{ "ml": { "v": "7", "eng": "2.12.0-beta.2", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.00006535649, "rte": "az", "prob": 0.00006535649 } ], "prob": 0.00006535649, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.00006535649299621582, "type": "xz" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.000008831421837385278, "type": "elf" } ], "version": "v18.18", "analyzed_at": "2026-10-01T00:19:15Z" }, "path": "industrialio-gts-helper.ko.xz", "raw": { "files": [ { "id": 0, "mol": "O(Al)", "sha": "c84d46c4ce90f230fde890d7942e8eba4f599b843ceafe4b2ca3bee54d8c86a6", "path": "industrialio-gts-helper.ko.xz", "risk": 2, "size": 5024, "type": "xz", "facts": { "metrics": { "file": { "size": 5024, "entropy": 7.96 }, "binary": { "peak_region_bytes": 5024, "peak_region_entropy": 7.83 } } }, "traits": [ { "id": "metadata/file/extension/identity::linux-kernel-package-artifact-basename", "conf": 0.95, "crit": 2, "desc": "Linux kernel package/module artifact basename", "from": [ { "file": 1 } ], "uses": [ 4 ] }, { "id": "objectives/anti-analysis/environment-detect/runtime::runtime-vm-detection-evidence", "mbc": "B0001", "conf": 0.9, "crit": 3, "desc": "Contains virtual-machine detection evidence", "from": [ { "file": 1 } ], "uses": [ 3 ] }, { "id": "metadata/binary/header/identity::elf-relocatable-object", "conf": 0.9, "crit": 2, "desc": "ELF relocatable object file" }, { "id": "objectives/anti-analysis/vm-detect/vendor::virtualbox-recognized-vendor-marker", "atk": "T1497.001", "conf": 0.9, "crit": 2, "desc": "Recognized VirtualBox vendor markers", "from": [ { "file": 1 } ], "uses": [ 0 ] }, { "id": "metadata/file/extension/identity::linux-kernel-module-basename", "conf": 0.95, "crit": 2, "desc": "Linux kernel module basename", "from": [ { "file": 1 } ] }, { "id": "metadata/package/license::gpl-word", "conf": 0.7, "crit": 2, "desc": "References the GPL license", "from": [ { "file": 1 } ] } ] }, { "ctx": [ { "b": "E))420S-r400000000000rxOe0rr9100000000000000000000\u003eTCKL0000000000kMy=:002m:8VQ=Ra0pWoa0pWoa0pWoa0pWo1opZ.\u0026r69gw\u003eF0f1WFH7w!RMxmrtx$GB2x", "ln": 0 }, { "b": "000000000000000000000000000000000000000000000000000000000000wmY}3uUKj)uUsF4uTXa^x(4c+y\u00260D?A=k)%wmY*(A+PGmx(v(LnL8Y2y?WJ}BrCTozGx-pazka%zy]%AzdLquv{%g+aztt5AaK6h0ay1(xM4]Oo\u003c@c=x={C+x([DhzE)Ydjz!IMDtc@ivpJ!=B-8p^xkI6\u003ey+xjoz9v@ox\u003e7Z(B7EH8p!Q\u003egA:%o7A=U@kzAQDQl]Ev^f*NSRiwS@!l{\u0026W@f*NPYli7LcAaJ]$B3fIqzGG]gwJ:e@zEEx[j.X!AB-RUBx\u003c\u003e*(z^Nd0B6\u0026P(y\u0026A%a0cR{]zdd6\u003ev)8.5f/P", "ln": 6680 }, { "b": "d@]PJePL/AeIYmtg9xH\u0026p-%Z$wO2Z$BrCBswm6E%y\u0026r-)az(4cC4CYnx(v)gayOY0v}W+S0bld=uUsF4uVZjdvqGp-vqfQ^Bz\u003eJcv{%g+07/:TuQ[6]uR0QVp^[mZwmY}3uUKj)uUKy(Bye-@z^Nd0A@X^6pHuQ\u003eq^S6:oI!eQ0bld=uUsF4uTW+!uTXa^", "ln": 6969 } ], "depth": 1, "facts": { "sec": [ [ ".text", 64, 4888, 6.14, "alloc,executable" ], [ ".rela.text", 15248, 960, 1.73, "info_link" ], [ ".note.gnu.property", 4952, 32, 1.69, "alloc" ], [ ".note.gnu.build-id", 4984, 36, 4.25, "alloc" ], [ ".note.Linux", 5020, 68, 3.37, "alloc" ], [ "__ksymtab_gpl", 5088, 192, 0.0, "alloc" ], [ ".rela__ksymtab_gpl", 16208, 1152, 1.43, "info_link" ], [ "__kcrctab_gpl", 5280, 64, 5.78, "alloc" ], [ "__patchable_function_entries", 5344, 160, 0.0, "write,alloc" ], [ ".rela__patchable_function_entries", 17360, 480, 1.56, "info_link" ], [ ".gnu.linkonce.this_module", 5504, 1216, 0.21, "write,alloc" ], [ ".plt", 