{
  "llm": {
    "conf": 0.42276466,
    "grade": "benign",
    "model": "Qwen/Qwen3.6-27B",
    "outcome": "benign",
    "interpretation": "Legitimate dd_rescue binary"
  },
  "ml": {
    "v": "7",
    "eng": "2.3.1-beta.0",
    "lvl": -1,
    "conf": 0,
    "mods": [
      {
        "cls": 0,
        "raw": 0.17537804,
        "rte": "az",
        "prob": 0.17537804
      }
    ],
    "prob": 0.17537804,
    "files": [
      {
        "id": 0,
        "lvl": -1,
        "conf": 0,
        "prob": 0.17537803947925568,
        "type": "xz"
      },
      {
        "id": 1,
        "lvl": -1,
        "conf": 0,
        "prob": 0.005375812295824289,
        "type": "elf"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-07-20T02:13:33Z"
  },
  "path": "dd_rescue-1.33.tgz",
  "raw": {
    "files": [
      {
        "id": 0,
        "ctx": [
          {
            "b": "@wP48s]XK9\u003egl[e0STwA761smBt8:J\u0026Aug\u003e)oGYu7!U0^ne\u0026SkxdX4ti$cZ^6RH4mV1Qiq6YLW4L=kii/z6iH!1Y\u0026jtzH:Bd[m2MtPSWUPPQ-N\u003cIj0E/4{*-9@",
            "n": [
              {
                "c": 2,
                "d": "Binary is not digitally signed",
                "i": "metadata/unsigned",
                "o": 0,
                "z": 1,
                "cf": 1.0
              }
            ],
            "ln": 0
          }
        ],
        "mol": "H(F₄)Md(He)",
        "sha": "f86ffcda3618b4d03b837202e01d6da8459f2669165538b4e4248151856fcbf8",
        "path": "dd_rescue-1.33.tgz",
        "risk": 4,
        "size": 25904,
        "type": "xz",
        "facts": {
          "metrics": {
            "file": {
              "size": 25904.0,
              "entropy": 7.99,
              "size_bytes": 25904.0
            },
            "binary": {
              "overall_entropy": 7.99,
              "peak_region_bytes": 25600.0,
              "peak_region_entropy": 7.84
            },
            "consistency": {
              "extension_content_mismatch": 1.0,
              "extension_content_mismatch.archive_as_archive": 1.0
            }
          }
        },
        "traits": [
          {
            "id": "micro-behaviors/fs/file/write/direct::write--pwrite",
            "conf": 0.6600000262260437,
            "crit": 2,
            "desc": "References POSIX pwrite API",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "metadata/binary/metrics/threshold::many-imports-50",
            "conf": 1.0,
            "crit": 1,
            "desc": "Binary has 50+ imports",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "micro-behaviors/os/random/crypto::srand-symbol",
            "conf": 0.4000000059604645,
            "crit": 2,
            "desc": "Random seed initialization (srand)",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/file/binary::file-read-operation",
            "atk": "T1005",
            "conf": 0.75,
            "crit": 1,
            "desc": "File-reading capability",
            "from": [
              {
                "off": 3382,
                "file": 1
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/file/binary::file-manipulation",
            "atk": "T1005",
            "conf": 0.75,
            "crit": 3,
            "desc": "File content manipulation (read/write/seek)",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "metadata/binary/metrics/threshold::rich-sentence-strings-20pct",
            "conf": 0.800000011920929,
            "crit": 1,
            "desc": "Binary has many sentence-like strings",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/file/write/direct::write--fwrite",
            "conf": 0.6600000262260437,
            "crit": 2,
            "desc": "References fwrite file-write API",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "micro-behaviors/ui/help::usage-label",
            "conf": 0.75,
            "crit": 1,
            "desc": "Command line usage text",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "micro-behaviors/ui/help::options-title",
            "crit": 2,
            "desc": "Options: label",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/chown::fchown-fn",
            "conf": 0.6600000262260437,
            "crit": 3,
            "desc": "Change file ownership by fd",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/file/read::read",
            "conf": 0.699999988079071,
            "crit": 2,
            "desc": "Read file descriptor (read/pread)",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/file/write/direct::write",
            "conf": 0.6600000262260437,
            "crit": 2,
            "desc": "POSIX file-write capability",
            "from": [
              {
                "off": 3375,
                "file": 1
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/file/open::fopen",
            "conf": 0.6600000262260437,
            "crit": 3,
            "desc": "Opens file with C fopen",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/chmod/modify::syscall-fchmod",
            "atk": "T1222",
            "mbc": "E1222",
            "conf": 0.6600000262260437,
            "crit": 3,
            "desc": "fchmod syscall",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "micro-behaviors/os/random/crypto::rand-symbol",
