{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 0.9815003871917725,
        "class": 1
      }
    ],
    "prob": 0.9815004,
    "class": 1,
    "oprob": 0.91053504,
    "oclass": 0,
    "version": "v16.16",
    "thresholds": [
      0.9815004,
      0.99404883
    ],
    "analyzed_at": "2026-05-01T19:14:21Z"
  },
  "path": "36474",
  "raw": {
    "v": "4",
    "fs": [
      {
        "f": "KO₃(As₆AlC₃)Md₃(Bi₇HeSi)",
        "x": 189,
        "id": 0,
        "is": [
          "RegisterConsoleOS2",
          "GetEnvironmentVariableW",
          "GlobalWire",
          "GetCommTimeouts",
          "WriteConsoleInputVDMW",
          "GetFileSizeEx",
          "GetStringTypeExW",
          "InterlockedIncrement",
          "GetEnvironmentStrings",
          "SetConsoleDisplayMode",
          "GetConsoleAliasExesW"
        ],
        "ms": {
          "binary": {
            "code_size": 42496.0,
            "file_size": 96256.0,
            "wx_sections": 2.0,
            "import_count": 11.0,
            "string_count": 52.0,
            "section_count": 4.0,
            "avg_complexity": 1.0,
            "function_count": 1.0,
            "import_density": 0.27,
            "max_complexity": 1.0,
            "string_density": 1.25,
            "overall_entropy": 7.93,
            "avg_basic_blocks": 1.0,
            "avg_section_size": 21376.0,
            "function_density": 0.02,
            "avg_function_size": 9560.0,
            "avg_string_length": 8.69,
            "complexity_per_kb": 0.02,
            "max_string_length": 40.0,
            "writable_sections": 4.0,
            "avg_string_entropy": 2.49,
            "code_section_ratio": 0.5,
            "code_to_data_ratio": 0.99,
            "data_to_file_ratio": 0.45,
            "text_to_file_ratio": 0.14,
            "total_basic_blocks": 1.0,
            "executable_sections": 2.0,
            "section_name_entropy": 2.7,
            "string_length_stddev": 7.34,
            "largest_section_ratio": 0.45,
            "sentence_string_count": 1.0,
            "sentence_string_ratio": 0.02,
            "function_analysis_depth": 2.0,
            "has_malformed_structure": true,
            "normalized_import_count": 0.04,
            "normalized_section_count": 0.24,
            "nonstandard_section_name_count": 2.0
          }
        },
        "ss": [
          [
            77,
            "!This program cannot be run in DOS mode."
          ],
          [
            160,
            "Rich"
          ],
          [
            424,
            ".text"
          ],
          [
            464,
            "rdata"
          ],
          [
            504,
            ".data"
          ],
          [
            544,
            ".krdata"
          ],
          [
            2232,
            "o0g7"
          ],
          [
            14221,
            "Wxnn"
          ],
          [
            14583,
            "KERNEL32.dll"
          ],
          [
            14599,
            "RegisterConsoleOS2"
          ],
          [
            14621,
            "GetEnvironmentVariableW"
          ],
          [
            14648,
            "GlobalWire"
          ],
          [
            14662,
            "GetCommTimeouts"
          ],
          [
            14681,
            "WriteConsoleInputVDMW"
          ],
          [
            14706,
            "GetFileSizeEx"
          ],
          [
            14723,
            "GetStringTypeExW"
          ],
          [
            14743,
            "InterlockedIncrement"
          ],
          [
            14767,
            "GetEnvironmentStrings"
          ],
          [
            14792,
            "SetConsoleDisplayMode"
          ],
          [
            14817,
            "GetConsoleAliasExesW"
          ],
          [
            26522,
            "o35c"
          ],
          [
            29039,
            "BJ6G"
          ],
          [
            31005,
            "JVNR"
          ],
          [
            32471,
            "750J"
          ],
          [
            33250,
            "ius1"
          ],
          [
            34748,
            "F nt"
          ],
          [
            41187,
            "7FYH"
          ],
          [
            41434,
            "H1_K"
          ],
          [
            51376,
            "QSUZI"
          ],
          [
            51937,
            "45RF"
          ],
          [
            53441,
            "/e469"
          ],
          [
            55357,
            "XYU8"
          ],
          [
            55620,
            "sh.x"
          ],
          [
            55748,
