{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 0.8344548940658569,
        "class": 0
      }
    ],
    "prob": 0.8344549,
    "class": 0,
    "models": [
      {
        "m": "az",
        "prob": 0.8344549,
        "class": 0
      },
      {
        "m": "az/native",
        "prob": 0.07716687,
        "class": 0
      },
      {
        "m": "az/pe",
        "prob": 0.08341734,
        "class": 0
      }
    ],
    "version": "v16.16",
    "thresholds": [
      0.9979839,
      1.0
    ],
    "analyzed_at": "2026-05-11T17:38:00Z"
  },
  "path": "20845",
  "raw": {
    "v": "4",
    "fs": [
      {
        "f": "Md₂(BiSi)",
        "k": {
          "hash.imp": "c11090f075532f5e5f159980bfdfa56f",
          "pe.checksum": "0x000116ae",
          "pe.timestamp": 1365139637,
          "hash.authenti": "c0a97a68114dbd7e436f342e8d8133888992db0b3bc70fa1ce789d2e853f1082",
          "build.target_arch": "x86",
          "pe.linker_version": "1.70",
          "pe.data_directories[0].rva": 6287,
          "pe.data_directories[1].rva": 65536,
          "pe.data_directories[0].name": "import",
          "pe.data_directories[0].size": 285,
          "pe.data_directories[1].name": "resource",
          "pe.data_directories[1].size": 1084,
          "pe.version_info.company_name": "Zezuecsua",
          "pe.version_info.file_version": "3.7",
          "pe.version_info.internal_name": "Udpuvo",
          "pe.version_info.product_version": "3.7",
          "pe.version_info.file_description": "Urceyvebg miziyvah",
          "pe.section_characteristics[0].name": ".text",
          "pe.section_characteristics[1].name": ".data",
          "pe.section_characteristics[2].name": ".rsrc",
          "pe.section_characteristics[0].raw_size": 2560,
          "pe.section_characteristics[1].raw_size": 18432,
          "pe.section_characteristics[2].raw_size": 1536,
          "pe.section_characteristics[0].virtual_size": 2476,
          "pe.section_characteristics[1].virtual_size": 57344,
          "pe.section_characteristics[2].virtual_size": 1084,
          "pe.section_characteristics[0].virtual_address": 4096,
          "pe.section_characteristics[1].virtual_address": 8192,
          "pe.section_characteristics[2].virtual_address": 65536,
          "pe.section_characteristics[0].characteristics_hex": "60000020",
          "pe.section_characteristics[1].characteristics_hex": "c0000040",
          "pe.section_characteristics[2].characteristics_hex": "c0000040"
        },
        "x": 4,
        "id": 0,
        "is": [
          "VirtualAlloc",
          "GetTextMetricsA",
          "ExtractIconA",
          "GetSaveFileNameA"
        ],
        "ms": {
          "pe": {
            "entry": 4096.0,
            "machine": 332.0,
            "checksum": 71342.0,
            "rsrc_size": 1536.0,
            "subsystem": 2.0,
            "timestamp": 1365139637.0,
            "image_base": 4194304.0,
            "has_checksum": true,
            "rsrc_entropy": 1.49,
            "entry_section": ".text",
            "size_of_image": 69632.0,
            "file_alignment": 512.0,
            "characteristics": 271.0,
            "size_of_headers": 512.0,
            "export_timestamp": 0.0,
            "import_dll_count": 4.0,
            "computed_checksum": 81991.0,
            "section_alignment": 4096.0,
            "resource_timestamp": 0.0,
            "has_export_timestamp": false,
            "linker_major_version": 1.0,
            "linker_minor_version": 70.0,
            "has_resource_timestamp": false,
            "number_of_rva_and_sizes": 16.0
          },
          "file": {
            "size": 23040.0
          },
          "binary": {
            "code_size": 2560.0,
            "func_count": 1.0,
            "code_entropy": 1.1,
            "data_entropy": 5.91,
            "func_density": 0.4,
            "import_count": 4.0,
            "string_count": 27.0,
            "avg_func_size": 143.0,
            "section_count": 3.0,
            "avg_complexity": 6.0,
            "import_density": 1.6,
            "max_complexity": 6.0,
            "string_density": 10.8,
            "overall_entropy": 2.83,
            "avg_basic_blocks": 9.0,
            "avg_section_size": 7509.33,
            "dependency_count": 4.0,
            "entropy_variance": 2.18,
            "avg_string_length": 11.63,
            "complexity_per_kb": 2.4,
            "max_string_length": 40.0,
            "wide_string_count": 12.0,
            "avg_string_entropy": 2.91,
