{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.8951900005340576, "class": 0 } ], "prob": 0.89519, "class": 0, "version": "v16.16", "thresholds": [ 0.9815004, 0.99404883 ], "analyzed_at": "2026-05-01T19:30:52Z" }, "path": "x86__64__lsb__unix-system-v__gcc-7.1.0__O3__no-obf__unstripped__util-linux-2.33__column", "raw": { "v": "4", "fs": [ { "f": "O₂(CI)H(Db₂)Md₂(HeBi₂)", "x": 3, "id": 0, "is": [ "", "getenv", "free", "strcasecmp", "scols_line_refer_data", "abort", "errno_location", "strncmp", "scols_line_get_column_cell", "ITM_deregisterTMCloneTable", "exit", "scols_table_set_name", "scols_table_enable_noheadings", "fpending", "scols_column_get_header", "warn", "scols_table_new_column", "ferror", "scols_free_iter", "isatty", "strtod", "localeconv", "mbstowcs", "scols_table_set_column_separator", "textdomain", "vasprintf", "strtol_internal", "fclose", "bindtextdomain", "stpcpy", "dcgettext", "ctype_get_mb_cur_max", "strlen", "getopt_long", "errx", "mbrtowc", "strchr", "printf", "warnx", "scols_column_get_flags", "snprintf", "assert_fail", "fputs", "strtoul_internal", "scols_table_get_column", "ioctl", "fgetc", "scols_new_table", "strspn", "fputc", "strdup", "strcspn", "wcspbrk", "scols_column_set_flags", "libc_start_main", "calloc", "getdelim", "strcmp", "scols_table_new_line", "strndup", "fprintf", "scols_table_is_json", "feof", "gmon_start__", "strtol", "memcpy", "scols_table_set_termforce", "scols_table_get_ncols", "scols_table_enable_header_repeat", "scols_table_next_line", "fputws", "wcwidth", "err", "malloc", "scols_table_next_column", "scols_cell_get_data", "scols_line_is_ancestor", "scols_table_get_nlines", "scols_table_enable_json", "scols_table_move_column", "ttyname", "scols_table_set_termwidth", "realloc", "setlocale", "mempcpy", "wcstok", "scols_print_table", "fopen", "scols_new_iter", "strtoul", "cxa_atexit", "wcstombs", "putwchar", "scols_line_add_child", "sprintf", "exit", "ITM_registerTMCloneTable", "scols_table_enable_noencoding", "iswprint", "scols_init_debug", "ctype_b_loc", "scols_reset_iter" ], "ms": { "elf": { "e_type": 2.0, "has_got": true, "has_plt": true, "has_note": true, "e_machine": 62.0, "rpath_set": true, "class_bits": 64.0, "note_count": 1.0, "nx_enabled": true, "entry_point": 4208656.0, "needed_libs": 2.0, "rpath_count": 1.0, "dynsym_count": 109.0, "has_eh_frame": true, "symtab_count": 253.0, "dynrela_count": 7.0, "entry_section": ".text", "little_endian": true, "pltreloc_count": 98.0, "has_interpreter": true, "fini_array_count": 1.0, "init_array_count": 1.0, "program_header_count": 8.0, "section_header_count": 29.0, "load_segment_max_p_memsz": 42564.0, "load_segment_max_p_filesz": 42564.0, "section_relocation_group_count": 2.0 }, "binary": { "code_size": 24100.0, "file_size": 56624.0, "entry_point": 4208656.0, "has_overlay": true, "code_entropy": 3.98, "data_entropy": 2.3, "export_count": 177.0, "import_count": 102.0, "overlay_size": 1859.0, "string_count": 434.0, "overlay_ratio": 0.03, "section_count": 28.0, "avg_complexity": 5.6, "function_count": 187.0, "import_density": 4.33, "max_complexity": 153.0, "string_density": 18.44, "aliased_exports": 97.0, "overall_entropy": 2.82, "overlay_entropy": 1.57, "avg_basic_blocks": 7.41, "avg_section_size": 1938.46, "dependency_count": 2.0, "entropy_variance": 1.54, "function_density": 7.95, "avg_function_size": 120.2, "avg_string_length": 19.2, "complexity_per_kb": 