{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.8985074758529663, "class": 0 } ], "prob": 0.8985075, "class": 0, "models": [ { "m": "az", "prob": 0.8985075, "class": 0 }, { "m": "az/native", "prob": 0.00023250407, "class": 0 }, { "m": "az/elf", "prob": 0.0, "class": 0 } ], "version": "v16.16", "thresholds": [ 0.9983558, 0.99991804 ], "analyzed_at": "2026-05-17T13:34:31Z" }, "path": "8393587a1ccf98b84f362da2631361ca758fcdee500eab81c0ee8104ae048ea8.elf", "raw": { "v": "4", "fs": [ { "f": "H₂(FPo)Md₂(BiHe)", "k": { "elf.relro": "partial", "elf.abi.os": "linux", "elf.comment": "GCC: (Debian 6.3.0-14) 6.3.0 20170415", "build.distro": "debian", "elf.needed[0]": "libm.so.6", "elf.needed[1]": "libpthread.so.0", "elf.needed[2]": "libc.so.6", "debug.build_id": "79912731c9cdcc6d61eff0284d55bf721b8bfc36", "build.toolchain": "gcc 6.3.0", "elf.interpreter": "/lib64/ld-linux-x86-64.so.2", "elf.dt_flags.pie": true, "build.target_arch": "x86_64", "elf.entry_section": ".text", "elf.abi.min_kernel": "2.6.32", "elf.dt_flags.raw_1": 134217728, "elf.dt_flags_1.pie": true, "elf.segments[0].perms": "r-x", "elf.segments[1].perms": "r--", "elf.segments[2].perms": "r-x", "elf.segments[3].perms": "rw-", "elf.segments[4].perms": "rw-", "elf.segments[5].perms": "r--", "elf.segments[6].perms": "r--", "elf.segments[7].perms": "rw-", "elf.segments[8].perms": "r--", "build.toolchain_family": "gcc", "elf.comment_entries[0]": "GCC: (Debian 6.3.0-14) 6.3.0 20170415", "elf.fini_array[0].addr": "0x1670", "elf.gnu_abi_min_kernel": "2.6.32", "elf.init_array[0].addr": "0x16b0", "elf.segments[0].p_type": "PT_PHDR", "elf.segments[1].p_type": "PT_INTERP", "elf.segments[2].p_type": "PT_LOAD", "elf.segments[3].p_type": "PT_LOAD", "elf.segments[4].p_type": "PT_DYNAMIC", "elf.segments[5].p_type": "PT_NOTE", "elf.segments[6].p_type": "PT_GNU_EH_FRAME", "elf.segments[7].p_type": "PT_GNU_STACK", "elf.segments[8].p_type": "PT_GNU_RELRO", "elf.segments[0].p_memsz": 504, "elf.segments[0].p_vaddr": 64, "elf.segments[1].p_memsz": 28, "elf.segments[1].p_vaddr": 568, "elf.segments[2].p_memsz": 58740, "elf.segments[3].p_memsz": 2296, "elf.segments[3].p_vaddr": 2158008, "elf.segments[4].p_memsz": 512, "elf.segments[4].p_vaddr": 2158032, "elf.segments[5].p_memsz": 68, "elf.segments[5].p_vaddr": 596, "elf.segments[6].p_memsz": 324, "elf.segments[6].p_vaddr": 57000, "elf.segments[8].p_memsz": 584, "elf.segments[8].p_vaddr": 2158008, "elf.dynsym_funcs[0].kind": "func", "elf.dynsym_funcs[0].name": "__ctype_get_mb_cur_max", "elf.dynsym_funcs[1].kind": "func", "elf.dynsym_funcs[1].name": "__cxa_finalize", "elf.dynsym_funcs[2].kind": "func", "elf.dynsym_funcs[2].name": "__errno_location", "elf.dynsym_funcs[3].kind": "func", "elf.dynsym_funcs[3].name": "__libc_start_main", "elf.dynsym_funcs[4].kind": "func", "elf.dynsym_funcs[4].name": "__sysv_signal", "elf.dynsym_funcs[5].kind": "func", "elf.dynsym_funcs[5].name": "atoi", "elf.dynsym_funcs[6].kind": "func", "elf.dynsym_funcs[6].name": "calloc", "elf.dynsym_funcs[7].kind": "func", "elf.dynsym_funcs[7].name": "execlp", "elf.dynsym_funcs[8].kind": "func", "elf.dynsym_funcs[8].name": "exit", "elf.dynsym_funcs[9].kind": "func", "elf.dynsym_funcs[9].name": "fclose", "elf.segments[0].p_filesz": 504, "elf.segments[0].p_offset": 64, "elf.segments[1].p_filesz": 28, "elf.segments[1].p_offset": 568, "elf.segments[2].p_filesz": 58740, "elf.segments[3].p_filesz": 1048, "elf.segments[3].p_offset": 60856, "elf.segments[4].p_filesz": 512, "elf.segments[4].p_offset": 60880, "elf.segments[5].p_filesz": 68, "elf.segments[5].p_offset": 596, "elf.segments[6].p_filesz": 324, "elf.segments[6].p_offset": 57000, "elf.segments[8].p_filesz": 584, "elf.segments[8].p_offset": 