{ "ml": { "v": "7", "eng": "2.2.0-beta.2", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.014226168, "rte": "az", "prob": 0.014226168 }, { "cls": 0, "raw": 0.0013266504, "rte": "az/tar", "prob": 0.0013266504 } ], "prob": 0.03599733, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.03599733114242554, "type": "apk_alpine" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.03599733114242554, "type": "elf" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.00001231829355674563, "type": "elf" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.000010877847671508789, "type": "elf" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.000010838110938493628, "type": "text" } ], "version": "v18.18", "analyzed_at": "2026-06-26T09:47:54Z" }, "path": "kamailio-jansson-6.0.6-r0.apk", "raw": { "files": [ { "id": 0, "ctx": [ { "b": "abZy8000000T3{24[J!\u003enkh=HeH]u63?!Yp^*DIa!jX1m:JNrco?u{f=2H?Deg@xa3GU*X", "n": [ { "c": 2, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "o": 0, "z": 1, "cf": 1.0 } ], "ln": 0 } ], "mol": "O(Er)H₂(Cm₃Os)Md(He)", "sha": "b6524441feed117d488870143448b580725cd7e6951a2e2f3c065487f97eac7f", "path": "/data/samples/unknown/foraged/alpine/alpinelinux.org/_/kamailio-jansson/kamailio-jansson-6.0.6-r0.apk", "risk": 4, "size": 142618, "type": "apk_alpine", "facts": { "metrics": { "file": { "size": 142618.0, "entropy": 8.0, "size_bytes": 142618.0 }, "parse": { "error_count": 1.0 }, "binary": { "overall_entropy": 8.0, "peak_region_bytes": 141312.0, "peak_region_entropy": 7.83 } } }, "traits": [ { "id": "micro-behaviors/communications/socket/tcp::socket-symbol-text", "conf": 0.75, "crit": 3, "desc": "Socket API symbol text", "from": [ { "file": 1 } ] }, { "id": "objectives/evasion/process/injection/memory::asm-manual-import-parsing-cond-2--inline-18287", "conf": 0.8999999761581421, "crit": 3, "desc": "High export-count binary context", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/socket/options::options-set", "conf": 0.6600000262260437, "crit": 3, "desc": "Set socket options", "from": [ { "file": 1 } ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-version-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package version field", "from": [ { "file": 4 } ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-origin-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package origin field", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/os/event/library/libevent::libevent", "conf": 0.699999988079071, "crit": 3, "desc": "libevent event loop library", "from": [ { "off": 8365, "file": 1 } ] }, { "id": "micro-behaviors/os/event/library/libevent::event-base-dispatch", "conf": 0.4000000059604645, "crit": 2, "desc": "event_base_dispatch function", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/db/sql::sql-insert", "crit": 3, "desc": "INSERT INTO SQL keyword", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/socket/listen::socket-sym", "mbc": "C0001", "conf": 0.4000000059604645, "crit": 3, "desc": "socket function symbol", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/file/write/direct::write", "conf": 0.6600000262260437, "crit": 2, "desc": "Write files", "from": [ { "off": 8837, "file": 1 } ] }, { "id": "micro-behaviors/fs/file/binary::file-read-operation", "atk": "T1005", "conf": 0.75, "crit": 1, "desc": "File read operation", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/dylib/library/libc::libc-characteristic-cxa-finalize", "crit": 2, "desc": "libc characteristic cxa finalize", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/os/event/library/libevent::event-base-new", "conf": 0.4000000059604645, "crit": 2, "desc": "event_base_new function", "from": [ { "file": 1 } ] }, { "id": "metadata/hardening/missing::stripped-binary", "conf": 0.800000011920929, "crit": 3, "desc": "No full symbol table (likely stripped)", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/socket/receive::_recv-symbol", "atk": "T1071", "mbc": "C0001", "conf": 0.6600000262260437, "crit": 3, "desc": "Uses _recv socket call", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/os/event/library/libevent::bufferevent-prefix", "conf": 0.4000000059604645, "crit": 2, "desc": "bufferevent_ function prefix", "from": [ { "file": 1 } ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-basename", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package info file" }, { "id": "micro-behaviors/dylib/library/family::async-io-libevent-symbol--event-base", "conf": 0.8999999761581421, "crit": 2, "desc": "libevent symbol (event_base_)", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/dylib/library/family::async-io-libevent-symbol--bufferevent", "conf": 0.8999999761581421, "crit": 2, "desc": "libevent symbol (bufferevent_)", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/socket/receive::recv-symbol", "atk": "T1071", "mbc": "C0001", "conf": 0.6600000262260437, "crit": 3, "desc": "Uses recv socket call", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/dylib/library/libc::libc-internal-functions-b", "conf": 0.699999988079071, "crit": 2, "desc": "libc internal symbols cluster B", "from": [ { "file": 1 }, { "file": 2 }, { "file": 3 } ] }, { "id": "micro-behaviors/os/event/library/libevent::event-add", "conf": 0.4000000059604645, "crit": 2, "desc": "event_add function", "from": [ { "file": 1 } ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-package-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package name field", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/fs/file/write/direct::write--write", "conf": 0.6600000262260437, "crit": 2, "desc": "Write files (write)", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/file/read::read", "conf": 0.699999988079071, "crit": 2, "desc": "Read file descriptor (read/pread)", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/os/event/library/libevent::evbuffer-prefix", "conf": 0.4000000059604645, "crit": 2, "desc": "evbuffer_ function prefix", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/dylib/library/family::async-io-libevent-symbol--evbuffer", "conf": 0.8999999761581421, "crit": 2, "desc": "libevent symbol (evbuffer_)", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/dylib/library/abi-graphics::cxx-abi-symbols-a", "conf": 0.800000011920929, "crit": 2, "desc": "C++ ABI symbols cluster A", "from": [ { "file": 1 }, { "file": 2 }, { "file": 3 } ] }, { "id": "micro-behaviors/os/event/library/libevent::evdns-prefix", "conf": 0.4000000059604645, "crit": 2, "desc": "evdns_ function prefix", "from": [ { "file": 1 } ] } ] }, { "ctx": [ { "b": "E))420S-r400000000000@$H+0rr910000000000kMy=:00000avukh0000000000kMA+z3JJA(7xtiJ0rr911o", "n": [ { "c": 3, "d": "Strips toolchain banner but retains build-id", "i": "metadata/build/artifact::aggressive-strip", "o": 0, "z": 1, "cf": 1.0 } ], "ln": 0 }, { "b": "A-t+2y\u0026si5raflLwDl7Av%zA?w[=c\u003ey?Xib0af8zwPzu{x(!xcA:JB0vqPN.x(mK30af8NwOkZ#", "n": [ { "c": 3, "d": "Benign network-capable library context", "i": "objectives/supply-chain/trojanized/backdoor::benign-network-library-context", "o": 7199, "z": 12, "cf": 0.8999999761581421 } ], "ln": 7183 }, { "b": "0aGI.uU0\u003e(v@Dm5wN//ZvS=o{wPzv9wO#P%xjVf(wO${=y?mbSvS=o{wPzv9wO#P%wnc9[vR/PQvS=o{wPzv9wO#P%w].D]0a{d\u0026v}x1Tx(^^5zF\u003c2}Bo2\u0026\u003cA+PAkuT[a\u003cBo2@+", "n": [ { "c": 3, "d": "Benign socket shell helper context", "i": "micro-behaviors/process/fd/dup::posix-fd-redirect-shell-benign-context", "o": 7297, "z": 19, "cf": 0.9399999976158142 }, { "c": 3, "d": "Linker and terminal benign dual-mode forwarding", "i": "micro-behaviors/process/fd/dup::unix-dual-mode-socket-exec-benign-context", "o": 7317, "z": 16, "cf": 0.9399999976158142 }, { "c": 3, "d": "Terminal socket exec helper context", "i": "micro-behaviors/process/fd/dup::unix-terminal-socket-exec-benign-context", "o": 7273, "z": 23, "cf": 0.949999988079071 } ], "ln": 7257 }, { "b": "0a]UNy*Ri]ADL\u0026lBo2VPB97\u00262yHpN+yHpWZx(0=Ywm64(uV]\u003c]x\u003ediQv@uy80af8AA=M5ouU\u003cT\u003cvruj4zua-?Bye\u0026#zF9K30cqZ[B8LM7z/x^#B7GD2yH}6@vqGU3wDlgJC3!-$zF\u003c2}Bo35%z/fPmv{:1.wPh0+y?X670cr6*yH}O/xkzG}vqGpZC3!Y!B7CtXB.kk%A+fA9zGGlbz!0M]Bye]%Ck#b\u003ezF\u003c2}ByeS*x(4u\u003e0aGI.uT[1(zE)s1uT)KBvR6Z\u0026A+eV\u0026uT)KBvS=o{wPzv9wO#P%B7GD6vGo\u003eWw[CQ{wP?T5ByeP%vpB4:0b3a^vQT7WwP?Q4B6\u0026x+B7CtXB.kk%A+fA9zGGlbz!0M]ByeJ@zF\u003c2}ByeZ1B98qdzdJYSz/fD7v@#70wPz%9A=Rj)z/Pu0uVGZ/z/fD7v@}", "n": [ { "c": 3, "d": "Stack protector/canary enabled", "i": "metadata/hardening/build::stack-protector", "o": 7579, "z": 14, "cf": 0.8999999761581421 }, { "c": 3, "d": "Set socket options", "i": "micro-behaviors/communications/socket/options::options-set", "o": 7640, "z": 10, "cf": 0.6600000262260437 }, { "c": 3, "d": "Socket API symbol text", "i": "micro-behaviors/communications/socket/tcp::socket-symbol-text", "o": 7696, "z": 6, "cf": 0.75 }, { "c": 2, "d": "libevent symbol (bufferevent_)", "i": "micro-behaviors/dylib/library/family::async-io-libevent-symbol--bufferevent", "o": 7718, "z": 22, "cf": 0.8999999761581421 }, { "c": 2, "d": "File descriptor manipulation and control", "i": "micro-behaviors/fs/file/handle::fcntl", "o": 7606, "z": 5, "cf": 0.4000000059604645 } ], "ln": 7563 }, { "b": "w[CyWvGo$.wO#P%zE[1(wP?T5ByeD!wb{g:wO#P%wmYMSwP?T5Bye:1x([5$y?Xibwb{*Zx-", "n": [ { "c": 3, "d": "libevent event loop library", "i": "micro-behaviors/os/event/library/libevent::libevent", "o": 7999, "z": 9, "cf": 0.699999988079071 } ], "ln": 7983 }, { "b": "0c.\u003c=Byf61v@Dm5wN//ZvS=o{wPzv9wO#P%B8LM7wPRo(wPRo\u0026zGxe@A=M8s0a*s@BzkL#xjkHYB98ClA=M8s0af!Xzc}s4z/+$@", "n": [ { "c": 2, "d": "libevent symbol (bufferevent_)", "i": "micro-behaviors/dylib/library/family::async-io-libevent-symbol--bufferevent", "o": 8063, "z": 32, "cf": 0.8999999761581421 } ], "ln": 8047 }, { "b": "vqGp(wPz%9A:JE1z/{10wP?Q4B6\u0026x+B7FY\u003cA+e!ZwP?T5ByeG=B7FY{z/oPaCXIm1wP?T5ByeG=B7FY\u003cA+e!ZB7Gl1uVZi[B7ol8Ac87{B8L@pAarl}wPJ0gBye$", "n": [ { "c": 2, "d": "libevent symbol (event_base_)", "i": "micro-behaviors/dylib/library/family::async-io-libevent-symbol--event-base", "o": 8381, "z": 19, "cf": 0.8999999761581421 }, { "c": 2, "d": "evdns_ function prefix", "i": "micro-behaviors/os/event/library/libevent::evdns-prefix", "o": 8365, "z": 6, "cf": 0.4000000059604645 } ], "ln": 8349 }, { "b": "z^N0/x(4r!Ab](bwPI[)wP?T5ByeG=B7FY@wP[b=C4tGiuT^C+wNxs^Ck#b\u0026wm6p\u0026AaJx^vGo$.wO#P%vQTs?uU0\u003e(Aa9\u0026#xAhK.wNPW(uVoZ#wNw}:wb{jZwO2j/x(ES\u003cv@k-Ry5", "n": [ { "c": 2, "d": "libevent symbol (event_base_)", "i": "micro-behaviors/dylib/library/family::async-io-libevent-symbol--event-base", "o": 8631, "z": 14, "cf": 0.8999999761581421 }, { "c": 2, "d": "event_base_dispatch function", "i": "micro-behaviors/os/event/library/libevent::event-base-dispatch", "o": 8673, "z": 19, "cf": 0.4000000059604645 } ], "ln": 8615 }, { "b": "v@le+vS=o{wPzv9wO#P%CxdztwDldHwoq-%B7GxnwPzc]x(!v@w].D]uVP!0C4CY3yY", "n": [ { "c": 2, "d": "Write files (write)", "i": "micro-behaviors/fs/file/write/direct::write--write", "o": 8837, "z": 5, "cf": 0.6600000262260437 } ], "ln": 8821 }, { "b": "vpS.RC4bPaw[t#.v@k:-Aa%o50chT)A^q24vGpv/x(n31A+flkwPI}[Ab]VgByf92", "n": [ { "c": 2, "d": "Binary process execution capability", "i": "objectives/anti-static/obfuscation/eval/loader::binary-process-execution", "o": 9231, "z": 4, "cf": 0.8500000238418579 } ], "ln": 9215 }, { "b": "wP?T5ByeV(Bye:1Aclm5wP?K9w[CQ{uUr}(uU\u003cp\u003exlm!!wP?K9w[CQ{uVpacuVP!20a*s.B.kk%A:J)0vrb\u003c\u003euVGN)xjR6OC4bPaw[u0\u0026A+f9aC4yU\u003ewPS0nA+PA7uVGZ^wm5}V0chTXB]Vz\u003eBAqLAx(mM\u003cA+eV\u00260b=v\u0026B98CpzF9r=B.kk%A:J)4DsW7)z!y^U0aPOO", "n": [ { "c": 3, "d": "Uses _recv socket call", "i": "micro-behaviors/communications/socket/receive::_recv-symbol", "o": 10079, "z": 4, "cf": 0.6600000262260437 }, { "c": 2, "d": "libevent symbol (evbuffer_)", "i": "micro-behaviors/dylib/library/family::async-io-libevent-symbol--evbuffer", "o": 9986, "z": 19, "cf": 0.8999999761581421 }, { "c": 2, "d": "Generic file read/write operations", "i": "micro-behaviors/fs/file/read-write::binary-file-ops", "o": 10094, "z": 4, "cf": 0.800000011920929 } ], "ln": 9970 }, { "b": "e]$}-hVNVdvQ?3cB-RvJCSmP*hz^4cz.r:Aygh13B8L@pAarxgB8I4iB-RNRy?WuiyHE", "n": [ { "c": 3, "d": "Architecture detection strings", "i": "objectives/discovery/host/software::arch-detection", "o": 10184, "z": 6, "cf": 0.5 } ], "ln": 10168 }, { "b": "aAIamC4CXpb}ZV*iWFqVw]zYjv@Dm5aseS\u0026B1N!1mQZ1Ex(mMaA+flkwPI@ow]zX", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 168224, "z": 3, "cf": 0.800000011920929 } ], "ln": 168208 }, { "b": "z/fPmv{-.:zF\u003c2}Bs}5:gb?j0iV[zGggR^VwgnSEB2\u003eA\u0026e?g]*B0U(NB3@=4az2M", "n": [ { "c": 1, "d": "memfd_create Linux syscall number (279)", "i": "objectives/evasion/fileless/memory::memfd_create-syscall-number--279", "o": 170099, "z": 3, "cf": 0.800000011920929 } ], "ln": 170083 }, { "b": "c39N8zF\u003cxmay/C6vru66BzbkdBAg/cB75N2x(v\u003e@0bt}WB8#nqA=tI#ax@O?zGx\u003e", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 171120, "z": 3, "cf": 0.800000011920929 } ], "ln": 171104 }, { "b": "B.