{ "ml": { "v": "7", "eng": "2.0.1-rc.1", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.000067045294, "rte": "az", "prob": 0.000067045294 }, { "cls": 0, "raw": 0.0029259026, "rte": "az/native", "prob": 0.0029259026 }, { "cls": 0, "raw": 0.12762688, "rte": "az/pe", "prob": 0.12762688 } ], "prob": 0.000067045294, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.00006704529369017109, "type": "pe" } ], "version": "v18.18", "analyzed_at": "2026-06-15T01:58:00Z" }, "path": "VirusShare_172a81d5c353c42764756e99ce7c885b", "raw": { "v": "7", "tv": "061e3", "files": [ { "id": 0, "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000\u003eL$O.4J\u0026m", "l": 0, "n": [ { "c": 2, "d": "ASLR enabled (DYNAMIC_BASE)", "i": "metadata/hardening/mitigation::pe-aslr", "o": 0, "z": 1 } ], "x": true }, { "b": "004\u003e){Tj]HF-.QOi0pKP56aLN[hkXa:nmQdG#gzr-]ZBlituh74[a!eh#ATPm2p", "l": 29737, "n": [ { "c": 2, "d": "RDRAND hardware random instruction", "i": "micro-behaviors/os/random/crypto::rdrand-instruction", "o": 29753, "z": 2 } ], "x": true }, { "b": "bQ!M=mRR]6g08.\u003e05axMlaGkX0093lt513qnqNHWy5!lcIf{M%nq/\u003eYd91.3aO(", "l": 362930, "n": [ { "c": 3, "d": "Executable memory allocation indicator", "i": "micro-behaviors/mem/alloc/executable::executable-allocation-indicator", "o": 362946, "z": 2 } ], "x": true }, { "b": "1POJ50000000000007azqE%](zdMWWA+eV\u0026006RkoL4TQwKyGLBzkk[y/s[PBzkVh004SPq/32R", "l": 386826, "n": [ { "c": 2, "d": "ResumeThread API reference", "i": "micro-behaviors/process/inject/runtime/call::resume-thread-dup", "o": 386842, "z": 12 } ], "x": true }, { "b": "BzkYgwLV=IwN/?6008G*lVM:DBy!A+A+eV\u0026007\u003cVs7b/+mSirCx(mN1wLV=IwN//Z1Qn4xwmXbwvrbs=o)7n]x*N8!wDikwl$HgCBy^/", "l": 386988, "n": [ { "c": 2, "d": "Wait for process/object", "i": "micro-behaviors/process/create/spawn::wait-for-single-object", "o": 387020, "z": 19 }, { "c": 2, "d": "CreateThread API name reference", "i": "micro-behaviors/process/threading/create::create-thread-text", "o": 387004, "z": 12 } ], "x": true }, { "b": "m}D^ovrlJVA=M8s006\u003eolVM:DBy^{Qy?k)jU(WBbBwN0@v)KToA+frk002UXqCGUOgCQN[y?%7K00000000000000000000000000000000000000", "l": 387218, "n": [ { "c": 2, "d": "CreateFile API string reference", "i": "micro-behaviors/fs/file/open::createfile-api", "o": 387234, "z": 10 }, { "c": 2, "d": ".dll extension reference", "i": "micro-behaviors/fs/path/extension::dll-dup", "o": 387272, "z": 4 } ], "x": true }, { "b": "00000000000000000000CZaBSCZ1BTD3BTVDu\u003c*ZDuTTWD3KQUDu\u003c:YDuTWVCZ1vRD3TZWDu:WWCx[BTCZjHVCZ1yRD3TZVCxXvVCZ1EUCxXsTDuTTVCx!yUDu%)YCxXmRCZsWXD3BNVD3sEUCZ1vSD3sETDuTNUCZaEVD3BKUCZsNWDuTNVCZjHVDuTQWDuTTUCZaEUDu\u003c*.Du\u003c^YD3sKVDuTNT", "l": 388592, "n": [ { "c": 2, "d": "Packed target-extension-like blob", "i": "objectives/impact/ransom/encrypt/extension::target-ext-archive-blob", "o": 388608, "z": 128 } ], "x": true }, { "b": "CZsWWDuTNTCZsTXCZjHVCx!BWD3KQVDu\u003c*.Cx[yUD3T^XDu%*YDu%*ZCZ1vSD3TZWD3BQUCy1ETCZsNUCx!vTCxXmRCx[ETCxXsRDuTQVDu%^VCZsTYCZ1EUCx[HVCx!vSCx!sTD3BTYDu%).CZsTVDu%*YCZ1yUD3TZWDu\u003c^XCZaKUDuTQUCx[EUCx!vRCZ1BUCZaBSCy1HWDu%\u003cXCx[BTCx[HUCZjHVDu:TVCy1ESDuTNVD3TZXD3sETCx!BUD3sERD3sNVD3sHSCZsTVDu:WVD3T^.D3o", "l": 389112, "n": [ { "c": 2, "d": "Windows file creation/open API", "i": "micro-behaviors/fs/file/open::file-create-win", "o": 389288, "z": 11 }, { "c": 2, "d": "Heap memory allocation", "i": "micro-behaviors/mem/alloc/heap::heap-alloc", "o": 389264, "z": 9 }, { "c": 2, "d": "Heap memory deallocation", "i": "micro-behaviors/mem/alloc/heap::heap-free", "o": 389152, "z": 8 }, { "c": 2, "d": "Heap memory reallocation", "i": "micro-behaviors/mem/alloc/heap::heap-realloc", "o": 389224, "z": 11 }, { "c": 2, "d": "Dynamically resolve own modules and exports", "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "o": 389248, "z": 16 }, { "c": 2, "d": "Enter critical section", "i": "micro-behaviors/process/sync/critical-section::critical-section-enter", "o": 389160, "z": 20 }, { "c": 2, "d": "Leave critical section", "i": "micro-behaviors/process/sync/critical-section::critical-section-leave", "o": 389128, "z": 20 }, { "c": 2, "d": "Create thread in current process", "i": "micro-behaviors/process/thread/create::create-thread", "o": 389192, "z": 12 } ], "x": true } ], "mol": "H(Mg)", "sha": "7f050a107f282e73b45c4e9410891a4eaa4c93565ffc569ca7e13b067ae6c8f8", "fact": { "id": "pe", "exp": [ [ "DbxgvWwmtyAladteko" ], [ "HoosbudndpxQfovmhychzuocb" ], [ "PmindojrstfmZfjnxazkbq" ], [ "StartW" ], [ "WckmtplvcjSrufhplgZnocyixsc" ] ], "imp": [ [ "kernel32", "ResumeThread" ], [ "kernel32", "LeaveCriticalSection" ], [ "kernel32", "Sleep" ], [ "kernel32", "TlsGetValue" ], [ "kernel32", "HeapFree" ], [ "kernel32", "EnterCriticalSection" ], [ "kernel32", "GetCurrentThread" ], [ "kernel32", "DuplicateHandle" ], [ "kernel32", "WaitForMultipleObjects" ], [ "kernel32", "CreateThread" ], [ "kernel32", "WaitForSingleObject" ], [ "kernel32", "WideCharToMultiByte" ], [ "kernel32", "DeleteCriticalSection" ], [ "kernel32", "HeapReAlloc" ], [ "kernel32", "InitializeCriticalSection" ], [ "kernel32", "GetThreadPriority" ], [ "kernel32", "GetModuleHandleA" ], [ "kernel32", "GetProcessHeap" ], [ "kernel32", "HeapAlloc" ], [ "kernel32", "GetCommandLineW" ], [ "kernel32", "GetLastError" ], [ "kernel32", "CreateFileA" ], [ "kernel32", "GetProcAddress" ] ], "met": { "pe": { "checksum": 453311.0, "checksum_valid": 0.0, "computed_checksum": 443367.0, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0 }, "file": { "size": 399360.0, "entropy": 6.6, "size_bytes": 399360.0 }, "binary": { "is_pie": 1.0, "code_entropy": 6.6, "data_entropy": 2.22, "string_count": 66.0, "overall_entropy": 6.6, "entropy_variance": 5.16, "avg_string_length": 134.17, "max_string_length": 8192.0, "code_to_data_ratio": 0.97, "string_length_stddev": 999.48, "largest_section_ratio": 0.96, "sentence_string_count": 1.0, "sentence_string_ratio": 0.02, "high_entropy_string_count": 0.0 }, "exports": { "count": 5.0 }, "imports": { "count": 23.0 }, "sections": { "count": 5.0, "code_size": 385024.0, "entropy_max": 6.6, "entropy_mean": 2.9, "name_entropy": 2.55, "writable_count": 2.