{
  "ml": {
    "v": "5",
    "fs": [
      {
        "id": 0,
        "prob": 0.8251519203186035,
        "class": 0,
        "threshold": 0.9987763166427612
      }
    ],
    "prob": 0.8251519,
    "class": 0,
    "level": 3,
    "models": [
      {
        "m": "az",
        "prob": 0.8251519,
        "class": 0
      },
      {
        "m": "az/native",
        "prob": 0.31724137,
        "class": 0
      },
      {
        "m": "az/elf",
        "prob": 0.027139874,
        "class": 0
      }
    ],
    "version": "v17.17",
    "threshold": 0.9987763,
    "analyzed_at": "2026-05-31T12:43:05Z"
  },
  "path": "f3dda37a24cab0e83b4f5a5a5e1b466cab8c1613821526a611c75f9a36035c60.elf",
  "raw": {
    "v": "5",
    "fs": [
      {
        "f": "H₂(Cm₃F)",
        "x": 7,
        "ff": {
          "i": [
            [
              "",
              "errno_location"
            ],
            [
              "",
              "getnameinfo"
            ],
            [
              "",
              "getaddrinfo"
            ],
            [
              "",
              "free"
            ],
            [
              "",
              "freeaddrinfo"
            ],
            [
              "",
              "gai_strerror"
            ],
            [
              "",
              "stderr"
            ],
            [
              "",
              "fwrite"
            ],
            [
              "",
              "vfprintf_chk"
            ],
            [
              "",
              "fputc"
            ],
            [
              "",
              "abort"
            ],
            [
              "",
              "pthread_mutex_lock"
            ],
            [
              "",
              "pthread_cond_wait"
            ],
            [
              "",
              "pthread_mutex_unlock"
            ],
            [
              "",
              "pthread_cond_broadcast"
            ],
            [
              "",
              "pthread_create"
            ],
            [
              "",
              "nanosleep"
            ],
            [
              "",
              "stack_chk_fail"
            ],
            [
              "",
              "strerror"
            ],
            [
              "",
              "fprintf_chk"
            ],
            [
              "",
              "malloc"
            ],
            [
              "",
              "pthread_attr_init"
            ],
            [
              "",
              "pthread_attr_getstacksize"
            ],
            [
              "",
              "pthread_attr_destroy"
            ],
            [
              "",
              "sigfillset"
            ],
            [
              "",
              "pthread_sigmask"
            ],
            [
              "",
              "mmap"
            ],
            [
              "",
              "setenv"
            ],
            [
              "",
              "unsetenv"
            ]
          ],
          "m": {
            "elf": {
              "bits": 64.0,
              "entry": 4584896.0,
              "has_got": 1.0,
              "has_plt": 1.0,
              "has_note": 1.0,
              "has_symtab": 1.0,
              "note_count": 1.0,
              "nx_enabled": 1.0,
              "dynrel_count": 0.0,
              "dynsym_count": 33.0,
              "has_eh_frame": 0.0,
              "stack_canary": 1.0,
              "symtab_count": 4710.0,
              "dynrela_count": 1.0,
              "little_endian": 1.0,
              "dwarf.cu_count": 1.0,
              "pltreloc_count": 28.0,
              "dt_versym_count": 33.0,
              "executable_stack": 0.0,
              "wx_segment_count": 0.0,
              "debug_section_count": 8.0,
              "hidden_symbol_count": 10.0,
              "fortify_source_count": 2.0,
              "program_header_count": 10.0,
              "gnu_stack_section_absent": 0.0,
              "load_segment_max_file_size": 1281912.0,
              "stripped_but_symtab_present": 1.0,
              "load_segment_max_memory_size": 1281912.0,
              "section_relocation_group_count": 2.0,
              "stripped_metadata_section_count": 3.0
            },
            "file": {
              "size": 3619456.0,
              "entropy": 5.57,
              "size_bytes": 3619456.0
            },
            "binary": {
              "is_pie": 0.0,
              "is_stripped": 0.0,
              "code_entropy": 5.82,
              "data_entropy": 4.52,
              "string_count": 14328.0,
              "entropy_variance": 2.76,
              "avg_string_length": 17.28,
              "max_string_length": 728.0,
              "code_to_data_ratio": 0.93,
              "string_length_stddev": 16.93,
              "largest_section_ratio": 0.31,
              "sentence_string_count": 1461.0,
              "sentence_string_ratio": 0.1,
              "high_entropy_string_count": 0.0
            },
            "exports": {
              "count": 3.0
            },
            "imports": {
              "count": 29.0
            },
            "sections": {
              "count": 35.0,
              "code_size": 1127550.0,
              "entropy_max": 5.82,
              "entropy_mean": 3.44,
              "name_entropy": 4.21,
              "writable_count": 8.0,
              "executable_count": 2.0,
              "nonstandard_count": 17.0,
              "executable_writable_count": 0.0
            },
            "dependencies": {
              "count": 2.0
            }
          },
          "s": [
            [
              4028,
              "u8",
              "28f98d72f0d066fd37e318476a18e186e714564d/lib64/ld-linux-x86-64.so.2"
            ],
            [
              25595,
              "u8",
              "ZXH9"
            ],
            [
              27406,
              "u8",
              "YXH9"
            ],
            [
              81943,
              "u8",
              "hhhhhhhhH9"
            ],
            [
              84143,
              "u8",
              "XXH9"
            ],
            [
              86102,
              "u8",
              "ZXL9"
            ],
            [
              88194,
              "u8",
              "D$(H)"
            ],
            [
              95111,
              "u8",
              "CslHk"
            ],
            [
              95899,
              "u8",
              "\\$(H)"
            ],
            [
              101170,
              "u8",
              "gfffffffH"
            ],
            [
              137965,
              "u8",
              "CsqHk"
            ],
            [
              151051,
              "u8",
              "X H9"
            ],
            [
              261129,
              "u8",
              "l$(H)"
            ],
            [
              264189,
              "u8",
              "AsEHk"
            ],
            [
              272554,
              "u8",
              "AsXHk"
            ],
            [
              301224,
              "u8",
              "XPH9"
            ],
            [
              304810,
              "u8",
              "$Hci H"
            ],
            [
              354456,
              "u8",
              "K8H9"
            ],
            [
              359867,
              "u8",
              "u}z{"
            ],
            [
              376194,
              "u8",
              "Genuu"
            ],
            [
              376202,
              "u8",
              "ineIu"
            ],
            [
              376210,
              "u8",
              "ntelu"
            ],
            [
              376868,
              "u8",
              "SPH9"
            ],
            [
              384656,
              "u8",
              "oxpfD"
            ],
            [
              386293,
              "u8",
              "oO f"
            ],
            [
              571358,
              "u8",
              "arGH9"
            ],
            [
              673282,
              "u8",
              "C8H9"
            ],
            [
              673395,
              "u8",
              "SHH9"
            ],
            [
              673508,
              "u8",
              "SXH9"
            ],
            [
              677449,
              "u8",
              "K H9"
            ],
            [
              682618,
              "u8",
              "S8H9"
            ],
            [
              683363,
              "u8",
              "CXH9"
            ],
            [
              698466,
              "u8",
              "C0H9"
            ],
            [
              712457,
              "u8",
              "YPH9"
            ],
            [
              789064,
              "u8",
              "/u6H"
            ],
            [
              804082,
              "u8",
              "5ulH9"
            ],
            [
              804696,
              "u8",
              "3ukH9"
            ],
            [
              804936,
              "u8",
              "5ukH9"
            ],
            [
