{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.0028699683025479317, "class": 0 } ], "prob": 0.0028699683, "class": 0, "models": [ { "m": "az", "prob": 0.0028699683, "class": 0 }, { "m": "az/native", "prob": 0.00015392201, "class": 0 }, { "m": "az/elf", "prob": 0.000040612933, "class": 0 } ], "version": "v16.16", "thresholds": [ 0.9953178, 0.9991311 ], "analyzed_at": "2026-05-02T19:04:32Z" }, "path": "x86__64__lsb__unix-system-v__gcc-6.5.0__O1__no-obf__unstripped__coreutils-8.30__mkdir", "raw": { "v": "4", "fs": [ { "f": "O₂(CI)H₃(F₃PoDb)Md₂(HeBi₂)", "x": 6, "id": 0, "is": [ "", "raise", "free", "vfprintf_chk", "abort", "errno_location", "strncmp", "exit", "fpending", "mkdir", "fcntl", "textdomain", "open_2", "fclose", "bindtextdomain", "dcgettext", "ctype_get_mb_cur_max", "chdir", "getopt_long", "mbrtowc", "overflow", "strrchr", "lseek", "assert_fail", "memset", "close", "libc_start_main", "memcmp", "fputs_unlocked", "calloc", "gmon_start__", "umask", "memcpy", "fileno", "xstat", "malloc", "fflush", "nl_langinfo", "fxstat", "lchown", "freading", "fchdir", "fwrite_unlocked", "chown", "realloc", "setlocale", "printf_chk", "fchmod", "chmod", "error", "waitpid", "open", "fseeko", "fchown", "cxa_atexit", "exit", "fwrite", "fprintf_chk", "mbsinit", "iswprint", "fork", "ctype_b_loc" ], "ms": { "elf": { "e_type": 2.0, "has_got": true, "has_plt": true, "has_note": true, "e_machine": 62.0, "class_bits": 64.0, "note_count": 1.0, "nx_enabled": true, "entry_point": 4200688.0, "needed_libs": 1.0, "dynsym_count": 70.0, "has_eh_frame": true, "symtab_count": 268.0, "dynrela_count": 7.0, "entry_section": ".text", "little_endian": true, "pltreloc_count": 60.0, "has_interpreter": true, "fini_array_count": 1.0, "init_array_count": 1.0, "program_header_count": 8.0, "section_header_count": 30.0, "load_segment_max_p_memsz": 33140.0, "load_segment_max_p_filesz": 33140.0, "section_relocation_group_count": 2.0 }, "binary": { "code_size": 17780.0, "file_size": 46656.0, "entry_point": 4200688.0, "has_overlay": true, "code_entropy": 3.97, "data_entropy": 2.63, "export_count": 151.0, "import_count": 62.0, "overlay_size": 1921.0, "string_count": 400.0, "overlay_ratio": 0.04, "section_count": 29.0, "avg_complexity": 5.63, "function_count": 158.0, "import_density": 3.57, "max_complexity": 334.0, "string_density": 23.04, "aliased_exports": 59.0, "overall_entropy": 2.71, "overlay_entropy": 1.57, "avg_basic_blocks": 6.07, "avg_section_size": 1538.83, "dependency_count": 1.0, "entropy_variance": 1.6, "function_density": 9.1, "avg_function_size": 108.2, "avg_string_length": 17.44, "complexity_per_kb": 0.32, "max_string_length": 254.0, "avg_string_entropy": 3.18, "code_to_data_ratio": 0.66, "data_to_file_ratio": 0.0, "text_to_file_ratio": 0.36, "total_basic_blocks": 959.0, "string_length_stddev": 21.18, "largest_section_ratio": 0.36, "sentence_string_count": 40.0, "sentence_string_ratio": 0.1, "behavioral_import_ratio": 0.02, "function_analysis_depth": 2.0, "high_complexity_functions": 3.0 } }, "ss": [ [ 0, "textdomain" ], [ 512, "/lib64/ld-linux-x86-64.so.2" ], [ 2827, "fflush" ], [ 2834, "fchmod" ], [ 2841, "__printf_chk" ], [ 2854, "setlocale" ], [ 2864, "mbrtowc" ], [ 2872, "strncmp" ], [ 2880, "optind" ], [ 2887, "strrchr" ], [ 2895, "dcgettext" ], [ 2905, "fchdir" ], [ 2912, "error" ], [ 2923, "iswprint" ], [ 