{ "ml": { "v": "7", "eng": "2.2.0-rc.1", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.0008565883, "rte": "az", "prob": 0.0008565883 }, { "cls": 0, "raw": 0.0010065138, "rte": "az/tar", "prob": 0.0010065138 } ], "prob": 0.0038332145, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.003833214519545436, "type": "apk_alpine" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.003833214519545436, "type": "elf" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.000022739171981811523, "type": "shell" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.000010838110938493628, "type": "text" } ], "version": "v18.18", "analyzed_at": "2026-06-26T08:08:45Z" }, "path": "gnupg-wks-client-2.4.9-r1.apk", "raw": { "files": [ { "id": 0, "ctx": [ { "b": "abZy8000000T3{24[J!\u003enkh=HeH]u63?!Yp^*DIa!jX1m:JNrco?u{f=2H?Deg@xa3GU*X", "n": [ { "c": 2, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "o": 0, "z": 1, "cf": 1.0 } ], "ln": 0 } ], "mol": "O₄(AlCDyEr)H₃(F₃Po₃U)Md(He)", "sha": "d3e0206d5b8a3a6409f237a1ee3e47e86497b0832cf5f8eb200b38e12f824d89", "path": "gnupg-wks-client-2.4.9-r1.apk", "risk": 12, "size": 85317, "type": "apk_alpine", "facts": { "metrics": { "file": { "size": 85317.0, "entropy": 7.99, "size_bytes": 85317.0 }, "parse": { "error_count": 1.0 }, "binary": { "overall_entropy": 7.99, "peak_region_bytes": 81920.0, "peak_region_entropy": 7.85 } } }, "traits": [ { "id": "metadata/binary/metrics/threshold::rich-sentence-strings-20pct", "conf": 0.800000011920929, "crit": 1, "desc": "Binary has many sentence-like strings", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/crypto/certificate/usage::pem-begin", "conf": 0.699999988079071, "crit": 2, "desc": "PEM begin marker", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/create/execv::exec-variant-symbol-text", "conf": 0.75, "crit": 3, "desc": "Exec family symbol text", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/directory/readdir::readdir-readdir", "conf": 0.6600000262260437, "crit": 2, "desc": "Uses readdir", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/create/setsid::symbol-text", "mbc": "F0003", "conf": 0.75, "crit": 3, "desc": "setsid symbol text", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/ui/help::has-help", "conf": 0.8500000238418579, "crit": 3, "desc": "Contains help or usage information", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/ui/help::usage-title-string", "crit": 1, "desc": "Usage: label in binary strings", "from": [ { "file": 1 } ] }, { "id": "objectives/impact/ransom/encrypt/threat-text::fp-signatures-word", "conf": 0.30000001192092896, "crit": 1, "desc": "Benign context: \"signatures\" allowlist word", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/os/sysinfo/platform/kernel::uname", "atk": "T1082", "mbc": "E1082", "conf": 0.6000000238418579, "crit": 3, "desc": "Query system name and information", "from": [ { "file": 1 } ] }, { "id": "objectives/evasion/masquerade/extension/shebang::bash-shebang-first-line", "atk": "T1036.008", "mbc": "F0008", "conf": 0.949999988079071, "crit": 3, "desc": "File starts with", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/process/fork/clone::fork", "conf": 0.6600000262260437, "crit": 2, "desc": "Process forking", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/user/query::getpwuid", "atk": "T1033", "mbc": "E1033", "crit": 3, "desc": "Get password file entry by UID", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/file/write/direct::write--write", "conf": 0.6600000262260437, "crit": 2, "desc": "Write files (write)", "from": [ { "file": 1 } ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-origin-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package origin field", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/ui/help::usage-lower", "crit": 2, "desc": "usage: label (lowercase)", "from": [ { "file": 1 } ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-basename", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package info file" }, { "id": "micro-behaviors/communications/socket/multiplex::select-multiplex", "crit": 3, "desc": "select() I/O multiplexing", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/path/device/special::dev-null", "conf": 1.0, "crit": 2, "desc": "/dev/null (legitimate discard device)", "from": [ { "file": 1 } ] }, { "id": "metadata/hardening/missing::stripped-binary", "conf": 0.800000011920929, "crit": 3, "desc": "No full symbol table (likely stripped)", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/proc/info/path::process-self-exe-path", "conf": 0.6600000262260437, "crit": 2, "desc": "Read own executable path (/proc/self/exe)", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/dylib/library/libc::libc-internal-functions-b", "conf": 0.699999988079071, "crit": 2, "desc": "libc internal symbols cluster B", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/create/execv::c-exec-variants", "conf": 0.800000011920929, "crit": 3, "desc": "C-style exec family functions", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/dylib/library/libc::libc-characteristic-cxa-finalize", "crit": 2, "desc": "libc characteristic cxa finalize", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/file/read::read", "conf": 0.699999988079071, "crit": 2, "desc": "Read file descriptor (read/pread)", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/ui/help::usage-title", "crit": 2, "desc": "Usage: label (title case)", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/ui/help::usage-lower-string", "crit": 1, "desc": "usage: label in binary strings", "from": [ { "file": 1 } ] }, { "id": "objectives/anti-analysis/timing/evasion::time-func", "atk": "T1497.001", "mbc": "B0001.032", "conf": 0.20000000298023224, "crit": 3, "desc": "Time query used for delay checks", "from": [ { "file": 1 } ] }, { "id": "objectives/anti-analysis/self-modify/runtime::elf-manual-loader-cond-0--inline-10757", "conf": 0.8500000238418579, "crit": 3, "desc": "Regex component marker", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/file/write/direct::write", "conf": 0.6600000262260437, "crit": 2, "desc": "Write files", "from": [ { "off": 7442, "file": 1 } ] }, { "id": "micro-behaviors/process/create/setsid::import", "mbc": "F0003", "conf": 1.0, "crit": 1, "desc": "setsid() function import", "from": [ { "file": 1 } ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-package-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package name field", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/fs/watch/inotify::inotify-add-watch", "conf": 0.6600000262260437, "crit": 3, "desc": "Monitor filesystem events via inotify", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/file/delete::remove", "conf": 0.30000001192092896, "crit": 3, "desc": "Delete files", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/ui/help::usage-label", "conf": 0.75, "crit": 1, "desc": "Command line usage text", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/directory/readdir::readdir-closedir", "conf": 0.6600000262260437, "crit": 2, "desc": "Uses closedir", "from": [ { "file": 1 } ] }, { "id": "objectives/discovery/system/fingerprint/user::user-info", "atk": "T1033", "conf": 0.699999988079071, "crit": 3, "desc": "User information fingerprinting", "from": [ { "file": 1 } ] }, { "id": "objectives/persistence/system/daemon/init::daemonize-self-reexec", "atk": "T1543", "mbc": "F0006", "crit": 3, "desc": "Daemonizes via self-exe re-exec + fork/setsid", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/create/shell/spawn::shell-exec", "atk": "T1059", "crit": 