{ "ml": { "v": "7", "eng": "2.1.0", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.1838518, "rte": "az", "prob": 0.1838518 } ], "prob": 0.1838518, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.18385179340839386, "type": "xz" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.022083720192313194, "type": "elf" } ], "version": "v18.18", "analyzed_at": "2026-06-23T19:53:44Z" }, "path": "jpegoptim-1.5.6.tgz", "raw": { "files": [ { "id": 0, "ctx": [ { "b": "@wP48s]XK9\u003egl[e0STwA761smBt8:J\u0026Eg-wa6!\u003c{7Y", "ln": 0 } ], "mol": "H(F₄)Md(He)", "sha": "da24ce136756342afece40e7a1be64997e24697a9ccdbc80e3d9dad063c879aa", "path": "/data/samples/good/foraged/netbsd/netbsd.org/_/jpegoptim-1.5.6/jpegoptim-1.5.6.tgz", "risk": 4, "size": 27488, "type": "xz", "facts": { "metrics": { "file": { "size": 27488.0, "entropy": 7.99, "size_bytes": 27488.0 }, "binary": { "overall_entropy": 7.99 }, "consistency": { "extension_content_mismatch": 1.0, "extension_content_mismatch.archive_as_archive": 1.0 } } }, "traits": [ { "id": "micro-behaviors/os/privilege/query::geteuid", "crit": 2, "desc": "Get effective user ID", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/dylib/library/libc::libc-internal-functions-b", "conf": 0.699999988079071, "crit": 2, "desc": "libc internal symbols cluster B", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/file/open::fopen", "conf": 0.6600000262260437, "crit": 3, "desc": "Open files", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/file/delete::unlink", "conf": 0.30000001192092896, "crit": 3, "desc": "Delete files", "from": [ { "file": 1 } ] }, { "id": "metadata/binary/metrics/threshold::rich-sentence-strings-20pct", "conf": 0.800000011920929, "crit": 1, "desc": "Binary has many sentence-like strings", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/chown::chown-fn", "conf": 0.6600000262260437, "crit": 3, "desc": "Change file ownership", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/file/binary::fseek-text", "atk": "T1005", "crit": 2, "desc": "fseek API string", "from": [ { "file": 1 } ] }, { "id": "metadata/hardening/mitigation::rpath-set", "conf": 0.699999988079071, "crit": 3, "desc": "RPATH/RUNPATH dynamic library path set", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/dylib/library/libc::libc-characteristic-cxa-finalize", "crit": 2, "desc": "libc characteristic cxa finalize", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/ui/help::usage-title", "crit": 2, "desc": "Usage: label (title case)", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/chmod/modify::syscall-chmod", "atk": "T1222", "mbc": "E1222", "conf": 0.6600000262260437, "crit": 3, "desc": "chmod syscall", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/ui/help::usage-label", "conf": 0.75, "crit": 1, "desc": "Command line usage text", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/chmod/modify::umask", "conf": 0.4000000059604645, "crit": 3, "desc": "Set file creation mask (umask)", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/file/binary::binary-read-write-ops", "atk": "T1005", "conf": 0.699999988079071, "crit": 3, "desc": "Binary file read/write