            ".xmt"
          ],
          [
            56935,
            "elxe"
          ],
          [
            57481,
            "7s5a"
          ],
          [
            63683,
            "OzuS+tPTtsf6"
          ],
          [
            64740,
            "drz3a"
          ],
          [
            70892,
            "T9F4"
          ],
          [
            71836,
            "MN 7"
          ],
          [
            76196,
            "YMQ4"
          ],
          [
            82434,
            "AOF3K"
          ],
          [
            83112,
            "nao2zkg"
          ],
          [
            86694,
            "Getu"
          ],
          [
            86702,
            "Procu"
          ],
          [
            86711,
            "Addru"
          ],
          [
            86759,
            "CloseHandle"
          ],
          [
            86785,
            "CreateEventA"
          ],
          [
            86812,
            "GetLastError"
          ],
          [
            86945,
            "VT_3"
          ],
          [
            86964,
            "RQQP"
          ],
          [
            91721,
            "`Bq`"
          ]
        ],
        "sz": 96256,
        "ts": [
          {
            "a": "T1027",
            "c": 0.800000011920929,
            "d": "PE header too corrupted to parse: Malformed entity: Rich header does not contain the DanS marker",
            "e": [
              "Malformed entity: Rich header does not contain the DanS marker"
            ],
            "i": "objectives/anti-analysis/pe-tampering/corrupted-header",
            "l": 4,
            "m": "B0001"
          },
          {
            "c": 1.0,
            "d": "GetEnvironmentVariableW import",
            "e": [
              "GetEnvironmentVariableW"
            ],
            "i": "well-known/malware/trojan/hijack-gen::get-environment-variable-w-import",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Binary has low average string entropy",
            "e": [
              "binary.avg_string_entropy = 2.49"
            ],
            "i": "metadata/binary/metrics::avg-string-entropy-4-max",
            "l": 2
          },
          {
            "c": 0.75,
            "d": "Binary exports no symbols",
            "e": [
              "binary.export_count = 0.00"
            ],
            "i": "metadata/binary/symbols::no-exports",
            "l": 1
          },
          {
            "d": "Few detected functions (stub-like or analysis-limited)",
            "e": [
              "binary.function_count = 1.00"
            ],
            "i": "metadata/binary/metrics::no-functions",
            "l": 2
          },
          {
            "c": 0.800000011920929,
            "d": "Get environment strings",
            "e": [
              "GetEnvironmentStrings"
            ],
            "i": "micro-behaviors/os/env/access::get-environment-strings",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "Low function count metric",
            "e": [
              "binary.function_count = 1.00"
            ],
            "i": "metadata/binary/metrics/markers::low-function-count-marker",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "Very low code entropy, minimal code",
            "e": [
              "binary.code_entropy = 0.00"
            ],
            "i": "metadata/binary/resource::low-code-entropy",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "Binary has low average complexity",
            "e": [
              "binary.avg_complexity = 1.00"
            ],
            "i": "metadata/binary/metrics::avg-complexity-15-max",
            "l": 2
          },
          {
            "c": 0.8999999761581421,
            "d": "Close handle",
            "e": [
              "CloseHandle"
            ],
            "i": "micro-behaviors/process/create/spawn::close-handle-dup",
            "l": 2
          },
          {
            "a": "T1105",
            "c": 1.0,
            "d": "Binary has high overall entropy",
            "e": [
              "binary.overall_entropy = 7.93"
            ],
            "i": "objectives/command-and-control/dropper/staging::high-entropy-binary",
            "l": 1
          },
          {
            "d": ".dll extension reference",
            "e": [
              ".dll"
            ],
            "i": "micro-behaviors/fs/path/extension::dll-dup",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "Binary has 4 or fewer sections",
            "e": [
              "binary.section_count = 4.00"
            ],
