{
  "ml": {
    "v": "5",
    "fs": [
      {
        "id": 0,
        "prob": 0.8251519203186035,
        "class": 0,
        "threshold": 0.9987763166427612
      }
    ],
    "prob": 0.8251519,
    "class": 0,
    "level": 3,
    "models": [
      {
        "m": "az",
        "prob": 0.8251519,
        "class": 0
      },
      {
        "m": "az/native",
        "prob": 0.2392638,
        "class": 0
      },
      {
        "m": "az/pe",
        "prob": 0.000115273775,
        "class": 0
      }
    ],
    "version": "v17.17",
    "threshold": 0.9987763,
    "analyzed_at": "2026-05-31T03:55:56Z"
  },
  "path": "6b46b78cb214984dc682b8a7155dc4dbafde40f2413de71a5aabd7896c0d5464.dll",
  "raw": {
    "v": "5",
    "fs": [
      {
        "f": "Md₂(BiSi)",
        "x": 5,
        "ff": {
          "i": [
            [
              "mscoree",
              "CorDllMain"
            ]
          ],
          "m": {
            "pe": {
              "checksum": 43016.0,
              "checksum_valid": 1.0,
              "resource_count": 1.0,
              "has_version_info": 1.0,
              "computed_checksum": 43016.0,
              "bss_like_section_count": 0.0,
              "section_overflow_count": 0.0,
              "misaligned_section_count": 0.0,
              "base_relocation_block_count": 1.0,
              "base_relocation_entry_count": 1.0
            },
            "file": {
              "size": 19744.0,
              "entropy": 6.78,
              "size_bytes": 19744.0
            },
            "binary": {
              "is_pie": 1.0,
              "has_overlay": 1.0,
              "code_entropy": 5.44,
              "overlay_size": 11552.0,
              "string_count": 265.0,
              "overlay_ratio": 0.59,
              "overlay_entropy": 7.36,
              "entropy_variance": 4.8,
              "avg_string_length": 15.4,
              "max_string_length": 145.0,
              "code_to_data_ratio": 1.0,
              "string_length_stddev": 13.42,
              "largest_section_ratio": 0.31,
              "sentence_string_count": 17.0,
              "sentence_string_ratio": 0.06,
              "high_entropy_string_count": 0.0
            },
            "imports": {
              "count": 1.0
            },
            "sections": {
              "count": 3.0,
              "code_size": 6144.0,
              "entropy_max": 5.44,
              "entropy_mean": 2.81,
              "name_entropy": 3.03,
              "writable_count": 0.0,
              "executable_count": 1.0,
              "nonstandard_count": 0.0,
              "executable_writable_count": 0.0
            },
            "dependencies": {
              "count": 1.0
            }
          },
          "s": [
            [
              77,
              "u8",
              "!This program cannot be run in DOS mode."
            ],
            [
              376,
              "u8",
              ".text"
            ],
            [
              455,
              "u8",
              "@.reloc"
            ],
            [
              608,
              "u8",
              "lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.R"
            ],
            [
              765,
              "u8",
              "PADPADPP)6"
            ],
            [
              1144,
              "wide",
              "BTN_INSTALL"
            ],
            [
              1188,
              "wide",
              "BTN_REMOVE*"
            ],
            [
              1252,
              "wide",
              "BTN_YESO"
            ],
            [
              1310,
              "wide",
              "INSTALL_EULA_TXT¹"
            ],
            [
              1394,
              "wide",
              "TXT_BROWSER_HPĖ"
            ],
            [
              1464,
              "wide",
              "TXT_CANCEL_SCREEN_DIALOGƮ"
            ],
            [
              1548,
              "wide",
              "TXT_CONFIG_BELOWȰ"
            ],
            [
              1618,
              "wide",
              "TXT_ERROR_INSTALL"
            ],
            [
              1688,
              "wide",
              "TXT_GET_WEBEXPͱ"
            ],
            [
              1754,
              "wide",
              "TXT_INSTALL_AGREEϡ"
            ],
            [
              1834,
              "wide",
              "TXT_INSTALL_COMPLETEҐ"
            ],
            [
              1922,
              "wide",
              "TXT_INSTALL_SUCCESSӟ"
            ],
            [
              2004,
              "wide",
              "TXT_NO_PROTECT"
            ],
            [
              2078,
              "wide",
              "TXT_READ_WC"
            ],
            [
              2138,
              "wide",
              "TXT_RESTORE_OPTION"
            ],
            [
              2212,
              "wide",
              "TXT_SET_HP"
            ],
            [
              2268,
              "wide",
              "TXT_SET_SE"
            ],
            [
              2316,
              "wide",
              "TXT_SORRY_TO_GO"
            ],
            [
              2400,
              "wide",
              "TXT_UNINSTALL_OPTION"
            ],
            [
              2492,
              "wide",
              "TXT_VALUE_PRIVACY"
            ],
            [
              2568,
              "wide",
              "TXT_WC_PROTECTS"
            ],
            [
              2822,
              "u8",
              "EULA"
            ],
            [
              5336,
              "u8",
              "BSJB"
            ],
            [
              5709,
              "u8",
              "\u003cModule\u003e"
            ],
            [
              5718,