operations", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/dylib/library/abi-graphics::cxx-abi-symbols-a", "conf": 0.800000011920929, "crit": 2, "desc": "C++ ABI symbols cluster A", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/os/privilege/query::getuid", "crit": 2, "desc": "Get user ID", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/file/binary::fseek-func", "atk": "T1005", "conf": 0.4000000059604645, "crit": 2, "desc": "Seeks to position in file", "from": [ { "file": 1 } ] }, { "id": "metadata/binary/metrics/threshold::many-imports-50", "conf": 1.0, "crit": 1, "desc": "Binary has 50+ imports", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/ui/help::usage-title-string", "crit": 1, "desc": "Usage: label in binary strings", "from": [ { "file": 1 } ] } ] }, { "ctx": [ { "b": "E))420S-r400000000000@$H+0rr91kRr3p00000kMy=:00000^dEws0000000000kMA+z2MN9\u0026df7:@1][S61o", "ln": 0 }, { "b": "qE%GPB97#llU{gLB7Gy)w{nofBy+CVuVOWpuTEq/vp9RXzEEu}DsW7-uVGZ\u003cx(!xcA:JB0vqPN.x(mK30a{g)BAmB]A+b", "ln": 3509 }, { "b": "vpS.Pz!iJ)x\u003e7\u003c*zGG}1w].D\u003ewb{v-wOkvUvScpeuT[1\u003eAb]JhA@Y@]wOkvqA+eW3wD", "ln": 4006 }, { "b": "ByxiiuT[1\u003eAb]JhA@YMOB97\u00262yHpN+yHpWZx(0=:AaJV?v@DsiuT[a\u003cBzkk[y*Rc\u0026A:-/@By/Gl0bMvUv\u003eI?ve?]9Yw[k?0wO}GRvScpe0chTVy\u00261310b2\u003e+wP.Y$0b#T\u003ewDl7AB7GDdze.i^0cq\u003c!zEEtYxjVg7x\u003ediJuVp47xkRc{wDl\u003c\u003cy?W^50af8OByxnGfAtZ6A++UZuVp6[B98CpzFa1\u003cB98Cyv}Y(.B98Cuy?mF:w[bT}B7CtYxM59j0cJx$zdNQavrqG[vqf/-C4LYlx(n380b(*#vrb#XA+fb%zdJYSxL?V#0a*4\u003ex(Xcf0crm5zEW9%0cJc!B87+=vqG:#v/QB^BzkS60af8BxjVgauT)++0af8BB97\u0026jh822xAclnj0bVH)By/rdA@Zk(vqG)\u003eBz7U.By/YhBo2VPy\u0026si7yhE]AgYQ(\u0026y\u0026:YbBtU-Lw]zT1zua3Wx\u003c$NVx(mTb0c.\u003c(zuarXBz(buuU\u003cT#x8(K+wO2SSxjVgcx\u003ediJwO#2UoI4Myp^)(Yi4=(+flItRfk$YtfkLui000", "ln": 4114 }, { "b": "wOk}2BzkOmB$\u003eQbe\u0026B*{lVl{?A+Pf1Brz#0diHu9iw@DAfFUHpaxi5(zY?X\u003eyIN\u003cawO}?P000000032uvp%djazL\u003ebxk.:hx(a$%z/x/jz/fS4auTmIy?mG)zdN=LapnC#at4a^Aa9\u003c4j$E*deO5BlBuI:9vrufD3lQDlarR^HarR^HarR^HarR^HaAIHkv}/L2ayP8dwPzV%Bzk]fay]58BzkS3BzkVhay]hbwN/?2A^n^tz/M%carR^HarR^HarR^HarR^HarR^Hz/x/jze1rcwfp", "ln": 30634 }, { "b": "aA8jvx(dNgvruj4zvdHeeODWTeIgTEy\u0026yHtarR^HarUieB8U@7C{4ixx(+zgwO=rdvqYP#wQ4{h3lQDyz9h/XvqGU1C%i=4", "ln": 30927 }, { "b": "arR^HarR^HarR^HarR^HarR!xwO2*6z!@@bw[=6)azCBgBzbkdxjkH(azC)tvR6u", "ln": 31558 }, { "b": "3lQDlarR^HarR^HarR^HarR^HaA8dlC{4rAwO@SkB7F(8Cwhejat4aPat2fQwPI@o", "ln": 31855 }, { "b": "C{3QgvruQpdgdgueMKzBeIhcSA=U@kzxH5AarUSzx(n2nAb](fA:-/cC4CYnx(v\u003e@3lQDyA@", "ln": 32284 }, { "b": "axi5(zY?X\u003eyIN\u003cawO}?Pra]#!aAhvtxl4A$ay/tbwPF#rx([2hk%!HCoJt4XoJ-Gk", "ln": 34128 }, { "b": "azbU9wGV5jw]@l9A+c^evqYP#D2E*Fvrb{4Cv+P2z/65dBz\u0026pxwN]H@BAh88B-.f", "ln": 34199 }, { "b": "A=k%#l$G\u003cJf/g1dfFUG=CSmP*hz^0qzE){0B7tn9e\u0026tmt0buE:xk.:hx(a#oc37gKc37gSc37Hx0bq", "ln": 36107 }, { "b": "c37T:BUa[Ze)8jTsxFVTBzU%%wmYN*BzkS9iV].\u00263ijTTA=k$vA+f9aC4\u003e\u0026bazbr", "ln": 38638 }, { "b": "fFUBsfFCEnatCM5h7*M.bU?])lq{okay/ClfFloPB%5H(g:1Lcf/Q*vf!UpuatC/ogDduKhxV:MwPzAamr\u0026+]bMG8+wPQmql](D2A=-#!v@Dj3z/dgqeoSc\u003ce\u00262vdgb7Esfebpqgbf[9hAAYJiX-MoB8b/jy-(e\u003eA3czabU?])lq{okay/Clx!AsnB%5H(f^5k9f!