            "conf": 0.30000001192092896,
            "crit": 2,
            "desc": "Random number generation (rand)",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "metadata/hardening/missing::stripped-binary",
            "conf": 0.800000011920929,
            "crit": 3,
            "desc": "No full symbol table (likely stripped)",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/file/write/direct::write--write",
            "conf": 0.6600000262260437,
            "crit": 2,
            "desc": "References POSIX write API",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "micro-behaviors/ui/help::options-title-string",
            "crit": 1,
            "desc": "Options: label in binary strings",
            "from": [
              {
                "file": 1
              }
            ]
          }
        ]
      },
      {
        "ctx": [
          {
            "b": "E))420S-r400000000000@$H+0rr91=(h@+00000kMy=:00000/VBf]0000000000kMA+z2MN9\u00269rm5V1][S61onA4kMy=:00000kMy=:00000kMy=:00000ZYsAn00000ZYsAn000002MK\u00268000000@@r31onA400ic20000000ic20000000ic2000007x",
            "n": [
              {
                "c": 3,
                "d": "No full symbol table (likely stripped)",
                "i": "metadata/hardening/missing::stripped-binary",
                "o": 0,
                "z": 25,
                "cf": 0.800000011920929
              }
            ],
            "ln": 0
          },
          {
            "b": "0rr9100000flItRfkLuiwQ4=@fkLeKwO+%=B8I3U2lj-71onA40rr91pgXJlq:ZP=kN:UO1onA41onA40@@r3p*)Da0000000000lJv8^nb@R\u002600000df6tF00000",
            "n": [
              {
                "c": 1,
                "d": "Repeated 0x07 byte constant",
                "i": "micro-behaviors/mem/protect/modify::repeated-07-byte-constant",
                "o": 536,
                "z": 4,
                "cf": 0.25
              }
            ],
            "ln": 504
          },
          {
            "b": "0SSik000000000000000000000000F0SSik0000000000000000000000000y?Wu*e]$}-f!@-vwn=A#zuaJ+zdvB40af8AA=M5o0axtPA=.p[B9RUk0crf?zE--*zG6SgzGGE\u003cuUj1\u0026x-IHEwmY^)xk8BewPzc\u0026A:-/@uUKy\u0026zVBP{wO2SSxjVg7x\u003edi+BAg(dz#:lLAb](fzEEx[0af8CwPS3dzdNS$wmo:vfAt%3zf6og0af8OByxnGfAt@#y\u00261310aeuwuS7DFx(!xcAZKUKB8$]l0a].Oz*c70B98CjAcRB\u003cuVp6[B98CpzFa1\u003cuT[h6AaJx#vpANzw[bT}B7Ct)BAg]mz#+5[Ab]VgBy\u003eI\u003eAcbJex8()ZA=M8s0af8QBzkP6h822xCxdztwDl7Vz/{2rwPzd1vpANzuTE\u003ez0a*4\u003ex(Xcf0a]\u003ePByLqTuVQr$v@2BYxLQ%/BZYr30af8yCWT@\u003ex(mu}x)Ks\u003cuTE?+xk8BewPzc\u0026A:-/@uUKy\u0026zVB/^x(^?=AbP/iCWCr0zddl{xkNYVy\u0026r*00crBbv@Dl%0b(*#x(mCYuTEz^ByxnGfAu3gBz(bu0a{g)ByLqWvrl0$vqPMQvru79x(\u003ct!BAhIwv{%E\u003c0a{m.wDl^[A+foiz/L?\u0026z/xo90afLRvQ\u0026+VzFsg)B98Czx\u003eIr(yYFA#A+PSb0b#%\u0026vpPvPwO\u003e{@C(R]cA==kg0crm5y?mF:w[bH\u003ez!5\u0026PuVQr$v@2BYxLQ%!vqfJTxjVg6AcbD6z/fg/uUaa=000000001$ZArHR00008000000000MZ90yQ0002S.5@ZT000080000000008:rgD.0002..5@ZT00008000000002..5@ZT0000:.xn*U00008000000000-R#M!$0001b.xn*U0000",
            "n": [
              {
                "c": 3,
                "d": "Stack protector/canary enabled",
                "i": "metadata/hardening/build::stack-protector",
                "o": 3418,
                "z": 14,
                "cf": 0.8999999761581421
              },
              {
                "c": 3,
                "d": "fchmod syscall",
                "i": "micro-behaviors/fs/chmod/modify::syscall-fchmod",
                "o": 3409,
                "z": 6,
                "cf": 0.6600000262260437
              },
              {
                "c": 3,
                "d": "Change file ownership by fd",
                "i": "micro-behaviors/fs/chown::fchown-fn",
                "o": 3062,
                "z": 6,
                "cf": 0.6600000262260437
              },
              {
                "c": 3,
                "d": "File content manipulation (read/write/seek)",
                "i": "micro-behaviors/fs/file/binary::file-manipulation",
                "o": 3148,
                "z": 6,
                "cf": 0.75
              },
              {
                "c": 3,
                "d": "Opens file with C fopen",
                "i": "micro-behaviors/fs/file/open::fopen",
                "o": 3348,
                "z": 5,
                "cf": 0.6600000262260437
              },
              {
                "c": 2,
                "d": "libc version string pattern",
                "i": "micro-behaviors/dylib/library/libc::libc-version-string",
                "o": 2881,
                "z": 9,
                "cf": 0.800000011920929
              },
              {
                "c": 2,
                "d": "Generic file read/write operations",
                "i": "micro-behaviors/fs/file/read-write::binary-file-ops",
                "o": 2894,
                "z": 4,
                "cf": 0.800000011920929
              },
              {
                "c": 2,
                "d": "Read file descriptor (read/pread)",
                "i": "micro-behaviors/fs/file/read::read",
                "o": 3382,
