{
  "ml": {
    "v": "7",
    "eng": "2.1.0",
    "lvl": -1,
    "conf": 0,
    "mods": [
      {
        "cls": 0,
        "raw": 0.0023489993,
        "rte": "az",
        "prob": 0.0023489993
      }
    ],
    "prob": 0.0023489993,
    "files": [
      {
        "id": 0,
        "lvl": -1,
        "conf": 0,
        "prob": 0.002348999259993434,
        "type": "7z"
      },
      {
        "id": 1,
        "lvl": -1,
        "conf": 0,
        "prob": 0.00032491484307684004,
        "type": "pe"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-06-21T18:55:13Z"
  },
  "path": "Windows ⁇⁇⁇⁇⁇!.7z",
  "raw": {
    "files": [
      {
        "id": 0,
        "mol": "O(Er)H(Os)",
        "sha": "6792453dfe6b1eef4179acdc7102e9739e7b02763a39ed1cad9430aeeaa5e237",
        "path": "Windows ⁇⁇⁇⁇⁇!.7z",
        "risk": 2,
        "size": 323618,
        "type": "7z",
        "facts": {
          "metrics": {
            "file": {
              "size": 323618.0,
              "entropy": 8.0,
              "size_bytes": 323618.0
            },
            "binary": {
              "overall_entropy": 8.0
            }
          }
        },
        "traits": [
          {
            "id": "micro-behaviors/fs/path/extension::dll-dup",
            "crit": 2,
            "desc": ".dll extension reference",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "micro-behaviors/os/callback/dda::line-dda",
            "conf": 0.949999988079071,
            "crit": 3,
            "desc": "LineDDA graphics callback",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/path/extension::exe-dup",
            "crit": 1,
            "desc": ".exe extension reference",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "metadata/package/versioning::pe-fileversion-field",
            "conf": 0.699999988079071,
            "crit": 2,
            "desc": "PE FileVersion metadata field",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "metadata/package/versioning::pe-productversion-field",
            "conf": 0.699999988079071,
            "crit": 2,
            "desc": "PE ProductVersion metadata field",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "metadata/package/versioning::pe-version-resource",
            "conf": 0.800000011920929,
            "crit": 2,
            "desc": "PE version resource structure",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "objectives/evasion/process/injection/callback::enum-fonts-callback",
            "atk": "T1106",
            "mbc": "E1106",
            "conf": 0.6499999761581421,
            "crit": 3,
            "desc": "EnumFonts callback shellcode execution API",
            "from": [
              {
                "file": 1
              }
            ]
          }
        ]
      },
      {
        "ctx": [
          {
            "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000:n=hu4J+",
            "ln": 0
          },
          {
            "b": "00000000000000000000ITZWx:+Z1\u002607.Ir]-iNZ0j@lx0i13uL)UUlzfvi99IrPpYz",
            "ln": 1008
          },
          {
            "b": "82%To:?}bp)1rmOq=^2$wt7WS004{x4f7nXsz9QK0rv\u0026EByY4+00015{Tg\u0026]dehe9:PbeN\u00262PU(0[2{l.V",
            "ln": 272706
          },
          {
            "b": "000000000000000000000+qAl00000oK!h9ggHB!u$frt3$xzu@:D0g(s6\u003e@9+brMr:#",
            "ln": 282096
          },
          {
            "b": "Bvyj\u003cz/L*TyH}K7wO:dTe[w^m000GgqGM.zzGP/cA::63m}DNHA+P2.vpB4:oLFoNk$2BcwN/?2A^mS+zGGA9y+xmmyYIYWmr\u0026rUB.25-AaAy0wM0eU004d.wPxNZe[w^m00",
            "ln": 282616
          },
          {
            "b": "00000000000000000000A@XBM1]$y80h/?i.p[%:0a2T%t:2fFec7ao0k{C?PA8\u003eQ00",
            "ln": 283632
          },
          {
            "b": "0rx1b0r7WM3Oy/E7YWiv0lk6:ybM7F0osa@0h8Zl04\u003c#DPP/BL[=m+={5DDurSE\u0026dw=Kb!^F$D\u003e\u003c]BGyg5}^o0bUWno8@]hx!PLN/-m@^o8@M7sCD[I0iL+^0q6LC0hktK^Cqef/7]y3\u003c:Ei:0e@\u0026\u002606?l\u003c0p)rs0jz)P05sL$0a[v]gxu)g",
            "ln": 286712
          },
          {
            "b": "00000000000000000000000000000000000000c40@@r3fAq964GDFeu\u0026QgS5c8XgKn",
            "ln": 399344
          },
          {
            "b": "0000000000007^QgYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006Xn[brp!0rxz91POJ",
            "ln": 399942
          },
          {
