{ "ml": { "v": "7", "eng": "2.0.1-rc.1", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.00017233689, "rte": "az", "prob": 0.00017233689 }, { "cls": 0, "raw": 0.0145273805, "rte": "az/native", "prob": 0.0145273805 }, { "cls": 0, "raw": 0.6178194, "rte": "az/pe", "prob": 0.6178194 } ], "prob": 0.00017233689, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.00017233689140994102, "type": "pe" } ], "version": "v18.18", "analyzed_at": "2026-06-15T04:15:47Z" }, "path": "59d57e99b3d251a073e2ed0d935f28a8d62bb4624cdc027427b607d8262706b6.exe", "raw": { "v": "7", "tv": "061e3", "files": [ { "id": 0, "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000UMaU64J\u0026m(0ji6Sa?dLD+]{51x(+zoA=kPhvqNb%vqY$3BrC47", "l": 0, "n": [ { "c": 3, "d": "PE carries bound import descriptors", "i": "metadata/build/artifact::pe-bound-imports-present", "o": 0, "z": 1 } ], "x": true }, { "b": "Hm[Vt5c8Xg0000000000o\u0026C7Vr.UFae\u003c@xb0000000000000000000000000000000000000000", "l": 544, "n": [ { "c": 1, "d": "VB6 runtime DLL string", "i": "objectives/command-and-control/dropper/binder::vb6-runtime-dll-text", "o": 560, "z": 12 } ], "x": true }, { "b": "0000000000000000000000000000000000000000000000000000000000000000000000000005e4k", "l": 4152, "n": [ { "c": 3, "d": "VB6 DllFunctionCall thunk", "i": "micro-behaviors/dylib/lookup::vb6-dll-function-call", "o": 4168, "z": 15 } ], "x": true }, { "b": "yH}K7wO:dT000006951jm}D^pz!a0bwKZxIwLMVJwMF\u003ciCRqqZH+z0[000c4g?P8O0000000000P/=%N01e", "l": 9080, "n": [ { "c": 2, "d": "Get module file path", "i": "micro-behaviors/os/module/load::get-module-filename-dup", "o": 9096, "z": 18 } ], "x": true }, { "b": "o\u0026C7Vr.UFae\u003c@xb00000o\u003ewAWlT:!Emq=:LzE\u0026!F002C*mnu/?q+o.SuQnjkqE%Cu002A6y^@L+v@}", "l": 85312, "n": [ { "c": 2, "d": "VB6 runtime helper import", "i": "metadata/binary/framework::vb6-runtime-core-helper", "o": 85328, "z": 14 } ], "x": true }, { "b": "B.bPsnP5SYA+n-\u0026wDhYguTE$=vmtAJwPh-ZvqYQ(wPv+J002\u0026oz^#dyy?#KTxk8l{0000000000000000000000000000000000000000", "l": 85418, "n": [ { "c": 2, "d": "VB6 runtime helper import", "i": "metadata/binary/framework::vb6-runtime-core-helper", "o": 85434, "z": 18 } ], "x": true }, { "b": "0000000000007HHgYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006Xn[brp!0rr910rr9", "l": 85734, "n": [ { "c": 2, "d": "PE version resource metadata", "i": "metadata/package/versioning::version-resource-metadata", "o": 85750, "z": 15 } ], "x": true }, { "b": "fAr{fli5Xt001nA1onD5pYLIozVBqFBPt[KBo25ove$cAwDhYg004lz001LI3ig8bmGvc5yYF2DrSDXhASydXx-J5Kzu6Up001!Pe=W)ifAq7M001XM3ig8bpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001!Pe=W)ifAq7M001?Q5=.}jnDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE004iyve$PNl\u0026.05nc0(mqucW%002y!8uo^rpxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE004iyve$PNl\u0026.05nc0(m", "l": 85954, "n": [ { "c": 2, "d": "PE FileVersion metadata field", "i": "metadata/package/versioning::pe-fileversion-field", "o": 86006, "z": 11 }, { "c": 2, "d": "PE InternalName metadata field", "i": "metadata/package/versioning::pe-internalname-field", "o": 86098, "z": 12 }, { "c": 2, "d": "PE OriginalFilename metadata field", "i": "metadata/package/versioning::pe-originalfilename-field", "o": 86150, "z": 16 }, { "c": 2, "d": "PE ProductName metadata field", "i": "metadata/package/versioning::pe-productname-field", "o": 85970, "z": 11 }, { "c": 2, "d": "PE ProductVersion metadata field", "i": "metadata/package/versioning::pe-productversion-field", "o": 86050, "z": 14 } ], "x": true } ], "mol": "H(Ds)Md(Bk)", "sha": "59d57e99b3d251a073e2ed0d935f28a8d62bb4624cdc027427b607d8262706b6", "fact": { "id": "pe", "imp": [ [ "msvbvm60", "ORDINAL 183" ], [ "msvbvm60", "ORDINAL 583" ], [ "msvbvm60", "ORDINAL 187" ], [ "msvbvm60", "MethCallEngine" ], [ "msvbvm60", "ORDINAL 516" ], [ "msvbvm60", "ORDINAL 517" ], [ "msvbvm60", "ORDINAL 518" ], [ "msvbvm60", "ORDINAL 593" ], [ "msvbvm60", "ORDINAL 594" ], [ "msvbvm60", "ORDINAL 520" ], [ "msvbvm60", "ORDINAL 705" ], [ "msvbvm60", "ORDINAL 709" ], [ "msvbvm60", "ORDINAL 631" ], [ "msvbvm60", "ORDINAL 632" ], [ "msvbvm60", "ORDINAL 526" ], [ "msvbvm60", "EVENT_SINK_AddRef" ], [ "msvbvm60", "ORDINAL 527" ], [ "msvbvm60", "ORDINAL 529" ], [ "msvbvm60", "DllFunctionCall" ], [ "msvbvm60", "EVENT_SINK_Release" ], [ "msvbvm60", "EVENT_SINK_QueryInterface" ], [ "msvbvm60", "vbaExceptHandler" ], [ "msvbvm60", "ORDINAL 711" ], [ "msvbvm60", "ORDINAL 712" ], [ "msvbvm60", "ORDINAL 606" ], [ "msvbvm60", "ORDINAL 607" ], [ "msvbvm60", "ORDINAL 608" ], [ "msvbvm60", "ORDINAL 717" ], [ "msvbvm60", "ProcCallEngine" ], [ "msvbvm60", "ORDINAL 644" ], [ "msvbvm60", "ORDINAL 537" ], [ "msvbvm60", "ORDINAL 645" ], [ "msvbvm60", "ORDINAL 648" ], [ "msvbvm60", "ORDINAL 570" ], [ "msvbvm60", "ORDINAL 573" ], [ "msvbvm60", "ORDINAL 685" ], [ "msvbvm60", "ORDINAL 100" ], [ "msvbvm60", "ORDINAL 687" ], [ "msvbvm60", "ORDINAL 616" ], [ "msvbvm60", "ORDINAL 617" ], [ "msvbvm60", "ORDINAL 618" ], [ "msvbvm60", "ORDINAL 619" ], [ "msvbvm60", "ORDINAL 543" ], [ "msvbvm60", "ORDINAL 580" ] ], "met": { "pe": { "checksum": 135660.0, "checksum_valid": 0.0, "computed_checksum": 136370.0, "bound_import_count": 1.0, "bss_like_section_count": 1.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "bound_imports_fingerprint": 3877243007.0 }, "file": { "size": 86528.0, "entropy": 5.0, "size_bytes": 86528.0 }, "binary": { "is_pie": 0.0, "code_entropy": 5.04, "string_count": 93.0, "overall_entropy": 5.0, "entropy_variance": 1.56, "avg_string_length": 11.22, "max_string_length": 53.0, "code_to_data_ratio": 1.0, "string_length_stddev": 6.72, "largest_section_ratio": 0.98, "sentence_string_count": 1.0, "sentence_string_ratio": 0.01, "high_entropy_string_count": 0.0 }, "imports": { "count": 44.0 }, "sections": { "count": 3.0, "code_size": 84480.0, "entropy_max": 5.04, "entropy_mean": 3.79, "name_entropy": 3.01, "writable_count": 1.