{
  "ml": {
    "v": "7",
    "eng": "2.12.0-beta.2",
    "lvl": -1,
    "conf": 0,
    "mods": [
      {
        "cls": 0,
        "raw": 0.00006681681,
        "rte": "az",
        "prob": 0.00006681681
      }
    ],
    "prob": 0.00006681681,
    "files": [
      {
        "id": 0,
        "lvl": -1,
        "conf": 0,
        "prob": 0.00006681680679321289,
        "type": "xz"
      },
      {
        "id": 1,
        "lvl": -1,
        "conf": 0,
        "prob": 0.00000904997159523191,
        "type": "elf"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-09-30T23:15:16Z"
  },
  "path": "dvb-usb-cinergyT2.ko.xz",
  "raw": {
    "files": [
      {
        "id": 0,
        "mol": "O(Al)",
        "sha": "c102c2544cce61c2a04e6040e3c2a5f3ce120e790a84bea872b953672696e889",
        "path": "dvb-usb-cinergyT2.ko.xz",
        "risk": 2,
        "size": 3964,
        "type": "xz",
        "facts": {
          "metrics": {
            "file": {
              "size": 3964,
              "entropy": 7.96
            },
            "binary": {
              "peak_region_bytes": 3964,
              "peak_region_entropy": 7.83
            }
          }
        },
        "traits": [
          {
            "id": "metadata/package/license::gpl-word",
            "conf": 0.7,
            "crit": 2,
            "desc": "References the GPL license",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "metadata/file/extension/identity::linux-kernel-module-basename",
            "conf": 0.95,
            "crit": 2,
            "desc": "Linux kernel module basename",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "metadata/file/extension/identity::linux-kernel-package-artifact-basename",
            "conf": 0.95,
            "crit": 2,
            "desc": "Linux kernel package/module artifact basename",
            "from": [
              {
                "file": 1
              }
            ],
            "uses": [
              1
            ]
          },
          {
            "id": "objectives/anti-analysis/vm-detect/vendor::virtualbox-recognized-vendor-marker",
            "atk": "T1497.001",
            "conf": 0.9,
            "crit": 2,
            "desc": "Recognized VirtualBox vendor markers",
            "from": [
              {
                "file": 1
              }
            ],
            "uses": [
              2
            ]
          },
          {
            "id": "metadata/binary/header/identity::elf-relocatable-object",
            "conf": 0.9,
            "crit": 2,
            "desc": "ELF relocatable object file"
          },
          {
            "id": "objectives/anti-analysis/environment-detect/runtime::runtime-vm-detection-evidence",
            "mbc": "B0001",
            "conf": 0.9,
            "crit": 3,
            "desc": "Contains virtual-machine detection evidence",
            "from": [
              {
                "file": 1
              }
            ],
            "uses": [
              3
            ]
          }
        ]
      },
      {
        "ctx": [
          {
            "b": "E))420S-r400000000000rxOe0rr91000000000000000000007!BYc0000000000kMy=:002m:b(/g\u003c000000000000000000000000000000000000000000000000000000",
            "ln": 0
          },
          {
            "b": "000000000CB1GN^vrt{+zfo@iCMqe{BzbPkjYDupx={h(vrM5Vy?Wx\u003czGxwLm]h\u003eVwmY*(A+PGmx(v(LraQ8\u003cvru6\u003cavx\u003cXwPzBeaxg9sl@(Sar3kZ(x)a6d0b#v!z9qrrvq{s1A:JZ8iZ^1nayO!?AcbViaz#ssvR6O30b#v!zfg5xwJ:Ejvq{q",
            "ln": 7137
          },
          {
            "b": "d@]PJePL/AeIYmtg9xH\u0026p-%Z$wO2Z$BrCBswm6E%y\u0026r-)az(4cC4CYnx(v)gayOY0v}W+S000000000000000000000000000000001nB@@r300000000000000000000000000000000000000000005!}@@r3000000000000000000000000c4000Mg",
            "ln": 7534
          }
        ],
        "depth": 1,
        "facts": {
          "sec": [
            [
              "__patchable_function_entries",
              64,
              136,
              0.0,
              "write,alloc"
            ],
            [
              ".rela__patchable_function_entries",
              15712,
              408,
              1.57,
              "info_link"
            ],
            [
              ".data",
              200,
              888,
              1.46,
              "write,alloc"
            ],
            [
              ".rela.data",
              16120,
              96,
              1.29,
              "info_link"
