{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 0.4759615361690521,
        "class": 0
      }
    ],
    "prob": 0.47596154,
    "class": 0,
    "models": [
      {
        "m": "az",
        "prob": 0.47596154,
        "class": 0
      },
      {
        "m": "az/native",
        "prob": 0.07716687,
        "class": 0
      },
      {
        "m": "az/pe",
        "prob": 0.08341734,
        "class": 0
      }
    ],
    "version": "v16.16",
    "thresholds": [
      0.9979839,
      1.0
    ],
    "analyzed_at": "2026-05-11T02:35:41Z"
  },
  "path": "235626",
  "raw": {
    "v": "4",
    "fs": [
      {
        "f": "Md₂(Bi₄Si)",
        "k": {
          "pe.checksum": "0x00001d6d",
          "pe.timestamp": 1397482799,
          "hash.authenti": "a3784fc2d0a3dc81e2ca62167d38583ff8d7e6f016d7dbd31b1e06b402bf32b8",
          "debug.pdb_path": "f:\\DW\\Desktop\\Dev\\11.0\\RC1\\MRC\\Src\\DWRC\\DWRCSE\\Win32\\Release\\DWRCSE.pdb",
          "pe.codeview.age": 1,
          "hash.rich_header": "4e798b17042802876b629fc89369062655eafe3e33aeea2d3e3e2e5948db39d5",
          "pe.codeview.guid": "A76CACD4-2119-44C9-B7C9-AB2EA2BD4449",
          "build.target_arch": "x86",
          "pe.linker_version": "9.0",
          "pe.resource_types[0]": "RT_MESSAGETABLE",
          "pe.resource_types[1]": "RT_MANIFEST",
          "pe.rich_header.xor_key": "0x9b243a7f",
          "pe.debug_entries[0].size": 96,
          "pe.debug_entries[0].type": "codeview",
          "pe.data_directories[0].rva": 12288,
          "pe.data_directories[1].rva": 16384,
          "pe.data_directories[2].rva": 4096,
          "pe.data_directories[0].name": "resource",
          "pe.data_directories[0].size": 1504,
          "pe.data_directories[1].name": "base_relocation",
          "pe.data_directories[1].size": 12,
          "pe.data_directories[2].name": "debug",
          "pe.data_directories[2].size": 28,
          "pe.debug_directory_types[0]": 2,
          "pe.debug_entries[0].timestamp": 1397482799,
          "pe.dll_characteristics.no_seh": true,
          "pe.rich_header_compids[0].count": 4,
          "pe.rich_header_compids[1].count": 3,
          "pe.rich_header_compids[2].count": 5,
          "pe.rich_header_compids[3].count": 3,
          "pe.rich_header_compids[4].count": 1,
          "pe.rich_header_compids[5].count": 1,
          "pe.dll_characteristics.nx_compat": true,
          "pe.rich_header_compids[0].compid": 8615945,
          "pe.rich_header_compids[1].compid": 8111655,
          "pe.rich_header_compids[2].compid": 65536,
          "pe.rich_header_compids[3].compid": 9074697,
          "pe.rich_header_compids[4].compid": 9720350,
          "pe.rich_header_compids[5].compid": 9533449,
          "pe.rich_header_compids[2].product": "Unknown",
          "pe.section_characteristics[0].name": ".rdata",
          "pe.section_characteristics[1].name": ".data",
          "pe.section_characteristics[2].name": ".rsrc",
          "pe.section_characteristics[3].name": ".reloc",
          "pe.dll_characteristics.dynamic_base": true,
          "pe.rich_header.entries[0].use_count": 4,
          "pe.rich_header.entries[1].use_count": 3,
          "pe.rich_header.entries[2].use_count": 5,
          "pe.rich_header.entries[3].use_count": 3,
          "pe.rich_header.entries[4].use_count": 1,
          "pe.rich_header.entries[5].use_count": 1,
          "pe.rich_header.entries[0].product_id": 131,
          "pe.rich_header.entries[1].product_id": 123,
          "pe.rich_header.entries[2].product_id": 1,
          "pe.rich_header.entries[3].product_id": 138,
          "pe.rich_header.entries[4].product_id": 148,
          "pe.rich_header.entries[5].product_id": 145,
          "pe.manifest.requested_execution_level": "asInvoker",
          "pe.rich_header.entries[0].build_number": 30729,
          "pe.rich_header.entries[0].product_name": "C_VS2008_LTCG",
          "pe.rich_header.entries[1].build_number": 50727,
          "pe.rich_header.entries[1].product_name": "unknown",
