{
  "ml": {
    "v": "5",
    "fs": [
      {
        "id": 0,
        "prob": 0.9990379810333252,
        "class": 2,
        "threshold": 0.9932810664176941
      }
    ],
    "prob": 0.999038,
    "class": 2,
    "level": 3,
    "models": [
      {
        "m": "az",
        "prob": 0.99716914,
        "class": 2
      },
      {
        "m": "az/native",
        "prob": 0.999038,
        "class": 2
      },
      {
        "m": "az/elf",
        "prob": 1.0,
        "class": 2
      }
    ],
    "version": "v17.17",
    "threshold": 0.99328107,
    "analyzed_at": "2026-05-31T09:12:08Z"
  },
  "path": "43c68eec3009399112556b62efc64a704adfd67bbe99802aebaff7fa577ffaf5.elf",
  "raw": {
    "v": "5",
    "fs": [
      {
        "f": "Md₃(BiBkHe₂)",
        "x": 125,
        "ff": {
          "m": {
            "elf": {
              "bits": 32.0,
              "entry": 51176.0,
              "has_got": 0.0,
              "has_plt": 0.0,
              "has_note": 0.0,
              "note_count": 0.0,
              "nx_enabled": 0.0,
              "dynrel_count": 0.0,
              "dynsym_count": 0.0,
              "has_eh_frame": 0.0,
              "symtab_count": 0.0,
              "dynrela_count": 0.0,
              "little_endian": 1.0,
              "pltreloc_count": 0.0,
              "executable_stack": 1.0,
              "wx_segment_count": 0.0,
              "program_header_count": 3.0,
              "gnu_stack_section_absent": 0.0,
              "load_segment_max_file_size": 22935.0,
              "stripped_but_symtab_present": 0.0,
              "load_segment_max_memory_size": 22935.0,
              "section_relocation_group_count": 0.0,
              "stripped_metadata_section_count": 8.0
            },
            "file": {
              "size": 23180.0,
              "entropy": 7.92,
              "size_bytes": 23180.0
            },
            "binary": {
              "is_pie": 0.0,
              "is_stripped": 1.0,
              "avg_complexity": 22.33,
              "max_complexity": 61.0,
              "huge_func_count": 1.0,
              "leaf_func_count": 2.0,
              "tiny_func_count": 0.0,
              "avg_basic_blocks": 37.0,
              "total_basic_blocks": 111.0
            },
            "functions": {
              "count": 3.0
            },
            "dependencies": {
              "count": 0.0
            }
          },
          "s": [
            [
              908,
              "u8",
              "/Nnvu"
            ],
            [
              1677,
              "u8",
              "FGRPx"
            ],
            [
              3512,
              "u8",
              "mBhu"
            ],
            [
              4461,
              "u8",
              "8QSQyO"
            ],
            [
              4765,
              "u8",
              "8W2Z"
            ],
            [
              5458,
              "u8",
              "w6PWi"
            ],
            [
              8182,
              "u8",
              "JWzb1"
            ],
            [
              9292,
              "u8",
              "ofW3n"
            ],
            [
              11162,
              "u8",
              "Mhze"
            ],
            [
              11337,
              "u8",
              ".fst"
            ],
            [
              11365,
              "u8",
              "1tAMA"
            ],
            [
              11888,
              "u8",
              "Nrdz"
            ],
            [
              11953,
              "u8",
              "hD[]"
            ],
            [
              13608,
              "u8",
              "bqR4X"
            ],
            [
              14527,
              "u8",
              "iezs"
            ],
            [
              15049,
              "u8",
              "U6CPpAd"
            ],
            [
              17504,
              "u8",
              "dIax"
            ],
            [
              18109,
              "u8",
              "WL0G"
            ],
            [
              21176,
              "u8",
              "PROT_EXEC|PROT_WRITE failed."
            ],
            [
              21208,
              "u8",
              "$Info: This file is packed with the UPX executable packer http://upx.sf.net $"
            ],
            [
              21287,
              "u8",
              "$Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $"
            ],
            [
              22922,
              "u8",
              "961K"
            ]
          ],
          "v": {
            "elf.type": "executable",
            "elf.class": "elf32",
            "elf.entry": 51176,
            "file.stem": "43c68eec3009399112556b62efc64a704adfd67bbe99802aebaff7fa577ffaf5",
            "elf.endian": "little",
            "elf.machine": "arm",
            "elf.version": 1,
            "binary.packer": "upx",
            "file.basename": "43c68eec3009399112556b62efc64a704adfd67bbe99802aebaff7fa577ffaf5.elf",
            "elf.e_flags[0]": "soft_float",
            "elf.e_flags_raw": 514,
            "elf.segments[0].type": "load",
            "elf.segments[1].type": "load",
            "elf.segments[2].type": "gnu_stack",
            "binary.packer_version": "3.94",
            "elf.segments[0].perms": "r-x",
            "elf.segments[0].vaddr": 32768,
            "elf.segments[1].perms": "rw-",
            "elf.segments[1].vaddr": 128320,
            "elf.segments[2].perms": "rwx",
            "elf.segments[0].file_size": 22935,
            "elf.segments[0].flags_hex": "5",
            "elf.segments[1].flags_hex": "6",
            "elf.segments[2].flags_hex": "7",
            "elf.segments[0].memory_size": 22935,
            "elf.segments[1].file_offset": 30016,
            "binary.top_complex_unnamed[0].cc": 61,
            "binary.top_complex_unnamed[1].cc": 2,
            "elf.stripped_metadata_sections[0]": ".symtab",
            "elf.stripped_metadata_sections[1]": ".strtab",
            "elf.stripped_metadata_sections[2]": ".comment",
            "elf.stripped_metadata_sections[3]": ".debug_info",
