{ "ml": { "v": "7", "eng": "2.0.1-rc.1", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.17920144, "rte": "az", "prob": 0.17920144 }, { "cls": 0, "raw": 0.18038476, "rte": "az/native", "prob": 0.18038476 }, { "cls": 0, "raw": 0.5819814, "rte": "az/pe", "prob": 0.5819814 } ], "prob": 0.17920144, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.17920143902301788, "type": "pe" } ], "version": "v18.18", "analyzed_at": "2026-06-15T04:14:13Z" }, "path": "7d0c39b7053943ccd4a41704d44c83feed6306ea086a1c72ee26ecf99ed1c83c.exe", "raw": { "v": "7", "tv": "061e3", "files": [ { "id": 0, "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J\u0026m(0ji6Sa?dLD+]{51x(+zoA=kPhvqNb%vqY$3BrC47", "l": 0, "n": [ { "c": 3, "d": "PE binary has trailing overlay data", "i": "metadata/binary/layout::has-overlay", "o": 0, "z": 25 } ], "x": true }, { "b": "0fg+TcJBbCaohxw04E%Glq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn", "l": 1906264, "n": [ { "c": 2, "d": ".NET Metadata Root (BSJB)", "i": "metadata/binary/framework::dotnet-metadata", "o": 1906280, "z": 4 } ], "x": true }, { "b": "000000000Yo(BM+y?k^gq*ACawO\u003c4\u003epxklMv@Dy7x\u003c}6ewmx7XwmxaWw[bsXv}e}Sw)]gTw[bpVwm/rKo\u003e!9Tz/Y\u0026eBs{QdB9g]clsB}Hv/PFwA+eV\u002608drtwb]hsC5Iec0b2\u003e+uRU3DwDk!Lx-", "l": 1911446, "n": [ { "c": 2, "d": "mscorlib reference", "i": "metadata/lang/compiler/managed::mscorlib", "o": 1911472, "z": 8 }, { "c": 2, "d": "System namespace reference", "i": "metadata/lang/compiler/managed::system-namespace", "o": 1911462, "z": 9 }, { "c": 2, "d": "Visual Basic runtime reference", "i": "metadata/lang/compiler/managed::visual-basic-runtime", "o": 1911510, "z": 21 } ], "x": true }, { "b": "v}f1Sv}GdVvp\u003c1UvQ%7Xe[Gos08^lywn=s0DsW7PD2[7sz7X!3A+eV\u0026x(mL-q/)4]", "l": 1911684, "n": [ { "c": 2, "d": ".exe extension reference", "i": "micro-behaviors/fs/path/extension::exe-dup", "o": 1911700, "z": 4 } ], "x": true }, { "b": "wPE\u0026rx(mD}zF8BPvp%SYq*ACawO\u003c53x(mE1Cxkxaz/PYo08^@SBzkP6nm=QRwPz?(m}D^svrb^[wPRH7A@XQD", "l": 1911993, "n": [ { "c": 2, "d": "Windows Forms UI framework", "i": "metadata/lang/compiler/managed::winforms-ui", "o": 1912009, "z": 20 } ], "x": true }, { "b": "AZ+j:o\u003c}:N0bV^!z/PA2e[w^m000000rjtBav2]b0000000000000000000000000", "l": 1931909, "n": [ { "c": 2, "d": ".dll extension reference", "i": "micro-behaviors/fs/path/extension::dll-dup", "o": 1931925, "z": 4 } ], "x": true }, { "b": "000000000000000000000fwi33\u0026*ncPF#]K000000000000000000000000000000000", "l": 1932272, "n": [ { "c": 2, "d": "PE .reloc section presence", "i": "metadata/binary/section/names::reloc-section-presence", "o": 1932288, "z": 6 } ], "x": true } ], "idn": { "trust": "self_signed", "signer": { "issuer": "C=US,L=New York,OU=Dafcfcfdbcfaecaddaeceda,O=Cacffcefbceffedad,CN=Bdfbacdcdbdadbdbaebda", "source": "pe.signatures[0]", "subject": "C=US,L=New York,OU=Dafcfcfdbcfaecaddaeceda,O=Cacffcefbceffedad,CN=Bdfbacdcdbdadbdbaebda", "common_name": "Bdfbacdcdbdadbdbaebda", "organization": "Cacffcefbceffedad" }, "unique_ids": { "authenticode_thumbprint_sha256": "f64d55345bb5459de74b629133738ca390b8266f9cf21a0ba4c7a70843ab51b2" }, "organization": { "value": "Cacffcefbceffedad", "source": "pe.signatures[0]", "verified": true } }, "mol": "Md₂(BiSi₂)", "sha": "7d0c39b7053943ccd4a41704d44c83feed6306ea086a1c72ee26ecf99ed1c83c", "fact": { "id": "pe", "imp": [ [ "mscoree", "CorExeMain" ] ], "met": { "pe": { "checksum": 1965725.0, "checksum_valid": 1.0, "cert_table_size": 6320.0, "computed_checksum": 1965725.0, "reloc_overhang_bytes": 500.0, "reloc_overhang_ratio": 0.98, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0 }, "file": { "size": 1939120.0, "entropy": 5.0, "size_bytes": 1939120.0 }, "binary": { "is_pie": 1.0, "has_overlay": 1.0, "code_entropy": 4.98, "overlay_size": 6320.0, "string_count": 111.0, "overlay_ratio": 0.0, "overall_entropy": 5.0, "overlay_entropy": 7.51, "entropy_variance": 5.96, "avg_string_length": 18.48, "max_string_length": 66.0, "code_to_data_ratio": 1.0, "string_length_stddev": 13.68, "largest_section_ratio": 1.0, "sentence_string_count": 8.0, "sentence_string_ratio": 0.07, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 2.0, "code_size": 1931776.0, "entropy_max": 4.98, "entropy_mean": 2.54, "name_entropy": 2.91, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } }, "sec": [ [ ".text", 512, 1931776, 4.98, "r-x" ], [ ".reloc", 1932288, 512, 0.1, "r--" ] ], "str": [ [ 77, "u8", "!This program cannot be run in DOS mode." ], [ 376, "u8", ".text" ], [ 247372, "u8", "% sh" ], [ 1906280, "u8", "BSJB" ], [ 1911453, "u8", "\u003cModule\u003e" ], [ 1911462, "u8", "System.IO" ], [ 1911472, "u8", "mscorlib" ], [ 1911481, "u8", "Bdbdedbecfcccccacfacafcbbdfc" ], [ 1911510, "u8", "Microsoft.VisualBasic" ], [ 1911532, "u8", "Thread" ], [ 1911539, "u8", "Load" ], [ 1911544, "u8", "Invoke" ], [ 1911551, "u8", "get_Name" ], [ 1911560, "u8", "WriteLine" ], [ 1911570, "u8", "Combine" ], [ 1911578, "u8", "get_IsValueType" ], [ 1911594, "u8", "get_ReturnType" ], [ 1911609, "u8", "get_ParameterType" ], [ 1911627, "u8", "GetType" ], [ 1911635, "u8", "MethodBase" ], [ 1911646, "u8", "Write" ], [ 1911652, "u8", "Byte" ], [ 1911657, "u8", "GetObjectValue" ], [ 1911672, "u8", "Bdbdedbecfcccccacfacafcbbdfc.exe" ], [ 1911705, "u8", "Randomize" ], [ 1911715, "u8", "System.Threading" ], [ 1911732, "u8", "String" ], [ 1911739, "u8", "Debug" ], [ 1911745, "u8", "VBMath" ], [ 1911752, "u8", "Path" ], [ 1911757, "u8", "System" ], [ 1911764, "u8", "IsAssignableFrom" ], [ 1911781, "u8", "AppDomain" ], [ 1911791, "u8", "GetDomain" ], [ 1911801, "u8", "Application" ], [ 1911813, "u8", "System.Reflection" ], [ 1911831, "u8", "ArgumentNullException" ], [ 1911853, "u8", "MethodInfo" ], [ 1911864, "u8", "MemberInfo" ], [ 1911875, "u8", "ParameterInfo" ], [ 1911889, "u8", "IMessageFilter" ], [ 1911904, "u8", "AddMessageFilter" ], [ 1911921, "u8", ".ctor" ], [ 1911927, "u8", ".cctor" ], [ 1911934, "u8", "System.Diagnostics" ], [ 1911953, "u8", "GetMethods" ], [ 1911964, "u8", "System.Runtime.CompilerServices" ], [ 1911996, "u8", "BindingFlags" ], [ 1912009, "u8", "System.Windows.Forms" ], [ 1912030, "u8", "RuntimeHelpers" ], [ 1912045, "u8", "GetParameters" ], [ 1912059, "u8", "DoEvents" ], [ 1912068, "u8", "Concat" ], [ 1912075, "u8", "Format" ], [ 1912082, "u8", "Object" ], [ 1912089, "u8", "get_EntryPoint" ], [ 1912104, "u8", "Assembly" ], [ 1912113, "u8", "op_Equality" ], [ 1912125, "u8", "op_Inequality" ], [ 1930366, "u8", "c8e21e59-9c3d-4098-b324-66d4f3f71b3a" ], [ 