          "pe.rich_header.entries[2].product_name": "Imp_VS_v6_or_earlier",
          "pe.rich_header.entries[3].build_number": 30729,
          "pe.rich_header.entries[3].product_name": "unknown",
          "pe.rich_header.entries[4].build_number": 21022,
          "pe.rich_header.entries[4].product_name": "unknown",
          "pe.rich_header.entries[5].build_number": 30729,
          "pe.rich_header.entries[5].product_name": "Linker_VS2008",
          "pe.section_characteristics[0].raw_size": 512,
          "pe.section_characteristics[2].raw_size": 1536,
          "pe.section_characteristics[3].raw_size": 512,
          "pe.section_characteristics[0].virtual_size": 132,
          "pe.section_characteristics[1].virtual_size": 808,
          "pe.section_characteristics[2].virtual_size": 1504,
          "pe.section_characteristics[3].virtual_size": 110,
          "pe.section_characteristics[0].virtual_address": 4096,
          "pe.section_characteristics[1].virtual_address": 8192,
          "pe.section_characteristics[2].virtual_address": 12288,
          "pe.section_characteristics[3].virtual_address": 16384,
          "pe.section_characteristics[0].characteristics_hex": "40000040",
          "pe.section_characteristics[1].characteristics_hex": "c0000040",
          "pe.section_characteristics[2].characteristics_hex": "40000040",
          "pe.section_characteristics[3].characteristics_hex": "42000040"
        },
        "x": 5,
        "id": 0,
        "ms": {
          "pe": {
            "machine": 332.0,
            "checksum": 7533.0,
            "pdb_path": "f:\\DW\\Desktop\\Dev\\11.0\\RC1\\MRC\\Src\\DWRC\\DWRCSE\\Win32\\Release\\DWRCSE.pdb",
            "rsrc_size": 1536.0,
            "subsystem": 2.0,
            "timestamp": 1397482799.0,
            "image_base": 268435456.0,
            "codeview_age": 1.0,
            "has_checksum": true,
            "has_manifest": true,
            "rsrc_entropy": 4.02,
            "codeview_guid": "A76CACD4-2119-44C9-B7C9-AB2EA2BD4449",
            "size_of_image": 20480.0,
            "checksum_valid": true,
            "file_alignment": 512.0,
            "resource_count": 2.0,
            "resource_types": [
              "RT_MESSAGETABLE",
              "RT_MANIFEST"
            ],
            "characteristics": 8450.0,
            "entry_in_header": true,
            "has_rich_header": true,
            "size_of_headers": 1024.0,
            "export_timestamp": 0.0,
            "computed_checksum": 7533.0,
            "section_alignment": 4096.0,
            "resource_timestamp": 0.0,
            "debug_timestamp_max": 1397482799.0,
            "debug_timestamp_min": 1397482799.0,
            "dll_characteristics": 1344.0,
            "has_export_timestamp": false,
            "linker_major_version": 9.0,
            "debug_directory_types": [
              2.0
            ],
            "bss_like_section_count": 1.0,
            "has_resource_timestamp": false,
            "debug_directory_entries": 1.0,
            "number_of_rva_and_sizes": 16.0,
            "debug_timestamp_consistent": true,
            "debug_timestamp_unique_count": 1.0,
            "debug_timestamp_nonzero_count": 1.0
          },
          "file": {
            "size": 3584.0
          },
          "binary": {
            "data_entropy": 0.91,
            "string_count": 33.0,
            "section_count": 4.0,
            "overall_entropy": 1.49,
            "avg_section_size": 640.0,
            "entropy_variance": 1.63,
            "avg_string_length": 25.15,
            "max_string_length": 86.0,
            "wide_string_count": 16.0,
            "avg_string_entropy": 3.31,
            "rsrc_to_file_ratio": 0.43,
            "string_length_stddev": 21.72,
            "debug_reference_count": 1.0,
            "largest_section_ratio": 0.43,
            "sentence_string_count": 11.0,
            "sentence_string_ratio": 0.33
          }
        },
        "ss": [
          [
            77,
            "!This program cannot be run in DOS mode."
