{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9115004539489746, "class": 0 } ], "prob": 0.91150045, "class": 0, "version": "v16.16", "thresholds": [ 0.9815004, 0.99404883 ], "analyzed_at": "2026-05-02T05:16:37Z" }, "path": "x86__64__lsb__unix-system-v__gcc-7.1.0__O3__no-obf__unstripped__coreutils-8.30__dd", "raw": { "v": "4", "fs": [ { "f": "O₂(CI)H₂(FDb₂)Md₂(HeBi₂)", "x": 4, "id": 0, "is": [ "", "ctype_toupper_loc", "getenv", "sigprocmask", "snprintf_chk", "raise", "free", "abort", "errno_location", "fdatasync", "error_at_line", "strncmp", "exit", "fpending", "sigaction", "localeconv", "fcntl", "clock_gettime", "write", "textdomain", "fclose", "bindtextdomain", "dcgettext", "ctype_get_mb_cur_max", "strlen", "getopt_long", "mbrtowc", "dup2", "strchr", "overflow", "strrchr", "ftruncate", "lseek", "gettimeofday", "assert_fail", "strtoul_internal", "memset", "ioctl", "close", "posix_fadvise", "read", "libc_start_main", "memcmp", "fputs_unlocked", "calloc", "memcpy_chk", "sigemptyset", "gmon_start__", "memcpy", "fileno", "malloc", "fflush", "nl_langinfo", "vasprintf_chk", "fxstat", "freading", "realloc", "setlocale", "printf_chk", "memmove", "error", "fsync", "open", "fseeko", "dcngettext", "cxa_atexit", "getpagesize", "sigismember", "exit", "fwrite", "fprintf_chk", "mbsinit", "iswprint", "sigaddset", "ctype_tolower_loc", "ctype_b_loc", "sprintf_chk" ], "ms": { "elf": { "e_type": 2.0, "has_got": true, "has_plt": true, "has_note": true, "e_machine": 62.0, "class_bits": 64.0, "note_count": 1.0, "nx_enabled": true, "entry_point": 4209584.0, "needed_libs": 1.0, "dynsym_count": 85.0, "has_eh_frame": true, "symtab_count": 361.0, "dynrela_count": 7.0, "entry_section": ".text", "little_endian": true, "pltreloc_count": 75.0, "has_interpreter": true, "fini_array_count": 1.0, "init_array_count": 1.0, "program_header_count": 8.0, "section_header_count": 29.0, "load_segment_max_p_memsz": 75988.0, "load_segment_max_p_filesz": 75988.0, "section_relocation_group_count": 2.0 }, "binary": { "code_size": 48372.0, "file_size": 95080.0, "entry_point": 4209584.0, "has_overlay": true, "code_entropy": 4.01, "data_entropy": 3.33, "export_count": 164.0, "import_count": 77.0, "overlay_size": 1858.0, "string_count": 671.0, "overlay_ratio": 0.02, "section_count": 28.0, "avg_complexity": 8.54, "function_count": 194.0, "import_density": 1.63, "max_complexity": 399.0, "string_density": 14.2, "aliased_exports": 74.0, "overall_entropy": 2.9, "overlay_entropy": 1.56, "avg_basic_blocks": 10.95, "avg_section_size": 3285.21, "dependency_count": 1.0, "entropy_variance": 1.56, "function_density": 4.11, "avg_function_size": 241.82, "avg_string_length": 21.93, "complexity_per_kb": 0.18, "max_string_length": 667.0, "avg_string_entropy": 3.2, "code_to_data_ratio": 1.11, "data_to_file_ratio": 0.0, "text_to_file_ratio": 0.5, "total_basic_blocks": 2125.0, "high_entropy_strings": 1.0, "string_length_stddev": 42.44, "largest_section_ratio": 0.5, "sentence_string_count": 134.0, "sentence_string_ratio": 0.2, "behavioral_import_ratio": 0.01, "function_analysis_depth": 2.0, "high_complexity_functions": 4.0 } }, "ss": [ [ 0, "textdomain" ], [ 512, "/lib64/ld-linux-x86-64.so.2" ], [ 3243, "fflush" ], [ 3250, "__printf_chk" ], [ 3263, "setlocale" ], [ 