0.24, "max_string_length": 91.0, "avg_string_entropy": 3.29, "code_to_data_ratio": 0.8, "data_to_file_ratio": 0.0, "text_to_file_ratio": 0.4, "total_basic_blocks": 1386.0, "string_length_stddev": 14.13, "largest_section_ratio": 0.4, "sentence_string_count": 43.0, "sentence_string_ratio": 0.1, "behavioral_import_ratio": 0.01, "function_analysis_depth": 2.0, "high_complexity_functions": 1.0, "runtime_search_path_count": 1.0 } }, "ss": [ [ 0, "textdomain" ], [ 512, "/lib64/ld-linux-x86-64.so.2" ], [ 4025, "libsmartcols.so.1" ], [ 4043, "scols_line_refer_data" ], [ 4065, "scols_reset_iter" ], [ 4082, "_ITM_deregisterTMCloneTable" ], [ 4110, "scols_free_iter" ], [ 4126, "scols_cell_get_data" ], [ 4146, "scols_table_set_name" ], [ 4167, "scols_column_set_flags" ], [ 4190, "scols_table_set_termwidth" ], [ 4216, "scols_table_get_ncols" ], [ 4238, "scols_table_enable_json" ], [ 4262, "scols_column_get_header" ], [ 4286, "scols_new_iter" ], [ 4301, "scols_table_enable_header_repeat" ], [ 4334, "scols_line_get_column_cell" ], [ 4361, "scols_new_table" ], [ 4377, "__gmon_start__" ], [ 4392, "scols_table_new_line" ], [ 4413, "scols_print_table" ], [ 4431, "scols_init_debug" ], [ 4448, "scols_table_is_json" ], [ 4468, "scols_table_move_column" ], [ 4492, "scols_table_enable_noheadings" ], [ 4522, "scols_table_enable_noencoding" ], [ 4552, "scols_table_next_line" ], [ 4574, "scols_table_set_column_separator" ], [ 4607, "scols_table_new_column" ], [ 4630, "scols_column_get_flags" ], [ 4653, "scols_line_add_child" ], [ 4674, "scols_table_next_column" ], [ 4698, "_ITM_registerTMCloneTable" ], [ 4724, "scols_table_get_nlines" ], [ 4747, "scols_line_is_ancestor" ], [ 4770, "scols_table_get_column" ], [ 4793, "scols_table_set_termforce" ], [ 4829, "putwchar" ], [ 4838, "vasprintf" ], [ 4848, "setlocale" ], [ 4858, "mbrtowc" ], [ 4866, "fopen" ], [ 4872, "strncmp" ], [ 4880, "optind" ], [ 4887, "__strdup" ], [ 4896, "dcgettext" ], [ 4906, "wcspbrk" ], [ 4914, "mbstowcs" ], [ 4929, "fputws" ], [ 4936, "iswprint" ], [ 4945, "realloc" ], [ 4953, "abort" ], [ 4978, "__assert_fail" ], [ 4992, "strtod" ], [ 4999, "__ctype_get_mb_cur_max" ], [ 5022, "strtol" ], [ 5029, "isatty" ], [ 5036, "feof" ], [ 5047, "calloc" ], [ 5054, "strlen" ], [ 5061, "localeconv" ], [ 5077, "strcspn" ], [ 5085, "__errno_location" ], [ 5102, "ttyname" ], [ 5110, "mempcpy" ], [ 5118, "stdout" ], [ 5137, "memcpy" ], [ 5144, "fclose" ], [ 5151, "__strtol_internal" ], [ 5169, "strtoul" ], [ 5177, "malloc" ], [ 5184, "strcasecmp" ], [ 5195, "__strndup" ], [ 5205, "__ctype_b_loc" ], [ 5219, "getenv" ], [ 5226, "optarg" ], [ 5233, "stderr" ], [ 5240, "wcwidth" ], [ 5248, "ioctl" ], [ 5254, "getopt_long" ], [ 5266, "__getdelim" ], [ 5277, "__fpending" ], [ 5295, "fprintf" ], [ 5303, "program_invocation_short_name" ], [ 5333, "wcstombs" ], [ 5347, "wcstok" ], [ 5354, "bindtextdomain" ], [ 5376, "__libc_start_main" ], [ 5394, "ferror" ], [ 5408, "snprintf" ], [ 5417, "__strtoul_internal" ], [ 5436, "free" ], [ 5441, "__progname" ], [ 5452, "__cxa_atexit" ], [ 5465, "/tmp/util-linux/_out/lib" ], [ 5490, "SMARTCOLS_2.30" ], [ 5505, "SMARTCOLS_2.31" ], [ 5520, "SMARTCOLS_2.29" ], [ 5535, "SMARTCOLS_2.27" ], [ 5550, "SMARTCOLS_2.25" ], [ 5575, "GLIBC_2.14" ], [ 10192, "AWAV1" ], [ 10198, "AUAT" ], [ 14896, "AUATI" ], [ 15216, "AVAU1" ], [ 15222, "ATUH" ], [ 15376, "AWAVA" ], [ 