          ],
          [
            192,
            "Rich"
          ],
          [
            456,
            ".rdata"
          ],
          [
            495,
            "@.data"
          ],
          [
            536,
            ".rsrc"
          ],
          [
            575,
            "@.reloc"
          ],
          [
            1060,
            "RSDS"
          ],
          [
            1084,
            "f:\\DW\\Desktop\\Dev\\11.0\\RC1\\MRC\\Src\\DWRC\\DWRCSE\\Win32\\Release\\DWRCSE.pdb"
          ],
          [
            1728,
            "wide",
            "Service"
          ],
          [
            1752,
            "wide",
            "Error"
          ],
          [
            1772,
            "wide",
            "Connection"
          ],
          [
            1804,
            "wide",
            "Connect"
          ],
          [
            1828,
            "wide",
            "Disconnect"
          ],
          [
            1860,
            "wide",
            "Information"
          ],
          [
            1892,
            "wide",
            "The %1 service was installed."
          ],
          [
            1960,
            "wide",
            "The %1 service was removed."
          ],
          [
            2024,
            "wide",
            "The %1 service could not be removed."
          ],
          [
            2108,
            "wide",
            "The control handler could not be installed. %1"
          ],
          [
            2212,
            "wide",
            "The initialization process failed. %1"
          ],
          [
            2296,
            "wide",
            "The service was started. %1"
          ],
          [
            2360,
            "wide",
            "The service received an unsupported request. %1"
          ],
          [
            2492,
            "wide",
            "The service was stopped. %1"
          ],
          [
            2556,
            "wide",
            "Information: %1"
          ],
          [
            2656,
            "wide",
            "Disconnect: %1"
          ],
          [
            2692,
            "\u003cassembly xmlns=\"urn:schemas-microsoft-com:asm.v1\" manifestVersion=\"1.0\"\u003e"
          ],
          [
            2767,
            "\u003ctrustInfo xmlns=\"urn:schemas-microsoft-com:asm.v3\"\u003e"
          ],
          [
            2823,
            "\u003csecurity\u003e"
          ],
          [
            2839,
            "\u003crequestedPrivileges\u003e"
          ],
          [
            2868,
            "\u003crequestedExecutionLevel level=\"asInvoker\" uiAccess=\"false\"\u003e\u003c/requestedExecutionLevel\u003e"
          ],
          [
            2964,
            "\u003c/requestedPrivileges\u003e"
          ],
          [
            2994,
            "\u003c/security\u003e"
          ],
          [
            3011,
            "\u003c/trustInfo\u003e"
          ],
          [
            3027,
            "\u003c/assembly\u003ePAPADDINGXXPADDINGPADDINGXXPADDING"
          ]
        ],
        "sz": 3584,
        "ts": [
          {
            "d": "Visual Studio build path",
            "e": [
              "f:\\DW\\Desktop\\Dev\\11.0\\RC1\\MRC\\Src\\DWRC\\DWRCSE\\Win32\\Release\\DWRCSE.pdb"
            ],
            "i": "metadata/binary/debug::pdb-visual-studio",
            "l": 3
          },
          {
            "c": 0.800000011920929,
            "d": "Low-entropy rdata section",
            "e": [
              ".rdata (entropy: 1.82)"
            ],
            "i": "metadata/binary/section/metrics::low-entropy-rdata-section",
            "l": 1
          },
          {
            "c": 0.7200000286102295,
            "d": "Embedded absolute PDB path",
            "e": [
              "f:\\DW\\Desktop\\Dev\\11.0\\RC1\\MRC\\Src\\DWRC\\DWRCSE\\Win32\\Release\\DWRCSE.pdb"
            ],
            "i": "metadata/binary/debug::pdb-absolute-path",
            "l": 3
          },
          {
            "c": 0.800000011920929,
            "d": "Binary has many sentence-like strings",
            "e": [
              "binary.sentence_string_ratio = 0.33"
            ],
            "i": "metadata/binary/metrics/threshold::rich-sentence-strings-20pct",
            "l": 1
          },
          {
            "d": "Few detected functions (stub-like or analysis-limited)",
            "e": [
              "binary.func_count = 0.00"
            ],
            "i": "metadata/binary/metrics/structural::no-functions",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "PE carries side-by-side assembly manifest",
            "e": [
              "{\"requested_execution_level\":\"asInvoker\",\"ui_access\":false}"
            ],
            "i": "metadata/build/manifest::pe-has-manifest",
            "l": 2
          },
          {
            "c": 0.8999999761581421,
            "d": "PE mapped image under 768 KiB",
            "e": [
              "pe.size_of_image = 20480.00"
            ],
            "i": "metadata/binary/layout::image-under-768kb",
            "l": 1
