{ "ml": { "v": "7", "eng": "2.0.1-rc.1", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.15888318, "rte": "az", "prob": 0.15888318 }, { "cls": 0, "raw": 0.09827915, "rte": "az/native", "prob": 0.09827915 }, { "cls": 0, "raw": 0.5594908, "rte": "az/pe", "prob": 0.5594908 } ], "prob": 0.15888318, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.15888318419456482, "type": "pe" } ], "version": "v18.18", "analyzed_at": "2026-06-15T10:07:40Z" }, "path": "512729", "raw": { "v": "7", "tv": "061e3", "files": [ { "id": 0, "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000", "l": 0, "n": [ { "c": 3, "d": "PE binary has trailing overlay data", "i": "metadata/binary/layout::has-overlay", "o": 0, "z": 25 } ], "x": true }, { "b": "ZuCQ$S{6G-OAQ1N00000vcET\u003eZutK%^c7Df\u0026]*vx@oaaX4^r@[cG$HghT7hwpu.-U000005=.]Z1onBL00000CiF#b000002\u003cql*00000nAZ3NBM-Y8J{3DyhS$bvPY=vQtiC}^xY]A@00000\u0026]{By000000000000000000007Bx-0000000SSi", "l": 45084, "n": [ { "c": 2, "d": "Locate PE resource entry with language (ANSI)", "i": "micro-behaviors/data/embedded/payload/resource::find-resource-ex-a", "o": 45108, "z": 15 }, { "c": 2, "d": "Query system hardware info (CPU cores)", "i": "micro-behaviors/os/sysinfo/hardware::get-system-info", "o": 45124, "z": 13 }, { "c": 2, "d": "Delay execution", "i": "micro-behaviors/time/timing/delay::sleep-dup", "o": 45100, "z": 5 }, { "c": 2, "d": "Enumerate top-level windows", "i": "micro-behaviors/ui/window/manage/enumerate::enum-windows", "o": 45188, "z": 11 } ], "x": true }, { "b": "zF9K3z/{a308(AZs3YUOe[w^m08DoSk#*(uga)9NyYBEC0zdfIwPz(!wO#SZBy/q\u003c", "l": 59411, "n": [ { "c": 2, "d": ".dll extension reference", "i": "micro-behaviors/fs/path/extension::dll-dup", "o": 59427, "z": 4 } ], "x": true }, { "b": "q!Q8[pJ{X/wkEh-B-qy4rz#s:gCQN[y?%7Ks]?9eB-Rj%x\u003eqG:w\u003e3GJwDky8mRM:JqE%]/B-E", "l": 59554, "n": [ { "c": 2, "d": "Reference to USER32.dll", "i": "micro-behaviors/os/module/load::user32-dll-reference", "o": 59570, "z": 10 } ], "x": true }, { "b": "BxnCxBPC0yx*#]YB7+KNm)]{8ga)9NyYG[bw[LW%Cxi-:zf6(gA=-{Ay?%7K3iiOcBvG$XwD", "l": 59848, "n": [ { "c": 2, "d": "Reference to GDI32.dll", "i": "micro-behaviors/os/module/load::gdi32-dll-reference", "o": 59864, "z": 9 } ], "x": true }, { "b": "oMaMnzF0*czddK2z/bKPk$1:tp!rC#e[w^m0000000000000000000000000000000000000000", "l": 59982, "n": [ { "c": 2, "d": "Reference to ADVAPI32.dll", "i": "micro-behaviors/os/module/load::advapi32-dll-reference", "o": 59998, "z": 12 } ], "x": true }, { "b": "00000000000000000000MBm8kG5BIYm0K=t2.xwF{Tg]!fgpz.vw99U-LWgQC1ZUb?