15383, "AUATUSH" ], [ 15776, "ATUSH" ], [ 16064, "AWAVAUATUSH" ], [ 19248, "AWAVAUATI" ], [ 19536, "AWAVE" ], [ 21470, "VUUUD" ], [ 22352, "ATUI" ], [ 26515, "AVAUATI" ], [ 27218, "/ukH" ], [ 31056, "AUATE1" ], [ 31928, "AUATUStoH" ], [ 32439, "AUATL" ], [ 32644, "table" ], [ 32650, "failed to parse column" ], [ 32673, "undefined column name '%s'" ], [ 32700, "text-utils/column.c" ], [ 32731, "cannot allocate %zu bytes" ], [ 32757, "write error" ], [ 32769, "read failed" ], [ 32781, "failed to add output data" ], [ 32807, "util-linux" ], [ 32829, "invalid columns argument" ], [ 32863, "%s [options] [\u003cfile\u003e...]" ], [ 32890, "Columnate lists." ], [ 32919, "display version" ], [ 32935, "display this help" ], [ 32953, "-V, --version" ], [ 32980, "%-34s%s" ], [ 32997, "For more details see %s." ], [ 33024, "column(1)" ], [ 33034, "failed to parse column names" ], [ 33063, "%s from %s" ], [ 33075, "util-linux 2.33" ], [ 33097, "fillrows" ], [ 33111, "output-separator" ], [ 33128, "output-width" ], [ 33141, "table-columns" ], [ 33155, "table-hide" ], [ 33166, "table-name" ], [ 33177, "table-noextreme" ], [ 33193, "table-noheadings" ], [ 33210, "table-order" ], [ 33222, "table-right" ], [ 33234, "table-truncate" ], [ 33249, "table-wrap" ], [ 33260, "table-empty-lines" ], [ 33278, "table-header-repeat" ], [ 33298, "tree" ], [ 33303, "tree-id" ], [ 33311, "tree-parent" ], [ 33328, "failed to allocate output table" ], [ 33360, "%s: %u: cannot allocate memory" ], [ 33392, "failed to allocate output line" ], [ 33424, "line %zu: for JSON the name of the column %zu is required" ], [ 33488, "failed to allocate output data" ], [ 33520, "/tmp/util-linux/_out/share/locale" ], [ 33560, "%s: mutually exclusive arguments:" ], [ 33656, "-n, --table-name \u003cname\u003e table name for JSON output" ], [ 33720, "-O, --table-order \u003ccolumns\u003e specify order of output columns" ], [ 33792, "-N, --table-columns \u003cnames\u003e comma separated columns names" ], [ 33864, "-E, --table-noextreme \u003ccolumns\u003e don't count long text from the columns to column width" ], [ 33960, "-d, --table-noheadings don't print header" ], [ 34016, "-e, --table-header-repeat repeat header for each page" ], [ 34080, "-H, --table-hide \u003ccolumns\u003e don't print the columns" ], [ 34144, "-R, --table-right \u003ccolumns\u003e right align text in these columns" ], [ 34216, "-T, --table-truncate \u003ccolumns\u003e truncate text in the columns when necessary" ], [ 34296, "-W, --table-wrap \u003ccolumns\u003e wrap text in the columns when necessary" ], [ 34376, "-L, --table-empty-lines don't ignore empty lines" ], [ 34512, "-r, --tree \u003ccolumn\u003e column to use tree-like output for the table" ], [ 34592, "-i, --tree-id \u003ccolumn\u003e line ID to specify child-parent relation" ], [ 34672, "-p, --tree-parent \u003ccolumn\u003e parent to specify child-parent relation" ], [ 34752, "-c, --output-width \u003cwidth\u003e width of output in number of characters" ], [ 34832, "-o, --output-separator \u003cstring\u003e columns separator for table output (default is two spaces)" ], [ 34928, "-s, --separator \u003cstring\u003e possible table delimiters" ], [ 35056, "Try '%s --help' for more information." ], [ 35136, "options --tree-id and --tree-parent are required for tree formatting" ], [ 35208, "option --table required for all --table-*" ], [ 35256, "option --table-columns