            ],
            [
              ".exit.data",
              1088,
              8,
              0.0,
              "write,alloc"
            ],
            [
              ".rela.exit.data",
              16216,
              24,
              0.66,
              "info_link"
            ],
            [
              ".init.data",
              1096,
              8,
              0.0,
              "write,alloc"
            ],
            [
              ".rela.init.data",
              16240,
              24,
              0.66,
              "info_link"
            ],
            [
              ".gnu.linkonce.this_module",
              1104,
              1216,
              0.16,
              "write,alloc"
            ],
            [
              ".rela.gnu.linkonce.this_module",
              16264,
              48,
              1.19,
              "info_link"
            ],
            [
              ".plt",
              2320,
              1,
              0.0,
              "alloc,executable"
            ],
            [
              ".init.plt",
              2321,
              1,
              0.0,
              "alloc"
            ],
            [
              ".text.ftrace_trampoline",
              2322,
              1,
              0.0,
              "alloc,executable"
            ],
            [
              ".rodata",
              2328,
              4664,
              0.28,
              "alloc"
            ],
            [
              ".rela.rodata",
              16312,
              456,
              1.86,
              "info_link"
            ],
            [
              ".rodata.str1.8",
              6992,
              167,
              4.87,
              "alloc,merge,strings"
            ],
            [
              ".modinfo",
              7159,
              432,
              5.22,
              "alloc"
            ],
            [
              "__param",
              7592,
              80,
              0.53,
              "alloc"
            ],
            [
              ".rela__param",
              16768,
              192,
              1.28,
              "info_link"
            ],
            [
              ".init.text.ftrace_trampoline",
              7672,
              1,
              0.0,
              "alloc"
            ],
            [
              ".note.gnu.property",
              7680,
              32,
              1.69,
              "alloc"
            ],
            [
              ".note.gnu.build-id",
              7712,
              36,
              4.19,
              "alloc"
            ],
            [
              ".note.Linux",
              7748,
              68,
              3.37,
              "alloc"
            ],
            [
              "__versions",
              7816,
              1152,
              2.4,
              "alloc"
            ],
            [
              ".text",
              8968,
              2356,
              5.81,
              "alloc,executable"
            ],
            [
              ".rela.text",
              16960,
              1152,
              1.74,
              "info_link"
            ],
            [
              ".init.text",
              11328,
              68,
              3.82,
              "alloc,executable"
            ],
            [
              ".rela.init.text",
              18112,
              168,
              1.2,
              "info_link"
            ],
            [
              ".exit.text",
              11400,
              36,
              3.62,
              "alloc,executable"
            ],
            [
              ".rela.exit.text",
              18280,
              72,
              1.09,
              "info_link"
            ],
            [
              ".comment",
              11440,
              128,
              4.14,
              "merge,strings"
            ],
            [
              ".symtab",
              11568,
              2712,
              1.64,
              ""
            ],
            [
              ".strtab",
              14280,
              1427,
              4.71,
              ""
            ],
            [
              ".shstrtab",
              18352,
              358,
              4.25,
              ""
            ]
          ],
          "metrics": {
            "elf": {
              "bits": 64,
              "entry": 0,
              "has_got": 0,
