{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9514931440353394, "class": 0 } ], "prob": 0.95149314, "class": 0, "version": "v16.16", "thresholds": [ 0.9815004, 0.99404883 ], "analyzed_at": "2026-05-01T19:07:19Z" }, "path": "x86__64__lsb__unix-system-v__gcc-4.9.4__O3__no-obf__unstripped__util-linux-2.33__whereis", "raw": { "v": "4", "fs": [ { "f": "O(C)H₂(HfPo₂)Md₂(HeBi₂)", "x": 6, "id": 0, "is": [ "", "getenv", "free", "abort", "errno_location", "strncpy", "exit", "fpending", "warn", "puts", "ferror", "getpid", "textdomain", "vasprintf", "fclose", "opendir", "bindtextdomain", "dcgettext", "strlen", "getuid", "errx", "strchr", "printf", "warnx", "IO_putc", "snprintf", "strrchr", "assert_fail", "fputs", "geteuid", "getcwd", "closedir", "fputc", "strdup", "libc_start_main", "fgets", "calloc", "fprintf", "gmon_start__", "realpath", "memcpy", "getgid", "xstat", "readdir", "err", "malloc", "getegid", "setlocale", "access", "fopen", "vfprintf", "strtoul", "cxa_atexit", "strcat", "exit", "setegid", "ctype_b_loc", "seteuid" ], "ms": { "elf": { "e_type": 2.0, "has_got": true, "has_plt": true, "has_note": true, "e_machine": 62.0, "class_bits": 64.0, "note_count": 1.0, "nx_enabled": true, "entry_point": 4201472.0, "needed_libs": 1.0, "dynsym_count": 62.0, "has_eh_frame": true, "symtab_count": 151.0, "dynrela_count": 4.0, "entry_section": ".text", "little_endian": true, "pltreloc_count": 56.0, "has_interpreter": true, "fini_array_count": 1.0, "init_array_count": 1.0, "program_header_count": 8.0, "section_header_count": 30.0, "load_segment_max_p_memsz": 19092.0, "load_segment_max_p_filesz": 19092.0, "section_relocation_group_count": 2.0 }, "binary": { "code_size": 9860.0, "file_size": 29952.0, "entry_point": 4201472.0, "has_overlay": true, "code_entropy": 3.95, "data_entropy": 3.53, "export_count": 69.0, "import_count": 58.0, "overlay_size": 1926.0, "string_count": 296.0, "overlay_ratio": 0.06, "section_count": 29.0, "avg_complexity": 4.65, "function_count": 86.0, "import_density": 6.02, "max_complexity": 98.0, "string_density": 30.74, "aliased_exports": 55.0, "overall_entropy": 2.73, "overlay_entropy": 1.52, "avg_basic_blocks": 5.72, "avg_section_size": 899.07, "dependency_count": 1.0, "entropy_variance": 1.56, "function_density": 8.93, "avg_function_size": 105.85, "avg_string_length": 15.27, "complexity_per_kb": 0.48, "max_string_length": 63.0, "avg_string_entropy": 3.1, "code_to_data_ratio": 0.61, "data_to_file_ratio": 0.02, "text_to_file_ratio": 0.3, "total_basic_blocks": 492.0, "string_length_stddev": 9.26, "largest_section_ratio": 0.3, "sentence_string_count": 30.0, "sentence_string_ratio": 0.1, "behavioral_import_ratio": 0.02, "function_analysis_depth": 2.0, "high_complexity_functions": 1.0 } }, "ss": [ [ 0, "textdomain" ], [ 512, "/lib64/ld-linux-x86-64.so.2" ], [ 2483, "vasprintf" ], [ 2493, "readdir" ], [ 2501, "_IO_putc" ], [ 2510, "setlocale" ], [ 2520, "fopen" ], [ 2526, "strrchr" ], [ 2534, "__strdup" ], [ 2543, "dcgettext" ], [ 2553, "closedir" ], [ 2562, "strncpy" ], [ 2576, "abort" ], [ 2588, "getpid" ], [ 2595, "__assert_fail" ], [ 2615, "calloc" ], [ 2622, "strlen" ], [ 2634, "__errno_location" ], [ 2651, "stdout" ], [ 2670, "memcpy" ], [ 