{ "llm": { "conf": 0.3816571, "grade": "benign", "model": "Qwen/Qwen3.6-27B", "review": false, "outcome": "benign", "interpretation": "Legitimate iproute2 package binaries" }, "ml": { "v": "7", "eng": "2.2.0-rc.1", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.005237967, "rte": "az", "prob": 0.005237967 }, { "cls": 0, "raw": 0.0019128323, "rte": "az/tar", "prob": 0.0019128323 } ], "prob": 0.116652966, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.1166529655456543, "type": "apk_alpine" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.014209548942744732, "type": "elf" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.012389819137752056, "type": "elf" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.012567132711410522, "type": "elf" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.1166529655456543, "type": "elf" }, { "id": 5, "lvl": -1, "conf": 0, "prob": 0.018639614805579185, "type": "elf" }, { "id": 6, "lvl": -1, "conf": 0, "prob": 0.015363584272563457, "type": "elf" }, { "id": 7, "lvl": -1, "conf": 0, "prob": 0.011237005703151226, "type": "elf" }, { "id": 8, "lvl": -1, "conf": 0, "prob": 0.1166529655456543, "type": "python" }, { "id": 9, "lvl": -1, "conf": 0, "prob": 0.000013470649719238281, "type": "elf" }, { "id": 10, "lvl": -1, "conf": 0, "prob": 0.000011791785254899878, "type": "elf" }, { "id": 11, "lvl": -1, "conf": 0, "prob": 0.000016202529877773486, "type": "shell" }, { "id": 12, "lvl": -1, "conf": 0, "prob": 0.1166529655456543, "type": "text" } ], "version": "v18.18", "analyzed_at": "2026-06-26T09:29:17Z" }, "path": "iproute2-7.1.0-r0.apk", "raw": { "files": [ { "id": 0, "ctx": [ { "b": "abZy8000000T3{24[J!\u003enkh=HeH]u63?!Yp^*DIa!jX1m:JNrco?u{f=2H?Deg@xa3GU*X", "n": [ { "c": 2, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "o": 0, "z": 1, "cf": 1.0 } ], "ln": 0 } ], "mol": "O₂(CEr₂)H₆(Cm₁₀DbDsF₄OsPo₄)Md(Pt)", "sha": "df4f1c37da95d010789f3086387119a2139ca744d15715dd5c54aae16a283e53", "path": "iproute2-7.1.0-r0.apk", "risk": 14, "size": 184322, "type": "apk_alpine", "facts": { "metrics": { "file": { "size": 184322.0, "entropy": 7.99, "size_bytes": 184322.0 }, "parse": { "error_count": 1.0 }, "binary": { "overall_entropy": 7.99, "peak_region_bytes": 182272.0, "peak_region_entropy": 7.83 } } }, "traits": [ { "id": "micro-behaviors/fs/path/temp::unix-temp", "conf": 0.699999988079071, "crit": 2, "desc": "Unix /tmp/ path reference", "from": [ { "file": 2 } ], "spans": [ [ 17551, 5 ] ] }, { "id": "micro-behaviors/process/create/subprocess::python-subprocess-io-fields--stdout", "atk": "T1059.006", "conf": 0.8399999737739563, "crit": 1, "desc": "Process output/status field names (stdout)", "from": [ { "file": 8 } ] }, { "id": "metadata/lang/source::imports-subprocess", "conf": 0.949999988079071, "crit": 3, "desc": "Imports subprocess module", "from": [ { "file": 8 } ] }, { "id": "micro-behaviors/communications/ip/resolve::resolve-gethostbyaddr", "conf": 0.6600000262260437, "crit": 3, "desc": "Resolve address with gethostbyaddr", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/socket/multiplex::poll-multiplex", "crit": 3, "desc": "poll() I/O multiplexing", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/fs/directory/readdir::readdir-opendir", "conf": 0.6600000262260437, "crit": 2, "desc": "Uses opendir", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/file/read::fscanf", "conf": 0.699999988079071, "crit": 2, "desc": "Formatted input from file", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/socket/tcp::connect-symbol-text", "conf": 0.75, "crit": 3, "desc": "Connect API symbol text", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/process/create/subprocess::import-dup", "atk": "T1059.006", "mbc": "E1059.006", "conf": 0.699999988079071, "crit": 2, "desc": "subprocess module import", "from": [ { "file": 8 } ] }, { "id": "micro-behaviors/communications/socket/send::sendmsg-symbol", "atk": "T1071", "mbc": "C0001", "conf": 0.6600000262260437, "crit": 3, "desc": "Uses sendmsg socket call", "from": [ { "file": 1 } ] }, { "id": "objectives/evasion/process/injection/memory::asm-manual-import-parsing-cond-2--inline-18287", "conf": 0.8999999761581421, "crit": 3, "desc": "High export-count binary context", "from": [ { "file": 1 } ], "spans": [ [ 0, 22 ] ] }, { "id": "micro-behaviors/communications/ip/parse::inet-ntop-symbol", "conf": 0.6600000262260437, "crit": 3, "desc": "Parse IP with inet_ntop", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/file/write/direct::write--write", "conf": 0.6600000262260437, "crit": 2, "desc": "Write files (write)", "from": [ { "file": 2 } ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-package-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package name field", "from": [ { "file": 12 } ] }, { "id": "micro-behaviors/process/create/subprocess::methods", "atk": "T1059.006", "conf": 0.75, "crit": 3, "desc": "subprocess module methods", "from": [ { "off": 1106, "file": 8, "line": 45 } ] }, { "id": "micro-behaviors/ui/help::usage-label", "conf": 0.75, "crit": 1, "desc": "Command line usage text", "from": [ { "file": 1 }, { "file": 2 }, { "file": 3 }, { "file": 5 }, { "file": 6 }, { "off": 72336, "file": 7 }, { "file": 9 }, { "file": 10 } ], "spans": [ [ 16707, 49 ], [ 16873, 128 ], [ 20480, 128 ], [ 25826, 128 ], [ 26515, 96 ], [ 31075, 128 ], [ 31328, 40 ], [ 32447, 34 ] ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-basename", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package info file" }, { "id": "micro-behaviors/communications/socket/options::options-set", "conf": 0.6600000262260437, "crit": 3, "desc": "Set socket options", "from": [ { "file": 1 } ], "spans": [ [ 3354, 21 ] ] }, { "id": "micro-behaviors/communications/ip/parse::inet-pton-symbol", "conf": 0.6600000262260437, "crit": 3, "desc": "Parse IP with inet_pton", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/socket/listen::listen-sym", "atk": "T1071", "mbc": "C0001", "conf": 0.6000000238418579, "crit": 3, "desc": "listen function symbol", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/communications/socket/tcp::accept-symbol-text", "conf": 0.75, "crit": 3, "desc": "Accept API symbol text", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/fs/file/binary::file-read-operation", "atk": "T1005", "conf": 0.75, "crit": 1, "desc": "File read operation", "from": [ { "off": 14561, "file": 1 }, { "file": 2 }, { "off": 3241, "file": 3 }, { "off": 3664, "file": 5 }, { "off": 14853, "file": 6 }, { "file": 7 } ], "spans": [ [ 2595, 4 ] ] }, { "id": "micro-behaviors/fs/file/read::fread-text", "conf": 0.6200000047683716, "crit": 2, "desc": "fread API string", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/socket/listen::socket-sym", "mbc": "C0001", "conf": 0.4000000059604645, "crit": 3, "desc": "socket function symbol", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/file/write/direct::write", "conf": 0.6600000262260437, "crit": 2, "desc": "Write files", "from": [ { "off": 13895, "file": 1 }, { "off": 2831, "file": 2 }, { "off": 3483, "file": 5 }, { "off": 14811, "file": 6 }, { "off": 4101, "file": 7 } ], "spans": [ [ 2831, 5 ] ] }, { "id": "micro-behaviors/fs/volume/mount::mount-underscore", "conf": 0.6600000262260437, "crit": 3, "desc": "Mount file systems", "from": [ { "file": 7 } ] }, { "id": "objectives/command-and-control/botnet/keywords::slave-term", "conf": 0.4000000059604645, "crit": 3, "desc": "Slave keyword", "from": [ { "file": 7 } ] }, { "id": "micro-behaviors/fs/directory/readdir::readdir-readdir", "conf": 0.6600000262260437, "crit": 2, "desc": "Uses readdir", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/create/subprocess::python-exec-capability", "conf": 0.800000011920929, "crit": 3, "desc": "Python process execution capability", "from": [ { "off": 1106, "file": 8, "line": 45 } ] }, { "id": "micro-behaviors/dylib/library/abi-graphics::cxx-abi-symbols-a", "conf": 0.800000011920929, "crit": 2, "desc": "C++ ABI symbols cluster A", "from": [ { "file": 1 } ] }, { "id": "metadata/binary/metrics/threshold::many-imports-50", "conf": 1.0, "crit": 1, "desc": "Binary has 50+ imports", "from": [ { "file": 1 } ], "spans": [ [ 0, 21 ] ] }, { "id": "micro-behaviors/communications/socket/tcp::listen-symbol-text", "conf": 0.75, "crit": 3, "desc": "Listen API symbol text", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/fs/directory/readdir::readdir-closedir", "conf": 0.6600000262260437, "crit": 2, "desc": "Uses closedir", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/socket/connect::connect-symbol", "atk": "T1071", "mbc": "C0001", "conf": 0.6600000262260437, "crit": 3, "desc": "Uses connect socket call", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/communications/socket/connect::_connect-symbol", "atk": "T1071", "mbc": "C0001", "conf": 0.6600000262260437, "crit": 3, "desc": "Uses _connect socket call", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/communications/socket/tcp::socket-symbol-text", "conf": 0.75, "crit": 3, "desc": "Socket API symbol text", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/fork/clone::daemon-dup", "conf": 0.6600000262260437, "crit": 3, "desc": "Daemonize process", "from": [ { "file": 2 } ] }, { "id": "objectives/command-and-control/reverse-shell/pty::python-socket-shell-cond-0--inline-10052", "conf": 0.949999988079071, "crit": 3, "desc": "Regex component marker", "from": [ { "file": 8 } ] }, { "id": "micro-behaviors/fs/file/read::read", "conf": 0.699999988079071, "crit": 2, "desc": "Read file descriptor (read/pread)", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/communications/ip/parse::ntohl-symbol", "conf": 0.6600000262260437, "crit": 3, "desc": "Converts network to host long", "from": [ { "file": 1 } ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-version-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package version field", "from": [ { "file": 12 } ] }, { "id": "micro-behaviors/communications/socket/bind/function::bind", "conf": 0.75, "crit": 3, "desc": "Bind socket to address", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/socket/receive::_recv-symbol", "atk": "T1071", "mbc": "C0001", "conf": 0.6600000262260437, "crit": 3, "desc": "Uses _recv socket call", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/dylib/lookup::dlsym-symbol", "conf": 0.8999999761581421, "crit": 2, "desc": "dlsym function symbol", "from": [ { "file": 6 } ] }, { "id": "micro-behaviors/communications/socket/receive::recv-symbol", "atk": "T1071", "mbc": "C0001", "conf": 0.6600000262260437, "crit": 3, "desc": "Uses recv socket call", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/dylib/library/libc::libc-internal-functions-b", "conf": 0.699999988079071, "crit": 2, "desc": "libc internal symbols cluster B", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/path/temp::hidden-tmp-path", "conf": 1.0, "crit": 2, "desc": "Hidden path prefix in /tmp", "from": [ { "file": 2 } ], "spans": [ [ 17551, 6 ] ] }, { "id": "micro-behaviors/dylib/library/libc::libc-characteristic-cxa-finalize", "crit": 2, "desc": "libc characteristic cxa finalize", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/os/network/status::netstat", "conf": 0.8999999761581421, "crit": 3, "desc": "netstat command", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/communications/socket/interface::if-indextoname-symbol", "conf": 0.699999988079071, "crit": 3, "desc": "Looks up name with if_indextoname", "from": [ { "file": 1 } ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-origin-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package origin field", "from": [ { "file": 12 } ] }, { "id": "micro-behaviors/communications/ip/parse::htonl-symbol", "conf": 0.6600000262260437, "crit": 3, "desc": "Converts host to network long", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/dylib/load/runtime::dlopen", "atk": "T1574.006", "conf": 0.8999999761581421, "crit": 3, "desc": "Dynamic library loading via dlopen", "from": [ { "file": 6 } ] }, { "id": "micro-behaviors/process/create/subprocess::popen-content", "atk": "T1059.006", "mbc": "E1059.006", "conf": 0.75, "crit": 3, "desc": "subprocess.Popen call (content)", "from": [ { "file": 8 } ] }, { "id": "micro-behaviors/fs/volume/mount::mount-fn", "conf": 0.6600000262260437, "crit": 3, "desc": "Mount file systems", "from": [ { "file": 7 } ] }, { "id": "micro-behaviors/data/serialize/json::json-load-call", "conf": 0.8999999761581421, "crit": 3, "desc": "Python json.load call", "from": [ { "file": 8 } ] }, { "id": "micro-behaviors/ui/help::usage-title", "crit": 2, "desc": "Usage: label (title case)", "from": [ { "file": 1 } ], "spans": [ [ 16707, 49 ], [ 16873, 128 ], [ 20480, 128 ], [ 25826, 128 ], [ 26515, 96 ], [ 31075, 128 ], [ 31328, 40 ], [ 32447, 34 ] ] }, { "id": "micro-behaviors/communications/socket/send::_send-symbol", "atk": "T1071", "mbc": "C0001", "conf": 0.6600000262260437, "crit": 3, "desc": "Uses _send socket call", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/path/temp::tmp-hidden-file", "atk": "T1564.001", "conf": 0.75, "crit": 3, "desc": "Hidden file path in /tmp directory", "from": [ { "file": 2 }, { "file": 3 } ], "spans": [ [ 17551, 5 ] ] }, { "id": "micro-behaviors/communications/socket/interface::if-nametoindex-symbol", "conf": 0.699999988079071, "crit": 3, "desc": "Looks up index with if_nametoindex", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/os/privilege/query::getuid", "crit": 2, "desc": "Get user ID", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/ip/parse::htons-symbol", "conf": 0.6600000262260437, "crit": 3, "desc": "Converts host to network short", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/create/subprocess::popen-ast", "atk": "T1059.006", "mbc": "C0017", "conf": 0.8500000238418579, "crit": 3, "desc": "Executes external system command", "from": [ { "file": 8 } ] }, { "id": "micro-behaviors/process/fd/stdio::freopen-import", "conf": 0.699999988079071, "crit": 3, "desc": "freopen stream redirection import", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/ip/parse::ntohs-symbol", "conf": 0.6600000262260437, "crit": 3, "desc": "Converts network to host short", "from": [ { "file": 1 } ] }, { "id": "metadata/binary/metrics/threshold::rich-sentence-strings-20pct", "conf": 0.800000011920929, "crit": 1, "desc": "Binary has many sentence-like strings", "from": [ { "file": 9 } ], "spans": [ [ 0, 35 ] ] }, { "id": "micro-behaviors/communications/socket/receive::recvmsg-symbol", "atk": "T1071", "mbc": "C0001", "conf": 0.6600000262260437, "crit": 3, "desc": "Uses recvmsg socket call", "from": [ { "file": 1 } ] }, { "id": "objectives/command-and-control/reverse-shell/pty::pty-dual-mode-backdoor-cond-2--inline-10027", "atk": "T1059.004", "mbc": "B0024", "conf": 0.9300000071525574, "crit": 3, "desc": "Regex component marker", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/communications/socket/send::send-symbol", "atk": "T1071", "mbc": "C0001", "conf": 0.6600000262260437, "crit": 3, "desc": "Uses send socket call", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/socket/listen::listen", "atk": "T1071", "mbc": "C0001", "conf": 0.6600000262260437, "crit": 3, "desc": "Listen on a socket", "from": [ { "file": 1 }, { "file": 2 }, { "file": 3 }, { "file": 5 }, { "file": 6 }, { "file": 7 }, { "file": 9 } ] }, { "id": "micro-behaviors/dylib/load/runtime::dlopen-dlsym", "atk": "T1574.006", "conf": 0.8500000238418579, "crit": 3, "desc": "Core dlopen/dlsym pattern", "from": [ { "off": 14369, "file": 6 } ] }, { "id": "objectives/evasion/masquerade/extension/shebang::bash-shebang-first-line", "atk": "T1036.008", "mbc": "F0008", "conf": 0.949999988079071, "crit": 3, "desc": "File starts with", "from": [ { "file": 11 } ] }, { "id": "micro-behaviors/process/create/exec::command-execution-capability", "conf": 0.699999988079071, "crit": 3, "desc": "Command execution capability", "from": [ { "off": 1106, "file": 8, "line": 45 } ] }, { "id": "micro-behaviors/os/privilege/query::geteuid", "crit": 2, "desc": "Get effective user ID", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/volume/umount::umount2-fn", "conf": 0.6600000262260437, "crit": 3, "desc": "Unmount file system", "from": [ { "file": 7 } ] }, { "id": "micro-behaviors/communications/socket/options::options-get", "conf": 0.6600000262260437, "crit": 3, "desc": "Get socket options", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/communications/socket/listen::accept-sym", "atk": "T1071", "mbc": "C0001", "conf": 0.6000000238418579, "crit": 3, "desc": "accept function symbol", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/fs/path/temp::tmp-path-content", "conf": 1.0, "crit": 2, "desc": "/tmp/ path component", "from": [ { "file": 2 } ], "spans": [ [ 17551, 13 ] ] }, { "id": "micro-behaviors/ui/help::usage-title-string", "crit": 1, "desc": "Usage: label in binary strings", "from": [ { "file": 1 } ], "spans": [ [ 16707, 49 ], [ 16873, 128 ], [ 20480, 128 ], [ 25826, 128 ], [ 26515, 96 ], [ 31075, 128 ], [ 31328, 40 ], [ 32447, 34 ] ] }, { "id": "micro-behaviors/fs/file/open::fopen", "conf": 0.6600000262260437, "crit": 3, "desc": "Open files", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/file/write/direct::write--fwrite", "conf": 0.6600000262260437, "crit": 2, "desc": "Write files (fwrite)", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/file/read::fread", "conf": 0.699999988079071, "crit": 2, "desc": "Read stream (fread)", "from": [ { "file": 1 } ] } ] }, { "ctx": [ { "b": "E))420S-r400000000000@$H+0rr917I0HC00000kMy=:00000:BKu(0000000000kMA+z4feS[8#{]T1][S6", "n": [ { "c": 3, "d": "Benign PE anti-analysis context", "i": "objectives/anti-analysis/debugger-detect/combined-checks::evasion-aware-benign-pe-context", "o": 0, "z": 22, "cf": 1.0 } ], "ln": 0 }, { "b": "KQIHGy?Wuiy?bbmB-RvJCSmP*hz^4cz.r:A0000E0SSjp0000w0000b0000:2SI!:dGx", "n": [ { "c": 3, "d": "Architecture detection strings", "i": "objectives/discovery/host/software::arch-detection", "o": 889, "z": 6, "cf": 0.5 } ], "ln": 873 }, { "b": "000000iVw500000003wkv%zA?w[=c\u003ey?Xib0af8zwPzu{x(!xcA:JB0vqPN.x(mK30aeq%o\u003c.{L", "n": [ { "c": 3, "d": "Benign network-capable library context", "i": "objectives/supply-chain/trojanized/backdoor::benign-network-library-context", "o": 13739, "z": 12, "cf": 0.8999999761581421 } ], "ln": 13723 }, { "b": "y?Wu*uVQr$A=+V9vqfPVxjVgbx(dB1w[ks}0a{B}x()[^uTE\u003e@vpK7Wv}YT+w)]y\u00260a]?VB-Ri@B97@7A=Id(Aclnz0a*y?Bo3i2z!J}!B8C@qx(n380af8AA=M5ouU\u003cT\u003cvruj4zua:1A+]r80b2\u003e+wO#U\u003eB98CjAcRB}z/xo90a{pZvqYVSw[bT}B7Ct-xjVga0cri\u003evqYVSzddl%z^@=*BAg]mz#:/}wO#3)ASyb\u003evpS[.ASyf5A:@%90bMZ#vrqGVy\u0026sxawnc5:w]I)mv/P\u003eyvrlH3A=+V2vqfJTA+e:7zf6s\u0026B98ClA=M8s0chTXB]VP9A:@^60crm5Bz\u003e%}B98CAz/]\u003c@B98CAz!n#\u003cBn", "n": [ { "c": 4, "d": "Sets LD_PRELOAD hooks to hide filesystem", "i": "objectives/evasion/kernel-hide/userspace::preload-rootkit-hook-set", "o": 13997, "z": 5, "cf": 0.9200000166893005 }, { "c": 3, "d": "Stack protector/canary enabled", "i": "metadata/hardening/build::stack-protector", "o": 13904, "z": 14, "cf": 0.8999999761581421 }, { "c": 3, "d": "Converts network to host long", "i": "micro-behaviors/communications/ip/parse::ntohl-symbol", "o": 13944, "z": 5, "cf": 0.6600000262260437 }, { "c": 3, "d": "Uses _recv socket call", "i": "micro-behaviors/communications/socket/receive::_recv-symbol", "o": 14119, "z": 4, "cf": 0.6600000262260437 }, { "c": 3, "d": "Uses recvmsg socket call", "i": "micro-behaviors/communications/socket/receive::recvmsg-symbol", "o": 14102, "z": 7, "cf": 0.6600000262260437 }, { "c": 3, "d": "Read file status and metadata", "i": "micro-behaviors/fs/file/stat::stat", "o": 14067, "z": 5, "cf": 0.800000011920929 }, { "c": 2, "d": "Characteristic libc export __assert_fail", "i": "micro-behaviors/dylib/library/libc::libc-characteristic-assert-fail", "o": 14090, "z": 11, "cf": 0.5 }, { "c": 2, "d": "Uses closedir", "i": "micro-behaviors/fs/directory/readdir::readdir-closedir", "o": 14073, "z": 8, "cf": 0.6600000262260437 }, { "c": 2, "d": "Uses opendir", "i": "micro-behaviors/fs/directory/readdir::readdir-opendir", "o": 14044, "z": 7, "cf": 0.6600000262260437 }, { "c": 2, "d": "Uses readdir", "i": "micro-behaviors/fs/directory/readdir::readdir-readdir", "o": 14052, "z": 7, "cf": 0.6600000262260437 }, { "c": 2, "d": "Generic file read/write operations", "i": "micro-behaviors/fs/file/read-write::binary-file-ops", "o": 14003, "z": 6, "cf": 0.800000011920929 }, { "c": 2, "d": "Write single bytes to file", "i": "micro-behaviors/fs/file/write/direct::fputc", "o": 14082, "z": 5, "cf": 0.6600000262260437 }, { "c": 2, "d": "Write files (fwrite)", "i": "micro-behaviors/fs/file/write/direct::write--fwrite", "o": 13895, "z": 6, "cf": 0.6600000262260437 }, { "c": 2, "d": "Environment variable access functions", "i": "micro-behaviors/os/env/vars/access::env-access-comp", "o": 13983, "z": 6, "cf": 0.4000000059604645 }, { "c": 2, "d": "Line-based file reading (fgets)", "i": "micro-behaviors/process/create/direct::fgets-loop", "o": 14017, "z": 5, "cf": 1.0 }, { "c": 2, "d": "Terminates process immediately without cleanup", "i": "micro-behaviors/process/terminate/signal::_exit", "o": 13939, "z": 4, "cf": 0.4000000059604645 }, { "c": 2, "d": "Execution time measurement APIs", "i": "objectives/anti-analysis/timing/evasion::timing-measurement", "o": 13882, "z": 12, "cf": 0.4000000059604645 } ], "ln": 13866 }, { "b": "BAhFwB.\u003e\u003c]B98CAz!