{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.8383554220199585, "class": 0 } ], "prob": 0.8383554, "class": 0, "models": [ { "m": "az", "prob": 0.8383554, "class": 0 }, { "m": "az/native", "prob": 0.0073409462, "class": 0 }, { "m": "az/elf", "prob": 0.0, "class": 0 } ], "version": "v17.17", "thresholds": [ 0.999503, 0.9998882 ], "analyzed_at": "2026-05-24T10:13:50Z" }, "path": "d9175993de906ebd595096bbb230303a1911a67d81529c5072974aadb572bfb3.elf", "raw": { "v": "5", "fs": [ { "f": "O(Er)H(F)", "x": 44, "ff": { "m": { "elf": { "parse_failed": 1.0 }, "file": { "size": 8155082.0, "entropy": 8.0, "size_bytes": 8155082.0 }, "parse": { "error_count": 1.0 } }, "s": [ [ 568, "u8", "/lib64/ld-linux-x86-64.so.2" ], [ 2769, "u8", "libdl.so.2" ], [ 2780, "u8", "__gmon_start__" ], [ 2795, "u8", "dlclose" ], [ 2809, "u8", "dlopen" ], [ 2816, "u8", "dlerror" ], [ 2834, "u8", "inflateEnd" ], [ 2845, "u8", "inflateInit_" ], [ 2858, "u8", "inflate" ], [ 2866, "u8", "libpthread.so.0" ], [ 2882, "u8", "__errno_location" ], [ 2899, "u8", "raise" ], [ 2905, "u8", "sem_post" ], [ 2914, "u8", "sem_destroy" ], [ 2926, "u8", "sem_init" ], [ 2935, "u8", "sem_wait" ], [ 2944, "u8", "waitpid" ], [ 2962, "u8", "__xpg_basename" ], [ 2977, "u8", "mkdtemp" ], [ 2985, "u8", "fflush" ], [ 2999, "u8", "fchmod" ], [ 3006, "u8", "exit" ], [ 3011, "u8", "readdir" ], [ 3019, "u8", "fopen" ], [ 3025, "u8", "strncmp" ], [ 3033, "u8", "__isoc99_sscanf" ], [ 3049, "u8", "closedir" ], [ 3058, "u8", "signal" ], [ 3065, "u8", "strncpy" ], [ 3073, "u8", "mbstowcs" ], [ 3087, "u8", "__stack_chk_fail" ], [ 3104, "u8", "__lxstat" ], [ 3113, "u8", "unlink" ], [ 3126, "u8", "realloc" ], [ 3134, "u8", "getpid" ], [ 3146, "u8", "strdup" ], [ 3153, "u8", "strtok" ], [ 3160, "u8", "strtol" ], [ 3172, "u8", "feof" ], [ 3177, "u8", "symlink" ], [ 3185, "u8", "calloc" ], [ 3192, "u8", "strlen" ], [ 3205, "u8", "dirname" ], [ 3219, "u8", "memcmp" ], [ 3226, "u8", "clearerr" ], [ 3235, "u8", "unsetenv" ], [ 3244, "u8", "stdout" ], [ 3257, "u8", "memcpy" ], [ 3264, "u8", "fclose" ], [ 3271, "u8", "__vsnprintf_chk" ], [ 3287, "u8", "strtoul" ], [ 3295, "u8", "malloc" ], [ 3302, "u8", "realpath" ], [ 3311, "u8", "ftello" ], [ 3318, "u8", "opendir" ], [ 3326, "u8", "getenv" ], [ 3333, "u8", "stderr" ], [ 3340, "u8", "munmap" ], [ 3347, "u8", "__snprintf_chk" ], [ 3362, "u8", "readlink" ], [ 3371, "u8", "execvp" ], [ 3378, "u8", "strncat" ], [ 3386, "u8", "__realpath_chk" ], [ 3401, "u8", "fileno" ], [ 3408, "u8", "fwrite" ], [ 3415, "u8", "fread" ], [ 3421, "u8", "__fread_chk" ], [ 3440, "u8", "wcsdup" ], [ 3447, "u8", "__xstat" ], [ 3462, "u8", "strerror" ], [ 3471, "u8", "__libc_start_main" ], [ 3489, "u8", "ferror" ], [ 3496, "u8", "wcslen" ], [ 3503, "u8", "fseeko" ], [ 3510, "u8", "snprintf" ], [ 3519, "u8", "free" ], [ 3546, "u8", "GLIBC_2.14" ], [ 9723, "u8", "ATUI" ], [ 10592, "u8", "ATUSH" ], [ 19328, "u8", "ATUE1" ], [ 24505, "u8", "ATUS" ], [ 24591, "u8", "K E1" ], [ 24723, "u8", "S8E1" ], [ 25475, "u8", "Hcu H" ], [ 25606, "u8", "tpHcM H" ], [ 25808, "u8", "HcU H" ], [ 28160, "u8", "ATUH" ], [ 31177, "u8", "IcT$ I" ], [ 32891, "u8", "ATUSL" ], [ 33856, "u8", "C8E1" ], [ 34320, "u8", "AVAUHc" ], [ 35728, "u8", "AVAUATUSLc" ], [ 36339, "u8", "t{AUATUSH" ], [ 38144, "u8", "_MEIXXXXH" ], [ 41124, "u8", "fseek" ], [ 