{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 0.9962007403373718,
        "class": 0
      }
    ],
    "prob": 0.99620074,
    "class": 0,
    "models": [
      {
        "m": "az",
        "prob": 0.97461957,
        "class": 0
      },
      {
        "m": "az/native",
        "prob": 0.9913573,
        "class": 0
      },
      {
        "m": "az/pe",
        "prob": 0.99620074,
        "class": 0
      }
    ],
    "version": "v16.16",
    "thresholds": [
      0.9961138,
      0.99909174
    ],
    "analyzed_at": "2026-05-10T12:50:08Z"
  },
  "path": "19095",
  "raw": {
    "v": "4",
    "fs": [
      {
        "f": "O₄(As₆C₂Er₅I)H₂(PoOs)Md₃(Bi₇SiPa)",
        "k": {
          "hash.imp": "b6f391375d741ab65301de3824d105be",
          "pe.timestamp": 1294145438,
          "hash.authenti": "01fb392a5445e99ca711f1b838923359140a2257c66771ce81fe90e824a52ec7",
          "hash.rich_header": "ac7f95a3db599aeeb78e9326156ad590dc55a373320aa9197a244a8868676977",
          "build.target_arch": "x86",
          "pe.linker_version": "5.12",
          "pe.rich_header.xor_key": "0xba6c561a",
          "pe.data_directories[0].rva": 8448,
          "pe.data_directories[1].rva": 8228,
          "pe.data_directories[2].rva": 16384,
          "pe.data_directories[3].rva": 8192,
          "pe.data_directories[0].name": "export",
          "pe.data_directories[0].size": 51,
          "pe.data_directories[1].name": "import",
          "pe.data_directories[1].size": 40,
          "pe.data_directories[2].name": "base_relocation",
          "pe.data_directories[2].size": 32,
          "pe.data_directories[3].name": "iat",
          "pe.data_directories[3].size": 36,
          "pe.rich_header_compids[0].count": 1,
          "pe.rich_header_compids[1].count": 12,
          "binary.top_complex_unnamed[0].cc": 6,
          "binary.top_complex_unnamed[1].cc": 3,
          "binary.top_complex_unnamed[2].cc": 3,
          "binary.top_complex_unnamed[3].cc": 2,
          "binary.top_complex_unnamed[4].cc": 2,
          "pe.rich_header_compids[0].compid": 1188092,
          "pe.rich_header_compids[1].compid": 1253262,
          "binary.top_complex_unnamed[0].bbs": 9,
          "binary.top_complex_unnamed[1].bbs": 5,
          "binary.top_complex_unnamed[2].bbs": 4,
          "binary.top_complex_unnamed[3].bbs": 4,
          "binary.top_complex_unnamed[4].bbs": 3,
          "binary.top_complex_unnamed[0].addr": "0x10001039",
          "binary.top_complex_unnamed[0].size": 85,
          "binary.top_complex_unnamed[1].addr": "0x10001000",
          "binary.top_complex_unnamed[1].size": 57,
          "binary.top_complex_unnamed[2].addr": "0x100010e3",
          "binary.top_complex_unnamed[2].size": 57,
          "binary.top_complex_unnamed[3].addr": "0x1000108e",
          "binary.top_complex_unnamed[3].size": 56,
          "binary.top_complex_unnamed[4].addr": "0x100010c6",
          "binary.top_complex_unnamed[4].size": 29,
          "pe.section_characteristics[0].name": ".text",
          "pe.section_characteristics[1].name": ".rdata",
          "pe.section_characteristics[2].name": ".data",
          "pe.section_characteristics[3].name": ".reloc",
          "pe.rich_header.entries[0].use_count": 1,
          "pe.rich_header.entries[1].use_count": 12,
          "pe.rich_header.entries[0].product_id": 18,
          "pe.rich_header.entries[1].product_id": 19,
          "pe.rich_header.entries[0].build_number": 8444,
          "pe.rich_header.entries[0].product_name": "unknown",
          "pe.rich_header.entries[1].build_number": 8078,
          "pe.rich_header.entries[1].product_name": "unknown",
