{
  "ml": {
    "v": "7",
    "eng": "2.9.1",
    "lvl": -1,
    "conf": 0,
    "mods": [
      {
        "cls": 0,
        "raw": 0.00009100636,
        "rte": "az",
        "prob": 0.00009100636
      },
      {
        "cls": 0,
        "raw": 0.0061561465,
        "rte": "az/native",
        "prob": 0.0061561465
      },
      {
        "cls": 0,
        "raw": 0.022521326,
        "rte": "az/pe",
        "prob": 0.022521326
      }
    ],
    "prob": 0.00009100636,
    "files": [
      {
        "id": 0,
        "lvl": -1,
        "conf": 0,
        "prob": 0.00009100636088987812,
        "type": "pe"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-09-12T20:32:05Z"
  },
  "path": "Backdoor.Win32.Hupigon.lsx",
  "raw": {
    "v": "8",
    "rev": "c7f7e",
    "files": [
      {
        "id": 0,
        "ctx": [
          {
            "b": "o\u003cgu[0SSi21on@j%nJ60XbVHe00000kMzY5000000000000000000000000000000000000000000961X!1\u0026Kag8v0a?dLD+]@ggra]#!aAhvtxl4A$az(mxBrC2",
            "ln": 0
          },
          {
            "b": "0ce6J0at\u003eq0b8vv0aC}A0a=c.03znp0a=dL03znL0ce6T0b}{S0a=dv03znK0b?\u003cP0b.^F0aM1J0bhBK0b.=V0b?\u003cT03znZ0a=dK0a=dL04[l{08\u0026(o0a(jM0cXAK0ce6J03znK0at\u003eI0cncK0aV6L0aM1E0b.^O0a=du0cwiP0b?\u003cP03znI0aC}D0ce6Y04[l?07c:8",
            "ln": 326997
          },
          {
            "b": "2nyiMwmYWDvq)@4x\u003eg^[q/)4\u003evqL#A22[MozdN.(rb3hXAXN!/zEE0\u003cwN(5LnP5SYA=$(c1jdnTpI%cCzdN.)3SH?SwPxI8x(dB41wAxsBoi#}rbVZS1onAer7p$Gq!o#)wPwbEBz$e\u0026A=#2mf:6^Mwo4\u003eVfFk4ifFk3Zp\u0026yw@1{nD",
            "ln": 344036
          }
        ],
        "mol": "H₂(PoU)",
        "sha": "5540e44017baf9351255ad65e387ef121236fb6a30a2fa4977e4a4095957d237",
        "path": "Backdoor.Win32.Hupigon.lsx",
        "risk": 2,
        "size": 698692,
        "type": "pe",
        "facts": {
          "imp": [
            [
              "kernel32",
              "GetProcAddress"
            ],
            [
              "kernel32",
              "GetModuleHandleA"
            ],
            [
              "kernel32",
              "LoadLibraryA"
            ],
            [
              "oleaut32",
              "SafeArrayPtrOfIndex"
            ],
            [
              "advapi32",
              "ReportEventA"
            ],
            [
              "oleaut32",
              "SysFreeString"
            ],
            [
              "winmm",
              "waveInUnprepareHeader"
            ],
            [
              "user32",
              "CreateWindowExA"
            ],
            [
              "comctl32",
              "ImageList_SetIconSize"
            ],
            [
              "version",
              "VerQueryValueA"
            ],
            [
              "shell32",
              "ShellExecuteA"
            ],
            [
              "advapi32",
              "RegQueryValueExA"
            ],
            [
              "wininet",
              "InternetQueryOptionA"
            ],
            [
              "gdi32",
              "UnrealizeObject"
            ],
            [
              "wsock32",
              "WSACleanup"
            ],
            [
              "advapi32",
              "StartServiceA"
            ],
            [
              "user32",
              "GetKeyboardType"
            ],
            [
              "msvfw32",
              "DrawDibDraw"
            ],
            [
              "urlmon",
              "URLDownloadToFileA"
            ],
            [
              "mpr",
              "WNetGetUserA"
            ],
            [
              "avicap32",
              "capCreateCaptureWindowA"
            ],
            [
              "oleaut32",
              "VariantChangeTypeEx"
            ],
            [
              "kernel32",
              "RaiseException"
            ]
          ],
          "sec": [
            [
              "",
              1024,
              300544,
              8.0,
              "rwx"
            ],
            [
              "",
              301568,
              6144,
              7.97,
              "rwx"
            ],
            [
              "",
              307712,
              0,
              0.0,
              "rwx"
            ],
            [
              "",
              307712,
              2560,
              7.94,
              "rwx"
            ],
            [
              "",
              310272,
              0,
              0.0,
              "rwx"
            ],
            [
              "",
              310272,
