{ "ml": { "v": "7", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.000064094864, "rte": "az", "prob": 0.000064094864 }, { "cls": 0, "raw": 0.0054833293, "rte": "az/native", "prob": 0.0054833293 }, { "cls": 0, "raw": 0.25562546, "rte": "az/pe", "prob": 0.25562546 } ], "prob": 0.000064094864, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.00006409486377378926, "type": "pe" } ], "version": "v18.18", "analyzed_at": "2026-06-14T21:21:54Z" }, "path": "46096a5640a91cddbb2ea4d49d24f6df8e2d079f68a2559849ee9ff3a50281c3.exe", "raw": { "v": "7", "tv": "061e3", "files": [ { "id": 0, "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J\u0026m(0ji6Sa?dLD+]{51x(+zoA=kPhvqNb%vqY$3BrC47", "l": 0, "n": [ { "c": 2, "d": "PE CLR runtime header present (COM descriptor)", "i": "metadata/binary/framework::clr-runtime-header", "o": 0, "z": 1 } ], "x": true }, { "b": "@SJig0%5re0@$x:%nS9Glq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn", "l": 10336, "n": [ { "c": 2, "d": ".NET Metadata Root (BSJB)", "i": "metadata/binary/framework::dotnet-metadata", "o": 10352, "z": 4 } ], "x": true }, { "b": "Bye3EmMpxgo(BM+y?k^gq*ACawO\u003c4\u003epxjjiz!-\u0026[BvoLVve%kKB97#ge(VzbBs{11v@C)(zFa2ys7L?vzf6i9A+]D008[e:By/qwlVl^SwN/*@z/fRGm}DNHA+P1-o\u003e!9Tz/Y\u0026eBs{QdB9g]clsB}Hv/PFwA+eV\u002609iVKB7]MgwN\u003e^eD2v5cx\u003e6\u003eGBzbP607gWwAa9=#o\u003ewAWz!5\u0026rwPQTTBzbP608^xEy***+", "l": 19063, "n": [ { "c": 3, "d": "Reflection.Emit usage (dynamic code)", "i": "metadata/lang/compiler/managed::reflection-emit", "o": 19202, "z": 13 }, { "c": 2, "d": "mscorlib reference", "i": "metadata/lang/compiler/managed::mscorlib", "o": 19127, "z": 8 }, { "c": 2, "d": "System namespace reference", "i": "metadata/lang/compiler/managed::system-namespace", "o": 19079, "z": 9 }, { "c": 2, "d": "Visual Basic runtime reference", "i": "metadata/lang/compiler/managed::visual-basic-runtime", "o": 19163, "z": 21 } ], "x": true }, { "b": "ASx9hzGFY%ASw^zB98B5o\u003e!9Tz/Y\u0026eBs{QdB9g]clsB}Hv\u003eHb!ze:i9wPyZXA=#ebwPE\u0026ID2[7sz7XZ$B8Mhwv}xYYpJeWtwmY/Zq!PPWwN[8pv}x.5qfuC)wL^qYx\u003e7\u003c*A@XHzv}Y=", "l": 20220, "n": [ { "c": 2, "d": "Visual Basic runtime reference", "i": "metadata/lang/compiler/managed::visual-basic-runtime", "o": 20236, "z": 38 }, { "c": 1, "d": "OpCodes token", "i": "metadata/lang/compiler/managed::opcodes-token", "o": 20292, "z": 7 } ], "x": true }, { "b": "y\u0026YOzA+eW3wL=/QvqQ5=q*ACawO\u003c53x(mE1Cxkxaz/PYo07gWxC4CYnx(v)g0b2\u003e+uR\u003erOze16jx(v)g08)Mt", "l": 20369, "n": [ { "c": 2, "d": "Windows Forms UI framework", "i": "metadata/lang/compiler/managed::winforms-ui", "o": 20385, "z": 20 } ], "x": true }, { "b": "Bo1^GA=2lb08E6swN//Zq*ACawO\u003c4{wPN]IwPN]uvru6Wx(dASw[D9}Bo2lUy?W$\u003eq*ACawO\u003c4$wOb:\u0026v@#B6zz1v{x(\u003ctRA+PSbq/(C*Bvy1SzdNQb09shPBy^)UwjguCB.