{ "ml": { "v": "7", "eng": "2.0.1-rc.1", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.00018826127, "rte": "az", "prob": 0.00018826127 }, { "cls": 0, "raw": 0.007774055, "rte": "az/native", "prob": 0.007774055 }, { "cls": 0, "raw": 0.108713515, "rte": "az/pe", "prob": 0.108713515 } ], "prob": 0.00018826127, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.0001882612705230713, "type": "pe" } ], "version": "v18.18", "analyzed_at": "2026-06-15T03:37:36Z" }, "path": "7f79358d80b4ebe3ca5466423594ce6d984cb1f81df7205268b9614e4f90d48d.exe", "raw": { "v": "7", "tv": "061e3", "files": [ { "id": 0, "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J\u0026m(0ji6Sa?dLD+]{51x(+zoA=kPhvqNb%vqY$3BrC47", "l": 0, "n": [ { "c": 3, "d": "PE stem disagrees with embedded PDB stem", "i": "objectives/evasion/masquerade/debug::pe-stem-differs-from-pdb-stem", "o": 0, "z": 1 } ], "x": true }, { "b": "2lj-70rr9i0W[lM017gQlq{Gy0rrc2000003\u0026*ncB#g*9e\u0026bgqf/Yjl000f5yYBCn", "l": 17036, "n": [ { "c": 2, "d": ".NET Metadata Root (BSJB)", "i": "metadata/binary/framework::dotnet-metadata", "o": 17052, "z": 4 } ], "x": true }, { "b": "zEl:TuTEduyH}K7wO:dTe[w^m0bV^!z/PVdvGotLB97#ge(3LawPzG{A@Yc:B97#ge\u003c\u003cL$wDkUOA@", "l": 24593, "n": [ { "c": 2, "d": "mscorlib reference", "i": "metadata/lang/compiler/managed::mscorlib", "o": 24614, "z": 8 }, { "c": 2, "d": ".dll extension reference", "i": "micro-behaviors/fs/path/extension::dll-dup", "o": 24609, "z": 4 } ], "x": true }, { "b": "wOkN{090JOBw=WUwmY=Yq*ACawO\u003c4\u003epxjv9CYW2cx(){b07HWswL3=KzVAZTA+eV@qE%oEwD", "l": 24753, "n": [ { "c": 2, "d": "System namespace reference", "i": "metadata/lang/compiler/managed::system-namespace", "o": 24769, "z": 9 } ], "x": true }, { "b": "y\u00260M?v}#6mlR7T6wnC/Sq*ACawO\u003c4$B-8qnzdLs\u003ezGGDgz/wS^A=#ebwPE\u0026uCYWImB7]Mgl3di?x\u003c#jbwDkUOB97#ge(D?fBzg", "l": 24962, "n": [ { "c": 2, "d": "Runtime interop services", "i": "metadata/lang/compiler/managed::runtime-interop", "o": 24978, "z": 30 } ], "x": true }, { "b": "q*ACawO\u003c\u003eXv}xR3x(v\u003e?l1t1JC42GhASx3WA+eV@s8@1%wPv=tzGY-mz/fA6zGC\u003eGlR7T6wb", "l": 25498, "n": [ { "c": 1, "d": "Dynamic object instantiation via Activator", "i": "objectives/anti-static/obfuscation/reflection/invoke::activator", "o": 25514, "z": 9 } ], "x": true }, { "b": "BzkVh07y^FzdN-@vR/PQq*ACawO\u003c4[x(m[\u003cmS\u0026PUu[}ZUA=k]dA==N#zF0!!lt{^UwNPDRq/)3", "l": 25581, "n": [ { "c": 3, "d": "LINQ query operations", "i": "micro-behaviors/data/db/linq::linq-queries", "o": 25597, "z": 11 } ], "x": true }, { "b": "x([60vqFkKBAh88B-.f{q*ACawO\u003c4#wN/\u003e6x([R2p\u00266MZw]zZbnKJLEzGP^@l2Z^hz/5]%zu9yNy\u0026\u003cv", "l": 25861, "n": [ { "c": 2, "d": "System namespace reference", "i": "metadata/lang/compiler/managed::system-namespace", "o": 25877, "z": 15 } ], "x": true }, { "b": "Abn@)wDkkiBwcm-xlm!!m}D^pwPRQ7wb]bhBvy7Sz!9N1x8(NQByd*xr+lq)x(v\u003e?xjVf(rS", "l": 28554, "n": [ { "c": 