{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.0002506344171706587, "class": 0 } ], "prob": 0.00025063442, "class": 0, "models": [ { "m": "az", "prob": 0.0001056677, "class": 0 }, { "m": "az/native", "prob": 0.00025063442, "class": 0 }, { "m": "az/elf", "prob": 0.000019042389, "class": 0 } ], "version": "v16.16", "thresholds": [ 0.9953178, 0.9991311 ], "analyzed_at": "2026-05-03T12:55:51Z" }, "path": "librumpfs_ntfs.so.0.0", "raw": { "v": "4", "fs": [ { "f": "O₂(CI)Md₂(HeBi₃)", "x": 3, "id": 0, "is": [ "", "rumpns_bdevsw_lookup", "rumpns_genfs_node_init", "rumpns_sysctl_teardown", "rumpns_set_statvfs_info", "rumpns_vop_kqfilter_desc", "rumpns_mutex_init", "rumpns_vop_default_desc", "rumpns_genfs_pathconf", "rumpns_vop_revoke_desc", "deregister_frame_info", "rumpns_uiomove", "rumpns_vop_setattr_desc", "rumpns_vop_fallocate_desc", "rumpns_namei_simple_user", "rumpns_bawrite", "rumpns_genfs_can_access", "rumpns_memset", "rumpns_genfs_node_destroy", "rumpns_vop_lookup_desc", "rumpns_vop_islocked_desc", "rumpns_genfs_compat_gop_write", "rumpns_eopnotsupp", "rumpns_vput", "rumpns_VFS_STATVFS", "rumpns_vrele", "rumpns_getblk", "Jv_RegisterClasses", "rumpns_desiredvnodes", "rumpns_VOP_CLOSE", "rumpns_cv_init", "rumpns_strncpy", "rumpns_genfs_mmap", "rumpns_x86_curlwp", "rumpns_vfs_vnode_iterator_destroy", "rumpns_vop_mkdir_desc", "rumpns_device_class", "rumpns_vop_inactive_desc", "rumpns_kmem_alloc", "rumpns_vop_ioctl_desc", "rumpns_makefstype", "rumpns_vop_symlink_desc", "rumpns_hashinit", "rumpns_vop_abortop_desc", "rumpns_strncmp", "rumpns_strcpy", "rumpns_vop_create_desc", "rumpns_genfs_compat_getpages", "rumpns_genfs_enoioctl", "rumpns_panic", "rumpns_genfs_kqfilter", "rumpns_vop_rename_desc", "rumpns_vop_seek_desc", "rumpns_mutex_exit", "rumpns_vop_poll_desc", "rumpns_genfs_suspendctl", "rumpns_genfs_putpages", "rumpns_vop_link_desc", "rumpns_mutex_destroy", "rumpns_genfs_unlock", "rumpns_spec_node_setmountedfs", "rumpns_genfs_islocked", "rumpns_genfs_seek", "rumpns_bread", "rumpns_mountlist_append", "rumpns_vop_getpages_desc", "rumpns_copy_statvfs_info", "rumpns_vop_remove_desc", "rumpns_kern_free", "rumpns_vop_mmap_desc", "stack_chk_guard", "rumpns_vop_readlink_desc", "rumpns_VOP_UNLOCK", "rumpns_kern_assert", "rumpns_vfs_vnode_iterator_init", "rumpns_genfs_fcntl", "cxa_finalize", "rumpns_biodone", "register_frame_info", "rumpns_vop_write_desc", "rumpns_strcmp", "rumpns_vfs_attach", "rumpns_vfs_rele", "rumpns_uvm_vnp_setsize", "rumpns_kern_malloc", "rumpns_VOP_OPEN", "rumpns_vn_bwrite", "rumpns_vinvalbuf", "rumpns_vop_close_desc", "rumpns_cv_signal", "rumpns_vop_readdir_desc", "rumpns_vop_reclaim_desc", "rumpns_vfs_detach", "rumpns_VOP_ACCESS", "rumpns_vop_fdiscard_desc", "rumpns_genfs_revoke", "rumpns_genfs_eopnotsupp", "rumpns_vop_strategy_desc", "rumpns_vn_lock", "rumpns_sysctl_createv", "rumpns_genfs_renamelock_enter", "rumpns_vop_parsepath_desc", "rumpns_vop_fcntl_desc", "rumpns_vop_pathconf_desc", "rumpns_vop_rmdir_desc", "rumpns_rootvp", "rumpns_strlen", "rumpns_vop_bwrite_desc", "rumpns_mutex_enter", "rumpns_genfs_renamelock_exit", "rumpns_kmem_zalloc", "rumpns_vop_read_desc", "rumpns_vcache_get", "rumpns_vop_lock_desc", "rumpns_cache_lookup", "rumpns_vfs_vnode_iterator_next", "rumpns_vop_accessx_desc", "rumpns_vflushbuf", "rumpns_vop_fsync_desc", "rumpns_vop_open_desc", "rumpns_vop_getattr_desc", "rumpns_NSM_FOLLOW_NOEMULROOT", "rumpns_kauth_accmode_to_action", "rumpns_vop_bmap_desc", "rumpns_memcpy", "rumpns_genfs_abortop", "rumpns_genfs_lock", "rumpns_vrefcnt", "rumpns_vop_mknod_desc", "rumpns_vop_access_desc", "rumpns_vref", "rumpns_vfs_rootmountalloc", "rumpns_cv_wait", "rumpns_genfs_nullop", "rumpns_hashdone", "rumpns_vop_advlock_desc", "rumpns_vrecycle", "rumpns_kauth_authorize_vnode", "rumpns_vop_print_desc", "rumpns_cache_enter", "rumpns_kmem_free", "rumpns_vflush", "rumpns_cv_destroy", "rumpns_vop_unlock_desc", "rumpns_genfs_parsepath", "rumpns_vfs_unbusy", "rumpns_genfs_accessx", "stack_chk_fail", "rumpns_brelse", "rumpns_printf", "rumpns_root_device", "rumpns_genfs_poll", "rumpns_vop_putpages_desc", "rumpns_vfs_stdextattrctl" ], "ms": { "elf": { "relro": "partial", "e_type": 3.0, "needed": [ "libc.so.12" ], "soname": "librumpfs_ntfs.so.0", "has_got": true, "has_plt": true, "has_note": true, "e_machine": 62.0, "class_bits": 64.0, "has_soname": true, "note_count": 2.0, "entry_point": 19216.0, "needed_libs": 1.0, "dynsym_count": 208.0, "has_eh_frame": true, "stack_canary": true, "symtab_count": 308.0, "dynrela_count": 136.0, "entry_section": ".text", "little_endian": true, "pltreloc_count": 109.0, "debuglink_present": true, "program_header_count": 7.0, "section_header_count": 33.0, "load_segment_max_p_memsz": 46656.0, "load_segment_max_p_filesz": 46656.0, "section_relocation_group_count": 2.0 }, "binary": { "code_size": 23172.0, "file_size": 66288.0, "entry_point": 19216.0, "has_overlay": true, "code_entropy": 4.05, "data_entropy": 2.17, "export_count": 55.0, "import_count": 154.0, "overlay_size": 2112.0, "string_count": 384.0, "overlay_ratio": 0.03, "section_count": 32.0, "avg_complexity": 4.76, "function_count": 137.0, "import_density": 6.81, "max_complexity": 62.0, "string_density": 16.97, "aliased_exports": 8.0, "overall_entropy": 2.83, "overlay_entropy": 1.44, "avg_basic_blocks": 7.13, "avg_section_size": 1957.13, "dependency_count": 1.0, "entropy_variance": 1.69, "function_density": 6.05, "avg_function_size": 309.83, "avg_string_length": 20.07, "complexity_per_kb": 0.21, "max_string_length": 66.0, "avg_string_entropy": 3.38, "code_to_data_ratio": 0.59, "data_to_file_ratio": 0.0, "text_to_file_ratio": 0.32, "total_basic_blocks": 977.0, "string_length_stddev": 