{
  "ml": {
    "v": "5",
    "fs": [
      {
        "id": 0,
        "prob": 0.8911781907081604,
        "class": 0,
        "threshold": 0.9987763166427612
      }
    ],
    "prob": 0.8911782,
    "class": 0,
    "level": 3,
    "models": [
      {
        "m": "az",
        "prob": 0.8911782,
        "class": 0
      },
      {
        "m": "az/native",
        "prob": 0.43843845,
        "class": 0
      },
      {
        "m": "az/pe",
        "prob": 0.1388889,
        "class": 0
      }
    ],
    "version": "v17.17",
    "threshold": 0.9987763,
    "analyzed_at": "2026-05-31T08:15:03Z"
  },
  "path": "2d721df670fdb63c643b3de2dcdd46311b8d94d2753b47ad0035392644dee77a.exe",
  "raw": {
    "v": "5",
    "fs": [
      {
        "f": "O(Dy)H(Po)",
        "x": 4,
        "ff": {
          "i": [
            [
              "kernel32",
              "WinExec"
            ],
            [
              "kernel32",
              "GetBinaryTypeA"
            ],
            [
              "kernel32",
              "GetComputerNameA"
            ],
            [
              "kernel32",
              "ExitProcess"
            ],
            [
              "user32",
              "BringWindowToTop"
            ],
            [
              "user32",
              "AppendMenuA"
            ]
          ],
          "m": {
            "pe": {
              "checksum": 17626.0,
              "checksum_valid": 1.0,
              "computed_checksum": 17626.0,
              "bss_like_section_count": 0.0,
              "section_overflow_count": 0.0,
              "misaligned_section_count": 0.0
            },
            "file": {
              "size": 2560.0,
              "entropy": 4.38,
              "size_bytes": 2560.0
            },
            "binary": {
              "is_pie": 0.0,
              "code_entropy": 4.49,
              "data_entropy": 4.51,
              "string_count": 19.0,
              "entropy_variance": 0.0,
              "avg_string_length": 9.89,
              "max_string_length": 44.0,
              "code_to_data_ratio": 0.5,
              "string_length_stddev": 9.01,
              "largest_section_ratio": 0.4,
              "sentence_string_count": 1.0,
              "sentence_string_ratio": 0.05,
              "high_entropy_string_count": 0.0
            },
            "imports": {
              "count": 6.0
            },
            "sections": {
              "count": 2.0,
              "code_size": 1024.0,
              "entropy_max": 4.51,
              "entropy_mean": 4.5,
              "name_entropy": 2.45,
              "writable_count": 1.0,
              "executable_count": 1.0,
              "nonstandard_count": 0.0,
              "executable_writable_count": 0.0
            },
            "dependencies": {
              "count": 2.0
            }
          },
          "s": [
            [
              77,
              "u8",
              "!This program cannot be run in DOS mode."
            ],
            [
              376,
              "u8",
              ".text"
            ],
            [
              2108,
              "u8",
              "kernel32.dll"
            ],
            [
              2123,
              "u8",
              "WinExec"
            ],
            [
              2133,
              "u8",
              "GetBinaryTypeA"
            ],
            [
              2150,
              "u8",
              "GetComputerNameA"
            ],
            [
              2169,
              "u8",
              "ExitProcess"
            ],
            [
              2181,
              "u8",
              "user32.dll"
            ],
            [
              2194,
              "u8",
              "BringWindowToTop"
            ],
            [
              2213,
              "u8",
              "AppendMenuA"
            ]
          ],
          "v": {
            "file.stem": "2d721df670fdb63c643b3de2dcdd46311b8d94d2753b47ad0035392644dee77a",
            "pe.imphash": "2e5a1176fc39ed148165dbe2da2bad74",
            "pe.machine": "i386",
            "pe.subsystem": "windows_gui",
            "file.basename": "2d721df670fdb63c643b3de2dcdd46311b8d94d2753b47ad0035392644dee77a.exe",
            "pe.image_base": 4194304,
            "pe.image_size": 12288,
            "pe.machine_id": 332,
            "pe.os_version": "4.0",
            "pe.entry_point": 4096,
            "pe.headers_size": 512,
            "pe.entry_section": ".text",
            "pe.subsystem_raw": 2,
            "pe.file_alignment": 512,
            "pe.image_hash.sha1": "b94b76e70681737ee73120cc1e6a15df908035e6",
            "pe.image_hash.sha256": "ee976f071e238f7f22f9bd1ef6fd021527ca15379a568e9cec3a53b7d9d61ac0",
            "pe.image_hash.sha384": "539f5620c22d471bc517b8e04daa5de224ba22691390472133d0f6b3305d2660cab8b9e148741e3af31c78c498b86f32",
            "pe.image_hash.sha512": "1ccf70d1351579e0166ffd388fd76aa6ad8e3185d3651193cf8199fb9794e705d43ccdc4d90812faf77a5e1d49736b85de3a5f352f7333c9af40292aff3c449b",
            "pe.section_alignment": 4096,
