{
  "ml": {
    "v": "7",
    "lvl": -1,
    "conf": 0,
    "mods": [
      {
        "cls": 0,
        "raw": 0.15053762,
        "rte": "az",
        "prob": 0.15053762
      },
      {
        "cls": 0,
        "raw": 0.07610896,
        "rte": "az/native",
        "prob": 0.07610896
      },
      {
        "cls": 0,
        "raw": 0.19297391,
        "rte": "az/pe",
        "prob": 0.19297391
      }
    ],
    "prob": 0.15053762,
    "files": [
      {
        "id": 0,
        "lvl": -1,
        "conf": 0,
        "prob": 0.1505376249551773,
        "type": "pe"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-06-14T11:04:44Z"
  },
  "path": "888dba9b6af3eefee1af6835639b59022aa5ccf487cbdf0965887ca27f7c0478.exe",
  "raw": {
    "v": "7",
    "tv": "c7b65",
    "files": [
      {
        "id": 0,
        "ctx": [
          {
            "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000u\u0026*rd4J\u0026m(0ji6Sa?dLD+]{51x(+zoA=kPhvqNb%vqY$3BrC47",
            "l": 0,
            "n": [
              {
                "c": 3,
                "d": "PE stem disagrees with embedded PDB stem",
                "i": "objectives/evasion/masquerade/debug::pe-stem-differs-from-pdb-stem",
                "o": 0,
                "z": 1
              }
            ],
            "x": true
          },
          {
            "b": "]E{mB0X\u003cVP8zIi(ehmb8kRSlsn?*qCtRMiUw?:n=Fh437NLs^xQ+I\u0026HYFfx^/F9va]F3sC3]d!.95mG]i5gEllnwJvqzFjLybb+?DnkE2J4$wkPFuGESXKLOX?Tl=:t9.}/FiBb\u003c$V]p{a=QF2R#CX6F/Z?j#ifsrX\u003cZQvLW#:B#69#JXZUnURMmV0000000000L@y@)000000SSi2b(^]BPEZ6yPA",
            "l": 10632,
            "n": [
              {
                "c": 3,
                "d": "Kernel ZwOpenProcess routine",
                "i": "micro-behaviors/process/terminate/kill::zw-open-process",
                "o": 10708,
                "z": 13
              },
              {
                "c": 2,
                "d": "Kernel pool memory allocation",
                "i": "micro-behaviors/mem/alloc/executable::kernel-pool-alloc",
                "o": 10756,
                "z": 21
              },
              {
                "c": 2,
                "d": "Memory copy operation",
                "i": "micro-behaviors/mem/c-runtime/functions::memcpy",
                "o": 10648,
                "z": 6
              },
              {
                "c": 2,
                "d": "Memory fill operation",
                "i": "micro-behaviors/mem/c-runtime/functions::memset",
                "o": 10656,
                "z": 6
              },
              {
                "c": 2,
                "d": "Create registry key",
                "i": "micro-behaviors/os/registry/hive::create-registry-key",
                "o": 10736,
                "z": 11
              }
            ],
            "x": true
          },
          {
            "b": "By/qXzF0*czddK2z/bKPzGG/ryJsree[Gos0024Wmr?amy\u0026r/(By!o!z!@G?BzaSZx8]pwB9zOz",
            "l": 13088,
            "n": [
              {
                "c": 2,
                "d": "Kernel driver ntoskrnl in INIT",
                "i": "metadata/binary/resource::kernel-driver-init",
                "o": 13104,
                "z": 12
              }
            ],
            "x": true
          },
          {
            "b": "0000000000003WmgYNHQrSD4#uJsabmf3i=qVGw?pxjb\u0026uJrT$p5)--pxgv{006Xn[brp!0rrc21PTh",
            "l": 13398,
            "n": [
              {
                "c": 2,
                "d": "PE version resource metadata",
                "i": "metadata/package/versioning::version-resource-metadata",
                "o": 13414,
                "z": 15
              }
            ],
            "x": true
          },
          {
            "b": "fAr{fvGn7Z002W)761vnlJz38z2!IPve$fBC(QOtve$cAwDhYg002Z[x-ISyASy1TA@ZaUw=M]",
            "l": 13550,
            "n": [
              {
                "c": 2,
                "d": "PE CompanyName metadata field",
                "i": "metadata/package/versioning::pe-companyname-field",
                "o": 13566,
                "z": 11
              }
            ],
            "x": true
          },
          {
            "b": "Bo31PzVBUP003417xsEomGvc5yYF2Dl\u0026Z=#A@YXIASx!Nz#:$Wx-J5Kzu6Up00372x-J2Jwb{JFCk#W",
            "l": 13626,
            "n": [
              {
                "c": 2,
                "d": "PE FileDescription metadata field",
                "i": "metadata/package/versioning::pe-filedescription-field",
                "o": 13642,
                "z": 15
              }
            ],
            "x": true
          },
          {
            "b": "x8(GyASu7t002aY4GDIfmGvc5yYF2DrSDXhASydXx-J5Kzu6Up001\u003eRe=WQae=WTbhukAhfArZ9g5%3eh#\u003eSj0024W4fczenDrSdBo2\u003eLASx$Sve$9zp5[Y5z2!bE003\u003coASys:A@Z4SvGplBx8\u003cK:",
            "l": 13714,
            "n": [
              {
