{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 0.03430774062871933,
        "class": 0
      }
    ],
    "prob": 0.03430774,
    "class": 0,
    "models": [
      {
        "m": "az",
        "prob": 0.03430774,
        "class": 0
      },
      {
        "m": "az/native",
        "prob": 0.0,
        "class": 0
      },
      {
        "m": "az/pe",
        "prob": 0.0,
        "class": 0
      }
    ],
    "version": "v17.17",
    "thresholds": [
      0.999503,
      0.9998882
    ],
    "analyzed_at": "2026-05-25T22:19:34Z"
  },
  "path": "VirusShare_9fcef6377530320a09e40ef0e77a022e",
  "raw": {
    "v": "5",
    "fs": [
      {
        "f": "Md₂(BiSi)",
        "x": 5,
        "ff": {
          "i": [
            [
              "mscoree",
              "CorDllMain"
            ]
          ],
          "m": {
            "pe": {
              "checksum": 79057.0,
              "checksum_valid": 1.0,
              "resource_count": 1.0,
              "has_version_info": 1.0,
              "computed_checksum": 79057.0,
              "bss_like_section_count": 0.0,
              "section_overflow_count": 0.0,
              "misaligned_section_count": 0.0,
              "base_relocation_block_count": 1.0,
              "base_relocation_entry_count": 1.0
            },
            "file": {
              "size": 22776.0,
              "entropy": 6.57,
              "size_bytes": 22776.0
            },
            "binary": {
              "is_pie": 1.0,
              "has_overlay": 1.0,
              "code_entropy": 4.98,
              "overlay_size": 13048.0,
              "string_count": 339.0,
              "overlay_ratio": 0.57,
              "overlay_entropy": 7.37,
              "entropy_variance": 4.03,
              "avg_string_length": 20.39,
              "max_string_length": 145.0,
              "code_to_data_ratio": 1.0,
              "string_length_stddev": 20.98,
              "largest_section_ratio": 0.34,
              "sentence_string_count": 71.0,
              "sentence_string_ratio": 0.21,
              "high_entropy_string_count": 0.0
            },
            "imports": {
              "count": 1.0
            },
            "sections": {
              "count": 3.0,
              "code_size": 7680.0,
              "entropy_max": 4.98,
              "entropy_mean": 2.64,
              "name_entropy": 3.03,
              "writable_count": 0.0,
              "executable_count": 1.0,
              "nonstandard_count": 0.0,
              "executable_writable_count": 0.0
            },
            "dependencies": {
              "count": 1.0
            }
          },
          "s": [
            [
              77,
              "u8",
              "!This program cannot be run in DOS mode."
            ],
            [
              376,
              "u8",
              ".text"
            ],
            [
              455,
              "u8",
              "@.reloc"
            ],
            [
              608,
              "u8",
              "lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.R"
            ],
            [
              765,
              "u8",
              "PADPADP"
            ],
            [
              1052,
              "wide",
              "AdministratorRightsRequiredCaptionJ"
            ],
            [
              1182,
              "wide",
              "CarrierInstallErrorǁ"
            ],
            [
              1260,
              "wide",
              "FileDownloadErrorǣ"
            ],
            [
              1342,
              "wide",
              "FileNotFoundErrorȞ"
            ],
            [
              1446,
              "wide",
              "MessageCarrierInstallError"
            ],
            [
              1550,
              "wide",
              "MessageFileDownloadErrorϣ"
            ],
            [
              1668,
              "wide",
              "MessageInsufficientRAMҩ"
            ],
            [
              1788,
              "wide",
              "MessageInvalidFolder"
            ],
            [
              1898,
              "wide",
              "MessageSkipOffer"
            ],
            [
              1968,
              "wide",
              "MultiInstancesCaption"
            ],
            [
              2048,
              "wide",
              "OfferAlreadyInstalled"
            ],
            [
              2134,
              "wide",
              "OptInPromptMessage"
            ],
            [
              2194,
              "wide",
              "Warning"
            ],
            [
              2252,
              "u8",
              "HAdministratorrechte erforderlich, um {Resource ProductName} auszuf"
            ],
            [
              2326,
              "u8",
              "(Fehler bei der Benutzerzugriffskontrolle"
            ],
            [
              2370,
              "u8",
              "Haben Sie die Installation von {Resource ProductName} abgebrochen?"
            ],
            [
              2440,
              "u8",
              "Bitte beachten Sie, dass folgende ausgew"
            ],
            [
              2482,
              "u8",
              "hlte Software installiert wurde / wurden:"
            ],
            [
              2540,
              "u8",
              "Sie k"
            ],
            [
              2547,
              "u8",
              "nnen jede Software"
            ],
            [
              2568,
              "u8",
              "ber das Dienstprogramm \"Hinzuf"
            ],
            [
              2600,
              "u8",
              "gen / Entfernen\" und deinstallieren"
            ],
            [
              2637,
              "u8",
              "Erweiterungen"
            ],
            [
              2653,
              "u8",
              "ber Ihren Browser-Add-On-Manager. \u003cbr /\u003e \u003cbr /\u003e"
            ],
            [
              2702,
              "u8",
              "Install Error"
            ],
            [
              2717,
              "u8",
              "Verbindungsfehler"
            ],
            [
              2735,
              "u8",
              "#Fehler beim Herunterladen der Datei"
            ],
            [
              2773,
              "u8",
              "Datei nicht gefunden"
            ],
            [
              2795,
              "u8",
              "Datei nicht gefunden:"
            ],
            [
              2819,
              "u8",
              "Dies ist das Installationsprogramm f"
            ],
            [
              2857,
              "u8",
              "r die 64-Bit-Version von {0} und l"
            ],
            [
              2893,
              "u8",
              "uft nicht auf Ihrem 32-Bit-Betriebssystem. Laden Sie stattdessen die 32-Bit-Version {0} herunter."
