{
  "ml": {
    "v": "7",
    "eng": "2.9.1",
    "lvl": -1,
    "conf": 0,
    "mods": [
      {
        "cls": 0,
        "raw": 0.00005396207,
        "rte": "az",
        "prob": 0.00005396207
      },
      {
        "cls": 0,
        "raw": 0.00181065,
        "rte": "az/native",
        "prob": 0.00181065
      },
      {
        "cls": 0,
        "raw": 0.0057556727,
        "rte": "az/pe",
        "prob": 0.0057556727
      }
    ],
    "prob": 0.00005396207,
    "files": [
      {
        "id": 0,
        "lvl": -1,
        "conf": 0,
        "prob": 0.000053962070523994043,
        "type": "pe"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-09-12T17:58:14Z"
  },
  "path": "Backdoor.Win32.Delf.afy",
  "raw": {
    "v": "8",
    "rev": "c7f7e",
    "files": [
      {
        "id": 0,
        "ctx": [
          {
            "b": "o\u003cgu[0SSi21on@j%nJ60XbVHe00000kMzY5000000000000000000000000000000000000000000961X!1\u0026Kag8v0a?dLD+]@ggra]#!aAhvtx8",
            "ln": 0
          },
          {
            "b": "wPxUcx(dB41wAxsBosh$15%hT0-e\u003c%22[MozdN.(rb3hXAXN!{zD7s!wPw1-rb3hXAXQKczdN.\u003coL4*T1f.+crbVZSpYHF1r8^NGwPv#Ox(dB4g6*D?By/GovqD4!00=qqrb3hXAT8$Kx(dB4ge[",
            "ln": 231465
          }
        ],
        "mol": "H(U)",
        "sha": "a71ef7ecbf45bc2da0b6c4fb1d692719374bfb1cbfa5207483f3c1fed89219aa",
        "path": "Backdoor.Win32.Delf.afy",
        "risk": 1,
        "size": 267188,
        "supp": [
          {
            "by": [
              {
                "id": "value"
              }
            ],
            "id": "metadata/binary/anomaly/signing::signed-pe-large-noncertificate-overlay",
            "crit": "notable",
            "kind": "unless"
          }
        ],
        "type": "pe",
        "facts": {
          "exp": [
            [
              "HookOff"
            ],
            [
              "HookOn"
            ],
            [
              "SetMainWindow"
            ]
          ],
          "imp": [
            [
              "kernel32",
              "GetProcAddress"
            ],
            [
              "kernel32",
              "GetModuleHandleA"
            ],
            [
              "kernel32",
              "LoadLibraryA"
            ],
            [
              "user32",
              "GetKeyboardType"
            ],
            [
              "advapi32",
              "RegQueryValueExA"
            ],
            [
              "oleaut32",
              "SysFreeString"
            ],
            [
              "advapi32",
              "RegQueryValueExA"
            ],
            [
              "gdi32",
              "UnrealizeObject"
            ],
            [
              "user32",
              "WindowFromPoint"
            ],
            [
              "oleaut32",
              "SafeArrayPtrOfIndex"
            ],
            [
              "comctl32",
              "ImageList_SetIconSize"
            ]
          ],
          "sec": [
            [
              "CODE",
              1024,
              135680,
              8.0,
              "rw-"
            ],
            [
              "DATA",
              136704,
              2048,
              7.05,
              "rw-"
            ],
            [
              "BSS",
              138752,
              0,
              0.0,
              "rw-"
            ],
            [
              ".idata",
              138752,
              3072,
              7.86,
              "rw-"
            ],
            [
              ".edata",
              141824,
              512,
              1.25,
              "rw-"
            ],
            [
              ".reloc",
              142336,
              13824,
              7.91,
              "rw-"
            ],
            [
              ".rsrc",
              156160,
              5120,
              6.88,
              "rw-"
            ],
            [
              ".aspack",
              161280,
              4608,
              6.09,
              "rw-"
            ],
            [
              ".rsrc",
              165888,
              0,
              0.0,
              "rw-"
            ]
          ],
          "metrics": {
            "pe": {
              "checksum": 0,
              "timestamp": 708992537,
              "icon_count": 2,
              "image_size": 393216,
              "has_overlay": 1,
              "overlay_end": 267188,
              "headers_size": 1024,
              "overlay_size": 101300,
              "checksum_valid": 0,
              "file_alignment": 512,
              "overlay_offset": 165888,
              "resource_count": 6,
              "overlay_padding": 101300,
              "checksum_stripped": 1,
              "computed_checksum": 289761,
              "dos_stub_modified": 1,
              "headers_size_ratio": 0,
              "prose_section_count": 0,
              "reloc_overhang_bytes": 4600,
              "reloc_overhang_ratio": 1,
              "bss_like_section_count": 1,
              "section_overflow_count": 0,
              "misaligned_section_count": 0,
              "entry_in_writable_section": 1,
              "base_relocation_block_count": 1,
              "base_relocation_entry_count": 0,
              "data_directory_anomaly_count": 1,
              "declared_data_directory_count": 5,
              "executable_prose_section_count": 0,
              "directory_section_mismatch_count": 0,
              "data_directory_zero_rva_nonzero_size_count": 1
            },
            "file": {
              "size": 267188,
              "entropy": 7.28
            },
            "binary": {
              "is_pie": 0,
              "has_overlay": 1,
              "data_entropy": 7.87,
              "overlay_size": 101300,
              "string_count": 1088,
              "overlay_ratio": 0.38,
              "overlay_entropy": 5.2,
              "entropy_variance": 4.89,
              "avg_string_length": 14.1,
              "max_string_length": 414,
              "peak_region_bytes": 155648,
              "code_to_data_ratio": 0,
              "peak_region_entropy": 7.85,
              "string_length_stddev": 24.59,
              "largest_section_ratio": 0.51,
              "sentence_string_count": 131,
              "sentence_string_ratio": 0.12,
              "high_entropy_string_count": 0
            },
            "exports": {
              "count": 3
            },
            "imports": {
              "count": 11
            },
            "sections": {
              "count": 9,
              "entropy_max": 8,
              "entropy_mean": 6.43,
              "name_entropy": 4.06,
              "writable_count": 9,
              "executable_count": 0,
              "nonstandard_count": 4,
              "executable_writable_count": 0
            },
            "consistency": {
              "extension_content_mismatch": 1,
              "extension_content_mismatch.binary_as_unknown": 1
            },
            "dependencies": {
              "count": 6
            }
          }
        },
        "traits": [
          {
            "id": "micro-behaviors/ui/controls/widget::image-list-set-icon-size",
            "conf": 0.88,
            "crit": 3,
            "desc": "Image list icon size import",
            "spans": [
              [
                385317,
                21
              ]
            ]
          }
        ]
      }
    ]
  }
}