{
  "ml": {
    "v": "7",
    "eng": "2.9.1",
    "lvl": -1,
    "conf": 0,
    "mods": [
      {
        "cls": 0,
        "raw": 0.00024056435,
        "rte": "az",
        "prob": 0.00024056435
      },
      {
        "cls": 0,
        "raw": 0.0015824238,
        "rte": "az/native",
        "prob": 0.0015824238
      },
      {
        "cls": 0,
        "raw": 0.006030033,
        "rte": "az/pe",
        "prob": 0.006030033
      }
    ],
    "prob": 0.00024056435,
    "files": [
      {
        "id": 0,
        "lvl": -1,
        "conf": 0,
        "prob": 0.00024056434631347656,
        "type": "pe"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-09-12T17:55:34Z"
  },
  "path": "Trojan-Downloader.Win32.Swizzor.gk",
  "raw": {
    "v": "8",
    "rev": "c7f7e",
    "files": [
      {
        "id": 0,
        "ctx": [
          {
            "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000?#A-S4J\u0026m(0ji6Sa?dLD+]{51x(+zoA=kPhvqNb%vqY$3BrC47aAzQxazCZol@c-7zeS@@e!5l%bME/A00000:4OtDGdQn^GdQn^GdQn^?vA}LFH$5+GdQq!Ob",
            "ln": 0
          }
        ],
        "mol": "Md₂(BiSi₂)",
        "sha": "a2b7e1f7eca367307c216e598c8891ab0b5f216119bb7d335ace116ca7302246",
        "path": "Trojan-Downloader.Win32.Swizzor.gk",
        "risk": 3,
        "size": 79480,
        "type": "pe",
        "facts": {
          "imp": [
            [
              "kernel32",
              "GetCommandLineA"
            ],
            [
              "kernel32",
              "GetProcessHeap"
            ],
            [
              "kernel32",
              "ReadFile"
            ],
            [
              "kernel32",
              "LocalFree"
            ],
            [
              "kernel32",
              "LocalAlloc"
            ],
            [
              "kernel32",
              "ReleaseMutex"
            ],
            [
              "kernel32",
              "GetExitCodeProcess"
            ],
            [
              "kernel32",
              "WaitForSingleObject"
            ],
            [
              "kernel32",
              "ResumeThread"
            ],
            [
              "kernel32",
              "CreateProcessA"
            ],
            [
              "kernel32",
              "CreateMutexA"
            ],
            [
              "kernel32",
              "ExitProcess"
            ],
            [
              "kernel32",
              "OpenMutexA"
            ],
            [
              "kernel32",
              "CopyFileA"
            ],
            [
              "kernel32",
              "Sleep"
            ],
            [
              "kernel32",
              "DeleteFileA"
            ],
            [
              "kernel32",
              "GetTickCount"
            ],
            [
              "kernel32",
              "HeapAlloc"
            ],
            [
              "kernel32",
              "GetModuleFileNameA"
            ],
            [
              "kernel32",
              "CloseHandle"
            ],
            [
              "kernel32",
              "WriteFile"
            ],
            [
              "kernel32",
              "CreateFileA"
            ],
            [
              "kernel32",
              "GetTempFileNameA"
            ],
            [
              "kernel32",
              "GetTempPathA"
            ],
            [
              "kernel32",
              "VirtualAlloc"
            ],
            [
              "kernel32",
              "SetFilePointer"
            ],
            [
              "user32",
              "FindWindowA"
            ],
            [
              "user32",
              "SendMessageA"
            ],
            [
              "msvcrt",
              "strlen"
            ],
            [
              "msvcrt",
              "strstr"
            ],
            [
              "msvcrt",
              "strcmp"
            ]
          ],
          "sec": [
            [
              ".text",
              1024,
              7680,
              6.47,
              "r-x"
            ],
            [
              ".data",
              8704,
              512,
              3.73,
              "rw-"
            ],
            [
              ".rsrc",
              9216,
              512,
              0.0,
              "r--"
            ]
          ],
          "metrics": {
            "pe": {
              "checksum": 84979,
              "timestamp": 1018917067,
              "image_size": 20480,
              "has_overlay": 1,
              "overlay_end": 77320,
              "headers_size": 1024,
              "overlay_size": 67592,
              "checksum_valid": 1,
              "file_alignment": 512,
              "overlay_offset": 9728,
              "resource_count": 0,
              "cert_table_size": 2160,
              "overlay_padding": 67592,
              "computed_checksum": 84979,
              "headers_size_ratio": 0.01,
              "prose_section_count": 0,
              "bss_like_section_count": 0,
              "section_overflow_count": 0,
              "signature_expired_days": 8795.3,
              "misaligned_section_count": 0,
              "declared_data_directory_count": 4,
              "executable_prose_section_count": 0,
              "directory_section_mismatch_count": 0
            },
            "file": {
              "size": 79480,
              "entropy": 7.9
            },
            "binary": {
              "is_pie": 0,
              "has_overlay": 1,
              "code_entropy": 6.47,
              "data_entropy": 3.73,
              "overlay_size": 69752,
              "string_count": 134,
              "overlay_ratio": 0.88,
              "overlay_entropy": 7.99,
              "entropy_variance": 7.02,
              "avg_string_length": 8.61,
              "max_string_length": 40,
              "peak_region_bytes": 66560,
              "code_to_data_ratio": 0.94,
              "peak_region_entropy": 7.84,
              "string_length_stddev": 6.14,
              "largest_section_ratio": 0.1,
              "sentence_string_count": 7,
              "sentence_string_ratio": 0.05,
              "high_entropy_string_count": 0
            },
            "imports": {
              "count": 31
            },
            "sections": {
              "count": 3,
              "code_size": 7680,
              "entropy_max": 6.47,
              "entropy_mean": 3.4,
              "name_entropy": 3.01,
              "writable_count": 1,
              "executable_count": 1,
              "nonstandard_count": 0,
              "executable_writable_count": 0
            },
            "consistency": {
              "extension_content_mismatch": 1,
              "extension_content_mismatch.binary_as_unknown": 1
            },
            "dependencies": {
              "count": 3
            }
          }
        },
        "ident": {
          "trust": "ca_signed",
          "signer": {
            "issuer": "EMAIL=server-certs@thawte.com,CN=Thawte Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA",
            "source": "pe.signatures[0]",
            "subject": "CN=C2 Media Ltd.,OU=Secure Application Development,O=C2 Media Ltd.,L=Borehamwood,ST=Hertfordshire,C=UK",
            "common_name": "C2 Media Ltd.",
            "organization": "C2 Media Ltd."
          },
          "unique_ids": {
            "authenticode_thumbprint_sha256": "a8778c07b390c95b775fe73d015ef6f6e0cd3753be364c94e2c869ab63c9247c"
          },
          "organization": {
            "value": "C2 Media Ltd.",
            "source": "pe.signatures[0]",
            "verified": false
          }
        },
        "traits": [
          {
            "id": "metadata/signed/unknown::c2-media-ltd.",
            "conf": 1.0,
            "crit": 3,
            "desc": "Authenticode chain CN: C2 Media Ltd."
          },
          {
            "id": "metadata/signed/leaf::c2-media-ltd.",
            "conf": 1.0,
            "crit": 3,
            "desc": "Signed by C2 Media Ltd."
          },
          {
            "id": "metadata/binary/anomaly/signing::signed-pe-large-noncertificate-overlay",
            "conf": 0.9,
            "crit": 3,
            "desc": "Signed PE has large non-certificate overlay",
            "spans": [
              [
                0,
                29
              ]
            ]
          }
        ]
      }
    ]
  }
}