{
  "ml": {
    "v": "7",
    "eng": "2.0.1-rc.1",
    "lvl": -1,
    "conf": 0,
    "mods": [
      {
        "cls": 0,
        "raw": 0.00015066068,
        "rte": "az",
        "prob": 0.00015066068
      },
      {
        "cls": 0,
        "raw": 0.0030299127,
        "rte": "az/native",
        "prob": 0.0030299127
      },
      {
        "cls": 0,
        "raw": 0.017684698,
        "rte": "az/pe",
        "prob": 0.017684698
      }
    ],
    "prob": 0.00015066068,
    "files": [
      {
        "id": 0,
        "lvl": -1,
        "conf": 0,
        "prob": 0.00015066067862790078,
        "type": "pe"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-06-15T06:52:19Z"
  },
  "path": "VirusShare_6aa1111ed9a71278971a8adb7ab49bf2",
  "raw": {
    "v": "7",
    "tv": "061e3",
    "files": [
      {
        "id": 0,
        "ctx": [
          {
            "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb",
            "l": 0,
            "n": [
              {
                "c": 3,
                "d": "Packed binary process execution",
                "i": "objectives/anti-static/obfuscation/eval/loader::packed-binary-process-execution",
                "o": 0,
                "z": 27
              }
            ],
            "x": true
          },
          {
            "b": "00000000000000000000rF/**(\u003e/Z50fBX\u003cav2{-mF@6j@7#QF0@@sN.#$]={\u003e}MHkV3Wf0@@sN.#$]=]OVcDI+S*A.mfEB000",
            "l": 496,
            "n": [
              {
                "c": 3,
                "d": "Packed binary context",
                "i": "objectives/anti-static/obfuscation/eval/loader::packed-binary-context",
                "o": 512,
                "z": 30
              }
            ],
            "x": true
          },
          {
            "b": "007[200000003\u003eSC4kMme[w^m0001uBAhhezu6Upzddl%z^@+E0bVp:B7GB[003wE",
            "l": 2586,
            "n": [
              {
                "c": 2,
                "d": ".dll extension reference",
                "i": "micro-behaviors/fs/path/extension::dll-dup",
                "o": 2602,
                "z": 4
              }
            ],
            "x": true
          },
          {
            "b": "A+eW3wL^z=v}x.5k(Z(+lU{WZwK{lEwnC/S002@eBx9i(vqYQ(wN[kOv}xR3x(v(Ux(4)5ASu7",
            "l": 2755,
            "n": [
              {
                "c": 2,
                "d": "Close handle",
                "i": "micro-behaviors/process/create/spawn::close-handle-dup",
                "o": 2771,
                "z": 11
              }
            ],
            "x": true
          }
        ],
        "mol": "O(As)H(Po₂)",
        "sha": "31a1e39798d8ac936eff20fee29b9ffdbc9ea267fb6457e9ddb685e97e3e899b",
        "fact": {
          "id": "pe",
          "imp": [
            [
              "msvcrt",
              "strlen"
            ],
            [
              "msvcrt",
              "malloc"
            ],
            [
              "msvcrt",
              "memset"
            ],
            [
              "msvcrt",
              "sleep"
            ],
            [
              "msvcrt",
              "argc"
            ],
            [
              "msvcrt",
              "argv"
            ],
            [
              "msvcrt",
              "environ"
            ],
            [
              "msvcrt",
              "XcptFilter"
            ],
            [
              "msvcrt",
              "set_app_type"
            ],
            [
              "msvcrt",
              "controlfp"
            ],
            [
              "msvcrt",
              "getmainargs"
            ],
            [
              "msvcrt",
              "exit"
            ],
            [
              "kernel32",
              "CreateProcessA"
            ],
            [
              "kernel32",
              "CloseHandle"
            ],
            [
              "kernel32",
              "SetUnhandledExceptionFilter"
            ]
          ],
          "met": {
            "pe": {
              "checksum": 5479.0,
              "checksum_valid": 1.0,
              "computed_checksum": 5479.0,
              "bss_like_section_count": 0.0,
              "section_overflow_count": 0.0,
              "misaligned_section_count": 0.0
            },
            "file": {
              "size": 3072.0,
              "entropy": 4.29,
              "size_bytes": 3072.0
            },
            "binary": {
              "is_pie": 0.0,
              "code_entropy": 3.84,
              "string_count": 20.0,
              "overall_entropy": 4.29,
              "entropy_variance": 0.15,
              "avg_string_length": 11.25,
              "max_string_length": 40.0,
              "code_to_data_ratio": 1.0,
              "string_length_stddev": 8.26,
              "largest_section_ratio": 0.5,
              "sentence_string_count": 1.0,
              "sentence_string_ratio": 0.05,
              "high_entropy_string_count": 0.0
            },
            "imports": {
              "count": 15.0
            },
            "sections": {
              "count": 3.0,
              "code_size": 1536.0,
              "entropy_max": 4.63,
              "entropy_mean": 4.23,
              "name_entropy": 3.01,
              "writable_count": 1.0,
              "executable_count": 1.0,
              "nonstandard_count": 0.0,
              "executable_writable_count": 0.0
            },
            "dependencies": {
              "count": 2.0
            }
          },
          "sec": [
            [
              ".text",
              512,
              1536,
              3.84,
              "r-x"
            ],
            [
              ".rdata",
              2048,
              1024,
              4.63,
              "r--"
            ],
            [
              ".bss",
              0,
              0,
              0.0,
              "rw-"
            ]
          ],
          "str": [
            [
              77,
              "u8",
              "!This program cannot be run in DOS mode."