            "b": "n=S2{aohxw001?Q3ig8bpYLIozVBqFBPt[KBo25ove$cAwDhYg002E*zVBnEn=T5nrSCC^wDkHa001?Q3ig8bmGvc5yYF2DrSDXhASydXx-J5Kzu6Up001\u003eRe=WQahVL/qe=W^ffAr\u003cd002aY4GDIfnDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE004rBzVBhCx-JbMyYFkJx-JwTe=YC.CMqpP001$U3ig8bpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001\u003eRe=WQahVL/qe=W^ffAr\u003cd002)%82%WqlJz38z2!IPve$fBC(QOtve$cAwDhYg0043twDlYIoAm]\u0026o8}S=aok*",
            "ln": 400154
          },
          {
            "b": "yYE]Ax8?]i002:]6954kmGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up003WjzVBFKyYEDnx-I3",
            "ln": 400458
          },
          {
            "b": "yYErjASu7t002y!4GDIfpxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE004rBzVBhCx-JbMyYFkJ",
            "ln": 400538
          },
          {
            "b": "0000000000000000000003zyA7YTKoT2\u0026*o\u003erFn%))3zd{DFST05aJQyYBCnYeNX/MPk",
            "ln": 407536
          }
        ],
        "depth": 1,
        "facts": {
          "imp": [
            [
              "kernel32",
              "GetLastError"
            ],
            [
              "ntdll",
              "RtlEnumerateGenericTableLikeADirectory"
            ],
            [
              "user32",
              "ExcludeUpdateRgn"
            ],
            [
              "gdi32",
              "LineDDA"
            ],
            [
              "gdi32",
              "GetSystemPaletteEntries"
            ],
            [
              "gdi32",
              "RemoveFontMemResourceEx"
            ],
            [
              "gdi32",
              "GetNearestColor"
            ],
            [
              "gdi32",
              "GetMetaRgn"
            ],
            [
              "gdi32",
              "GetCurrentObject"
            ],
            [
              "gdi32",
              "GetStretchBltMode"
            ],
            [
              "gdi32",
              "PatBlt"
            ],
            [
              "gdi32",
              "GdiSetBatchLimit"
            ],
            [
              "gdi32",
              "StrokeAndFillPath"
            ],
            [
              "gdi32",
              "SetTextJustification"
            ],
            [
              "gdi32",
              "CreateBitmap"
            ],
            [
              "gdi32",
              "DeleteObject"
            ],
            [
              "gdi32",
              "Ellipse"
            ],
            [
              "gdi32",
              "EnumFontsA"
            ],
            [
              "gdi32",
              "EnumObjects"
            ],
            [
              "gdi32",
              "EqualRgn"
            ],
            [
              "gdi32",
              "FlattenPath"
            ],
            [
              "gdi32",
              "GdiGetBatchLimit"
            ],
            [
              "gdi32",
              "ResizePalette"
            ],
            [
              "msimg32",
              "TransparentBlt"
            ],
            [
              "netapi32",
              "RxNetAccessSetInfo"
            ],
            [
              "comdlg32",
              "CommDlgExtendedError"
            ],
            [
              "oleaut32",
              "SafeArrayCreateVectorEx"
            ],
            [
              "mpr",
              "MultinetGetConnectionPerformanceW"
            ]
          ],
          "sec": [
            [
              ".text",
              1024,
              281088,
              6.28,
              "r-x"
            ],
            [
              ".rdata",
              282112,
              1536,
              3.84,
              "r--"
            ],
            [
              ".data",
              283648,
              115712,
              6.21,
              "rw-"
            ],
            [
              ".rsrc",
              399360,
              8192,
              6.29,
              "rw-"
            ],
            [
              ".reloc",
              407552,
              1536,
              1.46,
              "r--"
            ]
          ],
          "metrics": {
            "pe": {
              "checksum": 0.0,
              "icon_count": 2.0,
              "has_manifest": 1.0,
              "checksum_valid": 0.0,
              "resource_count": 4.0,
              "has_version_info": 1.0,
