{ "llm": { "conf": 0.4612202, "grade": "benign", "model": "Qwen/Qwen3.6-27B", "review": false, "outcome": "benign", "interpretation": "Legitimate Dovecot MySQL driver library" }, "ml": { "v": "7", "eng": "2.2.0-beta.1", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.23031452, "rte": "az", "prob": 0.23031452 } ], "prob": 0.23031452, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.23031452298164368, "type": "xz" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.04727441072463989, "type": "elf" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.000033408403396606445, "type": "deb" } ], "version": "v18.18", "analyzed_at": "2026-07-05T13:43:32Z" }, "path": "dovecot-mysql-2.3.21.1.tgz", "raw": { "files": [ { "id": 0, "ctx": [ { "b": "@wP48s]XK9\u003egl[e0STwA761smBt8:J\u0026Bh:F?cy1e7Y", "n": [ { "c": 2, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "o": 0, "z": 1, "cf": 1.0 } ], "ln": 0 } ], "mol": "H(Db₂)Md(He)", "sha": "ee68ae083287440a93ecac0edb25bf0f52aaf672a4b4951098e597da7ab655e6", "path": "dovecot-mysql-2.3.21.1.tgz", "risk": 3, "size": 15392, "type": "xz", "facts": { "metrics": { "file": { "size": 15392.0, "entropy": 7.99, "size_bytes": 15392.0 }, "binary": { "overall_entropy": 7.99, "peak_region_bytes": 15360.0, "peak_region_entropy": 7.84 }, "consistency": { "extension_content_mismatch": 1.0, "extension_content_mismatch.archive_as_archive": 1.0 } } }, "traits": [ { "id": "micro-behaviors/dylib/library/libc::libc-characteristic-cxa-finalize", "crit": 2, "desc": "libc characteristic cxa finalize", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/dylib/library/libc::libc-internal-functions-b", "conf": 0.699999988079071, "crit": 2, "desc": "libc internal symbols cluster B", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/dylib/library/abi-graphics::cxx-abi-symbols-a", "conf": 0.800000011920929, "crit": 2, "desc": "C++ ABI symbols cluster A", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/dylib/library/family::cxx-abi-symbols", "conf": 0.800000011920929, "crit": 2, "desc": "C++ ABI symbols", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/db/mysql::mysql-real-connect", "conf": 0.8999999761581421, "crit": 3, "desc": "mysql_real_connect function", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/data/db/influxdb::influxdb-flight-sql-ticket", "conf": 0.949999988079071, "crit": 3, "desc": "InfluxDB Arrow Flight SQL ticket", "from": [ { "file": 1 } ] }, { "id": "metadata/build/artifact::elf-stripped-but-symtab-present", "conf": 0.6000000238418579, "crit": 3, "desc": "ELF stripped with .symtab present", "from": [ { "file": 1 } ] }, { "id": "metadata/hardening/mitigation::rpath-set", "conf": 0.699999988079071, "crit": 3, "desc": "RPATH/RUNPATH dynamic library path set", "from": [ { "file": 1 } ] } ] }, { "ctx": [ { "b": "E))420S-r400000000000@$H+0rr915fR2N00000kMy=:00000PL:-f0000000000kMA+z2lm0?9SNhX1][S61onA4kMy=:00000kMy=:00000kMy=:00000HYEFQ00000HYEF", "ln": 0 }, { "b": "000000002*m/SI?0002*m/SI?0000003zmw00001000060000Uo8[}(0000Uocsim0000Uocsim0001H2lj-70001H2lj-70000003zmw00002000060000gp5\u003em]0000gp9oJp0000gp9oJp0001X0rr910001X0rr91000080000000004000040002qm/SI?0002qm/SI?0002qm/SI?0000I000000000I000000000400000", "ln": 145 }, { "b": "00000k(Z(+f-RgNbME/A00000fAq7M00000000004GDFeeDt+JkMy=:00000000000000000000000000000000000?t)PR5c8Xg00000000000000000000EGfuF5c8Xg00000000000000000000e=U\u003eKaohxw00000000000000000000)/AE?5c8X", "ln": 1040 }, { "b": "HxdwP5c8Xg00000000000000000000761smaohxw000000000000000000000aftLzFo8TuT[s?uUj1\u0026vqGU7wDl7AwmY^)xk8BewPzc\u0026A:-/@uUKy\u0026zVBcKA+e($B97#luUjs!zdN6*zF0!!uRkGGqE%GPB97#llU{gLB7Gy)B8=26BAg/cB75N2x(v\u003e", "ln": 3152 }, { "b": "wO7{HuVQr$v@2BYxLQ%/BZYr30crc@uVZr%zGxk@BzkVhuT[1\u003eze190A@YMOB97\u00262yHpN+yHpWZx(0=^D2)$wuUam#zF]I(D2)$wuUam#z/L?(z!%ugA9)Z3zdJY?uVQsfwoz\u0026#Ab]VgBy\u003eI\u0026D2)$wuUi\u003e\u003ev}Yj=wO#d5xMBe\u003cD2)$wuUi\u003e\u003ev}Yj\u0026z*8g#D2)$wuVu", "ln": 3340 }, { "b": "uUap*vq]^+B98CpzF5@^D2)$wuT)[\u003cB7Ct*D2)$wuVf[9x(v)g0bW15ACP06B8ki8wPN]VuVZ10wI(dwzfZhxy*Ri]vqGpXz/fD7v@}YZC4CMkuVP!2uTW[)wO#3=y\u0026r@[Ab]J4x)oS0ACO#)x(^^5zF\u003c2}Bo2(VwPz*fASx/XAa9S#v/QN\u0026y*R6#ByeJ@zF\u003c2}By!#\u0026A+frmy\u0026/U]D2)$wuUjs\u0026wNxE?B9hqv0aYUMvrDyduVo}4yYFJ#A:@%90bW15ACP01B.$F$x\u003eq9\u003eA@Z65B8=26w[u6]xKtv=wO+)#0czN?BAg-awP[b-B.kk%A:Jl]AaJ]$0aGUWvrcT2Bz\u003eJ1wQ4M\u003cAbYxawb{7Yw[CQ{uTW[)wO#3=", "ln": 3710 }, { "b": "uU\u003cT[uUj1\u0026x(^%0wb{7Yw[CQ{uUjs\u0026wDlW/z!@=?y\u0026131z/fxpuT[a/vru5XwP?T5ByeD!wm5?PBy/96A^mUbuVpdexAicYB98CzAbolguVQf{v}xYYA9)WdA+6ri0crm5v}Y(.Byf9hA+6riuV*mdx(0=\u003euVo}50czN?BAg]mz#:=!Byf9hAX.PLA=.q5BAg-gz^NT3zGC", "ln": 4032 }, { "b": "C4CMkuT)I^wOk}4D0+SjyYFo=vR]K]x\u003c\u003eKYe]$}-gxql9vSuKeByu!yz.r:Ay?Wu*e]$}-f!@-owO#2Uy?Wu?A+PYdA:JWeB8=1GB8I4iB-RNRAbf8ty?WtU000000001bocsim00008000000002^df6tF0001jocsim00008000000002YaPIGx0001$o8", "ln": 4553 }, { "b": "GtX5k00000000000000000000001r^asH@my?mc1w]zYjc3ptKwN/^g0a*g\u003ez/Ph{z!9zVwPz*fASxS\u003cx)a6deP2=OACNmq0aP?VwO#O\u0026zfZhxy:ZPJdlnNKlVl\u003cWwN/*@zF5@KcJF1eB8=1sBAg/cB75N2x(v\u003e?zfZhxy-)nex)a6d0bW15ACLR(D2)$wiV[AkA+PYdAXhcNB8=1Gv(=w9hVMxum[rR[z/Z12xM4%lvpS[?0cJu]ASy5!B8}", "ln": 15274 }, { "b": "000000000000000000000000000000000000000000000000000000000000%nSc0%nSc00000000000%nSc0%nSc000000000000000000000)i@2n00000\u003c@\u003cZ8000000000000000000000000000000000000000000000000000000000000000", "ln": 19208 }, { "b": "0000000000000000000000000000000000000000000000000000000000000rr9100000tlL0b000000rr9100000yxTXr000000rr9100000C)afF000004GDFe00000I3i\u003eV000004/=Of00000Ocn()000003\u0026*nc00000Fe!K?000004fcwd00000", "ln": 19936 }, { "b": "0000005)1u00000000000000007PyziV]?*vLYbZfFUBsfFCEnatCM5h7*M.bU?])lq{okay/Clx!AsnB%5H(f^5k9f!+mmi4(%AatC\u0026pfFLQAh6uTLwPzAamr\u0026+]bMG8+wPQmql](D2A=+=4xk8loq.i8mf!Lj7gb7BpfekgmgCx}ai65\u0026OiYe]uyhWW7xcoS/A3czabU?])lq{okay/ClwO#3hq.i8mf!Lg6gb7BpfebvsfGgaei65-FiX@PnyhWW7xcoS/A3czabU?])lq{okay/Clzz1\u003csB%5H(f^5k9f!+mmi4(%AatC\u0026pfFLQAh6uTLwPzAamr\u0026+]bME/A0p!wp00000000000000000\u0026M800\u0026M800\u0026M800\u0026M802\u003e[r0096100000001F#dJ?G8awuiMwO-F=A=lbnwmYo]dK([F0p!wp00000000000000000\u0026M800\u0026M800\u0026M800\u0026M802\u003e[r0096100000001F#dJ?G8awuiMwO-F=A=lbnwmU", "ln": 21155 } ], "depth": 1, "facts": { "exp": [ [ "driver_mysql_result" ], [ "driver_mysql_init" ], [ "driver_mysql_version" ], [ "driver_mysql_error_result" ], [ "driver_mysql_db" ], [ "driver_mysql_deinit" ] ], "imp": [ [ "", "t_buffer_alloc" ], [ "", "sql_result_unref" ], [ "", "register_frame_info" ], [ "", "t_str_new" ], [ "", "mysql_options" ], [ "", "mysql_query" ], [ "", "stack_chk_guard" ], [ "", "sql_driver_unregister" ], [ "", "mysql_num_fields" ], [ "", "Jv_RegisterClasses" ], [ "", "p_strdup" ], [ "", "event_category_sql" ], [ "", "sql_disconnect" ], [ "", "t_strdup_printf" ], [ "", "mysql_init" ], [ "", "cxa_finalize" ], [ "", "t_push" ], [ "", "time50" ], [ "", "pool_alloconly_create" ], [ "", "t_buffer_get" ], [ "", "sql_driver_register" ], [ "", "strlen" ], [ "", "mysql_fetch_row" ], [ "", "t_strdup_until" ], [ "", "buffer_append_c" ], [ "", "mysql_close" ], [ "", "mysql_real_connect" ], [ "", "sql_result_next_row" ], [ "", "net_str2port" ], [ "", "mysql_fetch_lengths" ], [ "", "default_pool" ], [ "", "stack_chk_fail" ], [ "", "sql_transaction_finished_event" ], [ "", "e_info" ], [ "", "mysql_affected_rows" ], [ "", "mysql_error" ], [ "", "sql_result_get_error" ], [ "", "event_unref" ], [ "", "str_to_uint" ], [ "", "binary_to_hex_append" ], [ "", "event_create" ], [ "", "mysql_fetch_fields" ], [ "", "sql_connection_log_finished" ], [ "", "io_loop_time_refresh" ], [ "", "t_strdup" ], [ "", "mysql_ssl_set" ], [ "", "sql_query_finished_event" ], [ "", "buffer_free" ], [ "", "mysql_store_result" ], [ "", "mysql_real_escape_string" ], [ "", "mysql_next_result" ], [ "", "str_c" ], [ "", "t_strsplit_spaces" ], [ "", "ioloop_time" ], [ "", "mysql_escape_string" ], [ "", "event_want_level" ], [ "", "sql_transaction_add_query" ], [ "", "sql_query_s" ], [ "", "i_fatal_status" ], [ "", "event_send_abort" ], [ "", "mysql_errno" ], [ "", "e_debug" ], [ "", "event_create_passthrough" ], [ "", "i_panic" ], [ "", "event_set_append_log_prefix" ], [ "", "strcmp" ], [ "", "buffer_append" ], [ "", "sql_not_connected_result" ], [ "", "sql_transaction_rollback" ], [ "", "strchr" ], [ "", "mysql_free_result" ], [ "", "sql_connect" ], [ "", "sql_transaction_commit_s" ], [ "", "e_error" ], [ "", "event_add_category" ], [ "", "t_pop" ], [ "", "sql_db_set_state" ], [ "", "deregister_frame_info" ] ], "sec": [ [ ".hash", 456, 628, 1.5, "alloc" ], [ ".dynsym", 1088, 2112, 1.26, "alloc" ], [ ".dynstr", 3200, 1449, 4.38, "alloc" ], [ ".rela.dyn", 4656, 984, 1.99, "alloc" ], [ ".rela.plt", 5640, 1656, 1.69, "alloc,info_link" ], [ ".init", 7296, 14, 3.24, "alloc,executable" ], [ ".plt", 7312, 1120, 4.2, "alloc,executable" ], [ ".plt.got", 8432, 32, 3.19, "alloc,executable" ], [ ".text", 8464, 6785, 6.01, "alloc,executable" ], [ ".fini", 15264, 14, 3.24, "alloc,executable" ], [ ".rodata", 15296, 1319, 4.88, "alloc" ], [ ".eh_frame_hdr", 16616, 300, 4.41, "alloc" ], [ ".eh_frame", 16920, 1452, 4.8, "alloc" ], [ ".note.netbsd.ident", 18372, 24, 3.0, "alloc" ], [ ".note.netbsd.pax", 18396, 20, 1.56, "alloc" ], [ ".ctors", 19256, 16, 1.0, "write,alloc" ], [ ".dtors", 19272, 16, 1.0, "write,alloc" ], [ ".jcr", 19288, 8, 0.0, "write,alloc" ], [ ".data.rel.ro", 19296, 688, 0.84, "write,alloc" ], [ ".dynamic", 19984, 400, 1.36, "write,alloc" ], [ ".got", 20384, 72, 0.0, "write,alloc" ], [ ".got.plt", 20480, 576, 1.83, "write,alloc" ], [ ".data", 21056, 120, 0.48, "write,alloc" ], [ ".comment", 21176, 27, 3.78, "merge,strings" ], [ ".ident", 21203, 222, 