{ "ml": { "v": "7", "eng": "2.0.1-rc.1", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.00015066068, "rte": "az", "prob": 0.00015066068 }, { "cls": 0, "raw": 0.0030299127, "rte": "az/native", "prob": 0.0030299127 }, { "cls": 0, "raw": 0.017846525, "rte": "az/pe", "prob": 0.017846525 } ], "prob": 0.00015066068, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.00015066067862790078, "type": "pe" } ], "version": "v18.18", "analyzed_at": "2026-06-15T06:51:56Z" }, "path": "VirusShare_7cfd73687adaab3ec847ee4eff305ce7", "raw": { "v": "7", "tv": "061e3", "files": [ { "id": 0, "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000Fb", "l": 0, "n": [ { "c": 3, "d": "Packed binary process execution", "i": "objectives/anti-static/obfuscation/eval/loader::packed-binary-process-execution", "o": 0, "z": 27 } ], "x": true }, { "b": "00000000000000000000rF/**(\u003e/Z50fBX\u003cav2{-mF@6j@7#Qx0@@sN.#$]={\u003e}MHkV3W70@@sN.#$]=]OVcDI+S*A.mfEB000", "l": 496, "n": [ { "c": 3, "d": "Packed binary context", "i": "objectives/anti-static/obfuscation/eval/loader::packed-binary-context", "o": 512, "z": 30 } ], "x": true }, { "b": "006eC00000003\u003eSC4kMme[w^m0001uBAhhezu6Upzddl%z^@+E0bVp:B7GB[003wk", "l": 2546, "n": [ { "c": 2, "d": ".dll extension reference", "i": "micro-behaviors/fs/path/extension::dll-dup", "o": 2562, "z": 4 } ], "x": true }, { "b": "A+eW3wL^z=v}x.5k(Z(+lU{WZwK{lEwnC/S002@eBx9i(vqYQ(wN[kOv}xR3x(v(Ux(4)5ASu7", "l": 2706, "n": [ { "c": 2, "d": "Close handle", "i": "micro-behaviors/process/create/spawn::close-handle-dup", "o": 2722, "z": 11 } ], "x": true } ], "mol": "O(As)H(Po₂)", "sha": "b7136aa9d6e4d71391647bda3291c53ce1ccbbac99201a81c269783193be176e", "fact": { "id": "pe", "imp": [ [ "msvcrt", "strlen" ], [ "msvcrt", "malloc" ], [ "msvcrt", "memset" ], [ "msvcrt", "argc" ], [ "msvcrt", "argv" ], [ "msvcrt", "environ" ], [ "msvcrt", "XcptFilter" ], [ "msvcrt", "set_app_type" ], [ "msvcrt", "controlfp" ], [ "msvcrt", "getmainargs" ], [ "msvcrt", "exit" ], [ "kernel32", "CreateProcessA" ], [ "kernel32", "CloseHandle" ], [ "kernel32", "SetUnhandledExceptionFilter" ] ], "met": { "pe": { "checksum": 60850.0, "checksum_valid": 1.0, "computed_checksum": 60850.0, "bss_like_section_count": 0.0, "section_overflow_count": 0.0, "misaligned_section_count": 0.0 }, "file": { "size": 3072.0, "entropy": 4.14, "size_bytes": 3072.0 }, "binary": { "is_pie": 0.0, "code_entropy": 3.78, "string_count": 21.0, "overall_entropy": 4.14, "entropy_variance": 0.07, "avg_string_length": 10.57, "max_string_length": 40.0, "code_to_data_ratio": 1.0, "string_length_stddev": 8.37, "largest_section_ratio": 0.5, "sentence_string_count": 1.0, "sentence_string_ratio": 0.05, "high_entropy_string_count": 0.0 }, "imports": { "count": 14.0 }, "sections": { "count": 3.0, "code_size": 1536.0, "entropy_max": 4.31, "entropy_mean": 4.05, "name_entropy": 3.01, "writable_count": 1.0, "executable_count": 1.0, "nonstandard_count": 0.