{ "ml": { "v": "5", "fs": [ { "id": 0, "prob": 0.8251519203186035, "class": 0, "threshold": 0.9987763166427612 } ], "prob": 0.8251519, "class": 0, "level": 3, "models": [ { "m": "az", "prob": 0.8251519, "class": 0 }, { "m": "az/native", "prob": 0.33898306, "class": 0 }, { "m": "az/pe", "prob": 0.014666666, "class": 0 } ], "version": "v17.17", "threshold": 0.9987763, "analyzed_at": "2026-05-31T10:48:57Z" }, "path": "340bd45ce01dfb4b1ea92693b2adce65c5352a9c7401e90879f042b4d9dbb1ba.exe", "raw": { "v": "5", "fs": [ { "f": "Md₂(BiSi)", "x": 3, "ff": { "m": { "pe": { "parse_failed": 1.0, "partial_parse": 1.0 }, "file": { "size": 3115696.0, "entropy": 7.93, "size_bytes": 3115696.0 }, "parse": { "error_count": 2.0 }, "binary": { "is_pie": 1.0 } }, "s": [ [ 77, "u8", "!This program cannot be run in DOS mode." ], [ 1316, "wide", "WEVT_TEMPLATE" ], [ 4150, "wide", "ATL110C" ], [ 4208, "wide", "AUDIOKSEX" ], [ 4274, "wide", "BOOTSTRF" ], [ 4334, "wide", "BTHPANCONTEXTHANDLERI" ], [ 4422, "wide", "CDPSVCL" ], [ 4482, "wide", "DPTOPOLOGYAPPG" ], [ 4552, "wide", "ESENTUTLP" ], [ 4616, "wide", "FODHELPERZ" ], [ 4682, "wide", "IGFXEMX" ], [ 4742, "wide", "IRFTPC" ], [ 4798, "wide", "KLISTA" ], [ 4852, "wide", "LPREMOVEF" ], [ 4918, "wide", "MBAEPARSERTASKL" ], [ 4992, "wide", "MCBUILDERT" ], [ 5058, "wide", "MICROSOFTEDGECPA" ], [ 5132, "wide", "MSINFO32P" ], [ 5196, "wide", "NETPLWIZJ" ], [ 5260, "wide", "OPENFILESG" ], [ 5324, "wide", "OPENWITHU" ], [ 5390, "wide", "PCALUAG" ], [ 5450, "wide", "PSRB" ], [ 5502, "wide", "RASDIALG" ], [ 5560, "wide", "RTKNGUI64L" ], [ 5626, "wide", "RUNLEGACYCPLELEVATEDC" ], [ 5712, "wide", "SIGVERIFO" ], [ 5778, "wide", "SPEECHRUNTIMEJ" ], [ 5848, "wide", "(SYSTEMPROPERTIESDATAEXECUTIONPREVENTIONK" ], [ 5974, "wide", "TSKILLC" ], [ 6032, "wide", "TSWPFWRPV" ], [ 6096, "wide", "TSWPFWRPZ" ], [ 6160, "wide", "TTDINJECTS" ], [ 6226, "wide", "USERACCOUNTCONTROLSETTINGSC" ], [ 6326, "wide", "WBADMINI" ], [ 6384, "wide", "WIFITASKR" ], [ 6448, "wide", "WINLOGONK" ], [ 6514, "wide", "WSCADMINUIF" ], [ 6614, "wide", "SCRIPT" ], [ 8236, "u8", "7oakz" ], [ 8389, "u8", "3Uh13" ], [ 9128, "u8", "ZSMKH" ], [ 12015, "u8", "IXXKq_l" ], [ 12358, "u8", "KcU81" ], [ 15616, "u8", "DpiUx" ], [ 15785, "u8", "Z5QQ5" ], [ 16127, "u8", "4HQuJ" ], [ 17907, "u8", "43GW" ], [ 20170, "u8", "XSPKI" ], [ 22331, "u8", "7KDD" ], [ 22485, "u8", "5uKMWg" ], [ 23546, "u8", "Kipje" ], [ 24604, "u8", "48ZrV" ], [ 27489, "u8", "AYRS" ], [ 27495, "u8", "Yeh A" ], [ 27905, "u8", "2\u003eDz" ], [ 28498, "u8", "69vh" ], [ 28842, "u8", "5hgoC" ], [ 28897, "u8", "lNuv" ], [ 29041, "u8", "tcCj" ], [ 29260, "u8", "0PuXI" ], [ 