6720, 1, 0.0, "alloc,executable" ], [ ".init.plt", 6721, 1, 0.0, "alloc" ], [ ".text.ftrace_trampoline", 6722, 1, 0.0, "alloc,executable" ], [ ".rodata.str1.8", 6728, 28, 3.67, "alloc,merge,strings" ], [ ".modinfo", 6756, 270, 5.08, "alloc" ], [ "__ksymtab_strings", 7026, 704, 4.44, "alloc,merge,strings" ], [ "__versions", 7736, 576, 1.86, "alloc" ], [ ".init.text.ftrace_trampoline", 8312, 1, 0.0, "alloc" ], [ ".comment", 8313, 96, 4.14, "merge,strings" ], [ ".symtab", 8416, 3960, 1.59, "" ], [ ".strtab", 12376, 2869, 4.11, "" ], [ ".shstrtab", 17840, 309, 4.44, "" ] ], "metrics": { "elf": { "bits": 64, "entry": 0, "has_got": 0, "has_plt": 1, "has_note": 1, "has_symtab": 1, "note_count": 3, "nx_enabled": 1, "dynrel_count": 0, "dynsym_count": 0, "has_build_id": 1, "has_eh_frame": 0, "no_gnu_stack": 0, "stack_canary": 1, "symtab_count": 165, "dynrela_count": 0, "little_endian": 1, "pltreloc_count": 0, "build_id_length": 20, "executable_stack": 0, "wx_segment_count": 0, "comment_entry_count": 3, "program_header_count": 0, "stripped_with_symtab": 1, "comment_distinct_count": 1, "executable_segment_count": 0, "load_segment_max_file_size": 0, "load_segment_max_memory_size": 0, "section_relocation_group_count": 3, "stripped_metadata_section_count": 5 }, "file": { "size": 19880, "entropy": 4.29 }, "binary": { "is_pie": 0, "has_overlay": 1, "is_stripped": 0, "code_entropy": 6.14, "data_entropy": 0.18, "overlay_size": 1731, "string_count": 134, "overlay_ratio": 0.09, "overlay_entropy": 1.13, "entropy_variance": 4.16, "avg_string_length": 28.63, "max_string_length": 72, "peak_region_bytes": 4096, "code_to_data_ratio": 0.78, "peak_region_entropy": 6.23, "string_length_stddev": 13.7, "largest_section_ratio": 0.25, "sentence_string_count": 4, "sentence_string_ratio": 0.03, "high_entropy_string_count": 0 }, "strings": { "truncated": 0, "retained_count": 134, "extracted_count": 134 }, "sections": { "count": 27, "code_size": 4890, "entropy_max": 6.14, "entropy_mean": 2.41, "name_entropy": 4.36, "writable_count": 4, "executable_count": 3, "nonstandard_count": 19, "executable_writable_count": 0 }, "dependencies": { "count": 0 } } }, "id": 1, "mol": "O(Al)", "path": "industrialio-gts-helper.ko.xz!!industrialio-gts-helper.ko", "pid": 0, "risk": 2, "sha": "e0684fb2095232b809e54632703fd4e9e533b49713142767fe851d39a3358c0d", "size": 19880, "traits": [ { "id": "metadata/binary/header/identity::elf-relocatable-object", "conf": 0.9, "crit": 2, "desc": "ELF relocatable object file" }, { "id": "metadata/file/extension/identity::linux-kernel-module-basename", "conf": 0.95, "crit": 2, "desc": "Linux kernel module basename" }, { "id": "metadata/package/license::gpl-word", "conf": 0.7, "crit": 2, "desc": "References the GPL license", "spans": [ [ 6867, 0 ] ] }, { "id": "metadata/file/extension/identity::linux-kernel-package-artifact-basename", "conf": 0.95, "crit": 2, "desc": "Linux kernel package/module artifact basename", "uses": [ 1 ] }, { "id": "objectives/anti-analysis/vm-detect/vendor::virtualbox-recognized-vendor-marker", "atk": "T1497.001", "conf": 0.9, "crit": 2, "desc": "Recognized VirtualBox vendor markers", "uses": [ 3 ] }, { "id": "objectives/anti-analysis/environment-detect/runtime::runtime-vm-detection-evidence", "mbc": "B0001", "conf": 0.9, "crit": 3, "desc": "Contains virtual-machine detection evidence", "uses": [ 4 ] } ], "type": "elf" } ], "rev": "c1ea9", "v": "8" } }