{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 0.9815003871917725,
        "class": 1
      }
    ],
    "prob": 0.9815004,
    "class": 1,
    "oprob": 0.8553412,
    "oclass": 0,
    "version": "v16.16",
    "thresholds": [
      0.9815004,
      0.99404883
    ],
    "analyzed_at": "2026-05-02T10:58:13Z"
  },
  "path": "25055",
  "raw": {
    "v": "4",
    "fs": [
      {
        "f": "KO₄(As₇C₃ErI)H₃(DbDsF)Md(Bi₄)",
        "x": 42,
        "id": 0,
        "is": [
          "RtlMoveMemory",
          "rtcCos",
          "MethCallEngine",
          "rtcLowerCaseBstr",
          "rtcLowerCaseVar",
          "rtcEnvironVar",
          "rtcRandomNext",
          "rtcRandomize",
          "rtcTrimVar",
          "rtcInStrRev",
          "rtcMidCharBstr",
          "rtcMidCharVar",
          "rtcSpaceVar",
          "EVENT_SINK_AddRef",
          "rtcUpperCaseBstr",
          "rtcKillFiles",
          "DllFunctionCall",
          "EVENT_SINK_Release",
          "EVENT_SINK_QueryInterface",
          "vbaExceptHandler",
          "rtcSplit",
          "rtcReplace",
          "rtcStringBstr",
          "rtcStringVar",
          "rtcVarBstrFromAnsi",
          "rtcStrConvVar2",
          "ProcCallEngine",
          "VarPtr",
          "rtcBstrFromAnsi",
          "rtcFileLength",
          "rtcFreeFile",
          "rtcHexVarFromVar",
          "rtcErrObj",
          "ThunRTMain",
          "rtcLeftCharBstr",
          "rtcLeftCharVar",
          "rtcRightCharBstr",
          "rtcRightCharVar",
          "rtcSetFileAttr"
        ],
        "ms": {
          "binary": {
            "code_size": 49152.0,
            "file_size": 57344.0,
            "import_count": 39.0,
            "string_count": 43.0,
            "section_count": 3.0,
            "avg_complexity": 9.6,
            "function_count": 5.0,
            "import_density": 0.81,
            "max_complexity": 41.0,
            "string_density": 0.9,
            "overall_entropy": 4.88,
            "avg_basic_blocks": 14.8,
            "avg_section_size": 17749.33,
            "function_density": 0.1,
            "avg_function_size": 101.8,
            "avg_string_length": 13.19,
            "complexity_per_kb": 0.2,
            "max_string_length": 53.0,
            "wide_string_count": 12.0,
            "writable_sections": 1.0,
            "avg_string_entropy": 3.11,
            "code_section_ratio": 0.33,
            "code_to_data_ratio": 12.0,
            "rsrc_to_file_ratio": 0.07,
            "text_to_file_ratio": 0.86,
            "total_basic_blocks": 74.0,
            "executable_sections": 1.0,
            "section_name_entropy": 3.01,
            "string_length_stddev": 8.76,
            "largest_section_ratio": 0.86,
            "sentence_string_count": 1.0,
            "sentence_string_ratio": 0.02,
            "function_analysis_depth": 2.0,
            "has_malformed_structure": true,
            "normalized_import_count": 0.16,
            "normalized_section_count": 0.19
          }
        },
        "ss": [
          [
            77,
            "!This program cannot be run in DOS mode."
