{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 0.007548119407147169,
        "class": 0
      }
    ],
    "prob": 0.0075481194,
    "class": 0,
    "models": [
      {
        "m": "az",
        "prob": 0.0075481194,
        "class": 0
      },
      {
        "m": "az/native",
        "prob": 0.0,
        "class": 0
      },
      {
        "m": "az/elf",
        "prob": 0.0,
        "class": 0
      }
    ],
    "version": "v17.17",
    "thresholds": [
      0.999503,
      0.9998882
    ],
    "analyzed_at": "2026-05-24T16:32:31Z"
  },
  "path": "e3a6d0d139dc56f28f82ec161b3d17ecd137b088acd3a0e8330a5d412c025b73.elf",
  "raw": {
    "v": "5",
    "fs": [
      {
        "f": "H₂(FPo)Md₂(BiHe)",
        "x": 6,
        "ff": {
          "i": [
            [
              "",
              "getenv"
            ],
            [
              "",
              "libc_start_main"
            ],
            [
              "",
              "errno_location"
            ],
            [
              "",
              "ITM_deregisterTMCloneTable"
            ],
            [
              "",
              "getpid"
            ],
            [
              "",
              "strlen"
            ],
            [
              "",
              "stack_chk_fail"
            ],
            [
              "",
              "memset"
            ],
            [
              "",
              "memcmp"
            ],
            [
              "",
              "calloc"
            ],
            [
              "",
              "putenv"
            ],
            [
              "",
              "atoll"
            ],
            [
              "",
              "fprintf"
            ],
            [
              "",
              "gmon_start__"
            ],
            [
              "",
              "stat"
            ],
            [
              "",
              "memcpy"
            ],
            [
              "",
              "time"
            ],
            [
              "",
              "malloc"
            ],
            [
              "",
              "isoc99_sscanf"
            ],
            [
              "",
              "execvp"
            ],
            [
              "",
              "sprintf"
            ],
            [
              "",
              "exit"
            ],
            [
              "",
              "fwrite"
            ],
            [
              "",
              "ITM_registerTMCloneTable"
            ],
            [
              "",
              "strdup"
            ],
            [
              "",
              "strerror"
            ],
            [
              "",
              "cxa_finalize"
            ]
          ],
          "m": {
            "elf": {
              "bits": 64.0,
              "entry": 4864.0,
              "has_got": 1.0,
              "has_plt": 1.0,
              "has_note": 1.0,
              "relacount": 3.0,
              "note_count": 3.0,
              "nx_enabled": 1.0,
              "has_cet_ibt": 1.0,
              "dynrel_count": 0.0,
              "dynsym_count": 32.0,
              "has_build_id": 1.0,
              "has_eh_frame": 1.0,
              "has_gnu_hash": 1.0,
              "stack_canary": 1.0,
              "symtab_count": 0.0,
              "dynrela_count": 10.0,
              "has_cet_shstk": 1.0,
              "little_endian": 1.0,
              "dt_flags_1_raw": 134217729.0,
              "pltreloc_count": 22.0,
              "build_id_length": 20.0,
              "dt_versym_count": 32.0,
              "executable_stack": 0.0,
              "fini_array_count": 1.0,
              "init_array_count": 1.0,
              "wx_segment_count": 0.0,
              "comment_entry_count": 1.0,
              "program_header_count": 13.0,
              "comment_distinct_count": 1.0,
              "gnu_stack_section_absent": 0.0,
              "load_segment_max_file_size": 6077.0,
              "stripped_but_symtab_present": 0.0,
              "load_segment_max_memory_size": 6424.0,
              "section_relocation_group_count": 2.0,
              "stripped_metadata_section_count": 7.0
            },
            "file": {
              "size": 19784.0,
              "entropy": 5.05,
              "size_bytes": 19784.0
            },
            "binary": {
              "is_pie": 1.0,
              "has_overlay": 1.0,
              "is_stripped": 1.0,
              "code_entropy": 5.29,
              "data_entropy": 7.14,
              "overlay_size": 1860.0,
              "string_count": 138.0,
              "overlay_ratio": 0.09,
