{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.06094364449381828, "class": 0 } ], "prob": 0.060943644, "class": 0, "models": [ { "m": "az", "prob": 0.060943644, "class": 0 }, { "m": "az/native", "prob": 0.0, "class": 0 }, { "m": "az/pe", "prob": 0.0, "class": 0 } ], "version": "v17.17", "thresholds": [ 0.999503, 0.9998882 ], "analyzed_at": "2026-05-24T12:33:01Z" }, "path": "7a3876b331ccea8dbb9a35183252575fc42646a55391de28528a021ab5e26dd3.exe", "raw": { "v": "5", "fs": [ { "f": "Md₂(BiSi)", "x": 3, "ff": { "m": { "pe": { "parse_failed": 1.0, "partial_parse": 1.0 }, "file": { "size": 3381824.0, "entropy": 7.93, "size_bytes": 3381824.0 }, "parse": { "error_count": 2.0 }, "binary": { "is_pie": 0.0 } }, "s": [ [ 77, "u8", "!This program cannot be run in DOS mode." ], [ 224, "u8", "Rich" ], [ 711, "u8", "@.rsrc" ], [ 751, "u8", "@.idata" ], [ 792, "u8", ".tls" ], [ 832, "u8", ".themida" ], [ 872, "u8", ".boot" ], [ 2179, "u8", "Rzkip9" ], [ 2452, "u8", "eoKv" ], [ 2703, "u8", "Upe0Ftn" ], [ 5452, "u8", "w3Kim" ], [ 5559, "u8", "8v1d" ], [ 5924, "u8", "Ye2Xqn" ], [ 6882, "u8", "23cl" ], [ 8000, "u8", "RBNU" ], [ 8568, "u8", "Ssvc" ], [ 8902, "u8", "juaq" ], [ 9698, "u8", "SNmhT" ], [ 11083, "u8", "Ye spBf" ], [ 11660, "u8", "Rryi4" ], [ 14580, "u8", "YhUVs" ], [ 16921, "u8", "QiGNk" ], [ 17053, "u8", "zzRu" ], [ 17217, "u8", "qKhc1" ], [ 17711, "u8", "e2dcK" ], [ 18798, "u8", "qagsYa5" ], [ 19237, "u8", "q9z2" ], [ 19620, "u8", "mczXD" ], [ 20637, "u8", "EUQL" ], [ 22256, "u8", "imyizq" ], [ 23373, "u8", "giFb" ], [ 27327, "u8", "nBJls" ], [ 28538, "u8", "E4GC" ], [ 28936, "u8", "q1opl" ], [ 29342, "u8", "Chas" ], [ 29592, "u8", "qD21t" ], [ 29986, "u8", "ZHTf0" ], [ 31444, "u8", "ToFpw" ], [ 33419, "u8", "ANjKq" ], [ 34036, "u8", "nO028" ], [ 34245, "u8", "j83q" ], [ 36520, "u8", "IZB_" ], [ 36801, "u8", "W5 3S" ], [ 37379, "u8", "haczNi" ], [ 37775, "u8", "N14Q" ], [ 39988, "u8", "e7ze" ], [ 40465, "u8", "jvvuT" ], [ 42642, "u8", "xg_TJ" ], [ 44544, "u8", "6nwlG" ], [ 45192, "u8", "Nysr" ], [ 45842, "u8", "are0" ], [ 46333, "u8", "sTaYE" ], [ 49798, "u8", "iwco" ], [ 50031, "u8", "T2USXGY" ], [ 51094, "u8", "spBd" ], [ 51310, "u8", "ifqe" ], [ 51505, "u8", "Su m" ], [ 52608, "u8", "E2Gok" ], [ 52674, "u8", "r4us" ], [ 52818, "u8", "M8cJOc" ], [ 52917, "u8", "rUCQ0z" ], [ 54115, "u8", "5RkpF" ], [ 55587, "u8", "EJ5D" ], [ 56512, "u8", "Zrqw" ], [ 56719, "u8", "UKRzq" ], [ 57875, "u8", "aeeyi" ], [ 58210, "u8", "AgHxy" ], [ 58533, "u8", "lLve" ], [ 59990, "u8", "JuXJa5" ], [ 61034, "u8", "/y8G" ], [ 61447, "u8", "lpfbV" ], [ 63783, "u8", "Jivgmq" ], [ 65467, "u8", "ij8vx" ], [ 67707, "u8", "lpLx" ], [ 68802, "u8", "hrZ5N" ], [ 73160, "u8", "Jgyw" ], [ 75508, "u8", "xWof" ], [ 77359, "u8", "Plpai" ], [ 77515, "u8", "rIKOp" ], [ 78687, "u8", "EEsNq" ], [ 