3273, "mbrtowc" ], [ 3281, "strncmp" ], [ 3289, "ftruncate" ], [ 3299, "dcngettext" ], [ 3310, "optind" ], [ 3317, "strrchr" ], [ 3325, "dcgettext" ], [ 3335, "error" ], [ 3341, "sigprocmask" ], [ 3353, "iswprint" ], [ 3362, "realloc" ], [ 3376, "abort" ], [ 3388, "program_invocation_name" ], [ 3412, "__assert_fail" ], [ 3426, "error_at_line" ], [ 3440, "__ctype_get_mb_cur_max" ], [ 3463, "posix_fadvise" ], [ 3477, "fdatasync" ], [ 3487, "calloc" ], [ 3494, "strlen" ], [ 3501, "sigemptyset" ], [ 3513, "memset" ], [ 3520, "localeconv" ], [ 3531, "__errno_location" ], [ 3548, "read" ], [ 3553, "memcmp" ], [ 3560, "getpagesize" ], [ 3577, "__fprintf_chk" ], [ 3591, "sigaddset" ], [ 3601, "stdout" ], [ 3608, "lseek" ], [ 3614, "memcpy" ], [ 3621, "fclose" ], [ 3628, "malloc" ], [ 3635, "raise" ], [ 3641, "mbsinit" ], [ 3649, "nl_langinfo" ], [ 3661, "__ctype_b_loc" ], [ 3675, "getenv" ], [ 3682, "__freading" ], [ 3693, "stderr" ], [ 3700, "ioctl" ], [ 3706, "__snprintf_chk" ], [ 3721, "getopt_long" ], [ 3733, "__fxstat" ], [ 3742, "fileno" ], [ 3749, "fwrite" ], [ 3756, "gettimeofday" ], [ 3769, "sigaction" ], [ 3779, "__memcpy_chk" ], [ 3792, "sigismember" ], [ 3804, "clock_gettime" ], [ 3818, "__fpending" ], [ 3829, "open" ], [ 3841, "program_invocation_short_name" ], [ 3871, "__ctype_toupper_loc" ], [ 3891, "__ctype_tolower_loc" ], [ 3911, "__vasprintf_chk" ], [ 3933, "__sprintf_chk" ], [ 3947, "memmove" ], [ 3955, "bindtextdomain" ], [ 3970, "opterr" ], [ 3977, "__libc_start_main" ], [ 3995, "fseeko" ], [ 4002, "__overflow" ], [ 4013, "__strtoul_internal" ], [ 4032, "fputs_unlocked" ], [ 4047, "free" ], [ 4052, "__progname" ], [ 4063, "__progname_full" ], [ 4079, "__cxa_atexit" ], [ 4092, "__gmon_start__" ], [ 4117, "GLIBC_2.14" ], [ 4128, "GLIBC_2.17" ], [ 7776, "AWAVAUATUS" ], [ 15536, "AVAUATUH" ], [ 16656, "ATUI" ], [ 16928, "AUATUS" ], [ 17168, "AVAU1" ], [ 17174, "ATUA" ], [ 17376, "AWAVAUATUSH" ], [ 17792, "AUATUSH" ], [ 20640, "AWAVI" ], [ 20647, "AUATA" ], [ 21795, "tYAUATA" ], [ 21968, "AUATI" ], [ 22494, "ATUS" ], [ 22937, "AVAUATE1" ], [ 23456, "ATUH" ], [ 23776, "AUAT1" ], [ 23984, "AWAV" ], [ 23990, "AUAT" ], [ 24566, "XZM9" ], [ 25568, "D$(M)" ], [ 25919, "D$(I)" ], [ 28384, "AVAUATUSH" ], [ 33888, "ATUSH" ], [ 34848, "AWAVAUATI" ], [ 35059, "hh9a" ], [ 44736, "AVAUA" ], [ 44928, "AWAVAUATM" ], [ 45199, "AQAUATAWAVL" ], [ 45715, "ATAWAVL" ], [ 45829, "AUATAWAVL" ], [ 46232, "ARAVAUSAWL" ], [ 46772, "AUSAWL" ], [ 46886, "AVAUSAWL" ], [ 47368, "/v5I" ], [ 47827, "AUATH" ], [ 47834, "UAWH" ], [ 47949, "ATUM" ], [ 47955, "AWAVL" ], [ 48077, "UAWAV" ], [ 48130, "AWAVH" ], [ 49789, "UAWAVH" ], [ 49898, "UAWAVL" ], [ 50352, "TUUUUUUUH" ], [ 50654, "SUUUUUUUH9" ], [ 54384, "AVAUATUSL" ], [ 54640, "AWAVA" ], [ 54647, "AUATL" ], [ 54864, "Infinity" ], [ 54880, "%lu bytes copied, %s, %s" ], [ 54905, "%lu byte copied, %s, %s" ], [ 54929, "%lu bytes (%s) copied, %s, %s" ], [ 54963, "bcEGkKMPTwYZ0" ], [ 54981, "setting flags for %s" ], [ 55002, "%lu truncated records" ], [ 55025, "%lu truncated record" ], [ 55047, "closing input file %s" ], [ 55072, "sha2 utilities" ], [ 55087, "USR1" ], [ 55094, "test invocation" ], [ 55110, "Multi-call invocation" ], [ 55132, "sha224sum" ], [ 55142, "sha256sum" ], [ 