{
  "ml": {
    "v": "7",
    "eng": "2.11.0-beta.0",
    "lvl": -1,
    "conf": 0,
    "mods": [
      {
        "cls": 0,
        "raw": 0.000048091013,
        "rte": "az",
        "prob": 0.000048091013
      },
      {
        "cls": 0,
        "raw": 0.0052768984,
        "rte": "az/native",
        "prob": 0.0052768984
      },
      {
        "cls": 0,
        "raw": 0.019217819,
        "rte": "az/pe",
        "prob": 0.019217819
      }
    ],
    "prob": 0.000048091013,
    "files": [
      {
        "id": 0,
        "lvl": -1,
        "conf": 0,
        "prob": 0.00004809101301361807,
        "type": "pe"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-09-17T07:03:26Z"
  },
  "path": "Virus.Hijack_Gen.Variant.Ransom.Sodinokibi.66_2_1.vir",
  "raw": {
    "v": "8",
    "rev": "e86a6",
    "files": [
      {
        "id": 0,
        "sha": "6e95f086fd8f7992973990796e1ad82998c3a27744ef8ca4ef5db60e47896990",
        "path": "Virus.Hijack_Gen.Variant.Ransom.Sodinokibi.66_2_1.vir",
        "size": 196733,
        "type": "pe",
        "facts": {
          "imp": [
            [
              "msvbvm60",
              "CIcos"
            ],
            [
              "msvbvm60",
              "adj_fptan"
            ],
            [
              "msvbvm60",
              "vbaVarMove"
            ],
            [
              "msvbvm60",
              "vbaFreeVar"
            ],
            [
              "msvbvm60",
              "ORDINAL 588"
            ],
            [
              "msvbvm60",
              "vbaFreeVarList"
            ],
            [
              "msvbvm60",
              "vbaEnd"
            ],
            [
              "msvbvm60",
              "adj_fdiv_m64"
            ],
            [
              "msvbvm60",
              "vbaFreeObjList"
            ],
            [
              "msvbvm60",
              "adj_fprem1"
            ],
            [
              "msvbvm60",
              "vbaStrCat"
            ],
            [
              "msvbvm60",
              "vbaSetSystemError"
            ],
            [
              "msvbvm60",
              ""
            ],
            [
              "msvbvm60",
              "adj_fdiv_m32"
            ],
            [
              "msvbvm60",
              "vbaAryDestruct"
            ],
            [
              "msvbvm60",
              "ORDINAL 593"
            ],
            [
              "msvbvm60",
              "ORDINAL 594"
            ],
            [
              "msvbvm60",
              "vbaOnError"
            ],
            [
              "msvbvm60",
              "vbaObjSet"
            ],
            [
              "msvbvm60",
              "adj_fdiv_m16i"
            ],
            [
              "msvbvm60",
              "adj_fdivr_m16i"
            ],
            [
              "msvbvm60",
              "CIsin"
            ],
            [
              "msvbvm60",
              "vbaChkstk"
            ],
            [
              "msvbvm60",
              "vbaFileClose"
            ],
            [
              "msvbvm60",
              "EVENT_SINK_AddRef"
            ],
            [
              "msvbvm60",
              "vbaPutOwner3"
            ],
            [
              "msvbvm60",
              ""
            ],
            [
              "msvbvm60",
              "adj_fpatan"
            ],
            [
              "msvbvm60",
              "vbaRedim"
            ],
            [
              "msvbvm60",
              "vbaStrR8"
            ],
            [
              "msvbvm60",
              "EVENT_SINK_Release"
            ],
            [
              "msvbvm60",
              "ORDINAL 600"
            ],
            [
              "msvbvm60",
              "CIsqrt"
            ],
            [
              "msvbvm60",
              "EVENT_SINK_QueryInterface"
            ],
            [
              "msvbvm60",
              "v;aExceptHandler"
            ],
            [
              "msvbvm60",
              "adj_fprem"
            ],
            [
              "msvbvm60",
              "a^j_fdivr_m64"
            ],
            [
              "msvbvm60",
              "vbaFPException"
            ],
            [
              "msvbvm60",
              "vbaGetOwner3"
            ],
            [
              "msvbvm60",
              "vbaUbound"
            ],
            [
              "msvbvm60",
              "vbaStrVarVal"
            ],
            [
              "msvbvm60",
              "vbaVarCat"
