{
  "ml": {
    "v": "7",
    "eng": "2.0.1-rc.1",
    "lvl": -1,
    "conf": 0,
    "mods": [
      {
        "cls": 0,
        "raw": 0.00012845795,
        "rte": "az",
        "prob": 0.00012845795
      },
      {
        "cls": 0,
        "raw": 0.0027258992,
        "rte": "az/native",
        "prob": 0.0027258992
      },
      {
        "cls": 0,
        "raw": 0.07875621,
        "rte": "az/pe",
        "prob": 0.07875621
      }
    ],
    "prob": 0.00012845795,
    "files": [
      {
        "id": 0,
        "lvl": -1,
        "conf": 0,
        "prob": 0.00012845794844906777,
        "type": "pe"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-06-15T06:52:01Z"
  },
  "path": "VirusShare_608ac3f3c24d8974f6702208dff26153",
  "raw": {
    "v": "7",
    "tv": "061e3",
    "files": [
      {
        "id": 0,
        "ctx": [
          {
            "b": "o\u003cf^Z0rr910SSi2%nJ60XbVHe000003ig5a000004J\u0026m(0ji6Sa?dLD+]{e5zzK3\u003ce\u003e5(he!5dkkMy=:p^\u003eu",
            "l": 0,
            "n": [
              {
                "c": 2,
                "d": "DEP / NX enabled (NX_COMPAT)",
                "i": "metadata/hardening/mitigation::pe-dep",
                "o": 0,
                "z": 1
              }
            ],
            "x": true
          },
          {
            "b": "00000000000000000000rG3j4mg-pNo:\u003c)Srr#I56:bTA08OOx2VbmoxZbD}0ri=\u003cav2{j.{3uG+/[qPrG3iS5j/4^xB)A]0o!qc004S",
            "l": 496,
            "n": [
              {
                "c": 3,
                "d": "Writable and executable section (W^X violation)",
                "i": "metadata/hardening/memory::wx-section",
                "o": 512,
                "z": 35
              }
            ],
            "x": true
          },
          {
            "b": "08)YBwPdS=B98CswO%^llVM:DBy!A+A+eV\u002609i/OBAI2dmSJ6K07QQxo(BM+y?l7Iy?lvIzdM=Gm}D^wx\u003e7{Cz/]@t07zcDBwN0@v}x.507QQxmRMV",
            "l": 3922,
            "n": [
              {
                "c": 2,
                "d": "Get module file path",
                "i": "micro-behaviors/os/module/load::get-module-filename-dup",
                "o": 3963,
                "z": 18
              },
              {
                "c": 2,
                "d": "CreateThread API name reference",
                "i": "micro-behaviors/process/threading/create::create-thread-text",
                "o": 3938,
                "z": 12
              }
            ],
            "x": true
          },
          {
            "b": "y^z(Nz^@=BwNPasx(4tXlU{WZwK{lEwnC/SlVM:DBy^{Qy?lVFy\u0026:Ysy?mG=08mPLBzj6!By!A\u0026s7#hRlUG[G000c4003[UwnD6mwnD5ZzdNN9wPN]VCxv+q0bVp:v@MX[00Ao40b(W+gCQM",
            "l": 4025,
            "n": [
              {
                "c": 2,
                "d": "CreateFile API string reference",
                "i": "micro-behaviors/fs/file/open::createfile-api",
                "o": 4053,
                "z": 10
              },
              {
                "c": 2,
                "d": "Direct NT API access",
                "i": "micro-behaviors/os/syscall/invoke::ntdll-import",
                "o": 4099,
                "z": 9
              },
              {
                "c": 2,
                "d": "Close handle",
                "i": "micro-behaviors/process/create/spawn::close-handle-dup",
                "o": 4041,
                "z": 11
              }
            ],
            "x": true
          },
          {
            "b": "y?%8IBAgr4AZoW91onA4rz#s:gCQN[y?%8}B8VelzGGFR0c-H6A+PAkw(!%j1onA4s4MdTr8=WDwnD5Zs7#LyBAzE?A:-D[rDq)Qs7#LyBAzE$AaJ[!s7#K",
            "l": 4180,
            "n": [
              {
                "c": 3,
                "d": "Dynamically resolved WinHTTP downloader flow",
                "i": "micro-behaviors/communications/http/client/winhttp::winhttp-downloader-flow-text",
                "o": 4232,
                "z": 11
              },
              {
                "c": 2,
                "d": "Reference to USER32.dll",
                "i": "micro-behaviors/os/module/load::user32-dll-reference",
                "o": 4196,
                "z": 10
              }
            ],
            "x": true
          },
          {
            "b": "now@)pJf(.qE%\u0026\u003cwPI}[s7#LyBAzF2wO#3RwPq\u003c7B94y-x(lE-Bz$91wPA5!wNPaXA=RjZx(lE-Bz$b?vpP",