            "pe.subsystem_version": "4.0",
            "pe.characteristics[0]": "relocs_stripped",
            "pe.characteristics[1]": "executable_image",
            "pe.characteristics[2]": "32bit_machine",
            "pe.characteristics_raw": 783,
            "pe.linker_major_version": 6,
            "pe.data_directories[0].rva": 8640,
            "pe.data_directories[1].rva": 8700,
            "pe.number_of_rva_and_sizes": 16,
            "pe.data_directories[0].name": "import",
            "pe.data_directories[0].size": 60,
            "pe.data_directories[1].name": "iat",
            "pe.data_directories[1].size": 32,
            "pe.coff.dos_header_pe_pointer": 128
          },
          "id": "pe",
          "sc": [
            [
              ".text",
              512,
              1024,
              4.49,
              "r-x"
            ],
            [
              ".data",
              1536,
              1024,
              4.51,
              "rw-"
            ]
          ]
        },
        "id": 0,
        "sz": 2560,
        "ts": [
          {
            "c": 1.0,
            "d": "File is a compiled binary",
            "e": [
              "2d721df670fdb63c643b3de2dcdd46311b8d94d2753b47ad0035392644dee77a.exe"
            ],
            "i": "metadata/binary/framework::is-binary",
            "l": 1
          },
          {
            "c": 0.9800000190734863,
            "d": "BringWindowToTop import symbol",
            "e": [
              "BringWindowToTop"
            ],
            "i": "metadata/binary/symbols/imports::bringwindowtotop-import",
            "l": 1,
            "el": [
              "0x2210"
            ]
          },
          {
            "d": ".dll extension reference",
            "e": [
              ".dll"
            ],
            "i": "micro-behaviors/fs/path/extension::dll-dup",
            "l": 2,
            "el": [
              "0x83c"
            ]
          },
          {
            "c": 0.699999988079071,
            "d": "PE has few sections",
            "e": [
              "sections.count = 2.00"
            ],
            "i": "metadata/binary/layout::legacy-few-sections",
            "l": 2
          },
          {
            "c": 0.8999999761581421,
            "d": "PE file uses .exe extension",
            "e": [
              "2d721df670fdb63c643b3de2dcdd46311b8d94d2753b47ad0035392644dee77a.exe"
            ],
            "i": "metadata/binary/framework::exe-extension",
            "l": 1
          },
          {
            "a": "T1082",
            "c": 0.8999999761581421,
            "d": "Query computer/host name",
            "e": [
              "GetComputerNameA"
            ],
            "i": "micro-behaviors/os/sysinfo/hostname::get-computer-name",
            "l": 2,
            "el": [
              "0x866"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "PE standard code/data section",
            "e": [
              ".text",
              ".data"
            ],
            "i": "metadata/binary/section/names::pe-code-data-standard-section",
            "l": 1
          },
          {
            "a": "T1082",
            "c": 0.8999999761581421,
            "d": "GetComputerName P/Invoke string for hostname recon",
            "e": [
              "GetComputerNameA"
            ],
            "i": "objectives/discovery/host/fingerprint::getcomputername-text",
            "l": 3,
            "el": [
              "0x866"
            ]
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "VB6 binary with very few strings",
            "e": [
              "binary.string_count = 19.00"
            ],
            "i": "objectives/anti-static/obfuscation/payload/string-sparse::low-string-count-vb6",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 1.0,
            "d": "Binary has 4 or fewer sections",
            "e": [
              "sections.count = 2.00"
            ],
            "i": "objectives/command-and-control/infrastructure/config::max-sections-4",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "CompanyName field absent from PE version info",
            "e": [
              "field 'pe.version.company' does not exist"
            ],
            "i": "metadata/binary/anomaly/format::version-info-company-name-absent",
            "l": 1,
            "el": [
              "value:pe.version.company"
            ]
          },
          {
            "a": "T1106",
            "c": 0.8999999761581421,
            "d": "WinExec command execution API",
            "e": [
              "WinExec"
            ],
            "i": "micro-behaviors/process/create/exec::winexec",
            "l": 3,
            "el": [
              "0x21fc"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "Exit current process",
            "e": [
              "ExitProcess"
            ],
            "i": "micro-behaviors/process/terminate/kill::exit-process",
            "l": 2,
            "el": [
              "0x2208"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "PE has under ten imports",
            "e": [
              "imports.count = 6.00"
