{
  "ml": {
    "v": "5",
    "fs": [
      {
        "id": 0,
        "prob": 0.8251519203186035,
        "class": 0,
        "threshold": 0.9987763166427612
      }
    ],
    "prob": 0.8251519,
    "class": 0,
    "level": 3,
    "models": [
      {
        "m": "az",
        "prob": 0.8251519,
        "class": 0
      },
      {
        "m": "az/native",
        "prob": 0.2392638,
        "class": 0
      },
      {
        "m": "az/pe",
        "prob": 0.014666666,
        "class": 0
      }
    ],
    "version": "v17.17",
    "threshold": 0.9987763,
    "analyzed_at": "2026-05-31T09:59:00Z"
  },
  "path": "09f7b6653733496bf7009e3def383c57c774978147edaa5c84e5eae493e8d242.exe",
  "raw": {
    "v": "5",
    "fs": [
      {
        "f": "Md₂(BiSi)",
        "x": 5,
        "ff": {
          "i": [
            [
              "mscoree",
              "CorExeMain"
            ]
          ],
          "m": {
            "pe": {
              "checksum": 1796470.0,
              "checksum_valid": 1.0,
              "computed_checksum": 1796470.0,
              "bss_like_section_count": 0.0,
              "section_overflow_count": 0.0,
              "misaligned_section_count": 0.0,
              "base_relocation_block_count": 1.0,
              "base_relocation_entry_count": 1.0
            },
            "file": {
              "size": 1757200.0,
              "entropy": 2.67,
              "size_bytes": 1757200.0
            },
            "binary": {
              "is_pie": 1.0,
              "has_overlay": 1.0,
              "code_entropy": 2.62,
              "overlay_size": 7184.0,
              "string_count": 32430.0,
              "overlay_ratio": 0.0,
              "overlay_entropy": 7.5,
              "entropy_variance": 1.58,
              "avg_string_length": 52.72,
              "max_string_length": 916390.0,
              "code_to_data_ratio": 1.0,
              "string_length_stddev": 5088.55,
              "largest_section_ratio": 1.0,
              "sentence_string_count": 8.0,
              "sentence_string_ratio": 0.0,
              "high_entropy_string_count": 0.0
            },
            "imports": {
              "count": 1.0
            },
            "sections": {
              "count": 2.0,
              "code_size": 1748992.0,
              "entropy_max": 2.62,
              "entropy_mean": 1.36,
              "name_entropy": 2.91,
              "writable_count": 0.0,
              "executable_count": 1.0,
              "nonstandard_count": 0.0,
              "executable_writable_count": 0.0
            },
            "dependencies": {
              "count": 1.0
            }
          },
          "s": [
            [
              77,
              "u8",
              "!This program cannot be run in DOS mode."
            ],
            [
              376,
              "u8",
              ".text"
            ],
            [
              5213,
              "u8",
              "UInt32"
            ],
            [
              5227,
              "u8",
              "\u003cModule\u003e"
            ],
            [
              5236,
              "u8",
              "System.IO"
            ],
            [
              5246,
              "u8",
              "System.Web"
            ],
            [
              5257,
              "u8",
              "mscorlib"
            ],
            [
              5266,
              "u8",
              "Microsoft.VisualBasic"
            ],
            [
              5288,
              "u8",
              "TrimEnd"
            ],
            [
              5296,
              "u8",
              "CompareMethod"
            ],
            [
              5310,
              "u8",
              "Replace"
            ],
            [
              5318,
              "u8",
              "IClrStrongName"
            ],
            [
              5333,
              "u8",
              "Type"
            ],
            [
              5338,
              "u8",
              "System.Core"
            ],
            [
              5350,
              "u8",
              "WriteByte"
            ],
            [
              5360,
              "u8",
              "ToByte"
            ],
            [
              5367,
              "u8",
              "GetObjectValue"
            ],
            [
              5382,
              "u8",
              "NewLateBinding"
            ],
            [
              5397,
              "u8",
              "ToString"
            ],
            [
              5406,
              "u8",
              "Microsoft.Runtime.Hosting"
            ],
            [
              5432,
              "u8",
              "get_Length"
            ],
            [
              5443,
              "u8",
              "Decimal"
            ],
            [
              5451,
              "u8",
              "LateCall"
            ],
            [