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } }, "sec": [ [ ".text", 1024, 385024, 6.6, "r-x" ], [ ".rdata", 386048, 1536, 4.17, "r--" ], [ ".data", 387584, 512, 0.2, "rw-" ], [ ".pdata", 388096, 512, 1.22, "r--" ], [ ".tdata", 388608, 10752, 2.32, "rw-" ] ], "str": [ [ 77, "u8", "!This program cannot be run in DOS mode." ], [ 496, "u8", ".text" ], [ 575, "u8", "@.data" ], [ 616, "u8", ".pdata" ], [ 655, "u8", "@.tdata" ], [ 1024, "u8", "UAWAVAUATVWSH" ], [ 1476, "u8", "VUUUH" ], [ 7591, "stack", "cCn(" ], [ 44161, "stack", "l*?6" ], [ 53379, "stack", "pu=F" ], [ 65440, "u8", "wwwwH" ], [ 96060, "stack", "?iC5" ], [ 103399, "stack", "U()Z" ], [ 111128, "u8", "2333" ], [ 113190, "stack", "$Lqb" ], [ 125586, "stack", "xXUm" ], [ 134618, "stack", "T;Q-" ], [ 163798, "stack", "Ev^@" ], [ 166735, "stack", "$DaY" ], [ 167544, "u8", "5FBY" ], [ 200712, "stack", "8q\u003ev" ], [ 223882, "stack", "kTl(" ], [ 247725, "stack", "t~kJ" ], [ 251437, "stack", "D5No" ], [ 260243, "stack", "KPTX" ], [ 289760, "stack", "?./)" ], [ 305696, "stack", ";C{W" ], [ 308415, "stack", ";C{W" ], [ 314502, "stack", "t4LT" ], [ 342977, "stack", "FG9}" ], [ 343440, "u8", "AWAVAUATVWUSH" ], [ 343664, "u8", "Ohiy" ], [ 344306, "stack", "h{y%" ], [ 354998, "stack", "L*SH" ], [ 359927, "u8", "fy3E1" ], [ 359972, "stack", "\u003eDoV" ], [ 386502, "u8", "StartW" ], [ 386509, "u8", "DbxgvWwmtyAladteko" ], [ 386528, "u8", "HoosbudndpxQfovmhychzuocb" ], [ 386554, "u8", "PmindojrstfmZfjnxazkbq" ], [ 386577, "u8", "WckmtplvcjSrufhplgZnocyixsc" ], [ 386842, "u8", "ResumeThread" ], [ 386858, "u8", "LeaveCriticalSection" ], [ 386882, "u8", "Sleep" ], [ 386890, "u8", "TlsGetValue" ], [ 386904, "u8", "HeapFree" ], [ 386916, "u8", "EnterCriticalSection" ], [ 386940, "u8", "GetCurrentThread" ], [ 386960, "u8", "DuplicateHandle" ], [ 386978, "u8", "WaitForMultipleObjects" ], [ 387004, "u8", "CreateThread" ], [ 387020, "u8", "WaitForSingleObject" ], [ 387042, "u8", "WideCharToMultiByte" ], [ 387064, "u8", "DeleteCriticalSection" ], [ 387088, "u8", "HeapReAlloc" ], [ 387102, "u8", "InitializeCriticalSection" ], [ 387130, "u8", "GetThreadPriority" ], [ 387150, "u8", "GetModuleHandleA" ], [ 387170, "u8", "GetProcessHeap" ], [ 387188, "u8", "HeapAlloc" ], [ 387200, "u8", "GetCommandLineW" ], [ 387218, "u8", "GetLastError" ], [ 387234, "u8", "CreateFileA" ], [ 387248, "u8", "GetProcAddress" ], [ 387264, "u8", "KERNEL32.dll" ], [ 