{
  "ml": {
    "v": "5",
    "fs": [
      {
        "id": 0,
        "prob": 0.8251519203186035,
        "class": 0,
        "threshold": 0.9987763166427612
      }
    ],
    "prob": 0.8251519,
    "class": 0,
    "level": 3,
    "models": [
      {
        "m": "az",
        "prob": 0.8251519,
        "class": 0
      },
      {
        "m": "az/native",
        "prob": 0.27968338,
        "class": 0
      },
      {
        "m": "az/pe",
        "prob": 0.014666666,
        "class": 0
      }
    ],
    "version": "v17.17",
    "threshold": 0.9987763,
    "analyzed_at": "2026-05-31T06:23:58Z"
  },
  "path": "ac01c541f3d8d71528ecc3fee4f3ac175a11a225c9bc9cc9453635771862a768.exe",
  "raw": {
    "v": "5",
    "fs": [
      {
        "f": "H(Ds)",
        "x": 4,
        "ff": {
          "i": [
            [
              "kernel32",
              "GetProcAddress"
            ],
            [
              "kernel32",
              "VirtualAlloc"
            ],
            [
              "kernel32",
              "VirtualFree"
            ],
            [
              "kernel32",
              "Sleep"
            ],
            [
              "kernel32",
              "GetFileSize"
            ],
            [
              "kernel32",
              "ReadFile"
            ],
            [
              "kernel32",
              "CloseHandle"
            ],
            [
              "kernel32",
              "LoadLibraryW"
            ],
            [
              "kernel32",
              "GetModuleFileNameW"
            ],
            [
              "kernel32",
              "CreateFileW"
            ]
          ],
          "m": {
            "pe": {
              "checksum": 0.0,
              "checksum_valid": 0.0,
              "checksum_stripped": 1.0,
              "computed_checksum": 48541.0,
              "bss_like_section_count": 0.0,
              "section_overflow_count": 0.0,
              "misaligned_section_count": 0.0,
              "base_relocation_block_count": 1.0,
              "base_relocation_entry_count": 26.0
            },
            "file": {
              "size": 4096.0,
              "entropy": 3.9,
              "size_bytes": 4096.0
            },
            "binary": {
              "is_pie": 1.0,
              "code_entropy": 5.51,
              "string_count": 26.0,
              "entropy_variance": 3.6,
              "avg_string_length": 10.46,
              "max_string_length": 44.0,
              "code_to_data_ratio": 1.0,
              "string_length_stddev": 7.44,
              "largest_section_ratio": 0.38,
              "sentence_string_count": 1.0,
              "sentence_string_ratio": 0.04,
              "high_entropy_string_count": 0.0
            },
            "imports": {
              "count": 10.0
            },
            "sections": {
              "count": 3.0,
              "code_size": 1536.0,
              "entropy_max": 5.51,
              "entropy_mean": 2.98,
              "name_entropy": 3.18,
              "writable_count": 0.0,
              "executable_count": 1.0,
              "nonstandard_count": 0.0,
              "executable_writable_count": 0.0
            },
            "dependencies": {
              "count": 1.0
            }
          },
          "s": [
            [
              77,
              "u8",
              "!This program cannot be run in DOS mode."
