{
  "ml": {
    "v": "7",
    "eng": "2.2.0-rc.1",
    "lvl": -1,
    "conf": 0,
    "mods": [
      {
        "cls": 0,
        "raw": 0.000056385994,
        "rte": "az",
        "prob": 0.000056385994
      }
    ],
    "prob": 0.000073750816,
    "files": [
      {
        "id": 0,
        "lvl": -1,
        "conf": 0,
        "prob": 0.00007375081622740254,
        "type": "zst"
      },
      {
        "id": 1,
        "lvl": -1,
        "conf": 0,
        "prob": 0.00007375081622740254,
        "type": "elf"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-06-28T01:32:16Z"
  },
  "path": "hid-steam.ko.zst",
  "raw": {
    "files": [
      {
        "id": 0,
        "ctx": [
          {
            "b": "d77-bQ}[R-0iA:iIN$X@koP9h1m:0tr*Jx*BD2$z}t",
            "n": [
              {
                "c": 2,
                "d": "Binary is not digitally signed",
                "i": "metadata/unsigned",
                "o": 0,
                "z": 1,
                "cf": 1.0
              }
            ],
            "ln": 0
          }
        ],
        "mol": "O₂(AsC)",
        "sha": "ad8cf9d66fdfe216a4ad83be4c6d74b6278071f80aed31dd8ede7a9899c0958d",
        "path": "hid-steam.ko.zst",
        "risk": 3,
        "size": 17303,
        "type": "zst",
        "facts": {
          "metrics": {
            "file": {
              "size": 17303.0,
              "entropy": 7.98,
              "size_bytes": 17303.0
            },
            "binary": {
              "overall_entropy": 7.98,
              "peak_region_bytes": 17303.0,
              "peak_region_entropy": 7.82
            }
          }
        },
        "traits": [
          {
            "id": "objectives/command-and-control/channel/deaddrop/steam::steam-summary-field",
            "atk": "T1102.001",
            "conf": 0.800000011920929,
            "crit": 3,
            "desc": "Steam profile summary/description field access",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "metadata/build/artifact::elf-stripped-but-symtab-present",
            "conf": 0.6000000238418579,
            "crit": 3,
            "desc": "ELF stripped with .symtab present",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "metadata/package/license::gpl-word",
            "conf": 0.699999988079071,
            "crit": 2,
            "desc": "GPL license reference",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "objectives/anti-static/obfuscation/payload/code-in-data::nop-sled-in-data",
            "conf": 0.6499999761581421,
            "crit": 3,
            "desc": "Repeated NOP-run pattern in executable section",
            "from": [
              {
                "file": 1
              }
            ]
          }
        ]
      },
      {
        "ctx": [
          {
            "b": "E))420S-r400000000000rtp-0rr9100000000000000000000UPA(C0000000000kMy=:002m:eDvs400000000",
            "n": [
              {
                "c": 3,
                "d": "Recognized XOR-loop byte-pattern marker",
                "i": "objectives/anti-analysis/self-modify/runtime::xor-loop-pattern-recognized-marker",
                "o": 0,
                "z": 12,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 0
          },
          {
            "b": "00000000000000000000KDtM=KDtM=KDtM=KDtM=\u003eL$O.097+?nqVCl\u003e(pX-01Qep0a]*}4\u003ccD800000KDtM=KDtM=KDtM=KDtM=\u003eL$O.098ND\u003cZ49J0000",
            "n": [
              {
                "c": 3,
                "d": "Repeated NOP-run pattern in executable section",
                "i": "objectives/anti-static/obfuscation/payload/code-in-data::nop-sled-in-data",
                "o": 392,
                "z": 47,
                "cf": 0.6499999761581421
              }
            ],
            "ln": 376
          },
          {
            "b": "az(4cwHO:CxK#67BzbkdxjkT*Aa9o1x(+zmz/^aozxK7ywDldYBzbPkjYlieA+Pf8aw#[",
            "n": [
              {
                "c": 2,
                "d": "Joystick, gamepad, or DirectInput keyword",
                "i": "micro-behaviors/hardware/input/gamepad::gamepad-input-keyword",
                "o": 17036,
                "z": 7,
                "cf": 0.949999988079071
              }
            ],
            "ln": 17020
          },
          {
            "b": "x(2ziz/4Vry?Wx\u003czGxwLm]h\u003eVwmY*(A+PGmx(v(Lnj=h(wo8ycwPw]9z/M$3vqH9#ax9w[vqNbOz/fVqz!%l3ASyf3v%hB7B7]MgjU[@Lf!#3Iixm",
            "n": [
              {
                "c": 3,
                "d": "Terminal socket exec helper context",
                "i": "micro-behaviors/process/fd/dup::unix-terminal-socket-exec-benign-context",
