{
  "ml": {
    "v": "5",
    "fs": [
      {
        "id": 0,
        "prob": 0.8911781907081604,
        "class": 0,
        "threshold": 0.9987763166427612
      }
    ],
    "prob": 0.8911782,
    "class": 0,
    "level": 3,
    "models": [
      {
        "m": "az",
        "prob": 0.8911782,
        "class": 0
      },
      {
        "m": "az/native",
        "prob": 0.6925373,
        "class": 0
      },
      {
        "m": "az/pe",
        "prob": 0.067434214,
        "class": 0
      }
    ],
    "version": "v17.17",
    "threshold": 0.9987763,
    "analyzed_at": "2026-05-31T12:09:24Z"
  },
  "path": "04802f1aa05ff27baad8f5cf6b31b5e4a2e1dcdc51c8eb1cf236a097a8e7eb9a.exe",
  "raw": {
    "v": "5",
    "fs": [
      {
        "f": "Md(Bi₃)",
        "x": 3,
        "ff": {
          "m": {
            "pe": {
              "checksum": 236204.0,
              "checksum_valid": 0.0,
              "computed_checksum": 82117.0,
              "bss_like_section_count": 0.0,
              "section_overflow_count": 4.0,
              "misaligned_section_count": 0.0
            },
            "file": {
              "size": 54431.0,
              "entropy": 7.22,
              "size_bytes": 54431.0
            },
            "binary": {
              "is_pie": 0.0,
              "code_entropy": 7.27,
              "data_entropy": 0.0,
              "string_count": 396.0,
              "entropy_variance": 9.9,
              "avg_string_length": 4.78,
              "max_string_length": 44.0,
              "code_to_data_ratio": 0.73,
              "string_length_stddev": 2.27,
              "largest_section_ratio": 2.23,
              "sentence_string_count": 1.0,
              "sentence_string_ratio": 0.0,
              "high_entropy_string_count": 0.0
            },
            "sections": {
              "count": 4.0,
              "code_size": 121344.0,
              "entropy_max": 7.27,
              "entropy_mean": 1.82,
              "name_entropy": 2.93,
              "writable_count": 1.0,
              "executable_count": 1.0,
              "nonstandard_count": 0.0,
              "executable_writable_count": 0.0
            },
            "dependencies": {
              "count": 0.0
            }
          },
          "s": [
            [
              77,
              "u8",
              "!This program cannot be run in DOS mode."
            ],
            [
              208,
              "u8",
              "Rich"
            ],
            [
              480,
              "u8",
              ".text"
            ],
            [
              559,
              "u8",
              "@.data"
            ],
            [
              600,
              "u8",
              ".rsrc"
            ],
            [
              6048,
              "u8",
              "YQPVh"
            ],
            [
              6198,
              "u8",
              "oV f"
            ],
            [
              6232,
              "u8",
              "onPf"
            ],
            [
              7569,
              "u8",
              "SWf9M"
            ],
            [
              10261,
              "u8",
              "uTVWh"
            ],
            [
              12577,
              "u8",
              "f90u"
            ],
            [
              12790,
              "u8",
              "5D4B"
            ],
            [
              19106,
              "u8",
              "UVWS"
            ],
            [
              27219,
              "u8",
              "SVWUj"
            ],
            [
              27513,
              "u8",
              "UQPXY]Y["
            ],
            [
              35401,
              "u8",
              "6MMU"
            ],
            [
              35783,
              "u8",
              "ffMe"
            ],
            [
              36953,
              "u8",
              "/Qo0yV"
            ],
            [
              41749,
              "u8",
              "M2H8"
            ],
            [
              43730,
              "u8",
              "86GR"
            ],
            [
              45934,
              "u8",
              "rpbWjG"
            ],
            [
              47177,
              "u8",
              "t0UZP"
            ],
            [
              47922,
              "u8",
              "5DxVG"
            ],
            [
              48734,
              "u8",
              "LDSRw"
            ],
            [
              49937,
              "u8",
              "mwIx"
            ],
            [
              50513,
              "u8",
              "sjPpb"
            ],
            [
              50898,
              "u8",
              "/AL4ep"
            ],
            [
              51622,
              "u8",
              "/V1Io"
            ]
          ],
          "v": {