\u003ca", "l": 77808, "n": [ { "c": 2, "d": "PE .reloc section presence", "i": "metadata/binary/section/names::reloc-section-presence", "o": 77824, "z": 6 } ], "x": true }, { "b": "0000000000003KigYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006Xn[brp!0rrc20rrc", "l": 147542, "n": [ { "c": 2, "d": "PE version resource metadata", "i": "metadata/package/versioning::version-resource-metadata", "o": 147558, "z": 15 } ], "x": true }, { "b": "fAr{fvGn7Z003418VP)slJz38z2!IPve$fBC(QOtve$cAwDhYg002p+wb{JFvGo%taoksuC(R)=Bo2\u003eLz2!RSaoj$kzuaeDzVB!Tz#:!RASxIFBo2\u003eLwb(Pf003417xsEomGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up002s=ASxIFB]VBXaoj$", "l": 147694, "n": [ { "c": 2, "d": "Adobe vendor marker in PE version info", "i": "metadata/binary/vendor::adobe-version-info-company", "o": 147736, "z": 26 }, { "c": 2, "d": "PE CompanyName metadata field", "i": "metadata/package/versioning::pe-companyname-field", "o": 147710, "z": 11 }, { "c": 2, "d": "PE FileDescription metadata field", "i": "metadata/package/versioning::pe-filedescription-field", "o": 147798, "z": 15 } ], "x": true }, { "b": "wb{fvASu7t001LI1][V7mGvc5yYF2DrSDXhASydXx-J5Kzu6Up001[Se=WQae=U\u003eK001zE1onD5nDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE002s=nDq6S0043tcJBeEoAnS7", "l": 147870, "n": [ { "c": 2, "d": "PE FileVersion metadata field", "i": "metadata/package/versioning::pe-fileversion-field", "o": 147886, "z": 11 }, { "c": 2, "d": "PE InternalName metadata field", "i": "metadata/package/versioning::pe-internalname-field", "o": 147930, "z": 12 } ], "x": true }, { "b": "z#+d-ASx!Nx8(PBBn#pvSq[4vf-Tilh#\u003e=neDvKafAr^bg5@A%k(+A}zVBkDwDi?MqVI7yA@ZpZwDlMEA@Wr.nDrSdv/QAEASy4UzVB!Tve$xHwDllv00000h#\u003ci:0rt)}ASx!Nx8(SCzua8ByYD{8x-I@HwDlPFve$cAwDhYgli6NSli5Rrwb{ACyYBCnc\u0026:wI0rt{@ASy1Twb{-Lv/QPJp5[Y5z2!bE00000li6NSli3#=ec2!M0rt{@ASy1Twb{-Lv/QPJrSDXhASydXx-J5Kzu6Upf-S*af-RgNp5(di0rtB^", "l": 147984, "n": [ { "c": 2, "d": "Adobe legacy vendor marker in resource", "i": "metadata/binary/vendor::adobe-systems-inc-marker", "o": 148000, "z": 39 }, { "c": 2, "d": "PE OriginalFilename metadata field", "i": "metadata/package/versioning::pe-originalfilename-field", "o": 148086, "z": 16 }, { "c": 2, "d": "PE ProductName metadata field", "i": "metadata/package/versioning::pe-productname-field", "o": 148142, "z": 11 }, { "c": 2, "d": "PE ProductVersion metadata field", "i": "metadata/package/versioning::pe-productversion-field", "o": 148182, "z": 14 } ], "x": true } ], "idn": { "name": { "value": "BIB.dll", "source": "pe.version.original_filename", "verified": false }, "trust": "ca_signed", "signer": { "issuer": "CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB", "source": "pe.signatures[0]", "subject": "CN=SYMVC LTD,O=SYMVC LTD,STREET=544 Willenhall Road,L=Willenhall,ST=West Midlands,POSTALCODE=WV13 