55152, "sha384sum" ], [ 55162, "sha512sum" ], [ 55172, "%s online help: \u003c%s\u003e" ], [ 55195, "GNU coreutils" ], [ 55220, "closing output file %s" ], [ 55243, "cannot fstat %s" ], [ 55259, "%s: cannot skip" ], [ 55275, "%s: cannot seek" ], [ 55291, "error reading %s" ], [ 55308, "writing to %s" ], [ 55333, "iflag" ], [ 55345, "status" ], [ 55364, "count" ], [ 55370, "count_bytes" ], [ 55382, "skip_bytes" ], [ 55393, "POSIXLY_CORRECT" ], [ 55409, "Stuart Kemp" ], [ 55421, "David MacKenzie" ], [ 55437, "Paul Rubin" ], [ 55448, "unrecognized operand %s" ], [ 55472, "invalid conversion" ], [ 55491, "invalid input flag" ], [ 55510, "invalid output flag" ], [ 55530, "invalid status level" ], [ 55551, "fullblock" ], [ 55561, "seek_bytes" ], [ 55572, "standard input" ], [ 55587, "failed to open %s" ], [ 55605, "standard output" ], [ 55621, "error writing %s" ], [ 55638, "fdatasync failed for %s" ], [ 55662, "fsync failed for %s" ], [ 55682, "invalid number" ], [ 55704, "%lu bytes (%s, %s) copied, %s, %s" ], [ 55744, "warning: %s is a zero multiplier; use %s if that is intended" ], [ 55808, "warning: working around lseek kernel bug for file (%s)\n of mt_type=0x%0lx -- see \u003csys/mtio.h\u003e for the list of types" ], [ 55863, "of mt_type=0x%0lx -- see \u003csys/mtio.h\u003e for the list of types" ], [ 55928, "%lu+%lu records in" ], [ 55947, "%lu+%lu records out" ], [ 55968, "memory exhausted by input buffer of size %lu bytes (%s)" ], [ 56024, "memory exhausted by output buffer of size %lu bytes (%s)" ], [ 56088, "Try '%s --help' for more information." ], [ 56128, "Usage: %s [OPERAND]...\n or: %s OPTION" ], [ 56151, "or: %s OPTION" ], [ 56176, "Copy a file, converting and formatting according to the operands.\n\n bs=BYTES read and write up to BYTES bytes at a time " ], [ 56243, "bs=BYTES read and write up to BYTES bytes at a time (default: 512);" ], [ 56320, "overrides ibs and obs" ], [ 56360, "cbs=BYTES convert BYTES bytes at a time" ], [ 56408, "conv=CONVS convert the file as per the comma separated symbol list" ], [ 56482, "count=N copy only N input blocks" ], [ 56525, "ibs=BYTES read up to BYTES bytes at a time (default: 512)" ], [ 56592, "if=FILE read from FILE instead of stdin\n iflag=FLAGS read as per the comma separated symbol list\n obs=BYTES " ], [ 56642, "iflag=FLAGS read as per the comma separated symbol list" ], [ 56704, "obs=BYTES write BYTES bytes at a time (default: 512)" ], [ 56765, "of=FILE write to FILE instead of stdout" ], [ 56815, "oflag=FLAGS write as per the comma separated symbol list" ], [ 56878, "seek=N skip N obs-sized blocks at start of output" ], [ 56939, "skip=N skip N ibs-sized blocks at start of input" ], [ 56999, "status=LEVEL The LEVEL of information to print to stderr;" ], [ 57062, "'none' suppresses everything but error messages," ], [ 57129, "'noxfer' suppresses the final transfer statistics," ], [ 57198, "'progress' shows periodic transfer statistics" ], [ 57264, "N and BYTES may be followed by the following multiplicative suffixes:\nc =1, w =2, b =512, kB =1000, K =1024, MB =1000*1000, M =1" ], [ 57265, "N and BYTES may be followed by the following multiplicative suffixes:" ], [ 57410, "GB =1000*1000*1000, G =1024*1024*1024, and so on for T, P, E, Z, Y." ], [ 