1930484, "u8", "736f8844-2b53-438e-8376-46a38d85f6cf" ], [ 1930558, "u8", "56200612-5fdf-4689-af04-815f67befb21" ], [ 1930632, "u8", "f8c178e7-daee-4b62-a719-2a7f6b684da1" ], [ 1930706, "u8", "0a373803-623e-4a88-93ca-603888f81b5d" ], [ 1930780, "u8", "a3830750-a047-4123-9f08-c5270cdf9cc3" ], [ 1930854, "u8", "a5f296bb-84b7-45fe-8ce1-a0bf6db40d08" ], [ 1930928, "u8", "9e639ee6-2c86-44f2-ab16-4a6237405d00" ], [ 1931918, "u8", "mscoree.dll" ], [ 1932866, "u8", "N0L0" ], [ 1933008, "u8", "Bdfbacdcdbdadbdbaebda1" ], [ 1933040, "u8", "Cacffcefbceffedad1 0" ], [ 1933068, "u8", "Dafcfcfdbcfaecaddaeceda1" ], [ 1933127, "u8", "201216052129Z" ], [ 1933446, "u8", "C0A0" ], [ 1934302, "u8", "20201216052130Z" ], [ 1934350, "u8", "Greater Manchester1" ], [ 1934379, "u8", "Salford1" ], [ 1934397, "u8", "Sectigo Limited1,0*" ], [ 1934422, "u8", "#Sectigo RSA Time Stamping Signer #2" ], [ 1934582, "u8", "Sectigo Limited1%0#" ], [ 1934608, "u8", "Sectigo RSA Time Stamping CA0" ], [ 1934655, "u8", "320122235959Z0" ], [ 1934767, "u8", "#Sectigo RSA Time Stamping Signer #20" ], [ 1935286, "u8", "vIhb" ], [ 1935487, "u8", "90705" ], [ 1935522, "u8", "https://sectigo.com/CPS0D" ], [ 1935563, "u8", "3http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t" ], [ 1935644, "u8", "3http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#" ], [ 1935710, "u8", "http://ocsp.sectigo.com0" ], [ 1935806, "u8", "WUpKN" ], [ 1936338, "u8", "New Jersey1" ], [ 1936359, "u8", "Jersey City1" ], [ 1936381, "u8", "The USERTRUST Network1.0," ], [ 1936412, "u8", "%USERTrust RSA Certification Authority0" ], [ 1936454, "u8", "190502000000Z" ], [ 1937315, "u8", "I0G0E" ], [ 1937325, "u8", "?http://crl.usertrust.com/USERTrustRSACertificationAuthority.crl0v" ], [ 1937418, "u8", "3http://crt.usertrust.com/USERTrustRSAAddTrustCA.crt0%" ], [ 1937484, "u8", "http://ocsp.usertrust.com0" ], [ 1937687, "u8", "mAmg" ], [ 1938154, "u8", "Sectigo RSA Time Stamping CA" ], [ 1938527, "u8", "%USERTrust RSA Certification Authority" ], [ 1938652, "u8", "Hi10R" ], [ 1930366, "wide", "c8e21e59-9c3d-4098-b324-66d4f3f71b3a" ], [ 1930484, "wide", "736f8844-2b53-438e-8376-46a38d85f6cf" ], [ 1930558, "wide", "56200612-5fdf-4689-af04-815f67befb21" ], [ 1930632, "wide", "f8c178e7-daee-4b62-a719-2a7f6b684da1" ], [ 1930706, "wide", "0a373803-623e-4a88-93ca-603888f81b5d" ], [ 1930780, "wide", "a3830750-a047-4123-9f08-c5270cdf9cc3" ], [ 1930854, "wide", "a5f296bb-84b7-45fe-8ce1-a0bf6db40d08" ], [ 1930928, "wide", "9e639ee6-2c86-44f2-ab16-4a6237405d00" ] ], "val": { "file.stem": "7d0c39b7053943ccd4a41704d44c83feed6306ea086a1c72ee26ecf99ed1c83c", "pe.imphash": "f34d5f2d4577ed6d9ceec516c1f5a744", "pe.machine": "i386", "pe.subsystem": "windows_gui", "pe.timestamp": 1608096089, "file.basename": "7d0c39b7053943ccd4a41704d44c83feed6306ea086a1c72ee26ecf99ed1c83c.exe", "pe.image_base": 4194304, "pe.image_size": 1949696, "pe.machine_id": 332, "pe.os_version": "4.0", "pe.entry_point": 1939614, "pe.headers_size": 512, "pe.entry_section": ".text", "pe.subsystem_raw": 2, "pe.clr.is_il_only": 1, "pe.file_alignment": 