{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9111804366111755, "class": 0 } ], "prob": 0.91118044, "class": 0, "version": "v16.16", "thresholds": [ 0.9815004, 0.99404883 ], "analyzed_at": "2026-05-01T18:33:41Z" }, "path": "x86__64__lsb__unix-system-v__llvm-obfuscator-3.4.0__O3__mllvmsub__unstripped__coreutils-8.30__dd", "raw": { "v": "4", "fs": [ { "f": "O₂(CI)H₂(FDb)Md₂(HeBi₂)", "x": 4, "id": 0, "is": [ "", "ctype_toupper_loc", "getenv", "sigprocmask", "snprintf_chk", "raise", "free", "abort", "errno_location", "fdatasync", "error_at_line", "strncmp", "exit", "fpending", "sigaction", "localeconv", "fcntl", "clock_gettime", "write", "textdomain", "fclose", "bindtextdomain", "dcgettext", "ctype_get_mb_cur_max", "strlen", "getopt_long", "mbrtowc", "dup2", "strchr", "overflow", "strrchr", "ftruncate", "lseek", "gettimeofday", "assert_fail", "strtoul_internal", "memset", "ioctl", "close", "posix_fadvise", "read", "libc_start_main", "memcmp", "fputs_unlocked", "calloc", "strcmp", "sigemptyset", "gmon_start__", "memcpy", "fileno", "malloc", "fflush", "nl_langinfo", "vasprintf_chk", "fxstat", "freading", "realloc", "setlocale", "printf_chk", "memmove", "error", "fsync", "open", "fseeko", "dcngettext", "cxa_atexit", "getpagesize", "sigismember", "exit", "fwrite", "fprintf_chk", "mbsinit", "iswprint", "sigaddset", "ctype_tolower_loc", "ctype_b_loc", "sprintf_chk" ], "ms": { "elf": { "e_type": 2.0, "has_got": true, "has_plt": true, "has_note": true, "e_machine": 62.0, "class_bits": 64.0, "note_count": 1.0, "nx_enabled": true, "entry_point": 4202000.0, "needed_libs": 1.0, "dynsym_count": 85.0, "has_eh_frame": true, "symtab_count": 365.0, "dynrela_count": 7.0, "entry_section": ".text", "little_endian": true, "pltreloc_count": 75.0, "has_interpreter": true, "fini_array_count": 1.0, "init_array_count": 1.0, "program_header_count": 8.0, "section_header_count": 30.0, "load_segment_max_p_memsz": 61716.0, "load_segment_max_p_filesz": 61716.0, "section_relocation_group_count": 2.0 }, "binary": { "code_size": 40356.0, "file_size": 79400.0, "entry_point": 4202000.0, "has_overlay": true, "code_entropy": 4.03, "data_entropy": 3.39, "export_count": 165.0, "import_count": 77.0, "overlay_size": 1924.0, "string_count": 656.0, "overlay_ratio": 0.02, "section_count": 29.0, "avg_complexity": 6.63, "function_count": 192.0, "import_density": 1.95, "max_complexity": 280.0, "string_density": 16.65, "aliased_exports": 74.0, "overall_entropy": 2.85, "overlay_entropy": 1.55, "avg_basic_blocks": 9.44, "avg_section_size": 2691.38, "dependency_count": 1.0, "entropy_variance": 1.65, "function_density": 4.87, "avg_function_size": 202.94, "avg_string_length": 22.67, "complexity_per_kb": 0.17, "max_string_length": 667.0, "avg_string_entropy": 3.25, "code_to_data_ratio": 1.07, "data_to_file_ratio": 0.0, "text_to_file_ratio": 0.49, "total_basic_blocks": 1813.0, "string_length_stddev": 42.83, "largest_section_ratio": 0.49, "sentence_string_count": 136.0, "sentence_string_ratio": 0.21, "behavioral_import_ratio": 0.01, "function_analysis_depth": 2.0, "high_complexity_functions": 4.0 } }, "ss": [ [ 0, "textdomain" ], [ 512, "/lib64/ld-linux-x86-64.so.2" ], [ 3243, "fflush" ], [ 3250, "__printf_chk" ], [ 3263, "setlocale" ], [ 3273, "mbrtowc" ], [ 3281, "strncmp" ], [ 3289, "ftruncate" ], [ 3299, "dcngettext" ], [ 3310, "optind" ], [ 3317, "strrchr" ], [ 3325, "dcgettext" ], [ 3335, "error" ], [ 3341, "sigprocmask" ], [ 