{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 0.8985074758529663,
        "class": 0
      }
    ],
    "prob": 0.8985075,
    "class": 0,
    "models": [
      {
        "m": "az",
        "prob": 0.8985075,
        "class": 0
      },
      {
        "m": "az/native",
        "prob": 0.032846715,
        "class": 0
      },
      {
        "m": "az/pe",
        "prob": 0.2514535,
        "class": 0
      }
    ],
    "version": "v16.16",
    "thresholds": [
      0.9983558,
      0.99991804
    ],
    "analyzed_at": "2026-05-19T03:26:02Z"
  },
  "path": "935e9815a88a0b395e6fa44d6d30315082a6701cf3ebc9c44177dd57fa787b87.exe",
  "raw": {
    "v": "4",
    "fs": [
      {
        "f": "Md₂(BiSi)",
        "k": {
          "binary.top_complex_unnamed[0].cc": 18,
          "binary.top_complex_unnamed[1].cc": 3,
          "binary.top_complex_unnamed[2].cc": 2,
          "binary.top_complex_unnamed[0].bbs": 33,
          "binary.top_complex_unnamed[1].bbs": 5,
          "binary.top_complex_unnamed[2].bbs": 3,
          "binary.top_complex_unnamed[0].addr": "0x401340",
          "binary.top_complex_unnamed[0].size": 1938,
          "binary.top_complex_unnamed[1].addr": "0x4012e9",
          "binary.top_complex_unnamed[1].size": 67,
          "binary.top_complex_unnamed[2].addr": "0x401b60",
          "binary.top_complex_unnamed[2].size": 688
        },
        "x": 3,
        "id": 0,
        "ms": {
          "file": {
            "size": 9551.0
          },
          "binary": {
            "code_size": 79872.0,
            "func_count": 18.0,
            "func_density": 0.23,
            "string_count": 13.0,
            "avg_func_size": 33361.39,
            "section_count": 9.0,
            "avg_complexity": 1.44,
            "max_complexity": 18.0,
            "string_density": 0.17,
            "overall_entropy": 5.65,
            "avg_basic_blocks": 3.56,
            "avg_section_size": 175274.67,
            "avg_string_length": 7.85,
            "complexity_per_kb": 0.15,
            "max_string_length": 40.0,
            "avg_string_entropy": 2.32,
            "code_section_ratio": 0.11,
            "code_to_data_ratio": 0.05,
            "data_to_file_ratio": 0.16,
            "rsrc_to_file_ratio": 154.92,
            "text_to_file_ratio": 8.36,
            "total_basic_blocks": 64.0,
            "func_analysis_depth": 2.0,
            "section_name_entropy": 3.72,
            "string_length_stddev": 9.42,
            "largest_section_ratio": 154.92,
            "sentence_string_count": 1.0,
            "sentence_string_ratio": 0.08,
            "writable_section_count": 6.0,
            "has_malformed_structure": true,
            "executable_section_count": 1.0,
            "normalized_section_count": 0.68,
            "nonstandard_section_count": 1.0
          }
        },
        "ss": [
          [
            77,
            "!This program cannot be run in DOS mode."
          ],
          [
            376,
            ".text"
          ],
          [
            456,
            ".rdata"
          ],
          [
            494,
            "`@.eh_fram"
          ],
          [
            534,
            "0@.bss"
          ],
          [
            576,
            ".idata"
          ],
          [
            656,
            ".tls"
          ],
          [
            696,
            ".rsrc"
          ],
          [
            5297,
            "3456"
          ],
          [
            5307,
            "7890"
          ],
          [
            5317,
            "/qwe"
          ],
          [
            5337,
            "iopa"
          ],
          [
            7904,
            "UWVS"
          ]
        ],
        "sz": 9551,
        "ts": [
          {
            "a": "T1027",
            "c": 0.30000001192092896,
            "d": "PE header too corrupted to parse: Malformed entity: malformed resource table size (1479216 bytes)",
            "e": [
              "Malformed entity: malformed resource table size (1479216 bytes)"
            ],
            "i": "objectives/anti-analysis/pe-tampering/corrupted-header",
            "l": 2,
            "m": "B0001"
          },
          {
            "c": 0.8999999761581421,
            "d": "PE standard code/data section",
            "e": [
              ".text",
              ".data"
            ],
            "i": "metadata/binary/section/names::pe-code-data-standard-section",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "Resource section is major PE share",
            "e": [
              "binary.rsrc_to_file_ratio = 154.92"
            ],
            "i": "metadata/binary/section/metrics::major-rsrc-section",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Binary has low average complexity",
            "e": [
              "binary.avg_complexity = 1.44"
            ],
            "i": "metadata/binary/metrics/threshold::avg-complexity-15-max",
            "l": 2
          },
          {
            "c": 0.800000011920929,
            "d": "CompanyName field absent from PE version info",
            "e": [
              "field 'pe.version_info.company_name' does not exist"
            ],
            "i": "metadata/binary/anomaly/format::version-info-company-name-absent",
            "l": 1
          },
          {
            "c": 0.8799999952316284,
            "d": "Sparse function count stub",
            "e": [
              "binary.func_count = 18.00"
            ],
            "i": "well-known/malware/trojan/shellobject/revengerat::sparse-function-stub",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "File is a compiled binary",
            "e": [
              "935e9815a88a0b395e6fa44d6d30315082a6701cf3ebc9c44177dd57fa787b87.exe"
            ],
            "i": "metadata/binary/framework::is-binary",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Binary has low average string entropy",