29987, "u8", "z/F zM" ], [ 30320, "u8", "\u003cJ8\u003e" ], [ 30373, "u8", "KvnIf.DHixZ" ], [ 32738, "u8", "KT49" ], [ 33210, "u8", "I}[xb" ], [ 34197, "u8", "2aro" ], [ 35721, "u8", "dHhf" ], [ 37738, "u8", "LUT5" ], [ 38949, "u8", "a6uj" ], [ 38974, "u8", "oXqi" ], [ 41808, "u8", "lMjp" ], [ 42818, "u8", "WO1Co" ], [ 45194, "u8", "/BxD" ], [ 46742, "u8", "Vngd" ], [ 47824, "u8", "zzO1H" ], [ 54952, "u8", "v25j" ], [ 57434, "u8", "eST2q" ], [ 61552, "u8", "lpUv" ], [ 64134, "u8", "/U7t" ], [ 68179, "u8", "wnEua" ], [ 69082, "u8", "LhyyYc" ], [ 70055, "u8", "rLkg" ], [ 70087, "u8", "0Krsa" ], [ 71078, "u8", "7cWNK" ], [ 72123, "u8", "T5VlTV" ], [ 72307, "u8", "PzBUh" ], [ 73347, "u8", "GDLt3" ], [ 74390, "u8", "fNEUE" ], [ 74665, "u8", "g5Bvi" ], [ 75833, "u8", "TCip1" ], [ 75992, "u8", "U0 E" ], [ 78538, "u8", "T5GL" ], [ 78671, "u8", "fBvu" ], [ 80389, "u8", "64BBS" ], [ 80601, "u8", "6PFwc" ], [ 82523, "u8", "30GYvc" ], [ 83320, "u8", "5btRI1" ], [ 83389, "u8", "E13P" ], [ 84257, "u8", "XPXxw" ], [ 84777, "u8", "/U0d" ], [ 85670, "u8", "/yrp" ], [ 86063, "u8", "Hpdo" ], [ 87496, "u8", "E)r(" ], [ 88147, "u8", "Ybuw" ], [ 89236, "u8", "w PlnAH" ], [ 89592, "u8", "Hn4aw" ], [ 91933, "u8", "Ql cO" ], [ 93125, "u8", "sZ9yh" ], [ 93667, "u8", "RX8Y" ], [ 96789, "u8", "9g1a" ], [ 97728, "u8", "7R8T" ], [ 98551, "u8", "MN_L8" ], [ 99702, "u8", "7DWH" ], [ 102028, "u8", "/vTTM" ], [ 103793, "u8", "Xi.oo" ], [ 105561, "u8", "AA_0" ], [ 107510, "u8", "7grdM" ], [ 107535, "u8", "w25p" ], [ 108499, "u8", "45W3K" ], [ 109188, "u8", "vcND2" ], [ 110405, "u8", "DJ5AyX" ], [ 111628, "u8", "jZeKO7k" ], [ 112216, "u8", "/qQ\tC" ], [ 114438, "u8", "uZahY2pO" ], [ 115134, "u8", "Mabo8" ], [ 116219, "u8", "JSNI" ], [ 116530, "u8", "eBwn1" ], [ 116810, "u8", "U4auQ" ], [ 117242, "u8", "7WRT" ], [ 117894, "u8", "WCAU" ], [ 118565, "u8", "4RKW" ], [ 118803, "u8", "zvJs" ], [ 119816, "u8", "STbvb" ], [ 120370, "u8", "YlY l" ], [ 121492, "u8", "Y_M4" ], [ 121845, "u8", "C@Fe r" ], [ 124080, "u8", "hmJy" ], [ 126995, "u8", "/?gG97x" ], [ 127211, "u8", "ZKMaC5" ], [ 128800, "u8", "kc82" ], [ 131237, "u8", "NMLW" ], [ 132277, "u8", "Paxr" ], [ 133826, "u8", "XE5Rx" ], [ 135601, "u8", "/M8I" ], [ 136539, "u8", "mOih" ], [ 137555, "u8", "\u003cV6\u003e" ], [ 138207, "u8", "taLt" ], [ 140104, "u8", "Hnhf" ], [ 140705, "u8", "D{u}" ], [ 140813, "u8", "p3t0" ], [ 141150, "u8", "T4RW" ], [ 141270, "u8", "YQS6" ], [ 141464, "u8", "Ktrj" ], [ 141745, "u8", "Kdyl" ], [ 142814, "u8", "b4lo" ], [ 144344, "wide", "Info" ], [ 144364, "wide", "Start" ], [ 144384, "wide", "Stop" ], [ 144404, "wide", "Information" ], [ 144436, "wide", "Microsoft-JScript" ], [ 