{ "ml": { "v": "5", "fs": [ { "id": 0, "prob": 0.8911781907081604, "class": 0, "threshold": 0.9987763166427612 } ], "prob": 0.8911782, "class": 0, "level": 3, "models": [ { "m": "az", "prob": 0.8911782, "class": 0 }, { "m": "az/native", "prob": 0.98376626, "class": 0 }, { "m": "az/pe", "prob": 0.1969697, "class": 0 } ], "version": "v17.17", "threshold": 0.9987763, "analyzed_at": "2026-05-31T05:28:43Z" }, "path": "5fd1c60e75c4f69becb02a21c86a756b8084ca3fc54ffc8ca9ac5501e276e6a2.exe", "raw": { "v": "5", "fs": [ { "f": "H(Ds)Md(Bk)", "x": 4, "ff": { "i": [ [ "msvbvm60", "ORDINAL 183" ], [ "msvbvm60", "ORDINAL 583" ], [ "msvbvm60", "ORDINAL 187" ], [ "msvbvm60", "MethCallEngine" ], [ "msvbvm60", "ORDINAL 516" ], [ "msvbvm60", "ORDINAL 517" ], [ "msvbvm60", "ORDINAL 518" ], [ "msvbvm60", "ORDINAL 593" ], [ "msvbvm60", "ORDINAL 594" ], [ "msvbvm60", "ORDINAL 520" ], [ "msvbvm60", "ORDINAL 705" ], [ "msvbvm60", "ORDINAL 709" ], [ "msvbvm60", "ORDINAL 631" ], [ "msvbvm60", "ORDINAL 632" ], [ "msvbvm60", "ORDINAL 526" ], [ "msvbvm60", "EVENT_SINK_AddRef" ], [ "msvbvm60", "ORDINAL 527" ], [ "msvbvm60", "ORDINAL 529" ], [ "msvbvm60", "DllFunctionCall" ], [ "msvbvm60", "EVENT_SINK_Release" ], [ "msvbvm60", "EVENT_SINK_QueryInterface" ], [ "msvbvm60", "vbaExceptHandler" ], [ "msvbvm60", "ORDINAL 711" ], [ "msvbvm60", "ORDINAL 712" ], [ "msvbvm60", "ORDINAL 606" ], [ "msvbvm60", "ORDINAL 607" ], [ "msvbvm60", "ORDINAL 608" ], [ "msvbvm60", "ORDINAL 717" ], [ "msvbvm60", "ProcCallEngine" ], [ "msvbvm60", "ORDINAL 644" ], [ "msvbvm60", "ORDINAL 537" ], [ "msvbvm60", "ORDINAL 645" ], [ "msvbvm60", "ORDINAL 648" ], [ "msvbvm60", "ORDINAL 570" ], [ "msvbvm60", "ORDINAL 573" ], [ "msvbvm60", "ORDINAL 685" ], [ "msvbvm60", "ORDINAL 100" ], [ "msvbvm60", "ORDINAL 687" ], [ "msvbvm60", "ORDINAL 616" ], [ "msvbvm60", "ORDINAL 617" ], [ "msvbvm60", "ORDINAL 618" ], [ "msvbvm60", "ORDINAL 619" ], [ "msvbvm60", "ORDINAL 543" ], [ "msvbvm60", "ORDINAL 580" ] ], "m": { "pe": { "checksum": 135660.0, "checksum_valid": 0.0, "computed_checksum": 116157.0, "bound_import_count": 1.0, "bss_like_section_count": 1.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "bound_imports_fingerprint": 3877243007.0 }, "file": { "size": 86528.0, "entropy": 5.0, "size_bytes": 86528.0 }, "binary": { "is_pie": 0.0, "code_entropy": 5.04, "string_count": 171.0, "entropy_variance": 1.57, "avg_string_length": 8.8, "max_string_length": 53.0, "code_to_data_ratio": 1.0, "string_length_stddev": 6.13, "largest_section_ratio": 0.98, "sentence_string_count": 1.0, "sentence_string_ratio": 0.01, "high_entropy_string_count": 0.0 }, "imports": { "count": 44.0 }, "sections": { "count": 3.0, "code_size": 84480.0, "entropy_max": 5.04, "entropy_mean": 3.78, "name_entropy": 3.01, "writable_count": 1.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } }, "s": [ [ 77, "u8", "!This program cannot be run in DOS mode." ], [ 152, "u8", "Rich" ], [ 424, "u8", ".text" ], [ 504, "u8", ".rsrc" ], [ 560, "u8", "MSVBVM60.DLL" ], [ 1058, "u8", "OsetPs" ], [ 1146, "u8", "PsDROs" ], [ 1900, "u8", "MEOW" ], [ 7740, "u8", "offpGTDu5" ], [ 7752, "u8", "offpGTDu9" ], [ 7764, "u8", "offpGTDu7" ], [ 7776, "u8", "offpGTDu8" ], [ 7876, "u8", "offpGTDu2" ], [ 7904, "u8", "VGjxkCAIzTGknRvdGydUzKrVsqLKcIHQDxyrFFTbaPaXgnuTlvXPY" ], [ 8028, "u8", "offpGTDu11" ], [ 8081, "u8", "mrugC" ], [ 8134, "u8", "xVoffpGTDu53" ], [ 