              806690,
              "u8",
              "MulH9"
            ],
            [
              808665,
              "u8",
              "mulH9"
            ],
            [
              840987,
              "u8",
              "XHH9"
            ],
            [
              888809,
              "u8",
              "CHH9"
            ],
            [
              892028,
              "u8",
              "h(I)"
            ],
            [
              892051,
              "u8",
              "X0H9"
            ],
            [
              892799,
              "u8",
              "h(H)"
            ],
            [
              893140,
              "u8",
              "i(H)"
            ],
            [
              900232,
              "u8",
              "JHM9"
            ],
            [
              900514,
              "u8",
              "HHM9"
            ],
            [
              907876,
              "u8",
              "A L9"
            ],
            [
              918361,
              "u8",
              "L$(H)"
            ],
            [
              966198,
              "u8",
              "t$(H)"
            ],
            [
              974035,
              "u8",
              "WsLHk"
            ],
            [
              974223,
              "u8",
              "WsuHk"
            ],
            [
              998253,
              "u8",
              "D$B\u003c\"t\u003c\u003c't8H"
            ],
            [
              1044843,
              "u8",
              "sxHk"
            ],
            [
              1049084,
              "u8",
              "spHk"
            ],
            [
              1064716,
              "u8",
              "sgHk"
            ],
            [
              1129440,
              "u8",
              "ATUSH"
            ],
            [
              1130672,
              "u8",
              "ATUI"
            ],
            [
              2414753,
              "u8",
              ".text"
            ],
            [
              2414759,
              "u8",
              ".noptrdata"
            ],
            [
              2414770,
              "u8",
              ".data"
            ],
            [
              2414776,
              "u8",
              ".bss"
            ],
            [
              2414781,
              "u8",
              ".noptrbss"
            ],
            [
              2414791,
              "u8",
              ".tbss"
            ],
            [
              2414797,
              "u8",
              ".note.go.buildid"
            ],
            [
              2414814,
              "u8",
              ".elfdata"
            ],
            [
              2414823,
              "u8",
              ".rodata"
            ],
            [
              2414831,
              "u8",
              ".typelink"
            ],
            [
              2414841,
              "u8",
              ".gosymtab"
            ],
            [
              2414851,
              "u8",
              ".gopclntab"
            ],
            [
              2414862,
              "u8",
              ".symtab"
            ],
            [
              2414870,
              "u8",
              ".strtab"
            ],
            [
              2414878,
              "u8",
              ".debug_abbrev"
            ],
            [
              2414892,
              "u8",
              ".debug_aranges"
            ],
            [
              2414907,
              "u8",
              ".debug_frame"
            ],
            [
              2414920,
              "u8",
              ".debug_info"
            ],
            [
              2414932,
              "u8",
              ".debug_line"
            ],
            [
              2414944,
              "u8",
              ".debug_loc"
            ],
            [
              2414955,
              "u8",
              ".debug_macinfo"
            ],
            [
              2414970,
              "u8",
              ".debug_pubnames"
            ],
            [
              2414986,
              "u8",
              ".debug_pubtypes"
            ],
            [
              2415002,
              "u8",
              ".debug_ranges"
            ],
            [
              2415016,
              "u8",
              ".debug_str"
            ],
            [
              2415027,
              "u8",
              ".debug_gdb_scripts"
            ],
            [
              2415046,
              "u8",
              ".shstrtab"
            ],
            [
              2415056,
              "u8",
              ".interp"
            ],
            [
              2415064,
              "u8",
              ".hash"
            ],
            [
              2415070,
              "u8",
              ".got"
            ],
            [
              2415075,
              "u8",
              ".got.plt"
            ],
            [
              2415084,
              "u8",
              ".dynamic"
            ],
            [
              2415093,
              "u8",
              ".dynsym"
            ],
            [
              2415101,
              "u8",
              ".dynstr"
            ],
            [
              2415109,
              "u8",
              ".rela"
            ],
            [
              2415115,
              "u8",
              ".rela.plt"
            ],
            [
              2415125,
              "u8",
              ".plt"
            ],
            [
              2415130,
              "u8",
              ".gnu.version"
            ],
            [
              2415143,
              "u8",
              ".gnu.version_r"
            ],
            [
              2415169,
              "u8",
              "crosscall2"
            ],
            [
              2415180,
              "u8",
              "_cgo_panic"
            ],
            [
              2415191,
              "u8",
              "_cgo_topofstack"
            ],
            [
              2415207,
              "u8",
              "libpthread.so.0"
            ],
            [
              2415233,
              "u8",
              "__errno_location"
            ],
            [
              2415250,
              "u8",
              "getnameinfo"
            ],
            [
              2415262,
              "u8",
              "getaddrinfo"
            ],
            [
              2415279,
              "u8",
              "freeaddrinfo"
            ],
            [
              2415292,
              "u8",
              "gai_strerror"
            ],
            [
              2415305,
              "u8",
              "stderr"
            ],
            [
              2415312,
              "u8",
              "fwrite"
            ],
            [
              2415319,
              "u8",
              "__vfprintf_chk"
            ],
            [
              2415340,
              "u8",
              "abort"
            ],
            [
              2415346,
              "u8",
              "pthread_mutex_lock"
            ],
            [
              2415365,
              "u8",
              "pthread_cond_wait"
            ],
            [
              2415383,
              "u8",
              "pthread_mutex_unlock"
            ],
            [
              2415404,
              "u8",
              "pthread_cond_broadcast"
            ],
            [
              2415427,
              "u8",
              "pthread_create"
            ],
            [
              2415442,
              "u8",
              "nanosleep"
            ],
            [
              2415452,
              "u8",
              "__stack_chk_fail"
            ],
            [
              2415469,
              "u8",
              "strerror"
            ],
            [
              2415478,
              "u8",
              "__fprintf_chk"
            ],
            [
              2415492,
              "u8",
              "malloc"
            ],
            [
              2415499,
              "u8",
              "pthread_attr_init"
            ],
            [
              2415517,
              "u8",
              "pthread_attr_getstacksize"
            ],
            [
              2415543,
              "u8",
              "pthread_attr_destroy"
            ],
            [
              2415564,
              "u8",
              "sigfillset"
            ],
            [
              2415575,
              "u8",
              "pthread_sigmask"
            ],
            [
              2415596,
              "u8",
              "setenv"
            ],
            [
              2415603,
              "u8",
              "unsetenv"
            ],
            [
              2417272,
              "u8",
              "(nil)"
            ],
            [
              2417600,
              "u8",
              "(MISSING)"
            ],
            [
              2417616,
              "u8",
              "(BADINDEX)"
            ],
            [
              2417664,
              "u8",
              "%!(BADPREC)"
