{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9351849555969238, "class": 0 } ], "prob": 0.93518496, "class": 0, "version": "v16.16", "thresholds": [ 0.9815004, 0.99404883 ], "analyzed_at": "2026-05-02T10:57:08Z" }, "path": "x86__64__lsb__unix-system-v__gcc-4.9.4__O0__no-obf__unstripped__util-linux-2.33__fstrim", "raw": { "v": "4", "fs": [ { "f": "O₃(CDyI)H₄(F₂HfPoDb)Md₂(HeBi₂)", "x": 7, "id": 0, "is": [ "", "getenv", "mnt_fs_get_source", "mnt_fs_streq_srcpath", "free", "strtoimax", "mnt_fs_streq_target", "mnt_unref_table", "errno_location", "strncpy", "mnt_new_table_from_file", "strncmp", "ITM_deregisterTMCloneTable", "exit", "fpending", "warn", "mkdir", "ferror", "strtod", "vsnprintf", "mnt_table_next_fs", "localeconv", "faccessat", "readlink", "fcntl", "write", "getpid", "textdomain", "vasprintf", "mnt_new_iter", "fclose", "bindtextdomain", "strlen", "openat", "getuid", "getopt_long", "errx", "gettext", "strchr", "printf", "warnx", "snprintf", "nanosleep", "strrchr", "mkostemp", "dup", "assert_fail", "mnt_resolve_spec", "fputs", "memset", "geteuid", "fscanf", "ioctl", "fgetc", "close", "rewinddir", "strspn", "closedir", "fputc", "strcspn", "strtok_r", "read", "strndup", "libc_start_main", "memcmp", "fgets", "mnt_fs_get_target", "mnt_table_uniq_fs", "calloc", "strcmp", "readlinkat", "dirfd", "fprintf", "syscall", "gmon_start__", "umask", "strtol", "mnt_fs_get_srcpath", "memcpy", "mnt_get_mountpoint", "xpg_basename", "getgid", "xstat", "readdir", "mnt_init_debug", "tolower", "err", "malloc", "strncasecmp", "mnt_new_cache", "mnt_fs_is_pseudofs", "strsep", "sched_cpufree", "fxstat", "mnt_free_iter", "sscanf", "mnt_unref_cache", "mnt_fs_is_netfs", "getegid", "sched_cpualloc", "gnu_dev_major", "fdopen", "asprintf", "setlocale", "mnt_get_fstab_path", "memmove", "open", "fopen", "Jv_RegisterClasses", "strtoumax", "vfprintf", "fdopendir", "gnu_dev_minor", "strtoul", "cxa_atexit", "exit", "ITM_registerTMCloneTable", "strdup", "gnu_dev_makedev", "strstr", "getdtablesize", "vfscanf", "ctype_b_loc" ], "ms": { "elf": { "e_type": 2.0, "has_got": true, "has_plt": true, "has_note": true, "e_machine": 62.0, "rpath_set": true, "class_bits": 64.0, "note_count": 1.0, "nx_enabled": true, "entry_point": 4205792.0, "needed_libs": 5.0, "rpath_count": 1.0, "dynsym_count": 129.0, "has_eh_frame": true, "symtab_count": 384.0, "dynrela_count": 7.0, "entry_section": ".text", "little_endian": true, "pltreloc_count": 118.0, "has_interpreter": true, "fini_array_count": 1.0, "init_array_count": 1.0, "program_header_count": 8.0, "section_header_count": 31.0, "load_segment_max_p_memsz": 61188.0, "load_segment_max_p_filesz": 61188.0, "section_relocation_group_count": 2.0 }, "binary": { "code_size": 40682.0, "file_size": 80912.0, "entry_point": 4205792.0, "has_overlay": true, "code_entropy": 3.86, "data_entropy": 2.5, "export_count": 260.0, "import_count": 123.0, "overlay_size": 1988.0, "string_count": 577.0, "overlay_ratio": 0.02, "section_count": 30.0, "avg_complexity": 4.02, "function_count": 303.0, "import_density": 3.1, "max_complexity": 66.0, "string_density": 14.52, "aliased_exports": 117.0, "overall_entropy": 2.74, "overlay_entropy": 1.56, "avg_basic_blocks": 6.35, "avg_section_size": 2605.3, "dependency_count": 5.0, "entropy_variance": 1.53, "function_density": 