{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.003977848682552576, "class": 0 } ], "prob": 0.0039778487, "class": 0, "models": [ { "m": "az", "prob": 0.0039778487, "class": 0 }, { "m": "az/native", "prob": 0.00013466622, "class": 0 }, { "m": "az/elf", "prob": 0.0000510113, "class": 0 } ], "version": "v16.16", "thresholds": [ 0.9953178, 0.9991311 ], "analyzed_at": "2026-05-03T03:11:48Z" }, "path": "x86__64__lsb__unix-system-v__gcc-7.1.0__O1__no-obf__unstripped__coreutils-8.30__join", "raw": { "v": "4", "fs": [ { "f": "O₂(CI)H₂(FDb)Md₂(HeBi₂)", "x": 4, "id": 0, "is": [ "", "ctype_toupper_loc", "uflow", "free", "abort", "errno_location", "strncmp", "exit", "fpending", "fcntl", "textdomain", "fclose", "bindtextdomain", "dcgettext", "ctype_get_mb_cur_max", "getopt_long", "mbrtowc", "strchr", "overflow", "strrchr", "lseek", "assert_fail", "memset", "close", "posix_fadvise", "memchr", "libc_start_main", "memcmp", "fputs_unlocked", "calloc", "strcmp", "gmon_start__", "memcpy", "fileno", "malloc", "fflush", "nl_langinfo", "strcoll", "freading", "fwrite_unlocked", "realloc", "fdopen", "setlocale", "printf_chk", "error", "fseeko", "fopen", "strtoul", "cxa_atexit", "exit", "fwrite", "fprintf_chk", "mbsinit", "iswprint", "ctype_b_loc" ], "ms": { "elf": { "e_type": 2.0, "needed": [ "libc.so.6" ], "has_got": true, "has_plt": true, "has_note": true, "e_machine": 62.0, "class_bits": 64.0, "note_count": 1.0, "nx_enabled": true, "entry_point": 4200112.0, "needed_libs": 1.0, "dynsym_count": 64.0, "has_eh_frame": true, "symtab_count": 290.0, "dynrela_count": 8.0, "entry_section": ".text", "little_endian": true, "pltreloc_count": 53.0, "has_interpreter": true, "fini_array_count": 1.0, "init_array_count": 1.0, "program_header_count": 8.0, "section_header_count": 29.0, "load_segment_max_p_memsz": 39636.0, "load_segment_max_p_filesz": 39636.0, "section_relocation_group_count": 2.0 }, "binary": { "code_size": 21924.0, "file_size": 55136.0, "entry_point": 4200112.0, "has_overlay": true, "code_entropy": 3.95, "data_entropy": 3.02, "export_count": 143.0, "import_count": 55.0, "overlay_size": 1863.0, "string_count": 451.0, "overlay_ratio": 0.03, "section_count": 28.0, "avg_complexity": 6.29, "function_count": 163.0, "import_density": 2.57, "max_complexity": 334.0, "string_density": 21.06, "aliased_exports": 52.0, "overall_entropy": 2.84, "overlay_entropy": 1.54, "avg_basic_blocks": 7.08, "avg_section_size": 1858.07, "dependency_count": 1.0, "entropy_variance": 1.52, "function_density": 7.61, "avg_function_size": 130.74, "avg_string_length": 20.55, "complexity_per_kb": 0.29, "max_string_length": 815.0, "avg_string_entropy": 3.21, "code_to_data_ratio": 0.73, "data_to_file_ratio": 0.0, "text_to_file_ratio": 0.38, "total_basic_blocks": 1154.0, "string_length_stddev": 41.68, "largest_section_ratio": 0.38, "sentence_string_count": 70.0, "sentence_string_ratio": 0.16, "behavioral_import_ratio": 0.04, "function_analysis_depth": 2.0, "high_complexity_functions": 3.0 } }, "ss": [ [ 0, "textdomain" ], [ 512, "/lib64/ld-linux-x86-64.so.2" ], [ 2539, "fflush" ], [ 2546, "__printf_chk" ], [ 2559, "setlocale" ], [ 2569, "mbrtowc" ], [ 2577, "fopen" ], [ 2583, "strncmp" ], [ 2591, "optind" ], [ 2598, "strrchr" ], [ 2606, "dcgettext" ], [ 2616, "error" ], [ 