                "c": 2,
                "d": "PE FileVersion metadata field",
                "i": "metadata/package/versioning::pe-fileversion-field",
                "o": 13730,
                "z": 11
              },
              {
                "c": 2,
                "d": "PE InternalName metadata field",
                "i": "metadata/package/versioning::pe-internalname-field",
                "o": 13790,
                "z": 12
              }
            ],
            "x": true
          },
          {
            "b": "B]V7Nwb[jZ002s=4fczepxkznx-I=Cx-J2Jve$9zmGvc5yYF2Dzua8Bz2!bE003\u003coASys:A@Z4SvGplB",
            "l": 13962,
            "n": [
              {
                "c": 2,
                "d": "PE OriginalFilename metadata field",
                "i": "metadata/package/versioning::pe-originalfilename-field",
                "o": 13978,
                "z": 16
              }
            ],
            "x": true
          },
          {
            "b": "A@ZE=A@Vgu003:lb(^@CpYLIozVBqFBPt[KBo25ove$cAwDhYg002Z[x-ISyASy1TA@ZaUw=M]",
            "l": 14030,
            "n": [
              {
                "c": 2,
                "d": "PE ProductName metadata field",
                "i": "metadata/package/versioning::pe-productname-field",
                "o": 14046,
                "z": 11
              }
            ],
            "x": true
          },
          {
            "b": "Bo2\u003eLz2:Lo002m:4GDIfpYLIozVBqFBPt[KBo2twwDl-JA@Y[OzVBUP001\u003eRe=WQae=WTbhukAhfAq",
            "l": 14138,
            "n": [
              {
                "c": 2,
                "d": "PE ProductVersion metadata field",
                "i": "metadata/package/versioning::pe-productversion-field",
                "o": 14154,
                "z": 14
              }
            ],
            "x": true
          },
          {
            "b": "0000000000000000000000000M\u0026E9^Nky/#X?@C712S$lvkRZQ5h(:ho/v2IK#zqT)\u003e$",
            "l": 14320,
            "n": [
              {
                "c": 2,
                "d": "PE .reloc section presence",
                "i": "metadata/binary/section/names::reloc-section-presence",
                "o": 14336,
                "z": 6
              }
            ],
            "x": true
          }
        ],
        "idn": {
          "name": {
            "value": "mrxsmbmg.sys",
            "source": "pe.version.original_filename",
            "verified": false
          },
          "trust": "unsigned",
          "project": {
            "value": "Microsoft® Windows® Operating System",
            "source": "pe.version.product_name",
            "verified": false
          },
          "version": {
            "value": "5.1.2600.2180",
            "source": "pe.version.file_version",
            "verified": false
          },
          "build_path": {
            "value": "mrxsmbmg.pdb",
            "source": "pe.debug.pdb.path",
            "verified": false
          },
          "organization": {
            "value": "Microsoft Corporation",
            "source": "pe.version.company",
            "verified": false
          }
        },
        "mol": "O(Er)H(Po)",
        "sha": "888dba9b6af3eefee1af6835639b59022aa5ccf487cbdf0965887ca27f7c0478",
        "fact": {
          "id": "pe",
          "imp": [
            [
              "ntoskrnl.exe",
              "KeWaitForSingleObject"
            ],
            [
              "ntoskrnl.exe",
              "KeInitializeEvent"
            ],
            [
              "ntoskrnl.exe",
              "ExFreePool"
            ],
            [
              "ntoskrnl.exe",
              "RtlInitUnicodeString"
            ],
            [
              "ntoskrnl.exe",
              "ExAllocatePool"
            ],
            [
              "ntoskrnl.exe",
              "except_handler3"
            ],
            [
              "ntoskrnl.exe",
              "memcpy"
            ],
            [
              "ntoskrnl.exe",
              "local_unwind2"
            ],
            [
              "ntoskrnl.exe",
              "memset"
            ],
            [
              "ntoskrnl.exe",
              "KeDelayExecutionThread"
            ],
            [
              "ntoskrnl.exe",
              "RtlCompareUnicodeString"
            ],
            [
              "ntoskrnl.exe",
              "ZwClose"
            ],
            [
              "ntoskrnl.exe",
              "ObfDereferenceObject"
            ],
            [
              "ntoskrnl.exe",
              "KeWaitForMultipleObjects"
            ],
            [
              "ntoskrnl.exe",
              "ObReferenceObjectByHandle"
            ],
            [
              "ntoskrnl.exe",
              "PsCreateSystemThread"
            ],
            [
              "ntoskrnl.exe",
              "PsGetVersion"
            ],
            [
