{ "ml": { "v": "5", "fs": [ { "id": 0, "prob": 0.8911781907081604, "class": 0, "threshold": 0.9987763166427612 } ], "prob": 0.8911782, "class": 0, "level": 3, "models": [ { "m": "az", "prob": 0.8911782, "class": 0 }, { "m": "az/native", "prob": 0.3472222, "class": 0 }, { "m": "az/pe", "prob": 0.613924, "class": 0 } ], "version": "v17.17", "threshold": 0.9987763, "analyzed_at": "2026-05-31T08:13:24Z" }, "path": "af6e8bc426688ae4926fb61b6f45f70b8608232d4b726bf535ff66dfbeb6c496.exe", "raw": { "v": "5", "fs": [ { "f": "Md₂(Bi₂Si)", "x": 41, "ff": { "m": { "pe": { "checksum": 500944.0, "has_overlay": 1.0, "overlay_end": 462848.0, "overlay_size": 8192.0, "checksum_valid": 1.0, "overlay_offset": 454656.0, "overlay_padding": 12800.0, "computed_checksum": 500944.0, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0 }, "file": { "size": 475136.0, "entropy": 7.01, "size_bytes": 475136.0 }, "binary": { "is_pie": 1.0, "has_overlay": 1.0, "code_entropy": 6.81, "overlay_size": 20480.0, "string_count": 5973.0, "overlay_ratio": 0.04, "overlay_entropy": 5.5, "entropy_variance": 12.98, "avg_string_length": 4.92, "max_string_length": 51.0, "code_to_data_ratio": 1.0, "string_length_stddev": 2.49, "largest_section_ratio": 0.89, "sentence_string_count": 17.0, "sentence_string_ratio": 0.0, "high_entropy_string_count": 0.0 }, "sections": { "count": 2.0, "code_size": 448512.0, "entropy_max": 7.24, "entropy_mean": 3.64, "writable_count": 0.0, "executable_count": 2.0, "nonstandard_count": 2.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 0.0 } }, "s": [ [ 77, "u8", "!This program cannot be run in DOS mode." ], [ 160, "u8", "RichAIg" ], [ 1034, "u8", "UVWATAUAVAWH" ], [ 32794, "u8", "ing..." ], [ 32840, "u8", "MessageTransfer" ], [ 33212, "unicode-escape", "d\\Release\\" ], [ 33237, "u8", ".pdb" ], [ 33264, "u8", "GCTL" ], [ 33296, "u8", ".rdata" ], [ 33312, "u8", ".rdata$voltmd" ], [ 33336, "u8", ".rdata$zzzdbg" ], [ 33360, "u8", ".xdata" ], [ 33376, "u8", ".pdata" ], [ 38675, "u8", "*.1H6X" ], [ 39085, "u8", "037X" ], [ 39657, "u8", "ISdXf" ], [ 40971, "u8", "Ljfo" ], [ 41088, "u8", "ET56" ], [ 42080, "u8", "bAif" ], [ 42275, "u8", "EAQI" ], [ 44393, "u8", "k2pMuf" ], [ 44657, "u8", "/JEdJ" ], [ 45441, "u8", "/46A" ], [ 45620, "u8", "GAQI" ], [ 45659, "u8", "2 ;.AQI" ], [ 45833, "u8", "p3uf" ], [ 46002, "u8", "gOoAQI" ], [ 48963, "u8", "/w8f" ], [ 50059, "u8", "2lLqf" ], [ 50163, "u8", "P3UMZf" ], [ 51044, "u8", "b.gHlf" ], [ 51259, "u8", "M0 4:9" ], [ 52380, "u8", "TAQI" ], [ 52610, "u8", "i0pAQI" ], [ 56255, "u8", "4RNWh" ], [ 57399, "u8", "ej9n" ], [ 57813, "u8", "ugIk" ], [ 57852, "u8", "ca5Opf" ], [ 58848, "u8", "6YQkc" ], [ 59345, "u8", "5QWK" ], [ 59816, "u8", "/G65" ], [ 59855, "u8", "ga4o" ], [ 60237, "u8", "zg5o" ], [ 60537, "u8", "YAQI" ], [ 60595, "u8", "VAQI" ], [ 60689, "u8", "cx7QA" ], [ 61227, "u8", "OEVH" ], [ 62197, "u8", "Lu yf" ], [ 62332, "u8", "GQH5" ], [ 64169, "u8", "0qJvu" ], [ 66466, "u8", "8GR5r" ], [ 66552, "u8", "lGsa5" ], [ 68553, "u8", "nKuf" ], [ 