{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 0.7817023992538452,
        "class": 0
      }
    ],
    "prob": 0.7817024,
    "class": 0,
    "models": [
      {
        "m": "az",
        "prob": 0.7817024,
        "class": 0
      },
      {
        "m": "az/native",
        "prob": 0.00023250407,
        "class": 0
      },
      {
        "m": "az/pe",
        "prob": 0.0,
        "class": 0
      }
    ],
    "version": "v16.16",
    "thresholds": [
      0.9983558,
      0.99991804
    ],
    "analyzed_at": "2026-05-18T00:10:11Z"
  },
  "path": "2bc02026317099fc027bcf8a91c7005246b8ea61f28dace5293b7b0cc2de42b0.dll",
  "raw": {
    "v": "4",
    "fs": [
      {
        "f": "Md₂(Bi₂Si)",
        "k": {
          "hash.imp": "0fbf32532db2d14e7ac3ea5fae7eb05b",
          "pe.timestamp": 1752593570,
          "hash.authenti": "69df916edc0d466c0457ac0e068e7b858b41fc66de6a613bdc9318e96509c1a9",
          "build.target_arch": "x86",
          "pe.linker_version": "11.0",
          "pe.resource_types[0]": "RT_VERSION",
          "pe.data_directories[0].rva": 9076,
          "pe.data_directories[1].rva": 16384,
          "pe.data_directories[2].rva": 24576,
          "pe.data_directories[3].rva": 8192,
          "pe.data_directories[4].rva": 8200,
          "pe.data_directories[0].name": "import",
          "pe.data_directories[0].size": 87,
          "pe.data_directories[1].name": "resource",
          "pe.data_directories[1].size": 680,
          "pe.data_directories[2].name": "base_relocation",
          "pe.data_directories[2].size": 12,
          "pe.data_directories[3].name": "iat",
          "pe.data_directories[3].size": 8,
          "pe.data_directories[4].name": "clr_runtime_header",
          "pe.data_directories[4].size": 72,
          "pe.version_info.file_version": "0.0.0.0",
          "pe.dll_characteristics.no_seh": true,
          "pe.version_info.internal_name": "dpelxyxn.dll",
          "pe.version_info.legal_copyright": " ",
          "pe.version_info.product_version": "0.0.0.0",
          "pe.dll_characteristics.nx_compat": true,
          "pe.version_info.file_description": " ",
          "pe.version_info.original_filename": "dpelxyxn.dll",
          "pe.section_characteristics[0].name": ".text",
          "pe.section_characteristics[1].name": ".rsrc",
          "pe.section_characteristics[2].name": ".reloc",
          "pe.dll_characteristics.dynamic_base": true,
          "pe.section_characteristics[0].raw_size": 1024,
          "pe.section_characteristics[1].raw_size": 1024,
          "pe.section_characteristics[2].raw_size": 512,
          "pe.section_characteristics[0].virtual_size": 980,
          "pe.section_characteristics[1].virtual_size": 680,
          "pe.section_characteristics[2].virtual_size": 12,
          "pe.dll_characteristics.terminal_server_aware": true,
          "pe.section_characteristics[0].virtual_address": 8192,
          "pe.section_characteristics[1].virtual_address": 16384,
          "pe.section_characteristics[2].virtual_address": 24576,
          "pe.section_characteristics[0].characteristics_hex": "60000020",
          "pe.section_characteristics[1].characteristics_hex": "40000040",
          "pe.section_characteristics[2].characteristics_hex": "42000040"
        },
        "x": 6,
        "id": 0,
        "is": [
          "CorDllMain"
        ],
        "ms": {
          "pe": {
            "entry": 9166.0,
            "machine": 332.0,
            "checksum": 0.0,
            "is_dotnet": true,
            "rsrc_size": 1024.0,
            "subsystem": 3.0,
            "timestamp": 1752593570.0,
            "image_base": 268435456.0,
            "clr_version": "2.5",
            "rsrc_entropy": 2.17,
            "entry_section": ".text",
            "size_of_image": 32768.0,
            "file_alignment": 512.0,
            "resource_count": 1.0,
            "resource_types": [
              "RT_VERSION"
            ],
            "characteristics": 8450.0,
            "size_of_headers": 512.0,
            "export_timestamp": 0.0,
            "has_version_info": true,
            "import_dll_count": 1.0,
            "computed_checksum": 12517.0,
            "section_alignment": 8192.0,
            "resource_timestamp": 0.0,
            "dll_characteristics": 34112.0,
            "has_export_timestamp": false,
            "linker_major_version": 11.0,
            "has_resource_timestamp": false,
            "number_of_rva_and_sizes": 16.0
          },
          "file": {
            "size": 3072.0
          },
          "binary": {
            "code_size": 1024.0,
            "code_entropy": 4.33,
            "import_count": 1.0,
            "string_count": 36.0,
            "section_count": 3.0,
            "import_density": 1.0,
            "string_density": 36.0,
            "overall_entropy": 2.19,
            "avg_section_size": 853.33,
            "dependency_count": 1.0,
            "entropy_variance": 1.73,
            "avg_string_length": 14.53,
            "max_string_length": 40.0,
            "wide_string_count": 12.0,
            "avg_string_entropy": 3.21,
            "code_to_data_ratio": 0.67,
            "rsrc_to_file_ratio": 0.33,
            "text_to_file_ratio": 0.33,
            "string_length_stddev": 8.14,
            "largest_section_ratio": 0.33,
            "sentence_string_count": 1.0,
            "sentence_string_ratio": 0.03
          }
        },
        "ss": [
          [
            77,
            "!This program cannot be run in DOS mode."