              "ntoskrnl.exe",
              "ZwQueryInformationProcess"
            ],
            [
              "ntoskrnl.exe",
              "wcsncpy"
            ],
            [
              "ntoskrnl.exe",
              "RtlInitString"
            ],
            [
              "ntoskrnl.exe",
              "PsGetCurrentProcessId"
            ],
            [
              "ntoskrnl.exe",
              "ZwOpenProcess"
            ],
            [
              "ntoskrnl.exe",
              "RtlEqualString"
            ],
            [
              "ntoskrnl.exe",
              "RtlInitAnsiString"
            ],
            [
              "ntoskrnl.exe",
              "strrchr"
            ],
            [
              "ntoskrnl.exe",
              "ZwOpenThread"
            ],
            [
              "ntoskrnl.exe",
              "KeSetEvent"
            ],
            [
              "ntoskrnl.exe",
              "KeClearEvent"
            ],
            [
              "ntoskrnl.exe",
              "ZwCreateKey"
            ],
            [
              "ntoskrnl.exe",
              "ZwSetValueKey"
            ],
            [
              "ntoskrnl.exe",
              "ZwQueryValueKey"
            ],
            [
              "ntoskrnl.exe",
              "ZwOpenKey"
            ],
            [
              "ntoskrnl.exe",
              "ZwQuerySystemInformation"
            ],
            [
              "ntoskrnl.exe",
              "ExAllocatePoolWithTag"
            ],
            [
              "ntoskrnl.exe",
              "swprintf"
            ],
            [
              "ntoskrnl.exe",
              "ExFreePoolWithTag"
            ],
            [
              "ntoskrnl.exe",
              "RtlCopyUnicodeString"
            ],
            [
              "ntoskrnl.exe",
              "RtlAppendUnicodeStringToString"
            ],
            [
              "ntoskrnl.exe",
              "ZwDeleteKey"
            ]
          ],
          "met": {
            "pe": {
              "checksum": 28370.0,
              "has_safe_seh": 1.0,
              "checksum_valid": 0.0,
              "resource_count": 1.0,
              "has_version_info": 1.0,
              "computed_checksum": 28882.0,
              "reloc_overhang_bytes": 192.0,
              "reloc_overhang_ratio": 0.3,
              "bss_like_section_count": 0.0,
              "section_overflow_count": 0.0,
              "misaligned_section_count": 0.0,
              "version.identity_entropy": 4.49,
              "base_relocation_block_count": 3.0,
              "base_relocation_entry_count": 211.0,
              "version.identity_symbol_ratio": 0.03
            },
            "file": {
              "size": 14976.0,
              "entropy": 6.02,
              "size_bytes": 14976.0
            },
            "binary": {
              "is_pie": 0.0,
              "code_entropy": 6.18,
              "data_entropy": 5.02,
              "string_count": 81.0,
              "overall_entropy": 6.02,
              "entropy_variance": 1.0,
              "avg_string_length": 13.99,
              "max_string_length": 47.0,
              "code_to_data_ratio": 0.96,
              "string_length_stddev": 8.16,
              "largest_section_ratio": 0.63,
              "sentence_string_count": 4.0,
              "sentence_string_ratio": 0.05,
              "high_entropy_string_count": 0.0
            },
            "imports": {
              "count": 39.0
            },
            "sections": {
              "count": 6.0,
              "code_size": 10496.0,
              "entropy_max": 6.3,
              "entropy_mean": 4.75,
              "name_entropy": 3.55,
              "writable_count": 2.0,
              "executable_count": 2.0,
              "nonstandard_count": 1.0,
              "executable_writable_count": 1.0
            },
            "dependencies": {
              "count": 1.0
            }
          },
          "sec": [
            [
              ".text",
              1152,
              9472,
              6.3,
              "r-x"
            ],
            [
              ".rdata",
              10624,
              1280,
              3.69,
              "r--"
            ],
            [
              ".data",
              11904,
              384,
              5.02,
              "rw-"
            ],
            [
              "INIT",
              12288,
              1024,
              5.06,
              "rwx"
            ],
            [
              ".rsrc",
              13312,
              1024,
              3.28,
              "r--"
            ],
            [
              ".reloc",
              14336,
              640,
              5.13,
              "r--"
            ]
          ],
          "str": [
            [
              77,
              "u8",
              "!This program cannot be run in DOS mode."