3, "desc": "Shell exec builtin (process replacement)", "from": [ { "file": 2 } ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-version-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package version field", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/process/create/shell/spawn::shell-execution-comp", "atk": "T1059", "mbc": "E1059", "conf": 0.8999999761581421, "crit": 3, "desc": "Shell command execution capability", "from": [ { "file": 2 } ] }, { "id": "objectives/command-and-control/infrastructure/config::dirmngr-root-hints-context", "atk": "T1043", "mbc": "C0002", "conf": 0.9399999976158142, "crit": 3, "desc": "dirmngr DNS root hints context", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/create/shell/spawn::shell-symbols", "conf": 0.8999999761581421, "crit": 3, "desc": "Shell execution symbols", "from": [ { "off": 10, "file": 2, "line": 2 } ] }, { "id": "micro-behaviors/crypto/library/keyword::encrypt-keyword", "conf": 0.4000000059604645, "crit": 3, "desc": "Generic 'encrypt' term in strings", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/user/query::getpwnam", "atk": "T1033", "mbc": "E1033", "conf": 0.4000000059604645, "crit": 2, "desc": "Resolve username to password entry", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/dylib/library/abi-graphics::cxx-abi-symbols-a", "conf": 0.800000011920929, "crit": 2, "desc": "C++ ABI symbols cluster A", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/watch/inotify::inotify-init", "conf": 0.6600000262260437, "crit": 3, "desc": "Monitor filesystem events via inotify", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/crypto/certificate/usage::pem-end", "conf": 0.699999988079071, "crit": 2, "desc": "PEM end marker", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/file/binary::fseek-func", "atk": "T1005", "conf": 0.4000000059604645, "crit": 2, "desc": "Seeks to position in file", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/crypto/certificate/usage::certificate-ref", "crit": 2, "desc": "certificate string reference", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/file/stat::stat-core", "conf": 0.800000011920929, "crit": 3, "desc": "Read file status and metadata (core)", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/chmod/modify::syscall-chmod", "atk": "T1222", "mbc": "E1222", "conf": 0.6600000262260437, "crit": 3, "desc": "chmod syscall", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/file/delete::unlink", "conf": 0.30000001192092896, "crit": 3, "desc": "Delete files", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/file/binary::file-read-operation", "atk": "T1005", "conf": 0.75, "crit": 1, "desc": "File read operation", "from": [ { "file": 1 } ] }, { "id": "metadata/binary/metrics/threshold::many-imports-50", "conf": 1.0, "crit": 1, "desc": "Binary has 50+ imports", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/directory/readdir::readdir-opendir", "conf": 0.6600000262260437, "crit": 2, "desc": "Uses opendir", "from": [ { "file": 1 } ] } ] }, { "ctx": [ { "b": "E))420S-r400000000000@$H+0rr91J8Y\u0026T00000kMy=:000005s9v$0000000000kMA+z4feS[8#{]T1][S61onA4kMy=:00000kMy=:00000kMy=:00000/A83M00000/A83", "ln": 0 }, { "b": "0SSnp1onA40rr91000001onA46Awak0@@r3m]04:-JyAtDZ.Y6NJIQyDCzzWtZyivfkLuifkLeJzfo]oeQflkuP6.[B8JV=000001POJ5*YdrO0rr911][S60d+aI00Mg3*YdrO?2EAP?t^JQ?V9SR00000XSca?iR57Fdiju!(^Lqj00000000000000000000000000000000000blm=A5=.[i00000000000000000000@q=(#5=.[i00000000000000000000(I{[+5=.[i00000000000000000000VJygc5=.[", "ln": 824 }, { "b": "ToeC55DAKCPOrHF000002MK\u0026800000KQh0/5=-Bx^8Md!000000rr91000000crm3v@MX[B98CjAcRCazGxxhwO#U\u003eCvticAa@?.xjVg9y?W:2Bo3xcB7ocaw=M)^xjU}0BA}}sBo2@+By/uk0b2\u003e+Aa@?.uTEq/vp9RXzEEu}DsW7!B-o8oB98CAz/]\u003c@B7Gf0v@}Y\u003ewNPaWx(ThXuVQr$v@2BYxLQ%!vqfJTAa%o50b=j.z/Y-awPdSYB97\u0026j0bDp+yYFJ#A:@K10af8zwPzu{x(!xcA:JB0vqPN.x(mK30aeq%o\u003c.{Lxk8BewPy:AlU{WUwMi8Ey?iP/BAhnezeYF@BAhneAcRC2wO\u003e{]z#:G*A++U^CX7xd0cq\u003c!vpKy[z/bLZnMnz\u003ewmY^)xk8BewPy:AlU{WUwMi8Ey?iP+AaJ]$x(ThXuTX1%wPz)1w)]y\u00260crm5v@le+B98CjB8V0%uTEw+A=b/5y\u0026r/(BzkVh0ax$/x-IHKCXIm1B98CswO}G?BAg(8ASxP=z/YG2x(ThXuVGZ\u003cx(!xcA:JB0vqPN.x(mK30ax}\u0026BZYe{A+f5#vrk#WvrlHjvqYB[wPRo(Aa-J?A=LJdz/{8gwDldWB9g]euVP!2uU\u003cT[uT)KBvrlHjvqYB\u0026wP[b.B8#FjzEmE6v@2T$uT[1(zE)s10ax}\u0026BZYe{BAg/cB75N20cqZ[B.Lv^vpBd}Bo2@+By/Pewb{ETzeBimwDlp^Abok#x()Y\u003eDs.bn0crm5B98B5B98CwvSDk:vSM9?A:@+.w[b.2yYFJ#A:@K0wN/N@0b2\u003e+B.Lv^xjC$cuVP!2uU\u003cT[uUA\u003e=wnC*$0b2!ZD0+A0uUA\u003e?xKtj\u003ew[CQ{0b2!ZD0+S7CYm2hB7nS@0b2!ZD0+64wNPW(uV6!1v}tTMv@=\u003c4B7GD2w)]^\u0026y?mTcz/Ph#vqYQ(wPv=-v@=\u003c4v@DmbA=k:]xjC$cuVQsfwoz?\u003exjC$cuT)IXy\u0026r!-xjC$cuWcTlA+6ri0b2!ZD0+P6vqG:#v/QdKA^q2pv{%g\u0026z^@=Wv@=\u003c4zddl%z^@=Wv@=\u003c4CX{(9y\u0026r!-xjC$cuVP!2uVg7ez!rG$A+eO", "ln": 6296 }, { "b": "zEEx[0b2!ZD0+f7wN$\u003cOv@=\u003c4CYEw7y\u00261310b2!ZD0+z%y\u0026131uVP^*B-I3[BzU#ex(4tXB97@hB-WR6B8M8v0blH.BAz^dB98Cyv}Y(.zFSV@vqYZ(zF0!!y\u0026r/(y\u0026\u003cxdwDlvOBz#CDx\u003ediRwPR)nzEEwZvru79x(\u003ct@ByX%6ASyf5A=Vhq0cqZ[B7]d+xk?H7ByeS)wPR$[xk?H7Byf61vqG:#v{%y#vr?\u0026=Aa:ikuU%N?x(Th^Aa:ikuUj1*wO#z^xk?H7Byfljx()[^xk?H7ByeT7A+PSb0b3m-A=+VhB75Y)0b3m-A=+V3wPRo\u003cA=M8sv@DHcBo2@)xl593B7GD2vRGZ*A^mT$Aa:ikuU\u003cT[uUi.*vqC{RAa-K0BAhCvB-H#60b3m-uUam#uVP!2uUam#zF]I/Aa:ikuUi!:z/YE\u0026xk?F", "ln": 7228 }, { "b": "ByeS(y\u0026%/j0b3m-A=+Vivrlydx(n380b3m-A=+V5zEW3+A=M8sv@DHcBo2@)xl593zeTx8zuar*xl593A+eV\u00260b3m-A=+V8z!AA#BAh8kx8(N-xl593B7GD2vqG:#v{-?\u003czESVVAa:ikuU\u003cT[uU0.SB.pXYxk?H7Bye\u003c5xj27*B7Gxl0b3m-A=+V8z!AA\u003ezF0!!xk?H7Byf9hA=(CixjR6QAa:ikuU\u003cT[uVP!2uVp3%w[=F\u0026xk?H7", "ln": 7705 }, { "b": "uVP!2uUj1%wN]d?BAh8kxj2H:AbYxe0b3m-uUam#uT[1+wNx4\u0026z/5\u003c5D2)LqA=k%#xk?H7ByeJ\u003ewnc5:xk?H7ByeT3wO2SSxk?H7Bye\u003c5xj2p.Byf9hA+eV@0b3m-A=+U%A+xu1A=U/j0b3m-A=+VewNPaRy?W=#0b3m-A=+V2Aclnj0b3m-A=+VfwPRp2BAhIBvp%cKxk?H7ByeV(ByPJ90b3m-A=+V2wPz*fASx-\u003exl593w[t))0b3m-A=+T", "ln": 8072 }, { "b": "Aa:ikuU\u003cT[uUr}(uVp3%w[=F\u0026xk?H7ByeS$vqPN.xjVe+xk?H7ByeS)wPRzZxkI:8zdN6{0cqZ[y\u0026r/(y?iPXzFsi9A=l8tA@Zn}xk?)fv@kT}yxeA\u0026xj+\u003c]y\u0026:ff0cJf}x(mX^Bz\u003e#lCv+^{B98CmBzkP60aPXVz!5\u0026XzffGewDlvOBz#hkwb{T!wnc5:Bz(qvAaK4\u0026BAz!CvqPMQAclnlzGV24x(dA]z2!P+x(^?=A+f9aC4yU/zF%Shw{E-$zFsg)A+eV\u0026y?W^50cqZ[A+]Dbx(\u003ct@BAhnevrl0\u0026zeYF?v@DmduT)[\u003cB7Ct(wO${[wDlmPw[Dd0zdJYWwPS0iv@2%\u003czdJYOw[=c%0bVH[x(dzYx\u003e870B]Vk^z/f-9z/xo90bls?BzkujuTWFQuW2}2v}U\u003c+zEEx[0af8Hx\u003c$NVB97\u0026hBye([x(i]!x\u003c$H(B9g]ee]$}-iri(fvRog\u003eD2N\u003cTB8JV^fAt{6vRoT)eOe%yz/NEKz.rZzy?Wu*e]t-Ly+o(\u003ehEwv0e]$}-f-TZhqDV*}uOKe\u003e07P\u003cQuQW\u003c\u003cpF$KOe?^o0nKtZwq=MaUuOTk/000000rrc20rrc20rrc20rrc20rrc20SSr50rrl50@@u40rrl50rri40@@u40rri40@@u40r", "ln": 8514 }, { "b": "70H+20ri=HA@=nA.[MiL008n?)eN9Bm/M1?%43UFyRR2.ItoXR%7}=p07-FF0R/uFGB)ih8utA?0!gvM:)fU21HP3C006.u0001!{X)ZJnH.Di:I8f+006+p000", "ln": 71199 }, { "b": "00000000000000000000oH?]MeIX}kePkUYy*?A%ASwu{pe$aXkMAL(g+H=*lVl{?A+Pf1Brz#0diHx1gbQg!f!:.qz!9A4m@qZa07P^:fhc7$B:9).y?m3@wGV28AbP=sayYFaB0bNyauR[To*IuAkT3!c09a8GxjTaDxk?GnCwzmKv@b\u003c\u003czGE19v@Dj3vqYQYax@=6BzkVhB6P[)vrc14t{7KExDQ]9AV/4by\u0026y*6q*An5vr:*Qxk?GnCwzmKv@b\u003c\u003czGE19v@Dj3vqYQYax@=6BzkVhB6P[)vrc14t)-@nx\u003eqg7azbLjaARpdaxJb-awlo\u003eax8\u0026(C4\u003eC$3ijZTxdXsyB1H)rx\u003eqg70cY@50a*g\u003ez/M$ey\u0026131vruj3xcq55zeTDuayYF9w[u0zash7o04/^uz.k)DBzkVhA@W^zADL#bBo0)A", "ln": 118768 }, { "b": "wNPQgCwy.uwmov!enPlmvqC]}ePLAjx(E=$zGC\u003egeOe*fA^qRC0a*4TA^qRCx(v(iw)]y\u0026wN)?Ac36y[lVl\u003c:wO#Pwrc-B]iV}\u003cIAbok#vruj4zzcfJwg?IjB-p$CCwzmblVl\u003c:wO#Pwrb#z+B7P07eK:L!z!9N1xf4d{vRG]\u003e3ikf[AaI6Mv@Dl%x(X60BzkVhePLAzAbPSnwErG\u0026zE^s0iV].