{ "ml": { "v": "5", "fs": [ { "id": 0, "prob": 0.9990379810333252, "class": 2, "threshold": 0.9932810664176941 } ], "prob": 0.999038, "class": 2, "level": 3, "models": [ { "m": "az", "prob": 0.99716914, "class": 2 }, { "m": "az/native", "prob": 0.999038, "class": 2 }, { "m": "az/elf", "prob": 1.0, "class": 2 } ], "version": "v17.17", "threshold": 0.99328107, "analyzed_at": "2026-05-31T15:26:47Z" }, "path": "259bffe87d7a9283e4c52e9a2fe669c2f6974d1e970f8d5dc2d6e362eaa973b7.elf", "raw": { "v": "5", "fs": [ { "f": "Md₃(BiBkHe₂)", "x": 125, "ff": { "m": { "elf": { "bits": 32.0, "entry": 55392.0, "has_got": 0.0, "has_plt": 0.0, "has_note": 0.0, "note_count": 0.0, "nx_enabled": 0.0, "dynrel_count": 0.0, "dynsym_count": 0.0, "has_eh_frame": 0.0, "symtab_count": 0.0, "dynrela_count": 0.0, "little_endian": 1.0, "pltreloc_count": 0.0, "executable_stack": 1.0, "wx_segment_count": 0.0, "program_header_count": 3.0, "gnu_stack_section_absent": 0.0, "load_segment_max_file_size": 27151.0, "stripped_but_symtab_present": 0.0, "load_segment_max_memory_size": 27151.0, "section_relocation_group_count": 0.0, "stripped_metadata_section_count": 8.0 }, "file": { "size": 27384.0, "entropy": 7.94, "size_bytes": 27384.0 }, "binary": { "is_pie": 0.0, "is_stripped": 1.0, "avg_complexity": 22.0, "max_complexity": 61.0, "huge_func_count": 1.0, "leaf_func_count": 2.0, "tiny_func_count": 1.0, "avg_basic_blocks": 36.67, "total_basic_blocks": 110.0 }, "functions": { "count": 3.0 }, "dependencies": { "count": 0.0 } }, "s": [ [ 1778, "u8", "QO}{cVX" ], [ 2512, "u8", "lhA7s" ], [ 4195, "u8", "sM mon" ], [ 4215, "u8", "Xq.td" ], [ 5655, "u8", "EAQO" ], [ 5898, "u8", "a206" ], [ 6276, "u8", "Rujq" ], [ 6547, "u8", "mPgeJ" ], [ 7941, "u8", "FpHO1" ], [ 8414, "u8", "F2ZH" ], [ 8814, "u8", "qjiqa" ], [ 8927, "u8", "o2XpveS" ], [ 9058, "u8", "B5LA" ], [ 9499, "u8", "hw40" ], [ 9562, "u8", "C1G2" ], [ 10299, "u8", "kjKh" ], [ 10335, "u8", "WWH41y" ], [ 10787, "u8", "Z1ptO" ], [ 13300, "u8", "/EUo" ], [ 13310, "u8", "fvZCl" ], [ 14188, "u8", "F93M" ], [ 14469, "u8", "Mvoi" ], [ 14577, "u8", "wQgf2" ], [ 17559, "u8", "HLBM" ], [ 17750, "u8", "M3OMq" ], [ 18256, "u8", "kayaW" ], [ 19151, "u8", "qNV p" ], [ 19741, "u8", "emWx" ], [ 21049, "u8", "fG.v" ], [ 22576, "u8", "T_B9" ], [ 25392, "u8", "PROT_EXEC|PROT_WRITE failed." ], [ 25424, "u8", "$Info: This file is packed with the UPX executable packer http://upx.sf.net $" ], [ 25503, "u8", "$Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $" ], [ 27138, "u8", "961K" ] ], "v": { "elf.type": "executable", "elf.class": "elf32", "elf.entry": 55392, "file.stem": "259bffe87d7a9283e4c52e9a2fe669c2f6974d1e970f8d5dc2d6e362eaa973b7", "elf.endian": "little", "elf.machine": "arm", "elf.version": 1, "binary.packer": "upx", "file.basename": "259bffe87d7a9283e4c52e9a2fe669c2f6974d1e970f8d5dc2d6e362eaa973b7.elf", "elf.e_flags[0]": "soft_float", "elf.e_flags_raw": 514, "elf.segments[0].type": "load", "elf.segments[1].type": "load", "elf.segments[2].type": "gnu_stack", "binary.packer_version": "3.94", "elf.segments[0].perms": "r-x", "elf.segments[0].vaddr": 32768, "elf.segments[1].perms": "rw-", "elf.segments[1].vaddr": 128836, "elf.segments[2].perms": "rwx", "elf.segments[0].file_size": 27151, "elf.segments[0].flags_hex": "5", "elf.segments[1].flags_hex": "6", "elf.segments[2].flags_hex": "7", "elf.segments[0].memory_size": 27151, "elf.segments[1].file_offset": 30532, "binary.top_complex_unnamed[0].cc": 61, "elf.stripped_metadata_sections[0]": ".symtab", "elf.stripped_metadata_sections[1]": ".strtab", "elf.stripped_metadata_sections[2]": ".comment", "elf.stripped_metadata_sections[3]": ".debug_info", "elf.stripped_metadata_sections[4]": ".debug_line", "elf.stripped_metadata_sections[5]": ".debug_str", "elf.stripped_metadata_sections[6]": ".debug_abbrev", "elf.stripped_metadata_sections[7]": ".note.gnu.gold-version", "binary.top_complex_unnamed[0].addr": "0xd9e0" }, "id": "elf" }, "id": 