7.63, "avg_function_size": 130.07, "avg_string_length": 16.39, "complexity_per_kb": 0.1, "max_string_length": 74.0, "avg_string_entropy": 3.25, "code_to_data_ratio": 1.09, "data_to_file_ratio": 0.0, "text_to_file_ratio": 0.48, "total_basic_blocks": 1925.0, "string_length_stddev": 8.85, "largest_section_ratio": 0.48, "sentence_string_count": 41.0, "sentence_string_ratio": 0.07, "behavioral_import_ratio": 0.02, "function_analysis_depth": 2.0, "high_complexity_functions": 1.0, "runtime_search_path_count": 1.0, "nonstandard_section_name_count": 1.0 } }, "ss": [ [ 0, "textdomain" ], [ 512, "/lib64/ld-linux-x86-64.so.2" ], [ 4585, "libmount.so.1" ], [ 4599, "mnt_unref_table" ], [ 4615, "_ITM_deregisterTMCloneTable" ], [ 4643, "mnt_table_next_fs" ], [ 4661, "mnt_fs_get_source" ], [ 4679, "mnt_init_debug" ], [ 4694, "mnt_free_iter" ], [ 4708, "mnt_table_uniq_fs" ], [ 4726, "mnt_fs_streq_srcpath" ], [ 4747, "mnt_fs_get_srcpath" ], [ 4766, "mnt_new_iter" ], [ 4779, "mnt_fs_is_pseudofs" ], [ 4798, "mnt_new_table_from_file" ], [ 4822, "mnt_unref_cache" ], [ 4838, "__gmon_start__" ], [ 4853, "mnt_fs_is_netfs" ], [ 4869, "mnt_get_fstab_path" ], [ 4888, "mnt_new_cache" ], [ 4902, "mnt_resolve_spec" ], [ 4919, "mnt_fs_get_target" ], [ 4937, "_Jv_RegisterClasses" ], [ 4957, "mnt_fs_streq_target" ], [ 4977, "mnt_get_mountpoint" ], [ 4996, "_ITM_registerTMCloneTable" ], [ 5022, "libblkid.so.1" ], [ 5036, "libuuid.so.1" ], [ 5049, "librt.so.1" ], [ 5070, "__xpg_basename" ], [ 5085, "vasprintf" ], [ 5095, "gnu_dev_major" ], [ 5109, "readdir" ], [ 5117, "setlocale" ], [ 5127, "fopen" ], [ 5133, "strncmp" ], [ 5141, "optind" ], [ 5148, "strrchr" ], [ 5156, "readlinkat" ], [ 5167, "closedir" ], [ 5176, "nanosleep" ], [ 5186, "strncpy" ], [ 5200, "gettext" ], [ 5208, "vfscanf" ], [ 5222, "__sched_cpualloc" ], [ 5239, "rewinddir" ], [ 5255, "tolower" ], [ 5263, "getpid" ], [ 5277, "strdup" ], [ 5284, "__sched_cpufree" ], [ 5300, "__assert_fail" ], [ 5314, "strtod" ], [ 5321, "strtol" ], [ 5334, "strtoumax" ], [ 5350, "calloc" ], [ 5357, "strlen" ], [ 5364, "memset" ], [ 5371, "localeconv" ], [ 5394, "strcspn" ], [ 5402, "__errno_location" ], [ 5419, "read" ], [ 5424, "memcmp" ], [ 5431, "strndup" ], [ 5439, "vsnprintf" ], [ 5449, "stdout" ], [ 5468, "strtok_r" ], [ 5477, "memcpy" ], [ 5484, "fclose" ], [ 5491, "strtoul" ], [ 5499, "malloc" ], [ 5512, "fdopendir" ], [ 5522, "getgid" ], [ 5529, "__ctype_b_loc" ], [ 5543, "getenv" ], [ 5550, "sscanf" ], [ 5557, "optarg" ], [ 5564, "stderr" ], [ 5571, "ioctl" ], [ 5577, "getuid" ], [ 5584, "readlink" ], [ 5593, "getegid" ], [ 5601, "getopt_long" ], [ 5613, "strncasecmp" ], [ 5625, "gnu_dev_minor" ], [ 5639, "geteuid" ], [ 5647, "__fpending" ], [ 5665, "strtoimax" ], [ 5675, "program_invocation_short_name" ], [ 5705, "fdopen" ], [ 5712, "syscall" ], [ 5726, "openat" ], [ 5733, "getdtablesize" ], [ 5752, "memmove" ], [ 5760, "mkostemp" ], [ 5769, "strsep" ], [ 5776, "bindtextdomain" ], [ 5791, "faccessat" ], [ 5808, "__libc_start_main" ], [ 5832, "ferror" ], [ 5839, "write" ], [ 5845, "vfprintf" ], [ 5854, "gnu_dev_makedev" ], [ 5870, "__progname" ], [ 5881, "__cxa_atexit" ], [ 5894, "__xstat" ], [ 5902, "__fxstat" ], [ 5911, "/tmp/util-linux/_out/lib" ], [ 5936, "MOUNT_2.21" ], [ 5947, "MOUNT_2.25" ], [ 5958, "MOUNT_2.24" ], [ 