          ],
          [
            152,
            "Rich"
          ],
          [
            424,
            ".text"
          ],
          [
            504,
            ".rsrc"
          ],
          [
            576,
            "KERNEL32.DLL"
          ],
          [
            589,
            "NTDLL.DLL"
          ],
          [
            599,
            "MSVBVM60.DLL"
          ],
          [
            4820,
            "vvwoGsIi"
          ],
          [
            10452,
            "Form"
          ],
          [
            10476,
            "jHAUdyNrGlulAfTLVEiGzSgoXcYRwjKKINiNpKmQnqQInvCbjIeOG"
          ],
          [
            11740,
            "kernel32"
          ],
          [
            11756,
            "Process32Next"
          ],
          [
            11896,
            "wsock32"
          ],
          [
            11908,
            "gethostbyname"
          ],
          [
            12048,
            "user32"
          ],
          [
            12060,
            "CallWindowProcW"
          ],
          [
            12200,
            "GetModuleFileNameW"
          ],
          [
            12344,
            "GetProcAddress"
          ],
          [
            12484,
            "LoadLibraryW"
          ],
          [
            12676,
            "omOsjEhe"
          ],
          [
            13884,
            "KERNEL32"
          ],
          [
            13896,
            "RtlMoveMemory"
          ],
          [
            14282,
            "CMwlZxpIVPiaVpDU"
          ],
          [
            15897,
            "UDGF"
          ],
          [
            52498,
            "MethCallEngine"
          ],
          [
            52516,
            "EVENT_SINK_AddRef"
          ],
          [
            52536,
            "DllFunctionCall"
          ],
          [
            52554,
            "EVENT_SINK_Release"
          ],
          [
            52576,
            "EVENT_SINK_QueryInterface"
          ],
          [
            52604,
            "__vbaExceptHandler"
          ],
          [
            52626,
            "ProcCallEngine"
          ],
          [
            53590,
            "wide",
            "VS_VERSION_INFO"
          ],
          [
            53682,
            "wide",
            "VarFileInfo"
          ],
          [
            53714,
            "wide",
            "Translation"
          ],
          [
            53750,
            "wide",
            "StringFileInfo"
          ],
          [
            53810,
            "wide",
            "ProductName"
          ],
          [
            53836,
            "wide",
            "vvwoGsIi"
          ],
          [
            53862,
            "wide",
            "FileVersion"
          ],
          [
            53888,
            "wide",
            "9.12"
          ],
          [
            53906,
            "wide",
            "ProductVersion"
          ],
          [
            53954,
            "wide",
            "InternalName"
          ],
          [
            54006,
            "wide",
            "OriginalFilename"
          ],
          [
            54040,
            "wide",
            "vvwoGsIi.exe"
          ]
        ],
        "sz": 57344,
        "ts": [
          {
            "a": "T1027",
            "c": 0.30000001192092896,
            "d": "PE header too corrupted to parse: Malformed entity: ResourceString value_len (79) exceeds available bytes (28)",
            "e": [
              "Malformed entity: ResourceString value_len (79) exceeds available bytes (28)"
            ],
            "i": "objectives/anti-analysis/pe-tampering/corrupted-header",
            "l": 2,
            "m": "B0001"
          },
          {
            "c": 0.800000011920929,
            "d": "PE version resource structure",
            "e": [
              "VS_VERSION_INFO"
            ],
            "i": "metadata/package/versioning::pe-version-resource",
            "l": 2
          },
          {
            "c": 0.9900000095367432,
            "d": "MSVBVM60 runtime marker",
            "e": [
              "MSVBVM60.DLL"
            ],
            "i": "well-known/malware/trojan/shellobject::msvbvm60-runtime",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "Get module file path",
            "e": [
              "GetModuleFileNameW"
            ],
            "i": "micro-behaviors/os/module/load::get-module-filename-dup",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "Binary has 3+ functions",
            "e": [
              "binary.function_count = 5.00"
            ],
            "i": "metadata/binary/metrics::few-functions-3",
            "l": 1