              5460,
              "u8",
              "System.Xml"
            ],
            [
              5471,
              "u8",
              "MemoryStream"
            ],
            [
              5484,
              "u8",
              "System"
            ],
            [
              5491,
              "u8",
              "ResGen"
            ],
            [
              5498,
              "u8",
              "AppDomain"
            ],
            [
              5508,
              "u8",
              "get_CurrentDomain"
            ],
            [
              5526,
              "u8",
              "System.Reflection"
            ],
            [
              5544,
              "u8",
              "BaseCollection"
            ],
            [
              5559,
              "u8",
              "FieldInfo"
            ],
            [
              5617,
              "u8",
              ".zip"
            ],
            [
              5622,
              "u8",
              "ToChar"
            ],
            [
              5629,
              "u8",
              "XmlSiteMapProvider"
            ],
            [
              5648,
              "u8",
              "System.Resources.ResourceManager"
            ],
            [
              5681,
              "u8",
              "FileStyleUriParser"
            ],
            [
              5700,
              "u8",
              "Cursor"
            ],
            [
              5707,
              "u8",
              ".ctor"
            ],
            [
              5713,
              "u8",
              ".cctor"
            ],
            [
              5720,
              "u8",
              "Microsoft.VisualBasic.CompilerServices"
            ],
            [
              5759,
              "u8",
              "System.Runtime.CompilerServices"
            ],
            [
              5791,
              "u8",
              "System.Resources"
            ],
            [
              5808,
              "u8",
              "Strings"
            ],
            [
              5816,
              "u8",
              "XmlReaderSettings"
            ],
            [
              5834,
              "u8",
              "XmlWriterSettings"
            ],
            [
              5852,
              "u8",
              "System.Windows.Forms"
            ],
            [
              5873,
              "u8",
              "Conversions"
            ],
            [
              5885,
              "u8",
              "get_Chars"
            ],
            [
              5895,
              "u8",
              "RuntimeHelpers"
            ],
            [
              5910,
              "u8",
              "Object"
            ],
            [
              5917,
              "u8",
              "LateGet"
            ],
            [
              5925,
              "u8",
              "Split"
            ],
            [
              5931,
              "u8",
              "TrimStart"
            ],
            [
              5941,
              "u8",
              "ToArray"
            ],
            [
              1749278,
              "u8",
              "mscoree.dll"
            ],
            [
              1750082,
              "u8",
              "N0L0"
            ],
            [
              1750309,
              "u8",
              "1604"
            ],
            [
              1750632,
              "u8",
              "201222235924Z"
            ],
            [
              1750647,
              "u8",
              "211222235924Z0"
            ],
            [
              1751240,
              "u8",
              "C0A0"
            ],
            [
              1752387,
              "u8",
              "20201222235925Z"
            ],
            [
              1752435,
              "u8",
              "Greater Manchester1"
            ],
            [
              1752464,
              "u8",
              "Salford1"
            ],
            [
              1752482,
              "u8",
              "Sectigo Limited1,0*"
            ],
            [
              1752507,
              "u8",
              "#Sectigo RSA Time Stamping Signer #2"
            ],
            [
              1752667,
              "u8",
              "Sectigo Limited1%0#"
            ],
            [
              1752693,
              "u8",
              "Sectigo RSA Time Stamping CA0"
            ],
            [
              1752740,
              "u8",
              "320122235959Z0"
            ],
            [
              1752852,
              "u8",
              "#Sectigo RSA Time Stamping Signer #20"
            ],
            [
              1753371,
              "u8",
              "vIhb"
            ],
            [
              1753572,
              "u8",
              "90705"
            ],
            [
