{
  "ml": {
    "v": "5",
    "fs": [
      {
        "id": 0,
        "prob": 0.8748640418052673,
        "class": 0,
        "threshold": 0.9989520311355591
      }
    ],
    "prob": 0.87486404,
    "class": 0,
    "level": 3,
    "models": [
      {
        "m": "az",
        "prob": 0.87486404,
        "class": 0
      },
      {
        "m": "az/native",
        "prob": 0.19512194,
        "class": 0
      },
      {
        "m": "az/pe",
        "prob": 0.0,
        "class": 0
      }
    ],
    "version": "v17.17",
    "threshold": 0.99895203,
    "analyzed_at": "2026-05-30T01:59:07Z"
  },
  "path": "abd8fcadf68652ae4f26ce90b69c70ffd76106a4a27afb8e86efb57b18d9d3cc.exe",
  "raw": {
    "v": "5",
    "fs": [
      {
        "f": "Md₂(BiSi)",
        "x": 5,
        "ff": {
          "i": [
            [
              "mscoree",
              "CorExeMain"
            ]
          ],
          "m": {
            "pe": {
              "checksum": 2179503.0,
              "checksum_valid": 1.0,
              "computed_checksum": 2179503.0,
              "bss_like_section_count": 0.0,
              "section_overflow_count": 0.0,
              "misaligned_section_count": 0.0,
              "base_relocation_block_count": 1.0,
              "base_relocation_entry_count": 1.0
            },
            "file": {
              "size": 2171152.0,
              "entropy": 2.71,
              "size_bytes": 2171152.0
            },
            "binary": {
              "is_pie": 1.0,
              "has_overlay": 1.0,
              "code_entropy": 2.67,
              "overlay_size": 7440.0,
              "string_count": 36710.0,
              "overlay_ratio": 0.0,
              "overlay_entropy": 7.5,
              "entropy_variance": 1.66,
              "avg_string_length": 57.4,
              "max_string_length": 1118470.0,
              "code_to_data_ratio": 1.0,
              "string_length_stddev": 5837.44,
              "largest_section_ratio": 1.0,
              "sentence_string_count": 8.0,
              "sentence_string_ratio": 0.0,
              "high_entropy_string_count": 0.0
            },
            "imports": {
              "count": 1.0
            },
            "sections": {
              "count": 2.0,
              "code_size": 2162688.0,
              "entropy_max": 2.67,
              "entropy_mean": 1.39,
              "name_entropy": 2.91,
              "writable_count": 0.0,
              "executable_count": 1.0,
              "nonstandard_count": 0.0,
              "executable_writable_count": 0.0
            },
            "dependencies": {
              "count": 1.0
            }
          },
          "s": [
            [
              77,
              "u8",
              "!This program cannot be run in DOS mode."
            ],
            [
              376,
              "u8",
              ".text"
            ],
            [
              3116,
              "u8",
              "BSJB"
            ],
            [
              6704,
              "u8",
              "\u003cModule\u003e"
            ],
            [
              6713,
              "u8",
              "System.Web"
            ],
            [
              6724,
              "u8",
              "mscorlib"
            ],
            [
              6733,
              "u8",
              "System.Collections.Generic"
            ],
            [
              6760,
              "u8",
              "Microsoft.VisualBasic"
            ],
            [
              6786,
              "u8",
              "CompareMethod"
            ],
            [
              6800,
              "u8",
              "Replace"
            ],
            [
              6808,
              "u8",
              "WeakReference"
            ],
            [
              6822,
              "u8",
              "Type"
            ],
            [
              6827,
              "u8",
              "ToByte"
            ],
            [
              6834,
              "u8",
              "GetObjectValue"
            ],
            [
              6849,
              "u8",
              "LateBinding"
            ],
            [
              6861,
              "u8",
              "ToString"
            ],
            [
              6870,
              "u8",
              "get_Length"
            ],
            [
              6881,
              "u8",
              "LateCall"
            ],
            [
              6890,
              "u8",
              "System"
            ],
            [
              6897,
              "u8",
              "AppDomain"
            ],
            [