            "code_to_data_ratio": 0.13,
            "data_to_file_ratio": 0.8,
            "rsrc_to_file_ratio": 0.07,
            "text_to_file_ratio": 0.11,
            "total_basic_blocks": 9.0,
            "func_analysis_depth": 2.0,
            "string_length_stddev": 6.8,
            "largest_section_ratio": 0.8,
            "sentence_string_count": 1.0,
            "sentence_string_ratio": 0.04,
            "writable_section_count": 2.0,
            "behavioral_import_ratio": 0.25,
            "executable_section_count": 1.0
          }
        },
        "ss": [
          [
            77,
            "!This program cannot be run in DOS mode."
          ],
          [
            376,
            ".text"
          ],
          [
            456,
            ".rsrc"
          ],
          [
            2803,
            "kernel32.dll"
          ],
          [
            2816,
            "gdi32.dll"
          ],
          [
            2826,
            "shell32.dll"
          ],
          [
            2838,
            "comdlg32.dll"
          ],
          [
            2870,
            "VirtualAlloc"
          ],
          [
            2902,
            "GetTextMetricsA"
          ],
          [
            2938,
            "ExtractIconA"
          ],
          [
            2970,
            "GetSaveFileNameA"
          ],
          [
            5674,
            "U99X"
          ],
          [
            14000,
            "FF7VX"
          ],
          [
            17591,
            "Finit"
          ],
          [
            19717,
            "USL7"
          ],
          [
            22110,
            "wide",
            "VS_VERSION_INFO"
          ],
          [
            22202,
            "wide",
            "StringFileInfo"
          ],
          [
            22262,
            "wide",
            "CompanyName"
          ],
          [
            22288,
            "wide",
            "Zezuecsua"
          ],
          [
            22314,
            "wide",
            "FileDescription"
          ],
          [
            22348,
            "wide",
            "Urceyvebg miziyvah"
          ],
          [
            22394,
            "wide",
            "FileVersion"
          ],
          [
            22434,
            "wide",
            "ProductVersion"
          ],
          [
            22478,
            "wide",
            "InternalName"
          ],
          [
            22504,
            "wide",
            "Udpuvo"
          ],
          [
            22526,
            "wide",
            "VarFileInfo"
          ],
          [
            22558,
            "wide",
            "Translation"
          ]
        ],
        "sz": 23040,
        "ts": [
          {
            "a": "T1027",
            "c": 0.699999988079071,
            "d": "Code section dominates file layout",
            "e": [
              "binary.largest_section_ratio = 0.80"
            ],
            "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.699999988079071,
            "d": "PE has few sections",
            "e": [
              "binary.section_count = 3.00"
            ],
            "i": "metadata/binary/layout::legacy-few-sections",
            "l": 2
          },
          {
            "a": "T1036.005",
            "c": 0.9700000286102295,
            "d": "PE has no Authenticode signature",
            "e": [
              "binary.has_signature = 0.00"
            ],
            "i": "objectives/evasion/masquerade/version-resource/microsoft-utility::dw20-host-unsigned",
            "l": 1,
            "m": "F0004"
          },
          {
            "c": 0.699999988079071,
            "d": "PE InternalName metadata field",
            "e": [
              "InternalName"
            ],
            "i": "metadata/package/versioning::pe-internalname-field",
            "l": 2
          },
          {
            "c": 0.800000011920929,
            "d": "Tiny PE single-function stub",
            "e": [
              "binary.func_count = 1.00"
            ],
            "i": "metadata/binary/layout::tiny-single-function-pe",
            "l": 3
          },
          {
            "c": 0.75,
            "d": "Binary exports no symbols",
            "e": [
              "binary.export_count = 0.00"
            ],
            "i": "metadata/binary/symbols/exports::no-exports",
            "l": 1
          },
          {
            "a": "T1587.001",
            "c": 0.8999999761581421,