57479, "Each CONV symbol may be:" ], [ 57512, "ascii from EBCDIC to ASCII\n ebcdic from ASCII to EBCDIC\n ibm from ASCII to alternate EBCDIC\n block pad newli" ], [ 57545, "ebcdic from ASCII to EBCDIC" ], [ 57578, "ibm from ASCII to alternate EBCDIC" ], [ 57621, "block pad newline-terminated records with spaces to cbs-size" ], [ 57688, "unblock replace trailing spaces in cbs-size records with newline" ], [ 57757, "lcase change upper case to lower case" ], [ 57801, "ucase change lower case to upper case" ], [ 57845, "sparse try to seek rather than write the output for NUL input blocks" ], [ 57919, "swab swap every pair of input bytes" ], [ 57962, "sync pad every input block with NULs to ibs-size; when used" ], [ 58029, "with block or unblock, pad with spaces rather than NULs" ], [ 58104, "excl fail if the output file already exists\n nocreat do not create the output file\n notrunc do not truncate the outpu" ], [ 58155, "nocreat do not create the output file" ], [ 58197, "notrunc do not truncate the output file" ], [ 58241, "noerror continue after read errors" ], [ 58280, "fdatasync physically write output file data before finishing" ], [ 58344, "fsync likewise, but also write metadata" ], [ 58392, "Each FLAG symbol may be:\n\n append append mode (makes sense only for output; conv=notrunc suggested)" ], [ 58393, "Each FLAG symbol may be:" ], [ 58419, "append append mode (makes sense only for output; conv=notrunc suggested)" ], [ 58504, "direct use direct I/O for data" ], [ 58544, "directory fail unless a directory" ], [ 58584, "dsync use synchronized I/O for data" ], [ 58632, "sync likewise, but also for metadata" ], [ 58680, "fullblock accumulate full blocks of input (iflag only)" ], [ 58744, "nonblock use non-blocking I/O" ], [ 58784, "noatime do not update access time" ], [ 58824, "nocache Request to drop cache. See also oflag=sync" ], [ 58888, "noctty do not assign controlling terminal from file" ], [ 58952, "nofollow do not follow symlinks" ], [ 58992, "count_bytes treat 'count=N' as a byte count (iflag only)" ], [ 59056, "skip_bytes treat 'skip=N' as a byte count (iflag only)" ], [ 59120, "seek_bytes treat 'seek=N' as a byte count (oflag only)" ], [ 59184, "Sending a %s signal to a running 'dd' process makes it\nprint I/O statistics to standard error and then resume copying.\n\nOptions " ], [ 59185, "Sending a %s signal to a running 'dd' process makes it" ], [ 59240, "print I/O statistics to standard error and then resume copying." ], [ 59305, "Options are:" ], [ 59320, "--help display this help and exit" ], [ 59368, "--version output version information and exit" ], [ 59424, "https://www.gnu.org/software/coreutils/" ], [ 59464, "Report %s translation bugs to \u003chttps://translationproject.org/team/\u003e" ], [ 59536, "Full documentation at: \u003c%s%s\u003e" ], [ 59568, "or available locally via: info '(coreutils) %s%s'" ], [ 59624, "warning: partial read (%lu bytes); suggest iflag=fullblock" ], [ 59688, "warning: partial read (%lu byte); suggest iflag=fullblock" ], [ 59752, "failed to turn off O_DIRECT: %s" ], [ 59784, "/tmp/coreutils/_out/share/locale" ], [ 59824, "cannot combine any two of {ascii,ebcdic,ibm}" ], [ 59872, "cannot combine block and unblock" ] ], "sz": 95080, "ts": [ { "c": 