{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 0.9999180436134338,
        "class": 2
      }
    ],
    "prob": 0.99991804,
    "class": 2,
    "models": [
      {
        "m": "az",
        "prob": 0.99991804,
        "class": 2
      },
      {
        "m": "az/native",
        "prob": 0.99972135,
        "class": 0
      },
      {
        "m": "az/pe",
        "prob": 0.99940467,
        "class": 0
      }
    ],
    "version": "v16.16",
    "thresholds": [
      0.9983558,
      0.99991804
    ],
    "analyzed_at": "2026-05-18T04:30:08Z"
  },
  "path": "VirusShare_badfc92044544cc5c9645bd3396e49b0",
  "raw": {
    "v": "4",
    "fs": [
      {
        "f": "O(As₃)H₂(CmDb)Md₃(Bi₅HeSi)",
        "k": {
          "hash.authenti": "a487f5e57a4a7f7a78315b3412e4bca6beac6952cc942c85c3c1429347352588",
          "build.target_arch": "x86",
          "pe.linker_version": "3.4",
          "pe.data_directories[0].rva": 188416,
          "pe.data_directories[0].name": "resource",
          "pe.data_directories[0].size": 16,
          "binary.top_complex_unnamed[0].cc": 2,
          "binary.top_complex_unnamed[1].cc": 2,
          "binary.top_complex_unnamed[0].bbs": 3,
          "binary.top_complex_unnamed[1].bbs": 2,
          "binary.top_complex_unnamed[0].addr": "0x408917",
          "binary.top_complex_unnamed[0].size": 43,
          "binary.top_complex_unnamed[1].addr": "0x408900",
          "binary.top_complex_unnamed[1].size": 22,
          "pe.section_characteristics[0].name": ".text",
          "pe.section_characteristics[1].name": ".data",
          "pe.section_characteristics[2].name": ".rdata",
          "pe.section_characteristics[3].name": ".bss",
          "pe.section_characteristics[4].name": ".rsrc",
          "pe.section_characteristics[0].raw_size": 32256,
          "pe.section_characteristics[1].raw_size": 1536,
          "pe.section_characteristics[2].raw_size": 51200,
          "pe.section_characteristics[4].raw_size": 512,
          "pe.section_characteristics[0].virtual_size": 31984,
          "pe.section_characteristics[1].virtual_size": 1348,
          "pe.section_characteristics[2].virtual_size": 50916,
          "pe.section_characteristics[3].virtual_size": 93984,
          "pe.section_characteristics[4].virtual_size": 16,
          "pe.section_characteristics[0].virtual_address": 4096,
          "pe.section_characteristics[1].virtual_address": 36864,
          "pe.section_characteristics[2].virtual_address": 40960,
          "pe.section_characteristics[3].virtual_address": 94208,
          "pe.section_characteristics[4].virtual_address": 188416,
          "pe.section_characteristics[0].characteristics_hex": "e0000020",
          "pe.section_characteristics[1].characteristics_hex": "c0000040",
          "pe.section_characteristics[2].characteristics_hex": "c0000040",
          "pe.section_characteristics[3].characteristics_hex": "c0000080",
          "pe.section_characteristics[4].characteristics_hex": "40000040"
        },
        "x": 79,
        "id": 0,
        "ms": {
          "pe": {
            "entry": 34764.0,
            "machine": 332.0,
            "checksum": 0.0,
            "rsrc_size": 512.0,
            "subsystem": 3.0,
            "image_base": 4194304.0,
            "rsrc_entropy": 2.88,
            "entry_section": ".text",
            "size_of_image": 192512.0,
            "file_alignment": 512.0,
            "characteristics": 783.0,
            "size_of_headers": 1024.0,
            "export_timestamp": 0.0,
            "computed_checksum": 138685.0,
            "section_alignment": 4096.0,
            "timestamp_anomaly": true,
            "timestamp_is_zero": true,
            "resource_timestamp": 0.0,
            "has_export_timestamp": false,
            "linker_major_version": 3.0,
            "linker_minor_version": 4.0,
            "has_resource_timestamp": false,
            "number_of_rva_and_sizes": 16.0,
            "entry_in_writable_section": true
          },
          "file": {
            "size": 86528.0
          },
          "binary": {
            "code_size": 32256.0,
            "func_count": 3.0,
            "code_entropy": 7.93,
            "data_entropy": 7.64,
            "func_density": 0.1,
            "string_count": 37.0,
            "avg_func_size": 122.67,
            "section_count": 5.0,
            "avg_complexity": 2.0,
            "max_complexity": 2.0,
            "string_density": 1.17,
            "overall_entropy": 5.22,
            "avg_basic_blocks": 2.67,
            "avg_section_size": 17100.8,
            "entropy_variance": 3.23,
            "wx_section_count": 1.0,
            "avg_string_length": 19.86,
            "complexity_per_kb": 0.06,
            "max_string_length": 496.0,
            "avg_string_entropy": 2.2,