            "l": 4290,
            "n": [
              {
                "c": 1,
                "d": "WinHTTP send request text reference",
                "i": "micro-behaviors/communications/http/client/winhttp::winhttp-send-request-text",
                "o": 4306,
                "z": 18
              }
            ],
            "x": true
          },
          {
            "b": "now@)lU{WZwK{lEwnC/Ss7#LyBAzF1wN/p=C4BM.B8V5nB7CsK1onA4ogq-NmnbG)e\u003c@xb07QQxo(BM+y?l7Iy?i",
            "l": 4364,
            "n": [
              {
                "c": 1,
                "d": "WinHTTP receive response text reference",
                "i": "micro-behaviors/communications/http/client/winhttp::winhttp-receive-response-text",
                "o": 4380,
                "z": 22
              }
            ],
            "x": true
          },
          {
            "b": "l2pvQv/Phvv{%gyA+e!Zm}D^pz!a0bwKZxIwLMVJwKcq+CXIm@A=kD0B8}rY%nSc0000000000000000000",
            "l": 4493,
            "n": [
              {
                "c": 2,
                "d": "Get module file path (ANSI)",
                "i": "micro-behaviors/os/module/load::get-module-filename-ansi",
                "o": 4509,
                "z": 18
              }
            ],
            "x": true
          },
          {
            "b": "6@4jST=}9#:weQLrn*\u0026Tf}1tr=Of[\u0026xEC(f(49@*^nBSOObGD#A}yN{oJx=eQTUu(y]R8?3ZvYYrselT)L\u003cr3G)efq+qt6:aDqyJnF{4f-I7/DBg-DFW$+n7ncKvwp$nxjMogj5:I-Tze9#rAn1h}lpf]2tqk:E5K=.GNBiPKN(dvJDqjK$1b(3rr{5RayOzeJVDvDPbp1N#a}$?h/fmOn7?545d\u0026%q\u0026fw/$EKU@T\u003ezO}p]s/.jecHtM1?cp(JWPRd(g(\u003c.}\u003c.ym.}hy0O5i/u8qtRymhn.T]f\u0026o*",
            "l": 73712,
            "n": [
              {
                "c": 3,
                "d": "WinHTTP download session and response flow",
                "i": "micro-behaviors/communications/http/client/winhttp::winhttp-downloader-flow",
                "o": 73832,
                "z": 15
              },
              {
                "c": 3,
                "d": "Receive WinHTTP server response",
                "i": "micro-behaviors/communications/http/client/winhttp::winhttp-receive-response",
                "o": 73864,
                "z": 22
              },
              {
                "c": 2,
                "d": "wsprintfA user32 string formatting import",
                "i": "micro-behaviors/data/format/string::wsprintfa-format",
                "o": 73820,
                "z": 9
              },
              {
                "c": 2,
                "d": "Windows file creation/open API",
                "i": "micro-behaviors/fs/file/open::file-create-win",
                "o": 73772,
                "z": 11
              },
              {
                "c": 2,
                "d": "Read data from file handle",
                "i": "micro-behaviors/fs/file/read::read-file",
                "o": 73764,
                "z": 8
              },
              {
                "c": 2,
                "d": "Local memory allocation",
                "i": "micro-behaviors/mem/alloc/heap::local-alloc",
                "o": 73888,
                "z": 10
              },
              {
                "c": 2,
                "d": "Memory copy operation",
                "i": "micro-behaviors/mem/c-runtime/functions::memcpy",
                "o": 73796,
                "z": 6
              },
              {
                "c": 2,
                "d": "Memory fill operation",
                "i": "micro-behaviors/mem/c-runtime/functions::memset",
                "o": 73788,
                "z": 6
              },
              {
                "c": 2,
                "d": "Exit current process",
                "i": "micro-behaviors/process/terminate/kill::exit-process",
                "o": 73752,
                "z": 11
              },
              {
                "c": 2,
                "d": "Create thread in current process",
                "i": "micro-behaviors/process/thread/create::create-thread",
                "o": 73736,
                "z": 12
              },
              {
                "c": 2,
                "d": "Delay execution",
                "i": "micro-behaviors/time/timing/delay::sleep-dup",