            "file.stem": "04802f1aa05ff27baad8f5cf6b31b5e4a2e1dcdc51c8eb1cf236a097a8e7eb9a",
            "pe.machine": "i386",
            "pe.rich.key": 3668304339,
            "pe.rich.hash": "e710f7babb7adfde69df5f86090f82b4",
            "pe.subsystem": "windows_gui",
            "pe.timestamp": 1694374401,
            "file.basename": "04802f1aa05ff27baad8f5cf6b31b5e4a2e1dcdc51c8eb1cf236a097a8e7eb9a.exe",
            "pe.image_base": 4194304,
            "pe.image_size": 37875712,
            "pe.machine_id": 332,
            "pe.os_version": "5.1",
            "pe.entry_point": 9217,
            "pe.headers_size": 1024,
            "pe.entry_section": ".text",
            "pe.subsystem_raw": 2,
            "pe.file_alignment": 512,
            "pe.section_alignment": 4096,
            "pe.subsystem_version": "5.1",
            "pe.characteristics[0]": "relocs_stripped",
            "pe.characteristics[1]": "executable_image",
            "pe.characteristics[2]": "32bit_machine",
            "pe.characteristics_raw": 259,
            "pe.inflated_sections[0]": ".data",
            "pe.linker_major_version": 10,
            "build.toolchain.compiler": "msvc",
            "pe.dll_characteristics[0]": "terminal_server_aware",
            "pe.data_directories[0].rva": 137684,
            "pe.data_directories[1].rva": 37830656,
            "pe.data_directories[2].rva": 137844,
            "pe.data_directories[3].rva": 136080,
            "pe.data_directories[4].rva": 126976,
            "pe.dll_characteristics_raw": 32768,
            "pe.number_of_rva_and_sizes": 16,
            "pe.overflowing_sections[0]": ".text",
            "pe.overflowing_sections[1]": ".rdata",
            "pe.overflowing_sections[2]": ".data",
            "pe.overflowing_sections[3]": ".rsrc",
            "pe.data_directories[0].name": "import",
            "pe.data_directories[0].size": 160,
            "pe.data_directories[1].name": "resource",
            "pe.data_directories[1].size": 43648,
            "pe.data_directories[2].name": "debug",
            "pe.data_directories[2].size": 28,
            "pe.data_directories[3].name": "load_config",
            "pe.data_directories[3].size": 64,
            "pe.data_directories[4].name": "iat",
            "pe.data_directories[4].size": 424,
            "pe.rich.entries[0].build_id": 171,
            "pe.rich.entries[1].build_id": 158,
            "pe.rich.entries[2].build_id": 170,
            "pe.rich.entries[3].build_id": 147,
            "pe.rich.entries[4].build_id": 1,
            "pe.rich.entries[5].build_id": 175,
            "pe.rich.entries[6].build_id": 154,
            "pe.rich.entries[7].build_id": 157,
            "pe.rich.entries[0].use_count": 28,
            "pe.rich.entries[1].use_count": 19,
            "pe.rich.entries[2].use_count": 88,
            "pe.rich.entries[3].use_count": 15,
            "pe.rich.entries[4].use_count": 111,
            "pe.rich.entries[5].use_count": 1,
            "pe.rich.entries[6].use_count": 1,
            "pe.rich.entries[7].use_count": 1,
            "pe.coff.dos_header_pe_pointer": 232,
            "pe.rich.entries[0].product_id": 30319,
            "pe.rich.entries[1].product_id": 30319,
            "pe.rich.entries[2].product_id": 30319,
            "pe.rich.entries[3].product_id": 30729,
            "pe.rich.entries[5].product_id": 30319,
            "pe.rich.entries[6].product_id": 30319,
            "pe.rich.entries[7].product_id": 30319
          },
          "id": "pe",
          "sc": [
            [
              ".text",
              1024,
              121344,
              7.27,
              "r-x"
            ],
            [
              ".rdata",
              122368,
              13312,
              0.0,
              "r--"
            ],
            [
              ".data",
              135680,
              45568,
              0.0,
              "rw-"
            ],
            [
              ".rsrc",
              181248,
              44032,
              0.0,
              "r--"
            ]
          ]
        },
        "id": 0,
        "sz": 54431,
        "ts": [
          {
            "c": 0.8999999761581421,
            "d": "PE section headers declare sizes beyond end of file",
            "i": "metadata/binary/anomaly::inflated-section-headers",
            "l": 3
          },
          {
            "c": 1.0,
            "d": "File is a compiled binary",
            "e": [
              "04802f1aa05ff27baad8f5cf6b31b5e4a2e1dcdc51c8eb1cf236a097a8e7eb9a.exe"
            ],
            "i": "metadata/binary/framework::is-binary",
            "l": 1
          },
          {
            "a": "T1027.007",
            "c": 0.699999988079071,
            "d": "PE header access via e_lfanew offset",
            "e": [
              "48",
              "46",
              "41"
            ],
            "i": "objectives/anti-static/obfuscation/imports::pe-header-walk",
            "l": 1,
