{ "ml": { "v": "7", "eng": "2.9.1", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.00010363261, "rte": "az", "prob": 0.00010363261 }, { "cls": 0, "raw": 0.000518173, "rte": "az/native", "prob": 0.000518173 }, { "cls": 0, "raw": 0.0021578174, "rte": "az/pe", "prob": 0.0021578174 } ], "prob": 0.00010363261, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.00010363260662415996, "type": "pe" } ], "version": "v18.18", "analyzed_at": "2026-09-12T17:29:46Z" }, "path": "Worm.WinCE.PMCryptic.a", "raw": { "v": "8", "rev": "c7f7e", "files": [ { "id": 0, "ctx": [ { "b": "o\u003ciRU0@@r31onA4%nJ60XbVHe00000kMy=:0000000000000000000000000000000000000000=\u0026s4C4J\u0026m(0ji6Sa?dLD+]{51x(+zoA=kPhvqNb%vqY$3BrC47aAzQxazCZol@c-7zeS@@e!5l%bME/A00000)*7JeT7:@kT7:@kT7:@k8Fg55Tz75lT7:]jLw9y@qH6m]Sa!ShT7:@kS+B\u0026jJitETSS", "ln": 0 }, { "b": "000000000000000000000000000000000000000006\u0026d2MOt6SU[iOmTn[[rYA1RNKn#I\u003e/asOScLiH({w*\u003cx/ate+srK\u0026igYT+$lnkS@-T[^/05gRVs]+!Q\u0026sJlh2MK$^wb@p.0@#rV2ll4e0@", "ln": 992 }, { "b": "0kLb^9rdXJ*=$(u1I*U\u003e0kLb^9rdXJ/GYDq000000rr91PD\u003cKrZ:5{X*-#[2-3tu-wh0#-0000000000p+.}I06*I:nhg8A0000000000tRMiU\u003cuJXBjtu*o0000000000yb2X*/GYAp00000000", "ln": 7648 }, { "b": "Ft-CFFnCF\u003cFl8ZJFfU9{Fb/MH00-G7FcVbPFb/MH05:/SFb/MH07fKWmmo*ye[w^m0aPORy?4y7wIdIfyYBDgz//L$Ab]XCwnD5Z0000000000000000000000000000000000000000000000000000000000000000000000000000000000000", "ln": 7975 }, { "b": "0000000000000000000000000000000000000000[Dw]y9@#v(9SMg\u003c}u3.FjPCFjxAn9-7x:.*zVG\u0026*s{1+Pcisf$V\u0026y8RPA1$xQYpyBWeZhSdfoH1kl7Xlz2\u003cS!yYKJ^nDn:v\u003ekUHj83f", "ln": 8160 }, { "b": "0000000000000000000000000000000000000000FfUc}1q.6N*-#[20r@J?]DTCq0uh27u)L*N0ylYJwf}rS0r@J?00000000000000000000000000000000000000", "ln": 11232 }, { "b": "0000000000000000000000000000000000000000000000000000000000620@@r3aohy(4GDFeh#\u0026@e000000000000000000310rr91pYHGC000000000000000000315!C3yxAe3.000", "ln": 11744 } ], "mol": "Md₂(Bi₂Si)", "sha": "ba20fb84fa436fa6582cb33f83ce436b317b5cee5c871917fc73e4a2dde6dd5e", "path": "Worm.WinCE.PMCryptic.a", "risk": 3, "size": 15874, "supp": [ { "by": [ { "id": "metrics", "spans": [ [ 0, 26 ] ] } ], "id": "metadata/binary/layout::low-overlay-entropy", "crit": "notable", "kind": "unless" }, { "by": [ { "id": "metrics", "spans": [ [ 0, 28 ] ] } ], "id": "metadata/binary/layout::pe-checksum-zeroed", "crit": "notable", "kind": "unless" } ], "type": "pe", "facts": { "imp": [ [ "coredll", "ORDINAL 1521" ], [ "coredll", "ORDINAL 287" ], [ "coredll", "ORDINAL 30" ], [ "coredll", "ORDINAL 1018" ], [ "coredll", "ORDINAL 61" ], [ "coredll", "ORDINAL 360" ], [ "coredll", "ORDINAL 1047" ], [ "coredll", "ORDINAL 367" ], [ "coredll", "ORDINAL 858" ], [ "coredll", "ORDINAL 550" ], [ "coredll", "ORDINAL 180" ], [ "coredll", "ORDINAL 160" ], [ "coredll", "ORDINAL 164" ], [ "coredll", "ORDINAL 181" ], [ "coredll", "ORDINAL 553" ], [ "coredll", "ORDINAL 63" ], [ "coredll", "ORDINAL 365" ], [ "coredll", "ORDINAL 364" ], [ "coredll", "ORDINAL 73" ], [ "coredll", "ORDINAL 231" ], [ "coredll", "ORDINAL 537" ], [ "coredll", "ORDINAL 2003" ], [ "coredll", "ORDINAL 549" ], [ "coredll", "ORDINAL 80" ], [ "coredll", "ORDINAL 496" ], [ "coredll", "ORDINAL 370" ], [ "coredll", "ORDINAL 173" ], [ "coredll", "ORDINAL 548" ], [ "coredll", "ORDINAL 535" ], [ "coredll", "ORDINAL 1041" ], [ "coredll", "ORDINAL 58" ], [ "coredll", "ORDINAL 516" ], [ "coredll", "ORDINAL 178" ], [ "coredll", "ORDINAL 552" ], [ "coredll", "ORDINAL 358" ], [ "coredll", "ORDINAL 1177" ], [ "coredll", "ORDINAL 493" ], [ "coredll", "ORDINAL 492" ], [ "coredll", "ORDINAL 171" ], [ "coredll", "ORDINAL 701" ], [ "coredll", "ORDINAL 177" ], [ "coredll", "ORDINAL 890" ], [ "coredll", "ORDINAL 291" ], [ "coredll", "ORDINAL 166" ], [ "coredll", "ORDINAL 167" ], [ "coredll", "ORDINAL 60" ], [ "coredll", "ORDINAL 1519" ], [ "coredll", "ORDINAL 359" ], [ "coredll", "ORDINAL 169" ], [ "coredll", "ORDINAL 168" ], [ "coredll", "ORDINAL 1645" ], [ "coredll", "ORDINAL 87" ], [ "coredll", "ORDINAL 36" ], [ "cellcore", "ORDINAL 54" ], [ "note_prj", "ORDINAL 7" ], [ "note_prj", "ORDINAL 8" ] ], "sec": [ [ ".text", 1024, 6656, 7.1, "rwx" ], [ ".rdata", 7680, 512, 3.04, "r--" ], [ ".data", 8192, 3072, 0.48, "rw-" ], [ ".pdata", 11264, 512, 0.52, "r--" ], [ ".rsrc", 11776, 4096, 3.67, "r--" ] ], "metrics": { "pe": { "checksum": 0, "timestamp": 1210510351, "icon_count": 2, "image_size": 28672, "has_overlay": 1, "overlay_end": 15874, "headers_size": 1024, "overlay_size": 2, "checksum_valid": 0, "file_alignment": 512, "overlay_offset": 15872, "resource_count": 2, "overlay_padding": 2, "checksum_stripped": 1, "computed_checksum": 21703, "headers_size_ratio": 0.06, "prose_section_count": 0, "bss_like_section_count": 0, "section_overflow_count": 0, "misaligned_section_count": 0, "entry_in_writable_section": 1, "declared_data_directory_count": 4, "executable_prose_section_count": 0, "directory_section_mismatch_count": 0 }, "file": { "size": 15874, "entropy": 5.01 }, "binary": { "is_pie": 0, "has_overlay": 1, "code_entropy": 7.1, "data_entropy": 0.48, "overlay_size": 2, "string_count": 19, "overlay_ratio": 0, "overlay_entropy": 1, "entropy_variance": 5.95, "avg_string_length": 13.74, "max_string_length": 40, "peak_region_bytes": 5120, "code_to_data_ratio": 0.68, "peak_region_entropy": 6.64, "string_length_stddev": 10.68, "largest_section_ratio": 0.42, "sentence_string_count": 1, "sentence_string_ratio": 0.05, "high_entropy_string_count": 0 }, "imports": { "count": 56 }, "sections": { "count": 5, "code_size": 6656, "entropy_max": 7.1, "entropy_mean": 2.96, "name_entropy": 2.97, "writable_count": 2, "executable_count": 1, "nonstandard_count": 0, "executable_writable_count": 1 }, "consistency": { "extension_content_mismatch": 1, "extension_content_mismatch.binary_as_binary": 1 }, "dependencies": { "count": 3 } } }, "traits": [ { "id": "metadata/binary/metrics/structural::high-code-entropy", "conf": 0.8, "crit": 3, "desc": "Binary code section entropy at least 7.0", "spans": [ [ 0, 26 ] ] }, { "id": "metadata/binary/section/metrics::pe-entry-in-writable-section", "conf": 0.95, "crit": 3, "desc": "PE entry point in writable section", "spans": [ [ 0, 35 ] ] }, { "id": "metadata/signed/trust-level::unsigned-missing-signature-record", "conf": 0.9, "crit": 3, "desc": "PE lacks signature record" } ] } ] } }