{
  "ml": {
    "v": "5",
    "fs": [
      {
        "id": 0,
        "prob": 0.8911781907081604,
        "class": 0,
        "threshold": 0.9987763166427612
      }
    ],
    "prob": 0.8911782,
    "class": 0,
    "level": 3,
    "models": [
      {
        "m": "az",
        "prob": 0.8911782,
        "class": 0
      },
      {
        "m": "az/native",
        "prob": 0.27968338,
        "class": 0
      },
      {
        "m": "az/pe",
        "prob": 0.06984127,
        "class": 0
      }
    ],
    "version": "v17.17",
    "threshold": 0.9987763,
    "analyzed_at": "2026-05-31T04:05:02Z"
  },
  "path": "0e2ca3a86d3a4b2db09378a17aa65d667bafe6227b30f1a4ba9079a439d06841.exe",
  "raw": {
    "v": "5",
    "fs": [
      {
        "f": "Md(Bi₃)",
        "x": 40,
        "ff": {
          "m": {
            "pe": {
              "checksum": 62750.0,
              "has_overlay": 1.0,
              "overlay_end": 31274.0,
              "overlay_size": 554.0,
              "checksum_valid": 0.0,
              "overlay_offset": 30720.0,
              "overlay_padding": 554.0,
              "computed_checksum": 63304.0,
              "bss_like_section_count": 0.0,
              "section_overflow_count": 0.0,
              "misaligned_section_count": 0.0,
              "entry_in_writable_section": 1.0
            },
            "file": {
              "size": 31274.0,
              "entropy": 7.78,
              "size_bytes": 31274.0
            },
            "binary": {
              "is_pie": 0.0,
              "has_overlay": 1.0,
              "code_entropy": 7.88,
              "overlay_size": 554.0,
              "string_count": 353.0,
              "overlay_ratio": 0.02,
              "overlay_entropy": 0.0,
              "avg_string_length": 4.78,
              "max_string_length": 43.0,
              "code_to_data_ratio": 1.0,
              "string_length_stddev": 2.26,
              "largest_section_ratio": 0.97,
              "sentence_string_count": 1.0,
              "sentence_string_ratio": 0.0,
              "high_entropy_string_count": 0.0
            },
            "sections": {
              "count": 1.0,
              "code_size": 30208.0,
              "entropy_max": 7.88,
              "entropy_mean": 7.88,
              "name_entropy": 1.92,
              "writable_count": 1.0,
              "executable_count": 1.0,
              "nonstandard_count": 0.0,
              "executable_writable_count": 1.0
            },
            "dependencies": {
              "count": 0.0
            }
          },
          "s": [
            [
              77,
              "u8",
              "!This program cannot be run in DOS mode."
            ],
            [
              376,
              "u8",
              ".text"
            ],
            [
              1073,
              "u8",
              "B1Ohn"
            ],
            [
              1239,
              "u8",
              "USVW"
            ],
            [
              1353,
              "u8",
              "6 A0T"
            ],
            [
              1374,
              "u8",
              "d222"
            ],
            [
              1671,
              "u8",
              "TUTU"
            ],
            [
              2351,
              "u8",
              "pok8o"
            ],
            [
              2372,
              "u8",
              "xopQo"
            ],
            [
              2757,
              "u8",
              "]op[o"
            ],
            [
              4020,
              "u8",
              "yfWy"
            ],
            [
              4281,
              "u8",
              "jj45"
            ],
            [
              4326,
              "u8",
              "Wtjj"
            ],
            [
              4841,
              "u8",
              "bIV9J"
            ],
            [
              5720,
              "u8",
              "fDZuD"
            ],
            [
              5758,
              "u8",
              "uDZRG"
            ],
            [
              5877,
              "xor",
              "$===N_TXYQQ=\\NJURRV=NSEUV====c"
            ],
            [
              6810,
              "xor",
              "%systemroot%\\system32\\ntdll.dll"
            ],
            [
              7743,
              "u8",
              "5555n"
            ],
            [
              7769,
              "u8",
              "i655"
            ],
            [
              8175,
              "u8",
              "755O"
            ],
            [
              8599,
              "u8",
              "BF2B"
            ],
            [
              8628,
              "u8",
              "AQHVV"
            ],
            [
              8971,
              "u8",
              "8qKgs"
            ],
            [
              10057,
              "u8",
              "DGOK5"
            ],
            [
              10072,
              "u8",
              "SYQJ"
            ],
            [
              11617,
              "u8",
              "btIi"
            ],
            [
              12140,
              "u8",
              "xabQZ"
            ],
            [
              13799,
              "u8",
              "04SHQ"
            ],
            [
              17313,
              "u8",
              "paJj"
            ],
            [
              17349,
              "u8",
              "HS XsB"
            ],
            [
              18143,
              "u8",
              "PpNZP"
            ],
            [
              18692,
              "u8",
              "oRqDK"
            ],
            [
              20403,
              "u8",