            "code_to_data_ratio": 0.61,
            "data_to_file_ratio": 0.02,
            "rsrc_to_file_ratio": 0.01,
            "text_to_file_ratio": 0.37,
            "total_basic_blocks": 8.0,
            "func_analysis_depth": 2.0,
            "high_entropy_regions": 2.0,
            "string_length_stddev": 79.65,
            "largest_section_ratio": 0.59,
            "sentence_string_count": 1.0,
            "sentence_string_ratio": 0.03,
            "writable_section_count": 4.0,
            "entry_in_writable_region": true,
            "executable_section_count": 1.0
          }
        },
        "ss": [
          [
            77,
            "!This program cannot be run in DOS mode."
          ],
          [
            376,
            ".text"
          ],
          [
            416,
            ".data"
          ],
          [
            456,
            ".rdata"
          ],
          [
            496,
            ".bss"
          ],
          [
            536,
            ".rsrc"
          ],
          [
            3986,
            "du9e"
          ],
          [
            6362,
            "Dkfv"
          ],
          [
            9485,
            "J_06"
          ],
          [
            14847,
            "2D5B"
          ],
          [
            15576,
            "g879"
          ],
          [
            15581,
            "\u003cBA\u003e"
          ],
          [
            15801,
            "N:z2\u003e!"
          ],
          [
            18519,
            "V3QN"
          ],
          [
            26127,
            "/pSU"
          ],
          [
            26325,
            "S5HM"
          ],
          [
            30158,
            "Q6WW"
          ],
          [
            30547,
            "m~2\u003e z"
          ],
          [
            38325,
            "Mbdo"
          ],
          [
            41864,
            "19.130.27.122:47762"
          ],
          [
            45873,
            "4I3EN"
          ],
          [
            51255,
            "d8a4"
          ],
          [
            51261,
            "/uqgy"
          ],
          [
            52565,
            "XU95"
          ],
          [
            52930,
            "IFQA"
          ],
          [
            55529,
            "168.118.6.52:29569"
          ],
          [
            57505,
            "SB74"
          ],
          [
            58666,
            "/ycR"
          ],
          [
            60848,
            "95.143.192.105:17629"
          ],
          [
            61887,
            "9BHB"
          ],
          [
            62883,
            "NRGK"
          ],
          [
            64525,
            "G ti"
          ],
          [
            75362,
            "Yspa"
          ],
          [
            80913,
            "/Imt"
          ],
          [
            83930,
            "860K"
          ],
          [
            85565,
            "1.Mym!@"
          ],
          [
            86032,
            "PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDING"
          ]
        ],
        "sz": 86528,
        "ts": [
          {
            "a": "T1070.006",
            "c": 0.8999999761581421,
            "d": "PE header timestamp is zero",
            "e": [
              "pe.timestamp_is_zero = 1.00"
            ],
            "i": "objectives/evasion/indicator-removal/timestamps::zero-header-timestamp",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "Low average string entropy (dictionary text)",
            "e": [
              "binary.avg_string_entropy = 2.20"
            ],
            "i": "objectives/anti-static/pack/polymorphic::low-avg-string-entropy",
            "l": 1
          },
          {
            "c": 0.8500000238418579,
            "d": "PE checksum field not set",
            "e": [
              "pe.has_checksum = 0.00"
            ],
            "i": "metadata/binary/layout::pe-checksum-absent",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Near-maximum entropy in .text section",
            "e": [
              ".text (entropy: 7.93, perms: rwx)"
            ],
            "i": "objectives/anti-static/pack/entropy::dotnet-high-entropy-text-raw",
            "l": 1
          },
          {
            "a": "T1036.005",
            "c": 0.9700000286102295,
            "d": "Console subsystem on dw20 claim",
            "e": [
              "pe.subsystem = 3.00"
            ],
            "i": "objectives/evasion/masquerade/version-resource/microsoft-utility::dw20-cui-subsystem",
            "l": 1,
            "m": "F0004"
          },
          {
            "a": "T1027",
            "c": 0.949999988079071,
            "d": "Code section entropy above 7.4",