8148, "u8", "offpGTDu68" ], [ 8160, "u8", "offpGTDu51" ], [ 8172, "u8", "offpGTDu48" ], [ 8184, "u8", "offpGTDu55" ], [ 8196, "u8", "offpGTDu24" ], [ 8208, "u8", "offpGTDu52" ], [ 8220, "u8", "offpGTDu69" ], [ 8232, "u8", "offpGTDu33" ], [ 8244, "u8", "offpGTDu34" ], [ 8256, "u8", "offpGTDu40" ], [ 8268, "u8", "offpGTDu46" ], [ 8280, "u8", "offpGTDu25" ], [ 8292, "u8", "offpGTDu58" ], [ 8304, "u8", "offpGTDu22" ], [ 8316, "u8", "offpGTDu44" ], [ 8328, "u8", "offpGTDu56" ], [ 8340, "u8", "offpGTDu26" ], [ 8352, "u8", "offpGTDu27" ], [ 8364, "u8", "offpGTDu49" ], [ 8376, "u8", "offpGTDu54" ], [ 8388, "u8", "offpGTDu39" ], [ 8400, "u8", "offpGTDu29" ], [ 8412, "u8", "offpGTDu30" ], [ 8424, "u8", "offpGTDu70" ], [ 8436, "u8", "offpGTDu21" ], [ 8448, "u8", "offpGTDu28" ], [ 8460, "u8", "offpGTDu41" ], [ 8472, "u8", "offpGTDu23" ], [ 8484, "u8", "offpGTDu32" ], [ 8496, "u8", "offpGTDu71" ], [ 8508, "u8", "offpGTDu37" ], [ 8520, "u8", "offpGTDu57" ], [ 8532, "u8", "offpGTDu43" ], [ 8544, "u8", "offpGTDu31" ], [ 8556, "u8", "offpGTDu47" ], [ 8568, "u8", "offpGTDu35" ], [ 8580, "u8", "offpGTDu36" ], [ 8592, "u8", "offpGTDu59" ], [ 8604, "u8", "offpGTDu42" ], [ 8628, "u8", "YtoKosQY" ], [ 8720, "u8", "offpGTDu6" ], [ 8732, "u8", "offpGTDu10" ], [ 9080, "u8", "kernel32" ], [ 9096, "u8", "GetModuleFileNameW" ], [ 10504, "u8", "offpGTDu4" ], [ 10588, "u8", "offpGTDu3" ], [ 10600, "u8", "MSVBVM60" ], [ 10692, "u8", "offpGTDu12" ], [ 10768, "u8", "Class" ], [ 10792, "u8", "qvpHvOlXJarFEcPtnkbVlLBBKLCyCwqQEn" ], [ 10888, "u8", "offpGTDu1" ], [ 10900, "u8", "offpGTDu0" ], [ 11152, "u8", "offpGTDu" ], [ 11298, "u8", "PYTKhrNDuNBriMAq" ], [ 13699, "u8", "WW7S" ], [ 13908, "u8", "pd83" ], [ 14147, "u8", "e98a" ], [ 85328, "u8", "MethCallEngine" ], [ 85346, "u8", "EVENT_SINK_AddRef" ], [ 85366, "u8", "DllFunctionCall" ], [ 85384, "u8", "EVENT_SINK_Release" ], [ 85406, "u8", "EVENT_SINK_QueryInterface" ], [ 85434, "u8", "__vbaExceptHandler" ], [ 85456, "u8", "ProcCallEngine" ], [ 85750, "wide", "VS_VERSION_INFO" ], [ 85842, "wide", "VarFileInfo" ], [ 85874, "wide", "Translation" ], [ 85910, "wide", "StringFileInfo" ], [ 85946, "wide", "040904B0" ], [ 85970, "wide", "ProductName" ], [ 86006, "wide", "FileVersion" ], [ 86032, "wide", "2.82" ], [ 86050, "wide", "ProductVersion" ], [ 86098, "wide", "InternalName" ], [ 86124, "wide", "offpGTDu" ], [ 86150, "wide", "OriginalFilename" ], [ 86184, "wide", "offpGTDu.exe" ] ], "v": { "file.stem": "5fd1c60e75c4f69becb02a21c86a756b8084ca3fc54ffc8ca9ac5501e276e6a2", "pe.imphash": "3aa2b5107bb285a3aa45cba195a25d4a", "pe.machine": "i386", "pe.rich.key": 2288615565, "pe.rich.hash": "cfa14d932599a86407a6162cc2d261fa", "pe.subsystem": "windows_gui", "pe.timestamp": 1268999575, "file.basename": "5fd1c60e75c4f69becb02a21c86a756b8084ca3fc54ffc8ca9ac5501e276e6a2.exe", "pe.image_base": 4194304, "pe.image_size": 106496, "pe.machine_id": 332, "pe.os_version": "4.0", "pe.entry_point": 4552, "pe.headers_size": 1024, "pe.entry_section": ".text", "pe.subsystem_raw": 2, "pe.file_alignment": 512, "pe.image_hash.sha1": "9a55342ba6fa420d15cc9f8dc2909b66265bde86", "pe.image_hash.sha256": "bd8ff342babb59e9c03bf9e3e0c30545878fc0de492afe0e362c63cee8026a6a", "pe.image_hash.sha384": "a100d053ac244d189fd7b201edec05f731b0143e478d08c94b350cd6595a40885a397d0d01d6094d982186e7e3e975b2", "pe.image_hash.sha512": "56ba461d808fb7376949fe22f0a39478184493cee163cb5c5c35423c9262f8a763d291b43d64d34dc35035afa7b6f67d188d370e6d22489630fed3cf135cb744", "pe.section_alignment": 