{ "ml": { "v": "7", "eng": "2.8.0", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.000018666187, "rte": "az", "prob": 0.000018666187 }, { "cls": 0, "raw": 0.0000001291434, "rte": "az/rpm", "prob": 0.0000001291434 } ], "prob": 0.000018666187, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.00001866618731583003, "type": "rpm" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.000008672475814819336, "type": "elf" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.000009079773917619605, "type": "registry" } ], "version": "v18.18", "analyzed_at": "2026-08-28T15:41:51Z" }, "path": "dragon-26.08.0-1.fc46.aarch64.rpm", "raw": { "files": [ { "id": 0, "mol": "H(Cm)Md₂(BiPa)", "sha": "f07f19e9fa6da4146736ca816287bd6bcbbf7d9092e13348ae1c88309be05fd9", "path": "dragon-26.08.0-1.fc46.aarch64.rpm", "risk": 3, "size": 241585, "type": "rpm", "facts": { "metrics": { "rpm": { "buildtime": 1786751872 }, "file": { "size": 241585, "entropy": 7.81 }, "binary": { "peak_region_bytes": 196529, "peak_region_entropy": 7.84 } } }, "ident": { "name": { "value": "dragon", "source": "rpm.name", "verified": false }, "urls": [ { "url": "https://apps.kde.org/dragonplayer/", "kind": "homepage", "source": "rpm.url" } ], "trust": "unsigned", "authors": [ { "name": "Fedora Project", "role": "packager", "source": "rpm.packager" } ], "version": { "value": "26.08.0", "source": "rpm.version", "verified": false }, "organization": { "value": "Fedora Project", "source": "rpm.vendor", "verified": false } }, "traits": [ { "id": "metadata/binary/linking/runtime::library-loader-dep", "conf": 1.0, "crit": 3, "desc": "ELF directly depends on the dynamic loader", "from": [ { "file": 1 } ] }, { "id": "metadata/binary/linking/runtime::dynamic-loader-needed", "conf": 0.7, "crit": 3, "desc": "ELF needs the Linux dynamic loader" }, { "id": "metadata/binary/linking/runtime::glibc-needed", "conf": 1.0, "crit": 3, "desc": "ELF depends on glibc" }, { "id": "micro-behaviors/communications/http/url/domain::http-url-binary", "atk": "T1071.001", "mbc": "C0002", "conf": 0.7, "crit": 3, "desc": "Embedded HTTP or WebSocket URL", "from": [ { "file": 1 } ] }, { "id": "metadata/package/files/system-package::fedora-rpm-vendor", "conf": 0.99, "crit": 3, "desc": "Fedora Project RPM vendor identity" }, { "id": "metadata/package/files/system-package::rpm-signature-present", "conf": 0.95, "crit": 3, "desc": "RPM signature header is present" } ] }, { "ctx": [ { "b": "E))420S-r400000000000%2!g0rr91Z.)aL00000kMy=:00000ao?