          },
          {
            "a": "T1027.007",
            "c": 1.0,
            "d": "WININET.DLL absent from PE import table",
            "e": [
              "pe.import_dll_count = 0.00"
            ],
            "i": "objectives/anti-static/obfuscation/imports::wininet-import-absent",
            "l": 2,
            "m": "B0032"
          },
          {
            "c": 0.8999999761581421,
            "d": "PE standard runtime section",
            "e": [
              ".rdata",
              ".reloc"
            ],
            "i": "metadata/binary/section/names::pe-runtime-standard-section",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Binary has low average string entropy",
            "e": [
              "binary.avg_string_entropy = 3.31"
            ],
            "i": "metadata/binary/metrics/threshold::avg-string-entropy-4-max",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "Binary has 4 or fewer sections",
            "e": [
              "binary.section_count = 4.00"
            ],
            "i": "objectives/command-and-control/infrastructure/config::max-sections-4",
            "l": 1
          },
          {
            "c": 0.75,
            "d": "Binary exports no symbols",
            "e": [
              "binary.export_count = 0.00"
            ],
            "i": "metadata/binary/symbols/exports::no-exports",
            "l": 1
          },
          {
            "c": 0.8199999928474426,
            "d": "Repeated padding marker string block",
            "e": [
              "\u003c/assembly\u003ePAPADDINGXXPADDINGPADDINGXXPADDING"
            ],
            "i": "objectives/anti-static/obfuscation/string/junking::repeated-padding-marker",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "ASLR enabled (DYNAMIC_BASE)",
            "e": [
              "true"
            ],
            "i": "metadata/hardening/mitigation::pe-aslr",
            "l": 2
          },
          {
            "c": 0.699999988079071,
            "d": "PDB path on Desktop",
            "e": [
              "f:\\DW\\Desktop\\Dev\\11.0\\RC1\\MRC\\Src\\DWRC\\DWRCSE\\Win32\\Release\\DWRCSE.pdb"
            ],
            "i": "metadata/binary/debug::pdb-desktop-path",
            "l": 3
          },
          {
            "c": 1.0,
            "d": "DEP / NX enabled (NX_COMPAT)",
            "e": [
              "true"
            ],
            "i": "metadata/hardening/mitigation::pe-dep",
            "l": 2
          },
          {
            "d": "PDB path on non-standard drive letter",
            "e": [
              "f:\\DW\\Desktop\\Dev\\11.0\\RC1\\MRC\\Src\\DWRC\\DWRCSE\\Win32\\Release\\DWRCSE.pdb"
            ],
            "i": "metadata/binary/debug::pdb-nonstandard-drive",
            "l": 3
          },
          {
            "c": 1.0,
            "d": "Tiny PE by file size",
            "e": [
              "pe.machine = 332.00"
            ],
            "i": "metadata/binary/metrics/size::tiny-pe",
            "l": 3
          },
          {
            "c": 1.0,
            "d": "NO_SEH (SafeSEH not used)",
            "e": [
              "true"
            ],
            "i": "metadata/hardening/mitigation::pe-no-seh",
            "l": 2
          },
          {
            "a": "T1204.002",
            "c": 0.7599999904632568,
            "d": "Short PDB marker",
            "e": [
              "DWRCSE.pdb"
            ],
            "i": "objectives/command-and-control/dropper/execution/clickfix::short-pdb-marker",
            "l": 1,
            "m": "B0024"
          },
          {
            "c": 0.699999988079071,
            "d": "PE with six or fewer imports",
            "e": [
              "binary.import_count = 0.00"
            ],
            "i": "metadata/binary/symbols/imports::pe-imports-max-six",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "Tiny writable data section",
            "e": [
              ".data (size: 0)"
            ],
            "i": "metadata/binary/section/metrics::tiny-data-section",
            "l": 1
          },
          {
            "a": "T1070.006",
            "c": 0.699999988079071,
            "d": "PE header compile timestamp predates 2025",
            "e": [
              "pe.timestamp = 1397482799.00"
            ],
            "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "requestedExecutionLevel is asInvoker",
            "e": [
              "asInvoker"
            ],
            "i": "metadata/build/manifest::pe-as-invoker",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "PE second resource is RT_MANIFEST",
            "e": [
              "RT_MANIFEST"
            ],
            "i": "metadata/binary/resource::pe-resource-manifest-second",
            "l": 2
          },
          {
            "c": 0.699999988079071,
            "d": "PE imports from one DLL",
            "e": [
              "pe.import_dll_count = 0.00"
            ],
            "i": "metadata/binary/symbols/imports::pe-single-import-dll",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Binary has low average complexity",
            "e": [