            ],
            [
              176,
              "u8",
              "Rich"
            ],
            [
              440,
              "u8",
              ".text"
            ],
            [
              519,
              "u8",
              "@.reloc"
            ],
            [
              2664,
              "u8",
              "GCTL"
            ],
            [
              2716,
              "u8",
              ".rdata"
            ],
            [
              2732,
              "u8",
              ".rdata$zzzdbg"
            ],
            [
              2914,
              "u8",
              "GetProcAddress"
            ],
            [
              2932,
              "u8",
              "VirtualAlloc"
            ],
            [
              2948,
              "u8",
              "VirtualFree"
            ],
            [
              2962,
              "u8",
              "Sleep"
            ],
            [
              2970,
              "u8",
              "GetFileSize"
            ],
            [
              2984,
              "u8",
              "ReadFile"
            ],
            [
              2996,
              "u8",
              "CloseHandle"
            ],
            [
              3010,
              "u8",
              "LoadLibraryW"
            ],
            [
              3026,
              "u8",
              "GetModuleFileNameW"
            ],
            [
              3048,
              "u8",
              "CreateFileW"
            ],
            [
              3060,
              "u8",
              "KERNEL32.dll"
            ]
          ],
          "v": {
            "file.stem": "ac01c541f3d8d71528ecc3fee4f3ac175a11a225c9bc9cc9453635771862a768",
            "pe.imphash": "9eb38642d795cd7c1e2ce5909c1a70fd",
            "pe.machine": "i386",
            "pe.rich.key": 2533698547,
            "pe.rich.hash": "b5f73c216964eea59e53375ee81c7e4e",
            "pe.subsystem": "windows_gui",
            "pe.timestamp": 1595771721,
            "file.basename": "ac01c541f3d8d71528ecc3fee4f3ac175a11a225c9bc9cc9453635771862a768.exe",
            "pe.image_base": 4194304,
            "pe.image_size": 16384,
            "pe.machine_id": 332,
            "pe.os_version": "5.1",
            "pe.entry_point": 4096,
            "pe.headers_size": 1024,
            "pe.entry_section": ".text",
            "pe.subsystem_raw": 2,
            "pe.file_alignment": 512,
            "pe.image_hash.sha1": "c7603a85334d027a9331b8bbeb1d32d50ea880cb",
            "pe.image_hash.sha256": "ac6c4bc22824cf354e8f5459b04e808b06c98aec7ad01e092de9c8ee8ce3c5fe",
            "pe.image_hash.sha384": "3f72f5aa86ecddb144b0f4e5696009b18f7249f57116d4ed76c3fc22bcaf84fc4bdd4c505a8620fd3973f26a1a4084f0",
            "pe.image_hash.sha512": "a507acbd04c5742fb03ad98bf068f5081a2003c3dabfea906f620793db5b7882b2074c09728d4a259ca3bf64863780cb78f96b09190c8e295f1d087879b9658f",
            "pe.section_alignment": 4096,
            "pe.subsystem_version": "5.1",
            "pe.characteristics[0]": "executable_image",
            "pe.characteristics[1]": "32bit_machine",
            "pe.characteristics_raw": 258,
            "pe.linker_major_version": 14,
            "build.toolchain.compiler": "msvc",
            "pe.debug.entries[0].type": "pogo",
            "pe.debug.entries[1].type": "iltcg",
            "pe.dll_characteristics[0]": "dynamic_base",
            "pe.dll_characteristics[1]": "nx_compat",
            "pe.dll_characteristics[2]": "no_seh",
            "pe.dll_characteristics[3]": "terminal_server_aware",
            "pe.data_directories[0].rva": 8460,
            "pe.data_directories[1].rva": 12288,
            "pe.data_directories[2].rva": 8240,
            "pe.data_directories[3].rva": 8192,
            "pe.dll_characteristics_raw": 34112,
            "pe.number_of_rva_and_sizes": 16,
            "pe.data_directories[0].name": "import",
            "pe.data_directories[0].size": 40,
            "pe.data_directories[1].name": "base_relocation",
            "pe.data_directories[1].size": 60,
            "pe.data_directories[2].name": "debug",
            "pe.data_directories[2].size": 56,
            "pe.data_directories[3].name": "iat",
            "pe.data_directories[3].size": 48,
            "pe.debug.entries[0].type_id": 13,
            "pe.debug.entries[1].type_id": 14,
            "pe.rich.entries[0].build_id": 147,
            "pe.rich.entries[1].build_id": 1,
            "pe.rich.entries[2].build_id": 261,
            "pe.rich.entries[3].build_id": 258,
            "pe.rich.entries[0].use_count": 3,
            "pe.rich.entries[1].use_count": 10,
            "pe.rich.entries[2].use_count": 2,
            "pe.rich.entries[3].use_count": 1,
            "pe.coff.dos_header_pe_pointer": 192,
