7.98, "size_bytes": 8863.0 }, "binary": { "overall_entropy": 7.98, "peak_region_bytes": 8863.0, "peak_region_entropy": 7.83 } } }, "traits": [ { "id": "objectives/command-and-control/channel/redundancy::multi-channel-diversity", "atk": "T1071", "mbc": "B0030", "conf": 0.8500000238418579, "crit": 3, "desc": "C2 infrastructure using multiple communication methods", "from": [ { "file": 1 } ] }, { "id": "objectives/anti-static/obfuscation/payload/code-in-data::nop-sled-in-data", "conf": 0.6499999761581421, "crit": 3, "desc": "Repeated NOP-run pattern in executable section", "from": [ { "file": 1 } ] }, { "id": "metadata/build/artifact::elf-stripped-but-symtab-present", "conf": 0.6000000238418579, "crit": 3, "desc": "ELF stripped with .symtab present", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/ip/literal::external-ipv4-binary", "conf": 0.8500000238418579, "crit": 2, "desc": "Hardcoded external IPv4 address", "from": [ { "file": 1 } ] }, { "id": "metadata/package/license::gpl-word", "conf": 0.699999988079071, "crit": 2, "desc": "GPL license reference", "from": [ { "file": 1 } ] } ] }, { "ctx": [ { "b": "E))420S-r400000000000rtp-0rr9100000000000000000000noK$k0000000000kMy=:002m:f90Q800000000", "n": [ { "c": 3, "d": "Recognized XOR-loop byte-pattern marker", "i": "objectives/anti-analysis/self-modify/runtime::xor-loop-pattern-recognized-marker", "o": 0, "z": 9, "cf": 0.8999999761581421 } ], "ln": 0 }, { "b": "00000000000000000000KDtM=KDtM=KDtM=KDtM=\u003eL$O.098NFm\u003c76MU-F?+05qnWIre1${a=Qi00000KDtM=KDtM=KDtM=KDtM=\u003eL$O.07-2raCGJia?mQ", "n": [ { "c": 3, "d": "Repeated NOP-run pattern in executable section", "i": "objectives/anti-static/obfuscation/payload/code-in-data::nop-sled-in-data", "o": 224, "z": 47, "cf": 0.6499999761581421 } ], "ln": 208 }, { "b": "1POJ50cwzd00000t1BI5sZaf%l0V=.t}%+Z:UAGz%3XVT\u003e(pX-0000000000000000002d0@", "n": [ { "c": 3, "d": "Dotted-quad PE version metadata marker", "i": "objectives/command-and-control/infrastructure/ip::ipv4-version-metadata-marker", "o": 3089, "z": 9, "cf": 0.9399999976158142 } ], "ln": 3073 }, { "b": "{a=Qi00000y?Wx\u003czGxwLm]h\u003eVC4CYnx(v(LfFk9XwmY*(A+PGmx(v(LpdvPHx(a%", "n": [ { "c": 3, "d": "Terminal socket exec helper context", "i": "micro-behaviors/process/fd/dup::unix-terminal-socket-exec-benign-context", "o": 4501, "z": 3, "cf": 0.949999988079071 } ], "ln": 4485 }, { "b": "wN]}1wNxK[zdNTdBo2VPB97\u00262yHpN+yHpWZx(0=!w[bgUx\u003eId4vqGp[zGor3x(!xcA:Ju*C4\u003eC$0aM", "n": [ { "c": 3, "d": "Stack protector/canary enabled", "i": "metadata/hardening/build::stack-protector", "o": 6226, "z": 14, "cf": 0.8999999761581421 } ], "ln": 6210 } ], "depth": 1, "facts": { "exp": [ [ "this_module" ], [ "cleanup_module" ], [ "init_module" ], [ "pfx_init_module" ], [ "pfx_cleanup_module" ] ], "imp": [ [ "", "nfc_digital_allocate_device" ], [ "", "msecs_to_jiffies" ], [ "", "consume_skb" ], [ "", "snprintf" ], [ "", "nfc_digital_free_device" ], [ "", "queue_work_on" ], [ "", "finish_wait" ], [ "", "kfree" ], [ "", "nfc_digital_register_device" ], [ "", "prepare_to_wait_event" ], [ "", "wake_up" ], [ "", "dynamic_dev_dbg" ], [ "", "fentry__" ], [ "", "x86_indirect_thunk_rax" ], [ "", "dump_stack" ], [ "", "printk" ], [ "", "ref_stack_chk_guard" ], [ "", "schedule_timeout" ], [ "", "stack_chk_fail" ], [ "", "queue_delayed_work_on" ], [ "", "init_wait_entry" ], [ "", "dev_err" ], [ "", "system_percpu_wq" ], [ "", "random_kmalloc_seed" ], [ "", "mutex_lock" ], [ "", "debugfs_remove" ], [ "", "x86_return_thunk" ], [ "", "init_waitqueue_head" ], [ "", "mutex_unlock" ], [ "", "cancel_delayed_work_sync" ], [ "", "kmalloc_cache_noprof" ], [ "", "cancel_work_sync" ], [ "", "delayed_work_timer_fn" ], [ "", "timer_init_key" ], [ "", "get_random_bytes" ], [ "", "ubsan_handle_load_invalid_value" ], [ "", "nfc_digital_unregister_device" ], [ "", "debugfs_create_u8" ], [ "", "debugfs_create_dir" ], [ "", "SCT__might_resched" ], [ "", "kmalloc_caches" ], [ "", "mutex_init_generic" ] ], "sec": [ [ "__jump_table", 64, 16, 0.0, "write,alloc" ], [ ".rela__jump_table", 20888, 72, 1.23, "info_link" ], [ "__patchable_function_entries", 80, 144, 0.0, "write,alloc" ], [ ".rela__patchable_function_entries", 20960, 432, 1.35, "info_link" ], [ ".text", 224, 2890, 4.96, "alloc,executable" ], [ ".rela.text", 21392, 3720, 2.53, "info_link" ], [ ".data", 3120, 180, 2.44, "write,alloc" ], [ ".rela.data", 25112, 240, 1.28, "info_link" ], [ ".rodata", 3304, 720, 4.54, "alloc" ], [ ".rela.rodata", 25352, 168, 1.45, "info_link" ], [ "__mcount_loc", 4024, 136, 0.0, "alloc" ], [ ".rela__mcount_loc", 25520, 408, 1.38, "info_link" ], [ ".exit.text", 4160, 100, 3.22, "alloc,executable" ], [ ".rela.exit.text", 25928, 216, 1.82, "info_link" ], [ ".init.text", 4264, 229, 4.14, "alloc,executable" ], [ ".rela.init.text", 26144, 480, 1.98, "info_link" ], [ ".modinfo", 4493, 208, 4.97, "alloc" ], [ ".exit.data", 4704, 8, 0.0, "write,alloc" ], [ ".rela.exit.data", 26624, 24, 0.5, "info_link" ], [ ".init.data", 4712, 8, 0.0, "write,alloc" ], [ ".rela.init.data", 26648, 24, 0.5, "info_link" ], [ "__dyndbg", 4720, 56, 0.26, "write,alloc" ], [ ".rela__dyndbg", 26672, 96, 1.23, "info_link" ], [ ".comment", 4776, 117, 4.05, "merge,strings" ], [ ".static_call_sites", 4893, 8, 0.0, "write,alloc" ], [ ".rela.static_call_sites", 26768, 48, 0.93, "info_link" ], [ ".retpoline_sites", 4901, 4, 0.0, "alloc" ], [ ".rela.retpoline_sites", 26816, 24, 0.98, "info_link" ], [ ".return_sites", 4905, 80, 0.0, "alloc" ], [ ".rela.return_sites", 26840, 480, 1.58, "info_link" ], [ ".call_sites", 4985, 408, 0.0, "alloc" ], [ ".rela.call_sites", 27320, 2448, 1.79, "info_link" ], [ ".note.gnu.build-id", 5396, 36, 4.25, "alloc" ], [ ".note.package", 5432, 108, 4.73, "alloc" ], [ "__version_ext_names", 5544, 767, 4.39, "alloc" ], [ "__version_ext_crcs", 6312, 172, 6.6, "alloc" ], [ "__versions", 6488, 2752, 2.64, "alloc" ], [ ".gnu.linkonce.this_module", 9240, 1280, 0.06, "write,alloc" ], [ ".rela.gnu.linkonce.this_module", 29768, 48, 1.05, "info_link" ], [ ".note.Linux", 10520, 48, 1.97, "alloc" ], [ ".BTF", 10568, 5568, 4.73, "" ], [ ".symtab", 16136, 2928, 1.77, "" ], [ ".strtab", 