{
  "ml": {
    "v": "5",
    "fs": [
      {
        "id": 0,
        "prob": 0.9990379810333252,
        "class": 2,
        "threshold": 0.9932810664176941
      }
    ],
    "prob": 0.999038,
    "class": 2,
    "level": 3,
    "models": [
      {
        "m": "az",
        "prob": 0.9922832,
        "class": 2
      },
      {
        "m": "az/native",
        "prob": 0.999038,
        "class": 2
      },
      {
        "m": "az/elf",
        "prob": 1.0,
        "class": 2
      }
    ],
    "version": "v17.17",
    "threshold": 0.99328107,
    "analyzed_at": "2026-05-31T09:53:17Z"
  },
  "path": "d666e41866bd09fd34c9fcf77e1dc7bc91c4b89e01cc0887bcb276cb1528ee96.elf",
  "raw": {
    "v": "5",
    "fs": [
      {
        "f": "Md₃(BiBkHe₂)",
        "x": 125,
        "ff": {
          "m": {
            "elf": {
              "bits": 32.0,
              "entry": 59720.0,
              "has_got": 0.0,
              "has_plt": 0.0,
              "has_note": 0.0,
              "note_count": 0.0,
              "nx_enabled": 0.0,
              "dynrel_count": 0.0,
              "dynsym_count": 0.0,
              "has_eh_frame": 0.0,
              "symtab_count": 0.0,
              "dynrela_count": 0.0,
              "little_endian": 1.0,
              "pltreloc_count": 0.0,
              "executable_stack": 1.0,
              "wx_segment_count": 0.0,
              "program_header_count": 3.0,
              "gnu_stack_section_absent": 0.0,
              "load_segment_max_file_size": 31541.0,
              "stripped_but_symtab_present": 0.0,
              "load_segment_max_memory_size": 31541.0,
              "section_relocation_group_count": 0.0,
              "stripped_metadata_section_count": 8.0
            },
            "file": {
              "size": 15662.0,
              "entropy": 7.98,
              "size_bytes": 15662.0
            },
            "binary": {
              "is_pie": 0.0,
              "is_stripped": 1.0,
              "avg_complexity": 1.0,
              "max_complexity": 1.0,
              "huge_func_count": 0.0,
              "leaf_func_count": 1.0,
              "tiny_func_count": 1.0,
              "avg_basic_blocks": 1.0,
              "total_basic_blocks": 1.0
            },
            "functions": {
              "count": 1.0
            },
            "dependencies": {
              "count": 0.0
            }
          },
          "s": [
            [
              1955,
              "u8",
              "4YD6e"
            ],
            [
              2968,
              "u8",
              "k2zjjN"
            ],
            [
              3744,
              "u8",
              "iuJ9Y"
            ],
            [
              4089,
              "u8",
              "SknBu"
            ],
            [
              7782,
              "u8",
              "a5Eyt"
            ],
            [
              9053,
              "u8",
              "lj15"
            ],
            [
              9198,
              "u8",
              "MNX8"
            ],
            [
              10245,
              "u8",
              "Pwnq"
            ],
            [
              10308,
              "u8",
              "3RtsGKrk"
            ],
            [
              11189,
              "u8",
              "iJpx"
            ],
            [
              11196,
              "u8",
              "ix3HlS"
            ],
            [
              11468,
              "u8",
              "xuXm"
            ],
            [
              12008,
              "u8",
              "5u\u003c\u003c0rk"
            ],
            [
              12420,
              "u8",
              "EK7U"
            ],
            [
              12480,
              "u8",
              "gcNdC"
            ],
            [
              14494,
              "u8",
              "2dus"
            ]
          ],
          "v": {
            "elf.type": "executable",
            "elf.class": "elf32",
            "elf.entry": 59720,
            "file.stem": "d666e41866bd09fd34c9fcf77e1dc7bc91c4b89e01cc0887bcb276cb1528ee96",
            "elf.endian": "little",
            "elf.machine": "arm",
            "elf.version": 1,
            "binary.packer": "upx",
            "file.basename": "d666e41866bd09fd34c9fcf77e1dc7bc91c4b89e01cc0887bcb276cb1528ee96.elf",
            "elf.e_flags[0]": "eabi_v4",
            "elf.e_flags_raw": 67108866,
            "elf.segments[0].type": "load",
            "elf.segments[1].type": "load",
            "elf.segments[2].type": "gnu_stack",
            "elf.segments[0].perms": "r-x",
            "elf.segments[0].vaddr": 32768,
            "elf.segments[1].perms": "rw-",
            "elf.segments[1].vaddr": 156772,
            "elf.segments[2].perms": "rwx",
            "elf.segments[0].file_size": 31541,
            "elf.segments[0].flags_hex": "5",
            "elf.segments[1].flags_hex": "6",
            "elf.segments[2].flags_hex": "7",
            "elf.segments[0].memory_size": 31541,
            "elf.segments[1].file_offset": 25700,
            "elf.stripped_metadata_sections[0]": ".symtab",
            "elf.stripped_metadata_sections[1]": ".strtab",
            "elf.stripped_metadata_sections[2]": ".comment",
            "elf.stripped_metadata_sections[3]": ".debug_info",
            "elf.stripped_metadata_sections[4]": ".debug_line",
            "elf.stripped_metadata_sections[5]": ".debug_str",