+mmi4(%AatC\u0026pfFLQAh6uTLwPzAamr\u0026+]bMG8+wPQmql](D2A=+=4xk8loq.i8mf!Lj7gb7BpfekgmgCx}ai65\u0026OiYe]uyhWW7xcoS/A3czabU?])lq{okay/ClwO#3hq.i8mf!Lg6gb7BpfebvsfGgaei65-FiX@PnyhWW7xcoS/A3czabU?])lq{okay/Clzz1\u003csB%5H(f^5k9f!+mmi4(%AatC\u0026pfFLQAh6uTLwPzAamr\u0026+]bME\u0026m=Jj7D00000000000000800008000080000800", "ln": 45865 }, { "b": "BAhFivGn34xMFooBywRUe[]iBwPz.\u0026e]CPHwId\u003eiByGr4e[[\u003cczGC\u003ehzF%Sde]ClxvSM6jAa9$\u003ee[!WmxAfU}D2vXGz2=h0D2vXBASv.8zGNNPwPz\u003caz/bLcxkR\u0026AC4CYnx(v(@ASv.jwD", "ln": 62569 }, { "b": "v@.M4wmoN*e]\u003eJte]\u003e\u003ege[xlBvqPZ*04}]5Bs}JGBo0}7vrt]Te[e)y04}=1zeA\u003c4Bo0{(", "ln": 62774 } ], "depth": 1, "facts": { "exp": [ [ "progname" ], [ "ps_strings" ], [ "environ" ], [ "warn" ] ], "imp": [ [ "", "fdopen" ], [ "", "memcmp" ], [ "", "abort" ], [ "", "realloc" ], [ "", "geteuid" ], [ "", "jpeg_destroy_decompress" ], [ "", "sscanf" ], [ "", "pipe" ], [ "", "snprintf" ], [ "", "deregister_frame_info" ], [ "", "setjmp14" ], [ "", "signal" ], [ "", "getpid" ], [ "", "jpeg_finish_compress" ], [ "", "jpeg_set_quality" ], [ "", "unlink" ], [ "", "stat50" ], [ "", "fork" ], [ "", "jpeg_set_defaults" ], [ "", "Jv_RegisterClasses" ], [ "", "fflush" ], [ "", "strrchr" ], [ "", "strnlen" ], [ "", "fclose" ], [ "", "chown" ], [ "", "utimensat" ], [ "", "wait" ], [ "", "open" ], [ "", "jpeg_write_scanlines" ], [ "", "jpeg_start_decompress" ], [ "", "vfprintf" ], [ "", "optarg" ], [ "", "rename" ], [ "", "jpeg_abort_compress" ], [ "", "chmod" ], [ "", "jpeg_destroy_compress" ], [ "", "printf" ], [ "", "fwrite" ], [ "", "sF" ], [ "", "strncpy" ], [ "", "stack_chk_guard" ], [ "", "cxa_finalize" ], [ "", "register_frame_info" ], [ "", "exit" ], [ "", "jpeg_std_error" ], [ "", "fprintf" ], [ "", "jpeg_read_coefficients" ], [ "", "jpeg_abort_decompress" ], [ "", "jpeg_start_compress" ], [ "", "jpeg_CreateDecompress" ], [ "", "jpeg_save_markers" ], [ "", "jpeg_resync_to_restart" ], [ "", "strncat" ], [ "", "fread" ], [ "", "close" ], [ "", "jpeg_write_marker" ], [ "", "umask" ], [ "", "calloc" ], [ "", "optind" ], [ "", "fgets_chk" ], [ "", "fstat50" ], [ "", "jpeg_CreateCompress" ], [ "", "fputc" ], [ "", "mkstemps" ], [ "", "jpeg_read_header" ], [ "", "jpeg_write_coefficients" ], [ "", "fputs" ], [ "", "realpath" ], [ "", "jpeg_read_scanlines" ], [ "", "atexit" ], [ "", "longjmp14" ], [ "", "jpeg_finish_decompress" ], [ "", "jpeg_simple_progression" ], [ "", "free" ], [ "", "jpeg_copy_critical_parameters" ], [ "", "puts" ], [ "", "lstat50" ], [ "", "fopen" ], [ "", "libc_init" ], [ "", "memcpy" ], [ "", "strlen" ], [ "", "stack_chk_fail" ], [ "", "getopt_long" ], [ "", "fseek" ], [ "", "getuid" ] ], "sec": [ [ ".interp", 512, 23, 3.82, "alloc" ], [ ".note.netbsd.ident", 536, 24, 3.0, "alloc" ], [ ".note.netbsd.pax", 560, 20, 1.56, "alloc" ], [ ".hash", 584, 648, 1.55, "alloc" ], [ ".dynsym", 1232, 2232, 1.18, "alloc" ], [ ".dynstr", 3464, 1087, 4.51, "alloc" ], [ ".gnu.version", 4552, 186, 0.76, "alloc" ], [ ".gnu.version_r", 4744, 32, 1.99, "alloc" ], [ ".rela.dyn", 4776, 3960, 2.16, "alloc" ], [ ".rela.plt", 8736, 1824, 