#7uw]zYjA+flkwPI@oAaa3dz^^e-0bt}WB8#nqA=tI#ax@O?zGx(qzGoYauUKBhv(=y", "n": [ { "c": 1, "d": "payload keyword", "i": "objectives/command-and-control/dropper/keywords::payload", "o": 173733, "z": 7, "cf": 0.6000000238418579 } ], "ln": 173717 }, { "b": "B8V5nB7DF8z!i#jzF%RtxKM6}ayMyowPz\u003caz/dfm0bt}WB8#nqA=tI#ax@O?zGx(q", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 175083, "z": 4, "cf": 0.800000011920929 } ], "ln": 175067 }, { "b": "c37wNc394aD1?eeaARJAx(n06A=-BrzGG!tpe%$Yazk.kB-mV/ygh13B8L@pAarx2twvO:B8#m", "n": [ { "c": 3, "d": "INSERT INTO SQL keyword", "i": "micro-behaviors/data/db/sql::sql-insert", "o": 181939, "z": 11, "cf": 0.5 } ], "ln": 181923 }, { "b": "efF[IA=-\u0026PCv+G3xML^FvqYP#Ab]VhA+PSvayPq4az#ataAIWAAbP=swN({cxK#5", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 183868, "z": 3, "cf": 0.800000011920929 } ], "ln": 183852 }, { "b": "uRS)-r8Lm\u0026rz#s[l@N5(lqgfxoh4]Qr4Gd.k#{AYqBKIWoJCH#mn\u003e-Wr7{j$p/G$-ml%sGo-", "n": [ { "c": 1, "d": "Benign context: deny/block-list word", "i": "objectives/credential-access/shell/history::shell-history-unless-cond-1--rx-3", "o": 187733, "z": 9, "cf": 0.30000001192092896 } ], "ln": 187717 }, { "b": "yHI6*x(4H4at$\u0026ae\u0026B?2CSmP*hz^6Xx(n6rdfa9\u003ezGx(qzGoYav(+-IwPS0nA+PA7e[j", "n": [ { "c": 2, "d": "x86_64 architecture string", "i": "micro-behaviors/os/sysinfo/platform/string::arch-x86-64", "o": 187802, "z": 6, "cf": 0.30000001192092896 } ], "ln": 187786 }, { "b": "wzvj^00000IROsl00000ygh13B8L@pAarxgB8JWwwNY^{00000P.PU%04@taB98CAvpxi?zF%Sde[Y6Ae]U\u0026H", "n": [ { "c": 2, "d": ".gnu_debuglink reference present", "i": "metadata/build/debug::elf-debuglink", "o": 213536, "z": 20, "cf": 1.0 } ], "ln": 213520 }, { "b": "y?bbiwb[k{zGNNBvrl8Ze[xlBB9RQ5e[xlBB98B5e]\u003eJtvj(8ozu8qfwO=xtwo\u00264)e[]iqBo0}nwQ5p", "n": [ { "c": 2, "d": "ELF dynstr section name", "i": "metadata/binary/linking/static::elf-dynstr-section-name", "o": 213631, "z": 7, "cf": 0.8999999761581421 }, { "c": 2, "d": "ELF dynsym section name", "i": "metadata/binary/linking/static::elf-dynsym-section-name", "o": 213623, "z": 7, "cf": 0.8999999761581421 } ], "ln": 213607 }, { "b": "vr?\u00269wmoN*e]\u003eJte]\u003e\u003ege[xlBvqPZ*04}]5Bo0}7vrt]Te[e)y04}]4BZFV\u003cvS=s1x(mX^", "n": [ { "c": 2, "d": "ELF dynamic section name", "i": "metadata/binary/linking/static::elf-dynamic-section-name", "o": 213746, "z": 8, "cf": 0.8999999761581421 } ], "ln": 213730 } ], "depth": 1, "facts": { "exp": [ [ "module_version" ], [ "global_retry_ranges" ], [ "insert_server_group" ], [ "print_group" ], [ "wait_close" ], [ "tmb" ], [ "fail_request" ], [ "exports" ], [ "create_server_group" ], [ "jsonrpc_request" ], [ "global_server_group" ], [ "server_eq" ], [ "internal_error" ], [ "schedule_retry" ], [ "jsonrpc_min_srv_ttl" ], [ "parse_keep_alive_param" ], [ "retry_cb" ], [ "global_evdns_base" ], [ "parse_retry_codes_param" ], [ "global_ev_base" ], [ "set_non_blocking" ], [ "server_tried" ], [ "loadbalance_by_weight" ], [ "bev_disconnect" ], [ "free_server_list" ], [ "jsontoval" ], [ "handle_response" ], [ "server_backoff_cb" ], [ "create_req_cmd" ], [ "request_table" ], [ "free_server" ], [ "module_flags" ], [ "free_pipe_cmd" ], [ "jsonrpc_keep_alive" ], [ "print_server" ], [ "create_request" ], [ "jsonrpc_notification" ], [ "refresh_srv_cb" ], [ "mod_jsonrpc_request" ], [ "init" ], [ "io_shutdown" ], [ "free_server_group" ], [ "mod_destroy" ], [ "cmd_pipe_cb" ], [ "connect_failed" ], [ "force_reconnect" ], [ "netstring_read" ], [ "close_server" ], [ "server_group_size" ], [ "wait_server_backoff" ], [ "jsonrpc_send" ], [ "create_server" ], [ "timeout_cb" ], [ "free_srv" ], [ "jsonrpc_add_server" ], [ "jsonrpc_server_from_srv" ], [ "module_interface_ver" ], [ "null_str" ], [ "force_disconnect" ], [ "send_to_script" ], [ "parse_min_ttl_param" ], [ "jsonrpc_server_group_lock" ], [ "bev_connect" ], [ "handle_netstring" ], [ "parse_server_param" ], [ "send_pipe_cmd" ], [ "netstring_encode_new" ], [ "print_srv" ], [ "connect_servers" ], [ "cmd_pipe" ], [ "pipe_fds" ], [ "fd_is_valid" ], [ "addto_server_list" ], [ "jsonrpc_request_no_options" ], [ "requests_using_server" ], [ "create_pipe_cmd" ], [ "bev_read_cb" ], [ "jsonrpc_io_child_process" ], [ "free_netstring" ], [ "id_hash" ], [ "set_linger" ], [ "store_request" ], [ "print_request" ], [ "global_srv_list" ], [ "pop_request" ], [ "netstring_buffer_size" ], [ "bev_connect_cb" ], [ "free_req_cmd" ], [ "wait_reconnect" ], [ "fini" ], [ "jsonrpc_parse_server" ], [ "addto_srv_list" ], [ "set_keepalive" ], [ "free_request" ], [ "netstring_read_evbuffer" ], [ "s2i" ], [ "result_pv_str" ], [ "create_srv" ], [ "refresh_srv" ], [ "netstring_read_fd" ], [ "jsonrpc_result_pv" ] ], "imp": [ [ "", "bufferevent_free" ], [ "", "json_dumps" ], [ "", "strtok_r" ], [ "", "event_base_free" ], [ "", "fork_basic_timer" ], [ "", "find_export" ], [ "", "json_object_update" ], [ "", "recv" ], [ "", "event_base_new" ], [ "", "strerror" ], [ "", "pv_parse_spec2" ], [ "", "get_str_fparam" ], [ "", "cfg_global_lock" ], [ "", "syscall" ], [ "", "process_no" ], [ "", "bufferevent_enable" ], [ "", "ceil" ], [ "", "km_log_func" ], [ "", "fastrand_max" ], [ "", "fixup_spve_null" ], [ "", "json_delete" ], [ "", "json_string" ], [ "", "cxa_finalize" ], [ "", "shm_root" ], [ "", "resolv_init" ], [ "", "cfg_block_size" ], [ "", "dprint_color_reset" ], [ "", "get_debug_facility" ], [ "", "bufferevent_setcb" ], [ "", "socket" ], [ "", "json_loads" ], [ "", "free_params" ], [ "", "log_level_info" ], [ "", "evbuffer_get_length" ], [ "", "stack_chk_fail" ], [ "", "strtol" ], [ "", "pipe" ], [ "", "dprint_color" ], [ "", "cfg_child_init" ], [ "", "cfg_ginst_count" ], [ "", "json_object_get" ], [ "", "write" ], [ "", "fprintf" ], [ "", "json_object_set_new" ], [ "", "parse_params" ], [ "", "deregister_frame_info" ], [ "", "log_prefix_val" ], [ "", "setsockopt" ], [ "", "ITM_registerTMCloneTable" ], [ "", "json_integer_value" ], [ "", "evdns_base_new" ], [ "", "read" ], [ "", "strncmp" ], [ "", "free_rdata_list" ], [ "", "log10" ], [ "", "my_pid" ], [ "", "cfg_move_handle" ], [ "", "evbuffer_search_range" ], [ "", "register_basic_timers" ], [ "", "cfg_child_cb" ], [ "", "bufferevent_socket_get_dns_error" ], [ "", "evdns_base_free" ], [ "", "bufferevent_write" ], [ "", "ITM_deregisterTMCloneTable" ], [ "", "dprint_crit" ], [ "", "event_new" ], [ "", "event_add" ], [ "", "get_record" ], [ "", "evbuffer_ptr_set" ], [ "", "event_base_dispatch" ], [ "", "cfg_group" ], [ "", "sprintf" ], [ "", "stderr" ], [ "", "cfg_global" ], [ "", "bufferevent_get_input" ], [ "", "fixup_free_spve_null" ], [ "", "bufferevent_get_enabled" ], [ "", "cfg_child_cb_first" ], [ "", "main_rt" ], [ "", "get_debug_level" ], [ "", "cfg_local" ], [ "", "json_string_value" ], [ "", "log_stderr" ], [ "", "ksr_slog_func" ], [ "", "route_lookup" ], [ "", "json_integer" ], [ "", "event_free" ], [ "", "event_base_loopexit" ], [ "", "event_del" ], [ "", "cfg_child_cb_last" ], [ "", "errno_location" ], [ "", "atoi" ], [ "", "bufferevent_socket_new" ], [ "", "bufferevent_disable" ], [ "", "evbuffer_remove" ], [ "", "json_object" ], [ "", "evutil_gai_strerror" ], [ "", "register_procs" ], [ "", "log_color" ], [ "", "pkg_root" ], [ "", "bufferevent_socket_connect_hostname" ], [ "", "fcntl" ], [ "", "event_initialized" ], [ "", "register_frame_info" ], [ "", "close" ], [ "", "free" ], [ "", "fork_process" ] ], "sec": [ [ ".note.gnu.property", 680, 48, 1.94, "alloc" ], [ ".note.gnu.build-id", 728, 36, 4.19, "alloc" ], [ ".gnu.hash", 768, 1348, 4.31, "alloc" ], [ ".dynsym", 2120, 5016, 2.16, "alloc" ], [ ".dynstr", 7136, 3093, 4.38, "alloc" ], [ ".rela.dyn", 10232, 4776, 1.82, "alloc" ], [ ".relr.dyn", 15008, 40, 2.35, "alloc" ], [ ".init", 16384, 3, 1.58, "alloc,executable" ], [ ".text", 16400, 149046, 6.15, "alloc,executable" ], [ ".fini", 165446, 3, 1.58, "alloc,executable" ], [ ".rodata", 167936, 21784, 4.96, "alloc" ], [ ".eh_frame_hdr", 189720, 764, 5.36, "alloc" ], [ ".eh_frame", 190488, 16380, 5.26, "alloc" ], [ ".init_array", 210832, 8, 1.06, "write,alloc" ], [ ".fini_array", 210840, 8, 1.06, "write,alloc" ], [ ".data.rel.ro", 210848, 128, 1.81, "write,alloc" ], [ ".dynamic", 210976, 480, 1.39, "write,alloc" ], [ ".got", 211456, 1536, 0.02, "write,alloc" ], [ ".data", 212992, 544, 1.45, "write,alloc" ], [ ".gnu_debuglink", 213536, 28, 4.07, "" ], [ ".shstrtab", 213564, 222, 4.19, "" ] ], "metrics": { "elf": { "bits": 64.0, "entry": 0.0, "has_got": 1.0, "has_plt": 0.0, "has_note": 1.0, "note_count": 2.0, "nx_enabled": 1.0, "has_dt_relr": 1.0, "has_runpath": 1.0, "dynrel_count": 0.0, "dynsym_count": 209.0, "has_build_id": 1.0, "has_eh_frame": 1.0, "has_gnu_hash": 1.0, "stack_canary": 1.0, "symtab_count": 0.0, "dynrela_count": 199.0, "has_debuglink": 1.0, "little_endian": 1.0, "dt_flags_1_raw": 1.0, "pltreloc_count": 0.0, "build_id_length": 20.0, "executable_stack": 0.0, "fini_array_count": 1.0, "init_array_count": 1.0, "wx_segment_count": 0.0, "program_header_count": 11.0, "gnu_stack_section_absent": 0.0, "load_segment_max_file_size": 149065.0, "stripped_but_symtab_present": 0.0, "load_segment_max_memory_size": 149065.0, "section_relocation_group_count": 1.0, "stripped_metadata_section_count": 8.0 }, "file": { "size": 215264.0, "entropy": 6.11, "size_bytes": 215264.0 }, "binary": { "is_pie": 0.0, "has_overlay": 1.0, "is_stripped": 1.0, "code_entropy": 6.15, "data_entropy": 0.64, "overlay_size": 1478.0, "string_count": 743.0, "overlay_ratio": 0.01, "overall_entropy": 6.11, "overlay_entropy": 1.45, "entropy_variance": 2.97, "avg_string_length": 29.25, "max_string_length": 293.0, "peak_region_bytes": 139264.0, "code_to_data_ratio": 0.98, "peak_region_entropy": 6.19, "string_length_stddev": 20.3, "largest_section_ratio": 0.69, "sentence_string_count": 181.0, "sentence_string_ratio": 0.24, "high_entropy_string_count": 0.0 }, "exports": { "count": 101.0 }, "imports": { "count": 107.0 }, "sections": { "count": 23.0, "code_size": 149052.0, "entropy_max": 6.15, "entropy_mean": 2.91, "name_entropy": 4.14, "writable_count": 7.0, "executable_count": 3.0, "nonstandard_count": 6.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 3.0 } } }, "id": 1, "mol": "O(Er)H₂(Cm₃Os)Md(He)", "path": "/data/samples/unknown/foraged/alpine/alpinelinux.org/_/kamailio-jansson/kamailio-jansson-6.0.6-r0.apk!!usr/lib/kamailio/modules/janssonrpcc.so", "risk": 4, "sha": "31a590521bd1a36f1f0ba523cff794bc9497d4c8d5a15b5232e2ab86260b85ed", "size": 215264, "traits": [ { "id": "micro-behaviors/os/event/library/libevent::event-base-new", "conf": 0.4000000059604645, "crit": 2, "desc": "event_base_new function", "spans": [ [ 8631, 14 ] ] }, { "id": "micro-behaviors/fs/file/read::read", "conf": 0.699999988079071, "crit": 2, "desc": "Read file descriptor (read/pread)", "spans": [ [ 10094, 4 ] ] }, { "id": "micro-behaviors/os/event/library/libevent::evbuffer-prefix", "conf": 0.4000000059604645, "crit": 2, "desc": "evbuffer_ function prefix", "spans": [ [ 9986, 9 ] ] }, { "id": "micro-behaviors/os/event/library/libevent::evdns-prefix", "conf": 0.4000000059604645, "crit": 2, "desc": "evdns_ function prefix", "spans": [ [ 8365, 6 ] ] }, { "id": "micro-behaviors/dylib/library/family::async-io-libevent-symbol--event-base", "conf": 0.8999999761581421, "crit": 2, "desc": "libevent symbol (event_base_)", "spans": [ [ 8381, 19 ], [ 8401, 15 ], [ 8631, 14 ], [ 8673, 19 ] ] }, { "id": "micro-behaviors/dylib/library/family::async-io-libevent-symbol--evbuffer", "conf": 