81322, "u8", "UC3nEkh" ], [ 81803, "u8", "ejr6R" ], [ 82511, "u8", "m31s" ], [ 84084, "u8", "EgXF9" ], [ 84375, "u8", "xqaDh" ], [ 84649, "u8", "RW34" ], [ 84832, "u8", "yrVc" ], [ 85226, "u8", "ytZp" ], [ 88366, "u8", "cjYh" ], [ 88563, "u8", "Mbiz" ], [ 88632, "u8", "YKA_" ], [ 88797, "u8", "2MDcoZ" ], [ 89175, "u8", "cqqGH" ], [ 89569, "u8", "CP7_5" ], [ 89791, "u8", "zt(}" ], [ 93517, "u8", "2Dtls" ], [ 93620, "u8", "qSzXK" ], [ 93821, "u8", "ufMlA" ], [ 94866, "u8", "HLTJd" ], [ 96669, "u8", "3kWJB" ], [ 96937, "u8", "CRSXr" ], [ 96945, "u8", "7piy" ], [ 98148, "u8", "A6GktG" ], [ 98261, "u8", "KGIHs" ], [ 98840, "u8", "G7cnb" ], [ 99203, "u8", "mRzy" ], [ 99396, "u8", "itypGs" ], [ 100784, "u8", "9tmi" ], [ 102233, "u8", "vhDKn" ], [ 105622, "u8", "qN1YP" ], [ 106315, "u8", "e 2y" ], [ 107332, "u8", "PqIbMN" ], [ 107935, "u8", "nq.Nvi" ], [ 108599, "u8", "21oe" ], [ 111486, "u8", "1Fwtj" ], [ 111869, "u8", "fDytM" ], [ 112067, "u8", "NXoRc" ], [ 112156, "u8", "qiWTy" ], [ 112593, "u8", "f(D]" ], [ 113409, "u8", "lel7e" ], [ 115673, "u8", "Y3VVc" ], [ 116052, "u8", "yj[H]" ], [ 116148, "u8", "UJL_" ], [ 116226, "u8", "37ic" ], [ 117921, "u8", "Irpa" ], [ 119420, "u8", "Ury4W" ], [ 119461, "u8", "nlbJ5" ], [ 122479, "u8", "veJu" ], [ 122577, "u8", "RFMOq" ], [ 123707, "u8", "OLC7" ], [ 126212, "u8", "f.kz" ], [ 126765, "u8", "ug5Tv" ], [ 127022, "u8", "aonu" ], [ 129658, "u8", "yau5t" ], [ 129734, "u8", "id4i" ], [ 136143, "u8", "5UNT" ], [ 136164, "u8", "ibdDH" ], [ 137504, "u8", "MbWIZ" ], [ 137688, "u8", "HuyXZ" ], [ 139153, "u8", "OZmBr" ], [ 139179, "u8", "/9uzwB{" ], [ 139546, "u8", "ag1u" ], [ 139753, "u8", "28lqJQ" ], [ 141284, "u8", "Mqij" ], [ 142521, "u8", "\u0026g@sWH." ], [ 144687, "u8", "Gwfya" ], [ 145204, "u8", "JyqkN" ], [ 146417, "u8", "XRMX" ], [ 147440, "u8", "mYvv" ], [ 147977, "u8", "Miceg" ], [ 148242, "u8", "QCEL" ], [ 148503, "u8", "pZ_/rRP" ], [ 148717, "u8", "gosoM" ], [ 149502, "u8", "dWywk/" ], [ 149721, "u8", "nIpic" ], [ 151639, "u8", "LgmbX" ], [ 151968, "u8", "2J.K@ly" ], [ 151994, "u8", "YFM3gi" ], [ 152232, "u8", "v9pXH" ], [ 153744, "u8", "ST9Q" ], [ 154725, "u8", "aTpm" ], [ 155831, "u8", "oiHa" ], [ 157257, "u8", "yjdVk" ], [ 158083, "u8", "virQF" ], [ 158476, "u8", "KrRYL" ], [ 159037, "u8", "cjGncy" ], [ 159136, "u8", "Uzy1u" ], [ 159580, "u8", "viQc4" ], [ 160988, "u8", "k1z1" ], [ 161139, "u8", "uUNzE" ], [ 161416, "u8", "grGt" ], [ 162392, "u8", "ie1b" ], [ 163000, "u8", "mr9xP" ], [ 163360, "u8", "3023" ], [ 164120, "u8", "Auuv" ], [ 166074, "u8", "eIVJ6" ], [ 166910, "u8", "Wvyx" ], [ 168090, "u8", "9c3h" ], [ 168789, "u8", "vKgs" ], [ 169680, "u8", "fneSP" ], [ 172538, "u8", "OOD4" ], [ 173293, "u8", "/PgB" ], [ 175155, "u8", "Iicb" ], [ 175399, "u8", "zGbYzk" ], [ 176876, "u8", "yuzFJ" ], [ 177579, "u8", "fXJERzN" ], [ 