{
  "ml": {
    "l": -1,
    "v": "6",
    "fs": [
      {
        "l": -1,
        "id": 0,
        "prob": 0.9434438943862915
      }
    ],
    "prob": 0.9434439,
    "models": [
      {
        "m": "az",
        "prob": 0.9434439,
        "class": 0
      },
      {
        "m": "az/native",
        "prob": 0.6333333,
        "class": 0
      },
      {
        "m": "az/pe",
        "prob": 0.5944882,
        "class": 0
      }
    ],
    "version": "v17.17",
    "analyzed_at": "2026-06-03T08:45:09Z"
  },
  "path": "589a46cddd84b26fc3828e368268390daaf25f2c8a3e6f5ab9b8e4125e6a1b7b.exe",
  "raw": {
    "v": "6",
    "fs": [
      {
        "f": "Md₂(BiSi)",
        "x": 5,
        "ff": {
          "i": [
            [
              "mscoree",
              "CorExeMain"
            ]
          ],
          "m": {
            "pe": {
              "checksum": 2192909.0,
              "checksum_valid": 1.0,
              "computed_checksum": 2192909.0,
              "bss_like_section_count": 0.0,
              "section_overflow_count": 0.0,
              "misaligned_section_count": 0.0,
              "base_relocation_block_count": 1.0,
              "base_relocation_entry_count": 1.0
            },
            "file": {
              "size": 2137504.0,
              "entropy": 3.32,
              "size_bytes": 2137504.0
            },
            "binary": {
              "is_pie": 1.0,
              "has_overlay": 1.0,
              "code_entropy": 3.29,
              "overlay_size": 5024.0,
              "string_count": 471.0,
              "overlay_ratio": 0.0,
              "overall_entropy": 3.32,
              "overlay_entropy": 7.2,
              "entropy_variance": 2.54,
              "avg_string_length": 4430.41,
              "max_string_length": 2079095.0,
              "code_to_data_ratio": 1.0,
              "string_length_stddev": 95697.15,
              "largest_section_ratio": 1.0,
              "sentence_string_count": 5.0,
              "sentence_string_ratio": 0.01,
              "high_entropy_string_count": 0.0
            },
            "imports": {
              "count": 1.0
            },
            "sections": {
              "count": 2.0,
              "code_size": 2131456.0,
              "entropy_max": 3.29,
              "entropy_mean": 1.7,
              "name_entropy": 2.91,
              "writable_count": 0.0,
              "executable_count": 1.0,
              "nonstandard_count": 0.0,
              "executable_writable_count": 0.0
            },
            "dependencies": {
              "count": 1.0
            }
          },
          "s": [
            [
              77,
              "u8",
              "!This program cannot be run in DOS mode."
            ],
            [
              376,
              "u8",
              ".text"
            ],
            [
              5733,
              "u8",
              "8 KQ"
            ],
            [
              5805,
              "u8",
              "6 KQ"
            ],
            [
              5877,
              "u8",
              "4 KQ"
            ],
            [
              5949,
              "u8",
              "2 KQ"
            ],
            [
              42816,
              "u8",
              "BSJB"
            ],
            [
              46248,
              "u8",
              "UInt32"
            ],
            [
              46255,
              "u8",
              "\u003cModule\u003e"
            ],
            [
              46264,
              "u8",
              "System.IO"
            ],
            [
              46277,
              "u8",
              "effbdbecfccfcaafbdccbaa"
            ],
            [
              46301,
              "u8",
              "dbfdbaa"
            ],
            [
              46309,
              "u8",
              "eaccbfcaabffababbdfbfcfaeaa"
            ],
            [
              46337,
              "u8",
              "ecdaaabacaeeeccffcfaddeaa"
            ],
            [
              46363,
              "u8",
              "acdbedbaacffbbacecaba"
            ],
            [
              46385,
              "u8",
              "fbfcdcbfdbceaecadfba"
            ],
            [
              46406,
              "u8",
              "feeadca"
            ],
            [
              46414,
              "u8",
              "bbefadbeaefcaddecaecdbeca"
            ],
            [
              46440,
              "u8",
              "cedbbbeeaaaaffbaecccafacbcfca"
            ],
            [
              46470,
              "u8",
              "dadedcbada"
            ],
            [
              46481,
              "u8",
              "bfbcabaadaabbebbbacea"
            ],
            [
              46503,
              "u8",
              "ccecebedfffdfeeadecaebcebbeea"
            ],
            [
              46533,
              "u8",
              "fececbfdbabfefdcfafa"
            ],
            [
              46554,
              "u8",
              "dacdeabecaddbbbdfa"
            ],
            [
              46573,
              "u8",
              "dccaaefbeefa"
            ],
            [
              46586,
              "u8",
              "bbeabeeeadcfaaffa"
            ],
            [
              46604,
              "u8",
              "ebefddcfcfeeab"
            ],
            [
              46619,
              "u8",
              "bcabffbbb"
            ],
            [
              46629,
              "u8",
              "cdbbcdfdeadfdebfdfdfbfdbb"
            ],
            [
              46655,
              "u8",
              "aceccfeabbeafbb"
            ],
            [
              46671,
              "u8",
              "ebbaafffcccbfddedbbefbb"
            ],
            [
              46695,
              "u8",
              "adbdaefbeabdeabcbdbbdccbfbbcb"
            ],
            [
              46725,
              "u8",
              "eafaaacfffcbaafebbcfacdeaccb"
            ],
            [
              46754,
              "u8",
              "bbbadbdbdadccebddcacbabbedcb"
            ],
            [
              46783,
              "u8",
              "bbeffaccdcaafbdaaefbeadb"
            ],
            [
              46808,
              "u8",
              "edbedffebbdb"
            ],
            [
              46821,
              "u8",
              "dfeafddb"
            ],
            [
              46830,
              "u8",
              "efabdbcdadaedb"
            ],
            [
              46845,
              "u8",
              "fdfccfeadefafeeffdffeccaeb"
            ],
            [
              46872,
              "u8",
              "fdfceabffcdedcdedaeeceb"
            ],
            [
              46896,
              "u8",
              "becdfaafbdfaacfeb"
            ],
            [
              46914,
              "u8",
              "cffeaebbbfb"
            ],
            [
              46926,
              "u8",