5969, "MOUNT_2.22" ], [ 5980, "MOUNT_2.19" ], [ 6013, "GLIBC_2.14" ], [ 36203, "AUATSH" ], [ 44587, "APWQL" ], [ 50016, "AWAVA" ], [ 50023, "AUATL" ], [ 50304, "write error" ], [ 50316, "cannot open %s" ], [ 50331, "stat of %s failed" ], [ 50349, "%s: not a directory" ], [ 50376, "%s: 0 B (dry run) trimmed on %s" ], [ 50409, "%s: 0 B (dry run) trimmed" ], [ 50436, "%s: FITRIM ioctl failed" ], [ 50464, "%s: %s (%lu bytes) trimmed on %s" ], [ 50498, "%s: %s (%lu bytes) trimmed" ], [ 50526, "queue/discard_granularity" ], [ 50552, "/proc/self/mountinfo" ], [ 50576, "failed to initialize libmount iterator" ], [ 50615, "failed to parse %s" ], [ 50640, "failed to initialize libmount cache" ], [ 50685, "%s [options] \u003cmount point\u003e" ], [ 50720, "Discard unused blocks on a mounted filesystem." ], [ 50784, "-a, --all trim all supported mounted filesystems" ], [ 50848, "-A, --fstab trim all supported mounted filesystems from /etc/fstab" ], [ 50928, "-o, --offset \u003cnum\u003e the offset in bytes to start discarding from" ], [ 51000, "-l, --length \u003cnum\u003e the number of bytes to discard" ], [ 51056, "-m, --minimum \u003cnum\u003e the minimum extent length to discard" ], [ 51120, "-v, --verbose print number of discarded bytes" ], [ 51176, "-d, --dry-run does everything, but trim" ], [ 51224, "display version" ], [ 51240, "display this help" ], [ 51258, "-V, --version" ], [ 51285, "%-21s%s" ], [ 51302, "For more details see %s." ], [ 51329, "fstrim(8)" ], [ 51344, "/tmp/util-linux/_out/share/locale" ], [ 51378, "util-linux" ], [ 51389, "%s from %s" ], [ 51401, "util-linux 2.33" ], [ 51417, "failed to parse length" ], [ 51440, "failed to parse offset" ], [ 51464, "failed to parse minimum extent length" ], [ 51504, "Try '%s --help' for more information." ], [ 51556, "no mountpoint specified" ], [ 51584, "unexpected number of arguments" ], [ 51616, "%s: the discard operation is not supported" ], [ 52111, "version" ], [ 52119, "offset" ], [ 52126, "length" ], [ 52133, "minimum" ], [ 52141, "verbose" ], [ 52149, "dry-run" ], [ 52489, "BKMGTPE" ], [ 52499, "%d%s%lu%s" ], [ 52515, "lib/strutils.c" ], [ 52532, "suffix" ], [ 52558, "KMGTPEZY" ], [ 52567, "kmgtpezy" ], [ 52576, "strnappend" ], [ 52655, "ULPATH_DEBUG" ], [ 52668, "ulpath" ], [ 52680, "%d: %s: don't print memory addresses (SUID executable)." ], [ 52741, "%d: %s: %8s:" ], [ 52755, "alloc" ], [ 52761, "dealloc" ], [ 52769, "lib/path.c" ], [ 52780, "pc-\u003edir_fd \u003c 0" ], [ 52795, "new prefix: '%s'" ], [ 52812, "new dir: '%s'" ], [ 52826, "(re)set dialect" ], [ 52851, "pc-\u003edir_path" ], [ 52864, "opening dir: '%s'" ], [ 52883, "%s/%s/%s" ], [ 52892, "access: '%s'" ], [ 52905, "opening '%s'" ], [ 52918, "[redirected]" ], [ 52932, "opening '%s'%s" ], [ 52947, "duplicate dir path" ], [ 52966, "reading '%s'" ], [ 52983, "fscanf [%s] '%s'" ], [ 53040, "ul_path_set_prefix" ], [ 53072, "ul_path_get_dirfd" ], [ 53151, "ULSYSFS_DEBUG" ], [ 53165, "ulsysfs" ], [ 53257, "/sys/dev/block/%d:%d" ], [ 53278, "alloc new sysfs handler" ], [ 53302, "init sysfs stuff" ], [ 53319, "deinit" ], [ 53326, "new parent" ], [ 53337, "queue/" ], [ 53344, "%s redirected to parent" ], [ 53373, "%s/start" ], [ 53382, "%s/partition" ], [ 53395, "%s/dev" ], [ 53402, "partno (%d) -\u003e devno (%d)" ], [ 