{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 0.009955555200576782,
        "class": 0
      }
    ],
    "prob": 0.009955555,
    "class": 0,
    "models": [
      {
        "m": "az",
        "prob": 0.009955555,
        "class": 0
      },
      {
        "m": "az/native",
        "prob": 0.0,
        "class": 0
      },
      {
        "m": "az/pe",
        "prob": 0.0,
        "class": 0
      }
    ],
    "version": "v17.17",
    "thresholds": [
      0.999503,
      0.9998882
    ],
    "analyzed_at": "2026-05-25T14:25:52Z"
  },
  "path": "VirusShare_369b6bf32192dee6280e18d9e7f00686",
  "raw": {
    "v": "5",
    "fs": [
      {
        "f": "Md₂(BiSi)",
        "x": 5,
        "ff": {
          "m": {
            "pe": {
              "checksum": 10529.0,
              "checksum_valid": 1.0,
              "resource_count": 1.0,
              "has_version_info": 1.0,
              "computed_checksum": 10529.0,
              "bss_like_section_count": 0.0,
              "forwarded_export_count": 5.0,
              "section_overflow_count": 0.0,
              "misaligned_section_count": 0.0
            },
            "file": {
              "size": 8888.0,
              "entropy": 6.37,
              "size_bytes": 8888.0
            },
            "binary": {
              "is_pie": 1.0,
              "has_overlay": 1.0,
              "code_entropy": 3.2,
              "overlay_size": 5816.0,
              "string_count": 165.0,
              "overlay_ratio": 0.65,
              "overlay_entropy": 7.39,
              "entropy_variance": 0.0,
              "avg_string_length": 14.62,
              "max_string_length": 49.0,
              "code_to_data_ratio": 1.0,
              "string_length_stddev": 11.48,
              "largest_section_ratio": 0.12,
              "sentence_string_count": 16.0,
              "sentence_string_ratio": 0.1,
              "high_entropy_string_count": 0.0
            },
            "exports": {
              "count": 5.0
            },
            "sections": {
              "count": 2.0,
              "code_size": 1024.0,
              "entropy_max": 3.24,
              "entropy_mean": 3.22,
              "name_entropy": 2.72,
              "writable_count": 0.0,
              "executable_count": 1.0,
              "nonstandard_count": 0.0,
              "executable_writable_count": 0.0
            },
            "dependencies": {
              "count": 0.0
            }
          },
          "s": [
            [
              77,
              "u8",
              "!This program cannot be run in DOS mode."
            ],
            [
              456,
              "u8",
              ".text"
            ],
            [
              1108,
              "u8",
              "RSDS"
            ],
            [
              1132,
              "u8",
              "api-ms-win-core-handle-l1-1-0.pdb"
            ],
            [
              1200,
              "u8",
              ".rdata"
            ],
            [
              1216,
              "u8",
              ".rdata$zzzdbg"
            ],
            [
              1240,
              "u8",
              ".edata"
            ],
            [
              1386,
              "u8",
              "api-ms-win-core-handle-l1-1-0.dll"
            ],
            [
              1420,
              "u8",
              "CloseHandle"
            ],
            [
              1432,
              "u8",
              "kernel32.CloseHandle"
            ],
            [
              1453,
              "u8",
              "CompareObjectHandles"
            ],
            [
              1474,
              "u8",
              "kernel32.CompareObjectHandles"
            ],
            [
              1504,
              "u8",
              "DuplicateHandle"
            ],
            [
              1520,
              "u8",
              "kernel32.DuplicateHandle"
            ],
            [
              1545,
              "u8",
              "GetHandleInformation"
            ],
            [
              1566,
              "u8",
              "kernel32.GetHandleInformation"
            ],
            [
              1596,
              "u8",
              "SetHandleInformation"
            ],
            [
              1617,
              "u8",
              "kernel32.SetHandleInformation"
            ],
            [
              2150,
              "wide",
              "VS_VERSION_INFO"
            ],
            [
              2242,
              "wide",
              "StringFileInfo"
            ],
            [
              2278,
              "wide",
              "040904B0"
            ],
            [
              2302,
              "wide",
              "CompanyName"
            ],
            [
              2328,
              "wide",
              "Microsoft Corporation"
            ],
            [
              2378,
              "wide",
              "FileDescription"
            ],
            [
              2412,
              "wide",
              "ApiSet Stub DLL"
            ],
            [
              2450,
              "wide",
              "FileVersion"
            ],
            [
              2546,
              "wide",
              "InternalName"
            ],
            [
              2572,
              "wide",
              "apisetstub"
            ],
            [
              2602,
              "wide",
              "LegalCopyright"
            ],
            [
              2632,
              "wide",
              "© Microsoft Corporation. All rights reserved."
