{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.06094364449381828, "class": 0 } ], "prob": 0.060943644, "class": 0, "models": [ { "m": "az", "prob": 0.060943644, "class": 0 }, { "m": "az/native", "prob": 0.0, "class": 0 }, { "m": "az/pe", "prob": 0.0, "class": 0 } ], "version": "v17.17", "thresholds": [ 0.999503, 0.9998882 ], "analyzed_at": "2026-05-24T03:48:40Z" }, "path": "b0e2b1b073a915fa703025f056d9a5bcead51c287aec7d8fd7242d9497049417.exe", "raw": { "v": "5", "fs": [ { "f": "Md₂(BiSi)", "x": 3, "ff": { "m": { "pe": { "parse_failed": 1.0, "partial_parse": 1.0 }, "file": { "size": 3027880.0, "entropy": 7.96, "size_bytes": 3027880.0 }, "parse": { "error_count": 2.0 }, "binary": { "is_pie": 0.0 } }, "s": [ [ 77, "u8", "!This program cannot be run in DOS mode." ], [ 551, "u8", "@.rsrc" ], [ 591, "u8", "@.idata" ], [ 632, "u8", ".themida" ], [ 672, "u8", ".boot" ], [ 1180, "u8", "Ol1Ylp" ], [ 1187, "u8", "K sLO" ], [ 1648, "u8", "2lBCCl" ], [ 1866, "u8", "rG CU" ], [ 2093, "u8", "mFhqP" ], [ 3621, "u8", "unFhH" ], [ 3986, "u8", "OiOui" ], [ 6357, "u8", "rL@%u.8" ], [ 7035, "u8", "Mkdk" ], [ 9995, "u8", "/2mZ" ], [ 10395, "u8", "Nkdv" ], [ 12298, "u8", "xAPue" ], [ 12427, "u8", "RXx1LL" ], [ 12477, "u8", "FB8W" ], [ 14152, "u8", "/NqQ" ], [ 16204, "u8", "vFS8d" ], [ 16382, "u8", "29 t" ], [ 16795, "u8", "Hmhg" ], [ 16855, "u8", "YVqiT" ], [ 17326, "u8", "VP0px" ], [ 19653, "u8", "x32Er" ], [ 24913, "u8", "gt.v" ], [ 25425, "u8", "G L4" ], [ 27708, "u8", "oc_OO" ], [ 29418, "u8", "zB1xt" ], [ 30926, "u8", "lB1xf" ], [ 32064, "u8", "2u4iqh" ], [ 33132, "u8", "Rezm" ], [ 33727, "u8", "Xgbv" ], [ 34195, "u8", "okv.a" ], [ 34201, "u8", "yig5sy" ], [ 34498, "u8", "z48c" ], [ 34958, "u8", "xLmz" ], [ 36445, "u8", "gqE0b" ], [ 36649, "u8", "33S2vi" ], [ 36661, "u8", "fbCk" ], [ 37979, "u8", "kxW0p" ], [ 38783, "u8", "IQIC" ], [ 39397, "u8", "92WK" ], [ 39838, "u8", "kkWo" ], [ 40565, "u8", "TIbl15" ], [ 41167, "u8", "G.sq" ], [ 43928, "u8", "kpxMG" ], [ 44351, "u8", "cXes" ], [ 46500, "u8", "Hjmw1" ], [ 46595, "u8", "s19f" ], [ 47065, "u8", "7755" ], [ 52904, "u8", "N0N_" ], [ 53350, "u8", "/KHZ" ], [ 53364, "u8", "uM e" ], [ 53989, "u8", "P50G" ], [ 56501, "u8", "p0Meu" ], [ 57212, "u8", "StbMs" ], [ 57443, "u8", "AAF_" ], [ 57758, "u8", "o87p" ], [ 61415, "u8", "kQlCMo" ], [ 65197, "u8", "ftEk" ], [ 66592, "u8", "/j8W" ], [ 68643, "u8", "eQmCC2" ], [ 69021, "u8", "obJtuT" ], [ 71250, "u8", "X8PF" ], [ 73366, "u8", "gzQw" ], [ 74089, "u8", "TU4R" ], [ 74178, "u8", "Qzls" ], [ 75380, "u8", "2LHI" ], [ 75450, "u8", "lHnHM" ], [ 75478, "u8", "BGePF" ], [ 75732, "u8", "Ofxr" ], [ 75837, "u8", "GQcPr" ], [ 76818, "u8", "8qZlhm" ], [ 77859, "u8", "/s{FTHzO" ], [ 78616, "u8", "QX38" ], [ 80924, "u8", "BlRac" ], [ 81443, "u8", "ZJM0" ], [ 81756, "u8", "1v7SS" ], [ 82788, "u8", "IjqDA" ], [ 85245, "u8", "6cRRe" ], [ 