            "i": "objectives/command-and-control/infrastructure/config::max-sections-4",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "PE standard code/data section",
            "e": [
              ".text",
              ".data"
            ],
            "i": "metadata/binary/section/names::pe-code-data-standard-section",
            "l": 1
          },
          {
            "c": 0.949999988079071,
            "d": "Random low-entropy RWX cavity section",
            "e": [
              ".text (size: 13824, entropy: 0.00, perms: -rwx)",
              ".krdata (size: 28672, entropy: 0.00, perms: -rwx)"
            ],
            "i": "metadata/binary/section/metrics::random-rwx-cavity-section",
            "l": 4
          },
          {
            "c": 0.800000011920929,
            "d": "PE with exactly four sections",
            "e": [
              "binary.section_count = 4.00"
            ],
            "i": "metadata/binary/metrics::four-section-pe",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Binary is not position-independent (fixed load address)",
            "e": [
              "binary.is_pie = 0.00"
            ],
            "i": "metadata/hardening::no-pie",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "File is a compiled binary",
            "e": [
              "binary.file_size = 96256.00"
            ],
            "i": "metadata/binary/framework::is-binary",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "Binary lacks resource section entirely",
            "e": [
              "binary.rsrc_to_file_ratio = 0.00"
            ],
            "i": "metadata/binary/resource::no-resources",
            "l": 2
          },
          {
            "a": "T1027.007",
            "c": 0.800000011920929,
            "d": "DLL name strings without LoadLibrary import",
            "e": [
              "binary.import_count = 11.00"
            ],
            "i": "objectives/anti-static/obfuscation/string/runtime-decrypt::dll-names-no-loadlibrary",
            "l": 1,
            "m": "B0032.014"
          },
          {
            "c": 0.8999999761581421,
            "d": "Tiny C string section ratio",
            "e": [
              " = 0.0% of total (0 / 96256 bytes)"
            ],
            "i": "metadata/binary/section/metrics::tiny-cstring-section",
            "l": 1
          },
          {
            "a": "T1045",
            "c": 0.949999988079071,
            "d": "Multiple W+X sections (packer pattern)",
            "e": [
              "binary.wx_sections = 2.00"
            ],
            "i": "objectives/anti-static/obfuscation/binary-metrics::many-wx-sections",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.8500000238418579,
            "d": "High overall file entropy (likely",
            "e": [
              "binary.overall_entropy = 7.93"
            ],
            "i": "objectives/anti-static/obfuscation/binary-metrics::high-overall-entropy",
            "l": 3,
            "m": "B0032"
          },
          {
            "c": 0.9900000095367432,
            "d": "Single-function packed stub layout",
            "e": [
              "binary.function_count = 1.00"
            ],
            "i": "well-known/malware/worm/mydoom::metric-function-count-1",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.9200000166893005,
            "d": "Zero-entropy executable section (carved/packed PE)",
            "e": [
              ".text (size: 13824, entropy: 0.00, perms: -rwx)",
              ".krdata (size: 28672, entropy: 0.00, perms: -rwx)"
            ],
            "i": "objectives/anti-static/obfuscation/binary-metrics::zero-entropy-executable-section",
            "l": 4,
            "m": "B0032"
          },
          {
            "a": "T1055",
            "c": 0.8999999761581421,
            "d": "Writable and executable sections (self-modifying",
            "e": [
              "binary.wx_sections = 2.00"
            ],
            "i": "objectives/anti-static/obfuscation/binary-metrics::wx-sections",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.8600000143051147,
            "d": "Long mixed-case identifiers cluster",
            "e": [
              "GetEnvironmentVariableW",
              "WriteConsoleInputVDMW",
              "InterlockedIncrement",
              "SetConsoleDisplayMode",
              "GetConsoleAliasExesW"
            ],
            "i": "objectives/anti-static/obfuscation/string::long-mixedcase-identifiers",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 1.0,
            "d": "Binary is not digitally signed",
            "e": [
              "binary.has_signature = 0.00"
            ],
            "i": "metadata/signed::unsigned",
            "l": 2