0.8999999761581421, "crit": 2, "desc": "libevent symbol (evbuffer_)", "spans": [ [ 9986, 19 ], [ 10006, 16 ], [ 10023, 21 ], [ 10045, 15 ] ] }, { "id": "micro-behaviors/dylib/library/family::async-io-libevent-symbol--bufferevent", "conf": 0.8999999761581421, "crit": 2, "desc": "libevent symbol (bufferevent_)", "spans": [ [ 7273, 23 ], [ 7297, 19 ], [ 7317, 16 ], [ 7718, 22 ], [ 7783, 17 ], [ 7801, 18 ], [ 7838, 35 ], [ 8063, 32 ] ] }, { "id": "micro-behaviors/os/event/library/libevent::event-base-dispatch", "conf": 0.4000000059604645, "crit": 2, "desc": "event_base_dispatch function", "spans": [ [ 8673, 19 ] ] }, { "id": "micro-behaviors/fs/file/write/direct::write--write", "conf": 0.6600000262260437, "crit": 2, "desc": "Write files (write)", "spans": [ [ 8837, 5 ] ] }, { "id": "micro-behaviors/data/db/sql::sql-insert", "crit": 3, "desc": "INSERT INTO SQL keyword", "spans": [ [ 181939, 11 ] ] }, { "id": "micro-behaviors/communications/socket/options::options-set", "conf": 0.6600000262260437, "crit": 3, "desc": "Set socket options", "spans": [ [ 7640, 10 ] ] }, { "id": "micro-behaviors/dylib/library/libc::libc-characteristic-cxa-finalize", "crit": 2, "desc": "libc characteristic cxa finalize", "spans": [ [ 7199, 12 ] ] }, { "id": "micro-behaviors/communications/socket/receive::_recv-symbol", "atk": "T1071", "mbc": "C0001", "conf": 0.6600000262260437, "crit": 3, "desc": "Uses _recv socket call", "spans": [ [ 10079, 4 ] ] }, { "id": "micro-behaviors/os/event/library/libevent::event-add", "conf": 0.4000000059604645, "crit": 2, "desc": "event_add function", "spans": [ [ 7999, 9 ] ] }, { "id": "micro-behaviors/communications/socket/tcp::socket-symbol-text", "conf": 0.75, "crit": 3, "desc": "Socket API symbol text", "spans": [ [ 7696, 6 ] ] }, { "id": "micro-behaviors/communications/socket/receive::recv-symbol", "atk": "T1071", "mbc": "C0001", "conf": 0.6600000262260437, "crit": 3, "desc": "Uses recv socket call", "spans": [ [ 10079, 4 ] ] }, { "id": "micro-behaviors/os/event/library/libevent::bufferevent-prefix", "conf": 0.4000000059604645, "crit": 2, "desc": "bufferevent_ function prefix", "spans": [ [ 7273, 12 ] ] }, { "id": "micro-behaviors/communications/socket/listen::socket-sym", "mbc": "C0001", "conf": 0.4000000059604645, "crit": 3, "desc": "socket function symbol", "spans": [ [ 7696, 6 ] ] }, { "id": "metadata/hardening/missing::stripped-binary", "conf": 0.800000011920929, "crit": 3, "desc": "No full symbol table (likely stripped)", "spans": [ [ 0, 25 ] ] }, { "id": "objectives/evasion/process/injection/memory::asm-manual-import-parsing-cond-2--inline-18287", "conf": 0.8999999761581421, "crit": 3, "desc": "High export-count binary context", "spans": [ [ 0, 22 ] ] }, { "id": "micro-behaviors/dylib/library/libc::libc-internal-functions-b", "conf": 0.699999988079071, "crit": 2, "desc": "libc internal symbols cluster B", "spans": [ [ 7199, 12 ] ] }, { "id": "micro-behaviors/fs/file/binary::file-read-operation", "atk": "T1005", "conf": 0.75, "crit": 1, "desc": "File read operation", "spans": [ [ 10094, 4 ] ] }, { "id": "micro-behaviors/fs/file/write/direct::write", "conf": 0.6600000262260437, "crit": 2, "desc": "Write files", "spans": [ [ 8837, 5 ] ] }, { "id": "micro-behaviors/os/event/library/libevent::libevent", "conf": 0.699999988079071, "crit": 3, "desc": "libevent event loop library", "spans": [ [ 7273, 12 ], [ 7999, 9 ], [ 8365, 6 ], [ 8631, 14 ], [ 8673, 19 ], [ 9986, 9 ] ] }, { "id": "micro-behaviors/dylib/library/abi-graphics::cxx-abi-symbols-a", "conf": 0.800000011920929, "crit": 2, "desc": "C++ ABI symbols cluster A", "spans": [ [ 7199, 12 ] ] } ], "type": "elf" }, { "ctx": [ { "b": "E))420S-r400000000000@$H+0rr910000000000kMy=:00000{+I{J0000000000kMA+z3JJA(7xtiJ0rr91", "n": [ { "c": 3, "d": "Strips toolchain banner but retains build-id", "i": "metadata/build/artifact::aggressive-strip", "o": 0, "z": 1, "cf": 1.0 } ], "ln": 0 }, { "b": "A-t+2y\u0026si5raflLwDl7Av%zA?w[=c\u003ey?Xib0af8zwPzu{x(!xcA:JB0vqPN.x(mK30af8NwOkZ#", "n": [ { "c": 3, "d": "Terminal socket exec helper context", "i": "micro-behaviors/process/fd/dup::unix-terminal-socket-exec-benign-context", "o": 3253, "z": 12, "cf": 0.949999988079071 } ], "ln": 3237 }, { "b": "wN/*?x(){buV6C1Bo2VPB97\u00262yHpN+yHpWZx(0=:B8L@6wmYN*By+C!vqZdcz/fAgwm5$XByeY)y\u0026x", "n": [ { "c": 3, "d": "Stack protector/canary enabled", "i": "metadata/hardening/build::stack-protector", "o": 3641, "z": 14, "cf": 0.8999999761581421 } ], "ln": 3625 }, { "b": "e]$}-gYRuavQ?3cB-RvJCSmP*hz^4cz.r:Aygh13B8L}GB8I4iB-RNRy?WuiyHI6*x(0", "n": [ { "c": 3, "d": "Architecture detection strings", "i": "objectives/discovery/host/software::arch-detection", "o": 4546, "z": 6, "cf": 0.5 } ], "ln": 4530 }, { "b": "uRS)-r8Lm\u0026rz#s[l@N5(lqgfxoh4]Qr4Gd.k#{AYqBKIWoJCH#mn\u003e-Wr7{j$p/G$-ml%sGo-", "n": [ { "c": 1, "d": "Benign context: deny/block-list word", "i": "objectives/credential-access/shell/history::shell-history-unless-cond-1--rx-3", "o": 66031, "z": 9, "cf": 0.30000001192092896 } ], "ln": 66015 }, { "b": "yHI6*x(4H4at$\u0026ae\u0026B?2CSmP*hz^6Xx(n6rdf9SNe)wr\u003cvqZdcz/e{3vrufnv/QmLzGt", "n": [ { "c": 2, "d": "x86_64 architecture string", "i": "micro-behaviors/os/sysinfo/platform/string::arch-x86-64", "o": 66100, "z": 6, "cf": 0.30000001192092896 } ], "ln": 66084 }, { "b": "00000000000000000000ygh13B8L}GB8JWwwNY^{00000HpV4D04@taB98CAvpxi?zF%Sde[Y6Ae]U\u0026H", "n": [ { "c": 2, "d": ".gnu_debuglink reference present", "i": "metadata/build/debug::elf-debuglink", "o": 78592, "z": 16, "cf": 1.0 } ], "ln": 78576 }, { "b": "y?bbiwb[k{zGNNBvrl8Ze[xlBB9RQ5e[xlBB98B5e]\u003eJtvj(8ozu8qfwO=xtwo\u00264)e[]iqBo0}nwQ5p", "n": [ { "c": 2, "d": "ELF dynstr section name", "i": "metadata/binary/linking/static::elf-dynstr-section-name", "o": 78683, "z": 7, "cf": 0.8999999761581421 }, { "c": 2, "d": "ELF dynsym section name", "i": "metadata/binary/linking/static::elf-dynsym-section-name", "o": 78675, "z": 7, "cf": 0.8999999761581421 } ], "ln": 78659 }, { "b": "vr?