177630, "u8", "mnRy" ], [ 177919, "u8", "bBK7N" ], [ 178094, "u8", "t}I[" ], [ 178231, "u8", "vTg65" ], [ 180080, "u8", "4y7g" ], [ 180303, "u8", "csgBN" ], [ 182535, "u8", "Mhky" ], [ 182702, "u8", "M09re" ], [ 183076, "u8", "YEhIi" ], [ 183749, "u8", "Xwro" ], [ 185070, "u8", "li8s" ], [ 186885, "u8", "5udjw" ], [ 187353, "u8", "iaxr" ], [ 187453, "u8", "nP l" ], [ 187970, "u8", "5zRGz" ], [ 188407, "u8", "j6RKF" ], [ 191979, "u8", "bUaRIK" ], [ 192064, "u8", "a6x13" ], [ 192167, "u8", "RRrTrQ6" ], [ 192579, "u8", "fisu" ], [ 192656, "u8", "mCdq" ], [ 193115, "u8", "Elyc" ], [ 194047, "u8", "I8ZT" ], [ 194179, "u8", "jiJu" ], [ 195633, "u8", "aya5" ], [ 197017, "u8", "6sfUa" ], [ 197277, "u8", "yYdu" ], [ 198531, "u8", "hQMdX" ], [ 198646, "u8", "C0mcX" ], [ 198739, "u8", "mMsr" ], [ 198775, "u8", "A3D2" ], [ 199148, "u8", "qDaw" ], [ 200511, "u8", "eYL9V" ], [ 200682, "u8", "aQ5me" ], [ 201272, "u8", "Okbi" ], [ 205745, "u8", "whEJJV" ], [ 206866, "u8", "eYTSi" ], [ 206970, "u8", "OH_O" ], [ 207009, "u8", "kEtBQ" ], [ 207778, "u8", "mAQf7" ], [ 208337, "u8", "{)lj" ], [ 215104, "u8", "/DCh" ], [ 217737, "u8", "/r15-z59svI=" ], [ 218010, "u8", "YQ*ib l" ], [ 218558, "u8", "gzuDc" ], [ 219008, "u8", "LIebU" ], [ 220407, "u8", "M25G" ], [ 220535, "u8", "Y120p" ], [ 222060, "u8", "uXmf" ], [ 222718, "u8", "[74]" ], [ 223517, "u8", "OES1QDy" ], [ 224597, "u8", "a.Bw" ], [ 228237, "u8", "liRRA" ], [ 228295, "u8", "ElePs" ], [ 230811, "u8", "V4ZN" ], [ 232043, "u8", "Htin" ], [ 232264, "u8", "gkCx" ], [ 232576, "u8", "Toxs" ], [ 232689, "u8", "FRLD" ], [ 233673, "u8", "AOltd" ], [ 236289, "u8", "itO3.Yw" ], [ 236413, "u8", "caku" ], [ 236465, "u8", "W]{42TH" ], [ 236690, "u8", "Uw5QT" ], [ 237039, "u8", "qmqeW" ], [ 237350, "u8", "Iu50jF" ], [ 238063, "u8", "u.Qh" ], [ 238300, "u8", "TPwP55a" ], [ 238428, "u8", "jgHt" ], [ 238488, "u8", "L4EY" ] ], "v": { "pe.machine": "x86_64", "pe.subsystem": "windows_gui", "pe.timestamp": 1760282694, "pe.image_base": 5368709120, "pe.image_size": 9003008, "pe.machine_id": 34404, "pe.os_version": "6.0", "pe.entry_point": 6217816, "pe.headers_size": 1024, "pe.partial_parse": true, "pe.subsystem_raw": 2, "pe.file_alignment": 512, "pe.cert_table_size": 11312, "pe.section_alignment": 4096, "pe.subsystem_version": "6.0", "pe.characteristics[0]": "executable_image", "pe.characteristics[1]": "large_address_aware", "pe.characteristics_raw": 34, "pe.linker_major_version": 14, "pe.linker_minor_version": 43, "pe.signatures[0].issuer": "CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB", "pe.signatures[0].serial": "5a34a5b636563df6b7a1f07fb5f23979", "pe.signatures[0].subject": "CN=Martin Tofall,O=Martin Tofall,ST=Nordrhein-Westfalen,C=DE", "pe.dll_characteristics[0]": "high_entropy_va", "pe.dll_characteristics[1]": "terminal_server_aware", "pe.signatures[0].verified": true, "pe.dll_characteristics_raw": 