              "u8",
              "mscorlib"
            ],
            [
              5727,
              "u8",
              "System.Reflection"
            ],
            [
              5745,
              "u8",
              "AssemblyTitleAttribute"
            ],
            [
              5768,
              "u8",
              ".ctor"
            ],
            [
              5774,
              "u8",
              "AssemblyDescriptionAttribute"
            ],
            [
              5803,
              "u8",
              "AssemblyCompanyAttribute"
            ],
            [
              5828,
              "u8",
              "AssemblyProductAttribute"
            ],
            [
              5853,
              "u8",
              "AssemblyCopyrightAttribute"
            ],
            [
              5880,
              "u8",
              "AssemblyTrademarkAttribute"
            ],
            [
              5907,
              "u8",
              "AssemblyFileVersionAttribute"
            ],
            [
              5936,
              "u8",
              "WebCompanionInstaller.resources.dll"
            ],
            [
              5972,
              "u8",
              "WebCompanionInstaller.resources"
            ],
            [
              6010,
              "u8",
              "WebCompanionInstaller.Localization.Resource.ja-JP.resources"
            ],
            [
              6136,
              "u8",
              "WebCompanionInstaller"
            ],
            [
              6169,
              "u8",
              "Copyright"
            ],
            [
              6181,
              "u8",
              "2015"
            ],
            [
              6270,
              "u8",
              "mscoree.dll"
            ],
            [
              6750,
              "wide",
              "VS_VERSION_INFO"
            ],
            [
              6842,
              "wide",
              "VarFileInfo"
            ],
            [
              6874,
              "wide",
              "Translation"
            ],
            [
              6910,
              "wide",
              "StringFileInfo"
            ],
            [
              6970,
              "wide",
              "FileDescription"
            ],
            [
              7004,
              "wide",
              "WebCompanionInstaller"
            ],
            [
              7054,
              "wide",
              "FileVersion"
            ],
            [
              7102,
              "wide",
              "InternalName"
            ],
            [
              7128,
              "wide",
              "WebCompanionInstaller.resources.dll"
            ],
            [
              7206,
              "wide",
              "LegalCopyright"
            ],
            [
              7236,
              "wide",
              "Copyright ©  2015"
            ],
            [
              7278,
              "wide",
              "OriginalFilename"
            ],
            [
              7390,
              "wide",
              "ProductName"
            ],
            [
              7466,
              "wide",
              "ProductVersion"
            ],
            [
              7518,
              "wide",
              "Assembly Version"
            ],
            [
              8394,
              "u8",
              "Western Cape1"
            ],
            [
              8417,
              "u8",
              "Durbanville1"
            ],
            [
              8439,
              "u8",
              "Thawte1"
            ],
            [
              8456,
              "u8",
              "Thawte Certification1"
            ],
            [
              8487,
              "u8",
              "Thawte Timestamping CA0"
            ],
            [
              8567,
              "u8",
              "Symantec Corporation100."
            ],
            [
              8597,
              "u8",
              "'Symantec Time Stamping Services CA - G20"
            ],
            [
              8998,
              "u8",
              "http://ocsp.thawte.com0"
            ],
            [
              9048,
              "u8",
              "80604"
            ],
            [
              9058,
              "u8",
              ".http://crl.thawte.com/ThawteTimestampingCA.crl0"
            ],
            [
              9168,
              "u8",
              "TimeStamp-2048-10"
            ],
            [
              9492,
              "u8",
              "201229235959Z0b1"
            ],
            [
              9531,
              "u8",
              "Symantec Corporation1402"
            ],
            [
              9561,
              "u8",
              "+Symantec Time Stamping Services Signer - G40"
            ],
            [
              9991,
              "u8",
              "http://ts-ocsp.ws.symantec.com07"
            ],
            [
              10034,
              "u8",
              "+http://ts-aia.ws.symantec.com/tss-ca-g2.cer0\u003c"
            ],
            [
              10086,
              "u8",
              "50301"
            ],
            [
              10096,
              "u8",
              "+http://ts-crl.ws.symantec.com/tss-ca-g2.crl0("
            ],
            [
              10166,
              "u8",
              "TimeStamp-2048-20"
            ],
            [
              10275,
              "u8",
              "b07x"
            ],
            [
              10594,
              "u8",
              "Symantec Corporation1"
            ],
            [
              10625,
              "u8",
              "Symantec Trust Network100."