\u00269wmoN*e]\u003eJte]\u003e\u003ege[xlBvqPZ*04}]5Bo0}7vrt]Te[e)y04}]4BZFV\u003cvS=s1x(mX^", "n": [ { "c": 2, "d": "ELF dynamic section name", "i": "metadata/binary/linking/static::elf-dynamic-section-name", "o": 78798, "z": 8, "cf": 0.8999999761581421 } ], "ln": 78782 } ], "depth": 1, "facts": { "exp": [ [ "init" ], [ "janssonmod_set" ], [ "exports" ], [ "janssonmod_set_replace" ], [ "mod_register" ], [ "janssonmod_pv_get" ], [ "json_path_get" ], [ "janssonmod_get_helper" ], [ "jansson_to_xval" ], [ "fini" ], [ "janssonmod_set_append" ], [ "module_version" ], [ "jansson_xdecode" ], [ "module_interface_ver" ], [ "json_path_set" ], [ "janssonmod_get" ], [ "module_flags" ], [ "janssonmod_array_size" ], [ "jansson_xencode" ], [ "jansson_to_val" ], [ "janssonmod_get_field" ] ], "imp": [ [ "", "strcpy" ], [ "", "sr_kemi_modules_add" ], [ "", "json_dumps" ], [ "", "fixup_pvar_null" ], [ "", "json_object_update" ], [ "", "get_str_fparam" ], [ "", "process_no" ], [ "", "xavp_add_value" ], [ "", "json_object_iter" ], [ "", "km_log_func" ], [ "", "fixup_free_spve_spve" ], [ "", "json_object_iter_value" ], [ "", "fixup_spve_spve" ], [ "", "fixup_spve_null" ], [ "", "json_object_iter_key" ], [ "", "json_delete" ], [ "", "json_string" ], [ "", "cxa_finalize" ], [ "", "pv_value_destroy" ], [ "", "xavp_get" ], [ "", "malloc" ], [ "", "strtoll" ], [ "", "dprint_color_reset" ], [ "", "json_object_key_to_iter" ], [ "", "get_debug_facility" ], [ "", "json_object_iter_next" ], [ "", "json_stringn" ], [ "", "json_loads" ], [ "", "log_level_info" ], [ "", "stack_chk_fail" ], [ "", "strtol" ], [ "", "dprint_color" ], [ "", "fixup_free_pvar_null" ], [ "", "json_object_get" ], [ "", "strtod" ], [ "", "json_array_append_new" ], [ "", "fprintf" ], [ "", "json_object_set_new" ], [ "", "deregister_frame_info" ], [ "", "json_real_value" ], [ "", "json_array_set_new" ], [ "", "log_prefix_val" ], [ "", "ITM_registerTMCloneTable" ], [ "", "json_integer_value" ], [ "", "json_false" ], [ "", "my_pid" ], [ "", "ITM_deregisterTMCloneTable" ], [ "", "json_array_get" ], [ "", "dprint_crit" ], [ "", "pv_get_spec_value" ], [ "", "json_array_size" ], [ "", "asprintf" ], [ "", "stderr" ], [ "", "fixup_free_spve_null" ], [ "", "json_null" ], [ "", "json_true" ], [ "", "get_debug_level" ], [ "", "json_string_value" ], [ "", "log_stderr" ], [ "", "ksr_slog_func" ], [ "", "json_integer" ], [ "", "json_real" ], [ "", "pv_cache_get" ], [ "", "json_object" ], [ "", "log_color" ], [ "", "register_frame_info" ], [ "", "strpbrk" ], [ "", "free" ] ], "sec": [ [ ".note.gnu.property", 680, 48, 1.94, "alloc" ], [ ".note.gnu.build-id", 728, 36, 4.25, "alloc" ], [ ".gnu.hash", 768, 252, 4.06, "alloc" ], [ ".dynsym", 1024, 2160, 1.55, "alloc" ], [ ".dynstr", 3184, 1403, 4.44, "alloc" ], [ ".rela.dyn", 4592, 1992, 1.72, "alloc" ], [ ".relr.dyn", 6584, 40, 2.52, "alloc" ], [ ".init", 8192, 3, 1.58, "alloc,executable" ], [ ".text", 8208, 49898, 6.02, "alloc,executable" ], [ ".fini", 58106, 3, 1.58, "alloc,executable" ], [ ".rodata", 61440, 6719, 5.01, "alloc" ], [ ".eh_frame_hdr", 68160, 268, 4.63, "alloc" ], [ ".eh_frame", 68432, 5852, 5.21, "alloc" ], [ ".init_array", 76712, 8, 1.06, "write,alloc" ], [ ".fini_array", 76720, 8, 1.06, "write,alloc" ], [ ".data.rel.ro", 76728, 32, 0.54, "write,alloc" ], [ ".dynamic", 76760, 464, 1.33, "write,alloc" ], [ ".got", 77224, 600, 0.05, "write,alloc" ], [ ".data", 77824, 768, 1.21, "write,alloc" ], [ ".gnu_debuglink", 78592, 24, 3.8, "" ], [ ".shstrtab", 78616, 222, 4.19, "" ] ], "metrics": { "elf": { "bits": 64.0, "entry": 0.0, "has_got": 1.0, "has_plt": 0.0, "has_note": 1.0, "note_count": 2.0, "nx_enabled": 1.0, "has_dt_relr": 1.0, "has_runpath": 1.0, "dynrel_count": 0.0, "dynsym_count": 90.0, "has_build_id": 1.0, "has_eh_frame": 1.0, "has_gnu_hash": 1.0, "stack_canary": 1.0, "symtab_count": 0.0, "dynrela_count": 83.0, "has_debuglink": 1.0, "little_endian": 1.0, "dt_flags_1_raw": 1.0, "pltreloc_count": 0.0, "build_id_length": 20.0, "executable_stack": 0.0, "fini_array_count": 1.0, "init_array_count": 1.0, "wx_segment_count": 0.0, "program_header_count": 11.0, "gnu_stack_section_absent": 0.0, "load_segment_max_file_size": 49917.0, "stripped_but_symtab_present": 0.0, "load_segment_max_memory_size": 49917.0, "section_relocation_group_count": 1.0, "stripped_metadata_section_count": 8.0 }, "file": { "size": 80312.0, "entropy": 5.63, "size_bytes": 80312.0 }, "binary": { "is_pie": 0.0, "has_overlay": 1.0, "is_stripped": 1.0, "code_entropy": 6.02, "data_entropy": 0.86, "overlay_size": 1474.0, "string_count": 304.0, "overlay_ratio": 0.02, "overall_entropy": 5.63, "overlay_entropy": 1.4, "entropy_variance": 3.02, "avg_string_length": 24.76, "max_string_length": 293.0, "peak_region_bytes": 47104.0, "code_to_data_ratio": 0.96, "peak_region_entropy": 6.02, "string_length_stddev": 21.98, "largest_section_ratio": 0.62, "sentence_string_count": 60.0, "sentence_string_ratio": 0.2, "high_entropy_string_count": 0.0 }, "exports": { "count": 21.0 }, "imports": { "count": 68.0 }, "sections": { "count": 23.0, "code_size": 49904.0, "entropy_max": 6.02, "entropy_mean": 2.75, "name_entropy": 4.14, "writable_count": 7.0, "executable_count": 3.0, "nonstandard_count": 6.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 2.0 } } }, "id": 2, "mol": "Md(He)", "path": "/data/samples/unknown/foraged/alpine/alpinelinux.org/_/kamailio-jansson/kamailio-jansson-6.0.6-r0.apk!!usr/lib/kamailio/modules/jansson.so", "risk": 1, "sha": "fd1a0e422e410dc51cbb5f7fe558cd20038773146cfee17b5d9f90686dc9f0ec", "size": 80312, "traits": [ { "id": "micro-behaviors/dylib/library/libc::libc-characteristic-cxa-finalize", "crit": 2, "desc": "libc characteristic cxa finalize", "spans": [ [ 3253, 12 ] ] }, { "id": "metadata/hardening/missing::stripped-binary", "conf": 0.800000011920929, "crit": 3, "desc": "No full symbol table (likely stripped)", "spans": [ [ 0, 25 ] ] }, { "id": "micro-behaviors/dylib/library/libc::libc-internal-functions-b", "conf": 0.699999988079071, "crit": 2, "desc": "libc internal symbols cluster B", "spans": [ [ 3253, 12 ] ] }, { "id": "micro-behaviors/dylib/library/abi-graphics::cxx-abi-symbols-a", "conf": 0.800000011920929, "crit": 2, "desc": "C++ ABI symbols cluster A", "spans": [ [ 3253, 12 ] ] } ], "type": "elf" }, { "ctx": [ { "b": "E))420S-r400000000000@$H+0rr910000000000kMy=:00000Fti8A0000000000kMA+z3JJA(7xtiJ0rr91", "n": [ { "c": 3, "d": "Strips toolchain banner but retains build-id", "i": "metadata/build/artifact::aggressive-strip", "o": 0, "z": 1, "cf": 1.0 } ], "ln": 0 }, { "b": "A-t+2y\u0026si5raflLwDl7Av%zA?w[=c\u003ey?Xib0af8zwPzu{x(!xcA:JB0vqPN.x(mK30af8NwOkZ#", "n": [ { "c": 3, "d": "Terminal socket exec helper context", "i": "micro-behaviors/process/fd/dup::unix-terminal-socket-exec-benign-context", "o": 3071, "z": 12, "cf": 0.949999988079071 } ], "ln": 3055 }, { "b": "B-7W?uVo^[uVH76Bo2VPB97\u00262yHpN+yHpWZx(0=Tv}e\u003eXB8L@6x(mTb0aPLWuUTU2zEm9}x(\u003ct\u0026B8I", "n": [ { "c": 3, "d": "Stack protector/canary enabled", "i": "metadata/hardening/build::stack-protector", "o": 3326, "z": 14, "cf": 0.8999999761581421 } ], "ln": 3310 }, { "b": "uU%Z(wDlE^z/e{5wNPxPy\u0026r/(y\u0026\u003cxdwDlvWBzkP60crm5w]}:7wDlE^z/e{6BAh8kx8(W/z/e]@zGGD5wPv==B8L@6zV", "n": [ { "c": 2, "d": "Convert time to UTC time", "i": "micro-behaviors/time/query::gmtime", "o": 3775, "z": 6, "cf": 0.20000000298023224 }, { "c": 2, "d": "localtime function (string)", "i": "micro-behaviors/time/query::localtime-string", "o": 3766, "z": 8, "cf": 0.20000000298023224 }, { "c": 2, "d": "Format time as string", "i": "micro-behaviors/time/query::strftime", "o": 3782, "z": 8, "cf": 0.20000000298023224 } ], "ln": 3749 }, { "b": "e]$}-gYRuavQ?3cB-RvJCSmP*hz^4cz.r:AvpJ!Oyiarhe]$}hflItRfkLuifkC0kvqb", "n": [ { "c": 3, "d": "Architecture detection strings", "i": "objectives/discovery/host/software::arch-detection", "o": 4050, "z": 6, "cf": 0.5 } ], "ln": 4034 }, { "b": "ax@n:v{-$(z/e{0z!7FgiY5VHt@\u003c8dvRGZ\u003cuTWCO04](Se?O!]z!a0bwPGIkv}df2", "n": [ { "c": 1, "d": "Port 443 (HTTPS)", "i": "objectives/command-and-control/infrastructure/ip::port-443", "o": 33052, "z": 4, "cf": 0.4000000059604645 } ], "ln": 33036 }, { "b": "uRS)-r8Lm\u0026rz#s[l@N5(lqgfxoh4]Qr4Gd.k#{AYqBKIWoJCH#mn\u003e-Wr7{j$p/G$-ml%sGo-", "n": [ { "c": 1, "d": "Benign context: deny/block-list word", "i": "objectives/credential-access/shell/history::shell-history-unless-cond-1--rx-3", "o": 36112, "z": 9, "cf": 0.30000001192092896 } ], "ln": 36096 }, { "b": "yHI6*x(4H4at$\u0026ae\u0026B?2CSmP*hz^6Xx(n6rdf6tF00000000000002p-q/\u003eY-q/\u003e/-qY", "n": [ { "c": 2, "d": "x86_64 architecture string", "i": "micro-behaviors/os/sysinfo/platform/string::arch-x86-64", "o": 36181, "z": 6, "cf": 0.30000001192092896 } ], "ln": 36165 }, { "b": "00000000000000000000vpJ!Oyiarhe]$}-wmYj)x8?]iy@net04@taB98CAvpxi?zF%Sde[Y6Ae]U\u0026Hz#", "n": [ { "c": 2, "d": ".gnu_debuglink reference present", "i": "metadata/build/debug::elf-debuglink", "o": 41608, "z": 17, "cf": 1.0 } ], "ln": 41592 }, { "b": "y?bbiwb[k{zGNNBvrl8Ze[xlBB9RQ5e[xlBB98B5e]\u003eJtvj(8ozu8qfwO=xtwo\u00264)e[]iqBo0}nwQ5p", "n": [ { "c": 2, "d": "ELF dynstr section name", "i": "metadata/binary/linking/static::elf-dynstr-section-name", "o": 41699, "z": 7, "cf": 0.8999999761581421 }, { "c": 2, "d": "ELF dynsym section name", "i": "metadata/binary/linking/static::elf-dynsym-section-name", "o": 41691, "z": 7, "cf": 0.8999999761581421 } ], "ln": 41675 }, { "b": "vr?\u00269wmoN*e]\u003eJte]\u003e\u003ege[xlBvqPZ*04}]5Bo0}7vrt]Te[e)y04}]4BZFV\u003cvS=s1x(mX^", "n": [ { "c": 2, "d": "ELF dynamic section name", "i": "metadata/binary/linking/static::elf-dynamic-section-name", "o": 41814, "z": 8, "cf": 0.8999999761581421 } ], "ln": 41798 } ], "depth": 1, "facts": { "exp": [ [ "cdr_expired_dlg_enable" ], [ "module_interface_ver" ], [ "acc_json_engine" ], [ "exports" ], [ "init" ], [ "fini" ], [ "cdr_enable" ], [ "acc_json_send_request" ], [ "cdr_q_name" ], [ "dlgb" ], [ "acc_q_name" ], [ "cdr_syslog_write" ], [ "acc_flag" ], [ "acc_time_mode" ], [ "cdr_json_pre_encoded_prefix" ], [ "cdr_json_init" ], [ "acc_output_syslog" ], [ "cdr_extra" ], [ "accb" ], [ "acc_extra" ], [ "cdr_output_mqueue_str" ], [ "acc_syslog_write" ], [ "acc_json_init" ], [ "cdr_output_syslog" ], [ "mq_api" ], [ "acc_json_pre_encoded_prefix" ], [ "acc_missed_flag" ], [ "cdr_json_engine" ], [ "module_version" ], [ "cdr_json_write" ], [ "acc_output_mqueue_str" ], [ "module_flags" ] ], "imp": [ [ "", "json_dumps" ], [ "", "find_export" ], [ "", "strndup" ], [ "", "process_no" ], [ "", "km_log_func" ], [ "", "json_delete" ], [ "", "json_string" ], [ "", "cxa_finalize" ], [ "", "dprint_color_reset" ], [ "", "get_debug_facility" ], [ "", "json_object_clear" ], [ "", "json_loads" ], [ "", "log_level_info" ], [ "", "stack_chk_fail" ], [ "", "dprint_color" ], [ "", "fprintf" ], [ "", "json_object_set_new" ], [ "", "deregister_frame_info" ], [ "", "log_prefix_val" ], [ "", "ITM_registerTMCloneTable" ], [ "", "openlog" ], [ "", "closelog" ], [ "", "strncmp" ], [ "", "json_object_size" ], [ "", "my_pid" ], [ "", "ITM_deregisterTMCloneTable" ], [ "", "localtime" ], [ "", "dprint_crit" ], [ "", "str2facility" ], [ "", "syslog" ], [ "", "stderr" ], [ "", "get_debug_level" ], [ "", "strftime" ], [ "", "log_stderr" ], [ "", "ksr_slog_func" ], [ "", "json_integer" ], [ "", "json_real" ], [ "", "gmtime" ], [ "", "json_object" ], [ "", "log_color" ], [ "", "pkg_root" ], [ "", "register_frame_info" ], [ "", "free" ] ], "sec": [ [ ".note.gnu.property", 680, 48, 1.94, "alloc" ], [ ".note.gnu.build-id", 728, 36, 4.14, "alloc" ], [ ".gnu.hash", 768, 412, 4.11, "alloc" ], [ ".dynsym", 1184, 1824, 1.71, "alloc" ], [ ".dynstr", 3008, 1084, 4.48, "alloc" ], [ ".rela.dyn", 4096, 1872, 1.51, "alloc" ], [ ".relr.dyn", 5968, 40, 2.17, "alloc" ], [ ".init", 8192, 3, 1.58, "alloc,executable" ], [ ".text", 8208, 24043, 5.92, "alloc,executable" ], [ ".fini", 32251, 3, 1.58, "alloc,executable" ], [ ".rodata", 32768, 3616, 5.24, "alloc" ], [ ".eh_frame_hdr", 36384, 100, 3.93, "alloc" ], [ ".eh_frame", 36488, 2268, 5.11, "alloc" ], [ ".init_array", 39888, 8, 1.06, "write,alloc" ], [ ".fini_array", 39896, 8, 1.06, "write,alloc" ], [ ".data.rel.ro", 39904, 16, 0.99, "write,alloc" ], [ ".dynamic", 39920, 464, 1.29, "write,alloc" ], [ ".got", 40384, 576, 0.04, "write,alloc" ], [ ".data", 40960, 648, 