                "z": 5,
                "cf": 0.699999988079071
              },
              {
                "c": 2,
                "d": "Truncate file",
                "i": "micro-behaviors/fs/file/truncate::truncate",
                "o": 3324,
                "z": 9,
                "cf": 0.5
              },
              {
                "c": 2,
                "d": "Write single bytes to file",
                "i": "micro-behaviors/fs/file/write/direct::fputc",
                "o": 3302,
                "z": 5,
                "cf": 0.6600000262260437
              },
              {
                "c": 2,
                "d": "References POSIX pwrite API",
                "i": "micro-behaviors/fs/file/write/direct::write--pwrite",
                "o": 3375,
                "z": 6,
                "cf": 0.6600000262260437
              },
              {
                "c": 2,
                "d": "Seeded random number generation",
                "i": "micro-behaviors/os/random/crypto::seeded-random",
                "o": 2926,
                "z": 5,
                "cf": 0.5
              },
              {
                "c": 2,
                "d": "Abort program execution",
                "i": "micro-behaviors/os/signal/handler::abort",
                "o": 2914,
                "z": 5,
                "cf": 0.8999999761581421
              },
              {
                "c": 2,
                "d": "Send signal to self",
                "i": "micro-behaviors/os/signal/handler::raise",
                "o": 3243,
                "z": 5,
                "cf": 0.8500000238418579
              },
              {
                "c": 2,
                "d": "Install signal handler",
                "i": "micro-behaviors/os/signal/handler::signal",
                "o": 3368,
                "z": 6,
                "cf": 0.8999999761581421
              },
              {
                "c": 2,
                "d": "Query system configuration information",
                "i": "micro-behaviors/os/sysinfo/config::sysconf",
                "o": 3270,
                "z": 7,
                "cf": 0.4000000059604645
              },
              {
                "c": 2,
                "d": "Get process ID",
                "i": "micro-behaviors/process/identity/query::getpid",
                "o": 2977,
                "z": 6,
                "cf": 0.30000001192092896
              },
              {
                "c": 2,
                "d": "Terminates process immediately without cleanup",
                "i": "micro-behaviors/process/terminate/signal::_exit",
                "o": 3319,
                "z": 4,
                "cf": 0.4000000059604645
              }
            ],
            "ln": 2833
          },
          {
            "b": "c37gSb}Z]:yBIp!c37jLapn8G0aYREA+fr4B.9PRc#0NhzZ^Z\u0026q/#}]vrcSow]zYjc37gXj%hd)0aYREA+fr4B.9PRc#0NhzZ^Z\u0026l3vfXwmYo]b$@2*llHhUaA}\u003cuBy/Ioc#-:rw]zZbwN(]foLFoedgc4P0aYREA+fr4B.9PRd0G9uzFs03dlnN",
            "n": [
              {
                "c": 2,
                "d": "Contains frequent English function words",
                "i": "metadata/file/profile/language::lang-english",
                "o": 35307,
                "z": 3,
                "cf": 0.800000011920929
              }
            ],
            "ln": 35259
          },
          {
            "b": "AbP!ub}Z]:yANOpz/6AmwGV8kaz+FbxjSh{B0a[7vqfQ5apoAoc37wNc364^00000c37wNc37wNwmP4/wPIv7wJy}Zx(mK3dlnOJA+PGewGU]mwPA0nx()]ec{*\u003c7",
            "n": [
              {
                "c": 1,
                "d": "again exclamation fragment",
                "i": "objectives/anti-static/obfuscation/string/concat::frag-again-excl",
                "o": 36444,
                "z": 4,
                "cf": 1.0
              }
            ],
            "ln": 36412
          },
          {
            "b": "00000019mEuVG.0v%8u9r+lq)x(v(ic37QWyJTVtkXBICy\u0026r]$e[wJAav/gbav/m4aA/H[B#6E903\u003ecDiV}%zuVG.0v%8unv\u003eq^Cf!LgtgAXCbf/7EpgCpKratC(qgbI3Fg:3BtA+]Vaw/%J!A3cza000000aYREA+fr4B.8XfB0b7nwO009z!s9nvrb{iaw3V5B0bBxz//M2By!#9vTf8rxK@rdwPzTeaA7\u003cmm]05bm]h(4B$$gUAV/JY3ig5a0aYREA+fr4B.8X9z/xA4B0b14Byuq7A=k!qz/fbew[=6)asIeGayYe9v@0h$wP?=$wHO:zzY\u0026Faz//V7AXmX000000098@-m[2DYwmP4/wPIv7wGUh}Acb/jzGx8ax(mJ%y?j-cB-.kfy?i}N0000008EMQx(v)giV{1}azC!kB08OFaAITkA=-Byz/YSmx(v(ix(k4ox(m)jBrCgfy?j.qwmYvYB.(d.fEXKW03AybarR^HarSmmaA8jqB08OFaAITkA=-Byz/YSmx(v(ix(k5iB-.OBBrCgfy?j.qwmYvox(F0idj+/a03AybarR^HarSmBaAIEkByGqlayYe9v@0idx)Ktkw]zYjv@DsiaA8jgA::67z/cWCwmYvoc21[Mc21F",
            "n": [
              {
                "c": 3,
                "d": "Terminal socket exec helper context",
                "i": "micro-behaviors/process/fd/dup::unix-terminal-socket-exec-benign-context",
                "o": 37456,
                "z": 62,
                "cf": 0.949999988079071
              },
              {
                "c": 2,
                "d": "Contains frequent English function words",
                "i": "metadata/file/profile/language::lang-english",
                "o": 37302,
                "z": 3,
                "cf": 0.800000011920929