144480, "wide", "Interpreted" ], [ 144528, "wide", "JITLoopBody" ], [ 144626, "wide", "VS_VERSION_INFO" ], [ 144718, "wide", "StringFileInfo" ], [ 144754, "wide", "040904B0" ], [ 144778, "wide", "CompanyName" ], [ 144804, "wide", "Microsoft Corporation" ], [ 144854, "wide", "FileDescription" ], [ 144888, "wide", "Microsoft JScript Analysis Engine" ], [ 144966, "wide", "FileVersion" ], [ 144992, "wide", "10.00.8431.0 (fbl_ie_dev1.120610-1700)" ], [ 145078, "wide", "InternalName" ], [ 145104, "wide", "jscript9ls.dll" ], [ 145142, "wide", "LegalCopyright" ], [ 145172, "wide", "Microsoft Corporation. All rights reserved." ], [ 145266, "wide", "OriginalFilename" ], [ 145338, "wide", "ProductName" ], [ 145364, "wide", "Microsoft Visual Studio" ], [ 145422, "wide", "ProductVersion" ], [ 145486, "wide", "VarFileInfo" ], [ 145518, "wide", "Translation" ], [ 146574, "u8", "HRVS" ], [ 147813, "u8", "OPsCnx" ], [ 148146, "u8", "l2ra" ], [ 148230, "u8", "PEDI" ], [ 149129, "u8", "ZVDvk" ], [ 149145, "u8", "y4ETkP" ], [ 149683, "u8", "KEYW" ], [ 149861, "u8", "EVNTl" ], [ 150076, "u8", "b0d9" ], [ 150615, "u8", "6b49E" ], [ 151196, "u8", "p\"pIpnpvpaplpipdp ppprpopcfe" ], [ 151348, "u8", "21nAb" ], [ 151602, "u8", "y8z4" ], [ 151611, "u8", "\u0026b Dub" ], [ 151662, "u8", "dvUc4" ], [ 151834, "u8", "nmMzwy" ], [ 152057, "u8", "ga5y" ], [ 152274, "u8", "p.pOpbejAcH\\d" ], [ 152602, "u8", "UclTrs" ], [ 152630, "u8", "ztUhN" ], [ 152679, "u8", "pCpagn" ], [ 152778, "u8", "70xAj" ], [ 152949, "u8", "v8a*lTD u" ], [ 152987, "u8", "Wad2s" ], [ 153237, "u8", "psDwt" ], [ 153338, "u8", "loU6F" ], [ 153578, "u8", "ialIt" ], [ 153835, "u8", "Twjd" ], [ 154004, "u8", "3U5kf" ], [ 154477, "u8", "hFBYw" ], [ 154796, "u8", "823C" ], [ 154834, "u8", "er3j" ], [ 155781, "u8", "Vd9dw" ], [ 155849, "u8", "Hpoep" ], [ 155879, "u8", "0cYTfDd" ], [ 156011, "u8", "pwRe" ], [ 156261, "u8", "0eMnbL" ], [ 156483, "u8", "JNoS4" ], [ 157055, "u8", "pupmpbpeprV" ], [ 157107, "u8", "rDpgV" ], [ 157618, "u8", "pzL4r" ], [ 157707, "u8", "iH878T*hnLvZ" ], [ 158183, "u8", "nMBi9" ], [ 158690, "u8", "VxDRdH" ], [ 159133, "u8", "pcpilf" ], [ 159197, "u8", "Tnfr" ], [ 159368, "u8", "FDAX" ], [ 160005, "u8", "z624m" ], [ 160303, "u8", "3R5AP" ], [ 160313, "u8", "D3SE" ], [ 160998, "u8", "D24Ni" ], [ 162337, "u8", "kr\u0026x9amv.