{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 0.8344548940658569,
        "class": 0
      }
    ],
    "prob": 0.8344549,
    "class": 0,
    "models": [
      {
        "m": "az",
        "prob": 0.8344549,
        "class": 0
      },
      {
        "m": "az/native",
        "prob": 0.07716687,
        "class": 0
      },
      {
        "m": "az/pe",
        "prob": 0.08341734,
        "class": 0
      }
    ],
    "version": "v16.16",
    "thresholds": [
      0.9979839,
      1.0
    ],
    "analyzed_at": "2026-05-11T16:48:58Z"
  },
  "path": "21045",
  "raw": {
    "v": "4",
    "fs": [
      {
        "f": "Md₂(Bi₄Si)",
        "k": {
          "pe.timestamp": 1311605149,
          "hash.authenti": "983c6aa27c1799ad76b0f7b4e66d2ca9391339bb521e04358781669beefdaf05",
          "hash.rich_header": "db0e4146d133bcf275be5f412d75aa55133f74896fa2fa4e23dbae42a9d14597",
          "build.target_arch": "x86",
          "pe.linker_version": "6.0",
          "pe.rich_header.xor_key": "0x0d2a3479",
          "pe.inflated_sections[0]": ".text",
          "pe.data_directories[0].rva": 20784,
          "pe.data_directories[1].rva": 45056,
          "pe.data_directories[0].name": "import",
          "pe.data_directories[0].size": 80,
          "pe.data_directories[1].name": "resource",
          "pe.data_directories[1].size": 100,
          "pe.rich_header_compids[0].count": 1,
          "pe.rich_header_compids[1].count": 3,
          "pe.rich_header_compids[2].count": 11,
          "pe.rich_header_compids[3].count": 2,
          "pe.rich_header_compids[4].count": 7,
          "pe.rich_header_compids[5].count": 74,
          "pe.rich_header_compids[6].count": 4,
          "pe.rich_header_compids[7].count": 1,
          "binary.top_complex_unnamed[0].cc": 17,
          "pe.rich_header_compids[0].compid": 793723,
          "pe.rich_header_compids[1].compid": 924803,
          "pe.rich_header_compids[2].compid": 663407,
          "pe.rich_header_compids[3].compid": 270191,
          "pe.rich_header_compids[4].compid": 6098883,
          "pe.rich_header_compids[5].compid": 65536,
          "pe.rich_header_compids[6].compid": 729064,
          "pe.rich_header_compids[7].compid": 394951,
          "binary.top_complex_unnamed[0].bbs": 26,
          "pe.rich_header_compids[5].product": "Unknown",
          "binary.top_complex_unnamed[0].addr": "0x40b071",
          "binary.top_complex_unnamed[0].size": 712,
          "pe.section_characteristics[0].name": ".text",
          "pe.section_characteristics[1].name": ".rdata",
          "pe.section_characteristics[2].name": ".data",
          "pe.section_characteristics[3].name": ".rsrc",
          "pe.section_characteristics[4].name": ".dat6",
          "pe.rich_header.entries[0].use_count": 1,
          "pe.rich_header.entries[1].use_count": 3,
          "pe.rich_header.entries[2].use_count": 11,
          "pe.rich_header.entries[3].use_count": 2,
          "pe.rich_header.entries[4].use_count": 7,
          "pe.rich_header.entries[5].use_count": 74,
          "pe.rich_header.entries[6].use_count": 4,
          "pe.rich_header.entries[7].use_count": 1,
          "pe.rich_header.entries[0].product_id": 12,
          "pe.rich_header.entries[1].product_id": 14,
          "pe.rich_header.entries[2].product_id": 10,
          "pe.rich_header.entries[3].product_id": 4,
          "pe.rich_header.entries[4].product_id": 93,
          "pe.rich_header.entries[5].product_id": 1,
          "pe.rich_header.entries[6].product_id": 11,
          "pe.rich_header.entries[7].product_id": 6,
          "pe.rich_header.entries[0].build_number": 7291,
          "pe.rich_header.entries[0].product_name": "unknown",
          "pe.rich_header.entries[1].build_number": 7299,
          "pe.rich_header.entries[1].product_name": "Export_VC2003",
          "pe.rich_header.entries[2].build_number": 8047,
          "pe.rich_header.entries[2].product_name": "Linker_v6",
          "pe.rich_header.entries[3].build_number": 8047,
          "pe.rich_header.entries[3].product_name": "Linker_VS_v6_or_earlier",
          "pe.rich_header.entries[4].build_number": 4035,
          "pe.rich_header.entries[4].product_name": "unknown",
