{ "llm": { "conf": 0.8302361, "grade": "benign", "model": "Qwen/Qwen3.6-27B", "review": false, "outcome": "benign", "interpretation": "Legitimate Linux system library package" }, "ml": { "v": "7", "eng": "2.2.0-rc.1", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.7574801, "rte": "az", "prob": 0.7574801 } ], "prob": 0.7574801, "skip": [ { "rte": "az/tar", "why": "unavailable" }, { "rte": "az/tar", "why": "unavailable" } ], "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.7574800848960876, "type": "apk_alpine" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.16987991333007812, "type": "elf" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.33140063285827637, "type": "json" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.37750354409217834, "type": "text" } ], "version": "v18.18", "analyzed_at": "2026-06-30T07:48:13Z" }, "path": "liburing-ffi-2.15-r0.apk", "raw": { "files": [ { "id": 0, "ctx": [ { "b": "abZy8010L00rqzlDW\u003c^fLhMl*E#n0H63oM(DIBQ0}]m}YKlX7pfuIDay%]CrnjV7pa@MLw", "n": [ { "c": 2, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "o": 0, "z": 1, "cf": 1.0 } ], "ln": 0 } ], "mol": "O(Er)H(Os)", "sha": "a82f6f7b8f08b16d95278aab6373093fdc9cab053f3b7ef9687bcb324f7a792f", "path": "liburing-ffi-2.15-r0.apk", "risk": 3, "size": 36942, "type": "apk_alpine", "facts": { "metrics": { "file": { "size": 36942.0, "entropy": 7.98, "size_bytes": 36942.0 }, "parse": { "error_count": 1.0 }, "binary": { "overall_entropy": 7.98, "peak_region_bytes": 36864.0, "peak_region_entropy": 7.83 } } }, "traits": [ { "id": "metadata/package/files/system-package::melange-pkginfo-generator", "conf": 0.8999999761581421, "crit": 1, "desc": "Melange-generated package metadata", "from": [ { "file": 3 } ] }, { "id": "metadata/package/files/system-package::alpine-apk-pkginfo", "conf": 0.9700000286102295, "crit": 2, "desc": "Alpine/Wolfi package info metadata", "from": [ { "off": 91, "file": 3, "line": 6 } ] }, { "id": "micro-behaviors/dylib/library/libc::libc-characteristic-cxa-finalize", "crit": 2, "desc": "libc characteristic cxa finalize", "from": [ { "file": 1 } ] }, { "id": "metadata/package/files/system-package::spdx-wolfi-apk-purl", "conf": 0.8999999761581421, "crit": 1, "desc": "Wolfi APK package URL in SPDX", "from": [ { "file": 2 } ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-origin-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package origin field", "from": [ { "file": 3 } ] }, { "id": "objectives/evasion/process/injection/memory::asm-manual-import-parsing-cond-2--inline-18287", "conf": 0.8999999761581421, "crit": 3, "desc": "High export-count binary context", "from": [ { "file": 1 } ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-version-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package version field", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/dylib/library/abi-graphics::cxx-abi-symbols-a", "conf": 0.800000011920929, "crit": 2, "desc": "C++ ABI symbols cluster A", "from": [ { "file": 1 } ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-package-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package name field", "from": [ { "file": 3 } ] }, { "id": "metadata/package/files/system-package::spdx-document-version", "conf": 0.8999999761581421, "crit": 1, "desc": "SPDX document version field" }, { "id": "metadata/package/files/system-package::wolfi-pkginfo-maintainer", "conf": 0.8999999761581421, "crit": 1, "desc": "Wolfi package maintainer field", "from": [ { "file": 3 } ] }, { "id": "metadata/package/files/system-package::spdx-melange-namespace", "conf": 