2677, "fclose" ], [ 2684, "strtoul" ], [ 2692, "malloc" ], [ 2699, "strcat" ], [ 2706, "realpath" ], [ 2715, "setegid" ], [ 2723, "getgid" ], [ 2730, "opendir" ], [ 2738, "__ctype_b_loc" ], [ 2752, "getenv" ], [ 2759, "stderr" ], [ 2766, "seteuid" ], [ 2774, "getuid" ], [ 2781, "getegid" ], [ 2789, "getcwd" ], [ 2796, "geteuid" ], [ 2804, "__fpending" ], [ 2822, "program_invocation_short_name" ], [ 2852, "__xstat" ], [ 2865, "bindtextdomain" ], [ 2880, "access" ], [ 2887, "__libc_start_main" ], [ 2905, "ferror" ], [ 2912, "vfprintf" ], [ 2921, "snprintf" ], [ 2930, "free" ], [ 2935, "__progname" ], [ 2946, "__cxa_atexit" ], [ 2959, "__gmon_start__" ], [ 2974, "GLIBC_2.14" ], [ 5600, "AWAVAUATA" ], [ 7665, "ATUSH" ], [ 8128, "AVAUI" ], [ 8135, "ATUH" ], [ 9440, "AWAVA" ], [ 9447, "AUATUSH" ], [ 10128, "AVAUA" ], [ 10135, "ATUI" ], [ 10567, "AUATI" ], [ 10928, "AUATA" ], [ 11440, "AWAVAUATI" ], [ 13109, "AUATH" ], [ 13408, "AVAUATUSH" ], [ 13986, "AWAVAUATUSH" ], [ 14343, "AUATL" ], [ 14539, "LIST" ], [ 14544, "whereis" ], [ 14552, "%d: %s: %8s:" ], [ 14566, "free dirlist" ], [ 14589, "SEARCH" ], [ 14596, "compare '%s' and '%s'" ], [ 14643, "display version" ], [ 14659, "display this help" ], [ 14677, "-V, --version" ], [ 14704, "%-16s%s" ], [ 14721, "For more details see %s." ], [ 14748, "whereis(1)" ], [ 14759, "cannot allocate string" ], [ 14794, "find '%s' in '%s'" ], [ 14812, "%s: %s %s/%s" ], [ 14825, "cannot allocate %zu bytes" ], [ 14851, "misc-utils/whereis.c" ], [ 14877, "add dir: %s" ], [ 14891, "scanning subdir: %s" ], [ 14916, "STATIC" ], [ 14923, "write error" ], [ 14935, "ARGV" ], [ 14940, "using argv[%d]: %s" ], [ 14961, "cannot duplicate string" ], [ 14989, "construct %s dirlist from: %s" ], [ 15019, "util-linux" ], [ 15030, "not enough arguments" ], [ 15051, "%s from %s" ], [ 15063, "util-linux 2.33" ], [ 15079, "WHEREIS_DEBUG" ], [ 15093, "MANPATH" ], [ 15111, "bad usage" ], [ 15139, "option -f is missing" ], [ 15171, "/usr/src/lib/libc/*" ], [ 15191, "/usr/src/lib/libc/net/*" ], [ 15215, "/usr/src/ucb/pascal" ], [ 15235, "/usr/src/ucb/pascal/utilities" ], [ 15265, "/usr/src/undoc" ], [ 15291, "/usr/share/man/*" ], [ 15354, "/usr/interviews/man/mann" ], [ 15379, "/usr/share/info" ], [ 15395, "/usr/bin" ], [ 15404, "/usr/sbin" ], [ 15414, "/usr/lib/x86_64-linux-gnu" ], [ 15440, "/usr/lib" ], [ 15449, "/usr/lib64" ], [ 15460, "/usr/etc" ], [ 15469, "/usr/games" ], [ 15480, "/usr/games/bin" ], [ 15495, "/usr/games/lib" ], [ 15510, "/usr/emacs/etc" ], [ 15525, "/usr/lib/emacs/*/etc" ], [ 15546, "/usr/TeX/bin" ], [ 15559, "/usr/tex/bin" ], [ 15572, "/usr/interviews/bin/LINUX" ], [ 15598, "/usr/X11R6/bin" ], [ 15613, "/usr/X386/bin" ], [ 15627, "/usr/bin/X11" ], [ 15640, "/usr/X11/bin" ], [ 15653, "/usr/X11R5/bin" ], [ 15668, "/usr/local/bin" ], [ 15683, "/usr/local/sbin" ], [ 15699, "/usr/local/etc" ], [ 15714, "/usr/local/lib" ], [ 15729, "/usr/local/games" ], [ 15746, "/usr/local/games/bin" ], [ 15767, "/usr/local/emacs/etc" ], [ 15788, "/usr/local/TeX/bin" ], [ 15807, "/usr/local/tex/bin" ], [ 15826, "/usr/local/bin/X11" ], [ 15845, "/usr/contrib" ], [ 15858, "/usr/hosts" ], [ 15869, "/usr/include" ], [ 15882, "/usr/g++-include" ], [ 