1, "d": "GetMethod call reference", "i": "objectives/anti-static/obfuscation/reflection/invoke::get-method-call", "o": 28570, "z": 9 } ], "x": true }, { "b": "l#MTTrb#XYzF9=%mr\u0026J/e[Gos00003aohxx0dZmP1u(@M1wn\u003e:1uDVt1rWXg1v\u0026OO", "l": 28882, "n": [ { "c": 2, "d": ".exe extension reference", "i": "micro-behaviors/fs/path/extension::exe-dup", "o": 28898, "z": 4 } ], "x": true }, { "b": "4j?G40aM0K06Hr8000(V06{-P1w5.N1vieS1tQ9E1t{rG1tfVPjT71]1t{rH1tZfA1uM-W1u=(E1uDVt1rWXg", "l": 30898, "n": [ { "c": 3, "d": "Cyrillic script detection (Russian/Ukrainian)", "i": "micro-behaviors/data/text/language::lang-russian", "o": 30914, "z": 20 } ], "x": true }, { "b": "000000000000000000000fvfX3\u0026*ncPG-zR000000000000000000000000000000000", "l": 33264, "n": [ { "c": 2, "d": "PE .reloc section presence", "i": "metadata/binary/section/names::reloc-section-presence", "o": 33280, "z": 6 } ], "x": true } ], "idn": { "trust": "unsigned", "build_path": { "value": "DoesTriangleExis.pdb", "source": "pe.debug.pdb.path", "verified": false } }, "mol": "O(Er)H(Db₂)", "sha": "7f79358d80b4ebe3ca5466423594ce6d984cb1f81df7205268b9614e4f90d48d", "fact": { "id": "pe", "imp": [ [ "mscoree", "CorExeMain" ] ], "met": { "pe": { "checksum": 0.0, "checksum_valid": 0.0, "checksum_stripped": 1.0, "computed_checksum": 76383.0, "reloc_overhang_bytes": 500.0, "reloc_overhang_ratio": 0.98, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0, "base_relocation_block_count": 1.0, "base_relocation_entry_count": 1.0 }, "file": { "size": 33792.0, "entropy": 5.27, "size_bytes": 33792.0 }, "binary": { "is_pie": 1.0, "code_entropy": 5.35, "string_count": 385.0, "overall_entropy": 5.27, "entropy_variance": 6.94, "avg_string_length": 11.45, "max_string_length": 44.0, "code_to_data_ratio": 1.0, "string_length_stddev": 6.06, "largest_section_ratio": 0.97, "sentence_string_count": 1.0, "sentence_string_ratio": 0.0, "high_entropy_string_count": 0.0 }, "imports": { "count": 1.0 }, "sections": { "count": 2.0, "code_size": 32768.0, "entropy_max": 5.35, "entropy_mean": 2.72, "name_entropy": 2.91, "writable_count": 0.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } }, "sec": [ [ ".text", 512, 32768, 5.35, "r-x" ], [ ".reloc", 33280, 512, 0.08, "r--" ] ], "str": [ [ 77, "u8", "!This program cannot be run in DOS mode." ], [ 376, "u8", ".text" ], [ 17052, "u8", "BSJB" ], [ 24297, "u8", "\u003cModule\u003e" ], [ 24306, "u8", "Program" ], [ 24314, "u8", "DoesTriangleExis" ], [ 24331, "u8", "IOSystem" ], [ 24340, "u8", "PABCSystem" ], [ 24351, "u8", "IOStandardSystem" ], [ 24368, "u8", "Text" ], [ 24373, "u8", "TypedSet" ], [ 24382, "u8", "AbstractBinaryFile" ], [ 24401, "u8", "TypedFile" ], [ 24411, "u8", "BinaryFile" ], [ 24422, "u8", "IntRange" ], [ 24431, "u8", "CharRange" ], [ 24441, "u8", "RealRange" ], [ 24451, "u8", "SystemIndex" ], [ 24463, "u8", "SliceType" ], [ 24473, "u8", "PABCSystem_implementation______" ], [ 24505, "u8", "NotPinnableWrapper" ], [ 