11.3, "debug_reference_count": 1.0, "largest_section_ratio": 0.32, "sentence_string_count": 48.0, "sentence_string_ratio": 0.13, "function_analysis_depth": 2.0, "high_complexity_functions": 1.0, "nonstandard_section_name_count": 7.0 } }, "ss": [ [ 7087, "__cxa_finalize" ], [ 7102, "__deregister_frame_info" ], [ 7126, "__register_frame_info" ], [ 7148, "_Jv_RegisterClasses" ], [ 7168, "rumpns_genfs_pathconf" ], [ 7190, "rumpns_printf" ], [ 7204, "rumpns_ntfs_readattr" ], [ 7225, "rumpns_ntfs_writeattr_plain" ], [ 7253, "rumpns_memset" ], [ 7267, "rumpns_biodone" ], [ 7282, "rumpns_strlen" ], [ 7296, "rumpns_VOP_UNLOCK" ], [ 7314, "rumpns_ntfs_ntget" ], [ 7332, "rumpns_vrele" ], [ 7345, "rumpns_genfs_node_destroy" ], [ 7371, "rumpns_kmem_free" ], [ 7388, "rumpns_kern_free" ], [ 7405, "rumpns_ntfs_ntrele" ], [ 7424, "rumpns_ntfs_ntput" ], [ 7442, "rumpns_kern_malloc" ], [ 7461, "rumpns_ntfs_ntreaddir" ], [ 7483, "rumpns_ntfs_isnamepermitted" ], [ 7511, "rumpns_uiomove" ], [ 7526, "rumpns_strncpy" ], [ 7541, "rumpns_vflushbuf" ], [ 7558, "rumpns_ntfs_nttimetounix" ], [ 7583, "rumpns_VOP_ACCESS" ], [ 7601, "rumpns_cache_lookup" ], [ 7621, "rumpns_ntfs_ntvattrget" ], [ 7644, "rumpns_ntfs_vgetex" ], [ 7663, "rumpns_ntfs_ntvattrrele" ], [ 7687, "rumpns_ntfs_ntlookupfile" ], [ 7712, "rumpns_cache_enter" ], [ 7731, "rumpns_vref" ], [ 7743, "rumpns_genfs_can_access" ], [ 7767, "rumpns_kauth_accmode_to_action" ], [ 7798, "rumpns_kauth_authorize_vnode" ], [ 7827, "rumpns_ntfs_vnodeop_opv_desc" ], [ 7856, "rumpns_ntfs_vnodeop_p" ], [ 7878, "rumpns_ntfs_vnodeop_entries" ], [ 7906, "rumpns_vop_default_desc" ], [ 7930, "rumpns_vop_parsepath_desc" ], [ 7956, "rumpns_genfs_parsepath" ], [ 7979, "rumpns_vop_lookup_desc" ], [ 8002, "rumpns_vop_create_desc" ], [ 8025, "rumpns_genfs_eopnotsupp" ], [ 8049, "rumpns_vop_mknod_desc" ], [ 8071, "rumpns_vop_open_desc" ], [ 8092, "rumpns_vop_close_desc" ], [ 8114, "rumpns_vop_access_desc" ], [ 8137, "rumpns_vop_accessx_desc" ], [ 8161, "rumpns_genfs_accessx" ], [ 8182, "rumpns_vop_getattr_desc" ], [ 8206, "rumpns_vop_setattr_desc" ], [ 8230, "rumpns_vop_read_desc" ], [ 8251, "rumpns_vop_write_desc" ], [ 8273, "rumpns_vop_fallocate_desc" ], [ 8299, "rumpns_vop_fdiscard_desc" ], [ 8324, "rumpns_vop_fcntl_desc" ], [ 8346, "rumpns_genfs_fcntl" ], [ 8365, "rumpns_vop_ioctl_desc" ], [ 8387, "rumpns_genfs_enoioctl" ], [ 8409, "rumpns_vop_poll_desc" ], [ 8430, "rumpns_genfs_poll" ], [ 8448, "rumpns_vop_kqfilter_desc" ], [ 8473, "rumpns_genfs_kqfilter" ], [ 8495, "rumpns_vop_revoke_desc" ], [ 8518, "rumpns_genfs_revoke" ], [ 8538, "rumpns_vop_mmap_desc" ], [ 8559, "rumpns_genfs_mmap" ], [ 8577, "rumpns_vop_fsync_desc" ], [ 8599, "rumpns_vop_seek_desc" ], [ 8620, "rumpns_genfs_seek" ], [ 8638, "rumpns_vop_remove_desc" ], [ 8661, "rumpns_vop_link_desc" ], [ 8682, "rumpns_vop_rename_desc" ], [ 