{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 0.9305707812309265,
        "class": 0
      }
    ],
    "prob": 0.9305708,
    "class": 0,
    "version": "v16.16",
    "thresholds": [
      0.9815004,
      0.99404883
    ],
    "analyzed_at": "2026-04-30T15:40:28Z"
  },
  "path": "gcrt0.o",
  "raw": {
    "v": "4",
    "fs": [
      {
        "f": "O₂(AsEr)Md₂(Bi₄He)",
        "x": 3,
        "id": 0,
        "ms": {
          "elf": {
            "e_type": 1.0,
            "e_machine": 3.0,
            "class_bits": 32.0,
            "has_eh_frame": true,
            "symtab_count": 63.0,
            "little_endian": true,
            "debug_section_count": 7.0,
            "section_header_count": 35.0,
            "section_relocation_group_count": 9.0
          },
          "binary": {
            "code_size": 830.0,
            "file_size": 13864.0,
            "has_overlay": true,
            "code_entropy": 2.81,
            "data_entropy": 1.73,
            "export_count": 6.0,
            "overlay_size": 1400.0,
            "string_count": 120.0,
            "overlay_ratio": 0.1,
            "section_count": 33.0,
            "avg_complexity": 4.8,
            "function_count": 10.0,
            "max_complexity": 27.0,
            "string_density": 148.05,
            "aliased_exports": 5.0,
            "overall_entropy": 2.78,
            "overlay_entropy": 1.82,
            "avg_basic_blocks": 6.5,
            "avg_section_size": 375.64,
            "entropy_variance": 1.41,
            "function_density": 12.34,
            "avg_function_size": 83.0,
            "avg_string_length": 14.84,
            "complexity_per_kb": 5.92,
            "max_string_length": 318.0,
            "avg_string_entropy": 2.92,
            "code_to_data_ratio": 0.07,
            "text_to_file_ratio": 0.08,
            "total_basic_blocks": 65.0,
            "string_length_stddev": 29.08,
            "debug_reference_count": 7.0,
            "largest_section_ratio": 0.15,
            "sentence_string_count": 8.0,
            "sentence_string_ratio": 0.07,
            "function_analysis_depth": 2.0,
            "nonstandard_section_name_count": 25.0
          }
        },
        "ss": [
          [
            924,
            "ps_strings missing"
          ],
          [
            1273,
            "GCC: (NetBSD nb3 20231008) 10.5.0"
          ],
          [
            1307,
            "$NetBSD: crt0.S,v 1.4 2018/11/26 17:37:45 joerg Exp $"
          ],
          [
            1361,
            "$NetBSD: crt0-common.c,v 1.27 2022/06/21 06:52:17 skrll Exp $"
          ],
          [
            4250,
            "/usr/src/lib/csu/common"
          ],
          [
            4274,
            "/usr/include/sys"
          ],
          [
            4291,
            "/usr/include"
          ],
          [
            4305,
            "crt0-common.c"
          ],
          [
            4322,
            "common_int_types.h"
          ],
          [
            4344,
            "types.h"
          ],
          [
            4355,
            "stdint.h"
          ],
          [
            4367,
            "exec.h"
          ],
          [
            4377,
            "exec_elf.h"
          ],
          [
            4391,
            "csu-common.h"
          ],
          [
            4407,
            "stdlib.h"
          ],
          [
            4419,
            "unistd.h"
          ],
          [
            5283,
            "ps_strings"
          ],
          [
            5294,
            "__rel_iplt_end"
          ],
          [
            5309,
            "environ"
          ],
          [
            5317,
            "phlimit"
          ],
          [
            5325,
            "GNU C99 10.5.0 -fno-canonical-system-headers -m32 -mtune=nocona -march=x86-64 -g -O2 -std=gnu99 -fdebug-regex-map=/usr/src/(.*)/"
          ],
          [
            5655,
            "target"
          ],
          [
            5662,
            "fptr_t"
          ],
          [
            5669,
            "short int"
          ],
          [
            5679,
            "p_memsz"
          ],
          [
            5687,
            "atexit"
          ],
          [
            5694,
            "p_paddr"
          ],
          [
            5702,
            "_libc_init"
          ],
          [
            5713,
            "main"
          ],
          [
            5718,
            "long long int"
          ],
          [
            5732,
            "__uint32_t"
          ],
          [
            5743,
            "__uint16_t"
          ],
          [
            5777,
            "monstartup"
          ],
          [
            5788,
            "__eprol"
          ],
          [
            5796,
            "p_vaddr"
          ],
          [
            5804,
            "p_type"
          ],
          [
            5811,
            "uint8_t"
          ],
          [
            5819,
            "a_type"
          ],
          [
            5826,
            "ps_nenvstr"
          ],
          [
            5837,
            "relocbase"
          ],
          [
            5847,
            "uintptr_t"
          ],
          [
            5862,
            "___start"
          ],
          [
            5871,
            "ps_envstr"
          ],
          [
            5881,
            "__ps_strings"
          ],
          [
            5920,
            "long int"
          ],
          [
            5929,
            "where"
          ],
          [
            5935,
            "_initarray"
          ],
          [
            5946,
            "ps_nargvstr"
          ],