              512,
              0.21,
              "rwx"
            ],
            [
              "",
              310784,
              0,
              0.0,
              "rwx"
            ],
            [
              ".rsrc",
              310784,
              34816,
              4.66,
              "rwx"
            ],
            [
              "",
              345600,
              512,
              7.61,
              "rwx"
            ],
            [
              "",
              346112,
              8704,
              7.98,
              "rwx"
            ],
            [
              "",
              354816,
              512,
              7.54,
              "rwx"
            ],
            [
              ".sys",
              355328,
              343040,
              7.93,
              "rwx"
            ],
            [
              ".adata",
              698368,
              0,
              0.0,
              "rwx"
            ]
          ],
          "metrics": {
            "pe": {
              "checksum": 0,
              "timestamp": 1179345446,
              "icon_count": 2,
              "image_size": 1294336,
              "has_overlay": 1,
              "overlay_end": 698692,
              "headers_size": 1024,
              "overlay_size": 324,
              "checksum_valid": 0,
              "file_alignment": 512,
              "overlay_offset": 698368,
              "resource_count": 8,
              "overlay_padding": 324,
              "checksum_stripped": 1,
              "computed_checksum": 713293,
              "dos_stub_modified": 1,
              "headers_size_ratio": 0,
              "prose_section_count": 0,
              "reloc_overhang_bytes": 343032,
              "reloc_overhang_ratio": 1,
              "bss_like_section_count": 4,
              "section_overflow_count": 0,
              "misaligned_section_count": 0,
              "entry_in_writable_section": 1,
              "base_relocation_block_count": 1,
              "base_relocation_entry_count": 0,
              "data_directory_anomaly_count": 1,
              "declared_data_directory_count": 5,
              "executable_prose_section_count": 0,
              "directory_section_mismatch_count": 0,
              "data_directory_zero_rva_nonzero_size_count": 1
            },
            "file": {
              "size": 698692,
              "entropy": 7.91
            },
            "binary": {
              "is_pie": 0,
              "has_overlay": 1,
              "code_entropy": 7.79,
              "overlay_size": 324,
              "string_count": 1180,
              "overlay_ratio": 0,
              "overlay_entropy": 5.47,
              "entropy_variance": 6.2,
              "avg_string_length": 12.03,
              "max_string_length": 189,
              "peak_region_bytes": 657408,
              "code_to_data_ratio": 1,
              "peak_region_entropy": 7.85,
              "string_length_stddev": 18.15,
              "largest_section_ratio": 0.49,
              "sentence_string_count": 164,
              "sentence_string_ratio": 0.14,
              "high_entropy_string_count": 0
            },
            "imports": {
              "count": 23
            },
            "sections": {
              "count": 13,
              "code_size": 697344,
              "entropy_max": 8,
              "entropy_mean": 6.65,
              "name_entropy": 2.82,
              "writable_count": 13,
              "executable_count": 13,
              "nonstandard_count": 12,
              "executable_writable_count": 13
            },
            "consistency": {
              "extension_content_mismatch": 1,
              "extension_content_mismatch.binary_as_unknown": 1
            },
            "dependencies": {
              "count": 15
            }
          }
        },
        "traits": [
          {
            "id": "micro-behaviors/process/create/exec::shell-execute-a",
            "atk": "T1059.001",
            "conf": 0.75,
            "crit": 3,
            "desc": "Execute shell command (ShellExecuteA)",
            "spans": [
              [
                950054,
                13
              ]
            ]
          },
          {
            "id": "micro-behaviors/ui/controls/widget::image-list-set-icon-size",
            "conf": 0.88,
            "crit": 3,
            "desc": "Image list icon size import",
            "spans": [
              [
                950038,
                21
              ]
            ]
          }
        ]
      }
    ]
  }
}