15899, "/usr/ucb" ], [ 15908, "/usr/old" ], [ 15917, "/usr/new" ], [ 15926, "/usr/local" ], [ 15937, "/usr/libexec" ], [ 15950, "/usr/share" ], [ 15976, "%s [options] [-BMS \u003cdir\u003e... -f] \u003cname\u003e" ], [ 16024, "Locate the binary, source, and manual-page files for a command." ], [ 16136, "-B \u003cdirs\u003e define binaries lookup path" ], [ 16184, "-m search only for manuals and infos" ], [ 16232, "-M \u003cdirs\u003e define man and info lookup path" ], [ 16320, "-S \u003cdirs\u003e define sources lookup path" ], [ 16360, "-f terminate \u003cdirs\u003e argument list" ], [ 16408, "-u search for unusual entries" ], [ 16448, "-l output effective lookup paths" ], [ 16496, "lookup dirs for '%s' (%s), want: %s %s %s" ], [ 16544, "ignore (already in list): %s" ], [ 16576, "construct %s dirlist from static array" ], [ 16616, "construct %s dirlist from argv[%d..]" ], [ 16656, "/tmp/util-linux/_out/share/locale" ], [ 16696, "Try '%s --help' for more information." ], [ 16736, "%d: %s: don't print memory addresses (SUID executable)." ], [ 16800, "/usr/local/lib/x86_64-linux-gnu" ], [ 17312, "dirlist_add_dir" ], [ 17328, "%s/sys/block/%s/dm/name" ], [ 17352, "/dev/mapper/%s" ], [ 22080, "GCC: (GNU) 4.9.4" ], [ 25729, "crtstuff.c" ], [ 25740, "__JCR_LIST__" ], [ 25753, "deregister_tm_clones" ], [ 25774, "__do_global_dtors_aux" ], [ 25796, "completed.6672" ], [ 25811, "__do_global_dtors_aux_fini_array_entry" ], [ 25850, "frame_dummy" ], [ 25862, "__frame_dummy_init_array_entry" ], [ 25893, "whereis.c" ], [ 25903, "ul_debugobj" ], [ 25915, "whereis_debug_mask" ], [ 25934, "free_dirlist" ], [ 25947, "ul_debug" ], [ 25956, "filename_equal" ], [ 25977, "xasprintf.constprop.1" ], [ 25999, "lookup" ], [ 26028, "__PRETTY_FUNCTION__.6110" ], [ 26053, "dirlist_add_subdir" ], [ 26072, "construct_dirlist" ], [ 26090, "CSWTCH.73" ], [ 26100, "close_stdout" ], [ 26113, "construct_dirlist_from_argv" ], [ 26141, "construct_dirlist_from_env" ], [ 26168, "bindirs" ], [ 26176, "mandirs" ], [ 26184, "srcdirs" ], [ 26192, "canonicalize.c" ], [ 26207, "__FRAME_END__" ], [ 26221, "__JCR_END__" ], [ 26233, "__init_array_end" ], [ 26250, "_DYNAMIC" ], [ 26259, "__init_array_start" ], [ 26278, "__GNU_EH_FRAME_HDR" ], [ 26297, "_GLOBAL_OFFSET_TABLE_" ], [ 26319, "__libc_csu_fini" ], [ 26335, "getenv@@GLIBC_2.2.5" ], [ 26355, "__progname@@GLIBC_2.2.5" ], [ 26379, "free@@GLIBC_2.2.5" ], [ 26397, "abort@@GLIBC_2.2.5" ], [ 26416, "__errno_location@@GLIBC_2.2.5" ], [ 26446, "strncpy@@GLIBC_2.2.5" ], [ 26467, "_ITM_deregisterTMCloneTable" ], [ 26495, "stdout@@GLIBC_2.2.5" ], [ 26534, "__fpending@@GLIBC_2.2.5" ], [ 26558, "warn@@GLIBC_2.2.5" ], [ 26576, "ferror@@GLIBC_2.2.5" ], [ 26596, "atexit" ], [ 26603, "canonicalize_path_restricted" ], [ 26632, "getpid@@GLIBC_2.2.5" ], [ 26652, "vasprintf@@GLIBC_2.2.5" ], [ 26675, "_edata" ], [ 26682, "fclose@@GLIBC_2.2.5" ], [ 26702, "opendir@@GLIBC_2.2.5" ], [ 26723, "bindtextdomain@@GLIBC_2.2.5" ], [ 26751, "dcgettext@@GLIBC_2.2.5" ], [ 26774, "strlen@@GLIBC_2.2.5" ], [ 26794, "getuid@@GLIBC_2.2.5" ], [ 26814, "errx@@GLIBC_2.2.5" ], [ 26832, "strchr@@GLIBC_2.2.5" ], [ 26852, "warnx@@GLIBC_2.2.5" ], [ 26893, "snprintf@@GLIBC_2.2.5" ], [ 