            ],
            [
              584,
              "u8",
              "Rich"
            ],
            [
              856,
              "u8",
              ".text"
            ],
            [
              895,
              "u8",
              "h.rdata"
            ],
            [
              935,
              "u8",
              "H.data"
            ],
            [
              976,
              "u8",
              "INIT"
            ],
            [
              1016,
              "u8",
              ".rsrc"
            ],
            [
              1055,
              "u8",
              "B.reloc"
            ],
            [
              4764,
              "u8",
              "PWWV"
            ],
            [
              5810,
              "u8",
              "pxWf3"
            ],
            [
              7375,
              "u8",
              "QSVW3"
            ],
            [
              7567,
              "u8",
              "VPPPP"
            ],
            [
              7651,
              "u8",
              "SVW3"
            ],
            [
              9449,
              "u8",
              "jeYji[js^jt_jrZf"
            ],
            [
              10496,
              "u8",
              "NtBuildNumber"
            ],
            [
              10883,
              "u8",
              "w+w;w2w0w6w4w.w(wRw"
            ],
            [
              11424,
              "u8",
              "RSDS"
            ],
            [
              11448,
              "u8",
              "mrxsmbmg.pdb"
            ],
            [
              12490,
              "u8",
              "KeWaitForSingleObject"
            ],
            [
              12514,
              "u8",
              "KeInitializeEvent"
            ],
            [
              12534,
              "u8",
              "ExFreePool"
            ],
            [
              12548,
              "u8",
              "RtlInitUnicodeString"
            ],
            [
              12572,
              "u8",
              "ExAllocatePool"
            ],
            [
              12590,
              "u8",
              "_except_handler3"
            ],
            [
              12610,
              "u8",
              "memcpy"
            ],
            [
              12620,
              "u8",
              "_local_unwind2"
            ],
            [
              12638,
              "u8",
              "memset"
            ],
            [
              12648,
              "u8",
              "KeDelayExecutionThread"
            ],
            [
              12674,
              "u8",
              "RtlCompareUnicodeString"
            ],
            [
              12700,
              "u8",
              "ZwClose"
            ],
            [
              12710,
              "u8",
              "ObfDereferenceObject"
            ],
            [
              12734,
              "u8",
              "KeWaitForMultipleObjects"
            ],
            [
              12762,
              "u8",
              "ObReferenceObjectByHandle"
            ],
            [
              12790,
              "u8",
              "PsCreateSystemThread"
            ],
            [
              12814,
              "u8",
              "PsGetVersion"
            ],
            [
              12830,
              "u8",
              "ZwQueryInformationProcess"
            ],
            [
              12858,
              "u8",
              "wcsncpy"
            ],
            [
              12868,
              "u8",
              "RtlInitString"
            ],
            [
              12884,
              "u8",
              "PsGetCurrentProcessId"
            ],
            [
              12908,
              "u8",
              "ZwOpenProcess"
            ],
            [
              12924,
              "u8",
              "RtlEqualString"
            ],
            [
              12942,
              "u8",
              "RtlInitAnsiString"
            ],
            [
              12962,
              "u8",
              "strrchr"
            ],
            [
              12972,
              "u8",
              "ZwOpenThread"
            ],
            [
              12988,
              "u8",
              "KeSetEvent"
            ],
            [
              13002,
              "u8",
              "KeClearEvent"
            ],
            [
              13018,
              "u8",
              "ZwCreateKey"
            ],
            [
              13032,
              "u8",
              "ZwSetValueKey"
            ],
            [
              13048,
              "u8",
              "ZwQueryValueKey"
            ],
            [
              13066,
              "u8",
              "ZwOpenKey"
            ],
            [
              13078,
              "u8",
              "ZwQuerySystemInformation"
            ],
            [
              13104,
              "u8",
              "ntoskrnl.exe"
            ],
            [
              13120,
              "u8",
              "ExAllocatePoolWithTag"
            ],
            [
              13144,
              "u8",
              "swprintf"
            ],
            [
              13156,
              "u8",
              "ExFreePoolWithTag"
            ],
            [
              13176,
              "u8",
              "RtlCopyUnicodeString"
            ],
            [
              13200,
              "u8",
              "RtlAppendUnicodeStringToString"
            ],
            [
              13234,
              "u8",
              "ZwDeleteKey"
            ],
            [
              14623,
              "u8",
              "=1=6=B=I=R=b="
            ],
            [
              10424,
              "wide",
              "Excluded"
            ],
            [
              10442,
              "wide",
              "\\Parameters"
            ],
            [
              10466,
              "wide",
              "Control"
            ],
            [
              10482,
              "wide",
              "Status"
            ],
            [
              13414,
              "wide",
              "VS_VERSION_INFO"
            ],
            [
              13506,
              "wide",
              "StringFileInfo"
            ],
            [
              13542,
              "wide",
              "040904b0"
            ],
            [
              13566,
              "wide",
              "CompanyName"
            ],
            [
              13592,
              "wide",
              "Microsoft Corporation"
            ],
            [
              13642,
              "wide",
              "FileDescription"
            ],
            [
              13676,
              "wide",
              "Windows NT SMB Manager"
            ],
            [
              13730,
              "wide",
              "FileVersion"
            ],
            [
              13790,
              "wide",
              "InternalName"
            ],
            [
              13816,
              "wide",
              "mrxsmbmg.sys"
            ],
            [
              13850,
              "wide",
              "LegalCopyright"
            ],
            [
              13880,
              "wide",
              "© Microsoft Corporation. All rights reserved."