2622, "iswprint" ], [ 2631, "realloc" ], [ 2639, "abort" ], [ 2657, "memchr" ], [ 2664, "program_invocation_name" ], [ 2688, "__assert_fail" ], [ 2702, "__ctype_get_mb_cur_max" ], [ 2725, "posix_fadvise" ], [ 2739, "calloc" ], [ 2746, "memset" ], [ 2753, "__errno_location" ], [ 2770, "memcmp" ], [ 2777, "__fprintf_chk" ], [ 2791, "stdout" ], [ 2798, "lseek" ], [ 2804, "memcpy" ], [ 2811, "fclose" ], [ 2818, "strtoul" ], [ 2826, "malloc" ], [ 2833, "mbsinit" ], [ 2841, "__uflow" ], [ 2849, "nl_langinfo" ], [ 2861, "__ctype_b_loc" ], [ 2875, "optarg" ], [ 2882, "__freading" ], [ 2893, "stderr" ], [ 2900, "getopt_long" ], [ 2912, "fileno" ], [ 2919, "fwrite" ], [ 2926, "__fpending" ], [ 2944, "program_invocation_short_name" ], [ 2974, "fdopen" ], [ 2981, "__ctype_toupper_loc" ], [ 3007, "bindtextdomain" ], [ 3022, "fwrite_unlocked" ], [ 3045, "__libc_start_main" ], [ 3063, "fseeko" ], [ 3070, "strcoll" ], [ 3078, "__overflow" ], [ 3089, "fputs_unlocked" ], [ 3104, "free" ], [ 3109, "__progname" ], [ 3120, "__progname_full" ], [ 3136, "__cxa_atexit" ], [ 3149, "__gmon_start__" ], [ 3176, "GLIBC_2.14" ], [ 6420, "AUATUSH" ], [ 7220, "AWAVAUATUSH" ], [ 7447, "AVAUATUSI" ], [ 7784, "ATUSH" ], [ 7859, "TUUUUUU" ], [ 20436, "ATUSL" ], [ 22173, "AWAVM" ], [ 22267, "AWAVAUM" ], [ 22370, "AWAVAUATL" ], [ 22490, "AWAVAUAT" ], [ 23418, "TUUUUUUU" ], [ 23555, "SUUUUUUUH9" ], [ 23840, "AVAUATUSA" ], [ 24054, "AVAUATUSH" ], [ 26656, "AWAVA" ], [ 26663, "AUATL" ], [ 26852, "invalid field number: %s" ], [ 26877, "invalid field specifier: %s" ], [ 26905, "src/join.c" ], [ 26940, "read error" ], [ 26951, "%s:%lu: is not sorted: %.*s" ], [ 26979, "join" ], [ 26986, "test invocation" ], [ 27002, "Multi-call invocation" ], [ 27024, "sha224sum" ], [ 27034, "sha2 utilities" ], [ 27049, "sha256sum" ], [ 27059, "sha384sum" ], [ 27069, "sha512sum" ], [ 27079, "%s online help: \u003c%s\u003e" ], [ 27102, "GNU coreutils" ], [ 27120, "extra operand %s" ], [ 27137, "auto" ], [ 27142, "multi-character tab %s" ], [ 27165, "incompatible tabs" ], [ 27183, "Mike Haertel" ], [ 27216, "missing operand" ], [ 27232, "missing operand after %s" ], [ 27257, "ignore-case" ], [ 27269, "nocheck-order" ], [ 27283, "zero-terminated" ], [ 27299, "header" ], [ 27311, "version" ], [ 27320, "incompatible join fields %lu, %lu" ], [ 27360, "invalid file number in field spec: %s" ], [ 27440, "Try '%s --help' for more information." ], [ 27480, "Usage: %s [OPTION]... FILE1 FILE2" ], [ 27520, "For each pair of input lines with identical join fields, write a line to\nstandard output. The default join field is the first, " ], [ 27593, "standard output. The default join field is the first, delimited by blanks." ], [ 27672, "When FILE1 or FILE2 (not both) is -, read standard input." ], [ 27737, "-a FILENUM also print unpairable lines from file FILENUM, where" ], [ 27810, "FILENUM is 1 or 2, corresponding to FILE1 or FILE2" ], [ 27883, "-e EMPTY replace missing input fields with EMPTY" ], [ 27944, "-i, --ignore-case ignore differences in case when comparing fields" ], [ 28014, "-j FIELD equivalent to '-1 FIELD -2 FIELD'" ], [ 28068, "-o FORMAT obey FORMAT while constructing output line" ], [ 28131, "-t CHAR use CHAR as input and output field separator" ], [ 28200, "-v FILENUM like -a