0.8999999761581421, "crit": 1, "desc": "Melange SPDX document namespace" }, { "id": "metadata/build/artifact::elf-stripped-but-symtab-present", "conf": 0.6000000238418579, "crit": 3, "desc": "ELF stripped with .symtab present", "from": [ { "file": 1 } ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-basename", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package info file" }, { "id": "metadata/package/files/system-package::spdx-sbom-document", "conf": 0.9800000190734863, "crit": 2, "desc": "SPDX SBOM document", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/os/event/kernel/epoll::epoll-wait", "conf": 0.4000000059604645, "crit": 2, "desc": "epoll_wait function", "from": [ { "file": 1 } ] }, { "id": "metadata/package/files/system-package::spdx-apk-pkginfo-source", "conf": 0.8999999761581421, "crit": 1, "desc": "SPDX references APK DB package info", "from": [ { "file": 2 } ] }, { "id": "metadata/package/files/system-package::spdx-document-id", "conf": 0.8999999761581421, "crit": 1, "desc": "SPDX document identifier" }, { "id": "micro-behaviors/os/event/kernel/epoll::epoll-ctl", "conf": 0.4000000059604645, "crit": 2, "desc": "epoll_ctl function", "from": [ { "file": 1 } ] }, { "id": "metadata/package/files/system-package::spdx-melange-creator", "conf": 0.8999999761581421, "crit": 1, "desc": "Melange SPDX creator", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/dylib/library/libc::libc-internal-functions-b", "conf": 0.699999988079071, "crit": 2, "desc": "libc internal symbols cluster B", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/os/event/kernel/epoll::epoll-usage", "conf": 0.6499999761581421, "crit": 3, "desc": "Direct epoll event notification", "from": [ { "off": 13576, "file": 1 } ] } ] }, { "ctx": [ { "b": "E))420S-r400000000000@$H+0rr910000000000kMy=:00000UO3%p0000000000kMA+z3JJA(9SNhX0rr911on", "n": [ { "c": 3, "d": "Patterns associated with legitimate injectors to reduce FPs", "i": "objectives/evasion/process/injection/toolkit::legitimate-injector-patterns", "o": 0, "z": 22, "cf": 1.0 } ], "ln": 0 }, { "b": "A-t+2y\u0026si5raflLwDl7Av%zA?w[=c\u003ey?Xib0blvUB-Ihlxj2U3wP.M\u003ezeAZ20blvUB-Ihlxj2W[", "n": [ { "c": 3, "d": "Terminal socket exec helper context", "i": "micro-behaviors/process/fd/dup::unix-terminal-socket-exec-benign-context", "o": 9528, "z": 12, "cf": 0.949999988079071 } ], "ln": 9512 }, { "b": "x(mM\u003cAb]JeuU\u003cB$By/s\u0026x(vv3A+PA7uVp3%A9)f}z!%k%Cvtic0blvUB-Ihlxj2Q#wPh0*x(4v4uV*r#vru5Xx(vv3", "n": [ { "c": 3, "d": "Direct epoll event notification", "i": "micro-behaviors/os/event/kernel/epoll::epoll-usage", "o": 12714, "z": 24, "cf": 0.6499999761581421 } ], "ln": 12698 }, { "b": "uVf){zEESxuU0\u003e\u003ewN//Zx(vv3A+PA7uVp3%A9)f}z!%k%v@#I!x(vv3A+PA7uVp3%A9)N8z*2\u00269wNw[?w[CQ{A@Y[", "n": [ { "c": 2, "d": "epoll_ctl function", "i": "micro-behaviors/os/event/kernel/epoll::epoll-ctl", "o": 13576, "z": 23, "cf": 0.4000000059604645 } ], "ln": 13560 }, { "b": "b4kI4xLzN1v@#\u003clwG\u003ceVCSmP*hz=Ra00000000000000000000000000000000000000", "n": [ { "c": 3, "d": "Architecture detection strings", "i": "objectives/discovery/host/software::arch-detection", "o": 54513, "z": 6, "cf": 0.5 } ], "ln": 54497 }, { "b": "wPh0[yH?d1vrqGYA+e/Em[=GvlTIP3ga\u003eA:x(vv3A+PA7uVp3%A9)S%v%hi@B.