85609, "u8", "][\"%s\"" ], [ 86725, "u8", "tMei" ], [ 87708, "u8", "zuaGI" ], [ 88698, "u8", "582t" ], [ 90633, "u8", "7f@0\u003c\u003c" ], [ 91362, "u8", "MQUtF" ], [ 94624, "u8", "G2_B" ], [ 95738, "u8", "07 O" ], [ 98234, "u8", "x8eu" ], [ 99209, "u8", "NnSWU" ], [ 99738, "u8", "THHkZd" ], [ 99799, "u8", "LJ7ajI" ], [ 100131, "u8", "KB63" ], [ 100218, "u8", "Q/3\u003cQ73DQ?3LV" ], [ 101773, "u8", "VWFS" ], [ 102915, "u8", "K950" ], [ 103022, "u8", "wUg6Yow" ], [ 103359, "u8", "kMnm" ], [ 105326, "u8", "KBkZeb" ], [ 106421, "u8", "p0c3" ], [ 106680, "u8", "S4Hrk" ], [ 108169, "u8", "O2TK" ], [ 110378, "u8", "/uHpt0P" ], [ 110849, "u8", "M442yG" ], [ 111761, "u8", "fPJKp" ], [ 113835, "u8", "HKDI" ], [ 114486, "u8", "htg-S/" ], [ 115394, "u8", "/GCw" ], [ 116028, "u8", "HlCUb3" ], [ 117617, "u8", "vNPle4" ], [ 118836, "u8", "3S67h" ], [ 120559, "u8", "JJ5b1" ], [ 122217, "u8", "-qHM+ r" ], [ 122469, "u8", "UUKH" ], [ 122795, "u8", "xaIQo" ], [ 124825, "u8", "(]in" ], [ 125410, "u8", "b2\u003e*" ], [ 126000, "u8", "hiOL8" ], [ 126548, "u8", "Rtrt" ], [ 126953, "u8", "DROK" ], [ 127658, "u8", "8VCer" ], [ 127810, "u8", "oSg95" ], [ 128161, "u8", "X~2\u003e1" ], [ 128897, "u8", "U59_" ], [ 132417, "u8", "TRHK" ], [ 133095, "u8", "Phdrq" ], [ 133846, "u8", "Nuwu" ], [ 133880, "u8", "eu%.wr" ], [ 134617, "u8", "yS3evw" ], [ 135324, "u8", "Wryc3" ], [ 135869, "u8", "nr2Ac" ], [ 136724, "u8", "Upw5l" ], [ 136892, "u8", "quJ8E" ], [ 137908, "u8", "pyJq" ], [ 138892, "u8", "8fYyd" ], [ 139860, "u8", "LvHRGA" ], [ 140331, "u8", "q7ta7" ], [ 140963, "u8", "Xh6KuHP9" ], [ 145980, "u8", "rr6CR" ], [ 146035, "u8", "LJ7aA" ], [ 147686, "u8", "lDBOoG" ], [ 148007, "u8", "VMLD" ], [ 148992, "u8", "/xtx" ], [ 151227, "u8", "NVZUmU" ], [ 151478, "u8", "bu1p" ], [ 151505, "u8", "102x" ], [ 154304, "u8", "2\u003em0" ], [ 155071, "u8", "wg{]" ], [ 156053, "u8", "x81m" ], [ 161429, "u8", "Adfi" ], [ 162047, "u8", "2ockmwx" ], [ 162856, "u8", "MALNq" ], [ 163807, "u8", "SKS6" ], [ 166790, "u8", "/9jX" ], [ 168667, "u8", "XB_P" ], [ 170251, "u8", "UTB9" ], [ 170878, "u8", "gWQ7B" ], [ 176526, "u8", "ZDMU" ], [ 176627, "u8", "OBI9" ], [ 179332, "u8", "o2i1" ], [ 180323, "u8", "1QuqZ" ], [ 187503, "u8", "dg6E8" ], [ 188300, "u8", "nkYl" ], [ 189226, "u8", "atpe" ], [ 191632, "u8", "vD.n" ], [ 192224, "u8", "V5Orv" ], [ 192375, "u8", "8L8EM" ], [ 193953, "u8", "oEty" ], [ 196712, "u8", "crzH0" ], [ 198400, "u8", "lMcw" ], [ 198977, "u8", "t2OxjE" ], [ 199017, "u8", "fExs" ], [ 201207, "u8", "kVUS6" ], [ 202376, "u8", "v9utE" ], [ 203199, "u8", "Zfdm" ], [ 203853, "u8", "eDoy8" ], [ 206839, "u8", "IHDR" ], [ 206891, "u8", "DH4J" ], [ 206898, "u8", "8g0j" ], [ 206963, "u8", "SEuuW" ], [ 209007, "u8", "3b8x" ], [ 212114, "u8", "T4J2" ], [ 214540, "u8", "jcSo" ], [ 215013, "u8", "RJEQ" ], [ 215470, "u8", "bWws" ], [ 217160, "u8", "oqQk" ], [ 