            ],
            [
              10657,
              "u8",
              "'Symantec Class 3 SHA256 Code Signing CA0"
            ],
            [
              10716,
              "u8",
              "190329235959Z0e1"
            ],
            [
              10755,
              "u8",
              "Sliema1"
            ],
            [
              10789,
              "u8",
              "Lavasoft Limited1"
            ],
            [
              10816,
              "u8",
              "Lavasoft Limited0"
            ],
            [
              11040,
              "u8",
              "0yiYT1"
            ],
            [
              11180,
              "u8",
              "http://sv.symcb.com/sv.crl0a"
            ],
            [
              11214,
              "u8",
              "Z0X0V"
            ],
            [
              11243,
              "u8",
              "https://d.symcb.com/cps0%"
            ],
            [
              11282,
              "u8",
              "https://d.symcb.com/rpa0"
            ],
            [
              11339,
              "u8",
              "K0I0"
            ],
            [
              11356,
              "u8",
              "http://sv.symcd.com0\u0026"
            ],
            [
              11389,
              "u8",
              "http://sv.symcb.com/sv.crt0"
            ],
            [
              11828,
              "u8",
              "VeriSign, Inc.1"
            ],
            [
              11853,
              "u8",
              "VeriSign Trust Network1:08"
            ],
            [
              11885,
              "u8",
              "1(c) 2006 VeriSign, Inc. - For authorized use only1E0C"
            ],
            [
              11945,
              "u8",
              "\u003cVeriSign Class 3 Public Primary Certification Authority - G50"
            ],
            [
              12025,
              "u8",
              "231209235959Z0"
            ],
            [
              12499,
              "u8",
              "http://s2.symcb.com0"
            ],
            [
              12546,
              "u8",
              "e0c0a"
            ],
            [
              12580,
              "u8",
              "http://www.symauth.com/cps0("
            ],
            [
              12622,
              "u8",
              "http://www.symauth.com/rpa00"
            ],
            [
              12667,
              "u8",
              "http://s1.symcb.com/pca3-g5.crl0"
            ],
            [
              12771,
              "u8",
              "SymantecPKI-1-5670"
            ],
            [
              12849,
              "u8",
              "3130"
            ],
            [
              13231,
              "u8",
              "'Symantec Class 3 SHA256 Code Signing CA"
            ],
            [
              13671,
              "u8",
              "1zNS4"
            ],
            [
              13777,
              "u8",
              "'Symantec Time Stamping Services CA - G2"
            ],
            [
              14059,
              "u8",
              "Z3XW"
            ],
            [
              14294,
              "u8",
              "N0L0"
            ],
            [
              17763,
              "u8",
              "20190317051355Z"
            ],
            [
              17811,
              "u8",
              "Greater Manchester1"
            ],
            [
              17840,
              "u8",
              "Salford1"
            ],
            [
              17858,
              "u8",
              "COMODO CA Limited1,0*"
            ],
            [
              17885,
              "u8",
              "#COMODO SHA-256 Time Stamping Signer"
            ],
            [
              18011,
              "u8",
              "Salt Lake City1"
            ],
            [
              18036,
              "u8",
              "The USERTRUST Network1!0"
            ],
            [
              18068,
              "u8",
              "http://www.usertrust.com1"
            ],
            [
              18103,
              "u8",
              "UTN-USERFirst-Object0"
            ],
            [
              18127,
              "u8",
              "151231000000Z"
            ],
            [
              18142,
              "u8",
              "190709184036Z0"
            ],
            [
              18256,
              "u8",
              "#COMODO SHA-256 Time Stamping Signer0"
            ],
            [
              18728,
              "u8",
              "1http://crl.usertrust.com/UTN-USERFirst-Object.crl05"
            ],
            [
              18808,
              "u8",
              "http://ocsp.usertrust.com0"
            ],
            [
              19255,
              "u8",
              "UTN-USERFirst-Object"
            ],
            [
              19356,
              "u8",
              "190317051355Z0+"
            ]
          ],
          "v": {
            "file.stem": "6b46b78cb214984dc682b8a7155dc4dbafde40f2413de71a5aabd7896c0d5464",
            "pe.imphash": "dae02f32a21e03ce65412f6e56942daa",
            "pe.machine": "i386",
            "pe.subsystem": "windows_cui",
