{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 0.02988702617585659,
        "class": 0
      }
    ],
    "prob": 0.029887026,
    "class": 0,
    "models": [
      {
        "m": "az",
        "prob": 0.005225021,
        "class": 0
      },
      {
        "m": "az/native",
        "prob": 0.029887026,
        "class": 0
      },
      {
        "m": "az/elf",
        "prob": 0.0035412346,
        "class": 0
      }
    ],
    "version": "v16.16",
    "thresholds": [
      0.9953178,
      0.9991311
    ],
    "analyzed_at": "2026-05-02T17:48:27Z"
  },
  "path": "x86__64__lsb__unix-system-v__clang-5.0.1__O1__no-obf__unstripped__acpid-2.0.31__inotify_handler.o",
  "raw": {
    "v": "4",
    "fs": [
      {
        "f": "O₂(AsEr)Md₂(Bi₄He)",
        "x": 4,
        "id": 0,
        "ms": {
          "elf": {
            "e_type": 1.0,
            "has_note": true,
            "e_machine": 62.0,
            "class_bits": 64.0,
            "has_eh_frame": true,
            "symtab_count": 18.0,
            "little_endian": true,
            "section_header_count": 10.0,
            "section_relocation_group_count": 2.0
          },
          "binary": {
            "code_size": 680.0,
            "file_size": 3752.0,
            "has_overlay": true,
            "code_entropy": 4.51,
            "data_entropy": 4.34,
            "export_count": 1.0,
            "overlay_size": 640.0,
            "string_count": 41.0,
            "overlay_ratio": 0.17,
            "section_count": 8.0,
            "avg_complexity": 6.0,
            "function_count": 2.0,
            "max_complexity": 7.0,
            "string_density": 61.74,
            "overall_entropy": 3.24,
            "overlay_entropy": 1.02,
            "avg_basic_blocks": 12.0,
            "avg_section_size": 380.25,
            "entropy_variance": 1.5,
            "function_density": 3.01,
            "avg_function_size": 337.5,
            "avg_string_length": 16.61,
            "complexity_per_kb": 9.04,
            "max_string_length": 44.0,
            "avg_string_entropy": 3.17,
            "code_to_data_ratio": 0.29,
            "text_to_file_ratio": 0.47,
            "total_basic_blocks": 24.0,
            "string_length_stddev": 10.11,
            "largest_section_ratio": 0.29,
            "sentence_string_count": 14.0,
            "sentence_string_ratio": 0.34,
            "function_analysis_depth": 2.0,
            "nonstandard_section_name_count": 2.0
          }
        },
        "ss": [
          [
            64,
            "AVSH"
          ],
          [
            352,
            "UAWAVAUATSH"
          ],
          [
            494,
            "/dev/inpH"
          ],
          [
            502,
            "stack",
            "/dev/inp"
          ],
          [
            744,
            "inotify_init() failed: %s (%d)"
          ],
          [
            775,
            "inotify fd: %d"
          ],
          [
            790,
            "/dev/input"
          ],
          [
            801,
            "inotify_add_watch(): input layer not found"
          ],
          [
            844,
            "inotify_add_watch() failed: %s (%d)"
          ],
          [
            880,
            "inotify wd: %d"
          ],
          [
            895,
            "can't add connection for inotify"
          ],
          [
            928,
            "inotify read bytes: %d"
          ],
          [
            951,
            "inotify fd eof encountered"
          ],
          [
            978,
            "inotify read error: %s (%d)"
          ],
          [
            1006,
            "disconnecting from inotify"
          ],
          [
            1033,
            "inotify name len: %d"
          ],
          [
            1056,
            "inotify about to open: %s"
          ],
          [
            1082,
            "inotify received a delete for: %s"
          ],
          [
            1117,
            "clang version 5.0.1 (tags/RELEASE_501/final)"
          ],
          [
            2841,
            "process_inotify"
          ],
          [
            2857,
            "open_inotify"
          ],
          [
            2870,
            ".rela.text"
          ],
          [
            2881,
            ".comment"
          ],
          [
            2890,
            "strncat"
          ],
          [
            2898,
            "strerror"
          ],
          [
            2907,
            "delete_connection"
          ],
          [
            2925,
            "add_connection"
          ],
          [
            2940,
            "__errno_location"
          ],
          [
            2957,
            "strlen"
          ],
          [
            2964,
            ".note.GNU-stack"
          ],
          [
            2980,
            "inotify_add_watch"
          ],
          [
            2998,
            "acpid_log"
          ],
          [
            3008,
            "close"
          ],
          [
            3014,
            ".rela.eh_frame"
          ],
          [
            3029,
            "open_inputfile"
          ],
          [
            3044,
            "read"
          ],
          [
            3049,
            "inotify_handler.c"
          ],
          [
            3067,
            ".strtab"
          ],
          [
            3075,
            ".symtab"
          ],
          [
            3083,
            "inotify_init1"
          ],
          [
            3097,
            ".rodata.str1.1"
          ]
        ],
        "sz": 3752,
        "ts": [
          {
            "c": 1.0,
            "d": "Binary is not digitally signed",
            "i": "metadata/unsigned",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "Tiny ELF binary (\u003c 4KB)",
