{ "ml": { "v": "5", "fs": [ { "id": 0, "prob": 0.9990379810333252, "class": 2, "threshold": 0.9932810664176941 } ], "prob": 0.999038, "class": 2, "level": 3, "models": [ { "m": "az", "prob": 0.99716914, "class": 2 }, { "m": "az/native", "prob": 0.999038, "class": 2 }, { "m": "az/elf", "prob": 1.0, "class": 2 } ], "version": "v17.17", "threshold": 0.99328107, "analyzed_at": "2026-05-31T17:20:45Z" }, "path": "e8d895ae0dab773bf2b2d9899d6ec2dd49276440d48ac8df0cdac9656393fcf7.elf", "raw": { "v": "5", "fs": [ { "f": "Md₃(BiBkHe₂)", "x": 126, "ff": { "m": { "elf": { "bits": 32.0, "entry": 55176.0, "has_got": 0.0, "has_plt": 0.0, "has_note": 0.0, "note_count": 0.0, "nx_enabled": 0.0, "dynrel_count": 0.0, "dynsym_count": 0.0, "has_eh_frame": 0.0, "symtab_count": 0.0, "dynrela_count": 0.0, "little_endian": 1.0, "pltreloc_count": 0.0, "executable_stack": 1.0, "wx_segment_count": 0.0, "program_header_count": 3.0, "gnu_stack_section_absent": 0.0, "load_segment_max_file_size": 26997.0, "stripped_but_symtab_present": 0.0, "load_segment_max_memory_size": 26997.0, "section_relocation_group_count": 0.0, "stripped_metadata_section_count": 8.0 }, "file": { "size": 27300.0, "entropy": 7.94, "size_bytes": 27300.0 }, "binary": { "is_pie": 0.0, "is_stripped": 1.0, "avg_complexity": 32.5, "max_complexity": 61.0, "huge_func_count": 1.0, "leaf_func_count": 1.0, "tiny_func_count": 0.0, "avg_basic_blocks": 54.5, "total_basic_blocks": 109.0 }, "functions": { "count": 2.0 }, "dependencies": { "count": 0.0 } }, "s": [ [ 1802, "u8", "Syil" ], [ 3467, "u8", "6i3l" ], [ 3881, "u8", "Y0GK" ], [ 4500, "u8", "uwr6pVw" ], [ 6623, "u8", "NVzcySh" ], [ 8044, "u8", "NhKTl" ], [ 8532, "u8", "MAAF" ], [ 9643, "u8", "rtFk" ], [ 9983, "u8", "kZgn" ], [ 12748, "u8", "JuIZJ" ], [ 13725, "u8", "[nv}" ], [ 14320, "u8", "7itb" ], [ 14416, "u8", "OpaQO" ], [ 14655, "u8", "uc6b" ], [ 14767, "u8", "g1a1" ], [ 15034, "u8", "GZPKH" ], [ 15306, "u8", "bsZ89" ], [ 15747, "u8", "vFNlI" ], [ 15891, "u8", "0bJdn" ], [ 15982, "u8", "mZ n" ], [ 16450, "u8", "I460dv" ], [ 17757, "u8", "/9oYs" ], [ 17979, "u8", "M2dHW" ], [ 18399, "u8", "e5k4" ], [ 19225, "u8", "vQAJ4g" ], [ 20345, "u8", "i.Ei" ], [ 20536, "u8", "/EHNk" ], [ 20613, "u8", "Y59L" ], [ 21765, "u8", "t70m" ], [ 22243, "u8", "xLOocH" ], [ 25212, "u8", "PROT_EXEC|PROT_WRITE failed." ], [ 25244, "u8", "$Info: This file is packed with the UPX executable packer http://upx.sf.net $" ], [ 25323, "u8", "$Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $" ], [ 26397, "u8", "G0KT" ] ], "v": { "elf.type": "executable", "elf.class": "elf32", "elf.entry": 55176, "file.stem": "e8d895ae0dab773bf2b2d9899d6ec2dd49276440d48ac8df0cdac9656393fcf7", "elf.endian": "little", "elf.machine": "arm", "elf.version": 1, "binary.packer": "upx", "file.basename": "e8d895ae0dab773bf2b2d9899d6ec2dd49276440d48ac8df0cdac9656393fcf7.elf", "elf.e_flags[0]": "eabi_v4", "elf.e_flags_raw": 67108866, "elf.segments[0].type": "load", "elf.segments[1].type": "load", "elf.segments[2].type": "gnu_stack", "binary.packer_version": "3.94", "elf.segments[0].perms": "r-x", "elf.segments[0].vaddr": 32768, "elf.segments[1].perms": "rw-", "elf.segments[1].vaddr": 141508, "elf.segments[2].perms": "rwx", "elf.segments[0].file_size": 26997, "elf.segments[0].flags_hex": "5", "elf.segments[1].flags_hex": "6", "elf.segments[2].flags_hex": "7", "elf.segments[0].memory_size": 26997, "elf.segments[1].file_offset": 10436, "binary.top_complex_unnamed[0].cc": 61, "elf.stripped_metadata_sections[0]": ".symtab", "elf.stripped_metadata_sections[1]": ".strtab", "elf.stripped_metadata_sections[2]": ".comment", "elf.stripped_metadata_sections[3]": ".debug_info", "elf.stripped_metadata_sections[4]": ".debug_line", "elf.stripped_metadata_sections[5]": ".debug_str", "elf.stripped_metadata_sections[6]": ".debug_abbrev", "elf.stripped_metadata_sections[7]": ".note.gnu.gold-version", "binary.top_complex_unnamed[0].addr": "0xd924" }, "id": "elf" }, "id": 