          "pe.section_characteristics[0].raw_size": 1024,
          "pe.section_characteristics[1].raw_size": 512,
          "pe.section_characteristics[2].raw_size": 512,
          "pe.section_characteristics[3].raw_size": 512,
          "pe.section_characteristics[0].virtual_size": 566,
          "pe.section_characteristics[1].virtual_size": 307,
          "pe.section_characteristics[2].virtual_size": 302,
          "pe.section_characteristics[3].virtual_size": 52,
          "pe.section_characteristics[0].virtual_address": 4096,
          "pe.section_characteristics[1].virtual_address": 8192,
          "pe.section_characteristics[2].virtual_address": 12288,
          "pe.section_characteristics[3].virtual_address": 16384,
          "pe.section_characteristics[0].characteristics_hex": "60000020",
          "pe.section_characteristics[1].characteristics_hex": "40000040",
          "pe.section_characteristics[2].characteristics_hex": "c0000040",
          "pe.section_characteristics[3].characteristics_hex": "42000040"
        },
        "x": 5,
        "id": 0,
        "is": [
          "CloseHandle",
          "CreateMutexA",
          "CreateProcessA",
          "GetLastError",
          "GetModuleFileNameA",
          "ReleaseMutex",
          "lstrcpyA",
          "lstrlenA"
        ],
        "ms": {
          "pe": {
            "entry": 4484.0,
            "machine": 332.0,
            "checksum": 0.0,
            "subsystem": 2.0,
            "timestamp": 1294145438.0,
            "image_base": 268435456.0,
            "entry_section": ".text",
            "size_of_image": 20480.0,
            "file_alignment": 512.0,
            "characteristics": 8462.0,
            "has_rich_header": true,
            "size_of_headers": 1024.0,
            "export_timestamp": 1294145438.0,
            "import_dll_count": 1.0,
            "computed_checksum": 17333.0,
            "section_alignment": 4096.0,
            "resource_timestamp": 0.0,
            "has_export_timestamp": true,
            "linker_major_version": 5.0,
            "linker_minor_version": 12.0,
            "has_resource_timestamp": false,
            "number_of_rva_and_sizes": 16.0
          },
          "file": {
            "size": 3584.0
          },
          "binary": {
            "code_size": 1024.0,
            "func_count": 13.0,
            "code_entropy": 3.71,
            "data_entropy": 1.72,
            "func_density": 13.0,
            "import_count": 8.0,
            "string_count": 20.0,
            "avg_func_size": 42.15,
            "section_count": 4.0,
            "avg_complexity": 2.23,
            "import_density": 8.0,
            "max_complexity": 6.0,
            "string_density": 20.0,
            "overall_entropy": 1.89,
            "avg_basic_blocks": 3.23,
            "avg_section_size": 640.0,
            "dependency_count": 1.0,
            "entropy_variance": 1.36,
            "avg_string_length": 11.4,
            "complexity_per_kb": 2.23,
            "max_string_length": 40.0,
            "avg_string_entropy": 2.9,
            "code_to_data_ratio": 0.67,
            "data_to_file_ratio": 0.14,
            "text_to_file_ratio": 0.29,
            "total_basic_blocks": 42.0,
            "func_analysis_depth": 2.0,
            "string_length_stddev": 7.67,
            "largest_section_ratio": 0.29,
            "sentence_string_count": 1.0,
            "sentence_string_ratio": 0.05,
            "writable_section_count": 1.0,
            "behavioral_import_ratio": 0.13,
            "executable_section_count": 1.0
          }
        },
        "ss": [
          [
            77,
            "!This program cannot be run in DOS mode."