            "e": [
              "binary.code_entropy = 7.93"
            ],
            "i": "objectives/anti-static/pack/polymorphic::high-text-entropy-7p4",
            "l": 1
          },
          {
            "a": "T1553.002",
            "c": 0.8500000238418579,
            "d": "PE lacks VS_VERSION_INFO resource",
            "e": [
              "field 'pe.version_info.file_version' does not exist"
            ],
            "i": "objectives/evasion/masquerade/cert::pe-no-version-info-resource",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "Five section PE layout",
            "e": [
              "binary.section_count = 5.00"
            ],
            "i": "metadata/binary/section/metrics::five-section-pe",
            "l": 1
          },
          {
            "c": 0.8199999928474426,
            "d": "Elevated text section entropy",
            "e": [
              ".text (entropy: 7.93)"
            ],
            "i": "metadata/binary/section/metrics::elevated-text-entropy-section",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "CompanyName field absent from PE version info",
            "e": [
              "field 'pe.version_info.company_name' does not exist"
            ],
            "i": "metadata/binary/anomaly/format::version-info-company-name-absent",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "PE has low overall entropy",
            "e": [
              "binary.overall_entropy = 5.22"
            ],
            "i": "metadata/binary/layout::low-overall-entropy",
            "l": 2
          },
          {
            "a": "T1105",
            "c": 1.0,
            "d": "Binary contains high-entropy data regions",
            "e": [
              "binary.high_entropy_regions = 2.00"
            ],
            "i": "objectives/command-and-control/dropper/staging/embedded::has-high-entropy-regions",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "PE mapped image under 768 KiB",
            "e": [
              "pe.size_of_image = 192512.00"
            ],
            "i": "metadata/binary/layout::image-under-768kb",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Binary has 3+ functions",
            "e": [
              "binary.func_count = 3.00"
            ],
            "i": "metadata/binary/metrics/threshold::few-functions-3",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "PE standard code/data section",
            "e": [
              ".data",
              ".text"
            ],
            "i": "metadata/binary/section/names::pe-code-data-standard-section",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Low function count metric",
            "e": [
              "binary.func_count = 3.00"
            ],
            "i": "metadata/binary/metrics/anomaly::low-function-count-marker",
            "l": 1
          },
          {
            "a": "T1036.005",
            "c": 0.9700000286102295,
            "d": "PE has no Authenticode signature",
            "e": [
              "binary.has_signature = 0.00"
            ],
            "i": "objectives/evasion/masquerade/version-resource/microsoft-utility::dw20-host-unsigned",
            "l": 1,
            "m": "F0004"
          },
          {
            "a": "T1027",
            "c": 0.949999988079071,
            "d": "Very low recovered function count",
            "e": [
              "binary.func_count = 3.00"
            ],
            "i": "objectives/anti-static/pack/polymorphic::very-low-func-count",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Binary has low average string entropy",
            "e": [
              "binary.avg_string_entropy = 2.20"
            ],
            "i": "metadata/binary/metrics/threshold::avg-string-entropy-4-max",
            "l": 2
          },
          {
            "c": 0.699999988079071,
            "d": "PE imports from one DLL",
            "e": [
              "pe.import_dll_count = 0.00"
            ],
            "i": "metadata/binary/symbols/imports::pe-single-import-dll",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "PE resource section",
            "e": [
              ".rsrc"
            ],
            "i": "metadata/binary/section/names::pe-resource-section",
            "l": 1
          },
          {
            "a": "T1055.012",
            "c": 1.0,
            "d": "Lacks substantial resources",
            "e": [
              "binary.rsrc_to_file_ratio = 0.01"
            ],
            "i": "objectives/evasion/process/injection/hollowing::lacks-substantial-resources",
            "l": 1,
            "m": "E1055.012"
          },
          {
            "c": 0.800000011920929,
            "d": "Tiny writable data section",
            "e": [
              ".data (size: 1536)"
            ],