0, "sz": 27300, "ts": [ { "c": 1.0, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "l": 2 }, { "c": 1.0, "d": "Binary contains a UPX packing marker", "i": "anti-static/packer/upx", "l": 4 }, { "c": 1.0, "d": "UPX decompression failed: IO error: No such file or directory (os error 2)", "i": "anti-static/packer/upx/decompression-failed", "l": 5 }, { "c": 0.699999988079071, "d": "ELF symbol tables stripped from binary", "e": [ "elf.stripped_metadata_section_count = 8.00" ], "i": "metadata/binary/anomaly/provenance::stripped-symbol-tables", "l": 1 }, { "c": 1.0, "d": "Binary symbol table is stripped", "e": [ "binary.is_stripped = 1.00" ], "i": "metadata/hardening/layout::stripped", "l": 2 }, { "c": 0.949999988079071, "d": "UPX magic bytes in ELF", "e": [ "UPX!" ], "i": "objectives/anti-static/pack/detect::upx-magic-raw", "l": 1 }, { "c": 0.8500000238418579, "d": "ELF PT_GNU_STACK has executable bit set", "e": [ "elf.executable_stack = 1.00" ], "i": "metadata/binary/anomaly/format::elf-executable-stack", "l": 3 }, { "c": 1.0, "d": "UPX executable packer signature string", "e": [ "$Info: This file is packed with the UPX executable packer http://upx.sf.net $" ], "i": "objectives/anti-static/pack/detect::upx-packer-string", "l": 1, "el": [ "0x629c" ] }, { "c": 0.6000000238418579, "d": "Small ELF binary (\u003c 50KB)", "e": [ "e8d895ae0dab773bf2b2d9899d6ec2dd49276440d48ac8df0cdac9656393fcf7.elf" ], "i": "metadata/binary/metrics/structural::small-elf-binary", "l": 2 }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2, "el": [ "0x62eb" ] }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "e8d895ae0dab773bf2b2d9899d6ec2dd49276440d48ac8df0cdac9656393fcf7.elf" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.4000000059604645, "d": "Very few leaf functions (deep)", "e": [ "binary.leaf_func_count = 1.00" ], "i": "metadata/binary/metrics/structural::few-leaf-functions", "l": 3 }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening/layout::no-pie", "l": 2 }, { "c": 0.6000000238418579, "d": "PROT_EXEC memory protection constant", "e": [ "PROT_EXEC|PROT_WRITE failed." ], "i": "micro-behaviors/mem/alloc/executable::prot-exec-const", "l": 2, "el": [ "0x627c" ] }, { "c": 0.8999999761581421, "d": "ELF imports zero needed libraries", "e": [ "dependencies.count = 0.00" ], "i": "metadata/binary/linking/static::elf-needed-libs-zero", "l": 2 }, { "c": 0.800000011920929, "d": "No full symbol table (likely stripped)", "e": [ "binary.is_stripped = 1.00" ], "i": "metadata/hardening/missing::stripped-binary", "l": 3 }, { "c": 0.6000000238418579, "d": "PROT_WRITE memory protection constant", "e": [ "PROT_WRITE" ], "i": "objectives/anti-analysis/self-modify/runtime::prot-write", "l": 2, "el": [ "0x627c" ] }, { "c": 1.0, "d": "Toolchain banner stripped, build-id retained", "e": [ "[.symtab, .strtab, .comment, .debug_info, .debug_line, .debug_str, .debug_abbrev, .note.gnu.gold-version]" ], "i": "metadata/build/artifact::aggressive-strip", "l": 3, "el": [ "value:elf.stripped_metadata_sections" ] }, { "c": 0.8999999761581421, "d": "Tiny C string section ratio", "e": [ " = 0.0% of total (0 / 27300 bytes)" ], "i": "metadata/binary/section/metrics::tiny-cstring-section", "l": 1 }, { "a": "T1027", "c": 0.550000011920929, "d": "High basic blocks per function", "e": [ "binary.avg_basic_blocks = 54.50" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::many-basic-blocks", "l": 3, "m": "B0032" }, { "c": 0.8999999761581421, "d": "NX/DEP disabled (stack is executable)", "e": [ "elf.nx_enabled = 0.00" ], "i": "metadata/hardening/mitigation::nx-disabled", "l": 3 } ], "sha": "e8d895ae0dab773bf2b2d9899d6ec2dd49276440d48ac8df0cdac9656393fcf7", "path": "e8d895ae0dab773bf2b2d9899d6ec2dd49276440d48ac8df0cdac9656393fcf7.elf", "type": "elf" } ], "tv": "176d6" } }