{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.8383554220199585, "class": 0 } ], "prob": 0.8383554, "class": 0, "models": [ { "m": "az", "prob": 0.8383554, "class": 0 }, { "m": "az/source", "prob": 0.4568528, "class": 0 }, { "m": "az/c", "prob": 0.39269912, "class": 0 } ], "version": "v17.17", "thresholds": [ 0.999503, 0.9998882 ], "analyzed_at": "2026-05-25T19:33:19Z" }, "path": "injector.c", "raw": { "v": "5", "fs": [ { "f": "O(Er)H(F)", "x": 30, "ff": { "i": [ [ "", "printf" ], [ "", "fstat" ], [ "", "puts" ], [ "", "exit" ], [ "", "open" ], [ "", "printf" ], [ "", "printf" ], [ "", "strerror" ], [ "", "get_file_size" ], [ "", "mmap" ], [ "", "puts" ], [ "", "close" ], [ "", "close" ], [ "", "unlink" ], [ "", "open" ], [ "", "printf" ], [ "", "printf" ], [ "", "strerror" ], [ "", "ALIGN_UP" ], [ "", "ftruncate" ], [ "", "mmap" ], [ "", "close" ], [ "", "memmove" ], [ "", "munmap" ], [ "", "strlen" ], [ "", "find_valid_section" ], [ "", "puts" ], [ "", "malloc" ], [ "", "strlen" ], [ "", "memmove" ], [ "", "strlen" ], [ "", "memmove" ], [ "", "strlen" ], [ "", "memmove" ], [ "", "strlen" ], [ "", "strlen" ], [ "", "memmove" ], [ "", "free" ], [ "", "printf" ], [ "", "msync" ], [ "", "munmap" ], [ "", "ARRAY_SIZE" ], [ "", "strncpy" ], [ "", "strncat" ], [ "", "printf" ], [ "", "install_module_by_path" ] ], "m": { "ast": { "max_depth": 18.0, "bind_count": 8.0, "call_count": 46.0, "node_count": 1485.0, "target_count": 23.0, "member_depth_max": 2.0, "string_literal_count": 11.0, "string_concat_chain_max_length": 4.0 }, "file": { "size": 6016.0, "entropy": 4.64, "size_bytes": 6016.0 }, "text": { "digit_ratio": 0.02, "space_count": 1642.0, "total_lines": 168.0, "char_entropy": 4.64, "unique_chars": 83.0, "string_density": 0.07, "avg_line_length": 34.81, "max_line_length": 80.0, "empty_line_ratio": 0.07, "last_line_length": 1.0, "whitespace_ratio": 0.3, "most_common_ratio": 0.07, "identifier_density": 1.85, "line_length_stddev": 23.59, "normalized_string_count": 0.85, "repeated_char_sequences": 33.0, "most_common_char_is_null": 0.0, "suspicious_comment_ratio": 0.33, "max_inline_whitespace_run": 1.0, "most_common_char_codepoint": 101.0, "suspicious_identifier_ratio": 0.02, "normalized_unique_identifiers": 11.36 }, "source": { "class_count": 1.0, "function_count": 4.0 }, "imports": { "count": 1.0, "unique_modules": 1.0, "third_party_count": 1.0, "third_party_ratio": 1.0 }, "strings": { "total": 11.0, "avg_length": 18.0, "max_length": 37.0, "avg_entropy": 3.35, "total_bytes": 198.0, "entropy_stddev": 0.56 }, "comments": { "chars": 659.0, "lines": 20.0, "total": 3.0, "to_code_ratio": 0.14, "url_in_comments": 1.0, "high_entropy_comments": 1.0 }, "functions": { "count": 5.0 }, "identifiers": { "total": 310.0, "avg_length": 8.48, "max_length": 27.0, "min_length": 1.0, "avg_entropy": 2.59, "reuse_ratio": 0.27, "unique_count": 84.0, "length_stddev": 4.77, "has_digit_ratio": 0.04, "sequential_names": 2.0, "single_char_count": 2.0, "single_char_ratio": 0.02, "high_entropy_count": 6.0, "high_entropy_ratio": 0.07, "all_lowercase_ratio": 0.81, "all_uppercase_ratio": 0.15, "underscore_prefix_count": 2.0 } }, "s": [ [ 9, "u8", "injector.h" ], [ 10, "u8", "injector.h" ], [ 1692, "u8", "INFO \"Section found: 0x%lx %s\\n" ], [ 1697, "u8", "Section found: 0x%lx %s\\n" ], [ 1698, "u8", "Section found: 0x%lx %s" ], [ 2298, "u8", "[!] fstat fail" ], [ 2299, "u8", "[!] fstat fail" ], [ 2875, "u8", "WARN \"fail to open file %s\\n" ], [ 2880, "u8", "fail to open file %s\\n" ], [ 2881, "u8", "fail to open file %s" ], [ 2928, "u8", "WARN \"Error: %s\\n" ], [ 2933, "u8", "Error: %s\\n" ], [ 2934, "u8", "Error: %s" ], [ 3167, "u8", "WARN \"Fail to mmap" ], [ 3172, "u8", "Fail to mmap" ], [ 3173, "u8", "Fail to mmap" ], [ 3581, "u8", "WARN \"Fail to open file %s\\n" ], [ 3586, "u8", "Fail to open file %s\\n" ], [ 3587, "u8", "Fail to open file %s" ], [ 3634, "u8", "WARN \"Error: %s\\n" ], [ 3639, "u8", "Error: %s\\n" ], [ 3640, "u8", "Error: %s" ], [ 4435, "u8", "WARN \"No avalible space for patching" ], [ 4440, "u8", "No avalible space for patching" ], [ 4441, "u8", "No avalible space for patching" ], [ 5343, "u8", "INFO \"Successfully inject rootkit into %s\\n" ], [ 5348, "u8", "Successfully inject rootkit into %s\\n" ], [ 5349, "u8", "Successfully inject rootkit into %s" ], [ 5874, "u8", "%s\\n" ], [ 