1.0, "d": "ELF program interpreter present", "e": [ "/lib64/ld-linux-x86-64.so.2" ], "i": "metadata/binary/linking::elf-interpreter", "l": 2 }, { "c": 1.0, "d": "ELF needed library", "e": [ "libc.so.6" ], "i": "metadata/binary/linking::elf-needed-lib", "l": 2 }, { "c": 1.0, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "l": 2 }, { "c": 1.0, "d": "Binary format is identified", "e": [ "elf.class_bits = 64.00" ], "i": "metadata/binary::binary-format-checked", "l": 2 }, { "c": 0.4000000059604645, "d": "Terminate process immediately without cleanup", "e": [ "exit", "exit" ], "i": "micro-behaviors/process/terminate/signal::_exit", "l": 2 }, { "c": 1.0, "d": "Binary has 9+ exports", "e": [ "binary.export_count = 164.00" ], "i": "metadata/binary/metrics::many-exports-9", "l": 1 }, { "d": "Characteristic system library exports", "e": [ "libc_start_main" ], "i": "micro-behaviors/dylib/library/libc::libc-characteristic-symbols", "l": 2 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 77.00" ], "i": "metadata/binary/metrics::many-imports-40", "l": 1 }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2 }, { "a": "T1124", "c": 0.30000001192092896, "d": "Get time from specified clock", "e": [ "clock_gettime" ], "i": "micro-behaviors/time/query::clock_gettime", "l": 2, "m": "T1124" }, { "c": 1.0, "d": "/tmp/ path component", "e": [ "/tmp/coreutils/_out/share/locale" ], "i": "micro-behaviors/fs/path/temp::tmp-path-content", "l": 2 }, { "c": 0.8999999761581421, "d": "ELF dynstr section name", "e": [ ".dynstr" ], "i": "metadata/binary/linking::elf-dynstr-section-name", "l": 2 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.function_count = 194.00" ], "i": "metadata/binary/metrics::few-functions-3", "l": 1 }, { "d": "Characteristic system library export __cxa_atexit", "e": [ "cxa_atexit" ], "i": "micro-behaviors/dylib/library/libc::libc-characteristic-cxa-atexit", "l": 2 }, { "c": 0.8999999761581421, "d": "ELF interpreter section name", "e": [ ".interp" ], "i": "metadata/binary/linking::elf-interpreter-section-name", "l": 2 }, { "c": 0.699999988079071, "d": "Unix /tmp/ path reference", "e": [ "/tmp/coreutils/_out/share/locale" ], "i": "micro-behaviors/fs/path/temp::unix-temp", "l": 2 }, { "a": "T1124", "c": 0.30000001192092896, "d": "Get current time with microsecond precision", "e": [ "gettimeofday" ], "i": "micro-behaviors/time/query::gettimeofday", "l": 2, "m": "T1124" }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.function_count = 194.00" ], "i": "metadata/binary/metrics::many-functions-50", "l": 1 }, { "c": 0.8999999761581421, "d": "ELF dynsym section name", "e": [ ".dynsym" ], "i": "metadata/binary/linking::elf-dynsym-section-name", "l": 2 }, { "d": "overflow keyword", "e": [ "offset overflow while reading file %s", "__overflow@@GLIBC_2.2.5", "__overflow", "overflow", "overflow@@GLIBC_2.2.5", "input_offset_overflow" ], "i": "micro-behaviors/data/text/keywords::overflow", "l": 1 }, { "c": 0.699999988079071, "d": "GPL license reference", "e": [ "GPL", "GPL" ], "i": "metadata/package/license::gpl-word", "l": 2 }, { "a": "T1083", "c": 0.4000000059604645, "d": "File descriptor manipulation and control", "e": [ "fcntl" ], "i": "micro-behaviors/fs/file/operations::fcntl", "l": 