4096, "pe.subsystem_version": "4.0", "pe.characteristics[0]": "relocs_stripped", "pe.characteristics[1]": "executable_image", "pe.characteristics[2]": "32bit_machine", "pe.characteristics_raw": 271, "pe.linker_major_version": 6, "build.toolchain.compiler": "msvc", "pe.bound_imports[0].name": "MSVBVM60.DLL", "pe.data_directories[0].rva": 88164, "pe.data_directories[1].rva": 102400, "pe.data_directories[2].rva": 544, "pe.data_directories[3].rva": 4096, "pe.number_of_rva_and_sizes": 16, "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 40, "pe.data_directories[1].name": "resource", "pe.data_directories[1].size": 784, "pe.data_directories[2].name": "bound_import", "pe.data_directories[2].size": 32, "pe.data_directories[3].name": "iat", "pe.data_directories[3].size": 180, "pe.rich.entries[0].build_id": 13, "pe.rich.entries[0].use_count": 1, "pe.coff.dos_header_pe_pointer": 176, "pe.rich.entries[0].product_id": 9782, "pe.bound_imports[0].time_date_stamp": 1208131974 }, "id": "pe", "sc": [ [ ".text", 1024, 84480, 5.04, "r-x" ], [ ".data", 0, 0, 0.0, "rw-" ], [ ".rsrc", 85504, 1024, 2.53, "r--" ] ] }, "id": 0, "sz": 86528, "ts": [ { "c": 1.0, "d": "File is a compiled binary", "e": [ "5fd1c60e75c4f69becb02a21c86a756b8084ca3fc54ffc8ca9ac5501e276e6a2.exe" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.699999988079071, "d": "Get module file path", "e": [ "GetModuleFileNameW" ], "i": "micro-behaviors/os/module/load::get-module-filename-dup", "l": 2, "el": [ "0x2388" ] }, { "c": 0.699999988079071, "d": "PE has few sections", "e": [ "sections.count = 3.00" ], "i": "metadata/binary/layout::legacy-few-sections", "l": 2 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "imports.count = 44.00" ], "i": "metadata/binary/metrics/threshold::many-imports-25", "l": 1 }, { "a": "T1027.009", "c": 0.9900000095367432, "d": "VB6 runtime DLL string", "e": [ "MSVBVM60.DLL" ], "i": "objectives/command-and-control/dropper/binder::vb6-runtime-dll-text", "l": 1, "el": [ "0x230" ] }, { "c": 0.8999999761581421, "d": "PE file uses .exe extension", "e": [ "5fd1c60e75c4f69becb02a21c86a756b8084ca3fc54ffc8ca9ac5501e276e6a2.exe" ], "i": "metadata/binary/framework::exe-extension", "l": 1 }, { "a": "T1027.009", "c": 0.9900000095367432, "d": "VB6 DllFunctionCall runtime string", "e": [ "DllFunctionCall" ], "i": "objectives/command-and-control/dropper/binder::vb6-dll-function-call-text", "l": 1, "el": [ "0x14d76" ] }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032", "el": [ "0x14ef6" ] }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "imports.count = 44.00" ], "i": "metadata/binary/metrics/threshold::many-imports-30", "l": 1 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 171.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.9200000166893005, "d": "VB6 runtime helper import", "e": [ "MethCallEngine", "ProcCallEngine", "__vbaExceptHandler" ], "i": "metadata/binary/framework::vb6-runtime-core-helper", "l": 2, "el": [ "0x14d50", "0x14dd0", "0x14dba" ] }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".data", ".text" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.8999999761581421, "d": "PE carries bound import descriptors", "e": [ "[{\"name\":\"MSVBVM60.DLL\",\"time_date_stamp\":1208131974,\"forwarder_ref_count\":0}]" ], "i": "metadata/build/artifact::pe-bound-imports-present", "l": 3, "el": [ "value:pe.bound_imports" ] }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "sections.count = 3.