{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.8699360489845276, "class": 0 } ], "prob": 0.86993605, "class": 0, "models": [ { "m": "az", "prob": 0.86993605, "class": 0 }, { "m": "az/native", "prob": 0.07716687, "class": 0 }, { "m": "az/pe", "prob": 0.08341734, "class": 0 } ], "version": "v16.16", "thresholds": [ 0.9979839, 1.0 ], "analyzed_at": "2026-05-11T17:14:21Z" }, "path": "20447", "raw": { "v": "4", "fs": [ { "f": "Md₂(Bi₂Si)", "k": { "hash.imp": "bf503e3a796248e3e6fe44a7cdef7e4d", "pe.timestamp": 1278618635, "hash.authenti": "5a091e1658abea85729b2b46bacc0532ca3eb68e4081a3c696f704971633f0f5", "hash.rich_header": "afe52ef1809f6ead7778c197cad7dadeb1017c5c2059f6b4c4cd38929c46c47c", "build.target_arch": "x86", "pe.linker_version": "6.0", "pe.rich_header.xor_key": "0xd416c918", "pe.inflated_sections[0]": "UPX2", "pe.data_directories[0].rva": 57344, "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 192, "pe.rich_header_compids[0].count": 10, "pe.rich_header_compids[1].count": 16, "pe.rich_header_compids[2].count": 31, "pe.rich_header_compids[3].count": 2, "pe.rich_header_compids[4].count": 5, "pe.rich_header_compids[5].count": 49, "pe.rich_header_compids[6].count": 1, "pe.rich_header_compids[0].compid": 730678, "pe.rich_header_compids[1].compid": 924803, "pe.rich_header_compids[2].compid": 665142, "pe.rich_header_compids[3].compid": 728943, "pe.rich_header_compids[4].compid": 1253218, "pe.rich_header_compids[5].compid": 65536, "pe.rich_header_compids[6].compid": 729064, "pe.rich_header_compids[5].product": "Unknown", "pe.section_characteristics[0].name": "UPX0", "pe.section_characteristics[1].name": "UPX1", "pe.section_characteristics[2].name": "UPX2", "pe.rich_header.entries[0].use_count": 10, "pe.rich_header.entries[1].use_count": 16, "pe.rich_header.entries[2].use_count": 31, "pe.rich_header.entries[3].use_count": 2, "pe.rich_header.entries[4].use_count": 5, "pe.rich_header.entries[5].use_count": 49, "pe.rich_header.entries[6].use_count": 1, "pe.rich_header.entries[0].product_id": 11, "pe.rich_header.entries[1].product_id": 14, "pe.rich_header.entries[2].product_id": 10, "pe.rich_header.entries[3].product_id": 11, "pe.rich_header.entries[4].product_id": 19, "pe.rich_header.entries[5].product_id": 1, "pe.rich_header.entries[6].product_id": 11, "pe.rich_header.entries[0].build_number": 9782, "pe.rich_header.entries[0].product_name": "Cvt_Omf", "pe.rich_header.entries[1].build_number": 7299, "pe.rich_header.entries[1].product_name": "Export_VC2003", "pe.rich_header.entries[2].build_number": 9782, "pe.rich_header.entries[2].product_name": "Linker_v6", "pe.rich_header.entries[3].build_number": 8047, "pe.rich_header.entries[3].product_name": "Cvt_Omf", "pe.rich_header.entries[4].build_number": 8034, "pe.rich_header.entries[4].product_name": "unknown", "pe.rich_header.entries[5].product_name": "Imp_VS_v6_or_earlier", "pe.rich_header.entries[6].build_number": 8168, "pe.rich_header.entries[6].product_name": "Cvt_Omf", "pe.section_characteristics[1].raw_size": 16896, "pe.section_characteristics[2].raw_size": 512, "pe.section_characteristics[0].virtual_size": 32768, "pe.section_characteristics[1].virtual_size": 20480, "pe.section_characteristics[2].virtual_size": 4096, "pe.section_characteristics[0].virtual_address": 4096, "pe.section_characteristics[1].virtual_address": 36864, "pe.section_characteristics[2].virtual_address": 57344, "pe.section_characteristics[0].characteristics_hex": "e0000080", "pe.section_characteristics[1].characteristics_hex": "e0000040", "pe.section_characteristics[2].characteristics_hex": "c0000040" }, "x": 5, "id": 0, "is": [ "LoadLibraryA", "GetProcAddress", "VirtualProtect", "ExitProcess", "RegOpenKeyExA" ], "ms": { "pe": { "entry": 53200.0, "machine": 332.0, "checksum": 0.0, "subsystem": 2.0, "timestamp": 