{ "ml": { "v": "7", "eng": "2.2.0-rc.1", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.000011364619, "rte": "az", "prob": 0.000011364619 }, { "cls": 0, "raw": 0.00019145012, "rte": "az/tar", "prob": 0.00019145012 } ], "prob": 0.000011364619, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.00001136461924033938, "type": "apk_alpine" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.000010679165825422388, "type": "elf" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.000010450680747453589, "type": "text" } ], "version": "v18.18", "analyzed_at": "2026-06-26T09:29:40Z" }, "path": "kamailio-geoip2-6.0.6-r0.apk", "raw": { "files": [ { "id": 0, "ctx": [ { "b": "abZy8000000T3{24[J!\u003enkh=HeH]u63?!Yp^*DIa!jX1m:JNrco?u{f=2H?Deg@xa3GU*X", "n": [ { "c": 2, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "o": 0, "z": 1, "cf": 1.0 } ], "ln": 0 } ], "mol": "Md(He)", "sha": "fd89a4e8b7726634e9bfc1c54657962fd1e90d0fe8c4a43ef0a37c2db6789c55", "path": "kamailio-geoip2-6.0.6-r0.apk", "risk": 1, "size": 23722, "type": "apk_alpine", "facts": { "metrics": { "file": { "size": 23722.0, "entropy": 7.99, "size_bytes": 23722.0 }, "parse": { "error_count": 1.0 }, "binary": { "overall_entropy": 7.99, "peak_region_bytes": 23552.0, "peak_region_entropy": 7.81 } } }, "traits": [ { "id": "metadata/package/files/system-package::alpine-pkginfo-origin-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package origin field", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/dylib/library/libc::libc-internal-functions-b", "conf": 0.699999988079071, "crit": 2, "desc": "libc internal symbols cluster B", "from": [ { "file": 1 } ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-basename", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package info file" }, { "id": "metadata/package/files/system-package::alpine-pkginfo-package-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package name field", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/dylib/library/libc::libc-characteristic-cxa-finalize", "crit": 2, "desc": "libc characteristic cxa finalize", "from": [ { "file": 1 } ] }, { "id": "metadata/hardening/missing::stripped-binary", "conf": 0.800000011920929, "crit": 3, "desc": "No full symbol table (likely stripped)", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/dylib/library/abi-graphics::cxx-abi-symbols-a", "conf": 0.800000011920929, "crit": 2, "desc": "C++ ABI symbols cluster A", "from": [ { "file": 1 } ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-version-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package version field", "from": [ { "file": 2 } ] } ] }, { "ctx": [ { "b": "E))420S-r400000000000@$H+0rr910000000000kMy=:00000nyNRt0000000000kMA+z3JJA(7xtiJ0rr91", "n": [ { "c": 3, "d": "Strips toolchain banner but retains build-id", "i": "metadata/build/artifact::aggressive-strip", "o": 0, "z": 1, "cf": 1.0 } ], "ln": 0 }, { "b": "A-t+2y\u0026si5raflLwDl7Av%zA?w[=c\u003ey?Xib0af8zwPzu{x(!xcA:JB0vqPN.x(mK30af8NwOkZ#", "n": [ { "c": 3, "d": "Terminal socket exec helper context", "i": "micro-behaviors/process/fd/dup::unix-terminal-socket-exec-benign-context", "o": 2845, "z": 12, "cf": 0.949999988079071 } ], "ln": 2829 }, { "b": "wOkZ#By/G1vrcx%C(RhUB97\u00262yHpN+yHpWZx(0=\u003cA:JD\u003cz!TeCuTWFQuVG.0x\u003edi+D2)F7y?