              1753607,
              "u8",
              "https://sectigo.com/CPS0D"
            ],
            [
              1753648,
              "u8",
              "3http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t"
            ],
            [
              1753729,
              "u8",
              "3http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#"
            ],
            [
              1753795,
              "u8",
              "http://ocsp.sectigo.com0"
            ],
            [
              1753891,
              "u8",
              "WUpKN"
            ],
            [
              1754423,
              "u8",
              "New Jersey1"
            ],
            [
              1754444,
              "u8",
              "Jersey City1"
            ],
            [
              1754466,
              "u8",
              "The USERTRUST Network1.0,"
            ],
            [
              1754497,
              "u8",
              "%USERTrust RSA Certification Authority0"
            ],
            [
              1754539,
              "u8",
              "190502000000Z"
            ],
            [
              1755400,
              "u8",
              "I0G0E"
            ],
            [
              1755410,
              "u8",
              "?http://crl.usertrust.com/USERTrustRSACertificationAuthority.crl0v"
            ],
            [
              1755503,
              "u8",
              "3http://crt.usertrust.com/USERTrustRSAAddTrustCA.crt0%"
            ],
            [
              1755569,
              "u8",
              "http://ocsp.usertrust.com0"
            ],
            [
              1755772,
              "u8",
              "mAmg"
            ],
            [
              1756239,
              "u8",
              "Sectigo RSA Time Stamping CA"
            ],
            [
              1756612,
              "u8",
              "%USERTrust RSA Certification Authority"
            ]
          ],
          "v": {
            "file.stem": "09f7b6653733496bf7009e3def383c57c774978147edaa5c84e5eae493e8d242",
            "pe.imphash": "f34d5f2d4577ed6d9ceec516c1f5a744",
            "pe.machine": "i386",
            "pe.subsystem": "windows_gui",
            "pe.timestamp": 1608681564,
            "file.basename": "09f7b6653733496bf7009e3def383c57c774978147edaa5c84e5eae493e8d242.exe",
            "pe.image_base": 4194304,
            "pe.image_size": 1769472,
            "pe.machine_id": 332,
            "pe.os_version": "4.0",
            "pe.entry_point": 1756974,
            "pe.headers_size": 512,
            "pe.entry_section": ".text",
            "pe.subsystem_raw": 2,
            "pe.clr.is_il_only": 1,
            "pe.file_alignment": 512,
            "pe.cert_table_size": 7184,
            "pe.image_hash.sha1": "65dca8add49d32885dc7b2f8d7050e56254dee6c",
            "pe.image_hash.sha256": "d13aaa1bc4279abee5ea5c1498e5b31157240ee262236125f04884ee500a4f0a",
            "pe.image_hash.sha384": "cf6494c68a26f628f9b0cebd922014df9a0db32c9cbee02a5d803a38877950218154bffc26d26e35f5cb1cbd2b0e92c0",
            "pe.image_hash.sha512": "4bf4e5a23bca9e3324a8cb9efab13c6e9cb7692ba2f4fce58c5e1dbc8c9d6499e484861baeea440378f2b6cfda0d60199cd14a87d4344d4da769751b63362f49",
            "pe.section_alignment": 8192,
            "pe.subsystem_version": "4.0",
            "pe.characteristics[0]": "executable_image",
            "pe.characteristics[1]": "32bit_machine",
            "pe.characteristics_raw": 258,
            "pe.clr.runtime_version": "2.5",
            "pe.linker_major_version": 11,
            "pe.signatures[0].issuer": "C=???????????????,ST=娜勒娜西ОО豆西吉西勒娜О豆娜西吉勒豆吉吉豆西西,L=屁Н贝Н贝Ю屁,TITLE=娜П艾艾吉吉吉艾吉艾艾艾娜艾艾艾吉П艾П艾艾ПЮЮ艾吉娜,EMAIL=??????????????????????,OU=儿弗艾德儿艾德德德德儿德德弗艾,O=吉艾诶诶艾吉诶诶艾开诶开诶艾艾艾开,CN=尺诶维维马诶维",
            "pe.signatures[0].serial": "0b6f92aae7afef1be4094bd31ad72905",
            "pe.signatures[0].subject": "C=???????????????,ST=娜勒娜西ОО豆西吉西勒娜О豆娜西吉勒豆吉吉豆西西,L=屁Н贝Н贝Ю屁,TITLE=娜П艾艾吉吉吉艾吉艾艾艾娜艾艾艾吉П艾П艾艾ПЮЮ艾吉娜,EMAIL=??????????????????????,OU=儿弗艾德儿艾德德德德儿德德弗艾,O=吉艾诶诶艾吉诶诶艾开诶开诶艾艾艾开,CN=尺诶维维马诶维",
            "pe.dll_characteristics[0]": "dynamic_base",
            "pe.dll_characteristics[1]": "nx_compat",
            "pe.dll_characteristics[2]": "no_seh",
            "pe.dll_characteristics[3]": "terminal_server_aware",
            "pe.signatures[0].verified": true,
            "pe.data_directories[0].rva": 1756888,
            "pe.data_directories[1].rva": 1750016,
            "pe.data_directories[2].rva": 1761280,
            "pe.data_directories[3].rva": 8192,
            "pe.data_directories[4].rva": 8200,
            "pe.dll_characteristics_raw": 34112,
            "pe.number_of_rva_and_sizes": 16,
            "pe.signatures[0].not_after": "2021-12-22T23:59:24Z",
            "pe.data_directories[0].name": "import",
            "pe.data_directories[0].size": 83,
            "pe.data_directories[1].name": "certificate",