          ],
          [
            160,
            "Rich"
          ],
          [
            432,
            ".text"
          ],
          [
            511,
            "@.data"
          ],
          [
            552,
            ".reloc"
          ],
          [
            1027,
            "VWQSR"
          ],
          [
            1169,
            "SRVWQ"
          ],
          [
            2162,
            "CloseHandle"
          ],
          [
            2176,
            "CreateMutexA"
          ],
          [
            2192,
            "CreateProcessA"
          ],
          [
            2210,
            "GetLastError"
          ],
          [
            2226,
            "GetModuleFileNameA"
          ],
          [
            2248,
            "ReleaseMutex"
          ],
          [
            2264,
            "lstrcpyA"
          ],
          [
            2276,
            "lstrlenA"
          ],
          [
            2286,
            "kernel32.dll"
          ],
          [
            2344,
            "runner.dll"
          ],
          [
            2560,
            "\\/INTEL_CEDR_STORE"
          ],
          [
            2579,
            "TJfQitDj.exe"
          ],
          [
            2592,
            "TION_PATH%"
          ]
        ],
        "sz": 3584,
        "ts": [
          {
            "c": 1.0,
            "d": "Binary has 4 or fewer sections",
            "e": [
              "binary.section_count = 4.00"
            ],
            "i": "objectives/command-and-control/infrastructure/config::max-sections-4",
            "l": 1
          },
          {
            "a": "T1027.007",
            "c": 1.0,
            "d": "WININET.DLL absent from PE import table",
            "e": [
              "pe.import_dll_count = 1.00"
            ],
            "i": "objectives/anti-static/obfuscation/imports::wininet-import-absent",
            "l": 2,
            "m": "B0032"
          },
          {
            "a": "T1055.012",
            "c": 1.0,
            "d": "Lacks substantial resources",
            "e": [
              "binary.rsrc_to_file_ratio = 0.00"
            ],
            "i": "objectives/evasion/process/injection/hollowing::lacks-substantial-resources",
            "l": 1,
            "m": "E1055.012"
          },
          {
            "c": 0.8999999761581421,
            "d": "Binary has low overall entropy",
            "e": [
              "binary.overall_entropy = 1.89"
            ],
            "i": "metadata/binary/metrics/threshold::low-overall-entropy-binary",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "Close handle",
            "e": [
              "CloseHandle"
            ],
            "i": "micro-behaviors/process/create/spawn::close-handle-dup",
            "l": 2
          },
          {
            "c": 0.699999988079071,
            "d": "Get module file path (ANSI)",
            "e": [
              "GetModuleFileNameA"
            ],
            "i": "micro-behaviors/os/module/load::get-module-filename-ansi",
            "l": 2
          },
          {
            "c": 0.699999988079071,
            "d": "PE has low overall entropy",
            "e": [
              "binary.overall_entropy = 1.89"
            ],
            "i": "metadata/binary/layout::low-overall-entropy",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "Binary has 3+ functions",
            "e": [
              "binary.func_count = 13.00"
            ],
            "i": "metadata/binary/metrics/threshold::few-functions-3",
            "l": 1
          },
          {
            "a": "T1036.005",
            "c": 0.9700000286102295,
            "d": "PE has no Authenticode signature",
            "e": [
              "binary.has_signature = 0.00"
            ],
            "i": "objectives/evasion/masquerade/version-resource/microsoft-utility::dw20-host-unsigned",
            "l": 1,
            "m": "F0004"
          },
          {
            "c": 0.8999999761581421,
            "d": "PE Rich header present (MSVC toolchain)",
            "e": [
              "pe.has_rich_header = 1.00"
            ],
            "i": "metadata/binary/resource::rich-header-present",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "Tiny PE by file size",
            "e": [
              "pe.machine = 332.00"
            ],
            "i": "metadata/binary/metrics/size::tiny-pe",
            "l": 3
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "VB6 binary with very few strings",
            "e": [
              "binary.string_count = 20.00"
            ],
            "i": "objectives/anti-static/obfuscation/payload/string-sparse::low-string-count-vb6",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.800000011920929,
            "d": "PE with exactly four sections",
            "e": [
              "binary.section_count = 4.00"
            ],
            "i": "metadata/binary/metrics/structural::four-section-pe",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "PE mapped image under 768 KiB",
            "e": [
              "pe.size_of_image = 20480.00"
            ],
            "i": "metadata/binary/layout::image-under-768kb",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "PE imports from one DLL",
            "e": [
              "pe.import_dll_count = 1.00"
            ],