          },
          {
            "c": 0.8500000238418579,
            "d": "Low function count metric",
            "e": [
              "binary.function_count = 1.00"
            ],
            "i": "metadata/binary/anomaly::low-function-count-marker",
            "l": 1
          },
          {
            "c": 0.9900000095367432,
            "d": "Single stub function layout",
            "e": [
              "binary.function_count = 1.00"
            ],
            "i": "well-known/malware/worm/ludbaruma::metric-function-count-1",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.699999988079071,
            "d": "Oversized data section vs code",
            "e": [
              "rdata",
              ".data",
              ".krdata",
              "rdata+.data+.krdata = 518.5% of text (71680 / 13824 bytes)"
            ],
            "i": "objectives/anti-static/obfuscation/payload/section::oversized-data-section",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.8500000238418579,
            "d": "PE with malformed section layout",
            "e": [
              "binary.has_malformed_structure = 1.00"
            ],
            "i": "metadata/binary/metrics::malformed-pe-structure",
            "l": 3
          },
          {
            "a": "T1105",
            "c": 0.800000011920929,
            "d": "Compact PE import table",
            "e": [
              "binary.import_count = 11.00"
            ],
            "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table",
            "l": 1,
            "m": "E1105"
          },
          {
            "c": 0.75,
            "d": "Low average code complexity",
            "e": [
              "binary.avg_complexity = 1.00"
            ],
            "i": "metadata/binary/metrics::low-average-complexity",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "Writable and executable section (W^X violation)",
            "e": [
              ".text (size: 13824, perms: -rwx)",
              ".krdata (size: 28672, perms: -rwx)"
            ],
            "i": "metadata/hardening/memory::wx-section",
            "l": 3
          },
          {
            "a": "T1045",
            "c": 0.949999988079071,
            "d": "Very high entropy (strongly indicates",
            "e": [
              "binary.overall_entropy = 7.93"
            ],
            "i": "objectives/anti-static/obfuscation/binary-metrics::very-high-entropy",
            "l": 3,
            "m": "B0032"
          },
          {
            "c": 0.4000000059604645,
            "d": "Very few basic blocks (analysis-limited or sparse)",
            "e": [
              "binary.total_basic_blocks = 1.00"
            ],
            "i": "metadata/binary/metrics::few-basic-blocks",
            "l": 2
          },
          {
            "c": 0.8500000238418579,
            "d": "High entropy executable section (possible packing)",
            "e": [
              ".text"
            ],
            "i": "objectives/anti-static/pack/entropy::high-entropy-section",
            "l": 3
          },
          {
            "c": 0.800000011920929,
            "d": "High entropy executable section (possible packing)",
            "e": [
              ".text"
            ],
            "i": "objectives/anti-static/obfuscation/instruction/junk::high-entropy-generic",
            "l": 3
          },
          {
            "c": 0.800000011920929,
            "d": "PE executable is unsigned",
            "e": [
              "binary.has_signature = 0.00"
            ],
            "i": "metadata/signed::unsigned-pe-executable",
            "l": 3
          },
          {
            "c": 0.949999988079071,
            "d": "links KERNEL32.dll (RegisterConsoleOS2, GetEnvironmentVariableW, GlobalWire, GetCommTimeouts, WriteConsoleInputVDMW, ... +6 more)",
            "e": [
              "KERNEL32.dll"
            ],
            "i": "metadata/dylib::kernel32/dll",
            "l": 2
          },
          {
            "a": "T1045",
            "c": 0.949999988079071,
            "d": "Binary is heavily packed/encrypted",
            "e": [
              "binary.overall_entropy = 7.93",
              "binary.function_count = 1.00",
              "binary.wx_sections = 2.00"
            ],
            "i": "objectives/anti-static/obfuscation/binary-metrics::binary-heavily-packed",
            "l": 5,
            "m": "B0032"
          }
        ],
        "sha": "12c498c575a60f3c492d3310e2d5dd8392bc0fa0bf9b5c69ba602c625c77f018",
        "path": "/data/samples/bad/datasets/pe-machine-learning-dataset/36474",
        "type": "pe"
      }
    ],
    "tv": "2a0fe"
  }
}