              "overlay_entropy": 1.41,
              "entropy_variance": 2.72,
              "avg_string_length": 7.45,
              "max_string_length": 44.0,
              "code_to_data_ratio": 0.39,
              "string_length_stddev": 5.75,
              "largest_section_ratio": 0.27,
              "sentence_string_count": 2.0,
              "sentence_string_ratio": 0.01,
              "high_entropy_string_count": 0.0
            },
            "exports": {
              "count": 4.0
            },
            "imports": {
              "count": 27.0
            },
            "sections": {
              "count": 29.0,
              "code_size": 3932.0,
              "entropy_max": 7.95,
              "entropy_mean": 3.18,
              "name_entropy": 4.23,
              "writable_count": 6.0,
              "executable_count": 6.0,
              "nonstandard_count": 6.0,
              "executable_writable_count": 0.0
            },
            "dependencies": {
              "count": 1.0
            }
          },
          "s": [
            [
              792,
              "u8",
              "/lib64/ld-linux-x86-64.so.2"
            ],
            [
              1769,
              "u8",
              "__cxa_finalize"
            ],
            [
              1784,
              "u8",
              "malloc"
            ],
            [
              1791,
              "u8",
              "getpid"
            ],
            [
              1803,
              "u8",
              "__libc_start_main"
            ],
            [
              1821,
              "u8",
              "fprintf"
            ],
            [
              1829,
              "u8",
              "putenv"
            ],
            [
              1836,
              "u8",
              "memset"
            ],
            [
              1843,
              "u8",
              "strlen"
            ],
            [
              1850,
              "u8",
              "strdup"
            ],
            [
              1857,
              "u8",
              "getenv"
            ],
            [
              1864,
              "u8",
              "memcmp"
            ],
            [
              1871,
              "u8",
              "sprintf"
            ],
            [
              1879,
              "u8",
              "execvp"
            ],
            [
              1886,
              "u8",
              "stderr"
            ],
            [
              1893,
              "u8",
              "memcpy"
            ],
            [
              1900,
              "u8",
              "atoll"
            ],
            [
              1906,
              "u8",
              "strerror"
            ],
            [
              1915,
              "u8",
              "__errno_location"
            ],
            [
              1932,
              "u8",
              "exit"
            ],
            [
              1937,
              "u8",
              "__isoc99_sscanf"
            ],
            [
              1953,
              "u8",
              "fwrite"
            ],
            [
              1960,
              "u8",
              "__stack_chk_fail"
            ],
            [
              1977,
              "u8",
              "calloc"
            ],
            [
              1984,
              "u8",
              "time"
            ],
            [
              1989,
              "u8",
              "__environ"
            ],
            [
              2019,
              "u8",
              "GLIBC_2.14"
            ],
            [
              2030,
              "u8",
              "GLIBC_2.33"
            ],
            [
              2051,
              "u8",
              "GLIBC_2.34"
            ],
            [
              2074,
              "u8",
              "_ITM_deregisterTMCloneTable"
            ],
            [
              2102,
              "u8",
              "__gmon_start__"
            ],
            [
              2117,
              "u8",
              "_ITM_registerTMCloneTable"
            ],
            [
              4881,
              "u8",
              "PTE1"
            ],
            [
              7824,
              "u8",
              "ATSH"
            ],
            [
              8205,
              "u8",
              "=%lu %d"
            ],
            [
              8213,
              "u8",
              "%lu %d%c"
            ],
            [
              8224,
              "u8",
              "E: neither argv[0] nor $_ works."