              "has_plt": 1,
              "has_note": 1,
              "has_symtab": 1,
              "note_count": 3,
              "nx_enabled": 1,
              "dynrel_count": 0,
              "dynsym_count": 0,
              "has_build_id": 1,
              "has_eh_frame": 0,
              "no_gnu_stack": 0,
              "symtab_count": 113,
              "dynrela_count": 0,
              "little_endian": 1,
              "pltreloc_count": 0,
              "build_id_length": 20,
              "executable_stack": 0,
              "wx_segment_count": 0,
              "comment_entry_count": 4,
              "program_header_count": 0,
              "stripped_with_symtab": 1,
              "comment_distinct_count": 1,
              "executable_segment_count": 0,
              "load_segment_max_file_size": 0,
              "load_segment_max_memory_size": 0,
              "section_relocation_group_count": 10,
              "stripped_metadata_section_count": 5
            },
            "file": {
              "size": 21080,
              "entropy": 2.93
            },
            "binary": {
              "is_pie": 0,
              "has_overlay": 1,
              "is_stripped": 0,
              "code_entropy": 5.72,
              "data_entropy": 0.66,
              "overlay_size": 2370,
              "string_count": 114,
              "overlay_ratio": 0.11,
              "overlay_entropy": 1.22,
              "entropy_variance": 3.14,
              "avg_string_length": 19.75,
              "max_string_length": 72,
              "peak_region_bytes": 2048,
              "code_to_data_ratio": 0.52,
              "peak_region_entropy": 5.91,
              "string_length_stddev": 12.02,
              "largest_section_ratio": 0.22,
              "sentence_string_count": 8,
              "sentence_string_ratio": 0.07,
              "high_entropy_string_count": 0
            },
            "strings": {
              "truncated": 0,
              "retained_count": 114,
              "extracted_count": 114
            },
            "sections": {
              "count": 37,
              "code_size": 2462,
              "entropy_max": 5.81,
              "entropy_mean": 1.9,
              "name_entropy": 4.15,
              "writable_count": 6,
              "executable_count": 5,
              "nonstandard_count": 28,
              "executable_writable_count": 0
            },
            "dependencies": {
              "count": 0
            }
          }
        },
        "id": 1,
        "mol": "O(Al)",
        "path": "dvb-usb-cinergyT2.ko.xz!!dvb-usb-cinergyT2.ko",
        "pid": 0,
        "risk": 2,
        "sha": "fd6ed4673a3f6d7ff75fc7e0958a0f5e1665f0cbab7b153f3ed4bcf66e62aaf9",
        "size": 21080,
        "traits": [
          {
            "id": "metadata/binary/header/identity::elf-relocatable-object",
            "conf": 0.9,
            "crit": 2,
            "desc": "ELF relocatable object file"
          },
          {
            "id": "metadata/file/extension/identity::linux-kernel-module-basename",
            "conf": 0.95,
            "crit": 2,
            "desc": "Linux kernel module basename"
          },
          {
            "id": "metadata/package/license::gpl-word",
            "conf": 0.7,
            "crit": 2,
            "desc": "References the GPL license",
            "spans": [
              [
                7185,
                0
              ]
            ]
          },
          {
            "id": "metadata/file/extension/identity::linux-kernel-package-artifact-basename",
            "conf": 0.95,
            "crit": 2,
            "desc": "Linux kernel package/module artifact basename",
            "uses": [
              1
            ]
          },
          {
            "id": "objectives/anti-analysis/vm-detect/vendor::virtualbox-recognized-vendor-marker",
            "atk": "T1497.001",
            "conf": 0.9,
            "crit": 2,
            "desc": "Recognized VirtualBox vendor markers",
            "uses": [
              3
            ]
          },
          {
            "id": "objectives/anti-analysis/environment-detect/runtime::runtime-vm-detection-evidence",
            "mbc": "B0001",
            "conf": 0.9,
            "crit": 3,
            "desc": "Contains virtual-machine detection evidence",
            "uses": [
              4
            ]
          }
        ],
        "type": "elf"
      }
    ],
    "rev": "c1ea9",
    "v": "8"
  }
}