            ],
            [
              2993,
              "u8",
              "Bei der Installation von {Resource ProductName} ist ein unerwarteter Fehler aufgetreten."
            ],
            [
              3083,
              "u8",
              "Der Assistent wird geschlossen. Bitte versuche es erneut."
            ],
            [
              3144,
              "u8",
              "Exit-Code: {Resource CarrierCurrentExitCode}"
            ],
            [
              3193,
              "u8",
              "chten Sie das Installationsprogramm wirklich beenden?"
            ],
            [
              3247,
              "u8",
              "vSetup konnte die Datei nicht herunterladen. Bitte"
            ],
            [
              3307,
              "u8",
              "fen Sie die Netzwerkverbindung und versuchen Sie es erneut."
            ],
            [
              3367,
              "u8",
              "LDer Ordnername darf keines der folgenden Zeichen enthalten: \\n /: *? \\ \"\u003c\u003e |"
            ],
            [
              3447,
              "u8",
              "Auf Ihrem Computer ist derzeit nicht gen"
            ],
            [
              3489,
              "u8",
              "gend RAM verf"
            ],
            [
              3504,
              "u8",
              "gbar, um {0} zu installieren. \\nBitte schlie"
            ],
            [
              3550,
              "u8",
              "en Sie ein Programm, um Speicher freizugeben, und starten Sie die Installation von {0} erneut."
            ],
            [
              3647,
              "u8",
              "Der Installationsvorgang '{0}' erfordert eine Internetverbindung. Bitte stellen Sie sicher, dass Ihr Computer mit dem Internet v"
            ],
            [
              3789,
              "u8",
              "/Sie m"
            ],
            [
              3797,
              "u8",
              "ssen einen g"
            ],
            [
              3811,
              "u8",
              "ltigen Zielordner eingeben"
            ],
            [
              3839,
              "u8",
              "{0} ist bereits installiert."
            ],
            [
              3872,
              "u8",
              "chten Sie dieses Angebot wirklich"
            ],
            [
              3908,
              "u8",
              "berspringen?"
            ],
            [
              3921,
              "u8",
              "xEine andere Instanz dieses Installationsprogramms wird bereits ausgef"
            ],
            [
              3993,
              "u8",
              "hrt. Bitte versuche es in einigen Minuten erneut."
            ],
            [
              4043,
              "u8",
              "%Installationsprogramms l"
            ],
            [
              4070,
              "u8",
              "uft bereits"
            ],
            [
              4082,
              "u8",
              "#Nicht unterst"
            ],
            [
              4098,
              "u8",
              "tztes Betriebssystem"
            ],
            [
              4120,
              "u8",
              "Angebot bereits installiert"
            ],
            [
              4148,
              "u8",
              "\"Vervollst"
            ],
            [
              4160,
              "u8",
              "ndigen Sie Ihre Auswahl"
            ],
            [
              4184,
              "u8",
              "\\Sie haben keine Auswahl getroffen."
            ],
            [
              4224,
              "u8",
              "chten Sie {OfferSoftwareName} kostenlos installieren?"
            ],
            [
              4279,
              "u8",
              "Alles"
            ],
            [
              4287,
              "u8",
              "berspringen"
            ],
            [
              4300,
              "u8",
              "Warnung"
            ],
            [
              4310,
              "u8",
              "Der Installationsassistent hat beim Versuch, eine Verbindung zum Server herzustellen, einen Fehler festgestellt. Bitte versuchen"
            ],
            [
              4450,
              "u8",
              "ter noch einmal."
            ],
            [
              4794,
              "wide",
              "BundleInfoErrorCaptionŏ"
            ],
            [
              4892,
              "wide",
              "CancelMessageǻ"
            ],
            [
              4968,
              "wide",
              "CancelMessageLastScreenOfferPageȳ"
            ],
            [
              5088,
              "wide",
              "CouldNotDownloadMessageCaption"
            ],
            [
              5305,
              "u8",
              "Bitte beachten Sie, dass die folgende/n ausgew"
            ],
            [
              5353,
              "u8",
              "hlte/n Software/s installiert wurde/wurden:"
            ],
            [
              5420,
              "u8",
              "nnen jede Software mit dem"
            ],
            [
              5450,
              "u8",
              "Hinzuf"
            ],
            [
              5458,
              "u8",
              "gen/Entfernen"
            ],
            [
              5474,
              "u8",
              "-Dienstprogramm und den Erweiterungen"
            ],
            [
              5514,
              "u8",
              "ber den Add-on-Manager Ihres Browsers deinstallieren."