            "i": "metadata/binary/section/metrics::tiny-data-section",
            "l": 1
          },
          {
            "c": 0.8199999928474426,
            "d": "Repeated padding marker string block",
            "e": [
              "PADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…",
              "…XPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…",
              "PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX…"
            ],
            "i": "objectives/anti-static/obfuscation/string/junking::repeated-padding-marker",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "PE standard runtime section",
            "e": [
              ".rdata"
            ],
            "i": "metadata/binary/section/names::pe-runtime-standard-section",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "File is a compiled binary",
            "e": [
              "VirusShare_badfc92044544cc5c9645bd3396e49b0"
            ],
            "i": "metadata/binary/framework::is-binary",
            "l": 1
          },
          {
            "c": 0.8600000143051147,
            "d": "High entropy rdata section",
            "e": [
              ".rdata (entropy: 7.99)"
            ],
            "i": "metadata/binary/section/metrics::high-entropy-rdata-section",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "Import count is exactly zero",
            "e": [
              "pe.import_dll_count = 0.00"
            ],
            "i": "objectives/evasion/masquerade/identity/vendor::zero-import-count",
            "l": 2
          },
          {
            "c": 0.699999988079071,
            "d": "PE with six or fewer imports",
            "e": [
              "binary.import_count = 0.00"
            ],
            "i": "metadata/binary/symbols/imports::pe-imports-max-six",
            "l": 1
          },
          {
            "a": "T1055.012",
            "c": 1.0,
            "d": "Lacks substantial data section",
            "e": [
              "binary.data_to_file_ratio = 0.02"
            ],
            "i": "objectives/evasion/process/injection/hollowing::lacks-substantial-data",
            "l": 1,
            "m": "E1055.012"
          },
          {
            "a": "T1027",
            "c": 1.0,
            "d": "Binary has normal code entropy (\u003e5.5)",
            "e": [
              "binary.code_entropy = 7.93"
            ],
            "i": "objectives/anti-static/obfuscation/binary-metrics/shape::normal-code-entropy",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.8999999761581421,
            "d": "PE has under ten imports",
            "e": [
              "binary.import_count = 0.00"
            ],
            "i": "objectives/anti-static/pack/runtime::pe-import-count-under-10",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "Small PE resource section",
            "e": [
              "pe.rsrc_size = 512.00"
            ],
            "i": "metadata/package/versioning::pe-small-rsrc",
            "l": 1
          },
          {
            "d": "Few detected functions (stub-like or analysis-limited)",
            "e": [
              "binary.func_count = 3.00"
            ],
            "i": "metadata/binary/metrics/structural::no-functions",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "Binary has low average complexity",
            "e": [
              "binary.avg_complexity = 2.00"
            ],
            "i": "metadata/binary/metrics/threshold::avg-complexity-15-max",
            "l": 2
          },
          {
            "c": 0.75,
            "d": "Binary exports no symbols",
            "e": [
              "binary.export_count = 0.00"
            ],
            "i": "metadata/binary/symbols/exports::no-exports",
            "l": 1
          },
          {
            "a": "T1622",
            "c": 0.949999988079071,
            "d": "Minimal PE import DLL count (\u003c= 3)",
            "e": [
              "pe.import_dll_count = 0.00"
            ],
            "i": "objectives/anti-analysis/debugger-detect/stub::minimal-import-dll-count",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "VB6 binary with very few strings",
            "e": [
              "binary.string_count = 37.00"
            ],
            "i": "objectives/anti-static/obfuscation/payload/string-sparse::low-string-count-vb6",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.800000011920929,
            "d": "High entropy .rdata section (likely encrypted)",
            "e": [
              ".rdata (entropy: 7.99)"
            ],
            "i": "metadata/binary/section/names::high-entropy-rdata",
            "l": 3
          },
          {
            "c": 0.800000011920929,
            "d": "Tiny resource section (no version/icon)",
            "e": [
              ".rsrc (size: 512)"