2938, "realloc" ], [ 2946, "abort" ], [ 2958, "program_invocation_name" ], [ 2982, "__assert_fail" ], [ 2996, "__ctype_get_mb_cur_max" ], [ 3019, "lchown" ], [ 3026, "calloc" ], [ 3033, "memset" ], [ 3040, "__errno_location" ], [ 3057, "memcmp" ], [ 3064, "__fprintf_chk" ], [ 3078, "fchown" ], [ 3085, "stdout" ], [ 3092, "lseek" ], [ 3098, "memcpy" ], [ 3105, "fclose" ], [ 3112, "malloc" ], [ 3125, "raise" ], [ 3131, "mbsinit" ], [ 3139, "nl_langinfo" ], [ 3151, "__ctype_b_loc" ], [ 3165, "__open_2" ], [ 3174, "optarg" ], [ 3181, "__freading" ], [ 3192, "stderr" ], [ 3199, "getopt_long" ], [ 3211, "__fxstat" ], [ 3220, "fileno" ], [ 3227, "fwrite" ], [ 3234, "waitpid" ], [ 3242, "__fpending" ], [ 3253, "open" ], [ 3258, "__vfprintf_chk" ], [ 3273, "program_invocation_short_name" ], [ 3309, "__xstat" ], [ 3317, "bindtextdomain" ], [ 3332, "fwrite_unlocked" ], [ 3348, "__libc_start_main" ], [ 3366, "fseeko" ], [ 3373, "__overflow" ], [ 3384, "fputs_unlocked" ], [ 3399, "free" ], [ 3404, "__progname" ], [ 3415, "__progname_full" ], [ 3431, "__cxa_atexit" ], [ 3444, "__gmon_start__" ], [ 3469, "GLIBC_2.14" ], [ 6630, "ATUSH" ], [ 6800, "AVAUATUSI" ], [ 7959, "AVAUATUSH" ], [ 9073, "AWAVAUATUSH" ], [ 9817, "AUATUSH" ], [ 10711, "ATUS" ], [ 16312, "ATUSL" ], [ 19259, "AWAVM" ], [ 19353, "AWAVAUM" ], [ 19456, "AWAVAUATL" ], [ 19576, "AWAVAUAT" ], [ 20504, "TUUUUUUU" ], [ 20638, "SUUUUUUUH9" ], [ 22976, "AWAVA" ], [ 22983, "AUATL" ], [ 23180, "test invocation" ], [ 23196, "Multi-call invocation" ], [ 23218, "sha224sum" ], [ 23228, "sha2 utilities" ], [ 23243, "sha256sum" ], [ 23253, "sha384sum" ], [ 23263, "sha512sum" ], [ 23273, "%s online help: \u003c%s\u003e" ], [ 23296, "GNU coreutils" ], [ 23314, "created directory %s" ], [ 23335, "David MacKenzie" ], [ 23357, "missing operand" ], [ 23373, "invalid mode %s" ], [ 23389, "context" ], [ 23397, "mode" ], [ 23402, "parents" ], [ 23410, "verbose" ], [ 23423, "version" ], [ 23432, "Try '%s --help' for more information." ], [ 23472, "Usage: %s [OPTION]... DIRECTORY..." ], [ 23512, "Create the DIRECTORY(ies), if they do not already exist." ], [ 23576, "Mandatory arguments to long options are mandatory for short options too." ], [ 23656, "-m, --mode=MODE set file mode (as in chmod), not a=rwx - umask\n -p, --parents no error if existing, make parent directori" ], [ 23723, "-p, --parents no error if existing, make parent directories as needed" ], [ 23799, "-v, --verbose print a message for each created directory" ], [ 23864, "-Z set SELinux security context of each created directory\n to the default type\n -" ], [ 23942, "to the default type" ], [ 23987, "--context[=CTX] like -Z, or if CTX is specified then set the SELinux" ], [ 24063, "or SMACK security context to CTX" ], [ 24128, "--help display this help and exit" ], [ 24176, "--version output version information and exit" ], [ 24232, "https://www.gnu.org/software/coreutils/" ], [ 24272, "Report %s translation bugs to \u003chttps://translationproject.org/team/\u003e" ], [ 24344, "Full documentation at: \u003c%s%s\u003e" ], [ 24376, "or available locally via: info '(coreutils) %s%s'" ], [ 24432, "/tmp/coreutils/_out/share/locale" ], [ 24472, "warning: ignoring --context; it requires an SELinux/SMACK-enabled kernel" ], [ 24803, "8.30" ], [ 24808, "write error" ], [ 24829, "cannot create directory %s" ], [ 24856, "cannot change permissions of %s" ], [ 24888, "cannot change owner and permissions of %s" ], [ 25200, "A NULL argv[0] was passed through an exec system call." ], [ 25256, "/.libs/" ], [ 25287, "GB18030" ], [ 25297, "literal" ], [ 25311, "shell-always" ], [ 25324, "shell-escape" ], [ 25337, "shell-escape-always" ], [ 25357, "c-maybe" ], [ 25365, "clocale" ], [ 27160, "lib/savewd.c" ], [ 27173, "wd-\u003eval.child == 0" ], [ 27192, "(*__errno_location ()) == 4" ], [ 27220, "wd-\u003eval.child \u003c 0" ], [ 27512, "savewd_finish" ], [ 27528, "savewd_restore" ], [ 27544, "savewd_save" ], [ 27560, "savewd_chdir" ], [ 27573, "%s (%s) %s" ], [ 27596, "Written by %s." ], [ 27612, "Written by %s and %s." ], [ 27635, "Written by %s, %s, and %s." ], [ 27663, "Report bugs to: %s" ], [ 27684, "bug-coreutils@gnu.org" ], [ 27706, "%s home page: \u003c%s\u003e" ], [ 27728, "License GPLv3+: GNU GPL version 3 or later \u003chttps://gnu.org/licenses/gpl.html\u003e.\nThis is free software: you are free to change an" ], [ 27729, "License GPLv3+: GNU GPL version 3 or later \u003chttps://gnu.org/licenses/gpl.html\u003e." ], [ 27809, "This is free software: you are free to change and redistribute it." ], [ 27876, "There is NO WARRANTY, to the extent permitted by law." ], [ 27936, "Written by %s, %s, %s," ], [ 27959, "and %s." ], [ 27991, "%s, and %s." ], [ 28031, "%s, %s, and %s." ], [ 28071, "%s, %s, %s, and %s." ], [ 28239, "%s, %s, and others." ], [ 28264, "General help using GNU software: \u003chttps://www.gnu.org/gethelp/\u003e" ], [ 28416, "Copyright %s %d Free Software Foundation, Inc." ], [ 28463, "memory exhausted" ], [ 28480, "POSIX" ], [ 28486, "ASCII" ], [ 34260, "GCC: (GNU) 6.5.0" ], [ 40713, "crtstuff.c" ], [ 40724, "__JCR_LIST__" ], [ 40737, "deregister_tm_clones" ], [ 40758, "__do_global_dtors_aux" ], [ 40780, "completed.6954" ], [ 40795, "__do_global_dtors_aux_fini_array_entry" ], [ 40834, "frame_dummy" ], [ 40846, "__frame_dummy_init_array_entry" ], [ 40877, "mkdir.c" ], [ 40885, "process_dir" ], [ 40897, "announce_mkdir" ], [ 40912, "make_ancestor" ], [ 40926, "longopts" ], [ 40935, "prog-fprintf.c" ], [ 40950, "selinux.c" ], [ 40960, "version.c" ], [ 40970, "closeout.c" ], [ 40981, "exitfail.c" ], [ 40992, "mkdir-p.c" ], [ 41002, "modechange.c" ], [ 41015, "progname.c" ], [ 41026, "quotearg.c" ], [ 41037, "strcaseeq6" ], [ 41048, "gettext_quote" ], [ 41062, "quotearg_buffer_restyled" ], [ 41087, "quotearg_n_options" ], [ 41106, "slotvec" ], [ 41114, "nslots" ], [ 41121, "slotvec0" ], [ 41130, "slot0" ], [ 41136, "default_quoting_options" ], [ 41160, "savewd.c" ], [ 41169, "__PRETTY_FUNCTION__.4340" ], [ 41194, "__PRETTY_FUNCTION__.4355" ], [ 41219, "__PRETTY_FUNCTION__.4371" ], [ 41244, "__PRETTY_FUNCTION__.4397" ], [ 41269, "version-etc.c" ], [ 41283, "version-etc-fsf.c" ], [ 41301, "xmalloc.c" ], [ 41311, "xalloc-die.c" ], [ 41324, "mbrtowc.c" ], [ 41334, "c-strcasecmp.c" ], [ 41349, "close-stream.c" ], [ 41364, "open-safer.c" ], [ 41377, "hard-locale.c" ], [ 41391, "localcharset.c" ], [ 41406, "mkancesdirs.c" ], [ 41420, "dirchownmod.c" ], [ 41434, "fd-safer.c" ], [ 41445, "fclose.c" ], [ 41454, "fflush.c" ], [ 41463, "fseeko.c" ], [ 41472, "nl_langinfo.c" ], [ 41486, "dup-safer.c" ], [ 41498, "fcntl.c" ], [ 41506, "have_dupfd_cloexec.3212" ], [ 41530, "__FRAME_END__" ], [ 