{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9580419659614563, "class": 0 } ], "prob": 0.95804197, "class": 0, "models": [ { "m": "az", "prob": 0.69427526, "class": 0 }, { "m": "az/native", "prob": 0.95804197, "class": 0 }, { "m": "az/pe", "prob": 0.72279793, "class": 0 } ], "version": "v16.16", "thresholds": [ 0.9961373, 0.9998425 ], "analyzed_at": "2026-05-12T07:30:19Z" }, "path": "75285", "raw": { "v": "4", "fs": [ { "f": "Md₂(BiSi)", "k": { "hash.imp": "f585ea6e9c3791e541ed7daa51d77d33", "pe.timestamp": 2019954075, "hash.authenti": "e685bcae642ff079e24fd009ab213b682e9fbae15a0ba415d1b63831a4a27e2e", "hash.rich_header": "f56f742de837b8fc56671dc238d873ea3d31dcc4f157068e4d56e61fc2d46056", "build.target_arch": "x86", "pe.linker_version": "8.0", "pe.rich_header.xor_key": "0x167f96c6", "pe.data_directories[0].rva": 28672, "pe.data_directories[1].rva": 37376, "pe.data_directories[2].rva": 28812, "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 843, "pe.data_directories[1].name": "tls", "pe.data_directories[1].size": 24, "pe.data_directories[2].name": "iat", "pe.data_directories[2].size": 156, "pe.rich_header_compids[0].count": 24, "pe.rich_header_compids[1].count": 1, "pe.rich_header_compids[2].count": 1, "pe.rich_header_compids[0].compid": 1253262, "pe.rich_header_compids[1].compid": 1188092, "pe.rich_header_compids[2].compid": 394951, "pe.section_characteristics[0].name": ".text", "pe.section_characteristics[1].name": ".rdata", "pe.section_characteristics[2].name": ".data", "pe.rich_header.entries[0].use_count": 24, "pe.rich_header.entries[1].use_count": 1, "pe.rich_header.entries[2].use_count": 1, "pe.rich_header.entries[0].product_id": 19, "pe.rich_header.entries[1].product_id": 18, "pe.rich_header.entries[2].product_id": 6, "pe.rich_header.entries[0].build_number": 8078, "pe.rich_header.entries[0].product_name": "unknown", "pe.rich_header.entries[1].build_number": 8444, "pe.rich_header.entries[1].product_name": "unknown", "pe.rich_header.entries[2].build_number": 1735, "pe.rich_header.entries[2].product_name": "Cvt_Pgo_VS_v6_or_earlier", "pe.section_characteristics[0].raw_size": 16384, "pe.section_characteristics[1].raw_size": 4096, "pe.section_characteristics[2].raw_size": 8192, "pe.section_characteristics[0].virtual_size": 16384, "pe.section_characteristics[1].virtual_size": 4096, "pe.section_characteristics[2].virtual_size": 8192, "pe.section_characteristics[0].virtual_address": 12288, "pe.section_characteristics[1].virtual_address": 28672, "pe.section_characteristics[2].virtual_address": 32768, "pe.section_characteristics[0].characteristics_hex": "60000020", "pe.section_characteristics[1].characteristics_hex": "40000040", "pe.section_characteristics[2].characteristics_hex": "e0000040" }, "x": 43, "id": 0, "is": [ "dwOKSubclass", "ChooseFontA", "ChooseColorW", "ChooseFontW", "ReplaceTextA", "ColorHLSToRGB", "SHGetValueA", "ColorRGBToHLS", "StrCSpnA", "StrCmpCA", "OleUninitialize", "GetClassFile", "CoUninitialize", "HDC_UserSize", "GetErrorInfo", "DeleteDC", "SetGraphicsMode", "SaveDC", "RestoreDC", "GetLayout", "CreateThread", "ExitProcess", "GetProcAddress", "GlobalAlloc", "GlobalFree", "LoadLibraryA", "VirtualProtect", "WaitForSingleObject", "MulDiv", "Sleep", "GetDateFormatA", "RaiseException", "GetLastError" ], "ms": { "pe": { "entry": 13633.0, "machine": 332.0, "checksum": 0.0, "subsystem": 2.0, "timestamp": 2019954075.0, "image_base": 