{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.022268146276474, "class": 0 } ], "prob": 0.022268146, "class": 0, "models": [ { "m": "az", "prob": 0.0064438917, "class": 0 }, { "m": "az/native", "prob": 0.022268146, "class": 0 }, { "m": "az/elf", "prob": 0.009000766, "class": 0 } ], "version": "v16.16", "thresholds": [ 0.9953178, 0.9991311 ], "analyzed_at": "2026-05-03T03:04:46Z" }, "path": "x86__64__lsb__unix-system-v__clang-3.8.0__Os__no-obf__unstripped__acpid-2.0.31__ud_socket.o", "raw": { "v": "4", "fs": [ { "f": "O₂(AsEr)Md₂(Bi₄He)", "x": 4, "id": 0, "ms": { "elf": { "e_type": 1.0, "has_note": true, "e_machine": 62.0, "class_bits": 64.0, "has_eh_frame": true, "symtab_count": 25.0, "little_endian": true, "section_header_count": 10.0, "section_relocation_group_count": 2.0 }, "binary": { "code_size": 687.0, "file_size": 3448.0, "has_overlay": true, "code_entropy": 4.99, "data_entropy": 4.34, "export_count": 4.0, "overlay_size": 640.0, "string_count": 31.0, "overlay_ratio": 0.19, "section_count": 8.0, "avg_complexity": 4.0, "function_count": 4.0, "max_complexity": 6.0, "string_density": 46.21, "overall_entropy": 3.3, "overlay_entropy": 1.01, "avg_basic_blocks": 6.0, "avg_section_size": 342.88, "entropy_variance": 1.51, "function_density": 5.96, "avg_function_size": 171.75, "avg_string_length": 14.32, "complexity_per_kb": 5.96, "max_string_length": 66.0, "avg_string_entropy": 2.95, "code_to_data_ratio": 0.33, "text_to_file_ratio": 0.41, "total_basic_blocks": 24.0, "string_length_stddev": 14.79, "largest_section_ratio": 0.21, "sentence_string_count": 4.0, "sentence_string_ratio": 0.13, "function_analysis_depth": 2.0, "nonstandard_section_name_count": 2.0 } }, "ss": [ [ 64, "UAVSH" ], [ 366, "UAWAVATSH" ], [ 751, "ud_create_socket(): socket filename longer than %zu characters: %s" ], [ 818, "fchmod() on socket %s: %s" ], [ 844, "ud_connect(): socket filename longer than %zu characters: %s" ], [ 906, "clang version 3.8.0 (tags/RELEASE_380/final)" ], [ 2537, "strncpy" ], [ 2545, "memcpy" ], [ 2552, ".rela.text" ], [ 2563, "getsockopt" ], [ 2574, "ud_accept" ], [ 2584, ".comment" ], [ 2593, "ud_create_socket" ], [ 2610, "ud_connect" ], [ 2621, "strerror" ], [ 2630, "__errno_location" ], [ 2647, "listen" ], [ 2654, "strlen" ], [ 2661, "strnlen" ], [ 2675, "unlink" ], [ 2682, ".note.GNU-stack" ], [ 2698, "acpid_log" ], [ 2708, "close" ], [ 2714, ".rela.eh_frame" ], [ 2729, "fchmod" ], [ 2741, "ud_get_peercred" ], [ 2757, "ud_socket.c" ], [ 2769, ".strtab" ], [ 2777, ".symtab" ], [ 2785, "accept4" ], [ 2793, ".rodata.str1.1" ] ], "sz": 3448, "ts": [ { "c": 1.0, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "l": 2 }, { "c": 0.8999999761581421, "d": "ELF imports zero needed libraries", "e": [ "binary.dependency_count = 0.00" ], "i": "metadata/binary/linking::elf-needed-libs-zero", "l": 2 }, { "c": 1.0, "d": "Binary format is identified", "e": [ "elf.class_bits = 64.00" ], "i": "metadata/binary::binary-format-checked", "l": 2 }, { "c": 1.0, "d": "Sparse visible string surface", "e": [ "binary.string_count = 31.00" ], "i": "objectives/anti-static/obfuscation/control-flow/native::sparse-strings", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 2.95" ], "i": "metadata/binary/metrics::avg-string-entropy-4-max", "l": 2 }, { "c": 1.0, "d": "Tiny ELF binary (\u003c 4KB)", "e": [ "elf.class_bits = 64.00" ], "i": "metadata/binary/metrics::tiny-elf", "l": 3 }, { "c": 0.4000000059604645, "d": "Very few functions detected", "e": [ "binary.function_count = 4.00" ], "i": "metadata/binary/metrics::few-functions", "l": 2 }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening::no-pie", "l": 2 }, { "c": 0.6000000238418579, "d": "Small ELF binary (\u003c 50KB)", "e": [ "x86__64__lsb__unix-system-v__clang-3.8.0__Os__no-obf__unstripped__acpid-2.0.31__ud_socket.o" ], "i": "metadata/binary/metrics::small-elf-binary", "l": 2 }, { "c": 1.0, "d": "ELF64 class marker", "e": [ "elf.class_bits = 64.00" ], "i": "metadata/binary/metrics::elf64-class", "l": 1 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 4.00" ], "i": "metadata/binary/metrics::avg-complexity-15-max", "l": 2 }, { "c": 0.800000011920929, "d": "Compiler/project context token", "e": [ "clang version" ], "i": "micro-behaviors/dylib/library::llvm-project-ref-b", "l": 2 }, { "d": "Binary exports symbols", "e": [ "binary.export_count = 4.00" ], "i": "metadata/binary/symbols::has-exports", "l": 1 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "binary.file_size = 3448.00" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.function_count = 4.00" ], "i": "metadata/binary/metrics::few-functions-3", "l": 1 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 3.30" ], "i": "metadata/binary/metrics::low-overall-entropy-binary", "l": 1 }, { "a": "T1106", "c": 0.949999988079071, "d": "ELF ET_DYN binary type", "e": [ "elf.e_type = 1.00" ], "i": "objectives/evasion/anti-av/syscall::elf-et-dyn", "l": 1, "m": "B0009" }, { "c": 0.6000000238418579, "d": "Binary not position-independent (no ASLR)", "e": [ "elf.e_type = 1.00" ], "i": "metadata/hardening::no-pie-struct", "l": 3 }, { "c": 0.75, "d": "ELF lacks dynamic linker sections", "e": [ "elf.class_bits = 64.00" ], "i": "metadata/binary/linking::static-linked-heuristic", "l": 3 }, { "c": 0.75, "d": "ELF lacks dynamic linker sections", "e": [ "elf.class_bits = 64.00" ], "i": "metadata/hardening::static-linked-heuristic", "l": 3 }, { "c": 0.800000011920929, "d": "Statically linked binary", "e": [ "binary.dependency_count = 0.00", "elf.class_bits = 64.00" ], "i": "metadata/binary/linking::static-linked", "l": 3 } ], "sha": "a838cf84cf9fc11e2bbcefe6e684a0d7a025238ec5b6fc88fb21bb93abe9f643", "path": "x86__64__lsb__unix-system-v__clang-3.8.0__Os__no-obf__unstripped__acpid-2.0.31__ud_socket.o", "type": "elf" } ], "tv": "b2c18" } }