{ "ml": { "v": "7", "eng": "2.9.1", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.00005795558, "rte": "az", "prob": 0.00005795558 }, { "cls": 0, "raw": 0.0022916098, "rte": "az/native", "prob": 0.0022916098 }, { "cls": 0, "raw": 0.008007824, "rte": "az/pe", "prob": 0.008007824 } ], "prob": 0.00005795558, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.000057955581723945215, "type": "pe" } ], "version": "v18.18", "analyzed_at": "2026-09-14T18:33:16Z" }, "path": "wdbgF.exe", "raw": { "v": "8", "rev": "c7f7e", "files": [ { "id": 0, "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J\u0026m(0ji6Sa?dLD+]{51x(+zoA=kPhvqNb%vqY$3BrC47aAzQxazCZol@c-7zeS@@e!5l%bME/A00000p^\u003eu:wqg-$yaUxV0nmRS\u003eNEN)[bK^n3JZwU0f^G:0r8", "ln": 0 }, { "b": "00000000000000000000000000000000000000009SMfu00000000000000000000000000000000000Xz43H0rr91YXrDL0rr91Z$O(P0rr91-m\u003eqT0rr91:Lc.X0rr91+?Ad-0rr91=\u0026", "ln": 104928 }, { "b": "0000000000000000000000000000000000000000k%^}bmmG^rnLhSHo?[FXqbQs(rArg6sZ2lyv}od.xj#0]yIW\u003c9z/xYpB98LFCx!yVfFLssg=mfIi5@Gx00000000000000000000fFLssg=k", "ln": 105440 }, { "b": "0000000l\u003cmCql-g0007.yYBCn3t\u003c-?Aa9l(uT^}(yYFAIn=R9S0000Q0000000001Ofwjs00cKeA2G8^0007.00dlyA3q\u003c]0007.2MLiGA9)M)v@2B?x(0=/d[P!b0rr91bME/A000000I06]0004e0b\u0026..0@@r5KPkv?ze-\u003c6yIv./w4R^w0e9]zkMH\u0026+0h/!%00000009", "ln": 153216 }, { "b": "k$svJpe\u003eN\u003eml%sgqD0Mt9u^JK000-pFe[)m2(\u003c@op?Ub}x\u003e7N/l1BIDwPI[)FGk1\u003c0rr9gr+VO@BZY8+x)Ks\u003cF/La\u003e0rr913%#O2k$svJq:\u003c5MnL-8*njt*jmn:alEJuoj0003{vqPM", "ln": 220987 } ], "mol": "Md(Bi)", "sha": "8eaeea02f70fa219e4d887ec921ca1cce4283f40256f5920db2d8dbb895c2aec", "path": "wdbgF.exe", "risk": 1, "size": 529997, "type": "pe", "facts": { "imp": [ [ "advapi32", "GetUserNameA" ], [ "advapi32", "RegCloseKey" ], [ "advapi32", "RegDeleteValueA" ], [ "advapi32", "RegOpenKeyA" ], [ "advapi32", "RegSetValueExA" ], [ "bcrypt", "BCryptGenRandom" ], [ "kernel32", "CloseHandle" ], [ "kernel32", "CopyFileA" ], [ "kernel32", "CreateDirectoryA" ], [ "kernel32", "CreateFileA" ], [ "kernel32", "CreatePipe" ], [ "kernel32", "CreateProcessA" ], [ "kernel32", "CreateThread" ], [ "kernel32", "CreateToolhelp32Snapshot" ], [ "kernel32", "DeleteCriticalSection" ], [ "kernel32", "DeleteFileA" ], [ "kernel32", "EnterCriticalSection" ], [ "kernel32", "ExitProcess" ], [ "kernel32", "FileTimeToLocalFileTime" ], [ "kernel32", "FileTimeToSystemTime" ], [ "kernel32", "FindClose" ], [ "kernel32", "FindFirstFileA" ], [ "kernel32", "FindNextFileA" ], [ "kernel32", "GetConsoleWindow" ], [ "kernel32", "GetCurrentProcessId" ], [ "kernel32", "GetLastError" ], [ "kernel32", "GetModuleFileNameA" ], [ "kernel32", "GetModuleHandleA" ], [ "kernel32", "GetProcAddress" ], [ "kernel32", "GetStdHandle" ], [ "kernel32", "GetSystemDirectoryA" ], [ "kernel32", "InitializeCriticalSection" ], [ "kernel32", "IsDBCSLeadByteEx" ], [ "kernel32", "LeaveCriticalSection" ], [ "kernel32", "LoadLibraryA" ], [ "kernel32", "MoveFileA" ], [ "kernel32", "MultiByteToWideChar" ], [ "kernel32", "OpenProcess" ], [ "kernel32", "PeekNamedPipe" ], [ "kernel32", "Process32First" ], [ "kernel32", "Process32Next" ], [ "kernel32", "ReadFile" ], [ "kernel32", "RemoveDirectoryA" ], [ "kernel32", "SetFileAttributesA" ], [ "kernel32", "SetHandleInformation" ], [ "kernel32", "SetStdHandle" ], [ "kernel32", "SetUnhandledExceptionFilter" ], [ "kernel32", "Sleep" ], [ "kernel32", "TerminateProcess" ], [ "kernel32", "TerminateThread" ], [ "kernel32", "TlsGetValue" ], [ "kernel32", "VirtualAlloc" ], [ "kernel32", "VirtualFree" ], [ "kernel32", "VirtualProtect" ], [ "kernel32", "VirtualQuery" ], [ "kernel32", "WaitForSingleObject" ], [ "kernel32", "WideCharToMultiByte" ], [ "kernel32", "WriteFile" ], [ "kernel32", "C_specific_handler" ], [ "msvcrt", "lc_codepage_func" ], [ "msvcrt", "mb_cur_max_func" ], [ "msvcrt", "getmainargs" ], [ "msvcrt", "initenv" ], [ "msvcrt", "iob_func" ], [ "msvcrt", "set_app_type" ], [ "msvcrt", "setusermatherr" ], [ "msvcrt", "amsg_exit" ], [ "msvcrt", "cexit" ], [ "msvcrt", "chdir" ], [ "msvcrt", "commode" ], [ "msvcrt", "errno" ], [ "msvcrt", "fmode" ], [ "msvcrt", "getcwd" ], [ "msvcrt", "initterm" ], [ "msvcrt", "lock" ], [ "msvcrt", "mkdir" ], [ "msvcrt", "onexit" ], [ "msvcrt", "stat64" ], [ "msvcrt", "stricmp" ], [ "msvcrt", "time64" ], [ "msvcrt", "unlock" ], [ "msvcrt", "abort" ], [ "msvcrt", "atoi" ], [ "msvcrt", "calloc" ], [ "msvcrt", "exit" ], [ "msvcrt", "fclose" ], [ "msvcrt", "fopen" ], [ "msvcrt", "fprintf" ], [ "msvcrt", "fputc" ], [ "msvcrt", "fread" ], [ "msvcrt", "free" ], [ "msvcrt", "fwrite" ], [ "msvcrt", "getenv" ], [ "msvcrt", "localeconv" ], [ "msvcrt", "malloc" ], [ "msvcrt", "memchr" ], [ "msvcrt", "memcmp" ], [ "msvcrt", "memcpy" ], [ "msvcrt", "memset" ], [ "msvcrt", "realloc" ], [ "msvcrt", "remove" ], [ "msvcrt", "signal" ], [ "msvcrt", "strchr" ], [ "msvcrt", "strcmp" ], [ "msvcrt", "strcspn" ], [ "msvcrt", "strerror" ], [ "msvcrt", "strlen" ], [ "msvcrt", "strncat" ], [ "msvcrt", "strncmp" ], [ "msvcrt", "strncpy" ], [ "msvcrt", "strrchr" ], [ "msvcrt", "strspn" ], [ "msvcrt", "system" ], [ "msvcrt", "vfprintf" ], [ "msvcrt", "wcslen" ], [ "user32", "ShowWindow" ], [ "winhttp", "WinHttpCloseHandle" ], [ "winhttp", "WinHttpConnect" ], [ "winhttp", "WinHttpOpen" ], [ "winhttp", "WinHttpOpenRequest" ], [ "winhttp", "WinHttpQueryHeaders" ], [ "winhttp", "WinHttpReadData" ], [ "winhttp", "WinHttpReceiveResponse" ], [ "winhttp", "WinHttpSendRequest" ], [ "winhttp", "WinHttpSetTimeouts" ], [ "ws2_32", "WSAGetLastError" ], [ "ws2_32", "WSAStartup" ], [ "ws2_32", "WSAFDIsSet" ], [ "ws2_32", "closesocket" ], [ "ws2_32", "connect" ], [ "ws2_32", "gethostbyname" ], [ "ws2_32", "gethostname" ], [ "ws2_32", "htons" ], [ "ws2_32", "inet_pton" ], [ "ws2_32", "ioctlsocket" ], [ "ws2_32", "recv" ], [ "ws2_32", "recvfrom" ], [ "ws2_32", "select" ], [ "ws2_32", "send" ], [ "ws2_32", "sendto" ], [ "ws2_32", "setsockopt" ], [ "ws2_32", "socket" ] ], "sec": [ [ ".text", 1536, 103424, 5.91, "r-x" ], [ ".data", 104960, 512, 1.66, "rw-" ], [ ".rdata", 105472, 12288, 5.9, "r--" ], [ ".pdata", 117760, 3584, 4.98, "r--" ], [ ".xdata", 121344, 3584, 4.36, "r--" ], [ ".bss", 0, 0, 0.0, "rw-" ], [ ".idata", 124928, 5632, 4.28, "rw-" ], [ ".CRT", 130560, 512, 0.31, "rw-" ], [ ".tls", 131072, 512, 0.0, "rw-" ], [ ".reloc", 131584, 512, 2.03, "r--" ], [ ".debug_aranges", 132096, 2560, 1.95, "r--" ], [ ".debug_info", 134656, 167424, 5.8, "r--" ], [ ".debug_abbrev", 302080, 22528, 4.8, "r--" ], [ ".debug_line", 324608, 58880, 5.26, "r--" ], [ ".debug_frame", 383488, 14848, 4.69, "r--" ], [ ".debug_str", 398336, 2048, 4.09, "r--" ], [ ".debug_line_str", 400384, 15360, 4.77, "r--" ], [ ".debug_loclists", 415744, 31232, 5.82, "r--" ], [ ".debug_rnglists", 446976, 2048, 5.25, "r--" ] ], "metrics": { "pe": { "checksum": 558290, "timestamp": 1787571562, "image_size": 503808, "has_overlay": 1, "overlay_end": 529997, "headers_size": 1536, "overlay_size": 80973, "checksum_valid": 1, "file_alignment": 512, "overlay_offset": 449024, "overlay_padding": 80973, "computed_checksum": 558290, "headers_size_ratio": 0, "tls_callback_count": 2, "prose_section_count": 0, "reloc_overhang_bytes": 344, "reloc_overhang_ratio": 0.67, "bss_like_section_count": 0, "section_overflow_count": 0, "misaligned_section_count": 0, "base_relocation_block_count": 5, "base_relocation_entry_count": 61, "declared_data_directory_count": 5, "executable_prose_section_count": 0, "directory_section_mismatch_count": 1 }, "file": { "size": 529997, "entropy": 5.98 }, "binary": { "is_pie": 1, "has_overlay": 1, "code_entropy": 5.91, "data_entropy": 3.5, "overlay_size": 80973, "string_count": 2365, "overlay_ratio": 0.15, "overlay_entropy": 3.9, "entropy_variance": 3.5, "avg_string_length": 14.99, "max_string_length": 200, "peak_region_bytes": 1024, "code_to_data_ratio": 0.94, "peak_region_entropy": 7.23, "string_length_stddev": 13.85, "largest_section_ratio": 0.32, "sentence_string_count": 82, "sentence_string_ratio": 0.03, "high_entropy_string_count": 1 }, "imports": { "count": 142 }, "sections": { "count": 19, "code_size": 103424, "entropy_max": 5.91, "entropy_mean": 3.99, "name_entropy": 4.11, "writable_count": 5, "executable_count": 1, "nonstandard_count": 10, "executable_writable_count": 0 }, "dependencies": { "count": 7 } } }, "ident": { "trust": "unsigned", "build_path": { "value": "/home/uagent/newcompany/os_v2/service/remote_control/dev/adaptix-c2/stealth_tools/c_agent/win", "source": "strings", "verified": false } }, "traits": [ { "id": "metadata/binary/section/metrics::multiple-nonstandard-section-names", "conf": 0.9, "crit": 3, "desc": "Multiple nonstandard PE section names", "spans": [ [ 0, 34 ] ] } ] } ] } }