4194304.0, "entry_section": ".text", "size_of_image": 40960.0, "file_alignment": 512.0, "characteristics": 259.0, "has_rich_header": true, "size_of_headers": 12288.0, "export_timestamp": 0.0, "import_dll_count": 5.0, "computed_checksum": 91593.0, "section_alignment": 4096.0, "timestamp_anomaly": true, "resource_timestamp": 0.0, "timestamp_in_future": true, "has_export_timestamp": false, "linker_major_version": 8.0, "has_resource_timestamp": false, "number_of_rva_and_sizes": 16.0, "api_hashing_indicator_count": 1.0 }, "file": { "size": 29696.0 }, "binary": { "code_size": 24576.0, "func_count": 2.0, "code_entropy": 5.47, "data_entropy": 1.25, "func_density": 0.08, "import_count": 33.0, "string_count": 42.0, "avg_func_size": 23.5, "section_count": 3.0, "avg_complexity": 1.0, "import_density": 1.38, "max_complexity": 1.0, "string_density": 1.75, "overall_entropy": 4.06, "avg_basic_blocks": 1.0, "avg_section_size": 9557.33, "dependency_count": 5.0, "entropy_variance": 2.22, "wx_section_count": 1.0, "avg_string_length": 11.38, "complexity_per_kb": 0.04, "max_string_length": 43.0, "avg_string_entropy": 2.94, "code_to_data_ratio": 6.0, "data_to_file_ratio": 0.28, "text_to_file_ratio": 0.55, "total_basic_blocks": 2.0, "func_analysis_depth": 2.0, "string_length_stddev": 6.02, "largest_section_ratio": 0.55, "sentence_string_count": 1.0, "sentence_string_ratio": 0.02, "writable_section_count": 1.0, "behavioral_import_ratio": 0.09, "executable_section_count": 2.0 } }, "ss": [ [ 80, "This program cannot be run in DOS mode.\r\r\n$" ], [ 168, "Rich" ], [ 504, ".text" ], [ 583, "@.data" ], [ 9764, "P00_2" ], [ 10227, "/W O0" ], [ 12275, "z2\u003eQ" ], [ 12284, "HYP4" ], [ 17704, "comdlg32.dll" ], [ 17719, "dwOKSubclass" ], [ 17734, "ChooseFontA" ], [ 17748, "ChooseColorW" ], [ 17763, "ChooseFontW" ], [ 17777, "ReplaceTextA" ], [ 17790, "SHLWAPI.dll" ], [ 17804, "ColorHLSToRGB" ], [ 17820, "SHGetValueA" ], [ 17834, "ColorRGBToHLS" ], [ 17870, "ole32.dll" ], [ 17882, "OleUninitialize" ], [ 17900, "GetClassFile" ], [ 17915, "CoUninitialize" ], [ 17932, "HDC_UserSize" ], [ 17947, "GetErrorInfo" ], [ 17960, "GDI32.dll" ], [ 17972, "DeleteDC" ], [ 17983, "SetGraphicsMode" ], [ 18010, "RestoreDC" ], [ 18022, "GetLayout" ], [ 18032, "KERNEL32.dll" ], [ 18047, "CreateThread" ], [ 18062, "ExitProcess" ], [ 18076, "GetProcAddress" ], [ 18093, "GlobalAlloc" ], [ 18107, "GlobalFree" ], [ 18120, "LoadLibraryA" ], [ 18135, "VirtualProtect" ], [ 18152, "WaitForSingleObject" ], [ 18196, "Sleep" ], [ 18204, "GetDateFormatA" ], [ 18221, "RaiseException" ], [ 18238, "GetLastError" ] ], "sz": 29696, "ts": [ { "c": 0.699999988079071, "d": "CreateThread API name reference", "e": [ "CreateThread" ], "i": "micro-behaviors/process/threading/create::create-thread-text", "l": 2 }, { "c": 0.800000011920929, "d": "Low-entropy rdata section", "e": [ ".rdata (entropy: 1.25)" ], "i": "metadata/binary/section/metrics::low-entropy-rdata-section", "l": 1 }, { "a": "T1553.002", "c": 0.8500000238418579, "d": "PE lacks VS_VERSION_INFO resource", "e": [ "field 'pe.version_info.file_version' does not exist" ], "i": "objectives/evasion/masquerade/cert::pe-no-version-info-resource", "l": 1 }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2 }, { "c": 0.699999988079071, "d": "Delay execution", "e": [ "Sleep" ], "i": "micro-behaviors/time/timing/delay::sleep-dup", "l": 2 }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "binary.section_count = 3.