{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.037966325879096985, "class": 0 } ], "prob": 0.037966326, "class": 0, "models": [ { "m": "az", "prob": 0.037966326, "class": 0 }, { "m": "az/native", "prob": 0.0, "class": 0 }, { "m": "az/pe", "prob": 0.0, "class": 0 } ], "version": "v17.17", "thresholds": [ 0.999503, 0.9998882 ], "analyzed_at": "2026-05-24T22:45:22Z" }, "path": "76f508f8c3b732a544afb16124eb7683b40f9c29ed1f363674aa57a4ba82e43a.exe", "raw": { "v": "5", "fs": [ { "f": "Md₂(BiSi)", "x": 4, "ff": { "m": { "pe": { "parse_failed": 1.0, "partial_parse": 1.0 }, "file": { "size": 12953528.0, "entropy": 7.84, "size_bytes": 12953528.0 }, "parse": { "error_count": 2.0 }, "binary": { "is_pie": 0.0 } }, "s": [ [ 77, "u8", "!This program cannot be run in DOS mode." ], [ 392, "u8", ".text" ], [ 471, "u8", "@.data" ], [ 631, "u8", "h.rsrc" ], [ 3810, "u8", "Gtfo2" ], [ 4090, "u8", "reHe" ], [ 5988, "u8", "WFPo9D" ], [ 6121, "u8", "b8evm" ], [ 6571, "u8", "OqxnW" ], [ 7497, "u8", "NJLG" ], [ 9621, "u8", "TJt7S" ], [ 11691, "u8", "Z8gCO" ], [ 12712, "u8", "UqPYh" ], [ 14862, "u8", "xVyp" ], [ 15285, "u8", "8iVY2" ], [ 19443, "u8", "inCb" ], [ 19535, "u8", "biuQx" ], [ 20262, "u8", "Z95j7" ], [ 22224, "u8", "8irl" ], [ 22780, "u8", "/jhZ" ], [ 23494, "u8", "Debp" ], [ 24048, "u8", "aKAsp" ], [ 24060, "u8", "Lasp" ], [ 25754, "u8", "/GKz" ], [ 26054, "u8", "48IS" ], [ 26487, "u8", "7iR85Q" ], [ 27609, "u8", "Hrqq" ], [ 27970, "u8", "N8IX" ], [ 28932, "u8", "edim" ], [ 31829, "u8", "ZM8G" ], [ 32492, "u8", "rB1SRj" ], [ 33171, "u8", "dfXw" ], [ 33766, "u8", "/ 6q5O" ], [ 36479, "u8", "y66D3" ], [ 37976, "u8", "aw\u003c\u003c" ], [ 38207, "u8", "t548" ], [ 40453, "u8", "Jhfp" ], [ 41014, "u8", "442u" ], [ 41381, "u8", "SFYD" ], [ 42740, "u8", "vkTq" ], [ 43050, "u8", "8SIGK" ], [ 44385, "u8", "i0UMhI" ], [ 44769, "u8", "Z_IJ" ], [ 44790, "u8", "ik8q" ], [ 45201, "u8", "3niVE" ], [ 47132, "u8", "E428" ], [ 47228, "u8", "6z6a" ], [ 50373, "u8", "kZ2pp" ], [ 50751, "u8", "nVup" ], [ 50761, "u8", "NA zL" ], [ 52179, "u8", "962Zt" ], [ 53198, "u8", "d399" ], [ 54158, "u8", "cpdE3" ], [ 57337, "u8", "l][o" ], [ 62408, "u8", "gYg66" ], [ 62872, "u8", "BTtAf" ], [ 64457, "u8", "bdL0i" ], [ 66026, "u8", "j9 j" ], [ 67208, "u8", "VIEt8" ], [ 68228, "u8", "JHOi9F" ], [ 68316, "u8", "/oSX" ], [ 71034, "u8", "8 C76" ], [ 72019, "u8", "eCts" ], [ 72570, "u8", "6MZJ" ], [ 73193, "u8", "9hcwA" ], [ 77762, "u8", "TX9K3" ], [ 77979, "u8", "ha0xr" ], [ 79314, "u8", "2\u003e`6" ], [ 79452, "u8", "SBdfa" ], [ 81209, "u8", "Q jj" ], [ 81937, "u8", "gouu" ], [ 83613, "u8", "uRqe" ], [ 84171, "u8", "EXX2" ], [ 86986, "u8", "QueryDosDeviceW" ], [ 87542, "u8", "IKPR" ], [ 89131, "u8", "UVW9" ], [ 90956, "u8", "XN11p" ], [ 91271, "u8", "ni4Ay" ], [ 91319, "u8", "A3V5" ], [ 91484, "u8", "PE_W" ], [ 91866, "u8", "daqaiL" ], [ 92243, "u8", "sYve" ], [ 92324, "u8", "53AF" ], [ 92382, "u8", "ZKDA" ], [ 95724, "u8", "6GJF" ], [ 95842, "u8", "j94e" ], [ 