{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 1.0,
        "class": 2
      }
    ],
    "prob": 1.0,
    "class": 2,
    "models": [
      {
        "m": "az",
        "prob": 0.6687533,
        "class": 0
      },
      {
        "m": "az/native",
        "prob": 0.04664179,
        "class": 0
      },
      {
        "m": "az/elf",
        "prob": 1.0,
        "class": 2
      }
    ],
    "version": "v16.16",
    "thresholds": [
      0.9961373,
      0.9998425
    ],
    "analyzed_at": "2026-05-15T18:57:09Z"
  },
  "path": "2a7e13e904f8de0f4eebe3d364f7f1fdd09aa72b2c95db20393cfbb0eb77341d.elf",
  "raw": {
    "v": "4",
    "fs": [
      {
        "f": "Md₃(BiBkHe₂)",
        "k": {
          "debug.build_id": "d12750eea31ff4ca83ab12d2e8d54e33338ffe85",
          "build.target_arch": "x86_64",
          "elf.entry_section": ".text",
          "elf.segments[0].perms": "r--",
          "elf.segments[1].perms": "r-x",
          "elf.segments[2].perms": "rw-",
          "elf.segments[3].perms": "r--",
          "elf.segments[0].p_type": "PT_LOAD",
          "elf.segments[1].p_type": "PT_LOAD",
          "elf.segments[2].p_type": "PT_LOAD",
          "elf.segments[3].p_type": "PT_NOTE",
          "elf.segments[0].p_memsz": 324,
          "elf.segments[0].p_vaddr": 4194304,
          "elf.segments[1].p_memsz": 4966,
          "elf.segments[1].p_vaddr": 4198400,
          "elf.segments[2].p_memsz": 198,
          "elf.segments[2].p_vaddr": 4206592,
          "elf.segments[3].p_memsz": 36,
          "elf.segments[3].p_vaddr": 4194592,
          "elf.segments[0].p_filesz": 324,
          "elf.segments[1].p_filesz": 4966,
          "elf.segments[1].p_offset": 4096,
          "elf.segments[2].p_filesz": 198,
          "elf.segments[2].p_offset": 12288,
          "elf.segments[3].p_filesz": 36,
          "elf.segments[3].p_offset": 288,
          "elf.segments[0].flags_hex": "4",
          "elf.segments[1].flags_hex": "5",
          "elf.segments[2].flags_hex": "6",
          "elf.segments[3].flags_hex": "4",
          "binary.top_complex_unnamed[0].cc": 41,
          "binary.top_complex_unnamed[1].cc": 17,
          "binary.top_complex_unnamed[2].cc": 10,
          "binary.top_complex_unnamed[3].cc": 6,
          "binary.top_complex_unnamed[4].cc": 4,
          "binary.top_complex_unnamed[5].cc": 3,
          "binary.top_complex_unnamed[6].cc": 2,
          "binary.top_complex_unnamed[7].cc": 2,
          "binary.top_complex_unnamed[0].bbs": 68,
          "binary.top_complex_unnamed[1].bbs": 26,
          "binary.top_complex_unnamed[2].bbs": 18,
          "binary.top_complex_unnamed[3].bbs": 9,
          "binary.top_complex_unnamed[4].bbs": 6,
          "binary.top_complex_unnamed[5].bbs": 5,
          "binary.top_complex_unnamed[6].bbs": 3,
          "binary.top_complex_unnamed[7].bbs": 3,
          "elf.stripped_metadata_sections[0]": ".comment",
          "elf.stripped_metadata_sections[1]": ".note.GNU-stack",
          "elf.stripped_metadata_sections[2]": ".note.gnu.property",
          "elf.stripped_metadata_sections[3]": ".note.ABI-tag",
          "elf.stripped_metadata_sections[4]": ".symtab",
          "elf.stripped_metadata_sections[5]": ".strtab",
          "binary.top_complex_unnamed[0].addr": "0x4011e4",
          "binary.top_complex_unnamed[0].size": 2705,
          "binary.top_complex_unnamed[1].addr": "0x40204c",
          "binary.top_complex_unnamed[1].size": 699,
          "binary.top_complex_unnamed[2].addr": "0x401c75",
          "binary.top_complex_unnamed[2].size": 409,
          "binary.top_complex_unnamed[3].addr": "0x401e0e",
          "binary.top_complex_unnamed[3].size": 187,
          "binary.top_complex_unnamed[4].addr": "0x4010ae",
          "binary.top_complex_unnamed[4].size": 67,
          "binary.top_complex_unnamed[5].addr": "0x402017",
          "binary.top_complex_unnamed[5].size": 53,
          "binary.top_complex_unnamed[6].addr": "0x4010f1",
          "binary.top_complex_unnamed[6].size": 243,
          "binary.top_complex_unnamed[7].addr": "0x401fb8",
          "binary.top_complex_unnamed[7].size": 48
        },
        "x": 5,
        "id": 0,
        "ms": {
          "elf": {
            "entry": 4198400.0,
            "e_type": 2.0,
            "has_note": true,
            "e_machine": 62.0,
            "class_bits": 64.0,
            "note_count": 1.0,
            "has_build_id": true,
            "entry_section": ".text",
            "little_endian": true,
            "section_count": 5.0,
            "build_id_length": 20.0,
            "program_header_count": 4.0,
            "gnu_stack_section_absent": true,
            "load_segment_max_p_memsz": 4966.0,
            "load_segment_max_p_filesz": 4966.0,
            "stripped_metadata_section_count": 6.0
          },
          "file": {
            "size": 12848.0
          },
          "binary": {
            "code_size": 4966.0,
            "func_count": 13.0,