            "pe.timestamp": 1552799405,
            "file.basename": "6b46b78cb214984dc682b8a7155dc4dbafde40f2413de71a5aabd7896c0d5464.dll",
            "pe.image_base": 4194304,
            "pe.image_size": 32768,
            "pe.machine_id": 332,
            "pe.os_version": "4.0",
            "pe.version.os": "unknown",
            "pe.entry_point": 13966,
            "pe.headers_size": 512,
            "pe.version.type": "dll",
            "pe.entry_section": ".text",
            "pe.subsystem_raw": 3,
            "pe.clr.is_il_only": 1,
            "pe.file_alignment": 512,
            "pe.cert_table_size": 11552,
            "pe.image_hash.sha1": "282e4bd940019d1896cc236be9e4174823a35ee1",
            "pe.image_hash.sha256": "96fe7b1f6694e2ffb898c821d5f554fbdfe69df0e2e278f554a4255e53050df4",
            "pe.image_hash.sha384": "fab2ddfb09645e84baf9c8dba059acfcffce216c14e46e7a947b489d0f5408d87d4d5a8e31aad9c33941f2be78d03396",
            "pe.image_hash.sha512": "69164de4fb153df788607e0ed8a72fb7188fb6f3b35761a6c1c8bff0529d0af6a254fbac9bae3e79fb36aa5f197c716c6da1f1f888412202dd823531119427c4",
            "pe.resource_types[0]": "RT_VERSION",
            "pe.section_alignment": 8192,
            "pe.subsystem_version": "4.0",
            "pe.version.copyright": "Copyright ©  2015",
            "pe.characteristics[0]": "executable_image",
            "pe.characteristics[1]": "32bit_machine",
            "pe.characteristics[2]": "dll",
            "pe.characteristics_raw": 8450,
            "pe.clr.runtime_version": "2.5",
            "pe.version.description": "WebCompanionInstaller",
            "pe.linker_major_version": 8,
            "pe.signatures[0].issuer": "CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US",
            "pe.signatures[0].serial": "76ee7ef043821e76143e9510553389e1",
            "pe.version.file_version": "1.0.0.0",
            "pe.version.product_name": "WebCompanionInstaller",
            "pe.signatures[0].subject": "CN=Lavasoft Limited,O=Lavasoft Limited,L=Sliema,ST=Sliema,C=MT",
            "pe.version.internal_name": "WebCompanionInstaller.resources.dll",
            "pe.dll_characteristics[0]": "dynamic_base",
            "pe.dll_characteristics[1]": "nx_compat",
            "pe.dll_characteristics[2]": "no_seh",
            "pe.dll_characteristics[3]": "terminal_server_aware",
            "pe.signatures[0].verified": true,
            "pe.data_directories[0].rva": 13884,
            "pe.data_directories[1].rva": 16384,
            "pe.data_directories[2].rva": 8192,
            "pe.data_directories[3].rva": 24576,
            "pe.data_directories[4].rva": 8192,
            "pe.data_directories[5].rva": 8200,
            "pe.dll_characteristics_raw": 34112,
            "pe.number_of_rva_and_sizes": 16,
            "pe.signatures[0].not_after": "2019-03-29T23:59:59Z",
            "pe.version.product_version": "1.0.0.0",
            "pe.data_directories[0].name": "import",
            "pe.data_directories[0].size": 79,
            "pe.data_directories[1].name": "resource",
            "pe.data_directories[1].size": 912,
            "pe.data_directories[2].name": "certificate",
            "pe.data_directories[2].size": 11552,
            "pe.data_directories[3].name": "base_relocation",
            "pe.data_directories[3].size": 12,
            "pe.data_directories[4].name": "iat",
            "pe.data_directories[4].size": 8,
            "pe.data_directories[5].name": "clr_runtime_header",
            "pe.data_directories[5].size": 72,
            "pe.signatures[0].not_before": "2017-03-13T00:00:00Z",
            "pe.version.original_filename": "WebCompanionInstaller.resources.dll",
            "pe.coff.dos_header_pe_pointer": 128,
            "pe.signatures[0].nested.issuer": "CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US",
            "pe.signatures[0].nested.serial": "76ee7ef043821e76143e9510553389e1",
            "pe.base_relocations.block_count": 1,
            "pe.base_relocations.entry_count": 1,
            "pe.signatures[0].nested.subject": "CN=Lavasoft Limited,O=Lavasoft Limited,L=Sliema,ST=Sliema,C=MT",
            "pe.signatures[0].nested.verified": true,
            "pe.signatures[0].thumbprint_sha1": "b99c6f735653238eb611e1dab57eeb588d0fc8d4",
            "pe.base_relocations.padding_count": 1,
            "pe.signatures[0].cert_chain_depth": 4,
            "pe.signatures[0].digest_algorithm": "sha1",
            "pe.signatures[0].eku_code_signing": true,
            "pe.signatures[0].nested.not_after": "2019-03-29T23:59:59Z",
            "pe.signatures[0].signature_digest": "282e4bd940019d1896cc236be9e4174823a35ee1",
            "pe.signatures[0].nested.not_before": "2017-03-13T00:00:00Z",
            "pe.signatures[0].thumbprint_sha256": "da69984bbcd8b1874771dad74ea324069e82f7e7825d4eaa6716365bba957550",
            "pe.signatures[0].signature_algorithm": "sha256WithRSAEncryption",
            "pe.signatures[0].nested.thumbprint_sha1": "b99c6f735653238eb611e1dab57eeb588d0fc8d4",
            "pe.signatures[0].nested.cert_chain_depth": 2,
            "pe.signatures[0].nested.digest_algorithm": "sha256",
            "pe.signatures[0].nested.eku_code_signing": true,
            "pe.signatures[0].nested.signature_digest": "96fe7b1f6694e2ffb898c821d5f554fbdfe69df0e2e278f554a4255e53050df4",
