{
  "ml": {
    "v": "7",
    "eng": "2.2.0-rc.1",
    "lvl": -1,
    "conf": 0,
    "mods": [
      {
        "cls": 0,
        "raw": 0.00004266699,
        "rte": "az",
        "prob": 0.00004266699
      }
    ],
    "prob": 0.00007664164,
    "files": [
      {
        "id": 0,
        "lvl": -1,
        "conf": 0,
        "prob": 0.00007664164149900898,
        "type": "zst"
      },
      {
        "id": 1,
        "lvl": -1,
        "conf": 0,
        "prob": 0.00007664164149900898,
        "type": "elf"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-06-28T03:15:50Z"
  },
  "path": "snd-soc-nau8822.ko.zst",
  "raw": {
    "files": [
      {
        "id": 0,
        "ctx": [
          {
            "b": "d77-bQ^q/$0drS6N+b+siuWK91a^qdn\u0026yzSfM\u003c-tu\u0026",
            "n": [
              {
                "c": 2,
                "d": "Binary is not digitally signed",
                "i": "metadata/unsigned",
                "o": 0,
                "z": 1,
                "cf": 1.0
              }
            ],
            "ln": 0
          }
        ],
        "mol": "O₂(AsC)",
        "sha": "ceb1d4b4dbdb6ee2d41a885bd7339821304c40b827e89c308abb3739bb49e33d",
        "path": "snd-soc-nau8822.ko.zst",
        "risk": 3,
        "size": 22282,
        "type": "zst",
        "facts": {
          "metrics": {
            "file": {
              "size": 22282.0,
              "entropy": 7.99,
              "size_bytes": 22282.0
            },
            "binary": {
              "overall_entropy": 7.99,
              "peak_region_bytes": 22282.0,
              "peak_region_entropy": 7.82
            }
          }
        },
        "traits": [
          {
            "id": "metadata/build/artifact::elf-stripped-but-symtab-present",
            "conf": 0.6000000238418579,
            "crit": 3,
            "desc": "ELF stripped with .symtab present",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "objectives/anti-static/obfuscation/payload/code-in-data::nop-sled-in-data",
            "conf": 0.6499999761581421,
            "crit": 3,
            "desc": "Repeated NOP-run pattern in executable section",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "metadata/package/license::gpl-word",
            "conf": 0.699999988079071,
            "crit": 2,
            "desc": "GPL license reference",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/ip/literal::external-ipv4-binary",
            "conf": 0.8500000238418579,
            "crit": 2,
            "desc": "Hardcoded external IPv4 address",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "objectives/command-and-control/channel/redundancy::multi-channel-diversity",
            "atk": "T1071",
            "mbc": "B0030",
            "conf": 0.8500000238418579,
            "crit": 3,
            "desc": "C2 infrastructure using multiple communication methods",
            "from": [
              {
                "file": 1
              }
            ]
          }
        ]
      },
      {
        "ctx": [
          {
            "b": "E))420S-r400000000000rtp-0rr9100000000000000000000U^aof0000000000kMy=:002m:f90Q800000000",
            "n": [
              {
                "c": 3,
                "d": "Recognized XOR-loop byte-pattern marker",
                "i": "objectives/anti-analysis/self-modify/runtime::xor-loop-pattern-recognized-marker",
                "o": 0,
                "z": 18,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 0
          },
          {
            "b": "00000000000000000000KDtM=KDtM=KDtM=KDtM=\u003eL$O.09cJf0000\u0026Irfx?5oY3:XzMeT@@o+5kzewpndRG+50BZ.^U4J.4[1itg14/I\u003e(pX-01Qf40000",
            "n": [
              {
                "c": 3,
                "d": "Repeated NOP-run pattern in executable section",
                "i": "objectives/anti-static/obfuscation/payload/code-in-data::nop-sled-in-data",
                "o": 336,
                "z": 47,
                "cf": 0.6499999761581421
              }
            ],
            "ln": 320
          },
          {
            "b": "0o\u003cE-008i.0002-00000t3Bo$l0V=.t}%+Z:UAGz%3XVT\u003e(pX-07\u00268%5q!j\u003eIsKiT-Sb#s00",
            "n": [
              {
                "c": 3,
                "d": "Dotted-quad PE version metadata marker",
                "i": "objectives/command-and-control/infrastructure/ip::ipv4-version-metadata-marker",
                "o": 4424,
                "z": 9,
                "cf": 0.9399999976158142
              }
            ],
            "ln": 4408
          },
          {
            "b": "t}#xz00000y?Wx\u003czGxwLm]h(4B$%5aB-.qnAY(*0C4\u003eFfoLFw!jy-FHx(kQ\u0026zGQa",
            "n": [
              {
                "c": 3,
                "d": "Terminal socket exec helper context",
                "i": "micro-behaviors/process/fd/dup::unix-terminal-socket-exec-benign-context",
                "o": 40160,
                "z": 3,
                "cf": 0.949999988079071
              }
            ],
            "ln": 40144
          }
        ],
        "depth": 1,