26915, "strrchr@@GLIBC_2.2.5" ], [ 26936, "__assert_fail@@GLIBC_2.2.5" ], [ 26963, "fputs@@GLIBC_2.2.5" ], [ 26982, "geteuid@@GLIBC_2.2.5" ], [ 27003, "getcwd@@GLIBC_2.2.5" ], [ 27023, "closedir@@GLIBC_2.2.5" ], [ 27045, "fputc@@GLIBC_2.2.5" ], [ 27064, "__strdup@@GLIBC_2.2.5" ], [ 27086, "__libc_start_main@@GLIBC_2.2.5" ], [ 27117, "fgets@@GLIBC_2.2.5" ], [ 27136, "__canonicalize_dm_name" ], [ 27159, "calloc@@GLIBC_2.2.5" ], [ 27179, "__data_start" ], [ 27207, "__dso_handle" ], [ 27220, "realpath@@GLIBC_2.3" ], [ 27240, "memcpy@@GLIBC_2.14" ], [ 27259, "_IO_stdin_used" ], [ 27274, "getgid@@GLIBC_2.2.5" ], [ 27294, "__xstat@@GLIBC_2.2.5" ], [ 27315, "readdir@@GLIBC_2.2.5" ], [ 27336, "__libc_csu_init" ], [ 27352, "malloc@@GLIBC_2.2.5" ], [ 27372, "canonicalize_path" ], [ 27390, "getegid@@GLIBC_2.2.5" ], [ 27411, "__bss_start" ], [ 27423, "setlocale@@GLIBC_2.2.5" ], [ 27446, "main" ], [ 27451, "absolute_path" ], [ 27465, "access@@GLIBC_2.2.5" ] ], "sz": 29952, "ts": [ { "c": 1.0, "d": "ELF program interpreter present", "e": [ "/lib64/ld-linux-x86-64.so.2" ], "i": "metadata/binary/linking::elf-interpreter", "l": 2 }, { "c": 1.0, "d": "ELF needed library", "e": [ "libc.so.6" ], "i": "metadata/binary/linking::elf-needed-lib", "l": 2 }, { "c": 1.0, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "l": 2 }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.function_count = 86.00" ], "i": "metadata/binary/metrics::many-functions", "l": 2 }, { "a": "T1055", "c": 0.25, "d": "Repeated 0x07 code constant (possible PROT_RWX)", "e": [ "07 00 00 00", "07 00 00 00" ], "i": "micro-behaviors/mem/protect/modify::rwx-prot-bytes", "l": 1 }, { "d": "Characteristic system library export __assert_fail", "e": [ "assert_fail" ], "i": "micro-behaviors/dylib/library/libc::libc-characteristic-assert-fail", "l": 2 }, { "d": ".so extension reference", "e": [ ".so" ], "i": "micro-behaviors/fs/path/extension::so", "l": 2 }, { "c": 1.0, "d": "Binary format is identified", "e": [ "elf.class_bits = 64.00" ], "i": "metadata/binary::binary-format-checked", "l": 2 }, { "c": 0.6600000262260437, "d": "Uses closedir", "e": [ "closedir" ], "i": "micro-behaviors/fs/directory/readdir::readdir-closedir", "l": 2 }, { "c": 0.800000011920929, "d": "Binary has many exports (\u003e10)", "e": [ "binary.export_count = 69.00" ], "i": "metadata/binary/metrics::many-exports", "l": 2 }, { "c": 0.800000011920929, "d": "Drop privileges (setuid after getuid)", "e": [ "setegid", "seteuid" ], "i": "micro-behaviors/process/identity/setuid::drop-privs", "l": 2 }, { "c": 0.6000000238418579, "d": "Small ELF binary (\u003c 50KB)", "e": [ "x86__64__lsb__unix-system-v__gcc-4.9.4__O3__no-obf__unstripped__util-linux-2.33__whereis" ], "i": "metadata/binary/metrics::small-elf-binary", "l": 2 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 58.00" ], "i": "metadata/binary/metrics::many-imports-40", "l": 1 }, { "c": 0.6600000262260437, "d": "Reference to /lib64", "e": [ "/lib64/ld-linux-x86-64.so.2" ], "i": "micro-behaviors/fs/path/system::system-lib64", "l": 2 }, { "d": "Characteristic system library exports", "e": [ "libc_start_main" ], "i": "micro-behaviors/dylib/library/libc::libc-characteristic-symbols", "l": 