              6907,
              "u8",
              "get_CurrentDomain"
            ],
            [
              7006,
              "u8",
              ".zip"
            ],
            [
              7011,
              "u8",
              "Char"
            ],
            [
              7016,
              "u8",
              "XmlSiteMapProvider"
            ],
            [
              7035,
              "u8",
              "System.Resources.ResourceManager"
            ],
            [
              7068,
              "u8",
              ".ctor"
            ],
            [
              7074,
              "u8",
              ".cctor"
            ],
            [
              7081,
              "u8",
              "Microsoft.VisualBasic.CompilerServices"
            ],
            [
              7120,
              "u8",
              "System.Runtime.CompilerServices"
            ],
            [
              7152,
              "u8",
              "System.Resources"
            ],
            [
              7169,
              "u8",
              "Strings"
            ],
            [
              7177,
              "u8",
              "Conversions"
            ],
            [
              7189,
              "u8",
              "get_Chars"
            ],
            [
              7199,
              "u8",
              "RuntimeHelpers"
            ],
            [
              7214,
              "u8",
              "Format"
            ],
            [
              7221,
              "u8",
              "Object"
            ],
            [
              7228,
              "u8",
              "LateGet"
            ],
            [
              7236,
              "u8",
              "System.Net"
            ],
            [
              7247,
              "u8",
              "Split"
            ],
            [
              7253,
              "u8",
              "MsgBoxResult"
            ],
            [
              7266,
              "u8",
              "DnsEndPoint"
            ],
            [
              7278,
              "u8",
              "ToArray"
            ],
            [
              2162686,
              "u8",
              "mscoree.dll"
            ],
            [
              2163778,
              "u8",
              "N0L0"
            ],
            [
              2164412,
              "u8",
              "201220220448Z"
            ],
            [
              2164427,
              "u8",
              "211220220448Z0"
            ],
            [
              2165103,
              "u8",
              "C0A0"
            ],
            [
              2166333,
              "u8",
              "20201220220449Z"
            ],
            [
              2166381,
              "u8",
              "Greater Manchester1"
            ],
            [
              2166410,
              "u8",
              "Salford1"
            ],
            [
              2166428,
              "u8",
              "Sectigo Limited1,0*"
            ],
            [
              2166453,
              "u8",
              "#Sectigo RSA Time Stamping Signer #2"
            ],
            [
              2166613,
              "u8",
              "Sectigo Limited1%0#"
            ],
            [
              2166639,
              "u8",
              "Sectigo RSA Time Stamping CA0"
            ],
            [
              2166686,
              "u8",
              "320122235959Z0"
            ],
            [
              2166798,
              "u8",
              "#Sectigo RSA Time Stamping Signer #20"
            ],
            [
              2167317,
              "u8",
              "vIhb"
            ],
            [
              2167518,
              "u8",
              "90705"
            ],
            [
              2167553,
              "u8",
              "https://sectigo.com/CPS0D"
            ],
            [
              2167594,
              "u8",
              "3http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t"
            ],
            [
              2167675,
              "u8",
              "3http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#"
            ],
            [
              2167741,
              "u8",
              "http://ocsp.sectigo.com0"
            ],
            [
              2167837,
              "u8",
              "WUpKN"
            ],
            [
              2168369,
              "u8",
              "New Jersey1"
            ],
            [
              2168390,
              "u8",
              "Jersey City1"
            ],
            [
