{
  "ml": {
    "v": "5",
    "fs": [
      {
        "id": 0,
        "prob": 0.8748640418052673,
        "class": 0,
        "threshold": 0.9989520311355591
      }
    ],
    "prob": 0.87486404,
    "class": 0,
    "level": 3,
    "models": [
      {
        "m": "az",
        "prob": 0.87486404,
        "class": 0
      },
      {
        "m": "az/native",
        "prob": 0.8199203,
        "class": 0
      },
      {
        "m": "az/pe",
        "prob": 0.0,
        "class": 0
      }
    ],
    "version": "v17.17",
    "threshold": 0.99895203,
    "analyzed_at": "2026-05-30T11:25:20Z"
  },
  "path": "785fad18a3d5d268a0d6d99814255229472bcc77c21097bab92cc4d2376b1069.exe",
  "raw": {
    "v": "5",
    "fs": [
      {
        "f": "Md(Bi₃)",
        "x": 3,
        "ff": {
          "m": {
            "pe": {
              "checksum": 0.0,
              "checksum_valid": 0.0,
              "checksum_stripped": 1.0,
              "computed_checksum": 105757.0,
              "bss_like_section_count": 0.0,
              "section_overflow_count": 2.0,
              "misaligned_section_count": 0.0
            },
            "file": {
              "size": 40618.0,
              "entropy": 7.98,
              "size_bytes": 40618.0
            },
            "binary": {
              "is_pie": 1.0,
              "code_entropy": 8.0,
              "string_count": 474.0,
              "entropy_variance": 15.98,
              "avg_string_length": 4.65,
              "max_string_length": 44.0,
              "code_to_data_ratio": 1.0,
              "string_length_stddev": 2.01,
              "largest_section_ratio": 14.31,
              "sentence_string_count": 1.0,
              "sentence_string_ratio": 0.0,
              "high_entropy_string_count": 0.0
            },
            "sections": {
              "count": 2.0,
              "code_size": 581120.0,
              "entropy_max": 8.0,
              "entropy_mean": 4.0,
              "name_entropy": 2.72,
              "writable_count": 0.0,
              "executable_count": 1.0,
              "nonstandard_count": 0.0,
              "executable_writable_count": 0.0
            },
            "dependencies": {
              "count": 0.0
            }
          },
          "s": [
            [
              77,
              "u8",
              "!This program cannot be run in DOS mode."
            ],
            [
              392,
              "u8",
              ".text"
            ],
            [
              1044,
              "u8",
              "uum1"
            ],
            [
              3047,
              "u8",
              "/zOMP"
            ],
            [
              6071,
              "u8",
              "T RpS"
            ],
            [
              6603,
              "u8",
              "t59i"
            ],
            [
              7007,
              "u8",
              "zRDEY"
            ],
            [
              7359,
              "u8",
              "rtQ0u"
            ],
            [
              7920,
              "u8",
              "I8tRI"
            ],
            [
              8477,
              "u8",
              "kNWWL"
            ],
            [
              9157,
              "u8",
              "OOIXR"
            ],
            [
              9441,
              "u8",
              "fZu o"
            ],
            [
              11256,
              "u8",
              "NFytp"
            ],
            [
              12929,
              "u8",
              "tp nj"
            ],
            [
              16220,
              "u8",
              "et6i"
            ],
            [
              16550,
              "u8",
              "ccUa"
            ],
            [
              17309,
              "u8",
              "QHSKt"
            ],
            [
              19939,
              "u8",
              "kcMzG"
            ],
            [
              20041,
              "u8",
              "1rmMX"
            ],
            [
              21700,
              "u8",
              "G6WS6"
            ],
            [
              22392,
              "u8",
              "5ezbT"
            ],
            [
              22624,
              "u8",
              "EWRB"
            ],
            [
              23741,
              "u8",
              "A YifY"
            ],
            [
              25743,
              "u8",
              "qjEl"
            ],
            [
              25816,
              "u8",
              "D864Q9"
            ],
            [
              25891,
              "u8",
              "ib83"
            ],
            [
              26701,
              "u8",
              "M04A"
            ],
            [
              28919,
              "u8",
              "vJgm"
            ],
            [
              29381,
              "u8",
              "qwJa"
            ],
            [
              29500,
              "u8",
              "jtuJp"
            ],
            [
              29738,
              "u8",
              "PTWJM5t"
            ],
            [
              29782,
              "u8",
              "DJT5"
            ],
            [
              30012,
              "u8",
              "3rgH1"
            ],
            [
              30518,
              "u8",
              "LJ2X"
            ],
            [
              32591,
              "u8",
              "B_RB"
            ],
            [
              36054,
              "u8",
              "nUVmk"
            ],
            [
              38880,
