{
  "ml": {
    "v": "5",
    "fs": [
      {
        "id": 0,
        "prob": 0.9986477494239807,
        "class": 2,
        "threshold": 0.9932810664176941
      }
    ],
    "prob": 0.99864775,
    "class": 2,
    "level": 3,
    "models": [
      {
        "m": "az",
        "prob": 0.99716914,
        "class": 2
      },
      {
        "m": "az/native",
        "prob": 0.99864775,
        "class": 2
      },
      {
        "m": "az/elf",
        "prob": 1.0,
        "class": 2
      }
    ],
    "version": "v17.17",
    "threshold": 0.99328107,
    "analyzed_at": "2026-05-31T08:00:59Z"
  },
  "path": "5da56b388c4c9f90549f383c7fcd9debcb2596a966e51d735e5fb3d77fafa611.elf",
  "raw": {
    "v": "5",
    "fs": [
      {
        "f": "Md₃(BiBkHe₂)",
        "x": 126,
        "ff": {
          "m": {
            "elf": {
              "bits": 32.0,
              "entry": 57944.0,
              "has_got": 0.0,
              "has_plt": 0.0,
              "has_note": 0.0,
              "note_count": 0.0,
              "nx_enabled": 0.0,
              "dynrel_count": 0.0,
              "dynsym_count": 0.0,
              "has_eh_frame": 0.0,
              "symtab_count": 0.0,
              "dynrela_count": 0.0,
              "little_endian": 1.0,
              "pltreloc_count": 0.0,
              "executable_stack": 1.0,
              "wx_segment_count": 0.0,
              "program_header_count": 3.0,
              "gnu_stack_section_absent": 0.0,
              "load_segment_max_file_size": 29703.0,
              "stripped_but_symtab_present": 0.0,
              "load_segment_max_memory_size": 29703.0,
              "section_relocation_group_count": 0.0,
              "stripped_metadata_section_count": 8.0
            },
            "file": {
              "size": 29944.0,
              "entropy": 7.95,
              "size_bytes": 29944.0
            },
            "binary": {
              "is_pie": 0.0,
              "is_stripped": 1.0,
              "avg_complexity": 32.5,
              "max_complexity": 61.0,
              "huge_func_count": 1.0,
              "leaf_func_count": 1.0,
              "tiny_func_count": 0.0,
              "avg_basic_blocks": 54.5,
              "total_basic_blocks": 109.0
            },
            "functions": {
              "count": 2.0
            },
            "dependencies": {
              "count": 0.0
            }
          },
          "s": [
            [
              644,
              "u8",
              "Za0ex"
            ],
            [
              4059,
              "u8",
              "knJw"
            ],
            [
              5421,
              "u8",
              "HH4O"
            ],
            [
              5786,
              "u8",
              "Qb u"
            ],
            [
              6791,
              "u8",
              "rth J"
            ],
            [
              9122,
              "u8",
              "/gzfkr"
            ],
            [
              10710,
              "u8",
              "8XLqrlT"
            ],
            [
              10763,
              "u8",
              "pkCl"
            ],
            [
              10855,
              "u8",
              "7x3d"
            ],
            [
              11587,
              "u8",
              "VM 3"
            ],
            [
              11754,
              "u8",
              "JBP5"
            ],
            [
              13857,
              "u8",
              "AHR2"
            ],
            [
              15132,
              "u8",
              "KT1N"
            ],
            [
              16023,
              "u8",
              "qNL f"
            ],
            [
              17975,
              "u8",
              "wbpOR"
            ],
            [
              18545,
              "u8",
              "Orhu"
            ],
            [
              18669,
              "u8",
              "iu5Fj"
            ],
            [
              18946,
              "u8",
              "UITtf"
            ],
            [
              20233,
              "u8",
              "QKAR"
            ],
            [
              20655,
              "u8",
              "INCN"
            ],
            [
              21208,
              "u8",
              "Izoa"
            ],
            [
              22516,
              "u8",
              "FUM1"
            ],
            [
              27944,
              "u8",
              "PROT_EXEC|PROT_WRITE failed."
