{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 0.995867908000946,
        "class": 1
      }
    ],
    "prob": 0.9958679,
    "class": 1,
    "oprob": 0.8751796,
    "models": [
      {
        "m": "az",
        "prob": 0.8751796,
        "class": 0
      },
      {
        "m": "az/native",
        "prob": 0.7976363,
        "class": 0
      },
      {
        "m": "az/elf",
        "prob": 0.8649016,
        "class": 0
      }
    ],
    "oclass": 0,
    "version": "v16.16",
    "thresholds": [
      0.9958679,
      0.99937946
    ],
    "analyzed_at": "2026-05-05T12:05:10Z"
  },
  "path": "4cfff3ea8fbaa2939088a0d1aa99d4e75f3edb1b44e5be6dd2e8d49fd423820c",
  "raw": {
    "v": "4",
    "fs": [
      {
        "f": "O₂(As₂C)Md₃(Bi₄BkHe)",
        "k": {
          "build.target_arch": "x86_64",
          "elf.stripped_metadata_sections[0]": ".comment",
          "elf.stripped_metadata_sections[1]": ".symtab",
          "elf.stripped_metadata_sections[2]": ".strtab"
        },
        "x": 71,
        "id": 0,
        "ms": {
          "elf": {
            "stripped_metadata_section_count": 3.0
          },
          "file": {
            "size": 2240.0
          },
          "binary": {
            "overall_entropy": 1.7,
            "func_analysis_depth": 1.0,
            "has_malformed_structure": true
          }
        },
        "sz": 2240,
        "ts": [
          {
            "a": "T1027",
            "c": 1.0,
            "d": "Malformed ELF header or section headers: bad offset 55208",
            "i": "anti-analysis/malformed/elf-header",
            "l": 4,
            "m": "B0001"
          },
          {
            "c": 1.0,
            "d": "Binary is not digitally signed",
            "i": "metadata/unsigned",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "Binary has 4 or fewer sections",
            "e": [
              "binary.section_count = 0.00"
            ],
            "i": "objectives/command-and-control/infrastructure/config::max-sections-4",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Binary is not position-independent (fixed load address)",
            "e": [
              "binary.is_pie = 0.00"
            ],
            "i": "metadata/hardening::no-pie",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "Binary has low average complexity",
            "e": [
              "binary.avg_complexity = 0.00"
            ],
            "i": "metadata/binary/metrics::avg-complexity-15-max",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "Binary has low average string entropy",
            "e": [
              "binary.avg_string_entropy = 0.00"
            ],
            "i": "metadata/binary/metrics::avg-string-entropy-4-max",
            "l": 2
          },
          {
            "c": 0.699999988079071,
            "d": "Binary with almost no readable strings",
            "e": [
              "binary.string_count = 0.00"
            ],
            "i": "metadata/binary/metrics::near-zero-strings",
            "l": 4
          },
          {
            "c": 1.0,
            "d": "Sparse visible string surface",
            "e": [
              "binary.string_count = 0.00"
            ],
            "i": "objectives/anti-static/obfuscation/control-flow/native::sparse-strings",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.8999999761581421,
            "d": "Binary has low overall entropy",
            "e": [
              "binary.overall_entropy = 1.70"
            ],
            "i": "metadata/binary/metrics::low-overall-entropy-binary",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "ELF imports zero needed libraries",
            "e": [
              "binary.dependency_count = 0.00"
            ],
            "i": "metadata/binary/linking::elf-needed-libs-zero",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "File is a compiled binary",
            "e": [
              "4cfff3ea8fbaa2939088a0d1aa99d4e75f3edb1b44e5be6dd2e8d49fd423820c"
            ],
            "i": "metadata/binary/framework::is-binary",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Toolchain banner stripped, build-id retained",
            "e": [
              "[.comment, .symtab, .strtab]"
            ],
            "i": "metadata/build::aggressive-strip",
            "l": 3
          },
          {
            "d": "Few detected functions (stub-like or analysis-limited)",
            "e": [
              "binary.func_count = 0.00"
            ],
            "i": "metadata/binary/metrics::no-functions",
            "l": 3
          },
          {
            "a": "T1027",
            "c": 0.699999988079071,
            "d": "Zero recovered functions",
            "e": [
              "binary.func_count = 0.00"
            ],
            "i": "objectives/anti-static/obfuscation/payload/encrypted::zero-function-count",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.6000000238418579,
            "d": "Small ELF binary (\u003c 50KB)",
            "e": [
              "4cfff3ea8fbaa2939088a0d1aa99d4e75f3edb1b44e5be6dd2e8d49fd423820c"
            ],
            "i": "metadata/binary/metrics::small-elf-binary",
            "l": 2
          },
          {
            "c": 0.949999988079071,
            "d": "ELF binary without section headers",
            "e": [
              "binary.section_count = 0.00"
            ],
            "i": "metadata/binary/anomaly::elf-no-section-headers",
            "l": 3
          },
          {
            "c": 0.6000000238418579,
            "d": "Binary not position-independent (no ASLR)",
            "e": [
              "elf.e_type = 0.00"
            ],
            "i": "metadata/hardening::no-pie-struct",
            "l": 3
          },
          {
            "c": 0.8999999761581421,
            "d": "Tiny C string section ratio",
            "e": [
              " = 0.0% of total (0 / 2240 bytes)"
            ],
            "i": "metadata/binary/section/metrics::tiny-cstring-section",
            "l": 1
          },
          {
            "c": 0.6000000238418579,
            "d": "Very few sections (merged/stripped)",
            "e": [
              "binary.section_count = 0.00"
            ],
            "i": "metadata/binary/metrics::few-sections",
            "l": 3
          }
        ],
        "sha": "4cfff3ea8fbaa2939088a0d1aa99d4e75f3edb1b44e5be6dd2e8d49fd423820c",
        "path": "4cfff3ea8fbaa2939088a0d1aa99d4e75f3edb1b44e5be6dd2e8d49fd423820c",
        "type": "elf"
      }
    ],
    "tv": "27ac5"
  }
}