              },
              {
                "c": 2,
                "d": "References the GPL license",
                "i": "metadata/package/license::gpl-word",
                "o": 37179,
                "z": 3,
                "cf": 0.699999988079071
              }
            ],
            "ln": 37131
          },
          {
            "b": "eM9YlarR^HarR!EwPhi?By/00C{4rKx()]eB75]%ayYe9v@0hnwmYu}x\u003ewG4zF0Q0wGUYdatmnpB$XeMA=ixT3ig5GarR^HarR^HeP-9TarR^HarR!GA=(nfvru66z/{evB-X:rx(4u6c$D[3j-kf!ed8vS0000warR^HarR^HeMr\u0026narR^HarR!GA=(nfve",
            "n": [
              {
                "c": 2,
                "d": "/dev/zero (legitimate zero source)",
                "i": "micro-behaviors/fs/path/device/special::dev-zero",
                "o": 38353,
                "z": 9,
                "cf": 1.0
              }
            ],
            "ln": 38305
          },
          {
            "b": "A=k#tasH=iw\u003c73Idj+/a0000warR^HarR^HeMT5qarR^HarR!EwNP9(Byxi5wPP57y\u0026r*0ayPd#ayPCix\u003eet/A+PSbB0bgeazCv$zGGP5vqE5mwmYvozF{%P3ig5GarR^HarR^HeNY+AarR^HarR!FA6XI=wGUP0y?j-kA+PSfzF77uwmYvozF{%",
            "n": [
              {
                "c": 2,
                "d": "Contains frequent English function words",
                "i": "metadata/file/profile/language::lang-english",
                "o": 38645,
                "z": 3,
                "cf": 0.800000011920929
              }
            ],
            "ln": 38597
          },
          {
            "b": "zG6-ue*a7YmmnmYats{PwNPE$ayMymx(dA7vQTs?wft@8wN)\u003ef001cwB7]J8atmnpB$W#UvqYQ]z6indax7Y$l}f:wmiDkSC4C.qxk.Z0aAhykB.2zkA:-\u0026@z/3RmB.$P0A=S\u0026u00000002YbyH}Z7B7D)BeI!IFmmxP$q:\u003cbymOcoxaA}Koy-)UtwPA0nx()]ez!rZ1wGS=KBzkP6B08(KenobQfF1tkq+n9ah.D*xdj$@c001cyx([2heI[OGmmxP$q:\u003cbymOcoxaBd)FazkncayPdgvpS[.BzkVhvqE6bvqYQ]z6i!aB8@DLAX7{BeoiG%fEXQY001cyx([2heIXCEmmxP$q:\u003cbymOcoxaBd)FaA4",
            "n": [
              {
                "c": 2,
                "d": "Contains frequent English function words",
                "i": "metadata/file/profile/language::lang-english",
                "o": 39600,
                "z": 4,
                "cf": 0.800000011920929
              },
              {
                "c": 2,
                "d": "Access /dev/urandom",
                "i": "micro-behaviors/os/random/crypto::urandom",
                "o": 39454,
                "z": 12,
                "cf": 1.0
              }
            ],
            "ln": 39406
          },
          {
            "b": "f!$geazSw*f!+vtdj=Poc{opsgbJq)diJLHav^?mfFUE\u003egBTCQD30Rs3ig5ara]#!aAhvtxl4A$azC)tB-RbaB.\u0026gxzY\u003c7iB7ou7ay[]5vixo4ay!\u00263wGU]6aw1jZaz2Olz/P[IayX[(vrDT53ig5aazC{uwn=42az#ataz$+2wPI{3A+PunayO.$",
            "n": [
              {
                "c": 2,
                "d": "Contains frequent English function words",
                "i": "metadata/file/profile/language::lang-english",
                "o": 39816,
                "z": 4,
                "cf": 0.800000011920929
              }
            ],
            "ln": 39768
          },
          {
            "b": "003LuuVG.0v%8uzasH@ww]xaVaAR:DzFs03aA8cuA+fi3vrrRueMa2uw]zYjfjXTqfm4hIzWDEA00000003LuuVG.0v%8uzasH\u0026gByw#miV@cOw[=6)ayPd#aA8yAw[=6)ayPq4azCv$zGGP5vqE5{zE:(iA=(nfaAR:DzE)u3z/cZ900000003LuuVG.0v/",
            "n": [
              {
                "c": 2,
                "d": "/dev/zero (legitimate zero source)",
                "i": "micro-behaviors/fs/path/device/special::dev-zero",
                "o": 41198,
                "z": 9,
                "cf": 1.0
              }
            ],
            "ln": 41150
          },
          {
            "b": "3ig5a000000aYREA+fr4B.9PRd0G9uzFs03dlnO[A+PGewGU]mwPA0nx()]eCwhejaz#anePUGmyHHW*wGU]lBz#wAaQOhH000000aYREA+fr4B.9PRd0G9uzFs03dlnOyzG6-uazbt7wGUA0wft@8v@Dl}vrcSoz/{evB-X:rx(4u6c37hqA+cwc",
            "n": [
              {
                "c": 2,
                "d": "Contains frequent English function words",
                "i": "metadata/file/profile/language::lang-english",
                "o": 42479,
                "z": 4,
                "cf": 0.800000011920929
              }
            ],
            "ln": 42431
          },
          {
            "b": "x\u003ewG0A=IdQC4CYrA+PSb09shPBy=OezGG^%p/p4UuU\u003cB=v/Pt6pdFV6A=by/fjXTqfm4hIzVBrUuVG.0v%8uzasH\u0026gByw#miV].\u0026iV].\u00263ij^TAclm5z/{evB-WQ]wm6v*B7ou70bb}Wz#+5)A:\u0026%dwDlZ)x\u003eqw^C4CYnx(v\u003e?x(F0i0b(*{A@Zo1w]}H600",
            "n": [
              {
                "c": 2,
                "d": "/dev/zero (legitimate zero source)",
                "i": "micro-behaviors/fs/path/device/special::dev-zero",
                "o": 43010,
                "z": 9,
                "cf": 1.0
              }
            ],
            "ln": 42962
          },
          {