1278618635.0, "image_base": 4194304.0, "entry_section": "UPX1", "size_of_image": 61440.0, "file_alignment": 512.0, "characteristics": 271.0, "has_rich_header": true, "size_of_headers": 4096.0, "export_timestamp": 0.0, "import_dll_count": 2.0, "computed_checksum": 51915.0, "section_alignment": 4096.0, "resource_timestamp": 0.0, "has_export_timestamp": false, "linker_major_version": 6.0, "bss_like_section_count": 1.0, "has_resource_timestamp": false, "number_of_rva_and_sizes": 16.0, "entry_in_writable_section": true, "api_hashing_indicator_count": 1.0, "max_section_inflation_ratio": 8.0, "entry_in_nonstandard_section": true }, "file": { "size": 18457.0 }, "binary": { "code_size": 16896.0, "func_count": 1.0, "has_overlay": true, "code_entropy": 3.93, "func_density": 0.06, "import_count": 5.0, "overlay_size": 25.0, "string_count": 47.0, "avg_func_size": 400.0, "overlay_ratio": 0.0, "section_count": 3.0, "avg_complexity": 26.0, "import_density": 0.3, "max_complexity": 26.0, "string_density": 2.85, "overall_entropy": 3.2, "overlay_entropy": 3.78, "avg_basic_blocks": 46.0, "avg_section_size": 5802.67, "dependency_count": 2.0, "entropy_variance": 3.37, "wx_section_count": 2.0, "avg_string_length": 8.47, "complexity_per_kb": 1.58, "max_string_length": 40.0, "avg_string_entropy": 2.54, "code_to_data_ratio": 33.0, "total_basic_blocks": 46.0, "func_analysis_depth": 2.0, "high_entropy_regions": 1.0, "string_length_stddev": 6.68, "largest_section_ratio": 0.92, "sentence_string_count": 2.0, "sentence_string_ratio": 0.04, "writable_section_count": 3.0, "behavioral_import_ratio": 0.6, "entry_in_writable_region": true, "executable_section_count": 2.0, "nonstandard_section_count": 3.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 200, "Rich" ], [ 464, "UPX0" ], [ 504, "UPX1" ], [ 544, "UPX2" ], [ 987, "2.03" ], [ 4546, "NXOV" ], [ 5611, "g7 0" ], [ 6839, "BI66" ], [ 6857, "hk7e" ], [ 7068, "BHLW" ], [ 7445, "vic 5" ], [ 7843, "KKYK" ], [ 8039, "y.ia9" ], [ 8611, "Vwcs" ], [ 9969, "HTQ64" ], [ 10712, "SLTO9H" ], [ 14423, "Bhhu" ], [ 14502, "/LW2" ], [ 15337, "ing too lo" ], [ 15403, "\",Unknown excep)" ], [ 15456, "__GLOBA" ], [ 15467, "L_HEAP_SELECTED" ], [ 15484, "MSVCRT" ], [ 15589, "R6028" ], [ 15647, "wi8a" ], [ 15665, "5pur+virtu!b" ], [ 15761, "a/lock" ], [ 15792, "@gram Jm6/CKa/09O" ], [ 15950, "essageBoxA|s%32.d" ], [ 16044, "/Chv" ], [ 16270, "C:\\2 Fi" ], [ 16304, "XPLORE." ], [ 16402, ".xipg." ], [ 16837, "Exec" ], [ 16906, "ALbdeCharToM" ], [ 16923, "Bytd" ], [ 17286, ".tex" ], [ 17732, "XPTPSW" ], [ 18008, "KERNEL32.DLL" ], [ 18021, "ADVAPI32.dll" ], [ 18036, "LoadLibraryA" ], [ 18050, "GetProcAddress" ], [ 18066, "VirtualProtect" ], [ 18082, "ExitProcess" ], [ 18096, "RegOpenKeyExA" ], [ 18432, "Fri Jul 09 12:37:51 2010" ] ], "sz": 18457, "ts": [ { "a": "T1106", "c": 0.8999999761581421, "d": "FFI GetProcAddress API name", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::ffi-getprocaddress-api", "l": 1 }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.92" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "binary.section_count = 3.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "c": 0.8999999761581421, "d": "PE has under ten imports", "e": [ "binary.import_count = 5.00" ], "i": "objectives/anti-static/pack/runtime::pe-import-count-under-10", "l": 1 }, { "c": 0.7599999904632568, "d": "PE entry in nonstandard section", "e": [ "pe.entry_in_nonstandard_section = 1.00" ], "i": "metadata/binary/section/metrics::pe-nonstandard-entry", "l": 1 }, { "c": 0.800000011920929, "d": "Small PE resource section", "e": [ "pe.rsrc_size = 0.00" ], "i": "metadata/package/versioning::pe-small-rsrc", "l": 1 }, { "a": "T1027.007", "c": 1.0, "d": "WININET.DLL absent from PE import table", "e": [ "pe.import_dll_count = 