68637, "u8", "095Bt" ], [ 69344, "u8", "MB F;K" ], [ 69488, "u8", "/O73" ], [ 69838, "u8", "6EQkOf" ], [ 70074, "u8", "3d9f" ], [ 70257, "u8", "QBXH" ], [ 70872, "u8", "MOU56e" ], [ 71646, "u8", "cV}[" ], [ 72992, "u8", "DGK5" ], [ 75758, "u8", "eXrn" ], [ 75851, "u8", "HBb6K" ], [ 76587, "u8", "b.gf" ], [ 77267, "u8", "AAQI" ], [ 77988, "u8", "Krew" ], [ 78068, "u8", "4oiHf" ], [ 78554, "u8", "cv}{" ], [ 80571, "u8", "La e:jA" ], [ 81755, "u8", "dCkf" ], [ 82388, "u8", "AHH5" ], [ 82927, "u8", "M0 4" ], [ 84182, "u8", "Mh l" ], [ 84199, "u8", "o.tHyf" ], [ 85261, "u8", "0TJYf" ], [ 85325, "u8", "CZuLf" ], [ 85642, "u8", "IWqRA" ], [ 85666, "u8", "94TnI" ], [ 86562, "u8", "qHxb" ], [ 86674, "u8", "Ilcq7Q" ], [ 86804, "u8", "43N8\"\u003c\u003cA" ], [ 87174, "u8", "Oriw" ], [ 88161, "u8", "m.ru" ], [ 88563, "u8", "G1OX" ], [ 89202, "u8", "wleu" ], [ 91523, "u8", "ecku" ], [ 92028, "u8", "yZ b:g" ], [ 94853, "u8", "IPZtqf" ], [ 96173, "u8", "1BKGeL" ], [ 96260, "u8", "5OGjL" ], [ 96673, "u8", "wZec" ], [ 96958, "u8", "2gLlf" ], [ 97461, "u8", "N3SMX" ], [ 97743, "u8", "lLsfx" ], [ 97795, "u8", "2BLG K" ], [ 97829, "u8", "I{c}" ], [ 99015, "u8", "8TRA" ], [ 99225, "u8", "H2MLRAQI" ], [ 100497, "u8", "/I\t5" ], [ 101337, "u8", "2L9A" ], [ 101533, "u8", "Vqjf" ], [ 101751, "u8", "Keej" ], [ 102430, "u8", "Laff" ], [ 102689, "u8", "R5AQI" ], [ 103138, "u8", "OAjFf" ], [ 104037, "u8", "df8jR" ], [ 104848, "u8", "8FRl5" ], [ 105532, "u8", "Q9XS" ], [ 105576, "u8", "LO S:XT" ], [ 105685, "u8", "ef8jf" ], [ 105866, "u8", "Mf j" ], [ 105944, "u8", "DgAQI" ], [ 107040, "u8", "Ltfyf" ], [ 107052, "u8", "Jkdp" ], [ 109799, "u8", "2BLG K:P" ], [ 110204, "u8", "065P" ], [ 110277, "u8", "SHrsf" ], [ 112981, "u8", "KYsTf" ], [ 113336, "u8", "EGL4UOZ" ], [ 113456, "u8", "]a{f" ], [ 114410, "u8", "aXrjf" ], [ 118602, "u8", "Jhdm" ], [ 119168, "u8", "/F6i" ], [ 119336, "u8", "M2 65N" ], [ 119391, "u8", "/ICdH~M" ], [ 119807, "u8", "Jceh" ], [ 120174, "u8", "p.uf" ], [ 121289, "u8", "@.GHLf" ], [ 121975, "u8", "Lc g" ], [ 122955, "u8", "BYGO" ], [ 123755, "u8", "IAQI" ], [ 124474, "u8", "Lffk" ], [ 124658, "u8", "Mtgy" ], [ 125134, "u8", "Cq]x{" ], [ 125251, "u8", "HAQI" ], [ 125626, "u8", "sCzf" ], [ 127956, "u8", "REY_" ], [ 128242, "u8", "JoAQI" ], [ 128815, "u8", "JLQfVf" ], [ 129939, "u8", "Mjgo" ], [ 130291, "u8", "K4P3" ], [ 130410, "u8", "f094" ], [ 131486, "u8", "Omir" ], [ 131585, "u8", "jYAQI" ], [ 131683, "u8", "kYAQI" ], [ 133030, "u8", "wN53g" ], [ 133404, "u8", "nCuf" ], [ 133575, "u8", "ACH5" ], [ 133607, "u8", "hWqq" ], [ 134366, "u8", "Gla55" ], [ 134739, "u8", "Xa5Oef" ], [ 134849, "u8", "Lufz" ], [ 135044, "u8", "GSmAQI" ], [ 135460, "u8", "IGPa5f" ], [ 135847, "u8", "5QCD" ], [ 136143, "u8", "zYof" ], [ 136321, "u8", "Me iARI" ], [ 136624, "u8", ".235" ], [ 137141, "u8", "IIdN5u" ], [ 137904, "u8", "\u003e2CLH L" ], [ 139938, "u8", "tYbu" ], [ 139977, "u8", "Yvbu" ], [ 143233, "u8", "t5aOGu" ], [ 143725, "u8", "xK9XTX" ], [ 144569, "u8", "n6vu" ], [ 