{
  "ml": {
    "v": "7",
    "eng": "2.12.0-beta.2",
    "lvl": -1,
    "conf": 0,
    "mods": [
      {
        "cls": 0,
        "raw": 0.0000024537246,
        "rte": "az",
        "prob": 0.0000024537246
      }
    ],
    "prob": 0.000006854534,
    "files": [
      {
        "id": 0,
        "lvl": -1,
        "conf": 0,
        "prob": 0.000006854534149169922,
        "type": "xz"
      },
      {
        "id": 1,
        "lvl": -1,
        "conf": 0,
        "prob": 0.000006854534149169922,
        "type": "elf"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-10-01T00:30:44Z"
  },
  "path": "video-mux.ko.xz",
  "raw": {
    "files": [
      {
        "id": 0,
        "mol": "O(Al)",
        "sha": "b102fc2cd12f4aba3b4cadb91f2b6094bdae9c4f5fe9577ea4bcc500e2f27f0c",
        "path": "/data/samples/incoming/forager/raspios/raspberrypi.org/osimage/arm64-img/2026-09-15-raspios-trixie-arm64.img/2026-09-15-raspios-trixie-arm64.img.d/1.img.d/usr/lib/modules/6.18.50+rpt-rpi-2712/kernel/drivers/media/platform/video-mux.ko.xz",
        "risk": 2,
        "size": 4416,
        "type": "xz",
        "facts": {
          "metrics": {
            "file": {
              "size": 4416,
              "entropy": 7.95
            },
            "binary": {
              "peak_region_bytes": 4096,
              "peak_region_entropy": 7.84
            }
          }
        },
        "traits": [
          {
            "id": "metadata/binary/header/identity::elf-relocatable-object",
            "conf": 0.9,
            "crit": 2,
            "desc": "ELF relocatable object file"
          },
          {
            "id": "objectives/anti-analysis/vm-detect/vendor::virtualbox-recognized-vendor-marker",
            "atk": "T1497.001",
            "conf": 0.9,
            "crit": 2,
            "desc": "Recognized VirtualBox vendor markers",
            "from": [
              {
                "file": 1
              }
            ],
            "uses": [
              5
            ]
          },
          {
            "id": "objectives/anti-analysis/environment-detect/runtime::runtime-vm-detection-evidence",
            "mbc": "B0001",
            "conf": 0.9,
            "crit": 3,
            "desc": "Contains virtual-machine detection evidence",
            "from": [
              {
                "file": 1
              }
            ],
            "uses": [
              1
            ]
          },
          {
            "id": "metadata/package/license::gpl-word",
            "conf": 0.7,
            "crit": 2,
            "desc": "References the GPL license",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "metadata/file/extension/identity::linux-kernel-module-basename",
            "conf": 0.95,
            "crit": 2,
            "desc": "Linux kernel module basename",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "metadata/file/extension/identity::linux-kernel-package-artifact-basename",
            "conf": 0.95,
            "crit": 2,
            "desc": "Linux kernel package/module artifact basename",
            "from": [
              {
                "file": 1
              }
            ],
            "uses": [
              4
            ]
          }
        ]
      },
      {
        "ctx": [
          {
            "b": "E))420S-r400000000000rxOe0rr9100000000000000000000c{N+j0000000000kMy=:002m:ble[/a0pWoa0pWoa0pWoa0pWoko*oX@D(nT@r04Z]htW?]8!#)0QJ8E00[e",
            "ln": 0
          },
          {
            "b": "00000000000000000000000000000000000000000000000000y?Wx\u003czGxwLm]h\u003eVvrDW9z/O0qxLzo%AbV}6vpA!:efE=2zFa9lA=k\u0026fCMqe{BzbPkjYt^gv}Yo[nmuTLAX5tfwO#d6BAhqqx)oR*wPIv4x(Ffdz/dZYx\u003eg^[aAITBwNPA#zfoT",
            "ln": 5592
          },
          {
            "b": "d@]PJePL/AeIYmtg9xH\u0026p-%Z$wO2Z$BrCBswm6E%y\u0026r-)az(4cC4CYnx(v)gayOY0v}W+S000040000g000050000?pe}n]006!q0000200000000040000k000030000?pe}osX=})4AlDmOt@PX#L\u003ecns}1kyb00004000010rr9[x(n6r0000000006",
            "ln": 5925
          }
        ],
        "depth": 1,
        "facts": {
          "sec": [
            [
              ".text",
              64,
              2824,
              5.9,
              "alloc,executable"
            ],
            [
              ".rela.text",
              13264,
              1944,
              1.87,
              "info_link"
            ],
            [
              ".init.text",
              2888,
              60,
              3.8,
              "alloc,executable"
            ],