          "pe.rich_header.entries[5].product_name": "Imp_VS_v6_or_earlier",
          "pe.rich_header.entries[6].build_number": 8168,
          "pe.rich_header.entries[6].product_name": "Cvt_Omf",
          "pe.rich_header.entries[7].build_number": 1735,
          "pe.rich_header.entries[7].product_name": "Cvt_Pgo_VS_v6_or_earlier",
          "pe.section_characteristics[0].raw_size": 2048,
          "pe.section_characteristics[4].raw_size": 21504,
          "pe.section_characteristics[0].virtual_size": 14565,
          "pe.section_characteristics[1].virtual_size": 1508,
          "pe.section_characteristics[2].virtual_size": 1132,
          "pe.section_characteristics[3].virtual_size": 13936,
          "pe.section_characteristics[4].virtual_size": 24576,
          "pe.section_characteristics[0].virtual_address": 4096,
          "pe.section_characteristics[1].virtual_address": 20480,
          "pe.section_characteristics[2].virtual_address": 24576,
          "pe.section_characteristics[3].virtual_address": 28672,
          "pe.section_characteristics[4].virtual_address": 45056,
          "pe.section_characteristics[0].characteristics_hex": "e00000e0",
          "pe.section_characteristics[1].characteristics_hex": "e00000e0",
          "pe.section_characteristics[2].characteristics_hex": "e00000e0",
          "pe.section_characteristics[3].characteristics_hex": "e00000e0",
          "pe.section_characteristics[4].characteristics_hex": "e00000e0"
        },
        "x": 5,
        "id": 0,
        "ms": {
          "pe": {
            "entry": 4096.0,
            "machine": 332.0,
            "checksum": 0.0,
            "subsystem": 2.0,
            "timestamp": 1311605149.0,
            "image_base": 4194304.0,
            "entry_section": ".text",
            "size_of_image": 69632.0,
            "file_alignment": 512.0,
            "resource_count": 1.0,
            "characteristics": 271.0,
            "has_rich_header": true,
            "overlay_padding": 512.0,
            "size_of_headers": 1024.0,
            "export_timestamp": 0.0,
            "computed_checksum": 76737.0,
            "section_alignment": 4096.0,
            "resource_timestamp": 0.0,
            "has_export_timestamp": false,
            "linker_major_version": 6.0,
            "bss_like_section_count": 3.0,
            "has_resource_timestamp": false,
            "number_of_rva_and_sizes": 16.0,
            "entry_in_writable_section": true,
            "max_section_inflation_ratio": 7.11
          },
          "file": {
            "size": 25088.0
          },
          "binary": {
            "code_size": 23552.0,
            "func_count": 2.0,
            "has_overlay": true,
            "code_entropy": 2.88,
            "func_density": 0.09,
            "overlay_size": 512.0,
            "string_count": 12.0,
            "avg_func_size": 368.0,
            "overlay_ratio": 0.02,
            "section_count": 5.0,
            "avg_complexity": 9.0,
            "max_complexity": 17.0,
            "string_density": 0.52,
            "overall_entropy": 2.88,
            "overlay_entropy": 5.57,
            "avg_basic_blocks": 13.5,
            "avg_section_size": 4710.4,
            "entropy_variance": 3.55,
            "wx_section_count": 5.0,
            "avg_string_length": 7.58,
            "complexity_per_kb": 0.39,
            "max_string_length": 40.0,
            "wide_string_count": 1.0,
            "avg_string_entropy": 2.12,
            "code_to_data_ratio": 15.33,
            "text_to_file_ratio": 0.08,
            "total_basic_blocks": 27.0,
            "func_analysis_depth": 2.0,
            "high_entropy_regions": 1.0,
            "string_length_stddev": 9.79,
            "largest_section_ratio": 0.86,
            "sentence_string_count": 1.0,
            "sentence_string_ratio": 0.08,
            "writable_section_count": 5.0,
            "entry_in_writable_region": true,
            "executable_section_count": 5.0,
            "nonstandard_section_count": 1.0
          }
        },
        "ss": [
          [
            77,
            "!This program cannot be run in DOS mode."