            ],
            "i": "metadata/binary/resource::minimal-resources",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "Binary is not digitally signed",
            "e": [
              "binary.has_signature = 0.00"
            ],
            "i": "metadata/signed/trust-level::unsigned",
            "l": 3
          },
          {
            "a": "T1070.006",
            "c": 0.8999999761581421,
            "d": "Export timestamp is absent",
            "e": [
              "pe.has_export_timestamp = 0.00"
            ],
            "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-absent",
            "l": 2
          },
          {
            "a": "T1055",
            "c": 0.949999988079071,
            "d": "Huge null run in executable (128+ bytes)",
            "e": [
              "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00"
            ],
            "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text",
            "l": 1
          },
          {
            "c": 0.9200000166893005,
            "d": "External IPv4 address with port literal",
            "e": [
              "168.118.6.52:29569",
              "95.143.192.105:17629",
              "19.130.27.122:47762"
            ],
            "i": "micro-behaviors/communications/ip/endpoint::external-ipv4-port-binary-literal",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.800000011920929,
            "d": "Data section significantly larger than code",
            "e": [
              ".rdata",
              ".data+.rdata = 163.5% of text (52736 / 32256 bytes)",
              ".data"
            ],
            "i": "objectives/anti-static/obfuscation/payload/section::data-section-dominant",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.8500000238418579,
            "d": "High code section entropy",
            "e": [
              "binary.code_entropy = 7.93"
            ],
            "i": "metadata/binary/metrics/pe-details::high-code-entropy-go",
            "l": 3
          },
          {
            "c": 0.699999988079071,
            "d": "No imported symbols",
            "e": [
              "binary.import_density = 0.00"
            ],
            "i": "metadata/binary/metrics/structural::no-imports",
            "l": 3
          },
          {
            "a": "T1105",
            "c": 0.800000011920929,
            "d": "Compact PE import table",
            "e": [
              "binary.import_count = 0.00"
            ],
            "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table",
            "l": 1,
            "m": "E1105"
          },
          {
            "c": 0.8500000238418579,
            "d": "Low function count metric",
            "e": [
              "binary.func_count = 3.00"
            ],
            "i": "metadata/binary/anomaly/format::low-function-count-marker",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "Encrypted data section (very high)",
            "e": [
              ".rdata (entropy: 7.99)"
            ],
            "i": "objectives/anti-static/obfuscation/payload/section::encrypted-data-section",
            "l": 4,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.800000011920929,
            "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)",
            "e": [
              "pe.resource_count = 0.00"
            ],
            "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.699999988079071,
            "d": "Oversized data section vs code",
            "e": [
              ".rdata",
              ".data+.rdata = 163.5% of text (52736 / 32256 bytes)",
              ".data"
            ],
            "i": "objectives/anti-static/obfuscation/payload/section::oversized-data-section",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1027.002",
            "c": 0.699999988079071,
            "d": "PE with single import",
            "e": [
              "binary.import_count = 0.00"
            ],
            "i": "objectives/command-and-control/dropper/execution/loader::pe-single-import",
            "l": 1
          },
          {
            "c": 0.7200000286102295,
            "d": "Writable .rdata section permissions",
            "e": [
              ".rdata (perms: rw-)"
            ],
            "i": "metadata/binary/section/names::writable-rdata",
            "l": 3
          },
          {
            "c": 0.8500000238418579,
            "d": "High entropy executable section",
            "e": [
              ".text (entropy: 7.93, perms: rwx)"
            ],
            "i": "metadata/binary/section/metrics::high-entropy-exec-section",
            "l": 3
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "Encrypted rdata section (PE crypter)",
            "e": [
              ".rdata (entropy: 7.99)"