          },
          {
            "c": 0.9900000095367432,
            "d": "MSVBVM60 runtime marker",
            "e": [
              "MSVBVM60.DLL"
            ],
            "i": "well-known/malware/worm/ludbaruma::msvbvm60-runtime",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "PE standard code/data section",
            "e": [
              ".text",
              ".data"
            ],
            "i": "metadata/binary/section/names::pe-code-data-standard-section",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "OriginalFilename field marker",
            "e": [
              "OriginalFilename"
            ],
            "i": "well-known/malware/worm/ludbaruma::originalfilename-field",
            "l": 1
          },
          {
            "a": "T1055",
            "c": 0.8799999952316284,
            "d": "Go RtlMoveMemory API name",
            "e": [
              "RtlMoveMemory"
            ],
            "i": "objectives/evasion/process/injection/shellcode::go-rtlmovememory-api",
            "l": 1,
            "m": "B0033"
          },
          {
            "c": 1.0,
            "d": "Binary has 4 or fewer sections",
            "e": [
              "binary.section_count = 3.00"
            ],
            "i": "objectives/command-and-control/infrastructure/config::max-sections-4",
            "l": 1
          },
          {
            "c": 0.9399999976158142,
            "d": "VB6 runtime DLL reference",
            "e": [
              "MSVBVM60.DLL"
            ],
            "i": "metadata/binary/framework::vb6-runtime-dll",
            "l": 2
          },
          {
            "c": 0.8999999761581421,
            "d": "VB6 event sink helper",
            "e": [
              "EVENT_SINK_AddRef",
              "EVENT_SINK_Release",
              "EVENT_SINK_QueryInterface"
            ],
            "i": "metadata/binary/framework::vb6-runtime-event-helper",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "File is a compiled binary",
            "e": [
              "binary.file_size = 57344.00"
            ],
            "i": "metadata/binary/framework::is-binary",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Binary has low average complexity",
            "e": [
              "binary.avg_complexity = 9.60"
            ],
            "i": "metadata/binary/metrics::avg-complexity-15-max",
            "l": 2
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "VB6 string conversion helper",
            "e": [
              "rtcStrConvVar2"
            ],
            "i": "micro-behaviors/data/string/operations::vb6-string-conversion-helper",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.8399999737739563,
            "d": "VB6 PE with three sections",
            "e": [
              "binary.section_count = 3.00"
            ],
            "i": "objectives/anti-static/obfuscation/payload::three-section-vb6-layout",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 1.0,
            "d": "Binary is not position-independent (fixed load address)",
            "e": [
              "binary.is_pie = 0.00"
            ],
            "i": "metadata/hardening::no-pie",
            "l": 2
          },
          {
            "c": 0.8999999761581421,
            "d": "VB6 runtime entrypoint marker",
            "e": [
              "ThunRTMain"
            ],
            "i": "metadata/binary/framework::vb6-runtime-entry",
            "l": 2
          },
          {
            "c": 0.75,
            "d": "Binary exports no symbols",
            "e": [
              "binary.export_count = 0.00"
            ],
            "i": "metadata/binary/symbols::no-exports",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Binary has low average string entropy",
            "e": [
              "binary.avg_string_entropy = 3.11"
            ],
            "i": "metadata/binary/metrics::avg-string-entropy-4-max",
            "l": 2
          },
          {
            "c": 0.699999988079071,
            "d": "PE has low overall entropy",
            "e": [
              "binary.overall_entropy = 4.88"
            ],
            "i": "metadata/binary/layout::low-overall-entropy",
            "l": 2
          },
          {
            "a": "T1106",
            "c": 0.8799999952316284,
            "d": "Call window procedure",
            "e": [
              "CallWindowProcW"
            ],
            "i": "micro-behaviors/ui/window/manage::call-window-proc",
            "l": 2
          },
          {
            "c": 0.8999999761581421,
            "d": "VB6 random number helper",
            "e": [
              "rtcRandomNext"
            ],