              "binary.avg_complexity = 0.00"
            ],
            "i": "metadata/binary/metrics/threshold::avg-complexity-15-max",
            "l": 2
          },
          {
            "c": 0.8999999761581421,
            "d": "PE standard code/data section",
            "e": [
              ".data"
            ],
            "i": "metadata/binary/section/names::pe-code-data-standard-section",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "Very low code entropy, minimal code",
            "e": [
              "binary.code_entropy = 0.00"
            ],
            "i": "metadata/binary/resource::low-code-entropy",
            "l": 2
          },
          {
            "a": "T1070.006",
            "c": 0.699999988079071,
            "d": "Debug timestamps internally consistent",
            "e": [
              "pe.debug_timestamp_consistent = 1.00"
            ],
            "i": "objectives/evasion/indicator-removal/timestamps::debug-timestamps-consistent",
            "l": 1
          },
          {
            "a": "T1055.012",
            "c": 1.0,
            "d": "Lacks substantial data section",
            "e": [
              "binary.data_to_file_ratio = 0.00"
            ],
            "i": "objectives/evasion/process/injection/hollowing::lacks-substantial-data",
            "l": 1,
            "m": "E1055.012"
          },
          {
            "a": "T1027.003",
            "c": 0.9900000095367432,
            "d": "PE checksum mismatch",
            "e": [
              "pe.checksum_valid = 1.00"
            ],
            "i": "objectives/anti-static/obfuscation/payload/container::pe-checksum-mismatch-png",
            "l": 1,
            "m": "F0001.006"
          },
          {
            "c": 0.8999999761581421,
            "d": "PE .reloc section presence",
            "e": [
              ".reloc"
            ],
            "i": "metadata/binary/section/names::reloc-section-presence",
            "l": 2
          },
          {
            "c": 0.8999999761581421,
            "d": "PE resource section",
            "e": [
              ".rsrc"
            ],
            "i": "metadata/binary/section/names::pe-resource-section",
            "l": 1
          },
          {
            "c": 0.8600000143051147,
            "d": "asInvoker manifest tag in resources",
            "e": [
              "\u003crequestedExecutionLevel level=\"asInvoker\" uiAccess=\"false\"\u003e"
            ],
            "i": "metadata/binary/resource::asinvoker-resource-manifest-flex",
            "l": 2
          },
          {
            "c": 0.8999999761581421,
            "d": "PE Rich header present (MSVC toolchain)",
            "e": [
              "pe.has_rich_header = 1.00"
            ],
            "i": "metadata/binary/resource::rich-header-present",
            "l": 2
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "VB6 binary with very few strings",
            "e": [
              "binary.string_count = 33.00"
            ],
            "i": "objectives/anti-static/obfuscation/payload/string-sparse::low-string-count-vb6",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 1.0,
            "d": "File is a compiled binary",
            "e": [
              "235626"
            ],
            "i": "metadata/binary/framework::is-binary",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "PE has exactly two resource entries",
            "e": [
              "pe.resource_count = 2.00"
            ],
            "i": "metadata/binary/resource::pe-resource-count-two",
            "l": 2
          },
          {
            "c": 0.800000011920929,
            "d": "Tiny PE single-function stub",
            "e": [
              "binary.func_count = 0.00"
            ],
            "i": "metadata/binary/layout::tiny-single-function-pe",
            "l": 3
          },
          {
            "c": 0.8999999761581421,
            "d": "Binary has low overall entropy",
            "e": [
              "binary.overall_entropy = 1.49"
            ],
            "i": "metadata/binary/metrics/threshold::low-overall-entropy-binary",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "PE has under ten imports",
            "e": [
              "binary.import_count = 0.00"
            ],
            "i": "objectives/anti-static/pack/runtime::pe-import-count-under-10",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "PE has low overall entropy",
            "e": [
              "binary.overall_entropy = 1.49"
            ],
            "i": "metadata/binary/layout::low-overall-entropy",
            "l": 2
          },
          {
            "a": "T1027",
            "c": 0.699999988079071,
            "d": "Zero recovered functions",
            "e": [
              "binary.func_count = 0.00"
            ],
            "i": "objectives/anti-static/obfuscation/payload/encrypted::zero-function-count",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.800000011920929,
            "d": "Small PE resource section",
            "e": [
              "pe.rsrc_size = 1536.00"
            ],