            ],
            [
              2730,
              "wide",
              "OriginalFilename"
            ],
            [
              2794,
              "wide",
              "ProductName"
            ],
            [
              2820,
              "wide",
              "Microsoft® Windows® Operating System"
            ],
            [
              2902,
              "wide",
              "ProductVersion"
            ],
            [
              2966,
              "wide",
              "VarFileInfo"
            ],
            [
              2998,
              "wide",
              "Translation"
            ],
            [
              3134,
              "u8",
              "Z0X03"
            ],
            [
              3302,
              "u8",
              "Western Cape1"
            ],
            [
              3325,
              "u8",
              "Durbanville1"
            ],
            [
              3347,
              "u8",
              "Thawte1"
            ],
            [
              3364,
              "u8",
              "Thawte Certification1"
            ],
            [
              3395,
              "u8",
              "Thawte Timestamping CA0"
            ],
            [
              3475,
              "u8",
              "Symantec Corporation100."
            ],
            [
              3505,
              "u8",
              "'Symantec Time Stamping Services CA - G20"
            ],
            [
              3906,
              "u8",
              "http://ocsp.thawte.com0"
            ],
            [
              3956,
              "u8",
              "80604"
            ],
            [
              3966,
              "u8",
              ".http://crl.thawte.com/ThawteTimestampingCA.crl0"
            ],
            [
              4076,
              "u8",
              "TimeStamp-2048-10"
            ],
            [
              4312,
              "u8",
              "thawte, Inc.1(0\u0026"
            ],
            [
              4335,
              "u8",
              "Certification Services Division1806"
            ],
            [
              4376,
              "u8",
              "/(c) 2006 thawte, Inc. - For authorized use only1"
            ],
            [
              4435,
              "u8",
              "thawte Primary Root CA0"
            ],
            [
              4476,
              "u8",
              "231209235959Z0L1"
            ],
            [
              4515,
              "u8",
              "thawte, Inc.1\u00260$"
            ],
            [
              4538,
              "u8",
              "thawte SHA256 Code Signing CA0"
            ],
            [
              4899,
              "u8",
              "http://t2.symcb.com0"
            ],
            [
              4956,
              "u8",
              "!http://t1.symcb.com/ThawtePCA.crl0"
            ],
            [
              5063,
              "u8",
              "SymantecPKI-1-5680"
            ],
            [
              5141,
              "u8",
              "WHP0"
            ],
            [
              5365,
              "u8",
              "EArWu"
            ],
            [
              5581,
              "u8",
              "201229235959Z0b1"
            ],
            [
              5620,
              "u8",
              "Symantec Corporation1402"
            ],
            [
              5650,
              "u8",
              "+Symantec Time Stamping Services Signer - G40"
            ],
            [
              6080,
              "u8",
              "http://ts-ocsp.ws.symantec.com07"
            ],
            [
              6123,
              "u8",
              "+http://ts-aia.ws.symantec.com/tss-ca-g2.cer0\u003c"
            ],
            [
              6175,
              "u8",
              "50301"
            ],
            [
              6185,
              "u8",
              "+http://ts-crl.ws.symantec.com/tss-ca-g2.crl0("
            ],
            [
              6255,
              "u8",
              "TimeStamp-2048-20"
            ],
            [
              6364,
              "u8",
              "b07x"
            ],
            [
              6754,
              "u8",
              "171013235959Z0"
            ],
            [
              6794,
              "u8",
              "Beijing1"
            ],
            [
              6830,
              "u8",
              "No Organization Affiliation1"
            ],
            [
              6868,
              "u8",
              "Individual Developer1"
            ],
            [
              6899,
              "u8",
              "Mengmeng Wang0"
            ],
            [
              7308,
              "u8",
              "http://tl.symcb.com/tl.crl0"
            ],
            [
              7379,
              "u8",
              "g0e0c"
            ],
            [
              7408,
              "u8",