5875, "u8", "%s" ] ], "v": { "source.language": "c", "source.imports[0]": "ALIGN_UP", "source.imports[1]": "ARRAY_SIZE", "source.imports[2]": "close", "source.imports[3]": "exit", "source.imports[4]": "find_valid_section", "source.imports[5]": "free", "source.imports[6]": "fstat", "source.imports[7]": "ftruncate", "source.imports[8]": "get_file_size", "source.imports[9]": "install_module_by_path", "source.strings[0]": "Error: %s", "source.strings[1]": "Error: %s\\n", "source.strings[2]": "Fail to mmap", "source.strings[3]": "Fail to open file %s", "source.strings[4]": "Fail to open file %s\\n", "source.strings[5]": "INFO \"Section found: 0x%lx %s\\n", "source.strings[6]": "INFO \"Successfully inject rootkit into %s\\n", "source.strings[7]": "No avalible space for patching", "source.strings[8]": "Section found: 0x%lx %s", "source.strings[9]": "Section found: 0x%lx %s\\n", "source.has_imports": true, "source.imports[10]": "malloc", "source.imports[11]": "memmove", "source.imports[12]": "mmap", "source.imports[13]": "msync", "source.imports[14]": "munmap", "source.imports[15]": "open", "source.imports[16]": "printf", "source.imports[17]": "puts", "source.imports[18]": "strerror", "source.imports[19]": "strlen", "source.imports[20]": "strncat", "source.imports[21]": "strncpy", "source.imports[22]": "unlink", "source.strings[10]": "Successfully inject rootkit into %s", "source.strings[11]": "Successfully inject rootkit into %s\\n", "source.strings[12]": "WARN \"Error: %s\\n", "source.strings[13]": "WARN \"Fail to mmap", "source.strings[14]": "WARN \"Fail to open file %s\\n", "source.strings[15]": "WARN \"No avalible space for patching", "source.strings[16]": "WARN \"fail to open file %s\\n", "source.strings[17]": "[!] fstat fail", "source.strings[18]": "fail to open file %s", "source.strings[19]": "fail to open file %s\\n", "source.strings[20]": "injector.h", "source.functions[0]": "find_valid_section(char *image,\n unsigned long patch_size,\n unsigned long *ppatch_base,\n unsigned long *ppatch_virtual_base)", "source.functions[1]": "get_file_size(int fd)", "source.functions[2]": "install_module(const char module_start[],\n const char module_end[],\n const char *root)", "source.functions[3]": "install_module_by_path(char *path,\n char *relative_path,\n const char module_start[],\n const char module_end[])" }, "ca": [ [ "printf", "%s\\n" ], [ "printf", "Error: %s\\n" ], [ "printf", "Fail to open file %s\\n" ], [ "printf", "Section found: 0x%lx %s\\n" ], [ "printf", "Successfully inject rootkit into %s\\n" ], [ "printf", "fail to open file %s\\n" ], [ "puts", "Fail to mmap" ], [ "puts", "No avalible space for patching" ], [ "puts", "[!] fstat fail" ] ], "ct": [ "ALIGN_UP", "ARRAY_SIZE", "close", "exit", "find_valid_section", "free", "fstat", "ftruncate", "get_file_size", "install_module_by_path", "malloc", "memmove", "mmap", "msync", "munmap", "open", "printf", "puts", "strerror", "strlen", "strncat", "strncpy", "unlink" ], "id": "c", "mc": [ "elf_header.e_entry", "elf_header.e_phnum", "elf_header.e_phoff", "elf_header.e_shnum", "elf_header.e_shoff", "elf_header.e_shstrndx", "sb.st_size" ] }, "id": 0, "sz": 6016, "ts": [ { "c": 0.699999988079071, "d": "Memory move operation (often used", "e": [ "memmove(image + evil_base, module_start, evil_size)", "memmove(image + patch_base + patch_size - strlen(relative_path) - 1,\n relative_path, strl...", "memmove(shellcode, _binary_shellcode_bin_start,\n patch_size - strlen(relative_path) - 1)", "memmove(image, source_image, image_size)", "memmove(image + patch_base, shellcode,\n patch_size - strlen(relative_path) - 1)" ], "i": "objectives/evasion/kernel-hide/lkm/hiding::memmove-call", "l": 4 }, { "c": 0.6600000262260437, "d": "Open files", "e": [ "open" ], "i": "micro-behaviors/fs/file/open::open-base", "l": 2 }, { "d": "Truncate file", "e": [ "ftruncate" ], "i": "micro-behaviors/fs/file/truncate::truncate", "l": 2 }, { "c": 0.6600000262260437, "d": "Unmap files from memory", "e": [ "munmap" ], "i": "micro-behaviors/fs/memory/mmap::munmap", "l": 2 }, { "c": 0.6600000262260437, "d": "Look up file permissions", "e": [ "fstat" ], "i": "micro-behaviors/fs/chmod/get::get-dup", "l": 2 }, { "c": 1.0, "d": "shell script command substitution", "e": [ "`drow`" ], "i": "micro-behaviors/process/create/shell/invoke::command-substitution", "l": 2 }, { "c": 0.800000011920929, "d": "Read file status and metadata (core)", "e": [ "fstat" ], "i": "micro-behaviors/fs/file/stat::stat-core", "l": 3 } ], "sha": "1cde92744d0a7ee65aeca4eec8b4a15c04cb62d8bc802f9d06d43a107cda0810", "path": "injector.c", "type": "c" } ], "tv": "cf883" } }