3353, "iswprint" ], [ 3362, "realloc" ], [ 3376, "abort" ], [ 3388, "program_invocation_name" ], [ 3412, "__assert_fail" ], [ 3426, "error_at_line" ], [ 3440, "__ctype_get_mb_cur_max" ], [ 3463, "posix_fadvise" ], [ 3477, "fdatasync" ], [ 3487, "calloc" ], [ 3494, "strlen" ], [ 3501, "sigemptyset" ], [ 3513, "memset" ], [ 3520, "localeconv" ], [ 3531, "__errno_location" ], [ 3548, "read" ], [ 3553, "memcmp" ], [ 3560, "getpagesize" ], [ 3577, "__fprintf_chk" ], [ 3591, "sigaddset" ], [ 3601, "stdout" ], [ 3608, "lseek" ], [ 3614, "memcpy" ], [ 3621, "fclose" ], [ 3628, "malloc" ], [ 3635, "raise" ], [ 3641, "mbsinit" ], [ 3649, "nl_langinfo" ], [ 3661, "__ctype_b_loc" ], [ 3675, "getenv" ], [ 3682, "__freading" ], [ 3693, "stderr" ], [ 3700, "ioctl" ], [ 3706, "__snprintf_chk" ], [ 3721, "getopt_long" ], [ 3733, "__fxstat" ], [ 3742, "fileno" ], [ 3749, "fwrite" ], [ 3756, "gettimeofday" ], [ 3769, "sigaction" ], [ 3779, "sigismember" ], [ 3791, "clock_gettime" ], [ 3805, "__fpending" ], [ 3816, "open" ], [ 3828, "program_invocation_short_name" ], [ 3858, "__ctype_toupper_loc" ], [ 3878, "__ctype_tolower_loc" ], [ 3898, "__vasprintf_chk" ], [ 3920, "__sprintf_chk" ], [ 3934, "memmove" ], [ 3942, "bindtextdomain" ], [ 3957, "opterr" ], [ 3971, "__libc_start_main" ], [ 3989, "fseeko" ], [ 3996, "__overflow" ], [ 4007, "__strtoul_internal" ], [ 4026, "fputs_unlocked" ], [ 4041, "free" ], [ 4046, "__progname" ], [ 4057, "__progname_full" ], [ 4073, "__cxa_atexit" ], [ 4086, "__gmon_start__" ], [ 4111, "GLIBC_2.14" ], [ 4122, "GLIBC_2.17" ], [ 7952, "UAVS" ], [ 9072, "UAWAVAUATSH" ], [ 10529, "ffffff." ], [ 18770, "fffff." ], [ 18784, "UAVSH" ], [ 19024, "UAWAVAUATSPI" ], [ 19552, "AVSP1" ], [ 22608, "AVSH" ], [ 23040, "UAWAVSPI" ], [ 23376, "UAWAVATSI" ], [ 23888, "UAWAVATSH" ], [ 24608, "AWAVATSH" ], [ 25408, "UAWAVSPH" ], [ 25600, "AWAVSH" ], [ 25776, "UAWAVSP" ], [ 29792, "AVSPH" ], [ 35984, "AWAVSL" ], [ 38768, "UAVSA" ], [ 38880, "UAWAVATSA" ], [ 40576, "USPH" ], [ 40784, "TUUUUUUU1" ], [ 41019, "TUUUUUUUH9" ], [ 41136, "AVSPI" ], [ 41264, "AWAVSI" ], [ 41787, "/v1I" ], [ 45296, "AWAVATSPH" ], [ 45776, "AWAVATSPI" ], [ 46624, "AWAVA" ], [ 46631, "AUATL" ], [ 46935, "ATry '%s --help' for more information." ], [ 46975, "Usage: %s [OPERAND]...\n or: %s OPTION" ], [ 46998, "or: %s OPTION" ], [ 47016, "Copy a file, converting and formatting according to the operands.\n\n bs=BYTES read and write up to BYTES bytes at a time " ], [ 47083, "bs=BYTES read and write up to BYTES bytes at a time (default: 512);" ], [ 47160, "overrides ibs and obs" ], [ 47200, "cbs=BYTES convert BYTES bytes at a time" ], [ 47248, "conv=CONVS convert the file as per the comma separated symbol list" ], [ 47322, "count=N copy only N input blocks" ], [ 47365, "ibs=BYTES read up to BYTES bytes at a time (default: 512)" ], [ 47432, "if=FILE read from FILE instead of stdin\n iflag=FLAGS read as per the comma separated symbol list\n obs=BYTES " ], [ 47482, "iflag=FLAGS read as per the comma separated symbol list" ], [ 47544, "obs=BYTES write BYTES bytes at a time (default: 512)" ], [ 47605, "of=FILE write to FILE instead of stdout" ], [ 47655, "oflag=FLAGS write as per the comma separated symbol list" ], [ 47718, "seek=N skip N obs-sized blocks at start of output" ], [ 47779, "skip=N skip N ibs-sized blocks at start of input" ], [ 47839, "status=LEVEL The LEVEL of information to print to stderr;" ], [ 47902, "'none' suppresses everything