              "https://www.thawte.com/cps0/"
            ],
            [
              7449,
              "u8",
              "!https://www.thawte.com/repository0W"
            ],
            [
              7496,
              "u8",
              "K0I0"
            ],
            [
              7513,
              "u8",
              "http://tl.symcd.com0\u0026"
            ],
            [
              7546,
              "u8",
              "http://tl.symcb.com/tl.crt0"
            ],
            [
              7910,
              "u8",
              "thawte SHA256 Code Signing CA"
            ],
            [
              8213,
              "u8",
              "rlFv"
            ],
            [
              8244,
              "u8",
              "_N WOy"
            ],
            [
              8445,
              "u8",
              "'Symantec Time Stamping Services CA - G2"
            ]
          ],
          "v": {
            "pe.machine": "i386",
            "pe.rich.key": 2444448553,
            "pe.rich.hash": "669f3a9d65babc7aaa2f6b3ff663994a",
            "pe.subsystem": "windows_cui",
            "pe.timestamp": 1433321542,
            "pe.image_base": 268435456,
            "pe.image_size": 12288,
            "pe.machine_id": 332,
            "pe.os_version": "10.0",
            "pe.version.os": "windows_nt_windows32",
            "pe.headers_size": 1024,
            "pe.version.type": "dll",
            "pe.debug.pdb.age": 1,
            "pe.subsystem_raw": 3,
            "pe.debug.pdb.guid": "2a69568f-2ec9-4904-af7b-5592b048e025",
            "pe.debug.pdb.path": "api-ms-win-core-handle-l1-1-0.pdb",
            "pe.file_alignment": 512,
            "pe.cert_table_size": 5816,
            "pe.image_hash.sha1": "9a96590f890a6d8a46b0216a2982730a15e8ed0a",
            "pe.version.company": "Microsoft Corporation",
            "pe.export_timestamp": 1433315177,
            "pe.image_hash.sha256": "c8a5e0e348c561f59f74fd02198f43c9fcd14c0e11e6a34e34bfdff5f0a5abcc",
            "pe.image_hash.sha384": "cc9fdcb4aaaac1dbc5bb3701c631962db6bd38d50590bbaf95553b3a31f6e31844db9b3259c33f71551447d02ef7737d",
            "pe.image_hash.sha512": "b84ce2f861c49b1c11e8a45d1d580d1ebcd60a3ad22726b22cc1b13a02a43338bd5c900baac0c9a7d792d4722a1ef2f88a0cbdcdfefea2968c2f2f3d160e3c81",
            "pe.resource_types[0]": "RT_VERSION",
            "pe.section_alignment": 4096,
            "pe.subsystem_version": "10.0",
            "pe.version.copyright": "© Microsoft Corporation. All rights reserved.",
            "pe.characteristics[0]": "executable_image",
            "pe.characteristics[1]": "32bit_machine",
            "pe.characteristics[2]": "dll",
            "pe.characteristics_raw": 8450,
            "pe.debug.pdb.timestamp": 1433321542,
            "pe.version.description": "ApiSet Stub DLL",
            "pe.linker_major_version": 12,
            "pe.linker_minor_version": 10,
            "pe.signatures[0].issuer": "CN=thawte SHA256 Code Signing CA,O=thawte\\, Inc.,C=US",
            "pe.signatures[0].serial": "57fcdab4b0c6202bc89a0ddd4a742960",
            "pe.version.file_version": "10.0.10137.0 (th1.150602-2238)",
            "pe.version.product_name": "Microsoft® Windows® Operating System",
            "build.toolchain.compiler": "msvc",
            "pe.debug.entries[0].type": "codeview",
            "pe.debug.entries[1].type": "pogo",
            "pe.signatures[0].subject": "CN=Mengmeng Wang,OU=Individual Developer,O=No Organization Affiliation,L=Beijing,ST=Beijing,C=CN",
            "pe.version.internal_name": "apisetstub",
            "pe.dll_characteristics[0]": "dynamic_base",
            "pe.dll_characteristics[1]": "nx_compat",
            "pe.dll_characteristics[2]": "no_seh",
            "pe.signatures[0].verified": true,
            "pe.data_directories[0].rva": 4368,
            "pe.data_directories[1].rva": 8192,
            "pe.data_directories[2].rva": 3072,
            "pe.data_directories[3].rva": 4096,
            "pe.dll_characteristics_raw": 1344,
            "pe.number_of_rva_and_sizes": 16,
            "pe.signatures[0].not_after": "2017-10-13T23:59:59Z",
            "pe.version.product_version": "10.0.10137.0",
            "pe.data_directories[0].name": "export",
            "pe.data_directories[0].size": 351,
            "pe.data_directories[1].name": "resource",
            "pe.data_directories[1].size": 984,
            "pe.data_directories[2].name": "certificate",
            "pe.data_directories[2].size": 5816,
            "pe.data_directories[3].name": "debug",
            "pe.data_directories[3].size": 56,
            "pe.debug.entries[0].type_id": 2,
            "pe.debug.entries[1].type_id": 13,
            "pe.rich.entries[0].build_id": 238,
            "pe.rich.entries[1].build_id": 242,
            "pe.rich.entries[2].build_id": 237,
            "pe.rich.entries[3].build_id": 240,
            "pe.signatures[0].not_before": "2016-10-14T00:00:00Z",
            "pe.rich.entries[0].use_count": 1,