            "b": "zELyAgb7Etf!+pvdiHu0e\u0026tmn07PyziV]?*vLYbZfFUBsfFCEnatCM5h7*M.bU?])lq{okay/ClfFloPB%5H(g:1Lcf/Q*vf!UpuatC/ogDduKhxV:MwPzAamr\u0026+]bMG8+wPQmql](D2A=-#!v@Dj3z/dgqeoSc\u003ce\u00262vdgb7Esfebpqgbf[9hAAYJiX-MoB8b/jy-(e\u003eA3czabU?])lq{okay/Clx!AsnB%5H(f^5k9f!+mmi4(%AatC\u0026pfFLQAh6uTLwPzAamr\u0026+]bMG8+wPQmql](D2A=+=4xk8loq.i8mf!Lj7gb7BpfekgmgCx}ai65\u0026OiYe]uyhWW7xcoS/A3czabU?])lq{okay/ClwO#3hq.i8mf!Lg6gb7BpfebvsfGgaei65-FiX@PnyhWW7xcoS/A3czabU?])lq{okay/Clzz1\u003csB%5H(f^5k9f!+mmi4(%AatC\u0026pfFLQAh6uTLwPzAamr\u0026+]bME\u0026m=Jj7D0000000000000080000800008000080000r000010000000000dK([\u003cph.mGvpA!:aw^8%C4\u003eF#wfruKdGxFs=Jj7D0000000000000080000800",
            "n": [
              {
                "c": 2,
                "d": "NetBSD base system artifact",
                "i": "metadata/binary/provenance::netbsd-base-system-artifact",
                "o": 51221,
                "z": 8,
                "cf": 0.949999988079071
              },
              {
                "c": 1,
                "d": "Compact C type format section",
                "i": "metadata/vendor/identity::sunw-ctf-section",
                "o": 51560,
                "z": 9,
                "cf": 0.949999988079071
              }
            ],
            "ln": 51173
          },
          {
            "b": "00031000000000GdK(MozY?.ZvR6u#p\u0026ZF$x\u003eg^=asX\u0026\u003c001S)xMFooBywRUe[]iBwPz.\u0026e]CPHwId\u003eiByGr4e[[\u003cczGC\u003ehzF%Sde]ClxvSM6jAa9$\u003ee[!WmxAfU}D2vXGz2=h0D2vXBASv.jwO+^cwo\u00264)e]\u003eJtvj(InBo0}czFsg)e]USGe[Y9A04@w8CYS{rw[=c%04@qgwmoN*04}?@uUjs!zdN6/wo4V5wOtB.A:-/@04}=6z/P[0e[x6xA=Rjkygzn:e[xlBvqPZ*04}]5Bs}JGBo0}7vrt]Te[e)y04}=1zeA\u003c4Bo0{(rzDR5v@#q.0000000000000000000000000000000000000000000000000000000000000000000000",
            "n": [
              {
                "c": 2,
                "d": "ELF dynamic section name",
                "i": "metadata/binary/linking/static::elf-dynamic-section-name",
                "o": 51878,
                "z": 8,
                "cf": 0.8999999761581421
              },
              {
                "c": 2,
                "d": "ELF dynstr section name",
                "i": "metadata/binary/linking/static::elf-dynstr-section-name",
                "o": 51772,
                "z": 7,
                "cf": 0.8999999761581421
              },
              {
                "c": 2,
                "d": "ELF dynsym section name",
                "i": "metadata/binary/linking/static::elf-dynsym-section-name",
                "o": 51764,
                "z": 7,
                "cf": 0.8999999761581421
              },
              {
                "c": 2,
                "d": "ELF interpreter section name",
                "i": "metadata/binary/linking/static::elf-interpreter-section-name",
                "o": 51714,
                "z": 7,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 51666
          }
        ],
        "depth": 1,
        "facts": {
          "exp": [
            [
              "progname"
            ],
            [
              "ps_strings"
            ],
            [
              "environ"
            ]
          ],
          "imp": [
            [
              "",
              "fdopen"
            ],
            [
              "",
              "memcmp"
            ],
            [
              "",
              "errno"
            ],
            [
              "",
              "abort"
            ],
            [
              "",
              "write"
            ],
            [
              "",
              "fsync"
            ],
            [
              "",
              "srand"
            ],
            [
              "",
              "snprintf"
            ],
            [
              "",
              "deregister_frame_info"
            ],
            [
              "",
              "signal"
            ],
            [
              "",
              "lseek"
            ],
            [
              "",
              "getpid"
            ],
            [
              "",
              "strcmp"
            ],
            [
              "",
              "gettimeofday50"
            ],
            [
              "",
              "memset"
            ],
            [
              "",
              "stat50"
            ],
            [
              "",
              "malloc"
            ],
            [
              "",
              "Jv_RegisterClasses"
            ],
            [
              "",
              "rand"
            ],
            [
              "",
              "fchown"
            ],
            [
              "",
              "strcpy"
            ],
            [
              "",
              "ctype_tab_"
            ],
            [
              "",
              "fclose"
            ],
            [
              "",
              "strdup"
            ],
            [
              "",
              "open"
            ],
            [
              "",
              "vfprintf"
            ],
            [
              "",
              "optarg"
            ],
            [
              "",
              "perror"
            ],
            [
              "",
              "utime50"
            ],
            [
              "",
              "fwrite"
            ],
            [
              "",
              "toupper_tab_"
            ],
            [
              "",
              "sF"
            ],