            "e": [
              "binary.avg_string_entropy = 2.32"
            ],
            "i": "metadata/binary/metrics/threshold::avg-string-entropy-4-max",
            "l": 2
          },
          {
            "c": 0.9200000166893005,
            "d": "Resource section dominates PE size",
            "e": [
              "binary.rsrc_to_file_ratio = 154.92"
            ],
            "i": "metadata/binary/section/metrics::dominant-rsrc-section",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "Native runtime has huge functions",
            "e": [
              "binary.avg_func_size = 33361.39"
            ],
            "i": "metadata/lang/compiler/aot::huge-runtime-average-function",
            "l": 2
          },
          {
            "c": 0.8799999952316284,
            "d": "Small string table footprint",
            "e": [
              "binary.string_count = 13.00"
            ],
            "i": "well-known/malware/trojan/shellobject/revengerat::tiny-string-table",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "Large PE resource section (\u003e150KB)",
            "e": [
              ".rsrc (size: 1479680)"
            ],
            "i": "objectives/anti-static/obfuscation/binary-metrics/overlay::large-pe-resource-section",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "PE file uses .exe extension",
            "e": [
              "935e9815a88a0b395e6fa44d6d30315082a6701cf3ebc9c44177dd57fa787b87.exe"
            ],
            "i": "metadata/binary/framework::exe-extension",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "Very low code entropy, minimal code",
            "e": [
              "binary.code_entropy = 0.00"
            ],
            "i": "metadata/binary/resource::low-code-entropy",
            "l": 2
          },
          {
            "c": 0.75,
            "d": "Binary exports no symbols",
            "e": [
              "binary.export_count = 0.00"
            ],
            "i": "metadata/binary/symbols/exports::no-exports",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "PE TLS section",
            "e": [
              ".tls"
            ],
            "i": "metadata/binary/section/names::pe-tls-section",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "PE resource section",
            "e": [
              ".rsrc"
            ],
            "i": "metadata/binary/section/names::pe-resource-section",
            "l": 1
          },
          {
            "c": 0.8500000238418579,
            "d": "Large zero-entropy placeholder section",
            "e": [
              ".rdata (size: 10752, entropy: 0.00, perms: -r--)"
            ],
            "i": "metadata/binary/section/metrics::null-placeholder-section",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "PE has under ten imports",
            "e": [
              "binary.import_count = 0.00"
            ],
            "i": "objectives/anti-static/pack/runtime::pe-import-count-under-10",
            "l": 1
          },
          {
            "c": 0.949999988079071,
            "d": "PE section declared larger than file (truncated/corrupt)",
            "e": [
              "binary.largest_section_ratio = 154.92"
            ],
            "i": "metadata/binary/metrics/structural::section-exceeds-file-size",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.699999988079071,
            "d": "Code section dominates file layout",
            "e": [
              "binary.largest_section_ratio = 154.92"
            ],
            "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "VB6 binary with very few strings",
            "e": [
              "binary.string_count = 13.00"
            ],
            "i": "objectives/anti-static/obfuscation/payload/string-sparse::low-string-count-vb6",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1612",
            "c": 0.8500000238418579,
            "d": "Large PE resource section",
            "e": [
              ".rsrc (size: 1479680)"
            ],
            "i": "objectives/anti-static/obfuscation/payload/resource::large-rsrc-section",
            "l": 1,
            "m": "B0023"
          },
          {
            "c": 0.800000011920929,
            "d": "Low-entropy rdata section",
            "e": [
              ".rdata (entropy: 0.00)"
            ],
            "i": "metadata/binary/section/metrics::low-entropy-rdata-section",
            "l": 1
          },
          {
            "a": "T1036.005",
            "c": 0.9700000286102295,
            "d": "PE has no Authenticode signature",
            "e": [
              "binary.has_signature = 0.00"
            ],
            "i": "objectives/evasion/masquerade/version-resource/microsoft-utility::dw20-host-unsigned",
            "l": 1,
            "m": "F0004"
          },
          {
            "c": 0.800000011920929,
            "d": "Tiny writable data section",
            "e": [
              ".data (size: 1536)"
            ],
            "i": "metadata/binary/section/metrics::tiny-data-section",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "PE has low overall entropy",
            "e": [
              "binary.overall_entropy = 5.65"
            ],
            "i": "metadata/binary/layout::low-overall-entropy",
            "l": 2
          },
          {
            "a": "T1553.002",
            "c": 0.8500000238418579,
            "d": "PE lacks VS_VERSION_INFO resource",
            "e": [
              "field 'pe.version_info.file_version' does not exist"
            ],
            "i": "objectives/evasion/masquerade/cert::pe-no-version-info-resource",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Binary has 3+ functions",
            "e": [
              "binary.func_count = 18.00"
            ],