            ],
            [
              8257,
              "u8",
              "\u003cnull\u003e"
            ],
            [
              8268,
              "u8",
              "%s%s%s: %s"
            ],
            [
              14170,
              "u8",
              "/uOb"
            ],
            [
              16757,
              "u8",
              "Wu1krH"
            ],
            [
              17613,
              "u8",
              "GCC: (Ubuntu 11.4.0-1ubuntu1~22.04.2) 11.4.0"
            ],
            [
              17659,
              "u8",
              ".shstrtab"
            ],
            [
              17669,
              "u8",
              ".interp"
            ],
            [
              17677,
              "u8",
              ".note.gnu.property"
            ],
            [
              17696,
              "u8",
              ".note.gnu.build-id"
            ],
            [
              17715,
              "u8",
              ".note.ABI-tag"
            ],
            [
              17729,
              "u8",
              ".gnu.hash"
            ],
            [
              17739,
              "u8",
              ".dynsym"
            ],
            [
              17747,
              "u8",
              ".dynstr"
            ],
            [
              17755,
              "u8",
              ".gnu.version"
            ],
            [
              17768,
              "u8",
              ".gnu.version_r"
            ],
            [
              17783,
              "u8",
              ".rela.dyn"
            ],
            [
              17793,
              "u8",
              ".rela.plt"
            ],
            [
              17803,
              "u8",
              ".init"
            ],
            [
              17809,
              "u8",
              ".plt.got"
            ],
            [
              17818,
              "u8",
              ".plt.sec"
            ],
            [
              17827,
              "u8",
              ".text"
            ],
            [
              17833,
              "u8",
              ".fini"
            ],
            [
              17839,
              "u8",
              ".rodata"
            ],
            [
              17847,
              "u8",
              ".eh_frame_hdr"
            ],
            [
              17861,
              "u8",
              ".eh_frame"
            ],
            [
              17871,
              "u8",
              ".init_array"
            ],
            [
              17883,
              "u8",
              ".fini_array"
            ],
            [
              17895,
              "u8",
              ".dynamic"
            ],
            [
              17904,
              "u8",
              ".data"
            ],
            [
              17910,
              "u8",
              ".bss"
            ],
            [
              17915,
              "u8",
              ".comment"
            ],
            [
              21728,
              "u8",
              "_environ"
            ]
          ],
          "v": {
            "elf.type": "dynamic",
            "elf.class": "elf64",
            "elf.entry": 4864,
            "elf.relro": "full",
            "elf.abi.os": "linux",
            "elf.distro": "ubuntu",
            "elf.endian": "little",
            "elf.machine": "x86_64",
            "elf.version": 1,
            "elf.build_id": "5baab1e7031f16105ce04143e7464df5bf415c16",
            "elf.needed[0]": "libc.so.6",
            "elf.toolchain": "gcc 11.4.0",
            "elf.comment[0]": "GCC: (Ubuntu 11.4.0-1ubuntu1~22.04.2) 11.4.0",
            "elf.dt_flags[0]": "bind_now",
            "elf.interpreter": "/lib64/ld-linux-x86-64.so.2",
            "elf.dt_flags_1[0]": "now",
            "elf.dt_flags_1[1]": "pie",
            "elf.entry_section": ".text",
            "elf.abi.min_kernel": "3.2.0",
            "elf.hashes.imphash": "b8286608917a52d1a17ed6108829c6c8",
            "elf.hashes.dyn_hash": "3cd5dd33c6e5751a42fbdece4c763267",
            "elf.segments[0].type": "phdr",
            "elf.segments[1].type": "interp",
            "elf.segments[2].type": "load",
            "elf.segments[3].type": "load",
            "elf.segments[4].type": "load",
            "elf.segments[5].type": "load",
            "elf.segments[6].type": "dynamic",
            "elf.segments[7].type": "note",