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 2.0 } }, "sec": [ [ ".text", 512, 1536, 3.78, "r-x" ], [ ".rdata", 2048, 1024, 4.31, "r--" ], [ ".bss", 0, 0, 0.0, "rw-" ] ], "str": [ [ 77, "u8", "!This program cannot be run in DOS mode." ], [ 376, "u8", ".text" ], [ 2222, "u8", "CBC5" ], [ 2285, "u8", "QN O7" ], [ 2332, "u8", "YDSA" ], [ 2556, "u8", "msvcrt.dll" ], [ 2569, "u8", "strlen" ], [ 2578, "u8", "malloc" ], [ 2587, "u8", "memset" ], [ 2596, "u8", "__argc" ], [ 2605, "u8", "__argv" ], [ 2614, "u8", "_environ" ], [ 2625, "u8", "_XcptFilter" ], [ 2639, "u8", "__set_app_type" ], [ 2656, "u8", "_controlfp" ], [ 2669, "u8", "__getmainargs" ], [ 2685, "u8", "exit" ], [ 2690, "u8", "kernel32.dll" ], [ 2705, "u8", "CreateProcessA" ], [ 2722, "u8", "CloseHandle" ], [ 2736, "u8", "SetUnhandledExceptionFilter" ] ], "val": { "file.stem": "VirusShare_7cfd73687adaab3ec847ee4eff305ce7", "pe.imphash": "26929006cc8d1e53cefbb91369e4f82d", "pe.machine": "i386", "pe.subsystem": "windows_gui", "file.basename": "VirusShare_7cfd73687adaab3ec847ee4eff305ce7", "pe.image_base": 4194304, "pe.image_size": 16384, "pe.machine_id": 332, "pe.os_version": "4.0", "pe.entry_point": 4761, "pe.headers_size": 512, "pe.entry_section": ".text", "pe.subsystem_raw": 2, "pe.file_alignment": 512, "pe.image_hash.sha1": "f25da9d972f648fb562e4c450a50839481f85a2b", "pe.image_hash.sha256": "13449d1381aeaa6e150f17c61ccaa5dd4b27e59663ecdcef9ec6e25942d6e4a0", "pe.image_hash.sha384": "a824274f242f6eea89638e5abb1332c9068e727f06097935b6984d4371dca067f2dbdc48ddd6d53399bc0e15d29b3419", "pe.image_hash.sha512": "6debfda62db347599eefd50fd2a92904aea9c347331d50c3baf1fb6200925d611c9a970f61d77f85c459d4524a85bb2703c79c0e74921fe9c8ba686fb7909943", "pe.section_alignment": 4096, "pe.subsystem_version": "4.0", "pe.characteristics[0]": "relocs_stripped", "pe.characteristics[1]": "executable_image", "pe.characteristics[2]": "32bit_machine", "pe.characteristics_raw": 783, "pe.linker_major_version": 6, "pe.data_directories[0].rva": 8512, "pe.data_directories[1].rva": 8572, "pe.number_of_rva_and_sizes": 16, "pe.data_directories[0].name": "import", "pe.data_directories[0].size": 60, "pe.data_directories[1].name": "iat", "pe.data_directories[1].size": 64, "pe.coff.dos_header_pe_pointer": 128 } }, "find": [ { "id": "objectives/anti-static/pack/upx::no-compression-grade-section", "atk": "T1027.002", "mbc": "F0001.008", "conf": 0.8999999761581421, "crit": 1, "desc": "No section reaches compression-grade entropy" }, { "id": "micro-behaviors/process/create/spawn::create-process-a", "atk": "T1106", "conf": 0.949999988079071, "crit": 3, "desc": "Create process (ANSI)" }, { "id": "metadata/binary/metrics/structural::few-sections", "conf": 0.6000000238418579, "crit": 3, "desc": "Very few sections (merged/stripped)" }, { "id": "objectives/anti-static/obfuscation/eval/loader::packed-binary-context", "atk": "T1027", "mbc": "B0032", "conf": 0.8500000238418579, "crit": 3, "desc": "Packed binary context" }, { "id": "micro-behaviors/process/create/shell/invoke::win-createprocess", "atk": "T1059.003", "mbc": "E1059.003", "conf": 0.8999999761581421, "crit": 3, "desc": "Creates new process via Windows API" }, { "id": "micro-behaviors/process/create/shell/invoke::shell-execution-comp", "atk": "T1059", "mbc": "E1059", "conf": 0.8999999761581421, "crit": 3, "desc": "Shell command execution capability detected" }, { "id": "objectives/anti-static/obfuscation/eval/loader::binary-process-execution", "atk": "T1027", "mbc": "B0032", "conf": 0.8500000238418579, "crit": 3, "desc": "Binary process execution capability" }, { "id": "objectives/anti-static/obfuscation/eval/loader::packed-binary-process-execution", "atk": "T1027", "mbc": "B0032", "conf": 0.8999999761581421, "crit": 3, "desc": "Packed binary process execution" } ], "path": "VirusShare_7cfd73687adaab3ec847ee4eff305ce7", "risk": 3, "size": 3072, "type": "pe" } ] } }