8705, "rumpns_vop_mkdir_desc" ], [ 8727, "rumpns_vop_rmdir_desc" ], [ 8749, "rumpns_vop_symlink_desc" ], [ 8773, "rumpns_vop_readdir_desc" ], [ 8797, "rumpns_vop_readlink_desc" ], [ 8822, "rumpns_vop_abortop_desc" ], [ 8846, "rumpns_genfs_abortop" ], [ 8867, "rumpns_vop_inactive_desc" ], [ 8892, "rumpns_vop_reclaim_desc" ], [ 8916, "rumpns_vop_lock_desc" ], [ 8937, "rumpns_genfs_lock" ], [ 8955, "rumpns_vop_unlock_desc" ], [ 8978, "rumpns_genfs_unlock" ], [ 8998, "rumpns_vop_bmap_desc" ], [ 9019, "rumpns_vop_strategy_desc" ], [ 9044, "rumpns_vop_print_desc" ], [ 9066, "rumpns_vop_islocked_desc" ], [ 9091, "rumpns_genfs_islocked" ], [ 9113, "rumpns_vop_pathconf_desc" ], [ 9138, "rumpns_vop_advlock_desc" ], [ 9162, "rumpns_genfs_nullop" ], [ 9182, "rumpns_vop_bwrite_desc" ], [ 9205, "rumpns_vn_bwrite" ], [ 9222, "rumpns_vop_getpages_desc" ], [ 9247, "rumpns_genfs_compat_getpages" ], [ 9276, "rumpns_vop_putpages_desc" ], [ 9301, "rumpns_genfs_putpages" ], [ 9323, "rumpns_ntfs_nthashdone" ], [ 9346, "rumpns_ntfs_nthashreinit" ], [ 9371, "rumpns_ntfs_nthashinit" ], [ 9394, "rumpns_ntfs_toupper_init" ], [ 9419, "__stack_chk_guard" ], [ 9437, "rumpns_memcpy" ], [ 9451, "rumpns_ntfs_ntlookup" ], [ 9472, "rumpns_ntfs_loadntnode" ], [ 9495, "rumpns_kmem_zalloc" ], [ 9514, "rumpns_strcpy" ], [ 9528, "rumpns_ntfs_ntref" ], [ 9546, "rumpns_genfs_node_init" ], [ 9569, "rumpns_uvm_vnp_setsize" ], [ 9592, "rumpns_kmem_alloc" ], [ 9610, "__stack_chk_fail" ], [ 9627, "rumpns_copy_statvfs_info" ], [ 9652, "rumpns_vflush" ], [ 9666, "rumpns_vrefcnt" ], [ 9681, "rumpns_spec_node_setmountedfs" ], [ 9711, "rumpns_x86_curlwp" ], [ 9729, "rumpns_vinvalbuf" ], [ 9746, "rumpns_vn_lock" ], [ 9761, "rumpns_VOP_CLOSE" ], [ 9778, "rumpns_ntfs_toupper_unuse" ], [ 9804, "rumpns_kern_assert" ], [ 9823, "rumpns_panic" ], [ 9836, "rumpns_ntfs_vfsops" ], [ 9855, "rumpns_vfs_detach" ], [ 9873, "rumpns_vfs_attach" ], [ 9891, "rumpns_sysctl_createv" ], [ 9913, "rumpns_sysctl_teardown" ], [ 9936, "rumpns_ntfs_calccfree" ], [ 9958, "rumpns_bread" ], [ 9971, "rumpns_brelse" ], [ 9985, "rumpns_strncmp" ], [ 10000, "rumpns_ntfs_utf8_wget" ], [ 10022, "rumpns_ntfs_utf8_wput" ], [ 10044, "rumpns_ntfs_utf8_wcmp" ], [ 10066, "rumpns_vput" ], [ 10078, "rumpns_ntfs_toupper_use" ], [ 10102, "rumpns_vfs_vnode_iterator_init" ], [ 10133, "rumpns_vrecycle" ], [ 10149, "rumpns_vfs_vnode_iterator_next" ], [ 10180, "rumpns_vfs_vnode_iterator_destroy" ], [ 10214, "rumpns_makefstype" ], [ 10232, "rumpns_root_device" ], [ 10251, "rumpns_device_class" ], [ 10271, "rumpns_vfs_rootmountalloc" ], [ 10297, "rumpns_rootvp" ], [ 10311, "rumpns_mountlist_append" ], [ 10335, "rumpns_vfs_unbusy" ], [ 10353, "rumpns_vfs_rele" ], [ 10369, "rumpns_NSM_FOLLOW_NOEMULROOT" ], [ 10398, "rumpns_namei_simple_user" ], [ 10423, "rumpns_bdevsw_lookup" ], [ 