218459, "u8", "hORsq0" ], [ 219419, "u8", "c7Ece" ], [ 220026, "u8", "d0ma" ], [ 221890, "u8", "cpzFb" ], [ 223336, "u8", "QLJBO" ], [ 223672, "u8", "FX3gT" ], [ 224987, "u8", "Qhkv" ], [ 228195, "u8", ".uuc" ], [ 229202, "u8", "IaZYP" ], [ 230779, "u8", "MPBL" ], [ 231308, "u8", "KEP3" ], [ 233039, "u8", "/\tPv" ], [ 234419, "u8", "VfFcp" ], [ 235956, "u8", "UMR0" ], [ 238943, "u8", "Xrx U" ], [ 243876, "u8", "/oy=W\tN\u003ezX" ], [ 245102, "u8", "2\u003e;YH" ], [ 246448, "u8", "7SD7qT" ], [ 247642, "u8", "WBXM" ], [ 248136, "u8", "/BcM" ], [ 251022, "u8", "X tWFy" ], [ 251558, "u8", "9Sjjh" ], [ 251678, "u8", "IrSZW" ], [ 252190, "u8", "nbFGIk" ], [ 253222, "u8", "isB65" ], [ 259483, "u8", "V6SI" ], [ 261121, "u8", "Aufk" ], [ 261590, "u8", "Hprt" ], [ 264338, "u8", "vij]h.[" ], [ 270979, "u8", "haaa" ], [ 271736, "u8", "sNmr" ], [ 272725, "u8", "IEND" ], [ 277137, "u8", "A8Yeg" ], [ 277371, "u8", "dqq1YZZ" ], [ 277427, "u8", "09pi" ], [ 279180, "u8", "MQDU" ], [ 279445, "u8", "o4z8" ], [ 282457, "u8", "EEnkm" ], [ 282528, "u8", "DnPLu" ], [ 284491, "u8", "UFcBj" ], [ 285342, "u8", "6M696q" ], [ 286890, "u8", "kTai" ], [ 289161, "u8", "p10FK" ], [ 291543, "u8", "sNwl" ], [ 294408, "u8", "jNFrY" ], [ 299125, "u8", "WMZQ" ], [ 302146, "wide", "VS_VERSION_INFO" ], [ 302238, "wide", "StringFileInfo" ], [ 302298, "wide", "InternalName" ], [ 302324, "wide", "guacd.exe" ], [ 302350, "wide", "CompanyName" ], [ 302376, "wide", "Apache Software Foundation" ], [ 302438, "wide", "ProductName" ], [ 302464, "wide", "Apache Guacamole" ], [ 302506, "wide", "LegalCopyright" ], [ 302536, "wide", "© 2020-2026 Apache Software Foundation. All rights reserved." ], [ 302666, "wide", "Comments" ], [ 302684, "wide", "Apache Guacamole Remote Desktop" ], [ 302754, "wide", "ProductVersion" ], [ 302810, "wide", "OriginalFilename" ], [ 302870, "wide", "FileVersion" ], [ 302930, "wide", "FileDescription" ], [ 303034, "wide", "VarFileInfo" ], [ 303066, "wide", "Translation" ], [ 303104, "u8", "kernel32.dll" ], [ 303119, "u8", "GetModuleHandleA" ], [ 303136, "u8", "USER32.dll" ], [ 303149, "u8", "IsIconic" ] ], "v": { "pe.machine": "x86_64", "pe.subsystem": "windows_gui", "pe.timestamp": 1611875385, "pe.image_base": 5368709120, "pe.image_size": 7487488, "pe.machine_id": 34404, "pe.os_version": "6.0", "pe.entry_point": 4767832, "pe.headers_size": 1024, "pe.partial_parse": true, "pe.subsystem_raw": 2, "pe.file_alignment": 512, "pe.cert_table_size": 7080, "pe.section_alignment": 4096, "pe.subsystem_version": "6.0", "pe.characteristics[0]": "executable_image", "pe.characteristics[1]": "large_address_aware", "pe.characteristics_raw": 34, "pe.linker_major_version": 14, "pe.linker_minor_version": 29, "pe.signatures[0].issuer": "CN=Riot Games\\, Inc.", "pe.signatures[0].serial": "397b46f5ea63568745c1dab8ffc24101", "pe.signatures[0].subject": "CN=Riot