            ],
            [
              13978,
              "wide",
              "OriginalFilename"
            ],
            [
              14046,
              "wide",
              "ProductName"
            ],
            [
              14072,
              "wide",
              "Microsoft® Windows® Operating System"
            ],
            [
              14154,
              "wide",
              "ProductVersion"
            ],
            [
              14218,
              "wide",
              "VarFileInfo"
            ],
            [
              14250,
              "wide",
              "Translation"
            ]
          ],
          "val": {
            "file.stem": "888dba9b6af3eefee1af6835639b59022aa5ccf487cbdf0965887ca27f7c0478",
            "pe.imphash": "0986c134ccc3041a3665a381bbdf8c83",
            "pe.machine": "i386",
            "pe.rich.key": 2179497461,
            "pe.rich.hash": "f867442d2ff015c3a9718fb7173816db",
            "pe.subsystem": "native",
            "pe.timestamp": 1061173141,
            "file.basename": "888dba9b6af3eefee1af6835639b59022aa5ccf487cbdf0965887ca27f7c0478.exe",
            "pe.image_base": 65536,
            "pe.image_size": 14976,
            "pe.machine_id": 332,
            "pe.os_version": "6.0",
            "pe.version.os": "windows_nt_windows32",
            "pe.entry_point": 3348,
            "pe.headers_size": 1152,
            "pe.version.type": "drv",
            "pe.debug.pdb.age": 1,
            "pe.entry_section": ".text",
            "pe.subsystem_raw": 1,
            "pe.debug.pdb.guid": "4a025d98-a779-4ca8-b7da-5086b7831e6d",
            "pe.debug.pdb.path": "mrxsmbmg.pdb",
            "pe.debug.pdb.stem": "mrxsmbmg",
            "pe.file_alignment": 128,
            "pe.image_hash.sha1": "a818c5001658c59b391c8e1d62f7149c34eb1cf4",
            "pe.version.company": "Microsoft Corporation",
            "pe.version.subtype": "system",
            "pe.load_config.size": 72,
            "pe.version.flags[0]": "private_build",
            "pe.image_hash.sha256": "2c978dd1a521c8caa7866149b1b11c58e3b4ffc028abed77c2525829c0c9cf5f",
            "pe.image_hash.sha384": "8e598c8c82e9f9f8359f213b6a533768622b038f4e20af0eaa37345f22dd8c0444e05d7c96c71fa3b3b4382ab149b43a",
            "pe.image_hash.sha512": "1b8132090fadea2e1e54ccb4bf5d33725238ed45b4315eb59953011a6b0f476ae5e0c010345b23b81807b48a8599816f9e36d5c34da4323a4cd900cfc9a1ecbd",
            "pe.resource_types[0]": "RT_VERSION",
            "pe.section_alignment": 128,
            "pe.subsystem_version": "5.0",
            "pe.version.copyright": "© Microsoft Corporation. All rights reserved.",
            "pe.characteristics[0]": "executable_image",
            "pe.characteristics[1]": "32bit_machine",
            "pe.debug.pdb.basename": "mrxsmbmg.pdb",
            "pe.characteristics_raw": 258,
            "pe.debug.pdb.timestamp": 1061173141,
            "pe.version.description": "Windows NT SMB Manager",
            "pe.linker_major_version": 8,
            "pe.version.file_version": "5.1.2600.2180",
            "pe.version.product_name": "Microsoft® Windows® Operating System",
            "build.toolchain.compiler": "msvc",
            "pe.debug.entries[0].type": "codeview",
            "pe.debug.pdb.path_offset": 11448,
            "pe.version.internal_name": "mrxsmbmg.sys",
            "pe.version.company_offset": 13592,
            "pe.data_directories[0].rva": 12288,
            "pe.data_directories[1].rva": 13312,
            "pe.data_directories[2].rva": 14336,
            "pe.data_directories[3].rva": 10784,
            "pe.data_directories[4].rva": 11352,
            "pe.data_directories[5].rva": 10624,
            "pe.number_of_rva_and_sizes": 16,
            "pe.version.product_version": "5.1.2600.2180",
            "pe.data_directories[0].name": "import",
            "pe.data_directories[0].size": 40,
            "pe.data_directories[1].name": "resource",
            "pe.data_directories[1].size": 968,
            "pe.data_directories[2].name": "base_relocation",
            "pe.data_directories[2].size": 448,
            "pe.data_directories[3].name": "debug",
            "pe.data_directories[3].size": 28,
            "pe.data_directories[4].name": "load_config",
            "pe.data_directories[4].size": 64,
            "pe.data_directories[5].name": "iat",
            "pe.data_directories[5].size": 160,
            "pe.debug.entries[0].type_id": 2,
            "pe.rich.entries[0].build_id": 125,
            "pe.rich.entries[1].build_id": 109,
            "pe.rich.entries[2].build_id": 1,
            "pe.rich.entries[3].build_id": 19,
            "pe.rich.entries[4].build_id": 110,
            "pe.rich.entries[5].build_id": 124,
            "pe.rich.entries[6].build_id": 120,
            "pe.version.copyright_offset": 13880,
            "pe.rich.entries[0].use_count": 1,
            "pe.rich.entries[1].use_count": 2,
            "pe.rich.entries[2].use_count": 43,
            "pe.rich.entries[3].use_count": 3,
            "pe.rich.entries[4].use_count": 12,
            "pe.rich.entries[5].use_count": 1,
            "pe.rich.entries[6].use_count": 1,
            "pe.version.original_filename": "mrxsmbmg.sys",
            "pe.coff.dos_header_pe_pointer": 608,
            "pe.rich.entries[0].product_id": 50727,
            "pe.rich.entries[1].product_id": 50727,
            "pe.rich.entries[3].product_id": 9049,
            "pe.rich.entries[4].product_id": 50727,