            "i": "micro-behaviors/os/random/generator::vb6-rtc-random-next",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "ProductVersion field marker",
            "e": [
              "ProductVersion"
            ],
            "i": "well-known/malware/worm/ludbaruma::productversion-field",
            "l": 1
          },
          {
            "c": 0.9800000190734863,
            "d": "user32 dynamic dispatch target",
            "e": [
              "user32"
            ],
            "i": "well-known/malware/trojan/shellobject/hijack::user32-dispatch-target",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "FileVersion field marker",
            "e": [
              "FileVersion"
            ],
            "i": "well-known/malware/worm/ludbaruma::fileversion-field",
            "l": 1
          },
          {
            "a": "T1027",
            "c": 0.9900000095367432,
            "d": "PE version resource text",
            "e": [
              "VS_VERSION_INFO"
            ],
            "i": "objectives/anti-static/obfuscation/payload/section::anydesk-version-info",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.9200000166893005,
            "d": "VB6 rtcVarBstrFromAnsi string builder",
            "e": [
              "rtcVarBstrFromAnsi"
            ],
            "i": "micro-behaviors/data/string/operations::vb6-string-construction-bstr",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.9399999976158142,
            "d": "VB6 DllFunctionCall thunk",
            "e": [
              "DllFunctionCall"
            ],
            "i": "micro-behaviors/dylib/lookup::vb6-dll-function-call",
            "l": 3
          },
          {
            "c": 0.699999988079071,
            "d": "gethostbyname import string",
            "e": [
              "gethostbyname"
            ],
            "i": "micro-behaviors/communications/ip/resolve::resolve-gethostbyname-import",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "Binary has 30+ imports",
            "e": [
              "binary.import_count = 39.00"
            ],
            "i": "metadata/binary/metrics::many-imports-30",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "Very low code entropy, minimal code",
            "e": [
              "binary.code_entropy = 0.00"
            ],
            "i": "metadata/binary/resource::low-code-entropy",
            "l": 2
          },
          {
            "c": 0.800000011920929,
            "d": "Tiny writable data section",
            "e": [
              ".data (size: 0)"
            ],
            "i": "metadata/binary/section/metrics::tiny-data-section",
            "l": 1
          },
          {
            "c": 0.8799999952316284,
            "d": "VB6 file length helper alias",
            "e": [
              "rtcFileLength"
            ],
            "i": "micro-behaviors/fs/file/read::vb6-rtcfilelength",
            "l": 2
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "VB6 string split helper",
            "e": [
              "rtcSplit"
            ],
            "i": "micro-behaviors/data/string/operations::vb6-split-helper",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.8500000238418579,
            "d": "Large zero-entropy placeholder section",
            "e": [
              ".rsrc (size: 4096, entropy: 0.00, perms: -r--)"
            ],
            "i": "metadata/binary/section/metrics::null-placeholder-section",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "Binary has 25+ imports",
            "e": [
              "binary.import_count = 39.00"
            ],
            "i": "metadata/binary/metrics::many-imports-25",
            "l": 1
          },
          {
            "c": 0.4000000059604645,
            "d": "Very few functions detected",
            "e": [
              "binary.function_count = 5.00"
            ],
            "i": "metadata/binary/metrics::few-functions",
            "l": 2
          },
          {
            "a": "T1027",
            "c": 0.699999988079071,
            "d": "Code section dominates file layout",
            "e": [
              "binary.largest_section_ratio = 0.86"
            ],
            "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "VB6 left string helper",
            "e": [
              "rtcLeftCharVar"
            ],
            "i": "micro-behaviors/data/string/operations::vb6-left-string-helper",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "VB6 substring extraction helper",
            "e": [
              "rtcMidCharBstr"
            ],
            "i": "micro-behaviors/data/string/operations::vb6-substring-helper",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.8999999761581421,
            "d": "PE resource section",
            "e": [