146422, "u8", "2LGX" ], [ 147850, "u8", "VDmywu" ], [ 149081, "u8", "csQu" ], [ 149097, "u8", "9 DX" ], [ 150746, "u8", "qL3YH" ], [ 152027, "u8", "0oAUI" ], [ 153833, "u8", "tmAQI" ], [ 154571, "u8", "uEWH5X" ], [ 154654, "u8", "o.wf" ], [ 154685, "u8", "EjRH5" ], [ 154939, "u8", "53tz" ], [ 156231, "u8", "V_LW5" ], [ 156526, "u8", "xOAUI" ], [ 158099, "u8", "IJ7H" ], [ 158903, "u8", "2VAQI" ], [ 161257, "u8", "5LAfF" ], [ 165607, "u8", "Tvfdo" ], [ 165938, "u8", "thAQI" ], [ 166761, "unicode-escape", "Cÿo" ], [ 167665, "u8", "NYVDp" ], [ 168030, "u8", "owpeyAQI" ], [ 168845, "u8", "Q.af" ], [ 168990, "u8", "Wtdb" ], [ 169136, "u8", "R5WO" ], [ 169203, "u8", "Rycf" ], [ 169219, "u8", "Qgjf" ], [ 170722, "u8", "0LHH5u" ], [ 171122, "u8", "HXH5" ], [ 171231, "u8", "D:2C LH" ], [ 171375, "u8", "ITBY" ], [ 171597, "u8", "E1LH" ], [ 173471, "u8", "G3NMS" ], [ 174191, "u8", "G5CO" ], [ 175606, "u8", "FAQI" ], [ 175987, "u8", "pN^ df" ], [ 176281, "u8", "76XH" ], [ 176799, "u8", "a1qf" ], [ 177572, "u8", "Zzqf" ], [ 177807, "u8", "a2mf" ], [ 178659, "u8", "jTrb" ], [ 180642, "u8", "a5qy" ], [ 181021, "u8", "Bq0zf" ], [ 181039, "u8", "hUCiH" ], [ 181200, "u8", "RH5O" ], [ 181726, "u8", "UJH5" ], [ 181875, "u8", "WE3H" ], [ 183984, "u8", "9SAI" ], [ 184357, "u8", "zAxf" ], [ 184826, "u8", "vMur" ], [ 185212, "u8", "Aq.z" ], [ 185493, "u8", "OmAQI" ], [ 187315, "u8", "GGH5" ], [ 187554, "u8", "fH5mq" ], [ 187579, "u8", "K3SH" ], [ 187653, "u8", "9H5S" ], [ 187674, "u8", "i4qf" ], [ 187686, "u8", "ri3vH" ], [ 188848, "u8", "F2NLS" ], [ 189873, "u8", "PXFT" ], [ 190532, "u8", "gapo" ], [ 192533, "u8", "SH51" ], [ 192834, "u8", "PF5H" ], [ 193452, "u8", "RAQI" ], [ 193668, "u8", "uUkl" ], [ 194089, "u8", "Uckf" ], [ 194763, "u8", "paxo" ], [ 194947, "u8", "MAUI" ], [ 195198, "u8", "C6K5" ], [ 195506, "u8", "Q3VA" ], [ 196190, "u8", "ZHE5" ], [ 196417, "u8", "V5 R" ], [ 196658, "u8", "BqH2ULZ" ], [ 196686, "u8", "ciQf" ], [ 196777, "u8", "Dm553" ], [ 197325, "u8", "PAQI" ], [ 197813, "u8", "g6of" ], [ 198427, "u8", "0AJFf" ], [ 199279, "u8", "a0h5" ], [ 199750, "u8", "pheWf" ], [ 201321, "u8", "F6NQ" ], [ 201792, "u8", "2\u003eVI" ], [ 203162, "u8", "gX Sf" ], [ 203844, "u8", "OH5eX" ], [ 204131, "u8", "ZH59" ], [ 204371, "u8", "ATIbf" ], [ 205577, "u8", "XHdcif" ], [ 205806, "u8", "mHyf" ], [ 207070, "u8", "Khfm" ], [ 207114, "u8", "f9m5" ], [ 207462, "u8", "MHY6b" ] ], "v": { "file.stem": "af6e8bc426688ae4926fb61b6f45f70b8608232d4b726bf535ff66dfbeb6c496", "pe.machine": "x86_64", "pe.rich.key": 2355579201, "pe.rich.hash": "7bdb15ec340a95b869e10c30c493def2", "pe.subsystem": "windows_cui", "pe.timestamp": 1740718402, "file.basename": "af6e8bc426688ae4926fb61b6f45f70b8608232d4b726bf535ff66dfbeb6c496.exe", "pe.image_base": 5368709120, "pe.image_size": 462848, "pe.machine_id": 34404, "pe.os_version": "6.0", "pe.entry_point": 17792, "pe.headers_size": 1536, "pe.subsystem_raw": 3, "pe.file_alignment": 512, "pe.cert_table_size": 