            ],
            [
              5589,
              "u8",
              "Der Installationsassistent hat beim Versuch, eine Verbindung mit dem Server herzustellen, einen Fehler festgestellt. Bitte versu"
            ],
            [
              5728,
              "u8",
              "ter erneut."
            ],
            [
              5740,
              "u8",
              "-Sind Sie sicher, dass Sie abbrechen m"
            ],
            [
              5788,
              "u8",
              "Warning"
            ],
            [
              5844,
              "u8",
              "Setup could not download the file. Please check network connection and retry."
            ],
            [
              5923,
              "u8",
              "File downloading error"
            ],
            [
              6022,
              "u8",
              "chten Sie kostenlos {OfferSoftwareName} ausprobieren?"
            ],
            [
              6362,
              "wide",
              "ChooseFolder"
            ],
            [
              6406,
              "wide",
              "InvalidPath8"
            ],
            [
              6492,
              "wide",
              "SelectFolder}"
            ],
            [
              6552,
              "u8",
              "Stornieren"
            ],
            [
              6563,
              "u8",
              "#Bitte w"
            ],
            [
              6573,
              "u8",
              "hlen Sie einen Ordner aus"
            ],
            [
              6601,
              "u8",
              "Error"
            ],
            [
              6613,
              "u8",
              "ltigen Pfad"
            ],
            [
              6625,
              "u8",
              "%Bitte w"
            ],
            [
              6635,
              "u8",
              "hlen Sie einen Ordner in {0}"
            ],
            [
              6665,
              "u8",
              "Nein"
            ],
            [
              6671,
              "u8",
              "Okay"
            ],
            [
              6680,
              "u8",
              "hlen Sie einen Ordner"
            ],
            [
              6716,
              "u8",
              "BSJB"
            ],
            [
              7093,
              "u8",
              "\u003cModule\u003e"
            ],
            [
              7102,
              "u8",
              "mscorlib"
            ],
            [
              7111,
              "u8",
              "System.Reflection"
            ],
            [
              7129,
              "u8",
              "AssemblyTitleAttribute"
            ],
            [
              7152,
              "u8",
              ".ctor"
            ],
            [
              7158,
              "u8",
              "AssemblyDescriptionAttribute"
            ],
            [
              7187,
              "u8",
              "AssemblyProductAttribute"
            ],
            [
              7212,
              "u8",
              "AssemblyCopyrightAttribute"
            ],
            [
              7239,
              "u8",
              "AssemblyTrademarkAttribute"
            ],
            [
              7266,
              "u8",
              "AssemblyFileVersionAttribute"
            ],
            [
              7295,
              "u8",
              "DevLib.resources.dll"
            ],
            [
              7316,
              "u8",
              "DevLib.resources"
            ],
            [
              7336,
              "u8",
              "DevLib.LanguageResource.GenericBundleResources.de.resources"
            ],
            [
              7396,
              "u8",
              "DevLib.LanguageResource.Res.de.resources"
            ],
            [
              7437,
              "u8",
              "DevLib.LanguageResource.SciterScriptResources.de.resources"
            ],
            [
              7560,
              "u8",
              "DevLib"
            ],
            [
              7572,
              "u8",
              "adaware installer dll"
            ],
            [
              7599,
              "u8",
              "Copyright"
            ],
            [
              7611,
              "u8",
              "Adaware 2020"
            ],
            [
              7636,
              "u8",
              "5.1.1.0"
            ],
            [
              7710,
              "u8",
              "mscoree.dll"
            ],
            [
              8286,
              "wide",
              "VS_VERSION_INFO"
            ],
            [
              8378,
              "wide",
              "VarFileInfo"
            ],
            [
              8410,
              "wide",
              "Translation"
            ],
            [
              8446,
              "wide",
              "StringFileInfo"
            ],
            [
              8506,
              "wide",
              "Comments"
            ],
            [
              8524,
              "wide",
              "adaware installer dll"
            ],
            [
              8574,
              "wide",
              "FileDescription"
            ],
            [
              8608,
              "wide",
              "DevLib"
            ],
            [
              8630,
              "wide",
              "FileVersion"
            ],
            [
              8656,
              "wide",
              "5.1.1.0"
            ],
            [
              8678,
              "wide",
              "InternalName"
            ],
            [
              8704,
              "wide",
              "DevLib.resources.dll"
            ],
            [
              8754,
              "wide",
              "LegalCopyright"
            ],
            [
              8784,
              "wide",
              "Copyright © Adaware 2020"
            ],
            [
              8842,
              "wide",
              "OriginalFilename"
            ],
            [
              8926,
              "wide",
              "ProductName"
            ],
            [
              8974,
              "wide",
              "ProductVersion"
            ],
            [
              9026,
              "wide",
              "Assembly Version"
            ],
            [
              9924,
              "u8",
              "GlobalSign nv-sa1"
            ],
            [
              9969,
              "u8",
              "GlobalSign Root CA0"
            ],
            [
              10006,
              "u8",
              "280128120000Z0R1"
            ],
            [
              10045,
              "u8",
              "GlobalSign nv-sa1(0\u0026"
            ],
            [
              10072,
              "u8",
              "GlobalSign Timestamping CA - G20"
            ],
            [
              10224,
              "u8",
              "0Erm9"
            ],
            [
              10489,
              "u8",
              "0402"
            ],
            [
              10504,
              "u8",
              "\u0026https://www.globalsign.com/repository/03"
            ],
            [
              10561,
              "u8",
              "\"http://crl.globalsign.net/root.crl0"
            ],
            [
              11041,
              "u8",
              "160524000000Z"
            ],
            [
              11095,
              "u8",
              "GMO GlobalSign Pte Ltd100."
