{ "llm": { "conf": 0.22491276, "error": "LLM endpoint returned 402 Payment Required: \"{\\\"error\\\":{\\\"message\\\":\\\"Insufficient credits. Add more using https://openrouter.ai/settings/credits\\\",\\\"code\\\":402,\\\"metadata\\\":{\\\"limit_source\\\":\\\"openrouter_credits\\\",\\\"remedy_hint\\\":\\\"Add credits at https://openrouter.ai/settings/credits, or lower max_tokens / prompt size to fit your remaining balance.\\\"}}}\"", "model": "Qwen/Qwen3.8-27B", "outcome": "benign" }, "ml": { "v": "7", "eng": "2.10.0", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.22491276, "rte": "az", "prob": 0.22491276 }, { "cls": 0, "raw": 0.014195462, "rte": "az/native", "prob": 0.014195462 }, { "cls": 0, "raw": 0.013453782, "rte": "az/pe", "prob": 0.013453782 } ], "prob": 0.22491276, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.22491276264190674, "type": "pe" } ], "version": "v18.18", "analyzed_at": "2026-09-12T04:59:30Z" }, "path": "Virus.Win32.Artelad.2173", "raw": { "v": "8", "rev": "c7f7e", "files": [ { "id": 0, "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb/MH4J\u0026m(0ji6Sa?dLD+]{51x(+zoA=kPhvqNb%vqY$3BrC47aAzQxazCZol@c-7zeS@@e!5l%bME/A00000p^\u003eu:oAuys3x)Cd0000000000?#Bk/3JQwA00ic207D}*00000073.!01Ybg03zmw00", "ln": 0 }, { "b": "0000000000000000000000000000000000000000gR*\u003cs0fAq7KDtM=KDtM=eIeK%v@C)?az2C3at2e%00000000000000000000000000000000000000000000000", "ln": 2016 }, { "b": "0000000000000000000000000000000000000000eIeLaeG!LwzGx[xeIeLa0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", "ln": 2528 }, { "b": "0000000000000000000000000000000000000000eIeLaeG!OjByupzeIeLa0000000000000000000000000000000000000000000000000000000000000000000000000000000000", "ln": 3040 }, { "b": "000000000000000000000000000000000000000000000000000000000000000002MK\u002680000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", "ln": 19920 } ], "mol": "Md₂(Bi₄Si)", "sha": "aaf3fb3c9b6eb7091ce59a0248b6f9bc5eaae1ecd21c5357981e0173218d02ee", "path": "Virus.Win32.Artelad.2173", "risk": 5, "size": 23040, "supp": [ { "by": [ { "id": "metadata/binary/resource::no-resources" }, { "id": "metadata/binary/resource::pe-no-version-info-resource" }, { "id": "metadata/binary/resource::small-pe-no-resources" } ], "id": "objectives/anti-static/obfuscation/payload/loader::pe-zero-imports-shellcode-dropper", "crit": "hostile", "kind": "unless" }, { "by": [ { "id": "metadata/binary/section/names::pe-code-data-standard-section", "spans": [ [ 2048, 5 ], [ 2560, 6 ], [ 3072, 5 ], [ 19968, 6 ] ] }, { "id": "metadata/binary/section/names::pe-runtime-standard-section", "spans": [ [ 2048, 5 ], [ 2560, 6 ], [ 3072, 5 ], [ 19968, 6 ] ] }, { "id": "metadata/binary/section/names::reloc-section-presence", "spans": [ [ 2048, 5 ], [ 2560, 6 ], [ 3072, 5 ], [ 19968, 6 ] ] } ], "id": "objectives/anti-static/pack/section-anomaly::tiny-executable-obfuscation-section", "crit": "suspicious", "kind": "unless" }, { "by": [ { "id": "metrics", "spans": [ [ 0, 28 ] ] } ], "id": "metadata/binary/layout::pe-checksum-zeroed", "crit": "notable", "kind": "unless" } ], "type": "pe", "facts": { "sec": [ [ ".text", 2048, 512, 0.51, "r-x" ], [ ".rdata", 2560, 512, 0.27, "r--" ], [ ".data", 3072, 512, 0.25, "rw-" ], [ "DATA00", 3584, 512, 0.27, "r--" ], [ "DATA01", 4096, 512, 0.27, "r--" ], [ "DATA02", 4608, 512, 0.27, "r--" ], [ "DATA03", 5120, 512, 0.27, "r--" ], [ "DATA04", 5632, 512, 0.27, "r--" ], [ "DATA05", 6144, 512, 0.27, "r--" ], [ "DATA06", 6656, 512, 0.27, "r--" ], [ "DATA07", 7168, 512, 0.27, "r--" ], [ "DATA08", 7680, 512, 0.27, "r--" ], [ "DATA09", 8192, 512, 0.27, "r--" ], [ "DATA10", 8704, 512, 0.27, "r--" ], [ "DATA11", 9216, 512, 0.27, "r--" ], [ "DATA12", 9728, 512, 0.27, "r--" ], [ "DATA13", 10240, 512, 0.27, "r--" ], [ "DATA14", 10752, 512, 0.27, "r--" ], [ "DATA15", 11264, 512, 