{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 0.5925531983375549,
        "class": 0
      }
    ],
    "prob": 0.5925532,
    "class": 0,
    "models": [
      {
        "m": "az",
        "prob": 0.5925532,
        "class": 0
      },
      {
        "m": "az/native",
        "prob": 0.07716687,
        "class": 0
      },
      {
        "m": "az/pe",
        "prob": 0.08341734,
        "class": 0
      }
    ],
    "version": "v16.16",
    "thresholds": [
      0.9979839,
      1.0
    ],
    "analyzed_at": "2026-05-11T02:13:56Z"
  },
  "path": "242662",
  "raw": {
    "v": "4",
    "fs": [
      {
        "f": "Md₂(Bi₄Si)",
        "k": {
          "pe.checksum": "0x0000d981",
          "pe.timestamp": 1446172832,
          "hash.authenti": "fe32c049c4026af9748e4ee8443ed3025c5cf72da95c4dbd6b9ef8ac6aece4ab",
          "debug.pdb_path": "wlanutil.pdb",
          "pe.codeview.age": 1,
          "hash.rich_header": "6b7550cd526ffcecf8a0f093845c50c2c014321141b09f952fb6dc7d21e90943",
          "pe.codeview.guid": "49CFAC0F-5D71-4B2E-A918-FD858D8C7794",
          "build.target_arch": "x86_64",
          "pe.linker_version": "12.10",
          "pe.resource_types[0]": "RT_VERSION",
          "pe.rich_header.xor_key": "0x8de8e059",
          "pe.debug_entries[0].size": 37,
          "pe.debug_entries[0].type": "codeview",
          "pe.debug_entries[1].size": 100,
          "pe.debug_entries[1].type": "pogo",
          "pe.data_directories[0].rva": 4192,
          "pe.data_directories[1].rva": 8192,
          "pe.data_directories[2].rva": 4096,
          "pe.data_directories[0].name": "export",
          "pe.data_directories[0].size": 423,
          "pe.data_directories[1].name": "resource",
          "pe.data_directories[1].size": 1352,
          "pe.data_directories[2].name": "debug",
          "pe.data_directories[2].size": 56,
          "pe.debug_directory_types[0]": 2,
          "pe.debug_directory_types[1]": 13,
          "pe.version_info.company_name": "Microsoft Corporation",
          "pe.version_info.file_version": "10.0.10586.0 (th2_release.151029-1700)",
          "pe.version_info.product_name": "Microsoft® Windows® Operating System",
          "pe.debug_entries[0].timestamp": 1446172832,
          "pe.debug_entries[1].timestamp": 1446172832,
          "pe.version_info.internal_name": "wlanutil.dll",
          "pe.dll_characteristics.guard_cf": true,
          "pe.rich_header_compids[0].count": 1,
          "pe.rich_header_compids[1].count": 1,
          "pe.rich_header_compids[2].count": 1,
          "pe.version_info.legal_copyright": "© Microsoft Corporation. All rights reserved.",
          "pe.version_info.product_version": "10.0.10586.0",
          "pe.dll_characteristics.nx_compat": true,
          "pe.rich_header_compids[0].compid": 15637684,
          "pe.rich_header_compids[1].compid": 15572148,
          "pe.rich_header_compids[2].compid": 15768756,
          "pe.version_info.file_description": "Windows Wireless LAN 802.11 Utility DLL",
          "pe.version_info.original_filename": "wlanutil.dll",
          "pe.section_characteristics[0].name": ".rdata",
          "pe.section_characteristics[1].name": ".rsrc",
          "pe.dll_characteristics.dynamic_base": true,
          "pe.rich_header.entries[0].use_count": 1,
          "pe.rich_header.entries[1].use_count": 1,
          "pe.rich_header.entries[2].use_count": 1,
          "pe.rich_header.entries[0].product_id": 238,
          "pe.rich_header.entries[1].product_id": 237,
          "pe.rich_header.entries[2].product_id": 240,
          "pe.dll_characteristics.high_entropy_va": true,