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "c": 0.699999988079071, "d": "PE has few sections", "e": [ "binary.section_count = 3.00" ], "i": "metadata/binary/layout::legacy-few-sections", "l": 2 }, { "a": "T1027.007", "c": 1.0, "d": "WININET.DLL absent from PE import table", "e": [ "pe.import_dll_count = 5.00" ], "i": "objectives/anti-static/obfuscation/imports::wininet-import-absent", "l": 2, "m": "B0032" }, { "c": 0.800000011920929, "d": "CompanyName field absent from PE version info", "e": [ "field 'pe.version_info.company_name' does not exist" ], "i": "metadata/binary/anomaly/format::version-info-company-name-absent", "l": 1 }, { "d": "Few detected functions (stub-like or analysis-limited)", "e": [ "binary.func_count = 2.00" ], "i": "metadata/binary/metrics/structural::no-functions", "l": 2 }, { "c": 0.8999999761581421, "d": "PE Rich header present (MSVC toolchain)", "e": [ "pe.has_rich_header = 1.00" ], "i": "metadata/binary/resource::rich-header-present", "l": 2 }, { "a": "T1106", "c": 0.8999999761581421, "d": "FFI GetProcAddress API name", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::ffi-getprocaddress-api", "l": 1 }, { "c": 0.8500000238418579, "d": "PE checksum field not set", "e": [ "pe.has_checksum = 0.00" ], "i": "metadata/binary/layout::pe-checksum-absent", "l": 1 }, { "c": 0.8500000238418579, "d": "Raise structured exception", "e": [ "RaiseException" ], "i": "micro-behaviors/os/exception/raise::raise-exception", "l": 2 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 33.00" ], "i": "metadata/binary/metrics/threshold::many-imports-20", "l": 1 }, { "c": 1.0, "d": "Reference to GDI32.dll", "e": [ "GDI32.dll" ], "i": "micro-behaviors/os/module/load::gdi32-dll-reference", "l": 2 }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 40960.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "a": "T1027", "c": 0.8399999737739563, "d": "VB6 PE with three sections", "e": [ "binary.section_count = 3.00" ], "i": "objectives/anti-static/obfuscation/payload/string-sparse::three-section-vb6-layout", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "LoadLibrary symbol", "e": [ "LoadLibraryA" ], "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym", "l": 1 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.75, "d": "Binary exports no symbols", "e": [ "binary.export_count = 0.00" ], "i": "metadata/binary/symbols/exports::no-exports", "l": 1 }, { "c": 0.8199999928474426, "d": "Elevated text section entropy", "e": [ ".text (entropy: 6.68)" ], "i": "metadata/binary/section/metrics::elevated-text-entropy-section", "l": 1 }, { "c": 0.699999988079071, "d": "Get system error code", "e": [ "GetLastError" ], "i": "micro-behaviors/os/exception/error-handling::get-last-error", "l": 2 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 4.06" ], "i": "metadata/binary/metrics/threshold::low-overall-entropy-binary", "l": 1 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 1.00" ], "i": "metadata/binary/metrics/threshold::avg-complexity-15-max", "l": 2 }, { "a": "T1036.005", "c": 0.9700000286102295, "d": "PE has no Authenticode signature", "e": [ "binary.has_signature = 0.00" ], "i": "objectives/evasion/masquerade/version-resource/microsoft-utility::dw20-host-unsigned", "l": 1, "m": "F0004" }, { "c": 0.800000011920929, "d": "Small PE resource section", "e": [ "pe.rsrc_size = 0.00" ], "i": "metadata/package/versioning::pe-small-rsrc", "l": 1 }, { "c": 1.0, "d": "VirtualProtect