%j\u0026xMOfgyYFc\u003cz/fQ@B98Cuy?mF:B98Cuv@MX[zdNM]zeYF-Bz\u003e\u003c[B9R?pz/fd!zGG/gA@Zf4ByO#)ASx]]v{%g}x(dzYvrk}2x(dzYxjVgcx\u003ediRwPRHax\u003ediNvq]N^wPRo#A=kB/v{%s-xjVf(w]7)*0aPCRuT)[-vr8uTvq]N{wPRo#A=kB/v{%s-w].D]0crl)x(i].A+ffdwO}GXwPR:5zE\u0026/?BAg(1Bo3x7A=Vty0chTVy\u00261310cn", "n": [ { "c": 3, "d": "Converts host to network long", "i": "micro-behaviors/communications/ip/parse::htonl-symbol", "o": 14188, "z": 5, "cf": 0.6600000262260437 }, { "c": 3, "d": "Converts host to network short", "i": "micro-behaviors/communications/ip/parse::htons-symbol", "o": 14194, "z": 5, "cf": 0.6600000262260437 }, { "c": 3, "d": "Converts network to host short", "i": "micro-behaviors/communications/ip/parse::ntohs-symbol", "o": 14236, "z": 5, "cf": 0.6600000262260437 }, { "c": 3, "d": "freopen stream redirection import", "i": "micro-behaviors/process/fd/stdio::freopen-import", "o": 14347, "z": 7, "cf": 0.699999988079071 }, { "c": 3, "d": "POSIX user lookup functions", "i": "objectives/discovery/account/enum::passive-user-lookup", "o": 14268, "z": 6, "cf": 0.4000000059604645 }, { "c": 2, "d": "Get effective user ID", "i": "micro-behaviors/os/privilege/query::geteuid", "o": 14275, "z": 7, "cf": 0.5 }, { "c": 2, "d": "cap_get_proc function", "i": "micro-behaviors/os/security/capabilities::cap-get-proc", "o": 14283, "z": 12, "cf": 0.75 }, { "c": 2, "d": "cap_set_proc function", "i": "micro-behaviors/os/security/capabilities::cap-set-proc", "o": 14319, "z": 12, "cf": 0.75 }, { "c": 2, "d": "Query system configuration information", "i": "micro-behaviors/os/sysinfo/config::sysconf", "o": 14228, "z": 7, "cf": 0.4000000059604645 }, { "c": 2, "d": "localtime function (string)", "i": "micro-behaviors/time/query::localtime-string", "o": 14251, "z": 8, "cf": 0.20000000298023224 } ], "ln": 14172 }, { "b": "B98CjB8V0%B98Cyv}Y(.x(mH7uV6$7z#:@\u003cBzbPlBy/ui0crl)z/{d4xjVf#z/Z2fD0$k]ASxY=y?mH50blH.BAz^dB98CjxMw0kyYFS\u003cAb]VgBy\u003eI!zE)]%Acc2o0b#H\u0026A=k%#B98CmBzkP60ax}/A+PAkw=M)-zE^Q9x8)0:BAqwgyJ1fl0cr6*yH}O/vRGZ\u003c0b2\u003e+B8LM7zEEx[0a{m.vpPvIwP8eXw]}Q2yYF6UA=M8s0bl4Lx(mD)CYW\u003ewvqPMQx\u003eyZ\u0026vqPN$z!T91wQ1h(zFSV*BAzLgxjVf(BU+=MzeKe%zFTfhxj2p.Byb", "n": [ { "c": 3, "d": "Parse IP with inet_ntop", "i": "micro-behaviors/communications/ip/parse::inet-ntop-symbol", "o": 14408, "z": 9, "cf": 0.6600000262260437 }, { "c": 3, "d": "Parse IP with inet_pton", "i": "micro-behaviors/communications/ip/parse::inet-pton-symbol", "o": 14483, "z": 9, "cf": 0.6600000262260437 }, { "c": 3, "d": "Resolve address with gethostbyaddr", "i": "micro-behaviors/communications/ip/resolve::resolve-gethostbyaddr", "o": 14436, "z": 13, "cf": 0.6600000262260437 }, { "c": 3, "d": "Bind socket to address", "i": "micro-behaviors/communications/socket/bind/function::bind", "o": 14544, "z": 4, "cf": 0.75 }, { "c": 3, "d": "Looks up name with if_indextoname", "i": "micro-behaviors/communications/socket/interface::if-indextoname-symbol", "o": 14585, "z": 14, "cf": 0.699999988079071 }, { "c": 3, "d": "Looks up index with if_nametoindex", "i": "micro-behaviors/communications/socket/interface::if-nametoindex-symbol", "o": 14600, "z": 14, "cf": 0.699999988079071 }, { "c": 3, "d": "Set socket options", "i": "micro-behaviors/communications/socket/options::options-set", "o": 14526, "z": 10, "cf": 0.6600000262260437 }, { "c": 3, "d": "Uses sendmsg socket call", "i": "micro-behaviors/communications/socket/send::sendmsg-symbol", "o": 14518, "z": 7, "cf": 0.6600000262260437 }, { "c": 3, "d": "Socket API symbol text", "i": "micro-behaviors/communications/socket/tcp::socket-symbol-text", "o": 14537, "z": 6, "cf": 0.75 }, { "c": 2, "d": "Read stream (fread)", "i": "micro-behaviors/fs/file/read::fread", "o": 14561, "z": 5, "cf": 0.699999988079071 }, { "c": 2, "d": "Detect if running in terminal (isatty)", "i": "micro-behaviors/process/tty/terminal::isatty", "o": 14457, "z": 6, "cf": 0.5 }, { "c": 2, "d": "Format time as string", "i": "micro-behaviors/time/query::strftime", "o": 14500, "z": 8, "cf": 0.20000000298023224 } ], "ln": 14392 }, { "b": "e]$}-g5#c8vQ?3cB-RvJCSmP*hz^4cz.r:AA==hnuU1j/A9)Grve%}KByeD!wo6EY0b.", "n": [ { "c": 2, "d": "x86_64 architecture string", "i": "micro-behaviors/os/sysinfo/platform/string::arch-x86-64", "o": 14802, "z": 6, "cf": 0.30000001192092896 } ], "ln": 14786 }, { "b": "zGGk}z!%ujuVZC\u003exjVf(BzkP60cig0y*R0)zFJ^9ze-\u003c5wPq6?x(4)5ASyc4zFSV\u003c", "n": [ { "c": 2, "d": "Get current calendar time (seconds)", "i": "micro-behaviors/time/query::time", "o": 15405, "z": 4, "cf": 0.30000001192092896 } ], "ln": 15389 }, { "b": "z/f=aAb]JiBA)\u003ebBz+]4B7Gl10cig0y*QZ]w[+*)wm5+2zuarXByffdB7]o8wN\u003e^W", "n": [ { "c": 3, "d": "Uses _send socket call", "i": "micro-behaviors/communications/socket/send::_send-symbol", "o": 18331, "z": 4, "cf": 0.6600000262260437 } ], "ln": 18315 }, { "b": "002Mx-1lcUl0MYYl0?Es1R?1q555\u003ck^St?iZ-=nG-@TMM[54B\u003enS0ypIt6qnnS07tnqU\u003e}qu4v\u003eR#", "n": [ { "c": 1, "d": "DJB2 hash algorithm constant (5381)", "i": "objectives/anti-static/obfuscation/imports::djb2-hash-constant", "o": 42784, "z": 11, "cf": 0.75 }, { "c": 1, "d": "DJB2 hash multiply-by-33 instruction", "i": "objectives/anti-static/obfuscation/imports::djb2-multiply-33", "o": 42795, "z": 2, "cf": 0.699999988079071 } ], "ln": 42768 }, { "b": "00000000000000000000rDzOYwJy@OBzU@lax]%:p/H1Zpe-ovazbt7wGTDloHQ7dayP85aBCqclp%Wlr8T]B3qTF$nL-8WauzUdDMT[Ltvzw.y\u003cxqeDMW3uwPP5xazC.8Bt+m?az++fyAO0ExK#10aBLwW3lQDlarR^HarR^HarSl)aBCp-hxWw\u0026eIFq{at3R#wPz\u003caz/e\u00266Ef@+pn\u003c#9DqY[a:", "n": [ { "c": 3, "d": "Terminal socket exec helper context", "i": "micro-behaviors/process/fd/dup::unix-terminal-socket-exec-benign-context", "o": 61440, "z": 128, "cf": 0.949999988079071 } ], "ln": 61424 }, { "b": "A=k$VazbLjaz2CjA^m#(fj/lnfkkxCz/{ekgb0oXz/{10flItRflp/nA+c[rAb](tBy^iXxl4{kz#.L5ByM$rAb](tBy^iXA=+Vfv@Dr$A@W\u003eoB8\u0026{PxKL{)fkkxCz/{ekgb0V\u0026uVPZ}AaK7\u003cfj/lnfkkxCz/{ekgb0V\u0026uVGZ^y\u0026aj[flItRflp/nA+c[rAb](tBy^iXA=+VewNPy(A@W\u003e8ByM$rAb](tBy^iXA=+V0B7Pb$y?9J0B-RNRB7/05wIm-", "n": [ { "c": 2, "d": "Reference to /etc configuration files", "i": "micro-behaviors/fs/path/config/system::config-etc", "o": 61974, "z": 5, "cf": 0.6600000262260437 } ], "ln": 61958 }, { "b": "B-.gIflhewwohu%wO+(Sfj/lnfkkxCz/{ekgb0JYuVp47Bz(j2flItRflp/nA+c[rz#", "n": [ { "c": 2, "d": "Reference to /etc configuration files", "i": "micro-behaviors/fs/path/config/system::config-etc", "o": 62184, "z": 5, "cf": 0.6600000262260437 } ], "ln": 62168 }, { "b": "flp/nA+c[rAb](tBy^icfj/lnfkkxCz/{ekg5@$sByM$rAb](tBy^iXA=+VcA=l5rA@W\u003eoB8\u0026{PxKL{)fkkw", "n": [ { "c": 2, "d": "Reference to /etc configuration files", "i": "micro-behaviors/fs/path/config/system::config-etc", "o": 62264, "z": 5, "cf": 0.6600000262260437 } ], "ln": 62248 }, { "b": "Bz(j2A=+VcA=l5rB1Q#6fj/lnfkkxCz/{ekgb0V\u0026uTWFQA=u5qBz(j2flItRflp/nAS", "n": [ { "c": 2, "d": "Reference to /etc configuration files", "i": "micro-behaviors/fs/path/config/system::config-etc", "o": 62344, "z": 5, "cf": 0.6600000262260437 } ], "ln": 62328 }, { "b": "qC{p*aARTDzEW9%wN(bFflqzWfjO*bB8%0LwPPNKB1X?X0aP}\u0026y?aVaz/^ahB.LV5aAg+hxL}l}wGUN", "n": [ { "c": 2, "d": "/sys/class/net/ path", "i": "micro-behaviors/os/network/interface::sys-class-net", "o": 62727, "z": 15, "cf": 0.5 } ], "ln": 62711 }, { "b": "x(mH70blsZBt:boAboN}vSDf[xjR6ckr/ce03#\u003eoA@YC\u003efF^RErb3hXB97\u0026cA5]9/B07", "n": [ { "c": 1, "d": "bridge interface", "i": "micro-behaviors/os/container/namespace::bridge-str", "o": 63205, "z": 6, "cf": 1.0 } ], "ln": 63189 }, { "b": "By^7qzGNNvB.LV5eOO.}e[]iBwPz.\u0026e[Y6Ae[!WmxAfU}D2vXGz2=h0D2vXBASv.8zGNNPwPz\u003caz/bLcxkR\u0026AC4CYnx(v(@ASv.jwD", "n": [ { "c": 2, "d": "ELF dynstr section name", "i": "metadata/binary/linking/static::elf-dynstr-section-name", "o": 98567, "z": 7, "cf": 0.8999999761581421 }, { "c": 2, "d": "ELF dynsym section name", "i": "metadata/binary/linking/static::elf-dynsym-section-name", "o": 98559, "z": 7, "cf": 0.8999999761581421 }, { "c": 2, "d": "ELF interpreter section name", "i": "metadata/binary/linking/static::elf-interpreter-section-name", "o": 98541, "z": 7, "cf": 0.8999999761581421 } ], "ln": 98525 }, { "b": "vr?\u00269wmoN*e]\u003eJte]\u003e\u003ege[xlBvqPZ*04}]5Bo0}7vrt]Te[e)y04}=1zeA\u003c4Bn#pv00000", "n": [ { "c": 2, "d": "ELF dynamic section name", "i": "metadata/binary/linking/static::elf-dynamic-section-name", "o": 98720, "z": 8, "cf": 0.8999999761581421 } ], "ln": 98704 } ], "depth": 1, "facts": { "exp": [ [ "use_iec" ], [ "addattr_nest_compat" ], [ "rtnl_rtprot_a2n" ], [ "stdin" ], [ "family_name" ], [ "jsonw_s64" ], [ "timestamp_short" ], [ "read_prop" ], [ "get_be16" ], [ "jsonw_hhu_field" ], [ "rtnl_open" ], [ "ll_addr_a2n" ], [ "protodown_reason_n2a" ], [ "addattr16" ], [ "iproute2_hz_internal" ], [ "addattr_nest_end" ], [ "print_color_hu" ], [ "rtnl_linkdump_req_filter_fn" ], [ "parse_rtattr" ], [ "addattr" ], [ "new_json_obj" ], [ "addr64_n2a" ], [ "mask2bits" ], [ "rtnl_addrlbldump_req" ], [ "rt_addr_n2a_r" ], [ "print_escape_buf" ], [ "jsonw_new" ], [ "duparg" ], [ "sprint_time" ], [ "rtnl_tunneldump_req" ], [ "jsonw_xint_field" ], [ "ll_name_to_index" ], [ "get_addr" ], [ "get_hz" ], [ "delete_json_obj_plain" ], [ "inc_indent" ], [ "addattr8" ], [ "rtnl_mdbdump_req" ], [ "rta_nest" ], [ "rtnl_dscp_a2n" ], [ "get_be32" ], [ "rta_addattr64" ], [ "rtnl_add_nl_group" ], [ "resolve_hosts" ], [ "addattr32" ], [ "print_color_lluint" ], [ "get_u16" ], [ "get_float" ], [ "rtnl_listen" ], [ "color_fprintf" ], [ "rtnl_addrprot_a2n" ], [ "stdout" ], [ "matches_color" ], [ "print_name_and_link" ], [ "namehash" ], [ "print_nlmsg_timestamp" ], [ "jsonw_destroy" ], [ "proto_a2n" ], [ "close_json_array" ], [ "nl_dump_ext_ack" ], [ "str_to_bool" ], [ "print_nl" ], [ "rtnl_open_byproto" ], [ "jsonw_u64_field" ], [ "parse_rtattr_one" ], [ "jsonw_int_field" ], [ "rtnl_group_n2a" ], [ "inet_addr_match" ], [ "parse_mapping_gen" ], [ "nodev" ], [ "nl_proto_n2a" ], [ "print_color_int" ], [ "rta_nest_end" ], [ "get_addr32" ], [ "rtnl_statsdump_req_filter" ], [ "print_color_string" ], [ "str_map_lookup_u8" ], [ "jsonw_null" ], [ "print_color_0xhex" ], [ "invarg" ], [ "rtnl_routedump_req" ], [ "stderr" ], [ "get_u32" ], [ "rtnl_send" ], [ "open_fds_close" ], [ "mpls_ntop" ], [ "rtnl_send_check" ], [ "format_host_r" ], [ "numeric" ], [ "close_json_object" ], [ "check_ifname" ], [ "print_timestamp" ], [ "rtnl_nsiddump_req_filter_fn" ], [ "hexstring_n2a" ], [ "print_color_null" ], [ "get_time64" ], [ "get_user_hz" ], [ "rtnl_rtrealm_a2n" ], [ "jsonw_float" ], [ "get_s32" ], [ "get_be64" ], [ "rtnl_dsfield_n2a" ], [ "rtnl_rttable_n2a" ], [ "default_color_opt" ], [ "addattr64" ], [ "parse_on_off" ], [ "jsonw_string_field" ], [ "jsonw_bool" ], [ "parse_mapping" ], [ "rtnl_rtscope_n2a" ], [ "ll_init_map" ], [ "ll_index_to_name" ], [ "cmdlineno" ], [ "jsonw_uint_field" ], [ "print_uint_name_value" ], [ "jsonw_pretty" ], [ "rtnl_talk" ], [ "ll_index_to_flags" ], [ "print_indent" ], [ "print_color_on_off" ], [ "iproute2_user_hz_internal" ], [ "get_integer" ], [ "print_color_bool" ], [ "nl_dump_ext_ack_done" ], [ "protodown_reason_a2n" ], [ "get_addr64" ], [ "jsonw_hhu" ], [ "int_to_str" ], [ "jsonw_uint" ], [ "rtnl_brvlandump_req" ], [ "get_unsigned" ], [ "print_color_u64" ], [ "start" ], [ "get_time" ], [ "addattr_nest_compat_end" ], [ "get_u64" ], [ "rtnl_linkdump_req" ], [ "init" ], [ "rtnl_dump_filter_errhndlr_nc" ], [ "af_bit_len" ], [ "get_u8" ], [ "mpls_pton" ], [ "print_color_uint" ], [ "get_prefix" ], [ "print_color_s64" ], [ "human_readable" ], [ "ll_index_to_type" ], [ "get_s64" ], [ "oper_state_color" ], [ "jsonw_null_field" ], [ "new_json_obj_plain" ], [ "parse_one_of_deprecated" ], [ "jsonw_luint_field" ], [ "get_long" ], [ "jsonw_bool_field" ], [ "rtnl_neightbldump_req" ], [ "get_guid" ], [ "rtnl_dsfield_get_name" ], [ "print_string_name_value" ], [ "print_num" ], [ "fini" ], [ "main" ], [ "print_color_float" ], [ "open_json_object" ], [ "rtnl_group_a2n" ], [ "duparg2" ], [ "hex2mem" ], [ "free_indent_mem" ], [ "nl_proto_a2n" ], [ "drop_cap" ], [ "get_addr_rta" ], [ "rtnl_rtprot_n2a" ], [ "jsonw_luint" ], [ "delete_json_obj" ], [ "format_host" ], [ "rtnl_echo_talk" ], [ "check_enable_color" ], [ "jsonw_hu" ], [ "alloc_indent_mem" ], [ "ll_addr_n2a" ], [ "ll_idx_n2a" ], [ "jsonw_end_array" ], [ "rtnl_fdb_linkdump_req_filter_fn" ], [ "print_color_bool_opt" ], [ "hexstring_a2n" ], [ "rta_addattr_l" ], [ "jsonw_lluint" ], [ "rtnl_dsfield_a2n" ], [ "rtnl_rttable_a2n" ], [ "dec_indent" ], [ "rtnl_close" ], [ "ll_drop_by_index" ], [ "get_ifname" ], [ "print_range" ], [ "str_map_lookup_u16" ], [ "jsonw_start_object" ], [ "ll_remember_index" ], [ "print_color_rate" ], [ "print_color_hex" ], [ "rtnl_rtscope_a2n" ], [ "jsonw_xint" ], [ "do_batch" ], [ "jsonw_end_object" ], [ "get_float_min_max" ], [ "missarg" ], [ "jsonw_int" ], [ "jsonw_lluint_field" ], [ "SL_" ], [ "incomplete_command" ], [ "parse_rtattr_flags" ], [ "rtnl_dscp_n2a" ], [ "open_json_array" ], [ "get_real_family" ], [ "rtnl_set_strict_dump" ], [ "print_color_tv" ], [ "addattr_nest" ], [ "jsonw_string" ], [ "rtnl_addrprot_n2a" ], [ "rtnl_nexthopdump_req" ], [ "rtnl_listen_all_nsid" ], [ "parse_mapping_num_all" ], [ "get_prefix_1" ], [ "ifa_family_color" ], [ "proto_n2a" ], [ "rtnl_dump_request" ], [ "check_altifname" ], [ "open_fds_add" ], [ "rtnl_nexthop_bucket_dump_req" ], [ "get_time_rtt" ], [ "jsonw_name" ], [ "rtnl_talk_suppress_rtnl_errmsg" ], [ "jsonw_hu_field" ], [ "jsonw_s64_field" ], [ "sprint_time64" ], [ "rta_addattr16" ], [ "inet_addr_match_rta" ], [ "parse_rtattr_nested_compat" ], [ "rtnl_linkdump_req_filter" ], [ "uint_to_str" ], [ "get_addr_1" ], [ "rtnl_neighdump_req" ], [ "rta_addattr8" ], [ "get_str_char_count" ], [ "str_map_lookup_uint" ], [ "addattrstrz" ], [ "str_map_lookup_str" ], [ "addattr_l" ], [ "rt_addr_n2a" ], [ "jsonw_float_field" ], [ "is_json_context" ], [ "get_ifname_rta" ], [ "print_color_luint" ], [ "print_color_hhu" ], [ "get_rtnl_link_stats_rta" ], [ "rtnl_netconfdump_req" ], [ "rtnl_from_file" ], [ "jsonw_printf" ], [ "read_family" ], [ "pretty" ], [ "generic_proc_open" ], [ "parse_one_of" ], [ "rtnl_dump_filter_nc" ], [ "get_json_writer" ], [ "matches" ], [ "rtnl_rtrealm_n2a" ], [ "jsonw_start_array" ], [ "rta_addattr32" ], [ "jsonw_u64" ], [ "str_split_by_char" ], [ "addraw_l" ], [ "rtnl_addrdump_req" ], [ "rcvbuf" ], [ "rtnl_ruledump_req" ], [ "rtnl_dump_request_n" ] ], "imp": [ [ "", "putchar" ], [ "", "strcpy" ], [ "", "asctime" ], [ "", "if_indextoname" ], [ "", "cap_get_flag" ], [ "", "printf" ], [ "", "sysconf" ], [ "", "cap_clear" ], [ "", "sethostent" ], [ "", "recv" ], [ "", "strerror" ], [ "", "geteuid" ], [ "", "inet_pton" ], [ "", "snprintf" ], [ "", "getenv" ], [ "", "mnl_attr_parse" ], [ "", "fscanf" ], [ "", "fgets" ], [ "", "perror" ], [ "", "cxa_finalize" ], [ "", "getuid" ], [ "", "feof" ], [ "", "malloc" ], [ "", "isatty" ], [ "", "strtoll" ], [ "", "strtoul" ], [ "", "gethostbyaddr" ], [ "", "socket" ], [ "", "readdir" ], [ "", "mnl_attr_get_type" ], [ "", "fflush" ], [ "", "send" ], [ "", "stack_chk_fail" ], [ "", "strtol" ], [ "", "strnlen" ], [ "", "strrchr" ], [ "", "cap_get_proc" ], [ "", "strtod" ], [ "", "fprintf" ], [ "", "strcat" ], [ "", "bind" ], [ "", "ntohl" ], [ "", "if_nametoindex" ], [ "", "deregister_frame_info" ], [ "", "mnl_nlmsg_get_payload_len" ], [ "", "setsockopt" ], [ "", "mnl_attr_type_valid" ], [ "", "ITM_registerTMCloneTable" ], [ "", "mnl_attr_get_u32" ], [ "", "lstat" ], [ "", "ferror" ], [ "", "strstr" ], [ "", "sendmsg" ], [ "", "cap_set_proc" ], [ "", "strncpy" ], [ "", "strcasecmp" ], [ "", "htonl" ], [ "", "realloc" ], [ "", "mnl_nlmsg_get_payload" ], [ "", "memcmp" ], [ "", "sscanf" ], [ "", "fread" ], [ "", "ITM_deregisterTMCloneTable" ], [ "", "strdup" ], [ "", "strtoull" ], [ "", "gettimeofday" ], [ "", "mnl_attr_validate" ], [ "", "fopen" ], [ "", "localtime" ], [ "", "ftell" ], [ "", "fclose" ], [ "", "ntohs" ], [ "", "time" ], [ "", "opendir" ], [ "", "assert_fail" ], [ "", "mnl_attr_get_str" ], [ "", "putc" ], [ "", "strcmp" ], [ "", "sprintf" ], [ "", "asprintf" ], [ "", "strtof" ], [ "", "strcspn" ], [ "", "fputc" ], [ "", "strftime" ], [ "", "fwrite" ], [ "", "htons" ], [ "", "freopen" ], [ "", "errno_location" ], [ "", "exit" ], [ "", "inet_ntop" ], [ "", "atoi" ], [ "", "fileno" ], [ "", "getline" ], [ "", "strspn" ], [ "", "libc_start_main" ], [ "", "strlen" ], [ "", "cap_free" ], [ "", "strchr" ], [ "", "fputs" ], [ "", "closedir" ], [ "", "recvmsg" ], [ "", "strchrnul" ], [ "", "register_frame_info" ], [ "", "close" ], [ "", "vfprintf" ], [ "", "free" ], [ "", "getsockname" ] ], "sec": [ [ ".note.gnu.property", 792, 48, 1.94, "alloc" ], [ ".note.gnu.build-id", 840, 36, 4.19, "alloc" ], [ ".interp", 876, 25, 4.05, "alloc" ], [ ".gnu.hash", 904, 3588, 4.53, "alloc" ], [ ".dynsym", 4496, 9240, 2.37, "alloc" ], [ ".dynstr", 13736, 5025, 4.42, "alloc" ], [ ".gnu.version", 18762, 770, 1.07, "alloc" ], [ ".gnu.version_r", 19536, 32, 2.17, "alloc" ], [ ".rela.dyn", 19568, 2616, 1.76, "alloc" ], [ ".rela.plt", 22184, 24, 1.22, "alloc,info_link" ], [ ".relr.dyn", 22208, 120, 2.58, "alloc" ], [ ".init", 24576, 3, 1.58, "alloc,executable" ], [ ".plt", 24592, 32, 3.05, "alloc,executable" ], [ ".text", 24624, 36389, 6.24, "alloc,executable" ], [ ".fini", 61013, 3, 1.58, "alloc,executable" ], [ ".rodata", 61440, 4592, 5.22, "alloc" ], [ ".eh_frame_hdr", 66032, 2444, 5.27, "alloc" ], [ ".eh_frame", 68480, 11616, 4.89, "alloc" ], [ ".init_array", 80144, 8, 1.06, "write,alloc" ], [ ".fini_array", 80152, 8, 1.06, "write,alloc" ], [ ".data.rel.ro", 80160, 280, 1.67, "write,alloc" ], [ ".dynamic", 80440, 576, 1.51, "write,alloc" ], [ ".got", 81016, 880, 0.06, "write,alloc" ], [ ".data", 81920, 16544, 0.1, "write,alloc" ], [ ".comment", 98464, 28, 3.99, "merge,strings" ], [ ".shstrtab", 98492, 262, 4.18, "" ] ], "metrics": { "elf": { "bits": 64.0, "entry": 25623.0, "has_got": 1.0, "has_plt": 1.0, "has_note": 1.0, "note_count": 2.0, "nx_enabled": 1.0, "has_dt_relr": 1.0, "dynrel_count": 0.0, "dynsym_count": 385.0, "has_build_id": 1.0, "has_eh_frame": 1.0, "has_gnu_hash": 1.0, "stack_canary": 1.0, "symtab_count": 0.0, "dynrela_count": 109.0, "little_endian": 1.0, "dt_flags_1_raw": 134217729.0, "pltreloc_count": 1.0, "build_id_length": 20.0, "dt_versym_count": 385.0, "executable_stack": 0.0, "fini_array_count": 1.0, "init_array_count": 1.0, "wx_segment_count": 0.0, "comment_entry_count": 1.0, "program_header_count": 13.0, "comment_distinct_count": 1.0, "gnu_stack_section_absent": 0.0, "load_segment_max_file_size": 36440.0, "stripped_but_symtab_present": 0.0, "load_segment_max_memory_size": 38032.0, "section_relocation_group_count": 2.0, "stripped_metadata_section_count": 7.0 }, "file": { "size": 100552.0, "entropy": 4.88, "size_bytes": 100552.0 }, "binary": { "is_pie": 1.0, "has_overlay": 1.0, "is_stripped": 1.0, "code_entropy": 6.24, "data_entropy": 0.17, "overlay_size": 1798.0, "string_count": 562.0, "overlay_ratio": 0.02, "overall_entropy": 4.88, "overlay_entropy": 1.53, "entropy_variance": 2.9, "avg_string_length": 15.37, "max_string_length": 191.0, "peak_region_bytes": 10240.0, "code_to_data_ratio": 0.67, "peak_region_entropy": 6.53, "string_length_stddev": 13.02, "largest_section_ratio": 0.36, "sentence_string_count": 64.0, "sentence_string_ratio": 0.11, "high_entropy_string_count": 0.0 }, "exports": { "count": 274.0 }, "imports": { "count": 107.0 }, "sections": { "count": 28.0, "code_size": 36427.0, "entropy_max": 6.24, "entropy_mean": 2.76, "name_entropy": 4.13, "writable_count": 7.0, "executable_count": 4.0, "nonstandard_count": 6.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 3.0 } } }, "id": 1, "mol": "O(Er)H₃(Cm₈FPo)", "path": "iproute2-7.1.0-r0.apk!!sbin/rtmon", "risk": 5, "sha": "28b40eb5f2964268186fae1dee3acb405c5e83452dfb3003b1e3ae1bda09174d", "size": 100552, "traits": [ { "id": "micro-behaviors/fs/file/read::fscanf", "conf": 0.699999988079071, "crit": 2, "desc": "Formatted input from file", "spans": [ [ 14003, 6 ] ] }, { "id": "micro-behaviors/fs/directory/readdir::readdir-readdir", "conf": 0.6600000262260437, "crit": 2, "desc": "Uses readdir", "spans": [ [ 14052, 7 ] ] }, { "id": "micro-behaviors/communications/socket/bind/function::bind", "conf": 0.75, "crit": 3, "desc": "Bind socket to address", "spans": [ [ 14544, 4 ] ] }, { "id": "micro-behaviors/communications/ip/resolve::resolve-gethostbyaddr", "conf": 0.6600000262260437, "crit": 3, "desc": "Resolve address with gethostbyaddr", "spans": [ [ 14436, 13 ] ] }, { "id": "micro-behaviors/communications/ip/parse::inet-ntop-symbol", "conf": 0.6600000262260437, "crit": 3, "desc": "Parse IP with inet_ntop", "spans": [ [ 14408, 9 ] ] }, { "id": "micro-behaviors/ui/help::usage-title", "crit": 2, "desc": "Usage: label (title case)", "spans": [ [ 61440, 128 ] ] }, { "id": "micro-behaviors/dylib/library/libc::libc-characteristic-cxa-finalize", "crit": 2, "desc": "libc characteristic cxa finalize", "spans": [ [ 13739, 12 ] ] }, { "id": "micro-behaviors/fs/file/open::fopen", "conf": 0.6600000262260437, "crit": 3, "desc": "Open files", "spans": [ [ 13997, 5 ] ] }, { "id": "micro-behaviors/ui/help::usage-title-string", "crit": 1, "desc": "Usage: label in binary strings", "spans": [ [ 61440, 128 ] ] }, { "id": "micro-behaviors/communications/ip/parse::ntohl-symbol", "conf": 0.6600000262260437, "crit": 3, "desc": "Converts network to host long", "spans": [ [ 13944, 5 ] ] }, { "id": "micro-behaviors/communications/ip/parse::inet-pton-symbol", "conf": 0.6600000262260437, "crit": 3, "desc": "Parse IP with inet_pton", "spans": [ [ 14483, 9 ] ] }, { "id": "micro-behaviors/communications/socket/receive::_recv-symbol", "atk": "T1071", "mbc": "C0001", "conf": 0.6600000262260437, "crit": 3, "desc": "Uses _recv socket call", "spans": [ [ 14119, 4 ] ] }, { "id": "micro-behaviors/fs/directory/readdir::readdir-opendir", "conf": 0.6600000262260437, "crit": 2, "desc": "Uses opendir", "spans": [ [ 14044, 7 ] ] }, { "id": "micro-behaviors/fs/file/write/direct::write--fwrite", "conf": 0.6600000262260437, "crit": 2, "desc": "Write files (fwrite)", "spans": [ [ 13895, 6 ] ] }, { "id": "metadata/binary/metrics/threshold::many-imports-50", "conf": 1.0, "crit": 1, "desc": "Binary has 50+ imports", "spans": [ [ 0, 22 ] ] }, { "id": "micro-behaviors/communications/socket/receive::recv-symbol", "atk": "T1071", "mbc": "C0001", "conf": 0.6600000262260437, "crit": 3, "desc": "Uses recv socket call", "spans": [ [ 14119, 4 ] ] }, { "id": "micro-behaviors/os/privilege/query::getuid", "crit": 2, "desc": "Get user ID", "spans": [ [ 14268, 6 ] ] }, { "id": "micro-behaviors/communications/socket/interface::if-nametoindex-symbol", "conf": 0.699999988079071, "crit": 3, "desc": "Looks up index with if_nametoindex", "spans": [ [ 14600, 14 ] ] }, { "id": "micro-behaviors/fs/file/read::fread", "conf": 0.699999988079071, "crit": 2, "desc": "Read stream (fread)", "spans": [ [ 14561, 5 ] ] }, { "id": "micro-behaviors/communications/socket/interface::if-indextoname-symbol", "conf": 0.699999988079071, "crit": 3, "desc": "Looks up name with if_indextoname", "spans": [ [ 14585, 14 ] ] }, { "id": "micro-behaviors/communications/socket/tcp::socket-symbol-text", "conf": 0.75, "crit": 3, "desc": "Socket API symbol text", "spans": [ [ 14537, 6 ] ] }, { "id": "micro-behaviors/communications/socket/options::options-set", "conf": 0.6600000262260437, "crit": 3, "desc": "Set socket options", "spans": [ [ 14526, 10 ] ] }, { "id": "micro-behaviors/fs/file/read::fread-text", "conf": 0.6200000047683716, "crit": 2, "desc": "fread API string", "spans": [ [ 14561, 5 ] ] }, { "id": "micro-behaviors/communications/ip/parse::ntohs-symbol", "conf": 0.6600000262260437, "crit": 3, "desc": "Converts network to host short", "spans": [ [ 14236, 5 ] ] }, { "id": "micro-behaviors/os/privilege/query::geteuid", "crit": 2, "desc": "Get effective user ID", "spans": [ [ 14275, 7 ] ] }, { "id": "micro-behaviors/fs/directory/readdir::readdir-closedir", "conf": 0.6600000262260437, "crit": 2, "desc": "Uses closedir", "spans": [ [ 14073, 8 ] ] }, { "id": "micro-behaviors/communications/ip/parse::htonl-symbol", "conf": 0.6600000262260437, "crit": 3, "desc": "Converts host to network long", "spans": [ [ 14188, 5 ] ] }, { "id": "micro-behaviors/process/fd/stdio::freopen-import", "conf": 0.699999988079071, "crit": 3, "desc": "freopen stream redirection import", "spans": [ [ 14347, 7 ] ] }, { "id": "micro-behaviors/communications/ip/parse::htons-symbol", "conf": 0.6600000262260437, "crit": 3, "desc": "Converts host to network short", "spans": [ [ 14194, 5 ] ] }, { "id": "objectives/evasion/process/injection/memory::asm-manual-import-parsing-cond-2--inline-18287", "conf": 0.8999999761581421, "crit": 3, "desc": "High export-count binary context", "spans": [ [ 0, 22 ] ] }, { "id": "micro-behaviors/communications/socket/send::sendmsg-symbol", "atk": "T1071", "mbc": "C0001", "conf": 0.6600000262260437, "crit": 3, "desc": "Uses sendmsg socket call", "spans": [ [ 14518, 7 ] ] }, { "id": "micro-behaviors/communications/socket/send::send-symbol", "atk": "T1071", "mbc": "C0001", "conf": 0.6600000262260437, "crit": 3, "desc": "Uses send socket call", "spans": [ [ 18331, 4 ] ] }, { "id": "micro-behaviors/communications/socket/listen::socket-sym", "mbc": "C0001", "conf": 0.4000000059604645, "crit": 3, "desc": "socket function symbol", "spans": [ [ 14537, 6 ] ] }, { "id": "micro-behaviors/communications/socket/receive::recvmsg-symbol", "atk": "T1071", "mbc": "C0001", "conf": 0.6600000262260437, "crit": 3, "desc": "Uses recvmsg socket call", "spans": [ [ 14102, 7 ] ] }, { "id": "micro-behaviors/communications/socket/send::_send-symbol", "atk": "T1071", "mbc": "C0001", "conf": 0.6600000262260437, "crit": 3, "desc": "Uses _send socket call", "spans": [ [ 18331, 4 ] ] }, { "id": "micro-behaviors/fs/file/binary::file-read-operation", "atk": "T1005", "conf": 0.75, "crit": 1, "desc": "File read operation", "spans": [ [ 14003, 6 ], [ 14561, 5 ] ] }, { "id": "micro-behaviors/fs/file/write/direct::write", "conf": 0.6600000262260437, "crit": 2, "desc": "Write files", "spans": [ [ 13895, 6 ] ] }, { "id": "micro-behaviors/dylib/library/libc::libc-internal-functions-b", "conf": 0.699999988079071, "crit": 2, "desc": "libc internal symbols cluster B", "spans": [ [ 13739, 12 ] ] }, { "id": "micro-behaviors/ui/help::usage-label", "conf": 0.75, "crit": 1, "desc": "Command line usage text", "spans": [ [ 61440, 128 ] ] }, { "id": "micro-behaviors/dylib/library/abi-graphics::cxx-abi-symbols-a", "conf": 0.800000011920929, "crit": 2, "desc": "C++ ABI symbols cluster A", "spans": [ [ 13739, 12 ] ] } ], "type": "elf" }, { "ctx": [ { "b": "E))420S-r400000000000@$H+0rr91NjXEt00000kMy=:00000c%lJI0000000000kMA+z4f", "n": [ { "c": 3, "d": "No full symbol table (likely stripped)", "i": "metadata/hardening/missing::stripped-binary", "o": 0, "z": 25, "cf": 0.800000011920929 } ], "ln": 0 }, { "b": ")8(B-y?Wuiy?bbmB-RvJCSmP*hz^4cz.r:A000060000S000010000600000G-IeN1Zz", "n": [ { "c": 3, "d": "Architecture detection strings", "i": "objectives/discovery/host/software::arch-detection", "o": 889, "z": 6, "cf": 0.5 } ], "ln": 873 }, { "b": "0000000Ao400000003wkv%zA?w[=c\u003ey?Xib0af8zwPzu{x(!xcA:JB0vqPN.x(mK30aeq%o\u003c.