3QZ,C=GB", "common_name": "SYMVC LTD", "organization": "SYMVC LTD" }, "project": { "value": "BIB", "source": "pe.version.product_name", "verified": false }, "version": { "value": "6.1.", "source": "pe.version.file_version", "verified": false }, "unique_ids": { "authenticode_thumbprint_sha256": "6d73c83b8d15458e0a84db15c894376cedbb9c89c92ac520362e74749606e0cd" }, "organization": { "value": "SYMVC LTD", "source": "pe.signatures[0]", "verified": true } }, "mol": "Md₂(BiSi₂)", "sha": "0c910fb08d46bc613812c9802bbaf9ef9811faf2d633f7ebe45074dae2c1410d", "fact": { "id": "pe", "imp": [ [ "shlwapi", "AssocIsDangerous" ], [ "oleaut32", "ORDINAL 18" ], [ "oleaut32", "ORDINAL 4" ], [ "user32", "GetDlgItemTextA" ], [ "user32", "GetOpenClipboardWindow" ], [ "user32", "GetMenuStringA" ], [ "user32", "InsertMenuItemW" ], [ "user32", "ShowOwnedPopups" ], [ "user32", "EnumWindows" ], [ "user32", "DrawTextW" ], [ "kernel32", "Sleep" ], [ "kernel32", "FlushViewOfFile" ], [ "kernel32", "FindResourceExA" ], [ "kernel32", "GetCompressedFileSizeA" ], [ "kernel32", "GetDateFormatW" ], [ "kernel32", "GetDefaultCommConfigW" ], [ "kernel32", "GetSystemInfo" ], [ "kernel32", "GetPrivateProfileIntA" ], [ "kernel32", "GetCommandLineA" ], [ "powrprof", "CanUserWritePwrScheme" ], [ "gdi32", "GdiFlush" ], [ "gdi32", "GetObjectW" ], [ "gdi32", "GetStretchBltMode" ], [ "gdi32", "GetObjectA" ], [ "msvcrt", "fgetws" ], [ "comdlg32", "GetFileTitleW" ], [ "advapi32", "GetEventLogInformation" ], [ "advapi32", "GetServiceKeyNameW" ], [ "advapi32", "FileEncryptionStatusW" ] ], "met": { "pe": { "checksum": 195051.0, "checksum_valid": 1.0, "resource_count": 1.0, "cert_table_size": 6472.0, "has_version_info": 1.0, "computed_checksum": 195051.0, "reloc_overhang_bytes": 1668.0, "reloc_overhang_ratio": 0.41, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "version.identity_entropy": 4.13, "base_relocation_block_count": 11.0, "base_relocation_entry_count": 1165.0, "version.identity_symbol_ratio": 0.0 }, "file": { "size": 162120.0, "entropy": 6.37, "size_bytes": 162120.0 }, "binary": { "is_pie": 0.0, "has_overlay": 1.0, "code_entropy": 5.73, "data_entropy": 6.56, "overlay_size": 6472.0, "string_count": 614.0, "overlay_ratio": 0.04, "overall_entropy": 6.37, "overlay_entropy": 7.46, "entropy_variance": 5.3, "avg_string_length": 8.79, "max_string_length": 62.0, "code_to_data_ratio": 0.32, "string_length_stddev": 7.65, "largest_section_ratio": 0.25, "sentence_string_count": 16.0, "sentence_string_ratio": 0.03, "high_entropy_string_count": 0.0 }, "imports": { "count": 29.0 }, "sections": { "count": 10.0, "code_size": 40960.0, "entropy_max": 7.6, "entropy_mean": 4.66, "name_entropy": 3.92, "writable_count": 6.0, "executable_count": 1.0, "nonstandard_count": 4.