symbol", "e": [ "VirtualProtect" ], "i": "objectives/anti-static/obfuscation/reflection/class::virtualprotect-sym", "l": 1 }, { "c": 1.0, "d": "PE built after 2020-01-01", "e": [ "pe.timestamp = 2019954075.00" ], "i": "metadata/hardening/mitigation::post-2020-pe", "l": 1 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 33.00" ], "i": "metadata/binary/metrics/threshold::many-imports-30", "l": 1 }, { "a": "T1222.001", "c": 0.949999988079071, "d": "Modify memory page protection", "e": [ "VirtualProtect" ], "i": "micro-behaviors/mem/protect/modify::virtual-protect", "l": 2, "m": "C0021" }, { "c": 0.8999999761581421, "d": "Wait for process/object", "e": [ "WaitForSingleObject" ], "i": "micro-behaviors/process/create/spawn::wait-for-single-object", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "75285" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.6000000238418579, "d": "SOCKS5 UDP ASSOCIATE request opcode", "e": [ "05 03 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-udp-associate-byte", "l": 1 }, { "a": "T1129", "c": 0.949999988079071, "d": "Create thread in current process", "e": [ "CreateThread" ], "i": "micro-behaviors/process/thread/create::create-thread", "l": 2 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 2.94" ], "i": "metadata/binary/metrics/threshold::avg-string-entropy-4-max", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "a": "T1027.007", "c": 0.699999988079071, "d": "PE header access via e_lfanew offset", "e": [ "4b", "49" ], "i": "objectives/anti-static/obfuscation/imports::pe-header-walk", "l": 1, "m": "B0032.014" }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 33.00" ], "i": "metadata/binary/metrics/threshold::many-imports-25", "l": 1 }, { "c": 0.7799999713897705, "d": "Uninitialize COM subsystem", "e": [ "CoUninitialize" ], "i": "micro-behaviors/os/com/invoke::co-uninitialize", "l": 2 }, { "a": "T1055.012", "c": 1.0, "d": "Lacks substantial resources", "e": [ "binary.rsrc_to_file_ratio = 0.00" ], "i": "objectives/evasion/process/injection/hollowing::lacks-substantial-resources", "l": 1, "m": "E1055.012" }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 8192)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "c": 0.8799999952316284, "d": "LoadLibraryA then VirtualProtect strings", "e": [ "LoadLibraryAVirtualProtect" ], "i": "micro-behaviors/mem/protect/modify::loadlibrarya-virtualprotect-pair", "l": 1 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 4.06" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 1.0, "d": "Suspicious combination of imported APIs", "e": [ "pe.api_hashing_indicator_count = 1.00" ], "i": "metadata/binary/metrics/anomaly::suspicious-import-combo-marker", "l": 1 }, { "c": 0.75, "d": "Uninitialize OLE/COM subsystem", "e": [ "OleUninitialize" ], "i": "micro-behaviors/os/com/invoke::ole-uninitialize", "l": 2 }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE timestamp anomaly detected", "e": [ "pe.timestamp_anomaly = 1.00" ], "i": "objectives/evasion/indicator-removal/timestamps::timestamp-anomaly", "l": 2 }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2 }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed/trust-level::unsigned", "l": 3 }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1 }, { "a": "T1574.002", "c": 0.8999999761581421, "d": "Hidden LoadLibraryA string reference", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/dylib/load/runtime::load-library-a-string-no-import", "l": 1 }, { "a": "T1620", "c": 0.8999999761581421, "d": "GetProcAddress loader API string", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-getprocaddress-string", "l": 1, "m": "B0030" }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "binary.import_count = 33.