          ],
          [
            480,
            ".text"
          ],
          [
            520,
            ".rdata"
          ],
          [
            560,
            ".data"
          ],
          [
            600,
            ".rsrc"
          ],
          [
            3098,
            "wide",
            "POPUP"
          ],
          [
            5073,
            "/gH0"
          ],
          [
            5089,
            "ABGQ"
          ],
          [
            7576,
            "/EJuC"
          ],
          [
            8327,
            ".qml"
          ],
          [
            16145,
            "Gsna"
          ],
          [
            17818,
            "Zvqq"
          ]
        ],
        "sz": 25088,
        "ts": [
          {
            "a": "T1027.007",
            "c": 1.0,
            "d": "WININET.DLL absent from PE import table",
            "e": [
              "pe.import_dll_count = 0.00"
            ],
            "i": "objectives/anti-static/obfuscation/imports::wininet-import-absent",
            "l": 2,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.699999988079071,
            "d": "Code section dominates file layout",
            "e": [
              "binary.largest_section_ratio = 0.86"
            ],
            "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.8999999761581421,
            "d": "PE mapped image under 768 KiB",
            "e": [
              "pe.size_of_image = 69632.00"
            ],
            "i": "metadata/binary/layout::image-under-768kb",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "Tiny writable data section",
            "e": [
              ".data (size: 0)"
            ],
            "i": "metadata/binary/section/metrics::tiny-data-section",
            "l": 1
          },
          {
            "a": "T1055.012",
            "c": 1.0,
            "d": "Lacks substantial resources",
            "e": [
              "binary.rsrc_to_file_ratio = 0.00"
            ],
            "i": "objectives/evasion/process/injection/hollowing::lacks-substantial-resources",
            "l": 1,
            "m": "E1055.012"
          },
          {
            "a": "T1036.005",
            "c": 0.9700000286102295,
            "d": "PE has no Authenticode signature",
            "e": [
              "binary.has_signature = 0.00"
            ],
            "i": "objectives/evasion/masquerade/version-resource/microsoft-utility::dw20-host-unsigned",
            "l": 1,
            "m": "F0004"
          },
          {
            "c": 0.800000011920929,
            "d": "Five section PE layout",
            "e": [
              "binary.section_count = 5.00"
            ],
            "i": "metadata/binary/section/metrics::five-section-pe",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "PE resource section",
            "e": [
              ".rsrc"
            ],
            "i": "metadata/binary/section/names::pe-resource-section",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "Binary has low overall entropy",
            "e": [
              "binary.overall_entropy = 2.88"
            ],
            "i": "metadata/binary/metrics/threshold::low-overall-entropy-binary",
            "l": 1
          },
          {
            "c": 0.8500000238418579,
            "d": "PE checksum field not set",
            "e": [
              "pe.has_checksum = 0.00"
            ],
            "i": "metadata/binary/layout::pe-checksum-absent",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "PE Rich header present (MSVC toolchain)",
            "e": [
              "pe.has_rich_header = 1.00"
            ],
            "i": "metadata/binary/resource::rich-header-present",
            "l": 2
          },
          {
            "a": "T1105",
            "c": 1.0,
            "d": "Binary contains high-entropy data regions",
            "e": [
              "binary.high_entropy_regions = 1.00"
            ],
            "i": "objectives/command-and-control/dropper/staging/embedded::has-high-entropy-regions",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "PE has under ten imports",
            "e": [
              "binary.import_count = 0.00"
            ],
            "i": "objectives/anti-static/pack/runtime::pe-import-count-under-10",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "PE standard runtime section",
            "e": [
              ".rdata"
            ],
            "i": "metadata/binary/section/names::pe-runtime-standard-section",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "PE imports from one DLL",
            "e": [
              "pe.import_dll_count = 0.00"
            ],
            "i": "metadata/binary/symbols/imports::pe-single-import-dll",
            "l": 1
          },
          {
            "a": "T1055.012",
            "c": 1.0,
            "d": "Lacks substantial data section",
            "e": [
              "binary.data_to_file_ratio = 0.00"
            ],
            "i": "objectives/evasion/process/injection/hollowing::lacks-substantial-data",
            "l": 1,
            "m": "E1055.012"
          },
          {
            "c": 0.699999988079071,
            "d": "PE has low overall entropy",
            "e": [
              "binary.overall_entropy = 2.88"
            ],