\u00263sNEQA+frkiV].\u00263t%^1v}vXzc36y[mSJA:090\u003epoj-w\u003eAckSax\u003e7N[x(v(iv@Dl%x(X60BzkVh08[2HygQ)%09r@SeKTR/w]]R9wPz\u003caz/bL(B.(elAa9^efj/3hA^qRCwN)\u003eBAb](sz!0Z4jTarNAbok#vruj4zzb%wA4LTsv@=\u003clBy!#b07gWxBy/uieMv1mwDldTAbok#vruj4zz7", "ln": 119223 }, { "b": "Cxk!L0cAH9wJx*3z/ff3A=2lbx(v(vA+flkwPI}[A+e-(x)a5#aA.NkCYmk7By!#9CwzmxzdN^fvp%c]cNA*Y3ihC}D2Nsxaz\u003e?lB7]J80chTXwODs0wftP7C42i3wfu8i", "ln": 119695 }, { "b": "AV/7lC42i3wb{ZWA+w%9azbt9xjVa5A+PAkiV].\u00263ijKTBrCa9v@=\u003clBy!#9CwhejiV].\u00263ijNOzF0Q6zddK2z/cXrwPq\u003c7B95Kxz/^ajwN/+aAcbV4aA}KwxDRz9A+w%9azULl3ijHBwo8m5B2\u003cpGvpS[?wPI]uaz\u003e?lB7]J8aA8oyx(n95y?WzW", "ln": 119850 }, { "b": "x\u003ehocw].*basgLvyH}^jaAIDzw)]Y!0a*g\u003ez/M$tA=kD0B8#5kxcp#3C{1zOiV].\u0026at1ZSyIv:bwN(bFB-Q#7wJy}WB08=Iax@=6BzkVhB6P[mA%.[UA=M8saAz44wnb{]aAITnx(k%Oc36y[xk?GaB97\u0026jB-PO^c37gPA%.[nmmf%Qp/H1Zpg3T.sPy]SnLAbZmf3[tA=k$vA+eV\u0026x(mMaAbPMbv%Ghey**%$azbLjaswERcPSv@A%.[^A=lbnwmY^7w]zYjcNA*Yao", "ln": 120542 }, { "b": "yIvW0aA.SCB9g@ex(!ufz/cXawmPZ(B8@Eoz/M$hz/5]%zxHqMB0\u003c0\u003ec36y[Bzbxfay]zcvqfQ4Ab](avpB4#ay]z4B8AvEaAIWAAbP=saxIime^.OWvrcm1zF80MwnbT/wPzv1BrCTEvR]?2B7]MgayO!\u003eA+frkwPF$xB74iTB1wCMz-]y/dgc5f", "ln": 120808 }, { "b": "zdN^fvp%cU04/^tvr:wxB-.OBBuIs5f!+pnfArWRwmYm\u003eD2N\u003c9wmYm\u003eD2N\u003etz/cXfvqfK?wi7?VA%.[TwN/+aAcb/jzxK1yv}f7YwmYoU0bDd\u003eaA.:pwft#jay]4[A^qRCaARpday/tcw[.", "ln": 121207 }, { "b": "vpS[.zF78mB7Gwmx\u003eetlc37Bv04/^xB.Lu3eN-g2eP\u003e=r0axzGx(mMaB-RbmazCvew)]y\u0026wN)?Ac36y[lVl\u003c:wO#Pwrc-B]iV}\u003cIAbok#vruj4zzb%wA4L\u003cpD2\u003cr10a*g\u003ez/M$eA=2-nx(mMayH}=Lash7o0b#\u003c$By/wywmU:xvrcm1zF80MrDz\u003e(xcp-9vp\u003cQkf^7sABzbP6azbLjay]zcvqfQ4cNA*Y3ii.gC{46GvR/+1xLzu%aAz4kB.bSo0bV\u003c{BzkY5A=-%Kx)si10ax?=y?S", "ln": 122051 }, { "b": "A+PSfzF78cwQbzuzY*zNB0\u00268xvqfK?wi7?VA%.[KmOcoxD}3X5m[3rLqB%R.axqueqy$Edt(VDdx(n0lvqG:iyH}+\u003eeIh0OzeTPeeO!{y0b#%)zGGPgxcpnGl)ceKB7+L)A+PAkx(mMas4+}7rz(G\u003cz#", "ln": 122646 }, { "b": "B7Gwmx\u003ehn+Ab]VgBs?YLwg.}AyYFA{x(n2nBzbkds4+}7rz(Hkw]zYjBzbkdxk8K2zxK7ywPw]cwb[\u003e4pJgz\u0026z/fRS3lPsTwGV5jzdN{8vrrSez/PziADL#bBo2\u0026.vS=q-B7Gl10cqZ?wft#cwGU?#x(1]mB7]J8aAIaiwnL:?yYFx@Bz#wA0dmmcoHTtMA+PSbaARpdaz\u003eL3y-)?ravX{@mf4yJvruTkeOnI[D}3IKCxdztwGV5ovruTkazC.9zY\u003cduaARphB09}u0b=ZbvrDWgB97\u0026hBo2=^vpK7?x(!v@zF}anwmNojwP\u002604A@Y-?az#atayO!\u003eaAz4pz!0i$x(v(iv}xX5x\u003ez6?vru740chT/z*2XmzeTGqazUJ", "ln": 123180 }, { "b": "gh{VxB7D$l0bV^\u0026eK0V!A=L-eBye#}A=.p72[mjwqE%uHx)a5#iSIJ=zGGDcBs*EjvqZc#wPxv\u003ezEWP}x(mL-lVl\u003c:wO#Pwl${ZYz/YSmx(v\u003e?pJf(.07gNvB7CtsvqYN^", "ln": 125589 }, { "b": "D30Rst)ZMTdSX*7z/fV9x(mH5t)ZNGx(dAkzddi\u003eAXp\u00264a.bRseK0V!A=L-eBye#}A=.pcB2\u003eAz4giyw4gizJz/]@dvrcSRa%?pO01xn!eHtD:A$5DRAa9^eeK0SZB-7.#A^mU7vrb{%Brz[SaAg+fwO#Pwk4nCMzE^f@C(QlvBy+Cbe?^nGv@#@Ek4w.QA+fcguVoB]Bs/W]wQ5p%jUn/yfFWe\u003cc38j3jPGLmzE^P)x(1]lz/oCmcNA*YazC)tzu", "ln": 126674 }, { "b": "s4+}7B-RbnayMy5vpJ$Zwft]7B9hqv0cqZ(C4CXpB-RbnayPdgx(n95y?WA5v}xX5x\u003ez6?vru5XB-7R$v}xR3vpB4:av]Ehp-%^\u0026wnc6}v@@\u00269A=k!qB7GxnwPw]qvriM3y?m3)wN({az#+2#vpJ!UAcbI$y?j.Wr8=WpA+e=}A+e:5azbUjz6i[hA=#2m07oM", "ln": 126966 }, { "b": "vrt{]iV@u-BrCHlaz\u003eXbz/Qag06ZD*zu9{Z05T:n05lecf!\u0026U.g5%3Yiw92^y?Wu\u003ev@=\u003clBo0RdazC)tBz(7uz!@@bc#JQcwfrgtefFRmC4z^xB14B@wPz*fAV/BmBAzkmxcp=6C6mqmash7KBz\u0026oHc37B{ash7o0aPCPcV*Fwx(^Y(y?j-0z/Pziwoz:dB2\u003eA\u0026A%.[2wmY{qzGP=i03#XEaxH\u003cbpdXhJiV@G=vqYQ:A+3qbzG6-uaAz4iAaJ]#wc@q.B2\u003eBBk#HDHpdEt/B97\u0026dwmoH?aA8yAAclmBA+ffdwO#6\u00263ihw[iV}G\u0026qCG!Um(?=lByx5$", "ln": 127631 }, { "b": "B0\u00268xvqfK?wi7?VA%.[HsxFWcso6{[Cx:agB7GwmcNA*Yaz#atazbLmzE:7Orz#s:08cfUpc?Py055FoAXzlEv{%gbvRGZvflItRfjFTkiXK@Rzu9H0r7E0Vpe$aXnkz@G0a*g\u003ez/M$yzGxxhBzkS9az2ClC42zlc389\u0026c36y[wPz*fAV/BmBAzkmxcqnrAbYS8zdNQbvrcSoxl4{kAc0dlz/M%Fc37B{ash7o0a*g\u003ez/L", "ln": 128061 }, { "b": "z/^amwPS0iv@2%\u003czdLawwgoLZc36y[w[=6)ay]58v@=p5Bz(gxc1FcjB0bvsBrC0mB-7]reO5^pvqfQ4B8LM7wPOmVB8LM7wPP5jvqPM#zF%RtAb]JhwO#Pjw]zYjw[=6)ay]58v@=p5Bz(gxc1Et.B8LM7wPP5jvqPM#w]zYjw[=6)ay]58v@=p5Bz(gxc1FcxvriMkA=(nfvru6\u003easIhqB8$]6ashtRayYRrwPGyBCvtxhwN(]fBTWT$w)]y\u0026wN({9zY\u0026F8y\u0026r/(By=OiwO(vaC{3ZqAV/mdzdK\u0026dw/$X@asgLVash7o0dDNNxkR\u003chx8\u003cP7A=kCvB7Gf1fj/xt07P^:p!a\u003eVry]\u003eLuS6V}q#*GIA=k$vA+eV\u0026x(mMaB9RRsx(mYecNA*YiV].\u00263ih.*x(kOpAa-W0zE@(\u003cA^qwpxcp!{y\u00260M?v@0hmc37Bv0cR^!B.8Xqz/l+mvrc0(054!}zzbTwxjC\u003c$w?EOnyYF3!A=k$vz/xo9", "ln": 128287 }, { "b": "vScH43ijTTA=k$vCxdztx(mMaBz\u0026oHc37B{ash7o03#XtB-Rbmfc$-vfjVWnfj/lnfk2fBAaYe7B-RNRy?Wu\u0026CX7v+flItRfkLuifk2fBAaYe7y?WtUflItRflp/nA+c[pzGP]h055FoAXzGEvrb{jy\u0026r/(y?iPBe[YcoeN-p6zGC\u003eSe[wWpzeK0b08\u003eH=wQd:6CW{!/z/65@x(U?o03JE$zGP]huU%Z(B.\u003eR@zEEx[uT)IXy?mbSaS$AnB-p#2vS=y3wm5\u003eYA+e:5z/Qa6fjwH8zGEKAAaZ+hxjU$5055z6wg@1lwmo4^z/bLdBz#7Lwg@4zz8bTgwO(v6054\u003e%A=2Yb", "ln": 129004 }, { "b": "wfrxRfFCfXtw!v%wNboZe\u0026mS3b}Z@]eHr28B08+YgikG5e\u00264Gec365.m]grdeIeLaeKz(@nLQxdeIeLaeEzF!hz!#.v\u003eIl\u003ex\u003ehDhjrMDXeIeLaeK-A5aok\u003eeg?pfce[j(nf!$Kwh8WxMiws!(e[5j0wmYv=xLzi%y\u0026a6dAb/]tBAI+JCZjQ3lpjdfmN{0vn\u003eR\u0026LpesX-qD3K{r--yas]YY\u003cbQB=+dL0enkvd-AE0{Cze?Ncux\u003c$Z+A^qRCaAhvtvR/Q)iV].\u00263ik0!BrCHlay/tgwGUY8aAIa7B-I4ozdNN5A^n^KxLzo]ayP85z!0i$x(mMac2vYDvTi6bA@Zc3BrCHlay/tgwGVhgx(4u6vqG:#v{%E[zF77ry\u0026{\u003efD30Rs", "ln": 129765 }, { "b": "A+eV\u0026C{3Njz!0M]wc@rTx\u003eIr(y\u0026Z.cA+cwhz/^ahy\u0026r*0wN(bFm]hY.r8^0Kr7fXVejr6dp!TeT03#XEaz2Olz/M$ey\u0026131vruj3xcqnqA+PA7iV].\u00263ikf\u0026D2v5cwDkW#qCvdkBA}$NAaG2Wx(!lfvr?\u0026Pk#*(PpF%+-sPAXPB-.qnA+PSv09z@\u003el}G\u003ctmn^4:s3Y$.k#6*Pl}HrNoHh!YsvtU^q:\u003cR-nL-8*r9r3^08VZ5qbxL=p!TeOmO=]R07Q0YuR9$0o\u00261eSoHO}Hlrc@\u003eq:\u003cR-nL-8*lrc@\u003ek$1asmn)a+qb*)]o\u003cZQ\u003cl@=]H07/{:nKM0Omnl6nqVGS=pdm]SqDWvbq:\u003cO\u003el{T^r0b#T\u0026wO#QgC}BeWwPxwkvrt]Tp!szJpe\u003ea]uQ)KXo\u003cZB.pe?iEf!$Kwh8WxMiws(Jv}od.k%^}bmmEnrfFLssg=mfIi5$zRv}od.k%^}bmmEn1fFLssg=mfIi5$zRv}od.k%^}bmmEn*CX7xbz/oCAv/Qy\u003cA+PSqwO@RMjS[k^k5LyLvpPvFeK1x0x(){9at1ZCeK0S^w[CQ{auR!fB7]@iz!pb4eK0S^w[CQ{0aNPAzGoq%wfr#$aAImywP8f6v/", "ln": 131606 }, { "b": "v{:7Yv@=G{B98CpzF787vqfK?wi7?VA%.[:vq]N{Byxo9v{:q0A+PA7B0b76x(4u\u003eiV].\u00263iiH?k$K-IxMOunB2\u003e%cvS=s8e[Y6AAaZ!wA+twxpe$aX07Q{Hp!7HQp!7HQp!aCU07P\u003cQuQmgJpe?i(lQTjeo\u00261H:r8upAl{TmopFH)TnM5nTm]xsSf/5/xf/5/1p!9(GpdtjNp!aFJqug\u0026Yw?t$xv@DmdwPz\u003caz/cXfA=k!qcNA*YaARJAcNA*Yaz#atayPC4x(0", "ln": 133064 }, { "b": "zY*zNB0\u00268xvqfK?wi7?VA%.[-z!0M9zF%Rtzdc%^iV}jpAc15.B97\u0026jaA7\u003cmBzU$tw[=6)azb4@y?mcrash7o0aPCPzF%RtA+eV\u0026az+$ayI4o%wEnANz!0M{x(4u6wnc9[AbYw%A+e+*0chT/z*2\u0026jxcqnqvqGG$y\u0026r*0w[=6)asH-uwNPW(wfts", "ln": 133794 }, { "b": "lSd5-r7P\u003eXuRa0Zpxi^KlSd5-r7P\u003eXuQ^sMoHRtHl}6EvsX@6?pFLm)of(XXo?wnZnLR=.p^F2Up!jFIq:*WRpFTw=p^F2Up!jFIq:*WRpFTwMl{*@vk$1BnlJxLMqCxLD07/)YpF$c", "ln": 135807 }, { "b": "l}6\u0026Jm]98\u003enMkW^qCP!Xmn)a+q+oF^lScusr7fgPq:\u003cR-nL-8*ogq$-pes?Pr7P\u003eXuRS)Ymf37Ur6:FPpFLm^oHhfE08ur?k#ZAKpg3yPr6ZHXpFstEsZLfboAmZOsZKJ]ml%(", "ln": 136140 }, { "b": "vM35OzEW3$A+PSb0000000000}+h.A4B{sp{l=r\u0026\u0026Pusa8MBIO([YHX7K@4UiF0\u003ee.P:Ckg/L$f=LS+*/K(@xbp*b7!V#W*f8!3rIb822ASOPsGQU:EF7I^LxSa@uLJp70wQStyO?TyTU*l?=om#jfY=cqBmPKgeq7qkES+3eTt(o0SR)c49(cP[Y5$K[4\u003coghUa4MwM2SFv}]lRt{1(Zmq@\u0026RC9=}{?Yd\u0026Z5R?gWi]cDR@0f$6m++keQ!jy+-p:1Gg^v4UKLO6$dAzaWecMiLquFQ7AjDnTE\u003eJi7wsCI(HmsSRk)QeHy}rlKnpUzlT7XCk}nl:RmQWjMwkpgr(i^XvWzdES()?