{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.06094364449381828, "class": 0 } ], "prob": 0.060943644, "class": 0, "models": [ { "m": "az", "prob": 0.060943644, "class": 0 }, { "m": "az/native", "prob": 0.00049701787, "class": 0 }, { "m": "az/pe", "prob": 0.0, "class": 0 } ], "version": "v17.17", "thresholds": [ 0.999503, 0.9998882 ], "analyzed_at": "2026-05-25T22:54:27Z" }, "path": "VirusShare_beb3f61c14d470f215b0dbde086f5adf", "raw": { "v": "5", "fs": [ { "f": "H(Po₂)Md(Bi)", "x": 4, "ff": { "m": { "pe": { "parse_failed": 1.0, "partial_parse": 1.0 }, "file": { "size": 79665.0, "entropy": 5.35, "size_bytes": 79665.0 }, "parse": { "error_count": 2.0 }, "binary": { "is_pie": 0.0 } }, "s": [ [ 77, "u8", "!This program cannot be run in DOS mode." ], [ 200, "u8", "RichY" ], [ 464, "u8", ".text" ], [ 544, "u8", ".rsrc" ], [ 624, "u8", "msvcrt.dll" ], [ 635, "u8", "KERNEL32.dll" ], [ 648, "u8", "NTDLL.DLL" ], [ 658, "u8", "USER32.dll" ], [ 2832, "wide", "CMD.EXE" ], [ 3550, "u8", "JYYS" ], [ 3647, "u8", "QQW3" ], [ 3812, "u8", "JYYf97" ], [ 5014, "u8", "YYuHS" ], [ 5308, "u8", "QQSVWj" ], [ 5616, "u8", "QQSVW" ], [ 6914, "u8", "QSV3" ], [ 7380, "u8", "Jj.h" ], [ 8140, "wide", "COPYCMD" ], [ 9585, "u8", "JYY9" ], [ 9673, "u8", "JVSSj" ], [ 10235, "u8", "JYY3" ], [ 10549, "u8", "YYWS" ], [ 10884, "u8", "JYYW" ], [ 11125, "u8", "JYYV" ], [ 11488, "u8", "Wt j*V" ], [ 12762, "u8", "JSVW" ], [ 14948, "wide", "RANDOM" ], [ 14964, "wide", "CMDCMDLINE" ], [ 15387, "u8", "JYPVV" ], [ 15700, "u8", "SetConsoleInputExeNameW" ], [ 15724, "u8", "IsDebuggerPresent" ], [ 15744, "u8", "CopyFileExW" ], [ 15754, "wide", "WKERNEL32.DLL" ], [ 16046, "u8", "PVhlL" ], [ 16102, "u8", "PVhLL" ], [ 16263, "u8", "Jj Zf;" ], [ 16404, "wide", "AutoRun" ], [ 16420, "wide", "PathCompletionChar" ], [ 16460, "wide", "CompletionChar" ], [ 16492, "wide", "DefaultColor" ], [ 16520, "wide", "DelayedExpansion" ], [ 16556, "wide", "EnableExtensions" ], [ 16592, "wide", "DisableUNCCheck" ], [ 16624, "wide", "Software\\Microsoft\\Command Processor" ], [ 16784, "u8", "SetThreadUILanguage" ], [ 17096, "wide", "Software\\Policies\\Microsoft\\Windows\\System" ], [ 19152, "wide", "MM/dd/yy" ], [ 21302, "u8", "YYuXj" ], [ 21821, "u8", "u7f9" ], [ 22207, "u8", "JYY_" ], [ 22225, "u8", "HuKQS" ], [ 22917, "u8", "tXAAC" ], [ 23220, "u8", "YYtgf" ], [ 23542, "u8", "QQSV" ], [ 23608, "u8", "tDSSVWj" ], [ 23638, "u8", "SNVW" ], [ 23915, "u8", "PSVP" ], [ 27218, "u8", "t295" ], [ 27358, "u8", "QSVW3" ], [ 34272, "wide", "Unknown" ], [ 35321, "u8", "JWWP" ], [ 35872, "wide", "0123456789" ], [ 36629, "u8", "HpjLX" ], [ 36995, "u8", "du1f" ], [ 37640, "wide", "ENABLEEXTENSIONS" ], [ 38326, "u8", "SVW3" ], [ 40064, "u8", "NtQueryInformationProcess" ], [ 40092, "wide", "NTDLL.DLL" ], [ 40124, "u8", "PSVW3" ], [ 41076, "wide", "useback" ], [ 41092, "wide", "usebackq" ], [ 46989, "u8", "f97u" ], [ 48080, "wide", "\u003cnoalias\u003e" ], [ 50131, "u8", "WWWWWj" ], [ 50924, "wide", "DIRCMD" ], [ 51032, "u8", "PWWV" ], [ 52784, "u8", "YYt3h" ], [ 53080, "u8", "JYYP" ], [ 53946, "u8", "SVWtH" ], [ 55910, "u8", "JujSS" ], [ 56126, "u8", "AFFf9" ], [ 57956, "wide", "cmd.exe" ], [ 58041, "u8", "Yu69E" ], [ 58248, "u8", "C:\\\\Program Files\\Debugging Tools for Windows (x64)\\dumpchk.exe" ], [ 79655, "u8", "FACEHACKER" ] ], "v": { "pe.machine": "i386", "pe.subsystem": "windows_cui", "pe.timestamp": 1091600062, "pe.image_base": 1255145472, "pe.image_size": 397312, "pe.machine_id": 332, "pe.os_version": "5.1", "pe.entry_point": 20566, "pe.headers_size": 1024, "pe.partial_parse": true, "pe.subsystem_raw": 3, "pe.file_alignment": 512, "pe.section_alignment": 4096, "pe.subsystem_version": "4.0", "pe.characteristics[0]": "relocs_stripped", "pe.characteristics[1]": "executable_image", "pe.characteristics[2]": "32bit_machine", "pe.characteristics_raw": 271, "pe.linker_major_version": 7, "pe.linker_minor_version": 10, "pe.dll_characteristics[0]": "terminal_server_aware", "pe.dll_characteristics_raw": 32768, "pe.number_of_rva_and_sizes": 