            ],
            [
              11127,
              "u8",
              "'GlobalSign TSA for MS Authenticode - G20"
            ],
            [
              11493,
              "u8",
              "E0C0A"
            ],
            [
              11524,
              "u8",
              "\u0026https://www.globalsign.com/repository/0"
            ],
            [
              11616,
              "u8",
              "1http://crl.globalsign.com/gs/gstimestampingg2.crl0T"
            ],
            [
              11679,
              "u8",
              "H0F0D"
            ],
            [
              11695,
              "u8",
              "8http://secure.globalsign.com/cacert/gstimestampingg2.crt0"
            ],
            [
              12162,
              "u8",
              "Entrust, Inc.1(0\u0026"
            ],
            [
              12186,
              "u8",
              "See www.entrust.net/legal-terms1907"
            ],
            [
              12227,
              "u8",
              "0(c) 2009 Entrust, Inc. - for authorized use only1200"
            ],
            [
              12286,
              "u8",
              ")Entrust Root Certification Authority - G20"
            ],
            [
              12332,
              "u8",
              "150610134249Z"
            ],
            [
              12347,
              "u8",
              "301110141249Z0"
            ],
            [
              12452,
              "u8",
              "0(c) 2015 Entrust, Inc. - for authorized use only1\u003c0:"
            ],
            [
              12511,
              "u8",
              "3Entrust Extended Validation Code Signing CA - EVCS10"
            ],
            [
              12952,
              "u8",
              "http://ocsp.entrust.net00"
            ],
            [
              12994,
              "u8",
              "http://crl.entrust.net/g2ca.crl0;"
            ],
            [
              13033,
              "u8",
              "40200"
            ],
            [
              13060,
              "u8",
              "http://www.entrust.net/rpa0"
            ],
            [
              13679,
              "u8",
              "200113193708Z"
            ],
            [
              13694,
              "u8",
              "210113200707Z0"
            ],
            [
              13734,
              "u8",
              "Sibiu1"
            ],
            [
              13771,
              "u8",
              "ITNT SRL1"
            ],
            [
              13790,
              "u8",
              "Private Organization1"
            ],
            [
              13821,
              "u8",
              "J32/15 /20031"
            ],
            [
              13844,
              "u8",
              "ITNT SRL0"
            ],
            [
              14221,
              "u8",
              "http://ocsp.entrust.net05"
            ],
            [
              14257,
              "u8",
              ")http://aia.entrust.net/evcs1-chain256.cer01"
            ],
            [
              14317,
              "u8",
              "http://crl.entrust.net/evcs1.crl0J"
            ],
            [
              14358,
              "u8",
              "C0A06"
            ],
            [
              14942,
              "u8",
              "3Entrust Extended Validation Code Signing CA - EVCS1"
            ],
            [
              15317,
              "u8",
              "Rorp"
            ],
            [
              15497,
              "u8",
              "GlobalSign Timestamping CA - G2"
            ],
            [
              15710,
              "u8",
              "T0R1"
            ],
            [
              16168,
              "u8",
              "N0L0"
            ],
            [
              19768,
              "u8",
              "20201125194038Z"
            ],
            [
              19813,
              "u8",
              "GMO GlobalSign Pte Ltd1)0'"
            ],
            [
              19845,
              "u8",
              "GlobalSign TSA for Standard - G2"
            ],
            [
              20033,
              "u8",
              "270624000000Z0Y1"
            ],
            [
              20104,
              "u8",
              "GlobalSign TSA for Standard - G20"
            ],
            [
              21034,
              "u8",
              "Uz8ht"
            ],
            [
              22612,
              "u8",
              "WXGJG2"
            ]
          ],
          "v": {
            "pe.imphash": "dae02f32a21e03ce65412f6e56942daa",
            "pe.machine": "i386",
            "pe.subsystem": "windows_cui",
            "pe.timestamp": 1606332327,
            "pe.image_base": 4194304,
            "pe.image_size": 32768,
            "pe.machine_id": 332,
            "pe.os_version": "4.0",
            "pe.version.os": "unknown",
            "pe.entry_point": 15406,
            "pe.headers_size": 512,
            "pe.version.type": "dll",
            "pe.entry_section": ".text",
            "pe.subsystem_raw": 3,
            "pe.clr.is_il_only": 1,
            "pe.file_alignment": 512,
            "pe.cert_table_size": 13048,
            "pe.image_hash.sha1": "2c9579dd5ceb60005bbbf6e0f7a779591ff67b4c",
            "pe.version.comments": "adaware installer dll",
            "pe.image_hash.sha256": "695f7c44a13739daa516f7480c2219595e3373f027e3bc3ef064efbed4e7b0ea",
            "pe.image_hash.sha384": "ecc7492e918f4337bb7a46e12c304dfabc32a6aee14846c2e689dfeafcce1c11d39c576ab07a6bdecad7fa69d8a17862",
            "pe.image_hash.sha512": "83660d420fdd6a1b8d65d30f39cd54453edffbe1e0d2636485f699b2ba4544811963c76af3b9f9c0cc2b60de6cf86946147d211fb41657dd922830009089040d",