        "facts": {
          "exp": [
            [
              "this_module"
            ],
            [
              "cleanup_module"
            ],
            [
              "init_module"
            ],
            [
              "pfx_init_module"
            ],
            [
              "pfx_cleanup_module"
            ]
          ],
          "imp": [
            [
              "",
              "regcache_sync"
            ],
            [
              "",
              "regmap_write"
            ],
            [
              "",
              "devm_kmalloc"
            ],
            [
              "",
              "snd_soc_bytes_info_ext"
            ],
            [
              "",
              "snd_soc_component_read"
            ],
            [
              "",
              "kfree"
            ],
            [
              "",
              "snd_soc_put_enum_double"
            ],
            [
              "",
              "regcache_mark_dirty"
            ],
            [
              "",
              "dynamic_dev_dbg"
            ],
            [
              "",
              "fentry__"
            ],
            [
              "",
              "snd_soc_component_write"
            ],
            [
              "",
              "devm_snd_soc_register_component"
            ],
            [
              "",
              "clk_prepare"
            ],
            [
              "",
              "dump_stack"
            ],
            [
              "",
              "devm_regmap_init_i2c"
            ],
            [
              "",
              "snd_soc_get_enum_double"
            ],
            [
              "",
              "SCT__WARN_trap"
            ],
            [
              "",
              "ubsan_handle_out_of_bounds"
            ],
            [
              "",
              "i2c_register_driver"
            ],
            [
              "",
              "snd_soc_info_volsw"
            ],
            [
              "",
              "dev_err"
            ],
            [
              "",
              "snd_soc_dapm_put_volsw"
            ],
            [
              "",
              "snd_soc_dapm_force_bias_level"
            ],
            [
              "",
              "snd_soc_dapm_to_component"
            ],
            [
              "",
              "snd_soc_dapm_get_bias_level"
            ],
            [
              "",
              "x86_return_thunk"
            ],
            [
              "",
              "kmemdup_noprof"
            ],
            [
              "",
              "snd_soc_info_enum_double"
            ],
            [
              "",
              "devm_clk_get_optional"
            ],
            [
              "",
              "clk_get_rate"
            ],
            [
              "",
              "snd_soc_get_volsw"
            ],
            [
              "",
              "snd_soc_put_volsw"
            ],
            [
              "",
              "snd_soc_component_update_bits"
            ],
            [
              "",
              "const_udelay"
            ],
            [
              "",
              "clk_disable"
            ],
            [
              "",
              "dev_err_probe"
            ],
            [
              "",
              "snd_soc_dapm_get_volsw"
            ],
            [
              "",
              "i2c_del_driver"
            ],
            [
              "",
              "clk_enable"
            ],
            [
              "",
              "snd_soc_params_to_bclk"
            ],
            [
              "",
              "clk_unprepare"
            ]
          ],
          "sec": [
            [
              "__bug_table",
              64,
              16,
              0.99,
              "write,alloc"
            ],
            [
              ".rela__bug_table",
              87080,
              72,
              0.93,
              "info_link"
            ],
            [
              "__jump_table",
              80,
              112,
              0.0,
              "write,alloc"
            ],
            [
              ".rela__jump_table",
              87152,
              504,
              1.59,
              "info_link"
            ],
            [
              "__patchable_function_entries",
              192,
              144,
              0.0,
              "write,alloc"
            ],
            [
              ".rela__patchable_function_entries",
              87656,
              432,
              1.41,
              "info_link"
            ],
            [
              ".text",
              336,
              4267,
              5.31,
              "alloc,executable"
            ],
            [
              ".rela.text",
              88088,
              4728,
              2.59,
              "info_link"
            ],
            [
              ".data",
              4608,
              8120,
              0.43,
              "write,alloc"
            ],
            [