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 9.0 } }, "sec": [ [ ".text", 4096, 40960, 5.73, "r-x" ], [ ".rdata", 45056, 16384, 2.66, "r-x" ], [ ".data", 61440, 8192, 3.52, "rw-" ], [ "CONST", 69632, 8192, 5.8, "rw-" ], [ ".reloc", 77824, 4096, 1.48, "rw-" ], [ ".crt1", 81920, 12288, 7.36, "rw-" ], [ ".qdata", 94208, 28672, 7.6, "rw-" ], [ "CODE", 122880, 24576, 7.05, "rw-" ], [ ".rsrc", 147456, 4096, 1.0, "r--" ], [ ".reloc", 151552, 4096, 4.39, "r--" ] ], "str": [ [ 77, "u8", "!This program cannot be run in DOS mode." ], [ 428, "u8", ".text" ], [ 507, "u8", "@.data" ], [ 548, "u8", "CONST" ], [ 588, "u8", ".reloc" ], [ 628, "u8", ".crt1" ], [ 668, "u8", ".qdata" ], [ 708, "u8", "CODE" ], [ 748, "u8", ".rsrc" ], [ 787, "u8", "@.reloc" ], [ 9147, "u8", "T$()" ], [ 9191, "u8", "YRT5" ], [ 26222, "u8", "QFB0" ], [ 36558, "u8", "L$()" ], [ 38406, "u8", "j81o" ], [ 45297, "u8", "tweew" ], [ 45360, "u8", "eetww" ], [ 45380, "u8", "eteew" ], [ 45387, "u8", "eeewte" ], [ 45402, "u8", "eeeet" ], [ 45409, "u8", "tewet" ], [ 45415, "u8", "ewttet" ], [ 45814, "u8", "etwtwt" ], [ 45821, "u8", "ttteee" ], [ 45828, "u8", "weweww" ], [ 45856, "u8", "wwewwe" ], [ 45884, "u8", "tewtww" ], [ 45927, "u8", "wete" ], [ 46283, "u8", "ttetwe" ], [ 46297, "u8", "ttewww" ], [ 46318, "u8", "ewtwwe" ], [ 46353, "u8", "tttetw" ], [ 46367, "u8", "wwete" ], [ 46376, "u8", "ewee" ], [ 46381, "u8", "ewte" ], [ 46751, "u8", "wewwww" ], [ 46758, "u8", "twtwee" ], [ 46795, "u8", "etwe" ], [ 46800, "u8", "eeeeet" ], [ 47145, "u8", "eeet" ], [ 47160, "u8", "etee" ], [ 47200, "u8", "teweew" ], [ 47214, "u8", "eewet" ], [ 47256, "u8", "weewe" ], [ 47670, "u8", "twtwte" ], [ 47691, "u8", "etwewe" ], [ 47705, "u8", "weew" ], [ 47712, "u8", "etetww" ], [ 47742, "u8", "teew" ], [ 48069, "u8", "tettee" ], [ 48097, "u8", "tewwwe" ], [ 48132, "u8", "weeewt" ], [ 48160, "u8", "twee" ], [ 48558, "u8", "ewtet" ], [ 48593, "u8", "ewett" ], [ 48635, "u8", "wtwete" ], [ 48670, "u8", "wewete" ], [ 49006, "u8", "etwwtw" ], [ 49069, "u8", "tewett" ], [ 49077, "u8", "weeee" ], [ 49104, "u8", "weewte" ], [ 49505, "u8", "tewte" ], [ 49567, "u8", "twwett" ], [ 49574, "u8", "ewetew" ], [ 49927, "u8", "wewewt" ], [ 49948, "u8", "twwwte" ], [ 50444, "u8", "wwwee" ], [ 50465, "u8", "wtteww" ], [ 50480, "u8", "eeewe" ], [ 50487, "u8", "eeete" ], [ 50507, "u8", "etwwtt" ], [ 50537, "u8", "ewet" ], [ 50914, "u8", "ettet" ], [ 50941, "u8", "etwwwt" ], [ 50955, "u8", "etteew" ], [ 50969, "u8", "ettett" ], [ 50976, "u8", "ewetee" ], [ 51398, "u8", "teett" ], [ 51692, "u8", "ewewww" ], [ 51701, "u8", "wtee" ], [ 51743, "u8", "tete" ], [ 51762, "u8", "etewte" ], [ 