24535, "u8", "PABCExtensions" ], [ 24550, "u8", "$ClassUnitAttr" ], [ 24565, "u8", "PABCExtensions_implementation______" ], [ 24601, "u8", "kernel32.dll" ], [ 24614, "u8", "mscorlib" ], [ 24623, "u8", "System.Numerics" ], [ 24639, "u8", "System.Core" ], [ 24651, "u8", "System" ], [ 24658, "u8", "Object" ], [ 24665, "u8", "IEnumerable" ], [ 24677, "u8", "System.Collections" ], [ 24696, "u8", "IEnumerable`1" ], [ 24710, "u8", "System.Collections.Generic" ], [ 24737, "u8", "Attribute" ], [ 24747, "u8", "BigInteger" ], [ 24758, "u8", "TextReader" ], [ 24769, "u8", "System.IO" ], [ 24779, "u8", "TextWriter" ], [ 24790, "u8", "FileInfo" ], [ 24799, "u8", "StreamReader" ], [ 24812, "u8", "Hashtable" ], [ 24822, "u8", "IEnumerator" ], [ 24834, "u8", "FileStream" ], [ 24845, "u8", "BinaryReader" ], [ 24858, "u8", "BinaryWriter" ], [ 24871, "u8", "Type" ], [ 24876, "u8", "ParamArrayAttribute" ], [ 24896, "u8", "IEnumerator`1" ], [ 24920, "u8", "ThreadStaticAttribute" ], [ 24942, "u8", "IAsyncResult" ], [ 24955, "u8", "AsyncCallback" ], [ 24969, "u8", "GCHandle" ], [ 24978, "u8", "System.Runtime.InteropServices" ], [ 25009, "u8", "ExtensionAttribute" ], [ 25028, "u8", "System.Runtime.CompilerServices" ], [ 25060, "u8", "Array" ], [ 25066, "u8", "MethodInfo" ], [ 25077, "u8", "System.Reflection" ], [ 25095, "u8", "Char" ], [ 25100, "u8", "Encoding" ], [ 25109, "u8", "System.Text" ], [ 25121, "u8", "Dictionary`2" ], [ 25134, "u8", "Random" ], [ 25141, "u8", "NumberFormatInfo" ], [ 25158, "u8", "System.Globalization" ], [ 25179, "u8", "DateTime" ], [ 25188, "u8", "Console" ], [ 25196, "u8", "StringBuilder" ], [ 25210, "u8", "IOException" ], [ 25222, "u8", "String" ], [ 25229, "u8", "FormatException" ], [ 25245, "u8", "OverflowException" ], [ 25263, "u8", "Convert" ], [ 25271, "u8", "IFormatProvider" ], [ 25287, "u8", "Debug" ], [ 25293, "u8", "System.Diagnostics" ], [ 25312, "u8", "Int32" ], [ 25318, "u8", "ICollection" ], [ 25330, "u8", "IComparable" ], [ 25342, "u8", "TypeCode" ], [ 25351, "u8", "Byte" ], [ 25356, "u8", "SByte" ], [ 25362, "u8", "Int16" ], [ 25368, "u8", "UInt16" ], [ 25375, "u8", "UInt32" ], [ 25382, "u8", "Int64" ], [ 25388, "u8", "UInt64" ], [ 25395, "u8", "DebuggerStepThroughAttribute" ], [ 25424, "u8", "ArrayList" ], [ 25434, "u8", "Double" ], [ 25441, "u8", "FieldInfo" ], [ 25451, "u8", "Decimal" ], [ 25459, "u8", "RuntimeTypeHandle" ], [ 25477, "u8", "Marshal" ], [ 25485, "u8", "BindingFlags" ], [ 25498, "u8", "SystemException" ], [ 25514, "u8", "Activator" ], [ 25524, "u8", "StreamWriter" ], [ 25537, "u8", "Environment" ], [ 25549, "u8", "GCHandleType" ], [ 25562, "u8", "Stream" ], [ 25569, "u8", "Binder" ], [ 25576, "u8", "Exception" ], [ 25586, "u8", "Enumerable" ], [ 25597, "u8", "System.Linq" ], [ 25616, "u8", "PropertyInfo" ], [ 25629, "u8", "Boolean" ], [ 25637, "u8", "StringSplitOptions" ], [ 25656, "u8", "Pointer" ], [ 25664, "u8", "Single" ], [ 25671, "u8", "Complex" ], [ 