{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.06094364449381828, "class": 0 } ], "prob": 0.060943644, "class": 0, "models": [ { "m": "az", "prob": 0.060943644, "class": 0 }, { "m": "az/native", "prob": 0.0, "class": 0 }, { "m": "az/pe", "prob": 0.0, "class": 0 } ], "version": "v17.17", "thresholds": [ 0.999503, 0.9998882 ], "analyzed_at": "2026-05-24T12:52:12Z" }, "path": "95db9fa2b2781611fb4daad7111dede2fc9994f22a2cfbb90d439dbed56014e1.exe", "raw": { "v": "5", "fs": [ { "f": "Md₂(Bi₂Si)", "x": 5, "ff": { "m": { "pe": { "parse_failed": 1.0, "partial_parse": 1.0 }, "file": { "size": 3341784.0, "entropy": 7.97, "size_bytes": 3341784.0 }, "parse": { "error_count": 2.0 }, "binary": { "is_pie": 0.0 } }, "s": [ [ 77, "u8", "!This program cannot be run in DOS mode." ], [ 551, "u8", "@.rsrc" ], [ 591, "u8", "@.idata" ], [ 632, "u8", ".themida" ], [ 672, "u8", ".boot" ], [ 2534, "u8", "QRWpy" ], [ 3557, "u8", "WMXO" ], [ 8422, "u8", "Y 3W6" ], [ 12067, "u8", "w%aJOUI" ], [ 12115, "u8", "5WKOUrd" ], [ 12273, "u8", "ghCb0d" ], [ 13593, "u8", "3]4(" ], [ 14617, "u8", "\u0026@H3Y.Q" ], [ 23083, "u8", "tqE3O" ], [ 23621, "u8", "tr8G4" ], [ 24736, "u8", "RUZ1" ], [ 29360, "u8", "w1Tkyl" ], [ 29835, "u8", "k4ap" ], [ 30193, "u8", "4u6m" ], [ 30371, "u8", "3HcbH" ], [ 31616, "u8", "EgiYJ" ], [ 32262, "u8", "YWFHB" ], [ 32718, "u8", "Ro v" ], [ 34022, "u8", "S6GC" ], [ 34834, "u8", "3s7q" ], [ 36293, "u8", "{s]m" ], [ 36696, "u8", "/nWMN" ], [ 37712, "u8", "pNtf" ], [ 38383, "u8", "tKfa" ], [ 39307, "u8", "x6d9" ], [ 39506, "u8", "o0s9s" ], [ 40071, "u8", "UDLQ" ], [ 40589, "u8", "a1Ln18" ], [ 41305, "u8", "xhau" ], [ 41529, "u8", "dDyc" ], [ 42493, "u8", "IUWK8" ], [ 43543, "u8", "0LZFs" ], [ 46748, "u8", "T6UF" ], [ 47223, "u8", "DHRO" ], [ 47542, "u8", "Qsni" ], [ 48159, "u8", "Zgm89" ], [ 48433, "u8", "orTLv" ], [ 49108, "u8", "gCHGpv" ], [ 51279, "u8", "Rkhj" ], [ 52456, "u8", "YN40" ], [ 53394, "u8", "IDOJ" ], [ 55701, "u8", "6r5e" ], [ 56386, "u8", "MlfJ4" ], [ 56617, "u8", "Nb84ww" ], [ 58102, "u8", "EZ5sR" ], [ 58671, "u8", "wuRu" ], [ 60189, "u8", "Oujf" ], [ 62894, "u8", "AW3Fp" ], [ 63384, "u8", "OSPfA" ], [ 64495, "u8", "@hbVdl/." ], [ 67922, "u8", "SfPmx" ], [ 69384, "u8", "h.nx" ], [ 70921, "u8", "/k38" ], [ 72050, "u8", "s1lMR" ], [ 72094, "u8", "69qz" ], [ 74171, "u8", "1J3eq" ], [ 77233, "u8", "P5UN" ], [ 78335, "u8", "D qn" ], [ 80073, "u8", "ypT8X" ], [ 80248, "u8", "lsQs" ], [ 82995, "u8", "aLNDL" ], [ 83261, "u8", "q2vfNW" ], [ 85787, "u8", "cZPmY" ], [ 86526, "u8", "3Rpo3" ], [ 87602, "u8", "48 yh" ], [ 89478, "u8", "n VOi" ], [ 90705, "u8", "zhOb" ], [ 92962, "u8", "a[)z" ], [ 94522, "u8", "1krYf" ], [ 97168, "u8", "nM e" ], [ 98825, "u8", "yBrKM" ], [ 99656, "u8", "fI0dx" ], [ 99793, "u8", "b Yy" ], [ 99855, "u8", "ZZqLJ" ], [ 107071, "u8", "yDvl" ], [ 107837, "u8", "V5KK" ], [ 108066, "u8", "jjii" ], [ 110127, "u8", "raRw" ], [ 110721, "u8", "DVI9" ], [ 112785, "u8", "HgPIK" ], [ 