%8:wP4", "n": [ { "c": 3, "d": "Stack protector/canary enabled", "i": "metadata/hardening/build::stack-protector", "o": 3167, "z": 14, "cf": 0.8999999761581421 } ], "ln": 3151 }, { "b": "08lfQlsjwpByfi1y\u0026%p?B7]H(v@Dz*B8=kx0ax$Tzzziez!9i}wOkZ#By/E)B8\u003eS6wO(b", "n": [ { "c": 3, "d": "Benign network-capable library context", "i": "objectives/supply-chain/trojanized/backdoor::benign-network-library-context", "o": 3387, "z": 3, "cf": 0.8999999761581421 }, { "c": 1, "d": "libm cos import", "i": "micro-behaviors/dylib/library/libm::libm-cos-symbol", "o": 3391, "z": 3, "cf": 0.4000000059604645 } ], "ln": 3371 }, { "b": "e]$}-fAt{6vQ?3cB-RvJCSmP*hz^4cz.r:AxjV0}A564!zVzCkB8\u0026{Ix\u003c@-hvqPB!y?S", "n": [ { "c": 3, "d": "Architecture detection strings", "i": "objectives/discovery/host/software::arch-detection", "o": 3804, "z": 6, "cf": 0.5 } ], "ln": 3788 }, { "b": "uRS)-r8Lm\u0026rz#s[l@N5(lqgfxoh4]Qr4Gd.k#{AYqBKIWoJCH#mn\u003e-Wr7{j$p/G$-ml%sGo-", "n": [ { "c": 1, "d": "Benign context: deny/block-list word", "i": "objectives/credential-access/shell/history::shell-history-unless-cond-1--rx-3", "o": 43340, "z": 9, "cf": 0.30000001192092896 } ], "ln": 43324 }, { "b": "yHI6*x(4H4at$\u0026ae\u0026B?2CSmP*hz^6Xx(n6rdfa0(z!TeCiV@6Dz!TeCuVpfvv/QdMz!P", "n": [ { "c": 2, "d": "x86_64 architecture string", "i": "micro-behaviors/os/sysinfo/platform/string::arch-x86-64", "o": 43409, "z": 6, "cf": 0.30000001192092896 } ], "ln": 43393 }, { "b": "00000000000000000000xjV0}A564!z.tNivS=q-\u003eUNK\u003e04@taB98CAvpxi?zF%Sde[Y6Ae]U\u0026HAaK4", "n": [ { "c": 2, "d": ".gnu_debuglink reference present", "i": "metadata/build/debug::elf-debuglink", "o": 54096, "z": 15, "cf": 1.0 } ], "ln": 54080 }, { "b": "y?bbiwb[k{zGNNBvrl8Ze[xlBB9RQ5e[xlBB98B5e]\u003eJtvj(8ozu8qfwO=xtwo\u00264)e[]iqBo0}nwQ5p", "n": [ { "c": 2, "d": "ELF dynstr section name", "i": "metadata/binary/linking/static::elf-dynstr-section-name", "o": 54183, "z": 7, "cf": 0.8999999761581421 }, { "c": 2, "d": "ELF dynsym section name", "i": "metadata/binary/linking/static::elf-dynsym-section-name", "o": 54175, "z": 7, "cf": 0.8999999761581421 } ], "ln": 54159 }, { "b": "vr?\u00269wmoN*e]\u003eJte]\u003e\u003ege[xlBvqPZ*04}]5Bo0}7vrt]Te[e)y04}]4BZFV\u003cvS=s1x(mX^", "n": [ { "c": 2, "d": "ELF dynamic section name", "i": "metadata/binary/linking/static::elf-dynamic-section-name", "o": 54298, "z": 8, "cf": 0.8999999761581421 } ], "ln": 54282 } ], "depth": 1, "facts": { "exp": [ [ "sr_geoip2_get_record" ], [ "geoip2_update_pv" ], [ "exports" ], [ "pv_get_geoip2" ], [ "fini" ], [ "geoip2_destroy_pv" ], [ "geoip2_reload_pv" ], [ "sr_geoip2_add_item" ], [ "geoip2_init_pv" ], [ "module_flags" ], [ "ubl_rpc" ], [ "module_version" ], [ "geoip2_pv_reset" ], [ "geoip2_destroy_list" ], [ "init" ], [ "module_interface_ver" ], [ "get_gen_lock" ], [ "mod_register" ], [ "get_geoip_handle" ], [ "geoip2_reload_set" ], [ "pv_geoip2_get_strzval" ], [ "pv_parse_geoip2_name" ], [ "sr_geoip2_add_resid" ] ], "imp": [ [ "", "sr_kemi_modules_add" ], [ "", "sqrt" ], [ "", "MMDB_lookup_string" ], [ "", "pv_get_null" ], [ "", "get_str_fparam" ], [ "", "snprintf" ], [ "", "syscall" ], [ "", "process_no" ], [ "", "MMDB_get_value" ], [ "", "km_log_func" ], [ "", "fixup_free_spve_spve" ], [ "", "fixup_spve_spve" ], [ "", "MMDB_open" ], [ "", "cxa_finalize" ], [ "", "MMDB_close" ], [ "", "shm_root" ], [ "", "malloc" ], [ "", "dprint_color_reset" ], [ "", "get_debug_facility" ], [ "", "log_level_info" ], [ "", "stack_chk_fail" ], [ "", "dprint_color" ], [ "", "atof" ], [ "", "fprintf" ], [ "", "deregister_frame_info" ], [ "", "log_prefix_val" ], [ "", "ITM_registerTMCloneTable" ], [ "", "cos" ], [ "", "sin" ], [ "", "atan2" ], [ "", "strncmp" ], [ "", "rpc_register_array" ], [ "", "strncpy" ], [ "", "my_pid" ], [ "", "ITM_deregisterTMCloneTable" ], [ "", "dprint_crit" ], [ "", "fixup_free_spve_all" ], [ "", "pv_get_strval" ], [ "", "stderr" ], [ "", "get_debug_level" ], [ "", "fixup_spve_all" ], [ "", "log_stderr" ], [ "", "ksr_slog_func" ], [ "", "MMDB_lib_version" ], [ "", "errno_location" ], [ "", "log_color" ], [ "", "pkg_root" ], [ "", "register_frame_info" ] ], "sec": [ [ ".note.gnu.property", 680, 48, 1.94, "alloc" ], [ ".note.gnu.build-id", 728, 36, 4.25, "alloc" ], [ ".gnu.hash", 768, 276, 4.02, "alloc" ], [ ".dynsym", 1048, 1728, 1.6, "alloc" ], [ ".dynstr", 2776, 1068, 4.52, "alloc" ], [ ".rela.dyn", 3848, 1512, 1.49, "alloc" ], [ ".relr.dyn", 5360, 40, 2.42, "alloc" ], [ ".init", 8192, 3, 1.58, "alloc,executable" ], [ ".text", 8208, 29841, 6.0, "alloc,executable" ], [ ".fini", 38049, 3, 1.58, "alloc,executable" ], [ ".rodata", 40960, 4355, 5.22, "alloc" ], [ ".eh_frame_hdr", 45316, 244, 4.45, "alloc" ], [ ".eh_frame", 45560, 3428, 5.22, "alloc" ], [ ".init_array", 52264, 8, 1.06, "write,alloc" ], [ ".fini_array", 52272, 8, 1.06, "write,alloc" ], [ ".data.rel.ro", 52280, 24, 0.9, "write,alloc" ], [ ".dynamic", 52304, 464, 1.31, "write,alloc" ], [ ".got", 52768, 480, 0.04, "write,alloc" ], [ ".data", 53248, 848, 0.91, "write,alloc" ], [ ".gnu_debuglink", 54096, 20, 3.92, "" ], [ ".shstrtab", 54116, 222, 4.19, "" ] ], "metrics": { "elf": { "bits": 64.0, "entry": 0.0, "has_got": 1.0, "has_plt": 0.0, "has_note": 1.0, "note_count": 2.0, "nx_enabled": 1.0, "has_dt_relr": 1.0, "has_runpath": 1.0, "dynrel_count": 0.0, "dynsym_count": 72.0, "has_build_id": 1.0, "has_eh_frame": 1.0, "has_gnu_hash": 1.0, "stack_canary": 1.0, "symtab_count": 0.0, "dynrela_count": 63.0, "has_debuglink": 1.0, "little_endian": 1.0, "dt_flags_1_raw": 1.0, "pltreloc_count": 0.0, "build_id_length": 20.0, "executable_stack": 0.0, "fini_array_count": 1.0, "init_array_count": 1.0, "wx_segment_count": 0.0, "program_header_count": 11.0, "gnu_stack_section_absent": 0.0, "load_segment_max_file_size": 29860.0, "stripped_but_symtab_present": 0.0, "load_segment_max_memory_size": 29860.0, "section_relocation_group_count": 1.0, "stripped_metadata_section_count": 8.0 }, "file": { "size": 55816.0, "entropy": 5.14, "size_bytes": 55816.0 }, "binary": { "is_pie": 0.0, "has_overlay": 1.0, "is_stripped": 1.0, "code_entropy": 6.0, "data_entropy": 0.78, "overlay_size": 1478.0, "string_count": 216.0, "overlay_ratio": 0.03, "overall_entropy": 5.14, "overlay_entropy": 1.34, "entropy_variance": 3.07, "avg_string_length": 23.11, "max_string_length": 293.0, "peak_region_bytes": 9216.0, "code_to_data_ratio": 0.94, "peak_region_entropy": 6.26, "string_length_stddev": 24.55, "largest_section_ratio": 0.53, "sentence_string_count": 41.0, "sentence_string_ratio": 0.19, "high_entropy_string_count": 0.0 }, "exports": { "count": 23.0 }, "imports": { "count": 48.0 }, "sections": { "count": 23.0, "code_size": 29847.0, "entropy_max": 6.0, "entropy_mean": 2.75, "name_entropy": 4.14, "writable_count": 7.0, "executable_count": 3.0, "nonstandard_count": 6.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 2.0 } } }, "id": 1, "mol": "Md(He)", "path": "kamailio-geoip2-6.0.6-r0.apk!!usr/lib/kamailio/modules/geoip2.so", "risk": 1, "sha": "4ca16b9f064b3d3d9f9524c6288b16714d548cf3696d8e06fc9b308c2e22f5bf", "size": 55816, "traits": [ { "id": "micro-behaviors/dylib/library/libc::libc-characteristic-cxa-finalize", "crit": 2, "desc": "libc characteristic cxa finalize", "spans": [ [ 2845, 12 ] ] }, { "id": "metadata/hardening/missing::stripped-binary", "conf": 0.800000011920929, "crit": 3, "desc": "No full symbol table (likely stripped)", "spans": [ [ 0, 25 ] ] }, { "id": "micro-behaviors/dylib/library/libc::libc-internal-functions-b", "conf": 0.699999988079071, "crit": 2, "desc": "libc internal symbols cluster B", "spans": [ [ 2845, 12 ] ] }, { "id": "micro-behaviors/dylib/library/abi-graphics::cxx-abi-symbols-a", "conf": 0.800000011920929, "crit": 2, "desc": "C++ ABI symbols cluster A", "spans": [ [ 2845, 12 ] ] } ], "type": "elf" }, { "ctx": [ { "b": "boPG/zE)\u0026%By!