                "o": 17123,
                "z": 3,
                "cf": 0.949999988079071
              },
              {
                "c": 3,
                "d": "Steam profile summary/description field access",
                "i": "objectives/command-and-control/channel/deaddrop/steam::steam-summary-field",
                "o": 17127,
                "z": 38,
                "cf": 0.800000011920929
              }
            ],
            "ln": 17107
          },
          {
            "b": "z/{eez!ru=z/]@dA@YMOB97\u00262yHpN+yHpWZx(0=RuUBd:uVGZ\u003cx(!xcA:Ju$x)a6d0crBbBy/q@AaG",
            "n": [
              {
                "c": 3,
                "d": "Stack protector/canary enabled",
                "i": "metadata/hardening/build::stack-protector",
                "o": 20652,
                "z": 14,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 20636
          },
          {
            "b": "nKJLIl%\u0026qEoI4MGk#ZoWn(5O*r7PCI07/N=lQsyqlq*9GmpetQk$\u003e6AuSo]{m[l0CqVGxS",
            "n": [
              {
                "c": 2,
                "d": "Joystick, gamepad, or DirectInput keyword",
                "i": "micro-behaviors/hardware/input/gamepad::gamepad-input-keyword",
                "o": 30427,
                "z": 8,
                "cf": 0.949999988079071
              }
            ],
            "ln": 30411
          },
          {
            "b": "mmmbOmo0kTpdFU+mmHl-m)P\u003crp^EGRq=DsQoj7a.k%!mll\u0026ZdOr8=B:m{/d=m[uP^m)P\u0026",
            "n": [
              {
                "c": 2,
                "d": "Joystick, gamepad, or DirectInput keyword",
                "i": "micro-behaviors/hardware/input/gamepad::gamepad-input-keyword",
                "o": 30746,
                "z": 7,
                "cf": 0.949999988079071
              }
            ],
            "ln": 30730
          }
        ],
        "depth": 1,
        "facts": {
          "exp": [
            [
              "this_module"
            ],
            [
              "cleanup_module"
            ],
            [
              "init_module"
            ],
            [
              "pfx_init_module"
            ],
            [
              "pfx_cleanup_module"
            ]
          ],
          "imp": [
            [
              "",
              "input_allocate_device"
            ],
            [
              "",
              "list_add_valid_or_report"
            ],
            [
              "",
              "devm_kmalloc"
            ],
            [
              "",
              "hid_unregister_driver"
            ],
            [
              "",
              "rcu_read_lock"
            ],
            [
              "",
              "power_supply_register"
            ],
            [
              "",
              "hid_hw_start"
            ],
            [
              "",
              "queue_work_on"
            ],
            [
              "",
              "param_get_bool"
            ],
            [
              "",
              "hid_register_driver"
            ],
            [
              "",
              "input_unregister_device"
            ],
            [
              "",
              "memcpy"
            ],
            [
              "",
              "kfree"
            ],
            [
              "",
              "raw_spin_lock_irqsave"
            ],
            [
              "",
              "hid_allocate_device"
            ],
            [
              "",
              "hid_destroy_device"
            ],
            [
              "",
              "hid_hw_stop"
            ],
            [
              "",
              "fentry__"
            ],
            [
              "",
              "input_free_device"
            ],
            [
              "",
              "dump_stack"
            ],
            [
              "",
              "ref_stack_chk_guard"
            ],
            [
              "",
              "input_register_device"
            ],
            [
              "",
              "stack_chk_fail"
            ],
            [
              "",
              "queue_delayed_work_on"
            ],
            [
              "",
              "strnlen"
            ],
            [
              "",
              "dev_info"
            ],
            [
              "",
              "hid_alloc_report_buf"
            ],
            [
              "",
              "ubsan_handle_out_of_bounds"
            ],
            [
              "",
              "sized_strscpy"
            ],
            [
