{
  "ml": {
    "v": "7",
    "eng": "2.9.1",
    "lvl": -1,
    "conf": 0,
    "mods": [
      {
        "cls": 0,
        "raw": 0.000065366425,
        "rte": "az",
        "prob": 0.000065366425
      },
      {
        "cls": 0,
        "raw": 0.0014995536,
        "rte": "az/native",
        "prob": 0.0014995536
      },
      {
        "cls": 0,
        "raw": 0.005612751,
        "rte": "az/pe",
        "prob": 0.005612751
      }
    ],
    "prob": 0.000065366425,
    "files": [
      {
        "id": 0,
        "lvl": -1,
        "conf": 0,
        "prob": 0.00006536642467835918,
        "type": "pe"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-09-12T19:25:40Z"
  },
  "path": "Backdoor.Win32.Vipdataend.jg",
  "raw": {
    "v": "8",
    "rev": "c7f7e",
    "files": [
      {
        "id": 0,
        "ctx": [
          {
            "b": "o\u003cf^Z0rr910SSu6%nJc2kMy=:4GDFe8#]%s00000xL?E2D2\u003euOaw^8%By!%7rXMcX0000000000kMy=:p^\u003eu:oAtj}8d2SV0000000000?#F^*3JQqD000000mg-",
            "ln": 0
          }
        ],
        "mol": "K(Am)",
        "sha": "2ffff6c6eff1ce456b640e361afe85f7989e082483eb5a50bc8bcd7268ffeb0c",
        "path": "Backdoor.Win32.Vipdataend.jg",
        "risk": 1,
        "size": 127650,
        "type": "pe",
        "facts": {
          "imp": [
            [
              "kernel32",
              "LoadLibraryA"
            ],
            [
              "kernel32",
              "GetProcAddress"
            ],
            [
              "kernel32",
              "VirtualFree"
            ],
            [
              "kernel32",
              "VirtualAlloc"
            ]
          ],
          "sec": [
            [
              "hmimys",
              512,
              0,
              0.0,
              "rwx"
            ],
            [
              "hmimys",
              512,
              127138,
              7.98,
              "rwx"
            ],
            [
              "hmimys",
              512,
              0,
              0.0,
              "rwx"
            ]
          ],
          "metrics": {
            "pe": {
              "checksum": 133623,
              "timestamp": 708992537,
              "icon_count": 2,
              "image_size": 565248,
              "headers_size": 512,
              "checksum_valid": 0,
              "file_alignment": 512,
              "resource_count": 6,
              "has_version_info": 1,
              "computed_checksum": 128591,
              "headers_size_ratio": 0,
              "prose_section_count": 0,
              "bss_like_section_count": 2,
              "section_overflow_count": 0,
              "misaligned_section_count": 0,
              "version.identity_entropy": 4.42,
              "entry_in_writable_section": 1,
              "declared_data_directory_count": 3,
              "version.identity_symbol_ratio": 0.06,
              "executable_prose_section_count": 0,
              "directory_section_mismatch_count": 0
            },
            "file": {
              "size": 127650,
              "entropy": 7.97
            },
            "binary": {
              "is_pie": 0,
              "code_entropy": 7.98,
              "string_count": 123,
              "avg_string_length": 7.2,
              "max_string_length": 47,
              "peak_region_bytes": 121506,
              "code_to_data_ratio": 1,
              "peak_region_entropy": 7.85,
              "string_length_stddev": 6.62,
              "largest_section_ratio": 1,
              "sentence_string_count": 3,
              "sentence_string_ratio": 0.02,
              "high_entropy_string_count": 0
            },
            "imports": {
              "count": 4
            },
            "sections": {
              "count": 3,
              "code_size": 127138,
              "entropy_max": 7.98,
              "entropy_mean": 7.98,
              "name_entropy": 2.25,
              "writable_count": 3,
              "executable_count": 3,
              "nonstandard_count": 3,
              "executable_writable_count": 3
            },
            "consistency": {
              "extension_content_mismatch": 1,
              "internal_name_original_filename_mismatch": 0,
              "extension_content_mismatch.binary_as_unknown": 1
            },
            "dependencies": {
              "count": 1
            }
          }
        },
        "ident": {
          "name": {
            "value": "rpcs.exe",
            "source": "pe.version.original_filename",
            "verified": false
          },
          "trust": "unsigned",
          "project": {
            "value": "Microsoft(R) Windows(R) Operating System",
            "source": "pe.version.product_name",
            "verified": false
          },
          "version": {
            "value": "5.2.3790.1830",
            "source": "pe.version.file_version",
            "verified": false
          },
          "organization": {
            "value": "Microsoft Corporation",
            "source": "pe.version.company",
            "verified": false
          }
        },
        "traits": [
          {
            "id": "well-known/app/system/windows-core-utilities::microsoft-company-name",
            "conf": 0.99,
            "crit": 3,
            "desc": "Microsoft version company name"
          }
        ]
      }
    ]
  }
}