            "pe.data_directories[1].size": 7184,
            "pe.data_directories[2].name": "base_relocation",
            "pe.data_directories[2].size": 12,
            "pe.data_directories[3].name": "iat",
            "pe.data_directories[3].size": 8,
            "pe.data_directories[4].name": "clr_runtime_header",
            "pe.data_directories[4].size": 72,
            "pe.signatures[0].not_before": "2020-12-22T23:59:24Z",
            "pe.signatures[0].self_issued": true,
            "pe.coff.dos_header_pe_pointer": 128,
            "pe.base_relocations.block_count": 1,
            "pe.base_relocations.entry_count": 1,
            "pe.signatures[0].thumbprint_sha1": "4ec1ba06044234e1166eba2c8910df84ca05af06",
            "pe.base_relocations.padding_count": 1,
            "pe.signatures[0].cert_chain_depth": 1,
            "pe.signatures[0].digest_algorithm": "sha256",
            "pe.signatures[0].eku_code_signing": true,
            "pe.signatures[0].signature_digest": "d13aaa1bc4279abee5ea5c1498e5b31157240ee262236125f04884ee500a4f0a",
            "pe.signatures[0].thumbprint_sha256": "855873bc62e4a188be29ba7cd67e6cec2beb1fbf78301ea5749e88b7b661db86",
            "pe.signatures[0].signature_algorithm": "sha256WithRSAEncryption",
            "pe.signatures[0].signature_digest_algorithm": "sha256"
          },
          "id": "pe",
          "sc": [
            [
              ".text",
              512,
              1748992,
              2.62,
              "r-x"
            ],
            [
              ".reloc",
              1749504,
              512,
              0.1,
              "r--"
            ]
          ]
        },
        "id": 0,
        "sz": 1757200,
        "ts": [
          {
            "c": 1.0,
            "d": ".NET assembly detected via BSJB CLR metadata signature",
            "e": [
              "BSJB at offset 0xf2c"
            ],
            "i": "metadata/dotnet/bsjb-signature",
            "l": 2,
            "el": [
              "0xf2c"
            ]
          },
          {
            "c": 1.0,
            "d": "Authenticode chain CN: 尺诶维维马诶维",
            "e": [
              "尺诶维维马诶维"
            ],
            "i": "metadata/signed/unknown::尺诶维维马诶维",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "Signed by 吉艾诶诶艾吉诶诶艾开诶开诶艾艾艾开",
            "e": [
              "吉艾诶诶艾吉诶诶艾开诶开诶艾艾艾开"
            ],
            "i": "metadata/signed/leaf::吉艾诶诶艾吉诶诶艾开诶开诶艾艾艾开",
            "l": 3
          },
          {
            "c": 0.8799999952316284,
            "d": "Native runtime binary is large",
            "e": [
              "09f7b6653733496bf7009e3def383c57c774978147edaa5c84e5eae493e8d242.exe"
            ],
            "i": "metadata/lang/compiler/aot::native-runtime-large-file",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "File larger than 1MB",
            "e": [
              "09f7b6653733496bf7009e3def383c57c774978147edaa5c84e5eae493e8d242.exe"
            ],
            "i": "metadata/binary/metrics/size::large-file-1mb",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "File is a compiled binary",
            "e": [
              "09f7b6653733496bf7009e3def383c57c774978147edaa5c84e5eae493e8d242.exe"
            ],
            "i": "metadata/binary/framework::is-binary",
            "l": 1
          },
          {
            "a": "T1140",
            "c": 0.8999999761581421,
            "d": "VB LateGet dispatch token",
            "e": [
              "LateGet"
            ],
            "i": "objectives/command-and-control/dropper/staging/embedded::vb-lateget-token",
            "l": 1,
            "m": "B0030",
            "el": [
              "0x171d"
            ]
          },
          {
            "c": 0.699999988079071,
            "d": "Reflection method namespace token",
            "e": [
              "System.Reflection"
            ],
            "i": "objectives/anti-static/obfuscation/reflection/invoke::namespace-import",
            "l": 1,
            "el": [
              "0x1596"
            ]
          },
          {
            "c": 1.0,
            "d": ".NET Metadata Root (BSJB)",
            "e": [
              "BSJB"
            ],
            "i": "metadata/binary/framework::dotnet-metadata",
            "l": 2
          },
          {
            "c": 0.6000000238418579,
            "d": "AppDomain.CurrentDomain accessor",
            "e": [
              "get_CurrentDomain"
            ],
            "i": "objectives/anti-static/obfuscation/reflection/invoke::appdomain-currentdomain",
            "l": 1,
            "el": [
              "0x1584"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "PE contains many extracted strings",
            "e": [
              "binary.string_count = 32430.00"
            ],
            "i": "metadata/package/quality::high-string-count-pe",
            "l": 1
          },
          {