            "pe.signatures[0].nested.thumbprint_sha256": "da69984bbcd8b1874771dad74ea324069e82f7e7825d4eaa6716365bba957550",
            "pe.signatures[0].nested.signature_algorithm": "sha256WithRSAEncryption",
            "pe.signatures[0].signature_digest_algorithm": "sha1",
            "pe.signatures[0].nested.signature_digest_algorithm": "sha256"
          },
          "id": "pe",
          "sc": [
            [
              ".text",
              512,
              6144,
              5.44,
              "r-x"
            ],
            [
              ".rsrc",
              6656,
              1024,
              2.9,
              "r--"
            ],
            [
              ".reloc",
              7680,
              512,
              0.08,
              "r--"
            ]
          ]
        },
        "id": 0,
        "sz": 19744,
        "ts": [
          {
            "c": 1.0,
            "d": ".NET assembly detected via BSJB CLR metadata signature",
            "e": [
              "BSJB at offset 0x14d8"
            ],
            "i": "metadata/dotnet/bsjb-signature",
            "l": 2,
            "el": [
              "0x14d8"
            ]
          },
          {
            "c": 1.0,
            "d": "Authenticode chain CN: Lavasoft Limited",
            "e": [
              "Lavasoft Limited"
            ],
            "i": "metadata/signed/unknown::lavasoft-limited",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "Signed by Lavasoft Limited",
            "e": [
              "Lavasoft Limited"
            ],
            "i": "metadata/signed/leaf::lavasoft-limited",
            "l": 3
          },
          {
            "c": 1.0,
            "d": "File is a compiled binary",
            "e": [
              "6b46b78cb214984dc682b8a7155dc4dbafde40f2413de71a5aabd7896c0d5464.dll"
            ],
            "i": "metadata/binary/framework::is-binary",
            "l": 1
          },
          {
            "c": 0.949999988079071,
            "d": "PE LegalCopyright field is populated",
            "e": [
              "Copyright ©  2015"
            ],
            "i": "metadata/package/versioning::pe-legal-copyright-present",
            "l": 1,
            "el": [
              "value:pe.version.copyright"
            ]
          },
          {
            "c": 0.699999988079071,
            "d": "Reflection method namespace token",
            "e": [
              "System.Reflection"
            ],
            "i": "objectives/anti-static/obfuscation/reflection/invoke::namespace-import",
            "l": 1,
            "el": [
              "0x165f"
            ]
          },
          {
            "c": 1.0,
            "d": ".NET Metadata Root (BSJB)",
            "e": [
              "BSJB"
            ],
            "i": "metadata/binary/framework::dotnet-metadata",
            "l": 2
          },
          {
            "c": 0.949999988079071,
            "d": "PE FileDescription field is populated",
            "e": [
              "WebCompanionInstaller"
            ],
            "i": "metadata/package/versioning::pe-file-description-present",
            "l": 1,
            "el": [
              "value:pe.version.description"
            ]
          },
          {
            "c": 0.6000000238418579,
            "d": "Copyright notice",
            "e": [
              "Copyright"
            ],
            "i": "metadata/package/license::copyright-word",
            "l": 2,
            "el": [
              "0x1819"
            ]
          },
          {
            "c": 0.9200000166893005,
            "d": "PE FileVersion resembles IPv4",
            "e": [
              "1.0.0.0"
            ],
            "i": "metadata/package/versioning::pe-file-version-ipv4-shape",
            "l": 1,
            "el": [
              "value:pe.version.file_version"
            ]
          },
          {
            "d": ".dll extension reference",
            "e": [
              ".dll"
            ],
            "i": "micro-behaviors/fs/path/extension::dll-dup",
            "l": 2,
            "el": [
              "0x1730"
            ]
          },
          {
            "c": 0.699999988079071,
            "d": "PE has few sections",
            "e": [
              "sections.count = 3.00"
            ],
            "i": "metadata/binary/layout::legacy-few-sections",
            "l": 2
          },
          {
            "c": 0.949999988079071,
            "d": "PE ProductName field is populated",
            "e": [
              "WebCompanionInstaller"
            ],
            "i": "metadata/package/versioning::pe-product-name-present",
            "l": 1,
            "el": [
              "value:pe.version.product_name"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "mscorlib reference",
            "e": [
              "mscorlib",
              "lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.R"
            ],
            "i": "metadata/lang/compiler/managed::mscorlib",
            "l": 2,
            "el": [
              "0x1656",
              "0x260"
            ]
          },
          {
            "c": 1.0,
            "d": "PE first resource is RT_VERSION",
            "e": [