            "elf.segments[8].type": "note",
            "elf.segments[9].type": "other",
            "elf.toolchain_family": "gcc",
            "elf.segments[0].perms": "r--",
            "elf.segments[0].vaddr": 64,
            "elf.segments[10].type": "gnu_eh_frame",
            "elf.segments[11].type": "gnu_stack",
            "elf.segments[12].type": "gnu_relro",
            "elf.segments[1].perms": "r--",
            "elf.segments[1].vaddr": 792,
            "elf.segments[2].perms": "r--",
            "elf.segments[3].perms": "r-x",
            "elf.segments[3].vaddr": 4096,
            "elf.segments[4].perms": "r--",
            "elf.segments[4].vaddr": 8192,
            "elf.segments[5].perms": "rw-",
            "elf.segments[5].vaddr": 15632,
            "elf.segments[6].perms": "rw-",
            "elf.segments[6].vaddr": 15648,
            "elf.segments[7].perms": "r--",
            "elf.segments[7].vaddr": 824,
            "elf.segments[8].perms": "r--",
            "elf.segments[8].vaddr": 872,
            "elf.segments[9].perms": "r--",
            "elf.segments[9].vaddr": 824,
            "elf.fini_array[0].addr": "0x13a0",
            "elf.hashes.export_hash": "9b6fea56f5804d379cff220c1d19df44",
            "elf.init_array[0].addr": "0x13e0",
            "elf.needed_versions[0]": "libc.so.6@GLIBC_2.7",
            "elf.needed_versions[1]": "libc.so.6@GLIBC_2.14",
            "elf.needed_versions[2]": "libc.so.6@GLIBC_2.33",
            "elf.needed_versions[3]": "libc.so.6@GLIBC_2.4",
            "elf.needed_versions[4]": "libc.so.6@GLIBC_2.34",
            "elf.needed_versions[5]": "libc.so.6@GLIBC_2.2.5",
            "elf.segments[10].perms": "r--",
            "elf.segments[10].vaddr": 8280,
            "elf.segments[11].perms": "rw-",
            "elf.segments[12].perms": "r--",
            "elf.segments[12].vaddr": 15632,
            "build.toolchain.version": "11.4.0",
            "build.toolchain.compiler": "gcc",
            "elf.dynsym_funcs[0].kind": "func",
            "elf.dynsym_funcs[0].name": "__cxa_finalize",
            "elf.dynsym_funcs[1].kind": "func",
            "elf.dynsym_funcs[1].name": "__errno_location",
            "elf.dynsym_funcs[2].kind": "func",
            "elf.dynsym_funcs[2].name": "__isoc99_sscanf",
            "elf.dynsym_funcs[3].kind": "func",
            "elf.dynsym_funcs[3].name": "__libc_start_main",
            "elf.dynsym_funcs[4].kind": "func",
            "elf.dynsym_funcs[4].name": "__stack_chk_fail",
            "elf.dynsym_funcs[5].kind": "func",
            "elf.dynsym_funcs[5].name": "atoll",
            "elf.dynsym_funcs[6].kind": "func",
            "elf.dynsym_funcs[6].name": "calloc",
            "elf.dynsym_funcs[7].kind": "func",
            "elf.dynsym_funcs[7].name": "execvp",
            "elf.dynsym_funcs[8].kind": "func",
            "elf.dynsym_funcs[8].name": "exit",
            "elf.dynsym_funcs[9].kind": "func",
            "elf.dynsym_funcs[9].name": "fprintf",
            "elf.gnu_property[0].type": "x86_feature_1_and",
            "elf.dynsym_funcs[10].kind": "func",
            "elf.dynsym_funcs[10].name": "fwrite",
            "elf.dynsym_funcs[11].kind": "func",
            "elf.dynsym_funcs[11].name": "getenv",
            "elf.dynsym_funcs[12].kind": "func",
            "elf.dynsym_funcs[12].name": "getpid",
            "elf.dynsym_funcs[13].kind": "func",
            "elf.dynsym_funcs[13].name": "malloc",
            "elf.dynsym_funcs[14].kind": "func",
            "elf.dynsym_funcs[14].name": "memcmp",
            "elf.dynsym_funcs[15].kind": "func",
            "elf.dynsym_funcs[15].name": "memcpy",
            "elf.dynsym_funcs[16].kind": "func",
            "elf.dynsym_funcs[16].name": "memset",
            "elf.dynsym_funcs[17].kind": "func",
            "elf.dynsym_funcs[17].name": "putenv",
            "elf.dynsym_funcs[18].kind": "func",
            "elf.dynsym_funcs[18].name": "sprintf",
            "elf.dynsym_funcs[19].kind": "func",
            "elf.dynsym_funcs[19].name": "stat",
            "elf.dynsym_funcs[20].kind": "func",
            "elf.dynsym_funcs[20].name": "strdup",
            "elf.dynsym_funcs[21].kind": "func",
            "elf.dynsym_funcs[21].name": "strerror",
            "elf.dynsym_funcs[22].kind": "func",
            "elf.dynsym_funcs[22].name": "strlen",
            "elf.dynsym_funcs[23].kind": "func",
            "elf.dynsym_funcs[23].name": "time",
            "elf.gnu_property[0].value": "0x3",