2, "m": "E1083" }, { "d": "Truncate file", "e": [ "ftruncate" ], "i": "micro-behaviors/fs/file/truncate::truncate", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 77.00" ], "i": "metadata/binary/metrics::many-imports-50", "l": 1 }, { "c": 0.30000001192092896, "d": "GNU coreutils reference", "e": [ "GNU coreutils" ], "i": "micro-behaviors/dylib/library::gnu-coreutils-ref", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "binary.file_size = 95080.00" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.6000000238418579, "d": "Examine or change blocked signals", "e": [ "sigprocmask" ], "i": "micro-behaviors/process/terminate/signal::sigprocmask", "l": 2 }, { "d": "Duplicate file descriptor (I/O redirection)", "e": [ "dup2" ], "i": "micro-behaviors/process/fd/dup::dup2", "l": 2 }, { "d": ".so extension reference", "e": [ ".so" ], "i": "micro-behaviors/fs/path/extension::so", "l": 2 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.20" ], "i": "metadata/binary/metrics::avg-string-entropy-4-max", "l": 2 }, { "d": "Characteristic system library export __assert_fail", "e": [ "assert_fail" ], "i": "micro-behaviors/dylib/library/libc::libc-characteristic-assert-fail", "l": 2 }, { "d": "Usage: label in binary strings", "e": [ "Usage: %s [OPERAND]...\n or: %s OPTION" ], "i": "metadata/package/help::usage-title-string", "l": 1 }, { "c": 1.0, "d": "ELF64 class marker", "e": [ "elf.class_bits = 64.00" ], "i": "metadata/binary/metrics::elf64-class", "l": 1 }, { "a": "T1027", "d": "Unusual character combinations", "e": [ "!\"#$%\u0026'()*+" ], "i": "micro-behaviors/data/encode/xor::unusual-character-combinations", "l": 1 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 8.54" ], "i": "metadata/binary/metrics::avg-complexity-15-max", "l": 2 }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening::no-pie", "l": 2 }, { "c": 0.8500000238418579, "d": "Send signal to self", "e": [ "raise" ], "i": "micro-behaviors/os/signal/handler::raise", "l": 2 }, { "c": 0.8999999761581421, "d": "Abort program execution", "e": [ "abort" ], "i": "micro-behaviors/os/signal/handler::abort", "l": 2 }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.function_count = 194.00" ], "i": "metadata/binary/metrics::many-functions", "l": 2 }, { "a": "T1486", "c": 0.75, "d": "flock LOCK_EX call bytecode pattern", "e": [ "bf 79 fb ff ff", "be 02 ff ff ff", "be ed fd ff ff", "bf 58 ca ff ff", "b9 b7 f1 ff ff", "bd fe ff ff 66", "be 09 4c ff ff" ], "i": "objectives/impact/ransom/esxi::flock-lockex", "l": 1, "m": "C0027" }, { "c": 0.8999999761581421, "d": "CLI help or usage text", "e": [ "Try '%s --help' for more information." ], "i": "metadata/binary/metrics::help-usage-string", "l": 2 }, { "c": 0.699999988079071, "d": "Read file descriptor (read/pread)", "e": [ "read" ], "i": "micro-behaviors/fs/file/read::read", "l": 2 }, { "c": 0.6600000262260437, "d": "Open files", "e": [ "open" ], "i": "micro-behaviors/fs/file/open::open-base", "l": 2 }, { "c": 0.8999999761581421, "d": "Install signal handler (POSIX sigaction)", "e": [ "sigaction" ], "i": "micro-behaviors/os/signal/handler::sigaction", "l": 2 }, { "c": 1.0, "d": "Binary has 100+ exports", "e": [ "binary.export_count = 164.00" ], "i": "metadata/binary/metrics::many-exports-100", "l": 1 }, { "a": "T1055", "c": 0.25, "d": "Repeated 0x07 code constant (possible PROT_RWX)", "e": [ "07 00 00 00", "07 00 00 00", "07 00 00 00", "07 00 00 00", "07 00 00 00", "07 00 00 00" ], "i": "micro-behaviors/mem/protect/modify::rwx-prot-bytes", "l": 1 }, { "c": 1.0, "d": "Binary has 20+ exports", "e": [ "binary.export_count = 164.00" ], "i": "metadata/binary/metrics::many-exports-20", "l": 1 }, { "a": "T1059.006", "c": 0.6000000238418579, "d": "Named /tmp execution path", "e": [ "/tmp/coreutils" ], "i": "objectives/command-and-control/dropper::tmp-path", "l": 1, "m": "B0024" }, { "c": 0.6600000262260437, "d": "Reference to /lib64", "e": [ "/lib64/ld-linux-x86-64.so.2" ], "i": "micro-behaviors/fs/path/system::system-lib64", "l": 2 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 2.90" ], "i": "metadata/binary/metrics::low-overall-entropy-binary", "l": 1 }, { "d": "Characteristic system library export __errno_location", "e": [ "errno_location" ], "i": "micro-behaviors/dylib/library/libc::libc-characteristic-errno", "l": 2 }, { "a": "T1005", "c": 0.4000000059604645, "d": "Seeks to position in file", "e": [ "fseeko", "fseeko@@GLIBC_2.2.5", "rpl_fseeko", "sym.imp.fseeko", "sym.rpl_fseeko" ], "i": "micro-behaviors/fs/file/binary::fseek-func", "l": 2 }, { "c": 0.8399999737739563, "d": "High basic block count in sparse binary", "e": [ "binary.total_basic_blocks = 2125.00" ], "i": "metadata/binary/metrics::dense-basic-blocks", "l": 1 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 77.00" ], "i": "metadata/binary/metrics::many-imports-25", "l": 1 }, { "c": 0.8500000238418579, "d": "FORTIFY_SOURCE memcpy bounds check", "e": [ "memcpy_chk", "memcpy_chk@@GLIBC_2.3.4", "sym.imp.__memcpy_chk" ], "i": "metadata/hardening::memcpy-chk", "l": 2 }, { "c": 0.699999988079071, "d": "Version information string", "e": [ "--version" ], "i": "metadata/package/help::version-text", "l": 2 }, { "c": 1.0, "d": "Binary has 20+ sections (installer/packer)", "e": [ "binary.section_count = 28.00" ], "i": "metadata/binary/metrics::many-sections-20", "l": 1 }, { "c": 0.6600000262260437, "d": "Write files", "e": [ "write", "fwrite" ], "i": "micro-behaviors/fs/file/write::write", "l": 2 }, { "c": 0.800000011920929, "d": "libc version string pattern", "e": [ "GLIBC", "GLIBC", "GLIBC", "GLIBC", "GLIBC", "GLIBC", "GLIBC", "GLIBC", "GLIBC", "GLIBC", "GLIBC", "GLIBC", "GLIBC", "GLIBC", "GLIBC", "GLIBC" ], "i": "micro-behaviors/dylib/library/libc::libc-version-string", "l": 2 }, { "c": 0.20000000298023224, "d": "output keyword", "e": [ "fdatasync physically write output file data before finishing", "notrunc do not truncate the output file", "seek=N skip N obs-sized blocks at start of output", "sparse try to seek rather than write the output for NUL input blocks", "…e (makes sense only for output; conv=notrunc suggested…", "…c do not truncate the output file\n noerror contin…", "standard output", "excl fail if the output file already exists\n n…", "…k rather than write the output for NUL input blocks\n …", "memory exhausted by output buffer of size %lu bytes (%s)", "…eat do not create the output file\n notrunc do not…", "invalid output flag", "closing output file %s", "…ized blocks at start of output\n skip=N skip …", "…async physically write