              "RT_VERSION"
            ],
            "i": "metadata/binary/resource::pe-resource-version-first",
            "l": 2,
            "el": [
              "value:pe.resource_types[0]"
            ]
          },
          {
            "a": "T1027",
            "c": 0.9900000095367432,
            "d": "PE version resource text",
            "e": [
              "VS_VERSION_INFO"
            ],
            "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info",
            "l": 1,
            "m": "B0032",
            "el": [
              "0x1a5e"
            ]
          },
          {
            "a": "T1036.001",
            "c": 0.8399999737739563,
            "d": "Symantec timestamp string in overlay",
            "e": [
              "+Symantec Time Stamping Services Signer - G40"
            ],
            "i": "objectives/evasion/masquerade/binary::overlay-symantec-string",
            "l": 1,
            "el": [
              "0x2559"
            ]
          },
          {
            "c": 0.699999988079071,
            "d": "PE has many readable strings",
            "e": [
              "binary.string_count = 265.00"
            ],
            "i": "metadata/binary/layout::many-readable-strings",
            "l": 2
          },
          {
            "c": 0.8999999761581421,
            "d": "PE standard code/data section",
            "e": [
              ".text"
            ],
            "i": "metadata/binary/section/names::pe-code-data-standard-section",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "PE import table has exactly one entry",
            "e": [
              "imports.count = 1.00"
            ],
            "i": "metadata/binary/symbols/imports::single-import-raw",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Binary has 4 or fewer sections",
            "e": [
              "sections.count = 3.00"
            ],
            "i": "objectives/command-and-control/infrastructure/config::max-sections-4",
            "l": 1
          },
          {
            "c": 0.9200000166893005,
            "d": "PE ProductVersion resembles IPv4",
            "e": [
              "1.0.0.0"
            ],
            "i": "metadata/package/versioning::pe-product-version-ipv4-shape",
            "l": 1,
            "el": [
              "value:pe.version.product_version"
            ]
          },
          {
            "c": 0.800000011920929,
            "d": "CompanyName field absent from PE version info",
            "e": [
              "field 'pe.version.company' does not exist"
            ],
            "i": "metadata/binary/anomaly/format::version-info-company-name-absent",
            "l": 1,
            "el": [
              "value:pe.version.company"
            ]
          },
          {
            "c": 0.8500000238418579,
            "d": "DLL filename extension present",
            "e": [
              "6b46b78cb214984dc682b8a7155dc4dbafde40f2413de71a5aabd7896c0d5464.dll"
            ],
            "i": "objectives/evasion/masquerade/dll/name::dll-basename",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "NO_SEH (SafeSEH not used)",
            "e": [
              "[dynamic_base, nx_compat, no_seh, terminal_server_aware]"
            ],
            "i": "metadata/hardening/mitigation::pe-no-seh",
            "l": 2,
            "el": [
              "value:pe.dll_characteristics"
            ]
          },
          {
            "a": "T1036.001",
            "c": 0.8600000143051147,
            "d": "USERTrust certificate string in overlay",
            "e": [
              "The USERTRUST Network1!0"
            ],
            "i": "objectives/evasion/masquerade/binary::overlay-usertrust-string",
            "l": 1,
            "el": [
              "0x4674"
            ]
          },
          {
            "c": 0.699999988079071,
            "d": "PE InternalName metadata field",
            "e": [
              "InternalName"
            ],
            "i": "metadata/package/versioning::pe-internalname-field",
            "l": 2,
            "el": [
              "0x1bbe"
            ]
          },
          {
            "c": 0.949999988079071,
            "d": "PE version info numeric fields present",
            "e": [
              "1.0.0.0"
            ],
            "i": "metadata/binary/anomaly/format::version-info-file-version-present",
            "l": 1,
            "el": [
              "value:pe.version.file_version"
            ]
          },
          {
            "c": 1.0,
            "d": "PE Authenticode signature verified metadata",
            "e": [
              "true"
            ],
            "i": "metadata/signed/certificate::pe-signature-verified-kv",
            "l": 2,
            "el": [
              "value:pe.signatures[0].verified"
            ]
          },
          {
            "a": "T1620",
            "c": 0.949999988079071,
            "d": "mscoree DLL string reference",
            "e": [
              "mscoree.dll"
            ],
            "i": "objectives/anti-static/obfuscation/payload/loader::mscoree-name-anywhere",
            "l": 1,
            "m": "B0032",
            "el": [
              "0x187e"
            ]
          },
          {
            "c": 0.699999988079071,