\u0026D0000000000kMA+z3\u0026\u0026J)aoiF-1][S61onA4kMy=:00000kMy=:00000kMy=:00000PAk8[00000PAk8[000002MK\u00268000000@@r31onA41oOS7000001oOS7000001oOS7000008VP\u003cr00000", "ln": 0 }, { "b": "wPy:AlU{WUwMi8Ey?iPNuU\u003cB=v{:q0vrcD%zddc@0af8yCWT@\u003ex(mu}x)Ks\u003cvpBd}Bo2VKhFW1YibSn6ojH)OuJsCppd)r1oh6nlvqGU7wN[.YA+PA7ico7qBAh8kxgl$zuS{hVhCl.Zv{%g/DsZR=BAh8kxgaEyB]U(RB97\u00262yHpN+yHpWZx(0=Rt23!aof)39B-Z2WByvJ\u003emn==qqb.NSx(mMZgg9%nuSeZ!pbaK$l1j+PBwcyUwO#N2f!=pnv}xL0wLlPWmn\u003e%Gq.?YUgg9%nuJsCppbaB}l1j+PBvoLVvkf-.wPQsKB8b(oA7jLTwLMVJwKPG\u0026h=iH}A+PA70ab", "ln": 1847 }, { "b": "A=k!{By)H3f/h-]D30Q-A=LPlr+Vb?0ae]8f!(K8wQ5q}BAg@3zesnZv/P\u003eyxjVf[B:e7ryYE*HB97\u00262yHpN+yHpZ%vrb(Uy?WuKmM9*)ibRPgy+x^Ee\u0026AYCx\u003c%.8hBzH[B7^gEz.r{Fy?WuQBt^0ky+x^Ee\u0026AYCx\u003c%}YhDKQ6xjVgae]$}-humMcvOofGnD", "ln": 2850 }, { "b": "y?WuQBt=H8A+c\u003eAz.r{Fy?Wu*e]$}-humM7eO]csB:bGDvrb\u003c\u003ehz^4cz.r:Am[=GvlTIP3f/G8fByc{am[=GvlTJbCnNB\u003e+uS6r^qufiXnKt^Kga\u003evt08W\u0026BhzcZs000000000000ic50000000004000000000500Jub00-Gd00ic200ri300Jua00ri500ic40000000-G700\u0026Ma00SAd00icb00-G700001009641POJl0000w0001=K^lgK00@Sy1POJ5000010097[1onAk0000w00", "ln": 3049 }, { "b": "5UqI*5Ak*maoAUoa0pWouNb:7[bJEn5U.!\u003e5ct1SaoAUoa0pWouNb:7[bJEn5Ve7]5f:o1aoAUoa0pWouNb:7[bJEn5VOv%5jeKxaoAUoa0pWouNb:7[bJEn5W1U15mN!+aoAUoa0pWouNb:7[bJEn5WB}55q06caoAUoa0pWouNb:7[bJEn5W\u003ej95tzsIaoAUoa0pWouNbZ", "ln": 4864 }, { "b": "aoAUoa0pWo000000000000000000000000000000ko*oX%3D$qbvD72.VluI@D/iS@LF=2\u00262.%f?#A=70q]v.]p(rY6952]0SUHY\u0026*fVv0SW=0\u0026kkLS\u0026SxjY\u0026D20Y", "ln": 5280 }, { "b": "000000000007p\u003coxk.Vgp\u00266M=wPv+J05uC+fGpWs06}-Jx\u003eg^[aAhd9D1z1sBzb98azth8ayMynB75J(y?X0pazbL4B-NJ.0000007gWzD2^RixMLvLfFCyoawDo?av{A{wO=e\u0026lVl{?A+Pf1BrAs)fGgK9nNVGVo(B]\u0026z!fnyz/x#xx\u003eIa3atLSag9xa@A:-={ax8#@By/E)000000b()\u003ce]b0ee[x0hxk.Wby*?Q2ASu7t0b()\u003ce]b0ee[x0hxk.U/08l)ozu6Up0aYUMvrDyd07Hyhy?mc1Bz\u0026prz^^f0qb6.bv@C)?e*9]cBy=OlA+PDjaz2Olz/P[x000000aV7I0at\u003eu0b?\u003cP0b}{O0at\u003eM0a=dJ00000000000b8vO0cwiW0cnc3051s90aM1E0bRZM0bhBP0cnb)0bzNB0a=c.0b?\u003cT0a#o+0aV7I0at\u003eu0b?\u003cP000000cnc.0aC}B0bhBP06*J[0cFoO0cnb)0bzNB0a=c.0b?\u003cT0a#oi00ic20000000a2vj5=gW00@S906{qU@$CFl008@%%5Yp406{FZ%7?Vn0hfn\u0026@@", "ln": 7135 }, { "b": "vp%H@a$K{YwPz\u003caz/c:Wa#h5efGpWseIO\u003e\u0026v(c7/efXIyv}YN#wN/?8A+cBQb4j]2v}W+Sa$K{RB3\u003c[Tb03]TAaI6-z-RGwwn=G%Ab](iwN/*yw[tH\u003eA:.0=h6NCG0000000000000000000000000000000000000000000000000000000000000000000", "ln": 8040 }, { "b": "0000000000000000000000000000000000000000000000000000000000000sG8i00000wo89\u003ez/dcZhzcWye?!\u003eie[OPIhzeADA:@=vg+JrIvS=q-:*Ep=@wP48s]XK9\u003egl[e1I\u0026:$KsRKQ761sm00000\u003e9$e:\u00261=?aq^xw/KWT}pj=c5\u0026IS6plQqCQazA6h+c=$fKb8Yfs!