0, "sz": 27384, "ts": [ { "c": 1.0, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "l": 2 }, { "c": 1.0, "d": "Binary contains a UPX packing marker", "i": "anti-static/packer/upx", "l": 4 }, { "c": 1.0, "d": "UPX decompression failed: IO error: No such file or directory (os error 2)", "i": "anti-static/packer/upx/decompression-failed", "l": 5 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "259bffe87d7a9283e4c52e9a2fe669c2f6974d1e970f8d5dc2d6e362eaa973b7.elf" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2, "el": [ "0x639f" ] }, { "c": 0.4000000059604645, "d": "Very few leaf functions (deep)", "e": [ "binary.leaf_func_count = 2.00" ], "i": "metadata/binary/metrics/structural::few-leaf-functions", "l": 3 }, { "c": 0.8500000238418579, "d": "ELF PT_GNU_STACK has executable bit set", "e": [ "elf.executable_stack = 1.00" ], "i": "metadata/binary/anomaly/format::elf-executable-stack", "l": 3 }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening/layout::no-pie", "l": 2 }, { "c": 0.949999988079071, "d": "UPX magic bytes in ELF", "e": [ "UPX!" ], "i": "objectives/anti-static/pack/detect::upx-magic-raw", "l": 1 }, { "c": 0.699999988079071, "d": "ELF symbol tables stripped from binary", "e": [ "elf.stripped_metadata_section_count = 8.00" ], "i": "metadata/binary/anomaly/provenance::stripped-symbol-tables", "l": 1 }, { "c": 0.6000000238418579, "d": "PROT_EXEC memory protection constant", "e": [ "PROT_EXEC|PROT_WRITE failed." ], "i": "micro-behaviors/mem/alloc/executable::prot-exec-const", "l": 2, "el": [ "0x6330" ] }, { "c": 0.6000000238418579, "d": "Small ELF binary (\u003c 50KB)", "e": [ "259bffe87d7a9283e4c52e9a2fe669c2f6974d1e970f8d5dc2d6e362eaa973b7.elf" ], "i": "metadata/binary/metrics/structural::small-elf-binary", "l": 2 }, { "c": 1.0, "d": "UPX executable packer signature string", "e": [ "$Info: This file is packed with the UPX executable packer http://upx.sf.net $" ], "i": "objectives/anti-static/pack/detect::upx-packer-string", "l": 1, "el": [ "0x6350" ] }, { "c": 0.8999999761581421, "d": "ELF imports zero needed libraries", "e": [ "dependencies.count = 0.00" ], "i": "metadata/binary/linking/static::elf-needed-libs-zero", "l": 2 }, { "c": 1.0, "d": "Binary symbol table is stripped", "e": [ "binary.is_stripped = 1.00" ], "i": "metadata/hardening/layout::stripped", "l": 2 }, { "c": 0.6000000238418579, "d": "PROT_WRITE memory protection constant", "e": [ "PROT_WRITE" ], "i": "objectives/anti-analysis/self-modify/runtime::prot-write", "l": 2, "el": [ "0x6330" ] }, { "c": 1.0, "d": "Toolchain banner stripped, build-id retained", "e": [ "[.symtab, .strtab, .comment, .debug_info, .debug_line, .debug_str, .debug_abbrev, .note.gnu.gold-version]" ], "i": "metadata/build/artifact::aggressive-strip", "l": 3, "el": [ "value:elf.stripped_metadata_sections" ] }, { "c": 0.8999999761581421, "d": "Tiny C string section ratio", "e": [ " = 0.0% of total (0 / 27384 bytes)" ], "i": "metadata/binary/section/metrics::tiny-cstring-section", "l": 1 }, { "c": 0.800000011920929, "d": "No full symbol table (likely stripped)", "e": [ "binary.is_stripped = 1.00" ], "i": "metadata/hardening/missing::stripped-binary", "l": 3 }, { "c": 0.8999999761581421, "d": "NX/DEP disabled (stack is executable)", "e": [ "elf.nx_enabled = 0.00" ], "i": "metadata/hardening/mitigation::nx-disabled", "l": 3 } ], "sha": "259bffe87d7a9283e4c52e9a2fe669c2f6974d1e970f8d5dc2d6e362eaa973b7", "path": "259bffe87d7a9283e4c52e9a2fe669c2f6974d1e970f8d5dc2d6e362eaa973b7.elf", "type": "elf" } ], "tv": "52045" } }