4.7, "merge,strings" ], [ ".SUNW_ctf", 21428, 143, 2.89, "" ], [ ".symtab", 21576, 4032, 1.84, "" ], [ ".strtab", 25608, 2469, 4.52, "" ], [ ".shstrtab", 28077, 239, 4.17, "" ] ], "metrics": { "elf": { "bits": 64, "entry": 8464, "has_got": 1, "has_plt": 1, "has_note": 1, "has_rpath": 1, "relacount": 31, "has_symtab": 1, "note_count": 2, "nx_enabled": 1, "dynrel_count": 0, "dynsym_count": 88, "has_eh_frame": 1, "no_gnu_stack": 1, "stack_canary": 1, "symtab_count": 168, "dynrela_count": 41, "little_endian": 1, "pltreloc_count": 69, "executable_stack": 0, "wx_segment_count": 0, "comment_entry_count": 1, "program_header_count": 7, "stripped_with_symtab": 1, "comment_distinct_count": 1, "executable_segment_count": 1, "load_segment_max_file_size": 18416, "load_segment_max_memory_size": 18416, "section_relocation_group_count": 2, "stripped_metadata_section_count": 5 }, "file": { "size": 30240, "entropy": 4.52 }, "binary": { "is_pie": 0, "has_overlay": 1, "is_stripped": 0, "code_entropy": 5.73, "data_entropy": 1.19, "overlay_size": 1924, "string_count": 224, "overlay_ratio": 0.06, "overlay_entropy": 1.44, "entropy_variance": 2.69, "avg_string_length": 18, "max_string_length": 73, "peak_region_bytes": 7168, "code_to_data_ratio": 0.81, "peak_region_entropy": 5.85, "string_length_stddev": 10.81, "largest_section_ratio": 0.22, "sentence_string_count": 28, "sentence_string_ratio": 0.13, "high_entropy_string_count": 0 }, "exports": { "count": 6 }, "imports": { "count": 78 }, "sections": { "count": 30, "code_size": 7965, "entropy_max": 6.01, "entropy_mean": 2.68, "name_entropy": 4.11, "writable_count": 8, "executable_count": 5, "nonstandard_count": 8, "executable_writable_count": 0 }, "dependencies": { "count": 3 } } }, "id": 1, "mol": "H(Db)Md₂(HeV)", "path": "dovecot-mysql-2.3.21.1.tgz!!lib/dovecot/libdriver_mysql.so", "pid": 0, "risk": 4, "sha": "f1f207ec484dd5b90d56d76e33adf2ea032e736f0f13e41364019eb0e330d629", "size": 30240, "traits": [ { "id": "metadata/file/string/process-name::mysql-name", "conf": 0.4, "crit": 3, "desc": "MySQL database server name", "spans": [ [ 15343, 5 ] ] }, { "id": "metadata/hardening/mitigation::partial-relro", "conf": 0.8, "crit": 3, "desc": "Partial RELRO (GOT partially protected)" }, { "id": "metadata/vendor/identity::sunw-ctf-section", "conf": 0.95, "crit": 3, "desc": "Compact C type format section", "spans": [ [ 21428, 9 ] ] }, { "id": "micro-behaviors/data/db/mysql::mysql-real-connect", "conf": 0.9, "crit": 3, "desc": "mysql_real_connect function", "spans": [ [ 3774, 18 ] ] }, { "id": "micro-behaviors/mem/protect/modify::repeated-07-byte-constant", "conf": 0.25, "crit": 3, "desc": "Repeated 0x07 byte constant", "spans": [ [ 209, 4 ] ] } ], "type": "elf" }, { "depth": 1, "facts": { "metrics": { "file": { "size": 27878.0, "entropy": 4.27, "size_bytes": 27878.0 }, "binary": { "overall_entropy": 4.27, "peak_region_bytes": 6144.0, "peak_region_entropy": 5.47 }, "consistency": { "extension_content_mismatch": 1.0, "extension_content_mismatch.archive_as_unknown": 1.0 } } }, "id": 2, "path": "dovecot-mysql-2.3.21.1.tgz!!lib/dovecot/libdriver_mysql.a", "sha": "2a0da9c1c4d353bb2086c041588c8cc4b8b13c51806d9f6ab53173f586049616", "size": 27878, "type": "deb" } ], "rev": "868bd", "v": "8" } }