Games\\, Inc.", "pe.dll_characteristics[0]": "high_entropy_va", "pe.dll_characteristics[1]": "terminal_server_aware", "pe.signatures[0].verified": true, "pe.dll_characteristics_raw": 32800, "pe.number_of_rva_and_sizes": 16, "pe.signatures[0].not_after": "2030-05-18T06:56:21Z", "pe.signatures[0].not_before": "2026-05-18T06:46:21Z", "pe.signatures[0].self_issued": true, "pe.coff.dos_header_pe_pointer": 128, "pe.signatures[0].thumbprint_sha1": "ff206a010b71dea57510dfa5327e81879134500b", "pe.signatures[0].cert_chain_depth": 4, "pe.signatures[0].digest_algorithm": "sha256", "pe.signatures[0].eku_code_signing": true, "pe.signatures[0].signature_digest": "7fd355d254fc07dfd6959809c0903243b01ab72428fab4e0267ce9e720ff4961", "pe.signatures[0].thumbprint_sha256": "2e38adedd224e84fdd5a478abf178493e501be76edc41f83741c225c32ea5875", "pe.signatures[0].signature_algorithm": "sha256WithRSAEncryption", "pe.signatures[0].signature_digest_algorithm": "sha256" }, "er": [ [ "malformed", "pe-parse" ], [ "fallback", "pe-parse" ] ], "id": "pe" }, "id": 0, "sz": 3027880, "ts": [ { "a": "T1027", "c": 0.30000001192092896, "d": "PE parsed with header-only fallback (downstream walker failed)", "e": [ "PE parsed with header-only fallback (downstream walker failed)" ], "i": "objectives/anti-analysis/pe-tampering/corrupted-header", "l": 2, "m": "B0001" }, { "c": 1.0, "d": "Authenticode chain CN: Riot Games\\", "e": [ "Riot Games\\" ], "i": "metadata/signed/unknown::riot-games\\", "l": 2 }, { "c": 1.0, "d": "Signed by Riot Games\\", "e": [ "Riot Games\\" ], "i": "metadata/signed/leaf::riot-games\\", "l": 3 }, { "c": 1.0, "d": "Binary is 500KB+", "e": [ "b0e2b1b073a915fa703025f056d9a5bcead51c287aec7d8fd7242d9497049417.exe" ], "i": "metadata/binary/metrics/threshold::large-binary-500k", "l": 1 }, { "c": 1.0, "d": "Reference to GDI32.dll", "e": [ "GDI32.dll" ], "i": "micro-behaviors/os/module/load::gdi32-dll-reference", "l": 2 }, { "c": 0.8999999761581421, "d": "PE file uses .exe extension", "e": [ "b0e2b1b073a915fa703025f056d9a5bcead51c287aec7d8fd7242d9497049417.exe" ], "i": "metadata/binary/framework::exe-extension", "l": 1 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "StringFileInfo" ], "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7", "l": 1 }, { "c": 1.0, "d": "High-entropy ASLR (64-bit)", "e": [ "[high_entropy_va, terminal_server_aware]" ], "i": "metadata/hardening/mitigation::pe-high-entropy-va", "l": 2 }, { "c": 1.0, "d": "File larger than 1MB", "e": [ "b0e2b1b073a915fa703025f056d9a5bcead51c287aec7d8fd7242d9497049417.exe" ], "i": "metadata/binary/metrics/size::large-file-1mb", "l": 2 }, { "c": 1.0, "d": "PE Authenticode signature verified metadata", "e": [ "true" ], "i": "metadata/signed/certificate::pe-signature-verified-kv", "l": 2 }, { "c": 0.8999999761581421, "d": "PE file larger than 2 MiB", "e": [ "b0e2b1b073a915fa703025f056d9a5bcead51c287aec7d8fd7242d9497049417.exe" ], "i": "metadata/binary/layout::file-over-2mb", "l": 1 }, { "c": 0.800000011920929, "d": "CompanyName field absent from PE version info", "e": [ "field 'pe.version.company' does not exist" ], "i": "metadata/binary/anomaly/format::version-info-company-name-absent", "l": 1 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "b0e2b1b073a915fa703025f056d9a5bcead51c287aec7d8fd7242d9497049417.exe" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "d": ".dll extension reference", "e": [ ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "a": "T1027", "c": 0.9900000095367432, "d": "PE version resource text", "e": [ "VS_VERSION_INFO" ], "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info", "l": 1, "m": "B0032" }, { "a": "T1036.001", "c": 0.8600000143051147, "d": "USERTrust certificate string in overlay", "e": [ "The USERTRUST Network1.0," ], "i": "objectives/evasion/masquerade/binary::overlay-usertrust-string", "l": 1 }, { "a": "T1553.002", "c": 0.8500000238418579, "d": "PE lacks VS_VERSION_INFO resource", "e": [ "field 'pe.version.file_version' does not exist" ], "i": "objectives/evasion/masquerade/cert::pe-no-version-info-resource", "l": 1 }, { "c": 0.8799999952316284, "d": "Native runtime binary is large", "e": [ "b0e2b1b073a915fa703025f056d9a5bcead51c287aec7d8fd7242d9497049417.exe" ], "i": "metadata/lang/compiler/aot::native-runtime-large-file", "l": 2 }, { "c": 1.0, "d": "Reference to USER32.dll", "e": [ "USER32.dll" ], "i": "micro-behaviors/os/module/load::user32-dll-reference", "l": 2 }, { "d": ".exe extension reference", "e": [ ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 2 }, { "c": 0.949999988079071, "d": "Filename has EXE extension", "e": [ "b0e2b1b073a915fa703025f056d9a5bcead51c287aec7d8fd7242d9497049417.exe" ], "i": "objectives/evasion/masquerade/file/double-ext::basename-is-exe", "l": 1 }, { "c": 0.8999999761581421, "d": "Tiny C string section ratio", "e": [ " = 0.0% of total (0 / 3027880 bytes)" ], "i": "metadata/binary/section/metrics::tiny-cstring-section", "l": 1 }, { "a": "T1027.007", "c": 0.8999999761581421, "d": "Kernel32 DLL resolution string", "e": [ "kernel32.dll" ], "i": "micro-behaviors/os/api-resolution/manual::kernel32-resolver", "l": 1 }, { "a": "T1027", "c": 1.0, "d": "Binary is 1MB or larger", "e": [ "b0e2b1b073a915fa703025f056d9a5bcead51c287aec7d8fd7242d9497049417.exe" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::file-size-1m-plus", "l": 1, "m": "B0032" }, { "c": 0.8500000238418579, "d": "PE with malformed section layout", "e": [ "parse.error_count = 2.00" ], "i": "metadata/binary/metrics/structural::malformed-pe-structure", "l": 3 } ], "sha": "b0e2b1b073a915fa703025f056d9a5bcead51c287aec7d8fd7242d9497049417", "path": "b0e2b1b073a915fa703025f056d9a5bcead51c287aec7d8fd7242d9497049417.exe", "type": "pe" } ], "tv": "9ea7c" } }