114169, "u8", "Oqwl" ], [ 116457, "u8", "YMZN" ], [ 117023, "u8", "0CEVWpgx" ], [ 119696, "u8", "WXZ6" ], [ 120542, "u8", "LyslM5" ], [ 120717, "u8", "ChxUf" ], [ 121468, "u8", "O1oQJW" ], [ 121619, "u8", "Zwsv" ], [ 121656, "u8", "kQbn" ], [ 121901, "u8", "z(}v" ], [ 123167, "u8", "OypLm" ], [ 127472, "u8", "EF0D" ], [ 132116, "u8", "6XTT" ], [ 132198, "u8", "LF3B" ], [ 134370, "u8", "/XAgQ" ], [ 135335, "u8", "R4_X" ], [ 135520, "u8", "kio8" ], [ 136627, "u8", "Jl21A" ], [ 137137, "u8", "y58h" ], [ 138641, "u8", "LTHM" ], [ 140488, "u8", "h15f" ], [ 142525, "u8", "1au3O" ], [ 144346, "wide", "TBAAW2PW" ], [ 144375, "u8", "IHDR" ], [ 145177, "u8", "Skkk" ], [ 145876, "u8", "e2Rgv" ], [ 147893, "u8", "45vg" ], [ 148310, "u8", "qfoiS" ], [ 151775, "u8", "tNCNB" ], [ 152971, "u8", "Cff2y" ], [ 153523, "u8", "lTxsxh" ], [ 155257, "u8", "Os49r" ], [ 156932, "u8", "hPbv" ], [ 157340, "u8", "rP80A" ], [ 158760, "u8", "VKMQ" ], [ 159072, "u8", "xTGYh" ], [ 159322, "u8", "fLgl" ], [ 160045, "u8", "kk%Vhl" ], [ 164360, "u8", "EeFIv" ], [ 167113, "u8", "Jzqd" ], [ 167135, "u8", "WWK86" ], [ 170661, "u8", "4m d" ], [ 172443, "u8", "RzaUU" ], [ 172991, "u8", "FsVMw" ], [ 173176, "u8", "TUuaQ" ], [ 173510, "u8", "70CU" ], [ 174820, "u8", "Qdpa" ], [ 175163, "u8", "Wgsd" ], [ 175561, "u8", "tm0kyD" ], [ 176511, "u8", "By9dt" ], [ 179613, "u8", "EXZP" ], [ 180775, "u8", "U2HAtG" ], [ 182012, "u8", "I75M" ], [ 182623, "u8", "TUuMJ" ], [ 186635, "u8", "7saTeT" ], [ 189268, "u8", "hD g" ], [ 189646, "u8", "zqVo" ], [ 190756, "u8", "5egx" ], [ 192910, "u8", "zDTxz" ], [ 194270, "u8", "NGixa" ], [ 194308, "u8", "99qx" ], [ 198957, "u8", "l11ul" ], [ 199242, "u8", "5PUUX" ], [ 200109, "u8", "IPHo5" ], [ 200926, "u8", "M7YB" ], [ 202087, "u8", "9ICC8O" ], [ 203072, "u8", "3hpJAE" ], [ 203656, "u8", "Kpbp" ], [ 204874, "u8", "Xe0FF" ], [ 208394, "u8", "niyi1" ], [ 208645, "u8", "9286" ], [ 209468, "u8", "SmDOx" ], [ 209749, "u8", "dVwc" ], [ 209949, "u8", "IDATc" ], [ 214011, "u8", "IEND" ], [ 215024, "u8", "FTOH" ], [ 217522, "u8", "W_MZ" ], [ 219730, "u8", "SYRE" ], [ 220019, "u8", "7333" ], [ 221204, "u8", "7t7n" ], [ 222415, "u8", "C833" ], [ 222753, "u8", "/AYrp{w2A" ], [ 223835, "u8", "Vgut" ], [ 228408, "u8", "5DTR" ], [ 230530, "u8", "iUx49" ], [ 236505, "u8", "SSSO7" ], [ 238729, "u8", "MNNNV" ], [ 239145, "u8", "4099" ], [ 239431, "u8", "SOmh5" ], [ 240217, "u8", "466VJ" ], [ 241287, "u8", "pVYXXX766" ], [ 241436, "u8", "Z111qZk" ], [ 242603, "u8", "LWNI" ], [ 242989, "u8", "Q333" ], [ 243673, "u8", "`pp`" ], [ 244785, "u8", "KCC7" ], [ 245389, "u8", "yjuu5" ], [ 245846, "wide", "VS_VERSION_INFO" ], [ 245938, "wide", "StringFileInfo" ], [ 245974, "wide", "040904B0" ], [ 245998, "wide", "CompanyName" ], [ 246024, "wide", "VMware, Inc." ], [ 246058, "wide", "FileDescription" ], [ 246092, "wide", "VMware Workstation" ], [ 246138, "wide", "FileVersion" ], [ 246164, "wide", "23.5.214.72" ], [ 246194, "wide", "InternalName" ], [ 