            "d": ".dll extension reference",
            "e": [
              ".dll"
            ],
            "i": "micro-behaviors/fs/path/extension::dll-dup",
            "l": 2,
            "el": [
              "0x1ab11e"
            ]
          },
          {
            "c": 0.699999988079071,
            "d": "PE has few sections",
            "e": [
              "sections.count = 2.00"
            ],
            "i": "metadata/binary/layout::legacy-few-sections",
            "l": 2
          },
          {
            "c": 0.6499999761581421,
            "d": "AppDomain class token",
            "e": [
              "AppDomain"
            ],
            "i": "objectives/anti-static/obfuscation/reflection/invoke::appdomain-class-token",
            "l": 1,
            "el": [
              "0x157a"
            ]
          },
          {
            "a": "T1027.003",
            "c": 0.7799999713897705,
            "d": ".NET resource manager reference",
            "e": [
              "System.Resources.ResourceManager"
            ],
            "i": "micro-behaviors/data/embedded/payload/image::dotnet-resource-manager-token",
            "l": 1,
            "m": "F0001.006",
            "el": [
              "0x1610"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "PE file uses .exe extension",
            "e": [
              "09f7b6653733496bf7009e3def383c57c774978147edaa5c84e5eae493e8d242.exe"
            ],
            "i": "metadata/binary/framework::exe-extension",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Binary has 1000 or more strings",
            "e": [
              "binary.string_count = 32430.00"
            ],
            "i": "metadata/binary/metrics/threshold::string-count-1000-plus",
            "l": 2
          },
          {
            "c": 0.8999999761581421,
            "d": "mscorlib reference",
            "e": [
              "mscorlib"
            ],
            "i": "metadata/lang/compiler/managed::mscorlib",
            "l": 2,
            "el": [
              "0x1489"
            ]
          },
          {
            "c": 0.699999988079071,
            "d": "PE has many readable strings",
            "e": [
              "binary.string_count = 32430.00"
            ],
            "i": "metadata/binary/layout::many-readable-strings",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "Binary is 500KB+",
            "e": [
              "09f7b6653733496bf7009e3def383c57c774978147edaa5c84e5eae493e8d242.exe"
            ],
            "i": "metadata/binary/metrics/threshold::large-binary-500k",
            "l": 1
          },
          {
            "c": 0.8600000143051147,
            "d": "VB late binding token",
            "e": [
              "LateCall"
            ],
            "i": "objectives/anti-static/obfuscation/reflection/invoke::vb-latecall-token",
            "l": 1,
            "el": [
              "0x154b"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "PE standard code/data section",
            "e": [
              ".text"
            ],
            "i": "metadata/binary/section/names::pe-code-data-standard-section",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "PE import table has exactly one entry",
            "e": [
              "imports.count = 1.00"
            ],
            "i": "metadata/binary/symbols/imports::single-import-raw",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Binary has 4 or fewer sections",
            "e": [
              "sections.count = 2.00"
            ],
            "i": "objectives/command-and-control/infrastructure/config::max-sections-4",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "CompanyName field absent from PE version info",
            "e": [
              "field 'pe.version.company' does not exist"
            ],
            "i": "metadata/binary/anomaly/format::version-info-company-name-absent",
            "l": 1,
            "el": [
              "value:pe.version.company"
            ]
          },
          {
            "c": 1.0,
            "d": "NO_SEH (SafeSEH not used)",
            "e": [
              "[dynamic_base, nx_compat, no_seh, terminal_server_aware]"
            ],
            "i": "metadata/hardening/mitigation::pe-no-seh",
            "l": 2,
            "el": [
              "value:pe.dll_characteristics"
            ]
          },
          {
            "a": "T1036.001",
            "c": 0.8600000143051147,
            "d": "USERTrust certificate string in overlay",
            "e": [
              "The USERTRUST Network1.0,"
            ],
            "i": "objectives/evasion/masquerade/binary::overlay-usertrust-string",
            "l": 1,
            "el": [
              "0x1ac562"
            ]
          },
          {
            "a": "T1027",
            "c": 0.699999988079071,
            "d": "Code section dominates file layout",
            "e": [
              "binary.largest_section_ratio = 1.00"