            "i": "metadata/binary/symbols/imports::pe-single-import-dll",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "CreateMutex API call",
            "e": [
              "CreateMutexA",
              "sub.kernel32.dll_CreateMutexA"
            ],
            "i": "micro-behaviors/process/sync/mutex::create-mutex",
            "l": 2,
            "m": "C0042"
          },
          {
            "a": "T1106",
            "c": 0.949999988079071,
            "d": "Create process (ANSI)",
            "e": [
              "CreateProcessA"
            ],
            "i": "micro-behaviors/process/create/spawn::create-process-a",
            "l": 3
          },
          {
            "d": ".dll extension reference",
            "e": [
              ".dll"
            ],
            "i": "micro-behaviors/fs/path/extension::dll-dup",
            "l": 2
          },
          {
            "a": "T1070.006",
            "c": 0.699999988079071,
            "d": "PE header compile timestamp predates 2025",
            "e": [
              "pe.timestamp = 1294145438.00"
            ],
            "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "PE .reloc section presence",
            "e": [
              ".reloc"
            ],
            "i": "metadata/binary/section/names::reloc-section-presence",
            "l": 2
          },
          {
            "c": 0.8500000238418579,
            "d": "Query current module path",
            "e": [
              "GetModuleFileNameA"
            ],
            "i": "micro-behaviors/fs/path/check::get-module-filename",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "File is a compiled binary",
            "e": [
              "19095"
            ],
            "i": "metadata/binary/framework::is-binary",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "ReleaseMutex API call",
            "e": [
              "ReleaseMutex"
            ],
            "i": "micro-behaviors/process/sync/mutex::release-mutex",
            "l": 2,
            "m": "C0042"
          },
          {
            "c": 0.699999988079071,
            "d": "GetModuleFileName API call",
            "e": [
              "GetModuleFileNameA"
            ],
            "i": "micro-behaviors/process/info/current::get-module-filename",
            "l": 2
          },
          {
            "c": 0.75,
            "d": "Binary exports no symbols",
            "e": [
              "binary.export_count = 0.00"
            ],
            "i": "metadata/binary/symbols/exports::no-exports",
            "l": 1
          },
          {
            "a": "T1055.012",
            "c": 0.800000011920929,
            "d": "CreateProcess API string reference",
            "e": [
              "CreateProcessA"
            ],
            "i": "objectives/evasion/process/injection/hollowing::create-process-string",
            "l": 1,
            "m": "E1055.012"
          },
          {
            "c": 0.800000011920929,
            "d": "Small PE resource section",
            "e": [
              "pe.rsrc_size = 0.00"
            ],
            "i": "metadata/package/versioning::pe-small-rsrc",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "Tiny writable data section",
            "e": [
              ".data (size: 512)"
            ],
            "i": "metadata/binary/section/metrics::tiny-data-section",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "PE has under ten imports",
            "e": [
              "binary.import_count = 8.00"
            ],
            "i": "objectives/anti-static/pack/runtime::pe-import-count-under-10",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Binary has low average complexity",
            "e": [
              "binary.avg_complexity = 2.23"
            ],
            "i": "metadata/binary/metrics/threshold::avg-complexity-15-max",
            "l": 2
          },
          {
            "c": 0.699999988079071,
            "d": "Get system error code",
            "e": [
              "GetLastError"
            ],
            "i": "micro-behaviors/os/exception/error-handling::get-last-error",
            "l": 2
          },
          {
            "c": 0.800000011920929,
            "d": "Dense PE import table references",
            "e": [
              "binary.import_density = 8.00"
            ],
            "i": "metadata/binary/metrics/structural::high-import-density",
            "l": 3
          },
          {
            "c": 1.0,
            "d": "Binary has low average string entropy",
            "e": [
              "binary.avg_string_entropy = 2.90"
            ],
            "i": "metadata/binary/metrics/threshold::avg-string-entropy-4-max",
            "l": 2
          },
          {
            "c": 0.800000011920929,
            "d": "CompanyName field absent from PE version info",
            "e": [
              "field 'pe.version_info.company_name' does not exist"
            ],
            "i": "metadata/binary/anomaly/format::version-info-company-name-absent",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "PE standard code/data section",
            "e": [
              ".text",
              ".data"
            ],
            "i": "metadata/binary/section/names::pe-code-data-standard-section",
            "l": 1
          },
          {
            "a": "T1485",
            "c": 0.8999999761581421,
            "d": "Preserves .exe .gho .bak files",