              "abbaebbfb"
            ],
            [
              46936,
              "u8",
              "acefebdedcddcacccfbfb"
            ],
            [
              46958,
              "u8",
              "dafafdcdfabbedaacdeeefb"
            ],
            [
              46982,
              "u8",
              "defcfccdcffb"
            ],
            [
              46995,
              "u8",
              "cafafadeffb"
            ],
            [
              47007,
              "u8",
              "mscorlib"
            ],
            [
              47016,
              "u8",
              "bcdedaaabcfaffcdfedbdac"
            ],
            [
              47040,
              "u8",
              "fdcfcfbbfeadeac"
            ],
            [
              47056,
              "u8",
              "bdabccfebadfecacdfac"
            ],
            [
              47077,
              "u8",
              "dbebbeeabc"
            ],
            [
              47088,
              "u8",
              "aadadfbcbbeebc"
            ],
            [
              47103,
              "u8",
              "acbbbfdccaaadc"
            ],
            [
              47118,
              "u8",
              "acefefdaacbdc"
            ],
            [
              47132,
              "u8",
              "efeeefaebdc"
            ],
            [
              47144,
              "u8",
              "ffdabacedfabdecdc"
            ],
            [
              47162,
              "u8",
              "ecffcacdabbfcdbcdfcbacfdc"
            ],
            [
              47188,
              "u8",
              "deaeadecdbdfaaaebddeaddefdc"
            ],
            [
              47216,
              "u8",
              "adebacecdaafabbabebec"
            ],
            [
              47238,
              "u8",
              "bccddbecafcdcadcafcbbbafdec"
            ],
            [
              47266,
              "u8",
              "fbddaaebfafacfaaaababfefec"
            ],
            [
              47293,
              "u8",
              "fefaadaffacffcacacddbedfc"
            ],
            [
              47319,
              "u8",
              "cfdadbfbffdaddfbeffc"
            ],
            [
              47340,
              "u8",
              "ebdfffc"
            ],
            [
              47348,
              "u8",
              "System.Collections.Generic"
            ],
            [
              47375,
              "u8",
              "Microsoft.VisualBasic"
            ],
            [
              47397,
              "u8",
              "cbbbbeddccaaefdbfad"
            ],
            [
              47417,
              "u8",
              "decbbacebcffadcbebbd"
            ],
            [
              47438,
              "u8",
              "cefdcdcbaaebd"
            ],
            [
              47452,
              "u8",
              "baceeacd"
            ],
            [
              47461,
              "u8",
              "acbbbbeaecceadccbcedddcccd"
            ],
            [
              47488,
              "u8",
              "adfbefcdfebecccedeefcd"
            ],
            [
              47511,
              "u8",
              "fbfdbdefeaaedbcadefaeafffcd"
            ],
            [
              47543,
              "u8",
              "ecdcbbfbdd"
            ],
            [
              47554,
              "u8",
              "daaacbadeedcdd"
            ],
            [
              47569,
              "u8",
              "ebddedaed"
            ],
            [
              47579,
              "u8",
              "aadecaaeed"
            ],
            [
              47590,
              "u8",
              "ffaeeecccbfddaefdbdadbefeed"
            ],
            [
              47618,
              "u8",
              "bbcacffeadacbcbbcaeedafed"
            ],
            [
              47644,
              "u8",
              "bababaedfcdfed"
            ],
            [
              47659,
              "u8",
              "ddbcfeffcbdbebafd"
            ],
            [
              47677,
              "u8",
              "bbdbfcaeafddfd"
            ],
            [
              47692,
              "u8",
              "dfdfdfd"
            ],
            [
              47700,
              "u8",
              "adcadddcaababbabbcadfdbfefd"
            ],
            [
              47728,
              "u8",
              "TrimEnd"
            ],
            [
              47736,
              "u8",
              "Round"
            ],
            [
              47742,
              "u8",
              "GetCurrentMethod"
            ],
            [
              47759,
              "u8",
              "bbbabaacaecfbddefafdccebaaae"
            ],
            [
              47788,
              "u8",
              "cdeeeacdfbdafaaedabae"
            ],
            [
              47810,
              "u8",
              "ddccbfdfdbabaeffbfcdbdbcdbae"
            ],
            [
              47839,
              "u8",
              "ffadbaaabaceedbfbae"
            ],
            [
              47859,
              "u8",
              "dfbafacadaeae"
            ],
            [
              47873,
              "u8",
              "bcbadfeabe"
            ],
            [
              47884,
              "u8",
              "ffbeffabdfdbdeddbaebe"
            ],
            [
              47906,
              "u8",
              "aabdcbdadbfbfbe"
            ],
            [
              47922,
              "u8",
              "Replace"
            ],
            [
              47930,
              "u8",
              "cafaddccce"
            ],
            [
              47941,
              "u8",
              "cccbfcefdeddecaeaadecdce"
            ],
            [
              47966,
              "u8",
              "IdentityReference"
            ],
            [
              47984,
              "u8",
              "eaececbebbadbde"
            ],
            [
              48000,
              "u8",
              "abfdfcfcbdbedeafbfbbcbcde"
            ],
            [
              48026,
              "u8",
              "eaddeecedbeadaccebababecbcde"
            ],
            [
              48055,
              "u8",
              "bdddbedbdfbafaebbcbbfaefbee"
            ],
            [
              48083,
              "u8",
              "fecffddbbabdadecbfefdeabdcee"
            ],
            [
              48112,
              "u8",
              "ecfaafccaafeeafaadee"
            ],
            [
              48133,
              "u8",
              "ecedfbeceefdfdaffeabffee"
            ],
            [
              48158,
              "u8",
              "bcaefaaabfdfbffbcaefbfaffe"
            ],
            [
              48185,
              "u8",
              "System.IO.IsolatedStorage"
            ],
            [
              48211,
              "u8",