          ],
          [
            376,
            ".text"
          ],
          [
            455,
            "@.reloc"
          ],
          [
            993,
            "\u003cModule\u003e"
          ],
          [
            1002,
            "dpelxyxn.dll"
          ],
          [
            1015,
            "Win32ShowWindow"
          ],
          [
            1031,
            "Win32Functions"
          ],
          [
            1046,
            "mscorlib"
          ],
          [
            1055,
            "System"
          ],
          [
            1062,
            "Object"
          ],
          [
            1069,
            "GetConsoleWindow"
          ],
          [
            1086,
            "ShowWindow"
          ],
          [
            1097,
            ".ctor"
          ],
          [
            1108,
            "nCmdShow"
          ],
          [
            1117,
            "System.Runtime.CompilerServices"
          ],
          [
            1149,
            "CompilationRelaxationsAttribute"
          ],
          [
            1181,
            "RuntimeCompatibilityAttribute"
          ],
          [
            1211,
            "dpelxyxn"
          ],
          [
            1220,
            "System.Runtime.InteropServices"
          ],
          [
            1251,
            "DllImportAttribute"
          ],
          [
            1270,
            "kernel32.dll"
          ],
          [
            1283,
            "user32.dll"
          ],
          [
            1371,
            "WrapNonExceptionThrows"
          ],
          [
            1470,
            "mscoree.dll"
          ],
          [
            1630,
            "wide",
            "VS_VERSION_INFO"
          ],
          [
            1722,
            "wide",
            "VarFileInfo"
          ],
          [
            1754,
            "wide",
            "Translation"
          ],
          [
            1790,
            "wide",
            "StringFileInfo"
          ],
          [
            1850,
            "wide",
            "FileDescription"
          ],
          [
            1894,
            "wide",
            "FileVersion"
          ],
          [
            1942,
            "wide",
            "InternalName"
          ],
          [
            1968,
            "wide",
            "dpelxyxn.dll"
          ],
          [
            2002,
            "wide",
            "LegalCopyright"
          ],
          [
            2042,
            "wide",
            "OriginalFilename"
          ],
          [
            2110,
            "wide",
            "ProductVersion"
          ],
          [
            2162,
            "wide",
            "Assembly Version"
          ]
        ],
        "sz": 3072,
        "ts": [
          {
            "c": 1.0,
            "d": ".NET assembly detected via BSJB CLR metadata signature",
            "e": [
              "BSJB at offset 0x258"
            ],
            "i": "metadata/dotnet/bsjb-signature",
            "l": 2
          },
          {
            "c": 0.699999988079071,
            "d": "PE imports from one DLL",
            "e": [
              "pe.import_dll_count = 1.00"
            ],
            "i": "metadata/binary/symbols/imports::pe-single-import-dll",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "Tiny PE single-function stub",
            "e": [
              "binary.func_count = 0.00"
            ],
            "i": "metadata/binary/layout::tiny-single-function-pe",
            "l": 3
          },
          {
            "c": 0.699999988079071,
            "d": "PE OriginalFilename metadata field",
            "e": [
              "OriginalFilename"
            ],
            "i": "metadata/package/versioning::pe-originalfilename-field",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "Binary has 4 or fewer sections",
            "e": [
              "binary.section_count = 3.00"
            ],
            "i": "objectives/command-and-control/infrastructure/config::max-sections-4",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "PE has few sections",
            "e": [
              "binary.section_count = 3.00"
            ],
            "i": "metadata/binary/layout::legacy-few-sections",
            "l": 2
          },
          {
            "c": 0.699999988079071,
            "d": "PE FileDescription metadata field",
            "e": [
              "FileDescription"
            ],
            "i": "metadata/package/versioning::pe-filedescription-field",
            "l": 2
          },
          {
            "c": 0.8999999761581421,
            "d": "PE standard code/data section",
            "e": [
              ".text"
            ],
            "i": "metadata/binary/section/names::pe-code-data-standard-section",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "NO_SEH (SafeSEH not used)",
            "e": [
              "true"
            ],
            "i": "metadata/hardening/mitigation::pe-no-seh",
            "l": 2
          },
          {
            "c": 0.699999988079071,
            "d": "PE InternalName metadata field",
            "e": [