            ],
            "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 1.0,
            "d": "PE Authenticode signature verified metadata",
            "e": [
              "true"
            ],
            "i": "metadata/signed/certificate::pe-signature-verified-kv",
            "l": 2,
            "el": [
              "value:pe.signatures[0].verified"
            ]
          },
          {
            "a": "T1027",
            "c": 0.8600000143051147,
            "d": "Giant text section dominates PE",
            "e": [
              "binary.largest_section_ratio = 1.00"
            ],
            "i": "objectives/anti-static/obfuscation/payload/camouflage::giant-text-section",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1620",
            "c": 0.949999988079071,
            "d": "mscoree DLL string reference",
            "e": [
              "mscoree.dll"
            ],
            "i": "objectives/anti-static/obfuscation/payload/loader::mscoree-name-anywhere",
            "l": 1,
            "m": "B0032",
            "el": [
              "0x1ab11e"
            ]
          },
          {
            "c": 0.800000011920929,
            "d": "Windows Forms UI framework",
            "e": [
              "System.Windows.Forms"
            ],
            "i": "metadata/lang/compiler/managed::winforms-ui",
            "l": 2,
            "el": [
              "0x16dc"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": ".NET WPF namespace reference",
            "e": [
              "System.Windows"
            ],
            "i": "well-known/game/mod::wpf-namespace-ref",
            "l": 1,
            "el": [
              "0x16dc"
            ]
          },
          {
            "a": "T1027",
            "c": 0.9399999976158142,
            "d": "Single section occupies nearly all bytes",
            "e": [
              "binary.largest_section_ratio = 1.00"
            ],
            "i": "objectives/anti-static/obfuscation/payload/section::extreme-dominant-section",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "Large PE with exactly two sections",
            "e": [
              "sections.count = 2.00"
            ],
            "i": "objectives/anti-static/obfuscation/payload/section::two-section-pe",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "High plaintext string count",
            "e": [
              "binary.string_count = 32430.00"
            ],
            "i": "objectives/anti-static/pack/polymorphic::high-string-count-2000",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Binary has 2000+ strings",
            "e": [
              "binary.string_count = 32430.00"
            ],
            "i": "metadata/binary/metrics/threshold::many-strings-2000",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "PE binary has trailing overlay data",
            "e": [
              "binary.has_overlay = 1.00"
            ],
            "i": "metadata/binary/layout::has-overlay",
            "l": 3
          },
          {
            "c": 0.800000011920929,
            "d": "System namespace reference",
            "e": [
              "System.IO"
            ],
            "i": "metadata/lang/compiler/managed::system-namespace",
            "l": 2,
            "el": [
              "0x1474"
            ]
          },
          {
            "a": "T1562.001",
            "c": 0.949999988079071,
            "d": "Regex component marker",
            "e": [
              "GetObjectValue"
            ],
            "i": "objectives/evasion/indicator-removal/cleanup::motw-removal-stream--rx-3",
            "l": 1,
            "m": "B0047",
            "el": [
              "0x14f7"
            ]
          },
          {
            "c": 1.0,
            "d": "DEP / NX enabled (NX_COMPAT)",
            "e": [
              "[dynamic_base, nx_compat, no_seh, terminal_server_aware]"
            ],
            "i": "metadata/hardening/mitigation::pe-dep",
            "l": 2,
            "el": [
              "value:pe.dll_characteristics"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "PE .reloc section presence",
            "e": [
              ".reloc"
            ],
            "i": "metadata/binary/section/names::reloc-section-presence",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "ASLR enabled (DYNAMIC_BASE)",
            "e": [
              "[dynamic_base, nx_compat, no_seh, terminal_server_aware]"
            ],
            "i": "metadata/hardening/mitigation::pe-aslr",
            "l": 2,
            "el": [
              "value:pe.dll_characteristics"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "PE standard runtime section",
            "e": [
              ".reloc"
            ],
            "i": "metadata/binary/section/names::pe-runtime-standard-section",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "Regex component marker",
            "e": [