60856, "elf.dynsym_funcs[10].kind": "func", "elf.dynsym_funcs[10].name": "feof", "elf.dynsym_funcs[11].kind": "func", "elf.dynsym_funcs[11].name": "ferror", "elf.dynsym_funcs[12].kind": "func", "elf.dynsym_funcs[12].name": "fgets", "elf.dynsym_funcs[13].kind": "func", "elf.dynsym_funcs[13].name": "fopen", "elf.dynsym_funcs[14].kind": "func", "elf.dynsym_funcs[14].name": "fork", "elf.dynsym_funcs[15].kind": "func", "elf.dynsym_funcs[15].name": "fprintf", "elf.dynsym_funcs[16].kind": "func", "elf.dynsym_funcs[16].name": "fputc", "elf.dynsym_funcs[17].kind": "func", "elf.dynsym_funcs[17].name": "fputs", "elf.dynsym_funcs[18].kind": "func", "elf.dynsym_funcs[18].name": "free", "elf.dynsym_funcs[19].kind": "func", "elf.dynsym_funcs[19].name": "fseek", "elf.dynsym_funcs[20].kind": "func", "elf.dynsym_funcs[20].name": "fwrite", "elf.dynsym_funcs[21].kind": "func", "elf.dynsym_funcs[21].name": "malloc", "elf.dynsym_funcs[22].kind": "func", "elf.dynsym_funcs[22].name": "mbstowcs", "elf.dynsym_funcs[23].kind": "func", "elf.dynsym_funcs[23].name": "memcpy", "elf.dynsym_funcs[24].kind": "func", "elf.dynsym_funcs[24].name": "memset", "elf.dynsym_funcs[25].kind": "func", "elf.dynsym_funcs[25].name": "pow", "elf.dynsym_funcs[26].kind": "func", "elf.dynsym_funcs[26].name": "pthread_create", "elf.dynsym_funcs[27].kind": "func", "elf.dynsym_funcs[27].name": "pthread_detach", "elf.dynsym_funcs[28].kind": "func", "elf.dynsym_funcs[28].name": "qsort", "elf.dynsym_funcs[29].kind": "func", "elf.dynsym_funcs[29].name": "remove", "elf.dynsym_funcs[30].kind": "func", "elf.dynsym_funcs[30].name": "rename", "elf.dynsym_funcs[31].kind": "func", "elf.dynsym_funcs[31].name": "setlocale", "elf.dynsym_funcs[32].kind": "func", "elf.dynsym_funcs[32].name": "sleep", "elf.dynsym_funcs[33].kind": "func", "elf.dynsym_funcs[33].name": "strcat", "elf.dynsym_funcs[34].kind": "func", "elf.dynsym_funcs[34].name": "strchr", "elf.dynsym_funcs[35].kind": "func", "elf.dynsym_funcs[35].name": "strcmp", "elf.dynsym_funcs[36].kind": "func", "elf.dynsym_funcs[36].name": "strerror", "elf.dynsym_funcs[37].kind": "func", "elf.dynsym_funcs[37].name": "strlen", "elf.dynsym_funcs[38].kind": "func", "elf.dynsym_funcs[38].name": "strncat", "elf.dynsym_funcs[39].kind": "func", "elf.dynsym_funcs[39].name": "strncmp", "elf.dynsym_funcs[40].kind": "func", "elf.dynsym_funcs[40].name": "strncpy", "elf.dynsym_funcs[41].kind": "func", "elf.dynsym_funcs[41].name": "strrchr", "elf.dynsym_funcs[42].kind": "func", "elf.dynsym_funcs[42].name": "strstr", "elf.dynsym_funcs[43].kind": "func", "elf.dynsym_funcs[43].name": "strtok", "elf.dynsym_funcs[44].kind": "func", "elf.dynsym_funcs[44].name": "strtoul", "elf.dynsym_funcs[45].kind": "func", "elf.dynsym_funcs[45].name": "tolower", "elf.dynsym_funcs[46].kind": "func", "elf.dynsym_funcs[46].name": "toupper", "elf.dynsym_funcs[47].kind": "func", "elf.dynsym_funcs[47].name": "wait", "elf.dynsym_funcs[48].kind": "func", "elf.dynsym_funcs[48].name": "wcschr", "elf.dynsym_funcs[49].kind": "func", "elf.dynsym_funcs[49].name": "wcscmp", "elf.dynsym_funcs[50].kind": "func", "elf.dynsym_funcs[50].name": "wcslen", "elf.dynsym_funcs[51].kind": "func", "elf.dynsym_funcs[51].name": "wcsncat", "elf.dynsym_funcs[52].kind": "func", "elf.dynsym_funcs[52].name": "wcsncmp", "elf.dynsym_funcs[53].kind": "func", "elf.dynsym_funcs[53].name": "wcstombs", "elf.dynsym_funcs[54].kind": "func", "elf.dynsym_funcs[54].name": "wctomb", "elf.segments[0].flags_hex": "5", "elf.segments[1].flags_hex": "4", "elf.segments[2].flags_hex": "5", "elf.segments[3].flags_hex": "6", "elf.segments[4].flags_hex": "6", "elf.segments[5].flags_hex": "4", "elf.segments[6].flags_hex": "4", "elf.segments[7].flags_hex": "6", "elf.segments[8].flags_hex": "4", "elf.needed_versions[0].lib": "libm.so.6", "elf.needed_versions[1].lib": "libpthread.so.0", "elf.needed_versions[2].lib": "libc.so.6", "elf.dynsym_funcs[1].binding": "weak", "elf.stripped_metadata_sections[0]": ".note.GNU-stack", "elf.stripped_metadata_sections[1]": ".note.gnu.property", "elf.needed_versions[0].versions[0]": "GLIBC_2.2.5", "elf.needed_versions[1].versions[0]": "GLIBC_2.2.5", "elf.needed_versions[2].versions[0]": "GLIBC_2.14", "elf.needed_versions[2].versions[1]": "GLIBC_2.2.5" }, "x": 6, "id": 0, "is": [ "", "free", "wcscmp", "pthread_create", "pthread_detach", "errno_location", "strncpy", "remove", "strncmp", "ITM_deregisterTMCloneTable", "toupper", "ferror", "qsort", "mbstowcs", "wcsncat", "fclose", "ctype_get_mb_cur_max", "strlen", "strchr", "wcslen", "strrchr", "fputs", "memset", "pow", "strncat", "fputc", "libc_start_main", "fgets", "calloc", "strcmp", "fprintf", "feof", "gmon_start__", "memcpy", "sysv_signal", "tolower", "malloc", "fseek", "setlocale", "wctomb", "fopen", "wcschr", "strtok", "Jv_RegisterClasses", "rename", "strtoul", "atoi", "wcstombs", "strcat", "exit", "fwrite", "ITM_registerTMCloneTable", "execlp", "strerror", "sleep", "wcsncmp", "wait", "cxa_finalize", "fork", "strstr" ], "ms": { "elf": { "entry": 