}", "l": 20507, "n": [ { "c": 2, "d": "System namespace reference", "i": "metadata/lang/compiler/managed::system-namespace", "o": 20523, "z": 10 }, { "c": 1, "d": "Reflection.Emit namespace reference", "i": "metadata/lang/compiler/managed::reflection-emit-namespace", "o": 20559, "z": 22 } ], "x": true }, { "b": "\u003e+V5TRn8k\u003cZw[llZ-a}Dw=MAyCMq1Hn=T8oz2^xjpYL.un=T8ove$JLn=T8on=T8on=T8opYL.un=T8on=T8on=O", "l": 54437, "n": [ { "c": 3, "d": "Encoded payload detected: base64", "i": "metadata/encoded-payload/base64", "o": 54453, "z": 22 } ], "x": true }, { "b": "AZ+j:o\u003c}:N0bV^!z/PA2e[w^m000000rjtBav2]b0000000000000000000000000", "l": 1837413, "n": [ { "c": 2, "d": ".dll extension reference", "i": "micro-behaviors/fs/path/extension::dll-dup", "o": 1837429, "z": 4 } ], "x": true }, { "b": "0000000000000000000003AlY3\u0026*ncFhWDd000000000000000000000000000000000", "l": 1837552, "n": [ { "c": 2, "d": "PE .reloc section presence", "i": "metadata/binary/section/names::reloc-section-presence", "o": 1837568, "z": 6 } ], "x": true } ], "mol": "Md₂(Pt)", "sha": "46096a5640a91cddbb2ea4d49d24f6df8e2d079f68a2559849ee9ff3a50281c3", "fact": { "id": "pe", "imp": [ [ "mscoree", "CorExeMain" ] ], "met": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "checksum_stripped": 1.0, "computed_checksum": 1895348.0, "reloc_overhang_bytes": 500.0, "reloc_overhang_ratio": 0.98, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0 }, "file": { "size": 1838080.0, "entropy": 2.81, "size_bytes": 1838080.0 }, "binary": { "is_pie": 1.0, "code_entropy": 2.81, "string_count": 108.0, "overall_entropy": 2.81, "entropy_variance": 1.83, "avg_string_length": 21.26, "max_string_length": 753.0, "code_to_data_ratio": 1.0, "string_length_stddev": 71.35, "largest_section_ratio": 1.0, "sentence_string_count": 1.0, "sentence_string_ratio": 0.01, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 2.0, "code_size": 1837056.0, "entropy_max": 2.81, "entropy_mean": 1.45, "name_entropy": 2.91, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } }, "sec": [ [ ".text", 512, 1837056, 2.81, "r-x" ], [ ".reloc", 1837568, 512, 0.1, "r--" ] ], "str": [ [ 77, "u8", "!This program cannot be run in DOS mode." ], [ 376, "u8", ".text" ], [ 19022, "u8", "UInt32" ], [ 19047, "u8", "IDictionary`2" ], [ 19070, "u8", "\u003cModule\u003e" ], [ 19079, "u8", "System.IO" ], [ 19089, "u8", "ProjectData" ], [ 19101, "u8", "System.Text.Encodings.Web" ], [ 19127, "u8", "mscorlib" ], [ 19136, "u8", "System.Collections.Generic" ], [ 19163, "u8", "Microsoft.VisualBasic" ], [ 19185, "u8", "Thread" ], [ 19192, "u8", "Versioned" ], [ 19202, "u8", "DynamicMethod" ], [ 19216, "u8", "CompareMethod" ], [ 19230, "u8", "GetMethod" ], [ 19240, "u8", "Replace" ], [ 19248, "u8", "OpCode" ], [ 19255, "u8", "System.Text.Unicode" ], [ 19275, "u8", "Microsoft.WindowsAzure.Storage" ], [ 19306, "u8", "UnicodeRange" ], [ 19319, "u8", "Invoke" ], [ 19326, "u8", "IDisposable" ], [ 19338, "u8", "RuntimeTypeHandle" ], [ 19356, "u8", "GetTypeFromHandle" ], [ 19374, "u8", "Volatile" ], [ 19383, "u8", "get_SharedAccessStartTime" ], [ 19409, "u8", "get_SharedAccessExpiryTime" ], [ 19436, "u8", "CallType" ], [ 