            "e": [
              "elf.class_bits = 64.00"
            ],
            "i": "metadata/binary/metrics::tiny-elf",
            "l": 3
          },
          {
            "d": "Binary exports symbols",
            "e": [
              "binary.export_count = 1.00"
            ],
            "i": "metadata/binary/symbols::has-exports",
            "l": 1
          },
          {
            "a": "T1055",
            "c": 0.25,
            "d": "Repeated 0x07 code constant (possible PROT_RWX)",
            "e": [
              "07 00 00 00",
              "07 00 00 00",
              "07 00 00 00",
              "07 00 00 00",
              "07 00 00 00",
              "07 00 00 00"
            ],
            "i": "micro-behaviors/mem/protect/modify::rwx-prot-bytes",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Binary has low average complexity",
            "e": [
              "binary.avg_complexity = 6.00"
            ],
            "i": "metadata/binary/metrics::avg-complexity-15-max",
            "l": 2
          },
          {
            "d": "Few detected functions (stub-like or analysis-limited)",
            "e": [
              "binary.function_count = 2.00"
            ],
            "i": "metadata/binary/metrics::no-functions",
            "l": 2
          },
          {
            "c": 0.8999999761581421,
            "d": "ELF imports zero needed libraries",
            "e": [
              "binary.dependency_count = 0.00"
            ],
            "i": "metadata/binary/linking::elf-needed-libs-zero",
            "l": 2
          },
          {
            "a": "T1106",
            "c": 0.949999988079071,
            "d": "ELF ET_DYN binary type",
            "e": [
              "elf.e_type = 1.00"
            ],
            "i": "objectives/evasion/anti-av/syscall::elf-et-dyn",
            "l": 1,
            "m": "B0009"
          },
          {
            "c": 1.0,
            "d": "Sparse visible string surface",
            "e": [
              "binary.string_count = 41.00"
            ],
            "i": "objectives/anti-static/obfuscation/control-flow/native::sparse-strings",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 1.0,
            "d": "ELF64 class marker",
            "e": [
              "elf.class_bits = 64.00"
            ],
            "i": "metadata/binary/metrics::elf64-class",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Binary format is identified",
            "e": [
              "elf.class_bits = 64.00"
            ],
            "i": "metadata/binary::binary-format-checked",
            "l": 2
          },
          {
            "c": 0.6000000238418579,
            "d": "Small ELF binary (\u003c 50KB)",
            "e": [
              "x86__64__lsb__unix-system-v__clang-5.0.1__O1__no-obf__unstripped__acpid-2.0.31__inotify_handler.o"
            ],
            "i": "metadata/binary/metrics::small-elf-binary",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "Binary is not position-independent (fixed load address)",
            "e": [
              "binary.is_pie = 0.00"
            ],
            "i": "metadata/hardening::no-pie",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "Binary has low average string entropy",
            "e": [
              "binary.avg_string_entropy = 3.17"
            ],
            "i": "metadata/binary/metrics::avg-string-entropy-4-max",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "File is a compiled binary",
            "e": [
              "binary.file_size = 3752.00"
            ],
            "i": "metadata/binary/framework::is-binary",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "Binary has low overall entropy",
            "e": [
              "binary.overall_entropy = 3.24"
            ],
            "i": "metadata/binary/metrics::low-overall-entropy-binary",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "Binary has many sentence-like strings",
            "e": [
              "binary.sentence_string_ratio = 0.34"
            ],
            "i": "metadata/binary/metrics::rich-sentence-strings-20pct",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "Compiler/project context token",
            "e": [
              "clang version"
            ],
            "i": "micro-behaviors/dylib/library::llvm-project-ref-b",
            "l": 2
          },
          {
            "c": 0.6000000238418579,
            "d": "Binary not position-independent (no ASLR)",
            "e": [
              "elf.e_type = 1.00"
            ],
            "i": "metadata/hardening::no-pie-struct",
            "l": 3
          },
          {
            "c": 0.75,
            "d": "ELF lacks dynamic linker sections",
            "e": [
              "elf.class_bits = 64.00"
            ],
            "i": "metadata/binary/linking::static-linked-heuristic",
            "l": 3
          },
          {
            "c": 0.75,
            "d": "ELF lacks dynamic linker sections",
            "e": [
              "elf.class_bits = 64.00"
            ],
            "i": "metadata/hardening::static-linked-heuristic",
            "l": 3
          },
          {
            "c": 0.800000011920929,
            "d": "Statically linked binary",
            "e": [
              "binary.dependency_count = 0.00",
              "elf.class_bits = 64.00"
            ],
            "i": "metadata/binary/linking::static-linked",
            "l": 3
          }
        ],
        "sha": "25bdda658cfdbbc77b09535310bc621cacace1175184f068271b05c28239ce5f",
        "path": "/data/samples/good/datasets/Labeled-Elfs/benignware/x86__64__lsb__unix-system-v__clang-5.0.1__O1__no-obf__unstripped__acpid-2.0.31__inotify_handler.o",
        "type": "elf"
      }
    ],
    "tv": "96b0e"
  }
}