{L", "n": [ { "c": 2, "d": "C++ standard library markers (libc++, libstdc++)", "i": "micro-behaviors/dylib/library/libc::cxx-stdlib-marker", "o": 2419, "z": 12, "cf": 0.8999999761581421 } ], "ln": 2403 }, { "b": "y?Wu*uVQr$A=+V9vqfPVxjVf@zGV23zG6SgzGGE\u003cuTE\u003e@vpK7Wv}YT+w)]y\u00260chTVwb]$zwPz*ez^Ns0v{%E[z/bL^CXIm1zeAZ20b#H\u0026A=k%#w]I^8zGGE\u003cw]zT1zua:0v{%m!0crm5woz?\u003ew[LW%A@Zo6A+]r80crm5v@MX[B97@7A=Id(v@c78wDlvOBn", "n": [ { "c": 4, "d": "Sets LD_PRELOAD hooks to hide filesystem", "i": "objectives/evasion/kernel-hide/userspace::preload-rootkit-hook-set", "o": 2642, "z": 5, "cf": 0.9200000166893005 }, { "c": 3, "d": "Stack protector/canary enabled", "i": "metadata/hardening/build::stack-protector", "o": 2580, "z": 14, "cf": 0.8999999761581421 }, { "c": 3, "d": "File content manipulation (read/write/seek)", "i": "micro-behaviors/fs/file/binary::file-manipulation", "o": 2595, "z": 4, "cf": 0.75 }, { "c": 2, "d": "Maps files or devices into memory", "i": "micro-behaviors/fs/memory/mmap::mmap", "o": 2622, "z": 4, "cf": 0.6600000262260437 }, { "c": 2, "d": "Environment variable access functions", "i": "micro-behaviors/os/env/vars/access::env-access-comp", "o": 2562, "z": 6, "cf": 0.4000000059604645 }, { "c": 2, "d": "Line-based file reading (fgets)", "i": "micro-behaviors/process/create/direct::fgets-loop", "o": 2662, "z": 5, "cf": 1.0 }, { "c": 2, "d": "Terminates process immediately without cleanup", "i": "micro-behaviors/process/terminate/signal::_exit", "o": 2617, "z": 4, "cf": 0.4000000059604645 } ], "ln": 2546 }, { "b": "0crm5v@le+B98CAz/]\u003c@xjVgcx\u003ediPCYiU7z!0M]Bo2=:zE---x(!xczuaiQwO(v60cq\u003c!zEEtYA:-\u0026@z/2F!wPR)9wb{mNBAzklwP8f\u003evr?\u0026(z!%j\u0026vpJ!UAc87(z/PQ[CxdztwDl{.x([rdwb{:\u0026y?W^50a{4=v}#6RB97\u0026j0a{pZvqYVSBzkP60aP}+zE)s10b2\u003e+B8LM7z/x^#B97@hB-WQ}Aclnj0bMvUv{%seB8JV^0bMvUv\u003eIRvB8iBMi5Ub4g+J\u0026/e?)ta09ALc0000000SA600961000000000000", "n": [ { "c": 4, "d": "Removes artifacts before memfd execution", "i": "objectives/evasion/fileless/memory::memfd-reexec-cleanup", "o": 2845, "z": 6, "cf": 0.9200000166893005 }, { "c": 3, "d": "Bind socket to address", "i": "micro-behaviors/communications/socket/bind/function::bind", "o": 2761, "z": 4, "cf": 0.75 }, { "c": 3, "d": "I/O multiplexing on sockets", "i": "micro-behaviors/communications/socket/multiplex::multiplex", "o": 2814, "z": 4, "cf": 0.6600000262260437 }, { "c": 3, "d": "Get socket options", "i": "micro-behaviors/communications/socket/options::options-get", "o": 2884, "z": 10, "cf": 0.6600000262260437 }, { "c": 3, "d": "Accept API symbol text", "i": "micro-behaviors/communications/socket/tcp::accept-symbol-text", "o": 2819, "z": 6, "cf": 0.75 }, { "c": 3, "d": "Connect API symbol text", "i": "micro-behaviors/communications/socket/tcp::connect-symbol-text", "o": 2876, "z": 7, "cf": 0.75 }, { "c": 3, "d": "Listen API symbol text", "i": "micro-behaviors/communications/socket/tcp::listen-symbol-text", "o": 2766, "z": 6, "cf": 0.75 }, { "c": 3, "d": "Socket API symbol text", "i": "micro-behaviors/communications/socket/tcp::socket-symbol-text", "o": 2754, "z": 6, "cf": 0.75 }, { "c": 3, "d": "Read file status and metadata (core)", "i": "micro-behaviors/fs/file/stat::stat-core", "o": 2858, "z": 5, "cf": 0.800000011920929 }, { "c": 3, "d": "Daemonize process", "i": "micro-behaviors/process/fork/clone::daemon-dup", "o": 2773, "z": 6, "cf": 0.6600000262260437 }, { "c": 3, "d": "POSIX user lookup functions", "i": "objectives/discovery/account/enum::passive-user-lookup", "o": 2743, "z": 6, "cf": 0.4000000059604645 }, { "c": 3, "d": "Benign network-capable library context", "i": "objectives/supply-chain/trojanized/backdoor::benign-network-library-context", "o": 2787, "z": 6, "cf": 0.8999999761581421 }, { "c": 2, "d": "Generic file read/write operations", "i": "micro-behaviors/fs/file/read-write::binary-file-ops", "o": 2864, "z": 6, "cf": 0.800000011920929 }, { "c": 2, "d": "Write single bytes to file", "i": "micro-behaviors/fs/file/write/direct::fputc", "o": 2902, "z": 5, "cf": 0.6600000262260437 }, { "c": 2, "d": "Write files (write)", "i": "micro-behaviors/fs/file/write/direct::write--write", "o": 2831, "z": 5, "cf": 0.6600000262260437 }, { "c": 2, "d": "Apply or remove advisory lock", "i": "micro-behaviors/fs/lock/flock::flock-fn", "o": 2852, "z": 5, "cf": 0.6600000262260437 }, { "c": 2, "d": "Install signal handler", "i": "micro-behaviors/os/signal/handler::signal", "o": 2780, "z": 6, "cf": 0.8999999761581421 }, { "c": 2, "d": "x86_64 architecture string", "i": "micro-behaviors/os/sysinfo/platform/string::arch-x86-64", "o": 2930, "z": 6, "cf": 0.30000001192092896 }, { "c": 2, "d": "Wait for child process state", "i": "micro-behaviors/process/control/wait::waitpid", "o": 2837, "z": 7, "cf": 0.6600000262260437 }, { "c": 2, "d": "Process forking", "i": "micro-behaviors/process/fork/clone::fork", "o": 2826, "z": 4, "cf": 0.6600000262260437 }, { "c": 2, "d": "Get process ID", "i": "micro-behaviors/process/identity/query::getpid", "o": 2794, "z": 6, "cf": 0.30000001192092896 }, { "c": 2, "d": "Get current calendar time (seconds)", "i": "micro-behaviors/time/query::time", "o": 2871, "z": 4, "cf": 0.30000001192092896 }, { "c": 2, "d": "Execution time measurement APIs", "i": "objectives/anti-analysis/timing/evasion::timing-measurement", "o": 2801, "z": 12, "cf": 0.4000000059604645 }, { "c": 1, "d": "libm exp import", "i": "micro-behaviors/dylib/library/libm::libm-exp-symbol", "o": 2750, "z": 3, "cf": 0.4000000059604645 } ], "ln": 2727 }, { "b": "Bt4VRuTWCOBo0Rdfc$VtfjXTqfkUoq0bVdSx\u003e5o7AaJ[!zdd6\u003ev\u003c2S9vq(h?b@48\u0026y\u0026@CL", "n": [ { "c": 3, "d": "Access raw system memory (/dev/mem)", "i": "micro-behaviors/mem/read/dump::dev-mem", "o": 16434, "z": 8, "cf": 0.8999999761581421 } ], "ln": 16418 }, { "b": "z/P(vAcbV4ayPvmc36y[fj/lnfkkxCz/{ekgb0V\u0026uVGZ^y\u0026aj[flItRflp/nA+c[rz#", "n": [ { "c": 2, "d": "Reference to /etc configuration files", "i": "micro-behaviors/fs/path/config/system::config-etc", "o": 16581, "z": 5, "cf": 0.6600000262260437 } ], "ln": 16565 }, { "b": "Ab](tBy^iVc36y[c2v/arDzOYwJy@OBywV?BrB^geOEv(r^F!7vrk%uBugKIax]%Zx(!w(w(rhGy\u0026akot)ZNBkxZ7NA.OPjvrk%uBufz6vrcm1zF80MA+eV}z2", "n": [ { "c": 3, "d": "Terminal socket exec helper context", "i": "micro-behaviors/process/fd/dup::unix-terminal-socket-exec-benign-context", "o": 16707, "z": 49, "cf": 0.949999988079071 } ], "ln": 16691 }, { "b": "08==ZlQK*Wnj=-VpF$r}flz5Ifd}o!vpJ!?e{eEJ0cif\u0026v}fQwaA8jgzxJRbB98tvC{3Zky?iP!Byt", "n": [ { "c": 3, "d": "Hidden file path in /tmp directory", "i": "micro-behaviors/fs/path/temp::tmp-hidden-file", "o": 16935, "z": 6, "cf": 0.75 } ], "ln": 16919 }, { "b": "By^7qzGNNvB.LV5eOO.}e[]iBwPz.\u0026e[Y6Ae[!WmxAfU}D2vXGz2=h0D2vXBASv.jwO+^cwo\u00264)e]\u003eJtvj(InBo0}lwO=xtwo\u00264)e=", "n": [ { "c": 2, "d": "ELF dynstr section name", "i": "metadata/binary/linking/static::elf-dynstr-section-name", "o": 22663, "z": 7, "cf": 0.8999999761581421 }, { "c": 2, "d": "ELF dynsym section name", "i": "metadata/binary/linking/static::elf-dynsym-section-name", "o": 22655, "z": 7, "cf": 0.8999999761581421 }, { "c": 2, "d": "ELF interpreter section name", "i": "metadata/binary/linking/static::elf-interpreter-section-name", "o": 22637, "z": 7, "cf": 0.8999999761581421 } ], "ln": 22621 }, { "b": "vr?\u00269wmoN*e]\u003eJte]\u003e\u003ege[xlBvqPZ*04}]5Bo0}7vrt]Te[e)y04}=1zeA\u003c4Bn#pv00000", "n": [ { "c": 2, "d": "ELF dynamic section name", "i": "metadata/binary/linking/static::elf-dynamic-section-name", "o": 22788, "z": 8, "cf": 0.8999999761581421 } ], "ln": 22772 } ], "depth": 1, "facts": { "exp": [ [ "stdout" ], [ "stderr" ], [ "optarg" ], [ "fini" ], [ "init" ], [ "optind" ] ], "imp": [ [ "", "strcpy" ], [ "", "waitpid" ], [ "", "printf" ], [ "", "random" ], [ "", "connect" ], [ "", "snprintf" ], [ "", "getenv" ], [ "", "getpid" ], [ "", "fscanf" ], [ "", "fgets" ], [ "", "perror" ], [ "", "cxa_finalize" ], [ "", "getuid" ], [ "", "strtoul" ], [ "", "socket" ], [ "", "mmap" ], [ "", "stack_chk_fail" ], [ "", "accept" ], [ "", "write" ], [ "", "fstat" ], [ "", "fprintf" ], [ "", "bind" ], [ "", "deregister_frame_info" ], [ "", "ITM_registerTMCloneTable" ], [ "", "flock" ], [ "", "signal" ], [ "", "read" ], [ "", "unlink" ], [ "", "listen" ], [ "", "fork" ], [ "", "sscanf" ], [ "", "ITM_deregisterTMCloneTable" ], [ "", "strdup" ], [ "", "gettimeofday" ], [ "", "fopen" ], [ "", "getopt" ], [ "", "fclose" ], [ "", "time" ], [ "", "poll" ], [ "", "exp" ], [ "", "strcmp" ], [ "", "fputc" ], [ "", "getsockopt" ], [ "", "errno_location" ], [ "", "exit" ], [ "", "atoi" ], [ "", "daemon" ], [ "", "libc_start_main" ], [ "", "strlen" ], [ "", "open" ], [ "", "fputs" ], [ "", "register_frame_info" ], [ "", "close" ] ], "sec": [ [ ".note.gnu.property", 792, 48, 1.94, "alloc" ], [ ".note.gnu.build-id", 840, 36, 4.19, "alloc" ], [ ".interp", 876, 25, 4.05, "alloc" ], [ ".gnu.hash", 904, 72, 3.57, "alloc" ], [ ".dynsym", 976, 1440, 1.07, "alloc" ], [ ".dynstr", 2416, 526, 4.46, "alloc" ], [ ".rela.dyn", 2944, 1344, 1.47, "alloc" ], [ ".rela.plt", 4288, 24, 0.98, "alloc,info_link" ], [ ".relr.dyn", 4312, 32, 1.18, "alloc" ], [ ".init", 8192, 3, 1.58, "alloc,executable" ], [ ".plt", 8208, 32, 3.05, "alloc,executable" ], [ ".text", 8240, 5850, 6.02, "alloc,executable" ], [ ".fini", 14090, 3, 1.58, "alloc,executable" ], [ ".rodata", 16384, 1112, 5.23, "alloc" ], [ ".eh_frame_hdr", 17496, 116, 3.85, "alloc" ], [ ".eh_frame", 17616, 624, 4.82, "alloc" ], [ ".init_array", 19472, 8, 1.06, "write,alloc" ], [ ".fini_array", 19480, 8, 1.06, "write,alloc" ], [ ".data.rel.ro", 19488, 24, 0.0, "write,alloc" ], [ ".dynamic", 19512, 512, 1.32, "write,alloc" ], [ ".got", 20024, 448, 0.09, "write,alloc" ], [ ".data", 20480, 2080, 0.02, "write,alloc" ], [ ".comment", 22560, 28, 3.99, "merge,strings" ], [ ".shstrtab", 22588, 234, 4.14, "" ] ], "metrics": { "elf": { "bits": 64.0, "entry": 11929.0, "has_got": 1.0, "has_plt": 1.0, "has_note": 1.0, "note_count": 2.0, "nx_enabled": 1.0, "has_dt_relr": 1.0, "dynrel_count": 0.0, "dynsym_count": 60.0, "has_build_id": 1.0, "has_eh_frame": 1.0, "has_gnu_hash": 1.0, "stack_canary": 1.0, "symtab_count": 0.0, "dynrela_count": 56.0, "little_endian": 1.0, "dt_flags_1_raw": 134217729.0, "pltreloc_count": 1.0, "build_id_length": 20.0, "executable_stack": 0.0, "fini_array_count": 1.0, "init_array_count": 1.0, "wx_segment_count": 0.0, "comment_entry_count": 1.0, "program_header_count": 13.0, "comment_distinct_count": 1.0, "gnu_stack_section_absent": 0.0, "load_segment_max_file_size": 5901.0, "stripped_but_symtab_present": 0.0, "load_segment_max_memory_size": 24200.0, "section_relocation_group_count": 2.0, "stripped_metadata_section_count": 7.0 }, "file": { "size": 24488.0, "entropy": 3.16, "size_bytes": 24488.0 }, "binary": { "is_pie": 1.0, "has_overlay": 1.0, "is_stripped": 1.0, "code_entropy": 6.0, "data_entropy": 0.25, "overlay_size": 1666.0, "string_count": 120.0, "overlay_ratio": 0.07, "overall_entropy": 3.16, "overlay_entropy": 1.38, "entropy_variance": 3.14, "avg_string_length": 12.49, "max_string_length": 78.0, "peak_region_bytes": 5120.0, "code_to_data_ratio": 0.66, "peak_region_entropy": 5.85, "string_length_stddev": 11.14, "largest_section_ratio": 0.24, "sentence_string_count": 14.0, "sentence_string_ratio": 0.12, "high_entropy_string_count": 0.0 }, "exports": { "count": 6.0 }, "imports": { "count": 53.0 }, "sections": { "count": 26.0, "code_size": 5888.0, "entropy_max": 6.02, "entropy_mean": 2.53, "name_entropy": 4.09, "writable_count": 7.0, "executable_count": 4.0, "nonstandard_count": 6.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 2.0 } } }, "id": 2, "mol": "H₃(Cm₅F₂Po)", "path": "iproute2-7.1.0-r0.apk!!sbin/rtacct", "risk": 4, "sha": "d8316e85b2843b3c0e6e7dacf447d5d894b90d6c1b779b8248f2023270d98b60", "size": 24488, "traits": [ { "id": "micro-behaviors/communications/socket/tcp::listen-symbol-text", "conf": 0.75, "crit": 3, "desc": "Listen API symbol text", "spans": [ [ 2766, 6 ] ] }, { "id": "micro-behaviors/fs/file/read::fscanf", "conf": 0.699999988079071, "crit": 2, "desc": "Formatted input from file", "spans": [ [ 2864, 6 ] ] }, { "id": "micro-behaviors/communications/socket/bind/function::bind", "conf": 0.75, "crit": 3, "desc": "Bind socket to address", "spans": [ [ 2761, 4 ] ] }, { "id": "micro-behaviors/ui/help::usage-title", "crit": 2, "desc": "Usage: label (title case)", "spans": [ [ 16707, 49 ] ] }, { "id": "micro-behaviors/fs/path/temp::tmp-path-content", "conf": 1.0, "crit": 2, "desc": "/tmp/ path component", "spans": [ [ 16935, 14 ] ] }, { "id": "micro-behaviors/dylib/library/libc::libc-characteristic-cxa-finalize", "crit": 2, "desc": "libc characteristic cxa finalize", "spans": [ [ 2419, 12 ] ] }, { "id": "micro-behaviors/fs/file/open::fopen", "conf": 0.6600000262260437, "crit": 3, "desc": "Open files", "spans": [ [ 2642, 5 ] ] }, { "id": "micro-behaviors/process/fork/clone::daemon-dup", "conf": 0.6600000262260437, "crit": 3, "desc": "Daemonize process", "spans": [ [ 2773, 6 ] ] }, { "id": "micro-behaviors/communications/socket/tcp::connect-symbol-text", "conf": 0.75, "crit": 3, "desc": "Connect API symbol text", "spans": [ [ 2876, 7 ] ] }, { "id": "micro-behaviors/communications/socket/tcp::accept-symbol-text", "conf": 0.75, "crit": 3, "desc": "Accept API symbol text", "spans": [ [ 2819, 6 ] ] }, { "id": "micro-behaviors/ui/help::usage-title-string", "crit": 1, "desc": "Usage: label in binary strings", "spans": [ [ 16707, 49 ] ] }, { "id": "micro-behaviors/fs/path/temp::hidden-tmp-path", "conf": 1.0, "crit": 2, "desc": "Hidden path prefix in /tmp", "spans": [ [ 16935, 6 ] ] }, { "id": "micro-behaviors/communications/socket/multiplex::poll-multiplex", "crit": 3, "desc": "poll() I/O multiplexing", "spans": [ [ 2814, 4 ] ] }, { "id": "micro-behaviors/communications/socket/listen::accept-sym", "atk": "T1071", "mbc": "C0001", "conf": 0.6000000238418579, "crit": 3, "desc": "accept function symbol", "spans": [ [ 2819, 6 ] ] }, { "id": "metadata/binary/metrics/threshold::many-imports-50", "conf": 1.0, "crit": 1, "desc": "Binary has 50+ imports", "spans": [ [ 0, 21 ] ] }, { "id": "micro-behaviors/os/privilege/query::getuid", "crit": 2, "desc": "Get user ID", "spans": [ [ 2743, 6 ] ] }, { "id": "micro-behaviors/communications/socket/listen::listen-sym", "atk": "T1071", "mbc": "C0001", "conf": 0.6000000238418579, "crit": 3, "desc": "listen function symbol", "spans": [ [ 2766, 6 ] ] }, { "id": "micro-behaviors/communications/socket/tcp::socket-symbol-text", "conf": 0.75, "crit": 3, "desc": "Socket API symbol text", "spans": [ [ 2754, 6 ] ] }, { "id": "micro-behaviors/fs/file/read::read", "conf": 0.699999988079071, "crit": 2, "desc": "Read file descriptor (read/pread)", "spans": [ [ 2595, 4 ] ] }, { "id": "micro-behaviors/communications/socket/options::options-get", "conf": 0.6600000262260437, "crit": 3, "desc": "Get socket options", "spans": [ [ 2884, 10 ] ] }, { "id": "micro-behaviors/fs/path/temp::unix-temp", "conf": 0.699999988079071, "crit": 2, "desc": "Unix /tmp/ path reference", "spans": [ [ 16935, 5 ] ] }, { "id": "micro-behaviors/fs/file/write/direct::write--write", "conf": 0.6600000262260437, "crit": 2, "desc": "Write files (write)", "spans": [ [ 2831, 5 ] ] }, { "id": "micro-behaviors/communications/socket/connect::connect-symbol", "atk": "T1071", "mbc": "C0001", "conf": 0.6600000262260437, "crit": 3, "desc": "Uses connect socket call", "spans": [ [ 2876, 7 ] ] }, { "id": "micro-behaviors/communications/socket/listen::socket-sym", "mbc": "C0001", "conf": 0.4000000059604645, "crit": 3, "desc": "socket function symbol", "spans": [ [ 2754, 6 ] ] }, { "id": "micro-behaviors/communications/socket/connect::_connect-symbol", "atk": "T1071", "mbc": "C0001", "conf": 0.6600000262260437, "crit": 3, "desc": "Uses _connect socket call", "spans": [ [ 2876, 7 ] ] }, { "id": "micro-behaviors/communications/socket/listen::listen", "atk": "T1071", "mbc": "C0001", "conf": 0.6600000262260437, "crit": 3, "desc": "Listen on a socket", "spans": [ [ 2754, 6 ], [ 2766, 6 ] ] }, { "id": "micro-behaviors/fs/path/temp::tmp-hidden-file", "atk": "T1564.001", "conf": 0.75, "crit": 3, "desc": "Hidden file path in /tmp directory", "spans": [ [ 16935, 5 ] ] }, { "id": "micro-behaviors/fs/file/binary::file-read-operation", "atk": "T1005", "conf": 0.75, "crit": 1, "desc": "File read operation", "spans": [ [ 2595, 4 ], [ 2864, 6 ] ] }, { "id": "micro-behaviors/fs/file/write/direct::write", "conf": 0.6600000262260437, "crit": 2, "desc": "Write files", "spans": [ [ 2831, 5 ] ] }, { "id": "micro-behaviors/dylib/library/libc::libc-internal-functions-b", "conf": 0.699999988079071, "crit": 2, "desc": "libc internal symbols cluster B", "spans": [ [ 2419, 12 ] ] }, { "id": "micro-behaviors/ui/help::usage-label", "conf": 0.75, "crit": 1, "desc": "Command line usage text", "spans": [ [ 16707, 49 ] ] }, { "id": "micro-behaviors/dylib/library/abi-graphics::cxx-abi-symbols-a", "conf": 0.800000011920929, "crit": 2, "desc": "C++ ABI symbols cluster A", "spans": [ [ 2419, 12 ] ] } ], "type": "elf" }, { "ctx": [ { "b": "E))420S-r400000000000@$H+0rr91B$iK)00000kMy=:000005mCLs0000000000kMA+z4feS[8upSP1][S6", "n": [ { "c": 3, "d": "No full symbol table (likely stripped)", "i": "metadata/hardening/missing::stripped-binary", "o": 0, "z": 25, "cf": 0.800000011920929 } ], "ln": 0 }, { "b": "N[w.{y?Wuiy?bbmB-RvJCSmP*hz^4cz.r:A000060000^000010000600000G-IeN1Zz", "n": [ { "c": 3, "d": "Architecture detection strings", "i": "objectives/discovery/host/software::arch-detection", "o": 889, "z": 6, "cf": 0.5 } ], "ln": 873 }, { "b": "0000000Ao400000003wkv%zA?w[=c\u003ey?Xib0af8zwPzu{x(!xcA:JB0vqPN.x(mK30aeq%o\u003c.{L", "n": [ { "c": 2, "d": "C++ standard library markers (libc++, libstdc++)", "i": "micro-behaviors/dylib/library/libc::cxx-stdlib-marker", "o": 2731, "z": 12, "cf": 0.8999999761581421 } ], "ln": 2715 }, { "b": "0crm5v@le+w]qD]ByO$:w[LW%A@Zo6A+]r80crm5y?4Bf0cri\u003evqYVSB97@7A=Id%vqG:#v/QEVA=M8s0a*y?Bo3x7A+6ri0af8OBywV{uT)++uUi.XyYF9VBzLVewDl^[A:@^60crm5zEW9%0a{g)BAmC6BAhzixMs8+A+e!ZxjVf@zGV23zG6SgzGGE\u003cw]zT1zuaoUy\u0026sxa0crl)z/{d4uTEk.B7GxluUi.XyYF6^B-.9[w[C\u003e4B7+L%w]I^8zGGE\u003cxjVg6AcbD6z/fg/z/x/bA+twXBz\u003e\u003c[z/x/jzE--WwPS6ewb{g=z#:@$v@2T$0aGUWwb{BWB97#h0aYIHzeTp(B7]o8vqC{:vqYQ]z2!iWBz$@80b2\u003e+BzkP6z!rJ*C(R/4y?%8Wv}f7?Bo2]\u003eA++U!wn=A#zua(?x([rdwb{:\u0026y?W^50a]}YwO#z^w]8x}yxd%/Byxm\u003ew]?D\u003czE@(\u003cx(dzYw]@6ozEW9%wDljUzF\u003c2}Bo2@+BAqwgyJ1fl0crm5v@MX[uTEw+A=b/5y\u0026r/(BzkVh0crm5wPz*f", "n": [ { "c": 4, "d": "Removes artifacts before memfd execution", "i": "objectives/evasion/fileless/memory::memfd-reexec-cleanup", "o": 3215, "z": 6, "cf": 0.9200000166893005 }, { "c": 4, "d": "Sets LD_PRELOAD hooks to hide filesystem", "i": "objectives/evasion/kernel-hide/userspace::preload-rootkit-hook-set", "o": 3025, "z": 5, "cf": 0.9200000166893005 }, { "c": 3, "d": "Stack protector/canary enabled", "i": "metadata/hardening/build::stack-protector", "o": 2952, "z": 14, "cf": 0.8999999761581421 }, { "c": 3, "d": "Bind socket to address", "i": "micro-behaviors/communications/socket/bind/function::bind", "o": 3130, "z": 4, "cf": 0.75 }, { "c": 3, "d": "I/O multiplexing on sockets", "i": "micro-behaviors/communications/socket/multiplex::multiplex", "o": 3183, "z": 4, "cf": 0.6600000262260437 }, { "c": 3, "d": "Get socket options", "i": "micro-behaviors/communications/socket/options::options-get", "o": 3271, "z": 10, "cf": 0.6600000262260437 }, { "c": 3, "d": "Accept API symbol text", "i": "micro-behaviors/communications/socket/tcp::accept-symbol-text", "o": 3188, "z": 6, "cf": 0.75 }, { "c": 3, "d": "Connect API symbol text", "i": "micro-behaviors/communications/socket/tcp::connect-symbol-text", "o": 3263, "z": 7, "cf": 0.75 }, { "c": 3, "d": "Listen API symbol text", "i": "micro-behaviors/communications/socket/tcp::listen-symbol-text", "o": 3135, "z": 6, "cf": 0.75 }, { "c": 3, "d": "Socket API symbol text", "i": "micro-behaviors/communications/socket/tcp::socket-symbol-text", "o": 3123, "z": 6, "cf": 0.75 }, { "c": 3, "d": "Read file status and metadata (core)", "i": "micro-behaviors/fs/file/stat::stat-core", "o": 3235, "z": 5, "cf": 0.800000011920929 }, { "c": 3, "d": "Daemonize process", "i": "micro-behaviors/process/fork/clone::daemon-dup", "o": 3142, "z": 6, "cf": 0.6600000262260437 }, { "c": 3, "d": "POSIX user lookup functions", "i": "objectives/discovery/account/enum::passive-user-lookup", "o": 3112, "z": 6, "cf": 0.4000000059604645 }, { "c": 3, "d": "Benign network-capable library context", "i": "objectives/supply-chain/trojanized/backdoor::benign-network-library-context", "o": 3156, "z": 6, "cf": 0.8999999761581421 }, { "c": 2, "d": "Characteristic libc export __assert_fail", "i": "micro-behaviors/dylib/library/libc::libc-characteristic-assert-fail", "o": 3047, "z": 11, "cf": 0.5 }, { "c": 2, "d": "Generic file read/write operations", "i": "micro-behaviors/fs/file/read-write::binary-file-ops", "o": 3202, "z": 4, "cf": 0.800000011920929 }, { "c": 2, "d": "Formatted input from file", "i": "micro-behaviors/fs/file/read::fscanf", "o": 3241, "z": 6, "cf": 0.699999988079071 }, { "c": 2, "d": "Truncate file", "i": "micro-behaviors/fs/file/truncate::truncate", "o": 3253, "z": 9, "cf": 0.5 }, { "c": 2, "d": "Write single bytes to file", "i": "micro-behaviors/fs/file/write/direct::fputc", "o": 3059, "z": 5, "cf": 0.6600000262260437 }, { "c": 2, "d": "Apply or remove advisory lock", "i": "micro-behaviors/fs/lock/flock::flock-fn", "o": 3229, "z": 5, "cf": 0.6600000262260437 }, { "c": 2, "d": "Environment variable access functions", "i": "micro-behaviors/os/env/vars/access::env-access-comp", "o": 3009, "z": 6, "cf": 0.4000000059604645 }, { "c": 2, "d": "Install signal handler", "i": "micro-behaviors/os/signal/handler::signal", "o": 3149, "z": 6, "cf": 0.8999999761581421 }, { "c": 2, "d": "Wait for child process state", "i": "micro-behaviors/process/control/wait::waitpid", "o": 3207, "z": 7, "cf": 0.6600000262260437 }, { "c": 2, "d": "Line-based file reading (fgets)", "i": "micro-behaviors/process/create/direct::fgets-loop", "o": 2889, "z": 5, "cf": 1.0 }, { "c": 2, "d": "Process forking", "i": "micro-behaviors/process/fork/clone::fork", "o": 3195, "z": 4, "cf": 0.6600000262260437 }, { "c": 2, "d": "Get process ID", "i": "micro-behaviors/process/identity/query::getpid", "o": 3163, "z": 6, "cf": 0.30000001192092896 }, { "c": 2, "d": "Terminates process immediately without cleanup", "i": "micro-behaviors/process/terminate/signal::_exit", "o": 2938, "z": 4, "cf": 0.4000000059604645 }, { "c": 2, "d": "Get current calendar time (seconds)", "i": "micro-behaviors/time/query::time", "o": 3248, "z": 4, "cf": 0.30000001192092896 }, { "c": 2, "d": "Execution time measurement APIs", "i": "objectives/anti-analysis/timing/evasion::timing-measurement", "o": 3170, "z": 12, "cf": 0.4000000059604645 }, { "c": 1, "d": "libm exp import", "i": "micro-behaviors/dylib/library/libm::libm-exp-symbol", "o": 3119, "z": 3, "cf": 0.4000000059604645 } ], "ln": 2873 }, { "b": "e]$}-g5#c8vQ?3cB-RvJCSmP*hz^4cz.r:A00000{*0\u003e1000001][S60rr9100000000", "n": [ { "c": 2, "d": "x86_64 architecture string", "i": "micro-behaviors/os/sysinfo/platform/string::arch-x86-64", "o": 3344, "z": 6, "cf": 0.30000001192092896 } ], "ln": 3328 }, { "b": "lTJOSr9@N0o\u00269.FzE)]yzE){hByxm\u003ep/p7RuRT3?uRT3?q=D4Z0buN[zxJ\u003ebygQ)%0buM", "n": [ { "c": 3, "d": "netstat command", "i": "micro-behaviors/os/network/status::netstat", "o": 16654, "z": 7, "cf": 0.8999999761581421 } ], "ln": 16638 }, { "b": "C}p7LAb](tBy^iVc36y[rDzOYwJy@KB97\u0026jax}Srr7P\u003eXt{9t]p^F5Wmn=(6toD:dr8=p:p9r*+t).X%at4mTat2fUwO=rdarR^HarR^HaARphB0bshB8$=5wEoL5at41Mat2fVxkRTdwGS9rarR^HazCFaz/PzixLzKfz/QagarR^UwgO\u0026PePUAgzAQ]!lSk9IarR!FvqP$1wGUMcwPA5sB97\u0026j", "n": [ { "c": 3, "d": "Terminal socket exec helper context", "i": "micro-behaviors/process/fd/dup::unix-terminal-socket-exec-benign-context", "o": 16873, "z": 128, "cf": 0.949999988079071 } ], "ln": 16857 }, { "b": "vrlJkq:\u003c5L3lQDleMKzBeIhcSA=U@kzxH5AarR^Hz/{evB-X:HwPz\u003caz/cXizF0*czddK2zV", "n": [ { "c": 3, "d": "Linker and terminal benign dual-mode forwarding", "i": "micro-behaviors/process/fd/dup::unix-dual-mode-socket-exec-benign-context", "o": 17316, "z": 9, "cf": 0.9399999976158142 } ], "ln": 17300 }, { "b": "Ck$xpr6:F\u003cnj=-VpF$r}flz5Ifd}c-ByxnzBTpL#zGx]dBugK.AaJ]fxLzKfz/QaCw[=6)0cfN\u0026zu", "n": [ { "c": 3, "d": "Hidden file path in /tmp directory", "i": "micro-behaviors/fs/path/temp::tmp-hidden-file", "o": 17551, "z": 6, "cf": 0.75 } ], "ln": 17535 }, { "b": "By^7qzGNNvB.LV5eOO.