246220, "wide", "vmware.exe" ], [ 246250, "wide", "OriginalFilename" ], [ 246314, "wide", "ProductName" ], [ 246386, "wide", "ProductVersion" ], [ 246416, "wide", "Version 23.5.214" ], [ 246458, "wide", "LegalCopyright" ], [ 246488, "wide", "© 2016-2019 VMware, Inc.. All rights reserved." ], [ 246590, "wide", "VarFileInfo" ], [ 246622, "wide", "Translation" ], [ 246784, "u8", "kernel32.dll" ], [ 246799, "u8", "GetModuleHandleA" ], [ 246816, "u8", "USER32.dll" ], [ 246829, "u8", "GetMessagePos" ], [ 246843, "u8", "gdiplus.dll" ], [ 246857, "u8", "GdiplusShutdown" ], [ 246873, "u8", "GDI32.dll" ], [ 246885, "u8", "CreateSolidBrush" ], [ 247775, "u8", "XSQRVWUH" ], [ 248022, "u8", "G6FU" ], [ 250557, "u8", "z15Dkp" ], [ 250991, "u8", "QP^ vp" ], [ 251071, "u8", "/NVC" ], [ 252550, "u8", "h Pi" ], [ 253534, "u8", "PvyLBHL" ], [ 255561, "u8", "/I2Wvt}" ], [ 256069, "u8", "iC18J" ], [ 257905, "u8", "eDJjD" ], [ 257911, "u8", "oDUvD" ], [ 258445, "u8", "DSKDX" ], [ 259239, "u8", "D=EDCXDJ(DN" ], [ 259251, "u8", "DS5DY" ], [ 259266, "u8", "DrzDw" ], [ 259661, "u8", "KD\u003cQDgWDL]D" ], [ 260356, "u8", "JDqNDkVDG[D" ], [ 260905, "u8", "DDODJ" ], [ 261208, "u8", "b\"yc\"Yf/Hk" ], [ 262589, "u8", "iSdw" ], [ 263640, "u8", "2H1M" ], [ 267384, "u8", "E1_4" ], [ 268457, "u8", "jXD0N7" ], [ 268816, "u8", "4A1Z" ], [ 273926, "u8", "ObLcd" ], [ 276161, "u8", "Iwpx" ], [ 277560, "u8", "MtuXA3e" ], [ 277937, "u8", "fLSdoz" ], [ 278796, "u8", "gVqz" ], [ 279054, "u8", "LnKH5T" ], [ 279838, "u8", "/cEL" ], [ 282245, "u8", "qXkt" ], [ 283559, "u8", "U20uldN" ], [ 283803, "u8", "BE5Hf" ], [ 289297, "u8", "SZ2V" ], [ 290004, "u8", "%fzvus" ], [ 290549, "u8", "9uod" ], [ 291626, "u8", "Uqjh" ], [ 294141, "u8", "uqzIs" ], [ 294389, "u8", "N3cfT4" ], [ 295515, "u8", "ar19n" ], [ 296133, "u8", "kbSZK" ], [ 297519, "u8", "v3w7" ], [ 298257, "u8", "MRSA" ], [ 300242, "u8", "NLT1" ], [ 301078, "u8", "aE(}" ], [ 301526, "u8", "AiV87O" ] ], "v": { "pe.machine": "x86_64", "pe.subsystem": "windows_gui", "pe.timestamp": 1611901404, "pe.image_base": 5368709120, "pe.image_size": 9064448, "pe.machine_id": 34404, "pe.os_version": "6.0", "pe.entry_point": 5976152, "pe.headers_size": 1024, "pe.partial_parse": true, "pe.subsystem_raw": 2, "pe.file_alignment": 512, "pe.cert_table_size": 7112, "pe.section_alignment": 4096, "pe.subsystem_version": "6.0", "pe.characteristics[0]": "executable_image", "pe.characteristics[1]": "large_address_aware", "pe.characteristics_raw": 34, "pe.linker_major_version": 14, "pe.linker_minor_version": 29, "pe.signatures[0].issuer": "CN=Intel Corporation", "pe.signatures[0].serial": "529c895e2ee6eda848c016533a5ea7fc", "pe.signatures[0].subject": "CN=Intel Corporation", "pe.dll_characteristics[0]": "high_entropy_va", "pe.dll_characteristics[1]": "terminal_server_aware", "pe.signatures[0].verified": true, "pe.dll_characteristics_raw": 32800, "pe.number_of_rva_and_sizes": 