            "d": "PE OriginalFilename metadata field",
            "e": [
              "OriginalFilename"
            ],
            "i": "metadata/package/versioning::pe-originalfilename-field",
            "l": 2,
            "el": [
              "0x1c6e"
            ]
          },
          {
            "a": "T1036.001",
            "c": 0.8799999952316284,
            "d": "UTN USERFirst Object string in overlay",
            "e": [
              "UTN-USERFirst-Object",
              "1http://crl.usertrust.com/UTN-USERFirst-Object.crl05",
              "UTN-USERFirst-Object0"
            ],
            "i": "objectives/evasion/masquerade/binary::overlay-utn-object-string",
            "l": 1,
            "el": [
              "0x4b37",
              "0x4928",
              "0x46b7"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "SOCKS5 client greeting bytes",
            "e": [
              "05 01 00"
            ],
            "i": "micro-behaviors/communications/proxy/socks::socks5-version-greeting-bytes",
            "l": 1,
            "el": [
              "0x180f"
            ]
          },
          {
            "a": "T1036.001",
            "c": 0.8600000143051147,
            "d": "COMODO certificate string in overlay",
            "e": [
              "COMODO CA Limited1,0*"
            ],
            "i": "objectives/evasion/masquerade/binary::overlay-comodo-string",
            "l": 1,
            "el": [
              "0x45c2"
            ]
          },
          {
            "c": 1.0,
            "d": "PE binary has trailing overlay data",
            "e": [
              "binary.has_overlay = 1.00"
            ],
            "i": "metadata/binary/layout::has-overlay",
            "l": 3
          },
          {
            "a": "T1562.001",
            "c": 0.949999988079071,
            "d": "Regex component marker",
            "e": [
              "TXT_VALUE_PRIVACY"
            ],
            "i": "objectives/evasion/indicator-removal/cleanup::motw-removal-stream--rx-3",
            "l": 1,
            "m": "B0047",
            "el": [
              "0x9bc"
            ]
          },
          {
            "c": 1.0,
            "d": "DEP / NX enabled (NX_COMPAT)",
            "e": [
              "[dynamic_base, nx_compat, no_seh, terminal_server_aware]"
            ],
            "i": "metadata/hardening/mitigation::pe-dep",
            "l": 2,
            "el": [
              "value:pe.dll_characteristics"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "PE .reloc section presence",
            "e": [
              ".reloc"
            ],
            "i": "metadata/binary/section/names::reloc-section-presence",
            "l": 2
          },
          {
            "a": "T1027.009",
            "c": 0.8600000143051147,
            "d": ".NET ResourceReader payload access",
            "e": [
              "lSystem.Resources.ResourceReader, mscorlib, Version=2.0.…"
            ],
            "i": "micro-behaviors/data/embedded/payload/resource::dotnet-resource-reader",
            "l": 1,
            "el": [
              "0x260"
            ]
          },
          {
            "c": 1.0,
            "d": "ASLR enabled (DYNAMIC_BASE)",
            "e": [
              "[dynamic_base, nx_compat, no_seh, terminal_server_aware]"
            ],
            "i": "metadata/hardening/mitigation::pe-aslr",
            "l": 2,
            "el": [
              "value:pe.dll_characteristics"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "Regex component marker",
            "e": [
              "binary.overlay_ratio = 0.59"
            ],
            "i": "objectives/anti-static/obfuscation/control-flow/logic::bloated-low-density-malware-cond-5--inline-32080",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "PE ProductName metadata field",
            "e": [
              "ProductName"
            ],
            "i": "metadata/package/versioning::pe-productname-field",
            "l": 2,
            "el": [
              "0x1cde"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "PE resource section",
            "e": [
              ".rsrc"
            ],
            "i": "metadata/binary/section/names::pe-resource-section",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "PE standard runtime section",
            "e": [
              ".reloc"
            ],
            "i": "metadata/binary/section/names::pe-runtime-standard-section",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "Regex component marker",
            "e": [
              "StringFileInfo"
            ],
            "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7",
            "l": 1,
            "el": [
              "0x1afe"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "PE has under ten imports",
            "e": [
              "imports.count = 1.00"
            ],
            "i": "objectives/anti-static/pack/runtime::pe-import-count-under-10",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "PE with six or fewer imports",
            "e": [
              "imports.count = 1.00"
            ],
            "i": "metadata/binary/symbols/imports::pe-imports-max-six",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "PE checksum matches computed value",