            ],
            [
              2417680,
              "u8",
              "%!(BADWIDTH)"
            ],
            [
              2418480,
              "u8",
              "/dev/urandom"
            ],
            [
              2421728,
              "u8",
              "fatal error: cgo callback before cgo call"
            ],
            [
              2422328,
              "u8",
              "d1d1"
            ],
            [
              2427048,
              "u8",
              "1050"
            ],
            [
              2427908,
              "u8",
              "H2O2"
            ],
            [
              2427914,
              "u8",
              "Q2_2"
            ],
            [
              2429898,
              "u8",
              "2050"
            ],
            [
              2440142,
              "u8",
              "0070"
            ],
            [
              2441402,
              "u8",
              "6070"
            ],
            [
              2457169,
              "u8",
              "fL0RWN0"
            ],
            [
              2471134,
              "u8",
              "G5_V"
            ],
            [
              2471350,
              "u8",
              "dtAxN"
            ],
            [
              2471359,
              "u8",
              "/wxRB"
            ],
            [
              2472503,
              "u8",
              "afNgy"
            ],
            [
              2473585,
              "u8",
              "acfO4"
            ],
            [
              2473788,
              "u8",
              "H1uyC"
            ],
            [
              2615697,
              "u8",
              "runtime.text"
            ],
            [
              2615710,
              "u8",
              "runtime.etext"
            ],
            [
              2615724,
              "u8",
              "runtime.symtab"
            ],
            [
              2615739,
              "u8",
              "runtime.gcbits.*"
            ],
            [
              2615766,
              "u8",
              "go.string.*"
            ],
            [
              2615778,
              "u8",
              "runtime.egcbss"
            ],
            [
              2615793,
              "u8",
              "runtime.gcbss"
            ],
            [
              2615807,
              "u8",
              "runtime.egcdata"
            ],
            [
              2615823,
              "u8",
              "runtime.gcdata"
            ],
            [
              2615838,
              "u8",
              "runtime.esymtab"
            ],
            [
              2615854,
              "u8",
              "runtime.epclntab"
            ],
            [
              2615871,
              "u8",
              "runtime.enoptrbss"
            ],
            [
              2615889,
              "u8",
              "runtime.noptrbss"
            ],
            [
              2615906,
              "u8",
              "runtime.ebss"
            ],
            [
              2615919,
              "u8",
              "runtime.bss"
            ],
            [
              2615931,
              "u8",
              "runtime.edata"
            ],
            [
              2615945,
              "u8",
              "runtime.enoptrdata"
            ],
            [
              2615964,
              "u8",
              "runtime.noptrdata"
            ],
            [
              2615982,
              "u8",
              "runtime.erodata"
            ],
            [
              2615998,
              "u8",
              "runtime.rodata"
            ],
            [
              2616013,
              "u8",
              "runtime.etypelink"
            ],
            [
              2616031,
              "u8",
              "runtime.typelink"
            ],
            [
              2616048,
              "u8",
              "runtime.findfunctab"
            ],
            [
              2616068,
              "u8",
              "runtime.pclntab"
            ],
            [
              2616099,
              "u8",
              "setg_gcc"
            ],
            [
              2616113,
              "u8",
              "runtime_init_cond"
            ],
            [
              2616131,
              "u8",
              "runtime_init_done"
            ],
            [
              2616149,
              "u8",
              "runtime_init_mu"
            ],
            [
              2616170,
              "u8",
              "runtime/cgo(.bss)"
            ],
            [
              2616188,
              "u8",
              "runtime/cgo(.rodata.str1.8)"
            ],
            [
              2616216,
              "u8",
              "runtime/cgo(.rodata.str1.1)"
            ],
            [
              2616244,
              "u8",
              "reflect.methodValueCall.args_stackmap"
            ],
            [
              2616282,
              "u8",
              "$f64.47efffffe0000000"
            ],
            [
              2616304,
              "u8",
              "$f64.3fc5555555555555"
            ],
            [
              2616326,
              "u8",
              "$f64.3fa5555555555555"
            ],
            [
              2616414,
              "u8",
              "$f64.3efa01a01a01a01a"
            ],
            [
              2616436,
              "u8",
              "$f64.3fb0000000000000"
            ],
            [
              2616458,
              "u8",
              "$f64.3d53de6af278ece6"
            ],
            [
              2616480,
              "u8",
              "$f64.3fe62e42fefa3000"
            ],
            [
              2616502,
              "u8",
              "math.Log.args_stackmap"
            ],
            [
              2616525,
              "u8",
              "math.hasSSE4.args_stackmap"
            ],
            [
              2616552,
              "u8",
              "math.Exp.args_stackmap"
            ],
            [
              2616575,
              "u8",
              "$f64.3fd999999997fa04"
            ],
            [
              2616597,
              "u8",
              "$f64.3fcc71c51d8e78af"
            ],
            [
              2616619,
              "u8",
              "$f64.3fc39a09d078c69f"
            ],
            [
              2616641,
              "u8",
              "$f64.3fe5555555555593"
            ],
            [
              2616663,
              "u8",
              "$f64.3fd2492494229359"
            ],
            [
              2616685,
              "u8",
              "$f64.3fc7466496cb03de"
            ],
            [
              2616707,
              "u8",
              "$f64.3fc2f112df3e5244"
            ],
            [
              2616729,
              "u8",
              "$f64.3fe6a09e667f3bcd"
            ],
            [
              2616751,
              "u8",
              "$f64.3ff71547652b82fe"
            ],
            [
              2616773,
              "u8",
              "$f64.3dea39ef35793c76"
            ],
            [
              2616795,
              "u8",
              "$f64.3fe62e42fee00000"
            ],
            [
              2616839,
              "u8",
              "sync/atomic.StoreUintptr.args_stackmap"
            ],
            [
              2616878,
              "u8",
              "sync/atomic.StoreUint64.args_stackmap"
            ],
            [
              2616916,
              "u8",
              "sync/atomic.StoreUint32.args_stackmap"
            ],
            [
              2616954,
              "u8",
              "sync/atomic.StoreInt32.args_stackmap"
            ],
            [
              2616991,
              "u8",
              "sync/atomic.LoadPointer.args_stackmap"
            ],
            [
              2617029,
              "u8",
              "sync/atomic.LoadUintptr.args_stackmap"
            ],
            [
              2617067,
              "u8",
              "sync/atomic.LoadUint64.args_stackmap"
            ],
            [
              2617104,
              "u8",
              "sync/atomic.LoadUint32.args_stackmap"
            ],
            [
              2617141,
              "u8",
              "sync/atomic.LoadInt32.args_stackmap"
            ],
            [
              2617177,
              "u8",
              "sync/atomic.AddUint64.args_stackmap"
            ],
            [
              2617213,
              "u8",
              "sync/atomic.AddUint32.args_stackmap"
            ],
            [
              2617249,
              "u8",
              "sync/atomic.AddInt32.args_stackmap"
            ],
            [
              2617284,
              "u8",
              "sync/atomic.CompareAndSwapUint64.args_stackmap"
            ],
            [
              2617331,
              "u8",
              "sync/atomic.CompareAndSwapUint32.args_stackmap"
            ],
            [
              2617378,
              "u8",
              "sync/atomic.CompareAndSwapInt32.args_stackmap"