10444, "rumpns_set_statvfs_info" ], [ 10468, "rumpns_VOP_OPEN" ], [ 10484, "rumpns_VFS_STATVFS" ], [ 10503, "rumpns_vcache_get" ], [ 10521, "rumpns_eopnotsupp" ], [ 10539, "rumpns_vfs_stdextattrctl" ], [ 10564, "rumpns_genfs_suspendctl" ], [ 10588, "rumpns_genfs_renamelock_enter" ], [ 10618, "rumpns_genfs_renamelock_exit" ], [ 10647, "rumpns_ntfs_vnodeopv_descs" ], [ 10674, "rumpns_genfs_compat_gop_write" ], [ 10704, "rumpns_mutex_enter" ], [ 10723, "rumpns_cv_wait" ], [ 10738, "rumpns_mutex_exit" ], [ 10756, "rumpns_ntfs_nthashlookup" ], [ 10781, "rumpns_ntfs_hashlock" ], [ 10802, "rumpns_cv_init" ], [ 10817, "rumpns_mutex_init" ], [ 10835, "rumpns_ntfs_nthashins" ], [ 10857, "rumpns_ntfs_freentvattr" ], [ 10881, "rumpns_cv_signal" ], [ 10898, "rumpns_ntfs_nthashrem" ], [ 10920, "rumpns_mutex_destroy" ], [ 10941, "rumpns_cv_destroy" ], [ 10959, "rumpns_ntfs_runtovrun" ], [ 10981, "rumpns_ntfs_attrtontvattr" ], [ 11007, "rumpns_ntfs_writentvattr_plain" ], [ 11038, "rumpns_bawrite" ], [ 11053, "rumpns_getblk" ], [ 11067, "rumpns_ntfs_readntvattr_plain" ], [ 11097, "rumpns_ntfs_procfixups" ], [ 11120, "rumpns_ntfs_readattr_plain" ], [ 11147, "rumpns_ntfs_uncompunit" ], [ 11170, "rumpns_strcmp" ], [ 11184, "rumpns_desiredvnodes" ], [ 11205, "rumpns_hashinit" ], [ 11221, "rumpns_hashdone" ], [ 11237, "rumpns_ntfs_uncompblock" ], [ 11261, "libc.so.12" ], [ 11272, "__start_link_set_modules" ], [ 11297, "__stop_link_set_modules" ], [ 11321, "__start_link_set_rump_components" ], [ 11354, "__stop_link_set_rump_components" ], [ 11386, "__start_link_set_evcnts" ], [ 11410, "__stop_link_set_evcnts" ], [ 11433, "__start_link_set_sysctl_funcs" ], [ 11463, "__stop_link_set_sysctl_funcs" ], [ 11497, "librumpfs_ntfs.so.0" ], [ 19929, "AVAUATSH" ], [ 20296, "AWAVAUATSH" ], [ 20809, "TPRL" ], [ 20842, "PPD9" ], [ 21416, "AVAUATSL" ], [ 22323, "ATSH" ], [ 25951, "T0DI" ], [ 27577, "AUATSH" ], [ 28122, "AVAUATH" ], [ 31565, "FILEL" ], [ 35245, "LXRH" ], [ 36219, "INDXL" ], [ 38104, "AUATH" ], [ 39844, "AWAVAUATSI" ], [ 40656, "tag VT_NTFS, ino %llu, flag %#x, usecount %d, nlink %ld" ], [ 40720, "ntfs_read: ntfs_readattr failed: %d" ], [ 40760, "ntfs_write: CAN'T WRITE BEYOND END OF FILE" ], [ 40808, "ntfs_strategy: ntfs_readattr failed" ], [ 40848, "ntfs_strategy: CAN'T EXTEND FILE" ], [ 40888, "ntfs_strategy: ntfs_writeattr fail" ], [ 40936, "ntfs_root: VFS_VGET failed: %d" ], [ 40968, "ntfs_loadvnode: ntfs_ntget failed" ], [ 41008, "ntfs_loadvnode: CAN'T LOAD ATTRIBUTES FOR INO: %llu" ], [ 41064, "%s: attr %x for ino %ld: error %d" ], [ 41104, "ntfs_unmount: vflush failed(sysnodes): %d" ], [ 41152, "/usr/src/sys/rump/fs/lib/libntfs/../../../../fs/ntfs/ntfs_vfsops.c" ], [ 41224, "kernel %sassertion \"%s\" failed: file \"%s\", line %d" ], [ 41280, "ntfs_mount(): MNT_UPDATE not supported" ], [ 41331, "diagnostic" ], [ 