            ],
            [
              27976,
              "u8",
              "$Info: This file is packed with the UPX executable packer http://upx.sf.net $"
            ],
            [
              28055,
              "u8",
              "$Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $"
            ],
            [
              29690,
              "u8",
              "961K"
            ]
          ],
          "v": {
            "elf.type": "executable",
            "elf.class": "elf32",
            "elf.entry": 57944,
            "file.stem": "5da56b388c4c9f90549f383c7fcd9debcb2596a966e51d735e5fb3d77fafa611",
            "elf.endian": "little",
            "elf.machine": "arm",
            "elf.version": 1,
            "binary.packer": "upx",
            "file.basename": "5da56b388c4c9f90549f383c7fcd9debcb2596a966e51d735e5fb3d77fafa611.elf",
            "elf.e_flags[0]": "soft_float",
            "elf.e_flags_raw": 514,
            "elf.segments[0].type": "load",
            "elf.segments[1].type": "load",
            "elf.segments[2].type": "gnu_stack",
            "binary.packer_version": "3.94",
            "elf.segments[0].perms": "r-x",
            "elf.segments[0].vaddr": 32768,
            "elf.segments[1].perms": "rw-",
            "elf.segments[1].vaddr": 136780,
            "elf.segments[2].perms": "rwx",
            "elf.segments[0].file_size": 29703,
            "elf.segments[0].flags_hex": "5",
            "elf.segments[1].flags_hex": "6",
            "elf.segments[2].flags_hex": "7",
            "elf.segments[0].memory_size": 29703,
            "elf.segments[1].file_offset": 5708,
            "binary.top_complex_unnamed[0].cc": 61,
            "elf.stripped_metadata_sections[0]": ".symtab",
            "elf.stripped_metadata_sections[1]": ".strtab",
            "elf.stripped_metadata_sections[2]": ".comment",
            "elf.stripped_metadata_sections[3]": ".debug_info",
            "elf.stripped_metadata_sections[4]": ".debug_line",
            "elf.stripped_metadata_sections[5]": ".debug_str",
            "elf.stripped_metadata_sections[6]": ".debug_abbrev",
            "elf.stripped_metadata_sections[7]": ".note.gnu.gold-version",
            "binary.top_complex_unnamed[0].addr": "0xe3d8"
          },
          "id": "elf"
        },
        "id": 0,
        "sz": 29944,
        "ts": [
          {
            "c": 1.0,
            "d": "Binary is not digitally signed",
            "i": "metadata/unsigned",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "Binary contains a UPX packing marker",
            "i": "anti-static/packer/upx",
            "l": 4
          },
          {
            "c": 1.0,
            "d": "UPX decompression failed: IO error: No such file or directory (os error 2)",
            "i": "anti-static/packer/upx/decompression-failed",
            "l": 5
          },
          {
            "c": 1.0,
            "d": "UPX executable packer signature string",
            "e": [
              "$Info: This file is packed with the UPX executable packer http://upx.sf.net $"
            ],
            "i": "objectives/anti-static/pack/detect::upx-packer-string",
            "l": 1,
            "el": [
              "0x6d48"
            ]
          },
          {
            "c": 0.949999988079071,
            "d": "UPX magic bytes in ELF",
            "e": [
              "UPX!"
            ],
            "i": "objectives/anti-static/pack/detect::upx-magic-raw",
            "l": 1
          },
          {
            "c": 0.6000000238418579,
            "d": "PROT_EXEC memory protection constant",
            "e": [
              "PROT_EXEC|PROT_WRITE failed."