          [
            5964,
            "rellim"
          ],
          [
            5971,
            "rtld_DYNAMIC"
          ],
          [
            5984,
            "exit"
          ],
          [
            5989,
            "__init_array_end"
          ],
          [
            6006,
            "r_offset"
          ],
          [
            6015,
            "unsigned char"
          ],
          [
            6029,
            "relocs"
          ],
          [
            6036,
            "cleanup"
          ],
          [
            6044,
            "abort"
          ],
          [
            6050,
            "r_info"
          ],
          [
            6057,
            "/usr/src/lib/csu/common/crt0-common.c"
          ],
          [
            6095,
            "signed char"
          ],
          [
            6107,
            "__init_array_start"
          ],
          [
            6126,
            "long long unsigned int"
          ],
          [
            6149,
            "uint32_t"
          ],
          [
            6158,
            "p_flags"
          ],
          [
            6166,
            "empty_string"
          ],
          [
            6179,
            "unsigned int"
          ],
          [
            6192,
            "uint16_t"
          ],
          [
            6201,
            "__preinit_array_end"
          ],
          [
            6221,
            "ps_argvstr"
          ],
          [
            6232,
            "short unsigned int"
          ],
          [
            6257,
            "char"
          ],
          [
            6262,
            "dynphdr"
          ],
          [
            6270,
            "__etext"
          ],
          [
            6278,
            "_preinit"
          ],
          [
            6297,
            "u_long"
          ],
          [
            6304,
            "fix_iplt"
          ],
          [
            6313,
            "relocslim"
          ],
          [
            6323,
            "long unsigned int"
          ],
          [
            6351,
            "__syscall"
          ],
          [
            6361,
            "__uintptr_t"
          ],
          [
            6373,
            "p_offset"
          ],
          [
            6382,
            "__progname"
          ],
          [
            6393,
            "__fini_array_end"
          ],
          [
            6421,
            "p_filesz"
          ],
          [
            6430,
            "__fini_array_start"
          ],
          [
            6449,
            "_finiarray"
          ],
          [
            6460,
            "__preinit_array_start"
          ],
          [
            6482,
            "/usr/obj/compat/amd64/i386/lib/csu"
          ],
          [
            6517,
            "relocssz"
          ],
          [
            6526,
            "__rel_iplt_start"
          ],
          [
            6543,
            "p_align"
          ],
          [
            6551,
            "relocate_self"
          ],
          [
            8692,
            "relocate_self.cold"
          ],
          [
            8720,
            "fix_iplt.cold"
          ],
          [
            8784,
            "_DYNAMIC"
          ],
          [
            9004,
            "_mcleanup"
          ],
          [
            9023,
            "_GLOBAL_OFFSET_TABLE_"
          ],
          [
            12133,
            ".symtab"
          ],
          [
            12141,
            ".strtab"
          ],
          [
            12149,
            ".shstrtab"
          ],
          [
            12159,
            ".group"
          ],
          [
            12166,
            ".rel.text"
          ],
          [
            12176,
            ".rel.text.unlikely"
          ],
          [
            12195,
            ".text.__x86.get_pc_thunk.ax"
          ],
          [
            12223,
            ".text.__x86.get_pc_thunk.bx"
          ],
          [
            12251,
            ".text.__x86.get_pc_thunk.di"
          ],
          [
            12279,
            ".rodata.str1.1"
          ],
          [
            12294,
            ".rel.eh_frame"
          ],
          [
            12308,
            ".data"
          ],
          [
            12314,
            ".rel.data.rel.local"
          ],
          [
            12334,
            ".bss"
          ],
          [
            12339,
            ".comment"
          ],
          [
            12348,
            ".ident"
          ],
          [
            12355,
            ".rel.debug_aranges"
          ],
          [
            12374,
            ".rel.debug_info"
          ],
          [
            12390,
            ".debug_abbrev"
          ],
          [
            12404,
            ".rel.debug_line"
          ],
          [
            12420,
            ".debug_str"
          ],
          [
            12431,
            ".rel.debug_loc"
          ],
          [
            12446,
            ".rel.debug_ranges"
          ]
        ],
        "sz": 13864,
        "ts": [
          {
            "c": 1.0,
            "d": "Binary is not digitally signed",
            "i": "metadata/unsigned",
            "l": 2
          },
          {
            "c": 0.6000000238418579,
            "d": "Small ELF binary (\u003c 50KB)",
            "e": [
              "gcrt0.o"
            ],
            "i": "metadata/binary/metrics::small-elf-binary",
            "l": 2
          },
          {
            "c": 0.8999999761581421,
            "d": "ELF imports zero needed libraries",
            "e": [
