{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9214929938316345, "class": 0 } ], "prob": 0.921493, "class": 0, "version": "v16.16", "thresholds": [ 0.9815004, 0.99404883 ], "analyzed_at": "2026-05-01T23:35:55Z" }, "path": "x86__64__lsb__unix-system-v__clang-3.8.0__O1__no-obf__unstripped__acpid-2.0.31__acpi_listen.o", "raw": { "v": "4", "fs": [ { "f": "O₂(AsEr)Md₃(Bi₃HePa)", "x": 3, "id": 0, "ms": { "elf": { "e_type": 1.0, "has_note": true, "e_machine": 62.0, "class_bits": 64.0, "has_eh_frame": true, "symtab_count": 42.0, "little_endian": true, "section_header_count": 15.0, "section_relocation_group_count": 4.0 }, "binary": { "code_size": 1299.0, "file_size": 7224.0, "has_overlay": true, "code_entropy": 4.87, "data_entropy": 1.49, "export_count": 1.0, "overlay_size": 963.0, "string_count": 63.0, "overlay_ratio": 0.13, "section_count": 13.0, "avg_complexity": 8.2, "function_count": 5.0, "max_complexity": 13.0, "string_density": 49.66, "overall_entropy": 2.32, "overlay_entropy": 1.13, "avg_basic_blocks": 13.0, "avg_section_size": 477.46, "entropy_variance": 1.87, "function_density": 3.94, "avg_function_size": 254.2, "avg_string_length": 12.27, "complexity_per_kb": 6.46, "max_string_length": 44.0, "avg_string_entropy": 2.87, "code_to_data_ratio": 0.26, "data_to_file_ratio": 0.05, "text_to_file_ratio": 0.48, "total_basic_blocks": 65.0, "string_length_stddev": 8.69, "largest_section_ratio": 0.3, "sentence_string_count": 11.0, "sentence_string_ratio": 0.17, "function_analysis_depth": 2.0, "nonstandard_section_name_count": 4.0 } }, "ss": [ [ 64, "AWAVATSH" ], [ 480, "AWAVATSPI" ], [ 768, "UAWAVAUATSPA" ], [ 1120, "UAWAVAUATSPI" ], [ 1363, "/var/run/acpid.socket" ], [ 1385, "%s: can't open socket %s: %s" ], [ 1419, "connection closed" ], [ 1438, "too many errors - aborting" ], [ 1475, "acpid-2.0.31" ], [ 1489, "count" ], [ 1495, "socketfile" ], [ 1506, "time" ], [ 1511, "version" ], [ 1524, "Usage: %s [OPTIONS]" ], [ 1565, "Set the maximum number of events." ], [ 1599, "Use the specified socket file." ], [ 1630, "Listen for the specified time (in seconds)." ], [ 1674, "Print version information." ], [ 1701, "Print this message." ], [ 1721, "ERR: malloc(%d): %s" ], [ 1742, "ERR: read(): %s" ], [ 2025, "clang version 3.8.0 (tags/RELEASE_380/final)" ], [ 5833, ".rela.text" ], [ 5844, "stdout" ], [ 5851, ".comment" ], [ 5860, "exit" ], [ 5865, "memset" ], [ 5872, "ud_connect" ], [ 5893, "max_events" ], [ 5904, ".bss" ], [ 5909, "main.nerrs" ], [ 5920, "stderr" ], [ 5927, "strerror" ], [ 5936, "strrchr" ], [ 5944, "opts_help" ], [ 5954, "__errno_location" ], [ 5971, "main" ], [ 5976, "strlen" ], [ 5983, "alarm" ], [ 5989, "signal" ], [ 5996, ".note.GNU-stack" ], [ 6012, "atoi" ], [ 6017, "optarg" ], [ 6024, "getopt_long" ], [ 6036, "setvbuf" ], [ 6044, "read_line.buf" ], [ 6058, "fprintf" ], [ 6066, "fwrite" ], [ 6073, "handle_cmdline" ], [ 6088, "read_line" ], [ 6098, ".rela.eh_frame" ], [ 6113, "progname" ], [ 6139, "optind" ], [ 6146, "time_expired" ], [ 6159, "read" ], [ 6170, "realloc" ], [ 6178, "__ctype_b_loc" ], [ 6192, "acpi_listen.c" ], [ 6206, ".strtab" ], [ 6214, ".symtab" ], [ 6222, ".rela.rodata" ], [ 6235, ".rela.data" ], [ 6246, ".rodata.str1.1" ] ], "sz": 7224, "ts": [ { "c": 1.0, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "l": 