            ],
            "i": "objectives/anti-static/obfuscation/payload/section::encrypted-rdata-section",
            "l": 4,
            "m": "B0032"
          },
          {
            "c": 0.800000011920929,
            "d": "Five or more PE sections",
            "e": [
              "binary.section_count = 5.00"
            ],
            "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe",
            "l": 1
          },
          {
            "c": 0.4000000059604645,
            "d": "Very few basic blocks (analysis-limited or sparse)",
            "e": [
              "binary.total_basic_blocks = 8.00"
            ],
            "i": "metadata/binary/metrics/structural::few-basic-blocks",
            "l": 3
          },
          {
            "a": "T1027.007",
            "c": 1.0,
            "d": "WININET.DLL absent from PE import table",
            "e": [
              "pe.import_dll_count = 0.00"
            ],
            "i": "objectives/anti-static/obfuscation/imports::wininet-import-absent",
            "l": 2,
            "m": "B0032"
          },
          {
            "a": "T1055",
            "c": 0.8999999761581421,
            "d": "Writable and executable sections (self-modifying",
            "e": [
              "binary.wx_section_count = 1.00"
            ],
            "i": "objectives/anti-static/obfuscation/binary-metrics/shape::wx-sections",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1055",
            "c": 0.9200000166893005,
            "d": "Regex component marker",
            "e": [
              "binary.import_count = 0.00"
            ],
            "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571",
            "l": 1,
            "m": "C0041"
          },
          {
            "a": "T1612",
            "c": 0.8500000238418579,
            "d": "PE has few icon resources",
            "e": [
              "pe.icon_count = 0.00"
            ],
            "i": "objectives/anti-static/obfuscation/payload/resource::icon-count-under-six",
            "l": 1,
            "m": "B0023"
          },
          {
            "c": 0.75,
            "d": "Low average code complexity",
            "e": [
              "binary.avg_complexity = 2.00"
            ],
            "i": "metadata/binary/metrics/structural::low-average-complexity",
            "l": 2
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "High entropy in code section",
            "e": [
              ".text (size: 32256, entropy: 7.93)"
            ],
            "i": "objectives/anti-static/obfuscation/payload/encrypted::high-entropy-text",
            "l": 4,
            "m": "B0032.002"
          },
          {
            "c": 0.75,
            "d": "High entropy encrypted data",
            "e": [
              ".rdata (entropy: 7.99)"
            ],
            "i": "micro-behaviors/data/encode/payload::payload-blob-metrics",
            "l": 3
          },
          {
            "a": "T1055",
            "c": 0.8500000238418579,
            "d": "Large null run in executable (64+ bytes)",
            "e": [
              "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00"
            ],
            "i": "objectives/anti-static/obfuscation/binary-structure::large-null-run-text",
            "l": 1
          },
          {
            "c": 0.8199999928474426,
            "d": "High entropy in writable data section",
            "e": [
              ".rdata (entropy: 7.99, perms: rw-)",
              ".data (entropy: 7.29, perms: rw-)"
            ],
            "i": "objectives/anti-static/pack/entropy::high-entropy-data-section",
            "l": 1
          },
          {
            "c": 0.8799999952316284,
            "d": "Hardcoded external IPv4 port in PE binary",
            "e": [
              "168.118.6.52:29569",
              "19.130.27.122:47762",
              "95.143.192.105:17629"
            ],
            "i": "micro-behaviors/communications/ip/endpoint::external-ipv4-port-pe",
            "l": 1
          },
          {
            "c": 0.9399999976158142,
            "d": "Multiple external IPv4 endpoints in rdata",
            "e": [
              "168.118.6.52:29569",
              "19.130.27.122:47762",
              "95.143.192.105:17629"
            ],
            "i": "micro-behaviors/communications/ip/endpoint::external-ipv4-port-rdata-pair",
            "l": 3
          },
          {
            "c": 0.9200000166893005,
            "d": "Writable .text section (custom packer indicator)",
            "e": [
              ".text (size: 32256, entropy: 7.93, perms: rwx)"
            ],
            "i": "metadata/binary/section/metrics::writable-text-section",
            "l": 4
          },
          {