            "pe.rich.entries[0].product_id": 30729,
            "pe.rich.entries[2].product_id": 24215,
            "pe.rich.entries[3].product_id": 24215,
            "pe.debug.entries[0].size_bytes": 164,
            "pe.base_relocations.block_count": 1,
            "pe.base_relocations.entry_count": 26,
            "pe.debug.entries[0].timestamp_unix": 1595771721,
            "pe.debug.entries[1].timestamp_unix": 1595771721
          },
          "id": "pe",
          "sc": [
            [
              ".text",
              1024,
              1536,
              5.51,
              "r-x"
            ],
            [
              ".rdata",
              2560,
              1024,
              2.47,
              "r--"
            ],
            [
              ".reloc",
              3584,
              512,
              0.95,
              "r--"
            ]
          ]
        },
        "id": 0,
        "sz": 4096,
        "ts": [
          {
            "c": 0.8999999761581421,
            "d": "Tiny PE stub footprint",
            "e": [
              "ac01c541f3d8d71528ecc3fee4f3ac175a11a225c9bc9cc9453635771862a768.exe"
            ],
            "i": "well-known/malware/trojan/shellobject/revengerat::tiny-pe-footprint",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "File is a compiled binary",
            "e": [
              "ac01c541f3d8d71528ecc3fee4f3ac175a11a225c9bc9cc9453635771862a768.exe"
            ],
            "i": "metadata/binary/framework::is-binary",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "Get module file path",
            "e": [
              "GetModuleFileNameW"
            ],
            "i": "micro-behaviors/os/module/load::get-module-filename-dup",
            "l": 2,
            "el": [
              "0xbd2"
            ]
          },
          {
            "d": ".dll extension reference",
            "e": [
              ".dll"
            ],
            "i": "micro-behaviors/fs/path/extension::dll-dup",
            "l": 2,
            "el": [
              "0xbf4"
            ]
          },
          {
            "c": 0.699999988079071,
            "d": "GetModuleFileName API call",
            "e": [
              "GetModuleFileNameW"
            ],
            "i": "micro-behaviors/process/info/current::get-module-filename",
            "l": 2,
            "el": [
              "0x2020"
            ]
          },
          {
            "c": 0.699999988079071,
            "d": "PE has few sections",
            "e": [
              "sections.count = 3.00"
            ],
            "i": "metadata/binary/layout::legacy-few-sections",
            "l": 2
          },
          {
            "c": 0.8999999761581421,
            "d": "PE file uses .exe extension",
            "e": [
              "ac01c541f3d8d71528ecc3fee4f3ac175a11a225c9bc9cc9453635771862a768.exe"
            ],
            "i": "metadata/binary/framework::exe-extension",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "Free virtual memory",
            "e": [
              "VirtualFree"
            ],
            "i": "micro-behaviors/mem/protect/modify::virtual-free",
            "l": 2,
            "el": [
              "0x2008"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "CTS CreateFileW import",
            "e": [
              "CreateFileW"
            ],
            "i": "well-known/malware/worm/cts::create-file-w-import",
            "l": 1,
            "el": [
              "0x2024"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "Windows file creation/open API",
            "e": [
              "CreateFileW"
            ],
            "i": "micro-behaviors/fs/file/open::file-create-win",
            "l": 2,
            "el": [
              "0x2024"
            ]
          },
          {
            "a": "T1027",
            "c": 1.0,
            "d": "Binary has normal code entropy (\u003e5.5)",
            "e": [
              "binary.code_entropy = 5.51"
            ],
            "i": "objectives/anti-static/obfuscation/binary-metrics/shape::normal-code-entropy",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.8999999761581421,
            "d": "PE standard code/data section",
            "e": [
              ".text"
            ],
            "i": "metadata/binary/section/names::pe-code-data-standard-section",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "Read data from file handle",
            "e": [
              "ReadFile"
            ],
            "i": "micro-behaviors/fs/file/read::read-file",
            "l": 2,
            "el": [
              "0x2014"
            ]
          },
          {
            "c": 0.8500000238418579,
            "d": "Query current module path",
            "e": [
              "GetModuleFileNameW"