/+hFbSVV8gEWf::o-nrk9b+b-Ouhg(MS\u002605n\u003cV(\u003ejZR\u003c9LnWr3DaCQ[RBqd2n9T\u003e@9pWitKyi2PRkKzrYBblT-R]zX^Ip?k$x3LX8b7WoP?+0vR*DJNiqw+z[kQ3L\u003ex2PGnP7OC/BzOJ:DrNBRA:\u003ej8#5VZ=)@9hM9e\u0026=fDk\u0026*lvsoa\u003eM=s/fG/\u0026edEEY0}S=C}m!Wi4\u003c\u003cE/]Lg(-\u0026$S{/7*iKU).C}I6]TT*VolF^nPmY.ZV!]Pm5wV(q}:O\u003cSfUyOujUdeR9!3fI[K9VApJVKHg{DjEi:j?yfPWEKR.KTxo3TQOwKXAQ^)j*uKKn?SGK/uqR\u003cS^mwlx7Zu)m%noutgVPb4nOYl?tw@mpHKp@ESyHrVVD(@DmHIR-\u003cARklnIN:gweEzb(!\u003cTL0aL.u+*MqnL+\u003cPaZh(2zL.8?48i^bjS6O]?j[5iQ}8c#6v\u0026T]yq]\u003e}Y(4Kak-{}6pA1nx(W", "ln": 137168 }, { "b": "q$(\u00264q4g\u003eCqtJ\u0026WpYQYDp+RVirN!E}ru:9qrm$+Rrl=GhrY9YPr(r3-s2+]\u0026s3Yeul}6Nnnj=ADoIFnTp/ga?r8($2sxO*ovQ\u0026}Ww[L^\u003eyhmT5zF%GlA=VtBC6wgRDn46egC*%Eh-J/Ffb$\u0026e%0FV-@#q)Q%j4}=%411b%5o\u003cn%9U::%bX8$%bX8$%bX8$%bX8$%csM5%dHtg@@r300aE\u0026ywmYmTAb](b0000000000000000000000000000000000000", "ln": 138159 }, { "b": "6CRx17-AwN%nSc08xfUp9V(HFa%OuVcmph\u003cdL054e?X[kgbF$g%nSaAvS2Z%w[K8myhmV@Ab*bvBtm]Zx(!PegC*$5h-rVIf!$Kwh8WxMiws(Jv}od.xj#0]yIW\u003c9z/t", "ln": 138453 }, { "b": "000000000000000000000000000000000000000000000000000000000000PJh3)00000kVN\u003c+00000u/}B\u0026000000000000000A{0D6000000rr9100000F9c?j000000SSi200000Irs)t000000@@r300000MfeeF000001onA400000Q2#BR000001POJ", "ln": 164768 }, { "b": "0000000000000000000000000000000000000000000000000000000000000rr9100000/:dSU000000rr9100000\u003eM}j?000000rr9100000{Z3{2000000rr91000003jl+k000003\u0026*nc0000006*I:000004fcwd00000^8Md!0000082%Tp00000", "ln": 165496 } ], "depth": 1, "facts": { "exp": [ [ "init" ], [ "stderr" ], [ "stdout" ], [ "fini" ] ], "imp": [ [ "", "opendir" ], [ "", "setuid" ], [ "", "memcmp" ], [ "", "qsort" ], [ "", "remove" ], [ "", "abort" ], [ "", "realloc" ], [ "", "write" ], [ "", "geteuid" ], [ "", "dup2" ], [ "", "assuan_socket_connect" ], [ "", "gpgrt_asprintf" ], [ "", "exit" ], [ "", "gcry_control" ], [ "", "gpgrt_fgets" ], [ "", "setsid" ], [ "", "iconv_close" ], [ "", "gcry_calloc" ], [ "", "strcspn" ], [ "", "gpgrt_fopen" ], [ "", "gpgrt_getcwd" ], [ "", "pipe" ], [ "", "snprintf" ], [ "", "gpgrt_log_bug" ], [ "", "gpg_err_code_from_errno" ], [ "", "dup" ], [ "", "deregister_frame_info" ], [ "", "inotify_add_watch" ], [ "", "gpgrt_write_sanitized" ], [ "", "getpid" ], [ "", "strcmp" ], [ "", "gpgrt_rewind" ], [ "", "readdir" ], [ "", "gpgrt_write" ], [ "", "time" ], [ "", "gcry_md_hash_buffer" ], [ "", "gpgrt_ungetc" ], [ "", "stpcpy" ], [ "", "unlink" ], [ "", "putenv" ], [ "", "gcry_create_nonce" ], [ "", "nl_langinfo" ], [ "", "gpgrt_mopen" ], [ "", "malloc" ], [ "", "fork" ], [ "", "memmove" ], [ "", "gpgrt_logv" ], [ "", "strcat" ], [ "", "gcry_set_outofcore_handler" ], [ "", "fflush" ], [ "", "strncmp" ], [ "", "assuan_transact" ], [ "", "gcry_malloc" ], [ "", "strcpy" ], [ "", "gpgrt_fileno" ], [ "", "strrchr" ], [ "", "fstat" ], [ "", "gpgrt_read_line" ], [ "", "closedir" ], [ "", "gpgrt_log" ], [ "", "gpgrt_set_binary" ], [ "", "setenv" ], [ "", "ITM_deregisterTMCloneTable" ], [ "", "gpgrt_log_fatal" ], [ "", "sleep" ], [ "", "gpgrt_fopenmem" ], [ "", "gpgrt_feof" ], [ "", "gpgrt_log_printf" ], [ "", "open" ], [ "", "gpgrt_log_string" ], [ "", "explicit_bzero" ], [ "", "gpgrt_vfprintf" ], [ "", "strstr" ], [ "", "gpgrt_fputc" ], [ "", "kill" ], [ "", "gcry_realloc" ], [ "", "rename" ], [ "", "unsetenv" ], [ "", "gpg_err_set_errno" ], [ "", "getpwnam" ], [ "", "link" ], [ "", "getsockname" ], [ "", "gpgrt_log_error" ], [ "", "iconv" ], [ "", "strchr" ], [ "", "strncasecmp" ], [ "", "gpgrt_set_strusage" ], [ "", "chmod" ], [ "", "gpg_err_code_from_syserror" ], [ "", "gpgrt_log_set_socket_dir_cb" ], [ "", "strspn" ], [ "", "strpbrk" ], [ "", "gpgrt_fflush" ], [ "", "getppid" ], [ "", "timegm" ], [ "", "getpwuid" ], [ "", "gcry_xcalloc" ], [ "", "waitpid" ], [ "", "libc_start_main" ], [ "", "gcry_check_version" ], [ "", "gpgrt_fname_get" ], [ "", "gpgrt_log_set_prefix" ], [ "", "gpgrt_vasprintf" ], [ "", "readlink" ], [ "", "strncpy" ], [ "", "sigemptyset" ], [ "", "cxa_finalize" ], [ "", "setrlimit" ], [ "", "register_frame_info" ], [ "", "exit" ], [ "", "raise" ], [ "", "gpgrt_set_fixed_string_mapper" ], [ "", "gpgrt_log_info" ], [ "", "gpgrt_ftruncate" ], [ "", "gpg_strerror" ], [ "", "fprintf" ], [ "", "gpgrt_read" ], [ "", "gpg_strsource" ], [ "", "gpgrt_snprintf" ], [ "", "gpgrt_argparse" ], [ "", "gcry_xrealloc" ], [ "", "gpgrt_fclose_snatch" ], [ "", "gpgrt_log_get_prefix" ], [ "", "gpgrt_usage" ], [ "", "ferror" ], [ "", "gpgrt_log_assert" ], [ "", "assuan_set_gpg_err_source" ], [ "", "strtoul" ], [ "", "gcry_free" ], [ "", "close" ], [ "", "assert_fail" ], [ "", "gmtime" ], [ "", "ITM_registerTMCloneTable" ], [ "", "sysconf" ], [ "", "gcry_sexp_sscan" ], [ "", "setlocale" ], [ "", "calloc" ], [ "", "gpgrt_fgetc" ], [ "", "getrlimit" ], [ "", "gpgrt_strusage" ], [ "", "read" ], [ "", "initgroups" ], [ "", "gcry_malloc_secure" ], [ "", "rmdir" ], [ "", "sigprocmask" ], [ "", "gpgrt_ftello" ], [ "", "gpgrt_printf" ], [ "", "gcry_sexp_sprint" ], [ "", "gpgrt_set_confdir" ], [ "", "gpgrt_get_std_stream" ], [ "", "gcry_set_log_handler" ], [ "", "errno_location" ], [ "", "bsearch" ], [ "", "gpgrt_get_errorcount" ], [ "", "fcntl" ], [ "", "gpg_err_init" ], [ "", "gpgrt_mkdir" ], [ "", "gpgrt_ferror" ], [ "", "fputs" ], [ "", "chdir" ], [ "", "atexit" ], [ "", "gpgrt_fputs" ], [ "", "tolower" ], [ "", "nanosleep" ], [ "", "localtime" ], [ "", "gpgrt_free" ], [ "", "gcry_set_fatalerror_handler" ], [ "", "execv" ], [ "", "gpgrt_set_usage_outfnc" ], [ "", "gpgrt_setvbuf" ], [ "", "free" ], [ "", "strftime" ], [ "", "toupper" ], [ "", "assuan_release" ], [ "", "gpgrt_inc_errorcount" ], [ "", "gpgrt_set_alloc_func" ], [ "", "atoi" ], [ "", "stat" ], [ "", "gpgrt_fseek" ], [ "", "isatty" ], [ "", "iconv_open" ], [ "", "mktime" ], [ "", "gpgrt_fread" ], [ "", "ttyname" ], [ "", "gcry_strdup" ], [ "", "tmpfile" ], [ "", "strerror" ], [ "", "assuan_new" ], [ "", "select" ], [ "", "gpgrt_poll" ], [ "", "gpgrt_fprintf" ], [ "", "gpgrt_log_get_stream" ], [ "", "assuan_set_log_cb" ], [ "", "gmtime_r" ], [ "", "putc" ], [ "", "gpgrt_chdir" ], [ "", "sprintf" ], [ "", "getenv" ], [ "", "gpgrt_reallocarray" ], [ "", "sigaction" ], [ "", "gpgrt_fwrite" ], [ "", "sigfillset" ], [ "", "gpg_err_code_to_errno" ], [ "", "gcry_xstrdup" ], [ "", "gpgrt_log_debug" ], [ "", "gpgrt_fdopen" ], [ "", "uname" ], [ "", "strlen" ], [ "", "gpgrt_fclose" ], [ "", "gpgrt_argparser" ], [ "", "stack_chk_fail" ], [ "", "inotify_init" ], [ "", "gpgrt_bsprintf" ], [ "", "gcry_cipher_algo_name" ], [ "", "strcasecmp" ], [ "", "getuid" ], [ "", "gcry_xmalloc" ], [ "", "difftime" ], [ "", "gpgrt_access" ] ], "sec": [ [ ".note.gnu.property", 792, 48, 1.94, "alloc" ], [ ".note.gnu.build-id", 840, 36, 4.0, "alloc" ], [ ".interp", 876, 25, 4.05, "alloc" ], [ ".gnu.hash", 904, 60, 3.11, "alloc" ], [ ".dynsym", 968, 5376, 1.15, "alloc" ], [ ".dynstr", 6344, 2631, 4.39, "alloc" ], [ ".gnu.version", 8976, 448, 1.73, "alloc" ], [ ".gnu.version_r", 9424, 96, 2.6, "alloc" ], [ ".rela.dyn", 9520, 5280, 1.83, "alloc" ], [ ".rela.plt", 14800, 24, 1.22, "alloc,info_link" ], [ ".relr.dyn", 14824, 56, 3.25, "alloc" ], [ ".init", 16384, 3, 1.58, "alloc,executable" ], [ ".plt", 16400, 32, 3.34, "alloc,executable" ], [ ".text", 16432, 100256, 6.36, "alloc,executable" ], [ ".fini", 116688, 3, 1.58, "alloc,executable" ], [ ".rodata", 118784, 20358, 5.83, "alloc" ], [ ".eh_frame_hdr", 139144, 3956, 5.51, "alloc" ], [ ".eh_frame", 143104, 20468, 