            "pe.resource_types[0]": "RT_VERSION",
            "pe.section_alignment": 8192,
            "pe.subsystem_version": "4.0",
            "pe.version.copyright": "Copyright © Adaware 2020",
            "pe.characteristics[0]": "executable_image",
            "pe.characteristics[1]": "32bit_machine",
            "pe.characteristics[2]": "dll",
            "pe.characteristics_raw": 8450,
            "pe.clr.runtime_version": "2.5",
            "pe.version.description": "DevLib",
            "pe.linker_major_version": 8,
            "pe.signatures[0].issuer": "CN=Entrust Extended Validation Code Signing CA - EVCS1,OU=(c) 2015 Entrust\\, Inc. - for authorized use only,OU=See www.entrust.net/legal-terms,O=Entrust\\, Inc.,C=US",
            "pe.signatures[0].serial": "0e6c471b231288be000000005565b0c7",
            "pe.version.file_version": "5.1.1.0",
            "pe.version.product_name": "DevLib",
            "pe.signatures[0].subject": "CN=ITNT SRL,SERIALNUMBER=J32/15 /2003,BUSINESSCATEGORY=Private Organization,O=ITNT SRL,1.3.6.1.4.1.311.60.2.1.3=#1302524f,L=Sibiu,C=RO",
            "pe.version.internal_name": "DevLib.resources.dll",
            "pe.dll_characteristics[0]": "dynamic_base",
            "pe.dll_characteristics[1]": "nx_compat",
            "pe.dll_characteristics[2]": "no_seh",
            "pe.dll_characteristics[3]": "terminal_server_aware",
            "pe.signatures[0].verified": true,
            "pe.data_directories[0].rva": 15328,
            "pe.data_directories[1].rva": 16384,
            "pe.data_directories[2].rva": 9728,
            "pe.data_directories[3].rva": 24576,
            "pe.data_directories[4].rva": 8192,
            "pe.data_directories[5].rva": 8200,
            "pe.dll_characteristics_raw": 34112,
            "pe.number_of_rva_and_sizes": 16,
            "pe.signatures[0].not_after": "2021-01-13T20:07:07Z",
            "pe.version.product_version": "5.1.1.0",
            "pe.data_directories[0].name": "import",
            "pe.data_directories[0].size": 75,
            "pe.data_directories[1].name": "resource",
            "pe.data_directories[1].size": 888,
            "pe.data_directories[2].name": "certificate",
            "pe.data_directories[2].size": 13048,
            "pe.data_directories[3].name": "base_relocation",
            "pe.data_directories[3].size": 12,
            "pe.data_directories[4].name": "iat",
            "pe.data_directories[4].size": 8,
            "pe.data_directories[5].name": "clr_runtime_header",
            "pe.data_directories[5].size": 72,
            "pe.signatures[0].not_before": "2020-01-13T19:37:08Z",
            "pe.version.original_filename": "DevLib.resources.dll",
            "pe.coff.dos_header_pe_pointer": 128,
            "pe.signatures[0].nested.issuer": "CN=Entrust Extended Validation Code Signing CA - EVCS1,OU=(c) 2015 Entrust\\, Inc. - for authorized use only,OU=See www.entrust.net/legal-terms,O=Entrust\\, Inc.,C=US",
            "pe.signatures[0].nested.serial": "0e6c471b231288be000000005565b0c7",
            "pe.base_relocations.block_count": 1,
            "pe.base_relocations.entry_count": 1,
            "pe.signatures[0].nested.subject": "CN=ITNT SRL,SERIALNUMBER=J32/15 /2003,BUSINESSCATEGORY=Private Organization,O=ITNT SRL,1.3.6.1.4.1.311.60.2.1.3=#1302524f,L=Sibiu,C=RO",
            "pe.signatures[0].nested.verified": true,
            "pe.signatures[0].thumbprint_sha1": "15fdc022d8114f7c7c4e8b1385cb89b41626d37d",
            "pe.base_relocations.padding_count": 1,
            "pe.signatures[0].cert_chain_depth": 4,
            "pe.signatures[0].digest_algorithm": "sha1",
            "pe.signatures[0].eku_code_signing": true,
            "pe.signatures[0].nested.not_after": "2021-01-13T20:07:07Z",
            "pe.signatures[0].signature_digest": "2c9579dd5ceb60005bbbf6e0f7a779591ff67b4c",
            "pe.signatures[0].nested.not_before": "2020-01-13T19:37:08Z",
            "pe.signatures[0].thumbprint_sha256": "437f38e130426ef025fc7eddd3456a6b18120fd63dbddceed1568639c95f1dbd",
            "pe.signatures[0].signature_algorithm": "sha256WithRSAEncryption",
            "pe.signatures[0].nested.thumbprint_sha1": "15fdc022d8114f7c7c4e8b1385cb89b41626d37d",
            "pe.signatures[0].nested.cert_chain_depth": 2,
            "pe.signatures[0].nested.digest_algorithm": "sha256",
            "pe.signatures[0].nested.eku_code_signing": true,
            "pe.signatures[0].nested.signature_digest": "695f7c44a13739daa516f7480c2219595e3373f027e3bc3ef064efbed4e7b0ea",
            "pe.signatures[0].nested.thumbprint_sha256": "437f38e130426ef025fc7eddd3456a6b18120fd63dbddceed1568639c95f1dbd",
            "pe.signatures[0].nested.signature_algorithm": "sha256WithRSAEncryption",
            "pe.signatures[0].signature_digest_algorithm": "sha1",
            "pe.signatures[0].nested.signature_digest_algorithm": "sha256"
          },
          "id": "pe",
          "sc": [
            [
              ".text",
              512,
              7680,
              4.98,
              "r-x"
            ],
            [
              ".rsrc",
              8192,
              1024,
              2.87,
              "r--"
            ],
            [
              ".reloc",
              9216,
              512,
              0.08,
              "r--"
            ]
          ]
        },
        "id": 0,
        "sz": 22776,
        "ts": [
          {
            "c": 1.0,
            "d": ".NET assembly detected via BSJB CLR metadata signature",
            "e": [
              "BSJB at offset 0x1a3c"
            ],
            "i": "metadata/dotnet/bsjb-signature",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "Authenticode chain CN: ITNT SRL",