              "",
              "dev_err"
            ],
            [
              "",
              "synchronize_rcu"
            ],
            [
              "",
              "rcu_read_unlock"
            ],
            [
              "",
              "system_percpu_wq"
            ],
            [
              "",
              "mutex_lock"
            ],
            [
              "",
              "input_set_capability"
            ],
            [
              "",
              "hid_hw_open"
            ],
            [
              "",
              "param_set_bool"
            ],
            [
              "",
              "hid_hw_close"
            ],
            [
              "",
              "list_del_entry_valid_or_report"
            ],
            [
              "",
              "fortify_panic"
            ],
            [
              "",
              "power_supply_get_drvdata"
            ],
            [
              "",
              "raw_spin_unlock_irqrestore"
            ],
            [
              "",
              "cancel_delayed_work"
            ],
            [
              "",
              "x86_return_thunk"
            ],
            [
              "",
              "input_event"
            ],
            [
              "",
              "power_supply_changed"
            ],
            [
              "",
              "input_set_abs_params"
            ],
            [
              "",
              "hid_input_report"
            ],
            [
              "",
              "devm_kasprintf"
            ],
            [
              "",
              "mutex_unlock"
            ],
            [
              "",
              "cancel_delayed_work_sync"
            ],
            [
              "",
              "power_supply_powers"
            ],
            [
              "",
              "dynamic_pr_debug"
            ],
            [
              "",
              "cancel_work_sync"
            ],
            [
              "",
              "delayed_work_timer_fn"
            ],
            [
              "",
              "input_alloc_absinfo"
            ],
            [
              "",
              "power_supply_unregister"
            ],
            [
              "",
              "timer_init_key"
            ],
            [
              "",
              "input_ff_create_memless"
            ],
            [
              "",
              "hid_parse_report"
            ],
            [
              "",
              "hid_hw_raw_request"
            ],
            [
              "",
              "ubsan_handle_load_invalid_value"
            ],
            [
              "",
              "hid_open_report"
            ],
            [
              "",
              "msleep"
            ],
            [
              "",
              "hid_add_device"
            ],
            [
              "",
              "mutex_init_generic"
            ]
          ],
          "sec": [
            [
              "__jump_table",
              64,
              64,
              0.0,
              "write,alloc"
            ],
            [
              ".rela__jump_table",
              42928,
              288,
              1.48,
              "info_link"
            ],
            [
              "__patchable_function_entries",
              128,
              264,
              0.0,
              "write,alloc"
            ],
            [
              ".rela__patchable_function_entries",
              43216,
              792,
              1.5,
              "info_link"
            ],
            [
              ".text",
              392,
              13740,
              5.25,
              "alloc,executable"
            ],
            [
              ".rela.text",
              44008,
              14904,
              2.74,
              "info_link"
            ],
            [
              ".data",
              14136,
              1249,
              0.81,
              "write,alloc"
            ],
            [
              ".rela.data",
              58912,
              1440,
              1.58,
              "info_link"
            ],
            [
              ".rodata",
              15392,
              1192,
              4.25,
              "alloc"
            ],
            [
              ".rela.rodata",
              60352,
              192,
              1.53,
              "info_link"
            ],
            [
              "__mcount_loc",
              16584,
              256,
              0.0,
              "alloc"
