{
  "ml": {
    "v": "5",
    "fs": [
      {
        "id": 0,
        "prob": 0.8911781907081604,
        "class": 0,
        "threshold": 0.9987763166427612
      }
    ],
    "prob": 0.8911782,
    "class": 0,
    "level": 3,
    "models": [
      {
        "m": "az",
        "prob": 0.8911782,
        "class": 0
      },
      {
        "m": "az/native",
        "prob": 0.8220408,
        "class": 0
      },
      {
        "m": "az/elf",
        "prob": 0.98156685,
        "class": 0
      }
    ],
    "version": "v17.17",
    "threshold": 0.9987763,
    "analyzed_at": "2026-05-31T05:12:38Z"
  },
  "path": "f54b3a51d8e38d4c8111c82c2ac0ea650392c8325e45734133c5bac72587349a.elf",
  "raw": {
    "v": "5",
    "fs": [
      {
        "f": "H(Ds)",
        "x": 42,
        "ff": {
          "m": {
            "elf": {
              "parse_failed": 1.0
            },
            "file": {
              "size": 201336.0,
              "entropy": 6.38,
              "size_bytes": 201336.0
            },
            "parse": {
              "error_count": 1.0
            }
          },
          "s": [
            [
              6301,
              "u8",
              "jb8a"
            ],
            [
              24644,
              "u8",
              "bhbxB"
            ],
            [
              29509,
              "u8",
              "Ykxf"
            ],
            [
              36896,
              "u8",
              "ahax"
            ],
            [
              37110,
              "u8",
              "P6dxs"
            ],
            [
              97716,
              "u8",
              "aha8"
            ],
            [
              99287,
              "u8",
              "Tajc8i"
            ],
            [
              99531,
              "u8",
              "Tejd8"
            ],
            [
              130648,
              "u8",
              "`2@9`"
            ],
            [
              132140,
              "u8",
              "a6@9 1"
            ],
            [
              133101,
              "u8",
              "eUkJL"
            ],
            [
              133449,
              "u8",
              "XZ1J"
            ],
            [
              134046,
              "u8",
              "Aa6ky"
            ],
            [
              134523,
              "u8",
              "P831"
            ],
            [
              138495,
              "u8",
              "k1d5"
            ],
            [
              138933,
              "u8",
              "4otDHl"
            ],
            [
              139866,
              "u8",
              "qioq"
            ],
            [
              141800,
              "u8",
              "invalid mode parameter"
            ],
            [
              141856,
              "u8",
              "cannot allocate dependency buffer"
            ],
            [
              141896,
              "u8",
              "DST not allowed in SUID/SGID programs"
            ],
            [
              141936,
              "u8",
              "dl-deps.c"
            ],
            [
              141952,
              "u8",
              "cannot load auxiliary `%s' because of empty dynamic string token substitution"
            ],
            [
              142032,
              "u8",
              "empty dynamic string token substitution"
            ],
            [
              142072,
              "u8",
              "load auxiliary object=%s requested by file=%s"
            ],
            [
              142120,
              "u8",
              "cannot allocate dependency list"
            ],
            [
              142152,
              "u8",
              "map-\u003el_searchlist.r_list == NULL"
            ],
            [
              142192,
              "u8",
              "cannot allocate symbol search list"
            ],
            [
              142232,
              "u8",
              "Filters not supported with LD_TRACE_PRELINKING"
            ],
            [
              142280,
              "u8",
              "cnt \u003c= nlist"
            ],
            [
              142296,
              "u8",
              "map-\u003el_searchlist.r_list[0] == map"
            ],
            [
              142336,
              "u8",
              "_dl_map_object_deps"
            ],
            [
              142360,
              "u8",
              "calling init: %s"
            ],
            [
              142384,
              "u8",
              "calling preinit: %s"
            ],
            [
              142408,
              "u8",
              "unsupported version %s of Verneed record"
            ],
            [
              142456,
              "u8",
              "dl-version.c"
            ],
            [
              142472,
              "u8",
              "needed != NULL"
            ],
            [
              142488,
              "u8",
              "checking for version `%s' in file %s [%lu] required by file %s [%lu]"
            ],
            [
              142560,
              "u8",
              "no version information available (required by %s)"
            ],
            [
              142616,
              "u8",
              "def_offset != 0"
            ],
            [
              142632,
              "u8",
              "unsupported version %s of Verdef record"
            ],
            [
              142672,
              "u8",
              "weak version `%s' not found (required by %s)"
            ],
            [
              142720,
              "u8",
              "version `%s' not found (required by %s)"
            ],
            [
              142760,
              "u8",
              "version lookup error"
            ],
            [
              142784,
              "u8",
              "cannot allocate version reference table"
            ],
            [
              142824,
              "u8",
              "match_symbol"
            ],
            [
              142840,
              "u8",
              "_dl_check_map_versions"
            ],
            [
              142864,
              "u8",
              "RTLD_NEXT used in code not dynamically loaded"
            ],
            [
              142944,
              "u8",
              "buffer overflow detected"