}e[]iBwPz.\u0026e[Y6Ae[!WmxAfU}D2vXGz2=h0D2vXBASv.jwO+^cwo\u00264)e]\u003eJtvj(InBo0}lwO=xtwo\u00264)e=", "n": [ { "c": 2, "d": "ELF dynstr section name", "i": "metadata/binary/linking/static::elf-dynstr-section-name", "o": 24687, "z": 7, "cf": 0.8999999761581421 }, { "c": 2, "d": "ELF dynsym section name", "i": "metadata/binary/linking/static::elf-dynsym-section-name", "o": 24679, "z": 7, "cf": 0.8999999761581421 }, { "c": 2, "d": "ELF interpreter section name", "i": "metadata/binary/linking/static::elf-interpreter-section-name", "o": 24661, "z": 7, "cf": 0.8999999761581421 } ], "ln": 24645 }, { "b": "vr?\u00269wmoN*e]\u003eJte]\u003e\u003ege[xlBvqPZ*04}]5Bo0}7vrt]Te[e)y04}=1zeA\u003c4Bn#pv00000", "n": [ { "c": 2, "d": "ELF dynamic section name", "i": "metadata/binary/linking/static::elf-dynamic-section-name", "o": 24812, "z": 8, "cf": 0.8999999761581421 } ], "ln": 24796 } ], "depth": 1, "facts": { "exp": [ [ "stdout" ], [ "stderr" ], [ "optarg" ], [ "fini" ], [ "init" ], [ "optind" ] ], "imp": [ [ "", "strcpy" ], [ "", "waitpid" ], [ "", "printf" ], [ "", "random" ], [ "", "connect" ], [ "", "strerror" ], [ "", "getopt_long" ], [ "", "snprintf" ], [ "", "getenv" ], [ "", "getpid" ], [ "", "fscanf" ], [ "", "fgets" ], [ "", "perror" ], [ "", "cxa_finalize" ], [ "", "getuid" ], [ "", "malloc" ], [ "", "socket" ], [ "", "fflush" ], [ "", "ftruncate" ], [ "", "stack_chk_fail" ], [ "", "accept" ], [ "", "strrchr" ], [ "", "fstat" ], [ "", "fprintf" ], [ "", "bind" ], [ "", "deregister_frame_info" ], [ "", "ITM_registerTMCloneTable" ], [ "", "flock" ], [ "", "signal" ], [ "", "strlcpy" ], [ "", "unlink" ], [ "", "listen" ], [ "", "fdopen" ], [ "", "fork" ], [ "", "sscanf" ], [ "", "strncat" ], [ "", "ITM_deregisterTMCloneTable" ], [ "", "strdup" ], [ "", "gettimeofday" ], [ "", "fopen" ], [ "", "fnmatch" ], [ "", "fclose" ], [ "", "time" ], [ "", "assert_fail" ], [ "", "poll" ], [ "", "exp" ], [ "", "putc" ], [ "", "strcmp" ], [ "", "fputc" ], [ "", "getsockopt" ], [ "", "rewind" ], [ "", "errno_location" ], [ "", "exit" ], [ "", "atoi" ], [ "", "fileno" ], [ "", "getline" ], [ "", "daemon" ], [ "", "libc_start_main" ], [ "", "strlen" ], [ "", "open" ], [ "", "strchr" ], [ "", "fputs" ], [ "", "register_frame_info" ], [ "", "close" ], [ "", "vfprintf" ], [ "", "free" ] ], "sec": [ [ ".note.gnu.property", 792, 48, 1.94, "alloc" ], [ ".note.gnu.build-id", 840, 36, 4.19, "alloc" ], [ ".interp", 876, 25, 4.05, "alloc" ], [ ".gnu.hash", 904, 72, 3.57, "alloc" ], [ ".dynsym", 976, 1752, 1.09, "alloc" ], [ ".dynstr", 2728, 628, 4.44, "alloc" ], [ ".rela.dyn", 3360, 1656, 1.48, "alloc" ], [ ".rela.plt", 5016, 24, 0.98, "alloc,info_link" ], [ ".relr.dyn", 5040, 24, 2.25, "alloc" ], [ ".init", 8192, 3, 1.58, "alloc,executable" ], [ ".plt", 8208, 32, 3.05, "alloc,executable" ], [ ".text", 8240, 6276, 6.01, "alloc,executable" ], [ ".fini", 14516, 3, 1.58, "alloc,executable" ], [ ".rodata", 16384, 1896, 5.24, "alloc" ], [ ".eh_frame_hdr", 18280, 188, 4.07, "alloc" ], [ ".eh_frame", 18472, 952, 4.77, "alloc" ], [ ".init_array", 23024, 8, 1.06, "write,alloc" ], [ ".fini_array", 23032, 8, 1.06, "write,alloc" ], [ ".data.rel.ro", 23040, 472, 0.9, "write,alloc" ], [ ".dynamic", 23512, 512, 1.33, "write,alloc" ], [ ".got", 24024, 552, 0.08, "write,alloc" ], [ ".data", 24576, 8, 0.54, "write,alloc" ], [ ".comment", 24584, 28, 3.99, "merge,strings" ], [ ".shstrtab", 24612, 234, 4.14, "" ] ], "metrics": { "elf": { "bits": 64.0, "entry": 11126.0, "has_got": 1.0, "has_plt": 1.0, "has_note": 1.0, "note_count": 2.0, "nx_enabled": 1.0, "has_dt_relr": 1.0, "dynrel_count": 0.0, "dynsym_count": 73.0, "has_build_id": 1.0, "has_eh_frame": 1.0, "has_gnu_hash": 1.0, "stack_canary": 1.0, "symtab_count": 0.0, "dynrela_count": 69.0, "little_endian": 1.0, "dt_flags_1_raw": 134217729.0, "pltreloc_count": 1.0, "build_id_length": 20.0, "executable_stack": 0.0, "fini_array_count": 1.0, "init_array_count": 1.0, "wx_segment_count": 0.0, "comment_entry_count": 1.0, "program_header_count": 13.0, "comment_distinct_count": 1.0, "gnu_stack_section_absent": 0.0, "load_segment_max_file_size": 6327.0, "stripped_but_symtab_present": 0.0, "load_segment_max_memory_size": 6327.0, "section_relocation_group_count": 2.0, "stripped_metadata_section_count": 7.0 }, "file": { "size": 26512.0, "entropy": 3.46, "size_bytes": 26512.0 }, "binary": { "is_pie": 1.0, "has_overlay": 1.0, "is_stripped": 1.0, "code_entropy": 5.99, "data_entropy": 0.75, "overlay_size": 1666.0, "string_count": 157.0, "overlay_ratio": 0.06, "overall_entropy": 3.46, "overlay_entropy": 1.37, "entropy_variance": 2.81, "avg_string_length": 17.18, "max_string_length": 540.0, "peak_region_bytes": 7168.0, "code_to_data_ratio": 0.8, "peak_region_entropy": 5.84, "string_length_stddev": 43.51, "largest_section_ratio": 0.24, "sentence_string_count": 25.0, "sentence_string_ratio": 0.16, "high_entropy_string_count": 0.0 }, "exports": { "count": 6.0 }, "imports": { "count": 66.0 }, "sections": { "count": 26.0, "code_size": 6314.0, "entropy_max": 6.01, "entropy_mean": 2.64, "name_entropy": 4.09, "writable_count": 7.0, "executable_count": 4.0, "nonstandard_count": 6.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 2.0 } } }, "id": 3, "mol": "H₄(Cm₅F₂OsPo)", "path": "iproute2-7.1.0-r0.apk!!sbin/nstat", "risk": 5, "sha": "565664c9c3c64a8cace610b59724f60dc7567daa810b3b7f1b093b18a51c7fcf", "size": 26512, "traits": [ { "id": "micro-behaviors/communications/socket/tcp::listen-symbol-text", "conf": 0.75, "crit": 3, "desc": "Listen API symbol text", "spans": [ [ 3135, 6 ] ] }, { "id": "micro-behaviors/fs/file/read::fscanf", "conf": 0.699999988079071, "crit": 2, "desc": "Formatted input from file", "spans": [ [ 3241, 6 ] ] }, { "id": "micro-behaviors/communications/socket/bind/function::bind", "conf": 0.75, "crit": 3, "desc": "Bind socket to address", "spans": [ [ 3130, 4 ] ] }, { "id": "micro-behaviors/ui/help::usage-title", "crit": 2, "desc": "Usage: label (title case)", "spans": [ [ 16873, 128 ] ] }, { "id": "micro-behaviors/fs/path/temp::tmp-path-content", "conf": 1.0, "crit": 2, "desc": "/tmp/ path component", "spans": [ [ 17551, 13 ] ] }, { "id": "micro-behaviors/dylib/library/libc::libc-characteristic-cxa-finalize", "crit": 2, "desc": "libc characteristic cxa finalize", "spans": [ [ 2731, 12 ] ] }, { "id": "micro-behaviors/fs/file/open::fopen", "conf": 0.6600000262260437, "crit": 3, "desc": "Open files", "spans": [ [ 3025, 5 ] ] }, { "id": "micro-behaviors/process/fork/clone::daemon-dup", "conf": 0.6600000262260437, "crit": 3, "desc": "Daemonize process", "spans": [ [ 3142, 6 ] ] }, { "id": "micro-behaviors/communications/socket/tcp::connect-symbol-text", "conf": 0.75, "crit": 3, "desc": "Connect API symbol text", "spans": [ [ 3263, 7 ] ] }, { "id": "micro-behaviors/communications/socket/tcp::accept-symbol-text", "conf": 0.75, "crit": 3, "desc": "Accept API symbol text", "spans": [ [ 3188, 6 ] ] }, { "id": "micro-behaviors/ui/help::usage-title-string", "crit": 1, "desc": "Usage: label in binary strings", "spans": [ [ 16873, 128 ] ] }, { "id": "micro-behaviors/fs/path/temp::hidden-tmp-path", "conf": 1.0, "crit": 2, "desc": "Hidden path prefix in /tmp", "spans": [ [ 17551, 6 ] ] }, { "id": "micro-behaviors/communications/socket/multiplex::poll-multiplex", "crit": 3, "desc": "poll() I/O multiplexing", "spans": [ [ 3183, 4 ] ] }, { "id": "micro-behaviors/communications/socket/listen::accept-sym", "atk": "T1071", "mbc": "C0001", "conf": 0.6000000238418579, "crit": 3, "desc": "accept function symbol", "spans": [ [ 3188, 6 ] ] }, { "id": "metadata/binary/metrics/threshold::many-imports-50", "conf": 1.0, "crit": 1, "desc": "Binary has 50+ imports", "spans": [ [ 0, 21 ] ] }, { "id": "micro-behaviors/os/privilege/query::getuid", "crit": 2, "desc": "Get user ID", "spans": [ [ 3112, 6 ] ] }, { "id": "micro-behaviors/communications/socket/listen::listen-sym", "atk": "T1071", "mbc": "C0001", "conf": 0.6000000238418579, "crit": 3, "desc": "listen function symbol", "spans": [ [ 3135, 6 ] ] }, { "id": "micro-behaviors/communications/socket/tcp::socket-symbol-text", "conf": 0.75, "crit": 3, "desc": "Socket API symbol text", "spans": [ [ 3123, 6 ] ] }, { "id": "micro-behaviors/communications/socket/options::options-get", "conf": 0.6600000262260437, "crit": 3, "desc": "Get socket options", "spans": [ [ 3271, 10 ] ] }, { "id": "micro-behaviors/fs/path/temp::unix-temp", "conf": 0.699999988079071, "crit": 2, "desc": "Unix /tmp/ path reference", "spans": [ [ 17551, 5 ] ] }, { "id": "micro-behaviors/os/network/status::netstat", "conf": 0.8999999761581421, "crit": 3, "desc": "netstat command", "spans": [ [ 16654, 7 ] ] }, { "id": "micro-behaviors/communications/socket/connect::connect-symbol", "atk": "T1071", "mbc": "C0001", "conf": 0.6600000262260437, "crit": 3, "desc": "Uses connect socket call", "spans": [ [ 3263, 7 ] ] }, { "id": "micro-behaviors/communications/socket/listen::socket-sym", "mbc": "C0001", "conf": 0.4000000059604645, "crit": 3, "desc": "socket function symbol", "spans": [ [ 3123, 6 ] ] }, { "id": "micro-behaviors/communications/socket/connect::_connect-symbol", "atk": "T1071", "mbc": "C0001", "conf": 0.6600000262260437, "crit": 3, "desc": "Uses _connect socket call", "spans": [ [ 3263, 7 ] ] }, { "id": "micro-behaviors/communications/socket/listen::listen", "atk": "T1071", "mbc": "C0001", "conf": 0.6600000262260437, "crit": 3, "desc": "Listen on a socket", "spans": [ [ 3123, 6 ], [ 3135, 6 ] ] }, { "id": "micro-behaviors/fs/path/temp::tmp-hidden-file", "atk": "T1564.001", "conf": 0.75, "crit": 3, "desc": "Hidden file path in /tmp directory", "spans": [ [ 17551, 5 ] ] }, { "id": "micro-behaviors/fs/file/binary::file-read-operation", "atk": "T1005", "conf": 0.75, "crit": 1, "desc": "File read operation", "spans": [ [ 3241, 6 ] ] }, { "id": "micro-behaviors/dylib/library/libc::libc-internal-functions-b", "conf": 0.699999988079071, "crit": 2, "desc": "libc internal symbols cluster B", "spans": [ [ 2731, 12 ] ] }, { "id": "micro-behaviors/ui/help::usage-label", "conf": 0.75, "crit": 1, "desc": "Command line usage text", "spans": [ [ 16873, 128 ] ] }, { "id": "micro-behaviors/dylib/library/abi-graphics::cxx-abi-symbols-a", "conf": 0.800000011920929, "crit": 2, "desc": "C++ ABI symbols cluster A", "spans": [ [ 2731, 12 ] ] } ], "type": "elf" }, { "id": 4, "mol": "H(F)", "sha": "d6f82d0e1f8c480716bf5293c15299c7b96ae3b77cf9647a837bf0b086e4c18d", "path": "iproute2-7.1.0-r0.apk!!sbin/lnstat", "risk": 1, "size": 18696, "type": "elf", "depth": 1 }, { "ctx": [ { "b": "E))420S-r400000000000@$H+0rr91*aij700000kMy=:00000fO6i70000000000kMA+z4feS[8#{]T1][S6", "n": [ { "c": 3, "d": "Benign PE anti-analysis context", "i": "objectives/anti-analysis/debugger-detect/combined-checks::evasion-aware-benign-pe-context", "o": 0, "z": 21, "cf": 1.0 } ], "ln": 0 }, { "b": "V@v?{y?Wuiy?bbmB-RvJCSmP*hz^4cz.r:A000060000@000010000600000G-IeN1Zz", "n": [ { "c": 3, "d": "Architecture detection strings", "i": "objectives/discovery/host/software::arch-detection", "o": 889, "z": 6, "cf": 0.5 } ], "ln": 873 }, { "b": "0000000Ao400000003wkv%zA?w[=c\u003ey?Xib0af8zwPzu{x(!xcA:JB0vqPN.x(mK30aeq%o\u003c.{L", "n": [ { "c": 2, "d": "C++ standard library markers (libc++, libstdc++)", "i": "micro-behaviors/dylib/library/libc::cxx-stdlib-marker", "o": 3067, "z": 12, "cf": 0.8999999761581421 } ], "ln": 3051 }, { "b": "zddl%z^@=*BAg]mz#:lLB97\u00262yHpN+yHpWZx(0=\u003czG6SgzGGE\u003cAaK6gz/L??CXIm1B97@hB-WQ}xjVga0crm5y?mF:B98CjzeYF@BAhhcAcRB(vScpe0crm5v}Y(.B8$\u00261zE@(XAclnj0crm5v@MX[uTEk.B7GxluUi.XyYF6Vy\u0026%/j0a{g)BAmC9w]I^8zGGE\u003cB8LM7wPN][wPS0iv@314Bo2=:zE--WwPS0iv@2%\u003czdJY?x(dzYA+e:7zf6s\u0026B98ClA=M8s0cqZ?wnMy20bl4Lx(mD)CYW\u003ewvqPMQw{nofBy+C[wO#2UxjVg6AcbD6z/fg/z/x/bA+twXBz\u003e\u003c[z/x/jzE--*BAhnezeYF/wPS6ewb{g=z#:Y*B97#h0aYIHzeTp(B7]o8vqC{:vqYQ]z2!iWBz$@80b2\u003e+BzkP6z!rJ*C(R/4y?%8Wv}f7?Bo2]\u003eA++U!wn=A#zua(?x([rdwb{mNBy/uk0cJf}x(mX^w[=6)zF]I!y\u0026r*00a{p]vrqGYz/xo90a{pZvqYVSw[bT}B7Ct-BAhIwv{%E\u003c0aP}+zE)s10b2\u003e+B8LM7z/x^#A+fDezE--:zFSV*BAzLgxjVf(BU+=MzeKe%zFTd", "n": [ { "c": 4, "d": "Removes artifacts before memfd execution", "i": "objectives/evasion/fileless/memory::memfd-reexec-cleanup", "o": 3632, "z": 6, "cf": 0.9200000166893005 }, { "c": 4, "d": "Sets LD_PRELOAD hooks to hide filesystem", "i": "objectives/evasion/kernel-hide/userspace::preload-rootkit-hook-set", "o": 3658, "z": 5, "cf": 0.9200000166893005 }, { "c": 3, "d": "Stack protector/canary enabled", "i": "metadata/hardening/build::stack-protector", "o": 3263, "z": 14, "cf": 0.8999999761581421 }, { "c": 3, "d": "Bind socket to address", "i": "micro-behaviors/communications/socket/bind/function::bind", "o": 3421, "z": 4, "cf": 0.75 }, { "c": 3, "d": "Looks up name with if_indextoname", "i": "micro-behaviors/communications/socket/interface::if-indextoname-symbol", "o": 3468, "z": 14, "cf": 0.699999988079071 }, { "c": 3, "d": "I/O multiplexing on sockets", "i": "micro-behaviors/communications/socket/multiplex::multiplex", "o": 3593, "z": 4, "cf": 0.6600000262260437 }, { "c": 3, "d": "Get socket options", "i": "micro-behaviors/communications/socket/options::options-get", "o": 3696, "z": 10, "cf": 0.6600000262260437 }, { "c": 3, "d": "Set socket options", "i": "micro-behaviors/communications/socket/options::options-set", "o": 3410, "z": 10, "cf": 0.6600000262260437 }, { "c": 3, "d": "Uses recvmsg socket call", "i": "micro-behaviors/communications/socket/receive::recvmsg-symbol", "o": 3443, "z": 7, "cf": 0.6600000262260437 }, { "c": 3, "d": "Uses _send socket call", "i": "micro-behaviors/communications/socket/send::_send-symbol", "o": 3490, "z": 4, "cf": 0.6600000262260437 }, { "c": 3, "d": "Uses sendmsg socket call", "i": "micro-behaviors/communications/socket/send::sendmsg-symbol", "o": 3460, "z": 7, "cf": 0.6600000262260437 }, { "c": 3, "d": "Accept API symbol text", "i": "micro-behaviors/communications/socket/tcp::accept-symbol-text", "o": 3598, "z": 6, "cf": 0.75 }, { "c": 3, "d": "Connect API symbol text", "i": "micro-behaviors/communications/socket/tcp::connect-symbol-text", "o": 3688, "z": 7, "cf": 0.75 }, { "c": 3, "d": "Listen API symbol text", "i": "micro-behaviors/communications/socket/tcp::listen-symbol-text", "o": 3545, "z": 6, "cf": 0.75 }, { "c": 3, "d": "Socket API symbol text", "i": "micro-behaviors/communications/socket/tcp::socket-symbol-text", "o": 3403, "z": 6, "cf": 0.75 }, { "c": 3, "d": "Read file status and metadata (core)", "i": "micro-behaviors/fs/file/stat::stat-core", "o": 3652, "z": 5, "cf": 0.800000011920929 }, { "c": 3, "d": "Daemonize process", "i": "micro-behaviors/process/fork/clone::daemon-dup", "o": 3552, "z": 6, "cf": 0.6600000262260437 }, { "c": 3, "d": "Regex component marker", "i": "objectives/command-and-control/reverse-shell/pty::pty-dual-mode-backdoor-cond-2--inline-10027", "o": 3495, "z": 11, "cf": 0.9300000071525574 }, { "c": 3, "d": "POSIX user lookup functions", "i": "objectives/discovery/account/enum::passive-user-lookup", "o": 3534, "z": 6, "cf": 0.4000000059604645 }, { "c": 3, "d": "Benign network-capable library context", "i": "objectives/supply-chain/trojanized/backdoor::benign-network-library-context", "o": 3566, "z": 6, "cf": 0.8999999761581421 }, { "c": 2, "d": "Characteristic libc export __assert_fail", "i": "micro-behaviors/dylib/library/libc::libc-characteristic-assert-fail", "o": 3369, "z": 11, "cf": 0.5 }, { "c": 2, "d": "Generic file read/write operations", "i": "micro-behaviors/fs/file/read-write::binary-file-ops", "o": 3612, "z": 4, "cf": 0.800000011920929 }, { "c": 2, "d": "Formatted input from file", "i": "micro-behaviors/fs/file/read::fscanf", "o": 3664, "z": 6, "cf": 0.699999988079071 }, { "c": 2, "d": "Truncate file", "i": "micro-behaviors/fs/file/truncate::truncate", "o": 3678, "z": 9, "cf": 0.5 }, { "c": 2, "d": "Write single bytes to file", "i": "micro-behaviors/fs/file/write/direct::fputc", "o": 3354, "z": 5, "cf": 0.6600000262260437 }, { "c": 2, "d": "Write files (fwrite)", "i": "micro-behaviors/fs/file/write/direct::write--fwrite", "o": 3483, "z": 6, "cf": 0.6600000262260437 }, { "c": 2, "d": "Apply or remove advisory lock", "i": "micro-behaviors/fs/lock/flock::flock-fn", "o": 3646, "z": 5, "cf": 0.6600000262260437 }, { "c": 2, "d": "Environment variable access functions", "i": "micro-behaviors/os/env/vars/access::env-access-comp", "o": 3625, "z": 6, "cf": 0.4000000059604645 }, { "c": 2, "d": "Abort program execution", "i": "micro-behaviors/os/signal/handler::abort", "o": 3334, "z": 5, "cf": 0.8999999761581421 }, { "c": 2, "d": "Install signal handler", "i": "micro-behaviors/os/signal/handler::signal", "o": 3559, "z": 6, "cf": 0.8999999761581421 }, { "c": 2, "d": "Wait for child process state", "i": "micro-behaviors/process/control/wait::waitpid", "o": 3617, "z": 7, "cf": 0.6600000262260437 }, { "c": 2, "d": "Line-based file reading (fgets)", "i": "micro-behaviors/process/create/direct::fgets-loop", "o": 3306, "z": 5, "cf": 1.0 }, { "c": 2, "d": "Process forking", "i": "micro-behaviors/process/fork/clone::fork", "o": 3605, "z": 4, "cf": 0.6600000262260437 }, { "c": 2, "d": "Get process ID", "i": "micro-behaviors/process/identity/query::getpid", "o": 3573, "z": 6, "cf": 0.30000001192092896 }, { "c": 2, "d": "Terminates process immediately without cleanup", "i": "micro-behaviors/process/terminate/signal::_exit", "o": 3294, "z": 4, "cf": 0.4000000059604645 }, { "c": 2, "d": "Get current calendar time (seconds)", "i": "micro-behaviors/time/query::time", "o": 3438, "z": 4, "cf": 0.30000001192092896 }, { "c": 2, "d": "Execution time measurement APIs", "i": "objectives/anti-analysis/timing/evasion::timing-measurement", "o": 3580, "z": 12, "cf": 0.4000000059604645 }, { "c": 1, "d": "libm exp import", "i": "micro-behaviors/dylib/library/libm::libm-exp-symbol", "o": 3541, "z": 3, "cf": 0.4000000059604645 } ], "ln": 3247 }, { "b": "e]$}-g5#c8vQ?3cB-RvJCSmP*hz^4cz.r:AoI4MBpe21He?^n9009620096200962009", "n": [ { "c": 2, "d": "x86_64 architecture string", "i": "micro-behaviors/os/sysinfo/platform/string::arch-x86-64", "o": 3901, "z": 6, "cf": 0.30000001192092896 } ], "ln": 3885 }, { "b": "Jtf=hI9\u0026%/IbKWJI9\u003cnj1R?1q5583zGWK@HyRR8:%ht2=(*vr66\u0026d:d044TE002MHA$y)248LL(oaR", "n": [ { "c": 1, "d": "DJB2 hash algorithm constant (5381)", "i": "objectives/anti-static/obfuscation/imports::djb2-hash-constant", "o": 15668, "z": 11, "cf": 0.75 }, { "c": 1, "d": "DJB2 hash multiply-by-33 instruction", "i": "objectives/anti-static/obfuscation/imports::djb2-multiply-33", "o": 15680, "z": 2, "cf": 0.699999988079071 } ], "ln": 15652 }, { "b": "C}p7LAb](tBy^iVc36y[rDzOYwJy@Fw]\u002665BrB^-p/H1Zpf!#Daw+v6r7fXWax]%+k#Z/LqCFuuaybr%arSmHefDI@xK#10arR^HarR^HarR!GxLzJgzdN^fvp%cUarR^UvjSJMeOO\u003cnz/PziarR^HarR^Hx\u003eIs4A+cwbx(!xmA^n0marSmDefDI@B7nS@jYs^pqY)h9arR!FvqP$1wGUMcwPA5s", "n": [ { "c": 3, "d": "Terminal socket exec helper context", "i": "micro-behaviors/process/fd/dup::unix-terminal-socket-exec-benign-context", "o": 25826, "z": 128, "cf": 0.949999988079071 } ], "ln": 25810 }, { "b": "vrlJkq:\u003c5L3lQDleMKzBeIhcSA=U@kzxH5AarR^HaA8yAAclmBC4CYnx(v(ix(mK3A=2lbx-", "n": [ { "c": 3, "d": "Linker and terminal benign dual-mode forwarding", "i": "micro-behaviors/process/fd/dup::unix-dual-mode-socket-exec-benign-context", "o": 26315, "z": 9, "cf": 0.9399999976158142 } ], "ln": 26299 }, { "b": "BrCdtBy/uhx(v(ic36y[rDzOYwJy@Fw]\u002665BrCTEAbY-oBy!#9CYN$nBAoFIarR^HarR!pAckJ3x([zsarR^HarT3\u0026B-8qxaA8dlC{46mv@2T$B0bNrvrrSowO#PjC4\u003ewcBzbkdlR{=n3ij^LB97\u0026jc1E0\u0026w]\u002665BugK=z!0M]Bo32!B97\u0026j", "n": [ { "c": 3, "d": "Benign socket shell helper context", "i": "micro-behaviors/process/fd/dup::posix-fd-redirect-shell-benign-context", "o": 26515, "z": 96, "cf": 0.9399999976158142 } ], "ln": 26499 }, { "b": "nK=STk#.hZnMeO:qDS#MBzU%%c37Z(x\u003ezBdvrsbAc1E04B1Yc(B6\u0026S[B97\u0026je{eD", "n": [ { "c": 2, "d": "Reference to a temporary directory", "i": "micro-behaviors/fs/temp/reference::temp-dir-reference", "o": 26740, "z": 3, "cf": 0.4000000059604645 } ], "ln": 26724 }, { "b": "By^7qzGNNvB.LV5eOO.}e[]iBwPz.\u0026e[Y6Ae[!WmxAfU}D2vXGz2=h0D2vXBASv.8zGNNPwPz\u003caz/bLcxkR\u0026AC4CYnx(v(@ASv.jwD", "n": [ { "c": 2, "d": "ELF dynstr section name", "i": "metadata/binary/linking/static::elf-dynstr-section-name", "o": 32883, "z": 7, "cf": 0.8999999761581421 }, { "c": 2, "d": "ELF dynsym section name", "i": "metadata/binary/linking/static::elf-dynsym-section-name", "o": 32875, "z": 7, "cf": 0.8999999761581421 }, { "c": 2, "d": "ELF interpreter section name", "i": "metadata/binary/linking/static::elf-interpreter-section-name", "o": 32857, "z": 7, "cf": 0.8999999761581421 } ], "ln": 32841 }, { "b": "vr?