2 }, { "c": 0.20000000298023224, "d": "command keyword", "e": [ "Locate the binary, source, and manual-page files for a command." ], "i": "micro-behaviors/data/text/keywords::command-dup", "l": 1 }, { "c": 0.6600000262260437, "d": "Resolve symbolic links to canonical", "e": [ "realpath", "realpath@@GLIBC_2.3", "sym.imp.realpath" ], "i": "micro-behaviors/fs/link/symlink::symlink-resolve", "l": 2 }, { "d": "Get effective user ID", "e": [ "geteuid" ], "i": "micro-behaviors/os/privilege/query::geteuid", "l": 2 }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening::no-pie", "l": 2 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 4.65" ], "i": "metadata/binary/metrics::avg-complexity-15-max", "l": 2 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.10" ], "i": "metadata/binary/metrics::avg-string-entropy-4-max", "l": 2 }, { "c": 0.6600000262260437, "d": "Uses readdir", "e": [ "readdir" ], "i": "micro-behaviors/fs/directory/readdir::readdir-readdir", "l": 2 }, { "d": "Get effective group ID", "e": [ "getegid" ], "i": "micro-behaviors/os/privilege/query::getegid", "l": 2 }, { "c": 0.8999999761581421, "d": "NetBSD-style /usr/src source path", "e": [ "/usr/src/ucb/pascal", "/usr/src/lib/libc/*", "/usr/src/lib/libc/net/*", "/usr/src/ucb/pascal/utilities", "/usr/src/undoc" ], "i": "metadata/binary/provenance::netbsd-source-tree-path", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "binary.file_size = 29952.00" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 2.73" ], "i": "metadata/binary/metrics::low-overall-entropy-binary", "l": 1 }, { "c": 0.8999999761581421, "d": "CLI help or usage text", "e": [ "Try '%s --help' for more information." ], "i": "metadata/binary/metrics::help-usage-string", "l": 2 }, { "c": 0.8999999761581421, "d": "ELF dynsym section name", "e": [ ".dynsym" ], "i": "metadata/binary/linking::elf-dynsym-section-name", "l": 2 }, { "c": 1.0, "d": "/tmp/ path component", "e": [ "/tmp/util-linux/_out/share/locale" ], "i": "micro-behaviors/fs/path/temp::tmp-path-content", "l": 2 }, { "c": 0.6600000262260437, "d": "Open files", "e": [ "fopen" ], "i": "micro-behaviors/fs/file/open::fopen", "l": 2 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 58.00" ], "i": "metadata/binary/metrics::many-imports-25", "l": 1 }, { "d": "Get user ID", "e": [ "getuid" ], "i": "micro-behaviors/os/privilege/query::getuid", "l": 2 }, { "c": 0.800000011920929, "d": "libc version string pattern", "e": [ "GLIBC", "GLIBC", "GLIBC", "GLIBC", "GLIBC", "GLIBC", "GLIBC", "GLIBC", "GLIBC", "GLIBC", "GLIBC", "GLIBC", "GLIBC", "GLIBC", "GLIBC", "GLIBC" ], "i": "micro-behaviors/dylib/library/libc::libc-version-string", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 58.00" ], "i": "metadata/binary/metrics::many-imports-50", "l": 1 }, { "a": "T1059.006", "c": 0.6000000238418579, "d": "Named /tmp execution path", "e": [ "/tmp/util" ], "i": "objectives/command-and-control/dropper::tmp-path", "l": 1, "m": "B0024" }, { "c": 0.8999999761581421, "d": "Abort program execution", "e": [ "abort" ], "i": "micro-behaviors/os/signal/handler::abort", "l": 2 }, { "c": 0.20000000298023224, "d": "output keyword", "e": [ "-l output effective lookup