41544, "__JCR_END__" ], [ 41556, "__init_array_end" ], [ 41573, "_DYNAMIC" ], [ 41582, "__init_array_start" ], [ 41601, "__GNU_EH_FRAME_HDR" ], [ 41620, "_GLOBAL_OFFSET_TABLE_" ], [ 41642, "quotearg_n_mem" ], [ 41657, "__libc_csu_fini" ], [ 41673, "quotearg_char" ], [ 41687, "__progname@@GLIBC_2.2.5" ], [ 41711, "raise@@GLIBC_2.2.5" ], [ 41730, "free@@GLIBC_2.2.5" ], [ 41748, "version_etc" ], [ 41760, "mode_compile" ], [ 41773, "quote_quoting_options" ], [ 41795, "__vfprintf_chk@@GLIBC_2.3.4" ], [ 41823, "abort@@GLIBC_2.2.5" ], [ 41842, "__errno_location@@GLIBC_2.2.5" ], [ 41872, "quotearg_alloc_mem" ], [ 41891, "strncmp@@GLIBC_2.2.5" ], [ 41912, "_ITM_deregisterTMCloneTable" ], [ 41940, "stdout@@GLIBC_2.2.5" ], [ 41979, "savewd_process_files" ], [ 42000, "set_quoting_flags" ], [ 42018, "rpl_mbrtowc" ], [ 42030, "__fpending@@GLIBC_2.2.5" ], [ 42054, "quotearg_n_style" ], [ 42071, "mkdir@@GLIBC_2.2.5" ], [ 42090, "quotearg_buffer" ], [ 42106, "set_program_name" ], [ 42123, "quotearg_n_custom" ], [ 42141, "atexit" ], [ 42148, "make_dir_parents" ], [ 42165, "quotearg_n_custom_mem" ], [ 42187, "quotearg_style" ], [ 42202, "fcntl@@GLIBC_2.2.5" ], [ 42221, "_edata" ], [ 42241, "prog_fprintf" ], [ 42274, "fclose@@GLIBC_2.2.5" ], [ 42294, "optind@@GLIBC_2.2.5" ], [ 42314, "bindtextdomain@@GLIBC_2.2.5" ] ], "sz": 46656, "ts": [ { "c": 1.0, "d": "ELF program interpreter present", "e": [ "/lib64/ld-linux-x86-64.so.2" ], "i": "metadata/binary/linking::elf-interpreter", "l": 2 }, { "c": 1.0, "d": "ELF needed library", "e": [ "libc.so.6" ], "i": "metadata/binary/linking::elf-needed-lib", "l": 2 }, { "c": 1.0, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "l": 2 }, { "d": "Usage: label in binary strings", "e": [ "Usage: %s [OPTION]... DIRECTORY..." ], "i": "metadata/package/help::usage-title-string", "l": 1 }, { "c": 1.0, "d": "Binary has 20+ exports", "e": [ "binary.export_count = 151.00" ], "i": "metadata/binary/metrics::many-exports-20", "l": 1 }, { "c": 0.6600000262260437, "d": "Open files", "e": [ "open" ], "i": "micro-behaviors/fs/file/open::open-base", "l": 2 }, { "c": 0.6600000262260437, "d": "Change file ownership", "e": [ "chown" ], "i": "micro-behaviors/fs/chown::chown-fn", "l": 3 }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening::no-pie", "l": 2 }, { "c": 0.30000001192092896, "d": "chdir syscall symbol", "e": [ "chdir" ], "i": "micro-behaviors/fs/directory/mkdir::chdir-symbol", "l": 2 }, { "c": 0.8999999761581421, "d": "ELF dynstr section name", "e": [ ".dynstr" ], "i": "metadata/binary/linking::elf-dynstr-section-name", "l": 2 }, { "c": 0.6600000262260437, "d": "Process forking", "e": [ "fork" ], "i": "micro-behaviors/process/fork/clone::fork", "l": 2 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.18" ], "i": "metadata/binary/metrics::avg-string-entropy-4-max", "l": 2 }, { "c": 0.8999999761581421, "d": "Abort program execution", "e": [ "abort" ], "i": "micro-behaviors/os/signal/handler::abort", "l": 2 }, { "c": 0.699999988079071, "d": "Version information string", "e": [ "--version" ], "i": "metadata/package/help::version-text", "l": 2 }, { "c": 0.6000000238418579, "d": "Small ELF binary (\u003c 50KB)", "e": [ "x86__64__lsb__unix-system-v__gcc-6.5.0__O1__no-obf__unstripped__coreutils-8.30__mkdir" ], "i": "metadata/binary/metrics::small-elf-binary", "l": 2 