12288, "pe.image_hash.sha1": "e62e8c8534aad8a90f62925ef725c671ca06f3a9", "pe.image_hash.sha256": "322a90b0658df38bae57a6daa3538e6cf1a7c248ae33d62c72f050271b33a132", "pe.image_hash.sha384": "2da7e9b5c647066779f35154230bfa5f9c2f3400e7fbf08c780bbf8a3ec3c6388f0be02274e3ff52ce8ff1b278925304", "pe.image_hash.sha512": "29b4f501d68f64c54e9d7413091e17c8a2b8244bbe4d3c49db5881069ab4f3ce1d4448717cdd49f3bc9de5f9ff4b2927af81d9fb354cb62012ccebf826ba7a4b", "pe.section_alignment": 4096, "pe.subsystem_version": "6.0", "pe.characteristics[0]": "executable_image", "pe.characteristics[1]": "large_address_aware", "pe.characteristics_raw": 34, "pe.linker_major_version": 14, "pe.linker_minor_version": 41, "pe.signatures[0].issuer": "CN=Certum Extended Validation Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL", "pe.signatures[0].serial": "5f737e82330734c32297ef89b72fb607", "build.toolchain.compiler": "msvc", "pe.signatures[0].subject": "CN=Keroro Technology Co.\\, Ltd.,O=Keroro Technology Co.\\, Ltd.,L=Shenzhen,ST=Guangdong,C=CN,SERIALNUMBER=91440300MA5FAR1W6E,1.3.6.1.4.1.311.60.2.1.1=#0c085368656e7a68656e,1.3.6.1.4.1.311.60.2.1.2=#0c094775616e67646f6e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e,BUSINESSCATEGORY=Private Organization", "pe.dll_characteristics[0]": "high_entropy_va", "pe.dll_characteristics[1]": "dynamic_base", "pe.dll_characteristics[2]": "nx_compat", "pe.dll_characteristics[3]": "terminal_server_aware", "pe.signatures[0].verified": true, "pe.data_directories[0].rva": 462848, "pe.dll_characteristics_raw": 33120, "pe.number_of_rva_and_sizes": 16, "pe.signatures[0].not_after": "2026-02-22T07:09:41Z", "pe.data_directories[0].name": "certificate", "pe.data_directories[0].size": 12288, "pe.rich.entries[0].build_id": 265, "pe.rich.entries[1].build_id": 258, "pe.signatures[0].not_before": "2025-02-22T07:09:42Z", "pe.rich.entries[0].use_count": 1, "pe.rich.entries[1].use_count": 1, "pe.coff.dos_header_pe_pointer": 184, "pe.rich.entries[0].product_id": 34120, "pe.rich.entries[1].product_id": 34120, "pe.signatures[0].thumbprint_sha1": "4ce7b99c56d5efe4fce93d71010d53941c3a635a", "pe.signatures[0].cert_chain_depth": 3, "pe.signatures[0].digest_algorithm": "sha256", "pe.signatures[0].eku_code_signing": true, "pe.signatures[0].signature_digest": "e8b265b5dc3a2ec53a84356d7affbb463cf28b623a84e62838c2384001ca52a1", "pe.signatures[0].thumbprint_sha256": "a2e0b7aaa5b7f1ff1c15291f5b08936659a05c7909648bdd8ab8b1b9a71fce40", "pe.signatures[0].signature_algorithm": "sha256WithRSAEncryption", "pe.signatures[0].signature_digest_algorithm": "sha256" }, "id": "pe", "sc": [ [ "", 4096, 26624, 0.04, "r-x" ], [ "", 32768, 421888, 7.24, "r-x" ] ] }, "id": 0, "sz": 475136, "ts": [ { "c": 1.0, "d": "Authenticode chain CN: Keroro Technology Co.\\", "e": [ "Keroro Technology Co.\\" ], "i": "metadata/signed/unknown::keroro-technology-co.\\", "l": 2 }, { "c": 1.0, "d": "Signed by Keroro Technology Co.\\", "e": [ "Keroro Technology Co.\\" ], "i": "metadata/signed/leaf::keroro-technology-co.