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "c": 0.6000000238418579, "d": "SOCKS5 BIND request opcode", "e": [ "05 02 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-bind-command-byte", "l": 1, "el": [ "0x14ca0" ] }, { "c": 0.800000011920929, "d": "CompanyName field absent from PE version info", "e": [ "field 'pe.version.company' does not exist" ], "i": "metadata/binary/anomaly/format::version-info-company-name-absent", "l": 1, "el": [ "value:pe.version.company" ] }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.98" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "PE InternalName metadata field", "e": [ "InternalName" ], "i": "metadata/package/versioning::pe-internalname-field", "l": 2, "el": [ "0x15052" ] }, { "c": 0.9399999976158142, "d": "VB6 DllFunctionCall thunk", "e": [ "DllFunctionCall" ], "i": "micro-behaviors/dylib/lookup::vb6-dll-function-call", "l": 3, "el": [ "0x1048" ] }, { "c": 0.699999988079071, "d": "PE OriginalFilename metadata field", "e": [ "OriginalFilename" ], "i": "metadata/package/versioning::pe-originalfilename-field", "l": 2, "el": [ "0x15086" ] }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "imports.count = 44.00" ], "i": "metadata/binary/metrics/threshold::many-imports-20", "l": 1 }, { "a": "T1485", "c": 0.8999999761581421, "d": "Preserves .exe .gho .bak files", "e": [ ".exe" ], "i": "objectives/impact/destroy/file-deletion::exe-gho-bak-whitelist", "l": 1, "m": "C0047", "el": [ "0x150a8" ] }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "imports.count = 44.00" ], "i": "metadata/binary/metrics/threshold::many-imports-40", "l": 1 }, { "c": 0.8999999761581421, "d": "SOCKS5 client greeting bytes", "e": [ "05 01 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-version-greeting-bytes", "l": 1, "el": [ "0x4307" ] }, { "c": 0.699999988079071, "d": "PE ProductName metadata field", "e": [ "ProductName" ], "i": "metadata/package/versioning::pe-productname-field", "l": 2, "el": [ "0x14fd2" ] }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "StringFileInfo" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1, "el": [ "0x14f96" ] }, { "c": 0.9900000095367432, "d": "Exactly three sections", "e": [ "sections.count = 3.00" ], "i": "well-known/malware/worm/ludbaruma::metric-section-count-3", "l": 1 }, { "c": 0.800000011920929, "d": "Tiny writable data section", "e": [ ".data (size: 0)" ], "i": "metadata/binary/section/metrics::tiny-data-section", "l": 1 }, { "a": "T1553.002", "c": 0.8500000238418579, "d": "PE lacks VS_VERSION_INFO resource", "e": [ "field 'pe.version.file_version' does not exist" ], "i": "objectives/evasion/masquerade/cert::pe-no-version-info-resource", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "a": "T1027", "c": 0.8399999737739563, "d": "VB6 PE with three sections", "e": [ "sections.count = 3.00" ], "i": "objectives/anti-static/obfuscation/payload/string-sparse::three-section-vb6-layout", "l": 1, "m": "B0032" }, { "a": "T1027.007", "c": 0.800000011920929, "d": "DLL name strings without LoadLibrary import", "e": [ "imports.count = 44.00" ], "i": "objectives/anti-static/obfuscation/string/runtime-decrypt::dll-names-no-loadlibrary", "l": 