25679, "u8", "SortedDictionary`2" ], [ 25710, "u8", "MemberInfo" ], [ 25721, "u8", "MethodBase" ], [ 25732, "u8", "ParameterInfo" ], [ 25746, "u8", "ParameterModifier" ], [ 25764, "u8", "ValueType" ], [ 25774, "u8", "OperatingSystem" ], [ 25790, "u8", "Version" ], [ 25798, "u8", "UTF8Encoding" ], [ 25811, "u8", "Thread" ], [ 25818, "u8", "System.Threading" ], [ 25835, "u8", "CultureInfo" ], [ 25847, "u8", "SecuritySafeCriticalAttribute" ], [ 25877, "u8", "System.Security" ], [ 25893, "u8", "PlatformID" ], [ 25904, "u8", "Enum" ], [ 25909, "u8", "AppDomain" ], [ 25919, "u8", "MulticastDelegate" ], [ 25937, "u8", "SecurityRulesAttribute" ], [ 25960, "u8", "SecurityRuleSet" ], [ 25976, "u8", "AssemblyTitleAttribute" ], [ 25999, "u8", "AssemblyDescriptionAttribute" ], [ 26028, "u8", "DebuggableAttribute" ], [ 26048, "u8", "CompilationRelaxationsAttribute" ], [ 26080, "u8", "Main" ], [ 26085, "u8", "$static_init$" ], [ 26113, "u8", "$_InitVariables_" ], [ 26130, "u8", ".ctor" ], [ 26145, "u8", "peek" ], [ 26150, "u8", "read_symbol" ], [ 26162, "u8", "read" ], [ 26169, "u8", "readln" ], [ 26176, "u8", "ReadLine" ], [ 26185, "u8", "ReadLexem" ], [ 26195, "u8", "write" ], [ 26207, "u8", "writeln" ], [ 26222, "u8", "ReadNextBuf" ], [ 26234, "u8", ".cctor" ], [ 26244, "u8", "state" ], [ 26262, "u8", "realbuflen" ], [ 26282, "u8", "Contains" ], [ 26291, "u8", "elem" ], [ 26300, "u8", "low_bound" ], [ 26310, "u8", "upper_bound" ], [ 26327, "u8", "Clip" ], [ 26332, "u8", "IsInDiapason" ], [ 26345, "u8", "AssignSetFrom" ], [ 26361, "u8", "initValue" ], [ 26371, "u8", "GetEnumerator" ], [ 26385, "u8", "ToString" ], [ 26406, "u8", "ElementType" ], [ 26423, "u8", "offsets" ], [ 26431, "u8", "GetFilePos" ], [ 26442, "u8", "get_Position" ], [ 26455, "u8", "Seek" ], [ 26462, "u8", "set_Position" ], [ 26475, "u8", "ElementSize" ], [ 26487, "u8", "offset" ], [ 26494, "u8", "Position" ], [ 26503, "u8", "get_Low" ], [ 26511, "u8", "get_High" ], [ 26524, "u8", "System.Collections.IEnumerable.GetEnumerator" ], [ 26569, "u8", "Equals" ], [ 26578, "u8", "GetHashCode" ], [ 26594, "u8", "High" ], [ 26599, "u8", "get_\u003c\u003enonPublicl0" ], [ 26617, "u8", "set_\u003c\u003enonPublicl0" ], [ 26635, "u8", "value" ], [ 26641, "u8", "get_\u003c\u003enonPublicl1" ], [ 26659, "u8", "set_\u003c\u003enonPublicl1" ], [ 26677, "u8", "get_\u003c\u003enonPublicl2" ], [ 26695, "u8", "set_\u003c\u003enonPublicl2" ], [ 26713, "u8", "\u003c\u003enonPublicl0" ], [ 26727, "u8", "\u003c\u003enonPublicl1" ], [ 26741, "u8", "\u003c\u003enonPublicl2" ], [ 26755, "u8", "get_IndexValue" ], [ 26770, "u8", "set_IndexValue" ], [ 26785, "u8", "get_IsInverted" ], [ 26804, "u8", "inverted" ], [ 26813, "u8", "IndexValue" ], [ 26824, "u8", "IsInverted" ], [ 26846, "u8", "situation" ], [ 26869, "u8", "count" ], [ 26875, "u8", "fromInverted" ], [ 26888, "u8", "toInverted" ], [ 26899, "u8", "notPinnableTypes" ], [ 26916, "u8", "Invoke" ], [ 26923, "u8", "BeginInvoke" ], [ 