{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.003645101794973016, "class": 0 } ], "prob": 0.0036451018, "class": 0, "models": [ { "m": "az", "prob": 0.0010426333, "class": 0 }, { "m": "az/native", "prob": 0.0036451018, "class": 0 }, { "m": "az/elf", "prob": 0.00083196926, "class": 0 } ], "version": "v16.16", "thresholds": [ 0.9953178, 0.9991311 ], "analyzed_at": "2026-05-03T07:30:17Z" }, "path": "crt1.o", "raw": { "v": "4", "fs": [ { "f": "O₂(AsEr)Md₂(Bi₄He)", "x": 3, "id": 0, "ms": { "elf": { "e_type": 1.0, "has_note": true, "e_machine": 62.0, "class_bits": 64.0, "note_count": 2.0, "has_eh_frame": true, "symtab_count": 11.0, "little_endian": true, "section_header_count": 15.0, "section_relocation_group_count": 2.0 }, "binary": { "code_size": 53.0, "file_size": 1984.0, "has_overlay": true, "code_entropy": 4.4, "data_entropy": 0.75, "export_count": 2.0, "overlay_size": 961.0, "string_count": 20.0, "overlay_ratio": 0.48, "section_count": 12.0, "avg_complexity": 1.0, "function_count": 2.0, "max_complexity": 1.0, "string_density": 386.42, "overall_entropy": 2.32, "overlay_entropy": 0.94, "avg_basic_blocks": 1.0, "avg_section_size": 78.92, "entropy_variance": 1.43, "function_density": 38.64, "avg_function_size": 21.5, "avg_string_length": 12.4, "complexity_per_kb": 19.32, "max_string_length": 26.0, "avg_string_entropy": 2.85, "code_to_data_ratio": 0.06, "data_to_file_ratio": 0.0, "text_to_file_ratio": 0.05, "total_basic_blocks": 2.0, "string_length_stddev": 6.08, "largest_section_ratio": 0.13, "sentence_string_count": 1.0, "sentence_string_ratio": 0.05, "function_analysis_depth": 2.0, "nonstandard_section_name_count": 2.0 } }, "ss": [ [ 81, "PTE1" ], [ 217, "GCC: (GNU) 15.2.1 20260209" ], [ 689, "__abi_tag" ], [ 699, "_dl_relocate_static_pie" ], [ 723, "_GLOBAL_OFFSET_TABLE_" ], [ 745, "_IO_stdin_used" ], [ 760, "__libc_start_main" ], [ 778, "__data_start" ], [ 889, ".symtab" ], [ 897, ".strtab" ], [ 905, ".shstrtab" ], [ 915, ".rela.text" ], [ 926, ".rela.eh_frame" ], [ 941, ".data" ], [ 947, ".bss" ], [ 952, ".comment" ], [ 961, ".note.gnu.property" ], [ 980, ".note.GNU-stack" ], [ 996, ".note.ABI-tag" ], [ 1010, ".rodata.cst4" ] ], "sz": 1984, "ts": [ { "c": 1.0, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "l": 2 }, { "d": "Binary exports symbols", "e": [ "binary.export_count = 2.00" ], "i": "metadata/binary/symbols::has-exports", "l": 1 }, { "c": 0.6000000238418579, "d": "Small ELF binary (\u003c 50KB)", "e": [ "crt1.o" ], "i": "metadata/binary/metrics::small-elf-binary", "l": 2 }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening::no-pie", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "binary.file_size = 1984.00" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 1.0, "d": "Sparse visible string surface", "e": [ "binary.string_count = 20.00" ], "i": "objectives/anti-static/obfuscation/control-flow/native::sparse-strings", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "ELF imports zero needed libraries", "e": [ "binary.dependency_count = 0.00" ], "i": "metadata/binary/linking::elf-needed-libs-zero", "l": 2 }, { "d": "Few detected functions (stub-like or analysis-limited)", "e": [ "binary.function_count = 2.00" ], "i": "metadata/binary/metrics::no-functions", "l": 2 }, { "c": 1.0, "d": "Tiny ELF binary (\u003c 4KB)", "e": [ "elf.class_bits = 64.00" ], "i": "metadata/binary/metrics::tiny-elf", "l": 3 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 2.85" ], "i": "metadata/binary/metrics::avg-string-entropy-4-max", "l": 2 }, { "a": "T1106", "c": 0.949999988079071, "d": "ELF ET_DYN binary type", "e": [ "elf.e_type = 1.00" ], "i": "objectives/evasion/anti-av/syscall::elf-et-dyn", "l": 1, "m": "B0009" }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 1.00" ], "i": "metadata/binary/metrics::avg-complexity-15-max", "l": 2 }, { "c": 1.0, "d": "ELF64 class marker", "e": [ "elf.class_bits = 64.00" ], "i": "metadata/binary/metrics::elf64-class", "l": 1 }, { "c": 1.0, "d": "Binary format is identified", "e": [ "elf.class_bits = 64.00" ], "i": "metadata/binary::binary-format-checked", "l": 2 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 2.32" ], "i": "metadata/binary/metrics::low-overall-entropy-binary", "l": 1 }, { "c": 0.6000000238418579, "d": "Binary not position-independent (no ASLR)", "e": [ "elf.e_type = 1.00" ], "i": "metadata/hardening::no-pie-struct", "l": 3 }, { "c": 0.4000000059604645, "d": "Very few basic blocks (analysis-limited or sparse)", "e": [ "binary.total_basic_blocks = 2.00" ], "i": "metadata/binary/metrics::few-basic-blocks", "l": 2 }, { "c": 0.75, "d": "Low average code complexity", "e": [ "binary.avg_complexity = 1.00" ], "i": "metadata/binary/metrics::low-average-complexity", "l": 2 }, { "c": 0.75, "d": "ELF lacks dynamic linker sections", "e": [ "elf.class_bits = 64.00" ], "i": "metadata/hardening::static-linked-heuristic", "l": 3 }, { "c": 0.75, "d": "ELF lacks dynamic linker sections", "e": [ "elf.class_bits = 64.00" ], "i": "metadata/binary/linking::static-linked-heuristic", "l": 3 }, { "c": 0.800000011920929, "d": "Statically linked binary", "e": [ "binary.dependency_count = 0.00", "elf.class_bits = 64.00" ], "i": "metadata/binary/linking::static-linked", "l": 3 } ], "sha": "ba11afe2659cdc853f4dd687b0c351ea9f6862358ac1aebc91813db623e4bf7b", "path": "/data/samples/good/archlinux/usr/lib/crt1.o", "type": "elf" } ], "tv": "b2c18" } }