              ".rela.data",
              92816,
              528,
              1.55,
              "info_link"
            ],
            [
              ".rodata",
              12728,
              27075,
              1.01,
              "alloc"
            ],
            [
              ".rela.rodata",
              93344,
              13056,
              2.03,
              "info_link"
            ],
            [
              ".comment",
              39803,
              117,
              4.05,
              "merge,strings"
            ],
            [
              "__mcount_loc",
              39920,
              136,
              0.0,
              "alloc"
            ],
            [
              ".rela__mcount_loc",
              106400,
              408,
              1.5,
              "info_link"
            ],
            [
              ".init.text",
              40056,
              54,
              2.72,
              "alloc,executable"
            ],
            [
              ".rela.init.text",
              106808,
              120,
              1.83,
              "info_link"
            ],
            [
              ".exit.text",
              40112,
              40,
              2.55,
              "alloc,executable"
            ],
            [
              ".rela.exit.text",
              106928,
              72,
              1.85,
              "info_link"
            ],
            [
              ".modinfo",
              40152,
              269,
              5.05,
              "alloc"
            ],
            [
              ".exit.data",
              40424,
              8,
              0.0,
              "write,alloc"
            ],
            [
              ".rela.exit.data",
              107000,
              24,
              0.5,
              "info_link"
            ],
            [
              ".init.data",
              40432,
              8,
              0.0,
              "write,alloc"
            ],
            [
              ".rela.init.data",
              107024,
              24,
              0.5,
              "info_link"
            ],
            [
              "__dyndbg",
              40440,
              392,
              0.45,
              "write,alloc"
            ],
            [
              ".rela__dyndbg",
              107048,
              672,
              1.54,
              "info_link"
            ],
            [
              ".note.package",
              40832,
              216,
              4.73,
              "alloc"
            ],
            [
              ".static_call_sites",
              41048,
              8,
              0.0,
              "write,alloc"
            ],
            [
              ".rela.static_call_sites",
              107720,
              48,
              0.91,
              "info_link"
            ],
            [
              ".return_sites",
              41056,
              88,
              0.0,
              "alloc"
            ],
            [
              ".rela.return_sites",
              107768,
              528,
              1.52,
              "info_link"
            ],
            [
              ".call_sites",
              41144,
              412,
              0.0,
              "alloc"
            ],
            [
              ".rela.call_sites",
              108296,
              2472,
              1.82,
              "info_link"
            ],
            [
              ".note.gnu.build-id",
              41556,
              36,
              4.25,
              "alloc"
            ],
            [
              "__version_ext_names",
              41592,
              794,
              4.33,
              "alloc"
            ],
            [
              "__version_ext_crcs",
              42392,
              168,
              6.39,
              "alloc"
            ],
            [
              "__versions",
              42560,
              2688,
              2.71,
              "alloc"
            ],
            [
              ".gnu.linkonce.this_module",
              45248,
              1280,
              0.13,
              "write,alloc"
            ],
            [
              ".rela.gnu.linkonce.this_module",
              110768,
              48,
              1.05,
              "info_link"
            ],
            [
              ".note.Linux",
              46528,
              48,
              1.97,
              "alloc"
            ],
            [
              ".BTF",
              46576,
              31075,
              4.94,
              ""
            ],
            [
              ".symtab",
              77656,
              5376,
              2.2,
              ""
            ],
            [
              ".strtab",
              83032,
              4043,
              4.71,
              ""
            ],
            [
              ".shstrtab",
              110816,
              457,
              4.31,
              ""
            ]
          ],
          "metrics": {
