{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.5925531983375549, "class": 0 } ], "prob": 0.5925532, "class": 0, "models": [ { "m": "az", "prob": 0.5925532, "class": 0 }, { "m": "az/native", "prob": 0.07716687, "class": 0 }, { "m": "az/elf", "prob": 0.032098766, "class": 0 } ], "version": "v16.16", "thresholds": [ 0.9979839, 1.0 ], "analyzed_at": "2026-05-10T23:46:35Z" }, "path": "x86__64__lsb__unix-system-v__clang-4.0.0__O3__no-obf__unstripped__util-linux-2.33__libsmartcols.so.1.1.0", "raw": { "v": "4", "fs": [ { "f": "O₂(CEr₂)H₅(Cm₂F₂HfOsPo₂)Md₂(BiHe)", "k": { "elf.relro": "partial", "elf.soname": "libsmartcols.so.1", "elf.comment": "GCC: (Ubuntu 5.5.0-12ubuntu1~16.04) 5.5.0 20171010; clang version 4.0.0 (tags/RELEASE_400/final)", "build.distro": "ubuntu", "elf.needed[0]": "libc.so.6", "elf.needed[1]": "ld-linux-x86-64.so.2", "build.toolchain": "gcc 5.5.0", "build.target_arch": "x86_64", "elf.entry_section": ".text", "elf.segments[0].perms": "r-x", "elf.segments[1].perms": "rw-", "elf.segments[2].perms": "rw-", "elf.segments[3].perms": "r--", "elf.segments[4].perms": "r--", "elf.segments[5].perms": "rw-", "elf.segments[6].perms": "r--", "build.toolchain_family": "gcc", "elf.comment_entries[0]": "GCC: (Ubuntu 5.5.0-12ubuntu1~16.04) 5.5.0 20171010", "elf.comment_entries[1]": "clang version 4.0.0 (tags/RELEASE_400/final)", "elf.fini_array[0].addr": "0x7e40", "elf.init_array[0].addr": "0x7e80", "elf.segments[0].p_type": "PT_LOAD", "elf.segments[1].p_type": "PT_LOAD", "elf.segments[2].p_type": "PT_DYNAMIC", "elf.segments[3].p_type": "PT_TLS", "elf.segments[4].p_type": "PT_GNU_EH_FRAME", "elf.segments[5].p_type": "PT_GNU_STACK", "elf.segments[6].p_type": "PT_GNU_RELRO", "elf.segments[0].p_memsz": 198476, "elf.segments[1].p_memsz": 7552, "elf.segments[1].p_vaddr": 2297112, "elf.segments[2].p_memsz": 512, "elf.segments[2].p_vaddr": 2301360, "elf.segments[3].p_memsz": 6, "elf.segments[3].p_vaddr": 2297112, "elf.segments[4].p_memsz": 4044, "elf.segments[4].p_vaddr": 176136, "elf.segments[6].p_memsz": 4840, "elf.segments[6].p_vaddr": 2297112, "elf.dynsym_funcs[0].kind": "func", "elf.dynsym_funcs[0].name": "__assert_fail", "elf.dynsym_funcs[1].kind": "func", "elf.dynsym_funcs[1].name": "__ctype_b_loc", "elf.dynsym_funcs[2].kind": "func", "elf.dynsym_funcs[2].name": "__ctype_get_mb_cur_max", "elf.dynsym_funcs[3].kind": "func", "elf.dynsym_funcs[3].name": "__ctype_tolower_loc", "elf.dynsym_funcs[4].kind": "func", "elf.dynsym_funcs[4].name": "__ctype_toupper_loc", "elf.dynsym_funcs[5].kind": "func", "elf.dynsym_funcs[5].name": "__cxa_atexit", "elf.dynsym_funcs[6].kind": "func", "elf.dynsym_funcs[6].name": "__cxa_finalize", "elf.dynsym_funcs[7].kind": "func", "elf.dynsym_funcs[7].name": "__errno_location", "elf.dynsym_funcs[8].kind": "func", "elf.dynsym_funcs[8].name": "__fxstat", "elf.dynsym_funcs[9].kind": "func", "elf.dynsym_funcs[9].name": "__fxstatat", "elf.provided_versions[0]": "SMARTCOLS_2.25", "elf.provided_versions[1]": "SMARTCOLS_2.27", "elf.provided_versions[2]": "SMARTCOLS_2.28", "elf.provided_versions[3]": "SMARTCOLS_2.29", "elf.provided_versions[4]": "SMARTCOLS_2.30", "elf.provided_versions[5]": "SMARTCOLS_2.31", "elf.provided_versions[6]": "SMARTCOLS_2.33", "elf.provided_versions[7]": "libsmartcols.so.1", "elf.segments[0].p_filesz": 198476, "elf.segments[1].p_filesz": 6704, "elf.segments[1].p_offset": 199960, "elf.segments[2].p_filesz": 512, "elf.segments[2].p_offset": 204208, "elf.segments[3].p_offset": 199960, "elf.segments[4].p_filesz": 4044, "elf.segments[4].p_offset": 176136, "elf.segments[6].p_filesz": 4840, "elf.segments[6].p_offset": 199960, "elf.dynsym_funcs[10].kind": "func", "elf.dynsym_funcs[10].name": "__libc_current_sigrtmax", "elf.dynsym_funcs[11].kind": "func", "elf.dynsym_funcs[11].name": "__libc_current_sigrtmin", "elf.dynsym_funcs[12].kind": "func", "elf.dynsym_funcs[12].name": "__sched_cpualloc", "elf.dynsym_funcs[13].kind": "func", "elf.dynsym_funcs[13].name": "__sched_cpufree", "elf.dynsym_funcs[14].kind": "func", "elf.dynsym_funcs[14].name": "__strdup", "elf.dynsym_funcs[15].kind": "func", "elf.dynsym_funcs[15].name": "__strndup", "elf.dynsym_funcs[16].kind": "func", "elf.dynsym_funcs[16].name": "__strtol_internal", "elf.dynsym_funcs[17].kind": "func", "elf.dynsym_funcs[17].name": "__strtoul_internal", "elf.dynsym_funcs[18].kind": "func", "elf.dynsym_funcs[18].name": "__tls_get_addr", "elf.dynsym_funcs[19].kind": "func", "elf.dynsym_funcs[19].name": "__xpg_basename", "elf.dynsym_funcs[20].kind": "func", "elf.dynsym_funcs[20].name": "__xstat", "elf.dynsym_funcs[21].kind": "func", "elf.dynsym_funcs[21].name": "abort", "elf.dynsym_funcs[22].kind": "func", "elf.dynsym_funcs[22].name": "access", "elf.dynsym_funcs[23].kind": "func", "elf.dynsym_funcs[23].name": "asprintf", "elf.dynsym_funcs[24].kind": "func", "elf.dynsym_funcs[24].name": "calloc", "elf.dynsym_funcs[25].kind": "func", "elf.dynsym_funcs[25].name": "close", "elf.dynsym_funcs[26].kind": "func", "elf.dynsym_funcs[26].name": "closedir", "elf.dynsym_funcs[27].kind": "func", "elf.dynsym_funcs[27].name": "connect", "elf.dynsym_funcs[28].kind": "func", "elf.dynsym_funcs[28].name": "dcgettext", "elf.dynsym_funcs[29].kind": "func", "elf.dynsym_funcs[29].name": "dirfd", "elf.dynsym_funcs[30].kind": "func", "elf.dynsym_funcs[30].name": "dup", "elf.dynsym_funcs[31].kind": "func", "elf.dynsym_funcs[31].name": "dup2", "elf.dynsym_funcs[32].kind": "func", "elf.dynsym_funcs[32].name": "endmntent", "elf.dynsym_funcs[33].kind": "func", "elf.dynsym_funcs[33].name": "err", "elf.dynsym_funcs[34].kind": "func", "elf.dynsym_funcs[34].name": "errx", "elf.dynsym_funcs[35].kind": "func", "elf.dynsym_funcs[35].name": "execl", "elf.dynsym_funcs[36].kind": "func", "elf.dynsym_funcs[36].name": "execvp", "elf.dynsym_funcs[37].kind": "func", "elf.dynsym_funcs[37].name": "faccessat", "elf.dynsym_funcs[38].kind": "func", "elf.dynsym_funcs[38].name": "fclose", "elf.dynsym_funcs[39].kind": "func", "elf.dynsym_funcs[39].name": "fcntl", "elf.dynsym_funcs[40].kind": "func", "elf.dynsym_funcs[40].name": "fdopen", "elf.dynsym_funcs[41].kind": "func", "elf.dynsym_funcs[41].name": "fdopendir", "elf.dynsym_funcs[42].kind": "func", "elf.dynsym_funcs[42].name": "fflush", "elf.dynsym_funcs[43].kind": "func", "elf.dynsym_funcs[43].name": "fgetc", "elf.dynsym_funcs[44].kind": "func", "elf.dynsym_funcs[44].name": "fgets", "elf.dynsym_funcs[45].kind": "func", "elf.dynsym_funcs[45].name": "fopen", "elf.dynsym_funcs[46].kind": "func", "elf.dynsym_funcs[46].name": "fork", "elf.dynsym_funcs[47].kind": "func", "elf.dynsym_funcs[47].name": "fprintf", "elf.dynsym_funcs[48].kind": "func", "elf.dynsym_funcs[48].name": "fputc", "elf.dynsym_funcs[49].kind": "func", "elf.dynsym_funcs[49].name": "fputs", "elf.dynsym_funcs[50].kind": "func", "elf.dynsym_funcs[50].name": "free", "elf.dynsym_funcs[51].kind