                "o": 73728,
                "z": 5
              }
            ],
            "x": true
          },
          {
            "b": "00000000000000000000W4EB10000000000d4{UwW4EB1Z[pYd0000000000hk73JZ[pYd:E\u0026Ll0000000000n1/}-:E\u0026Ll^4yyt00",
            "l": 100848,
            "n": [
              {
                "c": 3,
                "d": "Writable and executable section (W^X violation)",
                "i": "metadata/hardening/memory::wx-section",
                "o": 100864,
                "z": 33
              }
            ],
            "x": true
          }
        ],
        "mol": "H(Cm)Md(He)",
        "sha": "33ffd782aecd4706d8c1b76f8bbf5ae6fe99e4edc28a79a7bb9feedb130badc2",
        "fact": {
          "id": "pe",
          "imp": [
            [
              "kernel32",
              "Sleep"
            ],
            [
              "kernel32",
              "lstrlenA"
            ],
            [
              "kernel32",
              "CreateThread"
            ],
            [
              "kernel32",
              "VirtualFree"
            ],
            [
              "kernel32",
              "GetModuleFileNameW"
            ],
            [
              "kernel32",
              "GetTickCount"
            ],
            [
              "kernel32",
              "ExitProcess"
            ],
            [
              "kernel32",
              "GetFileSize"
            ],
            [
              "kernel32",
              "VirtualAlloc"
            ],
            [
              "kernel32",
              "ReadFile"
            ],
            [
              "kernel32",
              "CloseHandle"
            ],
            [
              "kernel32",
              "CreateFileW"
            ],
            [
              "kernel32",
              "lstrlenW"
            ],
            [
              "kernel32",
              "MultiByteToWideChar"
            ],
            [
              "ntdll",
              "memset"
            ],
            [
              "ntdll",
              "wtoi"
            ],
            [
              "ntdll",
              "memcpy"
            ],
            [
              "ole32",
              "CreateStreamOnHGlobal"
            ],
            [
              "shlwapi",
              "StrStrA"
            ],
            [
              "user32",
              "wsprintfA"
            ],
            [
              "user32",
              "wsprintfW"
            ],
            [
              "winhttp",
              "WinHttpCrackUrl"
            ],
            [
              "winhttp",
              "WinHttpOpen"
            ],
            [
              "winhttp",
              "WinHttpConnect"
            ],
            [
              "winhttp",
              "WinHttpOpenRequest"
            ],
            [
              "winhttp",
              "WinHttpSendRequest"
            ],
            [
              "winhttp",
              "WinHttpQueryHeaders"
            ],
            [
              "winhttp",
              "WinHttpReadData"
            ],
            [
              "winhttp",
              "WinHttpCloseHandle"
            ],
            [
              "winhttp",
              "WinHttpReceiveResponse"
            ],
            [
              "kernel32",
              "GetModuleFileNameW"
            ],
            [
              "kernel32",
              "GetModuleHandleA"
            ],
            [
              "kernel32",
              "LoadLibraryA"
            ],
            [
              "kernel32",
              "LocalAlloc"
            ],
            [
              "kernel32",
              "LocalFree"
            ],
            [
              "kernel32",
              "GetModuleFileNameA"
            ],
            [
              "kernel32",
              "ExitProcess"
            ]
          ],
          "met": {
            "pe": {
              "checksum": 0.0,
              "checksum_valid": 0.0,
              "checksum_stripped": 1.0,
              "computed_checksum": 130581.0,
              "bss_like_section_count": 0.0,
              "section_overflow_count": 0.0,
              "misaligned_section_count": 0.0,
              "entry_in_writable_section": 1.0