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } }, "sec": [ [ ".text", 1024, 84480, 5.04, "r-x" ], [ ".data", 0, 0, 0.0, "rw-" ], [ ".rsrc", 85504, 1024, 2.54, "r--" ] ], "str": [ [ 77, "u8", "!This program cannot be run in DOS mode." ], [ 152, "u8", "Rich" ], [ 424, "u8", ".text" ], [ 504, "u8", ".rsrc" ], [ 560, "u8", "MSVBVM60.DLL" ], [ 1058, "u8", "OsetPs" ], [ 1146, "u8", "PsDROs" ], [ 1900, "u8", "MEOW" ], [ 7740, "u8", "wazDkHxR5" ], [ 7752, "u8", "wazDkHxR9" ], [ 7764, "u8", "wazDkHxR7" ], [ 7776, "u8", "wazDkHxR8" ], [ 7876, "u8", "wazDkHxR2" ], [ 7904, "u8", "wUpfunkrZaUCPIBlkNlpfZQeKAoZdnCjxnNUHIMzCoCYGsRHaOmoh" ], [ 8028, "u8", "wazDkHxR11" ], [ 8081, "u8", "mrugC" ], [ 8134, "u8", "xVwazDkHxR53" ], [ 8148, "u8", "wazDkHxR68" ], [ 8160, "u8", "wazDkHxR51" ], [ 8172, "u8", "wazDkHxR48" ], [ 8184, "u8", "wazDkHxR55" ], [ 8196, "u8", "wazDkHxR24" ], [ 8208, "u8", "wazDkHxR52" ], [ 8220, "u8", "wazDkHxR69" ], [ 8232, "u8", "wazDkHxR33" ], [ 8244, "u8", "wazDkHxR34" ], [ 8256, "u8", "wazDkHxR40" ], [ 8268, "u8", "wazDkHxR46" ], [ 8280, "u8", "wazDkHxR25" ], [ 8292, "u8", "wazDkHxR58" ], [ 8304, "u8", "wazDkHxR22" ], [ 8316, "u8", "wazDkHxR44" ], [ 8328, "u8", "wazDkHxR56" ], [ 8340, "u8", "wazDkHxR26" ], [ 8352, "u8", "wazDkHxR27" ], [ 8364, "u8", "wazDkHxR49" ], [ 8376, "u8", "wazDkHxR54" ], [ 8388, "u8", "wazDkHxR39" ], [ 8400, "u8", "wazDkHxR29" ], [ 8412, "u8", "wazDkHxR30" ], [ 8424, "u8", "wazDkHxR70" ], [ 8436, "u8", "wazDkHxR21" ], [ 8448, "u8", "wazDkHxR28" ], [ 8460, "u8", "wazDkHxR41" ], [ 8472, "u8", "wazDkHxR23" ], [ 8484, "u8", "wazDkHxR32" ], [ 8496, "u8", "wazDkHxR71" ], [ 8508, "u8", "wazDkHxR37" ], [ 8520, "u8", "wazDkHxR57" ], [ 8532, "u8", "wazDkHxR43" ], [ 8544, "u8", "wazDkHxR31" ], [ 8556, "u8", "wazDkHxR47" ], [ 8568, "u8", "wazDkHxR35" ], [ 8580, "u8", "wazDkHxR36" ], [ 8592, "u8", "wazDkHxR59" ], [ 8604, "u8", "wazDkHxR42" ], [ 8628, "u8", "hMvZvKgh" ], [ 8720, "u8", "wazDkHxR6" ], [ 8732, "u8", "wazDkHxR10" ], [ 9080, "u8", "kernel32" ], [ 9096, "u8", "GetModuleFileNameW" ], [ 10504, "u8", "wazDkHxR4" ], [ 10588, "u8", "wazDkHxR3" ], [ 10600, "u8", "MSVBVM60" ], [ 10692, "u8", "wazDkHxR12" ], [ 10768, "u8", "Class" ], [ 10792, "u8", "ABcCBUaYtJQIrdPMDWFeaoZcxGlLlTAjrZ" ], [ 10888, "u8", "wazDkHxR1" ], [ 10900, "u8", "wazDkHxR0" ], [ 11152, "u8", "wazDkHxR" ], [ 11298, "u8", "sVRrzuyAqPfugUJc" ], [ 12311, "u8", "rJyt" ], [ 13155, "u8", "zhNl" ], [ 85328, "u8", "MethCallEngine" ], [ 85346, "u8", "EVENT_SINK_AddRef" ], [ 85366, "u8", "DllFunctionCall" ], [ 85384, "u8", "EVENT_SINK_Release" ], [ 85406, "u8", "EVENT_SINK_QueryInterface" ], [ 85434, "u8", "__vbaExceptHandler" ], [ 85456, "u8", "ProcCallEngine" ], [ 85750, "wide", "VS_VERSION_INFO" ], [ 85842, "wide", "VarFileInfo" ], [ 85874, "wide", "Translation" ], [ 85910, "wide", "StringFileInfo" ], [ 85946, "wide", "040904B0" ], [ 85970, "wide", "ProductName" ], [ 86006, "wide", "FileVersion" ], [ 86032, "wide", "3.90" ], [ 86050, "wide", "ProductVersion" ], [ 86098, "wide", "InternalName" ], [ 86124, "wide", "wazDkHxR" ], [ 86150, "wide", "OriginalFilename" ], [ 86184, "wide", "wazDkHxR.exe" ] ], "val": { "file.stem": "59d57e99b3d251a073e2ed0d935f28a8d62bb4624cdc027427b607d8262706b6", "pe.imphash": "3aa2b5107bb285a3aa45cba195a25d4a", "pe.machine": "i386", "pe.rich.key": 2288615565, "pe.rich.hash": "cfa14d932599a86407a6162cc2d261fa", "pe.subsystem": "windows_gui", "pe.timestamp": 