          "pe.rich_header.entries[0].build_number": 40116,
          "pe.rich_header.entries[0].product_name": "unknown",
          "pe.rich_header.entries[1].build_number": 40116,
          "pe.rich_header.entries[1].product_name": "unknown",
          "pe.rich_header.entries[2].build_number": 40116,
          "pe.rich_header.entries[2].product_name": "unknown",
          "pe.section_characteristics[0].raw_size": 1024,
          "pe.section_characteristics[1].raw_size": 1536,
          "pe.section_characteristics[0].virtual_size": 680,
          "pe.section_characteristics[1].virtual_size": 1352,
          "pe.section_characteristics[0].virtual_address": 4096,
          "pe.section_characteristics[1].virtual_address": 8192,
          "pe.section_characteristics[0].characteristics_hex": "40000040",
          "pe.section_characteristics[1].characteristics_hex": "40000040"
        },
        "x": 5,
        "id": 0,
        "ms": {
          "pe": {
            "machine": 34404.0,
            "checksum": 55681.0,
            "has_pogo": true,
            "pdb_path": "wlanutil.pdb",
            "rsrc_size": 1536.0,
            "subsystem": 3.0,
            "timestamp": 1446172832.0,
            "image_base": 6442450944.0,
            "codeview_age": 1.0,
            "has_checksum": true,
            "rsrc_entropy": 3.01,
            "codeview_guid": "49CFAC0F-5D71-4B2E-A918-FD858D8C7794",
            "forward_ratio": 1.0,
            "size_of_image": 12288.0,
            "checksum_valid": true,
            "file_alignment": 512.0,
            "resource_count": 2.0,
            "resource_types": [
              "RT_VERSION"
            ],
            "characteristics": 8226.0,
            "entry_in_header": true,
            "has_rich_header": true,
            "size_of_headers": 1024.0,
            "export_timestamp": 1446169421.0,
            "has_version_info": true,
            "computed_checksum": 55681.0,
            "section_alignment": 4096.0,
            "resource_timestamp": 0.0,
            "debug_timestamp_max": 1446172832.0,
            "debug_timestamp_min": 1446172832.0,
            "dll_characteristics": 16736.0,
            "has_export_timestamp": true,
            "linker_major_version": 12.0,
            "linker_minor_version": 10.0,
            "debug_directory_types": [
              2.0,
              13.0
            ],
            "export_forwarder_count": 6.0,
            "has_resource_timestamp": false,
            "debug_directory_entries": 2.0,
            "number_of_rva_and_sizes": 16.0,
            "debug_timestamp_consistent": true,
            "debug_timestamp_unique_count": 1.0,
            "debug_timestamp_nonzero_count": 2.0
          },
          "file": {
            "size": 3584.0
          },
          "binary": {
            "data_entropy": 3.49,
            "export_count": 6.0,
            "string_count": 39.0,
            "section_count": 2.0,
            "overall_entropy": 3.25,
            "avg_section_size": 1280.0,
            "entropy_variance": 0.24,
            "avg_string_length": 19.23,
            "max_string_length": 46.0,
            "wide_string_count": 18.0,
            "avg_string_entropy": 3.43,
            "rsrc_to_file_ratio": 0.43,
            "string_length_stddev": 10.88,
            "debug_reference_count": 2.0,
            "largest_section_ratio": 0.43,
            "sentence_string_count": 4.0,
            "sentence_string_ratio": 0.1
          }
        },
        "ss": [
          [
            77,
            "!This program cannot be run in DOS mode."