1.71, "alloc,info_link" ], [ ".init", 10560, 14, 3.04, "alloc,executable" ], [ ".plt", 10576, 1232, 4.25, "alloc,executable" ], [ ".plt.got", 11808, 32, 3.19, "alloc,executable" ], [ ".text", 11840, 18736, 6.07, "alloc,executable" ], [ ".fini", 30576, 14, 3.24, "alloc,executable" ], [ ".rodata", 30592, 8308, 4.99, "alloc" ], [ ".eh_frame_hdr", 38900, 444, 4.66, "alloc" ], [ ".eh_frame", 39344, 2148, 4.97, "alloc" ], [ ".ctors", 41656, 16, 1.0, "write,alloc" ], [ ".dtors", 41672, 16, 1.0, "write,alloc" ], [ ".jcr", 41688, 8, 0.0, "write,alloc" ], [ ".data.rel.ro", 41696, 2784, 1.62, "write,alloc" ], [ ".dynamic", 44480, 464, 1.48, "write,alloc" ], [ ".got", 44944, 88, 0.51, "write,alloc" ], [ ".got.plt", 45056, 632, 1.86, "write,alloc" ], [ ".data", 45688, 132, 0.98, "write,alloc" ], [ ".comment", 45820, 61, 4.11, "merge,strings" ], [ ".ident", 45881, 338, 4.84, "merge,strings" ], [ ".SUNW_ctf", 46220, 143, 2.89, "" ], [ ".debug_aranges", 46363, 64, 1.0, "" ], [ ".debug_info", 46427, 2178, 4.47, "" ], [ ".debug_abbrev", 48605, 741, 4.77, "" ], [ ".debug_line", 49346, 1105, 5.06, "" ], [ ".debug_str", 50451, 967, 4.8, "merge,strings" ], [ ".debug_loc", 51418, 1568, 2.05, "" ], [ ".debug_ranges", 52986, 208, 1.23, "" ], [ ".symtab", 53200, 6240, 2.11, "" ], [ ".strtab", 59440, 3118, 4.83, "" ], [ ".shstrtab", 62558, 369, 4.3, "" ] ], "metrics": { "elf": { "bits": 64.0, "entry": 11840.0, "has_got": 1.0, "has_plt": 1.0, "has_note": 1.0, "has_rpath": 1.0, "relacount": 156.0, "has_symtab": 1.0, "note_count": 2.0, "nx_enabled": 1.0, "dynrel_count": 0.0, "dynsym_count": 93.0, "has_eh_frame": 1.0, "stack_canary": 1.0, "symtab_count": 260.0, "dynrela_count": 165.0, "little_endian": 1.0, "dt_flags_1_raw": 134217728.0, "dwarf.cu_count": 1.0, "pltreloc_count": 76.0, "dt_versym_count": 93.0, "executable_stack": 0.0, "wx_segment_count": 0.0, "comment_entry_count": 2.0, "debug_section_count": 7.0, "fortify_source_count": 1.0, "program_header_count": 8.0, "comment_distinct_count": 2.0, "gnu_stack_section_absent": 1.0, "load_segment_max_file_size": 41492.0, "stripped_but_symtab_present": 0.0, "load_segment_max_memory_size": 41492.0, "section_relocation_group_count": 2.0, "stripped_metadata_section_count": 1.0 }, "file": { "size": 65552.0, "entropy": 5.18, "size_bytes": 65552.0 }, "binary": { "is_pie": 1.0, "has_overlay": 1.0, "is_stripped": 0.0, "code_entropy": 5.95, "data_entropy": 1.59, "overlay_size": 2625.0, "string_count": 595.0, "overlay_ratio": 0.04, "overall_entropy": 5.18, "overlay_entropy": 1.46, "entropy_variance": 2.66, "avg_string_length": 25.7, "max_string_length": 3400.0, "code_to_data_ratio": 0.83, "string_length_stddev": 139.57, "largest_section_ratio": 0.29, "sentence_string_count": 157.0, "sentence_string_ratio": 0.26, "high_entropy_string_count": 0.0 }, "exports": { "count": 4.0 }, "imports": { "count": 85.0 }, "sections": { "count": 41.0, "code_size": 20028.0, "entropy_max": 6.07, "entropy_mean": 2.86, "name_entropy": 4.25, "writable_count": 9.0, "executable_count": 5.0, "nonstandard_count": 15.