{
  "ml": {
    "l": -1,
    "v": "6",
    "fs": [
      {
        "l": -1,
        "id": 0,
        "prob": 0.9240506291389465
      }
    ],
    "prob": 0.9240506,
    "models": [
      {
        "m": "az",
        "raw": 0.4130195,
        "prob": 0.9240506,
        "class": 0
      },
      {
        "m": "az/source",
        "raw": 0.21414058,
        "prob": 0.91582,
        "class": 0
      },
      {
        "m": "az/c",
        "raw": 0.23028618,
        "prob": 0.5263158,
        "class": 0
      }
    ],
    "version": "v17.17",
    "analyzed_at": "2026-06-07T12:16:29Z"
  },
  "path": "PebApi.asm",
  "raw": {
    "v": "6",
    "fs": [
      {
        "f": "O(Er)H(Os)",
        "x": 37,
        "ff": {
          "m": {
            "ast": {
              "op.add": 12.0,
              "op.mul": 1.0,
              "max_depth": 8.0,
              "op.concat": 18.0,
              "call_count": 0.0,
              "node_count": 907.0,
              "member_count": 17.0,
              "op_density.add": 0.01,
              "op_density.mul": 0.0,
              "identifier_count": 110.0,
              "member_depth_max": 4.0,
              "op_density.concat": 0.02,
              "string_concat_chain_max_length": 3.0
            },
            "file": {
              "size": 3022.0,
              "entropy": 5.18,
              "size_bytes": 3022.0
            },
            "text": {
              "tab_count": 259.0,
              "digit_ratio": 0.01,
              "space_count": 182.0,
              "total_lines": 131.0,
              "char_entropy": 5.18,
              "unique_chars": 66.0,
              "avg_line_length": 22.08,
              "max_line_length": 87.0,
              "empty_line_ratio": 0.12,
              "last_line_length": 4.0,
              "whitespace_ratio": 0.19,
              "most_common_ratio": 0.08,
              "identifier_density": 2.7,
              "line_length_stddev": 16.56,
              "most_common_char_is_null": 0.0,
              "max_inline_whitespace_run": 2.0,
              "most_common_char_codepoint": 101.0,
              "suspicious_identifier_ratio": 0.02,
              "normalized_unique_identifiers": 15.64
            },
            "binary": {
              "overall_entropy": 5.18
            },
            "members": {
              "count": 17.0
            },
            "identifiers": {
              "count": 110.0,
              "total": 354.0,
              "avg_length": 7.19,
              "max_length": 23.0,
              "min_length": 1.0,
              "avg_entropy": 2.26,
              "reuse_ratio": 0.31,
              "unique_count": 110.0,
              "length_stddev": 5.38,
              "has_digit_ratio": 0.01,
              "sequential_names": 2.0,
              "single_char_count": 2.0,
              "single_char_ratio": 0.02,
              "high_entropy_count": 9.0,
              "high_entropy_ratio": 0.08,
              "all_lowercase_ratio": 0.55,
              "all_uppercase_ratio": 0.06,
              "numeric_suffix_count": 1.0
            }
          },
          "s": [
            [
              305,
              "10",
              "3"
            ],
            [
              318,
              "10",
              "4"
            ],
            [
              345,
              "16",
              "48"
            ],
            [
              821,
              "10",
              "13"
            ],
            [
              872,
              "16",
              "32"
            ],
            [
              1805,
              "10",
              "0"
            ],
            [
              2161,
              "10",
              "13"
            ],
            [
              2527,
              "10",
              "4"
            ],
            [
              2614,
              "10",
              "4"
            ],
            [
              2646,
              "10",
              "2"
            ]
          ],
          "v": {
            "file.stem": "PebApi",
            "file.basename": "PebApi.asm",
            "source.language": "c"
          },
          "id": "c",
          "mc": [
            "IMAGE_DOS_HEADER.e_lfanew",