            "elf.segments[0].file_size": 728,
            "elf.segments[0].flags_hex": "4",
            "elf.segments[1].file_size": 28,
            "elf.segments[1].flags_hex": "4",
            "elf.segments[2].file_size": 3088,
            "elf.segments[2].flags_hex": "4",
            "elf.segments[3].file_size": 3937,
            "elf.segments[3].flags_hex": "5",
            "elf.segments[4].file_size": 644,
            "elf.segments[4].flags_hex": "4",
            "elf.segments[5].file_size": 6077,
            "elf.segments[5].flags_hex": "6",
            "elf.segments[6].file_size": 496,
            "elf.segments[6].flags_hex": "6",
            "elf.segments[7].file_size": 48,
            "elf.segments[7].flags_hex": "4",
            "elf.segments[8].file_size": 68,
            "elf.segments[8].flags_hex": "4",
            "elf.segments[9].file_size": 48,
            "elf.segments[9].flags_hex": "4",
            "elf.segments[10].file_size": 116,
            "elf.segments[10].flags_hex": "4",
            "elf.segments[11].flags_hex": "6",
            "elf.segments[12].file_size": 752,
            "elf.segments[12].flags_hex": "4",
            "elf.dynsym_funcs[0].binding": "weak",
            "elf.segments[0].file_offset": 64,
            "elf.segments[0].memory_size": 728,
            "elf.segments[1].file_offset": 792,
            "elf.segments[1].memory_size": 28,
            "elf.segments[2].memory_size": 3088,
            "elf.segments[3].file_offset": 4096,
            "elf.segments[3].memory_size": 3937,
            "elf.segments[4].file_offset": 8192,
            "elf.segments[4].memory_size": 644,
            "elf.segments[5].file_offset": 11536,
            "elf.segments[5].memory_size": 6424,
            "elf.segments[6].file_offset": 11552,
            "elf.segments[6].memory_size": 496,
            "elf.segments[7].file_offset": 824,
            "elf.segments[7].memory_size": 48,
            "elf.segments[8].file_offset": 872,
            "elf.segments[8].memory_size": 68,
            "elf.segments[9].file_offset": 824,
            "elf.segments[9].memory_size": 48,
            "elf.symbol_kinds.types.func": 24,
            "elf.segments[10].file_offset": 8280,
            "elf.segments[10].memory_size": 116,
            "elf.segments[12].file_offset": 11536,
            "elf.segments[12].memory_size": 752,
            "elf.symbol_kinds.types.notype": 4,
            "elf.symbol_kinds.types.object": 4,
            "elf.symbol_kinds.bindings.weak": 6,
            "elf.symbol_kinds.bindings.local": 1,
            "elf.symbol_kinds.bindings.global": 25,
            "elf.stripped_metadata_sections[0]": ".symtab",
            "elf.stripped_metadata_sections[1]": ".strtab",
            "elf.stripped_metadata_sections[2]": ".debug_info",
            "elf.stripped_metadata_sections[3]": ".debug_line",
            "elf.stripped_metadata_sections[4]": ".debug_str",
            "elf.stripped_metadata_sections[5]": ".debug_abbrev",
            "elf.stripped_metadata_sections[6]": ".note.gnu.gold-version",
            "elf.relocation_kinds.R_X86_64_COPY": 2,
            "elf.symbol_kinds.visibility.default": 32,
            "elf.relocation_kinds.R_X86_64_GLOB_DAT": 5,
            "elf.relocation_kinds.R_X86_64_RELATIVE": 3,
            "elf.relocation_kinds.R_X86_64_JUMP_SLOT": 22
          },
          "x": [
            [
              "environ"
            ],
            [
              "stderr"
            ]
          ],
          "id": "elf",
          "sc": [
            [
              ".interp",
              792,
              28,
              0.0,
              "alloc"
            ],
            [
              ".note.gnu.property",
              824,
              48,
              0.0,
              "alloc"
            ],
            [
              ".note.gnu.build-id",
              872,
              36,
              0.0,
              "alloc"
            ],
            [
              ".note.ABI-tag",
              908,
              32,
              0.0,
              "alloc"
            ],
            [
              ".gnu.hash",
              944,
              56,
              0.0,
              "alloc"
            ],
            [
              ".dynsym",
              1000,
              768,
              0.0,
              "alloc"
            ],
            [
              ".dynstr",
              1768,
              375,
              0.0,