              2168412,
              "u8",
              "The USERTRUST Network1.0,"
            ],
            [
              2168443,
              "u8",
              "%USERTrust RSA Certification Authority0"
            ],
            [
              2168485,
              "u8",
              "190502000000Z"
            ],
            [
              2169346,
              "u8",
              "I0G0E"
            ],
            [
              2169356,
              "u8",
              "?http://crl.usertrust.com/USERTrustRSACertificationAuthority.crl0v"
            ],
            [
              2169449,
              "u8",
              "3http://crt.usertrust.com/USERTrustRSAAddTrustCA.crt0%"
            ],
            [
              2169515,
              "u8",
              "http://ocsp.usertrust.com0"
            ],
            [
              2169718,
              "u8",
              "mAmg"
            ],
            [
              2170185,
              "u8",
              "Sectigo RSA Time Stamping CA"
            ],
            [
              2170558,
              "u8",
              "%USERTrust RSA Certification Authority"
            ]
          ],
          "v": {
            "file.stem": "abd8fcadf68652ae4f26ce90b69c70ffd76106a4a27afb8e86efb57b18d9d3cc",
            "pe.imphash": "f34d5f2d4577ed6d9ceec516c1f5a744",
            "pe.machine": "i386",
            "pe.subsystem": "windows_gui",
            "pe.timestamp": 1608501888,
            "file.basename": "abd8fcadf68652ae4f26ce90b69c70ffd76106a4a27afb8e86efb57b18d9d3cc.exe",
            "pe.image_base": 4194304,
            "pe.image_size": 2179072,
            "pe.machine_id": 332,
            "pe.os_version": "4.0",
            "pe.entry_point": 2170382,
            "pe.headers_size": 512,
            "pe.entry_section": ".text",
            "pe.subsystem_raw": 2,
            "pe.clr.is_il_only": 1,
            "pe.file_alignment": 512,
            "pe.cert_table_size": 7440,
            "pe.image_hash.sha1": "9d49bdc73652960005aacb3e1a01a55aacb74d52",
            "pe.image_hash.sha256": "4c449dc64034fcc5ba9da0592c2ba074f6ec8a7ef78ad1b6e594b0f5b30bc4e0",
            "pe.image_hash.sha384": "7d206936704fae3678f4295a6fd89c59046d0866339d7608854d1d8340b2f9d0e0ba25ed1ae4820aeaf22ff4d3220ae1",
            "pe.image_hash.sha512": "1a85fa172831270081f0c61fa92ed755203db36d8a3ce2d8529df039d44473913a0bfec060be263c6b3259987957de140a1eda041f7970d05d05f496ed8354c4",
            "pe.section_alignment": 8192,
            "pe.subsystem_version": "4.0",
            "pe.characteristics[0]": "executable_image",
            "pe.characteristics[1]": "32bit_machine",
            "pe.characteristics_raw": 258,
            "pe.clr.runtime_version": "2.5",
            "pe.linker_major_version": 11,
            "pe.signatures[0].issuer": "C=?????????????????,ST=尺吉尺娜吉尺儿儿儿尺В娜尺儿尺娜吉贝В娜娜В吉贝儿贝,L=斯伊斯伊伊伊克伊伊Е提提Е斯提伊伊提Е,TITLE=维КК维Г维维维维伊维贼Г维维К伊К维К西西ГК西,EMAIL=???????????????????????,OU=艾贼艾贼吾吉吾吉吉艾艾贼吾贼艾吉贼艾艾艾贼吉艾吉吉,O=吉吾吾吾弗吾弗吾吉弗斯弗吉,CN=贝娜艾艾贝贝伊艾贝Х贝艾娜贝艾艾艾艾",
            "pe.signatures[0].serial": "0098e2b00c4e47e94d626ad2f3827dd76a",
            "pe.signatures[0].subject": "C=?????????????????,ST=尺吉尺娜吉尺儿儿儿尺В娜尺儿尺娜吉贝В娜娜В吉贝儿贝,L=斯伊斯伊伊伊克伊伊Е提提Е斯提伊伊提Е,TITLE=维КК维Г维维维维伊维贼Г维维К伊К维К西西ГК西,EMAIL=???????????????????????,OU=艾贼艾贼吾吉吾吉吉艾艾贼吾贼艾吉贼艾艾艾贼吉艾吉吉,O=吉吾吾吾弗吾弗吾吉弗斯弗吉,CN=贝娜艾艾贝贝伊艾贝Х贝艾娜贝艾艾艾艾",
            "pe.dll_characteristics[0]": "dynamic_base",
            "pe.dll_characteristics[1]": "nx_compat",
            "pe.dll_characteristics[2]": "no_seh",
            "pe.dll_characteristics[3]": "terminal_server_aware",
            "pe.signatures[0].verified": true,
            "pe.data_directories[0].rva": 2170304,
            "pe.data_directories[1].rva": 2163712,
            "pe.data_directories[2].rva": 2170880,
            "pe.data_directories[3].rva": 8192,
            "pe.data_directories[4].rva": 8200,
            "pe.dll_characteristics_raw": 34112,
            "pe.number_of_rva_and_sizes": 16,
            "pe.signatures[0].not_after": "2021-12-20T22:04:48Z",
            "pe.data_directories[0].name": "import",
            "pe.data_directories[0].size": 75,
            "pe.data_directories[1].name": "certificate",
            "pe.data_directories[1].size": 7440,
            "pe.data_directories[2].name": "base_relocation",
            "pe.data_directories[2].size": 12,
            "pe.data_directories[3].name": "iat",
            "pe.data_directories[3].size": 8,
            "pe.data_directories[4].name": "clr_runtime_header",
            "pe.data_directories[4].size": 72,
            "pe.signatures[0].not_before": "2020-12-20T22:04:48Z",