19445, "u8", "SecurityProtocolType" ], [ 19466, "u8", "MethodBase" ], [ 19477, "u8", "Dispose" ], [ 19485, "u8", "Create" ], [ 19492, "u8", "Write" ], [ 19498, "u8", "WriteByte" ], [ 19508, "u8", "ToByte" ], [ 19515, "u8", "Microsoft.WindowsAzure.Storage.Queue" ], [ 19552, "u8", "Stelem_Ref" ], [ 19563, "u8", "System.Threading" ], [ 19580, "u8", "System.Text.Encoding" ], [ 19601, "u8", "set_Encoding" ], [ 19614, "u8", "set_NewLineHandling" ], [ 19634, "u8", "PermissionsToString" ], [ 19654, "u8", "GetString" ], [ 19664, "u8", "WriteElementString" ], [ 19683, "u8", "get_Length" ], [ 19694, "u8", "Microsoft.WindowsAzure.Storage.Core.Auth" ], [ 19735, "u8", "Decimal" ], [ 19743, "u8", "Microsoft.WindowsAzure.Storage.Core.Util" ], [ 19784, "u8", "Call" ], [ 19789, "u8", "AssertNotNull" ], [ 19803, "u8", "System.Xml" ], [ 19814, "u8", "Microsoft.WindowsAzure.Storage.Shared.Protocol" ], [ 19861, "u8", "MemoryStream" ], [ 19874, "u8", "System" ], [ 19881, "u8", "Join" ], [ 19886, "u8", "System.Reflection" ], [ 19904, "u8", "MissingManifestResourceException" ], [ 19937, "u8", "StringComparison" ], [ 19954, "u8", "MethodInfo" ], [ 19965, "u8", "Sleep" ], [ 20025, "u8", ".zip" ], [ 20034, "u8", "Char" ], [ 20039, "u8", "System.Resources.ResourceManager" ], [ 20072, "u8", "SharedAccessSignatureHelper" ], [ 20100, "u8", "XmlWriter" ], [ 20110, "u8", "System.Xml.ReaderWriter" ], [ 20134, "u8", "CreateProjectError" ], [ 20153, "u8", "ClearProjectError" ], [ 20171, "u8", "SetProjectError" ], [ 20187, "u8", "GetILGenerator" ], [ 20202, "u8", ".ctor" ], [ 20208, "u8", ".cctor" ], [ 20215, "u8", "Newarr" ], [ 20222, "u8", "UIntPtr" ], [ 20230, "u8", "Ldstr" ], [ 20236, "u8", "Microsoft.VisualBasic.CompilerServices" ], [ 20275, "u8", "System.Resources" ], [ 20292, "u8", "OpCodes" ], [ 20300, "u8", "SharedAccessQueuePolicies" ], [ 20326, "u8", "AnchorStyles" ], [ 20339, "u8", "Strings" ], [ 20347, "u8", "XmlWriterSettings" ], [ 20365, "u8", "Equals" ], [ 20372, "u8", "CreateParams" ], [ 20385, "u8", "System.Windows.Forms" ], [ 20406, "u8", "Conversions" ], [ 20418, "u8", "get_Permissions" ], [ 20434, "u8", "SharedAccessQueuePermissions" ], [ 20463, "u8", "get_Chars" ], [ 20473, "u8", "WriteSharedAccessIdentifiers" ], [ 20502, "u8", "Concat" ], [ 20509, "u8", "Format" ], [ 20516, "u8", "Object" ], [ 20523, "u8", "System.Net" ], [ 20538, "u8", "DateTimeOffset" ], [ 20553, "u8", "Split" ], [ 20559, "u8", "System.Reflection.Emit" ], [ 20582, "u8", "WriteStartElement" ], [ 20600, "u8", "WriteEndDocument" ], [ 20617, "u8", "Request" ], [ 20625, "u8", "System.Text" ], [ 20637, "u8", "ToArray" ], [ 20645, "u8", "SharedAccessQueuePolicy" ], [ 20669, "u8", "CommonUtility" ], [ 20683, "u8", "GetDateTimeOrEmpty" ], [ 54453, "base64", "ĜIĜIĜIĜIĜIĜIĜIĜIĜIĜIĜIĜIĜIĜIĜIĜIĜIĜIĜIĜIĜIĜIĜIĜIĜIĜIĜIĜIĜIĜIĜIĜIĜIĜIĜIĜIĜIĜIĜIĜIĜIĜIĜ" ], [ 1837422, "u8", "mscoree.dll" ] ], "val": { "file.stem": "46096a5640a91cddbb2ea4d49d24f6df8e2d079f68a2559849ee9ff3a50281c3", "pe.imphash": "f34d5f2d4577ed6d9ceec516c1f5a744", "pe.machine": "i386", "pe.subsystem": "windows_gui", "pe.timestamp": 