            "i": "metadata/package/versioning::pe-small-rsrc",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "Import count is exactly zero",
            "e": [
              "binary.import_count = 0.00"
            ],
            "i": "objectives/evasion/masquerade/identity/vendor::zero-import-count",
            "l": 2
          },
          {
            "c": 0.800000011920929,
            "d": "CompanyName field absent from PE version info",
            "e": [
              "field 'pe.version_info.company_name' does not exist"
            ],
            "i": "metadata/binary/anomaly/format::version-info-company-name-absent",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "PE with exactly four sections",
            "e": [
              "binary.section_count = 4.00"
            ],
            "i": "metadata/binary/metrics/structural::four-section-pe",
            "l": 1
          },
          {
            "a": "T1053.005",
            "c": 0.8999999761581421,
            "d": "Regex component marker",
            "e": [
              "Connect",
              "Connection"
            ],
            "i": "objectives/persistence/login/scheduled-task/com::task-scheduler-builder-methods--rx-1",
            "l": 1,
            "m": "F0012"
          },
          {
            "a": "T1036.005",
            "c": 0.9700000286102295,
            "d": "PE has no Authenticode signature",
            "e": [
              "binary.has_signature = 0.00"
            ],
            "i": "objectives/evasion/masquerade/version-resource/microsoft-utility::dw20-host-unsigned",
            "l": 1,
            "m": "F0004"
          },
          {
            "c": 0.8500000238418579,
            "d": "PE checksum field not set",
            "e": [
              "pe.has_checksum = 1.00"
            ],
            "i": "metadata/binary/layout::pe-checksum-absent",
            "l": 1
          },
          {
            "a": "T1105",
            "c": 0.800000011920929,
            "d": "Compact PE import table",
            "e": [
              "binary.import_count = 0.00"
            ],
            "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table",
            "l": 1,
            "m": "E1105"
          },
          {
            "c": 0.699999988079071,
            "d": "No imported symbols",
            "e": [
              "binary.import_density = 0.00"
            ],
            "i": "metadata/binary/metrics/structural::no-imports",
            "l": 3
          },
          {
            "a": "T1612",
            "c": 0.8500000238418579,
            "d": "PE has few icon resources",
            "e": [
              "pe.icon_count = 0.00"
            ],
            "i": "objectives/anti-static/obfuscation/payload/resource::icon-count-under-six",
            "l": 1,
            "m": "B0023"
          },
          {
            "a": "T1055",
            "c": 0.9200000166893005,
            "d": "Regex component marker",
            "e": [
              "binary.import_count = 0.00"
            ],
            "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571",
            "l": 1,
            "m": "C0041"
          },
          {
            "a": "T1027",
            "c": 0.800000011920929,
            "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)",
            "e": [
              "pe.resource_count = 2.00"
            ],
            "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Binary is not digitally signed",
            "e": [
              "binary.has_signature = 0.00"
            ],
            "i": "metadata/signed/trust-level::unsigned",
            "l": 3
          },
          {
            "a": "T1070.006",
            "c": 0.8999999761581421,
            "d": "Export timestamp is absent",
            "e": [
              "pe.has_export_timestamp = 0.00"
            ],
            "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-absent",
            "l": 2
          },
          {
            "c": 0.800000011920929,
            "d": "PE executable is unsigned",
            "e": [
              "binary.has_signature = 0.00"
            ],
            "i": "metadata/signed/trust-level::unsigned-pe-executable",
            "l": 3
          },
          {
            "c": 0.8600000143051147,
            "d": "Low-code PE with no imports",
            "e": [
              "binary.import_density = 0.00",
              "binary.code_entropy = 0.00"
            ],
            "i": "metadata/binary/resource::low-code-no-import-resource-stub",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "PE file consisting primarily of resources (e.g., .mui, UI localization)",
            "e": [
              "binary.code_entropy = 0.00",
              "binary.func_count = 0.00",
              "binary.import_density = 0.00"
            ],
            "i": "metadata/binary/resource::resource-only-dll",
            "l": 2
          }
        ],
        "sha": "9d7e9272186efd910cd0403867090ebb1b62381136c6736b0fa889c2c2c6f003",
        "path": "/data/samples/good/datasets/pe-machine-learning-dataset/235626",
        "type": "pe"
      }
    ],
    "tv": "6a383"
  }
}