5.0, "alloc" ], [ ".init_array", 164816, 8, 1.06, "write,alloc" ], [ ".fini_array", 164824, 8, 1.06, "write,alloc" ], [ ".data.rel.ro", 164832, 712, 2.05, "write,alloc" ], [ ".dynamic", 165544, 592, 1.51, "write,alloc" ], [ ".got", 166136, 1776, 0.03, "write,alloc" ], [ ".data", 167936, 1256, 1.92, "write,alloc" ], [ ".comment", 169192, 28, 3.99, "merge,strings" ], [ ".shstrtab", 169220, 262, 4.18, "" ] ], "tgt": [ "fcn.000055d0", "fcn.00005761", "fcn.0000576d", "fcn.000059a9", "fcn.00005c43", "fcn.00006798", "fcn.00007031", "fcn.000070ae", "fcn.000072eb", "fcn.00007315", "fcn.000075d1", "fcn.00007b9a", "fcn.00007f56", "fcn.00008108", "fcn.000081d7", "fcn.00008444", "fcn.00008465", "fcn.00008627", "fcn.000087cd", "fcn.00008a11", "fcn.00008cb7", "fcn.00009ef6", "fcn.00009f0f", "fcn.00009f36", "fcn.00009f76", "fcn.00009fc7", "fcn.00009fe1", "fcn.0000a001", "fcn.0000a06b", "fcn.0000a147", "fcn.0000a1ad", "fcn.0000a2d9", "fcn.0000a34e", "fcn.0000a375", "fcn.0000a4ed", "fcn.0000a941", "fcn.0000a94c", "fcn.0000aa10", "fcn.0000aa78", "fcn.0000b689", "fcn.0000b83b", "fcn.0000b875", "fcn.0000b8a2", "fcn.0000b8c2", "fcn.0000b8c7", "fcn.0000b8cc", "fcn.0000b8d1", "fcn.0000b8d6", "fcn.0000b8db", "fcn.0000b8e5", "fcn.0000bc6b", "fcn.0000bca4", "fcn.0000bcde", "fcn.0000bcea", "fcn.0000bd41", "fcn.0000be0c", "fcn.0000beb9", "fcn.0000c028", "fcn.0000c0e5", "fcn.0000c129", "fcn.0000c2f9", "fcn.0000c3d1", "fcn.0000c402", "fcn.0000c4ac", "fcn.0000c4e5", "fcn.0000c537", "fcn.0000c6eb", "fcn.0000c713", "fcn.0000c788", "fcn.0000ca16", "fcn.0000caf0", "fcn.0000ceba", "fcn.0000cf69", "fcn.0000cfda", "fcn.0000d186", "fcn.0000d3e0", "fcn.0000d560", "fcn.0000d598", "fcn.0000d769", "fcn.0000d929", "fcn.0000dde8", "fcn.0000de22", "fcn.0000de64", "fcn.0000df24", "fcn.0000e032", "fcn.0000e054", "fcn.0000e0ad", "fcn.0000e16c", "fcn.0000e228", "fcn.0000e2e7", "fcn.0000e3a6", "fcn.0000e3db", "fcn.0000e484", "fcn.0000e54b", "fcn.0000e5f4", "fcn.0000e756", "fcn.0000e83e", "fcn.0000e909", "fcn.0000ea9e", "fcn.0000eaa8", "fcn.0000eaaf", "fcn.0000efa8", "fcn.0000efb6", "fcn.0000f558", "fcn.0000f748", "fcn.0000f9d3", "fcn.0000fa8c", "fcn.0000fa9e", "fcn.0000fcc1", "fcn.0000fcc7", "fcn.0000fccd", "fcn.00010289", "fcn.000102dc", "fcn.0001038c", "fcn.00010930", "fcn.0001096b", "fcn.000109b9", "fcn.00010bce", "fcn.00010c0c", "fcn.00010f16", "fcn.00010f7b", "fcn.00011165", "fcn.00011636", "fcn.0001184d", "fcn.00011864", "fcn.000119a8", "fcn.000119ef", "fcn.00011a7a", "fcn.000121ef", "fcn.000126cd", "fcn.00012cb9", "fcn.00012cdf", "fcn.00012cec", "fcn.00013029", "fcn.00013379", "fcn.0001364c", "fcn.00013737", "fcn.00013a74", "fcn.00013b69", "fcn.00013b87", "fcn.00013dac", "fcn.00013f66", "fcn.00014267", "fcn.0001497d", "fcn.00014a53", "fcn.00014a98", "fcn.00014b5d", "fcn.00014c03", "fcn.00014c0f", "fcn.00014d08", "fcn.00014f1e", "fcn.00015733", "fcn.00015d5c", "fcn.00015f81", "fcn.00016254", "fcn.000163cd", "fcn.00016b85", "fcn.00016ba6", "fcn.00016c9b", "fcn.00016e22", "fcn.000170bb", "fcn.000170e7", "fcn.000179be", "fcn.00017a56", "fcn.00017ab8", "fcn.00017ad9", "fcn.00017c16", "fcn.00017e1b", "fcn.00017e37", "fcn.00017e48", "fcn.00017e9e", "fcn.00017fce", "fcn.00018008", "fcn.0001873b", "fcn.0001874c", "fcn.000189a2", "fcn.000189c3", "fcn.00018ab8", "fcn.00018b90", "fcn.00018bf6", "fcn.00018ec6", "fcn.00018eed", "fcn.00019222", "fcn.000192af", "fcn.000196ab", "fcn.00019813", "fcn.00019c78", "fcn.00019c92", "fcn.00019d91", "fcn.0001a092", "fcn.0001a153", "fcn.0001a4d4", "fcn.0001ab73", "fcn.0001ab96", "fcn.0001b21a", "fcn.0001ba79", "fcn.0001bb6e", "fcn.0001bc60", "fcn.0001be25", "fcn.0001bf86", "fcn.0001c444", "fcn.0001c4ce", "fcn.0001c6c9" ], "funcs": [ [ "sym._init", 16384 ], [ "sym.imp.__libc_start_main", 16416 ], [ "entry0", 21900 ], [ "fcn.000055d0", 21968 ], [ "entry.fini0", 22080 ], [ "entry.init0", 22176 ], [ "fcn.00005761", 22369 ], [ "fcn.0000576d", 22381 ], [ "fcn.000059a9", 22953 ], [ "fcn.00005c43", 23619 ], [ "fcn.00005f1c", 24348 ], [ "fcn.00006421", 25633 ], [ "fcn.0000647f", 25727 ], [ "fcn.00006798", 26520 ], [ "fcn.00006b2f", 27439 ], [ "fcn.00006ceb", 27883 ], [ "fcn.00007031", 28721 ], [ "fcn.000070ae", 28846 ], [ "fcn.00007102", 28930 ], [ "fcn.000071c0", 29120 ], [ "fcn.000072eb", 29419 ], [ "fcn.00007315", 29461 ], [ "fcn.000075d1", 30161 ], [ "fcn.00007b9a", 31642 ], [ "fcn.00007de7", 32231 ], [ "fcn.00007f56", 32598 ], [ "fcn.00008108", 33032 ], [ "fcn.000081d7", 33239 ], [ "fcn.00008444", 33860 ], [ "fcn.00008465", 33893 ], [ "fcn.00008627", 34343 ], [ "fcn.000087cd", 34765 ], [ "fcn.00008a11", 35345 ], [ "fcn.00008cb7", 36023 ], [ "fcn.00009166", 37222 ], [ "fcn.00009255", 37461 ], [ "fcn.000092d7", 37591 ], [ "fcn.00009378", 37752 ], [ "fcn.00009b52", 39762 ], [ "fcn.00009ef6", 40694 ], [ "fcn.00009f0f", 40719 ], [ "fcn.00009f36", 40758 ], [ "fcn.00009f76", 40822 ], [ "fcn.00009fc7", 40903 ], [ "fcn.00009fe1", 40929 ], [ "fcn.0000a001", 40961 ], [ "fcn.0000a06b", 41067 ], [ "fcn.0000a13b", 41275 ], [ "fcn.0000a147", 41287 ], [ "fcn.0000a1ad", 41389 ], [ "fcn.0000a2d9", 41689 ], [ "fcn.0000a34e", 41806 ], [ "fcn.0000a375", 41845 ], [ "fcn.0000a3bc", 41916 ], [ "fcn.0000a4ed", 42221 ], [ "fcn.0000a941", 43329 ], [ "fcn.0000a94c", 43340 ], [ "fcn.0000aa10", 43536 ], [ "fcn.0000aa78", 43640 ], [ "fcn.0000b689", 46729 ], [ "fcn.0000b83b", 47163 ], [ "fcn.0000b875", 47221 ], [ "fcn.0000b8a2", 47266 ], [ "fcn.0000b8c2", 47298 ], [ "fcn.0000b8c7", 47303 ], [ "fcn.0000b8cc", 47308 ], [ "fcn.0000b8d1", 47313 ], [ "fcn.0000b8d6", 47318 ], [ "fcn.0000b8db", 47323 ], [ "fcn.0000b8e0", 47328 ], [ "fcn.0000b8e5", 47333 ], [ "fcn.0000bc6b", 48235 ], [ "fcn.0000bca4", 48292 ], [ "fcn.0000bcde", 48350 ], [ "fcn.0000bcea", 48362 ], [ "fcn.0000bd41", 48449 ], [ "fcn.0000be0c", 48652 ], [ "fcn.0000beb9", 48825 ], [ "fcn.0000c028", 49192 ], [ "fcn.0000c0e5", 49381 ], [ "fcn.0000c129", 49449 ], [ "fcn.0000c2f9", 49913 ], [ "fcn.0000c3d1", 50129 ], [ "fcn.0000c402", 50178 ], [ "fcn.0000c4ac", 50348 ], [ "fcn.0000c4e5", 50405 ], [ "fcn.0000c537", 50487 ], [ "fcn.0000c6eb", 50923 ], [ "fcn.0000c70e", 50958 ], [ "fcn.0000c713", 50963 ], [ "fcn.0000c788", 51080 ], [ "fcn.0000ca16", 51734 ], [ "fcn.0000caf0", 51952 ], [ "fcn.0000ceba", 52922 ], [ "fcn.0000cf69", 53097 ], [ "fcn.0000cfc7", 53191 ], [ "fcn.0000cfda", 53210 ], [ "fcn.0000d186", 53638 ], [ "fcn.0000d2b7", 53943 ], [ "fcn.0000d3e0", 54240 ], [ "fcn.0000d542", 54594 ], [ "fcn.0000d560", 54624 ], [ "fcn.0000d598", 54680 ], [ "fcn.0000d769", 55145 ], [ "fcn.0000d929", 55593 ], [ "fcn.0000dcf7", 56567 ], [ "fcn.0000dde8", 56808 ], [ "fcn.0000de22", 56866 ], [ "fcn.0000de64", 56932 ], [ "fcn.0000df24", 57124 ], [ "fcn.0000df5b", 57179 ], [ "fcn.0000e032", 57394 ], [ "fcn.0000e054", 57428 ], [ "fcn.0000e0ad", 57517 ], [ "fcn.0000e16c", 57708 ], [ "fcn.0000e228", 57896 ], [ "fcn.0000e2e7", 58087 ], [ "fcn.0000e3a6", 58278 ], [ "fcn.0000e3db", 58331 ], [ "fcn.0000e440", 58432 ], [ "fcn.0000e484", 58500 ], [ "fcn.0000e4ff", 58623 ], [ "fcn.0000e50d", 58637 ], [ "fcn.0000e54b", 58699 ], [ "fcn.0000e5f4", 58868 ], [ "fcn.0000e756", 59222 ], [ "fcn.0000e83e", 59454 ], [ "fcn.0000e909", 59657 ], [ "fcn.0000ea9e", 60062 ], [ "fcn.0000eaa8", 60072 ], [ "fcn.0000eaaf", 60079 ], [ "fcn.0000eb55", 60245 ], [ "fcn.0000efa8", 61352 ], [ "fcn.0000efb6", 61366 ], [ "fcn.0000f4a9", 62633 ], [ "fcn.0000f558", 62808 ], [ "fcn.0000f579", 62841 ], [ "fcn.0000f748", 63304 ], [ "fcn.0000f7c8", 63432 ], [ "fcn.0000f812", 63506 ], [ "fcn.0000f9d3", 63955 ], [ "fcn.0000fa8c", 64140 ], [ "fcn.0000fa9e", 64158 ], [ "fcn.0000fcc1", 