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 62.00" ], "i": "metadata/binary/metrics::many-imports-30", "l": 1 }, { "d": "Characteristic system library export __assert_fail", "e": [ "assert_fail" ], "i": "micro-behaviors/dylib/library/libc::libc-characteristic-assert-fail", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 62.00" ], "i": "metadata/binary/metrics::many-imports-50", "l": 1 }, { "c": 0.699999988079071, "d": "GPL license reference", "e": [ "GPL", "GPL" ], "i": "metadata/package/license::gpl-word", "l": 2 }, { "c": 0.8999999761581421, "d": "ELF interpreter section name", "e": [ ".interp" ], "i": "metadata/binary/linking::elf-interpreter-section-name", "l": 2 }, { "c": 0.8999999761581421, "d": "ELF dynamic section name", "e": [ ".dynamic" ], "i": "metadata/binary/linking::elf-dynamic-section-name", "l": 2 }, { "d": "Characteristic system library export __errno_location", "e": [ "errno_location" ], "i": "micro-behaviors/dylib/library/libc::libc-characteristic-errno", "l": 2 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 62.00" ], "i": "metadata/binary/metrics::many-imports-40", "l": 1 }, { "c": 0.6600000262260437, "d": "Change file ownership", "e": [ "lchown" ], "i": "micro-behaviors/fs/chown::lchown-fn", "l": 3 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 62.00" ], "i": "metadata/binary/metrics::many-imports-25", "l": 1 }, { "a": "T1059.006", "c": 0.6000000238418579, "d": "Named /tmp execution path", "e": [ "/tmp/coreutils" ], "i": "objectives/command-and-control/dropper::tmp-path", "l": 1, "m": "B0024" }, { "a": "T1005", "c": 0.4000000059604645, "d": "Seeks to position in file", "e": [ "fseeko", "fseeko@@GLIBC_2.2.5", "rpl_fseeko", "sym.imp.fseeko", "sym.rpl_fseeko" ], "i": "micro-behaviors/fs/file/binary::fseek-func", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.function_count = 158.00" ], "i": "metadata/binary/metrics::many-functions-50", "l": 1 }, { "c": 0.6600000262260437, "d": "Reference to /lib64", "e": [ "/lib64/ld-linux-x86-64.so.2" ], "i": "micro-behaviors/fs/path/system::system-lib64", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "binary.file_size = 46656.00" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 1.0, "d": "Binary has 20+ sections (installer/packer)", "e": [ "binary.section_count = 29.00" ], "i": "metadata/binary/metrics::many-sections-20", "l": 1 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 62.00" ], "i": "metadata/binary/metrics::many-imports-20", "l": 1 }, { "c": 1.0, "d": "ELF64 class marker", "e": [ "elf.class_bits = 64.00" ], "i": "metadata/binary/metrics::elf64-class", "l": 1 }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.function_count = 158.00" ], "i": "metadata/binary/metrics::many-functions", "l": 2 }, { "c": 0.8999999761581421, "d": "CLI help or usage text", "e": [ "Try '%s --help' for more information." ], "i": "metadata/binary/metrics::help-usage-string", "l": 2 }, { "c": 0.6600000262260437, "d": "Write files", "e": [ "fwrite" ], "i": "micro-behaviors/fs/file/write::write", "l": 2 }, { "c": 0.6600000262260437, "d": "Change file ownership by fd", "e": [ "fchown" ], "i": "micro-behaviors/fs/chown::fchown-fn", "l": 3 }, { "a": "T1486", "c": 0.75, "d": "flock LOCK_EX call bytecode pattern", "e": [ "be 60 bc ff ff" ], "i": "objectives/impact/ransom/esxi::flock-lockex", "l": 1, "m": "C0027" }, { "c": 