": "func", "elf.dynsym_funcs[51].name": "fscanf", "elf.dynsym_funcs[52].kind": "func", "elf.dynsym_funcs[52].name": "fwrite", "elf.dynsym_funcs[53].kind": "func", "elf.dynsym_funcs[53].name": "getcwd", "elf.dynsym_funcs[54].kind": "func", "elf.dynsym_funcs[54].name": "getdtablesize", "elf.dynsym_funcs[55].kind": "func", "elf.dynsym_funcs[55].name": "getegid", "elf.dynsym_funcs[56].kind": "func", "elf.dynsym_funcs[56].name": "getenv", "elf.dynsym_funcs[57].kind": "func", "elf.dynsym_funcs[57].name": "geteuid", "elf.dynsym_funcs[58].kind": "func", "elf.dynsym_funcs[58].name": "getgid", "elf.dynsym_funcs[59].kind": "func", "elf.dynsym_funcs[59].name": "getgrgid", "elf.dynsym_funcs[60].kind": "func", "elf.dynsym_funcs[60].name": "getlogin", "elf.dynsym_funcs[61].kind": "func", "elf.dynsym_funcs[61].name": "getmntent", "elf.dynsym_funcs[62].kind": "func", "elf.dynsym_funcs[62].name": "getpid", "elf.dynsym_funcs[63].kind": "func", "elf.dynsym_funcs[63].name": "getppid", "elf.dynsym_funcs[64].kind": "func", "elf.dynsym_funcs[64].name": "getpwnam_r", "elf.dynsym_funcs[65].kind": "func", "elf.dynsym_funcs[65].name": "getpwuid", "elf.dynsym_funcs[66].kind": "func", "elf.dynsym_funcs[66].name": "gettimeofday", "elf.dynsym_funcs[67].kind": "func", "elf.dynsym_funcs[67].name": "getuid", "elf.dynsym_funcs[68].kind": "func", "elf.dynsym_funcs[68].name": "gmtime_r", "elf.dynsym_funcs[69].kind": "func", "elf.dynsym_funcs[69].name": "hasmntopt", "elf.dynsym_funcs[70].kind": "func", "elf.dynsym_funcs[70].name": "ioctl", "elf.dynsym_funcs[71].kind": "func", "elf.dynsym_funcs[71].name": "isatty", "elf.dynsym_funcs[72].kind": "func", "elf.dynsym_funcs[72].name": "iswprint", "elf.dynsym_funcs[73].kind": "func", "elf.dynsym_funcs[73].name": "jrand48", "elf.dynsym_funcs[74].kind": "func", "elf.dynsym_funcs[74].name": "localeconv", "elf.dynsym_funcs[75].kind": "func", "elf.dynsym_funcs[75].name": "localtime", "elf.dynsym_funcs[76].kind": "func", "elf.dynsym_funcs[76].name": "localtime_r", "elf.dynsym_funcs[77].kind": "func", "elf.dynsym_funcs[77].name": "lseek", "elf.dynsym_funcs[78].kind": "func", "elf.dynsym_funcs[78].name": "malloc", "elf.dynsym_funcs[79].kind": "func", "elf.dynsym_funcs[79].name": "mbrtowc", "elf.dynsym_funcs[80].kind": "func", "elf.dynsym_funcs[80].name": "mbstowcs", "elf.dynsym_funcs[81].kind": "func", "elf.dynsym_funcs[81].name": "memchr", "elf.dynsym_funcs[82].kind": "func", "elf.dynsym_funcs[82].name": "memcpy", "elf.dynsym_funcs[83].kind": "func", "elf.dynsym_funcs[83].name": "memmove", "elf.dynsym_funcs[84].kind": "func", "elf.dynsym_funcs[84].name": "memset", "elf.dynsym_funcs[85].kind": "func", "elf.dynsym_funcs[85].name": "mkdir", "elf.dynsym_funcs[86].kind": "func", "elf.dynsym_funcs[86].name": "mkostemp", "elf.dynsym_funcs[87].kind": "func", "elf.dynsym_funcs[87].name": "mktime", "elf.dynsym_funcs[88].kind": "func", "elf.dynsym_funcs[88].name": "nanosleep", "elf.dynsym_funcs[89].kind": "func", "elf.dynsym_funcs[89].name": "nl_langinfo", "elf.dynsym_funcs[90].kind": "func", "elf.dynsym_funcs[90].name": "open", "elf.dynsym_funcs[91].kind": "func", "elf.dynsym_funcs[91].name": "open_memstream", "elf.dynsym_funcs[92].kind": "func", "elf.dynsym_funcs[92].name": "openat", "elf.dynsym_funcs[93].kind": "func", "elf.dynsym_funcs[93].name": "opendir", "elf.dynsym_funcs[94].kind": "func", "elf.dynsym_funcs[94].name": "pipe", "elf.dynsym_funcs[95].kind": "func", "elf.dynsym_funcs[95].name": "poll", "elf.dynsym_funcs[96].kind": "func", "elf.dynsym_funcs[96].name": "prctl", "elf.dynsym_funcs[97].kind": "func", "elf.dynsym_funcs[97].name": "qsort", "elf.dynsym_funcs[98].kind": "func", "elf.dynsym_funcs[98].name": "raise", "elf.dynsym_funcs[99].kind": "func", "elf.dynsym_funcs[99].name": "random", "elf.segments[0].flags_hex": "5", "elf.segments[1].flags_hex": "6", "elf.segments[2].flags_hex": "6", "elf.segments[3].flags_hex": "4", "elf.segments[4].flags_hex": "4", "elf.segments[5].flags_hex": "6", "elf.segments[6].flags_hex": "4", "elf.dynsym_funcs[100].kind": "func", "elf.dynsym_funcs[100].name": "read", "elf.dynsym_funcs[101].kind": "func", "elf.dynsym_funcs[101].name": "readdir", "elf.dynsym_funcs[102].kind": "func", "elf.dynsym_funcs[102].name": "readlink", "elf.dynsym_funcs[103].kind": "func", "elf.dynsym_funcs[103].name": "readlinkat", "elf.dynsym_funcs[104].kind": "func", "elf.dynsym_funcs[104].name": "realloc", "elf.dynsym_funcs[105].kind": "func", "elf.dynsym_funcs[105].name": "realpath", "elf.dynsym_funcs[106].kind": "func", "elf.dynsym_funcs[106].name": "rewinddir", "elf.dynsym_funcs[107].kind": "func", "elf.dynsym_funcs[107].name": "secure_getenv", "elf.dynsym_funcs[108].kind": "func", "elf.dynsym_funcs[108].name": "select", "elf.dynsym_funcs[109].kind": "func", "elf.dynsym_funcs[109].name": "setegid", "elf.dynsym_funcs[110].kind": "func", "elf.dynsym_funcs[110].name": "setenv", "elf.dynsym_funcs[111].kind": "func", "elf.dynsym_funcs[111].name": "seteuid", "elf.dynsym_funcs[112].kind": "func", "elf.dynsym_funcs[112].name": "setmntent", "elf.dynsym_funcs[113].kind": "func", "elf.dynsym_funcs[113].name": "setsockopt", "elf.dynsym_funcs[114].kind": "func", "elf.dynsym_funcs[114].name": "sigaction", "elf.dynsym_funcs[115].kind": "func", "elf.dynsym_funcs[115].name": "sigemptyset", "elf.dynsym_funcs[116].kind": "func", "elf.dynsym_funcs[116].name": "snprintf", "elf.dynsym_funcs[117].kind": "func", "elf.dynsym_funcs[117].name": "socket", "elf.dynsym_funcs[118].kind": "func", "elf.dynsym_funcs[118].name": "sprintf", "elf.dynsym_funcs[119].kind": "func", "elf.dynsym_funcs[119].name": "srandom", "elf.dynsym_funcs[120].kind": "func", "elf.dynsym_funcs[120].name": "sscanf", "elf.dynsym_funcs[121].kind": "func", "elf.dynsym_funcs[121].name": "stpcpy", "elf.dynsym_funcs[122].kind": "func", "elf.dynsym_funcs[122].name": "strcasecmp", "elf.dynsym_funcs[123].kind": "func", "elf.dynsym_funcs[123].name": "strchr", "elf.dynsym_funcs[124].kind": "func", "elf.dynsym_funcs[124].name": "strcmp", "elf.dynsym_funcs[125].kind": "func", "elf.dynsym_funcs[125].name": "strcpy", "elf.dynsym_funcs[126].kind": "func", "elf.dynsym_funcs[126].name": "strcspn", "elf.dynsym_funcs[127].kind": "func", "elf.dynsym_funcs[127].name": "strerror", "elf.dynsym_funcs[128].kind": "func", "elf.dynsym_funcs[128].name": "strftime", "elf.dynsym_funcs[129].kind": "func", "elf.dynsym_funcs[129].name": "strlen", "elf.dynsym_funcs[130].kind": "func", "elf.dynsym_funcs[130].name": "strncasecmp", "elf.dynsym_funcs[131].kind": "func", "elf.dynsym_funcs[131].name": "strncmp", "elf.dynsym_funcs[132].kind": "func", "elf.dynsym_funcs[132].name": "strncpy", "elf.dynsym_funcs[133].kind": "func", "elf.dynsym_funcs[133].name": "strptime", "elf.dynsym_funcs[134].kind": "func", "elf.dynsym_funcs[134].name": "strrchr", "elf.dynsym_funcs[135].kind": "func", "elf.dynsym_funcs[135].name": "strspn", "elf.dynsym_funcs[136].kind": "func", "elf.dynsym_funcs[136].name": "strstr", "elf.dynsym_funcs[137].kind": "func", "elf.dynsym_funcs[137].name": "strtod", "elf.dynsym_funcs[138].kind": "func", "elf.dynsym_funcs[138].name": "strtok", "elf.dynsym_funcs[139].kind": "func", "elf.dynsym_funcs[139].name": "strtol", "elf.dynsym_funcs[140].kind": "func", "elf.dynsym_funcs[140].name": "strtoll", "elf.dynsym_funcs[141].kind": "func", "elf.dynsym_funcs[141].name": "strtoul", "elf.dynsym_funcs[142].kind": "func", "elf.dynsym_funcs[142].name": "syscall", "elf.dynsym_funcs[143].kind": "func", "elf.dynsym_funcs[143].name": "time", "elf.dynsym_funcs[144].kind": "func", "elf.dynsym_funcs[144].name": "ttyname", "elf.dynsym_funcs[145].kind": "func", "elf.dynsym_funcs[145].name": "umask", "elf.dynsym_funcs[146].kind": "func", "elf.dynsym_funcs[146].name": "uname", "elf.dynsym_funcs[147].kind": "func", "elf.dynsym_funcs[147].name": "unlink", "elf.dynsym_funcs[148].kind": "func", "elf.dynsym_funcs[148].name": "unsetenv", "elf.dynsym_funcs[149].kind": "func", "elf.dynsym_funcs[149].name": "vasprintf", "elf.dynsym_funcs[150].kind": "func", "elf.dynsym_funcs[150].name": "vfprintf", "elf.dynsym_funcs[151].kind": "func", "elf.dynsym_funcs[151].name": "vfscanf", "elf.dynsym_funcs[152].kind": "func", "elf.dynsym_funcs[152].name": "vsnprintf", "elf.dynsym_funcs[153].kind": "func", "elf.dynsym_funcs[153].name": "waitpid", "elf.dynsym_funcs[154].kind": "func", "elf.dynsym_funcs[154].name": "warn", "elf.dynsym_funcs[155].kind": "func", "elf.dynsym_funcs[155].name": "warnx", "elf.dynsym_funcs[156].kind": "func", "elf.dynsym_funcs[156].name": "wcstombs", "elf.dynsym_funcs[157].kind": "func", "elf.dynsym_funcs[157].name": "wcswidth", "elf.dynsym_funcs[158].kind": "func", "elf.dynsym_funcs[158].name": "wctomb", "elf.dynsym_funcs[159].kind": "func", "elf.dynsym_funcs[159].name": "wcwidth", "elf.dynsym_funcs[160].kind": "func", "elf.dynsym_funcs[160].name": "write", "elf.needed_versions[0].lib": "ld-linux-x86-64.so.2", "elf.needed_versions[1].lib": "libc.so.6", "elf.dynsym_funcs[6].binding": "weak", "elf.version_definitions[0].base": true, "elf.version_definitions[0].name": "libsmartcols.so.1", "elf.version_definitions[1].name": "SMARTCOLS_2.25", "elf.version_definitions[2].name": "SMARTCOLS_2.27", "elf.version_definitions[3].name": "SMARTCOLS_2.28", "elf.version_definitions[4].name": "SMARTCOLS_2.29", "elf.version_definitions[5].name": "SMARTCOLS_2.30", "elf.version_definitions[6].name": "SMARTCOLS_2.31", "elf.version_definitions[7].name": "SMARTCOLS_2.33", "elf.version_definitions[2].parent": "SMARTCOLS_2.25", "elf.version_definitions[3].parent": "SMARTCOLS_2.27", "elf.version_definitions[4].parent": "SMARTCOLS_2.28", "elf.version_definitions[5].parent": "SMARTCOLS_2.29", "elf.version_definitions[6].parent": "SMARTCOLS_2.30", "elf.version_definitions[7].parent": "SMARTCOLS_2.31", "elf.needed_versions[0].versions[0]": "GLIBC_2.3", "elf.needed_versions[1].versions[0]": "GLIBC_2.14", "elf.needed_versions[1].versions[1]": "GLIBC_2.17", "elf.needed_versions[1].versions[2]": "GLIBC_2.2.5", "elf.needed_versions[1].versions[3]": "GLIBC_2.3", "elf.needed_versions[1].versions[4]": "GLIBC_2.4", "elf.needed_versions[1].versions[5]": "GLIBC_2.7" }, "x": 17, "id": 0, "is": [ "", "ctype_toupper_loc", "getenv", "raise", "free", "endmntent", "strcasecmp", "localtime", "abort", "errno_location", "srandom", "unlink", "open_memstream", "strncpy", "strncmp", "ITM_deregisterTMCloneTable", "stdout", "localtime_r", "strcpy", "secure_getenv", "warn", "mkdir", "qsort", "isatty", "sigaction", "strtod", "vsnprintf", "setsockopt", "wcswidth", "localeconv", "faccessat", "mbstowcs", "readlink", "fcntl", "setenv", "write", "getpid", "vasprintf", "strtol_internal", "fclose", "opendir", "getpwuid", "stpcpy", "dcgettext", "ctype_get_mb_cur_max", "strlen", "openat", "getuid", "errx", "mbrtowc", "dup2", "strchr", "warnx", "getgrgid", "fxstatat", "snprintf", "nanosleep", "strrchr", "uname", "mkostemp", "gmtime_r", "dup", "lseek", "gettimeofday", "assert_fail", "fputs", "strtoul_internal", "memset", "geteuid", "fscanf", "ioctl", "getcwd", "fgetc", "close", "rewinddir", "pipe", "strspn", "closedir", "fputc", "strdup", "strcspn", "memchr", "read", "environ", "fgets", "tls_get_addr", "calloc", "strcmp", "readlinkat", "dirfd", "strtoll", "strndup", "fprintf", "syscall", "sigemptyset", "gmon_start__", "umask", "strtol", "environ", "realpath", "memcpy", "prctl", "xpg_basename", "time", "getgid", "select", "xstat", "readdir", "random", "wcwidth", "err", "malloc", "strncasecmp", "fflush", "getmntent", "setmntent", "nl_langinfo", "sched_cpufree", "fxstat", "sscanf", "getlogin", "getegid", "mktime", "sched_cpualloc", "ttyname", "realloc", "fdopen", "asprintf", "getpwnam_r", "poll", "strftime", "memmove", "waitpid", "wctomb", "open", "access", "fopen", "strtok", "Jv_RegisterClasses", "vfprintf", "fdopendir", "unsetenv", "jrand48", "strtoul", "execvp", "cxa_atexit", "wcstombs", "libc_current_sigrtmin", "environ", "sprintf", "getppid", "connect", "fwrite", "libc_current_sigrtmax", "ITM_registerTMCloneTable", "strerror", "execl", "iswprint", "hasmntopt", "strptime", "cxa_finalize", "setegid", "fork", "strstr", "getdtablesize", "vfscanf", "ctype_tolower_loc", "ctype_b_loc", "stderr", "socket", "seteuid" ], "ms": { "elf": { "entry": 32176.0, "relro": "partial", "e_type": 3.0, "needed": [ "libc.so.6", "ld-linux-x86-64.so.2" ], "soname": "libsmartcols.so.1", "has_got": true, "has_plt": true, "e_machine": 62.0, "relacount": 298.0, "class_bits": 64.0, "has_soname": true, "nx_enabled": true, "needed_libs": 2.0, "dynsym_count": 329.0, "has_eh_frame": true, "has_gnu_hash": true, "symtab_count": 809.0, "dynrela_count": 307.0, "entry_section": ".text", "little_endian": true, "section_count": 31.0, "pltreloc_count": 222.0, "dt_versym_count": 329.0, "fini_array_count": 1.0, "init_array_count": 1.0, "comment_entry_count": 2.0, "program_header_count": 7.0, "has_direct_loader_dep": true, "comment_distinct_count": 2.0, "gnu_stack_section_absent": true, "load_segment_max_p_memsz": 198476.0, "load_segment_max_p_filesz": 198476.0, "stripped_but_symtab_present": true, "section_relocation_group_count": 2.0 }, "file": { "size": 242872.0 }, "binary": { "code_size": 133548.0, "func_count": 680.0, "has_overlay": true, "code_entropy": 4.1, "data_entropy": 3.68, "export_count": 316.0, "func_density": 5.21, "import_count": 171.0, "overlay_size": 1984.0, "string_count": 1368.0, "avg_func_size": 212.59, "overlay_ratio": 0.01, "section_count": 30.0, "avg_complexity": 6.69, "import_density": 1.31, "max_complexity": 260.0, "string_density": 10.49, "aliased_exports": 167.0, "overall_entropy": 3.05, "overlay_entropy": 1.64, "avg_basic_blocks": 9.67, "avg_section_size": 7992.03, "dependency_count": 2.0, "entropy_variance": 1.75, "avg_string_length": 