53428, "slaves" ], [ 53435, "/subsystem" ], [ 53446, "/sys/dev/block/" ], [ 53462, "removable" ], [ 53472, "partition" ], [ 53482, "dm/uuid" ], [ 53502, "stratis-1-private" ], [ 53520, "device" ], [ 53527, "%u:%u:%u:%u" ], [ 53540, "/sys/class" ], [ 53551, "%s%s/%s_host/host%d/%s" ], [ 53574, "%s%s/%s_host/host%d" ], [ 53607, "/sys/bus/scsi" ], [ 53621, "%s%s/devices/%d:%d:%d:%d/%s" ], [ 53649, "%s%s/devices/%d:%d:%d:%d" ], [ 53680, "lib/sysfs.c" ], [ 53692, "name" ], [ 53707, "%s/sys/block/%s/%s/dev" ], [ 53730, "%s/sys/block/%s/dev" ], [ 53750, "%s/sys/block/%s/device/dev" ], [ 53781, "ieee1394" ], [ 53790, "pcmcia" ], [ 53808, "__sysfs_devname_to_devno" ], [ 53833, "TMPDIR" ], [ 53846, "%s/%s.XXXXXX" ], [ 63080, "GCC: (GNU) 4.9.4" ], [ 72321, "crtstuff.c" ], [ 72332, "__JCR_LIST__" ], [ 72345, "deregister_tm_clones" ], [ 72366, "__do_global_dtors_aux" ], [ 72388, "completed.6672" ], [ 72403, "__do_global_dtors_aux_fini_array_entry" ], [ 72442, "frame_dummy" ], [ 72454, "__frame_dummy_init_array_entry" ], [ 72485, "fstrim.c" ], [ 72494, "close_stream" ], [ 72507, "close_stdout" ], [ 72520, "fstrim_filesystem" ], [ 72538, "has_discard" ], [ 72550, "uniq_fs_target_cmp" ], [ 72569, "uniq_fs_source_cmp" ], [ 72588, "fstrim_all" ], [ 72605, "longopts.6652" ], [ 72619, "strutils.c" ], [ 72630, "STRTOXX_EXIT_CODE" ], [ 72648, "do_scale_by_power" ], [ 72666, "suf.5454" ], [ 72675, "suf2.5455" ], [ 72685, "_strtou16_or_err" ], [ 72702, "_strtou32_or_err" ] ], "sz": 80912, "ts": [ { "c": 1.0, "d": "ELF program interpreter present", "e": [ "/lib64/ld-linux-x86-64.so.2" ], "i": "metadata/binary/linking::elf-interpreter", "l": 2 }, { "c": 1.0, "d": "ELF needed library", "e": [ "libmount.so.1", "libblkid.so.1", "libuuid.so.1", "librt.so.1", "libc.so.6" ], "i": "metadata/binary/linking::elf-needed-lib", "l": 2 }, { "c": 1.0, "d": "ELF RPATH entry", "e": [ "/tmp/util-linux/_out/lib" ], "i": "metadata/binary/linking::elf-rpath", "l": 2 }, { "c": 1.0, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "l": 2 }, { "c": 0.800000011920929, "d": "Invokes mkdir", "e": [ "mkdir" ], "i": "micro-behaviors/process/create/tool::mkdir-invocation", "l": 3 }, { "c": 0.6600000262260437, "d": "Open files", "e": [ "openat" ], "i": "micro-behaviors/fs/file/open::openat", "l": 2 }, { "d": "Get effective group ID", "e": [ "getegid" ], "i": "micro-behaviors/os/privilege/query::getegid", "l": 2 }, { "c": 1.0, "d": "Binary has 100+ exports", "e": [ "binary.export_count = 260.00" ], "i": "metadata/binary/metrics::many-exports-100", "l": 1 }, { "a": "T1486", "c": 0.75, "d": "flock LOCK_EX call bytecode pattern", "e": [ "be 3e f4 ff ff", "be 0e 70 ff ff" ], "i": "objectives/impact/ransom/esxi::flock-lockex", "l": 1, "m": "C0027" }, { "c": 1.0, "d": "Binary has 9+ exports", "e": [ "binary.export_count = 260.00" ], "i": "metadata/binary/metrics::many-exports-9", "l": 1 }, { "c": 0.6600000262260437, "d": "Write single bytes to file", "e": [ "fputc" ], "i": "micro-behaviors/fs/file/write::fputc", "l": 2 }, { "c": 0.4000000059604645, "d": "Set file creation mask (umask)", "e": [ "umask" ], "i": "micro-behaviors/fs/chmod/modify::umask", "l": 2 }, { "c": 1.0, "d": "/tmp/ path component", "e": [ "/tmp/util-linux/_out/lib", "/tmp/util-linux/_out/share/locale" ], "i": "micro-behaviors/fs/path/temp::tmp-path-content", "l": 