51798, "u8", "eewtt" ], [ 52268, "u8", "weeewe" ], [ 52282, "u8", "ewewwt" ], [ 52656, "u8", "wtette" ], [ 52663, "u8", "wttwew" ], [ 52670, "u8", "etttew" ], [ 52727, "u8", "tetee" ], [ 52740, "u8", "eewwww" ], [ 53119, "u8", "etwte" ], [ 53125, "u8", "ewttew" ], [ 53132, "u8", "ewtete" ], [ 53140, "u8", "eeewt" ], [ 53181, "u8", "ettwew" ], [ 53202, "u8", "weeeww" ], [ 53652, "u8", "wewttw" ], [ 53673, "u8", "eettet" ], [ 53680, "u8", "wewe" ], [ 53694, "u8", "etettw" ], [ 53710, "u8", "ttee" ], [ 53764, "u8", "etet" ], [ 54114, "u8", "ttwete" ], [ 54136, "u8", "ewwwe" ], [ 54142, "u8", "twwwet" ], [ 54156, "u8", "wetett" ], [ 54177, "u8", "eeewwt" ], [ 54191, "u8", "tttwet" ], [ 54198, "u8", "wtwetw" ], [ 54540, "u8", "tewwtw" ], [ 54596, "u8", "etewww" ], [ 54603, "u8", "eeweet" ], [ 54610, "u8", "ewttte" ], [ 54960, "u8", "teeww" ], [ 54967, "u8", "eeeewe" ], [ 55010, "u8", "eewt" ], [ 55023, "u8", "ewtewe" ], [ 55044, "u8", "weetwt" ], [ 55470, "u8", "wwwewe" ], [ 55477, "u8", "eeew" ], [ 55491, "u8", "wwewet" ], [ 55512, "u8", "wewtew" ], [ 55533, "u8", "teewe" ], [ 55540, "u8", "tteee" ], [ 55821, "u8", "eewtee" ], [ 55835, "u8", "eetwtt" ], [ 55842, "u8", "ewetw" ], [ 56296, "u8", "tteeet" ], [ 56324, "u8", "ttette" ], [ 56366, "u8", "ttwwee" ], [ 56374, "u8", "etewe" ], [ 56664, "u8", "etwwet" ], [ 56727, "u8", "wwewe" ], [ 56734, "u8", "teeeww" ], [ 56776, "u8", "tetwee" ], [ 57171, "u8", "etttet" ], [ 57213, "u8", "eweeet" ], [ 57586, "u8", "weewwt" ], [ 57593, "u8", "etew" ], [ 57600, "u8", "etteet" ], [ 57607, "u8", "wtewee" ], [ 57614, "u8", "ettte" ], [ 57628, "u8", "eeetew" ], [ 57649, "u8", "wetwtt" ], [ 57691, "u8", "tetwet" ], [ 58904, "u8", "RSDS" ], [ 58928, "u8", "\\\\3\\.41\\.34DLOperatingSyk3456bb" ], [ 59402, "u8", "AssocIsDangerous" ], [ 59420, "u8", "SHLWAPI.dll" ], [ 59432, "u8", "OLEAUT32.dll" ], [ 59448, "u8", "InsertMenuItemW" ], [ 59466, "u8", "GetDlgItemTextA" ], [ 59484, "u8", "EnumWindows" ], [ 59498, "u8", "DrawTextW" ], [ 59510, "u8", "GetOpenClipboardWindow" ], [ 59536, "u8", "GetMenuStringA" ], [ 59554, "u8", "ShowOwnedPopups" ], [ 59570, "u8", "USER32.dll" ], [ 59584, "u8", "FlushViewOfFile" ], [ 59602, "u8", "FindResourceExA" ], [ 59620, "u8", "GetCompressedFileSizeA" ], [ 59646, "u8", "GetDateFormatW" ], [ 59664, "u8", "GetDefaultCommConfigW" ], [ 59688, "u8", "GetSystemInfo" ], [ 59704, "u8", "GetPrivateProfileIntA" ], [ 59728, "u8", "GetCommandLineA" ], [ 59746, "u8", "Sleep" ], [ 59752, "u8", "KERNEL32.dll" ], [ 59768, "u8", "CanUserWritePwrScheme" ], [ 59790, "u8", "POWRPROF.dll" ], [ 59806, "u8", "GetObjectA" ], [ 59820, "u8", "GetStretchBltMode" ], [ 59840, "u8", "GetObjectW" ], [ 59854, "u8", "GdiFlush" ], [ 