            "pe.signatures[0].self_issued": true,
            "pe.coff.dos_header_pe_pointer": 128,
            "pe.base_relocations.block_count": 1,
            "pe.base_relocations.entry_count": 1,
            "pe.signatures[0].thumbprint_sha1": "1d54c7ce05df8858c5356c81db2ada2e0413acb7",
            "pe.base_relocations.padding_count": 1,
            "pe.signatures[0].cert_chain_depth": 1,
            "pe.signatures[0].digest_algorithm": "sha256",
            "pe.signatures[0].eku_code_signing": true,
            "pe.signatures[0].signature_digest": "4c449dc64034fcc5ba9da0592c2ba074f6ec8a7ef78ad1b6e594b0f5b30bc4e0",
            "pe.signatures[0].thumbprint_sha256": "6fae9f791c4232e66ee1791f630525904e8e76e9939991535cfea9db54d3f5a7",
            "pe.signatures[0].signature_algorithm": "sha256WithRSAEncryption",
            "pe.signatures[0].signature_digest_algorithm": "sha256"
          },
          "id": "pe",
          "sc": [
            [
              ".text",
              512,
              2162688,
              2.67,
              "r-x"
            ],
            [
              ".reloc",
              2163200,
              512,
              0.1,
              "r--"
            ]
          ]
        },
        "id": 0,
        "sz": 2171152,
        "ts": [
          {
            "c": 1.0,
            "d": ".NET assembly detected via BSJB CLR metadata signature",
            "e": [
              "BSJB at offset 0xc2c"
            ],
            "i": "metadata/dotnet/bsjb-signature",
            "l": 2,
            "el": [
              "0xc2c"
            ]
          },
          {
            "c": 1.0,
            "d": "Authenticode chain CN: 贝娜艾艾贝贝伊艾贝Х贝艾娜贝艾艾艾艾",
            "e": [
              "贝娜艾艾贝贝伊艾贝Х贝艾娜贝艾艾艾艾"
            ],
            "i": "metadata/signed/unknown::贝娜艾艾贝贝伊艾贝х贝艾娜贝艾艾艾艾",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "Signed by 吉吾吾吾弗吾弗吾吉弗斯弗吉",
            "e": [
              "吉吾吾吾弗吾弗吾吉弗斯弗吉"
            ],
            "i": "metadata/signed/leaf::吉吾吾吾弗吾弗吾吉弗斯弗吉",
            "l": 3
          },
          {
            "c": 1.0,
            "d": "PE checksum matches computed value",
            "e": [
              "pe.checksum_valid = 1.00"
            ],
            "i": "metadata/binary/layout::pe-checksum-valid",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Binary has 1000 or more strings",
            "e": [
              "binary.string_count = 36710.00"
            ],
            "i": "metadata/binary/metrics/threshold::string-count-1000-plus",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "ASLR enabled (DYNAMIC_BASE)",
            "e": [
              "[dynamic_base, nx_compat, no_seh, terminal_server_aware]"
            ],
            "i": "metadata/hardening/mitigation::pe-aslr",
            "l": 2,
            "el": [
              "value:pe.dll_characteristics"
            ]
          },
          {
            "c": 1.0,
            "d": "Binary is 500KB+",
            "e": [
              "abd8fcadf68652ae4f26ce90b69c70ffd76106a4a27afb8e86efb57b18d9d3cc.exe"
            ],
            "i": "metadata/binary/metrics/threshold::large-binary-500k",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "PE Authenticode signature verified metadata",
            "e": [
              "true"
            ],
            "i": "metadata/signed/certificate::pe-signature-verified-kv",
            "l": 2,
            "el": [
              "value:pe.signatures[0].verified"
            ]
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "High plaintext string count",
            "e": [
              "binary.string_count = 36710.00"
            ],
            "i": "objectives/anti-static/pack/polymorphic::high-string-count-2000",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "PE has under ten imports",
            "e": [
              "imports.count = 1.00"
            ],
            "i": "objectives/anti-static/pack/runtime::pe-import-count-under-10",
            "l": 1
          },
          {
            "c": 0.949999988079071,
            "d": "PE has exactly two sections",
            "e": [
              "sections.count = 2.00"
            ],
            "i": "well-known/malware/virus/virlock::two-section-layout",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "PE import table has exactly one entry",
            "e": [
              "imports.count = 1.00"
            ],
            "i": "metadata/binary/symbols/imports::single-import-raw",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.699999988079071,
            "d": "Code section dominates file layout",
            "e": [
              "binary.largest_section_ratio = 1.00"