            "pe.rich.entries[1].use_count": 2,
            "pe.rich.entries[2].use_count": 1,
            "pe.rich.entries[3].use_count": 1,
            "pe.version.original_filename": "apisetstub",
            "pe.coff.dos_header_pe_pointer": 208,
            "pe.rich.entries[0].product_id": 40116,
            "pe.rich.entries[1].product_id": 40116,
            "pe.rich.entries[2].product_id": 40116,
            "pe.rich.entries[3].product_id": 40116,
            "pe.debug.entries[0].size_bytes": 58,
            "pe.debug.entries[1].size_bytes": 100,
            "pe.signatures[0].thumbprint_sha1": "a659c4fdf054ffb193b2f060c6456804a6043162",
            "pe.signatures[0].cert_chain_depth": 4,
            "pe.signatures[0].digest_algorithm": "sha1",
            "pe.signatures[0].eku_code_signing": true,
            "pe.signatures[0].signature_digest": "9a96590f890a6d8a46b0216a2982730a15e8ed0a",
            "pe.debug.entries[0].timestamp_unix": 1433321542,
            "pe.debug.entries[1].timestamp_unix": 1433321542,
            "pe.signatures[0].thumbprint_sha256": "af77e7db87a3005b1f44b8f8f4bda3501706fe901f405eaf466bd26e53ab1792",
            "pe.signatures[0].signature_algorithm": "sha256WithRSAEncryption",
            "pe.signatures[0].signature_digest_algorithm": "sha1"
          },
          "x": [
            [
              "CloseHandle",
              "kernel32.CloseHandle"
            ],
            [
              "CompareObjectHandles",
              "kernel32.CompareObjectHandles"
            ],
            [
              "DuplicateHandle",
              "kernel32.DuplicateHandle"
            ],
            [
              "GetHandleInformation",
              "kernel32.GetHandleInformation"
            ],
            [
              "SetHandleInformation",
              "kernel32.SetHandleInformation"
            ]
          ],
          "id": "pe",
          "sc": [
            [
              ".text",
              1024,
              1024,
              3.2,
              "r-x"
            ],
            [
              ".rsrc",
              2048,
              1024,
              3.24,
              "r--"
            ]
          ]
        },
        "id": 0,
        "sz": 8888,
        "ts": [
          {
            "c": 1.0,
            "d": "Authenticode chain CN: Mengmeng Wang",
            "e": [
              "Mengmeng Wang"
            ],
            "i": "metadata/signed/unknown::mengmeng-wang",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "Signed by No Organization Affiliation",
            "e": [
              "No Organization Affiliation"
            ],
            "i": "metadata/signed/leaf::no-organization-affiliation",
            "l": 3
          },
          {
            "c": 0.699999988079071,
            "d": "PE FileDescription metadata field",
            "e": [
              "FileDescription"
            ],
            "i": "metadata/package/versioning::pe-filedescription-field",
            "l": 2
          },
          {
            "c": 0.800000011920929,
            "d": "Regex component marker",
            "e": [
              "StringFileInfo"
            ],
            "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "Close handle",
            "e": [
              "CloseHandle"
            ],
            "i": "micro-behaviors/process/create/spawn::close-handle-dup",
            "l": 2
          },
          {
            "a": "T1204.002",
            "c": 0.7599999904632568,
            "d": "Short PDB marker",
            "e": [
              "api-ms-win-core-handle-l1-1-0.pdb"
            ],
            "i": "objectives/command-and-control/dropper/execution/clickfix::short-pdb-marker",
            "l": 1,
            "m": "B0024"
          },
          {
            "c": 0.699999988079071,
            "d": "PE has many readable strings",
            "e": [
              "binary.string_count = 165.00"
            ],
            "i": "metadata/binary/layout::many-readable-strings",
            "l": 2
          },
          {
            "a": "T1036.005",
            "c": 0.8999999761581421,
            "d": "Microsoft Corporation company in version info",
            "e": [
              "Microsoft Corporation"
            ],
            "i": "objectives/evasion/masquerade/version-resource/microsoft-utility::dw20-microsoft-company",
            "l": 1,
            "m": "F0004"
          },
          {
            "c": 0.699999988079071,
            "d": "PE InternalName metadata field",
            "e": [
              "InternalName"
            ],
            "i": "metadata/package/versioning::pe-internalname-field",
            "l": 2
          },
          {
            "a": "T1036.005",
            "c": 0.949999988079071,
            "d": "Microsoft company version identity",
            "e": [
              "Microsoft Corporation"
            ],