\u00269wmoN*e]\u003eJte]\u003e\u003ege[xlBvqPZ*04}]5Bo0}7vrt]Te[e)y04}=1zeA\u003c4Bn#pv00000", "n": [ { "c": 2, "d": "ELF dynamic section name", "i": "metadata/binary/linking/static::elf-dynamic-section-name", "o": 33036, "z": 8, "cf": 0.8999999761581421 } ], "ln": 33020 } ], "depth": 1, "facts": { "exp": [ [ "stdout" ], [ "stderr" ], [ "optarg" ], [ "fini" ], [ "init" ], [ "optind" ] ], "imp": [ [ "", "strcpy" ], [ "", "waitpid" ], [ "", "if_indextoname" ], [ "", "printf" ], [ "", "random" ], [ "", "connect" ], [ "", "strerror" ], [ "", "getopt_long" ], [ "", "snprintf" ], [ "", "getenv" ], [ "", "mnl_attr_parse" ], [ "", "getpid" ], [ "", "fscanf" ], [ "", "fgets" ], [ "", "perror" ], [ "", "cxa_finalize" ], [ "", "getuid" ], [ "", "malloc" ], [ "", "socket" ], [ "", "mnl_attr_get_type" ], [ "", "fflush" ], [ "", "ftruncate" ], [ "", "send" ], [ "", "abort" ], [ "", "stack_chk_fail" ], [ "", "accept" ], [ "", "fstat" ], [ "", "fprintf" ], [ "", "bind" ], [ "", "deregister_frame_info" ], [ "", "mnl_nlmsg_get_payload_len" ], [ "", "setsockopt" ], [ "", "mnl_attr_type_valid" ], [ "", "ITM_registerTMCloneTable" ], [ "", "mnl_attr_get_u32" ], [ "", "flock" ], [ "", "signal" ], [ "", "sendmsg" ], [ "", "strlcpy" ], [ "", "strncmp" ], [ "", "unlink" ], [ "", "mnl_nlmsg_get_payload" ], [ "", "listen" ], [ "", "fdopen" ], [ "", "fork" ], [ "", "sscanf" ], [ "", "ITM_deregisterTMCloneTable" ], [ "", "strdup" ], [ "", "gettimeofday" ], [ "", "mnl_attr_validate" ], [ "", "fopen" ], [ "", "fnmatch" ], [ "", "fclose" ], [ "", "time" ], [ "", "assert_fail" ], [ "", "poll" ], [ "", "mnl_attr_get_str" ], [ "", "exp" ], [ "", "putc" ], [ "", "strcmp" ], [ "", "fputc" ], [ "", "getsockopt" ], [ "", "fwrite" ], [ "", "rewind" ], [ "", "errno_location" ], [ "", "exit" ], [ "", "atoi" ], [ "", "fileno" ], [ "", "daemon" ], [ "", "libc_start_main" ], [ "", "strlen" ], [ "", "open" ], [ "", "strchr" ], [ "", "fputs" ], [ "", "recvmsg" ], [ "", "register_frame_info" ], [ "", "close" ], [ "", "vfprintf" ], [ "", "free" ], [ "", "getsockname" ] ], "sec": [ [ ".note.gnu.property", 792, 48, 1.94, "alloc" ], [ ".note.gnu.build-id", 840, 36, 4.25, "alloc" ], [ ".interp", 876, 25, 4.05, "alloc" ], [ ".gnu.hash", 904, 72, 3.57, "alloc" ], [ ".dynsym", 976, 2088, 1.11, "alloc" ], [ ".dynstr", 3064, 860, 4.5, "alloc" ], [ ".gnu.version", 3924, 174, 1.22, "alloc" ], [ ".gnu.version_r", 4104, 32, 2.11, "alloc" ], [ ".rela.dyn", 4136, 1992, 1.5, "alloc" ], [ ".rela.plt", 6128, 24, 0.98, "alloc,info_link" ], [ ".relr.dyn", 6152, 32, 2.23, "alloc" ], [ ".init", 8192, 3, 1.58, "alloc,executable" ], [ ".plt", 8208, 32, 3.05, "alloc,executable" ], [ ".text", 8240, 13634, 6.1, "alloc,executable" ], [ ".fini", 21874, 3, 1.58, "alloc,executable" ], [ ".rodata", 24576, 3304, 5.15, "alloc" ], [ ".eh_frame_hdr", 27880, 308, 4.58, "alloc" ], [ ".eh_frame", 28192, 1800, 4.89, "alloc" ], [ ".init_array", 30800, 8, 1.06, "write,alloc" ], [ ".fini_array", 30808, 8, 1.06, "write,alloc" ], [ ".data.rel.ro", 30816, 696, 1.16, "write,alloc" ], [ ".dynamic", 31512, 576, 1.44, "write,alloc" ], [ ".got", 32088, 664, 0.07, "write,alloc" ], [ ".data", 32768, 12, 0.82, "write,alloc" ], [ ".comment", 32780, 28, 3.99, "merge,strings" ], [ ".shstrtab", 32808, 262, 4.18, "" ] ], "metrics": { "elf": { "bits": 64.0, "entry": 11482.0, "has_got": 1.0, "has_plt": 1.0, "has_note": 1.0, "note_count": 2.0, "nx_enabled": 1.0, "has_dt_relr": 1.0, "dynrel_count": 0.0, "dynsym_count": 87.0, "has_build_id": 1.0, "has_eh_frame": 1.0, "has_gnu_hash": 1.0, "stack_canary": 1.0, "symtab_count": 0.0, "dynrela_count": 83.0, "little_endian": 1.0, "dt_flags_1_raw": 134217729.0, "pltreloc_count": 1.0, "build_id_length": 20.0, "dt_versym_count": 87.0, "executable_stack": 0.0, "fini_array_count": 1.0, "init_array_count": 1.0, "wx_segment_count": 0.0, "comment_entry_count": 1.0, "program_header_count": 13.0, "comment_distinct_count": 1.0, "gnu_stack_section_absent": 0.0, "load_segment_max_file_size": 13685.0, "stripped_but_symtab_present": 0.0, "load_segment_max_memory_size": 18800.0, "section_relocation_group_count": 2.0, "stripped_metadata_section_count": 7.0 }, "file": { "size": 34864.0, "entropy": 4.62, "size_bytes": 34864.0 }, "binary": { "is_pie": 1.0, "has_overlay": 1.0, "is_stripped": 1.0, "code_entropy": 6.09, "data_entropy": 0.87, "overlay_size": 1794.0, "string_count": 239.0, "overlay_ratio": 0.05, "overall_entropy": 4.62, "overlay_entropy": 1.44, "entropy_variance": 2.71, "avg_string_length": 17.57, "max_string_length": 640.0, "peak_region_bytes": 8192.0, "code_to_data_ratio": 0.87, "peak_region_entropy": 6.17, "string_length_stddev": 42.31, "largest_section_ratio": 0.39, "sentence_string_count": 47.0, "sentence_string_ratio": 0.2, "high_entropy_string_count": 0.0 }, "exports": { "count": 6.0 }, "imports": { "count": 80.0 }, "sections": { "count": 28.0, "code_size": 13672.0, "entropy_max": 6.1, "entropy_mean": 2.62, "name_entropy": 4.13, "writable_count": 7.0, "executable_count": 4.0, "nonstandard_count": 6.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 3.0 } } }, "id": 5, "mol": "O(C)H₃(Cm₈FPo)", "path": "iproute2-7.1.0-r0.apk!!sbin/ifstat", "risk": 4, "sha": "16e6b0ef60076c50ecf877aa629b4b547a7d7d0ad9524a787a00cc67560ba58f", "size": 34864, "traits": [ { "id": "micro-behaviors/communications/socket/tcp::listen-symbol-text", "conf": 0.75, "crit": 3, "desc": "Listen API symbol text", "spans": [ [ 3545, 6 ] ] }, { "id": "micro-behaviors/fs/file/read::fscanf", "conf": 0.699999988079071, "crit": 2, "desc": "Formatted input from file", "spans": [ [ 3664, 6 ] ] }, { "id": "micro-behaviors/communications/socket/bind/function::bind", "conf": 0.75, "crit": 3, "desc": "Bind socket to address", "spans": [ [ 3421, 4 ] ] }, { "id": "micro-behaviors/ui/help::usage-title", "crit": 2, "desc": "Usage: label (title case)", "spans": [ [ 25826, 128 ], [ 26515, 96 ] ] }, { "id": "micro-behaviors/dylib/library/libc::libc-characteristic-cxa-finalize", "crit": 2, "desc": "libc characteristic cxa finalize", "spans": [ [ 3067, 12 ] ] }, { "id": "micro-behaviors/fs/file/open::fopen", "conf": 0.6600000262260437, "crit": 3, "desc": "Open files", "spans": [ [ 3658, 5 ] ] }, { "id": "micro-behaviors/process/fork/clone::daemon-dup", "conf": 0.6600000262260437, "crit": 3, "desc": "Daemonize process", "spans": [ [ 3552, 6 ] ] }, { "id": "micro-behaviors/communications/socket/tcp::connect-symbol-text", "conf": 0.75, "crit": 3, "desc": "Connect API symbol text", "spans": [ [ 3688, 7 ] ] }, { "id": "micro-behaviors/communications/socket/tcp::accept-symbol-text", "conf": 0.75, "crit": 3, "desc": "Accept API symbol text", "spans": [ [ 3598, 6 ] ] }, { "id": "micro-behaviors/ui/help::usage-title-string", "crit": 1, "desc": "Usage: label in binary strings", "spans": [ [ 25826, 128 ], [ 26515, 96 ] ] }, { "id": "micro-behaviors/fs/file/write/direct::write--fwrite", "conf": 0.6600000262260437, "crit": 2, "desc": "Write files (fwrite)", "spans": [ [ 3483, 6 ] ] }, { "id": "micro-behaviors/communications/socket/multiplex::poll-multiplex", "crit": 3, "desc": "poll() I/O multiplexing", "spans": [ [ 3593, 4 ] ] }, { "id": "micro-behaviors/communications/socket/listen::accept-sym", "atk": "T1071", "mbc": "C0001", "conf": 0.6000000238418579, "crit": 3, "desc": "accept function symbol", "spans": [ [ 3598, 6 ] ] }, { "id": "metadata/binary/metrics/threshold::many-imports-50", "conf": 1.0, "crit": 1, "desc": "Binary has 50+ imports", "spans": [ [ 0, 21 ] ] }, { "id": "micro-behaviors/os/privilege/query::getuid", "crit": 2, "desc": "Get user ID", "spans": [ [ 3534, 6 ] ] }, { "id": "micro-behaviors/communications/socket/listen::listen-sym", "atk": "T1071", "mbc": "C0001", "conf": 0.6000000238418579, "crit": 3, "desc": "listen function symbol", "spans": [ [ 3545, 6 ] ] }, { "id": "micro-behaviors/communications/socket/interface::if-indextoname-symbol", "conf": 0.699999988079071, "crit": 3, "desc": "Looks up name with if_indextoname", "spans": [ [ 3468, 14 ] ] }, { "id": "micro-behaviors/communications/socket/tcp::socket-symbol-text", "conf": 0.75, "crit": 3, "desc": "Socket API symbol text", "spans": [ [ 3403, 6 ] ] }, { "id": "micro-behaviors/communications/socket/options::options-set", "conf": 0.6600000262260437, "crit": 3, "desc": "Set socket options", "spans": [ [ 3410, 10 ] ] }, { "id": "micro-behaviors/communications/socket/options::options-get", "conf": 0.6600000262260437, "crit": 3, "desc": "Get socket options", "spans": [ [ 3696, 10 ] ] }, { "id": "micro-behaviors/communications/socket/send::sendmsg-symbol", "atk": "T1071", "mbc": "C0001", "conf": 0.6600000262260437, "crit": 3, "desc": "Uses sendmsg socket call", "spans": [ [ 3460, 7 ] ] }, { "id": "objectives/command-and-control/reverse-shell/pty::pty-dual-mode-backdoor-cond-2--inline-10027", "atk": "T1059.004", "mbc": "B0024", "conf": 0.9300000071525574, "crit": 3, "desc": "Regex component marker", "spans": [ [ 3495, 11 ] ] }, { "id": "micro-behaviors/communications/socket/connect::connect-symbol", "atk": "T1071", "mbc": "C0001", "conf": 0.6600000262260437, "crit": 3, "desc": "Uses connect socket call", "spans": [ [ 3688, 7 ] ] }, { "id": "micro-behaviors/communications/socket/send::send-symbol", "atk": "T1071", "mbc": "C0001", "conf": 0.6600000262260437, "crit": 3, "desc": "Uses send socket call", "spans": [ [ 3490, 4 ] ] }, { "id": "micro-behaviors/communications/socket/listen::socket-sym", "mbc": "C0001", "conf": 0.4000000059604645, "crit": 3, "desc": "socket function symbol", "spans": [ [ 3403, 6 ] ] }, { "id": "micro-behaviors/communications/socket/receive::recvmsg-symbol", "atk": "T1071", "mbc": "C0001", "conf": 0.6600000262260437, "crit": 3, "desc": "Uses recvmsg socket call", "spans": [ [ 3443, 7 ] ] }, { "id": "micro-behaviors/communications/socket/send::_send-symbol", "atk": "T1071", "mbc": "C0001", "conf": 0.6600000262260437, "crit": 3, "desc": "Uses _send socket call", "spans": [ [ 3490, 4 ] ] }, { "id": "micro-behaviors/communications/socket/connect::_connect-symbol", "atk": "T1071", "mbc": "C0001", "conf": 0.6600000262260437, "crit": 3, "desc": "Uses _connect socket call", "spans": [ [ 3688, 7 ] ] }, { "id": "micro-behaviors/communications/socket/listen::listen", "atk": "T1071", "mbc": "C0001", "conf": 0.6600000262260437, "crit": 3, "desc": "Listen on a socket", "spans": [ [ 3403, 6 ], [ 3545, 6 ] ] }, { "id": "micro-behaviors/fs/file/binary::file-read-operation", "atk": "T1005", "conf": 0.75, "crit": 1, "desc": "File read operation", "spans": [ [ 3664, 6 ] ] }, { "id": "micro-behaviors/fs/file/write/direct::write", "conf": 0.6600000262260437, "crit": 2, "desc": "Write files", "spans": [ [ 3483, 6 ] ] }, { "id": "micro-behaviors/dylib/library/libc::libc-internal-functions-b", "conf": 0.699999988079071, "crit": 2, "desc": "libc internal symbols cluster B", "spans": [ [ 3067, 12 ] ] }, { "id": "micro-behaviors/ui/help::usage-label", "conf": 0.75, "crit": 1, "desc": "Command line usage text", "spans": [ [ 25826, 128 ], [ 26515, 96 ] ] }, { "id": "micro-behaviors/dylib/library/abi-graphics::cxx-abi-symbols-a", "conf": 0.800000011920929, "crit": 2, "desc": "C++ ABI symbols cluster A", "spans": [ [ 3067, 12 ] ] } ], "type": "elf" }, { "ctx": [ { "b": "E))420S-r400000000000@$H+0rr91-9@YD00000kMy=:000002+?t10000000000kMA+z4feS[8#{]T1][S6", "n": [ { "c": 3, "d": "Benign PE anti-analysis context", "i": "objectives/anti-analysis/debugger-detect/combined-checks::evasion-aware-benign-pe-context", "o": 0, "z": 22, "cf": 1.0 } ], "ln": 0 }, { "b": "p*seSy?Wuiy?bbmB-RvJCSmP*hz^4cz.r:A0000N0SSjt0000w0000b0000:2SI!:dGx", "n": [ { "c": 3, "d": "Architecture detection strings", "i": "objectives/discovery/host/software::arch-detection", "o": 889, "z": 6, "cf": 0.5 } ], "ln": 873 }, { "b": "0000001/hh00000003wkv%zA?w[=c\u003ey?Xib0af8zwPzu{x(!xcA:JB0vqPN.x(mK30aeq%o\u003c.{L", "n": [ { "c": 3, "d": "Benign network-capable library context", "i": "objectives/supply-chain/trojanized/backdoor::benign-network-library-context", "o": 14011, "z": 12, "cf": 0.8999999761581421 } ], "ln": 13995 }, { "b": "x(i].Aclnz0crl)wPz!\u003ewQ4{h0af8OBywV{uT)++uUi.XyYFJ#A+]r80b=)%xLWV\u0026zG6SgzGGE\u003cuTEw+A=b/5y\u0026r/(BzkVh0b2\u003e+wO#U\u003eB98CjAcRB}z/xo90a{pZvqYVSw[bT}B7Ct-xjVga0cri\u003evqYVSzddl%z^@=*BAg]mz#:/}wO#3)ASyb\u003evpS[.ASyf5A:@%90bMZ#vrqGVy\u0026sxawnc5:w]I)mv/P\u003eyvrlH3A=+V2vqfJTA+e:7zf6s\u0026B98ClA=M8s0chTXB]V5?z/xo90aY[!D2iK\u003evqG:#v/QN(A=bxaC(R]cA:@^60crm5Bz\u003e%}B94", "n": [ { "c": 4, "d": "Sets LD_PRELOAD hooks to hide filesystem", "i": "objectives/evasion/kernel-hide/userspace::preload-rootkit-hook-set", "o": 14242, "z": 5, "cf": 0.9200000166893005 }, { "c": 3, "d": "Stack protector/canary enabled", "i": "metadata/hardening/build::stack-protector", "o": 14174, "z": 14, "cf": 0.8999999761581421 }, { "c": 3, "d": "Converts network to host long", "i": "micro-behaviors/communications/ip/parse::ntohl-symbol", "o": 14196, "z": 5, "cf": 0.6600000262260437 }, { "c": 3, "d": "Uses _recv socket call", "i": "micro-behaviors/communications/socket/receive::_recv-symbol", "o": 14364, "z": 4, "cf": 0.6600000262260437 }, { "c": 3, "d": "Uses recvmsg socket call", "i": "micro-behaviors/communications/socket/receive::recvmsg-symbol", "o": 14347, "z": 7, "cf": 0.6600000262260437 }, { "c": 3, "d": "Dynamic library loading via dlopen", "i": "micro-behaviors/dylib/load/runtime::dlopen", "o": 14369, "z": 6, "cf": 0.8999999761581421 }, { "c": 3, "d": "Core dlopen/dlsym pattern", "i": "micro-behaviors/dylib/load/runtime::dlopen-dlsym", "o": 14376, "z": 5, "cf": 0.8500000238418579 }, { "c": 3, "d": "Read file status and metadata", "i": "micro-behaviors/fs/file/stat::stat", "o": 14312, "z": 5, "cf": 0.800000011920929 }, { "c": 2, "d": "Characteristic libc export __assert_fail", "i": "micro-behaviors/dylib/library/libc::libc-characteristic-assert-fail", "o": 14335, "z": 11, "cf": 0.5 }, { "c": 2, "d": "Uses closedir", "i": "micro-behaviors/fs/directory/readdir::readdir-closedir", "o": 14318, "z": 8, "cf": 0.6600000262260437 }, { "c": 2, "d": "Uses opendir", "i": "micro-behaviors/fs/directory/readdir::readdir-opendir", "o": 14289, "z": 7, "cf": 0.6600000262260437 }, { "c": 2, "d": "Uses readdir", "i": "micro-behaviors/fs/directory/readdir::readdir-readdir", "o": 14297, "z": 7, "cf": 0.6600000262260437 }, { "c": 2, "d": "Generic file read/write operations", "i": "micro-behaviors/fs/file/read-write::binary-file-ops", "o": 14248, "z": 6, "cf": 0.800000011920929 }, { "c": 2, "d": "Write single bytes to file", "i": "micro-behaviors/fs/file/write/direct::fputc", "o": 14327, "z": 5, "cf": 0.6600000262260437 }, { "c": 2, "d": "Environment variable access functions", "i": "micro-behaviors/os/env/vars/access::env-access-comp", "o": 14228, "z": 6, "cf": 0.4000000059604645 }, { "c": 2, "d": "Line-based file reading (fgets)", "i": "micro-behaviors/process/create/direct::fgets-loop", "o": 14262, "z": 5, "cf": 1.0 }, { "c": 2, "d": "Terminates process immediately without cleanup", "i": "micro-behaviors/process/terminate/signal::_exit", "o": 14167, "z": 4, "cf": 0.4000000059604645 } ], "ln": 14151 }, { "b": "BAhFwB.\u003e\u003c]B98CAz!%j\u0026xMOfgyYFc\u003cz/fQ@B98Cuy?mF:zdNM]zeYF-Bz\u003e\u003c[B9R?pz/fd!zGG/gA@Zf4ByO#)ASx]]v{%g}x(dzYvrk}2x(dzYxjVgcx\u003ediRwPRHax\u003ediNvq]N^wPRo#A=kB/v{%s-xjVf(w]7)*0aPCRuT)[-vr8uTvq]N{wPRo#A=kB/v{%s-w].D]0crl)x(i].A+ffdwO}GXwPR:5zE\u0026/?BAg(1Bo3x7A=Vty0chTVy\u00261310cn", "n": [ { "c": 3, "d": "Converts host to network long", "i": "micro-behaviors/communications/ip/parse::htonl-symbol", "o": 14461, "z": 5, "cf": 0.6600000262260437 }, { "c": 3, "d": "Converts host to network short", "i": "micro-behaviors/communications/ip/parse::htons-symbol", "o": 14467, "z": 5, "cf": 0.6600000262260437 }, { "c": 3, "d": "Converts network to host short", "i": "micro-behaviors/communications/ip/parse::ntohs-symbol", "o": 14501, "z": 5, "cf": 0.6600000262260437 }, { "c": 3, "d": "freopen stream redirection import", "i": "micro-behaviors/process/fd/stdio::freopen-import", "o": 14612, "z": 7, "cf": 0.699999988079071 }, { "c": 3, "d": "POSIX user lookup functions", "i": "objectives/discovery/account/enum::passive-user-lookup", "o": 14533, "z": 6, "cf": 0.4000000059604645 }, { "c": 2, "d": "Get effective user ID", "i": "micro-behaviors/os/privilege/query::geteuid", "o": 14540, "z": 7, "cf": 0.5 }, { "c": 2, "d": "cap_get_proc function", "i": "micro-behaviors/os/security/capabilities::cap-get-proc", "o": 14548, "z": 12, "cf": 0.75 }, { "c": 2, "d": "cap_set_proc function", "i": "micro-behaviors/os/security/capabilities::cap-set-proc", "o": 14584, "z": 12, "cf": 0.75 }, { "c": 2, "d": "Query system configuration information", "i": "micro-behaviors/os/sysinfo/config::sysconf", "o": 14493, "z": 7, "cf": 0.4000000059604645 }, { "c": 2, "d": "localtime function (string)", "i": "micro-behaviors/time/query::localtime-string", "o": 14516, "z": 8, "cf": 0.20000000298023224 } ], "ln": 14445 }, { "b": "B98CjB8V0%B98Cyv}Y(.x(mH7uV6$7z#:@\u003cBzbPlBy/ui0crl)z/{d4w[C\u003e4B7+L^wPRQ7B97(pvpS[?0a]}YwO#z^x(^Z8BA)\u003ecBAg(8A=c2o0cR%[A+PAkw=MK.wPRo#Bz(3%AaK6gz/L?\u003cwPS3dzdNS$wmo--B98CmBzkP60ax}/A+PAkw=M)-zE^Q9x8(K/A+PSb0cqZ[B8LM7z/x^#B8LM7wPN]Yx(mCYxjVgaz!0N2vqPMQw].D\u003ewb{jMz!n#YBy/o80a]!.A=k%#B98Csv@MX[x\u003eyZ^zE^s6Bz(59zdJYYw)YB:zdN*cx(mD)CMqO#y*QQ)BAg-3wPRp4gCO@EzFSV$y\u0026alauUr}(uJ", "n": [ { "c": 3, "d": "Parse IP with inet_ntop", "i": "micro-behaviors/communications/ip/parse::inet-ntop-symbol", "o": 14673, "z": 9, "cf": 0.6600000262260437 }, { "c": 3, "d": "Parse IP with inet_pton", "i": "micro-behaviors/communications/ip/parse::inet-pton-symbol", "o": 14755, "z": 9, "cf": 0.6600000262260437 }, { "c": 3, "d": "Resolve address with gethostbyaddr", "i": "micro-behaviors/communications/ip/resolve::resolve-gethostbyaddr", "o": 14708, "z": 13, "cf": 0.6600000262260437 }, { "c": 3, "d": "Bind socket to address", "i": "micro-behaviors/communications/socket/bind/function::bind", "o": 14836, "z": 4, "cf": 0.75 }, { "c": 3, "d": "Looks up name with if_indextoname", "i": "micro-behaviors/communications/socket/interface::if-indextoname-symbol", "o": 14885, "z": 14, "cf": 0.699999988079071 }, { "c": 3, "d": "Looks up index with if_nametoindex", "i": "micro-behaviors/communications/socket/interface::if-nametoindex-symbol", "o": 14900, "z": 14, "cf": 0.699999988079071 }, { "c": 3, "d": "Set socket options", "i": "micro-behaviors/communications/socket/options::options-set", "o": 14818, "z": 10, "cf": 0.6600000262260437 }, { "c": 3, "d": "Uses sendmsg socket call", "i": "micro-behaviors/communications/socket/send::sendmsg-symbol", "o": 14803, "z": 7, "cf": 0.6600000262260437 }, { "c": 3, "d": "Socket API symbol text", "i": "micro-behaviors/communications/socket/tcp::socket-symbol-text", "o": 14829, "z": 6, "cf": 0.75 }, { "c": 2, "d": "Read stream (fread)", "i": "micro-behaviors/fs/file/read::fread", "o": 14853, "z": 5, "cf": 0.699999988079071 }, { "c": 2, "d": "Write files (fwrite)", "i": "micro-behaviors/fs/file/write/direct::write--fwrite", "o": 14811, "z": 6, "cf": 0.6600000262260437 }, { "c": 2, "d": "Detect if running in terminal (isatty)", "i": "micro-behaviors/process/tty/terminal::isatty", "o": 14729, "z": 6, "cf": 0.5 }, { "c": 2, "d": "Format time as string", "i": "micro-behaviors/time/query::strftime", "o": 14785, "z": 8, "cf": 0.20000000298023224 }, { "c": 2, "d": "Execution time measurement APIs", "i": "objectives/anti-analysis/timing/evasion::timing-measurement", "o": 14772, "z": 12, "cf": 0.4000000059604645 } ], "ln": 14657 }, { "b": "e]$}-g5#c8vQ?3cB-RvJCSmP*hz^4cz.r:AA==hnuU1j/A9)Grve%}KByeD!wo6EY0b.", "n": [ { "c": 2, "d": "x86_64 architecture string", "i": "micro-behaviors/os/sysinfo/platform/string::arch-x86-64", "o": 15102, "z": 6, "cf": 0.30000001192092896 } ], "ln": 15086 }, { "b": "zGGk}z!%ujuVZC\u003exjVf(BzkP60cig0y*R0)zFJ^9ze-\u003c5wPq6?x(4)5ASyc4zFSV\u003c", "n": [ { "c": 2, "d": "Get current calendar time (seconds)", "i": "micro-behaviors/time/query::time", "o": 15705, "z": 4, "cf": 0.30000001192092896 } ], "ln": 15689 }, { "b": "z/f=aAb]JiBA)\u003ebBz+]4B7Gl10cig0y*QZ]w[+*)wm5+2zuarXByffdB7]o8wN\u003e^W", "n": [ { "c": 3, "d": "Uses _send socket call", "i": "micro-behaviors/communications/socket/send::_send-symbol", "o": 18684, "z": 4, "cf": 0.6600000262260437 } ], "ln": 18668 }, { "b": "002Mx-1lcUl0MYYl0?Es1R?1q555\u003ck^St?iZ-=nG-@TMM[54B\u003enS0ypIt6qnnS07tnqU\u003e}qu4x^XC", "n": [ { "c": 1, "d": "DJB2 hash algorithm constant (5381)", "i": "objectives/anti-static/obfuscation/imports::djb2-hash-constant", "o": 42365, "z": 11, "cf": 0.75 }, { "c": 1, "d": "DJB2 hash multiply-by-33 instruction", "i": "objectives/anti-static/obfuscation/imports::djb2-multiply-33", "o": 42376, "z": 2, "cf": 0.699999988079071 } ], "ln": 42349 }, { "b": "c37mYaolp$Brz+NB0p}\u003erDzOYwJy@DwO#rbtoDZrr7P\u003eXqY]u*pEmVxlStgjxK#10t{aL5Cw7MdwGS9\u003elp%Wlr3jj+aBtkvBAhguwPRA8Ef}8tarR^HawU*knL-8WauzUdDMT[vtv??@x(v({aBCp-B6A-{Bzk/rx\u003e8i\u0026aBCp-wlSR!vqfL0t{aIqePL67Cu(ts3lQDlarR^HarR^HarR^HarR^H", "n": [ { "c": 3, "d": "Terminal socket exec helper context", "i": "micro-behaviors/process/fd/dup::unix-terminal-socket-exec-benign-context", "o": 65667, "z": 128, "cf": 0.949999988079071 } ], "ln": 65651 }, { "b": "A=k$VazbLjaz2CjA^m#(fj/lnfkkxCz/{ekgb0oXz/{10flItRflp/nA+c[rAb](tBy^iXxl4{kz#.L5ByM$rAb](tBy^iXA=+Vfv@Dr$A@W\u003eoB8\u0026{PxKL{)fkkxCz/{ekgb0V\u0026uVPZ}AaK7\u003cfj/lnfkkxCz/{ekgb0V\u0026uVGZ^y\u0026aj[flItRflp/nA+c[rAb](tBy^iXA=+VewNPy(A@W\u003e8ByM$rAb](tBy^iXA=+V0B7Pb$y?9J0B-RNRB7/05wIm-", "n": [ { "c": 2, "d": "Reference to /etc configuration files", "i": "micro-behaviors/fs/path/config/system::config-etc", "o": 66135, "z": 5, "cf": 0.6600000262260437 } ], "ln": 66119 }, { "b": "B-.gIflhewwohu%wO+(Sfj/lnfkkxCz/{ekgb0JYuVp47Bz(j2flItRflp/nA+c[rz#", "n": [ { "c": 2, "d": "Reference to /etc configuration files", "i": "micro-behaviors/fs/path/config/system::config-etc", "o": 66345, "z": 5, "cf": 0.6600000262260437 } ], "ln": 66329 }, { "b": "flp/nA+c[rAb](tBy^icfj/lnfkkxCz/{ekg5@$sByM$rAb](tBy^iXA=+VcA=l5rA@W\u003eoB8\u0026{PxKL{)fkkw", "n": [ { "c": 2, "d": "Reference to /etc configuration files", "i": "micro-behaviors/fs/path/config/system::config-etc", "o": 66425, "z": 5, "cf": 0.6600000262260437 } ], "ln": 66409 }, { "b": "Bz(j2A=+VcA=l5rB1Q#6fj/lnfkkxCz/{ekgb0V\u0026uTWFQA=u5qBz(j2flItRflp/nAS", "n": [ { "c": 2, "d": "Reference to /etc configuration files", "i": "micro-behaviors/fs/path/config/system::config-etc", "o": 66505, "z": 5, "cf": 0.6600000262260437 } ], "ln": 66489 }, { "b": "x(0=UvpQG[wO#rbc36y[flqzWfjO*bB8%0LwPPNKB1X?X0aP}\u0026y?aVaz/^ahB.LV5aAg+hxL}l}wGUN", "n": [ { "c": 2, "d": "/sys/class/net/ path", "i": "micro-behaviors/os/network/interface::sys-class-net", "o": 67052, "z": 15, "cf": 0.5 } ], "ln": 67036 }, { "b": "x(mH70blsZBt:boAboN}vSDf[xjR6ckr/b]CQmzhtQq6WzVA:JzdN^gvqP%Aash7Kc2r", "n": [ { "c": 1, "d": "bridge interface", "i": "micro-behaviors/os/container/namespace::bridge-str", "o": 67530, "z": 6, "cf": 1.0 } ], "ln": 67514 }, { "b": "wPE?T2{oj*wPq\u003cbA+fqmvpTj?zxJ[fA=2JiB7]Mgi@\u0026Y1ze0\u003e/v{%l$wn=g7i@\u0026/f00", "n": [ { "c": 2, "d": "admin keyword", "i": "objectives/discovery/account/keywords::admin-keyword", "o": 69514, "z": 5, "cf": 0.20000000298023224 } ], "ln": 69498 }, { "b": "Bo3b\u003eB94z6xM57{y\u0026:W#rDzOYwJy@zBAhgujvq?hj{\u003cUKl)9P{iZ1P#wPP4Sp^E#Nq:8sKaz++kBrC@NzeTraBz(gxD)0xDy?Wy8auSE^qCy7N3q:2^o\u0026Ae}jS[SJzdK?LzEEx[j%kj}x\u003eetGx\u003efymmr\u0026lTAbo9biTMg6BAhguy\u0026Y{\u0026v@#:caz(4mx([ol3jgi:A+(\u003ehwPP5jvqPM#w]zP%vr8XY", "n": [ { "c": 3, "d": "Linker and terminal benign dual-mode forwarding", "i": "micro-behaviors/process/fd/dup::unix-dual-mode-socket-exec-benign-context", "o": 70356, "z": 128, "cf": 0.9399999976158142 } ], "ln": 70340 }, { "b": "By^7qzGNNvB.LV5eOO.