            "i": "metadata/binary/layout::low-overall-entropy",
            "l": 2
          },
          {
            "c": 0.800000011920929,
            "d": "Low-entropy rdata section",
            "e": [
              ".rdata (entropy: 0.00)"
            ],
            "i": "metadata/binary/section/metrics::low-entropy-rdata-section",
            "l": 1
          },
          {
            "c": 0.75,
            "d": "Binary exports no symbols",
            "e": [
              "binary.export_count = 0.00"
            ],
            "i": "metadata/binary/symbols/exports::no-exports",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "VB6 binary with very few strings",
            "e": [
              "binary.string_count = 12.00"
            ],
            "i": "objectives/anti-static/obfuscation/payload/string-sparse::low-string-count-vb6",
            "l": 1,
            "m": "B0032"
          },
          {
            "d": "Few detected functions (stub-like or analysis-limited)",
            "e": [
              "binary.func_count = 2.00"
            ],
            "i": "metadata/binary/metrics/structural::no-functions",
            "l": 2
          },
          {
            "c": 0.8999999761581421,
            "d": "Import count is exactly zero",
            "e": [
              "binary.import_count = 0.00"
            ],
            "i": "objectives/evasion/masquerade/identity/vendor::zero-import-count",
            "l": 2
          },
          {
            "c": 0.800000011920929,
            "d": "Small PE resource section",
            "e": [
              "pe.rsrc_size = 0.00"
            ],
            "i": "metadata/package/versioning::pe-small-rsrc",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Binary has low average complexity",
            "e": [
              "binary.avg_complexity = 9.00"
            ],
            "i": "metadata/binary/metrics/threshold::avg-complexity-15-max",
            "l": 2
          },
          {
            "c": 0.8600000143051147,
            "d": "Inflated PE data section",
            "e": [
              "pe.max_section_inflation_ratio = 7.11"
            ],
            "i": "metadata/binary/section/metrics::inflated-data-section",
            "l": 1
          },
          {
            "a": "T1553.002",
            "c": 0.8500000238418579,
            "d": "PE lacks VS_VERSION_INFO resource",
            "e": [
              "field 'pe.version_info.file_version' does not exist"
            ],
            "i": "objectives/evasion/masquerade/cert::pe-no-version-info-resource",
            "l": 1
          },
          {
            "c": 0.8199999928474426,
            "d": "Elevated text section entropy",
            "e": [
              ".text (entropy: 6.43)"
            ],
            "i": "metadata/binary/section/metrics::elevated-text-entropy-section",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "CompanyName field absent from PE version info",
            "e": [
              "field 'pe.version_info.company_name' does not exist"
            ],
            "i": "metadata/binary/anomaly/format::version-info-company-name-absent",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "PE binary has trailing overlay data",
            "e": [
              "binary.has_overlay = 1.00"
            ],
            "i": "metadata/binary/layout::has-overlay",
            "l": 3
          },
          {
            "c": 1.0,
            "d": "Binary has low average string entropy",
            "e": [
              "binary.avg_string_entropy = 2.12"
            ],
            "i": "metadata/binary/metrics/threshold::avg-string-entropy-4-max",
            "l": 2
          },
          {
            "c": 0.699999988079071,
            "d": "PE with six or fewer imports",
            "e": [
              "binary.import_count = 0.00"
            ],
            "i": "metadata/binary/symbols/imports::pe-imports-max-six",
            "l": 1
          },
          {
            "a": "T1622",
            "c": 0.949999988079071,
            "d": "Minimal PE import DLL count (\u003c= 3)",
            "e": [
              "pe.import_dll_count = 0.00"
            ],
            "i": "objectives/anti-analysis/debugger-detect/stub::minimal-import-dll-count",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "PE standard code/data section",
            "e": [
              ".text",
              ".data"
            ],
            "i": "metadata/binary/section/names::pe-code-data-standard-section",
            "l": 1
          },
          {
            "a": "T1070.006",
            "c": 0.699999988079071,
            "d": "PE header compile timestamp predates 2025",
            "e": [
              "pe.timestamp = 1311605149.00"
            ],
            "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "File is a compiled binary",
            "e": [
              "21045"
            ],
            "i": "metadata/binary/framework::is-binary",
            "l": 1
          },
          {
            "c": 0.7200000286102295,
            "d": "Writable .rdata section permissions",
            "e": [
              ".rdata (perms: rwx)"
            ],
            "i": "metadata/binary/section/names::writable-rdata",
            "l": 3
          },
          {