1.46, "write,alloc" ], [ ".gnu_debuglink", 41608, 24, 3.97, "" ], [ ".shstrtab", 41632, 222, 4.19, "" ] ], "metrics": { "elf": { "bits": 64.0, "entry": 0.0, "has_got": 1.0, "has_plt": 0.0, "has_note": 1.0, "note_count": 2.0, "nx_enabled": 1.0, "has_dt_relr": 1.0, "has_runpath": 1.0, "dynrel_count": 0.0, "dynsym_count": 76.0, "has_build_id": 1.0, "has_eh_frame": 1.0, "has_gnu_hash": 1.0, "stack_canary": 1.0, "symtab_count": 0.0, "dynrela_count": 78.0, "has_debuglink": 1.0, "little_endian": 1.0, "dt_flags_1_raw": 1.0, "pltreloc_count": 0.0, "build_id_length": 20.0, "executable_stack": 0.0, "fini_array_count": 1.0, "init_array_count": 1.0, "wx_segment_count": 0.0, "program_header_count": 11.0, "gnu_stack_section_absent": 0.0, "load_segment_max_file_size": 24062.0, "stripped_but_symtab_present": 0.0, "load_segment_max_memory_size": 24062.0, "section_relocation_group_count": 1.0, "stripped_metadata_section_count": 8.0 }, "file": { "size": 43328.0, "entropy": 5.31, "size_bytes": 43328.0 }, "binary": { "is_pie": 0.0, "has_overlay": 1.0, "is_stripped": 1.0, "code_entropy": 5.92, "data_entropy": 0.93, "overlay_size": 1474.0, "string_count": 206.0, "overlay_ratio": 0.03, "overall_entropy": 5.31, "overlay_entropy": 1.34, "entropy_variance": 2.85, "avg_string_length": 21.5, "max_string_length": 293.0, "peak_region_bytes": 23552.0, "code_to_data_ratio": 0.93, "peak_region_entropy": 5.97, "string_length_stddev": 23.99, "largest_section_ratio": 0.55, "sentence_string_count": 29.0, "sentence_string_ratio": 0.14, "high_entropy_string_count": 0.0 }, "exports": { "count": 32.0 }, "imports": { "count": 43.0 }, "sections": { "count": 23.0, "code_size": 24049.0, "entropy_max": 5.92, "entropy_mean": 2.74, "name_entropy": 4.14, "writable_count": 7.0, "executable_count": 3.0, "nonstandard_count": 6.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 2.0 } } }, "id": 3, "mol": "Md(He)", "path": "/data/samples/unknown/foraged/alpine/alpinelinux.org/_/kamailio-jansson/kamailio-jansson-6.0.6-r0.apk!!usr/lib/kamailio/modules/acc_json.so", "risk": 1, "sha": "c04de659af58f1aa8f4b13c339f6b17bbfb94913d1c473b3d9c8dfeaae818bfd", "size": 43328, "traits": [ { "id": "micro-behaviors/dylib/library/libc::libc-characteristic-cxa-finalize", "crit": 2, "desc": "libc characteristic cxa finalize", "spans": [ [ 3071, 12 ] ] }, { "id": "metadata/hardening/missing::stripped-binary", "conf": 0.800000011920929, "crit": 3, "desc": "No full symbol table (likely stripped)", "spans": [ [ 0, 25 ] ] }, { "id": "micro-behaviors/dylib/library/libc::libc-internal-functions-b", "conf": 0.699999988079071, "crit": 2, "desc": "libc internal symbols cluster B", "spans": [ [ 3071, 12 ] ] }, { "id": "micro-behaviors/dylib/library/abi-graphics::cxx-abi-symbols-a", "conf": 0.800000011920929, "crit": 2, "desc": "C++ ABI symbols cluster A", "spans": [ [ 3071, 12 ] ] } ], "type": "elf" }, { "ctx": [ { "b": "boPG/zE)\u0026%By!#9vTf88vS=y3wfrVXf/HZsuVGThePJM", "n": [ { "c": 1, "d": "Alpine/Wolfi package info file", "i": "metadata/package/files/system-package::alpine-pkginfo-basename", "o": 0, "z": 1, "cf": 0.8999999761581421 } ], "ln": 1, "addr": 0 }, { "b": "boRbIx(mMaw)]E^A=k(raA?spB7]MgatCG8h.D\u0026", "ln": 2, "addr": 36 }, { "b": "Abf97vqPM#jS[JGzddc{x(tOrvqZdcz/b", "n": [ { "c": 2, "d": "Alpine/Wolfi package info metadata", "i": "metadata/package/files/system-package::alpine-apk-pkginfo", "o": 68, "z": 26, "cf": 0.9700000286102295 } ], "ln": 3, "addr": 68 }, { "b": "Abf9fwPw[Rat$\u0026ae\u0026Cq4fA", "n": [ { "c": 1, "d": "Alpine/Wolfi package version field", "i": "metadata/package/files/system-package::alpine-pkginfo-version-field", "o": 95, "z": 17, "cf": 0.8999999761581421 } ], "ln": 4, "addr": 95 }, { "b": "Abf8%wPIu7jS)yazddc{x(ta\u0026AaK5#BzkVhB0bysazL$ozxK1xA+PA7B0bQDx(mMaygh13B8L}sy?Wv0vrcR", "ln": 5, "addr": 113 }, { "b": "B-IpvjS[AWBz#pZfe4J[Cp)Vtzddc{x(tRxA+v3", "ln": 6, "addr": 181 }, { "b": "B7]@iauZ\u00266gDmxGgY", "ln": 9, "addr": 294 }, { "b": "vrb\u003c\u003eauZ\u0026(i5Ub4gY", "ln": 10, "addr": 308 }, { "b": "z/PM8x(k4RazUz5vqfK(zV", "n": [ { "c": 1, "d": "Alpine/Wolfi package origin field", "i": "metadata/package/files/system-package::alpine-pkginfo-origin-field", "o": 322, "z": 17, "cf": 0.8999999761581421 } ], "ln": 11, "addr": 322 }, { "b": "v@Dj3x(\u003eEXayNn=hAr-LgIev0iwSMLgc4j7vQS.8h!uDew\u00268w2g=Nm4h.XU$h2", "ln": 12, "addr": 340 }, { "b": "zddc@Byw)3wPw[RawMu!xKL^3l2HsDy***(B09O.vqYZ?y^qABAa%i3y?W^fCRi]PxfD", "ln": 13, "addr": 390 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 684.0, "entropy": 5.16, "size_bytes": 684.0 }, "binary": { "overall_entropy": 5.16, "peak_region_bytes": 684.0, "peak_region_entropy": 5.16 } } }, "id": 4, "path": "/data/samples/unknown/foraged/alpine/alpinelinux.org/_/kamailio-jansson/kamailio-jansson-6.0.6-r0.apk!!.PKGINFO", "risk": 1, "sha": "368fc442768df0b089797df89f36735c77a695242d6c236f6432d3c3d19ba615", "size": 684, "traits": [ { "id": "metadata/package/files/system-package::arch-pkgver-field", "conf": 0.9399999976158142, "crit": 1, "desc": "Arch pkgver metadata field", "spans": [ [ 95, 17 ] ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-origin-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package origin field", "spans": [ [ 322, 17 ] ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-version-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package version field", "spans": [ [ 95, 17 ] ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-package-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package name field", "spans": [ [ 68, 26 ] ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-basename", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package info file" }, { "id": "metadata/package/files/system-package::arch-pkgname-field", "conf": 0.9399999976158142, "crit": 1, "desc": "Arch pkgname metadata field", "spans": [ [ 68, 26 ] ] }, { "id": "metadata/package/files/system-package::alpine-apk-pkginfo", "conf": 0.9700000286102295, "crit": 2, "desc": "Alpine/Wolfi package info metadata", "spans": [ [ 68, 26 ], [ 95, 17 ], [ 322, 17 ] ] } ], "type": "text" } ], "rev": "af11a", "v": "8" } }