            "e": [
              "ITNT SRL"
            ],
            "i": "metadata/signed/unknown::itnt-srl",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "Signed by ITNT SRL",
            "e": [
              "ITNT SRL"
            ],
            "i": "metadata/signed/leaf::itnt-srl",
            "l": 3
          },
          {
            "c": 0.949999988079071,
            "d": "PE version info numeric fields present",
            "e": [
              "5.1.1.0"
            ],
            "i": "metadata/binary/anomaly/format::version-info-file-version-present",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "File is a compiled binary",
            "e": [
              "VirusShare_9fcef6377530320a09e40ef0e77a022e"
            ],
            "i": "metadata/binary/framework::is-binary",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "PE OriginalFilename metadata field",
            "e": [
              "OriginalFilename"
            ],
            "i": "metadata/package/versioning::pe-originalfilename-field",
            "l": 2
          },
          {
            "a": "T1027",
            "c": 0.8399999737739563,
            "d": "VB6 PE with three sections",
            "e": [
              "sections.count = 3.00"
            ],
            "i": "objectives/anti-static/obfuscation/payload/string-sparse::three-section-vb6-layout",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.9200000166893005,
            "d": "PE FileVersion resembles IPv4",
            "e": [
              "5.1.1.0"
            ],
            "i": "metadata/package/versioning::pe-file-version-ipv4-shape",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "PE Authenticode signature verified metadata",
            "e": [
              "true"
            ],
            "i": "metadata/signed/certificate::pe-signature-verified-kv",
            "l": 2
          },
          {
            "a": "T1027.009",
            "c": 0.8600000143051147,
            "d": ".NET ResourceReader payload access",
            "e": [
              "lSystem.Resources.ResourceReader, mscorlib, Version=2.0.…"
            ],
            "i": "micro-behaviors/data/embedded/payload/resource::dotnet-resource-reader",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "PE checksum matches computed value",
            "e": [
              "pe.checksum_valid = 1.00"
            ],
            "i": "metadata/binary/layout::pe-checksum-valid",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "PE FileDescription metadata field",
            "e": [
              "FileDescription"
            ],
            "i": "metadata/package/versioning::pe-filedescription-field",
            "l": 2
          },
          {
            "c": 0.800000011920929,
            "d": "Regex component marker",
            "e": [
              "MessageFileDownloadErrorϣ",
              "Setup could not download the file. Please check network connection and retry.",
              "File downloading error",
              "CouldNotDownloadMessageCaption",
              "FileDownloadErrorǣ"
            ],
            "i": "micro-behaviors/communications/http/client/managed::webclient--rx-5",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "ASLR enabled (DYNAMIC_BASE)",
            "e": [
              "[dynamic_base, nx_compat, no_seh, terminal_server_aware]"
            ],
            "i": "metadata/hardening/mitigation::pe-aslr",
            "l": 2
          },
          {
            "c": 0.699999988079071,
            "d": "PE with six or fewer imports",
            "e": [
              "imports.count = 1.00"
            ],
            "i": "metadata/binary/symbols/imports::pe-imports-max-six",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.9900000095367432,
            "d": "PE version resource text",
            "e": [
              "VS_VERSION_INFO"
            ],
            "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.8999999761581421,
            "d": "Regex component marker",
            "e": [
              "binary.overlay_ratio = 0.57"
            ],
            "i": "objectives/anti-static/obfuscation/control-flow/logic::bloated-low-density-malware-cond-5--inline-32080",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "PE InternalName metadata field",
            "e": [
              "InternalName"
            ],
            "i": "metadata/package/versioning::pe-internalname-field",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "PE binary has trailing overlay data",
            "e": [
              "binary.has_overlay = 1.00"
            ],
            "i": "metadata/binary/layout::has-overlay",
            "l": 3
          },
          {
            "c": 0.8999999761581421,
            "d": "SOCKS5 client greeting bytes",
            "e": [
              "05 01 00"
            ],
            "i": "micro-behaviors/communications/proxy/socks::socks5-version-greeting-bytes",
            "l": 1
          },
          {
            "c": 0.6000000238418579,
            "d": "Copyright notice",
            "e": [
              "Copyright"
            ],
            "i": "metadata/package/license::copyright-word",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "Binary has 4 or fewer sections",
            "e": [
              "sections.count = 3.00"
            ],
            "i": "objectives/command-and-control/infrastructure/config::max-sections-4",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "Regex component marker",
            "e": [
              "StringFileInfo"
            ],
            "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "PE resource section",
            "e": [
              ".rsrc"
            ],