            ],
            [
              ".rela__mcount_loc",
              60544,
              768,
              1.55,
              "info_link"
            ],
            [
              ".init.text",
              16840,
              63,
              2.85,
              "alloc,executable"
            ],
            [
              ".rela.init.text",
              61312,
              144,
              1.91,
              "info_link"
            ],
            [
              ".exit.text",
              16904,
              40,
              2.55,
              "alloc,executable"
            ],
            [
              ".rela.exit.text",
              61456,
              72,
              1.94,
              "info_link"
            ],
            [
              ".exit.data",
              16944,
              8,
              0.0,
              "write,alloc"
            ],
            [
              ".rela.exit.data",
              61528,
              24,
              0.5,
              "info_link"
            ],
            [
              ".init.data",
              16952,
              8,
              0.0,
              "write,alloc"
            ],
            [
              ".rela.init.data",
              61552,
              24,
              0.5,
              "info_link"
            ],
            [
              ".modinfo",
              16960,
              481,
              5.14,
              "alloc"
            ],
            [
              "__param",
              17448,
              40,
              0.5,
              "alloc"
            ],
            [
              ".rela__param",
              61576,
              96,
              1.14,
              "info_link"
            ],
            [
              "__dyndbg",
              17488,
              224,
              0.46,
              "write,alloc"
            ],
            [
              ".rela__dyndbg",
              61672,
              384,
              1.4,
              "info_link"
            ],
            [
              ".comment",
              17712,
              117,
              4.05,
              "merge,strings"
            ],
            [
              ".return_sites",
              17829,
              188,
              0.0,
              "alloc"
            ],
            [
              ".rela.return_sites",
              62056,
              1128,
              1.77,
              "info_link"
            ],
            [
              ".call_sites",
              18017,
              1664,
              0.0,
              "alloc"
            ],
            [
              ".rela.call_sites",
              63184,
              9984,
              2.14,
              "info_link"
            ],
            [
              ".note.gnu.build-id",
              19684,
              36,
              4.19,
              "alloc"
            ],
            [
              ".note.package",
              19720,
              108,
              4.73,
              "alloc"
            ],
            [
              "__version_ext_names",
              19832,
              1202,
              4.34,
              "alloc"
            ],
            [
              "__version_ext_crcs",
              21040,
              268,
              6.88,
              "alloc"
            ],
            [
              "__versions",
              21312,
              4288,
              2.66,
              "alloc"
            ],
            [
              ".gnu.linkonce.this_module",
              25600,
              1280,
              0.08,
              "write,alloc"
            ],
            [
              ".rela.gnu.linkonce.this_module",
              73168,
              48,
              1.05,
              "info_link"
            ],
            [
              ".note.Linux",
              26880,
              48,
              1.97,
              "alloc"
            ],
            [
              ".BTF",
              26928,
              7535,
              5.3,
              ""
            ],
            [
              ".symtab",
              34464,
              4968,
              2.08,
              ""
            ],
            [
              ".strtab",
              39432,
              3492,
              4.57,
              ""
            ],
            [
              ".shstrtab",
              73216,
              429,
              4.32,
              ""
            ]
          ],
          "metrics": {
            "elf": {
              "bits": 64.0,
              "entry": 0.0,
              "has_got": 0.0,