41152, "u8", "Failed to read cookie!" ], [ 41183, "u8", "Could not read full TOC!" ], [ 41209, "u8", "Error on file." ], [ 41232, "u8", "Failed to extract %s: inflateInit() failed with return code %d!" ], [ 41304, "u8", "Failed to extract %s: failed to allocate temporary input buffer!" ], [ 41376, "u8", "Failed to extract %s: failed to allocate temporary output buffer!" ], [ 41448, "u8", "Failed to extract %s: decompression resulted in return code %d!" ], [ 41520, "u8", "Failed to extract %s: failed to open archive file!" ], [ 41576, "u8", "Failed to extract %s: failed to seek to the entry's data!" ], [ 41640, "u8", "Failed to extract %s: failed to allocate data buffer (%u bytes)!" ], [ 41712, "u8", "Failed to extract %s: failed to read data chunk!" ], [ 41768, "u8", "Failed to create symbolic link %s!" ], [ 41808, "u8", "Failed to extract %s: failed to open target file!" ], [ 41864, "u8", "Failed to extract %s: failed to allocate temporary buffer!" ], [ 41928, "u8", "Failed to extract %s: failed to write data chunk!" ], [ 41984, "u8", "Failed to seek to cookie position!" ], [ 42024, "u8", "Could not allocate memory for archive structure!" ], [ 42080, "u8", "Could not allocate buffer for TOC!" ], [ 42132, "u8", "Py_DecodeLocale" ], [ 42148, "u8", "Py_Finalize" ], [ 42160, "u8", "Py_IsInitialized" ], [ 42177, "u8", "Py_PreInitialize" ], [ 42194, "u8", "PyInitConfig_Create" ], [ 42214, "u8", "PyInitConfig_Free" ], [ 42232, "u8", "PyInitConfig_SetInt" ], [ 42252, "u8", "PyInitConfig_SetStr" ], [ 42272, "u8", "PyInitConfig_SetStrList" ], [ 42296, "u8", "PyInitConfig_GetError" ], [ 42318, "u8", "Py_InitializeFromInitConfig" ], [ 42346, "u8", "PyConfig_Clear" ], [ 42361, "u8", "PyConfig_InitIsolatedConfig" ], [ 42389, "u8", "PyConfig_Read" ], [ 42403, "u8", "PyConfig_SetBytesString" ], [ 42427, "u8", "PyConfig_SetString" ], [ 42446, "u8", "PyConfig_SetWideStringList" ], [ 42473, "u8", "Py_InitializeFromConfig" ], [ 42497, "u8", "Py_ExitStatusException" ], [ 42544, "u8", "PyErr_NormalizeException" ], [ 42569, "u8", "PyErr_Occurred" ], [ 42596, "u8", "PyErr_Restore" ], [ 42610, "u8", "PyEval_EvalCode" ], [ 42626, "u8", "PyImport_AddModule" ], [ 42645, "u8", "PyImport_ExecCodeModule" ], [ 42669, "u8", "PyImport_ImportModule" ], [ 42691, "u8", "PyList_Append" ], [ 42705, "u8", "PyMem_RawFree" ], [ 42719, "u8", "PyModule_GetDict" ], [ 42736, "u8", "PyObject_CallFunction" ], [ 42758, "u8", "PyObject_CallFunctionObjArgs" ], [ 42787, "u8", "PyObject_GetAttrString" ], [ 42810, "u8", "PyObject_SetAttrString" ], [ 42833, "u8", "PyObject_Str" ], [ 42846, "u8", "PyRun_SimpleStringFlags" ], [ 42870, "u8", "PyStatus_Exception" ], [ 42889, "u8", "PySys_GetObject" ], [ 42905, "u8", "PySys_SetObject" ], [ 42921, "u8", "PyUnicode_AsUTF8" ], [ 42938, "u8", "PyUnicode_Decode" ], [ 42955, "u8", "PyUnicode_DecodeFSDefault" ], [ 42981, "u8", "PyUnicode_FromFormat" ], [ 43002, "u8", "PyUnicode_FromString" ], [ 43023, "u8", "PyUnicode_Join" ], [ 43038, "u8", "PyUnicode_Replace" ], [ 43056, "u8", "Path of Python shared library (%s) and its name (%s) exceed buffer size (%d)." ], [ 43136, "u8", "Failed to load Python shared library '%s': %s" ], [ 43184, "u8", "Could not allocate memory for DYLIB_PYTHON structure." ], [ 43240, "u8", "Failed to import symbol %s from Python shared library: %s" ], [ 