\\", "l": 3 }, { "c": 0.949999988079071, "d": "Certum EV code-signing chain", "e": [ "/Certum Extended Validation Code Signing 2021 CA0", "/Certum Extended Validation Code Signing 2021 CA" ], "i": "micro-behaviors/data/embedded/certificate::certum-ev-code-signing-chain", "l": 2, "el": [ "0x71770", "0x724ff" ] }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "af6e8bc426688ae4926fb61b6f45f70b8608232d4b726bf535ff66dfbeb6c496.exe" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.699999988079071, "d": "PE has few sections", "e": [ "sections.count = 2.00" ], "i": "metadata/binary/layout::legacy-few-sections", "l": 2 }, { "c": 0.8999999761581421, "d": "PE file uses .exe extension", "e": [ "af6e8bc426688ae4926fb61b6f45f70b8608232d4b726bf535ff66dfbeb6c496.exe" ], "i": "metadata/binary/framework::exe-extension", "l": 1 }, { "c": 1.0, "d": "Binary has 1000 or more strings", "e": [ "binary.string_count = 5973.00" ], "i": "metadata/binary/metrics/threshold::string-count-1000-plus", "l": 2 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 5973.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "a": "T1027", "c": 1.0, "d": "Binary has normal code entropy (\u003e5.5)", "e": [ "binary.code_entropy = 6.81" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::normal-code-entropy", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "High-entropy ASLR (64-bit)", "e": [ "[high_entropy_va, dynamic_base, nx_compat, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-high-entropy-va", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "sections.count = 2.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "c": 0.800000011920929, "d": "CompanyName field absent from PE version info", "e": [ "field 'pe.version.company' does not exist" ], "i": "metadata/binary/anomaly/format::version-info-company-name-absent", "l": 1, "el": [ "value:pe.version.company" ] }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.89" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "PE Authenticode signature verified metadata", "e": [ "true" ], "i": "metadata/signed/certificate::pe-signature-verified-kv", "l": 2, "el": [ "value:pe.signatures[0].verified" ] }, { "c": 0.949999988079071, "d": "Certum CRL distribution URL", "e": [ "http://crl.certum.pl/ctnca.crl0k", "http://crl.certum.pl/ctnca2.crl0l", "(http://subca.crl.certum.pl/ctsca2021.crl0", "0http://cevcsca2021.crl.certum.pl/cevcsca2021.crl0w" ], "i": "micro-behaviors/data/embedded/certificate::certum-crl-url", "l": 2, "el": [ "0x71488", "0x71a57", "0x72cd6", "0x72147" ] }, { "a": "T1027", "c": 0.8999999761581421, "d": "High plaintext string count", "e": [ "binary.string_count = 5973.00" ], "i": "objectives/anti-static/pack/polymorphic::high-string-count-2000", "l": 1 }, { "c": 1.0, "d": "Binary has 2000+ strings", "e": [ "binary.string_count = 5973.00" ], "i": "metadata/binary/metrics/threshold::many-strings-2000", "l": 1 }, { "c": 1.0, "d": "PE binary has trailing overlay data", "e": [ "binary.has_overlay = 1.00" ], "i": "metadata/binary/layout::has-overlay", "l": 3 }, { "c": 