              "alloc"
            ],
            [
              ".gnu.version",
              2144,
              64,
              0.0,
              "alloc"
            ],
            [
              ".gnu.version_r",
              2208,
              112,
              0.0,
              "alloc"
            ],
            [
              ".rela.dyn",
              2320,
              240,
              0.0,
              "alloc"
            ],
            [
              ".rela.plt",
              2560,
              528,
              0.0,
              "alloc,info_link"
            ],
            [
              ".init",
              4096,
              27,
              0.0,
              "alloc,executable"
            ],
            [
              ".plt",
              4128,
              368,
              0.0,
              "alloc,executable"
            ],
            [
              ".plt.got",
              4496,
              16,
              0.0,
              "alloc,executable"
            ],
            [
              ".plt.sec",
              4512,
              352,
              0.0,
              "alloc,executable"
            ],
            [
              ".text",
              4864,
              3156,
              0.0,
              "alloc,executable"
            ],
            [
              ".fini",
              8020,
              13,
              0.0,
              "alloc,executable"
            ],
            [
              ".rodata",
              8192,
              88,
              0.0,
              "alloc"
            ],
            [
              ".eh_frame_hdr",
              8280,
              116,
              0.0,
              "alloc"
            ],
            [
              ".eh_frame",
              8400,
              436,
              0.0,
              "alloc"
            ],
            [
              ".init_array",
              11536,
              8,
              0.0,
              "write,alloc"
            ],
            [
              ".fini_array",
              11544,
              8,
              0.0,
              "write,alloc"
            ],
            [
              ".dynamic",
              11552,
              496,
              0.0,
              "write,alloc"
            ],
            [
              ".got",
              12048,
              240,
              0.0,
              "write,alloc"
            ],
            [
              ".data",
              12288,
              5325,
              0.0,
              "write,alloc"
            ],
            [
              ".comment",
              17613,
              45,
              0.0,
              "merge,strings"
            ],
            [
              ".shstrtab",
              17658,
              266,
              0.0,
              ""
            ]
          ]
        },
        "id": 0,
        "sz": 19784,
        "ts": [
          {
            "c": 1.0,
            "d": "Binary is not digitally signed",
            "i": "metadata/unsigned",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "Binary has 20+ sections (installer/packer)",
            "e": [
              "sections.count = 29.00"
            ],
            "i": "metadata/binary/metrics/threshold::many-sections-20",
            "l": 1
          },
          {
            "a": "T1110.001",
            "c": 0.8500000238418579,
            "d": "Service account ubuntu",
            "e": [
              "ubuntu"
            ],
            "i": "objectives/lateral-movement/brute-force/password::service-account-ubuntu",
            "l": 1,
            "m": "E1110"
          },
          {
            "c": 1.0,
            "d": "Binary symbol table is stripped",
            "e": [
              "binary.is_stripped = 1.00"
            ],
            "i": "metadata/hardening/layout::stripped",
            "l": 2
          },
          {
            "c": 0.8999999761581421,
            "d": "ELF interpreter section name",
            "e": [
              ".interp"
            ],
            "i": "metadata/binary/linking/static::elf-interpreter-section-name",
            "l": 2
          },
          {
            "c": 0.699999988079071,
            "d": "ELF symbol tables stripped from binary",
            "e": [
              "elf.stripped_metadata_section_count = 7.00"
            ],
            "i": "metadata/binary/anomaly/provenance::stripped-symbol-tables",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "ELF dynstr section name",