\tn1" ], [ 162521, "u8", "PT_3" ], [ 163043, "u8", "ihFb" ], [ 163207, "u8", "MF544i" ], [ 163426, "u8", "qNCZKb" ], [ 163823, "u8", "7KN3V" ], [ 164674, "u8", "7KUQ" ], [ 168883, "u8", "UbadQ4" ], [ 169112, "u8", "qGlDA" ], [ 169237, "u8", "lKVED8" ], [ 169730, "u8", "Ta8KK" ], [ 171086, "u8", "/8JDI" ], [ 173737, "u8", "LO9ZF" ], [ 173944, "u8", "K7RM" ], [ 175849, "u8", "4RKo5T" ], [ 175879, "u8", "LJBR" ], [ 176628, "u8", "/kZO" ], [ 177083, "u8", "h-uvxYe" ], [ 177394, "u8", "/0ZY" ], [ 177441, "u8", "/jZh" ], [ 178772, "u8", "S2B4" ], [ 179421, "u8", "a00m" ], [ 179749, "u8", "vu6d" ] ], "v": { "file.stem": "340bd45ce01dfb4b1ea92693b2adce65c5352a9c7401e90879f042b4d9dbb1ba", "pe.machine": "x86_64", "pe.subsystem": "windows_gui", "pe.timestamp": 3213307921, "file.basename": "340bd45ce01dfb4b1ea92693b2adce65c5352a9c7401e90879f042b4d9dbb1ba.exe", "pe.image_base": 4194304, "pe.image_size": 4734976, "pe.machine_id": 34404, "pe.os_version": "4.0", "pe.entry_point": 4628920, "pe.headers_size": 1024, "pe.partial_parse": true, "pe.subsystem_raw": 2, "pe.file_alignment": 512, "pe.cert_table_size": 6320, "pe.section_alignment": 8192, "pe.subsystem_version": "4.0", "pe.characteristics[0]": "executable_image", "pe.characteristics[1]": "large_address_aware", "pe.characteristics_raw": 34, "pe.linker_major_version": 48, "pe.signatures[0].issuer": "CN=Colorful iGame Z390-X RNG Edition V20", "pe.signatures[0].serial": "17a8663a365863a1475edc4cba9a1b41", "pe.signatures[0].subject": "CN=Colorful iGame Z390-X RNG Edition V20", "pe.dll_characteristics[0]": "dynamic_base", "pe.dll_characteristics[1]": "nx_compat", "pe.dll_characteristics[2]": "terminal_server_aware", "pe.signatures[0].verified": true, "pe.dll_characteristics_raw": 33088, "pe.number_of_rva_and_sizes": 16, "pe.signatures[0].not_after": "2032-11-27T12:57:33Z", "pe.signatures[0].not_before": "2022-11-26T12:57:33Z", "pe.signatures[0].self_issued": true, "pe.coff.dos_header_pe_pointer": 256, "pe.signatures[0].thumbprint_sha1": "6e13b982a8426f342c07ca42844cfd482385be56", "pe.signatures[0].cert_chain_depth": 1, "pe.signatures[0].digest_algorithm": "sha256", "pe.signatures[0].signature_digest": "94da7213dc9befabda44697adfda35e9394eee83c406399de2c67a9764963aaa", "pe.signatures[0].thumbprint_sha256": "473aaaf480596f8835a95326a7fb35450b7dd3ab640d010038c461d86fb0656d", "pe.signatures[0].signature_algorithm": "sha1WithRSAEncryption", "pe.signatures[0].signature_digest_algorithm": "sha256" }, "er": [ [ "malformed", "pe-parse" ], [ "fallback", "pe-parse" ] ], "id": "pe" }, "id": 0, "sz": 3115696, "ts": [ { "a": "T1027", "c": 0.30000001192092896, "d": "PE parsed with header-only fallback (downstream walker failed)", "e": [ "PE parsed with header-only fallback (downstream walker failed)" ], "i": "objectives/anti-analysis/pe-tampering/corrupted-header", "l": 2, "m": "B0001" }, { "c": 1.0, "d": "Authenticode chain CN: Colorful iGame Z390-X RNG Edition V20", "e": [ "Colorful iGame Z390-X RNG Edition