1268999575, "file.basename": "59d57e99b3d251a073e2ed0d935f28a8d62bb4624cdc027427b607d8262706b6.exe", "pe.image_base": 4194304, "pe.image_size": 106496, "pe.machine_id": 332, "pe.os_version": "4.0", "pe.entry_point": 4552, "pe.headers_size": 1024, "pe.entry_section": ".text", "pe.subsystem_raw": 2, "pe.file_alignment": 512, "pe.image_hash.sha1": "c9979d1e4e782c27ba0d00d81fd2d191b76c1efc", "pe.image_hash.sha256": "5a27a4cf15c679b773bb8350a214429ac75de6600638607d4508b53502c3cc23", "pe.image_hash.sha384": "4d66f9718f1603f0863f1e17b78540148325db011688ce8d870309aa0f9b57344c860a00b0ab5d50cd64ad2cfbde51a1", "pe.image_hash.sha512": "b3c264745a0725a253a7214d3508b0685911180edb70f938ad70cc8ad3b1bee787e859777a794e672217474a367ef63bbb21781b78137fdc1aec53409526904d", "pe.section_alignment": 4096, "pe.subsystem_version": "4.0", "pe.characteristics[0]": "relocs_stripped", "pe.characteristics[1]": "executable_image", "pe.characteristics[2]": "32bit_machine", "pe.characteristics_raw": 271, "pe.linker_major_version": 6, "build.toolchain.compiler": "msvc", "pe.bound_imports[0].name": "MSVBVM60.DLL", "pe.data_directories[0].rva": 88164, "pe.data_directories[1].rva": 102400, "pe.data_directories[2].rva": 544, "pe.data_directories[3].rva": 4096, "pe.number_of_rva_and_sizes": 16, "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 40, "pe.data_directories[1].name": "resource", "pe.data_directories[1].size": 784, "pe.data_directories[2].name": "bound_import", "pe.data_directories[2].size": 32, "pe.data_directories[3].name": "iat", "pe.data_directories[3].size": 180, "pe.rich.entries[0].build_id": 13, "pe.rich.entries[0].use_count": 1, "pe.coff.dos_header_pe_pointer": 176, "pe.rich.entries[0].product_id": 9782, "pe.bound_imports[0].time_date_stamp": 1208131974 } }, "find": [ { "id": "objectives/command-and-control/dropper/binder::vb6-runtime-dll-text", "atk": "T1027.009", "conf": 0.9900000095367432, "crit": 1, "desc": "VB6 runtime DLL string" }, { "id": "metadata/package/versioning::pe-fileversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE FileVersion metadata field" }, { "id": "micro-behaviors/dylib/lookup::vb6-dll-function-call", "conf": 0.9399999976158142, "crit": 3, "desc": "VB6 DllFunctionCall thunk" }, { "id": "metadata/build/artifact::pe-bound-imports-present", "conf": 0.8999999761581421, "crit": 3, "desc": "PE carries bound import descriptors" }, { "id": "metadata/package/versioning::pe-version-resource", "conf": 0.800000011920929, "crit": 2, "desc": "PE version resource structure" }, { "id": "metadata/package/versioning::pe-productversion-field", "conf": 0.699999988079071, "crit": 2, "desc": "PE ProductVersion metadata field" }, { "id": "metadata/binary/metrics/structural::few-sections", "conf": 0.6000000238418579, "crit": 3, "desc": "Very few sections (merged/stripped)" }, { "id": "metadata/binary/metrics/structural::dominant-section", "conf": 0.6000000238418579, "crit": 3, "desc": "Single section dominates binary layout" } ], "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/2022-07/59d57e99b3d251a073e2ed0d935f28a8d62bb4624cdc027427b607d8262706b6.exe", "risk": 3, "size": 86528, "type": "pe" } ] } }