64705 ], [ "fcn.0000fcc7", 64711 ], [ "fcn.0000fccd", 64717 ], [ "fcn.00010289", 66185 ], [ "fcn.000102dc", 66268 ], [ "fcn.0001038c", 66444 ], [ "fcn.00010930", 67888 ], [ "fcn.0001096b", 67947 ], [ "fcn.000109b9", 68025 ], [ "fcn.00010bce", 68558 ], [ "fcn.00010c0c", 68620 ], [ "fcn.00010f16", 69398 ], [ "fcn.00010f62", 69474 ], [ "fcn.00010f7b", 69499 ], [ "fcn.00011165", 69989 ], [ "fcn.00011636", 71222 ], [ "fcn.0001169c", 71324 ], [ "fcn.0001184d", 71757 ], [ "fcn.00011864", 71780 ], [ "fcn.000119a8", 72104 ], [ "fcn.000119ef", 72175 ], [ "fcn.00011a7a", 72314 ], [ "fcn.00011b9f", 72607 ], [ "fcn.00011f0b", 73483 ], [ "fcn.000121ef", 74223 ], [ "fcn.000125fc", 75260 ], [ "fcn.000126cd", 75469 ], [ "fcn.00012786", 75654 ], [ "fcn.00012cb9", 76985 ], [ "fcn.00012cdf", 77023 ], [ "fcn.00012cec", 77036 ], [ "fcn.00013029", 77865 ], [ "fcn.00013334", 78644 ], [ "fcn.00013379", 78713 ], [ "fcn.0001364c", 79436 ], [ "fcn.00013737", 79671 ], [ "fcn.00013a74", 80500 ], [ "fcn.00013b69", 80745 ], [ "fcn.00013b87", 80775 ], [ "fcn.00013dac", 81324 ], [ "fcn.00013de4", 81380 ], [ "fcn.00013ed2", 81618 ], [ "fcn.00013f66", 81766 ], [ "fcn.00014105", 82181 ], [ "fcn.00014267", 82535 ], [ "fcn.00014497", 83095 ], [ "fcn.0001497d", 84349 ], [ "fcn.00014a53", 84563 ], [ "fcn.00014a98", 84632 ], [ "fcn.00014b5d", 84829 ], [ "fcn.00014c03", 84995 ], [ "fcn.00014c0f", 85007 ], [ "fcn.00014cae", 85166 ], [ "fcn.00014d08", 85256 ], [ "fcn.00014f1e", 85790 ], [ "fcn.00015733", 87859 ], [ "fcn.0001575d", 87901 ], [ "fcn.000159a1", 88481 ], [ "fcn.00015c55", 89173 ], [ "fcn.00015cd1", 89297 ], [ "fcn.00015d08", 89352 ], [ "fcn.00015d5c", 89436 ], [ "fcn.00015f81", 89985 ], [ "fcn.00016254", 90708 ], [ "fcn.000163cd", 91085 ], [ "fcn.00016b85", 93061 ], [ "fcn.00016ba6", 93094 ], [ "fcn.00016c9b", 93339 ], [ "fcn.00016e22", 93730 ], [ "fcn.000170bb", 94395 ], [ "fcn.000170e7", 94439 ], [ "fcn.000179be", 96702 ], [ "fcn.00017a56", 96854 ], [ "fcn.00017ab8", 96952 ], [ "fcn.00017ad9", 96985 ], [ "fcn.00017c16", 97302 ], [ "fcn.00017e1b", 97819 ], [ "fcn.00017e37", 97847 ], [ "fcn.00017e48", 97864 ], [ "fcn.00017e9e", 97950 ], [ "fcn.00017f6c", 98156 ], [ "fcn.00017fce", 98254 ], [ "fcn.00018008", 98312 ], [ "fcn.00018426", 99366 ], [ "fcn.0001873b", 100155 ], [ "fcn.0001874c", 100172 ], [ "fcn.000187c4", 100292 ], [ "fcn.000189a2", 100770 ], [ "fcn.000189c3", 100803 ], [ "fcn.00018ab8", 101048 ], [ "fcn.00018b90", 101264 ], [ "fcn.00018bf6", 101366 ], [ "fcn.00018ec6", 102086 ], [ "fcn.00018eed", 102125 ], [ "fcn.00019222", 102946 ], [ "fcn.000192af", 103087 ], [ "fcn.000196ab", 104107 ], [ "fcn.00019813", 104467 ], [ "fcn.00019824", 104484 ], [ "fcn.00019bfd", 105469 ], [ "fcn.00019c78", 105592 ], [ "fcn.00019c92", 105618 ], [ "fcn.00019cc9", 105673 ], [ "fcn.00019d91", 105873 ], [ "fcn.00019db4", 105908 ], [ "fcn.00019e94", 106132 ], [ "fcn.0001a092", 106642 ], [ "fcn.0001a153", 106835 ], [ "fcn.0001a302", 107266 ], [ "fcn.0001a4d4", 107732 ], [ "fcn.0001ab73", 109427 ], [ "fcn.0001ab96", 109462 ], [ "fcn.0001b21a", 111130 ], [ "fcn.0001ba79", 113273 ], [ "fcn.0001bb6e", 113518 ], [ "fcn.0001bc60", 113760 ], [ "fcn.0001be25", 114213 ], [ "fcn.0001bf86", 114566 ], [ "fcn.0001c15c", 115036 ], [ "fcn.0001c444", 115780 ], [ "fcn.0001c4ce", 115918 ], [ "fcn.0001c59f", 116127 ], [ "fcn.0001c6c9", 116425 ], [ "fcn.0001c71e", 116510 ], [ "sym._fini", 116688 ] ], "metrics": { "elf": { "bits": 64, "entry": 21900, "has_got": 1, "has_plt": 1, "has_note": 1, "note_count": 2, "nx_enabled": 1, "has_dt_relr": 1, "dynrel_count": 0, "dynsym_count": 224, "has_build_id": 1, "has_eh_frame": 1, "has_gnu_hash": 1, "no_gnu_stack": 0, "stack_canary": 1, "symtab_count": 0, "dynrela_count": 220, "little_endian": 1, "dt_flags_1_raw": 134217729, "pltreloc_count": 1, "build_id_length": 20, "dt_versym_count": 224, "executable_stack": 0, "fini_array_count": 1, "init_array_count": 1, "wx_segment_count": 0, "comment_entry_count": 1, "program_header_count": 13, "stripped_with_symtab": 0, "comment_distinct_count": 1, "executable_segment_count": 1, "load_segment_max_file_size": 100307, "load_segment_max_memory_size": 100307, "section_relocation_group_count": 2, "stripped_metadata_section_count": 7 }, "file": { "size": 171280, "entropy": 6.09 }, "binary": { "is_pie": 1, "has_overlay": 1, "is_stripped": 1, "basic_blocks": 4629, "code_entropy": 6.36, "data_entropy": 1.11, "overlay_size": 1798, "string_count": 1008, "overlay_ratio": 0.01, "avg_complexity": 13.03, "max_complexity": 196, "huge_func_count": 21, "leaf_func_count": 29, "overlay_entropy": 1.53, "tiny_func_count": 38, "avg_basic_blocks": 17.27, "entropy_variance": 2.74, "avg_string_length": 18.51, "max_string_length": 96, "peak_region_bytes": 1024, "code_to_data_ratio": 0.96, "peak_region_entropy": 7.76, "string_length_stddev": 13.03, "largest_section_ratio": 0.59, "sentence_string_count": 289, "sentence_string_ratio": 0.29, "high_entropy_string_count": 1 }, "exports": { "count": 4, "api_count": 4 }, "imports": { "count": 219 }, "strings": { "truncated": 0, "retained_count": 1008, "extracted_count": 1008 }, "sections": { "count": 28, "code_size": 100294, "entropy_max": 6.36, "entropy_mean": 2.86, "name_entropy": 4.13, "writable_count": 7, "executable_count": 4, "nonstandard_count": 6, "executable_writable_count": 0 }, "functions": { "count": 268 }, "dependencies": { "count": 4 } } }, "id": 1, "mol": "K(Te)H₄(Cm₃F₉Po₅U)Md₃(BiHePa)", "path": "gnupg-wks-client-2.4.9-r1.apk!!usr/bin/gpg-wks-client", "pid": 0, "risk": 19, "sha": "08b9b37dc19041f44cf0154eb958740292e0137d436947b85411b7dafa453c0f", "size": 171280, "traits": [ { "id": "metadata/binary/code/complexity::many-huge-functions", "conf": 0.9, "crit": 3, "desc": "4+ functions with 50+ block control-flow graphs" }, { "id": "metadata/binary/header/identity::shared-object-type", "conf": 1.0, "crit": 2, "desc": "ELF uses ET_DYN object type" }, { "id": "metadata/binary/section/prose::few-high-entropy-strings-20", "conf": 1.0, "crit": 2, "desc": "Binary has at most 20 high-entropy strings", "spans": [ [ 129868, 66 ] ] }, { "id": "metadata/binary/section/prose::rich-sentence-strings-20pct", "conf": 0.8, "crit": 2, "desc": "Binary has many sentence-like strings" }, { "id": "metadata/binary/symbols/count::many-imports", "conf": 0.8, "crit": 2, "desc": "High number of imported symbols (\u003e80)" }, { "id": "metadata/binary/symbols/count::many-imports-50", "conf": 1.0, "crit": 2, "desc": "Binary has 50+ imports" }, { "id": "metadata/file/string/file::tmp", "conf": 0.2, "crit": 1, "desc": "tmp keyword", "spans": [ [ 133842, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"", "spans": [ [ 119017, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-4", "conf": 0.8, "crit": 1, "desc": "English function-word token \"have\"", "spans": [ [ 127713, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "spans": [ [ 118946, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-6", "conf": 0.8, "crit": 1, "desc": "English function-word token \"with\"", "spans": [ [ 119898, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-7", "conf": 0.8, "crit": 1, "desc": "English function-word token \"this\"", "spans": [ [ 120856, 0 ] ] }, { "id": "metadata/package/files/dependency::os-image-root-file-path", "conf": 0.94, "crit": 3, "desc": "Root-level OS directory path" }, { "id": "micro-behaviors/communications/http/header/content-type::content-type-header", "conf": 0.5, "crit": 3, "desc": "References an HTTP Content-Type header", "spans": [ [ 119287, 71 ], [ 122115, 34 ] ] }, { "id": "micro-behaviors/communications/http/header/custom::boundary-param", "atk": "T1071.001", "mbc": "C0002", "conf": 0.5, "crit": 2, "desc": "Contains an HTTP multipart boundary parameter", "spans": [ [ 126738, 0 ] ] }, { "id": "micro-behaviors/communications/ipc/dbus::dbus-session-bus-address-env", "conf": 0.9, "crit": 3, "desc": "Reads the D-Bus session bus address", "spans": [ [ 131825, 24 ] ] }, { "id": "micro-behaviors/communications/socket/create::static-socket-api-marker", "conf": 0.8, "crit": 1, "desc": "Static ELF contains socket API marker", "spans": [ [ 128351, 0 ] ] }, { "id": "micro-behaviors/fs/file/binary::fseek-func", "conf": 0.4, "crit": 2, "desc": "Seeks to position in file", "spans": [ [ 8136, 0 ] ] }, { "id": "micro-behaviors/fs/link/symlink::readlink", "conf": 0.8, "crit": 3, "desc": "Read symbolic link target path", "spans": [ [ 8722, 8 ] ] }, { "id": "micro-behaviors/fs/path/device/special::dev-null", "conf": 1.0, "crit": 2, "desc": "/dev/null (legitimate discard device)", "spans": [ [ 127790, 0 ] ] }, { "id": "micro-behaviors/fs/proc/info/path::proc-exe-fragment-cluster", "conf": 0.78, "crit": 3, "desc": "Procfs executable path fragments", "spans": [ [ 128545, 14 ] ] }, { "id": "micro-behaviors/fs/read/file/descriptor::read", "conf": 0.7, "crit": 2, "desc": "Read file descriptor (read/pread)", "spans": [ [ 7769, 0 ] ] }, { "id": "micro-behaviors/fs/write/file/descriptor::write--write", "conf": 0.66, "crit": 2, "desc": "References POSIX write API", "spans": [ [ 7442, 0 ] ] }, { "id": "micro-behaviors/os/privilege/query::geteuid", "conf": 0.5, "crit": 2, "desc": "Get effective user ID", "spans": [ [ 6866, 0 ] ] }, { "id": "micro-behaviors/process/create/direct::pipe-import", "atk": "T1106", "conf": 0.72, "crit": 2, "desc": "References POSIX pipe API", "spans": [ [ 6480, 0 ] ] }, { "id": "micro-behaviors/process/daemonize/detach::setsid-import", "mbc": "F0003", "conf": 0.95, "crit": 3, "desc": "Imports POSIX setsid API", "spans": [ [ 7373, 6 ] ] }, { "id": "micro-behaviors/process/fd/dup::dup2", "conf": 0.5, "crit": 2, "desc": "Duplicate file descriptor (I/O redirection)", "spans": [ [ 6435, 0 ] ] }, { "id": "micro-behaviors/process/fork/clone::fork", "conf": 0.86, "crit": 3, "desc": "Process creation via fork or clone", "spans": [ [ 6586, 4 ] ] }, { "id": "micro-behaviors/process/identity/setuid::drop-privs--setuid", "conf": 0.8, "crit": 2, "desc": "Drop privileges (setuid)", "spans": [ [ 6853, 0 ] ] }, { "id": "micro-behaviors/process/tty/terminal::ttyname", "conf": 0.5, "crit": 2, "desc": "Get terminal name (ttyname)", "spans": [ [ 8674, 0 ] ] }, { "id": "micro-behaviors/ui/help::bracketed-parameter-usage", "conf": 0.96, "crit": 3, "desc": "Usage text lists command-line parameters", "spans": [ [ 118893, 48 ] ] }, { "id": "micro-behaviors/ui/help::options-title", "conf": 0.5, "crit": 2, "desc": "Options: label", "spans": [ [ 123244, 0 ] ] }, { "id": "micro-behaviors/ui/help::usage-lower", "conf": 0.5, "crit": 2, "desc": "usage: label (lowercase)", "spans": [ [ 120606, 0 ] ] }, { "id": "micro-behaviors/ui/help::usage-title", "conf": 0.5, "crit": 2, "desc": "Usage: label (title case)", "spans": [ [ 118893, 0 ] ] }, { "id": "well-known/tool/sysadmin/gnupg::dirmngr-config-socket-marker", "conf": 0.98, "crit": 3, "desc": "GnuPG dirmngr socket/config marker", "spans": [ [ 129143, 9 ] ] }, { "id": "metadata/binary/code/complexity::high-function-count-200", "conf": 0.7, "crit": 2, "desc": "High function count over 200" }, { "id": "metadata/binary/section/prose::high-string-count-1000", "conf": 0.7, "crit": 2, "desc": "High string count over 1000" }, { "id": "metadata/hardening/missing::stripped-binary", "conf": 0.8, "crit": 3, "desc": "No full symbol table (likely stripped)" }, { "id": "micro-behaviors/communications/http/url/domain::http-url-binary", "atk": "T1071.001", "mbc": "C0002", "conf": 0.7, "crit": 3, "desc": "Embedded HTTP or WebSocket URL", "spans": [ [ 133128, 22 ] ] }, { "id": "micro-behaviors/crypto/certificate/usage::certificate-ref", "conf": 0.5, "crit": 2, "desc": "References certificate terminology", "spans": [ [ 127014, 0 ] ] }, { "id": "micro-behaviors/fs/chmod/modify::chmod-symbol", "atk": "T1222", "mbc": "E1222", "conf": 0.66, "crit": 3, "desc": "References chmod permission-change API", "spans": [ [ 8639, 5 ] ] }, { "id": "micro-behaviors/fs/delete/file/library::remove", "conf": 0.3, "crit": 3, "desc": "Delete files", "spans": [ [ 8702, 6 ] ] }, { "id": "micro-behaviors/fs/delete/file/library::static-unlink-symbol-text", "atk": "T1070.004", "mbc": "C0047", "conf": 0.72, "crit": 3, "desc": "Static executable contains unlink symbol", "spans": [ [ 8615, 6 ] ] }, { "id": "micro-behaviors/fs/delete/file/library::unlink", "conf": 0.3, "crit": 3, "desc": "References unlink file-delete API", "spans": [ [ 8615, 6 ] ] }, { "id": "micro-behaviors/fs/directory/readdir::readdir-closedir", "conf": 0.66, "crit": 3, "desc": "Uses closedir", "spans": [ [ 6714, 8 ] ] }, { "id": "micro-behaviors/fs/directory/readdir::readdir-opendir", "conf": 0.66, "crit": 3, "desc": "Uses opendir", "spans": [ [ 6635, 7 ] ] }, { "id": "micro-behaviors/fs/directory/readdir::readdir-readdir", "conf": 0.66, "crit": 3, "desc": "Uses readdir", "spans": [ [ 6455, 7 ] ] }, { "id": "micro-behaviors/fs/file/stat::stat-core", "conf": 0.8, "crit": 3, "desc": "References stat-family file-status API", "spans": [ [ 6495, 5 ], [ 6496, 4 ] ] }, { "id": "micro-behaviors/fs/proc/exe::process-self-ex-fragment", "conf": 0.58, "crit": 2, "desc": "Read own executable path fragment (self/ex)", "spans": [ [ 128545, 0 ] ] }, { "id": "micro-behaviors/fs/proc/exe::process-self-exe-path", "conf": 0.66, "crit": 3, "desc": "References own executable procfs path", "spans": [ [ 128545, 14 ] ] }, { "id": "micro-behaviors/fs/watch/inotify::inotify-add-watch", "conf": 0.66, "crit": 3, "desc": "Adds an inotify watch on a path", "spans": [ [ 8823, 17 ] ] }, { "id": "micro-behaviors/fs/watch/inotify::inotify-init", "conf": 0.66, "crit": 3, "desc": "Creates an inotify instance", "spans": [ [ 8709, 12 ] ] }, { "id": "micro-behaviors/os/env/read::getenv", "conf": 0.3, "crit": 2, "desc": "getenv function (read environment variable)", "spans": [ [ 6406, 0 ] ] }, { "id": "micro-behaviors/os/event/kernel/select::select-multiplex", "conf": 0.5, "crit": 2, "desc": "select() I/O multiplexing", "spans": [ [ 6448, 0 ] ] }, { "id": "micro-behaviors/os/sysinfo/platform/kernel::uname", "atk": "T1082", "mbc": "E1082", "conf": 0.6, "crit": 3, "desc": "Query system name and information", "spans": [ [ 8841, 5 ] ] }, { "id": "micro-behaviors/process/create/execv::c-exec-variants", "conf": 0.8, "crit": 3, "desc": "C-style exec family functions", "spans": [ [ 6591, 5 ] ] }, { "id": "micro-behaviors/process/user/query::getpwuid", "atk": "T1033", "mbc": "E1033", "conf": 0.5, "crit": 3, "desc": "Imports UID password-entry lookup API", "spans": [ [ 7334, 8 ] ] }, { "id": "micro-behaviors/communications/http/header/custom::multipart-upload", "atk": "T1071.001", "mbc": "C0002", "conf": 0.6, "crit": 3, "desc": "Multipart form data upload", "uses": [ 14 ], "spans": [ [ 126738, 13 ] ] }, { "id": "micro-behaviors/communications/socket/multiplex::multiplex", "conf": 0.66, "crit": 3, "desc": "Socket I/O with poll or select multiplexing", "uses": [ 16, 53 ], "spans": [ [ 6448, 6 ], [ 128351, 6 ] ] }, { "id": "micro-behaviors/fs/file/binary::file-position-api", "conf": 0.78, "crit": 3, "desc": "References a file-position API", "uses": [ 17 ], "spans": [ [ 8136, 11 ] ] }, { "id": "micro-behaviors/fs/write/file/descriptor::write", "conf": 0.66, "crit": 2, "desc": "CRT or POSIX file-write capability", "uses": [ 22 ], "spans": [ [ 7442, 0 ] ] }, { "id": "micro-behaviors/process/create/direct::pipe-api-import", "atk": "T1106", "conf": 0.72, "crit": 2, "desc": "References a POSIX pipe API", "uses": [ 24 ], "spans": [ [ 6480, 0 ] ] }, { "id": "micro-behaviors/process/daemonize/detach::full-daemon", "conf": 0.9, "crit": 2, "desc": "Full daemon behavior (fork + setsid + devnull)", "uses": [ 19, 25, 27 ], "spans": [ [ 6586, 0 ], [ 127790, 0 ] ] }, { "id": "micro-behaviors/process/fork/clone::process-creation-primitive", "conf": 0.88, "crit": 3, "desc": "Process creation via fork or clone evidence", "uses": [ 27 ], "spans": [ [ 6586, 4 ] ] }, { "id": "micro-behaviors/process/tty/pty::ttyname-comp", "atk": "T1059", "conf": 0.8, "crit": 3, "desc": "Get terminal device pathname", "uses": [ 29 ], "spans": [ [ 8674, 7 ] ] }, { "id": "micro-behaviors/ui/help::has-help", "conf": 0.85, "crit": 3, "desc": "Contains help or usage information", "uses": [ 31, 32, 33 ], "spans": [ [ 118893, 62 ], [ 120606, 25 ], [ 123244, 8 ] ] }, { "id": "micro-behaviors/ui/help::usage-label", "conf": 0.75, "crit": 1, "desc": "Command line usage text", "uses": [ 31, 32, 33 ], "spans": [ [ 118893, 0 ] ] }, { "id": "micro-behaviors/fs/file/binary::seek-and-descriptor-io", "conf": 0.8, "crit": 3, "desc": "Reads or writes a seeked file descriptor", "uses": [ 21, 59, 60 ], "spans": [ [ 7442, 5 ], [ 7769, 4 ], [ 8136, 11 ] ] }, { "id": "micro-behaviors/process/create/direct::fork-execl-piped-stdio", "atk": "T1106", "conf": 0.92, "crit": 3, "desc": "Fork-execl with piped stdio", "uses": [ 26, 27, 55, 61 ], "spans": [ [ 6435, 4 ], [ 6480, 4 ], [ 6586, 4 ], [ 6591, 5 ] ] }, { "id": "micro-behaviors/process/create/exec::binary-process-execution", "atk": "T1106", "mbc": "C0017", "conf": 0.85, "crit": 1, "desc": "Native binary process execution capability", "uses": [ 55 ], "spans": [ [ 6591, 0 ] ] }, { "id": "micro-behaviors/process/daemonize/detach::fork-new-session", "conf": 0.75, "crit": 3, "desc": "Forks process into detached session", "uses": [ 25, 27 ], "spans": [ [ 6586, 4 ], [ 7373, 6 ] ] }, { "id": "micro-behaviors/process/daemonize/detach::self-exe-session-detach", "conf": 0.75, "crit": 3, "desc": "Reads own executable while detaching process session", "uses": [ 25, 27, 49 ], "spans": [ [ 6586, 4 ], [ 7373, 6 ], [ 128545, 14 ] ] }, { "id": "micro-behaviors/process/identity/setuid::setuid-dup", "conf": 0.6, "crit": 3, "desc": "Set user ID (capability)", "uses": [ 28 ], "spans": [ [ 6853, 6 ] ] } ], "type": "elf" }, { "ctx": [ { "b": "boXZHx(kOBxBnr}wN=\u0026bflItRfjFTkfk2lpeQ7#KeN@QhwO#Plar\u00266@a{[", "ln": 0, "col": 1, "line": 1 } ], "depth": 1, "facts": { "imp": [ [ "", "exec" ] ], "tgt": [ "exec" ], "metrics": { "ast": { "max_depth": 4, "call_count": 1, "node_count": 15 }, "file": { "size": 46, "entropy": 4.42 }, "text": { "lines": 2, "top_char": 47, "space_count": 2, "char_entropy": 4.42, "unique_chars": 25, "top_char_null": 0, "string_density": 1, "top_char_ratio": 0.11, "avg_line_length": 22, "max_line_length": 35, "last_line_length": 35, "whitespace_ratio": 0.09, "identifier_density": 1, "line_length_stddev": 13, "max_whitespace_run": 1, "normalized_string_count": 1.41, "normalized_unique_identifiers": 1 }, "binary": { "peak_region_bytes": 46, "peak_region_entropy": 4.42 }, "strings": { "bytes": 25, "count": 2, "avg_length": 12.5, "max_length": 23, "path_count": 1, "avg_entropy": 2.44, "entropy_stddev": 1.44 }, "comments": { "chars": 8, "count": 1, "lines": 1, "to_code_ratio": 1 }, "identifiers": { "count": 2, "unique": 1, "avg_length": 4, "max_length": 4, "min_length": 4, "avg_entropy": 1.5, "reuse_ratio": 0.5, "all_lowercase_ratio": 1 } } }, "id": 2, "mol": "Md(Pa)", "path": "gnupg-wks-client-2.4.9-r1.apk!!usr/libexec/gpg-wks-client", "pid": 0, "risk": 2, "sha": "ce6cefbfdc918dca407287363e3f3a260df701a1e7e4d6c4fe63fd76b66071f6", "size": 46, "traits": [ { "id": "metadata/package/files/dependency::os-image-root-file-path", "conf": 0.94, "crit": 3, "desc": "Root-level OS directory path" }, { "id": "micro-behaviors/process/create/shell/spawn::shell-exec", "atk": "T1059", "conf": 0.5, "crit": 3, "desc": "Uses shell exec to replace process", "spans": [ [ 10, 4 ] ] } ], "type": "shell" }, { "ctx": [ { "b": "boPG/zE)\u0026%By!#9vTf88vS=y3wfrVXf/HZsuVGTiePJJ", "n": [ { "c": 1, "d": "Alpine/Wolfi package info file", "i": "metadata/package/files/system-package::alpine-pkginfo-basename", "o": 0, "z": 1, "cf": 0.8999999761581421 } ], "ln": 1, "addr": 0 }, { "b": "boRbIx(mMaw)]E^A=k(raA?spB7]MgatCG8h.D\u0026", "ln": 2, "addr": 36 }, { "b": "Abf97vqPM#jS[xPB-p$BCwzmKv@b\u003c\u003czGC", "n": [ { "c": 2, "d": "Alpine/Wolfi package info metadata", "i": "metadata/package/files/system-package::alpine-apk-pkginfo", "o": 68, "z": 26, "cf": 0.9700000286102295 } ], "ln": 3, "addr": 68 }, { "b": "Abf9fwPw[RatLMae\u0026+I7f-", "n": [ { "c": 1, "d": "Alpine/Wolfi package version field", "i": "metadata/package/files/system-package::alpine-pkginfo-version-field", "o": 95, "z": 17, "cf": 0.8999999761581421 } ], "ln": 4, "addr": 95 }, { "b": "Abf8%wPIu7jS)l\u0026ruLaUx)9]{C{2R1vrb)3g9wd\u003es7L?-oj-w\u003eq!o#)x\u003e7Y%v@b\u003c\u003czGC", "ln": 5, "addr": 113 }, { "b": "B-IpvjS[AWBz#pZfe4J[Cp)JCB-p$Cz/PFz", "ln": 6, "addr": 168 }, { "b": "B7]@iauZ\u00264h.^9zhu", "ln": 9, "addr": 278 }, { "b": "vrb\u003c\u003eauZ\u0026(i5Ub4gY", "ln": 10, "addr": 292 }, { "b": "z/PM8x(k4RazkOmAaY", "n": [ { "c": 1, "d": "Alpine/Wolfi package origin field", "i": "metadata/package/files/system-package::alpine-pkginfo-origin-field", "o": 306, "z": 14, "cf": 0.8999999761581421 } ], "ln": 11, "addr": 306 }, { "b": "v@Dj3x(\u003eEXay)z=wmPmfhA9rDixe-Lwh#tNvMlhRwJa6MwIL$#gCy:Eg?5r$w=", "ln": 12, "addr": 321 }, { "b": "zddc@Byw)3wPw[RawMu!vqYH+y-(8-Aa6\u003eKzEWQ7vl!mqAa%i3y?W^fCRi]PxfD", "ln": 13, "addr": 371 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 808.0, "entropy": 5.18, "size_bytes": 808.0 }, "binary": { "overall_entropy": 5.18, "peak_region_bytes": 808.0, "peak_region_entropy": 5.18 } } }, "id": 3, "path": "gnupg-wks-client-2.4.9-r1.apk!!.PKGINFO", "risk": 1, "sha": "ba367673368000b7c3ecc0d639948a45c051212fead3073e3ddcd9066d52a696", "size": 808, "traits": [ { "id": "metadata/package/files/system-package::alpine-pkginfo-basename", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package info file" }, { "id": "metadata/package/files/system-package::arch-pkgname-field", "conf": 0.9399999976158142, "crit": 1, "desc": "Arch pkgname metadata field", "spans": [ [ 68, 26 ] ] }, { "id": "metadata/package/files/system-package::arch-pkgver-field", "conf": 0.9399999976158142, "crit": 1, "desc": "Arch pkgver metadata field", "spans": [ [ 95, 17 ] ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-version-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package version field", "spans": [ [ 95, 17 ] ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-package-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package name field", "spans": [ [ 68, 26 ] ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-origin-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package origin field", "spans": [ [ 306, 14 ] ] }, { "id": "metadata/package/files/system-package::alpine-apk-pkginfo", "conf": 0.9700000286102295, "crit": 2, "desc": "Alpine/Wolfi package info metadata", "spans": [ [ 68, 26 ], [ 95, 17 ], [ 306, 14 ] ] } ], "type": "text" } ], "v": "8" } }