32800, "pe.number_of_rva_and_sizes": 16, "pe.signatures[0].not_after": "2026-01-09T23:59:59Z", "pe.signatures[0].not_before": "2022-12-08T00:00:00Z", "pe.coff.dos_header_pe_pointer": 248, "pe.signatures[0].thumbprint_sha1": "47982902c6bc9f39ffe31c7373d74db9638088c5", "pe.signatures[0].cert_chain_depth": 3, "pe.signatures[0].digest_algorithm": "sha256", "pe.signatures[0].eku_code_signing": true, "pe.signatures[0].signature_digest": "19f48c2b56ca1a8410b05ea4416d809ec7aac6794c607cafceaea296578f19bc", "pe.signatures[0].thumbprint_sha256": "d13b6e75bf3db593ff2b1331cd30603663949e3a85edf9c74bc58cf34f56bc78", "pe.signatures[0].signature_algorithm": "sha384WithRSAEncryption", "pe.signatures[0].signature_digest_algorithm": "sha256" }, "er": [ [ "malformed", "pe-parse" ], [ "fallback", "pe-parse" ] ], "id": "pe" }, "id": 0, "sz": 3381824, "ts": [ { "a": "T1027", "c": 0.30000001192092896, "d": "PE parsed with header-only fallback (downstream walker failed)", "e": [ "PE parsed with header-only fallback (downstream walker failed)" ], "i": "objectives/anti-analysis/pe-tampering/corrupted-header", "l": 2, "m": "B0001" }, { "c": 1.0, "d": "Authenticode chain CN: Martin Tofall", "e": [ "Martin Tofall" ], "i": "metadata/signed/unknown::martin-tofall", "l": 2 }, { "c": 1.0, "d": "Signed by Martin Tofall", "e": [ "Martin Tofall" ], "i": "metadata/signed/leaf::martin-tofall", "l": 3 }, { "c": 1.0, "d": "Binary is 500KB+", "e": [ "7a3876b331ccea8dbb9a35183252575fc42646a55391de28528a021ab5e26dd3.exe" ], "i": "metadata/binary/metrics/threshold::large-binary-500k", "l": 1 }, { "d": "certificate string reference", "e": [ "Certificate" ], "i": "micro-behaviors/crypto/certificate/usage::certificate-ref", "l": 2 }, { "a": "T1614", "c": 0.6000000238418579, "d": "Country code RU token", "e": [ "\\RU " ], "i": "objectives/anti-analysis/geofencing/region/country-code-c::country-code-ru", "l": 1, "m": "B0007.003" }, { "c": 0.8999999761581421, "d": "PE file uses .exe extension", "e": [ "7a3876b331ccea8dbb9a35183252575fc42646a55391de28528a021ab5e26dd3.exe" ], "i": "metadata/binary/framework::exe-extension", "l": 1 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "StringFileInfo" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1 }, { "c": 1.0, "d": "High-entropy ASLR (64-bit)", "e": [ "[high_entropy_va, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-high-entropy-va", "l": 2 }, { "c": 1.0, "d": "File larger than 1MB", "e": [ "7a3876b331ccea8dbb9a35183252575fc42646a55391de28528a021ab5e26dd3.exe" ], "i": "metadata/binary/metrics/size::large-file-1mb", "l": 2 }, { "c": 1.0, "d": "PE Authenticode signature verified metadata", "e": [ "true" ], "i": "metadata/signed/certificate::pe-signature-verified-kv", "l": 