43304, "u8", "PyMarshal_ReadObjectFromString" ], [ 43336, "u8", "PyPreConfig_InitIsolatedConfig" ], [ 43368, "u8", "Could not allocate memory for DYLIB_TCLTK structure." ], [ 43424, "u8", "Failed to load Tcl shared library '%s': %s" ], [ 43472, "u8", "Failed to load Tk shared library '%s': %s" ], [ 43520, "u8", "Failed to import symbol %s from Tcl shared library: %s" ], [ 43576, "u8", "Failed to import symbol %s from Tk shared library: %s" ], [ 43640, "u8", "Tcl_CreateInterp" ], [ 43657, "u8", "Tcl_FindExecutable" ], [ 43676, "u8", "Tcl_DoOneEvent" ], [ 43691, "u8", "Tcl_Finalize" ], [ 43704, "u8", "Tcl_FinalizeThread" ], [ 43723, "u8", "Tcl_DeleteInterp" ], [ 43740, "u8", "Tcl_CreateThread" ], [ 43757, "u8", "Tcl_GetCurrentThread" ], [ 43778, "u8", "Tcl_JoinThread" ], [ 43793, "u8", "Tcl_MutexLock" ], [ 43807, "u8", "Tcl_MutexUnlock" ], [ 43823, "u8", "Tcl_MutexFinalize" ], [ 43841, "u8", "Tcl_ConditionFinalize" ], [ 43863, "u8", "Tcl_ConditionNotify" ], [ 43883, "u8", "Tcl_ConditionWait" ], [ 43901, "u8", "Tcl_ThreadQueueEvent" ], [ 43922, "u8", "Tcl_ThreadAlert" ], [ 43962, "u8", "Tcl_CreateObjCommand" ], [ 43983, "u8", "Tcl_GetString" ], [ 43997, "u8", "Tcl_NewStringObj" ], [ 44014, "u8", "Tcl_NewByteArrayObj" ], [ 44034, "u8", "Tcl_SetVar2Ex" ], [ 44048, "u8", "Tcl_GetObjResult" ], [ 44065, "u8", "Tcl_EvalFile" ], [ 44089, "u8", "Tcl_EvalObjv" ], [ 44129, "u8", "Tk_GetNumMainWindows" ], [ 44150, "u8", "[PYI-%d:%s]" ], [ 44163, "u8", "WARNING" ], [ 44171, "u8", "ERROR" ], [ 44177, "u8", "[PYI-%d:ERROR]" ], [ 44201, "u8", "__main__" ], [ 44210, "u8", "%s%c%s.py" ], [ 44220, "u8", "__file__" ], [ 44229, "u8", "_pyi_main_co" ], [ 44242, "u8", "Failed to extract entry: %s." ], [ 44272, "u8", "Could not get __main__ module." ], [ 44304, "u8", "Could not get __main__ module's dict." ], [ 44344, "u8", "Failed to extract script from archive!" ], [ 44384, "u8", "Absolute path to script exceeds PYI_PATH_MAX" ], [ 44432, "u8", "Failed to unmarshal code object for %s" ], [ 44472, "u8", "Failed to execute script '%s' due to unhandled exception!" ], [ 44536, "u8", "Extraction path length exceeds maximum path length!" ], [ 44592, "u8", "File already exists but should not: %s" ], [ 44632, "u8", "Failed to create parent directory structure." ], [ 44680, "u8", "Failed to remove temporary directory: %s" ], [ 44728, "u8", "Could not load PyInstaller's embedded PKG archive from the executable (%s)" ], [ 44808, "u8", "Could not side-load PyInstaller's PKG archive from external file (%s)" ], [ 44880, "u8", "PYINSTALLER_SUPPRESS_SPLASH_SCREEN" ], [ 44920, "u8", "Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s" ], [ 44968, "u8", "Invalid parent process level: %d" ], [ 45008, "u8", "Failed to set _PYI_PARENT_PROCESS_LEVEL environment variable!" ], [ 45072, "u8", "PYINSTALLER_STRICT_UNPACK_MODE" ], [ 45104, "u8", "Could not create temporary directory!" ], [ 45144, "u8", "Failed to set application home directory via environment variable!" ], [ 45216, "u8", "_PYI_APPLICATION_HOME_DIR environment variable is not defined!" ], [ 45280, "u8", "Path exceeds PYI_PATH_MAX limit." ], [ 45320, "u8", "Failed to set library search path via environment variable!" ], [ 45384, "u8", "LOADER: failed to allocate argv array for execvp!" ], [ 45440, "u8", "LOADER: failed to restart process: %s" ], [ 45480, "u8", "Failed to load splash screen resources!" ], [ 45528, "u8", "Failed to unpack splash screen dependencies from PKG archive!" ], [ 45592, "u8", "Failed to load Tcl/Tk shared libraries for splash screen!" ], [ 45656, "u8", "Failed to start splash screen!" ], [ 45688, "u8", "/proc/self/exe" ], [ 45703, "u8", "ld-%64[^.].so.