0.800000011920929, "d": "Invokes mkdir", "e": [ "mkdir", "mkdir", "mkdir" ], "i": "micro-behaviors/process/create/tool::mkdir-invocation", "l": 3 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 5.63" ], "i": "metadata/binary/metrics::avg-complexity-15-max", "l": 2 }, { "c": 0.800000011920929, "d": "libc version string pattern", "e": [ "GLIBC", "GLIBC", "GLIBC", "GLIBC", "GLIBC", "GLIBC", "GLIBC", "GLIBC", "GLIBC", "GLIBC", "GLIBC", "GLIBC", "GLIBC", "GLIBC", "GLIBC", "GLIBC" ], "i": "micro-behaviors/dylib/library/libc::libc-version-string", "l": 2 }, { "c": 0.8500000238418579, "d": "Send signal to self", "e": [ "raise" ], "i": "micro-behaviors/os/signal/handler::raise", "l": 2 }, { "a": "T1055", "c": 0.25, "d": "Repeated 0x07 code constant (possible PROT_RWX)", "e": [ "07 00 00 00", "07 00 00 00", "07 00 00 00" ], "i": "micro-behaviors/mem/protect/modify::rwx-prot-bytes", "l": 1 }, { "c": 0.8999999761581421, "d": "ELF dynsym section name", "e": [ ".dynsym" ], "i": "metadata/binary/linking::elf-dynsym-section-name", "l": 2 }, { "c": 1.0, "d": "/tmp/ path component", "e": [ "/tmp/coreutils/_out/share/locale" ], "i": "micro-behaviors/fs/path/temp::tmp-path-content", "l": 2 }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2 }, { "d": ".so extension reference", "e": [ ".so" ], "i": "micro-behaviors/fs/path/extension::so", "l": 2 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.function_count = 158.00" ], "i": "metadata/binary/metrics::few-functions-3", "l": 1 }, { "d": "Characteristic system library export __cxa_atexit", "e": [ "cxa_atexit" ], "i": "micro-behaviors/dylib/library/libc::libc-characteristic-cxa-atexit", "l": 2 }, { "c": 0.6600000262260437, "d": "Create directories", "e": [ "mkdir" ], "i": "micro-behaviors/fs/directory/mkdir::mkdir-base", "l": 2 }, { "c": 0.6600000262260437, "d": "Wait for child process state", "e": [ "waitpid" ], "i": "micro-behaviors/process/control/wait::waitpid", "l": 2 }, { "d": "Binary exports symbols", "e": [ "binary.export_count = 151.00" ], "i": "metadata/binary/symbols::has-exports", "l": 1 }, { "c": 1.0, "d": "Binary has 100+ exports", "e": [ "binary.export_count = 151.00" ], "i": "metadata/binary/metrics::many-exports-100", "l": 1 }, { "c": 0.4000000059604645, "d": "Set file creation mask (umask)", "e": [ "umask" ], "i": "micro-behaviors/fs/chmod/modify::umask", "l": 2 }, { "c": 0.4000000059604645, "d": "Terminate process immediately without cleanup", "e": [ "exit", "exit" ], "i": "micro-behaviors/process/terminate/signal::_exit", "l": 2 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 2.71" ], "i": "metadata/binary/metrics::low-overall-entropy-binary", "l": 1 }, { "c": 0.30000001192092896, "d": "GNU coreutils reference", "e": [ "GNU coreutils" ], "i": "micro-behaviors/dylib/library::gnu-coreutils-ref", "l": 2 }, { "a": "T1083", "c": 0.4000000059604645, "d": "File descriptor manipulation and control", "e": [ "fcntl" ], "i": "micro-behaviors/fs/file/handle::fcntl", "l": 2, "m": "E1083" }, { "c": 0.800000011920929, "d": "Binary has many exports (\u003e10)", "e": [ "binary.export_count = 151.00" ], "i": "metadata/binary/metrics::many-exports", "l": 2 }, { "d": "overflow keyword", "e": [ "overflow", "__overflow", "overflow@@GLIBC_2.2.5", "__overflow@@GLIBC_2.2.5" ], "i": "micro-behaviors/data/text/keywords::overflow", "l": 