}e[]iBwPz.\u0026e[Y6Ae[!WmxAfU}D2vXGz2=h0D2vXBASv.8zGNNPwPz\u003caz/bLcxkR\u0026AC4CYnx(v(@ASv.jwD", "n": [ { "c": 2, "d": "ELF dynstr section name", "i": "metadata/binary/linking/static::elf-dynstr-section-name", "o": 106823, "z": 7, "cf": 0.8999999761581421 }, { "c": 2, "d": "ELF dynsym section name", "i": "metadata/binary/linking/static::elf-dynsym-section-name", "o": 106815, "z": 7, "cf": 0.8999999761581421 }, { "c": 2, "d": "ELF interpreter section name", "i": "metadata/binary/linking/static::elf-interpreter-section-name", "o": 106797, "z": 7, "cf": 0.8999999761581421 } ], "ln": 106781 }, { "b": "vr?\u00269wmoN*e]\u003eJte]\u003e\u003ege[xlBvqPZ*04}]5Bo0}7vrt]Te[e)y04}=1zeA\u003c4Bn#pv00000", "n": [ { "c": 2, "d": "ELF dynamic section name", "i": "metadata/binary/linking/static::elf-dynamic-section-name", "o": 106976, "z": 8, "cf": 0.8999999761581421 } ], "ln": 106960 } ], "depth": 1, "facts": { "exp": [ [ "rtnl_statsdump_req_filter" ], [ "jsonw_hhu_field" ], [ "stderr" ], [ "jsonw_luint" ], [ "addattr_l" ], [ "jsonw_bool_field" ], [ "use_iec" ], [ "ll_remember_index" ], [ "af_bit_len" ], [ "init" ], [ "print_color_hhu" ], [ "duparg2" ], [ "jsonw_xint" ], [ "rtnl_group_n2a" ], [ "rtnl_fdb_linkdump_req_filter_fn" ], [ "check_altifname" ], [ "rtnl_linkdump_req" ], [ "rtnl_rttable_a2n" ], [ "invarg" ], [ "jsonw_null_field" ], [ "read_family" ], [ "format_host_r" ], [ "missarg" ], [ "get_prefix_1" ], [ "oper_state_color" ], [ "parse_rtattr" ], [ "stdin" ], [ "get_long" ], [ "rtnl_rtrealm_a2n" ], [ "jsonw_float_field" ], [ "do_batch" ], [ "jsonw_end_object" ], [ "color_fprintf" ], [ "inc_indent" ], [ "parse_mapping_num_all" ], [ "print_uint_name_value" ], [ "proto_n2a" ], [ "rtnl_dump_filter_nc" ], [ "get_guid" ], [ "rtnl_addrdump_req" ], [ "rtnl_nexthopdump_req" ], [ "str_map_lookup_uint" ], [ "rtnl_tunneldump_req" ], [ "jsonw_string_field" ], [ "parse_rtattr_nested_compat" ], [ "ifa_family_color" ], [ "rtnl_send" ], [ "iproute2_hz_internal" ], [ "nl_dump_ext_ack" ], [ "print_num" ], [ "rtnl_dscp_n2a" ], [ "duparg" ], [ "print_color_tv" ], [ "rtnl_dsfield_get_name" ], [ "timestamp_short" ], [ "namehash" ], [ "inet_addr_match" ], [ "show_raw" ], [ "print_range" ], [ "jsonw_printf" ], [ "rta_addattr8" ], [ "print_color_u64" ], [ "addattr16" ], [ "ll_idx_n2a" ], [ "get_u16" ], [ "jsonw_uint_field" ], [ "jsonw_hhu" ], [ "close_json_object" ], [ "rtnl_addrprot_a2n" ], [ "jsonw_start_array" ], [ "addattr_nest_end" ], [ "get_rtnl_link_stats_rta" ], [ "start" ], [ "pretty" ], [ "rtnl_rttable_n2a" ], [ "iproute2_user_hz_internal" ], [ "rtnl_mdbdump_req" ], [ "str_to_bool" ], [ "jsonw_u64_field" ], [ "resolve_hosts" ], [ "jsonw_hu" ], [ "rta_addattr_l" ], [ "ll_drop_by_index" ], [ "uint_to_str" ], [ "nl_proto_a2n" ], [ "rtnl_rtrealm_n2a" ], [ "rta_nest_end" ], [ "rtnl_netconfdump_req" ], [ "nl_dump_ext_ack_done" ], [ "get_addr32" ], [ "addattr32" ], [ "print_color_int" ], [ "get_u32" ], [ "print_color_s64" ], [ "rtnl_neightbldump_req" ], [ "jsonw_lluint_field" ], [ "incomplete_command" ], [ "parse_one_of_deprecated" ], [ "get_unsigned" ], [ "rcvbuf" ], [ "str_split_by_char" ], [ "rtnl_talk" ], [ "rt_addr_n2a_r" ], [ "ll_init_map" ], [ "ll_index_to_name" ], [ "main" ], [ "default_color_opt" ], [ "jsonw_end_array" ], [ "dec_indent" ], [ "parse_one_of" ], [ "jsonw_u64" ], [ "print_color_string" ], [ "get_be16" ], [ "get_addr_rta" ], [ "cmdlineno" ], [ "print_nlmsg_timestamp" ], [ "fini" ], [ "print_name_and_link" ], [ "jsonw_xint_field" ], [ "matches" ], [ "print_color_float" ], [ "matches_color" ], [ "jsonw_bool" ], [ "get_prefix" ], [ "rtnl_dsfield_a2n" ], [ "get_s32" ], [ "rtnl_addrprot_n2a" ], [ "str_map_lookup_u8" ], [ "rt_addr_n2a" ], [ "jsonw_start_object" ], [ "print_color_hu" ], [ "addr64_n2a" ], [ "ll_addr_a2n" ], [ "ll_index_to_type" ], [ "json" ], [ "rta_addattr16" ], [ "print_nl" ], [ "get_str_char_count" ], [ "open_json_array" ], [ "jsonw_int_field" ], [ "get_addr64" ], [ "addattr64" ], [ "nl_proto_n2a" ], [ "get_u64" ], [ "rtnl_rtscope_a2n" ], [ "numeric" ], [ "get_addr" ], [ "rtnl_nexthop_bucket_dump_req" ], [ "jsonw_int" ], [ "get_be32" ], [ "print_string_name_value" ], [ "rtnl_rtprot_a2n" ], [ "jsonw_s64" ], [ "rtnl_routedump_req" ], [ "check_ifname" ], [ "rtnl_dump_request_n" ], [ "mpls_ntop" ], [ "print_color_bool_opt" ], [ "print_color_bool" ], [ "show_stats" ], [ "addattr_nest_compat_end" ], [ "addraw_l" ], [ "parse_on_off" ], [ "get_integer" ], [ "print_color_on_off" ], [ "jsonw_destroy" ], [ "rta_addattr32" ], [ "new_json_obj_plain" ], [ "protodown_reason_a2n" ], [ "stdout" ], [ "show_details" ], [ "print_color_rate" ], [ "rtnl_listen_all_nsid" ], [ "get_time64" ], [ "get_user_hz" ], [ "jsonw_null" ], [ "read_prop" ], [ "rtnl_brvlandump_req" ], [ "ll_name_to_index" ], [ "parse_mapping_gen" ], [ "get_s64" ], [ "SL_" ], [ "drop_cap" ], [ "print_timestamp" ], [ "hexstring_a2n" ], [ "rtnl_linkdump_req_filter" ], [ "alloc_indent_mem" ], [ "jsonw_s64_field" ], [ "jsonw_pretty" ], [ "rtnl_dsfield_n2a" ], [ "rtnl_neighdump_req" ], [ "mask2bits" ], [ "mpls_pton" ], [ "rtnl_send_check" ], [ "print_color_lluint" ], [ "rtnl_dump_request" ], [ "addattrstrz" ], [ "get_time_rtt" ], [ "family_name" ], [ "get_real_family" ], [ "ll_index_to_flags" ], [ "ll_addr_n2a" ], [ "rtnl_listen" ], [ "sprint_time" ], [ "get_be64" ], [ "jsonw_new" ], [ "rtnl_set_strict_dump" ], [ "open_fds_add" ], [ "rtnl_dump_filter_errhndlr_nc" ], [ "jsonw_float" ], [ "parse_mapping" ], [ "rtnl_rtscope_n2a" ], [ "hex2mem" ], [ "get_json_writer" ], [ "print_color_luint" ], [ "print_color_null" ], [ "rtnl_rtprot_n2a" ], [ "get_u8" ], [ "jsonw_string" ], [ "rtnl_talk_suppress_rtnl_errmsg" ], [ "close_json_array" ], [ "inet_addr_match_rta" ], [ "rtnl_echo_talk" ], [ "get_ifname" ], [ "get_float_min_max" ], [ "rtnl_open" ], [ "generic_proc_open" ], [ "rta_addattr64" ], [ "str_map_lookup_u16" ], [ "rtnl_ruledump_req" ], [ "rtnl_from_file" ], [ "addattr_nest" ], [ "format_host" ], [ "protodown_reason_n2a" ], [ "get_hz" ], [ "get_ifname_rta" ], [ "ctrl_genl_util" ], [ "rta_nest" ], [ "rtnl_open_byproto" ], [ "rtnl_group_a2n" ], [ "jsonw_name" ], [ "open_json_object" ], [ "sprint_time64" ], [ "get_time" ], [ "addattr_nest_compat" ], [ "hexstring_n2a" ], [ "parse_rtattr_flags" ], [ "nodev" ], [ "print_color_hex" ], [ "addattr" ], [ "jsonw_uint" ], [ "rtnl_add_nl_group" ], [ "rtnl_linkdump_req_filter_fn" ], [ "print_indent" ], [ "addattr8" ], [ "rtnl_nsiddump_req_filter_fn" ], [ "get_addr_1" ], [ "int_to_str" ], [ "delete_json_obj" ], [ "is_json_context" ], [ "check_enable_color" ], [ "parse_rtattr_one" ], [ "proto_a2n" ], [ "new_json_obj" ], [ "jsonw_hu_field" ], [ "str_map_lookup_str" ], [ "delete_json_obj_plain" ], [ "jsonw_luint_field" ], [ "rtnl_close" ], [ "print_escape_buf" ], [ "rtnl_dscp_a2n" ], [ "rtnl_addrlbldump_req" ], [ "free_indent_mem" ], [ "print_color_0xhex" ], [ "get_float" ], [ "open_fds_close" ], [ "print_color_uint" ], [ "human_readable" ], [ "jsonw_lluint" ] ], "imp": [ [ "", "putchar" ], [ "", "strcpy" ], [ "", "asctime" ], [ "", "if_indextoname" ], [ "", "cap_get_flag" ], [ "", "printf" ], [ "", "sysconf" ], [ "", "cap_clear" ], [ "", "sethostent" ], [ "", "recv" ], [ "", "strerror" ], [ "", "geteuid" ], [ "", "inet_pton" ], [ "", "snprintf" ], [ "", "getenv" ], [ "", "mnl_attr_parse" ], [ "", "fscanf" ], [ "", "fgets" ], [ "", "perror" ], [ "", "cxa_finalize" ], [ "", "getuid" ], [ "", "feof" ], [ "", "malloc" ], [ "", "isatty" ], [ "", "strtoll" ], [ "", "strtoul" ], [ "", "gethostbyaddr" ], [ "", "socket" ], [ "", "readdir" ], [ "", "mnl_attr_get_type" ], [ "", "fflush" ], [ "", "send" ], [ "", "stack_chk_fail" ], [ "", "strtol" ], [ "", "strnlen" ], [ "", "strrchr" ], [ "", "cap_get_proc" ], [ "", "calloc" ], [ "", "strtod" ], [ "", "fprintf" ], [ "", "strcat" ], [ "", "bind" ], [ "", "ntohl" ], [ "", "if_nametoindex" ], [ "", "deregister_frame_info" ], [ "", "mnl_nlmsg_get_payload_len" ], [ "", "setsockopt" ], [ "", "mnl_attr_type_valid" ], [ "", "ITM_registerTMCloneTable" ], [ "", "mnl_attr_get_u32" ], [ "", "lstat" ], [ "", "ferror" ], [ "", "strstr" ], [ "", "sendmsg" ], [ "", "strlcpy" ], [ "", "dlopen" ], [ "", "cap_set_proc" ], [ "", "strncpy" ], [ "", "strcasecmp" ], [ "", "htonl" ], [ "", "realloc" ], [ "", "mnl_nlmsg_get_payload" ], [ "", "memcmp" ], [ "", "sscanf" ], [ "", "fread" ], [ "", "ITM_deregisterTMCloneTable" ], [ "", "dlsym" ], [ "", "strdup" ], [ "", "strtoull" ], [ "", "gettimeofday" ], [ "", "mnl_attr_validate" ], [ "", "fopen" ], [ "", "localtime" ], [ "", "ftell" ], [ "", "fclose" ], [ "", "ntohs" ], [ "", "time" ], [ "", "opendir" ], [ "", "assert_fail" ], [ "", "mnl_attr_get_str" ], [ "", "putc" ], [ "", "strcmp" ], [ "", "sprintf" ], [ "", "asprintf" ], [ "", "strtof" ], [ "", "strcspn" ], [ "", "fputc" ], [ "", "strftime" ], [ "", "fwrite" ], [ "", "htons" ], [ "", "freopen" ], [ "", "errno_location" ], [ "", "exit" ], [ "", "inet_ntop" ], [ "", "atoi" ], [ "", "fileno" ], [ "", "getline" ], [ "", "strspn" ], [ "", "libc_start_main" ], [ "", "strlen" ], [ "", "cap_free" ], [ "", "strchr" ], [ "", "fputs" ], [ "", "closedir" ], [ "", "recvmsg" ], [ "", "strchrnul" ], [ "", "register_frame_info" ], [ "", "close" ], [ "", "vfprintf" ], [ "", "free" ], [ "", "getsockname" ] ], "sec": [ [ ".note.gnu.property", 792, 48, 1.94, "alloc" ], [ ".note.gnu.build-id", 840, 36, 4.19, "alloc" ], [ ".interp", 876, 25, 4.05, "alloc" ], [ ".gnu.hash", 904, 3644, 4.55, "alloc" ], [ ".dynsym", 4552, 9456, 2.37, "alloc" ], [ ".dynstr", 14008, 5106, 4.42, "alloc" ], [ ".gnu.version", 19114, 788, 1.07, "alloc" ], [ ".gnu.version_r", 19904, 32, 2.17, "alloc" ], [ ".rela.dyn", 19936, 2712, 1.76, "alloc" ], [ ".rela.plt", 22648, 24, 1.22, "alloc,info_link" ], [ ".relr.dyn", 22672, 120, 2.67, "alloc" ], [ ".init", 24576, 3, 1.58, "alloc,executable" ], [ ".plt", 24592, 32, 3.05, "alloc,executable" ], [ ".text", 24624, 39616, 6.24, "alloc,executable" ], [ ".fini", 64240, 3, 1.58, "alloc,executable" ], [ ".rodata", 65536, 5840, 5.28, "alloc" ], [ ".eh_frame_hdr", 71376, 2516, 5.27, "alloc" ], [ ".eh_frame", 73896, 11988, 4.89, "alloc" ], [ ".init_array", 88304, 8, 1.06, "write,alloc" ], [ ".fini_array", 88312, 8, 1.06, "write,alloc" ], [ ".data.rel.ro", 88320, 280, 2.02, "write,alloc" ], [ ".dynamic", 88600, 576, 1.51, "write,alloc" ], [ ".got", 89176, 912, 0.06, "write,alloc" ], [ ".data", 90112, 16608, 0.14, "write,alloc" ], [ ".comment", 106720, 28, 3.99, "merge,strings" ], [ ".shstrtab", 106748, 262, 4.18, "" ] ], "metrics": { "elf": { "bits": 64.0, "entry": 25284.0, "has_got": 1.0, "has_plt": 1.0, "has_note": 1.0, "note_count": 2.0, "nx_enabled": 1.0, "has_dt_relr": 1.0, "dynrel_count": 0.0, "dynsym_count": 394.0, "has_build_id": 1.0, "has_eh_frame": 1.0, "has_gnu_hash": 1.0, "stack_canary": 1.0, "symtab_count": 0.0, "dynrela_count": 113.0, "little_endian": 1.0, "dt_flags_1_raw": 134217729.0, "pltreloc_count": 1.0, "build_id_length": 20.0, "dt_versym_count": 394.0, "executable_stack": 0.0, "fini_array_count": 1.0, "init_array_count": 1.0, "wx_segment_count": 0.0, "comment_entry_count": 1.0, "program_header_count": 13.0, "comment_distinct_count": 1.0, "gnu_stack_section_absent": 0.0, "load_segment_max_file_size": 39667.0, "stripped_but_symtab_present": 0.0, "load_segment_max_memory_size": 39667.0, "section_relocation_group_count": 2.0, "stripped_metadata_section_count": 7.0 }, "file": { "size": 108808.0, "entropy": 4.87, "size_bytes": 108808.0 }, "binary": { "is_pie": 1.0, "has_overlay": 1.0, "is_stripped": 1.0, "code_entropy": 6.23, "data_entropy": 0.21, "overlay_size": 1798.0, "string_count": 629.0, "overlay_ratio": 0.02, "overall_entropy": 4.87, "overlay_entropy": 1.53, "entropy_variance": 2.87, "avg_string_length": 15.59, "max_string_length": 220.0, "peak_region_bytes": 31744.0, "code_to_data_ratio": 0.68, "peak_region_entropy": 6.26, "string_length_stddev": 14.95, "largest_section_ratio": 0.36, "sentence_string_count": 85.0, "sentence_string_ratio": 0.14, "high_entropy_string_count": 0.0 }, "exports": { "count": 279.0 }, "imports": { "count": 111.0 }, "sections": { "count": 28.0, "code_size": 39654.0, "entropy_max": 6.24, "entropy_mean": 2.78, "name_entropy": 4.13, "writable_count": 7.0, "executable_count": 4.0, "nonstandard_count": 6.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 3.0 } } }, "id": 6, "mol": "O(Er)H₄(Cm₈DsFPo)", "path": "iproute2-7.1.0-r0.apk!!sbin/genl", "risk": 6, "sha": "441f66e7a97c45c5c5a7ac2082f43ae3befaff6607c35c84a031f3455d456fcd", "size": 108808, "traits": [ { "id": "micro-behaviors/fs/file/read::fscanf", "conf": 0.699999988079071, "crit": 2, "desc": "Formatted input from file", "spans": [ [ 14248, 6 ] ] }, { "id": "micro-behaviors/fs/directory/readdir::readdir-readdir", "conf": 0.6600000262260437, "crit": 2, "desc": "Uses readdir", "spans": [ [ 14297, 7 ] ] }, { "id": "micro-behaviors/communications/socket/bind/function::bind", "conf": 0.75, "crit": 3, "desc": "Bind socket to address", "spans": [ [ 14836, 4 ] ] }, { "id": "micro-behaviors/communications/ip/resolve::resolve-gethostbyaddr", "conf": 0.6600000262260437, "crit": 3, "desc": "Resolve address with gethostbyaddr", "spans": [ [ 14708, 13 ] ] }, { "id": "micro-behaviors/communications/ip/parse::inet-ntop-symbol", "conf": 0.6600000262260437, "crit": 3, "desc": "Parse IP with inet_ntop", "spans": [ [ 14673, 9 ] ] }, { "id": "micro-behaviors/ui/help::usage-title", "crit": 2, "desc": "Usage: label (title case)", "spans": [ [ 65667, 128 ], [ 70356, 128 ] ] }, { "id": "micro-behaviors/dylib/library/libc::libc-characteristic-cxa-finalize", "crit": 2, "desc": "libc characteristic cxa finalize", "spans": [ [ 14011, 12 ] ] }, { "id": "micro-behaviors/fs/file/open::fopen", "conf": 0.6600000262260437, "crit": 3, "desc": "Open files", "spans": [ [ 14242, 5 ] ] }, { "id": "micro-behaviors/ui/help::usage-title-string", "crit": 1, "desc": "Usage: label in binary strings", "spans": [ [ 65667, 128 ], [ 70356, 128 ] ] }, { "id": "micro-behaviors/communications/ip/parse::ntohl-symbol", "conf": 0.6600000262260437, "crit": 3, "desc": "Converts network to host long", "spans": [ [ 14196, 5 ] ] }, { "id": "micro-behaviors/communications/ip/parse::inet-pton-symbol", "conf": 0.6600000262260437, "crit": 3, "desc": "Parse IP with inet_pton", "spans": [ [ 14755, 9 ] ] }, { "id": "micro-behaviors/communications/socket/receive::_recv-symbol", "atk": "T1071", "mbc": "C0001", "conf": 0.6600000262260437, "crit": 3, "desc": "Uses _recv socket call", "spans": [ [ 14364, 4 ] ] }, { "id": "micro-behaviors/fs/directory/readdir::readdir-opendir", "conf": 0.6600000262260437, "crit": 2, "desc": "Uses opendir", "spans": [ [ 14289, 7 ] ] }, { "id": "micro-behaviors/fs/file/write/direct::write--fwrite", "conf": 0.6600000262260437, "crit": 2, "desc": "Write files (fwrite)", "spans": [ [ 14811, 6 ] ] }, { "id": "metadata/binary/metrics/threshold::many-imports-50", "conf": 1.0, "crit": 1, "desc": "Binary has 50+ imports", "spans": [ [ 0, 22 ] ] }, { "id": "micro-behaviors/communications/socket/receive::recv-symbol", "atk": "T1071", "mbc": "C0001", "conf": 0.6600000262260437, "crit": 3, "desc": "Uses recv socket call", "spans": [ [ 14364, 4 ] ] }, { "id": "micro-behaviors/os/privilege/query::getuid", "crit": 2, "desc": "Get user ID", "spans": [ [ 14533, 6 ] ] }, { "id": "micro-behaviors/communications/socket/interface::if-nametoindex-symbol", "conf": 0.699999988079071, "crit": 3, "desc": "Looks up index with if_nametoindex", "spans": [ [ 14900, 14 ] ] }, { "id": "micro-behaviors/fs/file/read::fread", "conf": 0.699999988079071, "crit": 2, "desc": "Read stream (fread)", "spans": [ [ 14853, 5 ] ] }, { "id": "micro-behaviors/communications/socket/interface::if-indextoname-symbol", "conf": 0.699999988079071, "crit": 3, "desc": "Looks up name with if_indextoname", "spans": [ [ 14885, 14 ] ] }, { "id": "micro-behaviors/communications/socket/tcp::socket-symbol-text", "conf": 0.75, "crit": 3, "desc": "Socket API symbol text", "spans": [ [ 14829, 6 ] ] }, { "id": "micro-behaviors/communications/socket/options::options-set", "conf": 0.6600000262260437, "crit": 3, "desc": "Set socket options", "spans": [ [ 14818, 10 ] ] }, { "id": "micro-behaviors/fs/file/read::fread-text", "conf": 0.6200000047683716, "crit": 2, "desc": "fread API string", "spans": [ [ 14853, 5 ] ] }, { "id": "micro-behaviors/communications/ip/parse::ntohs-symbol", "conf": 0.6600000262260437, "crit": 3, "desc": "Converts network to host short", "spans": [ [ 14501, 5 ] ] }, { "id": "micro-behaviors/dylib/lookup::dlsym-symbol", "conf": 0.8999999761581421, "crit": 2, "desc": "dlsym function symbol", "spans": [ [ 14376, 5 ] ] }, { "id": "micro-behaviors/os/privilege/query::geteuid", "crit": 2, "desc": "Get effective user ID", "spans": [ [ 14540, 7 ] ] }, { "id": "micro-behaviors/fs/directory/readdir::readdir-closedir", "conf": 0.6600000262260437, "crit": 2, "desc": "Uses closedir", "spans": [ [ 14318, 8 ] ] }, { "id": "micro-behaviors/communications/ip/parse::htonl-symbol", "conf": 0.6600000262260437, "crit": 3, "desc": "Converts host to network long", "spans": [ [ 14461, 5 ] ] }, { "id": "micro-behaviors/process/fd/stdio::freopen-import", "conf": 0.699999988079071, "crit": 3, "desc": "freopen stream redirection import", "spans": [ [ 14612, 7 ] ] }, { "id": "micro-behaviors/communications/ip/parse::htons-symbol", "conf": 0.6600000262260437, "crit": 3, "desc": "Converts host to network short", "spans": [ [ 14467, 5 ] ] }, { "id": "objectives/evasion/process/injection/memory::asm-manual-import-parsing-cond-2--inline-18287", "conf": 0.8999999761581421, "crit": 3, "desc": "High export-count binary context", "spans": [ [ 0, 22 ] ] }, { "id": "micro-behaviors/communications/socket/send::sendmsg-symbol", "atk": "T1071", "mbc": "C0001", "conf": 0.6600000262260437, "crit": 3, "desc": "Uses sendmsg socket call", "spans": [ [ 14803, 7 ] ] }, { "id": "micro-behaviors/communications/socket/send::send-symbol", "atk": "T1071", "mbc": "C0001", "conf": 0.6600000262260437, "crit": 3, "desc": "Uses send socket call", "spans": [ [ 18684, 4 ] ] }, { "id": "micro-behaviors/dylib/load/runtime::dlopen", "atk": "T1574.006", "conf": 0.8999999761581421, "crit": 3, "desc": "Dynamic library loading via dlopen", "spans": [ [ 14369, 6 ] ] }, { "id": "micro-behaviors/communications/socket/listen::socket-sym", "mbc": "C0001", "conf": 0.4000000059604645, "crit": 3, "desc": "socket function symbol", "spans": [ [ 14829, 6 ] ] }, { "id": "micro-behaviors/communications/socket/receive::recvmsg-symbol", "atk": "T1071", "mbc": "C0001", "conf": 0.6600000262260437, "crit": 3, "desc": "Uses recvmsg socket call", "spans": [ [ 14347, 7 ] ] }, { "id": "micro-behaviors/communications/socket/send::_send-symbol", "atk": "T1071", "mbc": "C0001", "conf": 0.6600000262260437, "crit": 3, "desc": "Uses _send socket call", "spans": [ [ 18684, 4 ] ] }, { "id": "micro-behaviors/fs/file/binary::file-read-operation", "atk": "T1005", "conf": 0.75, "crit": 1, "desc": "File read operation", "spans": [ [ 14248, 6 ], [ 14853, 5 ] ] }, { "id": "micro-behaviors/fs/file/write/direct::write", "conf": 0.6600000262260437, "crit": 2, "desc": "Write files", "spans": [ [ 14811, 6 ] ] }, { "id": "micro-behaviors/dylib/library/libc::libc-internal-functions-b", "conf": 0.699999988079071, "crit": 2, "desc": "libc internal symbols cluster B", "spans": [ [ 14011, 12 ] ] }, { "id": "micro-behaviors/ui/help::usage-label", "conf": 0.75, "crit": 1, "desc": "Command line usage text", "spans": [ [ 65667, 128 ], [ 70356, 128 ] ] }, { "id": "micro-behaviors/dylib/library/abi-graphics::cxx-abi-symbols-a", "conf": 0.800000011920929, "crit": 2, "desc": "C++ ABI symbols cluster A", "spans": [ [ 14011, 12 ] ] }, { "id": "micro-behaviors/dylib/load/runtime::dlopen-dlsym", "atk": "T1574.006", "conf": 0.8500000238418579, "crit": 3, "desc": "Core dlopen/dlsym pattern", "spans": [ [ 14369, 6 ], [ 14376, 5 ] ] } ], "type": "elf" }, { "ctx": [ { "b": "E))420S-r400000000000@$H+0rr91-3tr.00000kMy=:00000U.-wX0000000000kMA+z4feS[8#{]T1][S61o", "n": [ { "c": 3, "d": "Benign PE anti-analysis context", "i": "objectives/anti-analysis/debugger-detect/combined-checks::evasion-aware-benign-pe-context", "o": 0, "z": 21, "cf": 1.0 } ], "ln": 0 }, { "b": "\u003eGi9Ay?Wuiy?bbmB-RvJCSmP*hz^4cz.r:A000040001b000010000600000FGK@y1Yb", "n": [ { "c": 3, "d": "Architecture detection strings", "i": "objectives/discovery/host/software::arch-detection", "o": 889, "z": 6, "cf": 0.5 } ], "ln": 873 }, { "b": "0000000\u0026M800000003wkv%zA?w[=c\u003ey?Xib0af8zwPzu{x(!xcA:JB0vqPN.x(mK30aeq%o\u003c.{L", "n": [ { "c": 3, "d": "Benign network-capable library context", "i": "objectives/supply-chain/trojanized/backdoor::benign-network-library-context", "o": 3395, "z": 12, "cf": 0.8999999761581421 } ], "ln": 3379 }, { "b": "x(i](ByX%6ASxY\u003cB-.W8wQ4{h0crm5v@le+B97@hB-WR8BAhFwB.?4+uVQr$v@2BYxLQ%!vqfJTxjVgawPz%6D2v5cwDlQ\u0026z!Kg(B8C@qx(n380ax$/x-IHEwPz*ez^Ns0v{%E[z/bL@BAhFwyYFA=A=M8s0blsZByf0ez/bL*Bz(5r0c075v}Yp\u003e0cqZ?wb{W)A+]r80crm5v@MX[B98CAz!/t]BAg(8ASyf5A==kxy?%8=zE)]%zGG/o0b2\u003e+BzkP6z!rJ*C(RV0v{%g}x(dzYvrk}2x(dzYw]I)mv/QaYwN$\u003c.D2)FlzE@(^Bz\u003e\u0026e0bcE)zFPq]BAhnnwO}G?ByY960a{m.z/xo90crm5wPz*fASx--BzLVewDl^[A:@K10crm5B98B5", "n": [ { "c": 3, "d": "Stack protector/canary enabled", "i": "metadata/hardening/build::stack-protector", "o": 3580, "z": 14, "cf": 0.8999999761581421 }, { "c": 3, "d": "Converts host to network long", "i": "micro-behaviors/communications/ip/parse::htonl-symbol", "o": 3792, "z": 5, "cf": 0.6600000262260437 }, { "c": 3, "d": "Converts host to network short", "i": "micro-behaviors/communications/ip/parse::htons-symbol", "o": 3670, "z": 5, "cf": 0.6600000262260437 }, { "c": 3, "d": "Parse IP with inet_ntop", "i": "micro-behaviors/communications/ip/parse::inet-ntop-symbol", "o": 3726, "z": 9, "cf": 0.6600000262260437 }, { "c": 3, "d": "Parse IP with inet_pton", "i": "micro-behaviors/communications/ip/parse::inet-pton-symbol", "o": 3660, "z": 9, "cf": 0.6600000262260437 }, { "c": 3, "d": "Converts network to host long", "i": "micro-behaviors/communications/ip/parse::ntohl-symbol", "o": 3786, "z": 5, "cf": 0.6600000262260437 }, { "c": 3, "d": "Converts network to host short", "i": "micro-behaviors/communications/ip/parse::ntohs-symbol", "o": 3609, "z": 5, "cf": 0.6600000262260437 }, { "c": 3, "d": "Uses _send socket call", "i": "micro-behaviors/communications/socket/send::_send-symbol", "o": 3684, "z": 4, "cf": 0.6600000262260437 }, { "c": 3, "d": "freopen stream redirection import", "i": "micro-behaviors/process/fd/stdio::freopen-import", "o": 3812, "z": 7, "cf": 0.699999988079071 }, { "c": 2, "d": "Write single bytes to file", "i": "micro-behaviors/fs/file/write/direct::fputc", "o": 3767, "z": 5, "cf": 0.6600000262260437 }, { "c": 2, "d": "Query system configuration information", "i": "micro-behaviors/os/sysinfo/config::sysconf", "o": 3778, "z": 7, "cf": 0.4000000059604645 }, { "c": 2, "d": "Terminates process immediately without cleanup", "i": "micro-behaviors/process/terminate/signal::_exit", "o": 3551, "z": 4, "cf": 0.4000000059604645 }, { "c": 2, "d": "localtime function (string)", "i": "micro-behaviors/time/query::localtime-string", "o": 3750, "z": 8, "cf": 0.20000000298023224 }, { "c": 2, "d": "Get current calendar time (seconds)", "i": "micro-behaviors/time/query::time", "o": 3762, "z": 4, "cf": 0.30000001192092896 }, { "c": 2, "d": "Execution time measurement APIs", "i": "objectives/anti-analysis/timing/evasion::timing-measurement", "o": 3736, "z": 12, "cf": 0.4000000059604645 } ], "ln": 3535 }, { "b": "0crm5B8V0%B98CjB8V0%xjVf@zGV1(x(4u#zVBG)vruQp0crm5A:@^60cri\u003evqYVSw]zT1zuaoUy\u0026sxa0cqZ[B8LM7z/x^#w[LW%A@Zo6A+6ri0b(*/zE^E40chTVwmPy{0bMZ#vrqG^vqG:#v/Q1Pz/YG2x(ThXuTX1%wPz)1w)]y\u00260chTXC5qqk0cqZ?wnMy20cqZ[zGt/2zGxG1A+bk/z/]@t0cJc%B-8pR0crl\u003cBARnq0a]?VB-Ri@B98CjxMw0kyYFS\u003cAb]VgBy\u003eI]z!0M]Bo2=:zE--WwPS0iv@2%\u003czdJYVCxdztwDls.wNP9Hw[t))0a{s:y?