            },
            "file": {
              "size": 105472.0,
              "entropy": 5.6,
              "size_bytes": 105472.0
            },
            "binary": {
              "is_pie": 0.0,
              "code_entropy": 5.59,
              "data_entropy": 3.98,
              "string_count": 74.0,
              "overall_entropy": 5.6,
              "entropy_variance": 0.64,
              "avg_string_length": 9.38,
              "max_string_length": 22.0,
              "code_to_data_ratio": 0.99,
              "string_length_stddev": 4.86,
              "largest_section_ratio": 0.95,
              "sentence_string_count": 0.0,
              "sentence_string_ratio": 0.0,
              "high_entropy_string_count": 0.0
            },
            "imports": {
              "count": 37.0
            },
            "sections": {
              "count": 3.0,
              "code_size": 103936.0,
              "entropy_max": 5.75,
              "entropy_mean": 5.1,
              "name_entropy": 3.72,
              "writable_count": 3.0,
              "executable_count": 2.0,
              "nonstandard_count": 3.0,
              "executable_writable_count": 2.0
            },
            "dependencies": {
              "count": 6.0
            }
          },
          "sec": [
            [
              ".MPRESS1",
              512,
              100352,
              5.58,
              "rwx"
            ],
            [
              ".MPRESS2",
              100864,
              3584,
              5.75,
              "rwx"
            ],
            [
              ".imports",
              104448,
              1024,
              3.98,
              "rw-"
            ]
          ],
          "str": [
            [
              45,
              "u8",
              "!Win32 .EXE."
            ],
            [
              312,
              "u8",
              ".MPRESS1"
            ],
            [
              352,
              "u8",
              ".MPRESS2"
            ],
            [
              392,
              "u8",
              ".imports"
            ],
            [
              3910,
              "u8",
              "KERNEL32.DLL"
            ],
            [
              3923,
              "u8",
              "Sleep"
            ],
            [
              3929,
              "u8",
              "lstrlenA"
            ],
            [
              3938,
              "u8",
              "CreateThread"
            ],
            [
              3951,
              "u8",
              "VirtualFree"
            ],
            [
              3963,
              "u8",
              "GetModuleFileNameW"
            ],
            [
              3982,
              "u8",
              "GetTickCount"
            ],
            [
              3995,
              "u8",
              "ExitProcess"
            ],
            [
              4007,
              "u8",
              "GetFileSize"
            ],
            [
              4019,
              "u8",
              "VirtualAlloc"
            ],
            [
              4032,
              "u8",
              "ReadFile"
            ],
            [
              4041,
              "u8",
              "CloseHandle"
            ],
            [
              4053,
              "u8",
              "CreateFileW"
            ],
            [
              4065,
              "u8",
              "lstrlenW"
            ],
            [
              4074,
              "u8",
              "MultiByteToWideChar"
            ],
            [
              4099,
              "u8",
              "ntdll.dll"
            ],
            [
              4109,
              "u8",
              "memset"
            ],
            [
              4122,
              "u8",
              "memcpy"
            ],
            [
              4134,
              "u8",
              "ole32.dll"
            ],
            [
              4144,
              "u8",
              "CreateStreamOnHGlobal"
            ],
            [
              4171,
              "u8",
              "SHLWAPI.dll"
            ],
            [
              4183,
              "u8",
              "StrStrA"
            ],
            [
              4196,
              "u8",