              "u8",
              "SQWP"
            ],
            [
              39304,
              "u8",
              "JZPR"
            ]
          ],
          "v": {
            "file.stem": "785fad18a3d5d268a0d6d99814255229472bcc77c21097bab92cc4d2376b1069",
            "pe.machine": "x86_64",
            "pe.subsystem": "windows_gui",
            "pe.timestamp": 3519919784,
            "file.basename": "785fad18a3d5d268a0d6d99814255229472bcc77c21097bab92cc4d2376b1069.exe",
            "pe.image_base": 4194304,
            "pe.image_size": 598016,
            "pe.machine_id": 34404,
            "pe.os_version": "4.0",
            "pe.headers_size": 512,
            "pe.subsystem_raw": 2,
            "pe.file_alignment": 512,
            "pe.section_alignment": 8192,
            "pe.subsystem_version": "4.0",
            "pe.characteristics[0]": "executable_image",
            "pe.characteristics[1]": "large_address_aware",
            "pe.characteristics_raw": 34,
            "pe.linker_major_version": 48,
            "pe.dll_characteristics[0]": "high_entropy_va",
            "pe.dll_characteristics[1]": "dynamic_base",
            "pe.dll_characteristics[2]": "nx_compat",
            "pe.dll_characteristics[3]": "no_seh",
            "pe.dll_characteristics[4]": "terminal_server_aware",
            "pe.data_directories[0].rva": 589824,
            "pe.data_directories[1].rva": 8192,
            "pe.dll_characteristics_raw": 34144,
            "pe.number_of_rva_and_sizes": 16,
            "pe.overflowing_sections[0]": ".text",
            "pe.overflowing_sections[1]": ".rsrc",
            "pe.data_directories[0].name": "resource",
            "pe.data_directories[0].size": 2468,
            "pe.data_directories[1].name": "clr_runtime_header",
            "pe.data_directories[1].size": 72,
            "pe.coff.dos_header_pe_pointer": 128
          },
          "id": "pe",
          "sc": [
            [
              ".text",
              512,
              581120,
              8.0,
              "r-x"
            ],
            [
              ".rsrc",
              581632,
              2560,
              0.0,
              "r--"
            ]
          ]
        },
        "id": 0,
        "sz": 40618,
        "ts": [
          {
            "c": 0.8999999761581421,
            "d": "PE section headers declare sizes beyond end of file",
            "i": "metadata/binary/anomaly::inflated-section-headers",
            "l": 3
          },
          {
            "c": 1.0,
            "d": "ASLR enabled (DYNAMIC_BASE)",
            "e": [
              "[high_entropy_va, dynamic_base, nx_compat, no_seh, terminal_server_aware]"
            ],
            "i": "metadata/hardening/mitigation::pe-aslr",
            "l": 2,
            "el": [
              "value:pe.dll_characteristics"
            ]
          },
          {
            "a": "T1027",
            "c": 0.699999988079071,
            "d": "Code section dominates file layout",
            "e": [
              "binary.largest_section_ratio = 14.31"
            ],
            "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 1.0,
            "d": "NO_SEH (SafeSEH not used)",
            "e": [
              "[high_entropy_va, dynamic_base, nx_compat, no_seh, terminal_server_aware]"
            ],
            "i": "metadata/hardening/mitigation::pe-no-seh",
            "l": 2,
            "el": [
              "value:pe.dll_characteristics"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "PE resource section",
            "e": [
              ".rsrc"
            ],
            "i": "metadata/binary/section/names::pe-resource-section",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "High-entropy ASLR (64-bit)",
            "e": [
              "[high_entropy_va, dynamic_base, nx_compat, no_seh, terminal_server_aware]"
            ],
            "i": "metadata/hardening/mitigation::pe-high-entropy-va",
            "l": 2,
            "el": [
              "value:pe.dll_characteristics"
            ]
          },
          {
            "c": 0.8199999928474426,
            "d": "Elevated text section entropy",
            "e": [
              ".text (entropy: 8.00)"
            ],
            "i": "metadata/binary/section/metrics::elevated-text-entropy-section",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "DEP / NX enabled (NX_COMPAT)",
            "e": [
              "[high_entropy_va, dynamic_base, nx_compat, no_seh, terminal_server_aware]"
            ],
            "i": "metadata/hardening/mitigation::pe-dep",
            "l": 2,
            "el": [
              "value:pe.dll_characteristics"
            ]
          },
          {
            "c": 0.800000011920929,
            "d": "CompanyName field absent from PE version info",
            "e": [
              "field 'pe.version.company' does not exist"
            ],
            "i": "metadata/binary/anomaly/format::version-info-company-name-absent",
            "l": 1,
            "el": [
              "value:pe.version.company"
            ]
          },
          {
            "a": "T1553.002",
            "c": 0.8500000238418579,
            "d": "PE lacks VS_VERSION_INFO resource",
            "e": [
              "field 'pe.version.file_version' does not exist"
            ],
            "i": "objectives/evasion/masquerade/cert::pe-no-version-info-resource",
            "l": 1,
            "el": [
              "value:pe.version.file_version"
            ]
          },
          {
            "c": 1.0,
            "d": "Near-maximum entropy in .text section",
            "e": [