2.00" ], "i": "objectives/anti-static/obfuscation/imports::wininet-import-absent", "l": 2, "m": "B0032" }, { "d": "Few detected functions (stub-like or analysis-limited)", "e": [ "binary.func_count = 1.00" ], "i": "metadata/binary/metrics/structural::no-functions", "l": 2 }, { "c": 0.699999988079071, "d": "PE has few sections", "e": [ "binary.section_count = 3.00" ], "i": "metadata/binary/layout::legacy-few-sections", "l": 2 }, { "c": 0.800000011920929, "d": "Tiny PE single-function stub", "e": [ "binary.func_count = 1.00" ], "i": "metadata/binary/layout::tiny-single-function-pe", "l": 3 }, { "a": "T1112", "c": 0.8999999761581421, "d": "RegOpenKeyEx API", "e": [ "RegOpenKeyExA" ], "i": "objectives/anti-static/obfuscation/payload/registry::reg-open-key", "l": 1, "m": "B0032" }, { "a": "T1112", "c": 0.8999999761581421, "d": "Open registry key via import symbol ANSI", "e": [ "RegOpenKeyExA" ], "i": "micro-behaviors/os/registry/access::reg-open-key-ex-a-symbol", "l": 2 }, { "a": "T1055.012", "c": 1.0, "d": "Lacks substantial resources", "e": [ "binary.rsrc_to_file_ratio = 0.00" ], "i": "objectives/evasion/process/injection/hollowing::lacks-substantial-resources", "l": 1, "m": "E1055.012" }, { "c": 1.0, "d": "VirtualProtect symbol", "e": [ "VirtualProtect" ], "i": "objectives/anti-static/obfuscation/reflection/class::virtualprotect-sym", "l": 1 }, { "a": "T1036.005", "c": 0.9700000286102295, "d": "PE has no Authenticode signature", "e": [ "binary.has_signature = 0.00" ], "i": "objectives/evasion/masquerade/version-resource/microsoft-utility::dw20-host-unsigned", "l": 1, "m": "F0004" }, { "a": "T1027", "c": 0.800000011920929, "d": "UPX section naming marker", "e": [ "UPX1", "UPX2", "UPX0" ], "i": "objectives/anti-static/obfuscation/payload/encrypted::upx-section-marker", "l": 1, "m": "B0032" }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1278618635.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "c": 1.0, "d": "High code complexity metric", "e": [ "binary.avg_complexity = 26.00" ], "i": "metadata/binary/metrics/anomaly::high-complexity-marker", "l": 1 }, { "a": "T1055.012", "c": 1.0, "d": "Lacks substantial data section", "e": [ "binary.data_to_file_ratio = 0.00" ], "i": "objectives/evasion/process/injection/hollowing::lacks-substantial-data", "l": 1, "m": "E1055.012" }, { "c": 0.699999988079071, "d": "PE with six or fewer imports", "e": [ "binary.import_count = 5.00" ], "i": "metadata/binary/symbols/imports::pe-imports-max-six", "l": 1 }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "a": "T1027", "c": 0.8399999737739563, "d": "VB6 PE with three sections", "e": [ "binary.section_count = 3.00" ], "i": "objectives/anti-static/obfuscation/payload/string-sparse::three-section-vb6-layout", "l": 1, "m": "B0032" }, { "c": 0.9900000095367432, "d": "UPX0 section present", "e": [ "UPX0" ], "i": "well-known/malware/worm/mydoom::section-upx0", "l": 1 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 3.20" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 2.54" ], "i": "metadata/binary/metrics/threshold::avg-string-entropy-4-max", "l": 2 }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2 }, { "c": 1.0, "d": "Suspicious combination of imported APIs", "e": [ "pe.api_hashing_indicator_count = 1.00" ], "i": "metadata/binary/metrics/anomaly::suspicious-import-combo-marker", "l": 1 }, { "c": 0.75, "d": "Binary exports no symbols", "e": [ "binary.export_count = 0.00" ], "i": "metadata/binary/symbols/exports::no-exports", "l": 1 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "20447" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "a": "T1027.002", "c": 0.9900000095367432, "d": "UPX magic byte sequence", "e": [ "UPX!" ], "i": "objectives/anti-static/pack/upx::upx-magic-bytes", "l": 1, "m": "F0001.008" }, { "c": 1.0, "d": "UPX0 section name", "e": [ "UPX0" ], "i": "metadata/binary/section/names::upx0-section-name", "l": 1 }, { "c": 1.0, "d": "UPX1 section name", "e": [ "UPX1" ], "i": "metadata/binary/section/names::upx1-section-name", "l": 1 }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 61440.