59864, "u8", "GDI32.dll" ], [ 59876, "u8", "fgetws" ], [ 59884, "u8", "msvcrt.dll" ], [ 59898, "u8", "GetFileTitleW" ], [ 59912, "u8", "COMDLG32.dll" ], [ 59928, "u8", "FileEncryptionStatusW" ], [ 59952, "u8", "GetServiceKeyNameW" ], [ 59974, "u8", "GetEventLogInformation" ], [ 59998, "u8", "ADVAPI32.dll" ], [ 76020, "u8", "qRF4L" ], [ 77936, "u8", "uYfv" ], [ 77951, "u8", "DZq( LL~mZ" ], [ 82166, "u8", "LG7B" ], [ 82239, "u8", "qaX3L" ], [ 82763, "u8", "4RLoc" ], [ 85412, "u8", "YQ52" ], [ 94482, "u8", "O53Gk" ], [ 95478, "u8", "e8QZ8" ], [ 96704, "u8", "GCC55" ], [ 97405, "u8", "x98a" ], [ 98215, "u8", "OGvO2" ], [ 98537, "u8", "JV8ll" ], [ 98730, "u8", "q2Yui" ], [ 98853, "u8", "JhfVz" ], [ 98933, "u8", "PP0CI" ], [ 100094, "u8", "vu7Kon" ], [ 101250, "u8", "ruRu" ], [ 102936, "u8", "jpHw" ], [ 105672, "u8", "mEGS# r" ], [ 105893, "u8", "ULFk31" ], [ 106096, "u8", "ziqJ.n" ], [ 106393, "u8", "OeQWt" ], [ 107453, "u8", "4O9F" ], [ 109412, "u8", "HYgYR A" ], [ 109686, "u8", "eh85" ], [ 110543, "u8", "X A0" ], [ 112554, "u8", "AIQ3z" ], [ 114106, "u8", "tP0EG" ], [ 114882, "u8", "VCoxK" ], [ 115237, "u8", "TE8Q" ], [ 116019, "u8", "lD.cnw6v" ], [ 116809, "u8", "Q$eA hy" ], [ 117086, "u8", "8NTT" ], [ 117262, "u8", "k8e2" ], [ 118358, "u8", "T95W" ], [ 123511, "u8", "5K5Q" ], [ 124562, "u8", "Yomr" ], [ 126168, "u8", "rJP8uzx" ], [ 127947, "u8", "t14 v" ], [ 128756, "u8", "H9HR" ], [ 131759, "u8", "NRfySf" ], [ 132135, "u8", "ZWAR" ], [ 132455, "u8", "NWT6" ], [ 134312, "u8", "ZruRu" ], [ 135037, "u8", "VLOP" ], [ 151831, "u8", "0 0$0(0,0004080\u003c0@0D0H0L0P0T0X0\\0`0d0h0l0p0t0x0|0" ], [ 153291, "u8", "\u003c \u003c,\u003c0\u003c4\u003c8\u003c\u003c\u003c@\u003cD\u003cH\u003cL\u003cP\u003cT\u003cX\u003c\\\u003c`\u003cd\u003ch\u003cl\u003cp\u003ct\u003cx\u003c|\u003c" ], [ 153783, "u8", "0 0$0(0,0004080\u003c0@0D0H0L0P0T0X0\\0`0d0p0t0x0|0" ], [ 155710, "u8", "Z0X03" ], [ 155872, "u8", "GlobalSign nv-sa1" ], [ 155917, "u8", "GlobalSign Root CA0" ], [ 155954, "u8", "280128120000Z0R1" ], [ 155993, "u8", "GlobalSign nv-sa1(0\u0026" ], [ 156020, "u8", "GlobalSign Timestamping CA - G20" ], [ 156172, "u8", "0Erm9" ], [ 156437, "u8", "0402" ], [ 156452, "u8", "\u0026https://www.globalsign.com/repository/03" ], [ 156509, "u8", "\"http://crl.globalsign.net/root.crl0" ], [ 156989, "u8", "160524000000Z" ], [ 157043, "u8", "GMO GlobalSign Pte Ltd100." ], [ 157075, "u8", "'GlobalSign TSA for MS Authenticode - G20" ], [ 157441, "u8", "E0C0A" ], [ 157472, "u8", "\u0026https://www.globalsign.com/repository/0" ], [ 157564, "u8", "1http://crl.globalsign.com/gs/gstimestampingg2.crl0T" ], [ 157627, "u8", "H0F0D" ], [ 157643, "u8", "8http://secure.globalsign.com/cacert/gstimestampingg2.crt0" ], [ 