          ],
          [
            464,
            ".rdata"
          ],
          [
            503,
            "@.rsrc"
          ],
          [
            1220,
            "wlanutil.dll"
          ],
          [
            1233,
            "WlanIsActiveConsoleUser"
          ],
          [
            1257,
            "wlanapi.WlanIsActiveConsoleUser"
          ],
          [
            1289,
            "WlanSignalValueToBar"
          ],
          [
            1310,
            "wlanapi.WlanSignalValueToBar"
          ],
          [
            1339,
            "WlanSsidToDisplayName"
          ],
          [
            1361,
            "wlanapi.WlanSsidToDisplayName"
          ],
          [
            1391,
            "WlanStringToSsid"
          ],
          [
            1408,
            "wlanapi.WlanStringToSsid"
          ],
          [
            1433,
            "WlanStringToUtf8Ssid"
          ],
          [
            1454,
            "wlanapi.WlanStringToUtf8Ssid"
          ],
          [
            1483,
            "WlanUtf8SsidToDisplayName"
          ],
          [
            1509,
            "wlanapi.WlanUtf8SsidToDisplayName"
          ],
          [
            1544,
            "RSDS"
          ],
          [
            1568,
            "wlanutil.pdb"
          ],
          [
            1604,
            "GCTL"
          ],
          [
            1632,
            ".edata"
          ],
          [
            1648,
            ".rdata$zzzdbg"
          ],
          [
            2230,
            "wide",
            "VS_VERSION_INFO"
          ],
          [
            2322,
            "wide",
            "StringFileInfo"
          ],
          [
            2382,
            "wide",
            "CompanyName"
          ],
          [
            2408,
            "wide",
            "Microsoft Corporation"
          ],
          [
            2458,
            "wide",
            "FileDescription"
          ],
          [
            2492,
            "wide",
            "Windows Wireless LAN 802.11 Utility DLL"
          ],
          [
            2578,
            "wide",
            "FileVersion"
          ],
          [
            2604,
            "wide",
            "10.0.10586.0 (th2_release.151029-1700)"
          ],
          [
            2690,
            "wide",
            "InternalName"
          ],
          [
            2716,
            "wide",
            "wlanutil.dll"
          ],
          [
            2750,
            "wide",
            "LegalCopyright"
          ],
          [
            2780,
            "wide",
            "© Microsoft Corporation. All rights reserved."
          ],
          [
            2878,
            "wide",
            "OriginalFilename"
          ],
          [
            2946,
            "wide",
            "ProductName"
          ],
          [
            2972,
            "wide",
            "Microsoft® Windows® Operating System"
          ],
          [
            3054,
            "wide",
            "ProductVersion"
          ],
          [
            3118,
            "wide",
            "VarFileInfo"
          ],
          [
            3150,
            "wide",
            "Translation"
          ]
        ],
        "sz": 3584,
        "ts": [
          {
            "d": ".dll extension reference",
            "e": [
              ".dll"
            ],
            "i": "micro-behaviors/fs/path/extension::dll-dup",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "PGO-trained release build (POGO)",
            "e": [
              "pe.has_pogo = 1.00"
            ],
            "i": "metadata/build/reproducible::pe-pgo-trained",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "High-entropy ASLR (64-bit)",
            "e": [
              "true"
            ],
            "i": "metadata/hardening/mitigation::pe-high-entropy-va",
            "l": 2
          },
          {
            "c": 0.699999988079071,
            "d": "PE FileDescription metadata field",
            "e": [
              "FileDescription"
            ],
            "i": "metadata/package/versioning::pe-filedescription-field",
            "l": 2
          },
          {
            "c": 0.800000011920929,
            "d": "Low-entropy rdata section",
            "e": [
              ".rdata (entropy: 3.49)"
            ],
            "i": "metadata/binary/section/metrics::low-entropy-rdata-section",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "PE ProductName metadata field",
            "e": [
              "ProductName"