              "USER32.dll"
            ],
            [
              4207,
              "u8",
              "wsprintfA"
            ],
            [
              4217,
              "u8",
              "wsprintfW"
            ],
            [
              4232,
              "u8",
              "WINHTTP.dll"
            ],
            [
              4244,
              "u8",
              "WinHttpCrackUrl"
            ],
            [
              4260,
              "u8",
              "WinHttpOpen"
            ],
            [
              4272,
              "u8",
              "WinHttpConnect"
            ],
            [
              4287,
              "u8",
              "WinHttpOpenRequest"
            ],
            [
              4306,
              "u8",
              "WinHttpSendRequest"
            ],
            [
              4325,
              "u8",
              "WinHttpQueryHeaders"
            ],
            [
              4345,
              "u8",
              "WinHttpReadData"
            ],
            [
              4361,
              "u8",
              "WinHttpCloseHandle"
            ],
            [
              4380,
              "u8",
              "WinHttpReceiveResponse"
            ],
            [
              4458,
              "u8",
              "GetModuleHandleA"
            ],
            [
              4475,
              "u8",
              "LoadLibraryA"
            ],
            [
              4488,
              "u8",
              "LocalAlloc"
            ],
            [
              4499,
              "u8",
              "LocalFree"
            ],
            [
              4509,
              "u8",
              "GetModuleFileNameA"
            ],
            [
              6624,
              "u8",
              "KERNEL32"
            ],
            [
              6647,
              "u8",
              "VirtualProtect"
            ],
            [
              6670,
              "u8",
              "t PTj"
            ],
            [
              39274,
              "u8",
              "b9f3"
            ],
            [
              39982,
              "u8",
              "/ yW"
            ],
            [
              41301,
              "u8",
              "R3CX"
            ],
            [
              43075,
              "u8",
              "hXP6J"
            ],
            [
              45651,
              "u8",
              "hy79"
            ],
            [
              46441,
              "u8",
              "pKkh"
            ],
            [
              48297,
              "u8",
              "7PCG"
            ],
            [
              50639,
              "u8",
              "MwOGg"
            ],
            [
              52518,
              "u8",
              "h0d6"
            ],
            [
              55729,
              "u8",
              "KFKS8"
            ],
            [
              57197,
              "u8",
              "UhEzr"
            ],
            [
              57228,
              "u8",
              "user32.dll"
            ],
            [
              57332,
              "u8",
              "Lloa"
            ],
            [
              60112,
              "u8",
              "2XOKQK"
            ],
            [
              63454,
              "u8",
              "bZ8spQ"
            ],
            [
              70810,
              "u8",
              "sDsx"
            ],
            [
              70957,
              "u8",
              "lnBj"
            ],
            [
              71023,
              "u8",
              "oBzkp"
            ],
            [
              72184,
              "u8",
              "27Hsp5"
            ],
            [
              76522,
              "u8",
              ")zf["
            ],
            [
              76888,
              "u8",
              "7gyzO"
            ],
            [
              79838,
              "u8",
              "Eec7hM"
            ],
            [
              80055,
              "u8",
              "w3sa"
            ],
            [
              81775,
              "u8",
              "ZbAsh"
            ],
            [
              97697,
              "u8",