            "elf.stripped_metadata_sections[4]": ".debug_line",
            "elf.stripped_metadata_sections[5]": ".debug_str",
            "elf.stripped_metadata_sections[6]": ".debug_abbrev",
            "elf.stripped_metadata_sections[7]": ".note.gnu.gold-version",
            "binary.top_complex_unnamed[0].addr": "0xc968",
            "binary.top_complex_unnamed[1].addr": "0xc704"
          },
          "id": "elf"
        },
        "id": 0,
        "sz": 23180,
        "ts": [
          {
            "c": 1.0,
            "d": "Binary is not digitally signed",
            "i": "metadata/unsigned",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "Binary contains a UPX packing marker",
            "i": "anti-static/packer/upx",
            "l": 4
          },
          {
            "c": 1.0,
            "d": "UPX decompression failed: IO error: No such file or directory (os error 2)",
            "i": "anti-static/packer/upx/decompression-failed",
            "l": 5
          },
          {
            "c": 1.0,
            "d": "File is a compiled binary",
            "e": [
              "43c68eec3009399112556b62efc64a704adfd67bbe99802aebaff7fa577ffaf5.elf"
            ],
            "i": "metadata/binary/framework::is-binary",
            "l": 1
          },
          {
            "c": 0.6000000238418579,
            "d": "Copyright notice",
            "e": [
              "Copyright"
            ],
            "i": "metadata/package/license::copyright-word",
            "l": 2,
            "el": [
              "0x5327"
            ]
          },
          {
            "c": 0.4000000059604645,
            "d": "Very few leaf functions (deep)",
            "e": [
              "binary.leaf_func_count = 2.00"
            ],
            "i": "metadata/binary/metrics/structural::few-leaf-functions",
            "l": 3
          },
          {
            "c": 0.8500000238418579,
            "d": "ELF PT_GNU_STACK has executable bit set",
            "e": [
              "elf.executable_stack = 1.00"
            ],
            "i": "metadata/binary/anomaly/format::elf-executable-stack",
            "l": 3
          },
          {
            "c": 1.0,
            "d": "Binary is not position-independent (fixed load address)",
            "e": [
              "binary.is_pie = 0.00"
            ],
            "i": "metadata/hardening/layout::no-pie",
            "l": 2
          },
          {
            "c": 0.949999988079071,
            "d": "UPX magic bytes in ELF",
            "e": [
              "UPX!"
            ],
            "i": "objectives/anti-static/pack/detect::upx-magic-raw",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "ELF symbol tables stripped from binary",
            "e": [
              "elf.stripped_metadata_section_count = 8.00"
            ],
            "i": "metadata/binary/anomaly/provenance::stripped-symbol-tables",
            "l": 1
          },
          {
            "c": 0.6000000238418579,
            "d": "PROT_EXEC memory protection constant",
            "e": [
              "PROT_EXEC|PROT_WRITE failed."
            ],
            "i": "micro-behaviors/mem/alloc/executable::prot-exec-const",
            "l": 2,
            "el": [
              "0x52b8"
            ]
          },
          {
            "c": 0.6000000238418579,
            "d": "Small ELF binary (\u003c 50KB)",
            "e": [
              "43c68eec3009399112556b62efc64a704adfd67bbe99802aebaff7fa577ffaf5.elf"
            ],
            "i": "metadata/binary/metrics/structural::small-elf-binary",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "UPX executable packer signature string",
            "e": [
              "$Info: This file is packed with the UPX executable packer http://upx.sf.net $"
            ],
            "i": "objectives/anti-static/pack/detect::upx-packer-string",
            "l": 1,
            "el": [
              "0x52d8"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "ELF imports zero needed libraries",
            "e": [
              "dependencies.count = 0.00"
            ],
            "i": "metadata/binary/linking/static::elf-needed-libs-zero",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "Binary symbol table is stripped",
            "e": [
              "binary.is_stripped = 1.00"
            ],
            "i": "metadata/hardening/layout::stripped",
            "l": 2
          },
          {
            "c": 0.6000000238418579,
            "d": "PROT_WRITE memory protection constant",
            "e": [
              "PROT_WRITE"
            ],
            "i": "objectives/anti-analysis/self-modify/runtime::prot-write",
            "l": 2,
            "el": [
              "0x52b8"
            ]
          },
          {
            "c": 1.0,
            "d": "Toolchain banner stripped, build-id retained",
            "e": [
              "[.symtab, .strtab, .comment, .debug_info, .debug_line, .debug_str, .debug_abbrev, .note.gnu.gold-version]"
            ],
            "i": "metadata/build/artifact::aggressive-strip",
            "l": 3,
            "el": [
              "value:elf.stripped_metadata_sections"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "Tiny C string section ratio",
            "e": [
              " = 0.0% of total (0 / 23180 bytes)"
            ],
            "i": "metadata/binary/section/metrics::tiny-cstring-section",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "No full symbol table (likely stripped)",
            "e": [
              "binary.is_stripped = 1.00"
            ],
            "i": "metadata/hardening/missing::stripped-binary",
            "l": 3
          },
          {
            "c": 0.8999999761581421,
            "d": "NX/DEP disabled (stack is executable)",
            "e": [
              "elf.nx_enabled = 0.00"
            ],
            "i": "metadata/hardening/mitigation::nx-disabled",
            "l": 3
          }
        ],
        "sha": "43c68eec3009399112556b62efc64a704adfd67bbe99802aebaff7fa577ffaf5",
        "path": "43c68eec3009399112556b62efc64a704adfd67bbe99802aebaff7fa577ffaf5.elf",
        "type": "elf"
      }
    ],
    "tv": "52045"
  }
}