16, "pe.signatures[0].not_after": "2029-03-21T12:59:07Z", "pe.signatures[0].not_before": "2026-03-21T12:49:07Z", "pe.signatures[0].self_issued": true, "pe.coff.dos_header_pe_pointer": 128, "pe.signatures[0].thumbprint_sha1": "156eca442319ec98714bcbd88beb35998e25a184", "pe.signatures[0].cert_chain_depth": 4, "pe.signatures[0].digest_algorithm": "sha1", "pe.signatures[0].eku_code_signing": true, "pe.signatures[0].signature_digest": "d91aaa1ca3b183a8c667327c7e18e131556c5742", "pe.signatures[0].thumbprint_sha256": "43d12d71683ba86c41d3e21f6dc638e2d55cac0697928e87aa5cc7cc3a66c104", "pe.signatures[0].signature_algorithm": "sha256WithRSAEncryption", "pe.signatures[0].signature_digest_algorithm": "sha1" }, "er": [ [ "malformed", "pe-parse" ], [ "fallback", "pe-parse" ] ], "id": "pe" }, "id": 0, "sz": 3341784, "ts": [ { "a": "T1027", "c": 0.30000001192092896, "d": "PE parsed with header-only fallback (downstream walker failed)", "e": [ "PE parsed with header-only fallback (downstream walker failed)" ], "i": "objectives/anti-analysis/pe-tampering/corrupted-header", "l": 2, "m": "B0001" }, { "c": 1.0, "d": "Authenticode chain CN: Intel Corporation", "e": [ "Intel Corporation" ], "i": "metadata/signed/unknown::intel-corporation", "l": 2 }, { "c": 1.0, "d": "Signed by Intel Corporation", "e": [ "Intel Corporation" ], "i": "metadata/signed/leaf::intel-corporation", "l": 3 }, { "c": 1.0, "d": "Binary is 500KB+", "e": [ "95db9fa2b2781611fb4daad7111dede2fc9994f22a2cfbb90d439dbed56014e1.exe" ], "i": "metadata/binary/metrics/threshold::large-binary-500k", "l": 1 }, { "c": 0.7799999713897705, "d": "Short CamelCase Run value token", "e": [ "TZbOn" ], "i": "objectives/persistence/login/registry/autostart::short-camel-on-run-value-token", "l": 1 }, { "c": 0.8999999761581421, "d": "DOS dispatcher check op", "e": [ "Cmp\f" ], "i": "micro-behaviors/os/msdos/internal::dispatcher-signature-op", "l": 2 }, { "c": 1.0, "d": "Reference to GDI32.dll", "e": [ "GDI32.dll" ], "i": "micro-behaviors/os/module/load::gdi32-dll-reference", "l": 2 }, { "c": 0.8999999761581421, "d": "PE file uses .exe extension", "e": [ "95db9fa2b2781611fb4daad7111dede2fc9994f22a2cfbb90d439dbed56014e1.exe" ], "i": "metadata/binary/framework::exe-extension", "l": 1 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "StringFileInfo" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1 }, { "c": 1.0, "d": "High-entropy ASLR (64-bit)", "e": [ "[high_entropy_va, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-high-entropy-va", "l": 2 }, { "c": 0.8500000238418579, "d": "Signed binary with personal-name leaf cert", "e": [ "CN=Intel Corporation" ], "i": "metadata/binary/anomaly/format::binary-signed-with-individual-cert", "l": 3 }, { "c": 1.0, "d": "File larger than 1MB", "e": [ "95db9fa2b2781611fb4daad7111dede2fc9994f22a2cfbb90d439dbed56014e1.exe" ], "i": "metadata/binary/metrics/size::large-file-1mb", "l": 2 }, { "c": 1.0, "d": "PE Authenticode signature verified metadata", "e": [ "true" ], "i": "metadata/signed/certificate::pe-signature-verified-kv", "l": 2 }, { "c": 0.8999999761581421, "d": "PE file larger than 2 MiB", "e": [ "95db9fa2b2781611fb4daad7111dede2fc9994f22a2cfbb90d439dbed56014e1.exe" ], "i": "metadata/binary/layout::file-over-2mb", "l": 1 }, { "c": 0.800000011920929, "d": "CompanyName field absent from PE version info", "e": [ "field 'pe.version.company' does not exist" ], "i": "metadata/binary/anomaly/format::version-info-company-name-absent", "l": 1 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "95db9fa2b2781611fb4daad7111dede2fc9994f22a2cfbb90d439dbed56014e1.exe" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032" }, { "a": "T1553.002", "c": 0.8500000238418579, "d": "PE lacks VS_VERSION_INFO resource", "e": [ "field 'pe.version.file_version' does not exist" ], "i": "objectives/evasion/masquerade/cert::pe-no-version-info-resource", "l": 1 }, { "c": 0.8799999952316284, "d": "Native runtime binary is large", "e": [ "95db9fa2b2781611fb4daad7111dede2fc9994f22a2cfbb90d439dbed56014e1.exe" ], "i": "metadata/lang/compiler/aot::native-runtime-large-file", "l": 2 }, { "c": 1.0, "d": "Reference to USER32.dll", "e": [ "USER32.dll" ], "i": "micro-behaviors/os/module/load::user32-dll-reference", "l": 2 }, { "a": "T1497.001", "c": 0.8999999761581421, "d": "VM hypervisor string cluster", "e": [ "vmware", "VMware" ], "i": "objectives/anti-analysis/vm-detect/script::vm-indicator-hypervisor-strings", "l": 1 }, { "d": ".exe extension reference", "e": [ ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 2 }, { "c": 0.949999988079071, "d": "Filename has EXE extension", "e": [ "95db9fa2b2781611fb4daad7111dede2fc9994f22a2cfbb90d439dbed56014e1.exe" ], "i": "objectives/evasion/masquerade/file/double-ext::basename-is-exe", "l": 1 }, { "c": 0.8999999761581421, "d": "Encoded external IPv4 address", "e": [ "23.5.214.72" ], "i": "micro-behaviors/communications/ip/literal::encoded-external-ipv4-binary", "l": 2 }, { "c": 0.8999999761581421, "d": "Tiny C string section ratio", "e": [ " = 0.0% of total (0 / 3341784 bytes)" ], "i": "metadata/binary/section/metrics::tiny-cstring-section", "l": 1 }, { "a": "T1027.007", "c": 0.8999999761581421, "d": "Kernel32 DLL resolution string", "e": [ "kernel32.dll" ], "i": "micro-behaviors/os/api-resolution/manual::kernel32-resolver", "l": 1 }, { "a": "T1027", "c": 1.0, "d": "Binary is 1MB or larger", "e": [ "95db9fa2b2781611fb4daad7111dede2fc9994f22a2cfbb90d439dbed56014e1.exe" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::file-size-1m-plus", "l": 1, "m": "B0032" }, { "c": 0.8500000238418579, "d": "PE with malformed section layout", "e": [ "parse.error_count = 2.00" ], "i": "metadata/binary/metrics/structural::malformed-pe-structure", "l": 3 } ], "sha": "95db9fa2b2781611fb4daad7111dede2fc9994f22a2cfbb90d439dbed56014e1", "path": "95db9fa2b2781611fb4daad7111dede2fc9994f22a2cfbb90d439dbed56014e1.exe", "type": "pe" } ], "tv": "9ea7c" } }