5552.0, "relro": "partial", "e_type": 3.0, "needed": [ "libm.so.6", "libpthread.so.0", "libc.so.6" ], "has_got": true, "has_plt": true, "has_note": true, "e_machine": 62.0, "relacount": 3.0, "class_bits": 64.0, "dt_flags_1": 134217728.0, "note_count": 2.0, "nx_enabled": true, "needed_libs": 3.0, "dynsym_count": 63.0, "has_build_id": true, "has_eh_frame": true, "has_gnu_hash": true, "symtab_count": 173.0, "dynrela_count": 12.0, "entry_section": ".text", "little_endian": true, "section_count": 31.0, "pltreloc_count": 53.0, "build_id_length": 20.0, "dt_versym_count": 63.0, "has_interpreter": true, "fini_array_count": 1.0, "init_array_count": 1.0, "gnu_abi_min_kernel": "2.6.32", "comment_entry_count": 1.0, "program_header_count": 9.0, "comment_distinct_count": 1.0, "gnu_stack_section_absent": true, "load_segment_max_p_memsz": 58740.0, "load_segment_max_p_filesz": 58740.0, "stripped_but_symtab_present": true, "section_relocation_group_count": 2.0, "stripped_metadata_section_count": 2.0 }, "file": { "size": 70736.0 }, "binary": { "code_size": 45098.0, "func_count": 97.0, "has_overlay": true, "code_entropy": 3.83, "data_entropy": 2.87, "export_count": 63.0, "func_density": 2.2, "import_count": 60.0, "overlay_size": 1987.0, "string_count": 355.0, "avg_func_size": 458.67, "overlay_ratio": 0.03, "section_count": 30.0, "avg_complexity": 9.09, "import_density": 1.36, "max_complexity": 259.0, "string_density": 8.06, "aliased_exports": 54.0, "overall_entropy": 2.76, "overlay_entropy": 1.51, "avg_basic_blocks": 14.79, "avg_section_size": 2242.33, "dependency_count": 3.0, "entropy_variance": 1.57, "avg_string_length": 25.07, "complexity_per_kb": 0.21, "dynsym_func_count": 55.0, "has_provenance_id": true, "max_string_length": 169.0, "avg_string_entropy": 3.38, "code_to_data_ratio": 2.03, "data_to_file_ratio": 0.0, "text_to_file_ratio": 0.62, "total_basic_blocks": 1435.0, "func_analysis_depth": 2.0, "internal_func_count": 42.0, "provenance_id_length": 20.0, "string_length_stddev": 20.31, "largest_section_ratio": 0.62, "sentence_string_count": 132.0, "sentence_string_ratio": 0.37, "behavioral_import_ratio": 0.08, "high_complexity_func_count": 4.0 } }, "ss": [ [ 568, "/lib64/ld-linux-x86-64.so.2" ], [ 2235, "_ITM_deregisterTMCloneTable" ], [ 2263, "__gmon_start__" ], [ 2278, "_Jv_RegisterClasses" ], [ 2298, "_ITM_registerTMCloneTable" ], [ 2328, "libpthread.so.0" ], [ 2344, "wait" ], [ 2349, "__errno_location" ], [ 2366, "pthread_create" ], [ 2381, "pthread_detach" ], [ 2406, "exit" ], [ 2411, "setlocale" ], [ 2421, "fopen" ], [ 2427, "strncmp" ], [ 2435, "strrchr" ], [ 2443, "strncpy" ], [ 2451, "mbstowcs" ], [ 2471, "tolower" ], [ 2479, "__ctype_get_mb_cur_max" ], [ 2502, "strtok" ], [ 2509, "feof" ], [ 2514, "execlp" ], [ 2527, "calloc" ], [ 2534, "strlen" ], [ 2548, "memset" ], [ 2562, "fseek" ], [ 2568, "toupper" ], [ 2576, "stdout" ], [ 2595, "memcpy" ], [ 2602, "fclose" ], [ 2616, "strtoul" ], [ 2624, "malloc" ], [ 2631, "strcat" ], [ 2638, "remove" ], [ 2645, "wcsncat" ], [ 2653, "stderr" ], [ 2660, "strncat" ], [ 2668, "__sysv_signal" ], [ 2682, "fwrite" ], [ 2689, "rename" ], [ 2696, "atoi" ], [ 2708, "fprintf" ], [ 2722, "wcstombs" ], [ 2731, "sleep" ], [ 2737, "__cxa_finalize" ], [ 2759, "strerror" ], [ 2768, "__libc_start_main" ], [ 2786, "ferror" ], [ 2793, "wcslen" ], [ 2800, "wcsncmp" ], [ 2808, "wctomb" ], [ 2815, "free" ], [ 2832, "GLIBC_2.14" ], [ 11132, "ATSH" ], [ 21552, "stack", ".txt" ], [ 21554, ".txt" ], [ 21685, "stack", ".txt" ], [ 22651, "stack", ".lzm" ], [ 22653, ".lzmf" ], [ 42620, "stack", "STAR" ], [ 50256, "alloc_wide_string: Can't allocate mem!" ], [ 50304, "Error: wcstombs() failed. This shouldn't have happened." ], [ 50368, "Warning: wctomb failed for char U+%04lX" ], [ 50416, "fill_minmax_strings: can't allocate memory for last_min" ], [ 50480, "fill_minmax_strings: can't allocate memory for first_max" ], [ 50544, "fill_minmax_strings: can't allocate memory for min_string" ], [ 50608, "fill_minmax_strings: can't allocate memory for max_string" ], [ 50672, "fill_pattern_info: can't allocate memory for pattern info" ], [ 50736, "fill_pattern_info: options-\u003epattern is NULL!" ], [ 50784, "fill_pattern_info: Internal error: Can't find char at pos #%lu in cset" ], [ 50856, "Error: pattern is unexpectedly NULL in unicode size calc sanity check" ], [ 50928, "increment: SOMETHING REALLY BAD HAPPENED" ], [ 50992, "crunch: %3llu%% completed generating output" ], [ 51040, "crunch: %3d%% completed generating output" ], [ 51088, "rename: can't allocate memory for finalnewfile" ], [ 51136, "rename: can't allocate memory for newfile" ], [ 51184, "rename: can't allocate memory for comptype" ], [ 51232, "rename: can't allocate memory for compoutput" ], [ 51280, "Error renaming file. Status1 = %d Code = %d" ], [ 51327, "The problem is = %s" ], [ 51352, "rename: File START could not be opened" ], [ 51392, "rename: fclose returned error number = %d" ], [ 51440, "Error renaming file. Status2 = %d Code = %d" ], [ 51496, "Beginning lzma compression. Please wait." ], [ 51548, "bzip2" ], [ 51560, "Beginning bzip2 compression. Please wait." ], [ 51616, "Beginning gzip compression. Please wait." ], [ 51672, "Error compressing file. Status = %d Code = %d" ], [ 51728, "Error deleting file. Status = %d Code = %d" ], [ 51784, "Error: wctomb failed for char U+%04lX" ], [ 51824, "permute: can't allocate memory for block2" ], [ 51872, "permute: File START could not be opened" ], [ 51920, "permute: fclose returned error number = %d" ], [ 51968, "permute2: Ouput file START could not be opened" ], [ 52016, "permute2: can't allocate memory for block2" ], [ 52064, "permute: something really bad happened!" ], [ 52112, "permute2: fclose returned error number = %d" ], [ 52160, "permute2: something really bad happened!" ], [ 52208, "permute2: fprintf failed = %d" ], [ 52240, "permute3: fclose returned error number = %d" ], [ 52288, "chunk: can't allocate memory for block2" ], [ 52336, "chunk1: File START could not be opened" ], [ 52376, "chunk1: fprintf failed = %d" ], [ 52408, "chunk1: fclose returned error number = %d" ], [ 52456, "chunk2: Ouput file START could not be opened" ], [ 52504, "chunk: something really bad happened" ], [ 52542, "chunk2: fprintf failed = %d" ], [ 52576, "chunk2: fclose returned error number = %d" ], [ 52619, "Crunch ending at %s" ], [ 52640, "crunch version %s" ], [ 52664, "Crunch can create a wordlist based on criteria you specify. The outout from crunch can be sent to the screen, file, or to anoth" ], [ 52808, "Usage: crunch \u003cmin\u003e \u003cmax\u003e [options]" ], [ 52848, "where min and max are numbers" ], [ 52880, "Please refer to the man page for instructions and examples on how to use crunch." ], [ 52968, "resume: File START could not be opened" ], [ 53008, "resume: fclose returned error number = %d" ], [ 53051, "Resuming from = %s" ], [ 53072, "readcharset: File %s could not be opened" ], [ 53120, "readcharset: can't allocate memory for charset" ], [ 53176, "readcharset: fclose returned error number = %d" ], [ 53224, "readpermute: File %s could not be opened" ], [ 53272, "readpermute: can't allocate memory for wordarray1" ], [ 53328, "readpermute: fclose returned error number = %d" ], [ 53376, "Error: setlocale() failed" ], [ 53424, "Error: Failed to allocate memory" ], [ 53464, "crunch: can't allocate memory for default charset" ], [ 53520, "crunch: can't allocate memory for default upp_charset" ], [ 53576, "crunch: can't allocate memory for default num_charset" ], [ 53632, "crunch: can't allocate memory for default sym_charset" ], [ 53688, "crunch: can't allocate memory for user charset" ], [ 53736, "crunch: can't allocate memory for upp_charset" ], [ 53784, "crunch: can't allocate memory for num_charset" ], [ 53832, "crunch: can't allocate memory for sym_charset" ], [ 53880, "Starting length is greater than the ending length" ], [ 53936, "Crunch can only make words with a length of less than %d characters" ], [ 54032, "ERROR: Your system is unable to process numbers greater than 4.294.967.295. Please specify a filesize \u003c= 4GiB." ], [ 54144, "bvalue has a serious problem" ], [ 54174, "Please specify a value" ], [ 54208, "WARNING: resulting file will