            [
              ".rela.init.text",
              15208,
              120,
              1.21,
              "info_link"
            ],
            [
              ".exit.text",
              2952,
              36,
              3.62,
              "alloc,executable"
            ],
            [
              ".rela.exit.text",
              15328,
              72,
              1.15,
              "info_link"
            ],
            [
              "__patchable_function_entries",
              2992,
              72,
              0.0,
              "write,alloc"
            ],
            [
              ".rela__patchable_function_entries",
              15400,
              216,
              1.37,
              "info_link"
            ],
            [
              ".data",
              3064,
              200,
              0.0,
              "write,alloc"
            ],
            [
              ".rela.data",
              15616,
              96,
              1.32,
              "info_link"
            ],
            [
              ".exit.data",
              3264,
              8,
              0.0,
              "write,alloc"
            ],
            [
              ".rela.exit.data",
              15712,
              24,
              0.66,
              "info_link"
            ],
            [
              ".init.data",
              3272,
              8,
              0.0,
              "write,alloc"
            ],
            [
              ".rela.init.data",
              15736,
              24,
              0.66,
              "info_link"
            ],
            [
              ".gnu.linkonce.this_module",
              3280,
              1216,
              0.09,
              "write,alloc"
            ],
            [
              ".rela.gnu.linkonce.this_module",
              15760,
              48,
              1.19,
              "info_link"
            ],
            [
              ".plt",
              4496,
              1,
              0.0,
              "alloc,executable"
            ],
            [
              ".init.plt",
              4497,
              1,
              0.0,
              "alloc"
            ],
            [
              ".text.ftrace_trampoline",
              4498,
              1,
              0.0,
              "alloc,executable"
            ],
            [
              ".rodata.str1.8",
              4504,
              250,
              4.55,
              "alloc,merge,strings"
            ],
            [
              ".rodata",
              4760,
              872,
              0.12,
              "alloc"
            ],
            [
              ".rela.rodata",
              15808,
              264,
              1.56,
              "info_link"
            ],
            [
              ".modinfo",
              5632,
              350,
              5.22,
              "alloc"
            ],
            [
              ".note.gnu.property",
              5984,
              32,
              1.69,
              "alloc"
            ],
            [
              ".note.gnu.build-id",
              6016,
              36,
              4.14,
              "alloc"
            ],
            [
              ".note.Linux",
              6052,
              68,
              3.37,
              "alloc"
            ],
            [
              "__versions",
              6120,
              2688,
              3.03,
              "alloc"
            ],
            [
              ".init.text.ftrace_trampoline",
              8808,
              1,
              0.0,
              "alloc"
            ],
            [
              ".comment",
              8816,
              96,
              4.14,
              "merge,strings"
            ],
            [
              ".symtab",
              8912,
              2616,
              1.49,
              ""
            ],
            [
              ".strtab",
              11528,
              1732,
              4.64,
              ""
            ],
            [
              ".shstrtab",
              16072,
              345,
              4.25,
              ""
            ]
          ],
          "metrics": {
            "elf": {
              "bits": 64,
              "entry": 0,
              "has_got": 0,
              "has_plt": 1,
              "has_note": 1,
              "has_symtab": 1,
              "note_count": 3,
              "nx_enabled": 1,
              "dynrel_count": 0,