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "c": 0.8999999761581421, "d": "Low entropy overlay payload", "e": [ "binary.overlay_entropy = 3.78" ], "i": "metadata/binary/layout::low-overlay-entropy", "l": 3 }, { "c": 0.8999999761581421, "d": "PE Rich header present (MSVC toolchain)", "e": [ "pe.has_rich_header = 1.00" ], "i": "metadata/binary/resource::rich-header-present", "l": 2 }, { "c": 0.8600000143051147, "d": "Inflated PE data section", "e": [ "pe.max_section_inflation_ratio = 8.00" ], "i": "metadata/binary/section/metrics::inflated-data-section", "l": 1 }, { "c": 1.0, "d": "PE binary has trailing overlay data", "e": [ "binary.has_overlay = 1.00" ], "i": "metadata/binary/layout::has-overlay", "l": 3 }, { "a": "T1027.002", "c": 0.800000011920929, "d": "Entry point in non-standard section", "e": [ "UPX1 (size: 16896, entropy: 7.86, perms: rwx)" ], "i": "objectives/anti-static/pack/polymorphic::unusual-entry-point-section", "l": 1, "m": "F0001" }, { "a": "T1222.001", "c": 0.949999988079071, "d": "Modify memory page protection", "e": [ "VirtualProtect" ], "i": "micro-behaviors/mem/protect/modify::virtual-protect", "l": 2, "m": "C0021" }, { "c": 1.0, "d": "LoadLibrary symbol", "e": [ "LoadLibraryA" ], "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym", "l": 1 }, { "c": 0.8500000238418579, "d": "PE checksum field not set", "e": [ "pe.has_checksum = 0.00" ], "i": "metadata/binary/layout::pe-checksum-absent", "l": 1 }, { "a": "T1105", "c": 1.0, "d": "Binary contains high-entropy data regions", "e": [ "binary.high_entropy_regions = 1.00" ], "i": "objectives/command-and-control/dropper/staging/embedded::has-high-entropy-regions", "l": 1 }, { "c": 0.9900000095367432, "d": "UPX1 section present", "e": [ "UPX1" ], "i": "well-known/malware/worm/mydoom::section-upx1", "l": 1 }, { "a": "T1112", "c": 0.8399999737739563, "d": "Open registry key ANSI", "e": [ "RegOpenKeyExA" ], "i": "micro-behaviors/os/registry/manipulate::reg-open-key-ex-a", "l": 2 }, { "a": "T1622", "c": 0.949999988079071, "d": "Minimal PE import DLL count (\u003c= 3)", "e": [ "pe.import_dll_count = 2.00" ], "i": "objectives/anti-analysis/debugger-detect/stub::minimal-import-dll-count", "l": 1 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 3.20" ], "i": "metadata/binary/metrics/threshold::low-overall-entropy-binary", "l": 1 }, { "c": 1.0, "d": "Reference to ADVAPI32.dll", "e": [ "ADVAPI32.dll" ], "i": "micro-behaviors/os/module/load::advapi32-dll-reference", "l": 2 }, { "c": 0.800000011920929, "d": "CompanyName field absent from PE version info", "e": [ "field 'pe.version_info.company_name' does not exist" ], "i": "metadata/binary/anomaly/format::version-info-company-name-absent", "l": 1 }, { "a": "T1553.002", "c": 0.8500000238418579, "d": "PE lacks VS_VERSION_INFO resource", "e": [ "field 'pe.version_info.file_version' does not exist" ], "i": "objectives/evasion/masquerade/cert::pe-no-version-info-resource", "l": 1 }, { "c": 0.949999988079071, "d": "UPX packed section name", "e": [ "UPX0", "UPX1", "UPX2" ], "i": "metadata/binary/section/names::upx-section", "l": 2, "m": "F0001.008" }, { "c": 0.8999999761581421, "d": "Tiny C string section ratio", "e": [ " = 0.0% of total (0 / 18457 bytes)" ], "i": "metadata/binary/section/metrics::tiny-cstring-section", "l": 1 }, { "a": "T1027.007", "c": 0.8600000143051147, "d": "PE API hashing indicator present", "e": [ "pe.api_hashing_indicator_count = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::pe-api-hashing-indicator-single", "l": 1, "m": "B0032.014" }, { "a": "T1620", "c": 