{
  "ml": {
    "v": "7",
    "eng": "2.9.1",
    "lvl": -1,
    "conf": 0,
    "mods": [
      {
        "cls": 0,
        "raw": 0.00005690257,
        "rte": "az",
        "prob": 0.00005690257
      },
      {
        "cls": 0,
        "raw": 0.0046775243,
        "rte": "az/native",
        "prob": 0.0046775243
      },
      {
        "cls": 0,
        "raw": 0.02072228,
        "rte": "az/pe",
        "prob": 0.02072228
      }
    ],
    "prob": 0.00005690257,
    "files": [
      {
        "id": 0,
        "lvl": -1,
        "conf": 0,
        "prob": 0.00005690256875823252,
        "type": "pe"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-09-13T00:18:28Z"
  },
  "path": "XWORMexe.exe",
  "raw": {
    "v": "8",
    "files": [
      {
        "id": 0,
        "ctx": [
          {
            "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J\u0026m(0ji6Sa?dLD+]{51x(+zoA=kPhvqNb%vqY$3BrC47aAzQxazCZol@c-7zeS@@e!5l%bME/A00000p^\u003eu:oAtj}zC9-t0000000000?#A/V",
            "ln": 0
          }
        ],
        "mol": "Md(Bi)",
        "sha": "2b0eb7f9245b4504bfa55c6244b88c6f93135c24c643c854949ac264b5a07f1c",
        "path": "XWORMexe.exe",
        "risk": 1,
        "size": 19432448,
        "type": "pe",
        "facts": {
          "imp": [
            [
              "mscoree",
              "CorExeMain"
            ]
          ],
          "sec": [
            [
              ".text",
              512,
              19429888,
              8.0,
              "r-x"
            ],
            [
              ".rsrc",
              19430400,
              1536,
              3.76,
              "r--"
            ],
            [
              ".reloc",
              19431936,
              512,
              0.1,
              "r--"
            ]
          ],
          "metrics": {
            "pe": {
              "checksum": 0,
              "timestamp": 1783516014,
              "image_size": 19456000,
              "has_manifest": 1,
              "headers_size": 512,
              "checksum_valid": 0,
              "clr.is_il_only": 1,
              "file_alignment": 512,
              "resource_count": 2,
              "has_version_info": 1,
              "checksum_stripped": 1,
              "computed_checksum": 19441959,
              "headers_size_ratio": 0,
              "prose_section_count": 0,
              "reloc_overhang_bytes": 500,
              "reloc_overhang_ratio": 0.98,
              "clr.is_32bit_required": 0,
              "bss_like_section_count": 0,
              "clr.is_32bit_preferred": 0,
              "clr.strong_name_signed": 0,
              "section_overflow_count": 0,
              "clr.is_native_entrypoint": 0,
              "misaligned_section_count": 0,
              "clr.managed_resource_count": 1,
              "base_relocation_block_count": 1,
              "base_relocation_entry_count": 1,
              "clr.managed_resource_max_size": 19420206,
              "declared_data_directory_count": 5,
              "executable_prose_section_count": 0,
              "clr.managed_resource_max_entropy": 8,
              "directory_section_mismatch_count": 0
            },
            "file": {
              "size": 19432448,
              "entropy": 8
            },
            "binary": {
              "is_pie": 1,
              "code_entropy": 8,
              "string_count": 16426,
              "entropy_variance": 10.42,
              "avg_string_length": 4.92,
              "max_string_length": 145,
              "peak_region_bytes": 19417088,
              "code_to_data_ratio": 1,
              "peak_region_entropy": 7.87,
              "string_length_stddev": 2.52,
              "largest_section_ratio": 1,
              "sentence_string_count": 18,
              "sentence_string_ratio": 0,
              "high_entropy_string_count": 0
            },
            "imports": {
              "count": 1
            },
            "sections": {
              "count": 3,
              "code_size": 19429888,
              "entropy_max": 8,
              "entropy_mean": 3.95,
              "name_entropy": 3.03,
              "writable_count": 0,
              "executable_count": 1,
              "nonstandard_count": 0,
              "executable_writable_count": 0
            },
            "consistency": {
              "internal_name_original_filename_mismatch": 0
            },
            "dependencies": {
              "count": 1
            }
          }
        },
        "ident": {
          "name": {
            "value": "XWORMexe.exe",
            "source": "pe.version.original_filename",
            "verified": false
          },
          "trust": "unsigned",
          "version": {
            "value": "1.0.0.0",
            "source": "pe.version.file_version",
            "verified": false
          }
        },
        "traits": [
          {
            "id": "metadata/binary/anomaly/section-header::pe-il-only-without-clr-metadata",
            "conf": 0.97,
            "crit": 3,
            "desc": "IL-only PE lacks a CLR metadata root",
            "spans": [
              [
                0,
                24
              ]
            ]
          }
        ]
      }
    ]
  }
}