              "dynsym_count": 0,
              "has_build_id": 1,
              "has_eh_frame": 0,
              "no_gnu_stack": 0,
              "stack_canary": 1,
              "symtab_count": 109,
              "dynrela_count": 0,
              "little_endian": 1,
              "pltreloc_count": 0,
              "build_id_length": 20,
              "executable_stack": 0,
              "wx_segment_count": 0,
              "comment_entry_count": 3,
              "program_header_count": 0,
              "stripped_with_symtab": 1,
              "comment_distinct_count": 1,
              "executable_segment_count": 0,
              "load_segment_max_file_size": 0,
              "load_segment_max_memory_size": 0,
              "section_relocation_group_count": 9,
              "stripped_metadata_section_count": 5
            },
            "file": {
              "size": 18664,
              "entropy": 3.62
            },
            "binary": {
              "is_pie": 0,
              "has_overlay": 1,
              "is_stripped": 0,
              "code_entropy": 5.83,
              "data_entropy": 0.07,
              "overlay_size": 2247,
              "string_count": 125,
              "overlay_ratio": 0.12,
              "overlay_entropy": 1.2,
              "entropy_variance": 3.38,
              "avg_string_length": 20.46,
              "max_string_length": 72,
              "peak_region_bytes": 3072,
              "code_to_data_ratio": 0.66,
              "peak_region_entropy": 5.78,
              "string_length_stddev": 10.68,
              "largest_section_ratio": 0.15,
              "sentence_string_count": 10,
              "sentence_string_ratio": 0.08,
              "high_entropy_string_count": 0
            },
            "strings": {
              "truncated": 0,
              "retained_count": 125,
              "extracted_count": 125
            },
            "sections": {
              "count": 35,
              "code_size": 2922,
              "entropy_max": 5.9,
              "entropy_mean": 1.91,
              "name_entropy": 4.14,
              "writable_count": 6,
              "executable_count": 5,
              "nonstandard_count": 26,
              "executable_writable_count": 0
            },
            "dependencies": {
              "count": 0
            }
          }
        },
        "id": 1,
        "mol": "O(Al)",
        "path": "/data/samples/incoming/forager/raspios/raspberrypi.org/osimage/arm64-img/2026-09-15-raspios-trixie-arm64.img/2026-09-15-raspios-trixie-arm64.img.d/1.img.d/usr/lib/modules/6.18.50+rpt-rpi-2712/kernel/drivers/media/platform/video-mux.ko.xz!!video-mux.ko",
        "pid": 0,
        "risk": 2,
        "sha": "6cf2e4b51882152d3b0572227beeda13495500a84bb61bd1048c3fc86a90350f",
        "size": 18664,
        "traits": [
          {
            "id": "metadata/binary/header/identity::elf-relocatable-object",
            "conf": 0.9,
            "crit": 2,
            "desc": "ELF relocatable object file"
          },
          {
            "id": "metadata/file/extension/identity::linux-kernel-module-basename",
            "conf": 0.95,
            "crit": 2,
            "desc": "Linux kernel module basename"
          },
          {
            "id": "metadata/package/license::gpl-word",
            "conf": 0.7,
            "crit": 2,
            "desc": "References the GPL license",
            "spans": [
              [
                5640,
                0
              ]
            ]
          },
          {
            "id": "metadata/file/extension/identity::linux-kernel-package-artifact-basename",
            "conf": 0.95,
            "crit": 2,
            "desc": "Linux kernel package/module artifact basename",
            "uses": [
              1
            ]
          },
          {
            "id": "objectives/anti-analysis/vm-detect/vendor::virtualbox-recognized-vendor-marker",
            "atk": "T1497.001",
            "conf": 0.9,
            "crit": 2,
            "desc": "Recognized VirtualBox vendor markers",
            "uses": [
              3
            ]
          },
          {
            "id": "objectives/anti-analysis/environment-detect/runtime::runtime-vm-detection-evidence",
            "mbc": "B0001",
            "conf": 0.9,
            "crit": 3,
            "desc": "Contains virtual-machine detection evidence",
            "uses": [
              4
            ]
          }
        ],
        "type": "elf"
      }
    ],
    "rev": "c1ea9",
    "v": "8"
  }
}