              "InternalName"
            ],
            "i": "metadata/package/versioning::pe-internalname-field",
            "l": 2
          },
          {
            "c": 1.0,
            "d": ".NET Metadata Root (BSJB)",
            "e": [
              "BSJB"
            ],
            "i": "metadata/binary/framework::dotnet-metadata",
            "l": 2
          },
          {
            "c": 0.8999999761581421,
            "d": "PE resource section",
            "e": [
              ".rsrc"
            ],
            "i": "metadata/binary/section/names::pe-resource-section",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "PE with six or fewer imports",
            "e": [
              "binary.import_count = 1.00"
            ],
            "i": "metadata/binary/symbols/imports::pe-imports-max-six",
            "l": 1
          },
          {
            "c": 0.949999988079071,
            "d": "PE version info numeric fields present",
            "e": [
              "0.0.0.0"
            ],
            "i": "metadata/binary/anomaly/format::version-info-file-version-present",
            "l": 1
          },
          {
            "a": "T1036.005",
            "c": 0.9700000286102295,
            "d": "PE has no Authenticode signature",
            "e": [
              "binary.has_signature = 0.00"
            ],
            "i": "objectives/evasion/masquerade/version-resource/microsoft-utility::dw20-host-unsigned",
            "l": 1,
            "m": "F0004"
          },
          {
            "c": 0.75,
            "d": "Runtime interop services",
            "e": [
              "System.Runtime.InteropServices"
            ],
            "i": "metadata/lang/compiler/managed::runtime-interop",
            "l": 2
          },
          {
            "c": 1.0,
            "d": ".NET binary (PE with BSJB metadata)",
            "e": [
              "pe.is_dotnet = 1.00"
            ],
            "i": "metadata/binary/metrics/threshold::dotnet-binary",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "PE import table has exactly one entry",
            "e": [
              "binary.import_count = 1.00"
            ],
            "i": "metadata/binary/symbols/imports::single-import-raw",
            "l": 1
          },
          {
            "d": "Few detected functions (stub-like or analysis-limited)",
            "e": [
              "binary.func_count = 0.00"
            ],
            "i": "metadata/binary/metrics/structural::no-functions",
            "l": 2
          },
          {
            "c": 0.9200000166893005,
            "d": "PE ProductVersion resembles IPv4",
            "e": [
              "0.0.0.0"
            ],
            "i": "metadata/package/versioning::pe-product-version-ipv4-shape",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Tiny PE by file size",
            "e": [
              "pe.machine = 332.00"
            ],
            "i": "metadata/binary/metrics/size::tiny-pe",
            "l": 3
          },
          {
            "a": "T1622",
            "c": 0.949999988079071,
            "d": "Minimal PE import DLL count (\u003c= 3)",
            "e": [
              "pe.import_dll_count = 1.00"
            ],
            "i": "objectives/anti-analysis/debugger-detect/stub::minimal-import-dll-count",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "PE mapped image under 768 KiB",
            "e": [
              "pe.size_of_image = 32768.00"
            ],
            "i": "metadata/binary/layout::image-under-768kb",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "VB6 binary with very few strings",
            "e": [
              "binary.string_count = 36.00"
            ],
            "i": "objectives/anti-static/obfuscation/payload/string-sparse::low-string-count-vb6",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.9200000166893005,
            "d": "PE FileVersion resembles IPv4",
            "e": [
              "0.0.0.0"
            ],
            "i": "metadata/package/versioning::pe-file-version-ipv4-shape",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Binary has low average complexity",
            "e": [
              "binary.avg_complexity = 0.00"
            ],
            "i": "metadata/binary/metrics/threshold::avg-complexity-15-max",
            "l": 2
          },
          {
            "a": "T1036",
            "c": 0.949999988079071,
            "d": "PE FileDescription is single-character placeholder",
            "e": [
              " "
            ],
            "i": "objectives/evasion/masquerade/identity/fabricated::pe-file-description-single-char",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "ASLR enabled (DYNAMIC_BASE)",
            "e": [
              "true"
            ],
            "i": "metadata/hardening/mitigation::pe-aslr",
            "l": 2
          },
          {
            "a": "T1036.005",
            "c": 0.9700000286102295,
            "d": "Console subsystem on dw20 claim",
            "e": [
              "pe.subsystem = 3.00"
            ],
            "i": "objectives/evasion/masquerade/version-resource/microsoft-utility::dw20-cui-subsystem",
            "l": 1,