1, "m": "B0032.014" }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 0.98" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Tiny C string section ratio", "e": [ " = 0.0% of total (0 / 86528 bytes)" ], "i": "metadata/binary/section/metrics::tiny-cstring-section", "l": 1 }, { "a": "T1105", "c": 0.800000011920929, "d": "Compact PE import table", "e": [ "imports.count = 44.00" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table", "l": 1, "m": "E1105" }, { "a": "T1055", "c": 0.8500000238418579, "d": "Large null run in executable (64+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::large-null-run-text", "l": 1, "el": [ "0xbc3" ] }, { "a": "T1055", "c": 0.800000011920929, "d": "Executable section with very low entropy", "e": [ ".text (size: 84480, perms: r-x)" ], "i": "objectives/anti-static/obfuscation/binary-structure::low-entropy-executable", "l": 1 }, { "a": "T1045", "c": 0.6000000238418579, "d": "Single section dominates file (packer", "e": [ "binary.largest_section_ratio = 0.98" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::dominant-section", "l": 1, "m": "B0032" }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1, "el": [ "0xe5f" ] }, { "c": 0.6000000238418579, "d": "Single section dominates file (packer)", "e": [ "binary.largest_section_ratio = 0.98" ], "i": "metadata/binary/metrics/structural::dominant-section", "l": 3 }, { "a": "T1055", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "imports.count = 44.00" ], "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571", "l": 1, "m": "C0041" }, { "c": 0.949999988079071, "d": "Filename has EXE extension", "e": [ "5fd1c60e75c4f69becb02a21c86a756b8084ca3fc54ffc8ca9ac5501e276e6a2.exe" ], "i": "objectives/evasion/masquerade/file/double-ext::basename-is-exe", "l": 1 }, { "c": 0.6000000238418579, "d": "Very few sections (merged/stripped)", "e": [ "sections.count = 3.00" ], "i": "metadata/binary/metrics/structural::few-sections", "l": 3 }, { "d": ".exe extension reference", "e": [ ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 2, "el": [ "0x150a8" ] }, { "c": 0.800000011920929, "d": "Tiny resource section (no version/icon)", "e": [ ".rsrc (size: 1024)" ], "i": "metadata/binary/resource::minimal-resources", "l": 2 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Dominant section for VB6 loader profile", "e": [ "binary.largest_section_ratio = 0.98" ], "i": "objectives/anti-static/obfuscation/payload/string-sparse::dominant-text-layout-vb6", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "GetModuleFileNameW" ], "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers", "l": 1, "m": "B0032", "el": [ "0x2388" ] }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 0.98" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "links msvbvm60 (ORDINAL 183, ORDINAL 583, ORDINAL 187, MethCallEngine, ORDINAL 516, ... +39 more)", "e": [ "msvbvm60" ], "i": "metadata/dylib::msvbvm60", "l": 2, "el": [ "44 symbols" ] }, { "a": "T1027.009", "c": 0.9950000047683716, "d": "VB6 runtime dispatch string cluster", "e": [ "MSVBVM60.DLL", "DllFunctionCall" ], "i": "objectives/command-and-control/dropper/binder::vb6-runtime-text-cluster", "l": 1, "el": [ "0x230", "0x14d76" ] } ], "sha": "5fd1c60e75c4f69becb02a21c86a756b8084ca3fc54ffc8ca9ac5501e276e6a2", "path": "5fd1c60e75c4f69becb02a21c86a756b8084ca3fc54ffc8ca9ac5501e276e6a2.exe", "type": "pe" } ], "tv": "52045" } }