(elA@", "n": [ { "c": 3, "d": "Network-capable library profile", "i": "objectives/supply-chain/trojanized/backdoor::network-library-profile", "o": 64562, "z": 5, "cf": 0.8999999761581421 } ], "ln": 64546 }, { "b": "BAhFivGn2[zGNNBvrl8Ze[xlBB9RQ5e[xlBB98B5e[Y6Ae{p/DB7]Mg04}]4BUm\u0026GA=U@kzEl]Oe[Y5", "n": [ { "c": 2, "d": "ELF dynstr section name", "i": "metadata/binary/linking/static::elf-dynstr-section-name", "o": 70094, "z": 7, "cf": 0.8999999761581421 }, { "c": 2, "d": "ELF dynsym section name", "i": "metadata/binary/linking/static::elf-dynsym-section-name", "o": 70086, "z": 7, "cf": 0.8999999761581421 } ], "ln": 70070 }, { "b": "A::j[e[O*nx\u003cUp?A::j[e[xlBvqPZ*04}!\u003cByte4vSMO\u003ce[n*pzdNQb000000000000000", "n": [ { "c": 2, "d": "ELF dynamic section name", "i": "metadata/binary/linking/static::elf-dynamic-section-name", "o": 70290, "z": 8, "cf": 0.8999999761581421 } ], "ln": 70274 } ], "depth": 1, "facts": { "exp": [ [ "io_uring_register" ], [ "io_uring_prep_fadvise" ], [ "io_uring_prep_writev_fixed" ], [ "io_uring_queue_init_mem" ], [ "io_uring_prep_mkdir" ], [ "io_uring_register_buffers_update_tag" ], [ "io_uring_prep_symlink" ], [ "io_uring_sq_ready" ], [ "io_uring_close_ring_fd" ], [ "io_uring_prep_connect" ], [ "io_uring_cqe_get_data64" ], [ "io_uring_buf_ring_advance" ], [ "io_uring_prep_send_set_addr" ], [ "io_uring_prep_pipe_direct" ], [ "io_uring_memory_size" ], [ "io_uring_get_probe" ], [ "io_uring_recvmsg_validate" ], [ "io_uring_register_sync_cancel" ], [ "io_uring_buf_ring_mask" ], [ "io_uring_submit" ], [ "io_uring_register_files_update" ], [ "io_uring_minor_version" ], [ "io_uring_prep_open" ], [ "io_uring_unregister_buf_ring" ], [ "io_uring_mlock_size" ], [ "io_uring_get_cqe" ], [ "io_uring_prep_splice" ], [ "io_uring_prep_cancel64" ], [ "io_uring_prep_socket_direct_alloc" ], [ "io_uring_prep_openat" ], [ "io_uring_submit_and_wait" ], [ "io_uring_get_sqe" ], [ "io_uring_prep_read" ], [ "io_uring_buf_ring_cq_advance" ], [ "io_uring_buf_ring_init" ], [ "io_uring_prep_uring_cmd128" ], [ "io_uring_prep_waitid" ], [ "LIBURING_2.10" ], [ "LIBURING_2.11" ], [ "io_uring_prep_timeout_update" ], [ "LIBURING_2.12" ], [ "LIBURING_2.13" ], [ "LIBURING_2.14" ], [ "io_uring_unregister_personality" ], [ "LIBURING_2.15" ], [ "io_uring_register_clock" ], [ "io_uring_prep_send_zc" ], [ "io_uring_prep_cmd_discard" ], [ "io_uring_prep_rename" ], [ "io_uring_setup_buf_ring" ], [ "io_uring_prep_socket_direct" ], [ "io_uring_prep_sendmsg_zc_fixed" ], [ "io_uring_recvmsg_cmsg_nexthdr" ], [ "io_uring_prep_getxattr" ], [ "io_uring_cqe_iter_next" ], [ "io_uring_cq_has_overflow" ], [ "io_uring_prep_multishot_accept" ], [ "io_uring_prep_readv2" ], [ "io_uring_prep_epoll_wait" ], [ "io_uring_prep_ftruncate" ], [ "io_uring_cqe_nr" ], [ "io_uring_prep_write" ], [ "io_uring_register_napi" ], [ "io_uring_prep_statx" ], [ "io_uring_recvmsg_cmsg_firsthdr" ], [ "io_uring_submit_and_get_events" ], [ "io_uring_prep_cancel_fd" ], [ "io_uring_prep_fixed_fd_install" ], [ "io_uring_prep_open_direct" ], [ "io_uring_prep_files_update" ], [ "io_uring_wait_cqe" ], [ "io_uring_clone_buffers" ], [ "io_uring_prep_openat2_direct" ], [ "io_uring_queue_init_params" ], [ "io_uring_memory_size_params" ], [ "io_uring_prep_symlinkat" ], [ "io_uring_prep_msg_ring_fd" ], [ "io_uring_prep_recv" ], [ "io_uring_prep_multishot_accept_direct" ], [ "io_uring_resize_rings" ], [ "io_uring_register_zcrx_ctrl" ], [ "io_uring_cq_eventfd_toggle" ], [ "io_uring_register_eventfd_async" ], [ "io_uring_cqe_iter_init" ], [ "io_uring_prep_shutdown" ], [ "io_uring_submit_and_wait_min_timeout" ], [ "io_uring_prep_fsetxattr" ], [ "io_uring_prep_send_bundle" ], [ "io_uring_prep_link" ], [ "io_uring_register_region" ], [ "io_uring_prep_unlink" ], [ "io_uring_prep_timeout_remove" ], [ "io_uring_major_version" ], [ "io_uring_wait_cqe_timeout" ], [ "io_uring_prep_socket" ], [ "io_uring_register_restrictions" ], [ "io_uring_queue_mmap" ], [ "io_uring_prep_fallocate" ], [ "io_uring_prep_write_fixed" ], [ "io_uring_queue_init" ], [ "io_uring_prep_openat_direct" ], [ "io_uring_enter" ], [ "io_uring_register_bpf_filter_task" ], [ "io_uring_prep_accept_direct" ], [ "io_uring_prep_read_multishot" ], [ "io_uring_sqring_wait" ], [ "io_uring_clone_buffers_offset" ], [ "io_uring_register_buf_ring" ], [ "io_uring_prep_send_zc_fixed" ], [ "io_uring_opcode_supported" ], [ "io_uring_prep_recvmsg" ], [ "io_uring_prep_cmd_sock" ], [ "io_uring_register_wait_reg" ], [ "io_uring_unregister_buffers" ], [ "io_uring_cq_eventfd_enabled" ], [ "io_uring_prep_close" ], [ "io_uring_prep_futex_wait" ], [ "io_uring_get_sqe128" ], [ "io_uring_register_buffers" ], [ "io_uring_prep_poll_add" ], [ "io_uring_register_probe" ], [ "io_uring_prep_pipe" ], [ "io_uring_prep_msg_ring_fd_alloc" ], [ "io_uring_set_iowait" ], [ "io_uring_register_query" ], [ "io_uring_prep_linkat" ], [ "io_uring_recvmsg_name" ], [ "io_uring_register_file_alloc_range" ], [ "io_uring_prep_recv_multishot" ], [ "io_uring_prep_tee" ], [ "io_uring_free_probe" ], [ "io_uring_unregister_iowq_aff" ], [ "io_uring_prep_mkdirat" ], [ "io_uring_sq_space_left" ], [ "io_uring_prep_futex_wake" ], [ "io_uring_cqe_seen" ], [ "io_uring_prep_sendmsg_zc" ], [ "io_uring_get_probe_ring" ], [ "io_uring_prep_setxattr" ], [ "io_uring_prep_renameat" ], [ "io_uring_prep_listen" ], [ "io_uring_wait_cqes_min_timeout" ], [ "io_uring_peek_cqe" ], [ "io_uring_prep_nop" ], [ "io_uring_prep_rw" ], [ "io_uring_prep_remove_buffers" ], [ "io_uring_setup" ], [ "io_uring_peek_batch_cqe" ], [ "io_uring_recvmsg_payload" ], [ "io_uring_prep_unlinkat" ], [ "io_uring_free_buf_ring" ], [ "io_uring_prep_provide_buffers" ], [ "io_uring_prep_madvise64" ], [ "io_uring_cqe_get_data" ], [ "io_uring_prep_madvise" ], [ "io_uring_ring_dontfork" ], [ "io_uring_prep_poll_update" ], [ "io_uring_register_buffers_tags" ], [ "io_uring_register_files_tags" ], [ "io_uring_prep_fadvise64" ], [ "io_uring_register_files" ], [ "io_uring_register_iowq_max_workers" ], [ "io_uring_prep_readv" ], [ "io_uring_sqe_set_flags" ], [ "io_uring_register_buffers_sparse" ], [ "io_uring_prep_futex_waitv" ], [ "io_uring_prep_writev" ], [ "io_uring_wait_cqe_nr" ], [ "io_uring_mlock_size_params" ], [ "io_uring_unregister_napi" ], [ "io_uring_unregister_eventfd" ], [ "io_uring_prep_cmd_getsockname" ], [ "io_uring_prep_close_direct" ], [ "io_uring_cq_ready" ], [ "io_uring_buf_ring_add" ], [ "io_uring_prep_bind" ], [ "io_uring_prep_sendto" ], [ "io_uring_prep_sync_file_range" ], [ "io_uring_sqe_set_data" ], [ "io_uring_cq_advance" ], [ "io_uring_recvmsg_payload_length" ], [ "io_uring_register_eventfd" ], [ "io_uring_prep_readv_fixed" ], [ "io_uring_prep_writev2" ], [ "io_uring_prep_uring_cmd" ], [ "io_uring_submit_and_wait_reg" ], [ "io_uring_prep_fsync" ], [ "io_uring_prep_nop128" ], [ "io_uring_queue_exit" ], [ "io_uring_prep_send" ], [ "io_uring_prep_epoll_ctl" ], [ "io_uring_enter2" ], [ "io_uring_register_ifq" ], [ "io_uring_register_personality" ], [ "io_uring_unregister_ring_fd" ], [ "io_uring_prep_msg_ring" ], [ "io_uring_prep_timeout" ], [ "io_uring_register_files_update_tag" ], [ "io_uring_submit_and_wait_timeout" ], [ "io_uring_prep_poll_remove" ], [ "io_uring_get_events" ], [ "io_uring_prep_recvmsg_multishot" ], [ "io_uring_prep_msg_ring_cqe_flags" ], [ "io_uring_register_bpf_filter" ], [ "io_uring_register_ring_fd" ], [ "io_uring_register_iowq_aff" ], [ "io_uring_sqe_set_data64" ], [ "io_uring_prep_sendmsg" ], [ "io_uring_check_version" ], [ "io_uring_enable_rings" ], [ "io_uring_sqe_set_buf_group" ], [ "io_uring_prep_fgetxattr" ], [ "io_uring_register_files_sparse" ], [ "io_uring_register_sync_msg" ], [ "io_uring_prep_link_timeout" ], [ "io_uring_prep_accept" ], [ "io_uring_buf_ring_available" ], [ "io_uring_prep_openat2" ], [ "LIBURING_2.4" ], [ "LIBURING_2.5" ], [ "LIBURING_2.6" ], [ "LIBURING_2.7" ], [ "io_uring_prep_poll_multishot" ], [ "LIBURING_2.8" ], [ "LIBURING_2.9" ], [ "io_uring_unregister_files" ], [ "io_uring_prep_cancel" ], [ "io_uring_wait_cqes" ], [ "io_uring_prep_read_fixed" ] ], "imp": [ [ "", "free" ], [ "", "ITM_deregisterTMCloneTable" ], [ "", "calloc" ], [ "", "gmon_start__" ], [ "", "ITM_registerTMCloneTable" ], [ "", "cxa_finalize" ] ], "sec": [ [ ".gnu.hash", 680, 2988, 4.5, "alloc" ], [ ".dynsym", 3672, 5784, 2.58, "alloc" ], [ ".dynstr", 9456, 5663, 4.29, "alloc" ], [ ".gnu.version", 15120, 482, 1.91, "alloc" ], [ ".gnu.version_d", 15608, 452, 2.79, "alloc" ], [ ".gnu.version_r", 16064, 32, 2.24, "alloc" ], [ ".rela.dyn", 16096, 168, 1.27, "alloc" ], [ ".rela.plt", 16264, 1512, 1.46, "alloc,info_link" ], [ ".init", 20480, 27, 4.24, "alloc,executable" ], [ ".plt", 20512, 1024, 4.25, "alloc,executable" ], [ ".plt.got", 21536, 16, 3.38, "alloc,executable" ], [ ".plt.sec", 21552, 1008, 3.75, "alloc,executable" ], [ ".text", 22592, 21117, 6.01, "alloc,executable" ], [ ".fini", 43712, 13, 3.24, "alloc,executable" ], [ ".rodata", 45056, 16, 0.99, "alloc,merge" ], [ ".eh_frame_hdr", 45072, 1932, 4.8, "alloc" ], [ ".eh_frame", 47008, 7340, 4.78, "alloc" ], [ ".note.gnu.property", 54352, 64, 1.91, "alloc" ], [ ".note.package", 54416, 108, 4.86, "alloc" ], [ ".init_array", 56240, 8, 0.54, "write,alloc" ], [ ".fini_array", 56248, 8, 1.06, "write,alloc" ], [ ".dynamic", 56256, 528, 1.62, "write,alloc" ], [ ".got", 56784, 560, 1.63, "write,alloc" ], [ ".data", 57344, 8, 0.54, "write,alloc" ], [ ".comment", 57352, 30, 4.02, "merge,strings" ], [ ".symtab", 57384, 6504, 2.6, "" ], [ ".strtab", 63888, 6161, 4.35, "" ], [ ".shstrtab", 70049, 270, 4.22, "" ] ], "metrics": { "elf": { "bits": 64.0, "entry": 0.0, "has_got": 1.0, "has_plt": 1.0, "has_note": 1.0, "relacount": 3.0, "has_symtab": 1.0, "note_count": 2.0, "nx_enabled": 1.0, "has_cet_ibt": 1.0, "dynrel_count": 0.0, "dynsym_count": 241.0, "has_eh_frame": 1.0, "has_gnu_hash": 1.0, "symtab_count": 271.0, "dynrela_count": 7.0, "has_cet_shstk": 1.0, "little_endian": 1.0, "dt_flags_1_raw": 1.0, "pltreloc_count": 63.0, "dt_versym_count": 241.0, "executable_stack": 0.0, "fini_array_count": 1.0, "init_array_count": 1.0, "wx_segment_count": 0.0, "comment_entry_count": 1.0, "program_header_count": 11.0, "comment_distinct_count": 1.0, "gnu_stack_section_absent": 0.0, "load_segment_max_file_size": 23245.0, "stripped_but_symtab_present": 1.0, "load_segment_max_memory_size": 23245.0, "section_relocation_group_count": 2.0, "stripped_metadata_section_count": 5.0 }, "file": { "size": 72240.0, "entropy": 5.09, "size_bytes": 72240.0 }, "binary": { "is_pie": 0.0, "has_overlay": 1.0, "is_stripped": 0.0, "code_entropy": 5.83, "data_entropy": 1.61, "overlay_size": 1921.0, "string_count": 298.0, "overlay_ratio": 0.03, "overall_entropy": 5.09, "overlay_entropy": 1.52, "entropy_variance": 2.26, "avg_string_length": 21.4, "max_string_length": 89.0, "peak_region_bytes": 13312.0, "code_to_data_ratio": 0.95, "peak_region_entropy": 5.95, "string_length_stddev": 8.03, "largest_section_ratio": 0.29, "sentence_string_count": 1.0, "sentence_string_ratio": 0.0, "high_entropy_string_count": 0.0 }, "exports": { "count": 234.0 }, "imports": { "count": 6.0 }, "sections": { "count": 30.0, "code_size": 23205.0, "entropy_max": 6.01, "entropy_mean": 2.99, "name_entropy": 4.17, "writable_count": 6.0, "executable_count": 6.0, "nonstandard_count": 5.