FILENUM, but suppress joined output lines" ], [ 28368, "--check-order check that the input is correctly sorted, even" ], [ 28435, "if all input lines are pairable" ], [ 28489, "--nocheck-order do not check that the input is correctly sorted" ], [ 28557, "--header treat the first line in each file as field headers," ], [ 28629, "print them without trying to pair them" ], [ 28696, "-z, --zero-terminated line delimiter is NUL, not newline" ], [ 28760, "--help display this help and exit" ], [ 28808, "--version output version information and exit" ], [ 28864, "Unless -t CHAR is given, leading blanks separate fields and are ignored,\nelse fields are separated by CHAR. Any FIELD is a fiel" ], [ 28865, "Unless -t CHAR is given, leading blanks separate fields and are ignored," ], [ 28938, "else fields are separated by CHAR. Any FIELD is a field number counted" ], [ 29010, "from 1. FORMAT is one or more comma or blank separated specifications," ], [ 29082, "each being 'FILENUM.FIELD' or '0'. Default FORMAT outputs the join field," ], [ 29157, "the remaining fields from FILE1, the remaining fields from FILE2, all" ], [ 29227, "separated by CHAR. If FORMAT is the keyword 'auto', then the first" ], [ 29295, "line of each file determines the number of fields output for each line." ], [ 29368, "Important: FILE1 and FILE2 must be sorted on the join fields." ], [ 29430, "E.g., use \"sort -k 1b,1\" if 'join' has no options," ], [ 29481, "or use \"join -t ''\" if 'sort' has no options." ], [ 29527, "Note, comparisons honor the rules specified by 'LC_COLLATE'." ], [ 29588, "If the input is not sorted and some lines cannot be joined, a" ], [ 29650, "warning message will be given." ], [ 29688, "https://www.gnu.org/software/coreutils/" ], [ 29728, "Report %s translation bugs to \u003chttps://translationproject.org/team/\u003e" ], [ 29800, "Full documentation at: \u003c%s%s\u003e" ], [ 29832, "or available locally via: info '(coreutils) %s%s'" ], [ 29888, "/tmp/coreutils/_out/share/locale" ], [ 29928, "conflicting empty-field replacement strings" ], [ 29976, "both files cannot be standard input" ], [ 30016, "add_field" ], [ 30304, "8.30" ], [ 30309, "write error" ], [ 30328, "POSIX" ], [ 30336, "A NULL argv[0] was passed through an exec system call." ], [ 30392, "/.libs/" ], [ 30429, "GB18030" ], [ 30439, "literal" ], [ 30453, "shell-always" ], [ 30466, "shell-escape" ], [ 30479, "shell-escape-always" ], [ 30499, "c-maybe" ], [ 30507, "clocale" ], [ 32312, "%s (%s) %s" ], [ 32335, "Written by %s." ], [ 32351, "Written by %s and %s." ], [ 32374, "Written by %s, %s, and %s." ], [ 32402, "Report bugs to: %s" ], [ 32423, "bug-coreutils@gnu.org" ], [ 32445, "%s home page: \u003c%s\u003e" ], [ 32472, "License GPLv3+: GNU GPL version 3 or later \u003chttps://gnu.org/licenses/gpl.html\u003e.