              ".rsrc"
            ],
            "i": "metadata/binary/section/names::pe-resource-section",
            "l": 1
          },
          {
            "c": 0.8999999761581421,
            "d": "Binary has low overall entropy",
            "e": [
              "binary.overall_entropy = 4.88"
            ],
            "i": "metadata/binary/metrics::low-overall-entropy-binary",
            "l": 1
          },
          {
            "c": 0.8799999952316284,
            "d": "VB6 free file handle helper",
            "e": [
              "rtcFreeFile"
            ],
            "i": "micro-behaviors/fs/file/read::vb6-rtcfreefile",
            "l": 2
          },
          {
            "c": 0.8999999761581421,
            "d": "VB6 randomize helper",
            "e": [
              "rtcRandomize"
            ],
            "i": "micro-behaviors/os/random/generator::vb6-rtc-randomize",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "Binary has 20+ imports",
            "e": [
              "binary.import_count = 39.00"
            ],
            "i": "metadata/binary/metrics::many-imports-20",
            "l": 1
          },
          {
            "c": 0.699999988079071,
            "d": "PE ProductVersion metadata field",
            "e": [
              "ProductVersion"
            ],
            "i": "metadata/package/versioning::pe-productversion-field",
            "l": 2
          },
          {
            "c": 0.699999988079071,
            "d": "PE has few sections",
            "e": [
              "binary.section_count = 3.00"
            ],
            "i": "metadata/binary/layout::legacy-few-sections",
            "l": 2
          },
          {
            "c": 0.699999988079071,
            "d": "PE FileVersion metadata field",
            "e": [
              "FileVersion"
            ],
            "i": "metadata/package/versioning::pe-fileversion-field",
            "l": 2
          },
          {
            "a": "T1027",
            "c": 0.8199999928474426,
            "d": "Packed loader largest section ratio above 0.65",
            "e": [
              "binary.largest_section_ratio = 0.86"
            ],
            "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1620",
            "c": 0.8999999761581421,
            "d": "GetProcAddress loader API string",
            "e": [
              "GetProcAddress"
            ],
            "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-getprocaddress-string",
            "l": 1,
            "m": "B0030"
          },
          {
            "a": "T1105",
            "c": 0.800000011920929,
            "d": "Compact PE import table",
            "e": [
              "binary.import_count = 39.00"
            ],
            "i": "objectives/command-and-control/dropper/delivery/download-execute::compact-import-table",
            "l": 1,
            "m": "E1105"
          },
          {
            "a": "T1027",
            "c": 0.8600000143051147,
            "d": "Long mixed-case identifiers cluster",
            "e": [
              "GetModuleFileNameW"
            ],
            "i": "objectives/anti-static/obfuscation/string::long-mixedcase-identifiers",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1489",
            "c": 0.699999988079071,
            "d": "Versioned service stop context",
            "e": [
              "VS_VERSION_INFO"
            ],
            "i": "objectives/impact/services/stop::versioned-service-stop-context",
            "l": 1
          },
          {
            "c": 0.6000000238418579,
            "d": "Very few sections (merged/stripped)",
            "e": [
              "binary.section_count = 3.00"
            ],
            "i": "metadata/binary/metrics::few-sections",
            "l": 2
          },
          {
            "c": 0.8999999761581421,
            "d": "Tiny C string section ratio",
            "e": [
              " = 0.0% of total (0 / 57344 bytes)"
            ],
            "i": "metadata/binary/section/metrics::tiny-cstring-section",
            "l": 1
          },
          {
            "d": ".exe extension reference",
            "e": [
              ".exe"
            ],
            "i": "micro-behaviors/fs/path/extension::exe-dup",
            "l": 1
          },
          {
            "a": "T1027.007",
            "c": 0.800000011920929,
            "d": "DLL name strings without LoadLibrary import",
            "e": [
              "binary.import_count = 39.00"
            ],
            "i": "objectives/anti-static/obfuscation/string/runtime-decrypt::dll-names-no-loadlibrary",
            "l": 1,
            "m": "B0032.014"
          },
          {