            ],
            [
              2617438,
              "u8",
              "$f64.bfe0000000000000"
            ],
            [
              2617504,
              "u8",
              "$f64.3fd2972a8afc6175"
            ],
            [
              2617526,
              "u8",
              "$f64.401ec9d9297ebb83"
            ],
            [
              2617548,
              "u8",
              "syscall.RawSyscall.args_stackmap"
            ],
            [
              2617581,
              "u8",
              "syscall.Syscall6.args_stackmap"
            ],
            [
              2617612,
              "u8",
              "syscall.Syscall.args_stackmap"
            ],
            [
              2617642,
              "u8",
              "syscall.use.args_stackmap"
            ],
            [
              2617668,
              "u8",
              "$f64.3d538bffe4ddaebe"
            ],
            [
              2617690,
              "u8",
              "$f64.3db2533fe68fd3d2"
            ],
            [
              2617712,
              "u8",
              "fmt..gobytes.17"
            ],
            [
              2617728,
              "u8",
              "fmt..gobytes.16"
            ],
            [
              2617744,
              "u8",
              "fmt..gobytes.15"
            ],
            [
              2617760,
              "u8",
              "fmt..gobytes.14"
            ],
            [
              2617776,
              "u8",
              "fmt..gobytes.13"
            ],
            [
              2617792,
              "u8",
              "fmt..gobytes.12"
            ],
            [
              2617808,
              "u8",
              "fmt..gobytes.11"
            ],
            [
              2617824,
              "u8",
              "fmt..gobytes.10"
            ],
            [
              2617840,
              "u8",
              "fmt..gobytes.9"
            ],
            [
              2617855,
              "u8",
              "fmt..gobytes.8"
            ],
            [
              2617870,
              "u8",
              "fmt..gobytes.7"
            ],
            [
              2617885,
              "u8",
              "fmt..gobytes.6"
            ],
            [
              2617900,
              "u8",
              "fmt..gobytes.5"
            ],
            [
              2617915,
              "u8",
              "fmt..gobytes.4"
            ],
            [
              2617930,
              "u8",
              "fmt..gobytes.3"
            ],
            [
              2617945,
              "u8",
              "fmt..gobytes.2"
            ],
            [
              2617960,
              "u8",
              "fmt..gobytes.1"
            ],
            [
              2617975,
              "u8",
              "net..gostring.7"
            ],
            [
              2617991,
              "u8",
              "net.hdr..gostring.7"
            ],
            [
              2618011,
              "u8",
              "net..gostring.6"
            ],
            [
              2618027,
              "u8",
              "net.hdr..gostring.6"
            ],
            [
              2618047,
              "u8",
              "net..gostring.5"
            ],
            [
              2618063,
              "u8",
              "net.hdr..gostring.5"
            ],
            [
              2618083,
              "u8",
              "$f64.3e112e0be826d695"
            ],
            [
              2618105,
              "u8",
              "shifts"
            ],
            [
              2618118,
              "u8",
              "runtime..gostring.22"
            ],
            [
              2618139,
              "u8",
              "runtime.hdr..gostring.22"
            ],
            [
              2618164,
              "u8",
              "runtime..gostring.21"
            ],
            [
              2618185,
              "u8",
              "runtime.hdr..gostring.21"
            ],
            [
              2618210,
              "u8",
              "runtime..gostring.20"
            ]
          ],
          "v": {
            "elf.type": "executable",
            "elf.class": "elf64",
            "elf.entry": 4584896,
            "file.stem": "f3dda37a24cab0e83b4f5a5a5e1b466cab8c1613821526a611c75f9a36035c60",
            "elf.endian": "little",
            "elf.machine": "x86_64",
            "elf.version": 1,
            "elf.needed[0]": "libpthread.so.0",
            "elf.needed[1]": "libc.so.6",
            "file.basename": "f3dda37a24cab0e83b4f5a5a5e1b466cab8c1613821526a611c75f9a36035c60.elf",
            "elf.interpreter": "/lib64/ld-linux-x86-64.so.2",
            "binary.fortify[0]": "fprintf",
            "binary.fortify[1]": "vfprintf",
            "elf.entry_section": ".text",
            "elf.hashes.imphash": "16bab951c1e47f0eab910c0e8a6fad41",
            "elf.hashes.symhash": "16bab951c1e47f0eab910c0e8a6fad41",
            "elf.hashes.dyn_hash": "46f1a65d8287df386fa3062ea1baa777",
            "elf.segments[0].type": "phdr",
            "elf.segments[1].type": "interp",
            "elf.segments[2].type": "note",
            "elf.segments[3].type": "load",
            "elf.segments[4].type": "load",
            "elf.segments[5].type": "load",
            "elf.segments[6].type": "dynamic",
            "elf.segments[7].type": "tls",
            "elf.segments[8].type": "gnu_stack",
            "elf.segments[9].type": "other",
            "elf.segments[0].perms": "r--",
            "elf.segments[0].vaddr": 4194368,
            "elf.segments[1].perms": "r--",
            "elf.segments[1].vaddr": 4198372,
            "elf.segments[2].perms": "r--",
            "elf.segments[2].vaddr": 4198316,
            "elf.segments[3].perms": "r-x",
            "elf.segments[3].vaddr": 4194304,
            "elf.segments[4].perms": "r--",
            "elf.segments[4].vaddr": 5328896,
            "elf.segments[5].perms": "rw-",
            "elf.segments[5].vaddr": 6610944,
            "elf.segments[6].perms": "rw-",
            "elf.segments[6].vaddr": 6611200,
            "elf.segments[7].perms": "r--",
            "elf.segments[8].perms": "rw-",
            "elf.segments[9].perms": "---",
            "elf.dwarf.comp_dirs[0]": "/root",
            "elf.dwarf.languages[0]": "go",
            "elf.hashes.export_hash": "a4436763835753a7c2e049a27027b56f",
            "elf.needed_versions[0]": "libpthread.so.0@GLIBC_2.3.2",
            "elf.needed_versions[1]": "libpthread.so.0@GLIBC_2.2.5",
            "elf.needed_versions[2]": "libc.so.6@GLIBC_2.4",
            "elf.needed_versions[3]": "libc.so.6@GLIBC_2.3.4",
            "elf.needed_versions[4]": "libc.so.6@GLIBC_2.2.5",
            "build.toolchain.compiler": "go",
            "elf.dwarf.source_files[0]": "/root/go",
            "elf.segments[0].file_size": 560,
            "elf.segments[0].flags_hex": "4",
            "elf.segments[1].file_size": 28,
            "elf.segments[1].flags_hex": "4",
            "elf.segments[2].file_size": 56,
            "elf.segments[2].flags_hex": "4",
            "elf.segments[3].file_size": 1131664,
            "elf.segments[3].flags_hex": "5",
            "elf.segments[4].file_size": 1281912,
            "elf.segments[4].flags_hex": "4",
            "elf.segments[5].file_size": 82816,
            "elf.segments[5].flags_hex": "6",
            "elf.segments[6].file_size": 304,
            "elf.segments[6].flags_hex": "6",
            "elf.segments[7].flags_hex": "4",
            "elf.segments[8].flags_hex": "6",
            "elf.segments[9].flags_hex": "2a00",
            "elf.segments[0].file_offset": 64,
            "elf.segments[0].memory_size": 560,
            "elf.segments[1].file_offset": 4068,
            "elf.segments[1].memory_size": 28,
            "elf.segments[2].file_offset": 4012,
            "elf.segments[2].memory_size": 56,
            "elf.segments[3].memory_size": 1131664,
            "elf.segments[4].file_offset": 1134592,
            "elf.segments[4].memory_size": 1281912,
            "elf.segments[5].file_offset": 2416640,
            "elf.segments[5].memory_size": 213184,
            "elf.segments[6].file_offset": 2416896,
            "elf.segments[6].memory_size": 304,
            "elf.segments[7].memory_size": 8,
            "elf.symbol_kinds.types.func": 3017,
            "elf.symbol_kinds.types.notype": 31,
            "elf.symbol_kinds.types.object": 1695,
            "elf.symbol_kinds.bindings.local": 210,
            "elf.symbol_kinds.bindings.global": 4533,
            "elf.stripped_metadata_sections[0]": ".comment",
            "elf.stripped_metadata_sections[1]": ".debug_str",
            "elf.stripped_metadata_sections[2]": ".note.gnu.gold-version",
            "elf.symbol_kinds.visibility.hidden": 10,
            "elf.symbol_kinds.visibility.default": 4733,
            "elf.relocation_kinds.R_X86_64_GLOB_DAT": 1,
            "elf.relocation_kinds.R_X86_64_JUMP_SLOT": 28
          },
          "x": [
            [
              "crosscall2"
            ],
            [
              "cgo_panic"