            ],
            "i": "objectives/anti-static/pack/runtime::pe-import-count-under-10",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "PE with six or fewer imports",
            "e": [
              "imports.count = 6.00"
            ],
            "i": "metadata/binary/symbols/imports::pe-imports-max-six",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "PE checksum matches computed value",
            "e": [
              "pe.checksum_valid = 1.00"
            ],
            "i": "metadata/binary/layout::pe-checksum-valid",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "Tiny writable data section",
            "e": [
              ".data (size: 1024)"
            ],
            "i": "metadata/binary/section/metrics::tiny-data-section",
            "l": 1
          },
          {
            "a": "T1553.002",
            "c": 0.8500000238418579,
            "d": "PE lacks VS_VERSION_INFO resource",
            "e": [
              "field 'pe.version.file_version' does not exist"
            ],
            "i": "objectives/evasion/masquerade/cert::pe-no-version-info-resource",
            "l": 1,
            "el": [
              "value:pe.version.file_version"
            ]
          },
          {
            "d": "COMPUTERNAME environment variable",
            "e": [
              "GetComputerNameA"
            ],
            "i": "micro-behaviors/os/env/vars/system-info::computername-var",
            "l": 2,
            "el": [
              "0x866"
            ]
          },
          {
            "a": "T1027.007",
            "c": 0.800000011920929,
            "d": "DLL name strings without LoadLibrary import",
            "e": [
              "imports.count = 6.00"
            ],
            "i": "objectives/anti-static/obfuscation/string/runtime-decrypt::dll-names-no-loadlibrary",
            "l": 1,
            "m": "B0032.014"
          },
          {
            "c": 0.8999999761581421,
            "d": "Tiny C string section ratio",
            "e": [
              " = 0.0% of total (0 / 2560 bytes)"
            ],
            "i": "metadata/binary/section/metrics::tiny-cstring-section",
            "l": 1
          },
          {
            "a": "T1105",
            "c": 0.800000011920929,
            "d": "Compact PE import table",
            "e": [
              "imports.count = 6.00"
            ],
            "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table",
            "l": 1,
            "m": "E1105"
          },
          {
            "a": "T1027.007",
            "c": 0.8999999761581421,
            "d": "Kernel32 DLL resolution string",
            "e": [
              "kernel32.dll"
            ],
            "i": "micro-behaviors/os/api-resolution/manual::kernel32-resolver",
            "l": 1,
            "el": [
              "0x83c"
            ]
          },
          {
            "a": "T1055",
            "c": 0.949999988079071,
            "d": "Huge null run in executable (128+ bytes)",
            "e": [
              "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00"
            ],
            "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text",
            "l": 1,
            "el": [
              "0x40d"
            ]
          },
          {
            "a": "T1055",
            "c": 0.9200000166893005,
            "d": "Regex component marker",
            "e": [
              "imports.count = 6.00"
            ],
            "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571",
            "l": 1,
            "m": "C0041"
          },
          {
            "c": 0.949999988079071,
            "d": "Filename has EXE extension",
            "e": [
              "2d721df670fdb63c643b3de2dcdd46311b8d94d2753b47ad0035392644dee77a.exe"
            ],
            "i": "objectives/evasion/masquerade/file/double-ext::basename-is-exe",
            "l": 1
          },
          {
            "c": 0.6000000238418579,
            "d": "Very few sections (merged/stripped)",
            "e": [
              "sections.count = 2.00"
            ],
            "i": "metadata/binary/metrics/structural::few-sections",
            "l": 3
          },
          {
            "c": 0.949999988079071,
            "d": "links user32 (BringWindowToTop, AppendMenuA)",
            "e": [
              "user32"
            ],
            "i": "metadata/dylib::user32",
            "l": 2,
            "el": [
              "2 symbols"
            ]
          },
          {
            "c": 0.949999988079071,
            "d": "links kernel32 (WinExec, GetBinaryTypeA, GetComputerNameA, ExitProcess)",
            "e": [
              "kernel32"
            ],
            "i": "metadata/dylib::kernel32",
            "l": 2,
            "el": [
              "4 symbols"
            ]
          }
        ],
        "sha": "2d721df670fdb63c643b3de2dcdd46311b8d94d2753b47ad0035392644dee77a",
        "path": "2d721df670fdb63c643b3de2dcdd46311b8d94d2753b47ad0035392644dee77a.exe",
        "type": "pe"
      }
    ],
    "tv": "52045"
  }
}