            ],
            "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 1.0,
            "d": "PE binary has trailing overlay data",
            "e": [
              "binary.has_overlay = 1.00"
            ],
            "i": "metadata/binary/layout::has-overlay",
            "l": 3
          },
          {
            "c": 1.0,
            "d": "NO_SEH (SafeSEH not used)",
            "e": [
              "[dynamic_base, nx_compat, no_seh, terminal_server_aware]"
            ],
            "i": "metadata/hardening/mitigation::pe-no-seh",
            "l": 2,
            "el": [
              "value:pe.dll_characteristics"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "PE .reloc section presence",
            "e": [
              ".reloc"
            ],
            "i": "metadata/binary/section/names::reloc-section-presence",
            "l": 2
          },
          {
            "c": 0.6499999761581421,
            "d": "AppDomain class token",
            "e": [
              "AppDomain"
            ],
            "i": "objectives/anti-static/obfuscation/reflection/invoke::appdomain-class-token",
            "l": 1,
            "el": [
              "0x1af1"
            ]
          },
          {
            "c": 1.0,
            "d": ".NET Metadata Root (BSJB)",
            "e": [
              "BSJB"
            ],
            "i": "metadata/binary/framework::dotnet-metadata",
            "l": 2
          },
          {
            "c": 0.8500000238418579,
            "d": "Visual Basic runtime reference",
            "e": [
              "Microsoft.VisualBasic.CompilerServices",
              "Microsoft.VisualBasic"
            ],
            "i": "metadata/lang/compiler/managed::visual-basic-runtime",
            "l": 2,
            "el": [
              "0x1ba9",
              "0x1a68"
            ]
          },
          {
            "a": "T1620",
            "c": 0.949999988079071,
            "d": "mscoree DLL string reference",
            "e": [
              "mscoree.dll"
            ],
            "i": "objectives/anti-static/obfuscation/payload/loader::mscoree-name-anywhere",
            "l": 1,
            "m": "B0032",
            "el": [
              "0x20fffe"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "PE contains many extracted strings",
            "e": [
              "binary.string_count = 36710.00"
            ],
            "i": "metadata/package/quality::high-string-count-pe",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "DEP / NX enabled (NX_COMPAT)",
            "e": [
              "[dynamic_base, nx_compat, no_seh, terminal_server_aware]"
            ],
            "i": "metadata/hardening/mitigation::pe-dep",
            "l": 2,
            "el": [
              "value:pe.dll_characteristics"
            ]
          },
          {
            "c": 0.800000011920929,
            "d": "CompanyName field absent from PE version info",
            "e": [
              "field 'pe.version.company' does not exist"
            ],
            "i": "metadata/binary/anomaly/format::version-info-company-name-absent",
            "l": 1,
            "el": [
              "value:pe.version.company"
            ]
          },
          {
            "a": "T1553.002",
            "c": 0.8500000238418579,
            "d": "PE lacks VS_VERSION_INFO resource",
            "e": [
              "field 'pe.version.file_version' does not exist"
            ],
            "i": "objectives/evasion/masquerade/cert::pe-no-version-info-resource",
            "l": 1,
            "el": [
              "value:pe.version.file_version"
            ]
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "Large PE with exactly two sections",
            "e": [
              "sections.count = 2.00"
            ],
            "i": "objectives/anti-static/obfuscation/payload/section::two-section-pe",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 1.0,
            "d": "File larger than 1MB",
            "e": [
              "abd8fcadf68652ae4f26ce90b69c70ffd76106a4a27afb8e86efb57b18d9d3cc.exe"
            ],
            "i": "metadata/binary/metrics/size::large-file-1mb",
            "l": 2
          },
          {
            "a": "T1036.001",
            "c": 0.8600000143051147,
            "d": "USERTrust certificate string in overlay",
            "e": [
              "The USERTRUST Network1.0,"
            ],
            "i": "objectives/evasion/masquerade/binary::overlay-usertrust-string",
            "l": 1,
            "el": [
              "0x21165c"
            ]
          },
          {
            "c": 0.800000011920929,