16.75, "complexity_per_kb": 0.05, "dynsym_func_count": 310.0, "max_string_length": 139.0, "avg_string_entropy": 3.21, "code_to_data_ratio": 1.26, "data_to_file_ratio": 0.0, "text_to_file_ratio": 0.53, "total_basic_blocks": 6577.0, "func_analysis_depth": 2.0, "internal_func_count": 370.0, "string_length_stddev": 11.22, "largest_section_ratio": 0.53, "sentence_string_count": 145.0, "sentence_string_ratio": 0.11, "behavioral_import_ratio": 0.05, "nonstandard_section_count": 3.0, "high_complexity_func_count": 8.0 } }, "ss": [ [ 0, "asprintf" ], [ 9649, "__gmon_start__" ], [ 9664, "_ITM_deregisterTMCloneTable" ], [ 9692, "_ITM_registerTMCloneTable" ], [ 9718, "__cxa_finalize" ], [ 9733, "_Jv_RegisterClasses" ], [ 9753, "calloc" ], [ 9760, "scols_free_iter" ], [ 9776, "scols_iter_get_direction" ], [ 9801, "scols_new_iter" ], [ 9816, "scols_reset_iter" ], [ 9833, "__assert_fail" ], [ 9847, "__strdup" ], [ 9856, "scols_copy_symbols" ], [ 9875, "scols_new_symbols" ], [ 9893, "scols_ref_symbols" ], [ 9911, "scols_symbols_set_branch" ], [ 9936, "scols_symbols_set_cell_padding" ], [ 9967, "scols_symbols_set_right" ], [ 9991, "scols_symbols_set_title_padding" ], [ 10023, "scols_symbols_set_vertical" ], [ 10050, "scols_unref_symbols" ], [ 10070, "__ctype_b_loc" ], [ 10090, "getpid" ], [ 10097, "scols_cell_copy_content" ], [ 10121, "scols_cell_get_alignment" ], [ 10146, "scols_cell_get_color" ], [ 10167, "scols_cell_get_data" ], [ 10187, "scols_cell_get_flags" ], [ 10208, "scols_cell_get_userdata" ], [ 10232, "scols_cell_refer_data" ], [ 10254, "scols_cell_set_color" ], [ 10275, "scols_cell_set_data" ], [ 10295, "scols_cell_set_flags" ], [ 10316, "scols_cell_set_userdata" ], [ 10340, "scols_cmpstr_cells" ], [ 10359, "scols_reset_cell" ], [ 10376, "stderr" ], [ 10390, "vfprintf" ], [ 10399, "scols_column_get_color" ], [ 10422, "scols_column_get_flags" ], [ 10445, "scols_column_get_header" ], [ 10469, "scols_column_get_json_type" ], [ 10496, "scols_column_get_safechars" ], [ 10523, "scols_column_get_table" ], [ 10546, "scols_column_get_whint" ], [ 10569, "scols_column_get_width" ], [ 10592, "scols_column_is_customwrap" ], [ 10619, "scols_column_is_hidden" ], [ 10642, "scols_column_is_noextremes" ], [ 10669, "scols_column_is_right" ], [ 10691, "scols_column_is_strict_width" ], [ 10720, "scols_column_is_tree" ], [ 10741, "scols_column_is_trunc" ], [ 10763, "scols_column_is_wrap" ], [ 10784, "scols_column_set_cmpfunc" ], [ 10809, "scols_column_set_color" ], [ 10832, "scols_column_set_flags" ], [ 10855, "scols_column_set_json_type" ], [ 10882, "scols_column_set_safechars" ], [ 10909, "scols_column_set_whint" ], [ 10932, "scols_column_set_wrapfunc" ], [ 10958, "scols_copy_column" ], [ 10976, "scols_new_column" ], [ 10993, "scols_ref_column" ], [ 11010, "scols_unref_column" ], [ 11029, "scols_wrapnl_chunksize" ], [ 11052, "scols_wrapnl_nextchunk" ], [ 11082, "__errno_location" ], [ 11099, "memmove" ], [ 11107, "memset" ], [ 11114, "realloc" ], [ 11122, "scols_copy_line" ], [ 11138, "scols_line_add_child" ], [ 11159, "scols_line_alloc_cells" ], [ 11182, "scols_line_free_cells" ], [ 11204, "scols_line_get_cell" ], [ 11224, "scols_line_get_color" ], [ 11245, "scols_line_get_column_cell" ], [ 11272, "scols_line_get_ncells" ], [ 11294, "scols_line_get_parent" ], [ 11316, "scols_line_get_userdata" ], [ 11340, "scols_line_has_children" ], [ 11364, "scols_line_is_ancestor" ], [ 11387, "scols_line_next_child" ], [ 11409, "scols_line_refer_column_data" ], [ 11438, "scols_line_refer_data" ], [ 11460, "scols_line_remove_child" ], [ 11484, "scols_line_set_color" ], [ 11505, "scols_line_set_column_data" ], [ 11532, "scols_line_set_data" ], [ 11552, "scols_line_set_userdata" ], [ 11576, "scols_new_line" ], [ 11591, "scols_ref_line" ], [ 11606, "scols_unref_line" ], [ 11623, "nl_langinfo" ], [ 11635, "scols_copy_table" ], [ 11652, "scols_new_table" ], [ 11668, "scols_ref_table" ], [ 11684, "scols_sort_table" ], [ 11701, "scols_sort_table_by_tree" ], [ 11726, "scols_table_add_column" ], [ 11749, "scols_table_add_line" ], [ 11770, "scols_table_colors_wanted" ], [ 11796, "scols_table_enable_ascii" ], [ 11821, "scols_table_enable_colors" ], [ 11847, "scols_table_enable_export" ], [ 11873, "scols_table_enable_header_repeat" ], [ 11906, "scols_table_enable_json" ], [ 11930, "scols_table_enable_maxout" ], [ 11956, "scols_table_enable_noencoding" ], [ 11986, "scols_table_enable_noheadings" ], [ 12016, "scols_table_enable_nolinesep" ], [ 12045, "scols_table_enable_nowrap" ], [ 12071, "scols_table_enable_raw" ], [ 12094, "scols_table_get_column" ], [ 12117, "scols_table_get_column_separator" ], [ 12150, "scols_table_get_line" ], [ 12171, "scols_table_get_line_separator" ], [ 12202, "scols_table_get_name" ], [ 12223, "scols_table_get_ncols" ], [ 12245, "scols_table_get_nlines" ], [ 12268, "scols_table_get_stream" ], [ 12291, "scols_table_get_symbols" ], [ 12315, "scols_table_get_termforce" ], [ 12341, "scols_table_get_termheight" ], [ 12368, "scols_table_get_termwidth" ], [ 12394, "scols_table_get_title" ], [ 12416, "scols_table_is_ascii" ], [ 12437, "scols_table_is_empty" ], [ 12458, "scols_table_is_export" ], [ 12480, "scols_table_is_header_repeat" ], [ 12509, "scols_table_is_json" ], [ 12529, "scols_table_is_maxout" ], [ 12551, "scols_table_is_noencoding" ], [ 12577, "scols_table_is_noheadings" ], [ 12603, "scols_table_is_nolinesep" ], [ 12628, "scols_table_is_nowrap" ], [ 12650, "scols_table_is_raw" ], [ 12669, "scols_table_is_tree" ], [ 12689, "scols_table_move_column" ], [ 12713, "scols_table_new_column" ], [ 12736, "scols_table_new_line" ], [ 12757, "scols_table_next_column" ], [ 12781, "scols_table_next_line" ], [ 12803, "scols_table_reduce_termwidth" ], [ 12832, "scols_table_remove_column" ], [ 12858, "scols_table_remove_columns" ], [ 12885, "scols_table_remove_line" ], [ 12909, "scols_table_remove_lines" ], [ 12934, "scols_table_set_column_separator" ], [ 12967, "scols_table_set_default_symbols" ], [ 12999, "scols_table_set_line_separator" ], [ 13030, "scols_table_set_name" ], [ 13051, "scols_table_set_stream" ], [ 13074, "scols_table_set_symbols" ], [ 13098, "scols_table_set_termforce" ], [ 13124, "scols_table_set_termheight" ], [ 13151, "scols_table_set_termwidth" ], [ 13177, "scols_unref_table" ], [ 13195, "stdout" ], [ 13202, "__ctype_tolower_loc" ], [ 13222, "__ctype_toupper_loc" ], [ 13242, "fclose" ], [ 13255, "fwrite" ], [ 13262, "isatty" ], [ 13269, "malloc" ], [ 13276, "memcpy" ], [ 13283, "open_memstream" ], [ 13298, "scols_print_table" ], [ 13316, "scols_print_table_to_string" ], [ 13344, "scols_table_print_range" ], [ 13368, "scols_table_print_range_to_string" ], [ 13409, "strlen" ], [ 13416, "scols_get_library_version" ], [ 13442, "scols_parse_version_string" ], [ 13469, "getegid" ], [ 13477, "geteuid" ], [ 13485, "getgid" ], [ 13492, "getuid" ], [ 