{
  "ml": {
    "v": "7",
    "eng": "2.9.1",
    "lvl": -1,
    "conf": 0,
    "mods": [
      {
        "cls": 0,
        "raw": 0.00008676449,
        "rte": "az",
        "prob": 0.00008676449
      },
      {
        "cls": 0,
        "raw": 0.007010013,
        "rte": "az/native",
        "prob": 0.007010013
      },
      {
        "cls": 0,
        "raw": 0.023138016,
        "rte": "az/pe",
        "prob": 0.023138016
      }
    ],
    "prob": 0.00008676449,
    "files": [
      {
        "id": 0,
        "lvl": -1,
        "conf": 0,
        "prob": 0.00008676449215272442,
        "type": "pe"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-09-12T22:05:34Z"
  },
  "path": "Hoax.Win32.WebMoner.bq",
  "raw": {
    "v": "8",
    "files": [
      {
        "id": 0,
        "ctx": [
          {
            "b": "pI@Kox\u003e7]-4mkhVBz(4KhBzp{v}#5A22[MozdN.(rb3hXAXN?\u003ezGGDgC42g\u0026Z:xA*2tYkpx(dB42mBHBzdN-xrb3hXAS/6Ew][c+0S#zuz#@\u0026o00Vz4x(dB422]qNwPxKinP5SYA=$(c1I=w\u003e00=qqrb3hXAT8$Kx(dB4",
            "ln": 902225
          }
        ],
        "mol": "H₂(PoU)",
        "sha": "863c9cc4244ebbb6e29bf458bf4b4746ca9227ddab46138806c6a645e90ef8e9",
        "path": "Hoax.Win32.WebMoner.bq",
        "risk": 2,
        "size": 1060352,
        "type": "pe",
        "facts": {
          "imp": [
            [
              "kernel32",
              "DeleteCriticalSection"
            ],
            [
              "user32",
              "GetKeyboardType"
            ],
            [
              "advapi32",
              "RegQueryValueExA"
            ],
            [
              "oleaut32",
              "SysFreeString"
            ],
            [
              "version",
              "VerQueryValueA"
            ],
            [
              "gdi32",
              "UnrealizeObject"
            ],
            [
              "ole32",
              "CreateStreamOnHGlobal"
            ],
            [
              "comctl32",
              "ImageList_SetIconSize"
            ],
            [
              "shell32",
              "ShellExecuteA"
            ],
            [
              "kernel32",
              "LoadLibraryA"
            ],
            [
              "kernel32",
              "VirtualProtect"
            ],
            [
              "kernel32",
              "GetModuleFileNameA"
            ],
            [
              "user32",
              "MessageBoxA"
            ]
          ],
          "sec": [
            [
              "CODE",
              1024,
              0,
              0.0,
              "r-x"
            ],
            [
              "DATA",
              1024,
              0,
              0.0,
              "rw-"
            ],
            [
              "BSS",
              1024,
              0,
              0.0,
              "rw-"
            ],
            [
              ".idata",
              1024,
              0,
              0.0,
              "rw-"
            ],
            [
              ".tls",
              1024,
              0,
              0.0,
              "rw-"
            ],
            [
              ".rdata",
              1024,
              512,
              0.18,
              "r--"
            ],
            [
              ".reloc",
              1536,
              0,
              0.0,
              "r--"
            ],
            [
              ".text0",
              1536,
              0,
              0.0,
              "rwx"
            ],
            [
              ".text1",
              1536,
              697856,
              7.95,
              "rwx"
            ],
            [
              ".rsrc",
              699392,
              360960,
              7.61,
              "r--"
            ]
          ],
          "metrics": {
            "pe": {
              "checksum": 0,
              "timestamp": 708992537,
              "icon_count": 2,
              "image_size": 2023424,
              "has_manifest": 1,
              "headers_size": 1024,
              "checksum_valid": 0,
              "file_alignment": 512,
              "resource_count": 10,
              "has_version_info": 1,
              "checksum_stripped": 1,
              "computed_checksum": 1096196,
              "dos_stub_modified": 1,
              "headers_size_ratio": 0,
              "prose_section_count": 0,
              "bss_like_section_count": 5,
              "section_overflow_count": 0,
              "misaligned_section_count": 0,
              "version.identity_entropy": 4.48,
              "entry_in_writable_section": 1,
              "declared_data_directory_count": 3,
              "version.identity_symbol_ratio": 0.06,
              "executable_prose_section_count": 0,
              "directory_section_mismatch_count": 0
            },
            "file": {
              "size": 1060352,
              "entropy": 7.89
            },
            "binary": {
              "is_pie": 0,
              "code_entropy": 7.95,
              "string_count": 1668,
              "entropy_variance": 12.86,
              "avg_string_length": 11.64,
              "max_string_length": 2716,
              "peak_region_bytes": 926720,
              "code_to_data_ratio": 1,
              "peak_region_entropy": 7.81,
              "string_length_stddev": 69.57,
              "largest_section_ratio": 0.66,
              "sentence_string_count": 115,
              "sentence_string_ratio": 0.07,
              "high_entropy_string_count": 1
            },
            "imports": {
              "count": 13
            },
            "sections": {
              "count": 10,
              "code_size": 697856,
              "entropy_max": 7.95,
              "entropy_mean": 5.25,
              "name_entropy": 4.12,
              "writable_count": 6,
              "executable_count": 3,
              "nonstandard_count": 5,
              "executable_writable_count": 2
            },
            "consistency": {
              "extension_content_mismatch": 1,
              "internal_name_original_filename_mismatch": 0,
              "extension_content_mismatch.binary_as_unknown": 1
            },
            "dependencies": {
              "count": 9
            }
          }
        },
        "ident": {
          "name": {
            "value": "Power WMR.exe",
            "source": "pe.version.original_filename",
            "verified": false
          },
          "trust": "unsigned",
          "project": {
            "value": "Power WMR CLIENT",
            "source": "pe.version.product_name",
            "verified": false
          },
          "version": {
            "value": "1.0.0.0",
            "source": "pe.version.file_version",
            "verified": false
          },
          "organization": {
            "value": "© SPEED v 1.0 Power WMR",
            "source": "pe.version.company",
            "verified": false
          }
        },
        "traits": [
          {
            "id": "micro-behaviors/process/create/exec::shell-execute-a",
            "atk": "T1059.001",
            "conf": 0.75,
            "crit": 3,
            "desc": "Execute shell command (ShellExecuteA)",
            "spans": [
              [
                1637065,
                13
              ]
            ]
          },
          {
            "id": "micro-behaviors/ui/controls/widget::image-list-set-icon-size",
            "conf": 0.88,
            "crit": 3,
            "desc": "Image list icon size import",
            "spans": [
              [
                1319431,
                21
              ]
            ]
          }
        ]
      }
    ]
  }
}