            "i": "objectives/evasion/masquerade/version-resource/contradiction::microsoft-company-versioninfo-kv",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "PE OriginalFilename metadata field",
            "e": [
              "OriginalFilename"
            ],
            "i": "metadata/package/versioning::pe-originalfilename-field",
            "l": 2
          },
          {
            "a": "T1036.005",
            "c": 0.9700000286102295,
            "d": "Windows operating system product string",
            "e": [
              "Microsoft® Windows® Operating System"
            ],
            "i": "objectives/evasion/masquerade/version-resource/claim::getmac-product-string",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "DEP / NX enabled (NX_COMPAT)",
            "e": [
              "[dynamic_base, nx_compat, no_seh]"
            ],
            "i": "metadata/hardening/mitigation::pe-dep",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "PE Authenticode signature verified metadata",
            "e": [
              "true"
            ],
            "i": "metadata/signed/certificate::pe-signature-verified-kv",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "ASLR enabled (DYNAMIC_BASE)",
            "e": [
              "[dynamic_base, nx_compat, no_seh]"
            ],
            "i": "metadata/hardening/mitigation::pe-aslr",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "PE first resource is RT_VERSION",
            "e": [
              "RT_VERSION"
            ],
            "i": "metadata/binary/resource::pe-resource-version-first",
            "l": 2
          },
          {
            "c": 0.8999999761581421,
            "d": "PE standard code/data section",
            "e": [
              ".text"
            ],
            "i": "metadata/binary/section/names::pe-code-data-standard-section",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "PE CompanyName metadata field",
            "e": [
              "CompanyName"
            ],
            "i": "metadata/package/versioning::pe-companyname-field",
            "l": 2
          },
          {
            "c": 0.800000011920929,
            "d": "Duplicate object handle",
            "e": [
              "DuplicateHandle"
            ],
            "i": "micro-behaviors/communications/ipc/pipe::duplicate-handle",
            "l": 2
          },
          {
            "c": 0.949999988079071,
            "d": "PE version info numeric fields present",
            "e": [
              "10.0.10137.0 (th1.150602-2238)"
            ],
            "i": "metadata/binary/anomaly/format::version-info-file-version-present",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "Regex component marker",
            "e": [
              "binary.overlay_ratio = 0.65"
            ],
            "i": "objectives/anti-static/obfuscation/control-flow/logic::bloated-low-density-malware-cond-5--inline-32080",
            "l": 1
          },
          {
            "c": 0.9399999976158142,
            "d": "PE overlay exceeds thirty-five percent",
            "e": [
              "binary.overlay_ratio = 0.65"
            ],
            "i": "metadata/binary/layout::overlay-over-35pct",
            "l": 3
          },
          {
            "a": "T1027",
            "c": 0.9900000095367432,
            "d": "PE version resource text",
            "e": [
              "VS_VERSION_INFO"
            ],
            "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info",
            "l": 1,
            "m": "B0032"
          },
          {
            "d": ".dll extension reference",
            "e": [
              ".dll"
            ],
            "i": "micro-behaviors/fs/path/extension::dll-dup",
            "l": 2
          },
          {
            "c": 0.8999999761581421,
            "d": "PE resource section",
            "e": [
              ".rsrc"
            ],
            "i": "metadata/binary/section/names::pe-resource-section",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "DLL exports five to ten APIs",
            "e": [
              "exports.count = 5.00"
            ],
            "i": "metadata/binary/symbols/exports::sideload-export-cluster-size-5-10",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "PE checksum matches computed value",
            "e": [
              "pe.checksum_valid = 1.00"
            ],
            "i": "metadata/binary/layout::pe-checksum-valid",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "PE ProductName metadata field",
            "e": [
              "ProductName"
            ],
            "i": "metadata/package/versioning::pe-productname-field",
            "l": 2
          },
          {
            "c": 0.699999988079071,
            "d": "PE has few sections",
            "e": [
              "sections.count = 2.00"
            ],
            "i": "metadata/binary/layout::legacy-few-sections",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "NO_SEH (SafeSEH not used)",
            "e": [
              "[dynamic_base, nx_compat, no_seh]"
            ],