output file data before finish…", "nocreat do not create the output file" ], "i": "micro-behaviors/data/text/keywords::output", "l": 1 }, { "d": "Binary exports symbols", "e": [ "binary.export_count = 164.00" ], "i": "metadata/binary/symbols::has-exports", "l": 1 }, { "c": 0.8999999761581421, "d": "ELF dynamic section name", "e": [ ".dynamic" ], "i": "metadata/binary/linking::elf-dynamic-section-name", "l": 2 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 77.00" ], "i": "metadata/binary/metrics::many-imports-20", "l": 1 }, { "c": 0.800000011920929, "d": "Binary has many exports (\u003e10)", "e": [ "binary.export_count = 164.00" ], "i": "metadata/binary/metrics::many-exports", "l": 2 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 77.00" ], "i": "metadata/binary/metrics::many-imports-30", "l": 1 }, { "c": 1.0, "d": "ELF program interpreter metadata", "e": [ "/lib64/ld-linux-x86-64.so.2" ], "i": "metadata/binary/linking/runtime::interpreter", "l": 2 }, { "c": 0.8999999761581421, "d": "ELF dynamic section name", "e": [ ".dynamic" ], "i": "metadata/hardening::elf-dynamic-section-name", "l": 2 }, { "c": 0.30000001192092896, "d": "getenv function (read environment variable)", "e": [ "getenv", "sym.imp.getenv" ], "i": "micro-behaviors/os/env/vars::getenv", "l": 2 }, { "c": 0.8999999761581421, "d": "No RELRO (GOT writable after load)", "e": [ "elf.relro = 0.00" ], "i": "metadata/hardening::no-relro", "l": 2 }, { "c": 0.8999999761581421, "d": "ELF dynstr section name", "e": [ ".dynstr" ], "i": "metadata/hardening::elf-dynstr-section-name", "l": 2 }, { "c": 0.6000000238418579, "d": "Binary not position-independent (no ASLR)", "e": [ "elf.e_type = 2.00" ], "i": "metadata/hardening::no-pie-struct", "l": 3 }, { "c": 0.8999999761581421, "d": "ELF interpreter section name", "e": [ ".interp" ], "i": "metadata/hardening::elf-interpreter-section-name", "l": 2 }, { "c": 0.8999999761581421, "d": "No stack canary (stack smashing protection absent)", "e": [ "elf.stack_canary = 0.00" ], "i": "metadata/hardening::no-stack-canary", "l": 2 }, { "c": 1.0, "d": "ELF needed library metadata", "e": [ "libc.so.6" ], "i": "metadata/binary/linking/runtime::needed-lib", "l": 2 }, { "c": 0.8999999761581421, "d": "ELF dynsym section name", "e": [ ".dynsym" ], "i": "metadata/hardening::elf-dynsym-section-name", "l": 2 }, { "c": 0.6600000262260437, "d": "Reference to /tmp", "e": [ "/tmp/coreutils/_out/share/locale", "/tmp/coreutils/_out/share/locale" ], "i": "micro-behaviors/fs/path/temp::temp-tmp", "l": 2 }, { "a": "T1005", "c": 0.75, "d": "File content manipulation (read/write/seek)", "e": [ "fseeko", "fseeko@@GLIBC_2.2.5", "sym.imp.fseeko", "fwrite", "sym.rpl_fseeko", "rpl_fseeko", "write" ], "i": "micro-behaviors/fs/file/binary::file-manipulation", "l": 3 }, { "c": 0.8500000238418579, "d": "Documented command line program", "e": [ "Usage: %s [OPERAND]...\n or: %s OPTION", "binary.import_count = 77.00" ], "i": "metadata/package/help::documented-cli-binary", "l": 1 } ], "sha": "4e6d51d698710621569ccc100ec4ca8a7935320accafc4ab1cae4aadf11004b0", "path": "/data/samples/good/datasets/Labeled-Elfs/benignware/x86__64__lsb__unix-system-v__gcc-7.1.0__O3__no-obf__unstripped__coreutils-8.30__dd", "type": "elf" } ], "tv": "2a0fe" } }