            ],
            [
              142976,
              "u8",
              "Fatal glibc error: array index %zu not less than array length %zu"
            ],
            [
              199448,
              "u8",
              "GCC: (Ubuntu 9.4.0-1ubuntu1~20.04.2) 9.4.0"
            ],
            [
              199492,
              "u8",
              ".shstrtab"
            ],
            [
              199502,
              "u8",
              ".note.gnu.build-id"
            ],
            [
              199521,
              "u8",
              ".note.ABI-tag"
            ],
            [
              199535,
              "u8",
              ".rela.plt"
            ],
            [
              199545,
              "u8",
              ".init"
            ],
            [
              199551,
              "u8",
              ".text"
            ],
            [
              199557,
              "u8",
              ".fini"
            ],
            [
              199563,
              "u8",
              ".rodata"
            ],
            [
              199571,
              "u8",
              "__libc_IO_vtables"
            ],
            [
              199589,
              "u8",
              "__libc_atexit"
            ],
            [
              199603,
              "u8",
              ".eh_frame"
            ],
            [
              199613,
              "u8",
              ".gcc_except_table"
            ],
            [
              199631,
              "u8",
              ".tdata"
            ],
            [
              199638,
              "u8",
              ".tbss"
            ],
            [
              199644,
              "u8",
              ".init_array"
            ],
            [
              199656,
              "u8",
              ".fini_array"
            ],
            [
              199668,
              "u8",
              ".data.rel.ro"
            ],
            [
              199681,
              "u8",
              ".got"
            ],
            [
              199686,
              "u8",
              ".got.plt"
            ],
            [
              199695,
              "u8",
              ".data"
            ],
            [
              199701,
              "u8",
              ".bss"
            ],
            [
              199706,
              "u8",
              "__libc_freeres_ptrs"
            ],
            [
              199726,
              "u8",
              ".comment"
            ]
          ],
          "v": {
            "file.stem": "f54b3a51d8e38d4c8111c82c2ac0ea650392c8325e45734133c5bac72587349a",
            "file.basename": "f54b3a51d8e38d4c8111c82c2ac0ea650392c8325e45734133c5bac72587349a.elf"
          },
          "er": [
            [
              "malformed",
              "elf-parse"
            ]
          ],
          "id": "elf"
        },
        "id": 0,
        "sz": 201336,
        "ts": [
          {
            "a": "T1027",
            "c": 1.0,
            "d": "Malformed ELF header or section headers: ",
            "i": "anti-analysis/malformed/elf-header",
            "l": 4,
            "m": "B0001"
          },
          {
            "c": 1.0,
            "d": "Binary is not digitally signed",
            "i": "metadata/unsigned",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "File is a compiled binary",
            "e": [
              "f54b3a51d8e38d4c8111c82c2ac0ea650392c8325e45734133c5bac72587349a.elf"
            ],
            "i": "metadata/binary/framework::is-binary",
            "l": 1
          },
          {
            "c": 0.30000001192092896,
            "d": "token keyword",
            "e": [
              "token"
            ],
            "i": "micro-behaviors/data/text/keywords/lexicon::token",
            "l": 1,
            "el": [
              "0x22a80"
            ]
          },
          {
            "c": 0.30000001192092896,
            "d": "glibc reference",
            "e": [
              "Fatal glibc error: array index %zu not less than array length %zu"
            ],
            "i": "micro-behaviors/dylib/library/libc::glibc-ref",
            "l": 2,
            "el": [
              "0x22e80"
            ]
          },
          {
            "a": "T1574.006",
            "c": 0.8999999761581421,
            "d": "RTLD_NEXT pseudo-handle",
            "e": [
              "RTLD_NEXT used in code not dynamically loaded"
            ],
            "i": "micro-behaviors/dylib/lookup::rtld-next",
            "l": 3,
            "el": [
              "0x22e10"
            ]
          },
          {
            "a": "T1110.001",
            "c": 0.8500000238418579,
            "d": "Service account ubuntu",
            "e": [
              "GCC: (Ubuntu 9.4.0-1ubuntu1~20.04.2) 9.4.0"
            ],
            "i": "objectives/lateral-movement/brute-force/password::service-account-ubuntu",
            "l": 1,
            "m": "E1110",
            "el": [
              "0x30b18"
            ]
          },
          {
            "c": 0.800000011920929,
            "d": "libc version string pattern",
            "e": [
              "glibc"
            ],
            "i": "micro-behaviors/dylib/library/libc::libc-version-string",
            "l": 2,
            "el": [
              "0x22e80"
            ]
          },
          {
            "d": "overflow keyword",
            "e": [
              "buffer overflow detected"
            ],
            "i": "micro-behaviors/data/text/keywords/lexicon::overflow",
            "l": 1,
            "el": [
              "0x22e60"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "Tiny C string section ratio",
            "e": [
              " = 0.0% of total (0 / 201336 bytes)"
            ],
            "i": "metadata/binary/section/metrics::tiny-cstring-section",
            "l": 1
          },
          {
            "c": 0.9900000095367432,
            "d": "Downgrade embedded ELF markers in JRuby",
            "i": "well-known/lib/jruby::malformed-elf-downgrade",
            "l": 2
          }
        ],
        "sha": "f54b3a51d8e38d4c8111c82c2ac0ea650392c8325e45734133c5bac72587349a",
        "path": "f54b3a51d8e38d4c8111c82c2ac0ea650392c8325e45734133c5bac72587349a.elf",
        "type": "elf"
      }
    ],
    "tv": "52045"
  }
}