            ],
            "i": "metadata/package/versioning::pe-productname-field",
            "l": 2
          },
          {
            "d": "Few detected functions (stub-like or analysis-limited)",
            "e": [
              "binary.func_count = 0.00"
            ],
            "i": "metadata/binary/metrics/structural::no-functions",
            "l": 2
          },
          {
            "c": 0.699999988079071,
            "d": "PE CompanyName metadata field",
            "e": [
              "CompanyName"
            ],
            "i": "metadata/package/versioning::pe-companyname-field",
            "l": 2
          },
          {
            "c": 0.8999999761581421,
            "d": "PE mapped image under 768 KiB",
            "e": [
              "pe.size_of_image = 12288.00"
            ],
            "i": "metadata/binary/layout::image-under-768kb",
            "l": 1
          },
          {
            "a": "T1027.007",
            "c": 1.0,
            "d": "WININET.DLL absent from PE import table",
            "e": [
              "pe.import_dll_count = 0.00"
            ],
            "i": "objectives/anti-static/obfuscation/imports::wininet-import-absent",
            "l": 2,
            "m": "B0032"
          },
          {
            "c": 0.8999999761581421,
            "d": "PE standard runtime section",
            "e": [
              ".rdata"
            ],
            "i": "metadata/binary/section/names::pe-runtime-standard-section",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Binary has low average string entropy",
            "e": [
              "binary.avg_string_entropy = 3.43"
            ],
            "i": "metadata/binary/metrics/threshold::avg-string-entropy-4-max",
            "l": 2
          },
          {
            "c": 0.8999999761581421,
            "d": "Microsoft vendor marker in resource section",
            "e": [
              "Microsoft Corporation"
            ],
            "i": "metadata/binary/vendor::microsoft-corp-marker-rsrc",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Binary has 4 or fewer sections",
            "e": [
              "binary.section_count = 2.00"
            ],
            "i": "objectives/command-and-control/infrastructure/config::max-sections-4",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "PE has few sections",
            "e": [
              "binary.section_count = 2.00"
            ],
            "i": "metadata/binary/layout::legacy-few-sections",
            "l": 2
          },
          {
            "a": "T1036.005",
            "c": 0.8999999761581421,
            "d": "Microsoft Corporation company in version info",
            "e": [
              "Microsoft Corporation"
            ],
            "i": "objectives/evasion/masquerade/version-resource/microsoft-utility::dw20-microsoft-company",
            "l": 1,
            "m": "F0004"
          },
          {
            "c": 0.800000011920929,
            "d": "Regex component marker",
            "e": [
              "wlanapi.WlanStringToSsid",
              "WlanStringToSsid",
              "WlanStringToUtf8Ssid",
              "wlanapi.WlanStringToUtf8Ssid",
              "StringFileInfo"
            ],
            "i": "micro-behaviors/communications/http/client/managed::webclient--rx-7",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "ASLR enabled (DYNAMIC_BASE)",
            "e": [
              "true"
            ],
            "i": "metadata/hardening/mitigation::pe-aslr",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "DEP / NX enabled (NX_COMPAT)",
            "e": [
              "true"
            ],
            "i": "metadata/hardening/mitigation::pe-dep",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "Tiny PE by file size",
            "e": [
              "pe.machine = 34404.00"
            ],
            "i": "metadata/binary/metrics/size::tiny-pe",
            "l": 3
          },
          {
            "a": "T1036.005",
            "c": 0.9700000286102295,
            "d": "Windows operating system product string",
            "e": [
              "Microsoft® Windows® Operating System"
            ],
            "i": "objectives/evasion/masquerade/version-resource/claim::getmac-product-string",
            "l": 1
          },
          {
            "a": "T1204.002",
            "c": 0.7599999904632568,
            "d": "Short PDB marker",
            "e": [
              "wlanutil.pdb"
            ],
            "i": "objectives/command-and-control/dropper/execution/clickfix::short-pdb-marker",
            "l": 1,