            "m": "F0004"
          },
          {
            "a": "T1027",
            "c": 0.699999988079071,
            "d": "Zero recovered functions",
            "e": [
              "binary.func_count = 0.00"
            ],
            "i": "objectives/anti-static/obfuscation/payload/encrypted::zero-function-count",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 1.0,
            "d": "File is a compiled binary",
            "e": [
              "2bc02026317099fc027bcf8a91c7005246b8ea61f28dace5293b7b0cc2de42b0.dll"
            ],
            "i": "metadata/binary/framework::is-binary",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "Small PE resource section",
            "e": [
              "pe.rsrc_size = 1024.00"
            ],
            "i": "metadata/package/versioning::pe-small-rsrc",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "mscorlib reference",
            "e": [
              "mscorlib"
            ],
            "i": "metadata/lang/compiler/managed::mscorlib",
            "l": 2
          },
          {
            "c": 0.8500000238418579,
            "d": "DLL filename extension present",
            "e": [
              "2bc02026317099fc027bcf8a91c7005246b8ea61f28dace5293b7b0cc2de42b0.dll"
            ],
            "i": "objectives/evasion/masquerade/dll/name::dll-basename",
            "l": 2
          },
          {
            "d": ".dll extension reference",
            "e": [
              ".dll"
            ],
            "i": "micro-behaviors/fs/path/extension::dll-dup",
            "l": 2
          },
          {
            "c": 0.699999988079071,
            "d": "PE has low overall entropy",
            "e": [
              "binary.overall_entropy = 2.19"
            ],
            "i": "metadata/binary/layout::low-overall-entropy",
            "l": 2
          },
          {
            "c": 0.949999988079071,
            "d": "PE FileDescription field is populated",
            "e": [
              " "
            ],
            "i": "metadata/package/versioning::pe-file-description-present",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.8399999737739563,
            "d": "VB6 PE with three sections",
            "e": [
              "binary.section_count = 3.00"
            ],
            "i": "objectives/anti-static/obfuscation/payload/string-sparse::three-section-vb6-layout",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.9900000095367432,
            "d": "PE version resource text",
            "e": [
              "VS_VERSION_INFO"
            ],
            "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.8999999761581421,
            "d": "PE .reloc section presence",
            "e": [
              ".reloc"
            ],
            "i": "metadata/binary/section/names::reloc-section-presence",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "Tiny .NET assembly (\u003c 8KB)",
            "e": [
              "pe.is_dotnet = 1.00"
            ],
            "i": "metadata/binary/metrics/size::tiny-dotnet",
            "l": 3
          },
          {
            "c": 1.0,
            "d": "PE first resource is RT_VERSION",
            "e": [
              "RT_VERSION"
            ],
            "i": "metadata/binary/resource::pe-resource-version-first",
            "l": 2
          },
          {
            "c": 0.8999999761581421,
            "d": "Binary has low overall entropy",
            "e": [
              "binary.overall_entropy = 2.19"
            ],
            "i": "metadata/binary/metrics/threshold::low-overall-entropy-binary",
            "l": 1
          },
          {
            "c": 0.8500000238418579,
            "d": "PE checksum field not set",
            "e": [
              "pe.has_checksum = 0.00"
            ],
            "i": "metadata/binary/layout::pe-checksum-absent",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "CompanyName field absent from PE version info",
            "e": [
              "field 'pe.version_info.company_name' does not exist"
            ],
            "i": "metadata/binary/anomaly/format::version-info-company-name-absent",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "DEP / NX enabled (NX_COMPAT)",
            "e": [
              "true"
            ],
            "i": "metadata/hardening/mitigation::pe-dep",
            "l": 2
          },
          {
            "c": 0.8999999761581421,
            "d": "PE standard runtime section",
            "e": [
              ".reloc"
            ],
            "i": "metadata/binary/section/names::pe-runtime-standard-section",
            "l": 1
          },
          {
            "c": 0.75,
            "d": "Binary exports no symbols",
            "e": [
              "binary.export_count = 0.00"
            ],
            "i": "metadata/binary/symbols/exports::no-exports",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Binary has low average string entropy",
            "e": [
              "binary.avg_string_entropy = 3.21"
            ],
            "i": "metadata/binary/metrics/threshold::avg-string-entropy-4-max",
            "l": 2
          },
          {
            "c": 0.800000011920929,