            ],
            "i": "micro-behaviors/fs/path/check::get-module-filename",
            "l": 2,
            "el": [
              "0x2020"
            ]
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "VB6 binary with very few strings",
            "e": [
              "binary.string_count = 26.00"
            ],
            "i": "objectives/anti-static/obfuscation/payload/string-sparse::low-string-count-vb6",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 1.0,
            "d": "Binary has 4 or fewer sections",
            "e": [
              "sections.count = 3.00"
            ],
            "i": "objectives/command-and-control/infrastructure/config::max-sections-4",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "CompanyName field absent from PE version info",
            "e": [
              "field 'pe.version.company' does not exist"
            ],
            "i": "metadata/binary/anomaly/format::version-info-company-name-absent",
            "l": 1,
            "el": [
              "value:pe.version.company"
            ]
          },
          {
            "c": 0.699999988079071,
            "d": "Delay execution",
            "e": [
              "Sleep"
            ],
            "i": "micro-behaviors/time/timing/delay::sleep-dup",
            "l": 2,
            "el": [
              "0x200c"
            ]
          },
          {
            "a": "T1587.001",
            "c": 0.8999999761581421,
            "d": "Allocate virtual memory",
            "e": [
              "VirtualAlloc"
            ],
            "i": "micro-behaviors/mem/protect/modify::virtual-alloc",
            "l": 2,
            "el": [
              "0x2004"
            ]
          },
          {
            "c": 0.6499999761581421,
            "d": "Get file size",
            "e": [
              "GetFileSize"
            ],
            "i": "micro-behaviors/fs/sync/fsync::get-file-size",
            "l": 2,
            "el": [
              "0x2010"
            ]
          },
          {
            "c": 1.0,
            "d": "NO_SEH (SafeSEH not used)",
            "e": [
              "[dynamic_base, nx_compat, no_seh, terminal_server_aware]"
            ],
            "i": "metadata/hardening/mitigation::pe-no-seh",
            "l": 2,
            "el": [
              "value:pe.dll_characteristics"
            ]
          },
          {
            "c": 0.800000011920929,
            "d": "Low-entropy rdata section",
            "e": [
              ".rdata (entropy: 2.47)"
            ],
            "i": "metadata/binary/section/metrics::low-entropy-rdata-section",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "DEP / NX enabled (NX_COMPAT)",
            "e": [
              "[dynamic_base, nx_compat, no_seh, terminal_server_aware]"
            ],
            "i": "metadata/hardening/mitigation::pe-dep",
            "l": 2,
            "el": [
              "value:pe.dll_characteristics"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "PE .reloc section presence",
            "e": [
              ".reloc"
            ],
            "i": "metadata/binary/section/names::reloc-section-presence",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "ASLR enabled (DYNAMIC_BASE)",
            "e": [
              "[dynamic_base, nx_compat, no_seh, terminal_server_aware]"
            ],
            "i": "metadata/hardening/mitigation::pe-aslr",
            "l": 2,
            "el": [
              "value:pe.dll_characteristics"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "Close handle",
            "e": [
              "CloseHandle"
            ],
            "i": "micro-behaviors/process/create/spawn::close-handle-dup",
            "l": 2,
            "el": [
              "0xbb4"
            ]
          },
          {
            "c": 0.8999999761581421,
            "d": "PE standard runtime section",
            "e": [
              ".rdata",
              ".reloc"
            ],
            "i": "metadata/binary/section/names::pe-runtime-standard-section",
            "l": 1
          },
          {
            "d": "Small source file (\u003c=10KB) with 10+ imports",
            "e": [
              "imports.count = 10.00"
            ],
            "i": "metadata/file/text/metrics::script-many-imports-10-small",
            "l": 1
          },
          {
            "a": "T1574.002",
            "c": 0.8999999761581421,
            "d": "Windows GetProcAddress API string",
            "e": [
              "GetProcAddress"
            ],
            "i": "micro-behaviors/dylib/lookup::get-proc-address-text",
            "l": 2,
            "el": [
              "0xb62"
            ]
          },
          {
            "c": 1.0,
            "d": "LoadLibrary symbol",
            "e": [