512, "pe.image_hash.sha1": "2d691cfb688a7bdd88ecacede7fe2351a5bfffed", "pe.image_hash.sha256": "e3352eb42c321e003a23c75c4505c9d18d439d911cd9a06ab9d50334b9ea90e0", "pe.image_hash.sha384": "f3a66545f2cfbc4abafb32d8001720ce1f4812c8826281eae96f0ce2b7cd0eeb4165b5b8f61e6adabf4d38b287774f4c", "pe.image_hash.sha512": "58bdca6b8739b8b34f41e5c09aa856cb3cbd133f5d6f25fc3b9e697d67d46240e87368a2c4785acbaf29c1c96079868adb1a93c17ff4136461115365da4573c8", "pe.section_alignment": 8192, "pe.subsystem_version": "4.0", "pe.characteristics[0]": "executable_image", "pe.characteristics[1]": "32bit_machine", "pe.characteristics_raw": 258, "pe.clr.runtime_version": "2.5", "pe.linker_major_version": 11, "pe.signatures[0].issuer": "C=US,L=New York,OU=Dafcfcfdbcfaecaddaeceda,O=Cacffcefbceffedad,CN=Bdfbacdcdbdadbdbaebda", "pe.signatures[0].serial": "5f3d75f82fcb4993b4cff80e526d31a0", "pe.signatures[0].subject": "C=US,L=New York,OU=Dafcfcfdbcfaecaddaeceda,O=Cacffcefbceffedad,CN=Bdfbacdcdbdadbdbaebda", "pe.dll_characteristics[0]": "dynamic_base", "pe.dll_characteristics[1]": "nx_compat", "pe.dll_characteristics[2]": "no_seh", "pe.dll_characteristics[3]": "terminal_server_aware", "pe.signatures[0].verified": true, "pe.data_directories[0].rva": 1939528, "pe.data_directories[1].rva": 1932800, "pe.data_directories[2].rva": 1941504, "pe.data_directories[3].rva": 8192, "pe.data_directories[4].rva": 8200, "pe.dll_characteristics_raw": 34112, "pe.number_of_rva_and_sizes": 16, "pe.signatures[0].not_after": "2021-12-16T05:21:29Z", "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 83, "pe.data_directories[1].name": "certificate", "pe.data_directories[1].size": 6320, "pe.data_directories[2].name": "base_relocation", "pe.data_directories[2].size": 12, "pe.data_directories[3].name": "iat", "pe.data_directories[3].size": 8, "pe.data_directories[4].name": "clr_runtime_header", "pe.data_directories[4].size": 72, "pe.signatures[0].not_before": "2020-12-16T05:21:29Z", "pe.signatures[0].self_issued": true, "pe.coff.dos_header_pe_pointer": 128, "pe.base_relocations.block_count": 1, "pe.base_relocations.entry_count": 1, "pe.signatures[0].thumbprint_sha1": "77cdfb3f4df2d530acffea002a7644aa7055aa9e", "pe.base_relocations.padding_count": 1, "pe.signatures[0].cert_chain_depth": 1, "pe.signatures[0].digest_algorithm": "sha256", "pe.signatures[0].eku_code_signing": true, "pe.signatures[0].signature_digest": "e3352eb42c321e003a23c75c4505c9d18d439d911cd9a06ab9d50334b9ea90e0", "pe.signatures[0].thumbprint_sha256": "f64d55345bb5459de74b629133738ca390b8266f9cf21a0ba4c7a70843ab51b2", "pe.signatures[0].signature_algorithm": "sha256WithRSAEncryption", "pe.signatures[0].signature_digest_algorithm": "sha256" } }, "find": [ { "id": "metadata/signed/unknown::bdfbacdcdbdadbdbaebda", "conf": 1.0, "crit": 3, "desc": "Authenticode chain CN: Bdfbacdcdbdadbdbaebda" }, { "id": "metadata/signed/leaf::cacffcefbceffedad", "conf": 1.0, "crit": 3, "desc": "Signed by Cacffcefbceffedad" }, { "id": "metadata/signed/certificate::pe-signature-verified-kv", "conf": 1.0, "crit": 2, "desc": "PE Authenticode signature verified metadata" }, { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)" }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range" }, { "id": "metadata/binary/layout::has-overlay", "conf": 1.0, "crit": 3, "desc": "PE binary has trailing overlay data" } ], "path": "7d0c39b7053943ccd4a41704d44c83feed6306ea086a1c72ee26ecf99ed1c83c.exe", "risk": 4, "size": 1939120, "type": "pe" } ] } }