              "Strings",
              "ToString"
            ],
            "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7",
            "l": 1,
            "el": [
              "0x16b0",
              "0x1515"
            ]
          },
          {
            "c": 0.8500000238418579,
            "d": "Visual Basic runtime reference",
            "e": [
              "Microsoft.VisualBasic.CompilerServices",
              "Microsoft.VisualBasic"
            ],
            "i": "metadata/lang/compiler/managed::visual-basic-runtime",
            "l": 2,
            "el": [
              "0x1658",
              "0x1492"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "PE has under ten imports",
            "e": [
              "imports.count = 1.00"
            ],
            "i": "objectives/anti-static/pack/runtime::pe-import-count-under-10",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "Low ratio of sentence-like strings",
            "e": [
              "binary.sentence_string_ratio = 0.00"
            ],
            "i": "metadata/binary/metrics/pe-details::low-sentence-string-ratio",
            "l": 2
          },
          {
            "c": 0.699999988079071,
            "d": "PE with six or fewer imports",
            "e": [
              "imports.count = 1.00"
            ],
            "i": "metadata/binary/symbols/imports::pe-imports-max-six",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "PE checksum matches computed value",
            "e": [
              "pe.checksum_valid = 1.00"
            ],
            "i": "metadata/binary/layout::pe-checksum-valid",
            "l": 1
          },
          {
            "a": "T1553.002",
            "c": 0.8500000238418579,
            "d": "PE lacks VS_VERSION_INFO resource",
            "e": [
              "field 'pe.version.file_version' does not exist"
            ],
            "i": "objectives/evasion/masquerade/cert::pe-no-version-info-resource",
            "l": 1,
            "el": [
              "value:pe.version.file_version"
            ]
          },
          {
            "c": 0.949999988079071,
            "d": "PE has exactly two sections",
            "e": [
              "sections.count = 2.00"
            ],
            "i": "well-known/malware/virus/virlock::two-section-layout",
            "l": 1
          },
          {
            "a": "T1140",
            "c": 0.9200000166893005,
            "d": "VB NewLateBinding dispatch helper",
            "e": [
              "NewLateBinding"
            ],
            "i": "objectives/command-and-control/dropper/staging/embedded::vb-newlatebinding",
            "l": 1,
            "m": "B0030",
            "el": [
              "0x1506"
            ]
          },
          {
            "a": "T1027.009",
            "c": 0.550000011920929,
            "d": ".NET resource manager access",
            "e": [
              "ResourceManager"
            ],
            "i": "micro-behaviors/data/embedded/payload/resource::dotnet-resourcemanager",
            "l": 1,
            "el": [
              "0x1610"
            ]
          },
          {
            "a": "T1036.005",
            "c": 0.9200000166893005,
            "d": "Regex component marker",
            "e": [
              "binary.string_count = 32430.00"
            ],
            "i": "objectives/evasion/masquerade/version-resource/contradiction::microsoft-cisco-contradiction-cond-1--inline-26190",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "High string count over 1000",
            "e": [
              "binary.string_count = 32430.00"
            ],
            "i": "metadata/binary/metrics/threshold::high-string-count-1000",
            "l": 2
          },
          {
            "a": "T1027",
            "c": 0.8199999928474426,
            "d": "Packed loader largest section ratio above 0.65",
            "e": [
              "binary.largest_section_ratio = 1.00"
            ],
            "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.8399999737739563,
            "d": "Binary has 80 or fewer imports",
            "e": [
              "imports.count = 1.00"
            ],
            "i": "objectives/anti-static/obfuscation/binary-metrics/imports::max-80-imports",
            "l": 1
          },
          {
            "a": "T1485",
            "c": 0.8999999761581421,
            "d": "Giant embedded string blob metric",
            "e": [
              "binary.max_string_length = 916390.00"
            ],
            "i": "objectives/impact/wipe/disk/overwrite::giant-string-blob-metric",
            "l": 1
          },
          {
            "a": "T1105",
            "c": 0.800000011920929,
            "d": "Compact PE import table",
            "e": [
              "imports.count = 1.00"
            ],
            "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table",
            "l": 1,