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } } }, "id": 1, "mol": "O(Er)H(Os)", "path": "liburing-ffi-2.15-r0.apk!!usr/lib/liburing-ffi.so.2.15", "risk": 3, "sha": "5fe52ff6a2d19998db56ae582fe1aac474d024510fc5521ba2ccb4d679ea5438", "size": 72240, "traits": [ { "id": "metadata/build/artifact::elf-stripped-but-symtab-present", "conf": 0.6000000238418579, "crit": 3, "desc": "ELF stripped with .symtab present", "spans": [ [ 0, 38 ] ] }, { "id": "micro-behaviors/os/event/kernel/epoll::epoll-ctl", "conf": 0.4000000059604645, "crit": 2, "desc": "epoll_ctl function", "spans": [ [ 13576, 23 ] ] }, { "id": "micro-behaviors/os/event/kernel/epoll::epoll-wait", "conf": 0.4000000059604645, "crit": 2, "desc": "epoll_wait function", "spans": [ [ 12714, 24 ] ] }, { "id": "micro-behaviors/dylib/library/libc::libc-characteristic-cxa-finalize", "crit": 2, "desc": "libc characteristic cxa finalize", "spans": [ [ 9528, 12 ] ] }, { "id": "objectives/evasion/process/injection/memory::asm-manual-import-parsing-cond-2--inline-18287", "conf": 0.8999999761581421, "crit": 3, "desc": "High export-count binary context", "spans": [ [ 0, 22 ] ] }, { "id": "micro-behaviors/os/event/kernel/epoll::epoll-usage", "conf": 0.6499999761581421, "crit": 3, "desc": "Direct epoll event notification", "spans": [ [ 12714, 24 ], [ 13576, 23 ] ] }, { "id": "micro-behaviors/dylib/library/libc::libc-internal-functions-b", "conf": 0.699999988079071, "crit": 2, "desc": "libc internal symbols cluster B", "spans": [ [ 9528, 12 ] ] }, { "id": "micro-behaviors/dylib/library/abi-graphics::cxx-abi-symbols-a", "conf": 0.800000011920929, "crit": 2, "desc": "C++ ABI symbols cluster A", "spans": [ [ 9528, 12 ] ] } ], "type": "elf" }, { "ctx": [ { "b": "DJ", "n": [ { "c": 2, "d": "SPDX SBOM document", "i": "metadata/package/files/system-package::spdx-sbom-document", "o": 0, "z": 1, "cf": 0.9800000190734863 } ], "ln": 1, "addr": 0 }, { "b": "arR\u003eHAaBh]wPz\u003caz/c:War\u003c-Xl%82@e\u0026aX5", "ln": 2, "addr": 2 }, { "b": "arR\u003esvrt{Kx\u003e7Z(B7DKRar\u003cfufFb1ifD@4", "ln": 3, "addr": 31 }, { "b": "arR^Hb5y$6wO#N2oLFM\u0026r+lq)x(v(kiV]R5e\u00262gaec", "ln": 8, "addr": 253 }, { "b": "arR^Hb4CU8vruBdB0rT/tl", "ln": 9, "addr": 287 }, { "b": "arR^HarR\u003ecz/oCMaz\u003eXavqYZ?asIy!e\u0026tErfEXg%", "n": [ { "c": 2, "d": "Melange-generated SPDX SBOM", "i": "metadata/package/files/system-package::melange-spdx-sbom", "o": 311, "z": 14, "cf": 0.9800000190734863 } ], "ln": 10, "addr": 305 }, { "b": "arR^HarR\u003e7A+w/#x)Kifx(v(Iavx*Jx(mNavrb)faw3DXa]", "ln": 11, "addr": 338 }, { "b": "arR^Ht}t", "ln": 12, "addr": 376 }, { "b": "arR^HarR^HarR\u003eGwObH]wO#0?lT+7Fxk.*ob03?\u003cp^EDwk$su}o*IJum[3r1ec", "ln": 41, "addr": 1297 }, { "b": "arR^HarR^HarR\u003eGwObH]wO#0?rc-B]b03?\u003cAclhqa$J", "ln": 42, "addr": 1347 }, { "b": "arR^HarR^HarR\u003eGwObH]wO#0?oMaAHBz(gziV]R=yIbXpAbdaJz!