paths" ], "i": "micro-behaviors/data/text/keywords::output", "l": 1 }, { "c": 1.0, "d": "Line-based file reading (fgets)", "e": [ "fgets" ], "i": "micro-behaviors/process/create/direct::fgets-loop", "l": 2 }, { "c": 0.6600000262260437, "d": "Reference to /usr/local binaries", "e": [ "/usr/local/bin/X11" ], "i": "micro-behaviors/fs/path/binary::binary-usr-local", "l": 2 }, { "c": 0.8999999761581421, "d": "ELF interpreter section name", "e": [ ".interp" ], "i": "metadata/binary/linking::elf-interpreter-section-name", "l": 2 }, { "d": "Get group ID", "e": [ "getgid" ], "i": "micro-behaviors/os/privilege/query::getgid", "l": 2 }, { "c": 1.0, "d": "Binary has 20+ exports", "e": [ "binary.export_count = 69.00" ], "i": "metadata/binary/metrics::many-exports-20", "l": 1 }, { "c": 0.699999988079071, "d": "Version information string", "e": [ "--version" ], "i": "metadata/package/help::version-text", "l": 2 }, { "a": "T1082", "d": "/sys/block/ path", "e": [ "%s/sys/block/%s/dm/name" ], "i": "micro-behaviors/fs/disk/paths::sys-block", "l": 2, "m": "E1082" }, { "c": 0.699999988079071, "d": "Uses device mapper framework", "e": [ "/dev/mapper/%s" ], "i": "micro-behaviors/hardware/block/device::dev-mapper", "l": 3 }, { "d": "Characteristic system library export __errno_location", "e": [ "errno_location" ], "i": "micro-behaviors/dylib/library/libc::libc-characteristic-errno", "l": 2 }, { "d": "Binary exports symbols", "e": [ "binary.export_count = 69.00" ], "i": "metadata/binary/symbols::has-exports", "l": 1 }, { "c": 1.0, "d": "Binary has 9+ exports", "e": [ "binary.export_count = 69.00" ], "i": "metadata/binary/metrics::many-exports-9", "l": 1 }, { "a": "T1082", "c": 0.30000001192092896, "d": "x86_64 architecture string", "e": [ "/usr/lib/x86_64-linux-gnu", "/usr/local/lib/x86_64-linux-gnu" ], "i": "micro-behaviors/os/sysinfo/platform/architecture::arch-x86-64", "l": 2, "m": "E1082" }, { "c": 0.6600000262260437, "d": "Write single bytes to file", "e": [ "fputc" ], "i": "micro-behaviors/fs/file/write::fputc", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.function_count = 86.00" ], "i": "metadata/binary/metrics::many-functions-50", "l": 1 }, { "c": 0.4000000059604645, "d": "Terminate process immediately without cleanup", "e": [ "exit", "exit" ], "i": "micro-behaviors/process/terminate/signal::_exit", "l": 2 }, { "c": 0.6600000262260437, "d": "Uses opendir", "e": [ "opendir" ], "i": "micro-behaviors/fs/directory/readdir::readdir-opendir", "l": 2 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 58.00" ], "i": "metadata/binary/metrics::many-imports-20", "l": 1 }, { "c": 0.699999988079071, "d": "Unix /tmp/ path reference", "e": [ "/tmp/util-linux/_out/share/locale" ], "i": "micro-behaviors/fs/path/temp::unix-temp", "l": 2 }, { "c": 0.30000001192092896, "d": "Get process ID", "e": [ "getpid" ], "i": "micro-behaviors/process/identity/query::getpid", "l": 2 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.function_count = 86.00" ], "i": "metadata/binary/metrics::few-functions-3", "l": 1 }, { "d": "Characteristic system library export __cxa_atexit", "e": [ "cxa_atexit" ], "i": "micro-behaviors/dylib/library/libc::libc-characteristic-cxa-atexit", "l": 2 }, { "c": 1.0, "d": "ELF64 