            "m": "B0032.014",
            "el": [
              "0x4b58",
              "0x33eb",
              "0x4b26"
            ]
          },
          {
            "c": 0.8500000238418579,
            "d": "Inline MZ header validation constant",
            "e": [
              "B8 4D 5A 00 00"
            ],
            "i": "micro-behaviors/data/embedded/payload/header::inline-mz-magic-check",
            "l": 1,
            "el": [
              "0x16bf"
            ]
          },
          {
            "c": 0.8199999928474426,
            "d": "Elevated text section entropy",
            "e": [
              ".text (entropy: 7.27)"
            ],
            "i": "metadata/binary/section/metrics::elevated-text-entropy-section",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "PE file uses .exe extension",
            "e": [
              "04802f1aa05ff27baad8f5cf6b31b5e4a2e1dcdc51c8eb1cf236a097a8e7eb9a.exe"
            ],
            "i": "metadata/binary/framework::exe-extension",
            "l": 1
          },
          {
            "c": 0.9900000095367432,
            "d": ".rsrc section present",
            "e": [
              ".rsrc"
            ],
            "i": "well-known/malware/worm/mydoom::section-rsrc",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "PE has many readable strings",
            "e": [
              "binary.string_count = 396.00"
            ],
            "i": "metadata/binary/layout::many-readable-strings",
            "l": 2
          },
          {
            "a": "T1027",
            "c": 1.0,
            "d": "Binary has normal code entropy (\u003e5.5)",
            "e": [
              "binary.code_entropy = 7.27"
            ],
            "i": "objectives/anti-static/obfuscation/binary-metrics/shape::normal-code-entropy",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.8999999761581421,
            "d": "PE standard code/data section",
            "e": [
              ".data",
              ".text"
            ],
            "i": "metadata/binary/section/names::pe-code-data-standard-section",
            "l": 1
          },
          {
            "a": "T1027.007",
            "c": 0.8500000238418579,
            "d": "MZ header validation in code",
            "e": [
              "B8 4D 5A 00 00"
            ],
            "i": "objectives/anti-static/obfuscation/imports::mz-magic-check",
            "l": 1,
            "m": "B0032.014",
            "el": [
              "0x16bf"
            ]
          },
          {
            "c": 1.0,
            "d": "Binary has 4 or fewer sections",
            "e": [
              "sections.count = 4.00"
            ],
            "i": "objectives/command-and-control/infrastructure/config::max-sections-4",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "CompanyName field absent from PE version info",
            "e": [
              "field 'pe.version.company' does not exist"
            ],
            "i": "metadata/binary/anomaly/format::version-info-company-name-absent",
            "l": 1,
            "el": [
              "value:pe.version.company"
            ]
          },
          {
            "a": "T1027",
            "c": 0.699999988079071,
            "d": "Code section dominates file layout",
            "e": [
              "binary.largest_section_ratio = 2.23"
            ],
            "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.9900000095367432,
            "d": "Exactly four sections",
            "e": [
              "sections.count = 4.00"
            ],
            "i": "well-known/malware/worm/mydoom::metric-section-count-4",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "Inline PE header walk sequence",
            "e": [
              "41",
              "48",
              "46"
            ],
            "i": "micro-behaviors/data/embedded/payload/header::inline-pe-header-walk",
            "l": 1,
            "el": [
              "0x4b26",
              "0x4b58",
              "0x33eb"
            ]
          },
          {
            "c": 0.800000011920929,
            "d": "Low-entropy rdata section",
            "e": [
              ".rdata (entropy: 0.00)"
            ],
            "i": "metadata/binary/section/metrics::low-entropy-rdata-section",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "PE with exactly four sections",
            "e": [
              "sections.count = 4.00"
            ],
            "i": "metadata/binary/metrics/structural::four-section-pe",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "PE resource section",
            "e": [
              ".rsrc"
            ],
            "i": "metadata/binary/section/names::pe-resource-section",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "PE standard runtime section",
            "e": [
              ".rdata"
            ],
            "i": "metadata/binary/section/names::pe-runtime-standard-section",