V20" ], "i": "metadata/signed/unknown::colorful-igame-z390-x-rng-edition-v20", "l": 2 }, { "c": 1.0, "d": "Signed by Colorful iGame Z390-X RNG Edition V20", "e": [ "Colorful iGame Z390-X RNG Edition V20" ], "i": "metadata/signed/leaf::colorful-igame-z390-x-rng-edition-v20", "l": 3 }, { "a": "T1620", "c": 0.949999988079071, "d": "mscoree DLL string reference", "e": [ "mscoree.dll" ], "i": "objectives/anti-static/obfuscation/payload/loader::mscoree-name-anywhere", "l": 1, "m": "B0032", "el": [ "0x26493f" ] }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2, "el": [ "0x236d0" ] }, { "c": 0.550000011920929, "d": ".NET Start method token", "e": [ "Start" ], "i": "micro-behaviors/process/create/spawn::start-method-token-dotnet", "l": 1, "el": [ "0x233ec" ] }, { "a": "T1036.001", "c": 0.8600000143051147, "d": "USERTrust certificate string in overlay", "e": [ "The USERTRUST Network1.0," ], "i": "objectives/evasion/masquerade/binary::overlay-usertrust-string", "l": 1, "el": [ "0x2f7ffc" ] }, { "a": "T1614", "c": 0.6000000238418579, "d": "Country code KZ token", "e": [ "KZ@" ], "i": "objectives/anti-analysis/geofencing/region/country-code-b::country-code-kz", "l": 1, "m": "B0007.003", "el": [ "0x16ba56" ] }, { "c": 0.800000011920929, "d": "CompanyName field absent from PE version info", "e": [ "field 'pe.version.company' does not exist" ], "i": "metadata/binary/anomaly/format::version-info-company-name-absent", "l": 1, "el": [ "value:pe.version.company" ] }, { "c": 1.0, "d": "Binary is 500KB+", "e": [ "340bd45ce01dfb4b1ea92693b2adce65c5352a9c7401e90879f042b4d9dbb1ba.exe" ], "i": "metadata/binary/metrics/threshold::large-binary-500k", "l": 1 }, { "c": 0.8999999761581421, "d": "PE file larger than 2 MiB", "e": [ "340bd45ce01dfb4b1ea92693b2adce65c5352a9c7401e90879f042b4d9dbb1ba.exe" ], "i": "metadata/binary/layout::file-over-2mb", "l": 1 }, { "c": 1.0, "d": "PE Authenticode signature verified metadata", "e": [ "true" ], "i": "metadata/signed/certificate::pe-signature-verified-kv", "l": 2, "el": [ "value:pe.signatures[0].verified" ] }, { "c": 1.0, "d": "DEP / NX enabled (NX_COMPAT)", "e": [ "[dynamic_base, nx_compat, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-dep", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 1.0, "d": "File larger than 1MB", "e": [ "340bd45ce01dfb4b1ea92693b2adce65c5352a9c7401e90879f042b4d9dbb1ba.exe" ], "i": "metadata/binary/metrics/size::large-file-1mb", "l": 2 }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032", "el": [ "0x234f2" ] }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "StringFileInfo" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1, "el": [ "0x2354e" ] }, { "a": "T1553.002", "c": 0.8500000238418579, "d": "PE lacks VS_VERSION_INFO resource", "e": [ "field 'pe.version.file_version' does not exist" ], "i": "objectives/evasion/masquerade/cert::pe-no-version-info-resource", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "340bd45ce01dfb4b1ea92693b2adce65c5352a9c7401e90879f042b4d9dbb1ba.exe" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.8999999761581421, "d": "PE file uses .exe extension", "e": [ "340bd45ce01dfb4b1ea92693b2adce65c5352a9c7401e90879f042b4d9dbb1ba.exe" ], "i": "metadata/binary/framework::exe-extension", "l": 1 }, { "c": 0.8799999952316284, "d": "Native runtime binary is large", "e": [ "340bd45ce01dfb4b1ea92693b2adce65c5352a9c7401e90879f042b4d9dbb1ba.exe" ], "i": "metadata/lang/compiler/aot::native-runtime-large-file", "l": 2 }, { "c": 1.0, "d": "ASLR enabled (DYNAMIC_BASE)", "e": [ "[dynamic_base, nx_compat, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-aslr", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "a": "T1112", "c": 0.8399999737739563, "d": "Open registry key ANSI", "e": [ "RegOpenKeyExA" ], "i": "micro-behaviors/os/registry/manipulate::reg-open-key-ex-a", "l": 2, "el": [ "0x26496a" ] }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "SectigoRSATimeStampingCA" ], "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers", "l": 1, "m": "B0032", "el": [ "0x2f7cca" ] }, { "c": 0.949999988079071, "d": "Filename has EXE extension", "e": [ "340bd45ce01dfb4b1ea92693b2adce65c5352a9c7401e90879f042b4d9dbb1ba.exe" ], "i": "objectives/evasion/masquerade/file/double-ext::basename-is-exe", "l": 1 }, { "c": 0.8500000238418579, "d": "PE with malformed section layout", "e": [ "parse.error_count = 2.00" ], "i": "metadata/binary/metrics/structural::malformed-pe-structure", "l": 3 }, { "a": "T1027", "d": "Binary is 1MB or larger", "e": [ "340bd45ce01dfb4b1ea92693b2adce65c5352a9c7401e90879f042b4d9dbb1ba.exe" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::file-size-1m-plus", "l": 1, "m": "B0032" }, { "a": "T1027.007", "c": 0.8999999761581421, "d": "Kernel32 DLL resolution string", "e": [ "kernel32.dll" ], "i": "micro-behaviors/os/api-resolution/manual::kernel32-resolver", "l": 1, "el": [ "0x264992" ] }, { "c": 0.8999999761581421, "d": "Tiny C string section ratio", "e": [ " = 0.0% of total (0 / 3115696 bytes)" ], "i": "metadata/binary/section/metrics::tiny-cstring-section", "l": 1 } ], "sha": "340bd45ce01dfb4b1ea92693b2adce65c5352a9c7401e90879f042b4d9dbb1ba", "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/2022-11/340bd45ce01dfb4b1ea92693b2adce65c5352a9c7401e90879f042b4d9dbb1ba.exe", "type": "pe" } ], "tv": "52045" } }