41348, "NTFS" ], [ 41357, "%s: cannot recycle vnode %p" ], [ 41385, "root_device" ], [ 41400, "ntfs_loadvnode" ], [ 41416, "ntfs_mountfs" ], [ 41436, "%s: ino: %llu usecount: %d" ], [ 41464, "LIST_* forw %p %s:%d" ], [ 41485, "LIST_* back %p %s:%d" ], [ 41506, "%s: POSSIBLE RUN ERROR" ], [ 41530, "%s: invalid offset: %x" ], [ 41553, "%s: fixup %d doesn't match" ], [ 41581, "%s: BREAD FAILED" ], [ 41599, "%s: ntfs_readattr failed" ], [ 41625, "%s: BAD MFT RECORD %d" ], [ 41648, "LIST_INSERT_HEAD %p %s:%d" ], [ 41674, "%s: FAILED TO LOAD INO: %llu" ], [ 41704, "aalp != NULL" ], [ 41717, "%s: ATTRLIST ERROR." ], [ 41738, "%s: attrib: %qu - %qu" ], [ 41768, "ntfs_ntput: ino: %llu usecount: %d" ], [ 41808, "/usr/src/sys/rump/fs/lib/libntfs/../../../../fs/ntfs/ntfs_subr.c" ] ], "sz": 66288, "ts": [ { "c": 1.0, "d": ".gnu_debuglink reference present", "e": [ "librumpfs_ntfs.so.0.0.debug" ], "i": "metadata/build/debug::elf-debuglink", "l": 2 }, { "c": 1.0, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "l": 2 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 4.76" ], "i": "metadata/binary/metrics::avg-complexity-15-max", "l": 2 }, { "c": 0.8999999761581421, "d": "ELF dynsym section name", "e": [ ".dynsym" ], "i": "metadata/binary/linking::elf-dynsym-section-name", "l": 2 }, { "c": 0.800000011920929, "d": "libc version string pattern", "e": [ "libc.so.1" ], "i": "micro-behaviors/dylib/library/libc::libc-version-string", "l": 2 }, { "a": "T1071.001", "d": "Port 23 (telnet)", "e": [ ":23" ], "i": "objectives/command-and-control/infrastructure/ip::port-23", "l": 1, "m": "C0002" }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 154.00" ], "i": "metadata/binary/metrics::many-imports-25", "l": 1 }, { "c": 0.949999988079071, "d": "Compact C type format section", "e": [ ".SUNW_ctf" ], "i": "metadata/binary/section/content::sunw-ctf-section", "l": 1 }, { "d": ".so extension reference", "e": [ ".so", ".so", ".so" ], "i": "micro-behaviors/fs/path/extension::so", "l": 2 }, { "c": 1.0, "d": "ELF SONAME metadata", "e": [ "librumpfs_ntfs.so.0" ], "i": "metadata/binary/linking/runtime::soname", "l": 2 }, { "c": 0.8399999737739563, "d": "High basic block count in sparse binary", "e": [ "binary.total_basic_blocks = 977.00" ], "i": "metadata/binary/metrics::dense-basic-blocks", "l": 1 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 154.00" ], "i": "metadata/binary/metrics::many-imports-20", "l": 1 }, { "c": 1.0, "d": "Binary has 20+ sections (installer/packer)", "e": [ "binary.section_count = 32.00" ], "i": "metadata/binary/metrics::many-sections-20", "l": 1 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "binary.file_size = 66288.00" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.function_count = 137.00" ], "i": "metadata/binary/metrics::many-functions-50", "l": 1 }, { "a": "T1082", "c": 