388608, "u8", "xxwxxwyxyxzwzyzyzwyyyywxzyxzzwzwxwwxyzxxzxxywyxxxywzxwxwyzxwwwzzxwzxwwyyzwyxwxyyzzzwwwwyxzzxyxxyywwzxwwyywwyzwwyxxxzyxwyxzwzzwwz" ] ], "val": { "file.stem": "VirusShare_172a81d5c353c42764756e99ce7c885b", "pe.imphash": "c516d3218148ae26c7a8a3e8d670b133", "pe.machine": "x86_64", "pe.subsystem": "native", "pe.timestamp": 1636487566, "file.basename": "VirusShare_172a81d5c353c42764756e99ce7c885b", "pe.image_base": 6442450944, "pe.image_size": 413696, "pe.machine_id": 34404, "pe.os_version": "6.0", "pe.entry_point": 361600, "pe.headers_size": 1024, "pe.entry_section": ".text", "pe.subsystem_raw": 1, "pe.file_alignment": 512, "pe.image_hash.sha1": "b940a3c22be06b2f2932addda52f2f65fa930902", "pe.export_timestamp": 4294967295, "pe.image_hash.sha256": "2d5f1b0e57f55731b94afa81d734c7357a4eaa66d973c35b2072466e5059a720", "pe.image_hash.sha384": "2c38aef714d8dc86576ccf0ba559105c8e6f6e5fb81c603d07ff9c3b7ce7e7c0df7e0df99d2c38e73e48200973931bb3", "pe.image_hash.sha512": "96dddc40edb14541fac2f3a7169f6184918121cc1e8b434fa9904617bf8b856069783230ec3460ea80c94e64b9eadcea008233b0108b94bc210094e27b6708ff", "pe.section_alignment": 4096, "pe.subsystem_version": "6.0", "pe.characteristics[0]": "executable_image", "pe.characteristics[1]": "large_address_aware", "pe.characteristics[2]": "dll", "pe.characteristics_raw": 8226, "pe.dll_characteristics[0]": "high_entropy_va", "pe.dll_characteristics[1]": "dynamic_base", "pe.dll_characteristics[2]": "nx_compat", "pe.data_directories[0].rva": 389472, "pe.data_directories[1].rva": 389680, "pe.data_directories[2].rva": 397312, "pe.data_directories[3].rva": 389120, "pe.dll_characteristics_raw": 352, "pe.number_of_rva_and_sizes": 16, "pe.data_directories[0].name": "export", "pe.data_directories[0].size": 208, "pe.data_directories[1].name": "import", "pe.data_directories[1].size": 40, "pe.data_directories[2].name": "exception", "pe.data_directories[2].size": 108, "pe.data_directories[3].name": "iat", "pe.data_directories[3].size": 192, "pe.coff.dos_header_pe_pointer": 232 } }, "find": [ { "id": "micro-behaviors/mem/alloc/executable::page-execute-readwrite-arg-x64", "atk": "T1055", "conf": 0.699999988079071, "crit": 1, "desc": "Load PAGE_EXECUTE_READWRITE into r8d/r9d" }, { "id": "micro-behaviors/os/module/load::get-module-handle-ansi", "conf": 0.699999988079071, "crit": 2, "desc": "Get module handle ANSI" }, { "id": "micro-behaviors/os/module/load::get-proc-address-import", "conf": 0.8999999761581421, "crit": 2, "desc": "Resolve exports with GetProcAddress" }, { "id": "metadata/binary/metrics/structural::dominant-section", "conf": 0.6000000238418579, "crit": 3, "desc": "Single section dominates binary layout" }, { "id": "micro-behaviors/mem/alloc/executable::executable-allocation-indicator", "atk": "T1055", "conf": 0.8199999928474426, "crit": 3, "desc": "Executable memory allocation indicator" } ], "path": "/data/samples/bad/datasets/various/VirusShare/VirusShare_172a81d5c353c42764756e99ce7c885b", "risk": 2, "size": 399360, "type": "pe" } ] } }