              "IEnumerable"
            ],
            [
              48223,
              "u8",
              "IDisposable"
            ],
            [
              48235,
              "u8",
              "WaitHandle"
            ],
            [
              48246,
              "u8",
              "AddAccessRule"
            ],
            [
              48260,
              "u8",
              "FileSystemAccessRule"
            ],
            [
              48281,
              "u8",
              "AppWinStyle"
            ],
            [
              48293,
              "u8",
              "get_Name"
            ],
            [
              48302,
              "u8",
              "GetRandomFileName"
            ],
            [
              48320,
              "u8",
              "GetFileName"
            ],
            [
              48332,
              "u8",
              "GetStrongHashSuitableForObjectName"
            ],
            [
              48367,
              "u8",
              "GetName"
            ],
            [
              48375,
              "u8",
              "AssemblyName"
            ],
            [
              48388,
              "u8",
              "WaitOne"
            ],
            [
              48396,
              "u8",
              "Combine"
            ],
            [
              48404,
              "u8",
              "IsolatedStorageScope"
            ],
            [
              48425,
              "u8",
              "WellKnownSidType"
            ],
            [
              48442,
              "u8",
              "AccessControlType"
            ],
            [
              48460,
              "u8",
              "MethodBase"
            ],
            [
              48471,
              "u8",
              "get_CodeBase"
            ],
            [
              48484,
              "u8",
              "Dispose"
            ],
            [
              48492,
              "u8",
              "ComVisibleAttribute"
            ],
            [
              48512,
              "u8",
              "AssemblyTitleAttribute"
            ],
            [
              48535,
              "u8",
              "AssemblyTrademarkAttribute"
            ],
            [
              48562,
              "u8",
              "TargetFrameworkAttribute"
            ],
            [
              48587,
              "u8",
              "AssemblyFileVersionAttribute"
            ],
            [
              48616,
              "u8",
              "AssemblyDescriptionAttribute"
            ],
            [
              48645,
              "u8",
              "CompilationRelaxationsAttribute"
            ],
            [
              48677,
              "u8",
              "AssemblyProductAttribute"
            ],
            [
              48702,
              "u8",
              "AssemblyCopyrightAttribute"
            ],
            [
              48729,
              "u8",
              "AssemblyCompanyAttribute"
            ],
            [
              48754,
              "u8",
              "ToByte"
            ],
            [
              48761,
              "u8",
              "GetObjectValue"
            ],
            [
              48776,
              "u8",
              "cccbfcefdeddecaeaadecdce.exe"
            ],
            [
              48805,
              "u8",
              "get_Size"
            ],
            [
              48814,
              "u8",
              "abbbdeedacbeacacdcaaf"
            ],
            [
              48836,
              "u8",
              "bcbcedbebeefbafaf"
            ],
            [
              48854,
              "u8",
              "cffeccfaf"
            ],
            [
              48864,
              "u8",
              "fdbdbeedcefcbf"
            ],
            [
              48879,
              "u8",
              "aaffeadacfcfdbf"
            ],
            [
              48895,
              "u8",
              "edcbefeedffccebf"
            ],
            [
              48912,
              "u8",
              "cbffbfafcadddfcfcfebf"
            ],
            [
              48934,
              "u8",
              "cfbbebffbdecbfbbbbbfffdfebf"
            ],
            [
              48962,
              "u8",
              "fdfaedfbf"
            ],
            [
              48972,
              "u8",
              "feabcccacf"
            ],
            [
              48983,
              "u8",
              "efeacfbfedaddabbcf"
            ],
            [
              49002,
              "u8",
              "bbfffdadeaaccddbcf"
            ],
            [
              49021,
              "u8",
              "bafbccefdaeaccffecf"
            ],
            [
              49041,
              "u8",
              "becbeaffeaeceedbfcf"
            ],
            [
              49061,
              "u8",
              "accbcefffcf"
            ],
            [
              49073,
              "u8",
              "eccfdefafddfbadf"
            ],
            [
              49090,
              "u8",
              "beebcacbbefbeaeadf"
            ],
            [
              49109,
              "u8",
              "bebdfebfdfdf"
            ],
            [
              49122,
              "u8",
              "ecdfaefddbcbbdef"
            ],
            [
              49139,
              "u8",
              "abcdcdddcafcdfecabdcacfcdbff"
            ],
            [
              49168,
              "u8",
              "ceabfffddafffdfebff"
            ],
            [
              49188,
              "u8",
              "bdedcecdeddcecafff"
            ],
            [
              49207,
              "u8",
              "System.Threading"
            ],
            [
              49224,
              "u8",
              "NewLateBinding"
            ],
            [
              49239,
              "u8",
              "System.Runtime.Versioning"
            ],
            [
              49265,
              "u8",
              "ToString"
            ],
            [
              49274,
              "u8",
              "GetNormalizedStrongNameHash"
            ],
            [
              49302,
              "u8",
              "GetNormalizedUriHash"
            ],
            [
              49323,
              "u8",
              "Math"
            ],
            [
              49328,
              "u8",
              "GetFolderPath"
            ],
            [
              49342,
              "u8",
              "get_Length"
            ],
            [
              49357,
              "u8",
              "Decimal"
            ],
            [
              49365,
              "u8",
              "System.Security.Principal"
            ],
            [
              49391,
              "u8",
              "Shell"
            ],
            [
              49397,
              "u8",