(m*)a[iLR8]cr=tl.oD4T7DVsGP(KLk12O^YN6g8g7kFN-ZsFIF90ceRmq\u003eN1T9]}F.qFF)+V)UH%a{CX334gs=Rl{q\u00263zVE.4)c^%VJpC==dmVUhNi.1/p^@MCdrFHkp/SpNyblscV-#6/!m)S*k!Lg%WZ:y6w:iNRNh*8G9xpV5$BA$yeg/dwRZ6P:ze(te*JcDHKcROcOR\u0026}=q\u0026S)@*hTkF\u0026Wwn=2E]3.f[cBU6W$U^oEi1M%zrk?r?Yxx0L9g=bph.omAIG\u003ec5n4]X3ofN\u0026)pEFg)?)f7yAqY/Wn+d^39{/lFAy)hb\u003eTwql+!=hVa1wL-IcHFgbS.j3IZa/YB9L?f[h=RB8?C25yWs[xg^jx9xEv^:)+:8h}GksEd:?FGn=eLf!xdM@\u0026irmoW?S+8g^eMUknUCCML\u0026+TMaKoJ]hMfR1^]J*YDf5J}Vc![l2%4!apnCp1$rWEl%kIIstCY^-3.Q}!+!+9A@\u0026Kf%$waZwFGCV)K?[}2ng4uh9S)\u003cSwdeH=)HLWE0QGeerO!JaaOIku3[*QbH#Hyr2F?qowvJ", "ln": 65504 }, { "b": "005ONRfxh.xzR-g00004sY$!TB7/SpA=+-004@ecBy^7qzGNNvB.LV5eOO.}e[]iBwPz.\u0026e[Y6Ae[!WmxAfU}D2vXGz2=h0D2vXBASv.8zGNNPwPz\u003caz/bLcxkR\u0026AC4CYnx(v(@ASv.jwO+^cwo\u00264)e]\u003eJtvj(InBo0}lwO=xtwo\u00264)e[]iqBo0}nwQ5p%e[O*nx-G=az!9o#ve}]\u003exKtv(vqPN.xA", "ln": 66762 }, { "b": "By^7zvpK7YxjR5}x(mTbuTW$}vr?\u00269w[=c%uTW$}vr?\u00269wmoN*e]\u003eJte]\u003e\u003ege[xlBvqPZ*04}]5Bo0}7vrt]Te]+#RwPz\u003caz/bLcvSMO\u003ce[Y6AuU0.SB.tJ8zFGk8xkR\u003c0wmYj)xjLB)ve{oc000000000000000000000000000000000000000000000000000000000000000000000000000000003JHeb2lj-70SSi200000?#S(U00000?#S(U00", "ln": 66988 } ], "depth": 1, "facts": { "exp": [ [ "main" ], [ "init" ], [ "start" ], [ "fini" ] ], "imp": [ [ "", "ZNK16KLocalizedString8toStringEv" ], [ "", "ZN11QTextStreamlsEc" ], [ "", "ZN5QIconD1Ev" ], [ "", "ZN16KLocalizedStringD1Ev" ], [ "", "ZN10KAboutData18setApplicationDataERKS_" ], [ "", "ZN20KLocalizedQmlContext20setTranslationDomainERK7QString" ], [ "", "libc_start_main" ], [ "", "ZN10KAboutData18setDesktopFileNameERK7QString" ], [ "", "ZN10KAboutDataC1ERK7QStringS2_S2_S2_N13KAboutLicense10LicenseKeyES2_S2_S2_S2_" ], [ "", "gmon_start__" ], [ "", "ZN21QQmlApplicationEngineC1EP7QObject" ], [ "", "ZN21QQmlApplicationEngineD1Ev" ], [ "", "ZN12QApplicationD1Ev" ], [ "", "cxa_finalize" ], [ "", "ZN12QApplication4execEv" ], [ "", "ZN11QTextStreamlsERK7QString" ], [ "", "Z6ki18ndPKcS0_" ], [ "", "ZN15QGuiApplication13setWindowIconERK5QIcon" ], [ "", "ZN10KAboutDataD1Ev" ], [ "", "ZNK21QQmlApplicationEngine11rootObjectsEv" ], [ "", "ZN21QQmlApplicationEngine14loadFromModuleE14QAnyStringViewS0_" ], [ "", "ZN5QIcon9fromThemeERK7QString" ], [ "", "ZN7QString10fromLatin1E14QByteArrayView" ], [ "", "ZN10QArrayData10deallocateEPS_xx" ], [ "", "ZN7QString8fromUtf8E14QByteArrayView" ], [ "", "ITM_registerTMCloneTable" ], [ "", "ZN13KLocalization8Internal22createLocalizedContextEP10QQmlEngine" ], [ "", "getauxval" ], [ "", "ITM_deregisterTMCloneTable" ], [ "", "qt_version_tag" ], [ "", "ZN6QDebugD1Ev" ], [ "", "ZN12QApplicationC1ERiPPci" ], [ "", "abort" ], [ "", "ZNK14QMessageLogger7warningEv" ], [ "", "stack_chk_guard" ], [ "", "stack_chk_fail" ], [ "", "ZN6KCrash10initializeEv" ] ], "sec": [ [ ".note.gnu.build-id", 736, 36, 4.14, "alloc" ], [ ".interp", 772, 27, 4.21, "alloc" ], [ ".gnu.hash", 800, 28, 0.49, "alloc" ], [ ".dynsym", 832, 960, 0.99, "alloc" ], [ ".dynstr", 1792, 1358, 5.35, "alloc" ], [ ".gnu.version", 3150, 80, 1.69, "alloc" ], [ ".gnu.version_r", 3232, 240, 2.77, "alloc" ], [ ".rela.dyn", 3472, 144, 1.59, "alloc" ], [ ".rela.plt", 3616, 792, 1.88, "alloc,info_link" ], [ ".relr.dyn", 4408, 24, 1.61, "alloc" ], [ ".init", 4432, 28, 3.99, "alloc,executable" ], [ ".plt", 4464, 824, 4.56, "alloc,executable" ], [ ".text", 5312, 1788, 5.68, "alloc,executable" ], [ ".fini", 7100, 24, 3.72, "alloc,executable" ], [ ".rodata", 7128, 424, 4.28, "alloc" ], [ ".eh_frame_hdr", 7552, 84, 3.32, "alloc" ], [ ".eh_frame", 7640, 296, 3.89, "alloc" ], [ ".note.gnu.property", 7936, 32, 1.69, "alloc" ], [ ".note.ABI-tag", 7968, 32, 1.56, "alloc" ], [ ".note.package", 8000, 140, 4.83, "alloc" ], [ ".init_array", 64456, 16, 1.31, "write,alloc" ], [ ".fini_array", 64472, 8, 1.06, "write,alloc" ], [ ".data.rel.ro", 64480, 8, 1.55, "write,alloc" ], [ ".dynamic", 64488, 704, 1.52, "write,alloc" ], [ ".got", 65192, 344, 1.04, "write,alloc" ], [ ".data", 65536, 4, 0.0, "write,alloc" ], [ ".qtversion", 65544, 16, 0.99, "write,alloc" ], [ ".gnu_debuglink", 65560, 40, 4.44, "" ], [ ".gnu_debugdata", 65600, 1180, 7.8, "" ], [ ".shstrtab", 66780, 322, 4.3, "" ] ], "tgt": [ "fcn.000011a8", "fcn.000011d8", "fcn.00001208", "fcn.00001238", "fcn.00001298", "fcn.000012c8", "fcn.000012f8", "fcn.00001328", "fcn.00001358", "fcn.00001388", "fcn.000013a0", "fcn.000013b8", "fcn.000013d0", "fcn.000013e8", "fcn.00001400", "fcn.00001418", "fcn.00001430", "fcn.00001448", "fcn.00001460", "fcn.00001478", "loc.imp.__gmon_start", "method.KAboutData.~KAboutData()", "method.KLocalizedString.toString() const", "method.KLocalizedString.~KLocalizedString()", "method.QApplication.~QApplication()", "method.QDebug.~QDebug()", "method.QIcon.fromTheme(QString const\u0026)", "method.QMessageLogger.warning() const", "method.QString.fromUtf8(QByteArrayView)", "method.QTextStream.operator\u003c\u003c(QString const\u0026)", "sym.__aarch64_ldadd4_acq_rel", "sym.call_weak_fn", "sym.deregister_tm_clones", "sym.i18nd_char_const___char_const____clone_.constprop.0", "sym.imp.__libc_start_main" ], "funcs": [ [ "fcn.00001154", 4436 ], [ "fcn.00001174", 4468 ], [ "method.KLocalizedString.toString() const", 4496 ], [ "fcn.000011a8", 4520 ], [ "method.QIcon.~QIcon()", 4528 ], [ "method.KLocalizedString.