            "d": "System namespace reference",
            "e": [
              "System.Net"
            ],
            "i": "metadata/lang/compiler/managed::system-namespace",
            "l": 2,
            "el": [
              "0x1c44"
            ]
          },
          {
            "a": "T1027",
            "c": 0.9399999976158142,
            "d": "Single section occupies nearly all bytes",
            "e": [
              "binary.largest_section_ratio = 1.00"
            ],
            "i": "objectives/anti-static/obfuscation/payload/section::extreme-dominant-section",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.8799999952316284,
            "d": "Native runtime binary is large",
            "e": [
              "abd8fcadf68652ae4f26ce90b69c70ffd76106a4a27afb8e86efb57b18d9d3cc.exe"
            ],
            "i": "metadata/lang/compiler/aot::native-runtime-large-file",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "Binary has 4 or fewer sections",
            "e": [
              "sections.count = 2.00"
            ],
            "i": "objectives/command-and-control/infrastructure/config::max-sections-4",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "File is a compiled binary",
            "e": [
              "abd8fcadf68652ae4f26ce90b69c70ffd76106a4a27afb8e86efb57b18d9d3cc.exe"
            ],
            "i": "metadata/binary/framework::is-binary",
            "l": 1
          },
          {
            "c": 0.6000000238418579,
            "d": "AppDomain.CurrentDomain accessor",
            "e": [
              "get_CurrentDomain"
            ],
            "i": "objectives/anti-static/obfuscation/reflection/invoke::appdomain-currentdomain",
            "l": 1,
            "el": [
              "0x1afb"
            ]
          },
          {
            "c": 0.699999988079071,
            "d": "PE has few sections",
            "e": [
              "sections.count = 2.00"
            ],
            "i": "metadata/binary/layout::legacy-few-sections",
            "l": 2
          },
          {
            "c": 0.699999988079071,
            "d": "PE with six or fewer imports",
            "e": [
              "imports.count = 1.00"
            ],
            "i": "metadata/binary/symbols/imports::pe-imports-max-six",
            "l": 1
          },
          {
            "d": ".dll extension reference",
            "e": [
              ".dll"
            ],
            "i": "micro-behaviors/fs/path/extension::dll-dup",
            "l": 2,
            "el": [
              "0x20fffe"
            ]
          },
          {
            "c": 0.8600000143051147,
            "d": "VB late binding token",
            "e": [
              "LateCall"
            ],
            "i": "objectives/anti-static/obfuscation/reflection/invoke::vb-latecall-token",
            "l": 1,
            "el": [
              "0x1ae1"
            ]
          },
          {
            "a": "T1140",
            "c": 0.8999999761581421,
            "d": "VB LateGet dispatch token",
            "e": [
              "LateGet"
            ],
            "i": "objectives/command-and-control/dropper/staging/embedded::vb-lateget-token",
            "l": 1,
            "m": "B0030",
            "el": [
              "0x1c3c"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "PE standard runtime section",
            "e": [
              ".reloc"
            ],
            "i": "metadata/binary/section/names::pe-runtime-standard-section",
            "l": 1
          },
          {
            "a": "T1027.003",
            "c": 0.7799999713897705,
            "d": ".NET resource manager reference",
            "e": [
              "System.Resources.ResourceManager"
            ],
            "i": "micro-behaviors/data/embedded/payload/image::dotnet-resource-manager-token",
            "l": 1,
            "m": "F0001.006",
            "el": [
              "0x1b7b"
            ]
          },
          {
            "a": "T1562.001",
            "c": 0.949999988079071,
            "d": "Regex component marker",
            "e": [
              "GetObjectValue"
            ],
            "i": "objectives/evasion/indicator-removal/cleanup::motw-removal-stream--rx-3",
            "l": 1,
            "m": "B0047",
            "el": [
              "0x1ab2"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "mscorlib reference",
            "e": [
              "mscorlib"
            ],
            "i": "metadata/lang/compiler/managed::mscorlib",
            "l": 2,
            "el": [
              "0x1a44"
            ]
          },
          {
            "c": 0.699999988079071,