            ],
            [
              "cgo_topofstack"
            ]
          ],
          "id": "elf",
          "sc": [
            [
              ".text",
              4096,
              1127086,
              0.0,
              "alloc,executable"
            ],
            [
              ".plt",
              1131200,
              464,
              0.0,
              "alloc,executable"
            ],
            [
              ".rodata",
              1134592,
              789507,
              0.0,
              "alloc"
            ],
            [
              ".typelink",
              1924104,
              12888,
              0.0,
              "alloc"
            ],
            [
              ".gopclntab",
              1936992,
              476635,
              0.0,
              "alloc"
            ],
            [
              ".rela",
              2413632,
              24,
              0.0,
              "alloc"
            ],
            [
              ".rela.plt",
              2413664,
              672,
              0.0,
              "alloc"
            ],
            [
              ".gnu.version",
              2414336,
              66,
              0.0,
              "alloc"
            ],
            [
              ".gnu.version_r",
              2414432,
              112,
              0.0,
              "alloc"
            ],
            [
              ".hash",
              2414560,
              168,
              0.0,
              "alloc"
            ],
            [
              ".shstrtab",
              2414752,
              406,
              0.0,
              ""
            ],
            [
              ".dynstr",
              2415168,
              528,
              0.0,
              "alloc"
            ],
            [
              ".dynsym",
              2415712,
              792,
              0.0,
              "alloc"
            ],
            [
              ".got.plt",
              2416640,
              248,
              0.0,
              "write,alloc"
            ],
            [
              ".dynamic",
              2416896,
              304,
              0.0,
              "write,alloc"
            ],
            [
              ".got",
              2417200,
              8,
              0.0,
              "write,alloc"
            ],
            [
              ".noptrdata",
              2417216,
              56920,
              0.0,
              "write,alloc"
            ],
            [
              ".data",
              2474144,
              25296,
              0.0,
              "write,alloc"
            ],
            [
              ".interp",
              4068,
              28,
              0.0,
              "alloc"
            ],
            [
              ".note.go.buildid",
              4012,
              56,
              0.0,
              "alloc"
            ],
            [
              ".symtab",
              2502656,
              113040,
              0.0,
              ""
            ],
            [
              ".strtab",
              2615696,
              107785,
              0.0,
              ""
            ],
            [
              ".debug_abbrev",
              2723481,
              255,
              0.0,
              ""
            ],
            [
              ".debug_line",
              2723736,
              112977,
              0.0,
              ""
            ],
            [
              ".debug_frame",
              2836713,
              126148,
              0.0,
              ""
            ],
            [
              ".debug_info",
              2962861,
              485177,
              0.0,
              ""
            ],
            [
              ".debug_pubnames",
              3448038,
              125983,
              0.0,
              ""
            ],
            [
              ".debug_pubtypes",
              3574021,
              45343,
              0.0,
              ""
            ],
            [
              ".debug_aranges",
              3619364,
              48,
              0.0,
              ""
            ],
            [
              ".debug_gdb_scripts",
              3619412,
              44,
              0.0,
              ""
            ]
          ]
        },
        "id": 0,
        "sz": 3619456,
        "ts": [
          {
            "c": 1.0,
            "d": "Binary is not digitally signed",
            "i": "metadata/unsigned",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "ELF program interpreter metadata",
            "e": [
              "/lib64/ld-linux-x86-64.so.2"
            ],
            "i": "metadata/binary/linking/runtime::interpreter",
            "l": 2,
            "el": [
              "value:elf.interpreter"
            ]
          },
          {
            "c": 1.0,
            "d": "File larger than 1MB",
            "e": [
              "f3dda37a24cab0e83b4f5a5a5e1b466cab8c1613821526a611c75f9a36035c60.elf"
            ],
            "i": "metadata/binary/metrics/size::large-file-1mb",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "File is a compiled binary",
            "e": [
              "f3dda37a24cab0e83b4f5a5a5e1b466cab8c1613821526a611c75f9a36035c60.elf"
            ],
            "i": "metadata/binary/framework::is-binary",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "ELF dynsym section name",
            "e": [
              ".dynsym"
            ],
            "i": "metadata/binary/linking/static::elf-dynsym-section-name",
            "l": 2,
            "el": [
              "0x24d9f5"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "ELF interpreter section name",
            "e": [
              ".interp"
            ],
            "i": "metadata/binary/linking/static::elf-interpreter-section-name",
            "l": 2,
            "el": [
              "0x24d9d0"
            ]
          },
          {
            "a": "T1614",
            "c": 0.6000000238418579,
            "d": "Country code AM token",
            "e": [
              "AM"
            ],
            "i": "objectives/anti-analysis/geofencing/region/country-code-a::country-code-am",
            "l": 1,
            "m": "B0007.003",
            "el": [
              "0x58e870"
            ]
          },
          {
            "c": 1.0,
            "d": "Access /dev/urandom",
            "e": [
              "/dev/urandom"
            ],
            "i": "micro-behaviors/os/random/crypto::urandom",
            "l": 2,
            "el": [
              "0x24e730"
            ]
          },
          {
            "c": 0.4000000059604645,
            "d": "setenv function (set environment variable)",
            "e": [
              "setenv"
            ],
            "i": "micro-behaviors/os/env/vars/access::setenv",
            "l": 2,
            "el": [
              "import"
            ]
          },
          {
            "a": "T1071.001",
            "d": "HTTP/1.x version string",
            "e": [
              "GET login.cgi HTTP/1.1\r\n\r\n",
              "%29 HTTP/1.1"
            ],
            "i": "micro-behaviors/communications/http/request/client::http-version",
            "l": 2,
            "m": "C0002",
            "el": [
              "0x5b3320",
              "0x591820"
            ]
          },
          {
            "c": 0.6600000262260437,
            "d": "Write single bytes to file",
            "e": [
              "fputc"
            ],
            "i": "micro-behaviors/fs/file/write/direct::fputc",
            "l": 2,
            "el": [
              "import"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "Abort program execution",
            "e": [
              "abort"
            ],
            "i": "micro-behaviors/os/signal/handler::abort",
            "l": 2,
            "el": [
              "import"
            ]
          },
          {
            "c": 0.6600000262260437,
            "d": "Resolve endpoint with getnameinfo",
            "e": [
              "getnameinfo"
            ],
            "i": "micro-behaviors/communications/ip/resolve::resolve-getnameinfo",
            "l": 3,
            "el": [
              "import"
            ]
          },
          {
            "a": "T1059.004",
            "c": 0.800000011920929,
            "d": "Terminal type linux identifier",
            "e": [
              "linux"
            ],
            "i": "objectives/command-and-control/reverse-shell/pty::terminal-type-linux",
            "l": 1,
            "m": "B0024",
            "el": [
              "0x590418"
            ]
          },
          {
            "c": 0.30000001192092896,
            "d": "token keyword",
            "e": [
              "token"
            ],
            "i": "micro-behaviors/data/text/keywords/lexicon::token",
            "l": 1,
            "el": [
              "0x5910c0"
            ]
          },
          {
            "c": 0.20000000298023224,
            "d": "pipe keyword",
            "e": [
              "pipe"
            ],
            "i": "micro-behaviors/data/text/keywords/lexicon::pipe",