            "m": "B0024"
          },
          {
            "c": 0.699999988079071,
            "d": "PE with six or fewer imports",
            "e": [
              "binary.import_count = 0.00"
            ],
            "i": "metadata/binary/symbols/imports::pe-imports-max-six",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Control Flow Guard enabled",
            "e": [
              "true"
            ],
            "i": "metadata/hardening/mitigation::pe-cfg",
            "l": 2
          },
          {
            "a": "T1070.006",
            "c": 0.699999988079071,
            "d": "PE header compile timestamp predates 2025",
            "e": [
              "pe.timestamp = 1446172832.00"
            ],
            "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "PE imports from one DLL",
            "e": [
              "pe.import_dll_count = 0.00"
            ],
            "i": "metadata/binary/symbols/imports::pe-single-import-dll",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Binary has low average complexity",
            "e": [
              "binary.avg_complexity = 0.00"
            ],
            "i": "metadata/binary/metrics/threshold::avg-complexity-15-max",
            "l": 2
          },
          {
            "c": 0.8199999928474426,
            "d": "PE has DLL characteristics",
            "e": [
              "pe.characteristics = 8226.00"
            ],
            "i": "metadata/binary/metrics/pe-details::pe-dll-characteristics",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "Very low code entropy, minimal code",
            "e": [
              "binary.code_entropy = 0.00"
            ],
            "i": "metadata/binary/resource::low-code-entropy",
            "l": 2
          },
          {
            "a": "T1070.006",
            "c": 0.699999988079071,
            "d": "Debug timestamps internally consistent",
            "e": [
              "pe.debug_timestamp_consistent = 1.00"
            ],
            "i": "objectives/evasion/indicator-removal/timestamps::debug-timestamps-consistent",
            "l": 1
          },
          {
            "a": "T1055.012",
            "c": 1.0,
            "d": "Lacks substantial data section",
            "e": [
              "binary.data_to_file_ratio = 0.00"
            ],
            "i": "objectives/evasion/process/injection/hollowing::lacks-substantial-data",
            "l": 1,
            "m": "E1055.012"
          },
          {
            "a": "T1036.005",
            "c": 0.949999988079071,
            "d": "Microsoft company version identity",
            "e": [
              "Microsoft Corporation"
            ],
            "i": "objectives/evasion/masquerade/version-resource/contradiction::microsoft-company-versioninfo-kv",
            "l": 1
          },
          {
            "a": "T1027.003",
            "c": 0.9900000095367432,
            "d": "PE checksum mismatch",
            "e": [
              "pe.checksum_valid = 1.00"
            ],
            "i": "objectives/anti-static/obfuscation/payload/container::pe-checksum-mismatch-png",
            "l": 1,
            "m": "F0001.006"
          },
          {
            "c": 0.8999999761581421,
            "d": "High ratio of forwarded exports (\u003e80%)",
            "e": [
              "pe.forward_ratio = 1.00"
            ],
            "i": "metadata/binary/symbols/exports::high-forwarder-ratio",
            "l": 3
          },
          {
            "c": 0.699999988079071,
            "d": "PE OriginalFilename metadata field",
            "e": [
              "OriginalFilename"
            ],
            "i": "metadata/package/versioning::pe-originalfilename-field",
            "l": 2
          },
          {
            "c": 0.8999999761581421,
            "d": "PE resource section",
            "e": [
              ".rsrc"
            ],
            "i": "metadata/binary/section/names::pe-resource-section",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "PE InternalName metadata field",
            "e": [
              "InternalName"
            ],
            "i": "metadata/package/versioning::pe-internalname-field",
            "l": 2
          },
          {
            "c": 0.8999999761581421,
            "d": "PE Rich header present (MSVC toolchain)",
            "e": [
              "pe.has_rich_header = 1.00"
            ],
            "i": "metadata/binary/resource::rich-header-present",
            "l": 2
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "VB6 binary with very few strings",
            "e": [
              "binary.string_count = 39.00"
