{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.004118091892451048, "class": 0 } ], "prob": 0.004118092, "class": 0, "models": [ { "m": "az", "prob": 0.001038077, "class": 0 }, { "m": "az/native", "prob": 0.004118092, "class": 0 }, { "m": "az/elf", "prob": 0.0008716613, "class": 0 } ], "version": "v16.16", "thresholds": [ 0.9953178, 0.9991311 ], "analyzed_at": "2026-05-03T07:25:38Z" }, "path": "rcrt1.o", "raw": { "v": "4", "fs": [ { "f": "O₂(AsEr)Md₂(Bi₄He)", "x": 3, "id": 0, "ms": { "elf": { "e_type": 1.0, "has_note": true, "e_machine": 62.0, "class_bits": 64.0, "note_count": 2.0, "has_eh_frame": true, "symtab_count": 10.0, "little_endian": true, "section_header_count": 15.0, "section_relocation_group_count": 2.0 }, "binary": { "code_size": 38.0, "file_size": 1816.0, "has_overlay": true, "code_entropy": 4.31, "data_entropy": 0.75, "export_count": 1.0, "overlay_size": 961.0, "string_count": 19.0, "overlay_ratio": 0.53, "section_count": 12.0, "avg_complexity": 1.0, "function_count": 1.0, "max_complexity": 1.0, "string_density": 512.0, "overall_entropy": 2.3, "overlay_entropy": 0.93, "avg_basic_blocks": 1.0, "avg_section_size": 65.33, "entropy_variance": 1.44, "function_density": 26.95, "avg_function_size": 38.0, "avg_string_length": 11.84, "complexity_per_kb": 26.95, "max_string_length": 26.0, "avg_string_entropy": 2.82, "code_to_data_ratio": 0.05, "data_to_file_ratio": 0.0, "text_to_file_ratio": 0.05, "total_basic_blocks": 1.0, "string_length_stddev": 5.71, "largest_section_ratio": 0.13, "sentence_string_count": 1.0, "sentence_string_ratio": 0.05, "function_analysis_depth": 2.0, "nonstandard_section_name_count": 2.0 } }, "ss": [ [ 81, "PTE1" ], [ 153, "GCC: (GNU) 15.2.1 20260209" ], [ 569, "__abi_tag" ], [ 579, "_GLOBAL_OFFSET_TABLE_" ], [ 601, "_IO_stdin_used" ], [ 616, "__libc_start_main" ], [ 634, "__data_start" ], [ 721, ".symtab" ], [ 729, ".strtab" ], [ 737, ".shstrtab" ], [ 747, ".rela.text" ], [ 758, ".rela.eh_frame" ], [ 773, ".data" ], [ 779, ".bss" ], [ 784, ".comment" ], [ 793, ".note.gnu.property" ], [ 812, ".note.GNU-stack" ], [ 828, ".note.ABI-tag" ], [ 842, ".rodata.cst4" ] ], "sz": 1816, "ts": [ { "c": 1.0, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "l": 2 }, { "d": "Binary exports symbols", "e": [ "binary.export_count = 1.00" ], "i": "metadata/binary/symbols::has-exports", "l": 1 }, { "c": 0.6000000238418579, "d": "Small ELF binary (\u003c 50KB)", "e": [ "rcrt1.o" ], "i": "metadata/binary/metrics::small-elf-binary", "l": 2 }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening::no-pie", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "binary.file_size = 1816.00" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 1.0, "d": "Sparse visible string surface", "e": [ "binary.string_count = 19.00" ], "i": "objectives/anti-static/obfuscation/control-flow/native::sparse-strings", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "ELF imports zero needed libraries", "e": [ "binary.dependency_count = 0.00" ], "i": "metadata/binary/linking::elf-needed-libs-zero", "l": 2 }, { "d": "Few detected functions (stub-like or analysis-limited)", "e": [ "binary.function_count = 1.00" ], "i": "metadata/binary/metrics::no-functions", "l": 2 }, { "c": 1.0, "d": "Tiny ELF binary (\u003c 4KB)", "e": [ "elf.class_bits = 64.00" ], "i": "metadata/binary/metrics::tiny-elf", "l": 3 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 2.82" ], "i": "metadata/binary/metrics::avg-string-entropy-4-max", "l": 2 }, { "a": "T1106", "c": 0.949999988079071, "d": "ELF ET_DYN binary type", "e": [ "elf.e_type = 1.00" ], "i": "objectives/evasion/anti-av/syscall::elf-et-dyn", "l": 1, "m": "B0009" }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 1.00" ], "i": "metadata/binary/metrics::avg-complexity-15-max", "l": 2 }, { "c": 1.0, "d": "ELF64 class marker", "e": [ "elf.class_bits = 64.00" ], "i": "metadata/binary/metrics::elf64-class", "l": 1 }, { "c": 1.0, "d": "Binary format is identified", "e": [ "elf.class_bits = 64.00" ], "i": "metadata/binary::binary-format-checked", "l": 2 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 2.30" ], "i": "metadata/binary/metrics::low-overall-entropy-binary", "l": 1 }, { "c": 0.6000000238418579, "d": "Binary not position-independent (no ASLR)", "e": [ "elf.e_type = 1.00" ], "i": "metadata/hardening::no-pie-struct", "l": 3 }, { "c": 0.4000000059604645, "d": "Very few basic blocks (analysis-limited or sparse)", "e": [ "binary.total_basic_blocks = 1.00" ], "i": "metadata/binary/metrics::few-basic-blocks", "l": 2 }, { "c": 0.75, "d": "Low average code complexity", "e": [ "binary.avg_complexity = 1.00" ], "i": "metadata/binary/metrics::low-average-complexity", "l": 2 }, { "c": 0.75, "d": "ELF lacks dynamic linker sections", "e": [ "elf.class_bits = 64.00" ], "i": "metadata/hardening::static-linked-heuristic", "l": 3 }, { "c": 0.75, "d": "ELF lacks dynamic linker sections", "e": [ "elf.class_bits = 64.00" ], "i": "metadata/binary/linking::static-linked-heuristic", "l": 3 }, { "c": 0.800000011920929, "d": "Statically linked binary", "e": [ "elf.class_bits = 64.00", "binary.dependency_count = 0.00" ], "i": "metadata/binary/linking::static-linked", "l": 3 } ], "sha": "f7bd5f5813323ef7753a30885e0ddda41ec66b57bcae0a8bafe3c89d2b1f2b82", "path": "/data/samples/good/archlinux/usr/lib/rcrt1.o", "type": "elf" } ], "tv": "b2c18" } }