            "l": 1,
            "el": [
              "0x29ad39"
            ]
          },
          {
            "d": "TCPConn type",
            "e": [
              "TCPConn"
            ],
            "i": "micro-behaviors/communications/socket/tcp::tcp-conn",
            "l": 3,
            "el": [
              "0x2851cd"
            ]
          },
          {
            "d": "Binary exports symbols",
            "e": [
              "exports.count = 3.00"
            ],
            "i": "metadata/binary/symbols/exports::has-exports",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "go/rs language suffix",
            "e": [
              "runtime.rt0_go"
            ],
            "i": "micro-behaviors/data/text/malware/terms::malware-lang-suffix",
            "l": 1,
            "el": [
              "0x28db75"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "Large ELF with 500+ strings",
            "e": [
              "binary.string_count = 14328.00"
            ],
            "i": "metadata/binary/metrics/structural::many-strings-large-elf",
            "l": 2
          },
          {
            "c": 0.6600000262260437,
            "d": "Reference to /etc configuration files",
            "e": [
              "/etc/protocols",
              "/etc/nsswitch.conf",
              "/etc/resolv.conf",
              "/etc/services",
              "/etc/mdns.allow",
              "/etc/localtime",
              "/etc/hosts"
            ],
            "i": "micro-behaviors/fs/path/config/system::config-etc",
            "l": 2,
            "el": [
              "0x592700",
              "0x5ab740",
              "0x5ab760",
              "0x592710",
              "0x5926f0",
              "0x5926e0",
              "0x5926d0"
            ]
          },
          {
            "c": 1.0,
            "d": "Binary has 25+ imports",
            "e": [
              "imports.count = 29.00"
            ],
            "i": "metadata/binary/metrics/threshold::many-imports-25",
            "l": 1
          },
          {
            "a": "T1552.001",
            "c": 0.30000001192092896,
            "d": "\"password\" keyword",
            "e": [
              "password"
            ],
            "i": "objectives/supply-chain/credential-theft/registry::settings-password-keyword",
            "l": 1,
            "el": [
              "0x2d36c8"
            ]
          },
          {
            "c": 1.0,
            "d": "scanner word",
            "e": [
              "Scanner"
            ],
            "i": "objectives/impact/infect/lexicon::scanner-word",
            "l": 1,
            "el": [
              "0x293503"
            ]
          },
          {
            "c": 1.0,
            "d": "Binary has 1000 or more strings",
            "e": [
              "binary.string_count = 14328.00"
            ],
            "i": "metadata/binary/metrics/threshold::string-count-1000-plus",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "bootstrap string",
            "e": [
              "bootstrap"
            ],
            "i": "objectives/command-and-control/channel/p2p::bootstrap-str",
            "l": 1,
            "el": [
              "0x5c3340"
            ]
          },
          {
            "c": 0.6600000262260437,
            "d": "Resolve endpoint with getaddrinfo",
            "e": [
              "getaddrinfo"
            ],
            "i": "micro-behaviors/communications/ip/resolve::resolve-getaddrinfo",
            "l": 3,
            "el": [
              "import"
            ]
          },
          {
            "c": 0.6600000262260437,
            "d": "Reference to /lib64",
            "e": [
              "/lib64/ld-linux-x86-64.so.2"
            ],
            "i": "micro-behaviors/fs/path/system::system-lib64",
            "l": 2,
            "el": [
              "0xfbc"
            ]
          },
          {
            "c": 0.4000000059604645,
            "d": "unsetenv function (remove environment variable)",
            "e": [
              "unsetenv"
            ],
            "i": "micro-behaviors/os/env/vars/access::unsetenv",
            "l": 2,
            "el": [
              "import"
            ]
          },
          {
            "c": 0.6600000262260437,
            "d": "Read files (Go)",
            "e": [
              "os.(*File).Read"
            ],
            "i": "micro-behaviors/fs/file/read::read-go",
            "l": 2,
            "el": [
              "0x2920bb"
            ]
          },
          {
            "c": 0.699999988079071,
            "d": "HTTP GET method",
            "e": [
              "GET login.cgi HTTP/1.1"
            ],
            "i": "micro-behaviors/communications/http/get::get",
            "l": 3,
            "el": [
              "0x5b3320"
            ]
          },
          {
            "c": 1.0,
            "d": "Binary is 500KB+",
            "e": [
              "f3dda37a24cab0e83b4f5a5a5e1b466cab8c1613821526a611c75f9a36035c60.elf"
            ],
            "i": "metadata/binary/metrics/threshold::large-binary-500k",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "Go bytes.Buffer I/O",
            "e": [
              ".ReadFrom",
              ".WriteTo"
            ],
            "i": "micro-behaviors/data/buffer::go-bytes-buffer-io",
            "l": 2,
            "el": [
              "0x28f3fc",
              "0x28f444"
            ]
          },
          {
            "c": 1.0,
            "d": "Binary is not position-independent (fixed load address)",
            "e": [
              "binary.is_pie = 0.00"
            ],
            "i": "metadata/hardening/layout::no-pie",
            "l": 2
          },
          {
            "d": "pthread threading library",
            "e": [
              "pthread_create"
            ],
            "i": "micro-behaviors/process/threading/concurrency::pthread",
            "l": 2,
            "el": [
              "import"
            ]
          },
          {
            "c": 0.20000000298023224,
            "d": "pwd keyword",
            "e": [
              "pwd"
            ],
            "i": "micro-behaviors/data/text/keywords/lexicon::pwd",
            "l": 1,
            "el": [
              "0x5c8860"
            ]
          },
          {
            "d": "mmap memory mapping function",
            "e": [
              "mmap"
            ],
            "i": "micro-behaviors/mem/alloc/executable::mmap-symbol",
            "l": 2,
            "el": [
              "import"
            ]
          },
          {
            "c": 0.6000000238418579,
            "d": "payload keyword",
            "e": [
              "payload"
            ],
            "i": "micro-behaviors/data/text/keywords/lexicon::payload",
            "l": 1,
            "el": [
              "0x2d3871"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "__stack_chk_fail function",
            "e": [
              "stack_chk_fail"
            ],
            "i": "metadata/hardening/build::stack-chk-fail",
            "l": 2,
            "el": [
              "import"
            ]
          },
          {
            "c": 0.20000000298023224,
            "d": "localtime function (string)",
            "e": [
              "/etc/localtime"
            ],
            "i": "micro-behaviors/time/query::localtime-string",
            "l": 2,
            "el": [
              "0x5926e0"
            ]
          },
          {
            "c": 0.6000000238418579,
            "d": "TCP endpoint state error",
            "e": [
              "transport endpoint is already connected",
              "transport endpoint is not connected"
            ],
            "i": "micro-behaviors/communications/socket/tcp::go-net-error-endpoint",
            "l": 2,
            "el": [
              "0x5bf040",
              "0x5bf080"
            ]
          },
          {
            "c": 1.0,
            "d": "Binary has 20+ sections (installer/packer)",
            "e": [
              "sections.count = 35.00"
            ],
            "i": "metadata/binary/metrics/threshold::many-sections-20",
            "l": 1
          },
          {
            "c": 0.6000000238418579,
            "d": "SOCKS5 BIND request opcode",
            "e": [
              "05 02 00"
            ],
            "i": "micro-behaviors/communications/proxy/socks::socks5-bind-command-byte",
            "l": 1,
            "el": [
              "0xc59a"
            ]
          },
          {
            "a": "T1071.004",
            "c": 0.6600000262260437,
            "d": "Reads DNS resolver configuration",
            "e": [
              "/etc/resolv.conf"
            ],
            "i": "micro-behaviors/communications/dns/lookup/native::lookup-resolv",
            "l": 3,
            "m": "C0011",
            "el": [
              "0x5ab760"
            ]
          },
          {
            "c": 1.0,
            "d": "ELF needed library metadata",
            "e": [
              "[libpthread.so.0, libc.so.6]"
            ],
            "i": "metadata/binary/linking/runtime::needed-lib",
            "l": 2,
            "el": [