0.6000000238418579, "d": "Query or modify kernel state via sysctl", "e": [ "rumpns_sysctl_teardown", "rumpns_sysctl_createv", "stop_link_set_sysctl_funcs", "start_link_set_sysctl_funcs" ], "i": "micro-behaviors/os/sysinfo/config::sysctl", "l": 2, "m": "E1082" }, { "c": 0.800000011920929, "d": "Binary has many exports (\u003e10)", "e": [ "binary.export_count = 55.00" ], "i": "metadata/binary/metrics::many-exports", "l": 2 }, { "d": "Characteristic system library export __cxa_finalize", "e": [ "cxa_finalize" ], "i": "micro-behaviors/dylib/library/libc::libc-characteristic-cxa-finalize", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 154.00" ], "i": "metadata/binary/metrics::many-imports-50", "l": 1 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 154.00" ], "i": "metadata/binary/metrics::many-imports-40", "l": 1 }, { "c": 1.0, "d": "Binary format is identified", "e": [ "elf.class_bits = 64.00" ], "i": "metadata/binary::binary-format-checked", "l": 2 }, { "c": 0.8999999761581421, "d": "NetBSD-style /usr/src source path", "e": [ "/usr/src/sys/rump/fs/lib/libntfs/../../../../fs/ntfs/ntfs_vfsops.c", "/usr/src/sys/rump/fs/lib/libntfs/../../../../fs/ntfs/ntfs_subr.c", "/usr/src/sys/rump/fs/lib/libntfs/../../../../fs/ntfs/ntfs_ihash.c", "/usr/src/sys/rump/fs/lib/libntfs/../../../../fs/unicode.h" ], "i": "metadata/binary/provenance::netbsd-source-tree-path", "l": 2 }, { "c": 0.8999999761581421, "d": "ELF dynamic section name", "e": [ ".dynamic" ], "i": "metadata/binary/linking::elf-dynamic-section-name", "l": 2 }, { "c": 0.8999999761581421, "d": "ELF dynstr section name", "e": [ ".dynstr" ], "i": "metadata/binary/linking::elf-dynstr-section-name", "l": 2 }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.function_count = 137.00" ], "i": "metadata/binary/metrics::many-functions", "l": 2 }, { "a": "T1486", "c": 0.75, "d": "flock LOCK_EX call bytecode pattern", "e": [ "b8 eb db 48 8b", "be 55 e7 ff ff", "be ae db ff ff", "be b5 d7 ff ff", "be 38 d7 ff ff", "b9 63 c6 ff ff", "be c8 af ff ff", "be 77 ae ff ff", "be 64 ae ff ff" ], "i": "objectives/impact/ransom/esxi::flock-lockex", "l": 1, "m": "C0027" }, { "c": 1.0, "d": "Binary has 20+ exports", "e": [ "binary.export_count = 55.00" ], "i": "metadata/binary/metrics::many-exports-20", "l": 1 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 154.00" ], "i": "metadata/binary/metrics::many-imports-30", "l": 1 }, { "c": 1.0, "d": "Binary has 9+ exports", "e": [ "binary.export_count = 55.00" ], "i": "metadata/binary/metrics::many-exports-9", "l": 1 }, { "c": 0.8999999761581421, "d": "NetBSD RCS ident keyword", "e": [ "$NetBSD: ntfs_conv.c,v 1.10 2015/02/20 17:08:13 maxv Exp $", "$NetBSD: ntfs_vnops.c,v 1.66 2021/06/29 22:34:07 dholland Exp $", "$NetBSD: crtn.S,v 1.1 2010/08/07 18:01:35 joerg Exp $", "$NetBSD: ntfs_ihash.c,v 1.11 2015/02/20 17:08:13 maxv