            "pe.rich.entries[5].product_id": 50727,
            "pe.rich.entries[6].product_id": 50727,
            "pe.version.description_offset": 13676,
            "pe.debug.entries[0].size_bytes": 37,
            "pe.load_config.security_cookie": 77712,
            "pe.version.file_version_offset": 13756,
            "pe.version.product_name_offset": 14072,
            "pe.base_relocations.block_count": 3,
            "pe.base_relocations.entry_count": 211,
            "pe.load_config.se_handler_count": 1,
            "pe.load_config.se_handler_table": 77104,
            "pe.version.internal_name_offset": 13816,
            "pe.base_relocations.padding_count": 1,
            "pe.version.product_version_offset": 14184,
            "pe.debug.entries[0].timestamp_unix": 1061173141,
            "pe.version.original_filename_offset": 14012
          }
        },
        "find": [
          {
            "id": "metadata/binary/framework::is-binary",
            "conf": 1.0,
            "crit": 1,
            "desc": "File is a compiled binary"
          },
          {
            "id": "micro-behaviors/process/terminate/kill::zw-open-process",
            "conf": 0.8999999761581421,
            "crit": 3,
            "desc": "Kernel ZwOpenProcess routine"
          },
          {
            "id": "micro-behaviors/mem/c-runtime/functions::memcpy",
            "conf": 0.8999999761581421,
            "crit": 2,
            "desc": "Memory copy operation"
          },
          {
            "id": "metadata/binary/metrics/threshold::many-imports-25",
            "conf": 1.0,
            "crit": 1,
            "desc": "Binary has 25+ imports"
          },
          {
            "id": "metadata/binary/anomaly/format::version-info-file-version-present",
            "conf": 0.949999988079071,
            "crit": 1,
            "desc": "PE version info numeric fields present"
          },
          {
            "id": "metadata/package/versioning::pe-internalname-field",
            "conf": 0.699999988079071,
            "crit": 2,
            "desc": "PE InternalName metadata field"
          },
          {
            "id": "objectives/anti-static/obfuscation/imports::pe-header-walk",
            "atk": "T1027.007",
            "mbc": "B0032.014",
            "conf": 0.699999988079071,
            "crit": 1,
            "desc": "PE header access via e_lfanew offset"
          },
          {
            "id": "metadata/binary/section/names::pe-code-data-standard-section",
            "conf": 0.8999999761581421,
            "crit": 1,
            "desc": "PE standard code/data section"
          },
          {
            "id": "metadata/binary/section/names::pe-runtime-standard-section",
            "conf": 0.8999999761581421,
            "crit": 1,
            "desc": "PE standard runtime section"
          },
          {
            "id": "objectives/evasion/masquerade/version-resource/claim::getmac-product-string",
            "atk": "T1036.005",
            "conf": 0.9700000286102295,
            "crit": 1,
            "desc": "Windows operating system product string"
          },
          {
            "id": "objectives/command-and-control/dropper/execution/clickfix::short-pdb-marker",
            "atk": "T1204.002",
            "mbc": "B0024",
            "conf": 0.7599999904632568,
            "crit": 1,
            "desc": "Short PDB marker"
          },
          {
            "id": "metadata/binary/vendor::windows-os-product-name",
            "conf": 0.800000011920929,
            "crit": 1,
            "desc": "Windows OS product name in version resource"
          },
          {
            "id": "metadata/binary/section/metrics::tiny-rsrc-section",
            "conf": 0.8399999737739563,
            "crit": 1,
            "desc": "Minimal resource section footprint"
          },
          {
            "id": "micro-behaviors/communications/http/client/managed::webclient--rx-7",
            "conf": 0.800000011920929,
            "crit": 1,
            "desc": "Regex component marker"
          },
          {
            "id": "metadata/package/versioning::pe-file-description-present",
            "conf": 0.949999988079071,
            "crit": 1,
            "desc": "PE FileDescription field is populated"
          },
          {
            "id": "metadata/binary/metrics/threshold::many-imports-20",
            "conf": 1.0,
            "crit": 1,
            "desc": "Binary has 20+ imports"
          },
          {
            "id": "objectives/anti-static/pack/upx::no-compression-grade-section",
            "atk": "T1027.002",
            "mbc": "F0001.008",
            "conf": 0.8999999761581421,
            "crit": 1,
            "desc": "No section reaches compression-grade entropy"
          },
          {
            "id": "metadata/file/extension::exe",
            "conf": 1.0,
            "crit": 2,
            "desc": "Windows executable extension"
          },
          {
            "id": "metadata/package/versioning::pe-version-resource",
            "conf": 0.800000011920929,
            "crit": 2,
            "desc": "PE version resource structure"
          },
          {
            "id": "objectives/persistence/system/service/install::service-parameters-subkey",
            "atk": "T1543.003",
            "mbc": "B0011.003",
            "conf": 0.800000011920929,
            "crit": 1,
            "desc": "Service Parameters subkey string"
          },
