{
  "ml": {
    "v": "7",
    "eng": "2.0.1-rc.1",
    "lvl": -1,
    "conf": 0,
    "mods": [
      {
        "cls": 0,
        "raw": 0.000048389036,
        "rte": "az",
        "prob": 0.000048389036
      },
      {
        "cls": 0,
        "raw": 0.00071427226,
        "rte": "az/native",
        "prob": 0.00071427226
      },
      {
        "cls": 0,
        "raw": 0.004895836,
        "rte": "az/pe",
        "prob": 0.004895836
      }
    ],
    "prob": 0.000048389036,
    "files": [
      {
        "id": 0,
        "lvl": -1,
        "conf": 0,
        "prob": 0.00004838903623749502,
        "type": "pe"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-06-15T04:19:27Z"
  },
  "path": "3f6732a872b9704de47303c4345796ace5116870477763fdad608eabb9ed67e7.dll",
  "raw": {
    "v": "7",
    "tv": "061e3",
    "files": [
      {
        "id": 0,
        "ctx": [
          {
            "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J\u0026m(0ji6Sa?dLD+]{51x(+zoA=kPhvqNb%vqY$3BrC47",
            "l": 0,
            "n": [
              {
                "c": 2,
                "d": "Windows DLL extension",
                "i": "metadata/file/extension::dll",
                "o": 0,
                "z": 68
              }
            ],
            "x": true
          },
          {
            "b": "003\u003eEzf6og002w:r76zNe[w^m00000nm=jGlVM:DBy+BL002M3vq[RCB98CvC(N*A",
            "l": 2164,
            "n": [
              {
                "c": 2,
                "d": ".dll extension reference",
                "i": "micro-behaviors/fs/path/extension::dll-dup",
                "o": 2180,
                "z": 4
              }
            ],
            "x": true
          },
          {
            "b": "0000000000000000000001Ybg7YTKo3[$veqzqufw?X3PBtew403zmw6Awak0X:)l4LN",
            "l": 2544,
            "n": [
              {
                "c": 2,
                "d": "PE .reloc section presence",
                "i": "metadata/binary/section/names::reloc-section-presence",
                "o": 2560,
                "z": 6
              }
            ],
            "x": true
          }
        ],
        "mol": "H(Mg)",
        "sha": "3f6732a872b9704de47303c4345796ace5116870477763fdad608eabb9ed67e7",
        "fact": {
          "id": "pe",
          "imp": [
            [
              "crtdll",
              "memset"
            ],
            [
              "kernel32",
              "HeapCreate"
            ],
            [
              "kernel32",
              "HeapDestroy"
            ],
            [
              "kernel32",
              "ExitProcess"
            ],
            [
              "kernel32",
              "GetModuleHandleA"
            ]
          ],
          "met": {
            "pe": {
              "checksum": 0.0,
              "checksum_valid": 0.0,
              "checksum_stripped": 1.0,
              "computed_checksum": 52039.0,
              "reloc_overhang_bytes": 468.0,
              "reloc_overhang_ratio": 0.91,
              "bss_like_section_count": 0.0,
              "section_overflow_count": 0.0,
              "misaligned_section_count": 0.0,
              "base_relocation_block_count": 2.0,
              "base_relocation_entry_count": 13.0
            },
            "file": {
              "size": 3072.0,
              "entropy": 1.41,
              "size_bytes": 3072.0
            },
            "binary": {
              "is_pie": 0.0,
              "code_entropy": 1.1,
              "data_entropy": 1.76,
              "string_count": 11.0,
              "overall_entropy": 1.41,
              "entropy_variance": 0.43,
              "avg_string_length": 12.27,
              "max_string_length": 40.0,
              "code_to_data_ratio": 0.67,
              "string_length_stddev": 9.27,
              "largest_section_ratio": 0.17,
              "sentence_string_count": 1.0,
              "sentence_string_ratio": 0.09,
              "high_entropy_string_count": 0.0
            },
            "imports": {
              "count": 5.0
            },
            "sections": {
              "count": 4.0,
              "code_size": 1024.0,
              "entropy_max": 1.79,
              "entropy_mean": 1.12,
              "name_entropy": 3.18,
              "writable_count": 1.0,
              "executable_count": 2.0,
              "nonstandard_count": 1.0,
              "executable_writable_count": 0.0
            },
            "dependencies": {
              "count": 2.0
            }
          },
          "sec": [
            [
              ".code",
              1024,
              512,
              1.79,
              "r-x"
            ],
            [
              ".text",
              1536,
              512,
              0.42,
              "r-x"
            ],
            [
              ".data",
              2048,
              512,
              1.76,
              "rw-"
            ],
            [
              ".reloc",
              2560,
              512,
              0.51,
              "r--"
            ]
          ],
          "str": [
            [
              77,
              "u8",
              "!This program cannot be run in DOS mode."