              "LoadLibraryW"
            ],
            "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym",
            "l": 1,
            "el": [
              "0x201c"
            ]
          },
          {
            "a": "T1553.002",
            "c": 0.8500000238418579,
            "d": "PE lacks VS_VERSION_INFO resource",
            "e": [
              "field 'pe.version.file_version' does not exist"
            ],
            "i": "objectives/evasion/masquerade/cert::pe-no-version-info-resource",
            "l": 1,
            "el": [
              "value:pe.version.file_version"
            ]
          },
          {
            "c": 0.8799999952316284,
            "d": "Small string table footprint",
            "e": [
              "binary.string_count = 26.00"
            ],
            "i": "well-known/malware/trojan/shellobject/revengerat::tiny-string-table",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.8399999737739563,
            "d": "VB6 PE with three sections",
            "e": [
              "sections.count = 3.00"
            ],
            "i": "objectives/anti-static/obfuscation/payload/string-sparse::three-section-vb6-layout",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.8999999761581421,
            "d": "CreateFile API string reference",
            "e": [
              "CreateFile"
            ],
            "i": "micro-behaviors/fs/file/open::createfile-api",
            "l": 2,
            "el": [
              "0xbe8"
            ]
          },
          {
            "a": "T1587.001",
            "c": 0.8999999761581421,
            "d": "VirtualAlloc API string reference",
            "e": [
              "VirtualAlloc"
            ],
            "i": "micro-behaviors/mem/protect/modify::virtual-alloc-string",
            "l": 1,
            "el": [
              "0xb74"
            ]
          },
          {
            "a": "T1129",
            "c": 0.8799999952316284,
            "d": "Dynamic library loading via LoadLibraryW",
            "e": [
              "LoadLibraryW"
            ],
            "i": "micro-behaviors/dylib/load/runtime::load-library-w",
            "l": 3,
            "el": [
              "0x201c"
            ]
          },
          {
            "a": "T1105",
            "c": 0.800000011920929,
            "d": "Compact PE import table",
            "e": [
              "imports.count = 10.00"
            ],
            "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table",
            "l": 1,
            "m": "E1105"
          },
          {
            "a": "T1055",
            "c": 0.9200000166893005,
            "d": "Regex component marker",
            "e": [
              "imports.count = 10.00"
            ],
            "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571",
            "l": 1,
            "m": "C0041"
          },
          {
            "c": 0.949999988079071,
            "d": "Filename has EXE extension",
            "e": [
              "ac01c541f3d8d71528ecc3fee4f3ac175a11a225c9bc9cc9453635771862a768.exe"
            ],
            "i": "objectives/evasion/masquerade/file/double-ext::basename-is-exe",
            "l": 1
          },
          {
            "c": 0.6000000238418579,
            "d": "Very few sections (merged/stripped)",
            "e": [
              "sections.count = 3.00"
            ],
            "i": "metadata/binary/metrics/structural::few-sections",
            "l": 3
          },
          {
            "c": 0.8999999761581421,
            "d": "Resolve exports with GetProcAddress",
            "e": [
              "GetProcAddress"
            ],
            "i": "micro-behaviors/os/module/load::get-proc-address-import",
            "l": 2,
            "el": [
              "0x2000"
            ]
          },
          {
            "a": "T1027",
            "c": 0.8600000143051147,
            "d": "Long mixed-case identifiers cluster",
            "e": [
              "GetModuleFileNameW"
            ],
            "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers",
            "l": 1,
            "m": "B0032",
            "el": [
              "0xbd2"
            ]
          },
          {
            "c": 0.949999988079071,
            "d": "links kernel32 (GetProcAddress, VirtualAlloc, VirtualFree, Sleep, GetFileSize, ... +5 more)",
            "e": [
              "kernel32"
            ],
            "i": "metadata/dylib::kernel32",
            "l": 2,
            "el": [
              "10 symbols"
            ]
          }
        ],
        "sha": "ac01c541f3d8d71528ecc3fee4f3ac175a11a225c9bc9cc9453635771862a768",
        "path": "ac01c541f3d8d71528ecc3fee4f3ac175a11a225c9bc9cc9453635771862a768.exe",
        "type": "pe"
      }
    ],
    "tv": "52045"
  }
}