            "i": "metadata/hardening/mitigation::pe-no-seh",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "Binary has 4 or fewer sections",
            "e": [
              "sections.count = 2.00"
            ],
            "i": "objectives/command-and-control/infrastructure/config::max-sections-4",
            "l": 1
          },
          {
            "a": "T1036.001",
            "c": 0.8399999737739563,
            "d": "Symantec timestamp string in overlay",
            "e": [
              "+Symantec Time Stamping Services Signer - G40"
            ],
            "i": "objectives/evasion/masquerade/binary::overlay-symantec-string",
            "l": 1
          },
          {
            "c": 0.9700000286102295,
            "d": "Microsoft ImageHlp company metadata",
            "e": [
              "Microsoft Corporation"
            ],
            "i": "well-known/lib/microsoft-imagehlp::imagehlp-company",
            "l": 2
          },
          {
            "c": 0.949999988079071,
            "d": "PE FileDescription field is populated",
            "e": [
              "ApiSet Stub DLL"
            ],
            "i": "metadata/package/versioning::pe-file-description-present",
            "l": 1
          },
          {
            "c": 0.949999988079071,
            "d": "PE LegalCopyright field is populated",
            "e": [
              "© Microsoft Corporation. All rights reserved."
            ],
            "i": "metadata/package/versioning::pe-legal-copyright-present",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "PE binary has trailing overlay data",
            "e": [
              "binary.has_overlay = 1.00"
            ],
            "i": "metadata/binary/layout::has-overlay",
            "l": 3
          },
          {
            "c": 0.949999988079071,
            "d": "PE ProductName field is populated",
            "e": [
              "Microsoft® Windows® Operating System"
            ],
            "i": "metadata/package/versioning::pe-product-name-present",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "File is a compiled binary",
            "e": [
              "VirusShare_369b6bf32192dee6280e18d9e7f00686"
            ],
            "i": "metadata/binary/framework::is-binary",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "Microsoft vendor marker in resource section",
            "e": [
              "Microsoft Corporation"
            ],
            "i": "metadata/binary/vendor::microsoft-corp-marker-rsrc",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "Tiny C string section ratio",
            "e": [
              " = 0.0% of total (0 / 8888 bytes)"
            ],
            "i": "metadata/binary/section/metrics::tiny-cstring-section",
            "l": 1
          },
          {
            "c": 0.6000000238418579,
            "d": "Very few sections (merged/stripped)",
            "e": [
              "sections.count = 2.00"
            ],
            "i": "metadata/binary/metrics/structural::few-sections",
            "l": 3
          },
          {
            "a": "T1055",
            "c": 0.949999988079071,
            "d": "Huge null run in executable (128+ bytes)",
            "e": [
              "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00"
            ],
            "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.8600000143051147,
            "d": "Long mixed-case identifiers cluster",
            "e": [
              "GetHandleInformation",
              "SetHandleInformation"
            ],
            "i": "objectives/anti-static/obfuscation/string/junking::long-mixedcase-identifiers",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.800000011920929,
            "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)",
            "e": [
              "pe.resource_count = 1.00"
            ],
            "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "Claims Microsoft Corp in version resource",
            "e": [
              "Microsoft Corporation.",
              "Microsoft Corporation"
            ],
            "i": "metadata/binary/vendor::microsoft-corp-versioninfo",
            "l": 1
          },
          {
            "c": 0.9200000166893005,
            "d": "Overlay exceeds one-third",
            "e": [
              "binary.overlay_ratio = 0.65"
            ],
            "i": "metadata/binary/layout::overlay-dominates-third",
            "l": 3
          },
          {
            "c": 0.8999999761581421,
            "d": "Async I/O library (libevent, libev, etc.)",
            "e": [
              "DuplicateHandle"
            ],
            "i": "micro-behaviors/dylib/library/family::async-io-lib-marker",
            "l": 2
          }
        ],
        "sha": "b131b67b9aae8bd36e27685201f9c99c1271fadd3498dc3019813989ebf6c622",
        "path": "/data/samples/bad/datasets/various/VirusShare/VirusShare_369b6bf32192dee6280e18d9e7f00686",
        "type": "pe"
      }
    ],
    "tv": "a7886"
  }
}