            "d": "Allocate virtual memory",
            "e": [
              "VirtualAlloc"
            ],
            "i": "micro-behaviors/mem/protect/modify::virtual-alloc",
            "l": 2
          },
          {
            "c": 0.800000011920929,
            "d": "Regex component marker",
            "e": [
              "StringFileInfo"
            ],
            "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "PE standard code/data section",
            "e": [
              ".text",
              ".data"
            ],
            "i": "metadata/binary/section/names::pe-code-data-standard-section",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Binary has low average complexity",
            "e": [
              "binary.avg_complexity = 6.00"
            ],
            "i": "metadata/binary/metrics/threshold::avg-complexity-15-max",
            "l": 2
          },
          {
            "c": 0.949999988079071,
            "d": "PE version info numeric fields present",
            "e": [
              "3.7"
            ],
            "i": "metadata/binary/anomaly/format::version-info-file-version-present",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "PE resource section",
            "e": [
              ".rsrc"
            ],
            "i": "metadata/binary/section/names::pe-resource-section",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "PE FileDescription metadata field",
            "e": [
              "FileDescription"
            ],
            "i": "metadata/package/versioning::pe-filedescription-field",
            "l": 2
          },
          {
            "c": 0.800000011920929,
            "d": "Very low code entropy, minimal code",
            "e": [
              "binary.code_entropy = 1.10"
            ],
            "i": "metadata/binary/resource::low-code-entropy",
            "l": 2
          },
          {
            "a": "T1027.007",
            "c": 1.0,
            "d": "WININET.DLL absent from PE import table",
            "e": [
              "pe.import_dll_count = 4.00"
            ],
            "i": "objectives/anti-static/obfuscation/imports::wininet-import-absent",
            "l": 2,
            "m": "B0032"
          },
          {
            "c": 0.8999999761581421,
            "d": "PE mapped image under 768 KiB",
            "e": [
              "pe.size_of_image = 69632.00"
            ],
            "i": "metadata/binary/layout::image-under-768kb",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.9900000095367432,
            "d": "PE version resource text",
            "e": [
              "VS_VERSION_INFO"
            ],
            "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info",
            "l": 1,
            "m": "B0032"
          },
          {
            "d": "Few detected functions (stub-like or analysis-limited)",
            "e": [
              "binary.func_count = 1.00"
            ],
            "i": "metadata/binary/metrics/structural::no-functions",
            "l": 2
          },
          {
            "a": "T1027",
            "c": 0.8399999737739563,
            "d": "VB6 PE with three sections",
            "e": [
              "binary.section_count = 3.00"
            ],
            "i": "objectives/anti-static/obfuscation/payload/string-sparse::three-section-vb6-layout",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.699999988079071,
            "d": "PE with six or fewer imports",
            "e": [
              "binary.import_count = 4.00"
            ],
            "i": "metadata/binary/symbols/imports::pe-imports-max-six",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "PE CompanyName metadata field",
            "e": [
              "CompanyName"
            ],
            "i": "metadata/package/versioning::pe-companyname-field",
            "l": 2
          },
          {
            "c": 0.699999988079071,
            "d": "PE has low overall entropy",
            "e": [
              "binary.overall_entropy = 2.83"
            ],
            "i": "metadata/binary/layout::low-overall-entropy",
            "l": 2
          },
          {
            "c": 0.8999999761581421,
            "d": "PE has under ten imports",
            "e": [
              "binary.import_count = 4.00"
            ],
            "i": "objectives/anti-static/pack/runtime::pe-import-count-under-10",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Binary has low average string entropy",
            "e": [