158113, "u8", "Greater Manchester1" ], [ 158142, "u8", "Salford1" ], [ 158160, "u8", "COMODO CA Limited1#0!" ], [ 158188, "u8", "COMODO RSA Code Signing CA0" ], [ 158233, "u8", "191128235959Z0" ], [ 158273, "u8", "WV13 3QZ1" ] ], "val": { "file.stem": "512729", "pe.imphash": "89cc0882568d73c6c930bd519ad45cc9", "pe.machine": "i386", "pe.subsystem": "windows_gui", "pe.timestamp": 733100491, "file.basename": "512729", "pe.image_base": 4194304, "pe.image_size": 159744, "pe.machine_id": 332, "pe.os_version": "5.1", "pe.version.os": "unknown", "pe.entry_point": 9824, "pe.headers_size": 4096, "pe.version.type": "dll", "pe.entry_section": ".text", "pe.subsystem_raw": 2, "pe.file_alignment": 4096, "pe.image_hash.sha1": "94059eb470ecebdedb4eeb9805c18ac9ee649f10", "pe.version.company": "Adobe Systems Incorporated", "pe.image_hash.sha256": "a568e71d5722804fd59f6c542f5461d4dfc1cdd80067db2540389d8cc2dfced9", "pe.image_hash.sha384": "51be879366afd5fc967ba3b85bd0abf24a26c93261ee5cb516c2d98ebf22a0c6b7c4c8ab6b4f82793fb2225212586f27", "pe.image_hash.sha512": "3b001b303d7c5a940ffe0b30052cabb468b68e462d555c7909cfa52f205def25b35c10e34036cf9b14e71f4fb685c92ae24a2f8233fd1f48f2fa912bad1a0809", "pe.resource_types[0]": "RT_VERSION", "pe.section_alignment": 4096, "pe.subsystem_version": "5.0", "pe.version.copyright": "© 1984-2002 Adobe Systems Incorporated", "pe.characteristics[0]": "executable_image", "pe.characteristics[1]": "32bit_machine", "pe.characteristics_raw": 258, "pe.version.description": "Bravo Interface Binder", "pe.linker_major_version": 10, "pe.signatures[0].issuer": "CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB", "pe.signatures[0].serial": "00e54ef843127b7ada05aceefcaa9d46ff", "pe.version.file_version": "6.1.", "pe.version.product_name": "BIB", "pe.debug.entries[0].type": "other", "pe.debug.entries[1].type": "other", "pe.signatures[0].subject": "CN=SYMVC LTD,O=SYMVC LTD,STREET=544 Willenhall Road,L=Willenhall,ST=West Midlands,POSTALCODE=WV13 3QZ,C=GB", "pe.version.internal_name": "BIB", "pe.dll_characteristics[0]": "nx_compat", "pe.dll_characteristics[1]": "terminal_server_aware", "pe.signatures[0].verified": true, "pe.version.company_offset": 147736, "pe.data_directories[0].rva": 59048, "pe.data_directories[1].rva": 151552, "pe.data_directories[2].rva": 155648, "pe.data_directories[3].rva": 155648, "pe.data_directories[4].rva": 45215, "pe.data_directories[5].rva": 45056, "pe.dll_characteristics_raw": 33024, "pe.number_of_rva_and_sizes": 16, "pe.signatures[0].not_after": "2019-11-28T23:59:59Z", "pe.version.product_version": "1.1", "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 200, "pe.data_directories[1].name": "resource", "pe.data_directories[1].size": 