              "GPW9"
            ],
            [
              101145,
              "u8",
              "GetProcAddress"
            ],
            [
              101507,
              "u8",
              "UWVS"
            ]
          ],
          "val": {
            "file.stem": "VirusShare_608ac3f3c24d8974f6702208dff26153",
            "pe.imphash": "611f9b1763e10388c616a325bdb0d10b",
            "pe.machine": "i386",
            "pe.subsystem": "windows_gui",
            "pe.timestamp": 2693429,
            "file.basename": "VirusShare_608ac3f3c24d8974f6702208dff26153",
            "pe.image_base": 4194304,
            "pe.image_size": 114688,
            "pe.machine_id": 332,
            "pe.os_version": "5.1",
            "pe.entry_point": 46045,
            "pe.headers_size": 512,
            "pe.entry_section": ".MPRESS1",
            "pe.subsystem_raw": 2,
            "pe.file_alignment": 512,
            "pe.image_hash.sha1": "2d14fd76107d8e293af529d5a35a0efe4bf0a727",
            "pe.image_hash.sha256": "37e8368b339ca51d107a7cea09fc98231b689ccbf5f582291e064fe76113821b",
            "pe.image_hash.sha384": "cbd7c25c8d17f230d99f5e2f83117ad2b3b53fe293185c70cde0c3f5dc4d2acf3d67b3350e7c2d73a36a299e13eef8f2",
            "pe.image_hash.sha512": "24baa9b0475d618d0573442dace726bce869188f6b6a25c5ef747352b977a27f7d301d8d8905dccb7540b9fdc11eec618345fdd4dee79fd015c1cce4359c3335",
            "pe.section_alignment": 4096,
            "pe.subsystem_version": "5.1",
            "pe.characteristics[0]": "relocs_stripped",
            "pe.characteristics[1]": "executable_image",
            "pe.characteristics[2]": "32bit_machine",
            "pe.characteristics_raw": 771,
            "pe.linker_major_version": 10,
            "pe.dll_characteristics[0]": "nx_compat",
            "pe.dll_characteristics[1]": "terminal_server_aware",
            "pe.data_directories[0].rva": 110592,
            "pe.dll_characteristics_raw": 33024,
            "pe.number_of_rva_and_sizes": 16,
            "pe.data_directories[0].name": "import",
            "pe.data_directories[0].size": 180,
            "pe.coff.dos_header_pe_pointer": 64
          }
        },
        "find": [
          {
            "id": "micro-behaviors/fs/sync/fsync::get-file-size",
            "conf": 0.6499999761581421,
            "crit": 2,
            "desc": "Get file size"
          },
          {
            "id": "micro-behaviors/os/module/load::get-module-filename-ansi",
            "conf": 0.699999988079071,
            "crit": 2,
            "desc": "Get module file path (ANSI)"
          },
          {
            "id": "micro-behaviors/communications/http/client/winhttp::winhttp-open-request",
            "atk": "T1071.001",
            "mbc": "C0002",
            "conf": 0.8999999761581421,
            "crit": 3,
            "desc": "Create WinHTTP HTTP request handle"
          },
          {
            "id": "micro-behaviors/communications/http/client/winhttp::winhttp-receive-response-text",
            "atk": "T1071.001",
            "mbc": "C0002",
            "conf": 0.8399999737739563,
            "crit": 1,
            "desc": "WinHTTP receive response text reference"
          },
          {
            "id": "micro-behaviors/fs/file/read::read-file",
            "conf": 0.8999999761581421,
            "crit": 2,
            "desc": "Read data from file handle"
          },
          {
            "id": "micro-behaviors/fs/file/open::file-create-win",
            "conf": 0.8999999761581421,
            "crit": 2,
            "desc": "Windows file creation/open API"
          },
          {
            "id": "micro-behaviors/communications/http/client/winhttp::winhttp-query-headers",
            "atk": "T1071.001",
            "mbc": "C0002",
            "conf": 0.8799999952316284,
            "crit": 3,
            "desc": "Query WinHTTP response headers"
          },
          {
            "id": "micro-behaviors/communications/http/client/winhttp::winhttp-crack-url",
            "atk": "T1071.001",
            "mbc": "C0002",
            "conf": 0.8399999737739563,
            "crit": 3,
            "desc": "Parse URL with WinHTTP helper"
          },
          {
            "id": "micro-behaviors/communications/http/client/winhttp::winhttp-connect",