2 }, { "c": 0.699999988079071, "d": "Version information string", "e": [ "--version" ], "i": "metadata/package/help::version-text", "l": 2 }, { "c": 0.699999988079071, "d": "Unix /tmp/ path reference", "e": [ "/tmp/util-linux/_out/lib", "/tmp/util-linux/_out/share/locale" ], "i": "micro-behaviors/fs/path/temp::unix-temp", "l": 2 }, { "c": 0.6600000262260437, "d": "Uses rewinddir", "e": [ "rewinddir" ], "i": "micro-behaviors/fs/directory/readdir::readdir-rewinddir", "l": 2 }, { "c": 0.6600000262260437, "d": "Open files", "e": [ "open" ], "i": "micro-behaviors/fs/file/open::open-base", "l": 2 }, { "c": 0.8999999761581421, "d": "ELF interpreter section name", "e": [ ".interp" ], "i": "metadata/binary/linking::elf-interpreter-section-name", "l": 2 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.function_count = 303.00" ], "i": "metadata/binary/metrics::few-functions-3", "l": 1 }, { "c": 0.6600000262260437, "d": "Create directories", "e": [ "mkdir" ], "i": "micro-behaviors/fs/directory/mkdir::mkdir-base", "l": 2 }, { "c": 0.6600000262260437, "d": "Reference to /lib64", "e": [ "/lib64/ld-linux-x86-64.so.2" ], "i": "micro-behaviors/fs/path/system::system-lib64", "l": 2 }, { "c": 0.6600000262260437, "d": "Check if file exists", "e": [ "faccessat" ], "i": "micro-behaviors/fs/file/stat::stat-exists", "l": 2 }, { "c": 0.4000000059604645, "d": "Terminate process immediately without cleanup", "e": [ "exit", "exit" ], "i": "micro-behaviors/process/terminate/signal::_exit", "l": 2 }, { "a": "T1083", "c": 0.4000000059604645, "d": "File descriptor manipulation and control", "e": [ "fcntl" ], "i": "micro-behaviors/fs/file/operations::fcntl", "l": 2, "m": "E1083" }, { "d": "Characteristic system library exports", "e": [ "libc_start_main" ], "i": "micro-behaviors/dylib/library/libc::libc-characteristic-symbols", "l": 2 }, { "c": 0.30000001192092896, "d": "Get process ID", "e": [ "getpid" ], "i": "micro-behaviors/process/identity/query::getpid", "l": 2 }, { "a": "T1059.006", "c": 0.6000000238418579, "d": "Named /tmp execution path", "e": [ "/tmp/util", "/tmp/util" ], "i": "objectives/command-and-control/dropper::tmp-path", "l": 1, "m": "B0024" }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "binary.file_size = 80912.00" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.75, "d": "String to long integer conversion (strtol)", "e": [ "strtol" ], "i": "micro-behaviors/data/string/conversion::strtol", "l": 1 }, { "d": "Get effective user ID", "e": [ "geteuid" ], "i": "micro-behaviors/os/privilege/query::geteuid", "l": 2 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 4.02" ], "i": "metadata/binary/metrics::avg-complexity-15-max", "l": 2 }, { "c": 1.0, "d": "Binary has 20+ sections (installer/packer)", "e": [ "binary.section_count = 30.00" ], "i": "metadata/binary/metrics::many-sections-20", "l": 1 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 123.00" ], "i": "metadata/binary/metrics::many-imports-50", "l": 1 }, { "c": 1.0, "d": "Binary has 100+ imports", "e": [ "binary.import_count = 123.00" ], "i": "metadata/binary/metrics::many-imports-100", "l": 1 }, { "c": 0.6600000262260437, "d": "Look up file permissions", "e": [ "stat", "fstat" ], "i": "micro-behaviors/fs/chmod/get::get-dup", "l": 2 }, { "d": "Characteristic