1 }, { "c": 0.20000000298023224, "d": "output keyword", "e": [ "--version output version information and exit" ], "i": "micro-behaviors/data/text/keywords::output", "l": 1 }, { "d": "Characteristic system library exports", "e": [ "libc_start_main" ], "i": "micro-behaviors/dylib/library/libc::libc-characteristic-symbols", "l": 2 }, { "c": 0.699999988079071, "d": "Unix /tmp/ path reference", "e": [ "/tmp/coreutils/_out/share/locale" ], "i": "micro-behaviors/fs/path/temp::unix-temp", "l": 2 }, { "c": 1.0, "d": "Binary has 9+ exports", "e": [ "binary.export_count = 151.00" ], "i": "metadata/binary/metrics::many-exports-9", "l": 1 }, { "c": 1.0, "d": "Binary format is identified", "e": [ "elf.class_bits = 64.00" ], "i": "metadata/binary::binary-format-checked", "l": 2 }, { "c": 0.6000000238418579, "d": "Binary not position-independent (no ASLR)", "e": [ "elf.e_type = 2.00" ], "i": "metadata/hardening::no-pie-struct", "l": 3 }, { "a": "T1222", "c": 0.6600000262260437, "d": "fchmod syscall", "e": [ "fchmod" ], "i": "micro-behaviors/fs/chmod::syscall-fchmod", "l": 3, "m": "E1222" }, { "c": 0.8999999761581421, "d": "ELF dynstr section name", "e": [ ".dynstr" ], "i": "metadata/hardening::elf-dynstr-section-name", "l": 2 }, { "c": 1.0, "d": "ELF program interpreter metadata", "e": [ "/lib64/ld-linux-x86-64.so.2" ], "i": "metadata/binary/linking/runtime::interpreter", "l": 2 }, { "c": 0.8999999761581421, "d": "No stack canary (stack smashing protection absent)", "e": [ "elf.stack_canary = 0.00" ], "i": "metadata/hardening::no-stack-canary", "l": 2 }, { "c": 0.8999999761581421, "d": "ELF dynamic section name", "e": [ ".dynamic" ], "i": "metadata/hardening::elf-dynamic-section-name", "l": 2 }, { "a": "T1222", "c": 0.6600000262260437, "d": "chmod syscall", "e": [ "chmod" ], "i": "micro-behaviors/fs/chmod::syscall-chmod", "l": 3, "m": "E1222" }, { "c": 1.0, "d": "ELF needed library metadata", "e": [ "libc.so.6" ], "i": "metadata/binary/linking/runtime::needed-lib", "l": 2 }, { "c": 0.8999999761581421, "d": "No RELRO (GOT writable after load)", "e": [ "elf.relro = 0.00" ], "i": "metadata/hardening::no-relro", "l": 2 }, { "c": 0.8999999761581421, "d": "ELF dynsym section name", "e": [ ".dynsym" ], "i": "metadata/hardening::elf-dynsym-section-name", "l": 2 }, { "c": 0.8999999761581421, "d": "ELF interpreter section name", "e": [ ".interp" ], "i": "metadata/hardening::elf-interpreter-section-name", "l": 2 }, { "c": 0.6600000262260437, "d": "Reference to /tmp", "e": [ "/tmp/coreutils/_out/share/locale", "/tmp/coreutils/_out/share/locale" ], "i": "micro-behaviors/fs/path/temp::temp-tmp", "l": 2 }, { "a": "T1005", "c": 0.75, "d": "File content manipulation (read/write/seek)", "e": [ "rpl_fseeko", "fseeko@@GLIBC_2.2.5", "sym.imp.fseeko", "sym.rpl_fseeko", "fseeko", "fwrite" ], "i": "micro-behaviors/fs/file/binary::file-manipulation", "l": 3 }, { "c": 0.8500000238418579, "d": "Documented command line program", "e": [ "Usage: %s [OPTION]... DIRECTORY...", "binary.import_count = 62.00" ], "i": "metadata/package/help::documented-cli-binary", "l": 1 } ], "sha": "de6bbccf494193e25cdf5c1dbf18dbacf51f25ea360b312ef12fa3f1e6cc8ba7", "path": "/data/samples/good/datasets/Labeled-Elfs/benignware/x86__64__lsb__unix-system-v__gcc-6.5.0__O1__no-obf__unstripped__coreutils-8.30__mkdir", "type": "elf" } ], "tv": "96b0e" } }