but error messages," ], [ 47969, "'noxfer' suppresses the final transfer statistics," ], [ 48038, "'progress' shows periodic transfer statistics" ], [ 48103, "N and BYTES may be followed by the following multiplicative suffixes:\nc =1, w =2, b =512, kB =1000, K =1024, MB =1000*1000, M =1" ], [ 48104, "N and BYTES may be followed by the following multiplicative suffixes:" ], [ 48249, "GB =1000*1000*1000, G =1024*1024*1024, and so on for T, P, E, Z, Y." ], [ 48318, "Each CONV symbol may be:" ], [ 48345, "ascii from EBCDIC to ASCII\n ebcdic from ASCII to EBCDIC\n ibm from ASCII to alternate EBCDIC\n block pad newli" ], [ 48378, "ebcdic from ASCII to EBCDIC" ], [ 48411, "ibm from ASCII to alternate EBCDIC" ], [ 48454, "block pad newline-terminated records with spaces to cbs-size" ], [ 48521, "unblock replace trailing spaces in cbs-size records with newline" ], [ 48590, "lcase change upper case to lower case" ], [ 48634, "ucase change lower case to upper case" ], [ 48678, "sparse try to seek rather than write the output for NUL input blocks" ], [ 48752, "swab swap every pair of input bytes" ], [ 48795, "sync pad every input block with NULs to ibs-size; when used" ], [ 48862, "with block or unblock, pad with spaces rather than NULs" ], [ 48931, "excl fail if the output file already exists\n nocreat do not create the output file\n notrunc do not truncate the outpu" ], [ 48982, "nocreat do not create the output file" ], [ 49024, "notrunc do not truncate the output file" ], [ 49068, "noerror continue after read errors" ], [ 49107, "fdatasync physically write output file data before finishing" ], [ 49171, "fsync likewise, but also write metadata" ], [ 49218, "Each FLAG symbol may be:\n\n append append mode (makes sense only for output; conv=notrunc suggested)" ], [ 49219, "Each FLAG symbol may be:" ], [ 49245, "append append mode (makes sense only for output; conv=notrunc suggested)" ], [ 49324, "direct use direct I/O for data" ], [ 49361, "directory fail unless a directory" ], [ 49399, "dsync use synchronized I/O for data" ], [ 49442, "sync likewise, but also for metadata" ], [ 49487, "fullblock accumulate full blocks of input (iflag only)" ], [ 49546, "nonblock use non-blocking I/O" ], [ 49580, "noatime do not update access time" ], [ 49619, "nocache Request to drop cache. See also oflag=sync" ], [ 49676, "noctty do not assign controlling terminal from file" ], [ 49734, "nofollow do not follow symlinks" ], [ 49770, "count_bytes treat 'count=N' as a byte count (iflag only)" ], [ 49831, "skip_bytes treat 'skip=N' as a byte count (iflag only)" ], [ 49890, "seek_bytes treat 'seek=N' as a byte count (oflag only)" ], [ 49949, "Sending a %s signal to a running 'dd' process makes it\nprint I/O statistics to standard error and then resume copying.\n\nOptions " ], [ 49950, "Sending a %s signal to a running 'dd' process makes it" ], [ 50005, "print I/O statistics to standard error and then resume copying." ], [ 50070, "Options are:" ], [ 50085, "USR1" ], [ 50090, "--help display this help and exit" ], [ 50135, "--version output version information and exit" ], [ 50192, "/tmp/coreutils/_out/share/locale" ], [ 50225, "Paul Rubin" ], [ 50236, "David MacKenzie" ], [ 50252, "Stuart Kemp" ], [ 50264, "standard input" ], [ 50279, "failed to open %s" ], [ 50297, "standard output" ], [ 50313, "offset too large: cannot truncate to a length of seek=%lu (%lu-byte) blocks" ], [ 50389, "cannot fstat %s" ], [ 50405, "failed