1.0, "d": "DEP / NX enabled (NX_COMPAT)", "e": [ "[high_entropy_va, dynamic_base, nx_compat, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-dep", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 1.0, "d": "ASLR enabled (DYNAMIC_BASE)", "e": [ "[high_entropy_va, dynamic_base, nx_compat, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-aslr", "l": 2, "el": [ "value:pe.dll_characteristics" ] }, { "c": 1.0, "d": "PE checksum matches computed value", "e": [ "pe.checksum_valid = 1.00" ], "i": "metadata/binary/layout::pe-checksum-valid", "l": 1 }, { "c": 0.949999988079071, "d": "Certum OCSP responder URL", "e": [ "http://subca.ocsp-certum.com01", "http://subca.ocsp-certum.com02", "http://subca.ocsp-certum.com0", "\"http://cevcsca2021.ocsp-certum.com07" ], "i": "micro-behaviors/data/embedded/certificate::certum-ocsp-url", "l": 2, "el": [ "0x714c4", "0x71a94", "0x72c79", "0x72195" ] }, { "a": "T1553.002", "c": 0.8500000238418579, "d": "PE lacks VS_VERSION_INFO resource", "e": [ "field 'pe.version.file_version' does not exist" ], "i": "objectives/evasion/masquerade/cert::pe-no-version-info-resource", "l": 1, "el": [ "value:pe.version.file_version" ] }, { "c": 0.699999988079071, "d": "High string count over 1000", "e": [ "binary.string_count = 5973.00" ], "i": "metadata/binary/metrics/threshold::high-string-count-1000", "l": 2 }, { "c": 0.8799999952316284, "d": "Large anonymous PE section", "e": [ " (size: 421888)" ], "i": "metadata/binary/resource::large-anonymous-pe-section", "l": 4 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 0.89" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "c": 0.9200000166893005, "d": "Anonymous PE section high entropy", "e": [ " (size: 421888, entropy: 7.24)" ], "i": "metadata/binary/resource::anonymous-pe-section-high-entropy", "l": 4 }, { "a": "T1055", "c": 0.800000011920929, "d": "Executable section with very low entropy", "e": [ " (size: 421888, perms: r-x)" ], "i": "objectives/anti-static/obfuscation/binary-structure::low-entropy-executable", "l": 1 }, { "a": "T1027", "d": "Binary has overlay data", "e": [ "binary.has_overlay = 1.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::has-overlay", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "Filename has EXE extension", "e": [ "af6e8bc426688ae4926fb61b6f45f70b8608232d4b726bf535ff66dfbeb6c496.exe" ], "i": "objectives/evasion/masquerade/file/double-ext::basename-is-exe", "l": 1 }, { "c": 0.6000000238418579, "d": "Very few sections (merged/stripped)", "e": [ "sections.count = 2.00" ], "i": "metadata/binary/metrics/structural::few-sections", "l": 3 }, { "a": "T1027", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.largest_section_ratio = 0.89" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-data-geometry-cond-1--inline-29188", "l": 1, "m": "B0032" } ], "sha": "af6e8bc426688ae4926fb61b6f45f70b8608232d4b726bf535ff66dfbeb6c496", "path": "af6e8bc426688ae4926fb61b6f45f70b8608232d4b726bf535ff66dfbeb6c496.exe", "type": "pe" } ], "tv": "52045" } }