              "value:elf.needed"
            ]
          },
          {
            "a": "T1071.001",
            "c": 0.4000000059604645,
            "d": "Generic cmd/command/result field word fragment",
            "e": [
              "Result",
              "result"
            ],
            "i": "objectives/command-and-control/beacon/network/json::result-command-word",
            "l": 1,
            "m": "B0030",
            "el": [
              "0x294a5a",
              "0x31451d"
            ]
          },
          {
            "c": 0.6600000262260437,
            "d": "Reference to /etc/resolv.conf",
            "e": [
              "/etc/resolv.conf"
            ],
            "i": "micro-behaviors/fs/path/config/system::config-resolv",
            "l": 3,
            "el": [
              "0x5ab760"
            ]
          },
          {
            "a": "T1071.001",
            "c": 0.6000000238418579,
            "d": "Hardcoded GET method string",
            "e": [
              "GET /ftptest.cgi?loginuse=",
              "GET /set_ftp.cgi?loginuse="
            ],
            "i": "objectives/command-and-control/channel/http/message::http-method-get",
            "l": 1,
            "el": [
              "0x5b32e0",
              "0x5b3300"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "ELF dynstr section name",
            "e": [
              ".dynstr"
            ],
            "i": "metadata/binary/linking/static::elf-dynstr-section-name",
            "l": 2,
            "el": [
              "0x24d9fd"
            ]
          },
          {
            "a": "T1106",
            "c": 0.949999988079071,
            "d": "__vdso exported symbol string",
            "e": [
              "__vdso_gettimeofday_sym",
              "__vdso_time",
              "__vdso_gettimeofday",
              "__vdso_clock_gettime_sym",
              "__vdso_clock_gettime",
              "__vdso_time_sym"
            ],
            "i": "objectives/evasion/anti-av/syscall::linux-vdso-symbol",
            "l": 1,
            "m": "B0009",
            "el": [
              "0x285e05",
              "0x594440",
              "0x5adb80",
              "0x285de4",
              "0x5adb60",
              "0x285e25"
            ]
          },
          {
            "c": 0.6000000238418579,
            "d": "ELF stripped with .symtab present",
            "e": [
              "elf.stripped_but_symtab_present = 1.00"
            ],
            "i": "metadata/build/artifact::elf-stripped-but-symtab-present",
            "l": 3
          },
          {
            "c": 0.20000000298023224,
            "d": "encrypted-file trailer vocabulary",
            "e": [
              "magic",
              "trailer"
            ],
            "i": "micro-behaviors/data/text/keywords/lexicon::encrypted-trailer-vocab",
            "l": 1,
            "el": [
              "0x308c3e",
              "0x2d932d"
            ]
          },
          {
            "c": 0.699999988079071,
            "d": "ELF symbol tables stripped from binary",
            "e": [
              "elf.stripped_metadata_section_count = 3.00"
            ],
            "i": "metadata/binary/anomaly/provenance::stripped-symbol-tables",
            "l": 1
          },
          {
            "c": 0.30000001192092896,
            "d": "ICMP service/protocol reference",
            "e": [
              "ICMP",
              "icmp"
            ],
            "i": "micro-behaviors/communications/ip/services::services-icmp",
            "l": 2,
            "el": [
              "0x58ecc0",
              "0x595c90"
            ]
          },
          {
            "c": 1.0,
            "d": "Binary has 20+ imports",
            "e": [
              "imports.count = 29.00"
            ],
            "i": "metadata/binary/metrics/threshold::many-imports-20",
            "l": 1
          },
          {
            "c": 0.20000000298023224,
            "d": "output keyword",
            "e": [
              "stopped (tty output)",
              "input/output error"
            ],
            "i": "micro-behaviors/data/text/keywords/lexicon::output",
            "l": 1,
            "el": [
              "0x5b2360",
              "0x5affe0"
            ]
          },
          {
            "c": 0.6000000238418579,
            "d": "SOCKS5 UDP ASSOCIATE request opcode",
            "e": [
              "05 03 00"
            ],
            "i": "micro-behaviors/communications/proxy/socks::socks5-udp-associate-byte",
            "l": 1,
            "el": [
              "0x5c5c"
            ]
          },
          {
            "c": 0.75,
            "d": "HTTP protocol version strings",
            "e": [
              "HTTP/1.1"
            ],
            "i": "micro-behaviors/communications/http/request/client::http-versions",
            "l": 1,
            "el": [
              "0x591820"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "ELF dynamic section name",
            "e": [
              ".dynamic"
            ],
            "i": "metadata/binary/linking/static::elf-dynamic-section-name",
            "l": 2,
            "el": [
              "0x24d9ec"
            ]
          },
          {
            "c": 0.30000001192092896,
            "d": "XGETBV instruction bytes",
            "e": [
              "0F 01 D0"
            ],
            "i": "metadata/binary/instruction::xgetbv-instr",
            "l": 2,
            "el": [
              "0x5bdc8"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "Go ELF noptrdata section",
            "e": [
              ".noptrdata"
            ],
            "i": "metadata/lang/compiler/systems::go-noptrdata-elf",
            "l": 2
          },
          {
            "c": 0.8999999761581421,
            "d": "SOCKS5 client greeting bytes",
            "e": [
              "05 01 00"
            ],
            "i": "micro-behaviors/communications/proxy/socks::socks5-version-greeting-bytes",
            "l": 1,
            "el": [
              "0x20d9"
            ]
          },
          {
            "c": 1.0,
            "d": "Binary has 2000+ strings",
            "e": [
              "binary.string_count = 14328.00"
            ],
            "i": "metadata/binary/metrics/threshold::many-strings-2000",
            "l": 1
          },
          {
            "a": "T1055",
            "c": 0.25,
            "d": "Repeated 0x07 code constant (possible PROT_RWX)",
            "e": [
              "07 00 00 00"
            ],
            "i": "micro-behaviors/mem/protect/modify::rwx-prot-bytes",
            "l": 1,
            "el": [
              "0x2ff8"
            ]
          },
          {
            "d": "overflow keyword",
            "e": [
              "progToPointerMask: overflow",
              "runtime: split stack overflow: ",
              "runtime.overflowError",
              "runqsteal: runq overflow",
              "integer overflow",
              "overflow",
              "runtime: stat overflow: val ",
              "setoverflow",
              "runtime.panicoverflow",
              "runtime.(*hmap).setoverflow",
              "overflow is not nil",
              "runtime.(*bmap).overflow"
            ],
            "i": "micro-behaviors/data/text/keywords/lexicon::overflow",
            "l": 1,
            "el": [
              "0x5b7620",
              "0x5b7d60",
              "0x28699d",
              "0x5b7a00",
              "0x5b0020",
              "0x5969e0",
              "0x5b7d80",
              "0x597730",
              "0x2899c4",
              "0x287e48",
              "0x5b0a40",
              "0x287e2f"
            ]
          },
          {
            "d": "Characteristic system library export __errno_location",
            "e": [
              "errno_location"
            ],
            "i": "micro-behaviors/dylib/library/libc::libc-characteristic-errno",
            "l": 2,
            "el": [
              "import"
            ]
          },
          {
            "a": "T1485",
            "c": 1.0,
            "d": "Go math/rand Read method",
            "e": [
              "math/rand.(*Rand).Read"
            ],
            "i": "objectives/impact/wipe/disk/overwrite::go-rand-read",
            "l": 1,
            "el": [
              "0x294662"
            ]
          },
          {
            "c": 0.699999988079071,
            "d": "Go bytes.Buffer methods",
            "e": [
              ".WriteString",
              ".WriteByte",
              ".ReadByte"
            ],
            "i": "micro-behaviors/data/buffer::go-bytes-buffer-methods",
            "l": 2,
            "el": [
              "0x291cfc",
              "0x291d16",
              "0x2933e9"
            ]
          },
          {
            "c": 0.30000001192092896,
            "d": "Sleep for nanosecond duration",
            "e": [
              "nanosleep"
            ],
            "i": "micro-behaviors/time/query::nanosleep-func",
            "l": 2,
            "el": [
              "import"
            ]
          },
          {
            "c": 0.6600000262260437,
            "d": "Write files",
            "e": [