0.27, "r--" ], [ "DATA16", 11776, 512, 0.27, "r--" ], [ "DATA17", 12288, 512, 0.27, "r--" ], [ "DATA18", 12800, 512, 0.27, "r--" ], [ "DATA19", 13312, 512, 0.27, "r--" ], [ "DATA20", 13824, 512, 0.27, "r--" ], [ "DATA21", 14336, 512, 0.27, "r--" ], [ "DATA22", 14848, 512, 0.27, "r--" ], [ "DATA23", 15360, 512, 0.27, "r--" ], [ "DATA24", 15872, 512, 0.27, "r--" ], [ "DATA25", 16384, 512, 0.27, "r--" ], [ "DATA26", 16896, 512, 0.27, "r--" ], [ "DATA27", 17408, 512, 0.27, "r--" ], [ "DATA28", 17920, 512, 0.27, "r--" ], [ "DATA29", 18432, 512, 0.27, "r--" ], [ "DATA30", 18944, 512, 0.27, "r--" ], [ "DATA31", 19456, 512, 0.27, "r--" ], [ ".reloc", 19968, 3072, 6.52, "rwx" ] ], "funcs": [ [ "entry0", 4342272 ], [ "fcn.00424948", 4344136 ], [ "fcn.00424950", 4344144 ], [ "fcn.004249d0", 4344272 ], [ "fcn.00424a00", 4344320 ] ], "metrics": { "pe": { "checksum": 0, "timestamp": 926454538, "image_size": 150528, "headers_size": 2048, "checksum_valid": 0, "file_alignment": 512, "checksum_stripped": 1, "computed_checksum": 45838, "headers_size_ratio": 0.09, "prose_section_count": 0, "reloc_overhang_bytes": 3064, "reloc_overhang_ratio": 1, "bss_like_section_count": 0, "section_overflow_count": 0, "misaligned_section_count": 0, "entry_in_writable_section": 1, "rizin_importless_analysis": 1, "base_relocation_block_count": 1, "base_relocation_entry_count": 0, "declared_data_directory_count": 1, "executable_prose_section_count": 0, "rizin_importless_function_count": 5, "directory_section_mismatch_count": 0 }, "file": { "size": 23040, "entropy": 1.72 }, "binary": { "is_pie": 0, "basic_blocks": 74, "code_entropy": 5.66, "data_entropy": 0.25, "string_count": 40, "avg_complexity": 8.2, "max_complexity": 21, "huge_func_count": 0, "leaf_func_count": 4, "tiny_func_count": 1, "avg_basic_blocks": 14.8, "entropy_variance": 1.05, "avg_string_length": 15.3, "max_string_length": 40, "peak_region_bytes": 1024, "code_to_data_ratio": 0.88, "peak_region_entropy": 7.23, "string_length_stddev": 5.25, "largest_section_ratio": 0.13, "sentence_string_count": 2, "sentence_string_ratio": 0.05, "high_entropy_string_count": 0 }, "sections": { "count": 36, "code_size": 3584, "entropy_max": 6.52, "entropy_mean": 0.45, "name_entropy": 3.4, "writable_count": 2, "executable_count": 2, "nonstandard_count": 32, "executable_writable_count": 1 }, "functions": { "count": 5 }, "dependencies": { "count": 0 } } }, "traits": [ { "id": "metadata/binary/anomaly/section-header::pe-entry-in-reloc-section", "conf": 0.98, "crit": 3, "desc": "PE entry point in .reloc section" }, { "id": "metadata/binary/metrics/structural::few-functions", "conf": 0.4, "crit": 3, "desc": "Very few functions detected", "spans": [ [ 0, 22 ] ] }, { "id": "metadata/binary/metrics/structural::few-leaf-functions", "conf": 0.4, "crit": 3, "desc": "Binary has very few leaf functions", "spans": [ [ 0, 29 ] ] }, { "id": "metadata/binary/metrics/structural::no-imports", "conf": 0.7, "crit": 3, "desc": "PE has no imported DLL dependencies", "spans": [ [ 0, 25 ] ] }, { "id": "metadata/binary/resource::small-pe-no-resources", "conf": 0.82, "crit": 3, "desc": "Small PE lacks resource section" }, { "id": "metadata/binary/section/metrics::multiple-nonstandard-section-names", "conf": 0.9, "crit": 3, "desc": "Multiple nonstandard PE section names", "spans": [ [ 0, 34 ] ] }, { "id": "metadata/binary/section/metrics::pe-entry-in-writable-section", "conf": 0.95, "crit": 3, "desc": "PE entry point in writable section", "spans": [ [ 0, 35 ] ] }, { "id": "metadata/signed/trust-level::unsigned-missing-signature-record", "conf": 0.9, "crit": 3, "desc": "PE lacks signature record" }, { "id": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2000", "atk": "T1070.006", "conf": 0.78, "crit": 1, "desc": "PE header timestamp predates 2000", "spans": [ [ 0, 0 ] ] } ] } ] } }