required for --json" ], [ 35304, "failed to parse --table-right list" ], [ 35344, "failed to parse --table-trunc list" ], [ 35384, "failed to parse --table-noextreme list" ], [ 35424, "failed to parse --table-wrap list" ], [ 35464, "failed to parse --table-hide list" ], [ 35504, "failed to parse --table-order list" ], [ 36935, "KMGTPEZY" ], [ 36944, "kmgtpezy" ], [ 36955, "BKMGTPE" ], [ 36963, "%d%s%lu%s" ], [ 36990, ".ACOLUMNS" ], [ 37000, "LINES" ], [ 37012, "TERM" ], [ 37017, "lib/strv.c" ], [ 37032, "strv_remove" ], [ 37048, "strv_split" ], [ 43916, "GCC: (GNU) 7.1.0" ], [ 50009, "strutils.c" ], [ 50020, "_strtou32_or_err.part.0" ], [ 50044, "STRTOXX_EXIT_CODE" ], [ 50062, "_strtou16_or_err.part.1" ], [ 50086, "column.c" ], [ 50095, "init_table" ], [ 50106, "column_set_flag" ], [ 50122, "string_to_column.isra.2" ], [ 50146, "__err_oom.constprop.8" ], [ 50168, "split_or_error" ], [ 50183, "mbs_to_wcs" ], [ 50194, "apply_columnflag_from_list" ], [ 50221, "close_stdout" ], [ 50234, "read_input" ], [ 50245, "longopts.7442" ], [ 50259, "excl.7443" ], [ 50269, "crtstuff.c" ], [ 50280, "deregister_tm_clones" ], [ 50301, "__do_global_dtors_aux" ], [ 50323, "completed.6973" ], [ 50338, "__do_global_dtors_aux_fini_array_entry" ], [ 50377, "frame_dummy" ], [ 50389, "__frame_dummy_init_array_entry" ], [ 50420, "mbsalign.c" ], [ 50431, "ttyutils.c" ], [ 50442, "strv.c" ], [ 50449, "__PRETTY_FUNCTION__.4959" ], [ 50474, "__PRETTY_FUNCTION__.5027" ], [ 50499, "__FRAME_END__" ], [ 50513, "__init_array_end" ], [ 50530, "_DYNAMIC" ], [ 50539, "__init_array_start" ], [ 50558, "__GNU_EH_FRAME_HDR" ], [ 50577, "_GLOBAL_OFFSET_TABLE_" ], [ 50599, "strutils_set_exitcode" ], [ 50621, "__libc_csu_fini" ], [ 50637, "getenv@@GLIBC_2.2.5" ], [ 50657, "__progname@@GLIBC_2.2.5" ], [ 50681, "strtou64_or_err" ], [ 50697, "free@@GLIBC_2.2.5" ], [ 50715, "skip_fline" ], [ 50726, "mbs_safe_nwidth" ], [ 50742, "strcasecmp@@GLIBC_2.2.5" ], [ 50766, "scols_line_refer_data@@SMARTCOLS_2.25" ], [ 50804, "abort@@GLIBC_2.2.5" ], [ 50823, "__errno_location@@GLIBC_2.2.5" ], [ 50853, "strncmp@@GLIBC_2.2.5" ], [ 50874, "scols_line_get_column_cell@@SMARTCOLS_2.25" ], [ 50945, "stdout@@GLIBC_2.2.5" ], [ 50965, "strtou16_or_err" ], [ 51000, "strtol_or_err" ], [ 51014, "scols_table_set_name@@SMARTCOLS_2.27" ], [ 51051, "scols_table_enable_noheadings@@SMARTCOLS_2.25" ], [ 51097, "__fpending@@GLIBC_2.2.5" ] ], "sz": 56624, "ts": [ { "c": 1.0, "d": "ELF program interpreter present", "e": [ "/lib64/ld-linux-x86-64.so.2" ], "i": "metadata/binary/linking::elf-interpreter", "l": 2 }, { "c": 1.0, "d": "ELF needed library", "e": [ "libsmartcols.so.1", "libc.so.6" ], "i": "metadata/binary/linking::elf-needed-lib", "l": 2 }, { "c": 1.0, "d": "ELF RPATH entry", "e": [ "/tmp/util-linux/_out/lib" ], "i": "metadata/binary/linking::elf-rpath", "l": 2 }, { "c": 1.0, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "l": 2 }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.function_count = 187.00" ], "i": "metadata/binary/metrics::many-functions", "l": 2 }, { "a": "T1486", "c": 0.75, "d": "flock LOCK_EX call bytecode pattern", "e": [ "be 1e f5 ff ff", "be 38 03 00 00", "bf 16 af ff ff" ], "i": "objectives/impact/ransom/esxi::flock-lockex", "l": 1, "m": "C0027" }, { "a": "T1055", "c": 0.25, "d": "Repeated 0x07 code constant (possible PROT_RWX)", "e": [ "07 00 00 00", "07 00 00 00", "07 