%31fkLuiB-IhlxdW.cx*sBaf/pL6fH5#^v}X2Ii5Ub4g*CeSfFUK%x(!xpz-@q.y?vx9", "n": [ { "c": 2, "d": "Wolfi APK SPDX SBOM", "i": "metadata/package/files/system-package::wolfi-apk-spdx-sbom", "o": 1382, "z": 81, "cf": 0.9800000190734863 } ], "ln": 43, "addr": 1382 }, { "b": "arR^HarR^HEe", "ln": 44, "addr": 1479 }, { "b": "arR^HarT@v", "ln": 45, "addr": 1489 }, { "b": "arR^HarR\u003esz*c8nz^^fIz!0i$x(v(kiV]RwpEd]Tmn^8RpFJ8+", "ln": 91, "addr": 3257 }, { "b": "arR^HarR\u003eux(4v4l2HaED3T4jb03\u0026UvqH0@ec", "ln": 92, "addr": 3298 }, { "b": "arR^HarR\u003eHz/{8gwL3=KzZ4j+b4j#3B.L(cwft\u00261v@2H=wGUY8w]w/7A=k!qk#ph%l{-{Sfd{6]m[DDBpA?s", "n": [ { "c": 1, "d": "SPDX references APK DB package info", "i": "metadata/package/files/system-package::spdx-apk-pkginfo-source", "o": 3349, "z": 44, "cf": 0.8999999761581421 } ], "ln": 93, "addr": 3328 }, { "b": "arR^HarR\u003eAx\u003e7Z(B7EZSzEWH9wmYo}iV]RwpEd]Tmn^8RpFJ8+", "ln": 94, "addr": 3396 }, { "b": "arR^HarR\u003eAx\u003e7Z(B7E:Jv@bN]wN(#Car\u0026jdnMl*dqxOU6p!SC@e?[}@AXh9oBy/Fwa$J", "ln": 95, "addr": 3437 }, { "b": "arR^HarR^HarR\u003eGwObH]wO#0?oMaAHBz(gziV]R=yIbXpAbdaJz!%31fkLuiB-IhlxdW.cx*sBaf/pL6fH5#^v}X2Ii5Ub4g*CeSfFUL8A+Pf2zAR/IvS=Z9zF7c", "n": [ { "c": 1, "d": "Wolfi APK package URL in SPDX", "i": "metadata/package/files/system-package::spdx-wolfi-apk-purl", "o": 3697, "z": 84, "cf": 0.8999999761581421 } ], "ln": 102, "addr": 3697 }, { "b": "arR^HarR^HEe", "ln": 103, "addr": 3797 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 5318.0, "entropy": 5.13, "size_bytes": 5318.0 }, "json": { "parsed_bytes": 5318.0, "parse_limit_bytes": 76800.0 }, "binary": { "overall_entropy": 5.13, "peak_region_bytes": 5318.0, "peak_region_entropy": 5.24 } } }, "id": 2, "path": "liburing-ffi-2.15-r0.apk!!var/lib/db/sbom/liburing-ffi-2.15-r0.spdx.json", "risk": 1, "sha": "92fa476f94645336ee112b7e5b1197d093c70a5c9a8e44c0c651c34f14ead0f8", "size": 5318, "traits": [ { "id": "metadata/package/files/system-package::spdx-melange-namespace", "conf": 0.8999999761581421, "crit": 1, "desc": "Melange SPDX document namespace" }, { "id": "metadata/package/files/system-package::spdx-document-id", "conf": 0.8999999761581421, "crit": 1, "desc": "SPDX document identifier" }, { "id": "metadata/package/files/system-package::spdx-melange-creator", "conf": 0.8999999761581421, "crit": 1, "desc": "Melange SPDX creator", "spans": [ [ 311, 14 ] ] }, { "id": "metadata/package/files/system-package::spdx-apk-pkginfo-source", "conf": 0.8999999761581421, "crit": 1, "desc": "SPDX references APK DB package info", "spans": [ [ 3349, 44 ] ] }, { "id": "metadata/package/files/system-package::spdx-document-version", "conf": 0.8999999761581421, "crit": 1, "desc": "SPDX document version field" }, { "id": "metadata/package/files/system-package::spdx-wolfi-apk-purl", "conf": 0.8999999761581421, "crit": 1, "desc": "Wolfi APK package URL in SPDX", "spans": [ [ 1382, 81 ], [ 1413, 14 ], [ 3697, 84 ] ] }, { "id": "metadata/file/format::valid", "conf": 0.6000000238418579, "crit": 2, "desc": "JSON data format", "spans": [ [ 0, 30 ] ] }, { "id": "metadata/package/files/system-package::spdx-sbom-document", "conf": 0.9800000190734863, "crit": 2, "desc": "SPDX SBOM document" }, { "id": "metadata/package/files/system-package::melange-spdx-sbom", "conf": 0.9800000190734863, "crit": 2, "desc": "Melange-generated SPDX SBOM", "spans": [ [ 311, 14 ] ] }, { "id": "metadata/package/files/system-package::wolfi-apk-spdx-sbom", "conf": 0.9800000190734863, "crit": 2, "desc": "Wolfi APK SPDX SBOM", "spans": [ [ 1382, 81 ], [ 1413, 14 ], [ 3349, 44 ], [ 3697, 84 ] ] } ], "type": "json" }, { "ctx": [ { "b": "boPG/zE)\u0026%By!