            "c": 0.6000000238418579,
            "d": "High entropy in data section",
            "e": [
              ".rdata (entropy: 7.99)"
            ],
            "i": "metadata/binary/metrics/structural::high-entropy-data",
            "l": 1
          },
          {
            "a": "T1070.006",
            "c": 0.699999988079071,
            "d": "PE timestamp anomaly detected",
            "e": [
              "pe.timestamp_anomaly = 1.00"
            ],
            "i": "objectives/evasion/indicator-removal/timestamps::timestamp-anomaly",
            "l": 2
          },
          {
            "c": 0.9300000071525574,
            "d": "External IPv4:port literal in rdata",
            "e": [
              "168.118.6.52:29569",
              "19.130.27.122:47762",
              "95.143.192.105:17629"
            ],
            "i": "objectives/command-and-control/infrastructure/ip-port::external-ipv4-port-rdata-large",
            "l": 1
          },
          {
            "a": "T1027.002",
            "c": 0.699999988079071,
            "d": "PE with very few imports",
            "e": [
              "binary.import_count = 0.00"
            ],
            "i": "objectives/command-and-control/dropper/execution/loader::pe-few-imports",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Writable and executable section (W^X violation)",
            "e": [
              ".text (size: 32256, perms: rwx)"
            ],
            "i": "metadata/hardening/memory::wx-section",
            "l": 3
          },
          {
            "c": 0.8500000238418579,
            "d": "High-entropy read-only .rdata section",
            "e": [
              ".rdata (size: 51200, entropy: 7.99)"
            ],
            "i": "metadata/binary/anomaly/signing::high-entropy-rdata-section",
            "l": 3
          },
          {
            "a": "T1027",
            "c": 0.8500000238418579,
            "d": "Regex component marker",
            "e": [
              ".data",
              ".data+.rdata = 163.5% of text (52736 / 32256 bytes)",
              ".rdata"
            ],
            "i": "objectives/anti-static/obfuscation/payload/section::large-encoded-config-section-cond-1--inline-29175",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "Regex component marker",
            "e": [
              ".rdata (entropy: 7.99)"
            ],
            "i": "objectives/anti-static/obfuscation/payload/section::encrypted-payload-section-cond-0--inline-29177",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.800000011920929,
            "d": "PE executable is unsigned",
            "e": [
              "binary.has_signature = 0.00"
            ],
            "i": "metadata/signed/trust-level::unsigned-pe-executable",
            "l": 3
          },
          {
            "a": "T1027",
            "c": 0.9599999785423279,
            "d": "Regex component marker",
            "e": [
              ".rdata",
              ".data+.rdata = 163.5% of text (52736 / 32256 bytes)",
              ".data"
            ],
            "i": "objectives/anti-static/obfuscation/payload/section::encrypted-loader-data-geometry-cond-1--inline-29194",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.8500000238418579,
            "d": "Regex component marker",
            "e": [
              ".data (entropy: 7.29, perms: rw-)",
              ".rdata (entropy: 7.99, perms: rw-)"
            ],
            "i": "objectives/anti-static/obfuscation/payload/section::large-encoded-config-section-cond-0--inline-29174",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1055",
            "c": 0.8999999761581421,
            "d": "Code cave suitable for code injection",
            "e": [
              ".text (size: 32256, perms: rwx)",
              "binary.func_count = 3.00",
              "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00"
            ],
            "i": "objectives/anti-static/obfuscation/binary-structure::injection-ready-cave",
            "l": 4
          },
          {
            "a": "T1027",
            "c": 0.8500000238418579,
            "d": "Large encoded configuration data section",
            "e": [
              ".data+.rdata = 163.5% of text (52736 / 32256 bytes)",
              ".data (entropy: 7.29, perms: rw-)",
              ".rdata (entropy: 7.99, perms: rw-)",
              ".data",
              ".rdata"
            ],
            "i": "objectives/anti-static/obfuscation/payload/section::large-encoded-config-section",
            "l": 4,
            "m": "B0032"
          }
        ],
        "sha": "7c4ac7b793201e38f4dbdfda71f2d73ae55d0437036e91ff372cefd982e623a6",
        "path": "VirusShare_badfc92044544cc5c9645bd3396e49b0",
        "type": "pe"
      }
    ],
    "tv": "60127"
  }
}