%d" ], [ 45722, "u8", "PYINSTALLER_RESET_ENVIRONMENT" ], [ 45752, "u8", "_PYI_ARCHIVE_FILE" ], [ 45770, "u8", "_PYI_APPLICATION_HOME_DIR" ], [ 45796, "u8", "_PYI_PARENT_PROCESS_LEVEL" ], [ 45822, "u8", "_PYI_SPLASH_IPC" ], [ 45838, "u8", "_PYI_LINUX_PROCESS_NAME" ], [ 45862, "u8", "pyi-python-flag" ], [ 45878, "u8", "Py_GIL_DISABLED" ], [ 45894, "u8", "pyi-runtime-tmpdir" ], [ 45913, "u8", "pyi-contents-directory" ], [ 45936, "u8", "pyi-bootloader-ignore-signals" ], [ 45968, "u8", "%s%c%s%c%s%c%s" ], [ 45983, "u8", "%s%c%s.pkg" ], [ 45994, "u8", "%s%c%s.exe" ], [ 46005, "u8", "Failed to open archive %s!" ], [ 46040, "u8", "Failed to copy file %s from %s!" ], [ 46080, "u8", "Referenced dependency archive %s not found." ], [ 46128, "u8", "Maximum archive pool size reached!" ], [ 46168, "u8", "Failed to open referenced dependency archive %s." ], [ 46224, "u8", "Dependency %s not found in the referenced dependency archive." ], [ 46288, "u8", "Failed to extract %s from referenced dependency archive %s." ], [ 46354, "u8", "verbose" ] ], "er": [ [ "malformed", "elf-parse" ] ], "id": "elf" }, "id": 0, "sz": 8155082, "ts": [ { "a": "T1027", "c": 1.0, "d": "Malformed ELF header or section headers: ", "i": "anti-analysis/malformed/elf-header", "l": 4, "m": "B0001" }, { "c": 1.0, "d": "python code embedded in string", "e": [ "Detected python at offset 0xa8e8", "Detected python at offset 0xaa00", "Detected python at offset 0xaa38", "Detected python at offset 0xbdd8", "Detected python at offset 0xbe60" ], "i": "metadata/lang/embedded::python", "l": 2 }, { "c": 0.949999988079071, "d": "imports sys", "e": [ "sys" ], "i": "metadata/import/python::sys", "l": 2 }, { "c": 1.0, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "l": 2 }, { "d": "TMPDIR environment variable", "e": [ "TMPDIR" ], "i": "micro-behaviors/os/env/vars/access::tmpdir-var", "l": 2 }, { "c": 1.0, "d": "Binary is 500KB+", "e": [ "d9175993de906ebd595096bbb230303a1911a67d81529c5072974aadb572bfb3.elf" ], "i": "metadata/binary/metrics/threshold::large-binary-500k", "l": 1 }, { "c": 0.4000000059604645, "d": "LD_LIBRARY_PATH environment variable", "e": [ "LD_LIBRARY_PATH", "LD_LIBRARY_PATH_ORIG" ], "i": "micro-behaviors/os/linker/env::ld-library-path", "l": 2 }, { "c": 0.6200000047683716, "d": "fopen API string", "e": [ "fopen" ], "i": "micro-behaviors/fs/file/open::fopen-text", "l": 2 }, { "c": 0.20000000298023224, "d": "output keyword", "e": [ "Failed to extract %s: failed to allocate temporary output buffer!" ], "i": "micro-behaviors/data/text/keywords/lexicon::output", "l": 1 }, { "a": "T1095", "c": 0.6200000047683716, "d": "HIP routing field reference", "e": [ "HiP" ], "i": "objectives/command-and-control/channel/covert::hip-routing-field", "l": 1, "m": "C0014" }, { "a": "T1005", "d": "fseek API string", "e": [ "fseek" ], "i": "micro-behaviors/fs/file/binary::fseek-text", "l": 2 }, { "a": "T1110.001", "c": 0.8500000238418579, "d": "Service account ubuntu", "e": [ "ubuntu" ], "i": "objectives/lateral-movement/brute-force/password::service-account-ubuntu", "l": 1, "m": "E1110" }, { "c": 0.6200000047683716, "d": "fread API string", "e": [ "fread" ], "i": "micro-behaviors/fs/file/read::fread-text", "l": 2 }, { "c": 0.75, "d": "Archive open or extract instruction", "e": [ "open archive", "open referenced dependency archive" ], "i": "objectives/lateral-movement/social-engineering/lures::open-or-extract-zip-archive", "l": 1 }, { "c": 0.5799999833106995, "d": "Read own executable path fragment (self/ex)", "e": [ "/proc/self/exe" ], "i": "micro-behaviors/fs/proc/info/path::process-self-ex-fragment", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "d9175993de906ebd595096bbb230303a1911a67d81529c5072974aadb572bfb3.elf" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "__lxstat" ], "i": "objectives/evasion/kernel-hide/userspace::preload-rootkit-hook-set--rx-6", "l": 1 }, { "c": 0.20000000298023224, "d": "tmp keyword", "e": [ "tmp" ], "i": "micro-behaviors/data/text/keywords/lexicon::tmp", "l": 1 }, { "c": 0.800000011920929, "d": "libc version string pattern", "e": [ "GLIBC" ], "i": "micro-behaviors/dylib/library/libc::libc-version-string", "l": 2 }, { "a": "T1614", "c": 0.6000000238418579, "d": "Country code TJ token", "e": [ "TJ_" ], "i": "objectives/anti-analysis/geofencing/region/country-code-c::country-code-tj", "l": 1, "m": "B0007.003" }, { "c": 0.6600000262260437, "d": "Reference to /lib64", "e": [ "/lib64/ld-linux-x86-64.so.2" ], "i": "micro-behaviors/fs/path/system::system-lib64", "l": 2 }, { "c": 0.699999988079071, "d": "Unix var/tmp path fragment", "e": [ "/var/tmp" ], "i": "micro-behaviors/fs/path/temp::unix-var-temp-fragment", "l": 2 }, { "c": 1.0, "d": "File larger than 1MB", "e": [ "d9175993de906ebd595096bbb230303a1911a67d81529c5072974aadb572bfb3.elf" ], "i": "metadata/binary/metrics/size::large-file-1mb", "l": 2 }, { "c": 0.6000000238418579, "d": "References LD_LIBRARY_PATH environment variable", "e": [ "LD_LIBRARY_PATH", "LD_LIBRARY_PATH_ORIG" ], "i": "objectives/evasion/kernel-hide/userspace::ld-library-path-env", "l": 3 }, { "c": 0.9900000095367432, "d": "Downgrade embedded ELF markers in JRuby", "i": "well-known/lib/jruby::malformed-elf-downgrade", "l": 2 }, { "a": "T1620", "c": 0.8600000143051147, "d": "Reads own executable via procfs", "e": [ "/proc/self/exe" ], "i": "objectives/evasion/fileless/memory::proc-self-exe-source", "l": 3 }, { "a": "T1027", "c": 1.0, "d": "Binary is 1MB or larger", "e": [ "d9175993de906ebd595096bbb230303a1911a67d81529c5072974aadb572bfb3.elf" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::file-size-1m-plus", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Tiny C string section ratio", "e": [ " = 0.0% of total (0 / 8155082 bytes)" ], "i": "metadata/binary/section/metrics::tiny-cstring-section", "l": 1 }, { "d": ".exe extension reference", "e": [ ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 2 }, { "a": "T1005", "c": 0.75, "d": "File content manipulation (read/write/seek)", "e": [ "fseek", "fread" ], "i": "micro-behaviors/fs/file/binary::file-manipulation", "l": 3 } ], "sha": "d9175993de906ebd595096bbb230303a1911a67d81529c5072974aadb572bfb3", "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/2025-11/d9175993de906ebd595096bbb230303a1911a67d81529c5072974aadb572bfb3.elf", "type": "elf" } ], "tv": "9ea7c" } }