probably be larger than 2GB" ], [ 54272, "Some applications (john the ripper) can't use wordlists greater than 2GB" ], [ 54346, "A value of %lu" ], [ 54368, "or less should result in a file less than 2GB" ], [ 54416, "The above value is calcualated based on 2147483648UL/max" ], [ 54480, "Please specify the number of lines you want" ], [ 54528, "-d must be followed by [n][@,%%^]" ], [ 54568, "the type of duplicates must be one of [@,%%^]" ], [ 54616, "Please specify the type of duplicates to skip" ], [ 54672, "Error: Can;t allocate mem for endstring" ], [ 54720, "Please specify the string you want crunch to stop at" ], [ 54776, "can't allocate memory for charsetfilename" ], [ 54819, "charset = %s not found in %s" ], [ 54856, "can't allocate memory for wordarray1" ], [ 54896, "can't allocate memory for wordarray2" ], [ 54936, "upp_charset = %s not found in %s" ], [ 54976, "num_charset = %s not found in %s" ], [ 55016, "sym_charset = %s not found in %s" ], [ 55056, "Please specify a filename and character set" ], [ 55112, "Please specify a list of characters you want to treat as literal @?%%^" ], [ 55192, "crunch: can't allocate memory for fpath1" ], [ 55234, "START" ], [ 55240, "crunch: can't allocate memory for fpath2" ], [ 55288, "Please specify a output filename" ], [ 55328, "can't allocate memory for wordarray3" ], [ 55368, "Please specify a word or words to permute" ], [ 55416, "Please specify a filename for permute to read" ], [ 55472, "Warning: minimum length should be %d" ], [ 55512, "Please specify the word you wish to start at" ], [ 55568, "The maximum and minimum length should be the same size as the pattern you specified." ], [ 55656, "min = %d max = %d strlen(%s)=%d" ], [ 55691, "Please specify a pattern" ], [ 55720, "Disabling printpercentage thread. NOTE: MUST be last option" ], [ 55792, "Only gzip, bzip2, lzma, and 7z are supported" ], [ 55840, "you must specify -t when using -l" ], [ 55880, "Length of literal string should be the same length as pattern^" ], [ 55944, "you must use -o START if you specify a count" ], [ 55992, "End string length must equal maximum string size" ], [ 56048, "End string must be greater than start string" ], [ 56096, "can't allocate memory for literalstring" ], [ 56144, "startblock is not valid according to the pattern/literalstring" ], [ 56208, "endstring is not valid according to the pattern/literalstring" ], [ 56272, "Error: End string set by -e will never occur (too many duplicate chars)" ], [ 56352, "Notice: Detected unicode characters. If you are piping crunch output\nto another program such as john or aircrack please make su" ], [ 56422, "to another program such as john or aircrack please make sure that program" ], [ 56496, "can handle unicode input." ], [ 56528, "Do you want to continue? [Y/n]" ], [ 56560, "Aborted by user." ], [ 56584, "you cannot specify a startblock and resume" ], [ 56632, "permute doesn't support resume" ], [ 56664, "Crunch will now generate the following amount of data:" ], [ 56720, "%llu bytes" ], [ 56732, "%llu MB" ], [ 56741, "%llu GB" ], [ 56750, "%llu TB" ], [ 56759, "%llu PB" ], [ 56768, "Crunch will now generate the following number of lines:" ], [ 56832, "pthread_create error is %d" ], [ 56864, "Internal error: wordarray is NULL (it shouldn't be)" ], [ 56920, "Crunch will now generate approximately the following amount of data:" ], [ 61904, "GCC: (Debian 6.3.0-14) 6.3.0 20170415" ], [ 66097, "crtstuff.c" ], [ 66108, "__JCR_LIST__" ], [ 66121, "deregister_tm_clones" ], [ 66142, "__do_global_dtors_aux" ], [ 66164, "completed.6963" ], [ 66179, "__do_global_dtors_aux_fini_array_entry" ], [ 66218, "frame_dummy" ], [ 66230, "__frame_dummy_init_array_entry" ], [ 66261, "crunch.c" ], [ 66270, "def_low_charset" ], [ 66286, "def_upp_charset" ], [ 66302, "def_num_charset" ], [ 66318, "def_sym_charset" ], [ 66334, "version" ], [ 66346, "numofelements" ], [ 66360, "inverted" ], [ 66369, "linecount" ], [ 66379, "bytecount" ], [ 66389, "ctrlbreak" ], [ 66404, "output_unicode" ], [ 66419, "suppress_finalsize" ], [ 66438, "gconvbuffer" ], [ 66450, "gconvlen" ], [ 66459, "my_thread" ], [ 66469, "wcstring_cmp" ], [ 66482, "ex_program" ], [ 66493, "force_wide_string" ], [ 66511, "make_wide_string" ], [ 