system library export __errno_location", "e": [ "errno_location" ], "i": "micro-behaviors/dylib/library/libc::libc-characteristic-errno", "l": 2 }, { "c": 0.6600000262260437, "d": "Uses readdir", "e": [ "readdir" ], "i": "micro-behaviors/fs/directory/readdir::readdir-readdir", "l": 2 }, { "c": 0.800000011920929, "d": "Binary has many exports (\u003e10)", "e": [ "binary.export_count = 260.00" ], "i": "metadata/binary/metrics::many-exports", "l": 2 }, { "c": 0.8999999761581421, "d": "CLI help or usage text", "e": [ "Try '%s --help' for more information." ], "i": "metadata/binary/metrics::help-usage-string", "l": 2 }, { "c": 1.0, "d": "Binary format is identified", "e": [ "elf.class_bits = 64.00" ], "i": "metadata/binary::binary-format-checked", "l": 2 }, { "c": 0.30000001192092896, "d": "Sleep for nanosecond duration", "e": [ "nanosleep" ], "i": "micro-behaviors/time/query::nanosleep-func", "l": 2 }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening::no-pie", "l": 2 }, { "d": ".so extension reference", "e": [ ".so", ".so", ".so", ".so", ".so" ], "i": "micro-behaviors/fs/path/extension::so", "l": 2 }, { "d": "Characteristic system library export __cxa_atexit", "e": [ "cxa_atexit" ], "i": "micro-behaviors/dylib/library/libc::libc-characteristic-cxa-atexit", "l": 2 }, { "c": 0.8999999761581421, "d": "ELF dynsym section name", "e": [ ".dynsym" ], "i": "metadata/binary/linking::elf-dynsym-section-name", "l": 2 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.25" ], "i": "metadata/binary/metrics::avg-string-entropy-4-max", "l": 2 }, { "c": 0.6000000238418579, "d": "/etc/fstab mount table file", "e": [ "-A, --fstab trim all supported mounted filesystems from /etc/fstab" ], "i": "micro-behaviors/fs/volume/fstab::etc-fstab", "l": 2 }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.function_count = 303.00" ], "i": "metadata/binary/metrics::many-functions", "l": 2 }, { "c": 0.6600000262260437, "d": "Open files", "e": [ "fopen" ], "i": "micro-behaviors/fs/file/open::fopen", "l": 2 }, { "c": 0.6600000262260437, "d": "Uses closedir", "e": [ "closedir" ], "i": "micro-behaviors/fs/directory/readdir::readdir-closedir", "l": 2 }, { "c": 1.0, "d": "Binary has 20+ exports", "e": [ "binary.export_count = 260.00" ], "i": "metadata/binary/metrics::many-exports-20", "l": 1 }, { "d": "Binary exports symbols", "e": [ "binary.export_count = 260.00" ], "i": "metadata/binary/symbols::has-exports", "l": 1 }, { "d": "Characteristic system library export __assert_fail", "e": [ "assert_fail" ], "i": "micro-behaviors/dylib/library/libc::libc-characteristic-assert-fail", "l": 2 }, { "c": 0.6600000262260437, "d": "Uses fdopendir", "e": [ "fdopendir" ], "i": "micro-behaviors/fs/directory/readdir::readdir-fdopendir", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.function_count = 303.00" ], "i": "metadata/binary/metrics::many-functions-50", "l": 1 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 123.00" ], "i": "metadata/binary/metrics::many-imports-30", "l": 1 }, { "c": 0.699999988079071, "d": "RPATH/RUNPATH set (library injection vector)", "e": [ "elf.rpath_set = 1.00" ], "i": "metadata/hardening::rpath-set", "l": 3 }, { "c": 0.800000011920929, "d": "libc version string pattern", "e": [ "GLIBC", "GLIBC", "GLIBC", "GLIBC", "GLIBC", "GLIBC", "GLIBC", "GLIBC", "GLIBC", "GLIBC", "GLIBC", "GLIBC", "GLIBC", "GLIBC", "GLIBC", "GLIBC" ], "i": "micro-behaviors/dylib/library/libc::libc-version-string", "l": 2 }, { "c": 0.8399999737739563, "d": "High basic block count in sparse binary", "e": [ "binary.total_basic_blocks = 1925.00" ], "i": "metadata/binary/metrics::dense-basic-blocks", "l": 1 }, { "c": 1.0, "d": "Binary has 200+ exports (large library)", "e": [ "binary.export_count = 260.00" ], "i": "metadata/binary/metrics::many-exports-200", "l": 1 }, { "c": 0.800000011920929, "d": "Read symbolic link target path", "e": [ "readlinkat" ], "i": "micro-behaviors/fs/link/symlink::readlinkat", "l": 2 }, { "c": 0.6600000262260437, "d": "Reference to /etc configuration files", "e": [ "-A, --fstab trim all supported mounted filesystems from /etc/fstab" ], "i": "micro-behaviors/fs/path/config::config-etc", "l": 2 }, { "d": "TMPDIR environment variable", "e": [ "TMPDIR" ], "i": "micro-behaviors/os/env/vars::tmpdir-var", "l": 2 }, { "c": 0.8999999761581421, "d": "ELF dynstr section name", "e": [ ".dynstr" ], "i": "metadata/binary/linking::elf-dynstr-section-name", "l": 2 }, { "c": 0.699999988079071, "d": "Read file descriptor (read/pread)", "e": [ "read" ], "i": "micro-behaviors/fs/file/read::read", "l": 2 }, { "c": 1.0, "d": "Line-based file reading (fgets)", "e": [ "fgets" ], "i": "micro-behaviors/process/create/direct::fgets-loop", "l": 2 }, { "c": 1.0, "d": "ELF64 class marker", "e": [ "elf.class_bits = 64.00" ], "i": "metadata/binary/metrics::elf64-class", "l": 1 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 123.00" ], "i": "metadata/binary/metrics::many-imports-25", "l": 1 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 123.00" ], "i": "metadata/binary/metrics::many-imports-40", "l": 1 }, { "d": "Get user ID", "e": [ "getuid" ], "i": "micro-behaviors/os/privilege/query::getuid", "l": 2 }, { "d": "Get group ID", "e": [ "getgid" ], "i": "micro-behaviors/os/privilege/query::getgid", "l": 2 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 2.74" ], "i": "metadata/binary/metrics::low-overall-entropy-binary", "l": 1 }, { "c": 0.8999999761581421, "d": "ELF dynamic section name", "e": [ ".dynamic" ], "i": "metadata/binary/linking::elf-dynamic-section-name", "l": 2 }, { "a": "T1082", "d": "/sys/block/ path", "e": [ "%s/sys/block/%s/%s/dev", "%s/sys/block/%s/device/dev", "%s/sys/block/%s/dev" ], "i": "micro-behaviors/fs/disk/paths::sys-block", "l": 2, "m": "E1082" }, { "c": 0.800000011920929, "d": "Read symbolic link target path", "e": [ "readlink" ], "i": "micro-behaviors/fs/link/symlink::readlink", "l": 2 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 123.00" ], "i": "metadata/binary/metrics::many-imports-20", "l": 1 }, { "d": "Duplicate file descriptor", "e": [ "dup" ], "i": "micro-behaviors/process/fd/dup::dup", "l": 2 }, { "c": 0.699999988079071, "d": "Formatted input from file", "e": [ "fscanf", "vfscanf" ], "i": "micro-behaviors/fs/file/read::fscanf", "l": 2 }, { "a": "T1082", "c": 0.75, "d": "Access block device info via", "e": [ "/sys/dev/block/", "/sys/dev/block/%d:%d" ], "i": "micro-behaviors/hardware/block/device::sys-block-dup", "l": 3 }, { "c": 0.6600000262260437, "d": "Write files", "e": [ "write" ], "i": "micro-behaviors/fs/file/write::write", "l": 2 }, { "c": 