            "elf.stripped_metadata_sections[6]": ".debug_abbrev",
            "elf.stripped_metadata_sections[7]": ".note.gnu.gold-version"
          },
          "id": "elf"
        },
        "id": 0,
        "sz": 15662,
        "ts": [
          {
            "c": 1.0,
            "d": "Binary is not digitally signed",
            "i": "metadata/unsigned",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "Binary contains a UPX packing marker",
            "i": "anti-static/packer/upx",
            "l": 4
          },
          {
            "c": 1.0,
            "d": "UPX decompression failed: IO error: No such file or directory (os error 2)",
            "i": "anti-static/packer/upx/decompression-failed",
            "l": 5
          },
          {
            "c": 1.0,
            "d": "File is a compiled binary",
            "e": [
              "d666e41866bd09fd34c9fcf77e1dc7bc91c4b89e01cc0887bcb276cb1528ee96.elf"
            ],
            "i": "metadata/binary/framework::is-binary",
            "l": 1
          },
          {
            "c": 0.4000000059604645,
            "d": "Very few leaf functions (deep)",
            "e": [
              "binary.leaf_func_count = 1.00"
            ],
            "i": "metadata/binary/metrics/structural::few-leaf-functions",
            "l": 3
          },
          {
            "c": 0.8500000238418579,
            "d": "ELF PT_GNU_STACK has executable bit set",
            "e": [
              "elf.executable_stack = 1.00"
            ],
            "i": "metadata/binary/anomaly/format::elf-executable-stack",
            "l": 3
          },
          {
            "c": 1.0,
            "d": "Binary is not position-independent (fixed load address)",
            "e": [
              "binary.is_pie = 0.00"
            ],
            "i": "metadata/hardening/layout::no-pie",
            "l": 2
          },
          {
            "c": 0.949999988079071,
            "d": "UPX magic bytes in ELF",
            "e": [
              "UPX!"
            ],
            "i": "objectives/anti-static/pack/detect::upx-magic-raw",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "ELF symbol tables stripped from binary",
            "e": [
              "elf.stripped_metadata_section_count = 8.00"
            ],
            "i": "metadata/binary/anomaly/provenance::stripped-symbol-tables",
            "l": 1
          },
          {
            "c": 0.6000000238418579,
            "d": "Small ELF binary (\u003c 50KB)",
            "e": [
              "d666e41866bd09fd34c9fcf77e1dc7bc91c4b89e01cc0887bcb276cb1528ee96.elf"
            ],
            "i": "metadata/binary/metrics/structural::small-elf-binary",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "Binary has low average complexity",
            "e": [
              "binary.avg_complexity = 1.00"
            ],
            "i": "metadata/binary/metrics/threshold::avg-complexity-15-max",
            "l": 2
          },
          {
            "c": 0.8999999761581421,
            "d": "ELF imports zero needed libraries",
            "e": [
              "dependencies.count = 0.00"
            ],
            "i": "metadata/binary/linking/static::elf-needed-libs-zero",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "Binary symbol table is stripped",
            "e": [
              "binary.is_stripped = 1.00"
            ],
            "i": "metadata/hardening/layout::stripped",
            "l": 2
          },
          {
            "c": 0.4000000059604645,
            "d": "Very few basic blocks (analysis-limited or sparse)",
            "e": [
              "binary.total_basic_blocks = 1.00"
            ],
            "i": "metadata/binary/metrics/structural::few-basic-blocks",
            "l": 3
          },
          {
            "c": 1.0,
            "d": "Toolchain banner stripped, build-id retained",
            "e": [
              "[.symtab, .strtab, .comment, .debug_info, .debug_line, .debug_str, .debug_abbrev, .note.gnu.gold-version]"
            ],
            "i": "metadata/build/artifact::aggressive-strip",
            "l": 3,
            "el": [
              "value:elf.stripped_metadata_sections"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "Tiny C string section ratio",
            "e": [
              " = 0.0% of total (0 / 15662 bytes)"
            ],
            "i": "metadata/binary/section/metrics::tiny-cstring-section",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "No full symbol table (likely stripped)",
            "e": [
              "binary.is_stripped = 1.00"
            ],
            "i": "metadata/hardening/missing::stripped-binary",
            "l": 3
          },
          {
            "c": 0.75,
            "d": "Low average code complexity",
            "e": [
              "binary.avg_complexity = 1.00"
            ],
            "i": "metadata/binary/metrics/structural::low-average-complexity",
            "l": 2
          },
          {
            "c": 0.8999999761581421,
            "d": "NX/DEP disabled (stack is executable)",
            "e": [
              "elf.nx_enabled = 0.00"
            ],
            "i": "metadata/hardening/mitigation::nx-disabled",
            "l": 3
          }
        ],
        "sha": "d666e41866bd09fd34c9fcf77e1dc7bc91c4b89e01cc0887bcb276cb1528ee96",
        "path": "d666e41866bd09fd34c9fcf77e1dc7bc91c4b89e01cc0887bcb276cb1528ee96.elf",
        "type": "elf"
      }
    ],
    "tv": "52045"
  }
}