              "System.IO.FileSystem.AccessControl"
            ],
            [
              49432,
              "u8",
              "System.Security.AccessControl"
            ],
            [
              49462,
              "u8",
              "SetAccessControl"
            ],
            [
              49479,
              "u8",
              "System.IO.FileSystem"
            ],
            [
              49500,
              "u8",
              "Random"
            ],
            [
              49507,
              "u8",
              "Interaction"
            ],
            [
              49519,
              "u8",
              "System.Reflection"
            ],
            [
              49537,
              "u8",
              "SetAccessRuleProtection"
            ],
            [
              49561,
              "u8",
              "IsolatedStorageException"
            ],
            [
              49586,
              "u8",
              "MemberInfo"
            ],
            [
              49597,
              "u8",
              "DirectoryInfo"
            ],
            [
              49611,
              "u8",
              "Char"
            ],
            [
              49616,
              "u8",
              "SpecialFolder"
            ],
            [
              49630,
              "u8",
              "ToInteger"
            ],
            [
              49640,
              "u8",
              "SecurityIdentifier"
            ],
            [
              49659,
              "u8",
              "IdentityHelper"
            ],
            [
              49674,
              "u8",
              "IEnumerator"
            ],
            [
              49686,
              "u8",
              "GetEnumerator"
            ],
            [
              49700,
              "u8",
              ".ctor"
            ],
            [
              49706,
              "u8",
              ".cctor"
            ],
            [
              49713,
              "u8",
              "UIntPtr"
            ],
            [
              49721,
              "u8",
              "System.Runtime.InteropServices"
            ],
            [
              49752,
              "u8",
              "Microsoft.VisualBasic.CompilerServices"
            ],
            [
              49791,
              "u8",
              "System.Runtime.CompilerServices"
            ],
            [
              49823,
              "u8",
              "GetDirectories"
            ],
            [
              49838,
              "u8",
              "InheritanceFlags"
            ],
            [
              49855,
              "u8",
              "PropagationFlags"
            ],
            [
              49872,
              "u8",
              "System.Runtime.Extensions"
            ],
            [
              49898,
              "u8",
              "FileSystemAclExtensions"
            ],
            [
              49922,
              "u8",
              "Conversions"
            ],
            [
              49934,
              "u8",
              "System.Collections"
            ],
            [
              49953,
              "u8",
              "RuntimeHelpers"
            ],
            [
              49968,
              "u8",
              "FileSystemRights"
            ],
            [
              49985,
              "u8",
              "Exists"
            ],
            [
              49992,
              "u8",
              "System.Security.Principal.Windows"
            ],
            [
              50026,
              "u8",
              "Concat"
            ],
            [
              50033,
              "u8",
              "Format"
            ],
            [
              50040,
              "u8",
              "Object"
            ],
            [
              50047,
              "u8",
              "LateGet"
            ],
            [
              50055,
              "u8",
              "get_IsolatedStorage_Init"
            ],
            [
              50080,
              "u8",
              "Environment"
            ],
            [
              50092,
              "u8",
              "get_Current"
            ],
            [
              50104,
              "u8",
              "FailFast"
            ],
            [
              50113,
              "u8",
              "MoveNext"
            ],
            [
              50122,
              "u8",
              "77x/90x/144x/0x/3x/0x/0x/0x/4x/0x/0x/0x/255x/255x/0x/0x/184x/0x/0x/0x/0x/0x/0x/0x/64x/0x/0x/0x/0x/0x/0x/0x/0x/0x/0x/0x/0x/0x/0x/"
            ],
            [
              2129218,
              "u8",
              "ReleaseMutex"
            ],
            [
              2129231,
              "u8",
              "GetEntryAssembly"
            ],
            [
              2129248,
              "u8",
              "CreateDirectory"
            ],
            [
              2129264,
              "u8",
              "op_Equality"
            ],
            [
              2129276,
              "u8",
              "System.Security"
            ],
            [
              2129292,
              "u8",
              "FileSystemSecurity"
            ],
            [
              2129311,
              "u8",
              "ObjectSecurity"
            ],
            [
              2129326,
              "u8",
              "DirectorySecurity"
            ],
            [
              2129344,
              "u8",
              "IsNullOrEmpty"
            ],
            [
              2131000,
              "u8",
              ".NETFramework,Version=v4.0"
            ],
            [
              2131774,
              "u8",
              "mscoree.dll"
            ],
            [
              2132546,
              "u8",
              "N0L0"
            ],
            [
              2132689,
              "u8",
              "Microsoft Windows1"
            ],
            [
              2132717,
              "u8",
              "Bill Gates1"
            ],
            [
              2132738,
              "u8",
              "RE 9991"
            ],
            [
              2132780,
              "u8",
              "201104001409Z"
            ],
            [
              2132795,
              "u8",
              "211104001409Z0b1"
            ],
            [
              2133071,
              "u8",
              "C0A0"
            ],
            [
              2133889,
              "u8",
              "20201104001409Z"
            ],
            [
              2133980,
              "u8",
              "DigiCert Inc1"
            ],
            [
              2134003,
              "u8",
              "www.digicert.com110/"
            ],
            [
              2134029,
              "u8",
              "(DigiCert SHA2 Assured ID Timestamping CA0"
            ],
            [
              2134089,
              "u8",
              "301017000000Z0L1"
            ],