              "8X3Z"
            ],
            [
              21075,
              "u8",
              "JHeiL"
            ],
            [
              22242,
              "u8",
              "SM2.mHn"
            ],
            [
              23002,
              "u8",
              "dNfc"
            ],
            [
              24181,
              "u8",
              "6KV6aX"
            ],
            [
              25739,
              "u8",
              "pXOAk"
            ],
            [
              25891,
              "u8",
              "1Cxat"
            ],
            [
              26341,
              "u8",
              "aUIAK"
            ],
            [
              30179,
              "u8",
              "DA0JI"
            ]
          ],
          "v": {
            "file.stem": "0e2ca3a86d3a4b2db09378a17aa65d667bafe6227b30f1a4ba9079a439d06841",
            "pe.machine": "i386",
            "pe.subsystem": "windows_gui",
            "pe.timestamp": 1687783602,
            "file.basename": "0e2ca3a86d3a4b2db09378a17aa65d667bafe6227b30f1a4ba9079a439d06841.exe",
            "pe.image_base": 4194304,
            "pe.image_size": 36864,
            "pe.machine_id": 332,
            "pe.os_version": "1.0",
            "pe.entry_point": 12868,
            "pe.headers_size": 512,
            "pe.entry_section": ".text",
            "pe.subsystem_raw": 2,
            "pe.file_alignment": 512,
            "pe.image_hash.sha1": "3233da4861c2817bf7705c04e71b708d3397f699",
            "pe.image_hash.sha256": "848cf3f43f54e482c6074cad2ce8d7b70ebca0e377b906305e75d38ffeff639c",
            "pe.image_hash.sha384": "3be8be254101382df09a5ac6f3f76fc2bc30694ca78ddedd922e2896fd4f94e22d410cfa2e21ad967afe6ddcc75804e3",
            "pe.image_hash.sha512": "8efe01d6c83f4c64fa5d1b3ff4888cd85ec5fd2843847829853d88638201babe4bafdb476640d86634a63dae00ebc9fe77a2a9faa292726475770ad4ec25ae0b",
            "pe.section_alignment": 4096,
            "pe.subsystem_version": "5.1",
            "pe.characteristics[0]": "relocs_stripped",
            "pe.characteristics[1]": "executable_image",
            "pe.characteristics[2]": "32bit_machine",
            "pe.characteristics_raw": 271,
            "pe.linker_major_version": 1,
            "pe.linker_minor_version": 72,
            "pe.number_of_rva_and_sizes": 16,
            "pe.coff.dos_header_pe_pointer": 128
          },
          "id": "pe",
          "sc": [
            [
              ".text",
              512,
              30208,
              7.88,
              "rwx"
            ]
          ]
        },
        "id": 0,
        "sz": 31274,
        "ts": [
          {
            "c": 1.0,
            "d": "File is a compiled binary",
            "e": [
              "0e2ca3a86d3a4b2db09378a17aa65d667bafe6227b30f1a4ba9079a439d06841.exe"
            ],
            "i": "metadata/binary/framework::is-binary",
            "l": 1
          },
          {
            "d": ".dll extension reference",
            "e": [
              ".dll"
            ],
            "i": "micro-behaviors/fs/path/extension::dll-dup",
            "l": 2,
            "el": [
              "0x1a9a"
            ]
          },
          {
            "c": 0.699999988079071,
            "d": "PE has few sections",
            "e": [
              "sections.count = 1.00"
            ],
            "i": "metadata/binary/layout::legacy-few-sections",
            "l": 2
          },
          {
            "c": 0.8199999928474426,
            "d": "Elevated text section entropy",
            "e": [
              ".text (entropy: 7.88)"
            ],
            "i": "metadata/binary/section/metrics::elevated-text-entropy-section",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "PE file uses .exe extension",
            "e": [
              "0e2ca3a86d3a4b2db09378a17aa65d667bafe6227b30f1a4ba9079a439d06841.exe"
            ],
            "i": "metadata/binary/framework::exe-extension",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "PE has many readable strings",
            "e": [
              "binary.string_count = 353.00"
            ],
            "i": "metadata/binary/layout::many-readable-strings",
            "l": 2
          },
          {
            "a": "T1027",
            "c": 1.0,
            "d": "Binary has normal code entropy (\u003e5.5)",
            "e": [
              "binary.code_entropy = 7.88"
            ],
            "i": "objectives/anti-static/obfuscation/binary-metrics/shape::normal-code-entropy",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.8999999761581421,
            "d": "PE standard code/data section",
            "e": [
              ".text"
            ],
            "i": "metadata/binary/section/names::pe-code-data-standard-section",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Binary has 4 or fewer sections",
            "e": [
              "sections.count = 1.00"
            ],
            "i": "objectives/command-and-control/infrastructure/config::max-sections-4",
            "l": 1
          },
          {
            "d": "SYSTEMROOT environment variable",
            "e": [
              "%systemroot%\\system32\\ntdll.dll"
            ],
            "i": "micro-behaviors/os/env/vars/system-info::systemroot-var",
            "l": 2,
            "el": [
              "0x1a9a"
            ]
          },
          {
            "c": 0.800000011920929,
            "d": "CompanyName field absent from PE version info",
            "e": [
              "field 'pe.version.company' does not exist"
            ],
            "i": "metadata/binary/anomaly/format::version-info-company-name-absent",
            "l": 1,