            [
              "",
              "fgetc"
            ],
            [
              "",
              "stack_chk_guard"
            ],
            [
              "",
              "cxa_finalize"
            ],
            [
              "",
              "register_frame_info"
            ],
            [
              "",
              "exit"
            ],
            [
              "",
              "raise"
            ],
            [
              "",
              "fprintf"
            ],
            [
              "",
              "posix_memalign"
            ],
            [
              "",
              "clock"
            ],
            [
              "",
              "close"
            ],
            [
              "",
              "sysconf"
            ],
            [
              "",
              "optind"
            ],
            [
              "",
              "fstat50"
            ],
            [
              "",
              "optopt"
            ],
            [
              "",
              "truncate"
            ],
            [
              "",
              "read"
            ],
            [
              "",
              "fputc"
            ],
            [
              "",
              "basename"
            ],
            [
              "",
              "atexit"
            ],
            [
              "",
              "ftruncate"
            ],
            [
              "",
              "free"
            ],
            [
              "",
              "strerror"
            ],
            [
              "",
              "fopen"
            ],
            [
              "",
              "libc_init"
            ],
            [
              "",
              "strsignal"
            ],
            [
              "",
              "pwrite"
            ],
            [
              "",
              "pread"
            ],
            [
              "",
              "memcpy"
            ],
            [
              "",
              "strtod"
            ],
            [
              "",
              "strlen"
            ],
            [
              "",
              "fchmod"
            ],
            [
              "",
              "stack_chk_fail"
            ],
            [
              "",
              "getopt_long"
            ]
          ],
          "sec": [
            [
              ".interp",
              512,
              23,
              3.82,
              "alloc"
            ],
            [
              ".note.netbsd.ident",
              536,
              24,
              3.0,
              "alloc"
            ],
            [
              ".note.netbsd.pax",
              560,
              20,
              1.56,
              "alloc"
            ],
            [
              ".hash",
              584,
              564,
              1.35,
              "alloc"
            ],
            [
              ".dynsym",
              1152,
              1728,
              1.09,
              "alloc"
            ],
            [
              ".dynstr",
              2880,
              570,
              4.39,
              "alloc"
            ],
            [
              ".rela.dyn",
              3456,
              1440,
              1.95,
              "alloc"
            ],
            [
              ".rela.plt",
              4896,
              1296,
              1.66,
              "alloc,info_link"
            ],
            [
              ".init",
              6192,
              14,
              3.24,
              "alloc,executable"
            ],
            [
              ".plt",
              6208,
              880,
              4.14,
              "alloc,executable"
            ],
            [
              ".plt.got",
              7088,
              32,
              3.31,
              "alloc,executable"
            ],
            [
              ".text",
              7120,
              27445,
              6.19,
              "alloc,executable"
            ],
            [
              ".fini",
              34576,
              14,
              3.24,
              "alloc,executable"
            ],
            [
              ".rodata",
              34592,
              10240,
              5.11,
              "alloc"
            ],
            [
              ".eh_frame_hdr",
              44832,
              436,
              4.67,
              "alloc"
            ],
            [
              ".eh_frame",
              45272,
              2164,
              5.03,
              "alloc"
            ],
            [
              ".ctors",
              48648,
              16,
              1.0,
              "write,alloc"
            ],
            [
              ".dtors",
              48664,
              16,
              1.0,
              "write,alloc"
            ],
            [
              ".jcr",
              48680,
              8,
              0.0,
              "write,alloc"
            ],
            [
              ".dynamic",
              48688,
              368,
              1.28,
              "write,alloc"