~KLocalizedString()", 4544 ], [ "fcn.000011d8", 4568 ], [ "method.KLocalizedQmlContext.setTranslationDomain(QString const\u0026)", 4576 ], [ "sym.imp.__libc_start_main", 4592 ], [ "fcn.00001208", 4616 ], [ "method.KAboutData.KAboutData(QString const\u0026, QString const\u0026, QString const\u0026, QString const\u0026, KAboutLicense::LicenseKey, QString const\u0026, QString const\u0026, QString const\u0026, QString const\u0026)", 4624 ], [ "loc.imp.__gmon_start", 4640 ], [ "method.QQmlApplicationEngine.QQmlApplicationEngine(QObject*)", 4656 ], [ "fcn.00001238", 4664 ], [ "method.QQmlApplicationEngine.~QQmlApplicationEngine()", 4672 ], [ "method.QApplication.~QApplication()", 4688 ], [ "method.QTextStream.operator\u003c\u003c(QString const\u0026)", 4736 ], [ "fcn.00001298", 4760 ], [ "method.QGuiApplication.setWindowIcon(QIcon const\u0026)", 4768 ], [ "method.KAboutData.~KAboutData()", 4784 ], [ "fcn.000012c8", 4808 ], [ "method.QQmlApplicationEngine.loadFromModule(QAnyStringView, QAnyStringView)", 4816 ], [ "method.QIcon.fromTheme(QString const\u0026)", 4832 ], [ "fcn.000012f8", 4856 ], [ "method.QArrayData.deallocate(QArrayData*, int64_t, int64_t)", 4864 ], [ "method.QString.fromUtf8(QByteArrayView)", 4880 ], [ "fcn.00001328", 4904 ], [ "sym.imp.__getauxval", 4912 ], [ "method.QDebug.~QDebug()", 4928 ], [ "fcn.00001358", 4952 ], [ "sym.imp.abort", 4960 ], [ "method.QMessageLogger.warning() const", 4976 ], [ "fcn.00001388", 5000 ], [ "method.KCrash.initialize()", 5008 ], [ "fcn.000013a0", 5024 ], [ "fcn.000013b8", 5048 ], [ "fcn.000013d0", 5072 ], [ "fcn.000013e8", 5096 ], [ "fcn.00001400", 5120 ], [ "fcn.00001418", 5144 ], [ "fcn.00001430", 5168 ], [ "fcn.00001448", 5192 ], [ "fcn.00001460", 5216 ], [ "fcn.00001478", 5240 ], [ "fcn.00001490", 5264 ], [ "main", 5312 ], [ "fcn.000016c8", 5832 ], [ "entry.init0", 6528 ], [ "entry0", 6592 ], [ "sym.call_weak_fn", 6644 ], [ "sym.deregister_tm_clones", 6688 ], [ "entry.fini0", 6796 ], [ "entry.init1", 6880 ], [ "sym.i18nd_char_const___char_const____clone_.constprop.0", 6912 ], [ "sym.__aarch64_ldadd4_acq_rel", 7056 ], [ "fcn.00001bc0", 7104 ] ], "metrics": { "elf": { "bits": 64, "entry": 6592, "has_got": 1, "has_plt": 1, "has_note": 1, "note_count": 4, "nx_enabled": 1, "has_dt_relr": 1, "dynrel_count": 0, "dynsym_count": 40, "has_build_id": 1, "has_eh_frame": 1, "has_gnu_hash": 1, "no_gnu_stack": 0, "stack_canary": 1, "symtab_count": 0, "dynrela_count": 6, "has_debuglink": 1, "little_endian": 1, "dt_flags_1_raw": 134217729, "pltreloc_count": 33, "build_id_length": 20, "dt_versym_count": 40, "has_aarch64_bti": 1, "has_aarch64_pac": 1, "executable_stack": 