            "has_overlay": true,
            "code_entropy": 5.58,
            "data_entropy": 5.91,
            "func_density": 2.68,
            "overlay_size": 320.0,
            "string_count": 6.0,
            "avg_func_size": 380.46,
            "overlay_ratio": 0.02,
            "section_count": 4.0,
            "avg_complexity": 7.0,
            "max_complexity": 41.0,
            "string_density": 1.24,
            "overall_entropy": 4.87,
            "overlay_entropy": 0.87,
            "avg_basic_blocks": 11.38,
            "avg_section_size": 1310.5,
            "entropy_variance": 0.89,
            "avg_string_length": 9.83,
            "complexity_per_kb": 1.44,
            "has_provenance_id": true,
            "max_string_length": 18.0,
            "avg_string_entropy": 2.35,
            "code_to_data_ratio": 17.99,
            "data_to_file_ratio": 0.02,
            "text_to_file_ratio": 0.39,
            "total_basic_blocks": 148.0,
            "func_analysis_depth": 1.0,
            "provenance_id_length": 20.0,
            "string_length_stddev": 4.98,
            "largest_section_ratio": 0.39
          }
        },
        "ss": [
          [
            7296,
            "PSQRWVATAUAVAWH"
          ],
          [
            12478,
            "8.8.8.8"
          ],
          [
            12487,
            ".shstrtab"
          ],
          [
            12497,
            ".note.gnu.build-id"
          ],
          [
            12516,
            ".text"
          ],
          [
            12522,
            ".data"
          ]
        ],
        "sz": 12848,
        "ts": [
          {
            "c": 1.0,
            "d": "Binary is not digitally signed",
            "i": "metadata/unsigned",
            "l": 2
          },
          {
            "a": "T1055",
            "c": 0.25,
            "d": "Repeated 0x07 code constant (possible PROT_RWX)",
            "e": [
              "07 00 00 00"
            ],
            "i": "micro-behaviors/mem/protect/modify::rwx-prot-bytes",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Toolchain banner stripped, build-id retained",
            "e": [
              "[.comment, .note.GNU-stack, .note.gnu.property, .note.ABI-tag, .symtab, .strtab]"
            ],
            "i": "metadata/build/artifact::aggressive-strip",
            "l": 3
          },
          {
            "c": 1.0,
            "d": "File is a compiled binary",
            "e": [
              "2a7e13e904f8de0f4eebe3d364f7f1fdd09aa72b2c95db20393cfbb0eb77341d.elf"
            ],
            "i": "metadata/binary/framework::is-binary",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Binary has low average complexity",
            "e": [
              "binary.avg_complexity = 7.00"
            ],
            "i": "metadata/binary/metrics/threshold::avg-complexity-15-max",
            "l": 2
          },
          {
            "c": 0.8999999761581421,
            "d": "ELF imports zero needed libraries",
            "e": [
              "binary.dependency_count = 0.00"
            ],
            "i": "metadata/binary/linking/static::elf-needed-libs-zero",
            "l": 2
          },
          {
            "c": 0.6000000238418579,
            "d": "Small ELF binary (\u003c 50KB)",
            "e": [
              "2a7e13e904f8de0f4eebe3d364f7f1fdd09aa72b2c95db20393cfbb0eb77341d.elf"
            ],
            "i": "metadata/binary/metrics/structural::small-elf-binary",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "Binary format is identified",
            "e": [
              "elf.class_bits = 64.00"
            ],
            "i": "metadata/binary/layout::binary-format-checked",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "Sparse visible string surface",
            "e": [
              "binary.string_count = 6.00"
            ],
            "i": "objectives/anti-static/obfuscation/control-flow/native::sparse-strings",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.699999988079071,
            "d": "ELF built without stack canary",
            "e": [
              "elf.stack_canary = 0.00"
            ],
            "i": "metadata/binary/anomaly/provenance::no-stack-canary",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Binary has low average string entropy",
            "e": [
              "binary.avg_string_entropy = 2.35"
            ],
            "i": "metadata/binary/metrics/threshold::avg-string-entropy-4-max",
            "l": 2
          },
          {
            "c": 0.8999999761581421,
            "d": "Binary has low overall entropy",
            "e": [
              "binary.overall_entropy = 4.87"
            ],
            "i": "metadata/binary/metrics/threshold::low-overall-entropy-binary",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "ELF GNU build-id metadata",
            "e": [
              "d12750eea31ff4ca83ab12d2e8d54e33338ffe85"
            ],