Exp $", "$NetBSD: crti.S,v 1.1 2010/08/07 18:01:35 joerg Exp $", "$NetBSD: ntfs_subr.c,v 1.64 2021/05/13 08:57:29 hannken Exp $", "$NetBSD: crtbegin.S,v 1.2 2010/11/30 18:37:59 joerg Exp $", "$NetBSD: ntfs_vfsops.c,v 1.110 2020/04/13 19:23:18 ad Exp $", "$NetBSD: crtend.S,v 1.1 2010/08/07 18:01:34 joerg Exp $", "$NetBSD: ntfs_compr.c,v 1.6 2015/02/20 17:08:13 maxv Exp $" ], "i": "metadata/binary/provenance::netbsd-rcs-id", "l": 2 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 2.83" ], "i": "metadata/binary/metrics::low-overall-entropy-binary", "l": 1 }, { "c": 1.0, "d": "ELF needed library metadata", "e": [ "[libc.so.12] (size: 1 (array))" ], "i": "metadata/binary/linking/runtime::needed-lib", "l": 2 }, { "d": "Binary exports symbols", "e": [ "binary.export_count = 55.00" ], "i": "metadata/binary/symbols::has-exports", "l": 1 }, { "a": "T1055", "c": 0.25, "d": "Repeated 0x07 code constant (possible PROT_RWX)", "e": [ "07 00 00 00", "07 00 00 00", "07 00 00 00" ], "i": "micro-behaviors/mem/protect/modify::rwx-prot-bytes", "l": 1 }, { "c": 0.8999999761581421, "d": "__stack_chk_fail function", "e": [ "stack_chk_fail", "stack_chk_fail", "sym.imp.__stack_chk_fail" ], "i": "metadata/hardening::stack-chk-fail", "l": 2 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.38" ], "i": "metadata/binary/metrics::avg-string-entropy-4-max", "l": 2 }, { "c": 0.800000011920929, "d": "High number of imported symbols (\u003e80)", "e": [ "binary.import_count = 154.00" ], "i": "metadata/binary/metrics::many-imports", "l": 2 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.function_count = 137.00" ], "i": "metadata/binary/metrics::few-functions-3", "l": 1 }, { "c": 1.0, "d": "Binary has 100+ imports", "e": [ "binary.import_count = 154.00" ], "i": "metadata/binary/metrics::many-imports-100", "l": 1 }, { "c": 1.0, "d": "ELF64 class marker", "e": [ "elf.class_bits = 64.00" ], "i": "metadata/binary/metrics::elf64-class", "l": 1 }, { "c": 0.8999999761581421, "d": "NX/DEP disabled (stack is executable)", "e": [ "elf.nx_enabled = 0.00" ], "i": "metadata/hardening::nx-disabled", "l": 3 }, { "c": 0.8999999761581421, "d": "ELF dynamic section name", "e": [ ".dynamic" ], "i": "metadata/hardening::elf-dynamic-section-name", "l": 2 }, { "c": 0.8999999761581421, "d": "ELF dynsym section name", "e": [ ".dynsym" ], "i": "metadata/hardening::elf-dynsym-section-name", "l": 2 }, { "c": 1.0, "d": "ELF external debug artifact reference", "e": [ "librumpfs_ntfs.so.0.0.debug" ], "i": "metadata/build/debug::external-debug-reference", "l": 2 }, { "c": 0.8999999761581421, "d": "ELF dynstr section name", "e": [ ".dynstr" ], "i": "metadata/hardening::elf-dynstr-section-name", "l": 2 } ], "sha": "b99fabd5ca491920a062ed438fe16d67de39d3a80cf956248032e83ed5ebb354", "path": "librumpfs_ntfs.so.0.0", "type": "elf" } ], "tv": "6e0da" } }