            ],
            [
              376,
              "u8",
              ".text"
            ],
            [
              2086,
              "u8",
              "IF/IARAW3K"
            ],
            [
              2596,
              "u8",
              "msvcrt.dll"
            ],
            [
              2609,
              "u8",
              "strlen"
            ],
            [
              2618,
              "u8",
              "malloc"
            ],
            [
              2627,
              "u8",
              "memset"
            ],
            [
              2636,
              "u8",
              "_sleep"
            ],
            [
              2645,
              "u8",
              "__argc"
            ],
            [
              2654,
              "u8",
              "__argv"
            ],
            [
              2663,
              "u8",
              "_environ"
            ],
            [
              2674,
              "u8",
              "_XcptFilter"
            ],
            [
              2688,
              "u8",
              "__set_app_type"
            ],
            [
              2705,
              "u8",
              "_controlfp"
            ],
            [
              2718,
              "u8",
              "__getmainargs"
            ],
            [
              2734,
              "u8",
              "exit"
            ],
            [
              2739,
              "u8",
              "kernel32.dll"
            ],
            [
              2754,
              "u8",
              "CreateProcessA"
            ],
            [
              2771,
              "u8",
              "CloseHandle"
            ],
            [
              2785,
              "u8",
              "SetUnhandledExceptionFilter"
            ]
          ],
          "val": {
            "file.stem": "VirusShare_6aa1111ed9a71278971a8adb7ab49bf2",
            "pe.imphash": "4bfde1223391e32fec766cd1d41fa3e7",
            "pe.machine": "i386",
            "pe.subsystem": "windows_gui",
            "file.basename": "VirusShare_6aa1111ed9a71278971a8adb7ab49bf2",
            "pe.image_base": 4194304,
            "pe.image_size": 16384,
            "pe.machine_id": 332,
            "pe.os_version": "4.0",
            "pe.entry_point": 4773,
            "pe.headers_size": 512,
            "pe.entry_section": ".text",
            "pe.subsystem_raw": 2,
            "pe.file_alignment": 512,
            "pe.image_hash.sha1": "443ef59c3a7b21072883fe80e58696cd25e7fef2",
            "pe.image_hash.sha256": "892cca38a0395d6f861af8e0358849e853b7c2199f7af30594c830eec9db8609",
            "pe.image_hash.sha384": "da57ba83e5548320f386bc5ff56eef71a1774c8a0af2c1674b5dae4184f972e7f68e5c22c70834506fb0b9aad09681b1",
            "pe.image_hash.sha512": "cde2c6a1b786c8471db6fc7531634d147390e5bae78c5455895dfcacea05415939c64cafd41e52babec9d06bd50a72f15eecd259484b66ec7fb5dfafa57038df",
            "pe.section_alignment": 4096,
            "pe.subsystem_version": "4.0",
            "pe.characteristics[0]": "relocs_stripped",
            "pe.characteristics[1]": "executable_image",
            "pe.characteristics[2]": "32bit_machine",
            "pe.characteristics_raw": 783,
            "pe.linker_major_version": 6,
            "pe.data_directories[0].rva": 8544,
            "pe.data_directories[1].rva": 8604,
            "pe.number_of_rva_and_sizes": 16,
            "pe.data_directories[0].name": "import",
            "pe.data_directories[0].size": 60,
            "pe.data_directories[1].name": "iat",
            "pe.data_directories[1].size": 68,
            "pe.coff.dos_header_pe_pointer": 128
          }
        },
        "find": [
          {
            "id": "objectives/anti-static/pack/upx::no-compression-grade-section",
            "atk": "T1027.002",
            "mbc": "F0001.008",
            "conf": 0.8999999761581421,
            "crit": 1,
            "desc": "No section reaches compression-grade entropy"
          },
          {
            "id": "micro-behaviors/process/create/spawn::create-process-a",
            "atk": "T1106",
            "conf": 0.949999988079071,
            "crit": 3,
            "desc": "Create process (ANSI)"
          },
          {
            "id": "metadata/binary/metrics/structural::few-sections",
            "conf": 0.6000000238418579,
            "crit": 3,
            "desc": "Very few sections (merged/stripped)"
          },
          {
            "id": "objectives/anti-static/obfuscation/eval/loader::packed-binary-context",
            "atk": "T1027",
            "mbc": "B0032",
            "conf": 0.8500000238418579,
            "crit": 3,
            "desc": "Packed binary context"
          },
          {
            "id": "micro-behaviors/process/create/shell/invoke::win-createprocess",
            "atk": "T1059.003",
            "mbc": "E1059.003",
            "conf": 0.8999999761581421,
            "crit": 3,
            "desc": "Creates new process via Windows API"
          },
          {
            "id": "micro-behaviors/process/create/shell/invoke::shell-execution-comp",
            "atk": "T1059",
            "mbc": "E1059",
            "conf": 0.8999999761581421,
            "crit": 3,
            "desc": "Shell command execution capability detected"
          },
          {
            "id": "objectives/anti-static/obfuscation/eval/loader::binary-process-execution",
            "atk": "T1027",
            "mbc": "B0032",
            "conf": 0.8500000238418579,
            "crit": 3,
            "desc": "Binary process execution capability"
          },
          {
            "id": "objectives/anti-static/obfuscation/eval/loader::packed-binary-process-execution",
            "atk": "T1027",
            "mbc": "B0032",
            "conf": 0.8999999761581421,
            "crit": 3,
            "desc": "Packed binary process execution"
          }
        ],
        "path": "VirusShare_6aa1111ed9a71278971a8adb7ab49bf2",
        "risk": 3,
        "size": 3072,
        "type": "pe"
      }
    ]
  }
}