            ],
            [
              "msvbvm60",
              "CIlog"
            ],
            [
              "msvbvm60",
              "vbaFileOpen"
            ],
            [
              "msvbvm60",
              "vbaNew2"
            ],
            [
              "msvbvm60",
              "ORDINAL 57914"
            ],
            [
              "msvbvm60",
              "vbaR8Str"
            ],
            [
              "msvbvm60",
              "adj_fdiv_m32i"
            ],
            [
              "msvbvm60",
              "adj_fdivr_m32i"
            ],
            [
              "msvbvm60",
              "vbaFreeStrList"
            ],
            [
              "msvbvm60",
              "adj_fdivr_m32"
            ],
            [
              "msvbvm60",
              "adj_fdiv_r"
            ],
            [
              "msvbvm60",
              "ORDINAL 100"
            ],
            [
              "msvbvm60",
              "vbaI4Var"
            ],
            [
              "msvbvm60",
              "vbaVarMod"
            ],
            [
              "msvbvm60",
              "CIatan"
            ],
            [
              "msvbvm60",
              "vbaStrMove"
            ],
            [
              "msvbvm60",
              "allmul"
            ],
            [
              "msvbvm60",
              "CItan"
            ],
            [
              "msvbvm60",
              "vbaFPInt"
            ],
            [
              "msvbvm60",
              "vbaUI1Var"
            ],
            [
              "msvbvm60",
              "CIexp"
            ],
            [
              "msvbvm60",
              "vbaFreeStr"
            ],
            [
              "msvbvm60",
              "vbaFreeObj"
            ]
          ],
          "sec": [
            [
              ".text",
              4096,
              176128,
              7.56,
              "r-x"
            ],
            [
              ".data",
              180224,
              15460864,
              0.82,
              "rw-"
            ],
            [
              ".rsrc",
              184320,
              4096,
              1.96,
              "r--"
            ]
          ],
          "metrics": {
            "pe": {
              "checksum": 235297,
              "timestamp": 1547296057,
              "image_size": 188416,
              "headers_size": 4096,
              "checksum_valid": 0,
              "file_alignment": 4096,
              "computed_checksum": 228050,
              "dos_stub_modified": 1,
              "bound_import_count": 1,
              "headers_size_ratio": 0.02,
              "prose_section_count": 0,
              "section_overlap_count": 2,
              "bss_like_section_count": 0,
              "section_overflow_count": 1,
              "misaligned_section_count": 0,
              "bound_imports_fingerprint": 1243922264,
              "declared_data_directory_count": 4,
              "executable_prose_section_count": 0,
              "directory_section_mismatch_count": 0
            },
            "file": {
              "size": 196733,
              "entropy": 7.15
            },
            "binary": {
              "is_pie": 0,
              "code_entropy": 7.56,
              "data_entropy": 0.82,
              "string_count": 320,
              "entropy_variance": 8.68,
              "avg_string_length": 15.73,
              "max_string_length": 753,
              "peak_region_bytes": 116736,
              "code_to_data_ratio": 0.01,
              "peak_region_entropy": 7.76,
              "string_length_stddev": 51.42,
              "largest_section_ratio": 78.59,
              "sentence_string_count": 15,
              "sentence_string_ratio": 0.05,
              "high_entropy_string_count": 0
            },
            "imports": {
              "count": 64
            },
            "sections": {
              "count": 3,
              "code_size": 176128,
              "entropy_max": 7.56,
              "entropy_mean": 3.45,
              "name_entropy": 3.01,
              "writable_count": 1,
              "executable_count": 1,
              "nonstandard_count": 0,
              "executable_writable_count": 0
            },
            "consistency": {
              "extension_content_mismatch": 1,
              "extension_content_mismatch.binary_as_unknown": 1
            },
            "dependencies": {
              "count": 1
            }
          }
        }
      }
    ]
  }
}