            "elf": {
              "bits": 64.0,
              "entry": 0.0,
              "has_got": 0.0,
              "has_plt": 0.0,
              "has_note": 1.0,
              "has_symtab": 1.0,
              "note_count": 3.0,
              "nx_enabled": 1.0,
              "dynrel_count": 0.0,
              "dynsym_count": 0.0,
              "has_eh_frame": 0.0,
              "symtab_count": 224.0,
              "dynrela_count": 0.0,
              "little_endian": 1.0,
              "pltreloc_count": 0.0,
              "executable_stack": 0.0,
              "wx_segment_count": 0.0,
              "comment_entry_count": 3.0,
              "program_header_count": 0.0,
              "comment_distinct_count": 1.0,
              "gnu_stack_section_absent": 0.0,
              "load_segment_max_file_size": 0.0,
              "stripped_but_symtab_present": 1.0,
              "load_segment_max_memory_size": 0.0,
              "section_relocation_group_count": 16.0,
              "stripped_metadata_section_count": 5.0
            },
            "file": {
              "size": 115009.0,
              "entropy": 3.3,
              "size_bytes": 115009.0
            },
            "binary": {
              "is_pie": 0.0,
              "has_overlay": 1.0,
              "is_stripped": 0.0,
              "code_entropy": 5.25,
              "data_entropy": 0.38,
              "overlay_size": 3736.0,
              "string_count": 960.0,
              "overlay_ratio": 0.03,
              "avg_complexity": 2.13,
              "max_complexity": 29.0,
              "huge_func_count": 1.0,
              "leaf_func_count": 20.0,
              "overall_entropy": 3.3,
              "overlay_entropy": 3.06,
              "tiny_func_count": 30.0,
              "avg_basic_blocks": 4.13,
              "entropy_variance": 3.1,
              "avg_string_length": 15.87,
              "max_string_length": 90.0,
              "peak_region_bytes": 321.0,
              "code_to_data_ratio": 0.3,
              "total_basic_blocks": 190.0,
              "peak_region_entropy": 7.21,
              "string_length_stddev": 7.61,
              "largest_section_ratio": 0.27,
              "sentence_string_count": 64.0,
              "sentence_string_ratio": 0.07,
              "high_entropy_string_count": 0.0
            },
            "exports": {
              "count": 5.0
            },
            "imports": {
              "count": 41.0
            },
            "sections": {
              "count": 47.0,
              "code_size": 4361.0,
              "entropy_max": 6.39,
              "entropy_mean": 1.96,
              "name_entropy": 4.22,
              "writable_count": 10.0,
              "executable_count": 3.0,
              "nonstandard_count": 39.0,
              "executable_writable_count": 0.0
            },
            "functions": {
              "count": 46.0
            },
            "dependencies": {
              "count": 0.0
            }
          }
        },
        "id": 1,
        "mol": "O₂(AsC)",
        "path": "snd-soc-nau8822.ko.zst!!snd-soc-nau8822.ko",
        "risk": 3,
        "sha": "d2136f86dd4e44eabfa651d9afcb6b549fe332b444dc0790534167df5ceb6c72",
        "size": 115009,
        "traits": [
          {
            "id": "metadata/build/artifact::elf-stripped-but-symtab-present",
            "conf": 0.6000000238418579,
            "crit": 3,
            "desc": "ELF stripped with .symtab present",
            "spans": [
              [
                0,
                38
              ]
            ]
          },
          {
            "id": "metadata/package/license::gpl-word",
            "conf": 0.699999988079071,
            "crit": 2,
            "desc": "GPL license reference",
            "spans": [
              [
                40160,
                3
              ]
            ]
          },
          {
            "id": "objectives/anti-static/obfuscation/payload/code-in-data::nop-sled-in-data",
            "conf": 0.6499999761581421,
            "crit": 3,
            "desc": "Repeated NOP-run pattern in executable section",
            "spans": [
              [
                336,
                47
              ]
            ]
          },
          {
            "id": "micro-behaviors/communications/ip/literal::external-ipv4-binary",
            "conf": 0.8500000238418579,
            "crit": 2,
            "desc": "Hardcoded external IPv4 address",
            "spans": [
              [
                4424,
                9
              ]
            ]
          },
          {
            "id": "objectives/command-and-control/channel/redundancy::multi-channel-diversity",
            "atk": "T1071",
            "mbc": "B0030",
            "conf": 0.8500000238418579,
            "crit": 3,
            "desc": "C2 infrastructure using multiple communication methods",
            "spans": [
              [
                4424,
                9
              ]
            ]
          }
        ],
        "type": "elf"
      }
    ],
    "rev": "46112",
    "v": "8"
  }
}