#9vTf8kwO+^)xjR", "n": [ { "c": 2, "d": "Melange-generated APK package info", "i": "metadata/package/files/system-package::melange-generated-apk-pkginfo", "o": 0, "z": 22, "cf": 0.9800000190734863 } ], "ln": 1, "addr": 0 }, { "b": "Abf97vqPM#jS[MPvS=Z9zF7Lkw[.", "n": [ { "c": 2, "d": "Wolfi APK package info metadata", "i": "metadata/package/files/system-package::wolfi-apk-pkginfo", "o": 23, "z": 22, "cf": 0.9800000190734863 } ], "ln": 2, "addr": 23 }, { "b": "Abf9fwPw[RatLM7h7-\u00265", "n": [ { "c": 2, "d": "Alpine/Wolfi package info metadata", "i": "metadata/package/files/system-package::alpine-apk-pkginfo", "o": 46, "z": 16, "cf": 0.9700000286102295 } ], "ln": 3, "addr": 46 }, { "b": "vrb\u003c\u003eauZ\u0026(i5Ub4gY", "ln": 4, "addr": 63 }, { "b": "B7]@iauZ\u00264fG7WzfA", "ln": 5, "addr": 77 }, { "b": "z/PM8x(k4Raz++3B-Ihlx8", "n": [ { "c": 1, "d": "Alpine/Wolfi package origin field", "i": "metadata/package/files/system-package::alpine-pkginfo-origin-field", "o": 91, "z": 17, "cf": 0.8999999761581421 } ], "ln": 6, "addr": 91 }, { "b": "Abf8%wPIu7jS[MPvS=Z9zF78kxKL{)wftY5vSC)$C(", "ln": 7, "addr": 109 }, { "b": "B-IpvjS\u003c", "ln": 8, "addr": 143 }, { "b": "v@Dj3x(\u003eEXayWk^g+*WxgDmoMfK)0}vQ.kMi5$CWh-S\u0026Pg?nyNvkY#1vMd\u003cTh#", "ln": 9, "addr": 150 }, { "b": "zddc@Byw)3wPw[RaA}:uw[.", "n": [ { "c": 1, "d": "Wolfi package maintainer field", "i": "metadata/package/files/system-package::wolfi-pkginfo-maintainer", "o": 200, "z": 18, "cf": 0.8999999761581421 } ], "ln": 10, "addr": 200 }, { "b": "vS=y3wmPa\u003cwGTbUf/I6Eh-S-QfFJ", "ln": 11, "addr": 219 }, { "b": "y?Wx\u003czGxwijS)D\u003cr3j$mawtp4oF51Lf!Er:eO[\u003cqwPv", "ln": 12, "addr": 242 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 453.0, "entropy": 5.13, "size_bytes": 453.0 }, "binary": { "overall_entropy": 5.13, "peak_region_bytes": 453.0, "peak_region_entropy": 5.13 } } }, "id": 3, "path": "liburing-ffi-2.15-r0.apk!!.PKGINFO", "risk": 1, "sha": "6ae3ade464f8dac852e4bf37b0ef43d436296ef6e44f8a05e1b3f1c89fc418f9", "size": 453, "traits": [ { "id": "metadata/package/files/system-package::alpine-pkginfo-origin-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package origin field", "spans": [ [ 91, 17 ] ] }, { "id": "metadata/package/files/system-package::arch-pkgname-field", "conf": 0.9399999976158142, "crit": 1, "desc": "Arch pkgname metadata field", "spans": [ [ 23, 22 ] ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-version-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package version field", "spans": [ [ 46, 16 ] ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-package-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package name field", "spans": [ [ 23, 22 ] ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-basename", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package info file" }, { "id": "metadata/package/files/system-package::wolfi-pkginfo-maintainer", "conf": 0.8999999761581421, "crit": 1, "desc": "Wolfi package maintainer field", "spans": [ [ 200, 18 ] ] }, { "id": "metadata/package/files/system-package::melange-pkginfo-generator", "conf": 0.8999999761581421, "crit": 1, "desc": "Melange-generated package metadata", "spans": [ [ 0, 22 ] ] }, { "id": "metadata/package/files/system-package::alpine-apk-pkginfo", "conf": 0.9700000286102295, "crit": 2, "desc": "Alpine/Wolfi package info metadata", "spans": [ [ 23, 22 ], [ 46, 16 ], [ 91, 17 ] ] }, { "id": "metadata/package/files/system-package::melange-generated-apk-pkginfo", "conf": 0.9800000190734863, "crit": 2, "desc": "Melange-generated APK package info", "spans": [ [ 0, 22 ], [ 23, 22 ], [ 46, 16 ], [ 91, 17 ] ] }, { "id": "metadata/package/files/system-package::wolfi-apk-pkginfo", "conf": 0.9800000190734863, "crit": 2, "desc": "Wolfi APK package info metadata", "spans": [ [ 23, 22 ], [ 46, 16 ], [ 91, 17 ], [ 200, 18 ] ] } ], "type": "text" } ], "v": "8" } }