            ],
            "i": "objectives/anti-static/obfuscation/payload/string-sparse::low-string-count-vb6",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 1.0,
            "d": "File is a compiled binary",
            "e": [
              "242662"
            ],
            "i": "metadata/binary/framework::is-binary",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "PE first resource is RT_VERSION",
            "e": [
              "RT_VERSION"
            ],
            "i": "metadata/binary/resource::pe-resource-version-first",
            "l": 2
          },
          {
            "c": 0.8999999761581421,
            "d": "DLL exports five to ten APIs",
            "e": [
              "binary.export_count = 6.00"
            ],
            "i": "metadata/binary/symbols/exports::sideload-export-cluster-size-5-10",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "PE has exactly two resource entries",
            "e": [
              "pe.resource_count = 2.00"
            ],
            "i": "metadata/binary/resource::pe-resource-count-two",
            "l": 2
          },
          {
            "c": 0.800000011920929,
            "d": "Tiny PE single-function stub",
            "e": [
              "binary.func_count = 0.00"
            ],
            "i": "metadata/binary/layout::tiny-single-function-pe",
            "l": 3
          },
          {
            "c": 0.8999999761581421,
            "d": "Binary has low overall entropy",
            "e": [
              "binary.overall_entropy = 3.25"
            ],
            "i": "metadata/binary/metrics/threshold::low-overall-entropy-binary",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "PE has under ten imports",
            "e": [
              "binary.import_count = 0.00"
            ],
            "i": "objectives/anti-static/pack/runtime::pe-import-count-under-10",
            "l": 1
          },
          {
            "a": "T1036.005",
            "c": 0.9700000286102295,
            "d": "Console subsystem on dw20 claim",
            "e": [
              "pe.subsystem = 3.00"
            ],
            "i": "objectives/evasion/masquerade/version-resource/microsoft-utility::dw20-cui-subsystem",
            "l": 1,
            "m": "F0004"
          },
          {
            "c": 0.699999988079071,
            "d": "PE has low overall entropy",
            "e": [
              "binary.overall_entropy = 3.25"
            ],
            "i": "metadata/binary/layout::low-overall-entropy",
            "l": 2
          },
          {
            "a": "T1027",
            "c": 0.699999988079071,
            "d": "Zero recovered functions",
            "e": [
              "binary.func_count = 0.00"
            ],
            "i": "objectives/anti-static/obfuscation/payload/encrypted::zero-function-count",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.800000011920929,
            "d": "Small PE resource section",
            "e": [
              "pe.rsrc_size = 1536.00"
            ],
            "i": "metadata/package/versioning::pe-small-rsrc",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "Import count is exactly zero",
            "e": [
              "binary.import_count = 0.00"
            ],
            "i": "objectives/evasion/masquerade/identity/vendor::zero-import-count",
            "l": 2
          },
          {
            "c": 0.7799999713897705,
            "d": "Lowercase random PDB basename",
            "e": [
              "wlanutil.pdb"
            ],
            "i": "metadata/binary/debug::pdb-random-basename",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.9900000095367432,
            "d": "PE version resource text",
            "e": [
              "VS_VERSION_INFO"
            ],
            "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1036.005",
            "c": 0.9700000286102295,
            "d": "PE has no Authenticode signature",
            "e": [
              "binary.has_signature = 0.00"
            ],
            "i": "objectives/evasion/masquerade/version-resource/microsoft-utility::dw20-host-unsigned",
            "l": 1,
            "m": "F0004"
          },
          {
            "c": 0.949999988079071,
            "d": "PE version info numeric fields present",
            "e": [
              "10.0.10586.0 (th2_release.151029-1700)"
            ],
            "i": "metadata/binary/anomaly/format::version-info-file-version-present",
            "l": 1
          },
          {
            "c": 0.8500000238418579,
            "d": "PE checksum field not set",