            "m": "E1105"
          },
          {
            "a": "T1055",
            "c": 0.800000011920929,
            "d": "Executable section with very low entropy",
            "e": [
              ".text (size: 1748992, perms: r-x)"
            ],
            "i": "objectives/anti-static/obfuscation/binary-structure::low-entropy-executable",
            "l": 1
          },
          {
            "c": 1.0,
            "d": ".NET BSJB metadata marker",
            "e": [
              "BSJB"
            ],
            "i": "metadata/binary/framework::bsjb-marker",
            "l": 1
          },
          {
            "c": 0.8399999737739563,
            "d": "Large binary with few DLL dependencies",
            "e": [
              "dependencies.count = 1.00"
            ],
            "i": "metadata/package/metrics::import-count-under-80",
            "l": 2
          },
          {
            "a": "T1497.001",
            "c": 0.949999988079071,
            "d": "Regex component marker",
            "e": [
              "binary.string_count = 32430.00"
            ],
            "i": "objectives/anti-analysis/vm-detect/vendor::comprehensive-evasion-cond-1--inline-17219",
            "l": 1
          },
          {
            "c": 0.6000000238418579,
            "d": "Single section dominates file (packer)",
            "e": [
              "binary.largest_section_ratio = 1.00"
            ],
            "i": "metadata/binary/metrics/structural::dominant-section",
            "l": 3
          },
          {
            "a": "T1055",
            "c": 0.9200000166893005,
            "d": "Regex component marker",
            "e": [
              "imports.count = 1.00"
            ],
            "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571",
            "l": 1,
            "m": "C0041"
          },
          {
            "c": 0.949999988079071,
            "d": "Filename has EXE extension",
            "e": [
              "09f7b6653733496bf7009e3def383c57c774978147edaa5c84e5eae493e8d242.exe"
            ],
            "i": "objectives/evasion/masquerade/file/double-ext::basename-is-exe",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.8600000143051147,
            "d": "Dominant section for VB6 loader profile",
            "e": [
              "binary.largest_section_ratio = 1.00"
            ],
            "i": "objectives/anti-static/obfuscation/payload/string-sparse::dominant-text-layout-vb6",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.8600000143051147,
            "d": "Long mixed-case identifiers cluster",
            "e": [
              "FileStyleUriParser",
              "SectigoRSATimeStampingCA"
            ],
            "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers",
            "l": 1,
            "m": "B0032",
            "el": [
              "0x1631",
              "0x1ac230"
            ]
          },
          {
            "a": "T1027",
            "c": 0.8500000238418579,
            "d": "Sparse import table",
            "e": [
              "imports.count = 1.00"
            ],
            "i": "objectives/anti-static/obfuscation/binary-metrics/sparse-imports::low-import-count",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "d": "Binary is 1MB or larger",
            "e": [
              "09f7b6653733496bf7009e3def383c57c774978147edaa5c84e5eae493e8d242.exe"
            ],
            "i": "objectives/anti-static/obfuscation/binary-metrics/shape::file-size-1m-plus",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.949999988079071,
            "d": "Regex component marker",
            "e": [
              "binary.largest_section_ratio = 1.00"
            ],
            "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.9700000286102295,
            "d": "Regex component marker",
            "e": [
              "binary.largest_section_ratio = 1.00"
            ],
            "i": "objectives/anti-static/obfuscation/payload/section::packed-anti-analysis-data-loader-cond-1--inline-29202",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.949999988079071,
            "d": "links mscoree (CorExeMain)",
            "e": [
              "mscoree"
            ],
            "i": "metadata/dylib::mscoree",
            "l": 2,
            "el": [
              "1 symbols"
            ]
          },
          {
            "a": "T1036.005",
            "c": 0.8199999928474426,
            "d": "Low-import PE without dominant resources",
            "e": [
              "imports.count = 1.00"
            ],
            "i": "objectives/evasion/masquerade/version-resource/claim::low-import-pe-without-heavy-rsrc",
            "l": 1
          }
        ],
        "sha": "09f7b6653733496bf7009e3def383c57c774978147edaa5c84e5eae493e8d242",
        "path": "09f7b6653733496bf7009e3def383c57c774978147edaa5c84e5eae493e8d242.exe",
        "type": "pe"
      }
    ],
    "tv": "52045"
  }
}