            "i": "metadata/build/reproducible::elf-build-id",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "Binary is not position-independent (fixed load address)",
            "e": [
              "binary.is_pie = 0.00"
            ],
            "i": "metadata/hardening/layout::no-pie",
            "l": 2
          },
          {
            "c": 0.699999988079071,
            "d": "ELF symbol tables stripped from binary",
            "e": [
              "elf.stripped_metadata_section_count = 6.00"
            ],
            "i": "metadata/binary/anomaly/provenance::stripped-symbol-tables",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Binary has 3+ functions",
            "e": [
              "binary.func_count = 13.00"
            ],
            "i": "metadata/binary/metrics/threshold::few-functions-3",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "ELF64 class marker",
            "e": [
              "elf.class_bits = 64.00"
            ],
            "i": "metadata/binary/metrics/structural::elf64-class",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "ELF .note.GNU-stack section absent",
            "e": [
              "elf.gnu_stack_section_absent = 1.00"
            ],
            "i": "metadata/binary/anomaly/format::elf-gnu-stack-section-absent",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "Binary has 4 or fewer sections",
            "e": [
              "binary.section_count = 4.00"
            ],
            "i": "objectives/command-and-control/infrastructure/config::max-sections-4",
            "l": 1
          },
          {
            "c": 0.6000000238418579,
            "d": "Binary not position-independent (no ASLR)",
            "e": [
              "elf.e_type = 2.00"
            ],
            "i": "metadata/hardening/mitigation::no-pie-struct",
            "l": 3
          },
          {
            "c": 0.8999999761581421,
            "d": "NX/DEP disabled (stack is executable)",
            "e": [
              "elf.nx_enabled = 0.00"
            ],
            "i": "metadata/hardening/mitigation::nx-disabled",
            "l": 3
          },
          {
            "a": "T1027",
            "c": 0.4000000059604645,
            "d": "Stack string construction pattern (5+",
            "e": [
              "b8 01 b9 00 ba 01 bb 00 bc 00",
              "ba 01 bb 00 bc 00 bd 00 be 00",
              "bc 00 bd 00 be 00 bf 00 c0 00",
              "bb 00 bc 00 bd 00 be 00 bf 00",
              "b9 00 ba 01 bb 00 bc 00 bd 00",
              "b7 05 b8 01 b9 00 ba 01 bb 00"
            ],
            "i": "objectives/anti-static/obfuscation/control-flow/logic::stack-string-construction",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "No RELRO (GOT writable after load)",
            "e": [
              "elf.relro = 0.00"
            ],
            "i": "metadata/hardening/mitigation::no-relro",
            "l": 3
          },
          {
            "c": 0.8999999761581421,
            "d": "Tiny C string section ratio",
            "e": [
              " = 0.0% of total (0 / 12848 bytes)"
            ],
            "i": "metadata/binary/section/metrics::tiny-cstring-section",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "No stack canary (stack smashing protection absent)",
            "e": [
              "elf.stack_canary = 0.00"
            ],
            "i": "metadata/hardening/mitigation::no-stack-canary",
            "l": 3
          },
          {
            "c": 0.800000011920929,
            "d": "ELF lacks key security mitigations (no canary + no NX + no RELRO)",
            "e": [
              "elf.relro = 0.00",
              "elf.stack_canary = 0.00",
              "elf.nx_enabled = 0.00"
            ],
            "i": "metadata/hardening/mitigation::no-mitigations",
            "l": 3
          },
          {
            "c": 0.75,
            "d": "ELF lacks dynamic linker sections",
            "e": [
              "elf.class_bits = 64.00"
            ],
            "i": "metadata/hardening/missing::static-linked-heuristic",
            "l": 3
          },
          {
            "c": 0.75,
            "d": "ELF lacks dynamic linker sections",
            "e": [
              "elf.class_bits = 64.00"
            ],
            "i": "metadata/binary/linking/static::static-linked-heuristic",
            "l": 3
          },
          {
            "c": 0.800000011920929,
            "d": "Statically linked binary",
            "e": [
              "binary.dependency_count = 0.00",
              "elf.class_bits = 64.00"
            ],
            "i": "metadata/binary/linking/static::static-linked",
            "l": 3
          }
        ],
        "sha": "2a7e13e904f8de0f4eebe3d364f7f1fdd09aa72b2c95db20393cfbb0eb77341d",
        "path": "2a7e13e904f8de0f4eebe3d364f7f1fdd09aa72b2c95db20393cfbb0eb77341d.elf",
        "type": "elf"
      }
    ],
    "tv": "08128"
  }
}