            "e": [
              "pe.has_checksum = 1.00"
            ],
            "i": "metadata/binary/layout::pe-checksum-absent",
            "l": 1
          },
          {
            "a": "T1105",
            "c": 0.800000011920929,
            "d": "Compact PE import table",
            "e": [
              "binary.import_count = 0.00"
            ],
            "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table",
            "l": 1,
            "m": "E1105"
          },
          {
            "c": 0.699999988079071,
            "d": "No imported symbols",
            "e": [
              "binary.import_density = 0.00"
            ],
            "i": "metadata/binary/metrics/structural::no-imports",
            "l": 3
          },
          {
            "a": "T1612",
            "c": 0.8500000238418579,
            "d": "PE has few icon resources",
            "e": [
              "pe.icon_count = 0.00"
            ],
            "i": "objectives/anti-static/obfuscation/payload/resource::icon-count-under-six",
            "l": 1,
            "m": "B0023"
          },
          {
            "a": "T1055",
            "c": 0.9200000166893005,
            "d": "Regex component marker",
            "e": [
              "binary.import_count = 0.00"
            ],
            "i": "objectives/evasion/process/injection/vb6::vb6-process-injection-pattern-cond-1--inline-17571",
            "l": 1,
            "m": "C0041"
          },
          {
            "a": "T1027",
            "c": 0.800000011920929,
            "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)",
            "e": [
              "pe.resource_count = 2.00"
            ],
            "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "Claims Microsoft Corp in version resource",
            "e": [
              "Microsoft Corporation",
              "Microsoft Corporation."
            ],
            "i": "metadata/binary/vendor::microsoft-corp-versioninfo",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Binary is not digitally signed",
            "e": [
              "binary.has_signature = 0.00"
            ],
            "i": "metadata/signed/trust-level::unsigned",
            "l": 3
          },
          {
            "a": "T1070.006",
            "c": 0.8999999761581421,
            "d": "Export directory timestamp set to 0xFFFFFFFF (tampered)",
            "e": [
              "pe.export_timestamp = 1446169421.00"
            ],
            "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-maxval",
            "l": 1
          },
          {
            "c": 0.9900000095367432,
            "d": "Pure proxy DLL (100% forwarded exports)",
            "e": [
              "pe.forward_ratio = 1.00"
            ],
            "i": "metadata/binary/symbols/exports::pure-proxy-dll",
            "l": 2
          },
          {
            "c": 0.6000000238418579,
            "d": "Very few sections (merged/stripped)",
            "e": [
              "binary.section_count = 2.00"
            ],
            "i": "metadata/binary/metrics/structural::few-sections",
            "l": 3
          },
          {
            "c": 0.800000011920929,
            "d": "PE executable is unsigned",
            "e": [
              "binary.has_signature = 0.00"
            ],
            "i": "metadata/signed/trust-level::unsigned-pe-executable",
            "l": 3
          },
          {
            "c": 0.8600000143051147,
            "d": "Low-code PE with no imports",
            "e": [
              "binary.import_density = 0.00",
              "binary.code_entropy = 0.00"
            ],
            "i": "metadata/binary/resource::low-code-no-import-resource-stub",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Modern PE hardening (ASLR + DEP + CFG)",
            "e": [
              "true"
            ],
            "i": "metadata/hardening/mitigation::pe-modern-hardening",
            "l": 2
          },
          {
            "c": 0.8999999761581421,
            "d": "PE file consisting primarily of resources (e.g., .mui, UI localization)",
            "e": [
              "binary.func_count = 0.00",
              "binary.code_entropy = 0.00",
              "binary.import_density = 0.00"
            ],
            "i": "metadata/binary/resource::resource-only-dll",
            "l": 2
          }
        ],
        "sha": "ba2558841d2fbbcd9fa4e36218f11ea8759f1a194811604367aa4639026bdc81",
        "path": "/data/samples/good/datasets/pe-machine-learning-dataset/242662",
        "type": "pe"
      }
    ],
    "tv": "6a383"
  }
}