13499, "scols_init_debug" ], [ 13516, "strtoul" ], [ 13524, "__fxstat" ], [ 13533, "dcgettext" ], [ 13543, "ioctl" ], [ 13549, "lseek" ], [ 13555, "read" ], [ 13566, "__xstat" ], [ 13580, "fopen" ], [ 13586, "getcwd" ], [ 13593, "realpath" ], [ 13602, "setegid" ], [ 13610, "seteuid" ], [ 13618, "strncmp" ], [ 13626, "strrchr" ], [ 13640, "secure_getenv" ], [ 13654, "getgrgid" ], [ 13663, "getpwuid" ], [ 13672, "mbstowcs" ], [ 13681, "wcswidth" ], [ 13696, "getdtablesize" ], [ 13716, "mkostemp" ], [ 13731, "access" ], [ 13738, "endmntent" ], [ 13748, "getmntent" ], [ 13758, "hasmntopt" ], [ 13768, "setmntent" ], [ 13778, "strncpy" ], [ 13786, "unlink" ], [ 13793, "memchr" ], [ 13800, "strncasecmp" ], [ 13812, "__ctype_get_mb_cur_max" ], [ 13835, "abort" ], [ 13841, "iswprint" ], [ 13850, "mbrtowc" ], [ 13858, "wcstombs" ], [ 13867, "wcwidth" ], [ 13875, "wctomb" ], [ 13887, "execvp" ], [ 13894, "faccessat" ], [ 13904, "fflush" ], [ 13916, "pipe" ], [ 13921, "raise" ], [ 13927, "select" ], [ 13934, "sigaction" ], [ 13944, "strerror" ], [ 13953, "strtok" ], [ 13960, "waitpid" ], [ 13973, "gettimeofday" ], [ 13986, "localtime" ], [ 13996, "mktime" ], [ 14003, "unsetenv" ], [ 14012, "getlogin" ], [ 14021, "getpwnam_r" ], [ 14032, "__tls_get_addr" ], [ 14047, "getppid" ], [ 14055, "jrand48" ], [ 14063, "nanosleep" ], [ 14073, "srandom" ], [ 14081, "syscall" ], [ 14089, "__strndup" ], [ 14099, "__strtol_internal" ], [ 14117, "__strtoul_internal" ], [ 14147, "localeconv" ], [ 14158, "strcspn" ], [ 14173, "strtod" ], [ 14180, "strtol" ], [ 14187, "vasprintf" ], [ 14197, "gmtime_r" ], [ 14206, "localtime_r" ], [ 14218, "strftime" ], [ 14227, "strptime" ], [ 14236, "strtoll" ], [ 14244, "ttyname" ], [ 14252, "__xpg_basename" ], [ 14267, "execl" ] ], "sz": 242872, "ts": [ { "c": 1.0, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "l": 2 }, { "c": 1.0, "d": "Binary has 20+ exports", "e": [ "binary.export_count = 316.00" ], "i": "metadata/binary/metrics/threshold::many-exports-20", "l": 1 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 171.00" ], "i": "metadata/binary/metrics/threshold::many-imports-20", "l": 1 }, { "a": "T1055", "c": 0.25, "d": "Repeated 0x07 code constant (possible PROT_RWX)", "e": [ "07 00 00 00" ], "i": "micro-behaviors/mem/protect/modify::rwx-prot-bytes", "l": 1 }, { "c": 1.0, "d": "ELF64 class marker", "e": [ "elf.class_bits = 64.00" ], "i": "metadata/binary/metrics/structural::elf64-class", "l": 1 }, { "d": "TMPDIR environment variable", "e": [ "TMPDIR" ], "i": "micro-behaviors/os/env/vars/access::tmpdir-var", "l": 2 }, { "c": 0.6600000262260437, "d": "Read mount table entry", "e": [ "getmntent" ], "i": "micro-behaviors/fs/volume/fstab::getmntent", "l": 2 }, { "c": 1.0, "d": "Binary has 100+ exports", "e": [ "binary.export_count = 316.00" ], "i": "metadata/binary/metrics/threshold::many-exports-100", "l": 1 }, { "c": 0.6600000262260437, "d": "Uses opendir", "e": [ "opendir" ], "i": "micro-behaviors/fs/directory/readdir::readdir-opendir", "l": 2 }, { "c": 0.8999999761581421, "d": "Large ELF with low overall entropy", "e": [ "binary.overall_entropy = 3.05" ], "i": "metadata/binary/metrics/structural::low-overall-entropy-large-elf", "l": 2 }, { "c": 0.8999999761581421, "d": "Abort program execution", "e": [ "abort" ], "i": "micro-behaviors/os/signal/handler::abort", "l": 2 }, { "c": 0.20000000298023224, "d": "localtime function (string)", "e": [ "localtime_r@@GLIBC_2.2.5", "localtime", "localtime@@GLIBC_2.2.5", "localtime_r" ], "i": "micro-behaviors/time/query::localtime-string", "l": 2 }, { "d": "Characteristic system library export __cxa_finalize", "e": [ "cxa_finalize" ], "i": "micro-behaviors/dylib/library/libc::libc-characteristic-cxa-finalize", "l": 2 }, { "c": 0.699999988079071, "d": "Detects loop/jump control transfer in assembly", "e": [ "loop scan" ], "i": "micro-behaviors/crypto/symmetric/xor/loop::asm-loop-control-transfer", "l": 2 }, { "c": 0.9399999976158142, "d": "Regex component marker", "e": [ ".so" ], "i": "objectives/evasion/kernel-hide/userspace::runtime-shared-object-compile--rx-1", "l": 1 }, { "c": 0.699999988079071, "d": "/dev/random access", "e": [ "/dev/random" ], "i": "micro-behaviors/os/random/crypto::dev-random", "l": 2 }, { "c": 0.6600000262260437, "d": "Parse active mounts from /proc/mounts", "e": [ "/proc/mounts" ], "i": "micro-behaviors/fs/proc/mounts::mounts", "l": 3 }, { "d": "Detect if running in terminal (isatty)", "e": [ "isatty@@GLIBC_2.2.5", "isatty", "sym.imp.isatty" ], "i": "micro-behaviors/process/tty/terminal::isatty", "l": 2 }, { "c": 1.0, "d": "Binary has 200+ exports (large library)", "e": [ "binary.export_count = 316.00" ], "i": "metadata/binary/metrics/threshold::many-exports-200", "l": 1 }, { "c": 0.6600000262260437, "d": "Process forking", "e": [ "fork" ], "i": "micro-behaviors/process/fork/clone::fork", "l": 2 }, { "d": "X11 libSM reference", "e": [ "LIBSM", "libsm" ], "i": "micro-behaviors/dylib/library/family::x11-libsm-ref", "l": 2 }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.func_count = 680.00" ], "i": "metadata/binary/metrics/structural::many-functions", "l": 2 }, { "d": "Characteristic system library export __cxa_atexit", "e": [ "cxa_atexit" ], "i": "micro-behaviors/dylib/library/libc::libc-characteristic-cxa-atexit", "l": 2 }, { "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "ul_prefix_fopen", "fopen", "ul_path_fopenf", "fopen@@GLIBC_2.2.5", "ul_path_fopen", "ul_path_vfopenf" ], "i": "objectives/evasion/kernel-hide/userspace::preload-rootkit-hook-set--rx-8", "l": 1 }, { "a": "T1110.001", "c": 0.8500000238418579, "d": "Service account ubuntu", "e": [ "ubuntu" ], "i": "objectives/lateral-movement/brute-force/password::service-account-ubuntu", "l": 1, "m": "E1110" }, { "c": 0.800000011920929, "d": "Compiler/project context token", "e": [ "clang version" ], "i": "micro-behaviors/dylib/library/family::llvm-project-ref-b", "l": 2 }, { "c": 0.6000000238418579, "d": "X11 Session Management library", "e": [ "libsm", "LIBSM" ], "i": "micro-behaviors/dylib/library/family::x11-sm-ref", "l": 2 }, { "a": "T1033", "d": "Get login name", "e": [ "getlogin", "sym.xgetlogin", "sym.imp.getlogin", "getlogin@@GLIBC_2.2.5" ], "i": "micro-behaviors/process/user/query::getlogin", "l": 3, "m": "E1033" }, { "a": "T1082", "d": "/sys/block/ path", "e": [ "%s/sys/block/%s/dev", "%s/sys/block/%s/device/dev", "%s/sys/block/%s/dm/name", "%s/sys/block/%s/%s/dev" ], "i": "micro-behaviors/fs/disk/paths::sys-block", "l": 2, "m": "E1082" }, { "c": 0.699999988079071, "d": "Read file descriptor (read/pread)", "e": [ "read" ], "i": "micro-behaviors/fs/file/read::read", "l": 2 }, { "c": 0.20000000298023224, "d": "Convert time to UTC time", "e": [ "gmtime_r", "gmtime_r@@GLIBC_2.2.5", "sym.imp.gmtime_r" ], "i": "micro-behaviors/time/query::gmtime", "l": 2 }, { "c": 