            ],
            "i": "micro-behaviors/mem/alloc/executable::prot-exec-const",
            "l": 2,
            "el": [
              "0x6d28"
            ]
          },
          {
            "c": 1.0,
            "d": "File is a compiled binary",
            "e": [
              "5da56b388c4c9f90549f383c7fcd9debcb2596a966e51d735e5fb3d77fafa611.elf"
            ],
            "i": "metadata/binary/framework::is-binary",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "ELF imports zero needed libraries",
            "e": [
              "dependencies.count = 0.00"
            ],
            "i": "metadata/binary/linking/static::elf-needed-libs-zero",
            "l": 2
          },
          {
            "c": 0.699999988079071,
            "d": "ELF symbol tables stripped from binary",
            "e": [
              "elf.stripped_metadata_section_count = 8.00"
            ],
            "i": "metadata/binary/anomaly/provenance::stripped-symbol-tables",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Binary symbol table is stripped",
            "e": [
              "binary.is_stripped = 1.00"
            ],
            "i": "metadata/hardening/layout::stripped",
            "l": 2
          },
          {
            "c": 0.8500000238418579,
            "d": "ELF PT_GNU_STACK has executable bit set",
            "e": [
              "elf.executable_stack = 1.00"
            ],
            "i": "metadata/binary/anomaly/format::elf-executable-stack",
            "l": 3
          },
          {
            "c": 0.6000000238418579,
            "d": "Copyright notice",
            "e": [
              "Copyright"
            ],
            "i": "metadata/package/license::copyright-word",
            "l": 2,
            "el": [
              "0x6d97"
            ]
          },
          {
            "c": 0.4000000059604645,
            "d": "Very few leaf functions (deep)",
            "e": [
              "binary.leaf_func_count = 1.00"
            ],
            "i": "metadata/binary/metrics/structural::few-leaf-functions",
            "l": 3
          },
          {
            "c": 0.6000000238418579,
            "d": "Small ELF binary (\u003c 50KB)",
            "e": [
              "5da56b388c4c9f90549f383c7fcd9debcb2596a966e51d735e5fb3d77fafa611.elf"
            ],
            "i": "metadata/binary/metrics/structural::small-elf-binary",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "Binary is not position-independent (fixed load address)",
            "e": [
              "binary.is_pie = 0.00"
            ],
            "i": "metadata/hardening/layout::no-pie",
            "l": 2
          },
          {
            "c": 0.8999999761581421,
            "d": "Tiny C string section ratio",
            "e": [
              " = 0.0% of total (0 / 29944 bytes)"
            ],
            "i": "metadata/binary/section/metrics::tiny-cstring-section",
            "l": 1
          },
          {
            "c": 0.6000000238418579,
            "d": "PROT_WRITE memory protection constant",
            "e": [
              "PROT_WRITE"
            ],
            "i": "objectives/anti-analysis/self-modify/runtime::prot-write",
            "l": 2,
            "el": [
              "0x6d28"
            ]
          },
          {
            "c": 1.0,
            "d": "Toolchain banner stripped, build-id retained",
            "e": [
              "[.symtab, .strtab, .comment, .debug_info, .debug_line, .debug_str, .debug_abbrev, .note.gnu.gold-version]"
            ],
            "i": "metadata/build/artifact::aggressive-strip",
            "l": 3,
            "el": [
              "value:elf.stripped_metadata_sections"
            ]
          },
          {
            "c": 0.800000011920929,
            "d": "No full symbol table (likely stripped)",
            "e": [
              "binary.is_stripped = 1.00"
            ],
            "i": "metadata/hardening/missing::stripped-binary",
            "l": 3
          },
          {
            "a": "T1027",
            "c": 0.550000011920929,
            "d": "High basic blocks per function",
            "e": [
              "binary.avg_basic_blocks = 54.50"
            ],
            "i": "objectives/anti-static/obfuscation/binary-metrics/shape::many-basic-blocks",
            "l": 3,
            "m": "B0032"
          },
          {
            "c": 0.8999999761581421,
            "d": "NX/DEP disabled (stack is executable)",
            "e": [
              "elf.nx_enabled = 0.00"
            ],
            "i": "metadata/hardening/mitigation::nx-disabled",
            "l": 3
          }
        ],
        "sha": "5da56b388c4c9f90549f383c7fcd9debcb2596a966e51d735e5fb3d77fafa611",
        "path": "5da56b388c4c9f90549f383c7fcd9debcb2596a966e51d735e5fb3d77fafa611.elf",
        "type": "elf"
      }
    ],
    "tv": "52045"
  }
}