#9vTf88vS=y3wfrVXf/HZsuVGThePJM", "n": [ { "c": 1, "d": "Alpine/Wolfi package info file", "i": "metadata/package/files/system-package::alpine-pkginfo-basename", "o": 0, "z": 1, "cf": 0.8999999761581421 } ], "ln": 1, "addr": 0 }, { "b": "boRbIx(mMaw)]E^A=k(raA?spB7]MgatCG8h.D\u0026", "ln": 2, "addr": 36 }, { "b": "Abf97vqPM#jS[JGzddc{x(tOowP8p4g5", "n": [ { "c": 2, "d": "Alpine/Wolfi package info metadata", "i": "metadata/package/files/system-package::alpine-apk-pkginfo", "o": 68, "z": 25, "cf": 0.9700000286102295 } ], "ln": 3, "addr": 68 }, { "b": "Abf9fwPw[Rat$\u0026ae\u0026Cq4fA", "n": [ { "c": 1, "d": "Alpine/Wolfi package version field", "i": "metadata/package/files/system-package::alpine-pkginfo-version-field", "o": 94, "z": 17, "cf": 0.8999999761581421 } ], "ln": 4, "addr": 94 }, { "b": "Abf8%wPIu7jS)yazddc{x(ta*vr+HXzE:\u003eWwP7dpaz+$myJTOsB9hCvz/P}", "ln": 5, "addr": 112 }, { "b": "B-IpvjS[AWBz#pZfe4J[Cp)Vtzddc{x(tRxA+v3", "ln": 6, "addr": 160 }, { "b": "B7]@iauZ\u00268h8)rG", "ln": 9, "addr": 273 }, { "b": "vrb\u003c\u003eauZ\u0026(i5Ub4gY", "ln": 10, "addr": 286 }, { "b": "z/PM8x(k4RazUz5vqfK(zV", "n": [ { "c": 1, "d": "Alpine/Wolfi package origin field", "i": "metadata/package/files/system-package::alpine-pkginfo-origin-field", "o": 300, "z": 17, "cf": 0.8999999761581421 } ], "ln": 11, "addr": 300 }, { "b": "v@Dj3x(\u003eEXayNn=hAr-LgIev0iwSMLgc4j7vQS.8h!uDew\u00268w2g=Nm4h.XU$h2", "ln": 12, "addr": 318 }, { "b": "zddc@Byw)3wPw[RawMu!xKL^3l2HsDy***(B09O.vqYZ?y^qABAa%i3y?W^fCRi]PxfD", "ln": 13, "addr": 368 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 634.0, "entropy": 5.2, "size_bytes": 634.0 }, "binary": { "overall_entropy": 5.2, "peak_region_bytes": 634.0, "peak_region_entropy": 5.2 } } }, "id": 2, "path": "kamailio-geoip2-6.0.6-r0.apk!!.PKGINFO", "risk": 1, "sha": "ec94e76aaa7c49aef0f46b971ad6c62a0a1224748a325286910d523dae2c4620", "size": 634, "traits": [ { "id": "metadata/package/files/system-package::alpine-pkginfo-basename", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package info file" }, { "id": "metadata/package/files/system-package::arch-pkgname-field", "conf": 0.9399999976158142, "crit": 1, "desc": "Arch pkgname metadata field", "spans": [ [ 68, 25 ] ] }, { "id": "metadata/package/files/system-package::arch-pkgver-field", "conf": 0.9399999976158142, "crit": 1, "desc": "Arch pkgver metadata field", "spans": [ [ 94, 17 ] ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-version-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package version field", "spans": [ [ 94, 17 ] ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-package-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package name field", "spans": [ [ 68, 25 ] ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-origin-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package origin field", "spans": [ [ 300, 17 ] ] }, { "id": "metadata/package/files/system-package::alpine-apk-pkginfo", "conf": 0.9700000286102295, "crit": 2, "desc": "Alpine/Wolfi package info metadata", "spans": [ [ 68, 25 ], [ 94, 17 ], [ 300, 17 ] ] } ], "type": "text" } ], "v": "8" } }