            "i": "metadata/binary/section/names::pe-resource-section",
            "l": 1
          },
          {
            "a": "T1620",
            "c": 0.949999988079071,
            "d": "mscoree DLL string reference",
            "e": [
              "mscoree.dll"
            ],
            "i": "objectives/anti-static/obfuscation/payload/loader::mscoree-name-anywhere",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 1.0,
            "d": "PE first resource is RT_VERSION",
            "e": [
              "RT_VERSION"
            ],
            "i": "metadata/binary/resource::pe-resource-version-first",
            "l": 2
          },
          {
            "c": 0.699999988079071,
            "d": "PE has few sections",
            "e": [
              "sections.count = 3.00"
            ],
            "i": "metadata/binary/layout::legacy-few-sections",
            "l": 2
          },
          {
            "c": 0.949999988079071,
            "d": "PE ProductName field is populated",
            "e": [
              "DevLib"
            ],
            "i": "metadata/package/versioning::pe-product-name-present",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "mscorlib reference",
            "e": [
              "mscorlib",
              "lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.R"
            ],
            "i": "metadata/lang/compiler/managed::mscorlib",
            "l": 2
          },
          {
            "c": 0.8999999761581421,
            "d": "PE standard code/data section",
            "e": [
              ".text"
            ],
            "i": "metadata/binary/section/names::pe-code-data-standard-section",
            "l": 1
          },
          {
            "c": 0.9399999976158142,
            "d": "PE overlay exceeds thirty-five percent",
            "e": [
              "binary.overlay_ratio = 0.57"
            ],
            "i": "metadata/binary/layout::overlay-over-35pct",
            "l": 3
          },
          {
            "a": "T1036",
            "c": 0.8999999761581421,
            "d": "Repeated GlobalSign certificate text",
            "e": [
              "GlobalSign Root CA0",
              "GMO GlobalSign Pte Ltd100.",
              "GlobalSign Timestamping CA - G2",
              "GlobalSign Timestamping CA - G20",
              "GlobalSign nv-sa1",
              "GMO GlobalSign Pte Ltd1)0'",
              "GlobalSign TSA for Standard - G2",
              "GlobalSign TSA for Standard - G20",
              "'GlobalSign TSA for MS Authenticode - G20",
              "GlobalSign nv-sa1(0\u0026"
            ],
            "i": "objectives/evasion/masquerade/binary::repeated-globalsign-cert-text",
            "l": 1,
            "m": "OB0006"
          },
          {
            "c": 0.800000011920929,
            "d": "Binary has many sentence-like strings",
            "e": [
              "binary.sentence_string_ratio = 0.21"
            ],
            "i": "metadata/binary/metrics/threshold::rich-sentence-strings-20pct",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "PE ProductName metadata field",
            "e": [
              "ProductName"
            ],
            "i": "metadata/package/versioning::pe-productname-field",
            "l": 2
          },
          {
            "c": 1.0,
            "d": ".NET Metadata Root (BSJB)",
            "e": [
              "BSJB"
            ],
            "i": "metadata/binary/framework::dotnet-metadata",
            "l": 2
          },
          {
            "c": 0.8500000238418579,
            "d": "IPv4-like .NET assembly version",
            "e": [
              "Version=2.0.0.0"
            ],
            "i": "metadata/lang/compiler/managed::dotnet-ipv4-like-version",
            "l": 2
          },
          {
            "c": 0.9200000166893005,
            "d": "PE ProductVersion resembles IPv4",
            "e": [
              "5.1.1.0"
            ],
            "i": "metadata/package/versioning::pe-product-version-ipv4-shape",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "PE import table has exactly one entry",
            "e": [
              "imports.count = 1.00"
            ],
            "i": "metadata/binary/symbols/imports::single-import-raw",
            "l": 1
          },
          {
            "a": "T1105",
            "c": 0.800000011920929,
            "d": "Stagecomp downloading status",
            "e": [
              "downloading"
            ],
            "i": "objectives/command-and-control/dropper/delivery/download-execute::stagecomp-downloading-status",
            "l": 1,
            "m": "B0024"
          },
          {
            "a": "T1105, T1204.002",
            "c": 0.8999999761581421,
            "d": "Italian staged download status",
            "e": [
              "download",
              "Download"
            ],
            "i": "objectives/command-and-control/dropper/delivery/download-execute::italian-download-status-burst",
            "l": 1,
            "m": "E1105"
          },
          {
            "c": 0.8999999761581421,
            "d": "PE .reloc section presence",
            "e": [
              ".reloc"
            ],
            "i": "metadata/binary/section/names::reloc-section-presence",
            "l": 2
          },
          {
            "c": 0.949999988079071,
            "d": "PE FileDescription field is populated",
            "e": [
              "DevLib"
            ],
            "i": "metadata/package/versioning::pe-file-description-present",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "PE has many readable strings",
            "e": [
              "binary.string_count = 339.00"
            ],
            "i": "metadata/binary/layout::many-readable-strings",