95938, "u8", "WYP6d" ], [ 96105, "u8", "Gf3af" ], [ 96436, "u8", "J1RQ" ], [ 96529, "u8", "M1RQ" ], [ 99025, "u8", "BVowB" ], [ 99840, "u8", "q66c" ], [ 100059, "u8", "j416" ], [ 100163, "u8", "aEyg" ], [ 101315, "u8", "k6d3" ], [ 101707, "u8", "ot77" ], [ 102153, "u8", "0ptdL" ], [ 102699, "u8", "kIFim" ], [ 105407, "u8", "LX4iD" ], [ 105802, "u8", "PNKR" ], [ 107275, "u8", "7QDwQ" ], [ 107413, "u8", "8qWAX" ], [ 109896, "u8", "vmXo" ], [ 110510, "u8", "SF9J" ], [ 111280, "u8", "/yN8" ], [ 113369, "u8", "F.mfm" ], [ 114120, "u8", "jjajH" ], [ 116666, "u8", "f[}1" ], [ 117611, "u8", "EDKY" ], [ 117767, "u8", "j%-sdt" ], [ 118376, "u8", "FG5S" ], [ 121701, "u8", "PKeJd" ], [ 121850, "u8", "5E8B" ], [ 126132, "u8", "uLL |%Q" ], [ 126236, "u8", "0LL D" ], [ 129130, "u8", "w 6sa9" ], [ 129234, "u8", "o166" ], [ 130719, "u8", "5DGHd" ], [ 132392, "u8", "(rb)" ], [ 132700, "u8", "8B9K" ], [ 135966, "u8", "6A7N" ], [ 138668, "u8", "Yc.v" ], [ 139231, "u8", "inDg" ], [ 140388, "u8", "ubRp" ], [ 141277, "u8", "sjxpEw" ], [ 141386, "u8", "avCdU" ], [ 141788, "u8", "inar" ], [ 142800, "u8", "hLwr" ], [ 142870, "u8", "gqTw" ], [ 143073, "u8", "/ldQ" ], [ 143665, "u8", "T3UP" ], [ 147907, "u8", "f.88" ], [ 148603, "u8", "vVbh" ], [ 151395, "u8", "rx rE" ], [ 153634, "u8", "8uq9L" ], [ 153791, "u8", "840V" ], [ 155563, "u8", "RBKT" ], [ 159183, "u8", "X3CC" ], [ 159537, "u8", "rTrq" ], [ 161534, "u8", "g vfj" ], [ 166024, "u8", "3HNX" ], [ 168826, "u8", "jFMR8" ], [ 170037, "u8", "NLY95" ], [ 170293, "u8", "B6OX" ], [ 171169, "u8", "HLhh3" ], [ 171187, "u8", "hLhhs" ], [ 173383, "u8", "hbee" ], [ 173485, "u8", "NA5hRz0" ], [ 175396, "u8", "QofAe" ], [ 176090, "u8", "A855Rp" ], [ 177488, "u8", "08pv" ], [ 179603, "u8", "*.of" ], [ 181021, "u8", "PFDM" ], [ 181273, "u8", "2ue2N" ], [ 181999, "u8", "K1HJ" ], [ 183921, "u8", "teET J" ], [ 185165, "u8", "UFGC" ], [ 186517, "u8", "63TvX" ], [ 187133, "u8", "ir9rBH" ], [ 187516, "u8", "ZNRS" ], [ 188085, "u8", "Amps" ], [ 188954, "u8", "oNmw" ], [ 192591, "u8", "XIXT" ], [ 194020, "u8", "SziAj" ], [ 194081, "u8", "x Fr" ], [ 194771, "u8", "aAPZd" ], [ 196460, "u8", "3D1N" ], [ 196639, "u8", "AZ2Hu" ], [ 197514, "u8", "QQIQMo" ], [ 198990, "u8", "SDJA" ], [ 199508, "u8", "jbQ4gQA" ], [ 200887, "u8", "9Vzea" ], [ 202840, "u8", "QFNC-K-" ], [ 204152, "u8", "ZNCS" ], [ 204863, "u8", "DUHA5" ], [ 207510, "u8", "8L6B" ], [ 208631, "u8", "udKbW" ], [ 209075, "u8", "Nr58b" ], [ 210500, "u8", "zI9ll" ], [ 211539, "u8", "EP7I" ], [ 212467, "u8", "VCl1W" ], [ 219738, "u8", "Dhsy" ], [ 221151, "u8", "wIgr" ], [ 223041, "u8", "IhCuc" ], [ 223736, "u8", "I]b(" ], [ 223890, "u8", "HJ9U" ], [ 225587, "u8", "aouRvD" ], [ 226677, "u8", ")o(o" ], [ 226873, "u8", "01xdP" ], [ 228249, "u8", "PfSEAU" ], [ 232528, "u8", "^ NAxz" ], [ 232960, "u8", "ykKf" ], [ 233471, "u8", "qfija" ], [ 233571, "u8", "gz3ysam" ], [ 233909, "u8", "g92f" ], [ 236534, "u8", "tMaPI" ], [ 236963, "u8", "gI()c" ], [ 