0.800000011920929, "d": "Resolve GID to group name (getgrgid)", "e": [ "getgrgid" ], "i": "micro-behaviors/os/group/lookup::getgrgid", "l": 3 }, { "c": 0.6600000262260437, "d": "Check if file exists", "e": [ "faccessat", "access" ], "i": "micro-behaviors/fs/file/stat::stat-exists", "l": 2 }, { "d": "select() I/O multiplexing", "e": [ "select" ], "i": "micro-behaviors/communications/socket/multiplex::select-multiplex", "l": 3 }, { "a": "T1082", "c": 0.75, "d": "Access block device info via", "e": [ "/sys/dev/block/", "/sys/dev/block/%d:%d" ], "i": "micro-behaviors/hardware/block/device::sys-block-dup", "l": 3 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 171.00" ], "i": "metadata/binary/metrics/threshold::many-imports-25", "l": 1 }, { "c": 0.8999999761581421, "d": "Install signal handler (POSIX sigaction)", "e": [ "sigaction" ], "i": "micro-behaviors/os/signal/handler::sigaction", "l": 2 }, { "c": 0.949999988079071, "d": "ELF declares DT_RELACOUNT (relative relocations)", "e": [ "elf.relacount = 298.00" ], "i": "metadata/binary/anomaly/format::elf-relacount-present", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 171.00" ], "i": "metadata/binary/metrics/threshold::many-imports-50", "l": 1 }, { "c": 0.20000000298023224, "d": "Parse time string into time", "e": [ "strptime@@GLIBC_2.2.5", "sym.imp.strptime", "strptime" ], "i": "micro-behaviors/time/query::strptime", "l": 2 }, { "c": 0.6600000262260437, "d": "Access virtual block devices (loopback)", "e": [ "/dev/loop" ], "i": "micro-behaviors/fs/device/loopback::loopback", "l": 3 }, { "c": 1.0, "d": "Imports __tls_get_addr from the dynamic loader", "e": [ "tls_get_addr" ], "i": "metadata/binary/linking/runtime::imports-tls-get-addr", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "x86__64__lsb__unix-system-v__clang-4.0.0__O3__no-obf__unstripped__util-linux-2.33__libsmartcols.so.1.1.0" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.8999999761581421, "d": "ELF dynsym section name", "e": [ ".dynsym" ], "i": "metadata/binary/linking/static::elf-dynsym-section-name", "l": 2 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 6.69" ], "i": "metadata/binary/metrics/threshold::avg-complexity-15-max", "l": 2 }, { "c": 0.20000000298023224, "d": "Format time as string", "e": [ "sym.imp.strftime", "strftime", "strftime@@GLIBC_2.2.5" ], "i": "micro-behaviors/time/query::strftime", "l": 2 }, { "c": 0.699999988079071, "d": "ELF built with only partial RELRO", "e": [ "partial" ], "i": "metadata/binary/anomaly/provenance::partial-relro", "l": 1 }, { "d": "Get user ID", "e": [ "getuid" ], "i": "micro-behaviors/os/privilege/query::getuid", "l": 2 }, { "c": 0.4000000059604645, "d": "unsetenv function (remove environment variable)", "e": [ "sym.imp.unsetenv", "unsetenv" ], "i": "micro-behaviors/os/env/vars/access::unsetenv", "l": 2 }, { "c": 1.0, "d": "Line-based file reading (fgets)", "e": [ "fgets" ], "i": "micro-behaviors/process/create/direct::fgets-loop", "l": 2 }, { "c": 0.30000001192092896, "d": "Get process ID", "e": [ "getpid" ], "i": "micro-behaviors/process/identity/query::getpid", "l": 2 }, { "d": "Get effective user ID", "e": [ "geteuid" ], "i": "micro-behaviors/os/privilege/query::geteuid", "l": 2 }, { "c": 0.6600000262260437, "d": "Resolve symbolic links to canonical", "e": [ "realpath", "realpath@@GLIBC_2.3", "sym.imp.realpath" ], "i": "micro-behaviors/fs/link/symlink::symlink-resolve", "l": 2 }, { "c": 0.800000011920929, "d": "Drop privileges (setuid after getuid)", "e": [ "setegid", "seteuid" ], "i": "micro-behaviors/process/identity/setuid::drop-privs", "l": 2 }, { "c": 0.6600000262260437, "d": "Reference to /etc configuration files", "e": [ "/etc/mtab" ], "i": "micro-behaviors/fs/path/config/system::config-etc", "l": 2 }, { "a": "T1083", "c": 0.4000000059604645, "d": "File descriptor manipulation and control", "e": [ "fcntl" ], "i": "micro-behaviors/fs/file/handle::fcntl", "l": 2, "m": "E1083" }, { "c": 0.30000001192092896, "d": "Get process ID", "e": [ "getppid" ], "i": "micro-behaviors/process/identity/query::getppid", "l": 2 }, { "c": 0.20000000298023224, "d": "output keyword", "e": [ "non-terminal output", "output buffer utils" ], "i": "micro-behaviors/data/text/keywords/lexicon::output", "l": 1 }, { "d": "TERM environment variable", "e": [ "TERM" ], "i": "micro-behaviors/os/env/vars/system-info::term-var", "l": 2 }, { "c": 0.8399999737739563, "d": "High basic block count in sparse binary", "e": [ "binary.total_basic_blocks = 6577.00" ], "i": "metadata/binary/metrics/structural::dense-basic-blocks", "l": 1 }, { "c": 0.800000011920929, "d": "Invokes mkdir", "e": [ "mkdir" ], "i": "micro-behaviors/process/create/tool::mkdir-invocation", "l": 1 }, { "c": 0.6600000262260437, "d": "Uses readdir", "e": [ "readdir" ], "i": "micro-behaviors/fs/directory/readdir::readdir-readdir", "l": 2 }, { "c": 0.800000011920929, "d": "Read symbolic link target path", "e": [ "readlinkat" ], "i": "micro-behaviors/fs/link/symlink::readlinkat", "l": 2 }, { "c": 0.699999988079071, "d": "ELF built without stack canary", "e": [ "elf.stack_canary = 0.00" ], "i": "metadata/binary/anomaly/provenance::no-stack-canary", "l": 1 }, { "c": 0.75, "d": "String to long integer conversion (strtol)", "e": [ "strtol" ], "i": "micro-behaviors/data/string/conversion::strtol", "l": 1 }, { "c": 0.30000001192092896, "d": "Sleep for nanosecond duration", "e": [ "nanosleep" ], "i": "micro-behaviors/time/query::nanosleep-func", "l": 2 }, { "c": 0.20000000298023224, "d": "pipe keyword", "e": [ "pipe" ], "i": "micro-behaviors/data/text/keywords/lexicon::pipe", "l": 1 }, { "d": "Duplicate file descriptor", "e": [ "dup" ], "i": "micro-behaviors/process/fd/dup::dup", "l": 2 }, { "d": "Characteristic system library export __assert_fail", "e": [ "assert_fail" ], "i": "micro-behaviors/dylib/library/libc::libc-characteristic-assert-fail", "l": 2 }, { "c": 0.6600000262260437, "d": "Uses closedir", "e": [ "closedir" ], "i": "micro-behaviors/fs/directory/readdir::readdir-closedir", "l": 2 }, { "a": "T1124", "c": 0.30000001192092896, "d": "Get current calendar time (seconds)", "e": [ "time" ], "i": "micro-behaviors/time/query::time", "l": 2, "m": "T1124" }, { "c": 1.0, "d": "ELF needed library metadata", "e": [ "[libc.so.6, ld-linux-x86-64.so.2]" ], "i": "metadata/binary/linking/runtime::needed-lib", "l": 2 }, { "a": "T1005", "c": 0.75, "d": "Regex component marker", "e": [ "binary.import_count = 171.00" ], "i": "micro-behaviors/fs/file/binary::file-manipulation-cond-0--inline-18739", "l": 1 }, { "d": "Get terminal name (ttyname)", "e": [ "ttyname", "ttyname@@GLIBC_2.2.5", "sym.imp.ttyname" ], "i": "micro-behaviors/process/tty/terminal::ttyname", "l": 2 }, { "c": 1.0, "d": "Binary has 9+ exports", "e": [ "binary.export_count = 316.00" ], "i": "metadata/binary/metrics/threshold::many-exports-9", "l": 1 }, { "c": 