          {
            "id": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info",
            "atk": "T1027",
            "mbc": "B0032",
            "conf": 0.9900000095367432,
            "crit": 1,
            "desc": "PE version resource text"
          },
          {
            "id": "metadata/package/versioning::pe-originalfilename-field",
            "conf": 0.699999988079071,
            "crit": 2,
            "desc": "PE OriginalFilename metadata field"
          },
          {
            "id": "objectives/anti-static/obfuscation/binary-structure::kernel-driver-string",
            "atk": "T1055",
            "conf": 1.0,
            "crit": 1,
            "desc": "Windows kernel driver marker (ntoskrnl/storport)"
          },
          {
            "id": "metadata/binary/resource::kernel-driver-init",
            "conf": 0.949999988079071,
            "crit": 2,
            "desc": "Kernel driver ntoskrnl in INIT"
          },
          {
            "id": "objectives/impact/destroy/file-deletion::exe-gho-bak-whitelist",
            "atk": "T1485",
            "mbc": "C0047",
            "conf": 0.8999999761581421,
            "crit": 1,
            "desc": "Preserves .exe .gho .bak files"
          },
          {
            "id": "metadata/package/versioning::pe-legal-copyright-present",
            "conf": 0.949999988079071,
            "crit": 1,
            "desc": "PE LegalCopyright field is populated"
          },
          {
            "id": "metadata/binary/metrics/threshold::many-imports-30",
            "conf": 1.0,
            "crit": 1,
            "desc": "Binary has 30+ imports"
          },
          {
            "id": "metadata/package/versioning::pe-product-name-present",
            "conf": 0.949999988079071,
            "crit": 1,
            "desc": "PE ProductName field is populated"
          },
          {
            "id": "metadata/package/versioning::pe-productname-field",
            "conf": 0.699999988079071,
            "crit": 2,
            "desc": "PE ProductName metadata field"
          },
          {
            "id": "metadata/binary/debug::pdb-random-basename",
            "conf": 0.7799999713897705,
            "crit": 1,
            "desc": "Lowercase random PDB basename"
          },
          {
            "id": "metadata/binary/framework::exe-extension",
            "conf": 0.8999999761581421,
            "crit": 1,
            "desc": "PE file uses .exe extension"
          },
          {
            "id": "metadata/package/versioning::pe-productversion-field",
            "conf": 0.699999988079071,
            "crit": 2,
            "desc": "PE ProductVersion metadata field"
          },
          {
            "id": "metadata/binary/section/metrics::tiny-data-section",
            "conf": 0.800000011920929,
            "crit": 1,
            "desc": "Tiny writable data section"
          },
          {
            "id": "metadata/package/versioning::pe-filedescription-field",
            "conf": 0.699999988079071,
            "crit": 2,
            "desc": "PE FileDescription metadata field"
          },
          {
            "id": "metadata/package/versioning::pe-fileversion-field",
            "conf": 0.699999988079071,
            "crit": 2,
            "desc": "PE FileVersion metadata field"
          },
          {
            "id": "metadata/binary/metrics/structural::normal-code-entropy",
            "conf": 0.800000011920929,
            "crit": 2,
            "desc": "Binary code entropy above 5.5"
          },
          {
            "id": "metadata/binary/section/names::reloc-section-presence",
            "conf": 0.8999999761581421,
            "crit": 2,
            "desc": "PE .reloc section presence"
          },
          {
            "id": "micro-behaviors/os/kernel/module::native-subsystem",
            "conf": 0.9800000190734863,
            "crit": 1,
            "desc": "PE native subsystem"
          },
          {
            "id": "micro-behaviors/data/embedded/payload/header::inline-pe-header-walk",
            "conf": 0.800000011920929,
            "crit": 1,
            "desc": "Inline PE header walk sequence"
          },
          {
            "id": "objectives/evasion/masquerade/identity/fabricated::identity-nondegenerate-entropy",
            "atk": "T1036.005",
            "conf": 0.6000000238418579,
            "crit": 1,
            "desc": "identity nondegenerate entropy"
          },
          {
            "id": "well-known/malware/trojan/shellobject/revengerat::tiny-string-table",
            "conf": 0.8799999952316284,
            "crit": 1,
            "desc": "Small string table footprint"
          },
          {
            "id": "metadata/binary/section/names::pe-resource-section",
            "conf": 0.8999999761581421,
            "crit": 1,
            "desc": "PE resource section"
          },
          {
            "id": "micro-behaviors/mem/c-runtime/functions::memset",
            "conf": 0.8999999761581421,
            "crit": 2,
            "desc": "Memory fill operation"
          },
          {
            "id": "metadata/package/files::exe-extension-basename",
            "conf": 0.949999988079071,
            "crit": 1,
            "desc": "Filename ends with .exe"
          },
          {
            "id": "metadata/binary/resource::pe-resource-version-first",
            "conf": 1.0,
            "crit": 2,
            "desc": "PE first resource is RT_VERSION"