            "atk": "T1071.001",
            "mbc": "C0002",
            "conf": 0.8999999761581421,
            "crit": 3,
            "desc": "Connect WinHTTP to remote host"
          },
          {
            "id": "micro-behaviors/communications/http/client/winhttp::winhttp-read-data",
            "atk": "T1071.001",
            "mbc": "C0002",
            "conf": 0.8500000238418579,
            "crit": 3,
            "desc": "Read WinHTTP response body"
          },
          {
            "id": "micro-behaviors/communications/http/client/winhttp::winhttp-open",
            "atk": "T1071.001",
            "mbc": "C0002",
            "conf": 0.8999999761581421,
            "crit": 3,
            "desc": "Initialize WinHTTP session"
          },
          {
            "id": "micro-behaviors/communications/http/client/winhttp::winhttp-send-request",
            "atk": "T1071.001",
            "mbc": "C0002",
            "conf": 0.8999999761581421,
            "crit": 3,
            "desc": "Send WinHTTP request to server"
          },
          {
            "id": "micro-behaviors/communications/http/client/winhttp::winhttp-dll-name-text",
            "atk": "T1071.001",
            "mbc": "C0002",
            "conf": 0.8799999952316284,
            "crit": 1,
            "desc": "WinHTTP DLL name string reference"
          },
          {
            "id": "micro-behaviors/communications/http/client/winhttp::winhttp-close-handle",
            "atk": "T1071.001",
            "mbc": "C0002",
            "conf": 0.800000011920929,
            "crit": 3,
            "desc": "Close WinHTTP handle object"
          },
          {
            "id": "micro-behaviors/communications/http/client/winhttp::winhttp-receive-response",
            "atk": "T1071.001",
            "mbc": "C0002",
            "conf": 0.8999999761581421,
            "crit": 3,
            "desc": "Receive WinHTTP server response"
          },
          {
            "id": "micro-behaviors/communications/http/client/winhttp::winhttp-send-request-text",
            "atk": "T1071.001",
            "mbc": "C0002",
            "conf": 0.8399999737739563,
            "crit": 1,
            "desc": "WinHTTP send request text reference"
          },
          {
            "id": "metadata/binary/metrics/structural::few-sections",
            "conf": 0.6000000238418579,
            "crit": 3,
            "desc": "Very few sections (merged/stripped)"
          },
          {
            "id": "metadata/binary/metrics/structural::dominant-section",
            "conf": 0.6000000238418579,
            "crit": 3,
            "desc": "Single section dominates binary layout"
          },
          {
            "id": "metadata/hardening/memory::wx-section",
            "conf": 1.0,
            "crit": 3,
            "desc": "Writable and executable section (W^X violation)"
          },
          {
            "id": "micro-behaviors/communications/http/client/winhttp::winhttp-request-flow",
            "atk": "T1071.001",
            "mbc": "C0002",
            "conf": 0.8999999761581421,
            "crit": 3,
            "desc": "WinHTTP request response data flow"
          },
          {
            "id": "micro-behaviors/communications/http/client/winhttp::winhttp-session-connect-flow",
            "atk": "T1071.001",
            "mbc": "C0002",
            "conf": 0.9200000166893005,
            "crit": 3,
            "desc": "WinHTTP session with remote connection"
          },
          {
            "id": "micro-behaviors/communications/http/client/winhttp::winhttp-downloader-flow-text",
            "atk": "T1071.001",
            "mbc": "C0002",
            "conf": 0.9300000071525574,
            "crit": 3,
            "desc": "Dynamically resolved WinHTTP downloader flow"
          },
          {
            "id": "micro-behaviors/communications/http/client/winhttp::winhttp-downloader-flow",
            "atk": "T1071.001",
            "mbc": "C0002",
            "conf": 0.9399999976158142,
            "crit": 3,
            "desc": "WinHTTP download session and response flow"
          }
        ],
        "path": "VirusShare_608ac3f3c24d8974f6702208dff26153",
        "risk": 3,
        "size": 105472,
        "type": "pe"
      }
    ]
  }
}