19064, 1822, 4.63, "" ], [ ".shstrtab", 29816, 462, 4.29, "" ] ], "metrics": { "elf": { "bits": 64.0, "entry": 0.0, "has_got": 0.0, "has_plt": 0.0, "has_note": 1.0, "has_symtab": 1.0, "note_count": 3.0, "nx_enabled": 1.0, "dynrel_count": 0.0, "dynsym_count": 0.0, "has_eh_frame": 0.0, "stack_canary": 1.0, "symtab_count": 122.0, "dynrela_count": 0.0, "little_endian": 1.0, "pltreloc_count": 0.0, "executable_stack": 0.0, "wx_segment_count": 0.0, "comment_entry_count": 3.0, "program_header_count": 0.0, "comment_distinct_count": 1.0, "gnu_stack_section_absent": 0.0, "load_segment_max_file_size": 0.0, "stripped_but_symtab_present": 1.0, "load_segment_max_memory_size": 0.0, "section_relocation_group_count": 16.0, "stripped_metadata_section_count": 5.0 }, "file": { "size": 34009.0, "entropy": 3.93, "size_bytes": 34009.0 }, "binary": { "is_pie": 0.0, "has_overlay": 1.0, "is_stripped": 0.0, "code_entropy": 4.85, "data_entropy": 0.31, "overlay_size": 3731.0, "string_count": 281.0, "overlay_ratio": 0.11, "avg_complexity": 1.57, "max_complexity": 19.0, "huge_func_count": 0.0, "leaf_func_count": 20.0, "overall_entropy": 3.93, "overlay_entropy": 3.03, "tiny_func_count": 34.0, "avg_basic_blocks": 2.9, "entropy_variance": 3.35, "avg_string_length": 16.64, "max_string_length": 90.0, "peak_region_bytes": 217.0, "code_to_data_ratio": 0.65, "total_basic_blocks": 122.0, "peak_region_entropy": 6.88, "string_length_stddev": 9.59, "largest_section_ratio": 0.16, "sentence_string_count": 13.0, "sentence_string_ratio": 0.05, "high_entropy_string_count": 0.0 }, "exports": { "count": 5.0 }, "imports": { "count": 42.0 }, "sections": { "count": 47.0, "code_size": 3219.0, "entropy_max": 6.6, "entropy_mean": 2.05, "name_entropy": 4.21, "writable_count": 9.0, "executable_count": 3.0, "nonstandard_count": 39.0, "executable_writable_count": 0.0 }, "functions": { "count": 42.0 }, "dependencies": { "count": 0.0 } } }, "id": 1, "mol": "O₂(AsC)", "path": "nfcsim.ko.zst!!nfcsim.ko", "risk": 3, "sha": "bdd6f80b7957587d1b30dd2f01dc6790be6b52f4d818e2e155601d56f72b2758", "size": 34009, "traits": [ { "id": "metadata/build/artifact::elf-stripped-but-symtab-present", "conf": 0.6000000238418579, "crit": 3, "desc": "ELF stripped with .symtab present", "spans": [ [ 0, 38 ] ] }, { "id": "objectives/anti-static/obfuscation/payload/code-in-data::nop-sled-in-data", "conf": 0.6499999761581421, "crit": 3, "desc": "Repeated NOP-run pattern in executable section", "spans": [ [ 224, 47 ] ] }, { "id": "metadata/package/license::gpl-word", "conf": 0.699999988079071, "crit": 2, "desc": "GPL license reference", "spans": [ [ 4501, 3 ] ] }, { "id": "micro-behaviors/communications/ip/literal::external-ipv4-binary", "conf": 0.8500000238418579, "crit": 2, "desc": "Hardcoded external IPv4 address", "spans": [ [ 3089, 9 ] ] }, { "id": "objectives/command-and-control/channel/redundancy::multi-channel-diversity", "atk": "T1071", "mbc": "B0030", "conf": 0.8500000238418579, "crit": 3, "desc": "C2 infrastructure using multiple communication methods", "spans": [ [ 3089, 9 ] ] } ], "type": "elf" } ], "v": "8" } }