            "d": "Regex component marker",
            "e": [
              "StringFileInfo"
            ],
            "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7",
            "l": 1
          },
          {
            "a": "T1055.012",
            "c": 1.0,
            "d": "Lacks substantial data section",
            "e": [
              "binary.data_to_file_ratio = 0.00"
            ],
            "i": "objectives/evasion/process/injection/hollowing::lacks-substantial-data",
            "l": 1,
            "m": "E1055.012"
          },
          {
            "c": 1.0,
            "d": "PE built after 2020-01-01",
            "e": [
              "pe.timestamp = 1752593570.00"
            ],
            "i": "metadata/hardening/mitigation::post-2020-pe",
            "l": 1
          },
          {
            "c": 0.8399999737739563,
            "d": "PE has DLL characteristics",
            "e": [
              "pe.characteristics = 8450.00"
            ],
            "i": "metadata/binary/metrics/pe-details::pe-dll-characteristics",
            "l": 1
          },
          {
            "c": 0.949999988079071,
            "d": "PE LegalCopyright field is populated",
            "e": [
              " "
            ],
            "i": "metadata/package/versioning::pe-legal-copyright-present",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Binary is not digitally signed",
            "e": [
              "binary.has_signature = 0.00"
            ],
            "i": "metadata/signed/trust-level::unsigned",
            "l": 3
          },
          {
            "c": 1.0,
            "d": ".NET BSJB metadata marker",
            "e": [
              "BSJB"
            ],
            "i": "metadata/binary/framework::bsjb-marker",
            "l": 1
          },
          {
            "a": "T1070.006",
            "c": 0.8999999761581421,
            "d": "Export timestamp is absent",
            "e": [
              "pe.has_export_timestamp = 0.00"
            ],
            "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-absent",
            "l": 2
          },
          {
            "a": "T1027",
            "c": 0.800000011920929,
            "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)",
            "e": [
              "pe.resource_count = 1.00"
            ],
            "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources",
            "l": 1
          },
          {
            "a": "T1027.007",
            "c": 1.0,
            "d": "WININET.DLL absent from PE import table",
            "e": [
              "pe.import_dll_count = 1.00"
            ],
            "i": "objectives/anti-static/obfuscation/imports::wininet-import-absent",
            "l": 2,
            "m": "B0032"
          },
          {
            "a": "T1105",
            "c": 0.800000011920929,
            "d": "Compact PE import table",
            "e": [
              "binary.import_count = 1.00"
            ],
            "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table",
            "l": 1,
            "m": "E1105"
          },
          {
            "a": "T1055",
            "c": 0.9200000166893005,
            "d": "Regex component marker",
            "e": [
              "binary.import_count = 1.00"
            ],
            "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571",
            "l": 1,
            "m": "C0041"
          },
          {
            "a": "T1612",
            "c": 0.8500000238418579,
            "d": "PE has few icon resources",
            "e": [
              "pe.icon_count = 0.00"
            ],
            "i": "objectives/anti-static/obfuscation/payload/resource::icon-count-under-six",
            "l": 1,
            "m": "B0023"
          },
          {
            "c": 0.949999988079071,
            "d": "links mscoree.dll (CorDllMain)",
            "e": [
              "mscoree.dll"
            ],
            "i": "metadata/dylib::mscoree/dll",
            "l": 2
          },
          {
            "a": "T1036.005",
            "c": 0.9399999976158142,
            "d": "Two dotted-quad version strings",
            "e": [
              "0.0.0.0"
            ],
            "i": "objectives/evasion/masquerade/identity/fabricated::dotted-quad-version-pair",
            "l": 1
          },
          {
            "c": 0.949999988079071,
            "d": "PE version numbers look like IPv4",
            "e": [
              "0.0.0.0"
            ],
            "i": "metadata/package/versioning::version-number-ipv4-metadata",
            "l": 1
          },
          {
            "c": 1.0,
            "d": ".NET Assembly (mscoree.dll)",
            "e": [
              "pe.is_dotnet = 1.00",
              "BSJB"
            ],
            "i": "metadata/binary/framework::dotnet-assembly",
            "l": 2
          }
        ],
        "sha": "2bc02026317099fc027bcf8a91c7005246b8ea61f28dace5293b7b0cc2de42b0",
        "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/2bc02026317099fc027bcf8a91c7005246b8ea61f28dace5293b7b0cc2de42b0.dll",
        "type": "pe"
      }
    ],
    "tv": "60127"
  }
}