            "e": [
              ".dynstr"
            ],
            "i": "metadata/binary/linking/static::elf-dynstr-section-name",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "ELF needed library metadata",
            "e": [
              "[libc.so.6]"
            ],
            "i": "metadata/binary/linking/runtime::needed-lib",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "Binary has 20+ imports",
            "e": [
              "imports.count = 27.00"
            ],
            "i": "metadata/binary/metrics/threshold::many-imports-20",
            "l": 1
          },
          {
            "c": 0.4000000059604645,
            "d": "putenv function (modify environment variable)",
            "e": [
              "putenv"
            ],
            "i": "micro-behaviors/os/env/vars/access::putenv",
            "l": 2
          },
          {
            "c": 0.800000011920929,
            "d": "C-style exec family functions",
            "e": [
              "execvp"
            ],
            "i": "micro-behaviors/process/create/execv::c-exec-variants",
            "l": 3
          },
          {
            "a": "T1124",
            "c": 0.30000001192092896,
            "d": "Get current calendar time (seconds)",
            "e": [
              "time"
            ],
            "i": "micro-behaviors/time/query::time",
            "l": 2,
            "m": "T1124"
          },
          {
            "c": 0.8999999761581421,
            "d": "ELF dynsym section name",
            "e": [
              ".dynsym"
            ],
            "i": "metadata/binary/linking/static::elf-dynsym-section-name",
            "l": 2
          },
          {
            "c": 0.9599999785423279,
            "d": "ELF binary has trailing overlay data",
            "e": [
              "binary.has_overlay = 1.00"
            ],
            "i": "metadata/binary/layout::elf-has-overlay",
            "l": 3
          },
          {
            "c": 0.8999999761581421,
            "d": "__stack_chk_fail function",
            "e": [
              "stack_chk_fail"
            ],
            "i": "metadata/hardening/build::stack-chk-fail",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "ELF program interpreter metadata",
            "e": [
              "/lib64/ld-linux-x86-64.so.2"
            ],
            "i": "metadata/binary/linking/runtime::interpreter",
            "l": 2
          },
          {
            "c": 0.6000000238418579,
            "d": "Small ELF binary (\u003c 50KB)",
            "e": [
              "e3a6d0d139dc56f28f82ec161b3d17ecd137b088acd3a0e8330a5d412c025b73.elf"
            ],
            "i": "metadata/binary/metrics/structural::small-elf-binary",
            "l": 2
          },
          {
            "c": 0.949999988079071,
            "d": "ELF declares DT_RELACOUNT (relative relocations)",
            "e": [
              "elf.relacount = 3.00"
            ],
            "i": "metadata/binary/anomaly/format::elf-relacount-present",
            "l": 2
          },
          {
            "c": 0.6600000262260437,
            "d": "Reference to /lib64",
            "e": [
              "/lib64/ld-linux-x86-64.so.2"
            ],
            "i": "micro-behaviors/fs/path/system::system-lib64",
            "l": 2
          },
          {
            "c": 0.9599999785423279,
            "d": "ELF overlay exceeds 512 bytes",
            "e": [
              "binary.overlay_size = 1860.00"
            ],
            "i": "metadata/binary/layout::elf-overlay-over-512",
            "l": 3
          },
          {
            "c": 0.30000001192092896,
            "d": "Get process ID",
            "e": [
              "getpid"
            ],
            "i": "micro-behaviors/process/identity/query::getpid",
            "l": 2
          },
          {
            "d": "Characteristic system library export __cxa_finalize",
            "e": [
              "cxa_finalize"
            ],
            "i": "micro-behaviors/dylib/library/libc::libc-characteristic-cxa-finalize",
            "l": 2
          },
          {
            "d": "Binary exports symbols",
            "e": [
              "exports.count = 4.00"
            ],
            "i": "metadata/binary/symbols/exports::has-exports",
            "l": 1
          },
          {
            "c": 0.6600000262260437,
            "d": "Look up file permissions",