66528, "alloc_wide_string" ], [ 66546, "force_narrow_string" ], [ 66566, "make_narrow_string" ], [ 66585, "getmblen" ], [ 66594, "dupwcs" ], [ 66601, "check_member" ], [ 66614, "find_index" ], [ 66625, "fill_minmax_strings" ], [ 66645, "fill_pattern_info" ], [ 66663, "fill_next_count" ], [ 66679, "calculate_with_dupes" ], [ 66700, "calculate_simple" ], [ 66717, "calculate_with_pattern" ], [ 66740, "count_strings" ], [ 66754, "finished" ], [ 66763, "too_many_duplicates" ], [ 66783, "increment" ], [ 66793, "PrintPercentage" ], [ 66809, "renamefile" ], [ 66820, "printpermutepattern" ], [ 66840, "Permute" ], [ 66848, "Permutefilesize" ], [ 66864, "loadstring" ], [ 66887, "resumesession" ], [ 66901, "readcharsetfile" ], [ 66917, "readpermute" ], [ 66929, "copy_without_dupes" ], [ 66948, "__FRAME_END__" ], [ 66962, "__JCR_END__" ] ], "sz": 70736, "ts": [ { "c": 1.0, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "l": 2 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 2.76" ], "i": "metadata/binary/metrics/threshold::low-overall-entropy-binary", "l": 1 }, { "c": 0.6600000262260437, "d": "Reference to /lib64", "e": [ "/lib64/ld-linux-x86-64.so.2" ], "i": "micro-behaviors/fs/path/system::system-lib64", "l": 2 }, { "c": 0.6600000262260437, "d": "Open files", "e": [ "fopen" ], "i": "micro-behaviors/fs/file/open::fopen", "l": 2 }, { "c": 0.8999999761581421, "d": "ELF dynstr section name", "e": [ ".dynstr" ], "i": "metadata/binary/linking/static::elf-dynstr-section-name", "l": 2 }, { "a": "T1005", "d": "fseek API string", "e": [ "fseek" ], "i": "micro-behaviors/fs/file/binary::fseek-text", "l": 2 }, { "c": 0.8999999761581421, "d": "ELF dynamic section name", "e": [ ".dynamic" ], "i": "metadata/binary/linking/static::elf-dynamic-section-name", "l": 2 }, { "c": 1.0, "d": "Binary has 20+ exports", "e": [ "binary.export_count = 63.00" ], "i": "metadata/binary/metrics/threshold::many-exports-20", "l": 1 }, { "c": 0.6600000262260437, "d": "Write single bytes to file", "e": [ "fputc" ], "i": "micro-behaviors/fs/file/write/direct::fputc", "l": 2 }, { "d": "Characteristic system library exports", "e": [ "libc_start_main" ], "i": "micro-behaviors/dylib/library/libc::libc-characteristic-symbols", "l": 2 }, { "c": 0.9399999976158142, "d": "Regex component marker", "e": [ ".so" ], "i": "objectives/evasion/kernel-hide/userspace::runtime-shared-object-compile--rx-1", "l": 1 }, { "c": 0.949999988079071, "d": "ELF declares DT_RELACOUNT (relative relocations)", "e": [ "elf.relacount = 3.00" ], "i": "metadata/binary/anomaly/format::elf-relacount-present", "l": 2 }, { "c": 0.6600000262260437, "d": "Write files", "e": [ "fwrite" ], "i": "micro-behaviors/fs/file/write/direct::write", "l": 2 }, { "c": 1.0, "d": "ELF needed library metadata", "e": [ "[libm.so.6, libpthread.so.0, libc.so.6]" ], "i": "metadata/binary/linking/runtime::needed-lib", "l": 2 }, { "c": 0.800000011920929, "d": "libc version string pattern", "e": [ "GLIBC" ], "i": "micro-behaviors/dylib/library/libc::libc-version-string", "l": 2 }, { "d": "Usage: label in binary strings", "e": [ "Usage: crunch \u003cmin\u003e \u003cmax\u003e [options]" ], "i": "metadata/package/help::usage-title-string", "l": 1 }, { "c": 0.6200000047683716, "d": "fopen API string", "e": [ "fopen" ], "i": "micro-behaviors/fs/file/open::fopen-text", "l": 2 }, { "c": 1.0, "d": "Binary format is identified", "e": [ "elf.class_bits = 64.00" ], "i": "metadata/binary/layout::binary-format-checked", "l": 2 }, { "c": 0.800000011920929, "d": "C-style exec family functions", "e": [ "execlp" ], "i": "micro-behaviors/process/create/execv::c-exec-variants", "l": 3 }, { "c": 0.8999999761581421, "d": "ELF interpreter section name", "e": [ ".interp" ], "i": "metadata/binary/linking/static::elf-interpreter-section-name", "l": 2 }, { "c": 0.699999988079071, "d": "ELF built without stack canary", "e": [ "elf.stack_canary = 0.00" ], "i": "metadata/binary/anomaly/provenance::no-stack-canary", "l": 1 }, { "c": 0.800000011920929, "d": "Binary has many sentence-like strings", "e": [ "binary.sentence_string_ratio = 0.37" ], "i": "metadata/binary/metrics/threshold::rich-sentence-strings-20pct", "l": 1 }, { "c": 0.4000000059604645, "d": "Terminate process immediately