          },
          {
            "id": "metadata/package/versioning::pe-companyname-field",
            "conf": 0.699999988079071,
            "crit": 2,
            "desc": "PE CompanyName metadata field"
          },
          {
            "id": "metadata/binary/metrics/threshold::high-overall-entropy-binary",
            "conf": 0.8999999761581421,
            "crit": 1,
            "desc": "Binary has high overall entropy (packed/encrypted)"
          },
          {
            "id": "metadata/binary/section/metrics::low-entropy-rdata-section",
            "conf": 0.800000011920929,
            "crit": 1,
            "desc": "Low-entropy rdata section"
          },
          {
            "id": "metadata/binary/metrics/pe-details::dotnet-code-entropy-normal",
            "conf": 0.699999988079071,
            "crit": 1,
            "desc": ".NET code entropy in unpacked range"
          },
          {
            "id": "micro-behaviors/mem/alloc/executable::kernel-pool-alloc",
            "atk": "T1055",
            "conf": 0.8999999761581421,
            "crit": 2,
            "desc": "Kernel pool memory allocation"
          },
          {
            "id": "micro-behaviors/os/registry/hive::create-registry-key",
            "atk": "T1112",
            "conf": 0.9300000071525574,
            "crit": 2,
            "desc": "Create registry key"
          },
          {
            "id": "objectives/impact/services/stop::versioned-service-stop-context",
            "atk": "T1489",
            "conf": 0.699999988079071,
            "crit": 1,
            "desc": "Versioned service stop context"
          },
          {
            "id": "micro-behaviors/communications/proxy/socks::socks5-bind-command-byte",
            "conf": 0.6000000238418579,
            "crit": 1,
            "desc": "SOCKS5 BIND request opcode"
          },
          {
            "id": "micro-behaviors/process/info/query::zw-query-information-process",
            "conf": 0.800000011920929,
            "crit": 2,
            "desc": "ZwQueryInformationProcess import"
          },
          {
            "id": "micro-behaviors/os/registry/hive::set-registry-value",
            "atk": "T1112",
            "conf": 0.9300000071525574,
            "crit": 2,
            "desc": "Set registry value"
          },
          {
            "id": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe",
            "conf": 0.800000011920929,
            "crit": 1,
            "desc": "Five or more PE sections"
          },
          {
            "id": "objectives/evasion/masquerade/file/double-ext::basename-is-exe",
            "conf": 0.949999988079071,
            "crit": 1,
            "desc": "Filename has EXE extension"
          },
          {
            "id": "objectives/evasion/indicator-removal/cleanup::motw-removal-stream--rx-3",
            "atk": "T1562.001",
            "mbc": "B0047",
            "conf": 0.949999988079071,
            "crit": 1,
            "desc": "MOTW stream value component"
          },
          {
            "id": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table",
            "atk": "T1105",
            "mbc": "E1105",
            "conf": 0.800000011920929,
            "crit": 1,
            "desc": "Compact PE import table"
          },
          {
            "id": "micro-behaviors/fs/path/extension::exe-dup",
            "crit": 1,
            "desc": ".exe extension reference"
          },
          {
            "id": "objectives/evasion/anti-av/gui-decoy::minimal-pe-resources",
            "atk": "T1027",
            "conf": 0.800000011920929,
            "crit": 1,
            "desc": "Few PE resource entries"
          },
          {
            "id": "objectives/anti-static/obfuscation/string/runtime-decrypt::dll-names-no-loadlibrary",
            "atk": "T1027.007",
            "mbc": "B0032.014",
            "conf": 0.800000011920929,
            "crit": 1,
            "desc": "DLL name strings without LoadLibrary import"
          },
          {
            "id": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571",
            "atk": "T1055",
            "mbc": "C0041",
            "conf": 0.9200000166893005,
            "crit": 1,
            "desc": "Regex component marker"
          },
          {
            "id": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers",
            "atk": "T1027",
            "mbc": "B0032",
            "conf": 0.8600000143051147,
            "crit": 1,
            "desc": "Long mixed-case identifiers cluster"
          },
          {
            "id": "objectives/evasion/masquerade/debug::pe-stem-differs-from-pdb-stem",
            "atk": "T1036.005",
            "conf": 0.8500000238418579,
            "crit": 3,
            "desc": "PE stem disagrees with embedded PDB stem"
          },
          {
            "id": "metadata/package/quality::versioned",
            "conf": 0.8500000238418579,
            "crit": 2,
            "desc": "Contains version information"
          },
          {
            "id": "metadata/package/versioning::version-resource-metadata",
            "conf": 0.8999999761581421,
            "crit": 2,
            "desc": "PE version resource metadata"
          }
        ],
        "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/2026-04/888dba9b6af3eefee1af6835639b59022aa5ccf487cbdf0965887ca27f7c0478.exe",
        "risk": 4,
        "size": 14976,
        "type": "pe"
      }
    ]
  }
}