            ],
            [
              ".got",
              49056,
              96,
              0.25,
              "write,alloc"
            ],
            [
              ".got.plt",
              49152,
              456,
              1.8,
              "write,alloc"
            ],
            [
              ".data",
              49632,
              1528,
              1.04,
              "write,alloc"
            ],
            [
              ".comment",
              51160,
              61,
              4.11,
              "merge,strings"
            ],
            [
              ".ident",
              51221,
              338,
              4.84,
              "merge,strings"
            ],
            [
              ".SUNW_ctf",
              51560,
              143,
              2.89,
              ""
            ],
            [
              ".shstrtab",
              51703,
              223,
              4.19,
              ""
            ]
          ],
          "metrics": {
            "elf": {
              "bits": 64.0,
              "entry": 7120.0,
              "has_got": 1.0,
              "has_plt": 1.0,
              "has_note": 1.0,
              "relacount": 49.0,
              "note_count": 2.0,
              "nx_enabled": 1.0,
              "dynrel_count": 0.0,
              "dynsym_count": 72.0,
              "has_eh_frame": 1.0,
              "stack_canary": 1.0,
              "symtab_count": 0.0,
              "dynrela_count": 60.0,
              "little_endian": 1.0,
              "dt_flags_1_raw": 134217728.0,
              "pltreloc_count": 54.0,
              "executable_stack": 0.0,
              "wx_segment_count": 0.0,
              "comment_entry_count": 2.0,
              "program_header_count": 8.0,
              "comment_distinct_count": 2.0,
              "gnu_stack_section_absent": 1.0,
              "load_segment_max_file_size": 47436.0,
              "stripped_but_symtab_present": 0.0,
              "load_segment_max_memory_size": 47436.0,
              "section_relocation_group_count": 2.0,
              "stripped_metadata_section_count": 7.0
            },
            "file": {
              "size": 53784.0,
              "entropy": 5.65,
              "size_bytes": 53784.0
            },
            "binary": {
              "is_pie": 1.0,
              "has_overlay": 1.0,
              "is_stripped": 1.0,
              "code_entropy": 6.12,
              "data_entropy": 1.18,
              "overlay_size": 1858.0,
              "string_count": 276.0,
              "overlay_ratio": 0.03,
              "overall_entropy": 5.65,
              "overlay_entropy": 1.4,
              "entropy_variance": 2.78,
              "avg_string_length": 30.58,
              "max_string_length": 104.0,
              "peak_region_bytes": 17408.0,
              "code_to_data_ratio": 0.92,
              "peak_region_entropy": 6.15,
              "string_length_stddev": 25.19,
              "largest_section_ratio": 0.51,
              "sentence_string_count": 134.0,
              "sentence_string_ratio": 0.49,
              "high_entropy_string_count": 0.0
            },
            "exports": {
              "count": 3.0
            },
            "imports": {
              "count": 65.0
            },
            "sections": {
              "count": 29.0,
              "code_size": 28385.0,
              "entropy_max": 6.19,
              "entropy_mean": 2.82,
              "name_entropy": 4.14,
              "writable_count": 8.0,
              "executable_count": 5.0,
              "nonstandard_count": 8.0,
              "executable_writable_count": 0.0
            },
            "dependencies": {
              "count": 1.0
            }
          }
        },
        "id": 1,
        "mol": "H(F₄)Md(He)",
        "path": "dd_rescue-1.33.tgz!!bin/dd_rescue",
        "pid": 0,
        "risk": 4,
        "sha": "e68e034be83387325acbd86fc997c2dffd1bbddc9fd0173bf8c12742a52232e5",
        "size": 53784,
        "traits": [
          {
            "id": "metadata/binary/metrics/threshold::many-imports-50",
            "conf": 1.0,
            "crit": 1,
            "desc": "Binary has 50+ imports",
            "spans": [
              [
                0,
                21
              ]
            ]
          },
          {
            "id": "micro-behaviors/ui/help::options-title",
            "crit": 2,
            "desc": "Options: label",
            "spans": [
              [
                37456,
                62
              ]
            ]
          },
          {
            "id": "micro-behaviors/os/random/crypto::rand-symbol",
            "conf": 0.30000001192092896,
            "crit": 2,
            "desc": "Random number generation (rand)",
            "spans": [
              [
                2927,
                4
              ]
            ]
          },
          {
            "id": "micro-behaviors/fs/file/open::fopen",
            "conf": 0.6600000262260437,
            "crit": 3,
            "desc": "Opens file with C fopen",
            "spans": [
              [
                3348,
                5