%8-wPz*fASx/=uUKy*wQ5rnzEEx[0bl4LzEEx[Bz\u003e(hwmY#=zeKe%vruQiuUr}(uV!dW0bVQ\u0026uV6W%B7X\u0026)wPRn", "n": [ { "c": 4, "d": "Sets LD_PRELOAD hooks to hide filesystem", "i": "objectives/evasion/kernel-hide/userspace::preload-rootkit-hook-set", "o": 3910, "z": 5, "cf": 0.9200000166893005 }, { "c": 3, "d": "Bind socket to address", "i": "micro-behaviors/communications/socket/bind/function::bind", "o": 4084, "z": 4, "cf": 0.75 }, { "c": 3, "d": "Looks up name with if_indextoname", "i": "micro-behaviors/communications/socket/interface::if-indextoname-symbol", "o": 4132, "z": 14, "cf": 0.699999988079071 }, { "c": 3, "d": "Looks up index with if_nametoindex", "i": "micro-behaviors/communications/socket/interface::if-nametoindex-symbol", "o": 4147, "z": 14, "cf": 0.699999988079071 }, { "c": 3, "d": "Set socket options", "i": "micro-behaviors/communications/socket/options::options-set", "o": 3923, "z": 10, "cf": 0.6600000262260437 }, { "c": 3, "d": "Uses recvmsg socket call", "i": "micro-behaviors/communications/socket/receive::recvmsg-symbol", "o": 3999, "z": 7, "cf": 0.6600000262260437 }, { "c": 3, "d": "Uses sendmsg socket call", "i": "micro-behaviors/communications/socket/send::sendmsg-symbol", "o": 4007, "z": 7, "cf": 0.6600000262260437 }, { "c": 3, "d": "Socket API symbol text", "i": "micro-behaviors/communications/socket/tcp::socket-symbol-text", "o": 4077, "z": 6, "cf": 0.75 }, { "c": 3, "d": "Read file status and metadata (core)", "i": "micro-behaviors/fs/file/stat::stat-core", "o": 3963, "z": 5, "cf": 0.800000011920929 }, { "c": 3, "d": "Mount file systems", "i": "micro-behaviors/fs/volume/mount::mount-fn", "o": 4029, "z": 5, "cf": 0.6600000262260437 }, { "c": 3, "d": "Unmount file system", "i": "micro-behaviors/fs/volume/umount::umount2-fn", "o": 4035, "z": 7, "cf": 0.6600000262260437 }, { "c": 2, "d": "Characteristic libc export __assert_fail", "i": "micro-behaviors/dylib/library/libc::libc-characteristic-assert-fail", "o": 3987, "z": 11, "cf": 0.5 }, { "c": 2, "d": "Uses closedir", "i": "micro-behaviors/fs/directory/readdir::readdir-closedir", "o": 3976, "z": 8, "cf": 0.6600000262260437 }, { "c": 2, "d": "Uses opendir", "i": "micro-behaviors/fs/directory/readdir::readdir-opendir", "o": 3947, "z": 7, "cf": 0.6600000262260437 }, { "c": 2, "d": "Uses readdir", "i": "micro-behaviors/fs/directory/readdir::readdir-readdir", "o": 3955, "z": 7, "cf": 0.6600000262260437 }, { "c": 2, "d": "Generic file read/write operations", "i": "micro-behaviors/fs/file/read-write::binary-file-ops", "o": 4108, "z": 5, "cf": 0.800000011920929 }, { "c": 2, "d": "Write files (fwrite)", "i": "micro-behaviors/fs/file/write/direct::write--fwrite", "o": 4101, "z": 6, "cf": 0.6600000262260437 }, { "c": 2, "d": "Environment variable access functions", "i": "micro-behaviors/os/env/vars/access::env-access-comp", "o": 3874, "z": 6, "cf": 0.4000000059604645 }, { "c": 2, "d": "Line-based file reading (fgets)", "i": "micro-behaviors/process/create/direct::fgets-loop", "o": 3934, "z": 5, "cf": 1.0 }, { "c": 2, "d": "Detect if running in terminal (isatty)", "i": "micro-behaviors/process/tty/terminal::isatty", "o": 3888, "z": 6, "cf": 0.5 } ], "ln": 3858 }, { "b": "e]$}-g5#c8vQ?3cB-RvJCSmP*hz^4cz.r:AoI4MBpe21He?^n9009620096200962009", "n": [ { "c": 2, "d": "x86_64 architecture string", "i": "micro-behaviors/os/sysinfo/platform/string::arch-x86-64", "o": 4349, "z": 6, "cf": 0.30000001192092896 } ], "ln": 4333 }, { "b": "Jtf=hI9\u0026%/IbKWJI9\u003cnj1R?1q5583zGWK@HyRR8:%ht2=(*vr66^*r*044TE002MHA$y)248LL(oaR", "n": [ { "c": 1, "d": "DJB2 hash algorithm constant (5381)", "i": "objectives/anti-static/obfuscation/imports::djb2-hash-constant", "o": 54781, "z": 11, "cf": 0.75 }, { "c": 1, "d": "DJB2 hash multiply-by-33 instruction", "i": "objectives/anti-static/obfuscation/imports::djb2-multiply-33", "o": 54793, "z": 2, "cf": 0.699999988079071 } ], "ln": 54765 }, { "b": "00000000000000000000rDzOYwJy@yA+P5%wGUh1pF+1ZpFK?ht{8{fn\u003c#9DaBtj#pFBLHpdcjLaztt5A3fMoarR^HarR!oA+P5%wGUh1eOn{wv}u=*at45hByO#bw[=6)zEEx[3u{e{A+cvopEmVxlStf?jS]7]y?W^5aBCqzwmuWeaz\u003eT#aBCqGB95KLaA?NfzxKrHC5z1pD)0oAzFsihAV/=q", "n": [ { "c": 3, "d": "Terminal socket exec helper context", "i": "micro-behaviors/process/fd/dup::unix-terminal-socket-exec-benign-context", "o": 69632, "z": 128, "cf": 0.949999988079071 } ], "ln": 69616 }, { "b": "BAz!lat4tjB8L@4aBKN%rDzOYwJy@yA+P5%wGUO}vJZ1uvpS)\u003eD(#\u003cpAaJ]$aBCqxwO-GpaAz4jy***+aBLv#l{%]}wmY{bl}7b-arR^HarR^HarR^HarT(hB7Gf1ayc9]az\u003eLdBy/Fnt{9t]B-Rapt{9t]A=l8xwPw]0ax]$1CYWIqzEmi\u003evrcldt).X%arR^HarR^HarR^HtoF0ex\u003e7}7ayc9]", "n": [ { "c": 3, "d": "Linker and terminal benign dual-mode forwarding", "i": "micro-behaviors/process/fd/dup::unix-dual-mode-socket-exec-benign-context", "o": 69985, "z": 128, "cf": 0.9399999976158142 } ], "ln": 69969 }, { "b": "toEc/z^vy4B-.hnaybrOrDzOYwJy@yA+P5%wGU/6zFHwowPP59wP/g:mogKnay/thBrA}Dq=B(Bax]$cA+PDjx([Ryp/o\u003eXayc9]aAITkBy=N[r6:FLaybr%arR^HarR^HarR^HarR^HarR^HarR^HarR^HarT(hxlvT6wfukqzxKrHz!rQfaybr%arR^HarR^HarR^HarR^HarR^HarR^HarR^H", "n": [ { "c": 3, "d": "Benign socket shell helper context", "i": "micro-behaviors/process/fd/dup::posix-fd-redirect-shell-benign-context", "o": 70940, "z": 128, "cf": 0.9399999976158142 } ], "ln": 70924 }, { "b": "zddHcwPw[Ymoh#Emo{l2rDzOYwJy@yA+P5%wGU\u00262vJZ1uvpS)\u003eD(#%hy-[9FA+fiavpJ\u003c\u003eEir6iB%6gwrV(v1A=-B2pF$dmxl4@lm]Ab.p-@$-A:{j\u003cpGppWmo}3uAaK6bvqYT]BrC@NBy/rdt{9u{x\u003eet!nKM?\u003earR^HarR^HarR^HarT(hw[=76wPzc{z!9A4DMW3uv@co#wGVvywQ4Z3B.25a", "n": [ { "c": 2, "d": "Usage: label (title case)", "i": "micro-behaviors/ui/help::usage-title", "o": 72336, "z": 128, "cf": 0.5 } ], "ln": 72320 }, { "b": "arR^HayYw9wm]D@zdE8#w]8QhxDQ?%B%6gwrV\u003eP?AbP=saw+\u003cir3kD?toF96wfs]Al)b+TtoF0cv{:y%x={tLlTJ\u003e?nD", "n": [ { "c": 1, "d": "Lists or flushes hidden ports", "i": "objectives/evasion/kernel-hide/ebpf::bpf-rootkit-controller-actions--rx-9", "o": 72793, "z": 25, "cf": 0.7799999713897705 } ], "ln": 72777 }, { "b": "ayc9]aA?TpaxzleaybrOrDzOYwJy@yA+P5%wGU\u0026hBrCToBrCa9B%6gwrV(m2Bzh\u003c(q=DshB97\u0026jwGT]Jk#ZnWarR^HarR!oA+P5%wGU\u0026hBrC{KxM59yax]$0wP/g:mogKp3ij7Evp%djayYw9wm]D@C5gP8aBtktwmM*gay]51aBLwQx\u003eet!oHhAXnKKXiwP/g:mogKnaAR:zzE)S\u003ex(mK3azCver8(W*mnd5Wl)b+xarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^Hax]$cC4\u003eFft{9t]B-8qfxj\u003e^^aybr%arQ", "n": [ { "c": 2, "d": "Usage: label (title case)", "i": "micro-behaviors/ui/help::usage-title", "o": 72951, "z": 88, "cf": 0.5 } ], "ln": 72935 }, { "b": "aA?Efaxzf4pg3NXaybrOrDzOYwJy@yA+P5%wGVelx=}:BvpS)\u003eD(#%hy-[cGC5z1pr.=i[2)\u003c/UDMV%wz/{1wD)0DvzeTJcaBLw7p*VHRl@DDLqY]uM2)\u003ecNB%6gwrTG@(arR^HayYw9wm]D@C5z1pDMWxyz*9sLax]$0wP/g:mogKp3jo\u003cFwPzuy306!)2%7i(fFb1qh-AVJf/oprlVl*UvqYP#", "n": [ { "c": 2, "d": "Usage: label (title case)", "i": "micro-behaviors/ui/help::usage-title", "o": 74651, "z": 128, "cf": 0.5 } ], "ln": 74635 }, { "b": "x\u003edLJlT:\u003eIz/^aywO#33B8kodwGUJazeZRrwPq\u003c7B94ydeIPe8arR%Zf/Kd@azk.kBP", "n": [ { "c": 3, "d": "Slave keyword", "i": "objectives/command-and-control/botnet/keywords::slave-term", "o": 75931, "z": 5, "cf": 0.4000000059604645 } ], "ln": 75915 }, { "b": "08MM?o?wnJ08k:Tr7fW+q+PFTmf2.AlrcIQl%inJo?vXLk#*(Wo*}Dwk(:.SqDcN-oA", "n": [ { "c": 3, "d": "Slave keyword", "i": "objectives/command-and-control/botnet/keywords::slave-term", "o": 79188, "z": 5, "cf": 0.4000000059604645 } ], "ln": 79172 }, { "b": "wO=rfe^.O\u003cx(4tXw[kuJrDzOYwJy@yA+P5%wGU\u0026dzFsihAV!N#x(4u6D)0ltzFHwxazbd[aBCqGwmuWeaA?NfzxKrHC5z1pD(#\u003cly*vwFl2{QXzdNQbar\u0026aMa%pPvaA.NqzF%-pefG4PC{0", "n": [ { "c": 2, "d": "Usage: label (title case)", "i": "micro-behaviors/ui/help::usage-title", "o": 80452, "z": 66, "cf": 0.5 } ], "ln": 80436 }, { "b": "flp/nA+c[rAb](tBy^icfj/lnfkkxCz/{ekg5%:-A=k%#s7cb!x(mL-yiarhuW3K8Bn", "n": [ { "c": 2, "d": "Reference to /etc configuration files", "i": "micro-behaviors/fs/path/config/system::config-etc", "o": 81548, "z": 5, "cf": 0.6600000262260437 } ], "ln": 81532 }, { "b": "c37mYaolp$Brz+NB0p}\u003efj/lnfkkxCz/{ekgb0V\u0026uVp47Bz(j2flItRflp/nA+c[rz#", "n": [ { "c": 2, "d": "Reference to /etc configuration files", "i": "micro-behaviors/fs/path/config/system::config-etc", "o": 82089, "z": 5, "cf": 0.6600000262260437 } ], "ln": 82073 }, { "b": "x\u003eeu5y**\u003c+AXmX0flQ=AflhhMfk+uyzGt!BvqY$3BrCHvwO@SdwPScmA+=!nvqPN%Aa9l/ar*", "n": [ { "c": 1, "d": "Reference to /run", "i": "micro-behaviors/fs/path/system::system-run", "o": 82178, "z": 10, "cf": 0.6600000262260437 } ], "ln": 82162 }, { "b": "B9R*Hw)]y\u0026wN)?Ac36y[fj/lnfk+uyzGt!hwPRAnc365Mx(mD7c37gXj%hd)azb4@y?mcrash7o0cqZ/", "n": [ { "c": 2, "d": "Reference to /etc configuration files", "i": "micro-behaviors/fs/path/config/system::config-etc", "o": 82376, "z": 5, "cf": 0.6600000262260437 } ], "ln": 82360 }, { "b": "By^7qzGNNvB.LV5eOO.}e[]iBwPz.\u0026e[Y6Ae[!WmxAfU}D2vXGz2=h0D2vXBASv.8zGNNPwPz\u003caz/bLcxkR\u0026AC4CYnx(v(@ASv.jwD", "n": [ { "c": 2, "d": "ELF dynstr section name", "i": "metadata/binary/linking/static::elf-dynstr-section-name", "o": 100595, "z": 7, "cf": 0.8999999761581421 }, { "c": 2, "d": "ELF dynsym section name", "i": "metadata/binary/linking/static::elf-dynsym-section-name", "o": 100587, "z": 7, "cf": 0.8999999761581421 }, { "c": 2, "d": "ELF interpreter section name", "i": "metadata/binary/linking/static::elf-interpreter-section-name", "o": 100569, "z": 7, "cf": 0.8999999761581421 } ], "ln": 100553 }, { "b": "vr?\u00269wmoN*e]\u003eJte]\u003e\u003ege[xlBvqPZ*04}]5Bo0}7vrt]Te[e)y04}=1zeA\u003c4Bn#pv00000", "n": [ { "c": 2, "d": "ELF dynamic section name", "i": "metadata/binary/linking/static::elf-dynamic-section-name", "o": 100748, "z": 8, "cf": 0.8999999761581421 } ], "ln": 100732 } ], "depth": 1, "facts": { "exp": [ [ "stdout" ], [ "init" ], [ "stderr" ], [ "fini" ], [ "stdin" ] ], "imp": [ [ "", "putchar" ], [ "", "strcpy" ], [ "", "asctime" ], [ "", "if_indextoname" ], [ "", "printf" ], [ "", "sysconf" ], [ "", "strerror" ], [ "", "inet_pton" ], [ "", "snprintf" ], [ "", "getenv" ], [ "", "mnl_attr_parse" ], [ "", "unshare" ], [ "", "fgets" ], [ "", "perror" ], [ "", "cxa_finalize" ], [ "", "feof" ], [ "", "malloc" ], [ "", "isatty" ], [ "", "strtoul" ], [ "", "socket" ], [ "", "readdir" ], [ "", "mnl_attr_get_type" ], [ "", "fflush" ], [ "", "send" ], [ "", "stack_chk_fail" ], [ "", "strtol" ], [ "", "strnlen" ], [ "", "strrchr" ], [ "", "fprintf" ], [ "", "strcat" ], [ "", "bind" ], [ "", "ntohl" ], [ "", "umount2" ], [ "", "if_nametoindex" ], [ "", "deregister_frame_info" ], [ "", "mnl_nlmsg_get_payload_len" ], [ "", "setsockopt" ], [ "", "mnl_attr_type_valid" ], [ "", "ITM_registerTMCloneTable" ], [ "", "mnl_attr_get_u32" ], [ "", "lstat" ], [ "", "ferror" ], [ "", "strstr" ], [ "", "sendmsg" ], [ "", "htonl" ], [ "", "realloc" ], [ "", "mnl_nlmsg_get_payload" ], [ "", "strtok" ], [ "", "sscanf" ], [ "", "statvfs" ], [ "", "fread" ], [ "", "ITM_deregisterTMCloneTable" ], [ "", "strdup" ], [ "", "strtoull" ], [ "", "gettimeofday" ], [ "", "mnl_attr_validate" ], [ "", "fopen" ], [ "", "localtime" ], [ "", "ftell" ], [ "", "fclose" ], [ "", "ntohs" ], [ "", "time" ], [ "", "opendir" ], [ "", "assert_fail" ], [ "", "setns" ], [ "", "mnl_attr_get_str" ], [ "", "putc" ], [ "", "mount" ], [ "", "strcmp" ], [ "", "getservbyname" ], [ "", "strcspn" ], [ "", "fputc" ], [ "", "fwrite" ], [ "", "htons" ], [ "", "freopen" ], [ "", "errno_location" ], [ "", "exit" ], [ "", "inet_ntop" ], [ "", "atoi" ], [ "", "fileno" ], [ "", "getline" ], [ "", "strspn" ], [ "", "libc_start_main" ], [ "", "strlen" ], [ "", "open" ], [ "", "strchr" ], [ "", "fputs" ], [ "", "closedir" ], [ "", "recvmsg" ], [ "", "strchrnul" ], [ "", "register_frame_info" ], [ "", "close" ], [ "", "vfprintf" ], [ "", "free" ], [ "", "getsockname" ] ], "sec": [ [ ".note.gnu.property", 792, 48, 1.94, "alloc" ], [ ".note.gnu.build-id", 840, 36, 4.0, "alloc" ], [ ".interp", 876, 25, 4.05, "alloc" ], [ ".gnu.hash", 904, 60, 3.77, "alloc" ], [ ".dynsym", 968, 2424, 1.11, "alloc" ], [ ".dynstr", 3392, 980, 4.43, "alloc" ], [ ".gnu.version", 4372, 202, 1.2, "alloc" ], [ ".gnu.version_r", 4576, 32, 2.11, "alloc" ], [ ".rela.dyn", 4608, 2328, 1.75, "alloc" ], [ ".rela.plt", 6936, 24, 1.22, "alloc,info_link" ], [ ".relr.dyn", 6960, 56, 2.43, "alloc" ], [ ".init", 8192, 3, 1.58, "alloc,executable" ], [ ".plt", 8208, 32, 3.34, "alloc,executable" ], [ ".text", 8240, 57736, 6.18, "alloc,executable" ], [ ".fini", 65976, 3, 1.58, "alloc,executable" ], [ ".rodata", 69632, 13726, 4.97, "alloc" ], [ ".eh_frame_hdr", 83360, 1316, 5.24, "alloc" ], [ ".eh_frame", 84680, 7912, 5.06, "alloc" ], [ ".init_array", 96496, 8, 1.06, "write,alloc" ], [ ".fini_array", 96504, 8, 1.06, "write,alloc" ], [ ".data.rel.ro", 96512, 408, 2.02, "write,alloc" ], [ ".dynamic", 96920, 576, 1.48, "write,alloc" ], [ ".got", 97496, 784, 0.07, "write,alloc" ], [ ".data", 98304, 2188, 0.35, "write,alloc" ], [ ".comment", 100492, 28, 3.99, "merge,strings" ], [ ".shstrtab", 100520, 262, 4.18, "" ] ], "metrics": { "elf": { "bits": 64.0, "entry": 9412.0, "has_got": 1.0, "has_plt": 1.0, "has_note": 1.0, "note_count": 2.0, "nx_enabled": 1.0, "has_dt_relr": 1.0, "dynrel_count": 0.0, "dynsym_count": 101.0, "has_build_id": 1.0, "has_eh_frame": 1.0, "has_gnu_hash": 1.0, "stack_canary": 1.0, "symtab_count": 0.0, "dynrela_count": 97.0, "little_endian": 1.0, "dt_flags_1_raw": 134217729.0, "pltreloc_count": 1.0, "build_id_length": 20.0, "dt_versym_count": 101.0, "executable_stack": 0.0, "fini_array_count": 1.0, "init_array_count": 1.0, "wx_segment_count": 0.0, "comment_entry_count": 1.0, "program_header_count": 13.0, "comment_distinct_count": 1.0, "gnu_stack_section_absent": 0.0, "load_segment_max_file_size": 57787.0, "stripped_but_symtab_present": 0.0, "load_segment_max_memory_size": 57787.0, "section_relocation_group_count": 2.0, "stripped_metadata_section_count": 7.0 }, "file": { "size": 102576.0, "entropy": 5.65, "size_bytes": 102576.0 }, "binary": { "is_pie": 1.0, "has_overlay": 1.0, "is_stripped": 1.0, "code_entropy": 6.18, "data_entropy": 0.63, "overlay_size": 1794.0, "string_count": 593.0, "overlay_ratio": 0.02, "overall_entropy": 5.65, "overlay_entropy": 1.52, "entropy_variance": 2.78, "avg_string_length": 27.21, "max_string_length": 1608.0, "peak_region_bytes": 47104.0, "code_to_data_ratio": 0.94, "peak_region_entropy": 6.16, "string_length_stddev": 99.43, "largest_section_ratio": 0.56, "sentence_string_count": 194.0, "sentence_string_ratio": 0.33, "high_entropy_string_count": 0.0 }, "exports": { "count": 5.0 }, "imports": { "count": 95.0 }, "sections": { "count": 28.0, "code_size": 57774.0, "entropy_max": 6.18, "entropy_mean": 2.7, "name_entropy": 4.13, "writable_count": 7.0, "executable_count": 4.0, "nonstandard_count": 6.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 3.0 } } }, "id": 7, "mol": "H₃(Cm₇F₃Po)", "path": "iproute2-7.1.0-r0.apk!!sbin/bridge", "risk": 5, "sha": "c0851d5fb5c2041f529ab36453f1f41b9d18950d6fd6a98bf07acf382d016494", "size": 102576, "traits": [ { "id": "micro-behaviors/fs/directory/readdir::readdir-readdir", "conf": 0.6600000262260437, "crit": 2, "desc": "Uses readdir", "spans": [ [ 3955, 7 ] ] }, { "id": "micro-behaviors/communications/socket/bind/function::bind", "conf": 0.75, "crit": 3, "desc": "Bind socket to address", "spans": [ [ 4084, 4 ] ] }, { "id": "micro-behaviors/communications/ip/parse::inet-ntop-symbol", "conf": 0.6600000262260437, "crit": 3, "desc": "Parse IP with inet_ntop", "spans": [ [ 3726, 9 ] ] }, { "id": "micro-behaviors/ui/help::usage-title", "crit": 2, "desc": "Usage: label (title case)", "spans": [ [ 69632, 128 ], [ 69985, 128 ], [ 70940, 128 ], [ 72336, 128 ], [ 72951, 88 ], [ 73041, 128 ], [ 74651, 128 ], [ 80452, 66 ] ] }, { "id": "micro-behaviors/dylib/library/libc::libc-characteristic-cxa-finalize", "crit": 2, "desc": "libc characteristic cxa finalize", "spans": [ [ 3395, 12 ] ] }, { "id": "metadata/binary/metrics/threshold::rich-sentence-strings-20pct", "conf": 0.800000011920929, "crit": 1, "desc": "Binary has many sentence-like strings", "spans": [ [ 0, 35 ] ] }, { "id": "micro-behaviors/fs/file/open::fopen", "conf": 0.6600000262260437, "crit": 3, "desc": "Open files", "spans": [ [ 3910, 5 ] ] }, { "id": "micro-behaviors/ui/help::usage-title-string", "crit": 1, "desc": "Usage: label in binary strings", "spans": [ [ 69632, 128 ], [ 69985, 128 ], [ 70940, 128 ], [ 72336, 128 ], [ 72951, 88 ], [ 73041, 128 ], [ 74651, 128 ], [ 80452, 66 ] ] }, { "id": "micro-behaviors/communications/ip/parse::ntohl-symbol", "conf": 0.6600000262260437, "crit": 3, "desc": "Converts network to host long", "spans": [ [ 3786, 5 ] ] }, { "id": "micro-behaviors/communications/ip/parse::inet-pton-symbol", "conf": 0.6600000262260437, "crit": 3, "desc": "Parse IP with inet_pton", "spans": [ [ 3660, 9 ] ] }, { "id": "objectives/command-and-control/botnet/keywords::slave-term", "conf": 0.4000000059604645, "crit": 3, "desc": "Slave keyword", "spans": [ [ 75931, 5 ], [ 79188, 5 ] ] }, { "id": "micro-behaviors/fs/directory/readdir::readdir-opendir", "conf": 0.6600000262260437, "crit": 2, "desc": "Uses opendir", "spans": [ [ 3947, 7 ] ] }, { "id": "micro-behaviors/fs/file/write/direct::write--fwrite", "conf": 0.6600000262260437, "crit": 2, "desc": "Write files (fwrite)", "spans": [ [ 4101, 6 ] ] }, { "id": "metadata/binary/metrics/threshold::many-imports-50", "conf": 1.0, "crit": 1, "desc": "Binary has 50+ imports", "spans": [ [ 0, 21 ] ] }, { "id": "micro-behaviors/communications/socket/interface::if-nametoindex-symbol", "conf": 0.699999988079071, "crit": 3, "desc": "Looks up index with if_nametoindex", "spans": [ [ 4147, 14 ] ] }, { "id": "micro-behaviors/fs/file/read::fread", "conf": 0.699999988079071, "crit": 2, "desc": "Read stream (fread)", "spans": [ [ 4108, 5 ] ] }, { "id": "micro-behaviors/communications/socket/interface::if-indextoname-symbol", "conf": 0.699999988079071, "crit": 3, "desc": "Looks up name with if_indextoname", "spans": [ [ 4132, 14 ] ] }, { "id": "micro-behaviors/communications/socket/tcp::socket-symbol-text", "conf": 0.75, "crit": 3, "desc": "Socket API symbol text", "spans": [ [ 4077, 6 ] ] }, { "id": "micro-behaviors/communications/socket/options::options-set", "conf": 0.6600000262260437, "crit": 3, "desc": "Set socket options", "spans": [ [ 3923, 10 ] ] }, { "id": "micro-behaviors/fs/file/read::fread-text", "conf": 0.6200000047683716, "crit": 2, "desc": "fread API string", "spans": [ [ 4108, 5 ] ] }, { "id": "micro-behaviors/communications/ip/parse::ntohs-symbol", "conf": 0.6600000262260437, "crit": 3, "desc": "Converts network to host short", "spans": [ [ 3609, 5 ] ] }, { "id": "micro-behaviors/fs/directory/readdir::readdir-closedir", "conf": 0.6600000262260437, "crit": 2, "desc": "Uses closedir", "spans": [ [ 3976, 8 ] ] }, { "id": "micro-behaviors/fs/volume/umount::umount2-fn", "conf": 0.6600000262260437, "crit": 3, "desc": "Unmount file system", "spans": [ [ 4035, 7 ] ] }, { "id": "micro-behaviors/communications/ip/parse::htonl-symbol", "conf": 0.6600000262260437, "crit": 3, "desc": "Converts host to network long", "spans": [ [ 3792, 5 ] ] }, { "id": "micro-behaviors/process/fd/stdio::freopen-import", "conf": 0.699999988079071, "crit": 3, "desc": "freopen stream redirection import", "spans": [ [ 3812, 7 ] ] }, { "id": "micro-behaviors/fs/volume/mount::mount-fn", "conf": 0.6600000262260437, "crit": 3, "desc": "Mount file systems", "spans": [ [ 4029, 5 ] ] }, { "id": "micro-behaviors/fs/volume/mount::mount-underscore", "conf": 0.6600000262260437, "crit": 3, "desc": "Mount file systems", "spans": [ [ 4029, 5 ] ] }, { "id": "micro-behaviors/communications/ip/parse::htons-symbol", "conf": 0.6600000262260437, "crit": 3, "desc": "Converts host to network short", "spans": [ [ 3670, 5 ] ] }, { "id": "micro-behaviors/communications/socket/send::sendmsg-symbol", "atk": "T1071", "mbc": "C0001", "conf": 0.6600000262260437, "crit": 3, "desc": "Uses sendmsg socket call", "spans": [ [ 4007, 7 ] ] }, { "id": "micro-behaviors/communications/socket/send::send-symbol", "atk": "T1071", "mbc": "C0001", "conf": 0.6600000262260437, "crit": 3, "desc": "Uses send socket call", "spans": [ [ 3684, 4 ] ] }, { "id": "micro-behaviors/communications/socket/listen::socket-sym", "mbc": "C0001", "conf": 0.4000000059604645, "crit": 3, "desc": "socket function symbol", "spans": [ [ 4077, 6 ] ] }, { "id": "micro-behaviors/communications/socket/receive::recvmsg-symbol", "atk": "T1071", "mbc": "C0001", "conf": 0.6600000262260437, "crit": 3, "desc": "Uses recvmsg socket call", "spans": [ [ 3999, 7 ] ] }, { "id": "micro-behaviors/communications/socket/send::_send-symbol", "atk": "T1071", "mbc": "C0001", "conf": 0.6600000262260437, "crit": 3, "desc": "Uses _send socket call", "spans": [ [ 3684, 4 ] ] }, { "id": "micro-behaviors/fs/file/binary::file-read-operation", "atk": "T1005", "conf": 0.75, "crit": 1, "desc": "File read operation", "spans": [ [ 4108, 5 ] ] }, { "id": "micro-behaviors/fs/file/write/direct::write", "conf": 0.6600000262260437, "crit": 2, "desc": "Write files", "spans": [ [ 4101, 6 ] ] }, { "id": "micro-behaviors/dylib/library/libc::libc-internal-functions-b", "conf": 0.699999988079071, "crit": 2, "desc": "libc internal symbols cluster B", "spans": [ [ 3395, 12 ] ] }, { "id": "micro-behaviors/ui/help::usage-label", "conf": 0.75, "crit": 1, "desc": "Command line usage text", "spans": [ [ 69632, 128 ], [ 69985, 128 ], [ 70940, 128 ], [ 72336, 128 ], [ 72951, 88 ], [ 73041, 128 ], [ 74651, 128 ], [ 80452, 66 ] ] }, { "id": "micro-behaviors/dylib/library/abi-graphics::cxx-abi-symbols-a", "conf": 0.800000011920929, "crit": 2, "desc": "C++ ABI symbols cluster A", "spans": [ [ 3395, 12 ] ] } ], "type": "elf" }, { "analysis_gaps": [ "flow-graph-limited", "flow-query-incomplete" ], "ctx": [ { "b": "boXf.B-RNRvRGZkwO#VlAcVLsz/durboP]Yl%83mx\u003e7Z(B7D{{wmYU2x\u003ez6\u003cAYLskp!SC@e?^RS3l{V)xLzJgx(+zrx(d*9wGV57A+PGmaARJAAb](bwPI]nn(FIXaA8yAAclmBw].*bazC^qA=l8xwEoU8v@Dj3vqYP#vqYP#w]zZbvrrSaBs[WUlsB}Dwft/daz1#4y?WE3aAIjcy?$knv@=p5BrC:rA=U@kzy#nua%G@}A+PGmaARJAAa9^dwGUYaaAzyyBy=OkB-.OBBrCpnBz\u0026psz/PziA+eV\u0026vpB4:aARgtBs[:Ya{[V\u003eze:AlBrCTIA%=R#AbP=sazL$ozvg8{AbP=sazkncz/x!9x(d*cA=-BBBZ/rgz!0v1A%-lYwmYu}B-Q#7wHF#*3lQDlaswJ:p\u0026Zn/BrCZEvp%c]vqYP#wQ4{hcNQnGarR^HAb]VgBsntkB75Y)iV@=$ax@}@vR/Q[AV!ObvrS\u0026dA3eOfxlbWTe)R:be[P3xzddJmB9R*Vvrc17tqftidgdguarU-JB1R3Gx(\u003e:Yg:@+s3s)ZWaz\u003eL3zyu}{3lQDlaswJ:p\u0026ZF:wPI]nBzbkdvrc16zdNQbB0\u0026s.3lQDlazb50x(55qjS(a^zE)]q3lQDlaARTHiTM#LarR^HarUPwBAn#Qvrc14auZ\u0026WwPR\u003cfBs}iqBz(bud06VPe[5^kC3uWZt}v9xxF.RViWc9$toW-(y\u0026yNHar\u003eAaze0*ijTaeX3lQDlaz2!cwPh-lxjVg6Ac9Z5wPR\u003cfBvyj\u003cz/M$eB0b4mAYKKIarR^HarR!CA+PAkc$NBtdgdguarR^HarU/Fvp%d1dgcz8arR!sz/M$sAc9SNvrc06x(k5iAccdZ3lQDlarR^HazCBgz/x!vx(k4$a$WELefDb*eOFZiA3wNG3lQDlarR^HarR^HaA.:lxjSFu3lQDlarR^Haz2w6w/#2hBrA.fasw:0cPROSarR^HarR^HarR!svqPZ{C{2l)cUWEfBt+GNarR^HarR^HwO=6)aA8jvau.