            [
              2134128,
              "u8",
              "DigiCert, Inc.1$0\""
            ],
            [
              2134153,
              "u8",
              "TIMESTAMP-SHA256-2019-10-150"
            ],
            [
              2134586,
              "u8",
              "https://www.digicert.com/CPS0"
            ],
            [
              2135059,
              "u8",
              "j0h02"
            ],
            [
              2135069,
              "u8",
              ",http://crl3.digicert.com/sha2-assured-ts.crl02"
            ],
            [
              2135121,
              "u8",
              ",http://crl4.digicert.com/sha2-assured-ts.crl0"
            ],
            [
              2135197,
              "u8",
              "http://ocsp.digicert.com0O"
            ],
            [
              2135234,
              "u8",
              "Chttp://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0"
            ],
            [
              2135673,
              "u8",
              "www.digicert.com1$0\""
            ],
            [
              2135700,
              "u8",
              "DigiCert Assured ID Root CA0"
            ],
            [
              2135731,
              "u8",
              "160107120000Z"
            ]
          ],
          "v": {
            "file.stem": "589a46cddd84b26fc3828e368268390daaf25f2c8a3e6f5ab9b8e4125e6a1b7b",
            "pe.imphash": "f34d5f2d4577ed6d9ceec516c1f5a744",
            "pe.machine": "i386",
            "pe.subsystem": "windows_gui",
            "pe.timestamp": 1604448849,
            "file.basename": "589a46cddd84b26fc3828e368268390daaf25f2c8a3e6f5ab9b8e4125e6a1b7b.exe",
            "pe.image_base": 4194304,
            "pe.image_size": 2154496,
            "pe.machine_id": 332,
            "pe.os_version": "4.0",
            "pe.entry_point": 2139470,
            "pe.headers_size": 512,
            "pe.entry_section": ".text",
            "pe.subsystem_raw": 2,
            "pe.clr.is_il_only": 1,
            "pe.file_alignment": 512,
            "pe.cert_table_size": 5024,
            "pe.image_hash.sha1": "725519de60d812820af57213f66bf730468ec672",
            "pe.image_hash.sha256": "b5b962a0c3fab85f245164d70f7345df1d76b6eeab40679513b52e544f3dcff6",
            "pe.image_hash.sha384": "c01026a1183ce714c3c7bfae9190f766fba074cfa58d6e15eb16282c191104ba13a5310443f1831f6b4faa651408cfb1",
            "pe.image_hash.sha512": "719f77cf6b881a6dc2740f7e42f2974414f8ffb7a9e24297957f4e1220d9198b73f4649cae29f3a46eea840875259b6bef70dd69be2e64ede362a6f3412f0a56",
            "pe.section_alignment": 8192,
            "pe.subsystem_version": "4.0",
            "pe.characteristics[0]": "executable_image",
            "pe.characteristics[1]": "32bit_machine",
            "pe.characteristics_raw": 258,
            "pe.clr.runtime_version": "2.5",
            "pe.linker_major_version": 11,
            "pe.signatures[0].issuer": "C=US,L=New York,OU=RE 999,O=Bill Gates,CN=Microsoft Windows",
            "pe.signatures[0].serial": "00990574af06c01c95f7ece14c57aa0b0a",
            "pe.signatures[0].subject": "C=US,L=New York,OU=RE 999,O=Bill Gates,CN=Microsoft Windows",
            "pe.dll_characteristics[0]": "dynamic_base",
            "pe.dll_characteristics[1]": "nx_compat",
            "pe.dll_characteristics[2]": "no_seh",
            "pe.dll_characteristics[3]": "terminal_server_aware",
            "pe.signatures[0].verified": true,
            "pe.data_directories[0].rva": 2139380,
            "pe.data_directories[1].rva": 2132480,
            "pe.data_directories[2].rva": 2146304,
            "pe.data_directories[3].rva": 8192,
            "pe.data_directories[4].rva": 8200,
            "pe.dll_characteristics_raw": 34112,
            "pe.number_of_rva_and_sizes": 16,
            "pe.signatures[0].not_after": "2021-11-04T00:14:09Z",
            "pe.data_directories[0].name": "import",
            "pe.data_directories[0].size": 87,
            "pe.data_directories[1].name": "certificate",
            "pe.data_directories[1].size": 5024,
            "pe.data_directories[2].name": "base_relocation",
            "pe.data_directories[2].size": 12,
            "pe.data_directories[3].name": "iat",
            "pe.data_directories[3].size": 8,
            "pe.data_directories[4].name": "clr_runtime_header",
            "pe.data_directories[4].size": 72,
            "pe.signatures[0].not_before": "2020-11-04T00:14:09Z",
            "pe.signatures[0].self_issued": true,
            "pe.coff.dos_header_pe_pointer": 128,
            "pe.base_relocations.block_count": 1,
            "pe.base_relocations.entry_count": 1,
            "pe.signatures[0].thumbprint_sha1": "5cc0a8abc184aa7c193c426ff0a9ae32ff1b44a5",
            "pe.base_relocations.padding_count": 1,
            "pe.signatures[0].cert_chain_depth": 1,
            "pe.signatures[0].digest_algorithm": "sha256",
            "pe.signatures[0].eku_code_signing": true,
            "pe.signatures[0].signature_digest": "b5b962a0c3fab85f245164d70f7345df1d76b6eeab40679513b52e544f3dcff6",
            "pe.signatures[0].thumbprint_sha256": "e957222ea78e0f260a781601fc56b02455fce0cfcd8fdc86fdde3cd7470bf1f5",
            "pe.signatures[0].signature_algorithm": "sha256WithRSAEncryption",
            "pe.signatures[0].signature_digest_algorithm": "sha256"
          },
          "id": "pe",
          "sc": [
            [
              ".text",
              512,
              2131456,
              3.29,
              "r-x"
            ],
            [
              ".reloc",
              2131968,
              512,
              0.1,
              "r--"
            ]
          ]
        },
        "id": 0,
        "sz": 2137504,
        "ts": [
          {
            "c": 1.0,
            "d": "Authenticode chain CN: Microsoft Windows",
            "e": [
              "Microsoft Windows"
            ],
            "i": "metadata/signed/unknown::microsoft-windows",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "Signed by Bill Gates",
            "e": [
              "Bill Gates"
            ],
            "i": "metadata/signed/leaf::bill-gates",
            "l": 3
          },
          {
            "c": 0.800000011920929,
            "d": "Low ratio of sentence-like strings",
            "e": [
              "binary.sentence_string_ratio = 0.01"
            ],
            "i": "metadata/binary/metrics/pe-details::low-sentence-string-ratio",
            "l": 2
          },
          {
            "c": 0.8999999761581421,
            "d": "PE has under ten imports",
            "e": [
              "imports.count = 1.00"
            ],
            "i": "objectives/anti-static/pack/runtime::pe-import-count-under-10",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "PE binary has trailing overlay data",
            "e": [
              "binary.has_overlay = 1.00"
            ],
            "i": "metadata/binary/layout::has-overlay",
            "l": 3
          },
          {