            "d": "PE has many readable strings",
            "e": [
              "binary.string_count = 36710.00"
            ],
            "i": "metadata/binary/layout::many-readable-strings",
            "l": 2
          },
          {
            "a": "T1027",
            "c": 0.8600000143051147,
            "d": "Giant text section dominates PE",
            "e": [
              "binary.largest_section_ratio = 1.00"
            ],
            "i": "objectives/anti-static/obfuscation/payload/camouflage::giant-text-section",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.8999999761581421,
            "d": "PE file larger than 2 MiB",
            "e": [
              "abd8fcadf68652ae4f26ce90b69c70ffd76106a4a27afb8e86efb57b18d9d3cc.exe"
            ],
            "i": "metadata/binary/layout::file-over-2mb",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Binary has 2000+ strings",
            "e": [
              "binary.string_count = 36710.00"
            ],
            "i": "metadata/binary/metrics/threshold::many-strings-2000",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "Regex component marker",
            "e": [
              "ToString",
              "Strings"
            ],
            "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7",
            "l": 1,
            "el": [
              "0x1acd",
              "0x1c01"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "PE standard code/data section",
            "e": [
              ".text"
            ],
            "i": "metadata/binary/section/names::pe-code-data-standard-section",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "Low ratio of sentence-like strings",
            "e": [
              "binary.sentence_string_ratio = 0.00"
            ],
            "i": "metadata/binary/metrics/pe-details::low-sentence-string-ratio",
            "l": 2
          },
          {
            "c": 0.8999999761581421,
            "d": "PE file uses .exe extension",
            "e": [
              "abd8fcadf68652ae4f26ce90b69c70ffd76106a4a27afb8e86efb57b18d9d3cc.exe"
            ],
            "i": "metadata/binary/framework::exe-extension",
            "l": 1
          },
          {
            "a": "T1485",
            "c": 0.8999999761581421,
            "d": "Giant embedded string blob metric",
            "e": [
              "binary.max_string_length = 1118470.00"
            ],
            "i": "objectives/impact/wipe/disk/overwrite::giant-string-blob-metric",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.8600000143051147,
            "d": "Long mixed-case identifiers cluster",
            "e": [
              "SectigoRSATimeStampingCA"
            ],
            "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers",
            "l": 1,
            "m": "B0032",
            "el": [
              "0x21132a"
            ]
          },
          {
            "a": "T1055",
            "c": 0.800000011920929,
            "d": "Executable section with very low entropy",
            "e": [
              ".text (size: 2162688, perms: r-x)"
            ],
            "i": "objectives/anti-static/obfuscation/binary-structure::low-entropy-executable",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "High string count over 1000",
            "e": [
              "binary.string_count = 36710.00"
            ],
            "i": "metadata/binary/metrics/threshold::high-string-count-1000",
            "l": 2
          },
          {
            "a": "T1027",
            "c": 0.8500000238418579,
            "d": "Sparse import table",
            "e": [
              "imports.count = 1.00"
            ],
            "i": "objectives/anti-static/obfuscation/binary-metrics/sparse-imports::low-import-count",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.8399999737739563,
            "d": "Large binary with few DLL dependencies",
            "e": [
              "dependencies.count = 1.00"
            ],
            "i": "metadata/package/metrics::import-count-under-80",
            "l": 2
          },
          {
            "a": "T1027",
            "c": 0.8199999928474426,
            "d": "Packed loader largest section ratio above 0.65",
            "e": [
              "binary.largest_section_ratio = 1.00"
            ],
            "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1027.009",
            "c": 0.550000011920929,
            "d": ".NET resource manager access",
            "e": [
              "ResourceManager"
            ],
            "i": "micro-behaviors/data/embedded/payload/resource::dotnet-resourcemanager",
            "l": 1,
