{ "ml": { "v": "7", "eng": "2.11.0-beta.0", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.00006195903, "rte": "az", "prob": 0.00006195903 }, { "cls": 0, "raw": 0.02722638, "rte": "az/native", "prob": 0.02722638 }, { "cls": 0, "raw": 0.022122592, "rte": "az/pe", "prob": 0.022122592 } ], "prob": 0.00006195903, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.00006195902824401855, "type": "pe" } ], "version": "v18.18", "analyzed_at": "2026-09-17T17:17:30Z" }, "path": "Virus.Hijack_Trojan.GenericKDZ.105924_593.vir", "raw": { "v": "8", "files": [ { "id": 0, "ctx": [ { "b": "j?i9/j6%GZiTEnOiUr\u0026Zi^Ah\u0026iZCkZi\u0026KQui\u003cye$i*?EPi]INFiX8pekpW*n4\u003ew.UkpW*jpB^I74\u003ew.IjQS?MjP^nMjSt%Mj-q{1j.DuSj+251j:eFSjX)UmjU4Qh4\u003ew.U4\u003ew.U4\u003ew.U4\u003ew.U4\u003ew.U4\u003ew.U4\u003ew.U4\u003ew.U4\u003ew.U4\u003ew.U4\u003ew.U4\u003ew.U4\u003ew.U4\u003ew.U4\u003ew.U4\u003ew.U4\u003ew.U4\u003ew.U4\u003ew.U4\u003ew.U4\u003ew.U4\u003ew.U4\u003ew.U4\u003ew.U4\u003ew.U4\u003ew.U4\u003ew.U4\u003ew.U4\u003ew.U4\u003ew.U4\u003ew.U4\u003ew.U4\u003ew.", "ln": 42533 }, { "b": "g.h8Ug.h8Ug.h8Ug.h8Ug.h8Ug.h8Ug.h8Ug.h8Ug.h8Ug.h8Ug.h8Ug.h8Ug.h8Ug.h8Ug.h8Ug.h8Uu$R/x6HV?fCRsqmvm+r2lVc0\u003cs71*Ip+LyL6J\u003eP7vJ=aPvp9zyDlS/rtwD#JrEmbJ6KTT1saay\u003ctyM/@k[wu?szQxCq7(o}6KUl:6LP%Ll1g6-B.+r8kREIhrXF6lm%!0Fm\u003eLf[kZMYY8Z4W*l3(1r8EV}]BY-li6Niw]s71Hz6NJkjCu]U\u003cDTu}Nvj}*HD}[@\u003eCr*BS8+:^tu}L068+::xCUnAuDTghV8:!dmEoQCW8^NhOAsWs#BWDKwBZeAj6KtP.CRr=iu}+6lzz8hUCu]U\u003cDTu}NvgK\u003egg.j5ns72fFqexP7BZ5Dxwjyb^6N@S0rEvK$6L{fOmRUFfg*-+0rEvK$6LZ6Lqge*:ty6BpBZ5DxwjybLEpkV=mTX3VkRD!xvM+8T2o(@!q!xx3s71*I6KTu]r=gDI6KTT1s8Ie/9u$@gszyDAq6MD@tyxU2s9(C[szyDAq6MD{t6\u003c1Y6M#(VmLwBDvM+8T2o(@!q!xx3s71*I6KTu]r=gDI6KTT1s8Ie/9s\u0026S@87F-gwmFw-m}@n[m}$Lus9\u003erUoN/xCrEm5Ks$:]xrEDw[szyDAq6MD+qdAvGkRE1/l$POJkXrA76HCickXzPFt5lPzmRUFf6IIbop+Mx{s-3]J7+Y9mqePGZ7+XB0mTX3VkO5i.qePGZ7+XT7kM", "ln": 43460 } ], "mol": "Md", "sha": "6941c9600a436fe0c34e3dbbb0bb91e3421da111d6ec318e3aa6f438cfc935c0", "path": "Virus.Hijack_Trojan.GenericKDZ.105924_593.vir", "risk": 1, "size": 96360, "type": "pe", "facts": { "imp": [ [ "ole32", "CoCreateInstance" ], [ "ole32", "CLSIDFromString" ], [ "ole32", "CoInitialize" ], [ "ole32", "CoUninitialize" ], [ "oleaut32", "SysAllocString" ], [ "wininet", "DeleteUrlCacheEntry" ], [ "wininet", "FindFirstUrlCacheEntryA" ], [ "wininet", "FindNextUrlCacheEntryA" ], [ "kernel32", "ExitProcess" ], [ "kernel32", "ExpandEnvironmentStringsA" ], [ "kernel32", "GetCommandLineA" ], [ "kernel32", "GetComputerNameA" ], [ "kernel32", "GetCurrentProcessId" ], [ "kernel32", "GetCurrentThreadId" ], [ "kernel32", "GetExitCodeThread" ], [ "kernel32", "GetFileSize" ], [ "kernel32", "GetModuleFileNameA" ], [ "kernel32", "GetModuleHandleA" ], [ "kernel32", "CloseHandle" ], [ "kernel32", "GetProcAddress" ], [ "kernel32", "GetSystemDirectoryA" ], [ "kernel32", "GetTempPathA" ], [ "kernel32", "GetTickCount" ], [ "kernel32", "GetVersion" ], [ "kernel32", "GetVersionExA" ], [ "kernel32", "GetWindowsDirectoryA" ], [ "kernel32", "GlobalMemoryStatus" ], [ "kernel32", "CopyFileA" ], [ "kernel32", "InterlockedIncrement" ], [ "kernel32", "IsBadReadPtr" ], [ "kernel32", "IsBadWritePtr" ], [ "kernel32", "LoadLibraryA" ], [ "kernel32", "LocalAlloc" ], [ "kernel32", "LocalFree" ], [ "kernel32", "OpenMutexA" ], [ "kernel32", "CreateFileA" ], [ "kernel32", "ReadFile" ], [ "kernel32", "RtlUnwind" ], [ "kernel32", "SetFilePointer" ], [ "kernel32", "CreateMutexA" ], [ "kernel32", "Sleep" ], [ "kernel32", "TerminateProcess" ], [ "kernel32", "VirtualQuery" ], [ "kernel32", "CreateProcessA" ], [ "kernel32", "WaitForSingleObject" ], [ "kernel32", "WideCharToMultiByte" ], [ "kernel32", "WinExec" ], [ "kernel32", "WriteFile" ], [ "kernel32", "lstrlenA" ], [ "kernel32", "lstrlenW" ], [ "kernel32", "CreateThread" ], [ "kernel32", "DeleteFileA" ], [ "user32", "GetWindowTextA" ], [ "user32", "GetWindowRect" ], [ "user32", "FindWindowA" ], [ "user32", "GetWindow" ], [ "user32", "GetClassNameA" ], [ "user32", "SetFocus" ], [ "user32", "GetForegroundWindow" ], [ "user32", "LoadCursorA" ], [ "user32", "LoadIconA" ], [ "user32", "SetTimer" ], [ "user32", "RegisterClassA" ], [ "user32", "MessageBoxA" ], [ "user32", "GetMessageA" ], [ "user32", "GetWindowLongA" ], [ "user32", "SetWindowLongA" ], [ "user32", "CreateDesktopA" ], [ "user32", "SetThreadDesktop" ], [ "user32", "GetThreadDesktop" ], [ "user32", "TranslateMessage" ], [ "user32", "DispatchMessageA" ], [ "user32", "SendMessageA" ], [ "user32", "PostQuitMessage" ], [ "user32", "ShowWindow" ], [ "user32", "CreateWindowExA" ], [ "user32", "DestroyWindow" ], [ "user32", "MoveWindow" ], [ "user32", "DefWindowProcA" ], [ "user32", "CallWindowProcA" ], [ "gdi32", "GetStockObject" ], [ "gdi32", "SetBkColor" ], [ "gdi32", "SetTextColor" ], [ "gdi32", "CreateBrushIndirect" ], [ "gdi32", "CreateFontA" ], [ "advapi32", "GetUserNameA" ], [ "advapi32", "RegCreateKeyExA" ], [ "advapi32", "RegCloseKey" ], [ "advapi32", "RegOpenKeyExA" ], [ "advapi32", "RegQueryValueExA" ], [ "advapi32", "RegSetValueExA" ], [ "advapi32", "GetSecurityInfo" ], [ "advapi32", "SetSecurityInfo" ], [ "advapi32", "SetEntriesInAclA" ], [ "crtdll", "GetMainArgs" ], [ "crtdll", "sleep" ], [ "crtdll", "stricmp" ], [ "crtdll", "atoi" ], [ "crtdll", "exit" ], [ "crtdll", "memcpy" ], [ "crtdll", "memset" ], [ "crtdll", "printf" ], [ "crtdll", "raise" ], [ "crtdll", "rand" ], [ "crtdll", "signal" ], [ "crtdll", "sprintf" ], [ "crtdll", "srand" ], [ "crtdll", "sscanf" ], [ "crtdll", "strcat" ], [ "crtdll", "strchr" ], [ "crtdll", "strncmp" ], [ "crtdll", "vsprintf" ], [ "msvcrt", "memchr" ] ], "sec": [ [ ".idata", 1024, 32460, 7.2, "rwx" ], [ ".bss", 0, 0, 0.0, "rw-" ], [ ".data", 33792, 12752, 5.9, "rw-" ], [ ".idata", 46592, 3748, 5.15, "rw-" ], [ ".kofbl", 51200, 512, 2.34, "r-x" ], [ ".reloc", 51712, 4608, 5.29, "rwx" ], [ ".rsrc", 56320, 1024, 5.33, "r--" ], [ ".data", 57344, 7168, 4.72, "r--" ], [ ".rsrc", 64512, 512, 5.82, "r--" ], [ ".idata", 65024, 512, 4.91, "r--" ], [ ".idata", 65536, 512, 4.82, "r--" ], [ ".idata", 66048, 1024, 5.02, "r--" ], [ ".reloc", 67072, 3584, 4.71, "r-x" ], [ ".text", 70656, 4096, 4.6, "r--" ] ], "metrics": { "pe": { "checksum": 0, "timestamp": 537510153, "image_size": 245760, "has_overlay": 1, "overlay_end": 96360, "headers_size": 1024, "overlay_size": 21608, "checksum_valid": 0, "file_alignment": 512, "overlay_offset": 74752, "dos_stub_zeroed": 1, "overlay_padding": 22824, "checksum_stripped": 1, "computed_checksum": 117817, "dos_stub_modified": 1, "headers_size_ratio": 0.01, "prose_section_count": 3, "bss_like_section_count": 0, "section_overflow_count": 0, "misaligned_section_count": 0, "entry_in_nonstandard_section": 1, "declared_data_directory_count": 2, "executable_prose_section_count": 1, "directory_section_mismatch_count": 1 }, "file": { "size": 96360, "entropy": 6.52 }, "binary": { "is_pie": 0, "has_overlay": 1, "code_entropy": 6.71, "data_entropy": 5.73, "overlay_size": 21608, "string_count": 563, "overlay_ratio": 0.22, "overlay_entropy": 3.53, "entropy_variance": 1.07, "avg_string_length": 49.61, "max_string_length": 585, "peak_region_bytes": 18432, "code_to_data_ratio": 0.71, "peak_region_entropy": 7.21, "string_length_stddev": 55.71, "largest_section_ratio": 0.34, "sentence_string_count": 256, "sentence_string_ratio": 0.45, "high_entropy_string_count": 0 }, "imports": { "count": 113 }, "sections": { "count": 14, "code_size": 41164, "entropy_max": 7.2, "entropy_mean": 5.06, "name_entropy": 3.49, "writable_count": 5, "executable_count": 4, "nonstandard_count": 1, "executable_writable_count": 2 }, "consistency": { "extension_content_mismatch": 1, "extension_content_mismatch.binary_as_unknown": 1 }, "dependencies": { "count": 9 } } }, "traits": [ { "id": "metadata/encoded-payload/xor", "conf": 0.9, "crit": 3, "desc": "Encoded content decoded: xor", "spans": [ [ 42597, 39 ], [ 43524, 46 ], [ 43590, 46 ], [ 43648, 46 ], [ 43718, 41 ], [ 43758, 40 ], [ 43820, 46 ], [ 43883, 46 ] ] } ] } ] } }