            "IMAGE_EXPORT_DIRECTORY.AddressOfFunctions",
            "IMAGE_EXPORT_DIRECTORY.AddressOfNameOrdinals",
            "IMAGE_EXPORT_DIRECTORY.AddressOfNames",
            "IMAGE_EXPORT_DIRECTORY.NumberOfNames",
            "IMAGE_NT_HEADERS32.OptionalHeader",
            "IMAGE_NT_HEADERS32.OptionalHeader.DataDirectoryExport",
            "IMAGE_NT_HEADERS32.OptionalHeader.DataDirectoryExport.VirtualAddress",
            "LDR_DATA_TABLE_ENTRY.BaseDllName",
            "LDR_DATA_TABLE_ENTRY.BaseDllName.Buffer",
            "LDR_DATA_TABLE_ENTRY.BaseDllName.Length",
            "LDR_DATA_TABLE_ENTRY.DllBase",
            "PEB.Ldr",
            "PEB_LDR_DATA.InMemoryOrderModuleList",
            "PEB_LDR_DATA.InMemoryOrderModuleList.Flink",
            "cld.L_module_hash",
            "jz.C_module"
          ]
        },
        "id": 0,
        "sz": 3022,
        "ts": [
          {
            "a": "T1027.007",
            "c": 0.8500000238418579,
            "d": "Parse PE export directory",
            "e": [
              "IMAGE_EXPORT_DIRECTORY"
            ],
            "i": "micro-behaviors/os/api-resolution/manual::export-directory",
            "l": 3
          },
          {
            "a": "T1027.007",
            "c": 0.8500000238418579,
            "d": "Parse export name ordinals",
            "e": [
              "AddressOfNameOrdinals"
            ],
            "i": "micro-behaviors/os/api-resolution/manual::export-name-ordinals",
            "l": 3
          },
          {
            "c": 0.800000011920929,
            "d": "PE VirtualAddress reference",
            "e": [
              "VirtualAddress"
            ],
            "i": "micro-behaviors/fs/file/section::asm-pe-header-manipulation-layout-virtualaddr",
            "l": 1
          },
          {
            "a": "T1027.007",
            "c": 0.8500000238418579,
            "d": "Access PEB loader data",
            "e": [
              "PEB_LDR_DATA"
            ],
            "i": "micro-behaviors/os/api-resolution/manual::peb-ldr-data",
            "l": 3
          },
          {
            "c": 0.8799999952316284,
            "d": "Source or test deletion target",
            "e": [
              "test"
            ],
            "i": "micro-behaviors/data/text/keywords/lexicon::target-source-test",
            "l": 1
          },
          {
            "a": "T1027.007",
            "c": 0.8500000238418579,
            "d": "Parse export function table",
            "e": [
              "AddressOfFunctions"
            ],
            "i": "micro-behaviors/os/api-resolution/manual::export-function-table",
            "l": 3
          },
          {
            "a": "T1027.007",
            "c": 0.8500000238418579,
            "d": "Parse export name table",
            "e": [
              "AddressOfNames"
            ],
            "i": "micro-behaviors/os/api-resolution/manual::export-name-table",
            "l": 3
          },
          {
            "a": "T1027.007",
            "c": 0.8999999761581421,
            "d": "Walk PEB module list",
            "e": [
              "InMemoryOrderModuleList"
            ],
            "i": "micro-behaviors/os/api-resolution/manual::module-list-walk",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "Manual import parsing marker IMAGE_EXPORT_DIRECTORY",
            "e": [
              "IMAGE_EXPORT_DIRECTORY.AddressOfNames"
            ],
            "i": "objectives/evasion/process/injection/memory::asm-manual-import-export-dir",
            "l": 4
          },
          {
            "a": "T1027.007",
            "c": 0.9200000166893005,
            "d": "Manually resolve PE exports",
            "e": [
              "AddressOfFunctions",
              "IMAGE_EXPORT_DIRECTORY",
              "AddressOfNameOrdinals",
              "AddressOfNames"
            ],
            "i": "micro-behaviors/os/api-resolution/manual::manual-export-resolution",
            "l": 3
          }
        ],
        "sha": "9a41cc230d153ba0da0bd61e94213de9d561e4064aede05c2160f0abf1655054",
        "path": "PebApi.asm",
        "type": "c"
      }
    ],
    "tv": "318d5"
  }
}