            "e": [
              ".exe"
            ],
            "i": "objectives/impact/destroy/file-deletion::exe-gho-bak-whitelist",
            "l": 1,
            "m": "C0047"
          },
          {
            "c": 0.8999999761581421,
            "d": "PE standard runtime section",
            "e": [
              ".reloc",
              ".rdata"
            ],
            "i": "metadata/binary/section/names::pe-runtime-standard-section",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "Low-entropy rdata section",
            "e": [
              ".rdata (entropy: 2.70)"
            ],
            "i": "metadata/binary/section/metrics::low-entropy-rdata-section",
            "l": 1
          },
          {
            "a": "T1027.007",
            "c": 0.800000011920929,
            "d": "DLL name strings without LoadLibrary import",
            "e": [
              "binary.import_count = 8.00"
            ],
            "i": "objectives/anti-static/obfuscation/string/runtime-decrypt::dll-names-no-loadlibrary",
            "l": 1,
            "m": "B0032.014"
          },
          {
            "a": "T1027.007",
            "c": 0.8999999761581421,
            "d": "Kernel32 DLL resolution string",
            "e": [
              "kernel32.dll"
            ],
            "i": "micro-behaviors/os/api-resolution/manual::kernel32-resolver",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.8600000143051147,
            "d": "Long mixed-case identifiers cluster",
            "e": [
              "GetModuleFileNameA"
            ],
            "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1055",
            "c": 0.949999988079071,
            "d": "Huge null run in executable (128+ bytes)",
            "e": [
              "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00"
            ],
            "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.800000011920929,
            "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)",
            "e": [
              "pe.resource_count = 0.00"
            ],
            "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources",
            "l": 1
          },
          {
            "d": ".exe extension reference",
            "e": [
              ".exe"
            ],
            "i": "micro-behaviors/fs/path/extension::exe-dup",
            "l": 2
          },
          {
            "a": "T1055",
            "c": 0.9200000166893005,
            "d": "Regex component marker",
            "e": [
              "binary.import_count = 8.00"
            ],
            "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571",
            "l": 1,
            "m": "C0041"
          },
          {
            "c": 0.75,
            "d": "Low average code complexity",
            "e": [
              "binary.avg_complexity = 2.23"
            ],
            "i": "metadata/binary/metrics/structural::low-average-complexity",
            "l": 2
          },
          {
            "a": "T1612",
            "c": 0.8500000238418579,
            "d": "PE has few icon resources",
            "e": [
              "pe.icon_count = 0.00"
            ],
            "i": "objectives/anti-static/obfuscation/payload/resource::icon-count-under-six",
            "l": 1,
            "m": "B0023"
          },
          {
            "a": "T1070.006",
            "c": 0.8999999761581421,
            "d": "Export directory timestamp set to 0xFFFFFFFF (tampered)",
            "e": [
              "pe.export_timestamp = 1294145438.00"
            ],
            "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-maxval",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Binary is not digitally signed",
            "e": [
              "binary.has_signature = 0.00"
            ],
            "i": "metadata/signed/trust-level::unsigned",
            "l": 3
          },
          {
            "a": "T1105",
            "c": 0.800000011920929,
            "d": "Compact PE import table",
            "e": [
              "binary.import_count = 8.00"
            ],
            "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table",
            "l": 1,
            "m": "E1105"
          },
          {
            "c": 0.800000011920929,
            "d": "PE executable is unsigned",
            "e": [
              "binary.has_signature = 0.00"
            ],
            "i": "metadata/signed/trust-level::unsigned-pe-executable",
            "l": 3
          },
          {
            "c": 0.949999988079071,
            "d": "links kernel32.dll (CloseHandle, CreateMutexA, CreateProcessA, GetLastError, GetModuleFileNameA, ... +3 more)",
            "e": [
              "kernel32.dll"
            ],
            "i": "metadata/dylib::kernel32/dll",
            "l": 2
          },
          {
            "c": 0.800000011920929,
            "d": "Mutex-based single instance enforcement",
            "e": [
              "CreateMutexA",
              "sub.kernel32.dll_CreateMutexA",
              "GetLastError"
            ],
            "i": "micro-behaviors/process/sync/mutex::mutex-instance-check",
            "l": 2,
            "m": "C0042"
          }
        ],
        "sha": "a8447340b390b5e1eea07b8e455deb990ae4468f8a38f656d1fdf1e7f515e4fd",
        "path": "19095",
        "type": "pe"
      }
    ],
    "tv": "51ad9"
  }
}