            "c": 0.949999988079071,
            "d": "DigiCert timestamp certificate chain",
            "e": [
              "DigiCert SHA2 Assured ID Timestamping CA"
            ],
            "i": "micro-behaviors/data/embedded/certificate::digicert-timestamp-chain",
            "l": 2,
            "el": [
              "20900d"
            ]
          },
          {
            "c": 0.800000011920929,
            "d": "Regex component marker",
            "e": [
              "ToString"
            ],
            "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7",
            "l": 1,
            "el": [
              "c071"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "PE standard runtime section",
            "e": [
              ".reloc"
            ],
            "i": "metadata/binary/section/names::pe-runtime-standard-section",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.9399999976158142,
            "d": "Single section occupies nearly all bytes",
            "e": [
              "binary.largest_section_ratio = 1.00"
            ],
            "i": "objectives/anti-static/obfuscation/payload/section::extreme-dominant-section",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.800000011920929,
            "d": "System namespace reference",
            "e": [
              "System.IO",
              "System.Security"
            ],
            "i": "metadata/lang/compiler/managed::system-namespace",
            "l": 2,
            "el": [
              "b4b8",
              "c0d5"
            ]
          },
          {
            "d": ".dll extension reference",
            "e": [
              ".dll"
            ],
            "i": "micro-behaviors/fs/path/extension::dll-dup",
            "l": 2,
            "el": [
              "20873e"
            ]
          },
          {
            "c": 0.8500000238418579,
            "d": ".NET Framework reference",
            "e": [
              ".NETFramework,Version=v4.0"
            ],
            "i": "metadata/lang/compiler/managed::framework-reference",
            "l": 2,
            "el": [
              "208438"
            ]
          },
          {
            "a": "T1027",
            "c": 0.8600000143051147,
            "d": "Giant text section dominates PE",
            "e": [
              "binary.largest_section_ratio = 1.00"
            ],
            "i": "objectives/anti-static/obfuscation/payload/camouflage::giant-text-section",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 1.0,
            "d": "PE Authenticode signature verified metadata",
            "e": [
              "true"
            ],
            "i": "metadata/signed/certificate::pe-signature-verified-kv",
            "l": 2,
            "el": [
              "value:pe.signatures[0].verified"
            ]
          },
          {
            "c": 1.0,
            "d": "NO_SEH (SafeSEH not used)",
            "e": [
              "[dynamic_base, nx_compat, no_seh, terminal_server_aware]"
            ],
            "i": "metadata/hardening/mitigation::pe-no-seh",
            "l": 2,
            "el": [
              "value:pe.dll_characteristics"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "PE .reloc section presence",
            "e": [
              ".reloc"
            ],
            "i": "metadata/binary/section/names::reloc-section-presence",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "Binary is 500KB+",
            "e": [
              "589a46cddd84b26fc3828e368268390daaf25f2c8a3e6f5ab9b8e4125e6a1b7b.exe"
            ],
            "i": "metadata/binary/metrics/threshold::large-binary-500k",
            "l": 1
          },
          {
            "c": 0.8500000238418579,
            "d": "Visual Basic runtime reference",
            "e": [
              "Microsoft.VisualBasic",
              "Microsoft.VisualBasic.CompilerServices"
            ],
            "i": "metadata/lang/compiler/managed::visual-basic-runtime",
            "l": 2,
            "el": [
              "b90f",
              "c258"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "PE file uses .exe extension",
            "e": [
              "589a46cddd84b26fc3828e368268390daaf25f2c8a3e6f5ab9b8e4125e6a1b7b.exe"
            ],
            "i": "metadata/binary/framework::exe-extension",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "PE standard code/data section",
            "e": [
              ".text"
            ],
            "i": "metadata/binary/section/names::pe-code-data-standard-section",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "SOCKS5 client greeting bytes",
            "e": [
              "05 01 00"
            ],
            "i": "micro-behaviors/communications/proxy/socks::socks5-version-greeting-bytes",
            "l": 1,
            "el": [
              "208594"
            ]
          },
          {
            "c": 0.699999988079071,
            "d": "PE has many readable strings",
            "e": [
              "binary.string_count = 471.00"
            ],
            "i": "metadata/binary/layout::many-readable-strings",
            "l": 2
          },
          {
            "a": "T1485",
            "c": 0.8999999761581421,
            "d": "Preserves .exe .gho .bak files",
            "e": [
              ".exe"
            ],
            "i": "objectives/impact/destroy/file-deletion::exe-gho-bak-whitelist",
            "l": 1,
            "m": "C0047",
            "el": [
              "be88"
            ]
          },
          {
            "c": 0.699999988079071,
            "d": "Reflection method namespace token",
            "e": [
              "System.Reflection"
            ],
            "i": "objectives/anti-static/obfuscation/reflection/invoke::namespace-import",
            "l": 1,
            "el": [
              "c16f"
            ]
          },
          {
            "c": 0.949999988079071,
            "d": "PE has exactly two sections",
            "e": [
              "sections.count = 2.00"
            ],
            "i": "well-known/malware/virus/virlock::two-section-layout",
            "l": 1
          },
          {
            "c": 0.8799999952316284,
            "d": "Native runtime binary is large",
            "e": [
              "589a46cddd84b26fc3828e368268390daaf25f2c8a3e6f5ab9b8e4125e6a1b7b.exe"
            ],
            "i": "metadata/lang/compiler/aot::native-runtime-large-file",
            "l": 2
          },
          {
            "c": 0.699999988079071,
            "d": "PE import table has exactly one entry",
            "e": [
              "imports.count = 1.00"
            ],
            "i": "metadata/binary/symbols/imports::single-import-raw",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "File larger than 1MB",
            "e": [
              "589a46cddd84b26fc3828e368268390daaf25f2c8a3e6f5ab9b8e4125e6a1b7b.exe"
            ],
            "i": "metadata/binary/metrics/size::large-file-1mb",
            "l": 2
          },
          {
            "a": "T1027",