to truncate to %lu bytes in output file %s" ], [ 50455, "failed to discard cache for: %s" ], [ 50487, "%lu+%lu records in" ], [ 50506, "%lu+%lu records out" ], [ 50527, "%lu truncated record" ], [ 50549, "%lu truncated records" ], [ 50579, "Infinity" ], [ 50600, "%lu byte copied, %s, %s" ], [ 50624, "%lu bytes copied, %s, %s" ], [ 50649, "%lu bytes (%s) copied, %s, %s" ], [ 50679, "%lu bytes (%s, %s) copied, %s, %s" ], [ 50717, "closing input file %s" ], [ 50739, "closing output file %s" ], [ 50762, "%s: cannot skip to specified offset" ], [ 50798, "writing to %s" ], [ 50812, "error reading %s" ], [ 50829, "error writing %s" ], [ 50846, "failed to truncate to %ld bytes in output file %s" ], [ 50896, "fdatasync failed for %s" ], [ 50920, "fsync failed for %s" ], [ 50940, "offset overflow while reading file %s" ], [ 50978, "warning: invalid file offset after failed read" ], [ 51025, "cannot work around kernel bug after all" ], [ 51065, "%s: cannot seek" ], [ 51081, "warning: working around lseek kernel bug for file (%s)\n of mt_type=0x%0lx -- see \u003csys/mtio.h\u003e for the list of types" ], [ 51136, "of mt_type=0x%0lx -- see \u003csys/mtio.h\u003e for the list of types" ], [ 51198, "memory exhausted by output buffer of size %lu bytes (%s)" ], [ 51255, "memory exhausted by input buffer of size %lu bytes (%s)" ], [ 51311, "failed to turn off O_DIRECT: %s" ], [ 51343, "%s: cannot skip" ], [ 51359, "setting flags for %s" ], [ 51380, "unrecognized operand %s" ], [ 51415, "invalid conversion" ], [ 51434, "iflag" ], [ 51440, "invalid input flag" ], [ 51465, "invalid output flag" ], [ 51485, "status" ], [ 51492, "invalid status level" ], [ 51525, "count" ], [ 51538, "invalid number" ], [ 51553, "seek_bytes" ], [ 51564, "count_bytes" ], [ 51576, "skip_bytes" ], [ 51587, "cannot combine any two of {ascii,ebcdic,ibm}" ], [ 51632, "cannot combine block and unblock" ], [ 51665, "cannot combine lcase and ucase" ], [ 51696, "cannot combine excl and nocreat" ], [ 51728, "cannot combine direct and nocache" ], [ 51762, "warning: partial read (%lu byte); suggest iflag=fullblock" ], [ 51820, "warning: partial read (%lu bytes); suggest iflag=fullblock" ], [ 51879, "bcEGkKMPTwYZ0" ], [ 51893, "warning: %s is a zero multiplier; use %s if that is intended" ], [ 51958, "POSIXLY_CORRECT" ], [ 51976, "test invocation" ], [ 51992, "Multi-call invocation" ], [ 52014, "sha224sum" ], [ 52024, "sha2 utilities" ], [ 52039, "sha256sum" ], [ 52049, "sha384sum" ], [ 52059, "sha512sum" ], [ 52069, "%s online help: \u003c%s\u003e" ], [ 52092, "GNU coreutils" ], [ 52106, "https://www.gnu.org/software/coreutils/" ], [ 52150, "Report %s translation bugs to \u003chttps://translationproject.org/team/\u003e" ], [ 52220, "Full documentation at: \u003c%s%s\u003e" ], [ 52251, "or available locally via: info '(coreutils) %s%s'" ], [ 52449, "abcdefghi" ], [ 52482, "stuvwxyz" ], [ 52512, "{ABCDEFGHI" ], [ 52528, "}JKLMNOPQR" ], [ 52546, "STUVWXYZ" ], [ 52723, "3456" ], [ 52736, "ABCDEFGHIQRSTUVWXYbcdefghipqrstuvwx" ], [ 53088, "ascii" ], [ 53104, "ebcdic" ] ], "sz": 79400, "ts": [ { "c": 1.0, "d": "ELF program interpreter present", "e": [ "/lib64/ld-linux-x86-64.so.2" ], "i": "metadata/binary/linking::elf-interpreter", "l": 2 }, { "c": 1.0, "d": "ELF needed library", "e": [ "libc.so.6" ], "i": "metadata/binary/linking::elf-needed-lib", "l": 2 }, { "c": 1.0, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "l": 2 }, { "c": 