              "binary.avg_string_entropy = 2.91"
            ],
            "i": "metadata/binary/metrics/threshold::avg-string-entropy-4-max",
            "l": 2
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "VB6 binary with very few strings",
            "e": [
              "binary.string_count = 27.00"
            ],
            "i": "objectives/anti-static/obfuscation/payload/string-sparse::low-string-count-vb6",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 1.0,
            "d": "Binary has 4 or fewer sections",
            "e": [
              "binary.section_count = 3.00"
            ],
            "i": "objectives/command-and-control/infrastructure/config::max-sections-4",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "Binary has low overall entropy",
            "e": [
              "binary.overall_entropy = 2.83"
            ],
            "i": "metadata/binary/metrics/threshold::low-overall-entropy-binary",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "File is a compiled binary",
            "e": [
              "20845"
            ],
            "i": "metadata/binary/framework::is-binary",
            "l": 1
          },
          {
            "a": "T1070.006",
            "c": 0.699999988079071,
            "d": "PE header compile timestamp predates 2025",
            "e": [
              "pe.timestamp = 1365139637.00"
            ],
            "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "Small PE resource section",
            "e": [
              "pe.rsrc_size = 1536.00"
            ],
            "i": "metadata/package/versioning::pe-small-rsrc",
            "l": 1
          },
          {
            "d": ".dll extension reference",
            "e": [
              ".dll"
            ],
            "i": "micro-behaviors/fs/path/extension::dll-dup",
            "l": 2
          },
          {
            "c": 0.949999988079071,
            "d": "PE FileDescription field is populated",
            "e": [
              "Urceyvebg miziyvah"
            ],
            "i": "metadata/package/versioning::pe-file-description-present",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "Tiny C string section ratio",
            "e": [
              " = 0.0% of total (0 / 23040 bytes)"
            ],
            "i": "metadata/binary/section/metrics::tiny-cstring-section",
            "l": 1
          },
          {
            "a": "T1587.001",
            "c": 0.8999999761581421,
            "d": "VirtualAlloc API string reference",
            "e": [
              "VirtualAlloc"
            ],
            "i": "micro-behaviors/mem/protect/modify::virtual-alloc-string",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.800000011920929,
            "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)",
            "e": [
              "pe.resource_count = 0.00"
            ],
            "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources",
            "l": 1
          },
          {
            "a": "T1070.006",
            "c": 0.8999999761581421,
            "d": "Export timestamp is absent",
            "e": [
              "pe.has_export_timestamp = 0.00"
            ],
            "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-absent",
            "l": 2
          },
          {
            "a": "T1105",
            "c": 0.800000011920929,
            "d": "Compact PE import table",
            "e": [
              "binary.import_count = 4.00"
            ],
            "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table",
            "l": 1,
            "m": "E1105"
          },
          {
            "a": "T1027.007",
            "c": 0.8999999761581421,
            "d": "Kernel32 DLL resolution string",
            "e": [
              "kernel32.dll"
            ],
            "i": "micro-behaviors/os/api-resolution/manual::kernel32-resolver",
            "l": 1
          },
          {
            "a": "T1055",
            "c": 0.949999988079071,
            "d": "Huge null run in executable (128+ bytes)",
            "e": [
              "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00"
            ],
            "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text",
            "l": 1
          },
          {
            "a": "T1612",
            "c": 0.8500000238418579,
            "d": "PE has few icon resources",
            "e": [
              "pe.icon_count = 0.00"
            ],
            "i": "objectives/anti-static/obfuscation/payload/resource::icon-count-under-six",