00 00 00" ], "i": "micro-behaviors/mem/protect/modify::rwx-prot-bytes", "l": 1 }, { "d": "Characteristic system library export __assert_fail", "e": [ "assert_fail" ], "i": "micro-behaviors/dylib/library/libc::libc-characteristic-assert-fail", "l": 2 }, { "c": 1.0, "d": "Binary has 100+ imports", "e": [ "binary.import_count = 102.00" ], "i": "metadata/binary/metrics::many-imports-100", "l": 1 }, { "d": ".so extension reference", "e": [ ".so", ".so" ], "i": "micro-behaviors/fs/path/extension::so", "l": 2 }, { "c": 1.0, "d": "Binary format is identified", "e": [ "elf.class_bits = 64.00" ], "i": "metadata/binary::binary-format-checked", "l": 2 }, { "c": 0.75, "d": "String to long integer conversion (strtol)", "e": [ "strtol" ], "i": "micro-behaviors/data/string/conversion::strtol", "l": 1 }, { "c": 0.800000011920929, "d": "Binary has many exports (\u003e10)", "e": [ "binary.export_count = 177.00" ], "i": "metadata/binary/metrics::many-exports", "l": 2 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 102.00" ], "i": "metadata/binary/metrics::many-imports-40", "l": 1 }, { "c": 0.6600000262260437, "d": "Reference to /lib64", "e": [ "/lib64/ld-linux-x86-64.so.2" ], "i": "micro-behaviors/fs/path/system::system-lib64", "l": 2 }, { "d": "Characteristic system library exports", "e": [ "libc_start_main" ], "i": "micro-behaviors/dylib/library/libc::libc-characteristic-symbols", "l": 2 }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening::no-pie", "l": 2 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 5.60" ], "i": "metadata/binary/metrics::avg-complexity-15-max", "l": 2 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.29" ], "i": "metadata/binary/metrics::avg-string-entropy-4-max", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "binary.file_size = 56624.00" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 2.82" ], "i": "metadata/binary/metrics::low-overall-entropy-binary", "l": 1 }, { "c": 0.8999999761581421, "d": "CLI help or usage text", "e": [ "Try '%s --help' for more information." ], "i": "metadata/binary/metrics::help-usage-string", "l": 2 }, { "c": 0.8999999761581421, "d": "ELF dynsym section name", "e": [ ".dynsym" ], "i": "metadata/binary/linking::elf-dynsym-section-name", "l": 2 }, { "c": 1.0, "d": "Binary has 100+ exports", "e": [ "binary.export_count = 177.00" ], "i": "metadata/binary/metrics::many-exports-100", "l": 1 }, { "c": 0.800000011920929, "d": "High number of imported symbols (\u003e80)", "e": [ "binary.import_count = 102.00" ], "i": "metadata/binary/metrics::many-imports", "l": 2 }, { "c": 1.0, "d": "/tmp/ path component", "e": [ "/tmp/util-linux/_out/lib", "/tmp/util-linux/_out/share/locale" ], "i": "micro-behaviors/fs/path/temp::tmp-path-content", "l": 2 }, { "c": 0.6600000262260437, "d": "Open files", "e": [ "fopen" ], "i": "micro-behaviors/fs/file/open::fopen", "l": 2 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 102.00" ], "i": "metadata/binary/metrics::many-imports-25", "l": 1 }, { "c": 0.800000011920929, "d": "libc version string pattern", "e": [ "GLIBC", "GLIBC", "GLIBC", "GLIBC", "GLIBC", "GLIBC", "GLIBC", "GLIBC", "GLIBC", "GLIBC", "GLIBC", "GLIBC", "GLIBC", "GLIBC", "GLIBC", "GLIBC" ], "i": "micro-behaviors/dylib/library/libc::libc-version-string", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 102.00" ], "i": "metadata/binary/metrics::many-imports-50", "l": 1 }, { "a": "T1059.006", "c": 0.6000000238418579, "d": "Named /tmp execution path", "e": [ "/tmp/util", "/tmp/util" ], "i": "objectives/command-and-control/dropper::tmp-path", "l": 1, "m": "B0024" }, { "c": 0.8999999761581421, "d": "Abort program execution", "e": [ "abort" ], "i": "micro-behaviors/os/signal/handler::abort", "l": 2 }, { "d": "TERM environment variable", "e": [ "TERM" ], "i": "micro-behaviors/os/env/vars/system-info::term-var", "l": 2 }, { "c": 0.20000000298023224, "d": "output keyword", "e": [ "-o, --output-separator \u003cstring\u003e col…", "-O, --table-order \u003ccolumns\u003e specify order of output columns", "failed to add output data", "…mns separator for table output (default is two spaces)", "failed to allocate output table", "failed to allocate output line", "failed to allocate output data", "-r, --tree \u003ccolumn\u003e column to use tree-like output for the table", "output-separator", "output-width", "-c, --output-width \u003cwidth\u003e width of output in number of characters", "-n, --table-name \u003cname\u003e table name for JSON output" ], "i": "micro-behaviors/data/text/keywords::output", "l": 1 }, { "c": 0.699999988079071, "d": "RPATH/RUNPATH set (library injection vector)", "e": [ "elf.rpath_set = 1.00" ], "i": "metadata/hardening::rpath-set", "l": 3 }, { "c": 0.8999999761581421, "d": "ELF interpreter section name", "e": [ ".interp" ], "i": "metadata/binary/linking::elf-interpreter-section-name", "l": 2 }, { "c": 1.0, "d": "Binary has 20+ exports", "e": [ "binary.export_count = 177.00" ], "i": "metadata/binary/metrics::many-exports-20", "l": 1 }, { "c": 0.699999988079071, "d": "Version information string", "e": [ "--version" ], "i": "metadata/package/help::version-text", "l": 2 }, { "d": "Characteristic system library export __errno_location", "e": [ "errno_location" ], "i": "micro-behaviors/dylib/library/libc::libc-characteristic-errno", "l": 2 }, { "d": "Binary exports symbols", "e": [ "binary.export_count = 177.00" ], "i": "metadata/binary/symbols::has-exports", "l": 1 }, { "d": "hide keyword", "e": [ "hide", "hide", "hide" ], "i": "micro-behaviors/data/text/keywords::hide", "l": 1 }, { "c": 1.0, "d": "Binary has 9+ exports", "e": [ "binary.export_count = 177.00" ], "i": "metadata/binary/metrics::many-exports-9", "l": 1 }, { "d": "Detect if running in terminal (isatty)", "e": [ "isatty", "isatty@@GLIBC_2.2.5", "sym.imp.isatty" ], "i": "micro-behaviors/process/tty/terminal::isatty", "l": 2 }, { "c": 0.6600000262260437, "d": "Write single bytes to file", "e": [ "fputc" ], "i": "micro-behaviors/fs/file/write::fputc", "l": 2 }, { "d": "Get terminal name (ttyname)", "e": [ "ttyname", "ttyname@@GLIBC_2.2.5", "sym.imp.ttyname" ], "i": "micro-behaviors/process/tty/terminal::ttyname", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.function_count = 187.00" ], "i": "metadata/binary/metrics::many-functions-50", "l": 1 }, { "c": 0.4000000059604645, "d": "Terminate process immediately without cleanup", "e": [ "exit", "exit" ], "i": "micro-behaviors/process/terminate/signal::_exit", "l": 2 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 102.00" ], "i": "metadata/binary/metrics::many-imports-20", "l": 1 }, { "c": 0.699999988079071, "d": "Unix /tmp/ path reference", "e": [ "/tmp/util-linux/_out/lib", "/tmp/util-linux/_out/share/locale" ], "i": "micro-behaviors/fs/path/temp::unix-temp", "l": 2 