1611652371, "file.basename": "46096a5640a91cddbb2ea4d49d24f6df8e2d079f68a2559849ee9ff3a50281c3.exe", "pe.image_base": 4194304, "pe.image_size": 1859584, "pe.machine_id": 332, "pe.os_version": "4.0", "pe.entry_point": 1845118, "pe.headers_size": 512, "pe.entry_section": ".text", "pe.subsystem_raw": 2, "pe.clr.is_il_only": 1, "pe.file_alignment": 512, "pe.image_hash.sha1": "8cb020a0716ad7e02ba9bf7f37d9e82800cc0307", "pe.image_hash.sha256": "3dc82c84f777928606f4a5cdf041794ab7b7ad68635f6c94014a887244738903", "pe.image_hash.sha384": "560fda081cb23f66b6ad4f7ec720034138149f4012820f2f33e4bd5ef4bbd86b9f2087178ca7eba313e4f7362a8c05d1", "pe.image_hash.sha512": "4cf50b75701bb006f7086cc7d7b6c67558cf61759ede5f4c23e6151798fd0b08d359342161b5ca7579fd779d1bd30280d7b04d49c7e9d00b6f0136faa52da884", "pe.section_alignment": 8192, "pe.subsystem_version": "4.0", "pe.characteristics[0]": "executable_image", "pe.characteristics[1]": "32bit_machine", "pe.characteristics_raw": 258, "pe.clr.runtime_version": "2.5", "pe.linker_major_version": 11, "pe.dll_characteristics[0]": "dynamic_base", "pe.dll_characteristics[1]": "nx_compat", "pe.dll_characteristics[2]": "no_seh", "pe.dll_characteristics[3]": "terminal_server_aware", "pe.data_directories[0].rva": 1845028, "pe.data_directories[1].rva": 1851392, "pe.data_directories[2].rva": 8192, "pe.data_directories[3].rva": 8200, "pe.dll_characteristics_raw": 34112, "pe.number_of_rva_and_sizes": 16, "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 87, "pe.data_directories[1].name": "base_relocation", "pe.data_directories[1].size": 12, "pe.data_directories[2].name": "iat", "pe.data_directories[2].size": 8, "pe.data_directories[3].name": "clr_runtime_header", "pe.data_directories[3].size": 72, "pe.coff.dos_header_pe_pointer": 128, "pe.base_relocations.block_count": 1, "pe.base_relocations.entry_count": 1, "pe.base_relocations.padding_count": 1 } }, "find": [ { "id": "metadata/lang/compiler/managed::dynamic-method-token", "conf": 0.800000011920929, "crit": 1, "desc": "DynamicMethod token" }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "metadata/lang/compiler/managed::opcodes-token", "conf": 0.800000011920929, "crit": 1, "desc": "OpCodes token" }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)" }, { "id": "metadata/lang/compiler/managed::reflection-emit-namespace", "conf": 0.699999988079071, "crit": 1, "desc": "Reflection.Emit namespace reference" }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range" }, { "id": "metadata/lang/compiler/managed::reflection-emit", "conf": 0.8500000238418579, "crit": 3, "desc": "Reflection.Emit usage (dynamic code)" }, { "id": "metadata/encoded-payload/base64", "conf": 0.8999999761581421, "crit": 3, "desc": "Encoded payload detected: base64" } ], "path": "46096a5640a91cddbb2ea4d49d24f6df8e2d079f68a2559849ee9ff3a50281c3.exe", "risk": 2, "size": 1838080, "type": "pe" } ] } }