            "c": 0.699999988079071,
            "d": "Code section dominates file layout",
            "e": [
              "binary.largest_section_ratio = 1.00"
            ],
            "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 1.0,
            "d": "File is a compiled binary",
            "e": [
              "589a46cddd84b26fc3828e368268390daaf25f2c8a3e6f5ab9b8e4125e6a1b7b.exe"
            ],
            "i": "metadata/binary/framework::is-binary",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "Binary has low overall entropy",
            "e": [
              "binary.overall_entropy = 3.32"
            ],
            "i": "metadata/binary/metrics/threshold::low-overall-entropy-binary",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "PE has low overall entropy",
            "e": [
              "binary.overall_entropy = 3.32"
            ],
            "i": "metadata/binary/layout::low-overall-entropy",
            "l": 2
          },
          {
            "c": 0.699999988079071,
            "d": "PE has few sections",
            "e": [
              "sections.count = 2.00"
            ],
            "i": "metadata/binary/layout::legacy-few-sections",
            "l": 2
          },
          {
            "a": "T1614",
            "c": 0.6000000238418579,
            "d": "Country code ID token (repeated)",
            "e": [
              " ID "
            ],
            "i": "objectives/anti-analysis/geofencing/region/cluster::country-code-id",
            "l": 1,
            "m": "B0007.003",
            "el": [
              "20900d"
            ]
          },
          {
            "c": 0.699999988079071,
            "d": "PE with six or fewer imports",
            "e": [
              "imports.count = 1.00"
            ],
            "i": "metadata/binary/symbols/imports::pe-imports-max-six",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Binary has 4 or fewer sections",
            "e": [
              "sections.count = 2.00"
            ],
            "i": "objectives/command-and-control/infrastructure/config::max-sections-4",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "PE checksum matches computed value",
            "e": [
              "pe.checksum_valid = 1.00"
            ],
            "i": "metadata/binary/layout::pe-checksum-valid",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "CompanyName field absent from PE version info",
            "e": [
              "field 'pe.version.company' does not exist"
            ],
            "i": "metadata/binary/anomaly/format::version-info-company-name-absent",
            "l": 1,
            "el": [
              "value:pe.version.company"
            ]
          },
          {
            "c": 1.0,
            "d": "ASLR enabled (DYNAMIC_BASE)",
            "e": [
              "[dynamic_base, nx_compat, no_seh, terminal_server_aware]"
            ],
            "i": "metadata/hardening/mitigation::pe-aslr",
            "l": 2,
            "el": [
              "value:pe.dll_characteristics"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "PE file larger than 2 MiB",
            "e": [
              "589a46cddd84b26fc3828e368268390daaf25f2c8a3e6f5ab9b8e4125e6a1b7b.exe"
            ],
            "i": "metadata/binary/layout::file-over-2mb",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "Large PE with exactly two sections",
            "e": [
              "sections.count = 2.00"
            ],
            "i": "objectives/anti-static/obfuscation/payload/section::two-section-pe",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1140",
            "c": 0.9200000166893005,
            "d": "VB NewLateBinding dispatch helper",
            "e": [
              "NewLateBinding"
            ],
            "i": "objectives/command-and-control/dropper/staging/embedded::vb-newlatebinding",
            "l": 1,
            "m": "B0030",
            "el": [
              "c048"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "mscorlib reference",
            "e": [
              "mscorlib"
            ],
            "i": "metadata/lang/compiler/managed::mscorlib",
            "l": 2,
            "el": [
              "b79f"
            ]
          },
          {
            "c": 1.0,
            "d": ".NET Metadata Root (BSJB)",
            "e": [
              "BSJB"
            ],
            "i": "metadata/binary/framework::dotnet-metadata",
            "l": 2
          },
          {
            "a": "T1620",
            "c": 0.949999988079071,
            "d": "mscoree DLL string reference",
            "e": [
              "mscoree.dll"
            ],
            "i": "objectives/anti-static/obfuscation/payload/loader::mscoree-name-anywhere",
            "l": 1,
            "m": "B0032",
            "el": [
              "20873e"
            ]
          },
          {
            "c": 0.7200000286102295,
            "d": "Path combination helper token",
            "e": [
              "Combine"
            ],
            "i": "micro-behaviors/fs/temp/directory::path-combine-token",
            "l": 1,
            "el": [
              "bd0c"
            ]
          },
          {
            "c": 0.6000000238418579,
            "d": "MethodBase class reference",
            "e": [
              "MethodBase"
            ],
            "i": "objectives/anti-static/obfuscation/reflection/invoke::dotnet-methodbase-token",
            "l": 1,
            "el": [
              "bd4c"
            ]
          },
          {
            "c": 0.75,
            "d": "Runtime interop services",
            "e": [
              "System.Runtime.InteropServices"
            ],
            "i": "metadata/lang/compiler/managed::runtime-interop",
            "l": 2,
            "el": [
              "c239"
            ]
          },
          {
            "c": 1.0,
            "d": "DEP / NX enabled (NX_COMPAT)",
            "e": [
              "[dynamic_base, nx_compat, no_seh, terminal_server_aware]"
            ],
            "i": "metadata/hardening/mitigation::pe-dep",
            "l": 2,
            "el": [
              "value:pe.dll_characteristics"
            ]
          },
          {
            "a": "T1562.001",
            "c": 0.949999988079071,
            "d": "Regex component marker",
            "e": [
              "GetObjectValue"
            ],
            "i": "objectives/evasion/indicator-removal/cleanup::motw-removal-stream--rx-3",
            "l": 1,
            "m": "B0047",
            "el": [
              "be79"
            ]
          },
          {
            "a": "T1553.002",
            "c": 0.8500000238418579,
            "d": "PE lacks VS_VERSION_INFO resource",
            "e": [
              "field 'pe.version.file_version' does not exist"
            ],
            "i": "objectives/evasion/masquerade/cert::pe-no-version-info-resource",
            "l": 1,
            "el": [
              "value:pe.version.file_version"
            ]
          },
          {