\nThis is free software: you are free to change an" ], [ 32473, "License GPLv3+: GNU GPL version 3 or later \u003chttps://gnu.org/licenses/gpl.html\u003e." ], [ 32553, "This is free software: you are free to change and redistribute it." ], [ 32620, "There is NO WARRANTY, to the extent permitted by law." ], [ 32680, "Written by %s, %s, %s," ], [ 32703, "and %s." ], [ 32735, "%s, and %s." ], [ 32775, "%s, %s, and %s." ], [ 32815, "%s, %s, %s, and %s." ], [ 32983, "%s, %s, and others." ], [ 33008, "General help using GNU software: \u003chttps://www.gnu.org/gethelp/\u003e" ], [ 33184, "Copyright %s %d Free Software Foundation, Inc." ], [ 33231, "memory exhausted" ], [ 33248, "string comparison failed" ], [ 33280, "Set LC_ALL='C' to work around the problem." ], [ 33328, "The strings compared were %s and %s." ], [ 33365, "lib/xstrtol.c" ], [ 33384, "0 \u003c= strtol_base \u0026\u0026 strtol_base \u003c= 36" ], [ 34240, "xstrtoul" ], [ 34249, "ASCII" ], [ 42068, "GCC: (GNU) 7.1.0" ], [ 49049, "crtstuff.c" ], [ 49060, "deregister_tm_clones" ], [ 49081, "__do_global_dtors_aux" ], [ 49103, "completed.6973" ], [ 49118, "__do_global_dtors_aux_fini_array_entry" ], [ 49157, "frame_dummy" ], [ 49169, "__frame_dummy_init_array_entry" ], [ 49200, "join.c" ], [ 49207, "string_to_join_field" ], [ 49228, "set_join_field" ], [ 49243, "freeline" ], [ 49252, "free_spareline" ], [ 49267, "delseq" ], [ 49274, "add_field_list" ], [ 49289, "outlist_end" ], [ 49301, "__PRETTY_FUNCTION__.7310" ], [ 49326, "keycmp" ], [ 49333, "ignore_case" ], [ 49345, "hard_LC_COLLATE" ], [ 49361, "prfield" ], [ 49369, "empty_filler" ], [ 49382, "prfields" ], [ 49391, "autoformat" ], [ 49406, "prjoin" ], [ 49413, "outlist_head" ], [ 49426, "join_field_1" ], [ 49439, "uni_blank" ], [ 49449, "join_field_2" ], [ 49462, "eolchar" ], [ 49470, "autocount_1" ], [ 49482, "autocount_2" ], [ 49494, "extract_field" ], [ 49508, "get_line" ], [ 49517, "prevline" ], [ 49526, "line_no" ], [ 49534, "check_input_order" ], [ 49552, "seen_unpairable" ], [ 49568, "issued_disorder_warning" ], [ 49592, "g_names" ], [ 49600, "getseq" ], [ 49607, "add_file_name" ], [ 49621, "print_pairables" ], [ 49637, "print_unpairables_2" ], [ 49657, "longopts" ], [ 49666, "join_header_lines" ], [ 49684, "print_unpairables_1" ], [ 49704, "version.c" ], [ 49714, "closeout.c" ], [ 49725, "exitfail.c" ], [ 49736, "fadvise.c" ], [ 49746, "fopen-safer.c" ], [ 49760, "hard-locale.c" ], [ 49774, "linebuffer.c" ], [ 49787, "memcasecmp.c" ], [ 49800, "progname.c" ], [ 49811, "quotearg.c" ], [ 49822, "strcaseeq4" ], [ 49833, "gettext_quote" ], [ 49847, "quotearg_buffer_restyled" ], [ 49872, "quotearg_n_options" ], [ 49891, "slotvec" ], [ 49899, "nslots" ], [ 49906, "slotvec0" ], [ 49915, "slot0" ], [ 49921, "default_quoting_options" ], [ 49945, "dup-safer.c" ], [ 49957, "version-etc.c" ], [ 49971, "version-etc-fsf.c" ], [ 49989, "xmalloc.c" ], [ 49999, "xalloc-die.c" ] ], "sz": 55136, "ts": [ { "c": 1.0, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "l": 2 }, { "a": "T1055", "c": 0.25, "d": "Repeated 0x07 code constant (possible PROT_RWX)", "e": [ "07 00 00 00", "07 00 00 00", "07 00 00 00", "07 00 00 00" ], "i": "micro-behaviors/mem/protect/modify::rwx-prot-bytes", "l": 1 }, { "a": "T1083", "c": 0.4000000059604645, "d": "File descriptor manipulation and control", "e": [ "fcntl" ], "i": "micro-behaviors/fs/file/handle::fcntl", "l": 2, "m": "E1083" }, { "c": 0.699999988079071, "d": "GPL license reference", "e": [ "GPL", "GPL" ], "i": "metadata/package/license::gpl-word", "l": 2 }, { "a": "T1005", "c": 0.4000000059604645, "d": "Seeks to position in file", "e": [ "fseeko", "fseeko@@GLIBC_2.2.5", "rpl_fseeko", "sym.imp.fseeko", "sym.rpl_fseeko" ], "i": "micro-behaviors/fs/file/binary::fseek-func", "l": 