16, "pe.coff.dos_header_pe_pointer": 216 }, "er": [ [ "malformed", "pe-parse" ], [ "fallback", "pe-parse" ] ], "id": "pe" }, "id": 0, "sz": 79665, "ts": [ { "a": "T1027", "c": 0.30000001192092896, "d": "PE parsed with header-only fallback (downstream walker failed)", "e": [ "PE parsed with header-only fallback (downstream walker failed)" ], "i": "objectives/anti-analysis/pe-tampering/corrupted-header", "l": 2, "m": "B0001" }, { "a": "T1485", "c": 0.8999999761581421, "d": "Preserves .exe .gho .bak files", "e": [ ".exe" ], "i": "objectives/impact/destroy/file-deletion::exe-gho-bak-whitelist", "l": 1, "m": "C0047" }, { "a": "T1112", "c": 0.699999988079071, "d": "HKCU\\Software path string", "e": [ "Software\\M", "Software\\P" ], "i": "objectives/anti-static/obfuscation/payload/registry::hkcu-software-text", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "CompanyName field absent from PE version info", "e": [ "field 'pe.version.company' does not exist" ], "i": "metadata/binary/anomaly/format::version-info-company-name-absent", "l": 1 }, { "c": 0.949999988079071, "d": "cmd interpreter marker encoded", "e": [ "cmd.exe", "CMD.EXE" ], "i": "metadata/lang/encoded/wide::shell-interpreter-cmd", "l": 1 }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "a": "T1553.002", "c": 0.8500000238418579, "d": "PE lacks VS_VERSION_INFO resource", "e": [ "field 'pe.version.file_version' does not exist" ], "i": "objectives/evasion/masquerade/cert::pe-no-version-info-resource", "l": 1 }, { "c": 0.800000011920929, "d": "cmd.exe command interpreter reference", "e": [ "cmd.exe" ], "i": "micro-behaviors/process/create/exec::cmd-exe-reference", "l": 3 }, { "a": "T1071.001", "c": 0.8999999761581421, "d": "Command/result field word", "e": [ "CMD", "Command", "cmd" ], "i": "objectives/command-and-control/beacon/network/json::result-command-word", "l": 1, "m": "B0030" }, { "c": 1.0, "d": "Reference to USER32.dll", "e": [ "USER32.dll" ], "i": "micro-behaviors/os/module/load::user32-dll-reference", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "VirusShare_beb3f61c14d470f215b0dbde086f5adf" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "a": "T1562", "c": 0.8500000238418579, "d": "NtQueryInformationProcess NT process info query", "e": [ "NtQueryInformationProcess" ], "i": "micro-behaviors/process/control/info::nt-query-information-process", "l": 3 }, { "c": 0.699999988079071, "d": "Encoded HTML tag fragment", "e": [ "\u003cnoalias\u003e" ], "i": "objectives/anti-static/obfuscation/encoding/content::encoded-html-tag-fragment", "l": 1 }, { "c": 0.8500000238418579, "d": "PE with malformed section layout", "e": [ "parse.error_count = 2.00" ], "i": "metadata/binary/metrics/structural::malformed-pe-structure", "l": 3 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "SetThreadUILanguage", "SetConsoleInputExeNameW" ], "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "a": "T1622", "c": 0.949999988079071, "d": "Check if debugger is attached", "e": [ "IsDebuggerPresent" ], "i": "objectives/anti-analysis/debugger-detect/check::is-debugger-present", "l": 1, "m": "B0001" }, { "c": 0.4000000059604645, "d": "cmd.exe Windows command shell reference", "e": [ "CMD.EXE", "cmd.exe" ], "i": "objectives/execution/interpreter/script/shell::cmd-exe-dup", "l": 1 }, { "c": 1.0, "d": "Windows path-like string pattern", "e": [ "C:\\\\Program" ], "i": "micro-behaviors/data/text/path::windows-path-like-string", "l": 2 }, { "d": ".exe extension reference", "e": [ ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "Tiny C string section ratio", "e": [ " = 0.0% of total (0 / 79665 bytes)" ], "i": "metadata/binary/section/metrics::tiny-cstring-section", "l": 1 }, { "c": 1.0, "d": "Contains Windows executable file path", "e": [ ".exe", "C:\\\\Program" ], "i": "micro-behaviors/data/text/path::exe-extension-string", "l": 2 } ], "sha": "2a567073063d836e99417fd5e65d1e48b3bb54ca3b6a11b0ad8f1f5c964ef48e", "path": "VirusShare_beb3f61c14d470f215b0dbde086f5adf", "type": "pe" } ], "tv": "7924e" } }