26935, "u8", "callback" ], [ 26944, "u8", "'object'" ], [ 26953, "u8", "EndInvoke" ], [ 26963, "u8", "result" ], [ 26970, "u8", "TypedFileInit" ], [ 26984, "u8", "RunTimeSizeOf" ], [ 26998, "u8", "Writeln" ], [ 27011, "u8", "InSet" ], [ 27017, "u8", "Write" ], [ 27023, "u8", "PointerToString" ], [ 27039, "u8", "ReadReal" ], [ 27048, "u8", "prompt" ], [ 27055, "u8", "Print" ], [ 27071, "u8", "Read" ], [ 27076, "u8", "ReadString" ], [ 27087, "u8", "__FixPointer" ], [ 27100, "u8", "__FinalizeModule__" ], [ 27119, "u8", "RuntimeInitialize" ], [ 27142, "u8", "variable" ], [ 27151, "u8", "FilePos" ], [ 27159, "u8", "Format" ], [ 27166, "u8", "formatstring" ], [ 27184, "u8", "Range" ], [ 27204, "u8", "IsInputPipedOrRedirectedFromFile" ], [ 27247, "u8", "StrToInt" ], [ 27256, "u8", "__IS_SYSTEM_MODULE" ], [ 27275, "u8", "output" ], [ 27282, "u8", "input" ], [ 27288, "u8", "ErrOutput" ], [ 27298, "u8", "CurrentIOSystem" ], [ 27314, "u8", "IsConsoleApplication" ], [ 27335, "u8", "DefaultEncoding" ], [ 27351, "u8", "PrintDelimDefault" ], [ 27369, "u8", "__CONFIG__" ], [ 27389, "u8", "GetTranslation" ], [ 27404, "u8", "message" ], [ 27412, "u8", "GetCurrentLocale" ], [ 27429, "u8", "GetNullBasedArray" ], [ 27451, "u8", "convert_elem" ], [ 27464, "u8", "write_in_output" ], [ 27480, "u8", "StructuredObjectToString" ], [ 27505, "u8", "FormatFloatNumber" ], [ 27523, "u8", "ArrNToString" ], [ 27536, "u8", "indexes" ], [ 27546, "u8", "RedefinedToString" ], [ 27564, "u8", "writeln_in_output" ], [ 27582, "u8", "$Initialization" ], [ 27598, "u8", "__InitModule" ], [ 27611, "u8", "InternalEqual" ], [ 27625, "base64", "\u0016)ږ,ڶ*'" ], [ 27639, "u8", "FormatStr" ], [ 27663, "u8", "AllocConsole" ], [ 27676, "u8", "WINAPI_AllocConsole" ], [ 27704, "u8", "StartTime" ], [ 27714, "u8", "console_alloc" ], [ 27728, "u8", "_IsPipedRedirectedQuery" ] ], "val": { "file.stem": "7f79358d80b4ebe3ca5466423594ce6d984cb1f81df7205268b9614e4f90d48d", "pe.imphash": "f34d5f2d4577ed6d9ceec516c1f5a744", "pe.machine": "i386", "pe.subsystem": "windows_cui", "pe.timestamp": 1643050239, "file.basename": "7f79358d80b4ebe3ca5466423594ce6d984cb1f81df7205268b9614e4f90d48d.exe", "pe.image_base": 4194304, "pe.image_size": 49152, "pe.machine_id": 332, "pe.os_version": "4.0", "pe.entry_point": 40862, "pe.headers_size": 512, "pe.debug.pdb.age": 1, "pe.entry_section": ".text", "pe.subsystem_raw": 3, "pe.clr.is_il_only": 1, "pe.debug.pdb.guid": "14a215ec-9aa7-40d3-9673-b09a6b8963bf", "pe.debug.pdb.path": "DoesTriangleExis.pdb", "pe.debug.pdb.stem": "DoesTriangleExis", "pe.file_alignment": 512, "pe.image_hash.sha1": "fe4289ccbadd1ef56fa7e9f6028965ff93dc2dd5", "pe.image_hash.sha256": "36e5d8d435f1726cace9ab2c8a4236c4c91b5e3c1f2a30ad61203ddbc3ae15f2", "pe.image_hash.sha384": "bd3ac47e70b6af17a8318a05928e28419da623882ad8e2067778b30db29afb979a2ee984c4247e249a5cd470443a4c52", "pe.image_hash.sha512": "8c9910694a58cc522d16a05fd2d73a70f8ce7d830f9ae026faa72b3cbdb21bc348e29b5991a1d6ffc47cf35abe0d727869dfce755e3ba17cfd0cf5511975b03b", "pe.section_alignment": 