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 3.0 } } }, "id": 1, "mol": "H(F₄)Md(He)", "path": "/data/samples/good/foraged/netbsd/netbsd.org/_/jpegoptim-1.5.6/jpegoptim-1.5.6.tgz!!bin/jpegoptim", "risk": 4, "sha": "4e31bcc50adeb2dbcd66e2acb0ce1432b378507c6b50160f6fac4da436036840", "size": 65552, "traits": [ { "id": "micro-behaviors/fs/file/open::fopen", "conf": 0.6600000262260437, "crit": 3, "desc": "Open files", "spans": [ [ 4474, 5 ] ] }, { "id": "micro-behaviors/ui/help::usage-title", "crit": 2, "desc": "Usage: label (title case)", "spans": [ [ 30696, 128 ] ] }, { "id": "micro-behaviors/fs/file/binary::fseek-text", "atk": "T1005", "crit": 2, "desc": "fseek API string", "spans": [ [ 4508, 5 ] ] }, { "id": "micro-behaviors/dylib/library/libc::libc-characteristic-cxa-finalize", "crit": 2, "desc": "libc characteristic cxa finalize", "spans": [ [ 3539, 12 ] ] }, { "id": "micro-behaviors/ui/help::usage-title-string", "crit": 1, "desc": "Usage: label in binary strings", "spans": [ [ 30696, 128 ] ] }, { "id": "micro-behaviors/os/privilege/query::geteuid", "crit": 2, "desc": "Get effective user ID", "spans": [ [ 4207, 7 ] ] }, { "id": "micro-behaviors/fs/chmod/modify::umask", "conf": 0.4000000059604645, "crit": 3, "desc": "Set file creation mask (umask)", "spans": [ [ 4379, 5 ] ] }, { "id": "metadata/binary/metrics/threshold::many-imports-50", "conf": 1.0, "crit": 1, "desc": "Binary has 50+ imports", "spans": [ [ 0, 21 ] ] }, { "id": "micro-behaviors/fs/chown::chown-fn", "conf": 0.6600000262260437, "crit": 3, "desc": "Change file ownership", "spans": [ [ 4313, 5 ] ] }, { "id": "metadata/binary/metrics/threshold::rich-sentence-strings-20pct", "conf": 0.800000011920929, "crit": 1, "desc": "Binary has many sentence-like strings", "spans": [ [ 0, 35 ] ] }, { "id": "micro-behaviors/fs/file/binary::fseek-func", "atk": "T1005", "conf": 0.4000000059604645, "crit": 2, "desc": "Seeks to position in file", "spans": [ [ 4508, 5 ] ] }, { "id": "metadata/hardening/mitigation::rpath-set", "conf": 0.699999988079071, "crit": 3, "desc": "RPATH/RUNPATH dynamic library path set", "spans": [ [ 0, 20 ] ] }, { "id": "micro-behaviors/os/privilege/query::getuid", "crit": 2, "desc": "Get user ID", "spans": [ [ 4514, 6 ] ] }, { "id": "micro-behaviors/fs/file/delete::unlink", "conf": 0.30000001192092896, "crit": 3, "desc": "Delete files", "spans": [ [ 4256, 6 ] ] }, { "id": "micro-behaviors/fs/chmod/modify::syscall-chmod", "atk": "T1222", "mbc": "E1222", "conf": 0.6600000262260437, "crit": 3, "desc": "chmod syscall", "spans": [ [ 4357, 5 ] ] }, { "id": "micro-behaviors/fs/file/binary::binary-read-write-ops", "atk": "T1005", "conf": 0.699999988079071, "crit": 3, "desc": "Binary file read/write operations", "spans": [ [ 4508, 5 ] ] }, { "id": "micro-behaviors/ui/help::usage-label", "conf": 0.75, "crit": 1, "desc": "Command line usage text", "spans": [ [ 30696, 128 ] ] }, { "id": "micro-behaviors/dylib/library/libc::libc-internal-functions-b", "conf": 0.699999988079071, "crit": 2, "desc": "libc internal symbols cluster B", "spans": [ [ 3539, 12 ] ] }, { "id": "micro-behaviors/dylib/library/abi-graphics::cxx-abi-symbols-a", "conf": 0.800000011920929, "crit": 2, "desc": "C++ ABI symbols cluster A", "spans": [ [ 3539, 12 ] ] } ], "type": "elf" } ], "rev": "b520a", "v": "8" } }