0.699999988079071, "d": "Formatted input from file", "e": [ "fscanf", "vfscanf" ], "i": "micro-behaviors/fs/file/read::fscanf", "l": 2 }, { "d": "Get group ID", "e": [ "getgid" ], "i": "micro-behaviors/os/privilege/query::getgid", "l": 2 }, { "a": "T1036.005", "c": 0.8999999761581421, "d": "prctl system call symbol", "e": [ "prctl" ], "i": "objectives/evasion/masquerade/identity/daemon::prctl-symbol", "l": 3, "m": "F0004" }, { "c": 1.0, "d": "Binary has 20+ sections (installer/packer)", "e": [ "binary.section_count = 30.00" ], "i": "metadata/binary/metrics/threshold::many-sections-20", "l": 1 }, { "c": 0.6600000262260437, "d": "Wait for child process state", "e": [ "waitpid" ], "i": "micro-behaviors/process/control/wait::waitpid", "l": 2 }, { "c": 0.6600000262260437, "d": "Open files", "e": [ "fopen" ], "i": "micro-behaviors/fs/file/open::fopen", "l": 2 }, { "c": 0.6600000262260437, "d": "Create directories", "e": [ "mkdir" ], "i": "micro-behaviors/fs/directory/mkdir::mkdir-base", "l": 2 }, { "c": 0.8999999761581421, "d": "SOCKS5 client greeting bytes", "e": [ "05 01 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-version-greeting-bytes", "l": 1 }, { "c": 1.0, "d": "Shared library binds dynamic loader", "e": [ "elf.has_direct_loader_dep = 1.00" ], "i": "metadata/binary/linking/runtime::library-loader-dep", "l": 3 }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.func_count = 680.00" ], "i": "metadata/binary/metrics/threshold::many-functions-50", "l": 1 }, { "d": "PATH environment variable", "e": [ "PATH" ], "i": "micro-behaviors/os/env/vars/access::path-var", "l": 2 }, { "c": 0.800000011920929, "d": "C-style exec family functions", "e": [ "execvp", "execl" ], "i": "micro-behaviors/process/create/execv::c-exec-variants", "l": 3 }, { "c": 1.0, "d": "scanner word", "e": [ "scanner" ], "i": "objectives/impact/infect/lexicon::scanner-word", "l": 1 }, { "c": 0.8999999761581421, "d": "ELF dynstr section name", "e": [ ".dynstr" ], "i": "metadata/binary/linking/static::elf-dynstr-section-name", "l": 2 }, { "c": 0.6600000262260437, "d": "Open files", "e": [ "open" ], "i": "micro-behaviors/fs/file/open::open-base", "l": 2 }, { "a": "T1082", "c": 0.6000000238418579, "d": "Query system name and information", "e": [ "uname" ], "i": "micro-behaviors/os/sysinfo/platform/kernel::uname", "l": 3, "m": "E1082" }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.func_count = 680.00" ], "i": "metadata/binary/metrics/threshold::few-functions-3", "l": 1 }, { "c": 1.0, "d": "Binary has 1000 or more strings", "e": [ "binary.string_count = 1368.00" ], "i": "metadata/binary/metrics/threshold::string-count-1000-plus", "l": 2 }, { "d": "poll() I/O multiplexing", "e": [ "poll" ], "i": "micro-behaviors/communications/socket/multiplex::poll-multiplex", "l": 3 }, { "c": 0.800000011920929, "d": "getrandom syscall", "e": [ "getrandom() function" ], "i": "micro-behaviors/os/random/crypto::getrandom", "l": 2 }, { "d": "overflow keyword", "e": [ "format_iso_time: buffer overflow." ], "i": "micro-behaviors/data/text/keywords/lexicon::overflow", "l": 1 }, { "c": 0.6600000262260437, "d": "Open mount table for parsing", "e": [ "setmntent" ], "i": "micro-behaviors/fs/volume/fstab::setmntent", "l": 2 }, { "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "faccessat", "access@@GLIBC_2.2.5", "ul_path_access", "ul_path_accessf", "access: '%s'", "access", "faccessat@@GLIBC_2.4" ], "i": "objectives/evasion/kernel-hide/userspace::preload-rootkit-hook-set--rx-5", "l": 1 }, { "c": 0.20000000298023224, "d": "command keyword", "e": [ "proc_get_command", "proc_get_command_name", "plymouth_command" ], "i": "micro-behaviors/data/text/keywords/lexicon::command-dup", "l": 1 }, { "c": 0.699999988079071, "d": "ELF .note.GNU-stack section absent", "e": [ "elf.gnu_stack_section_absent = 1.00" ], "i": "metadata/binary/anomaly/format::elf-gnu-stack-section-absent", "l": 2 }, { "d": "SHELL environment variable", "e": [ "SHELL" ], "i": "micro-behaviors/os/env/vars/system-info::shell-var", "l": 2 }, { "a": "T1124", "c": 0.30000001192092896, "d": "Get current time with microsecond precision", "e": [ "gettimeofday" ], "i": "micro-behaviors/time/query::gettimeofday", "l": 2, "m": "T1124" }, { "c": 0.699999988079071, "d": "Uses device mapper framework", "e": [ "/dev/mapper/%s" ], "i": "micro-behaviors/hardware/block/device::dev-mapper", "l": 3 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 171.00" ], "i": "metadata/binary/metrics/threshold::many-imports-30", "l": 1 }, { "c": 0.800000011920929, "d": "libc version string pattern", "e": [ "GLIBC" ], "i": "micro-behaviors/dylib/library/libc::libc-version-string", "l": 2 }, { "c": 0.20000000298023224, "d": "localtime function (symbol)", "e": [ "localtime", "localtime_r", "sym.imp.localtime", "sym.imp.localtime_r", "localtime@@GLIBC_2.2.5", "localtime_r@@GLIBC_2.2.5" ], "i": "micro-behaviors/time/query::localtime-symbol", "l": 2 }, { "c": 0.800000011920929, "d": "Binary has many exports (\u003e10)", "e": [ "binary.export_count = 316.00" ], "i": "metadata/binary/metrics/structural::many-exports", "l": 2 }, { "c": 0.8999999761581421, "d": "ELF dynamic section name", "e": [ ".dynamic" ], "i": "metadata/binary/linking/static::elf-dynamic-section-name", "l": 2 }, { "c": 0.4000000059604645, "d": "setenv function (set environment variable)", "e": [ "setenv", "sym.imp.setenv" ], "i": "micro-behaviors/os/env/vars/access::setenv", "l": 2 }, { "d": "Binary exports symbols", "e": [ "binary.export_count = 316.00" ], "i": "metadata/binary/symbols/exports::has-exports", "l": 1 }, { "c": 0.6000000238418579, "d": "ELF stripped with .symtab present", "e": [ "elf.stripped_but_symtab_present = 1.00" ], "i": "metadata/build/artifact::elf-stripped-but-symtab-present", "l": 3 }, { "d": "Get effective group ID", "e": [ "getegid" ], "i": "micro-behaviors/os/privilege/query::getegid", "l": 2 }, { "c": 1.0, "d": "Binary format is identified", "e": [ "elf.class_bits = 64.00" ], "i": "metadata/binary/layout::binary-format-checked", "l": 2 }, { "c": 0.6600000262260437, "d": "Uses rewinddir", "e": [ "rewinddir" ], "i": "micro-behaviors/fs/directory/readdir::readdir-rewinddir", "l": 2 }, { "c": 0.800000011920929, "d": "High number of imported symbols (\u003e80)", "e": [ "binary.import_count = 171.00" ], "i": "metadata/binary/metrics/structural::many-imports", "l": 2 }, { "c": 0.6000000238418579, "d": "/etc/mtab mount table file", "e": [ "/etc/mtab" ], "i": "micro-behaviors/fs/volume/fstab::etc-mtab", "l": 2 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 171.00" ], "i": "metadata/binary/metrics/threshold::many-imports-40", "l": 1 }, { "c": 0.6600000262260437, "d": "Uses fdopendir", "e": [ "fdopendir" ], "i": "micro-behaviors/fs/directory/readdir::readdir-fdopendir", "l": 2 }, { "c": 0.6600000262260437, "d": "Parse mount table entries via", "e": [ "endmntent" ], "i": "micro-behaviors/fs/volume/fstab::endmntent", "l": 2 }, { "c": 0.4000000059604645, "d": "Set file creation mask (umask)", "e": [ "umask" ], "i": "micro-behaviors/fs/chmod/modify::umask", "l": 3 }, { "c": 0.6600000262260437, "d": "Write single bytes to file", "e": [ "fputc" ], "i": "micro-behaviors/fs/file/write/direct::fputc", "l": 2 }, { "c": 1.0, "d": "Binary has 100+ imports", "e": [ "binary.import_count = 171.00" ], "i": "metadata/binary/metrics/threshold::many-imports-100", "l": 1 }, { "c": 0.6600000262260437, "d": "Write files", "e": [ "write", "fwrite" ], "i": "micro-behaviors/fs/file/write/direct::write", "l": 2 }, { "c": 0.8999999761581421, "d": "Large ELF with 500+ strings", "e": [ "binary.string_count = 1368.00" ], "i": "metadata/binary/metrics/structural::many-strings-large-elf", "l": 2 }, { "c": 1.0, "d": "ELF SONAME metadata", "e": [ "libsmartcols.so.1" ], "i": "metadata/binary/linking/runtime::soname", "l": 2 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.21" ], "i": "metadata/binary/metrics/threshold::avg-string-entropy-4-max", "l": 2 }, { "d": "Characteristic system library export __errno_location", "e": [ "errno_location" ], "i": "micro-behaviors/dylib/library/libc::libc-characteristic-errno", "l": 2 }, { "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "binary.export_count = 316.00" ], "i": "objectives/evasion/process/injection/memory::asm-manual-import-parsing-cond-2--inline-18287", "l": 1 }, { "c": 0.6600000262260437, "d": "Open files", "e": [ "openat" ], "i": "micro-behaviors/fs/file/open::openat", "l": 2 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 3.05" ], "i": "metadata/binary/metrics/threshold::low-overall-entropy-binary", "l": 1 }, { "c": 1.0, "d": "Access /dev/urandom", "e": [ "/dev/urandom" ], "i": "micro-behaviors/os/random/crypto::urandom", "l": 2 }, { "d": "Duplicate file descriptor (I/O redirection)", "e": [ "dup2" ], "i": "micro-behaviors/process/fd/dup::dup2", "l": 2 }, { "c": 0.6600000262260437, "d": "Set socket options", "e": [ "sym.imp.setsockopt", "setsockopt@@GLIBC_2.2.5", "setsockopt" ], "i": "micro-behaviors/communications/socket/options::options-set", "l": 3 }, { "c": 0.8500000238418579, "d": "Send signal to self", "e": [ "raise" ], "i": "micro-behaviors/os/signal/handler::raise", "l": 2 }, { "c": 0.4000000059604645, "d": "SIGHUP signal ignore pattern (x86_64)", "e": [ "BF 01 00 00 00 BE 01 00 00 00" ], "i": "objectives/persistence/system/daemon/init::sig-ign-sighup-x64", "l": 1 }, { "c": 0.8999999761581421, "d": "ELF dynstr section name", "e": [ ".dynstr" ], "i": "metadata/hardening/missing::elf-dynstr-section-name", "l": 2 }, { "c": 0.8999999761581421, "d": "Binary has many functions", "e": [ "binary.func_count = 680.00" ], "i": "objectives/anti-static/pack/entropy::large-function-surface", "l": 1 }, { "a": "T1071", "c": 0.6600000262260437, "d": "Uses connect socket call", "e": [ "connect" ], "i": "micro-behaviors/communications/socket/connect::connect-symbol", "l": 3, "m": "C0001" }, { "c": 0.6000000238418579, "d": "Set group ID (capability)", "e": [ "setegid" ], "i": "micro-behaviors/process/identity/setuid::setgid", "l": 3 }, { "c": 0.8999999761581421, "d": "ELF dynamic section name", "e": [ ".dynamic" ], "i": "metadata/hardening/missing::elf-dynamic-section-name", "l": 2 }, { "c": 0.8999999761581421, "d": "ELF dynsym section name", "e": [ ".dynsym" ], "i": "metadata/hardening/missing::elf-dynsym-section-name", "l": 2 }, { "a": "T1071", "c": 0.6600000262260437, "d": "Uses _connect socket call", "e": [ "connect" ], "i": "micro-behaviors/communications/socket/connect::_connect-symbol", "l": 3, "m": "C0001" }, { "c": 0.4000000059604645, "d": "socket function symbol", "e": [ "socket" ], "i": "micro-behaviors/communications/socket/listen::socket-sym", "l": 3, "m": "C0001" }, { "c": 0.30000001192092896, "d": "Delete files", "e": [ "unlink" ], "i": "micro-behaviors/fs/file/delete::unlink", "l": 3 }, { "c": 0.699999988079071, "d": "High function count over 200", "e": [ "binary.func_count = 680.00" ], "i": "metadata/binary/metrics/threshold::high-function-count-200", "l": 2 }, { "a": "T1059.004", "c": 0.6499999761581421, "d": "References /bin/sh in binary", "e": [ "/bin/sh" ], "i": "micro-behaviors/process/create/shell/encoded::bin-sh-binary-text", "l": 3, "m": "E1059.004" }, { "c": 0.30000001192092896, "d": "getenv function (read environment variable)", "e": [ "getenv", "sym.imp.getenv" ], "i": "micro-behaviors/os/env/vars/access::getenv", "l": 2 }, { "c": 0.6000000238418579, "d": "Set user ID (capability)", "e": [ "seteuid" ], "i": "micro-behaviors/process/identity/setuid::setuid-dup", "l": 3 }, { "a": "T1033", "d": "Get password file entry by UID", "e": [ "getpwuid@@GLIBC_2.2.5", "getpwuid", "sym.imp.getpwuid" ], "i": "micro-behaviors/process/user/query::getpwuid", "l": 3, "m": "E1033" }, { "c": 0.699999988079071, "d": "High string count over 1000", "e": [ "binary.string_count = 1368.00" ], "i": "metadata/binary/metrics/threshold::high-string-count-1000", "l": 2 }, { "c": 0.8999999761581421, "d": "No stack canary (stack smashing protection absent)", "e": [ "elf.stack_canary = 0.00" ], "i": "metadata/hardening/mitigation::no-stack-canary", "l": 3 }, { "a": "T1083", "c": 0.6600000262260437, "d": "Read temp directory from TMPDIR", "e": [ "getenv", "TMPDIR", "sym.imp.getenv" ], "i": "micro-behaviors/fs/temp/directory::directory-env", "l": 2, "m": "E1083" }, { "a": "T1059.004", "c": 0.8500000238418579, "d": "POSIX shell with socket fd redirection", "e": [ "execvp", "execl", "connect", "/bin/sh", "dup2" ], "i": "objectives/command-and-control/reverse-shell/socket::posix-fd-redirect-shell", "l": 3, "m": "B0022" }, { "c": 0.8999999761581421, "d": "Large export PE with low overall entropy", "e": [ "binary.func_count = 680.00", "binary.overall_entropy = 3.05" ], "i": "objectives/anti-static/pack/entropy::high-entropy-data-pe-lib-context", "l": 1 }, { "a": "T1543", "c": 0.30000001192092896, "d": "Signal handler setup for daemon persistence", "e": [ "sigaction", "BF 01 00 00 00 BE 01 00 00 00" ], "i": "objectives/persistence/system/daemon/init::signal-ignore-pattern", "l": 3 }, { "a": "T1574.007", "c": 0.8999999761581421, "d": "Modifies PATH environment variable (broad capability)", "e": [ "PATH", "sym.imp.setenv", "setenv" ], "i": "objectives/evasion/hijack-execution-flow/env/path::path-modification", "l": 3 }, { "a": "T1497.003", "d": "Timing measurement with delay APIs", "e": [ "gettimeofday", "nanosleep" ], "i": "objectives/anti-analysis/timing/evasion::timing-evasion", "l": 3, "m": "B0003.005" } ], "sha": "efbc189bff48a7901cfade28ec001337ea3e6cc387ca0836eaa622fdeeab23b7", "path": "/data/samples/good/datasets/Labeled-Elfs/benignware/x86__64__lsb__unix-system-v__clang-4.0.0__O3__no-obf__unstripped__util-linux-2.33__libsmartcols.so.1.1.0", "type": "elf" } ], "tv": "6f60c" } }