\u003ega$UR}iTM#LarR^HarR^HarUo8ze0*iauZ?{x(mH7cKH$sarR^HarUlix\u003ewGaAc9jpzxJdceOlgTar\u0026x?w)]K\u003cy\u003cvjgiTM#LarR^HarR^HarUo8ze0*iauZ\u0026QA+t.4arR^HarR!ry\u0026:eG3lQDlarR^HarR^HayPtjwPz(nmQZaOwH[@FB-7(3zE^M{wft/fBzkVha{[V1arR!vw/$#fBrC1jxlc9varR^HarR^Hvrc14auZ\u0026KcOM]N3jm)#arUfhwfs2Ttpjc7cOcw/eOlvYazb50x(55Casw:QcOcw/A=l8xwHx2KcV0HrBseQZcV\u0026^ay?j#1as!NyA+xC2arR^HAb](bwPI]njS[/*vSlvav}x.5e(lF9wO@]azdCguB97@hB-Y=/BZ/rgz!0v1B1QoXp^(/uarR^HByG5ejS[GXz/dgzz^^f8Ab](bwPI]BB97@hB-Y5tarR^Hx\u003ewG1vqPZ{C{2mkasy(vwPPpX3lQDlarR^HazbFjauZ?{DPA(sEir\u003e$f/sw4DPA(sEir\u003e$idh]@iYILmiY]bPEir(+cKH$sarUliB7ExtarR^HarR^Hw]hSjjS(b0iX@KtaBud9gjpo(iX@KtaBudeEir\u003e$idlcmjtw:xaBwI:3jm)#arR)Kx(Chnz/{ekazL$ozxJ.aD2\u003crnarR!xwQettjS)@Rwoh\u0026uefDrMvru78vr\u003cjKaszbGwOc17v\u003c-/IcVB9ABz\u003eVcy:Q+RcV-^oAaHyFasyYhB%!*-cV\u0026^ay?j#13lQDlaAhvnzGEpszfdyxz/PY6BsnRQvq)ShvqPE:vix!QaB2IGvq]}5vqGU7wHF#UazULlB15K!3jm)#arUomAV/ylv@Dx#azCZoByG5E3lQDlarR^Hazbt0y?dPfjS)%HwN/U0wlS?PazCBgyANteaAz46z/PwhwO=B0aswJVw]zYjyANteazULlB6Pa}arR^HarR!CA+PAkc$Wsre[P3xzddJmdRryay?dPodgcy?x\u003ewF{uV6p?wNw^!jV%]iuTEUUx(mo+b035NarR!zvqfQcdgc", "ln": 0, "col": 1, "line": 1 } ], "depth": 1, "facts": { "imp": [ [ "", "print" ], [ "", "sys.exit" ], [ "", "getopt.getopt" ], [ "", "print" ], [ "", "usage" ], [ "", "usage" ], [ "", "subprocess.Popen" ], [ "", "json.load" ], [ "", "print" ], [ "", "fmt.format" ], [ "", "map" ], [ "", "x.capitalize" ], [ "", "print" ], [ "", "fmt.format" ], [ "", "main" ], [ "", "getopt" ], [ "", "json" ], [ "", "subprocess" ], [ "", "sys" ] ], "mbr": [ "fmt.format", "getopt.GetoptError", "getopt.getopt", "json.load", "process.stdout", "subprocess.PIPE", "subprocess.Popen", "sys.argv", "sys.exit", "x.capitalize" ], "tgt": [ "fmt.format", "getopt.getopt", "json.load", "main", "map", "print", "subprocess.Popen", "sys.exit", "usage", "x.capitalize" ], "funcs": [ [ "usage", 308 ], [ "main", 441 ] ], "metrics": { "ast": { "op.add": 1, "max_depth": 14, "call_count": 16, "node_count": 550, "member_count": 10, "op_density.add": 0, "max_array_length": 7, "max_concat_chain": 2, "max_member_depth": 2 }, "file": { "size": 1658, "entropy": 4.74 }, "text": { "lines": 62, "top_char": 101, "digit_ratio": 0.04, "space_count": 398, "char_entropy": 4.74, "unique_chars": 70, "top_char_null": 0, "import_density": 6.45, "string_density": 0.58, "top_char_ratio": 0.05, "avg_line_length": 25.74, "max_line_length": 78, "empty_line_ratio": 0.19, "last_line_length": 10, "whitespace_ratio": 0.28, "identifier_density": 1.31, "line_length_stddev": 22.14, "max_whitespace_run": 2, "normalized_import_count": 0.51, "normalized_string_count": 4.57, "repeated_char_sequences": 5, "normalized_function_count": 0.25, "imports_to_functions_ratio": 2, "strings_to_functions_ratio": 18, "suspicious_identifier_ratio": 0.06, "normalized_unique_identifiers": 5.54, "identifiers_to_functions_ratio": 16.5 }, "binds": { "count": 12 }, "binary": { "peak_region_bytes": 1658, "peak_region_entropy": 4.81 }, "source": { "function_count": 2 }, "imports": { "count": 4, "stdlib_count": 3, "stdlib_ratio": 0.75, "third_party_count": 1, "third_party_ratio": 0.25 }, "strings": { "bytes": 355, "count": 36, "avg_length": 9.86, "max_length": 60, "avg_entropy": 2.17, "empty_count": 1, "entropy_stddev": 0.93 }, "comments": { "chars": 196, "count": 6, "empty": 1, "lines": 5, "to_code_ratio": 0.09 }, "functions": { "count": 2, "density": 3.23, "code_ratio": 0.69, "length_stddev": 17.5, "avg_name_length": 4.5, "no_params_count": 2, "avg_length_lines": 21.5, "max_length_lines": 39, "min_length_lines": 4 }, "identifiers": { "count": 81, "unique": 33, "avg_length": 4.82, "max_length": 11, "min_length": 1, "avg_entropy": 1.92, "reuse_ratio": 0.41, "length_stddev": 2.32, "sequential_names": 2, "single_char_count": 2, "single_char_ratio": 0.06, "all_lowercase_ratio": 0.91, "all_uppercase_ratio": 0.03, "double_underscore_count": 1, "underscore_prefix_count": 1 } } }, "id": 8, "mol": "H₂(DbPo₃)Md₂(In₂Pa₂)", "path": "iproute2-7.1.0-r0.apk!!sbin/routel", "pid": 0, "risk": 8, "sha": "e348c708ec6d0b3252b5ac42b21a27c7dafad2ca32e1bba2f19aee3b7bf45bbe", "size": 1658, "supp": [ { "by": [ { "id": "micro-behaviors/process/create/subprocess::popen-ast", "spans": [ [ 1106, 16 ] ] } ], "id": "micro-behaviors/process/create/subprocess::popen-content", "crit": "notable", "kind": "unless" }, { "by": [ { "id": "micro-behaviors/process/create/subprocess::popen-ast", "spans": [ [ 1106, 16 ] ] } ], "id": "micro-behaviors/process/create/subprocess::qualified-popen-call", "crit": "notable", "kind": "unless" } ], "traits": [ { "id": "metadata/import/builtin::python-subprocess-import", "conf": 0.95, "crit": 3, "desc": "Subprocess import outside excluded contexts", "uses": [ 1 ], "spans": [ [ 295, 10 ] ] }, { "id": "metadata/import/python/subprocess::subprocess", "conf": 0.95, "crit": 3, "desc": "imports subprocess", "spans": [ [ 295, 10 ] ] }, { "id": "metadata/package/files/dependency::os-image-root-file-path", "conf": 0.94, "crit": 3, "desc": "Root-level OS directory path" }, { "id": "metadata/package/license::spdx-identifier", "conf": 0.9, "crit": 3, "desc": "SPDX license identifier", "spans": [ [ 26, 23 ] ] }, { "id": "metadata/package/license::spdx-license-identifier", "conf": 0.9, "crit": 3, "desc": "Source SPDX license identifier declaration", "spans": [ [ 26, 32 ] ] }, { "id": "micro-behaviors/data/parse/json::json-load-call", "conf": 0.9, "crit": 3, "desc": "Python json.load call", "spans": [ [ 1162, 9 ] ] }, { "id": "micro-behaviors/process/create/subprocess::popen-ast", "atk": "T1059.006", "mbc": "C0017", "conf": 0.85, "crit": 3, "desc": "Launches a process with subprocess.Popen", "spans": [ [ 1106, 16 ] ] }, { "id": "micro-behaviors/process/create/subprocess::variable-command-argument", "atk": "T1059.006", "mbc": "E1059.006", "conf": 0.95, "crit": 3, "desc": "Subprocess runs a variable-held command", "spans": [ [ 1106, 16 ] ] }, { "id": "micro-behaviors/process/exit/terminate::python-sys-exit-symbol", "conf": 0.84, "crit": 3, "desc": "Python sys.exit symbol", "spans": [ [ 426, 8 ] ] }, { "id": "micro-behaviors/process/fd/stdio::python-stdout-stream-name", "conf": 0.84, "crit": 3, "desc": "Python references the stdout stream", "spans": [ [ 1128, 6 ] ] }, { "id": "micro-behaviors/process/fd/stdio::python-subprocess-output-options", "conf": 0.9, "crit": 3, "desc": "subprocess call with stdout/stderr keyword", "spans": [ [ 1106, 10 ], [ 1117, 5 ], [ 1128, 6 ] ] }, { "id": "metadata/import/python/getopt::getopt", "conf": 0.95, "crit": 2, "desc": "imports getopt", "spans": [ [ 281, 0 ] ] }, { "id": "metadata/import/python/json::json", "conf": 0.95, "crit": 2, "desc": "imports json", "spans": [ [ 269, 0 ] ] }, { "id": "metadata/import/python/sys::sys", "conf": 0.95, "crit": 2, "desc": "imports sys", "spans": [ [ 258, 0 ] ] }, { "id": "metadata/package/license::gpl-2-spdx-identifier", "conf": 0.99, "crit": 2, "desc": "GPL-2.0 SPDX license identifier", "spans": [ [ 26, 0 ] ] }, { "id": "metadata/lang/natural/vocabulary/content-word::data-access-verb-token", "conf": 0.88, "crit": 1, "desc": "Data-access verb token", "spans": [ [ 356, 0 ] ] }, { "id": "metadata/lang/natural/vocabulary/function-word::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"", "spans": [ [ 468, 0 ] ] }, { "id": "metadata/lang/natural/vocabulary/function-word::lang-english--atom-2", "conf": 0.8, "crit": 1, "desc": "English function-word token \"and\"", "spans": [ [ 132, 0 ] ] }, { "id": "metadata/lang/natural/vocabulary/function-word::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "spans": [ [ 671, 0 ] ] }, { "id": "metadata/lang/natural/vocabulary/function-word::lang-english--atom-7", "conf": 0.8, "crit": 1, "desc": "English function-word token \"this\"", "spans": [ [ 63, 0 ] ] } ], "type": "python" }, { "ctx": [ { "b": "E))420S-r400000000000@$H+0rr91{-YXr00000kMy=:00000PM6@i0000000000kMA+z4feS[8#{]T1][S6", "n": [ { "c": 3, "d": "No full symbol table (likely stripped)", "i": "metadata/hardening/missing::stripped-binary", "o": 0, "z": 25, "cf": 0.800000011920929 } ], "ln": 0 }, { "b": "i}dbxy?Wuiy?bbmB-RvJCSmP*hz^4cz.r:A000050000Q000010000600000FDbVI1Yb", "n": [ { "c": 3, "d": "Architecture detection strings", "i": "objectives/discovery/host/software::arch-detection", "o": 889, "z": 6, "cf": 0.5 } ], "ln": 873 }, { "b": "000000096100000003wkv%zA?w[=c\u003ey?Xib0af8zwPzu{x(!xcA:JB0vqPN.x(mK30aeq%o\u003c.{L", "n": [ { "c": 3, "d": "Benign network-capable library context", "i": "objectives/supply-chain/trojanized/backdoor::benign-network-library-context", "o": 2315, "z": 12, "cf": 0.8999999761581421 } ], "ln": 2299 }, { "b": "x(i](ByX%6ASxY\u003cB-.W8wQ4{h0crm5Bz(qr0af8OBywV{uT)++uUi.XyYFJ#A+]r80bVdXy\u0026r!-B98CjAcRB}A+e!ZB98CjxA", "n": [ { "c": 3, "d": "Stack protector/canary enabled", "i": "metadata/hardening/build::stack-protector", "o": 2486, "z": 14, "cf": 0.8999999761581421 }, { "c": 2, "d": "Terminates process immediately without cleanup", "i": "micro-behaviors/process/terminate/signal::_exit", "o": 2471, "z": 4, "cf": 0.4000000059604645 } ], "ln": 2455 }, { "b": "C4LYlx(n380crl)z/{d4w]I)mv/QN*v@2T$0b#H\u0026A=k%#B7GDmz!0N3Ac87?x(mCYxjVgaz!0N2vqPMQBzkP60aP?-B7Ct(wN/[2B7UFWuUam#zF@(#z!0i$x(v\u003e?B98ClA=M8s0cqZ?wnMy20crm5zFS)40bl4LzEEx[Bz\u003e(hwmY#=B8$\u00261zE@(\u0026BAhFwwb{W)A:@K0wN/N@0bl4Lx(mD)CYW\u003ewvqPMQB8C@qx(n380b2\u003e+wO#U\u003ew[=6)zF]I?B76fjC(R]cA=LV6ASx@]y*QQ)BAg-3wPRp4gCO@EzFSV$yY", "n": [ { "c": 3, "d": "Bind socket to address", "i": "micro-behaviors/communications/socket/bind/function::bind", "o": 2591, "z": 4, "cf": 0.75 }, { "c": 3, "d": "Looks up name with if_indextoname", "i": "micro-behaviors/communications/socket/interface::if-indextoname-symbol", "o": 2709, "z": 14, "cf": 0.699999988079071 }, { "c": 3, "d": "Looks up index with if_nametoindex", "i": "micro-behaviors/communications/socket/interface::if-nametoindex-symbol", "o": 2669, "z": 14, "cf": 0.699999988079071 }, { "c": 3, "d": "Set socket options", "i": "micro-behaviors/communications/socket/options::options-set", "o": 2580, "z": 10, "cf": 0.6600000262260437 }, { "c": 3, "d": "Uses recvmsg socket call", "i": "micro-behaviors/communications/socket/receive::recvmsg-symbol", "o": 2619, "z": 7, "cf": 0.6600000262260437 }, { "c": 3, "d": "Uses sendmsg socket call", "i": "micro-behaviors/communications/socket/send::sendmsg-symbol", "o": 2653, "z": 7, "cf": 0.6600000262260437 }, { "c": 3, "d": "Socket API symbol text", "i": "micro-behaviors/communications/socket/tcp::socket-symbol-text", "o": 2566, "z": 6, "cf": 0.75 }, { "c": 2, "d": "Write single bytes to file", "i": "micro-behaviors/fs/file/write/direct::fputc", "o": 2560, "z": 5, "cf": 0.6600000262260437 }, { "c": 2, "d": "Environment variable access functions", "i": "micro-behaviors/os/env/vars/access::env-access-comp", "o": 2733, "z": 6, "cf": 0.4000000059604645 }, { "c": 2, "d": "Detect if running in terminal (isatty)", "i": "micro-behaviors/process/tty/terminal::isatty", "o": 2747, "z": 6, "cf": 0.5 }, { "c": 2, "d": "Get current calendar time (seconds)", "i": "micro-behaviors/time/query::time", "o": 2608, "z": 4, "cf": 0.30000001192092896 } ], "ln": 2544 }, { "b": "e]$}-g5#c8vQ?3cB-RvJCSmP*hz^4cz.r:AoI4MBpe21He?^n900962009620096200i", "n": [ { "c": 2, "d": "x86_64 architecture string", "i": "micro-behaviors/os/sysinfo/platform/string::arch-x86-64", "o": 2949, "z": 6, "cf": 0.30000001192092896 } ], "ln": 2933 }, { "b": "Jtf=hI9\u0026%/IbKWJI9\u003cnj1R?1q5583zGWK@HyRR8:%ht2=(*vr671Na1044TE002MHA$y)248LL(oaR", "n": [ { "c": 1, "d": "DJB2 hash algorithm constant (5381)", "i": "objectives/anti-static/obfuscation/imports::djb2-hash-constant", "o": 9741, "z": 11, "cf": 0.75 }, { "c": 1, "d": "DJB2 hash multiply-by-33 instruction", "i": "objectives/anti-static/obfuscation/imports::djb2-multiply-33", "o": 9753, "z": 2, "cf": 0.699999988079071 } ], "ln": 9725 }, { "b": "00000000000000000000rDzOYwJy@KwPS0bvq]^#ax]%:p/H1Zpe-ovaBtj#pFBLHpdcjLaztt5A3fMopF+1ZpFK?hiZ1Qjat3R#wPz\u003caz/e\u00266D($1Jtw[s@A:o/nat4nry\u0026yIB3pvP-o*IJxauzUdDMWxvBrC@NxjVfcD(#%hy?mZ1aBLwywP/g:moieHo*]x}arR^HxKL^?y?j-gv@Dr$av[^[", "n": [ { "c": 3, "d": "Terminal socket exec helper context", "i": "micro-behaviors/process/fd/dup::unix-terminal-socket-exec-benign-context", "o": 20480, "z": 128, "cf": 0.949999988079071 } ], "ln": 20464 }, { "b": "By^7qzGNNvB.LV5eOO.}e[]iBwPz.\u0026e[Y6Ae[!WmxAfU}D2vXGz2=h0D2vXBASv.8zGNNPwPz\u003caz/bLcxkR\u0026AC4CYnx(v(@ASv.jwD", "n": [ { "c": 2, "d": "ELF dynstr section name", "i": "metadata/binary/linking/static::elf-dynstr-section-name", "o": 28899, "z": 7, "cf": 0.8999999761581421 }, { "c": 2, "d": "ELF dynsym section name", "i": "metadata/binary/linking/static::elf-dynsym-section-name", "o": 28891, "z": 7, "cf": 0.8999999761581421 }, { "c": 2, "d": "ELF interpreter section name", "i": "metadata/binary/linking/static::elf-interpreter-section-name", "o": 28873, "z": 7, "cf": 0.8999999761581421 } ], "ln": 28857 }, { "b": "vr?\u00269wmoN*e]\u003eJte]\u003e\u003ege[xlBvqPZ*04}]5Bo0}7vrt]Te[e)y04}=1zeA\u003c4Bn#pv00000", "n": [ { "c": 2, "d": "ELF dynamic section name", "i": "metadata/binary/linking/static::elf-dynamic-section-name", "o": 29052, "z": 8, "cf": 0.8999999761581421 } ], "ln": 29036 } ], "depth": 1, "facts": { "exp": [ [ "init" ], [ "stderr" ], [ "stdout" ], [ "fini" ] ], "imp": [ [ "", "strcpy" ], [ "", "if_indextoname" ], [ "", "printf" ], [ "", "strerror" ], [ "", "snprintf" ], [ "", "getenv" ], [ "", "mnl_attr_parse" ], [ "", "perror" ], [ "", "cxa_finalize" ], [ "", "malloc" ], [ "", "isatty" ], [ "", "strtoul" ], [ "", "socket" ], [ "", "mnl_attr_get_type" ], [ "", "stack_chk_fail" ], [ "", "strnlen" ], [ "", "strrchr" ], [ "", "strtod" ], [ "", "fprintf" ], [ "", "bind" ], [ "", "if_nametoindex" ], [ "", "deregister_frame_info" ], [ "", "mnl_nlmsg_get_payload_len" ], [ "", "setsockopt" ], [ "", "mnl_attr_type_valid" ], [ "", "ITM_registerTMCloneTable" ], [ "", "mnl_attr_get_u32" ], [ "", "sendmsg" ], [ "", "strcasecmp" ], [ "", "mnl_nlmsg_get_payload" ], [ "", "sscanf" ], [ "", "ITM_deregisterTMCloneTable" ], [ "", "mnl_attr_validate" ], [ "", "time" ], [ "", "mnl_attr_get_str" ], [ "", "putc" ], [ "", "strcmp" ], [ "", "fputc" ], [ "", "errno_location" ], [ "", "exit" ], [ "", "fileno" ], [ "", "libc_start_main" ], [ "", "strlen" ], [ "", "fputs" ], [ "", "recvmsg" ], [ "", "strchrnul" ], [ "", "register_frame_info" ], [ "", "close" ], [ "", "vfprintf" ], [ "", "free" ], [ "", "getsockname" ] ], "sec": [ [ ".note.gnu.property", 792, 48, 1.94, "alloc" ], [ ".note.gnu.build-id", 840, 36, 4.19, "alloc" ], [ ".interp", 876, 25, 4.05, "alloc" ], [ ".gnu.hash", 904, 60, 3.11, "alloc" ], [ ".dynsym", 968, 1344, 1.02, "alloc" ], [ ".dynstr", 2312, 660, 4.5, "alloc" ], [ ".gnu.version", 2972, 112, 1.29, "alloc" ], [ ".gnu.version_r", 3088, 32, 1.99, "alloc" ], [ ".rela.dyn", 3120, 1248, 1.46, "alloc" ], [ ".rela.plt", 4368, 24, 0.98, "alloc,info_link" ], [ ".relr.dyn", 4392, 24, 2.16, "alloc" ], [ ".init", 8192, 3, 1.58, "alloc,executable" ], [ ".plt", 8208, 32, 3.05, "alloc,executable" ], [ ".text", 8240, 8450, 6.16, "alloc,executable" ], [ ".fini", 16690, 3, 1.58, "alloc,executable" ], [ ".rodata", 20480, 2088, 5.35, "alloc" ], [ ".eh_frame_hdr", 22568, 236, 4.33, "alloc" ], [ ".eh_frame", 22808, 1252, 4.76, "alloc" ], [ ".init_array", 27120, 8, 1.06, "write,alloc" ], [ ".fini_array", 27128, 8, 1.06, "write,alloc" ], [ ".data.rel.ro", 27136, 504, 2.04, "write,alloc" ], [ ".dynamic", 27640, 576, 1.47, "write,alloc" ], [ ".got", 28216, 432, 0.09, "write,alloc" ], [ ".data", 28672, 124, 0.55, "write,alloc" ], [ ".comment", 28796, 28, 3.99, "merge,strings" ], [ ".shstrtab", 28824, 262, 4.18, "" ] ], "metrics": { "elf": { "bits": 64.0, "entry": 8952.0, "has_got": 1.0, "has_plt": 1.0, "has_note": 1.0, "note_count": 2.0, "nx_enabled": 1.0, "has_dt_relr": 1.0, "dynrel_count": 0.0, "dynsym_count": 56.0, "has_build_id": 1.0, "has_eh_frame": 1.0, "has_gnu_hash": 1.0, "stack_canary": 1.0, "symtab_count": 0.0, "dynrela_count": 52.0, "little_endian": 1.0, "dt_flags_1_raw": 134217729.0, "pltreloc_count": 1.0, "build_id_length": 20.0, "dt_versym_count": 56.0, "executable_stack": 0.0, "fini_array_count": 1.0, "init_array_count": 1.0, "wx_segment_count": 0.0, "comment_entry_count": 1.0, "program_header_count": 13.0, "comment_distinct_count": 1.0, "gnu_stack_section_absent": 0.0, "load_segment_max_file_size": 8501.0, "stripped_but_symtab_present": 0.0, "load_segment_max_memory_size": 18208.0, "section_relocation_group_count": 2.0, "stripped_metadata_section_count": 7.0 }, "file": { "size": 30880.0, "entropy": 3.7, "size_bytes": 30880.0 }, "binary": { "is_pie": 1.0, "has_overlay": 1.0, "is_stripped": 1.0, "code_entropy": 6.14, "data_entropy": 1.21, "overlay_size": 1794.0, "string_count": 154.0, "overlay_ratio": 0.06, "overall_entropy": 3.7, "overlay_entropy": 1.44, "entropy_variance": 2.66, "avg_string_length": 18.2, "max_string_length": 421.0, "peak_region_bytes": 7168.0, "code_to_data_ratio": 0.84, "peak_region_entropy": 6.09, "string_length_stddev": 34.74, "largest_section_ratio": 0.27, "sentence_string_count": 42.0, "sentence_string_ratio": 0.27, "high_entropy_string_count": 0.0 }, "exports": { "count": 4.0 }, "imports": { "count": 51.0 }, "sections": { "count": 28.0, "code_size": 8488.0, "entropy_max": 6.16, "entropy_mean": 2.61, "name_entropy": 4.13, "writable_count": 7.0, "executable_count": 4.0, "nonstandard_count": 6.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 3.0 } } }, "id": 9, "mol": "H(Cm₆)", "path": "iproute2-7.1.0-r0.apk!!sbin/netshaper", "risk": 2, "sha": "167a956a1ef9bd6faba6c37b77363dfca3693f7d5dc45208550a8c89f95c4038", "size": 30880, "traits": [ { "id": "micro-behaviors/communications/socket/bind/function::bind", "conf": 0.75, "crit": 3, "desc": "Bind socket to address", "spans": [ [ 2591, 4 ] ] }, { "id": "micro-behaviors/ui/help::usage-title", "crit": 2, "desc": "Usage: label (title case)", "spans": [ [ 20480, 128 ] ] }, { "id": "micro-behaviors/dylib/library/libc::libc-characteristic-cxa-finalize", "crit": 2, "desc": "libc characteristic cxa finalize", "spans": [ [ 2315, 12 ] ] }, { "id": "metadata/binary/metrics/threshold::rich-sentence-strings-20pct", "conf": 0.800000011920929, "crit": 1, "desc": "Binary has many sentence-like strings", "spans": [ [ 0, 35 ] ] }, { "id": "micro-behaviors/ui/help::usage-title-string", "crit": 1, "desc": "Usage: label in binary strings", "spans": [ [ 20480, 128 ] ] }, { "id": "metadata/binary/metrics/threshold::many-imports-50", "conf": 1.0, "crit": 1, "desc": "Binary has 50+ imports", "spans": [ [ 0, 21 ] ] }, { "id": "micro-behaviors/communications/socket/interface::if-nametoindex-symbol", "conf": 0.699999988079071, "crit": 3, "desc": "Looks up index with if_nametoindex", "spans": [ [ 2669, 14 ] ] }, { "id": "micro-behaviors/communications/socket/interface::if-indextoname-symbol", "conf": 0.699999988079071, "crit": 3, "desc": "Looks up name with if_indextoname", "spans": [ [ 2709, 14 ] ] }, { "id": "micro-behaviors/communications/socket/tcp::socket-symbol-text", "conf": 0.75, "crit": 3, "desc": "Socket API symbol text", "spans": [ [ 2566, 6 ] ] }, { "id": "micro-behaviors/communications/socket/options::options-set", "conf": 0.6600000262260437, "crit": 3, "desc": "Set socket options", "spans": [ [ 2580, 10 ] ] }, { "id": "micro-behaviors/communications/socket/send::sendmsg-symbol", "atk": "T1071", "mbc": "C0001", "conf": 0.6600000262260437, "crit": 3, "desc": "Uses sendmsg socket call", "spans": [ [ 2653, 7 ] ] }, { "id": "micro-behaviors/communications/socket/listen::socket-sym", "mbc": "C0001", "conf": 0.4000000059604645, "crit": 3, "desc": "socket function symbol", "spans": [ [ 2566, 6 ] ] }, { "id": "micro-behaviors/communications/socket/receive::recvmsg-symbol", "atk": "T1071", "mbc": "C0001", "conf": 0.6600000262260437, "crit": 3, "desc": "Uses recvmsg socket call", "spans": [ [ 2619, 7 ] ] }, { "id": "micro-behaviors/dylib/library/libc::libc-internal-functions-b", "conf": 0.699999988079071, "crit": 2, "desc": "libc internal symbols cluster B", "spans": [ [ 2315, 12 ] ] }, { "id": "micro-behaviors/ui/help::usage-label", "conf": 0.75, "crit": 1, "desc": "Command line usage text", "spans": [ [ 20480, 128 ] ] }, { "id": "micro-behaviors/dylib/library/abi-graphics::cxx-abi-symbols-a", "conf": 0.800000011920929, "crit": 2, "desc": "C++ ABI symbols cluster A", "spans": [ [ 2315, 12 ] ] } ], "type": "elf" }, { "id": 10, "mol": "O(C)H(Cm)", "sha": "0c3736468b40e0a92a1469960a2a5387271baa68f9aeb2853ceda12b0d0b9545", "path": "iproute2-7.1.0-r0.apk!!sbin/dpll", "risk": 2, "size": 43480, "type": "elf", "depth": 1 }, { "ctx": [ { "b": "boXZHx(kOBxBk8Xw/$q2a%XNSwNPa=x(mYefjFTkfkkwOa%o2\u003ea$)ztzzbEwB9RkkCP[noj0nSUwO}?YA+#{Jw/@:ox(kOrA0*h\u003e3t1D@BrAmA", "ln": 0, "col": 1, "line": 1 } ], "depth": 1, "facts": { "imp": [ [ "", "readlink" ], [ "", "rm" ], [ "", "exit" ] ], "tgt": [ "exit", "readlink", "rm" ], "metrics": { "ast": { "max_depth": 8, "call_count": 3, "node_count": 35 }, "file": { "size": 88, "entropy": 4.57 }, "text": { "lines": 6, "top_char": 105, "tab_count": 1, "digit_ratio": 0.02, "space_count": 10, "char_entropy": 4.57, "unique_chars": 35, "top_char_null": 0, "string_density": 0.33, "top_char_ratio": 0.11, "avg_line_length": 13.67, "max_line_length": 51, "empty_line_ratio": 0.17, "last_line_length": 6, "whitespace_ratio": 0.19, "identifier_density": 1.5, "line_length_stddev": 17.31, "max_whitespace_run": 1, "normalized_string_count": 0.82, "suspicious_string_ratio": 0.5, "normalized_unique_identifiers": 1.93 }, "binary": { "peak_region_bytes": 88, "peak_region_entropy": 4.57 }, "strings": { "bytes": 31, "count": 2, "shell": 1, "avg_length": 15.5, "max_length": 19, "path_count": 2, "avg_entropy": 3.4, "entropy_stddev": 0.38 }, "comments": { "chars": 8, "count": 1, "lines": 1, "to_code_ratio": 0.2 }, "consistency": { "extension_content_mismatch": 1, "extension_content_mismatch.script_as_unknown": 1 }, "identifiers": { "count": 9, "unique": 5, "avg_length": 4.6, "max_length": 8, "min_length": 2, "avg_entropy": 1.85, "reuse_ratio": 0.56, "length_stddev": 2.5, "all_lowercase_ratio": 0.6 } } }, "id": 11, "mol": "H(F)Md₂(Bk)", "path": "iproute2-7.1.0-r0.apk!!.post-install", "pid": 0, "risk": 3, "sha": "abc97f1c4a4cbb0290c8cf5d1e9b2c05b51e09883320618e8fd0d8e415f1d760", "size": 88, "traits": [ { "id": "metadata/build/package/maintainer-scripts::apk-maintainer-script-basename", "conf": 0.95, "crit": 3, "desc": "Alpine apk maintainer script basename" }, { "id": "metadata/file/extension/mismatch::script-content-unregistered-extension", "conf": 0.9, "crit": 3, "desc": "Script content under an unregistered suffix" }, { "id": "micro-behaviors/fs/link/symlink::readlink", "conf": 0.8, "crit": 3, "desc": "Read symbolic link target path", "spans": [ [ 19, 8 ] ] }, { "id": "metadata/build/archive::github-versioned-source-archive-member", "conf": 0.95, "crit": 2, "desc": "GitHub versioned source archive member" } ], "type": "shell" }, { "id": 12, "sha": "74f590a05d5c25cfce234b0ea2f0f2cfb6bc93b11fe66aef1b36a7df7d250a76", "path": "iproute2-7.1.0-r0.apk!!.PKGINFO", "risk": 1, "size": 1088, "type": "text", "depth": 1 } ], "omitted_files": 3, "v": "8" } }