            "el": [
              "value:pe.version.company"
            ]
          },
          {
            "a": "T1027",
            "c": 0.699999988079071,
            "d": "Code section dominates file layout",
            "e": [
              "binary.largest_section_ratio = 0.97"
            ],
            "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.8999999761581421,
            "d": "Low entropy overlay payload",
            "e": [
              "binary.overlay_entropy = 0.00"
            ],
            "i": "metadata/binary/layout::low-overlay-entropy",
            "l": 3
          },
          {
            "c": 0.8500000238418579,
            "d": "Direct NT API access",
            "e": [
              "%systemroot%\\system32\\ntdll.dll"
            ],
            "i": "micro-behaviors/os/syscall/invoke::ntdll-import",
            "l": 2,
            "el": [
              "0x1a9a"
            ]
          },
          {
            "c": 1.0,
            "d": "PE binary has trailing overlay data",
            "e": [
              "binary.has_overlay = 1.00"
            ],
            "i": "metadata/binary/layout::has-overlay",
            "l": 3
          },
          {
            "a": "T1553.002",
            "c": 0.8500000238418579,
            "d": "PE lacks VS_VERSION_INFO resource",
            "e": [
              "field 'pe.version.file_version' does not exist"
            ],
            "i": "objectives/evasion/masquerade/cert::pe-no-version-info-resource",
            "l": 1,
            "el": [
              "value:pe.version.file_version"
            ]
          },
          {
            "a": "T1027",
            "c": 0.8199999928474426,
            "d": "Packed loader largest section ratio above 0.65",
            "e": [
              "binary.largest_section_ratio = 0.97"
            ],
            "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.8500000238418579,
            "d": "High code section entropy",
            "e": [
              "binary.code_entropy = 7.88"
            ],
            "i": "metadata/binary/metrics/pe-details::high-code-entropy-go",
            "l": 3
          },
          {
            "a": "T1562.001",
            "c": 1.0,
            "d": "ntdll.dll string reference",
            "e": [
              "%systemroot%\\system32\\ntdll.dll"
            ],
            "i": "objectives/evasion/anti-av/platform/defender::ntdll-dll-str",
            "l": 1,
            "el": [
              "0x1a9a"
            ]
          },
          {
            "c": 0.8500000238418579,
            "d": "High entropy executable section",
            "e": [
              ".text (entropy: 7.88, perms: rwx)"
            ],
            "i": "metadata/binary/section/metrics::high-entropy-exec-section",
            "l": 3
          },
          {
            "a": "T1045",
            "c": 0.6000000238418579,
            "d": "Single section dominates file (packer",
            "e": [
              "binary.largest_section_ratio = 0.97"
            ],
            "i": "objectives/anti-static/obfuscation/binary-metrics/shape::dominant-section",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1055",
            "c": 0.949999988079071,
            "d": "Huge null run in executable (128+ bytes)",
            "e": [
              "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00"
            ],
            "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text",
            "l": 1,
            "el": [
              "0x766d"
            ]
          },
          {
            "c": 0.6000000238418579,
            "d": "Single section dominates file (packer)",
            "e": [
              "binary.largest_section_ratio = 0.97"
            ],
            "i": "metadata/binary/metrics/structural::dominant-section",
            "l": 3
          },
          {
            "c": 0.949999988079071,
            "d": "Filename has EXE extension",
            "e": [
              "0e2ca3a86d3a4b2db09378a17aa65d667bafe6227b30f1a4ba9079a439d06841.exe"
            ],
            "i": "objectives/evasion/masquerade/file/double-ext::basename-is-exe",
            "l": 1
          },
          {
            "c": 0.6000000238418579,
            "d": "Very few sections (merged/stripped)",
            "e": [
              "sections.count = 1.00"
            ],
            "i": "metadata/binary/metrics/structural::few-sections",
            "l": 3
          },
          {
            "a": "T1027",
            "c": 0.8600000143051147,
            "d": "Dominant section for VB6 loader profile",
            "e": [
              "binary.largest_section_ratio = 0.97"
            ],
            "i": "objectives/anti-static/obfuscation/payload/string-sparse::dominant-text-layout-vb6",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.9200000166893005,
            "d": "Writable .text section (custom packer indicator)",
            "e": [
              ".text (size: 30208, entropy: 7.88, perms: rwx)"
            ],
            "i": "metadata/binary/section/metrics::writable-text-section",
            "l": 4
          },
          {
            "a": "T1027",
            "c": 0.949999988079071,
            "d": "Regex component marker",
            "e": [
              "binary.largest_section_ratio = 0.97"
            ],
            "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188",
            "l": 1,
            "m": "B0032"
          }
        ],
        "sha": "0e2ca3a86d3a4b2db09378a17aa65d667bafe6227b30f1a4ba9079a439d06841",
        "path": "0e2ca3a86d3a4b2db09378a17aa65d667bafe6227b30f1a4ba9079a439d06841.exe",
        "type": "pe"
      }
    ],
    "tv": "52045"
  }
}