            "c": 0.8500000238418579,
            "d": "PE with malformed section layout",
            "e": [
              "binary.has_malformed_structure = 1.00"
            ],
            "i": "metadata/binary/metrics::malformed-pe-structure",
            "l": 3
          },
          {
            "a": "T1027",
            "c": 0.9200000166893005,
            "d": "Zero-entropy executable section (carved/packed PE)",
            "e": [
              ".text (size: 49152, entropy: 0.00, perms: -r-x)"
            ],
            "i": "objectives/anti-static/obfuscation/binary-metrics::zero-entropy-executable-section",
            "l": 4,
            "m": "B0032"
          },
          {
            "c": 1.0,
            "d": "Binary is not digitally signed",
            "e": [
              "binary.has_signature = 0.00"
            ],
            "i": "metadata/signed::unsigned",
            "l": 2
          },
          {
            "c": 0.949999988079071,
            "d": "links KERNEL32.DLL (RtlMoveMemory)",
            "e": [
              "KERNEL32.DLL"
            ],
            "i": "metadata/dylib::kernel32/dll",
            "l": 2
          },
          {
            "c": 0.949999988079071,
            "d": "links MSVBVM60.DLL (rtcCos, MethCallEngine, rtcLowerCaseBstr, rtcLowerCaseVar, rtcEnvironVar, ... +33 more)",
            "e": [
              "MSVBVM60.DLL"
            ],
            "i": "metadata/dylib::msvbvm60/dll",
            "l": 2
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "VB6 runtime string decoding helpers",
            "e": [
              "rtcVarBstrFromAnsi",
              "rtcSplit",
              "rtcLeftCharVar",
              "rtcStrConvVar2",
              "rtcMidCharBstr"
            ],
            "i": "micro-behaviors/data/string/operations::vb6-runtime-string-decoding",
            "l": 3,
            "m": "B0032"
          },
          {
            "c": 0.9200000166893005,
            "d": "VB6 runtime PRNG helpers",
            "e": [
              "rtcRandomNext",
              "rtcRandomize"
            ],
            "i": "micro-behaviors/os/random/generator::vb6-runtime-prng",
            "l": 2
          },
          {
            "c": 0.8999999761581421,
            "d": "PE version resource metadata",
            "e": [
              "FileVersion",
              "VS_VERSION_INFO",
              "ProductVersion"
            ],
            "i": "metadata/package/versioning::version-resource-metadata",
            "l": 2
          },
          {
            "c": 0.949999988079071,
            "d": "Visual Basic 6 application framework",
            "e": [
              "EVENT_SINK_AddRef",
              "MSVBVM60.DLL",
              "ThunRTMain",
              "EVENT_SINK_Release",
              "EVENT_SINK_QueryInterface"
            ],
            "i": "metadata/binary/framework::vb6-application-framework",
            "l": 2
          },
          {
            "c": 0.8999999761581421,
            "d": "VB6 file I/O helper cluster",
            "e": [
              "rtcFreeFile",
              "rtcFileLength"
            ],
            "i": "micro-behaviors/fs/file/read::vb6-file-io-helpers",
            "l": 2
          },
          {
            "c": 0.949999988079071,
            "d": "VB6 runtime API dispatch",
            "e": [
              "ThunRTMain",
              "MSVBVM60.DLL",
              "EVENT_SINK_QueryInterface",
              "EVENT_SINK_AddRef",
              "EVENT_SINK_Release",
              "DllFunctionCall"
            ],
            "i": "micro-behaviors/dylib/lookup::vb6-runtime-api-dispatch",
            "l": 3
          },
          {
            "a": "T1027",
            "c": 0.8999999761581421,
            "d": "VB6 concealed Win32 API dispatch",
            "e": [
              "EVENT_SINK_QueryInterface",
              "rtcLeftCharVar",
              "rtcFreeFile",
              "ThunRTMain",
              "gethostbyname",
              "rtcRandomNext",
              "DllFunctionCall",
              "EVENT_SINK_AddRef",
              "rtcVarBstrFromAnsi",
              "rtcFileLength",
              "EVENT_SINK_Release",
              "rtcSplit",
              "rtcStrConvVar2",
              "rtcRandomize",
              "rtcMidCharBstr",
              "MSVBVM60.DLL"
            ],
            "i": "objectives/anti-static/obfuscation/imports::vb6-concealed-win32-apis",
            "l": 4,
            "m": "B0032"
          }
        ],
        "sha": "ba7150a412371e949e4c8ba902db15f606979da92839ba695ab6cb364db9b01f",
        "path": "/data/samples/bad/datasets/pe-machine-learning-dataset/25055",
        "type": "pe"
      }
    ],
    "tv": "7e897"
  }
}