8192, "pe.subsystem_version": "4.0", "pe.characteristics[0]": "executable_image", "pe.characteristics[1]": "32bit_machine", "pe.debug.pdb.basename": "DoesTriangleExis.pdb", "pe.characteristics_raw": 258, "pe.clr.runtime_version": "2.5", "pe.debug.pdb.timestamp": 1643050239, "pe.linker_major_version": 11, "pe.debug.entries[0].type": "codeview", "pe.debug.pdb.path_offset": 33068, "pe.dll_characteristics[0]": "dynamic_base", "pe.dll_characteristics[1]": "nx_compat", "pe.dll_characteristics[2]": "no_seh", "pe.dll_characteristics[3]": "terminal_server_aware", "pe.data_directories[0].rva": 40772, "pe.data_directories[1].rva": 40960, "pe.data_directories[2].rva": 40696, "pe.data_directories[3].rva": 8192, "pe.data_directories[4].rva": 8200, "pe.dll_characteristics_raw": 34112, "pe.number_of_rva_and_sizes": 16, "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 87, "pe.data_directories[1].name": "base_relocation", "pe.data_directories[1].size": 12, "pe.data_directories[2].name": "debug", "pe.data_directories[2].size": 28, "pe.data_directories[3].name": "iat", "pe.data_directories[3].size": 8, "pe.data_directories[4].name": "clr_runtime_header", "pe.data_directories[4].size": 72, "pe.debug.entries[0].type_id": 2, "pe.coff.dos_header_pe_pointer": 128, "pe.debug.entries[0].size_bytes": 45, "pe.base_relocations.block_count": 1, "pe.base_relocations.entry_count": 1, "pe.base_relocations.padding_count": 1, "pe.debug.entries[0].timestamp_unix": 1643050239 } }, "find": [ { "id": "metadata/binary/framework::clr-runtime-header", "conf": 1.0, "crit": 2, "desc": "PE CLR runtime header present (COM descriptor)" }, { "id": "metadata/binary/framework::dotnet-metadata", "conf": 1.0, "crit": 2, "desc": ".NET Metadata Root (BSJB)" }, { "id": "micro-behaviors/data/db/linq::linq-queries", "conf": 0.699999988079071, "crit": 3, "desc": "LINQ query operations" }, { "id": "micro-behaviors/data/text/language::lang-russian", "conf": 0.800000011920929, "crit": 3, "desc": "Cyrillic script detection (Russian/Ukrainian)" }, { "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal", "conf": 0.699999988079071, "crit": 1, "desc": ".NET code entropy in unpacked range" }, { "id": "objectives/anti-static/obfuscation/reflection/invoke::get-method-call", "conf": 0.6000000238418579, "crit": 1, "desc": "GetMethod call reference" }, { "id": "objectives/anti-static/obfuscation/reflection/invoke::activator", "conf": 0.800000011920929, "crit": 1, "desc": "Dynamic object instantiation via Activator" }, { "id": "objectives/evasion/masquerade/debug::pe-stem-differs-from-pdb-stem", "atk": "T1036.005", "conf": 0.8500000238418579, "crit": 3, "desc": "PE stem disagrees with embedded PDB stem" } ], "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/2022-01/7f79358d80b4ebe3ca5466423594ce6d984cb1f81df7205268b9614e4f90d48d.exe", "risk": 3, "size": 33792, "type": "pe" } ] } }