            "c": 0.800000011920929,
            "d": "Five or more PE sections",
            "e": [
              "binary.section_count = 5.00"
            ],
            "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Binary is not digitally signed",
            "e": [
              "binary.has_signature = 0.00"
            ],
            "i": "metadata/signed/trust-level::unsigned",
            "l": 3
          },
          {
            "c": 0.699999988079071,
            "d": "No imported symbols",
            "e": [
              "binary.import_density = 0.00"
            ],
            "i": "metadata/binary/metrics/structural::no-imports",
            "l": 3
          },
          {
            "a": "T1070.006",
            "c": 0.8999999761581421,
            "d": "Export timestamp is absent",
            "e": [
              "pe.has_export_timestamp = 0.00"
            ],
            "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-absent",
            "l": 2
          },
          {
            "c": 0.8999999761581421,
            "d": "Tiny C string section ratio",
            "e": [
              ".rdata = 0.0% of total (0 / 25088 bytes)",
              ".rdata"
            ],
            "i": "metadata/binary/section/metrics::tiny-cstring-section",
            "l": 1
          },
          {
            "a": "T1055",
            "c": 0.949999988079071,
            "d": "Huge null run in executable (128+ bytes)",
            "e": [
              "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00"
            ],
            "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.8199999928474426,
            "d": "Packed loader largest section ratio above 0.65",
            "e": [
              "binary.largest_section_ratio = 0.86"
            ],
            "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1027.002",
            "c": 0.699999988079071,
            "d": "PE with single import",
            "e": [
              "binary.import_count = 0.00"
            ],
            "i": "objectives/command-and-control/dropper/execution/loader::pe-single-import",
            "l": 1
          },
          {
            "a": "T1612",
            "c": 0.8500000238418579,
            "d": "PE has few icon resources",
            "e": [
              "pe.icon_count = 0.00"
            ],
            "i": "objectives/anti-static/obfuscation/payload/resource::icon-count-under-six",
            "l": 1,
            "m": "B0023"
          },
          {
            "a": "T1105",
            "c": 0.800000011920929,
            "d": "Compact PE import table",
            "e": [
              "binary.import_count = 0.00"
            ],
            "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table",
            "l": 1,
            "m": "E1105"
          },
          {
            "a": "T1027",
            "c": 0.800000011920929,
            "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)",
            "e": [
              "pe.resource_count = 1.00"
            ],
            "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "PE has multiple BSS-style sections",
            "e": [
              "pe.bss_like_section_count = 3.00"
            ],
            "i": "metadata/binary/anomaly/format::pe-bss-like-sections-multiple",
            "l": 3
          },
          {
            "a": "T1055",
            "c": 0.9200000166893005,
            "d": "Regex component marker",
            "e": [
              "binary.import_count = 0.00"
            ],
            "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571",
            "l": 1,
            "m": "C0041"
          },
          {
            "c": 0.800000011920929,
            "d": "Tiny resource section (no version/icon)",
            "e": [
              ".rsrc (size: 0)"
            ],
            "i": "metadata/binary/resource::minimal-resources",
            "l": 2
          },
          {
            "a": "T1027.002",
            "c": 0.699999988079071,
            "d": "PE with very few imports",
            "e": [
              "binary.import_count = 0.00"
            ],
            "i": "objectives/command-and-control/dropper/execution/loader::pe-few-imports",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.949999988079071,
            "d": "Regex component marker",
            "e": [
              "binary.largest_section_ratio = 0.86"
            ],
            "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.800000011920929,
            "d": "PE executable is unsigned",
            "e": [
              "binary.has_signature = 0.00"
            ],
            "i": "metadata/signed/trust-level::unsigned-pe-executable",
            "l": 3
          },
          {
            "c": 0.8999999761581421,
            "d": "High-trust tool delivered via low-integrity packaging",
            "e": [
              "binary.has_overlay = 1.00",
              "binary.has_signature = 0.00"
            ],
            "i": "objectives/supply-chain/trojanized/app/monitor::low-integrity-installer-packaging",
            "l": 1
          }
        ],
        "sha": "8a4614decf49ad52f097efed29614da9f606049ec636ea207bda503e49c1db9e",
        "path": "21045",
        "type": "pe"
      }
    ],
    "tv": "46790"
  }
}