            "l": 1
          },
          {
            "c": 0.8500000238418579,
            "d": "Large zero-entropy placeholder section",
            "e": [
              ".rsrc (size: 44032, entropy: 0.00, perms: r--)",
              ".rdata (size: 13312, entropy: 0.00, perms: r--)"
            ],
            "i": "metadata/binary/section/metrics::null-placeholder-section",
            "l": 1
          },
          {
            "c": 0.9900000095367432,
            "d": ".text section present",
            "e": [
              ".text"
            ],
            "i": "well-known/malware/worm/mydoom::section-text",
            "l": 1
          },
          {
            "c": 0.949999988079071,
            "d": "PE section declared larger than file (truncated/corrupt)",
            "e": [
              "binary.largest_section_ratio = 2.23"
            ],
            "i": "metadata/binary/metrics/structural::section-exceeds-file-size",
            "l": 1
          },
          {
            "a": "T1553.002",
            "c": 0.8500000238418579,
            "d": "PE lacks VS_VERSION_INFO resource",
            "e": [
              "field 'pe.version.file_version' does not exist"
            ],
            "i": "objectives/evasion/masquerade/cert::pe-no-version-info-resource",
            "l": 1,
            "el": [
              "value:pe.version.file_version"
            ]
          },
          {
            "a": "T1027",
            "c": 0.8199999928474426,
            "d": "Packed loader largest section ratio above 0.65",
            "e": [
              "binary.largest_section_ratio = 2.23"
            ],
            "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.8500000238418579,
            "d": "High code section entropy",
            "e": [
              "binary.code_entropy = 7.27"
            ],
            "i": "metadata/binary/metrics/pe-details::high-code-entropy-go",
            "l": 3
          },
          {
            "c": 0.9200000166893005,
            "d": "Large null-filled PE resources",
            "e": [
              ".rsrc (size: 44032, entropy: 0.00)"
            ],
            "i": "metadata/binary/resource::large-null-rsrc",
            "l": 3
          },
          {
            "a": "T1055",
            "c": 0.8500000238418579,
            "d": "Large null run in executable (64+ bytes)",
            "e": [
              "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00"
            ],
            "i": "objectives/anti-static/obfuscation/binary-structure::large-null-run-text",
            "l": 1,
            "el": [
              "0x70e0"
            ]
          },
          {
            "a": "T1055",
            "c": 0.800000011920929,
            "d": "Executable section with very low entropy",
            "e": [
              ".text (size: 121344, perms: r-x)"
            ],
            "i": "objectives/anti-static/obfuscation/binary-structure::low-entropy-executable",
            "l": 1
          },
          {
            "a": "T1045",
            "c": 0.6000000238418579,
            "d": "Single section dominates file (packer",
            "e": [
              "binary.largest_section_ratio = 2.23"
            ],
            "i": "objectives/anti-static/obfuscation/binary-metrics/shape::dominant-section",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1055",
            "c": 0.949999988079071,
            "d": "Huge null run in executable (128+ bytes)",
            "e": [
              "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00"
            ],
            "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text",
            "l": 1,
            "el": [
              "0x70e0"
            ]
          },
          {
            "c": 0.949999988079071,
            "d": "Filename has EXE extension",
            "e": [
              "04802f1aa05ff27baad8f5cf6b31b5e4a2e1dcdc51c8eb1cf236a097a8e7eb9a.exe"
            ],
            "i": "objectives/evasion/masquerade/file/double-ext::basename-is-exe",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.8600000143051147,
            "d": "Dominant section for VB6 loader profile",
            "e": [
              "binary.largest_section_ratio = 2.23"
            ],
            "i": "objectives/anti-static/obfuscation/payload/string-sparse::dominant-text-layout-vb6",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.949999988079071,
            "d": "Regex component marker",
            "e": [
              "binary.largest_section_ratio = 2.23"
            ],
            "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188",
            "l": 1,
            "m": "B0032"
          }
        ],
        "sha": "04802f1aa05ff27baad8f5cf6b31b5e4a2e1dcdc51c8eb1cf236a097a8e7eb9a",
        "path": "04802f1aa05ff27baad8f5cf6b31b5e4a2e1dcdc51c8eb1cf236a097a8e7eb9a.exe",
        "type": "pe"
      }
    ],
    "tv": "52045"
  }
}