            "i": "metadata/binary/metrics/threshold::few-functions-3",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "PE with six or fewer imports",
            "e": [
              "binary.import_count = 0.00"
            ],
            "i": "metadata/binary/symbols/imports::pe-imports-max-six",
            "l": 1
          },
          {
            "c": 0.75,
            "d": "Text section dominates file",
            "e": [
              "binary.text_to_file_ratio = 8.36"
            ],
            "i": "metadata/binary/layout::text-section-dominates-file",
            "l": 2
          },
          {
            "c": 0.8999999761581421,
            "d": "PE standard runtime section",
            "e": [
              ".rdata"
            ],
            "i": "metadata/binary/section/names::pe-runtime-standard-section",
            "l": 1
          },
          {
            "a": "T1027.002",
            "c": 0.699999988079071,
            "d": "PE with single import",
            "e": [
              "binary.import_count = 0.00"
            ],
            "i": "objectives/command-and-control/dropper/execution/loader::pe-single-import",
            "l": 1
          },
          {
            "c": 0.949999988079071,
            "d": "Filename has EXE extension",
            "e": [
              "935e9815a88a0b395e6fa44d6d30315082a6701cf3ebc9c44177dd57fa787b87.exe"
            ],
            "i": "objectives/evasion/masquerade/file/double-ext::basename-is-exe",
            "l": 1
          },
          {
            "a": "T1105",
            "c": 0.800000011920929,
            "d": "Compact PE import table",
            "e": [
              "binary.import_count = 0.00"
            ],
            "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table",
            "l": 1,
            "m": "E1105"
          },
          {
            "c": 0.8999999761581421,
            "d": "Oversized low-entropy PE resources",
            "e": [
              ".rsrc (size: 1479680, entropy: 0.00)"
            ],
            "i": "metadata/binary/resource::oversized-low-entropy-rsrc",
            "l": 3
          },
          {
            "a": "T1055",
            "c": 0.9200000166893005,
            "d": "Regex component marker",
            "e": [
              "binary.import_count = 0.00"
            ],
            "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571",
            "l": 1,
            "m": "C0041"
          },
          {
            "c": 0.9200000166893005,
            "d": "Large null-filled PE resources",
            "e": [
              ".rsrc (size: 1479680, entropy: 0.00)"
            ],
            "i": "metadata/binary/resource::large-null-rsrc",
            "l": 3
          },
          {
            "c": 0.800000011920929,
            "d": "Five or more PE sections",
            "e": [
              "binary.section_count = 9.00"
            ],
            "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe",
            "l": 1
          },
          {
            "c": 0.8799999952316284,
            "d": "Large low-entropy PE resources",
            "e": [
              ".rsrc (size: 1479680, entropy: 0.00)"
            ],
            "i": "metadata/binary/resource::resource-heavy-low-entropy-rsrc",
            "l": 2
          },
          {
            "c": 0.75,
            "d": "Low average code complexity",
            "e": [
              "binary.avg_complexity = 1.44"
            ],
            "i": "metadata/binary/metrics/structural::low-average-complexity",
            "l": 2
          },
          {
            "c": 0.8199999928474426,
            "d": "Oversized PE resource section",
            "e": [
              ".rsrc (size: 1479680)"
            ],
            "i": "metadata/binary/resource::oversized-rsrc",
            "l": 3
          },
          {
            "c": 1.0,
            "d": "Binary is not digitally signed",
            "e": [
              "binary.has_signature = 0.00"
            ],
            "i": "metadata/signed/trust-level::unsigned",
            "l": 3
          },
          {
            "a": "T1027.002",
            "c": 0.699999988079071,
            "d": "PE with very few imports",
            "e": [
              "binary.import_count = 0.00"
            ],
            "i": "objectives/command-and-control/dropper/execution/loader::pe-few-imports",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.8600000143051147,
            "d": "Dominant section for VB6 loader profile",
            "e": [
              "binary.largest_section_ratio = 154.92"
            ],
            "i": "objectives/anti-static/obfuscation/payload/string-sparse::dominant-text-layout-vb6",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.8199999928474426,
            "d": "Packed loader largest section ratio above 0.65",
            "e": [
              "binary.largest_section_ratio = 154.92"
            ],
            "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.8399999737739563,
            "d": "Resource-heavy PE with large .rsrc",
            "e": [
              ".rsrc (size: 1479680)"
            ],
            "i": "metadata/binary/resource::resource-heavy-rsrc",
            "l": 3
          },
          {
            "a": "T1027",
            "c": 0.949999988079071,
            "d": "Regex component marker",
            "e": [
              "binary.largest_section_ratio = 154.92"
            ],
            "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188",
            "l": 1,
            "m": "B0032"
          }
        ],
        "sha": "935e9815a88a0b395e6fa44d6d30315082a6701cf3ebc9c44177dd57fa787b87",
        "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/2025-11/935e9815a88a0b395e6fa44d6d30315082a6701cf3ebc9c44177dd57fa787b87.exe",
        "type": "pe"
      }
    ],
    "tv": "012f9"
  }
}