              ".text (entropy: 8.00, perms: r-x)"
            ],
            "i": "objectives/anti-static/pack/entropy::dotnet-high-entropy-text-raw",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 1.0,
            "d": "Binary has normal code entropy (\u003e5.5)",
            "e": [
              "binary.code_entropy = 8.00"
            ],
            "i": "objectives/anti-static/obfuscation/binary-metrics/shape::normal-code-entropy",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.949999988079071,
            "d": "Code section entropy above 7.4",
            "e": [
              "binary.code_entropy = 8.00"
            ],
            "i": "objectives/anti-static/pack/polymorphic::high-text-entropy-7p4",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Binary has 4 or fewer sections",
            "e": [
              "sections.count = 2.00"
            ],
            "i": "objectives/command-and-control/infrastructure/config::max-sections-4",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "File is a compiled binary",
            "e": [
              "785fad18a3d5d268a0d6d99814255229472bcc77c21097bab92cc4d2376b1069.exe"
            ],
            "i": "metadata/binary/framework::is-binary",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "PE has few sections",
            "e": [
              "sections.count = 2.00"
            ],
            "i": "metadata/binary/layout::legacy-few-sections",
            "l": 2
          },
          {
            "c": 0.949999988079071,
            "d": "PE section declared larger than file (truncated/corrupt)",
            "e": [
              "binary.largest_section_ratio = 14.31"
            ],
            "i": "metadata/binary/metrics/structural::section-exceeds-file-size",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "PE has many readable strings",
            "e": [
              "binary.string_count = 474.00"
            ],
            "i": "metadata/binary/layout::many-readable-strings",
            "l": 2
          },
          {
            "c": 0.8999999761581421,
            "d": "PE standard code/data section",
            "e": [
              ".text"
            ],
            "i": "metadata/binary/section/names::pe-code-data-standard-section",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "PE file uses .exe extension",
            "e": [
              "785fad18a3d5d268a0d6d99814255229472bcc77c21097bab92cc4d2376b1069.exe"
            ],
            "i": "metadata/binary/framework::exe-extension",
            "l": 1
          },
          {
            "a": "T1055",
            "c": 0.800000011920929,
            "d": "Executable section with very low entropy",
            "e": [
              ".text (size: 581120, perms: r-x)"
            ],
            "i": "objectives/anti-static/obfuscation/binary-structure::low-entropy-executable",
            "l": 1
          },
          {
            "a": "T1045",
            "c": 0.6000000238418579,
            "d": "Single section dominates file (packer",
            "e": [
              "binary.largest_section_ratio = 14.31"
            ],
            "i": "objectives/anti-static/obfuscation/binary-metrics/shape::dominant-section",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.8199999928474426,
            "d": "Packed loader largest section ratio above 0.65",
            "e": [
              "binary.largest_section_ratio = 14.31"
            ],
            "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.949999988079071,
            "d": "Filename has EXE extension",
            "e": [
              "785fad18a3d5d268a0d6d99814255229472bcc77c21097bab92cc4d2376b1069.exe"
            ],
            "i": "objectives/evasion/masquerade/file/double-ext::basename-is-exe",
            "l": 1
          },
          {
            "c": 0.6000000238418579,
            "d": "Very few sections (merged/stripped)",
            "e": [
              "sections.count = 2.00"
            ],
            "i": "metadata/binary/metrics/structural::few-sections",
            "l": 3
          },
          {
            "a": "T1027",
            "c": 0.8600000143051147,
            "d": "Dominant section for VB6 loader profile",
            "e": [
              "binary.largest_section_ratio = 14.31"
            ],
            "i": "objectives/anti-static/obfuscation/payload/string-sparse::dominant-text-layout-vb6",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.8500000238418579,
            "d": "High code section entropy",
            "e": [
              "binary.code_entropy = 8.00"
            ],
            "i": "metadata/binary/metrics/pe-details::high-code-entropy-go",
            "l": 3
          },
          {
            "c": 0.8500000238418579,
            "d": "High entropy executable section",
            "e": [
              ".text (entropy: 8.00, perms: r-x)"
            ],
            "i": "metadata/binary/section/metrics::high-entropy-exec-section",
            "l": 3
          },
          {
            "a": "T1027",
            "c": 0.949999988079071,
            "d": "Regex component marker",
            "e": [
              "binary.largest_section_ratio = 14.31"
            ],
            "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188",
            "l": 1,
            "m": "B0032"
          }
        ],
        "sha": "785fad18a3d5d268a0d6d99814255229472bcc77c21097bab92cc4d2376b1069",
        "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/2023-08/785fad18a3d5d268a0d6d99814255229472bcc77c21097bab92cc4d2376b1069.exe",
        "type": "pe"
      }
    ],
    "tv": "ca5ef"
  }
}