              "binary.dependency_count = 0.00"
            ],
            "i": "metadata/binary/linking::elf-needed-libs-zero",
            "l": 2
          },
          {
            "c": 0.8999999761581421,
            "d": "Binary has low overall entropy",
            "e": [
              "binary.overall_entropy = 2.78"
            ],
            "i": "metadata/binary/metrics::low-overall-entropy-binary",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Binary has low average complexity",
            "e": [
              "binary.avg_complexity = 4.80"
            ],
            "i": "metadata/binary/metrics::avg-complexity-15-max",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "Binary is not position-independent (fixed load address)",
            "e": [
              "binary.is_pie = 0.00"
            ],
            "i": "metadata/hardening::no-pie",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "Binary format is identified",
            "e": [
              "elf.class_bits = 32.00"
            ],
            "i": "metadata/binary::binary-format-checked",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "Binary has low average string entropy",
            "e": [
              "binary.avg_string_entropy = 2.92"
            ],
            "i": "metadata/binary/metrics::avg-string-entropy-4-max",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "Binary has 3+ functions",
            "e": [
              "binary.function_count = 10.00"
            ],
            "i": "metadata/binary/metrics::few-functions-3",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Binary has 20+ sections (installer/packer)",
            "e": [
              "binary.section_count = 33.00"
            ],
            "i": "metadata/binary/metrics::many-sections-20",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "NetBSD-style /usr/src source path",
            "e": [
              "…bj/\\1 -fdebug-regex-map=/usr/src/(.*)/obj/(.*)=/usr/obj/\\…",
              "/usr/src/lib/csu/common",
              "…gnu99 -fdebug-regex-map=/usr/src/(.*)/obj$=/usr/obj/\\1 -f…",
              "…\\1/\\2 -fdebug-regex-map=/usr/src/(.*)/obj\\..*=/usr/obj/\\1…",
              "…bj/\\1 -fdebug-regex-map=/usr/src/(.*)/obj\\..*/(.*)=/usr/o…",
              "/usr/src/lib/csu/common/crt0-common.c"
            ],
            "i": "metadata/binary/provenance::netbsd-source-tree-path",
            "l": 2
          },
          {
            "d": "Binary exports symbols",
            "e": [
              "binary.export_count = 6.00"
            ],
            "i": "metadata/binary/symbols::has-exports",
            "l": 1
          },
          {
            "a": "T1106",
            "c": 0.949999988079071,
            "d": "ELF ET_DYN binary type",
            "e": [
              "elf.e_type = 1.00"
            ],
            "i": "objectives/evasion/anti-av/syscall::elf-et-dyn",
            "l": 1,
            "m": "B0009"
          },
          {
            "c": 1.0,
            "d": "ELF32 class marker",
            "e": [
              "elf.class_bits = 32.00"
            ],
            "i": "objectives/anti-static/pack/detection::elf32-class",
            "l": 1
          },
          {
            "c": 0.4000000059604645,
            "d": "Very few functions detected",
            "e": [
              "binary.function_count = 10.00"
            ],
            "i": "metadata/binary/metrics::few-functions",
            "l": 2
          },
          {
            "c": 0.8999999761581421,
            "d": "NetBSD RCS ident keyword",
            "e": [
              "$NetBSD: crt0-common.c,v 1.27 2022/06/21 06:52:17 skrll Exp $",
              "$NetBSD: crt0.S,v 1.4 2018/11/26 17:37:45 joerg Exp $"
            ],
            "i": "metadata/binary/provenance::netbsd-rcs-id",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "File is a compiled binary",
            "e": [
              "binary.file_size = 13864.00"
            ],
            "i": "metadata/binary/framework::is-binary",
            "l": 1
          },
          {
            "c": 0.6000000238418579,
            "d": "Binary not position-independent (no ASLR)",
            "e": [
              "elf.e_type = 1.00"
            ],
            "i": "metadata/hardening::no-pie-struct",
            "l": 3
          },
          {
            "c": 0.8999999761581421,
            "d": "Tiny C string section ratio",
            "e": [
              ".rodata.str1.1",
              ".rodata.str1.1 = 0.1% of total (20 / 13864 bytes)"
            ],
            "i": "metadata/binary/section/metrics::tiny-cstring-section",
            "l": 1
          },
          {
            "c": 0.75,
            "d": "ELF lacks dynamic linker sections",
            "e": [
              "elf.class_bits = 32.00"
            ],
            "i": "metadata/binary/linking::static-linked-heuristic",
            "l": 3
          },
          {
            "c": 0.75,
            "d": "ELF lacks dynamic linker sections",
            "e": [
              "elf.class_bits = 32.00"
            ],
            "i": "metadata/hardening::static-linked-heuristic",
            "l": 3
          },
          {
            "c": 0.800000011920929,
            "d": "Statically linked binary",
            "e": [
              "elf.class_bits = 32.00",
              "binary.dependency_count = 0.00"
            ],
            "i": "metadata/binary/linking::static-linked",
            "l": 3
          }
        ],
        "sha": "7b7c6edf3fb0ebb4ec3a0e50ab7e794c028de1aec5744955d33b2bd07a4fd749",
        "path": "/data/samples/good/netbsd/usr/lib/i386/gcrt0.o",
        "type": "elf"
      }
    ],
    "tv": "13343"
  }
}