0.800000011920929, "d": "Binary has many sentence-like strings", "e": [ "binary.sentence_string_ratio = 0.21" ], "i": "metadata/binary/metrics::rich-sentence-strings-20pct", "l": 1 }, { "c": 1.0, "d": "Binary has 20+ sections (installer/packer)", "e": [ "binary.section_count = 29.00" ], "i": "metadata/binary/metrics::many-sections-20", "l": 1 }, { "a": "T1005", "c": 0.4000000059604645, "d": "Seeks to position in file", "e": [ "fseeko", "fseeko@@GLIBC_2.2.5", "rpl_fseeko", "sym.imp.fseeko", "sym.rpl_fseeko" ], "i": "micro-behaviors/fs/file/binary::fseek-func", "l": 2 }, { "c": 0.8399999737739563, "d": "High basic block count in sparse binary", "e": [ "binary.total_basic_blocks = 1813.00" ], "i": "metadata/binary/metrics::dense-basic-blocks", "l": 1 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.25" ], "i": "metadata/binary/metrics::avg-string-entropy-4-max", "l": 2 }, { "c": 0.6600000262260437, "d": "Open files", "e": [ "open" ], "i": "micro-behaviors/fs/file/open::open-base", "l": 2 }, { "c": 0.8999999761581421, "d": "ELF interpreter section name", "e": [ ".interp" ], "i": "metadata/binary/linking::elf-interpreter-section-name", "l": 2 }, { "c": 0.6000000238418579, "d": "Examine or change blocked signals", "e": [ "sigprocmask" ], "i": "micro-behaviors/process/terminate/signal::sigprocmask", "l": 2 }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.function_count = 192.00" ], "i": "metadata/binary/metrics::many-functions", "l": 2 }, { "d": "Usage: label in binary strings", "e": [ "Usage: %s [OPERAND]...\n or: %s OPTION" ], "i": "metadata/package/help::usage-title-string", "l": 1 }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.function_count = 192.00" ], "i": "metadata/binary/metrics::many-functions-50", "l": 1 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 77.00" ], "i": "metadata/binary/metrics::many-imports-30", "l": 1 }, { "c": 0.800000011920929, "d": "Binary has many exports (\u003e10)", "e": [ "binary.export_count = 165.00" ], "i": "metadata/binary/metrics::many-exports", "l": 2 }, { "c": 0.800000011920929, "d": "Compiler/project context token", "e": [ "clang version" ], "i": "micro-behaviors/dylib/library::llvm-project-ref-b", "l": 2 }, { "a": "T1124", "c": 0.30000001192092896, "d": "Get current time with microsecond precision", "e": [ "gettimeofday" ], "i": "micro-behaviors/time/query::gettimeofday", "l": 2, "m": "T1124" }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.function_count = 192.00" ], "i": "metadata/binary/metrics::few-functions-3", "l": 1 }, { "c": 0.8999999761581421, "d": "CLI help or usage text", "e": [ "ATry '%s --help' for more information." ], "i": "metadata/binary/metrics::help-usage-string", "l": 2 }, { "c": 1.0, "d": "Binary has 9+ exports", "e": [ "binary.export_count = 165.00" ], "i": "metadata/binary/metrics::many-exports-9", "l": 1 }, { "c": 0.800000011920929, "d": "libc version string pattern", "e": [ "GLIBC", "GLIBC", "GLIBC", "GLIBC", "GLIBC", "GLIBC", "GLIBC", "GLIBC", "GLIBC", "GLIBC", "GLIBC", "GLIBC", "GLIBC", "GLIBC", "GLIBC", "GLIBC" ], "i": "micro-behaviors/dylib/library/libc::libc-version-string", "l": 2 }, { "d": "Characteristic system library export __assert_fail", "e": [ "assert_fail" ], "i": "micro-behaviors/dylib/library/libc::libc-characteristic-assert-fail", "l": 2 }, { "c": 0.8999999761581421, "d": "Abort program execution", "e": [ "abort" ], "i": "micro-behaviors/os/signal/handler::abort", "l": 2 