238966, "u8", "O9W2" ], [ 239585, "u8", "YuPH6" ], [ 241708, "u8", "e02h" ], [ 242587, "u8", "JIY7" ], [ 243821, "u8", "uKZjP" ], [ 244895, "u8", "T0X94" ], [ 247135, "u8", "ZGcvM" ], [ 247142, "u8", "WcvMv" ], [ 247173, "u8", "cvMf4" ], [ 248280, "u8", "YhOdg" ], [ 253777, "u8", "mel2/_r1n]" ], [ 254531, "u8", "MGLgc" ], [ 257003, "u8", "unSg" ], [ 259478, "u8", "baTLe" ], [ 260308, "u8", "YduhP" ], [ 260578, "u8", "ipMq" ], [ 261308, "u8", "Oe.o" ], [ 261388, "u8", "/ZTaJr\\" ], [ 262306, "u8", "X5H A" ], [ 262598, "u8", "tLbv" ], [ 266930, "u8", "krTy" ], [ 269396, "u8", "/Z2zu" ], [ 270403, "u8", "GSU7" ], [ 270769, "u8", "0cSCO" ], [ 272579, "u8", "3ZNAp" ], [ 272837, "u8", "/Dqc" ], [ 273278, "u8", "Hjpd" ], [ 274509, "u8", "VFG8" ], [ 275650, "u8", "YbaTm" ], [ 277373, "u8", "WFgUJ" ], [ 277670, "u8", "uxZY1" ], [ 279262, "u8", "/\tG E" ], [ 279268, "u8", "/qZR" ], [ 279975, "u8", "qmxP3" ], [ 281884, "u8", "JknjGP" ], [ 284879, "u8", "ZGS0" ], [ 285460, "u8", "oz1Ew" ], [ 288188, "u8", "UCTN" ], [ 288982, "u8", "gkTs" ], [ 290597, "u8", "g SwdRW" ], [ 291097, "u8", "f6QWH" ], [ 295160, "u8", "IE7E" ], [ 295741, "u8", "wqVx" ], [ 296419, "u8", "sB.q" ], [ 299410, "u8", "xa6ra" ], [ 301003, "u8", "G1_J" ], [ 301990, "u8", "9wbFa" ], [ 303929, "u8", "/Wry" ], [ 305582, "u8", "FLSE" ], [ 307319, "u8", "ZJ4P" ], [ 307685, "u8", "6UaDI" ], [ 307758, "u8", "bj0CvdI" ], [ 310255, "u8", "Viiz" ], [ 310399, "u8", "oNGWt" ], [ 311761, "u8", "VJiAT" ], [ 312526, "u8", "x(Pz)" ], [ 318492, "u8", "lpXy" ], [ 318710, "u8", "oHXWY" ], [ 319052, "u8", "Xzehr" ] ], "v": { "pe.machine": "x86_64", "pe.subsystem": "windows_gui", "pe.timestamp": 1668881299, "pe.image_base": 5368709120, "pe.image_size": 21151744, "pe.machine_id": 34404, "pe.os_version": "6.0", "pe.entry_point": 14431888, "pe.headers_size": 1024, "pe.partial_parse": true, "pe.subsystem_raw": 2, "pe.file_alignment": 512, "pe.cert_table_size": 7096, "pe.section_alignment": 4096, "pe.subsystem_version": "6.0", "pe.characteristics[0]": "relocs_stripped", "pe.characteristics[1]": "executable_image", "pe.characteristics[2]": "large_address_aware", "pe.characteristics_raw": 35, "pe.linker_major_version": 14, "pe.linker_minor_version": 29, "pe.signatures[0].issuer": "CN=Panic\\, Inc.", "pe.signatures[0].serial": "529d79336bb640b8410ea0a0fb49e257", "pe.signatures[0].subject": "CN=Panic\\, Inc.", "pe.dll_characteristics[0]": "high_entropy_va", "pe.dll_characteristics[1]": "nx_compat", "pe.dll_characteristics[2]": "terminal_server_aware", "pe.signatures[0].verified": true, "pe.dll_characteristics_raw": 33056, "pe.number_of_rva_and_sizes": 16, "pe.signatures[0].not_after": "2029-04-02T08:23:20Z", "pe.signatures[0].not_before": "2026-04-02T08:13:20Z", "pe.signatures[0].self_issued": true, "pe.coff.dos_header_pe_pointer": 128, "pe.signatures[0].thumbprint_sha1": "5b06f023d6499e169555c151dc4cf6f11099540e", "pe.signatures[0].cert_chain_depth": 