              "fwrite"
            ],
            "i": "micro-behaviors/fs/file/write/direct::write",
            "l": 2,
            "el": [
              "import"
            ]
          },
          {
            "c": 0.6600000262260437,
            "d": "List directory contents (Go)",
            "e": [
              ".ReadDir"
            ],
            "i": "micro-behaviors/fs/directory/readdir::readdir-go",
            "l": 2,
            "el": [
              "0x293e7c"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "Go ELF build ID note",
            "e": [
              ".note.go.buildid"
            ],
            "i": "metadata/lang/compiler/systems::go-note-buildid-elf",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "Go-compiled binary (identified by .gopclntab section)",
            "e": [
              ".gopclntab"
            ],
            "i": "metadata/lang/compiler/systems::go-binary",
            "l": 2
          },
          {
            "a": "T1059",
            "c": 0.8500000238418579,
            "d": "Go binary uses os/exec",
            "e": [
              "/usr/lib/go-1.6/src/os/exec_posix.go",
              "/usr/lib/go-1.6/src/os/exec_unix.go"
            ],
            "i": "micro-behaviors/process/create/system::go-os-exec-pclntab",
            "l": 2,
            "m": "E1059",
            "el": [
              "0x29a5ae",
              "0x29a5d6"
            ]
          },
          {
            "d": "password keyword",
            "e": [
              "password",
              "Invalid Username/Password response\r\n"
            ],
            "i": "micro-behaviors/data/text/keywords/lexicon::password",
            "l": 1,
            "el": [
              "0x2d36c8",
              "0x5b8bc0"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "ELF dynsym section name",
            "e": [
              ".dynsym"
            ],
            "i": "metadata/hardening/missing::elf-dynsym-section-name",
            "l": 2,
            "el": [
              "0x24d9f5"
            ]
          },
          {
            "c": 0.699999988079071,
            "d": "High string count over 1000",
            "e": [
              "binary.string_count = 14328.00"
            ],
            "i": "metadata/binary/metrics/threshold::high-string-count-1000",
            "l": 2
          },
          {
            "c": 0.6000000238418579,
            "d": "TCP connection refused error",
            "e": [
              "connection refused"
            ],
            "i": "micro-behaviors/communications/socket/tcp::go-net-error-connection-refused",
            "l": 2,
            "el": [
              "0x5ae0c0"
            ]
          },
          {
            "c": 0.6000000238418579,
            "d": "TCP connection timeout error",
            "e": [
              "connection timed out"
            ],
            "i": "micro-behaviors/communications/socket/tcp::go-net-error-connection-timeout",
            "l": 2,
            "el": [
              "0x5ae0e0"
            ]
          },
          {
            "c": 1.0,
            "d": "Toolchain banner stripped, build-id retained",
            "e": [
              "[.comment, .debug_str, .note.gnu.gold-version]"
            ],
            "i": "metadata/build/artifact::aggressive-strip",
            "l": 2,
            "el": [
              "value:elf.stripped_metadata_sections"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "ELF interpreter section name",
            "e": [
              ".interp"
            ],
            "i": "metadata/hardening/missing::elf-interpreter-section-name",
            "l": 2,
            "el": [
              "0x24d9d0"
            ]
          },
          {
            "c": 0.6000000238418579,
            "d": "TCP connection reset error",
            "e": [
              "connection reset by peer"
            ],
            "i": "micro-behaviors/communications/socket/tcp::go-net-error-connection-reset",
            "l": 2,
            "el": [
              "0x5b3ba0"
            ]
          },
          {
            "c": 0.6600000262260437,
            "d": "Reference to /etc/hosts",
            "e": [
              "/etc/hosts"
            ],
            "i": "micro-behaviors/fs/path/config/system::config-hosts",
            "l": 3,
            "el": [
              "0x5926d0"
            ]
          },
          {
            "c": 0.4000000059604645,
            "d": "XOR decryption loop byte pattern",
            "e": [
              "c3 48 f9 00 76",
              "c3 48 f8 13 75",
              "c3 48 f8 01 74",
              "c3 48 f9 00 75",
              "c3 48 fa 10 75"
            ],
            "i": "objectives/anti-analysis/self-modify/runtime::xor-loop-pattern",
            "l": 1,
            "el": [
              "0x7c82e",
              "0x10218d",
              "0x40da5",
              "0x2b077",
              "0x7deb3"
            ]
          },
          {
            "a": "T1622",
            "d": "GDB debugger reference",
            "e": [
              "gdb"
            ],
            "i": "objectives/anti-analysis/debugger-detect/check::gdb-ref",
            "l": 1,
            "m": "B0001",
            "el": [
              "0x373a55"
            ]
          },
          {
            "c": 0.8399999737739563,
            "d": "Large binary with few DLL dependencies",
            "e": [
              "dependencies.count = 2.00"
            ],
            "i": "metadata/package/metrics::import-count-under-80",
            "l": 2
          },
          {
            "a": "T1497.001",
            "c": 0.949999988079071,
            "d": "Regex component marker",
            "e": [
              "binary.string_count = 14328.00"
            ],
            "i": "objectives/anti-analysis/vm-detect/vendor::comprehensive-evasion-cond-1--inline-17219",
            "l": 1
          },
          {
            "c": 0.4000000059604645,
            "d": "Embedded ZIP archive",
            "e": [
              "50 4B 03 04"
            ],
            "i": "micro-behaviors/data/embedded/payload/archive::zip-magic",
            "l": 2,
            "el": [
              "0xd4cd7"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "ELF dynstr section name",
            "e": [
              ".dynstr"
            ],
            "i": "metadata/hardening/missing::elf-dynstr-section-name",
            "l": 2,
            "el": [
              "0x24d9fd"
            ]
          },
          {
            "a": "T1106",
            "c": 0.8999999761581421,
            "d": "Syscall with immediate number",
            "e": [
              "0e 00 00 00",
              "c8 00 00 00",
              "02 00 00 00",
              "ba 00 00 00",
              "1b 00 00 00",
              "0d 00 00 00",
              "09 00 00 00",
              "3e 00 00 00",
              "27 00 00 00",
              "26 00 00 00",
              "0f 00 00 00",
              "17 00 00 00",
              "03 00 00 00",
              "01 00 00 00",
              "e7 00 00 00"
            ],
            "i": "objectives/evasion/anti-av/syscall::syscall-with-number",
            "l": 1,
            "m": "B0009",
            "el": [
              "0x5f863",
              "0x5f70d",
              "0x5f60d",
              "0x5f6f0",
              "0x5f76f",
              "0x5f894",
              "0x5f90d",
              "0x5f72d",
              "0x5f720",
              "0x5f74e",
              "0x5f8e0",
              "0x5f6d6",
              "0x5f634",
              "0x5f65e",
              "0x5f5f4"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "ELF dynamic section name",
            "e": [
              ".dynamic"
            ],
            "i": "metadata/hardening/missing::elf-dynamic-section-name",
            "l": 2,
            "el": [
              "0x24d9ec"
            ]
          },
          {
            "a": "T1027",
            "d": "Binary is 1MB or larger",
            "e": [
              "f3dda37a24cab0e83b4f5a5a5e1b466cab8c1613821526a611c75f9a36035c60.elf"
            ],
            "i": "objectives/anti-static/obfuscation/binary-metrics/shape::file-size-1m-plus",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1059.004",
            "c": 0.9399999976158142,
            "d": "Garbled Go remote tasking capability",
            "e": [
              ".WriteByte",
              "/usr/lib/go-1.6/src/os/exec_posix.go",
              ".WriteString",
              ".ReadFrom",
              ".WriteTo",
              "/usr/lib/go-1.6/src/os/exec_unix.go"
            ],
            "i": "objectives/command-and-control/remote-command/control::go-garbled-remote-tasking-capability",
            "l": 1,
            "el": [
              "0x291d16",
              "0x29a5ae",
              "0x291cfc",
              "0x28f3fc",
              "0x28f444",
              "0x29a5d6"
            ]
          }
        ],
        "sha": "f3dda37a24cab0e83b4f5a5a5e1b466cab8c1613821526a611c75f9a36035c60",
        "path": "f3dda37a24cab0e83b4f5a5a5e1b466cab8c1613821526a611c75f9a36035c60.elf",
        "type": "elf"
      }
    ],
    "tv": "52045"
  }
}