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 77.00" ], "i": "metadata/binary/metrics::many-imports-20", "l": 1 }, { "a": "T1055", "c": 0.25, "d": "Repeated 0x07 code constant (possible PROT_RWX)", "e": [ "07 00 00 00", "07 00 00 00", "07 00 00 00" ], "i": "micro-behaviors/mem/protect/modify::rwx-prot-bytes", "l": 1 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 6.63" ], "i": "metadata/binary/metrics::avg-complexity-15-max", "l": 2 }, { "d": ".so extension reference", "e": [ ".so" ], "i": "micro-behaviors/fs/path/extension::so", "l": 2 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 77.00" ], "i": "metadata/binary/metrics::many-imports-25", "l": 1 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 77.00" ], "i": "metadata/binary/metrics::many-imports-50", "l": 1 }, { "c": 0.8999999761581421, "d": "Install signal handler (POSIX sigaction)", "e": [ "sigaction" ], "i": "micro-behaviors/os/signal/handler::sigaction", "l": 2 }, { "d": "Characteristic system library exports", "e": [ "libc_start_main" ], "i": "micro-behaviors/dylib/library/libc::libc-characteristic-symbols", "l": 2 }, { "a": "T1486", "c": 0.800000011920929, "d": "Five-segment file encryption loop bytecode", "e": [ "ba 35", "ba 35" ], "i": "objectives/impact/ransom/esxi::segment-loop-5", "l": 1, "m": "C0027" }, { "c": 0.8500000238418579, "d": "Send signal to self", "e": [ "raise" ], "i": "micro-behaviors/os/signal/handler::raise", "l": 2 }, { "c": 0.6600000262260437, "d": "Reference to /lib64", "e": [ "/lib64/ld-linux-x86-64.so.2" ], "i": "micro-behaviors/fs/path/system::system-lib64", "l": 2 }, { "c": 1.0, "d": "Binary has 20+ exports", "e": [ "binary.export_count = 165.00" ], "i": "metadata/binary/metrics::many-exports-20", "l": 1 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 2.85" ], "i": "metadata/binary/metrics::low-overall-entropy-binary", "l": 1 }, { "d": "Characteristic system library export __cxa_atexit", "e": [ "cxa_atexit" ], "i": "micro-behaviors/dylib/library/libc::libc-characteristic-cxa-atexit", "l": 2 }, { "d": "Duplicate file descriptor (I/O redirection)", "e": [ "dup2" ], "i": "micro-behaviors/process/fd/dup::dup2", "l": 2 }, { "a": "T1124", "c": 0.30000001192092896, "d": "Get time from specified clock", "e": [ "clock_gettime" ], "i": "micro-behaviors/time/query::clock_gettime", "l": 2, "m": "T1124" }, { "c": 1.0, "d": "/tmp/ path component", "e": [ "/tmp/coreutils/_out/share/locale" ], "i": "micro-behaviors/fs/path/temp::tmp-path-content", "l": 2 }, { "d": "overflow keyword", "e": [ "__overflow@@GLIBC_2.2.5", "__overflow", "offset overflow while reading file %s", "overflow@@GLIBC_2.2.5", "input_offset_overflow", "overflow" ], "i": "micro-behaviors/data/text/keywords::overflow", "l": 1 }, { "c": 0.30000001192092896, "d": "GNU coreutils reference", "e": [ "GNU coreutils" ], "i": "micro-behaviors/dylib/library::gnu-coreutils-ref", "l": 2 }, { "a": "T1059.006", "c": 0.6000000238418579, "d": "Named /tmp execution path", "e": [ "/tmp/coreutils" ], "i": "objectives/command-and-control/dropper::tmp-path", "l": 1, "m": "B0024" }, { "c": 0.8999999761581421, "d": "ELF dynstr section name", "e": [ ".dynstr" ], "i": "metadata/binary/linking::elf-dynstr-section-name", "l": 2 }, { "c": 0.8999999761581421, "d": "ELF dynamic section name", "e": [ ".dynamic" ], "i": "metadata/binary/linking::elf-dynamic-section-name", "l": 2 }, { "c": 0.4000000059604645, "d": "Terminate process immediately without cleanup", "e": [ "exit", "exit" ], "i": "micro-behaviors/process/terminate/signal::_exit", "l": 2 }, { "c": 0.699999988079071, "d": "Unix /tmp/ path reference", "e": [ "/tmp/coreutils/_out/share/locale" ], "i": "micro-behaviors/fs/path/temp::unix-temp", "l": 2 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 77.00" ], "i": "metadata/binary/metrics::many-imports-40", "l": 1 }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2 }, { "d": "Truncate file", "e": [ "ftruncate" ], "i": "micro-behaviors/fs/file/truncate::truncate", "l": 2 }, { "c": 0.699999988079071, "d": "Version information string", "e": [ "--version" ], "i": "metadata/package/help::version-text", "l": 2 }, { "a": "T1486", "c": 0.75, "d": "flock LOCK_EX call bytecode pattern", "e": [ "bf 5a f6 ff ff", "be e0 f9 ff ff", "be bb f8 ff ff", "bf 4c f5 ff ff", "bf 15 cb ff ff", "b9 87 0a 00 00", "ba 4a b9 ff ff", "b9 03 00 00 eb", "be 48 6a ff ff" ], "i": "objectives/impact/ransom/esxi::flock-lockex", "l": 1, "m": "C0027" }, { "c": 1.0, "d": "Binary has 100+ exports", "e": [ "binary.export_count = 165.00" ], "i": "metadata/binary/metrics::many-exports-100", "l": 1 }, { "d": "Characteristic system library export __errno_location", "e": [ "errno_location" ], "i": "micro-behaviors/dylib/library/libc::libc-characteristic-errno", "l": 2 }, { "c": 1.0, "d": "Binary format is identified", "e": [ "elf.class_bits = 64.00" ], "i": "metadata/binary::binary-format-checked", "l": 2 }, { "d": "Binary exports symbols", "e": [ "binary.export_count = 165.00" ], "i": "metadata/binary/symbols::has-exports", "l": 1 }, { "c": 0.699999988079071, "d": "Read file descriptor (read/pread)", "e": [ "read" ], "i": "micro-behaviors/fs/file/read::read", "l": 2 }, { "c": 0.699999988079071, "d": "GPL license reference", "e": [ "GPL", "GPL" ], "i": "metadata/package/license::gpl-word", "l": 2 }, { "c": 0.6600000262260437, "d": "Write files", "e": [ "write", "fwrite" ], "i": "micro-behaviors/fs/file/write::write", "l": 2 }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening::no-pie", "l": 2 }, { "c": 0.8999999761581421, "d": "ELF dynsym section name", "e": [ ".dynsym" ], "i": "metadata/binary/linking::elf-dynsym-section-name", "l": 2 }, { "a": "T1083", "c": 0.4000000059604645, "d": "File descriptor manipulation and control", "e": [ "fcntl" ], "i": "micro-behaviors/fs/file/operations::fcntl", "l": 2, "m": "E1083" }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "binary.file_size = 79400.00" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 1.0, "d": "ELF64 class marker", "e": [ "elf.class_bits = 64.00" ], "i": "metadata/binary/metrics::elf64-class", "l": 1 }, { "c": 0.20000000298023224, "d": "output keyword", "e": [ "append append mode (makes sense only for output; conv=notrunc suggested)", "--version output version information and exit", "standard output", "fdatasync physically write output file data before finishing", "seek=N skip N obs-sized blocks at start of output", "failed to truncate to %lu bytes in output file %s", "nocreat do not create the output file", "…eat do not create the output file\n notrunc do not…", "notrunc do not truncate the output file", "sparse try to seek rather than write the output for NUL input blocks", "…ized blocks at start of output\n skip=N skip …", "…k rather than write the output for NUL input blocks\n …", "excl fail if the output file already exists\n n…", "…e (makes sense only for output; conv=notrunc suggested…", "…c do not