            "a": "T1140",
            "c": 0.8999999761581421,
            "d": "VB LateGet dispatch token",
            "e": [
              "LateGet"
            ],
            "i": "objectives/command-and-control/dropper/staging/embedded::vb-lateget-token",
            "l": 1,
            "m": "B0030",
            "el": [
              "c37f"
            ]
          },
          {
            "d": ".exe extension reference",
            "e": [
              ".exe"
            ],
            "i": "micro-behaviors/fs/path/extension::exe-dup",
            "l": 2,
            "el": [
              "be88"
            ]
          },
          {
            "c": 0.8399999737739563,
            "d": "Binary has 80 or fewer imports",
            "e": [
              "imports.count = 1.00"
            ],
            "i": "objectives/anti-static/obfuscation/binary-metrics/imports::max-80-imports",
            "l": 1
          },
          {
            "a": "T1055",
            "c": 0.9200000166893005,
            "d": "Regex component marker",
            "e": [
              "imports.count = 1.00"
            ],
            "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571",
            "l": 1,
            "m": "C0041"
          },
          {
            "c": 0.6000000238418579,
            "d": "Single section dominates file (packer)",
            "e": [
              "binary.largest_section_ratio = 1.00"
            ],
            "i": "metadata/binary/metrics/structural::dominant-section",
            "l": 3
          },
          {
            "a": "T1105",
            "c": 0.800000011920929,
            "d": "Compact PE import table",
            "e": [
              "imports.count = 1.00"
            ],
            "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table",
            "l": 1,
            "m": "E1105"
          },
          {
            "a": "T1027",
            "c": 0.8600000143051147,
            "d": "Dominant section for VB6 loader profile",
            "e": [
              "binary.largest_section_ratio = 1.00"
            ],
            "i": "objectives/anti-static/obfuscation/payload/string-sparse::dominant-text-layout-vb6",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "d": "Binary is 1MB or larger",
            "e": [
              "589a46cddd84b26fc3828e368268390daaf25f2c8a3e6f5ab9b8e4125e6a1b7b.exe"
            ],
            "i": "objectives/anti-static/obfuscation/binary-metrics/shape::file-size-1m-plus",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.8199999928474426,
            "d": "Packed loader largest section ratio above 0.65",
            "e": [
              "binary.largest_section_ratio = 1.00"
            ],
            "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.8600000143051147,
            "d": "Long mixed-case identifiers cluster",
            "e": [
              "AssemblyCopyrightAttribute",
              "SetAccessRuleProtection",
              "AssemblyTitleAttribute",
              "ComVisibleAttribute",
              "GetNormalizedStrongNameHash",
              "FileSystemAclExtensions",
              "AssemblyCompanyAttribute",
              "IsolatedStorageException",
              "AssemblyTrademarkAttribute",
              "TargetFrameworkAttribute",
              "AssemblyDescriptionAttribute",
              "AssemblyFileVersionAttribute",
              "FileSystemAccessRule",
              "AssemblyProductAttribute",
              "CompilationRelaxationsAttribute",
              "GetStrongHashSuitableForObjectName"
            ],
            "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers",
            "l": 1,
            "m": "B0032",
            "el": [
              "be3e",
              "c181",
              "bd80",
              "bd6c",
              "c07a",
              "c2ea",
              "be59",
              "c199",
              "bd97",
              "bdb2",
              "bde8",
              "bdcb",
              "bc84",
              "be25",
              "be05",
              "bccc"
            ]
          },
          {
            "a": "T1027",
            "c": 0.8500000238418579,
            "d": "Sparse import table",
            "e": [
              "imports.count = 1.00"
            ],
            "i": "objectives/anti-static/obfuscation/binary-metrics/sparse-imports::low-import-count",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.8399999737739563,
            "d": "Large binary with few DLL dependencies",
            "e": [
              "dependencies.count = 1.00"
            ],
            "i": "metadata/package/metrics::import-count-under-80",
            "l": 2
          },
          {
            "a": "T1485",
            "c": 0.8999999761581421,
            "d": "Giant embedded string blob metric",
            "e": [
              "binary.max_string_length = 2079095.00"
            ],
            "i": "objectives/impact/wipe/disk/overwrite::giant-string-blob-metric",
            "l": 1
          },
          {
            "c": 1.0,
            "d": ".NET BSJB metadata marker",
            "e": [
              "BSJB"
            ],
            "i": "metadata/binary/framework::bsjb-marker",
            "l": 1
          },
          {
            "c": 0.949999988079071,
            "d": "Filename has EXE extension",
            "e": [
              "589a46cddd84b26fc3828e368268390daaf25f2c8a3e6f5ab9b8e4125e6a1b7b.exe"
            ],
            "i": "objectives/evasion/masquerade/file/double-ext::basename-is-exe",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.9700000286102295,
            "d": "Regex component marker",
            "e": [
              "binary.largest_section_ratio = 1.00"
            ],
            "i": "objectives/anti-static/obfuscation/payload/section::packed-anti-analysis-data-loader-cond-1--inline-29202",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.949999988079071,
            "d": "Regex component marker",
            "e": [
              "binary.largest_section_ratio = 1.00"
            ],
            "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.949999988079071,
            "d": "links mscoree (CorExeMain)",
            "e": [
              "mscoree"
            ],
            "i": "metadata/dylib::mscoree",
            "l": 2,
            "el": [
              "1 symbols"
            ]
          },
          {
            "a": "T1036.005",
            "c": 0.8199999928474426,
            "d": "Low-import PE without dominant resources",
            "e": [
              "imports.count = 1.00"
            ],
            "i": "objectives/evasion/masquerade/version-resource/claim::low-import-pe-without-heavy-rsrc",
            "l": 1
          }
        ],
        "sha": "589a46cddd84b26fc3828e368268390daaf25f2c8a3e6f5ab9b8e4125e6a1b7b",
        "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/2020-11/589a46cddd84b26fc3828e368268390daaf25f2c8a3e6f5ab9b8e4125e6a1b7b.exe",
        "type": "pe"
      }
    ],
    "tv": "126f8"
  }
}