0.800000011920929, "d": "High number of imported symbols (\u003e80)", "e": [ "binary.import_count = 123.00" ], "i": "metadata/binary/metrics::many-imports", "l": 2 }, { "c": 0.8999999761581421, "d": "No stack canary (stack smashing protection absent)", "e": [ "elf.stack_canary = 0.00" ], "i": "metadata/hardening::no-stack-canary", "l": 2 }, { "c": 0.30000001192092896, "d": "getenv function (read environment variable)", "e": [ "getenv", "sym.imp.getenv" ], "i": "micro-behaviors/os/env/vars::getenv", "l": 2 }, { "c": 0.6600000262260437, "d": "Read mount info from /proc/self/mountinfo", "e": [ "/proc/self/mountinfo" ], "i": "micro-behaviors/fs/proc/mounts::mounts-mountinfo", "l": 3 }, { "c": 0.8999999761581421, "d": "ELF interpreter section name", "e": [ ".interp" ], "i": "metadata/hardening::elf-interpreter-section-name", "l": 2 }, { "c": 1.0, "d": "ELF RPATH metadata", "e": [ "/tmp/util-linux/_out/lib" ], "i": "metadata/binary/linking/runtime::elf-rpath", "l": 2 }, { "c": 0.800000011920929, "d": "Read file status and metadata (core)", "e": [ "stat", "fstat" ], "i": "micro-behaviors/fs/file/stat::stat-core", "l": 3 }, { "c": 0.8999999761581421, "d": "No RELRO (GOT writable after load)", "e": [ "elf.relro = 0.00" ], "i": "metadata/hardening::no-relro", "l": 2 }, { "c": 1.0, "d": "ELF needed library metadata", "e": [ "libmount.so.1", "libblkid.so.1", "libuuid.so.1", "librt.so.1", "libc.so.6" ], "i": "metadata/binary/linking/runtime::needed-lib", "l": 2 }, { "c": 0.6000000238418579, "d": "Binary not position-independent (no ASLR)", "e": [ "elf.e_type = 2.00" ], "i": "metadata/hardening::no-pie-struct", "l": 3 }, { "c": 0.699999988079071, "d": "High function count over 200", "e": [ "binary.function_count = 303.00" ], "i": "metadata/binary/metrics::high-function-count-200", "l": 2 }, { "c": 0.8999999761581421, "d": "ELF dynsym section name", "e": [ ".dynsym" ], "i": "metadata/hardening::elf-dynsym-section-name", "l": 2 }, { "c": 0.8999999761581421, "d": "ELF dynstr section name", "e": [ ".dynstr" ], "i": "metadata/hardening::elf-dynstr-section-name", "l": 2 }, { "c": 0.8999999761581421, "d": "ELF dynamic section name", "e": [ ".dynamic" ], "i": "metadata/hardening::elf-dynamic-section-name", "l": 2 }, { "c": 1.0, "d": "ELF program interpreter metadata", "e": [ "/lib64/ld-linux-x86-64.so.2" ], "i": "metadata/binary/linking/runtime::interpreter", "l": 2 }, { "a": "T1083", "c": 0.6600000262260437, "d": "Read temp directory from TMPDIR", "e": [ "sym.imp.getenv", "getenv", "TMPDIR" ], "i": "micro-behaviors/fs/temp/directory::directory-env", "l": 2, "m": "E1083" }, { "c": 0.6600000262260437, "d": "Reference to /tmp", "e": [ "/tmp/util-linux/_out/share/locale", "/tmp/util-linux/_out/lib", "/tmp/util-linux/_out/share/locale", "/tmp/util-linux/_out/lib" ], "i": "micro-behaviors/fs/path/temp::temp-tmp", "l": 2 }, { "a": "T1069", "c": 0.699999988079071, "d": "User/group ID gathering", "e": [ "getgid", "geteuid", "getegid" ], "i": "objectives/discovery/host/permissions::uid-gid-gathering", "l": 1 } ], "sha": "2be458a226b341a57b0402e2eedad3b994c02139f2750f4c0b395f784bb04af1", "path": "/data/samples/good/datasets/Labeled-Elfs/benignware/x86__64__lsb__unix-system-v__gcc-4.9.4__O0__no-obf__unstripped__util-linux-2.33__fstrim", "type": "elf" } ], "tv": "7e897" } }