              "checksum_stripped": 1.0,
              "computed_checksum": 454413.0,
              "reloc_overhang_bytes": 1284.0,
              "reloc_overhang_ratio": 0.84,
              "bss_like_section_count": 0.0,
              "section_overflow_count": 0.0,
              "misaligned_section_count": 0.0,
              "version.identity_entropy": 4.62,
              "base_relocation_block_count": 4.0,
              "base_relocation_entry_count": 108.0,
              "version.identity_symbol_ratio": 0.0
            },
            "file": {
              "size": 409088.0,
              "entropy": 6.24,
              "size_bytes": 409088.0
            },
            "binary": {
              "is_pie": 0.0,
              "code_entropy": 6.28,
              "data_entropy": 6.22,
              "string_count": 95.0,
              "overall_entropy": 6.24,
              "entropy_variance": 3.69,
              "avg_string_length": 14.18,
              "max_string_length": 73.0,
              "code_to_data_ratio": 0.69,
              "string_length_stddev": 10.76,
              "largest_section_ratio": 0.69,
              "sentence_string_count": 4.0,
              "sentence_string_ratio": 0.04,
              "high_entropy_string_count": 0.0
            },
            "imports": {
              "count": 28.0
            },
            "sections": {
              "count": 5.0,
              "code_size": 281088.0,
              "entropy_max": 6.29,
              "entropy_mean": 4.82,
              "name_entropy": 3.21,
              "writable_count": 2.0,
              "executable_count": 1.0,
              "nonstandard_count": 0.0,
              "executable_writable_count": 0.0
            },
            "dependencies": {
              "count": 9.0
            }
          }
        },
        "id": 1,
        "mol": "O(Er)H(Os)",
        "path": "Windows ⁇⁇⁇⁇⁇!.7z!!Windows ⁇⁇⁇⁇⁇!.exe",
        "risk": 2,
        "sha": "109db6a48739664011a81b4a2fd4af949676febde2692bc630e864336d11c06c",
        "size": 409088,
        "traits": [
          {
            "id": "metadata/package/versioning::pe-fileversion-field",
            "conf": 0.699999988079071,
            "crit": 2,
            "desc": "PE FileVersion metadata field",
            "spans": [
              [
                400222,
                11
              ]
            ]
          },
          {
            "id": "micro-behaviors/fs/path/extension::dll-dup",
            "crit": 2,
            "desc": ".dll extension reference",
            "spans": [
              [
                282632,
                4
              ]
            ]
          },
          {
            "id": "metadata/package/versioning::pe-version-resource",
            "conf": 0.800000011920929,
            "crit": 2,
            "desc": "PE version resource structure",
            "spans": [
              [
                399958,
                15
              ]
            ]
          },
          {
            "id": "metadata/package/versioning::pe-productversion-field",
            "conf": 0.699999988079071,
            "crit": 2,
            "desc": "PE ProductVersion metadata field",
            "spans": [
              [
                400334,
                14
              ]
            ]
          },
          {
            "id": "micro-behaviors/os/callback/dda::line-dda",
            "conf": 0.949999988079071,
            "crit": 3,
            "desc": "LineDDA graphics callback",
            "spans": [
              [
                286728,
                7
              ]
            ]
          },
          {
            "id": "objectives/evasion/process/injection/callback::enum-fonts-callback",
            "atk": "T1106",
            "mbc": "E1106",
            "conf": 0.6499999761581421,
            "crit": 3,
            "desc": "EnumFonts callback shellcode execution API",
            "spans": [
              [
                286784,
                10
              ]
            ]
          },
          {
            "id": "micro-behaviors/fs/path/extension::exe-dup",
            "crit": 1,
            "desc": ".exe extension reference",
            "spans": [
              [
                400309,
                4
              ]
            ]
          }
        ],
        "type": "pe"
      }
    ],
    "rev": "1f35f",
    "v": "8"
  }
}