            "l": 2
          },
          {
            "d": ".dll extension reference",
            "e": [
              ".dll"
            ],
            "i": "micro-behaviors/fs/path/extension::dll-dup",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "NO_SEH (SafeSEH not used)",
            "e": [
              "[dynamic_base, nx_compat, no_seh, terminal_server_aware]"
            ],
            "i": "metadata/hardening/mitigation::pe-no-seh",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "DEP / NX enabled (NX_COMPAT)",
            "e": [
              "[dynamic_base, nx_compat, no_seh, terminal_server_aware]"
            ],
            "i": "metadata/hardening/mitigation::pe-dep",
            "l": 2
          },
          {
            "c": 0.8999999761581421,
            "d": "PE standard runtime section",
            "e": [
              ".reloc"
            ],
            "i": "metadata/binary/section/names::pe-runtime-standard-section",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "CompanyName field absent from PE version info",
            "e": [
              "field 'pe.version.company' does not exist"
            ],
            "i": "metadata/binary/anomaly/format::version-info-company-name-absent",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "PE has under ten imports",
            "e": [
              "imports.count = 1.00"
            ],
            "i": "objectives/anti-static/pack/runtime::pe-import-count-under-10",
            "l": 1
          },
          {
            "c": 0.949999988079071,
            "d": "PE LegalCopyright field is populated",
            "e": [
              "Copyright © Adaware 2020"
            ],
            "i": "metadata/package/versioning::pe-legal-copyright-present",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "Reflection method namespace token",
            "e": [
              "System.Reflection"
            ],
            "i": "objectives/anti-static/obfuscation/reflection/invoke::namespace-import",
            "l": 1
          },
          {
            "a": "T1055",
            "c": 0.9200000166893005,
            "d": "Regex component marker",
            "e": [
              "imports.count = 1.00"
            ],
            "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571",
            "l": 1,
            "m": "C0041"
          },
          {
            "c": 0.6000000238418579,
            "d": "Very few sections (merged/stripped)",
            "e": [
              "sections.count = 3.00"
            ],
            "i": "metadata/binary/metrics/structural::few-sections",
            "l": 3
          },
          {
            "a": "T1105",
            "c": 0.800000011920929,
            "d": "Compact PE import table",
            "e": [
              "imports.count = 1.00"
            ],
            "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table",
            "l": 1,
            "m": "E1105"
          },
          {
            "a": "T1027",
            "c": 0.8600000143051147,
            "d": "Long mixed-case identifiers cluster",
            "e": [
              "AssemblyCopyrightAttribute",
              "AssemblyFileVersionAttribute",
              "GenericBundleResources",
              "CouldNotDownloadMessageCaption",
              "SciterScriptResources",
              "OfferAlreadyInstalled",
              "AssemblyDescriptionAttribute",
              "AssemblyTrademarkAttribute",
              "AdministratorRightsRequiredCaptionJ",
              "AssemblyProductAttribute",
              "AssemblyTitleAttribute",
              "MessageCarrierInstallError"
            ],
            "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 1.0,
            "d": ".NET BSJB metadata marker",
            "e": [
              "BSJB"
            ],
            "i": "metadata/binary/framework::bsjb-marker",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.800000011920929,
            "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)",
            "e": [
              "pe.resource_count = 1.00"
            ],
            "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "Tiny resource section (no version/icon)",
            "e": [
              ".rsrc (size: 1024)"
            ],
            "i": "metadata/binary/resource::minimal-resources",
            "l": 2
          },
          {
            "c": 0.9200000166893005,
            "d": "Overlay exceeds one-third",
            "e": [
              "binary.overlay_ratio = 0.57"
            ],
            "i": "metadata/binary/layout::overlay-dominates-third",
            "l": 3
          },
          {
            "c": 0.949999988079071,
            "d": "links mscoree (CorDllMain)",
            "e": [
              "mscoree"
            ],
            "i": "metadata/dylib::mscoree",
            "l": 2
          },
          {
            "c": 0.949999988079071,
            "d": "PE version numbers look like IPv4",
            "e": [
              "5.1.1.0"
            ],
            "i": "metadata/package/versioning::version-number-ipv4-metadata",
            "l": 1
          },
          {
            "a": "T1036.005",
            "c": 0.9399999976158142,
            "d": "Two dotted-quad version strings",
            "e": [
              "5.1.1.0"
            ],
            "i": "objectives/evasion/masquerade/identity/fabricated::dotted-quad-version-pair",
            "l": 1
          }
        ],
        "sha": "5fd5b148b28012162e5cafada04ef8a60602dca606040785e4dff3a20ba2ba17",
        "path": "/data/samples/bad/datasets/various/VirusShare/VirusShare_9fcef6377530320a09e40ef0e77a022e",
        "type": "pe"
      }
    ],
    "tv": "7924e"
  }
}