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "c": 0.949999988079071, "d": "PE compile timestamp far in future", "e": [ "pe.timestamp = 2019954075.00" ], "i": "metadata/binary/anomaly/provenance::pe-far-future-timestamp", "l": 4 }, { "c": 0.800000011920929, "d": "Binary lacks resource section entirely", "e": [ "binary.rsrc_to_file_ratio = 0.00" ], "i": "metadata/binary/resource::no-resources", "l": 2 }, { "a": "T1070.006", "c": 0.7799999713897705, "d": "PE header timestamp after 2030", "e": [ "pe.timestamp = 2019954075.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-post-2030", "l": 1 }, { "c": 0.75, "d": "Low average code complexity", "e": [ "binary.avg_complexity = 1.00" ], "i": "metadata/binary/metrics/structural::low-average-complexity", "l": 2 }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 0.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "c": 0.6000000238418579, "d": "Very few sections (merged/stripped)", "e": [ "binary.section_count = 3.00" ], "i": "metadata/binary/metrics/structural::few-sections", "l": 3 }, { "c": 0.4000000059604645, "d": "Very few basic blocks (analysis-limited or sparse)", "e": [ "binary.total_basic_blocks = 2.00" ], "i": "metadata/binary/metrics/structural::few-basic-blocks", "l": 3 }, { "a": "T1070.006", "c": 0.8999999761581421, "d": "Export timestamp is absent", "e": [ "pe.has_export_timestamp = 0.00" ], "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-absent", "l": 2 }, { "a": "T1027.007", "c": 0.8600000143051147, "d": "PE API hashing indicator present", "e": [ "pe.api_hashing_indicator_count = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::pe-api-hashing-indicator-single", "l": 1, "m": "B0032.014" }, { "a": "T1055", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "binary.import_count = 33.00" ], "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571", "l": 1, "m": "C0041" }, { "c": 0.800000011920929, "d": "PE executable is unsigned", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed/trust-level::unsigned-pe-executable", "l": 3 }, { "c": 0.949999988079071, "d": "links SHLWAPI.dll (ColorHLSToRGB, SHGetValueA, ColorRGBToHLS, StrCSpnA, StrCmpCA)", "e": [ "SHLWAPI.dll" ], "i": "metadata/dylib::shlwapi/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links comdlg32.dll (dwOKSubclass, ChooseFontA, ChooseColorW, ChooseFontW, ReplaceTextA)", "e": [ "comdlg32.dll" ], "i": "metadata/dylib::comdlg32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links KERNEL32.dll (CreateThread, ExitProcess, GetProcAddress, GlobalAlloc, GlobalFree, ... +8 more)", "e": [ "KERNEL32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links GDI32.dll (DeleteDC, SetGraphicsMode, SaveDC, RestoreDC, GetLayout)", "e": [ "GDI32.dll" ], "i": "metadata/dylib::gdi32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links ole32.dll (OleUninitialize, GetClassFile, CoUninitialize, HDC_UserSize, GetErrorInfo)", "e": [ "ole32.dll" ], "i": "metadata/dylib::ole32/dll", "l": 2 } ], "sha": "2268f06d258d759fe4946e2d3f6856cad7973cede824c8fdf0f2aa1590e1975d", "path": "/data/samples/bad/datasets/pe-machine-learning-dataset/75285", "type": "pe" } ], "tv": "46790" } }