            "el": [
              "0x1b7b"
            ]
          },
          {
            "a": "T1036.005",
            "c": 0.9200000166893005,
            "d": "Regex component marker",
            "e": [
              "binary.string_count = 36710.00"
            ],
            "i": "objectives/evasion/masquerade/version-resource/contradiction::microsoft-cisco-contradiction-cond-1--inline-26190",
            "l": 1
          },
          {
            "c": 1.0,
            "d": ".NET BSJB metadata marker",
            "e": [
              "BSJB"
            ],
            "i": "metadata/binary/framework::bsjb-marker",
            "l": 1
          },
          {
            "c": 0.949999988079071,
            "d": "Filename has EXE extension",
            "e": [
              "abd8fcadf68652ae4f26ce90b69c70ffd76106a4a27afb8e86efb57b18d9d3cc.exe"
            ],
            "i": "objectives/evasion/masquerade/file/double-ext::basename-is-exe",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.8600000143051147,
            "d": "Dominant section for VB6 loader profile",
            "e": [
              "binary.largest_section_ratio = 1.00"
            ],
            "i": "objectives/anti-static/obfuscation/payload/string-sparse::dominant-text-layout-vb6",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1497.001",
            "c": 0.949999988079071,
            "d": "Regex component marker",
            "e": [
              "binary.string_count = 36710.00"
            ],
            "i": "objectives/anti-analysis/vm-detect/vendor::comprehensive-evasion-cond-1--inline-17219",
            "l": 1
          },
          {
            "c": 0.6000000238418579,
            "d": "Single section dominates file (packer)",
            "e": [
              "binary.largest_section_ratio = 1.00"
            ],
            "i": "metadata/binary/metrics/structural::dominant-section",
            "l": 3
          },
          {
            "a": "T1027",
            "d": "Binary is 1MB or larger",
            "e": [
              "abd8fcadf68652ae4f26ce90b69c70ffd76106a4a27afb8e86efb57b18d9d3cc.exe"
            ],
            "i": "objectives/anti-static/obfuscation/binary-metrics/shape::file-size-1m-plus",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1055",
            "c": 0.9200000166893005,
            "d": "Regex component marker",
            "e": [
              "imports.count = 1.00"
            ],
            "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571",
            "l": 1,
            "m": "C0041"
          },
          {
            "a": "T1105",
            "c": 0.800000011920929,
            "d": "Compact PE import table",
            "e": [
              "imports.count = 1.00"
            ],
            "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table",
            "l": 1,
            "m": "E1105"
          },
          {
            "c": 0.8399999737739563,
            "d": "Binary has 80 or fewer imports",
            "e": [
              "imports.count = 1.00"
            ],
            "i": "objectives/anti-static/obfuscation/binary-metrics/imports::max-80-imports",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.9700000286102295,
            "d": "Regex component marker",
            "e": [
              "binary.largest_section_ratio = 1.00"
            ],
            "i": "objectives/anti-static/obfuscation/payload/section::packed-anti-analysis-data-loader-cond-1--inline-29202",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.949999988079071,
            "d": "Regex component marker",
            "e": [
              "binary.largest_section_ratio = 1.00"
            ],
            "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.949999988079071,
            "d": "links mscoree (CorExeMain)",
            "e": [
              "mscoree"
            ],
            "i": "metadata/dylib::mscoree",
            "l": 2,
            "el": [
              "1 symbols"
            ]
          },
          {
            "a": "T1036.005",
            "c": 0.8199999928474426,
            "d": "Low-import PE without dominant resources",
            "e": [
              "imports.count = 1.00"
            ],
            "i": "objectives/evasion/masquerade/version-resource/claim::low-import-pe-without-heavy-rsrc",
            "l": 1
          }
        ],
        "sha": "abd8fcadf68652ae4f26ce90b69c70ffd76106a4a27afb8e86efb57b18d9d3cc",
        "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/2020-12/abd8fcadf68652ae4f26ce90b69c70ffd76106a4a27afb8e86efb57b18d9d3cc.exe",
        "type": "pe"
      }
    ],
    "tv": "ca5ef"
  }
}