{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9255288243293762, "class": 0 } ], "prob": 0.9255288, "class": 0, "version": "v16.16", "thresholds": [ 0.9815004, 0.99404883 ], "analyzed_at": "2026-05-01T23:52:41Z" }, "path": "x86__64__lsb__unix-system-v__clang-3.8.0__O1__no-obf__unstripped__acpid-2.0.31__ud_socket.o", "raw": { "v": "4", "fs": [ { "f": "O₂(AsEr)Md₂(Bi₄He)", "x": 4, "id": 0, "ms": { "elf": { "e_type": 1.0, "has_note": true, "e_machine": 62.0, "class_bits": 64.0, "has_eh_frame": true, "symtab_count": 25.0, "little_endian": true, "section_header_count": 10.0, "section_relocation_group_count": 2.0 }, "binary": { "code_size": 711.0, "file_size": 3480.0, "has_overlay": true, "code_entropy": 5.01, "data_entropy": 4.35, "export_count": 4.0, "overlay_size": 640.0, "string_count": 32.0, "overlay_ratio": 0.18, "section_count": 8.0, "avg_complexity": 4.0, "function_count": 4.0, "max_complexity": 6.0, "string_density": 46.09, "overall_entropy": 3.31, "overlay_entropy": 1.02, "avg_basic_blocks": 6.0, "avg_section_size": 346.25, "entropy_variance": 1.52, "function_density": 5.76, "avg_function_size": 173.0, "avg_string_length": 14.09, "complexity_per_kb": 5.76, "max_string_length": 66.0, "avg_string_entropy": 2.87, "code_to_data_ratio": 0.35, "text_to_file_ratio": 0.41, "total_basic_blocks": 24.0, "string_length_stddev": 14.61, "largest_section_ratio": 0.21, "sentence_string_count": 4.0, "sentence_string_ratio": 0.13, "function_analysis_depth": 2.0, "nonstandard_section_name_count": 2.0 } }, "ss": [ [ 64, "UAVSH" ], [ 368, "UAWAVATSH" ], [ 513, "ffffff." ], [ 775, "ud_create_socket(): socket filename longer than %zu characters: %s" ], [ 842, "fchmod() on socket %s: %s" ], [ 868, "ud_connect(): socket filename longer than %zu characters: %s" ], [ 933, "clang version 3.8.0 (tags/RELEASE_380/final)" ], [ 2569, "strncpy" ], [ 2577, "memcpy" ], [ 2584, ".rela.text" ], [ 2595, "getsockopt" ], [ 2606, "ud_accept" ], [ 2616, ".comment" ], [ 2625, "ud_create_socket" ], [ 2642, "ud_connect" ], [ 2653, "strerror" ], [ 2662, "__errno_location" ], [ 2679, "listen" ], [ 2686, "strlen" ], [ 2693, "strnlen" ], [ 2707, "unlink" ], [ 2714, ".note.GNU-stack" ], [ 2730, "acpid_log" ], [ 2740, "close" ], [ 2746, ".rela.eh_frame" ], [ 2761, "fchmod" ], [ 2773, "ud_get_peercred" ], [ 2789, "ud_socket.c" ], [ 2801, ".strtab" ], [ 2809, ".symtab" ], [ 2817, "accept4" ], [ 2825, ".rodata.str1.1" ] ], "sz": 3480, "ts": [ { "c": 1.0, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "l": 2 }, { "c": 1.0, "d": "Binary format is identified", "e": [ "elf.class_bits = 64.00" ], "i": "metadata/binary::binary-format-checked", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "binary.file_size = 3480.00" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.6000000238418579, "d": "Small ELF binary (\u003c 50KB)", "e": [ "x86__64__lsb__unix-system-v__clang-3.8.0__O1__no-obf__unstripped__acpid-2.0.31__ud_socket.o" ], "i": "metadata/binary/metrics::small-elf-binary", "l": 2 }, { "c": 1.0, "d": "Sparse visible string surface", "e": [ "binary.string_count = 32.00" ], "i": "objectives/anti-static/obfuscation/control-flow/native::sparse-strings", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening::no-pie", "l": 2 }, { "c": 0.8999999761581421, "d": "ELF imports zero needed libraries", "e": [ "binary.dependency_count = 0.00" ], "i": "metadata/binary/linking::elf-needed-libs-zero", "l": 2 }, { "c": 0.4000000059604645, "d": "Very few functions detected", "e": [ "binary.function_count = 4.00" ], "i": "metadata/binary/metrics::few-functions", "l": 2 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.function_count = 4.00" ], "i": "metadata/binary/metrics::few-functions-3", "l": 1 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 3.31" ], "i": "metadata/binary/metrics::low-overall-entropy-binary", "l": 1 }, { "c": 1.0, "d": "ELF64 class marker", "e": [ "elf.class_bits = 64.00" ], "i": "metadata/binary/metrics::elf64-class", "l": 1 }, { "d": "Binary exports symbols", "e": [ "binary.export_count = 4.00" ], "i": "metadata/binary/symbols::has-exports", "l": 1 }, { "c": 1.0, "d": "Tiny ELF binary (\u003c 4KB)", "e": [ "elf.class_bits = 64.00" ], "i": "metadata/binary/metrics::tiny-elf", "l": 3 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 2.87" ], "i": "metadata/binary/metrics::avg-string-entropy-4-max", "l": 2 }, { "c": 0.800000011920929, "d": "Compiler/project context token", "e": [ "clang version" ], "i": "micro-behaviors/dylib/library::llvm-project-ref-b", "l": 2 }, { "a": "T1106", "c": 0.949999988079071, "d": "ELF ET_DYN binary type", "e": [ "elf.e_type = 1.00" ], "i": "objectives/evasion/anti-av/syscall::elf-et-dyn", "l": 1, "m": "B0009" }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 4.00" ], "i": "metadata/binary/metrics::avg-complexity-15-max", "l": 2 }, { "c": 0.6000000238418579, "d": "Binary not position-independent (no ASLR)", "e": [ "elf.e_type = 1.00" ], "i": "metadata/hardening::no-pie-struct", "l": 3 }, { "c": 0.75, "d": "ELF lacks dynamic linker sections", "e": [ "elf.class_bits = 64.00" ], "i": "metadata/binary/linking::static-linked-heuristic", "l": 3 }, { "c": 0.75, "d": "ELF lacks dynamic linker sections", "e": [ "elf.class_bits = 64.00" ], "i": "metadata/hardening::static-linked-heuristic", "l": 3 }, { "c": 0.800000011920929, "d": "Statically linked binary", "e": [ "elf.class_bits = 64.00", "binary.dependency_count = 0.00" ], "i": "metadata/binary/linking::static-linked", "l": 3 } ], "sha": "ec8ff6f0ce848ff8ec35f3664588af8b609da74862289b00f4608cd11aaec1b5", "path": "x86__64__lsb__unix-system-v__clang-3.8.0__O1__no-obf__unstripped__acpid-2.0.31__ud_socket.o", "type": "elf" } ], "tv": "2a0fe" } }