968, "pe.data_directories[2].name": "certificate", "pe.data_directories[2].size": 6472, "pe.data_directories[3].name": "base_relocation", "pe.data_directories[3].size": 2428, "pe.data_directories[4].name": "debug", "pe.data_directories[4].size": 56, "pe.data_directories[5].name": "iat", "pe.data_directories[5].size": 153, "pe.debug.entries[0].type_id": 512, "pe.debug.entries[1].type_id": 3072, "pe.signatures[0].not_before": "2018-11-28T00:00:00Z", "pe.version.copyright_offset": 148000, "pe.version.original_filename": "BIB.dll", "pe.coff.dos_header_pe_pointer": 180, "pe.version.description_offset": 147832, "pe.debug.entries[0].size_bytes": 14080, "pe.debug.entries[1].size_bytes": 5120, "pe.version.file_version_offset": 147912, "pe.version.product_name_offset": 148168, "pe.base_relocations.block_count": 11, "pe.base_relocations.entry_count": 1165, "pe.version.internal_name_offset": 147956, "pe.signatures[0].thumbprint_sha1": "1661eb0eec374d082720eaa3aa733af1b5d2d0e1", "pe.base_relocations.padding_count": 5, "pe.signatures[0].cert_chain_depth": 4, "pe.signatures[0].digest_algorithm": "sha1", "pe.signatures[0].eku_code_signing": true, "pe.signatures[0].signature_digest": "94059eb470ecebdedb4eeb9805c18ac9ee649f10", "pe.version.product_version_offset": 148212, "pe.debug.entries[0].timestamp_unix": 287708928, "pe.debug.entries[1].timestamp_unix": 287708928, "pe.signatures[0].thumbprint_sha256": "6d73c83b8d15458e0a84db15c894376cedbb9c89c92ac520362e74749606e0cd", "pe.version.original_filename_offset": 148120, "pe.signatures[0].signature_algorithm": "sha256WithRSAEncryption", "pe.signatures[0].signature_digest_algorithm": "sha1" } }, "find": [ { "id": "metadata/signed/unknown::symvc-ltd", "conf": 1.0, "crit": 3, "desc": "Authenticode chain CN: SYMVC LTD" }, { "id": "metadata/signed/leaf::symvc-ltd", "conf": 1.0, "crit": 3, "desc": "Signed by SYMVC LTD" }, { "id": "metadata/signed/certificate::pe-signature-verified-kv", "conf": 1.0, "crit": 2, "desc": "PE Authenticode signature verified metadata" }, { "id": "metadata/binary/vendor::adobe-version-info-company", "conf": 0.949999988079071, "crit": 2, "desc": "Adobe vendor marker in PE version info" }, { "id": "metadata/signed/certificate::pe-cert-issuer-comodo", "conf": 1.0, "crit": 2, "desc": "Issued by Comodo Code Signing CA" }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field" }, { "id": "metadata/binary/layout::has-overlay", "conf": 1.0, "crit": 3, "desc": "PE binary has trailing overlay data" }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure" }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field" } ], "path": "512729", "risk": 4, "size": 162120, "type": "pe" } ] } }