              ]
            ]
          },
          {
            "id": "micro-behaviors/fs/file/write/direct::write--fwrite",
            "conf": 0.6600000262260437,
            "crit": 2,
            "desc": "References fwrite file-write API",
            "spans": [
              [
                3148,
                6
              ]
            ]
          },
          {
            "id": "micro-behaviors/fs/file/write/direct::write--pwrite",
            "conf": 0.6600000262260437,
            "crit": 2,
            "desc": "References POSIX pwrite API",
            "spans": [
              [
                3375,
                6
              ]
            ]
          },
          {
            "id": "micro-behaviors/fs/file/write/direct::write--write",
            "conf": 0.6600000262260437,
            "crit": 2,
            "desc": "References POSIX write API",
            "spans": [
              [
                3149,
                5
              ]
            ]
          },
          {
            "id": "metadata/binary/metrics/threshold::rich-sentence-strings-20pct",
            "conf": 0.800000011920929,
            "crit": 1,
            "desc": "Binary has many sentence-like strings",
            "spans": [
              [
                0,
                35
              ]
            ]
          },
          {
            "id": "micro-behaviors/ui/help::options-title-string",
            "crit": 1,
            "desc": "Options: label in binary strings",
            "spans": [
              [
                37456,
                62
              ]
            ]
          },
          {
            "id": "micro-behaviors/fs/chown::fchown-fn",
            "conf": 0.6600000262260437,
            "crit": 3,
            "desc": "Change file ownership by fd",
            "spans": [
              [
                3062,
                6
              ]
            ]
          },
          {
            "id": "micro-behaviors/os/random/crypto::srand-symbol",
            "conf": 0.4000000059604645,
            "crit": 2,
            "desc": "Random seed initialization (srand)",
            "spans": [
              [
                2926,
                5
              ]
            ]
          },
          {
            "id": "micro-behaviors/fs/file/read::read",
            "conf": 0.699999988079071,
            "crit": 2,
            "desc": "Read file descriptor (read/pread)",
            "spans": [
              [
                3382,
                5
              ],
              [
                3383,
                4
              ]
            ]
          },
          {
            "id": "metadata/hardening/missing::stripped-binary",
            "conf": 0.800000011920929,
            "crit": 3,
            "desc": "No full symbol table (likely stripped)",
            "spans": [
              [
                0,
                25
              ]
            ]
          },
          {
            "id": "micro-behaviors/fs/chmod/modify::syscall-fchmod",
            "atk": "T1222",
            "mbc": "E1222",
            "conf": 0.6600000262260437,
            "crit": 3,
            "desc": "fchmod syscall",
            "spans": [
              [
                3409,
                6
              ]
            ]
          },
          {
            "id": "micro-behaviors/fs/file/binary::file-read-operation",
            "atk": "T1005",
            "conf": 0.75,
            "crit": 1,
            "desc": "File-reading capability",
            "spans": [
              [
                3382,
                5
              ],
              [
                3383,
                4
              ]
            ]
          },
          {
            "id": "micro-behaviors/fs/file/write/direct::write",
            "conf": 0.6600000262260437,
            "crit": 2,
            "desc": "POSIX file-write capability",
            "spans": [
              [
                3148,
                6
              ],
              [
                3149,
                5
              ],
              [
                3375,
                6
              ]
            ]
          },
          {
            "id": "micro-behaviors/ui/help::usage-label",
            "conf": 0.75,
            "crit": 1,
            "desc": "Command line usage text",
            "spans": [
              [
                37456,
                62
              ]
            ]
          },
          {
            "id": "micro-behaviors/fs/file/binary::file-manipulation",
            "atk": "T1005",
            "conf": 0.75,
            "crit": 3,
            "desc": "File content manipulation (read/write/seek)",
            "spans": [
              [
                3148,
                6
              ],
              [
                3149,
                5
              ],
              [
                3375,
                6
              ],
              [
                3382,
                5
              ],
              [
                3383,
                4
              ]
            ]
          }
        ],
        "type": "elf"
      }
    ],
    "v": "8"
  }
}