2 }, { "c": 0.800000011920929, "d": "Binary has many exports (\u003e10)", "e": [ "binary.export_count = 143.00" ], "i": "metadata/binary/metrics::many-exports", "l": 2 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 6.29" ], "i": "metadata/binary/metrics::avg-complexity-15-max", "l": 2 }, { "c": 1.0, "d": "Binary has 20+ sections (installer/packer)", "e": [ "binary.section_count = 28.00" ], "i": "metadata/binary/metrics::many-sections-20", "l": 1 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 55.00" ], "i": "metadata/binary/metrics::many-imports-50", "l": 1 }, { "c": 1.0, "d": "ELF program interpreter metadata", "e": [ "/lib64/ld-linux-x86-64.so.2" ], "i": "metadata/binary/linking/runtime::interpreter", "l": 2 }, { "c": 1.0, "d": "Binary has 100+ exports", "e": [ "binary.export_count = 143.00" ], "i": "metadata/binary/metrics::many-exports-100", "l": 1 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 2.84" ], "i": "metadata/binary/metrics::low-overall-entropy-binary", "l": 1 }, { "c": 0.800000011920929, "d": "libc version string pattern", "e": [ "GLIBC", "GLIBC", "GLIBC", "GLIBC", "GLIBC", "GLIBC", "GLIBC", "GLIBC", "GLIBC", "GLIBC", "GLIBC", "GLIBC", "GLIBC", "GLIBC", "GLIBC", "GLIBC" ], "i": "micro-behaviors/dylib/library/libc::libc-version-string", "l": 2 }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening::no-pie", "l": 2 }, { "d": ".so extension reference", "e": [ ".so" ], "i": "micro-behaviors/fs/path/extension::so", "l": 2 }, { "c": 1.0, "d": "Binary has 9+ exports", "e": [ "binary.export_count = 143.00" ], "i": "metadata/binary/metrics::many-exports-9", "l": 1 }, { "c": 0.4000000059604645, "d": "Terminate process immediately without cleanup", "e": [ "exit", "exit" ], "i": "micro-behaviors/process/terminate/signal::_exit", "l": 2 }, { "d": "Characteristic system library export __cxa_atexit", "e": [ "cxa_atexit" ], "i": "micro-behaviors/dylib/library/libc::libc-characteristic-cxa-atexit", "l": 2 }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2 }, { "c": 1.0, "d": "ELF needed library metadata", "e": [ "[libc.so.6] (size: 1 (array))" ], "i": "metadata/binary/linking/runtime::needed-lib", "l": 2 }, { "d": "overflow keyword", "e": [ "overflow", "overflow@@GLIBC_2.2.5", "__overflow", "__overflow@@GLIBC_2.2.5" ], "i": "micro-behaviors/data/text/keywords::overflow", "l": 1 }, { "c": 0.8999999761581421, "d": "Abort program execution", "e": [ "abort" ], "i": "micro-behaviors/os/signal/handler::abort", "l": 2 }, { "d": "Characteristic system library export __assert_fail", "e": [ "assert_fail" ], "i": "micro-behaviors/dylib/library/libc::libc-characteristic-assert-fail", "l": 2 }, { "c": 0.6600000262260437, "d": "Write files", "e": [ "fwrite" ], "i": "micro-behaviors/fs/file/write::write", "l": 2 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.function_count = 163.00" ], "i": "metadata/binary/metrics::few-functions-3", "l": 1 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "binary.file_size = 55136.00" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.699999988079071, "d": "Unix /tmp/ path reference", "e": [ "/tmp/coreutils/_out/share/locale" ], "i": "micro-behaviors/fs/path/temp::unix-temp", "l": 2 }, { "d": "Characteristic system library export __errno_location", "e": [ "errno_location" ], "i": "micro-behaviors/dylib/library/libc::libc-characteristic-errno", "l": 2 }, { "c": 0.8999999761581421, "d": "CLI help or usage text", "e": [ "Try '%s --help' for more information." ], "i": "metadata/binary/metrics::help-usage-string", "l": 2 }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.function_count = 163.00" ], "i": "metadata/binary/metrics::many-functions", "l": 2 }, { "d": "Characteristic system library exports", "e": [ "libc_start_main" ], "i": "micro-behaviors/dylib/library/libc::libc-characteristic-symbols", "l": 2 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 55.00" ], "i": "metadata/binary/metrics::many-imports-30", "l": 1 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.21" ], "i": "metadata/binary/metrics::avg-string-entropy-4-max", "l": 2 }, { "a": "T1486", "c": 0.75, "d": "flock LOCK_EX call bytecode pattern", "e": [ "be 12 09 00 00", "be 05 09 00 00", "ba eb f2 ff ff", "ba f5 ef ff ff", "ba 85 ef ff ff", "ba bf ee ff ff", "ba 8f e8 ff ff", "bb 03 00 00 eb", "ba c0 fc ff ff", "be a1 af ff ff" ], "i": "objectives/impact/ransom/esxi::flock-lockex", "l": 1, "m": "C0027" }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 55.00" ], "i": "metadata/binary/metrics::many-imports-20", "l": 1 }, { "c": 0.6600000262260437, "d": "Open files", "e": [ "fopen" ], "i": "micro-behaviors/fs/file/open::fopen", "l": 2 }, { "c": 0.8999999761581421, "d": "ELF dynsym section name", "e": [ ".dynsym" ], "i": "metadata/binary/linking::elf-dynsym-section-name", "l": 2 }, { "d": "Usage: label in binary strings", "e": [ "Usage: %s [OPTION]... FILE1 FILE2" ], "i": "metadata/package/help::usage-title-string", "l": 1 }, { "c": 0.8999999761581421, "d": "ELF dynamic section name", "e": [ ".dynamic" ], "i": "metadata/binary/linking::elf-dynamic-section-name", "l": 2 }, { "c": 1.0, "d": "Binary format is identified", "e": [ "elf.class_bits = 64.00" ], "i": "metadata/binary::binary-format-checked", "l": 2 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 55.00" ], "i": "metadata/binary/metrics::many-imports-25", "l": 1 }, { "c": 0.8999999761581421, "d": "ELF interpreter section name", "e": [ ".interp" ], "i": "metadata/binary/linking::elf-interpreter-section-name", "l": 2 }, { "c": 0.30000001192092896, "d": "GNU coreutils reference", "e": [ "GNU coreutils" ], "i": "micro-behaviors/dylib/library::gnu-coreutils-ref", "l": 2 }, { "d": "Binary exports symbols", "e": [ "binary.export_count = 143.00" ], "i": "metadata/binary/symbols::has-exports", "l": 1 }, { "c": 1.0, "d": "Binary has 20+ exports", "e": [ "binary.export_count = 143.00" ], "i": "metadata/binary/metrics::many-exports-20", "l": 1 }, { "c": 0.6600000262260437, "d": "Reference to /lib64", "e": [ "/lib64/ld-linux-x86-64.so.2" ], "i": "micro-behaviors/fs/path/system::system-lib64", "l": 2 }, { "c": 1.0, "d": "ELF64 class marker", "e": [ "elf.class_bits = 64.00" ], "i": "metadata/binary/metrics::elf64-class", "l": 1 }, { "c": 1.0, "d": "/tmp/ path component", "e": [ "/tmp/coreutils/_out/share/locale" ], "i": "micro-behaviors/fs/path/temp::tmp-path-content", "l": 2 }, { "a": "T1059.006", "c": 0.6000000238418579, "d": "Named /tmp execution path", "e": [ "/tmp/coreutils" ], "i": "objectives/command-and-control/dropper::tmp-path", "l": 