            "l": 1,
            "m": "B0023"
          },
          {
            "a": "T1055",
            "c": 0.9200000166893005,
            "d": "Regex component marker",
            "e": [
              "binary.import_count = 4.00"
            ],
            "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571",
            "l": 1,
            "m": "C0041"
          },
          {
            "c": 1.0,
            "d": "Binary is not digitally signed",
            "e": [
              "binary.has_signature = 0.00"
            ],
            "i": "metadata/signed/trust-level::unsigned",
            "l": 3
          },
          {
            "a": "T1027",
            "c": 0.75,
            "d": "Large .data section (\u003e70% of",
            "e": [
              "binary.data_to_file_ratio = 0.80"
            ],
            "i": "objectives/anti-static/obfuscation/payload/encrypted::large-data-section",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.8199999928474426,
            "d": "Packed loader largest section ratio above 0.65",
            "e": [
              "binary.largest_section_ratio = 0.80"
            ],
            "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1027.007",
            "c": 0.800000011920929,
            "d": "DLL name strings without LoadLibrary import",
            "e": [
              "binary.import_count = 4.00"
            ],
            "i": "objectives/anti-static/obfuscation/string/runtime-decrypt::dll-names-no-loadlibrary",
            "l": 1,
            "m": "B0032.014"
          },
          {
            "a": "T1055",
            "c": 0.8500000238418579,
            "d": "Large null run in executable (64+ bytes)",
            "e": [
              "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00"
            ],
            "i": "objectives/anti-static/obfuscation/binary-structure::large-null-run-text",
            "l": 1
          },
          {
            "c": 0.4000000059604645,
            "d": "Very few basic blocks (analysis-limited or sparse)",
            "e": [
              "binary.total_basic_blocks = 9.00"
            ],
            "i": "metadata/binary/metrics/structural::few-basic-blocks",
            "l": 3
          },
          {
            "c": 0.9900000095367432,
            "d": "Single-function packed stub layout",
            "e": [
              "binary.func_count = 1.00"
            ],
            "i": "well-known/malware/worm/mydoom::metric-function-count-1",
            "l": 1
          },
          {
            "c": 0.6000000238418579,
            "d": "Very few sections (merged/stripped)",
            "e": [
              "binary.section_count = 3.00"
            ],
            "i": "metadata/binary/metrics/structural::few-sections",
            "l": 3
          },
          {
            "c": 0.800000011920929,
            "d": "PE executable is unsigned",
            "e": [
              "binary.has_signature = 0.00"
            ],
            "i": "metadata/signed/trust-level::unsigned-pe-executable",
            "l": 3
          },
          {
            "a": "T1027",
            "c": 0.949999988079071,
            "d": "Regex component marker",
            "e": [
              "binary.largest_section_ratio = 0.80"
            ],
            "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.949999988079071,
            "d": "links gdi32.dll (GetTextMetricsA)",
            "e": [
              "gdi32.dll"
            ],
            "i": "metadata/dylib::gdi32/dll",
            "l": 2
          },
          {
            "c": 0.949999988079071,
            "d": "links shell32.dll (ExtractIconA)",
            "e": [
              "shell32.dll"
            ],
            "i": "metadata/dylib::shell32/dll",
            "l": 2
          },
          {
            "c": 0.949999988079071,
            "d": "links kernel32.dll (VirtualAlloc)",
            "e": [
              "kernel32.dll"
            ],
            "i": "metadata/dylib::kernel32/dll",
            "l": 2
          },
          {
            "c": 0.949999988079071,
            "d": "links comdlg32.dll (GetSaveFileNameA)",
            "e": [
              "comdlg32.dll"
            ],
            "i": "metadata/dylib::comdlg32/dll",
            "l": 2
          }
        ],
        "sha": "094a41f2a153cd58f97a1c043c8b2c2cbbf26a003b05676652aa8c2964ccf0e0",
        "path": "20845",
        "type": "pe"
      }
    ],
    "tv": "46790"
  }
}