            "e": [
              "pe.checksum_valid = 1.00"
            ],
            "i": "metadata/binary/layout::pe-checksum-valid",
            "l": 1
          },
          {
            "c": 0.9399999976158142,
            "d": "PE overlay exceeds thirty-five percent",
            "e": [
              "binary.overlay_ratio = 0.59"
            ],
            "i": "metadata/binary/layout::overlay-over-35pct",
            "l": 3
          },
          {
            "c": 0.8500000238418579,
            "d": "IPv4-like .NET assembly version",
            "e": [
              "Version=2.0.0.0"
            ],
            "i": "metadata/lang/compiler/managed::dotnet-ipv4-like-version",
            "l": 2,
            "el": [
              "0x260"
            ]
          },
          {
            "c": 0.699999988079071,
            "d": "PE FileDescription metadata field",
            "e": [
              "FileDescription"
            ],
            "i": "metadata/package/versioning::pe-filedescription-field",
            "l": 2,
            "el": [
              "0x1b3a"
            ]
          },
          {
            "a": "T1027",
            "c": 0.8399999737739563,
            "d": "VB6 PE with three sections",
            "e": [
              "sections.count = 3.00"
            ],
            "i": "objectives/anti-static/obfuscation/payload/string-sparse::three-section-vb6-layout",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.800000011920929,
            "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)",
            "e": [
              "pe.resource_count = 1.00"
            ],
            "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources",
            "l": 1
          },
          {
            "a": "T1105",
            "c": 0.800000011920929,
            "d": "Compact PE import table",
            "e": [
              "imports.count = 1.00"
            ],
            "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table",
            "l": 1,
            "m": "E1105"
          },
          {
            "c": 1.0,
            "d": ".NET BSJB metadata marker",
            "e": [
              "BSJB"
            ],
            "i": "metadata/binary/framework::bsjb-marker",
            "l": 1
          },
          {
            "a": "T1055",
            "c": 0.9200000166893005,
            "d": "Regex component marker",
            "e": [
              "imports.count = 1.00"
            ],
            "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571",
            "l": 1,
            "m": "C0041"
          },
          {
            "c": 0.9200000166893005,
            "d": "Overlay exceeds one-third",
            "e": [
              "binary.overlay_ratio = 0.59"
            ],
            "i": "metadata/binary/layout::overlay-dominates-third",
            "l": 3
          },
          {
            "c": 0.800000011920929,
            "d": "Tiny resource section (no version/icon)",
            "e": [
              ".rsrc (size: 1024)"
            ],
            "i": "metadata/binary/resource::minimal-resources",
            "l": 2
          },
          {
            "a": "T1027",
            "c": 0.8600000143051147,
            "d": "Long mixed-case identifiers cluster",
            "e": [
              "AssemblyTitleAttribute",
              "AssemblyCompanyAttribute",
              "AssemblyProductAttribute",
              "AssemblyCopyrightAttribute",
              "AssemblyDescriptionAttribute",
              "AssemblyTrademarkAttribute",
              "AssemblyFileVersionAttribute",
              "WebCompanionInstaller"
            ],
            "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers",
            "l": 1,
            "m": "B0032",
            "el": [
              "0x1671",
              "0x16ab",
              "0x16c4",
              "0x16dd",
              "0x168e",
              "0x16f8",
              "0x1713",
              "0x1730"
            ]
          },
          {
            "c": 0.949999988079071,
            "d": "links mscoree (CorDllMain)",
            "e": [
              "mscoree"
            ],
            "i": "metadata/dylib::mscoree",
            "l": 2,
            "el": [
              "1 symbols"
            ]
          },
          {
            "a": "T1036.005",
            "c": 0.9399999976158142,
            "d": "Two dotted-quad version strings",
            "e": [
              "1.0.0.0"
            ],
            "i": "objectives/evasion/masquerade/identity/fabricated::dotted-quad-version-pair",
            "l": 1,
            "el": [
              "value:pe.version.file_version"
            ]
          },
          {
            "c": 0.949999988079071,
            "d": "PE version numbers look like IPv4",
            "e": [
              "1.0.0.0"
            ],
            "i": "metadata/package/versioning::version-number-ipv4-metadata",
            "l": 1,
            "el": [
              "value:pe.version.file_version"
            ]
          }
        ],
        "sha": "6b46b78cb214984dc682b8a7155dc4dbafde40f2413de71a5aabd7896c0d5464",
        "path": "6b46b78cb214984dc682b8a7155dc4dbafde40f2413de71a5aabd7896c0d5464.dll",
        "type": "pe"
      }
    ],
    "tv": "52045"
  }
}