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.function_count = 187.00" ], "i": "metadata/binary/metrics::few-functions-3", "l": 1 }, { "d": "Characteristic system library export __cxa_atexit", "e": [ "cxa_atexit" ], "i": "micro-behaviors/dylib/library/libc::libc-characteristic-cxa-atexit", "l": 2 }, { "c": 1.0, "d": "ELF64 class marker", "e": [ "elf.class_bits = 64.00" ], "i": "metadata/binary/metrics::elf64-class", "l": 1 }, { "c": 0.8999999761581421, "d": "ELF dynamic section name", "e": [ ".dynamic" ], "i": "metadata/binary/linking::elf-dynamic-section-name", "l": 2 }, { "c": 0.8999999761581421, "d": "ELF dynstr section name", "e": [ ".dynstr" ], "i": "metadata/binary/linking::elf-dynstr-section-name", "l": 2 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 102.00" ], "i": "metadata/binary/metrics::many-imports-30", "l": 1 }, { "c": 0.6000000238418579, "d": "X11 Session Management library", "e": [ "libsm" ], "i": "micro-behaviors/dylib/library::x11-sm-ref", "l": 2 }, { "d": "X11 libSM reference", "e": [ "libsm" ], "i": "micro-behaviors/dylib/library::x11-libsm-ref", "l": 2 }, { "c": 1.0, "d": "Binary has 20+ sections (installer/packer)", "e": [ "binary.section_count = 28.00" ], "i": "metadata/binary/metrics::many-sections-20", "l": 1 }, { "c": 0.8999999761581421, "d": "No stack canary (stack smashing protection absent)", "e": [ "elf.stack_canary = 0.00" ], "i": "metadata/hardening::no-stack-canary", "l": 2 }, { "c": 0.6000000238418579, "d": "Binary not position-independent (no ASLR)", "e": [ "elf.e_type = 2.00" ], "i": "metadata/hardening::no-pie-struct", "l": 3 }, { "c": 0.8999999761581421, "d": "ELF dynsym section name", "e": [ ".dynsym" ], "i": "metadata/hardening::elf-dynsym-section-name", "l": 2 }, { "c": 1.0, "d": "ELF needed library metadata", "e": [ "libsmartcols.so.1", "libc.so.6" ], "i": "metadata/binary/linking/runtime::needed-lib", "l": 2 }, { "c": 0.30000001192092896, "d": "getenv function (read environment variable)", "e": [ "getenv", "sym.imp.getenv" ], "i": "micro-behaviors/os/env/vars::getenv", "l": 2 }, { "c": 0.8999999761581421, "d": "ELF dynstr section name", "e": [ ".dynstr" ], "i": "metadata/hardening::elf-dynstr-section-name", "l": 2 }, { "c": 0.8999999761581421, "d": "ELF interpreter section name", "e": [ ".interp" ], "i": "metadata/hardening::elf-interpreter-section-name", "l": 2 }, { "c": 1.0, "d": "ELF program interpreter metadata", "e": [ "/lib64/ld-linux-x86-64.so.2" ], "i": "metadata/binary/linking/runtime::interpreter", "l": 2 }, { "c": 0.8999999761581421, "d": "No RELRO (GOT writable after load)", "e": [ "elf.relro = 0.00" ], "i": "metadata/hardening::no-relro", "l": 2 }, { "c": 1.0, "d": "ELF RPATH metadata", "e": [ "/tmp/util-linux/_out/lib" ], "i": "metadata/binary/linking/runtime::elf-rpath", "l": 2 }, { "c": 0.8999999761581421, "d": "ELF dynamic section name", "e": [ ".dynamic" ], "i": "metadata/hardening::elf-dynamic-section-name", "l": 2 }, { "c": 0.6600000262260437, "d": "Reference to /tmp", "e": [ "/tmp/util-linux/_out/share/locale", "/tmp/util-linux/_out/share/locale", "/tmp/util-linux/_out/lib", "/tmp/util-linux/_out/lib" ], "i": "micro-behaviors/fs/path/temp::temp-tmp", "l": 2 } ], "sha": "6cdbd1b9b55401f76ffa03d60d2226728abe3f7bdd126e729cbfbf72584e5920", "path": "x86__64__lsb__unix-system-v__gcc-7.1.0__O3__no-obf__unstripped__util-linux-2.33__column", "type": "elf" } ], "tv": "feb13" } }