without cleanup", "e": [ "exit" ], "i": "micro-behaviors/process/terminate/signal::_exit", "l": 2 }, { "c": 0.30000001192092896, "d": "lzma compression reference", "e": [ "lzma" ], "i": "micro-behaviors/dylib/library/family::lzma-ref", "l": 2 }, { "c": 0.699999988079071, "d": "ELF .note.GNU-stack section absent", "e": [ "elf.gnu_stack_section_absent = 1.00" ], "i": "metadata/binary/anomaly/format::elf-gnu-stack-section-absent", "l": 2 }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.func_count = 97.00" ], "i": "metadata/binary/metrics/structural::many-functions", "l": 2 }, { "c": 0.699999988079071, "d": "ELF symbol tables stripped from binary", "e": [ "elf.stripped_metadata_section_count = 2.00" ], "i": "metadata/binary/anomaly/provenance::stripped-symbol-tables", "l": 1 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 9.09" ], "i": "metadata/binary/metrics/threshold::avg-complexity-15-max", "l": 2 }, { "c": 0.800000011920929, "d": "Binary has many exports (\u003e10)", "e": [ "binary.export_count = 63.00" ], "i": "metadata/binary/metrics/structural::many-exports", "l": 2 }, { "c": 1.0, "d": "ELF64 class marker", "e": [ "elf.class_bits = 64.00" ], "i": "metadata/binary/metrics/structural::elf64-class", "l": 1 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 60.00" ], "i": "metadata/binary/metrics/threshold::many-imports-25", "l": 1 }, { "c": 0.8399999737739563, "d": "High basic block count in sparse binary", "e": [ "binary.total_basic_blocks = 1435.00" ], "i": "metadata/binary/metrics/structural::dense-basic-blocks", "l": 1 }, { "c": 0.699999988079071, "d": "ELF built with only partial RELRO", "e": [ "partial" ], "i": "metadata/binary/anomaly/provenance::partial-relro", "l": 1 }, { "c": 0.75, "d": "String to integer conversion (atoi)", "e": [ "atoi" ], "i": "micro-behaviors/data/string/conversion::atoi", "l": 1 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 60.00" ], "i": "metadata/binary/metrics/threshold::many-imports-50", "l": 1 }, { "c": 1.0, "d": "Binary has 20+ sections (installer/packer)", "e": [ "binary.section_count = 30.00" ], "i": "metadata/binary/metrics/threshold::many-sections-20", "l": 1 }, { "d": "Binary exports symbols", "e": [ "binary.export_count = 63.00" ], "i": "metadata/binary/symbols/exports::has-exports", "l": 1 }, { "c": 0.6600000262260437, "d": "Process forking", "e": [ "fork" ], "i": "micro-behaviors/process/fork/clone::fork", "l": 2 }, { "d": "Usage: label (title case)", "e": [ "Usage: crunch \u003cmin\u003e \u003cmax\u003e [options]" ], "i": "metadata/package/help::usage-title", "l": 2 }, { "c": 1.0, "d": "Binary has 9+ exports", "e": [ "binary.export_count = 63.00" ], "i": "metadata/binary/metrics/threshold::many-exports-9", "l": 1 }, { "c": 1.0, "d": "Line-based file reading (fgets)", "e": [ "fgets" ], "i": "micro-behaviors/process/create/direct::fgets-loop", "l": 2 }, { "c": 0.8999999761581421, "d": "ELF dynsym section name", "e": [ ".dynsym" ], "i": "metadata/binary/linking/static::elf-dynsym-section-name", "l": 2 }, { "d": "Characteristic system library export __cxa_finalize", "e": [ "cxa_finalize" ], "i": "micro-behaviors/dylib/library/libc::libc-characteristic-cxa-finalize", "l": 2 }, { "c": 1.0, "d": "ELF program interpreter metadata", "e": [ "/lib64/ld-linux-x86-64.so.2" ], "i": "metadata/binary/linking/runtime::interpreter", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.func_count = 97.00" ], "i": "metadata/binary/metrics/threshold::many-functions-50", "l": 1 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "8393587a1ccf98b84f362da2631361ca758fcdee500eab81c0ee8104ae048ea8.elf" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "d": "pthread threading library", "e": [ "pthread_create", "pthread_create@@GLIBC_2.2.5", "sym.imp.pthread_create" ], "i": "micro-behaviors/process/threading/concurrency::pthread", "l": 2 }, { "a": "T1059.004", "c": 0.9300000071525574, "d": "Regex component marker", "e": [ "Usage: " ], "i": "objectives/command-and-control/reverse-shell/pty::pty-dual-mode-backdoor-cond-0--inline-10025", "l": 1, "m": "B0024" }, { "c": 0.30000001192092896, "d": "Delete files", "e": [ "remove" ], "i": "micro-behaviors/fs/file/delete::remove", "l": 3 }, { "c": 0.6600000262260437, "d": "Rename