0.8999999761581421, "d": "GetProcAddress loader API string", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-getprocaddress-string", "l": 1, "m": "B0030" }, { "c": 0.9599999785423279, "d": "Empty RWX UPX0 decoy section", "e": [ "UPX0 (size: 0, perms: rwx)" ], "i": "objectives/command-and-control/dropper/execution/loader::empty-rwx-upx0", "l": 1 }, { "a": "T1070.006", "c": 0.8999999761581421, "d": "Export timestamp is absent", "e": [ "pe.has_export_timestamp = 0.00" ], "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-absent", "l": 2 }, { "c": 0.699999988079071, "d": "Single function with high complexity (monolithic stub)", "e": [ "binary.func_count = 1.00" ], "i": "metadata/binary/metrics/structural::single-complex-function", "l": 3 }, { "c": 0.9900000095367432, "d": "Single-function packed stub layout", "e": [ "binary.func_count = 1.00" ], "i": "well-known/malware/worm/mydoom::metric-function-count-1", "l": 1 }, { "c": 0.6000000238418579, "d": "Very few sections (merged/stripped)", "e": [ "binary.section_count = 3.00" ], "i": "metadata/binary/metrics/structural::few-sections", "l": 3 }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 0.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "a": "T1055", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "binary.import_count = 5.00" ], "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571", "l": 1, "m": "C0041" }, { "c": 0.800000011920929, "d": "Binary lacks resource section entirely", "e": [ "binary.rsrc_to_file_ratio = 0.00" ], "i": "metadata/binary/resource::no-resources", "l": 2 }, { "c": 0.800000011920929, "d": "UPX packer marker string", "e": [ "UPX0", "UPX1" ], "i": "objectives/anti-static/pack/detect::upx-marker", "l": 1 }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2 }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed/trust-level::unsigned", "l": 3 }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "binary.import_count = 5.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "c": 0.800000011920929, "d": "PE executable is unsigned", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed/trust-level::unsigned-pe-executable", "l": 3 }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 0.92" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "UPX0", "UPX2", "UPX1" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-benign-cond-7--inline-29169", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "links KERNEL32.DLL (LoadLibraryA, GetProcAddress, VirtualProtect, ExitProcess)", "e": [ "KERNEL32.DLL" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links ADVAPI32.dll (RegOpenKeyExA)", "e": [ "ADVAPI32.dll" ], "i": "metadata/dylib::advapi32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "UPX0 and UPX1 section pair", "e": [ "UPX1", "UPX0" ], "i": "metadata/binary/section/names::upx-section-pair", "l": 2 }, { "c": 0.9900000095367432, "d": "Single-function UPX stub layout", "e": [ "binary.func_count = 1.00", "UPX0", "UPX1" ], "i": "well-known/malware/worm/mydoom::metric-function-count-1-upx-context", "l": 1 }, { "c": 0.949999988079071, "d": "UPX0 and UPX1 section pair", "e": [ "UPX1", "UPX0" ], "i": "well-known/malware/trojan/shellobject/strings::misleading-upx-sections", "l": 1 }, { "c": 0.8999999761581421, "d": "High-trust tool delivered via low-integrity packaging", "e": [ "binary.has_signature = 0.00", "binary.has_overlay = 1.00" ], "i": "objectives/supply-chain/trojanized/app/monitor::low-integrity-installer-packaging", "l": 1 }, { "a": "T1027", "c": 0.75, "d": "Minimal PE imports with dynamic loading", "e": [ "LoadLibraryA" ], "i": "objectives/anti-static/obfuscation/payload/import::minimal-pe-dynamic-load", "l": 2, "m": "B0032" } ], "sha": "3bd19230355715569c39f3ce1b20ef4003b47d6fbef9ce4596655e2b4b868642", "path": "20447", "type": "pe" } ], "tv": "46790" } }