truncate the output file\n noerror contin…", "…async physically write output file data before finish…" ], "i": "micro-behaviors/data/text/keywords::output", "l": 1 }, { "c": 0.8999999761581421, "d": "ELF dynamic section name", "e": [ ".dynamic" ], "i": "metadata/hardening::elf-dynamic-section-name", "l": 2 }, { "c": 1.0, "d": "ELF needed library metadata", "e": [ "libc.so.6" ], "i": "metadata/binary/linking/runtime::needed-lib", "l": 2 }, { "c": 0.8999999761581421, "d": "ELF interpreter section name", "e": [ ".interp" ], "i": "metadata/hardening::elf-interpreter-section-name", "l": 2 }, { "c": 0.4000000059604645, "d": "SIGHUP signal ignore pattern (x86_64)", "e": [ "BF 01 00 00 00 BE 01 00 00 00", "BF 01 00 00 00 BE 01 00 00 00" ], "i": "objectives/persistence/system/daemon/init::sig-ign-sighup-x64", "l": 1 }, { "c": 0.8999999761581421, "d": "No stack canary (stack smashing protection absent)", "e": [ "elf.stack_canary = 0.00" ], "i": "metadata/hardening::no-stack-canary", "l": 2 }, { "c": 1.0, "d": "ELF program interpreter metadata", "e": [ "/lib64/ld-linux-x86-64.so.2" ], "i": "metadata/binary/linking/runtime::interpreter", "l": 2 }, { "c": 0.8999999761581421, "d": "ELF dynstr section name", "e": [ ".dynstr" ], "i": "metadata/hardening::elf-dynstr-section-name", "l": 2 }, { "c": 0.8999999761581421, "d": "No RELRO (GOT writable after load)", "e": [ "elf.relro = 0.00" ], "i": "metadata/hardening::no-relro", "l": 2 }, { "c": 0.30000001192092896, "d": "getenv function (read environment variable)", "e": [ "getenv", "sym.imp.getenv" ], "i": "micro-behaviors/os/env/vars::getenv", "l": 2 }, { "c": 0.6000000238418579, "d": "Binary not position-independent (no ASLR)", "e": [ "elf.e_type = 2.00" ], "i": "metadata/hardening::no-pie-struct", "l": 3 }, { "c": 0.8999999761581421, "d": "ELF dynsym section name", "e": [ ".dynsym" ], "i": "metadata/hardening::elf-dynsym-section-name", "l": 2 }, { "c": 0.6600000262260437, "d": "Reference to /tmp", "e": [ "/tmp/coreutils/_out/share/locale", "/tmp/coreutils/_out/share/locale" ], "i": "micro-behaviors/fs/path/temp::temp-tmp", "l": 2 }, { "a": "T1005", "c": 0.75, "d": "File content manipulation (read/write/seek)", "e": [ "fseeko@@GLIBC_2.2.5", "write", "fwrite", "sym.rpl_fseeko", "fseeko", "rpl_fseeko", "sym.imp.fseeko" ], "i": "micro-behaviors/fs/file/binary::file-manipulation", "l": 3 }, { "a": "T1486", "c": 1.0, "d": "File encryption bytecode patterns combined", "e": [ "ba 35", "bf 5a f6 ff ff", "b9 87 0a 00 00", "bf 15 cb ff ff", "be e0 f9 ff ff", "bf 4c f5 ff ff", "be bb f8 ff ff", "b9 03 00 00 eb", "be 48 6a ff ff", "ba 4a b9 ff ff" ], "i": "objectives/impact/ransom/esxi::encryption-bytecodes", "l": 1, "m": "C0027" }, { "c": 0.8500000238418579, "d": "Documented command line program", "e": [ "Usage: %s [OPERAND]...\n or: %s OPTION", "binary.import_count = 77.00", "binary.sentence_string_ratio = 0.21" ], "i": "metadata/package/help::documented-cli-binary", "l": 1 }, { "a": "T1543", "c": 0.30000001192092896, "d": "Signal handler setup (daemon persistence", "e": [ "sigaction", "BF 01 00 00 00 BE 01 00 00 00" ], "i": "objectives/persistence/system/daemon/init::signal-ignore-pattern", "l": 3 } ], "sha": "bbf5b0533dbca858872a7b5e840bc44680414f1ef42cb4d04ca404d6c2452ff7", "path": "/data/samples/good/datasets/Labeled-Elfs/benignware/x86__64__lsb__unix-system-v__llvm-obfuscator-3.4.0__O3__mllvmsub__unstripped__coreutils-8.30__dd", "type": "elf" } ], "tv": "2a0fe" } }