files", "e": [ "rename" ], "i": "micro-behaviors/fs/file/rename::rename-base", "l": 2 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 60.00" ], "i": "metadata/binary/metrics/threshold::many-imports-40", "l": 1 }, { "c": 0.30000001192092896, "d": "Sleep for specified duration", "e": [ "sleep" ], "i": "micro-behaviors/time/query::sleep-func", "l": 2 }, { "c": 1.0, "d": "ELF GNU build-id metadata", "e": [ "79912731c9cdcc6d61eff0284d55bf721b8bfc36" ], "i": "metadata/build/reproducible::elf-build-id", "l": 2 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.38" ], "i": "metadata/binary/metrics/threshold::avg-string-entropy-4-max", "l": 2 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.func_count = 97.00" ], "i": "metadata/binary/metrics/threshold::few-functions-3", "l": 1 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 60.00" ], "i": "metadata/binary/metrics/threshold::many-imports-30", "l": 1 }, { "c": 1.0, "d": "ELF has program interpreter", "e": [ "elf.has_interpreter = 1.00" ], "i": "metadata/binary/layout::has-interpreter", "l": 2 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 60.00" ], "i": "metadata/binary/metrics/threshold::many-imports-20", "l": 1 }, { "a": "T1005", "c": 0.4000000059604645, "d": "Seeks to position in file", "e": [ "sym.imp.fseek", "fseek@@GLIBC_2.2.5", "fseek" ], "i": "micro-behaviors/fs/file/binary::fseek-func", "l": 2 }, { "d": "Characteristic system library export __errno_location", "e": [ "errno_location" ], "i": "micro-behaviors/dylib/library/libc::libc-characteristic-errno", "l": 2 }, { "c": 0.20000000298023224, "d": "output keyword", "e": [ "rename: can't allocate memory for compoutput", "…f you are piping crunch output\nto another program such…", "Please specify a output filename", "crunch: %3llu%% completed generating output", "crunch: %3d%% completed generating output", "output_unicode" ], "i": "micro-behaviors/data/text/keywords/lexicon::output", "l": 1 }, { "c": 0.6000000238418579, "d": "ELF stripped with .symtab present", "e": [ "elf.stripped_but_symtab_present = 1.00" ], "i": "metadata/build/artifact::elf-stripped-but-symtab-present", "l": 3 }, { "c": 0.8999999761581421, "d": "ELF dynstr section name", "e": [ ".dynstr" ], "i": "metadata/hardening/missing::elf-dynstr-section-name", "l": 2 }, { "c": 0.8999999761581421, "d": "No stack canary (stack smashing protection absent)", "e": [ "elf.stack_canary = 0.00" ], "i": "metadata/hardening/mitigation::no-stack-canary", "l": 3 }, { "c": 0.800000011920929, "d": "bzip2 string", "e": [ "bzip2" ], "i": "micro-behaviors/data/compress/library::bzip2-string", "l": 1 }, { "c": 0.8999999761581421, "d": "ELF interpreter section name", "e": [ ".interp" ], "i": "metadata/hardening/missing::elf-interpreter-section-name", "l": 2 }, { "c": 0.8999999761581421, "d": "ELF dynsym section name", "e": [ ".dynsym" ], "i": "metadata/hardening/missing::elf-dynsym-section-name", "l": 2 }, { "c": 0.8999999761581421, "d": "ELF dynamic section name", "e": [ ".dynamic" ], "i": "metadata/hardening/missing::elf-dynamic-section-name", "l": 2 }, { "a": "T1005", "c": 0.699999988079071, "d": "Binary file read/write operations", "e": [ "sym.imp.fseek", "fseek", "fseek@@GLIBC_2.2.5", "fseek" ], "i": "micro-behaviors/fs/file/binary::binary-read-write-ops", "l": 3 }, { "a": "T1005", "c": 0.75, "d": "File content manipulation (read/write/seek)", "e": [ "fwrite", "fseek@@GLIBC_2.2.5", "fseek", "sym.imp.fseek", "fseek" ], "i": "micro-behaviors/fs/file/binary::file-manipulation", "l": 3 }, { "c": 0.8500000238418579, "d": "Documented command line program", "e": [ "Usage: crunch \u003cmin\u003e \u003cmax\u003e [options]", "binary.import_count = 60.00", "binary.sentence_string_ratio = 0.37" ], "i": "metadata/package/help::documented-cli-binary", "l": 1 }, { "c": 0.8500000238418579, "d": "ELF hardening profile suggests private", "e": [ "elf.stripped_metadata_section_count = 2.00", "elf.stack_canary = 0.00", "partial" ], "i": "metadata/binary/anomaly/provenance::private-build-hardening-profile", "l": 3 } ], "sha": "8393587a1ccf98b84f362da2631361ca758fcdee500eab81c0ee8104ae048ea8", "path": "8393587a1ccf98b84f362da2631361ca758fcdee500eab81c0ee8104ae048ea8.elf", "type": "elf" } ], "tv": "529a0" } }