            ],
            [
              376,
              "u8",
              ".code"
            ],
            [
              496,
              "u8",
              ".reloc"
            ],
            [
              1167,
              "u8",
              "456BD670"
            ],
            [
              2166,
              "u8",
              "memset"
            ],
            [
              2174,
              "u8",
              "CRTDLL.dll"
            ],
            [
              2188,
              "u8",
              "HeapCreate"
            ],
            [
              2202,
              "u8",
              "HeapDestroy"
            ],
            [
              2216,
              "u8",
              "ExitProcess"
            ],
            [
              2230,
              "u8",
              "GetModuleHandleA"
            ],
            [
              2248,
              "u8",
              "KERNEL32.dll"
            ]
          ],
          "val": {
            "file.stem": "3f6732a872b9704de47303c4345796ace5116870477763fdad608eabb9ed67e7",
            "pe.imphash": "24a9d698157614300b4f12a31e0a92f1",
            "pe.machine": "i386",
            "pe.subsystem": "windows_cui",
            "pe.timestamp": 1186580112,
            "file.basename": "3f6732a872b9704de47303c4345796ace5116870477763fdad608eabb9ed67e7.dll",
            "pe.image_base": 268435456,
            "pe.image_size": 20480,
            "pe.machine_id": 332,
            "pe.os_version": "4.0",
            "pe.entry_point": 4096,
            "pe.headers_size": 1024,
            "pe.entry_section": ".code",
            "pe.subsystem_raw": 3,
            "pe.file_alignment": 512,
            "pe.image_hash.sha1": "c9d5617fb9c212587b3126663ec7db50965335a4",
            "pe.image_hash.sha256": "407dc481baee818bdfd4cbaff2d629a6bcfdccceb1799ee7cbdc205d6d67a2cd",
            "pe.image_hash.sha384": "fb5f21d887c27978adc64c25af8510fb4300db1d3272adaed937a14515690b7ffd1b5fa320e83b1583b259daa78cd277",
            "pe.image_hash.sha512": "c9cb3af584d856ab7775d642699550bbf523122788ecdd66b83a5e511da4b5eb8ce099689123aa0d628abd92f71289663b12012afe931933d41bebf5fc65fe79",
            "pe.section_alignment": 4096,
            "pe.subsystem_version": "4.0",
            "pe.characteristics[0]": "executable_image",
            "pe.characteristics[1]": "32bit_machine",
            "pe.characteristics[2]": "dll",
            "pe.characteristics_raw": 8462,
            "pe.linker_major_version": 2,
            "pe.linker_minor_version": 50,
            "pe.data_directories[0].rva": 12288,
            "pe.data_directories[1].rva": 16384,
            "pe.data_directories[2].rva": 12376,
            "pe.number_of_rva_and_sizes": 16,
            "pe.data_directories[0].name": "import",
            "pe.data_directories[0].size": 60,
            "pe.data_directories[1].name": "base_relocation",
            "pe.data_directories[1].size": 44,
            "pe.data_directories[2].name": "iat",
            "pe.data_directories[2].size": 28,
            "pe.coff.dos_header_pe_pointer": 128,
            "pe.base_relocations.block_count": 2,
            "pe.base_relocations.entry_count": 13,
            "pe.base_relocations.padding_count": 1
          }
        },
        "find": [
          {
            "id": "micro-behaviors/mem/alloc/heap::heap-create",
            "conf": 0.8999999761581421,
            "crit": 3,
            "desc": "Create private heap (HeapCreate)"
          }
        ],
        "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/2020-11/3f6732a872b9704de47303c4345796ace5116870477763fdad608eabb9ed67e7.dll",
        "risk": 1,
        "size": 3072,
        "type": "pe"
      }
    ]
  }
}