2 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 2.87" ], "i": "metadata/binary/metrics::avg-string-entropy-4-max", "l": 2 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.function_count = 5.00" ], "i": "metadata/binary/metrics::few-functions-3", "l": 1 }, { "c": 1.0, "d": "Binary format is identified", "e": [ "elf.class_bits = 64.00" ], "i": "metadata/binary::binary-format-checked", "l": 2 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 2.32" ], "i": "metadata/binary/metrics::low-overall-entropy-binary", "l": 1 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "binary.file_size = 7224.00" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Options usage text", "e": [ "Usage: %s [OPTIONS]" ], "i": "objectives/anti-static/obfuscation/binary-metrics::options-usage-string", "l": 1, "m": "B0032" }, { "a": "T1106", "c": 0.949999988079071, "d": "ELF ET_DYN binary type", "e": [ "elf.e_type = 1.00" ], "i": "objectives/evasion/anti-av/syscall::elf-et-dyn", "l": 1, "m": "B0009" }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening::no-pie", "l": 2 }, { "c": 1.0, "d": "ELF64 class marker", "e": [ "elf.class_bits = 64.00" ], "i": "metadata/binary/metrics::elf64-class", "l": 1 }, { "d": "Binary exports symbols", "e": [ "binary.export_count = 1.00" ], "i": "metadata/binary/symbols::has-exports", "l": 1 }, { "c": 0.4000000059604645, "d": "Very few functions detected", "e": [ "binary.function_count = 5.00" ], "i": "metadata/binary/metrics::few-functions", "l": 2 }, { "c": 0.800000011920929, "d": "Compiler/project context token", "e": [ "clang version" ], "i": "micro-behaviors/dylib/library::llvm-project-ref-b", "l": 2 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 8.20" ], "i": "metadata/binary/metrics::avg-complexity-15-max", "l": 2 }, { "d": "Usage: label in binary strings", "e": [ "Usage: %s [OPTIONS]" ], "i": "metadata/package/help::usage-title-string", "l": 1 }, { "c": 0.8999999761581421, "d": "ELF imports zero needed libraries", "e": [ "binary.dependency_count = 0.00" ], "i": "metadata/binary/linking::elf-needed-libs-zero", "l": 2 }, { "c": 0.6000000238418579, "d": "Small ELF binary (\u003c 50KB)", "e": [ "x86__64__lsb__unix-system-v__clang-3.8.0__O1__no-obf__unstripped__acpid-2.0.31__acpi_listen.o" ], "i": "metadata/binary/metrics::small-elf-binary", "l": 2 }, { "c": 0.6000000238418579, "d": "Binary not position-independent (no ASLR)", "e": [ "elf.e_type = 1.00" ], "i": "metadata/hardening::no-pie-struct", "l": 3 }, { "c": 0.75, "d": "ELF lacks dynamic linker sections", "e": [ "elf.class_bits = 64.00" ], "i": "metadata/hardening::static-linked-heuristic", "l": 3 }, { "c": 0.75, "d": "ELF lacks dynamic linker sections", "e": [ "elf.class_bits = 64.00" ], "i": "metadata/binary/linking::static-linked-heuristic", "l": 3 }, { "c": 0.800000011920929, "d": "Statically linked binary", "e": [ "binary.dependency_count = 0.00", "elf.class_bits = 64.00" ], "i": "metadata/binary/linking::static-linked", "l": 3 } ], "sha": "925cd111f1f046da92b251b7a5e44b633f53c35eb09450eebaf72a79547a4236", "path": "/data/samples/good/datasets/Labeled-Elfs/benignware/x86__64__lsb__unix-system-v__clang-3.8.0__O1__no-obf__unstripped__acpid-2.0.31__acpi_listen.o", "type": "elf" } ], "tv": "2a0fe" } }