              "has_plt": 0.0,
              "has_note": 1.0,
              "has_symtab": 1.0,
              "note_count": 3.0,
              "nx_enabled": 1.0,
              "dynrel_count": 0.0,
              "dynsym_count": 0.0,
              "has_eh_frame": 0.0,
              "stack_canary": 1.0,
              "symtab_count": 207.0,
              "dynrela_count": 0.0,
              "little_endian": 1.0,
              "pltreloc_count": 0.0,
              "executable_stack": 0.0,
              "wx_segment_count": 0.0,
              "comment_entry_count": 3.0,
              "program_header_count": 0.0,
              "comment_distinct_count": 1.0,
              "gnu_stack_section_absent": 0.0,
              "load_segment_max_file_size": 0.0,
              "stripped_but_symtab_present": 1.0,
              "load_segment_max_memory_size": 0.0,
              "section_relocation_group_count": 15.0,
              "stripped_metadata_section_count": 5.0
            },
            "file": {
              "size": 77249.0,
              "entropy": 4.13,
              "size_bytes": 77249.0
            },
            "binary": {
              "is_pie": 0.0,
              "has_overlay": 1.0,
              "is_stripped": 0.0,
              "code_entropy": 5.23,
              "data_entropy": 0.4,
              "overlay_size": 3604.0,
              "string_count": 436.0,
              "overlay_ratio": 0.05,
              "avg_complexity": 2.76,
              "max_complexity": 26.0,
              "huge_func_count": 0.0,
              "leaf_func_count": 35.0,
              "overall_entropy": 4.13,
              "overlay_entropy": 3.1,
              "tiny_func_count": 49.0,
              "avg_basic_blocks": 4.86,
              "entropy_variance": 3.35,
              "avg_string_length": 22.6,
              "max_string_length": 97.0,
              "peak_region_bytes": 449.0,
              "code_to_data_ratio": 0.82,
              "total_basic_blocks": 428.0,
              "peak_region_entropy": 7.57,
              "string_length_stddev": 10.32,
              "largest_section_ratio": 0.19,
              "sentence_string_count": 21.0,
              "sentence_string_ratio": 0.05,
              "high_entropy_string_count": 0.0
            },
            "exports": {
              "count": 5.0
            },
            "imports": {
              "count": 66.0
            },
            "sections": {
              "count": 45.0,
              "code_size": 13843.0,
              "entropy_max": 6.88,
              "entropy_mean": 2.14,
              "name_entropy": 4.25,
              "writable_count": 8.0,
              "executable_count": 3.0,
              "nonstandard_count": 37.0,
              "executable_writable_count": 0.0
            },
            "functions": {
              "count": 88.0
            },
            "dependencies": {
              "count": 0.0
            }
          }
        },
        "id": 1,
        "mol": "O₂(AsC)",
        "path": "hid-steam.ko.zst!!hid-steam.ko",
        "risk": 3,
        "sha": "4ad02d0df1671184ef60c900126e6e2c915a111de82d8f892d419c82b088ec29",
        "size": 77249,
        "traits": [
          {
            "id": "metadata/build/artifact::elf-stripped-but-symtab-present",
            "conf": 0.6000000238418579,
            "crit": 3,
            "desc": "ELF stripped with .symtab present",
            "spans": [
              [
                0,
                38
              ]
            ]
          },
          {
            "id": "objectives/command-and-control/channel/deaddrop/steam::steam-summary-field",
            "atk": "T1102.001",
            "conf": 0.800000011920929,
            "crit": 3,
            "desc": "Steam profile summary/description field access",
            "spans": [
              [
                17127,
                38
              ]
            ]
          },
          {
            "id": "metadata/package/license::gpl-word",
            "conf": 0.699999988079071,
            "crit": 2,
            "desc": "GPL license reference",
            "spans": [
              [
                17123,
                3
              ]
            ]
          },
          {
            "id": "objectives/anti-static/obfuscation/payload/code-in-data::nop-sled-in-data",
            "conf": 0.6499999761581421,
            "crit": 3,
            "desc": "Repeated NOP-run pattern in executable section",
            "spans": [
              [
                392,
                47
              ]
            ]
          }
        ],
        "type": "elf"
      }
    ],
    "rev": "46112",
    "v": "8"
  }
}