2 }, { "c": 0.8999999761581421, "d": "PE file larger than 2 MiB", "e": [ "7a3876b331ccea8dbb9a35183252575fc42646a55391de28528a021ab5e26dd3.exe" ], "i": "metadata/binary/layout::file-over-2mb", "l": 1 }, { "c": 0.800000011920929, "d": "CompanyName field absent from PE version info", "e": [ "field 'pe.version.company' does not exist" ], "i": "metadata/binary/anomaly/format::version-info-company-name-absent", "l": 1 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "7a3876b331ccea8dbb9a35183252575fc42646a55391de28528a021ab5e26dd3.exe" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "a": "T1614", "c": 0.6000000238418579, "d": "Country code TJ token", "e": [ "#TJ", "_TJ" ], "i": "objectives/anti-analysis/geofencing/region/country-code-c::country-code-tj", "l": 1, "m": "B0007.003" }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032" }, { "a": "T1553.002", "c": 0.8500000238418579, "d": "PE lacks VS_VERSION_INFO resource", "e": [ "field 'pe.version.file_version' does not exist" ], "i": "objectives/evasion/masquerade/cert::pe-no-version-info-resource", "l": 1 }, { "c": 1.0, "d": "Issued by Sectigo Code Signing CA", "e": [ "CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB" ], "i": "metadata/signed/certificate::pe-cert-issuer-sectigo", "l": 2 }, { "c": 0.8799999952316284, "d": "Native runtime binary is large", "e": [ "7a3876b331ccea8dbb9a35183252575fc42646a55391de28528a021ab5e26dd3.exe" ], "i": "metadata/lang/compiler/aot::native-runtime-large-file", "l": 2 }, { "d": ".exe extension reference", "e": [ ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 2 }, { "c": 0.949999988079071, "d": "Filename has EXE extension", "e": [ "7a3876b331ccea8dbb9a35183252575fc42646a55391de28528a021ab5e26dd3.exe" ], "i": "objectives/evasion/masquerade/file/double-ext::basename-is-exe", "l": 1 }, { "c": 0.8999999761581421, "d": "Tiny C string section ratio", "e": [ " = 0.0% of total (0 / 3381824 bytes)" ], "i": "metadata/binary/section/metrics::tiny-cstring-section", "l": 1 }, { "a": "T1027.007", "c": 0.8999999761581421, "d": "Kernel32 DLL resolution string", "e": [ "kernel32.dll" ], "i": "micro-behaviors/os/api-resolution/manual::kernel32-resolver", "l": 1 }, { "a": "T1027", "c": 1.0, "d": "Binary is 1MB or larger", "e": [ "7a3876b331ccea8dbb9a35183252575fc42646a55391de28528a021ab5e26dd3.exe" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::file-size-1m-plus", "l": 1, "m": "B0032" }, { "c": 0.8500000238418579, "d": "PE with malformed section layout", "e": [ "parse.error_count = 2.00" ], "i": "metadata/binary/metrics/structural::malformed-pe-structure", "l": 3 } ], "sha": "7a3876b331ccea8dbb9a35183252575fc42646a55391de28528a021ab5e26dd3", "path": "7a3876b331ccea8dbb9a35183252575fc42646a55391de28528a021ab5e26dd3.exe", "type": "pe" } ], "tv": "9ea7c" } }