0, "fini_array_count": 1, "init_array_count": 2, "wx_segment_count": 0, "program_header_count": 12, "stripped_with_symtab": 0, "has_direct_loader_dep": 1, "load_segment_max_file_size": 8140, "load_segment_max_memory_size": 8140, "section_relocation_group_count": 2, "stripped_metadata_section_count": 8 }, "file": { "size": 69152, "entropy": 1.19 }, "binary": { "is_pie": 1, "has_overlay": 1, "is_stripped": 1, "basic_blocks": 121, "code_entropy": 5.3, "data_entropy": 1.35, "overlay_size": 2050, "string_count": 99, "overlay_ratio": 0.03, "avg_complexity": 1.55, "max_complexity": 19, "huge_func_count": 0, "leaf_func_count": 17, "overlay_entropy": 1.43, "tiny_func_count": 48, "avg_basic_blocks": 2.16, "entropy_variance": 3.35, "avg_string_length": 21.42, "max_string_length": 123, "peak_region_bytes": 1024, "code_to_data_ratio": 0.71, "peak_region_entropy": 7.73, "string_length_stddev": 18.62, "largest_section_ratio": 0.03, "sentence_string_count": 5, "sentence_string_ratio": 0.05, "high_entropy_string_count": 0 }, "exports": { "count": 4 }, "imports": { "count": 37 }, "sections": { "count": 32, "code_size": 2664, "entropy_max": 7.8, "entropy_mean": 2.87, "name_entropy": 4.25, "writable_count": 8, "executable_count": 4, "nonstandard_count": 11, "executable_writable_count": 0 }, "functions": { "count": 56 }, "dependencies": { "count": 10 } } }, "id": 1, "mol": "H(Cm)Md(Bi)", "path": "dragon-26.08.0-1.fc46.aarch64.rpm!!usr/bin/dragon", "pid": 0, "risk": 2, "sha": "e12b185ce212a95913125bfd840d67b7d45cec2136f5a2faeb8f122feb5fc3b5", "size": 69152, "traits": [ { "id": "metadata/binary/linking/runtime::library-loader-dep", "conf": 1.0, "crit": 3, "desc": "ELF directly depends on the dynamic loader", "spans": [ [ 0, 32 ] ] }, { "id": "metadata/binary/linking/runtime::glibc-needed", "conf": 1.0, "crit": 3, "desc": "ELF depends on glibc" }, { "id": "metadata/binary/linking/runtime::dynamic-loader-needed", "conf": 0.7, "crit": 3, "desc": "ELF needs the Linux dynamic loader" }, { "id": "micro-behaviors/communications/http/url/domain::http-url-binary", "atk": "T1071.001", "mbc": "C0002", "conf": 0.7, "crit": 3, "desc": "Embedded HTTP or WebSocket URL", "spans": [ [ 7440, 24 ] ] } ], "type": "elf" }, { "depth": 1, "facts": { "metrics": { "file": { "size": 784, "entropy": 4.49 }, "binary": { "peak_region_bytes": 784, "peak_region_entropy": 4.49 }, "registry": { "is_deprecated": 0 } } }, "id": 2, "path": "dragon@26.08.0-1.fc46.registry.json", "pid": 0, "rel": "registry", "role": "sidecar", "sha": "3862e40c647856cbdf43ab5d2fd14f06cc95776c38a2c2ca50e40e5f5166b24c", "size": 784, "type": "registry" } ], "rev": "b59b7", "v": "8" } }