class marker", "e": [ "elf.class_bits = 64.00" ], "i": "metadata/binary/metrics::elf64-class", "l": 1 }, { "c": 0.8999999761581421, "d": "ELF dynamic section name", "e": [ ".dynamic" ], "i": "metadata/binary/linking::elf-dynamic-section-name", "l": 2 }, { "c": 0.8999999761581421, "d": "ELF dynstr section name", "e": [ ".dynstr" ], "i": "metadata/binary/linking::elf-dynstr-section-name", "l": 2 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 58.00" ], "i": "metadata/binary/metrics::many-imports-30", "l": 1 }, { "c": 1.0, "d": "Binary has 20+ sections (installer/packer)", "e": [ "binary.section_count = 29.00" ], "i": "metadata/binary/metrics::many-sections-20", "l": 1 }, { "c": 0.6600000262260437, "d": "Check if file exists", "e": [ "access" ], "i": "micro-behaviors/fs/file/stat::stat-exists", "l": 2 }, { "c": 0.6000000238418579, "d": "Set user ID (capability)", "e": [ "seteuid" ], "i": "micro-behaviors/process/identity/setuid::setuid-dup", "l": 3 }, { "c": 0.8999999761581421, "d": "No stack canary (stack smashing protection absent)", "e": [ "elf.stack_canary = 0.00" ], "i": "metadata/hardening::no-stack-canary", "l": 2 }, { "c": 0.6000000238418579, "d": "Binary not position-independent (no ASLR)", "e": [ "elf.e_type = 2.00" ], "i": "metadata/hardening::no-pie-struct", "l": 3 }, { "c": 0.6000000238418579, "d": "Set group ID (capability)", "e": [ "setegid" ], "i": "micro-behaviors/process/identity/setuid::setgid", "l": 3 }, { "c": 0.8999999761581421, "d": "ELF dynsym section name", "e": [ ".dynsym" ], "i": "metadata/hardening::elf-dynsym-section-name", "l": 2 }, { "c": 1.0, "d": "ELF needed library metadata", "e": [ "libc.so.6" ], "i": "metadata/binary/linking/runtime::needed-lib", "l": 2 }, { "c": 0.30000001192092896, "d": "getenv function (read environment variable)", "e": [ "getenv", "sym.imp.getenv" ], "i": "micro-behaviors/os/env/vars::getenv", "l": 2 }, { "c": 0.8999999761581421, "d": "ELF dynstr section name", "e": [ ".dynstr" ], "i": "metadata/hardening::elf-dynstr-section-name", "l": 2 }, { "c": 0.8999999761581421, "d": "ELF interpreter section name", "e": [ ".interp" ], "i": "metadata/hardening::elf-interpreter-section-name", "l": 2 }, { "c": 1.0, "d": "ELF program interpreter metadata", "e": [ "/lib64/ld-linux-x86-64.so.2" ], "i": "metadata/binary/linking/runtime::interpreter", "l": 2 }, { "c": 0.8999999761581421, "d": "No RELRO (GOT writable after load)", "e": [ "elf.relro = 0.00" ], "i": "metadata/hardening::no-relro", "l": 2 }, { "a": "T1057", "d": "Dev app emacs", "e": [ "emacs", "emacs", "emacs" ], "i": "micro-behaviors/process/enumerate/apps::dev-apps-emacs-pycharm", "l": 3, "m": "E1592" }, { "c": 0.8999999761581421, "d": "ELF dynamic section name", "e": [ ".dynamic" ], "i": "metadata/hardening::elf-dynamic-section-name", "l": 2 }, { "c": 0.6600000262260437, "d": "Reference to /tmp", "e": [ "/tmp/util-linux/_out/share/locale", "/tmp/util-linux/_out/share/locale" ], "i": "micro-behaviors/fs/path/temp::temp-tmp", "l": 2 } ], "sha": "0527dc3d0b03d31bf1a695de8e0393e24a5c9c431db41a4dc2cd04584bb32d7d", "path": "x86__64__lsb__unix-system-v__gcc-4.9.4__O3__no-obf__unstripped__util-linux-2.33__whereis", "type": "elf" } ], "tv": "feb13" } }