            "e": [
              "stat"
            ],
            "i": "micro-behaviors/fs/chmod/get::get-dup",
            "l": 2
          },
          {
            "d": "Characteristic system library exports",
            "e": [
              "libc_start_main"
            ],
            "i": "micro-behaviors/dylib/library/libc::libc-characteristic-symbols",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "File is a compiled binary",
            "e": [
              "e3a6d0d139dc56f28f82ec161b3d17ecd137b088acd3a0e8330a5d412c025b73.elf"
            ],
            "i": "metadata/binary/framework::is-binary",
            "l": 1
          },
          {
            "c": 0.4000000059604645,
            "d": "Terminate process immediately without cleanup",
            "e": [
              "exit"
            ],
            "i": "micro-behaviors/process/terminate/signal::_exit",
            "l": 2
          },
          {
            "d": "Characteristic system library export __errno_location",
            "e": [
              "errno_location"
            ],
            "i": "micro-behaviors/dylib/library/libc::libc-characteristic-errno",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "Binary has 25+ imports",
            "e": [
              "imports.count = 27.00"
            ],
            "i": "metadata/binary/metrics/threshold::many-imports-25",
            "l": 1
          },
          {
            "c": 0.6600000262260437,
            "d": "Write files",
            "e": [
              "fwrite"
            ],
            "i": "micro-behaviors/fs/file/write/direct::write",
            "l": 2
          },
          {
            "c": 0.800000011920929,
            "d": "libc version string pattern",
            "e": [
              "GLIBC"
            ],
            "i": "micro-behaviors/dylib/library/libc::libc-version-string",
            "l": 2
          },
          {
            "c": 0.8999999761581421,
            "d": "ELF dynamic section name",
            "e": [
              ".dynamic"
            ],
            "i": "metadata/binary/linking/static::elf-dynamic-section-name",
            "l": 2
          },
          {
            "c": 0.8999999761581421,
            "d": "ELF dynamic section name",
            "e": [
              ".dynamic"
            ],
            "i": "metadata/hardening/missing::elf-dynamic-section-name",
            "l": 2
          },
          {
            "c": 0.8999999761581421,
            "d": "ELF dynstr section name",
            "e": [
              ".dynstr"
            ],
            "i": "metadata/hardening/missing::elf-dynstr-section-name",
            "l": 2
          },
          {
            "c": 0.800000011920929,
            "d": "Read file status and metadata (core)",
            "e": [
              "stat"
            ],
            "i": "micro-behaviors/fs/file/stat::stat-core",
            "l": 3
          },
          {
            "c": 0.8999999761581421,
            "d": "ELF interpreter section name",
            "e": [
              ".interp"
            ],
            "i": "metadata/hardening/missing::elf-interpreter-section-name",
            "l": 2
          },
          {
            "c": 0.8999999761581421,
            "d": "Tiny C string section ratio",
            "e": [
              " = 0.0% of total (0 / 19784 bytes)"
            ],
            "i": "metadata/binary/section/metrics::tiny-cstring-section",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "ELF dynsym section name",
            "e": [
              ".dynsym"
            ],
            "i": "metadata/hardening/missing::elf-dynsym-section-name",
            "l": 2
          },
          {
            "c": 0.30000001192092896,
            "d": "getenv function (read environment variable)",
            "e": [
              "getenv"
            ],
            "i": "micro-behaviors/os/env/vars/access::getenv",
            "l": 2
          },
          {
            "c": 0.800000011920929,
            "d": "No full symbol table (likely stripped)",
            "e": [
              "binary.is_stripped = 1.00"
            ],
            "i": "metadata/hardening/missing::stripped-binary",
            "l": 3
          }
        ],
        "sha": "e3a6d0d139dc56f28f82ec161b3d17ecd137b088acd3a0e8330a5d412c025b73",
        "path": "e3a6d0d139dc56f28f82ec161b3d17ecd137b088acd3a0e8330a5d412c025b73.elf",
        "type": "elf"
      }
    ],
    "tv": "9ea7c"
  }
}