1, "m": "B0024" }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 55.00" ], "i": "metadata/binary/metrics::many-imports-40", "l": 1 }, { "c": 0.20000000298023224, "d": "output keyword", "e": [ "…rite a line to\nstandard output. The default join fiel…", "-t CHAR use CHAR as input and output field separator", "-o FORMAT obey FORMAT while constructing output line", "-v FILENUM like -a FILENUM, but suppress joined output lines", "…or '0'. Default FORMAT outputs the join field,\nthe re…", "standard output. The default join field is the first, delimited by blanks.", "…es the number of fields output for each line.\n\nImporta…", "line of each file determines the number of fields output for each line.", "each being 'FILENUM.FIELD' or '0'. Default FORMAT outputs the join field,", "--version output version information and exit" ], "i": "micro-behaviors/data/text/keywords::output", "l": 1 }, { "c": 0.699999988079071, "d": "Version information string", "e": [ "--version" ], "i": "metadata/package/help::version-text", "l": 2 }, { "c": 0.8999999761581421, "d": "ELF dynstr section name", "e": [ ".dynstr" ], "i": "metadata/binary/linking::elf-dynstr-section-name", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.function_count = 163.00" ], "i": "metadata/binary/metrics::many-functions-50", "l": 1 }, { "c": 0.8999999761581421, "d": "No RELRO (GOT writable after load)", "e": [ "elf.relro = 0.00" ], "i": "metadata/hardening::no-relro", "l": 2 }, { "c": 0.8999999761581421, "d": "ELF dynstr section name", "e": [ ".dynstr" ], "i": "metadata/hardening::elf-dynstr-section-name", "l": 2 }, { "c": 0.8999999761581421, "d": "ELF interpreter section name", "e": [ ".interp" ], "i": "metadata/hardening::elf-interpreter-section-name", "l": 2 }, { "c": 0.8999999761581421, "d": "No stack canary (stack smashing protection absent)", "e": [ "elf.stack_canary = 0.00" ], "i": "metadata/hardening::no-stack-canary", "l": 2 }, { "c": 0.6000000238418579, "d": "Binary not position-independent (no ASLR)", "e": [ "elf.e_type = 2.00" ], "i": "metadata/hardening::no-pie-struct", "l": 3 }, { "c": 0.8999999761581421, "d": "ELF dynsym section name", "e": [ ".dynsym" ], "i": "metadata/hardening::elf-dynsym-section-name", "l": 2 }, { "c": 0.8999999761581421, "d": "ELF dynamic section name", "e": [ ".dynamic" ], "i": "metadata/hardening::elf-dynamic-section-name", "l": 2 }, { "a": "T1005", "c": 0.75, "d": "File content manipulation (read/write/seek)", "e": [ "sym.imp.fseeko", "rpl_fseeko", "fseeko@@GLIBC_2.2.5", "sym.rpl_fseeko", "fseeko", "fwrite" ], "i": "micro-behaviors/fs/file/binary::file-manipulation", "l": 3 }, { "c": 0.6600000262260437, "d": "Reference to /tmp", "e": [ "/tmp/coreutils/_out/share/locale", "/tmp/coreutils/_out/share/locale" ], "i": "micro-behaviors/fs/path/temp::temp-tmp", "l": 2 }, { "c": 0.8500000238418579, "d": "Documented command line program", "e": [ "Usage: %s [OPTION]... FILE1 FILE2", "binary.import_count = 55.00" ], "i": "metadata/package/help::documented-cli-binary", "l": 1 } ], "sha": "ed11c0456630c5dbed1c4fc9f93f6dd1ef8e9893574b8c545e9fda59f4bb3d13", "path": "/data/samples/good/datasets/Labeled-Elfs/benignware/x86__64__lsb__unix-system-v__gcc-7.1.0__O1__no-obf__unstripped__coreutils-8.30__join", "type": "elf" } ], "tv": "b2c18" } }