4, "pe.signatures[0].digest_algorithm": "sha1", "pe.signatures[0].eku_code_signing": true, "pe.signatures[0].signature_digest": "6566d26851129563e23d510cadbbceda696a6ecc", "pe.signatures[0].thumbprint_sha256": "2cd1373092c56ff6785efbc5a6a62dd17d7ad990c363873439b013153e4b3819", "pe.signatures[0].signature_algorithm": "sha256WithRSAEncryption", "pe.signatures[0].signature_digest_algorithm": "sha1" }, "er": [ [ "malformed", "pe-parse" ], [ "fallback", "pe-parse" ] ], "id": "pe" }, "id": 0, "sz": 12953528, "ts": [ { "a": "T1027", "c": 0.30000001192092896, "d": "PE parsed with header-only fallback (downstream walker failed)", "e": [ "PE parsed with header-only fallback (downstream walker failed)" ], "i": "objectives/anti-analysis/pe-tampering/corrupted-header", "l": 2, "m": "B0001" }, { "c": 1.0, "d": "Authenticode chain CN: Panic\\", "e": [ "Panic\\" ], "i": "metadata/signed/unknown::panic\\", "l": 2 }, { "c": 1.0, "d": "Signed by Panic\\", "e": [ "Panic\\" ], "i": "metadata/signed/leaf::panic\\", "l": 3 }, { "c": 1.0, "d": "Binary is 500KB+", "e": [ "76f508f8c3b732a544afb16124eb7683b40f9c29ed1f363674aa57a4ba82e43a.exe" ], "i": "metadata/binary/metrics/threshold::large-binary-500k", "l": 1 }, { "c": 0.7799999713897705, "d": "Short CamelCase Run value token", "e": [ "PJROn" ], "i": "objectives/persistence/login/registry/autostart::short-camel-on-run-value-token", "l": 1 }, { "c": 0.8999999761581421, "d": "DOS dispatcher check op", "e": [ "CMP\u000b" ], "i": "micro-behaviors/os/msdos/internal::dispatcher-signature-op", "l": 2 }, { "c": 0.8999999761581421, "d": "PE file uses .exe extension", "e": [ "76f508f8c3b732a544afb16124eb7683b40f9c29ed1f363674aa57a4ba82e43a.exe" ], "i": "metadata/binary/framework::exe-extension", "l": 1 }, { "a": "T1614", "c": 0.6000000238418579, "d": "Country code AZ token", "e": [ "[AZ^", "[AZ", "AZ_" ], "i": "objectives/anti-analysis/geofencing/region/country-code-a::country-code-az", "l": 1, "m": "B0007.003" }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "StringFileInfo" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1 }, { "c": 1.0, "d": "High-entropy ASLR (64-bit)", "e": [ "[high_entropy_va, nx_compat, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-high-entropy-va", "l": 2 }, { "c": 1.0, "d": "File larger than 1MB", "e": [ "76f508f8c3b732a544afb16124eb7683b40f9c29ed1f363674aa57a4ba82e43a.exe" ], "i": "metadata/binary/metrics/size::large-file-1mb", "l": 2 }, { "c": 0.30000001192092896, "d": "xz compression reference", "e": [ "xz" ], "i": "micro-behaviors/dylib/library/family::xz-ref", "l": 2 }, { "c": 1.0, "d": "PE Authenticode signature verified metadata", "e": [ "true" ], "i": "metadata/signed/certificate::pe-signature-verified-kv", "l": 2 }, { "c": 0.699999988079071, "d": "Detects loop/jump control transfer in assembly", "e": [ "jb U" ], "i": "micro-behaviors/crypto/symmetric/xor/loop::asm-loop-control-transfer", "l": 2 }, { "c": 0.8999999761581421, "d": "PE file larger than 2 MiB", "e": [ "76f508f8c3b732a544afb16124eb7683b40f9c29ed1f363674aa57a4ba82e43a.exe" ], "i": "metadata/binary/layout::file-over-2mb", "l": 1 }, { "c": 0.800000011920929, "d": "CompanyName field absent from PE version info", "e": [ "field 'pe.version.company' does not exist" ], "i": "metadata/binary/anomaly/format::version-info-company-name-absent", "l": 1 }, { "c": 1.0, "d": "DEP / NX enabled (NX_COMPAT)", "e": [ "[high_entropy_va, nx_compat, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-dep", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "76f508f8c3b732a544afb16124eb7683b40f9c29ed1f363674aa57a4ba82e43a.exe" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "a": "T1614", "c": 0.6000000238418579, "d": "Country code AM token", "e": [ "AM ", "\u003cAM" ], "i": "objectives/anti-analysis/geofencing/region/country-code-a::country-code-am", "l": 1, "m": "B0007.003" }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032" }, { "a": "T1614", "c": 0.6000000238418579, "d": "Country code ZA token (repeated)", "e": [ "_ZA[", "]ZA[", "ZA[" ], "i": "objectives/anti-analysis/geofencing/region/cluster::country-code-za", "l": 1, "m": "B0007.003" }, { "a": "T1553.002", "c": 0.8500000238418579, "d": "PE lacks VS_VERSION_INFO resource", "e": [ "field 'pe.version.file_version' does not exist" ], "i": "objectives/evasion/masquerade/cert::pe-no-version-info-resource", "l": 1 }, { "c": 0.8799999952316284, "d": "Native runtime binary is large", "e": [ "76f508f8c3b732a544afb16124eb7683b40f9c29ed1f363674aa57a4ba82e43a.exe" ], "i": "metadata/lang/compiler/aot::native-runtime-large-file", "l": 2 }, { "c": 1.0, "d": "Reference to USER32.dll", "e": [ "USER32.dll" ], "i": "micro-behaviors/os/module/load::user32-dll-reference", "l": 2 }, { "d": ".exe extension reference", "e": [ ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 2 }, { "c": 0.949999988079071, "d": "Filename has EXE extension", "e": [ "76f508f8c3b732a544afb16124eb7683b40f9c29ed1f363674aa57a4ba82e43a.exe" ], "i": "objectives/evasion/masquerade/file/double-ext::basename-is-exe", "l": 1 }, { "c": 0.8999999761581421, "d": "Tiny C string section ratio", "e": [ " = 0.0% of total (0 / 12953528 bytes)" ], "i": "metadata/binary/section/metrics::tiny-cstring-section", "l": 1 }, { "a": "T1027", "c": 1.0, "d": "Binary is 1MB or larger", "e": [ "76f508f8c3b732a544afb16124eb7683b40f9c29ed1f363674aa57a4ba82e43a.exe" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::file-size-1m-plus", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "GetSystemTimeAsFileTime" ], "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "c": 0.8500000238418579, "d": "PE with malformed section layout", "e": [ "parse.error_count = 2.00" ], "i": "metadata/binary/metrics/structural::malformed-pe-structure", "l": 3 } ], "sha": "76f508f8c3b732a544afb16124eb7683b40f9c29ed1f363674aa57a4ba82e43a", "path": "76f508f8c3b732a544afb16124eb7683b40f9c29ed1f363674aa57a4ba82e43a.exe", "type": "pe" } ], "tv": "9ea7c" } }